net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Mike Shaver             <shaver@ingenia.com>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  19  *      Pierre Ynard                    :       export userland ND options
  20  *                                              through netlink (RDNSS support)
  21  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  22  *                                              of an RA.
  23  *      Janos Farkas                    :       kmalloc failure checks
  24  *      Alexey Kuznetsov                :       state machine reworked
  25  *                                              and moved to net/core.
  26  *      Pekka Savola                    :       RFC2461 validation
  27  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  28  */
  29
  30 #define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32 #include <linux/module.h>
  33 #include <linux/errno.h>
  34 #include <linux/types.h>
  35 #include <linux/socket.h>
  36 #include <linux/sockios.h>
  37 #include <linux/sched.h>
  38 #include <linux/net.h>
  39 #include <linux/in6.h>
  40 #include <linux/route.h>
  41 #include <linux/init.h>
  42 #include <linux/rcupdate.h>
  43 #include <linux/slab.h>
  44 #ifdef CONFIG_SYSCTL
  45 #include <linux/sysctl.h>
  46 #endif
  47
  48 #include <linux/if_addr.h>
  49 #include <linux/if_arp.h>
  50 #include <linux/ipv6.h>
  51 #include <linux/icmpv6.h>
  52 #include <linux/jhash.h>
  53
  54 #include <net/sock.h>
  55 #include <net/snmp.h>
  56
  57 #include <net/ipv6.h>
  58 #include <net/protocol.h>
  59 #include <net/ndisc.h>
  60 #include <net/ip6_route.h>
  61 #include <net/addrconf.h>
  62 #include <net/icmp.h>
  63
  64 #include <net/netlink.h>
  65 #include <linux/rtnetlink.h>
  66
  67 #include <net/flow.h>
  68 #include <net/ip6_checksum.h>
  69 #include <net/inet_common.h>
  70 #include <linux/proc_fs.h>
  71
  72 #include <linux/netfilter.h>
  73 #include <linux/netfilter_ipv6.h>
  74
  75 /* Set to 3 to get tracing... */
  76 #define ND_DEBUG 1
  77
  78 #define ND_PRINTK(val, level, fmt, ...)                         \
  79 do {                                                            \
  80         if (val <= ND_DEBUG)                                    \
  81                 net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
  82 } while (0)
  83
  84 static u32 ndisc_hash(const void *pkey,
  85                       const struct net_device *dev,
  86                       __u32 *hash_rnd);
  87 static int ndisc_constructor(struct neighbour *neigh);
  88 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  89 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  90 static int pndisc_constructor(struct pneigh_entry *n);
  91 static void pndisc_destructor(struct pneigh_entry *n);
  92 static void pndisc_redo(struct sk_buff *skb);
  93
  94 static const struct neigh_ops ndisc_generic_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_connected_output,
 100 };
 101
 102 static const struct neigh_ops ndisc_hh_ops = {
 103         .family =               AF_INET6,
 104         .solicit =              ndisc_solicit,
 105         .error_report =         ndisc_error_report,
 106         .output =               neigh_resolve_output,
 107         .connected_output =     neigh_resolve_output,
 108 };
 109
 110
 111 static const struct neigh_ops ndisc_direct_ops = {
 112         .family =               AF_INET6,
 113         .output =               neigh_direct_output,
 114         .connected_output =     neigh_direct_output,
 115 };
 116
 117 struct neigh_table nd_tbl = {
 118         .family =       AF_INET6,
 119         .key_len =      sizeof(struct in6_addr),
 120         .hash =         ndisc_hash,
 121         .constructor =  ndisc_constructor,
 122         .pconstructor = pndisc_constructor,
 123         .pdestructor =  pndisc_destructor,
 124         .proxy_redo =   pndisc_redo,
 125         .id =           "ndisc_cache",
 126         .parms = {
 127                 .tbl                    = &nd_tbl,
 128                 .base_reachable_time    = ND_REACHABLE_TIME,
 129                 .retrans_time           = ND_RETRANS_TIMER,
 130                 .gc_staletime           = 60 * HZ,
 131                 .reachable_time         = ND_REACHABLE_TIME,
 132                 .delay_probe_time       = 5 * HZ,
 133                 .queue_len_bytes        = 64*1024,
 134                 .ucast_probes           = 3,
 135                 .mcast_probes           = 3,
 136                 .anycast_delay          = 1 * HZ,
 137                 .proxy_delay            = (8 * HZ) / 10,
 138                 .proxy_qlen             = 64,
 139         },
 140         .gc_interval =    30 * HZ,
 141         .gc_thresh1 =    128,
 142         .gc_thresh2 =    512,
 143         .gc_thresh3 =   1024,
 144 };
 145
 146 static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
 147 {
 148         int pad   = ndisc_addr_option_pad(skb->dev->type);
 149         int data_len = skb->dev->addr_len;
 150         int space = ndisc_opt_addr_space(skb->dev);
 151         u8 *opt = skb_put(skb, space);
 152
 153         opt[0] = type;
 154         opt[1] = space>>3;
 155
 156         memset(opt + 2, 0, pad);
 157         opt   += pad;
 158         space -= pad;
 159
 160         memcpy(opt+2, data, data_len);
 161         data_len += 2;
 162         opt += data_len;
 163         if ((space -= data_len) > 0)
 164                 memset(opt, 0, space);
 165 }
 166
 167 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 168                                             struct nd_opt_hdr *end)
 169 {
 170         int type;
 171         if (!cur || !end || cur >= end)
 172                 return NULL;
 173         type = cur->nd_opt_type;
 174         do {
 175                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 176         } while(cur < end && cur->nd_opt_type != type);
 177         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 178 }
 179
 180 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 181 {
 182         return opt->nd_opt_type == ND_OPT_RDNSS ||
 183                 opt->nd_opt_type == ND_OPT_DNSSL;
 184 }
 185
 186 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 187                                              struct nd_opt_hdr *end)
 188 {
 189         if (!cur || !end || cur >= end)
 190                 return NULL;
 191         do {
 192                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 193         } while(cur < end && !ndisc_is_useropt(cur));
 194         return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 195 }
 196
 197 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 198                                           struct ndisc_options *ndopts)
 199 {
 200         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 201
 202         if (!nd_opt || opt_len < 0 || !ndopts)
 203                 return NULL;
 204         memset(ndopts, 0, sizeof(*ndopts));
 205         while (opt_len) {
 206                 int l;
 207                 if (opt_len < sizeof(struct nd_opt_hdr))
 208                         return NULL;
 209                 l = nd_opt->nd_opt_len << 3;
 210                 if (opt_len < l || l == 0)
 211                         return NULL;
 212                 switch (nd_opt->nd_opt_type) {
 213                 case ND_OPT_SOURCE_LL_ADDR:
 214                 case ND_OPT_TARGET_LL_ADDR:
 215                 case ND_OPT_MTU:
 216                 case ND_OPT_REDIRECT_HDR:
 217                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 218                                 ND_PRINTK(2, warn,
 219                                           "%s: duplicated ND6 option found: type=%d\n",
 220                                           __func__, nd_opt->nd_opt_type);
 221                         } else {
 222                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 223                         }
 224                         break;
 225                 case ND_OPT_PREFIX_INFO:
 226                         ndopts->nd_opts_pi_end = nd_opt;
 227                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 228                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 229                         break;
 230 #ifdef CONFIG_IPV6_ROUTE_INFO
 231                 case ND_OPT_ROUTE_INFO:
 232                         ndopts->nd_opts_ri_end = nd_opt;
 233                         if (!ndopts->nd_opts_ri)
 234                                 ndopts->nd_opts_ri = nd_opt;
 235                         break;
 236 #endif
 237                 default:
 238                         if (ndisc_is_useropt(nd_opt)) {
 239                                 ndopts->nd_useropts_end = nd_opt;
 240                                 if (!ndopts->nd_useropts)
 241                                         ndopts->nd_useropts = nd_opt;
 242                         } else {
 243                                 /*
 244                                  * Unknown options must be silently ignored,
 245                                  * to accommodate future extension to the
 246                                  * protocol.
 247                                  */
 248                                 ND_PRINTK(2, notice,
 249                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 250                                           __func__,
 251                                           nd_opt->nd_opt_type,
 252                                           nd_opt->nd_opt_len);
 253                         }
 254                 }
 255                 opt_len -= l;
 256                 nd_opt = ((void *)nd_opt) + l;
 257         }
 258         return ndopts;
 259 }
 260
 261 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 262 {
 263         switch (dev->type) {
 264         case ARPHRD_ETHER:
 265         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 266         case ARPHRD_FDDI:
 267                 ipv6_eth_mc_map(addr, buf);
 268                 return 0;
 269         case ARPHRD_ARCNET:
 270                 ipv6_arcnet_mc_map(addr, buf);
 271                 return 0;
 272         case ARPHRD_INFINIBAND:
 273                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 274                 return 0;
 275         case ARPHRD_IPGRE:
 276                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 277         default:
 278                 if (dir) {
 279                         memcpy(buf, dev->broadcast, dev->addr_len);
 280                         return 0;
 281                 }
 282         }
 283         return -EINVAL;
 284 }
 285
 286 EXPORT_SYMBOL(ndisc_mc_map);
 287
 288 static u32 ndisc_hash(const void *pkey,
 289                       const struct net_device *dev,
 290                       __u32 *hash_rnd)
 291 {
 292         return ndisc_hashfn(pkey, dev, hash_rnd);
 293 }
 294
 295 static int ndisc_constructor(struct neighbour *neigh)
 296 {
 297         struct in6_addr *addr = (struct in6_addr*)&neigh->primary_key;
 298         struct net_device *dev = neigh->dev;
 299         struct inet6_dev *in6_dev;
 300         struct neigh_parms *parms;
 301         bool is_multicast = ipv6_addr_is_multicast(addr);
 302
 303         in6_dev = in6_dev_get(dev);
 304         if (in6_dev == NULL) {
 305                 return -EINVAL;
 306         }
 307
 308         parms = in6_dev->nd_parms;
 309         __neigh_parms_put(neigh->parms);
 310         neigh->parms = neigh_parms_clone(parms);
 311
 312         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 313         if (!dev->header_ops) {
 314                 neigh->nud_state = NUD_NOARP;
 315                 neigh->ops = &ndisc_direct_ops;
 316                 neigh->output = neigh_direct_output;
 317         } else {
 318                 if (is_multicast) {
 319                         neigh->nud_state = NUD_NOARP;
 320                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 321                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 322                         neigh->nud_state = NUD_NOARP;
 323                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 324                         if (dev->flags&IFF_LOOPBACK)
 325                                 neigh->type = RTN_LOCAL;
 326                 } else if (dev->flags&IFF_POINTOPOINT) {
 327                         neigh->nud_state = NUD_NOARP;
 328                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 329                 }
 330                 if (dev->header_ops->cache)
 331                         neigh->ops = &ndisc_hh_ops;
 332                 else
 333                         neigh->ops = &ndisc_generic_ops;
 334                 if (neigh->nud_state&NUD_VALID)
 335                         neigh->output = neigh->ops->connected_output;
 336                 else
 337                         neigh->output = neigh->ops->output;
 338         }
 339         in6_dev_put(in6_dev);
 340         return 0;
 341 }
 342
 343 static int pndisc_constructor(struct pneigh_entry *n)
 344 {
 345         struct in6_addr *addr = (struct in6_addr*)&n->key;
 346         struct in6_addr maddr;
 347         struct net_device *dev = n->dev;
 348
 349         if (dev == NULL || __in6_dev_get(dev) == NULL)
 350                 return -EINVAL;
 351         addrconf_addr_solict_mult(addr, &maddr);
 352         ipv6_dev_mc_inc(dev, &maddr);
 353         return 0;
 354 }
 355
 356 static void pndisc_destructor(struct pneigh_entry *n)
 357 {
 358         struct in6_addr *addr = (struct in6_addr*)&n->key;
 359         struct in6_addr maddr;
 360         struct net_device *dev = n->dev;
 361
 362         if (dev == NULL || __in6_dev_get(dev) == NULL)
 363                 return;
 364         addrconf_addr_solict_mult(addr, &maddr);
 365         ipv6_dev_mc_dec(dev, &maddr);
 366 }
 367
 368 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 369                                        int len)
 370 {
 371         int hlen = LL_RESERVED_SPACE(dev);
 372         int tlen = dev->needed_tailroom;
 373         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 374         struct sk_buff *skb;
 375         int err;
 376
 377         skb = sock_alloc_send_skb(sk,
 378                                   hlen + sizeof(struct ipv6hdr) + len + tlen,
 379                                   1, &err);
 380         if (!skb) {
 381                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb, err=%d\n",
 382                           __func__, err);
 383                 return NULL;
 384         }
 385
 386         skb->protocol = htons(ETH_P_IPV6);
 387         skb->dev = dev;
 388
 389         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 390         skb_reset_transport_header(skb);
 391
 392         return skb;
 393 }
 394
 395 static void ip6_nd_hdr(struct sk_buff *skb,
 396                        const struct in6_addr *saddr,
 397                        const struct in6_addr *daddr,
 398                        int hop_limit, int len)
 399 {
 400         struct ipv6hdr *hdr;
 401
 402         skb_push(skb, sizeof(*hdr));
 403         skb_reset_network_header(skb);
 404         hdr = ipv6_hdr(skb);
 405
 406         ip6_flow_hdr(hdr, 0, 0);
 407
 408         hdr->payload_len = htons(len);
 409         hdr->nexthdr = IPPROTO_ICMPV6;
 410         hdr->hop_limit = hop_limit;
 411
 412         hdr->saddr = *saddr;
 413         hdr->daddr = *daddr;
 414 }
 415
 416 static void ndisc_send_skb(struct sk_buff *skb,
 417                            const struct in6_addr *daddr,
 418                            const struct in6_addr *saddr)
 419 {
 420         struct dst_entry *dst = skb_dst(skb);
 421         struct net *net = dev_net(skb->dev);
 422         struct sock *sk = net->ipv6.ndisc_sk;
 423         struct inet6_dev *idev;
 424         int err;
 425         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 426         u8 type;
 427
 428         type = icmp6h->icmp6_type;
 429
 430         if (!dst) {
 431                 struct flowi6 fl6;
 432
 433                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex);
 434                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 435                 if (IS_ERR(dst)) {
 436                         kfree_skb(skb);
 437                         return;
 438                 }
 439
 440                 skb_dst_set(skb, dst);
 441         }
 442
 443         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 444                                               IPPROTO_ICMPV6,
 445                                               csum_partial(icmp6h,
 446                                                            skb->len, 0));
 447
 448         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 449
 450         rcu_read_lock();
 451         idev = __in6_dev_get(dst->dev);
 452         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 453
 454         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 455                       dst_output);
 456         if (!err) {
 457                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 458                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 459         }
 460
 461         rcu_read_unlock();
 462 }
 463
 464 void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 465                    const struct in6_addr *daddr,
 466                    const struct in6_addr *solicited_addr,
 467                    bool router, bool solicited, bool override, bool inc_opt)
 468 {
 469         struct sk_buff *skb;
 470         struct in6_addr tmpaddr;
 471         struct inet6_ifaddr *ifp;
 472         const struct in6_addr *src_addr;
 473         struct nd_msg *msg;
 474         int optlen = 0;
 475
 476         /* for anycast or proxy, solicited_addr != src_addr */
 477         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 478         if (ifp) {
 479                 src_addr = solicited_addr;
 480                 if (ifp->flags & IFA_F_OPTIMISTIC)
 481                         override = false;
 482                 inc_opt |= ifp->idev->cnf.force_tllao;
 483                 in6_ifa_put(ifp);
 484         } else {
 485                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 486                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 487                                        &tmpaddr))
 488                         return;
 489                 src_addr = &tmpaddr;
 490         }
 491
 492         if (!dev->addr_len)
 493                 inc_opt = 0;
 494         if (inc_opt)
 495                 optlen += ndisc_opt_addr_space(dev);
 496
 497         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 498         if (!skb)
 499                 return;
 500
 501         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 502         *msg = (struct nd_msg) {
 503                 .icmph = {
 504                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 505                         .icmp6_router = router,
 506                         .icmp6_solicited = solicited,
 507                         .icmp6_override = override,
 508                 },
 509                 .target = *solicited_addr,
 510         };
 511
 512         if (inc_opt)
 513                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 514                                        dev->dev_addr);
 515
 516
 517         ndisc_send_skb(skb, daddr, src_addr);
 518 }
 519
 520 static void ndisc_send_unsol_na(struct net_device *dev)
 521 {
 522         struct inet6_dev *idev;
 523         struct inet6_ifaddr *ifa;
 524
 525         idev = in6_dev_get(dev);
 526         if (!idev)
 527                 return;
 528
 529         read_lock_bh(&idev->lock);
 530         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 531                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
 532                               /*router=*/ !!idev->cnf.forwarding,
 533                               /*solicited=*/ false, /*override=*/ true,
 534                               /*inc_opt=*/ true);
 535         }
 536         read_unlock_bh(&idev->lock);
 537
 538         in6_dev_put(idev);
 539 }
 540
 541 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 542                    const struct in6_addr *solicit,
 543                    const struct in6_addr *daddr, const struct in6_addr *saddr)
 544 {
 545         struct sk_buff *skb;
 546         struct in6_addr addr_buf;
 547         int inc_opt = dev->addr_len;
 548         int optlen = 0;
 549         struct nd_msg *msg;
 550
 551         if (saddr == NULL) {
 552                 if (ipv6_get_lladdr(dev, &addr_buf,
 553                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 554                         return;
 555                 saddr = &addr_buf;
 556         }
 557
 558         if (ipv6_addr_any(saddr))
 559                 inc_opt = false;
 560         if (inc_opt)
 561                 optlen += ndisc_opt_addr_space(dev);
 562
 563         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 564         if (!skb)
 565                 return;
 566
 567         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 568         *msg = (struct nd_msg) {
 569                 .icmph = {
 570                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 571                 },
 572                 .target = *solicit,
 573         };
 574
 575         if (inc_opt)
 576                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 577                                        dev->dev_addr);
 578
 579         ndisc_send_skb(skb, daddr, saddr);
 580 }
 581
 582 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 583                    const struct in6_addr *daddr)
 584 {
 585         struct sk_buff *skb;
 586         struct rs_msg *msg;
 587         int send_sllao = dev->addr_len;
 588         int optlen = 0;
 589
 590 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 591         /*
 592          * According to section 2.2 of RFC 4429, we must not
 593          * send router solicitations with a sllao from
 594          * optimistic addresses, but we may send the solicitation
 595          * if we don't include the sllao.  So here we check
 596          * if our address is optimistic, and if so, we
 597          * suppress the inclusion of the sllao.
 598          */
 599         if (send_sllao) {
 600                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 601                                                            dev, 1);
 602                 if (ifp) {
 603                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 604                                 send_sllao = 0;
 605                         }
 606                         in6_ifa_put(ifp);
 607                 } else {
 608                         send_sllao = 0;
 609                 }
 610         }
 611 #endif
 612         if (send_sllao)
 613                 optlen += ndisc_opt_addr_space(dev);
 614
 615         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 616         if (!skb)
 617                 return;
 618
 619         msg = (struct rs_msg *)skb_put(skb, sizeof(*msg));
 620         *msg = (struct rs_msg) {
 621                 .icmph = {
 622                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 623                 },
 624         };
 625
 626         if (send_sllao)
 627                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 628                                        dev->dev_addr);
 629
 630         ndisc_send_skb(skb, daddr, saddr);
 631 }
 632
 633
 634 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 635 {
 636         /*
 637          *      "The sender MUST return an ICMP
 638          *       destination unreachable"
 639          */
 640         dst_link_failure(skb);
 641         kfree_skb(skb);
 642 }
 643
 644 /* Called with locked neigh: either read or both */
 645
 646 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 647 {
 648         struct in6_addr *saddr = NULL;
 649         struct in6_addr mcaddr;
 650         struct net_device *dev = neigh->dev;
 651         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 652         int probes = atomic_read(&neigh->probes);
 653
 654         if (skb && ipv6_chk_addr(dev_net(dev), &ipv6_hdr(skb)->saddr, dev, 1))
 655                 saddr = &ipv6_hdr(skb)->saddr;
 656
 657         if ((probes -= neigh->parms->ucast_probes) < 0) {
 658                 if (!(neigh->nud_state & NUD_VALID)) {
 659                         ND_PRINTK(1, dbg,
 660                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 661                                   __func__, target);
 662                 }
 663                 ndisc_send_ns(dev, neigh, target, target, saddr);
 664         } else if ((probes -= neigh->parms->app_probes) < 0) {
 665                 neigh_app_ns(neigh);
 666         } else {
 667                 addrconf_addr_solict_mult(target, &mcaddr);
 668                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 669         }
 670 }
 671
 672 static int pndisc_is_router(const void *pkey,
 673                             struct net_device *dev)
 674 {
 675         struct pneigh_entry *n;
 676         int ret = -1;
 677
 678         read_lock_bh(&nd_tbl.lock);
 679         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 680         if (n)
 681                 ret = !!(n->flags & NTF_ROUTER);
 682         read_unlock_bh(&nd_tbl.lock);
 683
 684         return ret;
 685 }
 686
 687 static void ndisc_recv_ns(struct sk_buff *skb)
 688 {
 689         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 690         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 691         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 692         u8 *lladdr = NULL;
 693         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 694                                     offsetof(struct nd_msg, opt));
 695         struct ndisc_options ndopts;
 696         struct net_device *dev = skb->dev;
 697         struct inet6_ifaddr *ifp;
 698         struct inet6_dev *idev = NULL;
 699         struct neighbour *neigh;
 700         int dad = ipv6_addr_any(saddr);
 701         bool inc;
 702         int is_router = -1;
 703
 704         if (skb->len < sizeof(struct nd_msg)) {
 705                 ND_PRINTK(2, warn, "NS: packet too short\n");
 706                 return;
 707         }
 708
 709         if (ipv6_addr_is_multicast(&msg->target)) {
 710                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 711                 return;
 712         }
 713
 714         /*
 715          * RFC2461 7.1.1:
 716          * DAD has to be destined for solicited node multicast address.
 717          */
 718         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 719                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 720                 return;
 721         }
 722
 723         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 724                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 725                 return;
 726         }
 727
 728         if (ndopts.nd_opts_src_lladdr) {
 729                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 730                 if (!lladdr) {
 731                         ND_PRINTK(2, warn,
 732                                   "NS: invalid link-layer address length\n");
 733                         return;
 734                 }
 735
 736                 /* RFC2461 7.1.1:
 737                  *      If the IP source address is the unspecified address,
 738                  *      there MUST NOT be source link-layer address option
 739                  *      in the message.
 740                  */
 741                 if (dad) {
 742                         ND_PRINTK(2, warn,
 743                                   "NS: bad DAD packet (link-layer address option)\n");
 744                         return;
 745                 }
 746         }
 747
 748         inc = ipv6_addr_is_multicast(daddr);
 749
 750         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 751         if (ifp) {
 752
 753                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 754                         if (dad) {
 755                                 /*
 756                                  * We are colliding with another node
 757                                  * who is doing DAD
 758                                  * so fail our DAD process
 759                                  */
 760                                 addrconf_dad_failure(ifp);
 761                                 return;
 762                         } else {
 763                                 /*
 764                                  * This is not a dad solicitation.
 765                                  * If we are an optimistic node,
 766                                  * we should respond.
 767                                  * Otherwise, we should ignore it.
 768                                  */
 769                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 770                                         goto out;
 771                         }
 772                 }
 773
 774                 idev = ifp->idev;
 775         } else {
 776                 struct net *net = dev_net(dev);
 777
 778                 idev = in6_dev_get(dev);
 779                 if (!idev) {
 780                         /* XXX: count this drop? */
 781                         return;
 782                 }
 783
 784                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 785                     (idev->cnf.forwarding &&
 786                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 787                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 788                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 789                             skb->pkt_type != PACKET_HOST &&
 790                             inc &&
 791                             idev->nd_parms->proxy_delay != 0) {
 792                                 /*
 793                                  * for anycast or proxy,
 794                                  * sender should delay its response
 795                                  * by a random time between 0 and
 796                                  * MAX_ANYCAST_DELAY_TIME seconds.
 797                                  * (RFC2461) -- yoshfuji
 798                                  */
 799                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 800                                 if (n)
 801                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 802                                 goto out;
 803                         }
 804                 } else
 805                         goto out;
 806         }
 807
 808         if (is_router < 0)
 809                 is_router = idev->cnf.forwarding;
 810
 811         if (dad) {
 812                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
 813                               !!is_router, false, (ifp != NULL), true);
 814                 goto out;
 815         }
 816
 817         if (inc)
 818                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 819         else
 820                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 821
 822         /*
 823          *      update / create cache entry
 824          *      for the source address
 825          */
 826         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 827                                !inc || lladdr || !dev->addr_len);
 828         if (neigh)
 829                 neigh_update(neigh, lladdr, NUD_STALE,
 830                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 831                              NEIGH_UPDATE_F_OVERRIDE);
 832         if (neigh || !dev->header_ops) {
 833                 ndisc_send_na(dev, neigh, saddr, &msg->target,
 834                               !!is_router,
 835                               true, (ifp != NULL && inc), inc);
 836                 if (neigh)
 837                         neigh_release(neigh);
 838         }
 839
 840 out:
 841         if (ifp)
 842                 in6_ifa_put(ifp);
 843         else
 844                 in6_dev_put(idev);
 845 }
 846
 847 static void ndisc_recv_na(struct sk_buff *skb)
 848 {
 849         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 850         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 851         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 852         u8 *lladdr = NULL;
 853         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 854                                     offsetof(struct nd_msg, opt));
 855         struct ndisc_options ndopts;
 856         struct net_device *dev = skb->dev;
 857         struct inet6_ifaddr *ifp;
 858         struct neighbour *neigh;
 859
 860         if (skb->len < sizeof(struct nd_msg)) {
 861                 ND_PRINTK(2, warn, "NA: packet too short\n");
 862                 return;
 863         }
 864
 865         if (ipv6_addr_is_multicast(&msg->target)) {
 866                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 867                 return;
 868         }
 869
 870         if (ipv6_addr_is_multicast(daddr) &&
 871             msg->icmph.icmp6_solicited) {
 872                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 873                 return;
 874         }
 875
 876         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 877                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 878                 return;
 879         }
 880         if (ndopts.nd_opts_tgt_lladdr) {
 881                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 882                 if (!lladdr) {
 883                         ND_PRINTK(2, warn,
 884                                   "NA: invalid link-layer address length\n");
 885                         return;
 886                 }
 887         }
 888         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 889         if (ifp) {
 890                 if (skb->pkt_type != PACKET_LOOPBACK
 891                     && (ifp->flags & IFA_F_TENTATIVE)) {
 892                                 addrconf_dad_failure(ifp);
 893                                 return;
 894                 }
 895                 /* What should we make now? The advertisement
 896                    is invalid, but ndisc specs say nothing
 897                    about it. It could be misconfiguration, or
 898                    an smart proxy agent tries to help us :-)
 899
 900                    We should not print the error if NA has been
 901                    received from loopback - it is just our own
 902                    unsolicited advertisement.
 903                  */
 904                 if (skb->pkt_type != PACKET_LOOPBACK)
 905                         ND_PRINTK(1, warn,
 906                                   "NA: someone advertises our address %pI6 on %s!\n",
 907                                   &ifp->addr, ifp->idev->dev->name);
 908                 in6_ifa_put(ifp);
 909                 return;
 910         }
 911         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 912
 913         if (neigh) {
 914                 u8 old_flags = neigh->flags;
 915                 struct net *net = dev_net(dev);
 916
 917                 if (neigh->nud_state & NUD_FAILED)
 918                         goto out;
 919
 920                 /*
 921                  * Don't update the neighbor cache entry on a proxy NA from
 922                  * ourselves because either the proxied node is off link or it
 923                  * has already sent a NA to us.
 924                  */
 925                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 926                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
 927                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
 928                         /* XXX: idev->cnf.proxy_ndp */
 929                         goto out;
 930                 }
 931
 932                 neigh_update(neigh, lladdr,
 933                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 934                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 935                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 936                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 937                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 938
 939                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 940                         /*
 941                          * Change: router to host
 942                          */
 943                         struct rt6_info *rt;
 944                         rt = rt6_get_dflt_router(saddr, dev);
 945                         if (rt)
 946                                 ip6_del_rt(rt);
 947                 }
 948
 949 out:
 950                 neigh_release(neigh);
 951         }
 952 }
 953
 954 static void ndisc_recv_rs(struct sk_buff *skb)
 955 {
 956         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 957         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 958         struct neighbour *neigh;
 959         struct inet6_dev *idev;
 960         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 961         struct ndisc_options ndopts;
 962         u8 *lladdr = NULL;
 963
 964         if (skb->len < sizeof(*rs_msg))
 965                 return;
 966
 967         idev = __in6_dev_get(skb->dev);
 968         if (!idev) {
 969                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
 970                 return;
 971         }
 972
 973         /* Don't accept RS if we're not in router mode */
 974         if (!idev->cnf.forwarding)
 975                 goto out;
 976
 977         /*
 978          * Don't update NCE if src = ::;
 979          * this implies that the source node has no ip address assigned yet.
 980          */
 981         if (ipv6_addr_any(saddr))
 982                 goto out;
 983
 984         /* Parse ND options */
 985         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 986                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
 987                 goto out;
 988         }
 989
 990         if (ndopts.nd_opts_src_lladdr) {
 991                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
 992                                              skb->dev);
 993                 if (!lladdr)
 994                         goto out;
 995         }
 996
 997         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
 998         if (neigh) {
 999                 neigh_update(neigh, lladdr, NUD_STALE,
1000                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1001                              NEIGH_UPDATE_F_OVERRIDE|
1002                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1003                 neigh_release(neigh);
1004         }
1005 out:
1006         return;
1007 }
1008
1009 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1010 {
1011         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1012         struct sk_buff *skb;
1013         struct nlmsghdr *nlh;
1014         struct nduseroptmsg *ndmsg;
1015         struct net *net = dev_net(ra->dev);
1016         int err;
1017         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1018                                     + (opt->nd_opt_len << 3));
1019         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1020
1021         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1022         if (skb == NULL) {
1023                 err = -ENOBUFS;
1024                 goto errout;
1025         }
1026
1027         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1028         if (nlh == NULL) {
1029                 goto nla_put_failure;
1030         }
1031
1032         ndmsg = nlmsg_data(nlh);
1033         ndmsg->nduseropt_family = AF_INET6;
1034         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1035         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1036         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1037         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1038
1039         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1040
1041         if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1042                     &ipv6_hdr(ra)->saddr))
1043                 goto nla_put_failure;
1044         nlmsg_end(skb, nlh);
1045
1046         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1047         return;
1048
1049 nla_put_failure:
1050         nlmsg_free(skb);
1051         err = -EMSGSIZE;
1052 errout:
1053         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1054 }
1055
1056 static void ndisc_router_discovery(struct sk_buff *skb)
1057 {
1058         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1059         struct neighbour *neigh = NULL;
1060         struct inet6_dev *in6_dev;
1061         struct rt6_info *rt = NULL;
1062         int lifetime;
1063         struct ndisc_options ndopts;
1064         int optlen;
1065         unsigned int pref = 0;
1066
1067         __u8 * opt = (__u8 *)(ra_msg + 1);
1068
1069         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1070                 sizeof(struct ra_msg);
1071
1072         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1073                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1074                 return;
1075         }
1076         if (optlen < 0) {
1077                 ND_PRINTK(2, warn, "RA: packet too short\n");
1078                 return;
1079         }
1080
1081 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1082         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1083                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1084                 return;
1085         }
1086 #endif
1087
1088         /*
1089          *      set the RA_RECV flag in the interface
1090          */
1091
1092         in6_dev = __in6_dev_get(skb->dev);
1093         if (in6_dev == NULL) {
1094                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1095                           skb->dev->name);
1096                 return;
1097         }
1098
1099         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1100                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1101                 return;
1102         }
1103
1104         if (!ipv6_accept_ra(in6_dev))
1105                 goto skip_linkparms;
1106
1107 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1108         /* skip link-specific parameters from interior routers */
1109         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
1110                 goto skip_linkparms;
1111 #endif
1112
1113         if (in6_dev->if_flags & IF_RS_SENT) {
1114                 /*
1115                  *      flag that an RA was received after an RS was sent
1116                  *      out on this interface.
1117                  */
1118                 in6_dev->if_flags |= IF_RA_RCVD;
1119         }
1120
1121         /*
1122          * Remember the managed/otherconf flags from most recently
1123          * received RA message (RFC 2462) -- yoshfuji
1124          */
1125         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1126                                 IF_RA_OTHERCONF)) |
1127                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1128                                         IF_RA_MANAGED : 0) |
1129                                 (ra_msg->icmph.icmp6_addrconf_other ?
1130                                         IF_RA_OTHERCONF : 0);
1131
1132         if (!in6_dev->cnf.accept_ra_defrtr)
1133                 goto skip_defrtr;
1134
1135         if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
1136                 goto skip_defrtr;
1137
1138         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1139
1140 #ifdef CONFIG_IPV6_ROUTER_PREF
1141         pref = ra_msg->icmph.icmp6_router_pref;
1142         /* 10b is handled as if it were 00b (medium) */
1143         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1144             !in6_dev->cnf.accept_ra_rtr_pref)
1145                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1146 #endif
1147
1148         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1149
1150         if (rt) {
1151                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1152                 if (!neigh) {
1153                         ND_PRINTK(0, err,
1154                                   "RA: %s got default router without neighbour\n",
1155                                   __func__);
1156                         ip6_rt_put(rt);
1157                         return;
1158                 }
1159         }
1160         if (rt && lifetime == 0) {
1161                 ip6_del_rt(rt);
1162                 rt = NULL;
1163         }
1164
1165         if (rt == NULL && lifetime) {
1166                 ND_PRINTK(3, dbg, "RA: adding default router\n");
1167
1168                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1169                 if (rt == NULL) {
1170                         ND_PRINTK(0, err,
1171                                   "RA: %s failed to add default route\n",
1172                                   __func__);
1173                         return;
1174                 }
1175
1176                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1177                 if (neigh == NULL) {
1178                         ND_PRINTK(0, err,
1179                                   "RA: %s got default router without neighbour\n",
1180                                   __func__);
1181                         ip6_rt_put(rt);
1182                         return;
1183                 }
1184                 neigh->flags |= NTF_ROUTER;
1185         } else if (rt) {
1186                 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1187         }
1188
1189         if (rt)
1190                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1191         if (ra_msg->icmph.icmp6_hop_limit) {
1192                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1193                 if (rt)
1194                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1195                                        ra_msg->icmph.icmp6_hop_limit);
1196         }
1197
1198 skip_defrtr:
1199
1200         /*
1201          *      Update Reachable Time and Retrans Timer
1202          */
1203
1204         if (in6_dev->nd_parms) {
1205                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1206
1207                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1208                         rtime = (rtime*HZ)/1000;
1209                         if (rtime < HZ/10)
1210                                 rtime = HZ/10;
1211                         in6_dev->nd_parms->retrans_time = rtime;
1212                         in6_dev->tstamp = jiffies;
1213                         inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1214                 }
1215
1216                 rtime = ntohl(ra_msg->reachable_time);
1217                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1218                         rtime = (rtime*HZ)/1000;
1219
1220                         if (rtime < HZ/10)
1221                                 rtime = HZ/10;
1222
1223                         if (rtime != in6_dev->nd_parms->base_reachable_time) {
1224                                 in6_dev->nd_parms->base_reachable_time = rtime;
1225                                 in6_dev->nd_parms->gc_staletime = 3 * rtime;
1226                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1227                                 in6_dev->tstamp = jiffies;
1228                                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1229                         }
1230                 }
1231         }
1232
1233 skip_linkparms:
1234
1235         /*
1236          *      Process options.
1237          */
1238
1239         if (!neigh)
1240                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1241                                        skb->dev, 1);
1242         if (neigh) {
1243                 u8 *lladdr = NULL;
1244                 if (ndopts.nd_opts_src_lladdr) {
1245                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1246                                                      skb->dev);
1247                         if (!lladdr) {
1248                                 ND_PRINTK(2, warn,
1249                                           "RA: invalid link-layer address length\n");
1250                                 goto out;
1251                         }
1252                 }
1253                 neigh_update(neigh, lladdr, NUD_STALE,
1254                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1255                              NEIGH_UPDATE_F_OVERRIDE|
1256                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1257                              NEIGH_UPDATE_F_ISROUTER);
1258         }
1259
1260         if (!ipv6_accept_ra(in6_dev))
1261                 goto out;
1262
1263 #ifdef CONFIG_IPV6_ROUTE_INFO
1264         if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
1265                 goto skip_routeinfo;
1266
1267         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1268                 struct nd_opt_hdr *p;
1269                 for (p = ndopts.nd_opts_ri;
1270                      p;
1271                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1272                         struct route_info *ri = (struct route_info *)p;
1273 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1274                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1275                             ri->prefix_len == 0)
1276                                 continue;
1277 #endif
1278                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1279                                 continue;
1280                         rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
1281                                       &ipv6_hdr(skb)->saddr);
1282                 }
1283         }
1284
1285 skip_routeinfo:
1286 #endif
1287
1288 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1289         /* skip link-specific ndopts from interior routers */
1290         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
1291                 goto out;
1292 #endif
1293
1294         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1295                 struct nd_opt_hdr *p;
1296                 for (p = ndopts.nd_opts_pi;
1297                      p;
1298                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1299                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1300                                             (p->nd_opt_len) << 3,
1301                                             ndopts.nd_opts_src_lladdr != NULL);
1302                 }
1303         }
1304
1305         if (ndopts.nd_opts_mtu) {
1306                 __be32 n;
1307                 u32 mtu;
1308
1309                 memcpy(&n, ((u8*)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1310                 mtu = ntohl(n);
1311
1312                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1313                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1314                 } else if (in6_dev->cnf.mtu6 != mtu) {
1315                         in6_dev->cnf.mtu6 = mtu;
1316
1317                         if (rt)
1318                                 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1319
1320                         rt6_mtu_change(skb->dev, mtu);
1321                 }
1322         }
1323
1324         if (ndopts.nd_useropts) {
1325                 struct nd_opt_hdr *p;
1326                 for (p = ndopts.nd_useropts;
1327                      p;
1328                      p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1329                         ndisc_ra_useropt(skb, p);
1330                 }
1331         }
1332
1333         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1334                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1335         }
1336 out:
1337         ip6_rt_put(rt);
1338         if (neigh)
1339                 neigh_release(neigh);
1340 }
1341
1342 static void ndisc_redirect_rcv(struct sk_buff *skb)
1343 {
1344         u8 *hdr;
1345         struct ndisc_options ndopts;
1346         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1347         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1348                                     offsetof(struct rd_msg, opt));
1349
1350 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1351         switch (skb->ndisc_nodetype) {
1352         case NDISC_NODETYPE_HOST:
1353         case NDISC_NODETYPE_NODEFAULT:
1354                 ND_PRINTK(2, warn,
1355                           "Redirect: from host or unauthorized router\n");
1356                 return;
1357         }
1358 #endif
1359
1360         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1361                 ND_PRINTK(2, warn,
1362                           "Redirect: source address is not link-local\n");
1363                 return;
1364         }
1365
1366         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1367                 return;
1368
1369         if (!ndopts.nd_opts_rh) {
1370                 ip6_redirect_no_header(skb, dev_net(skb->dev), 0, 0);
1371                 return;
1372         }
1373
1374         hdr = (u8 *)ndopts.nd_opts_rh;
1375         hdr += 8;
1376         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1377                 return;
1378
1379         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1380 }
1381
1382 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1383                                            struct sk_buff *orig_skb,
1384                                            int rd_len)
1385 {
1386         u8 *opt = skb_put(skb, rd_len);
1387
1388         memset(opt, 0, 8);
1389         *(opt++) = ND_OPT_REDIRECT_HDR;
1390         *(opt++) = (rd_len >> 3);
1391         opt += 6;
1392
1393         memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
1394 }
1395
1396 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1397 {
1398         struct net_device *dev = skb->dev;
1399         struct net *net = dev_net(dev);
1400         struct sock *sk = net->ipv6.ndisc_sk;
1401         int optlen = 0;
1402         struct inet_peer *peer;
1403         struct sk_buff *buff;
1404         struct rd_msg *msg;
1405         struct in6_addr saddr_buf;
1406         struct rt6_info *rt;
1407         struct dst_entry *dst;
1408         struct flowi6 fl6;
1409         int rd_len;
1410         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1411         bool ret;
1412
1413         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1414                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1415                           dev->name);
1416                 return;
1417         }
1418
1419         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1420             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1421                 ND_PRINTK(2, warn,
1422                           "Redirect: target address is not link-local unicast\n");
1423                 return;
1424         }
1425
1426         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1427                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1428
1429         dst = ip6_route_output(net, NULL, &fl6);
1430         if (dst->error) {
1431                 dst_release(dst);
1432                 return;
1433         }
1434         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1435         if (IS_ERR(dst))
1436                 return;
1437
1438         rt = (struct rt6_info *) dst;
1439
1440         if (rt->rt6i_flags & RTF_GATEWAY) {
1441                 ND_PRINTK(2, warn,
1442                           "Redirect: destination is not a neighbour\n");
1443                 goto release;
1444         }
1445         peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
1446         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1447         if (peer)
1448                 inet_putpeer(peer);
1449         if (!ret)
1450                 goto release;
1451
1452         if (dev->addr_len) {
1453                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1454                 if (!neigh) {
1455                         ND_PRINTK(2, warn,
1456                                   "Redirect: no neigh for target address\n");
1457                         goto release;
1458                 }
1459
1460                 read_lock_bh(&neigh->lock);
1461                 if (neigh->nud_state & NUD_VALID) {
1462                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1463                         read_unlock_bh(&neigh->lock);
1464                         ha = ha_buf;
1465                         optlen += ndisc_opt_addr_space(dev);
1466                 } else
1467                         read_unlock_bh(&neigh->lock);
1468
1469                 neigh_release(neigh);
1470         }
1471
1472         rd_len = min_t(unsigned int,
1473                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1474                        skb->len + 8);
1475         rd_len &= ~0x7;
1476         optlen += rd_len;
1477
1478         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1479         if (!buff)
1480                 goto release;
1481
1482         msg = (struct rd_msg *)skb_put(buff, sizeof(*msg));
1483         *msg = (struct rd_msg) {
1484                 .icmph = {
1485                         .icmp6_type = NDISC_REDIRECT,
1486                 },
1487                 .target = *target,
1488                 .dest = ipv6_hdr(skb)->daddr,
1489         };
1490
1491         /*
1492          *      include target_address option
1493          */
1494
1495         if (ha)
1496                 ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
1497
1498         /*
1499          *      build redirect option and copy skb over to the new packet.
1500          */
1501
1502         if (rd_len)
1503                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1504
1505         skb_dst_set(buff, dst);
1506         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1507         return;
1508
1509 release:
1510         dst_release(dst);
1511 }
1512
1513 static void pndisc_redo(struct sk_buff *skb)
1514 {
1515         ndisc_recv_ns(skb);
1516         kfree_skb(skb);
1517 }
1518
1519 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1520 {
1521         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1522
1523         if (!idev)
1524                 return true;
1525         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1526             idev->cnf.suppress_frag_ndisc) {
1527                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1528                 return true;
1529         }
1530         return false;
1531 }
1532
1533 int ndisc_rcv(struct sk_buff *skb)
1534 {
1535         struct nd_msg *msg;
1536
1537         if (ndisc_suppress_frag_ndisc(skb))
1538                 return 0;
1539
1540         if (skb_linearize(skb))
1541                 return 0;
1542
1543         msg = (struct nd_msg *)skb_transport_header(skb);
1544
1545         __skb_push(skb, skb->data - skb_transport_header(skb));
1546
1547         if (ipv6_hdr(skb)->hop_limit != 255) {
1548                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1549                           ipv6_hdr(skb)->hop_limit);
1550                 return 0;
1551         }
1552
1553         if (msg->icmph.icmp6_code != 0) {
1554                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1555                           msg->icmph.icmp6_code);
1556                 return 0;
1557         }
1558
1559         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1560
1561         switch (msg->icmph.icmp6_type) {
1562         case NDISC_NEIGHBOUR_SOLICITATION:
1563                 ndisc_recv_ns(skb);
1564                 break;
1565
1566         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1567                 ndisc_recv_na(skb);
1568                 break;
1569
1570         case NDISC_ROUTER_SOLICITATION:
1571                 ndisc_recv_rs(skb);
1572                 break;
1573
1574         case NDISC_ROUTER_ADVERTISEMENT:
1575                 ndisc_router_discovery(skb);
1576                 break;
1577
1578         case NDISC_REDIRECT:
1579                 ndisc_redirect_rcv(skb);
1580                 break;
1581         }
1582
1583         return 0;
1584 }
1585
1586 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1587 {
1588         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1589         struct net *net = dev_net(dev);
1590         struct inet6_dev *idev;
1591
1592         switch (event) {
1593         case NETDEV_CHANGEADDR:
1594                 neigh_changeaddr(&nd_tbl, dev);
1595                 fib6_run_gc(0, net, false);
1596                 idev = in6_dev_get(dev);
1597                 if (!idev)
1598                         break;
1599                 if (idev->cnf.ndisc_notify)
1600                         ndisc_send_unsol_na(dev);
1601                 in6_dev_put(idev);
1602                 break;
1603         case NETDEV_DOWN:
1604                 neigh_ifdown(&nd_tbl, dev);
1605                 fib6_run_gc(0, net, false);
1606                 break;
1607         case NETDEV_NOTIFY_PEERS:
1608                 ndisc_send_unsol_na(dev);
1609                 break;
1610         default:
1611                 break;
1612         }
1613
1614         return NOTIFY_DONE;
1615 }
1616
1617 static struct notifier_block ndisc_netdev_notifier = {
1618         .notifier_call = ndisc_netdev_event,
1619 };
1620
1621 #ifdef CONFIG_SYSCTL
1622 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1623                                          const char *func, const char *dev_name)
1624 {
1625         static char warncomm[TASK_COMM_LEN];
1626         static int warned;
1627         if (strcmp(warncomm, current->comm) && warned < 5) {
1628                 strcpy(warncomm, current->comm);
1629                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1630                         warncomm, func,
1631                         dev_name, ctl->procname,
1632                         dev_name, ctl->procname);
1633                 warned++;
1634         }
1635 }
1636
1637 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1638 {
1639         struct net_device *dev = ctl->extra1;
1640         struct inet6_dev *idev;
1641         int ret;
1642
1643         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1644             (strcmp(ctl->procname, "base_reachable_time") == 0))
1645                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1646
1647         if (strcmp(ctl->procname, "retrans_time") == 0)
1648                 ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
1649
1650         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1651                 ret = proc_dointvec_jiffies(ctl, write,
1652                                             buffer, lenp, ppos);
1653
1654         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1655                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1656                 ret = proc_dointvec_ms_jiffies(ctl, write,
1657                                                buffer, lenp, ppos);
1658         else
1659                 ret = -1;
1660
1661         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1662                 if (ctl->data == &idev->nd_parms->base_reachable_time)
1663                         idev->nd_parms->reachable_time = neigh_rand_reach_time(idev->nd_parms->base_reachable_time);
1664                 idev->tstamp = jiffies;
1665                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1666                 in6_dev_put(idev);
1667         }
1668         return ret;
1669 }
1670
1671
1672 #endif
1673
1674 static int __net_init ndisc_net_init(struct net *net)
1675 {
1676         struct ipv6_pinfo *np;
1677         struct sock *sk;
1678         int err;
1679
1680         err = inet_ctl_sock_create(&sk, PF_INET6,
1681                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1682         if (err < 0) {
1683                 ND_PRINTK(0, err,
1684                           "NDISC: Failed to initialize the control socket (err %d)\n",
1685                           err);
1686                 return err;
1687         }
1688
1689         net->ipv6.ndisc_sk = sk;
1690
1691         np = inet6_sk(sk);
1692         np->hop_limit = 255;
1693         /* Do not loopback ndisc messages */
1694         np->mc_loop = 0;
1695
1696         return 0;
1697 }
1698
1699 static void __net_exit ndisc_net_exit(struct net *net)
1700 {
1701         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1702 }
1703
1704 static struct pernet_operations ndisc_net_ops = {
1705         .init = ndisc_net_init,
1706         .exit = ndisc_net_exit,
1707 };
1708
1709 int __init ndisc_init(void)
1710 {
1711         int err;
1712
1713         err = register_pernet_subsys(&ndisc_net_ops);
1714         if (err)
1715                 return err;
1716         /*
1717          * Initialize the neighbour table
1718          */
1719         neigh_table_init(&nd_tbl);
1720
1721 #ifdef CONFIG_SYSCTL
1722         err = neigh_sysctl_register(NULL, &nd_tbl.parms, "ipv6",
1723                                     &ndisc_ifinfo_sysctl_change);
1724         if (err)
1725                 goto out_unregister_pernet;
1726 #endif
1727         err = register_netdevice_notifier(&ndisc_netdev_notifier);
1728         if (err)
1729                 goto out_unregister_sysctl;
1730 out:
1731         return err;
1732
1733 out_unregister_sysctl:
1734 #ifdef CONFIG_SYSCTL
1735         neigh_sysctl_unregister(&nd_tbl.parms);
1736 out_unregister_pernet:
1737 #endif
1738         unregister_pernet_subsys(&ndisc_net_ops);
1739         goto out;
1740 }
1741
1742 void ndisc_cleanup(void)
1743 {
1744         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1745 #ifdef CONFIG_SYSCTL
1746         neigh_sysctl_unregister(&nd_tbl.parms);
1747 #endif
1748         neigh_table_clear(&nd_tbl);
1749         unregister_pernet_subsys(&ndisc_net_ops);
1750 }