net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Mike Shaver             <shaver@ingenia.com>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  19  *      Pierre Ynard                    :       export userland ND options
  20  *                                              through netlink (RDNSS support)
  21  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  22  *                                              of an RA.
  23  *      Janos Farkas                    :       kmalloc failure checks
  24  *      Alexey Kuznetsov                :       state machine reworked
  25  *                                              and moved to net/core.
  26  *      Pekka Savola                    :       RFC2461 validation
  27  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  28  */
  29
  30 #define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32 #include <linux/module.h>
  33 #include <linux/errno.h>
  34 #include <linux/types.h>
  35 #include <linux/socket.h>
  36 #include <linux/sockios.h>
  37 #include <linux/sched.h>
  38 #include <linux/net.h>
  39 #include <linux/in6.h>
  40 #include <linux/route.h>
  41 #include <linux/init.h>
  42 #include <linux/rcupdate.h>
  43 #include <linux/slab.h>
  44 #ifdef CONFIG_SYSCTL
  45 #include <linux/sysctl.h>
  46 #endif
  47
  48 #include <linux/if_addr.h>
  49 #include <linux/if_arp.h>
  50 #include <linux/ipv6.h>
  51 #include <linux/icmpv6.h>
  52 #include <linux/jhash.h>
  53
  54 #include <net/sock.h>
  55 #include <net/snmp.h>
  56
  57 #include <net/ipv6.h>
  58 #include <net/protocol.h>
  59 #include <net/ndisc.h>
  60 #include <net/ip6_route.h>
  61 #include <net/addrconf.h>
  62 #include <net/icmp.h>
  63
  64 #include <net/netlink.h>
  65 #include <linux/rtnetlink.h>
  66
  67 #include <net/flow.h>
  68 #include <net/ip6_checksum.h>
  69 #include <net/inet_common.h>
  70 #include <linux/proc_fs.h>
  71
  72 #include <linux/netfilter.h>
  73 #include <linux/netfilter_ipv6.h>
  74
  75 /* Set to 3 to get tracing... */
  76 #define ND_DEBUG 1
  77
  78 #define ND_PRINTK(val, level, fmt, ...)                         \
  79 do {                                                            \
  80         if (val <= ND_DEBUG)                                    \
  81                 net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
  82 } while (0)
  83
  84 static u32 ndisc_hash(const void *pkey,
  85                       const struct net_device *dev,
  86                       __u32 *hash_rnd);
  87 static int ndisc_constructor(struct neighbour *neigh);
  88 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  89 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  90 static int pndisc_constructor(struct pneigh_entry *n);
  91 static void pndisc_destructor(struct pneigh_entry *n);
  92 static void pndisc_redo(struct sk_buff *skb);
  93
  94 static const struct neigh_ops ndisc_generic_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_connected_output,
 100 };
 101
 102 static const struct neigh_ops ndisc_hh_ops = {
 103         .family =               AF_INET6,
 104         .solicit =              ndisc_solicit,
 105         .error_report =         ndisc_error_report,
 106         .output =               neigh_resolve_output,
 107         .connected_output =     neigh_resolve_output,
 108 };
 109
 110
 111 static const struct neigh_ops ndisc_direct_ops = {
 112         .family =               AF_INET6,
 113         .output =               neigh_direct_output,
 114         .connected_output =     neigh_direct_output,
 115 };
 116
 117 struct neigh_table nd_tbl = {
 118         .family =       AF_INET6,
 119         .key_len =      sizeof(struct in6_addr),
 120         .hash =         ndisc_hash,
 121         .constructor =  ndisc_constructor,
 122         .pconstructor = pndisc_constructor,
 123         .pdestructor =  pndisc_destructor,
 124         .proxy_redo =   pndisc_redo,
 125         .id =           "ndisc_cache",
 126         .parms = {
 127                 .tbl                    = &nd_tbl,
 128                 .reachable_time         = ND_REACHABLE_TIME,
 129                 .data = {
 130                         [NEIGH_VAR_MCAST_PROBES] = 3,
 131                         [NEIGH_VAR_UCAST_PROBES] = 3,
 132                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 133                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 134                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 135                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 136                         [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
 137                         [NEIGH_VAR_PROXY_QLEN] = 64,
 138                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 139                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 140                 },
 141         },
 142         .gc_interval =    30 * HZ,
 143         .gc_thresh1 =    128,
 144         .gc_thresh2 =    512,
 145         .gc_thresh3 =   1024,
 146 };
 147
 148 static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
 149 {
 150         int pad   = ndisc_addr_option_pad(skb->dev->type);
 151         int data_len = skb->dev->addr_len;
 152         int space = ndisc_opt_addr_space(skb->dev);
 153         u8 *opt = skb_put(skb, space);
 154
 155         opt[0] = type;
 156         opt[1] = space>>3;
 157
 158         memset(opt + 2, 0, pad);
 159         opt   += pad;
 160         space -= pad;
 161
 162         memcpy(opt+2, data, data_len);
 163         data_len += 2;
 164         opt += data_len;
 165         space -= data_len;
 166         if (space > 0)
 167                 memset(opt, 0, space);
 168 }
 169
 170 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 171                                             struct nd_opt_hdr *end)
 172 {
 173         int type;
 174         if (!cur || !end || cur >= end)
 175                 return NULL;
 176         type = cur->nd_opt_type;
 177         do {
 178                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 179         } while (cur < end && cur->nd_opt_type != type);
 180         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 181 }
 182
 183 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 184 {
 185         return opt->nd_opt_type == ND_OPT_RDNSS ||
 186                 opt->nd_opt_type == ND_OPT_DNSSL;
 187 }
 188
 189 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 190                                              struct nd_opt_hdr *end)
 191 {
 192         if (!cur || !end || cur >= end)
 193                 return NULL;
 194         do {
 195                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 196         } while (cur < end && !ndisc_is_useropt(cur));
 197         return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 198 }
 199
 200 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 201                                           struct ndisc_options *ndopts)
 202 {
 203         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 204
 205         if (!nd_opt || opt_len < 0 || !ndopts)
 206                 return NULL;
 207         memset(ndopts, 0, sizeof(*ndopts));
 208         while (opt_len) {
 209                 int l;
 210                 if (opt_len < sizeof(struct nd_opt_hdr))
 211                         return NULL;
 212                 l = nd_opt->nd_opt_len << 3;
 213                 if (opt_len < l || l == 0)
 214                         return NULL;
 215                 switch (nd_opt->nd_opt_type) {
 216                 case ND_OPT_SOURCE_LL_ADDR:
 217                 case ND_OPT_TARGET_LL_ADDR:
 218                 case ND_OPT_MTU:
 219                 case ND_OPT_REDIRECT_HDR:
 220                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 221                                 ND_PRINTK(2, warn,
 222                                           "%s: duplicated ND6 option found: type=%d\n",
 223                                           __func__, nd_opt->nd_opt_type);
 224                         } else {
 225                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 226                         }
 227                         break;
 228                 case ND_OPT_PREFIX_INFO:
 229                         ndopts->nd_opts_pi_end = nd_opt;
 230                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 231                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 232                         break;
 233 #ifdef CONFIG_IPV6_ROUTE_INFO
 234                 case ND_OPT_ROUTE_INFO:
 235                         ndopts->nd_opts_ri_end = nd_opt;
 236                         if (!ndopts->nd_opts_ri)
 237                                 ndopts->nd_opts_ri = nd_opt;
 238                         break;
 239 #endif
 240                 default:
 241                         if (ndisc_is_useropt(nd_opt)) {
 242                                 ndopts->nd_useropts_end = nd_opt;
 243                                 if (!ndopts->nd_useropts)
 244                                         ndopts->nd_useropts = nd_opt;
 245                         } else {
 246                                 /*
 247                                  * Unknown options must be silently ignored,
 248                                  * to accommodate future extension to the
 249                                  * protocol.
 250                                  */
 251                                 ND_PRINTK(2, notice,
 252                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 253                                           __func__,
 254                                           nd_opt->nd_opt_type,
 255                                           nd_opt->nd_opt_len);
 256                         }
 257                 }
 258                 opt_len -= l;
 259                 nd_opt = ((void *)nd_opt) + l;
 260         }
 261         return ndopts;
 262 }
 263
 264 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 265 {
 266         switch (dev->type) {
 267         case ARPHRD_ETHER:
 268         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 269         case ARPHRD_FDDI:
 270                 ipv6_eth_mc_map(addr, buf);
 271                 return 0;
 272         case ARPHRD_ARCNET:
 273                 ipv6_arcnet_mc_map(addr, buf);
 274                 return 0;
 275         case ARPHRD_INFINIBAND:
 276                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 277                 return 0;
 278         case ARPHRD_IPGRE:
 279                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 280         default:
 281                 if (dir) {
 282                         memcpy(buf, dev->broadcast, dev->addr_len);
 283                         return 0;
 284                 }
 285         }
 286         return -EINVAL;
 287 }
 288 EXPORT_SYMBOL(ndisc_mc_map);
 289
 290 static u32 ndisc_hash(const void *pkey,
 291                       const struct net_device *dev,
 292                       __u32 *hash_rnd)
 293 {
 294         return ndisc_hashfn(pkey, dev, hash_rnd);
 295 }
 296
 297 static int ndisc_constructor(struct neighbour *neigh)
 298 {
 299         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 300         struct net_device *dev = neigh->dev;
 301         struct inet6_dev *in6_dev;
 302         struct neigh_parms *parms;
 303         bool is_multicast = ipv6_addr_is_multicast(addr);
 304
 305         in6_dev = in6_dev_get(dev);
 306         if (in6_dev == NULL) {
 307                 return -EINVAL;
 308         }
 309
 310         parms = in6_dev->nd_parms;
 311         __neigh_parms_put(neigh->parms);
 312         neigh->parms = neigh_parms_clone(parms);
 313
 314         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 315         if (!dev->header_ops) {
 316                 neigh->nud_state = NUD_NOARP;
 317                 neigh->ops = &ndisc_direct_ops;
 318                 neigh->output = neigh_direct_output;
 319         } else {
 320                 if (is_multicast) {
 321                         neigh->nud_state = NUD_NOARP;
 322                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 323                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 324                         neigh->nud_state = NUD_NOARP;
 325                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 326                         if (dev->flags&IFF_LOOPBACK)
 327                                 neigh->type = RTN_LOCAL;
 328                 } else if (dev->flags&IFF_POINTOPOINT) {
 329                         neigh->nud_state = NUD_NOARP;
 330                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 331                 }
 332                 if (dev->header_ops->cache)
 333                         neigh->ops = &ndisc_hh_ops;
 334                 else
 335                         neigh->ops = &ndisc_generic_ops;
 336                 if (neigh->nud_state&NUD_VALID)
 337                         neigh->output = neigh->ops->connected_output;
 338                 else
 339                         neigh->output = neigh->ops->output;
 340         }
 341         in6_dev_put(in6_dev);
 342         return 0;
 343 }
 344
 345 static int pndisc_constructor(struct pneigh_entry *n)
 346 {
 347         struct in6_addr *addr = (struct in6_addr *)&n->key;
 348         struct in6_addr maddr;
 349         struct net_device *dev = n->dev;
 350
 351         if (dev == NULL || __in6_dev_get(dev) == NULL)
 352                 return -EINVAL;
 353         addrconf_addr_solict_mult(addr, &maddr);
 354         ipv6_dev_mc_inc(dev, &maddr);
 355         return 0;
 356 }
 357
 358 static void pndisc_destructor(struct pneigh_entry *n)
 359 {
 360         struct in6_addr *addr = (struct in6_addr *)&n->key;
 361         struct in6_addr maddr;
 362         struct net_device *dev = n->dev;
 363
 364         if (dev == NULL || __in6_dev_get(dev) == NULL)
 365                 return;
 366         addrconf_addr_solict_mult(addr, &maddr);
 367         ipv6_dev_mc_dec(dev, &maddr);
 368 }
 369
 370 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 371                                        int len)
 372 {
 373         int hlen = LL_RESERVED_SPACE(dev);
 374         int tlen = dev->needed_tailroom;
 375         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 376         struct sk_buff *skb;
 377
 378         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 379         if (!skb) {
 380                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 381                           __func__);
 382                 return NULL;
 383         }
 384
 385         skb->protocol = htons(ETH_P_IPV6);
 386         skb->dev = dev;
 387
 388         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 389         skb_reset_transport_header(skb);
 390
 391         /* Manually assign socket ownership as we avoid calling
 392          * sock_alloc_send_pskb() to bypass wmem buffer limits
 393          */
 394         skb_set_owner_w(skb, sk);
 395
 396         return skb;
 397 }
 398
 399 static void ip6_nd_hdr(struct sk_buff *skb,
 400                        const struct in6_addr *saddr,
 401                        const struct in6_addr *daddr,
 402                        int hop_limit, int len)
 403 {
 404         struct ipv6hdr *hdr;
 405
 406         skb_push(skb, sizeof(*hdr));
 407         skb_reset_network_header(skb);
 408         hdr = ipv6_hdr(skb);
 409
 410         ip6_flow_hdr(hdr, 0, 0);
 411
 412         hdr->payload_len = htons(len);
 413         hdr->nexthdr = IPPROTO_ICMPV6;
 414         hdr->hop_limit = hop_limit;
 415
 416         hdr->saddr = *saddr;
 417         hdr->daddr = *daddr;
 418 }
 419
 420 static void ndisc_send_skb(struct sk_buff *skb,
 421                            const struct in6_addr *daddr,
 422                            const struct in6_addr *saddr)
 423 {
 424         struct dst_entry *dst = skb_dst(skb);
 425         struct net *net = dev_net(skb->dev);
 426         struct sock *sk = net->ipv6.ndisc_sk;
 427         struct inet6_dev *idev;
 428         int err;
 429         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 430         u8 type;
 431
 432         type = icmp6h->icmp6_type;
 433
 434         if (!dst) {
 435                 struct flowi6 fl6;
 436
 437                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex);
 438                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 439                 if (IS_ERR(dst)) {
 440                         kfree_skb(skb);
 441                         return;
 442                 }
 443
 444                 skb_dst_set(skb, dst);
 445         }
 446
 447         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 448                                               IPPROTO_ICMPV6,
 449                                               csum_partial(icmp6h,
 450                                                            skb->len, 0));
 451
 452         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 453
 454         rcu_read_lock();
 455         idev = __in6_dev_get(dst->dev);
 456         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 457
 458         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 459                       dst_output);
 460         if (!err) {
 461                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 462                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 463         }
 464
 465         rcu_read_unlock();
 466 }
 467
 468 void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 469                    const struct in6_addr *daddr,
 470                    const struct in6_addr *solicited_addr,
 471                    bool router, bool solicited, bool override, bool inc_opt)
 472 {
 473         struct sk_buff *skb;
 474         struct in6_addr tmpaddr;
 475         struct inet6_ifaddr *ifp;
 476         const struct in6_addr *src_addr;
 477         struct nd_msg *msg;
 478         int optlen = 0;
 479
 480         /* for anycast or proxy, solicited_addr != src_addr */
 481         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 482         if (ifp) {
 483                 src_addr = solicited_addr;
 484                 if (ifp->flags & IFA_F_OPTIMISTIC)
 485                         override = false;
 486                 inc_opt |= ifp->idev->cnf.force_tllao;
 487                 in6_ifa_put(ifp);
 488         } else {
 489                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 490                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 491                                        &tmpaddr))
 492                         return;
 493                 src_addr = &tmpaddr;
 494         }
 495
 496         if (!dev->addr_len)
 497                 inc_opt = 0;
 498         if (inc_opt)
 499                 optlen += ndisc_opt_addr_space(dev);
 500
 501         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 502         if (!skb)
 503                 return;
 504
 505         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 506         *msg = (struct nd_msg) {
 507                 .icmph = {
 508                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 509                         .icmp6_router = router,
 510                         .icmp6_solicited = solicited,
 511                         .icmp6_override = override,
 512                 },
 513                 .target = *solicited_addr,
 514         };
 515
 516         if (inc_opt)
 517                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 518                                        dev->dev_addr);
 519
 520
 521         ndisc_send_skb(skb, daddr, src_addr);
 522 }
 523
 524 static void ndisc_send_unsol_na(struct net_device *dev)
 525 {
 526         struct inet6_dev *idev;
 527         struct inet6_ifaddr *ifa;
 528
 529         idev = in6_dev_get(dev);
 530         if (!idev)
 531                 return;
 532
 533         read_lock_bh(&idev->lock);
 534         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 535                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
 536                               /*router=*/ !!idev->cnf.forwarding,
 537                               /*solicited=*/ false, /*override=*/ true,
 538                               /*inc_opt=*/ true);
 539         }
 540         read_unlock_bh(&idev->lock);
 541
 542         in6_dev_put(idev);
 543 }
 544
 545 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 546                    const struct in6_addr *solicit,
 547                    const struct in6_addr *daddr, const struct in6_addr *saddr)
 548 {
 549         struct sk_buff *skb;
 550         struct in6_addr addr_buf;
 551         int inc_opt = dev->addr_len;
 552         int optlen = 0;
 553         struct nd_msg *msg;
 554
 555         if (saddr == NULL) {
 556                 if (ipv6_get_lladdr(dev, &addr_buf,
 557                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 558                         return;
 559                 saddr = &addr_buf;
 560         }
 561
 562         if (ipv6_addr_any(saddr))
 563                 inc_opt = false;
 564         if (inc_opt)
 565                 optlen += ndisc_opt_addr_space(dev);
 566
 567         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 568         if (!skb)
 569                 return;
 570
 571         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 572         *msg = (struct nd_msg) {
 573                 .icmph = {
 574                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 575                 },
 576                 .target = *solicit,
 577         };
 578
 579         if (inc_opt)
 580                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 581                                        dev->dev_addr);
 582
 583         ndisc_send_skb(skb, daddr, saddr);
 584 }
 585
 586 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 587                    const struct in6_addr *daddr)
 588 {
 589         struct sk_buff *skb;
 590         struct rs_msg *msg;
 591         int send_sllao = dev->addr_len;
 592         int optlen = 0;
 593
 594 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 595         /*
 596          * According to section 2.2 of RFC 4429, we must not
 597          * send router solicitations with a sllao from
 598          * optimistic addresses, but we may send the solicitation
 599          * if we don't include the sllao.  So here we check
 600          * if our address is optimistic, and if so, we
 601          * suppress the inclusion of the sllao.
 602          */
 603         if (send_sllao) {
 604                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 605                                                            dev, 1);
 606                 if (ifp) {
 607                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 608                                 send_sllao = 0;
 609                         }
 610                         in6_ifa_put(ifp);
 611                 } else {
 612                         send_sllao = 0;
 613                 }
 614         }
 615 #endif
 616         if (send_sllao)
 617                 optlen += ndisc_opt_addr_space(dev);
 618
 619         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 620         if (!skb)
 621                 return;
 622
 623         msg = (struct rs_msg *)skb_put(skb, sizeof(*msg));
 624         *msg = (struct rs_msg) {
 625                 .icmph = {
 626                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 627                 },
 628         };
 629
 630         if (send_sllao)
 631                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 632                                        dev->dev_addr);
 633
 634         ndisc_send_skb(skb, daddr, saddr);
 635 }
 636
 637
 638 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 639 {
 640         /*
 641          *      "The sender MUST return an ICMP
 642          *       destination unreachable"
 643          */
 644         dst_link_failure(skb);
 645         kfree_skb(skb);
 646 }
 647
 648 /* Called with locked neigh: either read or both */
 649
 650 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 651 {
 652         struct in6_addr *saddr = NULL;
 653         struct in6_addr mcaddr;
 654         struct net_device *dev = neigh->dev;
 655         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 656         int probes = atomic_read(&neigh->probes);
 657
 658         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 659                                            dev, 1,
 660                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 661                 saddr = &ipv6_hdr(skb)->saddr;
 662         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 663         if (probes < 0) {
 664                 if (!(neigh->nud_state & NUD_VALID)) {
 665                         ND_PRINTK(1, dbg,
 666                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 667                                   __func__, target);
 668                 }
 669                 ndisc_send_ns(dev, neigh, target, target, saddr);
 670         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 671                 neigh_app_ns(neigh);
 672         } else {
 673                 addrconf_addr_solict_mult(target, &mcaddr);
 674                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 675         }
 676 }
 677
 678 static int pndisc_is_router(const void *pkey,
 679                             struct net_device *dev)
 680 {
 681         struct pneigh_entry *n;
 682         int ret = -1;
 683
 684         read_lock_bh(&nd_tbl.lock);
 685         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 686         if (n)
 687                 ret = !!(n->flags & NTF_ROUTER);
 688         read_unlock_bh(&nd_tbl.lock);
 689
 690         return ret;
 691 }
 692
 693 static void ndisc_recv_ns(struct sk_buff *skb)
 694 {
 695         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 696         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 697         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 698         u8 *lladdr = NULL;
 699         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 700                                     offsetof(struct nd_msg, opt));
 701         struct ndisc_options ndopts;
 702         struct net_device *dev = skb->dev;
 703         struct inet6_ifaddr *ifp;
 704         struct inet6_dev *idev = NULL;
 705         struct neighbour *neigh;
 706         int dad = ipv6_addr_any(saddr);
 707         bool inc;
 708         int is_router = -1;
 709
 710         if (skb->len < sizeof(struct nd_msg)) {
 711                 ND_PRINTK(2, warn, "NS: packet too short\n");
 712                 return;
 713         }
 714
 715         if (ipv6_addr_is_multicast(&msg->target)) {
 716                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 717                 return;
 718         }
 719
 720         /*
 721          * RFC2461 7.1.1:
 722          * DAD has to be destined for solicited node multicast address.
 723          */
 724         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 725                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 726                 return;
 727         }
 728
 729         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 730                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 731                 return;
 732         }
 733
 734         if (ndopts.nd_opts_src_lladdr) {
 735                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 736                 if (!lladdr) {
 737                         ND_PRINTK(2, warn,
 738                                   "NS: invalid link-layer address length\n");
 739                         return;
 740                 }
 741
 742                 /* RFC2461 7.1.1:
 743                  *      If the IP source address is the unspecified address,
 744                  *      there MUST NOT be source link-layer address option
 745                  *      in the message.
 746                  */
 747                 if (dad) {
 748                         ND_PRINTK(2, warn,
 749                                   "NS: bad DAD packet (link-layer address option)\n");
 750                         return;
 751                 }
 752         }
 753
 754         inc = ipv6_addr_is_multicast(daddr);
 755
 756         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 757         if (ifp) {
 758
 759                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 760                         if (dad) {
 761                                 /*
 762                                  * We are colliding with another node
 763                                  * who is doing DAD
 764                                  * so fail our DAD process
 765                                  */
 766                                 addrconf_dad_failure(ifp);
 767                                 return;
 768                         } else {
 769                                 /*
 770                                  * This is not a dad solicitation.
 771                                  * If we are an optimistic node,
 772                                  * we should respond.
 773                                  * Otherwise, we should ignore it.
 774                                  */
 775                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 776                                         goto out;
 777                         }
 778                 }
 779
 780                 idev = ifp->idev;
 781         } else {
 782                 struct net *net = dev_net(dev);
 783
 784                 idev = in6_dev_get(dev);
 785                 if (!idev) {
 786                         /* XXX: count this drop? */
 787                         return;
 788                 }
 789
 790                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 791                     (idev->cnf.forwarding &&
 792                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 793                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 794                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 795                             skb->pkt_type != PACKET_HOST &&
 796                             inc &&
 797                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 798                                 /*
 799                                  * for anycast or proxy,
 800                                  * sender should delay its response
 801                                  * by a random time between 0 and
 802                                  * MAX_ANYCAST_DELAY_TIME seconds.
 803                                  * (RFC2461) -- yoshfuji
 804                                  */
 805                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 806                                 if (n)
 807                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 808                                 goto out;
 809                         }
 810                 } else
 811                         goto out;
 812         }
 813
 814         if (is_router < 0)
 815                 is_router = idev->cnf.forwarding;
 816
 817         if (dad) {
 818                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
 819                               !!is_router, false, (ifp != NULL), true);
 820                 goto out;
 821         }
 822
 823         if (inc)
 824                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 825         else
 826                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 827
 828         /*
 829          *      update / create cache entry
 830          *      for the source address
 831          */
 832         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 833                                !inc || lladdr || !dev->addr_len);
 834         if (neigh)
 835                 neigh_update(neigh, lladdr, NUD_STALE,
 836                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 837                              NEIGH_UPDATE_F_OVERRIDE);
 838         if (neigh || !dev->header_ops) {
 839                 ndisc_send_na(dev, neigh, saddr, &msg->target,
 840                               !!is_router,
 841                               true, (ifp != NULL && inc), inc);
 842                 if (neigh)
 843                         neigh_release(neigh);
 844         }
 845
 846 out:
 847         if (ifp)
 848                 in6_ifa_put(ifp);
 849         else
 850                 in6_dev_put(idev);
 851 }
 852
 853 static void ndisc_recv_na(struct sk_buff *skb)
 854 {
 855         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 856         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 857         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 858         u8 *lladdr = NULL;
 859         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 860                                     offsetof(struct nd_msg, opt));
 861         struct ndisc_options ndopts;
 862         struct net_device *dev = skb->dev;
 863         struct inet6_ifaddr *ifp;
 864         struct neighbour *neigh;
 865
 866         if (skb->len < sizeof(struct nd_msg)) {
 867                 ND_PRINTK(2, warn, "NA: packet too short\n");
 868                 return;
 869         }
 870
 871         if (ipv6_addr_is_multicast(&msg->target)) {
 872                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 873                 return;
 874         }
 875
 876         if (ipv6_addr_is_multicast(daddr) &&
 877             msg->icmph.icmp6_solicited) {
 878                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 879                 return;
 880         }
 881
 882         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 883                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 884                 return;
 885         }
 886         if (ndopts.nd_opts_tgt_lladdr) {
 887                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 888                 if (!lladdr) {
 889                         ND_PRINTK(2, warn,
 890                                   "NA: invalid link-layer address length\n");
 891                         return;
 892                 }
 893         }
 894         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 895         if (ifp) {
 896                 if (skb->pkt_type != PACKET_LOOPBACK
 897                     && (ifp->flags & IFA_F_TENTATIVE)) {
 898                                 addrconf_dad_failure(ifp);
 899                                 return;
 900                 }
 901                 /* What should we make now? The advertisement
 902                    is invalid, but ndisc specs say nothing
 903                    about it. It could be misconfiguration, or
 904                    an smart proxy agent tries to help us :-)
 905
 906                    We should not print the error if NA has been
 907                    received from loopback - it is just our own
 908                    unsolicited advertisement.
 909                  */
 910                 if (skb->pkt_type != PACKET_LOOPBACK)
 911                         ND_PRINTK(1, warn,
 912                                   "NA: someone advertises our address %pI6 on %s!\n",
 913                                   &ifp->addr, ifp->idev->dev->name);
 914                 in6_ifa_put(ifp);
 915                 return;
 916         }
 917         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 918
 919         if (neigh) {
 920                 u8 old_flags = neigh->flags;
 921                 struct net *net = dev_net(dev);
 922
 923                 if (neigh->nud_state & NUD_FAILED)
 924                         goto out;
 925
 926                 /*
 927                  * Don't update the neighbor cache entry on a proxy NA from
 928                  * ourselves because either the proxied node is off link or it
 929                  * has already sent a NA to us.
 930                  */
 931                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 932                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
 933                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
 934                         /* XXX: idev->cnf.proxy_ndp */
 935                         goto out;
 936                 }
 937
 938                 neigh_update(neigh, lladdr,
 939                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 940                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 941                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 942                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 943                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 944
 945                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 946                         /*
 947                          * Change: router to host
 948                          */
 949                         rt6_clean_tohost(dev_net(dev),  saddr);
 950                 }
 951
 952 out:
 953                 neigh_release(neigh);
 954         }
 955 }
 956
 957 static void ndisc_recv_rs(struct sk_buff *skb)
 958 {
 959         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 960         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 961         struct neighbour *neigh;
 962         struct inet6_dev *idev;
 963         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 964         struct ndisc_options ndopts;
 965         u8 *lladdr = NULL;
 966
 967         if (skb->len < sizeof(*rs_msg))
 968                 return;
 969
 970         idev = __in6_dev_get(skb->dev);
 971         if (!idev) {
 972                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
 973                 return;
 974         }
 975
 976         /* Don't accept RS if we're not in router mode */
 977         if (!idev->cnf.forwarding)
 978                 goto out;
 979
 980         /*
 981          * Don't update NCE if src = ::;
 982          * this implies that the source node has no ip address assigned yet.
 983          */
 984         if (ipv6_addr_any(saddr))
 985                 goto out;
 986
 987         /* Parse ND options */
 988         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 989                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
 990                 goto out;
 991         }
 992
 993         if (ndopts.nd_opts_src_lladdr) {
 994                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
 995                                              skb->dev);
 996                 if (!lladdr)
 997                         goto out;
 998         }
 999
1000         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1001         if (neigh) {
1002                 neigh_update(neigh, lladdr, NUD_STALE,
1003                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1004                              NEIGH_UPDATE_F_OVERRIDE|
1005                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1006                 neigh_release(neigh);
1007         }
1008 out:
1009         return;
1010 }
1011
1012 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1013 {
1014         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1015         struct sk_buff *skb;
1016         struct nlmsghdr *nlh;
1017         struct nduseroptmsg *ndmsg;
1018         struct net *net = dev_net(ra->dev);
1019         int err;
1020         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1021                                     + (opt->nd_opt_len << 3));
1022         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1023
1024         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1025         if (skb == NULL) {
1026                 err = -ENOBUFS;
1027                 goto errout;
1028         }
1029
1030         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1031         if (nlh == NULL) {
1032                 goto nla_put_failure;
1033         }
1034
1035         ndmsg = nlmsg_data(nlh);
1036         ndmsg->nduseropt_family = AF_INET6;
1037         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1038         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1039         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1040         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1041
1042         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1043
1044         if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1045                     &ipv6_hdr(ra)->saddr))
1046                 goto nla_put_failure;
1047         nlmsg_end(skb, nlh);
1048
1049         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1050         return;
1051
1052 nla_put_failure:
1053         nlmsg_free(skb);
1054         err = -EMSGSIZE;
1055 errout:
1056         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1057 }
1058
1059 static void ndisc_router_discovery(struct sk_buff *skb)
1060 {
1061         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1062         struct neighbour *neigh = NULL;
1063         struct inet6_dev *in6_dev;
1064         struct rt6_info *rt = NULL;
1065         int lifetime;
1066         struct ndisc_options ndopts;
1067         int optlen;
1068         unsigned int pref = 0;
1069
1070         __u8 *opt = (__u8 *)(ra_msg + 1);
1071
1072         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1073                 sizeof(struct ra_msg);
1074
1075         ND_PRINTK(2, info,
1076                   "RA: %s, dev: %s\n",
1077                   __func__, skb->dev->name);
1078         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1079                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1080                 return;
1081         }
1082         if (optlen < 0) {
1083                 ND_PRINTK(2, warn, "RA: packet too short\n");
1084                 return;
1085         }
1086
1087 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1088         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1089                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1090                 return;
1091         }
1092 #endif
1093
1094         /*
1095          *      set the RA_RECV flag in the interface
1096          */
1097
1098         in6_dev = __in6_dev_get(skb->dev);
1099         if (in6_dev == NULL) {
1100                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1101                           skb->dev->name);
1102                 return;
1103         }
1104
1105         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1106                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1107                 return;
1108         }
1109
1110         if (!ipv6_accept_ra(in6_dev)) {
1111                 ND_PRINTK(2, info,
1112                           "RA: %s, did not accept ra for dev: %s\n",
1113                           __func__, skb->dev->name);
1114                 goto skip_linkparms;
1115         }
1116
1117 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1118         /* skip link-specific parameters from interior routers */
1119         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1120                 ND_PRINTK(2, info,
1121                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1122                           __func__, skb->dev->name);
1123                 goto skip_linkparms;
1124         }
1125 #endif
1126
1127         if (in6_dev->if_flags & IF_RS_SENT) {
1128                 /*
1129                  *      flag that an RA was received after an RS was sent
1130                  *      out on this interface.
1131                  */
1132                 in6_dev->if_flags |= IF_RA_RCVD;
1133         }
1134
1135         /*
1136          * Remember the managed/otherconf flags from most recently
1137          * received RA message (RFC 2462) -- yoshfuji
1138          */
1139         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1140                                 IF_RA_OTHERCONF)) |
1141                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1142                                         IF_RA_MANAGED : 0) |
1143                                 (ra_msg->icmph.icmp6_addrconf_other ?
1144                                         IF_RA_OTHERCONF : 0);
1145
1146         if (!in6_dev->cnf.accept_ra_defrtr) {
1147                 ND_PRINTK(2, info,
1148                           "RA: %s, defrtr is false for dev: %s\n",
1149                           __func__, skb->dev->name);
1150                 goto skip_defrtr;
1151         }
1152
1153         /* Do not accept RA with source-addr found on local machine unless
1154          * accept_ra_from_local is set to true.
1155          */
1156         if (!in6_dev->cnf.accept_ra_from_local &&
1157             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1158                           NULL, 0)) {
1159                 ND_PRINTK(2, info,
1160                           "RA from local address detected on dev: %s: default router ignored\n",
1161                           skb->dev->name);
1162                 goto skip_defrtr;
1163         }
1164
1165         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1166
1167 #ifdef CONFIG_IPV6_ROUTER_PREF
1168         pref = ra_msg->icmph.icmp6_router_pref;
1169         /* 10b is handled as if it were 00b (medium) */
1170         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1171             !in6_dev->cnf.accept_ra_rtr_pref)
1172                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1173 #endif
1174
1175         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1176
1177         if (rt) {
1178                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1179                 if (!neigh) {
1180                         ND_PRINTK(0, err,
1181                                   "RA: %s got default router without neighbour\n",
1182                                   __func__);
1183                         ip6_rt_put(rt);
1184                         return;
1185                 }
1186         }
1187         if (rt && lifetime == 0) {
1188                 ip6_del_rt(rt);
1189                 rt = NULL;
1190         }
1191
1192         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, for dev: %s\n",
1193                   rt, lifetime, skb->dev->name);
1194         if (rt == NULL && lifetime) {
1195                 ND_PRINTK(3, info, "RA: adding default router\n");
1196
1197                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1198                 if (rt == NULL) {
1199                         ND_PRINTK(0, err,
1200                                   "RA: %s failed to add default route\n",
1201                                   __func__);
1202                         return;
1203                 }
1204
1205                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1206                 if (neigh == NULL) {
1207                         ND_PRINTK(0, err,
1208                                   "RA: %s got default router without neighbour\n",
1209                                   __func__);
1210                         ip6_rt_put(rt);
1211                         return;
1212                 }
1213                 neigh->flags |= NTF_ROUTER;
1214         } else if (rt) {
1215                 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1216         }
1217
1218         if (rt)
1219                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1220         if (ra_msg->icmph.icmp6_hop_limit) {
1221                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1222                 if (rt)
1223                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1224                                        ra_msg->icmph.icmp6_hop_limit);
1225         }
1226
1227 skip_defrtr:
1228
1229         /*
1230          *      Update Reachable Time and Retrans Timer
1231          */
1232
1233         if (in6_dev->nd_parms) {
1234                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1235
1236                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1237                         rtime = (rtime*HZ)/1000;
1238                         if (rtime < HZ/10)
1239                                 rtime = HZ/10;
1240                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1241                         in6_dev->tstamp = jiffies;
1242                         inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1243                 }
1244
1245                 rtime = ntohl(ra_msg->reachable_time);
1246                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1247                         rtime = (rtime*HZ)/1000;
1248
1249                         if (rtime < HZ/10)
1250                                 rtime = HZ/10;
1251
1252                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1253                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1254                                               BASE_REACHABLE_TIME, rtime);
1255                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1256                                               GC_STALETIME, 3 * rtime);
1257                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1258                                 in6_dev->tstamp = jiffies;
1259                                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1260                         }
1261                 }
1262         }
1263
1264 skip_linkparms:
1265
1266         /*
1267          *      Process options.
1268          */
1269
1270         if (!neigh)
1271                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1272                                        skb->dev, 1);
1273         if (neigh) {
1274                 u8 *lladdr = NULL;
1275                 if (ndopts.nd_opts_src_lladdr) {
1276                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1277                                                      skb->dev);
1278                         if (!lladdr) {
1279                                 ND_PRINTK(2, warn,
1280                                           "RA: invalid link-layer address length\n");
1281                                 goto out;
1282                         }
1283                 }
1284                 neigh_update(neigh, lladdr, NUD_STALE,
1285                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1286                              NEIGH_UPDATE_F_OVERRIDE|
1287                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1288                              NEIGH_UPDATE_F_ISROUTER);
1289         }
1290
1291         if (!ipv6_accept_ra(in6_dev)) {
1292                 ND_PRINTK(2, info,
1293                           "RA: %s, accept_ra is false for dev: %s\n",
1294                           __func__, skb->dev->name);
1295                 goto out;
1296         }
1297
1298 #ifdef CONFIG_IPV6_ROUTE_INFO
1299         if (!in6_dev->cnf.accept_ra_from_local &&
1300             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1301                           NULL, 0)) {
1302                 ND_PRINTK(2, info,
1303                           "RA from local address detected on dev: %s: router info ignored.\n",
1304                           skb->dev->name);
1305                 goto skip_routeinfo;
1306         }
1307
1308         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1309                 struct nd_opt_hdr *p;
1310                 for (p = ndopts.nd_opts_ri;
1311                      p;
1312                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1313                         struct route_info *ri = (struct route_info *)p;
1314 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1315                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1316                             ri->prefix_len == 0)
1317                                 continue;
1318 #endif
1319                         if (ri->prefix_len == 0 &&
1320                             !in6_dev->cnf.accept_ra_defrtr)
1321                                 continue;
1322                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1323                                 continue;
1324                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1325                                       &ipv6_hdr(skb)->saddr);
1326                 }
1327         }
1328
1329 skip_routeinfo:
1330 #endif
1331
1332 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1333         /* skip link-specific ndopts from interior routers */
1334         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1335                 ND_PRINTK(2, info,
1336                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1337                           __func__, skb->dev->name);
1338                 goto out;
1339         }
1340 #endif
1341
1342         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1343                 struct nd_opt_hdr *p;
1344                 for (p = ndopts.nd_opts_pi;
1345                      p;
1346                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1347                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1348                                             (p->nd_opt_len) << 3,
1349                                             ndopts.nd_opts_src_lladdr != NULL);
1350                 }
1351         }
1352
1353         if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1354                 __be32 n;
1355                 u32 mtu;
1356
1357                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1358                 mtu = ntohl(n);
1359
1360                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1361                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1362                 } else if (in6_dev->cnf.mtu6 != mtu) {
1363                         in6_dev->cnf.mtu6 = mtu;
1364
1365                         if (rt)
1366                                 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1367
1368                         rt6_mtu_change(skb->dev, mtu);
1369                 }
1370         }
1371
1372         if (ndopts.nd_useropts) {
1373                 struct nd_opt_hdr *p;
1374                 for (p = ndopts.nd_useropts;
1375                      p;
1376                      p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1377                         ndisc_ra_useropt(skb, p);
1378                 }
1379         }
1380
1381         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1382                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1383         }
1384 out:
1385         ip6_rt_put(rt);
1386         if (neigh)
1387                 neigh_release(neigh);
1388 }
1389
1390 static void ndisc_redirect_rcv(struct sk_buff *skb)
1391 {
1392         u8 *hdr;
1393         struct ndisc_options ndopts;
1394         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1395         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1396                                     offsetof(struct rd_msg, opt));
1397
1398 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1399         switch (skb->ndisc_nodetype) {
1400         case NDISC_NODETYPE_HOST:
1401         case NDISC_NODETYPE_NODEFAULT:
1402                 ND_PRINTK(2, warn,
1403                           "Redirect: from host or unauthorized router\n");
1404                 return;
1405         }
1406 #endif
1407
1408         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1409                 ND_PRINTK(2, warn,
1410                           "Redirect: source address is not link-local\n");
1411                 return;
1412         }
1413
1414         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1415                 return;
1416
1417         if (!ndopts.nd_opts_rh) {
1418                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1419                                         skb->dev->ifindex, 0);
1420                 return;
1421         }
1422
1423         hdr = (u8 *)ndopts.nd_opts_rh;
1424         hdr += 8;
1425         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1426                 return;
1427
1428         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1429 }
1430
1431 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1432                                            struct sk_buff *orig_skb,
1433                                            int rd_len)
1434 {
1435         u8 *opt = skb_put(skb, rd_len);
1436
1437         memset(opt, 0, 8);
1438         *(opt++) = ND_OPT_REDIRECT_HDR;
1439         *(opt++) = (rd_len >> 3);
1440         opt += 6;
1441
1442         memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
1443 }
1444
1445 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1446 {
1447         struct net_device *dev = skb->dev;
1448         struct net *net = dev_net(dev);
1449         struct sock *sk = net->ipv6.ndisc_sk;
1450         int optlen = 0;
1451         struct inet_peer *peer;
1452         struct sk_buff *buff;
1453         struct rd_msg *msg;
1454         struct in6_addr saddr_buf;
1455         struct rt6_info *rt;
1456         struct dst_entry *dst;
1457         struct flowi6 fl6;
1458         int rd_len;
1459         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1460         bool ret;
1461
1462         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1463                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1464                           dev->name);
1465                 return;
1466         }
1467
1468         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1469             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1470                 ND_PRINTK(2, warn,
1471                           "Redirect: target address is not link-local unicast\n");
1472                 return;
1473         }
1474
1475         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1476                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1477
1478         dst = ip6_route_output(net, NULL, &fl6);
1479         if (dst->error) {
1480                 dst_release(dst);
1481                 return;
1482         }
1483         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1484         if (IS_ERR(dst))
1485                 return;
1486
1487         rt = (struct rt6_info *) dst;
1488
1489         if (rt->rt6i_flags & RTF_GATEWAY) {
1490                 ND_PRINTK(2, warn,
1491                           "Redirect: destination is not a neighbour\n");
1492                 goto release;
1493         }
1494         peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
1495         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1496         if (peer)
1497                 inet_putpeer(peer);
1498         if (!ret)
1499                 goto release;
1500
1501         if (dev->addr_len) {
1502                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1503                 if (!neigh) {
1504                         ND_PRINTK(2, warn,
1505                                   "Redirect: no neigh for target address\n");
1506                         goto release;
1507                 }
1508
1509                 read_lock_bh(&neigh->lock);
1510                 if (neigh->nud_state & NUD_VALID) {
1511                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1512                         read_unlock_bh(&neigh->lock);
1513                         ha = ha_buf;
1514                         optlen += ndisc_opt_addr_space(dev);
1515                 } else
1516                         read_unlock_bh(&neigh->lock);
1517
1518                 neigh_release(neigh);
1519         }
1520
1521         rd_len = min_t(unsigned int,
1522                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1523                        skb->len + 8);
1524         rd_len &= ~0x7;
1525         optlen += rd_len;
1526
1527         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1528         if (!buff)
1529                 goto release;
1530
1531         msg = (struct rd_msg *)skb_put(buff, sizeof(*msg));
1532         *msg = (struct rd_msg) {
1533                 .icmph = {
1534                         .icmp6_type = NDISC_REDIRECT,
1535                 },
1536                 .target = *target,
1537                 .dest = ipv6_hdr(skb)->daddr,
1538         };
1539
1540         /*
1541          *      include target_address option
1542          */
1543
1544         if (ha)
1545                 ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
1546
1547         /*
1548          *      build redirect option and copy skb over to the new packet.
1549          */
1550
1551         if (rd_len)
1552                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1553
1554         skb_dst_set(buff, dst);
1555         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1556         return;
1557
1558 release:
1559         dst_release(dst);
1560 }
1561
1562 static void pndisc_redo(struct sk_buff *skb)
1563 {
1564         ndisc_recv_ns(skb);
1565         kfree_skb(skb);
1566 }
1567
1568 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1569 {
1570         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1571
1572         if (!idev)
1573                 return true;
1574         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1575             idev->cnf.suppress_frag_ndisc) {
1576                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1577                 return true;
1578         }
1579         return false;
1580 }
1581
1582 int ndisc_rcv(struct sk_buff *skb)
1583 {
1584         struct nd_msg *msg;
1585
1586         if (ndisc_suppress_frag_ndisc(skb))
1587                 return 0;
1588
1589         if (skb_linearize(skb))
1590                 return 0;
1591
1592         msg = (struct nd_msg *)skb_transport_header(skb);
1593
1594         __skb_push(skb, skb->data - skb_transport_header(skb));
1595
1596         if (ipv6_hdr(skb)->hop_limit != 255) {
1597                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1598                           ipv6_hdr(skb)->hop_limit);
1599                 return 0;
1600         }
1601
1602         if (msg->icmph.icmp6_code != 0) {
1603                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1604                           msg->icmph.icmp6_code);
1605                 return 0;
1606         }
1607
1608         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1609
1610         switch (msg->icmph.icmp6_type) {
1611         case NDISC_NEIGHBOUR_SOLICITATION:
1612                 ndisc_recv_ns(skb);
1613                 break;
1614
1615         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1616                 ndisc_recv_na(skb);
1617                 break;
1618
1619         case NDISC_ROUTER_SOLICITATION:
1620                 ndisc_recv_rs(skb);
1621                 break;
1622
1623         case NDISC_ROUTER_ADVERTISEMENT:
1624                 ndisc_router_discovery(skb);
1625                 break;
1626
1627         case NDISC_REDIRECT:
1628                 ndisc_redirect_rcv(skb);
1629                 break;
1630         }
1631
1632         return 0;
1633 }
1634
1635 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1636 {
1637         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1638         struct net *net = dev_net(dev);
1639         struct inet6_dev *idev;
1640
1641         switch (event) {
1642         case NETDEV_CHANGEADDR:
1643                 neigh_changeaddr(&nd_tbl, dev);
1644                 fib6_run_gc(0, net, false);
1645                 idev = in6_dev_get(dev);
1646                 if (!idev)
1647                         break;
1648                 if (idev->cnf.ndisc_notify)
1649                         ndisc_send_unsol_na(dev);
1650                 in6_dev_put(idev);
1651                 break;
1652         case NETDEV_DOWN:
1653                 neigh_ifdown(&nd_tbl, dev);
1654                 fib6_run_gc(0, net, false);
1655                 break;
1656         case NETDEV_NOTIFY_PEERS:
1657                 ndisc_send_unsol_na(dev);
1658                 break;
1659         default:
1660                 break;
1661         }
1662
1663         return NOTIFY_DONE;
1664 }
1665
1666 static struct notifier_block ndisc_netdev_notifier = {
1667         .notifier_call = ndisc_netdev_event,
1668 };
1669
1670 #ifdef CONFIG_SYSCTL
1671 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1672                                          const char *func, const char *dev_name)
1673 {
1674         static char warncomm[TASK_COMM_LEN];
1675         static int warned;
1676         if (strcmp(warncomm, current->comm) && warned < 5) {
1677                 strcpy(warncomm, current->comm);
1678                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1679                         warncomm, func,
1680                         dev_name, ctl->procname,
1681                         dev_name, ctl->procname);
1682                 warned++;
1683         }
1684 }
1685
1686 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1687 {
1688         struct net_device *dev = ctl->extra1;
1689         struct inet6_dev *idev;
1690         int ret;
1691
1692         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1693             (strcmp(ctl->procname, "base_reachable_time") == 0))
1694                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1695
1696         if (strcmp(ctl->procname, "retrans_time") == 0)
1697                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1698
1699         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1700                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1701                                                   buffer, lenp, ppos);
1702
1703         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1704                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1705                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1706                                                      buffer, lenp, ppos);
1707         else
1708                 ret = -1;
1709
1710         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1711                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1712                         idev->nd_parms->reachable_time =
1713                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1714                 idev->tstamp = jiffies;
1715                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1716                 in6_dev_put(idev);
1717         }
1718         return ret;
1719 }
1720
1721
1722 #endif
1723
1724 static int __net_init ndisc_net_init(struct net *net)
1725 {
1726         struct ipv6_pinfo *np;
1727         struct sock *sk;
1728         int err;
1729
1730         err = inet_ctl_sock_create(&sk, PF_INET6,
1731                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1732         if (err < 0) {
1733                 ND_PRINTK(0, err,
1734                           "NDISC: Failed to initialize the control socket (err %d)\n",
1735                           err);
1736                 return err;
1737         }
1738
1739         net->ipv6.ndisc_sk = sk;
1740
1741         np = inet6_sk(sk);
1742         np->hop_limit = 255;
1743         /* Do not loopback ndisc messages */
1744         np->mc_loop = 0;
1745
1746         return 0;
1747 }
1748
1749 static void __net_exit ndisc_net_exit(struct net *net)
1750 {
1751         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1752 }
1753
1754 static struct pernet_operations ndisc_net_ops = {
1755         .init = ndisc_net_init,
1756         .exit = ndisc_net_exit,
1757 };
1758
1759 int __init ndisc_init(void)
1760 {
1761         int err;
1762
1763         err = register_pernet_subsys(&ndisc_net_ops);
1764         if (err)
1765                 return err;
1766         /*
1767          * Initialize the neighbour table
1768          */
1769         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1770
1771 #ifdef CONFIG_SYSCTL
1772         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1773                                     ndisc_ifinfo_sysctl_change);
1774         if (err)
1775                 goto out_unregister_pernet;
1776 out:
1777 #endif
1778         return err;
1779
1780 #ifdef CONFIG_SYSCTL
1781 out_unregister_pernet:
1782         unregister_pernet_subsys(&ndisc_net_ops);
1783         goto out;
1784 #endif
1785 }
1786
1787 int __init ndisc_late_init(void)
1788 {
1789         return register_netdevice_notifier(&ndisc_netdev_notifier);
1790 }
1791
1792 void ndisc_late_cleanup(void)
1793 {
1794         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1795 }
1796
1797 void ndisc_cleanup(void)
1798 {
1799 #ifdef CONFIG_SYSCTL
1800         neigh_sysctl_unregister(&nd_tbl.parms);
1801 #endif
1802         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1803         unregister_pernet_subsys(&ndisc_net_ops);
1804 }