xref: /linux/net/ipv6/ip6mr.c (revision a33f32244d8550da8b4a26e277ce07d5c6d158b5)
1 /*
2  *	Linux IPv6 multicast routing support for BSD pim6sd
3  *	Based on net/ipv4/ipmr.c.
4  *
5  *	(c) 2004 Mickael Hoerdt, <hoerdt@clarinet.u-strasbg.fr>
6  *		LSIIT Laboratory, Strasbourg, France
7  *	(c) 2004 Jean-Philippe Andriot, <jean-philippe.andriot@6WIND.com>
8  *		6WIND, Paris, France
9  *	Copyright (C)2007,2008 USAGI/WIDE Project
10  *		YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
11  *
12  *	This program is free software; you can redistribute it and/or
13  *	modify it under the terms of the GNU General Public License
14  *	as published by the Free Software Foundation; either version
15  *	2 of the License, or (at your option) any later version.
16  *
17  */
18 
19 #include <asm/system.h>
20 #include <asm/uaccess.h>
21 #include <linux/types.h>
22 #include <linux/sched.h>
23 #include <linux/errno.h>
24 #include <linux/timer.h>
25 #include <linux/mm.h>
26 #include <linux/kernel.h>
27 #include <linux/fcntl.h>
28 #include <linux/stat.h>
29 #include <linux/socket.h>
30 #include <linux/inet.h>
31 #include <linux/netdevice.h>
32 #include <linux/inetdevice.h>
33 #include <linux/proc_fs.h>
34 #include <linux/seq_file.h>
35 #include <linux/init.h>
36 #include <linux/slab.h>
37 #include <net/protocol.h>
38 #include <linux/skbuff.h>
39 #include <net/sock.h>
40 #include <net/raw.h>
41 #include <linux/notifier.h>
42 #include <linux/if_arp.h>
43 #include <net/checksum.h>
44 #include <net/netlink.h>
45 
46 #include <net/ipv6.h>
47 #include <net/ip6_route.h>
48 #include <linux/mroute6.h>
49 #include <linux/pim.h>
50 #include <net/addrconf.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <net/ip6_checksum.h>
53 
54 /* Big lock, protecting vif table, mrt cache and mroute socket state.
55    Note that the changes are semaphored via rtnl_lock.
56  */
57 
58 static DEFINE_RWLOCK(mrt_lock);
59 
60 /*
61  *	Multicast router control variables
62  */
63 
64 #define MIF_EXISTS(_net, _idx) ((_net)->ipv6.vif6_table[_idx].dev != NULL)
65 
66 static struct mfc6_cache *mfc_unres_queue;		/* Queue of unresolved entries */
67 
68 /* Special spinlock for queue of unresolved entries */
69 static DEFINE_SPINLOCK(mfc_unres_lock);
70 
71 /* We return to original Alan's scheme. Hash table of resolved
72    entries is changed only in process context and protected
73    with weak lock mrt_lock. Queue of unresolved entries is protected
74    with strong spinlock mfc_unres_lock.
75 
76    In this case data path is free of exclusive locks at all.
77  */
78 
79 static struct kmem_cache *mrt_cachep __read_mostly;
80 
81 static int ip6_mr_forward(struct sk_buff *skb, struct mfc6_cache *cache);
82 static int ip6mr_cache_report(struct net *net, struct sk_buff *pkt,
83 			      mifi_t mifi, int assert);
84 static int ip6mr_fill_mroute(struct sk_buff *skb, struct mfc6_cache *c, struct rtmsg *rtm);
85 static void mroute_clean_tables(struct net *net);
86 
87 static struct timer_list ipmr_expire_timer;
88 
89 
90 #ifdef CONFIG_PROC_FS
91 
92 struct ipmr_mfc_iter {
93 	struct seq_net_private p;
94 	struct mfc6_cache **cache;
95 	int ct;
96 };
97 
98 
99 static struct mfc6_cache *ipmr_mfc_seq_idx(struct net *net,
100 					   struct ipmr_mfc_iter *it, loff_t pos)
101 {
102 	struct mfc6_cache *mfc;
103 
104 	it->cache = net->ipv6.mfc6_cache_array;
105 	read_lock(&mrt_lock);
106 	for (it->ct = 0; it->ct < MFC6_LINES; it->ct++)
107 		for (mfc = net->ipv6.mfc6_cache_array[it->ct];
108 		     mfc; mfc = mfc->next)
109 			if (pos-- == 0)
110 				return mfc;
111 	read_unlock(&mrt_lock);
112 
113 	it->cache = &mfc_unres_queue;
114 	spin_lock_bh(&mfc_unres_lock);
115 	for (mfc = mfc_unres_queue; mfc; mfc = mfc->next)
116 		if (net_eq(mfc6_net(mfc), net) &&
117 		    pos-- == 0)
118 			return mfc;
119 	spin_unlock_bh(&mfc_unres_lock);
120 
121 	it->cache = NULL;
122 	return NULL;
123 }
124 
125 
126 
127 
128 /*
129  *	The /proc interfaces to multicast routing /proc/ip6_mr_cache /proc/ip6_mr_vif
130  */
131 
132 struct ipmr_vif_iter {
133 	struct seq_net_private p;
134 	int ct;
135 };
136 
137 static struct mif_device *ip6mr_vif_seq_idx(struct net *net,
138 					    struct ipmr_vif_iter *iter,
139 					    loff_t pos)
140 {
141 	for (iter->ct = 0; iter->ct < net->ipv6.maxvif; ++iter->ct) {
142 		if (!MIF_EXISTS(net, iter->ct))
143 			continue;
144 		if (pos-- == 0)
145 			return &net->ipv6.vif6_table[iter->ct];
146 	}
147 	return NULL;
148 }
149 
150 static void *ip6mr_vif_seq_start(struct seq_file *seq, loff_t *pos)
151 	__acquires(mrt_lock)
152 {
153 	struct net *net = seq_file_net(seq);
154 
155 	read_lock(&mrt_lock);
156 	return *pos ? ip6mr_vif_seq_idx(net, seq->private, *pos - 1)
157 		: SEQ_START_TOKEN;
158 }
159 
160 static void *ip6mr_vif_seq_next(struct seq_file *seq, void *v, loff_t *pos)
161 {
162 	struct ipmr_vif_iter *iter = seq->private;
163 	struct net *net = seq_file_net(seq);
164 
165 	++*pos;
166 	if (v == SEQ_START_TOKEN)
167 		return ip6mr_vif_seq_idx(net, iter, 0);
168 
169 	while (++iter->ct < net->ipv6.maxvif) {
170 		if (!MIF_EXISTS(net, iter->ct))
171 			continue;
172 		return &net->ipv6.vif6_table[iter->ct];
173 	}
174 	return NULL;
175 }
176 
177 static void ip6mr_vif_seq_stop(struct seq_file *seq, void *v)
178 	__releases(mrt_lock)
179 {
180 	read_unlock(&mrt_lock);
181 }
182 
183 static int ip6mr_vif_seq_show(struct seq_file *seq, void *v)
184 {
185 	struct net *net = seq_file_net(seq);
186 
187 	if (v == SEQ_START_TOKEN) {
188 		seq_puts(seq,
189 			 "Interface      BytesIn  PktsIn  BytesOut PktsOut Flags\n");
190 	} else {
191 		const struct mif_device *vif = v;
192 		const char *name = vif->dev ? vif->dev->name : "none";
193 
194 		seq_printf(seq,
195 			   "%2td %-10s %8ld %7ld  %8ld %7ld %05X\n",
196 			   vif - net->ipv6.vif6_table,
197 			   name, vif->bytes_in, vif->pkt_in,
198 			   vif->bytes_out, vif->pkt_out,
199 			   vif->flags);
200 	}
201 	return 0;
202 }
203 
204 static const struct seq_operations ip6mr_vif_seq_ops = {
205 	.start = ip6mr_vif_seq_start,
206 	.next  = ip6mr_vif_seq_next,
207 	.stop  = ip6mr_vif_seq_stop,
208 	.show  = ip6mr_vif_seq_show,
209 };
210 
211 static int ip6mr_vif_open(struct inode *inode, struct file *file)
212 {
213 	return seq_open_net(inode, file, &ip6mr_vif_seq_ops,
214 			    sizeof(struct ipmr_vif_iter));
215 }
216 
217 static const struct file_operations ip6mr_vif_fops = {
218 	.owner	 = THIS_MODULE,
219 	.open    = ip6mr_vif_open,
220 	.read    = seq_read,
221 	.llseek  = seq_lseek,
222 	.release = seq_release_net,
223 };
224 
225 static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos)
226 {
227 	struct net *net = seq_file_net(seq);
228 
229 	return *pos ? ipmr_mfc_seq_idx(net, seq->private, *pos - 1)
230 		: SEQ_START_TOKEN;
231 }
232 
233 static void *ipmr_mfc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
234 {
235 	struct mfc6_cache *mfc = v;
236 	struct ipmr_mfc_iter *it = seq->private;
237 	struct net *net = seq_file_net(seq);
238 
239 	++*pos;
240 
241 	if (v == SEQ_START_TOKEN)
242 		return ipmr_mfc_seq_idx(net, seq->private, 0);
243 
244 	if (mfc->next)
245 		return mfc->next;
246 
247 	if (it->cache == &mfc_unres_queue)
248 		goto end_of_list;
249 
250 	BUG_ON(it->cache != net->ipv6.mfc6_cache_array);
251 
252 	while (++it->ct < MFC6_LINES) {
253 		mfc = net->ipv6.mfc6_cache_array[it->ct];
254 		if (mfc)
255 			return mfc;
256 	}
257 
258 	/* exhausted cache_array, show unresolved */
259 	read_unlock(&mrt_lock);
260 	it->cache = &mfc_unres_queue;
261 	it->ct = 0;
262 
263 	spin_lock_bh(&mfc_unres_lock);
264 	mfc = mfc_unres_queue;
265 	if (mfc)
266 		return mfc;
267 
268  end_of_list:
269 	spin_unlock_bh(&mfc_unres_lock);
270 	it->cache = NULL;
271 
272 	return NULL;
273 }
274 
275 static void ipmr_mfc_seq_stop(struct seq_file *seq, void *v)
276 {
277 	struct ipmr_mfc_iter *it = seq->private;
278 	struct net *net = seq_file_net(seq);
279 
280 	if (it->cache == &mfc_unres_queue)
281 		spin_unlock_bh(&mfc_unres_lock);
282 	else if (it->cache == net->ipv6.mfc6_cache_array)
283 		read_unlock(&mrt_lock);
284 }
285 
286 static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
287 {
288 	int n;
289 	struct net *net = seq_file_net(seq);
290 
291 	if (v == SEQ_START_TOKEN) {
292 		seq_puts(seq,
293 			 "Group                            "
294 			 "Origin                           "
295 			 "Iif      Pkts  Bytes     Wrong  Oifs\n");
296 	} else {
297 		const struct mfc6_cache *mfc = v;
298 		const struct ipmr_mfc_iter *it = seq->private;
299 
300 		seq_printf(seq, "%pI6 %pI6 %-3hd",
301 			   &mfc->mf6c_mcastgrp, &mfc->mf6c_origin,
302 			   mfc->mf6c_parent);
303 
304 		if (it->cache != &mfc_unres_queue) {
305 			seq_printf(seq, " %8lu %8lu %8lu",
306 				   mfc->mfc_un.res.pkt,
307 				   mfc->mfc_un.res.bytes,
308 				   mfc->mfc_un.res.wrong_if);
309 			for (n = mfc->mfc_un.res.minvif;
310 			     n < mfc->mfc_un.res.maxvif; n++) {
311 				if (MIF_EXISTS(net, n) &&
312 				    mfc->mfc_un.res.ttls[n] < 255)
313 					seq_printf(seq,
314 						   " %2d:%-3d",
315 						   n, mfc->mfc_un.res.ttls[n]);
316 			}
317 		} else {
318 			/* unresolved mfc_caches don't contain
319 			 * pkt, bytes and wrong_if values
320 			 */
321 			seq_printf(seq, " %8lu %8lu %8lu", 0ul, 0ul, 0ul);
322 		}
323 		seq_putc(seq, '\n');
324 	}
325 	return 0;
326 }
327 
328 static const struct seq_operations ipmr_mfc_seq_ops = {
329 	.start = ipmr_mfc_seq_start,
330 	.next  = ipmr_mfc_seq_next,
331 	.stop  = ipmr_mfc_seq_stop,
332 	.show  = ipmr_mfc_seq_show,
333 };
334 
335 static int ipmr_mfc_open(struct inode *inode, struct file *file)
336 {
337 	return seq_open_net(inode, file, &ipmr_mfc_seq_ops,
338 			    sizeof(struct ipmr_mfc_iter));
339 }
340 
341 static const struct file_operations ip6mr_mfc_fops = {
342 	.owner	 = THIS_MODULE,
343 	.open    = ipmr_mfc_open,
344 	.read    = seq_read,
345 	.llseek  = seq_lseek,
346 	.release = seq_release_net,
347 };
348 #endif
349 
350 #ifdef CONFIG_IPV6_PIMSM_V2
351 
352 static int pim6_rcv(struct sk_buff *skb)
353 {
354 	struct pimreghdr *pim;
355 	struct ipv6hdr   *encap;
356 	struct net_device  *reg_dev = NULL;
357 	struct net *net = dev_net(skb->dev);
358 	int reg_vif_num = net->ipv6.mroute_reg_vif_num;
359 
360 	if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(*encap)))
361 		goto drop;
362 
363 	pim = (struct pimreghdr *)skb_transport_header(skb);
364 	if (pim->type != ((PIM_VERSION << 4) | PIM_REGISTER) ||
365 	    (pim->flags & PIM_NULL_REGISTER) ||
366 	    (csum_ipv6_magic(&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
367 			     sizeof(*pim), IPPROTO_PIM,
368 			     csum_partial((void *)pim, sizeof(*pim), 0)) &&
369 	     csum_fold(skb_checksum(skb, 0, skb->len, 0))))
370 		goto drop;
371 
372 	/* check if the inner packet is destined to mcast group */
373 	encap = (struct ipv6hdr *)(skb_transport_header(skb) +
374 				   sizeof(*pim));
375 
376 	if (!ipv6_addr_is_multicast(&encap->daddr) ||
377 	    encap->payload_len == 0 ||
378 	    ntohs(encap->payload_len) + sizeof(*pim) > skb->len)
379 		goto drop;
380 
381 	read_lock(&mrt_lock);
382 	if (reg_vif_num >= 0)
383 		reg_dev = net->ipv6.vif6_table[reg_vif_num].dev;
384 	if (reg_dev)
385 		dev_hold(reg_dev);
386 	read_unlock(&mrt_lock);
387 
388 	if (reg_dev == NULL)
389 		goto drop;
390 
391 	skb->mac_header = skb->network_header;
392 	skb_pull(skb, (u8 *)encap - skb->data);
393 	skb_reset_network_header(skb);
394 	skb->dev = reg_dev;
395 	skb->protocol = htons(ETH_P_IPV6);
396 	skb->ip_summed = 0;
397 	skb->pkt_type = PACKET_HOST;
398 	skb_dst_drop(skb);
399 	reg_dev->stats.rx_bytes += skb->len;
400 	reg_dev->stats.rx_packets++;
401 	nf_reset(skb);
402 	netif_rx(skb);
403 	dev_put(reg_dev);
404 	return 0;
405  drop:
406 	kfree_skb(skb);
407 	return 0;
408 }
409 
410 static const struct inet6_protocol pim6_protocol = {
411 	.handler	=	pim6_rcv,
412 };
413 
414 /* Service routines creating virtual interfaces: PIMREG */
415 
416 static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
417 				      struct net_device *dev)
418 {
419 	struct net *net = dev_net(dev);
420 
421 	read_lock(&mrt_lock);
422 	dev->stats.tx_bytes += skb->len;
423 	dev->stats.tx_packets++;
424 	ip6mr_cache_report(net, skb, net->ipv6.mroute_reg_vif_num,
425 			   MRT6MSG_WHOLEPKT);
426 	read_unlock(&mrt_lock);
427 	kfree_skb(skb);
428 	return NETDEV_TX_OK;
429 }
430 
431 static const struct net_device_ops reg_vif_netdev_ops = {
432 	.ndo_start_xmit	= reg_vif_xmit,
433 };
434 
435 static void reg_vif_setup(struct net_device *dev)
436 {
437 	dev->type		= ARPHRD_PIMREG;
438 	dev->mtu		= 1500 - sizeof(struct ipv6hdr) - 8;
439 	dev->flags		= IFF_NOARP;
440 	dev->netdev_ops		= &reg_vif_netdev_ops;
441 	dev->destructor		= free_netdev;
442 	dev->features		|= NETIF_F_NETNS_LOCAL;
443 }
444 
445 static struct net_device *ip6mr_reg_vif(struct net *net)
446 {
447 	struct net_device *dev;
448 
449 	dev = alloc_netdev(0, "pim6reg", reg_vif_setup);
450 	if (dev == NULL)
451 		return NULL;
452 
453 	dev_net_set(dev, net);
454 
455 	if (register_netdevice(dev)) {
456 		free_netdev(dev);
457 		return NULL;
458 	}
459 	dev->iflink = 0;
460 
461 	if (dev_open(dev))
462 		goto failure;
463 
464 	dev_hold(dev);
465 	return dev;
466 
467 failure:
468 	/* allow the register to be completed before unregistering. */
469 	rtnl_unlock();
470 	rtnl_lock();
471 
472 	unregister_netdevice(dev);
473 	return NULL;
474 }
475 #endif
476 
477 /*
478  *	Delete a VIF entry
479  */
480 
481 static int mif6_delete(struct net *net, int vifi, struct list_head *head)
482 {
483 	struct mif_device *v;
484 	struct net_device *dev;
485 	struct inet6_dev *in6_dev;
486 	if (vifi < 0 || vifi >= net->ipv6.maxvif)
487 		return -EADDRNOTAVAIL;
488 
489 	v = &net->ipv6.vif6_table[vifi];
490 
491 	write_lock_bh(&mrt_lock);
492 	dev = v->dev;
493 	v->dev = NULL;
494 
495 	if (!dev) {
496 		write_unlock_bh(&mrt_lock);
497 		return -EADDRNOTAVAIL;
498 	}
499 
500 #ifdef CONFIG_IPV6_PIMSM_V2
501 	if (vifi == net->ipv6.mroute_reg_vif_num)
502 		net->ipv6.mroute_reg_vif_num = -1;
503 #endif
504 
505 	if (vifi + 1 == net->ipv6.maxvif) {
506 		int tmp;
507 		for (tmp = vifi - 1; tmp >= 0; tmp--) {
508 			if (MIF_EXISTS(net, tmp))
509 				break;
510 		}
511 		net->ipv6.maxvif = tmp + 1;
512 	}
513 
514 	write_unlock_bh(&mrt_lock);
515 
516 	dev_set_allmulti(dev, -1);
517 
518 	in6_dev = __in6_dev_get(dev);
519 	if (in6_dev)
520 		in6_dev->cnf.mc_forwarding--;
521 
522 	if (v->flags & MIFF_REGISTER)
523 		unregister_netdevice_queue(dev, head);
524 
525 	dev_put(dev);
526 	return 0;
527 }
528 
529 static inline void ip6mr_cache_free(struct mfc6_cache *c)
530 {
531 	release_net(mfc6_net(c));
532 	kmem_cache_free(mrt_cachep, c);
533 }
534 
535 /* Destroy an unresolved cache entry, killing queued skbs
536    and reporting error to netlink readers.
537  */
538 
539 static void ip6mr_destroy_unres(struct mfc6_cache *c)
540 {
541 	struct sk_buff *skb;
542 	struct net *net = mfc6_net(c);
543 
544 	atomic_dec(&net->ipv6.cache_resolve_queue_len);
545 
546 	while((skb = skb_dequeue(&c->mfc_un.unres.unresolved)) != NULL) {
547 		if (ipv6_hdr(skb)->version == 0) {
548 			struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct ipv6hdr));
549 			nlh->nlmsg_type = NLMSG_ERROR;
550 			nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
551 			skb_trim(skb, nlh->nlmsg_len);
552 			((struct nlmsgerr *)NLMSG_DATA(nlh))->error = -ETIMEDOUT;
553 			rtnl_unicast(skb, net, NETLINK_CB(skb).pid);
554 		} else
555 			kfree_skb(skb);
556 	}
557 
558 	ip6mr_cache_free(c);
559 }
560 
561 
562 /* Single timer process for all the unresolved queue. */
563 
564 static void ipmr_do_expire_process(unsigned long dummy)
565 {
566 	unsigned long now = jiffies;
567 	unsigned long expires = 10 * HZ;
568 	struct mfc6_cache *c, **cp;
569 
570 	cp = &mfc_unres_queue;
571 
572 	while ((c = *cp) != NULL) {
573 		if (time_after(c->mfc_un.unres.expires, now)) {
574 			/* not yet... */
575 			unsigned long interval = c->mfc_un.unres.expires - now;
576 			if (interval < expires)
577 				expires = interval;
578 			cp = &c->next;
579 			continue;
580 		}
581 
582 		*cp = c->next;
583 		ip6mr_destroy_unres(c);
584 	}
585 
586 	if (mfc_unres_queue != NULL)
587 		mod_timer(&ipmr_expire_timer, jiffies + expires);
588 }
589 
590 static void ipmr_expire_process(unsigned long dummy)
591 {
592 	if (!spin_trylock(&mfc_unres_lock)) {
593 		mod_timer(&ipmr_expire_timer, jiffies + 1);
594 		return;
595 	}
596 
597 	if (mfc_unres_queue != NULL)
598 		ipmr_do_expire_process(dummy);
599 
600 	spin_unlock(&mfc_unres_lock);
601 }
602 
603 /* Fill oifs list. It is called under write locked mrt_lock. */
604 
605 static void ip6mr_update_thresholds(struct mfc6_cache *cache, unsigned char *ttls)
606 {
607 	int vifi;
608 	struct net *net = mfc6_net(cache);
609 
610 	cache->mfc_un.res.minvif = MAXMIFS;
611 	cache->mfc_un.res.maxvif = 0;
612 	memset(cache->mfc_un.res.ttls, 255, MAXMIFS);
613 
614 	for (vifi = 0; vifi < net->ipv6.maxvif; vifi++) {
615 		if (MIF_EXISTS(net, vifi) &&
616 		    ttls[vifi] && ttls[vifi] < 255) {
617 			cache->mfc_un.res.ttls[vifi] = ttls[vifi];
618 			if (cache->mfc_un.res.minvif > vifi)
619 				cache->mfc_un.res.minvif = vifi;
620 			if (cache->mfc_un.res.maxvif <= vifi)
621 				cache->mfc_un.res.maxvif = vifi + 1;
622 		}
623 	}
624 }
625 
626 static int mif6_add(struct net *net, struct mif6ctl *vifc, int mrtsock)
627 {
628 	int vifi = vifc->mif6c_mifi;
629 	struct mif_device *v = &net->ipv6.vif6_table[vifi];
630 	struct net_device *dev;
631 	struct inet6_dev *in6_dev;
632 	int err;
633 
634 	/* Is vif busy ? */
635 	if (MIF_EXISTS(net, vifi))
636 		return -EADDRINUSE;
637 
638 	switch (vifc->mif6c_flags) {
639 #ifdef CONFIG_IPV6_PIMSM_V2
640 	case MIFF_REGISTER:
641 		/*
642 		 * Special Purpose VIF in PIM
643 		 * All the packets will be sent to the daemon
644 		 */
645 		if (net->ipv6.mroute_reg_vif_num >= 0)
646 			return -EADDRINUSE;
647 		dev = ip6mr_reg_vif(net);
648 		if (!dev)
649 			return -ENOBUFS;
650 		err = dev_set_allmulti(dev, 1);
651 		if (err) {
652 			unregister_netdevice(dev);
653 			dev_put(dev);
654 			return err;
655 		}
656 		break;
657 #endif
658 	case 0:
659 		dev = dev_get_by_index(net, vifc->mif6c_pifi);
660 		if (!dev)
661 			return -EADDRNOTAVAIL;
662 		err = dev_set_allmulti(dev, 1);
663 		if (err) {
664 			dev_put(dev);
665 			return err;
666 		}
667 		break;
668 	default:
669 		return -EINVAL;
670 	}
671 
672 	in6_dev = __in6_dev_get(dev);
673 	if (in6_dev)
674 		in6_dev->cnf.mc_forwarding++;
675 
676 	/*
677 	 *	Fill in the VIF structures
678 	 */
679 	v->rate_limit = vifc->vifc_rate_limit;
680 	v->flags = vifc->mif6c_flags;
681 	if (!mrtsock)
682 		v->flags |= VIFF_STATIC;
683 	v->threshold = vifc->vifc_threshold;
684 	v->bytes_in = 0;
685 	v->bytes_out = 0;
686 	v->pkt_in = 0;
687 	v->pkt_out = 0;
688 	v->link = dev->ifindex;
689 	if (v->flags & MIFF_REGISTER)
690 		v->link = dev->iflink;
691 
692 	/* And finish update writing critical data */
693 	write_lock_bh(&mrt_lock);
694 	v->dev = dev;
695 #ifdef CONFIG_IPV6_PIMSM_V2
696 	if (v->flags & MIFF_REGISTER)
697 		net->ipv6.mroute_reg_vif_num = vifi;
698 #endif
699 	if (vifi + 1 > net->ipv6.maxvif)
700 		net->ipv6.maxvif = vifi + 1;
701 	write_unlock_bh(&mrt_lock);
702 	return 0;
703 }
704 
705 static struct mfc6_cache *ip6mr_cache_find(struct net *net,
706 					   struct in6_addr *origin,
707 					   struct in6_addr *mcastgrp)
708 {
709 	int line = MFC6_HASH(mcastgrp, origin);
710 	struct mfc6_cache *c;
711 
712 	for (c = net->ipv6.mfc6_cache_array[line]; c; c = c->next) {
713 		if (ipv6_addr_equal(&c->mf6c_origin, origin) &&
714 		    ipv6_addr_equal(&c->mf6c_mcastgrp, mcastgrp))
715 			break;
716 	}
717 	return c;
718 }
719 
720 /*
721  *	Allocate a multicast cache entry
722  */
723 static struct mfc6_cache *ip6mr_cache_alloc(struct net *net)
724 {
725 	struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
726 	if (c == NULL)
727 		return NULL;
728 	c->mfc_un.res.minvif = MAXMIFS;
729 	mfc6_net_set(c, net);
730 	return c;
731 }
732 
733 static struct mfc6_cache *ip6mr_cache_alloc_unres(struct net *net)
734 {
735 	struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_ATOMIC);
736 	if (c == NULL)
737 		return NULL;
738 	skb_queue_head_init(&c->mfc_un.unres.unresolved);
739 	c->mfc_un.unres.expires = jiffies + 10 * HZ;
740 	mfc6_net_set(c, net);
741 	return c;
742 }
743 
744 /*
745  *	A cache entry has gone into a resolved state from queued
746  */
747 
748 static void ip6mr_cache_resolve(struct mfc6_cache *uc, struct mfc6_cache *c)
749 {
750 	struct sk_buff *skb;
751 
752 	/*
753 	 *	Play the pending entries through our router
754 	 */
755 
756 	while((skb = __skb_dequeue(&uc->mfc_un.unres.unresolved))) {
757 		if (ipv6_hdr(skb)->version == 0) {
758 			int err;
759 			struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct ipv6hdr));
760 
761 			if (ip6mr_fill_mroute(skb, c, NLMSG_DATA(nlh)) > 0) {
762 				nlh->nlmsg_len = skb_tail_pointer(skb) - (u8 *)nlh;
763 			} else {
764 				nlh->nlmsg_type = NLMSG_ERROR;
765 				nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
766 				skb_trim(skb, nlh->nlmsg_len);
767 				((struct nlmsgerr *)NLMSG_DATA(nlh))->error = -EMSGSIZE;
768 			}
769 			err = rtnl_unicast(skb, mfc6_net(uc), NETLINK_CB(skb).pid);
770 		} else
771 			ip6_mr_forward(skb, c);
772 	}
773 }
774 
775 /*
776  *	Bounce a cache query up to pim6sd. We could use netlink for this but pim6sd
777  *	expects the following bizarre scheme.
778  *
779  *	Called under mrt_lock.
780  */
781 
782 static int ip6mr_cache_report(struct net *net, struct sk_buff *pkt, mifi_t mifi,
783 			      int assert)
784 {
785 	struct sk_buff *skb;
786 	struct mrt6msg *msg;
787 	int ret;
788 
789 #ifdef CONFIG_IPV6_PIMSM_V2
790 	if (assert == MRT6MSG_WHOLEPKT)
791 		skb = skb_realloc_headroom(pkt, -skb_network_offset(pkt)
792 						+sizeof(*msg));
793 	else
794 #endif
795 		skb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(*msg), GFP_ATOMIC);
796 
797 	if (!skb)
798 		return -ENOBUFS;
799 
800 	/* I suppose that internal messages
801 	 * do not require checksums */
802 
803 	skb->ip_summed = CHECKSUM_UNNECESSARY;
804 
805 #ifdef CONFIG_IPV6_PIMSM_V2
806 	if (assert == MRT6MSG_WHOLEPKT) {
807 		/* Ugly, but we have no choice with this interface.
808 		   Duplicate old header, fix length etc.
809 		   And all this only to mangle msg->im6_msgtype and
810 		   to set msg->im6_mbz to "mbz" :-)
811 		 */
812 		skb_push(skb, -skb_network_offset(pkt));
813 
814 		skb_push(skb, sizeof(*msg));
815 		skb_reset_transport_header(skb);
816 		msg = (struct mrt6msg *)skb_transport_header(skb);
817 		msg->im6_mbz = 0;
818 		msg->im6_msgtype = MRT6MSG_WHOLEPKT;
819 		msg->im6_mif = net->ipv6.mroute_reg_vif_num;
820 		msg->im6_pad = 0;
821 		ipv6_addr_copy(&msg->im6_src, &ipv6_hdr(pkt)->saddr);
822 		ipv6_addr_copy(&msg->im6_dst, &ipv6_hdr(pkt)->daddr);
823 
824 		skb->ip_summed = CHECKSUM_UNNECESSARY;
825 	} else
826 #endif
827 	{
828 	/*
829 	 *	Copy the IP header
830 	 */
831 
832 	skb_put(skb, sizeof(struct ipv6hdr));
833 	skb_reset_network_header(skb);
834 	skb_copy_to_linear_data(skb, ipv6_hdr(pkt), sizeof(struct ipv6hdr));
835 
836 	/*
837 	 *	Add our header
838 	 */
839 	skb_put(skb, sizeof(*msg));
840 	skb_reset_transport_header(skb);
841 	msg = (struct mrt6msg *)skb_transport_header(skb);
842 
843 	msg->im6_mbz = 0;
844 	msg->im6_msgtype = assert;
845 	msg->im6_mif = mifi;
846 	msg->im6_pad = 0;
847 	ipv6_addr_copy(&msg->im6_src, &ipv6_hdr(pkt)->saddr);
848 	ipv6_addr_copy(&msg->im6_dst, &ipv6_hdr(pkt)->daddr);
849 
850 	skb_dst_set(skb, dst_clone(skb_dst(pkt)));
851 	skb->ip_summed = CHECKSUM_UNNECESSARY;
852 	}
853 
854 	if (net->ipv6.mroute6_sk == NULL) {
855 		kfree_skb(skb);
856 		return -EINVAL;
857 	}
858 
859 	/*
860 	 *	Deliver to user space multicast routing algorithms
861 	 */
862 	ret = sock_queue_rcv_skb(net->ipv6.mroute6_sk, skb);
863 	if (ret < 0) {
864 		if (net_ratelimit())
865 			printk(KERN_WARNING "mroute6: pending queue full, dropping entries.\n");
866 		kfree_skb(skb);
867 	}
868 
869 	return ret;
870 }
871 
872 /*
873  *	Queue a packet for resolution. It gets locked cache entry!
874  */
875 
876 static int
877 ip6mr_cache_unresolved(struct net *net, mifi_t mifi, struct sk_buff *skb)
878 {
879 	int err;
880 	struct mfc6_cache *c;
881 
882 	spin_lock_bh(&mfc_unres_lock);
883 	for (c = mfc_unres_queue; c; c = c->next) {
884 		if (net_eq(mfc6_net(c), net) &&
885 		    ipv6_addr_equal(&c->mf6c_mcastgrp, &ipv6_hdr(skb)->daddr) &&
886 		    ipv6_addr_equal(&c->mf6c_origin, &ipv6_hdr(skb)->saddr))
887 			break;
888 	}
889 
890 	if (c == NULL) {
891 		/*
892 		 *	Create a new entry if allowable
893 		 */
894 
895 		if (atomic_read(&net->ipv6.cache_resolve_queue_len) >= 10 ||
896 		    (c = ip6mr_cache_alloc_unres(net)) == NULL) {
897 			spin_unlock_bh(&mfc_unres_lock);
898 
899 			kfree_skb(skb);
900 			return -ENOBUFS;
901 		}
902 
903 		/*
904 		 *	Fill in the new cache entry
905 		 */
906 		c->mf6c_parent = -1;
907 		c->mf6c_origin = ipv6_hdr(skb)->saddr;
908 		c->mf6c_mcastgrp = ipv6_hdr(skb)->daddr;
909 
910 		/*
911 		 *	Reflect first query at pim6sd
912 		 */
913 		err = ip6mr_cache_report(net, skb, mifi, MRT6MSG_NOCACHE);
914 		if (err < 0) {
915 			/* If the report failed throw the cache entry
916 			   out - Brad Parker
917 			 */
918 			spin_unlock_bh(&mfc_unres_lock);
919 
920 			ip6mr_cache_free(c);
921 			kfree_skb(skb);
922 			return err;
923 		}
924 
925 		atomic_inc(&net->ipv6.cache_resolve_queue_len);
926 		c->next = mfc_unres_queue;
927 		mfc_unres_queue = c;
928 
929 		ipmr_do_expire_process(1);
930 	}
931 
932 	/*
933 	 *	See if we can append the packet
934 	 */
935 	if (c->mfc_un.unres.unresolved.qlen > 3) {
936 		kfree_skb(skb);
937 		err = -ENOBUFS;
938 	} else {
939 		skb_queue_tail(&c->mfc_un.unres.unresolved, skb);
940 		err = 0;
941 	}
942 
943 	spin_unlock_bh(&mfc_unres_lock);
944 	return err;
945 }
946 
947 /*
948  *	MFC6 cache manipulation by user space
949  */
950 
951 static int ip6mr_mfc_delete(struct net *net, struct mf6cctl *mfc)
952 {
953 	int line;
954 	struct mfc6_cache *c, **cp;
955 
956 	line = MFC6_HASH(&mfc->mf6cc_mcastgrp.sin6_addr, &mfc->mf6cc_origin.sin6_addr);
957 
958 	for (cp = &net->ipv6.mfc6_cache_array[line];
959 	     (c = *cp) != NULL; cp = &c->next) {
960 		if (ipv6_addr_equal(&c->mf6c_origin, &mfc->mf6cc_origin.sin6_addr) &&
961 		    ipv6_addr_equal(&c->mf6c_mcastgrp, &mfc->mf6cc_mcastgrp.sin6_addr)) {
962 			write_lock_bh(&mrt_lock);
963 			*cp = c->next;
964 			write_unlock_bh(&mrt_lock);
965 
966 			ip6mr_cache_free(c);
967 			return 0;
968 		}
969 	}
970 	return -ENOENT;
971 }
972 
973 static int ip6mr_device_event(struct notifier_block *this,
974 			      unsigned long event, void *ptr)
975 {
976 	struct net_device *dev = ptr;
977 	struct net *net = dev_net(dev);
978 	struct mif_device *v;
979 	int ct;
980 	LIST_HEAD(list);
981 
982 	if (event != NETDEV_UNREGISTER)
983 		return NOTIFY_DONE;
984 
985 	v = &net->ipv6.vif6_table[0];
986 	for (ct = 0; ct < net->ipv6.maxvif; ct++, v++) {
987 		if (v->dev == dev)
988 			mif6_delete(net, ct, &list);
989 	}
990 	unregister_netdevice_many(&list);
991 
992 	return NOTIFY_DONE;
993 }
994 
995 static struct notifier_block ip6_mr_notifier = {
996 	.notifier_call = ip6mr_device_event
997 };
998 
999 /*
1000  *	Setup for IP multicast routing
1001  */
1002 
1003 static int __net_init ip6mr_net_init(struct net *net)
1004 {
1005 	int err = 0;
1006 	net->ipv6.vif6_table = kcalloc(MAXMIFS, sizeof(struct mif_device),
1007 				       GFP_KERNEL);
1008 	if (!net->ipv6.vif6_table) {
1009 		err = -ENOMEM;
1010 		goto fail;
1011 	}
1012 
1013 	/* Forwarding cache */
1014 	net->ipv6.mfc6_cache_array = kcalloc(MFC6_LINES,
1015 					     sizeof(struct mfc6_cache *),
1016 					     GFP_KERNEL);
1017 	if (!net->ipv6.mfc6_cache_array) {
1018 		err = -ENOMEM;
1019 		goto fail_mfc6_cache;
1020 	}
1021 
1022 #ifdef CONFIG_IPV6_PIMSM_V2
1023 	net->ipv6.mroute_reg_vif_num = -1;
1024 #endif
1025 
1026 #ifdef CONFIG_PROC_FS
1027 	err = -ENOMEM;
1028 	if (!proc_net_fops_create(net, "ip6_mr_vif", 0, &ip6mr_vif_fops))
1029 		goto proc_vif_fail;
1030 	if (!proc_net_fops_create(net, "ip6_mr_cache", 0, &ip6mr_mfc_fops))
1031 		goto proc_cache_fail;
1032 #endif
1033 	return 0;
1034 
1035 #ifdef CONFIG_PROC_FS
1036 proc_cache_fail:
1037 	proc_net_remove(net, "ip6_mr_vif");
1038 proc_vif_fail:
1039 	kfree(net->ipv6.mfc6_cache_array);
1040 #endif
1041 fail_mfc6_cache:
1042 	kfree(net->ipv6.vif6_table);
1043 fail:
1044 	return err;
1045 }
1046 
1047 static void __net_exit ip6mr_net_exit(struct net *net)
1048 {
1049 #ifdef CONFIG_PROC_FS
1050 	proc_net_remove(net, "ip6_mr_cache");
1051 	proc_net_remove(net, "ip6_mr_vif");
1052 #endif
1053 	mroute_clean_tables(net);
1054 	kfree(net->ipv6.mfc6_cache_array);
1055 	kfree(net->ipv6.vif6_table);
1056 }
1057 
1058 static struct pernet_operations ip6mr_net_ops = {
1059 	.init = ip6mr_net_init,
1060 	.exit = ip6mr_net_exit,
1061 };
1062 
1063 int __init ip6_mr_init(void)
1064 {
1065 	int err;
1066 
1067 	mrt_cachep = kmem_cache_create("ip6_mrt_cache",
1068 				       sizeof(struct mfc6_cache),
1069 				       0, SLAB_HWCACHE_ALIGN,
1070 				       NULL);
1071 	if (!mrt_cachep)
1072 		return -ENOMEM;
1073 
1074 	err = register_pernet_subsys(&ip6mr_net_ops);
1075 	if (err)
1076 		goto reg_pernet_fail;
1077 
1078 	setup_timer(&ipmr_expire_timer, ipmr_expire_process, 0);
1079 	err = register_netdevice_notifier(&ip6_mr_notifier);
1080 	if (err)
1081 		goto reg_notif_fail;
1082 #ifdef CONFIG_IPV6_PIMSM_V2
1083 	if (inet6_add_protocol(&pim6_protocol, IPPROTO_PIM) < 0) {
1084 		printk(KERN_ERR "ip6_mr_init: can't add PIM protocol\n");
1085 		err = -EAGAIN;
1086 		goto add_proto_fail;
1087 	}
1088 #endif
1089 	return 0;
1090 #ifdef CONFIG_IPV6_PIMSM_V2
1091 add_proto_fail:
1092 	unregister_netdevice_notifier(&ip6_mr_notifier);
1093 #endif
1094 reg_notif_fail:
1095 	del_timer(&ipmr_expire_timer);
1096 	unregister_pernet_subsys(&ip6mr_net_ops);
1097 reg_pernet_fail:
1098 	kmem_cache_destroy(mrt_cachep);
1099 	return err;
1100 }
1101 
1102 void ip6_mr_cleanup(void)
1103 {
1104 	unregister_netdevice_notifier(&ip6_mr_notifier);
1105 	del_timer(&ipmr_expire_timer);
1106 	unregister_pernet_subsys(&ip6mr_net_ops);
1107 	kmem_cache_destroy(mrt_cachep);
1108 }
1109 
1110 static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
1111 {
1112 	int line;
1113 	struct mfc6_cache *uc, *c, **cp;
1114 	unsigned char ttls[MAXMIFS];
1115 	int i;
1116 
1117 	if (mfc->mf6cc_parent >= MAXMIFS)
1118 		return -ENFILE;
1119 
1120 	memset(ttls, 255, MAXMIFS);
1121 	for (i = 0; i < MAXMIFS; i++) {
1122 		if (IF_ISSET(i, &mfc->mf6cc_ifset))
1123 			ttls[i] = 1;
1124 
1125 	}
1126 
1127 	line = MFC6_HASH(&mfc->mf6cc_mcastgrp.sin6_addr, &mfc->mf6cc_origin.sin6_addr);
1128 
1129 	for (cp = &net->ipv6.mfc6_cache_array[line];
1130 	     (c = *cp) != NULL; cp = &c->next) {
1131 		if (ipv6_addr_equal(&c->mf6c_origin, &mfc->mf6cc_origin.sin6_addr) &&
1132 		    ipv6_addr_equal(&c->mf6c_mcastgrp, &mfc->mf6cc_mcastgrp.sin6_addr))
1133 			break;
1134 	}
1135 
1136 	if (c != NULL) {
1137 		write_lock_bh(&mrt_lock);
1138 		c->mf6c_parent = mfc->mf6cc_parent;
1139 		ip6mr_update_thresholds(c, ttls);
1140 		if (!mrtsock)
1141 			c->mfc_flags |= MFC_STATIC;
1142 		write_unlock_bh(&mrt_lock);
1143 		return 0;
1144 	}
1145 
1146 	if (!ipv6_addr_is_multicast(&mfc->mf6cc_mcastgrp.sin6_addr))
1147 		return -EINVAL;
1148 
1149 	c = ip6mr_cache_alloc(net);
1150 	if (c == NULL)
1151 		return -ENOMEM;
1152 
1153 	c->mf6c_origin = mfc->mf6cc_origin.sin6_addr;
1154 	c->mf6c_mcastgrp = mfc->mf6cc_mcastgrp.sin6_addr;
1155 	c->mf6c_parent = mfc->mf6cc_parent;
1156 	ip6mr_update_thresholds(c, ttls);
1157 	if (!mrtsock)
1158 		c->mfc_flags |= MFC_STATIC;
1159 
1160 	write_lock_bh(&mrt_lock);
1161 	c->next = net->ipv6.mfc6_cache_array[line];
1162 	net->ipv6.mfc6_cache_array[line] = c;
1163 	write_unlock_bh(&mrt_lock);
1164 
1165 	/*
1166 	 *	Check to see if we resolved a queued list. If so we
1167 	 *	need to send on the frames and tidy up.
1168 	 */
1169 	spin_lock_bh(&mfc_unres_lock);
1170 	for (cp = &mfc_unres_queue; (uc = *cp) != NULL;
1171 	     cp = &uc->next) {
1172 		if (net_eq(mfc6_net(uc), net) &&
1173 		    ipv6_addr_equal(&uc->mf6c_origin, &c->mf6c_origin) &&
1174 		    ipv6_addr_equal(&uc->mf6c_mcastgrp, &c->mf6c_mcastgrp)) {
1175 			*cp = uc->next;
1176 			atomic_dec(&net->ipv6.cache_resolve_queue_len);
1177 			break;
1178 		}
1179 	}
1180 	if (mfc_unres_queue == NULL)
1181 		del_timer(&ipmr_expire_timer);
1182 	spin_unlock_bh(&mfc_unres_lock);
1183 
1184 	if (uc) {
1185 		ip6mr_cache_resolve(uc, c);
1186 		ip6mr_cache_free(uc);
1187 	}
1188 	return 0;
1189 }
1190 
1191 /*
1192  *	Close the multicast socket, and clear the vif tables etc
1193  */
1194 
1195 static void mroute_clean_tables(struct net *net)
1196 {
1197 	int i;
1198 	LIST_HEAD(list);
1199 
1200 	/*
1201 	 *	Shut down all active vif entries
1202 	 */
1203 	for (i = 0; i < net->ipv6.maxvif; i++) {
1204 		if (!(net->ipv6.vif6_table[i].flags & VIFF_STATIC))
1205 			mif6_delete(net, i, &list);
1206 	}
1207 	unregister_netdevice_many(&list);
1208 
1209 	/*
1210 	 *	Wipe the cache
1211 	 */
1212 	for (i = 0; i < MFC6_LINES; i++) {
1213 		struct mfc6_cache *c, **cp;
1214 
1215 		cp = &net->ipv6.mfc6_cache_array[i];
1216 		while ((c = *cp) != NULL) {
1217 			if (c->mfc_flags & MFC_STATIC) {
1218 				cp = &c->next;
1219 				continue;
1220 			}
1221 			write_lock_bh(&mrt_lock);
1222 			*cp = c->next;
1223 			write_unlock_bh(&mrt_lock);
1224 
1225 			ip6mr_cache_free(c);
1226 		}
1227 	}
1228 
1229 	if (atomic_read(&net->ipv6.cache_resolve_queue_len) != 0) {
1230 		struct mfc6_cache *c, **cp;
1231 
1232 		spin_lock_bh(&mfc_unres_lock);
1233 		cp = &mfc_unres_queue;
1234 		while ((c = *cp) != NULL) {
1235 			if (!net_eq(mfc6_net(c), net)) {
1236 				cp = &c->next;
1237 				continue;
1238 			}
1239 			*cp = c->next;
1240 			ip6mr_destroy_unres(c);
1241 		}
1242 		spin_unlock_bh(&mfc_unres_lock);
1243 	}
1244 }
1245 
1246 static int ip6mr_sk_init(struct sock *sk)
1247 {
1248 	int err = 0;
1249 	struct net *net = sock_net(sk);
1250 
1251 	rtnl_lock();
1252 	write_lock_bh(&mrt_lock);
1253 	if (likely(net->ipv6.mroute6_sk == NULL)) {
1254 		net->ipv6.mroute6_sk = sk;
1255 		net->ipv6.devconf_all->mc_forwarding++;
1256 	}
1257 	else
1258 		err = -EADDRINUSE;
1259 	write_unlock_bh(&mrt_lock);
1260 
1261 	rtnl_unlock();
1262 
1263 	return err;
1264 }
1265 
1266 int ip6mr_sk_done(struct sock *sk)
1267 {
1268 	int err = 0;
1269 	struct net *net = sock_net(sk);
1270 
1271 	rtnl_lock();
1272 	if (sk == net->ipv6.mroute6_sk) {
1273 		write_lock_bh(&mrt_lock);
1274 		net->ipv6.mroute6_sk = NULL;
1275 		net->ipv6.devconf_all->mc_forwarding--;
1276 		write_unlock_bh(&mrt_lock);
1277 
1278 		mroute_clean_tables(net);
1279 	} else
1280 		err = -EACCES;
1281 	rtnl_unlock();
1282 
1283 	return err;
1284 }
1285 
1286 /*
1287  *	Socket options and virtual interface manipulation. The whole
1288  *	virtual interface system is a complete heap, but unfortunately
1289  *	that's how BSD mrouted happens to think. Maybe one day with a proper
1290  *	MOSPF/PIM router set up we can clean this up.
1291  */
1292 
1293 int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsigned int optlen)
1294 {
1295 	int ret;
1296 	struct mif6ctl vif;
1297 	struct mf6cctl mfc;
1298 	mifi_t mifi;
1299 	struct net *net = sock_net(sk);
1300 
1301 	if (optname != MRT6_INIT) {
1302 		if (sk != net->ipv6.mroute6_sk && !capable(CAP_NET_ADMIN))
1303 			return -EACCES;
1304 	}
1305 
1306 	switch (optname) {
1307 	case MRT6_INIT:
1308 		if (sk->sk_type != SOCK_RAW ||
1309 		    inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
1310 			return -EOPNOTSUPP;
1311 		if (optlen < sizeof(int))
1312 			return -EINVAL;
1313 
1314 		return ip6mr_sk_init(sk);
1315 
1316 	case MRT6_DONE:
1317 		return ip6mr_sk_done(sk);
1318 
1319 	case MRT6_ADD_MIF:
1320 		if (optlen < sizeof(vif))
1321 			return -EINVAL;
1322 		if (copy_from_user(&vif, optval, sizeof(vif)))
1323 			return -EFAULT;
1324 		if (vif.mif6c_mifi >= MAXMIFS)
1325 			return -ENFILE;
1326 		rtnl_lock();
1327 		ret = mif6_add(net, &vif, sk == net->ipv6.mroute6_sk);
1328 		rtnl_unlock();
1329 		return ret;
1330 
1331 	case MRT6_DEL_MIF:
1332 		if (optlen < sizeof(mifi_t))
1333 			return -EINVAL;
1334 		if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
1335 			return -EFAULT;
1336 		rtnl_lock();
1337 		ret = mif6_delete(net, mifi, NULL);
1338 		rtnl_unlock();
1339 		return ret;
1340 
1341 	/*
1342 	 *	Manipulate the forwarding caches. These live
1343 	 *	in a sort of kernel/user symbiosis.
1344 	 */
1345 	case MRT6_ADD_MFC:
1346 	case MRT6_DEL_MFC:
1347 		if (optlen < sizeof(mfc))
1348 			return -EINVAL;
1349 		if (copy_from_user(&mfc, optval, sizeof(mfc)))
1350 			return -EFAULT;
1351 		rtnl_lock();
1352 		if (optname == MRT6_DEL_MFC)
1353 			ret = ip6mr_mfc_delete(net, &mfc);
1354 		else
1355 			ret = ip6mr_mfc_add(net, &mfc,
1356 					    sk == net->ipv6.mroute6_sk);
1357 		rtnl_unlock();
1358 		return ret;
1359 
1360 	/*
1361 	 *	Control PIM assert (to activate pim will activate assert)
1362 	 */
1363 	case MRT6_ASSERT:
1364 	{
1365 		int v;
1366 		if (get_user(v, (int __user *)optval))
1367 			return -EFAULT;
1368 		net->ipv6.mroute_do_assert = !!v;
1369 		return 0;
1370 	}
1371 
1372 #ifdef CONFIG_IPV6_PIMSM_V2
1373 	case MRT6_PIM:
1374 	{
1375 		int v;
1376 		if (get_user(v, (int __user *)optval))
1377 			return -EFAULT;
1378 		v = !!v;
1379 		rtnl_lock();
1380 		ret = 0;
1381 		if (v != net->ipv6.mroute_do_pim) {
1382 			net->ipv6.mroute_do_pim = v;
1383 			net->ipv6.mroute_do_assert = v;
1384 		}
1385 		rtnl_unlock();
1386 		return ret;
1387 	}
1388 
1389 #endif
1390 	/*
1391 	 *	Spurious command, or MRT6_VERSION which you cannot
1392 	 *	set.
1393 	 */
1394 	default:
1395 		return -ENOPROTOOPT;
1396 	}
1397 }
1398 
1399 /*
1400  *	Getsock opt support for the multicast routing system.
1401  */
1402 
1403 int ip6_mroute_getsockopt(struct sock *sk, int optname, char __user *optval,
1404 			  int __user *optlen)
1405 {
1406 	int olr;
1407 	int val;
1408 	struct net *net = sock_net(sk);
1409 
1410 	switch (optname) {
1411 	case MRT6_VERSION:
1412 		val = 0x0305;
1413 		break;
1414 #ifdef CONFIG_IPV6_PIMSM_V2
1415 	case MRT6_PIM:
1416 		val = net->ipv6.mroute_do_pim;
1417 		break;
1418 #endif
1419 	case MRT6_ASSERT:
1420 		val = net->ipv6.mroute_do_assert;
1421 		break;
1422 	default:
1423 		return -ENOPROTOOPT;
1424 	}
1425 
1426 	if (get_user(olr, optlen))
1427 		return -EFAULT;
1428 
1429 	olr = min_t(int, olr, sizeof(int));
1430 	if (olr < 0)
1431 		return -EINVAL;
1432 
1433 	if (put_user(olr, optlen))
1434 		return -EFAULT;
1435 	if (copy_to_user(optval, &val, olr))
1436 		return -EFAULT;
1437 	return 0;
1438 }
1439 
1440 /*
1441  *	The IP multicast ioctl support routines.
1442  */
1443 
1444 int ip6mr_ioctl(struct sock *sk, int cmd, void __user *arg)
1445 {
1446 	struct sioc_sg_req6 sr;
1447 	struct sioc_mif_req6 vr;
1448 	struct mif_device *vif;
1449 	struct mfc6_cache *c;
1450 	struct net *net = sock_net(sk);
1451 
1452 	switch (cmd) {
1453 	case SIOCGETMIFCNT_IN6:
1454 		if (copy_from_user(&vr, arg, sizeof(vr)))
1455 			return -EFAULT;
1456 		if (vr.mifi >= net->ipv6.maxvif)
1457 			return -EINVAL;
1458 		read_lock(&mrt_lock);
1459 		vif = &net->ipv6.vif6_table[vr.mifi];
1460 		if (MIF_EXISTS(net, vr.mifi)) {
1461 			vr.icount = vif->pkt_in;
1462 			vr.ocount = vif->pkt_out;
1463 			vr.ibytes = vif->bytes_in;
1464 			vr.obytes = vif->bytes_out;
1465 			read_unlock(&mrt_lock);
1466 
1467 			if (copy_to_user(arg, &vr, sizeof(vr)))
1468 				return -EFAULT;
1469 			return 0;
1470 		}
1471 		read_unlock(&mrt_lock);
1472 		return -EADDRNOTAVAIL;
1473 	case SIOCGETSGCNT_IN6:
1474 		if (copy_from_user(&sr, arg, sizeof(sr)))
1475 			return -EFAULT;
1476 
1477 		read_lock(&mrt_lock);
1478 		c = ip6mr_cache_find(net, &sr.src.sin6_addr, &sr.grp.sin6_addr);
1479 		if (c) {
1480 			sr.pktcnt = c->mfc_un.res.pkt;
1481 			sr.bytecnt = c->mfc_un.res.bytes;
1482 			sr.wrong_if = c->mfc_un.res.wrong_if;
1483 			read_unlock(&mrt_lock);
1484 
1485 			if (copy_to_user(arg, &sr, sizeof(sr)))
1486 				return -EFAULT;
1487 			return 0;
1488 		}
1489 		read_unlock(&mrt_lock);
1490 		return -EADDRNOTAVAIL;
1491 	default:
1492 		return -ENOIOCTLCMD;
1493 	}
1494 }
1495 
1496 
1497 static inline int ip6mr_forward2_finish(struct sk_buff *skb)
1498 {
1499 	IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
1500 			 IPSTATS_MIB_OUTFORWDATAGRAMS);
1501 	return dst_output(skb);
1502 }
1503 
1504 /*
1505  *	Processing handlers for ip6mr_forward
1506  */
1507 
1508 static int ip6mr_forward2(struct sk_buff *skb, struct mfc6_cache *c, int vifi)
1509 {
1510 	struct ipv6hdr *ipv6h;
1511 	struct net *net = mfc6_net(c);
1512 	struct mif_device *vif = &net->ipv6.vif6_table[vifi];
1513 	struct net_device *dev;
1514 	struct dst_entry *dst;
1515 	struct flowi fl;
1516 
1517 	if (vif->dev == NULL)
1518 		goto out_free;
1519 
1520 #ifdef CONFIG_IPV6_PIMSM_V2
1521 	if (vif->flags & MIFF_REGISTER) {
1522 		vif->pkt_out++;
1523 		vif->bytes_out += skb->len;
1524 		vif->dev->stats.tx_bytes += skb->len;
1525 		vif->dev->stats.tx_packets++;
1526 		ip6mr_cache_report(net, skb, vifi, MRT6MSG_WHOLEPKT);
1527 		goto out_free;
1528 	}
1529 #endif
1530 
1531 	ipv6h = ipv6_hdr(skb);
1532 
1533 	fl = (struct flowi) {
1534 		.oif = vif->link,
1535 		.nl_u = { .ip6_u =
1536 				{ .daddr = ipv6h->daddr, }
1537 		}
1538 	};
1539 
1540 	dst = ip6_route_output(net, NULL, &fl);
1541 	if (!dst)
1542 		goto out_free;
1543 
1544 	skb_dst_drop(skb);
1545 	skb_dst_set(skb, dst);
1546 
1547 	/*
1548 	 * RFC1584 teaches, that DVMRP/PIM router must deliver packets locally
1549 	 * not only before forwarding, but after forwarding on all output
1550 	 * interfaces. It is clear, if mrouter runs a multicasting
1551 	 * program, it should receive packets not depending to what interface
1552 	 * program is joined.
1553 	 * If we will not make it, the program will have to join on all
1554 	 * interfaces. On the other hand, multihoming host (or router, but
1555 	 * not mrouter) cannot join to more than one interface - it will
1556 	 * result in receiving multiple packets.
1557 	 */
1558 	dev = vif->dev;
1559 	skb->dev = dev;
1560 	vif->pkt_out++;
1561 	vif->bytes_out += skb->len;
1562 
1563 	/* We are about to write */
1564 	/* XXX: extension headers? */
1565 	if (skb_cow(skb, sizeof(*ipv6h) + LL_RESERVED_SPACE(dev)))
1566 		goto out_free;
1567 
1568 	ipv6h = ipv6_hdr(skb);
1569 	ipv6h->hop_limit--;
1570 
1571 	IP6CB(skb)->flags |= IP6SKB_FORWARDED;
1572 
1573 	return NF_HOOK(PF_INET6, NF_INET_FORWARD, skb, skb->dev, dev,
1574 		       ip6mr_forward2_finish);
1575 
1576 out_free:
1577 	kfree_skb(skb);
1578 	return 0;
1579 }
1580 
1581 static int ip6mr_find_vif(struct net_device *dev)
1582 {
1583 	struct net *net = dev_net(dev);
1584 	int ct;
1585 	for (ct = net->ipv6.maxvif - 1; ct >= 0; ct--) {
1586 		if (net->ipv6.vif6_table[ct].dev == dev)
1587 			break;
1588 	}
1589 	return ct;
1590 }
1591 
1592 static int ip6_mr_forward(struct sk_buff *skb, struct mfc6_cache *cache)
1593 {
1594 	int psend = -1;
1595 	int vif, ct;
1596 	struct net *net = mfc6_net(cache);
1597 
1598 	vif = cache->mf6c_parent;
1599 	cache->mfc_un.res.pkt++;
1600 	cache->mfc_un.res.bytes += skb->len;
1601 
1602 	/*
1603 	 * Wrong interface: drop packet and (maybe) send PIM assert.
1604 	 */
1605 	if (net->ipv6.vif6_table[vif].dev != skb->dev) {
1606 		int true_vifi;
1607 
1608 		cache->mfc_un.res.wrong_if++;
1609 		true_vifi = ip6mr_find_vif(skb->dev);
1610 
1611 		if (true_vifi >= 0 && net->ipv6.mroute_do_assert &&
1612 		    /* pimsm uses asserts, when switching from RPT to SPT,
1613 		       so that we cannot check that packet arrived on an oif.
1614 		       It is bad, but otherwise we would need to move pretty
1615 		       large chunk of pimd to kernel. Ough... --ANK
1616 		     */
1617 		    (net->ipv6.mroute_do_pim ||
1618 		     cache->mfc_un.res.ttls[true_vifi] < 255) &&
1619 		    time_after(jiffies,
1620 			       cache->mfc_un.res.last_assert + MFC_ASSERT_THRESH)) {
1621 			cache->mfc_un.res.last_assert = jiffies;
1622 			ip6mr_cache_report(net, skb, true_vifi, MRT6MSG_WRONGMIF);
1623 		}
1624 		goto dont_forward;
1625 	}
1626 
1627 	net->ipv6.vif6_table[vif].pkt_in++;
1628 	net->ipv6.vif6_table[vif].bytes_in += skb->len;
1629 
1630 	/*
1631 	 *	Forward the frame
1632 	 */
1633 	for (ct = cache->mfc_un.res.maxvif - 1; ct >= cache->mfc_un.res.minvif; ct--) {
1634 		if (ipv6_hdr(skb)->hop_limit > cache->mfc_un.res.ttls[ct]) {
1635 			if (psend != -1) {
1636 				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
1637 				if (skb2)
1638 					ip6mr_forward2(skb2, cache, psend);
1639 			}
1640 			psend = ct;
1641 		}
1642 	}
1643 	if (psend != -1) {
1644 		ip6mr_forward2(skb, cache, psend);
1645 		return 0;
1646 	}
1647 
1648 dont_forward:
1649 	kfree_skb(skb);
1650 	return 0;
1651 }
1652 
1653 
1654 /*
1655  *	Multicast packets for forwarding arrive here
1656  */
1657 
1658 int ip6_mr_input(struct sk_buff *skb)
1659 {
1660 	struct mfc6_cache *cache;
1661 	struct net *net = dev_net(skb->dev);
1662 
1663 	read_lock(&mrt_lock);
1664 	cache = ip6mr_cache_find(net,
1665 				 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr);
1666 
1667 	/*
1668 	 *	No usable cache entry
1669 	 */
1670 	if (cache == NULL) {
1671 		int vif;
1672 
1673 		vif = ip6mr_find_vif(skb->dev);
1674 		if (vif >= 0) {
1675 			int err = ip6mr_cache_unresolved(net, vif, skb);
1676 			read_unlock(&mrt_lock);
1677 
1678 			return err;
1679 		}
1680 		read_unlock(&mrt_lock);
1681 		kfree_skb(skb);
1682 		return -ENODEV;
1683 	}
1684 
1685 	ip6_mr_forward(skb, cache);
1686 
1687 	read_unlock(&mrt_lock);
1688 
1689 	return 0;
1690 }
1691 
1692 
1693 static int
1694 ip6mr_fill_mroute(struct sk_buff *skb, struct mfc6_cache *c, struct rtmsg *rtm)
1695 {
1696 	int ct;
1697 	struct rtnexthop *nhp;
1698 	struct net *net = mfc6_net(c);
1699 	u8 *b = skb_tail_pointer(skb);
1700 	struct rtattr *mp_head;
1701 
1702 	/* If cache is unresolved, don't try to parse IIF and OIF */
1703 	if (c->mf6c_parent > MAXMIFS)
1704 		return -ENOENT;
1705 
1706 	if (MIF_EXISTS(net, c->mf6c_parent))
1707 		RTA_PUT(skb, RTA_IIF, 4, &net->ipv6.vif6_table[c->mf6c_parent].dev->ifindex);
1708 
1709 	mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
1710 
1711 	for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
1712 		if (MIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
1713 			if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
1714 				goto rtattr_failure;
1715 			nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
1716 			nhp->rtnh_flags = 0;
1717 			nhp->rtnh_hops = c->mfc_un.res.ttls[ct];
1718 			nhp->rtnh_ifindex = net->ipv6.vif6_table[ct].dev->ifindex;
1719 			nhp->rtnh_len = sizeof(*nhp);
1720 		}
1721 	}
1722 	mp_head->rta_type = RTA_MULTIPATH;
1723 	mp_head->rta_len = skb_tail_pointer(skb) - (u8 *)mp_head;
1724 	rtm->rtm_type = RTN_MULTICAST;
1725 	return 1;
1726 
1727 rtattr_failure:
1728 	nlmsg_trim(skb, b);
1729 	return -EMSGSIZE;
1730 }
1731 
1732 int ip6mr_get_route(struct net *net,
1733 		    struct sk_buff *skb, struct rtmsg *rtm, int nowait)
1734 {
1735 	int err;
1736 	struct mfc6_cache *cache;
1737 	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
1738 
1739 	read_lock(&mrt_lock);
1740 	cache = ip6mr_cache_find(net, &rt->rt6i_src.addr, &rt->rt6i_dst.addr);
1741 
1742 	if (!cache) {
1743 		struct sk_buff *skb2;
1744 		struct ipv6hdr *iph;
1745 		struct net_device *dev;
1746 		int vif;
1747 
1748 		if (nowait) {
1749 			read_unlock(&mrt_lock);
1750 			return -EAGAIN;
1751 		}
1752 
1753 		dev = skb->dev;
1754 		if (dev == NULL || (vif = ip6mr_find_vif(dev)) < 0) {
1755 			read_unlock(&mrt_lock);
1756 			return -ENODEV;
1757 		}
1758 
1759 		/* really correct? */
1760 		skb2 = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC);
1761 		if (!skb2) {
1762 			read_unlock(&mrt_lock);
1763 			return -ENOMEM;
1764 		}
1765 
1766 		skb_reset_transport_header(skb2);
1767 
1768 		skb_put(skb2, sizeof(struct ipv6hdr));
1769 		skb_reset_network_header(skb2);
1770 
1771 		iph = ipv6_hdr(skb2);
1772 		iph->version = 0;
1773 		iph->priority = 0;
1774 		iph->flow_lbl[0] = 0;
1775 		iph->flow_lbl[1] = 0;
1776 		iph->flow_lbl[2] = 0;
1777 		iph->payload_len = 0;
1778 		iph->nexthdr = IPPROTO_NONE;
1779 		iph->hop_limit = 0;
1780 		ipv6_addr_copy(&iph->saddr, &rt->rt6i_src.addr);
1781 		ipv6_addr_copy(&iph->daddr, &rt->rt6i_dst.addr);
1782 
1783 		err = ip6mr_cache_unresolved(net, vif, skb2);
1784 		read_unlock(&mrt_lock);
1785 
1786 		return err;
1787 	}
1788 
1789 	if (!nowait && (rtm->rtm_flags&RTM_F_NOTIFY))
1790 		cache->mfc_flags |= MFC_NOTIFY;
1791 
1792 	err = ip6mr_fill_mroute(skb, cache, rtm);
1793 	read_unlock(&mrt_lock);
1794 	return err;
1795 }
1796 
1797