net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Mike Shaver             <shaver@ingenia.com>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  19  *      Pierre Ynard                    :       export userland ND options
  20  *                                              through netlink (RDNSS support)
  21  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  22  *                                              of an RA.
  23  *      Janos Farkas                    :       kmalloc failure checks
  24  *      Alexey Kuznetsov                :       state machine reworked
  25  *                                              and moved to net/core.
  26  *      Pekka Savola                    :       RFC2461 validation
  27  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  28  */
  29
  30 #define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32 #include <linux/module.h>
  33 #include <linux/errno.h>
  34 #include <linux/types.h>
  35 #include <linux/socket.h>
  36 #include <linux/sockios.h>
  37 #include <linux/sched.h>
  38 #include <linux/net.h>
  39 #include <linux/in6.h>
  40 #include <linux/route.h>
  41 #include <linux/init.h>
  42 #include <linux/rcupdate.h>
  43 #include <linux/slab.h>
  44 #ifdef CONFIG_SYSCTL
  45 #include <linux/sysctl.h>
  46 #endif
  47
  48 #include <linux/if_addr.h>
  49 #include <linux/if_arp.h>
  50 #include <linux/ipv6.h>
  51 #include <linux/icmpv6.h>
  52 #include <linux/jhash.h>
  53
  54 #include <net/sock.h>
  55 #include <net/snmp.h>
  56
  57 #include <net/ipv6.h>
  58 #include <net/protocol.h>
  59 #include <net/ndisc.h>
  60 #include <net/ip6_route.h>
  61 #include <net/addrconf.h>
  62 #include <net/icmp.h>
  63
  64 #include <net/netlink.h>
  65 #include <linux/rtnetlink.h>
  66
  67 #include <net/flow.h>
  68 #include <net/ip6_checksum.h>
  69 #include <net/inet_common.h>
  70 #include <linux/proc_fs.h>
  71
  72 #include <linux/netfilter.h>
  73 #include <linux/netfilter_ipv6.h>
  74
  75 /* Set to 3 to get tracing... */
  76 #define ND_DEBUG 1
  77
  78 #define ND_PRINTK(val, level, fmt, ...)                         \
  79 do {                                                            \
  80         if (val <= ND_DEBUG)                                    \
  81                 net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
  82 } while (0)
  83
  84 static u32 ndisc_hash(const void *pkey,
  85                       const struct net_device *dev,
  86                       __u32 *hash_rnd);
  87 static int ndisc_constructor(struct neighbour *neigh);
  88 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  89 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  90 static int pndisc_constructor(struct pneigh_entry *n);
  91 static void pndisc_destructor(struct pneigh_entry *n);
  92 static void pndisc_redo(struct sk_buff *skb);
  93
  94 static const struct neigh_ops ndisc_generic_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_connected_output,
 100 };
 101
 102 static const struct neigh_ops ndisc_hh_ops = {
 103         .family =               AF_INET6,
 104         .solicit =              ndisc_solicit,
 105         .error_report =         ndisc_error_report,
 106         .output =               neigh_resolve_output,
 107         .connected_output =     neigh_resolve_output,
 108 };
 109
 110
 111 static const struct neigh_ops ndisc_direct_ops = {
 112         .family =               AF_INET6,
 113         .output =               neigh_direct_output,
 114         .connected_output =     neigh_direct_output,
 115 };
 116
 117 struct neigh_table nd_tbl = {
 118         .family =       AF_INET6,
 119         .key_len =      sizeof(struct in6_addr),
 120         .protocol =     cpu_to_be16(ETH_P_IPV6),
 121         .hash =         ndisc_hash,
 122         .constructor =  ndisc_constructor,
 123         .pconstructor = pndisc_constructor,
 124         .pdestructor =  pndisc_destructor,
 125         .proxy_redo =   pndisc_redo,
 126         .id =           "ndisc_cache",
 127         .parms = {
 128                 .tbl                    = &nd_tbl,
 129                 .reachable_time         = ND_REACHABLE_TIME,
 130                 .data = {
 131                         [NEIGH_VAR_MCAST_PROBES] = 3,
 132                         [NEIGH_VAR_UCAST_PROBES] = 3,
 133                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 134                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 135                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 136                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 137                         [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
 138                         [NEIGH_VAR_PROXY_QLEN] = 64,
 139                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 140                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 141                 },
 142         },
 143         .gc_interval =    30 * HZ,
 144         .gc_thresh1 =    128,
 145         .gc_thresh2 =    512,
 146         .gc_thresh3 =   1024,
 147 };
 148
 149 static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
 150 {
 151         int pad   = ndisc_addr_option_pad(skb->dev->type);
 152         int data_len = skb->dev->addr_len;
 153         int space = ndisc_opt_addr_space(skb->dev);
 154         u8 *opt = skb_put(skb, space);
 155
 156         opt[0] = type;
 157         opt[1] = space>>3;
 158
 159         memset(opt + 2, 0, pad);
 160         opt   += pad;
 161         space -= pad;
 162
 163         memcpy(opt+2, data, data_len);
 164         data_len += 2;
 165         opt += data_len;
 166         space -= data_len;
 167         if (space > 0)
 168                 memset(opt, 0, space);
 169 }
 170
 171 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 172                                             struct nd_opt_hdr *end)
 173 {
 174         int type;
 175         if (!cur || !end || cur >= end)
 176                 return NULL;
 177         type = cur->nd_opt_type;
 178         do {
 179                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 180         } while (cur < end && cur->nd_opt_type != type);
 181         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 182 }
 183
 184 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 185 {
 186         return opt->nd_opt_type == ND_OPT_RDNSS ||
 187                 opt->nd_opt_type == ND_OPT_DNSSL;
 188 }
 189
 190 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 191                                              struct nd_opt_hdr *end)
 192 {
 193         if (!cur || !end || cur >= end)
 194                 return NULL;
 195         do {
 196                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 197         } while (cur < end && !ndisc_is_useropt(cur));
 198         return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 199 }
 200
 201 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 202                                           struct ndisc_options *ndopts)
 203 {
 204         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 205
 206         if (!nd_opt || opt_len < 0 || !ndopts)
 207                 return NULL;
 208         memset(ndopts, 0, sizeof(*ndopts));
 209         while (opt_len) {
 210                 int l;
 211                 if (opt_len < sizeof(struct nd_opt_hdr))
 212                         return NULL;
 213                 l = nd_opt->nd_opt_len << 3;
 214                 if (opt_len < l || l == 0)
 215                         return NULL;
 216                 switch (nd_opt->nd_opt_type) {
 217                 case ND_OPT_SOURCE_LL_ADDR:
 218                 case ND_OPT_TARGET_LL_ADDR:
 219                 case ND_OPT_MTU:
 220                 case ND_OPT_REDIRECT_HDR:
 221                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 222                                 ND_PRINTK(2, warn,
 223                                           "%s: duplicated ND6 option found: type=%d\n",
 224                                           __func__, nd_opt->nd_opt_type);
 225                         } else {
 226                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 227                         }
 228                         break;
 229                 case ND_OPT_PREFIX_INFO:
 230                         ndopts->nd_opts_pi_end = nd_opt;
 231                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 232                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 233                         break;
 234 #ifdef CONFIG_IPV6_ROUTE_INFO
 235                 case ND_OPT_ROUTE_INFO:
 236                         ndopts->nd_opts_ri_end = nd_opt;
 237                         if (!ndopts->nd_opts_ri)
 238                                 ndopts->nd_opts_ri = nd_opt;
 239                         break;
 240 #endif
 241                 default:
 242                         if (ndisc_is_useropt(nd_opt)) {
 243                                 ndopts->nd_useropts_end = nd_opt;
 244                                 if (!ndopts->nd_useropts)
 245                                         ndopts->nd_useropts = nd_opt;
 246                         } else {
 247                                 /*
 248                                  * Unknown options must be silently ignored,
 249                                  * to accommodate future extension to the
 250                                  * protocol.
 251                                  */
 252                                 ND_PRINTK(2, notice,
 253                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 254                                           __func__,
 255                                           nd_opt->nd_opt_type,
 256                                           nd_opt->nd_opt_len);
 257                         }
 258                 }
 259                 opt_len -= l;
 260                 nd_opt = ((void *)nd_opt) + l;
 261         }
 262         return ndopts;
 263 }
 264
 265 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 266 {
 267         switch (dev->type) {
 268         case ARPHRD_ETHER:
 269         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 270         case ARPHRD_FDDI:
 271                 ipv6_eth_mc_map(addr, buf);
 272                 return 0;
 273         case ARPHRD_ARCNET:
 274                 ipv6_arcnet_mc_map(addr, buf);
 275                 return 0;
 276         case ARPHRD_INFINIBAND:
 277                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 278                 return 0;
 279         case ARPHRD_IPGRE:
 280                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 281         default:
 282                 if (dir) {
 283                         memcpy(buf, dev->broadcast, dev->addr_len);
 284                         return 0;
 285                 }
 286         }
 287         return -EINVAL;
 288 }
 289 EXPORT_SYMBOL(ndisc_mc_map);
 290
 291 static u32 ndisc_hash(const void *pkey,
 292                       const struct net_device *dev,
 293                       __u32 *hash_rnd)
 294 {
 295         return ndisc_hashfn(pkey, dev, hash_rnd);
 296 }
 297
 298 static int ndisc_constructor(struct neighbour *neigh)
 299 {
 300         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 301         struct net_device *dev = neigh->dev;
 302         struct inet6_dev *in6_dev;
 303         struct neigh_parms *parms;
 304         bool is_multicast = ipv6_addr_is_multicast(addr);
 305
 306         in6_dev = in6_dev_get(dev);
 307         if (in6_dev == NULL) {
 308                 return -EINVAL;
 309         }
 310
 311         parms = in6_dev->nd_parms;
 312         __neigh_parms_put(neigh->parms);
 313         neigh->parms = neigh_parms_clone(parms);
 314
 315         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 316         if (!dev->header_ops) {
 317                 neigh->nud_state = NUD_NOARP;
 318                 neigh->ops = &ndisc_direct_ops;
 319                 neigh->output = neigh_direct_output;
 320         } else {
 321                 if (is_multicast) {
 322                         neigh->nud_state = NUD_NOARP;
 323                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 324                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 325                         neigh->nud_state = NUD_NOARP;
 326                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 327                         if (dev->flags&IFF_LOOPBACK)
 328                                 neigh->type = RTN_LOCAL;
 329                 } else if (dev->flags&IFF_POINTOPOINT) {
 330                         neigh->nud_state = NUD_NOARP;
 331                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 332                 }
 333                 if (dev->header_ops->cache)
 334                         neigh->ops = &ndisc_hh_ops;
 335                 else
 336                         neigh->ops = &ndisc_generic_ops;
 337                 if (neigh->nud_state&NUD_VALID)
 338                         neigh->output = neigh->ops->connected_output;
 339                 else
 340                         neigh->output = neigh->ops->output;
 341         }
 342         in6_dev_put(in6_dev);
 343         return 0;
 344 }
 345
 346 static int pndisc_constructor(struct pneigh_entry *n)
 347 {
 348         struct in6_addr *addr = (struct in6_addr *)&n->key;
 349         struct in6_addr maddr;
 350         struct net_device *dev = n->dev;
 351
 352         if (dev == NULL || __in6_dev_get(dev) == NULL)
 353                 return -EINVAL;
 354         addrconf_addr_solict_mult(addr, &maddr);
 355         ipv6_dev_mc_inc(dev, &maddr);
 356         return 0;
 357 }
 358
 359 static void pndisc_destructor(struct pneigh_entry *n)
 360 {
 361         struct in6_addr *addr = (struct in6_addr *)&n->key;
 362         struct in6_addr maddr;
 363         struct net_device *dev = n->dev;
 364
 365         if (dev == NULL || __in6_dev_get(dev) == NULL)
 366                 return;
 367         addrconf_addr_solict_mult(addr, &maddr);
 368         ipv6_dev_mc_dec(dev, &maddr);
 369 }
 370
 371 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 372                                        int len)
 373 {
 374         int hlen = LL_RESERVED_SPACE(dev);
 375         int tlen = dev->needed_tailroom;
 376         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 377         struct sk_buff *skb;
 378
 379         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 380         if (!skb) {
 381                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 382                           __func__);
 383                 return NULL;
 384         }
 385
 386         skb->protocol = htons(ETH_P_IPV6);
 387         skb->dev = dev;
 388
 389         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 390         skb_reset_transport_header(skb);
 391
 392         /* Manually assign socket ownership as we avoid calling
 393          * sock_alloc_send_pskb() to bypass wmem buffer limits
 394          */
 395         skb_set_owner_w(skb, sk);
 396
 397         return skb;
 398 }
 399
 400 static void ip6_nd_hdr(struct sk_buff *skb,
 401                        const struct in6_addr *saddr,
 402                        const struct in6_addr *daddr,
 403                        int hop_limit, int len)
 404 {
 405         struct ipv6hdr *hdr;
 406
 407         skb_push(skb, sizeof(*hdr));
 408         skb_reset_network_header(skb);
 409         hdr = ipv6_hdr(skb);
 410
 411         ip6_flow_hdr(hdr, 0, 0);
 412
 413         hdr->payload_len = htons(len);
 414         hdr->nexthdr = IPPROTO_ICMPV6;
 415         hdr->hop_limit = hop_limit;
 416
 417         hdr->saddr = *saddr;
 418         hdr->daddr = *daddr;
 419 }
 420
 421 static void ndisc_send_skb(struct sk_buff *skb,
 422                            const struct in6_addr *daddr,
 423                            const struct in6_addr *saddr)
 424 {
 425         struct dst_entry *dst = skb_dst(skb);
 426         struct net *net = dev_net(skb->dev);
 427         struct sock *sk = net->ipv6.ndisc_sk;
 428         struct inet6_dev *idev;
 429         int err;
 430         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 431         u8 type;
 432
 433         type = icmp6h->icmp6_type;
 434
 435         if (!dst) {
 436                 struct flowi6 fl6;
 437
 438                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex);
 439                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 440                 if (IS_ERR(dst)) {
 441                         kfree_skb(skb);
 442                         return;
 443                 }
 444
 445                 skb_dst_set(skb, dst);
 446         }
 447
 448         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 449                                               IPPROTO_ICMPV6,
 450                                               csum_partial(icmp6h,
 451                                                            skb->len, 0));
 452
 453         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 454
 455         rcu_read_lock();
 456         idev = __in6_dev_get(dst->dev);
 457         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 458
 459         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 460                       dst_output);
 461         if (!err) {
 462                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 463                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 464         }
 465
 466         rcu_read_unlock();
 467 }
 468
 469 void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 470                    const struct in6_addr *daddr,
 471                    const struct in6_addr *solicited_addr,
 472                    bool router, bool solicited, bool override, bool inc_opt)
 473 {
 474         struct sk_buff *skb;
 475         struct in6_addr tmpaddr;
 476         struct inet6_ifaddr *ifp;
 477         const struct in6_addr *src_addr;
 478         struct nd_msg *msg;
 479         int optlen = 0;
 480
 481         /* for anycast or proxy, solicited_addr != src_addr */
 482         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 483         if (ifp) {
 484                 src_addr = solicited_addr;
 485                 if (ifp->flags & IFA_F_OPTIMISTIC)
 486                         override = false;
 487                 inc_opt |= ifp->idev->cnf.force_tllao;
 488                 in6_ifa_put(ifp);
 489         } else {
 490                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 491                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 492                                        &tmpaddr))
 493                         return;
 494                 src_addr = &tmpaddr;
 495         }
 496
 497         if (!dev->addr_len)
 498                 inc_opt = 0;
 499         if (inc_opt)
 500                 optlen += ndisc_opt_addr_space(dev);
 501
 502         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 503         if (!skb)
 504                 return;
 505
 506         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 507         *msg = (struct nd_msg) {
 508                 .icmph = {
 509                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 510                         .icmp6_router = router,
 511                         .icmp6_solicited = solicited,
 512                         .icmp6_override = override,
 513                 },
 514                 .target = *solicited_addr,
 515         };
 516
 517         if (inc_opt)
 518                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 519                                        dev->dev_addr);
 520
 521
 522         ndisc_send_skb(skb, daddr, src_addr);
 523 }
 524
 525 static void ndisc_send_unsol_na(struct net_device *dev)
 526 {
 527         struct inet6_dev *idev;
 528         struct inet6_ifaddr *ifa;
 529
 530         idev = in6_dev_get(dev);
 531         if (!idev)
 532                 return;
 533
 534         read_lock_bh(&idev->lock);
 535         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 536                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
 537                               /*router=*/ !!idev->cnf.forwarding,
 538                               /*solicited=*/ false, /*override=*/ true,
 539                               /*inc_opt=*/ true);
 540         }
 541         read_unlock_bh(&idev->lock);
 542
 543         in6_dev_put(idev);
 544 }
 545
 546 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 547                    const struct in6_addr *solicit,
 548                    const struct in6_addr *daddr, const struct in6_addr *saddr)
 549 {
 550         struct sk_buff *skb;
 551         struct in6_addr addr_buf;
 552         int inc_opt = dev->addr_len;
 553         int optlen = 0;
 554         struct nd_msg *msg;
 555
 556         if (saddr == NULL) {
 557                 if (ipv6_get_lladdr(dev, &addr_buf,
 558                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 559                         return;
 560                 saddr = &addr_buf;
 561         }
 562
 563         if (ipv6_addr_any(saddr))
 564                 inc_opt = false;
 565         if (inc_opt)
 566                 optlen += ndisc_opt_addr_space(dev);
 567
 568         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 569         if (!skb)
 570                 return;
 571
 572         msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
 573         *msg = (struct nd_msg) {
 574                 .icmph = {
 575                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 576                 },
 577                 .target = *solicit,
 578         };
 579
 580         if (inc_opt)
 581                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 582                                        dev->dev_addr);
 583
 584         ndisc_send_skb(skb, daddr, saddr);
 585 }
 586
 587 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 588                    const struct in6_addr *daddr)
 589 {
 590         struct sk_buff *skb;
 591         struct rs_msg *msg;
 592         int send_sllao = dev->addr_len;
 593         int optlen = 0;
 594
 595 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 596         /*
 597          * According to section 2.2 of RFC 4429, we must not
 598          * send router solicitations with a sllao from
 599          * optimistic addresses, but we may send the solicitation
 600          * if we don't include the sllao.  So here we check
 601          * if our address is optimistic, and if so, we
 602          * suppress the inclusion of the sllao.
 603          */
 604         if (send_sllao) {
 605                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 606                                                            dev, 1);
 607                 if (ifp) {
 608                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 609                                 send_sllao = 0;
 610                         }
 611                         in6_ifa_put(ifp);
 612                 } else {
 613                         send_sllao = 0;
 614                 }
 615         }
 616 #endif
 617         if (send_sllao)
 618                 optlen += ndisc_opt_addr_space(dev);
 619
 620         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 621         if (!skb)
 622                 return;
 623
 624         msg = (struct rs_msg *)skb_put(skb, sizeof(*msg));
 625         *msg = (struct rs_msg) {
 626                 .icmph = {
 627                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 628                 },
 629         };
 630
 631         if (send_sllao)
 632                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 633                                        dev->dev_addr);
 634
 635         ndisc_send_skb(skb, daddr, saddr);
 636 }
 637
 638
 639 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 640 {
 641         /*
 642          *      "The sender MUST return an ICMP
 643          *       destination unreachable"
 644          */
 645         dst_link_failure(skb);
 646         kfree_skb(skb);
 647 }
 648
 649 /* Called with locked neigh: either read or both */
 650
 651 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 652 {
 653         struct in6_addr *saddr = NULL;
 654         struct in6_addr mcaddr;
 655         struct net_device *dev = neigh->dev;
 656         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 657         int probes = atomic_read(&neigh->probes);
 658
 659         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 660                                            dev, 1,
 661                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 662                 saddr = &ipv6_hdr(skb)->saddr;
 663         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 664         if (probes < 0) {
 665                 if (!(neigh->nud_state & NUD_VALID)) {
 666                         ND_PRINTK(1, dbg,
 667                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 668                                   __func__, target);
 669                 }
 670                 ndisc_send_ns(dev, neigh, target, target, saddr);
 671         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 672                 neigh_app_ns(neigh);
 673         } else {
 674                 addrconf_addr_solict_mult(target, &mcaddr);
 675                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 676         }
 677 }
 678
 679 static int pndisc_is_router(const void *pkey,
 680                             struct net_device *dev)
 681 {
 682         struct pneigh_entry *n;
 683         int ret = -1;
 684
 685         read_lock_bh(&nd_tbl.lock);
 686         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 687         if (n)
 688                 ret = !!(n->flags & NTF_ROUTER);
 689         read_unlock_bh(&nd_tbl.lock);
 690
 691         return ret;
 692 }
 693
 694 static void ndisc_recv_ns(struct sk_buff *skb)
 695 {
 696         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 697         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 698         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 699         u8 *lladdr = NULL;
 700         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 701                                     offsetof(struct nd_msg, opt));
 702         struct ndisc_options ndopts;
 703         struct net_device *dev = skb->dev;
 704         struct inet6_ifaddr *ifp;
 705         struct inet6_dev *idev = NULL;
 706         struct neighbour *neigh;
 707         int dad = ipv6_addr_any(saddr);
 708         bool inc;
 709         int is_router = -1;
 710
 711         if (skb->len < sizeof(struct nd_msg)) {
 712                 ND_PRINTK(2, warn, "NS: packet too short\n");
 713                 return;
 714         }
 715
 716         if (ipv6_addr_is_multicast(&msg->target)) {
 717                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 718                 return;
 719         }
 720
 721         /*
 722          * RFC2461 7.1.1:
 723          * DAD has to be destined for solicited node multicast address.
 724          */
 725         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 726                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 727                 return;
 728         }
 729
 730         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 731                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 732                 return;
 733         }
 734
 735         if (ndopts.nd_opts_src_lladdr) {
 736                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 737                 if (!lladdr) {
 738                         ND_PRINTK(2, warn,
 739                                   "NS: invalid link-layer address length\n");
 740                         return;
 741                 }
 742
 743                 /* RFC2461 7.1.1:
 744                  *      If the IP source address is the unspecified address,
 745                  *      there MUST NOT be source link-layer address option
 746                  *      in the message.
 747                  */
 748                 if (dad) {
 749                         ND_PRINTK(2, warn,
 750                                   "NS: bad DAD packet (link-layer address option)\n");
 751                         return;
 752                 }
 753         }
 754
 755         inc = ipv6_addr_is_multicast(daddr);
 756
 757         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 758         if (ifp) {
 759
 760                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 761                         if (dad) {
 762                                 /*
 763                                  * We are colliding with another node
 764                                  * who is doing DAD
 765                                  * so fail our DAD process
 766                                  */
 767                                 addrconf_dad_failure(ifp);
 768                                 return;
 769                         } else {
 770                                 /*
 771                                  * This is not a dad solicitation.
 772                                  * If we are an optimistic node,
 773                                  * we should respond.
 774                                  * Otherwise, we should ignore it.
 775                                  */
 776                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 777                                         goto out;
 778                         }
 779                 }
 780
 781                 idev = ifp->idev;
 782         } else {
 783                 struct net *net = dev_net(dev);
 784
 785                 idev = in6_dev_get(dev);
 786                 if (!idev) {
 787                         /* XXX: count this drop? */
 788                         return;
 789                 }
 790
 791                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 792                     (idev->cnf.forwarding &&
 793                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 794                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 795                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 796                             skb->pkt_type != PACKET_HOST &&
 797                             inc &&
 798                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 799                                 /*
 800                                  * for anycast or proxy,
 801                                  * sender should delay its response
 802                                  * by a random time between 0 and
 803                                  * MAX_ANYCAST_DELAY_TIME seconds.
 804                                  * (RFC2461) -- yoshfuji
 805                                  */
 806                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 807                                 if (n)
 808                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 809                                 goto out;
 810                         }
 811                 } else
 812                         goto out;
 813         }
 814
 815         if (is_router < 0)
 816                 is_router = idev->cnf.forwarding;
 817
 818         if (dad) {
 819                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
 820                               !!is_router, false, (ifp != NULL), true);
 821                 goto out;
 822         }
 823
 824         if (inc)
 825                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 826         else
 827                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 828
 829         /*
 830          *      update / create cache entry
 831          *      for the source address
 832          */
 833         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 834                                !inc || lladdr || !dev->addr_len);
 835         if (neigh)
 836                 neigh_update(neigh, lladdr, NUD_STALE,
 837                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 838                              NEIGH_UPDATE_F_OVERRIDE);
 839         if (neigh || !dev->header_ops) {
 840                 ndisc_send_na(dev, neigh, saddr, &msg->target,
 841                               !!is_router,
 842                               true, (ifp != NULL && inc), inc);
 843                 if (neigh)
 844                         neigh_release(neigh);
 845         }
 846
 847 out:
 848         if (ifp)
 849                 in6_ifa_put(ifp);
 850         else
 851                 in6_dev_put(idev);
 852 }
 853
 854 static void ndisc_recv_na(struct sk_buff *skb)
 855 {
 856         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 857         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 858         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 859         u8 *lladdr = NULL;
 860         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 861                                     offsetof(struct nd_msg, opt));
 862         struct ndisc_options ndopts;
 863         struct net_device *dev = skb->dev;
 864         struct inet6_ifaddr *ifp;
 865         struct neighbour *neigh;
 866
 867         if (skb->len < sizeof(struct nd_msg)) {
 868                 ND_PRINTK(2, warn, "NA: packet too short\n");
 869                 return;
 870         }
 871
 872         if (ipv6_addr_is_multicast(&msg->target)) {
 873                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 874                 return;
 875         }
 876
 877         if (ipv6_addr_is_multicast(daddr) &&
 878             msg->icmph.icmp6_solicited) {
 879                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 880                 return;
 881         }
 882
 883         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 884                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 885                 return;
 886         }
 887         if (ndopts.nd_opts_tgt_lladdr) {
 888                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 889                 if (!lladdr) {
 890                         ND_PRINTK(2, warn,
 891                                   "NA: invalid link-layer address length\n");
 892                         return;
 893                 }
 894         }
 895         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 896         if (ifp) {
 897                 if (skb->pkt_type != PACKET_LOOPBACK
 898                     && (ifp->flags & IFA_F_TENTATIVE)) {
 899                                 addrconf_dad_failure(ifp);
 900                                 return;
 901                 }
 902                 /* What should we make now? The advertisement
 903                    is invalid, but ndisc specs say nothing
 904                    about it. It could be misconfiguration, or
 905                    an smart proxy agent tries to help us :-)
 906
 907                    We should not print the error if NA has been
 908                    received from loopback - it is just our own
 909                    unsolicited advertisement.
 910                  */
 911                 if (skb->pkt_type != PACKET_LOOPBACK)
 912                         ND_PRINTK(1, warn,
 913                                   "NA: someone advertises our address %pI6 on %s!\n",
 914                                   &ifp->addr, ifp->idev->dev->name);
 915                 in6_ifa_put(ifp);
 916                 return;
 917         }
 918         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 919
 920         if (neigh) {
 921                 u8 old_flags = neigh->flags;
 922                 struct net *net = dev_net(dev);
 923
 924                 if (neigh->nud_state & NUD_FAILED)
 925                         goto out;
 926
 927                 /*
 928                  * Don't update the neighbor cache entry on a proxy NA from
 929                  * ourselves because either the proxied node is off link or it
 930                  * has already sent a NA to us.
 931                  */
 932                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 933                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
 934                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
 935                         /* XXX: idev->cnf.proxy_ndp */
 936                         goto out;
 937                 }
 938
 939                 neigh_update(neigh, lladdr,
 940                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 941                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 942                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 943                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 944                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 945
 946                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 947                         /*
 948                          * Change: router to host
 949                          */
 950                         rt6_clean_tohost(dev_net(dev),  saddr);
 951                 }
 952
 953 out:
 954                 neigh_release(neigh);
 955         }
 956 }
 957
 958 static void ndisc_recv_rs(struct sk_buff *skb)
 959 {
 960         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 961         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 962         struct neighbour *neigh;
 963         struct inet6_dev *idev;
 964         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 965         struct ndisc_options ndopts;
 966         u8 *lladdr = NULL;
 967
 968         if (skb->len < sizeof(*rs_msg))
 969                 return;
 970
 971         idev = __in6_dev_get(skb->dev);
 972         if (!idev) {
 973                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
 974                 return;
 975         }
 976
 977         /* Don't accept RS if we're not in router mode */
 978         if (!idev->cnf.forwarding)
 979                 goto out;
 980
 981         /*
 982          * Don't update NCE if src = ::;
 983          * this implies that the source node has no ip address assigned yet.
 984          */
 985         if (ipv6_addr_any(saddr))
 986                 goto out;
 987
 988         /* Parse ND options */
 989         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 990                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
 991                 goto out;
 992         }
 993
 994         if (ndopts.nd_opts_src_lladdr) {
 995                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
 996                                              skb->dev);
 997                 if (!lladdr)
 998                         goto out;
 999         }
1000
1001         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1002         if (neigh) {
1003                 neigh_update(neigh, lladdr, NUD_STALE,
1004                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1005                              NEIGH_UPDATE_F_OVERRIDE|
1006                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1007                 neigh_release(neigh);
1008         }
1009 out:
1010         return;
1011 }
1012
1013 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1014 {
1015         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1016         struct sk_buff *skb;
1017         struct nlmsghdr *nlh;
1018         struct nduseroptmsg *ndmsg;
1019         struct net *net = dev_net(ra->dev);
1020         int err;
1021         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1022                                     + (opt->nd_opt_len << 3));
1023         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1024
1025         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1026         if (skb == NULL) {
1027                 err = -ENOBUFS;
1028                 goto errout;
1029         }
1030
1031         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1032         if (nlh == NULL) {
1033                 goto nla_put_failure;
1034         }
1035
1036         ndmsg = nlmsg_data(nlh);
1037         ndmsg->nduseropt_family = AF_INET6;
1038         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1039         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1040         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1041         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1042
1043         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1044
1045         if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1046                     &ipv6_hdr(ra)->saddr))
1047                 goto nla_put_failure;
1048         nlmsg_end(skb, nlh);
1049
1050         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1051         return;
1052
1053 nla_put_failure:
1054         nlmsg_free(skb);
1055         err = -EMSGSIZE;
1056 errout:
1057         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1058 }
1059
1060 static void ndisc_router_discovery(struct sk_buff *skb)
1061 {
1062         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1063         struct neighbour *neigh = NULL;
1064         struct inet6_dev *in6_dev;
1065         struct rt6_info *rt = NULL;
1066         int lifetime;
1067         struct ndisc_options ndopts;
1068         int optlen;
1069         unsigned int pref = 0;
1070
1071         __u8 *opt = (__u8 *)(ra_msg + 1);
1072
1073         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1074                 sizeof(struct ra_msg);
1075
1076         ND_PRINTK(2, info,
1077                   "RA: %s, dev: %s\n",
1078                   __func__, skb->dev->name);
1079         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1080                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1081                 return;
1082         }
1083         if (optlen < 0) {
1084                 ND_PRINTK(2, warn, "RA: packet too short\n");
1085                 return;
1086         }
1087
1088 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1089         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1090                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1091                 return;
1092         }
1093 #endif
1094
1095         /*
1096          *      set the RA_RECV flag in the interface
1097          */
1098
1099         in6_dev = __in6_dev_get(skb->dev);
1100         if (in6_dev == NULL) {
1101                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1102                           skb->dev->name);
1103                 return;
1104         }
1105
1106         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1107                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1108                 return;
1109         }
1110
1111         if (!ipv6_accept_ra(in6_dev)) {
1112                 ND_PRINTK(2, info,
1113                           "RA: %s, did not accept ra for dev: %s\n",
1114                           __func__, skb->dev->name);
1115                 goto skip_linkparms;
1116         }
1117
1118 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1119         /* skip link-specific parameters from interior routers */
1120         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1121                 ND_PRINTK(2, info,
1122                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1123                           __func__, skb->dev->name);
1124                 goto skip_linkparms;
1125         }
1126 #endif
1127
1128         if (in6_dev->if_flags & IF_RS_SENT) {
1129                 /*
1130                  *      flag that an RA was received after an RS was sent
1131                  *      out on this interface.
1132                  */
1133                 in6_dev->if_flags |= IF_RA_RCVD;
1134         }
1135
1136         /*
1137          * Remember the managed/otherconf flags from most recently
1138          * received RA message (RFC 2462) -- yoshfuji
1139          */
1140         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1141                                 IF_RA_OTHERCONF)) |
1142                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1143                                         IF_RA_MANAGED : 0) |
1144                                 (ra_msg->icmph.icmp6_addrconf_other ?
1145                                         IF_RA_OTHERCONF : 0);
1146
1147         if (!in6_dev->cnf.accept_ra_defrtr) {
1148                 ND_PRINTK(2, info,
1149                           "RA: %s, defrtr is false for dev: %s\n",
1150                           __func__, skb->dev->name);
1151                 goto skip_defrtr;
1152         }
1153
1154         /* Do not accept RA with source-addr found on local machine unless
1155          * accept_ra_from_local is set to true.
1156          */
1157         if (!in6_dev->cnf.accept_ra_from_local &&
1158             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1159                           NULL, 0)) {
1160                 ND_PRINTK(2, info,
1161                           "RA from local address detected on dev: %s: default router ignored\n",
1162                           skb->dev->name);
1163                 goto skip_defrtr;
1164         }
1165
1166         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1167
1168 #ifdef CONFIG_IPV6_ROUTER_PREF
1169         pref = ra_msg->icmph.icmp6_router_pref;
1170         /* 10b is handled as if it were 00b (medium) */
1171         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1172             !in6_dev->cnf.accept_ra_rtr_pref)
1173                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1174 #endif
1175
1176         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1177
1178         if (rt) {
1179                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1180                 if (!neigh) {
1181                         ND_PRINTK(0, err,
1182                                   "RA: %s got default router without neighbour\n",
1183                                   __func__);
1184                         ip6_rt_put(rt);
1185                         return;
1186                 }
1187         }
1188         if (rt && lifetime == 0) {
1189                 ip6_del_rt(rt);
1190                 rt = NULL;
1191         }
1192
1193         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, for dev: %s\n",
1194                   rt, lifetime, skb->dev->name);
1195         if (rt == NULL && lifetime) {
1196                 ND_PRINTK(3, info, "RA: adding default router\n");
1197
1198                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1199                 if (rt == NULL) {
1200                         ND_PRINTK(0, err,
1201                                   "RA: %s failed to add default route\n",
1202                                   __func__);
1203                         return;
1204                 }
1205
1206                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1207                 if (neigh == NULL) {
1208                         ND_PRINTK(0, err,
1209                                   "RA: %s got default router without neighbour\n",
1210                                   __func__);
1211                         ip6_rt_put(rt);
1212                         return;
1213                 }
1214                 neigh->flags |= NTF_ROUTER;
1215         } else if (rt) {
1216                 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1217         }
1218
1219         if (rt)
1220                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1221         if (ra_msg->icmph.icmp6_hop_limit) {
1222                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1223                 if (rt)
1224                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1225                                        ra_msg->icmph.icmp6_hop_limit);
1226         }
1227
1228 skip_defrtr:
1229
1230         /*
1231          *      Update Reachable Time and Retrans Timer
1232          */
1233
1234         if (in6_dev->nd_parms) {
1235                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1236
1237                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1238                         rtime = (rtime*HZ)/1000;
1239                         if (rtime < HZ/10)
1240                                 rtime = HZ/10;
1241                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1242                         in6_dev->tstamp = jiffies;
1243                         inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1244                 }
1245
1246                 rtime = ntohl(ra_msg->reachable_time);
1247                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1248                         rtime = (rtime*HZ)/1000;
1249
1250                         if (rtime < HZ/10)
1251                                 rtime = HZ/10;
1252
1253                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1254                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1255                                               BASE_REACHABLE_TIME, rtime);
1256                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1257                                               GC_STALETIME, 3 * rtime);
1258                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1259                                 in6_dev->tstamp = jiffies;
1260                                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1261                         }
1262                 }
1263         }
1264
1265 skip_linkparms:
1266
1267         /*
1268          *      Process options.
1269          */
1270
1271         if (!neigh)
1272                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1273                                        skb->dev, 1);
1274         if (neigh) {
1275                 u8 *lladdr = NULL;
1276                 if (ndopts.nd_opts_src_lladdr) {
1277                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1278                                                      skb->dev);
1279                         if (!lladdr) {
1280                                 ND_PRINTK(2, warn,
1281                                           "RA: invalid link-layer address length\n");
1282                                 goto out;
1283                         }
1284                 }
1285                 neigh_update(neigh, lladdr, NUD_STALE,
1286                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1287                              NEIGH_UPDATE_F_OVERRIDE|
1288                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1289                              NEIGH_UPDATE_F_ISROUTER);
1290         }
1291
1292         if (!ipv6_accept_ra(in6_dev)) {
1293                 ND_PRINTK(2, info,
1294                           "RA: %s, accept_ra is false for dev: %s\n",
1295                           __func__, skb->dev->name);
1296                 goto out;
1297         }
1298
1299 #ifdef CONFIG_IPV6_ROUTE_INFO
1300         if (!in6_dev->cnf.accept_ra_from_local &&
1301             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1302                           NULL, 0)) {
1303                 ND_PRINTK(2, info,
1304                           "RA from local address detected on dev: %s: router info ignored.\n",
1305                           skb->dev->name);
1306                 goto skip_routeinfo;
1307         }
1308
1309         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1310                 struct nd_opt_hdr *p;
1311                 for (p = ndopts.nd_opts_ri;
1312                      p;
1313                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1314                         struct route_info *ri = (struct route_info *)p;
1315 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1316                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1317                             ri->prefix_len == 0)
1318                                 continue;
1319 #endif
1320                         if (ri->prefix_len == 0 &&
1321                             !in6_dev->cnf.accept_ra_defrtr)
1322                                 continue;
1323                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1324                                 continue;
1325                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1326                                       &ipv6_hdr(skb)->saddr);
1327                 }
1328         }
1329
1330 skip_routeinfo:
1331 #endif
1332
1333 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1334         /* skip link-specific ndopts from interior routers */
1335         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1336                 ND_PRINTK(2, info,
1337                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1338                           __func__, skb->dev->name);
1339                 goto out;
1340         }
1341 #endif
1342
1343         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1344                 struct nd_opt_hdr *p;
1345                 for (p = ndopts.nd_opts_pi;
1346                      p;
1347                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1348                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1349                                             (p->nd_opt_len) << 3,
1350                                             ndopts.nd_opts_src_lladdr != NULL);
1351                 }
1352         }
1353
1354         if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1355                 __be32 n;
1356                 u32 mtu;
1357
1358                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1359                 mtu = ntohl(n);
1360
1361                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1362                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1363                 } else if (in6_dev->cnf.mtu6 != mtu) {
1364                         in6_dev->cnf.mtu6 = mtu;
1365
1366                         if (rt)
1367                                 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1368
1369                         rt6_mtu_change(skb->dev, mtu);
1370                 }
1371         }
1372
1373         if (ndopts.nd_useropts) {
1374                 struct nd_opt_hdr *p;
1375                 for (p = ndopts.nd_useropts;
1376                      p;
1377                      p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1378                         ndisc_ra_useropt(skb, p);
1379                 }
1380         }
1381
1382         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1383                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1384         }
1385 out:
1386         ip6_rt_put(rt);
1387         if (neigh)
1388                 neigh_release(neigh);
1389 }
1390
1391 static void ndisc_redirect_rcv(struct sk_buff *skb)
1392 {
1393         u8 *hdr;
1394         struct ndisc_options ndopts;
1395         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1396         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1397                                     offsetof(struct rd_msg, opt));
1398
1399 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1400         switch (skb->ndisc_nodetype) {
1401         case NDISC_NODETYPE_HOST:
1402         case NDISC_NODETYPE_NODEFAULT:
1403                 ND_PRINTK(2, warn,
1404                           "Redirect: from host or unauthorized router\n");
1405                 return;
1406         }
1407 #endif
1408
1409         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1410                 ND_PRINTK(2, warn,
1411                           "Redirect: source address is not link-local\n");
1412                 return;
1413         }
1414
1415         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1416                 return;
1417
1418         if (!ndopts.nd_opts_rh) {
1419                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1420                                         skb->dev->ifindex, 0);
1421                 return;
1422         }
1423
1424         hdr = (u8 *)ndopts.nd_opts_rh;
1425         hdr += 8;
1426         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1427                 return;
1428
1429         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1430 }
1431
1432 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1433                                            struct sk_buff *orig_skb,
1434                                            int rd_len)
1435 {
1436         u8 *opt = skb_put(skb, rd_len);
1437
1438         memset(opt, 0, 8);
1439         *(opt++) = ND_OPT_REDIRECT_HDR;
1440         *(opt++) = (rd_len >> 3);
1441         opt += 6;
1442
1443         memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
1444 }
1445
1446 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1447 {
1448         struct net_device *dev = skb->dev;
1449         struct net *net = dev_net(dev);
1450         struct sock *sk = net->ipv6.ndisc_sk;
1451         int optlen = 0;
1452         struct inet_peer *peer;
1453         struct sk_buff *buff;
1454         struct rd_msg *msg;
1455         struct in6_addr saddr_buf;
1456         struct rt6_info *rt;
1457         struct dst_entry *dst;
1458         struct flowi6 fl6;
1459         int rd_len;
1460         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1461         bool ret;
1462
1463         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1464                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1465                           dev->name);
1466                 return;
1467         }
1468
1469         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1470             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1471                 ND_PRINTK(2, warn,
1472                           "Redirect: target address is not link-local unicast\n");
1473                 return;
1474         }
1475
1476         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1477                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1478
1479         dst = ip6_route_output(net, NULL, &fl6);
1480         if (dst->error) {
1481                 dst_release(dst);
1482                 return;
1483         }
1484         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1485         if (IS_ERR(dst))
1486                 return;
1487
1488         rt = (struct rt6_info *) dst;
1489
1490         if (rt->rt6i_flags & RTF_GATEWAY) {
1491                 ND_PRINTK(2, warn,
1492                           "Redirect: destination is not a neighbour\n");
1493                 goto release;
1494         }
1495         peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
1496         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1497         if (peer)
1498                 inet_putpeer(peer);
1499         if (!ret)
1500                 goto release;
1501
1502         if (dev->addr_len) {
1503                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1504                 if (!neigh) {
1505                         ND_PRINTK(2, warn,
1506                                   "Redirect: no neigh for target address\n");
1507                         goto release;
1508                 }
1509
1510                 read_lock_bh(&neigh->lock);
1511                 if (neigh->nud_state & NUD_VALID) {
1512                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1513                         read_unlock_bh(&neigh->lock);
1514                         ha = ha_buf;
1515                         optlen += ndisc_opt_addr_space(dev);
1516                 } else
1517                         read_unlock_bh(&neigh->lock);
1518
1519                 neigh_release(neigh);
1520         }
1521
1522         rd_len = min_t(unsigned int,
1523                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1524                        skb->len + 8);
1525         rd_len &= ~0x7;
1526         optlen += rd_len;
1527
1528         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1529         if (!buff)
1530                 goto release;
1531
1532         msg = (struct rd_msg *)skb_put(buff, sizeof(*msg));
1533         *msg = (struct rd_msg) {
1534                 .icmph = {
1535                         .icmp6_type = NDISC_REDIRECT,
1536                 },
1537                 .target = *target,
1538                 .dest = ipv6_hdr(skb)->daddr,
1539         };
1540
1541         /*
1542          *      include target_address option
1543          */
1544
1545         if (ha)
1546                 ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
1547
1548         /*
1549          *      build redirect option and copy skb over to the new packet.
1550          */
1551
1552         if (rd_len)
1553                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1554
1555         skb_dst_set(buff, dst);
1556         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1557         return;
1558
1559 release:
1560         dst_release(dst);
1561 }
1562
1563 static void pndisc_redo(struct sk_buff *skb)
1564 {
1565         ndisc_recv_ns(skb);
1566         kfree_skb(skb);
1567 }
1568
1569 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1570 {
1571         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1572
1573         if (!idev)
1574                 return true;
1575         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1576             idev->cnf.suppress_frag_ndisc) {
1577                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1578                 return true;
1579         }
1580         return false;
1581 }
1582
1583 int ndisc_rcv(struct sk_buff *skb)
1584 {
1585         struct nd_msg *msg;
1586
1587         if (ndisc_suppress_frag_ndisc(skb))
1588                 return 0;
1589
1590         if (skb_linearize(skb))
1591                 return 0;
1592
1593         msg = (struct nd_msg *)skb_transport_header(skb);
1594
1595         __skb_push(skb, skb->data - skb_transport_header(skb));
1596
1597         if (ipv6_hdr(skb)->hop_limit != 255) {
1598                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1599                           ipv6_hdr(skb)->hop_limit);
1600                 return 0;
1601         }
1602
1603         if (msg->icmph.icmp6_code != 0) {
1604                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1605                           msg->icmph.icmp6_code);
1606                 return 0;
1607         }
1608
1609         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1610
1611         switch (msg->icmph.icmp6_type) {
1612         case NDISC_NEIGHBOUR_SOLICITATION:
1613                 ndisc_recv_ns(skb);
1614                 break;
1615
1616         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1617                 ndisc_recv_na(skb);
1618                 break;
1619
1620         case NDISC_ROUTER_SOLICITATION:
1621                 ndisc_recv_rs(skb);
1622                 break;
1623
1624         case NDISC_ROUTER_ADVERTISEMENT:
1625                 ndisc_router_discovery(skb);
1626                 break;
1627
1628         case NDISC_REDIRECT:
1629                 ndisc_redirect_rcv(skb);
1630                 break;
1631         }
1632
1633         return 0;
1634 }
1635
1636 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1637 {
1638         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1639         struct net *net = dev_net(dev);
1640         struct inet6_dev *idev;
1641
1642         switch (event) {
1643         case NETDEV_CHANGEADDR:
1644                 neigh_changeaddr(&nd_tbl, dev);
1645                 fib6_run_gc(0, net, false);
1646                 idev = in6_dev_get(dev);
1647                 if (!idev)
1648                         break;
1649                 if (idev->cnf.ndisc_notify)
1650                         ndisc_send_unsol_na(dev);
1651                 in6_dev_put(idev);
1652                 break;
1653         case NETDEV_DOWN:
1654                 neigh_ifdown(&nd_tbl, dev);
1655                 fib6_run_gc(0, net, false);
1656                 break;
1657         case NETDEV_NOTIFY_PEERS:
1658                 ndisc_send_unsol_na(dev);
1659                 break;
1660         default:
1661                 break;
1662         }
1663
1664         return NOTIFY_DONE;
1665 }
1666
1667 static struct notifier_block ndisc_netdev_notifier = {
1668         .notifier_call = ndisc_netdev_event,
1669 };
1670
1671 #ifdef CONFIG_SYSCTL
1672 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1673                                          const char *func, const char *dev_name)
1674 {
1675         static char warncomm[TASK_COMM_LEN];
1676         static int warned;
1677         if (strcmp(warncomm, current->comm) && warned < 5) {
1678                 strcpy(warncomm, current->comm);
1679                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1680                         warncomm, func,
1681                         dev_name, ctl->procname,
1682                         dev_name, ctl->procname);
1683                 warned++;
1684         }
1685 }
1686
1687 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1688 {
1689         struct net_device *dev = ctl->extra1;
1690         struct inet6_dev *idev;
1691         int ret;
1692
1693         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1694             (strcmp(ctl->procname, "base_reachable_time") == 0))
1695                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1696
1697         if (strcmp(ctl->procname, "retrans_time") == 0)
1698                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1699
1700         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1701                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1702                                                   buffer, lenp, ppos);
1703
1704         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1705                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1706                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1707                                                      buffer, lenp, ppos);
1708         else
1709                 ret = -1;
1710
1711         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1712                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1713                         idev->nd_parms->reachable_time =
1714                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1715                 idev->tstamp = jiffies;
1716                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1717                 in6_dev_put(idev);
1718         }
1719         return ret;
1720 }
1721
1722
1723 #endif
1724
1725 static int __net_init ndisc_net_init(struct net *net)
1726 {
1727         struct ipv6_pinfo *np;
1728         struct sock *sk;
1729         int err;
1730
1731         err = inet_ctl_sock_create(&sk, PF_INET6,
1732                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1733         if (err < 0) {
1734                 ND_PRINTK(0, err,
1735                           "NDISC: Failed to initialize the control socket (err %d)\n",
1736                           err);
1737                 return err;
1738         }
1739
1740         net->ipv6.ndisc_sk = sk;
1741
1742         np = inet6_sk(sk);
1743         np->hop_limit = 255;
1744         /* Do not loopback ndisc messages */
1745         np->mc_loop = 0;
1746
1747         return 0;
1748 }
1749
1750 static void __net_exit ndisc_net_exit(struct net *net)
1751 {
1752         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1753 }
1754
1755 static struct pernet_operations ndisc_net_ops = {
1756         .init = ndisc_net_init,
1757         .exit = ndisc_net_exit,
1758 };
1759
1760 int __init ndisc_init(void)
1761 {
1762         int err;
1763
1764         err = register_pernet_subsys(&ndisc_net_ops);
1765         if (err)
1766                 return err;
1767         /*
1768          * Initialize the neighbour table
1769          */
1770         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1771
1772 #ifdef CONFIG_SYSCTL
1773         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1774                                     ndisc_ifinfo_sysctl_change);
1775         if (err)
1776                 goto out_unregister_pernet;
1777 out:
1778 #endif
1779         return err;
1780
1781 #ifdef CONFIG_SYSCTL
1782 out_unregister_pernet:
1783         unregister_pernet_subsys(&ndisc_net_ops);
1784         goto out;
1785 #endif
1786 }
1787
1788 int __init ndisc_late_init(void)
1789 {
1790         return register_netdevice_notifier(&ndisc_netdev_notifier);
1791 }
1792
1793 void ndisc_late_cleanup(void)
1794 {
1795         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1796 }
1797
1798 void ndisc_cleanup(void)
1799 {
1800 #ifdef CONFIG_SYSCTL
1801         neigh_sysctl_unregister(&nd_tbl.parms);
1802 #endif
1803         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1804         unregister_pernet_subsys(&ndisc_net_ops);
1805 }