xref: /freebsd/sys/netinet6/in6_mcast.c (revision f9461246)
1fe267a55SPedro F. Giffuni /*-
2fe267a55SPedro F. Giffuni  * SPDX-License-Identifier: BSD-3-Clause
3fe267a55SPedro F. Giffuni  *
48f002c6cSBruce M Simpson  * Copyright (c) 2009 Bruce Simpson.
58f002c6cSBruce M Simpson  * All rights reserved.
68f002c6cSBruce M Simpson  *
78f002c6cSBruce M Simpson  * Redistribution and use in source and binary forms, with or without
88f002c6cSBruce M Simpson  * modification, are permitted provided that the following conditions
98f002c6cSBruce M Simpson  * are met:
108f002c6cSBruce M Simpson  * 1. Redistributions of source code must retain the above copyright
118f002c6cSBruce M Simpson  *    notice, this list of conditions and the following disclaimer.
128f002c6cSBruce M Simpson  * 2. Redistributions in binary form must reproduce the above copyright
138f002c6cSBruce M Simpson  *    notice, this list of conditions and the following disclaimer in the
148f002c6cSBruce M Simpson  *    documentation and/or other materials provided with the distribution.
158f002c6cSBruce M Simpson  * 3. The name of the author may not be used to endorse or promote
168f002c6cSBruce M Simpson  *    products derived from this software without specific prior written
178f002c6cSBruce M Simpson  *    permission.
188f002c6cSBruce M Simpson  *
198f002c6cSBruce M Simpson  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
208f002c6cSBruce M Simpson  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
218f002c6cSBruce M Simpson  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
228f002c6cSBruce M Simpson  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
238f002c6cSBruce M Simpson  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
248f002c6cSBruce M Simpson  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
258f002c6cSBruce M Simpson  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
268f002c6cSBruce M Simpson  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
278f002c6cSBruce M Simpson  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
288f002c6cSBruce M Simpson  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
298f002c6cSBruce M Simpson  * SUCH DAMAGE.
308f002c6cSBruce M Simpson  */
318f002c6cSBruce M Simpson 
328f002c6cSBruce M Simpson /*
338f002c6cSBruce M Simpson  * IPv6 multicast socket, group, and socket option processing module.
3433cde130SBruce M Simpson  * Normative references: RFC 2292, RFC 3492, RFC 3542, RFC 3678, RFC 3810.
358f002c6cSBruce M Simpson  */
368f002c6cSBruce M Simpson 
378f002c6cSBruce M Simpson #include <sys/cdefs.h>
388f002c6cSBruce M Simpson __FBSDID("$FreeBSD$");
398f002c6cSBruce M Simpson 
408f002c6cSBruce M Simpson #include "opt_inet6.h"
418f002c6cSBruce M Simpson 
428f002c6cSBruce M Simpson #include <sys/param.h>
438f002c6cSBruce M Simpson #include <sys/systm.h>
448f002c6cSBruce M Simpson #include <sys/kernel.h>
459b1d850bSMark Johnston #include <sys/ktr.h>
468f002c6cSBruce M Simpson #include <sys/malloc.h>
478f002c6cSBruce M Simpson #include <sys/mbuf.h>
488f002c6cSBruce M Simpson #include <sys/protosw.h>
498f002c6cSBruce M Simpson #include <sys/socket.h>
508f002c6cSBruce M Simpson #include <sys/socketvar.h>
518f002c6cSBruce M Simpson #include <sys/sysctl.h>
528f002c6cSBruce M Simpson #include <sys/priv.h>
539b1d850bSMark Johnston #include <sys/taskqueue.h>
548f002c6cSBruce M Simpson #include <sys/tree.h>
558f002c6cSBruce M Simpson 
568f002c6cSBruce M Simpson #include <net/if.h>
5776039bc8SGleb Smirnoff #include <net/if_var.h>
588f002c6cSBruce M Simpson #include <net/if_dl.h>
598f002c6cSBruce M Simpson #include <net/route.h>
606ad7446cSAlexander V. Chernikov #include <net/route/nhop.h>
618f002c6cSBruce M Simpson #include <net/vnet.h>
628f002c6cSBruce M Simpson 
638f002c6cSBruce M Simpson #include <netinet/in.h>
64f3e1324bSStephen Hurd #include <netinet/udp.h>
658f002c6cSBruce M Simpson #include <netinet/in_var.h>
66f3e1324bSStephen Hurd #include <netinet/ip_var.h>
67f3e1324bSStephen Hurd #include <netinet/udp_var.h>
689977be4aSAlexander V. Chernikov #include <netinet6/in6_fib.h>
698f002c6cSBruce M Simpson #include <netinet6/in6_var.h>
708f002c6cSBruce M Simpson #include <netinet/ip6.h>
718f002c6cSBruce M Simpson #include <netinet/icmp6.h>
728f002c6cSBruce M Simpson #include <netinet6/ip6_var.h>
738f002c6cSBruce M Simpson #include <netinet/in_pcb.h>
748f002c6cSBruce M Simpson #include <netinet/tcp_var.h>
758f002c6cSBruce M Simpson #include <netinet6/nd6.h>
768f002c6cSBruce M Simpson #include <netinet6/mld6_var.h>
77eddfbb76SRobert Watson #include <netinet6/scope6_var.h>
788f002c6cSBruce M Simpson 
798f002c6cSBruce M Simpson #ifndef KTR_MLD
808f002c6cSBruce M Simpson #define KTR_MLD KTR_INET6
818f002c6cSBruce M Simpson #endif
828f002c6cSBruce M Simpson 
838f002c6cSBruce M Simpson #ifndef __SOCKUNION_DECLARED
848f002c6cSBruce M Simpson union sockunion {
858f002c6cSBruce M Simpson 	struct sockaddr_storage	ss;
868f002c6cSBruce M Simpson 	struct sockaddr		sa;
878f002c6cSBruce M Simpson 	struct sockaddr_dl	sdl;
888f002c6cSBruce M Simpson 	struct sockaddr_in6	sin6;
898f002c6cSBruce M Simpson };
908f002c6cSBruce M Simpson typedef union sockunion sockunion_t;
918f002c6cSBruce M Simpson #define __SOCKUNION_DECLARED
928f002c6cSBruce M Simpson #endif /* __SOCKUNION_DECLARED */
938f002c6cSBruce M Simpson 
948f002c6cSBruce M Simpson static MALLOC_DEFINE(M_IN6MFILTER, "in6_mfilter",
958f002c6cSBruce M Simpson     "IPv6 multicast PCB-layer source filter");
96f3e1324bSStephen Hurd MALLOC_DEFINE(M_IP6MADDR, "in6_multi", "IPv6 multicast group");
978f002c6cSBruce M Simpson static MALLOC_DEFINE(M_IP6MOPTS, "ip6_moptions", "IPv6 multicast options");
988f002c6cSBruce M Simpson static MALLOC_DEFINE(M_IP6MSOURCE, "ip6_msource",
998f002c6cSBruce M Simpson     "IPv6 multicast MLD-layer source filter");
1008f002c6cSBruce M Simpson 
1018f002c6cSBruce M Simpson RB_GENERATE(ip6_msource_tree, ip6_msource, im6s_link, ip6_msource_cmp);
1028f002c6cSBruce M Simpson 
1038f002c6cSBruce M Simpson /*
1048f002c6cSBruce M Simpson  * Locking:
10559854ecfSHans Petter Selasky  * - Lock order is: Giant, IN6_MULTI_LOCK, INP_WLOCK,
10659854ecfSHans Petter Selasky  *   IN6_MULTI_LIST_LOCK, MLD_LOCK, IF_ADDR_LOCK.
1078f002c6cSBruce M Simpson  * - The IF_ADDR_LOCK is implicitly taken by in6m_lookup() earlier, however
1088f002c6cSBruce M Simpson  *   it can be taken by code in net/if.c also.
1098f002c6cSBruce M Simpson  * - ip6_moptions and in6_mfilter are covered by the INP_WLOCK.
1108f002c6cSBruce M Simpson  *
1118f002c6cSBruce M Simpson  * struct in6_multi is covered by IN6_MULTI_LOCK. There isn't strictly
1128f002c6cSBruce M Simpson  * any need for in6_multi itself to be virtualized -- it is bound to an ifp
1138f002c6cSBruce M Simpson  * anyway no matter what happens.
1148f002c6cSBruce M Simpson  */
115f3e1324bSStephen Hurd struct mtx in6_multi_list_mtx;
116f3e1324bSStephen Hurd MTX_SYSINIT(in6_multi_mtx, &in6_multi_list_mtx, "in6_multi_list_mtx", MTX_DEF);
117f3e1324bSStephen Hurd 
118f3e1324bSStephen Hurd struct mtx in6_multi_free_mtx;
119f3e1324bSStephen Hurd MTX_SYSINIT(in6_multi_free_mtx, &in6_multi_free_mtx, "in6_multi_free_mtx", MTX_DEF);
120f3e1324bSStephen Hurd 
121f3e1324bSStephen Hurd struct sx in6_multi_sx;
122f3e1324bSStephen Hurd SX_SYSINIT(in6_multi_sx, &in6_multi_sx, "in6_multi_sx");
123f3e1324bSStephen Hurd 
1248f002c6cSBruce M Simpson static void	im6f_commit(struct in6_mfilter *);
1258f002c6cSBruce M Simpson static int	im6f_get_source(struct in6_mfilter *imf,
1268f002c6cSBruce M Simpson 		    const struct sockaddr_in6 *psin,
1278f002c6cSBruce M Simpson 		    struct in6_msource **);
1288f002c6cSBruce M Simpson static struct in6_msource *
1298f002c6cSBruce M Simpson 		im6f_graft(struct in6_mfilter *, const uint8_t,
1308f002c6cSBruce M Simpson 		    const struct sockaddr_in6 *);
1318f002c6cSBruce M Simpson static void	im6f_leave(struct in6_mfilter *);
1328f002c6cSBruce M Simpson static int	im6f_prune(struct in6_mfilter *, const struct sockaddr_in6 *);
1338f002c6cSBruce M Simpson static void	im6f_purge(struct in6_mfilter *);
1348f002c6cSBruce M Simpson static void	im6f_rollback(struct in6_mfilter *);
1358f002c6cSBruce M Simpson static void	im6f_reap(struct in6_mfilter *);
13659854ecfSHans Petter Selasky static struct in6_mfilter *
13759854ecfSHans Petter Selasky 		im6o_match_group(const struct ip6_moptions *,
1388f002c6cSBruce M Simpson 		    const struct ifnet *, const struct sockaddr *);
1398f002c6cSBruce M Simpson static struct in6_msource *
14059854ecfSHans Petter Selasky 		im6o_match_source(struct in6_mfilter *, const struct sockaddr *);
1418f002c6cSBruce M Simpson static void	im6s_merge(struct ip6_msource *ims,
1428f002c6cSBruce M Simpson 		    const struct in6_msource *lims, const int rollback);
143f3e1324bSStephen Hurd static int	in6_getmulti(struct ifnet *, const struct in6_addr *,
1448f002c6cSBruce M Simpson 		    struct in6_multi **);
145e1891232SBjoern A. Zeeb static int	in6_joingroup_locked(struct ifnet *, const struct in6_addr *,
146e1891232SBjoern A. Zeeb 		    struct in6_mfilter *, struct in6_multi **, int);
1478f002c6cSBruce M Simpson static int	in6m_get_source(struct in6_multi *inm,
1488f002c6cSBruce M Simpson 		    const struct in6_addr *addr, const int noalloc,
1498f002c6cSBruce M Simpson 		    struct ip6_msource **pims);
1506c5a340eSDimitry Andric #ifdef KTR
1518f002c6cSBruce M Simpson static int	in6m_is_ifp_detached(const struct in6_multi *);
1526c5a340eSDimitry Andric #endif
1538f002c6cSBruce M Simpson static int	in6m_merge(struct in6_multi *, /*const*/ struct in6_mfilter *);
1548f002c6cSBruce M Simpson static void	in6m_purge(struct in6_multi *);
1558f002c6cSBruce M Simpson static void	in6m_reap(struct in6_multi *);
1568f002c6cSBruce M Simpson static struct ip6_moptions *
1578f002c6cSBruce M Simpson 		in6p_findmoptions(struct inpcb *);
1588f002c6cSBruce M Simpson static int	in6p_get_source_filters(struct inpcb *, struct sockopt *);
1598f002c6cSBruce M Simpson static int	in6p_join_group(struct inpcb *, struct sockopt *);
1608f002c6cSBruce M Simpson static int	in6p_leave_group(struct inpcb *, struct sockopt *);
16133cde130SBruce M Simpson static struct ifnet *
16233cde130SBruce M Simpson 		in6p_lookup_mcast_ifp(const struct inpcb *,
16333cde130SBruce M Simpson 		    const struct sockaddr_in6 *);
1648f002c6cSBruce M Simpson static int	in6p_block_unblock_source(struct inpcb *, struct sockopt *);
1658f002c6cSBruce M Simpson static int	in6p_set_multicast_if(struct inpcb *, struct sockopt *);
1668f002c6cSBruce M Simpson static int	in6p_set_source_filters(struct inpcb *, struct sockopt *);
1678f002c6cSBruce M Simpson static int	sysctl_ip6_mcast_filters(SYSCTL_HANDLER_ARGS);
1688f002c6cSBruce M Simpson 
1698f002c6cSBruce M Simpson SYSCTL_DECL(_net_inet6_ip6);	/* XXX Not in any common header. */
1708f002c6cSBruce M Simpson 
1717029da5cSPawel Biernacki static SYSCTL_NODE(_net_inet6_ip6, OID_AUTO, mcast,
1727029da5cSPawel Biernacki     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
1736472ac3dSEd Schouten     "IPv6 multicast");
1748f002c6cSBruce M Simpson 
1758f002c6cSBruce M Simpson static u_long in6_mcast_maxgrpsrc = IPV6_MAX_GROUP_SRC_FILTER;
1768f002c6cSBruce M Simpson SYSCTL_ULONG(_net_inet6_ip6_mcast, OID_AUTO, maxgrpsrc,
177af3b2549SHans Petter Selasky     CTLFLAG_RWTUN, &in6_mcast_maxgrpsrc, 0,
1788f002c6cSBruce M Simpson     "Max source filters per group");
1798f002c6cSBruce M Simpson 
1808f002c6cSBruce M Simpson static u_long in6_mcast_maxsocksrc = IPV6_MAX_SOCK_SRC_FILTER;
1818f002c6cSBruce M Simpson SYSCTL_ULONG(_net_inet6_ip6_mcast, OID_AUTO, maxsocksrc,
182af3b2549SHans Petter Selasky     CTLFLAG_RWTUN, &in6_mcast_maxsocksrc, 0,
1838f002c6cSBruce M Simpson     "Max source filters per socket");
1848f002c6cSBruce M Simpson 
1858f002c6cSBruce M Simpson /* TODO Virtualize this switch. */
1868f002c6cSBruce M Simpson int in6_mcast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
187af3b2549SHans Petter Selasky SYSCTL_INT(_net_inet6_ip6_mcast, OID_AUTO, loop, CTLFLAG_RWTUN,
1888f002c6cSBruce M Simpson     &in6_mcast_loop, 0, "Loopback multicast datagrams by default");
1898f002c6cSBruce M Simpson 
1906472ac3dSEd Schouten static SYSCTL_NODE(_net_inet6_ip6_mcast, OID_AUTO, filters,
1918f002c6cSBruce M Simpson     CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_ip6_mcast_filters,
1928f002c6cSBruce M Simpson     "Per-interface stack-wide source filters");
1938f002c6cSBruce M Simpson 
1946c5a340eSDimitry Andric #ifdef KTR
1958f002c6cSBruce M Simpson /*
1968f002c6cSBruce M Simpson  * Inline function which wraps assertions for a valid ifp.
1978f002c6cSBruce M Simpson  * The ifnet layer will set the ifma's ifp pointer to NULL if the ifp
1988f002c6cSBruce M Simpson  * is detached.
1998f002c6cSBruce M Simpson  */
2008f002c6cSBruce M Simpson static int __inline
2018f002c6cSBruce M Simpson in6m_is_ifp_detached(const struct in6_multi *inm)
2028f002c6cSBruce M Simpson {
2038f002c6cSBruce M Simpson 	struct ifnet *ifp;
2048f002c6cSBruce M Simpson 
2058f002c6cSBruce M Simpson 	KASSERT(inm->in6m_ifma != NULL, ("%s: no ifma", __func__));
2068f002c6cSBruce M Simpson 	ifp = inm->in6m_ifma->ifma_ifp;
2078f002c6cSBruce M Simpson 	if (ifp != NULL) {
2088f002c6cSBruce M Simpson 		/*
2098f002c6cSBruce M Simpson 		 * Sanity check that network-layer notion of ifp is the
2108f002c6cSBruce M Simpson 		 * same as that of link-layer.
2118f002c6cSBruce M Simpson 		 */
2128f002c6cSBruce M Simpson 		KASSERT(inm->in6m_ifp == ifp, ("%s: bad ifp", __func__));
2138f002c6cSBruce M Simpson 	}
2148f002c6cSBruce M Simpson 
2158f002c6cSBruce M Simpson 	return (ifp == NULL);
2168f002c6cSBruce M Simpson }
2176c5a340eSDimitry Andric #endif
2188f002c6cSBruce M Simpson 
2198f002c6cSBruce M Simpson /*
2208f002c6cSBruce M Simpson  * Initialize an in6_mfilter structure to a known state at t0, t1
2218f002c6cSBruce M Simpson  * with an empty source filter list.
2228f002c6cSBruce M Simpson  */
2238f002c6cSBruce M Simpson static __inline void
2248f002c6cSBruce M Simpson im6f_init(struct in6_mfilter *imf, const int st0, const int st1)
2258f002c6cSBruce M Simpson {
2268f002c6cSBruce M Simpson 	memset(imf, 0, sizeof(struct in6_mfilter));
2278f002c6cSBruce M Simpson 	RB_INIT(&imf->im6f_sources);
2288f002c6cSBruce M Simpson 	imf->im6f_st[0] = st0;
2298f002c6cSBruce M Simpson 	imf->im6f_st[1] = st1;
2308f002c6cSBruce M Simpson }
2318f002c6cSBruce M Simpson 
23259854ecfSHans Petter Selasky struct in6_mfilter *
23359854ecfSHans Petter Selasky ip6_mfilter_alloc(const int mflags, const int st0, const int st1)
2348f002c6cSBruce M Simpson {
23559854ecfSHans Petter Selasky 	struct in6_mfilter *imf;
2368f002c6cSBruce M Simpson 
23759854ecfSHans Petter Selasky 	imf = malloc(sizeof(*imf), M_IN6MFILTER, mflags);
2388f002c6cSBruce M Simpson 
23959854ecfSHans Petter Selasky 	if (imf != NULL)
24059854ecfSHans Petter Selasky 		im6f_init(imf, st0, st1);
24159854ecfSHans Petter Selasky 
24259854ecfSHans Petter Selasky 	return (imf);
2438f002c6cSBruce M Simpson }
2448f002c6cSBruce M Simpson 
24559854ecfSHans Petter Selasky void
24659854ecfSHans Petter Selasky ip6_mfilter_free(struct in6_mfilter *imf)
24759854ecfSHans Petter Selasky {
2488f002c6cSBruce M Simpson 
24959854ecfSHans Petter Selasky 	im6f_purge(imf);
25059854ecfSHans Petter Selasky 	free(imf, M_IN6MFILTER);
2518f002c6cSBruce M Simpson }
2528f002c6cSBruce M Simpson 
2538f002c6cSBruce M Simpson /*
2548f002c6cSBruce M Simpson  * Find an IPv6 multicast group entry for this ip6_moptions instance
2558f002c6cSBruce M Simpson  * which matches the specified group, and optionally an interface.
2568f002c6cSBruce M Simpson  * Return its index into the array, or -1 if not found.
2578f002c6cSBruce M Simpson  */
25859854ecfSHans Petter Selasky static struct in6_mfilter *
2598f002c6cSBruce M Simpson im6o_match_group(const struct ip6_moptions *imo, const struct ifnet *ifp,
2608f002c6cSBruce M Simpson     const struct sockaddr *group)
2618f002c6cSBruce M Simpson {
2628f002c6cSBruce M Simpson 	const struct sockaddr_in6 *gsin6;
26359854ecfSHans Petter Selasky         struct in6_mfilter *imf;
26459854ecfSHans Petter Selasky         struct in6_multi *inm;
2658f002c6cSBruce M Simpson 
2668f002c6cSBruce M Simpson         gsin6 = (const struct sockaddr_in6 *)group;
2678f002c6cSBruce M Simpson 
26859854ecfSHans Petter Selasky 	IP6_MFILTER_FOREACH(imf, &imo->im6o_head) {
26959854ecfSHans Petter Selasky 		inm = imf->im6f_in6m;
27059854ecfSHans Petter Selasky 		if (inm == NULL)
2718f002c6cSBruce M Simpson 			continue;
27259854ecfSHans Petter Selasky 		if ((ifp == NULL || (inm->in6m_ifp == ifp)) &&
27359854ecfSHans Petter Selasky 		    IN6_ARE_ADDR_EQUAL(&inm->in6m_addr,
2748f002c6cSBruce M Simpson 		    &gsin6->sin6_addr)) {
2758f002c6cSBruce M Simpson 			break;
2768f002c6cSBruce M Simpson 		}
2778f002c6cSBruce M Simpson 	}
27859854ecfSHans Petter Selasky 	return (imf);
2798f002c6cSBruce M Simpson }
2808f002c6cSBruce M Simpson 
2818f002c6cSBruce M Simpson /*
2828f002c6cSBruce M Simpson  * Find an IPv6 multicast source entry for this imo which matches
2838f002c6cSBruce M Simpson  * the given group index for this socket, and source address.
2848f002c6cSBruce M Simpson  *
28529dc7bc6SBruce M Simpson  * XXX TODO: The scope ID, if present in src, is stripped before
28629dc7bc6SBruce M Simpson  * any comparison. We SHOULD enforce scope/zone checks where the source
28729dc7bc6SBruce M Simpson  * filter entry has a link scope.
28829dc7bc6SBruce M Simpson  *
2898f002c6cSBruce M Simpson  * NOTE: This does not check if the entry is in-mode, merely if
2908f002c6cSBruce M Simpson  * it exists, which may not be the desired behaviour.
2918f002c6cSBruce M Simpson  */
2928f002c6cSBruce M Simpson static struct in6_msource *
29359854ecfSHans Petter Selasky im6o_match_source(struct in6_mfilter *imf, const struct sockaddr *src)
2948f002c6cSBruce M Simpson {
2958f002c6cSBruce M Simpson 	struct ip6_msource	 find;
2968f002c6cSBruce M Simpson 	struct ip6_msource	*ims;
2978f002c6cSBruce M Simpson 	const sockunion_t	*psa;
2988f002c6cSBruce M Simpson 
2998f002c6cSBruce M Simpson 	KASSERT(src->sa_family == AF_INET6, ("%s: !AF_INET6", __func__));
3008f002c6cSBruce M Simpson 
3018f002c6cSBruce M Simpson 	psa = (const sockunion_t *)src;
3028f002c6cSBruce M Simpson 	find.im6s_addr = psa->sin6.sin6_addr;
30329dc7bc6SBruce M Simpson 	in6_clearscope(&find.im6s_addr);		/* XXX */
3048f002c6cSBruce M Simpson 	ims = RB_FIND(ip6_msource_tree, &imf->im6f_sources, &find);
3058f002c6cSBruce M Simpson 
3068f002c6cSBruce M Simpson 	return ((struct in6_msource *)ims);
3078f002c6cSBruce M Simpson }
3088f002c6cSBruce M Simpson 
3098f002c6cSBruce M Simpson /*
3108f002c6cSBruce M Simpson  * Perform filtering for multicast datagrams on a socket by group and source.
3118f002c6cSBruce M Simpson  *
3128f002c6cSBruce M Simpson  * Returns 0 if a datagram should be allowed through, or various error codes
3138f002c6cSBruce M Simpson  * if the socket was not a member of the group, or the source was muted, etc.
3148f002c6cSBruce M Simpson  */
3158f002c6cSBruce M Simpson int
3168f002c6cSBruce M Simpson im6o_mc_filter(const struct ip6_moptions *imo, const struct ifnet *ifp,
3178f002c6cSBruce M Simpson     const struct sockaddr *group, const struct sockaddr *src)
3188f002c6cSBruce M Simpson {
31959854ecfSHans Petter Selasky 	struct in6_mfilter *imf;
3208f002c6cSBruce M Simpson 	struct in6_msource *ims;
3218f002c6cSBruce M Simpson 	int mode;
3228f002c6cSBruce M Simpson 
3238f002c6cSBruce M Simpson 	KASSERT(ifp != NULL, ("%s: null ifp", __func__));
3248f002c6cSBruce M Simpson 
32559854ecfSHans Petter Selasky 	imf = im6o_match_group(imo, ifp, group);
32659854ecfSHans Petter Selasky 	if (imf == NULL)
3278f002c6cSBruce M Simpson 		return (MCAST_NOTGMEMBER);
3288f002c6cSBruce M Simpson 
3298f002c6cSBruce M Simpson 	/*
3308f002c6cSBruce M Simpson 	 * Check if the source was included in an (S,G) join.
3318f002c6cSBruce M Simpson 	 * Allow reception on exclusive memberships by default,
3328f002c6cSBruce M Simpson 	 * reject reception on inclusive memberships by default.
3338f002c6cSBruce M Simpson 	 * Exclude source only if an in-mode exclude filter exists.
3348f002c6cSBruce M Simpson 	 * Include source only if an in-mode include filter exists.
3358f002c6cSBruce M Simpson 	 * NOTE: We are comparing group state here at MLD t1 (now)
3368f002c6cSBruce M Simpson 	 * with socket-layer t0 (since last downcall).
3378f002c6cSBruce M Simpson 	 */
33859854ecfSHans Petter Selasky 	mode = imf->im6f_st[1];
33959854ecfSHans Petter Selasky 	ims = im6o_match_source(imf, src);
3408f002c6cSBruce M Simpson 
3418f002c6cSBruce M Simpson 	if ((ims == NULL && mode == MCAST_INCLUDE) ||
3428f002c6cSBruce M Simpson 	    (ims != NULL && ims->im6sl_st[0] != mode))
3438f002c6cSBruce M Simpson 		return (MCAST_NOTSMEMBER);
3448f002c6cSBruce M Simpson 
3458f002c6cSBruce M Simpson 	return (MCAST_PASS);
3468f002c6cSBruce M Simpson }
3478f002c6cSBruce M Simpson 
3488f002c6cSBruce M Simpson /*
3498f002c6cSBruce M Simpson  * Find and return a reference to an in6_multi record for (ifp, group),
3508f002c6cSBruce M Simpson  * and bump its reference count.
3518f002c6cSBruce M Simpson  * If one does not exist, try to allocate it, and update link-layer multicast
3528f002c6cSBruce M Simpson  * filters on ifp to listen for group.
3538f002c6cSBruce M Simpson  * Assumes the IN6_MULTI lock is held across the call.
3548f002c6cSBruce M Simpson  * Return 0 if successful, otherwise return an appropriate error code.
3558f002c6cSBruce M Simpson  */
3568f002c6cSBruce M Simpson static int
357f3e1324bSStephen Hurd in6_getmulti(struct ifnet *ifp, const struct in6_addr *group,
3588f002c6cSBruce M Simpson     struct in6_multi **pinm)
3598f002c6cSBruce M Simpson {
3602cd6ad76SHans Petter Selasky 	struct epoch_tracker	 et;
3618f002c6cSBruce M Simpson 	struct sockaddr_in6	 gsin6;
3628f002c6cSBruce M Simpson 	struct ifmultiaddr	*ifma;
3638f002c6cSBruce M Simpson 	struct in6_multi	*inm;
3648f002c6cSBruce M Simpson 	int			 error;
3658f002c6cSBruce M Simpson 
3668f002c6cSBruce M Simpson 	error = 0;
3678f002c6cSBruce M Simpson 
3688f002c6cSBruce M Simpson 	/*
3698f002c6cSBruce M Simpson 	 * XXX: Accesses to ifma_protospec must be covered by IF_ADDR_LOCK;
3708f002c6cSBruce M Simpson 	 * if_addmulti() takes this mutex itself, so we must drop and
3718f002c6cSBruce M Simpson 	 * re-acquire around the call.
3728f002c6cSBruce M Simpson 	 */
3738f002c6cSBruce M Simpson 	IN6_MULTI_LOCK_ASSERT();
374f3e1324bSStephen Hurd 	IN6_MULTI_LIST_LOCK();
375137f91e8SJohn Baldwin 	IF_ADDR_WLOCK(ifp);
3762cd6ad76SHans Petter Selasky 	NET_EPOCH_ENTER(et);
3778f002c6cSBruce M Simpson 	inm = in6m_lookup_locked(ifp, group);
3782cd6ad76SHans Petter Selasky 	NET_EPOCH_EXIT(et);
3792cd6ad76SHans Petter Selasky 
3808f002c6cSBruce M Simpson 	if (inm != NULL) {
3818f002c6cSBruce M Simpson 		/*
3828f002c6cSBruce M Simpson 		 * If we already joined this group, just bump the
3838f002c6cSBruce M Simpson 		 * refcount and return it.
3848f002c6cSBruce M Simpson 		 */
3858f002c6cSBruce M Simpson 		KASSERT(inm->in6m_refcount >= 1,
3868f002c6cSBruce M Simpson 		    ("%s: bad refcount %d", __func__, inm->in6m_refcount));
387f3e1324bSStephen Hurd 		in6m_acquire_locked(inm);
3888f002c6cSBruce M Simpson 		*pinm = inm;
3898f002c6cSBruce M Simpson 		goto out_locked;
3908f002c6cSBruce M Simpson 	}
3918f002c6cSBruce M Simpson 
3928f002c6cSBruce M Simpson 	memset(&gsin6, 0, sizeof(gsin6));
3938f002c6cSBruce M Simpson 	gsin6.sin6_family = AF_INET6;
3948f002c6cSBruce M Simpson 	gsin6.sin6_len = sizeof(struct sockaddr_in6);
3958f002c6cSBruce M Simpson 	gsin6.sin6_addr = *group;
3968f002c6cSBruce M Simpson 
3978f002c6cSBruce M Simpson 	/*
3988f002c6cSBruce M Simpson 	 * Check if a link-layer group is already associated
3998f002c6cSBruce M Simpson 	 * with this network-layer group on the given ifnet.
4008f002c6cSBruce M Simpson 	 */
401f3e1324bSStephen Hurd 	IN6_MULTI_LIST_UNLOCK();
402137f91e8SJohn Baldwin 	IF_ADDR_WUNLOCK(ifp);
4038f002c6cSBruce M Simpson 	error = if_addmulti(ifp, (struct sockaddr *)&gsin6, &ifma);
4048f002c6cSBruce M Simpson 	if (error != 0)
4058f002c6cSBruce M Simpson 		return (error);
406f3e1324bSStephen Hurd 	IN6_MULTI_LIST_LOCK();
407137f91e8SJohn Baldwin 	IF_ADDR_WLOCK(ifp);
4088f002c6cSBruce M Simpson 
4098f002c6cSBruce M Simpson 	/*
4108f002c6cSBruce M Simpson 	 * If something other than netinet6 is occupying the link-layer
4118f002c6cSBruce M Simpson 	 * group, print a meaningful error message and back out of
4128f002c6cSBruce M Simpson 	 * the allocation.
4138f002c6cSBruce M Simpson 	 * Otherwise, bump the refcount on the existing network-layer
4148f002c6cSBruce M Simpson 	 * group association and return it.
4158f002c6cSBruce M Simpson 	 */
4168f002c6cSBruce M Simpson 	if (ifma->ifma_protospec != NULL) {
4178f002c6cSBruce M Simpson 		inm = (struct in6_multi *)ifma->ifma_protospec;
4188f002c6cSBruce M Simpson #ifdef INVARIANTS
4198f002c6cSBruce M Simpson 		KASSERT(ifma->ifma_addr != NULL, ("%s: no ifma_addr",
4208f002c6cSBruce M Simpson 		    __func__));
4218f002c6cSBruce M Simpson 		KASSERT(ifma->ifma_addr->sa_family == AF_INET6,
4228f002c6cSBruce M Simpson 		    ("%s: ifma not AF_INET6", __func__));
4238f002c6cSBruce M Simpson 		KASSERT(inm != NULL, ("%s: no ifma_protospec", __func__));
4248f002c6cSBruce M Simpson 		if (inm->in6m_ifma != ifma || inm->in6m_ifp != ifp ||
4258f002c6cSBruce M Simpson 		    !IN6_ARE_ADDR_EQUAL(&inm->in6m_addr, group))
4268f002c6cSBruce M Simpson 			panic("%s: ifma %p is inconsistent with %p (%p)",
4278f002c6cSBruce M Simpson 			    __func__, ifma, inm, group);
4288f002c6cSBruce M Simpson #endif
429f3e1324bSStephen Hurd 		in6m_acquire_locked(inm);
4308f002c6cSBruce M Simpson 		*pinm = inm;
4318f002c6cSBruce M Simpson 		goto out_locked;
4328f002c6cSBruce M Simpson 	}
4338f002c6cSBruce M Simpson 
434137f91e8SJohn Baldwin 	IF_ADDR_WLOCK_ASSERT(ifp);
4358f002c6cSBruce M Simpson 
4368f002c6cSBruce M Simpson 	/*
4378f002c6cSBruce M Simpson 	 * A new in6_multi record is needed; allocate and initialize it.
4388f002c6cSBruce M Simpson 	 * We DO NOT perform an MLD join as the in6_ layer may need to
4398f002c6cSBruce M Simpson 	 * push an initial source list down to MLD to support SSM.
4408f002c6cSBruce M Simpson 	 *
4418f002c6cSBruce M Simpson 	 * The initial source filter state is INCLUDE, {} as per the RFC.
4428f002c6cSBruce M Simpson 	 * Pending state-changes per group are subject to a bounds check.
4438f002c6cSBruce M Simpson 	 */
4448f002c6cSBruce M Simpson 	inm = malloc(sizeof(*inm), M_IP6MADDR, M_NOWAIT | M_ZERO);
4458f002c6cSBruce M Simpson 	if (inm == NULL) {
446f3e1324bSStephen Hurd 		IN6_MULTI_LIST_UNLOCK();
44755faae77SConrad Meyer 		IF_ADDR_WUNLOCK(ifp);
4488f002c6cSBruce M Simpson 		if_delmulti_ifma(ifma);
44955faae77SConrad Meyer 		return (ENOMEM);
4508f002c6cSBruce M Simpson 	}
4518f002c6cSBruce M Simpson 	inm->in6m_addr = *group;
4528f002c6cSBruce M Simpson 	inm->in6m_ifp = ifp;
4538f002c6cSBruce M Simpson 	inm->in6m_mli = MLD_IFINFO(ifp);
4548f002c6cSBruce M Simpson 	inm->in6m_ifma = ifma;
4558f002c6cSBruce M Simpson 	inm->in6m_refcount = 1;
4568f002c6cSBruce M Simpson 	inm->in6m_state = MLD_NOT_MEMBER;
457a99c84d4SGleb Smirnoff 	mbufq_init(&inm->in6m_scq, MLD_MAX_STATE_CHANGES);
4588f002c6cSBruce M Simpson 
4598f002c6cSBruce M Simpson 	inm->in6m_st[0].iss_fmode = MCAST_UNDEFINED;
4608f002c6cSBruce M Simpson 	inm->in6m_st[1].iss_fmode = MCAST_UNDEFINED;
4618f002c6cSBruce M Simpson 	RB_INIT(&inm->in6m_srcs);
4628f002c6cSBruce M Simpson 
4638f002c6cSBruce M Simpson 	ifma->ifma_protospec = inm;
4648f002c6cSBruce M Simpson 	*pinm = inm;
4658f002c6cSBruce M Simpson 
4668f002c6cSBruce M Simpson  out_locked:
467f3e1324bSStephen Hurd 	IN6_MULTI_LIST_UNLOCK();
468137f91e8SJohn Baldwin 	IF_ADDR_WUNLOCK(ifp);
4698f002c6cSBruce M Simpson 	return (error);
4708f002c6cSBruce M Simpson }
4718f002c6cSBruce M Simpson 
4728f002c6cSBruce M Simpson /*
4738f002c6cSBruce M Simpson  * Drop a reference to an in6_multi record.
4748f002c6cSBruce M Simpson  *
4758f002c6cSBruce M Simpson  * If the refcount drops to 0, free the in6_multi record and
4768f002c6cSBruce M Simpson  * delete the underlying link-layer membership.
4778f002c6cSBruce M Simpson  */
478f3e1324bSStephen Hurd static void
479f3e1324bSStephen Hurd in6m_release(struct in6_multi *inm)
4808f002c6cSBruce M Simpson {
4818f002c6cSBruce M Simpson 	struct ifmultiaddr *ifma;
482f3e1324bSStephen Hurd 	struct ifnet *ifp;
4838f002c6cSBruce M Simpson 
4848f002c6cSBruce M Simpson 	CTR2(KTR_MLD, "%s: refcount is %d", __func__, inm->in6m_refcount);
4858f002c6cSBruce M Simpson 
486f3e1324bSStephen Hurd 	MPASS(inm->in6m_refcount == 0);
4878f002c6cSBruce M Simpson 	CTR2(KTR_MLD, "%s: freeing inm %p", __func__, inm);
4888f002c6cSBruce M Simpson 
4898f002c6cSBruce M Simpson 	ifma = inm->in6m_ifma;
490f3e1324bSStephen Hurd 	ifp = inm->in6m_ifp;
491b6f6f880SMatt Macy 	MPASS(ifma->ifma_llifma == NULL);
4928f002c6cSBruce M Simpson 
4938f002c6cSBruce M Simpson 	/* XXX this access is not covered by IF_ADDR_LOCK */
4948f002c6cSBruce M Simpson 	CTR2(KTR_MLD, "%s: purging ifma %p", __func__, ifma);
495f3e1324bSStephen Hurd 	KASSERT(ifma->ifma_protospec == NULL,
496f3e1324bSStephen Hurd 	    ("%s: ifma_protospec != NULL", __func__));
497f9be0386SMatt Macy 	if (ifp == NULL)
498f9be0386SMatt Macy 		ifp = ifma->ifma_ifp;
4998f002c6cSBruce M Simpson 
5003b9b6b17SEd Maste 	if (ifp != NULL) {
50115f8acc5SEd Maste 		CURVNET_SET(ifp->if_vnet);
5028f002c6cSBruce M Simpson 		in6m_purge(inm);
5038f002c6cSBruce M Simpson 		free(inm, M_IP6MADDR);
504b6f6f880SMatt Macy 		if_delmulti_ifma_flags(ifma, 1);
50515f8acc5SEd Maste 		CURVNET_RESTORE();
506b6f6f880SMatt Macy 		if_rele(ifp);
5073b9b6b17SEd Maste 	} else {
5083b9b6b17SEd Maste 		in6m_purge(inm);
5093b9b6b17SEd Maste 		free(inm, M_IP6MADDR);
5103b9b6b17SEd Maste 		if_delmulti_ifma_flags(ifma, 1);
511b6f6f880SMatt Macy 	}
512f3e1324bSStephen Hurd }
513f3e1324bSStephen Hurd 
514431f2b87SMark Johnston /*
515431f2b87SMark Johnston  * Interface detach can happen in a taskqueue thread context, so we must use a
516431f2b87SMark Johnston  * dedicated thread to avoid deadlocks when draining in6m_release tasks.
517431f2b87SMark Johnston  */
518431f2b87SMark Johnston TASKQUEUE_DEFINE_THREAD(in6m_free);
519431f2b87SMark Johnston static struct task in6m_free_task;
5209b1d850bSMark Johnston static struct in6_multi_head in6m_free_list = SLIST_HEAD_INITIALIZER();
5219b1d850bSMark Johnston static void in6m_release_task(void *arg __unused, int pending __unused);
5229b1d850bSMark Johnston 
5239b1d850bSMark Johnston static void
524a95ef9d3SHans Petter Selasky in6m_init(void *arg __unused)
525f3e1324bSStephen Hurd {
526431f2b87SMark Johnston 	TASK_INIT(&in6m_free_task, 0, in6m_release_task, NULL);
527f3e1324bSStephen Hurd }
5289b1d850bSMark Johnston SYSINIT(in6m_init, SI_SUB_TASKQ, SI_ORDER_ANY, in6m_init, NULL);
529f3e1324bSStephen Hurd 
530f3e1324bSStephen Hurd void
531f3e1324bSStephen Hurd in6m_release_list_deferred(struct in6_multi_head *inmh)
532f3e1324bSStephen Hurd {
533f3e1324bSStephen Hurd 	if (SLIST_EMPTY(inmh))
534f3e1324bSStephen Hurd 		return;
535f3e1324bSStephen Hurd 	mtx_lock(&in6_multi_free_mtx);
536f3e1324bSStephen Hurd 	SLIST_CONCAT(&in6m_free_list, inmh, in6_multi, in6m_nrele);
537f3e1324bSStephen Hurd 	mtx_unlock(&in6_multi_free_mtx);
538431f2b87SMark Johnston 	taskqueue_enqueue(taskqueue_in6m_free, &in6m_free_task);
539f3e1324bSStephen Hurd }
540f3e1324bSStephen Hurd 
541f3e1324bSStephen Hurd void
5423689652cSHans Petter Selasky in6m_release_wait(void *arg __unused)
543dea72f06SHans Petter Selasky {
5443689652cSHans Petter Selasky 
5453689652cSHans Petter Selasky 	/*
5463689652cSHans Petter Selasky 	 * Make sure all pending multicast addresses are freed before
5473689652cSHans Petter Selasky 	 * the VNET or network device is destroyed:
5483689652cSHans Petter Selasky 	 */
549431f2b87SMark Johnston 	taskqueue_drain_all(taskqueue_in6m_free);
550dea72f06SHans Petter Selasky }
5513689652cSHans Petter Selasky #ifdef VIMAGE
552f9461246SBjoern A. Zeeb /* XXX-BZ FIXME, see D24914. */
5533689652cSHans Petter Selasky VNET_SYSUNINIT(in6m_release_wait, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST, in6m_release_wait, NULL);
5543689652cSHans Petter Selasky #endif
555dea72f06SHans Petter Selasky 
556dea72f06SHans Petter Selasky void
5572cd6ad76SHans Petter Selasky in6m_disconnect_locked(struct in6_multi_head *inmh, struct in6_multi *inm)
558f3e1324bSStephen Hurd {
559f3e1324bSStephen Hurd 	struct ifnet *ifp;
560f3e1324bSStephen Hurd 	struct ifaddr *ifa;
561f3e1324bSStephen Hurd 	struct in6_ifaddr *ifa6;
56266fe09d8SAndrew Gallatin 	struct in6_multi_mship *imm, *imm_tmp;
563b6f6f880SMatt Macy 	struct ifmultiaddr *ifma, *ll_ifma;
564f3e1324bSStephen Hurd 
5652cd6ad76SHans Petter Selasky 	IN6_MULTI_LIST_LOCK_ASSERT();
566f9be0386SMatt Macy 
5672cd6ad76SHans Petter Selasky 	ifp = inm->in6m_ifp;
568f9be0386SMatt Macy 	if (ifp == NULL)
5692cd6ad76SHans Petter Selasky 		return;		/* already called */
5702cd6ad76SHans Petter Selasky 
571f9be0386SMatt Macy 	inm->in6m_ifp = NULL;
572b6f6f880SMatt Macy 	IF_ADDR_WLOCK_ASSERT(ifp);
573b6f6f880SMatt Macy 	ifma = inm->in6m_ifma;
574f9be0386SMatt Macy 	if (ifma == NULL)
575f9be0386SMatt Macy 		return;
576b6f6f880SMatt Macy 
577b6f6f880SMatt Macy 	if_ref(ifp);
578f9be0386SMatt Macy 	if (ifma->ifma_flags & IFMA_F_ENQUEUED) {
579d7c5a620SMatt Macy 		CK_STAILQ_REMOVE(&ifp->if_multiaddrs, ifma, ifmultiaddr, ifma_link);
580f9be0386SMatt Macy 		ifma->ifma_flags &= ~IFMA_F_ENQUEUED;
581f9be0386SMatt Macy 	}
582b6f6f880SMatt Macy 	MCDPRINTF("removed ifma: %p from %s\n", ifma, ifp->if_xname);
583b6f6f880SMatt Macy 	if ((ll_ifma = ifma->ifma_llifma) != NULL) {
584b6f6f880SMatt Macy 		MPASS(ifma != ll_ifma);
585b6f6f880SMatt Macy 		ifma->ifma_llifma = NULL;
586b6f6f880SMatt Macy 		MPASS(ll_ifma->ifma_llifma == NULL);
587b6f6f880SMatt Macy 		MPASS(ll_ifma->ifma_ifp == ifp);
588b6f6f880SMatt Macy 		if (--ll_ifma->ifma_refcount == 0) {
589f9be0386SMatt Macy 			if (ll_ifma->ifma_flags & IFMA_F_ENQUEUED) {
590d7c5a620SMatt Macy 				CK_STAILQ_REMOVE(&ifp->if_multiaddrs, ll_ifma, ifmultiaddr, ifma_link);
591d3878608SMatt Macy 				ll_ifma->ifma_flags &= ~IFMA_F_ENQUEUED;
592f9be0386SMatt Macy 			}
593b6f6f880SMatt Macy 			MCDPRINTF("removed ll_ifma: %p from %s\n", ll_ifma, ifp->if_xname);
594b6f6f880SMatt Macy 			if_freemulti(ll_ifma);
595b6f6f880SMatt Macy 		}
596b6f6f880SMatt Macy 	}
597d7c5a620SMatt Macy 	CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
598f3e1324bSStephen Hurd 		if (ifa->ifa_addr->sa_family != AF_INET6)
599f3e1324bSStephen Hurd 			continue;
600f3e1324bSStephen Hurd 		ifa6 = (void *)ifa;
60166fe09d8SAndrew Gallatin 		LIST_FOREACH_SAFE(imm, &ifa6->ia6_memberships,
60266fe09d8SAndrew Gallatin 		    i6mm_chain, imm_tmp) {
603b6f6f880SMatt Macy 			if (inm == imm->i6mm_maddr) {
604b6f6f880SMatt Macy 				LIST_REMOVE(imm, i6mm_chain);
605b6f6f880SMatt Macy 				free(imm, M_IP6MADDR);
6062cd6ad76SHans Petter Selasky 				in6m_rele_locked(inmh, inm);
607f3e1324bSStephen Hurd 			}
608f3e1324bSStephen Hurd 		}
609b6f6f880SMatt Macy 	}
610b6f6f880SMatt Macy }
611b6f6f880SMatt Macy 
612f3e1324bSStephen Hurd static void
6139b1d850bSMark Johnston in6m_release_task(void *arg __unused, int pending __unused)
614f3e1324bSStephen Hurd {
615f3e1324bSStephen Hurd 	struct in6_multi_head in6m_free_tmp;
616f3e1324bSStephen Hurd 	struct in6_multi *inm, *tinm;
617f3e1324bSStephen Hurd 
618f3e1324bSStephen Hurd 	SLIST_INIT(&in6m_free_tmp);
619f3e1324bSStephen Hurd 	mtx_lock(&in6_multi_free_mtx);
620f3e1324bSStephen Hurd 	SLIST_CONCAT(&in6m_free_tmp, &in6m_free_list, in6_multi, in6m_nrele);
621f3e1324bSStephen Hurd 	mtx_unlock(&in6_multi_free_mtx);
622f3e1324bSStephen Hurd 	IN6_MULTI_LOCK();
623f3e1324bSStephen Hurd 	SLIST_FOREACH_SAFE(inm, &in6m_free_tmp, in6m_nrele, tinm) {
624f3e1324bSStephen Hurd 		SLIST_REMOVE_HEAD(&in6m_free_tmp, in6m_nrele);
625f3e1324bSStephen Hurd 		in6m_release(inm);
626f3e1324bSStephen Hurd 	}
627f3e1324bSStephen Hurd 	IN6_MULTI_UNLOCK();
6288f002c6cSBruce M Simpson }
6298f002c6cSBruce M Simpson 
6308f002c6cSBruce M Simpson /*
6318f002c6cSBruce M Simpson  * Clear recorded source entries for a group.
6328f002c6cSBruce M Simpson  * Used by the MLD code. Caller must hold the IN6_MULTI lock.
6338f002c6cSBruce M Simpson  * FIXME: Should reap.
6348f002c6cSBruce M Simpson  */
6358f002c6cSBruce M Simpson void
6368f002c6cSBruce M Simpson in6m_clear_recorded(struct in6_multi *inm)
6378f002c6cSBruce M Simpson {
6388f002c6cSBruce M Simpson 	struct ip6_msource	*ims;
6398f002c6cSBruce M Simpson 
640f3e1324bSStephen Hurd 	IN6_MULTI_LIST_LOCK_ASSERT();
6418f002c6cSBruce M Simpson 
6428f002c6cSBruce M Simpson 	RB_FOREACH(ims, ip6_msource_tree, &inm->in6m_srcs) {
6438f002c6cSBruce M Simpson 		if (ims->im6s_stp) {
6448f002c6cSBruce M Simpson 			ims->im6s_stp = 0;
6458f002c6cSBruce M Simpson 			--inm->in6m_st[1].iss_rec;
6468f002c6cSBruce M Simpson 		}
6478f002c6cSBruce M Simpson 	}
6488f002c6cSBruce M Simpson 	KASSERT(inm->in6m_st[1].iss_rec == 0,
6498f002c6cSBruce M Simpson 	    ("%s: iss_rec %d not 0", __func__, inm->in6m_st[1].iss_rec));
6508f002c6cSBruce M Simpson }
6518f002c6cSBruce M Simpson 
6528f002c6cSBruce M Simpson /*
6538f002c6cSBruce M Simpson  * Record a source as pending for a Source-Group MLDv2 query.
6548f002c6cSBruce M Simpson  * This lives here as it modifies the shared tree.
6558f002c6cSBruce M Simpson  *
6568f002c6cSBruce M Simpson  * inm is the group descriptor.
6578f002c6cSBruce M Simpson  * naddr is the address of the source to record in network-byte order.
6588f002c6cSBruce M Simpson  *
6598f002c6cSBruce M Simpson  * If the net.inet6.mld.sgalloc sysctl is non-zero, we will
6608f002c6cSBruce M Simpson  * lazy-allocate a source node in response to an SG query.
6618f002c6cSBruce M Simpson  * Otherwise, no allocation is performed. This saves some memory
6628f002c6cSBruce M Simpson  * with the trade-off that the source will not be reported to the
6638f002c6cSBruce M Simpson  * router if joined in the window between the query response and
6648f002c6cSBruce M Simpson  * the group actually being joined on the local host.
6658f002c6cSBruce M Simpson  *
6668f002c6cSBruce M Simpson  * VIMAGE: XXX: Currently the mld_sgalloc feature has been removed.
6678f002c6cSBruce M Simpson  * This turns off the allocation of a recorded source entry if
6688f002c6cSBruce M Simpson  * the group has not been joined.
6698f002c6cSBruce M Simpson  *
6708f002c6cSBruce M Simpson  * Return 0 if the source didn't exist or was already marked as recorded.
6718f002c6cSBruce M Simpson  * Return 1 if the source was marked as recorded by this function.
672a4641f4eSPedro F. Giffuni  * Return <0 if any error occurred (negated errno code).
6738f002c6cSBruce M Simpson  */
6748f002c6cSBruce M Simpson int
6758f002c6cSBruce M Simpson in6m_record_source(struct in6_multi *inm, const struct in6_addr *addr)
6768f002c6cSBruce M Simpson {
6778f002c6cSBruce M Simpson 	struct ip6_msource	 find;
6788f002c6cSBruce M Simpson 	struct ip6_msource	*ims, *nims;
6798f002c6cSBruce M Simpson 
680f3e1324bSStephen Hurd 	IN6_MULTI_LIST_LOCK_ASSERT();
6818f002c6cSBruce M Simpson 
6828f002c6cSBruce M Simpson 	find.im6s_addr = *addr;
6838f002c6cSBruce M Simpson 	ims = RB_FIND(ip6_msource_tree, &inm->in6m_srcs, &find);
6848f002c6cSBruce M Simpson 	if (ims && ims->im6s_stp)
6858f002c6cSBruce M Simpson 		return (0);
6868f002c6cSBruce M Simpson 	if (ims == NULL) {
6878f002c6cSBruce M Simpson 		if (inm->in6m_nsrc == in6_mcast_maxgrpsrc)
6888f002c6cSBruce M Simpson 			return (-ENOSPC);
6898f002c6cSBruce M Simpson 		nims = malloc(sizeof(struct ip6_msource), M_IP6MSOURCE,
6908f002c6cSBruce M Simpson 		    M_NOWAIT | M_ZERO);
6918f002c6cSBruce M Simpson 		if (nims == NULL)
6928f002c6cSBruce M Simpson 			return (-ENOMEM);
6938f002c6cSBruce M Simpson 		nims->im6s_addr = find.im6s_addr;
6948f002c6cSBruce M Simpson 		RB_INSERT(ip6_msource_tree, &inm->in6m_srcs, nims);
6958f002c6cSBruce M Simpson 		++inm->in6m_nsrc;
6968f002c6cSBruce M Simpson 		ims = nims;
6978f002c6cSBruce M Simpson 	}
6988f002c6cSBruce M Simpson 
6998f002c6cSBruce M Simpson 	/*
7008f002c6cSBruce M Simpson 	 * Mark the source as recorded and update the recorded
7018f002c6cSBruce M Simpson 	 * source count.
7028f002c6cSBruce M Simpson 	 */
7038f002c6cSBruce M Simpson 	++ims->im6s_stp;
7048f002c6cSBruce M Simpson 	++inm->in6m_st[1].iss_rec;
7058f002c6cSBruce M Simpson 
7068f002c6cSBruce M Simpson 	return (1);
7078f002c6cSBruce M Simpson }
7088f002c6cSBruce M Simpson 
7098f002c6cSBruce M Simpson /*
7108f002c6cSBruce M Simpson  * Return a pointer to an in6_msource owned by an in6_mfilter,
7118f002c6cSBruce M Simpson  * given its source address.
7128f002c6cSBruce M Simpson  * Lazy-allocate if needed. If this is a new entry its filter state is
7138f002c6cSBruce M Simpson  * undefined at t0.
7148f002c6cSBruce M Simpson  *
7158f002c6cSBruce M Simpson  * imf is the filter set being modified.
7168f002c6cSBruce M Simpson  * addr is the source address.
7178f002c6cSBruce M Simpson  *
7188f002c6cSBruce M Simpson  * SMPng: May be called with locks held; malloc must not block.
7198f002c6cSBruce M Simpson  */
7208f002c6cSBruce M Simpson static int
7218f002c6cSBruce M Simpson im6f_get_source(struct in6_mfilter *imf, const struct sockaddr_in6 *psin,
7228f002c6cSBruce M Simpson     struct in6_msource **plims)
7238f002c6cSBruce M Simpson {
7248f002c6cSBruce M Simpson 	struct ip6_msource	 find;
7258f002c6cSBruce M Simpson 	struct ip6_msource	*ims, *nims;
7268f002c6cSBruce M Simpson 	struct in6_msource	*lims;
7278f002c6cSBruce M Simpson 	int			 error;
7288f002c6cSBruce M Simpson 
7298f002c6cSBruce M Simpson 	error = 0;
7308f002c6cSBruce M Simpson 	ims = NULL;
7318f002c6cSBruce M Simpson 	lims = NULL;
7328f002c6cSBruce M Simpson 
7338f002c6cSBruce M Simpson 	find.im6s_addr = psin->sin6_addr;
7348f002c6cSBruce M Simpson 	ims = RB_FIND(ip6_msource_tree, &imf->im6f_sources, &find);
7358f002c6cSBruce M Simpson 	lims = (struct in6_msource *)ims;
7368f002c6cSBruce M Simpson 	if (lims == NULL) {
7378f002c6cSBruce M Simpson 		if (imf->im6f_nsrc == in6_mcast_maxsocksrc)
7388f002c6cSBruce M Simpson 			return (ENOSPC);
7398f002c6cSBruce M Simpson 		nims = malloc(sizeof(struct in6_msource), M_IN6MFILTER,
7408f002c6cSBruce M Simpson 		    M_NOWAIT | M_ZERO);
7418f002c6cSBruce M Simpson 		if (nims == NULL)
7428f002c6cSBruce M Simpson 			return (ENOMEM);
7438f002c6cSBruce M Simpson 		lims = (struct in6_msource *)nims;
7448f002c6cSBruce M Simpson 		lims->im6s_addr = find.im6s_addr;
7458f002c6cSBruce M Simpson 		lims->im6sl_st[0] = MCAST_UNDEFINED;
7468f002c6cSBruce M Simpson 		RB_INSERT(ip6_msource_tree, &imf->im6f_sources, nims);
7478f002c6cSBruce M Simpson 		++imf->im6f_nsrc;
7488f002c6cSBruce M Simpson 	}
7498f002c6cSBruce M Simpson 
7508f002c6cSBruce M Simpson 	*plims = lims;
7518f002c6cSBruce M Simpson 
7528f002c6cSBruce M Simpson 	return (error);
7538f002c6cSBruce M Simpson }
7548f002c6cSBruce M Simpson 
7558f002c6cSBruce M Simpson /*
7568f002c6cSBruce M Simpson  * Graft a source entry into an existing socket-layer filter set,
7578f002c6cSBruce M Simpson  * maintaining any required invariants and checking allocations.
7588f002c6cSBruce M Simpson  *
7598f002c6cSBruce M Simpson  * The source is marked as being in the new filter mode at t1.
7608f002c6cSBruce M Simpson  *
7618f002c6cSBruce M Simpson  * Return the pointer to the new node, otherwise return NULL.
7628f002c6cSBruce M Simpson  */
7638f002c6cSBruce M Simpson static struct in6_msource *
7648f002c6cSBruce M Simpson im6f_graft(struct in6_mfilter *imf, const uint8_t st1,
7658f002c6cSBruce M Simpson     const struct sockaddr_in6 *psin)
7668f002c6cSBruce M Simpson {
7678f002c6cSBruce M Simpson 	struct ip6_msource	*nims;
7688f002c6cSBruce M Simpson 	struct in6_msource	*lims;
7698f002c6cSBruce M Simpson 
7708f002c6cSBruce M Simpson 	nims = malloc(sizeof(struct in6_msource), M_IN6MFILTER,
7718f002c6cSBruce M Simpson 	    M_NOWAIT | M_ZERO);
7728f002c6cSBruce M Simpson 	if (nims == NULL)
7738f002c6cSBruce M Simpson 		return (NULL);
7748f002c6cSBruce M Simpson 	lims = (struct in6_msource *)nims;
7758f002c6cSBruce M Simpson 	lims->im6s_addr = psin->sin6_addr;
7768f002c6cSBruce M Simpson 	lims->im6sl_st[0] = MCAST_UNDEFINED;
7778f002c6cSBruce M Simpson 	lims->im6sl_st[1] = st1;
7788f002c6cSBruce M Simpson 	RB_INSERT(ip6_msource_tree, &imf->im6f_sources, nims);
7798f002c6cSBruce M Simpson 	++imf->im6f_nsrc;
7808f002c6cSBruce M Simpson 
7818f002c6cSBruce M Simpson 	return (lims);
7828f002c6cSBruce M Simpson }
7838f002c6cSBruce M Simpson 
7848f002c6cSBruce M Simpson /*
7858f002c6cSBruce M Simpson  * Prune a source entry from an existing socket-layer filter set,
7868f002c6cSBruce M Simpson  * maintaining any required invariants and checking allocations.
7878f002c6cSBruce M Simpson  *
7888f002c6cSBruce M Simpson  * The source is marked as being left at t1, it is not freed.
7898f002c6cSBruce M Simpson  *
7908f002c6cSBruce M Simpson  * Return 0 if no error occurred, otherwise return an errno value.
7918f002c6cSBruce M Simpson  */
7928f002c6cSBruce M Simpson static int
7938f002c6cSBruce M Simpson im6f_prune(struct in6_mfilter *imf, const struct sockaddr_in6 *psin)
7948f002c6cSBruce M Simpson {
7958f002c6cSBruce M Simpson 	struct ip6_msource	 find;
7968f002c6cSBruce M Simpson 	struct ip6_msource	*ims;
7978f002c6cSBruce M Simpson 	struct in6_msource	*lims;
7988f002c6cSBruce M Simpson 
7998f002c6cSBruce M Simpson 	find.im6s_addr = psin->sin6_addr;
8008f002c6cSBruce M Simpson 	ims = RB_FIND(ip6_msource_tree, &imf->im6f_sources, &find);
8018f002c6cSBruce M Simpson 	if (ims == NULL)
8028f002c6cSBruce M Simpson 		return (ENOENT);
8038f002c6cSBruce M Simpson 	lims = (struct in6_msource *)ims;
8048f002c6cSBruce M Simpson 	lims->im6sl_st[1] = MCAST_UNDEFINED;
8058f002c6cSBruce M Simpson 	return (0);
8068f002c6cSBruce M Simpson }
8078f002c6cSBruce M Simpson 
8088f002c6cSBruce M Simpson /*
8098f002c6cSBruce M Simpson  * Revert socket-layer filter set deltas at t1 to t0 state.
8108f002c6cSBruce M Simpson  */
8118f002c6cSBruce M Simpson static void
8128f002c6cSBruce M Simpson im6f_rollback(struct in6_mfilter *imf)
8138f002c6cSBruce M Simpson {
8148f002c6cSBruce M Simpson 	struct ip6_msource	*ims, *tims;
8158f002c6cSBruce M Simpson 	struct in6_msource	*lims;
8168f002c6cSBruce M Simpson 
8178f002c6cSBruce M Simpson 	RB_FOREACH_SAFE(ims, ip6_msource_tree, &imf->im6f_sources, tims) {
8188f002c6cSBruce M Simpson 		lims = (struct in6_msource *)ims;
8198f002c6cSBruce M Simpson 		if (lims->im6sl_st[0] == lims->im6sl_st[1]) {
8208f002c6cSBruce M Simpson 			/* no change at t1 */
8218f002c6cSBruce M Simpson 			continue;
8228f002c6cSBruce M Simpson 		} else if (lims->im6sl_st[0] != MCAST_UNDEFINED) {
8238f002c6cSBruce M Simpson 			/* revert change to existing source at t1 */
8248f002c6cSBruce M Simpson 			lims->im6sl_st[1] = lims->im6sl_st[0];
8258f002c6cSBruce M Simpson 		} else {
8268f002c6cSBruce M Simpson 			/* revert source added t1 */
8278f002c6cSBruce M Simpson 			CTR2(KTR_MLD, "%s: free ims %p", __func__, ims);
8288f002c6cSBruce M Simpson 			RB_REMOVE(ip6_msource_tree, &imf->im6f_sources, ims);
8298f002c6cSBruce M Simpson 			free(ims, M_IN6MFILTER);
8308f002c6cSBruce M Simpson 			imf->im6f_nsrc--;
8318f002c6cSBruce M Simpson 		}
8328f002c6cSBruce M Simpson 	}
8338f002c6cSBruce M Simpson 	imf->im6f_st[1] = imf->im6f_st[0];
8348f002c6cSBruce M Simpson }
8358f002c6cSBruce M Simpson 
8368f002c6cSBruce M Simpson /*
8378f002c6cSBruce M Simpson  * Mark socket-layer filter set as INCLUDE {} at t1.
8388f002c6cSBruce M Simpson  */
8398f002c6cSBruce M Simpson static void
8408f002c6cSBruce M Simpson im6f_leave(struct in6_mfilter *imf)
8418f002c6cSBruce M Simpson {
8428f002c6cSBruce M Simpson 	struct ip6_msource	*ims;
8438f002c6cSBruce M Simpson 	struct in6_msource	*lims;
8448f002c6cSBruce M Simpson 
8458f002c6cSBruce M Simpson 	RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
8468f002c6cSBruce M Simpson 		lims = (struct in6_msource *)ims;
8478f002c6cSBruce M Simpson 		lims->im6sl_st[1] = MCAST_UNDEFINED;
8488f002c6cSBruce M Simpson 	}
8498f002c6cSBruce M Simpson 	imf->im6f_st[1] = MCAST_INCLUDE;
8508f002c6cSBruce M Simpson }
8518f002c6cSBruce M Simpson 
8528f002c6cSBruce M Simpson /*
8538f002c6cSBruce M Simpson  * Mark socket-layer filter set deltas as committed.
8548f002c6cSBruce M Simpson  */
8558f002c6cSBruce M Simpson static void
8568f002c6cSBruce M Simpson im6f_commit(struct in6_mfilter *imf)
8578f002c6cSBruce M Simpson {
8588f002c6cSBruce M Simpson 	struct ip6_msource	*ims;
8598f002c6cSBruce M Simpson 	struct in6_msource	*lims;
8608f002c6cSBruce M Simpson 
8618f002c6cSBruce M Simpson 	RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
8628f002c6cSBruce M Simpson 		lims = (struct in6_msource *)ims;
8638f002c6cSBruce M Simpson 		lims->im6sl_st[0] = lims->im6sl_st[1];
8648f002c6cSBruce M Simpson 	}
8658f002c6cSBruce M Simpson 	imf->im6f_st[0] = imf->im6f_st[1];
8668f002c6cSBruce M Simpson }
8678f002c6cSBruce M Simpson 
8688f002c6cSBruce M Simpson /*
8698f002c6cSBruce M Simpson  * Reap unreferenced sources from socket-layer filter set.
8708f002c6cSBruce M Simpson  */
8718f002c6cSBruce M Simpson static void
8728f002c6cSBruce M Simpson im6f_reap(struct in6_mfilter *imf)
8738f002c6cSBruce M Simpson {
8748f002c6cSBruce M Simpson 	struct ip6_msource	*ims, *tims;
8758f002c6cSBruce M Simpson 	struct in6_msource	*lims;
8768f002c6cSBruce M Simpson 
8778f002c6cSBruce M Simpson 	RB_FOREACH_SAFE(ims, ip6_msource_tree, &imf->im6f_sources, tims) {
8788f002c6cSBruce M Simpson 		lims = (struct in6_msource *)ims;
8798f002c6cSBruce M Simpson 		if ((lims->im6sl_st[0] == MCAST_UNDEFINED) &&
8808f002c6cSBruce M Simpson 		    (lims->im6sl_st[1] == MCAST_UNDEFINED)) {
8818f002c6cSBruce M Simpson 			CTR2(KTR_MLD, "%s: free lims %p", __func__, ims);
8828f002c6cSBruce M Simpson 			RB_REMOVE(ip6_msource_tree, &imf->im6f_sources, ims);
8838f002c6cSBruce M Simpson 			free(ims, M_IN6MFILTER);
8848f002c6cSBruce M Simpson 			imf->im6f_nsrc--;
8858f002c6cSBruce M Simpson 		}
8868f002c6cSBruce M Simpson 	}
8878f002c6cSBruce M Simpson }
8888f002c6cSBruce M Simpson 
8898f002c6cSBruce M Simpson /*
8908f002c6cSBruce M Simpson  * Purge socket-layer filter set.
8918f002c6cSBruce M Simpson  */
8928f002c6cSBruce M Simpson static void
8938f002c6cSBruce M Simpson im6f_purge(struct in6_mfilter *imf)
8948f002c6cSBruce M Simpson {
8958f002c6cSBruce M Simpson 	struct ip6_msource	*ims, *tims;
8968f002c6cSBruce M Simpson 
8978f002c6cSBruce M Simpson 	RB_FOREACH_SAFE(ims, ip6_msource_tree, &imf->im6f_sources, tims) {
8988f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: free ims %p", __func__, ims);
8998f002c6cSBruce M Simpson 		RB_REMOVE(ip6_msource_tree, &imf->im6f_sources, ims);
9008f002c6cSBruce M Simpson 		free(ims, M_IN6MFILTER);
9018f002c6cSBruce M Simpson 		imf->im6f_nsrc--;
9028f002c6cSBruce M Simpson 	}
9038f002c6cSBruce M Simpson 	imf->im6f_st[0] = imf->im6f_st[1] = MCAST_UNDEFINED;
9048f002c6cSBruce M Simpson 	KASSERT(RB_EMPTY(&imf->im6f_sources),
9058f002c6cSBruce M Simpson 	    ("%s: im6f_sources not empty", __func__));
9068f002c6cSBruce M Simpson }
9078f002c6cSBruce M Simpson 
9088f002c6cSBruce M Simpson /*
9098f002c6cSBruce M Simpson  * Look up a source filter entry for a multicast group.
9108f002c6cSBruce M Simpson  *
9118f002c6cSBruce M Simpson  * inm is the group descriptor to work with.
9128f002c6cSBruce M Simpson  * addr is the IPv6 address to look up.
9138f002c6cSBruce M Simpson  * noalloc may be non-zero to suppress allocation of sources.
9148f002c6cSBruce M Simpson  * *pims will be set to the address of the retrieved or allocated source.
9158f002c6cSBruce M Simpson  *
9168f002c6cSBruce M Simpson  * SMPng: NOTE: may be called with locks held.
9178f002c6cSBruce M Simpson  * Return 0 if successful, otherwise return a non-zero error code.
9188f002c6cSBruce M Simpson  */
9198f002c6cSBruce M Simpson static int
9208f002c6cSBruce M Simpson in6m_get_source(struct in6_multi *inm, const struct in6_addr *addr,
9218f002c6cSBruce M Simpson     const int noalloc, struct ip6_msource **pims)
9228f002c6cSBruce M Simpson {
9238f002c6cSBruce M Simpson 	struct ip6_msource	 find;
9248f002c6cSBruce M Simpson 	struct ip6_msource	*ims, *nims;
9258f002c6cSBruce M Simpson #ifdef KTR
9268f002c6cSBruce M Simpson 	char			 ip6tbuf[INET6_ADDRSTRLEN];
9278f002c6cSBruce M Simpson #endif
9288f002c6cSBruce M Simpson 
9298f002c6cSBruce M Simpson 	find.im6s_addr = *addr;
9308f002c6cSBruce M Simpson 	ims = RB_FIND(ip6_msource_tree, &inm->in6m_srcs, &find);
9318f002c6cSBruce M Simpson 	if (ims == NULL && !noalloc) {
9328f002c6cSBruce M Simpson 		if (inm->in6m_nsrc == in6_mcast_maxgrpsrc)
9338f002c6cSBruce M Simpson 			return (ENOSPC);
9348f002c6cSBruce M Simpson 		nims = malloc(sizeof(struct ip6_msource), M_IP6MSOURCE,
9358f002c6cSBruce M Simpson 		    M_NOWAIT | M_ZERO);
9368f002c6cSBruce M Simpson 		if (nims == NULL)
9378f002c6cSBruce M Simpson 			return (ENOMEM);
9388f002c6cSBruce M Simpson 		nims->im6s_addr = *addr;
9398f002c6cSBruce M Simpson 		RB_INSERT(ip6_msource_tree, &inm->in6m_srcs, nims);
9408f002c6cSBruce M Simpson 		++inm->in6m_nsrc;
9418f002c6cSBruce M Simpson 		ims = nims;
9428f002c6cSBruce M Simpson 		CTR3(KTR_MLD, "%s: allocated %s as %p", __func__,
9438f002c6cSBruce M Simpson 		    ip6_sprintf(ip6tbuf, addr), ims);
9448f002c6cSBruce M Simpson 	}
9458f002c6cSBruce M Simpson 
9468f002c6cSBruce M Simpson 	*pims = ims;
9478f002c6cSBruce M Simpson 	return (0);
9488f002c6cSBruce M Simpson }
9498f002c6cSBruce M Simpson 
9508f002c6cSBruce M Simpson /*
9518f002c6cSBruce M Simpson  * Merge socket-layer source into MLD-layer source.
9528f002c6cSBruce M Simpson  * If rollback is non-zero, perform the inverse of the merge.
9538f002c6cSBruce M Simpson  */
9548f002c6cSBruce M Simpson static void
9558f002c6cSBruce M Simpson im6s_merge(struct ip6_msource *ims, const struct in6_msource *lims,
9568f002c6cSBruce M Simpson     const int rollback)
9578f002c6cSBruce M Simpson {
9588f002c6cSBruce M Simpson 	int n = rollback ? -1 : 1;
9598f002c6cSBruce M Simpson #ifdef KTR
9608f002c6cSBruce M Simpson 	char ip6tbuf[INET6_ADDRSTRLEN];
9618f002c6cSBruce M Simpson 
9628f002c6cSBruce M Simpson 	ip6_sprintf(ip6tbuf, &lims->im6s_addr);
9638f002c6cSBruce M Simpson #endif
9648f002c6cSBruce M Simpson 
9658f002c6cSBruce M Simpson 	if (lims->im6sl_st[0] == MCAST_EXCLUDE) {
9668f002c6cSBruce M Simpson 		CTR3(KTR_MLD, "%s: t1 ex -= %d on %s", __func__, n, ip6tbuf);
9678f002c6cSBruce M Simpson 		ims->im6s_st[1].ex -= n;
9688f002c6cSBruce M Simpson 	} else if (lims->im6sl_st[0] == MCAST_INCLUDE) {
9698f002c6cSBruce M Simpson 		CTR3(KTR_MLD, "%s: t1 in -= %d on %s", __func__, n, ip6tbuf);
9708f002c6cSBruce M Simpson 		ims->im6s_st[1].in -= n;
9718f002c6cSBruce M Simpson 	}
9728f002c6cSBruce M Simpson 
9738f002c6cSBruce M Simpson 	if (lims->im6sl_st[1] == MCAST_EXCLUDE) {
9748f002c6cSBruce M Simpson 		CTR3(KTR_MLD, "%s: t1 ex += %d on %s", __func__, n, ip6tbuf);
9758f002c6cSBruce M Simpson 		ims->im6s_st[1].ex += n;
9768f002c6cSBruce M Simpson 	} else if (lims->im6sl_st[1] == MCAST_INCLUDE) {
9778f002c6cSBruce M Simpson 		CTR3(KTR_MLD, "%s: t1 in += %d on %s", __func__, n, ip6tbuf);
9788f002c6cSBruce M Simpson 		ims->im6s_st[1].in += n;
9798f002c6cSBruce M Simpson 	}
9808f002c6cSBruce M Simpson }
9818f002c6cSBruce M Simpson 
9828f002c6cSBruce M Simpson /*
9838f002c6cSBruce M Simpson  * Atomically update the global in6_multi state, when a membership's
9848f002c6cSBruce M Simpson  * filter list is being updated in any way.
9858f002c6cSBruce M Simpson  *
9868f002c6cSBruce M Simpson  * imf is the per-inpcb-membership group filter pointer.
9878f002c6cSBruce M Simpson  * A fake imf may be passed for in-kernel consumers.
9888f002c6cSBruce M Simpson  *
9898f002c6cSBruce M Simpson  * XXX This is a candidate for a set-symmetric-difference style loop
9908f002c6cSBruce M Simpson  * which would eliminate the repeated lookup from root of ims nodes,
9918f002c6cSBruce M Simpson  * as they share the same key space.
9928f002c6cSBruce M Simpson  *
9938f002c6cSBruce M Simpson  * If any error occurred this function will back out of refcounts
9948f002c6cSBruce M Simpson  * and return a non-zero value.
9958f002c6cSBruce M Simpson  */
9968f002c6cSBruce M Simpson static int
9978f002c6cSBruce M Simpson in6m_merge(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf)
9988f002c6cSBruce M Simpson {
9998f002c6cSBruce M Simpson 	struct ip6_msource	*ims, *nims;
10008f002c6cSBruce M Simpson 	struct in6_msource	*lims;
10018f002c6cSBruce M Simpson 	int			 schanged, error;
10028f002c6cSBruce M Simpson 	int			 nsrc0, nsrc1;
10038f002c6cSBruce M Simpson 
10048f002c6cSBruce M Simpson 	schanged = 0;
10058f002c6cSBruce M Simpson 	error = 0;
10068f002c6cSBruce M Simpson 	nsrc1 = nsrc0 = 0;
1007f3e1324bSStephen Hurd 	IN6_MULTI_LIST_LOCK_ASSERT();
10088f002c6cSBruce M Simpson 
10098f002c6cSBruce M Simpson 	/*
10108f002c6cSBruce M Simpson 	 * Update the source filters first, as this may fail.
10118f002c6cSBruce M Simpson 	 * Maintain count of in-mode filters at t0, t1. These are
10128f002c6cSBruce M Simpson 	 * used to work out if we transition into ASM mode or not.
10138f002c6cSBruce M Simpson 	 * Maintain a count of source filters whose state was
10148f002c6cSBruce M Simpson 	 * actually modified by this operation.
10158f002c6cSBruce M Simpson 	 */
10168f002c6cSBruce M Simpson 	RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
10178f002c6cSBruce M Simpson 		lims = (struct in6_msource *)ims;
10188f002c6cSBruce M Simpson 		if (lims->im6sl_st[0] == imf->im6f_st[0]) nsrc0++;
10198f002c6cSBruce M Simpson 		if (lims->im6sl_st[1] == imf->im6f_st[1]) nsrc1++;
10208f002c6cSBruce M Simpson 		if (lims->im6sl_st[0] == lims->im6sl_st[1]) continue;
10218f002c6cSBruce M Simpson 		error = in6m_get_source(inm, &lims->im6s_addr, 0, &nims);
10228f002c6cSBruce M Simpson 		++schanged;
10238f002c6cSBruce M Simpson 		if (error)
10248f002c6cSBruce M Simpson 			break;
10258f002c6cSBruce M Simpson 		im6s_merge(nims, lims, 0);
10268f002c6cSBruce M Simpson 	}
10278f002c6cSBruce M Simpson 	if (error) {
10288f002c6cSBruce M Simpson 		struct ip6_msource *bims;
10298f002c6cSBruce M Simpson 
10308f002c6cSBruce M Simpson 		RB_FOREACH_REVERSE_FROM(ims, ip6_msource_tree, nims) {
10318f002c6cSBruce M Simpson 			lims = (struct in6_msource *)ims;
10328f002c6cSBruce M Simpson 			if (lims->im6sl_st[0] == lims->im6sl_st[1])
10338f002c6cSBruce M Simpson 				continue;
10348f002c6cSBruce M Simpson 			(void)in6m_get_source(inm, &lims->im6s_addr, 1, &bims);
10358f002c6cSBruce M Simpson 			if (bims == NULL)
10368f002c6cSBruce M Simpson 				continue;
10378f002c6cSBruce M Simpson 			im6s_merge(bims, lims, 1);
10388f002c6cSBruce M Simpson 		}
10398f002c6cSBruce M Simpson 		goto out_reap;
10408f002c6cSBruce M Simpson 	}
10418f002c6cSBruce M Simpson 
10428f002c6cSBruce M Simpson 	CTR3(KTR_MLD, "%s: imf filters in-mode: %d at t0, %d at t1",
10438f002c6cSBruce M Simpson 	    __func__, nsrc0, nsrc1);
10448f002c6cSBruce M Simpson 
10458f002c6cSBruce M Simpson 	/* Handle transition between INCLUDE {n} and INCLUDE {} on socket. */
10468f002c6cSBruce M Simpson 	if (imf->im6f_st[0] == imf->im6f_st[1] &&
10478f002c6cSBruce M Simpson 	    imf->im6f_st[1] == MCAST_INCLUDE) {
10488f002c6cSBruce M Simpson 		if (nsrc1 == 0) {
10498f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: --in on inm at t1", __func__);
10508f002c6cSBruce M Simpson 			--inm->in6m_st[1].iss_in;
10518f002c6cSBruce M Simpson 		}
10528f002c6cSBruce M Simpson 	}
10538f002c6cSBruce M Simpson 
10548f002c6cSBruce M Simpson 	/* Handle filter mode transition on socket. */
10558f002c6cSBruce M Simpson 	if (imf->im6f_st[0] != imf->im6f_st[1]) {
10568f002c6cSBruce M Simpson 		CTR3(KTR_MLD, "%s: imf transition %d to %d",
10578f002c6cSBruce M Simpson 		    __func__, imf->im6f_st[0], imf->im6f_st[1]);
10588f002c6cSBruce M Simpson 
10598f002c6cSBruce M Simpson 		if (imf->im6f_st[0] == MCAST_EXCLUDE) {
10608f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: --ex on inm at t1", __func__);
10618f002c6cSBruce M Simpson 			--inm->in6m_st[1].iss_ex;
10628f002c6cSBruce M Simpson 		} else if (imf->im6f_st[0] == MCAST_INCLUDE) {
10638f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: --in on inm at t1", __func__);
10648f002c6cSBruce M Simpson 			--inm->in6m_st[1].iss_in;
10658f002c6cSBruce M Simpson 		}
10668f002c6cSBruce M Simpson 
10678f002c6cSBruce M Simpson 		if (imf->im6f_st[1] == MCAST_EXCLUDE) {
10688f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: ex++ on inm at t1", __func__);
10698f002c6cSBruce M Simpson 			inm->in6m_st[1].iss_ex++;
10708f002c6cSBruce M Simpson 		} else if (imf->im6f_st[1] == MCAST_INCLUDE && nsrc1 > 0) {
10718f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: in++ on inm at t1", __func__);
10728f002c6cSBruce M Simpson 			inm->in6m_st[1].iss_in++;
10738f002c6cSBruce M Simpson 		}
10748f002c6cSBruce M Simpson 	}
10758f002c6cSBruce M Simpson 
10768f002c6cSBruce M Simpson 	/*
10778f002c6cSBruce M Simpson 	 * Track inm filter state in terms of listener counts.
10788f002c6cSBruce M Simpson 	 * If there are any exclusive listeners, stack-wide
10798f002c6cSBruce M Simpson 	 * membership is exclusive.
10808f002c6cSBruce M Simpson 	 * Otherwise, if only inclusive listeners, stack-wide is inclusive.
10818f002c6cSBruce M Simpson 	 * If no listeners remain, state is undefined at t1,
10828f002c6cSBruce M Simpson 	 * and the MLD lifecycle for this group should finish.
10838f002c6cSBruce M Simpson 	 */
10848f002c6cSBruce M Simpson 	if (inm->in6m_st[1].iss_ex > 0) {
10858f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: transition to EX", __func__);
10868f002c6cSBruce M Simpson 		inm->in6m_st[1].iss_fmode = MCAST_EXCLUDE;
10878f002c6cSBruce M Simpson 	} else if (inm->in6m_st[1].iss_in > 0) {
10888f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: transition to IN", __func__);
10898f002c6cSBruce M Simpson 		inm->in6m_st[1].iss_fmode = MCAST_INCLUDE;
10908f002c6cSBruce M Simpson 	} else {
10918f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: transition to UNDEF", __func__);
10928f002c6cSBruce M Simpson 		inm->in6m_st[1].iss_fmode = MCAST_UNDEFINED;
10938f002c6cSBruce M Simpson 	}
10948f002c6cSBruce M Simpson 
10958f002c6cSBruce M Simpson 	/* Decrement ASM listener count on transition out of ASM mode. */
10968f002c6cSBruce M Simpson 	if (imf->im6f_st[0] == MCAST_EXCLUDE && nsrc0 == 0) {
10978f002c6cSBruce M Simpson 		if ((imf->im6f_st[1] != MCAST_EXCLUDE) ||
1098bd745936SEnji Cooper 		    (imf->im6f_st[1] == MCAST_EXCLUDE && nsrc1 > 0)) {
10998f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: --asm on inm at t1", __func__);
11008f002c6cSBruce M Simpson 			--inm->in6m_st[1].iss_asm;
11018f002c6cSBruce M Simpson 		}
1102bd745936SEnji Cooper 	}
11038f002c6cSBruce M Simpson 
11048f002c6cSBruce M Simpson 	/* Increment ASM listener count on transition to ASM mode. */
11058f002c6cSBruce M Simpson 	if (imf->im6f_st[1] == MCAST_EXCLUDE && nsrc1 == 0) {
11068f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: asm++ on inm at t1", __func__);
11078f002c6cSBruce M Simpson 		inm->in6m_st[1].iss_asm++;
11088f002c6cSBruce M Simpson 	}
11098f002c6cSBruce M Simpson 
11108f002c6cSBruce M Simpson 	CTR3(KTR_MLD, "%s: merged imf %p to inm %p", __func__, imf, inm);
11118f002c6cSBruce M Simpson 	in6m_print(inm);
11128f002c6cSBruce M Simpson 
11138f002c6cSBruce M Simpson out_reap:
11148f002c6cSBruce M Simpson 	if (schanged > 0) {
11158f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: sources changed; reaping", __func__);
11168f002c6cSBruce M Simpson 		in6m_reap(inm);
11178f002c6cSBruce M Simpson 	}
11188f002c6cSBruce M Simpson 	return (error);
11198f002c6cSBruce M Simpson }
11208f002c6cSBruce M Simpson 
11218f002c6cSBruce M Simpson /*
11228f002c6cSBruce M Simpson  * Mark an in6_multi's filter set deltas as committed.
11238f002c6cSBruce M Simpson  * Called by MLD after a state change has been enqueued.
11248f002c6cSBruce M Simpson  */
11258f002c6cSBruce M Simpson void
11268f002c6cSBruce M Simpson in6m_commit(struct in6_multi *inm)
11278f002c6cSBruce M Simpson {
11288f002c6cSBruce M Simpson 	struct ip6_msource	*ims;
11298f002c6cSBruce M Simpson 
11308f002c6cSBruce M Simpson 	CTR2(KTR_MLD, "%s: commit inm %p", __func__, inm);
11318f002c6cSBruce M Simpson 	CTR1(KTR_MLD, "%s: pre commit:", __func__);
11328f002c6cSBruce M Simpson 	in6m_print(inm);
11338f002c6cSBruce M Simpson 
11348f002c6cSBruce M Simpson 	RB_FOREACH(ims, ip6_msource_tree, &inm->in6m_srcs) {
11358f002c6cSBruce M Simpson 		ims->im6s_st[0] = ims->im6s_st[1];
11368f002c6cSBruce M Simpson 	}
11378f002c6cSBruce M Simpson 	inm->in6m_st[0] = inm->in6m_st[1];
11388f002c6cSBruce M Simpson }
11398f002c6cSBruce M Simpson 
11408f002c6cSBruce M Simpson /*
11418f002c6cSBruce M Simpson  * Reap unreferenced nodes from an in6_multi's filter set.
11428f002c6cSBruce M Simpson  */
11438f002c6cSBruce M Simpson static void
11448f002c6cSBruce M Simpson in6m_reap(struct in6_multi *inm)
11458f002c6cSBruce M Simpson {
11468f002c6cSBruce M Simpson 	struct ip6_msource	*ims, *tims;
11478f002c6cSBruce M Simpson 
11488f002c6cSBruce M Simpson 	RB_FOREACH_SAFE(ims, ip6_msource_tree, &inm->in6m_srcs, tims) {
11498f002c6cSBruce M Simpson 		if (ims->im6s_st[0].ex > 0 || ims->im6s_st[0].in > 0 ||
11508f002c6cSBruce M Simpson 		    ims->im6s_st[1].ex > 0 || ims->im6s_st[1].in > 0 ||
11518f002c6cSBruce M Simpson 		    ims->im6s_stp != 0)
11528f002c6cSBruce M Simpson 			continue;
11538f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: free ims %p", __func__, ims);
11548f002c6cSBruce M Simpson 		RB_REMOVE(ip6_msource_tree, &inm->in6m_srcs, ims);
11558f002c6cSBruce M Simpson 		free(ims, M_IP6MSOURCE);
11568f002c6cSBruce M Simpson 		inm->in6m_nsrc--;
11578f002c6cSBruce M Simpson 	}
11588f002c6cSBruce M Simpson }
11598f002c6cSBruce M Simpson 
11608f002c6cSBruce M Simpson /*
11618f002c6cSBruce M Simpson  * Purge all source nodes from an in6_multi's filter set.
11628f002c6cSBruce M Simpson  */
11638f002c6cSBruce M Simpson static void
11648f002c6cSBruce M Simpson in6m_purge(struct in6_multi *inm)
11658f002c6cSBruce M Simpson {
11668f002c6cSBruce M Simpson 	struct ip6_msource	*ims, *tims;
11678f002c6cSBruce M Simpson 
11688f002c6cSBruce M Simpson 	RB_FOREACH_SAFE(ims, ip6_msource_tree, &inm->in6m_srcs, tims) {
11698f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: free ims %p", __func__, ims);
11708f002c6cSBruce M Simpson 		RB_REMOVE(ip6_msource_tree, &inm->in6m_srcs, ims);
11718f002c6cSBruce M Simpson 		free(ims, M_IP6MSOURCE);
11728f002c6cSBruce M Simpson 		inm->in6m_nsrc--;
11738f002c6cSBruce M Simpson 	}
11743c268b3aSAndrey V. Elsukov 	/* Free state-change requests that might be queued. */
1175a99c84d4SGleb Smirnoff 	mbufq_drain(&inm->in6m_scq);
11768f002c6cSBruce M Simpson }
11778f002c6cSBruce M Simpson 
11788f002c6cSBruce M Simpson /*
11798f002c6cSBruce M Simpson  * Join a multicast address w/o sources.
11808f002c6cSBruce M Simpson  * KAME compatibility entry point.
11818f002c6cSBruce M Simpson  *
11828f002c6cSBruce M Simpson  * SMPng: Assume no mc locks held by caller.
11838f002c6cSBruce M Simpson  */
11848f002c6cSBruce M Simpson int
1185f3e1324bSStephen Hurd in6_joingroup(struct ifnet *ifp, const struct in6_addr *mcaddr,
11868f002c6cSBruce M Simpson     /*const*/ struct in6_mfilter *imf, struct in6_multi **pinm,
11878f002c6cSBruce M Simpson     const int delay)
11888f002c6cSBruce M Simpson {
11898f002c6cSBruce M Simpson 	int error;
11908f002c6cSBruce M Simpson 
11918f002c6cSBruce M Simpson 	IN6_MULTI_LOCK();
1192f3e1324bSStephen Hurd 	error = in6_joingroup_locked(ifp, mcaddr, NULL, pinm, delay);
11938f002c6cSBruce M Simpson 	IN6_MULTI_UNLOCK();
11948f002c6cSBruce M Simpson 	return (error);
11958f002c6cSBruce M Simpson }
11968f002c6cSBruce M Simpson 
11978f002c6cSBruce M Simpson /*
11988f002c6cSBruce M Simpson  * Join a multicast group; real entry point.
11998f002c6cSBruce M Simpson  *
12008f002c6cSBruce M Simpson  * Only preserves atomicity at inm level.
12018f002c6cSBruce M Simpson  * NOTE: imf argument cannot be const due to sys/tree.h limitations.
12028f002c6cSBruce M Simpson  *
12038f002c6cSBruce M Simpson  * If the MLD downcall fails, the group is not joined, and an error
12048f002c6cSBruce M Simpson  * code is returned.
12058f002c6cSBruce M Simpson  */
1206e1891232SBjoern A. Zeeb static int
1207f3e1324bSStephen Hurd in6_joingroup_locked(struct ifnet *ifp, const struct in6_addr *mcaddr,
12088f002c6cSBruce M Simpson     /*const*/ struct in6_mfilter *imf, struct in6_multi **pinm,
12098f002c6cSBruce M Simpson     const int delay)
12108f002c6cSBruce M Simpson {
12112cd6ad76SHans Petter Selasky 	struct in6_multi_head    inmh;
12128f002c6cSBruce M Simpson 	struct in6_mfilter	 timf;
12138f002c6cSBruce M Simpson 	struct in6_multi	*inm;
1214f3e1324bSStephen Hurd 	struct ifmultiaddr *ifma;
12158f002c6cSBruce M Simpson 	int			 error;
12168f002c6cSBruce M Simpson #ifdef KTR
12178f002c6cSBruce M Simpson 	char			 ip6tbuf[INET6_ADDRSTRLEN];
12188f002c6cSBruce M Simpson #endif
12198f002c6cSBruce M Simpson 
122029dc7bc6SBruce M Simpson 	/*
122129dc7bc6SBruce M Simpson 	 * Sanity: Check scope zone ID was set for ifp, if and
122229dc7bc6SBruce M Simpson 	 * only if group is scoped to an interface.
122329dc7bc6SBruce M Simpson 	 */
122429dc7bc6SBruce M Simpson 	KASSERT(IN6_IS_ADDR_MULTICAST(mcaddr),
122529dc7bc6SBruce M Simpson 	    ("%s: not a multicast address", __func__));
122629dc7bc6SBruce M Simpson 	if (IN6_IS_ADDR_MC_LINKLOCAL(mcaddr) ||
122729dc7bc6SBruce M Simpson 	    IN6_IS_ADDR_MC_INTFACELOCAL(mcaddr)) {
122829dc7bc6SBruce M Simpson 		KASSERT(mcaddr->s6_addr16[1] != 0,
122929dc7bc6SBruce M Simpson 		    ("%s: scope zone ID not set", __func__));
123029dc7bc6SBruce M Simpson 	}
123129dc7bc6SBruce M Simpson 
12328f002c6cSBruce M Simpson 	IN6_MULTI_LOCK_ASSERT();
1233f3e1324bSStephen Hurd 	IN6_MULTI_LIST_UNLOCK_ASSERT();
12348f002c6cSBruce M Simpson 
12358f002c6cSBruce M Simpson 	CTR4(KTR_MLD, "%s: join %s on %p(%s))", __func__,
1236e74966f6SAndrey V. Elsukov 	    ip6_sprintf(ip6tbuf, mcaddr), ifp, if_name(ifp));
12378f002c6cSBruce M Simpson 
12388f002c6cSBruce M Simpson 	error = 0;
12398f002c6cSBruce M Simpson 	inm = NULL;
12408f002c6cSBruce M Simpson 
12418f002c6cSBruce M Simpson 	/*
12428f002c6cSBruce M Simpson 	 * If no imf was specified (i.e. kernel consumer),
12438f002c6cSBruce M Simpson 	 * fake one up and assume it is an ASM join.
12448f002c6cSBruce M Simpson 	 */
12458f002c6cSBruce M Simpson 	if (imf == NULL) {
12468f002c6cSBruce M Simpson 		im6f_init(&timf, MCAST_UNDEFINED, MCAST_EXCLUDE);
12478f002c6cSBruce M Simpson 		imf = &timf;
12488f002c6cSBruce M Simpson 	}
1249f3e1324bSStephen Hurd 	error = in6_getmulti(ifp, mcaddr, &inm);
12508f002c6cSBruce M Simpson 	if (error) {
1251f3e1324bSStephen Hurd 		CTR1(KTR_MLD, "%s: in6_getmulti() failure", __func__);
12528f002c6cSBruce M Simpson 		return (error);
12538f002c6cSBruce M Simpson 	}
12548f002c6cSBruce M Simpson 
1255f3e1324bSStephen Hurd 	IN6_MULTI_LIST_LOCK();
12568f002c6cSBruce M Simpson 	CTR1(KTR_MLD, "%s: merge inm state", __func__);
12578f002c6cSBruce M Simpson 	error = in6m_merge(inm, imf);
12588f002c6cSBruce M Simpson 	if (error) {
12598f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: failed to merge inm state", __func__);
12608f002c6cSBruce M Simpson 		goto out_in6m_release;
12618f002c6cSBruce M Simpson 	}
12628f002c6cSBruce M Simpson 
12638f002c6cSBruce M Simpson 	CTR1(KTR_MLD, "%s: doing mld downcall", __func__);
12648f002c6cSBruce M Simpson 	error = mld_change_state(inm, delay);
12658f002c6cSBruce M Simpson 	if (error) {
12668f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: failed to update source", __func__);
12678f002c6cSBruce M Simpson 		goto out_in6m_release;
12688f002c6cSBruce M Simpson 	}
12698f002c6cSBruce M Simpson 
12708f002c6cSBruce M Simpson out_in6m_release:
12712cd6ad76SHans Petter Selasky 	SLIST_INIT(&inmh);
12728f002c6cSBruce M Simpson 	if (error) {
1273a68cc388SGleb Smirnoff 		struct epoch_tracker et;
1274a68cc388SGleb Smirnoff 
12758f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: dropping ref on %p", __func__, inm);
12766afe56f9SRyan Libby 		IF_ADDR_WLOCK(ifp);
1277a68cc388SGleb Smirnoff 		NET_EPOCH_ENTER(et);
1278d7c5a620SMatt Macy 		CK_STAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1279f3e1324bSStephen Hurd 			if (ifma->ifma_protospec == inm) {
1280f3e1324bSStephen Hurd 				ifma->ifma_protospec = NULL;
1281f3e1324bSStephen Hurd 				break;
1282f3e1324bSStephen Hurd 			}
1283f3e1324bSStephen Hurd 		}
12842cd6ad76SHans Petter Selasky 		in6m_disconnect_locked(&inmh, inm);
12852cd6ad76SHans Petter Selasky 		in6m_rele_locked(&inmh, inm);
1286a68cc388SGleb Smirnoff 		NET_EPOCH_EXIT(et);
12876afe56f9SRyan Libby 		IF_ADDR_WUNLOCK(ifp);
12888f002c6cSBruce M Simpson 	} else {
12898f002c6cSBruce M Simpson 		*pinm = inm;
12908f002c6cSBruce M Simpson 	}
1291f3e1324bSStephen Hurd 	IN6_MULTI_LIST_UNLOCK();
12922cd6ad76SHans Petter Selasky 	in6m_release_list_deferred(&inmh);
12938f002c6cSBruce M Simpson 	return (error);
12948f002c6cSBruce M Simpson }
12958f002c6cSBruce M Simpson 
12968f002c6cSBruce M Simpson /*
12978f002c6cSBruce M Simpson  * Leave a multicast group; unlocked entry point.
12988f002c6cSBruce M Simpson  */
12998f002c6cSBruce M Simpson int
1300f3e1324bSStephen Hurd in6_leavegroup(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf)
13018f002c6cSBruce M Simpson {
13028f002c6cSBruce M Simpson 	int error;
13038f002c6cSBruce M Simpson 
13048f002c6cSBruce M Simpson 	IN6_MULTI_LOCK();
1305f3e1324bSStephen Hurd 	error = in6_leavegroup_locked(inm, imf);
13068f002c6cSBruce M Simpson 	IN6_MULTI_UNLOCK();
13078f002c6cSBruce M Simpson 	return (error);
13088f002c6cSBruce M Simpson }
13098f002c6cSBruce M Simpson 
13108f002c6cSBruce M Simpson /*
13118f002c6cSBruce M Simpson  * Leave a multicast group; real entry point.
13128f002c6cSBruce M Simpson  * All source filters will be expunged.
13138f002c6cSBruce M Simpson  *
13148f002c6cSBruce M Simpson  * Only preserves atomicity at inm level.
13158f002c6cSBruce M Simpson  *
13168f002c6cSBruce M Simpson  * Holding the write lock for the INP which contains imf
13178f002c6cSBruce M Simpson  * is highly advisable. We can't assert for it as imf does not
13188f002c6cSBruce M Simpson  * contain a back-pointer to the owning inp.
13198f002c6cSBruce M Simpson  *
13208f002c6cSBruce M Simpson  * Note: This is not the same as in6m_release(*) as this function also
13218f002c6cSBruce M Simpson  * makes a state change downcall into MLD.
13228f002c6cSBruce M Simpson  */
13238f002c6cSBruce M Simpson int
1324f3e1324bSStephen Hurd in6_leavegroup_locked(struct in6_multi *inm, /*const*/ struct in6_mfilter *imf)
13258f002c6cSBruce M Simpson {
13262cd6ad76SHans Petter Selasky 	struct in6_multi_head	 inmh;
13278f002c6cSBruce M Simpson 	struct in6_mfilter	 timf;
1328f3e1324bSStephen Hurd 	struct ifnet *ifp;
13298f002c6cSBruce M Simpson 	int			 error;
13308f002c6cSBruce M Simpson #ifdef KTR
13318f002c6cSBruce M Simpson 	char			 ip6tbuf[INET6_ADDRSTRLEN];
13328f002c6cSBruce M Simpson #endif
13338f002c6cSBruce M Simpson 
13348f002c6cSBruce M Simpson 	error = 0;
13358f002c6cSBruce M Simpson 
13368f002c6cSBruce M Simpson 	IN6_MULTI_LOCK_ASSERT();
13378f002c6cSBruce M Simpson 
13388f002c6cSBruce M Simpson 	CTR5(KTR_MLD, "%s: leave inm %p, %s/%s, imf %p", __func__,
13398f002c6cSBruce M Simpson 	    inm, ip6_sprintf(ip6tbuf, &inm->in6m_addr),
1340e74966f6SAndrey V. Elsukov 	    (in6m_is_ifp_detached(inm) ? "null" : if_name(inm->in6m_ifp)),
13418f002c6cSBruce M Simpson 	    imf);
13428f002c6cSBruce M Simpson 
13438f002c6cSBruce M Simpson 	/*
13448f002c6cSBruce M Simpson 	 * If no imf was specified (i.e. kernel consumer),
13458f002c6cSBruce M Simpson 	 * fake one up and assume it is an ASM join.
13468f002c6cSBruce M Simpson 	 */
13478f002c6cSBruce M Simpson 	if (imf == NULL) {
13488f002c6cSBruce M Simpson 		im6f_init(&timf, MCAST_EXCLUDE, MCAST_UNDEFINED);
13498f002c6cSBruce M Simpson 		imf = &timf;
13508f002c6cSBruce M Simpson 	}
13518f002c6cSBruce M Simpson 
13528f002c6cSBruce M Simpson 	/*
13538f002c6cSBruce M Simpson 	 * Begin state merge transaction at MLD layer.
13548f002c6cSBruce M Simpson 	 *
13558f002c6cSBruce M Simpson 	 * As this particular invocation should not cause any memory
13568f002c6cSBruce M Simpson 	 * to be allocated, and there is no opportunity to roll back
13578f002c6cSBruce M Simpson 	 * the transaction, it MUST NOT fail.
13588f002c6cSBruce M Simpson 	 */
1359f3e1324bSStephen Hurd 
1360f3e1324bSStephen Hurd 	ifp = inm->in6m_ifp;
1361f3e1324bSStephen Hurd 	IN6_MULTI_LIST_LOCK();
13628f002c6cSBruce M Simpson 	CTR1(KTR_MLD, "%s: merge inm state", __func__);
13638f002c6cSBruce M Simpson 	error = in6m_merge(inm, imf);
13648f002c6cSBruce M Simpson 	KASSERT(error == 0, ("%s: failed to merge inm state", __func__));
13658f002c6cSBruce M Simpson 
13668f002c6cSBruce M Simpson 	CTR1(KTR_MLD, "%s: doing mld downcall", __func__);
1367f9be0386SMatt Macy 	error = 0;
1368f9be0386SMatt Macy 	if (ifp)
13698f002c6cSBruce M Simpson 		error = mld_change_state(inm, 0);
13708f002c6cSBruce M Simpson 	if (error)
13718f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: failed mld downcall", __func__);
13728f002c6cSBruce M Simpson 
13738f002c6cSBruce M Simpson 	CTR2(KTR_MLD, "%s: dropping ref on %p", __func__, inm);
1374f3e1324bSStephen Hurd 	if (ifp)
1375b6f6f880SMatt Macy 		IF_ADDR_WLOCK(ifp);
13762cd6ad76SHans Petter Selasky 
13772cd6ad76SHans Petter Selasky 	SLIST_INIT(&inmh);
13782cd6ad76SHans Petter Selasky 	if (inm->in6m_refcount == 1)
13792cd6ad76SHans Petter Selasky 		in6m_disconnect_locked(&inmh, inm);
13802cd6ad76SHans Petter Selasky 	in6m_rele_locked(&inmh, inm);
1381f3e1324bSStephen Hurd 	if (ifp)
1382b6f6f880SMatt Macy 		IF_ADDR_WUNLOCK(ifp);
1383f3e1324bSStephen Hurd 	IN6_MULTI_LIST_UNLOCK();
13842cd6ad76SHans Petter Selasky 	in6m_release_list_deferred(&inmh);
13858f002c6cSBruce M Simpson 	return (error);
13868f002c6cSBruce M Simpson }
13878f002c6cSBruce M Simpson 
1388f3e1324bSStephen Hurd 
13898f002c6cSBruce M Simpson /*
13908f002c6cSBruce M Simpson  * Block or unblock an ASM multicast source on an inpcb.
13918f002c6cSBruce M Simpson  * This implements the delta-based API described in RFC 3678.
13928f002c6cSBruce M Simpson  *
13938f002c6cSBruce M Simpson  * The delta-based API applies only to exclusive-mode memberships.
13948f002c6cSBruce M Simpson  * An MLD downcall will be performed.
13958f002c6cSBruce M Simpson  *
13968f002c6cSBruce M Simpson  * SMPng: NOTE: Must take Giant as a join may create a new ifma.
13978f002c6cSBruce M Simpson  *
13988f002c6cSBruce M Simpson  * Return 0 if successful, otherwise return an appropriate error code.
13998f002c6cSBruce M Simpson  */
14008f002c6cSBruce M Simpson static int
14018f002c6cSBruce M Simpson in6p_block_unblock_source(struct inpcb *inp, struct sockopt *sopt)
14028f002c6cSBruce M Simpson {
14038f002c6cSBruce M Simpson 	struct group_source_req		 gsr;
14048f002c6cSBruce M Simpson 	sockunion_t			*gsa, *ssa;
14058f002c6cSBruce M Simpson 	struct ifnet			*ifp;
14068f002c6cSBruce M Simpson 	struct in6_mfilter		*imf;
14078f002c6cSBruce M Simpson 	struct ip6_moptions		*imo;
14088f002c6cSBruce M Simpson 	struct in6_msource		*ims;
14098f002c6cSBruce M Simpson 	struct in6_multi			*inm;
14108f002c6cSBruce M Simpson 	uint16_t			 fmode;
14118f002c6cSBruce M Simpson 	int				 error, doblock;
14128f002c6cSBruce M Simpson #ifdef KTR
14138f002c6cSBruce M Simpson 	char				 ip6tbuf[INET6_ADDRSTRLEN];
14148f002c6cSBruce M Simpson #endif
14158f002c6cSBruce M Simpson 
14168f002c6cSBruce M Simpson 	ifp = NULL;
14178f002c6cSBruce M Simpson 	error = 0;
14188f002c6cSBruce M Simpson 	doblock = 0;
14198f002c6cSBruce M Simpson 
14208f002c6cSBruce M Simpson 	memset(&gsr, 0, sizeof(struct group_source_req));
14218f002c6cSBruce M Simpson 	gsa = (sockunion_t *)&gsr.gsr_group;
14228f002c6cSBruce M Simpson 	ssa = (sockunion_t *)&gsr.gsr_source;
14238f002c6cSBruce M Simpson 
14248f002c6cSBruce M Simpson 	switch (sopt->sopt_name) {
14258f002c6cSBruce M Simpson 	case MCAST_BLOCK_SOURCE:
14268f002c6cSBruce M Simpson 	case MCAST_UNBLOCK_SOURCE:
14278f002c6cSBruce M Simpson 		error = sooptcopyin(sopt, &gsr,
14288f002c6cSBruce M Simpson 		    sizeof(struct group_source_req),
14298f002c6cSBruce M Simpson 		    sizeof(struct group_source_req));
14308f002c6cSBruce M Simpson 		if (error)
14318f002c6cSBruce M Simpson 			return (error);
14328f002c6cSBruce M Simpson 
14338f002c6cSBruce M Simpson 		if (gsa->sin6.sin6_family != AF_INET6 ||
14348f002c6cSBruce M Simpson 		    gsa->sin6.sin6_len != sizeof(struct sockaddr_in6))
14358f002c6cSBruce M Simpson 			return (EINVAL);
14368f002c6cSBruce M Simpson 
14378f002c6cSBruce M Simpson 		if (ssa->sin6.sin6_family != AF_INET6 ||
14388f002c6cSBruce M Simpson 		    ssa->sin6.sin6_len != sizeof(struct sockaddr_in6))
14398f002c6cSBruce M Simpson 			return (EINVAL);
14408f002c6cSBruce M Simpson 
14418f002c6cSBruce M Simpson 		if (gsr.gsr_interface == 0 || V_if_index < gsr.gsr_interface)
14428f002c6cSBruce M Simpson 			return (EADDRNOTAVAIL);
14438f002c6cSBruce M Simpson 
14448f002c6cSBruce M Simpson 		ifp = ifnet_byindex(gsr.gsr_interface);
14458f002c6cSBruce M Simpson 
14468f002c6cSBruce M Simpson 		if (sopt->sopt_name == MCAST_BLOCK_SOURCE)
14478f002c6cSBruce M Simpson 			doblock = 1;
14488f002c6cSBruce M Simpson 		break;
14498f002c6cSBruce M Simpson 
14508f002c6cSBruce M Simpson 	default:
14518f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: unknown sopt_name %d",
14528f002c6cSBruce M Simpson 		    __func__, sopt->sopt_name);
14538f002c6cSBruce M Simpson 		return (EOPNOTSUPP);
14548f002c6cSBruce M Simpson 		break;
14558f002c6cSBruce M Simpson 	}
14568f002c6cSBruce M Simpson 
14578f002c6cSBruce M Simpson 	if (!IN6_IS_ADDR_MULTICAST(&gsa->sin6.sin6_addr))
14588f002c6cSBruce M Simpson 		return (EINVAL);
14598f002c6cSBruce M Simpson 
146029dc7bc6SBruce M Simpson 	(void)in6_setscope(&gsa->sin6.sin6_addr, ifp, NULL);
146129dc7bc6SBruce M Simpson 
14628f002c6cSBruce M Simpson 	/*
14638f002c6cSBruce M Simpson 	 * Check if we are actually a member of this group.
14648f002c6cSBruce M Simpson 	 */
14658f002c6cSBruce M Simpson 	imo = in6p_findmoptions(inp);
146659854ecfSHans Petter Selasky 	imf = im6o_match_group(imo, ifp, &gsa->sa);
146759854ecfSHans Petter Selasky 	if (imf == NULL) {
14688f002c6cSBruce M Simpson 		error = EADDRNOTAVAIL;
14698f002c6cSBruce M Simpson 		goto out_in6p_locked;
14708f002c6cSBruce M Simpson 	}
147159854ecfSHans Petter Selasky 	inm = imf->im6f_in6m;
14728f002c6cSBruce M Simpson 
14738f002c6cSBruce M Simpson 	/*
14748f002c6cSBruce M Simpson 	 * Attempting to use the delta-based API on an
14758f002c6cSBruce M Simpson 	 * non exclusive-mode membership is an error.
14768f002c6cSBruce M Simpson 	 */
14778f002c6cSBruce M Simpson 	fmode = imf->im6f_st[0];
14788f002c6cSBruce M Simpson 	if (fmode != MCAST_EXCLUDE) {
14798f002c6cSBruce M Simpson 		error = EINVAL;
14808f002c6cSBruce M Simpson 		goto out_in6p_locked;
14818f002c6cSBruce M Simpson 	}
14828f002c6cSBruce M Simpson 
14838f002c6cSBruce M Simpson 	/*
14848f002c6cSBruce M Simpson 	 * Deal with error cases up-front:
14858f002c6cSBruce M Simpson 	 *  Asked to block, but already blocked; or
14868f002c6cSBruce M Simpson 	 *  Asked to unblock, but nothing to unblock.
14878f002c6cSBruce M Simpson 	 * If adding a new block entry, allocate it.
14888f002c6cSBruce M Simpson 	 */
148959854ecfSHans Petter Selasky 	ims = im6o_match_source(imf, &ssa->sa);
14908f002c6cSBruce M Simpson 	if ((ims != NULL && doblock) || (ims == NULL && !doblock)) {
14918f002c6cSBruce M Simpson 		CTR3(KTR_MLD, "%s: source %s %spresent", __func__,
14928f002c6cSBruce M Simpson 		    ip6_sprintf(ip6tbuf, &ssa->sin6.sin6_addr),
14938f002c6cSBruce M Simpson 		    doblock ? "" : "not ");
14948f002c6cSBruce M Simpson 		error = EADDRNOTAVAIL;
14958f002c6cSBruce M Simpson 		goto out_in6p_locked;
14968f002c6cSBruce M Simpson 	}
14978f002c6cSBruce M Simpson 
14988f002c6cSBruce M Simpson 	INP_WLOCK_ASSERT(inp);
14998f002c6cSBruce M Simpson 
15008f002c6cSBruce M Simpson 	/*
15018f002c6cSBruce M Simpson 	 * Begin state merge transaction at socket layer.
15028f002c6cSBruce M Simpson 	 */
15038f002c6cSBruce M Simpson 	if (doblock) {
15048f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: %s source", __func__, "block");
15058f002c6cSBruce M Simpson 		ims = im6f_graft(imf, fmode, &ssa->sin6);
15068f002c6cSBruce M Simpson 		if (ims == NULL)
15078f002c6cSBruce M Simpson 			error = ENOMEM;
15088f002c6cSBruce M Simpson 	} else {
15098f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: %s source", __func__, "allow");
15108f002c6cSBruce M Simpson 		error = im6f_prune(imf, &ssa->sin6);
15118f002c6cSBruce M Simpson 	}
15128f002c6cSBruce M Simpson 
15138f002c6cSBruce M Simpson 	if (error) {
15148f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: merge imf state failed", __func__);
15158f002c6cSBruce M Simpson 		goto out_im6f_rollback;
15168f002c6cSBruce M Simpson 	}
15178f002c6cSBruce M Simpson 
15188f002c6cSBruce M Simpson 	/*
15198f002c6cSBruce M Simpson 	 * Begin state merge transaction at MLD layer.
15208f002c6cSBruce M Simpson 	 */
1521f3e1324bSStephen Hurd 	IN6_MULTI_LIST_LOCK();
15228f002c6cSBruce M Simpson 	CTR1(KTR_MLD, "%s: merge inm state", __func__);
15238f002c6cSBruce M Simpson 	error = in6m_merge(inm, imf);
15244fd91336SAndrey V. Elsukov 	if (error)
15258f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: failed to merge inm state", __func__);
15264fd91336SAndrey V. Elsukov 	else {
15278f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: doing mld downcall", __func__);
15288f002c6cSBruce M Simpson 		error = mld_change_state(inm, 0);
15298f002c6cSBruce M Simpson 		if (error)
15308f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: failed mld downcall", __func__);
15314fd91336SAndrey V. Elsukov 	}
15328f002c6cSBruce M Simpson 
1533f3e1324bSStephen Hurd 	IN6_MULTI_LIST_UNLOCK();
15348f002c6cSBruce M Simpson 
15358f002c6cSBruce M Simpson out_im6f_rollback:
15368f002c6cSBruce M Simpson 	if (error)
15378f002c6cSBruce M Simpson 		im6f_rollback(imf);
15388f002c6cSBruce M Simpson 	else
15398f002c6cSBruce M Simpson 		im6f_commit(imf);
15408f002c6cSBruce M Simpson 
15418f002c6cSBruce M Simpson 	im6f_reap(imf);
15428f002c6cSBruce M Simpson 
15438f002c6cSBruce M Simpson out_in6p_locked:
15448f002c6cSBruce M Simpson 	INP_WUNLOCK(inp);
15458f002c6cSBruce M Simpson 	return (error);
15468f002c6cSBruce M Simpson }
15478f002c6cSBruce M Simpson 
15488f002c6cSBruce M Simpson /*
15498f002c6cSBruce M Simpson  * Given an inpcb, return its multicast options structure pointer.  Accepts
15508f002c6cSBruce M Simpson  * an unlocked inpcb pointer, but will return it locked.  May sleep.
15518f002c6cSBruce M Simpson  *
15528f002c6cSBruce M Simpson  * SMPng: NOTE: Potentially calls malloc(M_WAITOK) with Giant held.
15538f002c6cSBruce M Simpson  * SMPng: NOTE: Returns with the INP write lock held.
15548f002c6cSBruce M Simpson  */
15558f002c6cSBruce M Simpson static struct ip6_moptions *
15568f002c6cSBruce M Simpson in6p_findmoptions(struct inpcb *inp)
15578f002c6cSBruce M Simpson {
15588f002c6cSBruce M Simpson 	struct ip6_moptions	 *imo;
15598f002c6cSBruce M Simpson 
15608f002c6cSBruce M Simpson 	INP_WLOCK(inp);
15618f002c6cSBruce M Simpson 	if (inp->in6p_moptions != NULL)
15628f002c6cSBruce M Simpson 		return (inp->in6p_moptions);
15638f002c6cSBruce M Simpson 
15648f002c6cSBruce M Simpson 	INP_WUNLOCK(inp);
15658f002c6cSBruce M Simpson 
15668f002c6cSBruce M Simpson 	imo = malloc(sizeof(*imo), M_IP6MOPTS, M_WAITOK);
15678f002c6cSBruce M Simpson 
15688f002c6cSBruce M Simpson 	imo->im6o_multicast_ifp = NULL;
15698f002c6cSBruce M Simpson 	imo->im6o_multicast_hlim = V_ip6_defmcasthlim;
15708f002c6cSBruce M Simpson 	imo->im6o_multicast_loop = in6_mcast_loop;
157159854ecfSHans Petter Selasky 	STAILQ_INIT(&imo->im6o_head);
15728f002c6cSBruce M Simpson 
15738f002c6cSBruce M Simpson 	INP_WLOCK(inp);
15748f002c6cSBruce M Simpson 	if (inp->in6p_moptions != NULL) {
15758f002c6cSBruce M Simpson 		free(imo, M_IP6MOPTS);
15768f002c6cSBruce M Simpson 		return (inp->in6p_moptions);
15778f002c6cSBruce M Simpson 	}
15788f002c6cSBruce M Simpson 	inp->in6p_moptions = imo;
15798f002c6cSBruce M Simpson 	return (imo);
15808f002c6cSBruce M Simpson }
15818f002c6cSBruce M Simpson 
15828f002c6cSBruce M Simpson /*
15838f002c6cSBruce M Simpson  * Discard the IPv6 multicast options (and source filters).
15848f002c6cSBruce M Simpson  *
15858f002c6cSBruce M Simpson  * SMPng: NOTE: assumes INP write lock is held.
1586cb6bb230SMatt Macy  *
1587cb6bb230SMatt Macy  * XXX can all be safely deferred to epoch_call
1588cb6bb230SMatt Macy  *
15898f002c6cSBruce M Simpson  */
1590cb6bb230SMatt Macy 
1591cb6bb230SMatt Macy static void
1592f9be0386SMatt Macy inp_gcmoptions(struct ip6_moptions *imo)
15938f002c6cSBruce M Simpson {
15948f002c6cSBruce M Simpson 	struct in6_mfilter *imf;
1595b15253bbSMatt Macy 	struct in6_multi *inm;
1596b15253bbSMatt Macy 	struct ifnet *ifp;
15978f002c6cSBruce M Simpson 
159859854ecfSHans Petter Selasky 	while ((imf = ip6_mfilter_first(&imo->im6o_head)) != NULL) {
159959854ecfSHans Petter Selasky                 ip6_mfilter_remove(&imo->im6o_head, imf);
160059854ecfSHans Petter Selasky 
16018f002c6cSBruce M Simpson                 im6f_leave(imf);
160259854ecfSHans Petter Selasky                 if ((inm = imf->im6f_in6m) != NULL) {
160359854ecfSHans Petter Selasky                         if ((ifp = inm->in6m_ifp) != NULL) {
160415f8acc5SEd Maste                                 CURVNET_SET(ifp->if_vnet);
1605b15253bbSMatt Macy                                 (void)in6_leavegroup(inm, imf);
160615f8acc5SEd Maste                                 CURVNET_RESTORE();
16073b9b6b17SEd Maste                         } else {
16083b9b6b17SEd Maste                                 (void)in6_leavegroup(inm, imf);
16093b9b6b17SEd Maste                         }
16108f002c6cSBruce M Simpson                 }
161159854ecfSHans Petter Selasky                 ip6_mfilter_free(imf);
161259854ecfSHans Petter Selasky         }
16138f002c6cSBruce M Simpson         free(imo, M_IP6MOPTS);
1614cb6bb230SMatt Macy }
1615cb6bb230SMatt Macy 
1616cb6bb230SMatt Macy void
1617cb6bb230SMatt Macy ip6_freemoptions(struct ip6_moptions *imo)
1618cb6bb230SMatt Macy {
1619cb6bb230SMatt Macy 	if (imo == NULL)
1620cb6bb230SMatt Macy 		return;
1621f9be0386SMatt Macy 	inp_gcmoptions(imo);
16228f002c6cSBruce M Simpson }
16238f002c6cSBruce M Simpson 
16248f002c6cSBruce M Simpson /*
16258f002c6cSBruce M Simpson  * Atomically get source filters on a socket for an IPv6 multicast group.
16268f002c6cSBruce M Simpson  * Called with INP lock held; returns with lock released.
16278f002c6cSBruce M Simpson  */
16288f002c6cSBruce M Simpson static int
16298f002c6cSBruce M Simpson in6p_get_source_filters(struct inpcb *inp, struct sockopt *sopt)
16308f002c6cSBruce M Simpson {
16318f002c6cSBruce M Simpson 	struct __msfilterreq	 msfr;
16328f002c6cSBruce M Simpson 	sockunion_t		*gsa;
16338f002c6cSBruce M Simpson 	struct ifnet		*ifp;
16348f002c6cSBruce M Simpson 	struct ip6_moptions	*imo;
16358f002c6cSBruce M Simpson 	struct in6_mfilter	*imf;
16368f002c6cSBruce M Simpson 	struct ip6_msource	*ims;
16378f002c6cSBruce M Simpson 	struct in6_msource	*lims;
16388f002c6cSBruce M Simpson 	struct sockaddr_in6	*psin;
16398f002c6cSBruce M Simpson 	struct sockaddr_storage	*ptss;
16408f002c6cSBruce M Simpson 	struct sockaddr_storage	*tss;
16418f002c6cSBruce M Simpson 	int			 error;
164259854ecfSHans Petter Selasky 	size_t			 nsrcs, ncsrcs;
16438f002c6cSBruce M Simpson 
16448f002c6cSBruce M Simpson 	INP_WLOCK_ASSERT(inp);
16458f002c6cSBruce M Simpson 
16468f002c6cSBruce M Simpson 	imo = inp->in6p_moptions;
16478f002c6cSBruce M Simpson 	KASSERT(imo != NULL, ("%s: null ip6_moptions", __func__));
16488f002c6cSBruce M Simpson 
16498f002c6cSBruce M Simpson 	INP_WUNLOCK(inp);
16508f002c6cSBruce M Simpson 
16518f002c6cSBruce M Simpson 	error = sooptcopyin(sopt, &msfr, sizeof(struct __msfilterreq),
16528f002c6cSBruce M Simpson 	    sizeof(struct __msfilterreq));
16538f002c6cSBruce M Simpson 	if (error)
16548f002c6cSBruce M Simpson 		return (error);
16558f002c6cSBruce M Simpson 
165629dc7bc6SBruce M Simpson 	if (msfr.msfr_group.ss_family != AF_INET6 ||
165729dc7bc6SBruce M Simpson 	    msfr.msfr_group.ss_len != sizeof(struct sockaddr_in6))
16588f002c6cSBruce M Simpson 		return (EINVAL);
16598f002c6cSBruce M Simpson 
166029dc7bc6SBruce M Simpson 	gsa = (sockunion_t *)&msfr.msfr_group;
166129dc7bc6SBruce M Simpson 	if (!IN6_IS_ADDR_MULTICAST(&gsa->sin6.sin6_addr))
166229dc7bc6SBruce M Simpson 		return (EINVAL);
166329dc7bc6SBruce M Simpson 
166429dc7bc6SBruce M Simpson 	if (msfr.msfr_ifindex == 0 || V_if_index < msfr.msfr_ifindex)
166529dc7bc6SBruce M Simpson 		return (EADDRNOTAVAIL);
16668f002c6cSBruce M Simpson 	ifp = ifnet_byindex(msfr.msfr_ifindex);
16678f002c6cSBruce M Simpson 	if (ifp == NULL)
166829dc7bc6SBruce M Simpson 		return (EADDRNOTAVAIL);
166929dc7bc6SBruce M Simpson 	(void)in6_setscope(&gsa->sin6.sin6_addr, ifp, NULL);
16708f002c6cSBruce M Simpson 
16718f002c6cSBruce M Simpson 	INP_WLOCK(inp);
16728f002c6cSBruce M Simpson 
16738f002c6cSBruce M Simpson 	/*
16748f002c6cSBruce M Simpson 	 * Lookup group on the socket.
16758f002c6cSBruce M Simpson 	 */
167659854ecfSHans Petter Selasky 	imf = im6o_match_group(imo, ifp, &gsa->sa);
167759854ecfSHans Petter Selasky 	if (imf == NULL) {
16788f002c6cSBruce M Simpson 		INP_WUNLOCK(inp);
16798f002c6cSBruce M Simpson 		return (EADDRNOTAVAIL);
16808f002c6cSBruce M Simpson 	}
16818f002c6cSBruce M Simpson 
16828f002c6cSBruce M Simpson 	/*
16838f002c6cSBruce M Simpson 	 * Ignore memberships which are in limbo.
16848f002c6cSBruce M Simpson 	 */
16858f002c6cSBruce M Simpson 	if (imf->im6f_st[1] == MCAST_UNDEFINED) {
16868f002c6cSBruce M Simpson 		INP_WUNLOCK(inp);
16878f002c6cSBruce M Simpson 		return (EAGAIN);
16888f002c6cSBruce M Simpson 	}
16898f002c6cSBruce M Simpson 	msfr.msfr_fmode = imf->im6f_st[1];
16908f002c6cSBruce M Simpson 
16918f002c6cSBruce M Simpson 	/*
16928f002c6cSBruce M Simpson 	 * If the user specified a buffer, copy out the source filter
16938f002c6cSBruce M Simpson 	 * entries to userland gracefully.
16948f002c6cSBruce M Simpson 	 * We only copy out the number of entries which userland
16958f002c6cSBruce M Simpson 	 * has asked for, but we always tell userland how big the
16968f002c6cSBruce M Simpson 	 * buffer really needs to be.
16978f002c6cSBruce M Simpson 	 */
1698acde2476SXin LI 	if (msfr.msfr_nsrcs > in6_mcast_maxsocksrc)
1699acde2476SXin LI 		msfr.msfr_nsrcs = in6_mcast_maxsocksrc;
17008f002c6cSBruce M Simpson 	tss = NULL;
17018f002c6cSBruce M Simpson 	if (msfr.msfr_srcs != NULL && msfr.msfr_nsrcs > 0) {
17028f002c6cSBruce M Simpson 		tss = malloc(sizeof(struct sockaddr_storage) * msfr.msfr_nsrcs,
17038f002c6cSBruce M Simpson 		    M_TEMP, M_NOWAIT | M_ZERO);
17048f002c6cSBruce M Simpson 		if (tss == NULL) {
17058f002c6cSBruce M Simpson 			INP_WUNLOCK(inp);
17068f002c6cSBruce M Simpson 			return (ENOBUFS);
17078f002c6cSBruce M Simpson 		}
17088f002c6cSBruce M Simpson 	}
17098f002c6cSBruce M Simpson 
17108f002c6cSBruce M Simpson 	/*
17118f002c6cSBruce M Simpson 	 * Count number of sources in-mode at t0.
17128f002c6cSBruce M Simpson 	 * If buffer space exists and remains, copy out source entries.
17138f002c6cSBruce M Simpson 	 */
17148f002c6cSBruce M Simpson 	nsrcs = msfr.msfr_nsrcs;
17158f002c6cSBruce M Simpson 	ncsrcs = 0;
17168f002c6cSBruce M Simpson 	ptss = tss;
17178f002c6cSBruce M Simpson 	RB_FOREACH(ims, ip6_msource_tree, &imf->im6f_sources) {
17188f002c6cSBruce M Simpson 		lims = (struct in6_msource *)ims;
17198f002c6cSBruce M Simpson 		if (lims->im6sl_st[0] == MCAST_UNDEFINED ||
17208f002c6cSBruce M Simpson 		    lims->im6sl_st[0] != imf->im6f_st[0])
17218f002c6cSBruce M Simpson 			continue;
17228f002c6cSBruce M Simpson 		++ncsrcs;
17238f002c6cSBruce M Simpson 		if (tss != NULL && nsrcs > 0) {
17248f002c6cSBruce M Simpson 			psin = (struct sockaddr_in6 *)ptss;
17258f002c6cSBruce M Simpson 			psin->sin6_family = AF_INET6;
17268f002c6cSBruce M Simpson 			psin->sin6_len = sizeof(struct sockaddr_in6);
17278f002c6cSBruce M Simpson 			psin->sin6_addr = lims->im6s_addr;
17288f002c6cSBruce M Simpson 			psin->sin6_port = 0;
17298f002c6cSBruce M Simpson 			--nsrcs;
17308f002c6cSBruce M Simpson 			++ptss;
17318f002c6cSBruce M Simpson 		}
17328f002c6cSBruce M Simpson 	}
17338f002c6cSBruce M Simpson 
17348f002c6cSBruce M Simpson 	INP_WUNLOCK(inp);
17358f002c6cSBruce M Simpson 
17368f002c6cSBruce M Simpson 	if (tss != NULL) {
17378f002c6cSBruce M Simpson 		error = copyout(tss, msfr.msfr_srcs,
17388f002c6cSBruce M Simpson 		    sizeof(struct sockaddr_storage) * msfr.msfr_nsrcs);
17398f002c6cSBruce M Simpson 		free(tss, M_TEMP);
17408f002c6cSBruce M Simpson 		if (error)
17418f002c6cSBruce M Simpson 			return (error);
17428f002c6cSBruce M Simpson 	}
17438f002c6cSBruce M Simpson 
17448f002c6cSBruce M Simpson 	msfr.msfr_nsrcs = ncsrcs;
17458f002c6cSBruce M Simpson 	error = sooptcopyout(sopt, &msfr, sizeof(struct __msfilterreq));
17468f002c6cSBruce M Simpson 
17478f002c6cSBruce M Simpson 	return (error);
17488f002c6cSBruce M Simpson }
17498f002c6cSBruce M Simpson 
17508f002c6cSBruce M Simpson /*
17518f002c6cSBruce M Simpson  * Return the IP multicast options in response to user getsockopt().
17528f002c6cSBruce M Simpson  */
17538f002c6cSBruce M Simpson int
17548f002c6cSBruce M Simpson ip6_getmoptions(struct inpcb *inp, struct sockopt *sopt)
17558f002c6cSBruce M Simpson {
175633cde130SBruce M Simpson 	struct ip6_moptions	*im6o;
175733cde130SBruce M Simpson 	int			 error;
175833cde130SBruce M Simpson 	u_int			 optval;
17598f002c6cSBruce M Simpson 
17608f002c6cSBruce M Simpson 	INP_WLOCK(inp);
176133cde130SBruce M Simpson 	im6o = inp->in6p_moptions;
17628f002c6cSBruce M Simpson 	/*
17638f002c6cSBruce M Simpson 	 * If socket is neither of type SOCK_RAW or SOCK_DGRAM,
17648f002c6cSBruce M Simpson 	 * or is a divert socket, reject it.
17658f002c6cSBruce M Simpson 	 */
17668f002c6cSBruce M Simpson 	if (inp->inp_socket->so_proto->pr_protocol == IPPROTO_DIVERT ||
17678f002c6cSBruce M Simpson 	    (inp->inp_socket->so_proto->pr_type != SOCK_RAW &&
17688f002c6cSBruce M Simpson 	    inp->inp_socket->so_proto->pr_type != SOCK_DGRAM)) {
17698f002c6cSBruce M Simpson 		INP_WUNLOCK(inp);
17708f002c6cSBruce M Simpson 		return (EOPNOTSUPP);
17718f002c6cSBruce M Simpson 	}
17728f002c6cSBruce M Simpson 
17738f002c6cSBruce M Simpson 	error = 0;
17748f002c6cSBruce M Simpson 	switch (sopt->sopt_name) {
17758f002c6cSBruce M Simpson 	case IPV6_MULTICAST_IF:
177633cde130SBruce M Simpson 		if (im6o == NULL || im6o->im6o_multicast_ifp == NULL) {
17778f002c6cSBruce M Simpson 			optval = 0;
17788f002c6cSBruce M Simpson 		} else {
177933cde130SBruce M Simpson 			optval = im6o->im6o_multicast_ifp->if_index;
17808f002c6cSBruce M Simpson 		}
17818f002c6cSBruce M Simpson 		INP_WUNLOCK(inp);
178233cde130SBruce M Simpson 		error = sooptcopyout(sopt, &optval, sizeof(u_int));
17838f002c6cSBruce M Simpson 		break;
17848f002c6cSBruce M Simpson 
17858f002c6cSBruce M Simpson 	case IPV6_MULTICAST_HOPS:
178633cde130SBruce M Simpson 		if (im6o == NULL)
178733cde130SBruce M Simpson 			optval = V_ip6_defmcasthlim;
17888f002c6cSBruce M Simpson 		else
178908907004SBjoern A. Zeeb 			optval = im6o->im6o_multicast_hlim;
17908f002c6cSBruce M Simpson 		INP_WUNLOCK(inp);
17918f002c6cSBruce M Simpson 		error = sooptcopyout(sopt, &optval, sizeof(u_int));
17928f002c6cSBruce M Simpson 		break;
17938f002c6cSBruce M Simpson 
17948f002c6cSBruce M Simpson 	case IPV6_MULTICAST_LOOP:
179533cde130SBruce M Simpson 		if (im6o == NULL)
179633cde130SBruce M Simpson 			optval = in6_mcast_loop; /* XXX VIMAGE */
17978f002c6cSBruce M Simpson 		else
179833cde130SBruce M Simpson 			optval = im6o->im6o_multicast_loop;
17998f002c6cSBruce M Simpson 		INP_WUNLOCK(inp);
18008f002c6cSBruce M Simpson 		error = sooptcopyout(sopt, &optval, sizeof(u_int));
18018f002c6cSBruce M Simpson 		break;
18028f002c6cSBruce M Simpson 
18038f002c6cSBruce M Simpson 	case IPV6_MSFILTER:
180433cde130SBruce M Simpson 		if (im6o == NULL) {
18058f002c6cSBruce M Simpson 			error = EADDRNOTAVAIL;
18068f002c6cSBruce M Simpson 			INP_WUNLOCK(inp);
18078f002c6cSBruce M Simpson 		} else {
18088f002c6cSBruce M Simpson 			error = in6p_get_source_filters(inp, sopt);
18098f002c6cSBruce M Simpson 		}
18108f002c6cSBruce M Simpson 		break;
18118f002c6cSBruce M Simpson 
18128f002c6cSBruce M Simpson 	default:
18138f002c6cSBruce M Simpson 		INP_WUNLOCK(inp);
18148f002c6cSBruce M Simpson 		error = ENOPROTOOPT;
18158f002c6cSBruce M Simpson 		break;
18168f002c6cSBruce M Simpson 	}
18178f002c6cSBruce M Simpson 
18188f002c6cSBruce M Simpson 	INP_UNLOCK_ASSERT(inp);
18198f002c6cSBruce M Simpson 
18208f002c6cSBruce M Simpson 	return (error);
18218f002c6cSBruce M Simpson }
18228f002c6cSBruce M Simpson 
18238f002c6cSBruce M Simpson /*
182433cde130SBruce M Simpson  * Look up the ifnet to use for a multicast group membership,
182533cde130SBruce M Simpson  * given the address of an IPv6 group.
182633cde130SBruce M Simpson  *
182733cde130SBruce M Simpson  * This routine exists to support legacy IPv6 multicast applications.
182833cde130SBruce M Simpson  *
1829cfae6a92SMark Johnston  * Use the socket's current FIB number for any required FIB lookup. Look up the
1830cfae6a92SMark Johnston  * group address in the unicast FIB, and use its ifp; usually, this points to
1831cfae6a92SMark Johnston  * the default next-hop.  If the FIB lookup fails, return NULL.
183233cde130SBruce M Simpson  *
183333cde130SBruce M Simpson  * FUTURE: Support multiple forwarding tables for IPv6.
183433cde130SBruce M Simpson  *
183533cde130SBruce M Simpson  * Returns NULL if no ifp could be found.
183633cde130SBruce M Simpson  */
183733cde130SBruce M Simpson static struct ifnet *
1838cfae6a92SMark Johnston in6p_lookup_mcast_ifp(const struct inpcb *inp, const struct sockaddr_in6 *gsin6)
183933cde130SBruce M Simpson {
18406ad7446cSAlexander V. Chernikov 	struct nhop_object	*nh;
18419977be4aSAlexander V. Chernikov 	struct in6_addr		dst;
18429977be4aSAlexander V. Chernikov 	uint32_t		scopeid;
18439977be4aSAlexander V. Chernikov 	uint32_t		fibnum;
184433cde130SBruce M Simpson 
184533cde130SBruce M Simpson 	KASSERT(gsin6->sin6_family == AF_INET6,
184633cde130SBruce M Simpson 	    ("%s: not AF_INET6 group", __func__));
184733cde130SBruce M Simpson 
18489977be4aSAlexander V. Chernikov 	in6_splitscope(&gsin6->sin6_addr, &dst, &scopeid);
1849cfae6a92SMark Johnston 	fibnum = inp->inp_inc.inc_fibnum;
18506ad7446cSAlexander V. Chernikov 	nh = fib6_lookup(fibnum, &dst, scopeid, 0, 0);
185133cde130SBruce M Simpson 
18526ad7446cSAlexander V. Chernikov 	return (nh ? nh->nh_ifp : NULL);
185333cde130SBruce M Simpson }
185433cde130SBruce M Simpson 
185533cde130SBruce M Simpson /*
18568f002c6cSBruce M Simpson  * Join an IPv6 multicast group, possibly with a source.
185733cde130SBruce M Simpson  *
185833cde130SBruce M Simpson  * FIXME: The KAME use of the unspecified address (::)
185933cde130SBruce M Simpson  * to join *all* multicast groups is currently unsupported.
18608f002c6cSBruce M Simpson  */
18618f002c6cSBruce M Simpson static int
18628f002c6cSBruce M Simpson in6p_join_group(struct inpcb *inp, struct sockopt *sopt)
18638f002c6cSBruce M Simpson {
18642cd6ad76SHans Petter Selasky 	struct in6_multi_head		 inmh;
18658f002c6cSBruce M Simpson 	struct group_source_req		 gsr;
18668f002c6cSBruce M Simpson 	sockunion_t			*gsa, *ssa;
18678f002c6cSBruce M Simpson 	struct ifnet			*ifp;
18688f002c6cSBruce M Simpson 	struct in6_mfilter		*imf;
18698f002c6cSBruce M Simpson 	struct ip6_moptions		*imo;
18708f002c6cSBruce M Simpson 	struct in6_multi		*inm;
18718f002c6cSBruce M Simpson 	struct in6_msource		*lims;
18728f002c6cSBruce M Simpson 	int				 error, is_new;
18738f002c6cSBruce M Simpson 
18742cd6ad76SHans Petter Selasky 	SLIST_INIT(&inmh);
18758f002c6cSBruce M Simpson 	ifp = NULL;
18761f81c2b6SBruce M Simpson 	lims = NULL;
18778f002c6cSBruce M Simpson 	error = 0;
18788f002c6cSBruce M Simpson 
18798f002c6cSBruce M Simpson 	memset(&gsr, 0, sizeof(struct group_source_req));
18808f002c6cSBruce M Simpson 	gsa = (sockunion_t *)&gsr.gsr_group;
18818f002c6cSBruce M Simpson 	gsa->ss.ss_family = AF_UNSPEC;
18828f002c6cSBruce M Simpson 	ssa = (sockunion_t *)&gsr.gsr_source;
18838f002c6cSBruce M Simpson 	ssa->ss.ss_family = AF_UNSPEC;
18848f002c6cSBruce M Simpson 
188529dc7bc6SBruce M Simpson 	/*
188629dc7bc6SBruce M Simpson 	 * Chew everything into struct group_source_req.
188729dc7bc6SBruce M Simpson 	 * Overwrite the port field if present, as the sockaddr
188829dc7bc6SBruce M Simpson 	 * being copied in may be matched with a binary comparison.
188929dc7bc6SBruce M Simpson 	 * Ignore passed-in scope ID.
189029dc7bc6SBruce M Simpson 	 */
18918f002c6cSBruce M Simpson 	switch (sopt->sopt_name) {
18928f002c6cSBruce M Simpson 	case IPV6_JOIN_GROUP: {
18938f002c6cSBruce M Simpson 		struct ipv6_mreq mreq;
18948f002c6cSBruce M Simpson 
18958f002c6cSBruce M Simpson 		error = sooptcopyin(sopt, &mreq, sizeof(struct ipv6_mreq),
18968f002c6cSBruce M Simpson 		    sizeof(struct ipv6_mreq));
18978f002c6cSBruce M Simpson 		if (error)
18988f002c6cSBruce M Simpson 			return (error);
18998f002c6cSBruce M Simpson 
19008f002c6cSBruce M Simpson 		gsa->sin6.sin6_family = AF_INET6;
19018f002c6cSBruce M Simpson 		gsa->sin6.sin6_len = sizeof(struct sockaddr_in6);
19028f002c6cSBruce M Simpson 		gsa->sin6.sin6_addr = mreq.ipv6mr_multiaddr;
19038f002c6cSBruce M Simpson 
190433cde130SBruce M Simpson 		if (mreq.ipv6mr_interface == 0) {
190533cde130SBruce M Simpson 			ifp = in6p_lookup_mcast_ifp(inp, &gsa->sin6);
190633cde130SBruce M Simpson 		} else {
1907010c2b81SBjoern A. Zeeb 			if (V_if_index < mreq.ipv6mr_interface)
190833cde130SBruce M Simpson 				return (EADDRNOTAVAIL);
19098f002c6cSBruce M Simpson 			ifp = ifnet_byindex(mreq.ipv6mr_interface);
191033cde130SBruce M Simpson 		}
19118f002c6cSBruce M Simpson 		CTR3(KTR_MLD, "%s: ipv6mr_interface = %d, ifp = %p",
19128f002c6cSBruce M Simpson 		    __func__, mreq.ipv6mr_interface, ifp);
19138f002c6cSBruce M Simpson 	} break;
19148f002c6cSBruce M Simpson 
19158f002c6cSBruce M Simpson 	case MCAST_JOIN_GROUP:
19168f002c6cSBruce M Simpson 	case MCAST_JOIN_SOURCE_GROUP:
19178f002c6cSBruce M Simpson 		if (sopt->sopt_name == MCAST_JOIN_GROUP) {
19188f002c6cSBruce M Simpson 			error = sooptcopyin(sopt, &gsr,
19198f002c6cSBruce M Simpson 			    sizeof(struct group_req),
19208f002c6cSBruce M Simpson 			    sizeof(struct group_req));
19218f002c6cSBruce M Simpson 		} else if (sopt->sopt_name == MCAST_JOIN_SOURCE_GROUP) {
19228f002c6cSBruce M Simpson 			error = sooptcopyin(sopt, &gsr,
19238f002c6cSBruce M Simpson 			    sizeof(struct group_source_req),
19248f002c6cSBruce M Simpson 			    sizeof(struct group_source_req));
19258f002c6cSBruce M Simpson 		}
19268f002c6cSBruce M Simpson 		if (error)
19278f002c6cSBruce M Simpson 			return (error);
19288f002c6cSBruce M Simpson 
19298f002c6cSBruce M Simpson 		if (gsa->sin6.sin6_family != AF_INET6 ||
19308f002c6cSBruce M Simpson 		    gsa->sin6.sin6_len != sizeof(struct sockaddr_in6))
19318f002c6cSBruce M Simpson 			return (EINVAL);
19328f002c6cSBruce M Simpson 
19338f002c6cSBruce M Simpson 		if (sopt->sopt_name == MCAST_JOIN_SOURCE_GROUP) {
19348f002c6cSBruce M Simpson 			if (ssa->sin6.sin6_family != AF_INET6 ||
19358f002c6cSBruce M Simpson 			    ssa->sin6.sin6_len != sizeof(struct sockaddr_in6))
19368f002c6cSBruce M Simpson 				return (EINVAL);
193729dc7bc6SBruce M Simpson 			if (IN6_IS_ADDR_MULTICAST(&ssa->sin6.sin6_addr))
193829dc7bc6SBruce M Simpson 				return (EINVAL);
193929dc7bc6SBruce M Simpson 			/*
194029dc7bc6SBruce M Simpson 			 * TODO: Validate embedded scope ID in source
194129dc7bc6SBruce M Simpson 			 * list entry against passed-in ifp, if and only
194229dc7bc6SBruce M Simpson 			 * if source list filter entry is iface or node local.
194329dc7bc6SBruce M Simpson 			 */
194429dc7bc6SBruce M Simpson 			in6_clearscope(&ssa->sin6.sin6_addr);
19458f002c6cSBruce M Simpson 			ssa->sin6.sin6_port = 0;
194629dc7bc6SBruce M Simpson 			ssa->sin6.sin6_scope_id = 0;
19478f002c6cSBruce M Simpson 		}
19488f002c6cSBruce M Simpson 
19498f002c6cSBruce M Simpson 		if (gsr.gsr_interface == 0 || V_if_index < gsr.gsr_interface)
19508f002c6cSBruce M Simpson 			return (EADDRNOTAVAIL);
19518f002c6cSBruce M Simpson 		ifp = ifnet_byindex(gsr.gsr_interface);
19528f002c6cSBruce M Simpson 		break;
19538f002c6cSBruce M Simpson 
19548f002c6cSBruce M Simpson 	default:
19558f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: unknown sopt_name %d",
19568f002c6cSBruce M Simpson 		    __func__, sopt->sopt_name);
19578f002c6cSBruce M Simpson 		return (EOPNOTSUPP);
19588f002c6cSBruce M Simpson 		break;
19598f002c6cSBruce M Simpson 	}
19608f002c6cSBruce M Simpson 
19618f002c6cSBruce M Simpson 	if (!IN6_IS_ADDR_MULTICAST(&gsa->sin6.sin6_addr))
19628f002c6cSBruce M Simpson 		return (EINVAL);
19638f002c6cSBruce M Simpson 
19648f002c6cSBruce M Simpson 	if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0)
19658f002c6cSBruce M Simpson 		return (EADDRNOTAVAIL);
19668f002c6cSBruce M Simpson 
196729dc7bc6SBruce M Simpson 	gsa->sin6.sin6_port = 0;
196829dc7bc6SBruce M Simpson 	gsa->sin6.sin6_scope_id = 0;
196929dc7bc6SBruce M Simpson 
197033cde130SBruce M Simpson 	/*
197129dc7bc6SBruce M Simpson 	 * Always set the scope zone ID on memberships created from userland.
197229dc7bc6SBruce M Simpson 	 * Use the passed-in ifp to do this.
197329dc7bc6SBruce M Simpson 	 * XXX The in6_setscope() return value is meaningless.
197429dc7bc6SBruce M Simpson 	 * XXX SCOPE6_LOCK() is taken by in6_setscope().
197533cde130SBruce M Simpson 	 */
197629dc7bc6SBruce M Simpson 	(void)in6_setscope(&gsa->sin6.sin6_addr, ifp, NULL);
197733cde130SBruce M Simpson 
197859854ecfSHans Petter Selasky 	IN6_MULTI_LOCK();
197959854ecfSHans Petter Selasky 
198059854ecfSHans Petter Selasky 	/*
198159854ecfSHans Petter Selasky 	 * Find the membership in the membership list.
198259854ecfSHans Petter Selasky 	 */
19838f002c6cSBruce M Simpson 	imo = in6p_findmoptions(inp);
198459854ecfSHans Petter Selasky 	imf = im6o_match_group(imo, ifp, &gsa->sa);
198559854ecfSHans Petter Selasky 	if (imf == NULL) {
19868f002c6cSBruce M Simpson 		is_new = 1;
198759854ecfSHans Petter Selasky 		inm = NULL;
198859854ecfSHans Petter Selasky 
198959854ecfSHans Petter Selasky 		if (ip6_mfilter_count(&imo->im6o_head) >= IPV6_MAX_MEMBERSHIPS) {
199059854ecfSHans Petter Selasky 			error = ENOMEM;
199159854ecfSHans Petter Selasky 			goto out_in6p_locked;
199259854ecfSHans Petter Selasky 		}
19938f002c6cSBruce M Simpson 	} else {
199459854ecfSHans Petter Selasky 		is_new = 0;
199559854ecfSHans Petter Selasky 		inm = imf->im6f_in6m;
199659854ecfSHans Petter Selasky 
19971ee6b058SBruce M Simpson 		if (ssa->ss.ss_family != AF_UNSPEC) {
19981ee6b058SBruce M Simpson 			/*
19991ee6b058SBruce M Simpson 			 * MCAST_JOIN_SOURCE_GROUP on an exclusive membership
20001ee6b058SBruce M Simpson 			 * is an error. On an existing inclusive membership,
20011ee6b058SBruce M Simpson 			 * it just adds the source to the filter list.
20021ee6b058SBruce M Simpson 			 */
20031ee6b058SBruce M Simpson 			if (imf->im6f_st[1] != MCAST_INCLUDE) {
20048f002c6cSBruce M Simpson 				error = EINVAL;
20058f002c6cSBruce M Simpson 				goto out_in6p_locked;
20068f002c6cSBruce M Simpson 			}
20071f81c2b6SBruce M Simpson 			/*
20081f81c2b6SBruce M Simpson 			 * Throw out duplicates.
20091f81c2b6SBruce M Simpson 			 *
20101f81c2b6SBruce M Simpson 			 * XXX FIXME: This makes a naive assumption that
20111f81c2b6SBruce M Simpson 			 * even if entries exist for *ssa in this imf,
20121f81c2b6SBruce M Simpson 			 * they will be rejected as dupes, even if they
20131f81c2b6SBruce M Simpson 			 * are not valid in the current mode (in-mode).
20141f81c2b6SBruce M Simpson 			 *
20151f81c2b6SBruce M Simpson 			 * in6_msource is transactioned just as for anything
20161f81c2b6SBruce M Simpson 			 * else in SSM -- but note naive use of in6m_graft()
20171f81c2b6SBruce M Simpson 			 * below for allocating new filter entries.
20181f81c2b6SBruce M Simpson 			 *
20191f81c2b6SBruce M Simpson 			 * This is only an issue if someone mixes the
20201f81c2b6SBruce M Simpson 			 * full-state SSM API with the delta-based API,
20211f81c2b6SBruce M Simpson 			 * which is discouraged in the relevant RFCs.
20221f81c2b6SBruce M Simpson 			 */
202359854ecfSHans Petter Selasky 			lims = im6o_match_source(imf, &ssa->sa);
20241f81c2b6SBruce M Simpson 			if (lims != NULL /*&&
20251f81c2b6SBruce M Simpson 			    lims->im6sl_st[1] == MCAST_INCLUDE*/) {
20268f002c6cSBruce M Simpson 				error = EADDRNOTAVAIL;
20278f002c6cSBruce M Simpson 				goto out_in6p_locked;
20288f002c6cSBruce M Simpson 			}
20291ee6b058SBruce M Simpson 		} else {
20301ee6b058SBruce M Simpson 			/*
2031604a60d1SBruce M Simpson 			 * MCAST_JOIN_GROUP alone, on any existing membership,
2032604a60d1SBruce M Simpson 			 * is rejected, to stop the same inpcb tying up
2033604a60d1SBruce M Simpson 			 * multiple refs to the in_multi.
2034604a60d1SBruce M Simpson 			 * On an existing inclusive membership, this is also
2035604a60d1SBruce M Simpson 			 * an error; if you want to change filter mode,
2036604a60d1SBruce M Simpson 			 * you must use the userland API setsourcefilter().
2037604a60d1SBruce M Simpson 			 * XXX We don't reject this for imf in UNDEFINED
2038604a60d1SBruce M Simpson 			 * state at t1, because allocation of a filter
2039604a60d1SBruce M Simpson 			 * is atomic with allocation of a membership.
20401ee6b058SBruce M Simpson 			 */
20411ee6b058SBruce M Simpson 			error = EINVAL;
20421ee6b058SBruce M Simpson 			goto out_in6p_locked;
20431ee6b058SBruce M Simpson 		}
20441ee6b058SBruce M Simpson 	}
20458f002c6cSBruce M Simpson 
20468f002c6cSBruce M Simpson 	/*
20478f002c6cSBruce M Simpson 	 * Begin state merge transaction at socket layer.
20488f002c6cSBruce M Simpson 	 */
20498f002c6cSBruce M Simpson 	INP_WLOCK_ASSERT(inp);
20508f002c6cSBruce M Simpson 
20518f002c6cSBruce M Simpson 	/*
20528f002c6cSBruce M Simpson 	 * Graft new source into filter list for this inpcb's
20538f002c6cSBruce M Simpson 	 * membership of the group. The in6_multi may not have
20541ee6b058SBruce M Simpson 	 * been allocated yet if this is a new membership, however,
20551ee6b058SBruce M Simpson 	 * the in_mfilter slot will be allocated and must be initialized.
2056604a60d1SBruce M Simpson 	 *
2057604a60d1SBruce M Simpson 	 * Note: Grafting of exclusive mode filters doesn't happen
2058604a60d1SBruce M Simpson 	 * in this path.
20591f81c2b6SBruce M Simpson 	 * XXX: Should check for non-NULL lims (node exists but may
20601f81c2b6SBruce M Simpson 	 * not be in-mode) for interop with full-state API.
20618f002c6cSBruce M Simpson 	 */
20628f002c6cSBruce M Simpson 	if (ssa->ss.ss_family != AF_UNSPEC) {
20638f002c6cSBruce M Simpson 		/* Membership starts in IN mode */
20648f002c6cSBruce M Simpson 		if (is_new) {
20658f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: new join w/source", __func__);
206659854ecfSHans Petter Selasky 			imf = ip6_mfilter_alloc(M_NOWAIT, MCAST_UNDEFINED, MCAST_INCLUDE);
206759854ecfSHans Petter Selasky 			if (imf == NULL) {
206859854ecfSHans Petter Selasky 				error = ENOMEM;
206959854ecfSHans Petter Selasky 				goto out_in6p_locked;
207059854ecfSHans Petter Selasky 			}
20718f002c6cSBruce M Simpson 		} else {
20728f002c6cSBruce M Simpson 			CTR2(KTR_MLD, "%s: %s source", __func__, "allow");
20738f002c6cSBruce M Simpson 		}
20748f002c6cSBruce M Simpson 		lims = im6f_graft(imf, MCAST_INCLUDE, &ssa->sin6);
20758f002c6cSBruce M Simpson 		if (lims == NULL) {
20768f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: merge imf state failed",
20778f002c6cSBruce M Simpson 			    __func__);
20788f002c6cSBruce M Simpson 			error = ENOMEM;
207959854ecfSHans Petter Selasky 			goto out_in6p_locked;
20808f002c6cSBruce M Simpson 		}
20811ee6b058SBruce M Simpson 	} else {
20821ee6b058SBruce M Simpson 		/* No address specified; Membership starts in EX mode */
20831ee6b058SBruce M Simpson 		if (is_new) {
20841ee6b058SBruce M Simpson 			CTR1(KTR_MLD, "%s: new join w/o source", __func__);
208559854ecfSHans Petter Selasky 			imf = ip6_mfilter_alloc(M_NOWAIT, MCAST_UNDEFINED, MCAST_EXCLUDE);
208659854ecfSHans Petter Selasky 			if (imf == NULL) {
208759854ecfSHans Petter Selasky 				error = ENOMEM;
208859854ecfSHans Petter Selasky 				goto out_in6p_locked;
208959854ecfSHans Petter Selasky 			}
20901ee6b058SBruce M Simpson 		}
20918f002c6cSBruce M Simpson 	}
20928f002c6cSBruce M Simpson 
20938f002c6cSBruce M Simpson 	/*
20948f002c6cSBruce M Simpson 	 * Begin state merge transaction at MLD layer.
20958f002c6cSBruce M Simpson 	 */
209659854ecfSHans Petter Selasky 	if (is_new) {
2097f00876fbSMark Johnston 		in_pcbref(inp);
2098f00876fbSMark Johnston 		INP_WUNLOCK(inp);
2099f00876fbSMark Johnston 
2100f3e1324bSStephen Hurd 		error = in6_joingroup_locked(ifp, &gsa->sin6.sin6_addr, imf,
210159854ecfSHans Petter Selasky 		    &imf->im6f_in6m, 0);
210259854ecfSHans Petter Selasky 
210359854ecfSHans Petter Selasky 		INP_WLOCK(inp);
210459854ecfSHans Petter Selasky 		if (in_pcbrele_wlocked(inp)) {
210559854ecfSHans Petter Selasky 			error = ENXIO;
210659854ecfSHans Petter Selasky 			goto out_in6p_unlocked;
210759854ecfSHans Petter Selasky 		}
21084fd91336SAndrey V. Elsukov 		if (error) {
210959854ecfSHans Petter Selasky 			goto out_in6p_locked;
21104fd91336SAndrey V. Elsukov 		}
2111130f575dSHans Petter Selasky 		/*
2112130f575dSHans Petter Selasky 		 * NOTE: Refcount from in6_joingroup_locked()
2113130f575dSHans Petter Selasky 		 * is protecting membership.
2114130f575dSHans Petter Selasky 		 */
21155b64b824SHans Petter Selasky 		ip6_mfilter_insert(&imo->im6o_head, imf);
21168f002c6cSBruce M Simpson 	} else {
21178f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: merge inm state", __func__);
2118f3e1324bSStephen Hurd 		IN6_MULTI_LIST_LOCK();
21198f002c6cSBruce M Simpson 		error = in6m_merge(inm, imf);
212059854ecfSHans Petter Selasky 		if (error) {
21218f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: failed to merge inm state",
21228f002c6cSBruce M Simpson 			    __func__);
212359854ecfSHans Petter Selasky 			IN6_MULTI_LIST_UNLOCK();
212459854ecfSHans Petter Selasky 			im6f_rollback(imf);
212559854ecfSHans Petter Selasky 			im6f_reap(imf);
212659854ecfSHans Petter Selasky 			goto out_in6p_locked;
212759854ecfSHans Petter Selasky 		}
21288f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: doing mld downcall", __func__);
21298f002c6cSBruce M Simpson 		error = mld_change_state(inm, 0);
213059854ecfSHans Petter Selasky 		IN6_MULTI_LIST_UNLOCK();
213159854ecfSHans Petter Selasky 
213259854ecfSHans Petter Selasky 		if (error) {
21338f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: failed mld downcall",
21348f002c6cSBruce M Simpson 			     __func__);
21358f002c6cSBruce M Simpson 			im6f_rollback(imf);
21368f002c6cSBruce M Simpson 			im6f_reap(imf);
213759854ecfSHans Petter Selasky 			goto out_in6p_locked;
213859854ecfSHans Petter Selasky 		}
21398f002c6cSBruce M Simpson 	}
21408f002c6cSBruce M Simpson 
214159854ecfSHans Petter Selasky 	im6f_commit(imf);
214259854ecfSHans Petter Selasky 	imf = NULL;
21438f002c6cSBruce M Simpson 
21448f002c6cSBruce M Simpson out_in6p_locked:
21458f002c6cSBruce M Simpson 	INP_WUNLOCK(inp);
214659854ecfSHans Petter Selasky out_in6p_unlocked:
214759854ecfSHans Petter Selasky 	IN6_MULTI_UNLOCK();
214859854ecfSHans Petter Selasky 
214959854ecfSHans Petter Selasky 	if (is_new && imf) {
215059854ecfSHans Petter Selasky 		if (imf->im6f_in6m != NULL) {
215159854ecfSHans Petter Selasky 			struct in6_multi_head inmh;
215259854ecfSHans Petter Selasky 
215359854ecfSHans Petter Selasky 			SLIST_INIT(&inmh);
215459854ecfSHans Petter Selasky 			SLIST_INSERT_HEAD(&inmh, imf->im6f_in6m, in6m_defer);
21552cd6ad76SHans Petter Selasky 			in6m_release_list_deferred(&inmh);
215659854ecfSHans Petter Selasky 		}
215759854ecfSHans Petter Selasky 		ip6_mfilter_free(imf);
215859854ecfSHans Petter Selasky 	}
21598f002c6cSBruce M Simpson 	return (error);
21608f002c6cSBruce M Simpson }
21618f002c6cSBruce M Simpson 
21628f002c6cSBruce M Simpson /*
21638f002c6cSBruce M Simpson  * Leave an IPv6 multicast group on an inpcb, possibly with a source.
21648f002c6cSBruce M Simpson  */
21658f002c6cSBruce M Simpson static int
21668f002c6cSBruce M Simpson in6p_leave_group(struct inpcb *inp, struct sockopt *sopt)
21678f002c6cSBruce M Simpson {
216829dc7bc6SBruce M Simpson 	struct ipv6_mreq		 mreq;
21698f002c6cSBruce M Simpson 	struct group_source_req		 gsr;
21708f002c6cSBruce M Simpson 	sockunion_t			*gsa, *ssa;
21718f002c6cSBruce M Simpson 	struct ifnet			*ifp;
21728f002c6cSBruce M Simpson 	struct in6_mfilter		*imf;
21738f002c6cSBruce M Simpson 	struct ip6_moptions		*imo;
21748f002c6cSBruce M Simpson 	struct in6_msource		*ims;
21758f002c6cSBruce M Simpson 	struct in6_multi		*inm;
217629dc7bc6SBruce M Simpson 	uint32_t			 ifindex;
217759854ecfSHans Petter Selasky 	int				 error;
217859854ecfSHans Petter Selasky 	bool				 is_final;
21798f002c6cSBruce M Simpson #ifdef KTR
21808f002c6cSBruce M Simpson 	char				 ip6tbuf[INET6_ADDRSTRLEN];
21818f002c6cSBruce M Simpson #endif
21828f002c6cSBruce M Simpson 
21838f002c6cSBruce M Simpson 	ifp = NULL;
218429dc7bc6SBruce M Simpson 	ifindex = 0;
21858f002c6cSBruce M Simpson 	error = 0;
218659854ecfSHans Petter Selasky 	is_final = true;
21878f002c6cSBruce M Simpson 
21888f002c6cSBruce M Simpson 	memset(&gsr, 0, sizeof(struct group_source_req));
21898f002c6cSBruce M Simpson 	gsa = (sockunion_t *)&gsr.gsr_group;
21908f002c6cSBruce M Simpson 	gsa->ss.ss_family = AF_UNSPEC;
21918f002c6cSBruce M Simpson 	ssa = (sockunion_t *)&gsr.gsr_source;
21928f002c6cSBruce M Simpson 	ssa->ss.ss_family = AF_UNSPEC;
21938f002c6cSBruce M Simpson 
219429dc7bc6SBruce M Simpson 	/*
219529dc7bc6SBruce M Simpson 	 * Chew everything passed in up into a struct group_source_req
219629dc7bc6SBruce M Simpson 	 * as that is easier to process.
219729dc7bc6SBruce M Simpson 	 * Note: Any embedded scope ID in the multicast group passed
219829dc7bc6SBruce M Simpson 	 * in by userland is ignored, the interface index is the recommended
219929dc7bc6SBruce M Simpson 	 * mechanism to specify an interface; see below.
220029dc7bc6SBruce M Simpson 	 */
22018f002c6cSBruce M Simpson 	switch (sopt->sopt_name) {
220229dc7bc6SBruce M Simpson 	case IPV6_LEAVE_GROUP:
22038f002c6cSBruce M Simpson 		error = sooptcopyin(sopt, &mreq, sizeof(struct ipv6_mreq),
22048f002c6cSBruce M Simpson 		    sizeof(struct ipv6_mreq));
22058f002c6cSBruce M Simpson 		if (error)
22068f002c6cSBruce M Simpson 			return (error);
22078f002c6cSBruce M Simpson 		gsa->sin6.sin6_family = AF_INET6;
22088f002c6cSBruce M Simpson 		gsa->sin6.sin6_len = sizeof(struct sockaddr_in6);
22098f002c6cSBruce M Simpson 		gsa->sin6.sin6_addr = mreq.ipv6mr_multiaddr;
221029dc7bc6SBruce M Simpson 		gsa->sin6.sin6_port = 0;
221129dc7bc6SBruce M Simpson 		gsa->sin6.sin6_scope_id = 0;
221229dc7bc6SBruce M Simpson 		ifindex = mreq.ipv6mr_interface;
221329dc7bc6SBruce M Simpson 		break;
22148f002c6cSBruce M Simpson 
22158f002c6cSBruce M Simpson 	case MCAST_LEAVE_GROUP:
22168f002c6cSBruce M Simpson 	case MCAST_LEAVE_SOURCE_GROUP:
22178f002c6cSBruce M Simpson 		if (sopt->sopt_name == MCAST_LEAVE_GROUP) {
22188f002c6cSBruce M Simpson 			error = sooptcopyin(sopt, &gsr,
22198f002c6cSBruce M Simpson 			    sizeof(struct group_req),
22208f002c6cSBruce M Simpson 			    sizeof(struct group_req));
22218f002c6cSBruce M Simpson 		} else if (sopt->sopt_name == MCAST_LEAVE_SOURCE_GROUP) {
22228f002c6cSBruce M Simpson 			error = sooptcopyin(sopt, &gsr,
22238f002c6cSBruce M Simpson 			    sizeof(struct group_source_req),
22248f002c6cSBruce M Simpson 			    sizeof(struct group_source_req));
22258f002c6cSBruce M Simpson 		}
22268f002c6cSBruce M Simpson 		if (error)
22278f002c6cSBruce M Simpson 			return (error);
22288f002c6cSBruce M Simpson 
22298f002c6cSBruce M Simpson 		if (gsa->sin6.sin6_family != AF_INET6 ||
22308f002c6cSBruce M Simpson 		    gsa->sin6.sin6_len != sizeof(struct sockaddr_in6))
22318f002c6cSBruce M Simpson 			return (EINVAL);
22328f002c6cSBruce M Simpson 		if (sopt->sopt_name == MCAST_LEAVE_SOURCE_GROUP) {
22338f002c6cSBruce M Simpson 			if (ssa->sin6.sin6_family != AF_INET6 ||
22348f002c6cSBruce M Simpson 			    ssa->sin6.sin6_len != sizeof(struct sockaddr_in6))
22358f002c6cSBruce M Simpson 				return (EINVAL);
223629dc7bc6SBruce M Simpson 			if (IN6_IS_ADDR_MULTICAST(&ssa->sin6.sin6_addr))
223729dc7bc6SBruce M Simpson 				return (EINVAL);
223829dc7bc6SBruce M Simpson 			/*
223929dc7bc6SBruce M Simpson 			 * TODO: Validate embedded scope ID in source
224029dc7bc6SBruce M Simpson 			 * list entry against passed-in ifp, if and only
224129dc7bc6SBruce M Simpson 			 * if source list filter entry is iface or node local.
224229dc7bc6SBruce M Simpson 			 */
224329dc7bc6SBruce M Simpson 			in6_clearscope(&ssa->sin6.sin6_addr);
22448f002c6cSBruce M Simpson 		}
224529dc7bc6SBruce M Simpson 		gsa->sin6.sin6_port = 0;
224629dc7bc6SBruce M Simpson 		gsa->sin6.sin6_scope_id = 0;
224729dc7bc6SBruce M Simpson 		ifindex = gsr.gsr_interface;
22488f002c6cSBruce M Simpson 		break;
22498f002c6cSBruce M Simpson 
22508f002c6cSBruce M Simpson 	default:
22518f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: unknown sopt_name %d",
22528f002c6cSBruce M Simpson 		    __func__, sopt->sopt_name);
22538f002c6cSBruce M Simpson 		return (EOPNOTSUPP);
22548f002c6cSBruce M Simpson 		break;
22558f002c6cSBruce M Simpson 	}
22568f002c6cSBruce M Simpson 
22578f002c6cSBruce M Simpson 	if (!IN6_IS_ADDR_MULTICAST(&gsa->sin6.sin6_addr))
22588f002c6cSBruce M Simpson 		return (EINVAL);
22598f002c6cSBruce M Simpson 
226033cde130SBruce M Simpson 	/*
226129dc7bc6SBruce M Simpson 	 * Validate interface index if provided. If no interface index
226229dc7bc6SBruce M Simpson 	 * was provided separately, attempt to look the membership up
226329dc7bc6SBruce M Simpson 	 * from the default scope as a last resort to disambiguate
226429dc7bc6SBruce M Simpson 	 * the membership we are being asked to leave.
226529dc7bc6SBruce M Simpson 	 * XXX SCOPE6 lock potentially taken here.
226633cde130SBruce M Simpson 	 */
226729dc7bc6SBruce M Simpson 	if (ifindex != 0) {
2268010c2b81SBjoern A. Zeeb 		if (V_if_index < ifindex)
226929dc7bc6SBruce M Simpson 			return (EADDRNOTAVAIL);
227029dc7bc6SBruce M Simpson 		ifp = ifnet_byindex(ifindex);
227129dc7bc6SBruce M Simpson 		if (ifp == NULL)
227229dc7bc6SBruce M Simpson 			return (EADDRNOTAVAIL);
227329dc7bc6SBruce M Simpson 		(void)in6_setscope(&gsa->sin6.sin6_addr, ifp, NULL);
227429dc7bc6SBruce M Simpson 	} else {
227529dc7bc6SBruce M Simpson 		error = sa6_embedscope(&gsa->sin6, V_ip6_use_defzone);
227629dc7bc6SBruce M Simpson 		if (error)
227729dc7bc6SBruce M Simpson 			return (EADDRNOTAVAIL);
227829dc7bc6SBruce M Simpson 		/*
2279b36c89e5SBruce M Simpson 		 * Some badly behaved applications don't pass an ifindex
2280b36c89e5SBruce M Simpson 		 * or a scope ID, which is an API violation. In this case,
2281b36c89e5SBruce M Simpson 		 * perform a lookup as per a v6 join.
2282b36c89e5SBruce M Simpson 		 *
228329dc7bc6SBruce M Simpson 		 * XXX For now, stomp on zone ID for the corner case.
228429dc7bc6SBruce M Simpson 		 * This is not the 'KAME way', but we need to see the ifp
228529dc7bc6SBruce M Simpson 		 * directly until such time as this implementation is
228629dc7bc6SBruce M Simpson 		 * refactored, assuming the scope IDs are the way to go.
228729dc7bc6SBruce M Simpson 		 */
228829dc7bc6SBruce M Simpson 		ifindex = ntohs(gsa->sin6.sin6_addr.s6_addr16[1]);
2289b36c89e5SBruce M Simpson 		if (ifindex == 0) {
2290b36c89e5SBruce M Simpson 			CTR2(KTR_MLD, "%s: warning: no ifindex, looking up "
2291b36c89e5SBruce M Simpson 			    "ifp for group %s.", __func__,
2292b36c89e5SBruce M Simpson 			    ip6_sprintf(ip6tbuf, &gsa->sin6.sin6_addr));
2293b36c89e5SBruce M Simpson 			ifp = in6p_lookup_mcast_ifp(inp, &gsa->sin6);
2294b36c89e5SBruce M Simpson 		} else {
229529dc7bc6SBruce M Simpson 			ifp = ifnet_byindex(ifindex);
2296b36c89e5SBruce M Simpson 		}
229729dc7bc6SBruce M Simpson 		if (ifp == NULL)
229829dc7bc6SBruce M Simpson 			return (EADDRNOTAVAIL);
229929dc7bc6SBruce M Simpson 	}
230029dc7bc6SBruce M Simpson 
230129dc7bc6SBruce M Simpson 	CTR2(KTR_MLD, "%s: ifp = %p", __func__, ifp);
230229dc7bc6SBruce M Simpson 	KASSERT(ifp != NULL, ("%s: ifp did not resolve", __func__));
230333cde130SBruce M Simpson 
230459854ecfSHans Petter Selasky 	IN6_MULTI_LOCK();
230559854ecfSHans Petter Selasky 
23068f002c6cSBruce M Simpson 	/*
230759854ecfSHans Petter Selasky 	 * Find the membership in the membership list.
23088f002c6cSBruce M Simpson 	 */
23098f002c6cSBruce M Simpson 	imo = in6p_findmoptions(inp);
231059854ecfSHans Petter Selasky 	imf = im6o_match_group(imo, ifp, &gsa->sa);
231159854ecfSHans Petter Selasky 	if (imf == NULL) {
23128f002c6cSBruce M Simpson 		error = EADDRNOTAVAIL;
23138f002c6cSBruce M Simpson 		goto out_in6p_locked;
23148f002c6cSBruce M Simpson 	}
231559854ecfSHans Petter Selasky 	inm = imf->im6f_in6m;
23168f002c6cSBruce M Simpson 
23178f002c6cSBruce M Simpson 	if (ssa->ss.ss_family != AF_UNSPEC)
231859854ecfSHans Petter Selasky 		is_final = false;
23198f002c6cSBruce M Simpson 
23208f002c6cSBruce M Simpson 	/*
23218f002c6cSBruce M Simpson 	 * Begin state merge transaction at socket layer.
23228f002c6cSBruce M Simpson 	 */
23238f002c6cSBruce M Simpson 	INP_WLOCK_ASSERT(inp);
23248f002c6cSBruce M Simpson 
23258f002c6cSBruce M Simpson 	/*
23268f002c6cSBruce M Simpson 	 * If we were instructed only to leave a given source, do so.
23278f002c6cSBruce M Simpson 	 * MCAST_LEAVE_SOURCE_GROUP is only valid for inclusive memberships.
23288f002c6cSBruce M Simpson 	 */
23298f002c6cSBruce M Simpson 	if (is_final) {
233059854ecfSHans Petter Selasky 		ip6_mfilter_remove(&imo->im6o_head, imf);
23318f002c6cSBruce M Simpson 		im6f_leave(imf);
2332a4c5668dSHans Petter Selasky 
2333a4c5668dSHans Petter Selasky 		/*
2334a4c5668dSHans Petter Selasky 		 * Give up the multicast address record to which
2335a4c5668dSHans Petter Selasky 		 * the membership points.
2336a4c5668dSHans Petter Selasky 		 */
2337a4c5668dSHans Petter Selasky 		(void)in6_leavegroup_locked(inm, imf);
23388f002c6cSBruce M Simpson 	} else {
23398f002c6cSBruce M Simpson 		if (imf->im6f_st[0] == MCAST_EXCLUDE) {
23408f002c6cSBruce M Simpson 			error = EADDRNOTAVAIL;
23418f002c6cSBruce M Simpson 			goto out_in6p_locked;
23428f002c6cSBruce M Simpson 		}
234359854ecfSHans Petter Selasky 		ims = im6o_match_source(imf, &ssa->sa);
23448f002c6cSBruce M Simpson 		if (ims == NULL) {
23458f002c6cSBruce M Simpson 			CTR3(KTR_MLD, "%s: source %p %spresent", __func__,
23468f002c6cSBruce M Simpson 			    ip6_sprintf(ip6tbuf, &ssa->sin6.sin6_addr),
23478f002c6cSBruce M Simpson 			    "not ");
23488f002c6cSBruce M Simpson 			error = EADDRNOTAVAIL;
23498f002c6cSBruce M Simpson 			goto out_in6p_locked;
23508f002c6cSBruce M Simpson 		}
23518f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: %s source", __func__, "block");
23528f002c6cSBruce M Simpson 		error = im6f_prune(imf, &ssa->sin6);
23538f002c6cSBruce M Simpson 		if (error) {
23548f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: merge imf state failed",
23558f002c6cSBruce M Simpson 			    __func__);
23568f002c6cSBruce M Simpson 			goto out_in6p_locked;
23578f002c6cSBruce M Simpson 		}
23588f002c6cSBruce M Simpson 	}
23598f002c6cSBruce M Simpson 
23608f002c6cSBruce M Simpson 	/*
23618f002c6cSBruce M Simpson 	 * Begin state merge transaction at MLD layer.
23628f002c6cSBruce M Simpson 	 */
236359854ecfSHans Petter Selasky 	if (!is_final) {
236459854ecfSHans Petter Selasky 		CTR1(KTR_MLD, "%s: merge inm state", __func__);
236559854ecfSHans Petter Selasky 		IN6_MULTI_LIST_LOCK();
236659854ecfSHans Petter Selasky 		error = in6m_merge(inm, imf);
236759854ecfSHans Petter Selasky 		if (error) {
236859854ecfSHans Petter Selasky 			CTR1(KTR_MLD, "%s: failed to merge inm state",
236959854ecfSHans Petter Selasky 			    __func__);
237059854ecfSHans Petter Selasky 			IN6_MULTI_LIST_UNLOCK();
237159854ecfSHans Petter Selasky 			im6f_rollback(imf);
237259854ecfSHans Petter Selasky 			im6f_reap(imf);
237359854ecfSHans Petter Selasky                         goto out_in6p_locked;
237459854ecfSHans Petter Selasky 		}
2375f00876fbSMark Johnston 
237659854ecfSHans Petter Selasky 		CTR1(KTR_MLD, "%s: doing mld downcall", __func__);
237759854ecfSHans Petter Selasky 		error = mld_change_state(inm, 0);
237859854ecfSHans Petter Selasky 		IN6_MULTI_LIST_UNLOCK();
237959854ecfSHans Petter Selasky 		if (error) {
238059854ecfSHans Petter Selasky 			CTR1(KTR_MLD, "%s: failed mld downcall",
238159854ecfSHans Petter Selasky 			     __func__);
238259854ecfSHans Petter Selasky 			im6f_rollback(imf);
238359854ecfSHans Petter Selasky 			im6f_reap(imf);
238459854ecfSHans Petter Selasky                         goto out_in6p_locked;
238559854ecfSHans Petter Selasky 		}
238659854ecfSHans Petter Selasky 	}
238759854ecfSHans Petter Selasky 
238859854ecfSHans Petter Selasky 	im6f_commit(imf);
238959854ecfSHans Petter Selasky 	im6f_reap(imf);
239059854ecfSHans Petter Selasky 
239159854ecfSHans Petter Selasky out_in6p_locked:
239259854ecfSHans Petter Selasky 	INP_WUNLOCK(inp);
239359854ecfSHans Petter Selasky 
2394a4c5668dSHans Petter Selasky 	if (is_final && imf)
239559854ecfSHans Petter Selasky 		ip6_mfilter_free(imf);
23968f002c6cSBruce M Simpson 
2397f00876fbSMark Johnston 	IN6_MULTI_UNLOCK();
23988f002c6cSBruce M Simpson 	return (error);
23998f002c6cSBruce M Simpson }
24008f002c6cSBruce M Simpson 
24018f002c6cSBruce M Simpson /*
24028f002c6cSBruce M Simpson  * Select the interface for transmitting IPv6 multicast datagrams.
24038f002c6cSBruce M Simpson  *
24048f002c6cSBruce M Simpson  * Either an instance of struct in6_addr or an instance of struct ipv6_mreqn
24058f002c6cSBruce M Simpson  * may be passed to this socket option. An address of in6addr_any or an
24068f002c6cSBruce M Simpson  * interface index of 0 is used to remove a previous selection.
24078f002c6cSBruce M Simpson  * When no interface is selected, one is chosen for every send.
24088f002c6cSBruce M Simpson  */
24098f002c6cSBruce M Simpson static int
24108f002c6cSBruce M Simpson in6p_set_multicast_if(struct inpcb *inp, struct sockopt *sopt)
24118f002c6cSBruce M Simpson {
24128f002c6cSBruce M Simpson 	struct ifnet		*ifp;
24138f002c6cSBruce M Simpson 	struct ip6_moptions	*imo;
24148f002c6cSBruce M Simpson 	u_int			 ifindex;
24158f002c6cSBruce M Simpson 	int			 error;
24168f002c6cSBruce M Simpson 
24178f002c6cSBruce M Simpson 	if (sopt->sopt_valsize != sizeof(u_int))
24188f002c6cSBruce M Simpson 		return (EINVAL);
24198f002c6cSBruce M Simpson 
24208f002c6cSBruce M Simpson 	error = sooptcopyin(sopt, &ifindex, sizeof(u_int), sizeof(u_int));
24218f002c6cSBruce M Simpson 	if (error)
24228f002c6cSBruce M Simpson 		return (error);
2423010c2b81SBjoern A. Zeeb 	if (V_if_index < ifindex)
24248f002c6cSBruce M Simpson 		return (EINVAL);
2425e2956804SAndrey V. Elsukov 	if (ifindex == 0)
2426e2956804SAndrey V. Elsukov 		ifp = NULL;
2427e2956804SAndrey V. Elsukov 	else {
24288f002c6cSBruce M Simpson 		ifp = ifnet_byindex(ifindex);
2429e2956804SAndrey V. Elsukov 		if (ifp == NULL)
2430e2956804SAndrey V. Elsukov 			return (EINVAL);
2431e2956804SAndrey V. Elsukov 		if ((ifp->if_flags & IFF_MULTICAST) == 0)
24328f002c6cSBruce M Simpson 			return (EADDRNOTAVAIL);
2433e2956804SAndrey V. Elsukov 	}
24348f002c6cSBruce M Simpson 	imo = in6p_findmoptions(inp);
24358f002c6cSBruce M Simpson 	imo->im6o_multicast_ifp = ifp;
24368f002c6cSBruce M Simpson 	INP_WUNLOCK(inp);
24378f002c6cSBruce M Simpson 
24388f002c6cSBruce M Simpson 	return (0);
24398f002c6cSBruce M Simpson }
24408f002c6cSBruce M Simpson 
24418f002c6cSBruce M Simpson /*
24428f002c6cSBruce M Simpson  * Atomically set source filters on a socket for an IPv6 multicast group.
2443f00876fbSMark Johnston  *
2444f00876fbSMark Johnston  * SMPng: NOTE: Potentially calls malloc(M_WAITOK) with Giant held.
24458f002c6cSBruce M Simpson  */
24468f002c6cSBruce M Simpson static int
24478f002c6cSBruce M Simpson in6p_set_source_filters(struct inpcb *inp, struct sockopt *sopt)
24488f002c6cSBruce M Simpson {
24498f002c6cSBruce M Simpson 	struct __msfilterreq	 msfr;
24508f002c6cSBruce M Simpson 	sockunion_t		*gsa;
24518f002c6cSBruce M Simpson 	struct ifnet		*ifp;
24528f002c6cSBruce M Simpson 	struct in6_mfilter	*imf;
24538f002c6cSBruce M Simpson 	struct ip6_moptions	*imo;
24548f002c6cSBruce M Simpson 	struct in6_multi		*inm;
24558f002c6cSBruce M Simpson 	int			 error;
24568f002c6cSBruce M Simpson 
24578f002c6cSBruce M Simpson 	error = sooptcopyin(sopt, &msfr, sizeof(struct __msfilterreq),
24588f002c6cSBruce M Simpson 	    sizeof(struct __msfilterreq));
24598f002c6cSBruce M Simpson 	if (error)
24608f002c6cSBruce M Simpson 		return (error);
24618f002c6cSBruce M Simpson 
24620dc5893eSBruce M Simpson 	if (msfr.msfr_nsrcs > in6_mcast_maxsocksrc)
24630dc5893eSBruce M Simpson 		return (ENOBUFS);
24640dc5893eSBruce M Simpson 
24650dc5893eSBruce M Simpson 	if (msfr.msfr_fmode != MCAST_EXCLUDE &&
24660dc5893eSBruce M Simpson 	    msfr.msfr_fmode != MCAST_INCLUDE)
24678f002c6cSBruce M Simpson 		return (EINVAL);
24688f002c6cSBruce M Simpson 
24698f002c6cSBruce M Simpson 	if (msfr.msfr_group.ss_family != AF_INET6 ||
24708f002c6cSBruce M Simpson 	    msfr.msfr_group.ss_len != sizeof(struct sockaddr_in6))
24718f002c6cSBruce M Simpson 		return (EINVAL);
24728f002c6cSBruce M Simpson 
24738f002c6cSBruce M Simpson 	gsa = (sockunion_t *)&msfr.msfr_group;
24748f002c6cSBruce M Simpson 	if (!IN6_IS_ADDR_MULTICAST(&gsa->sin6.sin6_addr))
24758f002c6cSBruce M Simpson 		return (EINVAL);
24768f002c6cSBruce M Simpson 
24778f002c6cSBruce M Simpson 	gsa->sin6.sin6_port = 0;	/* ignore port */
24788f002c6cSBruce M Simpson 
24798f002c6cSBruce M Simpson 	if (msfr.msfr_ifindex == 0 || V_if_index < msfr.msfr_ifindex)
24808f002c6cSBruce M Simpson 		return (EADDRNOTAVAIL);
24818f002c6cSBruce M Simpson 	ifp = ifnet_byindex(msfr.msfr_ifindex);
24828f002c6cSBruce M Simpson 	if (ifp == NULL)
24838f002c6cSBruce M Simpson 		return (EADDRNOTAVAIL);
248429dc7bc6SBruce M Simpson 	(void)in6_setscope(&gsa->sin6.sin6_addr, ifp, NULL);
24858f002c6cSBruce M Simpson 
24868f002c6cSBruce M Simpson 	/*
24878f002c6cSBruce M Simpson 	 * Take the INP write lock.
24888f002c6cSBruce M Simpson 	 * Check if this socket is a member of this group.
24898f002c6cSBruce M Simpson 	 */
24908f002c6cSBruce M Simpson 	imo = in6p_findmoptions(inp);
249159854ecfSHans Petter Selasky 	imf = im6o_match_group(imo, ifp, &gsa->sa);
249259854ecfSHans Petter Selasky 	if (imf == NULL) {
24938f002c6cSBruce M Simpson 		error = EADDRNOTAVAIL;
24948f002c6cSBruce M Simpson 		goto out_in6p_locked;
24958f002c6cSBruce M Simpson 	}
249659854ecfSHans Petter Selasky 	inm = imf->im6f_in6m;
24978f002c6cSBruce M Simpson 
24988f002c6cSBruce M Simpson 	/*
24998f002c6cSBruce M Simpson 	 * Begin state merge transaction at socket layer.
25008f002c6cSBruce M Simpson 	 */
25018f002c6cSBruce M Simpson 	INP_WLOCK_ASSERT(inp);
25028f002c6cSBruce M Simpson 
25038f002c6cSBruce M Simpson 	imf->im6f_st[1] = msfr.msfr_fmode;
25048f002c6cSBruce M Simpson 
25058f002c6cSBruce M Simpson 	/*
25068f002c6cSBruce M Simpson 	 * Apply any new source filters, if present.
25078f002c6cSBruce M Simpson 	 * Make a copy of the user-space source vector so
25088f002c6cSBruce M Simpson 	 * that we may copy them with a single copyin. This
25098f002c6cSBruce M Simpson 	 * allows us to deal with page faults up-front.
25108f002c6cSBruce M Simpson 	 */
25118f002c6cSBruce M Simpson 	if (msfr.msfr_nsrcs > 0) {
25128f002c6cSBruce M Simpson 		struct in6_msource	*lims;
25138f002c6cSBruce M Simpson 		struct sockaddr_in6	*psin;
25148f002c6cSBruce M Simpson 		struct sockaddr_storage	*kss, *pkss;
25158f002c6cSBruce M Simpson 		int			 i;
25168f002c6cSBruce M Simpson 
25178f002c6cSBruce M Simpson 		INP_WUNLOCK(inp);
25188f002c6cSBruce M Simpson 
25198f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: loading %lu source list entries",
25208f002c6cSBruce M Simpson 		    __func__, (unsigned long)msfr.msfr_nsrcs);
25218f002c6cSBruce M Simpson 		kss = malloc(sizeof(struct sockaddr_storage) * msfr.msfr_nsrcs,
25228f002c6cSBruce M Simpson 		    M_TEMP, M_WAITOK);
25238f002c6cSBruce M Simpson 		error = copyin(msfr.msfr_srcs, kss,
25248f002c6cSBruce M Simpson 		    sizeof(struct sockaddr_storage) * msfr.msfr_nsrcs);
25258f002c6cSBruce M Simpson 		if (error) {
25268f002c6cSBruce M Simpson 			free(kss, M_TEMP);
25278f002c6cSBruce M Simpson 			return (error);
25288f002c6cSBruce M Simpson 		}
25298f002c6cSBruce M Simpson 
25308f002c6cSBruce M Simpson 		INP_WLOCK(inp);
25318f002c6cSBruce M Simpson 
25328f002c6cSBruce M Simpson 		/*
25338f002c6cSBruce M Simpson 		 * Mark all source filters as UNDEFINED at t1.
25348f002c6cSBruce M Simpson 		 * Restore new group filter mode, as im6f_leave()
25358f002c6cSBruce M Simpson 		 * will set it to INCLUDE.
25368f002c6cSBruce M Simpson 		 */
25378f002c6cSBruce M Simpson 		im6f_leave(imf);
25388f002c6cSBruce M Simpson 		imf->im6f_st[1] = msfr.msfr_fmode;
25398f002c6cSBruce M Simpson 
25408f002c6cSBruce M Simpson 		/*
25418f002c6cSBruce M Simpson 		 * Update socket layer filters at t1, lazy-allocating
25428f002c6cSBruce M Simpson 		 * new entries. This saves a bunch of memory at the
25438f002c6cSBruce M Simpson 		 * cost of one RB_FIND() per source entry; duplicate
25448f002c6cSBruce M Simpson 		 * entries in the msfr_nsrcs vector are ignored.
25458f002c6cSBruce M Simpson 		 * If we encounter an error, rollback transaction.
25468f002c6cSBruce M Simpson 		 *
25478f002c6cSBruce M Simpson 		 * XXX This too could be replaced with a set-symmetric
25488f002c6cSBruce M Simpson 		 * difference like loop to avoid walking from root
25498f002c6cSBruce M Simpson 		 * every time, as the key space is common.
25508f002c6cSBruce M Simpson 		 */
25518f002c6cSBruce M Simpson 		for (i = 0, pkss = kss; i < msfr.msfr_nsrcs; i++, pkss++) {
25528f002c6cSBruce M Simpson 			psin = (struct sockaddr_in6 *)pkss;
25538f002c6cSBruce M Simpson 			if (psin->sin6_family != AF_INET6) {
25548f002c6cSBruce M Simpson 				error = EAFNOSUPPORT;
25558f002c6cSBruce M Simpson 				break;
25568f002c6cSBruce M Simpson 			}
25578f002c6cSBruce M Simpson 			if (psin->sin6_len != sizeof(struct sockaddr_in6)) {
25588f002c6cSBruce M Simpson 				error = EINVAL;
25598f002c6cSBruce M Simpson 				break;
25608f002c6cSBruce M Simpson 			}
256129dc7bc6SBruce M Simpson 			if (IN6_IS_ADDR_MULTICAST(&psin->sin6_addr)) {
256229dc7bc6SBruce M Simpson 				error = EINVAL;
256329dc7bc6SBruce M Simpson 				break;
256429dc7bc6SBruce M Simpson 			}
256529dc7bc6SBruce M Simpson 			/*
256629dc7bc6SBruce M Simpson 			 * TODO: Validate embedded scope ID in source
256729dc7bc6SBruce M Simpson 			 * list entry against passed-in ifp, if and only
256829dc7bc6SBruce M Simpson 			 * if source list filter entry is iface or node local.
256929dc7bc6SBruce M Simpson 			 */
257029dc7bc6SBruce M Simpson 			in6_clearscope(&psin->sin6_addr);
25718f002c6cSBruce M Simpson 			error = im6f_get_source(imf, psin, &lims);
25728f002c6cSBruce M Simpson 			if (error)
25738f002c6cSBruce M Simpson 				break;
25748f002c6cSBruce M Simpson 			lims->im6sl_st[1] = imf->im6f_st[1];
25758f002c6cSBruce M Simpson 		}
25768f002c6cSBruce M Simpson 		free(kss, M_TEMP);
25778f002c6cSBruce M Simpson 	}
25788f002c6cSBruce M Simpson 
25798f002c6cSBruce M Simpson 	if (error)
25808f002c6cSBruce M Simpson 		goto out_im6f_rollback;
25818f002c6cSBruce M Simpson 
25828f002c6cSBruce M Simpson 	INP_WLOCK_ASSERT(inp);
2583f3e1324bSStephen Hurd 	IN6_MULTI_LIST_LOCK();
25848f002c6cSBruce M Simpson 
25858f002c6cSBruce M Simpson 	/*
25868f002c6cSBruce M Simpson 	 * Begin state merge transaction at MLD layer.
25878f002c6cSBruce M Simpson 	 */
25888f002c6cSBruce M Simpson 	CTR1(KTR_MLD, "%s: merge inm state", __func__);
25898f002c6cSBruce M Simpson 	error = in6m_merge(inm, imf);
25904fd91336SAndrey V. Elsukov 	if (error)
25918f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: failed to merge inm state", __func__);
25924fd91336SAndrey V. Elsukov 	else {
25938f002c6cSBruce M Simpson 		CTR1(KTR_MLD, "%s: doing mld downcall", __func__);
25948f002c6cSBruce M Simpson 		error = mld_change_state(inm, 0);
25958f002c6cSBruce M Simpson 		if (error)
25968f002c6cSBruce M Simpson 			CTR1(KTR_MLD, "%s: failed mld downcall", __func__);
25974fd91336SAndrey V. Elsukov 	}
25988f002c6cSBruce M Simpson 
2599f3e1324bSStephen Hurd 	IN6_MULTI_LIST_UNLOCK();
26008f002c6cSBruce M Simpson 
26018f002c6cSBruce M Simpson out_im6f_rollback:
26028f002c6cSBruce M Simpson 	if (error)
26038f002c6cSBruce M Simpson 		im6f_rollback(imf);
26048f002c6cSBruce M Simpson 	else
26058f002c6cSBruce M Simpson 		im6f_commit(imf);
26068f002c6cSBruce M Simpson 
26078f002c6cSBruce M Simpson 	im6f_reap(imf);
26088f002c6cSBruce M Simpson 
26098f002c6cSBruce M Simpson out_in6p_locked:
26108f002c6cSBruce M Simpson 	INP_WUNLOCK(inp);
26118f002c6cSBruce M Simpson 	return (error);
26128f002c6cSBruce M Simpson }
26138f002c6cSBruce M Simpson 
26148f002c6cSBruce M Simpson /*
26158f002c6cSBruce M Simpson  * Set the IP multicast options in response to user setsockopt().
26168f002c6cSBruce M Simpson  *
26178f002c6cSBruce M Simpson  * Many of the socket options handled in this function duplicate the
26188f002c6cSBruce M Simpson  * functionality of socket options in the regular unicast API. However,
26198f002c6cSBruce M Simpson  * it is not possible to merge the duplicate code, because the idempotence
26208f002c6cSBruce M Simpson  * of the IPv6 multicast part of the BSD Sockets API must be preserved;
26218f002c6cSBruce M Simpson  * the effects of these options must be treated as separate and distinct.
26228f002c6cSBruce M Simpson  *
26238f002c6cSBruce M Simpson  * SMPng: XXX: Unlocked read of inp_socket believed OK.
26248f002c6cSBruce M Simpson  */
26258f002c6cSBruce M Simpson int
26268f002c6cSBruce M Simpson ip6_setmoptions(struct inpcb *inp, struct sockopt *sopt)
26278f002c6cSBruce M Simpson {
262833cde130SBruce M Simpson 	struct ip6_moptions	*im6o;
26298f002c6cSBruce M Simpson 	int			 error;
26308f002c6cSBruce M Simpson 
26318f002c6cSBruce M Simpson 	error = 0;
26328f002c6cSBruce M Simpson 
26338f002c6cSBruce M Simpson 	/*
26348f002c6cSBruce M Simpson 	 * If socket is neither of type SOCK_RAW or SOCK_DGRAM,
26358f002c6cSBruce M Simpson 	 * or is a divert socket, reject it.
26368f002c6cSBruce M Simpson 	 */
26378f002c6cSBruce M Simpson 	if (inp->inp_socket->so_proto->pr_protocol == IPPROTO_DIVERT ||
26388f002c6cSBruce M Simpson 	    (inp->inp_socket->so_proto->pr_type != SOCK_RAW &&
26398f002c6cSBruce M Simpson 	     inp->inp_socket->so_proto->pr_type != SOCK_DGRAM))
26408f002c6cSBruce M Simpson 		return (EOPNOTSUPP);
26418f002c6cSBruce M Simpson 
26428f002c6cSBruce M Simpson 	switch (sopt->sopt_name) {
26438f002c6cSBruce M Simpson 	case IPV6_MULTICAST_IF:
26448f002c6cSBruce M Simpson 		error = in6p_set_multicast_if(inp, sopt);
26458f002c6cSBruce M Simpson 		break;
26468f002c6cSBruce M Simpson 
26478f002c6cSBruce M Simpson 	case IPV6_MULTICAST_HOPS: {
26488f002c6cSBruce M Simpson 		int hlim;
26498f002c6cSBruce M Simpson 
26508f002c6cSBruce M Simpson 		if (sopt->sopt_valsize != sizeof(int)) {
26518f002c6cSBruce M Simpson 			error = EINVAL;
26528f002c6cSBruce M Simpson 			break;
26538f002c6cSBruce M Simpson 		}
26548f002c6cSBruce M Simpson 		error = sooptcopyin(sopt, &hlim, sizeof(hlim), sizeof(int));
26558f002c6cSBruce M Simpson 		if (error)
26568f002c6cSBruce M Simpson 			break;
26578f002c6cSBruce M Simpson 		if (hlim < -1 || hlim > 255) {
26588f002c6cSBruce M Simpson 			error = EINVAL;
26598f002c6cSBruce M Simpson 			break;
266033cde130SBruce M Simpson 		} else if (hlim == -1) {
266133cde130SBruce M Simpson 			hlim = V_ip6_defmcasthlim;
26628f002c6cSBruce M Simpson 		}
266333cde130SBruce M Simpson 		im6o = in6p_findmoptions(inp);
266433cde130SBruce M Simpson 		im6o->im6o_multicast_hlim = hlim;
26658f002c6cSBruce M Simpson 		INP_WUNLOCK(inp);
26668f002c6cSBruce M Simpson 		break;
26678f002c6cSBruce M Simpson 	}
26688f002c6cSBruce M Simpson 
26698f002c6cSBruce M Simpson 	case IPV6_MULTICAST_LOOP: {
26708f002c6cSBruce M Simpson 		u_int loop;
26718f002c6cSBruce M Simpson 
26728f002c6cSBruce M Simpson 		/*
26738f002c6cSBruce M Simpson 		 * Set the loopback flag for outgoing multicast packets.
267433cde130SBruce M Simpson 		 * Must be zero or one.
26758f002c6cSBruce M Simpson 		 */
26768f002c6cSBruce M Simpson 		if (sopt->sopt_valsize != sizeof(u_int)) {
26778f002c6cSBruce M Simpson 			error = EINVAL;
26788f002c6cSBruce M Simpson 			break;
26798f002c6cSBruce M Simpson 		}
26808f002c6cSBruce M Simpson 		error = sooptcopyin(sopt, &loop, sizeof(u_int), sizeof(u_int));
26818f002c6cSBruce M Simpson 		if (error)
26828f002c6cSBruce M Simpson 			break;
268333cde130SBruce M Simpson 		if (loop > 1) {
268433cde130SBruce M Simpson 			error = EINVAL;
268533cde130SBruce M Simpson 			break;
268633cde130SBruce M Simpson 		}
268733cde130SBruce M Simpson 		im6o = in6p_findmoptions(inp);
268833cde130SBruce M Simpson 		im6o->im6o_multicast_loop = loop;
26898f002c6cSBruce M Simpson 		INP_WUNLOCK(inp);
26908f002c6cSBruce M Simpson 		break;
26918f002c6cSBruce M Simpson 	}
26928f002c6cSBruce M Simpson 
26938f002c6cSBruce M Simpson 	case IPV6_JOIN_GROUP:
26948f002c6cSBruce M Simpson 	case MCAST_JOIN_GROUP:
26958f002c6cSBruce M Simpson 	case MCAST_JOIN_SOURCE_GROUP:
26968f002c6cSBruce M Simpson 		error = in6p_join_group(inp, sopt);
26978f002c6cSBruce M Simpson 		break;
26988f002c6cSBruce M Simpson 
26998f002c6cSBruce M Simpson 	case IPV6_LEAVE_GROUP:
27008f002c6cSBruce M Simpson 	case MCAST_LEAVE_GROUP:
27018f002c6cSBruce M Simpson 	case MCAST_LEAVE_SOURCE_GROUP:
27028f002c6cSBruce M Simpson 		error = in6p_leave_group(inp, sopt);
27038f002c6cSBruce M Simpson 		break;
27048f002c6cSBruce M Simpson 
27058f002c6cSBruce M Simpson 	case MCAST_BLOCK_SOURCE:
27068f002c6cSBruce M Simpson 	case MCAST_UNBLOCK_SOURCE:
27078f002c6cSBruce M Simpson 		error = in6p_block_unblock_source(inp, sopt);
27088f002c6cSBruce M Simpson 		break;
27098f002c6cSBruce M Simpson 
27108f002c6cSBruce M Simpson 	case IPV6_MSFILTER:
27118f002c6cSBruce M Simpson 		error = in6p_set_source_filters(inp, sopt);
27128f002c6cSBruce M Simpson 		break;
27138f002c6cSBruce M Simpson 
27148f002c6cSBruce M Simpson 	default:
27158f002c6cSBruce M Simpson 		error = EOPNOTSUPP;
27168f002c6cSBruce M Simpson 		break;
27178f002c6cSBruce M Simpson 	}
27188f002c6cSBruce M Simpson 
27198f002c6cSBruce M Simpson 	INP_UNLOCK_ASSERT(inp);
27208f002c6cSBruce M Simpson 
27218f002c6cSBruce M Simpson 	return (error);
27228f002c6cSBruce M Simpson }
27238f002c6cSBruce M Simpson 
27248f002c6cSBruce M Simpson /*
27258f002c6cSBruce M Simpson  * Expose MLD's multicast filter mode and source list(s) to userland,
27268f002c6cSBruce M Simpson  * keyed by (ifindex, group).
27278f002c6cSBruce M Simpson  * The filter mode is written out as a uint32_t, followed by
27288f002c6cSBruce M Simpson  * 0..n of struct in6_addr.
27298f002c6cSBruce M Simpson  * For use by ifmcstat(8).
27308f002c6cSBruce M Simpson  * SMPng: NOTE: unlocked read of ifindex space.
27318f002c6cSBruce M Simpson  */
27328f002c6cSBruce M Simpson static int
27338f002c6cSBruce M Simpson sysctl_ip6_mcast_filters(SYSCTL_HANDLER_ARGS)
27348f002c6cSBruce M Simpson {
273529dc7bc6SBruce M Simpson 	struct in6_addr			 mcaddr;
27368f002c6cSBruce M Simpson 	struct in6_addr			 src;
2737a68cc388SGleb Smirnoff 	struct epoch_tracker		 et;
27388f002c6cSBruce M Simpson 	struct ifnet			*ifp;
27398f002c6cSBruce M Simpson 	struct ifmultiaddr		*ifma;
27408f002c6cSBruce M Simpson 	struct in6_multi		*inm;
27418f002c6cSBruce M Simpson 	struct ip6_msource		*ims;
27428f002c6cSBruce M Simpson 	int				*name;
27438f002c6cSBruce M Simpson 	int				 retval;
27448f002c6cSBruce M Simpson 	u_int				 namelen;
27458f002c6cSBruce M Simpson 	uint32_t			 fmode, ifindex;
27468f002c6cSBruce M Simpson #ifdef KTR
27478f002c6cSBruce M Simpson 	char				 ip6tbuf[INET6_ADDRSTRLEN];
27488f002c6cSBruce M Simpson #endif
27498f002c6cSBruce M Simpson 
27508f002c6cSBruce M Simpson 	name = (int *)arg1;
27518f002c6cSBruce M Simpson 	namelen = arg2;
27528f002c6cSBruce M Simpson 
27538f002c6cSBruce M Simpson 	if (req->newptr != NULL)
27548f002c6cSBruce M Simpson 		return (EPERM);
27558f002c6cSBruce M Simpson 
27568f002c6cSBruce M Simpson 	/* int: ifindex + 4 * 32 bits of IPv6 address */
27578f002c6cSBruce M Simpson 	if (namelen != 5)
27588f002c6cSBruce M Simpson 		return (EINVAL);
27598f002c6cSBruce M Simpson 
27608f002c6cSBruce M Simpson 	ifindex = name[0];
27618f002c6cSBruce M Simpson 	if (ifindex <= 0 || ifindex > V_if_index) {
27628f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: ifindex %u out of range",
27638f002c6cSBruce M Simpson 		    __func__, ifindex);
27648f002c6cSBruce M Simpson 		return (ENOENT);
27658f002c6cSBruce M Simpson 	}
27668f002c6cSBruce M Simpson 
276729dc7bc6SBruce M Simpson 	memcpy(&mcaddr, &name[1], sizeof(struct in6_addr));
276829dc7bc6SBruce M Simpson 	if (!IN6_IS_ADDR_MULTICAST(&mcaddr)) {
27698f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: group %s is not multicast",
277029dc7bc6SBruce M Simpson 		    __func__, ip6_sprintf(ip6tbuf, &mcaddr));
27718f002c6cSBruce M Simpson 		return (EINVAL);
27728f002c6cSBruce M Simpson 	}
27738f002c6cSBruce M Simpson 
2774b8a6e03fSGleb Smirnoff 	NET_EPOCH_ENTER(et);
27758f002c6cSBruce M Simpson 	ifp = ifnet_byindex(ifindex);
27768f002c6cSBruce M Simpson 	if (ifp == NULL) {
2777b8a6e03fSGleb Smirnoff 		NET_EPOCH_EXIT(et);
27788f002c6cSBruce M Simpson 		CTR2(KTR_MLD, "%s: no ifp for ifindex %u",
27798f002c6cSBruce M Simpson 		    __func__, ifindex);
27808f002c6cSBruce M Simpson 		return (ENOENT);
27818f002c6cSBruce M Simpson 	}
278229dc7bc6SBruce M Simpson 	/*
278329dc7bc6SBruce M Simpson 	 * Internal MLD lookups require that scope/zone ID is set.
278429dc7bc6SBruce M Simpson 	 */
278529dc7bc6SBruce M Simpson 	(void)in6_setscope(&mcaddr, ifp, NULL);
27868f002c6cSBruce M Simpson 
27878f002c6cSBruce M Simpson 	retval = sysctl_wire_old_buffer(req,
27888f002c6cSBruce M Simpson 	    sizeof(uint32_t) + (in6_mcast_maxgrpsrc * sizeof(struct in6_addr)));
2789b8a6e03fSGleb Smirnoff 	if (retval) {
2790b8a6e03fSGleb Smirnoff 		NET_EPOCH_EXIT(et);
27918f002c6cSBruce M Simpson 		return (retval);
2792b8a6e03fSGleb Smirnoff 	}
27938f002c6cSBruce M Simpson 
27948f002c6cSBruce M Simpson 	IN6_MULTI_LOCK();
2795f3e1324bSStephen Hurd 	IN6_MULTI_LIST_LOCK();
2796d7c5a620SMatt Macy 	CK_STAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
27972cd6ad76SHans Petter Selasky 		inm = in6m_ifmultiaddr_get_inm(ifma);
27982cd6ad76SHans Petter Selasky 		if (inm == NULL)
27998f002c6cSBruce M Simpson 			continue;
280029dc7bc6SBruce M Simpson 		if (!IN6_ARE_ADDR_EQUAL(&inm->in6m_addr, &mcaddr))
28018f002c6cSBruce M Simpson 			continue;
28028f002c6cSBruce M Simpson 		fmode = inm->in6m_st[1].iss_fmode;
28038f002c6cSBruce M Simpson 		retval = SYSCTL_OUT(req, &fmode, sizeof(uint32_t));
28048f002c6cSBruce M Simpson 		if (retval != 0)
28058f002c6cSBruce M Simpson 			break;
28068f002c6cSBruce M Simpson 		RB_FOREACH(ims, ip6_msource_tree, &inm->in6m_srcs) {
28078f002c6cSBruce M Simpson 			CTR2(KTR_MLD, "%s: visit node %p", __func__, ims);
28088f002c6cSBruce M Simpson 			/*
28098f002c6cSBruce M Simpson 			 * Only copy-out sources which are in-mode.
28108f002c6cSBruce M Simpson 			 */
28118f002c6cSBruce M Simpson 			if (fmode != im6s_get_mode(inm, ims, 1)) {
28128f002c6cSBruce M Simpson 				CTR1(KTR_MLD, "%s: skip non-in-mode",
28138f002c6cSBruce M Simpson 				    __func__);
28148f002c6cSBruce M Simpson 				continue;
28158f002c6cSBruce M Simpson 			}
28168f002c6cSBruce M Simpson 			src = ims->im6s_addr;
28178f002c6cSBruce M Simpson 			retval = SYSCTL_OUT(req, &src,
28188f002c6cSBruce M Simpson 			    sizeof(struct in6_addr));
28198f002c6cSBruce M Simpson 			if (retval != 0)
28208f002c6cSBruce M Simpson 				break;
28218f002c6cSBruce M Simpson 		}
28228f002c6cSBruce M Simpson 	}
2823f3e1324bSStephen Hurd 	IN6_MULTI_LIST_UNLOCK();
28248f002c6cSBruce M Simpson 	IN6_MULTI_UNLOCK();
2825b8a6e03fSGleb Smirnoff 	NET_EPOCH_EXIT(et);
28268f002c6cSBruce M Simpson 
28278f002c6cSBruce M Simpson 	return (retval);
28288f002c6cSBruce M Simpson }
28298f002c6cSBruce M Simpson 
28308f002c6cSBruce M Simpson #ifdef KTR
28318f002c6cSBruce M Simpson 
28328f002c6cSBruce M Simpson static const char *in6m_modestrs[] = { "un", "in", "ex" };
28338f002c6cSBruce M Simpson 
28348f002c6cSBruce M Simpson static const char *
28358f002c6cSBruce M Simpson in6m_mode_str(const int mode)
28368f002c6cSBruce M Simpson {
28378f002c6cSBruce M Simpson 
28388f002c6cSBruce M Simpson 	if (mode >= MCAST_UNDEFINED && mode <= MCAST_EXCLUDE)
28398f002c6cSBruce M Simpson 		return (in6m_modestrs[mode]);
28408f002c6cSBruce M Simpson 	return ("??");
28418f002c6cSBruce M Simpson }
28428f002c6cSBruce M Simpson 
28438f002c6cSBruce M Simpson static const char *in6m_statestrs[] = {
28448f002c6cSBruce M Simpson 	"not-member",
28458f002c6cSBruce M Simpson 	"silent",
28468f002c6cSBruce M Simpson 	"idle",
28478f002c6cSBruce M Simpson 	"lazy",
28488f002c6cSBruce M Simpson 	"sleeping",
28498f002c6cSBruce M Simpson 	"awakening",
28508f002c6cSBruce M Simpson 	"query-pending",
28518f002c6cSBruce M Simpson 	"sg-query-pending",
28528f002c6cSBruce M Simpson 	"leaving"
28538f002c6cSBruce M Simpson };
28548f002c6cSBruce M Simpson 
28558f002c6cSBruce M Simpson static const char *
28568f002c6cSBruce M Simpson in6m_state_str(const int state)
28578f002c6cSBruce M Simpson {
28588f002c6cSBruce M Simpson 
28598f002c6cSBruce M Simpson 	if (state >= MLD_NOT_MEMBER && state <= MLD_LEAVING_MEMBER)
28608f002c6cSBruce M Simpson 		return (in6m_statestrs[state]);
28618f002c6cSBruce M Simpson 	return ("??");
28628f002c6cSBruce M Simpson }
28638f002c6cSBruce M Simpson 
28648f002c6cSBruce M Simpson /*
28658f002c6cSBruce M Simpson  * Dump an in6_multi structure to the console.
28668f002c6cSBruce M Simpson  */
28678f002c6cSBruce M Simpson void
28688f002c6cSBruce M Simpson in6m_print(const struct in6_multi *inm)
28698f002c6cSBruce M Simpson {
28708f002c6cSBruce M Simpson 	int t;
28718f002c6cSBruce M Simpson 	char ip6tbuf[INET6_ADDRSTRLEN];
28728f002c6cSBruce M Simpson 
28735b65b8bcSAlexander Kabaev 	if ((ktr_mask & KTR_MLD) == 0)
28748f002c6cSBruce M Simpson 		return;
28758f002c6cSBruce M Simpson 
28768f002c6cSBruce M Simpson 	printf("%s: --- begin in6m %p ---\n", __func__, inm);
28778f002c6cSBruce M Simpson 	printf("addr %s ifp %p(%s) ifma %p\n",
28788f002c6cSBruce M Simpson 	    ip6_sprintf(ip6tbuf, &inm->in6m_addr),
28798f002c6cSBruce M Simpson 	    inm->in6m_ifp,
2880e74966f6SAndrey V. Elsukov 	    if_name(inm->in6m_ifp),
28818f002c6cSBruce M Simpson 	    inm->in6m_ifma);
28828f002c6cSBruce M Simpson 	printf("timer %u state %s refcount %u scq.len %u\n",
28838f002c6cSBruce M Simpson 	    inm->in6m_timer,
28848f002c6cSBruce M Simpson 	    in6m_state_str(inm->in6m_state),
28858f002c6cSBruce M Simpson 	    inm->in6m_refcount,
2886a99c84d4SGleb Smirnoff 	    mbufq_len(&inm->in6m_scq));
28878f002c6cSBruce M Simpson 	printf("mli %p nsrc %lu sctimer %u scrv %u\n",
28888f002c6cSBruce M Simpson 	    inm->in6m_mli,
28898f002c6cSBruce M Simpson 	    inm->in6m_nsrc,
28908f002c6cSBruce M Simpson 	    inm->in6m_sctimer,
28918f002c6cSBruce M Simpson 	    inm->in6m_scrv);
28928f002c6cSBruce M Simpson 	for (t = 0; t < 2; t++) {
28938f002c6cSBruce M Simpson 		printf("t%d: fmode %s asm %u ex %u in %u rec %u\n", t,
28948f002c6cSBruce M Simpson 		    in6m_mode_str(inm->in6m_st[t].iss_fmode),
28958f002c6cSBruce M Simpson 		    inm->in6m_st[t].iss_asm,
28968f002c6cSBruce M Simpson 		    inm->in6m_st[t].iss_ex,
28978f002c6cSBruce M Simpson 		    inm->in6m_st[t].iss_in,
28988f002c6cSBruce M Simpson 		    inm->in6m_st[t].iss_rec);
28998f002c6cSBruce M Simpson 	}
29008f002c6cSBruce M Simpson 	printf("%s: --- end in6m %p ---\n", __func__, inm);
29018f002c6cSBruce M Simpson }
29028f002c6cSBruce M Simpson 
29038f002c6cSBruce M Simpson #else /* !KTR */
29048f002c6cSBruce M Simpson 
29058f002c6cSBruce M Simpson void
29068f002c6cSBruce M Simpson in6m_print(const struct in6_multi *inm)
29078f002c6cSBruce M Simpson {
29088f002c6cSBruce M Simpson 
29098f002c6cSBruce M Simpson }
29108f002c6cSBruce M Simpson 
29118f002c6cSBruce M Simpson #endif /* KTR */
2912