1 /*
2 * Bridge multicast support.
3 *
4 * Copyright (c) 2010 Herbert Xu <herbert@gondor.apana.org.au>
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the Free
8 * Software Foundation; either version 2 of the License, or (at your option)
9 * any later version.
10 *
11 */
12
13 #include <linux/err.h>
14 #include <linux/if_ether.h>
15 #include <linux/igmp.h>
16 #include <linux/jhash.h>
17 #include <linux/kernel.h>
18 #include <linux/log2.h>
19 #include <linux/netdevice.h>
20 #include <linux/netfilter_bridge.h>
21 #include <linux/random.h>
22 #include <linux/rculist.h>
23 #include <linux/skbuff.h>
24 #include <linux/slab.h>
25 #include <linux/timer.h>
26 #include <net/ip.h>
27 #if IS_ENABLED(CONFIG_IPV6)
28 #include <net/ipv6.h>
29 #include <net/mld.h>
30 #include <net/addrconf.h>
31 #include <net/ip6_checksum.h>
32 #endif
33
34 #include "br_private.h"
35
36 #define mlock_dereference(X, br) \
37 rcu_dereference_protected(X, lockdep_is_held(&br->multicast_lock))
38
39 #if IS_ENABLED(CONFIG_IPV6)
ipv6_is_transient_multicast(const struct in6_addr * addr)40 static inline int ipv6_is_transient_multicast(const struct in6_addr *addr)
41 {
42 if (ipv6_addr_is_multicast(addr) && IPV6_ADDR_MC_FLAG_TRANSIENT(addr))
43 return 1;
44 return 0;
45 }
46 #endif
47
br_ip_equal(const struct br_ip * a,const struct br_ip * b)48 static inline int br_ip_equal(const struct br_ip *a, const struct br_ip *b)
49 {
50 if (a->proto != b->proto)
51 return 0;
52 switch (a->proto) {
53 case htons(ETH_P_IP):
54 return a->u.ip4 == b->u.ip4;
55 #if IS_ENABLED(CONFIG_IPV6)
56 case htons(ETH_P_IPV6):
57 return ipv6_addr_equal(&a->u.ip6, &b->u.ip6);
58 #endif
59 }
60 return 0;
61 }
62
__br_ip4_hash(struct net_bridge_mdb_htable * mdb,__be32 ip)63 static inline int __br_ip4_hash(struct net_bridge_mdb_htable *mdb, __be32 ip)
64 {
65 return jhash_1word(mdb->secret, (__force u32)ip) & (mdb->max - 1);
66 }
67
68 #if IS_ENABLED(CONFIG_IPV6)
__br_ip6_hash(struct net_bridge_mdb_htable * mdb,const struct in6_addr * ip)69 static inline int __br_ip6_hash(struct net_bridge_mdb_htable *mdb,
70 const struct in6_addr *ip)
71 {
72 return jhash2((__force u32 *)ip->s6_addr32, 4, mdb->secret) & (mdb->max - 1);
73 }
74 #endif
75
br_ip_hash(struct net_bridge_mdb_htable * mdb,struct br_ip * ip)76 static inline int br_ip_hash(struct net_bridge_mdb_htable *mdb,
77 struct br_ip *ip)
78 {
79 switch (ip->proto) {
80 case htons(ETH_P_IP):
81 return __br_ip4_hash(mdb, ip->u.ip4);
82 #if IS_ENABLED(CONFIG_IPV6)
83 case htons(ETH_P_IPV6):
84 return __br_ip6_hash(mdb, &ip->u.ip6);
85 #endif
86 }
87 return 0;
88 }
89
__br_mdb_ip_get(struct net_bridge_mdb_htable * mdb,struct br_ip * dst,int hash)90 static struct net_bridge_mdb_entry *__br_mdb_ip_get(
91 struct net_bridge_mdb_htable *mdb, struct br_ip *dst, int hash)
92 {
93 struct net_bridge_mdb_entry *mp;
94 struct hlist_node *p;
95
96 hlist_for_each_entry_rcu(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
97 if (br_ip_equal(&mp->addr, dst))
98 return mp;
99 }
100
101 return NULL;
102 }
103
br_mdb_ip_get(struct net_bridge_mdb_htable * mdb,struct br_ip * dst)104 static struct net_bridge_mdb_entry *br_mdb_ip_get(
105 struct net_bridge_mdb_htable *mdb, struct br_ip *dst)
106 {
107 if (!mdb)
108 return NULL;
109
110 return __br_mdb_ip_get(mdb, dst, br_ip_hash(mdb, dst));
111 }
112
br_mdb_ip4_get(struct net_bridge_mdb_htable * mdb,__be32 dst)113 static struct net_bridge_mdb_entry *br_mdb_ip4_get(
114 struct net_bridge_mdb_htable *mdb, __be32 dst)
115 {
116 struct br_ip br_dst;
117
118 br_dst.u.ip4 = dst;
119 br_dst.proto = htons(ETH_P_IP);
120
121 return br_mdb_ip_get(mdb, &br_dst);
122 }
123
124 #if IS_ENABLED(CONFIG_IPV6)
br_mdb_ip6_get(struct net_bridge_mdb_htable * mdb,const struct in6_addr * dst)125 static struct net_bridge_mdb_entry *br_mdb_ip6_get(
126 struct net_bridge_mdb_htable *mdb, const struct in6_addr *dst)
127 {
128 struct br_ip br_dst;
129
130 br_dst.u.ip6 = *dst;
131 br_dst.proto = htons(ETH_P_IPV6);
132
133 return br_mdb_ip_get(mdb, &br_dst);
134 }
135 #endif
136
br_mdb_get(struct net_bridge * br,struct sk_buff * skb)137 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
138 struct sk_buff *skb)
139 {
140 struct net_bridge_mdb_htable *mdb = rcu_dereference(br->mdb);
141 struct br_ip ip;
142
143 if (br->multicast_disabled)
144 return NULL;
145
146 if (BR_INPUT_SKB_CB(skb)->igmp)
147 return NULL;
148
149 ip.proto = skb->protocol;
150
151 switch (skb->protocol) {
152 case htons(ETH_P_IP):
153 ip.u.ip4 = ip_hdr(skb)->daddr;
154 break;
155 #if IS_ENABLED(CONFIG_IPV6)
156 case htons(ETH_P_IPV6):
157 ip.u.ip6 = ipv6_hdr(skb)->daddr;
158 break;
159 #endif
160 default:
161 return NULL;
162 }
163
164 return br_mdb_ip_get(mdb, &ip);
165 }
166
br_mdb_free(struct rcu_head * head)167 static void br_mdb_free(struct rcu_head *head)
168 {
169 struct net_bridge_mdb_htable *mdb =
170 container_of(head, struct net_bridge_mdb_htable, rcu);
171 struct net_bridge_mdb_htable *old = mdb->old;
172
173 mdb->old = NULL;
174 kfree(old->mhash);
175 kfree(old);
176 }
177
br_mdb_copy(struct net_bridge_mdb_htable * new,struct net_bridge_mdb_htable * old,int elasticity)178 static int br_mdb_copy(struct net_bridge_mdb_htable *new,
179 struct net_bridge_mdb_htable *old,
180 int elasticity)
181 {
182 struct net_bridge_mdb_entry *mp;
183 struct hlist_node *p;
184 int maxlen;
185 int len;
186 int i;
187
188 for (i = 0; i < old->max; i++)
189 hlist_for_each_entry(mp, p, &old->mhash[i], hlist[old->ver])
190 hlist_add_head(&mp->hlist[new->ver],
191 &new->mhash[br_ip_hash(new, &mp->addr)]);
192
193 if (!elasticity)
194 return 0;
195
196 maxlen = 0;
197 for (i = 0; i < new->max; i++) {
198 len = 0;
199 hlist_for_each_entry(mp, p, &new->mhash[i], hlist[new->ver])
200 len++;
201 if (len > maxlen)
202 maxlen = len;
203 }
204
205 return maxlen > elasticity ? -EINVAL : 0;
206 }
207
br_multicast_free_pg(struct rcu_head * head)208 static void br_multicast_free_pg(struct rcu_head *head)
209 {
210 struct net_bridge_port_group *p =
211 container_of(head, struct net_bridge_port_group, rcu);
212
213 kfree(p);
214 }
215
br_multicast_free_group(struct rcu_head * head)216 static void br_multicast_free_group(struct rcu_head *head)
217 {
218 struct net_bridge_mdb_entry *mp =
219 container_of(head, struct net_bridge_mdb_entry, rcu);
220
221 kfree(mp);
222 }
223
br_multicast_group_expired(unsigned long data)224 static void br_multicast_group_expired(unsigned long data)
225 {
226 struct net_bridge_mdb_entry *mp = (void *)data;
227 struct net_bridge *br = mp->br;
228 struct net_bridge_mdb_htable *mdb;
229
230 spin_lock(&br->multicast_lock);
231 if (!netif_running(br->dev) || timer_pending(&mp->timer))
232 goto out;
233
234 mp->mglist = false;
235
236 if (mp->ports)
237 goto out;
238
239 mdb = mlock_dereference(br->mdb, br);
240
241 hlist_del_rcu(&mp->hlist[mdb->ver]);
242 mdb->size--;
243
244 call_rcu_bh(&mp->rcu, br_multicast_free_group);
245
246 out:
247 spin_unlock(&br->multicast_lock);
248 }
249
br_multicast_del_pg(struct net_bridge * br,struct net_bridge_port_group * pg)250 static void br_multicast_del_pg(struct net_bridge *br,
251 struct net_bridge_port_group *pg)
252 {
253 struct net_bridge_mdb_htable *mdb;
254 struct net_bridge_mdb_entry *mp;
255 struct net_bridge_port_group *p;
256 struct net_bridge_port_group __rcu **pp;
257
258 mdb = mlock_dereference(br->mdb, br);
259
260 mp = br_mdb_ip_get(mdb, &pg->addr);
261 if (WARN_ON(!mp))
262 return;
263
264 for (pp = &mp->ports;
265 (p = mlock_dereference(*pp, br)) != NULL;
266 pp = &p->next) {
267 if (p != pg)
268 continue;
269
270 rcu_assign_pointer(*pp, p->next);
271 hlist_del_init(&p->mglist);
272 del_timer(&p->timer);
273 call_rcu_bh(&p->rcu, br_multicast_free_pg);
274
275 if (!mp->ports && !mp->mglist &&
276 netif_running(br->dev))
277 mod_timer(&mp->timer, jiffies);
278
279 return;
280 }
281
282 WARN_ON(1);
283 }
284
br_multicast_port_group_expired(unsigned long data)285 static void br_multicast_port_group_expired(unsigned long data)
286 {
287 struct net_bridge_port_group *pg = (void *)data;
288 struct net_bridge *br = pg->port->br;
289
290 spin_lock(&br->multicast_lock);
291 if (!netif_running(br->dev) || timer_pending(&pg->timer) ||
292 hlist_unhashed(&pg->mglist))
293 goto out;
294
295 br_multicast_del_pg(br, pg);
296
297 out:
298 spin_unlock(&br->multicast_lock);
299 }
300
br_mdb_rehash(struct net_bridge_mdb_htable __rcu ** mdbp,int max,int elasticity)301 static int br_mdb_rehash(struct net_bridge_mdb_htable __rcu **mdbp, int max,
302 int elasticity)
303 {
304 struct net_bridge_mdb_htable *old = rcu_dereference_protected(*mdbp, 1);
305 struct net_bridge_mdb_htable *mdb;
306 int err;
307
308 mdb = kmalloc(sizeof(*mdb), GFP_ATOMIC);
309 if (!mdb)
310 return -ENOMEM;
311
312 mdb->max = max;
313 mdb->old = old;
314
315 mdb->mhash = kzalloc(max * sizeof(*mdb->mhash), GFP_ATOMIC);
316 if (!mdb->mhash) {
317 kfree(mdb);
318 return -ENOMEM;
319 }
320
321 mdb->size = old ? old->size : 0;
322 mdb->ver = old ? old->ver ^ 1 : 0;
323
324 if (!old || elasticity)
325 get_random_bytes(&mdb->secret, sizeof(mdb->secret));
326 else
327 mdb->secret = old->secret;
328
329 if (!old)
330 goto out;
331
332 err = br_mdb_copy(mdb, old, elasticity);
333 if (err) {
334 kfree(mdb->mhash);
335 kfree(mdb);
336 return err;
337 }
338
339 call_rcu_bh(&mdb->rcu, br_mdb_free);
340
341 out:
342 rcu_assign_pointer(*mdbp, mdb);
343
344 return 0;
345 }
346
br_ip4_multicast_alloc_query(struct net_bridge * br,__be32 group)347 static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
348 __be32 group)
349 {
350 struct sk_buff *skb;
351 struct igmphdr *ih;
352 struct ethhdr *eth;
353 struct iphdr *iph;
354
355 skb = netdev_alloc_skb_ip_align(br->dev, sizeof(*eth) + sizeof(*iph) +
356 sizeof(*ih) + 4);
357 if (!skb)
358 goto out;
359
360 skb->protocol = htons(ETH_P_IP);
361
362 skb_reset_mac_header(skb);
363 eth = eth_hdr(skb);
364
365 memcpy(eth->h_source, br->dev->dev_addr, 6);
366 eth->h_dest[0] = 1;
367 eth->h_dest[1] = 0;
368 eth->h_dest[2] = 0x5e;
369 eth->h_dest[3] = 0;
370 eth->h_dest[4] = 0;
371 eth->h_dest[5] = 1;
372 eth->h_proto = htons(ETH_P_IP);
373 skb_put(skb, sizeof(*eth));
374
375 skb_set_network_header(skb, skb->len);
376 iph = ip_hdr(skb);
377
378 iph->version = 4;
379 iph->ihl = 6;
380 iph->tos = 0xc0;
381 iph->tot_len = htons(sizeof(*iph) + sizeof(*ih) + 4);
382 iph->id = 0;
383 iph->frag_off = htons(IP_DF);
384 iph->ttl = 1;
385 iph->protocol = IPPROTO_IGMP;
386 iph->saddr = 0;
387 iph->daddr = htonl(INADDR_ALLHOSTS_GROUP);
388 ((u8 *)&iph[1])[0] = IPOPT_RA;
389 ((u8 *)&iph[1])[1] = 4;
390 ((u8 *)&iph[1])[2] = 0;
391 ((u8 *)&iph[1])[3] = 0;
392 ip_send_check(iph);
393 skb_put(skb, 24);
394
395 skb_set_transport_header(skb, skb->len);
396 ih = igmp_hdr(skb);
397 ih->type = IGMP_HOST_MEMBERSHIP_QUERY;
398 ih->code = (group ? br->multicast_last_member_interval :
399 br->multicast_query_response_interval) /
400 (HZ / IGMP_TIMER_SCALE);
401 ih->group = group;
402 ih->csum = 0;
403 ih->csum = ip_compute_csum((void *)ih, sizeof(struct igmphdr));
404 skb_put(skb, sizeof(*ih));
405
406 __skb_pull(skb, sizeof(*eth));
407
408 out:
409 return skb;
410 }
411
412 #if IS_ENABLED(CONFIG_IPV6)
br_ip6_multicast_alloc_query(struct net_bridge * br,const struct in6_addr * group)413 static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
414 const struct in6_addr *group)
415 {
416 struct sk_buff *skb;
417 struct ipv6hdr *ip6h;
418 struct mld_msg *mldq;
419 struct ethhdr *eth;
420 u8 *hopopt;
421 unsigned long interval;
422
423 skb = netdev_alloc_skb_ip_align(br->dev, sizeof(*eth) + sizeof(*ip6h) +
424 8 + sizeof(*mldq));
425 if (!skb)
426 goto out;
427
428 skb->protocol = htons(ETH_P_IPV6);
429
430 /* Ethernet header */
431 skb_reset_mac_header(skb);
432 eth = eth_hdr(skb);
433
434 memcpy(eth->h_source, br->dev->dev_addr, 6);
435 eth->h_proto = htons(ETH_P_IPV6);
436 skb_put(skb, sizeof(*eth));
437
438 /* IPv6 header + HbH option */
439 skb_set_network_header(skb, skb->len);
440 ip6h = ipv6_hdr(skb);
441
442 *(__force __be32 *)ip6h = htonl(0x60000000);
443 ip6h->payload_len = htons(8 + sizeof(*mldq));
444 ip6h->nexthdr = IPPROTO_HOPOPTS;
445 ip6h->hop_limit = 1;
446 ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
447 if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
448 &ip6h->saddr)) {
449 kfree_skb(skb);
450 return NULL;
451 }
452 ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
453
454 hopopt = (u8 *)(ip6h + 1);
455 hopopt[0] = IPPROTO_ICMPV6; /* next hdr */
456 hopopt[1] = 0; /* length of HbH */
457 hopopt[2] = IPV6_TLV_ROUTERALERT; /* Router Alert */
458 hopopt[3] = 2; /* Length of RA Option */
459 hopopt[4] = 0; /* Type = 0x0000 (MLD) */
460 hopopt[5] = 0;
461 hopopt[6] = IPV6_TLV_PAD0; /* Pad0 */
462 hopopt[7] = IPV6_TLV_PAD0; /* Pad0 */
463
464 skb_put(skb, sizeof(*ip6h) + 8);
465
466 /* ICMPv6 */
467 skb_set_transport_header(skb, skb->len);
468 mldq = (struct mld_msg *) icmp6_hdr(skb);
469
470 interval = ipv6_addr_any(group) ?
471 br->multicast_query_response_interval :
472 br->multicast_last_member_interval;
473
474 mldq->mld_type = ICMPV6_MGM_QUERY;
475 mldq->mld_code = 0;
476 mldq->mld_cksum = 0;
477 mldq->mld_maxdelay = htons((u16)jiffies_to_msecs(interval));
478 mldq->mld_reserved = 0;
479 mldq->mld_mca = *group;
480
481 /* checksum */
482 mldq->mld_cksum = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
483 sizeof(*mldq), IPPROTO_ICMPV6,
484 csum_partial(mldq,
485 sizeof(*mldq), 0));
486 skb_put(skb, sizeof(*mldq));
487
488 __skb_pull(skb, sizeof(*eth));
489
490 out:
491 return skb;
492 }
493 #endif
494
br_multicast_alloc_query(struct net_bridge * br,struct br_ip * addr)495 static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
496 struct br_ip *addr)
497 {
498 switch (addr->proto) {
499 case htons(ETH_P_IP):
500 return br_ip4_multicast_alloc_query(br, addr->u.ip4);
501 #if IS_ENABLED(CONFIG_IPV6)
502 case htons(ETH_P_IPV6):
503 return br_ip6_multicast_alloc_query(br, &addr->u.ip6);
504 #endif
505 }
506 return NULL;
507 }
508
br_multicast_get_group(struct net_bridge * br,struct net_bridge_port * port,struct br_ip * group,int hash)509 static struct net_bridge_mdb_entry *br_multicast_get_group(
510 struct net_bridge *br, struct net_bridge_port *port,
511 struct br_ip *group, int hash)
512 {
513 struct net_bridge_mdb_htable *mdb;
514 struct net_bridge_mdb_entry *mp;
515 struct hlist_node *p;
516 unsigned count = 0;
517 unsigned max;
518 int elasticity;
519 int err;
520
521 mdb = rcu_dereference_protected(br->mdb, 1);
522 hlist_for_each_entry(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
523 count++;
524 if (unlikely(br_ip_equal(group, &mp->addr)))
525 return mp;
526 }
527
528 elasticity = 0;
529 max = mdb->max;
530
531 if (unlikely(count > br->hash_elasticity && count)) {
532 if (net_ratelimit())
533 br_info(br, "Multicast hash table "
534 "chain limit reached: %s\n",
535 port ? port->dev->name : br->dev->name);
536
537 elasticity = br->hash_elasticity;
538 }
539
540 if (mdb->size >= max) {
541 max *= 2;
542 if (unlikely(max >= br->hash_max)) {
543 br_warn(br, "Multicast hash table maximum "
544 "reached, disabling snooping: %s, %d\n",
545 port ? port->dev->name : br->dev->name, max);
546 err = -E2BIG;
547 disable:
548 br->multicast_disabled = 1;
549 goto err;
550 }
551 }
552
553 if (max > mdb->max || elasticity) {
554 if (mdb->old) {
555 if (net_ratelimit())
556 br_info(br, "Multicast hash table "
557 "on fire: %s\n",
558 port ? port->dev->name : br->dev->name);
559 err = -EEXIST;
560 goto err;
561 }
562
563 err = br_mdb_rehash(&br->mdb, max, elasticity);
564 if (err) {
565 br_warn(br, "Cannot rehash multicast "
566 "hash table, disabling snooping: %s, %d, %d\n",
567 port ? port->dev->name : br->dev->name,
568 mdb->size, err);
569 goto disable;
570 }
571
572 err = -EAGAIN;
573 goto err;
574 }
575
576 return NULL;
577
578 err:
579 mp = ERR_PTR(err);
580 return mp;
581 }
582
br_multicast_new_group(struct net_bridge * br,struct net_bridge_port * port,struct br_ip * group)583 static struct net_bridge_mdb_entry *br_multicast_new_group(
584 struct net_bridge *br, struct net_bridge_port *port,
585 struct br_ip *group)
586 {
587 struct net_bridge_mdb_htable *mdb;
588 struct net_bridge_mdb_entry *mp;
589 int hash;
590 int err;
591
592 mdb = rcu_dereference_protected(br->mdb, 1);
593 if (!mdb) {
594 err = br_mdb_rehash(&br->mdb, BR_HASH_SIZE, 0);
595 if (err)
596 return ERR_PTR(err);
597 goto rehash;
598 }
599
600 hash = br_ip_hash(mdb, group);
601 mp = br_multicast_get_group(br, port, group, hash);
602 switch (PTR_ERR(mp)) {
603 case 0:
604 break;
605
606 case -EAGAIN:
607 rehash:
608 mdb = rcu_dereference_protected(br->mdb, 1);
609 hash = br_ip_hash(mdb, group);
610 break;
611
612 default:
613 goto out;
614 }
615
616 mp = kzalloc(sizeof(*mp), GFP_ATOMIC);
617 if (unlikely(!mp))
618 return ERR_PTR(-ENOMEM);
619
620 mp->br = br;
621 mp->addr = *group;
622 setup_timer(&mp->timer, br_multicast_group_expired,
623 (unsigned long)mp);
624
625 hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
626 mdb->size++;
627
628 out:
629 return mp;
630 }
631
br_multicast_add_group(struct net_bridge * br,struct net_bridge_port * port,struct br_ip * group)632 static int br_multicast_add_group(struct net_bridge *br,
633 struct net_bridge_port *port,
634 struct br_ip *group)
635 {
636 struct net_bridge_mdb_entry *mp;
637 struct net_bridge_port_group *p;
638 struct net_bridge_port_group __rcu **pp;
639 unsigned long now = jiffies;
640 int err;
641
642 spin_lock(&br->multicast_lock);
643 if (!netif_running(br->dev) ||
644 (port && port->state == BR_STATE_DISABLED))
645 goto out;
646
647 mp = br_multicast_new_group(br, port, group);
648 err = PTR_ERR(mp);
649 if (IS_ERR(mp))
650 goto err;
651
652 if (!port) {
653 mp->mglist = true;
654 mod_timer(&mp->timer, now + br->multicast_membership_interval);
655 goto out;
656 }
657
658 for (pp = &mp->ports;
659 (p = mlock_dereference(*pp, br)) != NULL;
660 pp = &p->next) {
661 if (p->port == port)
662 goto found;
663 if ((unsigned long)p->port < (unsigned long)port)
664 break;
665 }
666
667 p = kzalloc(sizeof(*p), GFP_ATOMIC);
668 err = -ENOMEM;
669 if (unlikely(!p))
670 goto err;
671
672 p->addr = *group;
673 p->port = port;
674 p->next = *pp;
675 hlist_add_head(&p->mglist, &port->mglist);
676 setup_timer(&p->timer, br_multicast_port_group_expired,
677 (unsigned long)p);
678
679 rcu_assign_pointer(*pp, p);
680
681 found:
682 mod_timer(&p->timer, now + br->multicast_membership_interval);
683 out:
684 err = 0;
685
686 err:
687 spin_unlock(&br->multicast_lock);
688 return err;
689 }
690
br_ip4_multicast_add_group(struct net_bridge * br,struct net_bridge_port * port,__be32 group)691 static int br_ip4_multicast_add_group(struct net_bridge *br,
692 struct net_bridge_port *port,
693 __be32 group)
694 {
695 struct br_ip br_group;
696
697 if (ipv4_is_local_multicast(group))
698 return 0;
699
700 br_group.u.ip4 = group;
701 br_group.proto = htons(ETH_P_IP);
702
703 return br_multicast_add_group(br, port, &br_group);
704 }
705
706 #if IS_ENABLED(CONFIG_IPV6)
br_ip6_multicast_add_group(struct net_bridge * br,struct net_bridge_port * port,const struct in6_addr * group)707 static int br_ip6_multicast_add_group(struct net_bridge *br,
708 struct net_bridge_port *port,
709 const struct in6_addr *group)
710 {
711 struct br_ip br_group;
712
713 if (!ipv6_is_transient_multicast(group))
714 return 0;
715
716 br_group.u.ip6 = *group;
717 br_group.proto = htons(ETH_P_IPV6);
718
719 return br_multicast_add_group(br, port, &br_group);
720 }
721 #endif
722
br_multicast_router_expired(unsigned long data)723 static void br_multicast_router_expired(unsigned long data)
724 {
725 struct net_bridge_port *port = (void *)data;
726 struct net_bridge *br = port->br;
727
728 spin_lock(&br->multicast_lock);
729 if (port->multicast_router != 1 ||
730 timer_pending(&port->multicast_router_timer) ||
731 hlist_unhashed(&port->rlist))
732 goto out;
733
734 hlist_del_init_rcu(&port->rlist);
735
736 out:
737 spin_unlock(&br->multicast_lock);
738 }
739
br_multicast_local_router_expired(unsigned long data)740 static void br_multicast_local_router_expired(unsigned long data)
741 {
742 }
743
__br_multicast_send_query(struct net_bridge * br,struct net_bridge_port * port,struct br_ip * ip)744 static void __br_multicast_send_query(struct net_bridge *br,
745 struct net_bridge_port *port,
746 struct br_ip *ip)
747 {
748 struct sk_buff *skb;
749
750 skb = br_multicast_alloc_query(br, ip);
751 if (!skb)
752 return;
753
754 if (port) {
755 __skb_push(skb, sizeof(struct ethhdr));
756 skb->dev = port->dev;
757 NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
758 dev_queue_xmit);
759 } else
760 netif_rx(skb);
761 }
762
br_multicast_send_query(struct net_bridge * br,struct net_bridge_port * port,u32 sent)763 static void br_multicast_send_query(struct net_bridge *br,
764 struct net_bridge_port *port, u32 sent)
765 {
766 unsigned long time;
767 struct br_ip br_group;
768
769 if (!netif_running(br->dev) || br->multicast_disabled ||
770 timer_pending(&br->multicast_querier_timer))
771 return;
772
773 memset(&br_group.u, 0, sizeof(br_group.u));
774
775 br_group.proto = htons(ETH_P_IP);
776 __br_multicast_send_query(br, port, &br_group);
777
778 #if IS_ENABLED(CONFIG_IPV6)
779 br_group.proto = htons(ETH_P_IPV6);
780 __br_multicast_send_query(br, port, &br_group);
781 #endif
782
783 time = jiffies;
784 time += sent < br->multicast_startup_query_count ?
785 br->multicast_startup_query_interval :
786 br->multicast_query_interval;
787 mod_timer(port ? &port->multicast_query_timer :
788 &br->multicast_query_timer, time);
789 }
790
br_multicast_port_query_expired(unsigned long data)791 static void br_multicast_port_query_expired(unsigned long data)
792 {
793 struct net_bridge_port *port = (void *)data;
794 struct net_bridge *br = port->br;
795
796 spin_lock(&br->multicast_lock);
797 if (port->state == BR_STATE_DISABLED ||
798 port->state == BR_STATE_BLOCKING)
799 goto out;
800
801 if (port->multicast_startup_queries_sent <
802 br->multicast_startup_query_count)
803 port->multicast_startup_queries_sent++;
804
805 br_multicast_send_query(port->br, port,
806 port->multicast_startup_queries_sent);
807
808 out:
809 spin_unlock(&br->multicast_lock);
810 }
811
br_multicast_add_port(struct net_bridge_port * port)812 void br_multicast_add_port(struct net_bridge_port *port)
813 {
814 port->multicast_router = 1;
815
816 setup_timer(&port->multicast_router_timer, br_multicast_router_expired,
817 (unsigned long)port);
818 setup_timer(&port->multicast_query_timer,
819 br_multicast_port_query_expired, (unsigned long)port);
820 }
821
br_multicast_del_port(struct net_bridge_port * port)822 void br_multicast_del_port(struct net_bridge_port *port)
823 {
824 del_timer_sync(&port->multicast_router_timer);
825 }
826
__br_multicast_enable_port(struct net_bridge_port * port)827 static void __br_multicast_enable_port(struct net_bridge_port *port)
828 {
829 port->multicast_startup_queries_sent = 0;
830
831 if (try_to_del_timer_sync(&port->multicast_query_timer) >= 0 ||
832 del_timer(&port->multicast_query_timer))
833 mod_timer(&port->multicast_query_timer, jiffies);
834 }
835
br_multicast_enable_port(struct net_bridge_port * port)836 void br_multicast_enable_port(struct net_bridge_port *port)
837 {
838 struct net_bridge *br = port->br;
839
840 spin_lock(&br->multicast_lock);
841 if (br->multicast_disabled || !netif_running(br->dev))
842 goto out;
843
844 __br_multicast_enable_port(port);
845
846 out:
847 spin_unlock(&br->multicast_lock);
848 }
849
br_multicast_disable_port(struct net_bridge_port * port)850 void br_multicast_disable_port(struct net_bridge_port *port)
851 {
852 struct net_bridge *br = port->br;
853 struct net_bridge_port_group *pg;
854 struct hlist_node *p, *n;
855
856 spin_lock(&br->multicast_lock);
857 hlist_for_each_entry_safe(pg, p, n, &port->mglist, mglist)
858 br_multicast_del_pg(br, pg);
859
860 if (!hlist_unhashed(&port->rlist))
861 hlist_del_init_rcu(&port->rlist);
862 del_timer(&port->multicast_router_timer);
863 del_timer(&port->multicast_query_timer);
864 spin_unlock(&br->multicast_lock);
865 }
866
br_ip4_multicast_igmp3_report(struct net_bridge * br,struct net_bridge_port * port,struct sk_buff * skb)867 static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
868 struct net_bridge_port *port,
869 struct sk_buff *skb)
870 {
871 struct igmpv3_report *ih;
872 struct igmpv3_grec *grec;
873 int i;
874 int len;
875 int num;
876 int type;
877 int err = 0;
878 __be32 group;
879
880 if (!pskb_may_pull(skb, sizeof(*ih)))
881 return -EINVAL;
882
883 ih = igmpv3_report_hdr(skb);
884 num = ntohs(ih->ngrec);
885 len = sizeof(*ih);
886
887 for (i = 0; i < num; i++) {
888 len += sizeof(*grec);
889 if (!pskb_may_pull(skb, len))
890 return -EINVAL;
891
892 grec = (void *)(skb->data + len - sizeof(*grec));
893 group = grec->grec_mca;
894 type = grec->grec_type;
895
896 len += ntohs(grec->grec_nsrcs) * 4;
897 if (!pskb_may_pull(skb, len))
898 return -EINVAL;
899
900 /* We treat this as an IGMPv2 report for now. */
901 switch (type) {
902 case IGMPV3_MODE_IS_INCLUDE:
903 case IGMPV3_MODE_IS_EXCLUDE:
904 case IGMPV3_CHANGE_TO_INCLUDE:
905 case IGMPV3_CHANGE_TO_EXCLUDE:
906 case IGMPV3_ALLOW_NEW_SOURCES:
907 case IGMPV3_BLOCK_OLD_SOURCES:
908 break;
909
910 default:
911 continue;
912 }
913
914 err = br_ip4_multicast_add_group(br, port, group);
915 if (err)
916 break;
917 }
918
919 return err;
920 }
921
922 #if IS_ENABLED(CONFIG_IPV6)
br_ip6_multicast_mld2_report(struct net_bridge * br,struct net_bridge_port * port,struct sk_buff * skb)923 static int br_ip6_multicast_mld2_report(struct net_bridge *br,
924 struct net_bridge_port *port,
925 struct sk_buff *skb)
926 {
927 struct icmp6hdr *icmp6h;
928 struct mld2_grec *grec;
929 int i;
930 int len;
931 int num;
932 int err = 0;
933
934 if (!pskb_may_pull(skb, sizeof(*icmp6h)))
935 return -EINVAL;
936
937 icmp6h = icmp6_hdr(skb);
938 num = ntohs(icmp6h->icmp6_dataun.un_data16[1]);
939 len = sizeof(*icmp6h);
940
941 for (i = 0; i < num; i++) {
942 __be16 *nsrcs, _nsrcs;
943
944 nsrcs = skb_header_pointer(skb,
945 len + offsetof(struct mld2_grec,
946 grec_nsrcs),
947 sizeof(_nsrcs), &_nsrcs);
948 if (!nsrcs)
949 return -EINVAL;
950
951 if (!pskb_may_pull(skb,
952 len + sizeof(*grec) +
953 sizeof(struct in6_addr) * ntohs(*nsrcs)))
954 return -EINVAL;
955
956 grec = (struct mld2_grec *)(skb->data + len);
957 len += sizeof(*grec) +
958 sizeof(struct in6_addr) * ntohs(*nsrcs);
959
960 /* We treat these as MLDv1 reports for now. */
961 switch (grec->grec_type) {
962 case MLD2_MODE_IS_INCLUDE:
963 case MLD2_MODE_IS_EXCLUDE:
964 case MLD2_CHANGE_TO_INCLUDE:
965 case MLD2_CHANGE_TO_EXCLUDE:
966 case MLD2_ALLOW_NEW_SOURCES:
967 case MLD2_BLOCK_OLD_SOURCES:
968 break;
969
970 default:
971 continue;
972 }
973
974 err = br_ip6_multicast_add_group(br, port, &grec->grec_mca);
975 if (!err)
976 break;
977 }
978
979 return err;
980 }
981 #endif
982
983 /*
984 * Add port to rotuer_list
985 * list is maintained ordered by pointer value
986 * and locked by br->multicast_lock and RCU
987 */
br_multicast_add_router(struct net_bridge * br,struct net_bridge_port * port)988 static void br_multicast_add_router(struct net_bridge *br,
989 struct net_bridge_port *port)
990 {
991 struct net_bridge_port *p;
992 struct hlist_node *n, *slot = NULL;
993
994 hlist_for_each_entry(p, n, &br->router_list, rlist) {
995 if ((unsigned long) port >= (unsigned long) p)
996 break;
997 slot = n;
998 }
999
1000 if (slot)
1001 hlist_add_after_rcu(slot, &port->rlist);
1002 else
1003 hlist_add_head_rcu(&port->rlist, &br->router_list);
1004 }
1005
br_multicast_mark_router(struct net_bridge * br,struct net_bridge_port * port)1006 static void br_multicast_mark_router(struct net_bridge *br,
1007 struct net_bridge_port *port)
1008 {
1009 unsigned long now = jiffies;
1010
1011 if (!port) {
1012 if (br->multicast_router == 1)
1013 mod_timer(&br->multicast_router_timer,
1014 now + br->multicast_querier_interval);
1015 return;
1016 }
1017
1018 if (port->multicast_router != 1)
1019 return;
1020
1021 if (!hlist_unhashed(&port->rlist))
1022 goto timer;
1023
1024 br_multicast_add_router(br, port);
1025
1026 timer:
1027 mod_timer(&port->multicast_router_timer,
1028 now + br->multicast_querier_interval);
1029 }
1030
br_multicast_query_received(struct net_bridge * br,struct net_bridge_port * port,int saddr)1031 static void br_multicast_query_received(struct net_bridge *br,
1032 struct net_bridge_port *port,
1033 int saddr)
1034 {
1035 if (saddr)
1036 mod_timer(&br->multicast_querier_timer,
1037 jiffies + br->multicast_querier_interval);
1038 else if (timer_pending(&br->multicast_querier_timer))
1039 return;
1040
1041 br_multicast_mark_router(br, port);
1042 }
1043
br_ip4_multicast_query(struct net_bridge * br,struct net_bridge_port * port,struct sk_buff * skb)1044 static int br_ip4_multicast_query(struct net_bridge *br,
1045 struct net_bridge_port *port,
1046 struct sk_buff *skb)
1047 {
1048 const struct iphdr *iph = ip_hdr(skb);
1049 struct igmphdr *ih = igmp_hdr(skb);
1050 struct net_bridge_mdb_entry *mp;
1051 struct igmpv3_query *ih3;
1052 struct net_bridge_port_group *p;
1053 struct net_bridge_port_group __rcu **pp;
1054 unsigned long max_delay;
1055 unsigned long now = jiffies;
1056 __be32 group;
1057 int err = 0;
1058
1059 spin_lock(&br->multicast_lock);
1060 if (!netif_running(br->dev) ||
1061 (port && port->state == BR_STATE_DISABLED))
1062 goto out;
1063
1064 br_multicast_query_received(br, port, !!iph->saddr);
1065
1066 group = ih->group;
1067
1068 if (skb->len == sizeof(*ih)) {
1069 max_delay = ih->code * (HZ / IGMP_TIMER_SCALE);
1070
1071 if (!max_delay) {
1072 max_delay = 10 * HZ;
1073 group = 0;
1074 }
1075 } else {
1076 if (!pskb_may_pull(skb, sizeof(struct igmpv3_query))) {
1077 err = -EINVAL;
1078 goto out;
1079 }
1080
1081 ih3 = igmpv3_query_hdr(skb);
1082 if (ih3->nsrcs)
1083 goto out;
1084
1085 max_delay = ih3->code ?
1086 IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
1087 }
1088
1089 if (!group)
1090 goto out;
1091
1092 mp = br_mdb_ip4_get(mlock_dereference(br->mdb, br), group);
1093 if (!mp)
1094 goto out;
1095
1096 max_delay *= br->multicast_last_member_count;
1097
1098 if (mp->mglist &&
1099 (timer_pending(&mp->timer) ?
1100 time_after(mp->timer.expires, now + max_delay) :
1101 try_to_del_timer_sync(&mp->timer) >= 0))
1102 mod_timer(&mp->timer, now + max_delay);
1103
1104 for (pp = &mp->ports;
1105 (p = mlock_dereference(*pp, br)) != NULL;
1106 pp = &p->next) {
1107 if (timer_pending(&p->timer) ?
1108 time_after(p->timer.expires, now + max_delay) :
1109 try_to_del_timer_sync(&p->timer) >= 0)
1110 mod_timer(&p->timer, now + max_delay);
1111 }
1112
1113 out:
1114 spin_unlock(&br->multicast_lock);
1115 return err;
1116 }
1117
1118 #if IS_ENABLED(CONFIG_IPV6)
br_ip6_multicast_query(struct net_bridge * br,struct net_bridge_port * port,struct sk_buff * skb)1119 static int br_ip6_multicast_query(struct net_bridge *br,
1120 struct net_bridge_port *port,
1121 struct sk_buff *skb)
1122 {
1123 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
1124 struct mld_msg *mld = (struct mld_msg *) icmp6_hdr(skb);
1125 struct net_bridge_mdb_entry *mp;
1126 struct mld2_query *mld2q;
1127 struct net_bridge_port_group *p;
1128 struct net_bridge_port_group __rcu **pp;
1129 unsigned long max_delay;
1130 unsigned long now = jiffies;
1131 const struct in6_addr *group = NULL;
1132 int err = 0;
1133
1134 spin_lock(&br->multicast_lock);
1135 if (!netif_running(br->dev) ||
1136 (port && port->state == BR_STATE_DISABLED))
1137 goto out;
1138
1139 br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr));
1140
1141 /* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */
1142 if (!(ipv6_addr_type(&ip6h->saddr) & IPV6_ADDR_LINKLOCAL)) {
1143 err = -EINVAL;
1144 goto out;
1145 }
1146
1147 if (skb->len == sizeof(*mld)) {
1148 if (!pskb_may_pull(skb, sizeof(*mld))) {
1149 err = -EINVAL;
1150 goto out;
1151 }
1152 mld = (struct mld_msg *) icmp6_hdr(skb);
1153 max_delay = msecs_to_jiffies(htons(mld->mld_maxdelay));
1154 if (max_delay)
1155 group = &mld->mld_mca;
1156 } else if (skb->len >= sizeof(*mld2q)) {
1157 if (!pskb_may_pull(skb, sizeof(*mld2q))) {
1158 err = -EINVAL;
1159 goto out;
1160 }
1161 mld2q = (struct mld2_query *)icmp6_hdr(skb);
1162 if (!mld2q->mld2q_nsrcs)
1163 group = &mld2q->mld2q_mca;
1164
1165 max_delay = max(msecs_to_jiffies(MLDV2_MRC(ntohs(mld2q->mld2q_mrc))), 1UL);
1166 }
1167
1168 if (!group)
1169 goto out;
1170
1171 mp = br_mdb_ip6_get(mlock_dereference(br->mdb, br), group);
1172 if (!mp)
1173 goto out;
1174
1175 max_delay *= br->multicast_last_member_count;
1176 if (mp->mglist &&
1177 (timer_pending(&mp->timer) ?
1178 time_after(mp->timer.expires, now + max_delay) :
1179 try_to_del_timer_sync(&mp->timer) >= 0))
1180 mod_timer(&mp->timer, now + max_delay);
1181
1182 for (pp = &mp->ports;
1183 (p = mlock_dereference(*pp, br)) != NULL;
1184 pp = &p->next) {
1185 if (timer_pending(&p->timer) ?
1186 time_after(p->timer.expires, now + max_delay) :
1187 try_to_del_timer_sync(&p->timer) >= 0)
1188 mod_timer(&p->timer, now + max_delay);
1189 }
1190
1191 out:
1192 spin_unlock(&br->multicast_lock);
1193 return err;
1194 }
1195 #endif
1196
br_multicast_leave_group(struct net_bridge * br,struct net_bridge_port * port,struct br_ip * group)1197 static void br_multicast_leave_group(struct net_bridge *br,
1198 struct net_bridge_port *port,
1199 struct br_ip *group)
1200 {
1201 struct net_bridge_mdb_htable *mdb;
1202 struct net_bridge_mdb_entry *mp;
1203 struct net_bridge_port_group *p;
1204 unsigned long now;
1205 unsigned long time;
1206
1207 spin_lock(&br->multicast_lock);
1208 if (!netif_running(br->dev) ||
1209 (port && port->state == BR_STATE_DISABLED) ||
1210 timer_pending(&br->multicast_querier_timer))
1211 goto out;
1212
1213 mdb = mlock_dereference(br->mdb, br);
1214 mp = br_mdb_ip_get(mdb, group);
1215 if (!mp)
1216 goto out;
1217
1218 now = jiffies;
1219 time = now + br->multicast_last_member_count *
1220 br->multicast_last_member_interval;
1221
1222 if (!port) {
1223 if (mp->mglist &&
1224 (timer_pending(&mp->timer) ?
1225 time_after(mp->timer.expires, time) :
1226 try_to_del_timer_sync(&mp->timer) >= 0)) {
1227 mod_timer(&mp->timer, time);
1228 }
1229
1230 goto out;
1231 }
1232
1233 for (p = mlock_dereference(mp->ports, br);
1234 p != NULL;
1235 p = mlock_dereference(p->next, br)) {
1236 if (p->port != port)
1237 continue;
1238
1239 if (!hlist_unhashed(&p->mglist) &&
1240 (timer_pending(&p->timer) ?
1241 time_after(p->timer.expires, time) :
1242 try_to_del_timer_sync(&p->timer) >= 0)) {
1243 mod_timer(&p->timer, time);
1244 }
1245
1246 break;
1247 }
1248
1249 out:
1250 spin_unlock(&br->multicast_lock);
1251 }
1252
br_ip4_multicast_leave_group(struct net_bridge * br,struct net_bridge_port * port,__be32 group)1253 static void br_ip4_multicast_leave_group(struct net_bridge *br,
1254 struct net_bridge_port *port,
1255 __be32 group)
1256 {
1257 struct br_ip br_group;
1258
1259 if (ipv4_is_local_multicast(group))
1260 return;
1261
1262 br_group.u.ip4 = group;
1263 br_group.proto = htons(ETH_P_IP);
1264
1265 br_multicast_leave_group(br, port, &br_group);
1266 }
1267
1268 #if IS_ENABLED(CONFIG_IPV6)
br_ip6_multicast_leave_group(struct net_bridge * br,struct net_bridge_port * port,const struct in6_addr * group)1269 static void br_ip6_multicast_leave_group(struct net_bridge *br,
1270 struct net_bridge_port *port,
1271 const struct in6_addr *group)
1272 {
1273 struct br_ip br_group;
1274
1275 if (!ipv6_is_transient_multicast(group))
1276 return;
1277
1278 br_group.u.ip6 = *group;
1279 br_group.proto = htons(ETH_P_IPV6);
1280
1281 br_multicast_leave_group(br, port, &br_group);
1282 }
1283 #endif
1284
br_multicast_ipv4_rcv(struct net_bridge * br,struct net_bridge_port * port,struct sk_buff * skb)1285 static int br_multicast_ipv4_rcv(struct net_bridge *br,
1286 struct net_bridge_port *port,
1287 struct sk_buff *skb)
1288 {
1289 struct sk_buff *skb2 = skb;
1290 const struct iphdr *iph;
1291 struct igmphdr *ih;
1292 unsigned len;
1293 unsigned offset;
1294 int err;
1295
1296 /* We treat OOM as packet loss for now. */
1297 if (!pskb_may_pull(skb, sizeof(*iph)))
1298 return -EINVAL;
1299
1300 iph = ip_hdr(skb);
1301
1302 if (iph->ihl < 5 || iph->version != 4)
1303 return -EINVAL;
1304
1305 if (!pskb_may_pull(skb, ip_hdrlen(skb)))
1306 return -EINVAL;
1307
1308 iph = ip_hdr(skb);
1309
1310 if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
1311 return -EINVAL;
1312
1313 if (iph->protocol != IPPROTO_IGMP) {
1314 if ((iph->daddr & IGMP_LOCAL_GROUP_MASK) != IGMP_LOCAL_GROUP)
1315 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
1316 return 0;
1317 }
1318
1319 len = ntohs(iph->tot_len);
1320 if (skb->len < len || len < ip_hdrlen(skb))
1321 return -EINVAL;
1322
1323 if (skb->len > len) {
1324 skb2 = skb_clone(skb, GFP_ATOMIC);
1325 if (!skb2)
1326 return -ENOMEM;
1327
1328 err = pskb_trim_rcsum(skb2, len);
1329 if (err)
1330 goto err_out;
1331 }
1332
1333 len -= ip_hdrlen(skb2);
1334 offset = skb_network_offset(skb2) + ip_hdrlen(skb2);
1335 __skb_pull(skb2, offset);
1336 skb_reset_transport_header(skb2);
1337
1338 err = -EINVAL;
1339 if (!pskb_may_pull(skb2, sizeof(*ih)))
1340 goto out;
1341
1342 switch (skb2->ip_summed) {
1343 case CHECKSUM_COMPLETE:
1344 if (!csum_fold(skb2->csum))
1345 break;
1346 /* fall through */
1347 case CHECKSUM_NONE:
1348 skb2->csum = 0;
1349 if (skb_checksum_complete(skb2))
1350 goto out;
1351 }
1352
1353 err = 0;
1354
1355 BR_INPUT_SKB_CB(skb)->igmp = 1;
1356 ih = igmp_hdr(skb2);
1357
1358 switch (ih->type) {
1359 case IGMP_HOST_MEMBERSHIP_REPORT:
1360 case IGMPV2_HOST_MEMBERSHIP_REPORT:
1361 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
1362 err = br_ip4_multicast_add_group(br, port, ih->group);
1363 break;
1364 case IGMPV3_HOST_MEMBERSHIP_REPORT:
1365 err = br_ip4_multicast_igmp3_report(br, port, skb2);
1366 break;
1367 case IGMP_HOST_MEMBERSHIP_QUERY:
1368 err = br_ip4_multicast_query(br, port, skb2);
1369 break;
1370 case IGMP_HOST_LEAVE_MESSAGE:
1371 br_ip4_multicast_leave_group(br, port, ih->group);
1372 break;
1373 }
1374
1375 out:
1376 __skb_push(skb2, offset);
1377 err_out:
1378 if (skb2 != skb)
1379 kfree_skb(skb2);
1380 return err;
1381 }
1382
1383 #if IS_ENABLED(CONFIG_IPV6)
br_multicast_ipv6_rcv(struct net_bridge * br,struct net_bridge_port * port,struct sk_buff * skb)1384 static int br_multicast_ipv6_rcv(struct net_bridge *br,
1385 struct net_bridge_port *port,
1386 struct sk_buff *skb)
1387 {
1388 struct sk_buff *skb2;
1389 const struct ipv6hdr *ip6h;
1390 u8 icmp6_type;
1391 u8 nexthdr;
1392 __be16 frag_off;
1393 unsigned len;
1394 int offset;
1395 int err;
1396
1397 if (!pskb_may_pull(skb, sizeof(*ip6h)))
1398 return -EINVAL;
1399
1400 ip6h = ipv6_hdr(skb);
1401
1402 /*
1403 * We're interested in MLD messages only.
1404 * - Version is 6
1405 * - MLD has always Router Alert hop-by-hop option
1406 * - But we do not support jumbrograms.
1407 */
1408 if (ip6h->version != 6 ||
1409 ip6h->nexthdr != IPPROTO_HOPOPTS ||
1410 ip6h->payload_len == 0)
1411 return 0;
1412
1413 len = ntohs(ip6h->payload_len) + sizeof(*ip6h);
1414 if (skb->len < len)
1415 return -EINVAL;
1416
1417 nexthdr = ip6h->nexthdr;
1418 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr, &frag_off);
1419
1420 if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
1421 return 0;
1422
1423 /* Okay, we found ICMPv6 header */
1424 skb2 = skb_clone(skb, GFP_ATOMIC);
1425 if (!skb2)
1426 return -ENOMEM;
1427
1428 err = -EINVAL;
1429 if (!pskb_may_pull(skb2, offset + sizeof(struct icmp6hdr)))
1430 goto out;
1431
1432 len -= offset - skb_network_offset(skb2);
1433
1434 __skb_pull(skb2, offset);
1435 skb_reset_transport_header(skb2);
1436 skb_postpull_rcsum(skb2, skb_network_header(skb2),
1437 skb_network_header_len(skb2));
1438
1439 icmp6_type = icmp6_hdr(skb2)->icmp6_type;
1440
1441 switch (icmp6_type) {
1442 case ICMPV6_MGM_QUERY:
1443 case ICMPV6_MGM_REPORT:
1444 case ICMPV6_MGM_REDUCTION:
1445 case ICMPV6_MLD2_REPORT:
1446 break;
1447 default:
1448 err = 0;
1449 goto out;
1450 }
1451
1452 /* Okay, we found MLD message. Check further. */
1453 if (skb2->len > len) {
1454 err = pskb_trim_rcsum(skb2, len);
1455 if (err)
1456 goto out;
1457 err = -EINVAL;
1458 }
1459
1460 ip6h = ipv6_hdr(skb2);
1461
1462 switch (skb2->ip_summed) {
1463 case CHECKSUM_COMPLETE:
1464 if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, skb2->len,
1465 IPPROTO_ICMPV6, skb2->csum))
1466 break;
1467 /*FALLTHROUGH*/
1468 case CHECKSUM_NONE:
1469 skb2->csum = ~csum_unfold(csum_ipv6_magic(&ip6h->saddr,
1470 &ip6h->daddr,
1471 skb2->len,
1472 IPPROTO_ICMPV6, 0));
1473 if (__skb_checksum_complete(skb2))
1474 goto out;
1475 }
1476
1477 err = 0;
1478
1479 BR_INPUT_SKB_CB(skb)->igmp = 1;
1480
1481 switch (icmp6_type) {
1482 case ICMPV6_MGM_REPORT:
1483 {
1484 struct mld_msg *mld;
1485 if (!pskb_may_pull(skb2, sizeof(*mld))) {
1486 err = -EINVAL;
1487 goto out;
1488 }
1489 mld = (struct mld_msg *)skb_transport_header(skb2);
1490 BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
1491 err = br_ip6_multicast_add_group(br, port, &mld->mld_mca);
1492 break;
1493 }
1494 case ICMPV6_MLD2_REPORT:
1495 err = br_ip6_multicast_mld2_report(br, port, skb2);
1496 break;
1497 case ICMPV6_MGM_QUERY:
1498 err = br_ip6_multicast_query(br, port, skb2);
1499 break;
1500 case ICMPV6_MGM_REDUCTION:
1501 {
1502 struct mld_msg *mld;
1503 if (!pskb_may_pull(skb2, sizeof(*mld))) {
1504 err = -EINVAL;
1505 goto out;
1506 }
1507 mld = (struct mld_msg *)skb_transport_header(skb2);
1508 br_ip6_multicast_leave_group(br, port, &mld->mld_mca);
1509 }
1510 }
1511
1512 out:
1513 kfree_skb(skb2);
1514 return err;
1515 }
1516 #endif
1517
br_multicast_rcv(struct net_bridge * br,struct net_bridge_port * port,struct sk_buff * skb)1518 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
1519 struct sk_buff *skb)
1520 {
1521 BR_INPUT_SKB_CB(skb)->igmp = 0;
1522 BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
1523
1524 if (br->multicast_disabled)
1525 return 0;
1526
1527 switch (skb->protocol) {
1528 case htons(ETH_P_IP):
1529 return br_multicast_ipv4_rcv(br, port, skb);
1530 #if IS_ENABLED(CONFIG_IPV6)
1531 case htons(ETH_P_IPV6):
1532 return br_multicast_ipv6_rcv(br, port, skb);
1533 #endif
1534 }
1535
1536 return 0;
1537 }
1538
br_multicast_query_expired(unsigned long data)1539 static void br_multicast_query_expired(unsigned long data)
1540 {
1541 struct net_bridge *br = (void *)data;
1542
1543 spin_lock(&br->multicast_lock);
1544 if (br->multicast_startup_queries_sent <
1545 br->multicast_startup_query_count)
1546 br->multicast_startup_queries_sent++;
1547
1548 br_multicast_send_query(br, NULL, br->multicast_startup_queries_sent);
1549
1550 spin_unlock(&br->multicast_lock);
1551 }
1552
br_multicast_init(struct net_bridge * br)1553 void br_multicast_init(struct net_bridge *br)
1554 {
1555 br->hash_elasticity = 4;
1556 br->hash_max = 512;
1557
1558 br->multicast_router = 1;
1559 br->multicast_last_member_count = 2;
1560 br->multicast_startup_query_count = 2;
1561
1562 br->multicast_last_member_interval = HZ;
1563 br->multicast_query_response_interval = 10 * HZ;
1564 br->multicast_startup_query_interval = 125 * HZ / 4;
1565 br->multicast_query_interval = 125 * HZ;
1566 br->multicast_querier_interval = 255 * HZ;
1567 br->multicast_membership_interval = 260 * HZ;
1568
1569 spin_lock_init(&br->multicast_lock);
1570 setup_timer(&br->multicast_router_timer,
1571 br_multicast_local_router_expired, 0);
1572 setup_timer(&br->multicast_querier_timer,
1573 br_multicast_local_router_expired, 0);
1574 setup_timer(&br->multicast_query_timer, br_multicast_query_expired,
1575 (unsigned long)br);
1576 }
1577
br_multicast_open(struct net_bridge * br)1578 void br_multicast_open(struct net_bridge *br)
1579 {
1580 br->multicast_startup_queries_sent = 0;
1581
1582 if (br->multicast_disabled)
1583 return;
1584
1585 mod_timer(&br->multicast_query_timer, jiffies);
1586 }
1587
br_multicast_stop(struct net_bridge * br)1588 void br_multicast_stop(struct net_bridge *br)
1589 {
1590 struct net_bridge_mdb_htable *mdb;
1591 struct net_bridge_mdb_entry *mp;
1592 struct hlist_node *p, *n;
1593 u32 ver;
1594 int i;
1595
1596 del_timer_sync(&br->multicast_router_timer);
1597 del_timer_sync(&br->multicast_querier_timer);
1598 del_timer_sync(&br->multicast_query_timer);
1599
1600 spin_lock_bh(&br->multicast_lock);
1601 mdb = mlock_dereference(br->mdb, br);
1602 if (!mdb)
1603 goto out;
1604
1605 br->mdb = NULL;
1606
1607 ver = mdb->ver;
1608 for (i = 0; i < mdb->max; i++) {
1609 hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
1610 hlist[ver]) {
1611 del_timer(&mp->timer);
1612 call_rcu_bh(&mp->rcu, br_multicast_free_group);
1613 }
1614 }
1615
1616 if (mdb->old) {
1617 spin_unlock_bh(&br->multicast_lock);
1618 rcu_barrier_bh();
1619 spin_lock_bh(&br->multicast_lock);
1620 WARN_ON(mdb->old);
1621 }
1622
1623 mdb->old = mdb;
1624 call_rcu_bh(&mdb->rcu, br_mdb_free);
1625
1626 out:
1627 spin_unlock_bh(&br->multicast_lock);
1628 }
1629
br_multicast_set_router(struct net_bridge * br,unsigned long val)1630 int br_multicast_set_router(struct net_bridge *br, unsigned long val)
1631 {
1632 int err = -ENOENT;
1633
1634 spin_lock_bh(&br->multicast_lock);
1635 if (!netif_running(br->dev))
1636 goto unlock;
1637
1638 switch (val) {
1639 case 0:
1640 case 2:
1641 del_timer(&br->multicast_router_timer);
1642 /* fall through */
1643 case 1:
1644 br->multicast_router = val;
1645 err = 0;
1646 break;
1647
1648 default:
1649 err = -EINVAL;
1650 break;
1651 }
1652
1653 unlock:
1654 spin_unlock_bh(&br->multicast_lock);
1655
1656 return err;
1657 }
1658
br_multicast_set_port_router(struct net_bridge_port * p,unsigned long val)1659 int br_multicast_set_port_router(struct net_bridge_port *p, unsigned long val)
1660 {
1661 struct net_bridge *br = p->br;
1662 int err = -ENOENT;
1663
1664 spin_lock(&br->multicast_lock);
1665 if (!netif_running(br->dev) || p->state == BR_STATE_DISABLED)
1666 goto unlock;
1667
1668 switch (val) {
1669 case 0:
1670 case 1:
1671 case 2:
1672 p->multicast_router = val;
1673 err = 0;
1674
1675 if (val < 2 && !hlist_unhashed(&p->rlist))
1676 hlist_del_init_rcu(&p->rlist);
1677
1678 if (val == 1)
1679 break;
1680
1681 del_timer(&p->multicast_router_timer);
1682
1683 if (val == 0)
1684 break;
1685
1686 br_multicast_add_router(br, p);
1687 break;
1688
1689 default:
1690 err = -EINVAL;
1691 break;
1692 }
1693
1694 unlock:
1695 spin_unlock(&br->multicast_lock);
1696
1697 return err;
1698 }
1699
br_multicast_toggle(struct net_bridge * br,unsigned long val)1700 int br_multicast_toggle(struct net_bridge *br, unsigned long val)
1701 {
1702 struct net_bridge_port *port;
1703 int err = 0;
1704 struct net_bridge_mdb_htable *mdb;
1705
1706 spin_lock_bh(&br->multicast_lock);
1707 if (br->multicast_disabled == !val)
1708 goto unlock;
1709
1710 br->multicast_disabled = !val;
1711 if (br->multicast_disabled)
1712 goto unlock;
1713
1714 if (!netif_running(br->dev))
1715 goto unlock;
1716
1717 mdb = mlock_dereference(br->mdb, br);
1718 if (mdb) {
1719 if (mdb->old) {
1720 err = -EEXIST;
1721 rollback:
1722 br->multicast_disabled = !!val;
1723 goto unlock;
1724 }
1725
1726 err = br_mdb_rehash(&br->mdb, mdb->max,
1727 br->hash_elasticity);
1728 if (err)
1729 goto rollback;
1730 }
1731
1732 br_multicast_open(br);
1733 list_for_each_entry(port, &br->port_list, list) {
1734 if (port->state == BR_STATE_DISABLED ||
1735 port->state == BR_STATE_BLOCKING)
1736 continue;
1737
1738 __br_multicast_enable_port(port);
1739 }
1740
1741 unlock:
1742 spin_unlock_bh(&br->multicast_lock);
1743
1744 return err;
1745 }
1746
br_multicast_set_hash_max(struct net_bridge * br,unsigned long val)1747 int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val)
1748 {
1749 int err = -ENOENT;
1750 u32 old;
1751 struct net_bridge_mdb_htable *mdb;
1752
1753 spin_lock_bh(&br->multicast_lock);
1754 if (!netif_running(br->dev))
1755 goto unlock;
1756
1757 err = -EINVAL;
1758 if (!is_power_of_2(val))
1759 goto unlock;
1760
1761 mdb = mlock_dereference(br->mdb, br);
1762 if (mdb && val < mdb->size)
1763 goto unlock;
1764
1765 err = 0;
1766
1767 old = br->hash_max;
1768 br->hash_max = val;
1769
1770 if (mdb) {
1771 if (mdb->old) {
1772 err = -EEXIST;
1773 rollback:
1774 br->hash_max = old;
1775 goto unlock;
1776 }
1777
1778 err = br_mdb_rehash(&br->mdb, br->hash_max,
1779 br->hash_elasticity);
1780 if (err)
1781 goto rollback;
1782 }
1783
1784 unlock:
1785 spin_unlock_bh(&br->multicast_lock);
1786
1787 return err;
1788 }
1789