Linux Audio

Check our new training course

Loading...
v4.17
   1/*
   2 *	Neighbour Discovery for IPv6
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *	Mike Shaver		<shaver@ingenia.com>
   8 *
   9 *	This program is free software; you can redistribute it and/or
  10 *      modify it under the terms of the GNU General Public License
  11 *      as published by the Free Software Foundation; either version
  12 *      2 of the License, or (at your option) any later version.
  13 */
  14
  15/*
  16 *	Changes:
  17 *
  18 *	Alexey I. Froloff		:	RFC6106 (DNSSL) support
  19 *	Pierre Ynard			:	export userland ND options
  20 *						through netlink (RDNSS support)
  21 *	Lars Fenneberg			:	fixed MTU setting on receipt
  22 *						of an RA.
  23 *	Janos Farkas			:	kmalloc failure checks
  24 *	Alexey Kuznetsov		:	state machine reworked
  25 *						and moved to net/core.
  26 *	Pekka Savola			:	RFC2461 validation
  27 *	YOSHIFUJI Hideaki @USAGI	:	Verify ND options properly
  28 */
  29
  30#define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32#include <linux/module.h>
  33#include <linux/errno.h>
  34#include <linux/types.h>
  35#include <linux/socket.h>
  36#include <linux/sockios.h>
  37#include <linux/sched.h>
  38#include <linux/net.h>
  39#include <linux/in6.h>
  40#include <linux/route.h>
  41#include <linux/init.h>
  42#include <linux/rcupdate.h>
  43#include <linux/slab.h>
  44#ifdef CONFIG_SYSCTL
  45#include <linux/sysctl.h>
  46#endif
  47
  48#include <linux/if_addr.h>
  49#include <linux/if_ether.h>
  50#include <linux/if_arp.h>
  51#include <linux/ipv6.h>
  52#include <linux/icmpv6.h>
  53#include <linux/jhash.h>
  54
  55#include <net/sock.h>
  56#include <net/snmp.h>
  57
  58#include <net/ipv6.h>
  59#include <net/protocol.h>
  60#include <net/ndisc.h>
  61#include <net/ip6_route.h>
  62#include <net/addrconf.h>
  63#include <net/icmp.h>
  64
  65#include <net/netlink.h>
  66#include <linux/rtnetlink.h>
  67
  68#include <net/flow.h>
  69#include <net/ip6_checksum.h>
  70#include <net/inet_common.h>
  71#include <linux/proc_fs.h>
  72
  73#include <linux/netfilter.h>
  74#include <linux/netfilter_ipv6.h>
  75
 
 
 
 
 
 
 
 
 
  76static u32 ndisc_hash(const void *pkey,
  77		      const struct net_device *dev,
  78		      __u32 *hash_rnd);
  79static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
  80static int ndisc_constructor(struct neighbour *neigh);
  81static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  82static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  83static int pndisc_constructor(struct pneigh_entry *n);
  84static void pndisc_destructor(struct pneigh_entry *n);
  85static void pndisc_redo(struct sk_buff *skb);
  86
  87static const struct neigh_ops ndisc_generic_ops = {
  88	.family =		AF_INET6,
  89	.solicit =		ndisc_solicit,
  90	.error_report =		ndisc_error_report,
  91	.output =		neigh_resolve_output,
  92	.connected_output =	neigh_connected_output,
  93};
  94
  95static const struct neigh_ops ndisc_hh_ops = {
  96	.family =		AF_INET6,
  97	.solicit =		ndisc_solicit,
  98	.error_report =		ndisc_error_report,
  99	.output =		neigh_resolve_output,
 100	.connected_output =	neigh_resolve_output,
 101};
 102
 103
 104static const struct neigh_ops ndisc_direct_ops = {
 105	.family =		AF_INET6,
 106	.output =		neigh_direct_output,
 107	.connected_output =	neigh_direct_output,
 108};
 109
 110struct neigh_table nd_tbl = {
 111	.family =	AF_INET6,
 112	.key_len =	sizeof(struct in6_addr),
 113	.protocol =	cpu_to_be16(ETH_P_IPV6),
 114	.hash =		ndisc_hash,
 115	.key_eq =	ndisc_key_eq,
 116	.constructor =	ndisc_constructor,
 117	.pconstructor =	pndisc_constructor,
 118	.pdestructor =	pndisc_destructor,
 119	.proxy_redo =	pndisc_redo,
 120	.id =		"ndisc_cache",
 121	.parms = {
 122		.tbl			= &nd_tbl,
 123		.reachable_time		= ND_REACHABLE_TIME,
 124		.data = {
 125			[NEIGH_VAR_MCAST_PROBES] = 3,
 126			[NEIGH_VAR_UCAST_PROBES] = 3,
 127			[NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 128			[NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 129			[NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 130			[NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 131			[NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
 132			[NEIGH_VAR_PROXY_QLEN] = 64,
 133			[NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 134			[NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 135		},
 136	},
 137	.gc_interval =	  30 * HZ,
 138	.gc_thresh1 =	 128,
 139	.gc_thresh2 =	 512,
 140	.gc_thresh3 =	1024,
 141};
 142EXPORT_SYMBOL_GPL(nd_tbl);
 143
 144void __ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data,
 145			      int data_len, int pad)
 146{
 147	int space = __ndisc_opt_addr_space(data_len, pad);
 
 
 148	u8 *opt = skb_put(skb, space);
 149
 150	opt[0] = type;
 151	opt[1] = space>>3;
 152
 153	memset(opt + 2, 0, pad);
 154	opt   += pad;
 155	space -= pad;
 156
 157	memcpy(opt+2, data, data_len);
 158	data_len += 2;
 159	opt += data_len;
 160	space -= data_len;
 161	if (space > 0)
 162		memset(opt, 0, space);
 163}
 164EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
 165
 166static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
 167					  void *data, u8 icmp6_type)
 168{
 169	__ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
 170				 ndisc_addr_option_pad(skb->dev->type));
 171	ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
 172}
 173
 174static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
 175						   void *ha,
 176						   const u8 *ops_data)
 177{
 178	ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
 179	ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
 180}
 181
 182static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 183					    struct nd_opt_hdr *end)
 184{
 185	int type;
 186	if (!cur || !end || cur >= end)
 187		return NULL;
 188	type = cur->nd_opt_type;
 189	do {
 190		cur = ((void *)cur) + (cur->nd_opt_len << 3);
 191	} while (cur < end && cur->nd_opt_type != type);
 192	return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 193}
 194
 195static inline int ndisc_is_useropt(const struct net_device *dev,
 196				   struct nd_opt_hdr *opt)
 197{
 198	return opt->nd_opt_type == ND_OPT_RDNSS ||
 199		opt->nd_opt_type == ND_OPT_DNSSL ||
 200		ndisc_ops_is_useropt(dev, opt->nd_opt_type);
 201}
 202
 203static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
 204					     struct nd_opt_hdr *cur,
 205					     struct nd_opt_hdr *end)
 206{
 207	if (!cur || !end || cur >= end)
 208		return NULL;
 209	do {
 210		cur = ((void *)cur) + (cur->nd_opt_len << 3);
 211	} while (cur < end && !ndisc_is_useropt(dev, cur));
 212	return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
 213}
 214
 215struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 216					  u8 *opt, int opt_len,
 217					  struct ndisc_options *ndopts)
 218{
 219	struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 220
 221	if (!nd_opt || opt_len < 0 || !ndopts)
 222		return NULL;
 223	memset(ndopts, 0, sizeof(*ndopts));
 224	while (opt_len) {
 225		int l;
 226		if (opt_len < sizeof(struct nd_opt_hdr))
 227			return NULL;
 228		l = nd_opt->nd_opt_len << 3;
 229		if (opt_len < l || l == 0)
 230			return NULL;
 231		if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
 232			goto next_opt;
 233		switch (nd_opt->nd_opt_type) {
 234		case ND_OPT_SOURCE_LL_ADDR:
 235		case ND_OPT_TARGET_LL_ADDR:
 236		case ND_OPT_MTU:
 237		case ND_OPT_NONCE:
 238		case ND_OPT_REDIRECT_HDR:
 239			if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 240				ND_PRINTK(2, warn,
 241					  "%s: duplicated ND6 option found: type=%d\n",
 242					  __func__, nd_opt->nd_opt_type);
 243			} else {
 244				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 245			}
 246			break;
 247		case ND_OPT_PREFIX_INFO:
 248			ndopts->nd_opts_pi_end = nd_opt;
 249			if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 250				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 251			break;
 252#ifdef CONFIG_IPV6_ROUTE_INFO
 253		case ND_OPT_ROUTE_INFO:
 254			ndopts->nd_opts_ri_end = nd_opt;
 255			if (!ndopts->nd_opts_ri)
 256				ndopts->nd_opts_ri = nd_opt;
 257			break;
 258#endif
 259		default:
 260			if (ndisc_is_useropt(dev, nd_opt)) {
 261				ndopts->nd_useropts_end = nd_opt;
 262				if (!ndopts->nd_useropts)
 263					ndopts->nd_useropts = nd_opt;
 264			} else {
 265				/*
 266				 * Unknown options must be silently ignored,
 267				 * to accommodate future extension to the
 268				 * protocol.
 269				 */
 270				ND_PRINTK(2, notice,
 271					  "%s: ignored unsupported option; type=%d, len=%d\n",
 272					  __func__,
 273					  nd_opt->nd_opt_type,
 274					  nd_opt->nd_opt_len);
 275			}
 276		}
 277next_opt:
 278		opt_len -= l;
 279		nd_opt = ((void *)nd_opt) + l;
 280	}
 281	return ndopts;
 282}
 283
 284int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 285{
 286	switch (dev->type) {
 287	case ARPHRD_ETHER:
 288	case ARPHRD_IEEE802:	/* Not sure. Check it later. --ANK */
 289	case ARPHRD_FDDI:
 290		ipv6_eth_mc_map(addr, buf);
 291		return 0;
 292	case ARPHRD_ARCNET:
 293		ipv6_arcnet_mc_map(addr, buf);
 294		return 0;
 295	case ARPHRD_INFINIBAND:
 296		ipv6_ib_mc_map(addr, dev->broadcast, buf);
 297		return 0;
 298	case ARPHRD_IPGRE:
 299		return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 300	default:
 301		if (dir) {
 302			memcpy(buf, dev->broadcast, dev->addr_len);
 303			return 0;
 304		}
 305	}
 306	return -EINVAL;
 307}
 
 308EXPORT_SYMBOL(ndisc_mc_map);
 309
 310static u32 ndisc_hash(const void *pkey,
 311		      const struct net_device *dev,
 312		      __u32 *hash_rnd)
 313{
 314	return ndisc_hashfn(pkey, dev, hash_rnd);
 315}
 316
 317static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
 318{
 319	return neigh_key_eq128(n, pkey);
 320}
 321
 322static int ndisc_constructor(struct neighbour *neigh)
 323{
 324	struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 325	struct net_device *dev = neigh->dev;
 326	struct inet6_dev *in6_dev;
 327	struct neigh_parms *parms;
 328	bool is_multicast = ipv6_addr_is_multicast(addr);
 329
 330	in6_dev = in6_dev_get(dev);
 331	if (!in6_dev) {
 332		return -EINVAL;
 333	}
 334
 335	parms = in6_dev->nd_parms;
 336	__neigh_parms_put(neigh->parms);
 337	neigh->parms = neigh_parms_clone(parms);
 338
 339	neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 340	if (!dev->header_ops) {
 341		neigh->nud_state = NUD_NOARP;
 342		neigh->ops = &ndisc_direct_ops;
 343		neigh->output = neigh_direct_output;
 344	} else {
 345		if (is_multicast) {
 346			neigh->nud_state = NUD_NOARP;
 347			ndisc_mc_map(addr, neigh->ha, dev, 1);
 348		} else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 349			neigh->nud_state = NUD_NOARP;
 350			memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 351			if (dev->flags&IFF_LOOPBACK)
 352				neigh->type = RTN_LOCAL;
 353		} else if (dev->flags&IFF_POINTOPOINT) {
 354			neigh->nud_state = NUD_NOARP;
 355			memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 356		}
 357		if (dev->header_ops->cache)
 358			neigh->ops = &ndisc_hh_ops;
 359		else
 360			neigh->ops = &ndisc_generic_ops;
 361		if (neigh->nud_state&NUD_VALID)
 362			neigh->output = neigh->ops->connected_output;
 363		else
 364			neigh->output = neigh->ops->output;
 365	}
 366	in6_dev_put(in6_dev);
 367	return 0;
 368}
 369
 370static int pndisc_constructor(struct pneigh_entry *n)
 371{
 372	struct in6_addr *addr = (struct in6_addr *)&n->key;
 373	struct in6_addr maddr;
 374	struct net_device *dev = n->dev;
 375
 376	if (!dev || !__in6_dev_get(dev))
 377		return -EINVAL;
 378	addrconf_addr_solict_mult(addr, &maddr);
 379	ipv6_dev_mc_inc(dev, &maddr);
 380	return 0;
 381}
 382
 383static void pndisc_destructor(struct pneigh_entry *n)
 384{
 385	struct in6_addr *addr = (struct in6_addr *)&n->key;
 386	struct in6_addr maddr;
 387	struct net_device *dev = n->dev;
 388
 389	if (!dev || !__in6_dev_get(dev))
 390		return;
 391	addrconf_addr_solict_mult(addr, &maddr);
 392	ipv6_dev_mc_dec(dev, &maddr);
 393}
 394
 395static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 396				       int len)
 397{
 398	int hlen = LL_RESERVED_SPACE(dev);
 399	int tlen = dev->needed_tailroom;
 400	struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 401	struct sk_buff *skb;
 402
 403	skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 404	if (!skb) {
 405		ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 406			  __func__);
 407		return NULL;
 408	}
 409
 410	skb->protocol = htons(ETH_P_IPV6);
 411	skb->dev = dev;
 412
 413	skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 414	skb_reset_transport_header(skb);
 415
 416	/* Manually assign socket ownership as we avoid calling
 417	 * sock_alloc_send_pskb() to bypass wmem buffer limits
 418	 */
 419	skb_set_owner_w(skb, sk);
 420
 421	return skb;
 422}
 423
 424static void ip6_nd_hdr(struct sk_buff *skb,
 425		       const struct in6_addr *saddr,
 426		       const struct in6_addr *daddr,
 427		       int hop_limit, int len)
 428{
 429	struct ipv6hdr *hdr;
 430	struct inet6_dev *idev;
 431	unsigned tclass;
 432
 433	rcu_read_lock();
 434	idev = __in6_dev_get(skb->dev);
 435	tclass = idev ? idev->cnf.ndisc_tclass : 0;
 436	rcu_read_unlock();
 437
 438	skb_push(skb, sizeof(*hdr));
 439	skb_reset_network_header(skb);
 440	hdr = ipv6_hdr(skb);
 441
 442	ip6_flow_hdr(hdr, tclass, 0);
 443
 444	hdr->payload_len = htons(len);
 445	hdr->nexthdr = IPPROTO_ICMPV6;
 446	hdr->hop_limit = hop_limit;
 447
 448	hdr->saddr = *saddr;
 449	hdr->daddr = *daddr;
 450}
 451
 452static void ndisc_send_skb(struct sk_buff *skb,
 453			   const struct in6_addr *daddr,
 454			   const struct in6_addr *saddr)
 455{
 456	struct dst_entry *dst = skb_dst(skb);
 457	struct net *net = dev_net(skb->dev);
 458	struct sock *sk = net->ipv6.ndisc_sk;
 459	struct inet6_dev *idev;
 460	int err;
 461	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 462	u8 type;
 463
 464	type = icmp6h->icmp6_type;
 465
 466	if (!dst) {
 467		struct flowi6 fl6;
 468		int oif = skb->dev->ifindex;
 469
 470		icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 471		dst = icmp6_dst_alloc(skb->dev, &fl6);
 472		if (IS_ERR(dst)) {
 473			kfree_skb(skb);
 474			return;
 475		}
 476
 477		skb_dst_set(skb, dst);
 478	}
 479
 480	icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 481					      IPPROTO_ICMPV6,
 482					      csum_partial(icmp6h,
 483							   skb->len, 0));
 484
 485	ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 486
 487	rcu_read_lock();
 488	idev = __in6_dev_get(dst->dev);
 489	IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 490
 491	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
 492		      net, sk, skb, NULL, dst->dev,
 493		      dst_output);
 494	if (!err) {
 495		ICMP6MSGOUT_INC_STATS(net, idev, type);
 496		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 497	}
 498
 499	rcu_read_unlock();
 500}
 501
 502void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
 
 503		   const struct in6_addr *solicited_addr,
 504		   bool router, bool solicited, bool override, bool inc_opt)
 505{
 506	struct sk_buff *skb;
 507	struct in6_addr tmpaddr;
 508	struct inet6_ifaddr *ifp;
 509	const struct in6_addr *src_addr;
 510	struct nd_msg *msg;
 511	int optlen = 0;
 512
 513	/* for anycast or proxy, solicited_addr != src_addr */
 514	ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 515	if (ifp) {
 516		src_addr = solicited_addr;
 517		if (ifp->flags & IFA_F_OPTIMISTIC)
 518			override = false;
 519		inc_opt |= ifp->idev->cnf.force_tllao;
 520		in6_ifa_put(ifp);
 521	} else {
 522		if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 523				       inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 524				       &tmpaddr))
 525			return;
 526		src_addr = &tmpaddr;
 527	}
 528
 529	if (!dev->addr_len)
 530		inc_opt = false;
 531	if (inc_opt)
 532		optlen += ndisc_opt_addr_space(dev,
 533					       NDISC_NEIGHBOUR_ADVERTISEMENT);
 534
 535	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 536	if (!skb)
 537		return;
 538
 539	msg = skb_put(skb, sizeof(*msg));
 540	*msg = (struct nd_msg) {
 541		.icmph = {
 542			.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 543			.icmp6_router = router,
 544			.icmp6_solicited = solicited,
 545			.icmp6_override = override,
 546		},
 547		.target = *solicited_addr,
 548	};
 549
 550	if (inc_opt)
 551		ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 552				       dev->dev_addr,
 553				       NDISC_NEIGHBOUR_ADVERTISEMENT);
 554
 555	ndisc_send_skb(skb, daddr, src_addr);
 556}
 557
 558static void ndisc_send_unsol_na(struct net_device *dev)
 559{
 560	struct inet6_dev *idev;
 561	struct inet6_ifaddr *ifa;
 562
 563	idev = in6_dev_get(dev);
 564	if (!idev)
 565		return;
 566
 567	read_lock_bh(&idev->lock);
 568	list_for_each_entry(ifa, &idev->addr_list, if_list) {
 569		/* skip tentative addresses until dad completes */
 570		if (ifa->flags & IFA_F_TENTATIVE &&
 571		    !(ifa->flags & IFA_F_OPTIMISTIC))
 572			continue;
 573
 574		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
 575			      /*router=*/ !!idev->cnf.forwarding,
 576			      /*solicited=*/ false, /*override=*/ true,
 577			      /*inc_opt=*/ true);
 578	}
 579	read_unlock_bh(&idev->lock);
 580
 581	in6_dev_put(idev);
 582}
 583
 584void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
 585		   const struct in6_addr *daddr, const struct in6_addr *saddr,
 586		   u64 nonce)
 587{
 588	struct sk_buff *skb;
 589	struct in6_addr addr_buf;
 590	int inc_opt = dev->addr_len;
 591	int optlen = 0;
 592	struct nd_msg *msg;
 593
 594	if (!saddr) {
 595		if (ipv6_get_lladdr(dev, &addr_buf,
 596				   (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 597			return;
 598		saddr = &addr_buf;
 599	}
 600
 601	if (ipv6_addr_any(saddr))
 602		inc_opt = false;
 603	if (inc_opt)
 604		optlen += ndisc_opt_addr_space(dev,
 605					       NDISC_NEIGHBOUR_SOLICITATION);
 606	if (nonce != 0)
 607		optlen += 8;
 608
 609	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 610	if (!skb)
 611		return;
 612
 613	msg = skb_put(skb, sizeof(*msg));
 614	*msg = (struct nd_msg) {
 615		.icmph = {
 616			.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 617		},
 618		.target = *solicit,
 619	};
 620
 621	if (inc_opt)
 622		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 623				       dev->dev_addr,
 624				       NDISC_NEIGHBOUR_SOLICITATION);
 625	if (nonce != 0) {
 626		u8 *opt = skb_put(skb, 8);
 627
 628		opt[0] = ND_OPT_NONCE;
 629		opt[1] = 8 >> 3;
 630		memcpy(opt + 2, &nonce, 6);
 631	}
 632
 633	ndisc_send_skb(skb, daddr, saddr);
 634}
 635
 636void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 637		   const struct in6_addr *daddr)
 638{
 639	struct sk_buff *skb;
 640	struct rs_msg *msg;
 641	int send_sllao = dev->addr_len;
 642	int optlen = 0;
 643
 644#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 645	/*
 646	 * According to section 2.2 of RFC 4429, we must not
 647	 * send router solicitations with a sllao from
 648	 * optimistic addresses, but we may send the solicitation
 649	 * if we don't include the sllao.  So here we check
 650	 * if our address is optimistic, and if so, we
 651	 * suppress the inclusion of the sllao.
 652	 */
 653	if (send_sllao) {
 654		struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 655							   dev, 1);
 656		if (ifp) {
 657			if (ifp->flags & IFA_F_OPTIMISTIC)  {
 658				send_sllao = 0;
 659			}
 660			in6_ifa_put(ifp);
 661		} else {
 662			send_sllao = 0;
 663		}
 664	}
 665#endif
 666	if (send_sllao)
 667		optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
 668
 669	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 670	if (!skb)
 671		return;
 672
 673	msg = skb_put(skb, sizeof(*msg));
 674	*msg = (struct rs_msg) {
 675		.icmph = {
 676			.icmp6_type = NDISC_ROUTER_SOLICITATION,
 677		},
 678	};
 679
 680	if (send_sllao)
 681		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 682				       dev->dev_addr,
 683				       NDISC_ROUTER_SOLICITATION);
 684
 685	ndisc_send_skb(skb, daddr, saddr);
 686}
 687
 688
 689static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 690{
 691	/*
 692	 *	"The sender MUST return an ICMP
 693	 *	 destination unreachable"
 694	 */
 695	dst_link_failure(skb);
 696	kfree_skb(skb);
 697}
 698
 699/* Called with locked neigh: either read or both */
 700
 701static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 702{
 703	struct in6_addr *saddr = NULL;
 704	struct in6_addr mcaddr;
 705	struct net_device *dev = neigh->dev;
 706	struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 707	int probes = atomic_read(&neigh->probes);
 708
 709	if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 710					   dev, false, 1,
 711					   IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 712		saddr = &ipv6_hdr(skb)->saddr;
 713	probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 714	if (probes < 0) {
 715		if (!(neigh->nud_state & NUD_VALID)) {
 716			ND_PRINTK(1, dbg,
 717				  "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 718				  __func__, target);
 719		}
 720		ndisc_send_ns(dev, target, target, saddr, 0);
 721	} else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 722		neigh_app_ns(neigh);
 723	} else {
 724		addrconf_addr_solict_mult(target, &mcaddr);
 725		ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
 726	}
 727}
 728
 729static int pndisc_is_router(const void *pkey,
 730			    struct net_device *dev)
 731{
 732	struct pneigh_entry *n;
 733	int ret = -1;
 734
 735	read_lock_bh(&nd_tbl.lock);
 736	n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 737	if (n)
 738		ret = !!(n->flags & NTF_ROUTER);
 739	read_unlock_bh(&nd_tbl.lock);
 740
 741	return ret;
 742}
 743
 744void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
 745		  const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
 746		  struct ndisc_options *ndopts)
 747{
 748	neigh_update(neigh, lladdr, new, flags, 0);
 749	/* report ndisc ops about neighbour update */
 750	ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
 751}
 752
 753static void ndisc_recv_ns(struct sk_buff *skb)
 754{
 755	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 756	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 757	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 758	u8 *lladdr = NULL;
 759	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 760				    offsetof(struct nd_msg, opt));
 761	struct ndisc_options ndopts;
 762	struct net_device *dev = skb->dev;
 763	struct inet6_ifaddr *ifp;
 764	struct inet6_dev *idev = NULL;
 765	struct neighbour *neigh;
 766	int dad = ipv6_addr_any(saddr);
 767	bool inc;
 768	int is_router = -1;
 769	u64 nonce = 0;
 770
 771	if (skb->len < sizeof(struct nd_msg)) {
 772		ND_PRINTK(2, warn, "NS: packet too short\n");
 773		return;
 774	}
 775
 776	if (ipv6_addr_is_multicast(&msg->target)) {
 777		ND_PRINTK(2, warn, "NS: multicast target address\n");
 778		return;
 779	}
 780
 781	/*
 782	 * RFC2461 7.1.1:
 783	 * DAD has to be destined for solicited node multicast address.
 784	 */
 785	if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 786		ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 787		return;
 788	}
 789
 790	if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 791		ND_PRINTK(2, warn, "NS: invalid ND options\n");
 792		return;
 793	}
 794
 795	if (ndopts.nd_opts_src_lladdr) {
 796		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 797		if (!lladdr) {
 798			ND_PRINTK(2, warn,
 799				  "NS: invalid link-layer address length\n");
 800			return;
 801		}
 802
 803		/* RFC2461 7.1.1:
 804		 *	If the IP source address is the unspecified address,
 805		 *	there MUST NOT be source link-layer address option
 806		 *	in the message.
 807		 */
 808		if (dad) {
 809			ND_PRINTK(2, warn,
 810				  "NS: bad DAD packet (link-layer address option)\n");
 811			return;
 812		}
 813	}
 814	if (ndopts.nd_opts_nonce)
 815		memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
 816
 817	inc = ipv6_addr_is_multicast(daddr);
 818
 819	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 820	if (ifp) {
 821have_ifp:
 822		if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 823			if (dad) {
 824				if (nonce != 0 && ifp->dad_nonce == nonce) {
 825					u8 *np = (u8 *)&nonce;
 826					/* Matching nonce if looped back */
 827					ND_PRINTK(2, notice,
 828						  "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
 829						  ifp->idev->dev->name,
 830						  &ifp->addr, np);
 831					goto out;
 832				}
 833				/*
 834				 * We are colliding with another node
 835				 * who is doing DAD
 836				 * so fail our DAD process
 837				 */
 838				addrconf_dad_failure(skb, ifp);
 839				return;
 840			} else {
 841				/*
 842				 * This is not a dad solicitation.
 843				 * If we are an optimistic node,
 844				 * we should respond.
 845				 * Otherwise, we should ignore it.
 846				 */
 847				if (!(ifp->flags & IFA_F_OPTIMISTIC))
 848					goto out;
 849			}
 850		}
 851
 852		idev = ifp->idev;
 853	} else {
 854		struct net *net = dev_net(dev);
 855
 856		/* perhaps an address on the master device */
 857		if (netif_is_l3_slave(dev)) {
 858			struct net_device *mdev;
 859
 860			mdev = netdev_master_upper_dev_get_rcu(dev);
 861			if (mdev) {
 862				ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
 863				if (ifp)
 864					goto have_ifp;
 865			}
 866		}
 867
 868		idev = in6_dev_get(dev);
 869		if (!idev) {
 870			/* XXX: count this drop? */
 871			return;
 872		}
 873
 874		if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 875		    (idev->cnf.forwarding &&
 876		     (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 877		     (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 878			if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 879			    skb->pkt_type != PACKET_HOST &&
 880			    inc &&
 881			    NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 882				/*
 883				 * for anycast or proxy,
 884				 * sender should delay its response
 885				 * by a random time between 0 and
 886				 * MAX_ANYCAST_DELAY_TIME seconds.
 887				 * (RFC2461) -- yoshfuji
 888				 */
 889				struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 890				if (n)
 891					pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 892				goto out;
 893			}
 894		} else
 895			goto out;
 896	}
 897
 898	if (is_router < 0)
 899		is_router = idev->cnf.forwarding;
 900
 901	if (dad) {
 902		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
 903			      !!is_router, false, (ifp != NULL), true);
 904		goto out;
 905	}
 906
 907	if (inc)
 908		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 909	else
 910		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 911
 912	/*
 913	 *	update / create cache entry
 914	 *	for the source address
 915	 */
 916	neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 917			       !inc || lladdr || !dev->addr_len);
 918	if (neigh)
 919		ndisc_update(dev, neigh, lladdr, NUD_STALE,
 920			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
 921			     NEIGH_UPDATE_F_OVERRIDE,
 922			     NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
 923	if (neigh || !dev->header_ops) {
 924		ndisc_send_na(dev, saddr, &msg->target, !!is_router,
 
 925			      true, (ifp != NULL && inc), inc);
 926		if (neigh)
 927			neigh_release(neigh);
 928	}
 929
 930out:
 931	if (ifp)
 932		in6_ifa_put(ifp);
 933	else
 934		in6_dev_put(idev);
 935}
 936
 937static void ndisc_recv_na(struct sk_buff *skb)
 938{
 939	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 940	struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 941	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 942	u8 *lladdr = NULL;
 943	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 944				    offsetof(struct nd_msg, opt));
 945	struct ndisc_options ndopts;
 946	struct net_device *dev = skb->dev;
 947	struct inet6_dev *idev = __in6_dev_get(dev);
 948	struct inet6_ifaddr *ifp;
 949	struct neighbour *neigh;
 950
 951	if (skb->len < sizeof(struct nd_msg)) {
 952		ND_PRINTK(2, warn, "NA: packet too short\n");
 953		return;
 954	}
 955
 956	if (ipv6_addr_is_multicast(&msg->target)) {
 957		ND_PRINTK(2, warn, "NA: target address is multicast\n");
 958		return;
 959	}
 960
 961	if (ipv6_addr_is_multicast(daddr) &&
 962	    msg->icmph.icmp6_solicited) {
 963		ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 964		return;
 965	}
 966
 967	/* For some 802.11 wireless deployments (and possibly other networks),
 968	 * there will be a NA proxy and unsolicitd packets are attacks
 969	 * and thus should not be accepted.
 970	 */
 971	if (!msg->icmph.icmp6_solicited && idev &&
 972	    idev->cnf.drop_unsolicited_na)
 973		return;
 974
 975	if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 976		ND_PRINTK(2, warn, "NS: invalid ND option\n");
 977		return;
 978	}
 979	if (ndopts.nd_opts_tgt_lladdr) {
 980		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 981		if (!lladdr) {
 982			ND_PRINTK(2, warn,
 983				  "NA: invalid link-layer address length\n");
 984			return;
 985		}
 986	}
 987	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 988	if (ifp) {
 989		if (skb->pkt_type != PACKET_LOOPBACK
 990		    && (ifp->flags & IFA_F_TENTATIVE)) {
 991				addrconf_dad_failure(skb, ifp);
 992				return;
 993		}
 994		/* What should we make now? The advertisement
 995		   is invalid, but ndisc specs say nothing
 996		   about it. It could be misconfiguration, or
 997		   an smart proxy agent tries to help us :-)
 998
 999		   We should not print the error if NA has been
1000		   received from loopback - it is just our own
1001		   unsolicited advertisement.
1002		 */
1003		if (skb->pkt_type != PACKET_LOOPBACK)
1004			ND_PRINTK(1, warn,
1005				  "NA: %pM advertised our address %pI6c on %s!\n",
1006				  eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1007		in6_ifa_put(ifp);
1008		return;
1009	}
1010	neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1011
1012	if (neigh) {
1013		u8 old_flags = neigh->flags;
1014		struct net *net = dev_net(dev);
1015
1016		if (neigh->nud_state & NUD_FAILED)
1017			goto out;
1018
1019		/*
1020		 * Don't update the neighbor cache entry on a proxy NA from
1021		 * ourselves because either the proxied node is off link or it
1022		 * has already sent a NA to us.
1023		 */
1024		if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1025		    net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1026		    pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1027			/* XXX: idev->cnf.proxy_ndp */
1028			goto out;
1029		}
1030
1031		ndisc_update(dev, neigh, lladdr,
1032			     msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
1033			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1034			     (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1035			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1036			     (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1037			     NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1038
1039		if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1040			/*
1041			 * Change: router to host
1042			 */
1043			rt6_clean_tohost(dev_net(dev),  saddr);
1044		}
1045
1046out:
1047		neigh_release(neigh);
1048	}
1049}
1050
1051static void ndisc_recv_rs(struct sk_buff *skb)
1052{
1053	struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1054	unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1055	struct neighbour *neigh;
1056	struct inet6_dev *idev;
1057	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1058	struct ndisc_options ndopts;
1059	u8 *lladdr = NULL;
1060
1061	if (skb->len < sizeof(*rs_msg))
1062		return;
1063
1064	idev = __in6_dev_get(skb->dev);
1065	if (!idev) {
1066		ND_PRINTK(1, err, "RS: can't find in6 device\n");
1067		return;
1068	}
1069
1070	/* Don't accept RS if we're not in router mode */
1071	if (!idev->cnf.forwarding)
1072		goto out;
1073
1074	/*
1075	 * Don't update NCE if src = ::;
1076	 * this implies that the source node has no ip address assigned yet.
1077	 */
1078	if (ipv6_addr_any(saddr))
1079		goto out;
1080
1081	/* Parse ND options */
1082	if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts)) {
1083		ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
1084		goto out;
1085	}
1086
1087	if (ndopts.nd_opts_src_lladdr) {
1088		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1089					     skb->dev);
1090		if (!lladdr)
1091			goto out;
1092	}
1093
1094	neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1095	if (neigh) {
1096		ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1097			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1098			     NEIGH_UPDATE_F_OVERRIDE|
1099			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1100			     NDISC_ROUTER_SOLICITATION, &ndopts);
1101		neigh_release(neigh);
1102	}
1103out:
1104	return;
1105}
1106
1107static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1108{
1109	struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1110	struct sk_buff *skb;
1111	struct nlmsghdr *nlh;
1112	struct nduseroptmsg *ndmsg;
1113	struct net *net = dev_net(ra->dev);
1114	int err;
1115	int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1116				    + (opt->nd_opt_len << 3));
1117	size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1118
1119	skb = nlmsg_new(msg_size, GFP_ATOMIC);
1120	if (!skb) {
1121		err = -ENOBUFS;
1122		goto errout;
1123	}
1124
1125	nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1126	if (!nlh) {
1127		goto nla_put_failure;
1128	}
1129
1130	ndmsg = nlmsg_data(nlh);
1131	ndmsg->nduseropt_family = AF_INET6;
1132	ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1133	ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1134	ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1135	ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1136
1137	memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1138
1139	if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
 
1140		goto nla_put_failure;
1141	nlmsg_end(skb, nlh);
1142
1143	rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1144	return;
1145
1146nla_put_failure:
1147	nlmsg_free(skb);
1148	err = -EMSGSIZE;
1149errout:
1150	rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1151}
1152
1153static void ndisc_router_discovery(struct sk_buff *skb)
1154{
1155	struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1156	struct neighbour *neigh = NULL;
1157	struct inet6_dev *in6_dev;
1158	struct rt6_info *rt = NULL;
1159	int lifetime;
1160	struct ndisc_options ndopts;
1161	int optlen;
1162	unsigned int pref = 0;
1163	__u32 old_if_flags;
1164	bool send_ifinfo_notify = false;
1165
1166	__u8 *opt = (__u8 *)(ra_msg + 1);
1167
1168	optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1169		sizeof(struct ra_msg);
1170
1171	ND_PRINTK(2, info,
1172		  "RA: %s, dev: %s\n",
1173		  __func__, skb->dev->name);
1174	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1175		ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1176		return;
1177	}
1178	if (optlen < 0) {
1179		ND_PRINTK(2, warn, "RA: packet too short\n");
1180		return;
1181	}
1182
1183#ifdef CONFIG_IPV6_NDISC_NODETYPE
1184	if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1185		ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1186		return;
1187	}
1188#endif
1189
1190	/*
1191	 *	set the RA_RECV flag in the interface
1192	 */
1193
1194	in6_dev = __in6_dev_get(skb->dev);
1195	if (!in6_dev) {
1196		ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1197			  skb->dev->name);
1198		return;
1199	}
1200
1201	if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts)) {
1202		ND_PRINTK(2, warn, "RA: invalid ND options\n");
1203		return;
1204	}
1205
1206	if (!ipv6_accept_ra(in6_dev)) {
1207		ND_PRINTK(2, info,
1208			  "RA: %s, did not accept ra for dev: %s\n",
1209			  __func__, skb->dev->name);
1210		goto skip_linkparms;
1211	}
1212
1213#ifdef CONFIG_IPV6_NDISC_NODETYPE
1214	/* skip link-specific parameters from interior routers */
1215	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1216		ND_PRINTK(2, info,
1217			  "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1218			  __func__, skb->dev->name);
1219		goto skip_linkparms;
1220	}
1221#endif
1222
1223	if (in6_dev->if_flags & IF_RS_SENT) {
1224		/*
1225		 *	flag that an RA was received after an RS was sent
1226		 *	out on this interface.
1227		 */
1228		in6_dev->if_flags |= IF_RA_RCVD;
1229	}
1230
1231	/*
1232	 * Remember the managed/otherconf flags from most recently
1233	 * received RA message (RFC 2462) -- yoshfuji
1234	 */
1235	old_if_flags = in6_dev->if_flags;
1236	in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1237				IF_RA_OTHERCONF)) |
1238				(ra_msg->icmph.icmp6_addrconf_managed ?
1239					IF_RA_MANAGED : 0) |
1240				(ra_msg->icmph.icmp6_addrconf_other ?
1241					IF_RA_OTHERCONF : 0);
1242
1243	if (old_if_flags != in6_dev->if_flags)
1244		send_ifinfo_notify = true;
1245
1246	if (!in6_dev->cnf.accept_ra_defrtr) {
1247		ND_PRINTK(2, info,
1248			  "RA: %s, defrtr is false for dev: %s\n",
1249			  __func__, skb->dev->name);
1250		goto skip_defrtr;
1251	}
1252
1253	/* Do not accept RA with source-addr found on local machine unless
1254	 * accept_ra_from_local is set to true.
1255	 */
1256	if (!in6_dev->cnf.accept_ra_from_local &&
1257	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1258			  in6_dev->dev, 0)) {
1259		ND_PRINTK(2, info,
1260			  "RA from local address detected on dev: %s: default router ignored\n",
1261			  skb->dev->name);
1262		goto skip_defrtr;
1263	}
1264
1265	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1266
1267#ifdef CONFIG_IPV6_ROUTER_PREF
1268	pref = ra_msg->icmph.icmp6_router_pref;
1269	/* 10b is handled as if it were 00b (medium) */
1270	if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1271	    !in6_dev->cnf.accept_ra_rtr_pref)
1272		pref = ICMPV6_ROUTER_PREF_MEDIUM;
1273#endif
1274
1275	rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1276
1277	if (rt) {
1278		neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1279		if (!neigh) {
1280			ND_PRINTK(0, err,
1281				  "RA: %s got default router without neighbour\n",
1282				  __func__);
1283			ip6_rt_put(rt);
1284			return;
1285		}
1286	}
1287	if (rt && lifetime == 0) {
1288		ip6_del_rt(rt);
1289		rt = NULL;
1290	}
1291
1292	ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, for dev: %s\n",
1293		  rt, lifetime, skb->dev->name);
1294	if (!rt && lifetime) {
1295		ND_PRINTK(3, info, "RA: adding default router\n");
1296
1297		rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1298		if (!rt) {
1299			ND_PRINTK(0, err,
1300				  "RA: %s failed to add default route\n",
1301				  __func__);
1302			return;
1303		}
1304
1305		neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1306		if (!neigh) {
1307			ND_PRINTK(0, err,
1308				  "RA: %s got default router without neighbour\n",
1309				  __func__);
1310			ip6_rt_put(rt);
1311			return;
1312		}
1313		neigh->flags |= NTF_ROUTER;
1314	} else if (rt) {
1315		rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1316	}
1317
1318	if (rt)
1319		rt6_set_expires(rt, jiffies + (HZ * lifetime));
1320	if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1321	    ra_msg->icmph.icmp6_hop_limit) {
1322		if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1323			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1324			if (rt)
1325				dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1326					       ra_msg->icmph.icmp6_hop_limit);
1327		} else {
1328			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1329		}
1330	}
1331
1332skip_defrtr:
1333
1334	/*
1335	 *	Update Reachable Time and Retrans Timer
1336	 */
1337
1338	if (in6_dev->nd_parms) {
1339		unsigned long rtime = ntohl(ra_msg->retrans_timer);
1340
1341		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1342			rtime = (rtime*HZ)/1000;
1343			if (rtime < HZ/10)
1344				rtime = HZ/10;
1345			NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1346			in6_dev->tstamp = jiffies;
1347			send_ifinfo_notify = true;
1348		}
1349
1350		rtime = ntohl(ra_msg->reachable_time);
1351		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1352			rtime = (rtime*HZ)/1000;
1353
1354			if (rtime < HZ/10)
1355				rtime = HZ/10;
1356
1357			if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1358				NEIGH_VAR_SET(in6_dev->nd_parms,
1359					      BASE_REACHABLE_TIME, rtime);
1360				NEIGH_VAR_SET(in6_dev->nd_parms,
1361					      GC_STALETIME, 3 * rtime);
1362				in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1363				in6_dev->tstamp = jiffies;
1364				send_ifinfo_notify = true;
1365			}
1366		}
1367	}
1368
1369	/*
1370	 *	Send a notify if RA changed managed/otherconf flags or timer settings
1371	 */
1372	if (send_ifinfo_notify)
1373		inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1374
1375skip_linkparms:
1376
1377	/*
1378	 *	Process options.
1379	 */
1380
1381	if (!neigh)
1382		neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1383				       skb->dev, 1);
1384	if (neigh) {
1385		u8 *lladdr = NULL;
1386		if (ndopts.nd_opts_src_lladdr) {
1387			lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1388						     skb->dev);
1389			if (!lladdr) {
1390				ND_PRINTK(2, warn,
1391					  "RA: invalid link-layer address length\n");
1392				goto out;
1393			}
1394		}
1395		ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1396			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1397			     NEIGH_UPDATE_F_OVERRIDE|
1398			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1399			     NEIGH_UPDATE_F_ISROUTER,
1400			     NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1401	}
1402
1403	if (!ipv6_accept_ra(in6_dev)) {
1404		ND_PRINTK(2, info,
1405			  "RA: %s, accept_ra is false for dev: %s\n",
1406			  __func__, skb->dev->name);
1407		goto out;
1408	}
1409
1410#ifdef CONFIG_IPV6_ROUTE_INFO
1411	if (!in6_dev->cnf.accept_ra_from_local &&
1412	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1413			  in6_dev->dev, 0)) {
1414		ND_PRINTK(2, info,
1415			  "RA from local address detected on dev: %s: router info ignored.\n",
1416			  skb->dev->name);
1417		goto skip_routeinfo;
1418	}
1419
1420	if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1421		struct nd_opt_hdr *p;
1422		for (p = ndopts.nd_opts_ri;
1423		     p;
1424		     p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1425			struct route_info *ri = (struct route_info *)p;
1426#ifdef CONFIG_IPV6_NDISC_NODETYPE
1427			if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1428			    ri->prefix_len == 0)
1429				continue;
1430#endif
1431			if (ri->prefix_len == 0 &&
1432			    !in6_dev->cnf.accept_ra_defrtr)
1433				continue;
1434			if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1435				continue;
1436			if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1437				continue;
1438			rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1439				      &ipv6_hdr(skb)->saddr);
1440		}
1441	}
1442
1443skip_routeinfo:
1444#endif
1445
1446#ifdef CONFIG_IPV6_NDISC_NODETYPE
1447	/* skip link-specific ndopts from interior routers */
1448	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1449		ND_PRINTK(2, info,
1450			  "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1451			  __func__, skb->dev->name);
1452		goto out;
1453	}
1454#endif
1455
1456	if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1457		struct nd_opt_hdr *p;
1458		for (p = ndopts.nd_opts_pi;
1459		     p;
1460		     p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1461			addrconf_prefix_rcv(skb->dev, (u8 *)p,
1462					    (p->nd_opt_len) << 3,
1463					    ndopts.nd_opts_src_lladdr != NULL);
1464		}
1465	}
1466
1467	if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1468		__be32 n;
1469		u32 mtu;
1470
1471		memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1472		mtu = ntohl(n);
1473
1474		if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1475			ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1476		} else if (in6_dev->cnf.mtu6 != mtu) {
1477			in6_dev->cnf.mtu6 = mtu;
1478
1479			if (rt)
1480				dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1481
1482			rt6_mtu_change(skb->dev, mtu);
1483		}
1484	}
1485
1486	if (ndopts.nd_useropts) {
1487		struct nd_opt_hdr *p;
1488		for (p = ndopts.nd_useropts;
1489		     p;
1490		     p = ndisc_next_useropt(skb->dev, p,
1491					    ndopts.nd_useropts_end)) {
1492			ndisc_ra_useropt(skb, p);
1493		}
1494	}
1495
1496	if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1497		ND_PRINTK(2, warn, "RA: invalid RA options\n");
1498	}
1499out:
1500	ip6_rt_put(rt);
1501	if (neigh)
1502		neigh_release(neigh);
1503}
1504
1505static void ndisc_redirect_rcv(struct sk_buff *skb)
1506{
1507	u8 *hdr;
1508	struct ndisc_options ndopts;
1509	struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1510	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1511				    offsetof(struct rd_msg, opt));
1512
1513#ifdef CONFIG_IPV6_NDISC_NODETYPE
1514	switch (skb->ndisc_nodetype) {
1515	case NDISC_NODETYPE_HOST:
1516	case NDISC_NODETYPE_NODEFAULT:
1517		ND_PRINTK(2, warn,
1518			  "Redirect: from host or unauthorized router\n");
1519		return;
1520	}
1521#endif
1522
1523	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1524		ND_PRINTK(2, warn,
1525			  "Redirect: source address is not link-local\n");
1526		return;
1527	}
1528
1529	if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1530		return;
1531
1532	if (!ndopts.nd_opts_rh) {
1533		ip6_redirect_no_header(skb, dev_net(skb->dev),
1534					skb->dev->ifindex, 0);
1535		return;
1536	}
1537
1538	hdr = (u8 *)ndopts.nd_opts_rh;
1539	hdr += 8;
1540	if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1541		return;
1542
1543	icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1544}
1545
1546static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1547					   struct sk_buff *orig_skb,
1548					   int rd_len)
1549{
1550	u8 *opt = skb_put(skb, rd_len);
1551
1552	memset(opt, 0, 8);
1553	*(opt++) = ND_OPT_REDIRECT_HDR;
1554	*(opt++) = (rd_len >> 3);
1555	opt += 6;
1556
1557	skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1558		      rd_len - 8);
1559}
1560
1561void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1562{
1563	struct net_device *dev = skb->dev;
1564	struct net *net = dev_net(dev);
1565	struct sock *sk = net->ipv6.ndisc_sk;
1566	int optlen = 0;
1567	struct inet_peer *peer;
1568	struct sk_buff *buff;
1569	struct rd_msg *msg;
1570	struct in6_addr saddr_buf;
1571	struct rt6_info *rt;
1572	struct dst_entry *dst;
1573	struct flowi6 fl6;
1574	int rd_len;
1575	u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1576	   ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1577	bool ret;
1578
1579	if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1580		ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1581			  dev->name);
1582		return;
1583	}
1584
1585	if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1586	    ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1587		ND_PRINTK(2, warn,
1588			  "Redirect: target address is not link-local unicast\n");
1589		return;
1590	}
1591
1592	icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1593			 &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1594
1595	dst = ip6_route_output(net, NULL, &fl6);
1596	if (dst->error) {
1597		dst_release(dst);
1598		return;
1599	}
1600	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1601	if (IS_ERR(dst))
1602		return;
1603
1604	rt = (struct rt6_info *) dst;
1605
1606	if (rt->rt6i_flags & RTF_GATEWAY) {
1607		ND_PRINTK(2, warn,
1608			  "Redirect: destination is not a neighbour\n");
1609		goto release;
1610	}
1611	peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1612	ret = inet_peer_xrlim_allow(peer, 1*HZ);
1613	if (peer)
1614		inet_putpeer(peer);
1615	if (!ret)
1616		goto release;
1617
1618	if (dev->addr_len) {
1619		struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1620		if (!neigh) {
1621			ND_PRINTK(2, warn,
1622				  "Redirect: no neigh for target address\n");
1623			goto release;
1624		}
1625
1626		read_lock_bh(&neigh->lock);
1627		if (neigh->nud_state & NUD_VALID) {
1628			memcpy(ha_buf, neigh->ha, dev->addr_len);
1629			read_unlock_bh(&neigh->lock);
1630			ha = ha_buf;
1631			optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1632								ops_data_buf,
1633								&ops_data);
1634		} else
1635			read_unlock_bh(&neigh->lock);
1636
1637		neigh_release(neigh);
1638	}
1639
1640	rd_len = min_t(unsigned int,
1641		       IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1642		       skb->len + 8);
1643	rd_len &= ~0x7;
1644	optlen += rd_len;
1645
1646	buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1647	if (!buff)
1648		goto release;
1649
1650	msg = skb_put(buff, sizeof(*msg));
1651	*msg = (struct rd_msg) {
1652		.icmph = {
1653			.icmp6_type = NDISC_REDIRECT,
1654		},
1655		.target = *target,
1656		.dest = ipv6_hdr(skb)->daddr,
1657	};
1658
1659	/*
1660	 *	include target_address option
1661	 */
1662
1663	if (ha)
1664		ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1665
1666	/*
1667	 *	build redirect option and copy skb over to the new packet.
1668	 */
1669
1670	if (rd_len)
1671		ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1672
1673	skb_dst_set(buff, dst);
1674	ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1675	return;
1676
1677release:
1678	dst_release(dst);
1679}
1680
1681static void pndisc_redo(struct sk_buff *skb)
1682{
1683	ndisc_recv_ns(skb);
1684	kfree_skb(skb);
1685}
1686
1687static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1688{
1689	struct inet6_dev *idev = __in6_dev_get(skb->dev);
1690
1691	if (!idev)
1692		return true;
1693	if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1694	    idev->cnf.suppress_frag_ndisc) {
1695		net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1696		return true;
1697	}
1698	return false;
1699}
1700
1701int ndisc_rcv(struct sk_buff *skb)
1702{
1703	struct nd_msg *msg;
1704
1705	if (ndisc_suppress_frag_ndisc(skb))
1706		return 0;
1707
1708	if (skb_linearize(skb))
1709		return 0;
1710
1711	msg = (struct nd_msg *)skb_transport_header(skb);
1712
1713	__skb_push(skb, skb->data - skb_transport_header(skb));
1714
1715	if (ipv6_hdr(skb)->hop_limit != 255) {
1716		ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1717			  ipv6_hdr(skb)->hop_limit);
1718		return 0;
1719	}
1720
1721	if (msg->icmph.icmp6_code != 0) {
1722		ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1723			  msg->icmph.icmp6_code);
1724		return 0;
1725	}
1726
1727	memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1728
1729	switch (msg->icmph.icmp6_type) {
1730	case NDISC_NEIGHBOUR_SOLICITATION:
1731		ndisc_recv_ns(skb);
1732		break;
1733
1734	case NDISC_NEIGHBOUR_ADVERTISEMENT:
1735		ndisc_recv_na(skb);
1736		break;
1737
1738	case NDISC_ROUTER_SOLICITATION:
1739		ndisc_recv_rs(skb);
1740		break;
1741
1742	case NDISC_ROUTER_ADVERTISEMENT:
1743		ndisc_router_discovery(skb);
1744		break;
1745
1746	case NDISC_REDIRECT:
1747		ndisc_redirect_rcv(skb);
1748		break;
1749	}
1750
1751	return 0;
1752}
1753
1754static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1755{
1756	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1757	struct netdev_notifier_change_info *change_info;
1758	struct net *net = dev_net(dev);
1759	struct inet6_dev *idev;
1760
1761	switch (event) {
1762	case NETDEV_CHANGEADDR:
1763		neigh_changeaddr(&nd_tbl, dev);
1764		fib6_run_gc(0, net, false);
1765		/* fallthrough */
1766	case NETDEV_UP:
1767		idev = in6_dev_get(dev);
1768		if (!idev)
1769			break;
1770		if (idev->cnf.ndisc_notify ||
1771		    net->ipv6.devconf_all->ndisc_notify)
1772			ndisc_send_unsol_na(dev);
1773		in6_dev_put(idev);
1774		break;
1775	case NETDEV_CHANGE:
1776		change_info = ptr;
1777		if (change_info->flags_changed & IFF_NOARP)
1778			neigh_changeaddr(&nd_tbl, dev);
1779		break;
1780	case NETDEV_DOWN:
1781		neigh_ifdown(&nd_tbl, dev);
1782		fib6_run_gc(0, net, false);
1783		break;
1784	case NETDEV_NOTIFY_PEERS:
1785		ndisc_send_unsol_na(dev);
1786		break;
1787	default:
1788		break;
1789	}
1790
1791	return NOTIFY_DONE;
1792}
1793
1794static struct notifier_block ndisc_netdev_notifier = {
1795	.notifier_call = ndisc_netdev_event,
1796	.priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1797};
1798
1799#ifdef CONFIG_SYSCTL
1800static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1801					 const char *func, const char *dev_name)
1802{
1803	static char warncomm[TASK_COMM_LEN];
1804	static int warned;
1805	if (strcmp(warncomm, current->comm) && warned < 5) {
1806		strcpy(warncomm, current->comm);
1807		pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1808			warncomm, func,
1809			dev_name, ctl->procname,
1810			dev_name, ctl->procname);
1811		warned++;
1812	}
1813}
1814
1815int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1816{
1817	struct net_device *dev = ctl->extra1;
1818	struct inet6_dev *idev;
1819	int ret;
1820
1821	if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1822	    (strcmp(ctl->procname, "base_reachable_time") == 0))
1823		ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1824
1825	if (strcmp(ctl->procname, "retrans_time") == 0)
1826		ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1827
1828	else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1829		ret = neigh_proc_dointvec_jiffies(ctl, write,
1830						  buffer, lenp, ppos);
1831
1832	else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1833		 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1834		ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1835						     buffer, lenp, ppos);
1836	else
1837		ret = -1;
1838
1839	if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1840		if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1841			idev->nd_parms->reachable_time =
1842					neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1843		idev->tstamp = jiffies;
1844		inet6_ifinfo_notify(RTM_NEWLINK, idev);
1845		in6_dev_put(idev);
1846	}
1847	return ret;
1848}
1849
1850
1851#endif
1852
1853static int __net_init ndisc_net_init(struct net *net)
1854{
1855	struct ipv6_pinfo *np;
1856	struct sock *sk;
1857	int err;
1858
1859	err = inet_ctl_sock_create(&sk, PF_INET6,
1860				   SOCK_RAW, IPPROTO_ICMPV6, net);
1861	if (err < 0) {
1862		ND_PRINTK(0, err,
1863			  "NDISC: Failed to initialize the control socket (err %d)\n",
1864			  err);
1865		return err;
1866	}
1867
1868	net->ipv6.ndisc_sk = sk;
1869
1870	np = inet6_sk(sk);
1871	np->hop_limit = 255;
1872	/* Do not loopback ndisc messages */
1873	np->mc_loop = 0;
1874
1875	return 0;
1876}
1877
1878static void __net_exit ndisc_net_exit(struct net *net)
1879{
1880	inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1881}
1882
1883static struct pernet_operations ndisc_net_ops = {
1884	.init = ndisc_net_init,
1885	.exit = ndisc_net_exit,
1886};
1887
1888int __init ndisc_init(void)
1889{
1890	int err;
1891
1892	err = register_pernet_subsys(&ndisc_net_ops);
1893	if (err)
1894		return err;
1895	/*
1896	 * Initialize the neighbour table
1897	 */
1898	neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1899
1900#ifdef CONFIG_SYSCTL
1901	err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1902				    ndisc_ifinfo_sysctl_change);
1903	if (err)
1904		goto out_unregister_pernet;
1905out:
1906#endif
1907	return err;
1908
1909#ifdef CONFIG_SYSCTL
1910out_unregister_pernet:
1911	unregister_pernet_subsys(&ndisc_net_ops);
1912	goto out;
1913#endif
1914}
1915
1916int __init ndisc_late_init(void)
1917{
1918	return register_netdevice_notifier(&ndisc_netdev_notifier);
1919}
1920
1921void ndisc_late_cleanup(void)
1922{
1923	unregister_netdevice_notifier(&ndisc_netdev_notifier);
1924}
1925
1926void ndisc_cleanup(void)
1927{
1928#ifdef CONFIG_SYSCTL
1929	neigh_sysctl_unregister(&nd_tbl.parms);
1930#endif
1931	neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1932	unregister_pernet_subsys(&ndisc_net_ops);
1933}
v3.15
   1/*
   2 *	Neighbour Discovery for IPv6
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *	Mike Shaver		<shaver@ingenia.com>
   8 *
   9 *	This program is free software; you can redistribute it and/or
  10 *      modify it under the terms of the GNU General Public License
  11 *      as published by the Free Software Foundation; either version
  12 *      2 of the License, or (at your option) any later version.
  13 */
  14
  15/*
  16 *	Changes:
  17 *
  18 *	Alexey I. Froloff		:	RFC6106 (DNSSL) support
  19 *	Pierre Ynard			:	export userland ND options
  20 *						through netlink (RDNSS support)
  21 *	Lars Fenneberg			:	fixed MTU setting on receipt
  22 *						of an RA.
  23 *	Janos Farkas			:	kmalloc failure checks
  24 *	Alexey Kuznetsov		:	state machine reworked
  25 *						and moved to net/core.
  26 *	Pekka Savola			:	RFC2461 validation
  27 *	YOSHIFUJI Hideaki @USAGI	:	Verify ND options properly
  28 */
  29
  30#define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32#include <linux/module.h>
  33#include <linux/errno.h>
  34#include <linux/types.h>
  35#include <linux/socket.h>
  36#include <linux/sockios.h>
  37#include <linux/sched.h>
  38#include <linux/net.h>
  39#include <linux/in6.h>
  40#include <linux/route.h>
  41#include <linux/init.h>
  42#include <linux/rcupdate.h>
  43#include <linux/slab.h>
  44#ifdef CONFIG_SYSCTL
  45#include <linux/sysctl.h>
  46#endif
  47
  48#include <linux/if_addr.h>
 
  49#include <linux/if_arp.h>
  50#include <linux/ipv6.h>
  51#include <linux/icmpv6.h>
  52#include <linux/jhash.h>
  53
  54#include <net/sock.h>
  55#include <net/snmp.h>
  56
  57#include <net/ipv6.h>
  58#include <net/protocol.h>
  59#include <net/ndisc.h>
  60#include <net/ip6_route.h>
  61#include <net/addrconf.h>
  62#include <net/icmp.h>
  63
  64#include <net/netlink.h>
  65#include <linux/rtnetlink.h>
  66
  67#include <net/flow.h>
  68#include <net/ip6_checksum.h>
  69#include <net/inet_common.h>
  70#include <linux/proc_fs.h>
  71
  72#include <linux/netfilter.h>
  73#include <linux/netfilter_ipv6.h>
  74
  75/* Set to 3 to get tracing... */
  76#define ND_DEBUG 1
  77
  78#define ND_PRINTK(val, level, fmt, ...)				\
  79do {								\
  80	if (val <= ND_DEBUG)					\
  81		net_##level##_ratelimited(fmt, ##__VA_ARGS__);	\
  82} while (0)
  83
  84static u32 ndisc_hash(const void *pkey,
  85		      const struct net_device *dev,
  86		      __u32 *hash_rnd);
 
  87static int ndisc_constructor(struct neighbour *neigh);
  88static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  89static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  90static int pndisc_constructor(struct pneigh_entry *n);
  91static void pndisc_destructor(struct pneigh_entry *n);
  92static void pndisc_redo(struct sk_buff *skb);
  93
  94static const struct neigh_ops ndisc_generic_ops = {
  95	.family =		AF_INET6,
  96	.solicit =		ndisc_solicit,
  97	.error_report =		ndisc_error_report,
  98	.output =		neigh_resolve_output,
  99	.connected_output =	neigh_connected_output,
 100};
 101
 102static const struct neigh_ops ndisc_hh_ops = {
 103	.family =		AF_INET6,
 104	.solicit =		ndisc_solicit,
 105	.error_report =		ndisc_error_report,
 106	.output =		neigh_resolve_output,
 107	.connected_output =	neigh_resolve_output,
 108};
 109
 110
 111static const struct neigh_ops ndisc_direct_ops = {
 112	.family =		AF_INET6,
 113	.output =		neigh_direct_output,
 114	.connected_output =	neigh_direct_output,
 115};
 116
 117struct neigh_table nd_tbl = {
 118	.family =	AF_INET6,
 119	.key_len =	sizeof(struct in6_addr),
 
 120	.hash =		ndisc_hash,
 
 121	.constructor =	ndisc_constructor,
 122	.pconstructor =	pndisc_constructor,
 123	.pdestructor =	pndisc_destructor,
 124	.proxy_redo =	pndisc_redo,
 125	.id =		"ndisc_cache",
 126	.parms = {
 127		.tbl			= &nd_tbl,
 128		.reachable_time		= ND_REACHABLE_TIME,
 129		.data = {
 130			[NEIGH_VAR_MCAST_PROBES] = 3,
 131			[NEIGH_VAR_UCAST_PROBES] = 3,
 132			[NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 133			[NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 134			[NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 135			[NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 136			[NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
 137			[NEIGH_VAR_PROXY_QLEN] = 64,
 138			[NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 139			[NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 140		},
 141	},
 142	.gc_interval =	  30 * HZ,
 143	.gc_thresh1 =	 128,
 144	.gc_thresh2 =	 512,
 145	.gc_thresh3 =	1024,
 146};
 
 147
 148static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
 
 149{
 150	int pad   = ndisc_addr_option_pad(skb->dev->type);
 151	int data_len = skb->dev->addr_len;
 152	int space = ndisc_opt_addr_space(skb->dev);
 153	u8 *opt = skb_put(skb, space);
 154
 155	opt[0] = type;
 156	opt[1] = space>>3;
 157
 158	memset(opt + 2, 0, pad);
 159	opt   += pad;
 160	space -= pad;
 161
 162	memcpy(opt+2, data, data_len);
 163	data_len += 2;
 164	opt += data_len;
 165	if ((space -= data_len) > 0)
 
 166		memset(opt, 0, space);
 167}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 168
 169static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 170					    struct nd_opt_hdr *end)
 171{
 172	int type;
 173	if (!cur || !end || cur >= end)
 174		return NULL;
 175	type = cur->nd_opt_type;
 176	do {
 177		cur = ((void *)cur) + (cur->nd_opt_len << 3);
 178	} while(cur < end && cur->nd_opt_type != type);
 179	return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 180}
 181
 182static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 
 183{
 184	return opt->nd_opt_type == ND_OPT_RDNSS ||
 185		opt->nd_opt_type == ND_OPT_DNSSL;
 
 186}
 187
 188static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 
 189					     struct nd_opt_hdr *end)
 190{
 191	if (!cur || !end || cur >= end)
 192		return NULL;
 193	do {
 194		cur = ((void *)cur) + (cur->nd_opt_len << 3);
 195	} while(cur < end && !ndisc_is_useropt(cur));
 196	return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 197}
 198
 199struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 
 200					  struct ndisc_options *ndopts)
 201{
 202	struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 203
 204	if (!nd_opt || opt_len < 0 || !ndopts)
 205		return NULL;
 206	memset(ndopts, 0, sizeof(*ndopts));
 207	while (opt_len) {
 208		int l;
 209		if (opt_len < sizeof(struct nd_opt_hdr))
 210			return NULL;
 211		l = nd_opt->nd_opt_len << 3;
 212		if (opt_len < l || l == 0)
 213			return NULL;
 
 
 214		switch (nd_opt->nd_opt_type) {
 215		case ND_OPT_SOURCE_LL_ADDR:
 216		case ND_OPT_TARGET_LL_ADDR:
 217		case ND_OPT_MTU:
 
 218		case ND_OPT_REDIRECT_HDR:
 219			if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 220				ND_PRINTK(2, warn,
 221					  "%s: duplicated ND6 option found: type=%d\n",
 222					  __func__, nd_opt->nd_opt_type);
 223			} else {
 224				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 225			}
 226			break;
 227		case ND_OPT_PREFIX_INFO:
 228			ndopts->nd_opts_pi_end = nd_opt;
 229			if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 230				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 231			break;
 232#ifdef CONFIG_IPV6_ROUTE_INFO
 233		case ND_OPT_ROUTE_INFO:
 234			ndopts->nd_opts_ri_end = nd_opt;
 235			if (!ndopts->nd_opts_ri)
 236				ndopts->nd_opts_ri = nd_opt;
 237			break;
 238#endif
 239		default:
 240			if (ndisc_is_useropt(nd_opt)) {
 241				ndopts->nd_useropts_end = nd_opt;
 242				if (!ndopts->nd_useropts)
 243					ndopts->nd_useropts = nd_opt;
 244			} else {
 245				/*
 246				 * Unknown options must be silently ignored,
 247				 * to accommodate future extension to the
 248				 * protocol.
 249				 */
 250				ND_PRINTK(2, notice,
 251					  "%s: ignored unsupported option; type=%d, len=%d\n",
 252					  __func__,
 253					  nd_opt->nd_opt_type,
 254					  nd_opt->nd_opt_len);
 255			}
 256		}
 
 257		opt_len -= l;
 258		nd_opt = ((void *)nd_opt) + l;
 259	}
 260	return ndopts;
 261}
 262
 263int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 264{
 265	switch (dev->type) {
 266	case ARPHRD_ETHER:
 267	case ARPHRD_IEEE802:	/* Not sure. Check it later. --ANK */
 268	case ARPHRD_FDDI:
 269		ipv6_eth_mc_map(addr, buf);
 270		return 0;
 271	case ARPHRD_ARCNET:
 272		ipv6_arcnet_mc_map(addr, buf);
 273		return 0;
 274	case ARPHRD_INFINIBAND:
 275		ipv6_ib_mc_map(addr, dev->broadcast, buf);
 276		return 0;
 277	case ARPHRD_IPGRE:
 278		return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 279	default:
 280		if (dir) {
 281			memcpy(buf, dev->broadcast, dev->addr_len);
 282			return 0;
 283		}
 284	}
 285	return -EINVAL;
 286}
 287
 288EXPORT_SYMBOL(ndisc_mc_map);
 289
 290static u32 ndisc_hash(const void *pkey,
 291		      const struct net_device *dev,
 292		      __u32 *hash_rnd)
 293{
 294	return ndisc_hashfn(pkey, dev, hash_rnd);
 295}
 296
 
 
 
 
 
 297static int ndisc_constructor(struct neighbour *neigh)
 298{
 299	struct in6_addr *addr = (struct in6_addr*)&neigh->primary_key;
 300	struct net_device *dev = neigh->dev;
 301	struct inet6_dev *in6_dev;
 302	struct neigh_parms *parms;
 303	bool is_multicast = ipv6_addr_is_multicast(addr);
 304
 305	in6_dev = in6_dev_get(dev);
 306	if (in6_dev == NULL) {
 307		return -EINVAL;
 308	}
 309
 310	parms = in6_dev->nd_parms;
 311	__neigh_parms_put(neigh->parms);
 312	neigh->parms = neigh_parms_clone(parms);
 313
 314	neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 315	if (!dev->header_ops) {
 316		neigh->nud_state = NUD_NOARP;
 317		neigh->ops = &ndisc_direct_ops;
 318		neigh->output = neigh_direct_output;
 319	} else {
 320		if (is_multicast) {
 321			neigh->nud_state = NUD_NOARP;
 322			ndisc_mc_map(addr, neigh->ha, dev, 1);
 323		} else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 324			neigh->nud_state = NUD_NOARP;
 325			memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 326			if (dev->flags&IFF_LOOPBACK)
 327				neigh->type = RTN_LOCAL;
 328		} else if (dev->flags&IFF_POINTOPOINT) {
 329			neigh->nud_state = NUD_NOARP;
 330			memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 331		}
 332		if (dev->header_ops->cache)
 333			neigh->ops = &ndisc_hh_ops;
 334		else
 335			neigh->ops = &ndisc_generic_ops;
 336		if (neigh->nud_state&NUD_VALID)
 337			neigh->output = neigh->ops->connected_output;
 338		else
 339			neigh->output = neigh->ops->output;
 340	}
 341	in6_dev_put(in6_dev);
 342	return 0;
 343}
 344
 345static int pndisc_constructor(struct pneigh_entry *n)
 346{
 347	struct in6_addr *addr = (struct in6_addr*)&n->key;
 348	struct in6_addr maddr;
 349	struct net_device *dev = n->dev;
 350
 351	if (dev == NULL || __in6_dev_get(dev) == NULL)
 352		return -EINVAL;
 353	addrconf_addr_solict_mult(addr, &maddr);
 354	ipv6_dev_mc_inc(dev, &maddr);
 355	return 0;
 356}
 357
 358static void pndisc_destructor(struct pneigh_entry *n)
 359{
 360	struct in6_addr *addr = (struct in6_addr*)&n->key;
 361	struct in6_addr maddr;
 362	struct net_device *dev = n->dev;
 363
 364	if (dev == NULL || __in6_dev_get(dev) == NULL)
 365		return;
 366	addrconf_addr_solict_mult(addr, &maddr);
 367	ipv6_dev_mc_dec(dev, &maddr);
 368}
 369
 370static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 371				       int len)
 372{
 373	int hlen = LL_RESERVED_SPACE(dev);
 374	int tlen = dev->needed_tailroom;
 375	struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 376	struct sk_buff *skb;
 377
 378	skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 379	if (!skb) {
 380		ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 381			  __func__);
 382		return NULL;
 383	}
 384
 385	skb->protocol = htons(ETH_P_IPV6);
 386	skb->dev = dev;
 387
 388	skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 389	skb_reset_transport_header(skb);
 390
 391	/* Manually assign socket ownership as we avoid calling
 392	 * sock_alloc_send_pskb() to bypass wmem buffer limits
 393	 */
 394	skb_set_owner_w(skb, sk);
 395
 396	return skb;
 397}
 398
 399static void ip6_nd_hdr(struct sk_buff *skb,
 400		       const struct in6_addr *saddr,
 401		       const struct in6_addr *daddr,
 402		       int hop_limit, int len)
 403{
 404	struct ipv6hdr *hdr;
 
 
 
 
 
 
 
 405
 406	skb_push(skb, sizeof(*hdr));
 407	skb_reset_network_header(skb);
 408	hdr = ipv6_hdr(skb);
 409
 410	ip6_flow_hdr(hdr, 0, 0);
 411
 412	hdr->payload_len = htons(len);
 413	hdr->nexthdr = IPPROTO_ICMPV6;
 414	hdr->hop_limit = hop_limit;
 415
 416	hdr->saddr = *saddr;
 417	hdr->daddr = *daddr;
 418}
 419
 420static void ndisc_send_skb(struct sk_buff *skb,
 421			   const struct in6_addr *daddr,
 422			   const struct in6_addr *saddr)
 423{
 424	struct dst_entry *dst = skb_dst(skb);
 425	struct net *net = dev_net(skb->dev);
 426	struct sock *sk = net->ipv6.ndisc_sk;
 427	struct inet6_dev *idev;
 428	int err;
 429	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 430	u8 type;
 431
 432	type = icmp6h->icmp6_type;
 433
 434	if (!dst) {
 435		struct flowi6 fl6;
 
 436
 437		icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex);
 438		dst = icmp6_dst_alloc(skb->dev, &fl6);
 439		if (IS_ERR(dst)) {
 440			kfree_skb(skb);
 441			return;
 442		}
 443
 444		skb_dst_set(skb, dst);
 445	}
 446
 447	icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 448					      IPPROTO_ICMPV6,
 449					      csum_partial(icmp6h,
 450							   skb->len, 0));
 451
 452	ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 453
 454	rcu_read_lock();
 455	idev = __in6_dev_get(dst->dev);
 456	IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 457
 458	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 
 459		      dst_output);
 460	if (!err) {
 461		ICMP6MSGOUT_INC_STATS(net, idev, type);
 462		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 463	}
 464
 465	rcu_read_unlock();
 466}
 467
 468void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 469		   const struct in6_addr *daddr,
 470		   const struct in6_addr *solicited_addr,
 471		   bool router, bool solicited, bool override, bool inc_opt)
 472{
 473	struct sk_buff *skb;
 474	struct in6_addr tmpaddr;
 475	struct inet6_ifaddr *ifp;
 476	const struct in6_addr *src_addr;
 477	struct nd_msg *msg;
 478	int optlen = 0;
 479
 480	/* for anycast or proxy, solicited_addr != src_addr */
 481	ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 482	if (ifp) {
 483		src_addr = solicited_addr;
 484		if (ifp->flags & IFA_F_OPTIMISTIC)
 485			override = false;
 486		inc_opt |= ifp->idev->cnf.force_tllao;
 487		in6_ifa_put(ifp);
 488	} else {
 489		if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 490				       inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 491				       &tmpaddr))
 492			return;
 493		src_addr = &tmpaddr;
 494	}
 495
 496	if (!dev->addr_len)
 497		inc_opt = 0;
 498	if (inc_opt)
 499		optlen += ndisc_opt_addr_space(dev);
 
 500
 501	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 502	if (!skb)
 503		return;
 504
 505	msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 506	*msg = (struct nd_msg) {
 507		.icmph = {
 508			.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 509			.icmp6_router = router,
 510			.icmp6_solicited = solicited,
 511			.icmp6_override = override,
 512		},
 513		.target = *solicited_addr,
 514	};
 515
 516	if (inc_opt)
 517		ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 518				       dev->dev_addr);
 519
 520
 521	ndisc_send_skb(skb, daddr, src_addr);
 522}
 523
 524static void ndisc_send_unsol_na(struct net_device *dev)
 525{
 526	struct inet6_dev *idev;
 527	struct inet6_ifaddr *ifa;
 528
 529	idev = in6_dev_get(dev);
 530	if (!idev)
 531		return;
 532
 533	read_lock_bh(&idev->lock);
 534	list_for_each_entry(ifa, &idev->addr_list, if_list) {
 535		ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
 
 
 
 
 
 536			      /*router=*/ !!idev->cnf.forwarding,
 537			      /*solicited=*/ false, /*override=*/ true,
 538			      /*inc_opt=*/ true);
 539	}
 540	read_unlock_bh(&idev->lock);
 541
 542	in6_dev_put(idev);
 543}
 544
 545void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 546		   const struct in6_addr *solicit,
 547		   const struct in6_addr *daddr, const struct in6_addr *saddr)
 548{
 549	struct sk_buff *skb;
 550	struct in6_addr addr_buf;
 551	int inc_opt = dev->addr_len;
 552	int optlen = 0;
 553	struct nd_msg *msg;
 554
 555	if (saddr == NULL) {
 556		if (ipv6_get_lladdr(dev, &addr_buf,
 557				   (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 558			return;
 559		saddr = &addr_buf;
 560	}
 561
 562	if (ipv6_addr_any(saddr))
 563		inc_opt = false;
 564	if (inc_opt)
 565		optlen += ndisc_opt_addr_space(dev);
 
 
 
 566
 567	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 568	if (!skb)
 569		return;
 570
 571	msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 572	*msg = (struct nd_msg) {
 573		.icmph = {
 574			.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 575		},
 576		.target = *solicit,
 577	};
 578
 579	if (inc_opt)
 580		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 581				       dev->dev_addr);
 
 
 
 
 
 
 
 
 582
 583	ndisc_send_skb(skb, daddr, saddr);
 584}
 585
 586void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 587		   const struct in6_addr *daddr)
 588{
 589	struct sk_buff *skb;
 590	struct rs_msg *msg;
 591	int send_sllao = dev->addr_len;
 592	int optlen = 0;
 593
 594#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 595	/*
 596	 * According to section 2.2 of RFC 4429, we must not
 597	 * send router solicitations with a sllao from
 598	 * optimistic addresses, but we may send the solicitation
 599	 * if we don't include the sllao.  So here we check
 600	 * if our address is optimistic, and if so, we
 601	 * suppress the inclusion of the sllao.
 602	 */
 603	if (send_sllao) {
 604		struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 605							   dev, 1);
 606		if (ifp) {
 607			if (ifp->flags & IFA_F_OPTIMISTIC)  {
 608				send_sllao = 0;
 609			}
 610			in6_ifa_put(ifp);
 611		} else {
 612			send_sllao = 0;
 613		}
 614	}
 615#endif
 616	if (send_sllao)
 617		optlen += ndisc_opt_addr_space(dev);
 618
 619	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 620	if (!skb)
 621		return;
 622
 623	msg = (struct rs_msg *)skb_put(skb, sizeof(*msg));
 624	*msg = (struct rs_msg) {
 625		.icmph = {
 626			.icmp6_type = NDISC_ROUTER_SOLICITATION,
 627		},
 628	};
 629
 630	if (send_sllao)
 631		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 632				       dev->dev_addr);
 
 633
 634	ndisc_send_skb(skb, daddr, saddr);
 635}
 636
 637
 638static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 639{
 640	/*
 641	 *	"The sender MUST return an ICMP
 642	 *	 destination unreachable"
 643	 */
 644	dst_link_failure(skb);
 645	kfree_skb(skb);
 646}
 647
 648/* Called with locked neigh: either read or both */
 649
 650static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 651{
 652	struct in6_addr *saddr = NULL;
 653	struct in6_addr mcaddr;
 654	struct net_device *dev = neigh->dev;
 655	struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 656	int probes = atomic_read(&neigh->probes);
 657
 658	if (skb && ipv6_chk_addr(dev_net(dev), &ipv6_hdr(skb)->saddr, dev, 1))
 
 
 659		saddr = &ipv6_hdr(skb)->saddr;
 660
 661	if ((probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES)) < 0) {
 662		if (!(neigh->nud_state & NUD_VALID)) {
 663			ND_PRINTK(1, dbg,
 664				  "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 665				  __func__, target);
 666		}
 667		ndisc_send_ns(dev, neigh, target, target, saddr);
 668	} else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 669		neigh_app_ns(neigh);
 670	} else {
 671		addrconf_addr_solict_mult(target, &mcaddr);
 672		ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 673	}
 674}
 675
 676static int pndisc_is_router(const void *pkey,
 677			    struct net_device *dev)
 678{
 679	struct pneigh_entry *n;
 680	int ret = -1;
 681
 682	read_lock_bh(&nd_tbl.lock);
 683	n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 684	if (n)
 685		ret = !!(n->flags & NTF_ROUTER);
 686	read_unlock_bh(&nd_tbl.lock);
 687
 688	return ret;
 689}
 690
 
 
 
 
 
 
 
 
 
 691static void ndisc_recv_ns(struct sk_buff *skb)
 692{
 693	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 694	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 695	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 696	u8 *lladdr = NULL;
 697	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 698				    offsetof(struct nd_msg, opt));
 699	struct ndisc_options ndopts;
 700	struct net_device *dev = skb->dev;
 701	struct inet6_ifaddr *ifp;
 702	struct inet6_dev *idev = NULL;
 703	struct neighbour *neigh;
 704	int dad = ipv6_addr_any(saddr);
 705	bool inc;
 706	int is_router = -1;
 
 707
 708	if (skb->len < sizeof(struct nd_msg)) {
 709		ND_PRINTK(2, warn, "NS: packet too short\n");
 710		return;
 711	}
 712
 713	if (ipv6_addr_is_multicast(&msg->target)) {
 714		ND_PRINTK(2, warn, "NS: multicast target address\n");
 715		return;
 716	}
 717
 718	/*
 719	 * RFC2461 7.1.1:
 720	 * DAD has to be destined for solicited node multicast address.
 721	 */
 722	if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 723		ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 724		return;
 725	}
 726
 727	if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 728		ND_PRINTK(2, warn, "NS: invalid ND options\n");
 729		return;
 730	}
 731
 732	if (ndopts.nd_opts_src_lladdr) {
 733		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 734		if (!lladdr) {
 735			ND_PRINTK(2, warn,
 736				  "NS: invalid link-layer address length\n");
 737			return;
 738		}
 739
 740		/* RFC2461 7.1.1:
 741		 *	If the IP source address is the unspecified address,
 742		 *	there MUST NOT be source link-layer address option
 743		 *	in the message.
 744		 */
 745		if (dad) {
 746			ND_PRINTK(2, warn,
 747				  "NS: bad DAD packet (link-layer address option)\n");
 748			return;
 749		}
 750	}
 
 
 751
 752	inc = ipv6_addr_is_multicast(daddr);
 753
 754	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 755	if (ifp) {
 756
 757		if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 758			if (dad) {
 
 
 
 
 
 
 
 
 
 759				/*
 760				 * We are colliding with another node
 761				 * who is doing DAD
 762				 * so fail our DAD process
 763				 */
 764				addrconf_dad_failure(ifp);
 765				return;
 766			} else {
 767				/*
 768				 * This is not a dad solicitation.
 769				 * If we are an optimistic node,
 770				 * we should respond.
 771				 * Otherwise, we should ignore it.
 772				 */
 773				if (!(ifp->flags & IFA_F_OPTIMISTIC))
 774					goto out;
 775			}
 776		}
 777
 778		idev = ifp->idev;
 779	} else {
 780		struct net *net = dev_net(dev);
 781
 
 
 
 
 
 
 
 
 
 
 
 
 782		idev = in6_dev_get(dev);
 783		if (!idev) {
 784			/* XXX: count this drop? */
 785			return;
 786		}
 787
 788		if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 789		    (idev->cnf.forwarding &&
 790		     (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 791		     (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 792			if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 793			    skb->pkt_type != PACKET_HOST &&
 794			    inc &&
 795			    NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 796				/*
 797				 * for anycast or proxy,
 798				 * sender should delay its response
 799				 * by a random time between 0 and
 800				 * MAX_ANYCAST_DELAY_TIME seconds.
 801				 * (RFC2461) -- yoshfuji
 802				 */
 803				struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 804				if (n)
 805					pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 806				goto out;
 807			}
 808		} else
 809			goto out;
 810	}
 811
 812	if (is_router < 0)
 813		is_router = idev->cnf.forwarding;
 814
 815	if (dad) {
 816		ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
 817			      !!is_router, false, (ifp != NULL), true);
 818		goto out;
 819	}
 820
 821	if (inc)
 822		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 823	else
 824		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 825
 826	/*
 827	 *	update / create cache entry
 828	 *	for the source address
 829	 */
 830	neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 831			       !inc || lladdr || !dev->addr_len);
 832	if (neigh)
 833		neigh_update(neigh, lladdr, NUD_STALE,
 834			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
 835			     NEIGH_UPDATE_F_OVERRIDE);
 
 836	if (neigh || !dev->header_ops) {
 837		ndisc_send_na(dev, neigh, saddr, &msg->target,
 838			      !!is_router,
 839			      true, (ifp != NULL && inc), inc);
 840		if (neigh)
 841			neigh_release(neigh);
 842	}
 843
 844out:
 845	if (ifp)
 846		in6_ifa_put(ifp);
 847	else
 848		in6_dev_put(idev);
 849}
 850
 851static void ndisc_recv_na(struct sk_buff *skb)
 852{
 853	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 854	struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 855	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 856	u8 *lladdr = NULL;
 857	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 858				    offsetof(struct nd_msg, opt));
 859	struct ndisc_options ndopts;
 860	struct net_device *dev = skb->dev;
 
 861	struct inet6_ifaddr *ifp;
 862	struct neighbour *neigh;
 863
 864	if (skb->len < sizeof(struct nd_msg)) {
 865		ND_PRINTK(2, warn, "NA: packet too short\n");
 866		return;
 867	}
 868
 869	if (ipv6_addr_is_multicast(&msg->target)) {
 870		ND_PRINTK(2, warn, "NA: target address is multicast\n");
 871		return;
 872	}
 873
 874	if (ipv6_addr_is_multicast(daddr) &&
 875	    msg->icmph.icmp6_solicited) {
 876		ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 877		return;
 878	}
 879
 880	if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 
 
 
 
 
 
 
 
 881		ND_PRINTK(2, warn, "NS: invalid ND option\n");
 882		return;
 883	}
 884	if (ndopts.nd_opts_tgt_lladdr) {
 885		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 886		if (!lladdr) {
 887			ND_PRINTK(2, warn,
 888				  "NA: invalid link-layer address length\n");
 889			return;
 890		}
 891	}
 892	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 893	if (ifp) {
 894		if (skb->pkt_type != PACKET_LOOPBACK
 895		    && (ifp->flags & IFA_F_TENTATIVE)) {
 896				addrconf_dad_failure(ifp);
 897				return;
 898		}
 899		/* What should we make now? The advertisement
 900		   is invalid, but ndisc specs say nothing
 901		   about it. It could be misconfiguration, or
 902		   an smart proxy agent tries to help us :-)
 903
 904		   We should not print the error if NA has been
 905		   received from loopback - it is just our own
 906		   unsolicited advertisement.
 907		 */
 908		if (skb->pkt_type != PACKET_LOOPBACK)
 909			ND_PRINTK(1, warn,
 910				  "NA: someone advertises our address %pI6 on %s!\n",
 911				  &ifp->addr, ifp->idev->dev->name);
 912		in6_ifa_put(ifp);
 913		return;
 914	}
 915	neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 916
 917	if (neigh) {
 918		u8 old_flags = neigh->flags;
 919		struct net *net = dev_net(dev);
 920
 921		if (neigh->nud_state & NUD_FAILED)
 922			goto out;
 923
 924		/*
 925		 * Don't update the neighbor cache entry on a proxy NA from
 926		 * ourselves because either the proxied node is off link or it
 927		 * has already sent a NA to us.
 928		 */
 929		if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 930		    net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
 931		    pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
 932			/* XXX: idev->cnf.proxy_ndp */
 933			goto out;
 934		}
 935
 936		neigh_update(neigh, lladdr,
 937			     msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 938			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
 939			     (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 940			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 941			     (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 
 942
 943		if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 944			/*
 945			 * Change: router to host
 946			 */
 947			rt6_clean_tohost(dev_net(dev),  saddr);
 948		}
 949
 950out:
 951		neigh_release(neigh);
 952	}
 953}
 954
 955static void ndisc_recv_rs(struct sk_buff *skb)
 956{
 957	struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 958	unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 959	struct neighbour *neigh;
 960	struct inet6_dev *idev;
 961	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 962	struct ndisc_options ndopts;
 963	u8 *lladdr = NULL;
 964
 965	if (skb->len < sizeof(*rs_msg))
 966		return;
 967
 968	idev = __in6_dev_get(skb->dev);
 969	if (!idev) {
 970		ND_PRINTK(1, err, "RS: can't find in6 device\n");
 971		return;
 972	}
 973
 974	/* Don't accept RS if we're not in router mode */
 975	if (!idev->cnf.forwarding)
 976		goto out;
 977
 978	/*
 979	 * Don't update NCE if src = ::;
 980	 * this implies that the source node has no ip address assigned yet.
 981	 */
 982	if (ipv6_addr_any(saddr))
 983		goto out;
 984
 985	/* Parse ND options */
 986	if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 987		ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
 988		goto out;
 989	}
 990
 991	if (ndopts.nd_opts_src_lladdr) {
 992		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
 993					     skb->dev);
 994		if (!lladdr)
 995			goto out;
 996	}
 997
 998	neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
 999	if (neigh) {
1000		neigh_update(neigh, lladdr, NUD_STALE,
1001			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1002			     NEIGH_UPDATE_F_OVERRIDE|
1003			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
 
1004		neigh_release(neigh);
1005	}
1006out:
1007	return;
1008}
1009
1010static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1011{
1012	struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1013	struct sk_buff *skb;
1014	struct nlmsghdr *nlh;
1015	struct nduseroptmsg *ndmsg;
1016	struct net *net = dev_net(ra->dev);
1017	int err;
1018	int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1019				    + (opt->nd_opt_len << 3));
1020	size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1021
1022	skb = nlmsg_new(msg_size, GFP_ATOMIC);
1023	if (skb == NULL) {
1024		err = -ENOBUFS;
1025		goto errout;
1026	}
1027
1028	nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1029	if (nlh == NULL) {
1030		goto nla_put_failure;
1031	}
1032
1033	ndmsg = nlmsg_data(nlh);
1034	ndmsg->nduseropt_family = AF_INET6;
1035	ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1036	ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1037	ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1038	ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1039
1040	memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1041
1042	if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1043		    &ipv6_hdr(ra)->saddr))
1044		goto nla_put_failure;
1045	nlmsg_end(skb, nlh);
1046
1047	rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1048	return;
1049
1050nla_put_failure:
1051	nlmsg_free(skb);
1052	err = -EMSGSIZE;
1053errout:
1054	rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1055}
1056
1057static void ndisc_router_discovery(struct sk_buff *skb)
1058{
1059	struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1060	struct neighbour *neigh = NULL;
1061	struct inet6_dev *in6_dev;
1062	struct rt6_info *rt = NULL;
1063	int lifetime;
1064	struct ndisc_options ndopts;
1065	int optlen;
1066	unsigned int pref = 0;
 
 
1067
1068	__u8 * opt = (__u8 *)(ra_msg + 1);
1069
1070	optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1071		sizeof(struct ra_msg);
1072
 
 
 
1073	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1074		ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1075		return;
1076	}
1077	if (optlen < 0) {
1078		ND_PRINTK(2, warn, "RA: packet too short\n");
1079		return;
1080	}
1081
1082#ifdef CONFIG_IPV6_NDISC_NODETYPE
1083	if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1084		ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1085		return;
1086	}
1087#endif
1088
1089	/*
1090	 *	set the RA_RECV flag in the interface
1091	 */
1092
1093	in6_dev = __in6_dev_get(skb->dev);
1094	if (in6_dev == NULL) {
1095		ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1096			  skb->dev->name);
1097		return;
1098	}
1099
1100	if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1101		ND_PRINTK(2, warn, "RA: invalid ND options\n");
1102		return;
1103	}
1104
1105	if (!ipv6_accept_ra(in6_dev))
 
 
 
1106		goto skip_linkparms;
 
1107
1108#ifdef CONFIG_IPV6_NDISC_NODETYPE
1109	/* skip link-specific parameters from interior routers */
1110	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
 
 
 
1111		goto skip_linkparms;
 
1112#endif
1113
1114	if (in6_dev->if_flags & IF_RS_SENT) {
1115		/*
1116		 *	flag that an RA was received after an RS was sent
1117		 *	out on this interface.
1118		 */
1119		in6_dev->if_flags |= IF_RA_RCVD;
1120	}
1121
1122	/*
1123	 * Remember the managed/otherconf flags from most recently
1124	 * received RA message (RFC 2462) -- yoshfuji
1125	 */
 
1126	in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1127				IF_RA_OTHERCONF)) |
1128				(ra_msg->icmph.icmp6_addrconf_managed ?
1129					IF_RA_MANAGED : 0) |
1130				(ra_msg->icmph.icmp6_addrconf_other ?
1131					IF_RA_OTHERCONF : 0);
1132
1133	if (!in6_dev->cnf.accept_ra_defrtr)
 
 
 
 
 
 
1134		goto skip_defrtr;
 
1135
1136	if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
 
 
 
 
 
 
 
 
1137		goto skip_defrtr;
 
1138
1139	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1140
1141#ifdef CONFIG_IPV6_ROUTER_PREF
1142	pref = ra_msg->icmph.icmp6_router_pref;
1143	/* 10b is handled as if it were 00b (medium) */
1144	if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1145	    !in6_dev->cnf.accept_ra_rtr_pref)
1146		pref = ICMPV6_ROUTER_PREF_MEDIUM;
1147#endif
1148
1149	rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1150
1151	if (rt) {
1152		neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1153		if (!neigh) {
1154			ND_PRINTK(0, err,
1155				  "RA: %s got default router without neighbour\n",
1156				  __func__);
1157			ip6_rt_put(rt);
1158			return;
1159		}
1160	}
1161	if (rt && lifetime == 0) {
1162		ip6_del_rt(rt);
1163		rt = NULL;
1164	}
1165
1166	if (rt == NULL && lifetime) {
1167		ND_PRINTK(3, dbg, "RA: adding default router\n");
 
 
1168
1169		rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1170		if (rt == NULL) {
1171			ND_PRINTK(0, err,
1172				  "RA: %s failed to add default route\n",
1173				  __func__);
1174			return;
1175		}
1176
1177		neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1178		if (neigh == NULL) {
1179			ND_PRINTK(0, err,
1180				  "RA: %s got default router without neighbour\n",
1181				  __func__);
1182			ip6_rt_put(rt);
1183			return;
1184		}
1185		neigh->flags |= NTF_ROUTER;
1186	} else if (rt) {
1187		rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1188	}
1189
1190	if (rt)
1191		rt6_set_expires(rt, jiffies + (HZ * lifetime));
1192	if (ra_msg->icmph.icmp6_hop_limit) {
1193		in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1194		if (rt)
1195			dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1196				       ra_msg->icmph.icmp6_hop_limit);
 
 
 
 
 
1197	}
1198
1199skip_defrtr:
1200
1201	/*
1202	 *	Update Reachable Time and Retrans Timer
1203	 */
1204
1205	if (in6_dev->nd_parms) {
1206		unsigned long rtime = ntohl(ra_msg->retrans_timer);
1207
1208		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1209			rtime = (rtime*HZ)/1000;
1210			if (rtime < HZ/10)
1211				rtime = HZ/10;
1212			NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1213			in6_dev->tstamp = jiffies;
1214			inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1215		}
1216
1217		rtime = ntohl(ra_msg->reachable_time);
1218		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1219			rtime = (rtime*HZ)/1000;
1220
1221			if (rtime < HZ/10)
1222				rtime = HZ/10;
1223
1224			if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1225				NEIGH_VAR_SET(in6_dev->nd_parms,
1226					      BASE_REACHABLE_TIME, rtime);
1227				NEIGH_VAR_SET(in6_dev->nd_parms,
1228					      GC_STALETIME, 3 * rtime);
1229				in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1230				in6_dev->tstamp = jiffies;
1231				inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1232			}
1233		}
1234	}
1235
 
 
 
 
 
 
1236skip_linkparms:
1237
1238	/*
1239	 *	Process options.
1240	 */
1241
1242	if (!neigh)
1243		neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1244				       skb->dev, 1);
1245	if (neigh) {
1246		u8 *lladdr = NULL;
1247		if (ndopts.nd_opts_src_lladdr) {
1248			lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1249						     skb->dev);
1250			if (!lladdr) {
1251				ND_PRINTK(2, warn,
1252					  "RA: invalid link-layer address length\n");
1253				goto out;
1254			}
1255		}
1256		neigh_update(neigh, lladdr, NUD_STALE,
1257			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1258			     NEIGH_UPDATE_F_OVERRIDE|
1259			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1260			     NEIGH_UPDATE_F_ISROUTER);
 
1261	}
1262
1263	if (!ipv6_accept_ra(in6_dev))
 
 
 
1264		goto out;
 
1265
1266#ifdef CONFIG_IPV6_ROUTE_INFO
1267	if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
 
 
 
 
 
1268		goto skip_routeinfo;
 
1269
1270	if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1271		struct nd_opt_hdr *p;
1272		for (p = ndopts.nd_opts_ri;
1273		     p;
1274		     p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1275			struct route_info *ri = (struct route_info *)p;
1276#ifdef CONFIG_IPV6_NDISC_NODETYPE
1277			if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1278			    ri->prefix_len == 0)
1279				continue;
1280#endif
1281			if (ri->prefix_len == 0 &&
1282			    !in6_dev->cnf.accept_ra_defrtr)
1283				continue;
 
 
1284			if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1285				continue;
1286			rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
1287				      &ipv6_hdr(skb)->saddr);
1288		}
1289	}
1290
1291skip_routeinfo:
1292#endif
1293
1294#ifdef CONFIG_IPV6_NDISC_NODETYPE
1295	/* skip link-specific ndopts from interior routers */
1296	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
 
 
 
1297		goto out;
 
1298#endif
1299
1300	if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1301		struct nd_opt_hdr *p;
1302		for (p = ndopts.nd_opts_pi;
1303		     p;
1304		     p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1305			addrconf_prefix_rcv(skb->dev, (u8 *)p,
1306					    (p->nd_opt_len) << 3,
1307					    ndopts.nd_opts_src_lladdr != NULL);
1308		}
1309	}
1310
1311	if (ndopts.nd_opts_mtu) {
1312		__be32 n;
1313		u32 mtu;
1314
1315		memcpy(&n, ((u8*)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1316		mtu = ntohl(n);
1317
1318		if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1319			ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1320		} else if (in6_dev->cnf.mtu6 != mtu) {
1321			in6_dev->cnf.mtu6 = mtu;
1322
1323			if (rt)
1324				dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1325
1326			rt6_mtu_change(skb->dev, mtu);
1327		}
1328	}
1329
1330	if (ndopts.nd_useropts) {
1331		struct nd_opt_hdr *p;
1332		for (p = ndopts.nd_useropts;
1333		     p;
1334		     p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
 
1335			ndisc_ra_useropt(skb, p);
1336		}
1337	}
1338
1339	if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1340		ND_PRINTK(2, warn, "RA: invalid RA options\n");
1341	}
1342out:
1343	ip6_rt_put(rt);
1344	if (neigh)
1345		neigh_release(neigh);
1346}
1347
1348static void ndisc_redirect_rcv(struct sk_buff *skb)
1349{
1350	u8 *hdr;
1351	struct ndisc_options ndopts;
1352	struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1353	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1354				    offsetof(struct rd_msg, opt));
1355
1356#ifdef CONFIG_IPV6_NDISC_NODETYPE
1357	switch (skb->ndisc_nodetype) {
1358	case NDISC_NODETYPE_HOST:
1359	case NDISC_NODETYPE_NODEFAULT:
1360		ND_PRINTK(2, warn,
1361			  "Redirect: from host or unauthorized router\n");
1362		return;
1363	}
1364#endif
1365
1366	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1367		ND_PRINTK(2, warn,
1368			  "Redirect: source address is not link-local\n");
1369		return;
1370	}
1371
1372	if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1373		return;
1374
1375	if (!ndopts.nd_opts_rh) {
1376		ip6_redirect_no_header(skb, dev_net(skb->dev),
1377					skb->dev->ifindex, 0);
1378		return;
1379	}
1380
1381	hdr = (u8 *)ndopts.nd_opts_rh;
1382	hdr += 8;
1383	if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1384		return;
1385
1386	icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1387}
1388
1389static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1390					   struct sk_buff *orig_skb,
1391					   int rd_len)
1392{
1393	u8 *opt = skb_put(skb, rd_len);
1394
1395	memset(opt, 0, 8);
1396	*(opt++) = ND_OPT_REDIRECT_HDR;
1397	*(opt++) = (rd_len >> 3);
1398	opt += 6;
1399
1400	memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
 
1401}
1402
1403void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1404{
1405	struct net_device *dev = skb->dev;
1406	struct net *net = dev_net(dev);
1407	struct sock *sk = net->ipv6.ndisc_sk;
1408	int optlen = 0;
1409	struct inet_peer *peer;
1410	struct sk_buff *buff;
1411	struct rd_msg *msg;
1412	struct in6_addr saddr_buf;
1413	struct rt6_info *rt;
1414	struct dst_entry *dst;
1415	struct flowi6 fl6;
1416	int rd_len;
1417	u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
 
1418	bool ret;
1419
1420	if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1421		ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1422			  dev->name);
1423		return;
1424	}
1425
1426	if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1427	    ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1428		ND_PRINTK(2, warn,
1429			  "Redirect: target address is not link-local unicast\n");
1430		return;
1431	}
1432
1433	icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1434			 &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1435
1436	dst = ip6_route_output(net, NULL, &fl6);
1437	if (dst->error) {
1438		dst_release(dst);
1439		return;
1440	}
1441	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1442	if (IS_ERR(dst))
1443		return;
1444
1445	rt = (struct rt6_info *) dst;
1446
1447	if (rt->rt6i_flags & RTF_GATEWAY) {
1448		ND_PRINTK(2, warn,
1449			  "Redirect: destination is not a neighbour\n");
1450		goto release;
1451	}
1452	peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
1453	ret = inet_peer_xrlim_allow(peer, 1*HZ);
1454	if (peer)
1455		inet_putpeer(peer);
1456	if (!ret)
1457		goto release;
1458
1459	if (dev->addr_len) {
1460		struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1461		if (!neigh) {
1462			ND_PRINTK(2, warn,
1463				  "Redirect: no neigh for target address\n");
1464			goto release;
1465		}
1466
1467		read_lock_bh(&neigh->lock);
1468		if (neigh->nud_state & NUD_VALID) {
1469			memcpy(ha_buf, neigh->ha, dev->addr_len);
1470			read_unlock_bh(&neigh->lock);
1471			ha = ha_buf;
1472			optlen += ndisc_opt_addr_space(dev);
 
 
1473		} else
1474			read_unlock_bh(&neigh->lock);
1475
1476		neigh_release(neigh);
1477	}
1478
1479	rd_len = min_t(unsigned int,
1480		       IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1481		       skb->len + 8);
1482	rd_len &= ~0x7;
1483	optlen += rd_len;
1484
1485	buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1486	if (!buff)
1487		goto release;
1488
1489	msg = (struct rd_msg *)skb_put(buff, sizeof(*msg));
1490	*msg = (struct rd_msg) {
1491		.icmph = {
1492			.icmp6_type = NDISC_REDIRECT,
1493		},
1494		.target = *target,
1495		.dest = ipv6_hdr(skb)->daddr,
1496	};
1497
1498	/*
1499	 *	include target_address option
1500	 */
1501
1502	if (ha)
1503		ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
1504
1505	/*
1506	 *	build redirect option and copy skb over to the new packet.
1507	 */
1508
1509	if (rd_len)
1510		ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1511
1512	skb_dst_set(buff, dst);
1513	ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1514	return;
1515
1516release:
1517	dst_release(dst);
1518}
1519
1520static void pndisc_redo(struct sk_buff *skb)
1521{
1522	ndisc_recv_ns(skb);
1523	kfree_skb(skb);
1524}
1525
1526static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1527{
1528	struct inet6_dev *idev = __in6_dev_get(skb->dev);
1529
1530	if (!idev)
1531		return true;
1532	if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1533	    idev->cnf.suppress_frag_ndisc) {
1534		net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1535		return true;
1536	}
1537	return false;
1538}
1539
1540int ndisc_rcv(struct sk_buff *skb)
1541{
1542	struct nd_msg *msg;
1543
1544	if (ndisc_suppress_frag_ndisc(skb))
1545		return 0;
1546
1547	if (skb_linearize(skb))
1548		return 0;
1549
1550	msg = (struct nd_msg *)skb_transport_header(skb);
1551
1552	__skb_push(skb, skb->data - skb_transport_header(skb));
1553
1554	if (ipv6_hdr(skb)->hop_limit != 255) {
1555		ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1556			  ipv6_hdr(skb)->hop_limit);
1557		return 0;
1558	}
1559
1560	if (msg->icmph.icmp6_code != 0) {
1561		ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1562			  msg->icmph.icmp6_code);
1563		return 0;
1564	}
1565
1566	memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1567
1568	switch (msg->icmph.icmp6_type) {
1569	case NDISC_NEIGHBOUR_SOLICITATION:
1570		ndisc_recv_ns(skb);
1571		break;
1572
1573	case NDISC_NEIGHBOUR_ADVERTISEMENT:
1574		ndisc_recv_na(skb);
1575		break;
1576
1577	case NDISC_ROUTER_SOLICITATION:
1578		ndisc_recv_rs(skb);
1579		break;
1580
1581	case NDISC_ROUTER_ADVERTISEMENT:
1582		ndisc_router_discovery(skb);
1583		break;
1584
1585	case NDISC_REDIRECT:
1586		ndisc_redirect_rcv(skb);
1587		break;
1588	}
1589
1590	return 0;
1591}
1592
1593static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1594{
1595	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 
1596	struct net *net = dev_net(dev);
1597	struct inet6_dev *idev;
1598
1599	switch (event) {
1600	case NETDEV_CHANGEADDR:
1601		neigh_changeaddr(&nd_tbl, dev);
1602		fib6_run_gc(0, net, false);
 
 
1603		idev = in6_dev_get(dev);
1604		if (!idev)
1605			break;
1606		if (idev->cnf.ndisc_notify)
 
1607			ndisc_send_unsol_na(dev);
1608		in6_dev_put(idev);
1609		break;
 
 
 
 
 
1610	case NETDEV_DOWN:
1611		neigh_ifdown(&nd_tbl, dev);
1612		fib6_run_gc(0, net, false);
1613		break;
1614	case NETDEV_NOTIFY_PEERS:
1615		ndisc_send_unsol_na(dev);
1616		break;
1617	default:
1618		break;
1619	}
1620
1621	return NOTIFY_DONE;
1622}
1623
1624static struct notifier_block ndisc_netdev_notifier = {
1625	.notifier_call = ndisc_netdev_event,
 
1626};
1627
1628#ifdef CONFIG_SYSCTL
1629static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1630					 const char *func, const char *dev_name)
1631{
1632	static char warncomm[TASK_COMM_LEN];
1633	static int warned;
1634	if (strcmp(warncomm, current->comm) && warned < 5) {
1635		strcpy(warncomm, current->comm);
1636		pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1637			warncomm, func,
1638			dev_name, ctl->procname,
1639			dev_name, ctl->procname);
1640		warned++;
1641	}
1642}
1643
1644int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1645{
1646	struct net_device *dev = ctl->extra1;
1647	struct inet6_dev *idev;
1648	int ret;
1649
1650	if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1651	    (strcmp(ctl->procname, "base_reachable_time") == 0))
1652		ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1653
1654	if (strcmp(ctl->procname, "retrans_time") == 0)
1655		ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1656
1657	else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1658		ret = neigh_proc_dointvec_jiffies(ctl, write,
1659						  buffer, lenp, ppos);
1660
1661	else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1662		 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1663		ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1664						     buffer, lenp, ppos);
1665	else
1666		ret = -1;
1667
1668	if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1669		if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1670			idev->nd_parms->reachable_time =
1671					neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1672		idev->tstamp = jiffies;
1673		inet6_ifinfo_notify(RTM_NEWLINK, idev);
1674		in6_dev_put(idev);
1675	}
1676	return ret;
1677}
1678
1679
1680#endif
1681
1682static int __net_init ndisc_net_init(struct net *net)
1683{
1684	struct ipv6_pinfo *np;
1685	struct sock *sk;
1686	int err;
1687
1688	err = inet_ctl_sock_create(&sk, PF_INET6,
1689				   SOCK_RAW, IPPROTO_ICMPV6, net);
1690	if (err < 0) {
1691		ND_PRINTK(0, err,
1692			  "NDISC: Failed to initialize the control socket (err %d)\n",
1693			  err);
1694		return err;
1695	}
1696
1697	net->ipv6.ndisc_sk = sk;
1698
1699	np = inet6_sk(sk);
1700	np->hop_limit = 255;
1701	/* Do not loopback ndisc messages */
1702	np->mc_loop = 0;
1703
1704	return 0;
1705}
1706
1707static void __net_exit ndisc_net_exit(struct net *net)
1708{
1709	inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1710}
1711
1712static struct pernet_operations ndisc_net_ops = {
1713	.init = ndisc_net_init,
1714	.exit = ndisc_net_exit,
1715};
1716
1717int __init ndisc_init(void)
1718{
1719	int err;
1720
1721	err = register_pernet_subsys(&ndisc_net_ops);
1722	if (err)
1723		return err;
1724	/*
1725	 * Initialize the neighbour table
1726	 */
1727	neigh_table_init(&nd_tbl);
1728
1729#ifdef CONFIG_SYSCTL
1730	err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1731				    &ndisc_ifinfo_sysctl_change);
1732	if (err)
1733		goto out_unregister_pernet;
1734out:
1735#endif
1736	return err;
1737
1738#ifdef CONFIG_SYSCTL
1739out_unregister_pernet:
1740	unregister_pernet_subsys(&ndisc_net_ops);
1741	goto out;
1742#endif
1743}
1744
1745int __init ndisc_late_init(void)
1746{
1747	return register_netdevice_notifier(&ndisc_netdev_notifier);
1748}
1749
1750void ndisc_late_cleanup(void)
1751{
1752	unregister_netdevice_notifier(&ndisc_netdev_notifier);
1753}
1754
1755void ndisc_cleanup(void)
1756{
1757#ifdef CONFIG_SYSCTL
1758	neigh_sysctl_unregister(&nd_tbl.parms);
1759#endif
1760	neigh_table_clear(&nd_tbl);
1761	unregister_pernet_subsys(&ndisc_net_ops);
1762}