Support IPv6_MULTICAST_IF

Of the 11 java runtime tests that were anticipating this socket option, 8 now
pass. Of the 3 that still fail, 1 now needs IPV6_MULTICAST_HOPS. The other 2
fail due to an unknown reason: they fail with runc too.

PiperOrigin-RevId: 803266836

Author: shailend-g

pkg/sentry/socket/netstack/netstack.go

@@ -1627,6 +1627,14 @@ func getSockOptIPv6(t *kernel.Task, s socket.Socket, ep commonEndpoint, name int
 			return nil, err
 		}
 		return &ret, nil
+
+	case linux.IPV6_MULTICAST_IF:
+		v, err := ep.GetSockOptInt(tcpip.IPv6MulticastInterfaceOption)
+		if err != nil {
+			return nil, syserr.TranslateNetstackError(err)
+		}
+		vP := primitive.Int32(v)
+		return &vP, nil
 	}
 	return nil, syserr.ErrProtocolNotAvailable
 }
@@ -2479,6 +2487,14 @@ func setSockOptIPv6(t *kernel.Task, s socket.Socket, ep commonEndpoint, name int
 			MulticastAddr: tcpip.AddrFrom16(req.MulticastAddr),
 		}))
 
+	case linux.IPV6_MULTICAST_IF:
+		if len(optVal) < sizeOfInt32 {
+			return syserr.ErrInvalidArgument
+		}
+
+		v := int32(hostarch.ByteOrder.Uint32(optVal))
+		return syserr.TranslateNetstackError(ep.SetSockOptInt(tcpip.IPv6MulticastInterfaceOption, int(v)))
+
 	case linux.IPV6_IPSEC_POLICY,
 		linux.IPV6_JOIN_ANYCAST,
 		linux.IPV6_LEAVE_ANYCAST,
@@ -2595,7 +2611,6 @@ func setSockOptIPv6(t *kernel.Task, s socket.Socket, ep commonEndpoint, name int
 		linux.IPV6_MTU_DISCOVER,
 		linux.IPV6_FLOWINFO_SEND,
 		linux.IPV6_ADDR_PREFERENCES,
-		linux.IPV6_MULTICAST_IF,
 		linux.IPV6_UNICAST_IF,
 		linux.IPV6_ADDRFORM,
 		linux.IPV6_2292PKTINFO,

pkg/tcpip/tcpip.go

@@ -49,10 +49,8 @@ import (
 
 // Using the header package here would cause an import cycle.
 const (
-	ipv4AddressSize    = 4
-	ipv4ProtocolNumber = 0x0800
-	ipv6AddressSize    = 16
-	ipv6ProtocolNumber = 0x86dd
+	ipv4AddressSize = 4
+	ipv6AddressSize = 16
 )
 
 const (
@@ -1011,6 +1009,10 @@ const (
 	// PacketMMapReserveOption is used to set the packet mmap reserved space
 	// between the aligned header and the payload.
 	PacketMMapReserveOption
+
+	// IPv6MulticastInterfaceOption is used to set/get the NIC used for
+	// IPv6 multicast Tx.
+	IPv6MulticastInterfaceOption
 )
 
 const (

pkg/tcpip/tests/integration/BUILD

@@ -128,7 +128,6 @@ go_test(
         "//pkg/tcpip/tests/utils",
         "//pkg/tcpip/testutil",
         "//pkg/tcpip/transport/icmp",
-        "//pkg/tcpip/transport/raw",
         "//pkg/tcpip/transport/udp",
         "//pkg/waiter",
         "@com_github_google_go_cmp//cmp:go_default_library",

pkg/tcpip/tests/integration/multicast_broadcast_test.go

@@ -33,7 +33,6 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/tests/utils"
 	"gvisor.dev/gvisor/pkg/tcpip/testutil"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/raw"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
 	"gvisor.dev/gvisor/pkg/waiter"
 )
@@ -779,54 +778,3 @@ func TestAddMembershipInterfacePrecedence(t *testing.T) {
 		t.Fatalf("ep.SetSockOpt(&%#v): %s", addOpt, err)
 	}
 }
-
-func TestMismatchedMulticastAddressAndProtocol(t *testing.T) {
-	const nicID = 1
-	// MulticastAddr is IPv4, but proto is IPv6.
-	multicastAddr := tcpip.AddrFromSlice([]byte("\xe0\x01\x02\x03"))
-	s := stack.New(stack.Options{
-		NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
-		TransportProtocols: []stack.TransportProtocolFactory{icmp.NewProtocol6},
-		RawFactory:         raw.EndpointFactory{},
-	})
-	e := channel.New(0, defaultMTU, "")
-	defer e.Close()
-	if err := s.CreateNIC(nicID, e); err != nil {
-		t.Fatalf("CreateNIC(%d, _): %s", nicID, err)
-	}
-	protoAddr := tcpip.ProtocolAddress{Protocol: header.IPv4ProtocolNumber, AddressWithPrefix: utils.Ipv4Addr}
-	if err := s.AddProtocolAddress(nicID, protoAddr, stack.AddressProperties{}); err != nil {
-		t.Fatalf("AddProtocolAddress(%d, %+v, {}): %s", nicID, protoAddr, err)
-	}
-
-	var wq waiter.Queue
-	ep, err := s.NewRawEndpoint(header.ICMPv6ProtocolNumber, header.IPv6ProtocolNumber, &wq, false)
-	if err != nil {
-		t.Fatalf("NewEndpoint(%d, %d, _): %s", udp.ProtocolNumber, header.IPv6ProtocolNumber, err)
-	}
-	defer ep.Close()
-
-	bindAddr := tcpip.FullAddress{Port: utils.LocalPort}
-	if err := ep.Bind(bindAddr); err != nil {
-		t.Fatalf("ep.Bind(%#v): %s", bindAddr, err)
-	}
-
-	memOpt := tcpip.MembershipOption{
-		MulticastAddr: multicastAddr,
-		NIC:           0,
-		InterfaceAddr: utils.Ipv4Addr.Address,
-	}
-
-	// Add/remove membership should succeed when the interface index is specified,
-	// even if a bad interface address is specified.
-	addOpt := tcpip.AddMembershipOption(memOpt)
-	expErr := &tcpip.ErrInvalidOptionValue{}
-	if err := ep.SetSockOpt(&addOpt); err != expErr {
-		t.Fatalf("ep.SetSockOpt(&%#v): want %q, got %q", addOpt, expErr, err)
-	}
-
-	removeOpt := tcpip.RemoveMembershipOption(memOpt)
-	if err := ep.SetSockOpt(&removeOpt); err != expErr {
-		t.Fatalf("ep.SetSockOpt(&%#v): want %q, got %q", addOpt, expErr, err)
-	}
-}

pkg/tcpip/transport/internal/network/endpoint.go

@@ -66,10 +66,11 @@ type Endpoint struct {
 	// TODO(https://gvisor.dev/issue/6389): Use different fields for IPv4/IPv6.
 	// +checklocks:mu
 	multicastAddr tcpip.Address
-	// TODO(https://gvisor.dev/issue/6389): Use different fields for IPv4/IPv6.
 	// +checklocks:mu
 	multicastNICID tcpip.NICID
 	// +checklocks:mu
+	ipv6MulticastNICID tcpip.NICID
+	// +checklocks:mu
 	ipv4TOS uint8
 	// +checklocks:mu
 	ipv6TClass uint8
@@ -181,7 +182,11 @@ func (e *Endpoint) Close() {
 	}
 
 	for mem := range e.multicastMemberships {
-		e.stack.LeaveGroup(e.netProto, mem.nicID, mem.multicastAddr)
+		proto, err := e.multicastNetProto(mem.multicastAddr)
+		if err != nil {
+			panic("non multicast address in an existing membership")
+		}
+		e.stack.LeaveGroup(proto, mem.nicID, mem.multicastAddr)
 	}
 	e.multicastMemberships = nil
 
@@ -613,14 +618,17 @@ func (e *Endpoint) connectRouteRLocked(nicID tcpip.NICID, localAddr tcpip.Addres
 			localAddr = tcpip.Address{}
 		}
 
-		if header.IsV4MulticastAddress(addr.Addr) || header.IsV6MulticastAddress(addr.Addr) {
+		if header.IsV4MulticastAddress(addr.Addr) {
 			if nicID == 0 {
 				nicID = e.multicastNICID
 			}
 			if localAddr == (tcpip.Address{}) && nicID == 0 {
 				localAddr = e.multicastAddr
 			}
 		}
+		if header.IsV6MulticastAddress(addr.Addr) && nicID == 0 {
+			nicID = e.ipv6MulticastNICID
+		}
 	}
 
 	// Find a route to the desired destination.
@@ -865,6 +873,18 @@ func (e *Endpoint) SetSockOptInt(opt tcpip.SockOptInt, v int) tcpip.Error {
 		e.mu.Lock()
 		e.ipv6TClass = uint8(v)
 		e.mu.Unlock()
+
+	case tcpip.IPv6MulticastInterfaceOption:
+		if v != 0 && !e.stack.CheckNIC(tcpip.NICID(v)) {
+			return &tcpip.ErrUnknownNICID{}
+		}
+		e.mu.Lock()
+		defer e.mu.Unlock()
+		nic := tcpip.NICID(v)
+		if info := e.Info(); info.BindNICID != 0 && info.BindNICID != nic {
+			return &tcpip.ErrInvalidEndpointState{}
+		}
+		e.ipv6MulticastNICID = nic
 	}
 
 	return nil
@@ -907,11 +927,30 @@ func (e *Endpoint) GetSockOptInt(opt tcpip.SockOptInt) (int, tcpip.Error) {
 		e.mu.RUnlock()
 		return v, nil
 
+	case tcpip.IPv6MulticastInterfaceOption:
+		e.mu.RLock()
+		v := int(e.ipv6MulticastNICID)
+		e.mu.RUnlock()
+		return v, nil
+
 	default:
 		return -1, &tcpip.ErrUnknownProtocolOption{}
 	}
 }
 
+// multicastNetProto returns the network protocol of a given multicast address.
+// Returns an error if the address is not a multicast address.
+func (e *Endpoint) multicastNetProto(addr tcpip.Address) (tcpip.NetworkProtocolNumber, tcpip.Error) {
+	switch {
+	case header.IsV4MulticastAddress(addr):
+		return header.IPv4ProtocolNumber, nil
+	case header.IsV6MulticastAddress(addr):
+		return header.IPv6ProtocolNumber, nil
+	default:
+		return 0, &tcpip.ErrInvalidOptionValue{}
+	}
+}
+
 // SetSockOpt sets the socket option.
 func (e *Endpoint) SetSockOpt(opt tcpip.SettableSocketOption) tcpip.Error {
 	switch v := opt.(type) {
@@ -952,21 +991,23 @@ func (e *Endpoint) SetSockOpt(opt tcpip.SettableSocketOption) tcpip.Error {
 		e.multicastAddr = addr
 
 	case *tcpip.AddMembershipOption:
-		if !(header.IsV4MulticastAddress(v.MulticastAddr) && e.netProto == header.IPv4ProtocolNumber) && !(header.IsV6MulticastAddress(v.MulticastAddr) && e.netProto == header.IPv6ProtocolNumber) {
-			return &tcpip.ErrInvalidOptionValue{}
+		// Allowing IP_ADD_MEMBERSHIP on an ipv6 socket matches Linux behavior:
+		// https://github.com/torvalds/linux/blob/cec1e6e5d1a/net/ipv6/ipv6_sockglue.c#L964
+		proto, err := e.multicastNetProto(v.MulticastAddr)
+		if err != nil {
+			return err
 		}
 
 		nicID := v.NIC
-
 		if v.InterfaceAddr.Unspecified() {
 			if nicID == 0 {
-				if r, err := e.stack.FindRoute(0, tcpip.Address{}, v.MulticastAddr, e.netProto, false /* multicastLoop */); err == nil {
+				if r, err := e.stack.FindRoute(0, tcpip.Address{}, v.MulticastAddr, proto, false /* multicastLoop */); err == nil {
 					nicID = r.NICID()
 					r.Release()
 				}
 			}
 		} else {
-			nicID = e.stack.CheckLocalAddress(nicID, e.netProto, v.InterfaceAddr)
+			nicID = e.stack.CheckLocalAddress(nicID, proto, v.InterfaceAddr)
 		}
 		if nicID == 0 {
 			return &tcpip.ErrUnknownDevice{}
@@ -981,27 +1022,28 @@ func (e *Endpoint) SetSockOpt(opt tcpip.SettableSocketOption) tcpip.Error {
 			return &tcpip.ErrPortInUse{}
 		}
 
-		if err := e.stack.JoinGroup(e.netProto, nicID, v.MulticastAddr); err != nil {
+		if err := e.stack.JoinGroup(proto, nicID, v.MulticastAddr); err != nil {
 			return err
 		}
 
 		e.multicastMemberships[memToInsert] = struct{}{}
 
 	case *tcpip.RemoveMembershipOption:
-		if !(header.IsV4MulticastAddress(v.MulticastAddr) && e.netProto == header.IPv4ProtocolNumber) && !(header.IsV6MulticastAddress(v.MulticastAddr) && e.netProto == header.IPv6ProtocolNumber) {
-			return &tcpip.ErrInvalidOptionValue{}
+		proto, err := e.multicastNetProto(v.MulticastAddr)
+		if err != nil {
+			return err
 		}
 
 		nicID := v.NIC
 		if v.InterfaceAddr.Unspecified() {
 			if nicID == 0 {
-				if r, err := e.stack.FindRoute(0, tcpip.Address{}, v.MulticastAddr, e.netProto, false /* multicastLoop */); err == nil {
+				if r, err := e.stack.FindRoute(0, tcpip.Address{}, v.MulticastAddr, proto, false /* multicastLoop */); err == nil {
 					nicID = r.NICID()
 					r.Release()
 				}
 			}
 		} else {
-			nicID = e.stack.CheckLocalAddress(nicID, e.netProto, v.InterfaceAddr)
+			nicID = e.stack.CheckLocalAddress(nicID, proto, v.InterfaceAddr)
 		}
 		if nicID == 0 {
 			return &tcpip.ErrUnknownDevice{}
@@ -1016,7 +1058,7 @@ func (e *Endpoint) SetSockOpt(opt tcpip.SettableSocketOption) tcpip.Error {
 			return &tcpip.ErrBadLocalAddress{}
 		}
 
-		if err := e.stack.LeaveGroup(e.netProto, nicID, v.MulticastAddr); err != nil {
+		if err := e.stack.LeaveGroup(proto, nicID, v.MulticastAddr); err != nil {
 			return err
 		}
 

pkg/tcpip/transport/internal/network/endpoint_state.go

@@ -29,8 +29,12 @@ func (e *Endpoint) Resume(s *stack.Stack) error {
 
 	e.stack = s
 	for m := range e.multicastMemberships {
-		if err := e.stack.JoinGroup(e.netProto, m.nicID, m.multicastAddr); err != nil {
-			return fmt.Errorf("e.stack.JoinGroup(%d, %d, %s): %s", e.netProto, m.nicID, m.multicastAddr, err)
+		proto, err := e.multicastNetProto(m.multicastAddr)
+		if err != nil {
+			return fmt.Errorf("non multicast address in an existing membership during Resume: %s", err)
+		}
+		if err := e.stack.JoinGroup(proto, m.nicID, m.multicastAddr); err != nil {
+			return fmt.Errorf("e.stack.JoinGroup(%d, %d, %s): %s", proto, m.nicID, m.multicastAddr, err)
 		}
 	}
 

test/runtimes/exclude/java21.csv

@@ -27,20 +27,16 @@ java/lang/management/ThreadMXBean/ThreadMXBeanStateTest.java,,Broken test
 java/lang/reflect/exeCallerAccessTest/CallerAccessTest.java,,Broken test
 java/net/DatagramSocket/AddressNotSet.java,,
 java/net/DatagramSocket/SetGetReceiveBufferSize.java,b/180507650,
-java/net/MulticastSocket/B6425815.java,b/126900872,Need support for IPV6_MULTICAST_IF
-java/net/MulticastSocket/B6427403.java,b/126900872,Need support for IPV6_MULTICAST_IF
-java/net/MulticastSocket/IPMulticastIF.java,b/126900872,Need support for IPV6_MULTICAST_IF
+java/net/MulticastSocket/B6425815.java,b/446951345,Need support for IPV6_MULTICAST_HOPS
 java/net/MulticastSocket/MulticastTTL.java,,
-java/net/MulticastSocket/NetworkInterfaceEmptyGetInetAddressesTest.java,b/126900872,Need support for IPV6_MULTICAST_IF
-java/net/MulticastSocket/NoLoopbackPackets.java,b/126900872,Need support for IPV6_MULTICAST_IF
-java/net/MulticastSocket/NoSetNetworkInterface.java,b/126900872,Need support for IPV6_MULTICAST_IF
+java/net/MulticastSocket/NoLoopbackPackets.java,b/446928871,Test fails with runc too
 java/net/MulticastSocket/Promiscuous.java,,
 java/net/MulticastSocket/SendPortZero.java,,
 java/net/MulticastSocket/SetLoopbackMode.java,,
 java/net/MulticastSocket/SetLoopbackModeIPv4.java,,
 java/net/MulticastSocket/SetLoopbackOption.java,,
 java/net/MulticastSocket/SetTTLAndGetTTL.java,,
-java/net/MulticastSocket/Test.java,b/126900872,Need support for IPV6_MULTICAST_IF
+java/net/MulticastSocket/Test.java,b/446928871,Test fails with runc too
 java/net/MulticastSocket/TestDefaults.java,,
 java/net/MulticastSocket/TimeToLive.java,,
 java/net/NetworkInterface/NetworkInterfaceStreamTest.java,,
@@ -82,10 +78,6 @@ jdk/jfr/event/runtime/TestResidentSetSizeEvent.java,,
 jdk/jfr/jvm/TestWaste.java,,Broken test
 jdk/net/ExtendedSocketOption/DontFragmentTest.java,,
 jni/nullCaller/NullCallerTest.java,,Broken test
-sun/management/jdp/JdpDefaultsTest.java,b/126900872,Need support for IPV6_MULTICAST_IF
-sun/management/jdp/JdpJmxRemoteDynamicPortTest.java,b/126900872,Need support for IPV6_MULTICAST_IF
-sun/management/jdp/JdpOffTest.java,b/126900872,Need support for IPV6_MULTICAST_IF
-sun/management/jdp/JdpSpecificAddressTest.java,b/126900872,Need support for IPV6_MULTICAST_IF
 sun/management/jmxremote/bootstrap/CustomLauncherTest.java,,Broken test
 sun/management/jmxremote/bootstrap/JvmstatCountersTest.java,,Broken test
 sun/management/jmxremote/bootstrap/LocalManagementTest.java,,Broken test

test/syscalls/BUILD

@@ -810,6 +810,12 @@ syscall_test(
     test = "//test/syscalls/linux:socket_ipv4_udp_unbound_external_networking_test",
 )
 
+syscall_test(
+    # TODO(b/446206378): TestJoinLeaveMulticast fails with add_hostinet.
+    netstack_sr = True,
+    test = "//test/syscalls/linux:socket_ipv6_udp_unbound_external_networking_test",
+)
+
 syscall_test(
     size = "large",
     add_hostinet = True,

test/syscalls/linux/BUILD

@@ -2896,7 +2896,13 @@ cc_library(
         "socket_ipv6_udp_unbound_external_networking.h",
     ],
     deps = select_gtest() + [
+        ":ip_socket_test_util",
         ":socket_ip_udp_unbound_external_networking",
+        "//test/util:file_descriptor",
+        "//test/util:posix_error",
+        "//test/util:socket_util",
+        "//test/util:test_util",
+        "@com_google_absl//absl/cleanup",
     ],
     alwayslink = 1,
 )