ipmr.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *	IP multicast routing support for mrouted 3.6/3.8
   4 *
   5 *		(c) 1995 Alan Cox, <alan@lxorguk.ukuu.org.uk>
   6 *	  Linux Consultancy and Custom Driver Development
   7 *
   8 *	Fixes:
   9 *	Michael Chastain	:	Incorrect size of copying.
  10 *	Alan Cox		:	Added the cache manager code
  11 *	Alan Cox		:	Fixed the clone/copy bug and device race.
  12 *	Mike McLagan		:	Routing by source
  13 *	Malcolm Beattie		:	Buffer handling fixes.
  14 *	Alexey Kuznetsov	:	Double buffer free and other fixes.
  15 *	SVR Anand		:	Fixed several multicast bugs and problems.
  16 *	Alexey Kuznetsov	:	Status, optimisations and more.
  17 *	Brad Parker		:	Better behaviour on mrouted upcall
  18 *					overflow.
  19 *      Carlos Picoto           :       PIMv1 Support
  20 *	Pavlin Ivanov Radoslavov:	PIMv2 Registers must checksum only PIM header
  21 *					Relax this requirement to work with older peers.
  22 */
  23
  24#include <linux/uaccess.h>
  25#include <linux/types.h>
  26#include <linux/cache.h>
  27#include <linux/capability.h>
  28#include <linux/errno.h>
  29#include <linux/mm.h>
  30#include <linux/kernel.h>
  31#include <linux/fcntl.h>
  32#include <linux/stat.h>
  33#include <linux/socket.h>
  34#include <linux/in.h>
  35#include <linux/inet.h>
  36#include <linux/netdevice.h>
  37#include <linux/inetdevice.h>
  38#include <linux/igmp.h>
  39#include <linux/proc_fs.h>
  40#include <linux/seq_file.h>
  41#include <linux/mroute.h>
  42#include <linux/init.h>
  43#include <linux/if_ether.h>
  44#include <linux/slab.h>
  45#include <net/flow.h>
  46#include <net/net_namespace.h>
  47#include <net/ip.h>
  48#include <net/protocol.h>
  49#include <linux/skbuff.h>
  50#include <net/route.h>
  51#include <net/icmp.h>
  52#include <net/udp.h>
  53#include <net/raw.h>
  54#include <linux/notifier.h>
  55#include <linux/if_arp.h>
  56#include <linux/netfilter_ipv4.h>
  57#include <linux/compat.h>
  58#include <linux/export.h>
  59#include <linux/rhashtable.h>
  60#include <net/ip_tunnels.h>
  61#include <net/checksum.h>
  62#include <net/netlink.h>
  63#include <net/fib_rules.h>
  64#include <linux/netconf.h>
  65#include <net/rtnh.h>
  66#include <net/inet_dscp.h>
  67
  68#include <linux/nospec.h>
  69
  70struct ipmr_rule {
  71	struct fib_rule		common;
  72};
  73
  74struct ipmr_result {
  75	struct mr_table		*mrt;
  76};
  77
  78/* Big lock, protecting vif table, mrt cache and mroute socket state.
  79 * Note that the changes are semaphored via rtnl_lock.
  80 */
  81
  82static DEFINE_SPINLOCK(mrt_lock);
  83
  84static struct net_device *vif_dev_read(const struct vif_device *vif)
  85{
  86	return rcu_dereference(vif->dev);
  87}
  88
  89/* Multicast router control variables */
  90
  91/* Special spinlock for queue of unresolved entries */
  92static DEFINE_SPINLOCK(mfc_unres_lock);
  93
  94/* We return to original Alan's scheme. Hash table of resolved
  95 * entries is changed only in process context and protected
  96 * with weak lock mrt_lock. Queue of unresolved entries is protected
  97 * with strong spinlock mfc_unres_lock.
  98 *
  99 * In this case data path is free of exclusive locks at all.
 100 */
 101
 102static struct kmem_cache *mrt_cachep __ro_after_init;
 103
 104static struct mr_table *ipmr_new_table(struct net *net, u32 id);
 105static void ipmr_free_table(struct mr_table *mrt);
 106
 107static void ip_mr_forward(struct net *net, struct mr_table *mrt,
 108			  struct net_device *dev, struct sk_buff *skb,
 109			  struct mfc_cache *cache, int local);
 110static int ipmr_cache_report(const struct mr_table *mrt,
 111			     struct sk_buff *pkt, vifi_t vifi, int assert);
 112static void mroute_netlink_event(struct mr_table *mrt, struct mfc_cache *mfc,
 113				 int cmd);
 114static void igmpmsg_netlink_event(const struct mr_table *mrt, struct sk_buff *pkt);
 115static void mroute_clean_tables(struct mr_table *mrt, int flags);
 116static void ipmr_expire_process(struct timer_list *t);
 117
 118#ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
 119#define ipmr_for_each_table(mrt, net)					\
 120	list_for_each_entry_rcu(mrt, &net->ipv4.mr_tables, list,	\
 121				lockdep_rtnl_is_held() ||		\
 122				list_empty(&net->ipv4.mr_tables))
 123
 124static struct mr_table *ipmr_mr_table_iter(struct net *net,
 125					   struct mr_table *mrt)
 126{
 127	struct mr_table *ret;
 128
 129	if (!mrt)
 130		ret = list_entry_rcu(net->ipv4.mr_tables.next,
 131				     struct mr_table, list);
 132	else
 133		ret = list_entry_rcu(mrt->list.next,
 134				     struct mr_table, list);
 135
 136	if (&ret->list == &net->ipv4.mr_tables)
 137		return NULL;
 138	return ret;
 139}
 140
 141static struct mr_table *__ipmr_get_table(struct net *net, u32 id)
 142{
 143	struct mr_table *mrt;
 144
 145	ipmr_for_each_table(mrt, net) {
 146		if (mrt->id == id)
 147			return mrt;
 148	}
 149	return NULL;
 150}
 151
 152static struct mr_table *ipmr_get_table(struct net *net, u32 id)
 153{
 154	struct mr_table *mrt;
 155
 156	rcu_read_lock();
 157	mrt = __ipmr_get_table(net, id);
 158	rcu_read_unlock();
 159	return mrt;
 160}
 161
 162static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
 163			   struct mr_table **mrt)
 164{
 165	int err;
 166	struct ipmr_result res;
 167	struct fib_lookup_arg arg = {
 168		.result = &res,
 169		.flags = FIB_LOOKUP_NOREF,
 170	};
 171
 172	/* update flow if oif or iif point to device enslaved to l3mdev */
 173	l3mdev_update_flow(net, flowi4_to_flowi(flp4));
 174
 175	err = fib_rules_lookup(net->ipv4.mr_rules_ops,
 176			       flowi4_to_flowi(flp4), 0, &arg);
 177	if (err < 0)
 178		return err;
 179	*mrt = res.mrt;
 180	return 0;
 181}
 182
 183static int ipmr_rule_action(struct fib_rule *rule, struct flowi *flp,
 184			    int flags, struct fib_lookup_arg *arg)
 185{
 186	struct ipmr_result *res = arg->result;
 187	struct mr_table *mrt;
 188
 189	switch (rule->action) {
 190	case FR_ACT_TO_TBL:
 191		break;
 192	case FR_ACT_UNREACHABLE:
 193		return -ENETUNREACH;
 194	case FR_ACT_PROHIBIT:
 195		return -EACCES;
 196	case FR_ACT_BLACKHOLE:
 197	default:
 198		return -EINVAL;
 199	}
 200
 201	arg->table = fib_rule_get_table(rule, arg);
 202
 203	mrt = __ipmr_get_table(rule->fr_net, arg->table);
 204	if (!mrt)
 205		return -EAGAIN;
 206	res->mrt = mrt;
 207	return 0;
 208}
 209
 210static int ipmr_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 211{
 212	return 1;
 213}
 214
 215static int ipmr_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
 216			       struct fib_rule_hdr *frh, struct nlattr **tb,
 217			       struct netlink_ext_ack *extack)
 218{
 219	return 0;
 220}
 221
 222static int ipmr_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
 223			     struct nlattr **tb)
 224{
 225	return 1;
 226}
 227
 228static int ipmr_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
 229			  struct fib_rule_hdr *frh)
 230{
 231	frh->dst_len = 0;
 232	frh->src_len = 0;
 233	frh->tos     = 0;
 234	return 0;
 235}
 236
 237static const struct fib_rules_ops __net_initconst ipmr_rules_ops_template = {
 238	.family		= RTNL_FAMILY_IPMR,
 239	.rule_size	= sizeof(struct ipmr_rule),
 240	.addr_size	= sizeof(u32),
 241	.action		= ipmr_rule_action,
 242	.match		= ipmr_rule_match,
 243	.configure	= ipmr_rule_configure,
 244	.compare	= ipmr_rule_compare,
 245	.fill		= ipmr_rule_fill,
 246	.nlgroup	= RTNLGRP_IPV4_RULE,
 247	.owner		= THIS_MODULE,
 248};
 249
 250static int __net_init ipmr_rules_init(struct net *net)
 251{
 252	struct fib_rules_ops *ops;
 253	struct mr_table *mrt;
 254	int err;
 255
 256	ops = fib_rules_register(&ipmr_rules_ops_template, net);
 257	if (IS_ERR(ops))
 258		return PTR_ERR(ops);
 259
 260	INIT_LIST_HEAD(&net->ipv4.mr_tables);
 261
 262	mrt = ipmr_new_table(net, RT_TABLE_DEFAULT);
 263	if (IS_ERR(mrt)) {
 264		err = PTR_ERR(mrt);
 265		goto err1;
 266	}
 267
 268	err = fib_default_rule_add(ops, 0x7fff, RT_TABLE_DEFAULT);
 269	if (err < 0)
 270		goto err2;
 271
 272	net->ipv4.mr_rules_ops = ops;
 273	return 0;
 274
 275err2:
 276	rtnl_lock();
 277	ipmr_free_table(mrt);
 278	rtnl_unlock();
 279err1:
 280	fib_rules_unregister(ops);
 281	return err;
 282}
 283
 284static void __net_exit ipmr_rules_exit(struct net *net)
 285{
 286	struct mr_table *mrt, *next;
 287
 288	ASSERT_RTNL();
 289	list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
 290		list_del(&mrt->list);
 291		ipmr_free_table(mrt);
 292	}
 293	fib_rules_unregister(net->ipv4.mr_rules_ops);
 294}
 295
 296static int ipmr_rules_dump(struct net *net, struct notifier_block *nb,
 297			   struct netlink_ext_ack *extack)
 298{
 299	return fib_rules_dump(net, nb, RTNL_FAMILY_IPMR, extack);
 300}
 301
 302static unsigned int ipmr_rules_seq_read(const struct net *net)
 303{
 304	return fib_rules_seq_read(net, RTNL_FAMILY_IPMR);
 305}
 306
 307bool ipmr_rule_default(const struct fib_rule *rule)
 308{
 309	return fib_rule_matchall(rule) && rule->table == RT_TABLE_DEFAULT;
 310}
 311EXPORT_SYMBOL(ipmr_rule_default);
 312#else
 313#define ipmr_for_each_table(mrt, net) \
 314	for (mrt = net->ipv4.mrt; mrt; mrt = NULL)
 315
 316static struct mr_table *ipmr_mr_table_iter(struct net *net,
 317					   struct mr_table *mrt)
 318{
 319	if (!mrt)
 320		return net->ipv4.mrt;
 321	return NULL;
 322}
 323
 324static struct mr_table *ipmr_get_table(struct net *net, u32 id)
 325{
 326	return net->ipv4.mrt;
 327}
 328
 329#define __ipmr_get_table ipmr_get_table
 330
 331static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
 332			   struct mr_table **mrt)
 333{
 334	*mrt = net->ipv4.mrt;
 335	return 0;
 336}
 337
 338static int __net_init ipmr_rules_init(struct net *net)
 339{
 340	struct mr_table *mrt;
 341
 342	mrt = ipmr_new_table(net, RT_TABLE_DEFAULT);
 343	if (IS_ERR(mrt))
 344		return PTR_ERR(mrt);
 345	net->ipv4.mrt = mrt;
 346	return 0;
 347}
 348
 349static void __net_exit ipmr_rules_exit(struct net *net)
 350{
 351	ASSERT_RTNL();
 352	ipmr_free_table(net->ipv4.mrt);
 353	net->ipv4.mrt = NULL;
 354}
 355
 356static int ipmr_rules_dump(struct net *net, struct notifier_block *nb,
 357			   struct netlink_ext_ack *extack)
 358{
 359	return 0;
 360}
 361
 362static unsigned int ipmr_rules_seq_read(const struct net *net)
 363{
 364	return 0;
 365}
 366
 367bool ipmr_rule_default(const struct fib_rule *rule)
 368{
 369	return true;
 370}
 371EXPORT_SYMBOL(ipmr_rule_default);
 372#endif
 373
 374static inline int ipmr_hash_cmp(struct rhashtable_compare_arg *arg,
 375				const void *ptr)
 376{
 377	const struct mfc_cache_cmp_arg *cmparg = arg->key;
 378	const struct mfc_cache *c = ptr;
 379
 380	return cmparg->mfc_mcastgrp != c->mfc_mcastgrp ||
 381	       cmparg->mfc_origin != c->mfc_origin;
 382}
 383
 384static const struct rhashtable_params ipmr_rht_params = {
 385	.head_offset = offsetof(struct mr_mfc, mnode),
 386	.key_offset = offsetof(struct mfc_cache, cmparg),
 387	.key_len = sizeof(struct mfc_cache_cmp_arg),
 388	.nelem_hint = 3,
 389	.obj_cmpfn = ipmr_hash_cmp,
 390	.automatic_shrinking = true,
 391};
 392
 393static void ipmr_new_table_set(struct mr_table *mrt,
 394			       struct net *net)
 395{
 396#ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
 397	list_add_tail_rcu(&mrt->list, &net->ipv4.mr_tables);
 398#endif
 399}
 400
 401static struct mfc_cache_cmp_arg ipmr_mr_table_ops_cmparg_any = {
 402	.mfc_mcastgrp = htonl(INADDR_ANY),
 403	.mfc_origin = htonl(INADDR_ANY),
 404};
 405
 406static struct mr_table_ops ipmr_mr_table_ops = {
 407	.rht_params = &ipmr_rht_params,
 408	.cmparg_any = &ipmr_mr_table_ops_cmparg_any,
 409};
 410
 411static struct mr_table *ipmr_new_table(struct net *net, u32 id)
 412{
 413	struct mr_table *mrt;
 414
 415	/* "pimreg%u" should not exceed 16 bytes (IFNAMSIZ) */
 416	if (id != RT_TABLE_DEFAULT && id >= 1000000000)
 417		return ERR_PTR(-EINVAL);
 418
 419	mrt = __ipmr_get_table(net, id);
 420	if (mrt)
 421		return mrt;
 422
 423	return mr_table_alloc(net, id, &ipmr_mr_table_ops,
 424			      ipmr_expire_process, ipmr_new_table_set);
 425}
 426
 427static void ipmr_free_table(struct mr_table *mrt)
 428{
 429	struct net *net = read_pnet(&mrt->net);
 430
 431	WARN_ON_ONCE(!mr_can_free_table(net));
 432
 433	timer_shutdown_sync(&mrt->ipmr_expire_timer);
 434	mroute_clean_tables(mrt, MRT_FLUSH_VIFS | MRT_FLUSH_VIFS_STATIC |
 435				 MRT_FLUSH_MFC | MRT_FLUSH_MFC_STATIC);
 436	rhltable_destroy(&mrt->mfc_hash);
 437	kfree(mrt);
 438}
 439
 440/* Service routines creating virtual interfaces: DVMRP tunnels and PIMREG */
 441
 442/* Initialize ipmr pimreg/tunnel in_device */
 443static bool ipmr_init_vif_indev(const struct net_device *dev)
 444{
 445	struct in_device *in_dev;
 446
 447	ASSERT_RTNL();
 448
 449	in_dev = __in_dev_get_rtnl(dev);
 450	if (!in_dev)
 451		return false;
 452	ipv4_devconf_setall(in_dev);
 453	neigh_parms_data_state_setall(in_dev->arp_parms);
 454	IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
 455
 456	return true;
 457}
 458
 459static struct net_device *ipmr_new_tunnel(struct net *net, struct vifctl *v)
 460{
 461	struct net_device *tunnel_dev, *new_dev;
 462	struct ip_tunnel_parm_kern p = { };
 463	int err;
 464
 465	tunnel_dev = __dev_get_by_name(net, "tunl0");
 466	if (!tunnel_dev)
 467		goto out;
 468
 469	p.iph.daddr = v->vifc_rmt_addr.s_addr;
 470	p.iph.saddr = v->vifc_lcl_addr.s_addr;
 471	p.iph.version = 4;
 472	p.iph.ihl = 5;
 473	p.iph.protocol = IPPROTO_IPIP;
 474	sprintf(p.name, "dvmrp%d", v->vifc_vifi);
 475
 476	if (!tunnel_dev->netdev_ops->ndo_tunnel_ctl)
 477		goto out;
 478	err = tunnel_dev->netdev_ops->ndo_tunnel_ctl(tunnel_dev, &p,
 479			SIOCADDTUNNEL);
 480	if (err)
 481		goto out;
 482
 483	new_dev = __dev_get_by_name(net, p.name);
 484	if (!new_dev)
 485		goto out;
 486
 487	new_dev->flags |= IFF_MULTICAST;
 488	if (!ipmr_init_vif_indev(new_dev))
 489		goto out_unregister;
 490	if (dev_open(new_dev, NULL))
 491		goto out_unregister;
 492	dev_hold(new_dev);
 493	err = dev_set_allmulti(new_dev, 1);
 494	if (err) {
 495		dev_close(new_dev);
 496		tunnel_dev->netdev_ops->ndo_tunnel_ctl(tunnel_dev, &p,
 497				SIOCDELTUNNEL);
 498		dev_put(new_dev);
 499		new_dev = ERR_PTR(err);
 500	}
 501	return new_dev;
 502
 503out_unregister:
 504	unregister_netdevice(new_dev);
 505out:
 506	return ERR_PTR(-ENOBUFS);
 507}
 508
 509#if defined(CONFIG_IP_PIMSM_V1) || defined(CONFIG_IP_PIMSM_V2)
 510static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
 511{
 512	struct net *net = dev_net(dev);
 513	struct mr_table *mrt;
 514	struct flowi4 fl4 = {
 515		.flowi4_oif	= dev->ifindex,
 516		.flowi4_iif	= skb->skb_iif ? : LOOPBACK_IFINDEX,
 517		.flowi4_mark	= skb->mark,
 518	};
 519	int err;
 520
 521	err = ipmr_fib_lookup(net, &fl4, &mrt);
 522	if (err < 0) {
 523		kfree_skb(skb);
 524		return err;
 525	}
 526
 527	DEV_STATS_ADD(dev, tx_bytes, skb->len);
 528	DEV_STATS_INC(dev, tx_packets);
 529	rcu_read_lock();
 530
 531	/* Pairs with WRITE_ONCE() in vif_add() and vif_delete() */
 532	ipmr_cache_report(mrt, skb, READ_ONCE(mrt->mroute_reg_vif_num),
 533			  IGMPMSG_WHOLEPKT);
 534
 535	rcu_read_unlock();
 536	kfree_skb(skb);
 537	return NETDEV_TX_OK;
 538}
 539
 540static int reg_vif_get_iflink(const struct net_device *dev)
 541{
 542	return 0;
 543}
 544
 545static const struct net_device_ops reg_vif_netdev_ops = {
 546	.ndo_start_xmit	= reg_vif_xmit,
 547	.ndo_get_iflink = reg_vif_get_iflink,
 548};
 549
 550static void reg_vif_setup(struct net_device *dev)
 551{
 552	dev->type		= ARPHRD_PIMREG;
 553	dev->mtu		= ETH_DATA_LEN - sizeof(struct iphdr) - 8;
 554	dev->flags		= IFF_NOARP;
 555	dev->netdev_ops		= &reg_vif_netdev_ops;
 556	dev->needs_free_netdev	= true;
 557	dev->netns_immutable	= true;
 558}
 559
 560static struct net_device *ipmr_reg_vif(struct net *net, struct mr_table *mrt)
 561{
 562	struct net_device *dev;
 563	char name[IFNAMSIZ];
 564
 565	if (mrt->id == RT_TABLE_DEFAULT)
 566		sprintf(name, "pimreg");
 567	else
 568		sprintf(name, "pimreg%u", mrt->id);
 569
 570	dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, reg_vif_setup);
 571
 572	if (!dev)
 573		return NULL;
 574
 575	dev_net_set(dev, net);
 576
 577	if (register_netdevice(dev)) {
 578		free_netdev(dev);
 579		return NULL;
 580	}
 581
 582	if (!ipmr_init_vif_indev(dev))
 583		goto failure;
 584	if (dev_open(dev, NULL))
 585		goto failure;
 586
 587	dev_hold(dev);
 588
 589	return dev;
 590
 591failure:
 592	unregister_netdevice(dev);
 593	return NULL;
 594}
 595
 596/* called with rcu_read_lock() */
 597static int __pim_rcv(struct mr_table *mrt, struct sk_buff *skb,
 598		     unsigned int pimlen)
 599{
 600	struct net_device *reg_dev = NULL;
 601	struct iphdr *encap;
 602	int vif_num;
 603
 604	encap = (struct iphdr *)(skb_transport_header(skb) + pimlen);
 605	/* Check that:
 606	 * a. packet is really sent to a multicast group
 607	 * b. packet is not a NULL-REGISTER
 608	 * c. packet is not truncated
 609	 */
 610	if (!ipv4_is_multicast(encap->daddr) ||
 611	    encap->tot_len == 0 ||
 612	    ntohs(encap->tot_len) + pimlen > skb->len)
 613		return 1;
 614
 615	/* Pairs with WRITE_ONCE() in vif_add()/vid_delete() */
 616	vif_num = READ_ONCE(mrt->mroute_reg_vif_num);
 617	if (vif_num >= 0)
 618		reg_dev = vif_dev_read(&mrt->vif_table[vif_num]);
 619	if (!reg_dev)
 620		return 1;
 621
 622	skb->mac_header = skb->network_header;
 623	skb_pull(skb, (u8 *)encap - skb->data);
 624	skb_reset_network_header(skb);
 625	skb->protocol = htons(ETH_P_IP);
 626	skb->ip_summed = CHECKSUM_NONE;
 627
 628	skb_tunnel_rx(skb, reg_dev, dev_net(reg_dev));
 629
 630	netif_rx(skb);
 631
 632	return NET_RX_SUCCESS;
 633}
 634#else
 635static struct net_device *ipmr_reg_vif(struct net *net, struct mr_table *mrt)
 636{
 637	return NULL;
 638}
 639#endif
 640
 641static int call_ipmr_vif_entry_notifiers(struct net *net,
 642					 enum fib_event_type event_type,
 643					 struct vif_device *vif,
 644					 struct net_device *vif_dev,
 645					 vifi_t vif_index, u32 tb_id)
 646{
 647	return mr_call_vif_notifiers(net, RTNL_FAMILY_IPMR, event_type,
 648				     vif, vif_dev, vif_index, tb_id,
 649				     &net->ipv4.ipmr_seq);
 650}
 651
 652static int call_ipmr_mfc_entry_notifiers(struct net *net,
 653					 enum fib_event_type event_type,
 654					 struct mfc_cache *mfc, u32 tb_id)
 655{
 656	return mr_call_mfc_notifiers(net, RTNL_FAMILY_IPMR, event_type,
 657				     &mfc->_c, tb_id, &net->ipv4.ipmr_seq);
 658}
 659
 660/**
 661 *	vif_delete - Delete a VIF entry
 662 *	@mrt: Table to delete from
 663 *	@vifi: VIF identifier to delete
 664 *	@notify: Set to 1, if the caller is a notifier_call
 665 *	@head: if unregistering the VIF, place it on this queue
 666 */
 667static int vif_delete(struct mr_table *mrt, int vifi, int notify,
 668		      struct list_head *head)
 669{
 670	struct net *net = read_pnet(&mrt->net);
 671	struct vif_device *v;
 672	struct net_device *dev;
 673	struct in_device *in_dev;
 674
 675	if (vifi < 0 || vifi >= mrt->maxvif)
 676		return -EADDRNOTAVAIL;
 677
 678	v = &mrt->vif_table[vifi];
 679
 680	dev = rtnl_dereference(v->dev);
 681	if (!dev)
 682		return -EADDRNOTAVAIL;
 683
 684	spin_lock(&mrt_lock);
 685	call_ipmr_vif_entry_notifiers(net, FIB_EVENT_VIF_DEL, v, dev,
 686				      vifi, mrt->id);
 687	RCU_INIT_POINTER(v->dev, NULL);
 688
 689	if (vifi == mrt->mroute_reg_vif_num) {
 690		/* Pairs with READ_ONCE() in ipmr_cache_report() and reg_vif_xmit() */
 691		WRITE_ONCE(mrt->mroute_reg_vif_num, -1);
 692	}
 693	if (vifi + 1 == mrt->maxvif) {
 694		int tmp;
 695
 696		for (tmp = vifi - 1; tmp >= 0; tmp--) {
 697			if (VIF_EXISTS(mrt, tmp))
 698				break;
 699		}
 700		WRITE_ONCE(mrt->maxvif, tmp + 1);
 701	}
 702
 703	spin_unlock(&mrt_lock);
 704
 705	dev_set_allmulti(dev, -1);
 706
 707	in_dev = __in_dev_get_rtnl(dev);
 708	if (in_dev) {
 709		IPV4_DEVCONF(in_dev->cnf, MC_FORWARDING)--;
 710		inet_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF,
 711					    NETCONFA_MC_FORWARDING,
 712					    dev->ifindex, &in_dev->cnf);
 713		ip_rt_multicast_event(in_dev);
 714	}
 715
 716	if (v->flags & (VIFF_TUNNEL | VIFF_REGISTER) && !notify)
 717		unregister_netdevice_queue(dev, head);
 718
 719	netdev_put(dev, &v->dev_tracker);
 720	return 0;
 721}
 722
 723static void ipmr_cache_free_rcu(struct rcu_head *head)
 724{
 725	struct mr_mfc *c = container_of(head, struct mr_mfc, rcu);
 726
 727	kmem_cache_free(mrt_cachep, (struct mfc_cache *)c);
 728}
 729
 730static void ipmr_cache_free(struct mfc_cache *c)
 731{
 732	call_rcu(&c->_c.rcu, ipmr_cache_free_rcu);
 733}
 734
 735/* Destroy an unresolved cache entry, killing queued skbs
 736 * and reporting error to netlink readers.
 737 */
 738static void ipmr_destroy_unres(struct mr_table *mrt, struct mfc_cache *c)
 739{
 740	struct net *net = read_pnet(&mrt->net);
 741	struct sk_buff *skb;
 742	struct nlmsgerr *e;
 743
 744	atomic_dec(&mrt->cache_resolve_queue_len);
 745
 746	while ((skb = skb_dequeue(&c->_c.mfc_un.unres.unresolved))) {
 747		if (ip_hdr(skb)->version == 0) {
 748			struct nlmsghdr *nlh = skb_pull(skb,
 749							sizeof(struct iphdr));
 750			nlh->nlmsg_type = NLMSG_ERROR;
 751			nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr));
 752			skb_trim(skb, nlh->nlmsg_len);
 753			e = nlmsg_data(nlh);
 754			e->error = -ETIMEDOUT;
 755			memset(&e->msg, 0, sizeof(e->msg));
 756
 757			rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
 758		} else {
 759			kfree_skb(skb);
 760		}
 761	}
 762
 763	ipmr_cache_free(c);
 764}
 765
 766/* Timer process for the unresolved queue. */
 767static void ipmr_expire_process(struct timer_list *t)
 768{
 769	struct mr_table *mrt = timer_container_of(mrt, t, ipmr_expire_timer);
 770	struct mr_mfc *c, *next;
 771	unsigned long expires;
 772	unsigned long now;
 773
 774	if (!spin_trylock(&mfc_unres_lock)) {
 775		mod_timer(&mrt->ipmr_expire_timer, jiffies+HZ/10);
 776		return;
 777	}
 778
 779	if (list_empty(&mrt->mfc_unres_queue))
 780		goto out;
 781
 782	now = jiffies;
 783	expires = 10*HZ;
 784
 785	list_for_each_entry_safe(c, next, &mrt->mfc_unres_queue, list) {
 786		if (time_after(c->mfc_un.unres.expires, now)) {
 787			unsigned long interval = c->mfc_un.unres.expires - now;
 788			if (interval < expires)
 789				expires = interval;
 790			continue;
 791		}
 792
 793		list_del(&c->list);
 794		mroute_netlink_event(mrt, (struct mfc_cache *)c, RTM_DELROUTE);
 795		ipmr_destroy_unres(mrt, (struct mfc_cache *)c);
 796	}
 797
 798	if (!list_empty(&mrt->mfc_unres_queue))
 799		mod_timer(&mrt->ipmr_expire_timer, jiffies + expires);
 800
 801out:
 802	spin_unlock(&mfc_unres_lock);
 803}
 804
 805/* Fill oifs list. It is called under locked mrt_lock. */
 806static void ipmr_update_thresholds(struct mr_table *mrt, struct mr_mfc *cache,
 807				   unsigned char *ttls)
 808{
 809	int vifi;
 810
 811	cache->mfc_un.res.minvif = MAXVIFS;
 812	cache->mfc_un.res.maxvif = 0;
 813	memset(cache->mfc_un.res.ttls, 255, MAXVIFS);
 814
 815	for (vifi = 0; vifi < mrt->maxvif; vifi++) {
 816		if (VIF_EXISTS(mrt, vifi) &&
 817		    ttls[vifi] && ttls[vifi] < 255) {
 818			cache->mfc_un.res.ttls[vifi] = ttls[vifi];
 819			if (cache->mfc_un.res.minvif > vifi)
 820				cache->mfc_un.res.minvif = vifi;
 821			if (cache->mfc_un.res.maxvif <= vifi)
 822				cache->mfc_un.res.maxvif = vifi + 1;
 823		}
 824	}
 825	WRITE_ONCE(cache->mfc_un.res.lastuse, jiffies);
 826}
 827
 828static int vif_add(struct net *net, struct mr_table *mrt,
 829		   struct vifctl *vifc, int mrtsock)
 830{
 831	struct netdev_phys_item_id ppid = { };
 832	int vifi = vifc->vifc_vifi;
 833	struct vif_device *v = &mrt->vif_table[vifi];
 834	struct net_device *dev;
 835	struct in_device *in_dev;
 836	int err;
 837
 838	/* Is vif busy ? */
 839	if (VIF_EXISTS(mrt, vifi))
 840		return -EADDRINUSE;
 841
 842	switch (vifc->vifc_flags) {
 843	case VIFF_REGISTER:
 844		if (!ipmr_pimsm_enabled())
 845			return -EINVAL;
 846		/* Special Purpose VIF in PIM
 847		 * All the packets will be sent to the daemon
 848		 */
 849		if (mrt->mroute_reg_vif_num >= 0)
 850			return -EADDRINUSE;
 851		dev = ipmr_reg_vif(net, mrt);
 852		if (!dev)
 853			return -ENOBUFS;
 854		err = dev_set_allmulti(dev, 1);
 855		if (err) {
 856			unregister_netdevice(dev);
 857			dev_put(dev);
 858			return err;
 859		}
 860		break;
 861	case VIFF_TUNNEL:
 862		dev = ipmr_new_tunnel(net, vifc);
 863		if (IS_ERR(dev))
 864			return PTR_ERR(dev);
 865		break;
 866	case VIFF_USE_IFINDEX:
 867	case 0:
 868		if (vifc->vifc_flags == VIFF_USE_IFINDEX) {
 869			dev = dev_get_by_index(net, vifc->vifc_lcl_ifindex);
 870			if (dev && !__in_dev_get_rtnl(dev)) {
 871				dev_put(dev);
 872				return -EADDRNOTAVAIL;
 873			}
 874		} else {
 875			dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
 876		}
 877		if (!dev)
 878			return -EADDRNOTAVAIL;
 879		err = dev_set_allmulti(dev, 1);
 880		if (err) {
 881			dev_put(dev);
 882			return err;
 883		}
 884		break;
 885	default:
 886		return -EINVAL;
 887	}
 888
 889	in_dev = __in_dev_get_rtnl(dev);
 890	if (!in_dev) {
 891		dev_put(dev);
 892		return -EADDRNOTAVAIL;
 893	}
 894	IPV4_DEVCONF(in_dev->cnf, MC_FORWARDING)++;
 895	inet_netconf_notify_devconf(net, RTM_NEWNETCONF, NETCONFA_MC_FORWARDING,
 896				    dev->ifindex, &in_dev->cnf);
 897	ip_rt_multicast_event(in_dev);
 898
 899	/* Fill in the VIF structures */
 900	vif_device_init(v, dev, vifc->vifc_rate_limit,
 901			vifc->vifc_threshold,
 902			vifc->vifc_flags | (!mrtsock ? VIFF_STATIC : 0),
 903			(VIFF_TUNNEL | VIFF_REGISTER));
 904
 905	err = netif_get_port_parent_id(dev, &ppid, true);
 906	if (err == 0) {
 907		memcpy(v->dev_parent_id.id, ppid.id, ppid.id_len);
 908		v->dev_parent_id.id_len = ppid.id_len;
 909	} else {
 910		v->dev_parent_id.id_len = 0;
 911	}
 912
 913	v->local = vifc->vifc_lcl_addr.s_addr;
 914	v->remote = vifc->vifc_rmt_addr.s_addr;
 915
 916	/* And finish update writing critical data */
 917	spin_lock(&mrt_lock);
 918	rcu_assign_pointer(v->dev, dev);
 919	netdev_tracker_alloc(dev, &v->dev_tracker, GFP_ATOMIC);
 920	if (v->flags & VIFF_REGISTER) {
 921		/* Pairs with READ_ONCE() in ipmr_cache_report() and reg_vif_xmit() */
 922		WRITE_ONCE(mrt->mroute_reg_vif_num, vifi);
 923	}
 924	if (vifi+1 > mrt->maxvif)
 925		WRITE_ONCE(mrt->maxvif, vifi + 1);
 926	spin_unlock(&mrt_lock);
 927	call_ipmr_vif_entry_notifiers(net, FIB_EVENT_VIF_ADD, v, dev,
 928				      vifi, mrt->id);
 929	return 0;
 930}
 931
 932/* called with rcu_read_lock() */
 933static struct mfc_cache *ipmr_cache_find(struct mr_table *mrt,
 934					 __be32 origin,
 935					 __be32 mcastgrp)
 936{
 937	struct mfc_cache_cmp_arg arg = {
 938			.mfc_mcastgrp = mcastgrp,
 939			.mfc_origin = origin
 940	};
 941
 942	return mr_mfc_find(mrt, &arg);
 943}
 944
 945/* Look for a (*,G) entry */
 946static struct mfc_cache *ipmr_cache_find_any(struct mr_table *mrt,
 947					     __be32 mcastgrp, int vifi)
 948{
 949	struct mfc_cache_cmp_arg arg = {
 950			.mfc_mcastgrp = mcastgrp,
 951			.mfc_origin = htonl(INADDR_ANY)
 952	};
 953
 954	if (mcastgrp == htonl(INADDR_ANY))
 955		return mr_mfc_find_any_parent(mrt, vifi);
 956	return mr_mfc_find_any(mrt, vifi, &arg);
 957}
 958
 959/* Look for a (S,G,iif) entry if parent != -1 */
 960static struct mfc_cache *ipmr_cache_find_parent(struct mr_table *mrt,
 961						__be32 origin, __be32 mcastgrp,
 962						int parent)
 963{
 964	struct mfc_cache_cmp_arg arg = {
 965			.mfc_mcastgrp = mcastgrp,
 966			.mfc_origin = origin,
 967	};
 968
 969	return mr_mfc_find_parent(mrt, &arg, parent);
 970}
 971
 972/* Allocate a multicast cache entry */
 973static struct mfc_cache *ipmr_cache_alloc(void)
 974{
 975	struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
 976
 977	if (c) {
 978		c->_c.mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
 979		c->_c.mfc_un.res.minvif = MAXVIFS;
 980		c->_c.free = ipmr_cache_free_rcu;
 981		refcount_set(&c->_c.mfc_un.res.refcount, 1);
 982	}
 983	return c;
 984}
 985
 986static struct mfc_cache *ipmr_cache_alloc_unres(void)
 987{
 988	struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_ATOMIC);
 989
 990	if (c) {
 991		skb_queue_head_init(&c->_c.mfc_un.unres.unresolved);
 992		c->_c.mfc_un.unres.expires = jiffies + 10 * HZ;
 993	}
 994	return c;
 995}
 996
 997/* A cache entry has gone into a resolved state from queued */
 998static void ipmr_cache_resolve(struct net *net, struct mr_table *mrt,
 999			       struct mfc_cache *uc, struct mfc_cache *c)
1000{
1001	struct sk_buff *skb;
1002	struct nlmsgerr *e;
1003
1004	/* Play the pending entries through our router */
1005	while ((skb = __skb_dequeue(&uc->_c.mfc_un.unres.unresolved))) {
1006		if (ip_hdr(skb)->version == 0) {
1007			struct nlmsghdr *nlh = skb_pull(skb,
1008							sizeof(struct iphdr));
1009
1010			if (mr_fill_mroute(mrt, skb, &c->_c,
1011					   nlmsg_data(nlh)) > 0) {
1012				nlh->nlmsg_len = skb_tail_pointer(skb) -
1013						 (u8 *)nlh;
1014			} else {
1015				nlh->nlmsg_type = NLMSG_ERROR;
1016				nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr));
1017				skb_trim(skb, nlh->nlmsg_len);
1018				e = nlmsg_data(nlh);
1019				e->error = -EMSGSIZE;
1020				memset(&e->msg, 0, sizeof(e->msg));
1021			}
1022
1023			rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
1024		} else {
1025			rcu_read_lock();
1026			ip_mr_forward(net, mrt, skb->dev, skb, c, 0);
1027			rcu_read_unlock();
1028		}
1029	}
1030}
1031
1032/* Bounce a cache query up to mrouted and netlink.
1033 *
1034 * Called under rcu_read_lock().
1035 */
1036static int ipmr_cache_report(const struct mr_table *mrt,
1037			     struct sk_buff *pkt, vifi_t vifi, int assert)
1038{
1039	const int ihl = ip_hdrlen(pkt);
1040	struct sock *mroute_sk;
1041	struct igmphdr *igmp;
1042	struct igmpmsg *msg;
1043	struct sk_buff *skb;
1044	int ret;
1045
1046	mroute_sk = rcu_dereference(mrt->mroute_sk);
1047	if (!mroute_sk)
1048		return -EINVAL;
1049
1050	if (assert == IGMPMSG_WHOLEPKT || assert == IGMPMSG_WRVIFWHOLE)
1051		skb = skb_realloc_headroom(pkt, sizeof(struct iphdr));
1052	else
1053		skb = alloc_skb(128, GFP_ATOMIC);
1054
1055	if (!skb)
1056		return -ENOBUFS;
1057
1058	if (assert == IGMPMSG_WHOLEPKT || assert == IGMPMSG_WRVIFWHOLE) {
1059		/* Ugly, but we have no choice with this interface.
1060		 * Duplicate old header, fix ihl, length etc.
1061		 * And all this only to mangle msg->im_msgtype and
1062		 * to set msg->im_mbz to "mbz" :-)
1063		 */
1064		skb_push(skb, sizeof(struct iphdr));
1065		skb_reset_network_header(skb);
1066		skb_reset_transport_header(skb);
1067		msg = (struct igmpmsg *)skb_network_header(skb);
1068		memcpy(msg, skb_network_header(pkt), sizeof(struct iphdr));
1069		msg->im_msgtype = assert;
1070		msg->im_mbz = 0;
1071		if (assert == IGMPMSG_WRVIFWHOLE) {
1072			msg->im_vif = vifi;
1073			msg->im_vif_hi = vifi >> 8;
1074		} else {
1075			/* Pairs with WRITE_ONCE() in vif_add() and vif_delete() */
1076			int vif_num = READ_ONCE(mrt->mroute_reg_vif_num);
1077
1078			msg->im_vif = vif_num;
1079			msg->im_vif_hi = vif_num >> 8;
1080		}
1081		ip_hdr(skb)->ihl = sizeof(struct iphdr) >> 2;
1082		ip_hdr(skb)->tot_len = htons(ntohs(ip_hdr(pkt)->tot_len) +
1083					     sizeof(struct iphdr));
1084	} else {
1085		/* Copy the IP header */
1086		skb_set_network_header(skb, skb->len);
1087		skb_put(skb, ihl);
1088		skb_copy_to_linear_data(skb, pkt->data, ihl);
1089		/* Flag to the kernel this is a route add */
1090		ip_hdr(skb)->protocol = 0;
1091		msg = (struct igmpmsg *)skb_network_header(skb);
1092		msg->im_vif = vifi;
1093		msg->im_vif_hi = vifi >> 8;
1094		ipv4_pktinfo_prepare(mroute_sk, pkt, false);
1095		memcpy(skb->cb, pkt->cb, sizeof(skb->cb));
1096		/* Add our header */
1097		igmp = skb_put(skb, sizeof(struct igmphdr));
1098		igmp->type = assert;
1099		msg->im_msgtype = assert;
1100		igmp->code = 0;
1101		ip_hdr(skb)->tot_len = htons(skb->len);	/* Fix the length */
1102		skb->transport_header = skb->network_header;
1103	}
1104
1105	igmpmsg_netlink_event(mrt, skb);
1106
1107	/* Deliver to mrouted */
1108	ret = sock_queue_rcv_skb(mroute_sk, skb);
1109
1110	if (ret < 0) {
1111		net_warn_ratelimited("mroute: pending queue full, dropping entries\n");
1112		kfree_skb(skb);
1113	}
1114
1115	return ret;
1116}
1117
1118/* Queue a packet for resolution. It gets locked cache entry! */
1119/* Called under rcu_read_lock() */
1120static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
1121				 struct sk_buff *skb, struct net_device *dev)
1122{
1123	const struct iphdr *iph = ip_hdr(skb);
1124	struct mfc_cache *c;
1125	bool found = false;
1126	int err;
1127
1128	spin_lock_bh(&mfc_unres_lock);
1129	list_for_each_entry(c, &mrt->mfc_unres_queue, _c.list) {
1130		if (c->mfc_mcastgrp == iph->daddr &&
1131		    c->mfc_origin == iph->saddr) {
1132			found = true;
1133			break;
1134		}
1135	}
1136
1137	if (!found) {
1138		/* Create a new entry if allowable */
1139		c = ipmr_cache_alloc_unres();
1140		if (!c) {
1141			spin_unlock_bh(&mfc_unres_lock);
1142
1143			kfree_skb(skb);
1144			return -ENOBUFS;
1145		}
1146
1147		/* Fill in the new cache entry */
1148		c->_c.mfc_parent = -1;
1149		c->mfc_origin	= iph->saddr;
1150		c->mfc_mcastgrp	= iph->daddr;
1151
1152		/* Reflect first query at mrouted. */
1153		err = ipmr_cache_report(mrt, skb, vifi, IGMPMSG_NOCACHE);
1154
1155		if (err < 0) {
1156			/* If the report failed throw the cache entry
1157			   out - Brad Parker
1158			 */
1159			spin_unlock_bh(&mfc_unres_lock);
1160
1161			ipmr_cache_free(c);
1162			kfree_skb(skb);
1163			return err;
1164		}
1165
1166		atomic_inc(&mrt->cache_resolve_queue_len);
1167		list_add(&c->_c.list, &mrt->mfc_unres_queue);
1168		mroute_netlink_event(mrt, c, RTM_NEWROUTE);
1169
1170		if (atomic_read(&mrt->cache_resolve_queue_len) == 1)
1171			mod_timer(&mrt->ipmr_expire_timer,
1172				  c->_c.mfc_un.unres.expires);
1173	}
1174
1175	/* See if we can append the packet */
1176	if (c->_c.mfc_un.unres.unresolved.qlen > 3) {
1177		kfree_skb(skb);
1178		err = -ENOBUFS;
1179	} else {
1180		if (dev) {
1181			skb->dev = dev;
1182			skb->skb_iif = dev->ifindex;
1183		}
1184		skb_queue_tail(&c->_c.mfc_un.unres.unresolved, skb);
1185		err = 0;
1186	}
1187
1188	spin_unlock_bh(&mfc_unres_lock);
1189	return err;
1190}
1191
1192/* MFC cache manipulation by user space mroute daemon */
1193
1194static int ipmr_mfc_delete(struct mr_table *mrt, struct mfcctl *mfc, int parent)
1195{
1196	struct net *net = read_pnet(&mrt->net);
1197	struct mfc_cache *c;
1198
1199	/* The entries are added/deleted only under RTNL */
1200	rcu_read_lock();
1201	c = ipmr_cache_find_parent(mrt, mfc->mfcc_origin.s_addr,
1202				   mfc->mfcc_mcastgrp.s_addr, parent);
1203	rcu_read_unlock();
1204	if (!c)
1205		return -ENOENT;
1206	rhltable_remove(&mrt->mfc_hash, &c->_c.mnode, ipmr_rht_params);
1207	list_del_rcu(&c->_c.list);
1208	call_ipmr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, c, mrt->id);
1209	mroute_netlink_event(mrt, c, RTM_DELROUTE);
1210	mr_cache_put(&c->_c);
1211
1212	return 0;
1213}
1214
1215static int ipmr_mfc_add(struct net *net, struct mr_table *mrt,
1216			struct mfcctl *mfc, int mrtsock, int parent)
1217{
1218	struct mfc_cache *uc, *c;
1219	struct mr_mfc *_uc;
1220	bool found;
1221	int ret;
1222
1223	if (mfc->mfcc_parent >= MAXVIFS)
1224		return -ENFILE;
1225
1226	/* The entries are added/deleted only under RTNL */
1227	rcu_read_lock();
1228	c = ipmr_cache_find_parent(mrt, mfc->mfcc_origin.s_addr,
1229				   mfc->mfcc_mcastgrp.s_addr, parent);
1230	rcu_read_unlock();
1231	if (c) {
1232		spin_lock(&mrt_lock);
1233		c->_c.mfc_parent = mfc->mfcc_parent;
1234		ipmr_update_thresholds(mrt, &c->_c, mfc->mfcc_ttls);
1235		if (!mrtsock)
1236			c->_c.mfc_flags |= MFC_STATIC;
1237		spin_unlock(&mrt_lock);
1238		call_ipmr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_REPLACE, c,
1239					      mrt->id);
1240		mroute_netlink_event(mrt, c, RTM_NEWROUTE);
1241		return 0;
1242	}
1243
1244	if (mfc->mfcc_mcastgrp.s_addr != htonl(INADDR_ANY) &&
1245	    !ipv4_is_multicast(mfc->mfcc_mcastgrp.s_addr))
1246		return -EINVAL;
1247
1248	c = ipmr_cache_alloc();
1249	if (!c)
1250		return -ENOMEM;
1251
1252	c->mfc_origin = mfc->mfcc_origin.s_addr;
1253	c->mfc_mcastgrp = mfc->mfcc_mcastgrp.s_addr;
1254	c->_c.mfc_parent = mfc->mfcc_parent;
1255	ipmr_update_thresholds(mrt, &c->_c, mfc->mfcc_ttls);
1256	if (!mrtsock)
1257		c->_c.mfc_flags |= MFC_STATIC;
1258
1259	ret = rhltable_insert_key(&mrt->mfc_hash, &c->cmparg, &c->_c.mnode,
1260				  ipmr_rht_params);
1261	if (ret) {
1262		pr_err("ipmr: rhtable insert error %d\n", ret);
1263		ipmr_cache_free(c);
1264		return ret;
1265	}
1266	list_add_tail_rcu(&c->_c.list, &mrt->mfc_cache_list);
1267	/* Check to see if we resolved a queued list. If so we
1268	 * need to send on the frames and tidy up.
1269	 */
1270	found = false;
1271	spin_lock_bh(&mfc_unres_lock);
1272	list_for_each_entry(_uc, &mrt->mfc_unres_queue, list) {
1273		uc = (struct mfc_cache *)_uc;
1274		if (uc->mfc_origin == c->mfc_origin &&
1275		    uc->mfc_mcastgrp == c->mfc_mcastgrp) {
1276			list_del(&_uc->list);
1277			atomic_dec(&mrt->cache_resolve_queue_len);
1278			found = true;
1279			break;
1280		}
1281	}
1282	if (list_empty(&mrt->mfc_unres_queue))
1283		timer_delete(&mrt->ipmr_expire_timer);
1284	spin_unlock_bh(&mfc_unres_lock);
1285
1286	if (found) {
1287		ipmr_cache_resolve(net, mrt, uc, c);
1288		ipmr_cache_free(uc);
1289	}
1290	call_ipmr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_ADD, c, mrt->id);
1291	mroute_netlink_event(mrt, c, RTM_NEWROUTE);
1292	return 0;
1293}
1294
1295/* Close the multicast socket, and clear the vif tables etc */
1296static void mroute_clean_tables(struct mr_table *mrt, int flags)
1297{
1298	struct net *net = read_pnet(&mrt->net);
1299	struct mr_mfc *c, *tmp;
1300	struct mfc_cache *cache;
1301	LIST_HEAD(list);
1302	int i;
1303
1304	/* Shut down all active vif entries */
1305	if (flags & (MRT_FLUSH_VIFS | MRT_FLUSH_VIFS_STATIC)) {
1306		for (i = 0; i < mrt->maxvif; i++) {
1307			if (((mrt->vif_table[i].flags & VIFF_STATIC) &&
1308			     !(flags & MRT_FLUSH_VIFS_STATIC)) ||
1309			    (!(mrt->vif_table[i].flags & VIFF_STATIC) && !(flags & MRT_FLUSH_VIFS)))
1310				continue;
1311			vif_delete(mrt, i, 0, &list);
1312		}
1313		unregister_netdevice_many(&list);
1314	}
1315
1316	/* Wipe the cache */
1317	if (flags & (MRT_FLUSH_MFC | MRT_FLUSH_MFC_STATIC)) {
1318		list_for_each_entry_safe(c, tmp, &mrt->mfc_cache_list, list) {
1319			if (((c->mfc_flags & MFC_STATIC) && !(flags & MRT_FLUSH_MFC_STATIC)) ||
1320			    (!(c->mfc_flags & MFC_STATIC) && !(flags & MRT_FLUSH_MFC)))
1321				continue;
1322			rhltable_remove(&mrt->mfc_hash, &c->mnode, ipmr_rht_params);
1323			list_del_rcu(&c->list);
1324			cache = (struct mfc_cache *)c;
1325			call_ipmr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, cache,
1326						      mrt->id);
1327			mroute_netlink_event(mrt, cache, RTM_DELROUTE);
1328			mr_cache_put(c);
1329		}
1330	}
1331
1332	if (flags & MRT_FLUSH_MFC) {
1333		if (atomic_read(&mrt->cache_resolve_queue_len) != 0) {
1334			spin_lock_bh(&mfc_unres_lock);
1335			list_for_each_entry_safe(c, tmp, &mrt->mfc_unres_queue, list) {
1336				list_del(&c->list);
1337				cache = (struct mfc_cache *)c;
1338				mroute_netlink_event(mrt, cache, RTM_DELROUTE);
1339				ipmr_destroy_unres(mrt, cache);
1340			}
1341			spin_unlock_bh(&mfc_unres_lock);
1342		}
1343	}
1344}
1345
1346/* called from ip_ra_control(), before an RCU grace period,
1347 * we don't need to call synchronize_rcu() here
1348 */
1349static void mrtsock_destruct(struct sock *sk)
1350{
1351	struct net *net = sock_net(sk);
1352	struct mr_table *mrt;
1353
1354	rtnl_lock();
1355	ipmr_for_each_table(mrt, net) {
1356		if (sk == rtnl_dereference(mrt->mroute_sk)) {
1357			IPV4_DEVCONF_ALL(net, MC_FORWARDING)--;
1358			inet_netconf_notify_devconf(net, RTM_NEWNETCONF,
1359						    NETCONFA_MC_FORWARDING,
1360						    NETCONFA_IFINDEX_ALL,
1361						    net->ipv4.devconf_all);
1362			RCU_INIT_POINTER(mrt->mroute_sk, NULL);
1363			mroute_clean_tables(mrt, MRT_FLUSH_VIFS | MRT_FLUSH_MFC);
1364		}
1365	}
1366	rtnl_unlock();
1367}
1368
1369/* Socket options and virtual interface manipulation. The whole
1370 * virtual interface system is a complete heap, but unfortunately
1371 * that's how BSD mrouted happens to think. Maybe one day with a proper
1372 * MOSPF/PIM router set up we can clean this up.
1373 */
1374
1375int ip_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
1376			 unsigned int optlen)
1377{
1378	struct net *net = sock_net(sk);
1379	int val, ret = 0, parent = 0;
1380	struct mr_table *mrt;
1381	struct vifctl vif;
1382	struct mfcctl mfc;
1383	bool do_wrvifwhole;
1384	u32 uval;
1385
1386	/* There's one exception to the lock - MRT_DONE which needs to unlock */
1387	rtnl_lock();
1388	if (sk->sk_type != SOCK_RAW ||
1389	    inet_sk(sk)->inet_num != IPPROTO_IGMP) {
1390		ret = -EOPNOTSUPP;
1391		goto out_unlock;
1392	}
1393
1394	mrt = __ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
1395	if (!mrt) {
1396		ret = -ENOENT;
1397		goto out_unlock;
1398	}
1399	if (optname != MRT_INIT) {
1400		if (sk != rcu_access_pointer(mrt->mroute_sk) &&
1401		    !ns_capable(net->user_ns, CAP_NET_ADMIN)) {
1402			ret = -EACCES;
1403			goto out_unlock;
1404		}
1405	}
1406
1407	switch (optname) {
1408	case MRT_INIT:
1409		if (optlen != sizeof(int)) {
1410			ret = -EINVAL;
1411			break;
1412		}
1413		if (rtnl_dereference(mrt->mroute_sk)) {
1414			ret = -EADDRINUSE;
1415			break;
1416		}
1417
1418		ret = ip_ra_control(sk, 1, mrtsock_destruct);
1419		if (ret == 0) {
1420			rcu_assign_pointer(mrt->mroute_sk, sk);
1421			IPV4_DEVCONF_ALL(net, MC_FORWARDING)++;
1422			inet_netconf_notify_devconf(net, RTM_NEWNETCONF,
1423						    NETCONFA_MC_FORWARDING,
1424						    NETCONFA_IFINDEX_ALL,
1425						    net->ipv4.devconf_all);
1426		}
1427		break;
1428	case MRT_DONE:
1429		if (sk != rcu_access_pointer(mrt->mroute_sk)) {
1430			ret = -EACCES;
1431		} else {
1432			/* We need to unlock here because mrtsock_destruct takes
1433			 * care of rtnl itself and we can't change that due to
1434			 * the IP_ROUTER_ALERT setsockopt which runs without it.
1435			 */
1436			rtnl_unlock();
1437			ret = ip_ra_control(sk, 0, NULL);
1438			goto out;
1439		}
1440		break;
1441	case MRT_ADD_VIF:
1442	case MRT_DEL_VIF:
1443		if (optlen != sizeof(vif)) {
1444			ret = -EINVAL;
1445			break;
1446		}
1447		if (copy_from_sockptr(&vif, optval, sizeof(vif))) {
1448			ret = -EFAULT;
1449			break;
1450		}
1451		if (vif.vifc_vifi >= MAXVIFS) {
1452			ret = -ENFILE;
1453			break;
1454		}
1455		if (optname == MRT_ADD_VIF) {
1456			ret = vif_add(net, mrt, &vif,
1457				      sk == rtnl_dereference(mrt->mroute_sk));
1458		} else {
1459			ret = vif_delete(mrt, vif.vifc_vifi, 0, NULL);
1460		}
1461		break;
1462	/* Manipulate the forwarding caches. These live
1463	 * in a sort of kernel/user symbiosis.
1464	 */
1465	case MRT_ADD_MFC:
1466	case MRT_DEL_MFC:
1467		parent = -1;
1468		fallthrough;
1469	case MRT_ADD_MFC_PROXY:
1470	case MRT_DEL_MFC_PROXY:
1471		if (optlen != sizeof(mfc)) {
1472			ret = -EINVAL;
1473			break;
1474		}
1475		if (copy_from_sockptr(&mfc, optval, sizeof(mfc))) {
1476			ret = -EFAULT;
1477			break;
1478		}
1479		if (parent == 0)
1480			parent = mfc.mfcc_parent;
1481		if (optname == MRT_DEL_MFC || optname == MRT_DEL_MFC_PROXY)
1482			ret = ipmr_mfc_delete(mrt, &mfc, parent);
1483		else
1484			ret = ipmr_mfc_add(net, mrt, &mfc,
1485					   sk == rtnl_dereference(mrt->mroute_sk),
1486					   parent);
1487		break;
1488	case MRT_FLUSH:
1489		if (optlen != sizeof(val)) {
1490			ret = -EINVAL;
1491			break;
1492		}
1493		if (copy_from_sockptr(&val, optval, sizeof(val))) {
1494			ret = -EFAULT;
1495			break;
1496		}
1497		mroute_clean_tables(mrt, val);
1498		break;
1499	/* Control PIM assert. */
1500	case MRT_ASSERT:
1501		if (optlen != sizeof(val)) {
1502			ret = -EINVAL;
1503			break;
1504		}
1505		if (copy_from_sockptr(&val, optval, sizeof(val))) {
1506			ret = -EFAULT;
1507			break;
1508		}
1509		mrt->mroute_do_assert = val;
1510		break;
1511	case MRT_PIM:
1512		if (!ipmr_pimsm_enabled()) {
1513			ret = -ENOPROTOOPT;
1514			break;
1515		}
1516		if (optlen != sizeof(val)) {
1517			ret = -EINVAL;
1518			break;
1519		}
1520		if (copy_from_sockptr(&val, optval, sizeof(val))) {
1521			ret = -EFAULT;
1522			break;
1523		}
1524
1525		do_wrvifwhole = (val == IGMPMSG_WRVIFWHOLE);
1526		val = !!val;
1527		if (val != mrt->mroute_do_pim) {
1528			mrt->mroute_do_pim = val;
1529			mrt->mroute_do_assert = val;
1530			mrt->mroute_do_wrvifwhole = do_wrvifwhole;
1531		}
1532		break;
1533	case MRT_TABLE:
1534		if (!IS_BUILTIN(CONFIG_IP_MROUTE_MULTIPLE_TABLES)) {
1535			ret = -ENOPROTOOPT;
1536			break;
1537		}
1538		if (optlen != sizeof(uval)) {
1539			ret = -EINVAL;
1540			break;
1541		}
1542		if (copy_from_sockptr(&uval, optval, sizeof(uval))) {
1543			ret = -EFAULT;
1544			break;
1545		}
1546
1547		if (sk == rtnl_dereference(mrt->mroute_sk)) {
1548			ret = -EBUSY;
1549		} else {
1550			mrt = ipmr_new_table(net, uval);
1551			if (IS_ERR(mrt))
1552				ret = PTR_ERR(mrt);
1553			else
1554				raw_sk(sk)->ipmr_table = uval;
1555		}
1556		break;
1557	/* Spurious command, or MRT_VERSION which you cannot set. */
1558	default:
1559		ret = -ENOPROTOOPT;
1560	}
1561out_unlock:
1562	rtnl_unlock();
1563out:
1564	return ret;
1565}
1566
1567/* Execute if this ioctl is a special mroute ioctl */
1568int ipmr_sk_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
1569{
1570	switch (cmd) {
1571	/* These userspace buffers will be consumed by ipmr_ioctl() */
1572	case SIOCGETVIFCNT: {
1573		struct sioc_vif_req buffer;
1574
1575		return sock_ioctl_inout(sk, cmd, arg, &buffer,
1576				      sizeof(buffer));
1577		}
1578	case SIOCGETSGCNT: {
1579		struct sioc_sg_req buffer;
1580
1581		return sock_ioctl_inout(sk, cmd, arg, &buffer,
1582				      sizeof(buffer));
1583		}
1584	}
1585	/* return code > 0 means that the ioctl was not executed */
1586	return 1;
1587}
1588
1589/* Getsock opt support for the multicast routing system. */
1590int ip_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,
1591			 sockptr_t optlen)
1592{
1593	int olr;
1594	int val;
1595	struct net *net = sock_net(sk);
1596	struct mr_table *mrt;
1597
1598	if (sk->sk_type != SOCK_RAW ||
1599	    inet_sk(sk)->inet_num != IPPROTO_IGMP)
1600		return -EOPNOTSUPP;
1601
1602	mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
1603	if (!mrt)
1604		return -ENOENT;
1605
1606	switch (optname) {
1607	case MRT_VERSION:
1608		val = 0x0305;
1609		break;
1610	case MRT_PIM:
1611		if (!ipmr_pimsm_enabled())
1612			return -ENOPROTOOPT;
1613		val = mrt->mroute_do_pim;
1614		break;
1615	case MRT_ASSERT:
1616		val = mrt->mroute_do_assert;
1617		break;
1618	default:
1619		return -ENOPROTOOPT;
1620	}
1621
1622	if (copy_from_sockptr(&olr, optlen, sizeof(int)))
1623		return -EFAULT;
1624	if (olr < 0)
1625		return -EINVAL;
1626
1627	olr = min_t(unsigned int, olr, sizeof(int));
1628
1629	if (copy_to_sockptr(optlen, &olr, sizeof(int)))
1630		return -EFAULT;
1631	if (copy_to_sockptr(optval, &val, olr))
1632		return -EFAULT;
1633	return 0;
1634}
1635
1636/* The IP multicast ioctl support routines. */
1637int ipmr_ioctl(struct sock *sk, int cmd, void *arg)
1638{
1639	struct vif_device *vif;
1640	struct mfc_cache *c;
1641	struct net *net = sock_net(sk);
1642	struct sioc_vif_req *vr;
1643	struct sioc_sg_req *sr;
1644	struct mr_table *mrt;
1645
1646	mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
1647	if (!mrt)
1648		return -ENOENT;
1649
1650	switch (cmd) {
1651	case SIOCGETVIFCNT:
1652		vr = (struct sioc_vif_req *)arg;
1653		if (vr->vifi >= mrt->maxvif)
1654			return -EINVAL;
1655		vr->vifi = array_index_nospec(vr->vifi, mrt->maxvif);
1656		rcu_read_lock();
1657		vif = &mrt->vif_table[vr->vifi];
1658		if (VIF_EXISTS(mrt, vr->vifi)) {
1659			vr->icount = READ_ONCE(vif->pkt_in);
1660			vr->ocount = READ_ONCE(vif->pkt_out);
1661			vr->ibytes = READ_ONCE(vif->bytes_in);
1662			vr->obytes = READ_ONCE(vif->bytes_out);
1663			rcu_read_unlock();
1664
1665			return 0;
1666		}
1667		rcu_read_unlock();
1668		return -EADDRNOTAVAIL;
1669	case SIOCGETSGCNT:
1670		sr = (struct sioc_sg_req *)arg;
1671
1672		rcu_read_lock();
1673		c = ipmr_cache_find(mrt, sr->src.s_addr, sr->grp.s_addr);
1674		if (c) {
1675			sr->pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt);
1676			sr->bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes);
1677			sr->wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if);
1678			rcu_read_unlock();
1679			return 0;
1680		}
1681		rcu_read_unlock();
1682		return -EADDRNOTAVAIL;
1683	default:
1684		return -ENOIOCTLCMD;
1685	}
1686}
1687
1688#ifdef CONFIG_COMPAT
1689struct compat_sioc_sg_req {
1690	struct in_addr src;
1691	struct in_addr grp;
1692	compat_ulong_t pktcnt;
1693	compat_ulong_t bytecnt;
1694	compat_ulong_t wrong_if;
1695};
1696
1697struct compat_sioc_vif_req {
1698	vifi_t	vifi;		/* Which iface */
1699	compat_ulong_t icount;
1700	compat_ulong_t ocount;
1701	compat_ulong_t ibytes;
1702	compat_ulong_t obytes;
1703};
1704
1705int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
1706{
1707	struct compat_sioc_sg_req sr;
1708	struct compat_sioc_vif_req vr;
1709	struct vif_device *vif;
1710	struct mfc_cache *c;
1711	struct net *net = sock_net(sk);
1712	struct mr_table *mrt;
1713
1714	mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
1715	if (!mrt)
1716		return -ENOENT;
1717
1718	switch (cmd) {
1719	case SIOCGETVIFCNT:
1720		if (copy_from_user(&vr, arg, sizeof(vr)))
1721			return -EFAULT;
1722		if (vr.vifi >= mrt->maxvif)
1723			return -EINVAL;
1724		vr.vifi = array_index_nospec(vr.vifi, mrt->maxvif);
1725		rcu_read_lock();
1726		vif = &mrt->vif_table[vr.vifi];
1727		if (VIF_EXISTS(mrt, vr.vifi)) {
1728			vr.icount = READ_ONCE(vif->pkt_in);
1729			vr.ocount = READ_ONCE(vif->pkt_out);
1730			vr.ibytes = READ_ONCE(vif->bytes_in);
1731			vr.obytes = READ_ONCE(vif->bytes_out);
1732			rcu_read_unlock();
1733
1734			if (copy_to_user(arg, &vr, sizeof(vr)))
1735				return -EFAULT;
1736			return 0;
1737		}
1738		rcu_read_unlock();
1739		return -EADDRNOTAVAIL;
1740	case SIOCGETSGCNT:
1741		if (copy_from_user(&sr, arg, sizeof(sr)))
1742			return -EFAULT;
1743
1744		rcu_read_lock();
1745		c = ipmr_cache_find(mrt, sr.src.s_addr, sr.grp.s_addr);
1746		if (c) {
1747			sr.pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt);
1748			sr.bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes);
1749			sr.wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if);
1750			rcu_read_unlock();
1751
1752			if (copy_to_user(arg, &sr, sizeof(sr)))
1753				return -EFAULT;
1754			return 0;
1755		}
1756		rcu_read_unlock();
1757		return -EADDRNOTAVAIL;
1758	default:
1759		return -ENOIOCTLCMD;
1760	}
1761}
1762#endif
1763
1764static int ipmr_device_event(struct notifier_block *this, unsigned long event, void *ptr)
1765{
1766	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1767	struct net *net = dev_net(dev);
1768	struct mr_table *mrt;
1769	struct vif_device *v;
1770	int ct;
1771
1772	if (event != NETDEV_UNREGISTER)
1773		return NOTIFY_DONE;
1774
1775	ipmr_for_each_table(mrt, net) {
1776		v = &mrt->vif_table[0];
1777		for (ct = 0; ct < mrt->maxvif; ct++, v++) {
1778			if (rcu_access_pointer(v->dev) == dev)
1779				vif_delete(mrt, ct, 1, NULL);
1780		}
1781	}
1782	return NOTIFY_DONE;
1783}
1784
1785static struct notifier_block ip_mr_notifier = {
1786	.notifier_call = ipmr_device_event,
1787};
1788
1789/* Encapsulate a packet by attaching a valid IPIP header to it.
1790 * This avoids tunnel drivers and other mess and gives us the speed so
1791 * important for multicast video.
1792 */
1793static void ip_encap(struct net *net, struct sk_buff *skb,
1794		     __be32 saddr, __be32 daddr)
1795{
1796	struct iphdr *iph;
1797	const struct iphdr *old_iph = ip_hdr(skb);
1798
1799	skb_push(skb, sizeof(struct iphdr));
1800	skb->transport_header = skb->network_header;
1801	skb_reset_network_header(skb);
1802	iph = ip_hdr(skb);
1803
1804	iph->version	=	4;
1805	iph->tos	=	old_iph->tos;
1806	iph->ttl	=	old_iph->ttl;
1807	iph->frag_off	=	0;
1808	iph->daddr	=	daddr;
1809	iph->saddr	=	saddr;
1810	iph->protocol	=	IPPROTO_IPIP;
1811	iph->ihl	=	5;
1812	iph->tot_len	=	htons(skb->len);
1813	ip_select_ident(net, skb, NULL);
1814	ip_send_check(iph);
1815
1816	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1817	nf_reset_ct(skb);
1818}
1819
1820static inline int ipmr_forward_finish(struct net *net, struct sock *sk,
1821				      struct sk_buff *skb)
1822{
1823	struct ip_options *opt = &(IPCB(skb)->opt);
1824
1825	IP_INC_STATS(net, IPSTATS_MIB_OUTFORWDATAGRAMS);
1826
1827	if (unlikely(opt->optlen))
1828		ip_forward_options(skb);
1829
1830	return dst_output(net, sk, skb);
1831}
1832
1833#ifdef CONFIG_NET_SWITCHDEV
1834static bool ipmr_forward_offloaded(struct sk_buff *skb, struct mr_table *mrt,
1835				   int in_vifi, int out_vifi)
1836{
1837	struct vif_device *out_vif = &mrt->vif_table[out_vifi];
1838	struct vif_device *in_vif = &mrt->vif_table[in_vifi];
1839
1840	if (!skb->offload_l3_fwd_mark)
1841		return false;
1842	if (!out_vif->dev_parent_id.id_len || !in_vif->dev_parent_id.id_len)
1843		return false;
1844	return netdev_phys_item_id_same(&out_vif->dev_parent_id,
1845					&in_vif->dev_parent_id);
1846}
1847#else
1848static bool ipmr_forward_offloaded(struct sk_buff *skb, struct mr_table *mrt,
1849				   int in_vifi, int out_vifi)
1850{
1851	return false;
1852}
1853#endif
1854
1855/* Processing handlers for ipmr_forward, under rcu_read_lock() */
1856
1857static int ipmr_prepare_xmit(struct net *net, struct mr_table *mrt,
1858			     struct sk_buff *skb, int vifi)
1859{
1860	const struct iphdr *iph = ip_hdr(skb);
1861	struct vif_device *vif = &mrt->vif_table[vifi];
1862	struct net_device *vif_dev;
1863	struct rtable *rt;
1864	struct flowi4 fl4;
1865	int    encap = 0;
1866
1867	vif_dev = vif_dev_read(vif);
1868	if (!vif_dev)
1869		return -1;
1870
1871	if (vif->flags & VIFF_REGISTER) {
1872		WRITE_ONCE(vif->pkt_out, vif->pkt_out + 1);
1873		WRITE_ONCE(vif->bytes_out, vif->bytes_out + skb->len);
1874		DEV_STATS_ADD(vif_dev, tx_bytes, skb->len);
1875		DEV_STATS_INC(vif_dev, tx_packets);
1876		ipmr_cache_report(mrt, skb, vifi, IGMPMSG_WHOLEPKT);
1877		return -1;
1878	}
1879
1880	if (vif->flags & VIFF_TUNNEL) {
1881		rt = ip_route_output_ports(net, &fl4, NULL,
1882					   vif->remote, vif->local,
1883					   0, 0,
1884					   IPPROTO_IPIP,
1885					   iph->tos & INET_DSCP_MASK, vif->link);
1886		if (IS_ERR(rt))
1887			return -1;
1888		encap = sizeof(struct iphdr);
1889	} else {
1890		rt = ip_route_output_ports(net, &fl4, NULL, iph->daddr, 0,
1891					   0, 0,
1892					   IPPROTO_IPIP,
1893					   iph->tos & INET_DSCP_MASK, vif->link);
1894		if (IS_ERR(rt))
1895			return -1;
1896	}
1897
1898	if (skb->len+encap > dst_mtu(&rt->dst) && (ntohs(iph->frag_off) & IP_DF)) {
1899		/* Do not fragment multicasts. Alas, IPv4 does not
1900		 * allow to send ICMP, so that packets will disappear
1901		 * to blackhole.
1902		 */
1903		IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
1904		ip_rt_put(rt);
1905		return -1;
1906	}
1907
1908	encap += LL_RESERVED_SPACE(dst_dev_rcu(&rt->dst)) + rt->dst.header_len;
1909
1910	if (skb_cow(skb, encap)) {
1911		ip_rt_put(rt);
1912		return -1;
1913	}
1914
1915	WRITE_ONCE(vif->pkt_out, vif->pkt_out + 1);
1916	WRITE_ONCE(vif->bytes_out, vif->bytes_out + skb->len);
1917
1918	skb_dst_drop(skb);
1919	skb_dst_set(skb, &rt->dst);
1920	ip_decrease_ttl(ip_hdr(skb));
1921
1922	/* FIXME: forward and output firewalls used to be called here.
1923	 * What do we do with netfilter? -- RR
1924	 */
1925	if (vif->flags & VIFF_TUNNEL) {
1926		ip_encap(net, skb, vif->local, vif->remote);
1927		/* FIXME: extra output firewall step used to be here. --RR */
1928		DEV_STATS_INC(vif_dev, tx_packets);
1929		DEV_STATS_ADD(vif_dev, tx_bytes, skb->len);
1930	}
1931
1932	return 0;
1933}
1934
1935static void ipmr_queue_fwd_xmit(struct net *net, struct mr_table *mrt,
1936				int in_vifi, struct sk_buff *skb, int vifi)
1937{
1938	struct rtable *rt;
1939
1940	if (ipmr_forward_offloaded(skb, mrt, in_vifi, vifi))
1941		goto out_free;
1942
1943	if (ipmr_prepare_xmit(net, mrt, skb, vifi))
1944		goto out_free;
1945
1946	rt = skb_rtable(skb);
1947
1948	IPCB(skb)->flags |= IPSKB_FORWARDED;
1949
1950	/* RFC1584 teaches, that DVMRP/PIM router must deliver packets locally
1951	 * not only before forwarding, but after forwarding on all output
1952	 * interfaces. It is clear, if mrouter runs a multicasting
1953	 * program, it should receive packets not depending to what interface
1954	 * program is joined.
1955	 * If we will not make it, the program will have to join on all
1956	 * interfaces. On the other hand, multihoming host (or router, but
1957	 * not mrouter) cannot join to more than one interface - it will
1958	 * result in receiving multiple packets.
1959	 */
1960	NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD,
1961		net, NULL, skb, skb->dev, dst_dev_rcu(&rt->dst),
1962		ipmr_forward_finish);
1963	return;
1964
1965out_free:
1966	kfree_skb(skb);
1967}
1968
1969static void ipmr_queue_output_xmit(struct net *net, struct mr_table *mrt,
1970				   struct sk_buff *skb, int vifi)
1971{
1972	if (ipmr_prepare_xmit(net, mrt, skb, vifi))
1973		goto out_free;
1974
1975	ip_mc_output(net, NULL, skb);
1976	return;
1977
1978out_free:
1979	kfree_skb(skb);
1980}
1981
1982/* Called with mrt_lock or rcu_read_lock() */
1983static int ipmr_find_vif(const struct mr_table *mrt, struct net_device *dev)
1984{
1985	int ct;
1986	/* Pairs with WRITE_ONCE() in vif_delete()/vif_add() */
1987	for (ct = READ_ONCE(mrt->maxvif) - 1; ct >= 0; ct--) {
1988		if (rcu_access_pointer(mrt->vif_table[ct].dev) == dev)
1989			break;
1990	}
1991	return ct;
1992}
1993
1994/* "local" means that we should preserve one skb (for local delivery) */
1995/* Called uner rcu_read_lock() */
1996static void ip_mr_forward(struct net *net, struct mr_table *mrt,
1997			  struct net_device *dev, struct sk_buff *skb,
1998			  struct mfc_cache *c, int local)
1999{
2000	int true_vifi = ipmr_find_vif(mrt, dev);
2001	int psend = -1;
2002	int vif, ct;
2003
2004	vif = c->_c.mfc_parent;
2005	atomic_long_inc(&c->_c.mfc_un.res.pkt);
2006	atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes);
2007	WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies);
2008
2009	if (c->mfc_origin == htonl(INADDR_ANY) && true_vifi >= 0) {
2010		struct mfc_cache *cache_proxy;
2011
2012		/* For an (*,G) entry, we only check that the incoming
2013		 * interface is part of the static tree.
2014		 */
2015		cache_proxy = mr_mfc_find_any_parent(mrt, vif);
2016		if (cache_proxy &&
2017		    cache_proxy->_c.mfc_un.res.ttls[true_vifi] < 255)
2018			goto forward;
2019	}
2020
2021	/* Wrong interface: drop packet and (maybe) send PIM assert. */
2022	if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev) {
2023		if (rt_is_output_route(skb_rtable(skb))) {
2024			/* It is our own packet, looped back.
2025			 * Very complicated situation...
2026			 *
2027			 * The best workaround until routing daemons will be
2028			 * fixed is not to redistribute packet, if it was
2029			 * send through wrong interface. It means, that
2030			 * multicast applications WILL NOT work for
2031			 * (S,G), which have default multicast route pointing
2032			 * to wrong oif. In any case, it is not a good
2033			 * idea to use multicasting applications on router.
2034			 */
2035			goto dont_forward;
2036		}
2037
2038		atomic_long_inc(&c->_c.mfc_un.res.wrong_if);
2039
2040		if (true_vifi >= 0 && mrt->mroute_do_assert &&
2041		    /* pimsm uses asserts, when switching from RPT to SPT,
2042		     * so that we cannot check that packet arrived on an oif.
2043		     * It is bad, but otherwise we would need to move pretty
2044		     * large chunk of pimd to kernel. Ough... --ANK
2045		     */
2046		    (mrt->mroute_do_pim ||
2047		     c->_c.mfc_un.res.ttls[true_vifi] < 255) &&
2048		    time_after(jiffies,
2049			       c->_c.mfc_un.res.last_assert +
2050			       MFC_ASSERT_THRESH)) {
2051			c->_c.mfc_un.res.last_assert = jiffies;
2052			ipmr_cache_report(mrt, skb, true_vifi, IGMPMSG_WRONGVIF);
2053			if (mrt->mroute_do_wrvifwhole)
2054				ipmr_cache_report(mrt, skb, true_vifi,
2055						  IGMPMSG_WRVIFWHOLE);
2056		}
2057		goto dont_forward;
2058	}
2059
2060forward:
2061	WRITE_ONCE(mrt->vif_table[vif].pkt_in,
2062		   mrt->vif_table[vif].pkt_in + 1);
2063	WRITE_ONCE(mrt->vif_table[vif].bytes_in,
2064		   mrt->vif_table[vif].bytes_in + skb->len);
2065
2066	/* Forward the frame */
2067	if (c->mfc_origin == htonl(INADDR_ANY) &&
2068	    c->mfc_mcastgrp == htonl(INADDR_ANY)) {
2069		if (true_vifi >= 0 &&
2070		    true_vifi != c->_c.mfc_parent &&
2071		    ip_hdr(skb)->ttl >
2072				c->_c.mfc_un.res.ttls[c->_c.mfc_parent]) {
2073			/* It's an (*,*) entry and the packet is not coming from
2074			 * the upstream: forward the packet to the upstream
2075			 * only.
2076			 */
2077			psend = c->_c.mfc_parent;
2078			goto last_forward;
2079		}
2080		goto dont_forward;
2081	}
2082	for (ct = c->_c.mfc_un.res.maxvif - 1;
2083	     ct >= c->_c.mfc_un.res.minvif; ct--) {
2084		/* For (*,G) entry, don't forward to the incoming interface */
2085		if ((c->mfc_origin != htonl(INADDR_ANY) ||
2086		     ct != true_vifi) &&
2087		    ip_hdr(skb)->ttl > c->_c.mfc_un.res.ttls[ct]) {
2088			if (psend != -1) {
2089				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
2090
2091				if (skb2)
2092					ipmr_queue_fwd_xmit(net, mrt, true_vifi,
2093							    skb2, psend);
2094			}
2095			psend = ct;
2096		}
2097	}
2098last_forward:
2099	if (psend != -1) {
2100		if (local) {
2101			struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
2102
2103			if (skb2)
2104				ipmr_queue_fwd_xmit(net, mrt, true_vifi, skb2,
2105						    psend);
2106		} else {
2107			ipmr_queue_fwd_xmit(net, mrt, true_vifi, skb, psend);
2108			return;
2109		}
2110	}
2111
2112dont_forward:
2113	if (!local)
2114		kfree_skb(skb);
2115}
2116
2117static struct mr_table *ipmr_rt_fib_lookup(struct net *net, struct sk_buff *skb)
2118{
2119	struct rtable *rt = skb_rtable(skb);
2120	struct iphdr *iph = ip_hdr(skb);
2121	struct flowi4 fl4 = {
2122		.daddr = iph->daddr,
2123		.saddr = iph->saddr,
2124		.flowi4_dscp = ip4h_dscp(iph),
2125		.flowi4_oif = (rt_is_output_route(rt) ?
2126			       skb->dev->ifindex : 0),
2127		.flowi4_iif = (rt_is_output_route(rt) ?
2128			       LOOPBACK_IFINDEX :
2129			       skb->dev->ifindex),
2130		.flowi4_mark = skb->mark,
2131	};
2132	struct mr_table *mrt;
2133	int err;
2134
2135	err = ipmr_fib_lookup(net, &fl4, &mrt);
2136	if (err)
2137		return ERR_PTR(err);
2138	return mrt;
2139}
2140
2141/* Multicast packets for forwarding arrive here
2142 * Called with rcu_read_lock();
2143 */
2144int ip_mr_input(struct sk_buff *skb)
2145{
2146	struct mfc_cache *cache;
2147	struct net *net = dev_net(skb->dev);
2148	int local = skb_rtable(skb)->rt_flags & RTCF_LOCAL;
2149	struct mr_table *mrt;
2150	struct net_device *dev;
2151
2152	/* skb->dev passed in is the loX master dev for vrfs.
2153	 * As there are no vifs associated with loopback devices,
2154	 * get the proper interface that does have a vif associated with it.
2155	 */
2156	dev = skb->dev;
2157	if (netif_is_l3_master(skb->dev)) {
2158		dev = dev_get_by_index_rcu(net, IPCB(skb)->iif);
2159		if (!dev) {
2160			kfree_skb(skb);
2161			return -ENODEV;
2162		}
2163	}
2164
2165	/* Packet is looped back after forward, it should not be
2166	 * forwarded second time, but still can be delivered locally.
2167	 */
2168	if (IPCB(skb)->flags & IPSKB_FORWARDED)
2169		goto dont_forward;
2170
2171	mrt = ipmr_rt_fib_lookup(net, skb);
2172	if (IS_ERR(mrt)) {
2173		kfree_skb(skb);
2174		return PTR_ERR(mrt);
2175	}
2176	if (!local) {
2177		if (IPCB(skb)->opt.router_alert) {
2178			if (ip_call_ra_chain(skb))
2179				return 0;
2180		} else if (ip_hdr(skb)->protocol == IPPROTO_IGMP) {
2181			/* IGMPv1 (and broken IGMPv2 implementations sort of
2182			 * Cisco IOS <= 11.2(8)) do not put router alert
2183			 * option to IGMP packets destined to routable
2184			 * groups. It is very bad, because it means
2185			 * that we can forward NO IGMP messages.
2186			 */
2187			struct sock *mroute_sk;
2188
2189			mroute_sk = rcu_dereference(mrt->mroute_sk);
2190			if (mroute_sk) {
2191				nf_reset_ct(skb);
2192				raw_rcv(mroute_sk, skb);
2193				return 0;
2194			}
2195		}
2196	}
2197
2198	/* already under rcu_read_lock() */
2199	cache = ipmr_cache_find(mrt, ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
2200	if (!cache) {
2201		int vif = ipmr_find_vif(mrt, dev);
2202
2203		if (vif >= 0)
2204			cache = ipmr_cache_find_any(mrt, ip_hdr(skb)->daddr,
2205						    vif);
2206	}
2207
2208	/* No usable cache entry */
2209	if (!cache) {
2210		int vif;
2211
2212		if (local) {
2213			struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
2214			ip_local_deliver(skb);
2215			if (!skb2)
2216				return -ENOBUFS;
2217			skb = skb2;
2218		}
2219
2220		vif = ipmr_find_vif(mrt, dev);
2221		if (vif >= 0)
2222			return ipmr_cache_unresolved(mrt, vif, skb, dev);
2223		kfree_skb(skb);
2224		return -ENODEV;
2225	}
2226
2227	ip_mr_forward(net, mrt, dev, skb, cache, local);
2228
2229	if (local)
2230		return ip_local_deliver(skb);
2231
2232	return 0;
2233
2234dont_forward:
2235	if (local)
2236		return ip_local_deliver(skb);
2237	kfree_skb(skb);
2238	return 0;
2239}
2240
2241static void ip_mr_output_finish(struct net *net, struct mr_table *mrt,
2242				struct net_device *dev, struct sk_buff *skb,
2243				struct mfc_cache *c)
2244{
2245	int psend = -1;
2246	int ct;
2247
2248	atomic_long_inc(&c->_c.mfc_un.res.pkt);
2249	atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes);
2250	WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies);
2251
2252	/* Forward the frame */
2253	if (c->mfc_origin == htonl(INADDR_ANY) &&
2254	    c->mfc_mcastgrp == htonl(INADDR_ANY)) {
2255		if (ip_hdr(skb)->ttl >
2256		    c->_c.mfc_un.res.ttls[c->_c.mfc_parent]) {
2257			/* It's an (*,*) entry and the packet is not coming from
2258			 * the upstream: forward the packet to the upstream
2259			 * only.
2260			 */
2261			psend = c->_c.mfc_parent;
2262			goto last_xmit;
2263		}
2264		goto dont_xmit;
2265	}
2266
2267	for (ct = c->_c.mfc_un.res.maxvif - 1;
2268	     ct >= c->_c.mfc_un.res.minvif; ct--) {
2269		if (ip_hdr(skb)->ttl > c->_c.mfc_un.res.ttls[ct]) {
2270			if (psend != -1) {
2271				struct sk_buff *skb2;
2272
2273				skb2 = skb_clone(skb, GFP_ATOMIC);
2274				if (skb2)
2275					ipmr_queue_output_xmit(net, mrt,
2276							       skb2, psend);
2277			}
2278			psend = ct;
2279		}
2280	}
2281
2282last_xmit:
2283	if (psend != -1) {
2284		ipmr_queue_output_xmit(net, mrt, skb, psend);
2285		return;
2286	}
2287
2288dont_xmit:
2289	kfree_skb(skb);
2290}
2291
2292/* Multicast packets for forwarding arrive here
2293 * Called with rcu_read_lock();
2294 */
2295int ip_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
2296{
2297	struct rtable *rt = skb_rtable(skb);
2298	struct mfc_cache *cache;
2299	struct net_device *dev;
2300	struct mr_table *mrt;
2301	int vif;
2302
2303	guard(rcu)();
2304
2305	dev = dst_dev_rcu(&rt->dst);
2306
2307	if (IPCB(skb)->flags & IPSKB_FORWARDED)
2308		goto mc_output;
2309	if (!(IPCB(skb)->flags & IPSKB_MCROUTE))
2310		goto mc_output;
2311
2312	skb->dev = dev;
2313
2314	mrt = ipmr_rt_fib_lookup(net, skb);
2315	if (IS_ERR(mrt))
2316		goto mc_output;
2317
2318	cache = ipmr_cache_find(mrt, ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
2319	if (!cache) {
2320		vif = ipmr_find_vif(mrt, dev);
2321		if (vif >= 0)
2322			cache = ipmr_cache_find_any(mrt, ip_hdr(skb)->daddr,
2323						    vif);
2324	}
2325
2326	/* No usable cache entry */
2327	if (!cache) {
2328		vif = ipmr_find_vif(mrt, dev);
2329		if (vif >= 0)
2330			return ipmr_cache_unresolved(mrt, vif, skb, dev);
2331		goto mc_output;
2332	}
2333
2334	vif = cache->_c.mfc_parent;
2335	if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev)
2336		goto mc_output;
2337
2338	ip_mr_output_finish(net, mrt, dev, skb, cache);
2339	return 0;
2340
2341mc_output:
2342	return ip_mc_output(net, sk, skb);
2343}
2344
2345#ifdef CONFIG_IP_PIMSM_V1
2346/* Handle IGMP messages of PIMv1 */
2347int pim_rcv_v1(struct sk_buff *skb)
2348{
2349	struct igmphdr *pim;
2350	struct net *net = dev_net(skb->dev);
2351	struct mr_table *mrt;
2352
2353	if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(struct iphdr)))
2354		goto drop;
2355
2356	pim = igmp_hdr(skb);
2357
2358	mrt = ipmr_rt_fib_lookup(net, skb);
2359	if (IS_ERR(mrt))
2360		goto drop;
2361	if (!mrt->mroute_do_pim ||
2362	    pim->group != PIM_V1_VERSION || pim->code != PIM_V1_REGISTER)
2363		goto drop;
2364
2365	if (__pim_rcv(mrt, skb, sizeof(*pim))) {
2366drop:
2367		kfree_skb(skb);
2368	}
2369	return 0;
2370}
2371#endif
2372
2373#ifdef CONFIG_IP_PIMSM_V2
2374static int pim_rcv(struct sk_buff *skb)
2375{
2376	struct pimreghdr *pim;
2377	struct net *net = dev_net(skb->dev);
2378	struct mr_table *mrt;
2379
2380	if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(struct iphdr)))
2381		goto drop;
2382
2383	pim = (struct pimreghdr *)skb_transport_header(skb);
2384	if (pim->type != ((PIM_VERSION << 4) | (PIM_TYPE_REGISTER)) ||
2385	    (pim->flags & PIM_NULL_REGISTER) ||
2386	    (ip_compute_csum((void *)pim, sizeof(*pim)) != 0 &&
2387	     csum_fold(skb_checksum(skb, 0, skb->len, 0))))
2388		goto drop;
2389
2390	mrt = ipmr_rt_fib_lookup(net, skb);
2391	if (IS_ERR(mrt))
2392		goto drop;
2393	if (__pim_rcv(mrt, skb, sizeof(*pim))) {
2394drop:
2395		kfree_skb(skb);
2396	}
2397	return 0;
2398}
2399#endif
2400
2401int ipmr_get_route(struct net *net, struct sk_buff *skb,
2402		   __be32 saddr, __be32 daddr,
2403		   struct rtmsg *rtm, u32 portid)
2404{
2405	struct mfc_cache *cache;
2406	struct mr_table *mrt;
2407	int err;
2408
2409	rcu_read_lock();
2410	mrt = __ipmr_get_table(net, RT_TABLE_DEFAULT);
2411	if (!mrt) {
2412		rcu_read_unlock();
2413		return -ENOENT;
2414	}
2415
2416	cache = ipmr_cache_find(mrt, saddr, daddr);
2417	if (!cache && skb->dev) {
2418		int vif = ipmr_find_vif(mrt, skb->dev);
2419
2420		if (vif >= 0)
2421			cache = ipmr_cache_find_any(mrt, daddr, vif);
2422	}
2423	if (!cache) {
2424		struct sk_buff *skb2;
2425		struct iphdr *iph;
2426		struct net_device *dev;
2427		int vif = -1;
2428
2429		dev = skb->dev;
2430		if (dev)
2431			vif = ipmr_find_vif(mrt, dev);
2432		if (vif < 0) {
2433			rcu_read_unlock();
2434			return -ENODEV;
2435		}
2436
2437		skb2 = skb_realloc_headroom(skb, sizeof(struct iphdr));
2438		if (!skb2) {
2439			rcu_read_unlock();
2440			return -ENOMEM;
2441		}
2442
2443		NETLINK_CB(skb2).portid = portid;
2444		skb_push(skb2, sizeof(struct iphdr));
2445		skb_reset_network_header(skb2);
2446		iph = ip_hdr(skb2);
2447		iph->ihl = sizeof(struct iphdr) >> 2;
2448		iph->saddr = saddr;
2449		iph->daddr = daddr;
2450		iph->version = 0;
2451		err = ipmr_cache_unresolved(mrt, vif, skb2, dev);
2452		rcu_read_unlock();
2453		return err;
2454	}
2455
2456	err = mr_fill_mroute(mrt, skb, &cache->_c, rtm);
2457	rcu_read_unlock();
2458	return err;
2459}
2460
2461static int ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
2462			    u32 portid, u32 seq, struct mfc_cache *c, int cmd,
2463			    int flags)
2464{
2465	struct nlmsghdr *nlh;
2466	struct rtmsg *rtm;
2467	int err;
2468
2469	nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags);
2470	if (!nlh)
2471		return -EMSGSIZE;
2472
2473	rtm = nlmsg_data(nlh);
2474	rtm->rtm_family   = RTNL_FAMILY_IPMR;
2475	rtm->rtm_dst_len  = 32;
2476	rtm->rtm_src_len  = 32;
2477	rtm->rtm_tos      = 0;
2478	rtm->rtm_table    = mrt->id;
2479	if (nla_put_u32(skb, RTA_TABLE, mrt->id))
2480		goto nla_put_failure;
2481	rtm->rtm_type     = RTN_MULTICAST;
2482	rtm->rtm_scope    = RT_SCOPE_UNIVERSE;
2483	if (c->_c.mfc_flags & MFC_STATIC)
2484		rtm->rtm_protocol = RTPROT_STATIC;
2485	else
2486		rtm->rtm_protocol = RTPROT_MROUTED;
2487	rtm->rtm_flags    = 0;
2488
2489	if (nla_put_in_addr(skb, RTA_SRC, c->mfc_origin) ||
2490	    nla_put_in_addr(skb, RTA_DST, c->mfc_mcastgrp))
2491		goto nla_put_failure;
2492	err = mr_fill_mroute(mrt, skb, &c->_c, rtm);
2493	/* do not break the dump if cache is unresolved */
2494	if (err < 0 && err != -ENOENT)
2495		goto nla_put_failure;
2496
2497	nlmsg_end(skb, nlh);
2498	return 0;
2499
2500nla_put_failure:
2501	nlmsg_cancel(skb, nlh);
2502	return -EMSGSIZE;
2503}
2504
2505static int _ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
2506			     u32 portid, u32 seq, struct mr_mfc *c, int cmd,
2507			     int flags)
2508{
2509	return ipmr_fill_mroute(mrt, skb, portid, seq, (struct mfc_cache *)c,
2510				cmd, flags);
2511}
2512
2513static size_t mroute_msgsize(bool unresolved, int maxvif)
2514{
2515	size_t len =
2516		NLMSG_ALIGN(sizeof(struct rtmsg))
2517		+ nla_total_size(4)	/* RTA_TABLE */
2518		+ nla_total_size(4)	/* RTA_SRC */
2519		+ nla_total_size(4)	/* RTA_DST */
2520		;
2521
2522	if (!unresolved)
2523		len = len
2524		      + nla_total_size(4)	/* RTA_IIF */
2525		      + nla_total_size(0)	/* RTA_MULTIPATH */
2526		      + maxvif * NLA_ALIGN(sizeof(struct rtnexthop))
2527						/* RTA_MFC_STATS */
2528		      + nla_total_size_64bit(sizeof(struct rta_mfc_stats))
2529		;
2530
2531	return len;
2532}
2533
2534static void mroute_netlink_event(struct mr_table *mrt, struct mfc_cache *mfc,
2535				 int cmd)
2536{
2537	struct net *net = read_pnet(&mrt->net);
2538	struct sk_buff *skb;
2539	int err = -ENOBUFS;
2540
2541	skb = nlmsg_new(mroute_msgsize(mfc->_c.mfc_parent >= MAXVIFS,
2542				       mrt->maxvif),
2543			GFP_ATOMIC);
2544	if (!skb)
2545		goto errout;
2546
2547	err = ipmr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0);
2548	if (err < 0)
2549		goto errout;
2550
2551	rtnl_notify(skb, net, 0, RTNLGRP_IPV4_MROUTE, NULL, GFP_ATOMIC);
2552	return;
2553
2554errout:
2555	kfree_skb(skb);
2556	rtnl_set_sk_err(net, RTNLGRP_IPV4_MROUTE, err);
2557}
2558
2559static size_t igmpmsg_netlink_msgsize(size_t payloadlen)
2560{
2561	size_t len =
2562		NLMSG_ALIGN(sizeof(struct rtgenmsg))
2563		+ nla_total_size(1)	/* IPMRA_CREPORT_MSGTYPE */
2564		+ nla_total_size(4)	/* IPMRA_CREPORT_VIF_ID */
2565		+ nla_total_size(4)	/* IPMRA_CREPORT_SRC_ADDR */
2566		+ nla_total_size(4)	/* IPMRA_CREPORT_DST_ADDR */
2567		+ nla_total_size(4)	/* IPMRA_CREPORT_TABLE */
2568					/* IPMRA_CREPORT_PKT */
2569		+ nla_total_size(payloadlen)
2570		;
2571
2572	return len;
2573}
2574
2575static void igmpmsg_netlink_event(const struct mr_table *mrt, struct sk_buff *pkt)
2576{
2577	struct net *net = read_pnet(&mrt->net);
2578	struct nlmsghdr *nlh;
2579	struct rtgenmsg *rtgenm;
2580	struct igmpmsg *msg;
2581	struct sk_buff *skb;
2582	struct nlattr *nla;
2583	int payloadlen;
2584
2585	payloadlen = pkt->len - sizeof(struct igmpmsg);
2586	msg = (struct igmpmsg *)skb_network_header(pkt);
2587
2588	skb = nlmsg_new(igmpmsg_netlink_msgsize(payloadlen), GFP_ATOMIC);
2589	if (!skb)
2590		goto errout;
2591
2592	nlh = nlmsg_put(skb, 0, 0, RTM_NEWCACHEREPORT,
2593			sizeof(struct rtgenmsg), 0);
2594	if (!nlh)
2595		goto errout;
2596	rtgenm = nlmsg_data(nlh);
2597	rtgenm->rtgen_family = RTNL_FAMILY_IPMR;
2598	if (nla_put_u8(skb, IPMRA_CREPORT_MSGTYPE, msg->im_msgtype) ||
2599	    nla_put_u32(skb, IPMRA_CREPORT_VIF_ID, msg->im_vif | (msg->im_vif_hi << 8)) ||
2600	    nla_put_in_addr(skb, IPMRA_CREPORT_SRC_ADDR,
2601			    msg->im_src.s_addr) ||
2602	    nla_put_in_addr(skb, IPMRA_CREPORT_DST_ADDR,
2603			    msg->im_dst.s_addr) ||
2604	    nla_put_u32(skb, IPMRA_CREPORT_TABLE, mrt->id))
2605		goto nla_put_failure;
2606
2607	nla = nla_reserve(skb, IPMRA_CREPORT_PKT, payloadlen);
2608	if (!nla || skb_copy_bits(pkt, sizeof(struct igmpmsg),
2609				  nla_data(nla), payloadlen))
2610		goto nla_put_failure;
2611
2612	nlmsg_end(skb, nlh);
2613
2614	rtnl_notify(skb, net, 0, RTNLGRP_IPV4_MROUTE_R, NULL, GFP_ATOMIC);
2615	return;
2616
2617nla_put_failure:
2618	nlmsg_cancel(skb, nlh);
2619errout:
2620	kfree_skb(skb);
2621	rtnl_set_sk_err(net, RTNLGRP_IPV4_MROUTE_R, -ENOBUFS);
2622}
2623
2624static int ipmr_rtm_valid_getroute_req(struct sk_buff *skb,
2625				       const struct nlmsghdr *nlh,
2626				       struct nlattr **tb,
2627				       struct netlink_ext_ack *extack)
2628{
2629	struct rtmsg *rtm;
2630	int i, err;
2631
2632	rtm = nlmsg_payload(nlh, sizeof(*rtm));
2633	if (!rtm) {
2634		NL_SET_ERR_MSG(extack, "ipv4: Invalid header for multicast route get request");
2635		return -EINVAL;
2636	}
2637
2638	if (!netlink_strict_get_check(skb))
2639		return nlmsg_parse_deprecated(nlh, sizeof(*rtm), tb, RTA_MAX,
2640					      rtm_ipv4_policy, extack);
2641
2642	if ((rtm->rtm_src_len && rtm->rtm_src_len != 32) ||
2643	    (rtm->rtm_dst_len && rtm->rtm_dst_len != 32) ||
2644	    rtm->rtm_tos || rtm->rtm_table || rtm->rtm_protocol ||
2645	    rtm->rtm_scope || rtm->rtm_type || rtm->rtm_flags) {
2646		NL_SET_ERR_MSG(extack, "ipv4: Invalid values in header for multicast route get request");
2647		return -EINVAL;
2648	}
2649
2650	err = nlmsg_parse_deprecated_strict(nlh, sizeof(*rtm), tb, RTA_MAX,
2651					    rtm_ipv4_policy, extack);
2652	if (err)
2653		return err;
2654
2655	if ((tb[RTA_SRC] && !rtm->rtm_src_len) ||
2656	    (tb[RTA_DST] && !rtm->rtm_dst_len)) {
2657		NL_SET_ERR_MSG(extack, "ipv4: rtm_src_len and rtm_dst_len must be 32 for IPv4");
2658		return -EINVAL;
2659	}
2660
2661	for (i = 0; i <= RTA_MAX; i++) {
2662		if (!tb[i])
2663			continue;
2664
2665		switch (i) {
2666		case RTA_SRC:
2667		case RTA_DST:
2668		case RTA_TABLE:
2669			break;
2670		default:
2671			NL_SET_ERR_MSG(extack, "ipv4: Unsupported attribute in multicast route get request");
2672			return -EINVAL;
2673		}
2674	}
2675
2676	return 0;
2677}
2678
2679static int ipmr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
2680			     struct netlink_ext_ack *extack)
2681{
2682	struct net *net = sock_net(in_skb->sk);
2683	struct nlattr *tb[RTA_MAX + 1];
2684	struct sk_buff *skb = NULL;
2685	struct mfc_cache *cache;
2686	struct mr_table *mrt;
2687	__be32 src, grp;
2688	u32 tableid;
2689	int err;
2690
2691	err = ipmr_rtm_valid_getroute_req(in_skb, nlh, tb, extack);
2692	if (err < 0)
2693		goto errout;
2694
2695	src = nla_get_in_addr_default(tb[RTA_SRC], 0);
2696	grp = nla_get_in_addr_default(tb[RTA_DST], 0);
2697	tableid = nla_get_u32_default(tb[RTA_TABLE], 0);
2698
2699	mrt = __ipmr_get_table(net, tableid ? tableid : RT_TABLE_DEFAULT);
2700	if (!mrt) {
2701		err = -ENOENT;
2702		goto errout_free;
2703	}
2704
2705	/* entries are added/deleted only under RTNL */
2706	rcu_read_lock();
2707	cache = ipmr_cache_find(mrt, src, grp);
2708	rcu_read_unlock();
2709	if (!cache) {
2710		err = -ENOENT;
2711		goto errout_free;
2712	}
2713
2714	skb = nlmsg_new(mroute_msgsize(false, mrt->maxvif), GFP_KERNEL);
2715	if (!skb) {
2716		err = -ENOBUFS;
2717		goto errout_free;
2718	}
2719
2720	err = ipmr_fill_mroute(mrt, skb, NETLINK_CB(in_skb).portid,
2721			       nlh->nlmsg_seq, cache,
2722			       RTM_NEWROUTE, 0);
2723	if (err < 0)
2724		goto errout_free;
2725
2726	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
2727
2728errout:
2729	return err;
2730
2731errout_free:
2732	kfree_skb(skb);
2733	goto errout;
2734}
2735
2736static int ipmr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
2737{
2738	struct fib_dump_filter filter = {
2739		.rtnl_held = true,
2740	};
2741	int err;
2742
2743	if (cb->strict_check) {
2744		err = ip_valid_fib_dump_req(sock_net(skb->sk), cb->nlh,
2745					    &filter, cb);
2746		if (err < 0)
2747			return err;
2748	}
2749
2750	if (filter.table_id) {
2751		struct mr_table *mrt;
2752
2753		mrt = __ipmr_get_table(sock_net(skb->sk), filter.table_id);
2754		if (!mrt) {
2755			if (rtnl_msg_family(cb->nlh) != RTNL_FAMILY_IPMR)
2756				return skb->len;
2757
2758			NL_SET_ERR_MSG(cb->extack, "ipv4: MR table does not exist");
2759			return -ENOENT;
2760		}
2761		err = mr_table_dump(mrt, skb, cb, _ipmr_fill_mroute,
2762				    &mfc_unres_lock, &filter);
2763		return skb->len ? : err;
2764	}
2765
2766	return mr_rtm_dumproute(skb, cb, ipmr_mr_table_iter,
2767				_ipmr_fill_mroute, &mfc_unres_lock, &filter);
2768}
2769
2770static const struct nla_policy rtm_ipmr_policy[RTA_MAX + 1] = {
2771	[RTA_SRC]	= { .type = NLA_U32 },
2772	[RTA_DST]	= { .type = NLA_U32 },
2773	[RTA_IIF]	= { .type = NLA_U32 },
2774	[RTA_TABLE]	= { .type = NLA_U32 },
2775	[RTA_MULTIPATH]	= { .len = sizeof(struct rtnexthop) },
2776};
2777
2778static bool ipmr_rtm_validate_proto(unsigned char rtm_protocol)
2779{
2780	switch (rtm_protocol) {
2781	case RTPROT_STATIC:
2782	case RTPROT_MROUTED:
2783		return true;
2784	}
2785	return false;
2786}
2787
2788static int ipmr_nla_get_ttls(const struct nlattr *nla, struct mfcctl *mfcc)
2789{
2790	struct rtnexthop *rtnh = nla_data(nla);
2791	int remaining = nla_len(nla), vifi = 0;
2792
2793	while (rtnh_ok(rtnh, remaining)) {
2794		mfcc->mfcc_ttls[vifi] = rtnh->rtnh_hops;
2795		if (++vifi == MAXVIFS)
2796			break;
2797		rtnh = rtnh_next(rtnh, &remaining);
2798	}
2799
2800	return remaining > 0 ? -EINVAL : vifi;
2801}
2802
2803/* returns < 0 on error, 0 for ADD_MFC and 1 for ADD_MFC_PROXY */
2804static int rtm_to_ipmr_mfcc(struct net *net, struct nlmsghdr *nlh,
2805			    struct mfcctl *mfcc, int *mrtsock,
2806			    struct mr_table **mrtret,
2807			    struct netlink_ext_ack *extack)
2808{
2809	struct net_device *dev = NULL;
2810	u32 tblid = RT_TABLE_DEFAULT;
2811	struct mr_table *mrt;
2812	struct nlattr *attr;
2813	struct rtmsg *rtm;
2814	int ret, rem;
2815
2816	ret = nlmsg_validate_deprecated(nlh, sizeof(*rtm), RTA_MAX,
2817					rtm_ipmr_policy, extack);
2818	if (ret < 0)
2819		goto out;
2820	rtm = nlmsg_data(nlh);
2821
2822	ret = -EINVAL;
2823	if (rtm->rtm_family != RTNL_FAMILY_IPMR || rtm->rtm_dst_len != 32 ||
2824	    rtm->rtm_type != RTN_MULTICAST ||
2825	    rtm->rtm_scope != RT_SCOPE_UNIVERSE ||
2826	    !ipmr_rtm_validate_proto(rtm->rtm_protocol))
2827		goto out;
2828
2829	memset(mfcc, 0, sizeof(*mfcc));
2830	mfcc->mfcc_parent = -1;
2831	ret = 0;
2832	nlmsg_for_each_attr(attr, nlh, sizeof(struct rtmsg), rem) {
2833		switch (nla_type(attr)) {
2834		case RTA_SRC:
2835			mfcc->mfcc_origin.s_addr = nla_get_be32(attr);
2836			break;
2837		case RTA_DST:
2838			mfcc->mfcc_mcastgrp.s_addr = nla_get_be32(attr);
2839			break;
2840		case RTA_IIF:
2841			dev = __dev_get_by_index(net, nla_get_u32(attr));
2842			if (!dev) {
2843				ret = -ENODEV;
2844				goto out;
2845			}
2846			break;
2847		case RTA_MULTIPATH:
2848			if (ipmr_nla_get_ttls(attr, mfcc) < 0) {
2849				ret = -EINVAL;
2850				goto out;
2851			}
2852			break;
2853		case RTA_PREFSRC:
2854			ret = 1;
2855			break;
2856		case RTA_TABLE:
2857			tblid = nla_get_u32(attr);
2858			break;
2859		}
2860	}
2861	mrt = __ipmr_get_table(net, tblid);
2862	if (!mrt) {
2863		ret = -ENOENT;
2864		goto out;
2865	}
2866	*mrtret = mrt;
2867	*mrtsock = rtm->rtm_protocol == RTPROT_MROUTED ? 1 : 0;
2868	if (dev)
2869		mfcc->mfcc_parent = ipmr_find_vif(mrt, dev);
2870
2871out:
2872	return ret;
2873}
2874
2875/* takes care of both newroute and delroute */
2876static int ipmr_rtm_route(struct sk_buff *skb, struct nlmsghdr *nlh,
2877			  struct netlink_ext_ack *extack)
2878{
2879	struct net *net = sock_net(skb->sk);
2880	int ret, mrtsock, parent;
2881	struct mr_table *tbl;
2882	struct mfcctl mfcc;
2883
2884	mrtsock = 0;
2885	tbl = NULL;
2886	ret = rtm_to_ipmr_mfcc(net, nlh, &mfcc, &mrtsock, &tbl, extack);
2887	if (ret < 0)
2888		return ret;
2889
2890	parent = ret ? mfcc.mfcc_parent : -1;
2891	if (nlh->nlmsg_type == RTM_NEWROUTE)
2892		return ipmr_mfc_add(net, tbl, &mfcc, mrtsock, parent);
2893	else
2894		return ipmr_mfc_delete(tbl, &mfcc, parent);
2895}
2896
2897static bool ipmr_fill_table(struct mr_table *mrt, struct sk_buff *skb)
2898{
2899	u32 queue_len = atomic_read(&mrt->cache_resolve_queue_len);
2900
2901	if (nla_put_u32(skb, IPMRA_TABLE_ID, mrt->id) ||
2902	    nla_put_u32(skb, IPMRA_TABLE_CACHE_RES_QUEUE_LEN, queue_len) ||
2903	    nla_put_s32(skb, IPMRA_TABLE_MROUTE_REG_VIF_NUM,
2904			mrt->mroute_reg_vif_num) ||
2905	    nla_put_u8(skb, IPMRA_TABLE_MROUTE_DO_ASSERT,
2906		       mrt->mroute_do_assert) ||
2907	    nla_put_u8(skb, IPMRA_TABLE_MROUTE_DO_PIM, mrt->mroute_do_pim) ||
2908	    nla_put_u8(skb, IPMRA_TABLE_MROUTE_DO_WRVIFWHOLE,
2909		       mrt->mroute_do_wrvifwhole))
2910		return false;
2911
2912	return true;
2913}
2914
2915static bool ipmr_fill_vif(struct mr_table *mrt, u32 vifid, struct sk_buff *skb)
2916{
2917	struct net_device *vif_dev;
2918	struct nlattr *vif_nest;
2919	struct vif_device *vif;
2920
2921	vif = &mrt->vif_table[vifid];
2922	vif_dev = rtnl_dereference(vif->dev);
2923	/* if the VIF doesn't exist just continue */
2924	if (!vif_dev)
2925		return true;
2926
2927	vif_nest = nla_nest_start_noflag(skb, IPMRA_VIF);
2928	if (!vif_nest)
2929		return false;
2930
2931	if (nla_put_u32(skb, IPMRA_VIFA_IFINDEX, vif_dev->ifindex) ||
2932	    nla_put_u32(skb, IPMRA_VIFA_VIF_ID, vifid) ||
2933	    nla_put_u16(skb, IPMRA_VIFA_FLAGS, vif->flags) ||
2934	    nla_put_u64_64bit(skb, IPMRA_VIFA_BYTES_IN, vif->bytes_in,
2935			      IPMRA_VIFA_PAD) ||
2936	    nla_put_u64_64bit(skb, IPMRA_VIFA_BYTES_OUT, vif->bytes_out,
2937			      IPMRA_VIFA_PAD) ||
2938	    nla_put_u64_64bit(skb, IPMRA_VIFA_PACKETS_IN, vif->pkt_in,
2939			      IPMRA_VIFA_PAD) ||
2940	    nla_put_u64_64bit(skb, IPMRA_VIFA_PACKETS_OUT, vif->pkt_out,
2941			      IPMRA_VIFA_PAD) ||
2942	    nla_put_be32(skb, IPMRA_VIFA_LOCAL_ADDR, vif->local) ||
2943	    nla_put_be32(skb, IPMRA_VIFA_REMOTE_ADDR, vif->remote)) {
2944		nla_nest_cancel(skb, vif_nest);
2945		return false;
2946	}
2947	nla_nest_end(skb, vif_nest);
2948
2949	return true;
2950}
2951
2952static int ipmr_valid_dumplink(const struct nlmsghdr *nlh,
2953			       struct netlink_ext_ack *extack)
2954{
2955	struct ifinfomsg *ifm;
2956
2957	ifm = nlmsg_payload(nlh, sizeof(*ifm));
2958	if (!ifm) {
2959		NL_SET_ERR_MSG(extack, "ipv4: Invalid header for ipmr link dump");
2960		return -EINVAL;
2961	}
2962
2963	if (nlmsg_attrlen(nlh, sizeof(*ifm))) {
2964		NL_SET_ERR_MSG(extack, "Invalid data after header in ipmr link dump");
2965		return -EINVAL;
2966	}
2967
2968	if (ifm->__ifi_pad || ifm->ifi_type || ifm->ifi_flags ||
2969	    ifm->ifi_change || ifm->ifi_index) {
2970		NL_SET_ERR_MSG(extack, "Invalid values in header for ipmr link dump request");
2971		return -EINVAL;
2972	}
2973
2974	return 0;
2975}
2976
2977static int ipmr_rtm_dumplink(struct sk_buff *skb, struct netlink_callback *cb)
2978{
2979	struct net *net = sock_net(skb->sk);
2980	struct nlmsghdr *nlh = NULL;
2981	unsigned int t = 0, s_t;
2982	unsigned int e = 0, s_e;
2983	struct mr_table *mrt;
2984
2985	if (cb->strict_check) {
2986		int err = ipmr_valid_dumplink(cb->nlh, cb->extack);
2987
2988		if (err < 0)
2989			return err;
2990	}
2991
2992	s_t = cb->args[0];
2993	s_e = cb->args[1];
2994
2995	ipmr_for_each_table(mrt, net) {
2996		struct nlattr *vifs, *af;
2997		struct ifinfomsg *hdr;
2998		u32 i;
2999
3000		if (t < s_t)
3001			goto skip_table;
3002		nlh = nlmsg_put(skb, NETLINK_CB(cb->skb).portid,
3003				cb->nlh->nlmsg_seq, RTM_NEWLINK,
3004				sizeof(*hdr), NLM_F_MULTI);
3005		if (!nlh)
3006			break;
3007
3008		hdr = nlmsg_data(nlh);
3009		memset(hdr, 0, sizeof(*hdr));
3010		hdr->ifi_family = RTNL_FAMILY_IPMR;
3011
3012		af = nla_nest_start_noflag(skb, IFLA_AF_SPEC);
3013		if (!af) {
3014			nlmsg_cancel(skb, nlh);
3015			goto out;
3016		}
3017
3018		if (!ipmr_fill_table(mrt, skb)) {
3019			nlmsg_cancel(skb, nlh);
3020			goto out;
3021		}
3022
3023		vifs = nla_nest_start_noflag(skb, IPMRA_TABLE_VIFS);
3024		if (!vifs) {
3025			nla_nest_end(skb, af);
3026			nlmsg_end(skb, nlh);
3027			goto out;
3028		}
3029		for (i = 0; i < mrt->maxvif; i++) {
3030			if (e < s_e)
3031				goto skip_entry;
3032			if (!ipmr_fill_vif(mrt, i, skb)) {
3033				nla_nest_end(skb, vifs);
3034				nla_nest_end(skb, af);
3035				nlmsg_end(skb, nlh);
3036				goto out;
3037			}
3038skip_entry:
3039			e++;
3040		}
3041		s_e = 0;
3042		e = 0;
3043		nla_nest_end(skb, vifs);
3044		nla_nest_end(skb, af);
3045		nlmsg_end(skb, nlh);
3046skip_table:
3047		t++;
3048	}
3049
3050out:
3051	cb->args[1] = e;
3052	cb->args[0] = t;
3053
3054	return skb->len;
3055}
3056
3057#ifdef CONFIG_PROC_FS
3058/* The /proc interfaces to multicast routing :
3059 * /proc/net/ip_mr_cache & /proc/net/ip_mr_vif
3060 */
3061
3062static void *ipmr_vif_seq_start(struct seq_file *seq, loff_t *pos)
3063	__acquires(RCU)
3064{
3065	struct mr_vif_iter *iter = seq->private;
3066	struct net *net = seq_file_net(seq);
3067	struct mr_table *mrt;
3068
3069	rcu_read_lock();
3070	mrt = __ipmr_get_table(net, RT_TABLE_DEFAULT);
3071	if (!mrt) {
3072		rcu_read_unlock();
3073		return ERR_PTR(-ENOENT);
3074	}
3075
3076	iter->mrt = mrt;
3077
3078	return mr_vif_seq_start(seq, pos);
3079}
3080
3081static void ipmr_vif_seq_stop(struct seq_file *seq, void *v)
3082	__releases(RCU)
3083{
3084	rcu_read_unlock();
3085}
3086
3087static int ipmr_vif_seq_show(struct seq_file *seq, void *v)
3088{
3089	struct mr_vif_iter *iter = seq->private;
3090	struct mr_table *mrt = iter->mrt;
3091
3092	if (v == SEQ_START_TOKEN) {
3093		seq_puts(seq,
3094			 "Interface      BytesIn  PktsIn  BytesOut PktsOut Flags Local    Remote\n");
3095	} else {
3096		const struct vif_device *vif = v;
3097		const struct net_device *vif_dev;
3098		const char *name;
3099
3100		vif_dev = vif_dev_read(vif);
3101		name = vif_dev ? vif_dev->name : "none";
3102		seq_printf(seq,
3103			   "%2td %-10s %8ld %7ld  %8ld %7ld %05X %08X %08X\n",
3104			   vif - mrt->vif_table,
3105			   name, vif->bytes_in, vif->pkt_in,
3106			   vif->bytes_out, vif->pkt_out,
3107			   vif->flags, vif->local, vif->remote);
3108	}
3109	return 0;
3110}
3111
3112static const struct seq_operations ipmr_vif_seq_ops = {
3113	.start = ipmr_vif_seq_start,
3114	.next  = mr_vif_seq_next,
3115	.stop  = ipmr_vif_seq_stop,
3116	.show  = ipmr_vif_seq_show,
3117};
3118
3119static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos)
3120{
3121	struct net *net = seq_file_net(seq);
3122	struct mr_table *mrt;
3123
3124	mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
3125	if (!mrt)
3126		return ERR_PTR(-ENOENT);
3127
3128	return mr_mfc_seq_start(seq, pos, mrt, &mfc_unres_lock);
3129}
3130
3131static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
3132{
3133	int n;
3134
3135	if (v == SEQ_START_TOKEN) {
3136		seq_puts(seq,
3137		 "Group    Origin   Iif     Pkts    Bytes    Wrong Oifs\n");
3138	} else {
3139		const struct mfc_cache *mfc = v;
3140		const struct mr_mfc_iter *it = seq->private;
3141		const struct mr_table *mrt = it->mrt;
3142
3143		seq_printf(seq, "%08X %08X %-3hd",
3144			   (__force u32) mfc->mfc_mcastgrp,
3145			   (__force u32) mfc->mfc_origin,
3146			   mfc->_c.mfc_parent);
3147
3148		if (it->cache != &mrt->mfc_unres_queue) {
3149			seq_printf(seq, " %8lu %8lu %8lu",
3150				   atomic_long_read(&mfc->_c.mfc_un.res.pkt),
3151				   atomic_long_read(&mfc->_c.mfc_un.res.bytes),
3152				   atomic_long_read(&mfc->_c.mfc_un.res.wrong_if));
3153			for (n = mfc->_c.mfc_un.res.minvif;
3154			     n < mfc->_c.mfc_un.res.maxvif; n++) {
3155				if (VIF_EXISTS(mrt, n) &&
3156				    mfc->_c.mfc_un.res.ttls[n] < 255)
3157					seq_printf(seq,
3158					   " %2d:%-3d",
3159					   n, mfc->_c.mfc_un.res.ttls[n]);
3160			}
3161		} else {
3162			/* unresolved mfc_caches don't contain
3163			 * pkt, bytes and wrong_if values
3164			 */
3165			seq_printf(seq, " %8lu %8lu %8lu", 0ul, 0ul, 0ul);
3166		}
3167		seq_putc(seq, '\n');
3168	}
3169	return 0;
3170}
3171
3172static const struct seq_operations ipmr_mfc_seq_ops = {
3173	.start = ipmr_mfc_seq_start,
3174	.next  = mr_mfc_seq_next,
3175	.stop  = mr_mfc_seq_stop,
3176	.show  = ipmr_mfc_seq_show,
3177};
3178#endif
3179
3180#ifdef CONFIG_IP_PIMSM_V2
3181static const struct net_protocol pim_protocol = {
3182	.handler	=	pim_rcv,
3183};
3184#endif
3185
3186static unsigned int ipmr_seq_read(const struct net *net)
3187{
3188	return READ_ONCE(net->ipv4.ipmr_seq) + ipmr_rules_seq_read(net);
3189}
3190
3191static int ipmr_dump(struct net *net, struct notifier_block *nb,
3192		     struct netlink_ext_ack *extack)
3193{
3194	return mr_dump(net, nb, RTNL_FAMILY_IPMR, ipmr_rules_dump,
3195		       ipmr_mr_table_iter, extack);
3196}
3197
3198static const struct fib_notifier_ops ipmr_notifier_ops_template = {
3199	.family		= RTNL_FAMILY_IPMR,
3200	.fib_seq_read	= ipmr_seq_read,
3201	.fib_dump	= ipmr_dump,
3202	.owner		= THIS_MODULE,
3203};
3204
3205static int __net_init ipmr_notifier_init(struct net *net)
3206{
3207	struct fib_notifier_ops *ops;
3208
3209	net->ipv4.ipmr_seq = 0;
3210
3211	ops = fib_notifier_ops_register(&ipmr_notifier_ops_template, net);
3212	if (IS_ERR(ops))
3213		return PTR_ERR(ops);
3214	net->ipv4.ipmr_notifier_ops = ops;
3215
3216	return 0;
3217}
3218
3219static void __net_exit ipmr_notifier_exit(struct net *net)
3220{
3221	fib_notifier_ops_unregister(net->ipv4.ipmr_notifier_ops);
3222	net->ipv4.ipmr_notifier_ops = NULL;
3223}
3224
3225/* Setup for IP multicast routing */
3226static int __net_init ipmr_net_init(struct net *net)
3227{
3228	int err;
3229
3230	err = ipmr_notifier_init(net);
3231	if (err)
3232		goto ipmr_notifier_fail;
3233
3234	err = ipmr_rules_init(net);
3235	if (err < 0)
3236		goto ipmr_rules_fail;
3237
3238#ifdef CONFIG_PROC_FS
3239	err = -ENOMEM;
3240	if (!proc_create_net("ip_mr_vif", 0, net->proc_net, &ipmr_vif_seq_ops,
3241			sizeof(struct mr_vif_iter)))
3242		goto proc_vif_fail;
3243	if (!proc_create_net("ip_mr_cache", 0, net->proc_net, &ipmr_mfc_seq_ops,
3244			sizeof(struct mr_mfc_iter)))
3245		goto proc_cache_fail;
3246#endif
3247	return 0;
3248
3249#ifdef CONFIG_PROC_FS
3250proc_cache_fail:
3251	remove_proc_entry("ip_mr_vif", net->proc_net);
3252proc_vif_fail:
3253	rtnl_lock();
3254	ipmr_rules_exit(net);
3255	rtnl_unlock();
3256#endif
3257ipmr_rules_fail:
3258	ipmr_notifier_exit(net);
3259ipmr_notifier_fail:
3260	return err;
3261}
3262
3263static void __net_exit ipmr_net_exit(struct net *net)
3264{
3265#ifdef CONFIG_PROC_FS
3266	remove_proc_entry("ip_mr_cache", net->proc_net);
3267	remove_proc_entry("ip_mr_vif", net->proc_net);
3268#endif
3269	ipmr_notifier_exit(net);
3270}
3271
3272static void __net_exit ipmr_net_exit_batch(struct list_head *net_list)
3273{
3274	struct net *net;
3275
3276	rtnl_lock();
3277	list_for_each_entry(net, net_list, exit_list)
3278		ipmr_rules_exit(net);
3279	rtnl_unlock();
3280}
3281
3282static struct pernet_operations ipmr_net_ops = {
3283	.init = ipmr_net_init,
3284	.exit = ipmr_net_exit,
3285	.exit_batch = ipmr_net_exit_batch,
3286};
3287
3288static const struct rtnl_msg_handler ipmr_rtnl_msg_handlers[] __initconst = {
3289	{.protocol = RTNL_FAMILY_IPMR, .msgtype = RTM_GETLINK,
3290	 .dumpit = ipmr_rtm_dumplink},
3291	{.protocol = RTNL_FAMILY_IPMR, .msgtype = RTM_NEWROUTE,
3292	 .doit = ipmr_rtm_route},
3293	{.protocol = RTNL_FAMILY_IPMR, .msgtype = RTM_DELROUTE,
3294	 .doit = ipmr_rtm_route},
3295	{.protocol = RTNL_FAMILY_IPMR, .msgtype = RTM_GETROUTE,
3296	 .doit = ipmr_rtm_getroute, .dumpit = ipmr_rtm_dumproute},
3297};
3298
3299int __init ip_mr_init(void)
3300{
3301	int err;
3302
3303	mrt_cachep = KMEM_CACHE(mfc_cache, SLAB_HWCACHE_ALIGN | SLAB_PANIC);
3304
3305	err = register_pernet_subsys(&ipmr_net_ops);
3306	if (err)
3307		goto reg_pernet_fail;
3308
3309	err = register_netdevice_notifier(&ip_mr_notifier);
3310	if (err)
3311		goto reg_notif_fail;
3312#ifdef CONFIG_IP_PIMSM_V2
3313	if (inet_add_protocol(&pim_protocol, IPPROTO_PIM) < 0) {
3314		pr_err("%s: can't add PIM protocol\n", __func__);
3315		err = -EAGAIN;
3316		goto add_proto_fail;
3317	}
3318#endif
3319	rtnl_register_many(ipmr_rtnl_msg_handlers);
3320
3321	return 0;
3322
3323#ifdef CONFIG_IP_PIMSM_V2
3324add_proto_fail:
3325	unregister_netdevice_notifier(&ip_mr_notifier);
3326#endif
3327reg_notif_fail:
3328	unregister_pernet_subsys(&ipmr_net_ops);
3329reg_pernet_fail:
3330	kmem_cache_destroy(mrt_cachep);
3331	return err;
3332}