net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Mike Shaver             <shaver@ingenia.com>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  19  *      Pierre Ynard                    :       export userland ND options
  20  *                                              through netlink (RDNSS support)
  21  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  22  *                                              of an RA.
  23  *      Janos Farkas                    :       kmalloc failure checks
  24  *      Alexey Kuznetsov                :       state machine reworked
  25  *                                              and moved to net/core.
  26  *      Pekka Savola                    :       RFC2461 validation
  27  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  28  */
  29
  30 #define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32 #include <linux/module.h>
  33 #include <linux/errno.h>
  34 #include <linux/types.h>
  35 #include <linux/socket.h>
  36 #include <linux/sockios.h>
  37 #include <linux/sched.h>
  38 #include <linux/net.h>
  39 #include <linux/in6.h>
  40 #include <linux/route.h>
  41 #include <linux/init.h>
  42 #include <linux/rcupdate.h>
  43 #include <linux/slab.h>
  44 #ifdef CONFIG_SYSCTL
  45 #include <linux/sysctl.h>
  46 #endif
  47
  48 #include <linux/if_addr.h>
  49 #include <linux/if_ether.h>
  50 #include <linux/if_arp.h>
  51 #include <linux/ipv6.h>
  52 #include <linux/icmpv6.h>
  53 #include <linux/jhash.h>
  54
  55 #include <net/sock.h>
  56 #include <net/snmp.h>
  57
  58 #include <net/ipv6.h>
  59 #include <net/protocol.h>
  60 #include <net/ndisc.h>
  61 #include <net/ip6_route.h>
  62 #include <net/addrconf.h>
  63 #include <net/icmp.h>
  64
  65 #include <net/netlink.h>
  66 #include <linux/rtnetlink.h>
  67
  68 #include <net/flow.h>
  69 #include <net/ip6_checksum.h>
  70 #include <net/inet_common.h>
  71 #include <linux/proc_fs.h>
  72
  73 #include <linux/netfilter.h>
  74 #include <linux/netfilter_ipv6.h>
  75
  76 static u32 ndisc_hash(const void *pkey,
  77                       const struct net_device *dev,
  78                       __u32 *hash_rnd);
  79 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
  80 static int ndisc_constructor(struct neighbour *neigh);
  81 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  82 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  83 static int pndisc_constructor(struct pneigh_entry *n);
  84 static void pndisc_destructor(struct pneigh_entry *n);
  85 static void pndisc_redo(struct sk_buff *skb);
  86
  87 static const struct neigh_ops ndisc_generic_ops = {
  88         .family =               AF_INET6,
  89         .solicit =              ndisc_solicit,
  90         .error_report =         ndisc_error_report,
  91         .output =               neigh_resolve_output,
  92         .connected_output =     neigh_connected_output,
  93 };
  94
  95 static const struct neigh_ops ndisc_hh_ops = {
  96         .family =               AF_INET6,
  97         .solicit =              ndisc_solicit,
  98         .error_report =         ndisc_error_report,
  99         .output =               neigh_resolve_output,
 100         .connected_output =     neigh_resolve_output,
 101 };
 102
 103
 104 static const struct neigh_ops ndisc_direct_ops = {
 105         .family =               AF_INET6,
 106         .output =               neigh_direct_output,
 107         .connected_output =     neigh_direct_output,
 108 };
 109
 110 struct neigh_table nd_tbl = {
 111         .family =       AF_INET6,
 112         .key_len =      sizeof(struct in6_addr),
 113         .protocol =     cpu_to_be16(ETH_P_IPV6),
 114         .hash =         ndisc_hash,
 115         .key_eq =       ndisc_key_eq,
 116         .constructor =  ndisc_constructor,
 117         .pconstructor = pndisc_constructor,
 118         .pdestructor =  pndisc_destructor,
 119         .proxy_redo =   pndisc_redo,
 120         .id =           "ndisc_cache",
 121         .parms = {
 122                 .tbl                    = &nd_tbl,
 123                 .reachable_time         = ND_REACHABLE_TIME,
 124                 .data = {
 125                         [NEIGH_VAR_MCAST_PROBES] = 3,
 126                         [NEIGH_VAR_UCAST_PROBES] = 3,
 127                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 128                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 129                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 130                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 131                         [NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
 132                         [NEIGH_VAR_PROXY_QLEN] = 64,
 133                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 134                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 135                 },
 136         },
 137         .gc_interval =    30 * HZ,
 138         .gc_thresh1 =    128,
 139         .gc_thresh2 =    512,
 140         .gc_thresh3 =   1024,
 141 };
 142 EXPORT_SYMBOL_GPL(nd_tbl);
 143
 144 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data,
 145                               int data_len, int pad)
 146 {
 147         int space = __ndisc_opt_addr_space(data_len, pad);
 148         u8 *opt = skb_put(skb, space);
 149
 150         opt[0] = type;
 151         opt[1] = space>>3;
 152
 153         memset(opt + 2, 0, pad);
 154         opt   += pad;
 155         space -= pad;
 156
 157         memcpy(opt+2, data, data_len);
 158         data_len += 2;
 159         opt += data_len;
 160         space -= data_len;
 161         if (space > 0)
 162                 memset(opt, 0, space);
 163 }
 164 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
 165
 166 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
 167                                           void *data, u8 icmp6_type)
 168 {
 169         __ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
 170                                  ndisc_addr_option_pad(skb->dev->type));
 171         ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
 172 }
 173
 174 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
 175                                                    void *ha,
 176                                                    const u8 *ops_data)
 177 {
 178         ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
 179         ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
 180 }
 181
 182 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 183                                             struct nd_opt_hdr *end)
 184 {
 185         int type;
 186         if (!cur || !end || cur >= end)
 187                 return NULL;
 188         type = cur->nd_opt_type;
 189         do {
 190                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 191         } while (cur < end && cur->nd_opt_type != type);
 192         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 193 }
 194
 195 static inline int ndisc_is_useropt(const struct net_device *dev,
 196                                    struct nd_opt_hdr *opt)
 197 {
 198         return opt->nd_opt_type == ND_OPT_RDNSS ||
 199                 opt->nd_opt_type == ND_OPT_DNSSL ||
 200                 ndisc_ops_is_useropt(dev, opt->nd_opt_type);
 201 }
 202
 203 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
 204                                              struct nd_opt_hdr *cur,
 205                                              struct nd_opt_hdr *end)
 206 {
 207         if (!cur || !end || cur >= end)
 208                 return NULL;
 209         do {
 210                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 211         } while (cur < end && !ndisc_is_useropt(dev, cur));
 212         return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
 213 }
 214
 215 struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 216                                           u8 *opt, int opt_len,
 217                                           struct ndisc_options *ndopts)
 218 {
 219         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 220
 221         if (!nd_opt || opt_len < 0 || !ndopts)
 222                 return NULL;
 223         memset(ndopts, 0, sizeof(*ndopts));
 224         while (opt_len) {
 225                 int l;
 226                 if (opt_len < sizeof(struct nd_opt_hdr))
 227                         return NULL;
 228                 l = nd_opt->nd_opt_len << 3;
 229                 if (opt_len < l || l == 0)
 230                         return NULL;
 231                 if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
 232                         goto next_opt;
 233                 switch (nd_opt->nd_opt_type) {
 234                 case ND_OPT_SOURCE_LL_ADDR:
 235                 case ND_OPT_TARGET_LL_ADDR:
 236                 case ND_OPT_MTU:
 237                 case ND_OPT_NONCE:
 238                 case ND_OPT_REDIRECT_HDR:
 239                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 240                                 ND_PRINTK(2, warn,
 241                                           "%s: duplicated ND6 option found: type=%d\n",
 242                                           __func__, nd_opt->nd_opt_type);
 243                         } else {
 244                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 245                         }
 246                         break;
 247                 case ND_OPT_PREFIX_INFO:
 248                         ndopts->nd_opts_pi_end = nd_opt;
 249                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 250                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 251                         break;
 252 #ifdef CONFIG_IPV6_ROUTE_INFO
 253                 case ND_OPT_ROUTE_INFO:
 254                         ndopts->nd_opts_ri_end = nd_opt;
 255                         if (!ndopts->nd_opts_ri)
 256                                 ndopts->nd_opts_ri = nd_opt;
 257                         break;
 258 #endif
 259                 default:
 260                         if (ndisc_is_useropt(dev, nd_opt)) {
 261                                 ndopts->nd_useropts_end = nd_opt;
 262                                 if (!ndopts->nd_useropts)
 263                                         ndopts->nd_useropts = nd_opt;
 264                         } else {
 265                                 /*
 266                                  * Unknown options must be silently ignored,
 267                                  * to accommodate future extension to the
 268                                  * protocol.
 269                                  */
 270                                 ND_PRINTK(2, notice,
 271                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 272                                           __func__,
 273                                           nd_opt->nd_opt_type,
 274                                           nd_opt->nd_opt_len);
 275                         }
 276                 }
 277 next_opt:
 278                 opt_len -= l;
 279                 nd_opt = ((void *)nd_opt) + l;
 280         }
 281         return ndopts;
 282 }
 283
 284 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 285 {
 286         switch (dev->type) {
 287         case ARPHRD_ETHER:
 288         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 289         case ARPHRD_FDDI:
 290                 ipv6_eth_mc_map(addr, buf);
 291                 return 0;
 292         case ARPHRD_ARCNET:
 293                 ipv6_arcnet_mc_map(addr, buf);
 294                 return 0;
 295         case ARPHRD_INFINIBAND:
 296                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 297                 return 0;
 298         case ARPHRD_IPGRE:
 299                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 300         default:
 301                 if (dir) {
 302                         memcpy(buf, dev->broadcast, dev->addr_len);
 303                         return 0;
 304                 }
 305         }
 306         return -EINVAL;
 307 }
 308 EXPORT_SYMBOL(ndisc_mc_map);
 309
 310 static u32 ndisc_hash(const void *pkey,
 311                       const struct net_device *dev,
 312                       __u32 *hash_rnd)
 313 {
 314         return ndisc_hashfn(pkey, dev, hash_rnd);
 315 }
 316
 317 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
 318 {
 319         return neigh_key_eq128(n, pkey);
 320 }
 321
 322 static int ndisc_constructor(struct neighbour *neigh)
 323 {
 324         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 325         struct net_device *dev = neigh->dev;
 326         struct inet6_dev *in6_dev;
 327         struct neigh_parms *parms;
 328         bool is_multicast = ipv6_addr_is_multicast(addr);
 329
 330         in6_dev = in6_dev_get(dev);
 331         if (!in6_dev) {
 332                 return -EINVAL;
 333         }
 334
 335         parms = in6_dev->nd_parms;
 336         __neigh_parms_put(neigh->parms);
 337         neigh->parms = neigh_parms_clone(parms);
 338
 339         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 340         if (!dev->header_ops) {
 341                 neigh->nud_state = NUD_NOARP;
 342                 neigh->ops = &ndisc_direct_ops;
 343                 neigh->output = neigh_direct_output;
 344         } else {
 345                 if (is_multicast) {
 346                         neigh->nud_state = NUD_NOARP;
 347                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 348                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 349                         neigh->nud_state = NUD_NOARP;
 350                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 351                         if (dev->flags&IFF_LOOPBACK)
 352                                 neigh->type = RTN_LOCAL;
 353                 } else if (dev->flags&IFF_POINTOPOINT) {
 354                         neigh->nud_state = NUD_NOARP;
 355                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 356                 }
 357                 if (dev->header_ops->cache)
 358                         neigh->ops = &ndisc_hh_ops;
 359                 else
 360                         neigh->ops = &ndisc_generic_ops;
 361                 if (neigh->nud_state&NUD_VALID)
 362                         neigh->output = neigh->ops->connected_output;
 363                 else
 364                         neigh->output = neigh->ops->output;
 365         }
 366         in6_dev_put(in6_dev);
 367         return 0;
 368 }
 369
 370 static int pndisc_constructor(struct pneigh_entry *n)
 371 {
 372         struct in6_addr *addr = (struct in6_addr *)&n->key;
 373         struct in6_addr maddr;
 374         struct net_device *dev = n->dev;
 375
 376         if (!dev || !__in6_dev_get(dev))
 377                 return -EINVAL;
 378         addrconf_addr_solict_mult(addr, &maddr);
 379         ipv6_dev_mc_inc(dev, &maddr);
 380         return 0;
 381 }
 382
 383 static void pndisc_destructor(struct pneigh_entry *n)
 384 {
 385         struct in6_addr *addr = (struct in6_addr *)&n->key;
 386         struct in6_addr maddr;
 387         struct net_device *dev = n->dev;
 388
 389         if (!dev || !__in6_dev_get(dev))
 390                 return;
 391         addrconf_addr_solict_mult(addr, &maddr);
 392         ipv6_dev_mc_dec(dev, &maddr);
 393 }
 394
 395 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 396                                        int len)
 397 {
 398         int hlen = LL_RESERVED_SPACE(dev);
 399         int tlen = dev->needed_tailroom;
 400         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 401         struct sk_buff *skb;
 402
 403         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 404         if (!skb) {
 405                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 406                           __func__);
 407                 return NULL;
 408         }
 409
 410         skb->protocol = htons(ETH_P_IPV6);
 411         skb->dev = dev;
 412
 413         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 414         skb_reset_transport_header(skb);
 415
 416         /* Manually assign socket ownership as we avoid calling
 417          * sock_alloc_send_pskb() to bypass wmem buffer limits
 418          */
 419         skb_set_owner_w(skb, sk);
 420
 421         return skb;
 422 }
 423
 424 static void ip6_nd_hdr(struct sk_buff *skb,
 425                        const struct in6_addr *saddr,
 426                        const struct in6_addr *daddr,
 427                        int hop_limit, int len)
 428 {
 429         struct ipv6hdr *hdr;
 430         struct inet6_dev *idev;
 431         unsigned tclass;
 432
 433         rcu_read_lock();
 434         idev = __in6_dev_get(skb->dev);
 435         tclass = idev ? idev->cnf.ndisc_tclass : 0;
 436         rcu_read_unlock();
 437
 438         skb_push(skb, sizeof(*hdr));
 439         skb_reset_network_header(skb);
 440         hdr = ipv6_hdr(skb);
 441
 442         ip6_flow_hdr(hdr, tclass, 0);
 443
 444         hdr->payload_len = htons(len);
 445         hdr->nexthdr = IPPROTO_ICMPV6;
 446         hdr->hop_limit = hop_limit;
 447
 448         hdr->saddr = *saddr;
 449         hdr->daddr = *daddr;
 450 }
 451
 452 static void ndisc_send_skb(struct sk_buff *skb,
 453                            const struct in6_addr *daddr,
 454                            const struct in6_addr *saddr)
 455 {
 456         struct dst_entry *dst = skb_dst(skb);
 457         struct net *net = dev_net(skb->dev);
 458         struct sock *sk = net->ipv6.ndisc_sk;
 459         struct inet6_dev *idev;
 460         int err;
 461         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 462         u8 type;
 463
 464         type = icmp6h->icmp6_type;
 465
 466         if (!dst) {
 467                 struct flowi6 fl6;
 468                 int oif = skb->dev->ifindex;
 469
 470                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 471                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 472                 if (IS_ERR(dst)) {
 473                         kfree_skb(skb);
 474                         return;
 475                 }
 476
 477                 skb_dst_set(skb, dst);
 478         }
 479
 480         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 481                                               IPPROTO_ICMPV6,
 482                                               csum_partial(icmp6h,
 483                                                            skb->len, 0));
 484
 485         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 486
 487         rcu_read_lock();
 488         idev = __in6_dev_get(dst->dev);
 489         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 490
 491         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
 492                       net, sk, skb, NULL, dst->dev,
 493                       dst_output);
 494         if (!err) {
 495                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 496                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 497         }
 498
 499         rcu_read_unlock();
 500 }
 501
 502 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
 503                    const struct in6_addr *solicited_addr,
 504                    bool router, bool solicited, bool override, bool inc_opt)
 505 {
 506         struct sk_buff *skb;
 507         struct in6_addr tmpaddr;
 508         struct inet6_ifaddr *ifp;
 509         const struct in6_addr *src_addr;
 510         struct nd_msg *msg;
 511         int optlen = 0;
 512
 513         /* for anycast or proxy, solicited_addr != src_addr */
 514         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 515         if (ifp) {
 516                 src_addr = solicited_addr;
 517                 if (ifp->flags & IFA_F_OPTIMISTIC)
 518                         override = false;
 519                 inc_opt |= ifp->idev->cnf.force_tllao;
 520                 in6_ifa_put(ifp);
 521         } else {
 522                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 523                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 524                                        &tmpaddr))
 525                         return;
 526                 src_addr = &tmpaddr;
 527         }
 528
 529         if (!dev->addr_len)
 530                 inc_opt = false;
 531         if (inc_opt)
 532                 optlen += ndisc_opt_addr_space(dev,
 533                                                NDISC_NEIGHBOUR_ADVERTISEMENT);
 534
 535         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 536         if (!skb)
 537                 return;
 538
 539         msg = skb_put(skb, sizeof(*msg));
 540         *msg = (struct nd_msg) {
 541                 .icmph = {
 542                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 543                         .icmp6_router = router,
 544                         .icmp6_solicited = solicited,
 545                         .icmp6_override = override,
 546                 },
 547                 .target = *solicited_addr,
 548         };
 549
 550         if (inc_opt)
 551                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 552                                        dev->dev_addr,
 553                                        NDISC_NEIGHBOUR_ADVERTISEMENT);
 554
 555         ndisc_send_skb(skb, daddr, src_addr);
 556 }
 557
 558 static void ndisc_send_unsol_na(struct net_device *dev)
 559 {
 560         struct inet6_dev *idev;
 561         struct inet6_ifaddr *ifa;
 562
 563         idev = in6_dev_get(dev);
 564         if (!idev)
 565                 return;
 566
 567         read_lock_bh(&idev->lock);
 568         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 569                 /* skip tentative addresses until dad completes */
 570                 if (ifa->flags & IFA_F_TENTATIVE &&
 571                     !(ifa->flags & IFA_F_OPTIMISTIC))
 572                         continue;
 573
 574                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
 575                               /*router=*/ !!idev->cnf.forwarding,
 576                               /*solicited=*/ false, /*override=*/ true,
 577                               /*inc_opt=*/ true);
 578         }
 579         read_unlock_bh(&idev->lock);
 580
 581         in6_dev_put(idev);
 582 }
 583
 584 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
 585                    const struct in6_addr *daddr, const struct in6_addr *saddr,
 586                    u64 nonce)
 587 {
 588         struct sk_buff *skb;
 589         struct in6_addr addr_buf;
 590         int inc_opt = dev->addr_len;
 591         int optlen = 0;
 592         struct nd_msg *msg;
 593
 594         if (!saddr) {
 595                 if (ipv6_get_lladdr(dev, &addr_buf,
 596                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 597                         return;
 598                 saddr = &addr_buf;
 599         }
 600
 601         if (ipv6_addr_any(saddr))
 602                 inc_opt = false;
 603         if (inc_opt)
 604                 optlen += ndisc_opt_addr_space(dev,
 605                                                NDISC_NEIGHBOUR_SOLICITATION);
 606         if (nonce != 0)
 607                 optlen += 8;
 608
 609         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 610         if (!skb)
 611                 return;
 612
 613         msg = skb_put(skb, sizeof(*msg));
 614         *msg = (struct nd_msg) {
 615                 .icmph = {
 616                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 617                 },
 618                 .target = *solicit,
 619         };
 620
 621         if (inc_opt)
 622                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 623                                        dev->dev_addr,
 624                                        NDISC_NEIGHBOUR_SOLICITATION);
 625         if (nonce != 0) {
 626                 u8 *opt = skb_put(skb, 8);
 627
 628                 opt[0] = ND_OPT_NONCE;
 629                 opt[1] = 8 >> 3;
 630                 memcpy(opt + 2, &nonce, 6);
 631         }
 632
 633         ndisc_send_skb(skb, daddr, saddr);
 634 }
 635
 636 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 637                    const struct in6_addr *daddr)
 638 {
 639         struct sk_buff *skb;
 640         struct rs_msg *msg;
 641         int send_sllao = dev->addr_len;
 642         int optlen = 0;
 643
 644 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 645         /*
 646          * According to section 2.2 of RFC 4429, we must not
 647          * send router solicitations with a sllao from
 648          * optimistic addresses, but we may send the solicitation
 649          * if we don't include the sllao.  So here we check
 650          * if our address is optimistic, and if so, we
 651          * suppress the inclusion of the sllao.
 652          */
 653         if (send_sllao) {
 654                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 655                                                            dev, 1);
 656                 if (ifp) {
 657                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 658                                 send_sllao = 0;
 659                         }
 660                         in6_ifa_put(ifp);
 661                 } else {
 662                         send_sllao = 0;
 663                 }
 664         }
 665 #endif
 666         if (send_sllao)
 667                 optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
 668
 669         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 670         if (!skb)
 671                 return;
 672
 673         msg = skb_put(skb, sizeof(*msg));
 674         *msg = (struct rs_msg) {
 675                 .icmph = {
 676                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 677                 },
 678         };
 679
 680         if (send_sllao)
 681                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 682                                        dev->dev_addr,
 683                                        NDISC_ROUTER_SOLICITATION);
 684
 685         ndisc_send_skb(skb, daddr, saddr);
 686 }
 687
 688
 689 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 690 {
 691         /*
 692          *      "The sender MUST return an ICMP
 693          *       destination unreachable"
 694          */
 695         dst_link_failure(skb);
 696         kfree_skb(skb);
 697 }
 698
 699 /* Called with locked neigh: either read or both */
 700
 701 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 702 {
 703         struct in6_addr *saddr = NULL;
 704         struct in6_addr mcaddr;
 705         struct net_device *dev = neigh->dev;
 706         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 707         int probes = atomic_read(&neigh->probes);
 708
 709         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 710                                            dev, false, 1,
 711                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 712                 saddr = &ipv6_hdr(skb)->saddr;
 713         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 714         if (probes < 0) {
 715                 if (!(neigh->nud_state & NUD_VALID)) {
 716                         ND_PRINTK(1, dbg,
 717                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 718                                   __func__, target);
 719                 }
 720                 ndisc_send_ns(dev, target, target, saddr, 0);
 721         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 722                 neigh_app_ns(neigh);
 723         } else {
 724                 addrconf_addr_solict_mult(target, &mcaddr);
 725                 ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
 726         }
 727 }
 728
 729 static int pndisc_is_router(const void *pkey,
 730                             struct net_device *dev)
 731 {
 732         struct pneigh_entry *n;
 733         int ret = -1;
 734
 735         read_lock_bh(&nd_tbl.lock);
 736         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 737         if (n)
 738                 ret = !!(n->flags & NTF_ROUTER);
 739         read_unlock_bh(&nd_tbl.lock);
 740
 741         return ret;
 742 }
 743
 744 void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
 745                   const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
 746                   struct ndisc_options *ndopts)
 747 {
 748         neigh_update(neigh, lladdr, new, flags, 0);
 749         /* report ndisc ops about neighbour update */
 750         ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
 751 }
 752
 753 static void ndisc_recv_ns(struct sk_buff *skb)
 754 {
 755         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 756         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 757         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 758         u8 *lladdr = NULL;
 759         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 760                                     offsetof(struct nd_msg, opt));
 761         struct ndisc_options ndopts;
 762         struct net_device *dev = skb->dev;
 763         struct inet6_ifaddr *ifp;
 764         struct inet6_dev *idev = NULL;
 765         struct neighbour *neigh;
 766         int dad = ipv6_addr_any(saddr);
 767         bool inc;
 768         int is_router = -1;
 769         u64 nonce = 0;
 770
 771         if (skb->len < sizeof(struct nd_msg)) {
 772                 ND_PRINTK(2, warn, "NS: packet too short\n");
 773                 return;
 774         }
 775
 776         if (ipv6_addr_is_multicast(&msg->target)) {
 777                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 778                 return;
 779         }
 780
 781         /*
 782          * RFC2461 7.1.1:
 783          * DAD has to be destined for solicited node multicast address.
 784          */
 785         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 786                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 787                 return;
 788         }
 789
 790         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 791                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 792                 return;
 793         }
 794
 795         if (ndopts.nd_opts_src_lladdr) {
 796                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 797                 if (!lladdr) {
 798                         ND_PRINTK(2, warn,
 799                                   "NS: invalid link-layer address length\n");
 800                         return;
 801                 }
 802
 803                 /* RFC2461 7.1.1:
 804                  *      If the IP source address is the unspecified address,
 805                  *      there MUST NOT be source link-layer address option
 806                  *      in the message.
 807                  */
 808                 if (dad) {
 809                         ND_PRINTK(2, warn,
 810                                   "NS: bad DAD packet (link-layer address option)\n");
 811                         return;
 812                 }
 813         }
 814         if (ndopts.nd_opts_nonce)
 815                 memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
 816
 817         inc = ipv6_addr_is_multicast(daddr);
 818
 819         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 820         if (ifp) {
 821 have_ifp:
 822                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 823                         if (dad) {
 824                                 if (nonce != 0 && ifp->dad_nonce == nonce) {
 825                                         u8 *np = (u8 *)&nonce;
 826                                         /* Matching nonce if looped back */
 827                                         ND_PRINTK(2, notice,
 828                                                   "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
 829                                                   ifp->idev->dev->name,
 830                                                   &ifp->addr, np);
 831                                         goto out;
 832                                 }
 833                                 /*
 834                                  * We are colliding with another node
 835                                  * who is doing DAD
 836                                  * so fail our DAD process
 837                                  */
 838                                 addrconf_dad_failure(skb, ifp);
 839                                 return;
 840                         } else {
 841                                 /*
 842                                  * This is not a dad solicitation.
 843                                  * If we are an optimistic node,
 844                                  * we should respond.
 845                                  * Otherwise, we should ignore it.
 846                                  */
 847                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 848                                         goto out;
 849                         }
 850                 }
 851
 852                 idev = ifp->idev;
 853         } else {
 854                 struct net *net = dev_net(dev);
 855
 856                 /* perhaps an address on the master device */
 857                 if (netif_is_l3_slave(dev)) {
 858                         struct net_device *mdev;
 859
 860                         mdev = netdev_master_upper_dev_get_rcu(dev);
 861                         if (mdev) {
 862                                 ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
 863                                 if (ifp)
 864                                         goto have_ifp;
 865                         }
 866                 }
 867
 868                 idev = in6_dev_get(dev);
 869                 if (!idev) {
 870                         /* XXX: count this drop? */
 871                         return;
 872                 }
 873
 874                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 875                     (idev->cnf.forwarding &&
 876                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 877                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 878                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 879                             skb->pkt_type != PACKET_HOST &&
 880                             inc &&
 881                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 882                                 /*
 883                                  * for anycast or proxy,
 884                                  * sender should delay its response
 885                                  * by a random time between 0 and
 886                                  * MAX_ANYCAST_DELAY_TIME seconds.
 887                                  * (RFC2461) -- yoshfuji
 888                                  */
 889                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 890                                 if (n)
 891                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 892                                 goto out;
 893                         }
 894                 } else
 895                         goto out;
 896         }
 897
 898         if (is_router < 0)
 899                 is_router = idev->cnf.forwarding;
 900
 901         if (dad) {
 902                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
 903                               !!is_router, false, (ifp != NULL), true);
 904                 goto out;
 905         }
 906
 907         if (inc)
 908                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 909         else
 910                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 911
 912         /*
 913          *      update / create cache entry
 914          *      for the source address
 915          */
 916         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 917                                !inc || lladdr || !dev->addr_len);
 918         if (neigh)
 919                 ndisc_update(dev, neigh, lladdr, NUD_STALE,
 920                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 921                              NEIGH_UPDATE_F_OVERRIDE,
 922                              NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
 923         if (neigh || !dev->header_ops) {
 924                 ndisc_send_na(dev, saddr, &msg->target, !!is_router,
 925                               true, (ifp != NULL && inc), inc);
 926                 if (neigh)
 927                         neigh_release(neigh);
 928         }
 929
 930 out:
 931         if (ifp)
 932                 in6_ifa_put(ifp);
 933         else
 934                 in6_dev_put(idev);
 935 }
 936
 937 static void ndisc_recv_na(struct sk_buff *skb)
 938 {
 939         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 940         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 941         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 942         u8 *lladdr = NULL;
 943         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 944                                     offsetof(struct nd_msg, opt));
 945         struct ndisc_options ndopts;
 946         struct net_device *dev = skb->dev;
 947         struct inet6_dev *idev = __in6_dev_get(dev);
 948         struct inet6_ifaddr *ifp;
 949         struct neighbour *neigh;
 950
 951         if (skb->len < sizeof(struct nd_msg)) {
 952                 ND_PRINTK(2, warn, "NA: packet too short\n");
 953                 return;
 954         }
 955
 956         if (ipv6_addr_is_multicast(&msg->target)) {
 957                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 958                 return;
 959         }
 960
 961         if (ipv6_addr_is_multicast(daddr) &&
 962             msg->icmph.icmp6_solicited) {
 963                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 964                 return;
 965         }
 966
 967         /* For some 802.11 wireless deployments (and possibly other networks),
 968          * there will be a NA proxy and unsolicitd packets are attacks
 969          * and thus should not be accepted.
 970          */
 971         if (!msg->icmph.icmp6_solicited && idev &&
 972             idev->cnf.drop_unsolicited_na)
 973                 return;
 974
 975         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 976                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 977                 return;
 978         }
 979         if (ndopts.nd_opts_tgt_lladdr) {
 980                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 981                 if (!lladdr) {
 982                         ND_PRINTK(2, warn,
 983                                   "NA: invalid link-layer address length\n");
 984                         return;
 985                 }
 986         }
 987         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 988         if (ifp) {
 989                 if (skb->pkt_type != PACKET_LOOPBACK
 990                     && (ifp->flags & IFA_F_TENTATIVE)) {
 991                                 addrconf_dad_failure(skb, ifp);
 992                                 return;
 993                 }
 994                 /* What should we make now? The advertisement
 995                    is invalid, but ndisc specs say nothing
 996                    about it. It could be misconfiguration, or
 997                    an smart proxy agent tries to help us :-)
 998
 999                    We should not print the error if NA has been
1000                    received from loopback - it is just our own
1001                    unsolicited advertisement.
1002                  */
1003                 if (skb->pkt_type != PACKET_LOOPBACK)
1004                         ND_PRINTK(1, warn,
1005                                   "NA: %pM advertised our address %pI6c on %s!\n",
1006                                   eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1007                 in6_ifa_put(ifp);
1008                 return;
1009         }
1010         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1011
1012         if (neigh) {
1013                 u8 old_flags = neigh->flags;
1014                 struct net *net = dev_net(dev);
1015
1016                 if (neigh->nud_state & NUD_FAILED)
1017                         goto out;
1018
1019                 /*
1020                  * Don't update the neighbor cache entry on a proxy NA from
1021                  * ourselves because either the proxied node is off link or it
1022                  * has already sent a NA to us.
1023                  */
1024                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1025                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1026                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1027                         /* XXX: idev->cnf.proxy_ndp */
1028                         goto out;
1029                 }
1030
1031                 ndisc_update(dev, neigh, lladdr,
1032                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
1033                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1034                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1035                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1036                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1037                              NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1038
1039                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1040                         /*
1041                          * Change: router to host
1042                          */
1043                         rt6_clean_tohost(dev_net(dev),  saddr);
1044                 }
1045
1046 out:
1047                 neigh_release(neigh);
1048         }
1049 }
1050
1051 static void ndisc_recv_rs(struct sk_buff *skb)
1052 {
1053         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1054         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1055         struct neighbour *neigh;
1056         struct inet6_dev *idev;
1057         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1058         struct ndisc_options ndopts;
1059         u8 *lladdr = NULL;
1060
1061         if (skb->len < sizeof(*rs_msg))
1062                 return;
1063
1064         idev = __in6_dev_get(skb->dev);
1065         if (!idev) {
1066                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
1067                 return;
1068         }
1069
1070         /* Don't accept RS if we're not in router mode */
1071         if (!idev->cnf.forwarding)
1072                 goto out;
1073
1074         /*
1075          * Don't update NCE if src = ::;
1076          * this implies that the source node has no ip address assigned yet.
1077          */
1078         if (ipv6_addr_any(saddr))
1079                 goto out;
1080
1081         /* Parse ND options */
1082         if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts)) {
1083                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
1084                 goto out;
1085         }
1086
1087         if (ndopts.nd_opts_src_lladdr) {
1088                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1089                                              skb->dev);
1090                 if (!lladdr)
1091                         goto out;
1092         }
1093
1094         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1095         if (neigh) {
1096                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1097                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1098                              NEIGH_UPDATE_F_OVERRIDE|
1099                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1100                              NDISC_ROUTER_SOLICITATION, &ndopts);
1101                 neigh_release(neigh);
1102         }
1103 out:
1104         return;
1105 }
1106
1107 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1108 {
1109         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1110         struct sk_buff *skb;
1111         struct nlmsghdr *nlh;
1112         struct nduseroptmsg *ndmsg;
1113         struct net *net = dev_net(ra->dev);
1114         int err;
1115         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1116                                     + (opt->nd_opt_len << 3));
1117         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1118
1119         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1120         if (!skb) {
1121                 err = -ENOBUFS;
1122                 goto errout;
1123         }
1124
1125         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1126         if (!nlh) {
1127                 goto nla_put_failure;
1128         }
1129
1130         ndmsg = nlmsg_data(nlh);
1131         ndmsg->nduseropt_family = AF_INET6;
1132         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1133         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1134         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1135         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1136
1137         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1138
1139         if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1140                 goto nla_put_failure;
1141         nlmsg_end(skb, nlh);
1142
1143         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1144         return;
1145
1146 nla_put_failure:
1147         nlmsg_free(skb);
1148         err = -EMSGSIZE;
1149 errout:
1150         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1151 }
1152
1153 static void ndisc_router_discovery(struct sk_buff *skb)
1154 {
1155         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1156         struct neighbour *neigh = NULL;
1157         struct inet6_dev *in6_dev;
1158         struct rt6_info *rt = NULL;
1159         int lifetime;
1160         struct ndisc_options ndopts;
1161         int optlen;
1162         unsigned int pref = 0;
1163         __u32 old_if_flags;
1164         bool send_ifinfo_notify = false;
1165
1166         __u8 *opt = (__u8 *)(ra_msg + 1);
1167
1168         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1169                 sizeof(struct ra_msg);
1170
1171         ND_PRINTK(2, info,
1172                   "RA: %s, dev: %s\n",
1173                   __func__, skb->dev->name);
1174         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1175                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1176                 return;
1177         }
1178         if (optlen < 0) {
1179                 ND_PRINTK(2, warn, "RA: packet too short\n");
1180                 return;
1181         }
1182
1183 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1184         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1185                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1186                 return;
1187         }
1188 #endif
1189
1190         /*
1191          *      set the RA_RECV flag in the interface
1192          */
1193
1194         in6_dev = __in6_dev_get(skb->dev);
1195         if (!in6_dev) {
1196                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1197                           skb->dev->name);
1198                 return;
1199         }
1200
1201         if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts)) {
1202                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1203                 return;
1204         }
1205
1206         if (!ipv6_accept_ra(in6_dev)) {
1207                 ND_PRINTK(2, info,
1208                           "RA: %s, did not accept ra for dev: %s\n",
1209                           __func__, skb->dev->name);
1210                 goto skip_linkparms;
1211         }
1212
1213 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1214         /* skip link-specific parameters from interior routers */
1215         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1216                 ND_PRINTK(2, info,
1217                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1218                           __func__, skb->dev->name);
1219                 goto skip_linkparms;
1220         }
1221 #endif
1222
1223         if (in6_dev->if_flags & IF_RS_SENT) {
1224                 /*
1225                  *      flag that an RA was received after an RS was sent
1226                  *      out on this interface.
1227                  */
1228                 in6_dev->if_flags |= IF_RA_RCVD;
1229         }
1230
1231         /*
1232          * Remember the managed/otherconf flags from most recently
1233          * received RA message (RFC 2462) -- yoshfuji
1234          */
1235         old_if_flags = in6_dev->if_flags;
1236         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1237                                 IF_RA_OTHERCONF)) |
1238                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1239                                         IF_RA_MANAGED : 0) |
1240                                 (ra_msg->icmph.icmp6_addrconf_other ?
1241                                         IF_RA_OTHERCONF : 0);
1242
1243         if (old_if_flags != in6_dev->if_flags)
1244                 send_ifinfo_notify = true;
1245
1246         if (!in6_dev->cnf.accept_ra_defrtr) {
1247                 ND_PRINTK(2, info,
1248                           "RA: %s, defrtr is false for dev: %s\n",
1249                           __func__, skb->dev->name);
1250                 goto skip_defrtr;
1251         }
1252
1253         /* Do not accept RA with source-addr found on local machine unless
1254          * accept_ra_from_local is set to true.
1255          */
1256         if (!in6_dev->cnf.accept_ra_from_local &&
1257             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1258                           in6_dev->dev, 0)) {
1259                 ND_PRINTK(2, info,
1260                           "RA from local address detected on dev: %s: default router ignored\n",
1261                           skb->dev->name);
1262                 goto skip_defrtr;
1263         }
1264
1265         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1266
1267 #ifdef CONFIG_IPV6_ROUTER_PREF
1268         pref = ra_msg->icmph.icmp6_router_pref;
1269         /* 10b is handled as if it were 00b (medium) */
1270         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1271             !in6_dev->cnf.accept_ra_rtr_pref)
1272                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1273 #endif
1274
1275         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1276
1277         if (rt) {
1278                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1279                 if (!neigh) {
1280                         ND_PRINTK(0, err,
1281                                   "RA: %s got default router without neighbour\n",
1282                                   __func__);
1283                         ip6_rt_put(rt);
1284                         return;
1285                 }
1286         }
1287         if (rt && lifetime == 0) {
1288                 ip6_del_rt(rt);
1289                 rt = NULL;
1290         }
1291
1292         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, for dev: %s\n",
1293                   rt, lifetime, skb->dev->name);
1294         if (!rt && lifetime) {
1295                 ND_PRINTK(3, info, "RA: adding default router\n");
1296
1297                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1298                 if (!rt) {
1299                         ND_PRINTK(0, err,
1300                                   "RA: %s failed to add default route\n",
1301                                   __func__);
1302                         return;
1303                 }
1304
1305                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1306                 if (!neigh) {
1307                         ND_PRINTK(0, err,
1308                                   "RA: %s got default router without neighbour\n",
1309                                   __func__);
1310                         ip6_rt_put(rt);
1311                         return;
1312                 }
1313                 neigh->flags |= NTF_ROUTER;
1314         } else if (rt) {
1315                 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1316         }
1317
1318         if (rt)
1319                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1320         if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1321             ra_msg->icmph.icmp6_hop_limit) {
1322                 if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1323                         in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1324                         if (rt)
1325                                 dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1326                                                ra_msg->icmph.icmp6_hop_limit);
1327                 } else {
1328                         ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1329                 }
1330         }
1331
1332 skip_defrtr:
1333
1334         /*
1335          *      Update Reachable Time and Retrans Timer
1336          */
1337
1338         if (in6_dev->nd_parms) {
1339                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1340
1341                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1342                         rtime = (rtime*HZ)/1000;
1343                         if (rtime < HZ/10)
1344                                 rtime = HZ/10;
1345                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1346                         in6_dev->tstamp = jiffies;
1347                         send_ifinfo_notify = true;
1348                 }
1349
1350                 rtime = ntohl(ra_msg->reachable_time);
1351                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1352                         rtime = (rtime*HZ)/1000;
1353
1354                         if (rtime < HZ/10)
1355                                 rtime = HZ/10;
1356
1357                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1358                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1359                                               BASE_REACHABLE_TIME, rtime);
1360                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1361                                               GC_STALETIME, 3 * rtime);
1362                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1363                                 in6_dev->tstamp = jiffies;
1364                                 send_ifinfo_notify = true;
1365                         }
1366                 }
1367         }
1368
1369         /*
1370          *      Send a notify if RA changed managed/otherconf flags or timer settings
1371          */
1372         if (send_ifinfo_notify)
1373                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1374
1375 skip_linkparms:
1376
1377         /*
1378          *      Process options.
1379          */
1380
1381         if (!neigh)
1382                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1383                                        skb->dev, 1);
1384         if (neigh) {
1385                 u8 *lladdr = NULL;
1386                 if (ndopts.nd_opts_src_lladdr) {
1387                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1388                                                      skb->dev);
1389                         if (!lladdr) {
1390                                 ND_PRINTK(2, warn,
1391                                           "RA: invalid link-layer address length\n");
1392                                 goto out;
1393                         }
1394                 }
1395                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1396                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1397                              NEIGH_UPDATE_F_OVERRIDE|
1398                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1399                              NEIGH_UPDATE_F_ISROUTER,
1400                              NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1401         }
1402
1403         if (!ipv6_accept_ra(in6_dev)) {
1404                 ND_PRINTK(2, info,
1405                           "RA: %s, accept_ra is false for dev: %s\n",
1406                           __func__, skb->dev->name);
1407                 goto out;
1408         }
1409
1410 #ifdef CONFIG_IPV6_ROUTE_INFO
1411         if (!in6_dev->cnf.accept_ra_from_local &&
1412             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1413                           in6_dev->dev, 0)) {
1414                 ND_PRINTK(2, info,
1415                           "RA from local address detected on dev: %s: router info ignored.\n",
1416                           skb->dev->name);
1417                 goto skip_routeinfo;
1418         }
1419
1420         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1421                 struct nd_opt_hdr *p;
1422                 for (p = ndopts.nd_opts_ri;
1423                      p;
1424                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1425                         struct route_info *ri = (struct route_info *)p;
1426 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1427                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1428                             ri->prefix_len == 0)
1429                                 continue;
1430 #endif
1431                         if (ri->prefix_len == 0 &&
1432                             !in6_dev->cnf.accept_ra_defrtr)
1433                                 continue;
1434                         if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1435                                 continue;
1436                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1437                                 continue;
1438                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1439                                       &ipv6_hdr(skb)->saddr);
1440                 }
1441         }
1442
1443 skip_routeinfo:
1444 #endif
1445
1446 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1447         /* skip link-specific ndopts from interior routers */
1448         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1449                 ND_PRINTK(2, info,
1450                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1451                           __func__, skb->dev->name);
1452                 goto out;
1453         }
1454 #endif
1455
1456         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1457                 struct nd_opt_hdr *p;
1458                 for (p = ndopts.nd_opts_pi;
1459                      p;
1460                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1461                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1462                                             (p->nd_opt_len) << 3,
1463                                             ndopts.nd_opts_src_lladdr != NULL);
1464                 }
1465         }
1466
1467         if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1468                 __be32 n;
1469                 u32 mtu;
1470
1471                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1472                 mtu = ntohl(n);
1473
1474                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1475                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1476                 } else if (in6_dev->cnf.mtu6 != mtu) {
1477                         in6_dev->cnf.mtu6 = mtu;
1478
1479                         if (rt)
1480                                 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1481
1482                         rt6_mtu_change(skb->dev, mtu);
1483                 }
1484         }
1485
1486         if (ndopts.nd_useropts) {
1487                 struct nd_opt_hdr *p;
1488                 for (p = ndopts.nd_useropts;
1489                      p;
1490                      p = ndisc_next_useropt(skb->dev, p,
1491                                             ndopts.nd_useropts_end)) {
1492                         ndisc_ra_useropt(skb, p);
1493                 }
1494         }
1495
1496         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1497                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1498         }
1499 out:
1500         ip6_rt_put(rt);
1501         if (neigh)
1502                 neigh_release(neigh);
1503 }
1504
1505 static void ndisc_redirect_rcv(struct sk_buff *skb)
1506 {
1507         u8 *hdr;
1508         struct ndisc_options ndopts;
1509         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1510         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1511                                     offsetof(struct rd_msg, opt));
1512
1513 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1514         switch (skb->ndisc_nodetype) {
1515         case NDISC_NODETYPE_HOST:
1516         case NDISC_NODETYPE_NODEFAULT:
1517                 ND_PRINTK(2, warn,
1518                           "Redirect: from host or unauthorized router\n");
1519                 return;
1520         }
1521 #endif
1522
1523         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1524                 ND_PRINTK(2, warn,
1525                           "Redirect: source address is not link-local\n");
1526                 return;
1527         }
1528
1529         if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1530                 return;
1531
1532         if (!ndopts.nd_opts_rh) {
1533                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1534                                         skb->dev->ifindex, 0);
1535                 return;
1536         }
1537
1538         hdr = (u8 *)ndopts.nd_opts_rh;
1539         hdr += 8;
1540         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1541                 return;
1542
1543         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1544 }
1545
1546 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1547                                            struct sk_buff *orig_skb,
1548                                            int rd_len)
1549 {
1550         u8 *opt = skb_put(skb, rd_len);
1551
1552         memset(opt, 0, 8);
1553         *(opt++) = ND_OPT_REDIRECT_HDR;
1554         *(opt++) = (rd_len >> 3);
1555         opt += 6;
1556
1557         skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1558                       rd_len - 8);
1559 }
1560
1561 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1562 {
1563         struct net_device *dev = skb->dev;
1564         struct net *net = dev_net(dev);
1565         struct sock *sk = net->ipv6.ndisc_sk;
1566         int optlen = 0;
1567         struct inet_peer *peer;
1568         struct sk_buff *buff;
1569         struct rd_msg *msg;
1570         struct in6_addr saddr_buf;
1571         struct rt6_info *rt;
1572         struct dst_entry *dst;
1573         struct flowi6 fl6;
1574         int rd_len;
1575         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1576            ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1577         bool ret;
1578
1579         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1580                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1581                           dev->name);
1582                 return;
1583         }
1584
1585         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1586             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1587                 ND_PRINTK(2, warn,
1588                           "Redirect: target address is not link-local unicast\n");
1589                 return;
1590         }
1591
1592         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1593                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1594
1595         dst = ip6_route_output(net, NULL, &fl6);
1596         if (dst->error) {
1597                 dst_release(dst);
1598                 return;
1599         }
1600         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1601         if (IS_ERR(dst))
1602                 return;
1603
1604         rt = (struct rt6_info *) dst;
1605
1606         if (rt->rt6i_flags & RTF_GATEWAY) {
1607                 ND_PRINTK(2, warn,
1608                           "Redirect: destination is not a neighbour\n");
1609                 goto release;
1610         }
1611         peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1612         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1613         if (peer)
1614                 inet_putpeer(peer);
1615         if (!ret)
1616                 goto release;
1617
1618         if (dev->addr_len) {
1619                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1620                 if (!neigh) {
1621                         ND_PRINTK(2, warn,
1622                                   "Redirect: no neigh for target address\n");
1623                         goto release;
1624                 }
1625
1626                 read_lock_bh(&neigh->lock);
1627                 if (neigh->nud_state & NUD_VALID) {
1628                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1629                         read_unlock_bh(&neigh->lock);
1630                         ha = ha_buf;
1631                         optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1632                                                                 ops_data_buf,
1633                                                                 &ops_data);
1634                 } else
1635                         read_unlock_bh(&neigh->lock);
1636
1637                 neigh_release(neigh);
1638         }
1639
1640         rd_len = min_t(unsigned int,
1641                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1642                        skb->len + 8);
1643         rd_len &= ~0x7;
1644         optlen += rd_len;
1645
1646         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1647         if (!buff)
1648                 goto release;
1649
1650         msg = skb_put(buff, sizeof(*msg));
1651         *msg = (struct rd_msg) {
1652                 .icmph = {
1653                         .icmp6_type = NDISC_REDIRECT,
1654                 },
1655                 .target = *target,
1656                 .dest = ipv6_hdr(skb)->daddr,
1657         };
1658
1659         /*
1660          *      include target_address option
1661          */
1662
1663         if (ha)
1664                 ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1665
1666         /*
1667          *      build redirect option and copy skb over to the new packet.
1668          */
1669
1670         if (rd_len)
1671                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1672
1673         skb_dst_set(buff, dst);
1674         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1675         return;
1676
1677 release:
1678         dst_release(dst);
1679 }
1680
1681 static void pndisc_redo(struct sk_buff *skb)
1682 {
1683         ndisc_recv_ns(skb);
1684         kfree_skb(skb);
1685 }
1686
1687 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1688 {
1689         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1690
1691         if (!idev)
1692                 return true;
1693         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1694             idev->cnf.suppress_frag_ndisc) {
1695                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1696                 return true;
1697         }
1698         return false;
1699 }
1700
1701 int ndisc_rcv(struct sk_buff *skb)
1702 {
1703         struct nd_msg *msg;
1704
1705         if (ndisc_suppress_frag_ndisc(skb))
1706                 return 0;
1707
1708         if (skb_linearize(skb))
1709                 return 0;
1710
1711         msg = (struct nd_msg *)skb_transport_header(skb);
1712
1713         __skb_push(skb, skb->data - skb_transport_header(skb));
1714
1715         if (ipv6_hdr(skb)->hop_limit != 255) {
1716                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1717                           ipv6_hdr(skb)->hop_limit);
1718                 return 0;
1719         }
1720
1721         if (msg->icmph.icmp6_code != 0) {
1722                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1723                           msg->icmph.icmp6_code);
1724                 return 0;
1725         }
1726
1727         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1728
1729         switch (msg->icmph.icmp6_type) {
1730         case NDISC_NEIGHBOUR_SOLICITATION:
1731                 ndisc_recv_ns(skb);
1732                 break;
1733
1734         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1735                 ndisc_recv_na(skb);
1736                 break;
1737
1738         case NDISC_ROUTER_SOLICITATION:
1739                 ndisc_recv_rs(skb);
1740                 break;
1741
1742         case NDISC_ROUTER_ADVERTISEMENT:
1743                 ndisc_router_discovery(skb);
1744                 break;
1745
1746         case NDISC_REDIRECT:
1747                 ndisc_redirect_rcv(skb);
1748                 break;
1749         }
1750
1751         return 0;
1752 }
1753
1754 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1755 {
1756         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1757         struct netdev_notifier_change_info *change_info;
1758         struct net *net = dev_net(dev);
1759         struct inet6_dev *idev;
1760
1761         switch (event) {
1762         case NETDEV_CHANGEADDR:
1763                 neigh_changeaddr(&nd_tbl, dev);
1764                 fib6_run_gc(0, net, false);
1765                 /* fallthrough */
1766         case NETDEV_UP:
1767                 idev = in6_dev_get(dev);
1768                 if (!idev)
1769                         break;
1770                 if (idev->cnf.ndisc_notify ||
1771                     net->ipv6.devconf_all->ndisc_notify)
1772                         ndisc_send_unsol_na(dev);
1773                 in6_dev_put(idev);
1774                 break;
1775         case NETDEV_CHANGE:
1776                 change_info = ptr;
1777                 if (change_info->flags_changed & IFF_NOARP)
1778                         neigh_changeaddr(&nd_tbl, dev);
1779                 break;
1780         case NETDEV_DOWN:
1781                 neigh_ifdown(&nd_tbl, dev);
1782                 fib6_run_gc(0, net, false);
1783                 break;
1784         case NETDEV_NOTIFY_PEERS:
1785                 ndisc_send_unsol_na(dev);
1786                 break;
1787         default:
1788                 break;
1789         }
1790
1791         return NOTIFY_DONE;
1792 }
1793
1794 static struct notifier_block ndisc_netdev_notifier = {
1795         .notifier_call = ndisc_netdev_event,
1796         .priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1797 };
1798
1799 #ifdef CONFIG_SYSCTL
1800 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1801                                          const char *func, const char *dev_name)
1802 {
1803         static char warncomm[TASK_COMM_LEN];
1804         static int warned;
1805         if (strcmp(warncomm, current->comm) && warned < 5) {
1806                 strcpy(warncomm, current->comm);
1807                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1808                         warncomm, func,
1809                         dev_name, ctl->procname,
1810                         dev_name, ctl->procname);
1811                 warned++;
1812         }
1813 }
1814
1815 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1816 {
1817         struct net_device *dev = ctl->extra1;
1818         struct inet6_dev *idev;
1819         int ret;
1820
1821         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1822             (strcmp(ctl->procname, "base_reachable_time") == 0))
1823                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1824
1825         if (strcmp(ctl->procname, "retrans_time") == 0)
1826                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1827
1828         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1829                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1830                                                   buffer, lenp, ppos);
1831
1832         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1833                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1834                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1835                                                      buffer, lenp, ppos);
1836         else
1837                 ret = -1;
1838
1839         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1840                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1841                         idev->nd_parms->reachable_time =
1842                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1843                 idev->tstamp = jiffies;
1844                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1845                 in6_dev_put(idev);
1846         }
1847         return ret;
1848 }
1849
1850
1851 #endif
1852
1853 static int __net_init ndisc_net_init(struct net *net)
1854 {
1855         struct ipv6_pinfo *np;
1856         struct sock *sk;
1857         int err;
1858
1859         err = inet_ctl_sock_create(&sk, PF_INET6,
1860                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1861         if (err < 0) {
1862                 ND_PRINTK(0, err,
1863                           "NDISC: Failed to initialize the control socket (err %d)\n",
1864                           err);
1865                 return err;
1866         }
1867
1868         net->ipv6.ndisc_sk = sk;
1869
1870         np = inet6_sk(sk);
1871         np->hop_limit = 255;
1872         /* Do not loopback ndisc messages */
1873         np->mc_loop = 0;
1874
1875         return 0;
1876 }
1877
1878 static void __net_exit ndisc_net_exit(struct net *net)
1879 {
1880         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1881 }
1882
1883 static struct pernet_operations ndisc_net_ops = {
1884         .init = ndisc_net_init,
1885         .exit = ndisc_net_exit,
1886 };
1887
1888 int __init ndisc_init(void)
1889 {
1890         int err;
1891
1892         err = register_pernet_subsys(&ndisc_net_ops);
1893         if (err)
1894                 return err;
1895         /*
1896          * Initialize the neighbour table
1897          */
1898         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1899
1900 #ifdef CONFIG_SYSCTL
1901         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1902                                     ndisc_ifinfo_sysctl_change);
1903         if (err)
1904                 goto out_unregister_pernet;
1905 out:
1906 #endif
1907         return err;
1908
1909 #ifdef CONFIG_SYSCTL
1910 out_unregister_pernet:
1911         unregister_pernet_subsys(&ndisc_net_ops);
1912         goto out;
1913 #endif
1914 }
1915
1916 int __init ndisc_late_init(void)
1917 {
1918         return register_netdevice_notifier(&ndisc_netdev_notifier);
1919 }
1920
1921 void ndisc_late_cleanup(void)
1922 {
1923         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1924 }
1925
1926 void ndisc_cleanup(void)
1927 {
1928 #ifdef CONFIG_SYSCTL
1929         neigh_sysctl_unregister(&nd_tbl.parms);
1930 #endif
1931         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1932         unregister_pernet_subsys(&ndisc_net_ops);
1933 }