Adapt r197136 to IPv6 stack:

  Comment some flawed assumptions in in6p_join_group() about
  mixing SSM full-state and delta-based APIs.

MFC after:	1 day

1 files changed, 21 insertions, 2 deletions

diff --git a/sys/netinet6/in6_mcast.c b/sys/netinet6/in6_mcast.c
index 782ea47..1438c32 100644
--- a/sys/netinet6/in6_mcast.c
+++ b/sys/netinet6/in6_mcast.c
@@ -1814,6 +1814,7 @@ in6p_join_group(struct inpcb *inp, struct sockopt *sopt)
 
 	ifp = NULL;
 	imf = NULL;
+	lims = NULL;
 	error = 0;
 	is_new = 0;
 
@@ -1934,9 +1935,25 @@ in6p_join_group(struct inpcb *inp, struct sockopt *sopt)
 				error = EINVAL;
 				goto out_in6p_locked;
 			}
-			/* Throw out duplicates. */
+			/*
+			 * Throw out duplicates.
+			 *
+			 * XXX FIXME: This makes a naive assumption that
+			 * even if entries exist for *ssa in this imf,
+			 * they will be rejected as dupes, even if they
+			 * are not valid in the current mode (in-mode).
+			 *
+			 * in6_msource is transactioned just as for anything
+			 * else in SSM -- but note naive use of in6m_graft()
+			 * below for allocating new filter entries.
+			 *
+			 * This is only an issue if someone mixes the
+			 * full-state SSM API with the delta-based API,
+			 * which is discouraged in the relevant RFCs.
+			 */
 			lims = im6o_match_source(imo, idx, &ssa->sa);
-			if (lims != NULL) {
+			if (lims != NULL /*&&
+			    lims->im6sl_st[1] == MCAST_INCLUDE*/) {
 				error = EADDRNOTAVAIL;
 				goto out_in6p_locked;
 			}
@@ -1991,6 +2008,8 @@ in6p_join_group(struct inpcb *inp, struct sockopt *sopt)
 	 *
 	 * Note: Grafting of exclusive mode filters doesn't happen
 	 * in this path.
+	 * XXX: Should check for non-NULL lims (node exists but may
+	 * not be in-mode) for interop with full-state API.
 	 */
 	if (ssa->ss.ss_family != AF_UNSPEC) {
 		/* Membership starts in IN mode */