Linux Audio

Check our new training course

Loading...
v3.15
   1/*
   2 *	Multicast support for IPv6
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *
   8 *	Based on linux/ipv4/igmp.c and linux/ipv4/ip_sockglue.c
   9 *
  10 *	This program is free software; you can redistribute it and/or
  11 *      modify it under the terms of the GNU General Public License
  12 *      as published by the Free Software Foundation; either version
  13 *      2 of the License, or (at your option) any later version.
  14 */
  15
  16/* Changes:
  17 *
  18 *	yoshfuji	: fix format of router-alert option
  19 *	YOSHIFUJI Hideaki @USAGI:
  20 *		Fixed source address for MLD message based on
  21 *		<draft-ietf-magma-mld-source-05.txt>.
  22 *	YOSHIFUJI Hideaki @USAGI:
  23 *		- Ignore Queries for invalid addresses.
  24 *		- MLD for link-local addresses.
  25 *	David L Stevens <dlstevens@us.ibm.com>:
  26 *		- MLDv2 support
  27 */
  28
  29#include <linux/module.h>
  30#include <linux/errno.h>
  31#include <linux/types.h>
  32#include <linux/string.h>
  33#include <linux/socket.h>
  34#include <linux/sockios.h>
  35#include <linux/jiffies.h>
  36#include <linux/times.h>
  37#include <linux/net.h>
  38#include <linux/in.h>
  39#include <linux/in6.h>
  40#include <linux/netdevice.h>
  41#include <linux/if_arp.h>
  42#include <linux/route.h>
  43#include <linux/init.h>
  44#include <linux/proc_fs.h>
  45#include <linux/seq_file.h>
  46#include <linux/slab.h>
  47#include <linux/pkt_sched.h>
  48#include <net/mld.h>
  49
  50#include <linux/netfilter.h>
  51#include <linux/netfilter_ipv6.h>
  52
  53#include <net/net_namespace.h>
  54#include <net/sock.h>
  55#include <net/snmp.h>
  56
  57#include <net/ipv6.h>
  58#include <net/protocol.h>
  59#include <net/if_inet6.h>
  60#include <net/ndisc.h>
  61#include <net/addrconf.h>
  62#include <net/ip6_route.h>
  63#include <net/inet_common.h>
  64
  65#include <net/ip6_checksum.h>
  66
  67/* Set to 3 to get tracing... */
  68#define MCAST_DEBUG 2
  69
  70#if MCAST_DEBUG >= 3
  71#define MDBG(x) printk x
  72#else
  73#define MDBG(x)
  74#endif
  75
  76/* Ensure that we have struct in6_addr aligned on 32bit word. */
  77static void *__mld2_query_bugs[] __attribute__((__unused__)) = {
  78	BUILD_BUG_ON_NULL(offsetof(struct mld2_query, mld2q_srcs) % 4),
  79	BUILD_BUG_ON_NULL(offsetof(struct mld2_report, mld2r_grec) % 4),
  80	BUILD_BUG_ON_NULL(offsetof(struct mld2_grec, grec_mca) % 4)
  81};
  82
  83static struct in6_addr mld2_all_mcr = MLD2_ALL_MCR_INIT;
  84
  85/* Big mc list lock for all the sockets */
  86static DEFINE_SPINLOCK(ipv6_sk_mc_lock);
  87
  88static void igmp6_join_group(struct ifmcaddr6 *ma);
  89static void igmp6_leave_group(struct ifmcaddr6 *ma);
  90static void igmp6_timer_handler(unsigned long data);
  91
  92static void mld_gq_timer_expire(unsigned long data);
  93static void mld_ifc_timer_expire(unsigned long data);
  94static void mld_ifc_event(struct inet6_dev *idev);
  95static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
  96static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *addr);
  97static void mld_clear_delrec(struct inet6_dev *idev);
  98static bool mld_in_v1_mode(const struct inet6_dev *idev);
  99static int sf_setstate(struct ifmcaddr6 *pmc);
 100static void sf_markstate(struct ifmcaddr6 *pmc);
 101static void ip6_mc_clear_src(struct ifmcaddr6 *pmc);
 102static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
 103			  int sfmode, int sfcount, const struct in6_addr *psfsrc,
 104			  int delta);
 105static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
 106			  int sfmode, int sfcount, const struct in6_addr *psfsrc,
 107			  int delta);
 108static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
 109			    struct inet6_dev *idev);
 110
 111#define MLD_QRV_DEFAULT		2
 112/* RFC3810, 9.2. Query Interval */
 113#define MLD_QI_DEFAULT		(125 * HZ)
 114/* RFC3810, 9.3. Query Response Interval */
 115#define MLD_QRI_DEFAULT		(10 * HZ)
 116
 117/* RFC3810, 8.1 Query Version Distinctions */
 118#define MLD_V1_QUERY_LEN	24
 119#define MLD_V2_QUERY_LEN_MIN	28
 120
 121#define IPV6_MLD_MAX_MSF	64
 122
 123int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
 
 124
 125/*
 126 *	socket join on multicast group
 127 */
 128
 129#define for_each_pmc_rcu(np, pmc)				\
 130	for (pmc = rcu_dereference(np->ipv6_mc_list);		\
 131	     pmc != NULL;					\
 132	     pmc = rcu_dereference(pmc->next))
 133
 134static int unsolicited_report_interval(struct inet6_dev *idev)
 135{
 136	int iv;
 137
 138	if (mld_in_v1_mode(idev))
 139		iv = idev->cnf.mldv1_unsolicited_report_interval;
 140	else
 141		iv = idev->cnf.mldv2_unsolicited_report_interval;
 142
 143	return iv > 0 ? iv : 1;
 144}
 145
 146int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 147{
 148	struct net_device *dev = NULL;
 149	struct ipv6_mc_socklist *mc_lst;
 150	struct ipv6_pinfo *np = inet6_sk(sk);
 151	struct net *net = sock_net(sk);
 152	int err;
 153
 
 
 154	if (!ipv6_addr_is_multicast(addr))
 155		return -EINVAL;
 156
 157	rcu_read_lock();
 158	for_each_pmc_rcu(np, mc_lst) {
 159		if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
 160		    ipv6_addr_equal(&mc_lst->addr, addr)) {
 161			rcu_read_unlock();
 162			return -EADDRINUSE;
 163		}
 164	}
 165	rcu_read_unlock();
 166
 167	mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL);
 168
 169	if (mc_lst == NULL)
 170		return -ENOMEM;
 171
 172	mc_lst->next = NULL;
 173	mc_lst->addr = *addr;
 174
 175	rcu_read_lock();
 176	if (ifindex == 0) {
 177		struct rt6_info *rt;
 178		rt = rt6_lookup(net, addr, NULL, 0, 0);
 179		if (rt) {
 180			dev = rt->dst.dev;
 181			ip6_rt_put(rt);
 182		}
 183	} else
 184		dev = dev_get_by_index_rcu(net, ifindex);
 185
 186	if (dev == NULL) {
 187		rcu_read_unlock();
 188		sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
 189		return -ENODEV;
 190	}
 191
 192	mc_lst->ifindex = dev->ifindex;
 193	mc_lst->sfmode = MCAST_EXCLUDE;
 194	rwlock_init(&mc_lst->sflock);
 195	mc_lst->sflist = NULL;
 196
 197	/*
 198	 *	now add/increase the group membership on the device
 199	 */
 200
 201	err = ipv6_dev_mc_inc(dev, addr);
 202
 203	if (err) {
 204		rcu_read_unlock();
 205		sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
 206		return err;
 207	}
 208
 209	spin_lock(&ipv6_sk_mc_lock);
 210	mc_lst->next = np->ipv6_mc_list;
 211	rcu_assign_pointer(np->ipv6_mc_list, mc_lst);
 212	spin_unlock(&ipv6_sk_mc_lock);
 213
 214	rcu_read_unlock();
 215
 216	return 0;
 217}
 
 218
 219/*
 220 *	socket leave on multicast group
 221 */
 222int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
 223{
 224	struct ipv6_pinfo *np = inet6_sk(sk);
 225	struct ipv6_mc_socklist *mc_lst;
 226	struct ipv6_mc_socklist __rcu **lnk;
 227	struct net *net = sock_net(sk);
 228
 
 
 229	if (!ipv6_addr_is_multicast(addr))
 230		return -EINVAL;
 231
 232	spin_lock(&ipv6_sk_mc_lock);
 233	for (lnk = &np->ipv6_mc_list;
 234	     (mc_lst = rcu_dereference_protected(*lnk,
 235			lockdep_is_held(&ipv6_sk_mc_lock))) !=NULL ;
 236	      lnk = &mc_lst->next) {
 237		if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
 238		    ipv6_addr_equal(&mc_lst->addr, addr)) {
 239			struct net_device *dev;
 240
 241			*lnk = mc_lst->next;
 242			spin_unlock(&ipv6_sk_mc_lock);
 243
 244			rcu_read_lock();
 245			dev = dev_get_by_index_rcu(net, mc_lst->ifindex);
 246			if (dev != NULL) {
 247				struct inet6_dev *idev = __in6_dev_get(dev);
 248
 249				(void) ip6_mc_leave_src(sk, mc_lst, idev);
 250				if (idev)
 251					__ipv6_dev_mc_dec(idev, &mc_lst->addr);
 252			} else
 253				(void) ip6_mc_leave_src(sk, mc_lst, NULL);
 254			rcu_read_unlock();
 255			atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
 256			kfree_rcu(mc_lst, rcu);
 257			return 0;
 258		}
 259	}
 260	spin_unlock(&ipv6_sk_mc_lock);
 261
 262	return -EADDRNOTAVAIL;
 263}
 
 264
 265/* called with rcu_read_lock() */
 266static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
 267					     const struct in6_addr *group,
 268					     int ifindex)
 269{
 270	struct net_device *dev = NULL;
 271	struct inet6_dev *idev = NULL;
 272
 273	if (ifindex == 0) {
 274		struct rt6_info *rt = rt6_lookup(net, group, NULL, 0, 0);
 275
 276		if (rt) {
 277			dev = rt->dst.dev;
 278			ip6_rt_put(rt);
 279		}
 280	} else
 281		dev = dev_get_by_index_rcu(net, ifindex);
 282
 283	if (!dev)
 284		return NULL;
 285	idev = __in6_dev_get(dev);
 286	if (!idev)
 287		return NULL;
 288	read_lock_bh(&idev->lock);
 289	if (idev->dead) {
 290		read_unlock_bh(&idev->lock);
 291		return NULL;
 292	}
 293	return idev;
 294}
 295
 296void ipv6_sock_mc_close(struct sock *sk)
 297{
 298	struct ipv6_pinfo *np = inet6_sk(sk);
 299	struct ipv6_mc_socklist *mc_lst;
 300	struct net *net = sock_net(sk);
 301
 302	if (!rcu_access_pointer(np->ipv6_mc_list))
 303		return;
 304
 305	spin_lock(&ipv6_sk_mc_lock);
 306	while ((mc_lst = rcu_dereference_protected(np->ipv6_mc_list,
 307				lockdep_is_held(&ipv6_sk_mc_lock))) != NULL) {
 308		struct net_device *dev;
 309
 310		np->ipv6_mc_list = mc_lst->next;
 311		spin_unlock(&ipv6_sk_mc_lock);
 312
 313		rcu_read_lock();
 314		dev = dev_get_by_index_rcu(net, mc_lst->ifindex);
 315		if (dev) {
 316			struct inet6_dev *idev = __in6_dev_get(dev);
 317
 318			(void) ip6_mc_leave_src(sk, mc_lst, idev);
 319			if (idev)
 320				__ipv6_dev_mc_dec(idev, &mc_lst->addr);
 321		} else
 322			(void) ip6_mc_leave_src(sk, mc_lst, NULL);
 323		rcu_read_unlock();
 324
 325		atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
 326		kfree_rcu(mc_lst, rcu);
 327
 328		spin_lock(&ipv6_sk_mc_lock);
 329	}
 330	spin_unlock(&ipv6_sk_mc_lock);
 
 
 
 
 
 
 
 
 
 
 331}
 332
 333int ip6_mc_source(int add, int omode, struct sock *sk,
 334	struct group_source_req *pgsr)
 335{
 336	struct in6_addr *source, *group;
 337	struct ipv6_mc_socklist *pmc;
 338	struct inet6_dev *idev;
 339	struct ipv6_pinfo *inet6 = inet6_sk(sk);
 340	struct ip6_sf_socklist *psl;
 341	struct net *net = sock_net(sk);
 342	int i, j, rv;
 343	int leavegroup = 0;
 344	int pmclocked = 0;
 345	int err;
 346
 347	source = &((struct sockaddr_in6 *)&pgsr->gsr_source)->sin6_addr;
 348	group = &((struct sockaddr_in6 *)&pgsr->gsr_group)->sin6_addr;
 349
 350	if (!ipv6_addr_is_multicast(group))
 351		return -EINVAL;
 352
 353	rcu_read_lock();
 354	idev = ip6_mc_find_dev_rcu(net, group, pgsr->gsr_interface);
 355	if (!idev) {
 356		rcu_read_unlock();
 357		return -ENODEV;
 358	}
 359
 360	err = -EADDRNOTAVAIL;
 361
 362	for_each_pmc_rcu(inet6, pmc) {
 363		if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
 364			continue;
 365		if (ipv6_addr_equal(&pmc->addr, group))
 366			break;
 367	}
 368	if (!pmc) {		/* must have a prior join */
 369		err = -EINVAL;
 370		goto done;
 371	}
 372	/* if a source filter was set, must be the same mode as before */
 373	if (pmc->sflist) {
 374		if (pmc->sfmode != omode) {
 375			err = -EINVAL;
 376			goto done;
 377		}
 378	} else if (pmc->sfmode != omode) {
 379		/* allow mode switches for empty-set filters */
 380		ip6_mc_add_src(idev, group, omode, 0, NULL, 0);
 381		ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
 382		pmc->sfmode = omode;
 383	}
 384
 385	write_lock(&pmc->sflock);
 386	pmclocked = 1;
 387
 388	psl = pmc->sflist;
 389	if (!add) {
 390		if (!psl)
 391			goto done;	/* err = -EADDRNOTAVAIL */
 392		rv = !0;
 393		for (i=0; i<psl->sl_count; i++) {
 394			rv = !ipv6_addr_equal(&psl->sl_addr[i], source);
 395			if (rv == 0)
 396				break;
 397		}
 398		if (rv)		/* source not found */
 399			goto done;	/* err = -EADDRNOTAVAIL */
 400
 401		/* special case - (INCLUDE, empty) == LEAVE_GROUP */
 402		if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
 403			leavegroup = 1;
 404			goto done;
 405		}
 406
 407		/* update the interface filter */
 408		ip6_mc_del_src(idev, group, omode, 1, source, 1);
 409
 410		for (j=i+1; j<psl->sl_count; j++)
 411			psl->sl_addr[j-1] = psl->sl_addr[j];
 412		psl->sl_count--;
 413		err = 0;
 414		goto done;
 415	}
 416	/* else, add a new source to the filter */
 417
 418	if (psl && psl->sl_count >= sysctl_mld_max_msf) {
 419		err = -ENOBUFS;
 420		goto done;
 421	}
 422	if (!psl || psl->sl_count == psl->sl_max) {
 423		struct ip6_sf_socklist *newpsl;
 424		int count = IP6_SFBLOCK;
 425
 426		if (psl)
 427			count += psl->sl_max;
 428		newpsl = sock_kmalloc(sk, IP6_SFLSIZE(count), GFP_ATOMIC);
 429		if (!newpsl) {
 430			err = -ENOBUFS;
 431			goto done;
 432		}
 433		newpsl->sl_max = count;
 434		newpsl->sl_count = count - IP6_SFBLOCK;
 435		if (psl) {
 436			for (i=0; i<psl->sl_count; i++)
 437				newpsl->sl_addr[i] = psl->sl_addr[i];
 438			sock_kfree_s(sk, psl, IP6_SFLSIZE(psl->sl_max));
 439		}
 440		pmc->sflist = psl = newpsl;
 441	}
 442	rv = 1;	/* > 0 for insert logic below if sl_count is 0 */
 443	for (i=0; i<psl->sl_count; i++) {
 444		rv = !ipv6_addr_equal(&psl->sl_addr[i], source);
 445		if (rv == 0) /* There is an error in the address. */
 446			goto done;
 447	}
 448	for (j=psl->sl_count-1; j>=i; j--)
 449		psl->sl_addr[j+1] = psl->sl_addr[j];
 450	psl->sl_addr[i] = *source;
 451	psl->sl_count++;
 452	err = 0;
 453	/* update the interface list */
 454	ip6_mc_add_src(idev, group, omode, 1, source, 1);
 455done:
 456	if (pmclocked)
 457		write_unlock(&pmc->sflock);
 458	read_unlock_bh(&idev->lock);
 459	rcu_read_unlock();
 460	if (leavegroup)
 461		return ipv6_sock_mc_drop(sk, pgsr->gsr_interface, group);
 462	return err;
 463}
 464
 465int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
 466{
 467	const struct in6_addr *group;
 468	struct ipv6_mc_socklist *pmc;
 469	struct inet6_dev *idev;
 470	struct ipv6_pinfo *inet6 = inet6_sk(sk);
 471	struct ip6_sf_socklist *newpsl, *psl;
 472	struct net *net = sock_net(sk);
 473	int leavegroup = 0;
 474	int i, err;
 475
 476	group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
 477
 478	if (!ipv6_addr_is_multicast(group))
 479		return -EINVAL;
 480	if (gsf->gf_fmode != MCAST_INCLUDE &&
 481	    gsf->gf_fmode != MCAST_EXCLUDE)
 482		return -EINVAL;
 483
 484	rcu_read_lock();
 485	idev = ip6_mc_find_dev_rcu(net, group, gsf->gf_interface);
 486
 487	if (!idev) {
 488		rcu_read_unlock();
 489		return -ENODEV;
 490	}
 491
 492	err = 0;
 493
 494	if (gsf->gf_fmode == MCAST_INCLUDE && gsf->gf_numsrc == 0) {
 495		leavegroup = 1;
 496		goto done;
 497	}
 498
 499	for_each_pmc_rcu(inet6, pmc) {
 500		if (pmc->ifindex != gsf->gf_interface)
 501			continue;
 502		if (ipv6_addr_equal(&pmc->addr, group))
 503			break;
 504	}
 505	if (!pmc) {		/* must have a prior join */
 506		err = -EINVAL;
 507		goto done;
 508	}
 509	if (gsf->gf_numsrc) {
 510		newpsl = sock_kmalloc(sk, IP6_SFLSIZE(gsf->gf_numsrc),
 511							  GFP_ATOMIC);
 512		if (!newpsl) {
 513			err = -ENOBUFS;
 514			goto done;
 515		}
 516		newpsl->sl_max = newpsl->sl_count = gsf->gf_numsrc;
 517		for (i=0; i<newpsl->sl_count; ++i) {
 518			struct sockaddr_in6 *psin6;
 519
 520			psin6 = (struct sockaddr_in6 *)&gsf->gf_slist[i];
 521			newpsl->sl_addr[i] = psin6->sin6_addr;
 522		}
 523		err = ip6_mc_add_src(idev, group, gsf->gf_fmode,
 524			newpsl->sl_count, newpsl->sl_addr, 0);
 525		if (err) {
 526			sock_kfree_s(sk, newpsl, IP6_SFLSIZE(newpsl->sl_max));
 527			goto done;
 528		}
 529	} else {
 530		newpsl = NULL;
 531		(void) ip6_mc_add_src(idev, group, gsf->gf_fmode, 0, NULL, 0);
 532	}
 533
 534	write_lock(&pmc->sflock);
 535	psl = pmc->sflist;
 536	if (psl) {
 537		(void) ip6_mc_del_src(idev, group, pmc->sfmode,
 538			psl->sl_count, psl->sl_addr, 0);
 539		sock_kfree_s(sk, psl, IP6_SFLSIZE(psl->sl_max));
 540	} else
 541		(void) ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
 542	pmc->sflist = newpsl;
 543	pmc->sfmode = gsf->gf_fmode;
 544	write_unlock(&pmc->sflock);
 545	err = 0;
 546done:
 547	read_unlock_bh(&idev->lock);
 548	rcu_read_unlock();
 549	if (leavegroup)
 550		err = ipv6_sock_mc_drop(sk, gsf->gf_interface, group);
 551	return err;
 552}
 553
 554int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
 555	struct group_filter __user *optval, int __user *optlen)
 556{
 557	int err, i, count, copycount;
 558	const struct in6_addr *group;
 559	struct ipv6_mc_socklist *pmc;
 560	struct inet6_dev *idev;
 561	struct ipv6_pinfo *inet6 = inet6_sk(sk);
 562	struct ip6_sf_socklist *psl;
 563	struct net *net = sock_net(sk);
 564
 565	group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
 566
 567	if (!ipv6_addr_is_multicast(group))
 568		return -EINVAL;
 569
 570	rcu_read_lock();
 571	idev = ip6_mc_find_dev_rcu(net, group, gsf->gf_interface);
 572
 573	if (!idev) {
 574		rcu_read_unlock();
 575		return -ENODEV;
 576	}
 577
 578	err = -EADDRNOTAVAIL;
 579	/*
 580	 * changes to the ipv6_mc_list require the socket lock and
 581	 * a read lock on ip6_sk_mc_lock. We have the socket lock,
 582	 * so reading the list is safe.
 583	 */
 584
 585	for_each_pmc_rcu(inet6, pmc) {
 586		if (pmc->ifindex != gsf->gf_interface)
 587			continue;
 588		if (ipv6_addr_equal(group, &pmc->addr))
 589			break;
 590	}
 591	if (!pmc)		/* must have a prior join */
 592		goto done;
 593	gsf->gf_fmode = pmc->sfmode;
 594	psl = pmc->sflist;
 595	count = psl ? psl->sl_count : 0;
 596	read_unlock_bh(&idev->lock);
 597	rcu_read_unlock();
 598
 599	copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
 600	gsf->gf_numsrc = count;
 601	if (put_user(GROUP_FILTER_SIZE(copycount), optlen) ||
 602	    copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
 603		return -EFAULT;
 604	}
 605	/* changes to psl require the socket lock, a read lock on
 606	 * on ipv6_sk_mc_lock and a write lock on pmc->sflock. We
 607	 * have the socket lock, so reading here is safe.
 608	 */
 609	for (i=0; i<copycount; i++) {
 610		struct sockaddr_in6 *psin6;
 611		struct sockaddr_storage ss;
 612
 613		psin6 = (struct sockaddr_in6 *)&ss;
 614		memset(&ss, 0, sizeof(ss));
 615		psin6->sin6_family = AF_INET6;
 616		psin6->sin6_addr = psl->sl_addr[i];
 617		if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss)))
 618			return -EFAULT;
 619	}
 620	return 0;
 621done:
 622	read_unlock_bh(&idev->lock);
 623	rcu_read_unlock();
 624	return err;
 625}
 626
 627bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
 628		    const struct in6_addr *src_addr)
 629{
 630	struct ipv6_pinfo *np = inet6_sk(sk);
 631	struct ipv6_mc_socklist *mc;
 632	struct ip6_sf_socklist *psl;
 633	bool rv = true;
 634
 635	rcu_read_lock();
 636	for_each_pmc_rcu(np, mc) {
 637		if (ipv6_addr_equal(&mc->addr, mc_addr))
 638			break;
 639	}
 640	if (!mc) {
 641		rcu_read_unlock();
 642		return true;
 643	}
 644	read_lock(&mc->sflock);
 645	psl = mc->sflist;
 646	if (!psl) {
 647		rv = mc->sfmode == MCAST_EXCLUDE;
 648	} else {
 649		int i;
 650
 651		for (i=0; i<psl->sl_count; i++) {
 652			if (ipv6_addr_equal(&psl->sl_addr[i], src_addr))
 653				break;
 654		}
 655		if (mc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
 656			rv = false;
 657		if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
 658			rv = false;
 659	}
 660	read_unlock(&mc->sflock);
 661	rcu_read_unlock();
 662
 663	return rv;
 664}
 665
 666static void ma_put(struct ifmcaddr6 *mc)
 667{
 668	if (atomic_dec_and_test(&mc->mca_refcnt)) {
 669		in6_dev_put(mc->idev);
 670		kfree(mc);
 671	}
 672}
 673
 674static void igmp6_group_added(struct ifmcaddr6 *mc)
 675{
 676	struct net_device *dev = mc->idev->dev;
 677	char buf[MAX_ADDR_LEN];
 678
 679	if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
 680	    IPV6_ADDR_SCOPE_LINKLOCAL)
 681		return;
 682
 683	spin_lock_bh(&mc->mca_lock);
 684	if (!(mc->mca_flags&MAF_LOADED)) {
 685		mc->mca_flags |= MAF_LOADED;
 686		if (ndisc_mc_map(&mc->mca_addr, buf, dev, 0) == 0)
 687			dev_mc_add(dev, buf);
 688	}
 689	spin_unlock_bh(&mc->mca_lock);
 690
 691	if (!(dev->flags & IFF_UP) || (mc->mca_flags & MAF_NOREPORT))
 692		return;
 693
 694	if (mld_in_v1_mode(mc->idev)) {
 695		igmp6_join_group(mc);
 696		return;
 697	}
 698	/* else v2 */
 699
 700	mc->mca_crcount = mc->idev->mc_qrv;
 701	mld_ifc_event(mc->idev);
 702}
 703
 704static void igmp6_group_dropped(struct ifmcaddr6 *mc)
 705{
 706	struct net_device *dev = mc->idev->dev;
 707	char buf[MAX_ADDR_LEN];
 708
 709	if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
 710	    IPV6_ADDR_SCOPE_LINKLOCAL)
 711		return;
 712
 713	spin_lock_bh(&mc->mca_lock);
 714	if (mc->mca_flags&MAF_LOADED) {
 715		mc->mca_flags &= ~MAF_LOADED;
 716		if (ndisc_mc_map(&mc->mca_addr, buf, dev, 0) == 0)
 717			dev_mc_del(dev, buf);
 718	}
 719
 720	if (mc->mca_flags & MAF_NOREPORT)
 721		goto done;
 722	spin_unlock_bh(&mc->mca_lock);
 
 
 723
 724	if (!mc->idev->dead)
 725		igmp6_leave_group(mc);
 726
 727	spin_lock_bh(&mc->mca_lock);
 728	if (del_timer(&mc->mca_timer))
 729		atomic_dec(&mc->mca_refcnt);
 730done:
 731	ip6_mc_clear_src(mc);
 732	spin_unlock_bh(&mc->mca_lock);
 733}
 734
 735/*
 736 * deleted ifmcaddr6 manipulation
 737 */
 738static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
 739{
 740	struct ifmcaddr6 *pmc;
 741
 742	/* this is an "ifmcaddr6" for convenience; only the fields below
 743	 * are actually used. In particular, the refcnt and users are not
 744	 * used for management of the delete list. Using the same structure
 745	 * for deleted items allows change reports to use common code with
 746	 * non-deleted or query-response MCA's.
 747	 */
 748	pmc = kzalloc(sizeof(*pmc), GFP_ATOMIC);
 749	if (!pmc)
 750		return;
 751
 752	spin_lock_bh(&im->mca_lock);
 753	spin_lock_init(&pmc->mca_lock);
 754	pmc->idev = im->idev;
 755	in6_dev_hold(idev);
 756	pmc->mca_addr = im->mca_addr;
 757	pmc->mca_crcount = idev->mc_qrv;
 758	pmc->mca_sfmode = im->mca_sfmode;
 759	if (pmc->mca_sfmode == MCAST_INCLUDE) {
 760		struct ip6_sf_list *psf;
 761
 762		pmc->mca_tomb = im->mca_tomb;
 763		pmc->mca_sources = im->mca_sources;
 764		im->mca_tomb = im->mca_sources = NULL;
 765		for (psf=pmc->mca_sources; psf; psf=psf->sf_next)
 766			psf->sf_crcount = pmc->mca_crcount;
 767	}
 768	spin_unlock_bh(&im->mca_lock);
 769
 770	spin_lock_bh(&idev->mc_lock);
 771	pmc->next = idev->mc_tomb;
 772	idev->mc_tomb = pmc;
 773	spin_unlock_bh(&idev->mc_lock);
 774}
 775
 776static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *pmca)
 777{
 778	struct ifmcaddr6 *pmc, *pmc_prev;
 779	struct ip6_sf_list *psf, *psf_next;
 
 780
 781	spin_lock_bh(&idev->mc_lock);
 782	pmc_prev = NULL;
 783	for (pmc=idev->mc_tomb; pmc; pmc=pmc->next) {
 784		if (ipv6_addr_equal(&pmc->mca_addr, pmca))
 785			break;
 786		pmc_prev = pmc;
 787	}
 788	if (pmc) {
 789		if (pmc_prev)
 790			pmc_prev->next = pmc->next;
 791		else
 792			idev->mc_tomb = pmc->next;
 793	}
 794	spin_unlock_bh(&idev->mc_lock);
 795
 
 796	if (pmc) {
 797		for (psf=pmc->mca_tomb; psf; psf=psf_next) {
 798			psf_next = psf->sf_next;
 799			kfree(psf);
 
 
 
 
 
 800		}
 801		in6_dev_put(pmc->idev);
 802		kfree(pmc);
 803	}
 
 804}
 805
 806static void mld_clear_delrec(struct inet6_dev *idev)
 807{
 808	struct ifmcaddr6 *pmc, *nextpmc;
 809
 810	spin_lock_bh(&idev->mc_lock);
 811	pmc = idev->mc_tomb;
 812	idev->mc_tomb = NULL;
 813	spin_unlock_bh(&idev->mc_lock);
 814
 815	for (; pmc; pmc = nextpmc) {
 816		nextpmc = pmc->next;
 817		ip6_mc_clear_src(pmc);
 818		in6_dev_put(pmc->idev);
 819		kfree(pmc);
 820	}
 821
 822	/* clear dead sources, too */
 823	read_lock_bh(&idev->lock);
 824	for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
 825		struct ip6_sf_list *psf, *psf_next;
 826
 827		spin_lock_bh(&pmc->mca_lock);
 828		psf = pmc->mca_tomb;
 829		pmc->mca_tomb = NULL;
 830		spin_unlock_bh(&pmc->mca_lock);
 831		for (; psf; psf=psf_next) {
 832			psf_next = psf->sf_next;
 833			kfree(psf);
 834		}
 835	}
 836	read_unlock_bh(&idev->lock);
 837}
 838
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 839
 840/*
 841 *	device multicast group inc (add if not found)
 842 */
 843int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
 844{
 845	struct ifmcaddr6 *mc;
 846	struct inet6_dev *idev;
 847
 
 
 848	/* we need to take a reference on idev */
 849	idev = in6_dev_get(dev);
 850
 851	if (idev == NULL)
 852		return -EINVAL;
 853
 854	write_lock_bh(&idev->lock);
 855	if (idev->dead) {
 856		write_unlock_bh(&idev->lock);
 857		in6_dev_put(idev);
 858		return -ENODEV;
 859	}
 860
 861	for (mc = idev->mc_list; mc; mc = mc->next) {
 862		if (ipv6_addr_equal(&mc->mca_addr, addr)) {
 863			mc->mca_users++;
 864			write_unlock_bh(&idev->lock);
 865			ip6_mc_add_src(idev, &mc->mca_addr, MCAST_EXCLUDE, 0,
 866				NULL, 0);
 867			in6_dev_put(idev);
 868			return 0;
 869		}
 870	}
 871
 872	/*
 873	 *	not found: create a new one.
 874	 */
 875
 876	mc = kzalloc(sizeof(struct ifmcaddr6), GFP_ATOMIC);
 877
 878	if (mc == NULL) {
 879		write_unlock_bh(&idev->lock);
 880		in6_dev_put(idev);
 881		return -ENOMEM;
 882	}
 883
 884	setup_timer(&mc->mca_timer, igmp6_timer_handler, (unsigned long)mc);
 885
 886	mc->mca_addr = *addr;
 887	mc->idev = idev; /* (reference taken) */
 888	mc->mca_users = 1;
 889	/* mca_stamp should be updated upon changes */
 890	mc->mca_cstamp = mc->mca_tstamp = jiffies;
 891	atomic_set(&mc->mca_refcnt, 2);
 892	spin_lock_init(&mc->mca_lock);
 893
 894	/* initial mode is (EX, empty) */
 895	mc->mca_sfmode = MCAST_EXCLUDE;
 896	mc->mca_sfcount[MCAST_EXCLUDE] = 1;
 897
 898	if (ipv6_addr_is_ll_all_nodes(&mc->mca_addr) ||
 899	    IPV6_ADDR_MC_SCOPE(&mc->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
 900		mc->mca_flags |= MAF_NOREPORT;
 901
 902	mc->next = idev->mc_list;
 903	idev->mc_list = mc;
 
 
 
 
 
 904	write_unlock_bh(&idev->lock);
 905
 906	mld_del_delrec(idev, &mc->mca_addr);
 907	igmp6_group_added(mc);
 908	ma_put(mc);
 909	return 0;
 910}
 911
 912/*
 913 *	device multicast group del
 914 */
 915int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
 916{
 917	struct ifmcaddr6 *ma, **map;
 918
 
 
 919	write_lock_bh(&idev->lock);
 920	for (map = &idev->mc_list; (ma=*map) != NULL; map = &ma->next) {
 921		if (ipv6_addr_equal(&ma->mca_addr, addr)) {
 922			if (--ma->mca_users == 0) {
 923				*map = ma->next;
 924				write_unlock_bh(&idev->lock);
 925
 926				igmp6_group_dropped(ma);
 
 927
 928				ma_put(ma);
 929				return 0;
 930			}
 931			write_unlock_bh(&idev->lock);
 932			return 0;
 933		}
 934	}
 935	write_unlock_bh(&idev->lock);
 936
 937	return -ENOENT;
 938}
 939
 940int ipv6_dev_mc_dec(struct net_device *dev, const struct in6_addr *addr)
 941{
 942	struct inet6_dev *idev;
 943	int err;
 944
 945	rcu_read_lock();
 946
 947	idev = __in6_dev_get(dev);
 948	if (!idev)
 949		err = -ENODEV;
 950	else
 951		err = __ipv6_dev_mc_dec(idev, addr);
 952
 953	rcu_read_unlock();
 954	return err;
 955}
 956
 957/*
 958 *	check if the interface/address pair is valid
 959 */
 960bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
 961			 const struct in6_addr *src_addr)
 962{
 963	struct inet6_dev *idev;
 964	struct ifmcaddr6 *mc;
 965	bool rv = false;
 966
 967	rcu_read_lock();
 968	idev = __in6_dev_get(dev);
 969	if (idev) {
 970		read_lock_bh(&idev->lock);
 971		for (mc = idev->mc_list; mc; mc=mc->next) {
 972			if (ipv6_addr_equal(&mc->mca_addr, group))
 973				break;
 974		}
 975		if (mc) {
 976			if (src_addr && !ipv6_addr_any(src_addr)) {
 977				struct ip6_sf_list *psf;
 978
 979				spin_lock_bh(&mc->mca_lock);
 980				for (psf=mc->mca_sources;psf;psf=psf->sf_next) {
 981					if (ipv6_addr_equal(&psf->sf_addr, src_addr))
 982						break;
 983				}
 984				if (psf)
 985					rv = psf->sf_count[MCAST_INCLUDE] ||
 986						psf->sf_count[MCAST_EXCLUDE] !=
 987						mc->mca_sfcount[MCAST_EXCLUDE];
 988				else
 989					rv = mc->mca_sfcount[MCAST_EXCLUDE] !=0;
 990				spin_unlock_bh(&mc->mca_lock);
 991			} else
 992				rv = true; /* don't filter unspecified source */
 993		}
 994		read_unlock_bh(&idev->lock);
 995	}
 996	rcu_read_unlock();
 997	return rv;
 998}
 999
1000static void mld_gq_start_timer(struct inet6_dev *idev)
1001{
1002	unsigned long tv = prandom_u32() % idev->mc_maxdelay;
1003
1004	idev->mc_gq_running = 1;
1005	if (!mod_timer(&idev->mc_gq_timer, jiffies+tv+2))
1006		in6_dev_hold(idev);
1007}
1008
1009static void mld_gq_stop_timer(struct inet6_dev *idev)
1010{
1011	idev->mc_gq_running = 0;
1012	if (del_timer(&idev->mc_gq_timer))
1013		__in6_dev_put(idev);
1014}
1015
1016static void mld_ifc_start_timer(struct inet6_dev *idev, unsigned long delay)
1017{
1018	unsigned long tv = prandom_u32() % delay;
1019
1020	if (!mod_timer(&idev->mc_ifc_timer, jiffies+tv+2))
1021		in6_dev_hold(idev);
1022}
1023
1024static void mld_ifc_stop_timer(struct inet6_dev *idev)
1025{
1026	idev->mc_ifc_count = 0;
1027	if (del_timer(&idev->mc_ifc_timer))
1028		__in6_dev_put(idev);
1029}
1030
1031static void mld_dad_start_timer(struct inet6_dev *idev, unsigned long delay)
1032{
1033	unsigned long tv = prandom_u32() % delay;
1034
1035	if (!mod_timer(&idev->mc_dad_timer, jiffies+tv+2))
1036		in6_dev_hold(idev);
1037}
1038
1039static void mld_dad_stop_timer(struct inet6_dev *idev)
1040{
1041	if (del_timer(&idev->mc_dad_timer))
1042		__in6_dev_put(idev);
1043}
1044
1045/*
1046 *	IGMP handling (alias multicast ICMPv6 messages)
1047 */
1048
1049static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
1050{
1051	unsigned long delay = resptime;
1052
1053	/* Do not start timer for these addresses */
1054	if (ipv6_addr_is_ll_all_nodes(&ma->mca_addr) ||
1055	    IPV6_ADDR_MC_SCOPE(&ma->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
1056		return;
1057
1058	if (del_timer(&ma->mca_timer)) {
1059		atomic_dec(&ma->mca_refcnt);
1060		delay = ma->mca_timer.expires - jiffies;
1061	}
1062
1063	if (delay >= resptime)
1064		delay = prandom_u32() % resptime;
1065
1066	ma->mca_timer.expires = jiffies + delay;
1067	if (!mod_timer(&ma->mca_timer, jiffies + delay))
1068		atomic_inc(&ma->mca_refcnt);
1069	ma->mca_flags |= MAF_TIMER_RUNNING;
1070}
1071
1072/* mark EXCLUDE-mode sources */
1073static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
1074			     const struct in6_addr *srcs)
1075{
1076	struct ip6_sf_list *psf;
1077	int i, scount;
1078
1079	scount = 0;
1080	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
1081		if (scount == nsrcs)
1082			break;
1083		for (i=0; i<nsrcs; i++) {
1084			/* skip inactive filters */
1085			if (psf->sf_count[MCAST_INCLUDE] ||
1086			    pmc->mca_sfcount[MCAST_EXCLUDE] !=
1087			    psf->sf_count[MCAST_EXCLUDE])
1088				break;
1089			if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
1090				scount++;
1091				break;
1092			}
1093		}
1094	}
1095	pmc->mca_flags &= ~MAF_GSQUERY;
1096	if (scount == nsrcs)	/* all sources excluded */
1097		return false;
1098	return true;
1099}
1100
1101static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
1102			    const struct in6_addr *srcs)
1103{
1104	struct ip6_sf_list *psf;
1105	int i, scount;
1106
1107	if (pmc->mca_sfmode == MCAST_EXCLUDE)
1108		return mld_xmarksources(pmc, nsrcs, srcs);
1109
1110	/* mark INCLUDE-mode sources */
1111
1112	scount = 0;
1113	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
1114		if (scount == nsrcs)
1115			break;
1116		for (i=0; i<nsrcs; i++) {
1117			if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
1118				psf->sf_gsresp = 1;
1119				scount++;
1120				break;
1121			}
1122		}
1123	}
1124	if (!scount) {
1125		pmc->mca_flags &= ~MAF_GSQUERY;
1126		return false;
1127	}
1128	pmc->mca_flags |= MAF_GSQUERY;
1129	return true;
1130}
1131
1132static int mld_force_mld_version(const struct inet6_dev *idev)
1133{
1134	/* Normally, both are 0 here. If enforcement to a particular is
1135	 * being used, individual device enforcement will have a lower
1136	 * precedence over 'all' device (.../conf/all/force_mld_version).
1137	 */
1138
1139	if (dev_net(idev->dev)->ipv6.devconf_all->force_mld_version != 0)
1140		return dev_net(idev->dev)->ipv6.devconf_all->force_mld_version;
1141	else
1142		return idev->cnf.force_mld_version;
1143}
1144
1145static bool mld_in_v2_mode_only(const struct inet6_dev *idev)
1146{
1147	return mld_force_mld_version(idev) == 2;
1148}
1149
1150static bool mld_in_v1_mode_only(const struct inet6_dev *idev)
1151{
1152	return mld_force_mld_version(idev) == 1;
1153}
1154
1155static bool mld_in_v1_mode(const struct inet6_dev *idev)
1156{
1157	if (mld_in_v2_mode_only(idev))
1158		return false;
1159	if (mld_in_v1_mode_only(idev))
1160		return true;
1161	if (idev->mc_v1_seen && time_before(jiffies, idev->mc_v1_seen))
1162		return true;
1163
1164	return false;
1165}
1166
1167static void mld_set_v1_mode(struct inet6_dev *idev)
1168{
1169	/* RFC3810, relevant sections:
1170	 *  - 9.1. Robustness Variable
1171	 *  - 9.2. Query Interval
1172	 *  - 9.3. Query Response Interval
1173	 *  - 9.12. Older Version Querier Present Timeout
1174	 */
1175	unsigned long switchback;
1176
1177	switchback = (idev->mc_qrv * idev->mc_qi) + idev->mc_qri;
1178
1179	idev->mc_v1_seen = jiffies + switchback;
1180}
1181
1182static void mld_update_qrv(struct inet6_dev *idev,
1183			   const struct mld2_query *mlh2)
1184{
1185	/* RFC3810, relevant sections:
1186	 *  - 5.1.8. QRV (Querier's Robustness Variable)
1187	 *  - 9.1. Robustness Variable
1188	 */
1189
1190	/* The value of the Robustness Variable MUST NOT be zero,
1191	 * and SHOULD NOT be one. Catch this here if we ever run
1192	 * into such a case in future.
1193	 */
 
1194	WARN_ON(idev->mc_qrv == 0);
1195
1196	if (mlh2->mld2q_qrv > 0)
1197		idev->mc_qrv = mlh2->mld2q_qrv;
1198
1199	if (unlikely(idev->mc_qrv < 2)) {
1200		net_warn_ratelimited("IPv6: MLD: clamping QRV from %u to %u!\n",
1201				     idev->mc_qrv, MLD_QRV_DEFAULT);
1202		idev->mc_qrv = MLD_QRV_DEFAULT;
1203	}
1204}
1205
1206static void mld_update_qi(struct inet6_dev *idev,
1207			  const struct mld2_query *mlh2)
1208{
1209	/* RFC3810, relevant sections:
1210	 *  - 5.1.9. QQIC (Querier's Query Interval Code)
1211	 *  - 9.2. Query Interval
1212	 *  - 9.12. Older Version Querier Present Timeout
1213	 *    (the [Query Interval] in the last Query received)
1214	 */
1215	unsigned long mc_qqi;
1216
1217	if (mlh2->mld2q_qqic < 128) {
1218		mc_qqi = mlh2->mld2q_qqic;
1219	} else {
1220		unsigned long mc_man, mc_exp;
1221
1222		mc_exp = MLDV2_QQIC_EXP(mlh2->mld2q_qqic);
1223		mc_man = MLDV2_QQIC_MAN(mlh2->mld2q_qqic);
1224
1225		mc_qqi = (mc_man | 0x10) << (mc_exp + 3);
1226	}
1227
1228	idev->mc_qi = mc_qqi * HZ;
1229}
1230
1231static void mld_update_qri(struct inet6_dev *idev,
1232			   const struct mld2_query *mlh2)
1233{
1234	/* RFC3810, relevant sections:
1235	 *  - 5.1.3. Maximum Response Code
1236	 *  - 9.3. Query Response Interval
1237	 */
1238	idev->mc_qri = msecs_to_jiffies(mldv2_mrc(mlh2));
1239}
1240
1241static int mld_process_v1(struct inet6_dev *idev, struct mld_msg *mld,
1242			  unsigned long *max_delay)
1243{
1244	unsigned long mldv1_md;
1245
1246	/* Ignore v1 queries */
1247	if (mld_in_v2_mode_only(idev))
1248		return -EINVAL;
1249
1250	/* MLDv1 router present */
1251	mldv1_md = ntohs(mld->mld_maxdelay);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1252	*max_delay = max(msecs_to_jiffies(mldv1_md), 1UL);
1253
1254	mld_set_v1_mode(idev);
 
 
 
 
 
 
1255
1256	/* cancel MLDv2 report timer */
1257	mld_gq_stop_timer(idev);
1258	/* cancel the interface change timer */
1259	mld_ifc_stop_timer(idev);
1260	/* clear deleted report items */
1261	mld_clear_delrec(idev);
1262
1263	return 0;
1264}
1265
1266static int mld_process_v2(struct inet6_dev *idev, struct mld2_query *mld,
1267			  unsigned long *max_delay)
1268{
1269	/* hosts need to stay in MLDv1 mode, discard MLDv2 queries */
1270	if (mld_in_v1_mode(idev))
1271		return -EINVAL;
1272
1273	*max_delay = max(msecs_to_jiffies(mldv2_mrc(mld)), 1UL);
1274
1275	mld_update_qrv(idev, mld);
1276	mld_update_qi(idev, mld);
1277	mld_update_qri(idev, mld);
1278
1279	idev->mc_maxdelay = *max_delay;
1280
1281	return 0;
1282}
1283
1284/* called with rcu_read_lock() */
1285int igmp6_event_query(struct sk_buff *skb)
1286{
1287	struct mld2_query *mlh2 = NULL;
1288	struct ifmcaddr6 *ma;
1289	const struct in6_addr *group;
1290	unsigned long max_delay;
1291	struct inet6_dev *idev;
1292	struct mld_msg *mld;
1293	int group_type;
1294	int mark = 0;
1295	int len, err;
1296
1297	if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
1298		return -EINVAL;
1299
1300	/* compute payload length excluding extension headers */
1301	len = ntohs(ipv6_hdr(skb)->payload_len) + sizeof(struct ipv6hdr);
1302	len -= skb_network_header_len(skb);
1303
1304	/* Drop queries with not link local source */
1305	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL))
 
 
 
 
 
 
 
 
 
1306		return -EINVAL;
1307
1308	idev = __in6_dev_get(skb->dev);
1309	if (idev == NULL)
1310		return 0;
1311
1312	mld = (struct mld_msg *)icmp6_hdr(skb);
1313	group = &mld->mld_mca;
1314	group_type = ipv6_addr_type(group);
1315
1316	if (group_type != IPV6_ADDR_ANY &&
1317	    !(group_type&IPV6_ADDR_MULTICAST))
1318		return -EINVAL;
1319
1320	if (len == MLD_V1_QUERY_LEN) {
1321		err = mld_process_v1(idev, mld, &max_delay);
 
 
 
1322		if (err < 0)
1323			return err;
1324	} else if (len >= MLD_V2_QUERY_LEN_MIN) {
1325		int srcs_offset = sizeof(struct mld2_query) -
1326				  sizeof(struct icmp6hdr);
1327
1328		if (!pskb_may_pull(skb, srcs_offset))
1329			return -EINVAL;
1330
1331		mlh2 = (struct mld2_query *)skb_transport_header(skb);
1332
1333		err = mld_process_v2(idev, mlh2, &max_delay);
1334		if (err < 0)
1335			return err;
1336
1337		if (group_type == IPV6_ADDR_ANY) { /* general query */
1338			if (mlh2->mld2q_nsrcs)
1339				return -EINVAL; /* no sources allowed */
1340
1341			mld_gq_start_timer(idev);
1342			return 0;
1343		}
1344		/* mark sources to include, if group & source-specific */
1345		if (mlh2->mld2q_nsrcs != 0) {
1346			if (!pskb_may_pull(skb, srcs_offset +
1347			    ntohs(mlh2->mld2q_nsrcs) * sizeof(struct in6_addr)))
1348				return -EINVAL;
1349
1350			mlh2 = (struct mld2_query *)skb_transport_header(skb);
1351			mark = 1;
1352		}
1353	} else
1354		return -EINVAL;
 
1355
1356	read_lock_bh(&idev->lock);
1357	if (group_type == IPV6_ADDR_ANY) {
1358		for (ma = idev->mc_list; ma; ma=ma->next) {
1359			spin_lock_bh(&ma->mca_lock);
1360			igmp6_group_queried(ma, max_delay);
1361			spin_unlock_bh(&ma->mca_lock);
1362		}
1363	} else {
1364		for (ma = idev->mc_list; ma; ma=ma->next) {
1365			if (!ipv6_addr_equal(group, &ma->mca_addr))
1366				continue;
1367			spin_lock_bh(&ma->mca_lock);
1368			if (ma->mca_flags & MAF_TIMER_RUNNING) {
1369				/* gsquery <- gsquery && mark */
1370				if (!mark)
1371					ma->mca_flags &= ~MAF_GSQUERY;
1372			} else {
1373				/* gsquery <- mark */
1374				if (mark)
1375					ma->mca_flags |= MAF_GSQUERY;
1376				else
1377					ma->mca_flags &= ~MAF_GSQUERY;
1378			}
1379			if (!(ma->mca_flags & MAF_GSQUERY) ||
1380			    mld_marksources(ma, ntohs(mlh2->mld2q_nsrcs), mlh2->mld2q_srcs))
1381				igmp6_group_queried(ma, max_delay);
1382			spin_unlock_bh(&ma->mca_lock);
1383			break;
1384		}
1385	}
1386	read_unlock_bh(&idev->lock);
1387
1388	return 0;
1389}
1390
1391/* called with rcu_read_lock() */
1392int igmp6_event_report(struct sk_buff *skb)
1393{
1394	struct ifmcaddr6 *ma;
1395	struct inet6_dev *idev;
1396	struct mld_msg *mld;
1397	int addr_type;
1398
1399	/* Our own report looped back. Ignore it. */
1400	if (skb->pkt_type == PACKET_LOOPBACK)
1401		return 0;
1402
1403	/* send our report if the MC router may not have heard this report */
1404	if (skb->pkt_type != PACKET_MULTICAST &&
1405	    skb->pkt_type != PACKET_BROADCAST)
1406		return 0;
1407
1408	if (!pskb_may_pull(skb, sizeof(*mld) - sizeof(struct icmp6hdr)))
1409		return -EINVAL;
1410
1411	mld = (struct mld_msg *)icmp6_hdr(skb);
1412
1413	/* Drop reports with not link local source */
1414	addr_type = ipv6_addr_type(&ipv6_hdr(skb)->saddr);
1415	if (addr_type != IPV6_ADDR_ANY &&
1416	    !(addr_type&IPV6_ADDR_LINKLOCAL))
1417		return -EINVAL;
1418
1419	idev = __in6_dev_get(skb->dev);
1420	if (idev == NULL)
1421		return -ENODEV;
1422
1423	/*
1424	 *	Cancel the timer for this group
1425	 */
1426
1427	read_lock_bh(&idev->lock);
1428	for (ma = idev->mc_list; ma; ma=ma->next) {
1429		if (ipv6_addr_equal(&ma->mca_addr, &mld->mld_mca)) {
1430			spin_lock(&ma->mca_lock);
1431			if (del_timer(&ma->mca_timer))
1432				atomic_dec(&ma->mca_refcnt);
1433			ma->mca_flags &= ~(MAF_LAST_REPORTER|MAF_TIMER_RUNNING);
1434			spin_unlock(&ma->mca_lock);
1435			break;
1436		}
1437	}
1438	read_unlock_bh(&idev->lock);
1439	return 0;
1440}
1441
1442static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
1443		  int gdeleted, int sdeleted)
1444{
1445	switch (type) {
1446	case MLD2_MODE_IS_INCLUDE:
1447	case MLD2_MODE_IS_EXCLUDE:
1448		if (gdeleted || sdeleted)
1449			return false;
1450		if (!((pmc->mca_flags & MAF_GSQUERY) && !psf->sf_gsresp)) {
1451			if (pmc->mca_sfmode == MCAST_INCLUDE)
1452				return true;
1453			/* don't include if this source is excluded
1454			 * in all filters
1455			 */
1456			if (psf->sf_count[MCAST_INCLUDE])
1457				return type == MLD2_MODE_IS_INCLUDE;
1458			return pmc->mca_sfcount[MCAST_EXCLUDE] ==
1459				psf->sf_count[MCAST_EXCLUDE];
1460		}
1461		return false;
1462	case MLD2_CHANGE_TO_INCLUDE:
1463		if (gdeleted || sdeleted)
1464			return false;
1465		return psf->sf_count[MCAST_INCLUDE] != 0;
1466	case MLD2_CHANGE_TO_EXCLUDE:
1467		if (gdeleted || sdeleted)
1468			return false;
1469		if (pmc->mca_sfcount[MCAST_EXCLUDE] == 0 ||
1470		    psf->sf_count[MCAST_INCLUDE])
1471			return false;
1472		return pmc->mca_sfcount[MCAST_EXCLUDE] ==
1473			psf->sf_count[MCAST_EXCLUDE];
1474	case MLD2_ALLOW_NEW_SOURCES:
1475		if (gdeleted || !psf->sf_crcount)
1476			return false;
1477		return (pmc->mca_sfmode == MCAST_INCLUDE) ^ sdeleted;
1478	case MLD2_BLOCK_OLD_SOURCES:
1479		if (pmc->mca_sfmode == MCAST_INCLUDE)
1480			return gdeleted || (psf->sf_crcount && sdeleted);
1481		return psf->sf_crcount && !gdeleted && !sdeleted;
1482	}
1483	return false;
1484}
1485
1486static int
1487mld_scount(struct ifmcaddr6 *pmc, int type, int gdeleted, int sdeleted)
1488{
1489	struct ip6_sf_list *psf;
1490	int scount = 0;
1491
1492	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
1493		if (!is_in(pmc, psf, type, gdeleted, sdeleted))
1494			continue;
1495		scount++;
1496	}
1497	return scount;
1498}
1499
1500static void ip6_mc_hdr(struct sock *sk, struct sk_buff *skb,
1501		       struct net_device *dev,
1502		       const struct in6_addr *saddr,
1503		       const struct in6_addr *daddr,
1504		       int proto, int len)
1505{
1506	struct ipv6hdr *hdr;
1507
1508	skb->protocol = htons(ETH_P_IPV6);
1509	skb->dev = dev;
1510
1511	skb_reset_network_header(skb);
1512	skb_put(skb, sizeof(struct ipv6hdr));
1513	hdr = ipv6_hdr(skb);
1514
1515	ip6_flow_hdr(hdr, 0, 0);
1516
1517	hdr->payload_len = htons(len);
1518	hdr->nexthdr = proto;
1519	hdr->hop_limit = inet6_sk(sk)->hop_limit;
1520
1521	hdr->saddr = *saddr;
1522	hdr->daddr = *daddr;
1523}
1524
1525static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
1526{
1527	struct net_device *dev = idev->dev;
1528	struct net *net = dev_net(dev);
1529	struct sock *sk = net->ipv6.igmp_sk;
1530	struct sk_buff *skb;
1531	struct mld2_report *pmr;
1532	struct in6_addr addr_buf;
1533	const struct in6_addr *saddr;
1534	int hlen = LL_RESERVED_SPACE(dev);
1535	int tlen = dev->needed_tailroom;
 
1536	int err;
1537	u8 ra[8] = { IPPROTO_ICMPV6, 0,
1538		     IPV6_TLV_ROUTERALERT, 2, 0, 0,
1539		     IPV6_TLV_PADN, 0 };
1540
1541	/* we assume size > sizeof(ra) here */
1542	size += hlen + tlen;
1543	/* limit our allocations to order-0 page */
1544	size = min_t(int, size, SKB_MAX_ORDER(0, 0));
1545	skb = sock_alloc_send_skb(sk, size, 1, &err);
1546
1547	if (!skb)
1548		return NULL;
1549
1550	skb->priority = TC_PRIO_CONTROL;
1551	skb_reserve(skb, hlen);
 
1552
1553	if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
1554		/* <draft-ietf-magma-mld-source-05.txt>:
1555		 * use unspecified address as the source address
1556		 * when a valid link-local address is not available.
1557		 */
1558		saddr = &in6addr_any;
1559	} else
1560		saddr = &addr_buf;
1561
1562	ip6_mc_hdr(sk, skb, dev, saddr, &mld2_all_mcr, NEXTHDR_HOP, 0);
1563
1564	memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
1565
1566	skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data);
1567	skb_put(skb, sizeof(*pmr));
1568	pmr = (struct mld2_report *)skb_transport_header(skb);
1569	pmr->mld2r_type = ICMPV6_MLD2_REPORT;
1570	pmr->mld2r_resv1 = 0;
1571	pmr->mld2r_cksum = 0;
1572	pmr->mld2r_resv2 = 0;
1573	pmr->mld2r_ngrec = 0;
1574	return skb;
1575}
1576
1577static void mld_sendpack(struct sk_buff *skb)
1578{
1579	struct ipv6hdr *pip6 = ipv6_hdr(skb);
1580	struct mld2_report *pmr =
1581			      (struct mld2_report *)skb_transport_header(skb);
1582	int payload_len, mldlen;
1583	struct inet6_dev *idev;
1584	struct net *net = dev_net(skb->dev);
1585	int err;
1586	struct flowi6 fl6;
1587	struct dst_entry *dst;
1588
1589	rcu_read_lock();
1590	idev = __in6_dev_get(skb->dev);
1591	IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
1592
1593	payload_len = (skb_tail_pointer(skb) - skb_network_header(skb)) -
1594		sizeof(*pip6);
1595	mldlen = skb_tail_pointer(skb) - skb_transport_header(skb);
1596	pip6->payload_len = htons(payload_len);
1597
1598	pmr->mld2r_cksum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
1599					   IPPROTO_ICMPV6,
1600					   csum_partial(skb_transport_header(skb),
1601							mldlen, 0));
1602
1603	icmpv6_flow_init(net->ipv6.igmp_sk, &fl6, ICMPV6_MLD2_REPORT,
1604			 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
1605			 skb->dev->ifindex);
1606	dst = icmp6_dst_alloc(skb->dev, &fl6);
1607
1608	err = 0;
1609	if (IS_ERR(dst)) {
1610		err = PTR_ERR(dst);
1611		dst = NULL;
1612	}
1613	skb_dst_set(skb, dst);
1614	if (err)
1615		goto err_out;
1616
1617	payload_len = skb->len;
1618
1619	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
1620		      dst_output);
1621out:
1622	if (!err) {
1623		ICMP6MSGOUT_INC_STATS(net, idev, ICMPV6_MLD2_REPORT);
1624		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1625		IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, payload_len);
1626	} else {
1627		IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
1628	}
1629
1630	rcu_read_unlock();
1631	return;
1632
1633err_out:
1634	kfree_skb(skb);
1635	goto out;
1636}
1637
1638static int grec_size(struct ifmcaddr6 *pmc, int type, int gdel, int sdel)
1639{
1640	return sizeof(struct mld2_grec) + 16 * mld_scount(pmc,type,gdel,sdel);
1641}
1642
1643static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
1644	int type, struct mld2_grec **ppgr)
1645{
1646	struct net_device *dev = pmc->idev->dev;
1647	struct mld2_report *pmr;
1648	struct mld2_grec *pgr;
1649
1650	if (!skb)
1651		skb = mld_newpack(pmc->idev, dev->mtu);
1652	if (!skb)
1653		return NULL;
1654	pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec));
 
1655	pgr->grec_type = type;
1656	pgr->grec_auxwords = 0;
1657	pgr->grec_nsrcs = 0;
1658	pgr->grec_mca = pmc->mca_addr;	/* structure copy */
1659	pmr = (struct mld2_report *)skb_transport_header(skb);
1660	pmr->mld2r_ngrec = htons(ntohs(pmr->mld2r_ngrec)+1);
1661	*ppgr = pgr;
1662	return skb;
1663}
1664
1665#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? (skb)->dev->mtu - (skb)->len : \
1666	skb_tailroom(skb)) : 0)
1667
1668static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
1669	int type, int gdeleted, int sdeleted, int crsend)
1670{
1671	struct inet6_dev *idev = pmc->idev;
1672	struct net_device *dev = idev->dev;
1673	struct mld2_report *pmr;
1674	struct mld2_grec *pgr = NULL;
1675	struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
1676	int scount, stotal, first, isquery, truncate;
 
1677
1678	if (pmc->mca_flags & MAF_NOREPORT)
1679		return skb;
1680
 
 
 
 
1681	isquery = type == MLD2_MODE_IS_INCLUDE ||
1682		  type == MLD2_MODE_IS_EXCLUDE;
1683	truncate = type == MLD2_MODE_IS_EXCLUDE ||
1684		    type == MLD2_CHANGE_TO_EXCLUDE;
1685
1686	stotal = scount = 0;
1687
1688	psf_list = sdeleted ? &pmc->mca_tomb : &pmc->mca_sources;
1689
1690	if (!*psf_list)
1691		goto empty_source;
1692
1693	pmr = skb ? (struct mld2_report *)skb_transport_header(skb) : NULL;
1694
1695	/* EX and TO_EX get a fresh packet, if needed */
1696	if (truncate) {
1697		if (pmr && pmr->mld2r_ngrec &&
1698		    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
1699			if (skb)
1700				mld_sendpack(skb);
1701			skb = mld_newpack(idev, dev->mtu);
1702		}
1703	}
1704	first = 1;
1705	psf_prev = NULL;
1706	for (psf=*psf_list; psf; psf=psf_next) {
1707		struct in6_addr *psrc;
1708
1709		psf_next = psf->sf_next;
1710
1711		if (!is_in(pmc, psf, type, gdeleted, sdeleted)) {
1712			psf_prev = psf;
1713			continue;
1714		}
1715
 
 
 
 
 
 
 
 
 
1716		/* clear marks on query responses */
1717		if (isquery)
1718			psf->sf_gsresp = 0;
1719
1720		if (AVAILABLE(skb) < sizeof(*psrc) +
1721		    first*sizeof(struct mld2_grec)) {
1722			if (truncate && !first)
1723				break;	 /* truncate these */
1724			if (pgr)
1725				pgr->grec_nsrcs = htons(scount);
1726			if (skb)
1727				mld_sendpack(skb);
1728			skb = mld_newpack(idev, dev->mtu);
1729			first = 1;
1730			scount = 0;
1731		}
1732		if (first) {
1733			skb = add_grhead(skb, pmc, type, &pgr);
1734			first = 0;
1735		}
1736		if (!skb)
1737			return NULL;
1738		psrc = (struct in6_addr *)skb_put(skb, sizeof(*psrc));
1739		*psrc = psf->sf_addr;
1740		scount++; stotal++;
1741		if ((type == MLD2_ALLOW_NEW_SOURCES ||
1742		     type == MLD2_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
 
1743			psf->sf_crcount--;
1744			if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
1745				if (psf_prev)
1746					psf_prev->sf_next = psf->sf_next;
1747				else
1748					*psf_list = psf->sf_next;
1749				kfree(psf);
1750				continue;
1751			}
1752		}
1753		psf_prev = psf;
1754	}
1755
1756empty_source:
1757	if (!stotal) {
1758		if (type == MLD2_ALLOW_NEW_SOURCES ||
1759		    type == MLD2_BLOCK_OLD_SOURCES)
1760			return skb;
1761		if (pmc->mca_crcount || isquery || crsend) {
1762			/* make sure we have room for group header */
1763			if (skb && AVAILABLE(skb) < sizeof(struct mld2_grec)) {
1764				mld_sendpack(skb);
1765				skb = NULL; /* add_grhead will get a new one */
1766			}
1767			skb = add_grhead(skb, pmc, type, &pgr);
1768		}
1769	}
1770	if (pgr)
1771		pgr->grec_nsrcs = htons(scount);
1772
1773	if (isquery)
1774		pmc->mca_flags &= ~MAF_GSQUERY;	/* clear query state */
1775	return skb;
1776}
1777
1778static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
1779{
1780	struct sk_buff *skb = NULL;
1781	int type;
1782
1783	read_lock_bh(&idev->lock);
1784	if (!pmc) {
1785		for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
1786			if (pmc->mca_flags & MAF_NOREPORT)
1787				continue;
1788			spin_lock_bh(&pmc->mca_lock);
1789			if (pmc->mca_sfcount[MCAST_EXCLUDE])
1790				type = MLD2_MODE_IS_EXCLUDE;
1791			else
1792				type = MLD2_MODE_IS_INCLUDE;
1793			skb = add_grec(skb, pmc, type, 0, 0, 0);
1794			spin_unlock_bh(&pmc->mca_lock);
1795		}
1796	} else {
1797		spin_lock_bh(&pmc->mca_lock);
1798		if (pmc->mca_sfcount[MCAST_EXCLUDE])
1799			type = MLD2_MODE_IS_EXCLUDE;
1800		else
1801			type = MLD2_MODE_IS_INCLUDE;
1802		skb = add_grec(skb, pmc, type, 0, 0, 0);
1803		spin_unlock_bh(&pmc->mca_lock);
1804	}
1805	read_unlock_bh(&idev->lock);
1806	if (skb)
1807		mld_sendpack(skb);
1808}
1809
1810/*
1811 * remove zero-count source records from a source filter list
1812 */
1813static void mld_clear_zeros(struct ip6_sf_list **ppsf)
1814{
1815	struct ip6_sf_list *psf_prev, *psf_next, *psf;
1816
1817	psf_prev = NULL;
1818	for (psf=*ppsf; psf; psf = psf_next) {
1819		psf_next = psf->sf_next;
1820		if (psf->sf_crcount == 0) {
1821			if (psf_prev)
1822				psf_prev->sf_next = psf->sf_next;
1823			else
1824				*ppsf = psf->sf_next;
1825			kfree(psf);
1826		} else
1827			psf_prev = psf;
1828	}
1829}
1830
1831static void mld_send_cr(struct inet6_dev *idev)
1832{
1833	struct ifmcaddr6 *pmc, *pmc_prev, *pmc_next;
1834	struct sk_buff *skb = NULL;
1835	int type, dtype;
1836
1837	read_lock_bh(&idev->lock);
1838	spin_lock(&idev->mc_lock);
1839
1840	/* deleted MCA's */
1841	pmc_prev = NULL;
1842	for (pmc=idev->mc_tomb; pmc; pmc=pmc_next) {
1843		pmc_next = pmc->next;
1844		if (pmc->mca_sfmode == MCAST_INCLUDE) {
1845			type = MLD2_BLOCK_OLD_SOURCES;
1846			dtype = MLD2_BLOCK_OLD_SOURCES;
1847			skb = add_grec(skb, pmc, type, 1, 0, 0);
1848			skb = add_grec(skb, pmc, dtype, 1, 1, 0);
1849		}
1850		if (pmc->mca_crcount) {
1851			if (pmc->mca_sfmode == MCAST_EXCLUDE) {
1852				type = MLD2_CHANGE_TO_INCLUDE;
1853				skb = add_grec(skb, pmc, type, 1, 0, 0);
1854			}
1855			pmc->mca_crcount--;
1856			if (pmc->mca_crcount == 0) {
1857				mld_clear_zeros(&pmc->mca_tomb);
1858				mld_clear_zeros(&pmc->mca_sources);
1859			}
1860		}
1861		if (pmc->mca_crcount == 0 && !pmc->mca_tomb &&
1862		    !pmc->mca_sources) {
1863			if (pmc_prev)
1864				pmc_prev->next = pmc_next;
1865			else
1866				idev->mc_tomb = pmc_next;
1867			in6_dev_put(pmc->idev);
1868			kfree(pmc);
1869		} else
1870			pmc_prev = pmc;
1871	}
1872	spin_unlock(&idev->mc_lock);
1873
1874	/* change recs */
1875	for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
1876		spin_lock_bh(&pmc->mca_lock);
1877		if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
1878			type = MLD2_BLOCK_OLD_SOURCES;
1879			dtype = MLD2_ALLOW_NEW_SOURCES;
1880		} else {
1881			type = MLD2_ALLOW_NEW_SOURCES;
1882			dtype = MLD2_BLOCK_OLD_SOURCES;
1883		}
1884		skb = add_grec(skb, pmc, type, 0, 0, 0);
1885		skb = add_grec(skb, pmc, dtype, 0, 1, 0);	/* deleted sources */
1886
1887		/* filter mode changes */
1888		if (pmc->mca_crcount) {
1889			if (pmc->mca_sfmode == MCAST_EXCLUDE)
1890				type = MLD2_CHANGE_TO_EXCLUDE;
1891			else
1892				type = MLD2_CHANGE_TO_INCLUDE;
1893			skb = add_grec(skb, pmc, type, 0, 0, 0);
1894			pmc->mca_crcount--;
1895		}
1896		spin_unlock_bh(&pmc->mca_lock);
1897	}
1898	read_unlock_bh(&idev->lock);
1899	if (!skb)
1900		return;
1901	(void) mld_sendpack(skb);
1902}
1903
1904static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
1905{
1906	struct net *net = dev_net(dev);
1907	struct sock *sk = net->ipv6.igmp_sk;
1908	struct inet6_dev *idev;
1909	struct sk_buff *skb;
1910	struct mld_msg *hdr;
1911	const struct in6_addr *snd_addr, *saddr;
1912	struct in6_addr addr_buf;
1913	int hlen = LL_RESERVED_SPACE(dev);
1914	int tlen = dev->needed_tailroom;
1915	int err, len, payload_len, full_len;
1916	u8 ra[8] = { IPPROTO_ICMPV6, 0,
1917		     IPV6_TLV_ROUTERALERT, 2, 0, 0,
1918		     IPV6_TLV_PADN, 0 };
1919	struct flowi6 fl6;
1920	struct dst_entry *dst;
1921
1922	if (type == ICMPV6_MGM_REDUCTION)
1923		snd_addr = &in6addr_linklocal_allrouters;
1924	else
1925		snd_addr = addr;
1926
1927	len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
1928	payload_len = len + sizeof(ra);
1929	full_len = sizeof(struct ipv6hdr) + payload_len;
1930
1931	rcu_read_lock();
1932	IP6_UPD_PO_STATS(net, __in6_dev_get(dev),
1933		      IPSTATS_MIB_OUT, full_len);
1934	rcu_read_unlock();
1935
1936	skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err);
1937
1938	if (skb == NULL) {
1939		rcu_read_lock();
1940		IP6_INC_STATS(net, __in6_dev_get(dev),
1941			      IPSTATS_MIB_OUTDISCARDS);
1942		rcu_read_unlock();
1943		return;
1944	}
1945	skb->priority = TC_PRIO_CONTROL;
1946	skb_reserve(skb, hlen);
1947
1948	if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
1949		/* <draft-ietf-magma-mld-source-05.txt>:
1950		 * use unspecified address as the source address
1951		 * when a valid link-local address is not available.
1952		 */
1953		saddr = &in6addr_any;
1954	} else
1955		saddr = &addr_buf;
1956
1957	ip6_mc_hdr(sk, skb, dev, saddr, snd_addr, NEXTHDR_HOP, payload_len);
1958
1959	memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
1960
1961	hdr = (struct mld_msg *) skb_put(skb, sizeof(struct mld_msg));
1962	memset(hdr, 0, sizeof(struct mld_msg));
1963	hdr->mld_type = type;
1964	hdr->mld_mca = *addr;
1965
1966	hdr->mld_cksum = csum_ipv6_magic(saddr, snd_addr, len,
1967					 IPPROTO_ICMPV6,
1968					 csum_partial(hdr, len, 0));
1969
1970	rcu_read_lock();
1971	idev = __in6_dev_get(skb->dev);
1972
1973	icmpv6_flow_init(sk, &fl6, type,
1974			 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
1975			 skb->dev->ifindex);
1976	dst = icmp6_dst_alloc(skb->dev, &fl6);
1977	if (IS_ERR(dst)) {
1978		err = PTR_ERR(dst);
1979		goto err_out;
1980	}
1981
1982	skb_dst_set(skb, dst);
1983	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
 
1984		      dst_output);
1985out:
1986	if (!err) {
1987		ICMP6MSGOUT_INC_STATS(net, idev, type);
1988		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1989		IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, full_len);
1990	} else
1991		IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
1992
1993	rcu_read_unlock();
1994	return;
1995
1996err_out:
1997	kfree_skb(skb);
1998	goto out;
1999}
2000
2001static void mld_send_initial_cr(struct inet6_dev *idev)
2002{
2003	struct sk_buff *skb;
2004	struct ifmcaddr6 *pmc;
2005	int type;
2006
2007	if (mld_in_v1_mode(idev))
2008		return;
2009
2010	skb = NULL;
2011	read_lock_bh(&idev->lock);
2012	for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
2013		spin_lock_bh(&pmc->mca_lock);
2014		if (pmc->mca_sfcount[MCAST_EXCLUDE])
2015			type = MLD2_CHANGE_TO_EXCLUDE;
2016		else
2017			type = MLD2_CHANGE_TO_INCLUDE;
2018		skb = add_grec(skb, pmc, type, 0, 0, 1);
2019		spin_unlock_bh(&pmc->mca_lock);
2020	}
2021	read_unlock_bh(&idev->lock);
2022	if (skb)
2023		mld_sendpack(skb);
2024}
2025
2026void ipv6_mc_dad_complete(struct inet6_dev *idev)
2027{
2028	idev->mc_dad_count = idev->mc_qrv;
2029	if (idev->mc_dad_count) {
2030		mld_send_initial_cr(idev);
2031		idev->mc_dad_count--;
2032		if (idev->mc_dad_count)
2033			mld_dad_start_timer(idev, idev->mc_maxdelay);
2034	}
2035}
2036
2037static void mld_dad_timer_expire(unsigned long data)
2038{
2039	struct inet6_dev *idev = (struct inet6_dev *)data;
2040
2041	mld_send_initial_cr(idev);
2042	if (idev->mc_dad_count) {
2043		idev->mc_dad_count--;
2044		if (idev->mc_dad_count)
2045			mld_dad_start_timer(idev, idev->mc_maxdelay);
2046	}
2047	in6_dev_put(idev);
2048}
2049
2050static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
2051	const struct in6_addr *psfsrc)
2052{
2053	struct ip6_sf_list *psf, *psf_prev;
2054	int rv = 0;
2055
2056	psf_prev = NULL;
2057	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
2058		if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
2059			break;
2060		psf_prev = psf;
2061	}
2062	if (!psf || psf->sf_count[sfmode] == 0) {
2063		/* source filter not found, or count wrong =>  bug */
2064		return -ESRCH;
2065	}
2066	psf->sf_count[sfmode]--;
2067	if (!psf->sf_count[MCAST_INCLUDE] && !psf->sf_count[MCAST_EXCLUDE]) {
2068		struct inet6_dev *idev = pmc->idev;
2069
2070		/* no more filters for this source */
2071		if (psf_prev)
2072			psf_prev->sf_next = psf->sf_next;
2073		else
2074			pmc->mca_sources = psf->sf_next;
2075		if (psf->sf_oldin && !(pmc->mca_flags & MAF_NOREPORT) &&
2076		    !mld_in_v1_mode(idev)) {
2077			psf->sf_crcount = idev->mc_qrv;
2078			psf->sf_next = pmc->mca_tomb;
2079			pmc->mca_tomb = psf;
2080			rv = 1;
2081		} else
2082			kfree(psf);
2083	}
2084	return rv;
2085}
2086
2087static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
2088			  int sfmode, int sfcount, const struct in6_addr *psfsrc,
2089			  int delta)
2090{
2091	struct ifmcaddr6 *pmc;
2092	int	changerec = 0;
2093	int	i, err;
2094
2095	if (!idev)
2096		return -ENODEV;
2097	read_lock_bh(&idev->lock);
2098	for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
2099		if (ipv6_addr_equal(pmca, &pmc->mca_addr))
2100			break;
2101	}
2102	if (!pmc) {
2103		/* MCA not found?? bug */
2104		read_unlock_bh(&idev->lock);
2105		return -ESRCH;
2106	}
2107	spin_lock_bh(&pmc->mca_lock);
2108	sf_markstate(pmc);
2109	if (!delta) {
2110		if (!pmc->mca_sfcount[sfmode]) {
2111			spin_unlock_bh(&pmc->mca_lock);
2112			read_unlock_bh(&idev->lock);
2113			return -EINVAL;
2114		}
2115		pmc->mca_sfcount[sfmode]--;
2116	}
2117	err = 0;
2118	for (i=0; i<sfcount; i++) {
2119		int rv = ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
2120
2121		changerec |= rv > 0;
2122		if (!err && rv < 0)
2123			err = rv;
2124	}
2125	if (pmc->mca_sfmode == MCAST_EXCLUDE &&
2126	    pmc->mca_sfcount[MCAST_EXCLUDE] == 0 &&
2127	    pmc->mca_sfcount[MCAST_INCLUDE]) {
2128		struct ip6_sf_list *psf;
2129
2130		/* filter mode change */
2131		pmc->mca_sfmode = MCAST_INCLUDE;
2132		pmc->mca_crcount = idev->mc_qrv;
2133		idev->mc_ifc_count = pmc->mca_crcount;
2134		for (psf=pmc->mca_sources; psf; psf = psf->sf_next)
2135			psf->sf_crcount = 0;
2136		mld_ifc_event(pmc->idev);
2137	} else if (sf_setstate(pmc) || changerec)
2138		mld_ifc_event(pmc->idev);
2139	spin_unlock_bh(&pmc->mca_lock);
2140	read_unlock_bh(&idev->lock);
2141	return err;
2142}
2143
2144/*
2145 * Add multicast single-source filter to the interface list
2146 */
2147static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
2148	const struct in6_addr *psfsrc)
2149{
2150	struct ip6_sf_list *psf, *psf_prev;
2151
2152	psf_prev = NULL;
2153	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
2154		if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
2155			break;
2156		psf_prev = psf;
2157	}
2158	if (!psf) {
2159		psf = kzalloc(sizeof(*psf), GFP_ATOMIC);
2160		if (!psf)
2161			return -ENOBUFS;
2162
2163		psf->sf_addr = *psfsrc;
2164		if (psf_prev) {
2165			psf_prev->sf_next = psf;
2166		} else
2167			pmc->mca_sources = psf;
2168	}
2169	psf->sf_count[sfmode]++;
2170	return 0;
2171}
2172
2173static void sf_markstate(struct ifmcaddr6 *pmc)
2174{
2175	struct ip6_sf_list *psf;
2176	int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
2177
2178	for (psf=pmc->mca_sources; psf; psf=psf->sf_next)
2179		if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
2180			psf->sf_oldin = mca_xcount ==
2181				psf->sf_count[MCAST_EXCLUDE] &&
2182				!psf->sf_count[MCAST_INCLUDE];
2183		} else
2184			psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
2185}
2186
2187static int sf_setstate(struct ifmcaddr6 *pmc)
2188{
2189	struct ip6_sf_list *psf, *dpsf;
2190	int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
2191	int qrv = pmc->idev->mc_qrv;
2192	int new_in, rv;
2193
2194	rv = 0;
2195	for (psf=pmc->mca_sources; psf; psf=psf->sf_next) {
2196		if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
2197			new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
2198				!psf->sf_count[MCAST_INCLUDE];
2199		} else
2200			new_in = psf->sf_count[MCAST_INCLUDE] != 0;
2201		if (new_in) {
2202			if (!psf->sf_oldin) {
2203				struct ip6_sf_list *prev = NULL;
2204
2205				for (dpsf=pmc->mca_tomb; dpsf;
2206				     dpsf=dpsf->sf_next) {
2207					if (ipv6_addr_equal(&dpsf->sf_addr,
2208					    &psf->sf_addr))
2209						break;
2210					prev = dpsf;
2211				}
2212				if (dpsf) {
2213					if (prev)
2214						prev->sf_next = dpsf->sf_next;
2215					else
2216						pmc->mca_tomb = dpsf->sf_next;
2217					kfree(dpsf);
2218				}
2219				psf->sf_crcount = qrv;
2220				rv++;
2221			}
2222		} else if (psf->sf_oldin) {
2223			psf->sf_crcount = 0;
2224			/*
2225			 * add or update "delete" records if an active filter
2226			 * is now inactive
2227			 */
2228			for (dpsf=pmc->mca_tomb; dpsf; dpsf=dpsf->sf_next)
2229				if (ipv6_addr_equal(&dpsf->sf_addr,
2230				    &psf->sf_addr))
2231					break;
2232			if (!dpsf) {
2233				dpsf = kmalloc(sizeof(*dpsf), GFP_ATOMIC);
2234				if (!dpsf)
2235					continue;
2236				*dpsf = *psf;
2237				/* pmc->mca_lock held by callers */
2238				dpsf->sf_next = pmc->mca_tomb;
2239				pmc->mca_tomb = dpsf;
2240			}
2241			dpsf->sf_crcount = qrv;
2242			rv++;
2243		}
2244	}
2245	return rv;
2246}
2247
2248/*
2249 * Add multicast source filter list to the interface list
2250 */
2251static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
2252			  int sfmode, int sfcount, const struct in6_addr *psfsrc,
2253			  int delta)
2254{
2255	struct ifmcaddr6 *pmc;
2256	int	isexclude;
2257	int	i, err;
2258
2259	if (!idev)
2260		return -ENODEV;
2261	read_lock_bh(&idev->lock);
2262	for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
2263		if (ipv6_addr_equal(pmca, &pmc->mca_addr))
2264			break;
2265	}
2266	if (!pmc) {
2267		/* MCA not found?? bug */
2268		read_unlock_bh(&idev->lock);
2269		return -ESRCH;
2270	}
2271	spin_lock_bh(&pmc->mca_lock);
2272
2273	sf_markstate(pmc);
2274	isexclude = pmc->mca_sfmode == MCAST_EXCLUDE;
2275	if (!delta)
2276		pmc->mca_sfcount[sfmode]++;
2277	err = 0;
2278	for (i=0; i<sfcount; i++) {
2279		err = ip6_mc_add1_src(pmc, sfmode, &psfsrc[i]);
2280		if (err)
2281			break;
2282	}
2283	if (err) {
2284		int j;
2285
2286		if (!delta)
2287			pmc->mca_sfcount[sfmode]--;
2288		for (j=0; j<i; j++)
2289			ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
2290	} else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
2291		struct ip6_sf_list *psf;
2292
2293		/* filter mode change */
2294		if (pmc->mca_sfcount[MCAST_EXCLUDE])
2295			pmc->mca_sfmode = MCAST_EXCLUDE;
2296		else if (pmc->mca_sfcount[MCAST_INCLUDE])
2297			pmc->mca_sfmode = MCAST_INCLUDE;
2298		/* else no filters; keep old mode for reports */
2299
2300		pmc->mca_crcount = idev->mc_qrv;
2301		idev->mc_ifc_count = pmc->mca_crcount;
2302		for (psf=pmc->mca_sources; psf; psf = psf->sf_next)
2303			psf->sf_crcount = 0;
2304		mld_ifc_event(idev);
2305	} else if (sf_setstate(pmc))
2306		mld_ifc_event(idev);
2307	spin_unlock_bh(&pmc->mca_lock);
2308	read_unlock_bh(&idev->lock);
2309	return err;
2310}
2311
2312static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
2313{
2314	struct ip6_sf_list *psf, *nextpsf;
2315
2316	for (psf=pmc->mca_tomb; psf; psf=nextpsf) {
2317		nextpsf = psf->sf_next;
2318		kfree(psf);
2319	}
2320	pmc->mca_tomb = NULL;
2321	for (psf=pmc->mca_sources; psf; psf=nextpsf) {
2322		nextpsf = psf->sf_next;
2323		kfree(psf);
2324	}
2325	pmc->mca_sources = NULL;
2326	pmc->mca_sfmode = MCAST_EXCLUDE;
2327	pmc->mca_sfcount[MCAST_INCLUDE] = 0;
2328	pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
2329}
2330
2331
2332static void igmp6_join_group(struct ifmcaddr6 *ma)
2333{
2334	unsigned long delay;
2335
2336	if (ma->mca_flags & MAF_NOREPORT)
2337		return;
2338
2339	igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
2340
2341	delay = prandom_u32() % unsolicited_report_interval(ma->idev);
2342
2343	spin_lock_bh(&ma->mca_lock);
2344	if (del_timer(&ma->mca_timer)) {
2345		atomic_dec(&ma->mca_refcnt);
2346		delay = ma->mca_timer.expires - jiffies;
2347	}
2348
2349	if (!mod_timer(&ma->mca_timer, jiffies + delay))
2350		atomic_inc(&ma->mca_refcnt);
2351	ma->mca_flags |= MAF_TIMER_RUNNING | MAF_LAST_REPORTER;
2352	spin_unlock_bh(&ma->mca_lock);
2353}
2354
2355static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
2356			    struct inet6_dev *idev)
2357{
2358	int err;
2359
2360	/* callers have the socket lock and a write lock on ipv6_sk_mc_lock,
2361	 * so no other readers or writers of iml or its sflist
2362	 */
2363	if (!iml->sflist) {
2364		/* any-source empty exclude case */
2365		return ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
2366	}
2367	err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,
2368		iml->sflist->sl_count, iml->sflist->sl_addr, 0);
2369	sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max));
2370	iml->sflist = NULL;
2371	return err;
2372}
2373
2374static void igmp6_leave_group(struct ifmcaddr6 *ma)
2375{
2376	if (mld_in_v1_mode(ma->idev)) {
2377		if (ma->mca_flags & MAF_LAST_REPORTER)
2378			igmp6_send(&ma->mca_addr, ma->idev->dev,
2379				ICMPV6_MGM_REDUCTION);
2380	} else {
2381		mld_add_delrec(ma->idev, ma);
2382		mld_ifc_event(ma->idev);
2383	}
2384}
2385
2386static void mld_gq_timer_expire(unsigned long data)
2387{
2388	struct inet6_dev *idev = (struct inet6_dev *)data;
2389
2390	idev->mc_gq_running = 0;
2391	mld_send_report(idev, NULL);
2392	in6_dev_put(idev);
2393}
2394
2395static void mld_ifc_timer_expire(unsigned long data)
2396{
2397	struct inet6_dev *idev = (struct inet6_dev *)data;
2398
2399	mld_send_cr(idev);
2400	if (idev->mc_ifc_count) {
2401		idev->mc_ifc_count--;
2402		if (idev->mc_ifc_count)
2403			mld_ifc_start_timer(idev, idev->mc_maxdelay);
2404	}
2405	in6_dev_put(idev);
2406}
2407
2408static void mld_ifc_event(struct inet6_dev *idev)
2409{
2410	if (mld_in_v1_mode(idev))
2411		return;
2412	idev->mc_ifc_count = idev->mc_qrv;
2413	mld_ifc_start_timer(idev, 1);
2414}
2415
2416
2417static void igmp6_timer_handler(unsigned long data)
2418{
2419	struct ifmcaddr6 *ma = (struct ifmcaddr6 *) data;
2420
2421	if (mld_in_v1_mode(ma->idev))
2422		igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
2423	else
2424		mld_send_report(ma->idev, ma);
2425
2426	spin_lock(&ma->mca_lock);
2427	ma->mca_flags |=  MAF_LAST_REPORTER;
2428	ma->mca_flags &= ~MAF_TIMER_RUNNING;
2429	spin_unlock(&ma->mca_lock);
2430	ma_put(ma);
2431}
2432
2433/* Device changing type */
2434
2435void ipv6_mc_unmap(struct inet6_dev *idev)
2436{
2437	struct ifmcaddr6 *i;
2438
2439	/* Install multicast list, except for all-nodes (already installed) */
2440
2441	read_lock_bh(&idev->lock);
2442	for (i = idev->mc_list; i; i = i->next)
2443		igmp6_group_dropped(i);
2444	read_unlock_bh(&idev->lock);
2445}
2446
2447void ipv6_mc_remap(struct inet6_dev *idev)
2448{
2449	ipv6_mc_up(idev);
2450}
2451
2452/* Device going down */
2453
2454void ipv6_mc_down(struct inet6_dev *idev)
2455{
2456	struct ifmcaddr6 *i;
2457
2458	/* Withdraw multicast list */
2459
2460	read_lock_bh(&idev->lock);
 
 
 
 
 
 
 
2461	mld_ifc_stop_timer(idev);
2462	mld_gq_stop_timer(idev);
2463	mld_dad_stop_timer(idev);
2464
2465	for (i = idev->mc_list; i; i=i->next)
2466		igmp6_group_dropped(i);
2467	read_unlock_bh(&idev->lock);
2468
2469	mld_clear_delrec(idev);
2470}
2471
 
 
 
 
 
 
 
 
2472
2473/* Device going up */
2474
2475void ipv6_mc_up(struct inet6_dev *idev)
2476{
2477	struct ifmcaddr6 *i;
2478
2479	/* Install multicast list, except for all-nodes (already installed) */
2480
2481	read_lock_bh(&idev->lock);
2482	for (i = idev->mc_list; i; i=i->next)
 
 
2483		igmp6_group_added(i);
 
2484	read_unlock_bh(&idev->lock);
2485}
2486
2487/* IPv6 device initialization. */
2488
2489void ipv6_mc_init_dev(struct inet6_dev *idev)
2490{
2491	write_lock_bh(&idev->lock);
2492	spin_lock_init(&idev->mc_lock);
2493	idev->mc_gq_running = 0;
2494	setup_timer(&idev->mc_gq_timer, mld_gq_timer_expire,
2495			(unsigned long)idev);
2496	idev->mc_tomb = NULL;
2497	idev->mc_ifc_count = 0;
2498	setup_timer(&idev->mc_ifc_timer, mld_ifc_timer_expire,
2499			(unsigned long)idev);
2500	setup_timer(&idev->mc_dad_timer, mld_dad_timer_expire,
2501		    (unsigned long)idev);
2502
2503	idev->mc_qrv = MLD_QRV_DEFAULT;
2504	idev->mc_qi = MLD_QI_DEFAULT;
2505	idev->mc_qri = MLD_QRI_DEFAULT;
2506
2507	idev->mc_maxdelay = unsolicited_report_interval(idev);
2508	idev->mc_v1_seen = 0;
2509	write_unlock_bh(&idev->lock);
2510}
2511
2512/*
2513 *	Device is about to be destroyed: clean up.
2514 */
2515
2516void ipv6_mc_destroy_dev(struct inet6_dev *idev)
2517{
2518	struct ifmcaddr6 *i;
2519
2520	/* Deactivate timers */
2521	ipv6_mc_down(idev);
 
2522
2523	/* Delete all-nodes address. */
2524	/* We cannot call ipv6_dev_mc_dec() directly, our caller in
2525	 * addrconf.c has NULL'd out dev->ip6_ptr so in6_dev_get() will
2526	 * fail.
2527	 */
2528	__ipv6_dev_mc_dec(idev, &in6addr_linklocal_allnodes);
2529
2530	if (idev->cnf.forwarding)
2531		__ipv6_dev_mc_dec(idev, &in6addr_linklocal_allrouters);
2532
2533	write_lock_bh(&idev->lock);
2534	while ((i = idev->mc_list) != NULL) {
2535		idev->mc_list = i->next;
2536		write_unlock_bh(&idev->lock);
2537
2538		igmp6_group_dropped(i);
2539		ma_put(i);
2540
2541		write_lock_bh(&idev->lock);
2542	}
2543	write_unlock_bh(&idev->lock);
2544}
2545
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2546#ifdef CONFIG_PROC_FS
2547struct igmp6_mc_iter_state {
2548	struct seq_net_private p;
2549	struct net_device *dev;
2550	struct inet6_dev *idev;
2551};
2552
2553#define igmp6_mc_seq_private(seq)	((struct igmp6_mc_iter_state *)(seq)->private)
2554
2555static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
2556{
2557	struct ifmcaddr6 *im = NULL;
2558	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2559	struct net *net = seq_file_net(seq);
2560
2561	state->idev = NULL;
2562	for_each_netdev_rcu(net, state->dev) {
2563		struct inet6_dev *idev;
2564		idev = __in6_dev_get(state->dev);
2565		if (!idev)
2566			continue;
2567		read_lock_bh(&idev->lock);
2568		im = idev->mc_list;
2569		if (im) {
2570			state->idev = idev;
2571			break;
2572		}
2573		read_unlock_bh(&idev->lock);
2574	}
2575	return im;
2576}
2577
2578static struct ifmcaddr6 *igmp6_mc_get_next(struct seq_file *seq, struct ifmcaddr6 *im)
2579{
2580	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2581
2582	im = im->next;
2583	while (!im) {
2584		if (likely(state->idev != NULL))
2585			read_unlock_bh(&state->idev->lock);
2586
2587		state->dev = next_net_device_rcu(state->dev);
2588		if (!state->dev) {
2589			state->idev = NULL;
2590			break;
2591		}
2592		state->idev = __in6_dev_get(state->dev);
2593		if (!state->idev)
2594			continue;
2595		read_lock_bh(&state->idev->lock);
2596		im = state->idev->mc_list;
2597	}
2598	return im;
2599}
2600
2601static struct ifmcaddr6 *igmp6_mc_get_idx(struct seq_file *seq, loff_t pos)
2602{
2603	struct ifmcaddr6 *im = igmp6_mc_get_first(seq);
2604	if (im)
2605		while (pos && (im = igmp6_mc_get_next(seq, im)) != NULL)
2606			--pos;
2607	return pos ? NULL : im;
2608}
2609
2610static void *igmp6_mc_seq_start(struct seq_file *seq, loff_t *pos)
2611	__acquires(RCU)
2612{
2613	rcu_read_lock();
2614	return igmp6_mc_get_idx(seq, *pos);
2615}
2616
2617static void *igmp6_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2618{
2619	struct ifmcaddr6 *im = igmp6_mc_get_next(seq, v);
2620
2621	++*pos;
2622	return im;
2623}
2624
2625static void igmp6_mc_seq_stop(struct seq_file *seq, void *v)
2626	__releases(RCU)
2627{
2628	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2629
2630	if (likely(state->idev != NULL)) {
2631		read_unlock_bh(&state->idev->lock);
2632		state->idev = NULL;
2633	}
2634	state->dev = NULL;
2635	rcu_read_unlock();
2636}
2637
2638static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
2639{
2640	struct ifmcaddr6 *im = (struct ifmcaddr6 *)v;
2641	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2642
2643	seq_printf(seq,
2644		   "%-4d %-15s %pi6 %5d %08X %ld\n",
2645		   state->dev->ifindex, state->dev->name,
2646		   &im->mca_addr,
2647		   im->mca_users, im->mca_flags,
2648		   (im->mca_flags&MAF_TIMER_RUNNING) ?
2649		   jiffies_to_clock_t(im->mca_timer.expires-jiffies) : 0);
2650	return 0;
2651}
2652
2653static const struct seq_operations igmp6_mc_seq_ops = {
2654	.start	=	igmp6_mc_seq_start,
2655	.next	=	igmp6_mc_seq_next,
2656	.stop	=	igmp6_mc_seq_stop,
2657	.show	=	igmp6_mc_seq_show,
2658};
2659
2660static int igmp6_mc_seq_open(struct inode *inode, struct file *file)
2661{
2662	return seq_open_net(inode, file, &igmp6_mc_seq_ops,
2663			    sizeof(struct igmp6_mc_iter_state));
2664}
2665
2666static const struct file_operations igmp6_mc_seq_fops = {
2667	.owner		=	THIS_MODULE,
2668	.open		=	igmp6_mc_seq_open,
2669	.read		=	seq_read,
2670	.llseek		=	seq_lseek,
2671	.release	=	seq_release_net,
2672};
2673
2674struct igmp6_mcf_iter_state {
2675	struct seq_net_private p;
2676	struct net_device *dev;
2677	struct inet6_dev *idev;
2678	struct ifmcaddr6 *im;
2679};
2680
2681#define igmp6_mcf_seq_private(seq)	((struct igmp6_mcf_iter_state *)(seq)->private)
2682
2683static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
2684{
2685	struct ip6_sf_list *psf = NULL;
2686	struct ifmcaddr6 *im = NULL;
2687	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2688	struct net *net = seq_file_net(seq);
2689
2690	state->idev = NULL;
2691	state->im = NULL;
2692	for_each_netdev_rcu(net, state->dev) {
2693		struct inet6_dev *idev;
2694		idev = __in6_dev_get(state->dev);
2695		if (unlikely(idev == NULL))
2696			continue;
2697		read_lock_bh(&idev->lock);
2698		im = idev->mc_list;
2699		if (likely(im != NULL)) {
2700			spin_lock_bh(&im->mca_lock);
2701			psf = im->mca_sources;
2702			if (likely(psf != NULL)) {
2703				state->im = im;
2704				state->idev = idev;
2705				break;
2706			}
2707			spin_unlock_bh(&im->mca_lock);
2708		}
2709		read_unlock_bh(&idev->lock);
2710	}
2711	return psf;
2712}
2713
2714static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_sf_list *psf)
2715{
2716	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2717
2718	psf = psf->sf_next;
2719	while (!psf) {
2720		spin_unlock_bh(&state->im->mca_lock);
2721		state->im = state->im->next;
2722		while (!state->im) {
2723			if (likely(state->idev != NULL))
2724				read_unlock_bh(&state->idev->lock);
2725
2726			state->dev = next_net_device_rcu(state->dev);
2727			if (!state->dev) {
2728				state->idev = NULL;
2729				goto out;
2730			}
2731			state->idev = __in6_dev_get(state->dev);
2732			if (!state->idev)
2733				continue;
2734			read_lock_bh(&state->idev->lock);
2735			state->im = state->idev->mc_list;
2736		}
2737		if (!state->im)
2738			break;
2739		spin_lock_bh(&state->im->mca_lock);
2740		psf = state->im->mca_sources;
2741	}
2742out:
2743	return psf;
2744}
2745
2746static struct ip6_sf_list *igmp6_mcf_get_idx(struct seq_file *seq, loff_t pos)
2747{
2748	struct ip6_sf_list *psf = igmp6_mcf_get_first(seq);
2749	if (psf)
2750		while (pos && (psf = igmp6_mcf_get_next(seq, psf)) != NULL)
2751			--pos;
2752	return pos ? NULL : psf;
2753}
2754
2755static void *igmp6_mcf_seq_start(struct seq_file *seq, loff_t *pos)
2756	__acquires(RCU)
2757{
2758	rcu_read_lock();
2759	return *pos ? igmp6_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
2760}
2761
2762static void *igmp6_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2763{
2764	struct ip6_sf_list *psf;
2765	if (v == SEQ_START_TOKEN)
2766		psf = igmp6_mcf_get_first(seq);
2767	else
2768		psf = igmp6_mcf_get_next(seq, v);
2769	++*pos;
2770	return psf;
2771}
2772
2773static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
2774	__releases(RCU)
2775{
2776	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2777	if (likely(state->im != NULL)) {
2778		spin_unlock_bh(&state->im->mca_lock);
2779		state->im = NULL;
2780	}
2781	if (likely(state->idev != NULL)) {
2782		read_unlock_bh(&state->idev->lock);
2783		state->idev = NULL;
2784	}
2785	state->dev = NULL;
2786	rcu_read_unlock();
2787}
2788
2789static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
2790{
2791	struct ip6_sf_list *psf = (struct ip6_sf_list *)v;
2792	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2793
2794	if (v == SEQ_START_TOKEN) {
2795		seq_printf(seq,
2796			   "%3s %6s "
2797			   "%32s %32s %6s %6s\n", "Idx",
2798			   "Device", "Multicast Address",
2799			   "Source Address", "INC", "EXC");
2800	} else {
2801		seq_printf(seq,
2802			   "%3d %6.6s %pi6 %pi6 %6lu %6lu\n",
2803			   state->dev->ifindex, state->dev->name,
2804			   &state->im->mca_addr,
2805			   &psf->sf_addr,
2806			   psf->sf_count[MCAST_INCLUDE],
2807			   psf->sf_count[MCAST_EXCLUDE]);
2808	}
2809	return 0;
2810}
2811
2812static const struct seq_operations igmp6_mcf_seq_ops = {
2813	.start	=	igmp6_mcf_seq_start,
2814	.next	=	igmp6_mcf_seq_next,
2815	.stop	=	igmp6_mcf_seq_stop,
2816	.show	=	igmp6_mcf_seq_show,
2817};
2818
2819static int igmp6_mcf_seq_open(struct inode *inode, struct file *file)
2820{
2821	return seq_open_net(inode, file, &igmp6_mcf_seq_ops,
2822			    sizeof(struct igmp6_mcf_iter_state));
2823}
2824
2825static const struct file_operations igmp6_mcf_seq_fops = {
2826	.owner		=	THIS_MODULE,
2827	.open		=	igmp6_mcf_seq_open,
2828	.read		=	seq_read,
2829	.llseek		=	seq_lseek,
2830	.release	=	seq_release_net,
2831};
2832
2833static int __net_init igmp6_proc_init(struct net *net)
2834{
2835	int err;
2836
2837	err = -ENOMEM;
2838	if (!proc_create("igmp6", S_IRUGO, net->proc_net, &igmp6_mc_seq_fops))
2839		goto out;
2840	if (!proc_create("mcfilter6", S_IRUGO, net->proc_net,
2841			 &igmp6_mcf_seq_fops))
2842		goto out_proc_net_igmp6;
2843
2844	err = 0;
2845out:
2846	return err;
2847
2848out_proc_net_igmp6:
2849	remove_proc_entry("igmp6", net->proc_net);
2850	goto out;
2851}
2852
2853static void __net_exit igmp6_proc_exit(struct net *net)
2854{
2855	remove_proc_entry("mcfilter6", net->proc_net);
2856	remove_proc_entry("igmp6", net->proc_net);
2857}
2858#else
2859static inline int igmp6_proc_init(struct net *net)
2860{
2861	return 0;
2862}
2863static inline void igmp6_proc_exit(struct net *net)
2864{
2865}
2866#endif
2867
2868static int __net_init igmp6_net_init(struct net *net)
2869{
2870	int err;
2871
2872	err = inet_ctl_sock_create(&net->ipv6.igmp_sk, PF_INET6,
2873				   SOCK_RAW, IPPROTO_ICMPV6, net);
2874	if (err < 0) {
2875		pr_err("Failed to initialize the IGMP6 control socket (err %d)\n",
2876		       err);
2877		goto out;
2878	}
2879
2880	inet6_sk(net->ipv6.igmp_sk)->hop_limit = 1;
2881
 
 
 
 
 
 
 
 
2882	err = igmp6_proc_init(net);
2883	if (err)
2884		goto out_sock_create;
2885out:
2886	return err;
2887
 
 
2888out_sock_create:
2889	inet_ctl_sock_destroy(net->ipv6.igmp_sk);
2890	goto out;
 
2891}
2892
2893static void __net_exit igmp6_net_exit(struct net *net)
2894{
2895	inet_ctl_sock_destroy(net->ipv6.igmp_sk);
 
2896	igmp6_proc_exit(net);
2897}
2898
2899static struct pernet_operations igmp6_net_ops = {
2900	.init = igmp6_net_init,
2901	.exit = igmp6_net_exit,
2902};
2903
2904int __init igmp6_init(void)
2905{
2906	return register_pernet_subsys(&igmp6_net_ops);
2907}
2908
 
 
 
 
 
2909void igmp6_cleanup(void)
2910{
2911	unregister_pernet_subsys(&igmp6_net_ops);
 
 
 
 
 
2912}
v4.17
   1/*
   2 *	Multicast support for IPv6
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *
   8 *	Based on linux/ipv4/igmp.c and linux/ipv4/ip_sockglue.c
   9 *
  10 *	This program is free software; you can redistribute it and/or
  11 *      modify it under the terms of the GNU General Public License
  12 *      as published by the Free Software Foundation; either version
  13 *      2 of the License, or (at your option) any later version.
  14 */
  15
  16/* Changes:
  17 *
  18 *	yoshfuji	: fix format of router-alert option
  19 *	YOSHIFUJI Hideaki @USAGI:
  20 *		Fixed source address for MLD message based on
  21 *		<draft-ietf-magma-mld-source-05.txt>.
  22 *	YOSHIFUJI Hideaki @USAGI:
  23 *		- Ignore Queries for invalid addresses.
  24 *		- MLD for link-local addresses.
  25 *	David L Stevens <dlstevens@us.ibm.com>:
  26 *		- MLDv2 support
  27 */
  28
  29#include <linux/module.h>
  30#include <linux/errno.h>
  31#include <linux/types.h>
  32#include <linux/string.h>
  33#include <linux/socket.h>
  34#include <linux/sockios.h>
  35#include <linux/jiffies.h>
  36#include <linux/times.h>
  37#include <linux/net.h>
  38#include <linux/in.h>
  39#include <linux/in6.h>
  40#include <linux/netdevice.h>
  41#include <linux/if_arp.h>
  42#include <linux/route.h>
  43#include <linux/init.h>
  44#include <linux/proc_fs.h>
  45#include <linux/seq_file.h>
  46#include <linux/slab.h>
  47#include <linux/pkt_sched.h>
  48#include <net/mld.h>
  49
  50#include <linux/netfilter.h>
  51#include <linux/netfilter_ipv6.h>
  52
  53#include <net/net_namespace.h>
  54#include <net/sock.h>
  55#include <net/snmp.h>
  56
  57#include <net/ipv6.h>
  58#include <net/protocol.h>
  59#include <net/if_inet6.h>
  60#include <net/ndisc.h>
  61#include <net/addrconf.h>
  62#include <net/ip6_route.h>
  63#include <net/inet_common.h>
  64
  65#include <net/ip6_checksum.h>
  66
 
 
 
 
 
 
 
 
 
  67/* Ensure that we have struct in6_addr aligned on 32bit word. */
  68static int __mld2_query_bugs[] __attribute__((__unused__)) = {
  69	BUILD_BUG_ON_ZERO(offsetof(struct mld2_query, mld2q_srcs) % 4),
  70	BUILD_BUG_ON_ZERO(offsetof(struct mld2_report, mld2r_grec) % 4),
  71	BUILD_BUG_ON_ZERO(offsetof(struct mld2_grec, grec_mca) % 4)
  72};
  73
  74static struct in6_addr mld2_all_mcr = MLD2_ALL_MCR_INIT;
  75
 
 
 
  76static void igmp6_join_group(struct ifmcaddr6 *ma);
  77static void igmp6_leave_group(struct ifmcaddr6 *ma);
  78static void igmp6_timer_handler(struct timer_list *t);
  79
  80static void mld_gq_timer_expire(struct timer_list *t);
  81static void mld_ifc_timer_expire(struct timer_list *t);
  82static void mld_ifc_event(struct inet6_dev *idev);
  83static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
  84static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
  85static void mld_clear_delrec(struct inet6_dev *idev);
  86static bool mld_in_v1_mode(const struct inet6_dev *idev);
  87static int sf_setstate(struct ifmcaddr6 *pmc);
  88static void sf_markstate(struct ifmcaddr6 *pmc);
  89static void ip6_mc_clear_src(struct ifmcaddr6 *pmc);
  90static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
  91			  int sfmode, int sfcount, const struct in6_addr *psfsrc,
  92			  int delta);
  93static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
  94			  int sfmode, int sfcount, const struct in6_addr *psfsrc,
  95			  int delta);
  96static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
  97			    struct inet6_dev *idev);
  98
  99#define MLD_QRV_DEFAULT		2
 100/* RFC3810, 9.2. Query Interval */
 101#define MLD_QI_DEFAULT		(125 * HZ)
 102/* RFC3810, 9.3. Query Response Interval */
 103#define MLD_QRI_DEFAULT		(10 * HZ)
 104
 105/* RFC3810, 8.1 Query Version Distinctions */
 106#define MLD_V1_QUERY_LEN	24
 107#define MLD_V2_QUERY_LEN_MIN	28
 108
 109#define IPV6_MLD_MAX_MSF	64
 110
 111int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
 112int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
 113
 114/*
 115 *	socket join on multicast group
 116 */
 117
 118#define for_each_pmc_rcu(np, pmc)				\
 119	for (pmc = rcu_dereference(np->ipv6_mc_list);		\
 120	     pmc != NULL;					\
 121	     pmc = rcu_dereference(pmc->next))
 122
 123static int unsolicited_report_interval(struct inet6_dev *idev)
 124{
 125	int iv;
 126
 127	if (mld_in_v1_mode(idev))
 128		iv = idev->cnf.mldv1_unsolicited_report_interval;
 129	else
 130		iv = idev->cnf.mldv2_unsolicited_report_interval;
 131
 132	return iv > 0 ? iv : 1;
 133}
 134
 135int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 136{
 137	struct net_device *dev = NULL;
 138	struct ipv6_mc_socklist *mc_lst;
 139	struct ipv6_pinfo *np = inet6_sk(sk);
 140	struct net *net = sock_net(sk);
 141	int err;
 142
 143	ASSERT_RTNL();
 144
 145	if (!ipv6_addr_is_multicast(addr))
 146		return -EINVAL;
 147
 148	rcu_read_lock();
 149	for_each_pmc_rcu(np, mc_lst) {
 150		if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
 151		    ipv6_addr_equal(&mc_lst->addr, addr)) {
 152			rcu_read_unlock();
 153			return -EADDRINUSE;
 154		}
 155	}
 156	rcu_read_unlock();
 157
 158	mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL);
 159
 160	if (!mc_lst)
 161		return -ENOMEM;
 162
 163	mc_lst->next = NULL;
 164	mc_lst->addr = *addr;
 165
 
 166	if (ifindex == 0) {
 167		struct rt6_info *rt;
 168		rt = rt6_lookup(net, addr, NULL, 0, NULL, 0);
 169		if (rt) {
 170			dev = rt->dst.dev;
 171			ip6_rt_put(rt);
 172		}
 173	} else
 174		dev = __dev_get_by_index(net, ifindex);
 175
 176	if (!dev) {
 
 177		sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
 178		return -ENODEV;
 179	}
 180
 181	mc_lst->ifindex = dev->ifindex;
 182	mc_lst->sfmode = MCAST_EXCLUDE;
 183	rwlock_init(&mc_lst->sflock);
 184	mc_lst->sflist = NULL;
 185
 186	/*
 187	 *	now add/increase the group membership on the device
 188	 */
 189
 190	err = ipv6_dev_mc_inc(dev, addr);
 191
 192	if (err) {
 
 193		sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
 194		return err;
 195	}
 196
 
 197	mc_lst->next = np->ipv6_mc_list;
 198	rcu_assign_pointer(np->ipv6_mc_list, mc_lst);
 
 
 
 199
 200	return 0;
 201}
 202EXPORT_SYMBOL(ipv6_sock_mc_join);
 203
 204/*
 205 *	socket leave on multicast group
 206 */
 207int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
 208{
 209	struct ipv6_pinfo *np = inet6_sk(sk);
 210	struct ipv6_mc_socklist *mc_lst;
 211	struct ipv6_mc_socklist __rcu **lnk;
 212	struct net *net = sock_net(sk);
 213
 214	ASSERT_RTNL();
 215
 216	if (!ipv6_addr_is_multicast(addr))
 217		return -EINVAL;
 218
 
 219	for (lnk = &np->ipv6_mc_list;
 220	     (mc_lst = rtnl_dereference(*lnk)) != NULL;
 
 221	      lnk = &mc_lst->next) {
 222		if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
 223		    ipv6_addr_equal(&mc_lst->addr, addr)) {
 224			struct net_device *dev;
 225
 226			*lnk = mc_lst->next;
 
 227
 228			dev = __dev_get_by_index(net, mc_lst->ifindex);
 229			if (dev) {
 
 230				struct inet6_dev *idev = __in6_dev_get(dev);
 231
 232				(void) ip6_mc_leave_src(sk, mc_lst, idev);
 233				if (idev)
 234					__ipv6_dev_mc_dec(idev, &mc_lst->addr);
 235			} else
 236				(void) ip6_mc_leave_src(sk, mc_lst, NULL);
 237
 238			atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
 239			kfree_rcu(mc_lst, rcu);
 240			return 0;
 241		}
 242	}
 
 243
 244	return -EADDRNOTAVAIL;
 245}
 246EXPORT_SYMBOL(ipv6_sock_mc_drop);
 247
 248/* called with rcu_read_lock() */
 249static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
 250					     const struct in6_addr *group,
 251					     int ifindex)
 252{
 253	struct net_device *dev = NULL;
 254	struct inet6_dev *idev = NULL;
 255
 256	if (ifindex == 0) {
 257		struct rt6_info *rt = rt6_lookup(net, group, NULL, 0, NULL, 0);
 258
 259		if (rt) {
 260			dev = rt->dst.dev;
 261			ip6_rt_put(rt);
 262		}
 263	} else
 264		dev = dev_get_by_index_rcu(net, ifindex);
 265
 266	if (!dev)
 267		return NULL;
 268	idev = __in6_dev_get(dev);
 269	if (!idev)
 270		return NULL;
 271	read_lock_bh(&idev->lock);
 272	if (idev->dead) {
 273		read_unlock_bh(&idev->lock);
 274		return NULL;
 275	}
 276	return idev;
 277}
 278
 279void __ipv6_sock_mc_close(struct sock *sk)
 280{
 281	struct ipv6_pinfo *np = inet6_sk(sk);
 282	struct ipv6_mc_socklist *mc_lst;
 283	struct net *net = sock_net(sk);
 284
 285	ASSERT_RTNL();
 
 286
 287	while ((mc_lst = rtnl_dereference(np->ipv6_mc_list)) != NULL) {
 
 
 288		struct net_device *dev;
 289
 290		np->ipv6_mc_list = mc_lst->next;
 
 291
 292		dev = __dev_get_by_index(net, mc_lst->ifindex);
 
 293		if (dev) {
 294			struct inet6_dev *idev = __in6_dev_get(dev);
 295
 296			(void) ip6_mc_leave_src(sk, mc_lst, idev);
 297			if (idev)
 298				__ipv6_dev_mc_dec(idev, &mc_lst->addr);
 299		} else
 300			(void) ip6_mc_leave_src(sk, mc_lst, NULL);
 
 301
 302		atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
 303		kfree_rcu(mc_lst, rcu);
 
 
 304	}
 305}
 306
 307void ipv6_sock_mc_close(struct sock *sk)
 308{
 309	struct ipv6_pinfo *np = inet6_sk(sk);
 310
 311	if (!rcu_access_pointer(np->ipv6_mc_list))
 312		return;
 313	rtnl_lock();
 314	__ipv6_sock_mc_close(sk);
 315	rtnl_unlock();
 316}
 317
 318int ip6_mc_source(int add, int omode, struct sock *sk,
 319	struct group_source_req *pgsr)
 320{
 321	struct in6_addr *source, *group;
 322	struct ipv6_mc_socklist *pmc;
 323	struct inet6_dev *idev;
 324	struct ipv6_pinfo *inet6 = inet6_sk(sk);
 325	struct ip6_sf_socklist *psl;
 326	struct net *net = sock_net(sk);
 327	int i, j, rv;
 328	int leavegroup = 0;
 329	int pmclocked = 0;
 330	int err;
 331
 332	source = &((struct sockaddr_in6 *)&pgsr->gsr_source)->sin6_addr;
 333	group = &((struct sockaddr_in6 *)&pgsr->gsr_group)->sin6_addr;
 334
 335	if (!ipv6_addr_is_multicast(group))
 336		return -EINVAL;
 337
 338	rcu_read_lock();
 339	idev = ip6_mc_find_dev_rcu(net, group, pgsr->gsr_interface);
 340	if (!idev) {
 341		rcu_read_unlock();
 342		return -ENODEV;
 343	}
 344
 345	err = -EADDRNOTAVAIL;
 346
 347	for_each_pmc_rcu(inet6, pmc) {
 348		if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
 349			continue;
 350		if (ipv6_addr_equal(&pmc->addr, group))
 351			break;
 352	}
 353	if (!pmc) {		/* must have a prior join */
 354		err = -EINVAL;
 355		goto done;
 356	}
 357	/* if a source filter was set, must be the same mode as before */
 358	if (pmc->sflist) {
 359		if (pmc->sfmode != omode) {
 360			err = -EINVAL;
 361			goto done;
 362		}
 363	} else if (pmc->sfmode != omode) {
 364		/* allow mode switches for empty-set filters */
 365		ip6_mc_add_src(idev, group, omode, 0, NULL, 0);
 366		ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
 367		pmc->sfmode = omode;
 368	}
 369
 370	write_lock(&pmc->sflock);
 371	pmclocked = 1;
 372
 373	psl = pmc->sflist;
 374	if (!add) {
 375		if (!psl)
 376			goto done;	/* err = -EADDRNOTAVAIL */
 377		rv = !0;
 378		for (i = 0; i < psl->sl_count; i++) {
 379			rv = !ipv6_addr_equal(&psl->sl_addr[i], source);
 380			if (rv == 0)
 381				break;
 382		}
 383		if (rv)		/* source not found */
 384			goto done;	/* err = -EADDRNOTAVAIL */
 385
 386		/* special case - (INCLUDE, empty) == LEAVE_GROUP */
 387		if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
 388			leavegroup = 1;
 389			goto done;
 390		}
 391
 392		/* update the interface filter */
 393		ip6_mc_del_src(idev, group, omode, 1, source, 1);
 394
 395		for (j = i+1; j < psl->sl_count; j++)
 396			psl->sl_addr[j-1] = psl->sl_addr[j];
 397		psl->sl_count--;
 398		err = 0;
 399		goto done;
 400	}
 401	/* else, add a new source to the filter */
 402
 403	if (psl && psl->sl_count >= sysctl_mld_max_msf) {
 404		err = -ENOBUFS;
 405		goto done;
 406	}
 407	if (!psl || psl->sl_count == psl->sl_max) {
 408		struct ip6_sf_socklist *newpsl;
 409		int count = IP6_SFBLOCK;
 410
 411		if (psl)
 412			count += psl->sl_max;
 413		newpsl = sock_kmalloc(sk, IP6_SFLSIZE(count), GFP_ATOMIC);
 414		if (!newpsl) {
 415			err = -ENOBUFS;
 416			goto done;
 417		}
 418		newpsl->sl_max = count;
 419		newpsl->sl_count = count - IP6_SFBLOCK;
 420		if (psl) {
 421			for (i = 0; i < psl->sl_count; i++)
 422				newpsl->sl_addr[i] = psl->sl_addr[i];
 423			sock_kfree_s(sk, psl, IP6_SFLSIZE(psl->sl_max));
 424		}
 425		pmc->sflist = psl = newpsl;
 426	}
 427	rv = 1;	/* > 0 for insert logic below if sl_count is 0 */
 428	for (i = 0; i < psl->sl_count; i++) {
 429		rv = !ipv6_addr_equal(&psl->sl_addr[i], source);
 430		if (rv == 0) /* There is an error in the address. */
 431			goto done;
 432	}
 433	for (j = psl->sl_count-1; j >= i; j--)
 434		psl->sl_addr[j+1] = psl->sl_addr[j];
 435	psl->sl_addr[i] = *source;
 436	psl->sl_count++;
 437	err = 0;
 438	/* update the interface list */
 439	ip6_mc_add_src(idev, group, omode, 1, source, 1);
 440done:
 441	if (pmclocked)
 442		write_unlock(&pmc->sflock);
 443	read_unlock_bh(&idev->lock);
 444	rcu_read_unlock();
 445	if (leavegroup)
 446		err = ipv6_sock_mc_drop(sk, pgsr->gsr_interface, group);
 447	return err;
 448}
 449
 450int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
 451{
 452	const struct in6_addr *group;
 453	struct ipv6_mc_socklist *pmc;
 454	struct inet6_dev *idev;
 455	struct ipv6_pinfo *inet6 = inet6_sk(sk);
 456	struct ip6_sf_socklist *newpsl, *psl;
 457	struct net *net = sock_net(sk);
 458	int leavegroup = 0;
 459	int i, err;
 460
 461	group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
 462
 463	if (!ipv6_addr_is_multicast(group))
 464		return -EINVAL;
 465	if (gsf->gf_fmode != MCAST_INCLUDE &&
 466	    gsf->gf_fmode != MCAST_EXCLUDE)
 467		return -EINVAL;
 468
 469	rcu_read_lock();
 470	idev = ip6_mc_find_dev_rcu(net, group, gsf->gf_interface);
 471
 472	if (!idev) {
 473		rcu_read_unlock();
 474		return -ENODEV;
 475	}
 476
 477	err = 0;
 478
 479	if (gsf->gf_fmode == MCAST_INCLUDE && gsf->gf_numsrc == 0) {
 480		leavegroup = 1;
 481		goto done;
 482	}
 483
 484	for_each_pmc_rcu(inet6, pmc) {
 485		if (pmc->ifindex != gsf->gf_interface)
 486			continue;
 487		if (ipv6_addr_equal(&pmc->addr, group))
 488			break;
 489	}
 490	if (!pmc) {		/* must have a prior join */
 491		err = -EINVAL;
 492		goto done;
 493	}
 494	if (gsf->gf_numsrc) {
 495		newpsl = sock_kmalloc(sk, IP6_SFLSIZE(gsf->gf_numsrc),
 496							  GFP_ATOMIC);
 497		if (!newpsl) {
 498			err = -ENOBUFS;
 499			goto done;
 500		}
 501		newpsl->sl_max = newpsl->sl_count = gsf->gf_numsrc;
 502		for (i = 0; i < newpsl->sl_count; ++i) {
 503			struct sockaddr_in6 *psin6;
 504
 505			psin6 = (struct sockaddr_in6 *)&gsf->gf_slist[i];
 506			newpsl->sl_addr[i] = psin6->sin6_addr;
 507		}
 508		err = ip6_mc_add_src(idev, group, gsf->gf_fmode,
 509			newpsl->sl_count, newpsl->sl_addr, 0);
 510		if (err) {
 511			sock_kfree_s(sk, newpsl, IP6_SFLSIZE(newpsl->sl_max));
 512			goto done;
 513		}
 514	} else {
 515		newpsl = NULL;
 516		(void) ip6_mc_add_src(idev, group, gsf->gf_fmode, 0, NULL, 0);
 517	}
 518
 519	write_lock(&pmc->sflock);
 520	psl = pmc->sflist;
 521	if (psl) {
 522		(void) ip6_mc_del_src(idev, group, pmc->sfmode,
 523			psl->sl_count, psl->sl_addr, 0);
 524		sock_kfree_s(sk, psl, IP6_SFLSIZE(psl->sl_max));
 525	} else
 526		(void) ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
 527	pmc->sflist = newpsl;
 528	pmc->sfmode = gsf->gf_fmode;
 529	write_unlock(&pmc->sflock);
 530	err = 0;
 531done:
 532	read_unlock_bh(&idev->lock);
 533	rcu_read_unlock();
 534	if (leavegroup)
 535		err = ipv6_sock_mc_drop(sk, gsf->gf_interface, group);
 536	return err;
 537}
 538
 539int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
 540	struct group_filter __user *optval, int __user *optlen)
 541{
 542	int err, i, count, copycount;
 543	const struct in6_addr *group;
 544	struct ipv6_mc_socklist *pmc;
 545	struct inet6_dev *idev;
 546	struct ipv6_pinfo *inet6 = inet6_sk(sk);
 547	struct ip6_sf_socklist *psl;
 548	struct net *net = sock_net(sk);
 549
 550	group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
 551
 552	if (!ipv6_addr_is_multicast(group))
 553		return -EINVAL;
 554
 555	rcu_read_lock();
 556	idev = ip6_mc_find_dev_rcu(net, group, gsf->gf_interface);
 557
 558	if (!idev) {
 559		rcu_read_unlock();
 560		return -ENODEV;
 561	}
 562
 563	err = -EADDRNOTAVAIL;
 564	/* changes to the ipv6_mc_list require the socket lock and
 565	 * rtnl lock. We have the socket lock and rcu read lock,
 
 566	 * so reading the list is safe.
 567	 */
 568
 569	for_each_pmc_rcu(inet6, pmc) {
 570		if (pmc->ifindex != gsf->gf_interface)
 571			continue;
 572		if (ipv6_addr_equal(group, &pmc->addr))
 573			break;
 574	}
 575	if (!pmc)		/* must have a prior join */
 576		goto done;
 577	gsf->gf_fmode = pmc->sfmode;
 578	psl = pmc->sflist;
 579	count = psl ? psl->sl_count : 0;
 580	read_unlock_bh(&idev->lock);
 581	rcu_read_unlock();
 582
 583	copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
 584	gsf->gf_numsrc = count;
 585	if (put_user(GROUP_FILTER_SIZE(copycount), optlen) ||
 586	    copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
 587		return -EFAULT;
 588	}
 589	/* changes to psl require the socket lock, and a write lock
 590	 * on pmc->sflock. We have the socket lock so reading here is safe.
 
 591	 */
 592	for (i = 0; i < copycount; i++) {
 593		struct sockaddr_in6 *psin6;
 594		struct sockaddr_storage ss;
 595
 596		psin6 = (struct sockaddr_in6 *)&ss;
 597		memset(&ss, 0, sizeof(ss));
 598		psin6->sin6_family = AF_INET6;
 599		psin6->sin6_addr = psl->sl_addr[i];
 600		if (copy_to_user(&optval->gf_slist[i], &ss, sizeof(ss)))
 601			return -EFAULT;
 602	}
 603	return 0;
 604done:
 605	read_unlock_bh(&idev->lock);
 606	rcu_read_unlock();
 607	return err;
 608}
 609
 610bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
 611		    const struct in6_addr *src_addr)
 612{
 613	struct ipv6_pinfo *np = inet6_sk(sk);
 614	struct ipv6_mc_socklist *mc;
 615	struct ip6_sf_socklist *psl;
 616	bool rv = true;
 617
 618	rcu_read_lock();
 619	for_each_pmc_rcu(np, mc) {
 620		if (ipv6_addr_equal(&mc->addr, mc_addr))
 621			break;
 622	}
 623	if (!mc) {
 624		rcu_read_unlock();
 625		return true;
 626	}
 627	read_lock(&mc->sflock);
 628	psl = mc->sflist;
 629	if (!psl) {
 630		rv = mc->sfmode == MCAST_EXCLUDE;
 631	} else {
 632		int i;
 633
 634		for (i = 0; i < psl->sl_count; i++) {
 635			if (ipv6_addr_equal(&psl->sl_addr[i], src_addr))
 636				break;
 637		}
 638		if (mc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
 639			rv = false;
 640		if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
 641			rv = false;
 642	}
 643	read_unlock(&mc->sflock);
 644	rcu_read_unlock();
 645
 646	return rv;
 647}
 648
 
 
 
 
 
 
 
 
 649static void igmp6_group_added(struct ifmcaddr6 *mc)
 650{
 651	struct net_device *dev = mc->idev->dev;
 652	char buf[MAX_ADDR_LEN];
 653
 654	if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
 655	    IPV6_ADDR_SCOPE_LINKLOCAL)
 656		return;
 657
 658	spin_lock_bh(&mc->mca_lock);
 659	if (!(mc->mca_flags&MAF_LOADED)) {
 660		mc->mca_flags |= MAF_LOADED;
 661		if (ndisc_mc_map(&mc->mca_addr, buf, dev, 0) == 0)
 662			dev_mc_add(dev, buf);
 663	}
 664	spin_unlock_bh(&mc->mca_lock);
 665
 666	if (!(dev->flags & IFF_UP) || (mc->mca_flags & MAF_NOREPORT))
 667		return;
 668
 669	if (mld_in_v1_mode(mc->idev)) {
 670		igmp6_join_group(mc);
 671		return;
 672	}
 673	/* else v2 */
 674
 675	mc->mca_crcount = mc->idev->mc_qrv;
 676	mld_ifc_event(mc->idev);
 677}
 678
 679static void igmp6_group_dropped(struct ifmcaddr6 *mc)
 680{
 681	struct net_device *dev = mc->idev->dev;
 682	char buf[MAX_ADDR_LEN];
 683
 684	if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
 685	    IPV6_ADDR_SCOPE_LINKLOCAL)
 686		return;
 687
 688	spin_lock_bh(&mc->mca_lock);
 689	if (mc->mca_flags&MAF_LOADED) {
 690		mc->mca_flags &= ~MAF_LOADED;
 691		if (ndisc_mc_map(&mc->mca_addr, buf, dev, 0) == 0)
 692			dev_mc_del(dev, buf);
 693	}
 694
 
 
 695	spin_unlock_bh(&mc->mca_lock);
 696	if (mc->mca_flags & MAF_NOREPORT)
 697		return;
 698
 699	if (!mc->idev->dead)
 700		igmp6_leave_group(mc);
 701
 702	spin_lock_bh(&mc->mca_lock);
 703	if (del_timer(&mc->mca_timer))
 704		refcount_dec(&mc->mca_refcnt);
 
 
 705	spin_unlock_bh(&mc->mca_lock);
 706}
 707
 708/*
 709 * deleted ifmcaddr6 manipulation
 710 */
 711static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
 712{
 713	struct ifmcaddr6 *pmc;
 714
 715	/* this is an "ifmcaddr6" for convenience; only the fields below
 716	 * are actually used. In particular, the refcnt and users are not
 717	 * used for management of the delete list. Using the same structure
 718	 * for deleted items allows change reports to use common code with
 719	 * non-deleted or query-response MCA's.
 720	 */
 721	pmc = kzalloc(sizeof(*pmc), GFP_ATOMIC);
 722	if (!pmc)
 723		return;
 724
 725	spin_lock_bh(&im->mca_lock);
 726	spin_lock_init(&pmc->mca_lock);
 727	pmc->idev = im->idev;
 728	in6_dev_hold(idev);
 729	pmc->mca_addr = im->mca_addr;
 730	pmc->mca_crcount = idev->mc_qrv;
 731	pmc->mca_sfmode = im->mca_sfmode;
 732	if (pmc->mca_sfmode == MCAST_INCLUDE) {
 733		struct ip6_sf_list *psf;
 734
 735		pmc->mca_tomb = im->mca_tomb;
 736		pmc->mca_sources = im->mca_sources;
 737		im->mca_tomb = im->mca_sources = NULL;
 738		for (psf = pmc->mca_sources; psf; psf = psf->sf_next)
 739			psf->sf_crcount = pmc->mca_crcount;
 740	}
 741	spin_unlock_bh(&im->mca_lock);
 742
 743	spin_lock_bh(&idev->mc_lock);
 744	pmc->next = idev->mc_tomb;
 745	idev->mc_tomb = pmc;
 746	spin_unlock_bh(&idev->mc_lock);
 747}
 748
 749static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
 750{
 751	struct ifmcaddr6 *pmc, *pmc_prev;
 752	struct ip6_sf_list *psf;
 753	struct in6_addr *pmca = &im->mca_addr;
 754
 755	spin_lock_bh(&idev->mc_lock);
 756	pmc_prev = NULL;
 757	for (pmc = idev->mc_tomb; pmc; pmc = pmc->next) {
 758		if (ipv6_addr_equal(&pmc->mca_addr, pmca))
 759			break;
 760		pmc_prev = pmc;
 761	}
 762	if (pmc) {
 763		if (pmc_prev)
 764			pmc_prev->next = pmc->next;
 765		else
 766			idev->mc_tomb = pmc->next;
 767	}
 768	spin_unlock_bh(&idev->mc_lock);
 769
 770	spin_lock_bh(&im->mca_lock);
 771	if (pmc) {
 772		im->idev = pmc->idev;
 773		im->mca_crcount = idev->mc_qrv;
 774		im->mca_sfmode = pmc->mca_sfmode;
 775		if (pmc->mca_sfmode == MCAST_INCLUDE) {
 776			im->mca_tomb = pmc->mca_tomb;
 777			im->mca_sources = pmc->mca_sources;
 778			for (psf = im->mca_sources; psf; psf = psf->sf_next)
 779				psf->sf_crcount = im->mca_crcount;
 780		}
 781		in6_dev_put(pmc->idev);
 782		kfree(pmc);
 783	}
 784	spin_unlock_bh(&im->mca_lock);
 785}
 786
 787static void mld_clear_delrec(struct inet6_dev *idev)
 788{
 789	struct ifmcaddr6 *pmc, *nextpmc;
 790
 791	spin_lock_bh(&idev->mc_lock);
 792	pmc = idev->mc_tomb;
 793	idev->mc_tomb = NULL;
 794	spin_unlock_bh(&idev->mc_lock);
 795
 796	for (; pmc; pmc = nextpmc) {
 797		nextpmc = pmc->next;
 798		ip6_mc_clear_src(pmc);
 799		in6_dev_put(pmc->idev);
 800		kfree(pmc);
 801	}
 802
 803	/* clear dead sources, too */
 804	read_lock_bh(&idev->lock);
 805	for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
 806		struct ip6_sf_list *psf, *psf_next;
 807
 808		spin_lock_bh(&pmc->mca_lock);
 809		psf = pmc->mca_tomb;
 810		pmc->mca_tomb = NULL;
 811		spin_unlock_bh(&pmc->mca_lock);
 812		for (; psf; psf = psf_next) {
 813			psf_next = psf->sf_next;
 814			kfree(psf);
 815		}
 816	}
 817	read_unlock_bh(&idev->lock);
 818}
 819
 820static void mca_get(struct ifmcaddr6 *mc)
 821{
 822	refcount_inc(&mc->mca_refcnt);
 823}
 824
 825static void ma_put(struct ifmcaddr6 *mc)
 826{
 827	if (refcount_dec_and_test(&mc->mca_refcnt)) {
 828		in6_dev_put(mc->idev);
 829		kfree(mc);
 830	}
 831}
 832
 833static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
 834				   const struct in6_addr *addr)
 835{
 836	struct ifmcaddr6 *mc;
 837
 838	mc = kzalloc(sizeof(*mc), GFP_ATOMIC);
 839	if (!mc)
 840		return NULL;
 841
 842	timer_setup(&mc->mca_timer, igmp6_timer_handler, 0);
 843
 844	mc->mca_addr = *addr;
 845	mc->idev = idev; /* reference taken by caller */
 846	mc->mca_users = 1;
 847	/* mca_stamp should be updated upon changes */
 848	mc->mca_cstamp = mc->mca_tstamp = jiffies;
 849	refcount_set(&mc->mca_refcnt, 1);
 850	spin_lock_init(&mc->mca_lock);
 851
 852	/* initial mode is (EX, empty) */
 853	mc->mca_sfmode = MCAST_EXCLUDE;
 854	mc->mca_sfcount[MCAST_EXCLUDE] = 1;
 855
 856	if (ipv6_addr_is_ll_all_nodes(&mc->mca_addr) ||
 857	    IPV6_ADDR_MC_SCOPE(&mc->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
 858		mc->mca_flags |= MAF_NOREPORT;
 859
 860	return mc;
 861}
 862
 863/*
 864 *	device multicast group inc (add if not found)
 865 */
 866int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
 867{
 868	struct ifmcaddr6 *mc;
 869	struct inet6_dev *idev;
 870
 871	ASSERT_RTNL();
 872
 873	/* we need to take a reference on idev */
 874	idev = in6_dev_get(dev);
 875
 876	if (!idev)
 877		return -EINVAL;
 878
 879	write_lock_bh(&idev->lock);
 880	if (idev->dead) {
 881		write_unlock_bh(&idev->lock);
 882		in6_dev_put(idev);
 883		return -ENODEV;
 884	}
 885
 886	for (mc = idev->mc_list; mc; mc = mc->next) {
 887		if (ipv6_addr_equal(&mc->mca_addr, addr)) {
 888			mc->mca_users++;
 889			write_unlock_bh(&idev->lock);
 890			ip6_mc_add_src(idev, &mc->mca_addr, MCAST_EXCLUDE, 0,
 891				NULL, 0);
 892			in6_dev_put(idev);
 893			return 0;
 894		}
 895	}
 896
 897	mc = mca_alloc(idev, addr);
 898	if (!mc) {
 
 
 
 
 
 899		write_unlock_bh(&idev->lock);
 900		in6_dev_put(idev);
 901		return -ENOMEM;
 902	}
 903
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 904	mc->next = idev->mc_list;
 905	idev->mc_list = mc;
 906
 907	/* Hold this for the code below before we unlock,
 908	 * it is already exposed via idev->mc_list.
 909	 */
 910	mca_get(mc);
 911	write_unlock_bh(&idev->lock);
 912
 913	mld_del_delrec(idev, mc);
 914	igmp6_group_added(mc);
 915	ma_put(mc);
 916	return 0;
 917}
 918
 919/*
 920 *	device multicast group del
 921 */
 922int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
 923{
 924	struct ifmcaddr6 *ma, **map;
 925
 926	ASSERT_RTNL();
 927
 928	write_lock_bh(&idev->lock);
 929	for (map = &idev->mc_list; (ma = *map) != NULL; map = &ma->next) {
 930		if (ipv6_addr_equal(&ma->mca_addr, addr)) {
 931			if (--ma->mca_users == 0) {
 932				*map = ma->next;
 933				write_unlock_bh(&idev->lock);
 934
 935				igmp6_group_dropped(ma);
 936				ip6_mc_clear_src(ma);
 937
 938				ma_put(ma);
 939				return 0;
 940			}
 941			write_unlock_bh(&idev->lock);
 942			return 0;
 943		}
 944	}
 945	write_unlock_bh(&idev->lock);
 946
 947	return -ENOENT;
 948}
 949
 950int ipv6_dev_mc_dec(struct net_device *dev, const struct in6_addr *addr)
 951{
 952	struct inet6_dev *idev;
 953	int err;
 954
 955	ASSERT_RTNL();
 956
 957	idev = __in6_dev_get(dev);
 958	if (!idev)
 959		err = -ENODEV;
 960	else
 961		err = __ipv6_dev_mc_dec(idev, addr);
 962
 
 963	return err;
 964}
 965
 966/*
 967 *	check if the interface/address pair is valid
 968 */
 969bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
 970			 const struct in6_addr *src_addr)
 971{
 972	struct inet6_dev *idev;
 973	struct ifmcaddr6 *mc;
 974	bool rv = false;
 975
 976	rcu_read_lock();
 977	idev = __in6_dev_get(dev);
 978	if (idev) {
 979		read_lock_bh(&idev->lock);
 980		for (mc = idev->mc_list; mc; mc = mc->next) {
 981			if (ipv6_addr_equal(&mc->mca_addr, group))
 982				break;
 983		}
 984		if (mc) {
 985			if (src_addr && !ipv6_addr_any(src_addr)) {
 986				struct ip6_sf_list *psf;
 987
 988				spin_lock_bh(&mc->mca_lock);
 989				for (psf = mc->mca_sources; psf; psf = psf->sf_next) {
 990					if (ipv6_addr_equal(&psf->sf_addr, src_addr))
 991						break;
 992				}
 993				if (psf)
 994					rv = psf->sf_count[MCAST_INCLUDE] ||
 995						psf->sf_count[MCAST_EXCLUDE] !=
 996						mc->mca_sfcount[MCAST_EXCLUDE];
 997				else
 998					rv = mc->mca_sfcount[MCAST_EXCLUDE] != 0;
 999				spin_unlock_bh(&mc->mca_lock);
1000			} else
1001				rv = true; /* don't filter unspecified source */
1002		}
1003		read_unlock_bh(&idev->lock);
1004	}
1005	rcu_read_unlock();
1006	return rv;
1007}
1008
1009static void mld_gq_start_timer(struct inet6_dev *idev)
1010{
1011	unsigned long tv = prandom_u32() % idev->mc_maxdelay;
1012
1013	idev->mc_gq_running = 1;
1014	if (!mod_timer(&idev->mc_gq_timer, jiffies+tv+2))
1015		in6_dev_hold(idev);
1016}
1017
1018static void mld_gq_stop_timer(struct inet6_dev *idev)
1019{
1020	idev->mc_gq_running = 0;
1021	if (del_timer(&idev->mc_gq_timer))
1022		__in6_dev_put(idev);
1023}
1024
1025static void mld_ifc_start_timer(struct inet6_dev *idev, unsigned long delay)
1026{
1027	unsigned long tv = prandom_u32() % delay;
1028
1029	if (!mod_timer(&idev->mc_ifc_timer, jiffies+tv+2))
1030		in6_dev_hold(idev);
1031}
1032
1033static void mld_ifc_stop_timer(struct inet6_dev *idev)
1034{
1035	idev->mc_ifc_count = 0;
1036	if (del_timer(&idev->mc_ifc_timer))
1037		__in6_dev_put(idev);
1038}
1039
1040static void mld_dad_start_timer(struct inet6_dev *idev, unsigned long delay)
1041{
1042	unsigned long tv = prandom_u32() % delay;
1043
1044	if (!mod_timer(&idev->mc_dad_timer, jiffies+tv+2))
1045		in6_dev_hold(idev);
1046}
1047
1048static void mld_dad_stop_timer(struct inet6_dev *idev)
1049{
1050	if (del_timer(&idev->mc_dad_timer))
1051		__in6_dev_put(idev);
1052}
1053
1054/*
1055 *	IGMP handling (alias multicast ICMPv6 messages)
1056 */
1057
1058static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
1059{
1060	unsigned long delay = resptime;
1061
1062	/* Do not start timer for these addresses */
1063	if (ipv6_addr_is_ll_all_nodes(&ma->mca_addr) ||
1064	    IPV6_ADDR_MC_SCOPE(&ma->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
1065		return;
1066
1067	if (del_timer(&ma->mca_timer)) {
1068		refcount_dec(&ma->mca_refcnt);
1069		delay = ma->mca_timer.expires - jiffies;
1070	}
1071
1072	if (delay >= resptime)
1073		delay = prandom_u32() % resptime;
1074
1075	ma->mca_timer.expires = jiffies + delay;
1076	if (!mod_timer(&ma->mca_timer, jiffies + delay))
1077		refcount_inc(&ma->mca_refcnt);
1078	ma->mca_flags |= MAF_TIMER_RUNNING;
1079}
1080
1081/* mark EXCLUDE-mode sources */
1082static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
1083			     const struct in6_addr *srcs)
1084{
1085	struct ip6_sf_list *psf;
1086	int i, scount;
1087
1088	scount = 0;
1089	for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
1090		if (scount == nsrcs)
1091			break;
1092		for (i = 0; i < nsrcs; i++) {
1093			/* skip inactive filters */
1094			if (psf->sf_count[MCAST_INCLUDE] ||
1095			    pmc->mca_sfcount[MCAST_EXCLUDE] !=
1096			    psf->sf_count[MCAST_EXCLUDE])
1097				break;
1098			if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
1099				scount++;
1100				break;
1101			}
1102		}
1103	}
1104	pmc->mca_flags &= ~MAF_GSQUERY;
1105	if (scount == nsrcs)	/* all sources excluded */
1106		return false;
1107	return true;
1108}
1109
1110static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
1111			    const struct in6_addr *srcs)
1112{
1113	struct ip6_sf_list *psf;
1114	int i, scount;
1115
1116	if (pmc->mca_sfmode == MCAST_EXCLUDE)
1117		return mld_xmarksources(pmc, nsrcs, srcs);
1118
1119	/* mark INCLUDE-mode sources */
1120
1121	scount = 0;
1122	for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
1123		if (scount == nsrcs)
1124			break;
1125		for (i = 0; i < nsrcs; i++) {
1126			if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
1127				psf->sf_gsresp = 1;
1128				scount++;
1129				break;
1130			}
1131		}
1132	}
1133	if (!scount) {
1134		pmc->mca_flags &= ~MAF_GSQUERY;
1135		return false;
1136	}
1137	pmc->mca_flags |= MAF_GSQUERY;
1138	return true;
1139}
1140
1141static int mld_force_mld_version(const struct inet6_dev *idev)
1142{
1143	/* Normally, both are 0 here. If enforcement to a particular is
1144	 * being used, individual device enforcement will have a lower
1145	 * precedence over 'all' device (.../conf/all/force_mld_version).
1146	 */
1147
1148	if (dev_net(idev->dev)->ipv6.devconf_all->force_mld_version != 0)
1149		return dev_net(idev->dev)->ipv6.devconf_all->force_mld_version;
1150	else
1151		return idev->cnf.force_mld_version;
1152}
1153
1154static bool mld_in_v2_mode_only(const struct inet6_dev *idev)
1155{
1156	return mld_force_mld_version(idev) == 2;
1157}
1158
1159static bool mld_in_v1_mode_only(const struct inet6_dev *idev)
1160{
1161	return mld_force_mld_version(idev) == 1;
1162}
1163
1164static bool mld_in_v1_mode(const struct inet6_dev *idev)
1165{
1166	if (mld_in_v2_mode_only(idev))
1167		return false;
1168	if (mld_in_v1_mode_only(idev))
1169		return true;
1170	if (idev->mc_v1_seen && time_before(jiffies, idev->mc_v1_seen))
1171		return true;
1172
1173	return false;
1174}
1175
1176static void mld_set_v1_mode(struct inet6_dev *idev)
1177{
1178	/* RFC3810, relevant sections:
1179	 *  - 9.1. Robustness Variable
1180	 *  - 9.2. Query Interval
1181	 *  - 9.3. Query Response Interval
1182	 *  - 9.12. Older Version Querier Present Timeout
1183	 */
1184	unsigned long switchback;
1185
1186	switchback = (idev->mc_qrv * idev->mc_qi) + idev->mc_qri;
1187
1188	idev->mc_v1_seen = jiffies + switchback;
1189}
1190
1191static void mld_update_qrv(struct inet6_dev *idev,
1192			   const struct mld2_query *mlh2)
1193{
1194	/* RFC3810, relevant sections:
1195	 *  - 5.1.8. QRV (Querier's Robustness Variable)
1196	 *  - 9.1. Robustness Variable
1197	 */
1198
1199	/* The value of the Robustness Variable MUST NOT be zero,
1200	 * and SHOULD NOT be one. Catch this here if we ever run
1201	 * into such a case in future.
1202	 */
1203	const int min_qrv = min(MLD_QRV_DEFAULT, sysctl_mld_qrv);
1204	WARN_ON(idev->mc_qrv == 0);
1205
1206	if (mlh2->mld2q_qrv > 0)
1207		idev->mc_qrv = mlh2->mld2q_qrv;
1208
1209	if (unlikely(idev->mc_qrv < min_qrv)) {
1210		net_warn_ratelimited("IPv6: MLD: clamping QRV from %u to %u!\n",
1211				     idev->mc_qrv, min_qrv);
1212		idev->mc_qrv = min_qrv;
1213	}
1214}
1215
1216static void mld_update_qi(struct inet6_dev *idev,
1217			  const struct mld2_query *mlh2)
1218{
1219	/* RFC3810, relevant sections:
1220	 *  - 5.1.9. QQIC (Querier's Query Interval Code)
1221	 *  - 9.2. Query Interval
1222	 *  - 9.12. Older Version Querier Present Timeout
1223	 *    (the [Query Interval] in the last Query received)
1224	 */
1225	unsigned long mc_qqi;
1226
1227	if (mlh2->mld2q_qqic < 128) {
1228		mc_qqi = mlh2->mld2q_qqic;
1229	} else {
1230		unsigned long mc_man, mc_exp;
1231
1232		mc_exp = MLDV2_QQIC_EXP(mlh2->mld2q_qqic);
1233		mc_man = MLDV2_QQIC_MAN(mlh2->mld2q_qqic);
1234
1235		mc_qqi = (mc_man | 0x10) << (mc_exp + 3);
1236	}
1237
1238	idev->mc_qi = mc_qqi * HZ;
1239}
1240
1241static void mld_update_qri(struct inet6_dev *idev,
1242			   const struct mld2_query *mlh2)
1243{
1244	/* RFC3810, relevant sections:
1245	 *  - 5.1.3. Maximum Response Code
1246	 *  - 9.3. Query Response Interval
1247	 */
1248	idev->mc_qri = msecs_to_jiffies(mldv2_mrc(mlh2));
1249}
1250
1251static int mld_process_v1(struct inet6_dev *idev, struct mld_msg *mld,
1252			  unsigned long *max_delay, bool v1_query)
1253{
1254	unsigned long mldv1_md;
1255
1256	/* Ignore v1 queries */
1257	if (mld_in_v2_mode_only(idev))
1258		return -EINVAL;
1259
 
1260	mldv1_md = ntohs(mld->mld_maxdelay);
1261
1262	/* When in MLDv1 fallback and a MLDv2 router start-up being
1263	 * unaware of current MLDv1 operation, the MRC == MRD mapping
1264	 * only works when the exponential algorithm is not being
1265	 * used (as MLDv1 is unaware of such things).
1266	 *
1267	 * According to the RFC author, the MLDv2 implementations
1268	 * he's aware of all use a MRC < 32768 on start up queries.
1269	 *
1270	 * Thus, should we *ever* encounter something else larger
1271	 * than that, just assume the maximum possible within our
1272	 * reach.
1273	 */
1274	if (!v1_query)
1275		mldv1_md = min(mldv1_md, MLDV1_MRD_MAX_COMPAT);
1276
1277	*max_delay = max(msecs_to_jiffies(mldv1_md), 1UL);
1278
1279	/* MLDv1 router present: we need to go into v1 mode *only*
1280	 * when an MLDv1 query is received as per section 9.12. of
1281	 * RFC3810! And we know from RFC2710 section 3.7 that MLDv1
1282	 * queries MUST be of exactly 24 octets.
1283	 */
1284	if (v1_query)
1285		mld_set_v1_mode(idev);
1286
1287	/* cancel MLDv2 report timer */
1288	mld_gq_stop_timer(idev);
1289	/* cancel the interface change timer */
1290	mld_ifc_stop_timer(idev);
1291	/* clear deleted report items */
1292	mld_clear_delrec(idev);
1293
1294	return 0;
1295}
1296
1297static int mld_process_v2(struct inet6_dev *idev, struct mld2_query *mld,
1298			  unsigned long *max_delay)
1299{
 
 
 
 
1300	*max_delay = max(msecs_to_jiffies(mldv2_mrc(mld)), 1UL);
1301
1302	mld_update_qrv(idev, mld);
1303	mld_update_qi(idev, mld);
1304	mld_update_qri(idev, mld);
1305
1306	idev->mc_maxdelay = *max_delay;
1307
1308	return 0;
1309}
1310
1311/* called with rcu_read_lock() */
1312int igmp6_event_query(struct sk_buff *skb)
1313{
1314	struct mld2_query *mlh2 = NULL;
1315	struct ifmcaddr6 *ma;
1316	const struct in6_addr *group;
1317	unsigned long max_delay;
1318	struct inet6_dev *idev;
1319	struct mld_msg *mld;
1320	int group_type;
1321	int mark = 0;
1322	int len, err;
1323
1324	if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
1325		return -EINVAL;
1326
1327	/* compute payload length excluding extension headers */
1328	len = ntohs(ipv6_hdr(skb)->payload_len) + sizeof(struct ipv6hdr);
1329	len -= skb_network_header_len(skb);
1330
1331	/* RFC3810 6.2
1332	 * Upon reception of an MLD message that contains a Query, the node
1333	 * checks if the source address of the message is a valid link-local
1334	 * address, if the Hop Limit is set to 1, and if the Router Alert
1335	 * option is present in the Hop-By-Hop Options header of the IPv6
1336	 * packet.  If any of these checks fails, the packet is dropped.
1337	 */
1338	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL) ||
1339	    ipv6_hdr(skb)->hop_limit != 1 ||
1340	    !(IP6CB(skb)->flags & IP6SKB_ROUTERALERT) ||
1341	    IP6CB(skb)->ra != htons(IPV6_OPT_ROUTERALERT_MLD))
1342		return -EINVAL;
1343
1344	idev = __in6_dev_get(skb->dev);
1345	if (!idev)
1346		return 0;
1347
1348	mld = (struct mld_msg *)icmp6_hdr(skb);
1349	group = &mld->mld_mca;
1350	group_type = ipv6_addr_type(group);
1351
1352	if (group_type != IPV6_ADDR_ANY &&
1353	    !(group_type&IPV6_ADDR_MULTICAST))
1354		return -EINVAL;
1355
1356	if (len < MLD_V1_QUERY_LEN) {
1357		return -EINVAL;
1358	} else if (len == MLD_V1_QUERY_LEN || mld_in_v1_mode(idev)) {
1359		err = mld_process_v1(idev, mld, &max_delay,
1360				     len == MLD_V1_QUERY_LEN);
1361		if (err < 0)
1362			return err;
1363	} else if (len >= MLD_V2_QUERY_LEN_MIN) {
1364		int srcs_offset = sizeof(struct mld2_query) -
1365				  sizeof(struct icmp6hdr);
1366
1367		if (!pskb_may_pull(skb, srcs_offset))
1368			return -EINVAL;
1369
1370		mlh2 = (struct mld2_query *)skb_transport_header(skb);
1371
1372		err = mld_process_v2(idev, mlh2, &max_delay);
1373		if (err < 0)
1374			return err;
1375
1376		if (group_type == IPV6_ADDR_ANY) { /* general query */
1377			if (mlh2->mld2q_nsrcs)
1378				return -EINVAL; /* no sources allowed */
1379
1380			mld_gq_start_timer(idev);
1381			return 0;
1382		}
1383		/* mark sources to include, if group & source-specific */
1384		if (mlh2->mld2q_nsrcs != 0) {
1385			if (!pskb_may_pull(skb, srcs_offset +
1386			    ntohs(mlh2->mld2q_nsrcs) * sizeof(struct in6_addr)))
1387				return -EINVAL;
1388
1389			mlh2 = (struct mld2_query *)skb_transport_header(skb);
1390			mark = 1;
1391		}
1392	} else {
1393		return -EINVAL;
1394	}
1395
1396	read_lock_bh(&idev->lock);
1397	if (group_type == IPV6_ADDR_ANY) {
1398		for (ma = idev->mc_list; ma; ma = ma->next) {
1399			spin_lock_bh(&ma->mca_lock);
1400			igmp6_group_queried(ma, max_delay);
1401			spin_unlock_bh(&ma->mca_lock);
1402		}
1403	} else {
1404		for (ma = idev->mc_list; ma; ma = ma->next) {
1405			if (!ipv6_addr_equal(group, &ma->mca_addr))
1406				continue;
1407			spin_lock_bh(&ma->mca_lock);
1408			if (ma->mca_flags & MAF_TIMER_RUNNING) {
1409				/* gsquery <- gsquery && mark */
1410				if (!mark)
1411					ma->mca_flags &= ~MAF_GSQUERY;
1412			} else {
1413				/* gsquery <- mark */
1414				if (mark)
1415					ma->mca_flags |= MAF_GSQUERY;
1416				else
1417					ma->mca_flags &= ~MAF_GSQUERY;
1418			}
1419			if (!(ma->mca_flags & MAF_GSQUERY) ||
1420			    mld_marksources(ma, ntohs(mlh2->mld2q_nsrcs), mlh2->mld2q_srcs))
1421				igmp6_group_queried(ma, max_delay);
1422			spin_unlock_bh(&ma->mca_lock);
1423			break;
1424		}
1425	}
1426	read_unlock_bh(&idev->lock);
1427
1428	return 0;
1429}
1430
1431/* called with rcu_read_lock() */
1432int igmp6_event_report(struct sk_buff *skb)
1433{
1434	struct ifmcaddr6 *ma;
1435	struct inet6_dev *idev;
1436	struct mld_msg *mld;
1437	int addr_type;
1438
1439	/* Our own report looped back. Ignore it. */
1440	if (skb->pkt_type == PACKET_LOOPBACK)
1441		return 0;
1442
1443	/* send our report if the MC router may not have heard this report */
1444	if (skb->pkt_type != PACKET_MULTICAST &&
1445	    skb->pkt_type != PACKET_BROADCAST)
1446		return 0;
1447
1448	if (!pskb_may_pull(skb, sizeof(*mld) - sizeof(struct icmp6hdr)))
1449		return -EINVAL;
1450
1451	mld = (struct mld_msg *)icmp6_hdr(skb);
1452
1453	/* Drop reports with not link local source */
1454	addr_type = ipv6_addr_type(&ipv6_hdr(skb)->saddr);
1455	if (addr_type != IPV6_ADDR_ANY &&
1456	    !(addr_type&IPV6_ADDR_LINKLOCAL))
1457		return -EINVAL;
1458
1459	idev = __in6_dev_get(skb->dev);
1460	if (!idev)
1461		return -ENODEV;
1462
1463	/*
1464	 *	Cancel the timer for this group
1465	 */
1466
1467	read_lock_bh(&idev->lock);
1468	for (ma = idev->mc_list; ma; ma = ma->next) {
1469		if (ipv6_addr_equal(&ma->mca_addr, &mld->mld_mca)) {
1470			spin_lock(&ma->mca_lock);
1471			if (del_timer(&ma->mca_timer))
1472				refcount_dec(&ma->mca_refcnt);
1473			ma->mca_flags &= ~(MAF_LAST_REPORTER|MAF_TIMER_RUNNING);
1474			spin_unlock(&ma->mca_lock);
1475			break;
1476		}
1477	}
1478	read_unlock_bh(&idev->lock);
1479	return 0;
1480}
1481
1482static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
1483		  int gdeleted, int sdeleted)
1484{
1485	switch (type) {
1486	case MLD2_MODE_IS_INCLUDE:
1487	case MLD2_MODE_IS_EXCLUDE:
1488		if (gdeleted || sdeleted)
1489			return false;
1490		if (!((pmc->mca_flags & MAF_GSQUERY) && !psf->sf_gsresp)) {
1491			if (pmc->mca_sfmode == MCAST_INCLUDE)
1492				return true;
1493			/* don't include if this source is excluded
1494			 * in all filters
1495			 */
1496			if (psf->sf_count[MCAST_INCLUDE])
1497				return type == MLD2_MODE_IS_INCLUDE;
1498			return pmc->mca_sfcount[MCAST_EXCLUDE] ==
1499				psf->sf_count[MCAST_EXCLUDE];
1500		}
1501		return false;
1502	case MLD2_CHANGE_TO_INCLUDE:
1503		if (gdeleted || sdeleted)
1504			return false;
1505		return psf->sf_count[MCAST_INCLUDE] != 0;
1506	case MLD2_CHANGE_TO_EXCLUDE:
1507		if (gdeleted || sdeleted)
1508			return false;
1509		if (pmc->mca_sfcount[MCAST_EXCLUDE] == 0 ||
1510		    psf->sf_count[MCAST_INCLUDE])
1511			return false;
1512		return pmc->mca_sfcount[MCAST_EXCLUDE] ==
1513			psf->sf_count[MCAST_EXCLUDE];
1514	case MLD2_ALLOW_NEW_SOURCES:
1515		if (gdeleted || !psf->sf_crcount)
1516			return false;
1517		return (pmc->mca_sfmode == MCAST_INCLUDE) ^ sdeleted;
1518	case MLD2_BLOCK_OLD_SOURCES:
1519		if (pmc->mca_sfmode == MCAST_INCLUDE)
1520			return gdeleted || (psf->sf_crcount && sdeleted);
1521		return psf->sf_crcount && !gdeleted && !sdeleted;
1522	}
1523	return false;
1524}
1525
1526static int
1527mld_scount(struct ifmcaddr6 *pmc, int type, int gdeleted, int sdeleted)
1528{
1529	struct ip6_sf_list *psf;
1530	int scount = 0;
1531
1532	for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
1533		if (!is_in(pmc, psf, type, gdeleted, sdeleted))
1534			continue;
1535		scount++;
1536	}
1537	return scount;
1538}
1539
1540static void ip6_mc_hdr(struct sock *sk, struct sk_buff *skb,
1541		       struct net_device *dev,
1542		       const struct in6_addr *saddr,
1543		       const struct in6_addr *daddr,
1544		       int proto, int len)
1545{
1546	struct ipv6hdr *hdr;
1547
1548	skb->protocol = htons(ETH_P_IPV6);
1549	skb->dev = dev;
1550
1551	skb_reset_network_header(skb);
1552	skb_put(skb, sizeof(struct ipv6hdr));
1553	hdr = ipv6_hdr(skb);
1554
1555	ip6_flow_hdr(hdr, 0, 0);
1556
1557	hdr->payload_len = htons(len);
1558	hdr->nexthdr = proto;
1559	hdr->hop_limit = inet6_sk(sk)->hop_limit;
1560
1561	hdr->saddr = *saddr;
1562	hdr->daddr = *daddr;
1563}
1564
1565static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu)
1566{
1567	struct net_device *dev = idev->dev;
1568	struct net *net = dev_net(dev);
1569	struct sock *sk = net->ipv6.igmp_sk;
1570	struct sk_buff *skb;
1571	struct mld2_report *pmr;
1572	struct in6_addr addr_buf;
1573	const struct in6_addr *saddr;
1574	int hlen = LL_RESERVED_SPACE(dev);
1575	int tlen = dev->needed_tailroom;
1576	unsigned int size = mtu + hlen + tlen;
1577	int err;
1578	u8 ra[8] = { IPPROTO_ICMPV6, 0,
1579		     IPV6_TLV_ROUTERALERT, 2, 0, 0,
1580		     IPV6_TLV_PADN, 0 };
1581
1582	/* we assume size > sizeof(ra) here */
 
1583	/* limit our allocations to order-0 page */
1584	size = min_t(int, size, SKB_MAX_ORDER(0, 0));
1585	skb = sock_alloc_send_skb(sk, size, 1, &err);
1586
1587	if (!skb)
1588		return NULL;
1589
1590	skb->priority = TC_PRIO_CONTROL;
1591	skb_reserve(skb, hlen);
1592	skb_tailroom_reserve(skb, mtu, tlen);
1593
1594	if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
1595		/* <draft-ietf-magma-mld-source-05.txt>:
1596		 * use unspecified address as the source address
1597		 * when a valid link-local address is not available.
1598		 */
1599		saddr = &in6addr_any;
1600	} else
1601		saddr = &addr_buf;
1602
1603	ip6_mc_hdr(sk, skb, dev, saddr, &mld2_all_mcr, NEXTHDR_HOP, 0);
1604
1605	skb_put_data(skb, ra, sizeof(ra));
1606
1607	skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data);
1608	skb_put(skb, sizeof(*pmr));
1609	pmr = (struct mld2_report *)skb_transport_header(skb);
1610	pmr->mld2r_type = ICMPV6_MLD2_REPORT;
1611	pmr->mld2r_resv1 = 0;
1612	pmr->mld2r_cksum = 0;
1613	pmr->mld2r_resv2 = 0;
1614	pmr->mld2r_ngrec = 0;
1615	return skb;
1616}
1617
1618static void mld_sendpack(struct sk_buff *skb)
1619{
1620	struct ipv6hdr *pip6 = ipv6_hdr(skb);
1621	struct mld2_report *pmr =
1622			      (struct mld2_report *)skb_transport_header(skb);
1623	int payload_len, mldlen;
1624	struct inet6_dev *idev;
1625	struct net *net = dev_net(skb->dev);
1626	int err;
1627	struct flowi6 fl6;
1628	struct dst_entry *dst;
1629
1630	rcu_read_lock();
1631	idev = __in6_dev_get(skb->dev);
1632	IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
1633
1634	payload_len = (skb_tail_pointer(skb) - skb_network_header(skb)) -
1635		sizeof(*pip6);
1636	mldlen = skb_tail_pointer(skb) - skb_transport_header(skb);
1637	pip6->payload_len = htons(payload_len);
1638
1639	pmr->mld2r_cksum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
1640					   IPPROTO_ICMPV6,
1641					   csum_partial(skb_transport_header(skb),
1642							mldlen, 0));
1643
1644	icmpv6_flow_init(net->ipv6.igmp_sk, &fl6, ICMPV6_MLD2_REPORT,
1645			 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
1646			 skb->dev->ifindex);
1647	dst = icmp6_dst_alloc(skb->dev, &fl6);
1648
1649	err = 0;
1650	if (IS_ERR(dst)) {
1651		err = PTR_ERR(dst);
1652		dst = NULL;
1653	}
1654	skb_dst_set(skb, dst);
1655	if (err)
1656		goto err_out;
1657
1658	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
1659		      net, net->ipv6.igmp_sk, skb, NULL, skb->dev,
 
1660		      dst_output);
1661out:
1662	if (!err) {
1663		ICMP6MSGOUT_INC_STATS(net, idev, ICMPV6_MLD2_REPORT);
1664		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 
1665	} else {
1666		IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
1667	}
1668
1669	rcu_read_unlock();
1670	return;
1671
1672err_out:
1673	kfree_skb(skb);
1674	goto out;
1675}
1676
1677static int grec_size(struct ifmcaddr6 *pmc, int type, int gdel, int sdel)
1678{
1679	return sizeof(struct mld2_grec) + 16 * mld_scount(pmc,type,gdel,sdel);
1680}
1681
1682static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
1683	int type, struct mld2_grec **ppgr, unsigned int mtu)
1684{
 
1685	struct mld2_report *pmr;
1686	struct mld2_grec *pgr;
1687
1688	if (!skb) {
1689		skb = mld_newpack(pmc->idev, mtu);
1690		if (!skb)
1691			return NULL;
1692	}
1693	pgr = skb_put(skb, sizeof(struct mld2_grec));
1694	pgr->grec_type = type;
1695	pgr->grec_auxwords = 0;
1696	pgr->grec_nsrcs = 0;
1697	pgr->grec_mca = pmc->mca_addr;	/* structure copy */
1698	pmr = (struct mld2_report *)skb_transport_header(skb);
1699	pmr->mld2r_ngrec = htons(ntohs(pmr->mld2r_ngrec)+1);
1700	*ppgr = pgr;
1701	return skb;
1702}
1703
1704#define AVAILABLE(skb)	((skb) ? skb_availroom(skb) : 0)
 
1705
1706static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
1707	int type, int gdeleted, int sdeleted, int crsend)
1708{
1709	struct inet6_dev *idev = pmc->idev;
1710	struct net_device *dev = idev->dev;
1711	struct mld2_report *pmr;
1712	struct mld2_grec *pgr = NULL;
1713	struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
1714	int scount, stotal, first, isquery, truncate;
1715	unsigned int mtu;
1716
1717	if (pmc->mca_flags & MAF_NOREPORT)
1718		return skb;
1719
1720	mtu = READ_ONCE(dev->mtu);
1721	if (mtu < IPV6_MIN_MTU)
1722		return skb;
1723
1724	isquery = type == MLD2_MODE_IS_INCLUDE ||
1725		  type == MLD2_MODE_IS_EXCLUDE;
1726	truncate = type == MLD2_MODE_IS_EXCLUDE ||
1727		    type == MLD2_CHANGE_TO_EXCLUDE;
1728
1729	stotal = scount = 0;
1730
1731	psf_list = sdeleted ? &pmc->mca_tomb : &pmc->mca_sources;
1732
1733	if (!*psf_list)
1734		goto empty_source;
1735
1736	pmr = skb ? (struct mld2_report *)skb_transport_header(skb) : NULL;
1737
1738	/* EX and TO_EX get a fresh packet, if needed */
1739	if (truncate) {
1740		if (pmr && pmr->mld2r_ngrec &&
1741		    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
1742			if (skb)
1743				mld_sendpack(skb);
1744			skb = mld_newpack(idev, mtu);
1745		}
1746	}
1747	first = 1;
1748	psf_prev = NULL;
1749	for (psf = *psf_list; psf; psf = psf_next) {
1750		struct in6_addr *psrc;
1751
1752		psf_next = psf->sf_next;
1753
1754		if (!is_in(pmc, psf, type, gdeleted, sdeleted)) {
1755			psf_prev = psf;
1756			continue;
1757		}
1758
1759		/* Based on RFC3810 6.1. Should not send source-list change
1760		 * records when there is a filter mode change.
1761		 */
1762		if (((gdeleted && pmc->mca_sfmode == MCAST_EXCLUDE) ||
1763		     (!gdeleted && pmc->mca_crcount)) &&
1764		    (type == MLD2_ALLOW_NEW_SOURCES ||
1765		     type == MLD2_BLOCK_OLD_SOURCES) && psf->sf_crcount)
1766			goto decrease_sf_crcount;
1767
1768		/* clear marks on query responses */
1769		if (isquery)
1770			psf->sf_gsresp = 0;
1771
1772		if (AVAILABLE(skb) < sizeof(*psrc) +
1773		    first*sizeof(struct mld2_grec)) {
1774			if (truncate && !first)
1775				break;	 /* truncate these */
1776			if (pgr)
1777				pgr->grec_nsrcs = htons(scount);
1778			if (skb)
1779				mld_sendpack(skb);
1780			skb = mld_newpack(idev, mtu);
1781			first = 1;
1782			scount = 0;
1783		}
1784		if (first) {
1785			skb = add_grhead(skb, pmc, type, &pgr, mtu);
1786			first = 0;
1787		}
1788		if (!skb)
1789			return NULL;
1790		psrc = skb_put(skb, sizeof(*psrc));
1791		*psrc = psf->sf_addr;
1792		scount++; stotal++;
1793		if ((type == MLD2_ALLOW_NEW_SOURCES ||
1794		     type == MLD2_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
1795decrease_sf_crcount:
1796			psf->sf_crcount--;
1797			if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
1798				if (psf_prev)
1799					psf_prev->sf_next = psf->sf_next;
1800				else
1801					*psf_list = psf->sf_next;
1802				kfree(psf);
1803				continue;
1804			}
1805		}
1806		psf_prev = psf;
1807	}
1808
1809empty_source:
1810	if (!stotal) {
1811		if (type == MLD2_ALLOW_NEW_SOURCES ||
1812		    type == MLD2_BLOCK_OLD_SOURCES)
1813			return skb;
1814		if (pmc->mca_crcount || isquery || crsend) {
1815			/* make sure we have room for group header */
1816			if (skb && AVAILABLE(skb) < sizeof(struct mld2_grec)) {
1817				mld_sendpack(skb);
1818				skb = NULL; /* add_grhead will get a new one */
1819			}
1820			skb = add_grhead(skb, pmc, type, &pgr, mtu);
1821		}
1822	}
1823	if (pgr)
1824		pgr->grec_nsrcs = htons(scount);
1825
1826	if (isquery)
1827		pmc->mca_flags &= ~MAF_GSQUERY;	/* clear query state */
1828	return skb;
1829}
1830
1831static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
1832{
1833	struct sk_buff *skb = NULL;
1834	int type;
1835
1836	read_lock_bh(&idev->lock);
1837	if (!pmc) {
1838		for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
1839			if (pmc->mca_flags & MAF_NOREPORT)
1840				continue;
1841			spin_lock_bh(&pmc->mca_lock);
1842			if (pmc->mca_sfcount[MCAST_EXCLUDE])
1843				type = MLD2_MODE_IS_EXCLUDE;
1844			else
1845				type = MLD2_MODE_IS_INCLUDE;
1846			skb = add_grec(skb, pmc, type, 0, 0, 0);
1847			spin_unlock_bh(&pmc->mca_lock);
1848		}
1849	} else {
1850		spin_lock_bh(&pmc->mca_lock);
1851		if (pmc->mca_sfcount[MCAST_EXCLUDE])
1852			type = MLD2_MODE_IS_EXCLUDE;
1853		else
1854			type = MLD2_MODE_IS_INCLUDE;
1855		skb = add_grec(skb, pmc, type, 0, 0, 0);
1856		spin_unlock_bh(&pmc->mca_lock);
1857	}
1858	read_unlock_bh(&idev->lock);
1859	if (skb)
1860		mld_sendpack(skb);
1861}
1862
1863/*
1864 * remove zero-count source records from a source filter list
1865 */
1866static void mld_clear_zeros(struct ip6_sf_list **ppsf)
1867{
1868	struct ip6_sf_list *psf_prev, *psf_next, *psf;
1869
1870	psf_prev = NULL;
1871	for (psf = *ppsf; psf; psf = psf_next) {
1872		psf_next = psf->sf_next;
1873		if (psf->sf_crcount == 0) {
1874			if (psf_prev)
1875				psf_prev->sf_next = psf->sf_next;
1876			else
1877				*ppsf = psf->sf_next;
1878			kfree(psf);
1879		} else
1880			psf_prev = psf;
1881	}
1882}
1883
1884static void mld_send_cr(struct inet6_dev *idev)
1885{
1886	struct ifmcaddr6 *pmc, *pmc_prev, *pmc_next;
1887	struct sk_buff *skb = NULL;
1888	int type, dtype;
1889
1890	read_lock_bh(&idev->lock);
1891	spin_lock(&idev->mc_lock);
1892
1893	/* deleted MCA's */
1894	pmc_prev = NULL;
1895	for (pmc = idev->mc_tomb; pmc; pmc = pmc_next) {
1896		pmc_next = pmc->next;
1897		if (pmc->mca_sfmode == MCAST_INCLUDE) {
1898			type = MLD2_BLOCK_OLD_SOURCES;
1899			dtype = MLD2_BLOCK_OLD_SOURCES;
1900			skb = add_grec(skb, pmc, type, 1, 0, 0);
1901			skb = add_grec(skb, pmc, dtype, 1, 1, 0);
1902		}
1903		if (pmc->mca_crcount) {
1904			if (pmc->mca_sfmode == MCAST_EXCLUDE) {
1905				type = MLD2_CHANGE_TO_INCLUDE;
1906				skb = add_grec(skb, pmc, type, 1, 0, 0);
1907			}
1908			pmc->mca_crcount--;
1909			if (pmc->mca_crcount == 0) {
1910				mld_clear_zeros(&pmc->mca_tomb);
1911				mld_clear_zeros(&pmc->mca_sources);
1912			}
1913		}
1914		if (pmc->mca_crcount == 0 && !pmc->mca_tomb &&
1915		    !pmc->mca_sources) {
1916			if (pmc_prev)
1917				pmc_prev->next = pmc_next;
1918			else
1919				idev->mc_tomb = pmc_next;
1920			in6_dev_put(pmc->idev);
1921			kfree(pmc);
1922		} else
1923			pmc_prev = pmc;
1924	}
1925	spin_unlock(&idev->mc_lock);
1926
1927	/* change recs */
1928	for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
1929		spin_lock_bh(&pmc->mca_lock);
1930		if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
1931			type = MLD2_BLOCK_OLD_SOURCES;
1932			dtype = MLD2_ALLOW_NEW_SOURCES;
1933		} else {
1934			type = MLD2_ALLOW_NEW_SOURCES;
1935			dtype = MLD2_BLOCK_OLD_SOURCES;
1936		}
1937		skb = add_grec(skb, pmc, type, 0, 0, 0);
1938		skb = add_grec(skb, pmc, dtype, 0, 1, 0);	/* deleted sources */
1939
1940		/* filter mode changes */
1941		if (pmc->mca_crcount) {
1942			if (pmc->mca_sfmode == MCAST_EXCLUDE)
1943				type = MLD2_CHANGE_TO_EXCLUDE;
1944			else
1945				type = MLD2_CHANGE_TO_INCLUDE;
1946			skb = add_grec(skb, pmc, type, 0, 0, 0);
1947			pmc->mca_crcount--;
1948		}
1949		spin_unlock_bh(&pmc->mca_lock);
1950	}
1951	read_unlock_bh(&idev->lock);
1952	if (!skb)
1953		return;
1954	(void) mld_sendpack(skb);
1955}
1956
1957static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
1958{
1959	struct net *net = dev_net(dev);
1960	struct sock *sk = net->ipv6.igmp_sk;
1961	struct inet6_dev *idev;
1962	struct sk_buff *skb;
1963	struct mld_msg *hdr;
1964	const struct in6_addr *snd_addr, *saddr;
1965	struct in6_addr addr_buf;
1966	int hlen = LL_RESERVED_SPACE(dev);
1967	int tlen = dev->needed_tailroom;
1968	int err, len, payload_len, full_len;
1969	u8 ra[8] = { IPPROTO_ICMPV6, 0,
1970		     IPV6_TLV_ROUTERALERT, 2, 0, 0,
1971		     IPV6_TLV_PADN, 0 };
1972	struct flowi6 fl6;
1973	struct dst_entry *dst;
1974
1975	if (type == ICMPV6_MGM_REDUCTION)
1976		snd_addr = &in6addr_linklocal_allrouters;
1977	else
1978		snd_addr = addr;
1979
1980	len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
1981	payload_len = len + sizeof(ra);
1982	full_len = sizeof(struct ipv6hdr) + payload_len;
1983
1984	rcu_read_lock();
1985	IP6_UPD_PO_STATS(net, __in6_dev_get(dev),
1986		      IPSTATS_MIB_OUT, full_len);
1987	rcu_read_unlock();
1988
1989	skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err);
1990
1991	if (!skb) {
1992		rcu_read_lock();
1993		IP6_INC_STATS(net, __in6_dev_get(dev),
1994			      IPSTATS_MIB_OUTDISCARDS);
1995		rcu_read_unlock();
1996		return;
1997	}
1998	skb->priority = TC_PRIO_CONTROL;
1999	skb_reserve(skb, hlen);
2000
2001	if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
2002		/* <draft-ietf-magma-mld-source-05.txt>:
2003		 * use unspecified address as the source address
2004		 * when a valid link-local address is not available.
2005		 */
2006		saddr = &in6addr_any;
2007	} else
2008		saddr = &addr_buf;
2009
2010	ip6_mc_hdr(sk, skb, dev, saddr, snd_addr, NEXTHDR_HOP, payload_len);
2011
2012	skb_put_data(skb, ra, sizeof(ra));
2013
2014	hdr = skb_put_zero(skb, sizeof(struct mld_msg));
 
2015	hdr->mld_type = type;
2016	hdr->mld_mca = *addr;
2017
2018	hdr->mld_cksum = csum_ipv6_magic(saddr, snd_addr, len,
2019					 IPPROTO_ICMPV6,
2020					 csum_partial(hdr, len, 0));
2021
2022	rcu_read_lock();
2023	idev = __in6_dev_get(skb->dev);
2024
2025	icmpv6_flow_init(sk, &fl6, type,
2026			 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
2027			 skb->dev->ifindex);
2028	dst = icmp6_dst_alloc(skb->dev, &fl6);
2029	if (IS_ERR(dst)) {
2030		err = PTR_ERR(dst);
2031		goto err_out;
2032	}
2033
2034	skb_dst_set(skb, dst);
2035	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
2036		      net, sk, skb, NULL, skb->dev,
2037		      dst_output);
2038out:
2039	if (!err) {
2040		ICMP6MSGOUT_INC_STATS(net, idev, type);
2041		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 
2042	} else
2043		IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
2044
2045	rcu_read_unlock();
2046	return;
2047
2048err_out:
2049	kfree_skb(skb);
2050	goto out;
2051}
2052
2053static void mld_send_initial_cr(struct inet6_dev *idev)
2054{
2055	struct sk_buff *skb;
2056	struct ifmcaddr6 *pmc;
2057	int type;
2058
2059	if (mld_in_v1_mode(idev))
2060		return;
2061
2062	skb = NULL;
2063	read_lock_bh(&idev->lock);
2064	for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
2065		spin_lock_bh(&pmc->mca_lock);
2066		if (pmc->mca_sfcount[MCAST_EXCLUDE])
2067			type = MLD2_CHANGE_TO_EXCLUDE;
2068		else
2069			type = MLD2_CHANGE_TO_INCLUDE;
2070		skb = add_grec(skb, pmc, type, 0, 0, 1);
2071		spin_unlock_bh(&pmc->mca_lock);
2072	}
2073	read_unlock_bh(&idev->lock);
2074	if (skb)
2075		mld_sendpack(skb);
2076}
2077
2078void ipv6_mc_dad_complete(struct inet6_dev *idev)
2079{
2080	idev->mc_dad_count = idev->mc_qrv;
2081	if (idev->mc_dad_count) {
2082		mld_send_initial_cr(idev);
2083		idev->mc_dad_count--;
2084		if (idev->mc_dad_count)
2085			mld_dad_start_timer(idev, idev->mc_maxdelay);
2086	}
2087}
2088
2089static void mld_dad_timer_expire(struct timer_list *t)
2090{
2091	struct inet6_dev *idev = from_timer(idev, t, mc_dad_timer);
2092
2093	mld_send_initial_cr(idev);
2094	if (idev->mc_dad_count) {
2095		idev->mc_dad_count--;
2096		if (idev->mc_dad_count)
2097			mld_dad_start_timer(idev, idev->mc_maxdelay);
2098	}
2099	in6_dev_put(idev);
2100}
2101
2102static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
2103	const struct in6_addr *psfsrc)
2104{
2105	struct ip6_sf_list *psf, *psf_prev;
2106	int rv = 0;
2107
2108	psf_prev = NULL;
2109	for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
2110		if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
2111			break;
2112		psf_prev = psf;
2113	}
2114	if (!psf || psf->sf_count[sfmode] == 0) {
2115		/* source filter not found, or count wrong =>  bug */
2116		return -ESRCH;
2117	}
2118	psf->sf_count[sfmode]--;
2119	if (!psf->sf_count[MCAST_INCLUDE] && !psf->sf_count[MCAST_EXCLUDE]) {
2120		struct inet6_dev *idev = pmc->idev;
2121
2122		/* no more filters for this source */
2123		if (psf_prev)
2124			psf_prev->sf_next = psf->sf_next;
2125		else
2126			pmc->mca_sources = psf->sf_next;
2127		if (psf->sf_oldin && !(pmc->mca_flags & MAF_NOREPORT) &&
2128		    !mld_in_v1_mode(idev)) {
2129			psf->sf_crcount = idev->mc_qrv;
2130			psf->sf_next = pmc->mca_tomb;
2131			pmc->mca_tomb = psf;
2132			rv = 1;
2133		} else
2134			kfree(psf);
2135	}
2136	return rv;
2137}
2138
2139static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
2140			  int sfmode, int sfcount, const struct in6_addr *psfsrc,
2141			  int delta)
2142{
2143	struct ifmcaddr6 *pmc;
2144	int	changerec = 0;
2145	int	i, err;
2146
2147	if (!idev)
2148		return -ENODEV;
2149	read_lock_bh(&idev->lock);
2150	for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
2151		if (ipv6_addr_equal(pmca, &pmc->mca_addr))
2152			break;
2153	}
2154	if (!pmc) {
2155		/* MCA not found?? bug */
2156		read_unlock_bh(&idev->lock);
2157		return -ESRCH;
2158	}
2159	spin_lock_bh(&pmc->mca_lock);
2160	sf_markstate(pmc);
2161	if (!delta) {
2162		if (!pmc->mca_sfcount[sfmode]) {
2163			spin_unlock_bh(&pmc->mca_lock);
2164			read_unlock_bh(&idev->lock);
2165			return -EINVAL;
2166		}
2167		pmc->mca_sfcount[sfmode]--;
2168	}
2169	err = 0;
2170	for (i = 0; i < sfcount; i++) {
2171		int rv = ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
2172
2173		changerec |= rv > 0;
2174		if (!err && rv < 0)
2175			err = rv;
2176	}
2177	if (pmc->mca_sfmode == MCAST_EXCLUDE &&
2178	    pmc->mca_sfcount[MCAST_EXCLUDE] == 0 &&
2179	    pmc->mca_sfcount[MCAST_INCLUDE]) {
2180		struct ip6_sf_list *psf;
2181
2182		/* filter mode change */
2183		pmc->mca_sfmode = MCAST_INCLUDE;
2184		pmc->mca_crcount = idev->mc_qrv;
2185		idev->mc_ifc_count = pmc->mca_crcount;
2186		for (psf = pmc->mca_sources; psf; psf = psf->sf_next)
2187			psf->sf_crcount = 0;
2188		mld_ifc_event(pmc->idev);
2189	} else if (sf_setstate(pmc) || changerec)
2190		mld_ifc_event(pmc->idev);
2191	spin_unlock_bh(&pmc->mca_lock);
2192	read_unlock_bh(&idev->lock);
2193	return err;
2194}
2195
2196/*
2197 * Add multicast single-source filter to the interface list
2198 */
2199static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
2200	const struct in6_addr *psfsrc)
2201{
2202	struct ip6_sf_list *psf, *psf_prev;
2203
2204	psf_prev = NULL;
2205	for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
2206		if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
2207			break;
2208		psf_prev = psf;
2209	}
2210	if (!psf) {
2211		psf = kzalloc(sizeof(*psf), GFP_ATOMIC);
2212		if (!psf)
2213			return -ENOBUFS;
2214
2215		psf->sf_addr = *psfsrc;
2216		if (psf_prev) {
2217			psf_prev->sf_next = psf;
2218		} else
2219			pmc->mca_sources = psf;
2220	}
2221	psf->sf_count[sfmode]++;
2222	return 0;
2223}
2224
2225static void sf_markstate(struct ifmcaddr6 *pmc)
2226{
2227	struct ip6_sf_list *psf;
2228	int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
2229
2230	for (psf = pmc->mca_sources; psf; psf = psf->sf_next)
2231		if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
2232			psf->sf_oldin = mca_xcount ==
2233				psf->sf_count[MCAST_EXCLUDE] &&
2234				!psf->sf_count[MCAST_INCLUDE];
2235		} else
2236			psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
2237}
2238
2239static int sf_setstate(struct ifmcaddr6 *pmc)
2240{
2241	struct ip6_sf_list *psf, *dpsf;
2242	int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
2243	int qrv = pmc->idev->mc_qrv;
2244	int new_in, rv;
2245
2246	rv = 0;
2247	for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
2248		if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
2249			new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
2250				!psf->sf_count[MCAST_INCLUDE];
2251		} else
2252			new_in = psf->sf_count[MCAST_INCLUDE] != 0;
2253		if (new_in) {
2254			if (!psf->sf_oldin) {
2255				struct ip6_sf_list *prev = NULL;
2256
2257				for (dpsf = pmc->mca_tomb; dpsf;
2258				     dpsf = dpsf->sf_next) {
2259					if (ipv6_addr_equal(&dpsf->sf_addr,
2260					    &psf->sf_addr))
2261						break;
2262					prev = dpsf;
2263				}
2264				if (dpsf) {
2265					if (prev)
2266						prev->sf_next = dpsf->sf_next;
2267					else
2268						pmc->mca_tomb = dpsf->sf_next;
2269					kfree(dpsf);
2270				}
2271				psf->sf_crcount = qrv;
2272				rv++;
2273			}
2274		} else if (psf->sf_oldin) {
2275			psf->sf_crcount = 0;
2276			/*
2277			 * add or update "delete" records if an active filter
2278			 * is now inactive
2279			 */
2280			for (dpsf = pmc->mca_tomb; dpsf; dpsf = dpsf->sf_next)
2281				if (ipv6_addr_equal(&dpsf->sf_addr,
2282				    &psf->sf_addr))
2283					break;
2284			if (!dpsf) {
2285				dpsf = kmalloc(sizeof(*dpsf), GFP_ATOMIC);
2286				if (!dpsf)
2287					continue;
2288				*dpsf = *psf;
2289				/* pmc->mca_lock held by callers */
2290				dpsf->sf_next = pmc->mca_tomb;
2291				pmc->mca_tomb = dpsf;
2292			}
2293			dpsf->sf_crcount = qrv;
2294			rv++;
2295		}
2296	}
2297	return rv;
2298}
2299
2300/*
2301 * Add multicast source filter list to the interface list
2302 */
2303static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
2304			  int sfmode, int sfcount, const struct in6_addr *psfsrc,
2305			  int delta)
2306{
2307	struct ifmcaddr6 *pmc;
2308	int	isexclude;
2309	int	i, err;
2310
2311	if (!idev)
2312		return -ENODEV;
2313	read_lock_bh(&idev->lock);
2314	for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
2315		if (ipv6_addr_equal(pmca, &pmc->mca_addr))
2316			break;
2317	}
2318	if (!pmc) {
2319		/* MCA not found?? bug */
2320		read_unlock_bh(&idev->lock);
2321		return -ESRCH;
2322	}
2323	spin_lock_bh(&pmc->mca_lock);
2324
2325	sf_markstate(pmc);
2326	isexclude = pmc->mca_sfmode == MCAST_EXCLUDE;
2327	if (!delta)
2328		pmc->mca_sfcount[sfmode]++;
2329	err = 0;
2330	for (i = 0; i < sfcount; i++) {
2331		err = ip6_mc_add1_src(pmc, sfmode, &psfsrc[i]);
2332		if (err)
2333			break;
2334	}
2335	if (err) {
2336		int j;
2337
2338		if (!delta)
2339			pmc->mca_sfcount[sfmode]--;
2340		for (j = 0; j < i; j++)
2341			ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
2342	} else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
2343		struct ip6_sf_list *psf;
2344
2345		/* filter mode change */
2346		if (pmc->mca_sfcount[MCAST_EXCLUDE])
2347			pmc->mca_sfmode = MCAST_EXCLUDE;
2348		else if (pmc->mca_sfcount[MCAST_INCLUDE])
2349			pmc->mca_sfmode = MCAST_INCLUDE;
2350		/* else no filters; keep old mode for reports */
2351
2352		pmc->mca_crcount = idev->mc_qrv;
2353		idev->mc_ifc_count = pmc->mca_crcount;
2354		for (psf = pmc->mca_sources; psf; psf = psf->sf_next)
2355			psf->sf_crcount = 0;
2356		mld_ifc_event(idev);
2357	} else if (sf_setstate(pmc))
2358		mld_ifc_event(idev);
2359	spin_unlock_bh(&pmc->mca_lock);
2360	read_unlock_bh(&idev->lock);
2361	return err;
2362}
2363
2364static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
2365{
2366	struct ip6_sf_list *psf, *nextpsf;
2367
2368	for (psf = pmc->mca_tomb; psf; psf = nextpsf) {
2369		nextpsf = psf->sf_next;
2370		kfree(psf);
2371	}
2372	pmc->mca_tomb = NULL;
2373	for (psf = pmc->mca_sources; psf; psf = nextpsf) {
2374		nextpsf = psf->sf_next;
2375		kfree(psf);
2376	}
2377	pmc->mca_sources = NULL;
2378	pmc->mca_sfmode = MCAST_EXCLUDE;
2379	pmc->mca_sfcount[MCAST_INCLUDE] = 0;
2380	pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
2381}
2382
2383
2384static void igmp6_join_group(struct ifmcaddr6 *ma)
2385{
2386	unsigned long delay;
2387
2388	if (ma->mca_flags & MAF_NOREPORT)
2389		return;
2390
2391	igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
2392
2393	delay = prandom_u32() % unsolicited_report_interval(ma->idev);
2394
2395	spin_lock_bh(&ma->mca_lock);
2396	if (del_timer(&ma->mca_timer)) {
2397		refcount_dec(&ma->mca_refcnt);
2398		delay = ma->mca_timer.expires - jiffies;
2399	}
2400
2401	if (!mod_timer(&ma->mca_timer, jiffies + delay))
2402		refcount_inc(&ma->mca_refcnt);
2403	ma->mca_flags |= MAF_TIMER_RUNNING | MAF_LAST_REPORTER;
2404	spin_unlock_bh(&ma->mca_lock);
2405}
2406
2407static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
2408			    struct inet6_dev *idev)
2409{
2410	int err;
2411
2412	/* callers have the socket lock and rtnl lock
2413	 * so no other readers or writers of iml or its sflist
2414	 */
2415	if (!iml->sflist) {
2416		/* any-source empty exclude case */
2417		return ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
2418	}
2419	err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,
2420		iml->sflist->sl_count, iml->sflist->sl_addr, 0);
2421	sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max));
2422	iml->sflist = NULL;
2423	return err;
2424}
2425
2426static void igmp6_leave_group(struct ifmcaddr6 *ma)
2427{
2428	if (mld_in_v1_mode(ma->idev)) {
2429		if (ma->mca_flags & MAF_LAST_REPORTER)
2430			igmp6_send(&ma->mca_addr, ma->idev->dev,
2431				ICMPV6_MGM_REDUCTION);
2432	} else {
2433		mld_add_delrec(ma->idev, ma);
2434		mld_ifc_event(ma->idev);
2435	}
2436}
2437
2438static void mld_gq_timer_expire(struct timer_list *t)
2439{
2440	struct inet6_dev *idev = from_timer(idev, t, mc_gq_timer);
2441
2442	idev->mc_gq_running = 0;
2443	mld_send_report(idev, NULL);
2444	in6_dev_put(idev);
2445}
2446
2447static void mld_ifc_timer_expire(struct timer_list *t)
2448{
2449	struct inet6_dev *idev = from_timer(idev, t, mc_ifc_timer);
2450
2451	mld_send_cr(idev);
2452	if (idev->mc_ifc_count) {
2453		idev->mc_ifc_count--;
2454		if (idev->mc_ifc_count)
2455			mld_ifc_start_timer(idev, idev->mc_maxdelay);
2456	}
2457	in6_dev_put(idev);
2458}
2459
2460static void mld_ifc_event(struct inet6_dev *idev)
2461{
2462	if (mld_in_v1_mode(idev))
2463		return;
2464	idev->mc_ifc_count = idev->mc_qrv;
2465	mld_ifc_start_timer(idev, 1);
2466}
2467
2468static void igmp6_timer_handler(struct timer_list *t)
 
2469{
2470	struct ifmcaddr6 *ma = from_timer(ma, t, mca_timer);
2471
2472	if (mld_in_v1_mode(ma->idev))
2473		igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
2474	else
2475		mld_send_report(ma->idev, ma);
2476
2477	spin_lock(&ma->mca_lock);
2478	ma->mca_flags |=  MAF_LAST_REPORTER;
2479	ma->mca_flags &= ~MAF_TIMER_RUNNING;
2480	spin_unlock(&ma->mca_lock);
2481	ma_put(ma);
2482}
2483
2484/* Device changing type */
2485
2486void ipv6_mc_unmap(struct inet6_dev *idev)
2487{
2488	struct ifmcaddr6 *i;
2489
2490	/* Install multicast list, except for all-nodes (already installed) */
2491
2492	read_lock_bh(&idev->lock);
2493	for (i = idev->mc_list; i; i = i->next)
2494		igmp6_group_dropped(i);
2495	read_unlock_bh(&idev->lock);
2496}
2497
2498void ipv6_mc_remap(struct inet6_dev *idev)
2499{
2500	ipv6_mc_up(idev);
2501}
2502
2503/* Device going down */
2504
2505void ipv6_mc_down(struct inet6_dev *idev)
2506{
2507	struct ifmcaddr6 *i;
2508
2509	/* Withdraw multicast list */
2510
2511	read_lock_bh(&idev->lock);
2512
2513	for (i = idev->mc_list; i; i = i->next)
2514		igmp6_group_dropped(i);
2515
2516	/* Should stop timer after group drop. or we will
2517	 * start timer again in mld_ifc_event()
2518	 */
2519	mld_ifc_stop_timer(idev);
2520	mld_gq_stop_timer(idev);
2521	mld_dad_stop_timer(idev);
 
 
 
2522	read_unlock_bh(&idev->lock);
 
 
2523}
2524
2525static void ipv6_mc_reset(struct inet6_dev *idev)
2526{
2527	idev->mc_qrv = sysctl_mld_qrv;
2528	idev->mc_qi = MLD_QI_DEFAULT;
2529	idev->mc_qri = MLD_QRI_DEFAULT;
2530	idev->mc_v1_seen = 0;
2531	idev->mc_maxdelay = unsolicited_report_interval(idev);
2532}
2533
2534/* Device going up */
2535
2536void ipv6_mc_up(struct inet6_dev *idev)
2537{
2538	struct ifmcaddr6 *i;
2539
2540	/* Install multicast list, except for all-nodes (already installed) */
2541
2542	read_lock_bh(&idev->lock);
2543	ipv6_mc_reset(idev);
2544	for (i = idev->mc_list; i; i = i->next) {
2545		mld_del_delrec(idev, i);
2546		igmp6_group_added(i);
2547	}
2548	read_unlock_bh(&idev->lock);
2549}
2550
2551/* IPv6 device initialization. */
2552
2553void ipv6_mc_init_dev(struct inet6_dev *idev)
2554{
2555	write_lock_bh(&idev->lock);
2556	spin_lock_init(&idev->mc_lock);
2557	idev->mc_gq_running = 0;
2558	timer_setup(&idev->mc_gq_timer, mld_gq_timer_expire, 0);
 
2559	idev->mc_tomb = NULL;
2560	idev->mc_ifc_count = 0;
2561	timer_setup(&idev->mc_ifc_timer, mld_ifc_timer_expire, 0);
2562	timer_setup(&idev->mc_dad_timer, mld_dad_timer_expire, 0);
2563	ipv6_mc_reset(idev);
 
 
 
 
 
 
 
 
2564	write_unlock_bh(&idev->lock);
2565}
2566
2567/*
2568 *	Device is about to be destroyed: clean up.
2569 */
2570
2571void ipv6_mc_destroy_dev(struct inet6_dev *idev)
2572{
2573	struct ifmcaddr6 *i;
2574
2575	/* Deactivate timers */
2576	ipv6_mc_down(idev);
2577	mld_clear_delrec(idev);
2578
2579	/* Delete all-nodes address. */
2580	/* We cannot call ipv6_dev_mc_dec() directly, our caller in
2581	 * addrconf.c has NULL'd out dev->ip6_ptr so in6_dev_get() will
2582	 * fail.
2583	 */
2584	__ipv6_dev_mc_dec(idev, &in6addr_linklocal_allnodes);
2585
2586	if (idev->cnf.forwarding)
2587		__ipv6_dev_mc_dec(idev, &in6addr_linklocal_allrouters);
2588
2589	write_lock_bh(&idev->lock);
2590	while ((i = idev->mc_list) != NULL) {
2591		idev->mc_list = i->next;
 
2592
2593		write_unlock_bh(&idev->lock);
2594		ma_put(i);
 
2595		write_lock_bh(&idev->lock);
2596	}
2597	write_unlock_bh(&idev->lock);
2598}
2599
2600static void ipv6_mc_rejoin_groups(struct inet6_dev *idev)
2601{
2602	struct ifmcaddr6 *pmc;
2603
2604	ASSERT_RTNL();
2605
2606	if (mld_in_v1_mode(idev)) {
2607		read_lock_bh(&idev->lock);
2608		for (pmc = idev->mc_list; pmc; pmc = pmc->next)
2609			igmp6_join_group(pmc);
2610		read_unlock_bh(&idev->lock);
2611	} else
2612		mld_send_report(idev, NULL);
2613}
2614
2615static int ipv6_mc_netdev_event(struct notifier_block *this,
2616				unsigned long event,
2617				void *ptr)
2618{
2619	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
2620	struct inet6_dev *idev = __in6_dev_get(dev);
2621
2622	switch (event) {
2623	case NETDEV_RESEND_IGMP:
2624		if (idev)
2625			ipv6_mc_rejoin_groups(idev);
2626		break;
2627	default:
2628		break;
2629	}
2630
2631	return NOTIFY_DONE;
2632}
2633
2634static struct notifier_block igmp6_netdev_notifier = {
2635	.notifier_call = ipv6_mc_netdev_event,
2636};
2637
2638#ifdef CONFIG_PROC_FS
2639struct igmp6_mc_iter_state {
2640	struct seq_net_private p;
2641	struct net_device *dev;
2642	struct inet6_dev *idev;
2643};
2644
2645#define igmp6_mc_seq_private(seq)	((struct igmp6_mc_iter_state *)(seq)->private)
2646
2647static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
2648{
2649	struct ifmcaddr6 *im = NULL;
2650	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2651	struct net *net = seq_file_net(seq);
2652
2653	state->idev = NULL;
2654	for_each_netdev_rcu(net, state->dev) {
2655		struct inet6_dev *idev;
2656		idev = __in6_dev_get(state->dev);
2657		if (!idev)
2658			continue;
2659		read_lock_bh(&idev->lock);
2660		im = idev->mc_list;
2661		if (im) {
2662			state->idev = idev;
2663			break;
2664		}
2665		read_unlock_bh(&idev->lock);
2666	}
2667	return im;
2668}
2669
2670static struct ifmcaddr6 *igmp6_mc_get_next(struct seq_file *seq, struct ifmcaddr6 *im)
2671{
2672	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2673
2674	im = im->next;
2675	while (!im) {
2676		if (likely(state->idev))
2677			read_unlock_bh(&state->idev->lock);
2678
2679		state->dev = next_net_device_rcu(state->dev);
2680		if (!state->dev) {
2681			state->idev = NULL;
2682			break;
2683		}
2684		state->idev = __in6_dev_get(state->dev);
2685		if (!state->idev)
2686			continue;
2687		read_lock_bh(&state->idev->lock);
2688		im = state->idev->mc_list;
2689	}
2690	return im;
2691}
2692
2693static struct ifmcaddr6 *igmp6_mc_get_idx(struct seq_file *seq, loff_t pos)
2694{
2695	struct ifmcaddr6 *im = igmp6_mc_get_first(seq);
2696	if (im)
2697		while (pos && (im = igmp6_mc_get_next(seq, im)) != NULL)
2698			--pos;
2699	return pos ? NULL : im;
2700}
2701
2702static void *igmp6_mc_seq_start(struct seq_file *seq, loff_t *pos)
2703	__acquires(RCU)
2704{
2705	rcu_read_lock();
2706	return igmp6_mc_get_idx(seq, *pos);
2707}
2708
2709static void *igmp6_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2710{
2711	struct ifmcaddr6 *im = igmp6_mc_get_next(seq, v);
2712
2713	++*pos;
2714	return im;
2715}
2716
2717static void igmp6_mc_seq_stop(struct seq_file *seq, void *v)
2718	__releases(RCU)
2719{
2720	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2721
2722	if (likely(state->idev)) {
2723		read_unlock_bh(&state->idev->lock);
2724		state->idev = NULL;
2725	}
2726	state->dev = NULL;
2727	rcu_read_unlock();
2728}
2729
2730static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
2731{
2732	struct ifmcaddr6 *im = (struct ifmcaddr6 *)v;
2733	struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2734
2735	seq_printf(seq,
2736		   "%-4d %-15s %pi6 %5d %08X %ld\n",
2737		   state->dev->ifindex, state->dev->name,
2738		   &im->mca_addr,
2739		   im->mca_users, im->mca_flags,
2740		   (im->mca_flags&MAF_TIMER_RUNNING) ?
2741		   jiffies_to_clock_t(im->mca_timer.expires-jiffies) : 0);
2742	return 0;
2743}
2744
2745static const struct seq_operations igmp6_mc_seq_ops = {
2746	.start	=	igmp6_mc_seq_start,
2747	.next	=	igmp6_mc_seq_next,
2748	.stop	=	igmp6_mc_seq_stop,
2749	.show	=	igmp6_mc_seq_show,
2750};
2751
2752static int igmp6_mc_seq_open(struct inode *inode, struct file *file)
2753{
2754	return seq_open_net(inode, file, &igmp6_mc_seq_ops,
2755			    sizeof(struct igmp6_mc_iter_state));
2756}
2757
2758static const struct file_operations igmp6_mc_seq_fops = {
 
2759	.open		=	igmp6_mc_seq_open,
2760	.read		=	seq_read,
2761	.llseek		=	seq_lseek,
2762	.release	=	seq_release_net,
2763};
2764
2765struct igmp6_mcf_iter_state {
2766	struct seq_net_private p;
2767	struct net_device *dev;
2768	struct inet6_dev *idev;
2769	struct ifmcaddr6 *im;
2770};
2771
2772#define igmp6_mcf_seq_private(seq)	((struct igmp6_mcf_iter_state *)(seq)->private)
2773
2774static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
2775{
2776	struct ip6_sf_list *psf = NULL;
2777	struct ifmcaddr6 *im = NULL;
2778	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2779	struct net *net = seq_file_net(seq);
2780
2781	state->idev = NULL;
2782	state->im = NULL;
2783	for_each_netdev_rcu(net, state->dev) {
2784		struct inet6_dev *idev;
2785		idev = __in6_dev_get(state->dev);
2786		if (unlikely(idev == NULL))
2787			continue;
2788		read_lock_bh(&idev->lock);
2789		im = idev->mc_list;
2790		if (likely(im)) {
2791			spin_lock_bh(&im->mca_lock);
2792			psf = im->mca_sources;
2793			if (likely(psf)) {
2794				state->im = im;
2795				state->idev = idev;
2796				break;
2797			}
2798			spin_unlock_bh(&im->mca_lock);
2799		}
2800		read_unlock_bh(&idev->lock);
2801	}
2802	return psf;
2803}
2804
2805static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_sf_list *psf)
2806{
2807	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2808
2809	psf = psf->sf_next;
2810	while (!psf) {
2811		spin_unlock_bh(&state->im->mca_lock);
2812		state->im = state->im->next;
2813		while (!state->im) {
2814			if (likely(state->idev))
2815				read_unlock_bh(&state->idev->lock);
2816
2817			state->dev = next_net_device_rcu(state->dev);
2818			if (!state->dev) {
2819				state->idev = NULL;
2820				goto out;
2821			}
2822			state->idev = __in6_dev_get(state->dev);
2823			if (!state->idev)
2824				continue;
2825			read_lock_bh(&state->idev->lock);
2826			state->im = state->idev->mc_list;
2827		}
2828		if (!state->im)
2829			break;
2830		spin_lock_bh(&state->im->mca_lock);
2831		psf = state->im->mca_sources;
2832	}
2833out:
2834	return psf;
2835}
2836
2837static struct ip6_sf_list *igmp6_mcf_get_idx(struct seq_file *seq, loff_t pos)
2838{
2839	struct ip6_sf_list *psf = igmp6_mcf_get_first(seq);
2840	if (psf)
2841		while (pos && (psf = igmp6_mcf_get_next(seq, psf)) != NULL)
2842			--pos;
2843	return pos ? NULL : psf;
2844}
2845
2846static void *igmp6_mcf_seq_start(struct seq_file *seq, loff_t *pos)
2847	__acquires(RCU)
2848{
2849	rcu_read_lock();
2850	return *pos ? igmp6_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
2851}
2852
2853static void *igmp6_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2854{
2855	struct ip6_sf_list *psf;
2856	if (v == SEQ_START_TOKEN)
2857		psf = igmp6_mcf_get_first(seq);
2858	else
2859		psf = igmp6_mcf_get_next(seq, v);
2860	++*pos;
2861	return psf;
2862}
2863
2864static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
2865	__releases(RCU)
2866{
2867	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2868	if (likely(state->im)) {
2869		spin_unlock_bh(&state->im->mca_lock);
2870		state->im = NULL;
2871	}
2872	if (likely(state->idev)) {
2873		read_unlock_bh(&state->idev->lock);
2874		state->idev = NULL;
2875	}
2876	state->dev = NULL;
2877	rcu_read_unlock();
2878}
2879
2880static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
2881{
2882	struct ip6_sf_list *psf = (struct ip6_sf_list *)v;
2883	struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
2884
2885	if (v == SEQ_START_TOKEN) {
2886		seq_puts(seq, "Idx Device                Multicast Address                   Source Address    INC    EXC\n");
 
 
 
 
2887	} else {
2888		seq_printf(seq,
2889			   "%3d %6.6s %pi6 %pi6 %6lu %6lu\n",
2890			   state->dev->ifindex, state->dev->name,
2891			   &state->im->mca_addr,
2892			   &psf->sf_addr,
2893			   psf->sf_count[MCAST_INCLUDE],
2894			   psf->sf_count[MCAST_EXCLUDE]);
2895	}
2896	return 0;
2897}
2898
2899static const struct seq_operations igmp6_mcf_seq_ops = {
2900	.start	=	igmp6_mcf_seq_start,
2901	.next	=	igmp6_mcf_seq_next,
2902	.stop	=	igmp6_mcf_seq_stop,
2903	.show	=	igmp6_mcf_seq_show,
2904};
2905
2906static int igmp6_mcf_seq_open(struct inode *inode, struct file *file)
2907{
2908	return seq_open_net(inode, file, &igmp6_mcf_seq_ops,
2909			    sizeof(struct igmp6_mcf_iter_state));
2910}
2911
2912static const struct file_operations igmp6_mcf_seq_fops = {
 
2913	.open		=	igmp6_mcf_seq_open,
2914	.read		=	seq_read,
2915	.llseek		=	seq_lseek,
2916	.release	=	seq_release_net,
2917};
2918
2919static int __net_init igmp6_proc_init(struct net *net)
2920{
2921	int err;
2922
2923	err = -ENOMEM;
2924	if (!proc_create("igmp6", 0444, net->proc_net, &igmp6_mc_seq_fops))
2925		goto out;
2926	if (!proc_create("mcfilter6", 0444, net->proc_net,
2927			 &igmp6_mcf_seq_fops))
2928		goto out_proc_net_igmp6;
2929
2930	err = 0;
2931out:
2932	return err;
2933
2934out_proc_net_igmp6:
2935	remove_proc_entry("igmp6", net->proc_net);
2936	goto out;
2937}
2938
2939static void __net_exit igmp6_proc_exit(struct net *net)
2940{
2941	remove_proc_entry("mcfilter6", net->proc_net);
2942	remove_proc_entry("igmp6", net->proc_net);
2943}
2944#else
2945static inline int igmp6_proc_init(struct net *net)
2946{
2947	return 0;
2948}
2949static inline void igmp6_proc_exit(struct net *net)
2950{
2951}
2952#endif
2953
2954static int __net_init igmp6_net_init(struct net *net)
2955{
2956	int err;
2957
2958	err = inet_ctl_sock_create(&net->ipv6.igmp_sk, PF_INET6,
2959				   SOCK_RAW, IPPROTO_ICMPV6, net);
2960	if (err < 0) {
2961		pr_err("Failed to initialize the IGMP6 control socket (err %d)\n",
2962		       err);
2963		goto out;
2964	}
2965
2966	inet6_sk(net->ipv6.igmp_sk)->hop_limit = 1;
2967
2968	err = inet_ctl_sock_create(&net->ipv6.mc_autojoin_sk, PF_INET6,
2969				   SOCK_RAW, IPPROTO_ICMPV6, net);
2970	if (err < 0) {
2971		pr_err("Failed to initialize the IGMP6 autojoin socket (err %d)\n",
2972		       err);
2973		goto out_sock_create;
2974	}
2975
2976	err = igmp6_proc_init(net);
2977	if (err)
2978		goto out_sock_create_autojoin;
2979
2980	return 0;
2981
2982out_sock_create_autojoin:
2983	inet_ctl_sock_destroy(net->ipv6.mc_autojoin_sk);
2984out_sock_create:
2985	inet_ctl_sock_destroy(net->ipv6.igmp_sk);
2986out:
2987	return err;
2988}
2989
2990static void __net_exit igmp6_net_exit(struct net *net)
2991{
2992	inet_ctl_sock_destroy(net->ipv6.igmp_sk);
2993	inet_ctl_sock_destroy(net->ipv6.mc_autojoin_sk);
2994	igmp6_proc_exit(net);
2995}
2996
2997static struct pernet_operations igmp6_net_ops = {
2998	.init = igmp6_net_init,
2999	.exit = igmp6_net_exit,
3000};
3001
3002int __init igmp6_init(void)
3003{
3004	return register_pernet_subsys(&igmp6_net_ops);
3005}
3006
3007int __init igmp6_late_init(void)
3008{
3009	return register_netdevice_notifier(&igmp6_netdev_notifier);
3010}
3011
3012void igmp6_cleanup(void)
3013{
3014	unregister_pernet_subsys(&igmp6_net_ops);
3015}
3016
3017void igmp6_late_cleanup(void)
3018{
3019	unregister_netdevice_notifier(&igmp6_netdev_notifier);
3020}