net/ipv6/ndisc.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Neighbour Discovery for IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Mike Shaver             <shaver@ingenia.com>
   9  */
  10
  11 /*
  12  *      Changes:
  13  *
  14  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  15  *      Pierre Ynard                    :       export userland ND options
  16  *                                              through netlink (RDNSS support)
  17  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  18  *                                              of an RA.
  19  *      Janos Farkas                    :       kmalloc failure checks
  20  *      Alexey Kuznetsov                :       state machine reworked
  21  *                                              and moved to net/core.
  22  *      Pekka Savola                    :       RFC2461 validation
  23  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  24  */
  25
  26 #define pr_fmt(fmt) "ICMPv6: " fmt
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/sched.h>
  34 #include <linux/net.h>
  35 #include <linux/in6.h>
  36 #include <linux/route.h>
  37 #include <linux/init.h>
  38 #include <linux/rcupdate.h>
  39 #include <linux/slab.h>
  40 #ifdef CONFIG_SYSCTL
  41 #include <linux/sysctl.h>
  42 #endif
  43
  44 #include <linux/if_addr.h>
  45 #include <linux/if_ether.h>
  46 #include <linux/if_arp.h>
  47 #include <linux/ipv6.h>
  48 #include <linux/icmpv6.h>
  49 #include <linux/jhash.h>
  50
  51 #include <net/sock.h>
  52 #include <net/snmp.h>
  53
  54 #include <net/ipv6.h>
  55 #include <net/protocol.h>
  56 #include <net/ndisc.h>
  57 #include <net/ip6_route.h>
  58 #include <net/addrconf.h>
  59 #include <net/icmp.h>
  60
  61 #include <net/netlink.h>
  62 #include <linux/rtnetlink.h>
  63
  64 #include <net/flow.h>
  65 #include <net/ip6_checksum.h>
  66 #include <net/inet_common.h>
  67 #include <linux/proc_fs.h>
  68
  69 #include <linux/netfilter.h>
  70 #include <linux/netfilter_ipv6.h>
  71
  72 static u32 ndisc_hash(const void *pkey,
  73                       const struct net_device *dev,
  74                       __u32 *hash_rnd);
  75 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
  76 static bool ndisc_allow_add(const struct net_device *dev,
  77                             struct netlink_ext_ack *extack);
  78 static int ndisc_constructor(struct neighbour *neigh);
  79 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  80 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  81 static int pndisc_constructor(struct pneigh_entry *n);
  82 static void pndisc_destructor(struct pneigh_entry *n);
  83 static void pndisc_redo(struct sk_buff *skb);
  84 static int ndisc_is_multicast(const void *pkey);
  85
  86 static const struct neigh_ops ndisc_generic_ops = {
  87         .family =               AF_INET6,
  88         .solicit =              ndisc_solicit,
  89         .error_report =         ndisc_error_report,
  90         .output =               neigh_resolve_output,
  91         .connected_output =     neigh_connected_output,
  92 };
  93
  94 static const struct neigh_ops ndisc_hh_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_resolve_output,
 100 };
 101
 102
 103 static const struct neigh_ops ndisc_direct_ops = {
 104         .family =               AF_INET6,
 105         .output =               neigh_direct_output,
 106         .connected_output =     neigh_direct_output,
 107 };
 108
 109 struct neigh_table nd_tbl = {
 110         .family =       AF_INET6,
 111         .key_len =      sizeof(struct in6_addr),
 112         .protocol =     cpu_to_be16(ETH_P_IPV6),
 113         .hash =         ndisc_hash,
 114         .key_eq =       ndisc_key_eq,
 115         .constructor =  ndisc_constructor,
 116         .pconstructor = pndisc_constructor,
 117         .pdestructor =  pndisc_destructor,
 118         .proxy_redo =   pndisc_redo,
 119         .is_multicast = ndisc_is_multicast,
 120         .allow_add  =   ndisc_allow_add,
 121         .id =           "ndisc_cache",
 122         .parms = {
 123                 .tbl                    = &nd_tbl,
 124                 .reachable_time         = ND_REACHABLE_TIME,
 125                 .data = {
 126                         [NEIGH_VAR_MCAST_PROBES] = 3,
 127                         [NEIGH_VAR_UCAST_PROBES] = 3,
 128                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 129                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 130                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 131                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 132                         [NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
 133                         [NEIGH_VAR_PROXY_QLEN] = 64,
 134                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 135                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 136                 },
 137         },
 138         .gc_interval =    30 * HZ,
 139         .gc_thresh1 =    128,
 140         .gc_thresh2 =    512,
 141         .gc_thresh3 =   1024,
 142 };
 143 EXPORT_SYMBOL_GPL(nd_tbl);
 144
 145 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data,
 146                               int data_len, int pad)
 147 {
 148         int space = __ndisc_opt_addr_space(data_len, pad);
 149         u8 *opt = skb_put(skb, space);
 150
 151         opt[0] = type;
 152         opt[1] = space>>3;
 153
 154         memset(opt + 2, 0, pad);
 155         opt   += pad;
 156         space -= pad;
 157
 158         memcpy(opt+2, data, data_len);
 159         data_len += 2;
 160         opt += data_len;
 161         space -= data_len;
 162         if (space > 0)
 163                 memset(opt, 0, space);
 164 }
 165 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
 166
 167 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
 168                                           void *data, u8 icmp6_type)
 169 {
 170         __ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
 171                                  ndisc_addr_option_pad(skb->dev->type));
 172         ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
 173 }
 174
 175 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
 176                                                    void *ha,
 177                                                    const u8 *ops_data)
 178 {
 179         ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
 180         ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
 181 }
 182
 183 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 184                                             struct nd_opt_hdr *end)
 185 {
 186         int type;
 187         if (!cur || !end || cur >= end)
 188                 return NULL;
 189         type = cur->nd_opt_type;
 190         do {
 191                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 192         } while (cur < end && cur->nd_opt_type != type);
 193         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 194 }
 195
 196 static inline int ndisc_is_useropt(const struct net_device *dev,
 197                                    struct nd_opt_hdr *opt)
 198 {
 199         return opt->nd_opt_type == ND_OPT_RDNSS ||
 200                 opt->nd_opt_type == ND_OPT_DNSSL ||
 201                 opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
 202                 ndisc_ops_is_useropt(dev, opt->nd_opt_type);
 203 }
 204
 205 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
 206                                              struct nd_opt_hdr *cur,
 207                                              struct nd_opt_hdr *end)
 208 {
 209         if (!cur || !end || cur >= end)
 210                 return NULL;
 211         do {
 212                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 213         } while (cur < end && !ndisc_is_useropt(dev, cur));
 214         return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
 215 }
 216
 217 struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 218                                           u8 *opt, int opt_len,
 219                                           struct ndisc_options *ndopts)
 220 {
 221         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 222
 223         if (!nd_opt || opt_len < 0 || !ndopts)
 224                 return NULL;
 225         memset(ndopts, 0, sizeof(*ndopts));
 226         while (opt_len) {
 227                 int l;
 228                 if (opt_len < sizeof(struct nd_opt_hdr))
 229                         return NULL;
 230                 l = nd_opt->nd_opt_len << 3;
 231                 if (opt_len < l || l == 0)
 232                         return NULL;
 233                 if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
 234                         goto next_opt;
 235                 switch (nd_opt->nd_opt_type) {
 236                 case ND_OPT_SOURCE_LL_ADDR:
 237                 case ND_OPT_TARGET_LL_ADDR:
 238                 case ND_OPT_MTU:
 239                 case ND_OPT_NONCE:
 240                 case ND_OPT_REDIRECT_HDR:
 241                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 242                                 ND_PRINTK(2, warn,
 243                                           "%s: duplicated ND6 option found: type=%d\n",
 244                                           __func__, nd_opt->nd_opt_type);
 245                         } else {
 246                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 247                         }
 248                         break;
 249                 case ND_OPT_PREFIX_INFO:
 250                         ndopts->nd_opts_pi_end = nd_opt;
 251                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 252                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 253                         break;
 254 #ifdef CONFIG_IPV6_ROUTE_INFO
 255                 case ND_OPT_ROUTE_INFO:
 256                         ndopts->nd_opts_ri_end = nd_opt;
 257                         if (!ndopts->nd_opts_ri)
 258                                 ndopts->nd_opts_ri = nd_opt;
 259                         break;
 260 #endif
 261                 default:
 262                         if (ndisc_is_useropt(dev, nd_opt)) {
 263                                 ndopts->nd_useropts_end = nd_opt;
 264                                 if (!ndopts->nd_useropts)
 265                                         ndopts->nd_useropts = nd_opt;
 266                         } else {
 267                                 /*
 268                                  * Unknown options must be silently ignored,
 269                                  * to accommodate future extension to the
 270                                  * protocol.
 271                                  */
 272                                 ND_PRINTK(2, notice,
 273                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 274                                           __func__,
 275                                           nd_opt->nd_opt_type,
 276                                           nd_opt->nd_opt_len);
 277                         }
 278                 }
 279 next_opt:
 280                 opt_len -= l;
 281                 nd_opt = ((void *)nd_opt) + l;
 282         }
 283         return ndopts;
 284 }
 285
 286 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 287 {
 288         switch (dev->type) {
 289         case ARPHRD_ETHER:
 290         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 291         case ARPHRD_FDDI:
 292                 ipv6_eth_mc_map(addr, buf);
 293                 return 0;
 294         case ARPHRD_ARCNET:
 295                 ipv6_arcnet_mc_map(addr, buf);
 296                 return 0;
 297         case ARPHRD_INFINIBAND:
 298                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 299                 return 0;
 300         case ARPHRD_IPGRE:
 301                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 302         default:
 303                 if (dir) {
 304                         memcpy(buf, dev->broadcast, dev->addr_len);
 305                         return 0;
 306                 }
 307         }
 308         return -EINVAL;
 309 }
 310 EXPORT_SYMBOL(ndisc_mc_map);
 311
 312 static u32 ndisc_hash(const void *pkey,
 313                       const struct net_device *dev,
 314                       __u32 *hash_rnd)
 315 {
 316         return ndisc_hashfn(pkey, dev, hash_rnd);
 317 }
 318
 319 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
 320 {
 321         return neigh_key_eq128(n, pkey);
 322 }
 323
 324 static int ndisc_constructor(struct neighbour *neigh)
 325 {
 326         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 327         struct net_device *dev = neigh->dev;
 328         struct inet6_dev *in6_dev;
 329         struct neigh_parms *parms;
 330         bool is_multicast = ipv6_addr_is_multicast(addr);
 331
 332         in6_dev = in6_dev_get(dev);
 333         if (!in6_dev) {
 334                 return -EINVAL;
 335         }
 336
 337         parms = in6_dev->nd_parms;
 338         __neigh_parms_put(neigh->parms);
 339         neigh->parms = neigh_parms_clone(parms);
 340
 341         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 342         if (!dev->header_ops) {
 343                 neigh->nud_state = NUD_NOARP;
 344                 neigh->ops = &ndisc_direct_ops;
 345                 neigh->output = neigh_direct_output;
 346         } else {
 347                 if (is_multicast) {
 348                         neigh->nud_state = NUD_NOARP;
 349                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 350                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 351                         neigh->nud_state = NUD_NOARP;
 352                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 353                         if (dev->flags&IFF_LOOPBACK)
 354                                 neigh->type = RTN_LOCAL;
 355                 } else if (dev->flags&IFF_POINTOPOINT) {
 356                         neigh->nud_state = NUD_NOARP;
 357                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 358                 }
 359                 if (dev->header_ops->cache)
 360                         neigh->ops = &ndisc_hh_ops;
 361                 else
 362                         neigh->ops = &ndisc_generic_ops;
 363                 if (neigh->nud_state&NUD_VALID)
 364                         neigh->output = neigh->ops->connected_output;
 365                 else
 366                         neigh->output = neigh->ops->output;
 367         }
 368         in6_dev_put(in6_dev);
 369         return 0;
 370 }
 371
 372 static int pndisc_constructor(struct pneigh_entry *n)
 373 {
 374         struct in6_addr *addr = (struct in6_addr *)&n->key;
 375         struct in6_addr maddr;
 376         struct net_device *dev = n->dev;
 377
 378         if (!dev || !__in6_dev_get(dev))
 379                 return -EINVAL;
 380         addrconf_addr_solict_mult(addr, &maddr);
 381         ipv6_dev_mc_inc(dev, &maddr);
 382         return 0;
 383 }
 384
 385 static void pndisc_destructor(struct pneigh_entry *n)
 386 {
 387         struct in6_addr *addr = (struct in6_addr *)&n->key;
 388         struct in6_addr maddr;
 389         struct net_device *dev = n->dev;
 390
 391         if (!dev || !__in6_dev_get(dev))
 392                 return;
 393         addrconf_addr_solict_mult(addr, &maddr);
 394         ipv6_dev_mc_dec(dev, &maddr);
 395 }
 396
 397 /* called with rtnl held */
 398 static bool ndisc_allow_add(const struct net_device *dev,
 399                             struct netlink_ext_ack *extack)
 400 {
 401         struct inet6_dev *idev = __in6_dev_get(dev);
 402
 403         if (!idev || idev->cnf.disable_ipv6) {
 404                 NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device");
 405                 return false;
 406         }
 407
 408         return true;
 409 }
 410
 411 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 412                                        int len)
 413 {
 414         int hlen = LL_RESERVED_SPACE(dev);
 415         int tlen = dev->needed_tailroom;
 416         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 417         struct sk_buff *skb;
 418
 419         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 420         if (!skb) {
 421                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 422                           __func__);
 423                 return NULL;
 424         }
 425
 426         skb->protocol = htons(ETH_P_IPV6);
 427         skb->dev = dev;
 428
 429         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 430         skb_reset_transport_header(skb);
 431
 432         /* Manually assign socket ownership as we avoid calling
 433          * sock_alloc_send_pskb() to bypass wmem buffer limits
 434          */
 435         skb_set_owner_w(skb, sk);
 436
 437         return skb;
 438 }
 439
 440 static void ip6_nd_hdr(struct sk_buff *skb,
 441                        const struct in6_addr *saddr,
 442                        const struct in6_addr *daddr,
 443                        int hop_limit, int len)
 444 {
 445         struct ipv6hdr *hdr;
 446         struct inet6_dev *idev;
 447         unsigned tclass;
 448
 449         rcu_read_lock();
 450         idev = __in6_dev_get(skb->dev);
 451         tclass = idev ? idev->cnf.ndisc_tclass : 0;
 452         rcu_read_unlock();
 453
 454         skb_push(skb, sizeof(*hdr));
 455         skb_reset_network_header(skb);
 456         hdr = ipv6_hdr(skb);
 457
 458         ip6_flow_hdr(hdr, tclass, 0);
 459
 460         hdr->payload_len = htons(len);
 461         hdr->nexthdr = IPPROTO_ICMPV6;
 462         hdr->hop_limit = hop_limit;
 463
 464         hdr->saddr = *saddr;
 465         hdr->daddr = *daddr;
 466 }
 467
 468 static void ndisc_send_skb(struct sk_buff *skb,
 469                            const struct in6_addr *daddr,
 470                            const struct in6_addr *saddr)
 471 {
 472         struct dst_entry *dst = skb_dst(skb);
 473         struct net *net = dev_net(skb->dev);
 474         struct sock *sk = net->ipv6.ndisc_sk;
 475         struct inet6_dev *idev;
 476         int err;
 477         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 478         u8 type;
 479
 480         type = icmp6h->icmp6_type;
 481
 482         if (!dst) {
 483                 struct flowi6 fl6;
 484                 int oif = skb->dev->ifindex;
 485
 486                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 487                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 488                 if (IS_ERR(dst)) {
 489                         kfree_skb(skb);
 490                         return;
 491                 }
 492
 493                 skb_dst_set(skb, dst);
 494         }
 495
 496         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 497                                               IPPROTO_ICMPV6,
 498                                               csum_partial(icmp6h,
 499                                                            skb->len, 0));
 500
 501         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 502
 503         rcu_read_lock();
 504         idev = __in6_dev_get(dst->dev);
 505         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 506
 507         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
 508                       net, sk, skb, NULL, dst->dev,
 509                       dst_output);
 510         if (!err) {
 511                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 512                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 513         }
 514
 515         rcu_read_unlock();
 516 }
 517
 518 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
 519                    const struct in6_addr *solicited_addr,
 520                    bool router, bool solicited, bool override, bool inc_opt)
 521 {
 522         struct sk_buff *skb;
 523         struct in6_addr tmpaddr;
 524         struct inet6_ifaddr *ifp;
 525         const struct in6_addr *src_addr;
 526         struct nd_msg *msg;
 527         int optlen = 0;
 528
 529         /* for anycast or proxy, solicited_addr != src_addr */
 530         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 531         if (ifp) {
 532                 src_addr = solicited_addr;
 533                 if (ifp->flags & IFA_F_OPTIMISTIC)
 534                         override = false;
 535                 inc_opt |= ifp->idev->cnf.force_tllao;
 536                 in6_ifa_put(ifp);
 537         } else {
 538                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 539                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 540                                        &tmpaddr))
 541                         return;
 542                 src_addr = &tmpaddr;
 543         }
 544
 545         if (!dev->addr_len)
 546                 inc_opt = false;
 547         if (inc_opt)
 548                 optlen += ndisc_opt_addr_space(dev,
 549                                                NDISC_NEIGHBOUR_ADVERTISEMENT);
 550
 551         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 552         if (!skb)
 553                 return;
 554
 555         msg = skb_put(skb, sizeof(*msg));
 556         *msg = (struct nd_msg) {
 557                 .icmph = {
 558                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 559                         .icmp6_router = router,
 560                         .icmp6_solicited = solicited,
 561                         .icmp6_override = override,
 562                 },
 563                 .target = *solicited_addr,
 564         };
 565
 566         if (inc_opt)
 567                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 568                                        dev->dev_addr,
 569                                        NDISC_NEIGHBOUR_ADVERTISEMENT);
 570
 571         ndisc_send_skb(skb, daddr, src_addr);
 572 }
 573
 574 static void ndisc_send_unsol_na(struct net_device *dev)
 575 {
 576         struct inet6_dev *idev;
 577         struct inet6_ifaddr *ifa;
 578
 579         idev = in6_dev_get(dev);
 580         if (!idev)
 581                 return;
 582
 583         read_lock_bh(&idev->lock);
 584         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 585                 /* skip tentative addresses until dad completes */
 586                 if (ifa->flags & IFA_F_TENTATIVE &&
 587                     !(ifa->flags & IFA_F_OPTIMISTIC))
 588                         continue;
 589
 590                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
 591                               /*router=*/ !!idev->cnf.forwarding,
 592                               /*solicited=*/ false, /*override=*/ true,
 593                               /*inc_opt=*/ true);
 594         }
 595         read_unlock_bh(&idev->lock);
 596
 597         in6_dev_put(idev);
 598 }
 599
 600 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
 601                    const struct in6_addr *daddr, const struct in6_addr *saddr,
 602                    u64 nonce)
 603 {
 604         struct sk_buff *skb;
 605         struct in6_addr addr_buf;
 606         int inc_opt = dev->addr_len;
 607         int optlen = 0;
 608         struct nd_msg *msg;
 609
 610         if (!saddr) {
 611                 if (ipv6_get_lladdr(dev, &addr_buf,
 612                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 613                         return;
 614                 saddr = &addr_buf;
 615         }
 616
 617         if (ipv6_addr_any(saddr))
 618                 inc_opt = false;
 619         if (inc_opt)
 620                 optlen += ndisc_opt_addr_space(dev,
 621                                                NDISC_NEIGHBOUR_SOLICITATION);
 622         if (nonce != 0)
 623                 optlen += 8;
 624
 625         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 626         if (!skb)
 627                 return;
 628
 629         msg = skb_put(skb, sizeof(*msg));
 630         *msg = (struct nd_msg) {
 631                 .icmph = {
 632                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 633                 },
 634                 .target = *solicit,
 635         };
 636
 637         if (inc_opt)
 638                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 639                                        dev->dev_addr,
 640                                        NDISC_NEIGHBOUR_SOLICITATION);
 641         if (nonce != 0) {
 642                 u8 *opt = skb_put(skb, 8);
 643
 644                 opt[0] = ND_OPT_NONCE;
 645                 opt[1] = 8 >> 3;
 646                 memcpy(opt + 2, &nonce, 6);
 647         }
 648
 649         ndisc_send_skb(skb, daddr, saddr);
 650 }
 651
 652 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 653                    const struct in6_addr *daddr)
 654 {
 655         struct sk_buff *skb;
 656         struct rs_msg *msg;
 657         int send_sllao = dev->addr_len;
 658         int optlen = 0;
 659
 660 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 661         /*
 662          * According to section 2.2 of RFC 4429, we must not
 663          * send router solicitations with a sllao from
 664          * optimistic addresses, but we may send the solicitation
 665          * if we don't include the sllao.  So here we check
 666          * if our address is optimistic, and if so, we
 667          * suppress the inclusion of the sllao.
 668          */
 669         if (send_sllao) {
 670                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 671                                                            dev, 1);
 672                 if (ifp) {
 673                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 674                                 send_sllao = 0;
 675                         }
 676                         in6_ifa_put(ifp);
 677                 } else {
 678                         send_sllao = 0;
 679                 }
 680         }
 681 #endif
 682         if (send_sllao)
 683                 optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
 684
 685         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 686         if (!skb)
 687                 return;
 688
 689         msg = skb_put(skb, sizeof(*msg));
 690         *msg = (struct rs_msg) {
 691                 .icmph = {
 692                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 693                 },
 694         };
 695
 696         if (send_sllao)
 697                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 698                                        dev->dev_addr,
 699                                        NDISC_ROUTER_SOLICITATION);
 700
 701         ndisc_send_skb(skb, daddr, saddr);
 702 }
 703
 704
 705 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 706 {
 707         /*
 708          *      "The sender MUST return an ICMP
 709          *       destination unreachable"
 710          */
 711         dst_link_failure(skb);
 712         kfree_skb(skb);
 713 }
 714
 715 /* Called with locked neigh: either read or both */
 716
 717 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 718 {
 719         struct in6_addr *saddr = NULL;
 720         struct in6_addr mcaddr;
 721         struct net_device *dev = neigh->dev;
 722         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 723         int probes = atomic_read(&neigh->probes);
 724
 725         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 726                                            dev, false, 1,
 727                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 728                 saddr = &ipv6_hdr(skb)->saddr;
 729         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 730         if (probes < 0) {
 731                 if (!(neigh->nud_state & NUD_VALID)) {
 732                         ND_PRINTK(1, dbg,
 733                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 734                                   __func__, target);
 735                 }
 736                 ndisc_send_ns(dev, target, target, saddr, 0);
 737         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 738                 neigh_app_ns(neigh);
 739         } else {
 740                 addrconf_addr_solict_mult(target, &mcaddr);
 741                 ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
 742         }
 743 }
 744
 745 static int pndisc_is_router(const void *pkey,
 746                             struct net_device *dev)
 747 {
 748         struct pneigh_entry *n;
 749         int ret = -1;
 750
 751         read_lock_bh(&nd_tbl.lock);
 752         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 753         if (n)
 754                 ret = !!(n->flags & NTF_ROUTER);
 755         read_unlock_bh(&nd_tbl.lock);
 756
 757         return ret;
 758 }
 759
 760 void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
 761                   const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
 762                   struct ndisc_options *ndopts)
 763 {
 764         neigh_update(neigh, lladdr, new, flags, 0);
 765         /* report ndisc ops about neighbour update */
 766         ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
 767 }
 768
 769 static void ndisc_recv_ns(struct sk_buff *skb)
 770 {
 771         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 772         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 773         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 774         u8 *lladdr = NULL;
 775         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 776                                     offsetof(struct nd_msg, opt));
 777         struct ndisc_options ndopts;
 778         struct net_device *dev = skb->dev;
 779         struct inet6_ifaddr *ifp;
 780         struct inet6_dev *idev = NULL;
 781         struct neighbour *neigh;
 782         int dad = ipv6_addr_any(saddr);
 783         bool inc;
 784         int is_router = -1;
 785         u64 nonce = 0;
 786
 787         if (skb->len < sizeof(struct nd_msg)) {
 788                 ND_PRINTK(2, warn, "NS: packet too short\n");
 789                 return;
 790         }
 791
 792         if (ipv6_addr_is_multicast(&msg->target)) {
 793                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 794                 return;
 795         }
 796
 797         /*
 798          * RFC2461 7.1.1:
 799          * DAD has to be destined for solicited node multicast address.
 800          */
 801         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 802                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 803                 return;
 804         }
 805
 806         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 807                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 808                 return;
 809         }
 810
 811         if (ndopts.nd_opts_src_lladdr) {
 812                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 813                 if (!lladdr) {
 814                         ND_PRINTK(2, warn,
 815                                   "NS: invalid link-layer address length\n");
 816                         return;
 817                 }
 818
 819                 /* RFC2461 7.1.1:
 820                  *      If the IP source address is the unspecified address,
 821                  *      there MUST NOT be source link-layer address option
 822                  *      in the message.
 823                  */
 824                 if (dad) {
 825                         ND_PRINTK(2, warn,
 826                                   "NS: bad DAD packet (link-layer address option)\n");
 827                         return;
 828                 }
 829         }
 830         if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
 831                 memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
 832
 833         inc = ipv6_addr_is_multicast(daddr);
 834
 835         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 836         if (ifp) {
 837 have_ifp:
 838                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 839                         if (dad) {
 840                                 if (nonce != 0 && ifp->dad_nonce == nonce) {
 841                                         u8 *np = (u8 *)&nonce;
 842                                         /* Matching nonce if looped back */
 843                                         ND_PRINTK(2, notice,
 844                                                   "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
 845                                                   ifp->idev->dev->name,
 846                                                   &ifp->addr, np);
 847                                         goto out;
 848                                 }
 849                                 /*
 850                                  * We are colliding with another node
 851                                  * who is doing DAD
 852                                  * so fail our DAD process
 853                                  */
 854                                 addrconf_dad_failure(skb, ifp);
 855                                 return;
 856                         } else {
 857                                 /*
 858                                  * This is not a dad solicitation.
 859                                  * If we are an optimistic node,
 860                                  * we should respond.
 861                                  * Otherwise, we should ignore it.
 862                                  */
 863                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 864                                         goto out;
 865                         }
 866                 }
 867
 868                 idev = ifp->idev;
 869         } else {
 870                 struct net *net = dev_net(dev);
 871
 872                 /* perhaps an address on the master device */
 873                 if (netif_is_l3_slave(dev)) {
 874                         struct net_device *mdev;
 875
 876                         mdev = netdev_master_upper_dev_get_rcu(dev);
 877                         if (mdev) {
 878                                 ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
 879                                 if (ifp)
 880                                         goto have_ifp;
 881                         }
 882                 }
 883
 884                 idev = in6_dev_get(dev);
 885                 if (!idev) {
 886                         /* XXX: count this drop? */
 887                         return;
 888                 }
 889
 890                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 891                     (idev->cnf.forwarding &&
 892                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 893                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 894                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 895                             skb->pkt_type != PACKET_HOST &&
 896                             inc &&
 897                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 898                                 /*
 899                                  * for anycast or proxy,
 900                                  * sender should delay its response
 901                                  * by a random time between 0 and
 902                                  * MAX_ANYCAST_DELAY_TIME seconds.
 903                                  * (RFC2461) -- yoshfuji
 904                                  */
 905                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 906                                 if (n)
 907                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 908                                 goto out;
 909                         }
 910                 } else
 911                         goto out;
 912         }
 913
 914         if (is_router < 0)
 915                 is_router = idev->cnf.forwarding;
 916
 917         if (dad) {
 918                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
 919                               !!is_router, false, (ifp != NULL), true);
 920                 goto out;
 921         }
 922
 923         if (inc)
 924                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 925         else
 926                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 927
 928         /*
 929          *      update / create cache entry
 930          *      for the source address
 931          */
 932         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 933                                !inc || lladdr || !dev->addr_len);
 934         if (neigh)
 935                 ndisc_update(dev, neigh, lladdr, NUD_STALE,
 936                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 937                              NEIGH_UPDATE_F_OVERRIDE,
 938                              NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
 939         if (neigh || !dev->header_ops) {
 940                 ndisc_send_na(dev, saddr, &msg->target, !!is_router,
 941                               true, (ifp != NULL && inc), inc);
 942                 if (neigh)
 943                         neigh_release(neigh);
 944         }
 945
 946 out:
 947         if (ifp)
 948                 in6_ifa_put(ifp);
 949         else
 950                 in6_dev_put(idev);
 951 }
 952
 953 static void ndisc_recv_na(struct sk_buff *skb)
 954 {
 955         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 956         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 957         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 958         u8 *lladdr = NULL;
 959         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 960                                     offsetof(struct nd_msg, opt));
 961         struct ndisc_options ndopts;
 962         struct net_device *dev = skb->dev;
 963         struct inet6_dev *idev = __in6_dev_get(dev);
 964         struct inet6_ifaddr *ifp;
 965         struct neighbour *neigh;
 966
 967         if (skb->len < sizeof(struct nd_msg)) {
 968                 ND_PRINTK(2, warn, "NA: packet too short\n");
 969                 return;
 970         }
 971
 972         if (ipv6_addr_is_multicast(&msg->target)) {
 973                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 974                 return;
 975         }
 976
 977         if (ipv6_addr_is_multicast(daddr) &&
 978             msg->icmph.icmp6_solicited) {
 979                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 980                 return;
 981         }
 982
 983         /* For some 802.11 wireless deployments (and possibly other networks),
 984          * there will be a NA proxy and unsolicitd packets are attacks
 985          * and thus should not be accepted.
 986          */
 987         if (!msg->icmph.icmp6_solicited && idev &&
 988             idev->cnf.drop_unsolicited_na)
 989                 return;
 990
 991         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 992                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 993                 return;
 994         }
 995         if (ndopts.nd_opts_tgt_lladdr) {
 996                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 997                 if (!lladdr) {
 998                         ND_PRINTK(2, warn,
 999                                   "NA: invalid link-layer address length\n");
1000                         return;
1001                 }
1002         }
1003         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
1004         if (ifp) {
1005                 if (skb->pkt_type != PACKET_LOOPBACK
1006                     && (ifp->flags & IFA_F_TENTATIVE)) {
1007                                 addrconf_dad_failure(skb, ifp);
1008                                 return;
1009                 }
1010                 /* What should we make now? The advertisement
1011                    is invalid, but ndisc specs say nothing
1012                    about it. It could be misconfiguration, or
1013                    an smart proxy agent tries to help us :-)
1014
1015                    We should not print the error if NA has been
1016                    received from loopback - it is just our own
1017                    unsolicited advertisement.
1018                  */
1019                 if (skb->pkt_type != PACKET_LOOPBACK)
1020                         ND_PRINTK(1, warn,
1021                                   "NA: %pM advertised our address %pI6c on %s!\n",
1022                                   eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1023                 in6_ifa_put(ifp);
1024                 return;
1025         }
1026         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1027
1028         if (neigh) {
1029                 u8 old_flags = neigh->flags;
1030                 struct net *net = dev_net(dev);
1031
1032                 if (neigh->nud_state & NUD_FAILED)
1033                         goto out;
1034
1035                 /*
1036                  * Don't update the neighbor cache entry on a proxy NA from
1037                  * ourselves because either the proxied node is off link or it
1038                  * has already sent a NA to us.
1039                  */
1040                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1041                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1042                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1043                         /* XXX: idev->cnf.proxy_ndp */
1044                         goto out;
1045                 }
1046
1047                 ndisc_update(dev, neigh, lladdr,
1048                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
1049                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1050                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1051                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1052                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1053                              NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1054
1055                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1056                         /*
1057                          * Change: router to host
1058                          */
1059                         rt6_clean_tohost(dev_net(dev),  saddr);
1060                 }
1061
1062 out:
1063                 neigh_release(neigh);
1064         }
1065 }
1066
1067 static void ndisc_recv_rs(struct sk_buff *skb)
1068 {
1069         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1070         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1071         struct neighbour *neigh;
1072         struct inet6_dev *idev;
1073         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1074         struct ndisc_options ndopts;
1075         u8 *lladdr = NULL;
1076
1077         if (skb->len < sizeof(*rs_msg))
1078                 return;
1079
1080         idev = __in6_dev_get(skb->dev);
1081         if (!idev) {
1082                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
1083                 return;
1084         }
1085
1086         /* Don't accept RS if we're not in router mode */
1087         if (!idev->cnf.forwarding)
1088                 goto out;
1089
1090         /*
1091          * Don't update NCE if src = ::;
1092          * this implies that the source node has no ip address assigned yet.
1093          */
1094         if (ipv6_addr_any(saddr))
1095                 goto out;
1096
1097         /* Parse ND options */
1098         if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts)) {
1099                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
1100                 goto out;
1101         }
1102
1103         if (ndopts.nd_opts_src_lladdr) {
1104                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1105                                              skb->dev);
1106                 if (!lladdr)
1107                         goto out;
1108         }
1109
1110         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1111         if (neigh) {
1112                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1113                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1114                              NEIGH_UPDATE_F_OVERRIDE|
1115                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1116                              NDISC_ROUTER_SOLICITATION, &ndopts);
1117                 neigh_release(neigh);
1118         }
1119 out:
1120         return;
1121 }
1122
1123 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1124 {
1125         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1126         struct sk_buff *skb;
1127         struct nlmsghdr *nlh;
1128         struct nduseroptmsg *ndmsg;
1129         struct net *net = dev_net(ra->dev);
1130         int err;
1131         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1132                                     + (opt->nd_opt_len << 3));
1133         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1134
1135         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1136         if (!skb) {
1137                 err = -ENOBUFS;
1138                 goto errout;
1139         }
1140
1141         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1142         if (!nlh) {
1143                 goto nla_put_failure;
1144         }
1145
1146         ndmsg = nlmsg_data(nlh);
1147         ndmsg->nduseropt_family = AF_INET6;
1148         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1149         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1150         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1151         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1152
1153         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1154
1155         if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1156                 goto nla_put_failure;
1157         nlmsg_end(skb, nlh);
1158
1159         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1160         return;
1161
1162 nla_put_failure:
1163         nlmsg_free(skb);
1164         err = -EMSGSIZE;
1165 errout:
1166         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1167 }
1168
1169 static void ndisc_router_discovery(struct sk_buff *skb)
1170 {
1171         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1172         struct neighbour *neigh = NULL;
1173         struct inet6_dev *in6_dev;
1174         struct fib6_info *rt = NULL;
1175         struct net *net;
1176         int lifetime;
1177         struct ndisc_options ndopts;
1178         int optlen;
1179         unsigned int pref = 0;
1180         __u32 old_if_flags;
1181         bool send_ifinfo_notify = false;
1182
1183         __u8 *opt = (__u8 *)(ra_msg + 1);
1184
1185         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1186                 sizeof(struct ra_msg);
1187
1188         ND_PRINTK(2, info,
1189                   "RA: %s, dev: %s\n",
1190                   __func__, skb->dev->name);
1191         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1192                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1193                 return;
1194         }
1195         if (optlen < 0) {
1196                 ND_PRINTK(2, warn, "RA: packet too short\n");
1197                 return;
1198         }
1199
1200 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1201         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1202                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1203                 return;
1204         }
1205 #endif
1206
1207         /*
1208          *      set the RA_RECV flag in the interface
1209          */
1210
1211         in6_dev = __in6_dev_get(skb->dev);
1212         if (!in6_dev) {
1213                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1214                           skb->dev->name);
1215                 return;
1216         }
1217
1218         if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts)) {
1219                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1220                 return;
1221         }
1222
1223         if (!ipv6_accept_ra(in6_dev)) {
1224                 ND_PRINTK(2, info,
1225                           "RA: %s, did not accept ra for dev: %s\n",
1226                           __func__, skb->dev->name);
1227                 goto skip_linkparms;
1228         }
1229
1230 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1231         /* skip link-specific parameters from interior routers */
1232         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1233                 ND_PRINTK(2, info,
1234                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1235                           __func__, skb->dev->name);
1236                 goto skip_linkparms;
1237         }
1238 #endif
1239
1240         if (in6_dev->if_flags & IF_RS_SENT) {
1241                 /*
1242                  *      flag that an RA was received after an RS was sent
1243                  *      out on this interface.
1244                  */
1245                 in6_dev->if_flags |= IF_RA_RCVD;
1246         }
1247
1248         /*
1249          * Remember the managed/otherconf flags from most recently
1250          * received RA message (RFC 2462) -- yoshfuji
1251          */
1252         old_if_flags = in6_dev->if_flags;
1253         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1254                                 IF_RA_OTHERCONF)) |
1255                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1256                                         IF_RA_MANAGED : 0) |
1257                                 (ra_msg->icmph.icmp6_addrconf_other ?
1258                                         IF_RA_OTHERCONF : 0);
1259
1260         if (old_if_flags != in6_dev->if_flags)
1261                 send_ifinfo_notify = true;
1262
1263         if (!in6_dev->cnf.accept_ra_defrtr) {
1264                 ND_PRINTK(2, info,
1265                           "RA: %s, defrtr is false for dev: %s\n",
1266                           __func__, skb->dev->name);
1267                 goto skip_defrtr;
1268         }
1269
1270         /* Do not accept RA with source-addr found on local machine unless
1271          * accept_ra_from_local is set to true.
1272          */
1273         net = dev_net(in6_dev->dev);
1274         if (!in6_dev->cnf.accept_ra_from_local &&
1275             ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) {
1276                 ND_PRINTK(2, info,
1277                           "RA from local address detected on dev: %s: default router ignored\n",
1278                           skb->dev->name);
1279                 goto skip_defrtr;
1280         }
1281
1282         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1283
1284 #ifdef CONFIG_IPV6_ROUTER_PREF
1285         pref = ra_msg->icmph.icmp6_router_pref;
1286         /* 10b is handled as if it were 00b (medium) */
1287         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1288             !in6_dev->cnf.accept_ra_rtr_pref)
1289                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1290 #endif
1291         /* routes added from RAs do not use nexthop objects */
1292         rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev);
1293         if (rt) {
1294                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1295                                          rt->fib6_nh->fib_nh_dev, NULL,
1296                                           &ipv6_hdr(skb)->saddr);
1297                 if (!neigh) {
1298                         ND_PRINTK(0, err,
1299                                   "RA: %s got default router without neighbour\n",
1300                                   __func__);
1301                         fib6_info_release(rt);
1302                         return;
1303                 }
1304         }
1305         if (rt && lifetime == 0) {
1306                 ip6_del_rt(net, rt);
1307                 rt = NULL;
1308         }
1309
1310         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, for dev: %s\n",
1311                   rt, lifetime, skb->dev->name);
1312         if (!rt && lifetime) {
1313                 ND_PRINTK(3, info, "RA: adding default router\n");
1314
1315                 rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
1316                                          skb->dev, pref);
1317                 if (!rt) {
1318                         ND_PRINTK(0, err,
1319                                   "RA: %s failed to add default route\n",
1320                                   __func__);
1321                         return;
1322                 }
1323
1324                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1325                                          rt->fib6_nh->fib_nh_dev, NULL,
1326                                           &ipv6_hdr(skb)->saddr);
1327                 if (!neigh) {
1328                         ND_PRINTK(0, err,
1329                                   "RA: %s got default router without neighbour\n",
1330                                   __func__);
1331                         fib6_info_release(rt);
1332                         return;
1333                 }
1334                 neigh->flags |= NTF_ROUTER;
1335         } else if (rt) {
1336                 rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1337         }
1338
1339         if (rt)
1340                 fib6_set_expires(rt, jiffies + (HZ * lifetime));
1341         if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1342             ra_msg->icmph.icmp6_hop_limit) {
1343                 if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1344                         in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1345                         fib6_metric_set(rt, RTAX_HOPLIMIT,
1346                                         ra_msg->icmph.icmp6_hop_limit);
1347                 } else {
1348                         ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1349                 }
1350         }
1351
1352 skip_defrtr:
1353
1354         /*
1355          *      Update Reachable Time and Retrans Timer
1356          */
1357
1358         if (in6_dev->nd_parms) {
1359                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1360
1361                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1362                         rtime = (rtime*HZ)/1000;
1363                         if (rtime < HZ/10)
1364                                 rtime = HZ/10;
1365                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1366                         in6_dev->tstamp = jiffies;
1367                         send_ifinfo_notify = true;
1368                 }
1369
1370                 rtime = ntohl(ra_msg->reachable_time);
1371                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1372                         rtime = (rtime*HZ)/1000;
1373
1374                         if (rtime < HZ/10)
1375                                 rtime = HZ/10;
1376
1377                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1378                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1379                                               BASE_REACHABLE_TIME, rtime);
1380                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1381                                               GC_STALETIME, 3 * rtime);
1382                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1383                                 in6_dev->tstamp = jiffies;
1384                                 send_ifinfo_notify = true;
1385                         }
1386                 }
1387         }
1388
1389         /*
1390          *      Send a notify if RA changed managed/otherconf flags or timer settings
1391          */
1392         if (send_ifinfo_notify)
1393                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1394
1395 skip_linkparms:
1396
1397         /*
1398          *      Process options.
1399          */
1400
1401         if (!neigh)
1402                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1403                                        skb->dev, 1);
1404         if (neigh) {
1405                 u8 *lladdr = NULL;
1406                 if (ndopts.nd_opts_src_lladdr) {
1407                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1408                                                      skb->dev);
1409                         if (!lladdr) {
1410                                 ND_PRINTK(2, warn,
1411                                           "RA: invalid link-layer address length\n");
1412                                 goto out;
1413                         }
1414                 }
1415                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1416                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1417                              NEIGH_UPDATE_F_OVERRIDE|
1418                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1419                              NEIGH_UPDATE_F_ISROUTER,
1420                              NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1421         }
1422
1423         if (!ipv6_accept_ra(in6_dev)) {
1424                 ND_PRINTK(2, info,
1425                           "RA: %s, accept_ra is false for dev: %s\n",
1426                           __func__, skb->dev->name);
1427                 goto out;
1428         }
1429
1430 #ifdef CONFIG_IPV6_ROUTE_INFO
1431         if (!in6_dev->cnf.accept_ra_from_local &&
1432             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1433                           in6_dev->dev, 0)) {
1434                 ND_PRINTK(2, info,
1435                           "RA from local address detected on dev: %s: router info ignored.\n",
1436                           skb->dev->name);
1437                 goto skip_routeinfo;
1438         }
1439
1440         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1441                 struct nd_opt_hdr *p;
1442                 for (p = ndopts.nd_opts_ri;
1443                      p;
1444                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1445                         struct route_info *ri = (struct route_info *)p;
1446 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1447                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1448                             ri->prefix_len == 0)
1449                                 continue;
1450 #endif
1451                         if (ri->prefix_len == 0 &&
1452                             !in6_dev->cnf.accept_ra_defrtr)
1453                                 continue;
1454                         if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1455                                 continue;
1456                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1457                                 continue;
1458                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1459                                       &ipv6_hdr(skb)->saddr);
1460                 }
1461         }
1462
1463 skip_routeinfo:
1464 #endif
1465
1466 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1467         /* skip link-specific ndopts from interior routers */
1468         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1469                 ND_PRINTK(2, info,
1470                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1471                           __func__, skb->dev->name);
1472                 goto out;
1473         }
1474 #endif
1475
1476         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1477                 struct nd_opt_hdr *p;
1478                 for (p = ndopts.nd_opts_pi;
1479                      p;
1480                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1481                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1482                                             (p->nd_opt_len) << 3,
1483                                             ndopts.nd_opts_src_lladdr != NULL);
1484                 }
1485         }
1486
1487         if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1488                 __be32 n;
1489                 u32 mtu;
1490
1491                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1492                 mtu = ntohl(n);
1493
1494                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1495                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1496                 } else if (in6_dev->cnf.mtu6 != mtu) {
1497                         in6_dev->cnf.mtu6 = mtu;
1498                         fib6_metric_set(rt, RTAX_MTU, mtu);
1499                         rt6_mtu_change(skb->dev, mtu);
1500                 }
1501         }
1502
1503         if (ndopts.nd_useropts) {
1504                 struct nd_opt_hdr *p;
1505                 for (p = ndopts.nd_useropts;
1506                      p;
1507                      p = ndisc_next_useropt(skb->dev, p,
1508                                             ndopts.nd_useropts_end)) {
1509                         ndisc_ra_useropt(skb, p);
1510                 }
1511         }
1512
1513         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1514                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1515         }
1516 out:
1517         fib6_info_release(rt);
1518         if (neigh)
1519                 neigh_release(neigh);
1520 }
1521
1522 static void ndisc_redirect_rcv(struct sk_buff *skb)
1523 {
1524         u8 *hdr;
1525         struct ndisc_options ndopts;
1526         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1527         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1528                                     offsetof(struct rd_msg, opt));
1529
1530 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1531         switch (skb->ndisc_nodetype) {
1532         case NDISC_NODETYPE_HOST:
1533         case NDISC_NODETYPE_NODEFAULT:
1534                 ND_PRINTK(2, warn,
1535                           "Redirect: from host or unauthorized router\n");
1536                 return;
1537         }
1538 #endif
1539
1540         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1541                 ND_PRINTK(2, warn,
1542                           "Redirect: source address is not link-local\n");
1543                 return;
1544         }
1545
1546         if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1547                 return;
1548
1549         if (!ndopts.nd_opts_rh) {
1550                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1551                                         skb->dev->ifindex);
1552                 return;
1553         }
1554
1555         hdr = (u8 *)ndopts.nd_opts_rh;
1556         hdr += 8;
1557         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1558                 return;
1559
1560         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1561 }
1562
1563 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1564                                            struct sk_buff *orig_skb,
1565                                            int rd_len)
1566 {
1567         u8 *opt = skb_put(skb, rd_len);
1568
1569         memset(opt, 0, 8);
1570         *(opt++) = ND_OPT_REDIRECT_HDR;
1571         *(opt++) = (rd_len >> 3);
1572         opt += 6;
1573
1574         skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1575                       rd_len - 8);
1576 }
1577
1578 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1579 {
1580         struct net_device *dev = skb->dev;
1581         struct net *net = dev_net(dev);
1582         struct sock *sk = net->ipv6.ndisc_sk;
1583         int optlen = 0;
1584         struct inet_peer *peer;
1585         struct sk_buff *buff;
1586         struct rd_msg *msg;
1587         struct in6_addr saddr_buf;
1588         struct rt6_info *rt;
1589         struct dst_entry *dst;
1590         struct flowi6 fl6;
1591         int rd_len;
1592         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1593            ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1594         bool ret;
1595
1596         if (netif_is_l3_master(skb->dev)) {
1597                 dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
1598                 if (!dev)
1599                         return;
1600         }
1601
1602         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1603                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1604                           dev->name);
1605                 return;
1606         }
1607
1608         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1609             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1610                 ND_PRINTK(2, warn,
1611                           "Redirect: target address is not link-local unicast\n");
1612                 return;
1613         }
1614
1615         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1616                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1617
1618         dst = ip6_route_output(net, NULL, &fl6);
1619         if (dst->error) {
1620                 dst_release(dst);
1621                 return;
1622         }
1623         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1624         if (IS_ERR(dst))
1625                 return;
1626
1627         rt = (struct rt6_info *) dst;
1628
1629         if (rt->rt6i_flags & RTF_GATEWAY) {
1630                 ND_PRINTK(2, warn,
1631                           "Redirect: destination is not a neighbour\n");
1632                 goto release;
1633         }
1634         peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1635         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1636         if (peer)
1637                 inet_putpeer(peer);
1638         if (!ret)
1639                 goto release;
1640
1641         if (dev->addr_len) {
1642                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1643                 if (!neigh) {
1644                         ND_PRINTK(2, warn,
1645                                   "Redirect: no neigh for target address\n");
1646                         goto release;
1647                 }
1648
1649                 read_lock_bh(&neigh->lock);
1650                 if (neigh->nud_state & NUD_VALID) {
1651                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1652                         read_unlock_bh(&neigh->lock);
1653                         ha = ha_buf;
1654                         optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1655                                                                 ops_data_buf,
1656                                                                 &ops_data);
1657                 } else
1658                         read_unlock_bh(&neigh->lock);
1659
1660                 neigh_release(neigh);
1661         }
1662
1663         rd_len = min_t(unsigned int,
1664                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1665                        skb->len + 8);
1666         rd_len &= ~0x7;
1667         optlen += rd_len;
1668
1669         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1670         if (!buff)
1671                 goto release;
1672
1673         msg = skb_put(buff, sizeof(*msg));
1674         *msg = (struct rd_msg) {
1675                 .icmph = {
1676                         .icmp6_type = NDISC_REDIRECT,
1677                 },
1678                 .target = *target,
1679                 .dest = ipv6_hdr(skb)->daddr,
1680         };
1681
1682         /*
1683          *      include target_address option
1684          */
1685
1686         if (ha)
1687                 ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1688
1689         /*
1690          *      build redirect option and copy skb over to the new packet.
1691          */
1692
1693         if (rd_len)
1694                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1695
1696         skb_dst_set(buff, dst);
1697         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1698         return;
1699
1700 release:
1701         dst_release(dst);
1702 }
1703
1704 static void pndisc_redo(struct sk_buff *skb)
1705 {
1706         ndisc_recv_ns(skb);
1707         kfree_skb(skb);
1708 }
1709
1710 static int ndisc_is_multicast(const void *pkey)
1711 {
1712         return ipv6_addr_is_multicast((struct in6_addr *)pkey);
1713 }
1714
1715 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1716 {
1717         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1718
1719         if (!idev)
1720                 return true;
1721         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1722             idev->cnf.suppress_frag_ndisc) {
1723                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1724                 return true;
1725         }
1726         return false;
1727 }
1728
1729 int ndisc_rcv(struct sk_buff *skb)
1730 {
1731         struct nd_msg *msg;
1732
1733         if (ndisc_suppress_frag_ndisc(skb))
1734                 return 0;
1735
1736         if (skb_linearize(skb))
1737                 return 0;
1738
1739         msg = (struct nd_msg *)skb_transport_header(skb);
1740
1741         __skb_push(skb, skb->data - skb_transport_header(skb));
1742
1743         if (ipv6_hdr(skb)->hop_limit != 255) {
1744                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1745                           ipv6_hdr(skb)->hop_limit);
1746                 return 0;
1747         }
1748
1749         if (msg->icmph.icmp6_code != 0) {
1750                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1751                           msg->icmph.icmp6_code);
1752                 return 0;
1753         }
1754
1755         switch (msg->icmph.icmp6_type) {
1756         case NDISC_NEIGHBOUR_SOLICITATION:
1757                 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1758                 ndisc_recv_ns(skb);
1759                 break;
1760
1761         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1762                 ndisc_recv_na(skb);
1763                 break;
1764
1765         case NDISC_ROUTER_SOLICITATION:
1766                 ndisc_recv_rs(skb);
1767                 break;
1768
1769         case NDISC_ROUTER_ADVERTISEMENT:
1770                 ndisc_router_discovery(skb);
1771                 break;
1772
1773         case NDISC_REDIRECT:
1774                 ndisc_redirect_rcv(skb);
1775                 break;
1776         }
1777
1778         return 0;
1779 }
1780
1781 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1782 {
1783         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1784         struct netdev_notifier_change_info *change_info;
1785         struct net *net = dev_net(dev);
1786         struct inet6_dev *idev;
1787
1788         switch (event) {
1789         case NETDEV_CHANGEADDR:
1790                 neigh_changeaddr(&nd_tbl, dev);
1791                 fib6_run_gc(0, net, false);
1792                 /* fallthrough */
1793         case NETDEV_UP:
1794                 idev = in6_dev_get(dev);
1795                 if (!idev)
1796                         break;
1797                 if (idev->cnf.ndisc_notify ||
1798                     net->ipv6.devconf_all->ndisc_notify)
1799                         ndisc_send_unsol_na(dev);
1800                 in6_dev_put(idev);
1801                 break;
1802         case NETDEV_CHANGE:
1803                 change_info = ptr;
1804                 if (change_info->flags_changed & IFF_NOARP)
1805                         neigh_changeaddr(&nd_tbl, dev);
1806                 if (!netif_carrier_ok(dev))
1807                         neigh_carrier_down(&nd_tbl, dev);
1808                 break;
1809         case NETDEV_DOWN:
1810                 neigh_ifdown(&nd_tbl, dev);
1811                 fib6_run_gc(0, net, false);
1812                 break;
1813         case NETDEV_NOTIFY_PEERS:
1814                 ndisc_send_unsol_na(dev);
1815                 break;
1816         default:
1817                 break;
1818         }
1819
1820         return NOTIFY_DONE;
1821 }
1822
1823 static struct notifier_block ndisc_netdev_notifier = {
1824         .notifier_call = ndisc_netdev_event,
1825         .priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1826 };
1827
1828 #ifdef CONFIG_SYSCTL
1829 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1830                                          const char *func, const char *dev_name)
1831 {
1832         static char warncomm[TASK_COMM_LEN];
1833         static int warned;
1834         if (strcmp(warncomm, current->comm) && warned < 5) {
1835                 strcpy(warncomm, current->comm);
1836                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1837                         warncomm, func,
1838                         dev_name, ctl->procname,
1839                         dev_name, ctl->procname);
1840                 warned++;
1841         }
1842 }
1843
1844 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1845 {
1846         struct net_device *dev = ctl->extra1;
1847         struct inet6_dev *idev;
1848         int ret;
1849
1850         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1851             (strcmp(ctl->procname, "base_reachable_time") == 0))
1852                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1853
1854         if (strcmp(ctl->procname, "retrans_time") == 0)
1855                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1856
1857         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1858                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1859                                                   buffer, lenp, ppos);
1860
1861         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1862                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1863                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1864                                                      buffer, lenp, ppos);
1865         else
1866                 ret = -1;
1867
1868         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1869                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1870                         idev->nd_parms->reachable_time =
1871                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1872                 idev->tstamp = jiffies;
1873                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1874                 in6_dev_put(idev);
1875         }
1876         return ret;
1877 }
1878
1879
1880 #endif
1881
1882 static int __net_init ndisc_net_init(struct net *net)
1883 {
1884         struct ipv6_pinfo *np;
1885         struct sock *sk;
1886         int err;
1887
1888         err = inet_ctl_sock_create(&sk, PF_INET6,
1889                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1890         if (err < 0) {
1891                 ND_PRINTK(0, err,
1892                           "NDISC: Failed to initialize the control socket (err %d)\n",
1893                           err);
1894                 return err;
1895         }
1896
1897         net->ipv6.ndisc_sk = sk;
1898
1899         np = inet6_sk(sk);
1900         np->hop_limit = 255;
1901         /* Do not loopback ndisc messages */
1902         np->mc_loop = 0;
1903
1904         return 0;
1905 }
1906
1907 static void __net_exit ndisc_net_exit(struct net *net)
1908 {
1909         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1910 }
1911
1912 static struct pernet_operations ndisc_net_ops = {
1913         .init = ndisc_net_init,
1914         .exit = ndisc_net_exit,
1915 };
1916
1917 int __init ndisc_init(void)
1918 {
1919         int err;
1920
1921         err = register_pernet_subsys(&ndisc_net_ops);
1922         if (err)
1923                 return err;
1924         /*
1925          * Initialize the neighbour table
1926          */
1927         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1928
1929 #ifdef CONFIG_SYSCTL
1930         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1931                                     ndisc_ifinfo_sysctl_change);
1932         if (err)
1933                 goto out_unregister_pernet;
1934 out:
1935 #endif
1936         return err;
1937
1938 #ifdef CONFIG_SYSCTL
1939 out_unregister_pernet:
1940         unregister_pernet_subsys(&ndisc_net_ops);
1941         goto out;
1942 #endif
1943 }
1944
1945 int __init ndisc_late_init(void)
1946 {
1947         return register_netdevice_notifier(&ndisc_netdev_notifier);
1948 }
1949
1950 void ndisc_late_cleanup(void)
1951 {
1952         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1953 }
1954
1955 void ndisc_cleanup(void)
1956 {
1957 #ifdef CONFIG_SYSCTL
1958         neigh_sysctl_unregister(&nd_tbl.parms);
1959 #endif
1960         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1961         unregister_pernet_subsys(&ndisc_net_ops);
1962 }