net/ipv6/ndisc.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Neighbour Discovery for IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Mike Shaver             <shaver@ingenia.com>
   9  */
  10
  11 /*
  12  *      Changes:
  13  *
  14  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  15  *      Pierre Ynard                    :       export userland ND options
  16  *                                              through netlink (RDNSS support)
  17  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  18  *                                              of an RA.
  19  *      Janos Farkas                    :       kmalloc failure checks
  20  *      Alexey Kuznetsov                :       state machine reworked
  21  *                                              and moved to net/core.
  22  *      Pekka Savola                    :       RFC2461 validation
  23  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  24  */
  25
  26 #define pr_fmt(fmt) "ICMPv6: " fmt
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/sched.h>
  34 #include <linux/net.h>
  35 #include <linux/in6.h>
  36 #include <linux/route.h>
  37 #include <linux/init.h>
  38 #include <linux/rcupdate.h>
  39 #include <linux/slab.h>
  40 #ifdef CONFIG_SYSCTL
  41 #include <linux/sysctl.h>
  42 #endif
  43
  44 #include <linux/if_addr.h>
  45 #include <linux/if_ether.h>
  46 #include <linux/if_arp.h>
  47 #include <linux/ipv6.h>
  48 #include <linux/icmpv6.h>
  49 #include <linux/jhash.h>
  50
  51 #include <net/sock.h>
  52 #include <net/snmp.h>
  53
  54 #include <net/ipv6.h>
  55 #include <net/protocol.h>
  56 #include <net/ndisc.h>
  57 #include <net/ip6_route.h>
  58 #include <net/addrconf.h>
  59 #include <net/icmp.h>
  60
  61 #include <net/netlink.h>
  62 #include <linux/rtnetlink.h>
  63
  64 #include <net/flow.h>
  65 #include <net/ip6_checksum.h>
  66 #include <net/inet_common.h>
  67 #include <linux/proc_fs.h>
  68
  69 #include <linux/netfilter.h>
  70 #include <linux/netfilter_ipv6.h>
  71
  72 static u32 ndisc_hash(const void *pkey,
  73                       const struct net_device *dev,
  74                       __u32 *hash_rnd);
  75 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
  76 static bool ndisc_allow_add(const struct net_device *dev,
  77                             struct netlink_ext_ack *extack);
  78 static int ndisc_constructor(struct neighbour *neigh);
  79 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  80 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  81 static int pndisc_constructor(struct pneigh_entry *n);
  82 static void pndisc_destructor(struct pneigh_entry *n);
  83 static void pndisc_redo(struct sk_buff *skb);
  84 static int ndisc_is_multicast(const void *pkey);
  85
  86 static const struct neigh_ops ndisc_generic_ops = {
  87         .family =               AF_INET6,
  88         .solicit =              ndisc_solicit,
  89         .error_report =         ndisc_error_report,
  90         .output =               neigh_resolve_output,
  91         .connected_output =     neigh_connected_output,
  92 };
  93
  94 static const struct neigh_ops ndisc_hh_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_resolve_output,
 100 };
 101
 102
 103 static const struct neigh_ops ndisc_direct_ops = {
 104         .family =               AF_INET6,
 105         .output =               neigh_direct_output,
 106         .connected_output =     neigh_direct_output,
 107 };
 108
 109 struct neigh_table nd_tbl = {
 110         .family =       AF_INET6,
 111         .key_len =      sizeof(struct in6_addr),
 112         .protocol =     cpu_to_be16(ETH_P_IPV6),
 113         .hash =         ndisc_hash,
 114         .key_eq =       ndisc_key_eq,
 115         .constructor =  ndisc_constructor,
 116         .pconstructor = pndisc_constructor,
 117         .pdestructor =  pndisc_destructor,
 118         .proxy_redo =   pndisc_redo,
 119         .is_multicast = ndisc_is_multicast,
 120         .allow_add  =   ndisc_allow_add,
 121         .id =           "ndisc_cache",
 122         .parms = {
 123                 .tbl                    = &nd_tbl,
 124                 .reachable_time         = ND_REACHABLE_TIME,
 125                 .data = {
 126                         [NEIGH_VAR_MCAST_PROBES] = 3,
 127                         [NEIGH_VAR_UCAST_PROBES] = 3,
 128                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 129                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 130                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 131                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 132                         [NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
 133                         [NEIGH_VAR_PROXY_QLEN] = 64,
 134                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 135                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 136                 },
 137         },
 138         .gc_interval =    30 * HZ,
 139         .gc_thresh1 =    128,
 140         .gc_thresh2 =    512,
 141         .gc_thresh3 =   1024,
 142 };
 143 EXPORT_SYMBOL_GPL(nd_tbl);
 144
 145 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data,
 146                               int data_len, int pad)
 147 {
 148         int space = __ndisc_opt_addr_space(data_len, pad);
 149         u8 *opt = skb_put(skb, space);
 150
 151         opt[0] = type;
 152         opt[1] = space>>3;
 153
 154         memset(opt + 2, 0, pad);
 155         opt   += pad;
 156         space -= pad;
 157
 158         memcpy(opt+2, data, data_len);
 159         data_len += 2;
 160         opt += data_len;
 161         space -= data_len;
 162         if (space > 0)
 163                 memset(opt, 0, space);
 164 }
 165 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
 166
 167 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
 168                                           void *data, u8 icmp6_type)
 169 {
 170         __ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
 171                                  ndisc_addr_option_pad(skb->dev->type));
 172         ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
 173 }
 174
 175 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
 176                                                    void *ha,
 177                                                    const u8 *ops_data)
 178 {
 179         ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
 180         ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
 181 }
 182
 183 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 184                                             struct nd_opt_hdr *end)
 185 {
 186         int type;
 187         if (!cur || !end || cur >= end)
 188                 return NULL;
 189         type = cur->nd_opt_type;
 190         do {
 191                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 192         } while (cur < end && cur->nd_opt_type != type);
 193         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 194 }
 195
 196 static inline int ndisc_is_useropt(const struct net_device *dev,
 197                                    struct nd_opt_hdr *opt)
 198 {
 199         return opt->nd_opt_type == ND_OPT_PREFIX_INFO ||
 200                 opt->nd_opt_type == ND_OPT_RDNSS ||
 201                 opt->nd_opt_type == ND_OPT_DNSSL ||
 202                 opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
 203                 opt->nd_opt_type == ND_OPT_PREF64 ||
 204                 ndisc_ops_is_useropt(dev, opt->nd_opt_type);
 205 }
 206
 207 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
 208                                              struct nd_opt_hdr *cur,
 209                                              struct nd_opt_hdr *end)
 210 {
 211         if (!cur || !end || cur >= end)
 212                 return NULL;
 213         do {
 214                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 215         } while (cur < end && !ndisc_is_useropt(dev, cur));
 216         return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
 217 }
 218
 219 struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 220                                           u8 *opt, int opt_len,
 221                                           struct ndisc_options *ndopts)
 222 {
 223         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 224
 225         if (!nd_opt || opt_len < 0 || !ndopts)
 226                 return NULL;
 227         memset(ndopts, 0, sizeof(*ndopts));
 228         while (opt_len) {
 229                 int l;
 230                 if (opt_len < sizeof(struct nd_opt_hdr))
 231                         return NULL;
 232                 l = nd_opt->nd_opt_len << 3;
 233                 if (opt_len < l || l == 0)
 234                         return NULL;
 235                 if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
 236                         goto next_opt;
 237                 switch (nd_opt->nd_opt_type) {
 238                 case ND_OPT_SOURCE_LL_ADDR:
 239                 case ND_OPT_TARGET_LL_ADDR:
 240                 case ND_OPT_MTU:
 241                 case ND_OPT_NONCE:
 242                 case ND_OPT_REDIRECT_HDR:
 243                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 244                                 ND_PRINTK(2, warn,
 245                                           "%s: duplicated ND6 option found: type=%d\n",
 246                                           __func__, nd_opt->nd_opt_type);
 247                         } else {
 248                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 249                         }
 250                         break;
 251                 case ND_OPT_PREFIX_INFO:
 252                         ndopts->nd_opts_pi_end = nd_opt;
 253                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 254                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 255                         break;
 256 #ifdef CONFIG_IPV6_ROUTE_INFO
 257                 case ND_OPT_ROUTE_INFO:
 258                         ndopts->nd_opts_ri_end = nd_opt;
 259                         if (!ndopts->nd_opts_ri)
 260                                 ndopts->nd_opts_ri = nd_opt;
 261                         break;
 262 #endif
 263                 default:
 264                         if (ndisc_is_useropt(dev, nd_opt)) {
 265                                 ndopts->nd_useropts_end = nd_opt;
 266                                 if (!ndopts->nd_useropts)
 267                                         ndopts->nd_useropts = nd_opt;
 268                         } else {
 269                                 /*
 270                                  * Unknown options must be silently ignored,
 271                                  * to accommodate future extension to the
 272                                  * protocol.
 273                                  */
 274                                 ND_PRINTK(2, notice,
 275                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 276                                           __func__,
 277                                           nd_opt->nd_opt_type,
 278                                           nd_opt->nd_opt_len);
 279                         }
 280                 }
 281 next_opt:
 282                 opt_len -= l;
 283                 nd_opt = ((void *)nd_opt) + l;
 284         }
 285         return ndopts;
 286 }
 287
 288 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 289 {
 290         switch (dev->type) {
 291         case ARPHRD_ETHER:
 292         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 293         case ARPHRD_FDDI:
 294                 ipv6_eth_mc_map(addr, buf);
 295                 return 0;
 296         case ARPHRD_ARCNET:
 297                 ipv6_arcnet_mc_map(addr, buf);
 298                 return 0;
 299         case ARPHRD_INFINIBAND:
 300                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 301                 return 0;
 302         case ARPHRD_IPGRE:
 303                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 304         default:
 305                 if (dir) {
 306                         memcpy(buf, dev->broadcast, dev->addr_len);
 307                         return 0;
 308                 }
 309         }
 310         return -EINVAL;
 311 }
 312 EXPORT_SYMBOL(ndisc_mc_map);
 313
 314 static u32 ndisc_hash(const void *pkey,
 315                       const struct net_device *dev,
 316                       __u32 *hash_rnd)
 317 {
 318         return ndisc_hashfn(pkey, dev, hash_rnd);
 319 }
 320
 321 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
 322 {
 323         return neigh_key_eq128(n, pkey);
 324 }
 325
 326 static int ndisc_constructor(struct neighbour *neigh)
 327 {
 328         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 329         struct net_device *dev = neigh->dev;
 330         struct inet6_dev *in6_dev;
 331         struct neigh_parms *parms;
 332         bool is_multicast = ipv6_addr_is_multicast(addr);
 333
 334         in6_dev = in6_dev_get(dev);
 335         if (!in6_dev) {
 336                 return -EINVAL;
 337         }
 338
 339         parms = in6_dev->nd_parms;
 340         __neigh_parms_put(neigh->parms);
 341         neigh->parms = neigh_parms_clone(parms);
 342
 343         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 344         if (!dev->header_ops) {
 345                 neigh->nud_state = NUD_NOARP;
 346                 neigh->ops = &ndisc_direct_ops;
 347                 neigh->output = neigh_direct_output;
 348         } else {
 349                 if (is_multicast) {
 350                         neigh->nud_state = NUD_NOARP;
 351                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 352                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 353                         neigh->nud_state = NUD_NOARP;
 354                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 355                         if (dev->flags&IFF_LOOPBACK)
 356                                 neigh->type = RTN_LOCAL;
 357                 } else if (dev->flags&IFF_POINTOPOINT) {
 358                         neigh->nud_state = NUD_NOARP;
 359                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 360                 }
 361                 if (dev->header_ops->cache)
 362                         neigh->ops = &ndisc_hh_ops;
 363                 else
 364                         neigh->ops = &ndisc_generic_ops;
 365                 if (neigh->nud_state&NUD_VALID)
 366                         neigh->output = neigh->ops->connected_output;
 367                 else
 368                         neigh->output = neigh->ops->output;
 369         }
 370         in6_dev_put(in6_dev);
 371         return 0;
 372 }
 373
 374 static int pndisc_constructor(struct pneigh_entry *n)
 375 {
 376         struct in6_addr *addr = (struct in6_addr *)&n->key;
 377         struct in6_addr maddr;
 378         struct net_device *dev = n->dev;
 379
 380         if (!dev || !__in6_dev_get(dev))
 381                 return -EINVAL;
 382         addrconf_addr_solict_mult(addr, &maddr);
 383         ipv6_dev_mc_inc(dev, &maddr);
 384         return 0;
 385 }
 386
 387 static void pndisc_destructor(struct pneigh_entry *n)
 388 {
 389         struct in6_addr *addr = (struct in6_addr *)&n->key;
 390         struct in6_addr maddr;
 391         struct net_device *dev = n->dev;
 392
 393         if (!dev || !__in6_dev_get(dev))
 394                 return;
 395         addrconf_addr_solict_mult(addr, &maddr);
 396         ipv6_dev_mc_dec(dev, &maddr);
 397 }
 398
 399 /* called with rtnl held */
 400 static bool ndisc_allow_add(const struct net_device *dev,
 401                             struct netlink_ext_ack *extack)
 402 {
 403         struct inet6_dev *idev = __in6_dev_get(dev);
 404
 405         if (!idev || idev->cnf.disable_ipv6) {
 406                 NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device");
 407                 return false;
 408         }
 409
 410         return true;
 411 }
 412
 413 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 414                                        int len)
 415 {
 416         int hlen = LL_RESERVED_SPACE(dev);
 417         int tlen = dev->needed_tailroom;
 418         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 419         struct sk_buff *skb;
 420
 421         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 422         if (!skb) {
 423                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 424                           __func__);
 425                 return NULL;
 426         }
 427
 428         skb->protocol = htons(ETH_P_IPV6);
 429         skb->dev = dev;
 430
 431         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 432         skb_reset_transport_header(skb);
 433
 434         /* Manually assign socket ownership as we avoid calling
 435          * sock_alloc_send_pskb() to bypass wmem buffer limits
 436          */
 437         skb_set_owner_w(skb, sk);
 438
 439         return skb;
 440 }
 441
 442 static void ip6_nd_hdr(struct sk_buff *skb,
 443                        const struct in6_addr *saddr,
 444                        const struct in6_addr *daddr,
 445                        int hop_limit, int len)
 446 {
 447         struct ipv6hdr *hdr;
 448         struct inet6_dev *idev;
 449         unsigned tclass;
 450
 451         rcu_read_lock();
 452         idev = __in6_dev_get(skb->dev);
 453         tclass = idev ? idev->cnf.ndisc_tclass : 0;
 454         rcu_read_unlock();
 455
 456         skb_push(skb, sizeof(*hdr));
 457         skb_reset_network_header(skb);
 458         hdr = ipv6_hdr(skb);
 459
 460         ip6_flow_hdr(hdr, tclass, 0);
 461
 462         hdr->payload_len = htons(len);
 463         hdr->nexthdr = IPPROTO_ICMPV6;
 464         hdr->hop_limit = hop_limit;
 465
 466         hdr->saddr = *saddr;
 467         hdr->daddr = *daddr;
 468 }
 469
 470 static void ndisc_send_skb(struct sk_buff *skb,
 471                            const struct in6_addr *daddr,
 472                            const struct in6_addr *saddr)
 473 {
 474         struct dst_entry *dst = skb_dst(skb);
 475         struct net *net = dev_net(skb->dev);
 476         struct sock *sk = net->ipv6.ndisc_sk;
 477         struct inet6_dev *idev;
 478         int err;
 479         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 480         u8 type;
 481
 482         type = icmp6h->icmp6_type;
 483
 484         if (!dst) {
 485                 struct flowi6 fl6;
 486                 int oif = skb->dev->ifindex;
 487
 488                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 489                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 490                 if (IS_ERR(dst)) {
 491                         kfree_skb(skb);
 492                         return;
 493                 }
 494
 495                 skb_dst_set(skb, dst);
 496         }
 497
 498         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 499                                               IPPROTO_ICMPV6,
 500                                               csum_partial(icmp6h,
 501                                                            skb->len, 0));
 502
 503         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 504
 505         rcu_read_lock();
 506         idev = __in6_dev_get(dst->dev);
 507         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 508
 509         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
 510                       net, sk, skb, NULL, dst->dev,
 511                       dst_output);
 512         if (!err) {
 513                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 514                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 515         }
 516
 517         rcu_read_unlock();
 518 }
 519
 520 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
 521                    const struct in6_addr *solicited_addr,
 522                    bool router, bool solicited, bool override, bool inc_opt)
 523 {
 524         struct sk_buff *skb;
 525         struct in6_addr tmpaddr;
 526         struct inet6_ifaddr *ifp;
 527         const struct in6_addr *src_addr;
 528         struct nd_msg *msg;
 529         int optlen = 0;
 530
 531         /* for anycast or proxy, solicited_addr != src_addr */
 532         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 533         if (ifp) {
 534                 src_addr = solicited_addr;
 535                 if (ifp->flags & IFA_F_OPTIMISTIC)
 536                         override = false;
 537                 inc_opt |= ifp->idev->cnf.force_tllao;
 538                 in6_ifa_put(ifp);
 539         } else {
 540                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 541                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 542                                        &tmpaddr))
 543                         return;
 544                 src_addr = &tmpaddr;
 545         }
 546
 547         if (!dev->addr_len)
 548                 inc_opt = false;
 549         if (inc_opt)
 550                 optlen += ndisc_opt_addr_space(dev,
 551                                                NDISC_NEIGHBOUR_ADVERTISEMENT);
 552
 553         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 554         if (!skb)
 555                 return;
 556
 557         msg = skb_put(skb, sizeof(*msg));
 558         *msg = (struct nd_msg) {
 559                 .icmph = {
 560                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 561                         .icmp6_router = router,
 562                         .icmp6_solicited = solicited,
 563                         .icmp6_override = override,
 564                 },
 565                 .target = *solicited_addr,
 566         };
 567
 568         if (inc_opt)
 569                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 570                                        dev->dev_addr,
 571                                        NDISC_NEIGHBOUR_ADVERTISEMENT);
 572
 573         ndisc_send_skb(skb, daddr, src_addr);
 574 }
 575
 576 static void ndisc_send_unsol_na(struct net_device *dev)
 577 {
 578         struct inet6_dev *idev;
 579         struct inet6_ifaddr *ifa;
 580
 581         idev = in6_dev_get(dev);
 582         if (!idev)
 583                 return;
 584
 585         read_lock_bh(&idev->lock);
 586         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 587                 /* skip tentative addresses until dad completes */
 588                 if (ifa->flags & IFA_F_TENTATIVE &&
 589                     !(ifa->flags & IFA_F_OPTIMISTIC))
 590                         continue;
 591
 592                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
 593                               /*router=*/ !!idev->cnf.forwarding,
 594                               /*solicited=*/ false, /*override=*/ true,
 595                               /*inc_opt=*/ true);
 596         }
 597         read_unlock_bh(&idev->lock);
 598
 599         in6_dev_put(idev);
 600 }
 601
 602 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
 603                    const struct in6_addr *daddr, const struct in6_addr *saddr,
 604                    u64 nonce)
 605 {
 606         struct sk_buff *skb;
 607         struct in6_addr addr_buf;
 608         int inc_opt = dev->addr_len;
 609         int optlen = 0;
 610         struct nd_msg *msg;
 611
 612         if (!saddr) {
 613                 if (ipv6_get_lladdr(dev, &addr_buf,
 614                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 615                         return;
 616                 saddr = &addr_buf;
 617         }
 618
 619         if (ipv6_addr_any(saddr))
 620                 inc_opt = false;
 621         if (inc_opt)
 622                 optlen += ndisc_opt_addr_space(dev,
 623                                                NDISC_NEIGHBOUR_SOLICITATION);
 624         if (nonce != 0)
 625                 optlen += 8;
 626
 627         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 628         if (!skb)
 629                 return;
 630
 631         msg = skb_put(skb, sizeof(*msg));
 632         *msg = (struct nd_msg) {
 633                 .icmph = {
 634                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 635                 },
 636                 .target = *solicit,
 637         };
 638
 639         if (inc_opt)
 640                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 641                                        dev->dev_addr,
 642                                        NDISC_NEIGHBOUR_SOLICITATION);
 643         if (nonce != 0) {
 644                 u8 *opt = skb_put(skb, 8);
 645
 646                 opt[0] = ND_OPT_NONCE;
 647                 opt[1] = 8 >> 3;
 648                 memcpy(opt + 2, &nonce, 6);
 649         }
 650
 651         ndisc_send_skb(skb, daddr, saddr);
 652 }
 653
 654 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 655                    const struct in6_addr *daddr)
 656 {
 657         struct sk_buff *skb;
 658         struct rs_msg *msg;
 659         int send_sllao = dev->addr_len;
 660         int optlen = 0;
 661
 662 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 663         /*
 664          * According to section 2.2 of RFC 4429, we must not
 665          * send router solicitations with a sllao from
 666          * optimistic addresses, but we may send the solicitation
 667          * if we don't include the sllao.  So here we check
 668          * if our address is optimistic, and if so, we
 669          * suppress the inclusion of the sllao.
 670          */
 671         if (send_sllao) {
 672                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 673                                                            dev, 1);
 674                 if (ifp) {
 675                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 676                                 send_sllao = 0;
 677                         }
 678                         in6_ifa_put(ifp);
 679                 } else {
 680                         send_sllao = 0;
 681                 }
 682         }
 683 #endif
 684         if (send_sllao)
 685                 optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
 686
 687         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 688         if (!skb)
 689                 return;
 690
 691         msg = skb_put(skb, sizeof(*msg));
 692         *msg = (struct rs_msg) {
 693                 .icmph = {
 694                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 695                 },
 696         };
 697
 698         if (send_sllao)
 699                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 700                                        dev->dev_addr,
 701                                        NDISC_ROUTER_SOLICITATION);
 702
 703         ndisc_send_skb(skb, daddr, saddr);
 704 }
 705
 706
 707 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 708 {
 709         /*
 710          *      "The sender MUST return an ICMP
 711          *       destination unreachable"
 712          */
 713         dst_link_failure(skb);
 714         kfree_skb(skb);
 715 }
 716
 717 /* Called with locked neigh: either read or both */
 718
 719 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 720 {
 721         struct in6_addr *saddr = NULL;
 722         struct in6_addr mcaddr;
 723         struct net_device *dev = neigh->dev;
 724         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 725         int probes = atomic_read(&neigh->probes);
 726
 727         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 728                                            dev, false, 1,
 729                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 730                 saddr = &ipv6_hdr(skb)->saddr;
 731         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 732         if (probes < 0) {
 733                 if (!(neigh->nud_state & NUD_VALID)) {
 734                         ND_PRINTK(1, dbg,
 735                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 736                                   __func__, target);
 737                 }
 738                 ndisc_send_ns(dev, target, target, saddr, 0);
 739         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 740                 neigh_app_ns(neigh);
 741         } else {
 742                 addrconf_addr_solict_mult(target, &mcaddr);
 743                 ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
 744         }
 745 }
 746
 747 static int pndisc_is_router(const void *pkey,
 748                             struct net_device *dev)
 749 {
 750         struct pneigh_entry *n;
 751         int ret = -1;
 752
 753         read_lock_bh(&nd_tbl.lock);
 754         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 755         if (n)
 756                 ret = !!(n->flags & NTF_ROUTER);
 757         read_unlock_bh(&nd_tbl.lock);
 758
 759         return ret;
 760 }
 761
 762 void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
 763                   const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
 764                   struct ndisc_options *ndopts)
 765 {
 766         neigh_update(neigh, lladdr, new, flags, 0);
 767         /* report ndisc ops about neighbour update */
 768         ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
 769 }
 770
 771 static void ndisc_recv_ns(struct sk_buff *skb)
 772 {
 773         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 774         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 775         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 776         u8 *lladdr = NULL;
 777         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 778                                     offsetof(struct nd_msg, opt));
 779         struct ndisc_options ndopts;
 780         struct net_device *dev = skb->dev;
 781         struct inet6_ifaddr *ifp;
 782         struct inet6_dev *idev = NULL;
 783         struct neighbour *neigh;
 784         int dad = ipv6_addr_any(saddr);
 785         bool inc;
 786         int is_router = -1;
 787         u64 nonce = 0;
 788
 789         if (skb->len < sizeof(struct nd_msg)) {
 790                 ND_PRINTK(2, warn, "NS: packet too short\n");
 791                 return;
 792         }
 793
 794         if (ipv6_addr_is_multicast(&msg->target)) {
 795                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 796                 return;
 797         }
 798
 799         /*
 800          * RFC2461 7.1.1:
 801          * DAD has to be destined for solicited node multicast address.
 802          */
 803         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 804                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 805                 return;
 806         }
 807
 808         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 809                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 810                 return;
 811         }
 812
 813         if (ndopts.nd_opts_src_lladdr) {
 814                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 815                 if (!lladdr) {
 816                         ND_PRINTK(2, warn,
 817                                   "NS: invalid link-layer address length\n");
 818                         return;
 819                 }
 820
 821                 /* RFC2461 7.1.1:
 822                  *      If the IP source address is the unspecified address,
 823                  *      there MUST NOT be source link-layer address option
 824                  *      in the message.
 825                  */
 826                 if (dad) {
 827                         ND_PRINTK(2, warn,
 828                                   "NS: bad DAD packet (link-layer address option)\n");
 829                         return;
 830                 }
 831         }
 832         if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
 833                 memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
 834
 835         inc = ipv6_addr_is_multicast(daddr);
 836
 837         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 838         if (ifp) {
 839 have_ifp:
 840                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 841                         if (dad) {
 842                                 if (nonce != 0 && ifp->dad_nonce == nonce) {
 843                                         u8 *np = (u8 *)&nonce;
 844                                         /* Matching nonce if looped back */
 845                                         ND_PRINTK(2, notice,
 846                                                   "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
 847                                                   ifp->idev->dev->name,
 848                                                   &ifp->addr, np);
 849                                         goto out;
 850                                 }
 851                                 /*
 852                                  * We are colliding with another node
 853                                  * who is doing DAD
 854                                  * so fail our DAD process
 855                                  */
 856                                 addrconf_dad_failure(skb, ifp);
 857                                 return;
 858                         } else {
 859                                 /*
 860                                  * This is not a dad solicitation.
 861                                  * If we are an optimistic node,
 862                                  * we should respond.
 863                                  * Otherwise, we should ignore it.
 864                                  */
 865                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 866                                         goto out;
 867                         }
 868                 }
 869
 870                 idev = ifp->idev;
 871         } else {
 872                 struct net *net = dev_net(dev);
 873
 874                 /* perhaps an address on the master device */
 875                 if (netif_is_l3_slave(dev)) {
 876                         struct net_device *mdev;
 877
 878                         mdev = netdev_master_upper_dev_get_rcu(dev);
 879                         if (mdev) {
 880                                 ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
 881                                 if (ifp)
 882                                         goto have_ifp;
 883                         }
 884                 }
 885
 886                 idev = in6_dev_get(dev);
 887                 if (!idev) {
 888                         /* XXX: count this drop? */
 889                         return;
 890                 }
 891
 892                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 893                     (idev->cnf.forwarding &&
 894                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 895                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 896                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 897                             skb->pkt_type != PACKET_HOST &&
 898                             inc &&
 899                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 900                                 /*
 901                                  * for anycast or proxy,
 902                                  * sender should delay its response
 903                                  * by a random time between 0 and
 904                                  * MAX_ANYCAST_DELAY_TIME seconds.
 905                                  * (RFC2461) -- yoshfuji
 906                                  */
 907                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 908                                 if (n)
 909                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 910                                 goto out;
 911                         }
 912                 } else
 913                         goto out;
 914         }
 915
 916         if (is_router < 0)
 917                 is_router = idev->cnf.forwarding;
 918
 919         if (dad) {
 920                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
 921                               !!is_router, false, (ifp != NULL), true);
 922                 goto out;
 923         }
 924
 925         if (inc)
 926                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 927         else
 928                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 929
 930         /*
 931          *      update / create cache entry
 932          *      for the source address
 933          */
 934         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 935                                !inc || lladdr || !dev->addr_len);
 936         if (neigh)
 937                 ndisc_update(dev, neigh, lladdr, NUD_STALE,
 938                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 939                              NEIGH_UPDATE_F_OVERRIDE,
 940                              NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
 941         if (neigh || !dev->header_ops) {
 942                 ndisc_send_na(dev, saddr, &msg->target, !!is_router,
 943                               true, (ifp != NULL && inc), inc);
 944                 if (neigh)
 945                         neigh_release(neigh);
 946         }
 947
 948 out:
 949         if (ifp)
 950                 in6_ifa_put(ifp);
 951         else
 952                 in6_dev_put(idev);
 953 }
 954
 955 static void ndisc_recv_na(struct sk_buff *skb)
 956 {
 957         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 958         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 959         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 960         u8 *lladdr = NULL;
 961         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 962                                     offsetof(struct nd_msg, opt));
 963         struct ndisc_options ndopts;
 964         struct net_device *dev = skb->dev;
 965         struct inet6_dev *idev = __in6_dev_get(dev);
 966         struct inet6_ifaddr *ifp;
 967         struct neighbour *neigh;
 968
 969         if (skb->len < sizeof(struct nd_msg)) {
 970                 ND_PRINTK(2, warn, "NA: packet too short\n");
 971                 return;
 972         }
 973
 974         if (ipv6_addr_is_multicast(&msg->target)) {
 975                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 976                 return;
 977         }
 978
 979         if (ipv6_addr_is_multicast(daddr) &&
 980             msg->icmph.icmp6_solicited) {
 981                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 982                 return;
 983         }
 984
 985         /* For some 802.11 wireless deployments (and possibly other networks),
 986          * there will be a NA proxy and unsolicitd packets are attacks
 987          * and thus should not be accepted.
 988          */
 989         if (!msg->icmph.icmp6_solicited && idev &&
 990             idev->cnf.drop_unsolicited_na)
 991                 return;
 992
 993         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 994                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 995                 return;
 996         }
 997         if (ndopts.nd_opts_tgt_lladdr) {
 998                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 999                 if (!lladdr) {
1000                         ND_PRINTK(2, warn,
1001                                   "NA: invalid link-layer address length\n");
1002                         return;
1003                 }
1004         }
1005         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
1006         if (ifp) {
1007                 if (skb->pkt_type != PACKET_LOOPBACK
1008                     && (ifp->flags & IFA_F_TENTATIVE)) {
1009                                 addrconf_dad_failure(skb, ifp);
1010                                 return;
1011                 }
1012                 /* What should we make now? The advertisement
1013                    is invalid, but ndisc specs say nothing
1014                    about it. It could be misconfiguration, or
1015                    an smart proxy agent tries to help us :-)
1016
1017                    We should not print the error if NA has been
1018                    received from loopback - it is just our own
1019                    unsolicited advertisement.
1020                  */
1021                 if (skb->pkt_type != PACKET_LOOPBACK)
1022                         ND_PRINTK(1, warn,
1023                                   "NA: %pM advertised our address %pI6c on %s!\n",
1024                                   eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1025                 in6_ifa_put(ifp);
1026                 return;
1027         }
1028         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1029
1030         if (neigh) {
1031                 u8 old_flags = neigh->flags;
1032                 struct net *net = dev_net(dev);
1033
1034                 if (neigh->nud_state & NUD_FAILED)
1035                         goto out;
1036
1037                 /*
1038                  * Don't update the neighbor cache entry on a proxy NA from
1039                  * ourselves because either the proxied node is off link or it
1040                  * has already sent a NA to us.
1041                  */
1042                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1043                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1044                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1045                         /* XXX: idev->cnf.proxy_ndp */
1046                         goto out;
1047                 }
1048
1049                 ndisc_update(dev, neigh, lladdr,
1050                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
1051                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1052                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1053                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1054                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1055                              NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1056
1057                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1058                         /*
1059                          * Change: router to host
1060                          */
1061                         rt6_clean_tohost(dev_net(dev),  saddr);
1062                 }
1063
1064 out:
1065                 neigh_release(neigh);
1066         }
1067 }
1068
1069 static void ndisc_recv_rs(struct sk_buff *skb)
1070 {
1071         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1072         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1073         struct neighbour *neigh;
1074         struct inet6_dev *idev;
1075         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1076         struct ndisc_options ndopts;
1077         u8 *lladdr = NULL;
1078
1079         if (skb->len < sizeof(*rs_msg))
1080                 return;
1081
1082         idev = __in6_dev_get(skb->dev);
1083         if (!idev) {
1084                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
1085                 return;
1086         }
1087
1088         /* Don't accept RS if we're not in router mode */
1089         if (!idev->cnf.forwarding)
1090                 goto out;
1091
1092         /*
1093          * Don't update NCE if src = ::;
1094          * this implies that the source node has no ip address assigned yet.
1095          */
1096         if (ipv6_addr_any(saddr))
1097                 goto out;
1098
1099         /* Parse ND options */
1100         if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts)) {
1101                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
1102                 goto out;
1103         }
1104
1105         if (ndopts.nd_opts_src_lladdr) {
1106                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1107                                              skb->dev);
1108                 if (!lladdr)
1109                         goto out;
1110         }
1111
1112         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1113         if (neigh) {
1114                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1115                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1116                              NEIGH_UPDATE_F_OVERRIDE|
1117                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1118                              NDISC_ROUTER_SOLICITATION, &ndopts);
1119                 neigh_release(neigh);
1120         }
1121 out:
1122         return;
1123 }
1124
1125 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1126 {
1127         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1128         struct sk_buff *skb;
1129         struct nlmsghdr *nlh;
1130         struct nduseroptmsg *ndmsg;
1131         struct net *net = dev_net(ra->dev);
1132         int err;
1133         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1134                                     + (opt->nd_opt_len << 3));
1135         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1136
1137         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1138         if (!skb) {
1139                 err = -ENOBUFS;
1140                 goto errout;
1141         }
1142
1143         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1144         if (!nlh) {
1145                 goto nla_put_failure;
1146         }
1147
1148         ndmsg = nlmsg_data(nlh);
1149         ndmsg->nduseropt_family = AF_INET6;
1150         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1151         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1152         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1153         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1154
1155         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1156
1157         if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1158                 goto nla_put_failure;
1159         nlmsg_end(skb, nlh);
1160
1161         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1162         return;
1163
1164 nla_put_failure:
1165         nlmsg_free(skb);
1166         err = -EMSGSIZE;
1167 errout:
1168         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1169 }
1170
1171 static void ndisc_router_discovery(struct sk_buff *skb)
1172 {
1173         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1174         struct neighbour *neigh = NULL;
1175         struct inet6_dev *in6_dev;
1176         struct fib6_info *rt = NULL;
1177         u32 defrtr_usr_metric;
1178         struct net *net;
1179         int lifetime;
1180         struct ndisc_options ndopts;
1181         int optlen;
1182         unsigned int pref = 0;
1183         __u32 old_if_flags;
1184         bool send_ifinfo_notify = false;
1185
1186         __u8 *opt = (__u8 *)(ra_msg + 1);
1187
1188         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1189                 sizeof(struct ra_msg);
1190
1191         ND_PRINTK(2, info,
1192                   "RA: %s, dev: %s\n",
1193                   __func__, skb->dev->name);
1194         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1195                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1196                 return;
1197         }
1198         if (optlen < 0) {
1199                 ND_PRINTK(2, warn, "RA: packet too short\n");
1200                 return;
1201         }
1202
1203 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1204         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1205                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1206                 return;
1207         }
1208 #endif
1209
1210         /*
1211          *      set the RA_RECV flag in the interface
1212          */
1213
1214         in6_dev = __in6_dev_get(skb->dev);
1215         if (!in6_dev) {
1216                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1217                           skb->dev->name);
1218                 return;
1219         }
1220
1221         if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts)) {
1222                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1223                 return;
1224         }
1225
1226         if (!ipv6_accept_ra(in6_dev)) {
1227                 ND_PRINTK(2, info,
1228                           "RA: %s, did not accept ra for dev: %s\n",
1229                           __func__, skb->dev->name);
1230                 goto skip_linkparms;
1231         }
1232
1233 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1234         /* skip link-specific parameters from interior routers */
1235         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1236                 ND_PRINTK(2, info,
1237                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1238                           __func__, skb->dev->name);
1239                 goto skip_linkparms;
1240         }
1241 #endif
1242
1243         if (in6_dev->if_flags & IF_RS_SENT) {
1244                 /*
1245                  *      flag that an RA was received after an RS was sent
1246                  *      out on this interface.
1247                  */
1248                 in6_dev->if_flags |= IF_RA_RCVD;
1249         }
1250
1251         /*
1252          * Remember the managed/otherconf flags from most recently
1253          * received RA message (RFC 2462) -- yoshfuji
1254          */
1255         old_if_flags = in6_dev->if_flags;
1256         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1257                                 IF_RA_OTHERCONF)) |
1258                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1259                                         IF_RA_MANAGED : 0) |
1260                                 (ra_msg->icmph.icmp6_addrconf_other ?
1261                                         IF_RA_OTHERCONF : 0);
1262
1263         if (old_if_flags != in6_dev->if_flags)
1264                 send_ifinfo_notify = true;
1265
1266         if (!in6_dev->cnf.accept_ra_defrtr) {
1267                 ND_PRINTK(2, info,
1268                           "RA: %s, defrtr is false for dev: %s\n",
1269                           __func__, skb->dev->name);
1270                 goto skip_defrtr;
1271         }
1272
1273         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1274         if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_lft) {
1275                 ND_PRINTK(2, info,
1276                           "RA: router lifetime (%ds) is too short: %s\n",
1277                           lifetime, skb->dev->name);
1278                 goto skip_defrtr;
1279         }
1280
1281         /* Do not accept RA with source-addr found on local machine unless
1282          * accept_ra_from_local is set to true.
1283          */
1284         net = dev_net(in6_dev->dev);
1285         if (!in6_dev->cnf.accept_ra_from_local &&
1286             ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) {
1287                 ND_PRINTK(2, info,
1288                           "RA from local address detected on dev: %s: default router ignored\n",
1289                           skb->dev->name);
1290                 goto skip_defrtr;
1291         }
1292
1293 #ifdef CONFIG_IPV6_ROUTER_PREF
1294         pref = ra_msg->icmph.icmp6_router_pref;
1295         /* 10b is handled as if it were 00b (medium) */
1296         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1297             !in6_dev->cnf.accept_ra_rtr_pref)
1298                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1299 #endif
1300         /* routes added from RAs do not use nexthop objects */
1301         rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev);
1302         if (rt) {
1303                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1304                                          rt->fib6_nh->fib_nh_dev, NULL,
1305                                           &ipv6_hdr(skb)->saddr);
1306                 if (!neigh) {
1307                         ND_PRINTK(0, err,
1308                                   "RA: %s got default router without neighbour\n",
1309                                   __func__);
1310                         fib6_info_release(rt);
1311                         return;
1312                 }
1313         }
1314         /* Set default route metric as specified by user */
1315         defrtr_usr_metric = in6_dev->cnf.ra_defrtr_metric;
1316         /* delete the route if lifetime is 0 or if metric needs change */
1317         if (rt && (lifetime == 0 || rt->fib6_metric != defrtr_usr_metric)) {
1318                 ip6_del_rt(net, rt, false);
1319                 rt = NULL;
1320         }
1321
1322         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, metric: %d, for dev: %s\n",
1323                   rt, lifetime, defrtr_usr_metric, skb->dev->name);
1324         if (!rt && lifetime) {
1325                 ND_PRINTK(3, info, "RA: adding default router\n");
1326
1327                 if (neigh)
1328                         neigh_release(neigh);
1329
1330                 rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
1331                                          skb->dev, pref, defrtr_usr_metric);
1332                 if (!rt) {
1333                         ND_PRINTK(0, err,
1334                                   "RA: %s failed to add default route\n",
1335                                   __func__);
1336                         return;
1337                 }
1338
1339                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1340                                          rt->fib6_nh->fib_nh_dev, NULL,
1341                                           &ipv6_hdr(skb)->saddr);
1342                 if (!neigh) {
1343                         ND_PRINTK(0, err,
1344                                   "RA: %s got default router without neighbour\n",
1345                                   __func__);
1346                         fib6_info_release(rt);
1347                         return;
1348                 }
1349                 neigh->flags |= NTF_ROUTER;
1350         } else if (rt) {
1351                 rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1352         }
1353
1354         if (rt)
1355                 fib6_set_expires(rt, jiffies + (HZ * lifetime));
1356         if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1357             ra_msg->icmph.icmp6_hop_limit) {
1358                 if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1359                         in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1360                         fib6_metric_set(rt, RTAX_HOPLIMIT,
1361                                         ra_msg->icmph.icmp6_hop_limit);
1362                 } else {
1363                         ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1364                 }
1365         }
1366
1367 skip_defrtr:
1368
1369         /*
1370          *      Update Reachable Time and Retrans Timer
1371          */
1372
1373         if (in6_dev->nd_parms) {
1374                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1375
1376                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1377                         rtime = (rtime*HZ)/1000;
1378                         if (rtime < HZ/100)
1379                                 rtime = HZ/100;
1380                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1381                         in6_dev->tstamp = jiffies;
1382                         send_ifinfo_notify = true;
1383                 }
1384
1385                 rtime = ntohl(ra_msg->reachable_time);
1386                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1387                         rtime = (rtime*HZ)/1000;
1388
1389                         if (rtime < HZ/10)
1390                                 rtime = HZ/10;
1391
1392                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1393                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1394                                               BASE_REACHABLE_TIME, rtime);
1395                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1396                                               GC_STALETIME, 3 * rtime);
1397                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1398                                 in6_dev->tstamp = jiffies;
1399                                 send_ifinfo_notify = true;
1400                         }
1401                 }
1402         }
1403
1404 skip_linkparms:
1405
1406         /*
1407          *      Process options.
1408          */
1409
1410         if (!neigh)
1411                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1412                                        skb->dev, 1);
1413         if (neigh) {
1414                 u8 *lladdr = NULL;
1415                 if (ndopts.nd_opts_src_lladdr) {
1416                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1417                                                      skb->dev);
1418                         if (!lladdr) {
1419                                 ND_PRINTK(2, warn,
1420                                           "RA: invalid link-layer address length\n");
1421                                 goto out;
1422                         }
1423                 }
1424                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1425                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1426                              NEIGH_UPDATE_F_OVERRIDE|
1427                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1428                              NEIGH_UPDATE_F_ISROUTER,
1429                              NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1430         }
1431
1432         if (!ipv6_accept_ra(in6_dev)) {
1433                 ND_PRINTK(2, info,
1434                           "RA: %s, accept_ra is false for dev: %s\n",
1435                           __func__, skb->dev->name);
1436                 goto out;
1437         }
1438
1439 #ifdef CONFIG_IPV6_ROUTE_INFO
1440         if (!in6_dev->cnf.accept_ra_from_local &&
1441             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1442                           in6_dev->dev, 0)) {
1443                 ND_PRINTK(2, info,
1444                           "RA from local address detected on dev: %s: router info ignored.\n",
1445                           skb->dev->name);
1446                 goto skip_routeinfo;
1447         }
1448
1449         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1450                 struct nd_opt_hdr *p;
1451                 for (p = ndopts.nd_opts_ri;
1452                      p;
1453                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1454                         struct route_info *ri = (struct route_info *)p;
1455 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1456                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1457                             ri->prefix_len == 0)
1458                                 continue;
1459 #endif
1460                         if (ri->prefix_len == 0 &&
1461                             !in6_dev->cnf.accept_ra_defrtr)
1462                                 continue;
1463                         if (ri->lifetime != 0 &&
1464                             ntohl(ri->lifetime) < in6_dev->cnf.accept_ra_min_lft)
1465                                 continue;
1466                         if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1467                                 continue;
1468                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1469                                 continue;
1470                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1471                                       &ipv6_hdr(skb)->saddr);
1472                 }
1473         }
1474
1475 skip_routeinfo:
1476 #endif
1477
1478 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1479         /* skip link-specific ndopts from interior routers */
1480         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1481                 ND_PRINTK(2, info,
1482                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1483                           __func__, skb->dev->name);
1484                 goto out;
1485         }
1486 #endif
1487
1488         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1489                 struct nd_opt_hdr *p;
1490                 for (p = ndopts.nd_opts_pi;
1491                      p;
1492                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1493                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1494                                             (p->nd_opt_len) << 3,
1495                                             ndopts.nd_opts_src_lladdr != NULL);
1496                 }
1497         }
1498
1499         if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1500                 __be32 n;
1501                 u32 mtu;
1502
1503                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1504                 mtu = ntohl(n);
1505
1506                 if (in6_dev->ra_mtu != mtu) {
1507                         in6_dev->ra_mtu = mtu;
1508                         send_ifinfo_notify = true;
1509                 }
1510
1511                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1512                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1513                 } else if (in6_dev->cnf.mtu6 != mtu) {
1514                         in6_dev->cnf.mtu6 = mtu;
1515                         fib6_metric_set(rt, RTAX_MTU, mtu);
1516                         rt6_mtu_change(skb->dev, mtu);
1517                 }
1518         }
1519
1520         if (ndopts.nd_useropts) {
1521                 struct nd_opt_hdr *p;
1522                 for (p = ndopts.nd_useropts;
1523                      p;
1524                      p = ndisc_next_useropt(skb->dev, p,
1525                                             ndopts.nd_useropts_end)) {
1526                         ndisc_ra_useropt(skb, p);
1527                 }
1528         }
1529
1530         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1531                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1532         }
1533 out:
1534         /* Send a notify if RA changed managed/otherconf flags or
1535          * timer settings or ra_mtu value
1536          */
1537         if (send_ifinfo_notify)
1538                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1539
1540         fib6_info_release(rt);
1541         if (neigh)
1542                 neigh_release(neigh);
1543 }
1544
1545 static void ndisc_redirect_rcv(struct sk_buff *skb)
1546 {
1547         u8 *hdr;
1548         struct ndisc_options ndopts;
1549         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1550         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1551                                     offsetof(struct rd_msg, opt));
1552
1553 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1554         switch (skb->ndisc_nodetype) {
1555         case NDISC_NODETYPE_HOST:
1556         case NDISC_NODETYPE_NODEFAULT:
1557                 ND_PRINTK(2, warn,
1558                           "Redirect: from host or unauthorized router\n");
1559                 return;
1560         }
1561 #endif
1562
1563         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1564                 ND_PRINTK(2, warn,
1565                           "Redirect: source address is not link-local\n");
1566                 return;
1567         }
1568
1569         if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1570                 return;
1571
1572         if (!ndopts.nd_opts_rh) {
1573                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1574                                         skb->dev->ifindex);
1575                 return;
1576         }
1577
1578         hdr = (u8 *)ndopts.nd_opts_rh;
1579         hdr += 8;
1580         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1581                 return;
1582
1583         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1584 }
1585
1586 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1587                                            struct sk_buff *orig_skb,
1588                                            int rd_len)
1589 {
1590         u8 *opt = skb_put(skb, rd_len);
1591
1592         memset(opt, 0, 8);
1593         *(opt++) = ND_OPT_REDIRECT_HDR;
1594         *(opt++) = (rd_len >> 3);
1595         opt += 6;
1596
1597         skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1598                       rd_len - 8);
1599 }
1600
1601 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1602 {
1603         struct net_device *dev = skb->dev;
1604         struct net *net = dev_net(dev);
1605         struct sock *sk = net->ipv6.ndisc_sk;
1606         int optlen = 0;
1607         struct inet_peer *peer;
1608         struct sk_buff *buff;
1609         struct rd_msg *msg;
1610         struct in6_addr saddr_buf;
1611         struct rt6_info *rt;
1612         struct dst_entry *dst;
1613         struct flowi6 fl6;
1614         int rd_len;
1615         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1616            ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1617         bool ret;
1618
1619         if (netif_is_l3_master(skb->dev)) {
1620                 dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
1621                 if (!dev)
1622                         return;
1623         }
1624
1625         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1626                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1627                           dev->name);
1628                 return;
1629         }
1630
1631         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1632             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1633                 ND_PRINTK(2, warn,
1634                           "Redirect: target address is not link-local unicast\n");
1635                 return;
1636         }
1637
1638         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1639                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1640
1641         dst = ip6_route_output(net, NULL, &fl6);
1642         if (dst->error) {
1643                 dst_release(dst);
1644                 return;
1645         }
1646         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1647         if (IS_ERR(dst))
1648                 return;
1649
1650         rt = (struct rt6_info *) dst;
1651
1652         if (rt->rt6i_flags & RTF_GATEWAY) {
1653                 ND_PRINTK(2, warn,
1654                           "Redirect: destination is not a neighbour\n");
1655                 goto release;
1656         }
1657         peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1658         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1659         if (peer)
1660                 inet_putpeer(peer);
1661         if (!ret)
1662                 goto release;
1663
1664         if (dev->addr_len) {
1665                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1666                 if (!neigh) {
1667                         ND_PRINTK(2, warn,
1668                                   "Redirect: no neigh for target address\n");
1669                         goto release;
1670                 }
1671
1672                 read_lock_bh(&neigh->lock);
1673                 if (neigh->nud_state & NUD_VALID) {
1674                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1675                         read_unlock_bh(&neigh->lock);
1676                         ha = ha_buf;
1677                         optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1678                                                                 ops_data_buf,
1679                                                                 &ops_data);
1680                 } else
1681                         read_unlock_bh(&neigh->lock);
1682
1683                 neigh_release(neigh);
1684         }
1685
1686         rd_len = min_t(unsigned int,
1687                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1688                        skb->len + 8);
1689         rd_len &= ~0x7;
1690         optlen += rd_len;
1691
1692         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1693         if (!buff)
1694                 goto release;
1695
1696         msg = skb_put(buff, sizeof(*msg));
1697         *msg = (struct rd_msg) {
1698                 .icmph = {
1699                         .icmp6_type = NDISC_REDIRECT,
1700                 },
1701                 .target = *target,
1702                 .dest = ipv6_hdr(skb)->daddr,
1703         };
1704
1705         /*
1706          *      include target_address option
1707          */
1708
1709         if (ha)
1710                 ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1711
1712         /*
1713          *      build redirect option and copy skb over to the new packet.
1714          */
1715
1716         if (rd_len)
1717                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1718
1719         skb_dst_set(buff, dst);
1720         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1721         return;
1722
1723 release:
1724         dst_release(dst);
1725 }
1726
1727 static void pndisc_redo(struct sk_buff *skb)
1728 {
1729         ndisc_recv_ns(skb);
1730         kfree_skb(skb);
1731 }
1732
1733 static int ndisc_is_multicast(const void *pkey)
1734 {
1735         return ipv6_addr_is_multicast((struct in6_addr *)pkey);
1736 }
1737
1738 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1739 {
1740         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1741
1742         if (!idev)
1743                 return true;
1744         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1745             idev->cnf.suppress_frag_ndisc) {
1746                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1747                 return true;
1748         }
1749         return false;
1750 }
1751
1752 int ndisc_rcv(struct sk_buff *skb)
1753 {
1754         struct nd_msg *msg;
1755
1756         if (ndisc_suppress_frag_ndisc(skb))
1757                 return 0;
1758
1759         if (skb_linearize(skb))
1760                 return 0;
1761
1762         msg = (struct nd_msg *)skb_transport_header(skb);
1763
1764         __skb_push(skb, skb->data - skb_transport_header(skb));
1765
1766         if (ipv6_hdr(skb)->hop_limit != 255) {
1767                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1768                           ipv6_hdr(skb)->hop_limit);
1769                 return 0;
1770         }
1771
1772         if (msg->icmph.icmp6_code != 0) {
1773                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1774                           msg->icmph.icmp6_code);
1775                 return 0;
1776         }
1777
1778         switch (msg->icmph.icmp6_type) {
1779         case NDISC_NEIGHBOUR_SOLICITATION:
1780                 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1781                 ndisc_recv_ns(skb);
1782                 break;
1783
1784         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1785                 ndisc_recv_na(skb);
1786                 break;
1787
1788         case NDISC_ROUTER_SOLICITATION:
1789                 ndisc_recv_rs(skb);
1790                 break;
1791
1792         case NDISC_ROUTER_ADVERTISEMENT:
1793                 ndisc_router_discovery(skb);
1794                 break;
1795
1796         case NDISC_REDIRECT:
1797                 ndisc_redirect_rcv(skb);
1798                 break;
1799         }
1800
1801         return 0;
1802 }
1803
1804 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1805 {
1806         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1807         struct netdev_notifier_change_info *change_info;
1808         struct net *net = dev_net(dev);
1809         struct inet6_dev *idev;
1810
1811         switch (event) {
1812         case NETDEV_CHANGEADDR:
1813                 neigh_changeaddr(&nd_tbl, dev);
1814                 fib6_run_gc(0, net, false);
1815                 fallthrough;
1816         case NETDEV_UP:
1817                 idev = in6_dev_get(dev);
1818                 if (!idev)
1819                         break;
1820                 if (idev->cnf.ndisc_notify ||
1821                     net->ipv6.devconf_all->ndisc_notify)
1822                         ndisc_send_unsol_na(dev);
1823                 in6_dev_put(idev);
1824                 break;
1825         case NETDEV_CHANGE:
1826                 change_info = ptr;
1827                 if (change_info->flags_changed & IFF_NOARP)
1828                         neigh_changeaddr(&nd_tbl, dev);
1829                 if (!netif_carrier_ok(dev))
1830                         neigh_carrier_down(&nd_tbl, dev);
1831                 break;
1832         case NETDEV_DOWN:
1833                 neigh_ifdown(&nd_tbl, dev);
1834                 fib6_run_gc(0, net, false);
1835                 break;
1836         case NETDEV_NOTIFY_PEERS:
1837                 ndisc_send_unsol_na(dev);
1838                 break;
1839         default:
1840                 break;
1841         }
1842
1843         return NOTIFY_DONE;
1844 }
1845
1846 static struct notifier_block ndisc_netdev_notifier = {
1847         .notifier_call = ndisc_netdev_event,
1848         .priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1849 };
1850
1851 #ifdef CONFIG_SYSCTL
1852 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1853                                          const char *func, const char *dev_name)
1854 {
1855         static char warncomm[TASK_COMM_LEN];
1856         static int warned;
1857         if (strcmp(warncomm, current->comm) && warned < 5) {
1858                 strcpy(warncomm, current->comm);
1859                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1860                         warncomm, func,
1861                         dev_name, ctl->procname,
1862                         dev_name, ctl->procname);
1863                 warned++;
1864         }
1865 }
1866
1867 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void *buffer,
1868                 size_t *lenp, loff_t *ppos)
1869 {
1870         struct net_device *dev = ctl->extra1;
1871         struct inet6_dev *idev;
1872         int ret;
1873
1874         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1875             (strcmp(ctl->procname, "base_reachable_time") == 0))
1876                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1877
1878         if (strcmp(ctl->procname, "retrans_time") == 0)
1879                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1880
1881         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1882                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1883                                                   buffer, lenp, ppos);
1884
1885         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1886                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1887                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1888                                                      buffer, lenp, ppos);
1889         else
1890                 ret = -1;
1891
1892         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1893                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1894                         idev->nd_parms->reachable_time =
1895                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1896                 idev->tstamp = jiffies;
1897                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1898                 in6_dev_put(idev);
1899         }
1900         return ret;
1901 }
1902
1903
1904 #endif
1905
1906 static int __net_init ndisc_net_init(struct net *net)
1907 {
1908         struct ipv6_pinfo *np;
1909         struct sock *sk;
1910         int err;
1911
1912         err = inet_ctl_sock_create(&sk, PF_INET6,
1913                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1914         if (err < 0) {
1915                 ND_PRINTK(0, err,
1916                           "NDISC: Failed to initialize the control socket (err %d)\n",
1917                           err);
1918                 return err;
1919         }
1920
1921         net->ipv6.ndisc_sk = sk;
1922
1923         np = inet6_sk(sk);
1924         np->hop_limit = 255;
1925         /* Do not loopback ndisc messages */
1926         np->mc_loop = 0;
1927
1928         return 0;
1929 }
1930
1931 static void __net_exit ndisc_net_exit(struct net *net)
1932 {
1933         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1934 }
1935
1936 static struct pernet_operations ndisc_net_ops = {
1937         .init = ndisc_net_init,
1938         .exit = ndisc_net_exit,
1939 };
1940
1941 int __init ndisc_init(void)
1942 {
1943         int err;
1944
1945         err = register_pernet_subsys(&ndisc_net_ops);
1946         if (err)
1947                 return err;
1948         /*
1949          * Initialize the neighbour table
1950          */
1951         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1952
1953 #ifdef CONFIG_SYSCTL
1954         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1955                                     ndisc_ifinfo_sysctl_change);
1956         if (err)
1957                 goto out_unregister_pernet;
1958 out:
1959 #endif
1960         return err;
1961
1962 #ifdef CONFIG_SYSCTL
1963 out_unregister_pernet:
1964         unregister_pernet_subsys(&ndisc_net_ops);
1965         goto out;
1966 #endif
1967 }
1968
1969 int __init ndisc_late_init(void)
1970 {
1971         return register_netdevice_notifier(&ndisc_netdev_notifier);
1972 }
1973
1974 void ndisc_late_cleanup(void)
1975 {
1976         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1977 }
1978
1979 void ndisc_cleanup(void)
1980 {
1981 #ifdef CONFIG_SYSCTL
1982         neigh_sysctl_unregister(&nd_tbl.parms);
1983 #endif
1984         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1985         unregister_pernet_subsys(&ndisc_net_ops);
1986 }