Support IPv6_MULTICAST_IF

Of the 11 java runtime tests that were anticipating this socket option, 8 now
pass. Of the 3 that still fail, 1 now needs IPV6_MULTICAST_HOPS. The other 2
fail due to an unknown reason: they fail with runc too.

PiperOrigin-RevId: 813839126

Author: shailend-g

pkg/sentry/socket/netstack/netstack.go

@@ -1627,6 +1627,14 @@ func getSockOptIPv6(t *kernel.Task, s socket.Socket, ep commonEndpoint, name int
 			return nil, err
 		}
 		return &ret, nil
+
+	case linux.IPV6_MULTICAST_IF:
+		v, err := ep.GetSockOptInt(tcpip.IPv6MulticastInterfaceOption)
+		if err != nil {
+			return nil, syserr.TranslateNetstackError(err)
+		}
+		vP := primitive.Int32(v)
+		return &vP, nil
 	}
 	return nil, syserr.ErrProtocolNotAvailable
 }
@@ -2479,6 +2487,14 @@ func setSockOptIPv6(t *kernel.Task, s socket.Socket, ep commonEndpoint, name int
 			MulticastAddr: tcpip.AddrFrom16(req.MulticastAddr),
 		}))
 
+	case linux.IPV6_MULTICAST_IF:
+		if len(optVal) < sizeOfInt32 {
+			return syserr.ErrInvalidArgument
+		}
+
+		v := int32(hostarch.ByteOrder.Uint32(optVal))
+		return syserr.TranslateNetstackError(ep.SetSockOptInt(tcpip.IPv6MulticastInterfaceOption, int(v)))
+
 	case linux.IPV6_IPSEC_POLICY,
 		linux.IPV6_JOIN_ANYCAST,
 		linux.IPV6_LEAVE_ANYCAST,
@@ -2595,7 +2611,6 @@ func setSockOptIPv6(t *kernel.Task, s socket.Socket, ep commonEndpoint, name int
 		linux.IPV6_MTU_DISCOVER,
 		linux.IPV6_FLOWINFO_SEND,
 		linux.IPV6_ADDR_PREFERENCES,
-		linux.IPV6_MULTICAST_IF,
 		linux.IPV6_UNICAST_IF,
 		linux.IPV6_ADDRFORM,
 		linux.IPV6_2292PKTINFO,

pkg/tcpip/tcpip.go

@@ -1009,6 +1009,10 @@ const (
 	// PacketMMapReserveOption is used to set the packet mmap reserved space
 	// between the aligned header and the payload.
 	PacketMMapReserveOption
+
+	// IPv6MulticastInterfaceOption is used to set/get the NIC used for
+	// IPv6 multicast Tx.
+	IPv6MulticastInterfaceOption
 )
 
 const (

pkg/tcpip/transport/internal/network/endpoint.go

@@ -66,10 +66,11 @@ type Endpoint struct {
 	// TODO(https://gvisor.dev/issue/6389): Use different fields for IPv4/IPv6.
 	// +checklocks:mu
 	multicastAddr tcpip.Address
-	// TODO(https://gvisor.dev/issue/6389): Use different fields for IPv4/IPv6.
 	// +checklocks:mu
 	multicastNICID tcpip.NICID
 	// +checklocks:mu
+	ipv6MulticastNICID tcpip.NICID
+	// +checklocks:mu
 	ipv4TOS uint8
 	// +checklocks:mu
 	ipv6TClass uint8
@@ -617,14 +618,17 @@ func (e *Endpoint) connectRouteRLocked(nicID tcpip.NICID, localAddr tcpip.Addres
 			localAddr = tcpip.Address{}
 		}
 
-		if header.IsV4MulticastAddress(addr.Addr) || header.IsV6MulticastAddress(addr.Addr) {
+		if header.IsV4MulticastAddress(addr.Addr) {
 			if nicID == 0 {
 				nicID = e.multicastNICID
 			}
 			if localAddr == (tcpip.Address{}) && nicID == 0 {
 				localAddr = e.multicastAddr
 			}
 		}
+		if header.IsV6MulticastAddress(addr.Addr) && nicID == 0 {
+			nicID = e.ipv6MulticastNICID
+		}
 	}
 
 	// Find a route to the desired destination.
@@ -869,6 +873,18 @@ func (e *Endpoint) SetSockOptInt(opt tcpip.SockOptInt, v int) tcpip.Error {
 		e.mu.Lock()
 		e.ipv6TClass = uint8(v)
 		e.mu.Unlock()
+
+	case tcpip.IPv6MulticastInterfaceOption:
+		if v != 0 && !e.stack.CheckNIC(tcpip.NICID(v)) {
+			return &tcpip.ErrUnknownNICID{}
+		}
+		e.mu.Lock()
+		defer e.mu.Unlock()
+		nic := tcpip.NICID(v)
+		if info := e.Info(); info.BindNICID != 0 && info.BindNICID != nic {
+			return &tcpip.ErrInvalidEndpointState{}
+		}
+		e.ipv6MulticastNICID = nic
 	}
 
 	return nil
@@ -911,6 +927,12 @@ func (e *Endpoint) GetSockOptInt(opt tcpip.SockOptInt) (int, tcpip.Error) {
 		e.mu.RUnlock()
 		return v, nil
 
+	case tcpip.IPv6MulticastInterfaceOption:
+		e.mu.RLock()
+		v := int(e.ipv6MulticastNICID)
+		e.mu.RUnlock()
+		return v, nil
+
 	default:
 		return -1, &tcpip.ErrUnknownProtocolOption{}
 	}

test/runtimes/exclude/java21.csv

@@ -27,20 +27,16 @@ java/lang/management/ThreadMXBean/ThreadMXBeanStateTest.java,,Broken test
 java/lang/reflect/exeCallerAccessTest/CallerAccessTest.java,,Broken test
 java/net/DatagramSocket/AddressNotSet.java,,
 java/net/DatagramSocket/SetGetReceiveBufferSize.java,b/180507650,
-java/net/MulticastSocket/B6425815.java,b/126900872,Need support for IPV6_MULTICAST_IF
-java/net/MulticastSocket/B6427403.java,b/126900872,Need support for IPV6_MULTICAST_IF
-java/net/MulticastSocket/IPMulticastIF.java,b/126900872,Need support for IPV6_MULTICAST_IF
+java/net/MulticastSocket/B6425815.java,b/446951345,Need support for IPV6_MULTICAST_HOPS
 java/net/MulticastSocket/MulticastTTL.java,,
-java/net/MulticastSocket/NetworkInterfaceEmptyGetInetAddressesTest.java,b/126900872,Need support for IPV6_MULTICAST_IF
-java/net/MulticastSocket/NoLoopbackPackets.java,b/126900872,Need support for IPV6_MULTICAST_IF
-java/net/MulticastSocket/NoSetNetworkInterface.java,b/126900872,Need support for IPV6_MULTICAST_IF
+java/net/MulticastSocket/NoLoopbackPackets.java,b/446928871,Test fails with runc too
 java/net/MulticastSocket/Promiscuous.java,,
 java/net/MulticastSocket/SendPortZero.java,,
 java/net/MulticastSocket/SetLoopbackMode.java,,
 java/net/MulticastSocket/SetLoopbackModeIPv4.java,,
 java/net/MulticastSocket/SetLoopbackOption.java,,
 java/net/MulticastSocket/SetTTLAndGetTTL.java,,
-java/net/MulticastSocket/Test.java,b/126900872,Need support for IPV6_MULTICAST_IF
+java/net/MulticastSocket/Test.java,b/446928871,Test fails with runc too
 java/net/MulticastSocket/TestDefaults.java,,
 java/net/MulticastSocket/TimeToLive.java,,
 java/net/NetworkInterface/NetworkInterfaceStreamTest.java,,
@@ -82,10 +78,6 @@ jdk/jfr/event/runtime/TestResidentSetSizeEvent.java,,
 jdk/jfr/jvm/TestWaste.java,,Broken test
 jdk/net/ExtendedSocketOption/DontFragmentTest.java,,
 jni/nullCaller/NullCallerTest.java,,Broken test
-sun/management/jdp/JdpDefaultsTest.java,b/126900872,Need support for IPV6_MULTICAST_IF
-sun/management/jdp/JdpJmxRemoteDynamicPortTest.java,b/126900872,Need support for IPV6_MULTICAST_IF
-sun/management/jdp/JdpOffTest.java,b/126900872,Need support for IPV6_MULTICAST_IF
-sun/management/jdp/JdpSpecificAddressTest.java,b/126900872,Need support for IPV6_MULTICAST_IF
 sun/management/jmxremote/bootstrap/CustomLauncherTest.java,,Broken test
 sun/management/jmxremote/bootstrap/JvmstatCountersTest.java,,Broken test
 sun/management/jmxremote/bootstrap/LocalManagementTest.java,,Broken test

test/syscalls/linux/socket_ipv6_udp_unbound_external_networking.cc

@@ -211,5 +211,96 @@ TEST_P(IPv6UDPUnboundExternalNetworkingSocketTest, AddV4MembershipToV6Socket) {
               SyscallFailsWithErrno(ENOPROTOOPT));
 }
 
+TEST_P(IPv6UDPUnboundExternalNetworkingSocketTest, TestIPv6MulticastIf) {
+  auto sock = ASSERT_NO_ERRNO_AND_VALUE(NewSocket());
+
+  // Bind sock to the ethernet interface.
+  struct sockaddr_in6 bind_addr = eth_if_addr();
+  ASSERT_THAT(bind(sock->get(), AsSockAddr(&bind_addr), sizeof(bind_addr)),
+              SyscallSucceeds());
+
+  int mcast_idx;
+  socklen_t slen = sizeof(mcast_idx);
+  ASSERT_THAT(getsockopt(sock->get(), IPPROTO_IPV6, IPV6_MULTICAST_IF,
+                         &mcast_idx, &slen),
+              SyscallSucceeds());
+  EXPECT_EQ(mcast_idx, 0);  // Default is 0.
+
+  // Setting its multicast interface to the loopback interface should fail.
+  mcast_idx = lo_if_idx();
+  EXPECT_THAT(setsockopt(sock->get(), IPPROTO_IPV6, IPV6_MULTICAST_IF,
+                         &mcast_idx, slen),
+              SyscallFailsWithErrno(EINVAL));
+
+  // But setting it to the ethernet interface should succeed.
+  mcast_idx = eth_if_idx();
+  EXPECT_THAT(setsockopt(sock->get(), IPPROTO_IPV6, IPV6_MULTICAST_IF,
+                         &mcast_idx, slen),
+              SyscallSucceeds());
+  ASSERT_THAT(getsockopt(sock->get(), IPPROTO_IPV6, IPV6_MULTICAST_IF,
+                         &mcast_idx, &slen),
+              SyscallSucceeds());
+  EXPECT_EQ(mcast_idx, eth_if_idx());
+}
+
+TEST_P(IPv6UDPUnboundExternalNetworkingSocketTest,
+       TestIPv6MulticastIfSendAndRecv) {
+  auto recv = ASSERT_NO_ERRNO_AND_VALUE(NewSocket());
+  auto send = ASSERT_NO_ERRNO_AND_VALUE(NewSocket());
+
+  // Bind recv to ::.
+  TestAddress recv_addr = V6Any();
+  ASSERT_THAT(
+      bind(recv->get(), AsSockAddr(&recv_addr.addr), recv_addr.addr_len),
+      SyscallSucceeds());
+  socklen_t recv_addr_len = recv_addr.addr_len;
+  // Retrieve its assigned port.
+  ASSERT_THAT(
+      getsockname(recv->get(), AsSockAddr(&recv_addr.addr), &recv_addr_len),
+      SyscallSucceeds());
+
+  // And have it join a multicast group on the loopback interface.
+  TestAddress multicast_addr = V6Multicast();
+  ipv6_mreq group_req = {
+      .ipv6mr_multiaddr =
+          reinterpret_cast<sockaddr_in6*>(&multicast_addr.addr)->sin6_addr,
+      .ipv6mr_interface =
+          static_cast<decltype(ipv6_mreq::ipv6mr_interface)>(lo_if_idx()),
+  };
+  ASSERT_THAT(setsockopt(recv->get(), IPPROTO_IPV6, IPV6_ADD_MEMBERSHIP,
+                         &group_req, sizeof(group_req)),
+              SyscallSucceeds());
+
+  // Set send's multicast interface to the loopback interface. It is still
+  // unbound.
+  int mcast_idx = lo_if_idx();
+  ASSERT_THAT(setsockopt(send->get(), IPPROTO_IPV6, IPV6_MULTICAST_IF,
+                         &mcast_idx, sizeof(mcast_idx)),
+              SyscallSucceeds());
+
+  // Send a multicast packet.
+  auto send_addr = multicast_addr;
+  reinterpret_cast<sockaddr_in6*>(&send_addr.addr)->sin6_port =
+      reinterpret_cast<sockaddr_in6*>(&recv_addr.addr)->sin6_port;
+  char send_buf[200];
+  RandomizeBuffer(send_buf, sizeof(send_buf));
+  ASSERT_THAT(
+      RetryEINTR(sendto)(send->get(), send_buf, sizeof(send_buf), 0,
+                         AsSockAddr(&send_addr.addr), send_addr.addr_len),
+      SyscallSucceedsWithValue(sizeof(send_buf)));
+
+  // Check that we received the multicast packet.
+  char recv_buf[sizeof(send_buf)] = {};
+  ASSERT_THAT(
+      RecvTimeout(recv->get(), recv_buf, sizeof(recv_buf), 1 /*timeout*/),
+      IsPosixErrorOkAndHolds(sizeof(recv_buf)));
+  EXPECT_EQ(0, memcmp(send_buf, recv_buf, sizeof(send_buf)));
+
+  // Drop recv from the multicast group.
+  ASSERT_THAT(setsockopt(recv->get(), IPPROTO_IPV6, IPV6_DROP_MEMBERSHIP,
+                         &group_req, sizeof(group_req)),
+              SyscallSucceeds());
+}
+
 }  // namespace testing
 }  // namespace gvisor