net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Mike Shaver             <shaver@ingenia.com>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  19  *      Pierre Ynard                    :       export userland ND options
  20  *                                              through netlink (RDNSS support)
  21  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  22  *                                              of an RA.
  23  *      Janos Farkas                    :       kmalloc failure checks
  24  *      Alexey Kuznetsov                :       state machine reworked
  25  *                                              and moved to net/core.
  26  *      Pekka Savola                    :       RFC2461 validation
  27  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  28  */
  29
  30 #define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32 #include <linux/module.h>
  33 #include <linux/errno.h>
  34 #include <linux/types.h>
  35 #include <linux/socket.h>
  36 #include <linux/sockios.h>
  37 #include <linux/sched.h>
  38 #include <linux/net.h>
  39 #include <linux/in6.h>
  40 #include <linux/route.h>
  41 #include <linux/init.h>
  42 #include <linux/rcupdate.h>
  43 #include <linux/slab.h>
  44 #ifdef CONFIG_SYSCTL
  45 #include <linux/sysctl.h>
  46 #endif
  47
  48 #include <linux/if_addr.h>
  49 #include <linux/if_arp.h>
  50 #include <linux/ipv6.h>
  51 #include <linux/icmpv6.h>
  52 #include <linux/jhash.h>
  53
  54 #include <net/sock.h>
  55 #include <net/snmp.h>
  56
  57 #include <net/ipv6.h>
  58 #include <net/protocol.h>
  59 #include <net/ndisc.h>
  60 #include <net/ip6_route.h>
  61 #include <net/addrconf.h>
  62 #include <net/icmp.h>
  63
  64 #include <net/netlink.h>
  65 #include <linux/rtnetlink.h>
  66
  67 #include <net/flow.h>
  68 #include <net/ip6_checksum.h>
  69 #include <net/inet_common.h>
  70 #include <linux/proc_fs.h>
  71
  72 #include <linux/netfilter.h>
  73 #include <linux/netfilter_ipv6.h>
  74
  75 /* Set to 3 to get tracing... */
  76 #define ND_DEBUG 1
  77
  78 #define ND_PRINTK(val, level, fmt, ...)                         \
  79 do {                                                            \
  80         if (val <= ND_DEBUG)                                    \
  81                 net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
  82 } while (0)
  83
  84 static u32 ndisc_hash(const void *pkey,
  85                       const struct net_device *dev,
  86                       __u32 *hash_rnd);
  87 static int ndisc_constructor(struct neighbour *neigh);
  88 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  89 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  90 static int pndisc_constructor(struct pneigh_entry *n);
  91 static void pndisc_destructor(struct pneigh_entry *n);
  92 static void pndisc_redo(struct sk_buff *skb);
  93
  94 static const struct neigh_ops ndisc_generic_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_connected_output,
 100 };
 101
 102 static const struct neigh_ops ndisc_hh_ops = {
 103         .family =               AF_INET6,
 104         .solicit =              ndisc_solicit,
 105         .error_report =         ndisc_error_report,
 106         .output =               neigh_resolve_output,
 107         .connected_output =     neigh_resolve_output,
 108 };
 109
 110
 111 static const struct neigh_ops ndisc_direct_ops = {
 112         .family =               AF_INET6,
 113         .output =               neigh_direct_output,
 114         .connected_output =     neigh_direct_output,
 115 };
 116
 117 struct neigh_table nd_tbl = {
 118         .family =       AF_INET6,
 119         .key_len =      sizeof(struct in6_addr),
 120         .hash =         ndisc_hash,
 121         .constructor =  ndisc_constructor,
 122         .pconstructor = pndisc_constructor,
 123         .pdestructor =  pndisc_destructor,
 124         .proxy_redo =   pndisc_redo,
 125         .id =           "ndisc_cache",
 126         .parms = {
 127                 .tbl                    = &nd_tbl,
 128                 .base_reachable_time    = ND_REACHABLE_TIME,
 129                 .retrans_time           = ND_RETRANS_TIMER,
 130                 .gc_staletime           = 60 * HZ,
 131                 .reachable_time         = ND_REACHABLE_TIME,
 132                 .delay_probe_time       = 5 * HZ,
 133                 .queue_len_bytes        = 64*1024,
 134                 .ucast_probes           = 3,
 135                 .mcast_probes           = 3,
 136                 .anycast_delay          = 1 * HZ,
 137                 .proxy_delay            = (8 * HZ) / 10,
 138                 .proxy_qlen             = 64,
 139         },
 140         .gc_interval =    30 * HZ,
 141         .gc_thresh1 =    128,
 142         .gc_thresh2 =    512,
 143         .gc_thresh3 =   1024,
 144 };
 145
 146 static inline int ndisc_opt_addr_space(struct net_device *dev)
 147 {
 148         return NDISC_OPT_SPACE(dev->addr_len + ndisc_addr_option_pad(dev->type));
 149 }
 150
 151 static u8 *ndisc_fill_addr_option(u8 *opt, int type, void *data, int data_len,
 152                                   unsigned short addr_type)
 153 {
 154         int pad   = ndisc_addr_option_pad(addr_type);
 155         int space = NDISC_OPT_SPACE(data_len + pad);
 156
 157         opt[0] = type;
 158         opt[1] = space>>3;
 159
 160         memset(opt + 2, 0, pad);
 161         opt   += pad;
 162         space -= pad;
 163
 164         memcpy(opt+2, data, data_len);
 165         data_len += 2;
 166         opt += data_len;
 167         if ((space -= data_len) > 0)
 168                 memset(opt, 0, space);
 169         return opt + space;
 170 }
 171
 172 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 173                                             struct nd_opt_hdr *end)
 174 {
 175         int type;
 176         if (!cur || !end || cur >= end)
 177                 return NULL;
 178         type = cur->nd_opt_type;
 179         do {
 180                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 181         } while(cur < end && cur->nd_opt_type != type);
 182         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 183 }
 184
 185 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 186 {
 187         return opt->nd_opt_type == ND_OPT_RDNSS ||
 188                 opt->nd_opt_type == ND_OPT_DNSSL;
 189 }
 190
 191 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 192                                              struct nd_opt_hdr *end)
 193 {
 194         if (!cur || !end || cur >= end)
 195                 return NULL;
 196         do {
 197                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 198         } while(cur < end && !ndisc_is_useropt(cur));
 199         return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 200 }
 201
 202 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 203                                           struct ndisc_options *ndopts)
 204 {
 205         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 206
 207         if (!nd_opt || opt_len < 0 || !ndopts)
 208                 return NULL;
 209         memset(ndopts, 0, sizeof(*ndopts));
 210         while (opt_len) {
 211                 int l;
 212                 if (opt_len < sizeof(struct nd_opt_hdr))
 213                         return NULL;
 214                 l = nd_opt->nd_opt_len << 3;
 215                 if (opt_len < l || l == 0)
 216                         return NULL;
 217                 switch (nd_opt->nd_opt_type) {
 218                 case ND_OPT_SOURCE_LL_ADDR:
 219                 case ND_OPT_TARGET_LL_ADDR:
 220                 case ND_OPT_MTU:
 221                 case ND_OPT_REDIRECT_HDR:
 222                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 223                                 ND_PRINTK(2, warn,
 224                                           "%s: duplicated ND6 option found: type=%d\n",
 225                                           __func__, nd_opt->nd_opt_type);
 226                         } else {
 227                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 228                         }
 229                         break;
 230                 case ND_OPT_PREFIX_INFO:
 231                         ndopts->nd_opts_pi_end = nd_opt;
 232                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 233                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 234                         break;
 235 #ifdef CONFIG_IPV6_ROUTE_INFO
 236                 case ND_OPT_ROUTE_INFO:
 237                         ndopts->nd_opts_ri_end = nd_opt;
 238                         if (!ndopts->nd_opts_ri)
 239                                 ndopts->nd_opts_ri = nd_opt;
 240                         break;
 241 #endif
 242                 default:
 243                         if (ndisc_is_useropt(nd_opt)) {
 244                                 ndopts->nd_useropts_end = nd_opt;
 245                                 if (!ndopts->nd_useropts)
 246                                         ndopts->nd_useropts = nd_opt;
 247                         } else {
 248                                 /*
 249                                  * Unknown options must be silently ignored,
 250                                  * to accommodate future extension to the
 251                                  * protocol.
 252                                  */
 253                                 ND_PRINTK(2, notice,
 254                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 255                                           __func__,
 256                                           nd_opt->nd_opt_type,
 257                                           nd_opt->nd_opt_len);
 258                         }
 259                 }
 260                 opt_len -= l;
 261                 nd_opt = ((void *)nd_opt) + l;
 262         }
 263         return ndopts;
 264 }
 265
 266 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 267 {
 268         switch (dev->type) {
 269         case ARPHRD_ETHER:
 270         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 271         case ARPHRD_FDDI:
 272                 ipv6_eth_mc_map(addr, buf);
 273                 return 0;
 274         case ARPHRD_ARCNET:
 275                 ipv6_arcnet_mc_map(addr, buf);
 276                 return 0;
 277         case ARPHRD_INFINIBAND:
 278                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 279                 return 0;
 280         case ARPHRD_IPGRE:
 281                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 282         default:
 283                 if (dir) {
 284                         memcpy(buf, dev->broadcast, dev->addr_len);
 285                         return 0;
 286                 }
 287         }
 288         return -EINVAL;
 289 }
 290
 291 EXPORT_SYMBOL(ndisc_mc_map);
 292
 293 static u32 ndisc_hash(const void *pkey,
 294                       const struct net_device *dev,
 295                       __u32 *hash_rnd)
 296 {
 297         return ndisc_hashfn(pkey, dev, hash_rnd);
 298 }
 299
 300 static int ndisc_constructor(struct neighbour *neigh)
 301 {
 302         struct in6_addr *addr = (struct in6_addr*)&neigh->primary_key;
 303         struct net_device *dev = neigh->dev;
 304         struct inet6_dev *in6_dev;
 305         struct neigh_parms *parms;
 306         bool is_multicast = ipv6_addr_is_multicast(addr);
 307
 308         in6_dev = in6_dev_get(dev);
 309         if (in6_dev == NULL) {
 310                 return -EINVAL;
 311         }
 312
 313         parms = in6_dev->nd_parms;
 314         __neigh_parms_put(neigh->parms);
 315         neigh->parms = neigh_parms_clone(parms);
 316
 317         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 318         if (!dev->header_ops) {
 319                 neigh->nud_state = NUD_NOARP;
 320                 neigh->ops = &ndisc_direct_ops;
 321                 neigh->output = neigh_direct_output;
 322         } else {
 323                 if (is_multicast) {
 324                         neigh->nud_state = NUD_NOARP;
 325                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 326                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 327                         neigh->nud_state = NUD_NOARP;
 328                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 329                         if (dev->flags&IFF_LOOPBACK)
 330                                 neigh->type = RTN_LOCAL;
 331                 } else if (dev->flags&IFF_POINTOPOINT) {
 332                         neigh->nud_state = NUD_NOARP;
 333                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 334                 }
 335                 if (dev->header_ops->cache)
 336                         neigh->ops = &ndisc_hh_ops;
 337                 else
 338                         neigh->ops = &ndisc_generic_ops;
 339                 if (neigh->nud_state&NUD_VALID)
 340                         neigh->output = neigh->ops->connected_output;
 341                 else
 342                         neigh->output = neigh->ops->output;
 343         }
 344         in6_dev_put(in6_dev);
 345         return 0;
 346 }
 347
 348 static int pndisc_constructor(struct pneigh_entry *n)
 349 {
 350         struct in6_addr *addr = (struct in6_addr*)&n->key;
 351         struct in6_addr maddr;
 352         struct net_device *dev = n->dev;
 353
 354         if (dev == NULL || __in6_dev_get(dev) == NULL)
 355                 return -EINVAL;
 356         addrconf_addr_solict_mult(addr, &maddr);
 357         ipv6_dev_mc_inc(dev, &maddr);
 358         return 0;
 359 }
 360
 361 static void pndisc_destructor(struct pneigh_entry *n)
 362 {
 363         struct in6_addr *addr = (struct in6_addr*)&n->key;
 364         struct in6_addr maddr;
 365         struct net_device *dev = n->dev;
 366
 367         if (dev == NULL || __in6_dev_get(dev) == NULL)
 368                 return;
 369         addrconf_addr_solict_mult(addr, &maddr);
 370         ipv6_dev_mc_dec(dev, &maddr);
 371 }
 372
 373 static struct sk_buff *ndisc_build_skb(struct net_device *dev,
 374                                        const struct in6_addr *daddr,
 375                                        const struct in6_addr *saddr,
 376                                        struct icmp6hdr *icmp6h,
 377                                        const struct in6_addr *target,
 378                                        int llinfo)
 379 {
 380         struct net *net = dev_net(dev);
 381         struct sock *sk = net->ipv6.ndisc_sk;
 382         struct sk_buff *skb;
 383         struct icmp6hdr *hdr;
 384         int hlen = LL_RESERVED_SPACE(dev);
 385         int tlen = dev->needed_tailroom;
 386         int len;
 387         int err;
 388         u8 *opt;
 389
 390         if (!dev->addr_len)
 391                 llinfo = 0;
 392
 393         len = sizeof(struct icmp6hdr) + (target ? sizeof(*target) : 0);
 394         if (llinfo)
 395                 len += ndisc_opt_addr_space(dev);
 396
 397         skb = sock_alloc_send_skb(sk,
 398                                   (sizeof(struct ipv6hdr) +
 399                                    len + hlen + tlen),
 400                                   1, &err);
 401         if (!skb) {
 402                 ND_PRINTK(0, err, "ND: %s failed to allocate an skb, err=%d\n",
 403                           __func__, err);
 404                 return NULL;
 405         }
 406
 407         skb_reserve(skb, hlen);
 408         ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
 409
 410         skb->transport_header = skb->tail;
 411         skb_put(skb, len);
 412
 413         hdr = (struct icmp6hdr *)skb_transport_header(skb);
 414         memcpy(hdr, icmp6h, sizeof(*hdr));
 415
 416         opt = skb_transport_header(skb) + sizeof(struct icmp6hdr);
 417         if (target) {
 418                 *(struct in6_addr *)opt = *target;
 419                 opt += sizeof(*target);
 420         }
 421
 422         if (llinfo)
 423                 ndisc_fill_addr_option(opt, llinfo, dev->dev_addr,
 424                                        dev->addr_len, dev->type);
 425
 426         hdr->icmp6_cksum = csum_ipv6_magic(saddr, daddr, len,
 427                                            IPPROTO_ICMPV6,
 428                                            csum_partial(hdr,
 429                                                         len, 0));
 430
 431         return skb;
 432 }
 433
 434 static void ndisc_send_skb(struct sk_buff *skb, struct net_device *dev,
 435                            const struct in6_addr *daddr,
 436                            const struct in6_addr *saddr,
 437                            struct icmp6hdr *icmp6h)
 438 {
 439         struct flowi6 fl6;
 440         struct dst_entry *dst;
 441         struct net *net = dev_net(dev);
 442         struct sock *sk = net->ipv6.ndisc_sk;
 443         struct inet6_dev *idev;
 444         int err;
 445         u8 type;
 446
 447         type = icmp6h->icmp6_type;
 448
 449         icmpv6_flow_init(sk, &fl6, type, saddr, daddr, dev->ifindex);
 450         dst = icmp6_dst_alloc(dev, &fl6);
 451         if (IS_ERR(dst)) {
 452                 kfree_skb(skb);
 453                 return;
 454         }
 455
 456         skb_dst_set(skb, dst);
 457
 458         rcu_read_lock();
 459         idev = __in6_dev_get(dst->dev);
 460         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 461
 462         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 463                       dst_output);
 464         if (!err) {
 465                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 466                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 467         }
 468
 469         rcu_read_unlock();
 470 }
 471
 472 /*
 473  *      Send a Neighbour Discover packet
 474  */
 475 static void __ndisc_send(struct net_device *dev,
 476                          const struct in6_addr *daddr,
 477                          const struct in6_addr *saddr,
 478                          struct icmp6hdr *icmp6h, const struct in6_addr *target,
 479                          int llinfo)
 480 {
 481         struct sk_buff *skb;
 482
 483         skb = ndisc_build_skb(dev, daddr, saddr, icmp6h, target, llinfo);
 484         if (!skb)
 485                 return;
 486
 487         ndisc_send_skb(skb, dev, daddr, saddr, icmp6h);
 488 }
 489
 490 static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 491                           const struct in6_addr *daddr,
 492                           const struct in6_addr *solicited_addr,
 493                           int router, int solicited, int override, int inc_opt)
 494 {
 495         struct in6_addr tmpaddr;
 496         struct inet6_ifaddr *ifp;
 497         const struct in6_addr *src_addr;
 498         struct icmp6hdr icmp6h = {
 499                 .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 500         };
 501
 502         /* for anycast or proxy, solicited_addr != src_addr */
 503         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 504         if (ifp) {
 505                 src_addr = solicited_addr;
 506                 if (ifp->flags & IFA_F_OPTIMISTIC)
 507                         override = 0;
 508                 inc_opt |= ifp->idev->cnf.force_tllao;
 509                 in6_ifa_put(ifp);
 510         } else {
 511                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 512                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 513                                        &tmpaddr))
 514                         return;
 515                 src_addr = &tmpaddr;
 516         }
 517
 518         icmp6h.icmp6_router = router;
 519         icmp6h.icmp6_solicited = solicited;
 520         icmp6h.icmp6_override = override;
 521
 522         __ndisc_send(dev, daddr, src_addr, &icmp6h, solicited_addr,
 523                      inc_opt ? ND_OPT_TARGET_LL_ADDR : 0);
 524 }
 525
 526 static void ndisc_send_unsol_na(struct net_device *dev)
 527 {
 528         struct inet6_dev *idev;
 529         struct inet6_ifaddr *ifa;
 530
 531         idev = in6_dev_get(dev);
 532         if (!idev)
 533                 return;
 534
 535         read_lock_bh(&idev->lock);
 536         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 537                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
 538                               /*router=*/ !!idev->cnf.forwarding,
 539                               /*solicited=*/ false, /*override=*/ true,
 540                               /*inc_opt=*/ true);
 541         }
 542         read_unlock_bh(&idev->lock);
 543
 544         in6_dev_put(idev);
 545 }
 546
 547 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 548                    const struct in6_addr *solicit,
 549                    const struct in6_addr *daddr, const struct in6_addr *saddr)
 550 {
 551         struct in6_addr addr_buf;
 552         struct icmp6hdr icmp6h = {
 553                 .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 554         };
 555
 556         if (saddr == NULL) {
 557                 if (ipv6_get_lladdr(dev, &addr_buf,
 558                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 559                         return;
 560                 saddr = &addr_buf;
 561         }
 562
 563         __ndisc_send(dev, daddr, saddr, &icmp6h, solicit,
 564                      !ipv6_addr_any(saddr) ? ND_OPT_SOURCE_LL_ADDR : 0);
 565 }
 566
 567 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 568                    const struct in6_addr *daddr)
 569 {
 570         struct icmp6hdr icmp6h = {
 571                 .icmp6_type = NDISC_ROUTER_SOLICITATION,
 572         };
 573         int send_sllao = dev->addr_len;
 574
 575 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 576         /*
 577          * According to section 2.2 of RFC 4429, we must not
 578          * send router solicitations with a sllao from
 579          * optimistic addresses, but we may send the solicitation
 580          * if we don't include the sllao.  So here we check
 581          * if our address is optimistic, and if so, we
 582          * suppress the inclusion of the sllao.
 583          */
 584         if (send_sllao) {
 585                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 586                                                            dev, 1);
 587                 if (ifp) {
 588                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 589                                 send_sllao = 0;
 590                         }
 591                         in6_ifa_put(ifp);
 592                 } else {
 593                         send_sllao = 0;
 594                 }
 595         }
 596 #endif
 597         __ndisc_send(dev, daddr, saddr, &icmp6h, NULL,
 598                      send_sllao ? ND_OPT_SOURCE_LL_ADDR : 0);
 599 }
 600
 601
 602 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 603 {
 604         /*
 605          *      "The sender MUST return an ICMP
 606          *       destination unreachable"
 607          */
 608         dst_link_failure(skb);
 609         kfree_skb(skb);
 610 }
 611
 612 /* Called with locked neigh: either read or both */
 613
 614 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 615 {
 616         struct in6_addr *saddr = NULL;
 617         struct in6_addr mcaddr;
 618         struct net_device *dev = neigh->dev;
 619         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 620         int probes = atomic_read(&neigh->probes);
 621
 622         if (skb && ipv6_chk_addr(dev_net(dev), &ipv6_hdr(skb)->saddr, dev, 1))
 623                 saddr = &ipv6_hdr(skb)->saddr;
 624
 625         if ((probes -= neigh->parms->ucast_probes) < 0) {
 626                 if (!(neigh->nud_state & NUD_VALID)) {
 627                         ND_PRINTK(1, dbg,
 628                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 629                                   __func__, target);
 630                 }
 631                 ndisc_send_ns(dev, neigh, target, target, saddr);
 632         } else if ((probes -= neigh->parms->app_probes) < 0) {
 633 #ifdef CONFIG_ARPD
 634                 neigh_app_ns(neigh);
 635 #endif
 636         } else {
 637                 addrconf_addr_solict_mult(target, &mcaddr);
 638                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 639         }
 640 }
 641
 642 static int pndisc_is_router(const void *pkey,
 643                             struct net_device *dev)
 644 {
 645         struct pneigh_entry *n;
 646         int ret = -1;
 647
 648         read_lock_bh(&nd_tbl.lock);
 649         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 650         if (n)
 651                 ret = !!(n->flags & NTF_ROUTER);
 652         read_unlock_bh(&nd_tbl.lock);
 653
 654         return ret;
 655 }
 656
 657 static void ndisc_recv_ns(struct sk_buff *skb)
 658 {
 659         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 660         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 661         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 662         u8 *lladdr = NULL;
 663         u32 ndoptlen = skb->tail - (skb->transport_header +
 664                                     offsetof(struct nd_msg, opt));
 665         struct ndisc_options ndopts;
 666         struct net_device *dev = skb->dev;
 667         struct inet6_ifaddr *ifp;
 668         struct inet6_dev *idev = NULL;
 669         struct neighbour *neigh;
 670         int dad = ipv6_addr_any(saddr);
 671         bool inc;
 672         int is_router = -1;
 673
 674         if (skb->len < sizeof(struct nd_msg)) {
 675                 ND_PRINTK(2, warn, "NS: packet too short\n");
 676                 return;
 677         }
 678
 679         if (ipv6_addr_is_multicast(&msg->target)) {
 680                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 681                 return;
 682         }
 683
 684         /*
 685          * RFC2461 7.1.1:
 686          * DAD has to be destined for solicited node multicast address.
 687          */
 688         if (dad &&
 689             !(daddr->s6_addr32[0] == htonl(0xff020000) &&
 690               daddr->s6_addr32[1] == htonl(0x00000000) &&
 691               daddr->s6_addr32[2] == htonl(0x00000001) &&
 692               daddr->s6_addr [12] == 0xff )) {
 693                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 694                 return;
 695         }
 696
 697         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 698                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 699                 return;
 700         }
 701
 702         if (ndopts.nd_opts_src_lladdr) {
 703                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 704                 if (!lladdr) {
 705                         ND_PRINTK(2, warn,
 706                                   "NS: invalid link-layer address length\n");
 707                         return;
 708                 }
 709
 710                 /* RFC2461 7.1.1:
 711                  *      If the IP source address is the unspecified address,
 712                  *      there MUST NOT be source link-layer address option
 713                  *      in the message.
 714                  */
 715                 if (dad) {
 716                         ND_PRINTK(2, warn,
 717                                   "NS: bad DAD packet (link-layer address option)\n");
 718                         return;
 719                 }
 720         }
 721
 722         inc = ipv6_addr_is_multicast(daddr);
 723
 724         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 725         if (ifp) {
 726
 727                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 728                         if (dad) {
 729                                 /*
 730                                  * We are colliding with another node
 731                                  * who is doing DAD
 732                                  * so fail our DAD process
 733                                  */
 734                                 addrconf_dad_failure(ifp);
 735                                 return;
 736                         } else {
 737                                 /*
 738                                  * This is not a dad solicitation.
 739                                  * If we are an optimistic node,
 740                                  * we should respond.
 741                                  * Otherwise, we should ignore it.
 742                                  */
 743                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 744                                         goto out;
 745                         }
 746                 }
 747
 748                 idev = ifp->idev;
 749         } else {
 750                 struct net *net = dev_net(dev);
 751
 752                 idev = in6_dev_get(dev);
 753                 if (!idev) {
 754                         /* XXX: count this drop? */
 755                         return;
 756                 }
 757
 758                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 759                     (idev->cnf.forwarding &&
 760                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 761                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 762                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 763                             skb->pkt_type != PACKET_HOST &&
 764                             inc != 0 &&
 765                             idev->nd_parms->proxy_delay != 0) {
 766                                 /*
 767                                  * for anycast or proxy,
 768                                  * sender should delay its response
 769                                  * by a random time between 0 and
 770                                  * MAX_ANYCAST_DELAY_TIME seconds.
 771                                  * (RFC2461) -- yoshfuji
 772                                  */
 773                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 774                                 if (n)
 775                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 776                                 goto out;
 777                         }
 778                 } else
 779                         goto out;
 780         }
 781
 782         if (is_router < 0)
 783                 is_router = !!idev->cnf.forwarding;
 784
 785         if (dad) {
 786                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
 787                               is_router, 0, (ifp != NULL), 1);
 788                 goto out;
 789         }
 790
 791         if (inc)
 792                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 793         else
 794                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 795
 796         /*
 797          *      update / create cache entry
 798          *      for the source address
 799          */
 800         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 801                                !inc || lladdr || !dev->addr_len);
 802         if (neigh)
 803                 neigh_update(neigh, lladdr, NUD_STALE,
 804                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 805                              NEIGH_UPDATE_F_OVERRIDE);
 806         if (neigh || !dev->header_ops) {
 807                 ndisc_send_na(dev, neigh, saddr, &msg->target,
 808                               is_router,
 809                               1, (ifp != NULL && inc), inc);
 810                 if (neigh)
 811                         neigh_release(neigh);
 812         }
 813
 814 out:
 815         if (ifp)
 816                 in6_ifa_put(ifp);
 817         else
 818                 in6_dev_put(idev);
 819 }
 820
 821 static void ndisc_recv_na(struct sk_buff *skb)
 822 {
 823         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 824         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 825         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 826         u8 *lladdr = NULL;
 827         u32 ndoptlen = skb->tail - (skb->transport_header +
 828                                     offsetof(struct nd_msg, opt));
 829         struct ndisc_options ndopts;
 830         struct net_device *dev = skb->dev;
 831         struct inet6_ifaddr *ifp;
 832         struct neighbour *neigh;
 833
 834         if (skb->len < sizeof(struct nd_msg)) {
 835                 ND_PRINTK(2, warn, "NA: packet too short\n");
 836                 return;
 837         }
 838
 839         if (ipv6_addr_is_multicast(&msg->target)) {
 840                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 841                 return;
 842         }
 843
 844         if (ipv6_addr_is_multicast(daddr) &&
 845             msg->icmph.icmp6_solicited) {
 846                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 847                 return;
 848         }
 849
 850         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 851                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 852                 return;
 853         }
 854         if (ndopts.nd_opts_tgt_lladdr) {
 855                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 856                 if (!lladdr) {
 857                         ND_PRINTK(2, warn,
 858                                   "NA: invalid link-layer address length\n");
 859                         return;
 860                 }
 861         }
 862         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 863         if (ifp) {
 864                 if (skb->pkt_type != PACKET_LOOPBACK
 865                     && (ifp->flags & IFA_F_TENTATIVE)) {
 866                                 addrconf_dad_failure(ifp);
 867                                 return;
 868                 }
 869                 /* What should we make now? The advertisement
 870                    is invalid, but ndisc specs say nothing
 871                    about it. It could be misconfiguration, or
 872                    an smart proxy agent tries to help us :-)
 873
 874                    We should not print the error if NA has been
 875                    received from loopback - it is just our own
 876                    unsolicited advertisement.
 877                  */
 878                 if (skb->pkt_type != PACKET_LOOPBACK)
 879                         ND_PRINTK(1, warn,
 880                                   "NA: someone advertises our address %pI6 on %s!\n",
 881                                   &ifp->addr, ifp->idev->dev->name);
 882                 in6_ifa_put(ifp);
 883                 return;
 884         }
 885         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 886
 887         if (neigh) {
 888                 u8 old_flags = neigh->flags;
 889                 struct net *net = dev_net(dev);
 890
 891                 if (neigh->nud_state & NUD_FAILED)
 892                         goto out;
 893
 894                 /*
 895                  * Don't update the neighbor cache entry on a proxy NA from
 896                  * ourselves because either the proxied node is off link or it
 897                  * has already sent a NA to us.
 898                  */
 899                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 900                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
 901                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
 902                         /* XXX: idev->cnf.proxy_ndp */
 903                         goto out;
 904                 }
 905
 906                 neigh_update(neigh, lladdr,
 907                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 908                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 909                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 910                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 911                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 912
 913                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 914                         /*
 915                          * Change: router to host
 916                          */
 917                         struct rt6_info *rt;
 918                         rt = rt6_get_dflt_router(saddr, dev);
 919                         if (rt)
 920                                 ip6_del_rt(rt);
 921                 }
 922
 923 out:
 924                 neigh_release(neigh);
 925         }
 926 }
 927
 928 static void ndisc_recv_rs(struct sk_buff *skb)
 929 {
 930         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 931         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 932         struct neighbour *neigh;
 933         struct inet6_dev *idev;
 934         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 935         struct ndisc_options ndopts;
 936         u8 *lladdr = NULL;
 937
 938         if (skb->len < sizeof(*rs_msg))
 939                 return;
 940
 941         idev = __in6_dev_get(skb->dev);
 942         if (!idev) {
 943                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
 944                 return;
 945         }
 946
 947         /* Don't accept RS if we're not in router mode */
 948         if (!idev->cnf.forwarding)
 949                 goto out;
 950
 951         /*
 952          * Don't update NCE if src = ::;
 953          * this implies that the source node has no ip address assigned yet.
 954          */
 955         if (ipv6_addr_any(saddr))
 956                 goto out;
 957
 958         /* Parse ND options */
 959         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 960                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
 961                 goto out;
 962         }
 963
 964         if (ndopts.nd_opts_src_lladdr) {
 965                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
 966                                              skb->dev);
 967                 if (!lladdr)
 968                         goto out;
 969         }
 970
 971         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
 972         if (neigh) {
 973                 neigh_update(neigh, lladdr, NUD_STALE,
 974                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 975                              NEIGH_UPDATE_F_OVERRIDE|
 976                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
 977                 neigh_release(neigh);
 978         }
 979 out:
 980         return;
 981 }
 982
 983 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
 984 {
 985         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
 986         struct sk_buff *skb;
 987         struct nlmsghdr *nlh;
 988         struct nduseroptmsg *ndmsg;
 989         struct net *net = dev_net(ra->dev);
 990         int err;
 991         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
 992                                     + (opt->nd_opt_len << 3));
 993         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
 994
 995         skb = nlmsg_new(msg_size, GFP_ATOMIC);
 996         if (skb == NULL) {
 997                 err = -ENOBUFS;
 998                 goto errout;
 999         }
1000
1001         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1002         if (nlh == NULL) {
1003                 goto nla_put_failure;
1004         }
1005
1006         ndmsg = nlmsg_data(nlh);
1007         ndmsg->nduseropt_family = AF_INET6;
1008         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1009         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1010         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1011         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1012
1013         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1014
1015         if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1016                     &ipv6_hdr(ra)->saddr))
1017                 goto nla_put_failure;
1018         nlmsg_end(skb, nlh);
1019
1020         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1021         return;
1022
1023 nla_put_failure:
1024         nlmsg_free(skb);
1025         err = -EMSGSIZE;
1026 errout:
1027         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1028 }
1029
1030 static void ndisc_router_discovery(struct sk_buff *skb)
1031 {
1032         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1033         struct neighbour *neigh = NULL;
1034         struct inet6_dev *in6_dev;
1035         struct rt6_info *rt = NULL;
1036         int lifetime;
1037         struct ndisc_options ndopts;
1038         int optlen;
1039         unsigned int pref = 0;
1040
1041         __u8 * opt = (__u8 *)(ra_msg + 1);
1042
1043         optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
1044
1045         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1046                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1047                 return;
1048         }
1049         if (optlen < 0) {
1050                 ND_PRINTK(2, warn, "RA: packet too short\n");
1051                 return;
1052         }
1053
1054 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1055         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1056                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1057                 return;
1058         }
1059 #endif
1060
1061         /*
1062          *      set the RA_RECV flag in the interface
1063          */
1064
1065         in6_dev = __in6_dev_get(skb->dev);
1066         if (in6_dev == NULL) {
1067                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1068                           skb->dev->name);
1069                 return;
1070         }
1071
1072         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1073                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1074                 return;
1075         }
1076
1077         if (!ipv6_accept_ra(in6_dev))
1078                 goto skip_linkparms;
1079
1080 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1081         /* skip link-specific parameters from interior routers */
1082         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
1083                 goto skip_linkparms;
1084 #endif
1085
1086         if (in6_dev->if_flags & IF_RS_SENT) {
1087                 /*
1088                  *      flag that an RA was received after an RS was sent
1089                  *      out on this interface.
1090                  */
1091                 in6_dev->if_flags |= IF_RA_RCVD;
1092         }
1093
1094         /*
1095          * Remember the managed/otherconf flags from most recently
1096          * received RA message (RFC 2462) -- yoshfuji
1097          */
1098         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1099                                 IF_RA_OTHERCONF)) |
1100                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1101                                         IF_RA_MANAGED : 0) |
1102                                 (ra_msg->icmph.icmp6_addrconf_other ?
1103                                         IF_RA_OTHERCONF : 0);
1104
1105         if (!in6_dev->cnf.accept_ra_defrtr)
1106                 goto skip_defrtr;
1107
1108         if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
1109                 goto skip_defrtr;
1110
1111         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1112
1113 #ifdef CONFIG_IPV6_ROUTER_PREF
1114         pref = ra_msg->icmph.icmp6_router_pref;
1115         /* 10b is handled as if it were 00b (medium) */
1116         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1117             !in6_dev->cnf.accept_ra_rtr_pref)
1118                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1119 #endif
1120
1121         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1122
1123         if (rt) {
1124                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1125                 if (!neigh) {
1126                         ND_PRINTK(0, err,
1127                                   "RA: %s got default router without neighbour\n",
1128                                   __func__);
1129                         ip6_rt_put(rt);
1130                         return;
1131                 }
1132         }
1133         if (rt && lifetime == 0) {
1134                 ip6_del_rt(rt);
1135                 rt = NULL;
1136         }
1137
1138         if (rt == NULL && lifetime) {
1139                 ND_PRINTK(3, dbg, "RA: adding default router\n");
1140
1141                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1142                 if (rt == NULL) {
1143                         ND_PRINTK(0, err,
1144                                   "RA: %s failed to add default route\n",
1145                                   __func__);
1146                         return;
1147                 }
1148
1149                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1150                 if (neigh == NULL) {
1151                         ND_PRINTK(0, err,
1152                                   "RA: %s got default router without neighbour\n",
1153                                   __func__);
1154                         ip6_rt_put(rt);
1155                         return;
1156                 }
1157                 neigh->flags |= NTF_ROUTER;
1158         } else if (rt) {
1159                 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1160         }
1161
1162         if (rt)
1163                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1164         if (ra_msg->icmph.icmp6_hop_limit) {
1165                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1166                 if (rt)
1167                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1168                                        ra_msg->icmph.icmp6_hop_limit);
1169         }
1170
1171 skip_defrtr:
1172
1173         /*
1174          *      Update Reachable Time and Retrans Timer
1175          */
1176
1177         if (in6_dev->nd_parms) {
1178                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1179
1180                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1181                         rtime = (rtime*HZ)/1000;
1182                         if (rtime < HZ/10)
1183                                 rtime = HZ/10;
1184                         in6_dev->nd_parms->retrans_time = rtime;
1185                         in6_dev->tstamp = jiffies;
1186                         inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1187                 }
1188
1189                 rtime = ntohl(ra_msg->reachable_time);
1190                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1191                         rtime = (rtime*HZ)/1000;
1192
1193                         if (rtime < HZ/10)
1194                                 rtime = HZ/10;
1195
1196                         if (rtime != in6_dev->nd_parms->base_reachable_time) {
1197                                 in6_dev->nd_parms->base_reachable_time = rtime;
1198                                 in6_dev->nd_parms->gc_staletime = 3 * rtime;
1199                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1200                                 in6_dev->tstamp = jiffies;
1201                                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1202                         }
1203                 }
1204         }
1205
1206 skip_linkparms:
1207
1208         /*
1209          *      Process options.
1210          */
1211
1212         if (!neigh)
1213                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1214                                        skb->dev, 1);
1215         if (neigh) {
1216                 u8 *lladdr = NULL;
1217                 if (ndopts.nd_opts_src_lladdr) {
1218                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1219                                                      skb->dev);
1220                         if (!lladdr) {
1221                                 ND_PRINTK(2, warn,
1222                                           "RA: invalid link-layer address length\n");
1223                                 goto out;
1224                         }
1225                 }
1226                 neigh_update(neigh, lladdr, NUD_STALE,
1227                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1228                              NEIGH_UPDATE_F_OVERRIDE|
1229                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1230                              NEIGH_UPDATE_F_ISROUTER);
1231         }
1232
1233         if (!ipv6_accept_ra(in6_dev))
1234                 goto out;
1235
1236 #ifdef CONFIG_IPV6_ROUTE_INFO
1237         if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
1238                 goto skip_routeinfo;
1239
1240         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1241                 struct nd_opt_hdr *p;
1242                 for (p = ndopts.nd_opts_ri;
1243                      p;
1244                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1245                         struct route_info *ri = (struct route_info *)p;
1246 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1247                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1248                             ri->prefix_len == 0)
1249                                 continue;
1250 #endif
1251                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1252                                 continue;
1253                         rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
1254                                       &ipv6_hdr(skb)->saddr);
1255                 }
1256         }
1257
1258 skip_routeinfo:
1259 #endif
1260
1261 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1262         /* skip link-specific ndopts from interior routers */
1263         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
1264                 goto out;
1265 #endif
1266
1267         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1268                 struct nd_opt_hdr *p;
1269                 for (p = ndopts.nd_opts_pi;
1270                      p;
1271                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1272                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1273                                             (p->nd_opt_len) << 3,
1274                                             ndopts.nd_opts_src_lladdr != NULL);
1275                 }
1276         }
1277
1278         if (ndopts.nd_opts_mtu) {
1279                 __be32 n;
1280                 u32 mtu;
1281
1282                 memcpy(&n, ((u8*)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1283                 mtu = ntohl(n);
1284
1285                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1286                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1287                 } else if (in6_dev->cnf.mtu6 != mtu) {
1288                         in6_dev->cnf.mtu6 = mtu;
1289
1290                         if (rt)
1291                                 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1292
1293                         rt6_mtu_change(skb->dev, mtu);
1294                 }
1295         }
1296
1297         if (ndopts.nd_useropts) {
1298                 struct nd_opt_hdr *p;
1299                 for (p = ndopts.nd_useropts;
1300                      p;
1301                      p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1302                         ndisc_ra_useropt(skb, p);
1303                 }
1304         }
1305
1306         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1307                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1308         }
1309 out:
1310         ip6_rt_put(rt);
1311         if (neigh)
1312                 neigh_release(neigh);
1313 }
1314
1315 static void ndisc_redirect_rcv(struct sk_buff *skb)
1316 {
1317         u8 *hdr;
1318         struct ndisc_options ndopts;
1319         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1320         u32 ndoptlen = skb->tail - (skb->transport_header +
1321                                     offsetof(struct rd_msg, opt));
1322
1323 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1324         switch (skb->ndisc_nodetype) {
1325         case NDISC_NODETYPE_HOST:
1326         case NDISC_NODETYPE_NODEFAULT:
1327                 ND_PRINTK(2, warn,
1328                           "Redirect: from host or unauthorized router\n");
1329                 return;
1330         }
1331 #endif
1332
1333         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1334                 ND_PRINTK(2, warn,
1335                           "Redirect: source address is not link-local\n");
1336                 return;
1337         }
1338
1339         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1340                 return;
1341
1342         if (!ndopts.nd_opts_rh)
1343                 return;
1344
1345         hdr = (u8 *)ndopts.nd_opts_rh;
1346         hdr += 8;
1347         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1348                 return;
1349
1350         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1351 }
1352
1353 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1354 {
1355         struct net_device *dev = skb->dev;
1356         struct net *net = dev_net(dev);
1357         struct sock *sk = net->ipv6.ndisc_sk;
1358         int len = sizeof(struct rd_msg);
1359         struct inet_peer *peer;
1360         struct sk_buff *buff;
1361         struct rd_msg *msg;
1362         struct in6_addr saddr_buf;
1363         struct rt6_info *rt;
1364         struct dst_entry *dst;
1365         struct inet6_dev *idev;
1366         struct flowi6 fl6;
1367         u8 *opt;
1368         int hlen, tlen;
1369         int rd_len;
1370         int err;
1371         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1372         bool ret;
1373
1374         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1375                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1376                           dev->name);
1377                 return;
1378         }
1379
1380         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1381             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1382                 ND_PRINTK(2, warn,
1383                           "Redirect: target address is not link-local unicast\n");
1384                 return;
1385         }
1386
1387         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1388                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1389
1390         dst = ip6_route_output(net, NULL, &fl6);
1391         if (dst->error) {
1392                 dst_release(dst);
1393                 return;
1394         }
1395         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1396         if (IS_ERR(dst))
1397                 return;
1398
1399         rt = (struct rt6_info *) dst;
1400
1401         if (rt->rt6i_flags & RTF_GATEWAY) {
1402                 ND_PRINTK(2, warn,
1403                           "Redirect: destination is not a neighbour\n");
1404                 goto release;
1405         }
1406         peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
1407         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1408         if (peer)
1409                 inet_putpeer(peer);
1410         if (!ret)
1411                 goto release;
1412
1413         if (dev->addr_len) {
1414                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1415                 if (!neigh) {
1416                         ND_PRINTK(2, warn,
1417                                   "Redirect: no neigh for target address\n");
1418                         goto release;
1419                 }
1420
1421                 read_lock_bh(&neigh->lock);
1422                 if (neigh->nud_state & NUD_VALID) {
1423                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1424                         read_unlock_bh(&neigh->lock);
1425                         ha = ha_buf;
1426                         len += ndisc_opt_addr_space(dev);
1427                 } else
1428                         read_unlock_bh(&neigh->lock);
1429
1430                 neigh_release(neigh);
1431         }
1432
1433         rd_len = min_t(unsigned int,
1434                      IPV6_MIN_MTU-sizeof(struct ipv6hdr)-len, skb->len + 8);
1435         rd_len &= ~0x7;
1436         len += rd_len;
1437
1438         hlen = LL_RESERVED_SPACE(dev);
1439         tlen = dev->needed_tailroom;
1440         buff = sock_alloc_send_skb(sk,
1441                                    (sizeof(struct ipv6hdr) +
1442                                     len + hlen + tlen),
1443                                    1, &err);
1444         if (buff == NULL) {
1445                 ND_PRINTK(0, err,
1446                           "Redirect: %s failed to allocate an skb, err=%d\n",
1447                           __func__, err);
1448                 goto release;
1449         }
1450
1451         skb_reserve(buff, hlen);
1452         ip6_nd_hdr(sk, buff, dev, &saddr_buf, &ipv6_hdr(skb)->saddr,
1453                    IPPROTO_ICMPV6, len);
1454
1455         skb_set_transport_header(buff, skb_tail_pointer(buff) - buff->data);
1456         skb_put(buff, len);
1457         msg = (struct rd_msg *)icmp6_hdr(buff);
1458
1459         memset(&msg->icmph, 0, sizeof(struct icmp6hdr));
1460         msg->icmph.icmp6_type = NDISC_REDIRECT;
1461
1462         /*
1463          *      copy target and destination addresses
1464          */
1465
1466         msg->target = *target;
1467         msg->dest = ipv6_hdr(skb)->daddr;
1468
1469         opt = msg->opt;
1470
1471         /*
1472          *      include target_address option
1473          */
1474
1475         if (ha)
1476                 opt = ndisc_fill_addr_option(opt, ND_OPT_TARGET_LL_ADDR, ha,
1477                                              dev->addr_len, dev->type);
1478
1479         /*
1480          *      build redirect option and copy skb over to the new packet.
1481          */
1482
1483         memset(opt, 0, 8);
1484         *(opt++) = ND_OPT_REDIRECT_HDR;
1485         *(opt++) = (rd_len >> 3);
1486         opt += 6;
1487
1488         memcpy(opt, ipv6_hdr(skb), rd_len - 8);
1489
1490         msg->icmph.icmp6_cksum = csum_ipv6_magic(&saddr_buf, &ipv6_hdr(skb)->saddr,
1491                                                  len, IPPROTO_ICMPV6,
1492                                                  csum_partial(msg, len, 0));
1493
1494         skb_dst_set(buff, dst);
1495         rcu_read_lock();
1496         idev = __in6_dev_get(dst->dev);
1497         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
1498         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, buff, NULL, dst->dev,
1499                       dst_output);
1500         if (!err) {
1501                 ICMP6MSGOUT_INC_STATS(net, idev, NDISC_REDIRECT);
1502                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1503         }
1504
1505         rcu_read_unlock();
1506         return;
1507
1508 release:
1509         dst_release(dst);
1510 }
1511
1512 static void pndisc_redo(struct sk_buff *skb)
1513 {
1514         ndisc_recv_ns(skb);
1515         kfree_skb(skb);
1516 }
1517
1518 int ndisc_rcv(struct sk_buff *skb)
1519 {
1520         struct nd_msg *msg;
1521
1522         if (!pskb_may_pull(skb, skb->len))
1523                 return 0;
1524
1525         msg = (struct nd_msg *)skb_transport_header(skb);
1526
1527         __skb_push(skb, skb->data - skb_transport_header(skb));
1528
1529         if (ipv6_hdr(skb)->hop_limit != 255) {
1530                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1531                           ipv6_hdr(skb)->hop_limit);
1532                 return 0;
1533         }
1534
1535         if (msg->icmph.icmp6_code != 0) {
1536                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1537                           msg->icmph.icmp6_code);
1538                 return 0;
1539         }
1540
1541         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1542
1543         switch (msg->icmph.icmp6_type) {
1544         case NDISC_NEIGHBOUR_SOLICITATION:
1545                 ndisc_recv_ns(skb);
1546                 break;
1547
1548         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1549                 ndisc_recv_na(skb);
1550                 break;
1551
1552         case NDISC_ROUTER_SOLICITATION:
1553                 ndisc_recv_rs(skb);
1554                 break;
1555
1556         case NDISC_ROUTER_ADVERTISEMENT:
1557                 ndisc_router_discovery(skb);
1558                 break;
1559
1560         case NDISC_REDIRECT:
1561                 ndisc_redirect_rcv(skb);
1562                 break;
1563         }
1564
1565         return 0;
1566 }
1567
1568 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1569 {
1570         struct net_device *dev = ptr;
1571         struct net *net = dev_net(dev);
1572         struct inet6_dev *idev;
1573
1574         switch (event) {
1575         case NETDEV_CHANGEADDR:
1576                 neigh_changeaddr(&nd_tbl, dev);
1577                 fib6_run_gc(~0UL, net);
1578                 idev = in6_dev_get(dev);
1579                 if (!idev)
1580                         break;
1581                 if (idev->cnf.ndisc_notify)
1582                         ndisc_send_unsol_na(dev);
1583                 in6_dev_put(idev);
1584                 break;
1585         case NETDEV_DOWN:
1586                 neigh_ifdown(&nd_tbl, dev);
1587                 fib6_run_gc(~0UL, net);
1588                 break;
1589         case NETDEV_NOTIFY_PEERS:
1590                 ndisc_send_unsol_na(dev);
1591                 break;
1592         default:
1593                 break;
1594         }
1595
1596         return NOTIFY_DONE;
1597 }
1598
1599 static struct notifier_block ndisc_netdev_notifier = {
1600         .notifier_call = ndisc_netdev_event,
1601 };
1602
1603 #ifdef CONFIG_SYSCTL
1604 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1605                                          const char *func, const char *dev_name)
1606 {
1607         static char warncomm[TASK_COMM_LEN];
1608         static int warned;
1609         if (strcmp(warncomm, current->comm) && warned < 5) {
1610                 strcpy(warncomm, current->comm);
1611                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1612                         warncomm, func,
1613                         dev_name, ctl->procname,
1614                         dev_name, ctl->procname);
1615                 warned++;
1616         }
1617 }
1618
1619 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1620 {
1621         struct net_device *dev = ctl->extra1;
1622         struct inet6_dev *idev;
1623         int ret;
1624
1625         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1626             (strcmp(ctl->procname, "base_reachable_time") == 0))
1627                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1628
1629         if (strcmp(ctl->procname, "retrans_time") == 0)
1630                 ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
1631
1632         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1633                 ret = proc_dointvec_jiffies(ctl, write,
1634                                             buffer, lenp, ppos);
1635
1636         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1637                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1638                 ret = proc_dointvec_ms_jiffies(ctl, write,
1639                                                buffer, lenp, ppos);
1640         else
1641                 ret = -1;
1642
1643         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1644                 if (ctl->data == &idev->nd_parms->base_reachable_time)
1645                         idev->nd_parms->reachable_time = neigh_rand_reach_time(idev->nd_parms->base_reachable_time);
1646                 idev->tstamp = jiffies;
1647                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1648                 in6_dev_put(idev);
1649         }
1650         return ret;
1651 }
1652
1653
1654 #endif
1655
1656 static int __net_init ndisc_net_init(struct net *net)
1657 {
1658         struct ipv6_pinfo *np;
1659         struct sock *sk;
1660         int err;
1661
1662         err = inet_ctl_sock_create(&sk, PF_INET6,
1663                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1664         if (err < 0) {
1665                 ND_PRINTK(0, err,
1666                           "NDISC: Failed to initialize the control socket (err %d)\n",
1667                           err);
1668                 return err;
1669         }
1670
1671         net->ipv6.ndisc_sk = sk;
1672
1673         np = inet6_sk(sk);
1674         np->hop_limit = 255;
1675         /* Do not loopback ndisc messages */
1676         np->mc_loop = 0;
1677
1678         return 0;
1679 }
1680
1681 static void __net_exit ndisc_net_exit(struct net *net)
1682 {
1683         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1684 }
1685
1686 static struct pernet_operations ndisc_net_ops = {
1687         .init = ndisc_net_init,
1688         .exit = ndisc_net_exit,
1689 };
1690
1691 int __init ndisc_init(void)
1692 {
1693         int err;
1694
1695         err = register_pernet_subsys(&ndisc_net_ops);
1696         if (err)
1697                 return err;
1698         /*
1699          * Initialize the neighbour table
1700          */
1701         neigh_table_init(&nd_tbl);
1702
1703 #ifdef CONFIG_SYSCTL
1704         err = neigh_sysctl_register(NULL, &nd_tbl.parms, "ipv6",
1705                                     &ndisc_ifinfo_sysctl_change);
1706         if (err)
1707                 goto out_unregister_pernet;
1708 #endif
1709         err = register_netdevice_notifier(&ndisc_netdev_notifier);
1710         if (err)
1711                 goto out_unregister_sysctl;
1712 out:
1713         return err;
1714
1715 out_unregister_sysctl:
1716 #ifdef CONFIG_SYSCTL
1717         neigh_sysctl_unregister(&nd_tbl.parms);
1718 out_unregister_pernet:
1719 #endif
1720         unregister_pernet_subsys(&ndisc_net_ops);
1721         goto out;
1722 }
1723
1724 void ndisc_cleanup(void)
1725 {
1726         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1727 #ifdef CONFIG_SYSCTL
1728         neigh_sysctl_unregister(&nd_tbl.parms);
1729 #endif
1730         neigh_table_clear(&nd_tbl);
1731         unregister_pernet_subsys(&ndisc_net_ops);
1732 }