net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Mike Shaver             <shaver@ingenia.com>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  19  *      Pierre Ynard                    :       export userland ND options
  20  *                                              through netlink (RDNSS support)
  21  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  22  *                                              of an RA.
  23  *      Janos Farkas                    :       kmalloc failure checks
  24  *      Alexey Kuznetsov                :       state machine reworked
  25  *                                              and moved to net/core.
  26  *      Pekka Savola                    :       RFC2461 validation
  27  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  28  */
  29
  30 #define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32 #include <linux/module.h>
  33 #include <linux/errno.h>
  34 #include <linux/types.h>
  35 #include <linux/socket.h>
  36 #include <linux/sockios.h>
  37 #include <linux/sched.h>
  38 #include <linux/net.h>
  39 #include <linux/in6.h>
  40 #include <linux/route.h>
  41 #include <linux/init.h>
  42 #include <linux/rcupdate.h>
  43 #include <linux/slab.h>
  44 #ifdef CONFIG_SYSCTL
  45 #include <linux/sysctl.h>
  46 #endif
  47
  48 #include <linux/if_addr.h>
  49 #include <linux/if_arp.h>
  50 #include <linux/ipv6.h>
  51 #include <linux/icmpv6.h>
  52 #include <linux/jhash.h>
  53
  54 #include <net/sock.h>
  55 #include <net/snmp.h>
  56
  57 #include <net/ipv6.h>
  58 #include <net/protocol.h>
  59 #include <net/ndisc.h>
  60 #include <net/ip6_route.h>
  61 #include <net/addrconf.h>
  62 #include <net/icmp.h>
  63
  64 #include <net/netlink.h>
  65 #include <linux/rtnetlink.h>
  66
  67 #include <net/flow.h>
  68 #include <net/ip6_checksum.h>
  69 #include <net/inet_common.h>
  70 #include <linux/proc_fs.h>
  71
  72 #include <linux/netfilter.h>
  73 #include <linux/netfilter_ipv6.h>
  74
  75 /* Set to 3 to get tracing... */
  76 #define ND_DEBUG 1
  77
  78 #define ND_PRINTK(val, level, fmt, ...)                         \
  79 do {                                                            \
  80         if (val <= ND_DEBUG)                                    \
  81                 net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
  82 } while (0)
  83
  84 static u32 ndisc_hash(const void *pkey,
  85                       const struct net_device *dev,
  86                       __u32 *hash_rnd);
  87 static int ndisc_constructor(struct neighbour *neigh);
  88 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  89 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  90 static int pndisc_constructor(struct pneigh_entry *n);
  91 static void pndisc_destructor(struct pneigh_entry *n);
  92 static void pndisc_redo(struct sk_buff *skb);
  93
  94 static const struct neigh_ops ndisc_generic_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_connected_output,
 100 };
 101
 102 static const struct neigh_ops ndisc_hh_ops = {
 103         .family =               AF_INET6,
 104         .solicit =              ndisc_solicit,
 105         .error_report =         ndisc_error_report,
 106         .output =               neigh_resolve_output,
 107         .connected_output =     neigh_resolve_output,
 108 };
 109
 110
 111 static const struct neigh_ops ndisc_direct_ops = {
 112         .family =               AF_INET6,
 113         .output =               neigh_direct_output,
 114         .connected_output =     neigh_direct_output,
 115 };
 116
 117 struct neigh_table nd_tbl = {
 118         .family =       AF_INET6,
 119         .key_len =      sizeof(struct in6_addr),
 120         .hash =         ndisc_hash,
 121         .constructor =  ndisc_constructor,
 122         .pconstructor = pndisc_constructor,
 123         .pdestructor =  pndisc_destructor,
 124         .proxy_redo =   pndisc_redo,
 125         .id =           "ndisc_cache",
 126         .parms = {
 127                 .tbl                    = &nd_tbl,
 128                 .reachable_time         = ND_REACHABLE_TIME,
 129                 .data = {
 130                         [NEIGH_VAR_MCAST_PROBES] = 3,
 131                         [NEIGH_VAR_UCAST_PROBES] = 3,
 132                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 133                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 134                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 135                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 136                         [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
 137                         [NEIGH_VAR_PROXY_QLEN] = 64,
 138                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 139                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 140                 },
 141         },
 142         .gc_interval =    30 * HZ,
 143         .gc_thresh1 =    128,
 144         .gc_thresh2 =    512,
 145         .gc_thresh3 =   1024,
 146 };
 147
 148 static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
 149 {
 150         int pad   = ndisc_addr_option_pad(skb->dev->type);
 151         int data_len = skb->dev->addr_len;
 152         int space = ndisc_opt_addr_space(skb->dev);
 153         u8 *opt = skb_put(skb, space);
 154
 155         opt[0] = type;
 156         opt[1] = space>>3;
 157
 158         memset(opt + 2, 0, pad);
 159         opt   += pad;
 160         space -= pad;
 161
 162         memcpy(opt+2, data, data_len);
 163         data_len += 2;
 164         opt += data_len;
 165         space -= data_len;
 166         if (space > 0)
 167                 memset(opt, 0, space);
 168 }
 169
 170 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 171                                             struct nd_opt_hdr *end)
 172 {
 173         int type;
 174         if (!cur || !end || cur >= end)
 175                 return NULL;
 176         type = cur->nd_opt_type;
 177         do {
 178                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 179         } while (cur < end && cur->nd_opt_type != type);
 180         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 181 }
 182
 183 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 184 {
 185         return opt->nd_opt_type == ND_OPT_RDNSS ||
 186                 opt->nd_opt_type == ND_OPT_DNSSL;
 187 }
 188
 189 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 190                                              struct nd_opt_hdr *end)
 191 {
 192         if (!cur || !end || cur >= end)
 193                 return NULL;
 194         do {
 195                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 196         } while (cur < end && !ndisc_is_useropt(cur));
 197         return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 198 }
 199
 200 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 201                                           struct ndisc_options *ndopts)
 202 {
 203         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 204
 205         if (!nd_opt || opt_len < 0 || !ndopts)
 206                 return NULL;
 207         memset(ndopts, 0, sizeof(*ndopts));
 208         while (opt_len) {
 209                 int l;
 210                 if (opt_len < sizeof(struct nd_opt_hdr))
 211                         return NULL;
 212                 l = nd_opt->nd_opt_len << 3;
 213                 if (opt_len < l || l == 0)
 214                         return NULL;
 215                 switch (nd_opt->nd_opt_type) {
 216                 case ND_OPT_SOURCE_LL_ADDR:
 217                 case ND_OPT_TARGET_LL_ADDR:
 218                 case ND_OPT_MTU:
 219                 case ND_OPT_REDIRECT_HDR:
 220                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 221                                 ND_PRINTK(2, warn,
 222                                           "%s: duplicated ND6 option found: type=%d\n",
 223                                           __func__, nd_opt->nd_opt_type);
 224                         } else {
 225                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 226                         }
 227                         break;
 228                 case ND_OPT_PREFIX_INFO:
 229                         ndopts->nd_opts_pi_end = nd_opt;
 230                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 231                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 232                         break;
 233 #ifdef CONFIG_IPV6_ROUTE_INFO
 234                 case ND_OPT_ROUTE_INFO:
 235                         ndopts->nd_opts_ri_end = nd_opt;
 236                         if (!ndopts->nd_opts_ri)
 237                                 ndopts->nd_opts_ri = nd_opt;
 238                         break;
 239 #endif
 240                 default:
 241                         if (ndisc_is_useropt(nd_opt)) {
 242                                 ndopts->nd_useropts_end = nd_opt;
 243                                 if (!ndopts->nd_useropts)
 244                                         ndopts->nd_useropts = nd_opt;
 245                         } else {
 246                                 /*
 247                                  * Unknown options must be silently ignored,
 248                                  * to accommodate future extension to the
 249                                  * protocol.
 250                                  */
 251                                 ND_PRINTK(2, notice,
 252                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 253                                           __func__,
 254                                           nd_opt->nd_opt_type,
 255                                           nd_opt->nd_opt_len);
 256                         }
 257                 }
 258                 opt_len -= l;
 259                 nd_opt = ((void *)nd_opt) + l;
 260         }
 261         return ndopts;
 262 }
 263
 264 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 265 {
 266         switch (dev->type) {
 267         case ARPHRD_ETHER:
 268         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 269         case ARPHRD_FDDI:
 270                 ipv6_eth_mc_map(addr, buf);
 271                 return 0;
 272         case ARPHRD_ARCNET:
 273                 ipv6_arcnet_mc_map(addr, buf);
 274                 return 0;
 275         case ARPHRD_INFINIBAND:
 276                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 277                 return 0;
 278         case ARPHRD_IPGRE:
 279                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 280         default:
 281                 if (dir) {
 282                         memcpy(buf, dev->broadcast, dev->addr_len);
 283                         return 0;
 284                 }
 285         }
 286         return -EINVAL;
 287 }
 288 EXPORT_SYMBOL(ndisc_mc_map);
 289
 290 static u32 ndisc_hash(const void *pkey,
 291                       const struct net_device *dev,
 292                       __u32 *hash_rnd)
 293 {
 294         return ndisc_hashfn(pkey, dev, hash_rnd);
 295 }
 296
 297 static int ndisc_constructor(struct neighbour *neigh)
 298 {
 299         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 300         struct net_device *dev = neigh->dev;
 301         struct inet6_dev *in6_dev;
 302         struct neigh_parms *parms;
 303         bool is_multicast = ipv6_addr_is_multicast(addr);
 304
 305         in6_dev = in6_dev_get(dev);
 306         if (in6_dev == NULL) {
 307                 return -EINVAL;
 308         }
 309
 310         parms = in6_dev->nd_parms;
 311         __neigh_parms_put(neigh->parms);
 312         neigh->parms = neigh_parms_clone(parms);
 313
 314         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 315         if (!dev->header_ops) {
 316                 neigh->nud_state = NUD_NOARP;
 317                 neigh->ops = &ndisc_direct_ops;
 318                 neigh->output = neigh_direct_output;
 319         } else {
 320                 if (is_multicast) {
 321                         neigh->nud_state = NUD_NOARP;
 322                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 323                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 324                         neigh->nud_state = NUD_NOARP;
 325                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 326                         if (dev->flags&IFF_LOOPBACK)
 327                                 neigh->type = RTN_LOCAL;
 328                 } else if (dev->flags&IFF_POINTOPOINT) {
 329                         neigh->nud_state = NUD_NOARP;
 330                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 331                 }
 332                 if (dev->header_ops->cache)
 333                         neigh->ops = &ndisc_hh_ops;
 334                 else
 335                         neigh->ops = &ndisc_generic_ops;
 336                 if (neigh->nud_state&NUD_VALID)
 337                         neigh->output = neigh->ops->connected_output;
 338                 else
 339                         neigh->output = neigh->ops->output;
 340         }
 341         in6_dev_put(in6_dev);
 342         return 0;
 343 }
 344
 345 static int pndisc_constructor(struct pneigh_entry *n)
 346 {
 347         struct in6_addr *addr = (struct in6_addr *)&n->key;
 348         struct in6_addr maddr;
 349         struct net_device *dev = n->dev;
 350
 351         if (dev == NULL || __in6_dev_get(dev) == NULL)
 352                 return -EINVAL;
 353         addrconf_addr_solict_mult(addr, &maddr);
 354         ipv6_dev_mc_inc(dev, &maddr);
 355         return 0;
 356 }
 357
 358 static void pndisc_destructor(struct pneigh_entry *n)
 359 {
 360         struct in6_addr *addr = (struct in6_addr *)&n->key;
 361         struct in6_addr maddr;
 362         struct net_device *dev = n->dev;
 363
 364         if (dev == NULL || __in6_dev_get(dev) == NULL)
 365                 return;
 366         addrconf_addr_solict_mult(addr, &maddr);
 367         ipv6_dev_mc_dec(dev, &maddr);
 368 }
 369
 370 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 371                                        int len)
 372 {
 373         int hlen = LL_RESERVED_SPACE(dev);
 374         int tlen = dev->needed_tailroom;
 375         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 376         struct sk_buff *skb;
 377
 378         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 379         if (!skb) {
 380                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 381                           __func__);
 382                 return NULL;
 383         }
 384
 385         skb->protocol = htons(ETH_P_IPV6);
 386         skb->dev = dev;
 387
 388         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 389         skb_reset_transport_header(skb);
 390
 391         /* Manually assign socket ownership as we avoid calling
 392          * sock_alloc_send_pskb() to bypass wmem buffer limits
 393          */
 394         skb_set_owner_w(skb, sk);
 395
 396         return skb;
 397 }
 398
 399 static void ip6_nd_hdr(struct sk_buff *skb,
 400                        const struct in6_addr *saddr,
 401                        const struct in6_addr *daddr,
 402                        int hop_limit, int len)
 403 {
 404         struct ipv6hdr *hdr;
 405
 406         skb_push(skb, sizeof(*hdr));
 407         skb_reset_network_header(skb);
 408         hdr = ipv6_hdr(skb);
 409
 410         ip6_flow_hdr(hdr, 0, 0);
 411
 412         hdr->payload_len = htons(len);
 413         hdr->nexthdr = IPPROTO_ICMPV6;
 414         hdr->hop_limit = hop_limit;
 415
 416         hdr->saddr = *saddr;
 417         hdr->daddr = *daddr;
 418 }
 419
 420 static void ndisc_send_skb(struct sk_buff *skb,
 421                            const struct in6_addr *daddr,
 422                            const struct in6_addr *saddr)
 423 {
 424         struct dst_entry *dst = skb_dst(skb);
 425         struct net *net = dev_net(skb->dev);
 426         struct sock *sk = net->ipv6.ndisc_sk;
 427         struct inet6_dev *idev;
 428         int err;
 429         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 430         u8 type;
 431
 432         type = icmp6h->icmp6_type;
 433
 434         if (!dst) {
 435                 struct flowi6 fl6;
 436
 437                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex);
 438                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 439                 if (IS_ERR(dst)) {
 440                         kfree_skb(skb);
 441                         return;
 442                 }
 443
 444                 skb_dst_set(skb, dst);
 445         }
 446
 447         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 448                                               IPPROTO_ICMPV6,
 449                                               csum_partial(icmp6h,
 450                                                            skb->len, 0));
 451
 452         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 453
 454         rcu_read_lock();
 455         idev = __in6_dev_get(dst->dev);
 456         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 457
 458         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 459                       dst_output);
 460         if (!err) {
 461                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 462                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 463         }
 464
 465         rcu_read_unlock();
 466 }
 467
 468 void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 469                    const struct in6_addr *daddr,
 470                    const struct in6_addr *solicited_addr,
 471                    bool router, bool solicited, bool override, bool inc_opt)
 472 {
 473         struct sk_buff *skb;
 474         struct in6_addr tmpaddr;
 475         struct inet6_ifaddr *ifp;
 476         const struct in6_addr *src_addr;
 477         struct nd_msg *msg;
 478         int optlen = 0;
 479
 480         /* for anycast or proxy, solicited_addr != src_addr */
 481         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 482         if (ifp) {
 483                 src_addr = solicited_addr;
 484                 if (ifp->flags & IFA_F_OPTIMISTIC)
 485                         override = false;
 486                 inc_opt |= ifp->idev->cnf.force_tllao;
 487                 in6_ifa_put(ifp);
 488         } else {
 489                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 490                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 491                                        &tmpaddr))
 492                         return;
 493                 src_addr = &tmpaddr;
 494         }
 495
 496         if (!dev->addr_len)
 497                 inc_opt = 0;
 498         if (inc_opt)
 499                 optlen += ndisc_opt_addr_space(dev);
 500
 501         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 502         if (!skb)
 503                 return;
 504
 505         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 506         *msg = (struct nd_msg) {
 507                 .icmph = {
 508                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 509                         .icmp6_router = router,
 510                         .icmp6_solicited = solicited,
 511                         .icmp6_override = override,
 512                 },
 513                 .target = *solicited_addr,
 514         };
 515
 516         if (inc_opt)
 517                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 518                                        dev->dev_addr);
 519
 520
 521         ndisc_send_skb(skb, daddr, src_addr);
 522 }
 523
 524 static void ndisc_send_unsol_na(struct net_device *dev)
 525 {
 526         struct inet6_dev *idev;
 527         struct inet6_ifaddr *ifa;
 528
 529         idev = in6_dev_get(dev);
 530         if (!idev)
 531                 return;
 532
 533         read_lock_bh(&idev->lock);
 534         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 535                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
 536                               /*router=*/ !!idev->cnf.forwarding,
 537                               /*solicited=*/ false, /*override=*/ true,
 538                               /*inc_opt=*/ true);
 539         }
 540         read_unlock_bh(&idev->lock);
 541
 542         in6_dev_put(idev);
 543 }
 544
 545 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 546                    const struct in6_addr *solicit,
 547                    const struct in6_addr *daddr, const struct in6_addr *saddr)
 548 {
 549         struct sk_buff *skb;
 550         struct in6_addr addr_buf;
 551         int inc_opt = dev->addr_len;
 552         int optlen = 0;
 553         struct nd_msg *msg;
 554
 555         if (saddr == NULL) {
 556                 if (ipv6_get_lladdr(dev, &addr_buf,
 557                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 558                         return;
 559                 saddr = &addr_buf;
 560         }
 561
 562         if (ipv6_addr_any(saddr))
 563                 inc_opt = false;
 564         if (inc_opt)
 565                 optlen += ndisc_opt_addr_space(dev);
 566
 567         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 568         if (!skb)
 569                 return;
 570
 571         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 572         *msg = (struct nd_msg) {
 573                 .icmph = {
 574                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 575                 },
 576                 .target = *solicit,
 577         };
 578
 579         if (inc_opt)
 580                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 581                                        dev->dev_addr);
 582
 583         ndisc_send_skb(skb, daddr, saddr);
 584 }
 585
 586 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 587                    const struct in6_addr *daddr)
 588 {
 589         struct sk_buff *skb;
 590         struct rs_msg *msg;
 591         int send_sllao = dev->addr_len;
 592         int optlen = 0;
 593
 594 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 595         /*
 596          * According to section 2.2 of RFC 4429, we must not
 597          * send router solicitations with a sllao from
 598          * optimistic addresses, but we may send the solicitation
 599          * if we don't include the sllao.  So here we check
 600          * if our address is optimistic, and if so, we
 601          * suppress the inclusion of the sllao.
 602          */
 603         if (send_sllao) {
 604                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 605                                                            dev, 1);
 606                 if (ifp) {
 607                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 608                                 send_sllao = 0;
 609                         }
 610                         in6_ifa_put(ifp);
 611                 } else {
 612                         send_sllao = 0;
 613                 }
 614         }
 615 #endif
 616         if (send_sllao)
 617                 optlen += ndisc_opt_addr_space(dev);
 618
 619         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 620         if (!skb)
 621                 return;
 622
 623         msg = (struct rs_msg *)skb_put(skb, sizeof(*msg));
 624         *msg = (struct rs_msg) {
 625                 .icmph = {
 626                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 627                 },
 628         };
 629
 630         if (send_sllao)
 631                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 632                                        dev->dev_addr);
 633
 634         ndisc_send_skb(skb, daddr, saddr);
 635 }
 636
 637
 638 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 639 {
 640         /*
 641          *      "The sender MUST return an ICMP
 642          *       destination unreachable"
 643          */
 644         dst_link_failure(skb);
 645         kfree_skb(skb);
 646 }
 647
 648 /* Called with locked neigh: either read or both */
 649
 650 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 651 {
 652         struct in6_addr *saddr = NULL;
 653         struct in6_addr mcaddr;
 654         struct net_device *dev = neigh->dev;
 655         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 656         int probes = atomic_read(&neigh->probes);
 657
 658         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 659                                            dev, 1,
 660                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 661                 saddr = &ipv6_hdr(skb)->saddr;
 662         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 663         if (probes < 0) {
 664                 if (!(neigh->nud_state & NUD_VALID)) {
 665                         ND_PRINTK(1, dbg,
 666                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 667                                   __func__, target);
 668                 }
 669                 ndisc_send_ns(dev, neigh, target, target, saddr);
 670         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 671                 neigh_app_ns(neigh);
 672         } else {
 673                 addrconf_addr_solict_mult(target, &mcaddr);
 674                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 675         }
 676 }
 677
 678 static int pndisc_is_router(const void *pkey,
 679                             struct net_device *dev)
 680 {
 681         struct pneigh_entry *n;
 682         int ret = -1;
 683
 684         read_lock_bh(&nd_tbl.lock);
 685         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 686         if (n)
 687                 ret = !!(n->flags & NTF_ROUTER);
 688         read_unlock_bh(&nd_tbl.lock);
 689
 690         return ret;
 691 }
 692
 693 static void ndisc_recv_ns(struct sk_buff *skb)
 694 {
 695         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 696         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 697         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 698         u8 *lladdr = NULL;
 699         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 700                                     offsetof(struct nd_msg, opt));
 701         struct ndisc_options ndopts;
 702         struct net_device *dev = skb->dev;
 703         struct inet6_ifaddr *ifp;
 704         struct inet6_dev *idev = NULL;
 705         struct neighbour *neigh;
 706         int dad = ipv6_addr_any(saddr);
 707         bool inc;
 708         int is_router = -1;
 709
 710         if (skb->len < sizeof(struct nd_msg)) {
 711                 ND_PRINTK(2, warn, "NS: packet too short\n");
 712                 return;
 713         }
 714
 715         if (ipv6_addr_is_multicast(&msg->target)) {
 716                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 717                 return;
 718         }
 719
 720         /*
 721          * RFC2461 7.1.1:
 722          * DAD has to be destined for solicited node multicast address.
 723          */
 724         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 725                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 726                 return;
 727         }
 728
 729         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 730                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 731                 return;
 732         }
 733
 734         if (ndopts.nd_opts_src_lladdr) {
 735                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 736                 if (!lladdr) {
 737                         ND_PRINTK(2, warn,
 738                                   "NS: invalid link-layer address length\n");
 739                         return;
 740                 }
 741
 742                 /* RFC2461 7.1.1:
 743                  *      If the IP source address is the unspecified address,
 744                  *      there MUST NOT be source link-layer address option
 745                  *      in the message.
 746                  */
 747                 if (dad) {
 748                         ND_PRINTK(2, warn,
 749                                   "NS: bad DAD packet (link-layer address option)\n");
 750                         return;
 751                 }
 752         }
 753
 754         inc = ipv6_addr_is_multicast(daddr);
 755
 756         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 757         if (ifp) {
 758
 759                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 760                         if (dad) {
 761                                 /*
 762                                  * We are colliding with another node
 763                                  * who is doing DAD
 764                                  * so fail our DAD process
 765                                  */
 766                                 addrconf_dad_failure(ifp);
 767                                 return;
 768                         } else {
 769                                 /*
 770                                  * This is not a dad solicitation.
 771                                  * If we are an optimistic node,
 772                                  * we should respond.
 773                                  * Otherwise, we should ignore it.
 774                                  */
 775                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 776                                         goto out;
 777                         }
 778                 }
 779
 780                 idev = ifp->idev;
 781         } else {
 782                 struct net *net = dev_net(dev);
 783
 784                 idev = in6_dev_get(dev);
 785                 if (!idev) {
 786                         /* XXX: count this drop? */
 787                         return;
 788                 }
 789
 790                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 791                     (idev->cnf.forwarding &&
 792                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 793                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 794                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 795                             skb->pkt_type != PACKET_HOST &&
 796                             inc &&
 797                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 798                                 /*
 799                                  * for anycast or proxy,
 800                                  * sender should delay its response
 801                                  * by a random time between 0 and
 802                                  * MAX_ANYCAST_DELAY_TIME seconds.
 803                                  * (RFC2461) -- yoshfuji
 804                                  */
 805                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 806                                 if (n)
 807                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 808                                 goto out;
 809                         }
 810                 } else
 811                         goto out;
 812         }
 813
 814         if (is_router < 0)
 815                 is_router = idev->cnf.forwarding;
 816
 817         if (dad) {
 818                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
 819                               !!is_router, false, (ifp != NULL), true);
 820                 goto out;
 821         }
 822
 823         if (inc)
 824                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 825         else
 826                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 827
 828         /*
 829          *      update / create cache entry
 830          *      for the source address
 831          */
 832         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 833                                !inc || lladdr || !dev->addr_len);
 834         if (neigh)
 835                 neigh_update(neigh, lladdr, NUD_STALE,
 836                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 837                              NEIGH_UPDATE_F_OVERRIDE);
 838         if (neigh || !dev->header_ops) {
 839                 ndisc_send_na(dev, neigh, saddr, &msg->target,
 840                               !!is_router,
 841                               true, (ifp != NULL && inc), inc);
 842                 if (neigh)
 843                         neigh_release(neigh);
 844         }
 845
 846 out:
 847         if (ifp)
 848                 in6_ifa_put(ifp);
 849         else
 850                 in6_dev_put(idev);
 851 }
 852
 853 static void ndisc_recv_na(struct sk_buff *skb)
 854 {
 855         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 856         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 857         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 858         u8 *lladdr = NULL;
 859         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 860                                     offsetof(struct nd_msg, opt));
 861         struct ndisc_options ndopts;
 862         struct net_device *dev = skb->dev;
 863         struct inet6_ifaddr *ifp;
 864         struct neighbour *neigh;
 865
 866         if (skb->len < sizeof(struct nd_msg)) {
 867                 ND_PRINTK(2, warn, "NA: packet too short\n");
 868                 return;
 869         }
 870
 871         if (ipv6_addr_is_multicast(&msg->target)) {
 872                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 873                 return;
 874         }
 875
 876         if (ipv6_addr_is_multicast(daddr) &&
 877             msg->icmph.icmp6_solicited) {
 878                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 879                 return;
 880         }
 881
 882         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 883                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 884                 return;
 885         }
 886         if (ndopts.nd_opts_tgt_lladdr) {
 887                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 888                 if (!lladdr) {
 889                         ND_PRINTK(2, warn,
 890                                   "NA: invalid link-layer address length\n");
 891                         return;
 892                 }
 893         }
 894         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 895         if (ifp) {
 896                 if (skb->pkt_type != PACKET_LOOPBACK
 897                     && (ifp->flags & IFA_F_TENTATIVE)) {
 898                                 addrconf_dad_failure(ifp);
 899                                 return;
 900                 }
 901                 /* What should we make now? The advertisement
 902                    is invalid, but ndisc specs say nothing
 903                    about it. It could be misconfiguration, or
 904                    an smart proxy agent tries to help us :-)
 905
 906                    We should not print the error if NA has been
 907                    received from loopback - it is just our own
 908                    unsolicited advertisement.
 909                  */
 910                 if (skb->pkt_type != PACKET_LOOPBACK)
 911                         ND_PRINTK(1, warn,
 912                                   "NA: someone advertises our address %pI6 on %s!\n",
 913                                   &ifp->addr, ifp->idev->dev->name);
 914                 in6_ifa_put(ifp);
 915                 return;
 916         }
 917         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 918
 919         if (neigh) {
 920                 u8 old_flags = neigh->flags;
 921                 struct net *net = dev_net(dev);
 922
 923                 if (neigh->nud_state & NUD_FAILED)
 924                         goto out;
 925
 926                 /*
 927                  * Don't update the neighbor cache entry on a proxy NA from
 928                  * ourselves because either the proxied node is off link or it
 929                  * has already sent a NA to us.
 930                  */
 931                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 932                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
 933                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
 934                         /* XXX: idev->cnf.proxy_ndp */
 935                         goto out;
 936                 }
 937
 938                 neigh_update(neigh, lladdr,
 939                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 940                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 941                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 942                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 943                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 944
 945                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 946                         /*
 947                          * Change: router to host
 948                          */
 949                         rt6_clean_tohost(dev_net(dev),  saddr);
 950                 }
 951
 952 out:
 953                 neigh_release(neigh);
 954         }
 955 }
 956
 957 static void ndisc_recv_rs(struct sk_buff *skb)
 958 {
 959         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 960         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 961         struct neighbour *neigh;
 962         struct inet6_dev *idev;
 963         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 964         struct ndisc_options ndopts;
 965         u8 *lladdr = NULL;
 966
 967         if (skb->len < sizeof(*rs_msg))
 968                 return;
 969
 970         idev = __in6_dev_get(skb->dev);
 971         if (!idev) {
 972                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
 973                 return;
 974         }
 975
 976         /* Don't accept RS if we're not in router mode */
 977         if (!idev->cnf.forwarding)
 978                 goto out;
 979
 980         /*
 981          * Don't update NCE if src = ::;
 982          * this implies that the source node has no ip address assigned yet.
 983          */
 984         if (ipv6_addr_any(saddr))
 985                 goto out;
 986
 987         /* Parse ND options */
 988         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 989                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
 990                 goto out;
 991         }
 992
 993         if (ndopts.nd_opts_src_lladdr) {
 994                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
 995                                              skb->dev);
 996                 if (!lladdr)
 997                         goto out;
 998         }
 999
1000         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1001         if (neigh) {
1002                 neigh_update(neigh, lladdr, NUD_STALE,
1003                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1004                              NEIGH_UPDATE_F_OVERRIDE|
1005                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1006                 neigh_release(neigh);
1007         }
1008 out:
1009         return;
1010 }
1011
1012 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1013 {
1014         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1015         struct sk_buff *skb;
1016         struct nlmsghdr *nlh;
1017         struct nduseroptmsg *ndmsg;
1018         struct net *net = dev_net(ra->dev);
1019         int err;
1020         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1021                                     + (opt->nd_opt_len << 3));
1022         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1023
1024         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1025         if (skb == NULL) {
1026                 err = -ENOBUFS;
1027                 goto errout;
1028         }
1029
1030         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1031         if (nlh == NULL) {
1032                 goto nla_put_failure;
1033         }
1034
1035         ndmsg = nlmsg_data(nlh);
1036         ndmsg->nduseropt_family = AF_INET6;
1037         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1038         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1039         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1040         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1041
1042         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1043
1044         if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1045                     &ipv6_hdr(ra)->saddr))
1046                 goto nla_put_failure;
1047         nlmsg_end(skb, nlh);
1048
1049         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1050         return;
1051
1052 nla_put_failure:
1053         nlmsg_free(skb);
1054         err = -EMSGSIZE;
1055 errout:
1056         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1057 }
1058
1059 static void ndisc_router_discovery(struct sk_buff *skb)
1060 {
1061         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1062         struct neighbour *neigh = NULL;
1063         struct inet6_dev *in6_dev;
1064         struct rt6_info *rt = NULL;
1065         int lifetime;
1066         struct ndisc_options ndopts;
1067         int optlen;
1068         unsigned int pref = 0;
1069
1070         __u8 *opt = (__u8 *)(ra_msg + 1);
1071
1072         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1073                 sizeof(struct ra_msg);
1074
1075         ND_PRINTK(2, info,
1076                   "RA: %s, dev: %s\n",
1077                   __func__, skb->dev->name);
1078         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1079                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1080                 return;
1081         }
1082         if (optlen < 0) {
1083                 ND_PRINTK(2, warn, "RA: packet too short\n");
1084                 return;
1085         }
1086
1087 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1088         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1089                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1090                 return;
1091         }
1092 #endif
1093
1094         /*
1095          *      set the RA_RECV flag in the interface
1096          */
1097
1098         in6_dev = __in6_dev_get(skb->dev);
1099         if (in6_dev == NULL) {
1100                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1101                           skb->dev->name);
1102                 return;
1103         }
1104
1105         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1106                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1107                 return;
1108         }
1109
1110         if (!ipv6_accept_ra(in6_dev)) {
1111                 ND_PRINTK(2, info,
1112                           "RA: %s, did not accept ra for dev: %s\n",
1113                           __func__, skb->dev->name);
1114                 goto skip_linkparms;
1115         }
1116
1117 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1118         /* skip link-specific parameters from interior routers */
1119         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1120                 ND_PRINTK(2, info,
1121                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1122                           __func__, skb->dev->name);
1123                 goto skip_linkparms;
1124         }
1125 #endif
1126
1127         if (in6_dev->if_flags & IF_RS_SENT) {
1128                 /*
1129                  *      flag that an RA was received after an RS was sent
1130                  *      out on this interface.
1131                  */
1132                 in6_dev->if_flags |= IF_RA_RCVD;
1133         }
1134
1135         /*
1136          * Remember the managed/otherconf flags from most recently
1137          * received RA message (RFC 2462) -- yoshfuji
1138          */
1139         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1140                                 IF_RA_OTHERCONF)) |
1141                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1142                                         IF_RA_MANAGED : 0) |
1143                                 (ra_msg->icmph.icmp6_addrconf_other ?
1144                                         IF_RA_OTHERCONF : 0);
1145
1146         if (!in6_dev->cnf.accept_ra_defrtr) {
1147                 ND_PRINTK(2, info,
1148                           "RA: %s, defrtr is false for dev: %s\n",
1149                           __func__, skb->dev->name);
1150                 goto skip_defrtr;
1151         }
1152
1153         /* Do not accept RA with source-addr found on local machine unless
1154          * accept_ra_from_local is set to true.
1155          */
1156         if (!in6_dev->cnf.accept_ra_from_local &&
1157             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1158                           NULL, 0)) {
1159                 ND_PRINTK(2, info,
1160                           "RA from local address detected on dev: %s: default router ignored\n",
1161                           skb->dev->name);
1162                 goto skip_defrtr;
1163         }
1164
1165         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1166
1167 #ifdef CONFIG_IPV6_ROUTER_PREF
1168         pref = ra_msg->icmph.icmp6_router_pref;
1169         /* 10b is handled as if it were 00b (medium) */
1170         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1171             !in6_dev->cnf.accept_ra_rtr_pref)
1172                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1173 #endif
1174
1175         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1176
1177         if (rt) {
1178                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1179                 if (!neigh) {
1180                         ND_PRINTK(0, err,
1181                                   "RA: %s got default router without neighbour\n",
1182                                   __func__);
1183                         ip6_rt_put(rt);
1184                         return;
1185                 }
1186         }
1187         if (rt && lifetime == 0) {
1188                 ip6_del_rt(rt);
1189                 rt = NULL;
1190         }
1191
1192         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, for dev: %s\n",
1193                   rt, lifetime, skb->dev->name);
1194         if (rt == NULL && lifetime) {
1195                 ND_PRINTK(3, info, "RA: adding default router\n");
1196
1197                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1198                 if (rt == NULL) {
1199                         ND_PRINTK(0, err,
1200                                   "RA: %s failed to add default route\n",
1201                                   __func__);
1202                         return;
1203                 }
1204
1205                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1206                 if (neigh == NULL) {
1207                         ND_PRINTK(0, err,
1208                                   "RA: %s got default router without neighbour\n",
1209                                   __func__);
1210                         ip6_rt_put(rt);
1211                         return;
1212                 }
1213                 neigh->flags |= NTF_ROUTER;
1214         } else if (rt) {
1215                 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1216         }
1217
1218         if (rt)
1219                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1220         if (ra_msg->icmph.icmp6_hop_limit) {
1221                 /* Only set hop_limit on the interface if it is higher than
1222                  * the current hop_limit.
1223                  */
1224                 if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
1225                         in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1226                 } else {
1227                         ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
1228                 }
1229                 if (rt)
1230                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1231                                        ra_msg->icmph.icmp6_hop_limit);
1232         }
1233
1234 skip_defrtr:
1235
1236         /*
1237          *      Update Reachable Time and Retrans Timer
1238          */
1239
1240         if (in6_dev->nd_parms) {
1241                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1242
1243                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1244                         rtime = (rtime*HZ)/1000;
1245                         if (rtime < HZ/10)
1246                                 rtime = HZ/10;
1247                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1248                         in6_dev->tstamp = jiffies;
1249                         inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1250                 }
1251
1252                 rtime = ntohl(ra_msg->reachable_time);
1253                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1254                         rtime = (rtime*HZ)/1000;
1255
1256                         if (rtime < HZ/10)
1257                                 rtime = HZ/10;
1258
1259                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1260                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1261                                               BASE_REACHABLE_TIME, rtime);
1262                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1263                                               GC_STALETIME, 3 * rtime);
1264                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1265                                 in6_dev->tstamp = jiffies;
1266                                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1267                         }
1268                 }
1269         }
1270
1271 skip_linkparms:
1272
1273         /*
1274          *      Process options.
1275          */
1276
1277         if (!neigh)
1278                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1279                                        skb->dev, 1);
1280         if (neigh) {
1281                 u8 *lladdr = NULL;
1282                 if (ndopts.nd_opts_src_lladdr) {
1283                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1284                                                      skb->dev);
1285                         if (!lladdr) {
1286                                 ND_PRINTK(2, warn,
1287                                           "RA: invalid link-layer address length\n");
1288                                 goto out;
1289                         }
1290                 }
1291                 neigh_update(neigh, lladdr, NUD_STALE,
1292                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1293                              NEIGH_UPDATE_F_OVERRIDE|
1294                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1295                              NEIGH_UPDATE_F_ISROUTER);
1296         }
1297
1298         if (!ipv6_accept_ra(in6_dev)) {
1299                 ND_PRINTK(2, info,
1300                           "RA: %s, accept_ra is false for dev: %s\n",
1301                           __func__, skb->dev->name);
1302                 goto out;
1303         }
1304
1305 #ifdef CONFIG_IPV6_ROUTE_INFO
1306         if (!in6_dev->cnf.accept_ra_from_local &&
1307             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1308                           NULL, 0)) {
1309                 ND_PRINTK(2, info,
1310                           "RA from local address detected on dev: %s: router info ignored.\n",
1311                           skb->dev->name);
1312                 goto skip_routeinfo;
1313         }
1314
1315         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1316                 struct nd_opt_hdr *p;
1317                 for (p = ndopts.nd_opts_ri;
1318                      p;
1319                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1320                         struct route_info *ri = (struct route_info *)p;
1321 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1322                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1323                             ri->prefix_len == 0)
1324                                 continue;
1325 #endif
1326                         if (ri->prefix_len == 0 &&
1327                             !in6_dev->cnf.accept_ra_defrtr)
1328                                 continue;
1329                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1330                                 continue;
1331                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1332                                       &ipv6_hdr(skb)->saddr);
1333                 }
1334         }
1335
1336 skip_routeinfo:
1337 #endif
1338
1339 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1340         /* skip link-specific ndopts from interior routers */
1341         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1342                 ND_PRINTK(2, info,
1343                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1344                           __func__, skb->dev->name);
1345                 goto out;
1346         }
1347 #endif
1348
1349         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1350                 struct nd_opt_hdr *p;
1351                 for (p = ndopts.nd_opts_pi;
1352                      p;
1353                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1354                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1355                                             (p->nd_opt_len) << 3,
1356                                             ndopts.nd_opts_src_lladdr != NULL);
1357                 }
1358         }
1359
1360         if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1361                 __be32 n;
1362                 u32 mtu;
1363
1364                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1365                 mtu = ntohl(n);
1366
1367                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1368                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1369                 } else if (in6_dev->cnf.mtu6 != mtu) {
1370                         in6_dev->cnf.mtu6 = mtu;
1371
1372                         if (rt)
1373                                 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1374
1375                         rt6_mtu_change(skb->dev, mtu);
1376                 }
1377         }
1378
1379         if (ndopts.nd_useropts) {
1380                 struct nd_opt_hdr *p;
1381                 for (p = ndopts.nd_useropts;
1382                      p;
1383                      p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1384                         ndisc_ra_useropt(skb, p);
1385                 }
1386         }
1387
1388         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1389                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1390         }
1391 out:
1392         ip6_rt_put(rt);
1393         if (neigh)
1394                 neigh_release(neigh);
1395 }
1396
1397 static void ndisc_redirect_rcv(struct sk_buff *skb)
1398 {
1399         u8 *hdr;
1400         struct ndisc_options ndopts;
1401         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1402         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1403                                     offsetof(struct rd_msg, opt));
1404
1405 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1406         switch (skb->ndisc_nodetype) {
1407         case NDISC_NODETYPE_HOST:
1408         case NDISC_NODETYPE_NODEFAULT:
1409                 ND_PRINTK(2, warn,
1410                           "Redirect: from host or unauthorized router\n");
1411                 return;
1412         }
1413 #endif
1414
1415         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1416                 ND_PRINTK(2, warn,
1417                           "Redirect: source address is not link-local\n");
1418                 return;
1419         }
1420
1421         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1422                 return;
1423
1424         if (!ndopts.nd_opts_rh) {
1425                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1426                                         skb->dev->ifindex, 0);
1427                 return;
1428         }
1429
1430         hdr = (u8 *)ndopts.nd_opts_rh;
1431         hdr += 8;
1432         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1433                 return;
1434
1435         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1436 }
1437
1438 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1439                                            struct sk_buff *orig_skb,
1440                                            int rd_len)
1441 {
1442         u8 *opt = skb_put(skb, rd_len);
1443
1444         memset(opt, 0, 8);
1445         *(opt++) = ND_OPT_REDIRECT_HDR;
1446         *(opt++) = (rd_len >> 3);
1447         opt += 6;
1448
1449         memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
1450 }
1451
1452 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1453 {
1454         struct net_device *dev = skb->dev;
1455         struct net *net = dev_net(dev);
1456         struct sock *sk = net->ipv6.ndisc_sk;
1457         int optlen = 0;
1458         struct inet_peer *peer;
1459         struct sk_buff *buff;
1460         struct rd_msg *msg;
1461         struct in6_addr saddr_buf;
1462         struct rt6_info *rt;
1463         struct dst_entry *dst;
1464         struct flowi6 fl6;
1465         int rd_len;
1466         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1467         bool ret;
1468
1469         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1470                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1471                           dev->name);
1472                 return;
1473         }
1474
1475         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1476             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1477                 ND_PRINTK(2, warn,
1478                           "Redirect: target address is not link-local unicast\n");
1479                 return;
1480         }
1481
1482         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1483                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1484
1485         dst = ip6_route_output(net, NULL, &fl6);
1486         if (dst->error) {
1487                 dst_release(dst);
1488                 return;
1489         }
1490         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1491         if (IS_ERR(dst))
1492                 return;
1493
1494         rt = (struct rt6_info *) dst;
1495
1496         if (rt->rt6i_flags & RTF_GATEWAY) {
1497                 ND_PRINTK(2, warn,
1498                           "Redirect: destination is not a neighbour\n");
1499                 goto release;
1500         }
1501         peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
1502         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1503         if (peer)
1504                 inet_putpeer(peer);
1505         if (!ret)
1506                 goto release;
1507
1508         if (dev->addr_len) {
1509                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1510                 if (!neigh) {
1511                         ND_PRINTK(2, warn,
1512                                   "Redirect: no neigh for target address\n");
1513                         goto release;
1514                 }
1515
1516                 read_lock_bh(&neigh->lock);
1517                 if (neigh->nud_state & NUD_VALID) {
1518                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1519                         read_unlock_bh(&neigh->lock);
1520                         ha = ha_buf;
1521                         optlen += ndisc_opt_addr_space(dev);
1522                 } else
1523                         read_unlock_bh(&neigh->lock);
1524
1525                 neigh_release(neigh);
1526         }
1527
1528         rd_len = min_t(unsigned int,
1529                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1530                        skb->len + 8);
1531         rd_len &= ~0x7;
1532         optlen += rd_len;
1533
1534         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1535         if (!buff)
1536                 goto release;
1537
1538         msg = (struct rd_msg *)skb_put(buff, sizeof(*msg));
1539         *msg = (struct rd_msg) {
1540                 .icmph = {
1541                         .icmp6_type = NDISC_REDIRECT,
1542                 },
1543                 .target = *target,
1544                 .dest = ipv6_hdr(skb)->daddr,
1545         };
1546
1547         /*
1548          *      include target_address option
1549          */
1550
1551         if (ha)
1552                 ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
1553
1554         /*
1555          *      build redirect option and copy skb over to the new packet.
1556          */
1557
1558         if (rd_len)
1559                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1560
1561         skb_dst_set(buff, dst);
1562         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1563         return;
1564
1565 release:
1566         dst_release(dst);
1567 }
1568
1569 static void pndisc_redo(struct sk_buff *skb)
1570 {
1571         ndisc_recv_ns(skb);
1572         kfree_skb(skb);
1573 }
1574
1575 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1576 {
1577         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1578
1579         if (!idev)
1580                 return true;
1581         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1582             idev->cnf.suppress_frag_ndisc) {
1583                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1584                 return true;
1585         }
1586         return false;
1587 }
1588
1589 int ndisc_rcv(struct sk_buff *skb)
1590 {
1591         struct nd_msg *msg;
1592
1593         if (ndisc_suppress_frag_ndisc(skb))
1594                 return 0;
1595
1596         if (skb_linearize(skb))
1597                 return 0;
1598
1599         msg = (struct nd_msg *)skb_transport_header(skb);
1600
1601         __skb_push(skb, skb->data - skb_transport_header(skb));
1602
1603         if (ipv6_hdr(skb)->hop_limit != 255) {
1604                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1605                           ipv6_hdr(skb)->hop_limit);
1606                 return 0;
1607         }
1608
1609         if (msg->icmph.icmp6_code != 0) {
1610                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1611                           msg->icmph.icmp6_code);
1612                 return 0;
1613         }
1614
1615         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1616
1617         switch (msg->icmph.icmp6_type) {
1618         case NDISC_NEIGHBOUR_SOLICITATION:
1619                 ndisc_recv_ns(skb);
1620                 break;
1621
1622         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1623                 ndisc_recv_na(skb);
1624                 break;
1625
1626         case NDISC_ROUTER_SOLICITATION:
1627                 ndisc_recv_rs(skb);
1628                 break;
1629
1630         case NDISC_ROUTER_ADVERTISEMENT:
1631                 ndisc_router_discovery(skb);
1632                 break;
1633
1634         case NDISC_REDIRECT:
1635                 ndisc_redirect_rcv(skb);
1636                 break;
1637         }
1638
1639         return 0;
1640 }
1641
1642 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1643 {
1644         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1645         struct net *net = dev_net(dev);
1646         struct inet6_dev *idev;
1647
1648         switch (event) {
1649         case NETDEV_CHANGEADDR:
1650                 neigh_changeaddr(&nd_tbl, dev);
1651                 fib6_run_gc(0, net, false);
1652                 idev = in6_dev_get(dev);
1653                 if (!idev)
1654                         break;
1655                 if (idev->cnf.ndisc_notify)
1656                         ndisc_send_unsol_na(dev);
1657                 in6_dev_put(idev);
1658                 break;
1659         case NETDEV_DOWN:
1660                 neigh_ifdown(&nd_tbl, dev);
1661                 fib6_run_gc(0, net, false);
1662                 break;
1663         case NETDEV_NOTIFY_PEERS:
1664                 ndisc_send_unsol_na(dev);
1665                 break;
1666         default:
1667                 break;
1668         }
1669
1670         return NOTIFY_DONE;
1671 }
1672
1673 static struct notifier_block ndisc_netdev_notifier = {
1674         .notifier_call = ndisc_netdev_event,
1675 };
1676
1677 #ifdef CONFIG_SYSCTL
1678 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1679                                          const char *func, const char *dev_name)
1680 {
1681         static char warncomm[TASK_COMM_LEN];
1682         static int warned;
1683         if (strcmp(warncomm, current->comm) && warned < 5) {
1684                 strcpy(warncomm, current->comm);
1685                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1686                         warncomm, func,
1687                         dev_name, ctl->procname,
1688                         dev_name, ctl->procname);
1689                 warned++;
1690         }
1691 }
1692
1693 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1694 {
1695         struct net_device *dev = ctl->extra1;
1696         struct inet6_dev *idev;
1697         int ret;
1698
1699         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1700             (strcmp(ctl->procname, "base_reachable_time") == 0))
1701                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1702
1703         if (strcmp(ctl->procname, "retrans_time") == 0)
1704                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1705
1706         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1707                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1708                                                   buffer, lenp, ppos);
1709
1710         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1711                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1712                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1713                                                      buffer, lenp, ppos);
1714         else
1715                 ret = -1;
1716
1717         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1718                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1719                         idev->nd_parms->reachable_time =
1720                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1721                 idev->tstamp = jiffies;
1722                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1723                 in6_dev_put(idev);
1724         }
1725         return ret;
1726 }
1727
1728
1729 #endif
1730
1731 static int __net_init ndisc_net_init(struct net *net)
1732 {
1733         struct ipv6_pinfo *np;
1734         struct sock *sk;
1735         int err;
1736
1737         err = inet_ctl_sock_create(&sk, PF_INET6,
1738                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1739         if (err < 0) {
1740                 ND_PRINTK(0, err,
1741                           "NDISC: Failed to initialize the control socket (err %d)\n",
1742                           err);
1743                 return err;
1744         }
1745
1746         net->ipv6.ndisc_sk = sk;
1747
1748         np = inet6_sk(sk);
1749         np->hop_limit = 255;
1750         /* Do not loopback ndisc messages */
1751         np->mc_loop = 0;
1752
1753         return 0;
1754 }
1755
1756 static void __net_exit ndisc_net_exit(struct net *net)
1757 {
1758         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1759 }
1760
1761 static struct pernet_operations ndisc_net_ops = {
1762         .init = ndisc_net_init,
1763         .exit = ndisc_net_exit,
1764 };
1765
1766 int __init ndisc_init(void)
1767 {
1768         int err;
1769
1770         err = register_pernet_subsys(&ndisc_net_ops);
1771         if (err)
1772                 return err;
1773         /*
1774          * Initialize the neighbour table
1775          */
1776         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1777
1778 #ifdef CONFIG_SYSCTL
1779         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1780                                     ndisc_ifinfo_sysctl_change);
1781         if (err)
1782                 goto out_unregister_pernet;
1783 out:
1784 #endif
1785         return err;
1786
1787 #ifdef CONFIG_SYSCTL
1788 out_unregister_pernet:
1789         unregister_pernet_subsys(&ndisc_net_ops);
1790         goto out;
1791 #endif
1792 }
1793
1794 int __init ndisc_late_init(void)
1795 {
1796         return register_netdevice_notifier(&ndisc_netdev_notifier);
1797 }
1798
1799 void ndisc_late_cleanup(void)
1800 {
1801         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1802 }
1803
1804 void ndisc_cleanup(void)
1805 {
1806 #ifdef CONFIG_SYSCTL
1807         neigh_sysctl_unregister(&nd_tbl.parms);
1808 #endif
1809         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1810         unregister_pernet_subsys(&ndisc_net_ops);
1811 }