/src/frr/pimd/pim_igmpv3.c

Source
// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * PIM for Quagga
 * Copyright (C) 2008  Everton da Silva Marques
 */

#include <zebra.h>
#include "log.h"
#include "memory.h"
#include "if.h"
#include "lib_errors.h"

#include "pimd.h"
#include "pim_instance.h"
#include "pim_iface.h"
#include "pim_igmp.h"
#include "pim_igmpv3.h"
#include "pim_str.h"
#include "pim_util.h"
#include "pim_time.h"
#include "pim_zebra.h"
#include "pim_oil.h"
#include "pim_ssm.h"

static void group_retransmit_timer_on(struct gm_group *group);
static long igmp_group_timer_remain_msec(struct gm_group *group);
static long igmp_source_timer_remain_msec(struct gm_source *source);
static void group_query_send(struct gm_group *group);
static void source_query_send_by_flag(struct gm_group *group,
              int num_sources_tosend);

static void on_trace(const char *label, struct interface *ifp,
         struct in_addr from, struct in_addr group_addr,
         int num_sources, struct in_addr *sources)
{
  if (PIM_DEBUG_GM_TRACE) {
    char from_str[INET_ADDRSTRLEN];
    char group_str[INET_ADDRSTRLEN];

    pim_inet4_dump("<from?>", from, from_str, sizeof(from_str));
    pim_inet4_dump("<group?>", group_addr, group_str,
             sizeof(group_str));

    zlog_debug("%s: from %s on %s: group=%s sources=%d", label,
         from_str, ifp->name, group_str, num_sources);
  }
}

static inline long igmp_gmi_msec(struct gm_group *group)
{
  struct pim_interface *pim_ifp = group->interface->info;
  struct gm_sock *igmp;
  struct listnode *sock_node;

  long qrv = 0, qqi = 0;

  for (ALL_LIST_ELEMENTS_RO(pim_ifp->gm_socket_list, sock_node, igmp)) {
    qrv = MAX(qrv, igmp->querier_robustness_variable);
    qqi = MAX(qqi, igmp->querier_query_interval);
  }
  return PIM_IGMP_GMI_MSEC(qrv, qqi,
         pim_ifp->gm_query_max_response_time_dsec);
}

void igmp_group_reset_gmi(struct gm_group *group)
{
  long group_membership_interval_msec;
  struct interface *ifp;

  ifp = group->interface;

  /*
    RFC 3376: 8.4. Group Membership Interval

    The Group Membership Interval is the amount of time that must pass
    before a multicast router decides there are no more members of a
    group or a particular source on a network.

    This value MUST be ((the Robustness Variable) times (the Query
    Interval)) plus (one Query Response Interval).

    group_membership_interval_msec = querier_robustness_variable *
             (1000 * querier_query_interval) +
             100 * query_response_interval_dsec;
  */
  group_membership_interval_msec = igmp_gmi_msec(group);

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    zlog_debug(
      "Resetting group %s timer to GMI=%ld.%03ld sec on %s",
      group_str, group_membership_interval_msec / 1000,
      group_membership_interval_msec % 1000, ifp->name);
  }

  /*
    RFC 3376: 6.2.2. Definition of Group Timers

    The group timer is only used when a group is in EXCLUDE mode and
    it represents the time for the *filter-mode* of the group to
    expire and switch to INCLUDE mode.
  */
  assert(group->group_filtermode_isexcl);

  igmp_group_timer_on(group, group_membership_interval_msec, ifp->name);
}

static void igmp_source_timer(struct event *t)
{
  struct gm_source *source;
  struct gm_group *group;

  source = EVENT_ARG(t);

  group = source->source_group;

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    char source_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    pim_inet4_dump("<source?>", source->source_addr, source_str,
             sizeof(source_str));
    zlog_debug(
      "%s: Source timer expired for group %s source %s on %s",
      __func__, group_str, source_str,
      group->interface->name);
  }

  /*
    RFC 3376: 6.3. IGMPv3 Source-Specific Forwarding Rules

    Group
    Filter-Mode    Source Timer Value    Action
    -----------    ------------------    ------
    INCLUDE        TIMER == 0            Suggest to stop forwarding
                 traffic from source and
                 remove source record.  If
                 there are no more source
                 records for the group, delete
                 group record.

    EXCLUDE        TIMER == 0            Suggest to not forward
                 traffic from source
                 (DO NOT remove record)

    Source timer switched from (T > 0) to (T == 0): disable forwarding.
   */

  if (group->group_filtermode_isexcl) {
    /* EXCLUDE mode */

    igmp_source_forward_stop(source);
  } else {
    /* INCLUDE mode */

    /* igmp_source_delete() will stop forwarding source */
    igmp_source_delete(source);

    /*
      If there are no more source records for the group, delete
      group
      record.
    */
    if (!listcount(group->group_source_list)) {
      igmp_group_delete_empty_include(group);
    }
  }
}

static void source_timer_off(struct gm_group *group, struct gm_source *source)
{
  if (!source->t_source_timer)
    return;

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    char source_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    pim_inet4_dump("<source?>", source->source_addr, source_str,
             sizeof(source_str));
    zlog_debug(
      "Cancelling TIMER event for group %s source %s on %s",
      group_str, source_str, group->interface->name);
  }

  EVENT_OFF(source->t_source_timer);
}

static void igmp_source_timer_on(struct gm_group *group,
         struct gm_source *source, long interval_msec)
{
  source_timer_off(group, source);
  struct pim_interface *pim_ifp = group->interface->info;

  if (PIM_DEBUG_GM_EVENTS) {
    char group_str[INET_ADDRSTRLEN];
    char source_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    pim_inet4_dump("<source?>", source->source_addr, source_str,
             sizeof(source_str));
    zlog_debug(
      "Scheduling %ld.%03ld sec TIMER event for group %s source %s on %s",
      interval_msec / 1000, interval_msec % 1000, group_str,
      source_str, group->interface->name);
  }

  event_add_timer_msec(router->master, igmp_source_timer, source,
           interval_msec, &source->t_source_timer);

  /*
    RFC 3376: 6.3. IGMPv3 Source-Specific Forwarding Rules

    Source timer switched from (T == 0) to (T > 0): enable forwarding.
  */
  igmp_source_forward_start(pim_ifp->pim, source);
}

void igmp_source_reset_gmi(struct gm_group *group, struct gm_source *source)
{
  long group_membership_interval_msec;
  struct interface *ifp;

  ifp = group->interface;

  group_membership_interval_msec = igmp_gmi_msec(group);

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    char source_str[INET_ADDRSTRLEN];

    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    pim_inet4_dump("<source?>", source->source_addr, source_str,
             sizeof(source_str));

    zlog_debug(
      "Resetting source %s timer to GMI=%ld.%03ld sec for group %s on %s",
      source_str, group_membership_interval_msec / 1000,
      group_membership_interval_msec % 1000, group_str,
      ifp->name);
  }

  igmp_source_timer_on(group, source, group_membership_interval_msec);
}

static void source_mark_delete_flag(struct gm_group *group)
{
  struct listnode *src_node;
  struct gm_source *src;

  for (ALL_LIST_ELEMENTS_RO(group->group_source_list, src_node, src)) {
    IGMP_SOURCE_DO_DELETE(src->source_flags);
  }
}

static void source_mark_send_flag(struct gm_group *group)
{
  struct listnode *src_node;
  struct gm_source *src;

  for (ALL_LIST_ELEMENTS_RO(group->group_source_list, src_node, src)) {
    IGMP_SOURCE_DO_SEND(src->source_flags);
  }
}

static int source_mark_send_flag_by_timer(struct gm_group *group)
{
  struct listnode *src_node;
  struct gm_source *src;
  int num_marked_sources = 0;

  for (ALL_LIST_ELEMENTS_RO(group->group_source_list, src_node, src)) {
    /* Is source timer running? */
    if (src->t_source_timer) {
      IGMP_SOURCE_DO_SEND(src->source_flags);
      ++num_marked_sources;
    } else {
      IGMP_SOURCE_DONT_SEND(src->source_flags);
    }
  }

  return num_marked_sources;
}

static void source_clear_send_flag(struct list *source_list)
{
  struct listnode *src_node;
  struct gm_source *src;

  for (ALL_LIST_ELEMENTS_RO(source_list, src_node, src)) {
    IGMP_SOURCE_DONT_SEND(src->source_flags);
  }
}

/*
  Any source (*,G) is forwarded only if mode is EXCLUDE {empty}
*/
static void group_exclude_fwd_anysrc_ifempty(struct gm_group *group)
{
  struct pim_interface *pim_ifp = group->interface->info;

  assert(group->group_filtermode_isexcl);

  if (listcount(group->group_source_list) < 1) {
    igmp_anysource_forward_start(pim_ifp->pim, group);
  }
}

void igmp_source_free(struct gm_source *source)
{
  /* make sure there is no source timer running */
#ifndef FUZZING
  assert(!source->t_source_timer);
#endif
  XFREE(MTYPE_PIM_IGMP_GROUP_SOURCE, source);
}

static void source_channel_oil_detach(struct gm_source *source)
{
  if (source->source_channel_oil) {
    pim_channel_oil_del(source->source_channel_oil, __func__);
    source->source_channel_oil = NULL;
  }
}

/*
  igmp_source_delete:       stop forwarding, and delete the source
  igmp_source_forward_stop: stop forwarding, but keep the source
*/
void igmp_source_delete(struct gm_source *source)
{
  struct gm_group *group;
  struct in_addr src;

  group = source->source_group;

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    char source_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    pim_inet4_dump("<source?>", source->source_addr, source_str,
             sizeof(source_str));
    zlog_debug(
      "Deleting IGMP source %s for group %s from interface %s c_oil ref_count %d",
      source_str, group_str, group->interface->name,
      source->source_channel_oil
        ? source->source_channel_oil->oil_ref_count
        : 0);
  }

  source_timer_off(group, source);
  igmp_source_forward_stop(source);

  /* sanity check that forwarding has been disabled */
  if (IGMP_SOURCE_TEST_FORWARDING(source->source_flags)) {
    char group_str[INET_ADDRSTRLEN];
    char source_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    pim_inet4_dump("<source?>", source->source_addr, source_str,
             sizeof(source_str));
    zlog_warn(
      "%s: forwarding=ON(!) IGMP source %s for group %s from interface %s",
      __func__, source_str, group_str,
      group->interface->name);
    /* warning only */
  }

  source_channel_oil_detach(source);

  /*
    notice that listnode_delete() can't be moved
    into igmp_source_free() because the later is
    called by list_delete_all_node()
  */
  listnode_delete(group->group_source_list, source);

  src.s_addr = source->source_addr.s_addr;
  igmp_source_free(source);

  /* Group source list is empty and current source is * then
   *,G group going away so do not trigger start */
  if (group->group_filtermode_isexcl
      && (listcount(group->group_source_list) != 0)
      && src.s_addr != INADDR_ANY) {
    group_exclude_fwd_anysrc_ifempty(group);
  }
}

static void source_delete_by_flag(struct list *source_list)
{
  struct listnode *src_node;
  struct listnode *src_nextnode;
  struct gm_source *src;

  for (ALL_LIST_ELEMENTS(source_list, src_node, src_nextnode, src))
    if (IGMP_SOURCE_TEST_DELETE(src->source_flags))
      igmp_source_delete(src);
}

void igmp_source_delete_expired(struct list *source_list)
{
  struct listnode *src_node;
  struct listnode *src_nextnode;
  struct gm_source *src;

  for (ALL_LIST_ELEMENTS(source_list, src_node, src_nextnode, src))
    if (!src->t_source_timer)
      igmp_source_delete(src);
}

struct gm_source *igmp_find_source_by_addr(struct gm_group *group,
             struct in_addr src_addr)
{
  struct listnode *src_node;
  struct gm_source *src;

  for (ALL_LIST_ELEMENTS_RO(group->group_source_list, src_node, src))
    if (src_addr.s_addr == src->source_addr.s_addr)
      return src;

  return 0;
}

struct gm_source *igmp_get_source_by_addr(struct gm_group *group,
            struct in_addr src_addr, bool *new)
{
  struct gm_source *src;

  if (new)
    *new = false;

  src = igmp_find_source_by_addr(group, src_addr);
  if (src)
    return src;

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    char source_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    pim_inet4_dump("<source?>", src_addr, source_str,
             sizeof(source_str));
    zlog_debug(
      "Creating new IGMP source %s for group %s on interface %s",
      source_str, group_str, group->interface->name);
  }

  src = XCALLOC(MTYPE_PIM_IGMP_GROUP_SOURCE, sizeof(*src));

  if (new)
    *new = true;

  src->t_source_timer = NULL;
  src->source_group = group; /* back pointer */
  src->source_addr = src_addr;
  src->source_creation = pim_time_monotonic_sec();
  src->source_flags = 0;
  src->source_query_retransmit_count = 0;
  src->source_channel_oil = NULL;

  listnode_add(group->group_source_list, src);

  /* Any source (*,G) is forwarded only if mode is EXCLUDE {empty} */
  igmp_anysource_forward_stop(group);
  return src;
}

static void allow(struct gm_sock *igmp, struct in_addr from,
      struct in_addr group_addr, int num_sources,
      struct in_addr *sources)
{
  struct gm_source *source;
  struct gm_group *group;
  int i;

  if (num_sources == 0) {
    /*
      RFC 3376: 3.1. Socket-State
      If the requested filter mode is INCLUDE *and* the requested
      source list is empty, then the entry corresponding to the
      requested interface and multicast address is deleted if
      present. If no such entry is present, the request is ignored.
      So, deleting the group present.
    */
    group = find_group_by_addr(igmp, group_addr);
    if (!group) {
      return;
    }
    if (group->group_filtermode_isexcl) {
      if (listcount(group->group_source_list) == 1) {
        struct in_addr star = {.s_addr = INADDR_ANY};

        source = igmp_find_source_by_addr(group, star);
        if (source)
          igmp_source_reset_gmi(group, source);
      }
    } else {
      igmp_group_delete(group);
    }

    return;
  }

  /* non-existent group is created as INCLUDE {empty} */
  group = igmp_add_group_by_addr(igmp, group_addr);
  if (!group) {
    return;
  }

  /* scan received sources */
  for (i = 0; i < num_sources; ++i) {
    struct in_addr *src_addr;

    src_addr = sources + i;

    source = igmp_get_source_by_addr(group, *src_addr, NULL);
    if (!source)
      continue;

    /*
      RFC 3376: 6.4.1. Reception of Current-State Records

      When receiving IS_IN reports for groups in EXCLUDE mode is
      sources should be moved from set with (timers = 0) to set with
      (timers > 0).

      igmp_source_reset_gmi() below, resetting the source timers to
      GMI, accomplishes this.
    */
    igmp_source_reset_gmi(group, source);

  } /* scan received sources */
}

void igmpv3_report_isin(struct gm_sock *igmp, struct in_addr from,
      struct in_addr group_addr, int num_sources,
      struct in_addr *sources)
{
  on_trace(__func__, igmp->interface, from, group_addr, num_sources,
     sources);

  allow(igmp, from, group_addr, num_sources, sources);
}

static void isex_excl(struct gm_group *group, int num_sources,
          struct in_addr *sources)
{
  struct gm_source *source;
  int i;

  /* EXCLUDE mode */
  assert(group->group_filtermode_isexcl);

  /* E.1: set deletion flag for known sources (X,Y) */
  source_mark_delete_flag(group);

  /* scan received sources (A) */
  for (i = 0; i < num_sources; ++i) {
    struct in_addr *src_addr;
    bool new;

    src_addr = sources + i;

    /* E.2: lookup reported source from (A) in (X,Y) */
    source = igmp_get_source_by_addr(group, *src_addr, &new);
    if (!source)
      continue;

    if (!new) {
      /* E.3: if found, clear deletion flag: (X*A) or (Y*A) */
      IGMP_SOURCE_DONT_DELETE(source->source_flags);
    } else {
      /* E.4: if not found, create source with timer=GMI:
       * (A-X-Y) */
      assert(!source->t_source_timer); /* timer == 0 */
      igmp_source_reset_gmi(group, source);
#ifndef FUZZING
      assert(source->t_source_timer); /* (A-X-Y) timer > 0 */
#endif
    }

  } /* scan received sources */

  /*
   * If we are in isexcl mode and num_sources == 0
   * than that means we have a *,g entry that
   * needs to be handled
   */
  if (group->group_filtermode_isexcl && num_sources == 0) {
    struct in_addr star = {.s_addr = INADDR_ANY};
    source = igmp_find_source_by_addr(group, star);
    if (source) {
      IGMP_SOURCE_DONT_DELETE(source->source_flags);
      igmp_source_reset_gmi(group, source);
    }
  }

  /* E.5: delete all sources marked with deletion flag: (X-A) and (Y-A) */
  source_delete_by_flag(group->group_source_list);
}

static void isex_incl(struct gm_group *group, int num_sources,
          struct in_addr *sources)
{
  int i;

  /* INCLUDE mode */
  assert(!group->group_filtermode_isexcl);

  /* I.1: set deletion flag for known sources (A) */
  source_mark_delete_flag(group);

  /* scan received sources (B) */
  for (i = 0; i < num_sources; ++i) {
    struct gm_source *source;
    struct in_addr *src_addr;
    bool new;

    src_addr = sources + i;

    /* I.2: lookup reported source (B) */
    source = igmp_get_source_by_addr(group, *src_addr, &new);
    if (!source)
      continue;

    if (!new) {
      /* I.3: if found, clear deletion flag (A*B) */
      IGMP_SOURCE_DONT_DELETE(source->source_flags);
    } else {
      /* I.4: if not found, create source with timer=0 (B-A)
       */
#ifndef FUZZING
      assert(!source->t_source_timer); /* (B-A) timer=0 */
#endif
    }

  } /* scan received sources */

  /* I.5: delete all sources marked with deletion flag (A-B) */
  source_delete_by_flag(group->group_source_list);

  group->group_filtermode_isexcl = 1; /* boolean=true */

  assert(group->group_filtermode_isexcl);

  group_exclude_fwd_anysrc_ifempty(group);
}

void igmpv3_report_isex(struct gm_sock *igmp, struct in_addr from,
      struct in_addr group_addr, int num_sources,
      struct in_addr *sources, int from_igmp_v2_report)
{
  struct interface *ifp = igmp->interface;
  struct gm_group *group;

  on_trace(__func__, ifp, from, group_addr, num_sources, sources);

  if (pim_is_group_filtered(ifp->info, &group_addr))
    return;

  /* non-existent group is created as INCLUDE {empty} */
  group = igmp_add_group_by_addr(igmp, group_addr);
  if (!group) {
    return;
  }

  /* So we can display how we learned the group in our show command output
   */
  if (from_igmp_v2_report)
    group->igmp_version = 2;

  if (group->group_filtermode_isexcl) {
    /* EXCLUDE mode */
    isex_excl(group, num_sources, sources);
  } else {
    /* INCLUDE mode */
    isex_incl(group, num_sources, sources);
    assert(group->group_filtermode_isexcl);
  }

  assert(group->group_filtermode_isexcl);

  igmp_group_reset_gmi(group);
}

static void toin_incl(struct gm_group *group, int num_sources,
          struct in_addr *sources)
{
  int num_sources_tosend = listcount(group->group_source_list);
  int i;

  /* Set SEND flag for all known sources (A) */
  source_mark_send_flag(group);

  /* Scan received sources (B) */
  for (i = 0; i < num_sources; ++i) {
    struct gm_source *source;
    struct in_addr *src_addr;
    bool new;

    src_addr = sources + i;

    /* Lookup reported source (B) */
    source = igmp_get_source_by_addr(group, *src_addr, &new);
    if (!source)
      continue;

    if (!new) {
      /* If found, clear SEND flag (A*B) */
      IGMP_SOURCE_DONT_SEND(source->source_flags);
      --num_sources_tosend;
    }

    /* (B)=GMI */
    igmp_source_reset_gmi(group, source);
  }

  /* Send sources marked with SEND flag: Q(G,A-B) */
  if (num_sources_tosend > 0) {
    source_query_send_by_flag(group, num_sources_tosend);
  }
}

static void toin_excl(struct gm_group *group, int num_sources,
          struct in_addr *sources)
{
  int num_sources_tosend;
  int i;

  /* Set SEND flag for X (sources with timer > 0) */
  num_sources_tosend = source_mark_send_flag_by_timer(group);

  /* Scan received sources (A) */
  for (i = 0; i < num_sources; ++i) {
    struct gm_source *source;
    struct in_addr *src_addr;
    bool new;

    src_addr = sources + i;

    /* Lookup reported source (A) */
    source = igmp_get_source_by_addr(group, *src_addr, &new);
    if (!source)
      continue;

    if (source->t_source_timer) {
      /* If found and timer running, clear SEND flag
       * (X*A) */
      IGMP_SOURCE_DONT_SEND(source->source_flags);
      --num_sources_tosend;
    }

    /* (A)=GMI */
    igmp_source_reset_gmi(group, source);
  }

  /* Send sources marked with SEND flag: Q(G,X-A) */
  if (num_sources_tosend > 0) {
    source_query_send_by_flag(group, num_sources_tosend);
  }

  /* Send Q(G) */
  group_query_send(group);
}

void igmpv3_report_toin(struct gm_sock *igmp, struct in_addr from,
      struct in_addr group_addr, int num_sources,
      struct in_addr *sources)
{
  struct interface *ifp = igmp->interface;
  struct gm_group *group;

  on_trace(__func__, ifp, from, group_addr, num_sources, sources);

  /*
   * If the requested filter mode is INCLUDE *and* the requested source
   * list is empty, then the entry corresponding to the requested
   * interface and multicast address is deleted if present.  If no such
   * entry is present, the request is ignored.
   */
  if (num_sources) {
    /* non-existent group is created as INCLUDE {empty} */
    group = igmp_add_group_by_addr(igmp, group_addr);
    if (!group) {
      return;
    }
  } else {
    group = find_group_by_addr(igmp, group_addr);
    if (!group)
      return;
  }

  if (group->group_filtermode_isexcl) {
    /* EXCLUDE mode */
    toin_excl(group, num_sources, sources);
  } else {
    /* INCLUDE mode */
    toin_incl(group, num_sources, sources);
  }
}

static void toex_incl(struct gm_group *group, int num_sources,
          struct in_addr *sources)
{
  int num_sources_tosend = 0;
  int i;

  assert(!group->group_filtermode_isexcl);

  /* Set DELETE flag for all known sources (A) */
  source_mark_delete_flag(group);

  /* Clear off SEND flag from all known sources (A) */
  source_clear_send_flag(group->group_source_list);

  /* Scan received sources (B) */
  for (i = 0; i < num_sources; ++i) {
    struct gm_source *source;
    struct in_addr *src_addr;
    bool new;

    src_addr = sources + i;

    /* Lookup reported source (B) */
    source = igmp_get_source_by_addr(group, *src_addr, &new);
    if (!new) {
      /* If found, clear deletion flag: (A*B) */
      IGMP_SOURCE_DONT_DELETE(source->source_flags);
      /* and set SEND flag (A*B) */
      IGMP_SOURCE_DO_SEND(source->source_flags);
      ++num_sources_tosend;
#ifndef FUZZING
      assert(!source->t_source_timer); /* (B-A) timer=0 */
#endif
    }

  } /* Scan received sources (B) */

  group->group_filtermode_isexcl = 1; /* boolean=true */

  /* Delete all sources marked with DELETE flag (A-B) */
  source_delete_by_flag(group->group_source_list);

  /* Send sources marked with SEND flag: Q(G,A*B) */
  if (num_sources_tosend > 0) {
    source_query_send_by_flag(group, num_sources_tosend);
  }

  assert(group->group_filtermode_isexcl);

  group_exclude_fwd_anysrc_ifempty(group);
}

static void toex_excl(struct gm_group *group, int num_sources,
          struct in_addr *sources)
{
  int num_sources_tosend = 0;
  int i;

  /* set DELETE flag for all known sources (X,Y) */
  source_mark_delete_flag(group);

  /* clear off SEND flag from all known sources (X,Y) */
  source_clear_send_flag(group->group_source_list);

  if (num_sources == 0) {
    struct gm_source *source;
    struct in_addr any = {.s_addr = INADDR_ANY};

    source = igmp_find_source_by_addr(group, any);
    if (source)
      IGMP_SOURCE_DONT_DELETE(source->source_flags);
  }

  /* scan received sources (A) */
  for (i = 0; i < num_sources; ++i) {
    struct gm_source *source;
    struct in_addr *src_addr;
    bool new;

    src_addr = sources + i;

    /* lookup reported source (A) in known sources (X,Y) */
    source = igmp_get_source_by_addr(group, *src_addr, &new);
    if (!source)
      continue;

    if (!new) {
      /* if found, clear off DELETE flag from reported source
       * (A) */
      IGMP_SOURCE_DONT_DELETE(source->source_flags);
    } else {
      /* if not found, create source with Group Timer:
       * (A-X-Y)=Group Timer */
      long group_timer_msec;

      assert(!source->t_source_timer); /* timer == 0 */
      group_timer_msec = igmp_group_timer_remain_msec(group);
      igmp_source_timer_on(group, source, group_timer_msec);
#ifndef FUZZING
      assert(source->t_source_timer); /* (A-X-Y) timer > 0 */
#endif
      /* make sure source is created with DELETE flag unset */
      assert(!IGMP_SOURCE_TEST_DELETE(source->source_flags));
    }

    /* make sure reported source has DELETE flag unset */
    assert(!IGMP_SOURCE_TEST_DELETE(source->source_flags));

    if (source->t_source_timer) {
      /* if source timer>0 mark SEND flag: Q(G,A-Y) */
      IGMP_SOURCE_DO_SEND(source->source_flags);
      ++num_sources_tosend;
    }

  } /* scan received sources (A) */

  /*
    delete all sources marked with DELETE flag:
    Delete (X-A)
    Delete (Y-A)
  */
  source_delete_by_flag(group->group_source_list);

  /* send sources marked with SEND flag: Q(G,A-Y) */
  if (num_sources_tosend > 0) {
    source_query_send_by_flag(group, num_sources_tosend);
  }
}

void igmpv3_report_toex(struct gm_sock *igmp, struct in_addr from,
      struct in_addr group_addr, int num_sources,
      struct in_addr *sources)
{
  struct interface *ifp = igmp->interface;
  struct gm_group *group;

  on_trace(__func__, ifp, from, group_addr, num_sources, sources);

  /* non-existent group is created as INCLUDE {empty} */
  group = igmp_add_group_by_addr(igmp, group_addr);
  if (!group) {
    return;
  }

  if (group->group_filtermode_isexcl) {
    /* EXCLUDE mode */
    toex_excl(group, num_sources, sources);
  } else {
    /* INCLUDE mode */
    toex_incl(group, num_sources, sources);
    assert(group->group_filtermode_isexcl);
  }
  assert(group->group_filtermode_isexcl);

  /* Group Timer=GMI */
  igmp_group_reset_gmi(group);
}

void igmpv3_report_allow(struct gm_sock *igmp, struct in_addr from,
       struct in_addr group_addr, int num_sources,
       struct in_addr *sources)
{
  on_trace(__func__, igmp->interface, from, group_addr, num_sources,
     sources);

  allow(igmp, from, group_addr, num_sources, sources);
}

static void igmp_send_query_group(struct gm_group *group, char *query_buf,
          size_t query_buf_size, int num_sources,
          int s_flag)
{
  struct interface *ifp = group->interface;
  struct pim_interface *pim_ifp = ifp->info;
  struct gm_sock *igmp;
  struct listnode *sock_node;

  for (ALL_LIST_ELEMENTS_RO(pim_ifp->gm_socket_list, sock_node, igmp)) {
    igmp_send_query(
      pim_ifp->igmp_version, group, query_buf, query_buf_size,
      num_sources, group->group_addr, group->group_addr,
      pim_ifp->gm_specific_query_max_response_time_dsec,
      s_flag, igmp);
  }
}

/*
  RFC3376: 6.6.3.1. Building and Sending Group Specific Queries

  When transmitting a group specific query, if the group timer is
  larger than LMQT, the "Suppress Router-Side Processing" bit is set
  in the query message.
*/
static void group_retransmit_group(struct gm_group *group)
{
  struct pim_interface *pim_ifp;
  long lmqc;      /* Last Member Query Count */
  long lmqi_msec; /* Last Member Query Interval */
  long lmqt_msec; /* Last Member Query Time */
  int s_flag;
  int query_buf_size;

  pim_ifp = group->interface->info;

  if (pim_ifp->igmp_version == 3) {
    query_buf_size = PIM_IGMP_BUFSIZE_WRITE;
  } else {
    query_buf_size = IGMP_V12_MSG_SIZE;
  }

  char query_buf[query_buf_size];

  lmqc = pim_ifp->gm_last_member_query_count;
  lmqi_msec = 100 * pim_ifp->gm_specific_query_max_response_time_dsec;
  lmqt_msec = lmqc * lmqi_msec;

  /*
    RFC3376: 6.6.3.1. Building and Sending Group Specific Queries

    When transmitting a group specific query, if the group timer is
    larger than LMQT, the "Suppress Router-Side Processing" bit is set
    in the query message.
  */
  s_flag = igmp_group_timer_remain_msec(group) > lmqt_msec;

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    zlog_debug(
      "retransmit_group_specific_query: group %s on %s: s_flag=%d count=%d",
      group_str, group->interface->name, s_flag,
      group->group_specific_query_retransmit_count);
  }

  /*
    RFC3376: 4.1.12. IP Destination Addresses for Queries

    Group-Specific and Group-and-Source-Specific Queries are sent with
    an IP destination address equal to the multicast address of
    interest.
  */

  igmp_send_query_group(group, query_buf, sizeof(query_buf), 0, s_flag);
}

/*
  RFC3376: 6.6.3.2. Building and Sending Group and Source Specific Queries

  When building a group and source specific query for a group G, two
  separate query messages are sent for the group.  The first one has
  the "Suppress Router-Side Processing" bit set and contains all the
  sources with retransmission state and timers greater than LMQT.  The
  second has the "Suppress Router-Side Processing" bit clear and
  contains all the sources with retransmission state and timers lower
  or equal to LMQT.  If either of the two calculated messages does not
  contain any sources, then its transmission is suppressed.
 */
static int group_retransmit_sources(struct gm_group *group,
            int send_with_sflag_set)
{
  struct pim_interface *pim_ifp;
  long lmqc;      /* Last Member Query Count */
  long lmqi_msec; /* Last Member Query Interval */
  long lmqt_msec; /* Last Member Query Time */
  char query_buf1[PIM_IGMP_BUFSIZE_WRITE]; /* 1 = with s_flag set */
  char query_buf2[PIM_IGMP_BUFSIZE_WRITE]; /* 2 = with s_flag clear */
  int query_buf1_max_sources;
  int query_buf2_max_sources;
  struct in_addr *source_addr1;
  struct in_addr *source_addr2;
  int num_sources_tosend1;
  int num_sources_tosend2;
  struct listnode *src_node;
  struct gm_source *src;
  int num_retransmit_sources_left = 0;

  source_addr1 = (struct in_addr *)(query_buf1 + IGMP_V3_SOURCES_OFFSET);
  source_addr2 = (struct in_addr *)(query_buf2 + IGMP_V3_SOURCES_OFFSET);

  pim_ifp = group->interface->info;

  lmqc = pim_ifp->gm_last_member_query_count;
  lmqi_msec = 100 * pim_ifp->gm_specific_query_max_response_time_dsec;
  lmqt_msec = lmqc * lmqi_msec;

  /* Scan all group sources */
  for (ALL_LIST_ELEMENTS_RO(group->group_source_list, src_node, src)) {

    /* Source has retransmission state? */
    if (src->source_query_retransmit_count < 1)
      continue;

    if (--src->source_query_retransmit_count > 0) {
      ++num_retransmit_sources_left;
    }

    /* Copy source address into appropriate query buffer */
    if (igmp_source_timer_remain_msec(src) > lmqt_msec) {
      *source_addr1 = src->source_addr;
      ++source_addr1;
    } else {
      *source_addr2 = src->source_addr;
      ++source_addr2;
    }
  }

  num_sources_tosend1 =
    source_addr1
    - (struct in_addr *)(query_buf1 + IGMP_V3_SOURCES_OFFSET);
  num_sources_tosend2 =
    source_addr2
    - (struct in_addr *)(query_buf2 + IGMP_V3_SOURCES_OFFSET);

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    zlog_debug(
      "retransmit_grp&src_specific_query: group %s on %s: srcs_with_sflag=%d srcs_wo_sflag=%d will_send_sflag=%d retransmit_src_left=%d",
      group_str, group->interface->name, num_sources_tosend1,
      num_sources_tosend2, send_with_sflag_set,
      num_retransmit_sources_left);
  }

  if (num_sources_tosend1 > 0) {
    /*
      Send group-and-source-specific query with s_flag set and all
      sources with timers greater than LMQT.
    */

    if (send_with_sflag_set) {

      query_buf1_max_sources =
        (sizeof(query_buf1) - IGMP_V3_SOURCES_OFFSET)
        >> 2;
      if (num_sources_tosend1 > query_buf1_max_sources) {
        char group_str[INET_ADDRSTRLEN];
        pim_inet4_dump("<group?>", group->group_addr,
                 group_str, sizeof(group_str));
        zlog_warn(
          "%s: group %s on %s: s_flag=1 unable to fit %d sources into buf_size=%zu (max_sources=%d)",
          __func__, group_str,
          group->interface->name,
          num_sources_tosend1, sizeof(query_buf1),
          query_buf1_max_sources);
      } else {
        /*
          RFC3376: 4.1.12. IP Destination Addresses for
          Queries

          Group-Specific and Group-and-Source-Specific
          Queries are sent with
          an IP destination address equal to the
          multicast address of
          interest.
        */

        igmp_send_query_group(
          group, query_buf1, sizeof(query_buf1),
          num_sources_tosend1, 1 /* s_flag */);
      }

    } /* send_with_sflag_set */
  }

  if (num_sources_tosend2 > 0) {
    /*
      Send group-and-source-specific query with s_flag clear and all
      sources with timers lower or equal to LMQT.
    */

    query_buf2_max_sources =
      (sizeof(query_buf2) - IGMP_V3_SOURCES_OFFSET) >> 2;
    if (num_sources_tosend2 > query_buf2_max_sources) {
      char group_str[INET_ADDRSTRLEN];
      pim_inet4_dump("<group?>", group->group_addr, group_str,
               sizeof(group_str));
      zlog_warn(
        "%s: group %s on %s: s_flag=0 unable to fit %d sources into buf_size=%zu (max_sources=%d)",
        __func__, group_str, group->interface->name,
        num_sources_tosend2, sizeof(query_buf2),
        query_buf2_max_sources);
    } else {
      /*
        RFC3376: 4.1.12. IP Destination Addresses for Queries

        Group-Specific and Group-and-Source-Specific Queries
        are sent with
        an IP destination address equal to the multicast
        address of
        interest.
      */

      igmp_send_query_group(
        group, query_buf2, sizeof(query_buf2),
        num_sources_tosend2, 0 /* s_flag */);
    }
  }

  return num_retransmit_sources_left;
}

static void igmp_group_retransmit(struct event *t)
{
  struct gm_group *group;
  int num_retransmit_sources_left;
  int send_with_sflag_set; /* boolean */

  group = EVENT_ARG(t);

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    zlog_debug("group_retransmit_timer: group %s on %s", group_str,
         group->interface->name);
  }

  /* Retransmit group-specific queries? (RFC3376: 6.6.3.1) */
  if (group->group_specific_query_retransmit_count > 0) {

    /* Retransmit group-specific queries (RFC3376: 6.6.3.1) */
    group_retransmit_group(group);
    --group->group_specific_query_retransmit_count;

    /*
      RFC3376: 6.6.3.2
      If a group specific query is scheduled to be transmitted at
      the
      same time as a group and source specific query for the same
      group,
      then transmission of the group and source specific message
      with the
      "Suppress Router-Side Processing" bit set may be suppressed.
    */
    send_with_sflag_set = 0; /* boolean=false */
  } else {
    send_with_sflag_set = 1; /* boolean=true */
  }

  /* Retransmit group-and-source-specific queries (RFC3376: 6.6.3.2) */
  num_retransmit_sources_left =
    group_retransmit_sources(group, send_with_sflag_set);

  /*
    Keep group retransmit timer running if there is any retransmit
    counter pending
  */
  if ((num_retransmit_sources_left > 0)
      || (group->group_specific_query_retransmit_count > 0)) {
    group_retransmit_timer_on(group);
  }
}

/*
  group_retransmit_timer_on:
  if group retransmit timer isn't running, starts it;
  otherwise, do nothing
*/
static void group_retransmit_timer_on(struct gm_group *group)
{
  struct pim_interface *pim_ifp;
  long lmqi_msec; /* Last Member Query Interval */

  /* if group retransmit timer is running, do nothing */
  if (group->t_group_query_retransmit_timer) {
    return;
  }

  pim_ifp = group->interface->info;

  lmqi_msec = 100 * pim_ifp->gm_specific_query_max_response_time_dsec;

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    zlog_debug(
      "Scheduling %ld.%03ld sec retransmit timer for group %s on %s",
      lmqi_msec / 1000, lmqi_msec % 1000, group_str,
      group->interface->name);
  }

  event_add_timer_msec(router->master, igmp_group_retransmit, group,
           lmqi_msec, &group->t_group_query_retransmit_timer);
}

static long igmp_group_timer_remain_msec(struct gm_group *group)
{
  return pim_time_timer_remain_msec(group->t_group_timer);
}

static long igmp_source_timer_remain_msec(struct gm_source *source)
{
  return pim_time_timer_remain_msec(source->t_source_timer);
}

/*
  RFC3376: 6.6.3.1. Building and Sending Group Specific Queries
*/
static void group_query_send(struct gm_group *group)
{
  struct pim_interface *pim_ifp;
  long lmqc; /* Last Member Query Count */

  pim_ifp = group->interface->info;
  lmqc = pim_ifp->gm_last_member_query_count;

  /* lower group timer to lmqt */
  igmp_group_timer_lower_to_lmqt(group);

  /* reset retransmission counter */
  group->group_specific_query_retransmit_count = lmqc;

  /* immediately send group specific query (decrease retransmit counter by
   * 1)*/
  group_retransmit_group(group);

  /* make sure group retransmit timer is running */
  group_retransmit_timer_on(group);
}

/*
  RFC3376: 6.6.3.2. Building and Sending Group and Source Specific Queries
*/
static void source_query_send_by_flag(struct gm_group *group,
              int num_sources_tosend)
{
  struct pim_interface *pim_ifp;
  struct listnode *src_node;
  struct gm_source *src;
  long lmqc;      /* Last Member Query Count */
  long lmqi_msec; /* Last Member Query Interval */
  long lmqt_msec; /* Last Member Query Time */

  assert(num_sources_tosend > 0);

  pim_ifp = group->interface->info;

  lmqc = pim_ifp->gm_last_member_query_count;
  lmqi_msec = 100 * pim_ifp->gm_specific_query_max_response_time_dsec;
  lmqt_msec = lmqc * lmqi_msec;

  /*
    RFC3376: 6.6.3.2. Building and Sending Group and Source Specific
    Queries

    (...) for each of the sources in X of group G, with source timer
    larger
    than LMQT:
    o Set number of retransmissions for each source to [Last Member
    Query Count].
    o Lower source timer to LMQT.
  */
  for (ALL_LIST_ELEMENTS_RO(group->group_source_list, src_node, src)) {
    if (IGMP_SOURCE_TEST_SEND(src->source_flags)) {
      /* source "src" in X of group G */
      if (igmp_source_timer_remain_msec(src) > lmqt_msec) {
        src->source_query_retransmit_count = lmqc;
        igmp_source_timer_lower_to_lmqt(src);
      }
    }
  }

  /* send group-and-source specific queries */
  group_retransmit_sources(group, 1 /* send_with_sflag_set=true */);

  /* make sure group retransmit timer is running */
  group_retransmit_timer_on(group);
}

static void block_excl(struct gm_group *group, int num_sources,
           struct in_addr *sources)
{
  int num_sources_tosend = 0;
  int i;

  /* 1. clear off SEND flag from all known sources (X,Y) */
  source_clear_send_flag(group->group_source_list);

  /* 2. scan received sources (A) */
  for (i = 0; i < num_sources; ++i) {
    struct gm_source *source;
    struct in_addr *src_addr;
    bool new;

    src_addr = sources + i;

    /* lookup reported source (A) in known sources (X,Y) */
    source = igmp_get_source_by_addr(group, *src_addr, &new);
    if (!source)
      continue;

    if (new) {
      /* 3: if not found, create source with Group Timer:
       * (A-X-Y)=Group Timer */
      long group_timer_msec;

      assert(!source->t_source_timer); /* timer == 0 */
      group_timer_msec = igmp_group_timer_remain_msec(group);
      igmp_source_timer_on(group, source, group_timer_msec);
#ifndef FUZZING
      assert(source->t_source_timer); /* (A-X-Y) timer > 0 */
#endif
    }

    if (source->t_source_timer) {
      /* 4. if source timer>0 mark SEND flag: Q(G,A-Y) */
      IGMP_SOURCE_DO_SEND(source->source_flags);
      ++num_sources_tosend;
    }
  }

  /* 5. send sources marked with SEND flag: Q(G,A-Y) */
  if (num_sources_tosend > 0) {
    source_query_send_by_flag(group, num_sources_tosend);
  }
}

static void block_incl(struct gm_group *group, int num_sources,
           struct in_addr *sources)
{
  int num_sources_tosend = 0;
  int i;

  /* 1. clear off SEND flag from all known sources (B) */
  source_clear_send_flag(group->group_source_list);

  /* 2. scan received sources (A) */
  for (i = 0; i < num_sources; ++i) {
    struct gm_source *source;
    struct in_addr *src_addr;

    src_addr = sources + i;

    /* lookup reported source (A) in known sources (B) */
    source = igmp_find_source_by_addr(group, *src_addr);
    if (source) {
      /* 3. if found (A*B), mark SEND flag: Q(G,A*B) */
      IGMP_SOURCE_DO_SEND(source->source_flags);
      ++num_sources_tosend;
    }
  }

  /* 4. send sources marked with SEND flag: Q(G,A*B) */
  if (num_sources_tosend > 0) {
    source_query_send_by_flag(group, num_sources_tosend);
  }
}

void igmpv3_report_block(struct gm_sock *igmp, struct in_addr from,
       struct in_addr group_addr, int num_sources,
       struct in_addr *sources)
{
  struct interface *ifp = igmp->interface;
  struct gm_group *group;

  on_trace(__func__, ifp, from, group_addr, num_sources, sources);

  /* non-existent group is created as INCLUDE {empty} */
  group = igmp_add_group_by_addr(igmp, group_addr);
  if (!group) {
    return;
  }

  if (group->group_filtermode_isexcl) {
    /* EXCLUDE mode */
    block_excl(group, num_sources, sources);
  } else {
    /* INCLUDE mode */
    block_incl(group, num_sources, sources);
  }
}

void igmp_group_timer_lower_to_lmqt(struct gm_group *group)
{
  struct interface *ifp;
  struct pim_interface *pim_ifp;
  char *ifname;
  int lmqi_dsec; /* Last Member Query Interval */
  int lmqc;      /* Last Member Query Count */
  int lmqt_msec; /* Last Member Query Time */

  /*
    RFC 3376: 6.2.2. Definition of Group Timers

    The group timer is only used when a group is in EXCLUDE mode and
    it represents the time for the *filter-mode* of the group to
    expire and switch to INCLUDE mode.
  */
  if (!group->group_filtermode_isexcl) {
    return;
  }

  ifp = group->interface;
  pim_ifp = ifp->info;
  ifname = ifp->name;

  lmqi_dsec = pim_ifp->gm_specific_query_max_response_time_dsec;
  lmqc = pim_ifp->gm_last_member_query_count;
  lmqt_msec = PIM_IGMP_LMQT_MSEC(
    lmqi_dsec, lmqc); /* lmqt_msec = (100 * lmqi_dsec) * lmqc */

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    zlog_debug(
      "%s: group %s on %s: LMQC=%d LMQI=%d dsec LMQT=%d msec",
      __func__, group_str, ifname, lmqc, lmqi_dsec,
      lmqt_msec);
  }

  assert(group->group_filtermode_isexcl);

  igmp_group_timer_on(group, lmqt_msec, ifname);
}

void igmp_source_timer_lower_to_lmqt(struct gm_source *source)
{
  struct gm_group *group;
  struct interface *ifp;
  struct pim_interface *pim_ifp;
  char *ifname;
  int lmqi_dsec; /* Last Member Query Interval */
  int lmqc;      /* Last Member Query Count */
  int lmqt_msec; /* Last Member Query Time */

  group = source->source_group;
  ifp = group->interface;
  pim_ifp = ifp->info;
  ifname = ifp->name;

  lmqi_dsec = pim_ifp->gm_specific_query_max_response_time_dsec;
  lmqc = pim_ifp->gm_last_member_query_count;
  lmqt_msec = PIM_IGMP_LMQT_MSEC(
    lmqi_dsec, lmqc); /* lmqt_msec = (100 * lmqi_dsec) * lmqc */

  if (PIM_DEBUG_GM_TRACE) {
    char group_str[INET_ADDRSTRLEN];
    char source_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<group?>", group->group_addr, group_str,
             sizeof(group_str));
    pim_inet4_dump("<source?>", source->source_addr, source_str,
             sizeof(source_str));
    zlog_debug(
      "%s: group %s source %s on %s: LMQC=%d LMQI=%d dsec LMQT=%d msec",
      __func__, group_str, source_str, ifname, lmqc,
      lmqi_dsec, lmqt_msec);
  }

  igmp_source_timer_on(group, source, lmqt_msec);
}

void igmp_v3_send_query(struct gm_group *group, int fd, const char *ifname,
      char *query_buf, int query_buf_size, int num_sources,
      struct in_addr dst_addr, struct in_addr group_addr,
      int query_max_response_time_dsec, uint8_t s_flag,
      uint8_t querier_robustness_variable,
      uint16_t querier_query_interval)
{
  ssize_t msg_size;
  uint8_t max_resp_code;
  uint8_t qqic;
  ssize_t sent;
  struct sockaddr_in to;
  socklen_t tolen;
  uint16_t checksum;

  assert(num_sources >= 0);

  msg_size = IGMP_V3_SOURCES_OFFSET + (num_sources << 2);
  if (msg_size > query_buf_size) {
    flog_err(
      EC_LIB_DEVELOPMENT,
      "%s %s: unable to send: msg_size=%zd larger than query_buf_size=%d",
      __FILE__, __func__, msg_size, query_buf_size);
    return;
  }

  s_flag = PIM_FORCE_BOOLEAN(s_flag);
  assert((s_flag == 0) || (s_flag == 1));

  max_resp_code = igmp_msg_encode16to8(query_max_response_time_dsec);
  qqic = igmp_msg_encode16to8(querier_query_interval);

  /*
    RFC 3376: 4.1.6. QRV (Querier's Robustness Variable)

    If non-zero, the QRV field contains the [Robustness Variable]
    value used by the querier, i.e., the sender of the Query.  If the
    querier's [Robustness Variable] exceeds 7, the maximum value of
    the QRV field, the QRV is set to zero.
  */
  if (querier_robustness_variable > 7) {
    querier_robustness_variable = 0;
  }

  query_buf[0] = PIM_IGMP_MEMBERSHIP_QUERY;
  query_buf[1] = max_resp_code;
  *(uint16_t *)(query_buf + IGMP_CHECKSUM_OFFSET) =
    0; /* for computing checksum */
  memcpy(query_buf + 4, &group_addr, sizeof(struct in_addr));

  query_buf[8] = (s_flag << 3) | querier_robustness_variable;
  query_buf[9] = qqic;
  *(uint16_t *)(query_buf + IGMP_V3_NUMSOURCES_OFFSET) =
    htons(num_sources);

  checksum = in_cksum(query_buf, msg_size);
  *(uint16_t *)(query_buf + IGMP_CHECKSUM_OFFSET) = checksum;

  if (PIM_DEBUG_GM_PACKETS) {
    char dst_str[INET_ADDRSTRLEN];
    char group_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<dst?>", dst_addr, dst_str, sizeof(dst_str));
    pim_inet4_dump("<group?>", group_addr, group_str,
             sizeof(group_str));
    zlog_debug(
      "Send IGMPv3 query to %s on %s for group %s, sources=%d msg_size=%zd s_flag=%x QRV=%u QQI=%u QQIC=%02x",
      dst_str, ifname, group_str, num_sources, msg_size,
      s_flag, querier_robustness_variable,
      querier_query_interval, qqic);
  }

  memset(&to, 0, sizeof(to));
  to.sin_family = AF_INET;
  to.sin_addr = dst_addr;
  tolen = sizeof(to);

  sent = sendto(fd, query_buf, msg_size, MSG_DONTWAIT,
          (struct sockaddr *)&to, tolen);
  if (sent != (ssize_t)msg_size) {
    char dst_str[INET_ADDRSTRLEN];
    char group_str[INET_ADDRSTRLEN];
    pim_inet4_dump("<dst?>", dst_addr, dst_str, sizeof(dst_str));
    pim_inet4_dump("<group?>", group_addr, group_str,
             sizeof(group_str));
    if (sent < 0) {
      zlog_warn(
        "Send IGMPv3 query failed due to %s on %s: group=%s msg_size=%zd: errno=%d: %s",
        dst_str, ifname, group_str, msg_size, errno,
        safe_strerror(errno));
    } else {
      zlog_warn(
        "Send IGMPv3 query failed due to %s on %s: group=%s msg_size=%zd: sent=%zd",
        dst_str, ifname, group_str, msg_size, sent);
    }
    return;
  }

  /*
    s_flag sanity test: s_flag must be set for general queries

    RFC 3376: 6.6.1. Timer Updates

    When a router sends or receives a query with a clear Suppress
    Router-Side Processing flag, it must update its timers to reflect
    the correct timeout values for the group or sources being queried.

    General queries don't trigger timer update.
  */
  if (!s_flag) {
    /* general query? */
    if (group_addr.s_addr == INADDR_ANY) {
      char dst_str[INET_ADDRSTRLEN];
      char group_str[INET_ADDRSTRLEN];
      pim_inet4_dump("<dst?>", dst_addr, dst_str,
               sizeof(dst_str));
      pim_inet4_dump("<group?>", group_addr, group_str,
               sizeof(group_str));
      zlog_warn(
        "%s: to %s on %s: group=%s sources=%d: s_flag is clear for general query!",
        __func__, dst_str, ifname, group_str,
        num_sources);
    }
  }
}

void igmp_v3_recv_query(struct gm_sock *igmp, const char *from_str,
      char *igmp_msg)
{
  struct interface *ifp;
  struct pim_interface *pim_ifp;
  struct in_addr group_addr;
  uint8_t resv_s_qrv = 0;
  uint8_t s_flag = 0;
  uint8_t qrv = 0;
  int i;

  memcpy(&group_addr, igmp_msg + 4, sizeof(struct in_addr));
  ifp = igmp->interface;
  pim_ifp = ifp->info;

  /*
   * RFC 3376: 4.1.6. QRV (Querier's Robustness Variable)
   *
   * Routers adopt the QRV value from the most recently received Query
   * as their own [Robustness Variable] value, unless that most
   * recently received QRV was zero, in which case the receivers use
   * the default [Robustness Variable] value specified in section 8.1
   * or a statically configured value.
   */
  resv_s_qrv = igmp_msg[8];
  qrv = 7 & resv_s_qrv;
  igmp->querier_robustness_variable =
    qrv ? qrv : pim_ifp->gm_default_robustness_variable;

  /*
   * RFC 3376: 4.1.7. QQIC (Querier's Query Interval Code)
   *
   * Multicast routers that are not the current querier adopt the QQI
   * value from the most recently received Query as their own [Query
   * Interval] value, unless that most recently received QQI was zero,
   * in which case the receiving routers use the default.
   */
  if (igmp->t_other_querier_timer) {
    /* other querier present */
    uint8_t qqic;
    uint16_t qqi;
    qqic = igmp_msg[9];
    qqi = igmp_msg_decode8to16(qqic);
    igmp->querier_query_interval =
      qqi ? qqi : pim_ifp->gm_default_query_interval;

    if (PIM_DEBUG_GM_TRACE) {
      char ifaddr_str[INET_ADDRSTRLEN];
      pim_inet4_dump("<ifaddr?>", igmp->ifaddr, ifaddr_str,
               sizeof(ifaddr_str));
      zlog_debug(
        "Querier %s new query interval is %s QQI=%u sec (recv QQIC=%02x from %s)",
        ifaddr_str,
        qqi ? "recv-non-default" : "default",
        igmp->querier_query_interval, qqic, from_str);
    }
  }

  /*
   * RFC 3376: 6.6.1. Timer Updates
   *
   * When a router sends or receives a query with a clear Suppress
   * Router-Side Processing flag, it must update its timers to reflect
   * the correct timeout values for the group or sources being queried.
   *
   * General queries don't trigger timer update.
   */
  s_flag = (1 << 3) & resv_s_qrv;

  if (!s_flag) {
    /* s_flag is clear */

    if (group_addr.s_addr == INADDR_ANY) {
      /* this is a general query */
      /* log that general query should have the s_flag set */
      zlog_warn(
        "General IGMP query v3 from %s on %s: Suppress Router-Side Processing flag is clear",
        from_str, ifp->name);
    } else {
      struct gm_group *group;

      /* this is a non-general query: perform timer updates */

      group = find_group_by_addr(igmp, group_addr);
      if (group) {
        int recv_num_sources = ntohs(*(
          uint16_t
            *)(igmp_msg
               + IGMP_V3_NUMSOURCES_OFFSET));

        /*
         * RFC 3376: 6.6.1. Timer Updates
         * Query Q(G,A): Source Timer for sources in A
         * are lowered to LMQT
         * Query Q(G): Group Timer is lowered to LMQT
         */
        if (recv_num_sources < 1) {
          /* Query Q(G): Group Timer is lowered to
           * LMQT */

          igmp_group_timer_lower_to_lmqt(group);
        } else {
          /* Query Q(G,A): Source Timer for
           * sources in A are lowered to LMQT */

          /* Scan sources in query and lower their
           * timers to LMQT */
          struct in_addr *sources =
            (struct in_addr
               *)(igmp_msg
                  + IGMP_V3_SOURCES_OFFSET);
          for (i = 0; i < recv_num_sources; ++i) {
            struct in_addr src_addr;
            struct gm_source *src;
            memcpy(&src_addr, sources + i,
                   sizeof(struct in_addr));
            src = igmp_find_source_by_addr(
              group, src_addr);
            if (src) {
              igmp_source_timer_lower_to_lmqt(
                src);
            }
          }
        }
      } else {
        char group_str[INET_ADDRSTRLEN];
        pim_inet4_dump("<group?>", group_addr,
                 group_str, sizeof(group_str));
        zlog_warn(
          "IGMP query v3 from %s on %s: could not find group %s for timer update",
          from_str, ifp->name, group_str);
      }
    }
  } /* s_flag is clear: timer updates */
}

static bool igmp_pkt_grp_addr_ok(struct interface *ifp, const char *from_str,
         struct in_addr grp, int rec_type)
{
  struct pim_interface *pim_ifp;
  struct in_addr grp_addr;

  pim_ifp = ifp->info;

  /* determine filtering status for group */
  if (pim_is_group_filtered(pim_ifp, &grp)) {
    if (PIM_DEBUG_GM_PACKETS) {
      zlog_debug(
        "Filtering IGMPv3 group record %pI4 from %s on %s per prefix-list %s",
        &grp.s_addr, from_str, ifp->name,
        pim_ifp->boundary_oil_plist);
    }
    return false;
  }

  /*
   * If we receive a igmp report with the group in 224.0.0.0/24
   * then we should ignore it
   */

  grp_addr.s_addr = ntohl(grp.s_addr);

  if (pim_is_group_224_0_0_0_24(grp_addr)) {
    if (PIM_DEBUG_GM_PACKETS) {
      zlog_debug(
        "Ignoring IGMPv3 group record %pI4 from %s on %s group range falls in 224.0.0.0/24",
        &grp.s_addr, from_str, ifp->name);
    }
    return false;
  }

  /*
   * RFC 4604
   * section 2.2.1
   * EXCLUDE mode does not apply to SSM addresses, and an SSM-aware router
   * will ignore MODE_IS_EXCLUDE and CHANGE_TO_EXCLUDE_MODE requests in
   * the SSM range.
   */
  if (pim_is_grp_ssm(pim_ifp->pim, grp)) {
    switch (rec_type) {
    case IGMP_GRP_REC_TYPE_MODE_IS_EXCLUDE:
    case IGMP_GRP_REC_TYPE_CHANGE_TO_EXCLUDE_MODE:
      if (PIM_DEBUG_GM_PACKETS) {
        zlog_debug(
          "Ignoring IGMPv3 group record %pI4 from %s on %s exclude mode in SSM range",
          &grp.s_addr, from_str, ifp->name);
      }
      return false;
    }
  }

  return true;
}

int igmp_v3_recv_report(struct gm_sock *igmp, struct in_addr from,
      const char *from_str, char *igmp_msg, int igmp_msg_len)
{
  int num_groups;
  uint8_t *group_record;
  uint8_t *report_pastend = (uint8_t *)igmp_msg + igmp_msg_len;
  struct interface *ifp = igmp->interface;
  struct pim_interface *pim_ifp = ifp->info;
  int i;

  if (igmp->mtrace_only)
    return 0;

  if (igmp_msg_len < IGMP_V3_MSG_MIN_SIZE) {
    zlog_warn(
      "Recv IGMP report v3 from %s on %s: size=%d shorter than minimum=%d",
      from_str, ifp->name, igmp_msg_len,
      IGMP_V3_MSG_MIN_SIZE);
    return -1;
  }

  if (igmp_validate_checksum(igmp_msg, igmp_msg_len) == -1) {
    zlog_warn(
      "Recv IGMP report v3 from %s on %s: checksum mismatch: received=%x computed=%x",
      from_str, ifp->name, recv_checksum, checksum);
#ifndef FUZZING
    return -1;
#endif
  }

  /* Collecting IGMP Rx stats */
  igmp->igmp_stats.report_v3++;

  if (pim_ifp->igmp_version == 2) {
    zlog_warn(
      "Received Version 3 packet but interface: %s is configured for version 2",
      ifp->name);
    return -1;
  }

  num_groups = ntohs(
    *(uint16_t *)(igmp_msg + IGMP_V3_REPORT_NUMGROUPS_OFFSET));
  if (num_groups < 1) {
    zlog_warn(
      "Recv IGMP report v3 from %s on %s: missing group records",
      from_str, ifp->name);
    return -1;
  }

  if (PIM_DEBUG_GM_PACKETS) {
    zlog_debug(
      "Recv IGMP report v3 from %s on %s: size=%d groups=%d",
      from_str, ifp->name, igmp_msg_len, num_groups);
  }

  group_record = (uint8_t *)igmp_msg + IGMP_V3_REPORT_GROUPPRECORD_OFFSET;

  /* Scan groups */
  for (i = 0; i < num_groups; ++i) {
    struct in_addr rec_group;
    uint8_t *sources;
    uint8_t *src;
    int rec_type;
    int rec_auxdatalen;
    int rec_num_sources;
    int j;

    if ((group_record + IGMP_V3_GROUP_RECORD_MIN_SIZE)
        > report_pastend) {
      zlog_warn(
        "Recv IGMP report v3 from %s on %s: group record beyond report end",
        from_str, ifp->name);
      return -1;
    }

    rec_type = group_record[IGMP_V3_GROUP_RECORD_TYPE_OFFSET];
    rec_auxdatalen =
      group_record[IGMP_V3_GROUP_RECORD_AUXDATALEN_OFFSET];
    rec_num_sources = ntohs(*(
      uint16_t *)(group_record
            + IGMP_V3_GROUP_RECORD_NUMSOURCES_OFFSET));

    memcpy(&rec_group,
           group_record + IGMP_V3_GROUP_RECORD_GROUP_OFFSET,
           sizeof(struct in_addr));

    if (PIM_DEBUG_GM_PACKETS) {
      zlog_debug(
        "    Recv IGMP report v3 from %s on %s: record=%d type=%d auxdatalen=%d sources=%d group=%pI4",
        from_str, ifp->name, i, rec_type,
        rec_auxdatalen, rec_num_sources,
        &rec_group);
    }

    /* Scan sources */

    sources = group_record + IGMP_V3_GROUP_RECORD_SOURCE_OFFSET;

    for (j = 0, src = sources; j < rec_num_sources; ++j, src += 4) {

      if ((src + 4) > report_pastend) {
        zlog_warn(
          "Recv IGMP report v3 from %s on %s: group source beyond report end",
          from_str, ifp->name);
        return -1;
      }

      if (PIM_DEBUG_GM_PACKETS) {
        char src_str[200];

        if (!inet_ntop(AF_INET, src, src_str,
                 sizeof(src_str)))
          snprintf(src_str, sizeof(src_str),
             "<source?>");

        zlog_debug(
          "        Recv IGMP report v3 from %s on %s: record=%d group=%pI4 source=%s",
          from_str, ifp->name, i,
          &rec_group, src_str);
      }
    } /* for (sources) */


    if (igmp_pkt_grp_addr_ok(ifp, from_str, rec_group, rec_type))
      switch (rec_type) {
      case IGMP_GRP_REC_TYPE_MODE_IS_INCLUDE:
        igmpv3_report_isin(igmp, from, rec_group,
               rec_num_sources,
               (struct in_addr *)sources);
        break;
      case IGMP_GRP_REC_TYPE_MODE_IS_EXCLUDE:
        igmpv3_report_isex(
          igmp, from, rec_group, rec_num_sources,
          (struct in_addr *)sources, 0);
        break;
      case IGMP_GRP_REC_TYPE_CHANGE_TO_INCLUDE_MODE:
        igmpv3_report_toin(igmp, from, rec_group,
               rec_num_sources,
               (struct in_addr *)sources);
        break;
      case IGMP_GRP_REC_TYPE_CHANGE_TO_EXCLUDE_MODE:
        igmpv3_report_toex(igmp, from, rec_group,
               rec_num_sources,
               (struct in_addr *)sources);
        break;
      case IGMP_GRP_REC_TYPE_ALLOW_NEW_SOURCES:
        igmpv3_report_allow(igmp, from, rec_group,
                rec_num_sources,
                (struct in_addr *)sources);
        break;
      case IGMP_GRP_REC_TYPE_BLOCK_OLD_SOURCES:
        igmpv3_report_block(igmp, from, rec_group,
                rec_num_sources,
                (struct in_addr *)sources);
        break;
      default:
        zlog_warn(
          "Recv IGMP report v3 from %s on %s: unknown record type: type=%d",
          from_str, ifp->name, rec_type);
      }

    group_record +=
      8 + (rec_num_sources << 2) + (rec_auxdatalen << 2);

  } /* for (group records) */

  return 0;
}

Coverage Report

Created: 2025-12-12 06:43