1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *	Neighbour Discovery for IPv6
   4 *	Linux INET6 implementation
   5 *
   6 *	Authors:
   7 *	Pedro Roque		<roque@di.fc.ul.pt>
   8 *	Mike Shaver		<shaver@ingenia.com>
   9 */
  10
  11/*
  12 *	Changes:
  13 *
  14 *	Alexey I. Froloff		:	RFC6106 (DNSSL) support
  15 *	Pierre Ynard			:	export userland ND options
  16 *						through netlink (RDNSS support)
  17 *	Lars Fenneberg			:	fixed MTU setting on receipt
  18 *						of an RA.
  19 *	Janos Farkas			:	kmalloc failure checks
  20 *	Alexey Kuznetsov		:	state machine reworked
  21 *						and moved to net/core.
  22 *	Pekka Savola			:	RFC2461 validation
  23 *	YOSHIFUJI Hideaki @USAGI	:	Verify ND options properly
  24 */
  25
  26#define pr_fmt(fmt) "ICMPv6: " fmt
  27
  28#include <linux/module.h>
  29#include <linux/errno.h>
  30#include <linux/types.h>
  31#include <linux/socket.h>
  32#include <linux/sockios.h>
  33#include <linux/sched.h>
  34#include <linux/net.h>
  35#include <linux/in6.h>
  36#include <linux/route.h>
  37#include <linux/init.h>
  38#include <linux/rcupdate.h>
  39#include <linux/slab.h>
  40#ifdef CONFIG_SYSCTL
  41#include <linux/sysctl.h>
  42#endif
  43
  44#include <linux/if_addr.h>
  45#include <linux/if_ether.h>
  46#include <linux/if_arp.h>
  47#include <linux/ipv6.h>
  48#include <linux/icmpv6.h>
  49#include <linux/jhash.h>
  50
  51#include <net/sock.h>
  52#include <net/snmp.h>
  53
  54#include <net/ipv6.h>
  55#include <net/protocol.h>
  56#include <net/ndisc.h>
  57#include <net/ip6_route.h>
  58#include <net/addrconf.h>
  59#include <net/icmp.h>
  60
  61#include <net/netlink.h>
  62#include <linux/rtnetlink.h>
  63
  64#include <net/flow.h>
  65#include <net/ip6_checksum.h>
  66#include <net/inet_common.h>
  67#include <linux/proc_fs.h>
  68
  69#include <linux/netfilter.h>
  70#include <linux/netfilter_ipv6.h>
  71
  72static u32 ndisc_hash(const void *pkey,
  73		      const struct net_device *dev,
  74		      __u32 *hash_rnd);
  75static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
  76static bool ndisc_allow_add(const struct net_device *dev,
  77			    struct netlink_ext_ack *extack);
  78static int ndisc_constructor(struct neighbour *neigh);
  79static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  80static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  81static int pndisc_constructor(struct pneigh_entry *n);
  82static void pndisc_destructor(struct pneigh_entry *n);
  83static void pndisc_redo(struct sk_buff *skb);
  84static int ndisc_is_multicast(const void *pkey);
  85
  86static const struct neigh_ops ndisc_generic_ops = {
  87	.family =		AF_INET6,
  88	.solicit =		ndisc_solicit,
  89	.error_report =		ndisc_error_report,
  90	.output =		neigh_resolve_output,
  91	.connected_output =	neigh_connected_output,
  92};
  93
  94static const struct neigh_ops ndisc_hh_ops = {
  95	.family =		AF_INET6,
  96	.solicit =		ndisc_solicit,
  97	.error_report =		ndisc_error_report,
  98	.output =		neigh_resolve_output,
  99	.connected_output =	neigh_resolve_output,
 100};
 101
 102
 103static const struct neigh_ops ndisc_direct_ops = {
 104	.family =		AF_INET6,
 105	.output =		neigh_direct_output,
 106	.connected_output =	neigh_direct_output,
 107};
 108
 109struct neigh_table nd_tbl = {
 110	.family =	AF_INET6,
 111	.key_len =	sizeof(struct in6_addr),
 112	.protocol =	cpu_to_be16(ETH_P_IPV6),
 113	.hash =		ndisc_hash,
 114	.key_eq =	ndisc_key_eq,
 115	.constructor =	ndisc_constructor,
 116	.pconstructor =	pndisc_constructor,
 117	.pdestructor =	pndisc_destructor,
 118	.proxy_redo =	pndisc_redo,
 119	.is_multicast =	ndisc_is_multicast,
 120	.allow_add  =   ndisc_allow_add,
 121	.id =		"ndisc_cache",
 122	.parms = {
 123		.tbl			= &nd_tbl,
 124		.reachable_time		= ND_REACHABLE_TIME,
 125		.data = {
 126			[NEIGH_VAR_MCAST_PROBES] = 3,
 127			[NEIGH_VAR_UCAST_PROBES] = 3,
 128			[NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 129			[NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 130			[NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 131			[NEIGH_VAR_INTERVAL_PROBE_TIME_MS] = 5 * HZ,
 132			[NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 133			[NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
 134			[NEIGH_VAR_PROXY_QLEN] = 64,
 135			[NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 136			[NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 137		},
 138	},
 139	.gc_interval =	  30 * HZ,
 140	.gc_thresh1 =	 128,
 141	.gc_thresh2 =	 512,
 142	.gc_thresh3 =	1024,
 143};
 144EXPORT_SYMBOL_GPL(nd_tbl);
 145
 146void __ndisc_fill_addr_option(struct sk_buff *skb, int type, const void *data,
 147			      int data_len, int pad)
 148{
 149	int space = __ndisc_opt_addr_space(data_len, pad);
 150	u8 *opt = skb_put(skb, space);
 151
 152	opt[0] = type;
 153	opt[1] = space>>3;
 154
 155	memset(opt + 2, 0, pad);
 156	opt   += pad;
 157	space -= pad;
 158
 159	memcpy(opt+2, data, data_len);
 160	data_len += 2;
 161	opt += data_len;
 162	space -= data_len;
 163	if (space > 0)
 164		memset(opt, 0, space);
 165}
 166EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
 167
 168static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
 169					  const void *data, u8 icmp6_type)
 170{
 171	__ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
 172				 ndisc_addr_option_pad(skb->dev->type));
 173	ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
 174}
 175
 176static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
 177						   void *ha,
 178						   const u8 *ops_data)
 179{
 180	ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
 181	ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
 182}
 183
 184static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 185					    struct nd_opt_hdr *end)
 186{
 187	int type;
 188	if (!cur || !end || cur >= end)
 189		return NULL;
 190	type = cur->nd_opt_type;
 191	do {
 192		cur = ((void *)cur) + (cur->nd_opt_len << 3);
 193	} while (cur < end && cur->nd_opt_type != type);
 194	return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 195}
 196
 197static inline int ndisc_is_useropt(const struct net_device *dev,
 198				   struct nd_opt_hdr *opt)
 199{
 200	return opt->nd_opt_type == ND_OPT_PREFIX_INFO ||
 201		opt->nd_opt_type == ND_OPT_RDNSS ||
 202		opt->nd_opt_type == ND_OPT_DNSSL ||
 203		opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
 204		opt->nd_opt_type == ND_OPT_PREF64 ||
 205		ndisc_ops_is_useropt(dev, opt->nd_opt_type);
 206}
 207
 208static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
 209					     struct nd_opt_hdr *cur,
 210					     struct nd_opt_hdr *end)
 211{
 212	if (!cur || !end || cur >= end)
 213		return NULL;
 214	do {
 215		cur = ((void *)cur) + (cur->nd_opt_len << 3);
 216	} while (cur < end && !ndisc_is_useropt(dev, cur));
 217	return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
 218}
 219
 220struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 221					  u8 *opt, int opt_len,
 222					  struct ndisc_options *ndopts)
 223{
 224	struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 225
 226	if (!nd_opt || opt_len < 0 || !ndopts)
 227		return NULL;
 228	memset(ndopts, 0, sizeof(*ndopts));
 229	while (opt_len) {
 230		int l;
 231		if (opt_len < sizeof(struct nd_opt_hdr))
 232			return NULL;
 233		l = nd_opt->nd_opt_len << 3;
 234		if (opt_len < l || l == 0)
 235			return NULL;
 236		if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
 237			goto next_opt;
 238		switch (nd_opt->nd_opt_type) {
 239		case ND_OPT_SOURCE_LL_ADDR:
 240		case ND_OPT_TARGET_LL_ADDR:
 241		case ND_OPT_MTU:
 242		case ND_OPT_NONCE:
 243		case ND_OPT_REDIRECT_HDR:
 244			if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 245				ND_PRINTK(2, warn,
 246					  "%s: duplicated ND6 option found: type=%d\n",
 247					  __func__, nd_opt->nd_opt_type);
 248			} else {
 249				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 250			}
 251			break;
 252		case ND_OPT_PREFIX_INFO:
 253			ndopts->nd_opts_pi_end = nd_opt;
 254			if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 255				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 256			break;
 257#ifdef CONFIG_IPV6_ROUTE_INFO
 258		case ND_OPT_ROUTE_INFO:
 259			ndopts->nd_opts_ri_end = nd_opt;
 260			if (!ndopts->nd_opts_ri)
 261				ndopts->nd_opts_ri = nd_opt;
 262			break;
 263#endif
 264		default:
 265			if (ndisc_is_useropt(dev, nd_opt)) {
 266				ndopts->nd_useropts_end = nd_opt;
 267				if (!ndopts->nd_useropts)
 268					ndopts->nd_useropts = nd_opt;
 269			} else {
 270				/*
 271				 * Unknown options must be silently ignored,
 272				 * to accommodate future extension to the
 273				 * protocol.
 274				 */
 275				ND_PRINTK(2, notice,
 276					  "%s: ignored unsupported option; type=%d, len=%d\n",
 277					  __func__,
 278					  nd_opt->nd_opt_type,
 279					  nd_opt->nd_opt_len);
 280			}
 281		}
 282next_opt:
 283		opt_len -= l;
 284		nd_opt = ((void *)nd_opt) + l;
 285	}
 286	return ndopts;
 287}
 288
 289int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 290{
 291	switch (dev->type) {
 292	case ARPHRD_ETHER:
 293	case ARPHRD_IEEE802:	/* Not sure. Check it later. --ANK */
 294	case ARPHRD_FDDI:
 295		ipv6_eth_mc_map(addr, buf);
 296		return 0;
 297	case ARPHRD_ARCNET:
 298		ipv6_arcnet_mc_map(addr, buf);
 299		return 0;
 300	case ARPHRD_INFINIBAND:
 301		ipv6_ib_mc_map(addr, dev->broadcast, buf);
 302		return 0;
 303	case ARPHRD_IPGRE:
 304		return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 305	default:
 306		if (dir) {
 307			memcpy(buf, dev->broadcast, dev->addr_len);
 308			return 0;
 309		}
 310	}
 311	return -EINVAL;
 312}
 313EXPORT_SYMBOL(ndisc_mc_map);
 314
 315static u32 ndisc_hash(const void *pkey,
 316		      const struct net_device *dev,
 317		      __u32 *hash_rnd)
 318{
 319	return ndisc_hashfn(pkey, dev, hash_rnd);
 320}
 321
 322static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
 323{
 324	return neigh_key_eq128(n, pkey);
 325}
 326
 327static int ndisc_constructor(struct neighbour *neigh)
 328{
 329	struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 330	struct net_device *dev = neigh->dev;
 331	struct inet6_dev *in6_dev;
 332	struct neigh_parms *parms;
 333	bool is_multicast = ipv6_addr_is_multicast(addr);
 334
 335	in6_dev = in6_dev_get(dev);
 336	if (!in6_dev) {
 337		return -EINVAL;
 338	}
 339
 340	parms = in6_dev->nd_parms;
 341	__neigh_parms_put(neigh->parms);
 342	neigh->parms = neigh_parms_clone(parms);
 343
 344	neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 345	if (!dev->header_ops) {
 346		neigh->nud_state = NUD_NOARP;
 347		neigh->ops = &ndisc_direct_ops;
 348		neigh->output = neigh_direct_output;
 349	} else {
 350		if (is_multicast) {
 351			neigh->nud_state = NUD_NOARP;
 352			ndisc_mc_map(addr, neigh->ha, dev, 1);
 353		} else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 354			neigh->nud_state = NUD_NOARP;
 355			memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 356			if (dev->flags&IFF_LOOPBACK)
 357				neigh->type = RTN_LOCAL;
 358		} else if (dev->flags&IFF_POINTOPOINT) {
 359			neigh->nud_state = NUD_NOARP;
 360			memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 361		}
 362		if (dev->header_ops->cache)
 363			neigh->ops = &ndisc_hh_ops;
 364		else
 365			neigh->ops = &ndisc_generic_ops;
 366		if (neigh->nud_state&NUD_VALID)
 367			neigh->output = neigh->ops->connected_output;
 368		else
 369			neigh->output = neigh->ops->output;
 370	}
 371	in6_dev_put(in6_dev);
 372	return 0;
 373}
 374
 375static int pndisc_constructor(struct pneigh_entry *n)
 376{
 377	struct in6_addr *addr = (struct in6_addr *)&n->key;
 378	struct in6_addr maddr;
 379	struct net_device *dev = n->dev;
 380
 381	if (!dev || !__in6_dev_get(dev))
 382		return -EINVAL;
 383	addrconf_addr_solict_mult(addr, &maddr);
 384	ipv6_dev_mc_inc(dev, &maddr);
 385	return 0;
 386}
 387
 388static void pndisc_destructor(struct pneigh_entry *n)
 389{
 390	struct in6_addr *addr = (struct in6_addr *)&n->key;
 391	struct in6_addr maddr;
 392	struct net_device *dev = n->dev;
 393
 394	if (!dev || !__in6_dev_get(dev))
 395		return;
 396	addrconf_addr_solict_mult(addr, &maddr);
 397	ipv6_dev_mc_dec(dev, &maddr);
 398}
 399
 400/* called with rtnl held */
 401static bool ndisc_allow_add(const struct net_device *dev,
 402			    struct netlink_ext_ack *extack)
 403{
 404	struct inet6_dev *idev = __in6_dev_get(dev);
 405
 406	if (!idev || idev->cnf.disable_ipv6) {
 407		NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device");
 408		return false;
 409	}
 410
 411	return true;
 412}
 413
 414static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 415				       int len)
 416{
 417	int hlen = LL_RESERVED_SPACE(dev);
 418	int tlen = dev->needed_tailroom;
 419	struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 420	struct sk_buff *skb;
 421
 422	skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 423	if (!skb) {
 424		ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 425			  __func__);
 426		return NULL;
 427	}
 428
 429	skb->protocol = htons(ETH_P_IPV6);
 430	skb->dev = dev;
 431
 432	skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 433	skb_reset_transport_header(skb);
 434
 435	/* Manually assign socket ownership as we avoid calling
 436	 * sock_alloc_send_pskb() to bypass wmem buffer limits
 437	 */
 438	skb_set_owner_w(skb, sk);
 439
 440	return skb;
 441}
 442
 443static void ip6_nd_hdr(struct sk_buff *skb,
 444		       const struct in6_addr *saddr,
 445		       const struct in6_addr *daddr,
 446		       int hop_limit, int len)
 447{
 448	struct ipv6hdr *hdr;
 449	struct inet6_dev *idev;
 450	unsigned tclass;
 451
 452	rcu_read_lock();
 453	idev = __in6_dev_get(skb->dev);
 454	tclass = idev ? idev->cnf.ndisc_tclass : 0;
 455	rcu_read_unlock();
 456
 457	skb_push(skb, sizeof(*hdr));
 458	skb_reset_network_header(skb);
 459	hdr = ipv6_hdr(skb);
 460
 461	ip6_flow_hdr(hdr, tclass, 0);
 462
 463	hdr->payload_len = htons(len);
 464	hdr->nexthdr = IPPROTO_ICMPV6;
 465	hdr->hop_limit = hop_limit;
 466
 467	hdr->saddr = *saddr;
 468	hdr->daddr = *daddr;
 469}
 470
 471void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
 472		    const struct in6_addr *saddr)
 
 473{
 474	struct dst_entry *dst = skb_dst(skb);
 475	struct net *net = dev_net(skb->dev);
 476	struct sock *sk = net->ipv6.ndisc_sk;
 477	struct inet6_dev *idev;
 478	int err;
 479	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 480	u8 type;
 481
 482	type = icmp6h->icmp6_type;
 483
 484	if (!dst) {
 485		struct flowi6 fl6;
 486		int oif = skb->dev->ifindex;
 487
 488		icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 489		dst = icmp6_dst_alloc(skb->dev, &fl6);
 490		if (IS_ERR(dst)) {
 491			kfree_skb(skb);
 492			return;
 493		}
 494
 495		skb_dst_set(skb, dst);
 496	}
 497
 498	icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 499					      IPPROTO_ICMPV6,
 500					      csum_partial(icmp6h,
 501							   skb->len, 0));
 502
 503	ip6_nd_hdr(skb, saddr, daddr, READ_ONCE(inet6_sk(sk)->hop_limit), skb->len);
 504
 505	rcu_read_lock();
 506	idev = __in6_dev_get(dst->dev);
 507	IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
 508
 509	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
 510		      net, sk, skb, NULL, dst->dev,
 511		      dst_output);
 512	if (!err) {
 513		ICMP6MSGOUT_INC_STATS(net, idev, type);
 514		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 515	}
 516
 517	rcu_read_unlock();
 518}
 519EXPORT_SYMBOL(ndisc_send_skb);
 520
 521void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
 522		   const struct in6_addr *solicited_addr,
 523		   bool router, bool solicited, bool override, bool inc_opt)
 524{
 525	struct sk_buff *skb;
 526	struct in6_addr tmpaddr;
 527	struct inet6_ifaddr *ifp;
 528	const struct in6_addr *src_addr;
 529	struct nd_msg *msg;
 530	int optlen = 0;
 531
 532	/* for anycast or proxy, solicited_addr != src_addr */
 533	ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 534	if (ifp) {
 535		src_addr = solicited_addr;
 536		if (ifp->flags & IFA_F_OPTIMISTIC)
 537			override = false;
 538		inc_opt |= ifp->idev->cnf.force_tllao;
 539		in6_ifa_put(ifp);
 540	} else {
 541		if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 542				       inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 543				       &tmpaddr))
 544			return;
 545		src_addr = &tmpaddr;
 546	}
 547
 548	if (!dev->addr_len)
 549		inc_opt = false;
 550	if (inc_opt)
 551		optlen += ndisc_opt_addr_space(dev,
 552					       NDISC_NEIGHBOUR_ADVERTISEMENT);
 553
 554	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 555	if (!skb)
 556		return;
 557
 558	msg = skb_put(skb, sizeof(*msg));
 559	*msg = (struct nd_msg) {
 560		.icmph = {
 561			.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 562			.icmp6_router = router,
 563			.icmp6_solicited = solicited,
 564			.icmp6_override = override,
 565		},
 566		.target = *solicited_addr,
 567	};
 568
 569	if (inc_opt)
 570		ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 571				       dev->dev_addr,
 572				       NDISC_NEIGHBOUR_ADVERTISEMENT);
 573
 574	ndisc_send_skb(skb, daddr, src_addr);
 575}
 576
 577static void ndisc_send_unsol_na(struct net_device *dev)
 578{
 579	struct inet6_dev *idev;
 580	struct inet6_ifaddr *ifa;
 581
 582	idev = in6_dev_get(dev);
 583	if (!idev)
 584		return;
 585
 586	read_lock_bh(&idev->lock);
 587	list_for_each_entry(ifa, &idev->addr_list, if_list) {
 588		/* skip tentative addresses until dad completes */
 589		if (ifa->flags & IFA_F_TENTATIVE &&
 590		    !(ifa->flags & IFA_F_OPTIMISTIC))
 591			continue;
 592
 593		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
 594			      /*router=*/ !!idev->cnf.forwarding,
 595			      /*solicited=*/ false, /*override=*/ true,
 596			      /*inc_opt=*/ true);
 597	}
 598	read_unlock_bh(&idev->lock);
 599
 600	in6_dev_put(idev);
 601}
 602
 603struct sk_buff *ndisc_ns_create(struct net_device *dev, const struct in6_addr *solicit,
 604				const struct in6_addr *saddr, u64 nonce)
 
 605{
 606	int inc_opt = dev->addr_len;
 607	struct sk_buff *skb;
 608	struct nd_msg *msg;
 
 609	int optlen = 0;
 
 610
 611	if (!saddr)
 612		return NULL;
 
 
 
 
 613
 614	if (ipv6_addr_any(saddr))
 615		inc_opt = false;
 616	if (inc_opt)
 617		optlen += ndisc_opt_addr_space(dev,
 618					       NDISC_NEIGHBOUR_SOLICITATION);
 619	if (nonce != 0)
 620		optlen += 8;
 621
 622	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 623	if (!skb)
 624		return NULL;
 625
 626	msg = skb_put(skb, sizeof(*msg));
 627	*msg = (struct nd_msg) {
 628		.icmph = {
 629			.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 630		},
 631		.target = *solicit,
 632	};
 633
 634	if (inc_opt)
 635		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 636				       dev->dev_addr,
 637				       NDISC_NEIGHBOUR_SOLICITATION);
 638	if (nonce != 0) {
 639		u8 *opt = skb_put(skb, 8);
 640
 641		opt[0] = ND_OPT_NONCE;
 642		opt[1] = 8 >> 3;
 643		memcpy(opt + 2, &nonce, 6);
 644	}
 645
 646	return skb;
 647}
 648EXPORT_SYMBOL(ndisc_ns_create);
 649
 650void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
 651		   const struct in6_addr *daddr, const struct in6_addr *saddr,
 652		   u64 nonce)
 653{
 654	struct in6_addr addr_buf;
 655	struct sk_buff *skb;
 656
 657	if (!saddr) {
 658		if (ipv6_get_lladdr(dev, &addr_buf,
 659				    (IFA_F_TENTATIVE | IFA_F_OPTIMISTIC)))
 660			return;
 661		saddr = &addr_buf;
 662	}
 663
 664	skb = ndisc_ns_create(dev, solicit, saddr, nonce);
 665
 666	if (skb)
 667		ndisc_send_skb(skb, daddr, saddr);
 668}
 669
 670void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 671		   const struct in6_addr *daddr)
 672{
 673	struct sk_buff *skb;
 674	struct rs_msg *msg;
 675	int send_sllao = dev->addr_len;
 676	int optlen = 0;
 677
 678#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 679	/*
 680	 * According to section 2.2 of RFC 4429, we must not
 681	 * send router solicitations with a sllao from
 682	 * optimistic addresses, but we may send the solicitation
 683	 * if we don't include the sllao.  So here we check
 684	 * if our address is optimistic, and if so, we
 685	 * suppress the inclusion of the sllao.
 686	 */
 687	if (send_sllao) {
 688		struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 689							   dev, 1);
 690		if (ifp) {
 691			if (ifp->flags & IFA_F_OPTIMISTIC)  {
 692				send_sllao = 0;
 693			}
 694			in6_ifa_put(ifp);
 695		} else {
 696			send_sllao = 0;
 697		}
 698	}
 699#endif
 700	if (send_sllao)
 701		optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
 702
 703	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 704	if (!skb)
 705		return;
 706
 707	msg = skb_put(skb, sizeof(*msg));
 708	*msg = (struct rs_msg) {
 709		.icmph = {
 710			.icmp6_type = NDISC_ROUTER_SOLICITATION,
 711		},
 712	};
 713
 714	if (send_sllao)
 715		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 716				       dev->dev_addr,
 717				       NDISC_ROUTER_SOLICITATION);
 718
 719	ndisc_send_skb(skb, daddr, saddr);
 720}
 721
 722
 723static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 724{
 725	/*
 726	 *	"The sender MUST return an ICMP
 727	 *	 destination unreachable"
 728	 */
 729	dst_link_failure(skb);
 730	kfree_skb(skb);
 731}
 732
 733/* Called with locked neigh: either read or both */
 734
 735static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 736{
 737	struct in6_addr *saddr = NULL;
 738	struct in6_addr mcaddr;
 739	struct net_device *dev = neigh->dev;
 740	struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 741	int probes = atomic_read(&neigh->probes);
 742
 743	if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 744					   dev, false, 1,
 745					   IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 746		saddr = &ipv6_hdr(skb)->saddr;
 747	probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 748	if (probes < 0) {
 749		if (!(READ_ONCE(neigh->nud_state) & NUD_VALID)) {
 750			ND_PRINTK(1, dbg,
 751				  "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 752				  __func__, target);
 753		}
 754		ndisc_send_ns(dev, target, target, saddr, 0);
 755	} else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 756		neigh_app_ns(neigh);
 757	} else {
 758		addrconf_addr_solict_mult(target, &mcaddr);
 759		ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
 760	}
 761}
 762
 763static int pndisc_is_router(const void *pkey,
 764			    struct net_device *dev)
 765{
 766	struct pneigh_entry *n;
 767	int ret = -1;
 768
 769	read_lock_bh(&nd_tbl.lock);
 770	n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 771	if (n)
 772		ret = !!(n->flags & NTF_ROUTER);
 773	read_unlock_bh(&nd_tbl.lock);
 774
 775	return ret;
 776}
 777
 778void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
 779		  const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
 780		  struct ndisc_options *ndopts)
 781{
 782	neigh_update(neigh, lladdr, new, flags, 0);
 783	/* report ndisc ops about neighbour update */
 784	ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
 785}
 786
 787static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb)
 788{
 789	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 790	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 791	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 792	u8 *lladdr = NULL;
 793	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 794				    offsetof(struct nd_msg, opt));
 795	struct ndisc_options ndopts;
 796	struct net_device *dev = skb->dev;
 797	struct inet6_ifaddr *ifp;
 798	struct inet6_dev *idev = NULL;
 799	struct neighbour *neigh;
 800	int dad = ipv6_addr_any(saddr);
 
 801	int is_router = -1;
 802	SKB_DR(reason);
 803	u64 nonce = 0;
 804	bool inc;
 805
 806	if (skb->len < sizeof(struct nd_msg))
 807		return SKB_DROP_REASON_PKT_TOO_SMALL;
 
 
 808
 809	if (ipv6_addr_is_multicast(&msg->target)) {
 810		ND_PRINTK(2, warn, "NS: multicast target address\n");
 811		return reason;
 812	}
 813
 814	/*
 815	 * RFC2461 7.1.1:
 816	 * DAD has to be destined for solicited node multicast address.
 817	 */
 818	if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 819		ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 820		return reason;
 821	}
 822
 823	if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts))
 824		return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
 
 
 825
 826	if (ndopts.nd_opts_src_lladdr) {
 827		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 828		if (!lladdr) {
 829			ND_PRINTK(2, warn,
 830				  "NS: invalid link-layer address length\n");
 831			return reason;
 832		}
 833
 834		/* RFC2461 7.1.1:
 835		 *	If the IP source address is the unspecified address,
 836		 *	there MUST NOT be source link-layer address option
 837		 *	in the message.
 838		 */
 839		if (dad) {
 840			ND_PRINTK(2, warn,
 841				  "NS: bad DAD packet (link-layer address option)\n");
 842			return reason;
 843		}
 844	}
 845	if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
 846		memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
 847
 848	inc = ipv6_addr_is_multicast(daddr);
 849
 850	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 851	if (ifp) {
 852have_ifp:
 853		if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 854			if (dad) {
 855				if (nonce != 0 && ifp->dad_nonce == nonce) {
 856					u8 *np = (u8 *)&nonce;
 857					/* Matching nonce if looped back */
 858					ND_PRINTK(2, notice,
 859						  "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
 860						  ifp->idev->dev->name,
 861						  &ifp->addr, np);
 862					goto out;
 863				}
 864				/*
 865				 * We are colliding with another node
 866				 * who is doing DAD
 867				 * so fail our DAD process
 868				 */
 869				addrconf_dad_failure(skb, ifp);
 870				return reason;
 871			} else {
 872				/*
 873				 * This is not a dad solicitation.
 874				 * If we are an optimistic node,
 875				 * we should respond.
 876				 * Otherwise, we should ignore it.
 877				 */
 878				if (!(ifp->flags & IFA_F_OPTIMISTIC))
 879					goto out;
 880			}
 881		}
 882
 883		idev = ifp->idev;
 884	} else {
 885		struct net *net = dev_net(dev);
 886
 887		/* perhaps an address on the master device */
 888		if (netif_is_l3_slave(dev)) {
 889			struct net_device *mdev;
 890
 891			mdev = netdev_master_upper_dev_get_rcu(dev);
 892			if (mdev) {
 893				ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
 894				if (ifp)
 895					goto have_ifp;
 896			}
 897		}
 898
 899		idev = in6_dev_get(dev);
 900		if (!idev) {
 901			/* XXX: count this drop? */
 902			return reason;
 903		}
 904
 905		if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 906		    (idev->cnf.forwarding &&
 907		     (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 908		     (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 909			if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 910			    skb->pkt_type != PACKET_HOST &&
 911			    inc &&
 912			    NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 913				/*
 914				 * for anycast or proxy,
 915				 * sender should delay its response
 916				 * by a random time between 0 and
 917				 * MAX_ANYCAST_DELAY_TIME seconds.
 918				 * (RFC2461) -- yoshfuji
 919				 */
 920				struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 921				if (n)
 922					pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 923				goto out;
 924			}
 925		} else {
 926			SKB_DR_SET(reason, IPV6_NDISC_NS_OTHERHOST);
 927			goto out;
 928		}
 929	}
 930
 931	if (is_router < 0)
 932		is_router = idev->cnf.forwarding;
 933
 934	if (dad) {
 935		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
 936			      !!is_router, false, (ifp != NULL), true);
 937		goto out;
 938	}
 939
 940	if (inc)
 941		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 942	else
 943		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 944
 945	/*
 946	 *	update / create cache entry
 947	 *	for the source address
 948	 */
 949	neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 950			       !inc || lladdr || !dev->addr_len);
 951	if (neigh)
 952		ndisc_update(dev, neigh, lladdr, NUD_STALE,
 953			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
 954			     NEIGH_UPDATE_F_OVERRIDE,
 955			     NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
 956	if (neigh || !dev->header_ops) {
 957		ndisc_send_na(dev, saddr, &msg->target, !!is_router,
 958			      true, (ifp != NULL && inc), inc);
 959		if (neigh)
 960			neigh_release(neigh);
 961		reason = SKB_CONSUMED;
 962	}
 963
 964out:
 965	if (ifp)
 966		in6_ifa_put(ifp);
 967	else
 968		in6_dev_put(idev);
 969	return reason;
 970}
 971
 972static int accept_untracked_na(struct net_device *dev, struct in6_addr *saddr)
 973{
 974	struct inet6_dev *idev = __in6_dev_get(dev);
 975
 976	switch (idev->cnf.accept_untracked_na) {
 977	case 0: /* Don't accept untracked na (absent in neighbor cache) */
 978		return 0;
 979	case 1: /* Create new entries from na if currently untracked */
 980		return 1;
 981	case 2: /* Create new entries from untracked na only if saddr is in the
 982		 * same subnet as an address configured on the interface that
 983		 * received the na
 984		 */
 985		return !!ipv6_chk_prefix(saddr, dev);
 986	default:
 987		return 0;
 988	}
 989}
 990
 991static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb)
 992{
 993	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 994	struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 995	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 996	u8 *lladdr = NULL;
 997	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 998				    offsetof(struct nd_msg, opt));
 999	struct ndisc_options ndopts;
1000	struct net_device *dev = skb->dev;
1001	struct inet6_dev *idev = __in6_dev_get(dev);
1002	struct inet6_ifaddr *ifp;
1003	struct neighbour *neigh;
1004	SKB_DR(reason);
1005	u8 new_state;
1006
1007	if (skb->len < sizeof(struct nd_msg))
1008		return SKB_DROP_REASON_PKT_TOO_SMALL;
 
 
1009
1010	if (ipv6_addr_is_multicast(&msg->target)) {
1011		ND_PRINTK(2, warn, "NA: target address is multicast\n");
1012		return reason;
1013	}
1014
1015	if (ipv6_addr_is_multicast(daddr) &&
1016	    msg->icmph.icmp6_solicited) {
1017		ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
1018		return reason;
1019	}
1020
1021	/* For some 802.11 wireless deployments (and possibly other networks),
1022	 * there will be a NA proxy and unsolicitd packets are attacks
1023	 * and thus should not be accepted.
1024	 * drop_unsolicited_na takes precedence over accept_untracked_na
1025	 */
1026	if (!msg->icmph.icmp6_solicited && idev &&
1027	    idev->cnf.drop_unsolicited_na)
1028		return reason;
1029
1030	if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts))
1031		return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1032
 
 
 
 
1033	if (ndopts.nd_opts_tgt_lladdr) {
1034		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
1035		if (!lladdr) {
1036			ND_PRINTK(2, warn,
1037				  "NA: invalid link-layer address length\n");
1038			return reason;
1039		}
1040	}
1041	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
1042	if (ifp) {
1043		if (skb->pkt_type != PACKET_LOOPBACK
1044		    && (ifp->flags & IFA_F_TENTATIVE)) {
1045				addrconf_dad_failure(skb, ifp);
1046				return reason;
1047		}
1048		/* What should we make now? The advertisement
1049		   is invalid, but ndisc specs say nothing
1050		   about it. It could be misconfiguration, or
1051		   an smart proxy agent tries to help us :-)
1052
1053		   We should not print the error if NA has been
1054		   received from loopback - it is just our own
1055		   unsolicited advertisement.
1056		 */
1057		if (skb->pkt_type != PACKET_LOOPBACK)
1058			ND_PRINTK(1, warn,
1059				  "NA: %pM advertised our address %pI6c on %s!\n",
1060				  eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1061		in6_ifa_put(ifp);
1062		return reason;
1063	}
1064
1065	neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1066
1067	/* RFC 9131 updates original Neighbour Discovery RFC 4861.
1068	 * NAs with Target LL Address option without a corresponding
1069	 * entry in the neighbour cache can now create a STALE neighbour
1070	 * cache entry on routers.
1071	 *
1072	 *   entry accept  fwding  solicited        behaviour
1073	 * ------- ------  ------  ---------    ----------------------
1074	 * present      X       X         0     Set state to STALE
1075	 * present      X       X         1     Set state to REACHABLE
1076	 *  absent      0       X         X     Do nothing
1077	 *  absent      1       0         X     Do nothing
1078	 *  absent      1       1         X     Add a new STALE entry
1079	 *
1080	 * Note that we don't do a (daddr == all-routers-mcast) check.
1081	 */
1082	new_state = msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE;
1083	if (!neigh && lladdr && idev && idev->cnf.forwarding) {
1084		if (accept_untracked_na(dev, saddr)) {
1085			neigh = neigh_create(&nd_tbl, &msg->target, dev);
1086			new_state = NUD_STALE;
1087		}
1088	}
1089
1090	if (neigh && !IS_ERR(neigh)) {
1091		u8 old_flags = neigh->flags;
1092		struct net *net = dev_net(dev);
1093
1094		if (READ_ONCE(neigh->nud_state) & NUD_FAILED)
1095			goto out;
1096
1097		/*
1098		 * Don't update the neighbor cache entry on a proxy NA from
1099		 * ourselves because either the proxied node is off link or it
1100		 * has already sent a NA to us.
1101		 */
1102		if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1103		    net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1104		    pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1105			/* XXX: idev->cnf.proxy_ndp */
1106			goto out;
1107		}
1108
1109		ndisc_update(dev, neigh, lladdr,
1110			     new_state,
1111			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1112			     (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1113			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1114			     (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1115			     NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1116
1117		if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1118			/*
1119			 * Change: router to host
1120			 */
1121			rt6_clean_tohost(dev_net(dev),  saddr);
1122		}
1123		reason = SKB_CONSUMED;
1124out:
1125		neigh_release(neigh);
1126	}
1127	return reason;
1128}
1129
1130static enum skb_drop_reason ndisc_recv_rs(struct sk_buff *skb)
1131{
1132	struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1133	unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1134	struct neighbour *neigh;
1135	struct inet6_dev *idev;
1136	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1137	struct ndisc_options ndopts;
1138	u8 *lladdr = NULL;
1139	SKB_DR(reason);
1140
1141	if (skb->len < sizeof(*rs_msg))
1142		return SKB_DROP_REASON_PKT_TOO_SMALL;
1143
1144	idev = __in6_dev_get(skb->dev);
1145	if (!idev) {
1146		ND_PRINTK(1, err, "RS: can't find in6 device\n");
1147		return reason;
1148	}
1149
1150	/* Don't accept RS if we're not in router mode */
1151	if (!idev->cnf.forwarding)
1152		goto out;
1153
1154	/*
1155	 * Don't update NCE if src = ::;
1156	 * this implies that the source node has no ip address assigned yet.
1157	 */
1158	if (ipv6_addr_any(saddr))
1159		goto out;
1160
1161	/* Parse ND options */
1162	if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts))
1163		return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
 
 
1164
1165	if (ndopts.nd_opts_src_lladdr) {
1166		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1167					     skb->dev);
1168		if (!lladdr)
1169			goto out;
1170	}
1171
1172	neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1173	if (neigh) {
1174		ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1175			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1176			     NEIGH_UPDATE_F_OVERRIDE|
1177			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1178			     NDISC_ROUTER_SOLICITATION, &ndopts);
1179		neigh_release(neigh);
1180		reason = SKB_CONSUMED;
1181	}
1182out:
1183	return reason;
1184}
1185
1186static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1187{
1188	struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1189	struct sk_buff *skb;
1190	struct nlmsghdr *nlh;
1191	struct nduseroptmsg *ndmsg;
1192	struct net *net = dev_net(ra->dev);
1193	int err;
1194	int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1195				    + (opt->nd_opt_len << 3));
1196	size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1197
1198	skb = nlmsg_new(msg_size, GFP_ATOMIC);
1199	if (!skb) {
1200		err = -ENOBUFS;
1201		goto errout;
1202	}
1203
1204	nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1205	if (!nlh) {
1206		goto nla_put_failure;
1207	}
1208
1209	ndmsg = nlmsg_data(nlh);
1210	ndmsg->nduseropt_family = AF_INET6;
1211	ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1212	ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1213	ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1214	ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1215
1216	memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1217
1218	if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1219		goto nla_put_failure;
1220	nlmsg_end(skb, nlh);
1221
1222	rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1223	return;
1224
1225nla_put_failure:
1226	nlmsg_free(skb);
1227	err = -EMSGSIZE;
1228errout:
1229	rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1230}
1231
1232static enum skb_drop_reason ndisc_router_discovery(struct sk_buff *skb)
1233{
1234	struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1235	bool send_ifinfo_notify = false;
1236	struct neighbour *neigh = NULL;
1237	struct ndisc_options ndopts;
1238	struct fib6_info *rt = NULL;
1239	struct inet6_dev *in6_dev;
1240	u32 defrtr_usr_metric;
1241	unsigned int pref = 0;
1242	__u32 old_if_flags;
1243	struct net *net;
1244	SKB_DR(reason);
1245	int lifetime;
 
1246	int optlen;
 
 
 
1247
1248	__u8 *opt = (__u8 *)(ra_msg + 1);
1249
1250	optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1251		sizeof(struct ra_msg);
1252
1253	ND_PRINTK(2, info,
1254		  "RA: %s, dev: %s\n",
1255		  __func__, skb->dev->name);
1256	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1257		ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1258		return reason;
 
 
 
 
1259	}
1260	if (optlen < 0)
1261		return SKB_DROP_REASON_PKT_TOO_SMALL;
1262
1263#ifdef CONFIG_IPV6_NDISC_NODETYPE
1264	if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1265		ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1266		return reason;
1267	}
1268#endif
1269
 
 
 
 
1270	in6_dev = __in6_dev_get(skb->dev);
1271	if (!in6_dev) {
1272		ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1273			  skb->dev->name);
1274		return reason;
1275	}
1276
1277	if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts))
1278		return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
 
 
1279
1280	if (!ipv6_accept_ra(in6_dev)) {
1281		ND_PRINTK(2, info,
1282			  "RA: %s, did not accept ra for dev: %s\n",
1283			  __func__, skb->dev->name);
1284		goto skip_linkparms;
1285	}
1286
1287#ifdef CONFIG_IPV6_NDISC_NODETYPE
1288	/* skip link-specific parameters from interior routers */
1289	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1290		ND_PRINTK(2, info,
1291			  "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1292			  __func__, skb->dev->name);
1293		goto skip_linkparms;
1294	}
1295#endif
1296
1297	if (in6_dev->if_flags & IF_RS_SENT) {
1298		/*
1299		 *	flag that an RA was received after an RS was sent
1300		 *	out on this interface.
1301		 */
1302		in6_dev->if_flags |= IF_RA_RCVD;
1303	}
1304
1305	/*
1306	 * Remember the managed/otherconf flags from most recently
1307	 * received RA message (RFC 2462) -- yoshfuji
1308	 */
1309	old_if_flags = in6_dev->if_flags;
1310	in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1311				IF_RA_OTHERCONF)) |
1312				(ra_msg->icmph.icmp6_addrconf_managed ?
1313					IF_RA_MANAGED : 0) |
1314				(ra_msg->icmph.icmp6_addrconf_other ?
1315					IF_RA_OTHERCONF : 0);
1316
1317	if (old_if_flags != in6_dev->if_flags)
1318		send_ifinfo_notify = true;
1319
1320	if (!in6_dev->cnf.accept_ra_defrtr) {
1321		ND_PRINTK(2, info,
1322			  "RA: %s, defrtr is false for dev: %s\n",
1323			  __func__, skb->dev->name);
1324		goto skip_defrtr;
1325	}
1326
1327	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1328	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_lft) {
1329		ND_PRINTK(2, info,
1330			  "RA: router lifetime (%ds) is too short: %s\n",
1331			  lifetime, skb->dev->name);
1332		goto skip_defrtr;
1333	}
1334
1335	/* Do not accept RA with source-addr found on local machine unless
1336	 * accept_ra_from_local is set to true.
1337	 */
1338	net = dev_net(in6_dev->dev);
1339	if (!in6_dev->cnf.accept_ra_from_local &&
1340	    ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) {
1341		ND_PRINTK(2, info,
1342			  "RA from local address detected on dev: %s: default router ignored\n",
1343			  skb->dev->name);
1344		goto skip_defrtr;
1345	}
1346
 
 
1347#ifdef CONFIG_IPV6_ROUTER_PREF
1348	pref = ra_msg->icmph.icmp6_router_pref;
1349	/* 10b is handled as if it were 00b (medium) */
1350	if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1351	    !in6_dev->cnf.accept_ra_rtr_pref)
1352		pref = ICMPV6_ROUTER_PREF_MEDIUM;
1353#endif
1354	/* routes added from RAs do not use nexthop objects */
1355	rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev);
1356	if (rt) {
1357		neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1358					 rt->fib6_nh->fib_nh_dev, NULL,
1359					  &ipv6_hdr(skb)->saddr);
1360		if (!neigh) {
1361			ND_PRINTK(0, err,
1362				  "RA: %s got default router without neighbour\n",
1363				  __func__);
1364			fib6_info_release(rt);
1365			return reason;
1366		}
1367	}
1368	/* Set default route metric as specified by user */
1369	defrtr_usr_metric = in6_dev->cnf.ra_defrtr_metric;
1370	/* delete the route if lifetime is 0 or if metric needs change */
1371	if (rt && (lifetime == 0 || rt->fib6_metric != defrtr_usr_metric)) {
1372		ip6_del_rt(net, rt, false);
1373		rt = NULL;
1374	}
1375
1376	ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, metric: %d, for dev: %s\n",
1377		  rt, lifetime, defrtr_usr_metric, skb->dev->name);
1378	if (!rt && lifetime) {
1379		ND_PRINTK(3, info, "RA: adding default router\n");
1380
1381		if (neigh)
1382			neigh_release(neigh);
1383
1384		rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
1385					 skb->dev, pref, defrtr_usr_metric);
1386		if (!rt) {
1387			ND_PRINTK(0, err,
1388				  "RA: %s failed to add default route\n",
1389				  __func__);
1390			return reason;
1391		}
1392
1393		neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1394					 rt->fib6_nh->fib_nh_dev, NULL,
1395					  &ipv6_hdr(skb)->saddr);
1396		if (!neigh) {
1397			ND_PRINTK(0, err,
1398				  "RA: %s got default router without neighbour\n",
1399				  __func__);
1400			fib6_info_release(rt);
1401			return reason;
1402		}
1403		neigh->flags |= NTF_ROUTER;
1404	} else if (rt && IPV6_EXTRACT_PREF(rt->fib6_flags) != pref) {
1405		struct nl_info nlinfo = {
1406			.nl_net = net,
1407		};
1408		rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1409		inet6_rt_notify(RTM_NEWROUTE, rt, &nlinfo, NLM_F_REPLACE);
1410	}
1411
1412	if (rt)
1413		fib6_set_expires(rt, jiffies + (HZ * lifetime));
1414	if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1415	    ra_msg->icmph.icmp6_hop_limit) {
1416		if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1417			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1418			fib6_metric_set(rt, RTAX_HOPLIMIT,
1419					ra_msg->icmph.icmp6_hop_limit);
1420		} else {
1421			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1422		}
1423	}
1424
1425skip_defrtr:
1426
1427	/*
1428	 *	Update Reachable Time and Retrans Timer
1429	 */
1430
1431	if (in6_dev->nd_parms) {
1432		unsigned long rtime = ntohl(ra_msg->retrans_timer);
1433
1434		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1435			rtime = (rtime*HZ)/1000;
1436			if (rtime < HZ/100)
1437				rtime = HZ/100;
1438			NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1439			in6_dev->tstamp = jiffies;
1440			send_ifinfo_notify = true;
1441		}
1442
1443		rtime = ntohl(ra_msg->reachable_time);
1444		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1445			rtime = (rtime*HZ)/1000;
1446
1447			if (rtime < HZ/10)
1448				rtime = HZ/10;
1449
1450			if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1451				NEIGH_VAR_SET(in6_dev->nd_parms,
1452					      BASE_REACHABLE_TIME, rtime);
1453				NEIGH_VAR_SET(in6_dev->nd_parms,
1454					      GC_STALETIME, 3 * rtime);
1455				in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1456				in6_dev->tstamp = jiffies;
1457				send_ifinfo_notify = true;
1458			}
1459		}
1460	}
1461
 
 
 
 
 
 
1462skip_linkparms:
1463
1464	/*
1465	 *	Process options.
1466	 */
1467
1468	if (!neigh)
1469		neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1470				       skb->dev, 1);
1471	if (neigh) {
1472		u8 *lladdr = NULL;
1473		if (ndopts.nd_opts_src_lladdr) {
1474			lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1475						     skb->dev);
1476			if (!lladdr) {
1477				ND_PRINTK(2, warn,
1478					  "RA: invalid link-layer address length\n");
1479				goto out;
1480			}
1481		}
1482		ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1483			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1484			     NEIGH_UPDATE_F_OVERRIDE|
1485			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1486			     NEIGH_UPDATE_F_ISROUTER,
1487			     NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1488		reason = SKB_CONSUMED;
1489	}
1490
1491	if (!ipv6_accept_ra(in6_dev)) {
1492		ND_PRINTK(2, info,
1493			  "RA: %s, accept_ra is false for dev: %s\n",
1494			  __func__, skb->dev->name);
1495		goto out;
1496	}
1497
1498#ifdef CONFIG_IPV6_ROUTE_INFO
1499	if (!in6_dev->cnf.accept_ra_from_local &&
1500	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1501			  in6_dev->dev, 0)) {
1502		ND_PRINTK(2, info,
1503			  "RA from local address detected on dev: %s: router info ignored.\n",
1504			  skb->dev->name);
1505		goto skip_routeinfo;
1506	}
1507
1508	if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1509		struct nd_opt_hdr *p;
1510		for (p = ndopts.nd_opts_ri;
1511		     p;
1512		     p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1513			struct route_info *ri = (struct route_info *)p;
1514#ifdef CONFIG_IPV6_NDISC_NODETYPE
1515			if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1516			    ri->prefix_len == 0)
1517				continue;
1518#endif
1519			if (ri->prefix_len == 0 &&
1520			    !in6_dev->cnf.accept_ra_defrtr)
1521				continue;
1522			if (ri->lifetime != 0 &&
1523			    ntohl(ri->lifetime) < in6_dev->cnf.accept_ra_min_lft)
1524				continue;
1525			if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1526				continue;
1527			if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1528				continue;
1529			rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1530				      &ipv6_hdr(skb)->saddr);
1531		}
1532	}
1533
1534skip_routeinfo:
1535#endif
1536
1537#ifdef CONFIG_IPV6_NDISC_NODETYPE
1538	/* skip link-specific ndopts from interior routers */
1539	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1540		ND_PRINTK(2, info,
1541			  "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1542			  __func__, skb->dev->name);
1543		goto out;
1544	}
1545#endif
1546
1547	if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1548		struct nd_opt_hdr *p;
1549		for (p = ndopts.nd_opts_pi;
1550		     p;
1551		     p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1552			addrconf_prefix_rcv(skb->dev, (u8 *)p,
1553					    (p->nd_opt_len) << 3,
1554					    ndopts.nd_opts_src_lladdr != NULL);
1555		}
1556	}
1557
1558	if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1559		__be32 n;
1560		u32 mtu;
1561
1562		memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1563		mtu = ntohl(n);
1564
1565		if (in6_dev->ra_mtu != mtu) {
1566			in6_dev->ra_mtu = mtu;
1567			send_ifinfo_notify = true;
1568		}
1569
1570		if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1571			ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1572		} else if (in6_dev->cnf.mtu6 != mtu) {
1573			in6_dev->cnf.mtu6 = mtu;
1574			fib6_metric_set(rt, RTAX_MTU, mtu);
1575			rt6_mtu_change(skb->dev, mtu);
1576		}
1577	}
1578
1579	if (ndopts.nd_useropts) {
1580		struct nd_opt_hdr *p;
1581		for (p = ndopts.nd_useropts;
1582		     p;
1583		     p = ndisc_next_useropt(skb->dev, p,
1584					    ndopts.nd_useropts_end)) {
1585			ndisc_ra_useropt(skb, p);
1586		}
1587	}
1588
1589	if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1590		ND_PRINTK(2, warn, "RA: invalid RA options\n");
1591	}
1592out:
1593	/* Send a notify if RA changed managed/otherconf flags or
1594	 * timer settings or ra_mtu value
1595	 */
1596	if (send_ifinfo_notify)
1597		inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1598
1599	fib6_info_release(rt);
1600	if (neigh)
1601		neigh_release(neigh);
1602	return reason;
1603}
1604
1605static enum skb_drop_reason ndisc_redirect_rcv(struct sk_buff *skb)
1606{
 
 
1607	struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1608	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1609				    offsetof(struct rd_msg, opt));
1610	struct ndisc_options ndopts;
1611	SKB_DR(reason);
1612	u8 *hdr;
1613
1614#ifdef CONFIG_IPV6_NDISC_NODETYPE
1615	switch (skb->ndisc_nodetype) {
1616	case NDISC_NODETYPE_HOST:
1617	case NDISC_NODETYPE_NODEFAULT:
1618		ND_PRINTK(2, warn,
1619			  "Redirect: from host or unauthorized router\n");
1620		return reason;
1621	}
1622#endif
1623
1624	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1625		ND_PRINTK(2, warn,
1626			  "Redirect: source address is not link-local\n");
1627		return reason;
1628	}
1629
1630	if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1631		return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1632
1633	if (!ndopts.nd_opts_rh) {
1634		ip6_redirect_no_header(skb, dev_net(skb->dev),
1635					skb->dev->ifindex);
1636		return reason;
1637	}
1638
1639	hdr = (u8 *)ndopts.nd_opts_rh;
1640	hdr += 8;
1641	if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1642		return SKB_DROP_REASON_PKT_TOO_SMALL;
1643
1644	return icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1645}
1646
1647static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1648					   struct sk_buff *orig_skb,
1649					   int rd_len)
1650{
1651	u8 *opt = skb_put(skb, rd_len);
1652
1653	memset(opt, 0, 8);
1654	*(opt++) = ND_OPT_REDIRECT_HDR;
1655	*(opt++) = (rd_len >> 3);
1656	opt += 6;
1657
1658	skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1659		      rd_len - 8);
1660}
1661
1662void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1663{
1664	struct net_device *dev = skb->dev;
1665	struct net *net = dev_net(dev);
1666	struct sock *sk = net->ipv6.ndisc_sk;
1667	int optlen = 0;
1668	struct inet_peer *peer;
1669	struct sk_buff *buff;
1670	struct rd_msg *msg;
1671	struct in6_addr saddr_buf;
1672	struct rt6_info *rt;
1673	struct dst_entry *dst;
1674	struct flowi6 fl6;
1675	int rd_len;
1676	u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1677	   ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1678	bool ret;
1679
1680	if (netif_is_l3_master(skb->dev)) {
1681		dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
1682		if (!dev)
1683			return;
1684	}
1685
1686	if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1687		ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1688			  dev->name);
1689		return;
1690	}
1691
1692	if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1693	    ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1694		ND_PRINTK(2, warn,
1695			  "Redirect: target address is not link-local unicast\n");
1696		return;
1697	}
1698
1699	icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1700			 &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1701
1702	dst = ip6_route_output(net, NULL, &fl6);
1703	if (dst->error) {
1704		dst_release(dst);
1705		return;
1706	}
1707	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1708	if (IS_ERR(dst))
1709		return;
1710
1711	rt = (struct rt6_info *) dst;
1712
1713	if (rt->rt6i_flags & RTF_GATEWAY) {
1714		ND_PRINTK(2, warn,
1715			  "Redirect: destination is not a neighbour\n");
1716		goto release;
1717	}
1718	peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1719	ret = inet_peer_xrlim_allow(peer, 1*HZ);
1720	if (peer)
1721		inet_putpeer(peer);
1722	if (!ret)
1723		goto release;
1724
1725	if (dev->addr_len) {
1726		struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1727		if (!neigh) {
1728			ND_PRINTK(2, warn,
1729				  "Redirect: no neigh for target address\n");
1730			goto release;
1731		}
1732
1733		read_lock_bh(&neigh->lock);
1734		if (neigh->nud_state & NUD_VALID) {
1735			memcpy(ha_buf, neigh->ha, dev->addr_len);
1736			read_unlock_bh(&neigh->lock);
1737			ha = ha_buf;
1738			optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1739								ops_data_buf,
1740								&ops_data);
1741		} else
1742			read_unlock_bh(&neigh->lock);
1743
1744		neigh_release(neigh);
1745	}
1746
1747	rd_len = min_t(unsigned int,
1748		       IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1749		       skb->len + 8);
1750	rd_len &= ~0x7;
1751	optlen += rd_len;
1752
1753	buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1754	if (!buff)
1755		goto release;
1756
1757	msg = skb_put(buff, sizeof(*msg));
1758	*msg = (struct rd_msg) {
1759		.icmph = {
1760			.icmp6_type = NDISC_REDIRECT,
1761		},
1762		.target = *target,
1763		.dest = ipv6_hdr(skb)->daddr,
1764	};
1765
1766	/*
1767	 *	include target_address option
1768	 */
1769
1770	if (ha)
1771		ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1772
1773	/*
1774	 *	build redirect option and copy skb over to the new packet.
1775	 */
1776
1777	if (rd_len)
1778		ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1779
1780	skb_dst_set(buff, dst);
1781	ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1782	return;
1783
1784release:
1785	dst_release(dst);
1786}
1787
1788static void pndisc_redo(struct sk_buff *skb)
1789{
1790	enum skb_drop_reason reason = ndisc_recv_ns(skb);
1791
1792	kfree_skb_reason(skb, reason);
1793}
1794
1795static int ndisc_is_multicast(const void *pkey)
1796{
1797	return ipv6_addr_is_multicast((struct in6_addr *)pkey);
1798}
1799
1800static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1801{
1802	struct inet6_dev *idev = __in6_dev_get(skb->dev);
1803
1804	if (!idev)
1805		return true;
1806	if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1807	    idev->cnf.suppress_frag_ndisc) {
1808		net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1809		return true;
1810	}
1811	return false;
1812}
1813
1814enum skb_drop_reason ndisc_rcv(struct sk_buff *skb)
1815{
1816	struct nd_msg *msg;
1817	SKB_DR(reason);
1818
1819	if (ndisc_suppress_frag_ndisc(skb))
1820		return SKB_DROP_REASON_IPV6_NDISC_FRAG;
1821
1822	if (skb_linearize(skb))
1823		return SKB_DROP_REASON_NOMEM;
1824
1825	msg = (struct nd_msg *)skb_transport_header(skb);
1826
1827	__skb_push(skb, skb->data - skb_transport_header(skb));
1828
1829	if (ipv6_hdr(skb)->hop_limit != 255) {
1830		ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1831			  ipv6_hdr(skb)->hop_limit);
1832		return SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT;
1833	}
1834
1835	if (msg->icmph.icmp6_code != 0) {
1836		ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1837			  msg->icmph.icmp6_code);
1838		return SKB_DROP_REASON_IPV6_NDISC_BAD_CODE;
1839	}
1840
1841	switch (msg->icmph.icmp6_type) {
1842	case NDISC_NEIGHBOUR_SOLICITATION:
1843		memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1844		reason = ndisc_recv_ns(skb);
1845		break;
1846
1847	case NDISC_NEIGHBOUR_ADVERTISEMENT:
1848		reason = ndisc_recv_na(skb);
1849		break;
1850
1851	case NDISC_ROUTER_SOLICITATION:
1852		reason = ndisc_recv_rs(skb);
1853		break;
1854
1855	case NDISC_ROUTER_ADVERTISEMENT:
1856		reason = ndisc_router_discovery(skb);
1857		break;
1858
1859	case NDISC_REDIRECT:
1860		reason = ndisc_redirect_rcv(skb);
1861		break;
1862	}
1863
1864	return reason;
1865}
1866
1867static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1868{
1869	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1870	struct netdev_notifier_change_info *change_info;
1871	struct net *net = dev_net(dev);
1872	struct inet6_dev *idev;
1873	bool evict_nocarrier;
1874
1875	switch (event) {
1876	case NETDEV_CHANGEADDR:
1877		neigh_changeaddr(&nd_tbl, dev);
1878		fib6_run_gc(0, net, false);
1879		fallthrough;
1880	case NETDEV_UP:
1881		idev = in6_dev_get(dev);
1882		if (!idev)
1883			break;
1884		if (idev->cnf.ndisc_notify ||
1885		    net->ipv6.devconf_all->ndisc_notify)
1886			ndisc_send_unsol_na(dev);
1887		in6_dev_put(idev);
1888		break;
1889	case NETDEV_CHANGE:
1890		idev = in6_dev_get(dev);
1891		if (!idev)
1892			evict_nocarrier = true;
1893		else {
1894			evict_nocarrier = idev->cnf.ndisc_evict_nocarrier &&
1895					  net->ipv6.devconf_all->ndisc_evict_nocarrier;
1896			in6_dev_put(idev);
1897		}
1898
1899		change_info = ptr;
1900		if (change_info->flags_changed & IFF_NOARP)
1901			neigh_changeaddr(&nd_tbl, dev);
1902		if (evict_nocarrier && !netif_carrier_ok(dev))
1903			neigh_carrier_down(&nd_tbl, dev);
1904		break;
1905	case NETDEV_DOWN:
1906		neigh_ifdown(&nd_tbl, dev);
1907		fib6_run_gc(0, net, false);
1908		break;
1909	case NETDEV_NOTIFY_PEERS:
1910		ndisc_send_unsol_na(dev);
1911		break;
1912	default:
1913		break;
1914	}
1915
1916	return NOTIFY_DONE;
1917}
1918
1919static struct notifier_block ndisc_netdev_notifier = {
1920	.notifier_call = ndisc_netdev_event,
1921	.priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1922};
1923
1924#ifdef CONFIG_SYSCTL
1925static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1926					 const char *func, const char *dev_name)
1927{
1928	static char warncomm[TASK_COMM_LEN];
1929	static int warned;
1930	if (strcmp(warncomm, current->comm) && warned < 5) {
1931		strcpy(warncomm, current->comm);
1932		pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1933			warncomm, func,
1934			dev_name, ctl->procname,
1935			dev_name, ctl->procname);
1936		warned++;
1937	}
1938}
1939
1940int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void *buffer,
1941		size_t *lenp, loff_t *ppos)
1942{
1943	struct net_device *dev = ctl->extra1;
1944	struct inet6_dev *idev;
1945	int ret;
1946
1947	if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1948	    (strcmp(ctl->procname, "base_reachable_time") == 0))
1949		ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1950
1951	if (strcmp(ctl->procname, "retrans_time") == 0)
1952		ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1953
1954	else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1955		ret = neigh_proc_dointvec_jiffies(ctl, write,
1956						  buffer, lenp, ppos);
1957
1958	else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1959		 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1960		ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1961						     buffer, lenp, ppos);
1962	else
1963		ret = -1;
1964
1965	if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1966		if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1967			idev->nd_parms->reachable_time =
1968					neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1969		idev->tstamp = jiffies;
1970		inet6_ifinfo_notify(RTM_NEWLINK, idev);
1971		in6_dev_put(idev);
1972	}
1973	return ret;
1974}
1975
1976
1977#endif
1978
1979static int __net_init ndisc_net_init(struct net *net)
1980{
1981	struct ipv6_pinfo *np;
1982	struct sock *sk;
1983	int err;
1984
1985	err = inet_ctl_sock_create(&sk, PF_INET6,
1986				   SOCK_RAW, IPPROTO_ICMPV6, net);
1987	if (err < 0) {
1988		ND_PRINTK(0, err,
1989			  "NDISC: Failed to initialize the control socket (err %d)\n",
1990			  err);
1991		return err;
1992	}
1993
1994	net->ipv6.ndisc_sk = sk;
1995
1996	np = inet6_sk(sk);
1997	np->hop_limit = 255;
1998	/* Do not loopback ndisc messages */
1999	inet6_clear_bit(MC6_LOOP, sk);
2000
2001	return 0;
2002}
2003
2004static void __net_exit ndisc_net_exit(struct net *net)
2005{
2006	inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
2007}
2008
2009static struct pernet_operations ndisc_net_ops = {
2010	.init = ndisc_net_init,
2011	.exit = ndisc_net_exit,
2012};
2013
2014int __init ndisc_init(void)
2015{
2016	int err;
2017
2018	err = register_pernet_subsys(&ndisc_net_ops);
2019	if (err)
2020		return err;
2021	/*
2022	 * Initialize the neighbour table
2023	 */
2024	neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
2025
2026#ifdef CONFIG_SYSCTL
2027	err = neigh_sysctl_register(NULL, &nd_tbl.parms,
2028				    ndisc_ifinfo_sysctl_change);
2029	if (err)
2030		goto out_unregister_pernet;
2031out:
2032#endif
2033	return err;
2034
2035#ifdef CONFIG_SYSCTL
2036out_unregister_pernet:
2037	unregister_pernet_subsys(&ndisc_net_ops);
2038	goto out;
2039#endif
2040}
2041
2042int __init ndisc_late_init(void)
2043{
2044	return register_netdevice_notifier(&ndisc_netdev_notifier);
2045}
2046
2047void ndisc_late_cleanup(void)
2048{
2049	unregister_netdevice_notifier(&ndisc_netdev_notifier);
2050}
2051
2052void ndisc_cleanup(void)
2053{
2054#ifdef CONFIG_SYSCTL
2055	neigh_sysctl_unregister(&nd_tbl.parms);
2056#endif
2057	neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
2058	unregister_pernet_subsys(&ndisc_net_ops);
2059}