net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Mike Shaver             <shaver@ingenia.com>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  19  *      Pierre Ynard                    :       export userland ND options
  20  *                                              through netlink (RDNSS support)
  21  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  22  *                                              of an RA.
  23  *      Janos Farkas                    :       kmalloc failure checks
  24  *      Alexey Kuznetsov                :       state machine reworked
  25  *                                              and moved to net/core.
  26  *      Pekka Savola                    :       RFC2461 validation
  27  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  28  */
  29
  30 #define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32 #include <linux/module.h>
  33 #include <linux/errno.h>
  34 #include <linux/types.h>
  35 #include <linux/socket.h>
  36 #include <linux/sockios.h>
  37 #include <linux/sched.h>
  38 #include <linux/net.h>
  39 #include <linux/in6.h>
  40 #include <linux/route.h>
  41 #include <linux/init.h>
  42 #include <linux/rcupdate.h>
  43 #include <linux/slab.h>
  44 #ifdef CONFIG_SYSCTL
  45 #include <linux/sysctl.h>
  46 #endif
  47
  48 #include <linux/if_addr.h>
  49 #include <linux/if_arp.h>
  50 #include <linux/ipv6.h>
  51 #include <linux/icmpv6.h>
  52 #include <linux/jhash.h>
  53
  54 #include <net/sock.h>
  55 #include <net/snmp.h>
  56
  57 #include <net/ipv6.h>
  58 #include <net/protocol.h>
  59 #include <net/ndisc.h>
  60 #include <net/ip6_route.h>
  61 #include <net/addrconf.h>
  62 #include <net/icmp.h>
  63
  64 #include <net/netlink.h>
  65 #include <linux/rtnetlink.h>
  66
  67 #include <net/flow.h>
  68 #include <net/ip6_checksum.h>
  69 #include <net/inet_common.h>
  70 #include <linux/proc_fs.h>
  71
  72 #include <linux/netfilter.h>
  73 #include <linux/netfilter_ipv6.h>
  74
  75 /* Set to 3 to get tracing... */
  76 #define ND_DEBUG 1
  77
  78 #define ND_PRINTK(val, level, fmt, ...)                         \
  79 do {                                                            \
  80         if (val <= ND_DEBUG)                                    \
  81                 net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
  82 } while (0)
  83
  84 static u32 ndisc_hash(const void *pkey,
  85                       const struct net_device *dev,
  86                       __u32 *hash_rnd);
  87 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
  88 static int ndisc_constructor(struct neighbour *neigh);
  89 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  90 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  91 static int pndisc_constructor(struct pneigh_entry *n);
  92 static void pndisc_destructor(struct pneigh_entry *n);
  93 static void pndisc_redo(struct sk_buff *skb);
  94
  95 static const struct neigh_ops ndisc_generic_ops = {
  96         .family =               AF_INET6,
  97         .solicit =              ndisc_solicit,
  98         .error_report =         ndisc_error_report,
  99         .output =               neigh_resolve_output,
 100         .connected_output =     neigh_connected_output,
 101 };
 102
 103 static const struct neigh_ops ndisc_hh_ops = {
 104         .family =               AF_INET6,
 105         .solicit =              ndisc_solicit,
 106         .error_report =         ndisc_error_report,
 107         .output =               neigh_resolve_output,
 108         .connected_output =     neigh_resolve_output,
 109 };
 110
 111
 112 static const struct neigh_ops ndisc_direct_ops = {
 113         .family =               AF_INET6,
 114         .output =               neigh_direct_output,
 115         .connected_output =     neigh_direct_output,
 116 };
 117
 118 struct neigh_table nd_tbl = {
 119         .family =       AF_INET6,
 120         .key_len =      sizeof(struct in6_addr),
 121         .protocol =     cpu_to_be16(ETH_P_IPV6),
 122         .hash =         ndisc_hash,
 123         .key_eq =       ndisc_key_eq,
 124         .constructor =  ndisc_constructor,
 125         .pconstructor = pndisc_constructor,
 126         .pdestructor =  pndisc_destructor,
 127         .proxy_redo =   pndisc_redo,
 128         .id =           "ndisc_cache",
 129         .parms = {
 130                 .tbl                    = &nd_tbl,
 131                 .reachable_time         = ND_REACHABLE_TIME,
 132                 .data = {
 133                         [NEIGH_VAR_MCAST_PROBES] = 3,
 134                         [NEIGH_VAR_UCAST_PROBES] = 3,
 135                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 136                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 137                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 138                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 139                         [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
 140                         [NEIGH_VAR_PROXY_QLEN] = 64,
 141                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 142                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 143                 },
 144         },
 145         .gc_interval =    30 * HZ,
 146         .gc_thresh1 =    128,
 147         .gc_thresh2 =    512,
 148         .gc_thresh3 =   1024,
 149 };
 150
 151 static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
 152 {
 153         int pad   = ndisc_addr_option_pad(skb->dev->type);
 154         int data_len = skb->dev->addr_len;
 155         int space = ndisc_opt_addr_space(skb->dev);
 156         u8 *opt = skb_put(skb, space);
 157
 158         opt[0] = type;
 159         opt[1] = space>>3;
 160
 161         memset(opt + 2, 0, pad);
 162         opt   += pad;
 163         space -= pad;
 164
 165         memcpy(opt+2, data, data_len);
 166         data_len += 2;
 167         opt += data_len;
 168         space -= data_len;
 169         if (space > 0)
 170                 memset(opt, 0, space);
 171 }
 172
 173 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 174                                             struct nd_opt_hdr *end)
 175 {
 176         int type;
 177         if (!cur || !end || cur >= end)
 178                 return NULL;
 179         type = cur->nd_opt_type;
 180         do {
 181                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 182         } while (cur < end && cur->nd_opt_type != type);
 183         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 184 }
 185
 186 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 187 {
 188         return opt->nd_opt_type == ND_OPT_RDNSS ||
 189                 opt->nd_opt_type == ND_OPT_DNSSL;
 190 }
 191
 192 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 193                                              struct nd_opt_hdr *end)
 194 {
 195         if (!cur || !end || cur >= end)
 196                 return NULL;
 197         do {
 198                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 199         } while (cur < end && !ndisc_is_useropt(cur));
 200         return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 201 }
 202
 203 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 204                                           struct ndisc_options *ndopts)
 205 {
 206         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 207
 208         if (!nd_opt || opt_len < 0 || !ndopts)
 209                 return NULL;
 210         memset(ndopts, 0, sizeof(*ndopts));
 211         while (opt_len) {
 212                 int l;
 213                 if (opt_len < sizeof(struct nd_opt_hdr))
 214                         return NULL;
 215                 l = nd_opt->nd_opt_len << 3;
 216                 if (opt_len < l || l == 0)
 217                         return NULL;
 218                 switch (nd_opt->nd_opt_type) {
 219                 case ND_OPT_SOURCE_LL_ADDR:
 220                 case ND_OPT_TARGET_LL_ADDR:
 221                 case ND_OPT_MTU:
 222                 case ND_OPT_REDIRECT_HDR:
 223                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 224                                 ND_PRINTK(2, warn,
 225                                           "%s: duplicated ND6 option found: type=%d\n",
 226                                           __func__, nd_opt->nd_opt_type);
 227                         } else {
 228                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 229                         }
 230                         break;
 231                 case ND_OPT_PREFIX_INFO:
 232                         ndopts->nd_opts_pi_end = nd_opt;
 233                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 234                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 235                         break;
 236 #ifdef CONFIG_IPV6_ROUTE_INFO
 237                 case ND_OPT_ROUTE_INFO:
 238                         ndopts->nd_opts_ri_end = nd_opt;
 239                         if (!ndopts->nd_opts_ri)
 240                                 ndopts->nd_opts_ri = nd_opt;
 241                         break;
 242 #endif
 243                 default:
 244                         if (ndisc_is_useropt(nd_opt)) {
 245                                 ndopts->nd_useropts_end = nd_opt;
 246                                 if (!ndopts->nd_useropts)
 247                                         ndopts->nd_useropts = nd_opt;
 248                         } else {
 249                                 /*
 250                                  * Unknown options must be silently ignored,
 251                                  * to accommodate future extension to the
 252                                  * protocol.
 253                                  */
 254                                 ND_PRINTK(2, notice,
 255                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 256                                           __func__,
 257                                           nd_opt->nd_opt_type,
 258                                           nd_opt->nd_opt_len);
 259                         }
 260                 }
 261                 opt_len -= l;
 262                 nd_opt = ((void *)nd_opt) + l;
 263         }
 264         return ndopts;
 265 }
 266
 267 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 268 {
 269         switch (dev->type) {
 270         case ARPHRD_ETHER:
 271         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 272         case ARPHRD_FDDI:
 273                 ipv6_eth_mc_map(addr, buf);
 274                 return 0;
 275         case ARPHRD_ARCNET:
 276                 ipv6_arcnet_mc_map(addr, buf);
 277                 return 0;
 278         case ARPHRD_INFINIBAND:
 279                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 280                 return 0;
 281         case ARPHRD_IPGRE:
 282                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 283         default:
 284                 if (dir) {
 285                         memcpy(buf, dev->broadcast, dev->addr_len);
 286                         return 0;
 287                 }
 288         }
 289         return -EINVAL;
 290 }
 291 EXPORT_SYMBOL(ndisc_mc_map);
 292
 293 static u32 ndisc_hash(const void *pkey,
 294                       const struct net_device *dev,
 295                       __u32 *hash_rnd)
 296 {
 297         return ndisc_hashfn(pkey, dev, hash_rnd);
 298 }
 299
 300 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
 301 {
 302         return neigh_key_eq128(n, pkey);
 303 }
 304
 305 static int ndisc_constructor(struct neighbour *neigh)
 306 {
 307         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 308         struct net_device *dev = neigh->dev;
 309         struct inet6_dev *in6_dev;
 310         struct neigh_parms *parms;
 311         bool is_multicast = ipv6_addr_is_multicast(addr);
 312
 313         in6_dev = in6_dev_get(dev);
 314         if (!in6_dev) {
 315                 return -EINVAL;
 316         }
 317
 318         parms = in6_dev->nd_parms;
 319         __neigh_parms_put(neigh->parms);
 320         neigh->parms = neigh_parms_clone(parms);
 321
 322         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 323         if (!dev->header_ops) {
 324                 neigh->nud_state = NUD_NOARP;
 325                 neigh->ops = &ndisc_direct_ops;
 326                 neigh->output = neigh_direct_output;
 327         } else {
 328                 if (is_multicast) {
 329                         neigh->nud_state = NUD_NOARP;
 330                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 331                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 332                         neigh->nud_state = NUD_NOARP;
 333                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 334                         if (dev->flags&IFF_LOOPBACK)
 335                                 neigh->type = RTN_LOCAL;
 336                 } else if (dev->flags&IFF_POINTOPOINT) {
 337                         neigh->nud_state = NUD_NOARP;
 338                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 339                 }
 340                 if (dev->header_ops->cache)
 341                         neigh->ops = &ndisc_hh_ops;
 342                 else
 343                         neigh->ops = &ndisc_generic_ops;
 344                 if (neigh->nud_state&NUD_VALID)
 345                         neigh->output = neigh->ops->connected_output;
 346                 else
 347                         neigh->output = neigh->ops->output;
 348         }
 349         in6_dev_put(in6_dev);
 350         return 0;
 351 }
 352
 353 static int pndisc_constructor(struct pneigh_entry *n)
 354 {
 355         struct in6_addr *addr = (struct in6_addr *)&n->key;
 356         struct in6_addr maddr;
 357         struct net_device *dev = n->dev;
 358
 359         if (!dev || !__in6_dev_get(dev))
 360                 return -EINVAL;
 361         addrconf_addr_solict_mult(addr, &maddr);
 362         ipv6_dev_mc_inc(dev, &maddr);
 363         return 0;
 364 }
 365
 366 static void pndisc_destructor(struct pneigh_entry *n)
 367 {
 368         struct in6_addr *addr = (struct in6_addr *)&n->key;
 369         struct in6_addr maddr;
 370         struct net_device *dev = n->dev;
 371
 372         if (!dev || !__in6_dev_get(dev))
 373                 return;
 374         addrconf_addr_solict_mult(addr, &maddr);
 375         ipv6_dev_mc_dec(dev, &maddr);
 376 }
 377
 378 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 379                                        int len)
 380 {
 381         int hlen = LL_RESERVED_SPACE(dev);
 382         int tlen = dev->needed_tailroom;
 383         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 384         struct sk_buff *skb;
 385
 386         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 387         if (!skb) {
 388                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 389                           __func__);
 390                 return NULL;
 391         }
 392
 393         skb->protocol = htons(ETH_P_IPV6);
 394         skb->dev = dev;
 395
 396         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 397         skb_reset_transport_header(skb);
 398
 399         /* Manually assign socket ownership as we avoid calling
 400          * sock_alloc_send_pskb() to bypass wmem buffer limits
 401          */
 402         skb_set_owner_w(skb, sk);
 403
 404         return skb;
 405 }
 406
 407 static void ip6_nd_hdr(struct sk_buff *skb,
 408                        const struct in6_addr *saddr,
 409                        const struct in6_addr *daddr,
 410                        int hop_limit, int len)
 411 {
 412         struct ipv6hdr *hdr;
 413
 414         skb_push(skb, sizeof(*hdr));
 415         skb_reset_network_header(skb);
 416         hdr = ipv6_hdr(skb);
 417
 418         ip6_flow_hdr(hdr, 0, 0);
 419
 420         hdr->payload_len = htons(len);
 421         hdr->nexthdr = IPPROTO_ICMPV6;
 422         hdr->hop_limit = hop_limit;
 423
 424         hdr->saddr = *saddr;
 425         hdr->daddr = *daddr;
 426 }
 427
 428 static void ndisc_send_skb(struct sk_buff *skb,
 429                            const struct in6_addr *daddr,
 430                            const struct in6_addr *saddr)
 431 {
 432         struct dst_entry *dst = skb_dst(skb);
 433         struct net *net = dev_net(skb->dev);
 434         struct sock *sk = net->ipv6.ndisc_sk;
 435         struct inet6_dev *idev;
 436         int err;
 437         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 438         u8 type;
 439
 440         type = icmp6h->icmp6_type;
 441
 442         if (!dst) {
 443                 struct flowi6 fl6;
 444
 445                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex);
 446                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 447                 if (IS_ERR(dst)) {
 448                         kfree_skb(skb);
 449                         return;
 450                 }
 451
 452                 skb_dst_set(skb, dst);
 453         }
 454
 455         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 456                                               IPPROTO_ICMPV6,
 457                                               csum_partial(icmp6h,
 458                                                            skb->len, 0));
 459
 460         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 461
 462         rcu_read_lock();
 463         idev = __in6_dev_get(dst->dev);
 464         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 465
 466         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, sk, skb,
 467                       NULL, dst->dev,
 468                       dst_output_sk);
 469         if (!err) {
 470                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 471                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 472         }
 473
 474         rcu_read_unlock();
 475 }
 476
 477 void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 478                    const struct in6_addr *daddr,
 479                    const struct in6_addr *solicited_addr,
 480                    bool router, bool solicited, bool override, bool inc_opt)
 481 {
 482         struct sk_buff *skb;
 483         struct in6_addr tmpaddr;
 484         struct inet6_ifaddr *ifp;
 485         const struct in6_addr *src_addr;
 486         struct nd_msg *msg;
 487         int optlen = 0;
 488
 489         /* for anycast or proxy, solicited_addr != src_addr */
 490         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 491         if (ifp) {
 492                 src_addr = solicited_addr;
 493                 if (ifp->flags & IFA_F_OPTIMISTIC)
 494                         override = false;
 495                 inc_opt |= ifp->idev->cnf.force_tllao;
 496                 in6_ifa_put(ifp);
 497         } else {
 498                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 499                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 500                                        &tmpaddr))
 501                         return;
 502                 src_addr = &tmpaddr;
 503         }
 504
 505         if (!dev->addr_len)
 506                 inc_opt = 0;
 507         if (inc_opt)
 508                 optlen += ndisc_opt_addr_space(dev);
 509
 510         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 511         if (!skb)
 512                 return;
 513
 514         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 515         *msg = (struct nd_msg) {
 516                 .icmph = {
 517                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 518                         .icmp6_router = router,
 519                         .icmp6_solicited = solicited,
 520                         .icmp6_override = override,
 521                 },
 522                 .target = *solicited_addr,
 523         };
 524
 525         if (inc_opt)
 526                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 527                                        dev->dev_addr);
 528
 529
 530         ndisc_send_skb(skb, daddr, src_addr);
 531 }
 532
 533 static void ndisc_send_unsol_na(struct net_device *dev)
 534 {
 535         struct inet6_dev *idev;
 536         struct inet6_ifaddr *ifa;
 537
 538         idev = in6_dev_get(dev);
 539         if (!idev)
 540                 return;
 541
 542         read_lock_bh(&idev->lock);
 543         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 544                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
 545                               /*router=*/ !!idev->cnf.forwarding,
 546                               /*solicited=*/ false, /*override=*/ true,
 547                               /*inc_opt=*/ true);
 548         }
 549         read_unlock_bh(&idev->lock);
 550
 551         in6_dev_put(idev);
 552 }
 553
 554 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 555                    const struct in6_addr *solicit,
 556                    const struct in6_addr *daddr, const struct in6_addr *saddr)
 557 {
 558         struct sk_buff *skb;
 559         struct in6_addr addr_buf;
 560         int inc_opt = dev->addr_len;
 561         int optlen = 0;
 562         struct nd_msg *msg;
 563
 564         if (!saddr) {
 565                 if (ipv6_get_lladdr(dev, &addr_buf,
 566                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 567                         return;
 568                 saddr = &addr_buf;
 569         }
 570
 571         if (ipv6_addr_any(saddr))
 572                 inc_opt = false;
 573         if (inc_opt)
 574                 optlen += ndisc_opt_addr_space(dev);
 575
 576         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 577         if (!skb)
 578                 return;
 579
 580         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 581         *msg = (struct nd_msg) {
 582                 .icmph = {
 583                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 584                 },
 585                 .target = *solicit,
 586         };
 587
 588         if (inc_opt)
 589                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 590                                        dev->dev_addr);
 591
 592         ndisc_send_skb(skb, daddr, saddr);
 593 }
 594
 595 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 596                    const struct in6_addr *daddr)
 597 {
 598         struct sk_buff *skb;
 599         struct rs_msg *msg;
 600         int send_sllao = dev->addr_len;
 601         int optlen = 0;
 602
 603 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 604         /*
 605          * According to section 2.2 of RFC 4429, we must not
 606          * send router solicitations with a sllao from
 607          * optimistic addresses, but we may send the solicitation
 608          * if we don't include the sllao.  So here we check
 609          * if our address is optimistic, and if so, we
 610          * suppress the inclusion of the sllao.
 611          */
 612         if (send_sllao) {
 613                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 614                                                            dev, 1);
 615                 if (ifp) {
 616                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 617                                 send_sllao = 0;
 618                         }
 619                         in6_ifa_put(ifp);
 620                 } else {
 621                         send_sllao = 0;
 622                 }
 623         }
 624 #endif
 625         if (send_sllao)
 626                 optlen += ndisc_opt_addr_space(dev);
 627
 628         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 629         if (!skb)
 630                 return;
 631
 632         msg = (struct rs_msg *)skb_put(skb, sizeof(*msg));
 633         *msg = (struct rs_msg) {
 634                 .icmph = {
 635                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 636                 },
 637         };
 638
 639         if (send_sllao)
 640                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 641                                        dev->dev_addr);
 642
 643         ndisc_send_skb(skb, daddr, saddr);
 644 }
 645
 646
 647 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 648 {
 649         /*
 650          *      "The sender MUST return an ICMP
 651          *       destination unreachable"
 652          */
 653         dst_link_failure(skb);
 654         kfree_skb(skb);
 655 }
 656
 657 /* Called with locked neigh: either read or both */
 658
 659 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 660 {
 661         struct in6_addr *saddr = NULL;
 662         struct in6_addr mcaddr;
 663         struct net_device *dev = neigh->dev;
 664         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 665         int probes = atomic_read(&neigh->probes);
 666
 667         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 668                                            dev, 1,
 669                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 670                 saddr = &ipv6_hdr(skb)->saddr;
 671         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 672         if (probes < 0) {
 673                 if (!(neigh->nud_state & NUD_VALID)) {
 674                         ND_PRINTK(1, dbg,
 675                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 676                                   __func__, target);
 677                 }
 678                 ndisc_send_ns(dev, neigh, target, target, saddr);
 679         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 680                 neigh_app_ns(neigh);
 681         } else {
 682                 addrconf_addr_solict_mult(target, &mcaddr);
 683                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 684         }
 685 }
 686
 687 static int pndisc_is_router(const void *pkey,
 688                             struct net_device *dev)
 689 {
 690         struct pneigh_entry *n;
 691         int ret = -1;
 692
 693         read_lock_bh(&nd_tbl.lock);
 694         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 695         if (n)
 696                 ret = !!(n->flags & NTF_ROUTER);
 697         read_unlock_bh(&nd_tbl.lock);
 698
 699         return ret;
 700 }
 701
 702 static void ndisc_recv_ns(struct sk_buff *skb)
 703 {
 704         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 705         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 706         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 707         u8 *lladdr = NULL;
 708         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 709                                     offsetof(struct nd_msg, opt));
 710         struct ndisc_options ndopts;
 711         struct net_device *dev = skb->dev;
 712         struct inet6_ifaddr *ifp;
 713         struct inet6_dev *idev = NULL;
 714         struct neighbour *neigh;
 715         int dad = ipv6_addr_any(saddr);
 716         bool inc;
 717         int is_router = -1;
 718
 719         if (skb->len < sizeof(struct nd_msg)) {
 720                 ND_PRINTK(2, warn, "NS: packet too short\n");
 721                 return;
 722         }
 723
 724         if (ipv6_addr_is_multicast(&msg->target)) {
 725                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 726                 return;
 727         }
 728
 729         /*
 730          * RFC2461 7.1.1:
 731          * DAD has to be destined for solicited node multicast address.
 732          */
 733         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 734                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 735                 return;
 736         }
 737
 738         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 739                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 740                 return;
 741         }
 742
 743         if (ndopts.nd_opts_src_lladdr) {
 744                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 745                 if (!lladdr) {
 746                         ND_PRINTK(2, warn,
 747                                   "NS: invalid link-layer address length\n");
 748                         return;
 749                 }
 750
 751                 /* RFC2461 7.1.1:
 752                  *      If the IP source address is the unspecified address,
 753                  *      there MUST NOT be source link-layer address option
 754                  *      in the message.
 755                  */
 756                 if (dad) {
 757                         ND_PRINTK(2, warn,
 758                                   "NS: bad DAD packet (link-layer address option)\n");
 759                         return;
 760                 }
 761         }
 762
 763         inc = ipv6_addr_is_multicast(daddr);
 764
 765         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 766         if (ifp) {
 767
 768                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 769                         if (dad) {
 770                                 /*
 771                                  * We are colliding with another node
 772                                  * who is doing DAD
 773                                  * so fail our DAD process
 774                                  */
 775                                 addrconf_dad_failure(ifp);
 776                                 return;
 777                         } else {
 778                                 /*
 779                                  * This is not a dad solicitation.
 780                                  * If we are an optimistic node,
 781                                  * we should respond.
 782                                  * Otherwise, we should ignore it.
 783                                  */
 784                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 785                                         goto out;
 786                         }
 787                 }
 788
 789                 idev = ifp->idev;
 790         } else {
 791                 struct net *net = dev_net(dev);
 792
 793                 idev = in6_dev_get(dev);
 794                 if (!idev) {
 795                         /* XXX: count this drop? */
 796                         return;
 797                 }
 798
 799                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 800                     (idev->cnf.forwarding &&
 801                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 802                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 803                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 804                             skb->pkt_type != PACKET_HOST &&
 805                             inc &&
 806                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 807                                 /*
 808                                  * for anycast or proxy,
 809                                  * sender should delay its response
 810                                  * by a random time between 0 and
 811                                  * MAX_ANYCAST_DELAY_TIME seconds.
 812                                  * (RFC2461) -- yoshfuji
 813                                  */
 814                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 815                                 if (n)
 816                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 817                                 goto out;
 818                         }
 819                 } else
 820                         goto out;
 821         }
 822
 823         if (is_router < 0)
 824                 is_router = idev->cnf.forwarding;
 825
 826         if (dad) {
 827                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
 828                               !!is_router, false, (ifp != NULL), true);
 829                 goto out;
 830         }
 831
 832         if (inc)
 833                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 834         else
 835                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 836
 837         /*
 838          *      update / create cache entry
 839          *      for the source address
 840          */
 841         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 842                                !inc || lladdr || !dev->addr_len);
 843         if (neigh)
 844                 neigh_update(neigh, lladdr, NUD_STALE,
 845                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 846                              NEIGH_UPDATE_F_OVERRIDE);
 847         if (neigh || !dev->header_ops) {
 848                 ndisc_send_na(dev, neigh, saddr, &msg->target,
 849                               !!is_router,
 850                               true, (ifp != NULL && inc), inc);
 851                 if (neigh)
 852                         neigh_release(neigh);
 853         }
 854
 855 out:
 856         if (ifp)
 857                 in6_ifa_put(ifp);
 858         else
 859                 in6_dev_put(idev);
 860 }
 861
 862 static void ndisc_recv_na(struct sk_buff *skb)
 863 {
 864         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 865         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 866         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 867         u8 *lladdr = NULL;
 868         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 869                                     offsetof(struct nd_msg, opt));
 870         struct ndisc_options ndopts;
 871         struct net_device *dev = skb->dev;
 872         struct inet6_ifaddr *ifp;
 873         struct neighbour *neigh;
 874
 875         if (skb->len < sizeof(struct nd_msg)) {
 876                 ND_PRINTK(2, warn, "NA: packet too short\n");
 877                 return;
 878         }
 879
 880         if (ipv6_addr_is_multicast(&msg->target)) {
 881                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 882                 return;
 883         }
 884
 885         if (ipv6_addr_is_multicast(daddr) &&
 886             msg->icmph.icmp6_solicited) {
 887                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 888                 return;
 889         }
 890
 891         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 892                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 893                 return;
 894         }
 895         if (ndopts.nd_opts_tgt_lladdr) {
 896                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 897                 if (!lladdr) {
 898                         ND_PRINTK(2, warn,
 899                                   "NA: invalid link-layer address length\n");
 900                         return;
 901                 }
 902         }
 903         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 904         if (ifp) {
 905                 if (skb->pkt_type != PACKET_LOOPBACK
 906                     && (ifp->flags & IFA_F_TENTATIVE)) {
 907                                 addrconf_dad_failure(ifp);
 908                                 return;
 909                 }
 910                 /* What should we make now? The advertisement
 911                    is invalid, but ndisc specs say nothing
 912                    about it. It could be misconfiguration, or
 913                    an smart proxy agent tries to help us :-)
 914
 915                    We should not print the error if NA has been
 916                    received from loopback - it is just our own
 917                    unsolicited advertisement.
 918                  */
 919                 if (skb->pkt_type != PACKET_LOOPBACK)
 920                         ND_PRINTK(1, warn,
 921                                   "NA: someone advertises our address %pI6 on %s!\n",
 922                                   &ifp->addr, ifp->idev->dev->name);
 923                 in6_ifa_put(ifp);
 924                 return;
 925         }
 926         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 927
 928         if (neigh) {
 929                 u8 old_flags = neigh->flags;
 930                 struct net *net = dev_net(dev);
 931
 932                 if (neigh->nud_state & NUD_FAILED)
 933                         goto out;
 934
 935                 /*
 936                  * Don't update the neighbor cache entry on a proxy NA from
 937                  * ourselves because either the proxied node is off link or it
 938                  * has already sent a NA to us.
 939                  */
 940                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 941                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
 942                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
 943                         /* XXX: idev->cnf.proxy_ndp */
 944                         goto out;
 945                 }
 946
 947                 neigh_update(neigh, lladdr,
 948                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 949                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 950                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 951                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 952                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 953
 954                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 955                         /*
 956                          * Change: router to host
 957                          */
 958                         rt6_clean_tohost(dev_net(dev),  saddr);
 959                 }
 960
 961 out:
 962                 neigh_release(neigh);
 963         }
 964 }
 965
 966 static void ndisc_recv_rs(struct sk_buff *skb)
 967 {
 968         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 969         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 970         struct neighbour *neigh;
 971         struct inet6_dev *idev;
 972         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 973         struct ndisc_options ndopts;
 974         u8 *lladdr = NULL;
 975
 976         if (skb->len < sizeof(*rs_msg))
 977                 return;
 978
 979         idev = __in6_dev_get(skb->dev);
 980         if (!idev) {
 981                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
 982                 return;
 983         }
 984
 985         /* Don't accept RS if we're not in router mode */
 986         if (!idev->cnf.forwarding)
 987                 goto out;
 988
 989         /*
 990          * Don't update NCE if src = ::;
 991          * this implies that the source node has no ip address assigned yet.
 992          */
 993         if (ipv6_addr_any(saddr))
 994                 goto out;
 995
 996         /* Parse ND options */
 997         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 998                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
 999                 goto out;
1000         }
1001
1002         if (ndopts.nd_opts_src_lladdr) {
1003                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1004                                              skb->dev);
1005                 if (!lladdr)
1006                         goto out;
1007         }
1008
1009         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1010         if (neigh) {
1011                 neigh_update(neigh, lladdr, NUD_STALE,
1012                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1013                              NEIGH_UPDATE_F_OVERRIDE|
1014                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1015                 neigh_release(neigh);
1016         }
1017 out:
1018         return;
1019 }
1020
1021 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1022 {
1023         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1024         struct sk_buff *skb;
1025         struct nlmsghdr *nlh;
1026         struct nduseroptmsg *ndmsg;
1027         struct net *net = dev_net(ra->dev);
1028         int err;
1029         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1030                                     + (opt->nd_opt_len << 3));
1031         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1032
1033         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1034         if (!skb) {
1035                 err = -ENOBUFS;
1036                 goto errout;
1037         }
1038
1039         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1040         if (!nlh) {
1041                 goto nla_put_failure;
1042         }
1043
1044         ndmsg = nlmsg_data(nlh);
1045         ndmsg->nduseropt_family = AF_INET6;
1046         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1047         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1048         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1049         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1050
1051         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1052
1053         if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1054                 goto nla_put_failure;
1055         nlmsg_end(skb, nlh);
1056
1057         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1058         return;
1059
1060 nla_put_failure:
1061         nlmsg_free(skb);
1062         err = -EMSGSIZE;
1063 errout:
1064         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1065 }
1066
1067 static void ndisc_router_discovery(struct sk_buff *skb)
1068 {
1069         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1070         struct neighbour *neigh = NULL;
1071         struct inet6_dev *in6_dev;
1072         struct rt6_info *rt = NULL;
1073         int lifetime;
1074         struct ndisc_options ndopts;
1075         int optlen;
1076         unsigned int pref = 0;
1077
1078         __u8 *opt = (__u8 *)(ra_msg + 1);
1079
1080         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1081                 sizeof(struct ra_msg);
1082
1083         ND_PRINTK(2, info,
1084                   "RA: %s, dev: %s\n",
1085                   __func__, skb->dev->name);
1086         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1087                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1088                 return;
1089         }
1090         if (optlen < 0) {
1091                 ND_PRINTK(2, warn, "RA: packet too short\n");
1092                 return;
1093         }
1094
1095 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1096         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1097                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1098                 return;
1099         }
1100 #endif
1101
1102         /*
1103          *      set the RA_RECV flag in the interface
1104          */
1105
1106         in6_dev = __in6_dev_get(skb->dev);
1107         if (!in6_dev) {
1108                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1109                           skb->dev->name);
1110                 return;
1111         }
1112
1113         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1114                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1115                 return;
1116         }
1117
1118         if (!ipv6_accept_ra(in6_dev)) {
1119                 ND_PRINTK(2, info,
1120                           "RA: %s, did not accept ra for dev: %s\n",
1121                           __func__, skb->dev->name);
1122                 goto skip_linkparms;
1123         }
1124
1125 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1126         /* skip link-specific parameters from interior routers */
1127         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1128                 ND_PRINTK(2, info,
1129                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1130                           __func__, skb->dev->name);
1131                 goto skip_linkparms;
1132         }
1133 #endif
1134
1135         if (in6_dev->if_flags & IF_RS_SENT) {
1136                 /*
1137                  *      flag that an RA was received after an RS was sent
1138                  *      out on this interface.
1139                  */
1140                 in6_dev->if_flags |= IF_RA_RCVD;
1141         }
1142
1143         /*
1144          * Remember the managed/otherconf flags from most recently
1145          * received RA message (RFC 2462) -- yoshfuji
1146          */
1147         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1148                                 IF_RA_OTHERCONF)) |
1149                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1150                                         IF_RA_MANAGED : 0) |
1151                                 (ra_msg->icmph.icmp6_addrconf_other ?
1152                                         IF_RA_OTHERCONF : 0);
1153
1154         if (!in6_dev->cnf.accept_ra_defrtr) {
1155                 ND_PRINTK(2, info,
1156                           "RA: %s, defrtr is false for dev: %s\n",
1157                           __func__, skb->dev->name);
1158                 goto skip_defrtr;
1159         }
1160
1161         /* Do not accept RA with source-addr found on local machine unless
1162          * accept_ra_from_local is set to true.
1163          */
1164         if (!in6_dev->cnf.accept_ra_from_local &&
1165             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1166                           NULL, 0)) {
1167                 ND_PRINTK(2, info,
1168                           "RA from local address detected on dev: %s: default router ignored\n",
1169                           skb->dev->name);
1170                 goto skip_defrtr;
1171         }
1172
1173         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1174
1175 #ifdef CONFIG_IPV6_ROUTER_PREF
1176         pref = ra_msg->icmph.icmp6_router_pref;
1177         /* 10b is handled as if it were 00b (medium) */
1178         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1179             !in6_dev->cnf.accept_ra_rtr_pref)
1180                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1181 #endif
1182
1183         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1184
1185         if (rt) {
1186                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1187                 if (!neigh) {
1188                         ND_PRINTK(0, err,
1189                                   "RA: %s got default router without neighbour\n",
1190                                   __func__);
1191                         ip6_rt_put(rt);
1192                         return;
1193                 }
1194         }
1195         if (rt && lifetime == 0) {
1196                 ip6_del_rt(rt);
1197                 rt = NULL;
1198         }
1199
1200         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, for dev: %s\n",
1201                   rt, lifetime, skb->dev->name);
1202         if (!rt && lifetime) {
1203                 ND_PRINTK(3, info, "RA: adding default router\n");
1204
1205                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1206                 if (!rt) {
1207                         ND_PRINTK(0, err,
1208                                   "RA: %s failed to add default route\n",
1209                                   __func__);
1210                         return;
1211                 }
1212
1213                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1214                 if (!neigh) {
1215                         ND_PRINTK(0, err,
1216                                   "RA: %s got default router without neighbour\n",
1217                                   __func__);
1218                         ip6_rt_put(rt);
1219                         return;
1220                 }
1221                 neigh->flags |= NTF_ROUTER;
1222         } else if (rt) {
1223                 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1224         }
1225
1226         if (rt)
1227                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1228         if (ra_msg->icmph.icmp6_hop_limit) {
1229                 /* Only set hop_limit on the interface if it is higher than
1230                  * the current hop_limit.
1231                  */
1232                 if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
1233                         in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1234                 } else {
1235                         ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
1236                 }
1237                 if (rt)
1238                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1239                                        ra_msg->icmph.icmp6_hop_limit);
1240         }
1241
1242 skip_defrtr:
1243
1244         /*
1245          *      Update Reachable Time and Retrans Timer
1246          */
1247
1248         if (in6_dev->nd_parms) {
1249                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1250
1251                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1252                         rtime = (rtime*HZ)/1000;
1253                         if (rtime < HZ/10)
1254                                 rtime = HZ/10;
1255                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1256                         in6_dev->tstamp = jiffies;
1257                         inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1258                 }
1259
1260                 rtime = ntohl(ra_msg->reachable_time);
1261                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1262                         rtime = (rtime*HZ)/1000;
1263
1264                         if (rtime < HZ/10)
1265                                 rtime = HZ/10;
1266
1267                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1268                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1269                                               BASE_REACHABLE_TIME, rtime);
1270                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1271                                               GC_STALETIME, 3 * rtime);
1272                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1273                                 in6_dev->tstamp = jiffies;
1274                                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1275                         }
1276                 }
1277         }
1278
1279 skip_linkparms:
1280
1281         /*
1282          *      Process options.
1283          */
1284
1285         if (!neigh)
1286                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1287                                        skb->dev, 1);
1288         if (neigh) {
1289                 u8 *lladdr = NULL;
1290                 if (ndopts.nd_opts_src_lladdr) {
1291                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1292                                                      skb->dev);
1293                         if (!lladdr) {
1294                                 ND_PRINTK(2, warn,
1295                                           "RA: invalid link-layer address length\n");
1296                                 goto out;
1297                         }
1298                 }
1299                 neigh_update(neigh, lladdr, NUD_STALE,
1300                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1301                              NEIGH_UPDATE_F_OVERRIDE|
1302                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1303                              NEIGH_UPDATE_F_ISROUTER);
1304         }
1305
1306         if (!ipv6_accept_ra(in6_dev)) {
1307                 ND_PRINTK(2, info,
1308                           "RA: %s, accept_ra is false for dev: %s\n",
1309                           __func__, skb->dev->name);
1310                 goto out;
1311         }
1312
1313 #ifdef CONFIG_IPV6_ROUTE_INFO
1314         if (!in6_dev->cnf.accept_ra_from_local &&
1315             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1316                           NULL, 0)) {
1317                 ND_PRINTK(2, info,
1318                           "RA from local address detected on dev: %s: router info ignored.\n",
1319                           skb->dev->name);
1320                 goto skip_routeinfo;
1321         }
1322
1323         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1324                 struct nd_opt_hdr *p;
1325                 for (p = ndopts.nd_opts_ri;
1326                      p;
1327                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1328                         struct route_info *ri = (struct route_info *)p;
1329 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1330                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1331                             ri->prefix_len == 0)
1332                                 continue;
1333 #endif
1334                         if (ri->prefix_len == 0 &&
1335                             !in6_dev->cnf.accept_ra_defrtr)
1336                                 continue;
1337                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1338                                 continue;
1339                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1340                                       &ipv6_hdr(skb)->saddr);
1341                 }
1342         }
1343
1344 skip_routeinfo:
1345 #endif
1346
1347 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1348         /* skip link-specific ndopts from interior routers */
1349         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1350                 ND_PRINTK(2, info,
1351                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1352                           __func__, skb->dev->name);
1353                 goto out;
1354         }
1355 #endif
1356
1357         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1358                 struct nd_opt_hdr *p;
1359                 for (p = ndopts.nd_opts_pi;
1360                      p;
1361                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1362                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1363                                             (p->nd_opt_len) << 3,
1364                                             ndopts.nd_opts_src_lladdr != NULL);
1365                 }
1366         }
1367
1368         if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1369                 __be32 n;
1370                 u32 mtu;
1371
1372                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1373                 mtu = ntohl(n);
1374
1375                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1376                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1377                 } else if (in6_dev->cnf.mtu6 != mtu) {
1378                         in6_dev->cnf.mtu6 = mtu;
1379
1380                         if (rt)
1381                                 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1382
1383                         rt6_mtu_change(skb->dev, mtu);
1384                 }
1385         }
1386
1387         if (ndopts.nd_useropts) {
1388                 struct nd_opt_hdr *p;
1389                 for (p = ndopts.nd_useropts;
1390                      p;
1391                      p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1392                         ndisc_ra_useropt(skb, p);
1393                 }
1394         }
1395
1396         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1397                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1398         }
1399 out:
1400         ip6_rt_put(rt);
1401         if (neigh)
1402                 neigh_release(neigh);
1403 }
1404
1405 static void ndisc_redirect_rcv(struct sk_buff *skb)
1406 {
1407         u8 *hdr;
1408         struct ndisc_options ndopts;
1409         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1410         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1411                                     offsetof(struct rd_msg, opt));
1412
1413 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1414         switch (skb->ndisc_nodetype) {
1415         case NDISC_NODETYPE_HOST:
1416         case NDISC_NODETYPE_NODEFAULT:
1417                 ND_PRINTK(2, warn,
1418                           "Redirect: from host or unauthorized router\n");
1419                 return;
1420         }
1421 #endif
1422
1423         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1424                 ND_PRINTK(2, warn,
1425                           "Redirect: source address is not link-local\n");
1426                 return;
1427         }
1428
1429         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1430                 return;
1431
1432         if (!ndopts.nd_opts_rh) {
1433                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1434                                         skb->dev->ifindex, 0);
1435                 return;
1436         }
1437
1438         hdr = (u8 *)ndopts.nd_opts_rh;
1439         hdr += 8;
1440         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1441                 return;
1442
1443         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1444 }
1445
1446 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1447                                            struct sk_buff *orig_skb,
1448                                            int rd_len)
1449 {
1450         u8 *opt = skb_put(skb, rd_len);
1451
1452         memset(opt, 0, 8);
1453         *(opt++) = ND_OPT_REDIRECT_HDR;
1454         *(opt++) = (rd_len >> 3);
1455         opt += 6;
1456
1457         memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
1458 }
1459
1460 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1461 {
1462         struct net_device *dev = skb->dev;
1463         struct net *net = dev_net(dev);
1464         struct sock *sk = net->ipv6.ndisc_sk;
1465         int optlen = 0;
1466         struct inet_peer *peer;
1467         struct sk_buff *buff;
1468         struct rd_msg *msg;
1469         struct in6_addr saddr_buf;
1470         struct rt6_info *rt;
1471         struct dst_entry *dst;
1472         struct flowi6 fl6;
1473         int rd_len;
1474         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1475         bool ret;
1476
1477         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1478                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1479                           dev->name);
1480                 return;
1481         }
1482
1483         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1484             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1485                 ND_PRINTK(2, warn,
1486                           "Redirect: target address is not link-local unicast\n");
1487                 return;
1488         }
1489
1490         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1491                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1492
1493         dst = ip6_route_output(net, NULL, &fl6);
1494         if (dst->error) {
1495                 dst_release(dst);
1496                 return;
1497         }
1498         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1499         if (IS_ERR(dst))
1500                 return;
1501
1502         rt = (struct rt6_info *) dst;
1503
1504         if (rt->rt6i_flags & RTF_GATEWAY) {
1505                 ND_PRINTK(2, warn,
1506                           "Redirect: destination is not a neighbour\n");
1507                 goto release;
1508         }
1509         peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1510         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1511         if (peer)
1512                 inet_putpeer(peer);
1513         if (!ret)
1514                 goto release;
1515
1516         if (dev->addr_len) {
1517                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1518                 if (!neigh) {
1519                         ND_PRINTK(2, warn,
1520                                   "Redirect: no neigh for target address\n");
1521                         goto release;
1522                 }
1523
1524                 read_lock_bh(&neigh->lock);
1525                 if (neigh->nud_state & NUD_VALID) {
1526                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1527                         read_unlock_bh(&neigh->lock);
1528                         ha = ha_buf;
1529                         optlen += ndisc_opt_addr_space(dev);
1530                 } else
1531                         read_unlock_bh(&neigh->lock);
1532
1533                 neigh_release(neigh);
1534         }
1535
1536         rd_len = min_t(unsigned int,
1537                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1538                        skb->len + 8);
1539         rd_len &= ~0x7;
1540         optlen += rd_len;
1541
1542         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1543         if (!buff)
1544                 goto release;
1545
1546         msg = (struct rd_msg *)skb_put(buff, sizeof(*msg));
1547         *msg = (struct rd_msg) {
1548                 .icmph = {
1549                         .icmp6_type = NDISC_REDIRECT,
1550                 },
1551                 .target = *target,
1552                 .dest = ipv6_hdr(skb)->daddr,
1553         };
1554
1555         /*
1556          *      include target_address option
1557          */
1558
1559         if (ha)
1560                 ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
1561
1562         /*
1563          *      build redirect option and copy skb over to the new packet.
1564          */
1565
1566         if (rd_len)
1567                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1568
1569         skb_dst_set(buff, dst);
1570         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1571         return;
1572
1573 release:
1574         dst_release(dst);
1575 }
1576
1577 static void pndisc_redo(struct sk_buff *skb)
1578 {
1579         ndisc_recv_ns(skb);
1580         kfree_skb(skb);
1581 }
1582
1583 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1584 {
1585         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1586
1587         if (!idev)
1588                 return true;
1589         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1590             idev->cnf.suppress_frag_ndisc) {
1591                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1592                 return true;
1593         }
1594         return false;
1595 }
1596
1597 int ndisc_rcv(struct sk_buff *skb)
1598 {
1599         struct nd_msg *msg;
1600
1601         if (ndisc_suppress_frag_ndisc(skb))
1602                 return 0;
1603
1604         if (skb_linearize(skb))
1605                 return 0;
1606
1607         msg = (struct nd_msg *)skb_transport_header(skb);
1608
1609         __skb_push(skb, skb->data - skb_transport_header(skb));
1610
1611         if (ipv6_hdr(skb)->hop_limit != 255) {
1612                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1613                           ipv6_hdr(skb)->hop_limit);
1614                 return 0;
1615         }
1616
1617         if (msg->icmph.icmp6_code != 0) {
1618                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1619                           msg->icmph.icmp6_code);
1620                 return 0;
1621         }
1622
1623         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1624
1625         switch (msg->icmph.icmp6_type) {
1626         case NDISC_NEIGHBOUR_SOLICITATION:
1627                 ndisc_recv_ns(skb);
1628                 break;
1629
1630         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1631                 ndisc_recv_na(skb);
1632                 break;
1633
1634         case NDISC_ROUTER_SOLICITATION:
1635                 ndisc_recv_rs(skb);
1636                 break;
1637
1638         case NDISC_ROUTER_ADVERTISEMENT:
1639                 ndisc_router_discovery(skb);
1640                 break;
1641
1642         case NDISC_REDIRECT:
1643                 ndisc_redirect_rcv(skb);
1644                 break;
1645         }
1646
1647         return 0;
1648 }
1649
1650 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1651 {
1652         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1653         struct net *net = dev_net(dev);
1654         struct inet6_dev *idev;
1655
1656         switch (event) {
1657         case NETDEV_CHANGEADDR:
1658                 neigh_changeaddr(&nd_tbl, dev);
1659                 fib6_run_gc(0, net, false);
1660                 idev = in6_dev_get(dev);
1661                 if (!idev)
1662                         break;
1663                 if (idev->cnf.ndisc_notify)
1664                         ndisc_send_unsol_na(dev);
1665                 in6_dev_put(idev);
1666                 break;
1667         case NETDEV_DOWN:
1668                 neigh_ifdown(&nd_tbl, dev);
1669                 fib6_run_gc(0, net, false);
1670                 break;
1671         case NETDEV_NOTIFY_PEERS:
1672                 ndisc_send_unsol_na(dev);
1673                 break;
1674         default:
1675                 break;
1676         }
1677
1678         return NOTIFY_DONE;
1679 }
1680
1681 static struct notifier_block ndisc_netdev_notifier = {
1682         .notifier_call = ndisc_netdev_event,
1683 };
1684
1685 #ifdef CONFIG_SYSCTL
1686 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1687                                          const char *func, const char *dev_name)
1688 {
1689         static char warncomm[TASK_COMM_LEN];
1690         static int warned;
1691         if (strcmp(warncomm, current->comm) && warned < 5) {
1692                 strcpy(warncomm, current->comm);
1693                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1694                         warncomm, func,
1695                         dev_name, ctl->procname,
1696                         dev_name, ctl->procname);
1697                 warned++;
1698         }
1699 }
1700
1701 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1702 {
1703         struct net_device *dev = ctl->extra1;
1704         struct inet6_dev *idev;
1705         int ret;
1706
1707         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1708             (strcmp(ctl->procname, "base_reachable_time") == 0))
1709                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1710
1711         if (strcmp(ctl->procname, "retrans_time") == 0)
1712                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1713
1714         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1715                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1716                                                   buffer, lenp, ppos);
1717
1718         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1719                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1720                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1721                                                      buffer, lenp, ppos);
1722         else
1723                 ret = -1;
1724
1725         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1726                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1727                         idev->nd_parms->reachable_time =
1728                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1729                 idev->tstamp = jiffies;
1730                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1731                 in6_dev_put(idev);
1732         }
1733         return ret;
1734 }
1735
1736
1737 #endif
1738
1739 static int __net_init ndisc_net_init(struct net *net)
1740 {
1741         struct ipv6_pinfo *np;
1742         struct sock *sk;
1743         int err;
1744
1745         err = inet_ctl_sock_create(&sk, PF_INET6,
1746                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1747         if (err < 0) {
1748                 ND_PRINTK(0, err,
1749                           "NDISC: Failed to initialize the control socket (err %d)\n",
1750                           err);
1751                 return err;
1752         }
1753
1754         net->ipv6.ndisc_sk = sk;
1755
1756         np = inet6_sk(sk);
1757         np->hop_limit = 255;
1758         /* Do not loopback ndisc messages */
1759         np->mc_loop = 0;
1760
1761         return 0;
1762 }
1763
1764 static void __net_exit ndisc_net_exit(struct net *net)
1765 {
1766         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1767 }
1768
1769 static struct pernet_operations ndisc_net_ops = {
1770         .init = ndisc_net_init,
1771         .exit = ndisc_net_exit,
1772 };
1773
1774 int __init ndisc_init(void)
1775 {
1776         int err;
1777
1778         err = register_pernet_subsys(&ndisc_net_ops);
1779         if (err)
1780                 return err;
1781         /*
1782          * Initialize the neighbour table
1783          */
1784         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1785
1786 #ifdef CONFIG_SYSCTL
1787         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1788                                     ndisc_ifinfo_sysctl_change);
1789         if (err)
1790                 goto out_unregister_pernet;
1791 out:
1792 #endif
1793         return err;
1794
1795 #ifdef CONFIG_SYSCTL
1796 out_unregister_pernet:
1797         unregister_pernet_subsys(&ndisc_net_ops);
1798         goto out;
1799 #endif
1800 }
1801
1802 int __init ndisc_late_init(void)
1803 {
1804         return register_netdevice_notifier(&ndisc_netdev_notifier);
1805 }
1806
1807 void ndisc_late_cleanup(void)
1808 {
1809         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1810 }
1811
1812 void ndisc_cleanup(void)
1813 {
1814 #ifdef CONFIG_SYSCTL
1815         neigh_sysctl_unregister(&nd_tbl.parms);
1816 #endif
1817         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1818         unregister_pernet_subsys(&ndisc_net_ops);
1819 }