1 /*
2 * Copyright (c) 2010-2022 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /*
29 * Copyright (c) 2009 Bruce Simpson.
30 * All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. The name of the author may not be used to endorse or promote
41 * products derived from this software without specific prior written
42 * permission.
43 *
44 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
45 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
46 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
47 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
48 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
49 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
50 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
51 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
52 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
53 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
54 * SUCH DAMAGE.
55 */
56
57 /*
58 * IPv6 multicast socket, group, and socket option processing module.
59 * Normative references: RFC 2292, RFC 3492, RFC 3542, RFC 3678, RFC 3810.
60 */
61
62 #include <sys/cdefs.h>
63
64 #include <sys/param.h>
65 #include <sys/systm.h>
66 #include <sys/kernel.h>
67 #include <sys/malloc.h>
68 #include <sys/mbuf.h>
69 #include <sys/protosw.h>
70 #include <sys/socket.h>
71 #include <sys/socketvar.h>
72 #include <sys/protosw.h>
73 #include <sys/tree.h>
74 #include <sys/mcache.h>
75
76 #include <kern/zalloc.h>
77
78 #include <pexpert/pexpert.h>
79
80 #include <net/if.h>
81 #include <net/if_dl.h>
82 #include <net/net_api_stats.h>
83 #include <net/route.h>
84 #include <net/sockaddr_utils.h>
85 #include <net/net_sysctl.h>
86
87 #include <netinet/in.h>
88 #include <netinet/in_var.h>
89 #include <netinet6/in6_var.h>
90 #include <netinet/ip6.h>
91 #include <netinet/icmp6.h>
92 #include <netinet6/ip6_var.h>
93 #include <netinet/in_pcb.h>
94 #include <netinet/tcp.h>
95 #include <netinet/tcp_seq.h>
96 #include <netinet/tcp_var.h>
97 #include <netinet6/nd6.h>
98 #include <netinet6/mld6_var.h>
99 #include <netinet6/scope6_var.h>
100
101 #include <net/sockaddr_utils.h>
102
103 static void im6f_commit(struct in6_mfilter *);
104 static int im6f_get_source(struct in6_mfilter *imf,
105 const struct sockaddr_in6 *psin,
106 struct in6_msource **);
107 static struct in6_msource *
108 im6f_graft(struct in6_mfilter *, const uint8_t,
109 const struct sockaddr_in6 *);
110 static int im6f_prune(struct in6_mfilter *, const struct sockaddr_in6 *);
111 static void im6f_rollback(struct in6_mfilter *);
112 static void im6f_reap(struct in6_mfilter *);
113 static int im6o_grow(struct ip6_moptions *);
114 static size_t im6o_match_group(const struct ip6_moptions *,
115 const struct ifnet *, const struct sockaddr_in6 *);
116 static struct in6_msource *
117 im6o_match_source(const struct ip6_moptions *,
118 const size_t, const struct sockaddr_in6 *);
119 static void im6s_merge(struct ip6_msource *ims,
120 const struct in6_msource *lims, const int rollback);
121 static int in6_mc_get(struct ifnet *, const struct in6_addr *,
122 struct in6_multi **);
123 static int in6m_get_source(struct in6_multi *inm,
124 const struct in6_addr *addr, const int noalloc,
125 struct ip6_msource **pims);
126 static int in6m_is_ifp_detached(const struct in6_multi *);
127 static int in6m_merge(struct in6_multi *, /*const*/ struct in6_mfilter *);
128 static void in6m_reap(struct in6_multi *);
129 static struct ip6_moptions *
130 in6p_findmoptions(struct inpcb *);
131 static int in6p_get_source_filters(struct inpcb *, struct sockopt *);
132 static int in6p_lookup_v4addr(struct ipv6_mreq *, struct ip_mreq *);
133 static int in6p_join_group(struct inpcb *, struct sockopt *);
134 static int in6p_leave_group(struct inpcb *, struct sockopt *);
135 static struct ifnet *
136 in6p_lookup_mcast_ifp(const struct inpcb *,
137 const struct sockaddr_in6 *);
138 static int in6p_block_unblock_source(struct inpcb *, struct sockopt *);
139 static int in6p_set_multicast_if(struct inpcb *, struct sockopt *);
140 static int in6p_set_source_filters(struct inpcb *, struct sockopt *);
141 static int sysctl_ip6_mcast_filters SYSCTL_HANDLER_ARGS;
142 static __inline__ int ip6_msource_cmp(const struct ip6_msource *,
143 const struct ip6_msource *);
144
145 SYSCTL_DECL(_net_inet6_ip6); /* XXX Not in any common header. */
146
147 SYSCTL_NODE(_net_inet6_ip6, OID_AUTO, mcast, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "IPv6 multicast");
148
149 static unsigned long in6_mcast_maxgrpsrc = IPV6_MAX_GROUP_SRC_FILTER;
150 SYSCTL_LONG(_net_inet6_ip6_mcast, OID_AUTO, maxgrpsrc,
151 CTLFLAG_RW | CTLFLAG_LOCKED, &in6_mcast_maxgrpsrc,
152 "Max source filters per group");
153
154 static unsigned long in6_mcast_maxsocksrc = IPV6_MAX_SOCK_SRC_FILTER;
155 SYSCTL_LONG(_net_inet6_ip6_mcast, OID_AUTO, maxsocksrc,
156 CTLFLAG_RW | CTLFLAG_LOCKED, &in6_mcast_maxsocksrc,
157 "Max source filters per socket");
158
159 int in6_mcast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
160 SYSCTL_INT(_net_inet6_ip6_mcast, OID_AUTO, loop, CTLFLAG_RW | CTLFLAG_LOCKED,
161 &in6_mcast_loop, 0, "Loopback multicast datagrams by default");
162
163 SYSCTL_NODE(_net_inet6_ip6_mcast, OID_AUTO, filters,
164 CTLFLAG_RD | CTLFLAG_LOCKED, sysctl_ip6_mcast_filters,
165 "Per-interface stack-wide source filters");
166
167 RB_GENERATE_PREV(ip6_msource_tree, ip6_msource, im6s_link, ip6_msource_cmp);
168
169 #define IN6M_TRACE_HIST_SIZE 32 /* size of trace history */
170
171 /* For gdb */
172 __private_extern__ unsigned int in6m_trace_hist_size = IN6M_TRACE_HIST_SIZE;
173
174 struct in6_multi_dbg {
175 struct in6_multi in6m; /* in6_multi */
176 u_int16_t in6m_refhold_cnt; /* # of ref */
177 u_int16_t in6m_refrele_cnt; /* # of rele */
178 /*
179 * Circular lists of in6m_addref and in6m_remref callers.
180 */
181 ctrace_t in6m_refhold[IN6M_TRACE_HIST_SIZE];
182 ctrace_t in6m_refrele[IN6M_TRACE_HIST_SIZE];
183 /*
184 * Trash list linkage
185 */
186 TAILQ_ENTRY(in6_multi_dbg) in6m_trash_link;
187 };
188
189 /* Lock group and attribute for in6_multihead_lock lock */
190 static LCK_ATTR_DECLARE(in6_multihead_lock_attr, 0, 0);
191 static LCK_GRP_DECLARE(in6_multihead_lock_grp, "in6_multihead");
192
193 /* List of trash in6_multi entries protected by in6m_trash_lock */
194 static TAILQ_HEAD(, in6_multi_dbg) in6m_trash_head = TAILQ_HEAD_INITIALIZER(in6m_trash_head);
195 static LCK_MTX_DECLARE_ATTR(in6m_trash_lock, &in6_multihead_lock_grp,
196 &in6_multihead_lock_attr);
197
198 #if DEBUG
199 static TUNABLE(bool, in6m_debug, "ifa_debug", true); /* debugging (enabled) */
200 #else
201 static TUNABLE(bool, in6m_debug, "ifa_debug", false); /* debugging (disabled) */
202 #endif /* !DEBUG */
203
204 static KALLOC_TYPE_DEFINE(imm_zone, struct in6_multi_mship, NET_KT_DEFAULT);
205 static KALLOC_TYPE_DEFINE(ip6ms_zone, struct ip6_msource, NET_KT_DEFAULT);
206 static KALLOC_TYPE_DEFINE(in6ms_zone, struct in6_msource, NET_KT_DEFAULT);
207
208 static LCK_RW_DECLARE_ATTR(in6_multihead_lock, &in6_multihead_lock_grp,
209 &in6_multihead_lock_attr);
210 struct in6_multihead in6_multihead;
211
212 static struct in6_multi *in6_multi_alloc(zalloc_flags_t);
213 static void in6_multi_free(struct in6_multi *);
214 static void in6_multi_attach(struct in6_multi *);
215 static struct in6_multi_mship *in6_multi_mship_alloc(zalloc_flags_t);
216 static void in6_multi_mship_free(struct in6_multi_mship *);
217 static void in6m_trace(struct in6_multi *, int);
218
219 static struct ip6_msource *ip6ms_alloc(zalloc_flags_t);
220 static void ip6ms_free(struct ip6_msource *);
221 static struct in6_msource *in6ms_alloc(zalloc_flags_t);
222 static void in6ms_free(struct in6_msource *);
223
224 /*
225 * IPv6 source tree comparison function.
226 *
227 * An ordered predicate is necessary; bcmp() is not documented to return
228 * an indication of order, memcmp() is, and is an ISO C99 requirement.
229 */
230 static __inline int
ip6_msource_cmp(const struct ip6_msource * a,const struct ip6_msource * b)231 ip6_msource_cmp(const struct ip6_msource *a, const struct ip6_msource *b)
232 {
233 return memcmp(&a->im6s_addr, &b->im6s_addr, sizeof(struct in6_addr));
234 }
235
236 /*
237 * Inline function which wraps assertions for a valid ifp.
238 */
239 static __inline__ int
in6m_is_ifp_detached(const struct in6_multi * inm)240 in6m_is_ifp_detached(const struct in6_multi *inm)
241 {
242 VERIFY(inm->in6m_ifma != NULL);
243 VERIFY(inm->in6m_ifp == inm->in6m_ifma->ifma_ifp);
244
245 return !ifnet_is_attached(inm->in6m_ifp, 0);
246 }
247
248 /*
249 * Initialize an in6_mfilter structure to a known state at t0, t1
250 * with an empty source filter list.
251 */
252 static __inline__ void
im6f_init(struct in6_mfilter * imf,const uint8_t st0,const uint8_t st1)253 im6f_init(struct in6_mfilter *imf, const uint8_t st0, const uint8_t st1)
254 {
255 memset(imf, 0, sizeof(struct in6_mfilter));
256 RB_INIT(&imf->im6f_sources);
257 imf->im6f_st[0] = st0;
258 imf->im6f_st[1] = st1;
259 }
260
261 /*
262 * Resize the ip6_moptions vector to the next power-of-two minus 1.
263 */
264 static int
im6o_grow(struct ip6_moptions * imo)265 im6o_grow(struct ip6_moptions *imo)
266 {
267 struct in6_multi **nmships;
268 struct in6_multi **omships;
269 struct in6_mfilter *nmfilters;
270 struct in6_mfilter *omfilters;
271 int err;
272 size_t idx;
273 uint16_t oldmax;
274 uint16_t newmax;
275
276 IM6O_LOCK_ASSERT_HELD(imo);
277
278 nmships = NULL;
279 nmfilters = NULL;
280 err = 0;
281 omships = imo->im6o_membership;
282 omfilters = imo->im6o_mfilters;
283 oldmax = imo->im6o_max_memberships;
284 newmax = ((oldmax + 1) * 2) - 1;
285
286 if (newmax > IPV6_MAX_MEMBERSHIPS) {
287 return ETOOMANYREFS;
288 }
289
290 if ((nmships = kalloc_type(struct in6_multi *, newmax,
291 Z_WAITOK | Z_ZERO)) == NULL) {
292 err = ENOMEM;
293 goto cleanup;
294 }
295
296 if ((nmfilters = kalloc_type(struct in6_mfilter, newmax,
297 Z_WAITOK | Z_ZERO)) == NULL) {
298 err = ENOMEM;
299 goto cleanup;
300 }
301
302 /* Copy the existing memberships and release the memory. */
303 if (omships != NULL) {
304 VERIFY(oldmax <= newmax);
305 memcpy(nmships, omships, oldmax * sizeof(struct in6_multi *));
306 kfree_type(struct in6_multi *, oldmax, omships);
307 }
308
309 /* Copy the existing filters and release the memory. */
310 if (omfilters != NULL) {
311 VERIFY(oldmax <= newmax);
312 memcpy(nmfilters, omfilters, oldmax * sizeof(struct in6_mfilter));
313 kfree_type(struct in6_mfilter, oldmax, omfilters);
314 }
315
316 /* Initialize newly allocated source filter heads. */
317 for (idx = oldmax; idx < newmax; idx++) {
318 im6f_init(&nmfilters[idx], MCAST_UNDEFINED, MCAST_EXCLUDE);
319 }
320
321 imo->im6o_membership = nmships;
322 imo->im6o_max_memberships = newmax;
323 nmships = NULL;
324
325 imo->im6o_mfilters = nmfilters;
326 imo->im6o_max_filters = newmax;
327 nmfilters = NULL;
328
329 return 0;
330 cleanup:
331 if (nmfilters != NULL) {
332 kfree_type(struct in6_mfilter, newmax, nmfilters);
333 }
334
335 if (nmships != NULL) {
336 kfree_type(struct in6_multi *, newmax, nmships);
337 }
338
339 return err;
340 }
341
342 /*
343 * Find an IPv6 multicast group entry for this ip6_moptions instance
344 * which matches the specified group, and optionally an interface.
345 * Return its index into the array, or -1 if not found.
346 */
347 static size_t
im6o_match_group(const struct ip6_moptions * imo,const struct ifnet * ifp,const struct sockaddr_in6 * group)348 im6o_match_group(const struct ip6_moptions *imo, const struct ifnet *ifp,
349 const struct sockaddr_in6 *group)
350 {
351 const struct sockaddr_in6 *gsin6;
352 struct in6_multi *pinm;
353 int idx;
354 int nmships;
355
356 IM6O_LOCK_ASSERT_HELD(__DECONST(struct ip6_moptions *, imo));
357
358 gsin6 = group;
359
360 /* The im6o_membership array may be lazy allocated. */
361 if (imo->im6o_membership == NULL || imo->im6o_num_memberships == 0) {
362 return -1;
363 }
364
365 nmships = imo->im6o_num_memberships;
366 for (idx = 0; idx < nmships; idx++) {
367 pinm = imo->im6o_membership[idx];
368 if (pinm == NULL) {
369 continue;
370 }
371 IN6M_LOCK(pinm);
372 if ((ifp == NULL || (pinm->in6m_ifp == ifp)) &&
373 in6_are_addr_equal_scoped(&pinm->in6m_addr,
374 &gsin6->sin6_addr, pinm->ifscope, gsin6->sin6_scope_id)) {
375 IN6M_UNLOCK(pinm);
376 break;
377 }
378 IN6M_UNLOCK(pinm);
379 }
380 if (idx >= nmships) {
381 idx = -1;
382 }
383
384 return idx;
385 }
386
387 /*
388 * Find an IPv6 multicast source entry for this imo which matches
389 * the given group index for this socket, and source address.
390 *
391 * XXX TODO: The scope ID, if present in src, is stripped before
392 * any comparison. We SHOULD enforce scope/zone checks where the source
393 * filter entry has a link scope.
394 *
395 * NOTE: This does not check if the entry is in-mode, merely if
396 * it exists, which may not be the desired behaviour.
397 */
398 static struct in6_msource *
im6o_match_source(const struct ip6_moptions * imo,const size_t gidx,const struct sockaddr_in6 * src)399 im6o_match_source(const struct ip6_moptions *imo, const size_t gidx,
400 const struct sockaddr_in6 *src)
401 {
402 struct ip6_msource find;
403 struct in6_mfilter *imf;
404 struct ip6_msource *ims;
405 const struct sockaddr_in6 *psa;
406
407 IM6O_LOCK_ASSERT_HELD(__DECONST(struct ip6_moptions *, imo));
408
409 VERIFY(src->sin6_family == AF_INET6);
410 VERIFY(gidx != (size_t)-1 && gidx < imo->im6o_num_memberships);
411
412 /* The im6o_mfilters array may be lazy allocated. */
413 if (imo->im6o_mfilters == NULL) {
414 return NULL;
415 }
416 imf = &imo->im6o_mfilters[gidx];
417
418 psa = src;
419 find.im6s_addr = psa->sin6_addr;
420 in6_clearscope(&find.im6s_addr); /* XXX */
421 ims = RB_FIND(ip6_msource_tree, &imf->im6f_sources, &find);
422
423 return (struct in6_msource *)ims;
424 }
425
426 /*
427 * Perform filtering for multicast datagrams on a socket by group and source.
428 *
429 * Returns 0 if a datagram should be allowed through, or various error codes
430 * if the socket was not a member of the group, or the source was muted, etc.
431 */
432 int
im6o_mc_filter(const struct ip6_moptions * imo,struct ifnet * ifp,const struct sockaddr_in6 * group,const struct sockaddr_in6 * src)433 im6o_mc_filter(const struct ip6_moptions *imo, struct ifnet *ifp,
434 const struct sockaddr_in6 *group, const struct sockaddr_in6 *src)
435 {
436 size_t gidx;
437 struct in6_msource *ims;
438 int mode;
439
440 IM6O_LOCK_ASSERT_HELD(__DECONST(struct ip6_moptions *, imo));
441 VERIFY(ifp != NULL);
442
443 struct sockaddr_in6 group_tmp = *group;
444 if (!in6_embedded_scope) {
445 group_tmp.sin6_scope_id = in6_addr2scopeid(ifp, &group_tmp.sin6_addr);
446 }
447 gidx = im6o_match_group(imo, ifp, &group_tmp);
448 if (gidx == (size_t)-1) {
449 return MCAST_NOTGMEMBER;
450 }
451
452 /*
453 * Check if the source was included in an (S,G) join.
454 * Allow reception on exclusive memberships by default,
455 * reject reception on inclusive memberships by default.
456 * Exclude source only if an in-mode exclude filter exists.
457 * Include source only if an in-mode include filter exists.
458 * NOTE: We are comparing group state here at MLD t1 (now)
459 * with socket-layer t0 (since last downcall).
460 */
461 mode = imo->im6o_mfilters[gidx].im6f_st[1];
462 ims = im6o_match_source(imo, gidx, src);
463
464 if ((ims == NULL && mode == MCAST_INCLUDE) ||
465 (ims != NULL && ims->im6sl_st[0] != mode)) {
466 return MCAST_NOTSMEMBER;
467 }
468
469 return MCAST_PASS;
470 }
471
472 /*
473 * Find and return a reference to an in6_multi record for (ifp, group),
474 * and bump its reference count.
475 * If one does not exist, try to allocate it, and update link-layer multicast
476 * filters on ifp to listen for group.
477 * Assumes the IN6_MULTI lock is held across the call.
478 * Return 0 if successful, otherwise return an appropriate error code.
479 */
480 static int
in6_mc_get(struct ifnet * ifp,const struct in6_addr * group,struct in6_multi ** pinm)481 in6_mc_get(struct ifnet *ifp, const struct in6_addr *group,
482 struct in6_multi **pinm)
483 {
484 struct sockaddr_in6 gsin6;
485 struct ifmultiaddr *__single ifma;
486 struct in6_multi *__single inm;
487 int error;
488
489 *pinm = NULL;
490
491 in6_multihead_lock_shared();
492 IN6_LOOKUP_MULTI(group, ifp, inm);
493 if (inm != NULL) {
494 IN6M_LOCK(inm);
495 VERIFY(inm->in6m_reqcnt >= 1);
496 inm->in6m_reqcnt++;
497 VERIFY(inm->in6m_reqcnt != 0);
498 *pinm = inm;
499 IN6M_UNLOCK(inm);
500 in6_multihead_lock_done();
501 /*
502 * We already joined this group; return the in6m
503 * with a refcount held (via lookup) for caller.
504 */
505 return 0;
506 }
507 in6_multihead_lock_done();
508
509 memset(&gsin6, 0, sizeof(gsin6));
510 gsin6.sin6_family = AF_INET6;
511 gsin6.sin6_len = sizeof(struct sockaddr_in6);
512 gsin6.sin6_addr = *group;
513
514 /*
515 * Check if a link-layer group is already associated
516 * with this network-layer group on the given ifnet.
517 */
518 error = if_addmulti(ifp, SA(&gsin6), &ifma);
519 if (error != 0) {
520 return error;
521 }
522
523 /*
524 * See comments in in6m_remref() for access to ifma_protospec.
525 */
526 in6_multihead_lock_exclusive();
527 IFMA_LOCK(ifma);
528 if ((inm = ifma->ifma_protospec) != NULL) {
529 VERIFY(ifma->ifma_addr != NULL);
530 VERIFY(ifma->ifma_addr->sa_family == AF_INET6);
531 IN6M_ADDREF(inm); /* for caller */
532 IFMA_UNLOCK(ifma);
533 IN6M_LOCK(inm);
534 VERIFY(inm->in6m_ifma == ifma);
535 VERIFY(inm->in6m_ifp == ifp);
536 VERIFY(in6_are_addr_equal_scoped(&inm->in6m_addr, group, inm->ifscope, ifp->if_index));
537 if (inm->in6m_debug & IFD_ATTACHED) {
538 VERIFY(inm->in6m_reqcnt >= 1);
539 inm->in6m_reqcnt++;
540 VERIFY(inm->in6m_reqcnt != 0);
541 *pinm = inm;
542 IN6M_UNLOCK(inm);
543 in6_multihead_lock_done();
544 IFMA_REMREF(ifma);
545 /*
546 * We lost the race with another thread doing
547 * in6_mc_get(); since this group has already
548 * been joined; return the inm with a refcount
549 * held for caller.
550 */
551 return 0;
552 }
553 /*
554 * We lost the race with another thread doing in6_delmulti();
555 * the inm referring to the ifma has been detached, thus we
556 * reattach it back to the in6_multihead list, and return the
557 * inm with a refcount held for the caller.
558 */
559 in6_multi_attach(inm);
560 VERIFY((inm->in6m_debug &
561 (IFD_ATTACHED | IFD_TRASHED)) == IFD_ATTACHED);
562 *pinm = inm;
563 IN6M_UNLOCK(inm);
564 in6_multihead_lock_done();
565 IFMA_REMREF(ifma);
566 return 0;
567 }
568 IFMA_UNLOCK(ifma);
569
570 /*
571 * A new in6_multi record is needed; allocate and initialize it.
572 * We DO NOT perform an MLD join as the in6_ layer may need to
573 * push an initial source list down to MLD to support SSM.
574 *
575 * The initial source filter state is INCLUDE, {} as per the RFC.
576 * Pending state-changes per group are subject to a bounds check.
577 */
578 inm = in6_multi_alloc(Z_WAITOK);
579
580 IN6M_LOCK(inm);
581 inm->in6m_addr = *group;
582 inm->ifscope = in6_addr2scopeid(ifp, &inm->in6m_addr);
583 inm->in6m_ifp = ifp;
584 inm->in6m_mli = MLD_IFINFO(ifp);
585 VERIFY(inm->in6m_mli != NULL);
586 MLI_ADDREF(inm->in6m_mli);
587 inm->in6m_ifma = ifma; /* keep refcount from if_addmulti() */
588 inm->in6m_state = MLD_NOT_MEMBER;
589 /*
590 * Pending state-changes per group are subject to a bounds check.
591 */
592 inm->in6m_scq.ifq_maxlen = MLD_MAX_STATE_CHANGES;
593 inm->in6m_st[0].iss_fmode = MCAST_UNDEFINED;
594 inm->in6m_st[1].iss_fmode = MCAST_UNDEFINED;
595 RB_INIT(&inm->in6m_srcs);
596 *pinm = inm;
597 in6_multi_attach(inm);
598 VERIFY((inm->in6m_debug &
599 (IFD_ATTACHED | IFD_TRASHED)) == IFD_ATTACHED);
600 IN6M_ADDREF_LOCKED(inm); /* for caller */
601 IN6M_UNLOCK(inm);
602
603 IFMA_LOCK(ifma);
604 VERIFY(ifma->ifma_protospec == NULL);
605 ifma->ifma_protospec = inm;
606 IFMA_UNLOCK(ifma);
607 in6_multihead_lock_done();
608
609 return 0;
610 }
611
612 /*
613 * Clear recorded source entries for a group.
614 * Used by the MLD code. Caller must hold the IN6_MULTI lock.
615 * FIXME: Should reap.
616 */
617 void
in6m_clear_recorded(struct in6_multi * inm)618 in6m_clear_recorded(struct in6_multi *inm)
619 {
620 struct ip6_msource *ims;
621
622 IN6M_LOCK_ASSERT_HELD(inm);
623
624 RB_FOREACH(ims, ip6_msource_tree, &inm->in6m_srcs) {
625 if (ims->im6s_stp) {
626 ims->im6s_stp = 0;
627 --inm->in6m_st[1].iss_rec;
628 }
629 }
630 VERIFY(inm->in6m_st[1].iss_rec == 0);
631 }
632
633 /*
634 * Record a source as pending for a Source-Group MLDv2 query.
635 * This lives here as it modifies the shared tree.
636 *
637 * inm is the group descriptor.
638 * naddr is the address of the source to record in network-byte order.
639 *
640 * If the net.inet6.mld.sgalloc sysctl is non-zero, we will
641 * lazy-allocate a source node in response to an SG query.
642 * Otherwise, no allocation is performed. This saves some memory
643 * with the trade-off that the source will not be reported to the
644 * router if joined in the window between the query response and
645 * the group actually being joined on the local host.
646 *
647 * VIMAGE: XXX: Currently the mld_sgalloc feature has been removed.
648 * This turns off the allocation of a recorded source entry if
649 * the group has not been joined.
650 *
651 * Return 0 if the source didn't exist or was already marked as recorded.
652 * Return 1 if the source was marked as recorded by this function.
653 * Return <0 if any error occured (negated errno code).
654 */
655 int
in6m_record_source(struct in6_multi * inm,const struct in6_addr * addr)656 in6m_record_source(struct in6_multi *inm, const struct in6_addr *addr)
657 {
658 struct ip6_msource find;
659 struct ip6_msource *ims, *nims;
660
661 IN6M_LOCK_ASSERT_HELD(inm);
662
663 find.im6s_addr = *addr;
664 ims = RB_FIND(ip6_msource_tree, &inm->in6m_srcs, &find);
665 if (ims && ims->im6s_stp) {
666 return 0;
667 }
668 if (ims == NULL) {
669 if (inm->in6m_nsrc == in6_mcast_maxgrpsrc) {
670 return -ENOSPC;
671 }
672 nims = ip6ms_alloc(Z_WAITOK);
673 nims->im6s_addr = find.im6s_addr;
674 RB_INSERT(ip6_msource_tree, &inm->in6m_srcs, nims);
675 ++inm->in6m_nsrc;
676 ims = nims;
677 }
678
679 /*
680 * Mark the source as recorded and update the recorded
681 * source count.
682 */
683 ++ims->im6s_stp;
684 ++inm->in6m_st[1].iss_rec;
685
686 return 1;
687 }
688
689 /*
690 * Return a pointer to an in6_msource owned by an in6_mfilter,
691 * given its source address.
692 * Lazy-allocate if needed. If this is a new entry its filter state is
693 * undefined at t0.
694 *
695 * imf is the filter set being modified.
696 * addr is the source address.
697 *
698 * Caller is expected to be holding im6o_lock.
699 */
700 static int
im6f_get_source(struct in6_mfilter * imf,const struct sockaddr_in6 * psin,struct in6_msource ** plims)701 im6f_get_source(struct in6_mfilter *imf, const struct sockaddr_in6 *psin,
702 struct in6_msource **plims)
703 {
704 struct ip6_msource find;
705 struct ip6_msource *ims;
706 struct in6_msource *lims;
707 int error;
708
709 error = 0;
710 ims = NULL;
711 lims = NULL;
712
713 find.im6s_addr = psin->sin6_addr;
714 ims = RB_FIND(ip6_msource_tree, &imf->im6f_sources, &find);
715 lims = (struct in6_msource *)ims;
716 if (lims == NULL) {
717 if (imf->im6f_nsrc == in6_mcast_maxsocksrc) {
718 return ENOSPC;
719 }
720 lims = in6ms_alloc(Z_WAITOK);
721 lims->im6s_addr = find.im6s_addr;
722 lims->im6sl_st[0] = MCAST_UNDEFINED;
723 RB_INSERT(ip6_msource_tree, &imf->im6f_sources,
724 (struct ip6_msource *)lims);
725 ++imf->im6f_nsrc;
726 }
727
728 *plims = lims;
729
730 return error;
731 }
732
733 /*
734 * Graft a source entry into an existing socket-layer filter set,
735 * maintaining any required invariants and checking allocations.
736 *
737 * The source is marked as being in the new filter mode at t1.
738 *
739 * Return the pointer to the new node, otherwise return NULL.
740 *
741 * Caller is expected to be holding im6o_lock.
742 */
743 static struct in6_msource *
im6f_graft(struct in6_mfilter * imf,const uint8_t st1,const struct sockaddr_in6 * psin)744 im6f_graft(struct in6_mfilter *imf, const uint8_t st1,
745 const struct sockaddr_in6 *psin)
746 {
747 struct in6_msource *lims;
748 struct ip6_msource *__single lims_forged;
749
750 lims = in6ms_alloc(Z_WAITOK);
751 lims->im6s_addr = psin->sin6_addr;
752 lims->im6sl_st[0] = MCAST_UNDEFINED;
753 lims->im6sl_st[1] = st1;
754
755 /* Removal of __unsafe_forge_single tracked by rdar://121702748 */
756 lims_forged = __unsafe_forge_single(struct ip6_msource *, lims);
757 RB_INSERT(ip6_msource_tree, &imf->im6f_sources,
758 lims_forged);
759 ++imf->im6f_nsrc;
760
761 return lims;
762 }
763
764 /*
765 * Prune a source entry from an existing socket-layer filter set,
766 * maintaining any required invariants and checking allocations.
767 *
768 * The source is marked as being left at t1, it is not freed.
769 *
770 * Return 0 if no error occurred, otherwise return an errno value.
771 *
772 * Caller is expected to be holding im6o_lock.
773 */
774 static int
im6f_prune(struct in6_mfilter * imf,const struct sockaddr_in6 * psin)775 im6f_prune(struct in6_mfilter *imf, const struct sockaddr_in6 *psin)
776 {
777 struct ip6_msource find;
778 struct ip6_msource *ims;
779 struct in6_msource *lims;
780
781 find.im6s_addr = psin->sin6_addr;
782 ims = RB_FIND(ip6_msource_tree, &imf->im6f_sources, &find);
783 if (ims == NULL) {
784 return ENOENT;
785 }
786 lims = (struct in6_msource *)ims;
787 lims->im6sl_st[1] = MCAST_UNDEFINED;
788 return 0;
789 }
790
791 /*
792 * Revert socket-layer filter set deltas at t1 to t0 state.
793 *
794 * Caller is expected to be holding im6o_lock.
795 */
796 static void
im6f_rollback(struct in6_mfilter * imf)797 im6f_rollback(struct in6_mfilter *imf)
798 {
799 struct ip6_msource *ims, *tims;
800 struct in6_msource *lims;
801
802 RB_FOREACH_SAFE(ims, ip6_msource_tree, &imf->im6f_sources, tims) {
803 lims = (struct in6_msource *)ims;
804 if (lims->im6sl_st[0] == lims->im6sl_st[1]) {
805 /* no change at t1 */
806 continue;
807 } else if (lims->im6sl_st[0] != MCAST_UNDEFINED) {
808 /* revert change to existing source at t1 */
809 lims->im6sl_st[1] = lims->im6sl_st[0];
810 } else {
811 /* revert source added t1 */
812 MLD_PRINTF(("%s: free in6ms 0x%llx\n", __func__,
813 (uint64_t)VM_KERNEL_ADDRPERM(lims)));
814 RB_REMOVE(ip6_msource_tree, &imf->im6f_sources, ims);
815 in6ms_free(lims);
816 imf->im6f_nsrc--;
817 }
818 }
819 imf->im6f_st[1] = imf->im6f_st[0];
820 }
821
822 /*
823 * Mark socket-layer filter set as INCLUDE {} at t1.
824 *
825 * Caller is expected to be holding im6o_lock.
826 */
827 void
im6f_leave(struct in6_mfilter * imf)828 im6f_leave(struct in6_mfilter *imf)
829 {
830 struct ip6_msource *ims;
831 struct in6_msource *lims;
832
833 RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
834 lims = (struct in6_msource *)ims;
835 lims->im6sl_st[1] = MCAST_UNDEFINED;
836 }
837 imf->im6f_st[1] = MCAST_INCLUDE;
838 }
839
840 /*
841 * Mark socket-layer filter set deltas as committed.
842 *
843 * Caller is expected to be holding im6o_lock.
844 */
845 static void
im6f_commit(struct in6_mfilter * imf)846 im6f_commit(struct in6_mfilter *imf)
847 {
848 struct ip6_msource *ims;
849 struct in6_msource *lims;
850
851 RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
852 lims = (struct in6_msource *)ims;
853 lims->im6sl_st[0] = lims->im6sl_st[1];
854 }
855 imf->im6f_st[0] = imf->im6f_st[1];
856 }
857
858 /*
859 * Reap unreferenced sources from socket-layer filter set.
860 *
861 * Caller is expected to be holding im6o_lock.
862 */
863 static void
im6f_reap(struct in6_mfilter * imf)864 im6f_reap(struct in6_mfilter *imf)
865 {
866 struct ip6_msource *ims, *tims;
867 struct in6_msource *lims;
868
869 RB_FOREACH_SAFE(ims, ip6_msource_tree, &imf->im6f_sources, tims) {
870 lims = (struct in6_msource *)ims;
871 if ((lims->im6sl_st[0] == MCAST_UNDEFINED) &&
872 (lims->im6sl_st[1] == MCAST_UNDEFINED)) {
873 MLD_PRINTF(("%s: free in6ms 0x%llx\n", __func__,
874 (uint64_t)VM_KERNEL_ADDRPERM(lims)));
875 RB_REMOVE(ip6_msource_tree, &imf->im6f_sources, ims);
876 in6ms_free(lims);
877 imf->im6f_nsrc--;
878 }
879 }
880 }
881
882 /*
883 * Purge socket-layer filter set.
884 *
885 * Caller is expected to be holding im6o_lock.
886 */
887 void
im6f_purge(struct in6_mfilter * imf)888 im6f_purge(struct in6_mfilter *imf)
889 {
890 struct ip6_msource *ims, *tims;
891 struct in6_msource *lims;
892
893 RB_FOREACH_SAFE(ims, ip6_msource_tree, &imf->im6f_sources, tims) {
894 lims = (struct in6_msource *)ims;
895 MLD_PRINTF(("%s: free in6ms 0x%llx\n", __func__,
896 (uint64_t)VM_KERNEL_ADDRPERM(lims)));
897 RB_REMOVE(ip6_msource_tree, &imf->im6f_sources, ims);
898 in6ms_free(lims);
899 imf->im6f_nsrc--;
900 }
901 imf->im6f_st[0] = imf->im6f_st[1] = MCAST_UNDEFINED;
902 VERIFY(RB_EMPTY(&imf->im6f_sources));
903 }
904
905 /*
906 * Look up a source filter entry for a multicast group.
907 *
908 * inm is the group descriptor to work with.
909 * addr is the IPv6 address to look up.
910 * noalloc may be non-zero to suppress allocation of sources.
911 * *pims will be set to the address of the retrieved or allocated source.
912 *
913 * Return 0 if successful, otherwise return a non-zero error code.
914 */
915 static int
in6m_get_source(struct in6_multi * inm,const struct in6_addr * addr,const int noalloc,struct ip6_msource ** pims)916 in6m_get_source(struct in6_multi *inm, const struct in6_addr *addr,
917 const int noalloc, struct ip6_msource **pims)
918 {
919 struct ip6_msource find;
920 struct ip6_msource *ims, *nims;
921
922 IN6M_LOCK_ASSERT_HELD(inm);
923
924 find.im6s_addr = *addr;
925 ims = RB_FIND(ip6_msource_tree, &inm->in6m_srcs, &find);
926 if (ims == NULL && !noalloc) {
927 if (inm->in6m_nsrc == in6_mcast_maxgrpsrc) {
928 return ENOSPC;
929 }
930 nims = ip6ms_alloc(Z_WAITOK);
931 nims->im6s_addr = *addr;
932 RB_INSERT(ip6_msource_tree, &inm->in6m_srcs, nims);
933 ++inm->in6m_nsrc;
934 ims = nims;
935 MLD_PRINTF(("%s: allocated %s as 0x%llx\n", __func__,
936 ip6_sprintf(addr), (uint64_t)VM_KERNEL_ADDRPERM(ims)));
937 }
938
939 *pims = ims;
940 return 0;
941 }
942
943 /*
944 * Helper function to derive the filter mode on a source entry
945 * from its internal counters. Predicates are:
946 * A source is only excluded if all listeners exclude it.
947 * A source is only included if no listeners exclude it,
948 * and at least one listener includes it.
949 * May be used by ifmcstat(8).
950 */
951 uint8_t
im6s_get_mode(const struct in6_multi * inm,const struct ip6_msource * ims,uint8_t t)952 im6s_get_mode(const struct in6_multi *inm, const struct ip6_msource *ims,
953 uint8_t t)
954 {
955 IN6M_LOCK_ASSERT_HELD(__DECONST(struct in6_multi *, inm));
956
957 t = !!t;
958 if (inm->in6m_st[t].iss_ex > 0 &&
959 inm->in6m_st[t].iss_ex == ims->im6s_st[t].ex) {
960 return MCAST_EXCLUDE;
961 } else if (ims->im6s_st[t].in > 0 && ims->im6s_st[t].ex == 0) {
962 return MCAST_INCLUDE;
963 }
964 return MCAST_UNDEFINED;
965 }
966
967 /*
968 * Merge socket-layer source into MLD-layer source.
969 * If rollback is non-zero, perform the inverse of the merge.
970 */
971 static void
im6s_merge(struct ip6_msource * ims,const struct in6_msource * lims,const int rollback)972 im6s_merge(struct ip6_msource *ims, const struct in6_msource *lims,
973 const int rollback)
974 {
975 int n = rollback ? -1 : 1;
976
977 if (lims->im6sl_st[0] == MCAST_EXCLUDE) {
978 MLD_PRINTF(("%s: t1 ex -= %d on %s\n", __func__, n,
979 ip6_sprintf(&lims->im6s_addr)));
980 ims->im6s_st[1].ex -= n;
981 } else if (lims->im6sl_st[0] == MCAST_INCLUDE) {
982 MLD_PRINTF(("%s: t1 in -= %d on %s\n", __func__, n,
983 ip6_sprintf(&lims->im6s_addr)));
984 ims->im6s_st[1].in -= n;
985 }
986
987 if (lims->im6sl_st[1] == MCAST_EXCLUDE) {
988 MLD_PRINTF(("%s: t1 ex += %d on %s\n", __func__, n,
989 ip6_sprintf(&lims->im6s_addr)));
990 ims->im6s_st[1].ex += n;
991 } else if (lims->im6sl_st[1] == MCAST_INCLUDE) {
992 MLD_PRINTF(("%s: t1 in += %d on %s\n", __func__, n,
993 ip6_sprintf(&lims->im6s_addr)));
994 ims->im6s_st[1].in += n;
995 }
996 }
997
998 /*
999 * Atomically update the global in6_multi state, when a membership's
1000 * filter list is being updated in any way.
1001 *
1002 * imf is the per-inpcb-membership group filter pointer.
1003 * A fake imf may be passed for in-kernel consumers.
1004 *
1005 * XXX This is a candidate for a set-symmetric-difference style loop
1006 * which would eliminate the repeated lookup from root of ims nodes,
1007 * as they share the same key space.
1008 *
1009 * If any error occurred this function will back out of refcounts
1010 * and return a non-zero value.
1011 */
1012 static int
in6m_merge(struct in6_multi * inm,struct in6_mfilter * imf)1013 in6m_merge(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf)
1014 {
1015 struct ip6_msource *ims, *__single nims = NULL;
1016 struct in6_msource *lims;
1017 int schanged, error;
1018 int nsrc0, nsrc1;
1019
1020 IN6M_LOCK_ASSERT_HELD(inm);
1021
1022 schanged = 0;
1023 error = 0;
1024 nsrc1 = nsrc0 = 0;
1025
1026 /*
1027 * Update the source filters first, as this may fail.
1028 * Maintain count of in-mode filters at t0, t1. These are
1029 * used to work out if we transition into ASM mode or not.
1030 * Maintain a count of source filters whose state was
1031 * actually modified by this operation.
1032 */
1033 RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
1034 lims = (struct in6_msource *)ims;
1035 if (lims->im6sl_st[0] == imf->im6f_st[0]) {
1036 nsrc0++;
1037 }
1038 if (lims->im6sl_st[1] == imf->im6f_st[1]) {
1039 nsrc1++;
1040 }
1041 if (lims->im6sl_st[0] == lims->im6sl_st[1]) {
1042 continue;
1043 }
1044 error = in6m_get_source(inm, &lims->im6s_addr, 0, &nims);
1045 ++schanged;
1046 if (error) {
1047 break;
1048 }
1049 im6s_merge(nims, lims, 0);
1050 }
1051 if (error) {
1052 struct ip6_msource *__single bims;
1053
1054 RB_FOREACH_REVERSE_FROM(ims, ip6_msource_tree, nims) {
1055 lims = (struct in6_msource *)ims;
1056 if (lims->im6sl_st[0] == lims->im6sl_st[1]) {
1057 continue;
1058 }
1059 (void) in6m_get_source(inm, &lims->im6s_addr, 1, &bims);
1060 if (bims == NULL) {
1061 continue;
1062 }
1063 im6s_merge(bims, lims, 1);
1064 }
1065 goto out_reap;
1066 }
1067
1068 MLD_PRINTF(("%s: imf filters in-mode: %d at t0, %d at t1\n",
1069 __func__, nsrc0, nsrc1));
1070
1071 /* Handle transition between INCLUDE {n} and INCLUDE {} on socket. */
1072 if (imf->im6f_st[0] == imf->im6f_st[1] &&
1073 imf->im6f_st[1] == MCAST_INCLUDE) {
1074 if (nsrc1 == 0) {
1075 MLD_PRINTF(("%s: --in on inm at t1\n", __func__));
1076 --inm->in6m_st[1].iss_in;
1077 }
1078 }
1079
1080 /* Handle filter mode transition on socket. */
1081 if (imf->im6f_st[0] != imf->im6f_st[1]) {
1082 MLD_PRINTF(("%s: imf transition %d to %d\n",
1083 __func__, imf->im6f_st[0], imf->im6f_st[1]));
1084
1085 if (imf->im6f_st[0] == MCAST_EXCLUDE) {
1086 MLD_PRINTF(("%s: --ex on inm at t1\n", __func__));
1087 --inm->in6m_st[1].iss_ex;
1088 } else if (imf->im6f_st[0] == MCAST_INCLUDE) {
1089 MLD_PRINTF(("%s: --in on inm at t1\n", __func__));
1090 --inm->in6m_st[1].iss_in;
1091 }
1092
1093 if (imf->im6f_st[1] == MCAST_EXCLUDE) {
1094 MLD_PRINTF(("%s: ex++ on inm at t1\n", __func__));
1095 inm->in6m_st[1].iss_ex++;
1096 } else if (imf->im6f_st[1] == MCAST_INCLUDE && nsrc1 > 0) {
1097 MLD_PRINTF(("%s: in++ on inm at t1\n", __func__));
1098 inm->in6m_st[1].iss_in++;
1099 }
1100 }
1101
1102 /*
1103 * Track inm filter state in terms of listener counts.
1104 * If there are any exclusive listeners, stack-wide
1105 * membership is exclusive.
1106 * Otherwise, if only inclusive listeners, stack-wide is inclusive.
1107 * If no listeners remain, state is undefined at t1,
1108 * and the MLD lifecycle for this group should finish.
1109 */
1110 if (inm->in6m_st[1].iss_ex > 0) {
1111 MLD_PRINTF(("%s: transition to EX\n", __func__));
1112 inm->in6m_st[1].iss_fmode = MCAST_EXCLUDE;
1113 } else if (inm->in6m_st[1].iss_in > 0) {
1114 MLD_PRINTF(("%s: transition to IN\n", __func__));
1115 inm->in6m_st[1].iss_fmode = MCAST_INCLUDE;
1116 } else {
1117 MLD_PRINTF(("%s: transition to UNDEF\n", __func__));
1118 inm->in6m_st[1].iss_fmode = MCAST_UNDEFINED;
1119 }
1120
1121 /* Decrement ASM listener count on transition out of ASM mode. */
1122 if (imf->im6f_st[0] == MCAST_EXCLUDE && nsrc0 == 0) {
1123 if ((imf->im6f_st[1] != MCAST_EXCLUDE) ||
1124 (imf->im6f_st[1] == MCAST_EXCLUDE && nsrc1 > 0)) {
1125 MLD_PRINTF(("%s: --asm on inm at t1\n", __func__));
1126 --inm->in6m_st[1].iss_asm;
1127 }
1128 }
1129
1130 /* Increment ASM listener count on transition to ASM mode. */
1131 if (imf->im6f_st[1] == MCAST_EXCLUDE && nsrc1 == 0) {
1132 MLD_PRINTF(("%s: asm++ on inm at t1\n", __func__));
1133 inm->in6m_st[1].iss_asm++;
1134 }
1135
1136 MLD_PRINTF(("%s: merged imf 0x%llx to inm 0x%llx\n", __func__,
1137 (uint64_t)VM_KERNEL_ADDRPERM(imf),
1138 (uint64_t)VM_KERNEL_ADDRPERM(inm)));
1139 in6m_print(inm);
1140
1141 out_reap:
1142 if (schanged > 0) {
1143 MLD_PRINTF(("%s: sources changed; reaping\n", __func__));
1144 in6m_reap(inm);
1145 }
1146 return error;
1147 }
1148
1149 /*
1150 * Mark an in6_multi's filter set deltas as committed.
1151 * Called by MLD after a state change has been enqueued.
1152 */
1153 void
in6m_commit(struct in6_multi * inm)1154 in6m_commit(struct in6_multi *inm)
1155 {
1156 struct ip6_msource *ims;
1157
1158 IN6M_LOCK_ASSERT_HELD(inm);
1159
1160 MLD_PRINTF(("%s: commit inm 0x%llx\n", __func__,
1161 (uint64_t)VM_KERNEL_ADDRPERM(inm)));
1162 MLD_PRINTF(("%s: pre commit:\n", __func__));
1163 in6m_print(inm);
1164
1165 RB_FOREACH(ims, ip6_msource_tree, &inm->in6m_srcs) {
1166 ims->im6s_st[0] = ims->im6s_st[1];
1167 }
1168 inm->in6m_st[0] = inm->in6m_st[1];
1169 }
1170
1171 /*
1172 * Reap unreferenced nodes from an in6_multi's filter set.
1173 */
1174 static void
in6m_reap(struct in6_multi * inm)1175 in6m_reap(struct in6_multi *inm)
1176 {
1177 struct ip6_msource *ims, *tims;
1178
1179 IN6M_LOCK_ASSERT_HELD(inm);
1180
1181 RB_FOREACH_SAFE(ims, ip6_msource_tree, &inm->in6m_srcs, tims) {
1182 if (ims->im6s_st[0].ex > 0 || ims->im6s_st[0].in > 0 ||
1183 ims->im6s_st[1].ex > 0 || ims->im6s_st[1].in > 0 ||
1184 ims->im6s_stp != 0) {
1185 continue;
1186 }
1187 MLD_PRINTF(("%s: free ims 0x%llx\n", __func__,
1188 (uint64_t)VM_KERNEL_ADDRPERM(ims)));
1189 RB_REMOVE(ip6_msource_tree, &inm->in6m_srcs, ims);
1190 ip6ms_free(ims);
1191 inm->in6m_nsrc--;
1192 }
1193 }
1194
1195 /*
1196 * Purge all source nodes from an in6_multi's filter set.
1197 */
1198 void
in6m_purge(struct in6_multi * inm)1199 in6m_purge(struct in6_multi *inm)
1200 {
1201 struct ip6_msource *ims, *tims;
1202
1203 IN6M_LOCK_ASSERT_HELD(inm);
1204
1205 RB_FOREACH_SAFE(ims, ip6_msource_tree, &inm->in6m_srcs, tims) {
1206 MLD_PRINTF(("%s: free ims 0x%llx\n", __func__,
1207 (uint64_t)VM_KERNEL_ADDRPERM(ims)));
1208 RB_REMOVE(ip6_msource_tree, &inm->in6m_srcs, ims);
1209 ip6ms_free(ims);
1210 inm->in6m_nsrc--;
1211 }
1212 }
1213
1214 /*
1215 * Join a multicast address w/o sources.
1216 * KAME compatibility entry point.
1217 *
1218 */
1219 struct in6_multi_mship *
in6_joingroup(struct ifnet * ifp,struct in6_addr * mcaddr,int * errorp,int delay)1220 in6_joingroup(struct ifnet *ifp, struct in6_addr *mcaddr,
1221 int *errorp, int delay)
1222 {
1223 struct in6_multi_mship *imm;
1224 int error;
1225
1226 *errorp = 0;
1227
1228 imm = in6_multi_mship_alloc(Z_WAITOK);
1229
1230 error = in6_mc_join(ifp, mcaddr, NULL, &imm->i6mm_maddr, delay);
1231 if (error) {
1232 *errorp = error;
1233 in6_multi_mship_free(imm);
1234 return NULL;
1235 }
1236
1237 return imm;
1238 }
1239
1240 /*
1241 * Leave a multicast address w/o sources.
1242 * KAME compatibility entry point.
1243 */
1244 int
in6_leavegroup(struct in6_multi_mship * imm)1245 in6_leavegroup(struct in6_multi_mship *imm)
1246 {
1247 if (imm->i6mm_maddr != NULL) {
1248 in6_mc_leave(imm->i6mm_maddr, NULL);
1249 IN6M_REMREF(imm->i6mm_maddr);
1250 imm->i6mm_maddr = NULL;
1251 }
1252 in6_multi_mship_free(imm);
1253 return 0;
1254 }
1255
1256 /*
1257 * Join a multicast group; real entry point.
1258 *
1259 * Only preserves atomicity at inm level.
1260 * NOTE: imf argument cannot be const due to sys/tree.h limitations.
1261 *
1262 * If the MLD downcall fails, the group is not joined, and an error
1263 * code is returned.
1264 */
1265 int
in6_mc_join(struct ifnet * ifp,const struct in6_addr * mcaddr,struct in6_mfilter * imf,struct in6_multi ** pinm,const int delay)1266 in6_mc_join(struct ifnet *ifp, const struct in6_addr *mcaddr,
1267 /*const*/ struct in6_mfilter *imf, struct in6_multi **pinm,
1268 const int delay)
1269 {
1270 struct in6_mfilter timf;
1271 struct in6_multi *__single inm = NULL;
1272 int error = 0;
1273 struct mld_tparams mtp;
1274
1275 /*
1276 * Sanity: Check scope zone ID was set for ifp, if and
1277 * only if group is scoped to an interface.
1278 */
1279 VERIFY(IN6_IS_ADDR_MULTICAST(mcaddr));
1280 if (in6_embedded_scope && (IN6_IS_ADDR_MC_LINKLOCAL(mcaddr) ||
1281 IN6_IS_ADDR_MC_INTFACELOCAL(mcaddr))) {
1282 VERIFY(mcaddr->s6_addr16[1] != 0);
1283 }
1284
1285 MLD_PRINTF(("%s: join %s on 0x%llx(%s))\n", __func__,
1286 ip6_sprintf(mcaddr), (uint64_t)VM_KERNEL_ADDRPERM(ifp),
1287 if_name(ifp)));
1288
1289 bzero(&mtp, sizeof(mtp));
1290 *pinm = NULL;
1291
1292 /*
1293 * If no imf was specified (i.e. kernel consumer),
1294 * fake one up and assume it is an ASM join.
1295 */
1296 if (imf == NULL) {
1297 im6f_init(&timf, MCAST_UNDEFINED, MCAST_EXCLUDE);
1298 imf = &timf;
1299 }
1300
1301 error = in6_mc_get(ifp, mcaddr, &inm);
1302 if (error) {
1303 MLD_PRINTF(("%s: in6_mc_get() failure\n", __func__));
1304 return error;
1305 }
1306
1307 MLD_PRINTF(("%s: merge inm state\n", __func__));
1308
1309 IN6M_LOCK(inm);
1310 error = in6m_merge(inm, imf);
1311 if (error) {
1312 MLD_PRINTF(("%s: failed to merge inm state\n", __func__));
1313 goto out_in6m_release;
1314 }
1315
1316 MLD_PRINTF(("%s: doing mld downcall\n", __func__));
1317 error = mld_change_state(inm, &mtp, delay);
1318 if (error) {
1319 MLD_PRINTF(("%s: failed to update source\n", __func__));
1320 im6f_rollback(imf);
1321 goto out_in6m_release;
1322 }
1323
1324 out_in6m_release:
1325 if (error) {
1326 MLD_PRINTF(("%s: dropping ref on 0x%llx\n", __func__,
1327 (uint64_t)VM_KERNEL_ADDRPERM(inm)));
1328 IN6M_UNLOCK(inm);
1329 IN6M_REMREF(inm);
1330 } else {
1331 IN6M_UNLOCK(inm);
1332 *pinm = inm; /* keep refcount from in6_mc_get() */
1333 }
1334
1335 /* schedule timer now that we've dropped the lock(s) */
1336 mld_set_fast_timeout(&mtp);
1337
1338 return error;
1339 }
1340
1341 /*
1342 * Leave a multicast group; real entry point.
1343 * All source filters will be expunged.
1344 *
1345 * Only preserves atomicity at inm level.
1346 *
1347 * Holding the write lock for the INP which contains imf
1348 * is highly advisable. We can't assert for it as imf does not
1349 * contain a back-pointer to the owning inp.
1350 *
1351 * Note: This is not the same as in6m_release(*) as this function also
1352 * makes a state change downcall into MLD.
1353 */
1354 int
in6_mc_leave(struct in6_multi * inm,struct in6_mfilter * imf)1355 in6_mc_leave(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf)
1356 {
1357 struct in6_mfilter timf;
1358 int error, lastref;
1359 struct mld_tparams mtp;
1360
1361 bzero(&mtp, sizeof(mtp));
1362 error = 0;
1363
1364 IN6M_LOCK_ASSERT_NOTHELD(inm);
1365
1366 in6_multihead_lock_exclusive();
1367 IN6M_LOCK(inm);
1368
1369 MLD_PRINTF(("%s: leave inm 0x%llx, %s/%s%d, imf 0x%llx\n", __func__,
1370 (uint64_t)VM_KERNEL_ADDRPERM(inm), ip6_sprintf(&inm->in6m_addr),
1371 (in6m_is_ifp_detached(inm) ? "null" : inm->in6m_ifp->if_name),
1372 inm->in6m_ifp->if_unit, (uint64_t)VM_KERNEL_ADDRPERM(imf)));
1373
1374 /*
1375 * If no imf was specified (i.e. kernel consumer),
1376 * fake one up and assume it is an ASM join.
1377 */
1378 if (imf == NULL) {
1379 im6f_init(&timf, MCAST_EXCLUDE, MCAST_UNDEFINED);
1380 imf = &timf;
1381 }
1382
1383 /*
1384 * Begin state merge transaction at MLD layer.
1385 *
1386 * As this particular invocation should not cause any memory
1387 * to be allocated, and there is no opportunity to roll back
1388 * the transaction, it MUST NOT fail.
1389 */
1390 MLD_PRINTF(("%s: merge inm state\n", __func__));
1391
1392 error = in6m_merge(inm, imf);
1393 KASSERT(error == 0, ("%s: failed to merge inm state\n", __func__));
1394
1395 MLD_PRINTF(("%s: doing mld downcall\n", __func__));
1396 error = mld_change_state(inm, &mtp, 0);
1397 #if MLD_DEBUG
1398 if (error) {
1399 MLD_PRINTF(("%s: failed mld downcall\n", __func__));
1400 }
1401 #endif
1402 lastref = in6_multi_detach(inm);
1403 VERIFY(!lastref || (!(inm->in6m_debug & IFD_ATTACHED) &&
1404 inm->in6m_reqcnt == 0));
1405 IN6M_UNLOCK(inm);
1406 in6_multihead_lock_done();
1407
1408 if (lastref) {
1409 IN6M_REMREF(inm); /* for in6_multihead list */
1410 }
1411 /* schedule timer now that we've dropped the lock(s) */
1412 mld_set_fast_timeout(&mtp);
1413
1414 return error;
1415 }
1416
1417 /*
1418 * Block or unblock an ASM multicast source on an inpcb.
1419 * This implements the delta-based API described in RFC 3678.
1420 *
1421 * The delta-based API applies only to exclusive-mode memberships.
1422 * An MLD downcall will be performed.
1423 *
1424 * Return 0 if successful, otherwise return an appropriate error code.
1425 */
1426 static int
in6p_block_unblock_source(struct inpcb * inp,struct sockopt * sopt)1427 in6p_block_unblock_source(struct inpcb *inp, struct sockopt *sopt)
1428 {
1429 struct group_source_req gsr;
1430 struct sockaddr_in6 *gsa, *ssa;
1431 struct ifnet *ifp;
1432 struct in6_mfilter *imf;
1433 struct ip6_moptions *imo;
1434 struct in6_msource *ims;
1435 struct in6_multi *inm;
1436 size_t idx;
1437 uint8_t fmode;
1438 int error, doblock;
1439 struct mld_tparams mtp;
1440
1441 bzero(&mtp, sizeof(mtp));
1442 ifp = NULL;
1443 error = 0;
1444 doblock = 0;
1445
1446 memset(&gsr, 0, sizeof(struct group_source_req));
1447 gsa = SIN6(&gsr.gsr_group);
1448 ssa = SIN6(&gsr.gsr_source);
1449
1450 switch (sopt->sopt_name) {
1451 case MCAST_BLOCK_SOURCE:
1452 case MCAST_UNBLOCK_SOURCE:
1453 error = sooptcopyin(sopt, &gsr,
1454 sizeof(struct group_source_req),
1455 sizeof(struct group_source_req));
1456 if (error) {
1457 return error;
1458 }
1459
1460 if (gsa->sin6_family != AF_INET6 ||
1461 gsa->sin6_len != sizeof(struct sockaddr_in6)) {
1462 return EINVAL;
1463 }
1464
1465 if (ssa->sin6_family != AF_INET6 ||
1466 ssa->sin6_len != sizeof(struct sockaddr_in6)) {
1467 return EINVAL;
1468 }
1469
1470 ifnet_head_lock_shared();
1471 if (gsr.gsr_interface == 0 || !IF_INDEX_IN_RANGE(gsr.gsr_interface)) {
1472 ifnet_head_done();
1473 return EADDRNOTAVAIL;
1474 }
1475
1476 ifp = ifindex2ifnet[gsr.gsr_interface];
1477 ifnet_head_done();
1478
1479 if (ifp == NULL) {
1480 return EADDRNOTAVAIL;
1481 }
1482
1483 if (sopt->sopt_name == MCAST_BLOCK_SOURCE) {
1484 doblock = 1;
1485 }
1486 break;
1487
1488 default:
1489 MLD_PRINTF(("%s: unknown sopt_name %d\n",
1490 __func__, sopt->sopt_name));
1491 return EOPNOTSUPP;
1492 }
1493
1494 if (!IN6_IS_ADDR_MULTICAST(&gsa->sin6_addr)) {
1495 return EINVAL;
1496 }
1497
1498 (void) in6_setscope(&gsa->sin6_addr, ifp, IN6_NULL_IF_EMBEDDED_SCOPE(&gsa->sin6_scope_id));
1499
1500 /*
1501 * Check if we are actually a member of this group.
1502 */
1503 imo = in6p_findmoptions(inp);
1504 if (imo == NULL) {
1505 return ENOMEM;
1506 }
1507
1508 IM6O_LOCK(imo);
1509 idx = im6o_match_group(imo, ifp, gsa);
1510 if (idx == (size_t)-1 || imo->im6o_mfilters == NULL) {
1511 error = EADDRNOTAVAIL;
1512 goto out_imo_locked;
1513 }
1514
1515 VERIFY(imo->im6o_mfilters != NULL);
1516 imf = &imo->im6o_mfilters[idx];
1517 inm = imo->im6o_membership[idx];
1518
1519 /*
1520 * Attempting to use the delta-based API on an
1521 * non exclusive-mode membership is an error.
1522 */
1523 fmode = imf->im6f_st[0];
1524 if (fmode != MCAST_EXCLUDE) {
1525 error = EINVAL;
1526 goto out_imo_locked;
1527 }
1528
1529 /*
1530 * Deal with error cases up-front:
1531 * Asked to block, but already blocked; or
1532 * Asked to unblock, but nothing to unblock.
1533 * If adding a new block entry, allocate it.
1534 */
1535 ims = im6o_match_source(imo, idx, ssa);
1536 if ((ims != NULL && doblock) || (ims == NULL && !doblock)) {
1537 MLD_PRINTF(("%s: source %s %spresent\n", __func__,
1538 ip6_sprintf(&ssa->sin6_addr),
1539 doblock ? "" : "not "));
1540 error = EADDRNOTAVAIL;
1541 goto out_imo_locked;
1542 }
1543
1544 /*
1545 * Begin state merge transaction at socket layer.
1546 */
1547 if (doblock) {
1548 MLD_PRINTF(("%s: %s source\n", __func__, "block"));
1549 ims = im6f_graft(imf, fmode, ssa);
1550 if (ims == NULL) {
1551 error = ENOMEM;
1552 }
1553 } else {
1554 MLD_PRINTF(("%s: %s source\n", __func__, "allow"));
1555 error = im6f_prune(imf, ssa);
1556 }
1557
1558 if (error) {
1559 MLD_PRINTF(("%s: merge imf state failed\n", __func__));
1560 goto out_im6f_rollback;
1561 }
1562
1563 /*
1564 * Begin state merge transaction at MLD layer.
1565 */
1566 IN6M_LOCK(inm);
1567 MLD_PRINTF(("%s: merge inm state\n", __func__));
1568 error = in6m_merge(inm, imf);
1569 if (error) {
1570 MLD_PRINTF(("%s: failed to merge inm state\n", __func__));
1571 IN6M_UNLOCK(inm);
1572 goto out_im6f_rollback;
1573 }
1574
1575 MLD_PRINTF(("%s: doing mld downcall\n", __func__));
1576 error = mld_change_state(inm, &mtp, 0);
1577 IN6M_UNLOCK(inm);
1578 #if MLD_DEBUG
1579 if (error) {
1580 MLD_PRINTF(("%s: failed mld downcall\n", __func__));
1581 }
1582 #endif
1583
1584 out_im6f_rollback:
1585 if (error) {
1586 im6f_rollback(imf);
1587 } else {
1588 im6f_commit(imf);
1589 }
1590
1591 im6f_reap(imf);
1592
1593 out_imo_locked:
1594 IM6O_UNLOCK(imo);
1595 IM6O_REMREF(imo); /* from in6p_findmoptions() */
1596
1597 /* schedule timer now that we've dropped the lock(s) */
1598 mld_set_fast_timeout(&mtp);
1599
1600 return error;
1601 }
1602
1603 /*
1604 * Given an inpcb, return its multicast options structure pointer. Accepts
1605 * an unlocked inpcb pointer, but will return it locked. May sleep.
1606 *
1607 */
1608 static struct ip6_moptions *
in6p_findmoptions(struct inpcb * inp)1609 in6p_findmoptions(struct inpcb *inp)
1610 {
1611 struct ip6_moptions *imo;
1612 struct in6_multi **immp;
1613 struct in6_mfilter *imfp;
1614 size_t idx;
1615
1616 if ((imo = inp->in6p_moptions) != NULL) {
1617 IM6O_ADDREF(imo); /* for caller */
1618 return imo;
1619 }
1620
1621 imo = ip6_allocmoptions(Z_WAITOK);
1622 if (imo == NULL) {
1623 return NULL;
1624 }
1625
1626 immp = kalloc_type(struct in6_multi *, IPV6_MIN_MEMBERSHIPS,
1627 Z_WAITOK | Z_ZERO | Z_NOFAIL);
1628 imfp = kalloc_type(struct in6_mfilter, IPV6_MIN_MEMBERSHIPS,
1629 Z_WAITOK | Z_ZERO | Z_NOFAIL);
1630
1631 imo->im6o_multicast_ifp = NULL;
1632 imo->im6o_multicast_hlim = (u_char)ip6_defmcasthlim;
1633 imo->im6o_multicast_loop = (u_char)in6_mcast_loop;
1634 imo->im6o_num_memberships = 0;
1635 imo->im6o_max_memberships = IPV6_MIN_MEMBERSHIPS;
1636 imo->im6o_membership = immp;
1637 imo->im6o_max_filters = IPV6_MIN_MEMBERSHIPS;
1638 imo->im6o_mfilters = imfp;
1639
1640 /* Initialize per-group source filters. */
1641 for (idx = 0; idx < IPV6_MIN_MEMBERSHIPS; idx++) {
1642 im6f_init(&imfp[idx], MCAST_UNDEFINED, MCAST_EXCLUDE);
1643 }
1644
1645 inp->in6p_moptions = imo; /* keep reference from ip6_allocmoptions() */
1646 IM6O_ADDREF(imo); /* for caller */
1647
1648 return imo;
1649 }
1650
1651 /*
1652 * Atomically get source filters on a socket for an IPv6 multicast group.
1653 * Called with INP lock held; returns with lock released.
1654 */
1655 static int
in6p_get_source_filters(struct inpcb * inp,struct sockopt * sopt)1656 in6p_get_source_filters(struct inpcb *inp, struct sockopt *sopt)
1657 {
1658 struct __msfilterreq64 msfr = {}, msfr64;
1659 struct __msfilterreq32 msfr32;
1660 struct sockaddr_in6 *gsa;
1661 struct ifnet *ifp;
1662 struct ip6_moptions *imo;
1663 struct in6_mfilter *imf;
1664 struct ip6_msource *ims;
1665 struct in6_msource *lims;
1666 struct sockaddr_in6 *psin;
1667 struct sockaddr_storage *ptss;
1668 struct sockaddr_storage *tss;
1669 int error;
1670 size_t idx, nsrcs, ncsrcs;
1671 user_addr_t tmp_ptr;
1672
1673 const bool is_currproc_64bit_proc = IS_64BIT_PROCESS(current_proc());
1674
1675 imo = inp->in6p_moptions;
1676 VERIFY(imo != NULL);
1677
1678 if (is_currproc_64bit_proc) {
1679 error = sooptcopyin(sopt, &msfr64,
1680 sizeof(struct __msfilterreq64),
1681 sizeof(struct __msfilterreq64));
1682 if (error) {
1683 return error;
1684 }
1685 /* we never use msfr.msfr_srcs; */
1686 memcpy(&msfr, &msfr64, sizeof(msfr64));
1687 } else {
1688 error = sooptcopyin(sopt, &msfr32,
1689 sizeof(struct __msfilterreq32),
1690 sizeof(struct __msfilterreq32));
1691 if (error) {
1692 return error;
1693 }
1694 /* we never use msfr.msfr_srcs; */
1695 memcpy(&msfr, &msfr32, sizeof(msfr32));
1696 }
1697
1698 if (msfr.msfr_group.ss_family != AF_INET6 ||
1699 msfr.msfr_group.ss_len != sizeof(struct sockaddr_in6)) {
1700 return EINVAL;
1701 }
1702
1703 gsa = SIN6(&msfr.msfr_group);
1704 if (!IN6_IS_ADDR_MULTICAST(&gsa->sin6_addr)) {
1705 return EINVAL;
1706 }
1707
1708 ifnet_head_lock_shared();
1709 if (msfr.msfr_ifindex == 0 || !IF_INDEX_IN_RANGE(msfr.msfr_ifindex)) {
1710 ifnet_head_done();
1711 return EADDRNOTAVAIL;
1712 }
1713 ifp = ifindex2ifnet[msfr.msfr_ifindex];
1714 ifnet_head_done();
1715
1716 if (ifp == NULL) {
1717 return EADDRNOTAVAIL;
1718 }
1719
1720 if ((size_t) msfr.msfr_nsrcs >
1721 UINT32_MAX / sizeof(struct sockaddr_storage)) {
1722 msfr.msfr_nsrcs = UINT32_MAX / sizeof(struct sockaddr_storage);
1723 }
1724
1725 if (msfr.msfr_nsrcs > in6_mcast_maxsocksrc) {
1726 msfr.msfr_nsrcs = (uint32_t)in6_mcast_maxsocksrc;
1727 }
1728
1729 (void)in6_setscope(&gsa->sin6_addr, ifp, IN6_NULL_IF_EMBEDDED_SCOPE(&gsa->sin6_scope_id));
1730
1731 IM6O_LOCK(imo);
1732 /*
1733 * Lookup group on the socket.
1734 */
1735 idx = im6o_match_group(imo, ifp, gsa);
1736 if (idx == (size_t)-1 || imo->im6o_mfilters == NULL) {
1737 IM6O_UNLOCK(imo);
1738 return EADDRNOTAVAIL;
1739 }
1740 imf = &imo->im6o_mfilters[idx];
1741
1742 /*
1743 * Ignore memberships which are in limbo.
1744 */
1745 if (imf->im6f_st[1] == MCAST_UNDEFINED) {
1746 IM6O_UNLOCK(imo);
1747 return EAGAIN;
1748 }
1749 msfr.msfr_fmode = imf->im6f_st[1];
1750
1751 /*
1752 * If the user specified a buffer, copy out the source filter
1753 * entries to userland gracefully.
1754 * We only copy out the number of entries which userland
1755 * has asked for, but we always tell userland how big the
1756 * buffer really needs to be.
1757 */
1758 tss = NULL;
1759
1760 if (is_currproc_64bit_proc) {
1761 tmp_ptr = (user_addr_t)msfr64.msfr_srcs;
1762 } else {
1763 tmp_ptr = CAST_USER_ADDR_T(msfr32.msfr_srcs);
1764 }
1765
1766 if (tmp_ptr != USER_ADDR_NULL && msfr.msfr_nsrcs > 0) {
1767 tss = kalloc_data((size_t) msfr.msfr_nsrcs * sizeof(*tss),
1768 Z_WAITOK | Z_ZERO);
1769 if (tss == NULL) {
1770 IM6O_UNLOCK(imo);
1771 return ENOBUFS;
1772 }
1773 }
1774
1775 /*
1776 * Count number of sources in-mode at t0.
1777 * If buffer space exists and remains, copy out source entries.
1778 */
1779 nsrcs = msfr.msfr_nsrcs;
1780 ncsrcs = 0;
1781 ptss = tss;
1782 RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
1783 lims = (struct in6_msource *)ims;
1784 if (lims->im6sl_st[0] == MCAST_UNDEFINED ||
1785 lims->im6sl_st[0] != imf->im6f_st[0]) {
1786 continue;
1787 }
1788 if (tss != NULL && nsrcs > 0) {
1789 psin = SIN6(ptss);
1790 psin->sin6_family = AF_INET6;
1791 psin->sin6_len = sizeof(struct sockaddr_in6);
1792 psin->sin6_addr = lims->im6s_addr;
1793 psin->sin6_port = 0;
1794 --nsrcs;
1795 ++ptss;
1796 ++ncsrcs;
1797 }
1798 }
1799
1800 IM6O_UNLOCK(imo);
1801
1802 if (tss != NULL) {
1803 error = copyout(tss, tmp_ptr, ncsrcs * sizeof(*tss));
1804 kfree_data(tss, (size_t) msfr.msfr_nsrcs * sizeof(*tss));
1805 if (error) {
1806 return error;
1807 }
1808 }
1809
1810 msfr.msfr_nsrcs = (uint32_t)ncsrcs;
1811 if (is_currproc_64bit_proc) {
1812 msfr64.msfr_ifindex = msfr.msfr_ifindex;
1813 msfr64.msfr_fmode = msfr.msfr_fmode;
1814 msfr64.msfr_nsrcs = msfr.msfr_nsrcs;
1815 memcpy(&msfr64.msfr_group, &msfr.msfr_group,
1816 sizeof(struct sockaddr_storage));
1817 error = sooptcopyout(sopt, &msfr64,
1818 sizeof(struct __msfilterreq64));
1819 } else {
1820 msfr32.msfr_ifindex = msfr.msfr_ifindex;
1821 msfr32.msfr_fmode = msfr.msfr_fmode;
1822 msfr32.msfr_nsrcs = msfr.msfr_nsrcs;
1823 memcpy(&msfr32.msfr_group, &msfr.msfr_group,
1824 sizeof(struct sockaddr_storage));
1825 error = sooptcopyout(sopt, &msfr32,
1826 sizeof(struct __msfilterreq32));
1827 }
1828
1829 return error;
1830 }
1831
1832 /*
1833 * Return the IP multicast options in response to user getsockopt().
1834 */
1835 int
ip6_getmoptions(struct inpcb * inp,struct sockopt * sopt)1836 ip6_getmoptions(struct inpcb *inp, struct sockopt *sopt)
1837 {
1838 struct ip6_moptions *im6o;
1839 int error;
1840 u_int optval;
1841
1842 im6o = inp->in6p_moptions;
1843 /*
1844 * If socket is neither of type SOCK_RAW or SOCK_DGRAM,
1845 * or is a divert socket, reject it.
1846 */
1847 if (SOCK_PROTO(inp->inp_socket) == IPPROTO_DIVERT ||
1848 (SOCK_TYPE(inp->inp_socket) != SOCK_RAW &&
1849 SOCK_TYPE(inp->inp_socket) != SOCK_DGRAM)) {
1850 return EOPNOTSUPP;
1851 }
1852
1853 error = 0;
1854 switch (sopt->sopt_name) {
1855 case IPV6_MULTICAST_IF:
1856 if (im6o != NULL) {
1857 IM6O_LOCK(im6o);
1858 }
1859 if (im6o == NULL || im6o->im6o_multicast_ifp == NULL) {
1860 optval = 0;
1861 } else {
1862 optval = im6o->im6o_multicast_ifp->if_index;
1863 }
1864 if (im6o != NULL) {
1865 IM6O_UNLOCK(im6o);
1866 }
1867 error = sooptcopyout(sopt, &optval, sizeof(u_int));
1868 break;
1869
1870 case IPV6_MULTICAST_HOPS:
1871 if (im6o == NULL) {
1872 optval = ip6_defmcasthlim;
1873 } else {
1874 IM6O_LOCK(im6o);
1875 optval = im6o->im6o_multicast_hlim;
1876 IM6O_UNLOCK(im6o);
1877 }
1878 error = sooptcopyout(sopt, &optval, sizeof(u_int));
1879 break;
1880
1881 case IPV6_MULTICAST_LOOP:
1882 if (im6o == NULL) {
1883 optval = in6_mcast_loop; /* XXX VIMAGE */
1884 } else {
1885 IM6O_LOCK(im6o);
1886 optval = im6o->im6o_multicast_loop;
1887 IM6O_UNLOCK(im6o);
1888 }
1889 error = sooptcopyout(sopt, &optval, sizeof(u_int));
1890 break;
1891
1892 case IPV6_MSFILTER:
1893 if (im6o == NULL) {
1894 error = EADDRNOTAVAIL;
1895 } else {
1896 error = in6p_get_source_filters(inp, sopt);
1897 }
1898 break;
1899
1900 default:
1901 error = ENOPROTOOPT;
1902 break;
1903 }
1904
1905 return error;
1906 }
1907
1908 /*
1909 * Look up the ifnet to use for a multicast group membership,
1910 * given the address of an IPv6 group.
1911 *
1912 * This routine exists to support legacy IPv6 multicast applications.
1913 *
1914 * If inp is non-NULL and is bound to an interface, use this socket's
1915 * inp_boundif for any required routing table lookup.
1916 *
1917 * If the route lookup fails, return NULL.
1918 *
1919 * FUTURE: Support multiple forwarding tables for IPv6.
1920 *
1921 * Returns NULL if no ifp could be found.
1922 */
1923 static struct ifnet *
in6p_lookup_mcast_ifp(const struct inpcb * in6p,const struct sockaddr_in6 * gsin6)1924 in6p_lookup_mcast_ifp(const struct inpcb *in6p,
1925 const struct sockaddr_in6 *gsin6)
1926 {
1927 struct route_in6 ro6;
1928 struct ifnet *ifp;
1929 unsigned int ifscope = IFSCOPE_NONE;
1930
1931 VERIFY(in6p == NULL || (in6p->inp_vflag & INP_IPV6));
1932 VERIFY(gsin6->sin6_family == AF_INET6);
1933 if (IN6_IS_ADDR_MULTICAST(&gsin6->sin6_addr) == 0) {
1934 return NULL;
1935 }
1936
1937 if (in6p != NULL && (in6p->inp_flags & INP_BOUND_IF)) {
1938 ifscope = in6p->inp_boundifp->if_index;
1939 }
1940
1941 ifp = NULL;
1942 memset(&ro6, 0, sizeof(struct route_in6));
1943 memcpy(&ro6.ro_dst, gsin6, sizeof(struct sockaddr_in6));
1944 rtalloc_scoped_ign((struct route *)&ro6, 0, ifscope);
1945 if (ro6.ro_rt != NULL) {
1946 ifp = ro6.ro_rt->rt_ifp;
1947 VERIFY(ifp != NULL);
1948 }
1949 ROUTE_RELEASE(&ro6);
1950
1951 return ifp;
1952 }
1953
1954 /*
1955 * Since ipv6_mreq contains an ifindex and ip_mreq contains an AF_INET
1956 * address, we need to lookup the AF_INET address when translating an
1957 * ipv6_mreq structure into an ipmreq structure.
1958 * This is used when userland performs multicast setsockopt() on AF_INET6
1959 * sockets with AF_INET multicast addresses (IPv6 v4 mapped addresses).
1960 */
1961 static int
in6p_lookup_v4addr(struct ipv6_mreq * mreq,struct ip_mreq * v4mreq)1962 in6p_lookup_v4addr(struct ipv6_mreq *mreq, struct ip_mreq *v4mreq)
1963 {
1964 struct ifnet *ifp;
1965 struct ifaddr *ifa;
1966 struct sockaddr_in *sin;
1967
1968 ifnet_head_lock_shared();
1969 if (!IF_INDEX_IN_RANGE(mreq->ipv6mr_interface)) {
1970 ifnet_head_done();
1971 return EADDRNOTAVAIL;
1972 } else {
1973 ifp = ifindex2ifnet[mreq->ipv6mr_interface];
1974 }
1975 ifnet_head_done();
1976 if (ifp == NULL) {
1977 return EADDRNOTAVAIL;
1978 }
1979 ifa = ifa_ifpgetprimary(ifp, AF_INET);
1980 if (ifa == NULL) {
1981 return EADDRNOTAVAIL;
1982 }
1983 sin = SIN(ifa->ifa_addr);
1984 v4mreq->imr_interface.s_addr = sin->sin_addr.s_addr;
1985 ifa_remref(ifa);
1986
1987 return 0;
1988 }
1989
1990 /*
1991 * Join an IPv6 multicast group, possibly with a source.
1992 *
1993 * FIXME: The KAME use of the unspecified address (::)
1994 * to join *all* multicast groups is currently unsupported.
1995 */
1996 static int
in6p_join_group(struct inpcb * inp,struct sockopt * sopt)1997 in6p_join_group(struct inpcb *inp, struct sockopt *sopt)
1998 {
1999 struct group_source_req gsr;
2000 struct sockaddr_in6 *gsa, *ssa;
2001 struct ifnet *ifp;
2002 struct in6_mfilter *imf;
2003 struct ip6_moptions *imo;
2004 struct in6_multi *__single inm = NULL;
2005 struct in6_msource *lims = NULL;
2006 size_t idx;
2007 int error, is_new;
2008 struct mld_tparams mtp;
2009
2010 bzero(&mtp, sizeof(mtp));
2011 ifp = NULL;
2012 imf = NULL;
2013 error = 0;
2014 is_new = 0;
2015
2016 memset(&gsr, 0, sizeof(struct group_source_req));
2017 gsa = SIN6(&gsr.gsr_group);
2018 ssa = SIN6(&gsr.gsr_source);
2019
2020 /*
2021 * Chew everything into struct group_source_req.
2022 * Overwrite the port field if present, as the sockaddr
2023 * being copied in may be matched with a binary comparison.
2024 * Ignore passed-in scope ID.
2025 */
2026 switch (sopt->sopt_name) {
2027 case IPV6_JOIN_GROUP: {
2028 struct ipv6_mreq mreq;
2029
2030 error = sooptcopyin(sopt, &mreq, sizeof(struct ipv6_mreq),
2031 sizeof(struct ipv6_mreq));
2032 if (error) {
2033 return error;
2034 }
2035 if (IN6_IS_ADDR_V4MAPPED(&mreq.ipv6mr_multiaddr)) {
2036 struct ip_mreq v4mreq;
2037 struct sockopt v4sopt;
2038
2039 v4mreq.imr_multiaddr.s_addr =
2040 mreq.ipv6mr_multiaddr.s6_addr32[3];
2041 if (mreq.ipv6mr_interface == 0) {
2042 v4mreq.imr_interface.s_addr = INADDR_ANY;
2043 } else {
2044 error = in6p_lookup_v4addr(&mreq, &v4mreq);
2045 }
2046 if (error) {
2047 return error;
2048 }
2049 v4sopt.sopt_dir = SOPT_SET;
2050 v4sopt.sopt_level = sopt->sopt_level;
2051 v4sopt.sopt_name = IP_ADD_MEMBERSHIP;
2052 v4sopt.sopt_val = CAST_USER_ADDR_T(&v4mreq);
2053 v4sopt.sopt_valsize = sizeof(v4mreq);
2054 v4sopt.sopt_p = kernproc;
2055
2056 return inp_join_group(inp, &v4sopt);
2057 }
2058 gsa->sin6_family = AF_INET6;
2059 gsa->sin6_len = sizeof(struct sockaddr_in6);
2060 gsa->sin6_addr = mreq.ipv6mr_multiaddr;
2061
2062 /* Only allow IPv6 multicast addresses */
2063 if (IN6_IS_ADDR_MULTICAST(&gsa->sin6_addr) == 0) {
2064 return EINVAL;
2065 }
2066
2067 if (mreq.ipv6mr_interface == 0) {
2068 ifp = in6p_lookup_mcast_ifp(inp, gsa);
2069 } else {
2070 ifnet_head_lock_shared();
2071 if (!IF_INDEX_IN_RANGE(mreq.ipv6mr_interface)) {
2072 ifnet_head_done();
2073 return EADDRNOTAVAIL;
2074 }
2075 ifp = ifindex2ifnet[mreq.ipv6mr_interface];
2076 ifnet_head_done();
2077 }
2078 MLD_PRINTF(("%s: ipv6mr_interface = %d, ifp = 0x%llx\n",
2079 __func__, mreq.ipv6mr_interface,
2080 (uint64_t)VM_KERNEL_ADDRPERM(ifp)));
2081 break;
2082 }
2083
2084 case MCAST_JOIN_GROUP:
2085 case MCAST_JOIN_SOURCE_GROUP:
2086 if (sopt->sopt_name == MCAST_JOIN_GROUP) {
2087 error = sooptcopyin(sopt, &gsr,
2088 sizeof(struct group_req),
2089 sizeof(struct group_req));
2090 } else if (sopt->sopt_name == MCAST_JOIN_SOURCE_GROUP) {
2091 error = sooptcopyin(sopt, &gsr,
2092 sizeof(struct group_source_req),
2093 sizeof(struct group_source_req));
2094 }
2095 if (error) {
2096 return error;
2097 }
2098
2099 if (gsa->sin6_family != AF_INET6 ||
2100 gsa->sin6_len != sizeof(struct sockaddr_in6)) {
2101 return EINVAL;
2102 }
2103
2104 if (sopt->sopt_name == MCAST_JOIN_SOURCE_GROUP) {
2105 if (ssa->sin6_family != AF_INET6 ||
2106 ssa->sin6_len != sizeof(struct sockaddr_in6)) {
2107 return EINVAL;
2108 }
2109 if (IN6_IS_ADDR_MULTICAST(&ssa->sin6_addr)) {
2110 return EINVAL;
2111 }
2112 /*
2113 * TODO: Validate embedded scope ID in source
2114 * list entry against passed-in ifp, if and only
2115 * if source list filter entry is iface or node local.
2116 */
2117 in6_clearscope(&ssa->sin6_addr);
2118 ssa->sin6_port = 0;
2119 ssa->sin6_scope_id = 0;
2120 }
2121
2122 ifnet_head_lock_shared();
2123 if (gsr.gsr_interface == 0 ||
2124 !IF_INDEX_IN_RANGE(gsr.gsr_interface)) {
2125 ifnet_head_done();
2126 return EADDRNOTAVAIL;
2127 }
2128 ifp = ifindex2ifnet[gsr.gsr_interface];
2129 ifnet_head_done();
2130 break;
2131
2132 default:
2133 MLD_PRINTF(("%s: unknown sopt_name %d\n",
2134 __func__, sopt->sopt_name));
2135 return EOPNOTSUPP;
2136 }
2137
2138 if (!IN6_IS_ADDR_MULTICAST(&gsa->sin6_addr)) {
2139 return EINVAL;
2140 }
2141
2142 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2143 return EADDRNOTAVAIL;
2144 }
2145
2146 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_mcast_join_total);
2147 /*
2148 * TBD: revisit the criteria for non-OS initiated joins
2149 */
2150 if (inp->inp_lport == htons(5353)) {
2151 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_mcast_join_os_total);
2152 }
2153
2154 gsa->sin6_port = 0;
2155 if (in6_embedded_scope) {
2156 gsa->sin6_scope_id = 0;
2157 }
2158 (void)in6_setscope(&gsa->sin6_addr, ifp, &gsa->sin6_scope_id);
2159 if (!in6_embedded_scope) {
2160 if ((IN6_IS_ADDR_MC_LINKLOCAL(&gsa->sin6_addr) ||
2161 IN6_IS_ADDR_MC_INTFACELOCAL(&gsa->sin6_addr)) &&
2162 gsa->sin6_scope_id == 0) {
2163 return EINVAL;
2164 }
2165 }
2166
2167 /*
2168 * Some addresses are not valid without an embedded scopeid.
2169 * This check must be present because otherwise we will later hit
2170 * a VERIFY() in in6_mc_join().
2171 */
2172 if ((IN6_IS_ADDR_MC_LINKLOCAL(&gsa->sin6_addr) ||
2173 IN6_IS_ADDR_MC_INTFACELOCAL(&gsa->sin6_addr)) &&
2174 gsa->sin6_scope_id == 0) {
2175 return EINVAL;
2176 }
2177
2178 if (in6_embedded_scope) {
2179 gsa->sin6_scope_id = 0;
2180 }
2181
2182 imo = in6p_findmoptions(inp);
2183 if (imo == NULL) {
2184 return ENOMEM;
2185 }
2186
2187 IM6O_LOCK(imo);
2188 idx = im6o_match_group(imo, ifp, gsa);
2189 if (idx == (size_t)-1) {
2190 is_new = 1;
2191 } else {
2192 inm = imo->im6o_membership[idx];
2193 imf = &imo->im6o_mfilters[idx];
2194 if (ssa->sin6_family != AF_UNSPEC) {
2195 /*
2196 * MCAST_JOIN_SOURCE_GROUP on an exclusive membership
2197 * is an error. On an existing inclusive membership,
2198 * it just adds the source to the filter list.
2199 */
2200 if (imf->im6f_st[1] != MCAST_INCLUDE) {
2201 error = EINVAL;
2202 goto out_imo_locked;
2203 }
2204 /*
2205 * Throw out duplicates.
2206 *
2207 * XXX FIXME: This makes a naive assumption that
2208 * even if entries exist for *ssa in this imf,
2209 * they will be rejected as dupes, even if they
2210 * are not valid in the current mode (in-mode).
2211 *
2212 * in6_msource is transactioned just as for anything
2213 * else in SSM -- but note naive use of in6m_graft()
2214 * below for allocating new filter entries.
2215 *
2216 * This is only an issue if someone mixes the
2217 * full-state SSM API with the delta-based API,
2218 * which is discouraged in the relevant RFCs.
2219 */
2220 lims = im6o_match_source(imo, idx, ssa);
2221 if (lims != NULL /*&&
2222 * lims->im6sl_st[1] == MCAST_INCLUDE*/) {
2223 error = EADDRNOTAVAIL;
2224 goto out_imo_locked;
2225 }
2226 } else {
2227 /*
2228 * MCAST_JOIN_GROUP on an existing exclusive
2229 * membership is an error; return EADDRINUSE
2230 * to preserve 4.4BSD API idempotence, and
2231 * avoid tedious detour to code below.
2232 * NOTE: This is bending RFC 3678 a bit.
2233 *
2234 * On an existing inclusive membership, this is also
2235 * an error; if you want to change filter mode,
2236 * you must use the userland API setsourcefilter().
2237 * XXX We don't reject this for imf in UNDEFINED
2238 * state at t1, because allocation of a filter
2239 * is atomic with allocation of a membership.
2240 */
2241 error = EINVAL;
2242 /* See comments above for EADDRINUSE */
2243 if (imf->im6f_st[1] == MCAST_EXCLUDE) {
2244 error = EADDRINUSE;
2245 }
2246 goto out_imo_locked;
2247 }
2248 }
2249
2250 /*
2251 * Begin state merge transaction at socket layer.
2252 */
2253
2254 if (is_new) {
2255 if (imo->im6o_num_memberships == imo->im6o_max_memberships) {
2256 error = im6o_grow(imo);
2257 if (error) {
2258 goto out_imo_locked;
2259 }
2260 }
2261 /*
2262 * Allocate the new slot upfront so we can deal with
2263 * grafting the new source filter in same code path
2264 * as for join-source on existing membership.
2265 */
2266 idx = imo->im6o_num_memberships;
2267 imo->im6o_membership[idx] = NULL;
2268 imo->im6o_num_memberships++;
2269 VERIFY(imo->im6o_mfilters != NULL);
2270 imf = &imo->im6o_mfilters[idx];
2271 VERIFY(RB_EMPTY(&imf->im6f_sources));
2272 }
2273
2274 /*
2275 * Graft new source into filter list for this inpcb's
2276 * membership of the group. The in6_multi may not have
2277 * been allocated yet if this is a new membership, however,
2278 * the in_mfilter slot will be allocated and must be initialized.
2279 *
2280 * Note: Grafting of exclusive mode filters doesn't happen
2281 * in this path.
2282 * XXX: Should check for non-NULL lims (node exists but may
2283 * not be in-mode) for interop with full-state API.
2284 */
2285 if (ssa->sin6_family != AF_UNSPEC) {
2286 /* Membership starts in IN mode */
2287 if (is_new) {
2288 MLD_PRINTF(("%s: new join w/source\n", __func__);
2289 im6f_init(imf, MCAST_UNDEFINED, MCAST_INCLUDE));
2290 } else {
2291 MLD_PRINTF(("%s: %s source\n", __func__, "allow"));
2292 }
2293 lims = im6f_graft(imf, MCAST_INCLUDE, ssa);
2294 if (lims == NULL) {
2295 MLD_PRINTF(("%s: merge imf state failed\n",
2296 __func__));
2297 error = ENOMEM;
2298 goto out_im6o_free;
2299 }
2300 } else {
2301 /* No address specified; Membership starts in EX mode */
2302 if (is_new) {
2303 MLD_PRINTF(("%s: new join w/o source", __func__));
2304 im6f_init(imf, MCAST_UNDEFINED, MCAST_EXCLUDE);
2305 }
2306 }
2307
2308 /*
2309 * Begin state merge transaction at MLD layer.
2310 */
2311
2312 if (is_new) {
2313 VERIFY(inm == NULL);
2314 error = in6_mc_join(ifp, &gsa->sin6_addr, imf, &inm, 0);
2315 VERIFY(inm != NULL || error != 0);
2316
2317 if (error) {
2318 goto out_im6o_free;
2319 }
2320 imo->im6o_membership[idx] = inm; /* from in6_mc_join() */
2321 } else {
2322 MLD_PRINTF(("%s: merge inm state\n", __func__));
2323 IN6M_LOCK(inm);
2324 error = in6m_merge(inm, imf);
2325 if (error) {
2326 MLD_PRINTF(("%s: failed to merge inm state\n",
2327 __func__));
2328 IN6M_UNLOCK(inm);
2329 goto out_im6f_rollback;
2330 }
2331 MLD_PRINTF(("%s: doing mld downcall\n", __func__));
2332 error = mld_change_state(inm, &mtp, 0);
2333 IN6M_UNLOCK(inm);
2334 if (error) {
2335 MLD_PRINTF(("%s: failed mld downcall\n",
2336 __func__));
2337 goto out_im6f_rollback;
2338 }
2339 }
2340
2341 out_im6f_rollback:
2342 if (error) {
2343 im6f_rollback(imf);
2344 if (is_new) {
2345 im6f_purge(imf);
2346 } else {
2347 im6f_reap(imf);
2348 }
2349 } else {
2350 im6f_commit(imf);
2351 }
2352
2353 out_im6o_free:
2354 if (error && is_new) {
2355 VERIFY(inm == NULL);
2356 imo->im6o_membership[idx] = NULL;
2357 --imo->im6o_num_memberships;
2358 }
2359
2360 out_imo_locked:
2361 IM6O_UNLOCK(imo);
2362 IM6O_REMREF(imo); /* from in6p_findmoptions() */
2363
2364 /* schedule timer now that we've dropped the lock(s) */
2365 mld_set_fast_timeout(&mtp);
2366
2367 return error;
2368 }
2369
2370 /*
2371 * Leave an IPv6 multicast group on an inpcb, possibly with a source.
2372 */
2373 static int
in6p_leave_group(struct inpcb * inp,struct sockopt * sopt)2374 in6p_leave_group(struct inpcb *inp, struct sockopt *sopt)
2375 {
2376 struct ipv6_mreq mreq;
2377 struct group_source_req gsr;
2378 struct sockaddr_in6 *gsa, *ssa;
2379 struct ifnet *ifp;
2380 struct in6_mfilter *imf;
2381 struct ip6_moptions *imo;
2382 struct in6_msource *ims;
2383 struct in6_multi *inm = NULL;
2384 uint32_t ifindex = 0;
2385 size_t idx;
2386 int error, is_final;
2387 struct mld_tparams mtp;
2388
2389 bzero(&mtp, sizeof(mtp));
2390 ifp = NULL;
2391 error = 0;
2392 is_final = 1;
2393
2394 memset(&gsr, 0, sizeof(struct group_source_req));
2395 gsa = SIN6(&gsr.gsr_group);
2396 ssa = SIN6(&gsr.gsr_source);
2397
2398 /*
2399 * Chew everything passed in up into a struct group_source_req
2400 * as that is easier to process.
2401 * Note: Any embedded scope ID in the multicast group passed
2402 * in by userland is ignored, the interface index is the recommended
2403 * mechanism to specify an interface; see below.
2404 */
2405 switch (sopt->sopt_name) {
2406 case IPV6_LEAVE_GROUP: {
2407 error = sooptcopyin(sopt, &mreq, sizeof(struct ipv6_mreq),
2408 sizeof(struct ipv6_mreq));
2409 if (error) {
2410 return error;
2411 }
2412 if (IN6_IS_ADDR_V4MAPPED(&mreq.ipv6mr_multiaddr)) {
2413 struct ip_mreq v4mreq;
2414 struct sockopt v4sopt;
2415
2416 v4mreq.imr_multiaddr.s_addr =
2417 mreq.ipv6mr_multiaddr.s6_addr32[3];
2418 if (mreq.ipv6mr_interface == 0) {
2419 v4mreq.imr_interface.s_addr = INADDR_ANY;
2420 } else {
2421 error = in6p_lookup_v4addr(&mreq, &v4mreq);
2422 }
2423 if (error) {
2424 return error;
2425 }
2426 v4sopt.sopt_dir = SOPT_SET;
2427 v4sopt.sopt_level = sopt->sopt_level;
2428 v4sopt.sopt_name = IP_DROP_MEMBERSHIP;
2429 v4sopt.sopt_val = CAST_USER_ADDR_T(&v4mreq);
2430 v4sopt.sopt_valsize = sizeof(v4mreq);
2431 v4sopt.sopt_p = kernproc;
2432
2433 return inp_leave_group(inp, &v4sopt);
2434 }
2435 gsa->sin6_family = AF_INET6;
2436 gsa->sin6_len = sizeof(struct sockaddr_in6);
2437 gsa->sin6_addr = mreq.ipv6mr_multiaddr;
2438 gsa->sin6_port = 0;
2439 if (!in6_embedded_scope) {
2440 gsa->sin6_scope_id = 0;
2441 }
2442 ifindex = mreq.ipv6mr_interface;
2443 /* Only allow IPv6 multicast addresses */
2444 if (IN6_IS_ADDR_MULTICAST(&gsa->sin6_addr) == 0) {
2445 return EINVAL;
2446 }
2447 break;
2448 }
2449
2450 case MCAST_LEAVE_GROUP:
2451 case MCAST_LEAVE_SOURCE_GROUP:
2452 if (sopt->sopt_name == MCAST_LEAVE_GROUP) {
2453 error = sooptcopyin(sopt, &gsr,
2454 sizeof(struct group_req),
2455 sizeof(struct group_req));
2456 } else if (sopt->sopt_name == MCAST_LEAVE_SOURCE_GROUP) {
2457 error = sooptcopyin(sopt, &gsr,
2458 sizeof(struct group_source_req),
2459 sizeof(struct group_source_req));
2460 }
2461 if (error) {
2462 return error;
2463 }
2464
2465 if (gsa->sin6_family != AF_INET6 ||
2466 gsa->sin6_len != sizeof(struct sockaddr_in6)) {
2467 return EINVAL;
2468 }
2469 if (sopt->sopt_name == MCAST_LEAVE_SOURCE_GROUP) {
2470 if (ssa->sin6_family != AF_INET6 ||
2471 ssa->sin6_len != sizeof(struct sockaddr_in6)) {
2472 return EINVAL;
2473 }
2474 if (IN6_IS_ADDR_MULTICAST(&ssa->sin6_addr)) {
2475 return EINVAL;
2476 }
2477 /*
2478 * TODO: Validate embedded scope ID in source
2479 * list entry against passed-in ifp, if and only
2480 * if source list filter entry is iface or node local.
2481 */
2482 in6_clearscope(&ssa->sin6_addr);
2483 }
2484 gsa->sin6_port = 0;
2485 if (in6_embedded_scope) {
2486 gsa->sin6_scope_id = 0;
2487 }
2488 ifindex = gsr.gsr_interface;
2489 break;
2490
2491 default:
2492 MLD_PRINTF(("%s: unknown sopt_name %d\n",
2493 __func__, sopt->sopt_name));
2494 return EOPNOTSUPP;
2495 }
2496
2497 if (!IN6_IS_ADDR_MULTICAST(&gsa->sin6_addr)) {
2498 return EINVAL;
2499 }
2500
2501 /*
2502 * Validate interface index if provided. If no interface index
2503 * was provided separately, attempt to look the membership up
2504 * from the default scope as a last resort to disambiguate
2505 * the membership we are being asked to leave.
2506 * XXX SCOPE6 lock potentially taken here.
2507 */
2508 if (ifindex != 0) {
2509 ifnet_head_lock_shared();
2510 if (!IF_INDEX_IN_RANGE(ifindex)) {
2511 ifnet_head_done();
2512 return EADDRNOTAVAIL;
2513 }
2514 ifp = ifindex2ifnet[ifindex];
2515 ifnet_head_done();
2516 if (ifp == NULL) {
2517 return EADDRNOTAVAIL;
2518 }
2519 (void) in6_setscope(&gsa->sin6_addr, ifp, NULL);
2520 if (!in6_embedded_scope) {
2521 gsa->sin6_scope_id = ifindex;
2522 }
2523 } else {
2524 error = sa6_embedscope(gsa, ip6_use_defzone, IN6_NULL_IF_EMBEDDED_SCOPE(&ifindex));
2525 if (error) {
2526 return EADDRNOTAVAIL;
2527 }
2528 /*
2529 * Some badly behaved applications don't pass an ifindex
2530 * or a scope ID, which is an API violation. In this case,
2531 * perform a lookup as per a v6 join.
2532 *
2533 * XXX For now, stomp on zone ID for the corner case.
2534 * This is not the 'KAME way', but we need to see the ifp
2535 * directly until such time as this implementation is
2536 * refactored, assuming the scope IDs are the way to go.
2537 */
2538
2539 if (in6_embedded_scope) {
2540 ifindex = ntohs(gsa->sin6_addr.s6_addr16[1]);
2541 }
2542
2543 if (ifindex == 0) {
2544 MLD_PRINTF(("%s: warning: no ifindex, looking up "
2545 "ifp for group %s.\n", __func__,
2546 ip6_sprintf(&gsa->sin6_addr)));
2547 ifp = in6p_lookup_mcast_ifp(inp, gsa);
2548 } else {
2549 if (!IF_INDEX_IN_RANGE(ifindex)) {
2550 return EADDRNOTAVAIL;
2551 }
2552 ifnet_head_lock_shared();
2553 ifp = ifindex2ifnet[ifindex];
2554 ifnet_head_done();
2555 }
2556 if (ifp == NULL) {
2557 return EADDRNOTAVAIL;
2558 }
2559 }
2560
2561 VERIFY(ifp != NULL);
2562 MLD_PRINTF(("%s: ifp = 0x%llx\n", __func__,
2563 (uint64_t)VM_KERNEL_ADDRPERM(ifp)));
2564
2565 /*
2566 * Find the membership in the membership array.
2567 */
2568 imo = in6p_findmoptions(inp);
2569 if (imo == NULL) {
2570 return ENOMEM;
2571 }
2572
2573 IM6O_LOCK(imo);
2574 idx = im6o_match_group(imo, ifp, gsa);
2575 if (idx == (size_t)-1) {
2576 error = EADDRNOTAVAIL;
2577 goto out_locked;
2578 }
2579 inm = imo->im6o_membership[idx];
2580 imf = &imo->im6o_mfilters[idx];
2581
2582 if (ssa->sin6_family != AF_UNSPEC) {
2583 is_final = 0;
2584 }
2585
2586 /*
2587 * Begin state merge transaction at socket layer.
2588 */
2589
2590 /*
2591 * If we were instructed only to leave a given source, do so.
2592 * MCAST_LEAVE_SOURCE_GROUP is only valid for inclusive memberships.
2593 */
2594 if (is_final) {
2595 im6f_leave(imf);
2596 } else {
2597 if (imf->im6f_st[0] == MCAST_EXCLUDE) {
2598 error = EADDRNOTAVAIL;
2599 goto out_locked;
2600 }
2601 ims = im6o_match_source(imo, idx, ssa);
2602 if (ims == NULL) {
2603 MLD_PRINTF(("%s: source %s %spresent\n", __func__,
2604 ip6_sprintf(&ssa->sin6_addr),
2605 "not "));
2606 error = EADDRNOTAVAIL;
2607 goto out_locked;
2608 }
2609 MLD_PRINTF(("%s: %s source\n", __func__, "block"));
2610 error = im6f_prune(imf, ssa);
2611 if (error) {
2612 MLD_PRINTF(("%s: merge imf state failed\n",
2613 __func__));
2614 goto out_locked;
2615 }
2616 }
2617
2618 /*
2619 * Begin state merge transaction at MLD layer.
2620 */
2621
2622 if (is_final) {
2623 /*
2624 * Give up the multicast address record to which
2625 * the membership points. Reference held in im6o
2626 * will be released below.
2627 */
2628 (void) in6_mc_leave(inm, imf);
2629 } else {
2630 MLD_PRINTF(("%s: merge inm state\n", __func__));
2631 IN6M_LOCK(inm);
2632 error = in6m_merge(inm, imf);
2633 if (error) {
2634 MLD_PRINTF(("%s: failed to merge inm state\n",
2635 __func__));
2636 IN6M_UNLOCK(inm);
2637 goto out_im6f_rollback;
2638 }
2639
2640 MLD_PRINTF(("%s: doing mld downcall\n", __func__));
2641 error = mld_change_state(inm, &mtp, 0);
2642 if (error) {
2643 MLD_PRINTF(("%s: failed mld downcall\n", __func__));
2644 }
2645 IN6M_UNLOCK(inm);
2646 }
2647
2648 out_im6f_rollback:
2649 if (error) {
2650 im6f_rollback(imf);
2651 } else {
2652 im6f_commit(imf);
2653 }
2654
2655 im6f_reap(imf);
2656
2657 if (is_final) {
2658 /* Remove the gap in the membership array. */
2659 VERIFY(inm == imo->im6o_membership[idx]);
2660 IN6M_REMREF(inm);
2661
2662 for (++idx; idx < imo->im6o_num_memberships; ++idx) {
2663 imo->im6o_membership[idx - 1] = imo->im6o_membership[idx];
2664 imo->im6o_mfilters[idx - 1] = imo->im6o_mfilters[idx];
2665 }
2666 imo->im6o_num_memberships--;
2667
2668 /* Re-initialize the now unused tail of the list */
2669 imo->im6o_membership[imo->im6o_num_memberships] = NULL;
2670 im6f_init(&imo->im6o_mfilters[imo->im6o_num_memberships], MCAST_UNDEFINED, MCAST_EXCLUDE);
2671 }
2672
2673 out_locked:
2674 IM6O_UNLOCK(imo);
2675 IM6O_REMREF(imo); /* from in6p_findmoptions() */
2676
2677 /* schedule timer now that we've dropped the lock(s) */
2678 mld_set_fast_timeout(&mtp);
2679
2680 return error;
2681 }
2682
2683 /*
2684 * Select the interface for transmitting IPv6 multicast datagrams.
2685 *
2686 * Either an instance of struct in6_addr or an instance of struct ipv6_mreqn
2687 * may be passed to this socket option. An address of in6addr_any or an
2688 * interface index of 0 is used to remove a previous selection.
2689 * When no interface is selected, one is chosen for every send.
2690 */
2691 static int
in6p_set_multicast_if(struct inpcb * inp,struct sockopt * sopt)2692 in6p_set_multicast_if(struct inpcb *inp, struct sockopt *sopt)
2693 {
2694 struct ifnet *ifp;
2695 struct ip6_moptions *imo;
2696 u_int ifindex;
2697 int error;
2698
2699 if (sopt->sopt_valsize != sizeof(u_int)) {
2700 return EINVAL;
2701 }
2702
2703 error = sooptcopyin(sopt, &ifindex, sizeof(u_int), sizeof(u_int));
2704 if (error) {
2705 return error;
2706 }
2707
2708 ifnet_head_lock_shared();
2709 if (!IF_INDEX_IN_RANGE(ifindex)) {
2710 ifnet_head_done();
2711 return EINVAL;
2712 }
2713
2714 ifp = ifindex2ifnet[ifindex];
2715 ifnet_head_done();
2716 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2717 return EADDRNOTAVAIL;
2718 }
2719
2720 imo = in6p_findmoptions(inp);
2721 if (imo == NULL) {
2722 return ENOMEM;
2723 }
2724
2725 IM6O_LOCK(imo);
2726 imo->im6o_multicast_ifp = ifp;
2727 IM6O_UNLOCK(imo);
2728 IM6O_REMREF(imo); /* from in6p_findmoptions() */
2729
2730 return 0;
2731 }
2732
2733 /*
2734 * Atomically set source filters on a socket for an IPv6 multicast group.
2735 *
2736 */
2737 static int
in6p_set_source_filters(struct inpcb * inp,struct sockopt * sopt)2738 in6p_set_source_filters(struct inpcb *inp, struct sockopt *sopt)
2739 {
2740 struct __msfilterreq64 msfr = {}, msfr64;
2741 struct __msfilterreq32 msfr32;
2742 struct sockaddr_in6 *gsa;
2743 struct ifnet *ifp;
2744 struct in6_mfilter *imf;
2745 struct ip6_moptions *imo;
2746 struct in6_multi *inm;
2747 size_t idx;
2748 int error;
2749 user_addr_t tmp_ptr;
2750 struct mld_tparams mtp;
2751
2752 const bool is_currproc_64bit_proc = IS_64BIT_PROCESS(current_proc());
2753
2754 bzero(&mtp, sizeof(mtp));
2755
2756 if (is_currproc_64bit_proc) {
2757 error = sooptcopyin(sopt, &msfr64,
2758 sizeof(struct __msfilterreq64),
2759 sizeof(struct __msfilterreq64));
2760 if (error) {
2761 return error;
2762 }
2763 /* we never use msfr.msfr_srcs; */
2764 memcpy(&msfr, &msfr64, sizeof(msfr64));
2765 } else {
2766 error = sooptcopyin(sopt, &msfr32,
2767 sizeof(struct __msfilterreq32),
2768 sizeof(struct __msfilterreq32));
2769 if (error) {
2770 return error;
2771 }
2772 /* we never use msfr.msfr_srcs; */
2773 memcpy(&msfr, &msfr32, sizeof(msfr32));
2774 }
2775
2776 if ((size_t) msfr.msfr_nsrcs >
2777 UINT32_MAX / sizeof(struct sockaddr_storage)) {
2778 msfr.msfr_nsrcs = UINT32_MAX / sizeof(struct sockaddr_storage);
2779 }
2780
2781 if (msfr.msfr_nsrcs > in6_mcast_maxsocksrc) {
2782 return ENOBUFS;
2783 }
2784
2785 if (msfr.msfr_fmode != MCAST_EXCLUDE &&
2786 msfr.msfr_fmode != MCAST_INCLUDE) {
2787 return EINVAL;
2788 }
2789
2790 if (msfr.msfr_group.ss_family != AF_INET6 ||
2791 msfr.msfr_group.ss_len != sizeof(struct sockaddr_in6)) {
2792 return EINVAL;
2793 }
2794
2795 gsa = SIN6(&msfr.msfr_group);
2796 if (!IN6_IS_ADDR_MULTICAST(&gsa->sin6_addr)) {
2797 return EINVAL;
2798 }
2799
2800 gsa->sin6_port = 0; /* ignore port */
2801
2802 ifnet_head_lock_shared();
2803 if (msfr.msfr_ifindex == 0 || !IF_INDEX_IN_RANGE(msfr.msfr_ifindex)) {
2804 ifnet_head_done();
2805 return EADDRNOTAVAIL;
2806 }
2807 ifp = ifindex2ifnet[msfr.msfr_ifindex];
2808 ifnet_head_done();
2809 if (ifp == NULL) {
2810 return EADDRNOTAVAIL;
2811 }
2812
2813 (void)in6_setscope(&gsa->sin6_addr, ifp, IN6_NULL_IF_EMBEDDED_SCOPE(&gsa->sin6_scope_id));
2814
2815 /*
2816 * Take the INP write lock.
2817 * Check if this socket is a member of this group.
2818 */
2819 imo = in6p_findmoptions(inp);
2820 if (imo == NULL) {
2821 return ENOMEM;
2822 }
2823
2824 IM6O_LOCK(imo);
2825 idx = im6o_match_group(imo, ifp, gsa);
2826 if (idx == (size_t)-1 || imo->im6o_mfilters == NULL) {
2827 error = EADDRNOTAVAIL;
2828 goto out_imo_locked;
2829 }
2830 inm = imo->im6o_membership[idx];
2831 imf = &imo->im6o_mfilters[idx];
2832
2833 /*
2834 * Begin state merge transaction at socket layer.
2835 */
2836
2837 imf->im6f_st[1] = (uint8_t)msfr.msfr_fmode;
2838
2839 /*
2840 * Apply any new source filters, if present.
2841 * Make a copy of the user-space source vector so
2842 * that we may copy them with a single copyin. This
2843 * allows us to deal with page faults up-front.
2844 */
2845 if (msfr.msfr_nsrcs > 0) {
2846 struct in6_msource *__single lims;
2847 struct sockaddr_in6 *psin;
2848 struct sockaddr_storage *kss, *pkss;
2849 unsigned int i;
2850
2851 if (is_currproc_64bit_proc) {
2852 tmp_ptr = (user_addr_t)msfr64.msfr_srcs;
2853 } else {
2854 tmp_ptr = CAST_USER_ADDR_T(msfr32.msfr_srcs);
2855 }
2856
2857 MLD_PRINTF(("%s: loading %lu source list entries\n",
2858 __func__, (unsigned long)msfr.msfr_nsrcs));
2859 kss = kalloc_data((size_t) msfr.msfr_nsrcs * sizeof(*kss), Z_WAITOK);
2860 if (kss == NULL) {
2861 error = ENOMEM;
2862 goto out_imo_locked;
2863 }
2864
2865 error = copyin(tmp_ptr, kss,
2866 (size_t) msfr.msfr_nsrcs * sizeof(*kss));
2867 if (error) {
2868 kfree_data(kss, (size_t) msfr.msfr_nsrcs * sizeof(*kss));
2869 goto out_imo_locked;
2870 }
2871
2872 /*
2873 * Mark all source filters as UNDEFINED at t1.
2874 * Restore new group filter mode, as im6f_leave()
2875 * will set it to INCLUDE.
2876 */
2877 im6f_leave(imf);
2878 imf->im6f_st[1] = (uint8_t)msfr.msfr_fmode;
2879
2880 /*
2881 * Update socket layer filters at t1, lazy-allocating
2882 * new entries. This saves a bunch of memory at the
2883 * cost of one RB_FIND() per source entry; duplicate
2884 * entries in the msfr_nsrcs vector are ignored.
2885 * If we encounter an error, rollback transaction.
2886 *
2887 * XXX This too could be replaced with a set-symmetric
2888 * difference like loop to avoid walking from root
2889 * every time, as the key space is common.
2890 */
2891 for (i = 0, pkss = kss; i < msfr.msfr_nsrcs; i++, pkss++) {
2892 psin = SIN6(pkss);
2893 if (psin->sin6_family != AF_INET6) {
2894 error = EAFNOSUPPORT;
2895 break;
2896 }
2897 if (psin->sin6_len != sizeof(struct sockaddr_in6)) {
2898 error = EINVAL;
2899 break;
2900 }
2901 if (IN6_IS_ADDR_MULTICAST(&psin->sin6_addr)) {
2902 error = EINVAL;
2903 break;
2904 }
2905 /*
2906 * TODO: Validate embedded scope ID in source
2907 * list entry against passed-in ifp, if and only
2908 * if source list filter entry is iface or node local.
2909 */
2910 in6_clearscope(&psin->sin6_addr);
2911 error = im6f_get_source(imf, psin, &lims);
2912 if (error) {
2913 break;
2914 }
2915 lims->im6sl_st[1] = imf->im6f_st[1];
2916 }
2917 kfree_data(kss, (size_t) msfr.msfr_nsrcs * sizeof(*kss));
2918 }
2919
2920 if (error) {
2921 goto out_im6f_rollback;
2922 }
2923
2924 /*
2925 * Begin state merge transaction at MLD layer.
2926 */
2927 IN6M_LOCK(inm);
2928 MLD_PRINTF(("%s: merge inm state\n", __func__));
2929 error = in6m_merge(inm, imf);
2930 if (error) {
2931 MLD_PRINTF(("%s: failed to merge inm state\n", __func__));
2932 IN6M_UNLOCK(inm);
2933 goto out_im6f_rollback;
2934 }
2935
2936 MLD_PRINTF(("%s: doing mld downcall\n", __func__));
2937 error = mld_change_state(inm, &mtp, 0);
2938 IN6M_UNLOCK(inm);
2939 #if MLD_DEBUG
2940 if (error) {
2941 MLD_PRINTF(("%s: failed mld downcall\n", __func__));
2942 }
2943 #endif
2944
2945 out_im6f_rollback:
2946 if (error) {
2947 im6f_rollback(imf);
2948 } else {
2949 im6f_commit(imf);
2950 }
2951
2952 im6f_reap(imf);
2953
2954 out_imo_locked:
2955 IM6O_UNLOCK(imo);
2956 IM6O_REMREF(imo); /* from in6p_findmoptions() */
2957
2958 /* schedule timer now that we've dropped the lock(s) */
2959 mld_set_fast_timeout(&mtp);
2960
2961 return error;
2962 }
2963
2964 /*
2965 * Set the IP multicast options in response to user setsockopt().
2966 *
2967 * Many of the socket options handled in this function duplicate the
2968 * functionality of socket options in the regular unicast API. However,
2969 * it is not possible to merge the duplicate code, because the idempotence
2970 * of the IPv6 multicast part of the BSD Sockets API must be preserved;
2971 * the effects of these options must be treated as separate and distinct.
2972 *
2973 */
2974 int
ip6_setmoptions(struct inpcb * inp,struct sockopt * sopt)2975 ip6_setmoptions(struct inpcb *inp, struct sockopt *sopt)
2976 {
2977 struct ip6_moptions *im6o;
2978 int error;
2979
2980 error = 0;
2981
2982 /*
2983 * If socket is neither of type SOCK_RAW or SOCK_DGRAM,
2984 * or is a divert socket, reject it.
2985 */
2986 if (SOCK_PROTO(inp->inp_socket) == IPPROTO_DIVERT ||
2987 (SOCK_TYPE(inp->inp_socket) != SOCK_RAW &&
2988 SOCK_TYPE(inp->inp_socket) != SOCK_DGRAM)) {
2989 return EOPNOTSUPP;
2990 }
2991
2992 switch (sopt->sopt_name) {
2993 case IPV6_MULTICAST_IF:
2994 error = in6p_set_multicast_if(inp, sopt);
2995 break;
2996
2997 case IPV6_MULTICAST_HOPS: {
2998 int hlim;
2999
3000 if (sopt->sopt_valsize != sizeof(int)) {
3001 error = EINVAL;
3002 break;
3003 }
3004 error = sooptcopyin(sopt, &hlim, sizeof(hlim), sizeof(int));
3005 if (error) {
3006 break;
3007 }
3008 if (hlim < -1 || hlim > IPV6_MAXHLIM) {
3009 error = EINVAL;
3010 break;
3011 } else if (hlim == -1) {
3012 hlim = ip6_defmcasthlim;
3013 }
3014 im6o = in6p_findmoptions(inp);
3015 if (im6o == NULL) {
3016 error = ENOMEM;
3017 break;
3018 }
3019 IM6O_LOCK(im6o);
3020 im6o->im6o_multicast_hlim = (u_char)hlim;
3021 IM6O_UNLOCK(im6o);
3022 IM6O_REMREF(im6o); /* from in6p_findmoptions() */
3023 break;
3024 }
3025
3026 case IPV6_MULTICAST_LOOP: {
3027 u_int loop;
3028
3029 /*
3030 * Set the loopback flag for outgoing multicast packets.
3031 * Must be zero or one.
3032 */
3033 if (sopt->sopt_valsize != sizeof(u_int)) {
3034 error = EINVAL;
3035 break;
3036 }
3037 error = sooptcopyin(sopt, &loop, sizeof(u_int), sizeof(u_int));
3038 if (error) {
3039 break;
3040 }
3041 if (loop > 1) {
3042 error = EINVAL;
3043 break;
3044 }
3045 im6o = in6p_findmoptions(inp);
3046 if (im6o == NULL) {
3047 error = ENOMEM;
3048 break;
3049 }
3050 IM6O_LOCK(im6o);
3051 im6o->im6o_multicast_loop = (u_char)loop;
3052 IM6O_UNLOCK(im6o);
3053 IM6O_REMREF(im6o); /* from in6p_findmoptions() */
3054 break;
3055 }
3056
3057 case IPV6_JOIN_GROUP:
3058 case MCAST_JOIN_GROUP:
3059 case MCAST_JOIN_SOURCE_GROUP:
3060 error = in6p_join_group(inp, sopt);
3061 break;
3062
3063 case IPV6_LEAVE_GROUP:
3064 case MCAST_LEAVE_GROUP:
3065 case MCAST_LEAVE_SOURCE_GROUP:
3066 error = in6p_leave_group(inp, sopt);
3067 break;
3068
3069 case MCAST_BLOCK_SOURCE:
3070 case MCAST_UNBLOCK_SOURCE:
3071 error = in6p_block_unblock_source(inp, sopt);
3072 break;
3073
3074 case IPV6_MSFILTER:
3075 error = in6p_set_source_filters(inp, sopt);
3076 break;
3077
3078 default:
3079 error = EOPNOTSUPP;
3080 break;
3081 }
3082
3083 return error;
3084 }
3085 /*
3086 * Expose MLD's multicast filter mode and source list(s) to userland,
3087 * keyed by (ifindex, group).
3088 * The filter mode is written out as a uint32_t, followed by
3089 * 0..n of struct in6_addr.
3090 * For use by ifmcstat(8).
3091 */
3092 static int
3093 sysctl_ip6_mcast_filters SYSCTL_HANDLER_ARGS
3094 {
3095 #pragma unused(oidp)
3096 /* int: ifindex + 4 * 32 bits of IPv6 address */
3097 DECLARE_SYSCTL_HANDLER_ARG_ARRAY(int, 5, name, namelen);
3098
3099 struct in6_addr mcaddr;
3100 struct in6_addr src;
3101 struct ifnet *ifp;
3102 struct in6_multi *inm;
3103 struct in6_multistep step;
3104 struct ip6_msource *ims;
3105 int retval = 0;
3106 uint32_t fmode, ifindex;
3107
3108 if (req->newptr != USER_ADDR_NULL) {
3109 return EPERM;
3110 }
3111
3112 ifindex = name[0];
3113 ifnet_head_lock_shared();
3114 if (!IF_INDEX_IN_RANGE(ifindex)) {
3115 MLD_PRINTF(("%s: ifindex %u out of range\n",
3116 __func__, ifindex));
3117 ifnet_head_done();
3118 return ENOENT;
3119 }
3120
3121 memcpy(&mcaddr, &name[1], sizeof(struct in6_addr));
3122 if (!IN6_IS_ADDR_MULTICAST(&mcaddr)) {
3123 MLD_PRINTF(("%s: group %s is not multicast\n",
3124 __func__, ip6_sprintf(&mcaddr)));
3125 ifnet_head_done();
3126 return EINVAL;
3127 }
3128
3129 ifp = ifindex2ifnet[ifindex];
3130 ifnet_head_done();
3131 if (ifp == NULL) {
3132 MLD_PRINTF(("%s: no ifp for ifindex %u\n", __func__, ifindex));
3133 return ENOENT;
3134 }
3135 /*
3136 * Internal MLD lookups require that scope/zone ID is set.
3137 */
3138 uint32_t ifscope = IFSCOPE_NONE;
3139 (void)in6_setscope(&mcaddr, ifp, &ifscope);
3140
3141 in6_multihead_lock_shared();
3142 IN6_FIRST_MULTI(step, inm);
3143 while (inm != NULL) {
3144 IN6M_LOCK(inm);
3145 if (inm->in6m_ifp != ifp) {
3146 goto next;
3147 }
3148
3149 if (!in6_are_addr_equal_scoped(&inm->in6m_addr, &mcaddr, inm->ifscope, ifscope)) {
3150 goto next;
3151 }
3152
3153 fmode = inm->in6m_st[1].iss_fmode;
3154 retval = SYSCTL_OUT(req, &fmode, sizeof(uint32_t));
3155 if (retval != 0) {
3156 IN6M_UNLOCK(inm);
3157 break; /* abort */
3158 }
3159 RB_FOREACH(ims, ip6_msource_tree, &inm->in6m_srcs) {
3160 MLD_PRINTF(("%s: visit node 0x%llx\n", __func__,
3161 (uint64_t)VM_KERNEL_ADDRPERM(ims)));
3162 /*
3163 * Only copy-out sources which are in-mode.
3164 */
3165 if (fmode != im6s_get_mode(inm, ims, 1)) {
3166 MLD_PRINTF(("%s: skip non-in-mode\n",
3167 __func__));
3168 continue; /* process next source */
3169 }
3170 src = ims->im6s_addr;
3171 retval = SYSCTL_OUT(req, &src, sizeof(struct in6_addr));
3172 if (retval != 0) {
3173 break; /* process next inm */
3174 }
3175 }
3176 next:
3177 IN6M_UNLOCK(inm);
3178 IN6_NEXT_MULTI(step, inm);
3179 }
3180 in6_multihead_lock_done();
3181
3182 return retval;
3183 }
3184
3185 static struct in6_multi *
in6_multi_alloc(zalloc_flags_t how)3186 in6_multi_alloc(zalloc_flags_t how)
3187 {
3188 struct in6_multi *__single in6m;
3189
3190 if (in6m_debug == 0) {
3191 in6m = kalloc_type(struct in6_multi, how | Z_ZERO);
3192 } else {
3193 struct in6_multi_dbg *__single in6m_dbg;
3194 in6m_dbg = kalloc_type(struct in6_multi_dbg, how | Z_ZERO);
3195 in6m = (struct in6_multi *__single)in6m_dbg;
3196 }
3197 if (in6m != NULL) {
3198 lck_mtx_init(&in6m->in6m_lock, &in6_multihead_lock_grp,
3199 &in6_multihead_lock_attr);
3200 in6m->in6m_debug |= IFD_ALLOC;
3201 if (in6m_debug != 0) {
3202 in6m->in6m_debug |= IFD_DEBUG;
3203 in6m->in6m_trace = in6m_trace;
3204 }
3205 in6m->ifscope = IFSCOPE_NONE;
3206 }
3207 return in6m;
3208 }
3209
3210 static void
in6_multi_free(struct in6_multi * in6m)3211 in6_multi_free(struct in6_multi *in6m)
3212 {
3213 IN6M_LOCK(in6m);
3214 if (in6m->in6m_debug & IFD_ATTACHED) {
3215 panic("%s: attached in6m=%p is being freed", __func__, in6m);
3216 /* NOTREACHED */
3217 } else if (in6m->in6m_ifma != NULL) {
3218 panic("%s: ifma not NULL for in6m=%p", __func__, in6m);
3219 /* NOTREACHED */
3220 } else if (!(in6m->in6m_debug & IFD_ALLOC)) {
3221 panic("%s: in6m %p cannot be freed", __func__, in6m);
3222 /* NOTREACHED */
3223 } else if (in6m->in6m_refcount != 0) {
3224 panic("%s: non-zero refcount in6m=%p", __func__, in6m);
3225 /* NOTREACHED */
3226 } else if (in6m->in6m_reqcnt != 0) {
3227 panic("%s: non-zero reqcnt in6m=%p", __func__, in6m);
3228 /* NOTREACHED */
3229 }
3230
3231 /* Free any pending MLDv2 state-change records */
3232 IF_DRAIN(&in6m->in6m_scq);
3233
3234 in6m->in6m_debug &= ~IFD_ALLOC;
3235 if ((in6m->in6m_debug & (IFD_DEBUG | IFD_TRASHED)) ==
3236 (IFD_DEBUG | IFD_TRASHED)) {
3237 lck_mtx_lock(&in6m_trash_lock);
3238 TAILQ_REMOVE(&in6m_trash_head, (struct in6_multi_dbg *)in6m,
3239 in6m_trash_link);
3240 lck_mtx_unlock(&in6m_trash_lock);
3241 in6m->in6m_debug &= ~IFD_TRASHED;
3242 }
3243 IN6M_UNLOCK(in6m);
3244
3245 lck_mtx_destroy(&in6m->in6m_lock, &in6_multihead_lock_grp);
3246 if (!in6m_debug) {
3247 kfree_type(struct in6_multi, in6m);
3248 } else {
3249 struct in6_multi_dbg *__single in6m_dbg =
3250 (struct in6_multi_dbg *__single)in6m;
3251 kfree_type(struct in6_multi_dbg, in6m_dbg);
3252 in6m = NULL;
3253 }
3254 }
3255
3256 static void
in6_multi_attach(struct in6_multi * in6m)3257 in6_multi_attach(struct in6_multi *in6m)
3258 {
3259 in6_multihead_lock_assert(LCK_RW_ASSERT_EXCLUSIVE);
3260 IN6M_LOCK_ASSERT_HELD(in6m);
3261
3262 if (in6m->in6m_debug & IFD_ATTACHED) {
3263 panic("%s: Attempt to attach an already attached in6m=%p",
3264 __func__, in6m);
3265 /* NOTREACHED */
3266 }
3267
3268 in6m->in6m_reqcnt++;
3269 VERIFY(in6m->in6m_reqcnt == 1);
3270 IN6M_ADDREF_LOCKED(in6m);
3271 in6m->in6m_debug |= IFD_ATTACHED;
3272 /*
3273 * Reattach case: If debugging is enabled, take it
3274 * out of the trash list and clear IFD_TRASHED.
3275 */
3276 if ((in6m->in6m_debug & (IFD_DEBUG | IFD_TRASHED)) ==
3277 (IFD_DEBUG | IFD_TRASHED)) {
3278 /* Become a regular mutex, just in case */
3279 IN6M_CONVERT_LOCK(in6m);
3280 lck_mtx_lock(&in6m_trash_lock);
3281 TAILQ_REMOVE(&in6m_trash_head, (struct in6_multi_dbg *)in6m,
3282 in6m_trash_link);
3283 lck_mtx_unlock(&in6m_trash_lock);
3284 in6m->in6m_debug &= ~IFD_TRASHED;
3285 }
3286
3287 LIST_INSERT_HEAD(&in6_multihead, in6m, in6m_entry);
3288 }
3289
3290 int
in6_multi_detach(struct in6_multi * in6m)3291 in6_multi_detach(struct in6_multi *in6m)
3292 {
3293 in6_multihead_lock_assert(LCK_RW_ASSERT_EXCLUSIVE);
3294 IN6M_LOCK_ASSERT_HELD(in6m);
3295
3296 if (in6m->in6m_reqcnt == 0) {
3297 panic("%s: in6m=%p negative reqcnt", __func__, in6m);
3298 /* NOTREACHED */
3299 }
3300
3301 --in6m->in6m_reqcnt;
3302 if (in6m->in6m_reqcnt > 0) {
3303 return 0;
3304 }
3305
3306 if (!(in6m->in6m_debug & IFD_ATTACHED)) {
3307 panic("%s: Attempt to detach an unattached record in6m=%p",
3308 __func__, in6m);
3309 /* NOTREACHED */
3310 } else if (in6m->in6m_debug & IFD_TRASHED) {
3311 panic("%s: in6m %p is already in trash list", __func__, in6m);
3312 /* NOTREACHED */
3313 }
3314
3315 /*
3316 * NOTE: Caller calls IFMA_REMREF
3317 */
3318 in6m->in6m_debug &= ~IFD_ATTACHED;
3319 LIST_REMOVE(in6m, in6m_entry);
3320
3321 if (in6m->in6m_debug & IFD_DEBUG) {
3322 /* Become a regular mutex, just in case */
3323 IN6M_CONVERT_LOCK(in6m);
3324 lck_mtx_lock(&in6m_trash_lock);
3325 TAILQ_INSERT_TAIL(&in6m_trash_head,
3326 (struct in6_multi_dbg *)in6m, in6m_trash_link);
3327 lck_mtx_unlock(&in6m_trash_lock);
3328 in6m->in6m_debug |= IFD_TRASHED;
3329 }
3330
3331 return 1;
3332 }
3333
3334 void
in6m_addref(struct in6_multi * in6m,int locked)3335 in6m_addref(struct in6_multi *in6m, int locked)
3336 {
3337 if (!locked) {
3338 IN6M_LOCK_SPIN(in6m);
3339 } else {
3340 IN6M_LOCK_ASSERT_HELD(in6m);
3341 }
3342
3343 if (++in6m->in6m_refcount == 0) {
3344 panic("%s: in6m=%p wraparound refcnt", __func__, in6m);
3345 /* NOTREACHED */
3346 } else if (in6m->in6m_trace != NULL) {
3347 (*in6m->in6m_trace)(in6m, TRUE);
3348 }
3349 if (!locked) {
3350 IN6M_UNLOCK(in6m);
3351 }
3352 }
3353
3354 void
in6m_remref(struct in6_multi * in6m,int locked)3355 in6m_remref(struct in6_multi *in6m, int locked)
3356 {
3357 struct ifmultiaddr *ifma;
3358 struct mld_ifinfo *mli;
3359
3360 if (!locked) {
3361 IN6M_LOCK_SPIN(in6m);
3362 } else {
3363 IN6M_LOCK_ASSERT_HELD(in6m);
3364 }
3365
3366 if (in6m->in6m_refcount == 0 || (in6m->in6m_refcount == 1 && locked)) {
3367 panic("%s: in6m=%p negative refcnt", __func__, in6m);
3368 /* NOTREACHED */
3369 } else if (in6m->in6m_trace != NULL) {
3370 (*in6m->in6m_trace)(in6m, FALSE);
3371 }
3372
3373 --in6m->in6m_refcount;
3374 if (in6m->in6m_refcount > 0) {
3375 if (!locked) {
3376 IN6M_UNLOCK(in6m);
3377 }
3378 return;
3379 }
3380
3381 /*
3382 * Synchronization with in6_mc_get(). In the event the in6m has been
3383 * detached, the underlying ifma would still be in the if_multiaddrs
3384 * list, and thus can be looked up via if_addmulti(). At that point,
3385 * the only way to find this in6m is via ifma_protospec. To avoid
3386 * race conditions between the last in6m_remref() of that in6m and its
3387 * use via ifma_protospec, in6_multihead lock is used for serialization.
3388 * In order to avoid violating the lock order, we must drop in6m_lock
3389 * before acquiring in6_multihead lock. To prevent the in6m from being
3390 * freed prematurely, we hold an extra reference.
3391 */
3392 ++in6m->in6m_refcount;
3393 IN6M_UNLOCK(in6m);
3394 in6_multihead_lock_shared();
3395 IN6M_LOCK_SPIN(in6m);
3396 --in6m->in6m_refcount;
3397 if (in6m->in6m_refcount > 0) {
3398 /* We've lost the race, so abort since in6m is still in use */
3399 IN6M_UNLOCK(in6m);
3400 in6_multihead_lock_done();
3401 /* If it was locked, return it as such */
3402 if (locked) {
3403 IN6M_LOCK(in6m);
3404 }
3405 return;
3406 }
3407 in6m_purge(in6m);
3408 ifma = in6m->in6m_ifma;
3409 in6m->in6m_ifma = NULL;
3410 in6m->in6m_ifp = NULL;
3411 mli = in6m->in6m_mli;
3412 in6m->in6m_mli = NULL;
3413 IN6M_UNLOCK(in6m);
3414 IFMA_LOCK_SPIN(ifma);
3415 ifma->ifma_protospec = NULL;
3416 IFMA_UNLOCK(ifma);
3417 in6_multihead_lock_done();
3418
3419 in6_multi_free(in6m);
3420 if_delmulti_ifma(ifma);
3421 /* Release reference held to the underlying ifmultiaddr */
3422 IFMA_REMREF(ifma);
3423
3424 if (mli != NULL) {
3425 MLI_REMREF(mli);
3426 }
3427 }
3428
3429 static void
in6m_trace(struct in6_multi * in6m,int refhold)3430 in6m_trace(struct in6_multi *in6m, int refhold)
3431 {
3432 struct in6_multi_dbg *__single in6m_dbg =
3433 (struct in6_multi_dbg *__single)in6m;
3434 ctrace_t *tr;
3435 u_int32_t idx;
3436 u_int16_t *cnt;
3437
3438 if (!(in6m->in6m_debug & IFD_DEBUG)) {
3439 panic("%s: in6m %p has no debug structure", __func__, in6m);
3440 /* NOTREACHED */
3441 }
3442 if (refhold) {
3443 cnt = &in6m_dbg->in6m_refhold_cnt;
3444 tr = in6m_dbg->in6m_refhold;
3445 } else {
3446 cnt = &in6m_dbg->in6m_refrele_cnt;
3447 tr = in6m_dbg->in6m_refrele;
3448 }
3449
3450 idx = os_atomic_inc_orig(cnt, relaxed) % IN6M_TRACE_HIST_SIZE;
3451 ctrace_record(&tr[idx]);
3452 }
3453
3454 static struct in6_multi_mship *
in6_multi_mship_alloc(zalloc_flags_t how)3455 in6_multi_mship_alloc(zalloc_flags_t how)
3456 {
3457 return zalloc_flags(imm_zone, how | Z_ZERO);
3458 }
3459
3460 static void
in6_multi_mship_free(struct in6_multi_mship * imm)3461 in6_multi_mship_free(struct in6_multi_mship *imm)
3462 {
3463 if (imm->i6mm_maddr != NULL) {
3464 panic("%s: i6mm_maddr not NULL for imm=%p", __func__, imm);
3465 /* NOTREACHED */
3466 }
3467 zfree(imm_zone, imm);
3468 }
3469
3470 void
in6_multihead_lock_exclusive(void)3471 in6_multihead_lock_exclusive(void)
3472 {
3473 lck_rw_lock_exclusive(&in6_multihead_lock);
3474 }
3475
3476 void
in6_multihead_lock_shared(void)3477 in6_multihead_lock_shared(void)
3478 {
3479 lck_rw_lock_shared(&in6_multihead_lock);
3480 }
3481
3482 void
in6_multihead_lock_assert(int what)3483 in6_multihead_lock_assert(int what)
3484 {
3485 #if !MACH_ASSERT
3486 #pragma unused(what)
3487 #endif
3488 LCK_RW_ASSERT(&in6_multihead_lock, what);
3489 }
3490
3491 void
in6_multihead_lock_done(void)3492 in6_multihead_lock_done(void)
3493 {
3494 lck_rw_done(&in6_multihead_lock);
3495 }
3496
3497 static struct ip6_msource *
ip6ms_alloc(zalloc_flags_t how)3498 ip6ms_alloc(zalloc_flags_t how)
3499 {
3500 return zalloc_flags(ip6ms_zone, how | Z_ZERO);
3501 }
3502
3503 static void
ip6ms_free(struct ip6_msource * i6ms)3504 ip6ms_free(struct ip6_msource *i6ms)
3505 {
3506 zfree(ip6ms_zone, i6ms);
3507 }
3508
3509 static struct in6_msource *
in6ms_alloc(zalloc_flags_t how)3510 in6ms_alloc(zalloc_flags_t how)
3511 {
3512 return zalloc_flags(in6ms_zone, how | Z_ZERO);
3513 }
3514
3515 static void
in6ms_free(struct in6_msource * in6ms)3516 in6ms_free(struct in6_msource *in6ms)
3517 {
3518 zfree(in6ms_zone, in6ms);
3519 }
3520
3521 #ifdef MLD_DEBUG
3522
3523 static const char *in6m_modestrs[] = { "un", "in", "ex" };
3524
3525 static const char *
in6m_mode_str(const int mode)3526 in6m_mode_str(const int mode)
3527 {
3528 if (mode >= MCAST_UNDEFINED && mode <= MCAST_EXCLUDE) {
3529 return in6m_modestrs[mode];
3530 }
3531 return "??";
3532 }
3533
3534 static const char *in6m_statestrs[] = {
3535 "not-member",
3536 "silent",
3537 "reporting",
3538 "idle",
3539 "lazy",
3540 "sleeping",
3541 "awakening",
3542 "query-pending",
3543 "sg-query-pending",
3544 "leaving"
3545 };
3546
3547 static const char *
in6m_state_str(const int state)3548 in6m_state_str(const int state)
3549 {
3550 if (state >= MLD_NOT_MEMBER && state <= MLD_LEAVING_MEMBER) {
3551 return in6m_statestrs[state];
3552 }
3553 return "??";
3554 }
3555
3556 /*
3557 * Dump an in6_multi structure to the console.
3558 */
3559 void
in6m_print(const struct in6_multi * inm)3560 in6m_print(const struct in6_multi *inm)
3561 {
3562 int t;
3563
3564 IN6M_LOCK_ASSERT_HELD(__DECONST(struct in6_multi *, inm));
3565
3566 if (mld_debug == 0) {
3567 return;
3568 }
3569
3570 printf("%s: --- begin in6m 0x%llx ---\n", __func__,
3571 (uint64_t)VM_KERNEL_ADDRPERM(inm));
3572 printf("addr %s ifp 0x%llx(%s) ifma 0x%llx\n",
3573 ip6_sprintf(&inm->in6m_addr),
3574 (uint64_t)VM_KERNEL_ADDRPERM(inm->in6m_ifp),
3575 if_name(inm->in6m_ifp),
3576 (uint64_t)VM_KERNEL_ADDRPERM(inm->in6m_ifma));
3577 printf("timer %u state %s refcount %u scq.len %u\n",
3578 inm->in6m_timer,
3579 in6m_state_str(inm->in6m_state),
3580 inm->in6m_refcount,
3581 inm->in6m_scq.ifq_len);
3582 printf("mli 0x%llx nsrc %lu sctimer %u scrv %u\n",
3583 (uint64_t)VM_KERNEL_ADDRPERM(inm->in6m_mli),
3584 inm->in6m_nsrc,
3585 inm->in6m_sctimer,
3586 inm->in6m_scrv);
3587 for (t = 0; t < 2; t++) {
3588 printf("t%d: fmode %s asm %u ex %u in %u rec %u\n", t,
3589 in6m_mode_str(inm->in6m_st[t].iss_fmode),
3590 inm->in6m_st[t].iss_asm,
3591 inm->in6m_st[t].iss_ex,
3592 inm->in6m_st[t].iss_in,
3593 inm->in6m_st[t].iss_rec);
3594 }
3595 printf("%s: --- end in6m 0x%llx ---\n", __func__,
3596 (uint64_t)VM_KERNEL_ADDRPERM(inm));
3597 }
3598
3599 #else
3600
3601 void
in6m_print(__unused const struct in6_multi * inm)3602 in6m_print(__unused const struct in6_multi *inm)
3603 {
3604 }
3605
3606 #endif
3607