projects/linux·blob master · refs

2832 lines · 67.3 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Linux IPv6 multicast routing support for BSD pim6sd
4 * Based on net/ipv4/ipmr.c.
5 *
6 * (c) 2004 Mickael Hoerdt, <[email protected]>
7 * LSIIT Laboratory, Strasbourg, France
8 * (c) 2004 Jean-Philippe Andriot, <[email protected]>
9 * 6WIND, Paris, France
10 * Copyright (C)2007,2008 USAGI/WIDE Project
11 * YOSHIFUJI Hideaki <[email protected]>
12 */
13
14#include <linux/uaccess.h>
15#include <linux/types.h>
16#include <linux/sched.h>
17#include <linux/errno.h>
18#include <linux/mm.h>
19#include <linux/kernel.h>
20#include <linux/fcntl.h>
21#include <linux/stat.h>
22#include <linux/socket.h>
23#include <linux/inet.h>
24#include <linux/netdevice.h>
25#include <linux/inetdevice.h>
26#include <linux/proc_fs.h>
27#include <linux/seq_file.h>
28#include <linux/init.h>
29#include <linux/compat.h>
30#include <linux/rhashtable.h>
31#include <net/protocol.h>
32#include <linux/skbuff.h>
33#include <net/raw.h>
34#include <linux/notifier.h>
35#include <linux/if_arp.h>
36#include <net/checksum.h>
37#include <net/netlink.h>
38#include <net/fib_rules.h>
39
40#include <net/ipv6.h>
41#include <net/ip6_route.h>
42#include <linux/mroute6.h>
43#include <linux/pim.h>
44#include <net/addrconf.h>
45#include <linux/netfilter_ipv6.h>
46#include <linux/export.h>
47#include <net/ip6_checksum.h>
48#include <linux/netconf.h>
49#include <net/ip_tunnels.h>
50
51#include <linux/nospec.h>
52
53struct ip6mr_rule {
54 struct fib_rule common;
55};
56
57struct ip6mr_result {
58 struct mr_table *mrt;
59};
60
61/* Big lock, protecting vif table, mrt cache and mroute socket state.
62 Note that the changes are semaphored via rtnl_lock.
63 */
64
65static DEFINE_SPINLOCK(mrt_lock);
66
67static struct net_device *vif_dev_read(const struct vif_device *vif)
68{
69 return rcu_dereference(vif->dev);
70}
71
72/* Multicast router control variables */
73
74/* Special spinlock for queue of unresolved entries */
75static DEFINE_SPINLOCK(mfc_unres_lock);
76
77/* We return to original Alan's scheme. Hash table of resolved
78 entries is changed only in process context and protected
79 with weak lock mrt_lock. Queue of unresolved entries is protected
80 with strong spinlock mfc_unres_lock.
81
82 In this case data path is free of exclusive locks at all.
83 */
84
85static struct kmem_cache *mrt_cachep __read_mostly;
86
87static struct mr_table *ip6mr_new_table(struct net *net, u32 id);
88static void ip6mr_free_table(struct mr_table *mrt,
89 struct list_head *dev_kill_list);
90
91static void ip6_mr_forward(struct net *net, struct mr_table *mrt,
92 struct net_device *dev, struct sk_buff *skb,
93 struct mfc6_cache *cache);
94static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt,
95 mifi_t mifi, int assert);
96static void mr6_netlink_event(struct mr_table *mrt, struct mfc6_cache *mfc,
97 int cmd);
98static void mrt6msg_netlink_event(const struct mr_table *mrt, struct sk_buff *pkt);
99static int ip6mr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
100 struct netlink_ext_ack *extack);
101static int ip6mr_rtm_dumproute(struct sk_buff *skb,
102 struct netlink_callback *cb);
103static void mroute_clean_tables(struct mr_table *mrt, int flags,
104 struct list_head *dev_kill_list);
105static void ipmr_expire_process(struct timer_list *t);
106
107#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
108#define ip6mr_for_each_table(mrt, net) \
109 list_for_each_entry_rcu(mrt, &net->ipv6.mr6_tables, list, \
110 lockdep_rtnl_is_held() || \
111 list_empty(&net->ipv6.mr6_tables))
112
113static struct mr_table *ip6mr_mr_table_iter(struct net *net,
114 struct mr_table *mrt)
115{
116 struct mr_table *ret;
117
118 if (!mrt)
119 ret = list_entry_rcu(net->ipv6.mr6_tables.next,
120 struct mr_table, list);
121 else
122 ret = list_entry_rcu(mrt->list.next,
123 struct mr_table, list);
124
125 if (&ret->list == &net->ipv6.mr6_tables)
126 return NULL;
127 return ret;
128}
129
130static struct mr_table *__ip6mr_get_table(struct net *net, u32 id)
131{
132 struct mr_table *mrt;
133
134 ip6mr_for_each_table(mrt, net) {
135 if (mrt->id == id)
136 return mrt;
137 }
138 return NULL;
139}
140
141static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
142 struct mr_table **mrt)
143{
144 int err;
145 struct ip6mr_result res;
146 struct fib_lookup_arg arg = {
147 .result = &res,
148 .flags = FIB_LOOKUP_NOREF,
149 };
150
151 /* update flow if oif or iif point to device enslaved to l3mdev */
152 l3mdev_update_flow(net, flowi6_to_flowi(flp6));
153
154 err = fib_rules_lookup(net->ipv6.mr6_rules_ops,
155 flowi6_to_flowi(flp6), 0, &arg);
156 if (err < 0)
157 return err;
158 *mrt = res.mrt;
159 return 0;
160}
161
162static int ip6mr_rule_action(struct fib_rule *rule, struct flowi *flp,
163 int flags, struct fib_lookup_arg *arg)
164{
165 struct ip6mr_result *res = arg->result;
166 struct mr_table *mrt;
167
168 switch (rule->action) {
169 case FR_ACT_TO_TBL:
170 break;
171 case FR_ACT_UNREACHABLE:
172 return -ENETUNREACH;
173 case FR_ACT_PROHIBIT:
174 return -EACCES;
175 case FR_ACT_BLACKHOLE:
176 default:
177 return -EINVAL;
178 }
179
180 arg->table = fib_rule_get_table(rule, arg);
181
182 mrt = __ip6mr_get_table(rule->fr_net, arg->table);
183 if (!mrt)
184 return -EAGAIN;
185 res->mrt = mrt;
186 return 0;
187}
188
189static int ip6mr_rule_match(struct fib_rule *rule, struct flowi *flp, int flags)
190{
191 return 1;
192}
193
194static int ip6mr_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
195 struct fib_rule_hdr *frh, struct nlattr **tb,
196 struct netlink_ext_ack *extack)
197{
198 return 0;
199}
200
201static int ip6mr_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
202 struct nlattr **tb)
203{
204 return 1;
205}
206
207static int ip6mr_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
208 struct fib_rule_hdr *frh)
209{
210 frh->dst_len = 0;
211 frh->src_len = 0;
212 frh->tos = 0;
213 return 0;
214}
215
216static const struct fib_rules_ops __net_initconst ip6mr_rules_ops_template = {
217 .family = RTNL_FAMILY_IP6MR,
218 .rule_size = sizeof(struct ip6mr_rule),
219 .addr_size = sizeof(struct in6_addr),
220 .action = ip6mr_rule_action,
221 .match = ip6mr_rule_match,
222 .configure = ip6mr_rule_configure,
223 .compare = ip6mr_rule_compare,
224 .fill = ip6mr_rule_fill,
225 .nlgroup = RTNLGRP_IPV6_RULE,
226 .owner = THIS_MODULE,
227};
228
229static int __net_init ip6mr_rules_init(struct net *net)
230{
231 struct fib_rules_ops *ops;
232 LIST_HEAD(dev_kill_list);
233 struct mr_table *mrt;
234 int err;
235
236 ops = fib_rules_register(&ip6mr_rules_ops_template, net);
237 if (IS_ERR(ops))
238 return PTR_ERR(ops);
239
240 INIT_LIST_HEAD(&net->ipv6.mr6_tables);
241
242 mrt = ip6mr_new_table(net, RT6_TABLE_DFLT);
243 if (IS_ERR(mrt)) {
244 err = PTR_ERR(mrt);
245 goto err1;
246 }
247
248 err = fib_default_rule_add(ops, 0x7fff, RT6_TABLE_DFLT);
249 if (err < 0)
250 goto err2;
251
252 net->ipv6.mr6_rules_ops = ops;
253 return 0;
254
255err2:
256 ip6mr_free_table(mrt, &dev_kill_list);
257err1:
258 fib_rules_unregister(ops);
259 return err;
260}
261
262static void __net_exit ip6mr_rules_exit(struct net *net)
263{
264 fib_rules_unregister(net->ipv6.mr6_rules_ops);
265}
266
267static void __net_exit ip6mr_rules_exit_rtnl(struct net *net,
268 struct list_head *dev_kill_list)
269{
270 struct mr_table *mrt, *next;
271
272 list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
273 list_del_rcu(&mrt->list);
274 ip6mr_free_table(mrt, dev_kill_list);
275 }
276}
277
278static int ip6mr_rules_dump(struct net *net, struct notifier_block *nb,
279 struct netlink_ext_ack *extack)
280{
281 return fib_rules_dump(net, nb, RTNL_FAMILY_IP6MR, extack);
282}
283
284static unsigned int ip6mr_rules_seq_read(const struct net *net)
285{
286 return fib_rules_seq_read(net, RTNL_FAMILY_IP6MR);
287}
288
289bool ip6mr_rule_default(const struct fib_rule *rule)
290{
291 return fib_rule_matchall(rule) && rule->action == FR_ACT_TO_TBL &&
292 rule->table == RT6_TABLE_DFLT && !rule->l3mdev;
293}
294EXPORT_SYMBOL(ip6mr_rule_default);
295#else
296static struct mr_table *ip6mr_mr_table_iter(struct net *net,
297 struct mr_table *mrt)
298{
299 if (!mrt)
300 return rcu_dereference(net->ipv6.mrt6);
301 return NULL;
302}
303
304static struct mr_table *__ip6mr_get_table(struct net *net, u32 id)
305{
306 return rcu_dereference_check(net->ipv6.mrt6,
307 lockdep_rtnl_is_held() ||
308 !rcu_access_pointer(net->ipv6.mrt6));
309}
310
311#define ip6mr_for_each_table(mrt, net) \
312 for (mrt = __ip6mr_get_table(net, 0); mrt; mrt = NULL)
313
314static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
315 struct mr_table **mrt)
316{
317 *mrt = rcu_dereference(net->ipv6.mrt6);
318 if (!*mrt)
319 return -EAGAIN;
320 return 0;
321}
322
323static int __net_init ip6mr_rules_init(struct net *net)
324{
325 struct mr_table *mrt;
326
327 mrt = ip6mr_new_table(net, RT6_TABLE_DFLT);
328 if (IS_ERR(mrt))
329 return PTR_ERR(mrt);
330
331 rcu_assign_pointer(net->ipv6.mrt6, mrt);
332 return 0;
333}
334
335static void __net_exit ip6mr_rules_exit(struct net *net)
336{
337}
338
339static void __net_exit ip6mr_rules_exit_rtnl(struct net *net,
340 struct list_head *dev_kill_list)
341{
342 struct mr_table *mrt = rcu_dereference_protected(net->ipv6.mrt6, 1);
343
344 RCU_INIT_POINTER(net->ipv6.mrt6, NULL);
345 ip6mr_free_table(mrt, dev_kill_list);
346}
347
348static int ip6mr_rules_dump(struct net *net, struct notifier_block *nb,
349 struct netlink_ext_ack *extack)
350{
351 return 0;
352}
353
354static unsigned int ip6mr_rules_seq_read(const struct net *net)
355{
356 return 0;
357}
358#endif
359
360static struct mr_table *ip6mr_get_table(struct net *net, u32 id)
361{
362 struct mr_table *mrt;
363
364 rcu_read_lock();
365 mrt = __ip6mr_get_table(net, id);
366 rcu_read_unlock();
367
368 return mrt;
369}
370
371static int ip6mr_hash_cmp(struct rhashtable_compare_arg *arg,
372 const void *ptr)
373{
374 const struct mfc6_cache_cmp_arg *cmparg = arg->key;
375 struct mfc6_cache *c = (struct mfc6_cache *)ptr;
376
377 return !ipv6_addr_equal(&c->mf6c_mcastgrp, &cmparg->mf6c_mcastgrp) ||
378 !ipv6_addr_equal(&c->mf6c_origin, &cmparg->mf6c_origin);
379}
380
381static const struct rhashtable_params ip6mr_rht_params = {
382 .head_offset = offsetof(struct mr_mfc, mnode),
383 .key_offset = offsetof(struct mfc6_cache, cmparg),
384 .key_len = sizeof(struct mfc6_cache_cmp_arg),
385 .nelem_hint = 3,
386 .obj_cmpfn = ip6mr_hash_cmp,
387 .automatic_shrinking = true,
388};
389
390static void ip6mr_new_table_set(struct mr_table *mrt,
391 struct net *net)
392{
393#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
394 list_add_tail_rcu(&mrt->list, &net->ipv6.mr6_tables);
395#endif
396}
397
398static struct mfc6_cache_cmp_arg ip6mr_mr_table_ops_cmparg_any = {
399 .mf6c_origin = IN6ADDR_ANY_INIT,
400 .mf6c_mcastgrp = IN6ADDR_ANY_INIT,
401};
402
403static struct mr_table_ops ip6mr_mr_table_ops = {
404 .rht_params = &ip6mr_rht_params,
405 .cmparg_any = &ip6mr_mr_table_ops_cmparg_any,
406};
407
408static struct mr_table *ip6mr_new_table(struct net *net, u32 id)
409{
410 struct mr_table *mrt;
411
412 mrt = __ip6mr_get_table(net, id);
413 if (mrt)
414 return mrt;
415
416 return mr_table_alloc(net, id, &ip6mr_mr_table_ops,
417 ipmr_expire_process, ip6mr_new_table_set);
418}
419
420static void ip6mr_free_table(struct mr_table *mrt,
421 struct list_head *dev_kill_list)
422{
423 struct net *net = read_pnet(&mrt->net);
424 LIST_HEAD(ip6mr_dev_kill_list);
425
426 WARN_ON_ONCE(!mr_can_free_table(net));
427
428 timer_shutdown_sync(&mrt->ipmr_expire_timer);
429 mroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MIFS_STATIC |
430 MRT6_FLUSH_MFC | MRT6_FLUSH_MFC_STATIC,
431 &ip6mr_dev_kill_list);
432
433 mr_table_free(mrt);
434
435 WARN_ON_ONCE(!net_initialized(net) && !list_empty(&ip6mr_dev_kill_list));
436 list_splice(&ip6mr_dev_kill_list, dev_kill_list);
437}
438
439#ifdef CONFIG_PROC_FS
440/* The /proc interfaces to multicast routing
441 * /proc/ip6_mr_cache /proc/ip6_mr_vif
442 */
443
444static void *ip6mr_vif_seq_start(struct seq_file *seq, loff_t *pos)
445 __acquires(RCU)
446{
447 struct mr_vif_iter *iter = seq->private;
448 struct net *net = seq_file_net(seq);
449 struct mr_table *mrt;
450
451 rcu_read_lock();
452 mrt = __ip6mr_get_table(net, RT6_TABLE_DFLT);
453 if (!mrt) {
454 rcu_read_unlock();
455 return ERR_PTR(-ENOENT);
456 }
457
458 iter->mrt = mrt;
459
460 return mr_vif_seq_start(seq, pos);
461}
462
463static void ip6mr_vif_seq_stop(struct seq_file *seq, void *v)
464 __releases(RCU)
465{
466 rcu_read_unlock();
467}
468
469static int ip6mr_vif_seq_show(struct seq_file *seq, void *v)
470{
471 struct mr_vif_iter *iter = seq->private;
472 struct mr_table *mrt = iter->mrt;
473
474 if (v == SEQ_START_TOKEN) {
475 seq_puts(seq,
476 "Interface BytesIn PktsIn BytesOut PktsOut Flags\n");
477 } else {
478 const struct vif_device *vif = v;
479 const struct net_device *vif_dev;
480 const char *name;
481
482 vif_dev = vif_dev_read(vif);
483 name = vif_dev ? vif_dev->name : "none";
484
485 seq_printf(seq,
486 "%2td %-10s %8ld %7ld %8ld %7ld %05X\n",
487 vif - mrt->vif_table,
488 name, vif->bytes_in, vif->pkt_in,
489 vif->bytes_out, vif->pkt_out,
490 vif->flags);
491 }
492 return 0;
493}
494
495static const struct seq_operations ip6mr_vif_seq_ops = {
496 .start = ip6mr_vif_seq_start,
497 .next = mr_vif_seq_next,
498 .stop = ip6mr_vif_seq_stop,
499 .show = ip6mr_vif_seq_show,
500};
501
502static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos)
503{
504 struct net *net = seq_file_net(seq);
505 struct mr_table *mrt;
506
507 mrt = ip6mr_get_table(net, RT6_TABLE_DFLT);
508 if (!mrt)
509 return ERR_PTR(-ENOENT);
510
511 return mr_mfc_seq_start(seq, pos, mrt, &mfc_unres_lock);
512}
513
514static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
515{
516 int n;
517
518 if (v == SEQ_START_TOKEN) {
519 seq_puts(seq,
520 "Group "
521 "Origin "
522 "Iif Pkts Bytes Wrong Oifs\n");
523 } else {
524 const struct mfc6_cache *mfc = v;
525 const struct mr_mfc_iter *it = seq->private;
526 struct mr_table *mrt = it->mrt;
527
528 seq_printf(seq, "%pI6 %pI6 %-3hd",
529 &mfc->mf6c_mcastgrp, &mfc->mf6c_origin,
530 mfc->_c.mfc_parent);
531
532 if (it->cache != &mrt->mfc_unres_queue) {
533 seq_printf(seq, " %8lu %8lu %8lu",
534 atomic_long_read(&mfc->_c.mfc_un.res.pkt),
535 atomic_long_read(&mfc->_c.mfc_un.res.bytes),
536 atomic_long_read(&mfc->_c.mfc_un.res.wrong_if));
537 for (n = mfc->_c.mfc_un.res.minvif;
538 n < mfc->_c.mfc_un.res.maxvif; n++) {
539 if (VIF_EXISTS(mrt, n) &&
540 mfc->_c.mfc_un.res.ttls[n] < 255)
541 seq_printf(seq,
542 " %2d:%-3d", n,
543 mfc->_c.mfc_un.res.ttls[n]);
544 }
545 } else {
546 /* unresolved mfc_caches don't contain
547 * pkt, bytes and wrong_if values
548 */
549 seq_printf(seq, " %8lu %8lu %8lu", 0ul, 0ul, 0ul);
550 }
551 seq_putc(seq, '\n');
552 }
553 return 0;
554}
555
556static const struct seq_operations ipmr_mfc_seq_ops = {
557 .start = ipmr_mfc_seq_start,
558 .next = mr_mfc_seq_next,
559 .stop = mr_mfc_seq_stop,
560 .show = ipmr_mfc_seq_show,
561};
562#endif
563
564#ifdef CONFIG_IPV6_PIMSM_V2
565
566static int pim6_rcv(struct sk_buff *skb)
567{
568 struct pimreghdr *pim;
569 struct ipv6hdr *encap;
570 struct net_device *reg_dev = NULL;
571 struct net *net = dev_net(skb->dev);
572 struct mr_table *mrt;
573 struct flowi6 fl6 = {
574 .flowi6_iif = skb->dev->ifindex,
575 .flowi6_mark = skb->mark,
576 };
577 int reg_vif_num;
578
579 if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(*encap)))
580 goto drop;
581
582 pim = (struct pimreghdr *)skb_transport_header(skb);
583 if (pim->type != ((PIM_VERSION << 4) | PIM_TYPE_REGISTER) ||
584 (pim->flags & PIM_NULL_REGISTER) ||
585 (csum_ipv6_magic(&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
586 sizeof(*pim), IPPROTO_PIM,
587 csum_partial((void *)pim, sizeof(*pim), 0)) &&
588 csum_fold(skb_checksum(skb, 0, skb->len, 0))))
589 goto drop;
590
591 /* check if the inner packet is destined to mcast group */
592 encap = (struct ipv6hdr *)(skb_transport_header(skb) +
593 sizeof(*pim));
594
595 if (!ipv6_addr_is_multicast(&encap->daddr) ||
596 encap->payload_len == 0 ||
597 ntohs(encap->payload_len) + sizeof(*pim) > skb->len)
598 goto drop;
599
600 if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0)
601 goto drop;
602
603 /* Pairs with WRITE_ONCE() in mif6_add()/mif6_delete() */
604 reg_vif_num = READ_ONCE(mrt->mroute_reg_vif_num);
605 if (reg_vif_num >= 0)
606 reg_dev = vif_dev_read(&mrt->vif_table[reg_vif_num]);
607
608 if (!reg_dev)
609 goto drop;
610
611 skb->mac_header = skb->network_header;
612 skb_pull(skb, (u8 *)encap - skb->data);
613 skb_reset_network_header(skb);
614 skb->protocol = htons(ETH_P_IPV6);
615 skb->ip_summed = CHECKSUM_NONE;
616
617 skb_tunnel_rx(skb, reg_dev, dev_net(reg_dev));
618
619 netif_rx(skb);
620
621 return 0;
622 drop:
623 kfree_skb(skb);
624 return 0;
625}
626
627static const struct inet6_protocol pim6_protocol = {
628 .handler = pim6_rcv,
629};
630
631/* Service routines creating virtual interfaces: PIMREG */
632
633static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
634 struct net_device *dev)
635{
636 struct net *net = dev_net(dev);
637 struct mr_table *mrt;
638 struct flowi6 fl6 = {
639 .flowi6_oif = dev->ifindex,
640 .flowi6_iif = skb->skb_iif ? : LOOPBACK_IFINDEX,
641 .flowi6_mark = skb->mark,
642 };
643
644 if (!pskb_inet_may_pull(skb))
645 goto tx_err;
646
647 rcu_read_lock();
648
649 if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0)
650 goto tx_lookup_err;
651
652 DEV_STATS_ADD(dev, tx_bytes, skb->len);
653 DEV_STATS_INC(dev, tx_packets);
654
655 ip6mr_cache_report(mrt, skb, READ_ONCE(mrt->mroute_reg_vif_num),
656 MRT6MSG_WHOLEPKT);
657 rcu_read_unlock();
658 kfree_skb(skb);
659 return NETDEV_TX_OK;
660
661tx_lookup_err:
662 rcu_read_unlock();
663tx_err:
664 DEV_STATS_INC(dev, tx_errors);
665 kfree_skb(skb);
666 return NETDEV_TX_OK;
667}
668
669static int reg_vif_get_iflink(const struct net_device *dev)
670{
671 return 0;
672}
673
674static const struct net_device_ops reg_vif_netdev_ops = {
675 .ndo_start_xmit = reg_vif_xmit,
676 .ndo_get_iflink = reg_vif_get_iflink,
677};
678
679static void reg_vif_setup(struct net_device *dev)
680{
681 dev->type = ARPHRD_PIMREG;
682 dev->mtu = 1500 - sizeof(struct ipv6hdr) - 8;
683 dev->flags = IFF_NOARP;
684 dev->netdev_ops = &reg_vif_netdev_ops;
685 dev->needs_free_netdev = true;
686 dev->netns_immutable = true;
687}
688
689static struct net_device *ip6mr_reg_vif(struct net *net, struct mr_table *mrt)
690{
691 struct net_device *dev;
692 char name[IFNAMSIZ];
693
694 if (mrt->id == RT6_TABLE_DFLT)
695 sprintf(name, "pim6reg");
696 else
697 sprintf(name, "pim6reg%u", mrt->id);
698
699 dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, reg_vif_setup);
700 if (!dev)
701 return NULL;
702
703 dev_net_set(dev, net);
704
705 if (register_netdevice(dev)) {
706 free_netdev(dev);
707 return NULL;
708 }
709
710 if (dev_open(dev, NULL))
711 goto failure;
712
713 dev_hold(dev);
714 return dev;
715
716failure:
717 unregister_netdevice(dev);
718 return NULL;
719}
720#endif
721
722static int call_ip6mr_vif_entry_notifiers(struct net *net,
723 enum fib_event_type event_type,
724 struct vif_device *vif,
725 struct net_device *vif_dev,
726 mifi_t vif_index, u32 tb_id)
727{
728 return mr_call_vif_notifiers(net, RTNL_FAMILY_IP6MR, event_type,
729 vif, vif_dev, vif_index, tb_id,
730 &net->ipv6.ipmr_seq);
731}
732
733static int call_ip6mr_mfc_entry_notifiers(struct net *net,
734 enum fib_event_type event_type,
735 struct mfc6_cache *mfc, u32 tb_id)
736{
737 return mr_call_mfc_notifiers(net, RTNL_FAMILY_IP6MR, event_type,
738 &mfc->_c, tb_id, &net->ipv6.ipmr_seq);
739}
740
741/* Delete a VIF entry */
742static int mif6_delete(struct mr_table *mrt, int vifi, int notify,
743 struct list_head *head)
744{
745 struct vif_device *v;
746 struct net_device *dev;
747 struct inet6_dev *in6_dev;
748
749 if (vifi < 0 || vifi >= mrt->maxvif)
750 return -EADDRNOTAVAIL;
751
752 v = &mrt->vif_table[vifi];
753
754 dev = rtnl_dereference(v->dev);
755 if (!dev)
756 return -EADDRNOTAVAIL;
757
758 call_ip6mr_vif_entry_notifiers(read_pnet(&mrt->net),
759 FIB_EVENT_VIF_DEL, v, dev,
760 vifi, mrt->id);
761 spin_lock(&mrt_lock);
762 RCU_INIT_POINTER(v->dev, NULL);
763
764#ifdef CONFIG_IPV6_PIMSM_V2
765 if (vifi == mrt->mroute_reg_vif_num) {
766 /* Pairs with READ_ONCE() in ip6mr_cache_report() and reg_vif_xmit() */
767 WRITE_ONCE(mrt->mroute_reg_vif_num, -1);
768 }
769#endif
770
771 if (vifi + 1 == mrt->maxvif) {
772 int tmp;
773 for (tmp = vifi - 1; tmp >= 0; tmp--) {
774 if (VIF_EXISTS(mrt, tmp))
775 break;
776 }
777 WRITE_ONCE(mrt->maxvif, tmp + 1);
778 }
779
780 spin_unlock(&mrt_lock);
781
782 dev_set_allmulti(dev, -1);
783
784 in6_dev = __in6_dev_get(dev);
785 if (in6_dev) {
786 atomic_dec(&in6_dev->cnf.mc_forwarding);
787 inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF,
788 NETCONFA_MC_FORWARDING,
789 dev->ifindex, &in6_dev->cnf);
790 }
791
792 if ((v->flags & MIFF_REGISTER) && !notify)
793 unregister_netdevice_queue(dev, head);
794
795 netdev_put(dev, &v->dev_tracker);
796 return 0;
797}
798
799static inline void ip6mr_cache_free_rcu(struct rcu_head *head)
800{
801 struct mr_mfc *c = container_of(head, struct mr_mfc, rcu);
802
803 kmem_cache_free(mrt_cachep, (struct mfc6_cache *)c);
804}
805
806static inline void ip6mr_cache_free(struct mfc6_cache *c)
807{
808 call_rcu(&c->_c.rcu, ip6mr_cache_free_rcu);
809}
810
811/* Destroy an unresolved cache entry, killing queued skbs
812 and reporting error to netlink readers.
813 */
814
815static void ip6mr_destroy_unres(struct mr_table *mrt, struct mfc6_cache *c)
816{
817 struct net *net = read_pnet(&mrt->net);
818 struct sk_buff *skb;
819
820 WRITE_ONCE(mrt->cache_resolve_queue_len,
821 mrt->cache_resolve_queue_len - 1);
822
823 while ((skb = skb_dequeue(&c->_c.mfc_un.unres.unresolved)) != NULL) {
824 if (ipv6_hdr(skb)->version == 0) {
825 struct nlmsghdr *nlh = skb_pull(skb,
826 sizeof(struct ipv6hdr));
827 nlh->nlmsg_type = NLMSG_ERROR;
828 nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr));
829 skb_trim(skb, nlh->nlmsg_len);
830 ((struct nlmsgerr *)nlmsg_data(nlh))->error = -ETIMEDOUT;
831 rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
832 } else
833 kfree_skb(skb);
834 }
835
836 ip6mr_cache_free(c);
837}
838
839
840/* Timer process for all the unresolved queue. */
841
842static void ipmr_do_expire_process(struct mr_table *mrt)
843{
844 unsigned long now = jiffies;
845 unsigned long expires = 10 * HZ;
846 struct mr_mfc *c, *next;
847
848 list_for_each_entry_safe(c, next, &mrt->mfc_unres_queue, list) {
849 if (time_after(c->mfc_un.unres.expires, now)) {
850 /* not yet... */
851 unsigned long interval = c->mfc_un.unres.expires - now;
852 if (interval < expires)
853 expires = interval;
854 continue;
855 }
856
857 list_del(&c->list);
858 mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE);
859 ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c);
860 }
861
862 if (!list_empty(&mrt->mfc_unres_queue))
863 mod_timer(&mrt->ipmr_expire_timer, jiffies + expires);
864}
865
866static void ipmr_expire_process(struct timer_list *t)
867{
868 struct mr_table *mrt = timer_container_of(mrt, t, ipmr_expire_timer);
869
870 if (!spin_trylock(&mfc_unres_lock)) {
871 mod_timer(&mrt->ipmr_expire_timer, jiffies + 1);
872 return;
873 }
874
875 if (!list_empty(&mrt->mfc_unres_queue))
876 ipmr_do_expire_process(mrt);
877
878 spin_unlock(&mfc_unres_lock);
879}
880
881/* Fill oifs list. It is called under locked mrt_lock. */
882
883static void ip6mr_update_thresholds(struct mr_table *mrt,
884 struct mr_mfc *cache,
885 unsigned char *ttls)
886{
887 int vifi;
888
889 cache->mfc_un.res.minvif = MAXMIFS;
890 cache->mfc_un.res.maxvif = 0;
891 memset(cache->mfc_un.res.ttls, 255, MAXMIFS);
892
893 for (vifi = 0; vifi < mrt->maxvif; vifi++) {
894 if (VIF_EXISTS(mrt, vifi) &&
895 ttls[vifi] && ttls[vifi] < 255) {
896 cache->mfc_un.res.ttls[vifi] = ttls[vifi];
897 if (cache->mfc_un.res.minvif > vifi)
898 cache->mfc_un.res.minvif = vifi;
899 if (cache->mfc_un.res.maxvif <= vifi)
900 cache->mfc_un.res.maxvif = vifi + 1;
901 }
902 }
903 WRITE_ONCE(cache->mfc_un.res.lastuse, jiffies);
904}
905
906static int mif6_add(struct net *net, struct mr_table *mrt,
907 struct mif6ctl *vifc, int mrtsock)
908{
909 int vifi = vifc->mif6c_mifi;
910 struct vif_device *v = &mrt->vif_table[vifi];
911 struct net_device *dev;
912 struct inet6_dev *in6_dev;
913 int err;
914
915 /* Is vif busy ? */
916 if (VIF_EXISTS(mrt, vifi))
917 return -EADDRINUSE;
918
919 switch (vifc->mif6c_flags) {
920#ifdef CONFIG_IPV6_PIMSM_V2
921 case MIFF_REGISTER:
922 /*
923 * Special Purpose VIF in PIM
924 * All the packets will be sent to the daemon
925 */
926 if (mrt->mroute_reg_vif_num >= 0)
927 return -EADDRINUSE;
928 dev = ip6mr_reg_vif(net, mrt);
929 if (!dev)
930 return -ENOBUFS;
931 err = dev_set_allmulti(dev, 1);
932 if (err) {
933 unregister_netdevice(dev);
934 dev_put(dev);
935 return err;
936 }
937 break;
938#endif
939 case 0:
940 dev = dev_get_by_index(net, vifc->mif6c_pifi);
941 if (!dev)
942 return -EADDRNOTAVAIL;
943 err = dev_set_allmulti(dev, 1);
944 if (err) {
945 dev_put(dev);
946 return err;
947 }
948 break;
949 default:
950 return -EINVAL;
951 }
952
953 in6_dev = __in6_dev_get(dev);
954 if (in6_dev) {
955 atomic_inc(&in6_dev->cnf.mc_forwarding);
956 inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF,
957 NETCONFA_MC_FORWARDING,
958 dev->ifindex, &in6_dev->cnf);
959 }
960
961 /* Fill in the VIF structures */
962 vif_device_init(v, dev, vifc->vifc_rate_limit, vifc->vifc_threshold,
963 vifc->mif6c_flags | (!mrtsock ? VIFF_STATIC : 0),
964 MIFF_REGISTER);
965
966 /* And finish update writing critical data */
967 spin_lock(&mrt_lock);
968 rcu_assign_pointer(v->dev, dev);
969 netdev_tracker_alloc(dev, &v->dev_tracker, GFP_ATOMIC);
970#ifdef CONFIG_IPV6_PIMSM_V2
971 if (v->flags & MIFF_REGISTER)
972 WRITE_ONCE(mrt->mroute_reg_vif_num, vifi);
973#endif
974 if (vifi + 1 > mrt->maxvif)
975 WRITE_ONCE(mrt->maxvif, vifi + 1);
976 spin_unlock(&mrt_lock);
977 call_ip6mr_vif_entry_notifiers(net, FIB_EVENT_VIF_ADD,
978 v, dev, vifi, mrt->id);
979 return 0;
980}
981
982static struct mfc6_cache *ip6mr_cache_find(struct mr_table *mrt,
983 const struct in6_addr *origin,
984 const struct in6_addr *mcastgrp)
985{
986 struct mfc6_cache_cmp_arg arg = {
987 .mf6c_origin = *origin,
988 .mf6c_mcastgrp = *mcastgrp,
989 };
990
991 return mr_mfc_find(mrt, &arg);
992}
993
994/* Look for a (*,G) entry */
995static struct mfc6_cache *ip6mr_cache_find_any(struct mr_table *mrt,
996 struct in6_addr *mcastgrp,
997 mifi_t mifi)
998{
999 struct mfc6_cache_cmp_arg arg = {
1000 .mf6c_origin = in6addr_any,
1001 .mf6c_mcastgrp = *mcastgrp,
1002 };
1003
1004 if (ipv6_addr_any(mcastgrp))
1005 return mr_mfc_find_any_parent(mrt, mifi);
1006 return mr_mfc_find_any(mrt, mifi, &arg);
1007}
1008
1009/* Look for a (S,G,iif) entry if parent != -1 */
1010static struct mfc6_cache *
1011ip6mr_cache_find_parent(struct mr_table *mrt,
1012 const struct in6_addr *origin,
1013 const struct in6_addr *mcastgrp,
1014 int parent)
1015{
1016 struct mfc6_cache_cmp_arg arg = {
1017 .mf6c_origin = *origin,
1018 .mf6c_mcastgrp = *mcastgrp,
1019 };
1020
1021 return mr_mfc_find_parent(mrt, &arg, parent);
1022}
1023
1024/* Allocate a multicast cache entry */
1025static struct mfc6_cache *ip6mr_cache_alloc(void)
1026{
1027 struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
1028 if (!c)
1029 return NULL;
1030 c->_c.mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
1031 c->_c.mfc_un.res.minvif = MAXMIFS;
1032 c->_c.free = ip6mr_cache_free_rcu;
1033 refcount_set(&c->_c.mfc_un.res.refcount, 1);
1034 return c;
1035}
1036
1037static struct mfc6_cache *ip6mr_cache_alloc_unres(void)
1038{
1039 struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_ATOMIC);
1040 if (!c)
1041 return NULL;
1042 skb_queue_head_init(&c->_c.mfc_un.unres.unresolved);
1043 c->_c.mfc_un.unres.expires = jiffies + 10 * HZ;
1044 return c;
1045}
1046
1047/*
1048 * A cache entry has gone into a resolved state from queued
1049 */
1050
1051static void ip6mr_cache_resolve(struct net *net, struct mr_table *mrt,
1052 struct mfc6_cache *uc, struct mfc6_cache *c)
1053{
1054 struct sk_buff *skb;
1055
1056 /*
1057 * Play the pending entries through our router
1058 */
1059
1060 while ((skb = __skb_dequeue(&uc->_c.mfc_un.unres.unresolved))) {
1061 if (ipv6_hdr(skb)->version == 0) {
1062 struct nlmsghdr *nlh = skb_pull(skb,
1063 sizeof(struct ipv6hdr));
1064
1065 if (mr_fill_mroute(mrt, skb, &c->_c,
1066 nlmsg_data(nlh)) > 0) {
1067 nlh->nlmsg_len = skb_tail_pointer(skb) - (u8 *)nlh;
1068 } else {
1069 nlh->nlmsg_type = NLMSG_ERROR;
1070 nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr));
1071 skb_trim(skb, nlh->nlmsg_len);
1072 ((struct nlmsgerr *)nlmsg_data(nlh))->error = -EMSGSIZE;
1073 }
1074 rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
1075 } else {
1076 rcu_read_lock();
1077 ip6_mr_forward(net, mrt, skb->dev, skb, c);
1078 rcu_read_unlock();
1079 }
1080 }
1081}
1082
1083/*
1084 * Bounce a cache query up to pim6sd and netlink.
1085 *
1086 * Called under rcu_read_lock()
1087 */
1088
1089static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt,
1090 mifi_t mifi, int assert)
1091{
1092 enum skb_drop_reason reason;
1093 struct sock *mroute6_sk;
1094 struct sk_buff *skb;
1095 struct mrt6msg *msg;
1096
1097 mroute6_sk = rcu_dereference(mrt->mroute_sk);
1098 if (!mroute6_sk)
1099 return -EINVAL;
1100
1101#ifdef CONFIG_IPV6_PIMSM_V2
1102 if (assert == MRT6MSG_WHOLEPKT || assert == MRT6MSG_WRMIFWHOLE)
1103 skb = skb_realloc_headroom(pkt, -skb_network_offset(pkt)
1104 +sizeof(*msg));
1105 else
1106#endif
1107 skb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(*msg), GFP_ATOMIC);
1108
1109 if (!skb)
1110 return -ENOBUFS;
1111
1112 /* I suppose that internal messages
1113 * do not require checksums */
1114
1115 skb->ip_summed = CHECKSUM_UNNECESSARY;
1116
1117#ifdef CONFIG_IPV6_PIMSM_V2
1118 if (assert == MRT6MSG_WHOLEPKT || assert == MRT6MSG_WRMIFWHOLE) {
1119 /* Ugly, but we have no choice with this interface.
1120 Duplicate old header, fix length etc.
1121 And all this only to mangle msg->im6_msgtype and
1122 to set msg->im6_mbz to "mbz" :-)
1123 */
1124 __skb_pull(skb, skb_network_offset(pkt));
1125
1126 skb_push(skb, sizeof(*msg));
1127 skb_reset_transport_header(skb);
1128 msg = (struct mrt6msg *)skb_transport_header(skb);
1129 msg->im6_mbz = 0;
1130 msg->im6_msgtype = assert;
1131 if (assert == MRT6MSG_WRMIFWHOLE)
1132 msg->im6_mif = mifi;
1133 else
1134 msg->im6_mif = READ_ONCE(mrt->mroute_reg_vif_num);
1135 msg->im6_pad = 0;
1136 msg->im6_src = ipv6_hdr(pkt)->saddr;
1137 msg->im6_dst = ipv6_hdr(pkt)->daddr;
1138
1139 skb->ip_summed = CHECKSUM_UNNECESSARY;
1140 } else
1141#endif
1142 {
1143 /*
1144 * Copy the IP header
1145 */
1146
1147 skb_put(skb, sizeof(struct ipv6hdr));
1148 skb_reset_network_header(skb);
1149 skb_copy_to_linear_data(skb, ipv6_hdr(pkt), sizeof(struct ipv6hdr));
1150
1151 /*
1152 * Add our header
1153 */
1154 skb_put(skb, sizeof(*msg));
1155 skb_reset_transport_header(skb);
1156 msg = (struct mrt6msg *)skb_transport_header(skb);
1157
1158 msg->im6_mbz = 0;
1159 msg->im6_msgtype = assert;
1160 msg->im6_mif = mifi;
1161 msg->im6_pad = 0;
1162 msg->im6_src = ipv6_hdr(pkt)->saddr;
1163 msg->im6_dst = ipv6_hdr(pkt)->daddr;
1164
1165 skb->ip_summed = CHECKSUM_UNNECESSARY;
1166 }
1167
1168 skb_dst_drop(skb);
1169 mrt6msg_netlink_event(mrt, skb);
1170
1171 /* Deliver to user space multicast routing algorithms */
1172 reason = sock_queue_rcv_skb_reason(mroute6_sk, skb);
1173
1174 if (reason) {
1175 sk_skb_reason_drop(mroute6_sk, skb, reason);
1176 return -ENOMEM;
1177 }
1178
1179 return 0;
1180}
1181
1182/* Queue a packet for resolution. It gets locked cache entry! */
1183static int ip6mr_cache_unresolved(struct mr_table *mrt, mifi_t mifi,
1184 struct sk_buff *skb, struct net_device *dev)
1185{
1186 struct net *net = read_pnet(&mrt->net);
1187 struct mfc6_cache *c = NULL;
1188 bool found = false;
1189 int err;
1190
1191 spin_lock_bh(&mfc_unres_lock);
1192
1193 if (!check_net(net)) {
1194 err = -EINVAL;
1195 goto err;
1196 }
1197
1198 list_for_each_entry(c, &mrt->mfc_unres_queue, _c.list) {
1199 if (ipv6_addr_equal(&c->mf6c_mcastgrp, &ipv6_hdr(skb)->daddr) &&
1200 ipv6_addr_equal(&c->mf6c_origin, &ipv6_hdr(skb)->saddr)) {
1201 found = true;
1202 break;
1203 }
1204 }
1205
1206 if (!found) {
1207 /*
1208 * Create a new entry if allowable
1209 */
1210
1211 c = ip6mr_cache_alloc_unres();
1212 if (!c) {
1213 err = -ENOBUFS;
1214 goto err;
1215 }
1216
1217 /* Fill in the new cache entry */
1218 c->_c.mfc_parent = -1;
1219 c->mf6c_origin = ipv6_hdr(skb)->saddr;
1220 c->mf6c_mcastgrp = ipv6_hdr(skb)->daddr;
1221
1222 /*
1223 * Reflect first query at pim6sd
1224 */
1225 err = ip6mr_cache_report(mrt, skb, mifi, MRT6MSG_NOCACHE);
1226 if (err < 0)
1227 goto err;
1228
1229 WRITE_ONCE(mrt->cache_resolve_queue_len,
1230 mrt->cache_resolve_queue_len + 1);
1231 list_add(&c->_c.list, &mrt->mfc_unres_queue);
1232 mr6_netlink_event(mrt, c, RTM_NEWROUTE);
1233
1234 ipmr_do_expire_process(mrt);
1235 }
1236
1237 /* See if we can append the packet */
1238 if (c->_c.mfc_un.unres.unresolved.qlen > 3) {
1239 c = NULL;
1240 err = -ENOBUFS;
1241 goto err;
1242 }
1243
1244 if (dev) {
1245 skb->dev = dev;
1246 skb->skb_iif = dev->ifindex;
1247 }
1248
1249 skb_dst_drop(skb);
1250 skb_queue_tail(&c->_c.mfc_un.unres.unresolved, skb);
1251
1252 spin_unlock_bh(&mfc_unres_lock);
1253 return 0;
1254
1255err:
1256 spin_unlock_bh(&mfc_unres_lock);
1257 if (c)
1258 ip6mr_cache_free(c);
1259 kfree_skb(skb);
1260 return err;
1261}
1262
1263/*
1264 * MFC6 cache manipulation by user space
1265 */
1266
1267static int ip6mr_mfc_delete(struct mr_table *mrt, struct mf6cctl *mfc,
1268 int parent)
1269{
1270 struct mfc6_cache *c;
1271
1272 rcu_read_lock();
1273 c = ip6mr_cache_find_parent(mrt, &mfc->mf6cc_origin.sin6_addr,
1274 &mfc->mf6cc_mcastgrp.sin6_addr, parent);
1275 rcu_read_unlock();
1276 if (!c)
1277 return -ENOENT;
1278 rhltable_remove(&mrt->mfc_hash, &c->_c.mnode, ip6mr_rht_params);
1279 list_del_rcu(&c->_c.list);
1280
1281 call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
1282 FIB_EVENT_ENTRY_DEL, c, mrt->id);
1283 mr6_netlink_event(mrt, c, RTM_DELROUTE);
1284 mr_cache_put(&c->_c);
1285 return 0;
1286}
1287
1288static int ip6mr_device_event(struct notifier_block *this,
1289 unsigned long event, void *ptr)
1290{
1291 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1292 struct net *net = dev_net(dev);
1293 struct mr_table *mrt;
1294 struct vif_device *v;
1295 int ct;
1296
1297 if (event != NETDEV_UNREGISTER)
1298 return NOTIFY_DONE;
1299
1300 ip6mr_for_each_table(mrt, net) {
1301 v = &mrt->vif_table[0];
1302 for (ct = 0; ct < mrt->maxvif; ct++, v++) {
1303 if (rcu_access_pointer(v->dev) == dev)
1304 mif6_delete(mrt, ct, 1, NULL);
1305 }
1306 }
1307
1308 return NOTIFY_DONE;
1309}
1310
1311static unsigned int ip6mr_seq_read(const struct net *net)
1312{
1313 return atomic_read(&net->ipv6.ipmr_seq) + ip6mr_rules_seq_read(net);
1314}
1315
1316static int ip6mr_dump(struct net *net, struct notifier_block *nb,
1317 struct netlink_ext_ack *extack)
1318{
1319 return mr_dump(net, nb, RTNL_FAMILY_IP6MR, ip6mr_rules_dump,
1320 ip6mr_mr_table_iter, extack);
1321}
1322
1323static struct notifier_block ip6_mr_notifier = {
1324 .notifier_call = ip6mr_device_event
1325};
1326
1327static const struct fib_notifier_ops ip6mr_notifier_ops_template = {
1328 .family = RTNL_FAMILY_IP6MR,
1329 .fib_seq_read = ip6mr_seq_read,
1330 .fib_dump = ip6mr_dump,
1331 .owner = THIS_MODULE,
1332};
1333
1334static int __net_init ip6mr_notifier_init(struct net *net)
1335{
1336 struct fib_notifier_ops *ops;
1337
1338 atomic_set(&net->ipv6.ipmr_seq, 0);
1339
1340 ops = fib_notifier_ops_register(&ip6mr_notifier_ops_template, net);
1341 if (IS_ERR(ops))
1342 return PTR_ERR(ops);
1343
1344 net->ipv6.ip6mr_notifier_ops = ops;
1345
1346 return 0;
1347}
1348
1349static void __net_exit ip6mr_notifier_exit(struct net *net)
1350{
1351 fib_notifier_ops_unregister(net->ipv6.ip6mr_notifier_ops);
1352 net->ipv6.ip6mr_notifier_ops = NULL;
1353}
1354
1355/* Setup for IP multicast routing */
1356static int __net_init ip6mr_net_init(struct net *net)
1357{
1358#ifdef CONFIG_PROC_FS
1359 LIST_HEAD(dev_kill_list);
1360#endif
1361 int err;
1362
1363 mutex_init(&net->ipv6.mfc_mutex);
1364
1365 err = ip6mr_notifier_init(net);
1366 if (err)
1367 return err;
1368
1369 err = ip6mr_rules_init(net);
1370 if (err < 0)
1371 goto ip6mr_rules_fail;
1372
1373#ifdef CONFIG_PROC_FS
1374 err = -ENOMEM;
1375 if (!proc_create_net("ip6_mr_vif", 0, net->proc_net, &ip6mr_vif_seq_ops,
1376 sizeof(struct mr_vif_iter)))
1377 goto proc_vif_fail;
1378 if (!proc_create_net("ip6_mr_cache", 0, net->proc_net, &ipmr_mfc_seq_ops,
1379 sizeof(struct mr_mfc_iter)))
1380 goto proc_cache_fail;
1381#endif
1382
1383 return 0;
1384
1385#ifdef CONFIG_PROC_FS
1386proc_cache_fail:
1387 remove_proc_entry("ip6_mr_vif", net->proc_net);
1388proc_vif_fail:
1389 ip6mr_rules_exit_rtnl(net, &dev_kill_list);
1390 ip6mr_rules_exit(net);
1391#endif
1392ip6mr_rules_fail:
1393 ip6mr_notifier_exit(net);
1394 return err;
1395}
1396
1397static void __net_exit ip6mr_net_exit(struct net *net)
1398{
1399#ifdef CONFIG_PROC_FS
1400 remove_proc_entry("ip6_mr_cache", net->proc_net);
1401 remove_proc_entry("ip6_mr_vif", net->proc_net);
1402#endif
1403 ip6mr_rules_exit(net);
1404 ip6mr_notifier_exit(net);
1405}
1406
1407static void __net_exit ip6mr_net_exit_rtnl(struct net *net,
1408 struct list_head *dev_kill_list)
1409{
1410 ip6mr_rules_exit_rtnl(net, dev_kill_list);
1411}
1412
1413static struct pernet_operations ip6mr_net_ops = {
1414 .init = ip6mr_net_init,
1415 .exit = ip6mr_net_exit,
1416 .exit_rtnl = ip6mr_net_exit_rtnl,
1417};
1418
1419static const struct rtnl_msg_handler ip6mr_rtnl_msg_handlers[] __initconst_or_module = {
1420 {.owner = THIS_MODULE, .protocol = RTNL_FAMILY_IP6MR,
1421 .msgtype = RTM_GETROUTE,
1422 .doit = ip6mr_rtm_getroute, .dumpit = ip6mr_rtm_dumproute,
1423 .flags = RTNL_FLAG_DOIT_UNLOCKED | RTNL_FLAG_DUMP_UNLOCKED},
1424};
1425
1426int __init ip6_mr_init(void)
1427{
1428 int err;
1429
1430 mrt_cachep = KMEM_CACHE(mfc6_cache, SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT);
1431 if (!mrt_cachep)
1432 return -ENOMEM;
1433
1434 err = register_pernet_subsys(&ip6mr_net_ops);
1435 if (err)
1436 goto reg_pernet_fail;
1437
1438 err = register_netdevice_notifier(&ip6_mr_notifier);
1439 if (err)
1440 goto reg_notif_fail;
1441#ifdef CONFIG_IPV6_PIMSM_V2
1442 if (inet6_add_protocol(&pim6_protocol, IPPROTO_PIM) < 0) {
1443 pr_err("%s: can't add PIM protocol\n", __func__);
1444 err = -EAGAIN;
1445 goto add_proto_fail;
1446 }
1447#endif
1448 err = rtnl_register_many(ip6mr_rtnl_msg_handlers);
1449 if (!err)
1450 return 0;
1451
1452#ifdef CONFIG_IPV6_PIMSM_V2
1453 inet6_del_protocol(&pim6_protocol, IPPROTO_PIM);
1454add_proto_fail:
1455 unregister_netdevice_notifier(&ip6_mr_notifier);
1456#endif
1457reg_notif_fail:
1458 unregister_pernet_subsys(&ip6mr_net_ops);
1459reg_pernet_fail:
1460 kmem_cache_destroy(mrt_cachep);
1461 return err;
1462}
1463
1464void __init ip6_mr_cleanup(void)
1465{
1466 rtnl_unregister_many(ip6mr_rtnl_msg_handlers);
1467#ifdef CONFIG_IPV6_PIMSM_V2
1468 inet6_del_protocol(&pim6_protocol, IPPROTO_PIM);
1469#endif
1470 unregister_netdevice_notifier(&ip6_mr_notifier);
1471 unregister_pernet_subsys(&ip6mr_net_ops);
1472 kmem_cache_destroy(mrt_cachep);
1473}
1474
1475static int ip6mr_mfc_add(struct net *net, struct mr_table *mrt,
1476 struct mf6cctl *mfc, int mrtsock, int parent)
1477{
1478 unsigned char ttls[MAXMIFS];
1479 struct mfc6_cache *uc, *c;
1480 struct mr_mfc *_uc;
1481 bool found;
1482 int i, err;
1483
1484 if (mfc->mf6cc_parent >= MAXMIFS)
1485 return -ENFILE;
1486
1487 memset(ttls, 255, MAXMIFS);
1488 for (i = 0; i < MAXMIFS; i++) {
1489 if (IF_ISSET(i, &mfc->mf6cc_ifset))
1490 ttls[i] = 1;
1491 }
1492
1493 rcu_read_lock();
1494 c = ip6mr_cache_find_parent(mrt, &mfc->mf6cc_origin.sin6_addr,
1495 &mfc->mf6cc_mcastgrp.sin6_addr, parent);
1496 rcu_read_unlock();
1497 if (c) {
1498 spin_lock(&mrt_lock);
1499 c->_c.mfc_parent = mfc->mf6cc_parent;
1500 ip6mr_update_thresholds(mrt, &c->_c, ttls);
1501 if (!mrtsock)
1502 c->_c.mfc_flags |= MFC_STATIC;
1503 spin_unlock(&mrt_lock);
1504 call_ip6mr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_REPLACE,
1505 c, mrt->id);
1506 mr6_netlink_event(mrt, c, RTM_NEWROUTE);
1507 return 0;
1508 }
1509
1510 if (!ipv6_addr_any(&mfc->mf6cc_mcastgrp.sin6_addr) &&
1511 !ipv6_addr_is_multicast(&mfc->mf6cc_mcastgrp.sin6_addr))
1512 return -EINVAL;
1513
1514 c = ip6mr_cache_alloc();
1515 if (!c)
1516 return -ENOMEM;
1517
1518 c->mf6c_origin = mfc->mf6cc_origin.sin6_addr;
1519 c->mf6c_mcastgrp = mfc->mf6cc_mcastgrp.sin6_addr;
1520 c->_c.mfc_parent = mfc->mf6cc_parent;
1521 ip6mr_update_thresholds(mrt, &c->_c, ttls);
1522 if (!mrtsock)
1523 c->_c.mfc_flags |= MFC_STATIC;
1524
1525 err = rhltable_insert_key(&mrt->mfc_hash, &c->cmparg, &c->_c.mnode,
1526 ip6mr_rht_params);
1527 if (err) {
1528 pr_err("ip6mr: rhtable insert error %d\n", err);
1529 ip6mr_cache_free(c);
1530 return err;
1531 }
1532 list_add_tail_rcu(&c->_c.list, &mrt->mfc_cache_list);
1533
1534 /* Check to see if we resolved a queued list. If so we
1535 * need to send on the frames and tidy up.
1536 */
1537 found = false;
1538 spin_lock_bh(&mfc_unres_lock);
1539 list_for_each_entry(_uc, &mrt->mfc_unres_queue, list) {
1540 uc = (struct mfc6_cache *)_uc;
1541 if (ipv6_addr_equal(&uc->mf6c_origin, &c->mf6c_origin) &&
1542 ipv6_addr_equal(&uc->mf6c_mcastgrp, &c->mf6c_mcastgrp)) {
1543 list_del(&_uc->list);
1544 WRITE_ONCE(mrt->cache_resolve_queue_len,
1545 mrt->cache_resolve_queue_len - 1);
1546 found = true;
1547 break;
1548 }
1549 }
1550 if (list_empty(&mrt->mfc_unres_queue))
1551 timer_delete(&mrt->ipmr_expire_timer);
1552 spin_unlock_bh(&mfc_unres_lock);
1553
1554 if (found) {
1555 ip6mr_cache_resolve(net, mrt, uc, c);
1556 ip6mr_cache_free(uc);
1557 }
1558 call_ip6mr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_ADD,
1559 c, mrt->id);
1560 mr6_netlink_event(mrt, c, RTM_NEWROUTE);
1561 return 0;
1562}
1563
1564/*
1565 * Close the multicast socket, and clear the vif tables etc
1566 */
1567
1568static void mroute_clean_tables(struct mr_table *mrt, int flags,
1569 struct list_head *dev_kill_list)
1570{
1571 struct net *net = read_pnet(&mrt->net);
1572 struct mr_mfc *c, *tmp;
1573 int i;
1574
1575 /* Shut down all active vif entries */
1576 if (flags & (MRT6_FLUSH_MIFS | MRT6_FLUSH_MIFS_STATIC)) {
1577 for (i = 0; i < mrt->maxvif; i++) {
1578 if (((mrt->vif_table[i].flags & VIFF_STATIC) &&
1579 !(flags & MRT6_FLUSH_MIFS_STATIC)) ||
1580 (!(mrt->vif_table[i].flags & VIFF_STATIC) && !(flags & MRT6_FLUSH_MIFS)))
1581 continue;
1582 mif6_delete(mrt, i, 0, dev_kill_list);
1583 }
1584 }
1585
1586 /* Wipe the cache */
1587 if (flags & (MRT6_FLUSH_MFC | MRT6_FLUSH_MFC_STATIC)) {
1588 mutex_lock(&net->ipv6.mfc_mutex);
1589
1590 list_for_each_entry_safe(c, tmp, &mrt->mfc_cache_list, list) {
1591 if (((c->mfc_flags & MFC_STATIC) && !(flags & MRT6_FLUSH_MFC_STATIC)) ||
1592 (!(c->mfc_flags & MFC_STATIC) && !(flags & MRT6_FLUSH_MFC)))
1593 continue;
1594 rhltable_remove(&mrt->mfc_hash, &c->mnode, ip6mr_rht_params);
1595 list_del_rcu(&c->list);
1596 call_ip6mr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_DEL,
1597 (struct mfc6_cache *)c, mrt->id);
1598 mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE);
1599 mr_cache_put(c);
1600 }
1601
1602 mutex_unlock(&net->ipv6.mfc_mutex);
1603 }
1604
1605 if (flags & MRT6_FLUSH_MFC) {
1606 if (READ_ONCE(mrt->cache_resolve_queue_len) || !check_net(net)) {
1607 spin_lock_bh(&mfc_unres_lock);
1608 list_for_each_entry_safe(c, tmp, &mrt->mfc_unres_queue, list) {
1609 list_del(&c->list);
1610 mr6_netlink_event(mrt, (struct mfc6_cache *)c,
1611 RTM_DELROUTE);
1612 ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c);
1613 }
1614 spin_unlock_bh(&mfc_unres_lock);
1615 }
1616 }
1617}
1618
1619static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk)
1620{
1621 int err = 0;
1622 struct net *net = sock_net(sk);
1623
1624 rtnl_lock();
1625 spin_lock(&mrt_lock);
1626 if (rtnl_dereference(mrt->mroute_sk)) {
1627 err = -EADDRINUSE;
1628 } else {
1629 rcu_assign_pointer(mrt->mroute_sk, sk);
1630 sock_set_flag(sk, SOCK_RCU_FREE);
1631 atomic_inc(&net->ipv6.devconf_all->mc_forwarding);
1632 }
1633 spin_unlock(&mrt_lock);
1634
1635 if (!err)
1636 inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
1637 NETCONFA_MC_FORWARDING,
1638 NETCONFA_IFINDEX_ALL,
1639 net->ipv6.devconf_all);
1640 rtnl_unlock();
1641
1642 return err;
1643}
1644
1645int ip6mr_sk_done(struct sock *sk)
1646{
1647 struct net *net = sock_net(sk);
1648 struct ipv6_devconf *devconf;
1649 LIST_HEAD(dev_kill_list);
1650 struct mr_table *mrt;
1651 int err = -EACCES;
1652
1653 if (sk->sk_type != SOCK_RAW ||
1654 inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
1655 return err;
1656
1657 devconf = net->ipv6.devconf_all;
1658 if (!devconf || !atomic_read(&devconf->mc_forwarding))
1659 return err;
1660
1661 rtnl_lock();
1662 ip6mr_for_each_table(mrt, net) {
1663 if (sk == rtnl_dereference(mrt->mroute_sk)) {
1664 spin_lock(&mrt_lock);
1665 RCU_INIT_POINTER(mrt->mroute_sk, NULL);
1666 /* Note that mroute_sk had SOCK_RCU_FREE set,
1667 * so the RCU grace period before sk freeing
1668 * is guaranteed by sk_destruct()
1669 */
1670 atomic_dec(&devconf->mc_forwarding);
1671 spin_unlock(&mrt_lock);
1672 inet6_netconf_notify_devconf(net, RTM_NEWNETCONF,
1673 NETCONFA_MC_FORWARDING,
1674 NETCONFA_IFINDEX_ALL,
1675 net->ipv6.devconf_all);
1676
1677 mroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MFC,
1678 &dev_kill_list);
1679 err = 0;
1680 break;
1681 }
1682 }
1683 unregister_netdevice_many(&dev_kill_list);
1684 rtnl_unlock();
1685
1686 return err;
1687}
1688
1689bool mroute6_is_socket(struct net *net, struct sk_buff *skb)
1690{
1691 struct mr_table *mrt;
1692 struct flowi6 fl6 = {
1693 .flowi6_iif = skb->skb_iif ? : LOOPBACK_IFINDEX,
1694 .flowi6_oif = skb->dev->ifindex,
1695 .flowi6_mark = skb->mark,
1696 };
1697
1698 if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0)
1699 return NULL;
1700
1701 return rcu_access_pointer(mrt->mroute_sk);
1702}
1703EXPORT_SYMBOL(mroute6_is_socket);
1704
1705/*
1706 * Socket options and virtual interface manipulation. The whole
1707 * virtual interface system is a complete heap, but unfortunately
1708 * that's how BSD mrouted happens to think. Maybe one day with a proper
1709 * MOSPF/PIM router set up we can clean this up.
1710 */
1711
1712int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
1713 unsigned int optlen)
1714{
1715 int ret, parent = 0;
1716 struct mif6ctl vif;
1717 struct mf6cctl mfc;
1718 mifi_t mifi;
1719 struct net *net = sock_net(sk);
1720 struct mr_table *mrt;
1721
1722 if (sk->sk_type != SOCK_RAW ||
1723 inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
1724 return -EOPNOTSUPP;
1725
1726 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
1727 if (!mrt)
1728 return -ENOENT;
1729
1730 if (optname != MRT6_INIT) {
1731 if (sk != rcu_access_pointer(mrt->mroute_sk) &&
1732 !ns_capable(net->user_ns, CAP_NET_ADMIN))
1733 return -EACCES;
1734 }
1735
1736 switch (optname) {
1737 case MRT6_INIT:
1738 if (optlen < sizeof(int))
1739 return -EINVAL;
1740
1741 return ip6mr_sk_init(mrt, sk);
1742
1743 case MRT6_DONE:
1744 return ip6mr_sk_done(sk);
1745
1746 case MRT6_ADD_MIF:
1747 if (optlen < sizeof(vif))
1748 return -EINVAL;
1749 if (copy_from_sockptr(&vif, optval, sizeof(vif)))
1750 return -EFAULT;
1751 if (vif.mif6c_mifi >= MAXMIFS)
1752 return -ENFILE;
1753 rtnl_lock();
1754 ret = mif6_add(net, mrt, &vif,
1755 sk == rtnl_dereference(mrt->mroute_sk));
1756 rtnl_unlock();
1757 return ret;
1758
1759 case MRT6_DEL_MIF:
1760 if (optlen < sizeof(mifi_t))
1761 return -EINVAL;
1762 if (copy_from_sockptr(&mifi, optval, sizeof(mifi_t)))
1763 return -EFAULT;
1764 rtnl_lock();
1765 ret = mif6_delete(mrt, mifi, 0, NULL);
1766 rtnl_unlock();
1767 return ret;
1768
1769 /*
1770 * Manipulate the forwarding caches. These live
1771 * in a sort of kernel/user symbiosis.
1772 */
1773 case MRT6_ADD_MFC:
1774 case MRT6_DEL_MFC:
1775 parent = -1;
1776 fallthrough;
1777 case MRT6_ADD_MFC_PROXY:
1778 case MRT6_DEL_MFC_PROXY:
1779 if (optlen < sizeof(mfc))
1780 return -EINVAL;
1781 if (copy_from_sockptr(&mfc, optval, sizeof(mfc)))
1782 return -EFAULT;
1783 if (parent == 0)
1784 parent = mfc.mf6cc_parent;
1785
1786 mutex_lock(&net->ipv6.mfc_mutex);
1787
1788 if (optname == MRT6_DEL_MFC || optname == MRT6_DEL_MFC_PROXY)
1789 ret = ip6mr_mfc_delete(mrt, &mfc, parent);
1790 else
1791 ret = ip6mr_mfc_add(net, mrt, &mfc,
1792 sk ==
1793 rcu_access_pointer(mrt->mroute_sk),
1794 parent);
1795
1796 mutex_unlock(&net->ipv6.mfc_mutex);
1797 return ret;
1798
1799 case MRT6_FLUSH:
1800 {
1801 LIST_HEAD(dev_kill_list);
1802 int flags;
1803
1804 if (optlen != sizeof(flags))
1805 return -EINVAL;
1806 if (copy_from_sockptr(&flags, optval, sizeof(flags)))
1807 return -EFAULT;
1808
1809 rtnl_lock();
1810 mroute_clean_tables(mrt, flags, &dev_kill_list);
1811 unregister_netdevice_many(&dev_kill_list);
1812 rtnl_unlock();
1813 return 0;
1814 }
1815
1816 /*
1817 * Control PIM assert (to activate pim will activate assert)
1818 */
1819 case MRT6_ASSERT:
1820 {
1821 int v;
1822
1823 if (optlen != sizeof(v))
1824 return -EINVAL;
1825 if (copy_from_sockptr(&v, optval, sizeof(v)))
1826 return -EFAULT;
1827 WRITE_ONCE(mrt->mroute_do_assert, v);
1828 return 0;
1829 }
1830
1831#ifdef CONFIG_IPV6_PIMSM_V2
1832 case MRT6_PIM:
1833 {
1834 bool do_wrmifwhole;
1835 int v;
1836
1837 if (optlen != sizeof(v))
1838 return -EINVAL;
1839 if (copy_from_sockptr(&v, optval, sizeof(v)))
1840 return -EFAULT;
1841
1842 do_wrmifwhole = (v == MRT6MSG_WRMIFWHOLE);
1843 v = !!v;
1844 rtnl_lock();
1845 ret = 0;
1846 if (v != mrt->mroute_do_pim) {
1847 WRITE_ONCE(mrt->mroute_do_pim, v);
1848 WRITE_ONCE(mrt->mroute_do_assert, v);
1849 WRITE_ONCE(mrt->mroute_do_wrvifwhole, do_wrmifwhole);
1850 }
1851 rtnl_unlock();
1852 return ret;
1853 }
1854
1855#endif
1856#ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
1857 case MRT6_TABLE:
1858 {
1859 u32 v;
1860
1861 if (optlen != sizeof(u32))
1862 return -EINVAL;
1863 if (copy_from_sockptr(&v, optval, sizeof(v)))
1864 return -EFAULT;
1865 /* "pim6reg%u" should not exceed 16 bytes (IFNAMSIZ) */
1866 if (v != RT_TABLE_DEFAULT && v >= 100000000)
1867 return -EINVAL;
1868 if (sk == rcu_access_pointer(mrt->mroute_sk))
1869 return -EBUSY;
1870
1871 rtnl_lock();
1872 ret = 0;
1873 mrt = ip6mr_new_table(net, v);
1874 if (IS_ERR(mrt))
1875 ret = PTR_ERR(mrt);
1876 else
1877 raw6_sk(sk)->ip6mr_table = v;
1878 rtnl_unlock();
1879 return ret;
1880 }
1881#endif
1882 /*
1883 * Spurious command, or MRT6_VERSION which you cannot
1884 * set.
1885 */
1886 default:
1887 return -ENOPROTOOPT;
1888 }
1889}
1890
1891/*
1892 * Getsock opt support for the multicast routing system.
1893 */
1894
1895int ip6_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,
1896 sockptr_t optlen)
1897{
1898 int olr;
1899 int val;
1900 struct net *net = sock_net(sk);
1901 struct mr_table *mrt;
1902
1903 if (sk->sk_type != SOCK_RAW ||
1904 inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
1905 return -EOPNOTSUPP;
1906
1907 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
1908 if (!mrt)
1909 return -ENOENT;
1910
1911 switch (optname) {
1912 case MRT6_VERSION:
1913 val = 0x0305;
1914 break;
1915#ifdef CONFIG_IPV6_PIMSM_V2
1916 case MRT6_PIM:
1917 val = READ_ONCE(mrt->mroute_do_pim);
1918 break;
1919#endif
1920 case MRT6_ASSERT:
1921 val = READ_ONCE(mrt->mroute_do_assert);
1922 break;
1923 default:
1924 return -ENOPROTOOPT;
1925 }
1926
1927 if (copy_from_sockptr(&olr, optlen, sizeof(int)))
1928 return -EFAULT;
1929
1930 olr = min_t(int, olr, sizeof(int));
1931 if (olr < 0)
1932 return -EINVAL;
1933
1934 if (copy_to_sockptr(optlen, &olr, sizeof(int)))
1935 return -EFAULT;
1936 if (copy_to_sockptr(optval, &val, olr))
1937 return -EFAULT;
1938 return 0;
1939}
1940
1941/*
1942 * The IP multicast ioctl support routines.
1943 */
1944int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)
1945{
1946 struct sioc_sg_req6 *sr;
1947 struct sioc_mif_req6 *vr;
1948 struct vif_device *vif;
1949 struct mfc6_cache *c;
1950 struct net *net = sock_net(sk);
1951 struct mr_table *mrt;
1952
1953 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
1954 if (!mrt)
1955 return -ENOENT;
1956
1957 switch (cmd) {
1958 case SIOCGETMIFCNT_IN6:
1959 vr = (struct sioc_mif_req6 *)arg;
1960 if (vr->mifi >= mrt->maxvif)
1961 return -EINVAL;
1962 vr->mifi = array_index_nospec(vr->mifi, mrt->maxvif);
1963 rcu_read_lock();
1964 vif = &mrt->vif_table[vr->mifi];
1965 if (VIF_EXISTS(mrt, vr->mifi)) {
1966 vr->icount = READ_ONCE(vif->pkt_in);
1967 vr->ocount = READ_ONCE(vif->pkt_out);
1968 vr->ibytes = READ_ONCE(vif->bytes_in);
1969 vr->obytes = READ_ONCE(vif->bytes_out);
1970 rcu_read_unlock();
1971 return 0;
1972 }
1973 rcu_read_unlock();
1974 return -EADDRNOTAVAIL;
1975 case SIOCGETSGCNT_IN6:
1976 sr = (struct sioc_sg_req6 *)arg;
1977
1978 rcu_read_lock();
1979 c = ip6mr_cache_find(mrt, &sr->src.sin6_addr,
1980 &sr->grp.sin6_addr);
1981 if (c) {
1982 sr->pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt);
1983 sr->bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes);
1984 sr->wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if);
1985 rcu_read_unlock();
1986 return 0;
1987 }
1988 rcu_read_unlock();
1989 return -EADDRNOTAVAIL;
1990 default:
1991 return -ENOIOCTLCMD;
1992 }
1993}
1994
1995#ifdef CONFIG_COMPAT
1996struct compat_sioc_sg_req6 {
1997 struct sockaddr_in6 src;
1998 struct sockaddr_in6 grp;
1999 compat_ulong_t pktcnt;
2000 compat_ulong_t bytecnt;
2001 compat_ulong_t wrong_if;
2002};
2003
2004struct compat_sioc_mif_req6 {
2005 mifi_t mifi;
2006 compat_ulong_t icount;
2007 compat_ulong_t ocount;
2008 compat_ulong_t ibytes;
2009 compat_ulong_t obytes;
2010};
2011
2012int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
2013{
2014 struct compat_sioc_sg_req6 sr;
2015 struct compat_sioc_mif_req6 vr;
2016 struct vif_device *vif;
2017 struct mfc6_cache *c;
2018 struct net *net = sock_net(sk);
2019 struct mr_table *mrt;
2020
2021 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
2022 if (!mrt)
2023 return -ENOENT;
2024
2025 switch (cmd) {
2026 case SIOCGETMIFCNT_IN6:
2027 if (copy_from_user(&vr, arg, sizeof(vr)))
2028 return -EFAULT;
2029 if (vr.mifi >= mrt->maxvif)
2030 return -EINVAL;
2031 vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif);
2032 rcu_read_lock();
2033 vif = &mrt->vif_table[vr.mifi];
2034 if (VIF_EXISTS(mrt, vr.mifi)) {
2035 vr.icount = READ_ONCE(vif->pkt_in);
2036 vr.ocount = READ_ONCE(vif->pkt_out);
2037 vr.ibytes = READ_ONCE(vif->bytes_in);
2038 vr.obytes = READ_ONCE(vif->bytes_out);
2039 rcu_read_unlock();
2040
2041 if (copy_to_user(arg, &vr, sizeof(vr)))
2042 return -EFAULT;
2043 return 0;
2044 }
2045 rcu_read_unlock();
2046 return -EADDRNOTAVAIL;
2047 case SIOCGETSGCNT_IN6:
2048 if (copy_from_user(&sr, arg, sizeof(sr)))
2049 return -EFAULT;
2050
2051 rcu_read_lock();
2052 c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr);
2053 if (c) {
2054 sr.pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt);
2055 sr.bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes);
2056 sr.wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if);
2057 rcu_read_unlock();
2058
2059 if (copy_to_user(arg, &sr, sizeof(sr)))
2060 return -EFAULT;
2061 return 0;
2062 }
2063 rcu_read_unlock();
2064 return -EADDRNOTAVAIL;
2065 default:
2066 return -ENOIOCTLCMD;
2067 }
2068}
2069#endif
2070
2071static inline int ip6mr_forward2_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
2072{
2073 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
2074 IPSTATS_MIB_OUTFORWDATAGRAMS);
2075 return dst_output(net, sk, skb);
2076}
2077
2078/*
2079 * Processing handlers for ip6mr_forward
2080 */
2081
2082static int ip6mr_prepare_xmit(struct net *net, struct mr_table *mrt,
2083 struct sk_buff *skb, int vifi)
2084{
2085 struct vif_device *vif = &mrt->vif_table[vifi];
2086 struct net_device *vif_dev;
2087 struct ipv6hdr *ipv6h;
2088 struct dst_entry *dst;
2089 struct flowi6 fl6;
2090
2091 vif_dev = vif_dev_read(vif);
2092 if (!vif_dev)
2093 return -1;
2094
2095#ifdef CONFIG_IPV6_PIMSM_V2
2096 if (vif->flags & MIFF_REGISTER) {
2097 WRITE_ONCE(vif->pkt_out, vif->pkt_out + 1);
2098 WRITE_ONCE(vif->bytes_out, vif->bytes_out + skb->len);
2099 DEV_STATS_ADD(vif_dev, tx_bytes, skb->len);
2100 DEV_STATS_INC(vif_dev, tx_packets);
2101 ip6mr_cache_report(mrt, skb, vifi, MRT6MSG_WHOLEPKT);
2102 return -1;
2103 }
2104#endif
2105
2106 ipv6h = ipv6_hdr(skb);
2107
2108 fl6 = (struct flowi6) {
2109 .flowi6_oif = vif->link,
2110 .daddr = ipv6h->daddr,
2111 };
2112
2113 dst = ip6_route_output(net, NULL, &fl6);
2114 if (dst->error) {
2115 dst_release(dst);
2116 return -1;
2117 }
2118
2119 skb_dst_drop(skb);
2120 skb_dst_set(skb, dst);
2121
2122 /*
2123 * RFC1584 teaches, that DVMRP/PIM router must deliver packets locally
2124 * not only before forwarding, but after forwarding on all output
2125 * interfaces. It is clear, if mrouter runs a multicasting
2126 * program, it should receive packets not depending to what interface
2127 * program is joined.
2128 * If we will not make it, the program will have to join on all
2129 * interfaces. On the other hand, multihoming host (or router, but
2130 * not mrouter) cannot join to more than one interface - it will
2131 * result in receiving multiple packets.
2132 */
2133 skb->dev = vif_dev;
2134 WRITE_ONCE(vif->pkt_out, vif->pkt_out + 1);
2135 WRITE_ONCE(vif->bytes_out, vif->bytes_out + skb->len);
2136
2137 /* We are about to write */
2138 /* XXX: extension headers? */
2139 if (skb_cow(skb, sizeof(*ipv6h) + LL_RESERVED_SPACE(vif_dev)))
2140 return -1;
2141
2142 ipv6h = ipv6_hdr(skb);
2143 ipv6h->hop_limit--;
2144 return 0;
2145}
2146
2147static void ip6mr_forward2(struct net *net, struct mr_table *mrt,
2148 struct sk_buff *skb, int vifi)
2149{
2150 struct net_device *indev = skb->dev;
2151
2152 if (ip6mr_prepare_xmit(net, mrt, skb, vifi))
2153 goto out_free;
2154
2155 IP6CB(skb)->flags |= IP6SKB_FORWARDED;
2156
2157 NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
2158 net, NULL, skb, indev, skb->dev,
2159 ip6mr_forward2_finish);
2160 return;
2161
2162out_free:
2163 kfree_skb(skb);
2164}
2165
2166static void ip6mr_output2(struct net *net, struct mr_table *mrt,
2167 struct sk_buff *skb, int vifi)
2168{
2169 if (ip6mr_prepare_xmit(net, mrt, skb, vifi))
2170 goto out_free;
2171
2172 ip6_output(net, NULL, skb);
2173 return;
2174
2175out_free:
2176 kfree_skb(skb);
2177}
2178
2179/* Called with rcu_read_lock() */
2180static int ip6mr_find_vif(struct mr_table *mrt, struct net_device *dev)
2181{
2182 int ct;
2183
2184 /* Pairs with WRITE_ONCE() in mif6_delete()/mif6_add() */
2185 for (ct = READ_ONCE(mrt->maxvif) - 1; ct >= 0; ct--) {
2186 if (rcu_access_pointer(mrt->vif_table[ct].dev) == dev)
2187 break;
2188 }
2189 return ct;
2190}
2191
2192/* Called under rcu_read_lock() */
2193static void ip6_mr_forward(struct net *net, struct mr_table *mrt,
2194 struct net_device *dev, struct sk_buff *skb,
2195 struct mfc6_cache *c)
2196{
2197 int psend = -1;
2198 int vif, ct;
2199 int true_vifi = ip6mr_find_vif(mrt, dev);
2200
2201 vif = c->_c.mfc_parent;
2202 atomic_long_inc(&c->_c.mfc_un.res.pkt);
2203 atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes);
2204 WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies);
2205
2206 if (ipv6_addr_any(&c->mf6c_origin) && true_vifi >= 0) {
2207 struct mfc6_cache *cache_proxy;
2208
2209 /* For an (*,G) entry, we only check that the incoming
2210 * interface is part of the static tree.
2211 */
2212 cache_proxy = mr_mfc_find_any_parent(mrt, vif);
2213 if (cache_proxy &&
2214 cache_proxy->_c.mfc_un.res.ttls[true_vifi] < 255)
2215 goto forward;
2216 }
2217
2218 /*
2219 * Wrong interface: drop packet and (maybe) send PIM assert.
2220 */
2221 if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev) {
2222 atomic_long_inc(&c->_c.mfc_un.res.wrong_if);
2223
2224 if (true_vifi >= 0 && READ_ONCE(mrt->mroute_do_assert) &&
2225 /* pimsm uses asserts, when switching from RPT to SPT,
2226 so that we cannot check that packet arrived on an oif.
2227 It is bad, but otherwise we would need to move pretty
2228 large chunk of pimd to kernel. Ough... --ANK
2229 */
2230 (READ_ONCE(mrt->mroute_do_pim) ||
2231 c->_c.mfc_un.res.ttls[true_vifi] < 255) &&
2232 time_after(jiffies,
2233 c->_c.mfc_un.res.last_assert +
2234 MFC_ASSERT_THRESH)) {
2235 c->_c.mfc_un.res.last_assert = jiffies;
2236 ip6mr_cache_report(mrt, skb, true_vifi, MRT6MSG_WRONGMIF);
2237 if (READ_ONCE(mrt->mroute_do_wrvifwhole))
2238 ip6mr_cache_report(mrt, skb, true_vifi,
2239 MRT6MSG_WRMIFWHOLE);
2240 }
2241 goto dont_forward;
2242 }
2243
2244forward:
2245 WRITE_ONCE(mrt->vif_table[vif].pkt_in,
2246 mrt->vif_table[vif].pkt_in + 1);
2247 WRITE_ONCE(mrt->vif_table[vif].bytes_in,
2248 mrt->vif_table[vif].bytes_in + skb->len);
2249
2250 /*
2251 * Forward the frame
2252 */
2253 if (ipv6_addr_any(&c->mf6c_origin) &&
2254 ipv6_addr_any(&c->mf6c_mcastgrp)) {
2255 if (true_vifi >= 0 &&
2256 true_vifi != c->_c.mfc_parent &&
2257 ipv6_hdr(skb)->hop_limit >
2258 c->_c.mfc_un.res.ttls[c->_c.mfc_parent]) {
2259 /* It's an (*,*) entry and the packet is not coming from
2260 * the upstream: forward the packet to the upstream
2261 * only.
2262 */
2263 psend = c->_c.mfc_parent;
2264 goto last_forward;
2265 }
2266 goto dont_forward;
2267 }
2268 for (ct = c->_c.mfc_un.res.maxvif - 1;
2269 ct >= c->_c.mfc_un.res.minvif; ct--) {
2270 /* For (*,G) entry, don't forward to the incoming interface */
2271 if ((!ipv6_addr_any(&c->mf6c_origin) || ct != true_vifi) &&
2272 ipv6_hdr(skb)->hop_limit > c->_c.mfc_un.res.ttls[ct]) {
2273 if (psend != -1) {
2274 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
2275 if (skb2)
2276 ip6mr_forward2(net, mrt, skb2, psend);
2277 }
2278 psend = ct;
2279 }
2280 }
2281last_forward:
2282 if (psend != -1) {
2283 ip6mr_forward2(net, mrt, skb, psend);
2284 return;
2285 }
2286
2287dont_forward:
2288 kfree_skb(skb);
2289}
2290
2291/* Called under rcu_read_lock() */
2292static void ip6_mr_output_finish(struct net *net, struct mr_table *mrt,
2293 struct net_device *dev, struct sk_buff *skb,
2294 struct mfc6_cache *c)
2295{
2296 int psend = -1;
2297 int ct;
2298
2299 WARN_ON_ONCE(!rcu_read_lock_held());
2300
2301 atomic_long_inc(&c->_c.mfc_un.res.pkt);
2302 atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes);
2303 WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies);
2304
2305 /* Forward the frame */
2306 if (ipv6_addr_any(&c->mf6c_origin) &&
2307 ipv6_addr_any(&c->mf6c_mcastgrp)) {
2308 if (ipv6_hdr(skb)->hop_limit >
2309 c->_c.mfc_un.res.ttls[c->_c.mfc_parent]) {
2310 /* It's an (*,*) entry and the packet is not coming from
2311 * the upstream: forward the packet to the upstream
2312 * only.
2313 */
2314 psend = c->_c.mfc_parent;
2315 goto last_forward;
2316 }
2317 goto dont_forward;
2318 }
2319 for (ct = c->_c.mfc_un.res.maxvif - 1;
2320 ct >= c->_c.mfc_un.res.minvif; ct--) {
2321 if (ipv6_hdr(skb)->hop_limit > c->_c.mfc_un.res.ttls[ct]) {
2322 if (psend != -1) {
2323 struct sk_buff *skb2;
2324
2325 skb2 = skb_clone(skb, GFP_ATOMIC);
2326 if (skb2)
2327 ip6mr_output2(net, mrt, skb2, psend);
2328 }
2329 psend = ct;
2330 }
2331 }
2332last_forward:
2333 if (psend != -1) {
2334 ip6mr_output2(net, mrt, skb, psend);
2335 return;
2336 }
2337
2338dont_forward:
2339 kfree_skb(skb);
2340}
2341
2342/*
2343 * Multicast packets for forwarding arrive here
2344 */
2345
2346int ip6_mr_input(struct sk_buff *skb)
2347{
2348 struct net_device *dev = skb->dev;
2349 struct net *net = dev_net_rcu(dev);
2350 struct mfc6_cache *cache;
2351 struct mr_table *mrt;
2352 struct flowi6 fl6 = {
2353 .flowi6_iif = dev->ifindex,
2354 .flowi6_mark = skb->mark,
2355 };
2356 int err;
2357
2358 /* skb->dev passed in is the master dev for vrfs.
2359 * Get the proper interface that does have a vif associated with it.
2360 */
2361 if (netif_is_l3_master(dev)) {
2362 dev = dev_get_by_index_rcu(net, IPCB(skb)->iif);
2363 if (!dev) {
2364 kfree_skb(skb);
2365 return -ENODEV;
2366 }
2367 }
2368
2369 err = ip6mr_fib_lookup(net, &fl6, &mrt);
2370 if (err < 0) {
2371 kfree_skb(skb);
2372 return err;
2373 }
2374
2375 cache = ip6mr_cache_find(mrt,
2376 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr);
2377 if (!cache) {
2378 int vif = ip6mr_find_vif(mrt, dev);
2379
2380 if (vif >= 0)
2381 cache = ip6mr_cache_find_any(mrt,
2382 &ipv6_hdr(skb)->daddr,
2383 vif);
2384 }
2385
2386 /*
2387 * No usable cache entry
2388 */
2389 if (!cache) {
2390 int vif;
2391
2392 vif = ip6mr_find_vif(mrt, dev);
2393 if (vif >= 0) {
2394 int err = ip6mr_cache_unresolved(mrt, vif, skb, dev);
2395
2396 return err;
2397 }
2398 kfree_skb(skb);
2399 return -ENODEV;
2400 }
2401
2402 ip6_mr_forward(net, mrt, dev, skb, cache);
2403
2404 return 0;
2405}
2406
2407int ip6_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
2408{
2409 struct net_device *dev = skb_dst(skb)->dev;
2410 struct flowi6 fl6 = (struct flowi6) {
2411 .flowi6_iif = LOOPBACK_IFINDEX,
2412 .flowi6_mark = skb->mark,
2413 };
2414 struct mfc6_cache *cache;
2415 struct mr_table *mrt;
2416 int err;
2417 int vif;
2418
2419 guard(rcu)();
2420
2421 if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
2422 goto ip6_output;
2423 if (!(IP6CB(skb)->flags & IP6SKB_MCROUTE))
2424 goto ip6_output;
2425
2426 err = ip6mr_fib_lookup(net, &fl6, &mrt);
2427 if (err < 0) {
2428 kfree_skb(skb);
2429 return err;
2430 }
2431
2432 cache = ip6mr_cache_find(mrt,
2433 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr);
2434 if (!cache) {
2435 vif = ip6mr_find_vif(mrt, dev);
2436 if (vif >= 0)
2437 cache = ip6mr_cache_find_any(mrt,
2438 &ipv6_hdr(skb)->daddr,
2439 vif);
2440 }
2441
2442 /* No usable cache entry */
2443 if (!cache) {
2444 vif = ip6mr_find_vif(mrt, dev);
2445 if (vif >= 0)
2446 return ip6mr_cache_unresolved(mrt, vif, skb, dev);
2447 goto ip6_output;
2448 }
2449
2450 /* Wrong interface */
2451 vif = cache->_c.mfc_parent;
2452 if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev)
2453 goto ip6_output;
2454
2455 ip6_mr_output_finish(net, mrt, dev, skb, cache);
2456 return 0;
2457
2458ip6_output:
2459 return ip6_output(net, sk, skb);
2460}
2461
2462int ip6mr_get_route(struct net *net, struct sk_buff *skb, struct rtmsg *rtm,
2463 u32 portid)
2464{
2465 int err;
2466 struct mr_table *mrt;
2467 struct mfc6_cache *cache;
2468 struct rt6_info *rt = dst_rt6_info(skb_dst(skb));
2469
2470 rcu_read_lock();
2471 mrt = __ip6mr_get_table(net, RT6_TABLE_DFLT);
2472 if (!mrt) {
2473 rcu_read_unlock();
2474 return -ENOENT;
2475 }
2476
2477 cache = ip6mr_cache_find(mrt, &rt->rt6i_src.addr, &rt->rt6i_dst.addr);
2478 if (!cache && skb->dev) {
2479 int vif = ip6mr_find_vif(mrt, skb->dev);
2480
2481 if (vif >= 0)
2482 cache = ip6mr_cache_find_any(mrt, &rt->rt6i_dst.addr,
2483 vif);
2484 }
2485
2486 if (!cache) {
2487 struct sk_buff *skb2;
2488 struct ipv6hdr *iph;
2489 struct net_device *dev;
2490 int vif;
2491
2492 dev = skb->dev;
2493 if (!dev || (vif = ip6mr_find_vif(mrt, dev)) < 0) {
2494 rcu_read_unlock();
2495 return -ENODEV;
2496 }
2497
2498 /* really correct? */
2499 skb2 = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC);
2500 if (!skb2) {
2501 rcu_read_unlock();
2502 return -ENOMEM;
2503 }
2504
2505 NETLINK_CB(skb2).portid = portid;
2506 skb_reset_transport_header(skb2);
2507
2508 skb_put(skb2, sizeof(struct ipv6hdr));
2509 skb_reset_network_header(skb2);
2510
2511 iph = ipv6_hdr(skb2);
2512 iph->version = 0;
2513 iph->priority = 0;
2514 iph->flow_lbl[0] = 0;
2515 iph->flow_lbl[1] = 0;
2516 iph->flow_lbl[2] = 0;
2517 iph->payload_len = 0;
2518 iph->nexthdr = IPPROTO_NONE;
2519 iph->hop_limit = 0;
2520 iph->saddr = rt->rt6i_src.addr;
2521 iph->daddr = rt->rt6i_dst.addr;
2522
2523 err = ip6mr_cache_unresolved(mrt, vif, skb2, dev);
2524 rcu_read_unlock();
2525
2526 return err;
2527 }
2528
2529 err = mr_fill_mroute(mrt, skb, &cache->_c, rtm);
2530 rcu_read_unlock();
2531 return err;
2532}
2533
2534static int ip6mr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
2535 u32 portid, u32 seq, struct mfc6_cache *c, int cmd,
2536 int flags)
2537{
2538 struct nlmsghdr *nlh;
2539 struct rtmsg *rtm;
2540 int err;
2541
2542 nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags);
2543 if (!nlh)
2544 return -EMSGSIZE;
2545
2546 rtm = nlmsg_data(nlh);
2547 rtm->rtm_family = RTNL_FAMILY_IP6MR;
2548 rtm->rtm_dst_len = 128;
2549 rtm->rtm_src_len = 128;
2550 rtm->rtm_tos = 0;
2551 rtm->rtm_table = mrt->id;
2552 if (nla_put_u32(skb, RTA_TABLE, mrt->id))
2553 goto nla_put_failure;
2554 rtm->rtm_type = RTN_MULTICAST;
2555 rtm->rtm_scope = RT_SCOPE_UNIVERSE;
2556 if (c->_c.mfc_flags & MFC_STATIC)
2557 rtm->rtm_protocol = RTPROT_STATIC;
2558 else
2559 rtm->rtm_protocol = RTPROT_MROUTED;
2560 rtm->rtm_flags = 0;
2561
2562 if (nla_put_in6_addr(skb, RTA_SRC, &c->mf6c_origin) ||
2563 nla_put_in6_addr(skb, RTA_DST, &c->mf6c_mcastgrp))
2564 goto nla_put_failure;
2565 err = mr_fill_mroute(mrt, skb, &c->_c, rtm);
2566 /* do not break the dump if cache is unresolved */
2567 if (err < 0 && err != -ENOENT)
2568 goto nla_put_failure;
2569
2570 nlmsg_end(skb, nlh);
2571 return 0;
2572
2573nla_put_failure:
2574 nlmsg_cancel(skb, nlh);
2575 return -EMSGSIZE;
2576}
2577
2578static int _ip6mr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
2579 u32 portid, u32 seq, struct mr_mfc *c,
2580 int cmd, int flags)
2581{
2582 return ip6mr_fill_mroute(mrt, skb, portid, seq, (struct mfc6_cache *)c,
2583 cmd, flags);
2584}
2585
2586static int mr6_msgsize(bool unresolved)
2587{
2588 size_t len =
2589 NLMSG_ALIGN(sizeof(struct rtmsg))
2590 + nla_total_size(4) /* RTA_TABLE */
2591 + nla_total_size(sizeof(struct in6_addr)) /* RTA_SRC */
2592 + nla_total_size(sizeof(struct in6_addr)) /* RTA_DST */
2593 ;
2594
2595 if (!unresolved)
2596 len = len
2597 + nla_total_size(4) /* RTA_IIF */
2598 + nla_total_size(0) /* RTA_MULTIPATH */
2599 + MAXMIFS * NLA_ALIGN(sizeof(struct rtnexthop))
2600 /* RTA_MFC_STATS */
2601 + nla_total_size_64bit(sizeof(struct rta_mfc_stats))
2602 ;
2603
2604 return len;
2605}
2606
2607static void mr6_netlink_event(struct mr_table *mrt, struct mfc6_cache *mfc,
2608 int cmd)
2609{
2610 struct net *net = read_pnet(&mrt->net);
2611 struct sk_buff *skb;
2612 int err = -ENOBUFS;
2613
2614 skb = nlmsg_new(mr6_msgsize(mfc->_c.mfc_parent >= MAXMIFS), GFP_ATOMIC);
2615 if (!skb)
2616 goto errout;
2617
2618 err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0);
2619 if (err < 0)
2620 goto errout;
2621
2622 rtnl_notify(skb, net, 0, RTNLGRP_IPV6_MROUTE, NULL, GFP_ATOMIC);
2623 return;
2624
2625errout:
2626 kfree_skb(skb);
2627 rtnl_set_sk_err(net, RTNLGRP_IPV6_MROUTE, err);
2628}
2629
2630static size_t mrt6msg_netlink_msgsize(size_t payloadlen)
2631{
2632 size_t len =
2633 NLMSG_ALIGN(sizeof(struct rtgenmsg))
2634 + nla_total_size(1) /* IP6MRA_CREPORT_MSGTYPE */
2635 + nla_total_size(4) /* IP6MRA_CREPORT_MIF_ID */
2636 /* IP6MRA_CREPORT_SRC_ADDR */
2637 + nla_total_size(sizeof(struct in6_addr))
2638 /* IP6MRA_CREPORT_DST_ADDR */
2639 + nla_total_size(sizeof(struct in6_addr))
2640 /* IP6MRA_CREPORT_PKT */
2641 + nla_total_size(payloadlen)
2642 ;
2643
2644 return len;
2645}
2646
2647static void mrt6msg_netlink_event(const struct mr_table *mrt, struct sk_buff *pkt)
2648{
2649 struct net *net = read_pnet(&mrt->net);
2650 struct nlmsghdr *nlh;
2651 struct rtgenmsg *rtgenm;
2652 struct mrt6msg *msg;
2653 struct sk_buff *skb;
2654 struct nlattr *nla;
2655 int payloadlen;
2656
2657 payloadlen = pkt->len - sizeof(struct mrt6msg);
2658 msg = (struct mrt6msg *)skb_transport_header(pkt);
2659
2660 skb = nlmsg_new(mrt6msg_netlink_msgsize(payloadlen), GFP_ATOMIC);
2661 if (!skb)
2662 goto errout;
2663
2664 nlh = nlmsg_put(skb, 0, 0, RTM_NEWCACHEREPORT,
2665 sizeof(struct rtgenmsg), 0);
2666 if (!nlh)
2667 goto errout;
2668 rtgenm = nlmsg_data(nlh);
2669 rtgenm->rtgen_family = RTNL_FAMILY_IP6MR;
2670 if (nla_put_u8(skb, IP6MRA_CREPORT_MSGTYPE, msg->im6_msgtype) ||
2671 nla_put_u32(skb, IP6MRA_CREPORT_MIF_ID, msg->im6_mif) ||
2672 nla_put_in6_addr(skb, IP6MRA_CREPORT_SRC_ADDR,
2673 &msg->im6_src) ||
2674 nla_put_in6_addr(skb, IP6MRA_CREPORT_DST_ADDR,
2675 &msg->im6_dst))
2676 goto nla_put_failure;
2677
2678 nla = nla_reserve(skb, IP6MRA_CREPORT_PKT, payloadlen);
2679 if (!nla || skb_copy_bits(pkt, sizeof(struct mrt6msg),
2680 nla_data(nla), payloadlen))
2681 goto nla_put_failure;
2682
2683 nlmsg_end(skb, nlh);
2684
2685 rtnl_notify(skb, net, 0, RTNLGRP_IPV6_MROUTE_R, NULL, GFP_ATOMIC);
2686 return;
2687
2688nla_put_failure:
2689 nlmsg_cancel(skb, nlh);
2690errout:
2691 kfree_skb(skb);
2692 rtnl_set_sk_err(net, RTNLGRP_IPV6_MROUTE_R, -ENOBUFS);
2693}
2694
2695static const struct nla_policy ip6mr_getroute_policy[RTA_MAX + 1] = {
2696 [RTA_SRC] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
2697 [RTA_DST] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
2698 [RTA_TABLE] = { .type = NLA_U32 },
2699};
2700
2701static int ip6mr_rtm_valid_getroute_req(struct sk_buff *skb,
2702 const struct nlmsghdr *nlh,
2703 struct nlattr **tb,
2704 struct netlink_ext_ack *extack)
2705{
2706 struct rtmsg *rtm;
2707 int err;
2708
2709 err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, ip6mr_getroute_policy,
2710 extack);
2711 if (err)
2712 return err;
2713
2714 rtm = nlmsg_data(nlh);
2715 if ((rtm->rtm_src_len && rtm->rtm_src_len != 128) ||
2716 (rtm->rtm_dst_len && rtm->rtm_dst_len != 128) ||
2717 rtm->rtm_tos || rtm->rtm_table || rtm->rtm_protocol ||
2718 rtm->rtm_scope || rtm->rtm_type || rtm->rtm_flags) {
2719 NL_SET_ERR_MSG_MOD(extack,
2720 "Invalid values in header for multicast route get request");
2721 return -EINVAL;
2722 }
2723
2724 if ((tb[RTA_SRC] && !rtm->rtm_src_len) ||
2725 (tb[RTA_DST] && !rtm->rtm_dst_len)) {
2726 NL_SET_ERR_MSG_MOD(extack, "rtm_src_len and rtm_dst_len must be 128 for IPv6");
2727 return -EINVAL;
2728 }
2729
2730 return 0;
2731}
2732
2733static int ip6mr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
2734 struct netlink_ext_ack *extack)
2735{
2736 struct net *net = sock_net(in_skb->sk);
2737 struct in6_addr src = {}, grp = {};
2738 struct nlattr *tb[RTA_MAX + 1];
2739 struct mfc6_cache *cache;
2740 struct mr_table *mrt;
2741 struct sk_buff *skb;
2742 u32 tableid;
2743 int err;
2744
2745 err = ip6mr_rtm_valid_getroute_req(in_skb, nlh, tb, extack);
2746 if (err < 0)
2747 return err;
2748
2749 skb = nlmsg_new(mr6_msgsize(false), GFP_KERNEL);
2750 if (!skb)
2751 return -ENOBUFS;
2752
2753 if (tb[RTA_SRC])
2754 src = nla_get_in6_addr(tb[RTA_SRC]);
2755 if (tb[RTA_DST])
2756 grp = nla_get_in6_addr(tb[RTA_DST]);
2757 tableid = nla_get_u32_default(tb[RTA_TABLE], 0);
2758
2759 rcu_read_lock();
2760
2761 mrt = __ip6mr_get_table(net, tableid ?: RT_TABLE_DEFAULT);
2762 if (!mrt) {
2763 NL_SET_ERR_MSG_MOD(extack, "MR table does not exist");
2764 err = -ENOENT;
2765 goto err;
2766 }
2767
2768 cache = ip6mr_cache_find(mrt, &src, &grp);
2769 if (!cache) {
2770 NL_SET_ERR_MSG_MOD(extack, "MR cache entry not found");
2771 err = -ENOENT;
2772 goto err;
2773 }
2774
2775 err = ip6mr_fill_mroute(mrt, skb, NETLINK_CB(in_skb).portid,
2776 nlh->nlmsg_seq, cache, RTM_NEWROUTE, 0);
2777 if (err < 0)
2778 goto err;
2779
2780 rcu_read_unlock();
2781
2782 return rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
2783
2784err:
2785 rcu_read_unlock();
2786 kfree_skb(skb);
2787 return err;
2788}
2789
2790static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
2791{
2792 const struct nlmsghdr *nlh = cb->nlh;
2793 struct fib_dump_filter filter = {};
2794 int err;
2795
2796 rcu_read_lock();
2797
2798 if (cb->strict_check) {
2799 err = ip_valid_fib_dump_req(sock_net(skb->sk), nlh,
2800 &filter, cb);
2801 if (err < 0)
2802 goto unlock;
2803 }
2804
2805 if (filter.table_id) {
2806 struct mr_table *mrt;
2807
2808 mrt = __ip6mr_get_table(sock_net(skb->sk), filter.table_id);
2809 if (!mrt) {
2810 if (rtnl_msg_family(cb->nlh) != RTNL_FAMILY_IP6MR) {
2811 err = skb->len;
2812 goto unlock;
2813 }
2814
2815 NL_SET_ERR_MSG_MOD(cb->extack, "MR table does not exist");
2816 err = -ENOENT;
2817 goto unlock;
2818 }
2819
2820 err = mr_table_dump(mrt, skb, cb, _ip6mr_fill_mroute,
2821 &mfc_unres_lock, &filter);
2822 err = skb->len ? : err;
2823 goto unlock;
2824 }
2825
2826 err = mr_rtm_dumproute(skb, cb, ip6mr_mr_table_iter,
2827 _ip6mr_fill_mroute, &mfc_unres_lock, &filter);
2828unlock:
2829 rcu_read_unlock();
2830
2831 return err;
2832}