net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <[email protected]>
   7  *      Mike Shaver             <[email protected]>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  19  *      Pierre Ynard                    :       export userland ND options
  20  *                                              through netlink (RDNSS support)
  21  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  22  *                                              of an RA.
  23  *      Janos Farkas                    :       kmalloc failure checks
  24  *      Alexey Kuznetsov                :       state machine reworked
  25  *                                              and moved to net/core.
  26  *      Pekka Savola                    :       RFC2461 validation
  27  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  28  */
  29
  30 #define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32 #include <linux/module.h>
  33 #include <linux/errno.h>
  34 #include <linux/types.h>
  35 #include <linux/socket.h>
  36 #include <linux/sockios.h>
  37 #include <linux/sched.h>
  38 #include <linux/net.h>
  39 #include <linux/in6.h>
  40 #include <linux/route.h>
  41 #include <linux/init.h>
  42 #include <linux/rcupdate.h>
  43 #include <linux/slab.h>
  44 #ifdef CONFIG_SYSCTL
  45 #include <linux/sysctl.h>
  46 #endif
  47
  48 #include <linux/if_addr.h>
  49 #include <linux/if_arp.h>
  50 #include <linux/ipv6.h>
  51 #include <linux/icmpv6.h>
  52 #include <linux/jhash.h>
  53
  54 #include <net/sock.h>
  55 #include <net/snmp.h>
  56
  57 #include <net/ipv6.h>
  58 #include <net/protocol.h>
  59 #include <net/ndisc.h>
  60 #include <net/ip6_route.h>
  61 #include <net/addrconf.h>
  62 #include <net/icmp.h>
  63
  64 #include <net/netlink.h>
  65 #include <linux/rtnetlink.h>
  66
  67 #include <net/flow.h>
  68 #include <net/ip6_checksum.h>
  69 #include <net/inet_common.h>
  70 #include <linux/proc_fs.h>
  71
  72 #include <linux/netfilter.h>
  73 #include <linux/netfilter_ipv6.h>
  74
  75 /* Set to 3 to get tracing... */
  76 #define ND_DEBUG 1
  77
  78 #define ND_PRINTK(val, level, fmt, ...)                         \
  79 do {                                                            \
  80         if (val <= ND_DEBUG)                                    \
  81                 net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
  82 } while (0)
  83
  84 static u32 ndisc_hash(const void *pkey,
  85                       const struct net_device *dev,
  86                       __u32 *hash_rnd);
  87 static int ndisc_constructor(struct neighbour *neigh);
  88 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  89 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  90 static int pndisc_constructor(struct pneigh_entry *n);
  91 static void pndisc_destructor(struct pneigh_entry *n);
  92 static void pndisc_redo(struct sk_buff *skb);
  93
  94 static const struct neigh_ops ndisc_generic_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_connected_output,
 100 };
 101
 102 static const struct neigh_ops ndisc_hh_ops = {
 103         .family =               AF_INET6,
 104         .solicit =              ndisc_solicit,
 105         .error_report =         ndisc_error_report,
 106         .output =               neigh_resolve_output,
 107         .connected_output =     neigh_resolve_output,
 108 };
 109
 110
 111 static const struct neigh_ops ndisc_direct_ops = {
 112         .family =               AF_INET6,
 113         .output =               neigh_direct_output,
 114         .connected_output =     neigh_direct_output,
 115 };
 116
 117 struct neigh_table nd_tbl = {
 118         .family =       AF_INET6,
 119         .key_len =      sizeof(struct in6_addr),
 120         .hash =         ndisc_hash,
 121         .constructor =  ndisc_constructor,
 122         .pconstructor = pndisc_constructor,
 123         .pdestructor =  pndisc_destructor,
 124         .proxy_redo =   pndisc_redo,
 125         .id =           "ndisc_cache",
 126         .parms = {
 127                 .tbl                    = &nd_tbl,
 128                 .reachable_time         = ND_REACHABLE_TIME,
 129                 .data = {
 130                         [NEIGH_VAR_MCAST_PROBES] = 3,
 131                         [NEIGH_VAR_UCAST_PROBES] = 3,
 132                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 133                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 134                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 135                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 136                         [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
 137                         [NEIGH_VAR_PROXY_QLEN] = 64,
 138                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 139                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 140                 },
 141         },
 142         .gc_interval =    30 * HZ,
 143         .gc_thresh1 =    128,
 144         .gc_thresh2 =    512,
 145         .gc_thresh3 =   1024,
 146 };
 147
 148 static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
 149 {
 150         int pad   = ndisc_addr_option_pad(skb->dev->type);
 151         int data_len = skb->dev->addr_len;
 152         int space = ndisc_opt_addr_space(skb->dev);
 153         u8 *opt = skb_put(skb, space);
 154
 155         opt[0] = type;
 156         opt[1] = space>>3;
 157
 158         memset(opt + 2, 0, pad);
 159         opt   += pad;
 160         space -= pad;
 161
 162         memcpy(opt+2, data, data_len);
 163         data_len += 2;
 164         opt += data_len;
 165         if ((space -= data_len) > 0)
 166                 memset(opt, 0, space);
 167 }
 168
 169 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 170                                             struct nd_opt_hdr *end)
 171 {
 172         int type;
 173         if (!cur || !end || cur >= end)
 174                 return NULL;
 175         type = cur->nd_opt_type;
 176         do {
 177                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 178         } while(cur < end && cur->nd_opt_type != type);
 179         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 180 }
 181
 182 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 183 {
 184         return opt->nd_opt_type == ND_OPT_RDNSS ||
 185                 opt->nd_opt_type == ND_OPT_DNSSL;
 186 }
 187
 188 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 189                                              struct nd_opt_hdr *end)
 190 {
 191         if (!cur || !end || cur >= end)
 192                 return NULL;
 193         do {
 194                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 195         } while(cur < end && !ndisc_is_useropt(cur));
 196         return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 197 }
 198
 199 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 200                                           struct ndisc_options *ndopts)
 201 {
 202         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 203
 204         if (!nd_opt || opt_len < 0 || !ndopts)
 205                 return NULL;
 206         memset(ndopts, 0, sizeof(*ndopts));
 207         while (opt_len) {
 208                 int l;
 209                 if (opt_len < sizeof(struct nd_opt_hdr))
 210                         return NULL;
 211                 l = nd_opt->nd_opt_len << 3;
 212                 if (opt_len < l || l == 0)
 213                         return NULL;
 214                 switch (nd_opt->nd_opt_type) {
 215                 case ND_OPT_SOURCE_LL_ADDR:
 216                 case ND_OPT_TARGET_LL_ADDR:
 217                 case ND_OPT_MTU:
 218                 case ND_OPT_REDIRECT_HDR:
 219                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 220                                 ND_PRINTK(2, warn,
 221                                           "%s: duplicated ND6 option found: type=%d\n",
 222                                           __func__, nd_opt->nd_opt_type);
 223                         } else {
 224                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 225                         }
 226                         break;
 227                 case ND_OPT_PREFIX_INFO:
 228                         ndopts->nd_opts_pi_end = nd_opt;
 229                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 230                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 231                         break;
 232 #ifdef CONFIG_IPV6_ROUTE_INFO
 233                 case ND_OPT_ROUTE_INFO:
 234                         ndopts->nd_opts_ri_end = nd_opt;
 235                         if (!ndopts->nd_opts_ri)
 236                                 ndopts->nd_opts_ri = nd_opt;
 237                         break;
 238 #endif
 239                 default:
 240                         if (ndisc_is_useropt(nd_opt)) {
 241                                 ndopts->nd_useropts_end = nd_opt;
 242                                 if (!ndopts->nd_useropts)
 243                                         ndopts->nd_useropts = nd_opt;
 244                         } else {
 245                                 /*
 246                                  * Unknown options must be silently ignored,
 247                                  * to accommodate future extension to the
 248                                  * protocol.
 249                                  */
 250                                 ND_PRINTK(2, notice,
 251                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 252                                           __func__,
 253                                           nd_opt->nd_opt_type,
 254                                           nd_opt->nd_opt_len);
 255                         }
 256                 }
 257                 opt_len -= l;
 258                 nd_opt = ((void *)nd_opt) + l;
 259         }
 260         return ndopts;
 261 }
 262
 263 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 264 {
 265         switch (dev->type) {
 266         case ARPHRD_ETHER:
 267         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 268         case ARPHRD_FDDI:
 269                 ipv6_eth_mc_map(addr, buf);
 270                 return 0;
 271         case ARPHRD_ARCNET:
 272                 ipv6_arcnet_mc_map(addr, buf);
 273                 return 0;
 274         case ARPHRD_INFINIBAND:
 275                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 276                 return 0;
 277         case ARPHRD_IPGRE:
 278                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 279         default:
 280                 if (dir) {
 281                         memcpy(buf, dev->broadcast, dev->addr_len);
 282                         return 0;
 283                 }
 284         }
 285         return -EINVAL;
 286 }
 287
 288 EXPORT_SYMBOL(ndisc_mc_map);
 289
 290 static u32 ndisc_hash(const void *pkey,
 291                       const struct net_device *dev,
 292                       __u32 *hash_rnd)
 293 {
 294         return ndisc_hashfn(pkey, dev, hash_rnd);
 295 }
 296
 297 static int ndisc_constructor(struct neighbour *neigh)
 298 {
 299         struct in6_addr *addr = (struct in6_addr*)&neigh->primary_key;
 300         struct net_device *dev = neigh->dev;
 301         struct inet6_dev *in6_dev;
 302         struct neigh_parms *parms;
 303         bool is_multicast = ipv6_addr_is_multicast(addr);
 304
 305         in6_dev = in6_dev_get(dev);
 306         if (in6_dev == NULL) {
 307                 return -EINVAL;
 308         }
 309
 310         parms = in6_dev->nd_parms;
 311         __neigh_parms_put(neigh->parms);
 312         neigh->parms = neigh_parms_clone(parms);
 313
 314         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 315         if (!dev->header_ops) {
 316                 neigh->nud_state = NUD_NOARP;
 317                 neigh->ops = &ndisc_direct_ops;
 318                 neigh->output = neigh_direct_output;
 319         } else {
 320                 if (is_multicast) {
 321                         neigh->nud_state = NUD_NOARP;
 322                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 323                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 324                         neigh->nud_state = NUD_NOARP;
 325                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 326                         if (dev->flags&IFF_LOOPBACK)
 327                                 neigh->type = RTN_LOCAL;
 328                 } else if (dev->flags&IFF_POINTOPOINT) {
 329                         neigh->nud_state = NUD_NOARP;
 330                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 331                 }
 332                 if (dev->header_ops->cache)
 333                         neigh->ops = &ndisc_hh_ops;
 334                 else
 335                         neigh->ops = &ndisc_generic_ops;
 336                 if (neigh->nud_state&NUD_VALID)
 337                         neigh->output = neigh->ops->connected_output;
 338                 else
 339                         neigh->output = neigh->ops->output;
 340         }
 341         in6_dev_put(in6_dev);
 342         return 0;
 343 }
 344
 345 static int pndisc_constructor(struct pneigh_entry *n)
 346 {
 347         struct in6_addr *addr = (struct in6_addr*)&n->key;
 348         struct in6_addr maddr;
 349         struct net_device *dev = n->dev;
 350
 351         if (dev == NULL || __in6_dev_get(dev) == NULL)
 352                 return -EINVAL;
 353         addrconf_addr_solict_mult(addr, &maddr);
 354         ipv6_dev_mc_inc(dev, &maddr);
 355         return 0;
 356 }
 357
 358 static void pndisc_destructor(struct pneigh_entry *n)
 359 {
 360         struct in6_addr *addr = (struct in6_addr*)&n->key;
 361         struct in6_addr maddr;
 362         struct net_device *dev = n->dev;
 363
 364         if (dev == NULL || __in6_dev_get(dev) == NULL)
 365                 return;
 366         addrconf_addr_solict_mult(addr, &maddr);
 367         ipv6_dev_mc_dec(dev, &maddr);
 368 }
 369
 370 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 371                                        int len)
 372 {
 373         int hlen = LL_RESERVED_SPACE(dev);
 374         int tlen = dev->needed_tailroom;
 375         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 376         struct sk_buff *skb;
 377
 378         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 379         if (!skb) {
 380                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 381                           __func__);
 382                 return NULL;
 383         }
 384
 385         skb->protocol = htons(ETH_P_IPV6);
 386         skb->dev = dev;
 387
 388         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 389         skb_reset_transport_header(skb);
 390
 391         /* Manually assign socket ownership as we avoid calling
 392          * sock_alloc_send_pskb() to bypass wmem buffer limits
 393          */
 394         skb_set_owner_w(skb, sk);
 395
 396         return skb;
 397 }
 398
 399 static void ip6_nd_hdr(struct sk_buff *skb,
 400                        const struct in6_addr *saddr,
 401                        const struct in6_addr *daddr,
 402                        int hop_limit, int len)
 403 {
 404         struct ipv6hdr *hdr;
 405
 406         skb_push(skb, sizeof(*hdr));
 407         skb_reset_network_header(skb);
 408         hdr = ipv6_hdr(skb);
 409
 410         ip6_flow_hdr(hdr, 0, 0);
 411
 412         hdr->payload_len = htons(len);
 413         hdr->nexthdr = IPPROTO_ICMPV6;
 414         hdr->hop_limit = hop_limit;
 415
 416         hdr->saddr = *saddr;
 417         hdr->daddr = *daddr;
 418 }
 419
 420 static void ndisc_send_skb(struct sk_buff *skb,
 421                            const struct in6_addr *daddr,
 422                            const struct in6_addr *saddr)
 423 {
 424         struct dst_entry *dst = skb_dst(skb);
 425         struct net *net = dev_net(skb->dev);
 426         struct sock *sk = net->ipv6.ndisc_sk;
 427         struct inet6_dev *idev;
 428         int err;
 429         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 430         u8 type;
 431
 432         type = icmp6h->icmp6_type;
 433
 434         if (!dst) {
 435                 struct flowi6 fl6;
 436
 437                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex);
 438                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 439                 if (IS_ERR(dst)) {
 440                         kfree_skb(skb);
 441                         return;
 442                 }
 443
 444                 skb_dst_set(skb, dst);
 445         }
 446
 447         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 448                                               IPPROTO_ICMPV6,
 449                                               csum_partial(icmp6h,
 450                                                            skb->len, 0));
 451
 452         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 453
 454         rcu_read_lock();
 455         idev = __in6_dev_get(dst->dev);
 456         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 457
 458         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 459                       dst_output);
 460         if (!err) {
 461                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 462                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 463         }
 464
 465         rcu_read_unlock();
 466 }
 467
 468 void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 469                    const struct in6_addr *daddr,
 470                    const struct in6_addr *solicited_addr,
 471                    bool router, bool solicited, bool override, bool inc_opt)
 472 {
 473         struct sk_buff *skb;
 474         struct in6_addr tmpaddr;
 475         struct inet6_ifaddr *ifp;
 476         const struct in6_addr *src_addr;
 477         struct nd_msg *msg;
 478         int optlen = 0;
 479
 480         /* for anycast or proxy, solicited_addr != src_addr */
 481         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 482         if (ifp) {
 483                 src_addr = solicited_addr;
 484                 if (ifp->flags & IFA_F_OPTIMISTIC)
 485                         override = false;
 486                 inc_opt |= ifp->idev->cnf.force_tllao;
 487                 in6_ifa_put(ifp);
 488         } else {
 489                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 490                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 491                                        &tmpaddr))
 492                         return;
 493                 src_addr = &tmpaddr;
 494         }
 495
 496         if (!dev->addr_len)
 497                 inc_opt = 0;
 498         if (inc_opt)
 499                 optlen += ndisc_opt_addr_space(dev);
 500
 501         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 502         if (!skb)
 503                 return;
 504
 505         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 506         *msg = (struct nd_msg) {
 507                 .icmph = {
 508                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 509                         .icmp6_router = router,
 510                         .icmp6_solicited = solicited,
 511                         .icmp6_override = override,
 512                 },
 513                 .target = *solicited_addr,
 514         };
 515
 516         if (inc_opt)
 517                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 518                                        dev->dev_addr);
 519
 520
 521         ndisc_send_skb(skb, daddr, src_addr);
 522 }
 523
 524 static void ndisc_send_unsol_na(struct net_device *dev)
 525 {
 526         struct inet6_dev *idev;
 527         struct inet6_ifaddr *ifa;
 528
 529         idev = in6_dev_get(dev);
 530         if (!idev)
 531                 return;
 532
 533         read_lock_bh(&idev->lock);
 534         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 535                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
 536                               /*router=*/ !!idev->cnf.forwarding,
 537                               /*solicited=*/ false, /*override=*/ true,
 538                               /*inc_opt=*/ true);
 539         }
 540         read_unlock_bh(&idev->lock);
 541
 542         in6_dev_put(idev);
 543 }
 544
 545 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 546                    const struct in6_addr *solicit,
 547                    const struct in6_addr *daddr, const struct in6_addr *saddr)
 548 {
 549         struct sk_buff *skb;
 550         struct in6_addr addr_buf;
 551         int inc_opt = dev->addr_len;
 552         int optlen = 0;
 553         struct nd_msg *msg;
 554
 555         if (saddr == NULL) {
 556                 if (ipv6_get_lladdr(dev, &addr_buf,
 557                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 558                         return;
 559                 saddr = &addr_buf;
 560         }
 561
 562         if (ipv6_addr_any(saddr))
 563                 inc_opt = false;
 564         if (inc_opt)
 565                 optlen += ndisc_opt_addr_space(dev);
 566
 567         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 568         if (!skb)
 569                 return;
 570
 571         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 572         *msg = (struct nd_msg) {
 573                 .icmph = {
 574                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 575                 },
 576                 .target = *solicit,
 577         };
 578
 579         if (inc_opt)
 580                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 581                                        dev->dev_addr);
 582
 583         ndisc_send_skb(skb, daddr, saddr);
 584 }
 585
 586 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 587                    const struct in6_addr *daddr)
 588 {
 589         struct sk_buff *skb;
 590         struct rs_msg *msg;
 591         int send_sllao = dev->addr_len;
 592         int optlen = 0;
 593
 594 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 595         /*
 596          * According to section 2.2 of RFC 4429, we must not
 597          * send router solicitations with a sllao from
 598          * optimistic addresses, but we may send the solicitation
 599          * if we don't include the sllao.  So here we check
 600          * if our address is optimistic, and if so, we
 601          * suppress the inclusion of the sllao.
 602          */
 603         if (send_sllao) {
 604                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 605                                                            dev, 1);
 606                 if (ifp) {
 607                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 608                                 send_sllao = 0;
 609                         }
 610                         in6_ifa_put(ifp);
 611                 } else {
 612                         send_sllao = 0;
 613                 }
 614         }
 615 #endif
 616         if (send_sllao)
 617                 optlen += ndisc_opt_addr_space(dev);
 618
 619         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 620         if (!skb)
 621                 return;
 622
 623         msg = (struct rs_msg *)skb_put(skb, sizeof(*msg));
 624         *msg = (struct rs_msg) {
 625                 .icmph = {
 626                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 627                 },
 628         };
 629
 630         if (send_sllao)
 631                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 632                                        dev->dev_addr);
 633
 634         ndisc_send_skb(skb, daddr, saddr);
 635 }
 636
 637
 638 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 639 {
 640         /*
 641          *      "The sender MUST return an ICMP
 642          *       destination unreachable"
 643          */
 644         dst_link_failure(skb);
 645         kfree_skb(skb);
 646 }
 647
 648 /* Called with locked neigh: either read or both */
 649
 650 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 651 {
 652         struct in6_addr *saddr = NULL;
 653         struct in6_addr mcaddr;
 654         struct net_device *dev = neigh->dev;
 655         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 656         int probes = atomic_read(&neigh->probes);
 657
 658         if (skb && ipv6_chk_addr(dev_net(dev), &ipv6_hdr(skb)->saddr, dev, 1))
 659                 saddr = &ipv6_hdr(skb)->saddr;
 660
 661         if ((probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES)) < 0) {
 662                 if (!(neigh->nud_state & NUD_VALID)) {
 663                         ND_PRINTK(1, dbg,
 664                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 665                                   __func__, target);
 666                 }
 667                 ndisc_send_ns(dev, neigh, target, target, saddr);
 668         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 669                 neigh_app_ns(neigh);
 670         } else {
 671                 addrconf_addr_solict_mult(target, &mcaddr);
 672                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 673         }
 674 }
 675
 676 static int pndisc_is_router(const void *pkey,
 677                             struct net_device *dev)
 678 {
 679         struct pneigh_entry *n;
 680         int ret = -1;
 681
 682         read_lock_bh(&nd_tbl.lock);
 683         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 684         if (n)
 685                 ret = !!(n->flags & NTF_ROUTER);
 686         read_unlock_bh(&nd_tbl.lock);
 687
 688         return ret;
 689 }
 690
 691 static void ndisc_recv_ns(struct sk_buff *skb)
 692 {
 693         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 694         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 695         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 696         u8 *lladdr = NULL;
 697         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 698                                     offsetof(struct nd_msg, opt));
 699         struct ndisc_options ndopts;
 700         struct net_device *dev = skb->dev;
 701         struct inet6_ifaddr *ifp;
 702         struct inet6_dev *idev = NULL;
 703         struct neighbour *neigh;
 704         int dad = ipv6_addr_any(saddr);
 705         bool inc;
 706         int is_router = -1;
 707
 708         if (skb->len < sizeof(struct nd_msg)) {
 709                 ND_PRINTK(2, warn, "NS: packet too short\n");
 710                 return;
 711         }
 712
 713         if (ipv6_addr_is_multicast(&msg->target)) {
 714                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 715                 return;
 716         }
 717
 718         /*
 719          * RFC2461 7.1.1:
 720          * DAD has to be destined for solicited node multicast address.
 721          */
 722         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 723                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 724                 return;
 725         }
 726
 727         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 728                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 729                 return;
 730         }
 731
 732         if (ndopts.nd_opts_src_lladdr) {
 733                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 734                 if (!lladdr) {
 735                         ND_PRINTK(2, warn,
 736                                   "NS: invalid link-layer address length\n");
 737                         return;
 738                 }
 739
 740                 /* RFC2461 7.1.1:
 741                  *      If the IP source address is the unspecified address,
 742                  *      there MUST NOT be source link-layer address option
 743                  *      in the message.
 744                  */
 745                 if (dad) {
 746                         ND_PRINTK(2, warn,
 747                                   "NS: bad DAD packet (link-layer address option)\n");
 748                         return;
 749                 }
 750         }
 751
 752         inc = ipv6_addr_is_multicast(daddr);
 753
 754         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 755         if (ifp) {
 756
 757                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 758                         if (dad) {
 759                                 /*
 760                                  * We are colliding with another node
 761                                  * who is doing DAD
 762                                  * so fail our DAD process
 763                                  */
 764                                 addrconf_dad_failure(ifp);
 765                                 return;
 766                         } else {
 767                                 /*
 768                                  * This is not a dad solicitation.
 769                                  * If we are an optimistic node,
 770                                  * we should respond.
 771                                  * Otherwise, we should ignore it.
 772                                  */
 773                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 774                                         goto out;
 775                         }
 776                 }
 777
 778                 idev = ifp->idev;
 779         } else {
 780                 struct net *net = dev_net(dev);
 781
 782                 idev = in6_dev_get(dev);
 783                 if (!idev) {
 784                         /* XXX: count this drop? */
 785                         return;
 786                 }
 787
 788                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 789                     (idev->cnf.forwarding &&
 790                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 791                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 792                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 793                             skb->pkt_type != PACKET_HOST &&
 794                             inc &&
 795                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 796                                 /*
 797                                  * for anycast or proxy,
 798                                  * sender should delay its response
 799                                  * by a random time between 0 and
 800                                  * MAX_ANYCAST_DELAY_TIME seconds.
 801                                  * (RFC2461) -- yoshfuji
 802                                  */
 803                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 804                                 if (n)
 805                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 806                                 goto out;
 807                         }
 808                 } else
 809                         goto out;
 810         }
 811
 812         if (is_router < 0)
 813                 is_router = idev->cnf.forwarding;
 814
 815         if (dad) {
 816                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
 817                               !!is_router, false, (ifp != NULL), true);
 818                 goto out;
 819         }
 820
 821         if (inc)
 822                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 823         else
 824                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 825
 826         /*
 827          *      update / create cache entry
 828          *      for the source address
 829          */
 830         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 831                                !inc || lladdr || !dev->addr_len);
 832         if (neigh)
 833                 neigh_update(neigh, lladdr, NUD_STALE,
 834                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 835                              NEIGH_UPDATE_F_OVERRIDE);
 836         if (neigh || !dev->header_ops) {
 837                 ndisc_send_na(dev, neigh, saddr, &msg->target,
 838                               !!is_router,
 839                               true, (ifp != NULL && inc), inc);
 840                 if (neigh)
 841                         neigh_release(neigh);
 842         }
 843
 844 out:
 845         if (ifp)
 846                 in6_ifa_put(ifp);
 847         else
 848                 in6_dev_put(idev);
 849 }
 850
 851 static void ndisc_recv_na(struct sk_buff *skb)
 852 {
 853         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 854         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 855         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 856         u8 *lladdr = NULL;
 857         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 858                                     offsetof(struct nd_msg, opt));
 859         struct ndisc_options ndopts;
 860         struct net_device *dev = skb->dev;
 861         struct inet6_ifaddr *ifp;
 862         struct neighbour *neigh;
 863
 864         if (skb->len < sizeof(struct nd_msg)) {
 865                 ND_PRINTK(2, warn, "NA: packet too short\n");
 866                 return;
 867         }
 868
 869         if (ipv6_addr_is_multicast(&msg->target)) {
 870                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 871                 return;
 872         }
 873
 874         if (ipv6_addr_is_multicast(daddr) &&
 875             msg->icmph.icmp6_solicited) {
 876                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 877                 return;
 878         }
 879
 880         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 881                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 882                 return;
 883         }
 884         if (ndopts.nd_opts_tgt_lladdr) {
 885                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 886                 if (!lladdr) {
 887                         ND_PRINTK(2, warn,
 888                                   "NA: invalid link-layer address length\n");
 889                         return;
 890                 }
 891         }
 892         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 893         if (ifp) {
 894                 if (skb->pkt_type != PACKET_LOOPBACK
 895                     && (ifp->flags & IFA_F_TENTATIVE)) {
 896                                 addrconf_dad_failure(ifp);
 897                                 return;
 898                 }
 899                 /* What should we make now? The advertisement
 900                    is invalid, but ndisc specs say nothing
 901                    about it. It could be misconfiguration, or
 902                    an smart proxy agent tries to help us :-)
 903
 904                    We should not print the error if NA has been
 905                    received from loopback - it is just our own
 906                    unsolicited advertisement.
 907                  */
 908                 if (skb->pkt_type != PACKET_LOOPBACK)
 909                         ND_PRINTK(1, warn,
 910                                   "NA: someone advertises our address %pI6 on %s!\n",
 911                                   &ifp->addr, ifp->idev->dev->name);
 912                 in6_ifa_put(ifp);
 913                 return;
 914         }
 915         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 916
 917         if (neigh) {
 918                 u8 old_flags = neigh->flags;
 919                 struct net *net = dev_net(dev);
 920
 921                 if (neigh->nud_state & NUD_FAILED)
 922                         goto out;
 923
 924                 /*
 925                  * Don't update the neighbor cache entry on a proxy NA from
 926                  * ourselves because either the proxied node is off link or it
 927                  * has already sent a NA to us.
 928                  */
 929                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 930                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
 931                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
 932                         /* XXX: idev->cnf.proxy_ndp */
 933                         goto out;
 934                 }
 935
 936                 neigh_update(neigh, lladdr,
 937                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 938                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 939                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 940                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 941                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 942
 943                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 944                         /*
 945                          * Change: router to host
 946                          */
 947                         rt6_clean_tohost(dev_net(dev),  saddr);
 948                 }
 949
 950 out:
 951                 neigh_release(neigh);
 952         }
 953 }
 954
 955 static void ndisc_recv_rs(struct sk_buff *skb)
 956 {
 957         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 958         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 959         struct neighbour *neigh;
 960         struct inet6_dev *idev;
 961         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 962         struct ndisc_options ndopts;
 963         u8 *lladdr = NULL;
 964
 965         if (skb->len < sizeof(*rs_msg))
 966                 return;
 967
 968         idev = __in6_dev_get(skb->dev);
 969         if (!idev) {
 970                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
 971                 return;
 972         }
 973
 974         /* Don't accept RS if we're not in router mode */
 975         if (!idev->cnf.forwarding)
 976                 goto out;
 977
 978         /*
 979          * Don't update NCE if src = ::;
 980          * this implies that the source node has no ip address assigned yet.
 981          */
 982         if (ipv6_addr_any(saddr))
 983                 goto out;
 984
 985         /* Parse ND options */
 986         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 987                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
 988                 goto out;
 989         }
 990
 991         if (ndopts.nd_opts_src_lladdr) {
 992                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
 993                                              skb->dev);
 994                 if (!lladdr)
 995                         goto out;
 996         }
 997
 998         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
 999         if (neigh) {
1000                 neigh_update(neigh, lladdr, NUD_STALE,
1001                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1002                              NEIGH_UPDATE_F_OVERRIDE|
1003                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1004                 neigh_release(neigh);
1005         }
1006 out:
1007         return;
1008 }
1009
1010 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1011 {
1012         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1013         struct sk_buff *skb;
1014         struct nlmsghdr *nlh;
1015         struct nduseroptmsg *ndmsg;
1016         struct net *net = dev_net(ra->dev);
1017         int err;
1018         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1019                                     + (opt->nd_opt_len << 3));
1020         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1021
1022         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1023         if (skb == NULL) {
1024                 err = -ENOBUFS;
1025                 goto errout;
1026         }
1027
1028         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1029         if (nlh == NULL) {
1030                 goto nla_put_failure;
1031         }
1032
1033         ndmsg = nlmsg_data(nlh);
1034         ndmsg->nduseropt_family = AF_INET6;
1035         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1036         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1037         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1038         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1039
1040         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1041
1042         if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1043                     &ipv6_hdr(ra)->saddr))
1044                 goto nla_put_failure;
1045         nlmsg_end(skb, nlh);
1046
1047         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1048         return;
1049
1050 nla_put_failure:
1051         nlmsg_free(skb);
1052         err = -EMSGSIZE;
1053 errout:
1054         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1055 }
1056
1057 static void ndisc_router_discovery(struct sk_buff *skb)
1058 {
1059         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1060         struct neighbour *neigh = NULL;
1061         struct inet6_dev *in6_dev;
1062         struct rt6_info *rt = NULL;
1063         int lifetime;
1064         struct ndisc_options ndopts;
1065         int optlen;
1066         unsigned int pref = 0;
1067
1068         __u8 * opt = (__u8 *)(ra_msg + 1);
1069
1070         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1071                 sizeof(struct ra_msg);
1072
1073         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1074                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1075                 return;
1076         }
1077         if (optlen < 0) {
1078                 ND_PRINTK(2, warn, "RA: packet too short\n");
1079                 return;
1080         }
1081
1082 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1083         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1084                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1085                 return;
1086         }
1087 #endif
1088
1089         /*
1090          *      set the RA_RECV flag in the interface
1091          */
1092
1093         in6_dev = __in6_dev_get(skb->dev);
1094         if (in6_dev == NULL) {
1095                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1096                           skb->dev->name);
1097                 return;
1098         }
1099
1100         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1101                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1102                 return;
1103         }
1104
1105         if (!ipv6_accept_ra(in6_dev))
1106                 goto skip_linkparms;
1107
1108 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1109         /* skip link-specific parameters from interior routers */
1110         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
1111                 goto skip_linkparms;
1112 #endif
1113
1114         if (in6_dev->if_flags & IF_RS_SENT) {
1115                 /*
1116                  *      flag that an RA was received after an RS was sent
1117                  *      out on this interface.
1118                  */
1119                 in6_dev->if_flags |= IF_RA_RCVD;
1120         }
1121
1122         /*
1123          * Remember the managed/otherconf flags from most recently
1124          * received RA message (RFC 2462) -- yoshfuji
1125          */
1126         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1127                                 IF_RA_OTHERCONF)) |
1128                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1129                                         IF_RA_MANAGED : 0) |
1130                                 (ra_msg->icmph.icmp6_addrconf_other ?
1131                                         IF_RA_OTHERCONF : 0);
1132
1133         if (!in6_dev->cnf.accept_ra_defrtr)
1134                 goto skip_defrtr;
1135
1136         if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
1137                 goto skip_defrtr;
1138
1139         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1140
1141 #ifdef CONFIG_IPV6_ROUTER_PREF
1142         pref = ra_msg->icmph.icmp6_router_pref;
1143         /* 10b is handled as if it were 00b (medium) */
1144         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1145             !in6_dev->cnf.accept_ra_rtr_pref)
1146                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1147 #endif
1148
1149         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1150
1151         if (rt) {
1152                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1153                 if (!neigh) {
1154                         ND_PRINTK(0, err,
1155                                   "RA: %s got default router without neighbour\n",
1156                                   __func__);
1157                         ip6_rt_put(rt);
1158                         return;
1159                 }
1160         }
1161         if (rt && lifetime == 0) {
1162                 ip6_del_rt(rt);
1163                 rt = NULL;
1164         }
1165
1166         if (rt == NULL && lifetime) {
1167                 ND_PRINTK(3, dbg, "RA: adding default router\n");
1168
1169                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1170                 if (rt == NULL) {
1171                         ND_PRINTK(0, err,
1172                                   "RA: %s failed to add default route\n",
1173                                   __func__);
1174                         return;
1175                 }
1176
1177                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1178                 if (neigh == NULL) {
1179                         ND_PRINTK(0, err,
1180                                   "RA: %s got default router without neighbour\n",
1181                                   __func__);
1182                         ip6_rt_put(rt);
1183                         return;
1184                 }
1185                 neigh->flags |= NTF_ROUTER;
1186         } else if (rt) {
1187                 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1188         }
1189
1190         if (rt)
1191                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1192         if (ra_msg->icmph.icmp6_hop_limit) {
1193                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1194                 if (rt)
1195                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1196                                        ra_msg->icmph.icmp6_hop_limit);
1197         }
1198
1199 skip_defrtr:
1200
1201         /*
1202          *      Update Reachable Time and Retrans Timer
1203          */
1204
1205         if (in6_dev->nd_parms) {
1206                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1207
1208                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1209                         rtime = (rtime*HZ)/1000;
1210                         if (rtime < HZ/10)
1211                                 rtime = HZ/10;
1212                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1213                         in6_dev->tstamp = jiffies;
1214                         inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1215                 }
1216
1217                 rtime = ntohl(ra_msg->reachable_time);
1218                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1219                         rtime = (rtime*HZ)/1000;
1220
1221                         if (rtime < HZ/10)
1222                                 rtime = HZ/10;
1223
1224                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1225                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1226                                               BASE_REACHABLE_TIME, rtime);
1227                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1228                                               GC_STALETIME, 3 * rtime);
1229                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1230                                 in6_dev->tstamp = jiffies;
1231                                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1232                         }
1233                 }
1234         }
1235
1236 skip_linkparms:
1237
1238         /*
1239          *      Process options.
1240          */
1241
1242         if (!neigh)
1243                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1244                                        skb->dev, 1);
1245         if (neigh) {
1246                 u8 *lladdr = NULL;
1247                 if (ndopts.nd_opts_src_lladdr) {
1248                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1249                                                      skb->dev);
1250                         if (!lladdr) {
1251                                 ND_PRINTK(2, warn,
1252                                           "RA: invalid link-layer address length\n");
1253                                 goto out;
1254                         }
1255                 }
1256                 neigh_update(neigh, lladdr, NUD_STALE,
1257                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1258                              NEIGH_UPDATE_F_OVERRIDE|
1259                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1260                              NEIGH_UPDATE_F_ISROUTER);
1261         }
1262
1263         if (!ipv6_accept_ra(in6_dev))
1264                 goto out;
1265
1266 #ifdef CONFIG_IPV6_ROUTE_INFO
1267         if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
1268                 goto skip_routeinfo;
1269
1270         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1271                 struct nd_opt_hdr *p;
1272                 for (p = ndopts.nd_opts_ri;
1273                      p;
1274                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1275                         struct route_info *ri = (struct route_info *)p;
1276 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1277                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1278                             ri->prefix_len == 0)
1279                                 continue;
1280 #endif
1281                         if (ri->prefix_len == 0 &&
1282                             !in6_dev->cnf.accept_ra_defrtr)
1283                                 continue;
1284                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1285                                 continue;
1286                         rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
1287                                       &ipv6_hdr(skb)->saddr);
1288                 }
1289         }
1290
1291 skip_routeinfo:
1292 #endif
1293
1294 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1295         /* skip link-specific ndopts from interior routers */
1296         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
1297                 goto out;
1298 #endif
1299
1300         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1301                 struct nd_opt_hdr *p;
1302                 for (p = ndopts.nd_opts_pi;
1303                      p;
1304                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1305                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1306                                             (p->nd_opt_len) << 3,
1307                                             ndopts.nd_opts_src_lladdr != NULL);
1308                 }
1309         }
1310
1311         if (ndopts.nd_opts_mtu) {
1312                 __be32 n;
1313                 u32 mtu;
1314
1315                 memcpy(&n, ((u8*)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1316                 mtu = ntohl(n);
1317
1318                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1319                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1320                 } else if (in6_dev->cnf.mtu6 != mtu) {
1321                         in6_dev->cnf.mtu6 = mtu;
1322
1323                         if (rt)
1324                                 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1325
1326                         rt6_mtu_change(skb->dev, mtu);
1327                 }
1328         }
1329
1330         if (ndopts.nd_useropts) {
1331                 struct nd_opt_hdr *p;
1332                 for (p = ndopts.nd_useropts;
1333                      p;
1334                      p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1335                         ndisc_ra_useropt(skb, p);
1336                 }
1337         }
1338
1339         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1340                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1341         }
1342 out:
1343         ip6_rt_put(rt);
1344         if (neigh)
1345                 neigh_release(neigh);
1346 }
1347
1348 static void ndisc_redirect_rcv(struct sk_buff *skb)
1349 {
1350         u8 *hdr;
1351         struct ndisc_options ndopts;
1352         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1353         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1354                                     offsetof(struct rd_msg, opt));
1355
1356 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1357         switch (skb->ndisc_nodetype) {
1358         case NDISC_NODETYPE_HOST:
1359         case NDISC_NODETYPE_NODEFAULT:
1360                 ND_PRINTK(2, warn,
1361                           "Redirect: from host or unauthorized router\n");
1362                 return;
1363         }
1364 #endif
1365
1366         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1367                 ND_PRINTK(2, warn,
1368                           "Redirect: source address is not link-local\n");
1369                 return;
1370         }
1371
1372         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1373                 return;
1374
1375         if (!ndopts.nd_opts_rh) {
1376                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1377                                         skb->dev->ifindex, 0);
1378                 return;
1379         }
1380
1381         hdr = (u8 *)ndopts.nd_opts_rh;
1382         hdr += 8;
1383         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1384                 return;
1385
1386         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1387 }
1388
1389 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1390                                            struct sk_buff *orig_skb,
1391                                            int rd_len)
1392 {
1393         u8 *opt = skb_put(skb, rd_len);
1394
1395         memset(opt, 0, 8);
1396         *(opt++) = ND_OPT_REDIRECT_HDR;
1397         *(opt++) = (rd_len >> 3);
1398         opt += 6;
1399
1400         memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
1401 }
1402
1403 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1404 {
1405         struct net_device *dev = skb->dev;
1406         struct net *net = dev_net(dev);
1407         struct sock *sk = net->ipv6.ndisc_sk;
1408         int optlen = 0;
1409         struct inet_peer *peer;
1410         struct sk_buff *buff;
1411         struct rd_msg *msg;
1412         struct in6_addr saddr_buf;
1413         struct rt6_info *rt;
1414         struct dst_entry *dst;
1415         struct flowi6 fl6;
1416         int rd_len;
1417         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1418         bool ret;
1419
1420         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1421                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1422                           dev->name);
1423                 return;
1424         }
1425
1426         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1427             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1428                 ND_PRINTK(2, warn,
1429                           "Redirect: target address is not link-local unicast\n");
1430                 return;
1431         }
1432
1433         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1434                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1435
1436         dst = ip6_route_output(net, NULL, &fl6);
1437         if (dst->error) {
1438                 dst_release(dst);
1439                 return;
1440         }
1441         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1442         if (IS_ERR(dst))
1443                 return;
1444
1445         rt = (struct rt6_info *) dst;
1446
1447         if (rt->rt6i_flags & RTF_GATEWAY) {
1448                 ND_PRINTK(2, warn,
1449                           "Redirect: destination is not a neighbour\n");
1450                 goto release;
1451         }
1452         peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
1453         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1454         if (peer)
1455                 inet_putpeer(peer);
1456         if (!ret)
1457                 goto release;
1458
1459         if (dev->addr_len) {
1460                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1461                 if (!neigh) {
1462                         ND_PRINTK(2, warn,
1463                                   "Redirect: no neigh for target address\n");
1464                         goto release;
1465                 }
1466
1467                 read_lock_bh(&neigh->lock);
1468                 if (neigh->nud_state & NUD_VALID) {
1469                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1470                         read_unlock_bh(&neigh->lock);
1471                         ha = ha_buf;
1472                         optlen += ndisc_opt_addr_space(dev);
1473                 } else
1474                         read_unlock_bh(&neigh->lock);
1475
1476                 neigh_release(neigh);
1477         }
1478
1479         rd_len = min_t(unsigned int,
1480                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1481                        skb->len + 8);
1482         rd_len &= ~0x7;
1483         optlen += rd_len;
1484
1485         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1486         if (!buff)
1487                 goto release;
1488
1489         msg = (struct rd_msg *)skb_put(buff, sizeof(*msg));
1490         *msg = (struct rd_msg) {
1491                 .icmph = {
1492                         .icmp6_type = NDISC_REDIRECT,
1493                 },
1494                 .target = *target,
1495                 .dest = ipv6_hdr(skb)->daddr,
1496         };
1497
1498         /*
1499          *      include target_address option
1500          */
1501
1502         if (ha)
1503                 ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
1504
1505         /*
1506          *      build redirect option and copy skb over to the new packet.
1507          */
1508
1509         if (rd_len)
1510                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1511
1512         skb_dst_set(buff, dst);
1513         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1514         return;
1515
1516 release:
1517         dst_release(dst);
1518 }
1519
1520 static void pndisc_redo(struct sk_buff *skb)
1521 {
1522         ndisc_recv_ns(skb);
1523         kfree_skb(skb);
1524 }
1525
1526 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1527 {
1528         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1529
1530         if (!idev)
1531                 return true;
1532         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1533             idev->cnf.suppress_frag_ndisc) {
1534                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1535                 return true;
1536         }
1537         return false;
1538 }
1539
1540 int ndisc_rcv(struct sk_buff *skb)
1541 {
1542         struct nd_msg *msg;
1543
1544         if (ndisc_suppress_frag_ndisc(skb))
1545                 return 0;
1546
1547         if (skb_linearize(skb))
1548                 return 0;
1549
1550         msg = (struct nd_msg *)skb_transport_header(skb);
1551
1552         __skb_push(skb, skb->data - skb_transport_header(skb));
1553
1554         if (ipv6_hdr(skb)->hop_limit != 255) {
1555                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1556                           ipv6_hdr(skb)->hop_limit);
1557                 return 0;
1558         }
1559
1560         if (msg->icmph.icmp6_code != 0) {
1561                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1562                           msg->icmph.icmp6_code);
1563                 return 0;
1564         }
1565
1566         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1567
1568         switch (msg->icmph.icmp6_type) {
1569         case NDISC_NEIGHBOUR_SOLICITATION:
1570                 ndisc_recv_ns(skb);
1571                 break;
1572
1573         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1574                 ndisc_recv_na(skb);
1575                 break;
1576
1577         case NDISC_ROUTER_SOLICITATION:
1578                 ndisc_recv_rs(skb);
1579                 break;
1580
1581         case NDISC_ROUTER_ADVERTISEMENT:
1582                 ndisc_router_discovery(skb);
1583                 break;
1584
1585         case NDISC_REDIRECT:
1586                 ndisc_redirect_rcv(skb);
1587                 break;
1588         }
1589
1590         return 0;
1591 }
1592
1593 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1594 {
1595         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1596         struct net *net = dev_net(dev);
1597         struct inet6_dev *idev;
1598
1599         switch (event) {
1600         case NETDEV_CHANGEADDR:
1601                 neigh_changeaddr(&nd_tbl, dev);
1602                 fib6_run_gc(0, net, false);
1603                 idev = in6_dev_get(dev);
1604                 if (!idev)
1605                         break;
1606                 if (idev->cnf.ndisc_notify)
1607                         ndisc_send_unsol_na(dev);
1608                 in6_dev_put(idev);
1609                 break;
1610         case NETDEV_DOWN:
1611                 neigh_ifdown(&nd_tbl, dev);
1612                 fib6_run_gc(0, net, false);
1613                 break;
1614         case NETDEV_NOTIFY_PEERS:
1615                 ndisc_send_unsol_na(dev);
1616                 break;
1617         default:
1618                 break;
1619         }
1620
1621         return NOTIFY_DONE;
1622 }
1623
1624 static struct notifier_block ndisc_netdev_notifier = {
1625         .notifier_call = ndisc_netdev_event,
1626 };
1627
1628 #ifdef CONFIG_SYSCTL
1629 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1630                                          const char *func, const char *dev_name)
1631 {
1632         static char warncomm[TASK_COMM_LEN];
1633         static int warned;
1634         if (strcmp(warncomm, current->comm) && warned < 5) {
1635                 strcpy(warncomm, current->comm);
1636                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1637                         warncomm, func,
1638                         dev_name, ctl->procname,
1639                         dev_name, ctl->procname);
1640                 warned++;
1641         }
1642 }
1643
1644 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1645 {
1646         struct net_device *dev = ctl->extra1;
1647         struct inet6_dev *idev;
1648         int ret;
1649
1650         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1651             (strcmp(ctl->procname, "base_reachable_time") == 0))
1652                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1653
1654         if (strcmp(ctl->procname, "retrans_time") == 0)
1655                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1656
1657         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1658                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1659                                                   buffer, lenp, ppos);
1660
1661         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1662                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1663                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1664                                                      buffer, lenp, ppos);
1665         else
1666                 ret = -1;
1667
1668         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1669                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1670                         idev->nd_parms->reachable_time =
1671                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1672                 idev->tstamp = jiffies;
1673                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1674                 in6_dev_put(idev);
1675         }
1676         return ret;
1677 }
1678
1679
1680 #endif
1681
1682 static int __net_init ndisc_net_init(struct net *net)
1683 {
1684         struct ipv6_pinfo *np;
1685         struct sock *sk;
1686         int err;
1687
1688         err = inet_ctl_sock_create(&sk, PF_INET6,
1689                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1690         if (err < 0) {
1691                 ND_PRINTK(0, err,
1692                           "NDISC: Failed to initialize the control socket (err %d)\n",
1693                           err);
1694                 return err;
1695         }
1696
1697         net->ipv6.ndisc_sk = sk;
1698
1699         np = inet6_sk(sk);
1700         np->hop_limit = 255;
1701         /* Do not loopback ndisc messages */
1702         np->mc_loop = 0;
1703
1704         return 0;
1705 }
1706
1707 static void __net_exit ndisc_net_exit(struct net *net)
1708 {
1709         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1710 }
1711
1712 static struct pernet_operations ndisc_net_ops = {
1713         .init = ndisc_net_init,
1714         .exit = ndisc_net_exit,
1715 };
1716
1717 int __init ndisc_init(void)
1718 {
1719         int err;
1720
1721         err = register_pernet_subsys(&ndisc_net_ops);
1722         if (err)
1723                 return err;
1724         /*
1725          * Initialize the neighbour table
1726          */
1727         neigh_table_init(&nd_tbl);
1728
1729 #ifdef CONFIG_SYSCTL
1730         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1731                                     &ndisc_ifinfo_sysctl_change);
1732         if (err)
1733                 goto out_unregister_pernet;
1734 out:
1735 #endif
1736         return err;
1737
1738 #ifdef CONFIG_SYSCTL
1739 out_unregister_pernet:
1740         unregister_pernet_subsys(&ndisc_net_ops);
1741         goto out;
1742 #endif
1743 }
1744
1745 int __init ndisc_late_init(void)
1746 {
1747         return register_netdevice_notifier(&ndisc_netdev_notifier);
1748 }
1749
1750 void ndisc_late_cleanup(void)
1751 {
1752         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1753 }
1754
1755 void ndisc_cleanup(void)
1756 {
1757 #ifdef CONFIG_SYSCTL
1758         neigh_sysctl_unregister(&nd_tbl.parms);
1759 #endif
1760         neigh_table_clear(&nd_tbl);
1761         unregister_pernet_subsys(&ndisc_net_ops);
1762 }