net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <[email protected]>
   7  *      Mike Shaver             <[email protected]>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  19  *      Pierre Ynard                    :       export userland ND options
  20  *                                              through netlink (RDNSS support)
  21  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  22  *                                              of an RA.
  23  *      Janos Farkas                    :       kmalloc failure checks
  24  *      Alexey Kuznetsov                :       state machine reworked
  25  *                                              and moved to net/core.
  26  *      Pekka Savola                    :       RFC2461 validation
  27  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  28  */
  29
  30 #define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32 #include <linux/module.h>
  33 #include <linux/errno.h>
  34 #include <linux/types.h>
  35 #include <linux/socket.h>
  36 #include <linux/sockios.h>
  37 #include <linux/sched.h>
  38 #include <linux/net.h>
  39 #include <linux/in6.h>
  40 #include <linux/route.h>
  41 #include <linux/init.h>
  42 #include <linux/rcupdate.h>
  43 #include <linux/slab.h>
  44 #ifdef CONFIG_SYSCTL
  45 #include <linux/sysctl.h>
  46 #endif
  47
  48 #include <linux/if_addr.h>
  49 #include <linux/if_arp.h>
  50 #include <linux/ipv6.h>
  51 #include <linux/icmpv6.h>
  52 #include <linux/jhash.h>
  53
  54 #include <net/sock.h>
  55 #include <net/snmp.h>
  56
  57 #include <net/ipv6.h>
  58 #include <net/protocol.h>
  59 #include <net/ndisc.h>
  60 #include <net/ip6_route.h>
  61 #include <net/addrconf.h>
  62 #include <net/icmp.h>
  63
  64 #include <net/netlink.h>
  65 #include <linux/rtnetlink.h>
  66
  67 #include <net/flow.h>
  68 #include <net/ip6_checksum.h>
  69 #include <net/inet_common.h>
  70 #include <linux/proc_fs.h>
  71
  72 #include <linux/netfilter.h>
  73 #include <linux/netfilter_ipv6.h>
  74
  75 /* Set to 3 to get tracing... */
  76 #define ND_DEBUG 1
  77
  78 #define ND_PRINTK(val, level, fmt, ...)                         \
  79 do {                                                            \
  80         if (val <= ND_DEBUG)                                    \
  81                 net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
  82 } while (0)
  83
  84 static u32 ndisc_hash(const void *pkey,
  85                       const struct net_device *dev,
  86                       __u32 *hash_rnd);
  87 static int ndisc_constructor(struct neighbour *neigh);
  88 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  89 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  90 static int pndisc_constructor(struct pneigh_entry *n);
  91 static void pndisc_destructor(struct pneigh_entry *n);
  92 static void pndisc_redo(struct sk_buff *skb);
  93
  94 static const struct neigh_ops ndisc_generic_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_connected_output,
 100 };
 101
 102 static const struct neigh_ops ndisc_hh_ops = {
 103         .family =               AF_INET6,
 104         .solicit =              ndisc_solicit,
 105         .error_report =         ndisc_error_report,
 106         .output =               neigh_resolve_output,
 107         .connected_output =     neigh_resolve_output,
 108 };
 109
 110
 111 static const struct neigh_ops ndisc_direct_ops = {
 112         .family =               AF_INET6,
 113         .output =               neigh_direct_output,
 114         .connected_output =     neigh_direct_output,
 115 };
 116
 117 struct neigh_table nd_tbl = {
 118         .family =       AF_INET6,
 119         .key_len =      sizeof(struct in6_addr),
 120         .hash =         ndisc_hash,
 121         .constructor =  ndisc_constructor,
 122         .pconstructor = pndisc_constructor,
 123         .pdestructor =  pndisc_destructor,
 124         .proxy_redo =   pndisc_redo,
 125         .id =           "ndisc_cache",
 126         .parms = {
 127                 .tbl                    = &nd_tbl,
 128                 .reachable_time         = ND_REACHABLE_TIME,
 129                 .data = {
 130                         [NEIGH_VAR_MCAST_PROBES] = 3,
 131                         [NEIGH_VAR_UCAST_PROBES] = 3,
 132                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 133                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 134                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 135                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 136                         [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
 137                         [NEIGH_VAR_PROXY_QLEN] = 64,
 138                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 139                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 140                 },
 141         },
 142         .gc_interval =    30 * HZ,
 143         .gc_thresh1 =    128,
 144         .gc_thresh2 =    512,
 145         .gc_thresh3 =   1024,
 146 };
 147
 148 static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
 149 {
 150         int pad   = ndisc_addr_option_pad(skb->dev->type);
 151         int data_len = skb->dev->addr_len;
 152         int space = ndisc_opt_addr_space(skb->dev);
 153         u8 *opt = skb_put(skb, space);
 154
 155         opt[0] = type;
 156         opt[1] = space>>3;
 157
 158         memset(opt + 2, 0, pad);
 159         opt   += pad;
 160         space -= pad;
 161
 162         memcpy(opt+2, data, data_len);
 163         data_len += 2;
 164         opt += data_len;
 165         space -= data_len;
 166         if (space > 0)
 167                 memset(opt, 0, space);
 168 }
 169
 170 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 171                                             struct nd_opt_hdr *end)
 172 {
 173         int type;
 174         if (!cur || !end || cur >= end)
 175                 return NULL;
 176         type = cur->nd_opt_type;
 177         do {
 178                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 179         } while (cur < end && cur->nd_opt_type != type);
 180         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 181 }
 182
 183 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 184 {
 185         return opt->nd_opt_type == ND_OPT_RDNSS ||
 186                 opt->nd_opt_type == ND_OPT_DNSSL;
 187 }
 188
 189 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 190                                              struct nd_opt_hdr *end)
 191 {
 192         if (!cur || !end || cur >= end)
 193                 return NULL;
 194         do {
 195                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 196         } while (cur < end && !ndisc_is_useropt(cur));
 197         return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 198 }
 199
 200 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 201                                           struct ndisc_options *ndopts)
 202 {
 203         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 204
 205         if (!nd_opt || opt_len < 0 || !ndopts)
 206                 return NULL;
 207         memset(ndopts, 0, sizeof(*ndopts));
 208         while (opt_len) {
 209                 int l;
 210                 if (opt_len < sizeof(struct nd_opt_hdr))
 211                         return NULL;
 212                 l = nd_opt->nd_opt_len << 3;
 213                 if (opt_len < l || l == 0)
 214                         return NULL;
 215                 switch (nd_opt->nd_opt_type) {
 216                 case ND_OPT_SOURCE_LL_ADDR:
 217                 case ND_OPT_TARGET_LL_ADDR:
 218                 case ND_OPT_MTU:
 219                 case ND_OPT_REDIRECT_HDR:
 220                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 221                                 ND_PRINTK(2, warn,
 222                                           "%s: duplicated ND6 option found: type=%d\n",
 223                                           __func__, nd_opt->nd_opt_type);
 224                         } else {
 225                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 226                         }
 227                         break;
 228                 case ND_OPT_PREFIX_INFO:
 229                         ndopts->nd_opts_pi_end = nd_opt;
 230                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 231                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 232                         break;
 233 #ifdef CONFIG_IPV6_ROUTE_INFO
 234                 case ND_OPT_ROUTE_INFO:
 235                         ndopts->nd_opts_ri_end = nd_opt;
 236                         if (!ndopts->nd_opts_ri)
 237                                 ndopts->nd_opts_ri = nd_opt;
 238                         break;
 239 #endif
 240                 default:
 241                         if (ndisc_is_useropt(nd_opt)) {
 242                                 ndopts->nd_useropts_end = nd_opt;
 243                                 if (!ndopts->nd_useropts)
 244                                         ndopts->nd_useropts = nd_opt;
 245                         } else {
 246                                 /*
 247                                  * Unknown options must be silently ignored,
 248                                  * to accommodate future extension to the
 249                                  * protocol.
 250                                  */
 251                                 ND_PRINTK(2, notice,
 252                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 253                                           __func__,
 254                                           nd_opt->nd_opt_type,
 255                                           nd_opt->nd_opt_len);
 256                         }
 257                 }
 258                 opt_len -= l;
 259                 nd_opt = ((void *)nd_opt) + l;
 260         }
 261         return ndopts;
 262 }
 263
 264 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 265 {
 266         switch (dev->type) {
 267         case ARPHRD_ETHER:
 268         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 269         case ARPHRD_FDDI:
 270                 ipv6_eth_mc_map(addr, buf);
 271                 return 0;
 272         case ARPHRD_ARCNET:
 273                 ipv6_arcnet_mc_map(addr, buf);
 274                 return 0;
 275         case ARPHRD_INFINIBAND:
 276                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 277                 return 0;
 278         case ARPHRD_IPGRE:
 279                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 280         default:
 281                 if (dir) {
 282                         memcpy(buf, dev->broadcast, dev->addr_len);
 283                         return 0;
 284                 }
 285         }
 286         return -EINVAL;
 287 }
 288 EXPORT_SYMBOL(ndisc_mc_map);
 289
 290 static u32 ndisc_hash(const void *pkey,
 291                       const struct net_device *dev,
 292                       __u32 *hash_rnd)
 293 {
 294         return ndisc_hashfn(pkey, dev, hash_rnd);
 295 }
 296
 297 static int ndisc_constructor(struct neighbour *neigh)
 298 {
 299         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 300         struct net_device *dev = neigh->dev;
 301         struct inet6_dev *in6_dev;
 302         struct neigh_parms *parms;
 303         bool is_multicast = ipv6_addr_is_multicast(addr);
 304
 305         in6_dev = in6_dev_get(dev);
 306         if (in6_dev == NULL) {
 307                 return -EINVAL;
 308         }
 309
 310         parms = in6_dev->nd_parms;
 311         __neigh_parms_put(neigh->parms);
 312         neigh->parms = neigh_parms_clone(parms);
 313
 314         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 315         if (!dev->header_ops) {
 316                 neigh->nud_state = NUD_NOARP;
 317                 neigh->ops = &ndisc_direct_ops;
 318                 neigh->output = neigh_direct_output;
 319         } else {
 320                 if (is_multicast) {
 321                         neigh->nud_state = NUD_NOARP;
 322                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 323                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 324                         neigh->nud_state = NUD_NOARP;
 325                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 326                         if (dev->flags&IFF_LOOPBACK)
 327                                 neigh->type = RTN_LOCAL;
 328                 } else if (dev->flags&IFF_POINTOPOINT) {
 329                         neigh->nud_state = NUD_NOARP;
 330                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 331                 }
 332                 if (dev->header_ops->cache)
 333                         neigh->ops = &ndisc_hh_ops;
 334                 else
 335                         neigh->ops = &ndisc_generic_ops;
 336                 if (neigh->nud_state&NUD_VALID)
 337                         neigh->output = neigh->ops->connected_output;
 338                 else
 339                         neigh->output = neigh->ops->output;
 340         }
 341         in6_dev_put(in6_dev);
 342         return 0;
 343 }
 344
 345 static int pndisc_constructor(struct pneigh_entry *n)
 346 {
 347         struct in6_addr *addr = (struct in6_addr *)&n->key;
 348         struct in6_addr maddr;
 349         struct net_device *dev = n->dev;
 350
 351         if (dev == NULL || __in6_dev_get(dev) == NULL)
 352                 return -EINVAL;
 353         addrconf_addr_solict_mult(addr, &maddr);
 354         ipv6_dev_mc_inc(dev, &maddr);
 355         return 0;
 356 }
 357
 358 static void pndisc_destructor(struct pneigh_entry *n)
 359 {
 360         struct in6_addr *addr = (struct in6_addr *)&n->key;
 361         struct in6_addr maddr;
 362         struct net_device *dev = n->dev;
 363
 364         if (dev == NULL || __in6_dev_get(dev) == NULL)
 365                 return;
 366         addrconf_addr_solict_mult(addr, &maddr);
 367         ipv6_dev_mc_dec(dev, &maddr);
 368 }
 369
 370 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 371                                        int len)
 372 {
 373         int hlen = LL_RESERVED_SPACE(dev);
 374         int tlen = dev->needed_tailroom;
 375         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 376         struct sk_buff *skb;
 377
 378         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 379         if (!skb) {
 380                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 381                           __func__);
 382                 return NULL;
 383         }
 384
 385         skb->protocol = htons(ETH_P_IPV6);
 386         skb->dev = dev;
 387
 388         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 389         skb_reset_transport_header(skb);
 390
 391         /* Manually assign socket ownership as we avoid calling
 392          * sock_alloc_send_pskb() to bypass wmem buffer limits
 393          */
 394         skb_set_owner_w(skb, sk);
 395
 396         return skb;
 397 }
 398
 399 static void ip6_nd_hdr(struct sk_buff *skb,
 400                        const struct in6_addr *saddr,
 401                        const struct in6_addr *daddr,
 402                        int hop_limit, int len)
 403 {
 404         struct ipv6hdr *hdr;
 405
 406         skb_push(skb, sizeof(*hdr));
 407         skb_reset_network_header(skb);
 408         hdr = ipv6_hdr(skb);
 409
 410         ip6_flow_hdr(hdr, 0, 0);
 411
 412         hdr->payload_len = htons(len);
 413         hdr->nexthdr = IPPROTO_ICMPV6;
 414         hdr->hop_limit = hop_limit;
 415
 416         hdr->saddr = *saddr;
 417         hdr->daddr = *daddr;
 418 }
 419
 420 static void ndisc_send_skb(struct sk_buff *skb,
 421                            const struct in6_addr *daddr,
 422                            const struct in6_addr *saddr)
 423 {
 424         struct dst_entry *dst = skb_dst(skb);
 425         struct net *net = dev_net(skb->dev);
 426         struct sock *sk = net->ipv6.ndisc_sk;
 427         struct inet6_dev *idev;
 428         int err;
 429         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 430         u8 type;
 431
 432         type = icmp6h->icmp6_type;
 433
 434         if (!dst) {
 435                 struct flowi6 fl6;
 436
 437                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex);
 438                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 439                 if (IS_ERR(dst)) {
 440                         kfree_skb(skb);
 441                         return;
 442                 }
 443
 444                 skb_dst_set(skb, dst);
 445         }
 446
 447         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 448                                               IPPROTO_ICMPV6,
 449                                               csum_partial(icmp6h,
 450                                                            skb->len, 0));
 451
 452         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 453
 454         rcu_read_lock();
 455         idev = __in6_dev_get(dst->dev);
 456         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 457
 458         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 459                       dst_output);
 460         if (!err) {
 461                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 462                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 463         }
 464
 465         rcu_read_unlock();
 466 }
 467
 468 void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 469                    const struct in6_addr *daddr,
 470                    const struct in6_addr *solicited_addr,
 471                    bool router, bool solicited, bool override, bool inc_opt)
 472 {
 473         struct sk_buff *skb;
 474         struct in6_addr tmpaddr;
 475         struct inet6_ifaddr *ifp;
 476         const struct in6_addr *src_addr;
 477         struct nd_msg *msg;
 478         int optlen = 0;
 479
 480         /* for anycast or proxy, solicited_addr != src_addr */
 481         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 482         if (ifp) {
 483                 src_addr = solicited_addr;
 484                 if (ifp->flags & IFA_F_OPTIMISTIC)
 485                         override = false;
 486                 inc_opt |= ifp->idev->cnf.force_tllao;
 487                 in6_ifa_put(ifp);
 488         } else {
 489                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 490                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 491                                        &tmpaddr))
 492                         return;
 493                 src_addr = &tmpaddr;
 494         }
 495
 496         if (!dev->addr_len)
 497                 inc_opt = 0;
 498         if (inc_opt)
 499                 optlen += ndisc_opt_addr_space(dev);
 500
 501         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 502         if (!skb)
 503                 return;
 504
 505         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 506         *msg = (struct nd_msg) {
 507                 .icmph = {
 508                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 509                         .icmp6_router = router,
 510                         .icmp6_solicited = solicited,
 511                         .icmp6_override = override,
 512                 },
 513                 .target = *solicited_addr,
 514         };
 515
 516         if (inc_opt)
 517                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 518                                        dev->dev_addr);
 519
 520
 521         ndisc_send_skb(skb, daddr, src_addr);
 522 }
 523
 524 static void ndisc_send_unsol_na(struct net_device *dev)
 525 {
 526         struct inet6_dev *idev;
 527         struct inet6_ifaddr *ifa;
 528
 529         idev = in6_dev_get(dev);
 530         if (!idev)
 531                 return;
 532
 533         read_lock_bh(&idev->lock);
 534         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 535                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
 536                               /*router=*/ !!idev->cnf.forwarding,
 537                               /*solicited=*/ false, /*override=*/ true,
 538                               /*inc_opt=*/ true);
 539         }
 540         read_unlock_bh(&idev->lock);
 541
 542         in6_dev_put(idev);
 543 }
 544
 545 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 546                    const struct in6_addr *solicit,
 547                    const struct in6_addr *daddr, const struct in6_addr *saddr)
 548 {
 549         struct sk_buff *skb;
 550         struct in6_addr addr_buf;
 551         int inc_opt = dev->addr_len;
 552         int optlen = 0;
 553         struct nd_msg *msg;
 554
 555         if (saddr == NULL) {
 556                 if (ipv6_get_lladdr(dev, &addr_buf,
 557                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 558                         return;
 559                 saddr = &addr_buf;
 560         }
 561
 562         if (ipv6_addr_any(saddr))
 563                 inc_opt = false;
 564         if (inc_opt)
 565                 optlen += ndisc_opt_addr_space(dev);
 566
 567         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 568         if (!skb)
 569                 return;
 570
 571         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 572         *msg = (struct nd_msg) {
 573                 .icmph = {
 574                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 575                 },
 576                 .target = *solicit,
 577         };
 578
 579         if (inc_opt)
 580                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 581                                        dev->dev_addr);
 582
 583         ndisc_send_skb(skb, daddr, saddr);
 584 }
 585
 586 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 587                    const struct in6_addr *daddr)
 588 {
 589         struct sk_buff *skb;
 590         struct rs_msg *msg;
 591         int send_sllao = dev->addr_len;
 592         int optlen = 0;
 593
 594 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 595         /*
 596          * According to section 2.2 of RFC 4429, we must not
 597          * send router solicitations with a sllao from
 598          * optimistic addresses, but we may send the solicitation
 599          * if we don't include the sllao.  So here we check
 600          * if our address is optimistic, and if so, we
 601          * suppress the inclusion of the sllao.
 602          */
 603         if (send_sllao) {
 604                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 605                                                            dev, 1);
 606                 if (ifp) {
 607                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 608                                 send_sllao = 0;
 609                         }
 610                         in6_ifa_put(ifp);
 611                 } else {
 612                         send_sllao = 0;
 613                 }
 614         }
 615 #endif
 616         if (send_sllao)
 617                 optlen += ndisc_opt_addr_space(dev);
 618
 619         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 620         if (!skb)
 621                 return;
 622
 623         msg = (struct rs_msg *)skb_put(skb, sizeof(*msg));
 624         *msg = (struct rs_msg) {
 625                 .icmph = {
 626                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 627                 },
 628         };
 629
 630         if (send_sllao)
 631                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 632                                        dev->dev_addr);
 633
 634         ndisc_send_skb(skb, daddr, saddr);
 635 }
 636
 637
 638 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 639 {
 640         /*
 641          *      "The sender MUST return an ICMP
 642          *       destination unreachable"
 643          */
 644         dst_link_failure(skb);
 645         kfree_skb(skb);
 646 }
 647
 648 /* Called with locked neigh: either read or both */
 649
 650 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 651 {
 652         struct in6_addr *saddr = NULL;
 653         struct in6_addr mcaddr;
 654         struct net_device *dev = neigh->dev;
 655         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 656         int probes = atomic_read(&neigh->probes);
 657
 658         if (skb && ipv6_chk_addr(dev_net(dev), &ipv6_hdr(skb)->saddr, dev, 1))
 659                 saddr = &ipv6_hdr(skb)->saddr;
 660         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 661         if (probes < 0) {
 662                 if (!(neigh->nud_state & NUD_VALID)) {
 663                         ND_PRINTK(1, dbg,
 664                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 665                                   __func__, target);
 666                 }
 667                 ndisc_send_ns(dev, neigh, target, target, saddr);
 668         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 669                 neigh_app_ns(neigh);
 670         } else {
 671                 addrconf_addr_solict_mult(target, &mcaddr);
 672                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 673         }
 674 }
 675
 676 static int pndisc_is_router(const void *pkey,
 677                             struct net_device *dev)
 678 {
 679         struct pneigh_entry *n;
 680         int ret = -1;
 681
 682         read_lock_bh(&nd_tbl.lock);
 683         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 684         if (n)
 685                 ret = !!(n->flags & NTF_ROUTER);
 686         read_unlock_bh(&nd_tbl.lock);
 687
 688         return ret;
 689 }
 690
 691 static void ndisc_recv_ns(struct sk_buff *skb)
 692 {
 693         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 694         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 695         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 696         u8 *lladdr = NULL;
 697         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 698                                     offsetof(struct nd_msg, opt));
 699         struct ndisc_options ndopts;
 700         struct net_device *dev = skb->dev;
 701         struct inet6_ifaddr *ifp;
 702         struct inet6_dev *idev = NULL;
 703         struct neighbour *neigh;
 704         int dad = ipv6_addr_any(saddr);
 705         bool inc;
 706         int is_router = -1;
 707
 708         if (skb->len < sizeof(struct nd_msg)) {
 709                 ND_PRINTK(2, warn, "NS: packet too short\n");
 710                 return;
 711         }
 712
 713         if (ipv6_addr_is_multicast(&msg->target)) {
 714                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 715                 return;
 716         }
 717
 718         /*
 719          * RFC2461 7.1.1:
 720          * DAD has to be destined for solicited node multicast address.
 721          */
 722         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 723                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 724                 return;
 725         }
 726
 727         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 728                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 729                 return;
 730         }
 731
 732         if (ndopts.nd_opts_src_lladdr) {
 733                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 734                 if (!lladdr) {
 735                         ND_PRINTK(2, warn,
 736                                   "NS: invalid link-layer address length\n");
 737                         return;
 738                 }
 739
 740                 /* RFC2461 7.1.1:
 741                  *      If the IP source address is the unspecified address,
 742                  *      there MUST NOT be source link-layer address option
 743                  *      in the message.
 744                  */
 745                 if (dad) {
 746                         ND_PRINTK(2, warn,
 747                                   "NS: bad DAD packet (link-layer address option)\n");
 748                         return;
 749                 }
 750         }
 751
 752         inc = ipv6_addr_is_multicast(daddr);
 753
 754         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 755         if (ifp) {
 756
 757                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 758                         if (dad) {
 759                                 /*
 760                                  * We are colliding with another node
 761                                  * who is doing DAD
 762                                  * so fail our DAD process
 763                                  */
 764                                 addrconf_dad_failure(ifp);
 765                                 return;
 766                         } else {
 767                                 /*
 768                                  * This is not a dad solicitation.
 769                                  * If we are an optimistic node,
 770                                  * we should respond.
 771                                  * Otherwise, we should ignore it.
 772                                  */
 773                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 774                                         goto out;
 775                         }
 776                 }
 777
 778                 idev = ifp->idev;
 779         } else {
 780                 struct net *net = dev_net(dev);
 781
 782                 idev = in6_dev_get(dev);
 783                 if (!idev) {
 784                         /* XXX: count this drop? */
 785                         return;
 786                 }
 787
 788                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 789                     (idev->cnf.forwarding &&
 790                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 791                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 792                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 793                             skb->pkt_type != PACKET_HOST &&
 794                             inc &&
 795                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 796                                 /*
 797                                  * for anycast or proxy,
 798                                  * sender should delay its response
 799                                  * by a random time between 0 and
 800                                  * MAX_ANYCAST_DELAY_TIME seconds.
 801                                  * (RFC2461) -- yoshfuji
 802                                  */
 803                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 804                                 if (n)
 805                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 806                                 goto out;
 807                         }
 808                 } else
 809                         goto out;
 810         }
 811
 812         if (is_router < 0)
 813                 is_router = idev->cnf.forwarding;
 814
 815         if (dad) {
 816                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
 817                               !!is_router, false, (ifp != NULL), true);
 818                 goto out;
 819         }
 820
 821         if (inc)
 822                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 823         else
 824                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 825
 826         /*
 827          *      update / create cache entry
 828          *      for the source address
 829          */
 830         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 831                                !inc || lladdr || !dev->addr_len);
 832         if (neigh)
 833                 neigh_update(neigh, lladdr, NUD_STALE,
 834                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 835                              NEIGH_UPDATE_F_OVERRIDE);
 836         if (neigh || !dev->header_ops) {
 837                 ndisc_send_na(dev, neigh, saddr, &msg->target,
 838                               !!is_router,
 839                               true, (ifp != NULL && inc), inc);
 840                 if (neigh)
 841                         neigh_release(neigh);
 842         }
 843
 844 out:
 845         if (ifp)
 846                 in6_ifa_put(ifp);
 847         else
 848                 in6_dev_put(idev);
 849 }
 850
 851 static void ndisc_recv_na(struct sk_buff *skb)
 852 {
 853         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 854         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 855         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 856         u8 *lladdr = NULL;
 857         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 858                                     offsetof(struct nd_msg, opt));
 859         struct ndisc_options ndopts;
 860         struct net_device *dev = skb->dev;
 861         struct inet6_ifaddr *ifp;
 862         struct neighbour *neigh;
 863
 864         if (skb->len < sizeof(struct nd_msg)) {
 865                 ND_PRINTK(2, warn, "NA: packet too short\n");
 866                 return;
 867         }
 868
 869         if (ipv6_addr_is_multicast(&msg->target)) {
 870                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 871                 return;
 872         }
 873
 874         if (ipv6_addr_is_multicast(daddr) &&
 875             msg->icmph.icmp6_solicited) {
 876                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 877                 return;
 878         }
 879
 880         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 881                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 882                 return;
 883         }
 884         if (ndopts.nd_opts_tgt_lladdr) {
 885                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 886                 if (!lladdr) {
 887                         ND_PRINTK(2, warn,
 888                                   "NA: invalid link-layer address length\n");
 889                         return;
 890                 }
 891         }
 892         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 893         if (ifp) {
 894                 if (skb->pkt_type != PACKET_LOOPBACK
 895                     && (ifp->flags & IFA_F_TENTATIVE)) {
 896                                 addrconf_dad_failure(ifp);
 897                                 return;
 898                 }
 899                 /* What should we make now? The advertisement
 900                    is invalid, but ndisc specs say nothing
 901                    about it. It could be misconfiguration, or
 902                    an smart proxy agent tries to help us :-)
 903
 904                    We should not print the error if NA has been
 905                    received from loopback - it is just our own
 906                    unsolicited advertisement.
 907                  */
 908                 if (skb->pkt_type != PACKET_LOOPBACK)
 909                         ND_PRINTK(1, warn,
 910                                   "NA: someone advertises our address %pI6 on %s!\n",
 911                                   &ifp->addr, ifp->idev->dev->name);
 912                 in6_ifa_put(ifp);
 913                 return;
 914         }
 915         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 916
 917         if (neigh) {
 918                 u8 old_flags = neigh->flags;
 919                 struct net *net = dev_net(dev);
 920
 921                 if (neigh->nud_state & NUD_FAILED)
 922                         goto out;
 923
 924                 /*
 925                  * Don't update the neighbor cache entry on a proxy NA from
 926                  * ourselves because either the proxied node is off link or it
 927                  * has already sent a NA to us.
 928                  */
 929                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 930                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
 931                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
 932                         /* XXX: idev->cnf.proxy_ndp */
 933                         goto out;
 934                 }
 935
 936                 neigh_update(neigh, lladdr,
 937                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 938                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 939                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 940                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 941                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 942
 943                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 944                         /*
 945                          * Change: router to host
 946                          */
 947                         rt6_clean_tohost(dev_net(dev),  saddr);
 948                 }
 949
 950 out:
 951                 neigh_release(neigh);
 952         }
 953 }
 954
 955 static void ndisc_recv_rs(struct sk_buff *skb)
 956 {
 957         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 958         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 959         struct neighbour *neigh;
 960         struct inet6_dev *idev;
 961         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 962         struct ndisc_options ndopts;
 963         u8 *lladdr = NULL;
 964
 965         if (skb->len < sizeof(*rs_msg))
 966                 return;
 967
 968         idev = __in6_dev_get(skb->dev);
 969         if (!idev) {
 970                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
 971                 return;
 972         }
 973
 974         /* Don't accept RS if we're not in router mode */
 975         if (!idev->cnf.forwarding)
 976                 goto out;
 977
 978         /*
 979          * Don't update NCE if src = ::;
 980          * this implies that the source node has no ip address assigned yet.
 981          */
 982         if (ipv6_addr_any(saddr))
 983                 goto out;
 984
 985         /* Parse ND options */
 986         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 987                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
 988                 goto out;
 989         }
 990
 991         if (ndopts.nd_opts_src_lladdr) {
 992                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
 993                                              skb->dev);
 994                 if (!lladdr)
 995                         goto out;
 996         }
 997
 998         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
 999         if (neigh) {
1000                 neigh_update(neigh, lladdr, NUD_STALE,
1001                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1002                              NEIGH_UPDATE_F_OVERRIDE|
1003                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1004                 neigh_release(neigh);
1005         }
1006 out:
1007         return;
1008 }
1009
1010 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1011 {
1012         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1013         struct sk_buff *skb;
1014         struct nlmsghdr *nlh;
1015         struct nduseroptmsg *ndmsg;
1016         struct net *net = dev_net(ra->dev);
1017         int err;
1018         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1019                                     + (opt->nd_opt_len << 3));
1020         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1021
1022         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1023         if (skb == NULL) {
1024                 err = -ENOBUFS;
1025                 goto errout;
1026         }
1027
1028         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1029         if (nlh == NULL) {
1030                 goto nla_put_failure;
1031         }
1032
1033         ndmsg = nlmsg_data(nlh);
1034         ndmsg->nduseropt_family = AF_INET6;
1035         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1036         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1037         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1038         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1039
1040         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1041
1042         if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1043                     &ipv6_hdr(ra)->saddr))
1044                 goto nla_put_failure;
1045         nlmsg_end(skb, nlh);
1046
1047         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1048         return;
1049
1050 nla_put_failure:
1051         nlmsg_free(skb);
1052         err = -EMSGSIZE;
1053 errout:
1054         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1055 }
1056
1057 static void ndisc_router_discovery(struct sk_buff *skb)
1058 {
1059         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1060         struct neighbour *neigh = NULL;
1061         struct inet6_dev *in6_dev;
1062         struct rt6_info *rt = NULL;
1063         int lifetime;
1064         struct ndisc_options ndopts;
1065         int optlen;
1066         unsigned int pref = 0;
1067
1068         __u8 *opt = (__u8 *)(ra_msg + 1);
1069
1070         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1071                 sizeof(struct ra_msg);
1072
1073         ND_PRINTK(2, info,
1074                   "RA: %s, dev: %s\n",
1075                   __func__, skb->dev->name);
1076         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1077                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1078                 return;
1079         }
1080         if (optlen < 0) {
1081                 ND_PRINTK(2, warn, "RA: packet too short\n");
1082                 return;
1083         }
1084
1085 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1086         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1087                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1088                 return;
1089         }
1090 #endif
1091
1092         /*
1093          *      set the RA_RECV flag in the interface
1094          */
1095
1096         in6_dev = __in6_dev_get(skb->dev);
1097         if (in6_dev == NULL) {
1098                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1099                           skb->dev->name);
1100                 return;
1101         }
1102
1103         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1104                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1105                 return;
1106         }
1107
1108         if (!ipv6_accept_ra(in6_dev)) {
1109                 ND_PRINTK(2, info,
1110                           "RA: %s, did not accept ra for dev: %s\n",
1111                           __func__, skb->dev->name);
1112                 goto skip_linkparms;
1113         }
1114
1115 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1116         /* skip link-specific parameters from interior routers */
1117         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1118                 ND_PRINTK(2, info,
1119                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1120                           __func__, skb->dev->name);
1121                 goto skip_linkparms;
1122         }
1123 #endif
1124
1125         if (in6_dev->if_flags & IF_RS_SENT) {
1126                 /*
1127                  *      flag that an RA was received after an RS was sent
1128                  *      out on this interface.
1129                  */
1130                 in6_dev->if_flags |= IF_RA_RCVD;
1131         }
1132
1133         /*
1134          * Remember the managed/otherconf flags from most recently
1135          * received RA message (RFC 2462) -- yoshfuji
1136          */
1137         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1138                                 IF_RA_OTHERCONF)) |
1139                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1140                                         IF_RA_MANAGED : 0) |
1141                                 (ra_msg->icmph.icmp6_addrconf_other ?
1142                                         IF_RA_OTHERCONF : 0);
1143
1144         if (!in6_dev->cnf.accept_ra_defrtr) {
1145                 ND_PRINTK(2, info,
1146                           "RA: %s, defrtr is false for dev: %s\n",
1147                           __func__, skb->dev->name);
1148                 goto skip_defrtr;
1149         }
1150
1151         /* Do not accept RA with source-addr found on local machine unless
1152          * accept_ra_from_local is set to true.
1153          */
1154         if (!in6_dev->cnf.accept_ra_from_local &&
1155             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1156                           NULL, 0)) {
1157                 ND_PRINTK(2, info,
1158                           "RA from local address detected on dev: %s: default router ignored\n",
1159                           skb->dev->name);
1160                 goto skip_defrtr;
1161         }
1162
1163         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1164
1165 #ifdef CONFIG_IPV6_ROUTER_PREF
1166         pref = ra_msg->icmph.icmp6_router_pref;
1167         /* 10b is handled as if it were 00b (medium) */
1168         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1169             !in6_dev->cnf.accept_ra_rtr_pref)
1170                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1171 #endif
1172
1173         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1174
1175         if (rt) {
1176                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1177                 if (!neigh) {
1178                         ND_PRINTK(0, err,
1179                                   "RA: %s got default router without neighbour\n",
1180                                   __func__);
1181                         ip6_rt_put(rt);
1182                         return;
1183                 }
1184         }
1185         if (rt && lifetime == 0) {
1186                 ip6_del_rt(rt);
1187                 rt = NULL;
1188         }
1189
1190         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, for dev: %s\n",
1191                   rt, lifetime, skb->dev->name);
1192         if (rt == NULL && lifetime) {
1193                 ND_PRINTK(3, info, "RA: adding default router\n");
1194
1195                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1196                 if (rt == NULL) {
1197                         ND_PRINTK(0, err,
1198                                   "RA: %s failed to add default route\n",
1199                                   __func__);
1200                         return;
1201                 }
1202
1203                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1204                 if (neigh == NULL) {
1205                         ND_PRINTK(0, err,
1206                                   "RA: %s got default router without neighbour\n",
1207                                   __func__);
1208                         ip6_rt_put(rt);
1209                         return;
1210                 }
1211                 neigh->flags |= NTF_ROUTER;
1212         } else if (rt) {
1213                 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1214         }
1215
1216         if (rt)
1217                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1218         if (ra_msg->icmph.icmp6_hop_limit) {
1219                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1220                 if (rt)
1221                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1222                                        ra_msg->icmph.icmp6_hop_limit);
1223         }
1224
1225 skip_defrtr:
1226
1227         /*
1228          *      Update Reachable Time and Retrans Timer
1229          */
1230
1231         if (in6_dev->nd_parms) {
1232                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1233
1234                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1235                         rtime = (rtime*HZ)/1000;
1236                         if (rtime < HZ/10)
1237                                 rtime = HZ/10;
1238                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1239                         in6_dev->tstamp = jiffies;
1240                         inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1241                 }
1242
1243                 rtime = ntohl(ra_msg->reachable_time);
1244                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1245                         rtime = (rtime*HZ)/1000;
1246
1247                         if (rtime < HZ/10)
1248                                 rtime = HZ/10;
1249
1250                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1251                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1252                                               BASE_REACHABLE_TIME, rtime);
1253                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1254                                               GC_STALETIME, 3 * rtime);
1255                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1256                                 in6_dev->tstamp = jiffies;
1257                                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1258                         }
1259                 }
1260         }
1261
1262 skip_linkparms:
1263
1264         /*
1265          *      Process options.
1266          */
1267
1268         if (!neigh)
1269                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1270                                        skb->dev, 1);
1271         if (neigh) {
1272                 u8 *lladdr = NULL;
1273                 if (ndopts.nd_opts_src_lladdr) {
1274                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1275                                                      skb->dev);
1276                         if (!lladdr) {
1277                                 ND_PRINTK(2, warn,
1278                                           "RA: invalid link-layer address length\n");
1279                                 goto out;
1280                         }
1281                 }
1282                 neigh_update(neigh, lladdr, NUD_STALE,
1283                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1284                              NEIGH_UPDATE_F_OVERRIDE|
1285                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1286                              NEIGH_UPDATE_F_ISROUTER);
1287         }
1288
1289         if (!ipv6_accept_ra(in6_dev)) {
1290                 ND_PRINTK(2, info,
1291                           "RA: %s, accept_ra is false for dev: %s\n",
1292                           __func__, skb->dev->name);
1293                 goto out;
1294         }
1295
1296 #ifdef CONFIG_IPV6_ROUTE_INFO
1297         if (!in6_dev->cnf.accept_ra_from_local &&
1298             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1299                           NULL, 0)) {
1300                 ND_PRINTK(2, info,
1301                           "RA from local address detected on dev: %s: router info ignored.\n",
1302                           skb->dev->name);
1303                 goto skip_routeinfo;
1304         }
1305
1306         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1307                 struct nd_opt_hdr *p;
1308                 for (p = ndopts.nd_opts_ri;
1309                      p;
1310                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1311                         struct route_info *ri = (struct route_info *)p;
1312 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1313                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1314                             ri->prefix_len == 0)
1315                                 continue;
1316 #endif
1317                         if (ri->prefix_len == 0 &&
1318                             !in6_dev->cnf.accept_ra_defrtr)
1319                                 continue;
1320                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1321                                 continue;
1322                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1323                                       &ipv6_hdr(skb)->saddr);
1324                 }
1325         }
1326
1327 skip_routeinfo:
1328 #endif
1329
1330 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1331         /* skip link-specific ndopts from interior routers */
1332         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1333                 ND_PRINTK(2, info,
1334                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1335                           __func__, skb->dev->name);
1336                 goto out;
1337         }
1338 #endif
1339
1340         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1341                 struct nd_opt_hdr *p;
1342                 for (p = ndopts.nd_opts_pi;
1343                      p;
1344                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1345                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1346                                             (p->nd_opt_len) << 3,
1347                                             ndopts.nd_opts_src_lladdr != NULL);
1348                 }
1349         }
1350
1351         if (ndopts.nd_opts_mtu) {
1352                 __be32 n;
1353                 u32 mtu;
1354
1355                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1356                 mtu = ntohl(n);
1357
1358                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1359                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1360                 } else if (in6_dev->cnf.mtu6 != mtu) {
1361                         in6_dev->cnf.mtu6 = mtu;
1362
1363                         if (rt)
1364                                 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1365
1366                         rt6_mtu_change(skb->dev, mtu);
1367                 }
1368         }
1369
1370         if (ndopts.nd_useropts) {
1371                 struct nd_opt_hdr *p;
1372                 for (p = ndopts.nd_useropts;
1373                      p;
1374                      p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1375                         ndisc_ra_useropt(skb, p);
1376                 }
1377         }
1378
1379         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1380                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1381         }
1382 out:
1383         ip6_rt_put(rt);
1384         if (neigh)
1385                 neigh_release(neigh);
1386 }
1387
1388 static void ndisc_redirect_rcv(struct sk_buff *skb)
1389 {
1390         u8 *hdr;
1391         struct ndisc_options ndopts;
1392         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1393         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1394                                     offsetof(struct rd_msg, opt));
1395
1396 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1397         switch (skb->ndisc_nodetype) {
1398         case NDISC_NODETYPE_HOST:
1399         case NDISC_NODETYPE_NODEFAULT:
1400                 ND_PRINTK(2, warn,
1401                           "Redirect: from host or unauthorized router\n");
1402                 return;
1403         }
1404 #endif
1405
1406         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1407                 ND_PRINTK(2, warn,
1408                           "Redirect: source address is not link-local\n");
1409                 return;
1410         }
1411
1412         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1413                 return;
1414
1415         if (!ndopts.nd_opts_rh) {
1416                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1417                                         skb->dev->ifindex, 0);
1418                 return;
1419         }
1420
1421         hdr = (u8 *)ndopts.nd_opts_rh;
1422         hdr += 8;
1423         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1424                 return;
1425
1426         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1427 }
1428
1429 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1430                                            struct sk_buff *orig_skb,
1431                                            int rd_len)
1432 {
1433         u8 *opt = skb_put(skb, rd_len);
1434
1435         memset(opt, 0, 8);
1436         *(opt++) = ND_OPT_REDIRECT_HDR;
1437         *(opt++) = (rd_len >> 3);
1438         opt += 6;
1439
1440         memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
1441 }
1442
1443 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1444 {
1445         struct net_device *dev = skb->dev;
1446         struct net *net = dev_net(dev);
1447         struct sock *sk = net->ipv6.ndisc_sk;
1448         int optlen = 0;
1449         struct inet_peer *peer;
1450         struct sk_buff *buff;
1451         struct rd_msg *msg;
1452         struct in6_addr saddr_buf;
1453         struct rt6_info *rt;
1454         struct dst_entry *dst;
1455         struct flowi6 fl6;
1456         int rd_len;
1457         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1458         bool ret;
1459
1460         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1461                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1462                           dev->name);
1463                 return;
1464         }
1465
1466         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1467             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1468                 ND_PRINTK(2, warn,
1469                           "Redirect: target address is not link-local unicast\n");
1470                 return;
1471         }
1472
1473         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1474                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1475
1476         dst = ip6_route_output(net, NULL, &fl6);
1477         if (dst->error) {
1478                 dst_release(dst);
1479                 return;
1480         }
1481         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1482         if (IS_ERR(dst))
1483                 return;
1484
1485         rt = (struct rt6_info *) dst;
1486
1487         if (rt->rt6i_flags & RTF_GATEWAY) {
1488                 ND_PRINTK(2, warn,
1489                           "Redirect: destination is not a neighbour\n");
1490                 goto release;
1491         }
1492         peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
1493         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1494         if (peer)
1495                 inet_putpeer(peer);
1496         if (!ret)
1497                 goto release;
1498
1499         if (dev->addr_len) {
1500                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1501                 if (!neigh) {
1502                         ND_PRINTK(2, warn,
1503                                   "Redirect: no neigh for target address\n");
1504                         goto release;
1505                 }
1506
1507                 read_lock_bh(&neigh->lock);
1508                 if (neigh->nud_state & NUD_VALID) {
1509                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1510                         read_unlock_bh(&neigh->lock);
1511                         ha = ha_buf;
1512                         optlen += ndisc_opt_addr_space(dev);
1513                 } else
1514                         read_unlock_bh(&neigh->lock);
1515
1516                 neigh_release(neigh);
1517         }
1518
1519         rd_len = min_t(unsigned int,
1520                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1521                        skb->len + 8);
1522         rd_len &= ~0x7;
1523         optlen += rd_len;
1524
1525         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1526         if (!buff)
1527                 goto release;
1528
1529         msg = (struct rd_msg *)skb_put(buff, sizeof(*msg));
1530         *msg = (struct rd_msg) {
1531                 .icmph = {
1532                         .icmp6_type = NDISC_REDIRECT,
1533                 },
1534                 .target = *target,
1535                 .dest = ipv6_hdr(skb)->daddr,
1536         };
1537
1538         /*
1539          *      include target_address option
1540          */
1541
1542         if (ha)
1543                 ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
1544
1545         /*
1546          *      build redirect option and copy skb over to the new packet.
1547          */
1548
1549         if (rd_len)
1550                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1551
1552         skb_dst_set(buff, dst);
1553         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1554         return;
1555
1556 release:
1557         dst_release(dst);
1558 }
1559
1560 static void pndisc_redo(struct sk_buff *skb)
1561 {
1562         ndisc_recv_ns(skb);
1563         kfree_skb(skb);
1564 }
1565
1566 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1567 {
1568         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1569
1570         if (!idev)
1571                 return true;
1572         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1573             idev->cnf.suppress_frag_ndisc) {
1574                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1575                 return true;
1576         }
1577         return false;
1578 }
1579
1580 int ndisc_rcv(struct sk_buff *skb)
1581 {
1582         struct nd_msg *msg;
1583
1584         if (ndisc_suppress_frag_ndisc(skb))
1585                 return 0;
1586
1587         if (skb_linearize(skb))
1588                 return 0;
1589
1590         msg = (struct nd_msg *)skb_transport_header(skb);
1591
1592         __skb_push(skb, skb->data - skb_transport_header(skb));
1593
1594         if (ipv6_hdr(skb)->hop_limit != 255) {
1595                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1596                           ipv6_hdr(skb)->hop_limit);
1597                 return 0;
1598         }
1599
1600         if (msg->icmph.icmp6_code != 0) {
1601                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1602                           msg->icmph.icmp6_code);
1603                 return 0;
1604         }
1605
1606         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1607
1608         switch (msg->icmph.icmp6_type) {
1609         case NDISC_NEIGHBOUR_SOLICITATION:
1610                 ndisc_recv_ns(skb);
1611                 break;
1612
1613         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1614                 ndisc_recv_na(skb);
1615                 break;
1616
1617         case NDISC_ROUTER_SOLICITATION:
1618                 ndisc_recv_rs(skb);
1619                 break;
1620
1621         case NDISC_ROUTER_ADVERTISEMENT:
1622                 ndisc_router_discovery(skb);
1623                 break;
1624
1625         case NDISC_REDIRECT:
1626                 ndisc_redirect_rcv(skb);
1627                 break;
1628         }
1629
1630         return 0;
1631 }
1632
1633 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1634 {
1635         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1636         struct net *net = dev_net(dev);
1637         struct inet6_dev *idev;
1638
1639         switch (event) {
1640         case NETDEV_CHANGEADDR:
1641                 neigh_changeaddr(&nd_tbl, dev);
1642                 fib6_run_gc(0, net, false);
1643                 idev = in6_dev_get(dev);
1644                 if (!idev)
1645                         break;
1646                 if (idev->cnf.ndisc_notify)
1647                         ndisc_send_unsol_na(dev);
1648                 in6_dev_put(idev);
1649                 break;
1650         case NETDEV_DOWN:
1651                 neigh_ifdown(&nd_tbl, dev);
1652                 fib6_run_gc(0, net, false);
1653                 break;
1654         case NETDEV_NOTIFY_PEERS:
1655                 ndisc_send_unsol_na(dev);
1656                 break;
1657         default:
1658                 break;
1659         }
1660
1661         return NOTIFY_DONE;
1662 }
1663
1664 static struct notifier_block ndisc_netdev_notifier = {
1665         .notifier_call = ndisc_netdev_event,
1666 };
1667
1668 #ifdef CONFIG_SYSCTL
1669 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1670                                          const char *func, const char *dev_name)
1671 {
1672         static char warncomm[TASK_COMM_LEN];
1673         static int warned;
1674         if (strcmp(warncomm, current->comm) && warned < 5) {
1675                 strcpy(warncomm, current->comm);
1676                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1677                         warncomm, func,
1678                         dev_name, ctl->procname,
1679                         dev_name, ctl->procname);
1680                 warned++;
1681         }
1682 }
1683
1684 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1685 {
1686         struct net_device *dev = ctl->extra1;
1687         struct inet6_dev *idev;
1688         int ret;
1689
1690         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1691             (strcmp(ctl->procname, "base_reachable_time") == 0))
1692                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1693
1694         if (strcmp(ctl->procname, "retrans_time") == 0)
1695                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1696
1697         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1698                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1699                                                   buffer, lenp, ppos);
1700
1701         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1702                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1703                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1704                                                      buffer, lenp, ppos);
1705         else
1706                 ret = -1;
1707
1708         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1709                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1710                         idev->nd_parms->reachable_time =
1711                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1712                 idev->tstamp = jiffies;
1713                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1714                 in6_dev_put(idev);
1715         }
1716         return ret;
1717 }
1718
1719
1720 #endif
1721
1722 static int __net_init ndisc_net_init(struct net *net)
1723 {
1724         struct ipv6_pinfo *np;
1725         struct sock *sk;
1726         int err;
1727
1728         err = inet_ctl_sock_create(&sk, PF_INET6,
1729                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1730         if (err < 0) {
1731                 ND_PRINTK(0, err,
1732                           "NDISC: Failed to initialize the control socket (err %d)\n",
1733                           err);
1734                 return err;
1735         }
1736
1737         net->ipv6.ndisc_sk = sk;
1738
1739         np = inet6_sk(sk);
1740         np->hop_limit = 255;
1741         /* Do not loopback ndisc messages */
1742         np->mc_loop = 0;
1743
1744         return 0;
1745 }
1746
1747 static void __net_exit ndisc_net_exit(struct net *net)
1748 {
1749         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1750 }
1751
1752 static struct pernet_operations ndisc_net_ops = {
1753         .init = ndisc_net_init,
1754         .exit = ndisc_net_exit,
1755 };
1756
1757 int __init ndisc_init(void)
1758 {
1759         int err;
1760
1761         err = register_pernet_subsys(&ndisc_net_ops);
1762         if (err)
1763                 return err;
1764         /*
1765          * Initialize the neighbour table
1766          */
1767         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1768
1769 #ifdef CONFIG_SYSCTL
1770         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1771                                     ndisc_ifinfo_sysctl_change);
1772         if (err)
1773                 goto out_unregister_pernet;
1774 out:
1775 #endif
1776         return err;
1777
1778 #ifdef CONFIG_SYSCTL
1779 out_unregister_pernet:
1780         unregister_pernet_subsys(&ndisc_net_ops);
1781         goto out;
1782 #endif
1783 }
1784
1785 int __init ndisc_late_init(void)
1786 {
1787         return register_netdevice_notifier(&ndisc_netdev_notifier);
1788 }
1789
1790 void ndisc_late_cleanup(void)
1791 {
1792         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1793 }
1794
1795 void ndisc_cleanup(void)
1796 {
1797 #ifdef CONFIG_SYSCTL
1798         neigh_sysctl_unregister(&nd_tbl.parms);
1799 #endif
1800         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1801         unregister_pernet_subsys(&ndisc_net_ops);
1802 }