1 /*
2  *	Linux NET3:	Internet Group Management Protocol  [IGMP]
3  *
4  *	This code implements the IGMP protocol as defined in RFC1112. There has
5  *	been a further revision of this protocol since which is now supported.
6  *
7  *	If you have trouble with this module be careful what gcc you have used,
8  *	the older version didn't come out right using gcc 2.5.8, the newer one
9  *	seems to fall out with gcc 2.6.2.
10  *
11  *	Version: $Id: igmp.c,v 1.46 2001/07/27 09:27:29 davem Exp $
12  *
13  *	Authors:
14  *		Alan Cox <Alan.Cox@linux.org>
15  *
16  *	This program is free software; you can redistribute it and/or
17  *	modify it under the terms of the GNU General Public License
18  *	as published by the Free Software Foundation; either version
19  *	2 of the License, or (at your option) any later version.
20  *
21  *	Fixes:
22  *
23  *		Alan Cox	:	Added lots of __inline__ to optimise
24  *					the memory usage of all the tiny little
25  *					functions.
26  *		Alan Cox	:	Dumped the header building experiment.
27  *		Alan Cox	:	Minor tweaks ready for multicast routing
28  *					and extended IGMP protocol.
29  *		Alan Cox	:	Removed a load of inline directives. Gcc 2.5.8
30  *					writes utterly bogus code otherwise (sigh)
31  *					fixed IGMP loopback to behave in the manner
32  *					desired by mrouted, fixed the fact it has been
33  *					broken since 1.3.6 and cleaned up a few minor
34  *					points.
35  *
36  *		Chih-Jen Chang	:	Tried to revise IGMP to Version 2
37  *		Tsu-Sheng Tsao		E-mail: chihjenc@scf.usc.edu and tsusheng@scf.usc.edu
38  *					The enhancements are mainly based on Steve Deering's
39  * 					ipmulti-3.5 source code.
40  *		Chih-Jen Chang	:	Added the igmp_get_mrouter_info and
41  *		Tsu-Sheng Tsao		igmp_set_mrouter_info to keep track of
42  *					the mrouted version on that device.
43  *		Chih-Jen Chang	:	Added the max_resp_time parameter to
44  *		Tsu-Sheng Tsao		igmp_heard_query(). Using this parameter
45  *					to identify the multicast router version
46  *					and do what the IGMP version 2 specified.
47  *		Chih-Jen Chang	:	Added a timer to revert to IGMP V2 router
48  *		Tsu-Sheng Tsao		if the specified time expired.
49  *		Alan Cox	:	Stop IGMP from 0.0.0.0 being accepted.
50  *		Alan Cox	:	Use GFP_ATOMIC in the right places.
51  *		Christian Daudt :	igmp timer wasn't set for local group
52  *					memberships but was being deleted,
53  *					which caused a "del_timer() called
54  *					from %p with timer not initialized\n"
55  *					message (960131).
56  *		Christian Daudt :	removed del_timer from
57  *					igmp_timer_expire function (960205).
58  *             Christian Daudt :       igmp_heard_report now only calls
59  *                                     igmp_timer_expire if tm->running is
60  *                                     true (960216).
61  *		Malcolm Beattie :	ttl comparison wrong in igmp_rcv made
62  *					igmp_heard_query never trigger. Expiry
63  *					miscalculation fixed in igmp_heard_query
64  *					and random() made to return unsigned to
65  *					prevent negative expiry times.
66  *		Alexey Kuznetsov:	Wrong group leaving behaviour, backport
67  *					fix from pending 2.1.x patches.
68  *		Alan Cox:		Forget to enable FDDI support earlier.
69  *		Alexey Kuznetsov:	Fixed leaving groups on device down.
70  *		Alexey Kuznetsov:	Accordance to igmp-v2-06 draft.
71  *		David L Stevens:	IGMPv3 support, with help from
72  *					Vinay Kulkarni
73  */
74 
75 
76 #include <linux/config.h>
77 #include <asm/uaccess.h>
78 #include <asm/system.h>
79 #include <linux/types.h>
80 #include <linux/kernel.h>
81 #include <linux/sched.h>
82 #include <linux/string.h>
83 #include <linux/socket.h>
84 #include <linux/sockios.h>
85 #include <linux/in.h>
86 #include <linux/inet.h>
87 #include <linux/netdevice.h>
88 #include <linux/skbuff.h>
89 #include <linux/inetdevice.h>
90 #include <linux/igmp.h>
91 #include <linux/if_arp.h>
92 #include <linux/rtnetlink.h>
93 #include <net/ip.h>
94 #include <net/protocol.h>
95 #include <net/route.h>
96 #include <net/sock.h>
97 #include <net/checksum.h>
98 #include <linux/netfilter_ipv4.h>
99 #ifdef CONFIG_IP_MROUTE
100 #include <linux/mroute.h>
101 #endif
102 
103 
104 #define IP_MAX_MEMBERSHIPS	20
105 #define IP_MAX_MSF		10
106 
107 #ifdef CONFIG_IP_MULTICAST
108 /* Parameter names and values are taken from igmp-v2-06 draft */
109 
110 #define IGMP_V1_Router_Present_Timeout		(400*HZ)
111 #define IGMP_V2_Router_Present_Timeout		(400*HZ)
112 #define IGMP_Unsolicited_Report_Interval	(10*HZ)
113 #define IGMP_Query_Response_Interval		(10*HZ)
114 #define IGMP_Unsolicited_Report_Count		2
115 
116 
117 #define IGMP_Initial_Report_Delay		(1)
118 
119 /* IGMP_Initial_Report_Delay is not from IGMP specs!
120  * IGMP specs require to report membership immediately after
121  * joining a group, but we delay the first report by a
122  * small interval. It seems more natural and still does not
123  * contradict to specs provided this delay is small enough.
124  */
125 
126 #define IGMP_V1_SEEN(in_dev) (ipv4_devconf.force_igmp_version == 1 || \
127 		(in_dev)->cnf.force_igmp_version == 1 || \
128 		((in_dev)->mr_v1_seen && \
129 		time_before(jiffies, (in_dev)->mr_v1_seen)))
130 #define IGMP_V2_SEEN(in_dev) (ipv4_devconf.force_igmp_version == 2 || \
131 		(in_dev)->cnf.force_igmp_version == 2 || \
132 		((in_dev)->mr_v2_seen && \
133 		time_before(jiffies, (in_dev)->mr_v2_seen)))
134 
135 static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im);
136 static void igmpv3_del_delrec(struct in_device *in_dev, __u32 multiaddr);
137 static void igmpv3_clear_delrec(struct in_device *in_dev);
138 static int sf_setstate(struct ip_mc_list *pmc);
139 static void sf_markstate(struct ip_mc_list *pmc);
140 #endif
141 static void ip_mc_clear_src(struct ip_mc_list *pmc);
142 int ip_mc_add_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
143 	int sfcount, __u32 *psfsrc, int delta);
144 
ip_ma_put(struct ip_mc_list * im)145 static void ip_ma_put(struct ip_mc_list *im)
146 {
147 	if (atomic_dec_and_test(&im->refcnt)) {
148 		in_dev_put(im->interface);
149 		kfree(im);
150 	}
151 }
152 
153 #ifdef CONFIG_IP_MULTICAST
154 
155 /*
156  *	Timer management
157  */
158 
igmp_stop_timer(struct ip_mc_list * im)159 static __inline__ void igmp_stop_timer(struct ip_mc_list *im)
160 {
161 	spin_lock_bh(&im->lock);
162 	if (del_timer(&im->timer))
163 		atomic_dec(&im->refcnt);
164 	im->tm_running=0;
165 	im->reporter = 0;
166 	im->unsolicit_count = 0;
167 	spin_unlock_bh(&im->lock);
168 }
169 
170 /* It must be called with locked im->lock */
igmp_start_timer(struct ip_mc_list * im,int max_delay)171 static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
172 {
173 	int tv=net_random() % max_delay;
174 
175 	im->tm_running=1;
176 	if (!mod_timer(&im->timer, jiffies+tv+2))
177 		atomic_inc(&im->refcnt);
178 }
179 
igmp_gq_start_timer(struct in_device * in_dev)180 static void igmp_gq_start_timer(struct in_device *in_dev)
181 {
182 	int tv = net_random() % in_dev->mr_maxdelay;
183 
184 	in_dev->mr_gq_running = 1;
185 	if (!mod_timer(&in_dev->mr_gq_timer, jiffies+tv+2))
186 		in_dev_hold(in_dev);
187 }
188 
igmp_ifc_start_timer(struct in_device * in_dev,int delay)189 static void igmp_ifc_start_timer(struct in_device *in_dev, int delay)
190 {
191 	int tv = net_random() % delay;
192 
193 	if (!mod_timer(&in_dev->mr_ifc_timer, jiffies+tv+2))
194 		in_dev_hold(in_dev);
195 }
196 
igmp_mod_timer(struct ip_mc_list * im,int max_delay)197 static void igmp_mod_timer(struct ip_mc_list *im, int max_delay)
198 {
199 	spin_lock_bh(&im->lock);
200 	im->unsolicit_count = 0;
201 	if (del_timer(&im->timer)) {
202 		if ((long)(im->timer.expires-jiffies) < max_delay) {
203 			add_timer(&im->timer);
204 			im->tm_running=1;
205 			spin_unlock_bh(&im->lock);
206 			return;
207 		}
208 		atomic_dec(&im->refcnt);
209 	}
210 	igmp_start_timer(im, max_delay);
211 	spin_unlock_bh(&im->lock);
212 }
213 
214 
215 /*
216  *	Send an IGMP report.
217  */
218 
219 #define IGMP_SIZE (sizeof(struct igmphdr)+sizeof(struct iphdr)+4)
220 
221 /* Don't just hand NF_HOOK skb->dst->output, in case netfilter hook
222    changes route */
223 static inline int
output_maybe_reroute(struct sk_buff * skb)224 output_maybe_reroute(struct sk_buff *skb)
225 {
226 	return skb->dst->output(skb);
227 }
228 
229 
is_in(struct ip_mc_list * pmc,struct ip_sf_list * psf,int type,int gdeleted,int sdeleted)230 static int is_in(struct ip_mc_list *pmc, struct ip_sf_list *psf, int type,
231 	int gdeleted, int sdeleted)
232 {
233 	switch (type) {
234 	case IGMPV3_MODE_IS_INCLUDE:
235 	case IGMPV3_MODE_IS_EXCLUDE:
236 		if (gdeleted || sdeleted)
237 			return 0;
238 		return !(pmc->gsquery && !psf->sf_gsresp);
239 	case IGMPV3_CHANGE_TO_INCLUDE:
240 		if (gdeleted || sdeleted)
241 			return 0;
242 		return psf->sf_count[MCAST_INCLUDE] != 0;
243 	case IGMPV3_CHANGE_TO_EXCLUDE:
244 		if (gdeleted || sdeleted)
245 			return 0;
246 		if (pmc->sfcount[MCAST_EXCLUDE] == 0 ||
247 		    psf->sf_count[MCAST_INCLUDE])
248 			return 0;
249 		return pmc->sfcount[MCAST_EXCLUDE] ==
250 			psf->sf_count[MCAST_EXCLUDE];
251 	case IGMPV3_ALLOW_NEW_SOURCES:
252 		if (gdeleted || !psf->sf_crcount)
253 			return 0;
254 		return (pmc->sfmode == MCAST_INCLUDE) ^ sdeleted;
255 	case IGMPV3_BLOCK_OLD_SOURCES:
256 		if (pmc->sfmode == MCAST_INCLUDE)
257 			return gdeleted || (psf->sf_crcount && sdeleted);
258 		return psf->sf_crcount && !gdeleted && !sdeleted;
259 	}
260 	return 0;
261 }
262 
263 static int
igmp_scount(struct ip_mc_list * pmc,int type,int gdeleted,int sdeleted)264 igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
265 {
266 	struct ip_sf_list *psf;
267 	int scount = 0;
268 
269 	for (psf=pmc->sources; psf; psf=psf->sf_next) {
270 		if (!is_in(pmc, psf, type, gdeleted, sdeleted))
271 			continue;
272 		scount++;
273 	}
274 	return scount;
275 }
276 
igmpv3_newpack(struct net_device * dev,int size)277 static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
278 {
279 	struct sk_buff *skb;
280 	struct rtable *rt;
281 	struct iphdr *pip;
282 	struct igmpv3_report *pig;
283 	u32	dst;
284 
285 	dst = IGMPV3_ALL_MCR;
286 	if (ip_route_output(&rt, dst, 0, 0, dev->ifindex))
287 		return 0;
288 	if (rt->rt_src == 0) {
289 		ip_rt_put(rt);
290 		return 0;
291 	}
292 	skb = alloc_skb(size + dev->hard_header_len + 15, GFP_ATOMIC);
293 	if (skb == NULL) {
294 		ip_rt_put(rt);
295 		return 0;
296 	}
297 
298 	skb->dst = &rt->u.dst;
299 	skb->dev = dev;
300 
301 	skb_reserve(skb, (dev->hard_header_len+15)&~15);
302 
303 	skb->nh.iph = pip =(struct iphdr *)skb_put(skb, sizeof(struct iphdr)+4);
304 
305 	pip->version  = 4;
306 	pip->ihl      = (sizeof(struct iphdr)+4)>>2;
307 	pip->tos      = 0xc0;
308 	pip->frag_off = htons(IP_DF);
309 	pip->ttl      = 1;
310 	pip->daddr    = rt->rt_dst;
311 	pip->saddr    = rt->rt_src;
312 	pip->protocol = IPPROTO_IGMP;
313 	pip->tot_len  = 0;	/* filled in later */
314 	ip_select_ident(pip, &rt->u.dst, NULL);
315 	((u8*)&pip[1])[0] = IPOPT_RA;
316 	((u8*)&pip[1])[1] = 4;
317 	((u8*)&pip[1])[2] = 0;
318 	((u8*)&pip[1])[3] = 0;
319 
320 	pig =(struct igmpv3_report *)skb_put(skb, sizeof(*pig));
321 	skb->h.igmph = (struct igmphdr *)pig;
322 	pig->type = IGMPV3_HOST_MEMBERSHIP_REPORT;
323 	pig->resv1 = 0;
324 	pig->csum = 0;
325 	pig->resv2 = 0;
326 	pig->ngrec = 0;
327 	return skb;
328 }
329 
igmpv3_sendpack(struct sk_buff * skb)330 static int igmpv3_sendpack(struct sk_buff *skb)
331 {
332 	struct iphdr *pip = skb->nh.iph;
333 	struct igmphdr *pig = skb->h.igmph;
334 	int iplen, igmplen;
335 
336 	iplen = skb->tail - (unsigned char *)skb->nh.iph;
337 	pip->tot_len = htons(iplen);
338 	ip_send_check(pip);
339 
340 	igmplen = skb->tail - (unsigned char *)skb->h.igmph;
341 	pig->csum = ip_compute_csum((void *)skb->h.igmph, igmplen);
342 
343 	return NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, skb->dev,
344 		       output_maybe_reroute);
345 }
346 
grec_size(struct ip_mc_list * pmc,int type,int gdel,int sdel)347 static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel)
348 {
349 	return sizeof(struct igmpv3_grec) + 4*igmp_scount(pmc,type,gdel,sdel);
350 }
351 
add_grhead(struct sk_buff * skb,struct ip_mc_list * pmc,int type,struct igmpv3_grec ** ppgr)352 static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
353 	int type, struct igmpv3_grec **ppgr)
354 {
355 	struct net_device *dev = pmc->interface->dev;
356 	struct igmpv3_report *pih;
357 	struct igmpv3_grec *pgr;
358 
359 	if (!skb)
360 		skb = igmpv3_newpack(dev, dev->mtu);
361 	if (!skb)
362 		return 0;
363 	pgr = (struct igmpv3_grec *)skb_put(skb, sizeof(struct igmpv3_grec));
364 	pgr->grec_type = type;
365 	pgr->grec_auxwords = 0;
366 	pgr->grec_nsrcs = 0;
367 	pgr->grec_mca = pmc->multiaddr;
368 	pih = (struct igmpv3_report *)skb->h.igmph;
369 	pih->ngrec = htons(ntohs(pih->ngrec)+1);
370 	*ppgr = pgr;
371 	return skb;
372 }
373 
374 #define AVAILABLE(skb) ((skb) ? ((skb)->dev ? (skb)->dev->mtu - (skb)->len : \
375 	skb_tailroom(skb)) : 0)
376 
add_grec(struct sk_buff * skb,struct ip_mc_list * pmc,int type,int gdeleted,int sdeleted)377 static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
378 	int type, int gdeleted, int sdeleted)
379 {
380 	struct net_device *dev = pmc->interface->dev;
381 	struct igmpv3_report *pih;
382 	struct igmpv3_grec *pgr = 0;
383 	struct ip_sf_list *psf, *psf_next, *psf_prev, **psf_list;
384 	int scount, first, isquery, truncate;
385 
386 	if (pmc->multiaddr == IGMP_ALL_HOSTS)
387 		return skb;
388 
389 	isquery = type == IGMPV3_MODE_IS_INCLUDE ||
390 		  type == IGMPV3_MODE_IS_EXCLUDE;
391 	truncate = type == IGMPV3_MODE_IS_EXCLUDE ||
392 		    type == IGMPV3_CHANGE_TO_EXCLUDE;
393 
394 	psf_list = sdeleted ? &pmc->tomb : &pmc->sources;
395 
396 	if (!*psf_list) {
397 		if (type == IGMPV3_ALLOW_NEW_SOURCES ||
398 		    type == IGMPV3_BLOCK_OLD_SOURCES)
399 			return skb;
400 		if (pmc->crcount || isquery) {
401 			/* make sure we have room for group header and at
402 			 * least one source.
403 			 */
404 			if (skb && AVAILABLE(skb) < sizeof(struct igmpv3_grec)+
405 			    sizeof(__u32)) {
406 				igmpv3_sendpack(skb);
407 				skb = 0; /* add_grhead will get a new one */
408 			}
409 			skb = add_grhead(skb, pmc, type, &pgr);
410 		}
411 		return skb;
412 	}
413 	pih = skb ? (struct igmpv3_report *)skb->h.igmph : 0;
414 
415 	/* EX and TO_EX get a fresh packet, if needed */
416 	if (truncate) {
417 		if (pih && pih->ngrec &&
418 		    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
419 			if (skb)
420 				igmpv3_sendpack(skb);
421 			skb = igmpv3_newpack(dev, dev->mtu);
422 		}
423 	}
424 	first = 1;
425 	scount = 0;
426 	psf_prev = 0;
427 	for (psf=*psf_list; psf; psf=psf_next) {
428 		u32 *psrc;
429 
430 		psf_next = psf->sf_next;
431 
432 		if (!is_in(pmc, psf, type, gdeleted, sdeleted)) {
433 			psf_prev = psf;
434 			continue;
435 		}
436 
437 		/* clear marks on query responses */
438 		if (isquery)
439 			psf->sf_gsresp = 0;
440 
441 		if (AVAILABLE(skb) < sizeof(u32) +
442 		    first*sizeof(struct igmpv3_grec)) {
443 			if (truncate && !first)
444 				break;	 /* truncate these */
445 			if (pgr)
446 				pgr->grec_nsrcs = htons(scount);
447 			if (skb)
448 				igmpv3_sendpack(skb);
449 			skb = igmpv3_newpack(dev, dev->mtu);
450 			first = 1;
451 			scount = 0;
452 		}
453 		if (first) {
454 			skb = add_grhead(skb, pmc, type, &pgr);
455 			first = 0;
456 		}
457 		psrc = (u32 *)skb_put(skb, sizeof(u32));
458 		*psrc = psf->sf_inaddr;
459 		scount++;
460 		if ((type == IGMPV3_ALLOW_NEW_SOURCES ||
461 		     type == IGMPV3_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
462 			psf->sf_crcount--;
463 			if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
464 				if (psf_prev)
465 					psf_prev->sf_next = psf->sf_next;
466 				else
467 					*psf_list = psf->sf_next;
468 				kfree(psf);
469 				continue;
470 			}
471 		}
472 		psf_prev = psf;
473 	}
474 	if (pgr)
475 		pgr->grec_nsrcs = htons(scount);
476 
477 	if (isquery)
478 		pmc->gsquery = 0;	/* clear query state on report */
479 	return skb;
480 }
481 
igmpv3_send_report(struct in_device * in_dev,struct ip_mc_list * pmc)482 static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
483 {
484 	struct sk_buff *skb = 0;
485 	int type;
486 
487 	if (!pmc) {
488 		read_lock(&in_dev->lock);
489 		for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
490 			if (pmc->multiaddr == IGMP_ALL_HOSTS)
491 				continue;
492 			spin_lock_bh(&pmc->lock);
493 			if (pmc->sfcount[MCAST_EXCLUDE])
494 				type = IGMPV3_MODE_IS_EXCLUDE;
495 			else
496 				type = IGMPV3_MODE_IS_INCLUDE;
497 			skb = add_grec(skb, pmc, type, 0, 0);
498 			spin_unlock_bh(&pmc->lock);
499 		}
500 		read_unlock(&in_dev->lock);
501 	} else {
502 		spin_lock_bh(&pmc->lock);
503 		if (pmc->sfcount[MCAST_EXCLUDE])
504 			type = IGMPV3_MODE_IS_EXCLUDE;
505 		else
506 			type = IGMPV3_MODE_IS_INCLUDE;
507 		skb = add_grec(skb, pmc, type, 0, 0);
508 		spin_unlock_bh(&pmc->lock);
509 	}
510 	if (!skb)
511 		return 0;
512 	return igmpv3_sendpack(skb);
513 }
514 
515 /*
516  * remove zero-count source records from a source filter list
517  */
igmpv3_clear_zeros(struct ip_sf_list ** ppsf)518 static void igmpv3_clear_zeros(struct ip_sf_list **ppsf)
519 {
520 	struct ip_sf_list *psf_prev, *psf_next, *psf;
521 
522 	psf_prev = 0;
523 	for (psf=*ppsf; psf; psf = psf_next) {
524 		psf_next = psf->sf_next;
525 		if (psf->sf_crcount == 0) {
526 			if (psf_prev)
527 				psf_prev->sf_next = psf->sf_next;
528 			else
529 				*ppsf = psf->sf_next;
530 			kfree(psf);
531 		} else
532 			psf_prev = psf;
533 	}
534 }
535 
igmpv3_send_cr(struct in_device * in_dev)536 static void igmpv3_send_cr(struct in_device *in_dev)
537 {
538 	struct ip_mc_list *pmc, *pmc_prev, *pmc_next;
539 	struct sk_buff *skb = 0;
540 	int type, dtype;
541 
542 	read_lock(&in_dev->lock);
543 	write_lock_bh(&in_dev->mc_lock);
544 
545 	/* deleted MCA's */
546 	pmc_prev = 0;
547 	for (pmc=in_dev->mc_tomb; pmc; pmc=pmc_next) {
548 		pmc_next = pmc->next;
549 		if (pmc->sfmode == MCAST_INCLUDE) {
550 			type = IGMPV3_BLOCK_OLD_SOURCES;
551 			dtype = IGMPV3_BLOCK_OLD_SOURCES;
552 			skb = add_grec(skb, pmc, type, 1, 0);
553 			skb = add_grec(skb, pmc, dtype, 1, 1);
554 		}
555 		if (pmc->crcount) {
556 			pmc->crcount--;
557 			if (pmc->sfmode == MCAST_EXCLUDE) {
558 				type = IGMPV3_CHANGE_TO_INCLUDE;
559 				skb = add_grec(skb, pmc, type, 1, 0);
560 			}
561 			if (pmc->crcount == 0) {
562 				igmpv3_clear_zeros(&pmc->tomb);
563 				igmpv3_clear_zeros(&pmc->sources);
564 			}
565 		}
566 		if (pmc->crcount == 0 && !pmc->tomb && !pmc->sources) {
567 			if (pmc_prev)
568 				pmc_prev->next = pmc_next;
569 			else
570 				in_dev->mc_tomb = pmc_next;
571 			in_dev_put(pmc->interface);
572 			kfree(pmc);
573 		} else
574 			pmc_prev = pmc;
575 	}
576 	write_unlock_bh(&in_dev->mc_lock);
577 
578 	/* change recs */
579 	for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
580 		spin_lock_bh(&pmc->lock);
581 		if (pmc->sfcount[MCAST_EXCLUDE]) {
582 			type = IGMPV3_BLOCK_OLD_SOURCES;
583 			dtype = IGMPV3_ALLOW_NEW_SOURCES;
584 		} else {
585 			type = IGMPV3_ALLOW_NEW_SOURCES;
586 			dtype = IGMPV3_BLOCK_OLD_SOURCES;
587 		}
588 		skb = add_grec(skb, pmc, type, 0, 0);
589 		skb = add_grec(skb, pmc, dtype, 0, 1);	/* deleted sources */
590 
591 		/* filter mode changes */
592 		if (pmc->crcount) {
593 			pmc->crcount--;
594 			if (pmc->sfmode == MCAST_EXCLUDE)
595 				type = IGMPV3_CHANGE_TO_EXCLUDE;
596 			else
597 				type = IGMPV3_CHANGE_TO_INCLUDE;
598 			skb = add_grec(skb, pmc, type, 0, 0);
599 		}
600 		spin_unlock_bh(&pmc->lock);
601 	}
602 	read_unlock(&in_dev->lock);
603 	if (!skb)
604 		return;
605 	(void) igmpv3_sendpack(skb);
606 }
607 
igmp_send_report(struct in_device * in_dev,struct ip_mc_list * pmc,int type)608 static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
609 	int type)
610 {
611 	struct sk_buff *skb;
612 	struct iphdr *iph;
613 	struct igmphdr *ih;
614 	struct rtable *rt;
615 	struct net_device *dev = in_dev->dev;
616 	u32	group = pmc ? pmc->multiaddr : 0;
617 	u32	dst;
618 
619 	if (type == IGMPV3_HOST_MEMBERSHIP_REPORT)
620 		return igmpv3_send_report(in_dev, pmc);
621 	else if (type == IGMP_HOST_LEAVE_MESSAGE)
622 		dst = IGMP_ALL_ROUTER;
623 	else
624 		dst = group;
625 
626 	if (ip_route_output(&rt, dst, 0, 0, dev->ifindex))
627 		return -1;
628 	if (rt->rt_src == 0) {
629 		ip_rt_put(rt);
630 		return -1;
631 	}
632 
633 	skb=alloc_skb(IGMP_SIZE+dev->hard_header_len+15, GFP_ATOMIC);
634 	if (skb == NULL) {
635 		ip_rt_put(rt);
636 		return -1;
637 	}
638 
639 	skb->dst = &rt->u.dst;
640 
641 	skb_reserve(skb, (dev->hard_header_len+15)&~15);
642 
643 	skb->nh.iph = iph = (struct iphdr *)skb_put(skb, sizeof(struct iphdr)+4);
644 
645 	iph->version  = 4;
646 	iph->ihl      = (sizeof(struct iphdr)+4)>>2;
647 	iph->tos      = 0xc0;
648 	iph->frag_off = htons(IP_DF);
649 	iph->ttl      = 1;
650 	iph->daddr    = dst;
651 	iph->saddr    = rt->rt_src;
652 	iph->protocol = IPPROTO_IGMP;
653 	iph->tot_len  = htons(IGMP_SIZE);
654 	ip_select_ident(iph, &rt->u.dst, NULL);
655 	((u8*)&iph[1])[0] = IPOPT_RA;
656 	((u8*)&iph[1])[1] = 4;
657 	((u8*)&iph[1])[2] = 0;
658 	((u8*)&iph[1])[3] = 0;
659 	ip_send_check(iph);
660 
661 	ih = (struct igmphdr *)skb_put(skb, sizeof(struct igmphdr));
662 	ih->type=type;
663 	ih->code=0;
664 	ih->csum=0;
665 	ih->group=group;
666 	ih->csum=ip_compute_csum((void *)ih, sizeof(struct igmphdr));
667 
668 	return NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
669 		       output_maybe_reroute);
670 }
671 
igmp_gq_timer_expire(unsigned long data)672 static void igmp_gq_timer_expire(unsigned long data)
673 {
674 	struct in_device *in_dev = (struct in_device *)data;
675 
676 	in_dev->mr_gq_running = 0;
677 	igmpv3_send_report(in_dev, 0);
678 	__in_dev_put(in_dev);
679 }
680 
igmp_ifc_timer_expire(unsigned long data)681 static void igmp_ifc_timer_expire(unsigned long data)
682 {
683 	struct in_device *in_dev = (struct in_device *)data;
684 
685 	igmpv3_send_cr(in_dev);
686 	if (in_dev->mr_ifc_count) {
687 		in_dev->mr_ifc_count--;
688 		igmp_ifc_start_timer(in_dev, IGMP_Unsolicited_Report_Interval);
689 	}
690 	__in_dev_put(in_dev);
691 }
692 
igmp_ifc_event(struct in_device * in_dev)693 static void igmp_ifc_event(struct in_device *in_dev)
694 {
695 	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
696 		return;
697 	in_dev->mr_ifc_count = in_dev->mr_qrv ? in_dev->mr_qrv :
698 		IGMP_Unsolicited_Report_Count;
699 	igmp_ifc_start_timer(in_dev, 1);
700 }
701 
702 
igmp_timer_expire(unsigned long data)703 static void igmp_timer_expire(unsigned long data)
704 {
705 	struct ip_mc_list *im=(struct ip_mc_list *)data;
706 	struct in_device *in_dev = im->interface;
707 
708 	spin_lock(&im->lock);
709 	im->tm_running=0;
710 
711 	if (im->unsolicit_count) {
712 		im->unsolicit_count--;
713 		igmp_start_timer(im, IGMP_Unsolicited_Report_Interval);
714 	}
715 	im->reporter = 1;
716 	spin_unlock(&im->lock);
717 
718 	if (IGMP_V1_SEEN(in_dev))
719 		igmp_send_report(in_dev, im, IGMP_HOST_MEMBERSHIP_REPORT);
720 	else if (IGMP_V2_SEEN(in_dev))
721 		igmp_send_report(in_dev, im, IGMPV2_HOST_MEMBERSHIP_REPORT);
722 	else
723 		igmp_send_report(in_dev, im, IGMPV3_HOST_MEMBERSHIP_REPORT);
724 
725 	ip_ma_put(im);
726 }
727 
igmp_marksources(struct ip_mc_list * pmc,int nsrcs,__u32 * srcs)728 static void igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __u32 *srcs)
729 {
730 	struct ip_sf_list *psf;
731 	int i, scount;
732 
733 	scount = 0;
734 	for (psf=pmc->sources; psf; psf=psf->sf_next) {
735 		if (scount == nsrcs)
736 			break;
737 		for (i=0; i<nsrcs; i++)
738 			if (srcs[i] == psf->sf_inaddr) {
739 				psf->sf_gsresp = 1;
740 				scount++;
741 				break;
742 			}
743 	}
744 }
745 
igmp_heard_report(struct in_device * in_dev,u32 group)746 static void igmp_heard_report(struct in_device *in_dev, u32 group)
747 {
748 	struct ip_mc_list *im;
749 
750 	/* Timers are only set for non-local groups */
751 
752 	if (group == IGMP_ALL_HOSTS)
753 		return;
754 
755 	read_lock(&in_dev->lock);
756 	for (im=in_dev->mc_list; im!=NULL; im=im->next) {
757 		if (im->multiaddr == group) {
758 			igmp_stop_timer(im);
759 			break;
760 		}
761 	}
762 	read_unlock(&in_dev->lock);
763 }
764 
igmp_heard_query(struct in_device * in_dev,struct igmphdr * ih,int len)765 static void igmp_heard_query(struct in_device *in_dev, struct igmphdr *ih,
766 	int len)
767 {
768 	struct igmpv3_query *ih3 = (struct igmpv3_query *)ih;
769 	struct ip_mc_list	*im;
770 	u32			group = ih->group;
771 	int			max_delay;
772 	int			mark = 0;
773 
774 
775 	if (len == 8) {
776 		if (ih->code == 0) {
777 			/* Alas, old v1 router presents here. */
778 
779 			max_delay = IGMP_Query_Response_Interval;
780 			in_dev->mr_v1_seen = jiffies +
781 				IGMP_V1_Router_Present_Timeout;
782 			group = 0;
783 		} else {
784 			/* v2 router present */
785 			max_delay = ih->code*(HZ/IGMP_TIMER_SCALE);
786 			in_dev->mr_v2_seen = jiffies +
787 				IGMP_V2_Router_Present_Timeout;
788 		}
789 		/* cancel the interface change timer */
790 		in_dev->mr_ifc_count = 0;
791 		if (del_timer(&in_dev->mr_ifc_timer))
792 			__in_dev_put(in_dev);
793 		/* clear deleted report items */
794 		igmpv3_clear_delrec(in_dev);
795 	} else if (len < 12) {
796 		return;	/* ignore bogus packet; freed by caller */
797 	} else { /* v3 */
798 		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
799 		if (!max_delay)
800 			max_delay = 1;	/* can't mod w/ 0 */
801 		in_dev->mr_maxdelay = max_delay;
802 		if (ih3->qrv)
803 			in_dev->mr_qrv = ih3->qrv;
804 		if (!group) { /* general query */
805 			if (ih3->nsrcs)
806 				return;	/* no sources allowed */
807 			igmp_gq_start_timer(in_dev);
808 			return;
809 		}
810 		/* mark sources to include, if group & source-specific */
811 		mark = ih3->nsrcs != 0;
812 	}
813 
814 	/*
815 	 * - Start the timers in all of our membership records
816 	 *   that the query applies to for the interface on
817 	 *   which the query arrived excl. those that belong
818 	 *   to a "local" group (224.0.0.X)
819 	 * - For timers already running check if they need to
820 	 *   be reset.
821 	 * - Use the igmp->igmp_code field as the maximum
822 	 *   delay possible
823 	 */
824 	read_lock(&in_dev->lock);
825 	for (im=in_dev->mc_list; im!=NULL; im=im->next) {
826 		if (group && group != im->multiaddr)
827 			continue;
828 		if (im->multiaddr == IGMP_ALL_HOSTS)
829 			continue;
830 		spin_lock_bh(&im->lock);
831 		if (im->tm_running)
832 			im->gsquery = im->gsquery && mark;
833 		else
834 			im->gsquery = mark;
835 		if (im->gsquery)
836 			igmp_marksources(im, ntohs(ih3->nsrcs), ih3->srcs);
837 		spin_unlock_bh(&im->lock);
838 		igmp_mod_timer(im, max_delay);
839 	}
840 	read_unlock(&in_dev->lock);
841 }
842 
igmp_rcv(struct sk_buff * skb)843 int igmp_rcv(struct sk_buff *skb)
844 {
845 	/* This basically follows the spec line by line -- see RFC1112 */
846 	struct igmphdr *ih = skb->h.igmph;
847 	struct in_device *in_dev = in_dev_get(skb->dev);
848 	int len = skb->len;
849 
850 	if (in_dev==NULL) {
851 		kfree_skb(skb);
852 		return 0;
853 	}
854 
855 	if (skb_is_nonlinear(skb)) {
856 		if (skb_linearize(skb, GFP_ATOMIC) != 0) {
857 			kfree_skb(skb);
858 			return -ENOMEM;
859 		}
860 		ih = skb->h.igmph;
861 	}
862 
863 	if (len < sizeof(struct igmphdr) || ip_compute_csum((void *)ih, len)) {
864 		in_dev_put(in_dev);
865 		kfree_skb(skb);
866 		return 0;
867 	}
868 
869 	switch (ih->type) {
870 	case IGMP_HOST_MEMBERSHIP_QUERY:
871 		igmp_heard_query(in_dev, ih, len);
872 		break;
873 	case IGMP_HOST_MEMBERSHIP_REPORT:
874 	case IGMPV2_HOST_MEMBERSHIP_REPORT:
875 	case IGMPV3_HOST_MEMBERSHIP_REPORT:
876 		/* Is it our report looped back? */
877 		if (((struct rtable*)skb->dst)->key.iif == 0)
878 			break;
879 		/* don't rely on MC router hearing unicast reports */
880 		if (skb->pkt_type == PACKET_MULTICAST ||
881 		    skb->pkt_type == PACKET_BROADCAST)
882 			igmp_heard_report(in_dev, ih->group);
883 		igmp_heard_report(in_dev, ih->group);
884 		break;
885 	case IGMP_PIM:
886 #ifdef CONFIG_IP_PIMSM_V1
887 		in_dev_put(in_dev);
888 		return pim_rcv_v1(skb);
889 #endif
890 	case IGMP_DVMRP:
891 	case IGMP_TRACE:
892 	case IGMP_HOST_LEAVE_MESSAGE:
893 	case IGMP_MTRACE:
894 	case IGMP_MTRACE_RESP:
895 		break;
896 	default:
897 		NETDEBUG(printk(KERN_DEBUG "New IGMP type=%d, why we do not know about it?\n", ih->type));
898 	}
899 	in_dev_put(in_dev);
900 	kfree_skb(skb);
901 	return 0;
902 }
903 
904 #endif
905 
906 
907 /*
908  *	Add a filter to a device
909  */
910 
ip_mc_filter_add(struct in_device * in_dev,u32 addr)911 static void ip_mc_filter_add(struct in_device *in_dev, u32 addr)
912 {
913 	char buf[MAX_ADDR_LEN];
914 	struct net_device *dev = in_dev->dev;
915 
916 	/* Checking for IFF_MULTICAST here is WRONG-WRONG-WRONG.
917 	   We will get multicast token leakage, when IFF_MULTICAST
918 	   is changed. This check should be done in dev->set_multicast_list
919 	   routine. Something sort of:
920 	   if (dev->mc_list && dev->flags&IFF_MULTICAST) { do it; }
921 	   --ANK
922 	   */
923 	if (arp_mc_map(addr, buf, dev, 0) == 0)
924 		dev_mc_add(dev,buf,dev->addr_len,0);
925 }
926 
927 /*
928  *	Remove a filter from a device
929  */
930 
ip_mc_filter_del(struct in_device * in_dev,u32 addr)931 static void ip_mc_filter_del(struct in_device *in_dev, u32 addr)
932 {
933 	char buf[MAX_ADDR_LEN];
934 	struct net_device *dev = in_dev->dev;
935 
936 	if (arp_mc_map(addr, buf, dev, 0) == 0)
937 		dev_mc_delete(dev,buf,dev->addr_len,0);
938 }
939 
940 #ifdef CONFIG_IP_MULTICAST
941 /*
942  * deleted ip_mc_list manipulation
943  */
igmpv3_add_delrec(struct in_device * in_dev,struct ip_mc_list * im)944 static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
945 {
946 	struct ip_mc_list *pmc;
947 
948 	/* this is an "ip_mc_list" for convenience; only the fields below
949 	 * are actually used. In particular, the refcnt and users are not
950 	 * used for management of the delete list. Using the same structure
951 	 * for deleted items allows change reports to use common code with
952 	 * non-deleted or query-response MCA's.
953 	 */
954 	pmc = (struct ip_mc_list *)kmalloc(sizeof(*pmc), GFP_KERNEL);
955 	if (!pmc)
956 		return;
957 	memset(pmc, 0, sizeof(*pmc));
958 	spin_lock_bh(&im->lock);
959 	pmc->interface = im->interface;
960 	in_dev_hold(in_dev);
961 	pmc->multiaddr = im->multiaddr;
962 	pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
963 		IGMP_Unsolicited_Report_Count;
964 	pmc->sfmode = im->sfmode;
965 	if (pmc->sfmode == MCAST_INCLUDE) {
966 		struct ip_sf_list *psf;
967 
968 		pmc->tomb = im->tomb;
969 		pmc->sources = im->sources;
970 		im->tomb = im->sources = 0;
971 		for (psf=pmc->sources; psf; psf=psf->sf_next)
972 			psf->sf_crcount = pmc->crcount;
973 	}
974 	spin_unlock_bh(&im->lock);
975 
976 	write_lock_bh(&in_dev->mc_lock);
977 	pmc->next = in_dev->mc_tomb;
978 	in_dev->mc_tomb = pmc;
979 	write_unlock_bh(&in_dev->mc_lock);
980 }
981 
igmpv3_del_delrec(struct in_device * in_dev,__u32 multiaddr)982 static void igmpv3_del_delrec(struct in_device *in_dev, __u32 multiaddr)
983 {
984 	struct ip_mc_list *pmc, *pmc_prev;
985 	struct ip_sf_list *psf, *psf_next;
986 
987 	write_lock_bh(&in_dev->mc_lock);
988 	pmc_prev = 0;
989 	for (pmc=in_dev->mc_tomb; pmc; pmc=pmc->next) {
990 		if (pmc->multiaddr == multiaddr)
991 			break;
992 		pmc_prev = pmc;
993 	}
994 	if (pmc) {
995 		if (pmc_prev)
996 			pmc_prev->next = pmc->next;
997 		else
998 			in_dev->mc_tomb = pmc->next;
999 	}
1000 	write_unlock_bh(&in_dev->mc_lock);
1001 	if (pmc) {
1002 		for (psf=pmc->tomb; psf; psf=psf_next) {
1003 			psf_next = psf->sf_next;
1004 			kfree(psf);
1005 		}
1006 		in_dev_put(pmc->interface);
1007 		kfree(pmc);
1008 	}
1009 }
1010 
igmpv3_clear_delrec(struct in_device * in_dev)1011 static void igmpv3_clear_delrec(struct in_device *in_dev)
1012 {
1013 	struct ip_mc_list *pmc, *nextpmc;
1014 
1015 	write_lock_bh(&in_dev->mc_lock);
1016 	pmc = in_dev->mc_tomb;
1017 	in_dev->mc_tomb = 0;
1018 	write_unlock_bh(&in_dev->mc_lock);
1019 
1020 	for (; pmc; pmc = nextpmc) {
1021 		nextpmc = pmc->next;
1022 		ip_mc_clear_src(pmc);
1023 		in_dev_put(pmc->interface);
1024 		kfree(pmc);
1025 	}
1026 	/* clear dead sources, too */
1027 	read_lock(&in_dev->lock);
1028 	for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
1029 		struct ip_sf_list *psf, *psf_next;
1030 
1031 		spin_lock_bh(&pmc->lock);
1032 		psf = pmc->tomb;
1033 		pmc->tomb = 0;
1034 		spin_unlock_bh(&pmc->lock);
1035 		for (; psf; psf=psf_next) {
1036 			psf_next = psf->sf_next;
1037 			kfree(psf);
1038 		}
1039 	}
1040 	read_unlock(&in_dev->lock);
1041 }
1042 #endif
1043 
igmp_group_dropped(struct ip_mc_list * im)1044 static void igmp_group_dropped(struct ip_mc_list *im)
1045 {
1046 	struct in_device *in_dev = im->interface;
1047 #ifdef CONFIG_IP_MULTICAST
1048 	int reporter;
1049 #endif
1050 
1051 	if (im->loaded) {
1052 		im->loaded = 0;
1053 		ip_mc_filter_del(in_dev, im->multiaddr);
1054 	}
1055 
1056 #ifdef CONFIG_IP_MULTICAST
1057 	if (im->multiaddr == IGMP_ALL_HOSTS)
1058 		return;
1059 
1060 	reporter = im->reporter;
1061 	igmp_stop_timer(im);
1062 
1063 	if (!in_dev->dead) {
1064 		if (IGMP_V1_SEEN(in_dev))
1065 			goto done;
1066 		if (IGMP_V2_SEEN(in_dev)) {
1067 			if (reporter)
1068 				igmp_send_report(in_dev, im, IGMP_HOST_LEAVE_MESSAGE);
1069 			goto done;
1070 		}
1071 		/* IGMPv3 */
1072 		igmpv3_add_delrec(in_dev, im);
1073 
1074 		igmp_ifc_event(in_dev);
1075 	}
1076 done:
1077 #endif
1078 	ip_mc_clear_src(im);
1079 }
1080 
igmp_group_added(struct ip_mc_list * im)1081 static void igmp_group_added(struct ip_mc_list *im)
1082 {
1083 	struct in_device *in_dev = im->interface;
1084 
1085 	if (im->loaded == 0) {
1086 		im->loaded = 1;
1087 		ip_mc_filter_add(in_dev, im->multiaddr);
1088 	}
1089 
1090 #ifdef CONFIG_IP_MULTICAST
1091 	if (im->multiaddr == IGMP_ALL_HOSTS)
1092 		return;
1093 
1094 	if (in_dev->dead)
1095 		return;
1096 	if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev)) {
1097 		spin_lock_bh(&im->lock);
1098 		igmp_start_timer(im, IGMP_Initial_Report_Delay);
1099 		spin_unlock_bh(&im->lock);
1100 		return;
1101 	}
1102 	/* else, v3 */
1103 
1104 	im->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
1105 		IGMP_Unsolicited_Report_Count;
1106 	igmp_ifc_event(in_dev);
1107 #endif
1108 }
1109 
1110 
1111 /*
1112  *	Multicast list managers
1113  */
1114 
1115 
1116 /*
1117  *	A socket has joined a multicast group on device dev.
1118  */
1119 
ip_mc_inc_group(struct in_device * in_dev,u32 addr)1120 void ip_mc_inc_group(struct in_device *in_dev, u32 addr)
1121 {
1122 	struct ip_mc_list *im;
1123 
1124 	ASSERT_RTNL();
1125 
1126 	for (im=in_dev->mc_list; im; im=im->next) {
1127 		if (im->multiaddr == addr) {
1128 			im->users++;
1129 			ip_mc_add_src(in_dev, &addr, MCAST_EXCLUDE, 0, 0, 0);
1130 			goto out;
1131 		}
1132 	}
1133 
1134 	im = (struct ip_mc_list *)kmalloc(sizeof(*im), GFP_KERNEL);
1135 	if (!im)
1136 		goto out;
1137 
1138 	im->users=1;
1139 	im->interface=in_dev;
1140 	in_dev_hold(in_dev);
1141 	im->multiaddr=addr;
1142 	/* initial mode is (EX, empty) */
1143 	im->sfmode = MCAST_EXCLUDE;
1144 	im->sfcount[MCAST_INCLUDE] = 0;
1145 	im->sfcount[MCAST_EXCLUDE] = 1;
1146 	im->sources = 0;
1147 	im->tomb = 0;
1148 	im->crcount = 0;
1149 	atomic_set(&im->refcnt, 1);
1150 	spin_lock_init(&im->lock);
1151 #ifdef CONFIG_IP_MULTICAST
1152 	im->tm_running=0;
1153 	init_timer(&im->timer);
1154 	im->timer.data=(unsigned long)im;
1155 	im->timer.function=&igmp_timer_expire;
1156 	im->unsolicit_count = IGMP_Unsolicited_Report_Count;
1157 	im->reporter = 0;
1158 	im->gsquery = 0;
1159 #endif
1160 	im->loaded = 0;
1161 	write_lock_bh(&in_dev->lock);
1162 	im->next=in_dev->mc_list;
1163 	in_dev->mc_list=im;
1164 	write_unlock_bh(&in_dev->lock);
1165 #ifdef CONFIG_IP_MULTICAST
1166 	igmpv3_del_delrec(in_dev, im->multiaddr);
1167 #endif
1168 	igmp_group_added(im);
1169 	if (!in_dev->dead)
1170 		ip_rt_multicast_event(in_dev);
1171 out:
1172 	return;
1173 }
1174 
1175 /*
1176  *	A socket has left a multicast group on device dev
1177  */
1178 
ip_mc_dec_group(struct in_device * in_dev,u32 addr)1179 void ip_mc_dec_group(struct in_device *in_dev, u32 addr)
1180 {
1181 	struct ip_mc_list *i, **ip;
1182 
1183 	ASSERT_RTNL();
1184 
1185 	for (ip=&in_dev->mc_list; (i=*ip)!=NULL; ip=&i->next) {
1186 		if (i->multiaddr==addr) {
1187 			if (--i->users == 0) {
1188 				write_lock_bh(&in_dev->lock);
1189 				*ip = i->next;
1190 				write_unlock_bh(&in_dev->lock);
1191 				igmp_group_dropped(i);
1192 
1193 				if (!in_dev->dead)
1194 					ip_rt_multicast_event(in_dev);
1195 
1196 				ip_ma_put(i);
1197 				return;
1198 			}
1199 			break;
1200 		}
1201 	}
1202 }
1203 
1204 /* Device going down */
1205 
ip_mc_down(struct in_device * in_dev)1206 void ip_mc_down(struct in_device *in_dev)
1207 {
1208 	struct ip_mc_list *i;
1209 
1210 	ASSERT_RTNL();
1211 
1212 	for (i=in_dev->mc_list; i; i=i->next)
1213 		igmp_group_dropped(i);
1214 
1215 #ifdef CONFIG_IP_MULTICAST
1216 	in_dev->mr_ifc_count = 0;
1217 	if (del_timer(&in_dev->mr_ifc_timer))
1218 		__in_dev_put(in_dev);
1219 	in_dev->mr_gq_running = 0;
1220 	if (del_timer(&in_dev->mr_gq_timer))
1221 		__in_dev_put(in_dev);
1222 	igmpv3_clear_delrec(in_dev);
1223 #endif
1224 
1225 	ip_mc_dec_group(in_dev, IGMP_ALL_HOSTS);
1226 }
1227 
ip_mc_init_dev(struct in_device * in_dev)1228 void ip_mc_init_dev(struct in_device *in_dev)
1229 {
1230 	ASSERT_RTNL();
1231 
1232 	in_dev->mc_tomb = 0;
1233 #ifdef CONFIG_IP_MULTICAST
1234 	in_dev->mr_gq_running = 0;
1235 	init_timer(&in_dev->mr_gq_timer);
1236 	in_dev->mr_gq_timer.data=(unsigned long) in_dev;
1237 	in_dev->mr_gq_timer.function=&igmp_gq_timer_expire;
1238 	in_dev->mr_ifc_count = 0;
1239 	init_timer(&in_dev->mr_ifc_timer);
1240 	in_dev->mr_ifc_timer.data=(unsigned long) in_dev;
1241 	in_dev->mr_ifc_timer.function=&igmp_ifc_timer_expire;
1242 	in_dev->mr_qrv = IGMP_Unsolicited_Report_Count;
1243 #endif
1244 
1245 	in_dev->mc_lock = RW_LOCK_UNLOCKED;
1246 }
1247 
1248 /* Device going up */
1249 
ip_mc_up(struct in_device * in_dev)1250 void ip_mc_up(struct in_device *in_dev)
1251 {
1252 	struct ip_mc_list *i;
1253 
1254 	ASSERT_RTNL();
1255 
1256 	ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
1257 
1258 	for (i=in_dev->mc_list; i; i=i->next)
1259 		igmp_group_added(i);
1260 }
1261 
1262 /*
1263  *	Device is about to be destroyed: clean up.
1264  */
1265 
ip_mc_destroy_dev(struct in_device * in_dev)1266 void ip_mc_destroy_dev(struct in_device *in_dev)
1267 {
1268 	struct ip_mc_list *i;
1269 
1270 	ASSERT_RTNL();
1271 
1272 	/* Deactivate timers */
1273 	ip_mc_down(in_dev);
1274 
1275 	write_lock_bh(&in_dev->lock);
1276 	while ((i = in_dev->mc_list) != NULL) {
1277 		in_dev->mc_list = i->next;
1278 		write_unlock_bh(&in_dev->lock);
1279 
1280 		igmp_group_dropped(i);
1281 		ip_ma_put(i);
1282 
1283 		write_lock_bh(&in_dev->lock);
1284 	}
1285 	write_unlock_bh(&in_dev->lock);
1286 }
1287 
ip_mc_find_dev(struct ip_mreqn * imr)1288 static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
1289 {
1290 	struct rtable *rt;
1291 	struct net_device *dev = NULL;
1292 	struct in_device *idev = NULL;
1293 
1294 	if (imr->imr_ifindex) {
1295 		idev = inetdev_by_index(imr->imr_ifindex);
1296 		if (idev)
1297 			__in_dev_put(idev);
1298 		return idev;
1299 	}
1300 	if (imr->imr_address.s_addr) {
1301 		dev = ip_dev_find(imr->imr_address.s_addr);
1302 		if (!dev)
1303 			return NULL;
1304 		__dev_put(dev);
1305 	}
1306 
1307 	if (!dev && !ip_route_output(&rt, imr->imr_multiaddr.s_addr, 0, 0, 0)) {
1308 		dev = rt->u.dst.dev;
1309 		ip_rt_put(rt);
1310 	}
1311 	if (dev) {
1312 		imr->imr_ifindex = dev->ifindex;
1313 		idev = __in_dev_get(dev);
1314 	}
1315 	return idev;
1316 }
1317 
1318 /*
1319  *	Join a socket to a group
1320  */
1321 int sysctl_igmp_max_memberships = IP_MAX_MEMBERSHIPS;
1322 int sysctl_igmp_max_msf = IP_MAX_MSF;
1323 
1324 
ip_mc_del1_src(struct ip_mc_list * pmc,int sfmode,__u32 * psfsrc)1325 static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
1326 	__u32 *psfsrc)
1327 {
1328 	struct ip_sf_list *psf, *psf_prev;
1329 	int rv = 0;
1330 
1331 	psf_prev = 0;
1332 	for (psf=pmc->sources; psf; psf=psf->sf_next) {
1333 		if (psf->sf_inaddr == *psfsrc)
1334 			break;
1335 		psf_prev = psf;
1336 	}
1337 	if (!psf || psf->sf_count[sfmode] == 0) {
1338 		/* source filter not found, or count wrong =>  bug */
1339 		return -ESRCH;
1340 	}
1341 	psf->sf_count[sfmode]--;
1342 	if (psf->sf_count[sfmode] == 0) {
1343 		ip_rt_multicast_event(pmc->interface);
1344 	}
1345 	if (!psf->sf_count[MCAST_INCLUDE] && !psf->sf_count[MCAST_EXCLUDE]) {
1346 #ifdef CONFIG_IP_MULTICAST
1347 		struct in_device *in_dev = pmc->interface;
1348 #endif
1349 
1350 		/* no more filters for this source */
1351 		if (psf_prev)
1352 			psf_prev->sf_next = psf->sf_next;
1353 		else
1354 			pmc->sources = psf->sf_next;
1355 #ifdef CONFIG_IP_MULTICAST
1356 		if (psf->sf_oldin &&
1357 		    !IGMP_V1_SEEN(in_dev) && !IGMP_V2_SEEN(in_dev)) {
1358 			psf->sf_crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
1359 				IGMP_Unsolicited_Report_Count;
1360 			psf->sf_next = pmc->tomb;
1361 			pmc->tomb = psf;
1362 			rv = 1;
1363 		} else
1364 #endif
1365 			kfree(psf);
1366 	}
1367 	return rv;
1368 }
1369 
ip_mc_del_src(struct in_device * in_dev,__u32 * pmca,int sfmode,int sfcount,__u32 * psfsrc,int delta)1370 int ip_mc_del_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
1371 	int sfcount, __u32 *psfsrc, int delta)
1372 {
1373 	struct ip_mc_list *pmc;
1374 	int	changerec = 0;
1375 	int	i, err;
1376 
1377 	if (!in_dev)
1378 		return -ENODEV;
1379 	read_lock(&in_dev->lock);
1380 	for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
1381 		if (*pmca == pmc->multiaddr)
1382 			break;
1383 	}
1384 	if (!pmc) {
1385 		/* MCA not found?? bug */
1386 		read_unlock(&in_dev->lock);
1387 		return -ESRCH;
1388 	}
1389 	spin_lock_bh(&pmc->lock);
1390 	read_unlock(&in_dev->lock);
1391 #ifdef CONFIG_IP_MULTICAST
1392 	sf_markstate(pmc);
1393 #endif
1394 	if (!delta) {
1395 		err = -EINVAL;
1396 		if (!pmc->sfcount[sfmode])
1397 			goto out_unlock;
1398 		pmc->sfcount[sfmode]--;
1399 	}
1400 	err = 0;
1401 	for (i=0; i<sfcount; i++) {
1402 		int rv = ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
1403 
1404 		changerec |= rv > 0;
1405 		if (!err && rv < 0)
1406 			err = rv;
1407 	}
1408 	if (pmc->sfmode == MCAST_EXCLUDE &&
1409 	    pmc->sfcount[MCAST_EXCLUDE] == 0 &&
1410 	    pmc->sfcount[MCAST_INCLUDE]) {
1411 #ifdef CONFIG_IP_MULTICAST
1412 		struct ip_sf_list *psf;
1413 #endif
1414 
1415 		/* filter mode change */
1416 		pmc->sfmode = MCAST_INCLUDE;
1417 #ifdef CONFIG_IP_MULTICAST
1418 		pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
1419 			IGMP_Unsolicited_Report_Count;
1420 		in_dev->mr_ifc_count = pmc->crcount;
1421 		for (psf=pmc->sources; psf; psf = psf->sf_next)
1422 			psf->sf_crcount = 0;
1423 		igmp_ifc_event(pmc->interface);
1424 	} else if (sf_setstate(pmc) || changerec) {
1425 		igmp_ifc_event(pmc->interface);
1426 #endif
1427 	}
1428 out_unlock:
1429 	spin_unlock_bh(&pmc->lock);
1430 	return err;
1431 }
1432 
1433 /*
1434  * Add multicast single-source filter to the interface list
1435  */
ip_mc_add1_src(struct ip_mc_list * pmc,int sfmode,__u32 * psfsrc,int delta)1436 static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
1437 	__u32 *psfsrc, int delta)
1438 {
1439 	struct ip_sf_list *psf, *psf_prev;
1440 
1441 	psf_prev = 0;
1442 	for (psf=pmc->sources; psf; psf=psf->sf_next) {
1443 		if (psf->sf_inaddr == *psfsrc)
1444 			break;
1445 		psf_prev = psf;
1446 	}
1447 	if (!psf) {
1448 		psf = (struct ip_sf_list *)kmalloc(sizeof(*psf), GFP_ATOMIC);
1449 		if (!psf)
1450 			return -ENOBUFS;
1451 		memset(psf, 0, sizeof(*psf));
1452 		psf->sf_inaddr = *psfsrc;
1453 		if (psf_prev) {
1454 			psf_prev->sf_next = psf;
1455 		} else
1456 			pmc->sources = psf;
1457 	}
1458 	psf->sf_count[sfmode]++;
1459 	if (psf->sf_count[sfmode] == 1) {
1460 		ip_rt_multicast_event(pmc->interface);
1461 	}
1462 	return 0;
1463 }
1464 
1465 #ifdef CONFIG_IP_MULTICAST
sf_markstate(struct ip_mc_list * pmc)1466 static void sf_markstate(struct ip_mc_list *pmc)
1467 {
1468 	struct ip_sf_list *psf;
1469 	int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
1470 
1471 	for (psf=pmc->sources; psf; psf=psf->sf_next)
1472 		if (pmc->sfcount[MCAST_EXCLUDE]) {
1473 			psf->sf_oldin = mca_xcount ==
1474 				psf->sf_count[MCAST_EXCLUDE] &&
1475 				!psf->sf_count[MCAST_INCLUDE];
1476 		} else
1477 			psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
1478 }
1479 
sf_setstate(struct ip_mc_list * pmc)1480 static int sf_setstate(struct ip_mc_list *pmc)
1481 {
1482 	struct ip_sf_list *psf;
1483 	int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
1484 	int qrv = pmc->interface->mr_qrv;
1485 	int new_in, rv;
1486 
1487 	rv = 0;
1488 	for (psf=pmc->sources; psf; psf=psf->sf_next) {
1489 		if (pmc->sfcount[MCAST_EXCLUDE]) {
1490 			new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
1491 				!psf->sf_count[MCAST_INCLUDE];
1492 		} else
1493 			new_in = psf->sf_count[MCAST_INCLUDE] != 0;
1494 		if (new_in != psf->sf_oldin) {
1495 			psf->sf_crcount = qrv;
1496 			rv++;
1497 		}
1498 	}
1499 	return rv;
1500 }
1501 #endif
1502 
1503 /*
1504  * Add multicast source filter list to the interface list
1505  */
ip_mc_add_src(struct in_device * in_dev,__u32 * pmca,int sfmode,int sfcount,__u32 * psfsrc,int delta)1506 int ip_mc_add_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
1507 	int sfcount, __u32 *psfsrc, int delta)
1508 {
1509 	struct ip_mc_list *pmc;
1510 	int	isexclude;
1511 	int	i, err;
1512 
1513 	if (!in_dev)
1514 		return -ENODEV;
1515 	read_lock(&in_dev->lock);
1516 	for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
1517 		if (*pmca == pmc->multiaddr)
1518 			break;
1519 	}
1520 	if (!pmc) {
1521 		/* MCA not found?? bug */
1522 		read_unlock(&in_dev->lock);
1523 		return -ESRCH;
1524 	}
1525 	spin_lock_bh(&pmc->lock);
1526 	read_unlock(&in_dev->lock);
1527 
1528 #ifdef CONFIG_IP_MULTICAST
1529 	sf_markstate(pmc);
1530 #endif
1531 	isexclude = pmc->sfmode == MCAST_EXCLUDE;
1532 	if (!delta)
1533 		pmc->sfcount[sfmode]++;
1534 	err = 0;
1535 	for (i=0; i<sfcount; i++) {
1536 		err = ip_mc_add1_src(pmc, sfmode, &psfsrc[i], delta);
1537 		if (err)
1538 			break;
1539 	}
1540 	if (err) {
1541 		int j;
1542 
1543 		pmc->sfcount[sfmode]--;
1544 		for (j=0; j<i; j++)
1545 			(void) ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
1546 	} else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
1547 #ifdef CONFIG_IP_MULTICAST
1548 		struct in_device *in_dev = pmc->interface;
1549 		struct ip_sf_list *psf;
1550 #endif
1551 
1552 		/* filter mode change */
1553 		if (pmc->sfcount[MCAST_EXCLUDE])
1554 			pmc->sfmode = MCAST_EXCLUDE;
1555 		else if (pmc->sfcount[MCAST_INCLUDE])
1556 			pmc->sfmode = MCAST_INCLUDE;
1557 #ifdef CONFIG_IP_MULTICAST
1558 		/* else no filters; keep old mode for reports */
1559 
1560 		pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
1561 			IGMP_Unsolicited_Report_Count;
1562 		in_dev->mr_ifc_count = pmc->crcount;
1563 		for (psf=pmc->sources; psf; psf = psf->sf_next)
1564 			psf->sf_crcount = 0;
1565 		igmp_ifc_event(in_dev);
1566 	} else if (sf_setstate(pmc)) {
1567 		igmp_ifc_event(in_dev);
1568 #endif
1569 	}
1570 	spin_unlock_bh(&pmc->lock);
1571 	return err;
1572 }
1573 
ip_mc_clear_src(struct ip_mc_list * pmc)1574 static void ip_mc_clear_src(struct ip_mc_list *pmc)
1575 {
1576 	struct ip_sf_list *psf, *nextpsf;
1577 
1578 	for (psf=pmc->tomb; psf; psf=nextpsf) {
1579 		nextpsf = psf->sf_next;
1580 		kfree(psf);
1581 	}
1582 	pmc->tomb = 0;
1583 	for (psf=pmc->sources; psf; psf=nextpsf) {
1584 		nextpsf = psf->sf_next;
1585 		kfree(psf);
1586 	}
1587 	pmc->sources = 0;
1588 	pmc->sfmode = MCAST_EXCLUDE;
1589 	pmc->sfcount[MCAST_INCLUDE] = 0;
1590 	pmc->sfcount[MCAST_EXCLUDE] = 1;
1591 }
1592 
1593 
1594 /*
1595  * Join a multicast group
1596  */
ip_mc_join_group(struct sock * sk,struct ip_mreqn * imr)1597 int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
1598 {
1599 	int err;
1600 	u32 addr = imr->imr_multiaddr.s_addr;
1601 	struct ip_mc_socklist *iml, *i;
1602 	struct in_device *in_dev;
1603 	struct inet_opt *inet = &sk->protinfo.af_inet;
1604 	int count = 0;
1605 
1606 	if (!MULTICAST(addr))
1607 		return -EINVAL;
1608 
1609 	rtnl_shlock();
1610 
1611 	in_dev = ip_mc_find_dev(imr);
1612 
1613 	if (!in_dev) {
1614 		iml = NULL;
1615 		err = -ENODEV;
1616 		goto done;
1617 	}
1618 
1619 	iml = (struct ip_mc_socklist *)sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL);
1620 
1621 	err = -EADDRINUSE;
1622 	for (i = inet->mc_list; i; i = i->next) {
1623 		if (memcmp(&i->multi, imr, sizeof(*imr)) == 0) {
1624 			/* New style additions are reference counted */
1625 			if (imr->imr_address.s_addr == 0) {
1626 				i->count++;
1627 				err = 0;
1628 			}
1629 			goto done;
1630 		}
1631 		count++;
1632 	}
1633 	err = -ENOBUFS;
1634 	if (iml == NULL || count >= sysctl_igmp_max_memberships)
1635 		goto done;
1636 	memcpy(&iml->multi, imr, sizeof(*imr));
1637 	iml->next = sk->protinfo.af_inet.mc_list;
1638 	iml->count = 1;
1639 	iml->sflist = NULL;
1640 	iml->sfmode = MCAST_EXCLUDE;
1641 	inet->mc_list = iml;
1642 	ip_mc_inc_group(in_dev, addr);
1643 	iml = NULL;
1644 	err = 0;
1645 
1646 done:
1647 	rtnl_shunlock();
1648 	if (iml)
1649 		sock_kfree_s(sk, iml, sizeof(*iml));
1650 	return err;
1651 }
1652 
ip_mc_leave_src(struct sock * sk,struct ip_mc_socklist * iml,struct in_device * in_dev)1653 int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
1654 	struct in_device *in_dev)
1655 {
1656 	int err;
1657 
1658 	if (iml->sflist == 0) {
1659 		/* any-source empty exclude case */
1660 		return ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
1661 			iml->sfmode, 0, 0, 0);
1662 	}
1663 	err = ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
1664 			iml->sfmode, iml->sflist->sl_count,
1665 			iml->sflist->sl_addr, 0);
1666 	sock_kfree_s(sk, iml->sflist, IP_SFLSIZE(iml->sflist->sl_max));
1667 	iml->sflist = 0;
1668 	return err;
1669 }
1670 
1671 /*
1672  *	Ask a socket to leave a group.
1673  */
1674 
ip_mc_leave_group(struct sock * sk,struct ip_mreqn * imr)1675 int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
1676 {
1677 	struct inet_opt *inet = &sk->protinfo.af_inet;
1678 	struct ip_mc_socklist *iml, **imlp;
1679 
1680 	rtnl_lock();
1681 	for (imlp = &inet->mc_list; (iml = *imlp) != NULL; imlp = &iml->next) {
1682 		if (iml->multi.imr_multiaddr.s_addr==imr->imr_multiaddr.s_addr &&
1683 		    iml->multi.imr_address.s_addr==imr->imr_address.s_addr &&
1684 		    (!imr->imr_ifindex || iml->multi.imr_ifindex==imr->imr_ifindex)) {
1685 			struct in_device *in_dev;
1686 
1687 			in_dev = inetdev_by_index(iml->multi.imr_ifindex);
1688 			if (in_dev)
1689 				(void) ip_mc_leave_src(sk, iml, in_dev);
1690 			if (--iml->count) {
1691 				rtnl_unlock();
1692 				if (in_dev)
1693 					in_dev_put(in_dev);
1694 				return 0;
1695 			}
1696 
1697 			*imlp = iml->next;
1698 
1699 			if (in_dev) {
1700 				ip_mc_dec_group(in_dev, imr->imr_multiaddr.s_addr);
1701 				in_dev_put(in_dev);
1702 			}
1703 			rtnl_unlock();
1704 			sock_kfree_s(sk, iml, sizeof(*iml));
1705 			return 0;
1706 		}
1707 	}
1708 	rtnl_unlock();
1709 	return -EADDRNOTAVAIL;
1710 }
1711 
ip_mc_source(int add,int omode,struct sock * sk,struct ip_mreq_source * mreqs,int ifindex)1712 int ip_mc_source(int add, int omode, struct sock *sk, struct
1713 	ip_mreq_source *mreqs, int ifindex)
1714 {
1715 	int err;
1716 	struct ip_mreqn imr;
1717 	u32 addr = mreqs->imr_multiaddr;
1718 	struct ip_mc_socklist *pmc;
1719 	struct in_device *in_dev = 0;
1720 	struct inet_opt *inet = &sk->protinfo.af_inet;
1721 	struct ip_sf_socklist *psl;
1722 	int i, j, rv;
1723 
1724 	if (!MULTICAST(addr))
1725 		return -EINVAL;
1726 
1727 	rtnl_shlock();
1728 
1729 	imr.imr_multiaddr.s_addr = mreqs->imr_multiaddr;
1730 	imr.imr_address.s_addr = mreqs->imr_interface;
1731 	imr.imr_ifindex = ifindex;
1732 	in_dev = ip_mc_find_dev(&imr);
1733 
1734 	if (!in_dev) {
1735 		err = -ENODEV;
1736 		goto done;
1737 	}
1738 	err = -EADDRNOTAVAIL;
1739 
1740 	for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
1741 		if (memcmp(&pmc->multi, mreqs, 2*sizeof(__u32)) == 0)
1742 			break;
1743 	}
1744 	if (!pmc)		/* must have a prior join */
1745 		goto done;
1746 	/* if a source filter was set, must be the same mode as before */
1747 	if (pmc->sflist) {
1748 		if (pmc->sfmode != omode)
1749 			goto done;
1750 	} else if (pmc->sfmode != omode) {
1751 		/* allow mode switches for empty-set filters */
1752 		ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 0, 0, 0);
1753 		ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, pmc->sfmode, 0,
1754 			0, 0);
1755 		pmc->sfmode = omode;
1756 	}
1757 
1758 	psl = pmc->sflist;
1759 	if (!add) {
1760 		if (!psl)
1761 			goto done;
1762 		rv = !0;
1763 		for (i=0; i<psl->sl_count; i++) {
1764 			rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
1765 				sizeof(__u32));
1766 			if (rv == 0)
1767 				break;
1768 		}
1769 		if (rv)		/* source not found */
1770 			goto done;
1771 
1772 		/* update the interface filter */
1773 		ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
1774 			&mreqs->imr_sourceaddr, 1);
1775 
1776 		for (j=i+1; j<psl->sl_count; j++)
1777 			psl->sl_addr[j-1] = psl->sl_addr[j];
1778 		psl->sl_count--;
1779 		err = 0;
1780 		goto done;
1781 	}
1782 	/* else, add a new source to the filter */
1783 
1784 	if (psl && psl->sl_count >= sysctl_igmp_max_msf) {
1785 		err = -ENOBUFS;
1786 		goto done;
1787 	}
1788 	if (!psl || psl->sl_count == psl->sl_max) {
1789 		struct ip_sf_socklist *newpsl;
1790 		int count = IP_SFBLOCK;
1791 
1792 		if (psl)
1793 			count += psl->sl_max;
1794 		newpsl = (struct ip_sf_socklist *)sock_kmalloc(sk,
1795 			IP_SFLSIZE(count), GFP_KERNEL);
1796 		if (!newpsl) {
1797 			err = -ENOBUFS;
1798 			goto done;
1799 		}
1800 		newpsl->sl_max = count;
1801 		newpsl->sl_count = count - IP_SFBLOCK;
1802 		if (psl) {
1803 			for (i=0; i<psl->sl_count; i++)
1804 				newpsl->sl_addr[i] = psl->sl_addr[i];
1805 			sock_kfree_s(sk, psl, IP_SFLSIZE(psl->sl_max));
1806 		}
1807 		pmc->sflist = psl = newpsl;
1808 	}
1809 	rv = 1;	/* > 0 for insert logic below if sl_count is 0 */
1810 	for (i=0; i<psl->sl_count; i++) {
1811 		rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
1812 			sizeof(__u32));
1813 		if (rv == 0)
1814 			break;
1815 	}
1816 	if (rv == 0)		/* address already there is an error */
1817 		goto done;
1818 	for (j=psl->sl_count-1; j>=i; j--)
1819 		psl->sl_addr[j+1] = psl->sl_addr[j];
1820 	psl->sl_addr[i] = mreqs->imr_sourceaddr;
1821 	psl->sl_count++;
1822 	err = 0;
1823 	/* update the interface list */
1824 	ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
1825 		&mreqs->imr_sourceaddr, 1);
1826 done:
1827 	rtnl_shunlock();
1828 	return err;
1829 }
1830 
ip_mc_msfilter(struct sock * sk,struct ip_msfilter * msf,int ifindex)1831 int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
1832 {
1833 	int err;
1834 	struct ip_mreqn	imr;
1835 	u32 addr = msf->imsf_multiaddr;
1836 	struct ip_mc_socklist *pmc;
1837 	struct in_device *in_dev;
1838 	struct inet_opt *inet = &sk->protinfo.af_inet;
1839 	struct ip_sf_socklist *newpsl, *psl;
1840 
1841 	if (!MULTICAST(addr))
1842 		return -EINVAL;
1843 	if (msf->imsf_fmode != MCAST_INCLUDE &&
1844 	    msf->imsf_fmode != MCAST_EXCLUDE)
1845 		return -EINVAL;
1846 
1847 	rtnl_shlock();
1848 
1849 	imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
1850 	imr.imr_address.s_addr = msf->imsf_interface;
1851 	imr.imr_ifindex = ifindex;
1852 	in_dev = ip_mc_find_dev(&imr);
1853 
1854 	if (!in_dev) {
1855 		err = -ENODEV;
1856 		goto done;
1857 	}
1858 	err = -EADDRNOTAVAIL;
1859 
1860 	for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
1861 		if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
1862 		    pmc->multi.imr_ifindex == imr.imr_ifindex)
1863 			break;
1864 	}
1865 	if (!pmc)		/* must have a prior join */
1866 		goto done;
1867 	if (msf->imsf_numsrc) {
1868 		newpsl = (struct ip_sf_socklist *)sock_kmalloc(sk,
1869 				IP_SFLSIZE(msf->imsf_numsrc), GFP_KERNEL);
1870 		if (!newpsl) {
1871 			err = -ENOBUFS;
1872 			goto done;
1873 		}
1874 		newpsl->sl_max = newpsl->sl_count = msf->imsf_numsrc;
1875 		memcpy(newpsl->sl_addr, msf->imsf_slist,
1876 			msf->imsf_numsrc * sizeof(msf->imsf_slist[0]));
1877 		err = ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
1878 			msf->imsf_fmode, newpsl->sl_count, newpsl->sl_addr, 0);
1879 		if (err) {
1880 			sock_kfree_s(sk, newpsl, IP_SFLSIZE(newpsl->sl_max));
1881 			goto done;
1882 		}
1883 	} else {
1884 		newpsl = NULL;
1885 		(void) ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
1886 		       msf->imsf_fmode, 0, NULL, 0);
1887 	}
1888 	psl = pmc->sflist;
1889 	if (psl) {
1890 		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
1891 			psl->sl_count, psl->sl_addr, 0);
1892 		sock_kfree_s(sk, psl, IP_SFLSIZE(psl->sl_max));
1893 	} else
1894 		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
1895 			0, 0, 0);
1896 	pmc->sflist = newpsl;
1897 	pmc->sfmode = msf->imsf_fmode;
1898 done:
1899 	rtnl_shunlock();
1900 	return err;
1901 }
1902 
ip_mc_msfget(struct sock * sk,struct ip_msfilter * msf,struct ip_msfilter * optval,int * optlen)1903 int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
1904 	struct ip_msfilter *optval, int *optlen)
1905 {
1906 	int err, len, count, copycount;
1907 	struct ip_mreqn	imr;
1908 	u32 addr = msf->imsf_multiaddr;
1909 	struct ip_mc_socklist *pmc;
1910 	struct in_device *in_dev;
1911 	struct inet_opt *inet = &sk->protinfo.af_inet;
1912 	struct ip_sf_socklist *psl;
1913 
1914 	if (!MULTICAST(addr))
1915 		return -EINVAL;
1916 
1917 	rtnl_shlock();
1918 
1919 	imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
1920 	imr.imr_address.s_addr = msf->imsf_interface;
1921 	imr.imr_ifindex = 0;
1922 	in_dev = ip_mc_find_dev(&imr);
1923 
1924 	if (!in_dev) {
1925 		err = -ENODEV;
1926 		goto done;
1927 	}
1928 	err = -EADDRNOTAVAIL;
1929 
1930 	for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
1931 		if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
1932 		    pmc->multi.imr_ifindex == imr.imr_ifindex)
1933 			break;
1934 	}
1935 	if (!pmc)		/* must have a prior join */
1936 		goto done;
1937 	msf->imsf_fmode = pmc->sfmode;
1938 	psl = pmc->sflist;
1939 	rtnl_shunlock();
1940 	if (!psl) {
1941 		len = 0;
1942 		count = 0;
1943 	} else {
1944 		count = psl->sl_count;
1945 	}
1946 	copycount = count < msf->imsf_numsrc ? count : msf->imsf_numsrc;
1947 	len = copycount * sizeof(psl->sl_addr[0]);
1948 	msf->imsf_numsrc = count;
1949 	if (put_user(IP_MSFILTER_SIZE(copycount), optlen) ||
1950 	    copy_to_user((void *)optval, msf, IP_MSFILTER_SIZE(0))) {
1951 		return -EFAULT;
1952 	}
1953 	if (len &&
1954 	    copy_to_user((void *)&optval->imsf_slist[0], psl->sl_addr, len))
1955 		return -EFAULT;
1956 	return 0;
1957 done:
1958 	rtnl_shunlock();
1959 	return err;
1960 }
1961 
ip_mc_gsfget(struct sock * sk,struct group_filter * gsf,struct group_filter * optval,int * optlen)1962 int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
1963 	struct group_filter *optval, int *optlen)
1964 {
1965 	int err, i, count, copycount;
1966 	struct sockaddr_in *psin;
1967 	u32 addr;
1968 	struct ip_mc_socklist *pmc;
1969 	struct inet_opt *inet = &sk->protinfo.af_inet;
1970 	struct ip_sf_socklist *psl;
1971 
1972 	psin = (struct sockaddr_in *)&gsf->gf_group;
1973 	if (psin->sin_family != AF_INET)
1974 		return -EINVAL;
1975 	addr = psin->sin_addr.s_addr;
1976 	if (!MULTICAST(addr))
1977 		return -EINVAL;
1978 
1979 	rtnl_shlock();
1980 
1981 	err = -EADDRNOTAVAIL;
1982 
1983 	for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
1984 		if (pmc->multi.imr_multiaddr.s_addr == addr &&
1985 		    pmc->multi.imr_ifindex == gsf->gf_interface)
1986 			break;
1987 	}
1988 	if (!pmc)		/* must have a prior join */
1989 		goto done;
1990 	gsf->gf_fmode = pmc->sfmode;
1991 	psl = pmc->sflist;
1992 	rtnl_shunlock();
1993 	count = psl ? psl->sl_count : 0;
1994 	copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
1995 	gsf->gf_numsrc = count;
1996 	if (put_user(GROUP_FILTER_SIZE(copycount), optlen) ||
1997 	    copy_to_user((void *)optval, gsf, GROUP_FILTER_SIZE(0))) {
1998 		return -EFAULT;
1999 	}
2000 	for (i=0; i<copycount; i++) {
2001 		struct sockaddr_in *psin;
2002 		struct sockaddr_storage ss;
2003 
2004 		psin = (struct sockaddr_in *)&ss;
2005 		memset(&ss, 0, sizeof(ss));
2006 		psin->sin_family = AF_INET;
2007 		psin->sin_addr.s_addr = psl->sl_addr[i];
2008 		if (copy_to_user((void *)&optval->gf_slist[i], &ss, sizeof(ss)))
2009 			return -EFAULT;
2010 	}
2011 	return 0;
2012 done:
2013 	rtnl_shunlock();
2014 	return err;
2015 }
2016 
2017 /*
2018  * check if a multicast source filter allows delivery for a given <src,dst,intf>
2019  */
ip_mc_sf_allow(struct sock * sk,u32 loc_addr,u32 rmt_addr,int dif)2020 int ip_mc_sf_allow(struct sock *sk, u32 loc_addr, u32 rmt_addr, int dif)
2021 {
2022 	struct inet_opt *inet = &sk->protinfo.af_inet;
2023 	struct ip_mc_socklist *pmc;
2024 	struct ip_sf_socklist *psl;
2025 	int i;
2026 
2027 	if (!MULTICAST(loc_addr))
2028 		return 1;
2029 
2030 	for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
2031 		if (pmc->multi.imr_multiaddr.s_addr == loc_addr &&
2032 		    pmc->multi.imr_ifindex == dif)
2033 			break;
2034 	}
2035 	if (!pmc)
2036 		return 1;
2037 	psl = pmc->sflist;
2038 	if (!psl)
2039 		return pmc->sfmode == MCAST_EXCLUDE;
2040 
2041 	for (i=0; i<psl->sl_count; i++) {
2042 		if (psl->sl_addr[i] == rmt_addr)
2043 			break;
2044 	}
2045 	if (pmc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
2046 		return 0;
2047 	if (pmc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
2048 		return 0;
2049 	return 1;
2050 }
2051 
2052 /*
2053  *	A socket is closing.
2054  */
2055 
ip_mc_drop_socket(struct sock * sk)2056 void ip_mc_drop_socket(struct sock *sk)
2057 {
2058 	struct inet_opt *inet = &sk->protinfo.af_inet;
2059 	struct ip_mc_socklist *iml;
2060 
2061 	if (inet->mc_list == NULL)
2062 		return;
2063 
2064 	rtnl_lock();
2065 	while ((iml = inet->mc_list) != NULL) {
2066 		struct in_device *in_dev;
2067 		inet->mc_list = iml->next;
2068 
2069 		if ((in_dev = inetdev_by_index(iml->multi.imr_ifindex)) != NULL) {
2070 			(void) ip_mc_leave_src(sk, iml, in_dev);
2071 			ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
2072 			in_dev_put(in_dev);
2073 		}
2074 		sock_kfree_s(sk, iml, sizeof(*iml));
2075 
2076 	}
2077 	rtnl_unlock();
2078 }
2079 
ip_check_mc(struct in_device * in_dev,u32 mc_addr,u32 src_addr)2080 int ip_check_mc(struct in_device *in_dev, u32 mc_addr, u32 src_addr)
2081 {
2082 	struct ip_mc_list *im;
2083 	struct ip_sf_list *psf;
2084 	int rv = 0;
2085 
2086 	read_lock(&in_dev->lock);
2087 	for (im=in_dev->mc_list; im; im=im->next) {
2088 		if (im->multiaddr == mc_addr)
2089 			break;
2090 	}
2091 	/*
2092 	 * This should check the protocol and allow all IGMP packets
2093 	 * here, but it isn't available in the call from ip_route_output()
2094 	 * in 2.4.x. It shouldn't actually matter, since groups joined
2095 	 * from within the kernel will have an {exclude, empty} filter.
2096 	 * Differs from 2.5.x here.	+-DLS 4/23/03
2097 	 */
2098 	if (im) {
2099 		if (src_addr) {
2100 			for (psf=im->sources; psf; psf=psf->sf_next) {
2101 				if (psf->sf_inaddr == src_addr)
2102 					break;
2103 			}
2104 			if (psf)
2105 				rv = psf->sf_count[MCAST_INCLUDE] ||
2106 					psf->sf_count[MCAST_EXCLUDE] !=
2107 					im->sfcount[MCAST_EXCLUDE];
2108 			else
2109 				rv = im->sfcount[MCAST_EXCLUDE] != 0;
2110 		} else
2111 			rv = 1;
2112 	}
2113 	read_unlock(&in_dev->lock);
2114 	return rv;
2115 }
2116 
2117 
ip_mc_procinfo(char * buffer,char ** start,off_t offset,int length)2118 int ip_mc_procinfo(char *buffer, char **start, off_t offset, int length)
2119 {
2120 	off_t pos=0, begin=0;
2121 	struct ip_mc_list *im;
2122 	int len=0;
2123 	struct net_device *dev;
2124 
2125 	len=sprintf(buffer,"Idx\tDevice    : Count Querier\tGroup    Users Timer\tReporter\n");
2126 
2127 	read_lock(&dev_base_lock);
2128 	for(dev = dev_base; dev; dev = dev->next) {
2129 		struct in_device *in_dev = in_dev_get(dev);
2130 		char   *querier = "NONE";
2131 
2132 		if (in_dev == NULL)
2133 			continue;
2134 
2135 #ifdef CONFIG_IP_MULTICAST
2136 		querier = IGMP_V1_SEEN(in_dev) ? "V1" : IGMP_V2_SEEN(in_dev) ?
2137 			"V2" : "V3";
2138 #endif
2139 
2140 		len+=sprintf(buffer+len,"%d\t%-10s: %5d %7s\n",
2141 			     dev->ifindex, dev->name, dev->mc_count, querier);
2142 
2143 		read_lock(&in_dev->lock);
2144 		for (im = in_dev->mc_list; im; im = im->next) {
2145 			len+=sprintf(buffer+len,
2146 				     "\t\t\t\t%08lX %5d %d:%08lX\t\t%d\n",
2147 				     im->multiaddr, im->users,
2148 				     im->tm_running, im->tm_running ?
2149 				     im->timer.expires-jiffies : 0,
2150 				     im->reporter);
2151 
2152 			pos=begin+len;
2153 			if(pos<offset)
2154 			{
2155 				len=0;
2156 				begin=pos;
2157 			}
2158 			if(pos>offset+length) {
2159 				read_unlock(&in_dev->lock);
2160 				in_dev_put(in_dev);
2161 				goto done;
2162 			}
2163 		}
2164 		read_unlock(&in_dev->lock);
2165 		in_dev_put(in_dev);
2166 	}
2167 done:
2168 	read_unlock(&dev_base_lock);
2169 
2170 	*start=buffer+(offset-begin);
2171 	len-=(offset-begin);
2172 	if(len>length)
2173 		len=length;
2174 	if(len<0)
2175 		len=0;
2176 	return len;
2177 }
2178 
ip_mcf_procinfo(char * buffer,char ** start,off_t offset,int length)2179 int ip_mcf_procinfo(char *buffer, char **start, off_t offset, int length)
2180 {
2181 	off_t pos=0, begin=0;
2182 	int len=0;
2183 	int first = 1;
2184 	struct net_device *dev;
2185 
2186 	read_lock(&dev_base_lock);
2187 	for(dev=dev_base; dev; dev=dev->next) {
2188 		struct in_device *in_dev = in_dev_get(dev);
2189 		struct ip_mc_list *imc;
2190 
2191 		if (in_dev == NULL)
2192 			continue;
2193 
2194 		read_lock(&in_dev->lock);
2195 
2196 		for (imc=in_dev->mc_list; imc; imc=imc->next) {
2197 			struct ip_sf_list *psf;
2198 
2199 			spin_lock_bh(&imc->lock);
2200 			for (psf=imc->sources; psf; psf=psf->sf_next) {
2201 				if (first) {
2202 					len += sprintf(buffer+len, "%3s %6s "
2203 						"%10s %10s %6s %6s\n", "Idx",
2204 						"Device", "MCA", "SRC", "INC",
2205 						"EXC");
2206 					first = 0;
2207 				}
2208 				len += sprintf(buffer+len, "%3d %6.6s 0x%08x "
2209 					"0x%08x %6lu %6lu\n", dev->ifindex,
2210 					dev->name, ntohl(imc->multiaddr),
2211 					ntohl(psf->sf_inaddr),
2212 					psf->sf_count[MCAST_INCLUDE],
2213 					psf->sf_count[MCAST_EXCLUDE]);
2214 				pos=begin+len;
2215 				if(pos<offset)
2216 				{
2217 					len=0;
2218 					begin=pos;
2219 				}
2220 				if(pos>offset+length) {
2221 					spin_unlock_bh(&imc->lock);
2222 					read_unlock(&in_dev->lock);
2223 					in_dev_put(in_dev);
2224 					goto done;
2225 				}
2226 			}
2227 			spin_unlock_bh(&imc->lock);
2228 		}
2229 		read_unlock(&in_dev->lock);
2230 		in_dev_put(in_dev);
2231 	}
2232 done:
2233 	read_unlock(&dev_base_lock);
2234 
2235 	*start=buffer+(offset-begin);
2236 	len-=(offset-begin);
2237 	if(len>length)
2238 		len=length;
2239 	if(len<0)
2240 		len=0;
2241 	return len;
2242 }
2243 
2244