ipv6/ndisc.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Neighbour Discovery for IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Mike Shaver             <shaver@ingenia.com>
   9  */
  10
  11 /*
  12  *      Changes:
  13  *
  14  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  15  *      Pierre Ynard                    :       export userland ND options
  16  *                                              through netlink (RDNSS support)
  17  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  18  *                                              of an RA.
  19  *      Janos Farkas                    :       kmalloc failure checks
  20  *      Alexey Kuznetsov                :       state machine reworked
  21  *                                              and moved to net/core.
  22  *      Pekka Savola                    :       RFC2461 validation
  23  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  24  */
  25
  26 #define pr_fmt(fmt) "ICMPv6: " fmt
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/sched.h>
  34 #include <linux/net.h>
  35 #include <linux/in6.h>
  36 #include <linux/route.h>
  37 #include <linux/init.h>
  38 #include <linux/rcupdate.h>
  39 #include <linux/slab.h>
  40 #ifdef CONFIG_SYSCTL
  41 #include <linux/sysctl.h>
  42 #endif
  43
  44 #include <linux/if_addr.h>
  45 #include <linux/if_ether.h>
  46 #include <linux/if_arp.h>
  47 #include <linux/ipv6.h>
  48 #include <linux/icmpv6.h>
  49 #include <linux/jhash.h>
  50
  51 #include <net/sock.h>
  52 #include <net/snmp.h>
  53
  54 #include <net/ipv6.h>
  55 #include <net/protocol.h>
  56 #include <net/ndisc.h>
  57 #include <net/ip6_route.h>
  58 #include <net/addrconf.h>
  59 #include <net/icmp.h>
  60
  61 #include <net/netlink.h>
  62 #include <linux/rtnetlink.h>
  63
  64 #include <net/flow.h>
  65 #include <net/ip6_checksum.h>
  66 #include <net/inet_common.h>
  67 #include <linux/proc_fs.h>
  68
  69 #include <linux/netfilter.h>
  70 #include <linux/netfilter_ipv6.h>
  71
  72 static u32 ndisc_hash(const void *pkey,
  73                       const struct net_device *dev,
  74                       __u32 *hash_rnd);
  75 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
  76 static bool ndisc_allow_add(const struct net_device *dev,
  77                             struct netlink_ext_ack *extack);
  78 static int ndisc_constructor(struct neighbour *neigh);
  79 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  80 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  81 static int pndisc_constructor(struct pneigh_entry *n);
  82 static void pndisc_destructor(struct pneigh_entry *n);
  83 static void pndisc_redo(struct sk_buff *skb);
  84 static int ndisc_is_multicast(const void *pkey);
  85
  86 static const struct neigh_ops ndisc_generic_ops = {
  87         .family =               AF_INET6,
  88         .solicit =              ndisc_solicit,
  89         .error_report =         ndisc_error_report,
  90         .output =               neigh_resolve_output,
  91         .connected_output =     neigh_connected_output,
  92 };
  93
  94 static const struct neigh_ops ndisc_hh_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_resolve_output,
 100 };
 101
 102
 103 static const struct neigh_ops ndisc_direct_ops = {
 104         .family =               AF_INET6,
 105         .output =               neigh_direct_output,
 106         .connected_output =     neigh_direct_output,
 107 };
 108
 109 struct neigh_table nd_tbl = {
 110         .family =       AF_INET6,
 111         .key_len =      sizeof(struct in6_addr),
 112         .protocol =     cpu_to_be16(ETH_P_IPV6),
 113         .hash =         ndisc_hash,
 114         .key_eq =       ndisc_key_eq,
 115         .constructor =  ndisc_constructor,
 116         .pconstructor = pndisc_constructor,
 117         .pdestructor =  pndisc_destructor,
 118         .proxy_redo =   pndisc_redo,
 119         .is_multicast = ndisc_is_multicast,
 120         .allow_add  =   ndisc_allow_add,
 121         .id =           "ndisc_cache",
 122         .parms = {
 123                 .tbl                    = &nd_tbl,
 124                 .reachable_time         = ND_REACHABLE_TIME,
 125                 .data = {
 126                         [NEIGH_VAR_MCAST_PROBES] = 3,
 127                         [NEIGH_VAR_UCAST_PROBES] = 3,
 128                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 129                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 130                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 131                         [NEIGH_VAR_INTERVAL_PROBE_TIME_MS] = 5 * HZ,
 132                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 133                         [NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
 134                         [NEIGH_VAR_PROXY_QLEN] = 64,
 135                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 136                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 137                 },
 138         },
 139         .gc_interval =    30 * HZ,
 140         .gc_thresh1 =    128,
 141         .gc_thresh2 =    512,
 142         .gc_thresh3 =   1024,
 143 };
 144 EXPORT_SYMBOL_GPL(nd_tbl);
 145
 146 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, const void *data,
 147                               int data_len, int pad)
 148 {
 149         int space = __ndisc_opt_addr_space(data_len, pad);
 150         u8 *opt = skb_put(skb, space);
 151
 152         opt[0] = type;
 153         opt[1] = space>>3;
 154
 155         memset(opt + 2, 0, pad);
 156         opt   += pad;
 157         space -= pad;
 158
 159         memcpy(opt+2, data, data_len);
 160         data_len += 2;
 161         opt += data_len;
 162         space -= data_len;
 163         if (space > 0)
 164                 memset(opt, 0, space);
 165 }
 166 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
 167
 168 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
 169                                           const void *data, u8 icmp6_type)
 170 {
 171         __ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
 172                                  ndisc_addr_option_pad(skb->dev->type));
 173         ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
 174 }
 175
 176 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
 177                                                    void *ha,
 178                                                    const u8 *ops_data)
 179 {
 180         ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
 181         ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
 182 }
 183
 184 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 185                                             struct nd_opt_hdr *end)
 186 {
 187         int type;
 188         if (!cur || !end || cur >= end)
 189                 return NULL;
 190         type = cur->nd_opt_type;
 191         do {
 192                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 193         } while (cur < end && cur->nd_opt_type != type);
 194         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 195 }
 196
 197 static inline int ndisc_is_useropt(const struct net_device *dev,
 198                                    struct nd_opt_hdr *opt)
 199 {
 200         return opt->nd_opt_type == ND_OPT_PREFIX_INFO ||
 201                 opt->nd_opt_type == ND_OPT_RDNSS ||
 202                 opt->nd_opt_type == ND_OPT_DNSSL ||
 203                 opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
 204                 opt->nd_opt_type == ND_OPT_PREF64 ||
 205                 ndisc_ops_is_useropt(dev, opt->nd_opt_type);
 206 }
 207
 208 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
 209                                              struct nd_opt_hdr *cur,
 210                                              struct nd_opt_hdr *end)
 211 {
 212         if (!cur || !end || cur >= end)
 213                 return NULL;
 214         do {
 215                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 216         } while (cur < end && !ndisc_is_useropt(dev, cur));
 217         return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
 218 }
 219
 220 struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 221                                           u8 *opt, int opt_len,
 222                                           struct ndisc_options *ndopts)
 223 {
 224         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 225
 226         if (!nd_opt || opt_len < 0 || !ndopts)
 227                 return NULL;
 228         memset(ndopts, 0, sizeof(*ndopts));
 229         while (opt_len) {
 230                 int l;
 231                 if (opt_len < sizeof(struct nd_opt_hdr))
 232                         return NULL;
 233                 l = nd_opt->nd_opt_len << 3;
 234                 if (opt_len < l || l == 0)
 235                         return NULL;
 236                 if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
 237                         goto next_opt;
 238                 switch (nd_opt->nd_opt_type) {
 239                 case ND_OPT_SOURCE_LL_ADDR:
 240                 case ND_OPT_TARGET_LL_ADDR:
 241                 case ND_OPT_MTU:
 242                 case ND_OPT_NONCE:
 243                 case ND_OPT_REDIRECT_HDR:
 244                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 245                                 ND_PRINTK(2, warn,
 246                                           "%s: duplicated ND6 option found: type=%d\n",
 247                                           __func__, nd_opt->nd_opt_type);
 248                         } else {
 249                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 250                         }
 251                         break;
 252                 case ND_OPT_PREFIX_INFO:
 253                         ndopts->nd_opts_pi_end = nd_opt;
 254                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 255                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 256                         break;
 257 #ifdef CONFIG_IPV6_ROUTE_INFO
 258                 case ND_OPT_ROUTE_INFO:
 259                         ndopts->nd_opts_ri_end = nd_opt;
 260                         if (!ndopts->nd_opts_ri)
 261                                 ndopts->nd_opts_ri = nd_opt;
 262                         break;
 263 #endif
 264                 default:
 265                         if (ndisc_is_useropt(dev, nd_opt)) {
 266                                 ndopts->nd_useropts_end = nd_opt;
 267                                 if (!ndopts->nd_useropts)
 268                                         ndopts->nd_useropts = nd_opt;
 269                         } else {
 270                                 /*
 271                                  * Unknown options must be silently ignored,
 272                                  * to accommodate future extension to the
 273                                  * protocol.
 274                                  */
 275                                 ND_PRINTK(2, notice,
 276                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 277                                           __func__,
 278                                           nd_opt->nd_opt_type,
 279                                           nd_opt->nd_opt_len);
 280                         }
 281                 }
 282 next_opt:
 283                 opt_len -= l;
 284                 nd_opt = ((void *)nd_opt) + l;
 285         }
 286         return ndopts;
 287 }
 288
 289 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 290 {
 291         switch (dev->type) {
 292         case ARPHRD_ETHER:
 293         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 294         case ARPHRD_FDDI:
 295                 ipv6_eth_mc_map(addr, buf);
 296                 return 0;
 297         case ARPHRD_ARCNET:
 298                 ipv6_arcnet_mc_map(addr, buf);
 299                 return 0;
 300         case ARPHRD_INFINIBAND:
 301                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 302                 return 0;
 303         case ARPHRD_IPGRE:
 304                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 305         default:
 306                 if (dir) {
 307                         memcpy(buf, dev->broadcast, dev->addr_len);
 308                         return 0;
 309                 }
 310         }
 311         return -EINVAL;
 312 }
 313 EXPORT_SYMBOL(ndisc_mc_map);
 314
 315 static u32 ndisc_hash(const void *pkey,
 316                       const struct net_device *dev,
 317                       __u32 *hash_rnd)
 318 {
 319         return ndisc_hashfn(pkey, dev, hash_rnd);
 320 }
 321
 322 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
 323 {
 324         return neigh_key_eq128(n, pkey);
 325 }
 326
 327 static int ndisc_constructor(struct neighbour *neigh)
 328 {
 329         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 330         struct net_device *dev = neigh->dev;
 331         struct inet6_dev *in6_dev;
 332         struct neigh_parms *parms;
 333         bool is_multicast = ipv6_addr_is_multicast(addr);
 334
 335         in6_dev = in6_dev_get(dev);
 336         if (!in6_dev) {
 337                 return -EINVAL;
 338         }
 339
 340         parms = in6_dev->nd_parms;
 341         __neigh_parms_put(neigh->parms);
 342         neigh->parms = neigh_parms_clone(parms);
 343
 344         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 345         if (!dev->header_ops) {
 346                 neigh->nud_state = NUD_NOARP;
 347                 neigh->ops = &ndisc_direct_ops;
 348                 neigh->output = neigh_direct_output;
 349         } else {
 350                 if (is_multicast) {
 351                         neigh->nud_state = NUD_NOARP;
 352                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 353                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 354                         neigh->nud_state = NUD_NOARP;
 355                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 356                         if (dev->flags&IFF_LOOPBACK)
 357                                 neigh->type = RTN_LOCAL;
 358                 } else if (dev->flags&IFF_POINTOPOINT) {
 359                         neigh->nud_state = NUD_NOARP;
 360                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 361                 }
 362                 if (dev->header_ops->cache)
 363                         neigh->ops = &ndisc_hh_ops;
 364                 else
 365                         neigh->ops = &ndisc_generic_ops;
 366                 if (neigh->nud_state&NUD_VALID)
 367                         neigh->output = neigh->ops->connected_output;
 368                 else
 369                         neigh->output = neigh->ops->output;
 370         }
 371         in6_dev_put(in6_dev);
 372         return 0;
 373 }
 374
 375 static int pndisc_constructor(struct pneigh_entry *n)
 376 {
 377         struct in6_addr *addr = (struct in6_addr *)&n->key;
 378         struct in6_addr maddr;
 379         struct net_device *dev = n->dev;
 380
 381         if (!dev || !__in6_dev_get(dev))
 382                 return -EINVAL;
 383         addrconf_addr_solict_mult(addr, &maddr);
 384         ipv6_dev_mc_inc(dev, &maddr);
 385         return 0;
 386 }
 387
 388 static void pndisc_destructor(struct pneigh_entry *n)
 389 {
 390         struct in6_addr *addr = (struct in6_addr *)&n->key;
 391         struct in6_addr maddr;
 392         struct net_device *dev = n->dev;
 393
 394         if (!dev || !__in6_dev_get(dev))
 395                 return;
 396         addrconf_addr_solict_mult(addr, &maddr);
 397         ipv6_dev_mc_dec(dev, &maddr);
 398 }
 399
 400 /* called with rtnl held */
 401 static bool ndisc_allow_add(const struct net_device *dev,
 402                             struct netlink_ext_ack *extack)
 403 {
 404         struct inet6_dev *idev = __in6_dev_get(dev);
 405
 406         if (!idev || idev->cnf.disable_ipv6) {
 407                 NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device");
 408                 return false;
 409         }
 410
 411         return true;
 412 }
 413
 414 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 415                                        int len)
 416 {
 417         int hlen = LL_RESERVED_SPACE(dev);
 418         int tlen = dev->needed_tailroom;
 419         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 420         struct sk_buff *skb;
 421
 422         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 423         if (!skb) {
 424                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 425                           __func__);
 426                 return NULL;
 427         }
 428
 429         skb->protocol = htons(ETH_P_IPV6);
 430         skb->dev = dev;
 431
 432         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 433         skb_reset_transport_header(skb);
 434
 435         /* Manually assign socket ownership as we avoid calling
 436          * sock_alloc_send_pskb() to bypass wmem buffer limits
 437          */
 438         skb_set_owner_w(skb, sk);
 439
 440         return skb;
 441 }
 442
 443 static void ip6_nd_hdr(struct sk_buff *skb,
 444                        const struct in6_addr *saddr,
 445                        const struct in6_addr *daddr,
 446                        int hop_limit, int len)
 447 {
 448         struct ipv6hdr *hdr;
 449         struct inet6_dev *idev;
 450         unsigned tclass;
 451
 452         rcu_read_lock();
 453         idev = __in6_dev_get(skb->dev);
 454         tclass = idev ? idev->cnf.ndisc_tclass : 0;
 455         rcu_read_unlock();
 456
 457         skb_push(skb, sizeof(*hdr));
 458         skb_reset_network_header(skb);
 459         hdr = ipv6_hdr(skb);
 460
 461         ip6_flow_hdr(hdr, tclass, 0);
 462
 463         hdr->payload_len = htons(len);
 464         hdr->nexthdr = IPPROTO_ICMPV6;
 465         hdr->hop_limit = hop_limit;
 466
 467         hdr->saddr = *saddr;
 468         hdr->daddr = *daddr;
 469 }
 470
 471 void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
 472                     const struct in6_addr *saddr)
 473 {
 474         struct dst_entry *dst = skb_dst(skb);
 475         struct net *net = dev_net(skb->dev);
 476         struct sock *sk = net->ipv6.ndisc_sk;
 477         struct inet6_dev *idev;
 478         int err;
 479         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 480         u8 type;
 481
 482         type = icmp6h->icmp6_type;
 483
 484         if (!dst) {
 485                 struct flowi6 fl6;
 486                 int oif = skb->dev->ifindex;
 487
 488                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 489                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 490                 if (IS_ERR(dst)) {
 491                         kfree_skb(skb);
 492                         return;
 493                 }
 494
 495                 skb_dst_set(skb, dst);
 496         }
 497
 498         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 499                                               IPPROTO_ICMPV6,
 500                                               csum_partial(icmp6h,
 501                                                            skb->len, 0));
 502
 503         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 504
 505         rcu_read_lock();
 506         idev = __in6_dev_get(dst->dev);
 507         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 508
 509         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
 510                       net, sk, skb, NULL, dst->dev,
 511                       dst_output);
 512         if (!err) {
 513                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 514                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 515         }
 516
 517         rcu_read_unlock();
 518 }
 519 EXPORT_SYMBOL(ndisc_send_skb);
 520
 521 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
 522                    const struct in6_addr *solicited_addr,
 523                    bool router, bool solicited, bool override, bool inc_opt)
 524 {
 525         struct sk_buff *skb;
 526         struct in6_addr tmpaddr;
 527         struct inet6_ifaddr *ifp;
 528         const struct in6_addr *src_addr;
 529         struct nd_msg *msg;
 530         int optlen = 0;
 531
 532         /* for anycast or proxy, solicited_addr != src_addr */
 533         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 534         if (ifp) {
 535                 src_addr = solicited_addr;
 536                 if (ifp->flags & IFA_F_OPTIMISTIC)
 537                         override = false;
 538                 inc_opt |= ifp->idev->cnf.force_tllao;
 539                 in6_ifa_put(ifp);
 540         } else {
 541                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 542                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 543                                        &tmpaddr))
 544                         return;
 545                 src_addr = &tmpaddr;
 546         }
 547
 548         if (!dev->addr_len)
 549                 inc_opt = false;
 550         if (inc_opt)
 551                 optlen += ndisc_opt_addr_space(dev,
 552                                                NDISC_NEIGHBOUR_ADVERTISEMENT);
 553
 554         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 555         if (!skb)
 556                 return;
 557
 558         msg = skb_put(skb, sizeof(*msg));
 559         *msg = (struct nd_msg) {
 560                 .icmph = {
 561                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 562                         .icmp6_router = router,
 563                         .icmp6_solicited = solicited,
 564                         .icmp6_override = override,
 565                 },
 566                 .target = *solicited_addr,
 567         };
 568
 569         if (inc_opt)
 570                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 571                                        dev->dev_addr,
 572                                        NDISC_NEIGHBOUR_ADVERTISEMENT);
 573
 574         ndisc_send_skb(skb, daddr, src_addr);
 575 }
 576
 577 static void ndisc_send_unsol_na(struct net_device *dev)
 578 {
 579         struct inet6_dev *idev;
 580         struct inet6_ifaddr *ifa;
 581
 582         idev = in6_dev_get(dev);
 583         if (!idev)
 584                 return;
 585
 586         read_lock_bh(&idev->lock);
 587         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 588                 /* skip tentative addresses until dad completes */
 589                 if (ifa->flags & IFA_F_TENTATIVE &&
 590                     !(ifa->flags & IFA_F_OPTIMISTIC))
 591                         continue;
 592
 593                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
 594                               /*router=*/ !!idev->cnf.forwarding,
 595                               /*solicited=*/ false, /*override=*/ true,
 596                               /*inc_opt=*/ true);
 597         }
 598         read_unlock_bh(&idev->lock);
 599
 600         in6_dev_put(idev);
 601 }
 602
 603 struct sk_buff *ndisc_ns_create(struct net_device *dev, const struct in6_addr *solicit,
 604                                 const struct in6_addr *saddr, u64 nonce)
 605 {
 606         int inc_opt = dev->addr_len;
 607         struct sk_buff *skb;
 608         struct nd_msg *msg;
 609         int optlen = 0;
 610
 611         if (!saddr)
 612                 return NULL;
 613
 614         if (ipv6_addr_any(saddr))
 615                 inc_opt = false;
 616         if (inc_opt)
 617                 optlen += ndisc_opt_addr_space(dev,
 618                                                NDISC_NEIGHBOUR_SOLICITATION);
 619         if (nonce != 0)
 620                 optlen += 8;
 621
 622         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 623         if (!skb)
 624                 return NULL;
 625
 626         msg = skb_put(skb, sizeof(*msg));
 627         *msg = (struct nd_msg) {
 628                 .icmph = {
 629                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 630                 },
 631                 .target = *solicit,
 632         };
 633
 634         if (inc_opt)
 635                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 636                                        dev->dev_addr,
 637                                        NDISC_NEIGHBOUR_SOLICITATION);
 638         if (nonce != 0) {
 639                 u8 *opt = skb_put(skb, 8);
 640
 641                 opt[0] = ND_OPT_NONCE;
 642                 opt[1] = 8 >> 3;
 643                 memcpy(opt + 2, &nonce, 6);
 644         }
 645
 646         return skb;
 647 }
 648 EXPORT_SYMBOL(ndisc_ns_create);
 649
 650 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
 651                    const struct in6_addr *daddr, const struct in6_addr *saddr,
 652                    u64 nonce)
 653 {
 654         struct in6_addr addr_buf;
 655         struct sk_buff *skb;
 656
 657         if (!saddr) {
 658                 if (ipv6_get_lladdr(dev, &addr_buf,
 659                                     (IFA_F_TENTATIVE | IFA_F_OPTIMISTIC)))
 660                         return;
 661                 saddr = &addr_buf;
 662         }
 663
 664         skb = ndisc_ns_create(dev, solicit, saddr, nonce);
 665
 666         if (skb)
 667                 ndisc_send_skb(skb, daddr, saddr);
 668 }
 669
 670 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 671                    const struct in6_addr *daddr)
 672 {
 673         struct sk_buff *skb;
 674         struct rs_msg *msg;
 675         int send_sllao = dev->addr_len;
 676         int optlen = 0;
 677
 678 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 679         /*
 680          * According to section 2.2 of RFC 4429, we must not
 681          * send router solicitations with a sllao from
 682          * optimistic addresses, but we may send the solicitation
 683          * if we don't include the sllao.  So here we check
 684          * if our address is optimistic, and if so, we
 685          * suppress the inclusion of the sllao.
 686          */
 687         if (send_sllao) {
 688                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 689                                                            dev, 1);
 690                 if (ifp) {
 691                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 692                                 send_sllao = 0;
 693                         }
 694                         in6_ifa_put(ifp);
 695                 } else {
 696                         send_sllao = 0;
 697                 }
 698         }
 699 #endif
 700         if (send_sllao)
 701                 optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
 702
 703         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 704         if (!skb)
 705                 return;
 706
 707         msg = skb_put(skb, sizeof(*msg));
 708         *msg = (struct rs_msg) {
 709                 .icmph = {
 710                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 711                 },
 712         };
 713
 714         if (send_sllao)
 715                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 716                                        dev->dev_addr,
 717                                        NDISC_ROUTER_SOLICITATION);
 718
 719         ndisc_send_skb(skb, daddr, saddr);
 720 }
 721
 722
 723 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 724 {
 725         /*
 726          *      "The sender MUST return an ICMP
 727          *       destination unreachable"
 728          */
 729         dst_link_failure(skb);
 730         kfree_skb(skb);
 731 }
 732
 733 /* Called with locked neigh: either read or both */
 734
 735 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 736 {
 737         struct in6_addr *saddr = NULL;
 738         struct in6_addr mcaddr;
 739         struct net_device *dev = neigh->dev;
 740         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 741         int probes = atomic_read(&neigh->probes);
 742
 743         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 744                                            dev, false, 1,
 745                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 746                 saddr = &ipv6_hdr(skb)->saddr;
 747         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 748         if (probes < 0) {
 749                 if (!(READ_ONCE(neigh->nud_state) & NUD_VALID)) {
 750                         ND_PRINTK(1, dbg,
 751                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 752                                   __func__, target);
 753                 }
 754                 ndisc_send_ns(dev, target, target, saddr, 0);
 755         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 756                 neigh_app_ns(neigh);
 757         } else {
 758                 addrconf_addr_solict_mult(target, &mcaddr);
 759                 ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
 760         }
 761 }
 762
 763 static int pndisc_is_router(const void *pkey,
 764                             struct net_device *dev)
 765 {
 766         struct pneigh_entry *n;
 767         int ret = -1;
 768
 769         read_lock_bh(&nd_tbl.lock);
 770         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 771         if (n)
 772                 ret = !!(n->flags & NTF_ROUTER);
 773         read_unlock_bh(&nd_tbl.lock);
 774
 775         return ret;
 776 }
 777
 778 void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
 779                   const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
 780                   struct ndisc_options *ndopts)
 781 {
 782         neigh_update(neigh, lladdr, new, flags, 0);
 783         /* report ndisc ops about neighbour update */
 784         ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
 785 }
 786
 787 static void ndisc_recv_ns(struct sk_buff *skb)
 788 {
 789         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 790         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 791         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 792         u8 *lladdr = NULL;
 793         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 794                                     offsetof(struct nd_msg, opt));
 795         struct ndisc_options ndopts;
 796         struct net_device *dev = skb->dev;
 797         struct inet6_ifaddr *ifp;
 798         struct inet6_dev *idev = NULL;
 799         struct neighbour *neigh;
 800         int dad = ipv6_addr_any(saddr);
 801         bool inc;
 802         int is_router = -1;
 803         u64 nonce = 0;
 804
 805         if (skb->len < sizeof(struct nd_msg)) {
 806                 ND_PRINTK(2, warn, "NS: packet too short\n");
 807                 return;
 808         }
 809
 810         if (ipv6_addr_is_multicast(&msg->target)) {
 811                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 812                 return;
 813         }
 814
 815         /*
 816          * RFC2461 7.1.1:
 817          * DAD has to be destined for solicited node multicast address.
 818          */
 819         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 820                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 821                 return;
 822         }
 823
 824         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 825                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 826                 return;
 827         }
 828
 829         if (ndopts.nd_opts_src_lladdr) {
 830                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 831                 if (!lladdr) {
 832                         ND_PRINTK(2, warn,
 833                                   "NS: invalid link-layer address length\n");
 834                         return;
 835                 }
 836
 837                 /* RFC2461 7.1.1:
 838                  *      If the IP source address is the unspecified address,
 839                  *      there MUST NOT be source link-layer address option
 840                  *      in the message.
 841                  */
 842                 if (dad) {
 843                         ND_PRINTK(2, warn,
 844                                   "NS: bad DAD packet (link-layer address option)\n");
 845                         return;
 846                 }
 847         }
 848         if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
 849                 memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
 850
 851         inc = ipv6_addr_is_multicast(daddr);
 852
 853         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 854         if (ifp) {
 855 have_ifp:
 856                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 857                         if (dad) {
 858                                 if (nonce != 0 && ifp->dad_nonce == nonce) {
 859                                         u8 *np = (u8 *)&nonce;
 860                                         /* Matching nonce if looped back */
 861                                         ND_PRINTK(2, notice,
 862                                                   "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
 863                                                   ifp->idev->dev->name,
 864                                                   &ifp->addr, np);
 865                                         goto out;
 866                                 }
 867                                 /*
 868                                  * We are colliding with another node
 869                                  * who is doing DAD
 870                                  * so fail our DAD process
 871                                  */
 872                                 addrconf_dad_failure(skb, ifp);
 873                                 return;
 874                         } else {
 875                                 /*
 876                                  * This is not a dad solicitation.
 877                                  * If we are an optimistic node,
 878                                  * we should respond.
 879                                  * Otherwise, we should ignore it.
 880                                  */
 881                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 882                                         goto out;
 883                         }
 884                 }
 885
 886                 idev = ifp->idev;
 887         } else {
 888                 struct net *net = dev_net(dev);
 889
 890                 /* perhaps an address on the master device */
 891                 if (netif_is_l3_slave(dev)) {
 892                         struct net_device *mdev;
 893
 894                         mdev = netdev_master_upper_dev_get_rcu(dev);
 895                         if (mdev) {
 896                                 ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
 897                                 if (ifp)
 898                                         goto have_ifp;
 899                         }
 900                 }
 901
 902                 idev = in6_dev_get(dev);
 903                 if (!idev) {
 904                         /* XXX: count this drop? */
 905                         return;
 906                 }
 907
 908                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 909                     (idev->cnf.forwarding &&
 910                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 911                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 912                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 913                             skb->pkt_type != PACKET_HOST &&
 914                             inc &&
 915                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 916                                 /*
 917                                  * for anycast or proxy,
 918                                  * sender should delay its response
 919                                  * by a random time between 0 and
 920                                  * MAX_ANYCAST_DELAY_TIME seconds.
 921                                  * (RFC2461) -- yoshfuji
 922                                  */
 923                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 924                                 if (n)
 925                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 926                                 goto out;
 927                         }
 928                 } else
 929                         goto out;
 930         }
 931
 932         if (is_router < 0)
 933                 is_router = idev->cnf.forwarding;
 934
 935         if (dad) {
 936                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
 937                               !!is_router, false, (ifp != NULL), true);
 938                 goto out;
 939         }
 940
 941         if (inc)
 942                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 943         else
 944                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 945
 946         /*
 947          *      update / create cache entry
 948          *      for the source address
 949          */
 950         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 951                                !inc || lladdr || !dev->addr_len);
 952         if (neigh)
 953                 ndisc_update(dev, neigh, lladdr, NUD_STALE,
 954                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 955                              NEIGH_UPDATE_F_OVERRIDE,
 956                              NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
 957         if (neigh || !dev->header_ops) {
 958                 ndisc_send_na(dev, saddr, &msg->target, !!is_router,
 959                               true, (ifp != NULL && inc), inc);
 960                 if (neigh)
 961                         neigh_release(neigh);
 962         }
 963
 964 out:
 965         if (ifp)
 966                 in6_ifa_put(ifp);
 967         else
 968                 in6_dev_put(idev);
 969 }
 970
 971 static int accept_untracked_na(struct net_device *dev, struct in6_addr *saddr)
 972 {
 973         struct inet6_dev *idev = __in6_dev_get(dev);
 974
 975         switch (idev->cnf.accept_untracked_na) {
 976         case 0: /* Don't accept untracked na (absent in neighbor cache) */
 977                 return 0;
 978         case 1: /* Create new entries from na if currently untracked */
 979                 return 1;
 980         case 2: /* Create new entries from untracked na only if saddr is in the
 981                  * same subnet as an address configured on the interface that
 982                  * received the na
 983                  */
 984                 return !!ipv6_chk_prefix(saddr, dev);
 985         default:
 986                 return 0;
 987         }
 988 }
 989
 990 static void ndisc_recv_na(struct sk_buff *skb)
 991 {
 992         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 993         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 994         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 995         u8 *lladdr = NULL;
 996         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 997                                     offsetof(struct nd_msg, opt));
 998         struct ndisc_options ndopts;
 999         struct net_device *dev = skb->dev;
1000         struct inet6_dev *idev = __in6_dev_get(dev);
1001         struct inet6_ifaddr *ifp;
1002         struct neighbour *neigh;
1003         u8 new_state;
1004
1005         if (skb->len < sizeof(struct nd_msg)) {
1006                 ND_PRINTK(2, warn, "NA: packet too short\n");
1007                 return;
1008         }
1009
1010         if (ipv6_addr_is_multicast(&msg->target)) {
1011                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
1012                 return;
1013         }
1014
1015         if (ipv6_addr_is_multicast(daddr) &&
1016             msg->icmph.icmp6_solicited) {
1017                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
1018                 return;
1019         }
1020
1021         /* For some 802.11 wireless deployments (and possibly other networks),
1022          * there will be a NA proxy and unsolicitd packets are attacks
1023          * and thus should not be accepted.
1024          * drop_unsolicited_na takes precedence over accept_untracked_na
1025          */
1026         if (!msg->icmph.icmp6_solicited && idev &&
1027             idev->cnf.drop_unsolicited_na)
1028                 return;
1029
1030         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
1031                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
1032                 return;
1033         }
1034         if (ndopts.nd_opts_tgt_lladdr) {
1035                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
1036                 if (!lladdr) {
1037                         ND_PRINTK(2, warn,
1038                                   "NA: invalid link-layer address length\n");
1039                         return;
1040                 }
1041         }
1042         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
1043         if (ifp) {
1044                 if (skb->pkt_type != PACKET_LOOPBACK
1045                     && (ifp->flags & IFA_F_TENTATIVE)) {
1046                                 addrconf_dad_failure(skb, ifp);
1047                                 return;
1048                 }
1049                 /* What should we make now? The advertisement
1050                    is invalid, but ndisc specs say nothing
1051                    about it. It could be misconfiguration, or
1052                    an smart proxy agent tries to help us :-)
1053
1054                    We should not print the error if NA has been
1055                    received from loopback - it is just our own
1056                    unsolicited advertisement.
1057                  */
1058                 if (skb->pkt_type != PACKET_LOOPBACK)
1059                         ND_PRINTK(1, warn,
1060                                   "NA: %pM advertised our address %pI6c on %s!\n",
1061                                   eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1062                 in6_ifa_put(ifp);
1063                 return;
1064         }
1065
1066         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1067
1068         /* RFC 9131 updates original Neighbour Discovery RFC 4861.
1069          * NAs with Target LL Address option without a corresponding
1070          * entry in the neighbour cache can now create a STALE neighbour
1071          * cache entry on routers.
1072          *
1073          *   entry accept  fwding  solicited        behaviour
1074          * ------- ------  ------  ---------    ----------------------
1075          * present      X       X         0     Set state to STALE
1076          * present      X       X         1     Set state to REACHABLE
1077          *  absent      0       X         X     Do nothing
1078          *  absent      1       0         X     Do nothing
1079          *  absent      1       1         X     Add a new STALE entry
1080          *
1081          * Note that we don't do a (daddr == all-routers-mcast) check.
1082          */
1083         new_state = msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE;
1084         if (!neigh && lladdr && idev && idev->cnf.forwarding) {
1085                 if (accept_untracked_na(dev, saddr)) {
1086                         neigh = neigh_create(&nd_tbl, &msg->target, dev);
1087                         new_state = NUD_STALE;
1088                 }
1089         }
1090
1091         if (neigh && !IS_ERR(neigh)) {
1092                 u8 old_flags = neigh->flags;
1093                 struct net *net = dev_net(dev);
1094
1095                 if (READ_ONCE(neigh->nud_state) & NUD_FAILED)
1096                         goto out;
1097
1098                 /*
1099                  * Don't update the neighbor cache entry on a proxy NA from
1100                  * ourselves because either the proxied node is off link or it
1101                  * has already sent a NA to us.
1102                  */
1103                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1104                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1105                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1106                         /* XXX: idev->cnf.proxy_ndp */
1107                         goto out;
1108                 }
1109
1110                 ndisc_update(dev, neigh, lladdr,
1111                              new_state,
1112                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1113                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1114                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1115                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1116                              NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1117
1118                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1119                         /*
1120                          * Change: router to host
1121                          */
1122                         rt6_clean_tohost(dev_net(dev),  saddr);
1123                 }
1124
1125 out:
1126                 neigh_release(neigh);
1127         }
1128 }
1129
1130 static void ndisc_recv_rs(struct sk_buff *skb)
1131 {
1132         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1133         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1134         struct neighbour *neigh;
1135         struct inet6_dev *idev;
1136         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1137         struct ndisc_options ndopts;
1138         u8 *lladdr = NULL;
1139
1140         if (skb->len < sizeof(*rs_msg))
1141                 return;
1142
1143         idev = __in6_dev_get(skb->dev);
1144         if (!idev) {
1145                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
1146                 return;
1147         }
1148
1149         /* Don't accept RS if we're not in router mode */
1150         if (!idev->cnf.forwarding)
1151                 goto out;
1152
1153         /*
1154          * Don't update NCE if src = ::;
1155          * this implies that the source node has no ip address assigned yet.
1156          */
1157         if (ipv6_addr_any(saddr))
1158                 goto out;
1159
1160         /* Parse ND options */
1161         if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts)) {
1162                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
1163                 goto out;
1164         }
1165
1166         if (ndopts.nd_opts_src_lladdr) {
1167                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1168                                              skb->dev);
1169                 if (!lladdr)
1170                         goto out;
1171         }
1172
1173         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1174         if (neigh) {
1175                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1176                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1177                              NEIGH_UPDATE_F_OVERRIDE|
1178                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1179                              NDISC_ROUTER_SOLICITATION, &ndopts);
1180                 neigh_release(neigh);
1181         }
1182 out:
1183         return;
1184 }
1185
1186 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1187 {
1188         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1189         struct sk_buff *skb;
1190         struct nlmsghdr *nlh;
1191         struct nduseroptmsg *ndmsg;
1192         struct net *net = dev_net(ra->dev);
1193         int err;
1194         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1195                                     + (opt->nd_opt_len << 3));
1196         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1197
1198         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1199         if (!skb) {
1200                 err = -ENOBUFS;
1201                 goto errout;
1202         }
1203
1204         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1205         if (!nlh) {
1206                 goto nla_put_failure;
1207         }
1208
1209         ndmsg = nlmsg_data(nlh);
1210         ndmsg->nduseropt_family = AF_INET6;
1211         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1212         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1213         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1214         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1215
1216         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1217
1218         if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1219                 goto nla_put_failure;
1220         nlmsg_end(skb, nlh);
1221
1222         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1223         return;
1224
1225 nla_put_failure:
1226         nlmsg_free(skb);
1227         err = -EMSGSIZE;
1228 errout:
1229         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1230 }
1231
1232 static void ndisc_router_discovery(struct sk_buff *skb)
1233 {
1234         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1235         struct neighbour *neigh = NULL;
1236         struct inet6_dev *in6_dev;
1237         struct fib6_info *rt = NULL;
1238         u32 defrtr_usr_metric;
1239         struct net *net;
1240         int lifetime;
1241         struct ndisc_options ndopts;
1242         int optlen;
1243         unsigned int pref = 0;
1244         __u32 old_if_flags;
1245         bool send_ifinfo_notify = false;
1246
1247         __u8 *opt = (__u8 *)(ra_msg + 1);
1248
1249         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1250                 sizeof(struct ra_msg);
1251
1252         ND_PRINTK(2, info,
1253                   "RA: %s, dev: %s\n",
1254                   __func__, skb->dev->name);
1255         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1256                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1257                 return;
1258         }
1259         if (optlen < 0) {
1260                 ND_PRINTK(2, warn, "RA: packet too short\n");
1261                 return;
1262         }
1263
1264 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1265         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1266                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1267                 return;
1268         }
1269 #endif
1270
1271         /*
1272          *      set the RA_RECV flag in the interface
1273          */
1274
1275         in6_dev = __in6_dev_get(skb->dev);
1276         if (!in6_dev) {
1277                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1278                           skb->dev->name);
1279                 return;
1280         }
1281
1282         if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts)) {
1283                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1284                 return;
1285         }
1286
1287         if (!ipv6_accept_ra(in6_dev)) {
1288                 ND_PRINTK(2, info,
1289                           "RA: %s, did not accept ra for dev: %s\n",
1290                           __func__, skb->dev->name);
1291                 goto skip_linkparms;
1292         }
1293
1294 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1295         /* skip link-specific parameters from interior routers */
1296         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1297                 ND_PRINTK(2, info,
1298                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1299                           __func__, skb->dev->name);
1300                 goto skip_linkparms;
1301         }
1302 #endif
1303
1304         if (in6_dev->if_flags & IF_RS_SENT) {
1305                 /*
1306                  *      flag that an RA was received after an RS was sent
1307                  *      out on this interface.
1308                  */
1309                 in6_dev->if_flags |= IF_RA_RCVD;
1310         }
1311
1312         /*
1313          * Remember the managed/otherconf flags from most recently
1314          * received RA message (RFC 2462) -- yoshfuji
1315          */
1316         old_if_flags = in6_dev->if_flags;
1317         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1318                                 IF_RA_OTHERCONF)) |
1319                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1320                                         IF_RA_MANAGED : 0) |
1321                                 (ra_msg->icmph.icmp6_addrconf_other ?
1322                                         IF_RA_OTHERCONF : 0);
1323
1324         if (old_if_flags != in6_dev->if_flags)
1325                 send_ifinfo_notify = true;
1326
1327         if (!in6_dev->cnf.accept_ra_defrtr) {
1328                 ND_PRINTK(2, info,
1329                           "RA: %s, defrtr is false for dev: %s\n",
1330                           __func__, skb->dev->name);
1331                 goto skip_defrtr;
1332         }
1333
1334         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1335         if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_lft) {
1336                 ND_PRINTK(2, info,
1337                           "RA: router lifetime (%ds) is too short: %s\n",
1338                           lifetime, skb->dev->name);
1339                 goto skip_defrtr;
1340         }
1341
1342         /* Do not accept RA with source-addr found on local machine unless
1343          * accept_ra_from_local is set to true.
1344          */
1345         net = dev_net(in6_dev->dev);
1346         if (!in6_dev->cnf.accept_ra_from_local &&
1347             ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) {
1348                 ND_PRINTK(2, info,
1349                           "RA from local address detected on dev: %s: default router ignored\n",
1350                           skb->dev->name);
1351                 goto skip_defrtr;
1352         }
1353
1354 #ifdef CONFIG_IPV6_ROUTER_PREF
1355         pref = ra_msg->icmph.icmp6_router_pref;
1356         /* 10b is handled as if it were 00b (medium) */
1357         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1358             !in6_dev->cnf.accept_ra_rtr_pref)
1359                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1360 #endif
1361         /* routes added from RAs do not use nexthop objects */
1362         rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev);
1363         if (rt) {
1364                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1365                                          rt->fib6_nh->fib_nh_dev, NULL,
1366                                           &ipv6_hdr(skb)->saddr);
1367                 if (!neigh) {
1368                         ND_PRINTK(0, err,
1369                                   "RA: %s got default router without neighbour\n",
1370                                   __func__);
1371                         fib6_info_release(rt);
1372                         return;
1373                 }
1374         }
1375         /* Set default route metric as specified by user */
1376         defrtr_usr_metric = in6_dev->cnf.ra_defrtr_metric;
1377         /* delete the route if lifetime is 0 or if metric needs change */
1378         if (rt && (lifetime == 0 || rt->fib6_metric != defrtr_usr_metric)) {
1379                 ip6_del_rt(net, rt, false);
1380                 rt = NULL;
1381         }
1382
1383         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, metric: %d, for dev: %s\n",
1384                   rt, lifetime, defrtr_usr_metric, skb->dev->name);
1385         if (!rt && lifetime) {
1386                 ND_PRINTK(3, info, "RA: adding default router\n");
1387
1388                 if (neigh)
1389                         neigh_release(neigh);
1390
1391                 rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
1392                                          skb->dev, pref, defrtr_usr_metric);
1393                 if (!rt) {
1394                         ND_PRINTK(0, err,
1395                                   "RA: %s failed to add default route\n",
1396                                   __func__);
1397                         return;
1398                 }
1399
1400                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1401                                          rt->fib6_nh->fib_nh_dev, NULL,
1402                                           &ipv6_hdr(skb)->saddr);
1403                 if (!neigh) {
1404                         ND_PRINTK(0, err,
1405                                   "RA: %s got default router without neighbour\n",
1406                                   __func__);
1407                         fib6_info_release(rt);
1408                         return;
1409                 }
1410                 neigh->flags |= NTF_ROUTER;
1411         } else if (rt && IPV6_EXTRACT_PREF(rt->fib6_flags) != pref) {
1412                 struct nl_info nlinfo = {
1413                         .nl_net = net,
1414                 };
1415                 rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1416                 inet6_rt_notify(RTM_NEWROUTE, rt, &nlinfo, NLM_F_REPLACE);
1417         }
1418
1419         if (rt)
1420                 fib6_set_expires(rt, jiffies + (HZ * lifetime));
1421         if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1422             ra_msg->icmph.icmp6_hop_limit) {
1423                 if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1424                         in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1425                         fib6_metric_set(rt, RTAX_HOPLIMIT,
1426                                         ra_msg->icmph.icmp6_hop_limit);
1427                 } else {
1428                         ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1429                 }
1430         }
1431
1432 skip_defrtr:
1433
1434         /*
1435          *      Update Reachable Time and Retrans Timer
1436          */
1437
1438         if (in6_dev->nd_parms) {
1439                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1440
1441                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1442                         rtime = (rtime*HZ)/1000;
1443                         if (rtime < HZ/100)
1444                                 rtime = HZ/100;
1445                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1446                         in6_dev->tstamp = jiffies;
1447                         send_ifinfo_notify = true;
1448                 }
1449
1450                 rtime = ntohl(ra_msg->reachable_time);
1451                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1452                         rtime = (rtime*HZ)/1000;
1453
1454                         if (rtime < HZ/10)
1455                                 rtime = HZ/10;
1456
1457                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1458                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1459                                               BASE_REACHABLE_TIME, rtime);
1460                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1461                                               GC_STALETIME, 3 * rtime);
1462                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1463                                 in6_dev->tstamp = jiffies;
1464                                 send_ifinfo_notify = true;
1465                         }
1466                 }
1467         }
1468
1469 skip_linkparms:
1470
1471         /*
1472          *      Process options.
1473          */
1474
1475         if (!neigh)
1476                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1477                                        skb->dev, 1);
1478         if (neigh) {
1479                 u8 *lladdr = NULL;
1480                 if (ndopts.nd_opts_src_lladdr) {
1481                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1482                                                      skb->dev);
1483                         if (!lladdr) {
1484                                 ND_PRINTK(2, warn,
1485                                           "RA: invalid link-layer address length\n");
1486                                 goto out;
1487                         }
1488                 }
1489                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1490                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1491                              NEIGH_UPDATE_F_OVERRIDE|
1492                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1493                              NEIGH_UPDATE_F_ISROUTER,
1494                              NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1495         }
1496
1497         if (!ipv6_accept_ra(in6_dev)) {
1498                 ND_PRINTK(2, info,
1499                           "RA: %s, accept_ra is false for dev: %s\n",
1500                           __func__, skb->dev->name);
1501                 goto out;
1502         }
1503
1504 #ifdef CONFIG_IPV6_ROUTE_INFO
1505         if (!in6_dev->cnf.accept_ra_from_local &&
1506             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1507                           in6_dev->dev, 0)) {
1508                 ND_PRINTK(2, info,
1509                           "RA from local address detected on dev: %s: router info ignored.\n",
1510                           skb->dev->name);
1511                 goto skip_routeinfo;
1512         }
1513
1514         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1515                 struct nd_opt_hdr *p;
1516                 for (p = ndopts.nd_opts_ri;
1517                      p;
1518                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1519                         struct route_info *ri = (struct route_info *)p;
1520 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1521                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1522                             ri->prefix_len == 0)
1523                                 continue;
1524 #endif
1525                         if (ri->prefix_len == 0 &&
1526                             !in6_dev->cnf.accept_ra_defrtr)
1527                                 continue;
1528                         if (ri->lifetime != 0 &&
1529                             ntohl(ri->lifetime) < in6_dev->cnf.accept_ra_min_lft)
1530                                 continue;
1531                         if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1532                                 continue;
1533                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1534                                 continue;
1535                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1536                                       &ipv6_hdr(skb)->saddr);
1537                 }
1538         }
1539
1540 skip_routeinfo:
1541 #endif
1542
1543 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1544         /* skip link-specific ndopts from interior routers */
1545         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1546                 ND_PRINTK(2, info,
1547                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1548                           __func__, skb->dev->name);
1549                 goto out;
1550         }
1551 #endif
1552
1553         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1554                 struct nd_opt_hdr *p;
1555                 for (p = ndopts.nd_opts_pi;
1556                      p;
1557                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1558                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1559                                             (p->nd_opt_len) << 3,
1560                                             ndopts.nd_opts_src_lladdr != NULL);
1561                 }
1562         }
1563
1564         if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1565                 __be32 n;
1566                 u32 mtu;
1567
1568                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1569                 mtu = ntohl(n);
1570
1571                 if (in6_dev->ra_mtu != mtu) {
1572                         in6_dev->ra_mtu = mtu;
1573                         send_ifinfo_notify = true;
1574                 }
1575
1576                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1577                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1578                 } else if (in6_dev->cnf.mtu6 != mtu) {
1579                         in6_dev->cnf.mtu6 = mtu;
1580                         fib6_metric_set(rt, RTAX_MTU, mtu);
1581                         rt6_mtu_change(skb->dev, mtu);
1582                 }
1583         }
1584
1585         if (ndopts.nd_useropts) {
1586                 struct nd_opt_hdr *p;
1587                 for (p = ndopts.nd_useropts;
1588                      p;
1589                      p = ndisc_next_useropt(skb->dev, p,
1590                                             ndopts.nd_useropts_end)) {
1591                         ndisc_ra_useropt(skb, p);
1592                 }
1593         }
1594
1595         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1596                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1597         }
1598 out:
1599         /* Send a notify if RA changed managed/otherconf flags or
1600          * timer settings or ra_mtu value
1601          */
1602         if (send_ifinfo_notify)
1603                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1604
1605         fib6_info_release(rt);
1606         if (neigh)
1607                 neigh_release(neigh);
1608 }
1609
1610 static void ndisc_redirect_rcv(struct sk_buff *skb)
1611 {
1612         u8 *hdr;
1613         struct ndisc_options ndopts;
1614         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1615         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1616                                     offsetof(struct rd_msg, opt));
1617
1618 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1619         switch (skb->ndisc_nodetype) {
1620         case NDISC_NODETYPE_HOST:
1621         case NDISC_NODETYPE_NODEFAULT:
1622                 ND_PRINTK(2, warn,
1623                           "Redirect: from host or unauthorized router\n");
1624                 return;
1625         }
1626 #endif
1627
1628         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1629                 ND_PRINTK(2, warn,
1630                           "Redirect: source address is not link-local\n");
1631                 return;
1632         }
1633
1634         if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1635                 return;
1636
1637         if (!ndopts.nd_opts_rh) {
1638                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1639                                         skb->dev->ifindex);
1640                 return;
1641         }
1642
1643         hdr = (u8 *)ndopts.nd_opts_rh;
1644         hdr += 8;
1645         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1646                 return;
1647
1648         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1649 }
1650
1651 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1652                                            struct sk_buff *orig_skb,
1653                                            int rd_len)
1654 {
1655         u8 *opt = skb_put(skb, rd_len);
1656
1657         memset(opt, 0, 8);
1658         *(opt++) = ND_OPT_REDIRECT_HDR;
1659         *(opt++) = (rd_len >> 3);
1660         opt += 6;
1661
1662         skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1663                       rd_len - 8);
1664 }
1665
1666 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1667 {
1668         struct net_device *dev = skb->dev;
1669         struct net *net = dev_net(dev);
1670         struct sock *sk = net->ipv6.ndisc_sk;
1671         int optlen = 0;
1672         struct inet_peer *peer;
1673         struct sk_buff *buff;
1674         struct rd_msg *msg;
1675         struct in6_addr saddr_buf;
1676         struct rt6_info *rt;
1677         struct dst_entry *dst;
1678         struct flowi6 fl6;
1679         int rd_len;
1680         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1681            ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1682         bool ret;
1683
1684         if (netif_is_l3_master(skb->dev)) {
1685                 dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
1686                 if (!dev)
1687                         return;
1688         }
1689
1690         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1691                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1692                           dev->name);
1693                 return;
1694         }
1695
1696         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1697             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1698                 ND_PRINTK(2, warn,
1699                           "Redirect: target address is not link-local unicast\n");
1700                 return;
1701         }
1702
1703         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1704                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1705
1706         dst = ip6_route_output(net, NULL, &fl6);
1707         if (dst->error) {
1708                 dst_release(dst);
1709                 return;
1710         }
1711         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1712         if (IS_ERR(dst))
1713                 return;
1714
1715         rt = (struct rt6_info *) dst;
1716
1717         if (rt->rt6i_flags & RTF_GATEWAY) {
1718                 ND_PRINTK(2, warn,
1719                           "Redirect: destination is not a neighbour\n");
1720                 goto release;
1721         }
1722         peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1723         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1724         if (peer)
1725                 inet_putpeer(peer);
1726         if (!ret)
1727                 goto release;
1728
1729         if (dev->addr_len) {
1730                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1731                 if (!neigh) {
1732                         ND_PRINTK(2, warn,
1733                                   "Redirect: no neigh for target address\n");
1734                         goto release;
1735                 }
1736
1737                 read_lock_bh(&neigh->lock);
1738                 if (neigh->nud_state & NUD_VALID) {
1739                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1740                         read_unlock_bh(&neigh->lock);
1741                         ha = ha_buf;
1742                         optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1743                                                                 ops_data_buf,
1744                                                                 &ops_data);
1745                 } else
1746                         read_unlock_bh(&neigh->lock);
1747
1748                 neigh_release(neigh);
1749         }
1750
1751         rd_len = min_t(unsigned int,
1752                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1753                        skb->len + 8);
1754         rd_len &= ~0x7;
1755         optlen += rd_len;
1756
1757         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1758         if (!buff)
1759                 goto release;
1760
1761         msg = skb_put(buff, sizeof(*msg));
1762         *msg = (struct rd_msg) {
1763                 .icmph = {
1764                         .icmp6_type = NDISC_REDIRECT,
1765                 },
1766                 .target = *target,
1767                 .dest = ipv6_hdr(skb)->daddr,
1768         };
1769
1770         /*
1771          *      include target_address option
1772          */
1773
1774         if (ha)
1775                 ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1776
1777         /*
1778          *      build redirect option and copy skb over to the new packet.
1779          */
1780
1781         if (rd_len)
1782                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1783
1784         skb_dst_set(buff, dst);
1785         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1786         return;
1787
1788 release:
1789         dst_release(dst);
1790 }
1791
1792 static void pndisc_redo(struct sk_buff *skb)
1793 {
1794         ndisc_recv_ns(skb);
1795         kfree_skb(skb);
1796 }
1797
1798 static int ndisc_is_multicast(const void *pkey)
1799 {
1800         return ipv6_addr_is_multicast((struct in6_addr *)pkey);
1801 }
1802
1803 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1804 {
1805         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1806
1807         if (!idev)
1808                 return true;
1809         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1810             idev->cnf.suppress_frag_ndisc) {
1811                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1812                 return true;
1813         }
1814         return false;
1815 }
1816
1817 int ndisc_rcv(struct sk_buff *skb)
1818 {
1819         struct nd_msg *msg;
1820
1821         if (ndisc_suppress_frag_ndisc(skb))
1822                 return 0;
1823
1824         if (skb_linearize(skb))
1825                 return 0;
1826
1827         msg = (struct nd_msg *)skb_transport_header(skb);
1828
1829         __skb_push(skb, skb->data - skb_transport_header(skb));
1830
1831         if (ipv6_hdr(skb)->hop_limit != 255) {
1832                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1833                           ipv6_hdr(skb)->hop_limit);
1834                 return 0;
1835         }
1836
1837         if (msg->icmph.icmp6_code != 0) {
1838                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1839                           msg->icmph.icmp6_code);
1840                 return 0;
1841         }
1842
1843         switch (msg->icmph.icmp6_type) {
1844         case NDISC_NEIGHBOUR_SOLICITATION:
1845                 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1846                 ndisc_recv_ns(skb);
1847                 break;
1848
1849         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1850                 ndisc_recv_na(skb);
1851                 break;
1852
1853         case NDISC_ROUTER_SOLICITATION:
1854                 ndisc_recv_rs(skb);
1855                 break;
1856
1857         case NDISC_ROUTER_ADVERTISEMENT:
1858                 ndisc_router_discovery(skb);
1859                 break;
1860
1861         case NDISC_REDIRECT:
1862                 ndisc_redirect_rcv(skb);
1863                 break;
1864         }
1865
1866         return 0;
1867 }
1868
1869 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1870 {
1871         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1872         struct netdev_notifier_change_info *change_info;
1873         struct net *net = dev_net(dev);
1874         struct inet6_dev *idev;
1875         bool evict_nocarrier;
1876
1877         switch (event) {
1878         case NETDEV_CHANGEADDR:
1879                 neigh_changeaddr(&nd_tbl, dev);
1880                 fib6_run_gc(0, net, false);
1881                 fallthrough;
1882         case NETDEV_UP:
1883                 idev = in6_dev_get(dev);
1884                 if (!idev)
1885                         break;
1886                 if (idev->cnf.ndisc_notify ||
1887                     net->ipv6.devconf_all->ndisc_notify)
1888                         ndisc_send_unsol_na(dev);
1889                 in6_dev_put(idev);
1890                 break;
1891         case NETDEV_CHANGE:
1892                 idev = in6_dev_get(dev);
1893                 if (!idev)
1894                         evict_nocarrier = true;
1895                 else {
1896                         evict_nocarrier = idev->cnf.ndisc_evict_nocarrier &&
1897                                           net->ipv6.devconf_all->ndisc_evict_nocarrier;
1898                         in6_dev_put(idev);
1899                 }
1900
1901                 change_info = ptr;
1902                 if (change_info->flags_changed & IFF_NOARP)
1903                         neigh_changeaddr(&nd_tbl, dev);
1904                 if (evict_nocarrier && !netif_carrier_ok(dev))
1905                         neigh_carrier_down(&nd_tbl, dev);
1906                 break;
1907         case NETDEV_DOWN:
1908                 neigh_ifdown(&nd_tbl, dev);
1909                 fib6_run_gc(0, net, false);
1910                 break;
1911         case NETDEV_NOTIFY_PEERS:
1912                 ndisc_send_unsol_na(dev);
1913                 break;
1914         default:
1915                 break;
1916         }
1917
1918         return NOTIFY_DONE;
1919 }
1920
1921 static struct notifier_block ndisc_netdev_notifier = {
1922         .notifier_call = ndisc_netdev_event,
1923         .priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1924 };
1925
1926 #ifdef CONFIG_SYSCTL
1927 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1928                                          const char *func, const char *dev_name)
1929 {
1930         static char warncomm[TASK_COMM_LEN];
1931         static int warned;
1932         if (strcmp(warncomm, current->comm) && warned < 5) {
1933                 strcpy(warncomm, current->comm);
1934                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1935                         warncomm, func,
1936                         dev_name, ctl->procname,
1937                         dev_name, ctl->procname);
1938                 warned++;
1939         }
1940 }
1941
1942 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void *buffer,
1943                 size_t *lenp, loff_t *ppos)
1944 {
1945         struct net_device *dev = ctl->extra1;
1946         struct inet6_dev *idev;
1947         int ret;
1948
1949         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1950             (strcmp(ctl->procname, "base_reachable_time") == 0))
1951                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1952
1953         if (strcmp(ctl->procname, "retrans_time") == 0)
1954                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1955
1956         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1957                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1958                                                   buffer, lenp, ppos);
1959
1960         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1961                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1962                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1963                                                      buffer, lenp, ppos);
1964         else
1965                 ret = -1;
1966
1967         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1968                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1969                         idev->nd_parms->reachable_time =
1970                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1971                 idev->tstamp = jiffies;
1972                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1973                 in6_dev_put(idev);
1974         }
1975         return ret;
1976 }
1977
1978
1979 #endif
1980
1981 static int __net_init ndisc_net_init(struct net *net)
1982 {
1983         struct ipv6_pinfo *np;
1984         struct sock *sk;
1985         int err;
1986
1987         err = inet_ctl_sock_create(&sk, PF_INET6,
1988                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1989         if (err < 0) {
1990                 ND_PRINTK(0, err,
1991                           "NDISC: Failed to initialize the control socket (err %d)\n",
1992                           err);
1993                 return err;
1994         }
1995
1996         net->ipv6.ndisc_sk = sk;
1997
1998         np = inet6_sk(sk);
1999         np->hop_limit = 255;
2000         /* Do not loopback ndisc messages */
2001         np->mc_loop = 0;
2002
2003         return 0;
2004 }
2005
2006 static void __net_exit ndisc_net_exit(struct net *net)
2007 {
2008         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
2009 }
2010
2011 static struct pernet_operations ndisc_net_ops = {
2012         .init = ndisc_net_init,
2013         .exit = ndisc_net_exit,
2014 };
2015
2016 int __init ndisc_init(void)
2017 {
2018         int err;
2019
2020         err = register_pernet_subsys(&ndisc_net_ops);
2021         if (err)
2022                 return err;
2023         /*
2024          * Initialize the neighbour table
2025          */
2026         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
2027
2028 #ifdef CONFIG_SYSCTL
2029         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
2030                                     ndisc_ifinfo_sysctl_change);
2031         if (err)
2032                 goto out_unregister_pernet;
2033 out:
2034 #endif
2035         return err;
2036
2037 #ifdef CONFIG_SYSCTL
2038 out_unregister_pernet:
2039         unregister_pernet_subsys(&ndisc_net_ops);
2040         goto out;
2041 #endif
2042 }
2043
2044 int __init ndisc_late_init(void)
2045 {
2046         return register_netdevice_notifier(&ndisc_netdev_notifier);
2047 }
2048
2049 void ndisc_late_cleanup(void)
2050 {
2051         unregister_netdevice_notifier(&ndisc_netdev_notifier);
2052 }
2053
2054 void ndisc_cleanup(void)
2055 {
2056 #ifdef CONFIG_SYSCTL
2057         neigh_sysctl_unregister(&nd_tbl.parms);
2058 #endif
2059         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
2060         unregister_pernet_subsys(&ndisc_net_ops);
2061 }