net/ipv6/ndisc.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Neighbour Discovery for IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Mike Shaver             <shaver@ingenia.com>
   9  */
  10
  11 /*
  12  *      Changes:
  13  *
  14  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  15  *      Pierre Ynard                    :       export userland ND options
  16  *                                              through netlink (RDNSS support)
  17  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  18  *                                              of an RA.
  19  *      Janos Farkas                    :       kmalloc failure checks
  20  *      Alexey Kuznetsov                :       state machine reworked
  21  *                                              and moved to net/core.
  22  *      Pekka Savola                    :       RFC2461 validation
  23  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  24  */
  25
  26 #define pr_fmt(fmt) "ICMPv6: " fmt
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/sched.h>
  34 #include <linux/net.h>
  35 #include <linux/in6.h>
  36 #include <linux/route.h>
  37 #include <linux/init.h>
  38 #include <linux/rcupdate.h>
  39 #include <linux/slab.h>
  40 #ifdef CONFIG_SYSCTL
  41 #include <linux/sysctl.h>
  42 #endif
  43
  44 #include <linux/if_addr.h>
  45 #include <linux/if_ether.h>
  46 #include <linux/if_arp.h>
  47 #include <linux/ipv6.h>
  48 #include <linux/icmpv6.h>
  49 #include <linux/jhash.h>
  50
  51 #include <net/sock.h>
  52 #include <net/snmp.h>
  53
  54 #include <net/ipv6.h>
  55 #include <net/protocol.h>
  56 #include <net/ndisc.h>
  57 #include <net/ip6_route.h>
  58 #include <net/addrconf.h>
  59 #include <net/icmp.h>
  60
  61 #include <net/netlink.h>
  62 #include <linux/rtnetlink.h>
  63
  64 #include <net/flow.h>
  65 #include <net/ip6_checksum.h>
  66 #include <net/inet_common.h>
  67 #include <linux/proc_fs.h>
  68
  69 #include <linux/netfilter.h>
  70 #include <linux/netfilter_ipv6.h>
  71
  72 static u32 ndisc_hash(const void *pkey,
  73                       const struct net_device *dev,
  74                       __u32 *hash_rnd);
  75 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
  76 static bool ndisc_allow_add(const struct net_device *dev,
  77                             struct netlink_ext_ack *extack);
  78 static int ndisc_constructor(struct neighbour *neigh);
  79 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  80 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  81 static int pndisc_constructor(struct pneigh_entry *n);
  82 static void pndisc_destructor(struct pneigh_entry *n);
  83 static void pndisc_redo(struct sk_buff *skb);
  84 static int ndisc_is_multicast(const void *pkey);
  85
  86 static const struct neigh_ops ndisc_generic_ops = {
  87         .family =               AF_INET6,
  88         .solicit =              ndisc_solicit,
  89         .error_report =         ndisc_error_report,
  90         .output =               neigh_resolve_output,
  91         .connected_output =     neigh_connected_output,
  92 };
  93
  94 static const struct neigh_ops ndisc_hh_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_resolve_output,
 100 };
 101
 102
 103 static const struct neigh_ops ndisc_direct_ops = {
 104         .family =               AF_INET6,
 105         .output =               neigh_direct_output,
 106         .connected_output =     neigh_direct_output,
 107 };
 108
 109 struct neigh_table nd_tbl = {
 110         .family =       AF_INET6,
 111         .key_len =      sizeof(struct in6_addr),
 112         .protocol =     cpu_to_be16(ETH_P_IPV6),
 113         .hash =         ndisc_hash,
 114         .key_eq =       ndisc_key_eq,
 115         .constructor =  ndisc_constructor,
 116         .pconstructor = pndisc_constructor,
 117         .pdestructor =  pndisc_destructor,
 118         .proxy_redo =   pndisc_redo,
 119         .is_multicast = ndisc_is_multicast,
 120         .allow_add  =   ndisc_allow_add,
 121         .id =           "ndisc_cache",
 122         .parms = {
 123                 .tbl                    = &nd_tbl,
 124                 .reachable_time         = ND_REACHABLE_TIME,
 125                 .data = {
 126                         [NEIGH_VAR_MCAST_PROBES] = 3,
 127                         [NEIGH_VAR_UCAST_PROBES] = 3,
 128                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 129                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 130                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 131                         [NEIGH_VAR_INTERVAL_PROBE_TIME_MS] = 5 * HZ,
 132                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 133                         [NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
 134                         [NEIGH_VAR_PROXY_QLEN] = 64,
 135                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 136                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 137                 },
 138         },
 139         .gc_interval =    30 * HZ,
 140         .gc_thresh1 =    128,
 141         .gc_thresh2 =    512,
 142         .gc_thresh3 =   1024,
 143 };
 144 EXPORT_SYMBOL_GPL(nd_tbl);
 145
 146 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, const void *data,
 147                               int data_len, int pad)
 148 {
 149         int space = __ndisc_opt_addr_space(data_len, pad);
 150         u8 *opt = skb_put(skb, space);
 151
 152         opt[0] = type;
 153         opt[1] = space>>3;
 154
 155         memset(opt + 2, 0, pad);
 156         opt   += pad;
 157         space -= pad;
 158
 159         memcpy(opt+2, data, data_len);
 160         data_len += 2;
 161         opt += data_len;
 162         space -= data_len;
 163         if (space > 0)
 164                 memset(opt, 0, space);
 165 }
 166 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
 167
 168 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
 169                                           const void *data, u8 icmp6_type)
 170 {
 171         __ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
 172                                  ndisc_addr_option_pad(skb->dev->type));
 173         ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
 174 }
 175
 176 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
 177                                                    void *ha,
 178                                                    const u8 *ops_data)
 179 {
 180         ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
 181         ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
 182 }
 183
 184 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 185                                             struct nd_opt_hdr *end)
 186 {
 187         int type;
 188         if (!cur || !end || cur >= end)
 189                 return NULL;
 190         type = cur->nd_opt_type;
 191         do {
 192                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 193         } while (cur < end && cur->nd_opt_type != type);
 194         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 195 }
 196
 197 static inline int ndisc_is_useropt(const struct net_device *dev,
 198                                    struct nd_opt_hdr *opt)
 199 {
 200         return opt->nd_opt_type == ND_OPT_PREFIX_INFO ||
 201                 opt->nd_opt_type == ND_OPT_RDNSS ||
 202                 opt->nd_opt_type == ND_OPT_DNSSL ||
 203                 opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
 204                 opt->nd_opt_type == ND_OPT_PREF64 ||
 205                 ndisc_ops_is_useropt(dev, opt->nd_opt_type);
 206 }
 207
 208 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
 209                                              struct nd_opt_hdr *cur,
 210                                              struct nd_opt_hdr *end)
 211 {
 212         if (!cur || !end || cur >= end)
 213                 return NULL;
 214         do {
 215                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 216         } while (cur < end && !ndisc_is_useropt(dev, cur));
 217         return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
 218 }
 219
 220 struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 221                                           u8 *opt, int opt_len,
 222                                           struct ndisc_options *ndopts)
 223 {
 224         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 225
 226         if (!nd_opt || opt_len < 0 || !ndopts)
 227                 return NULL;
 228         memset(ndopts, 0, sizeof(*ndopts));
 229         while (opt_len) {
 230                 int l;
 231                 if (opt_len < sizeof(struct nd_opt_hdr))
 232                         return NULL;
 233                 l = nd_opt->nd_opt_len << 3;
 234                 if (opt_len < l || l == 0)
 235                         return NULL;
 236                 if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
 237                         goto next_opt;
 238                 switch (nd_opt->nd_opt_type) {
 239                 case ND_OPT_SOURCE_LL_ADDR:
 240                 case ND_OPT_TARGET_LL_ADDR:
 241                 case ND_OPT_MTU:
 242                 case ND_OPT_NONCE:
 243                 case ND_OPT_REDIRECT_HDR:
 244                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 245                                 ND_PRINTK(2, warn,
 246                                           "%s: duplicated ND6 option found: type=%d\n",
 247                                           __func__, nd_opt->nd_opt_type);
 248                         } else {
 249                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 250                         }
 251                         break;
 252                 case ND_OPT_PREFIX_INFO:
 253                         ndopts->nd_opts_pi_end = nd_opt;
 254                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 255                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 256                         break;
 257 #ifdef CONFIG_IPV6_ROUTE_INFO
 258                 case ND_OPT_ROUTE_INFO:
 259                         ndopts->nd_opts_ri_end = nd_opt;
 260                         if (!ndopts->nd_opts_ri)
 261                                 ndopts->nd_opts_ri = nd_opt;
 262                         break;
 263 #endif
 264                 default:
 265                         if (ndisc_is_useropt(dev, nd_opt)) {
 266                                 ndopts->nd_useropts_end = nd_opt;
 267                                 if (!ndopts->nd_useropts)
 268                                         ndopts->nd_useropts = nd_opt;
 269                         } else {
 270                                 /*
 271                                  * Unknown options must be silently ignored,
 272                                  * to accommodate future extension to the
 273                                  * protocol.
 274                                  */
 275                                 ND_PRINTK(2, notice,
 276                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 277                                           __func__,
 278                                           nd_opt->nd_opt_type,
 279                                           nd_opt->nd_opt_len);
 280                         }
 281                 }
 282 next_opt:
 283                 opt_len -= l;
 284                 nd_opt = ((void *)nd_opt) + l;
 285         }
 286         return ndopts;
 287 }
 288
 289 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 290 {
 291         switch (dev->type) {
 292         case ARPHRD_ETHER:
 293         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 294         case ARPHRD_FDDI:
 295                 ipv6_eth_mc_map(addr, buf);
 296                 return 0;
 297         case ARPHRD_ARCNET:
 298                 ipv6_arcnet_mc_map(addr, buf);
 299                 return 0;
 300         case ARPHRD_INFINIBAND:
 301                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 302                 return 0;
 303         case ARPHRD_IPGRE:
 304                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 305         default:
 306                 if (dir) {
 307                         memcpy(buf, dev->broadcast, dev->addr_len);
 308                         return 0;
 309                 }
 310         }
 311         return -EINVAL;
 312 }
 313 EXPORT_SYMBOL(ndisc_mc_map);
 314
 315 static u32 ndisc_hash(const void *pkey,
 316                       const struct net_device *dev,
 317                       __u32 *hash_rnd)
 318 {
 319         return ndisc_hashfn(pkey, dev, hash_rnd);
 320 }
 321
 322 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
 323 {
 324         return neigh_key_eq128(n, pkey);
 325 }
 326
 327 static int ndisc_constructor(struct neighbour *neigh)
 328 {
 329         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 330         struct net_device *dev = neigh->dev;
 331         struct inet6_dev *in6_dev;
 332         struct neigh_parms *parms;
 333         bool is_multicast = ipv6_addr_is_multicast(addr);
 334
 335         in6_dev = in6_dev_get(dev);
 336         if (!in6_dev) {
 337                 return -EINVAL;
 338         }
 339
 340         parms = in6_dev->nd_parms;
 341         __neigh_parms_put(neigh->parms);
 342         neigh->parms = neigh_parms_clone(parms);
 343
 344         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 345         if (!dev->header_ops) {
 346                 neigh->nud_state = NUD_NOARP;
 347                 neigh->ops = &ndisc_direct_ops;
 348                 neigh->output = neigh_direct_output;
 349         } else {
 350                 if (is_multicast) {
 351                         neigh->nud_state = NUD_NOARP;
 352                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 353                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 354                         neigh->nud_state = NUD_NOARP;
 355                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 356                         if (dev->flags&IFF_LOOPBACK)
 357                                 neigh->type = RTN_LOCAL;
 358                 } else if (dev->flags&IFF_POINTOPOINT) {
 359                         neigh->nud_state = NUD_NOARP;
 360                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 361                 }
 362                 if (dev->header_ops->cache)
 363                         neigh->ops = &ndisc_hh_ops;
 364                 else
 365                         neigh->ops = &ndisc_generic_ops;
 366                 if (neigh->nud_state&NUD_VALID)
 367                         neigh->output = neigh->ops->connected_output;
 368                 else
 369                         neigh->output = neigh->ops->output;
 370         }
 371         in6_dev_put(in6_dev);
 372         return 0;
 373 }
 374
 375 static int pndisc_constructor(struct pneigh_entry *n)
 376 {
 377         struct in6_addr *addr = (struct in6_addr *)&n->key;
 378         struct in6_addr maddr;
 379         struct net_device *dev = n->dev;
 380
 381         if (!dev || !__in6_dev_get(dev))
 382                 return -EINVAL;
 383         addrconf_addr_solict_mult(addr, &maddr);
 384         ipv6_dev_mc_inc(dev, &maddr);
 385         return 0;
 386 }
 387
 388 static void pndisc_destructor(struct pneigh_entry *n)
 389 {
 390         struct in6_addr *addr = (struct in6_addr *)&n->key;
 391         struct in6_addr maddr;
 392         struct net_device *dev = n->dev;
 393
 394         if (!dev || !__in6_dev_get(dev))
 395                 return;
 396         addrconf_addr_solict_mult(addr, &maddr);
 397         ipv6_dev_mc_dec(dev, &maddr);
 398 }
 399
 400 /* called with rtnl held */
 401 static bool ndisc_allow_add(const struct net_device *dev,
 402                             struct netlink_ext_ack *extack)
 403 {
 404         struct inet6_dev *idev = __in6_dev_get(dev);
 405
 406         if (!idev || idev->cnf.disable_ipv6) {
 407                 NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device");
 408                 return false;
 409         }
 410
 411         return true;
 412 }
 413
 414 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 415                                        int len)
 416 {
 417         int hlen = LL_RESERVED_SPACE(dev);
 418         int tlen = dev->needed_tailroom;
 419         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 420         struct sk_buff *skb;
 421
 422         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 423         if (!skb) {
 424                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 425                           __func__);
 426                 return NULL;
 427         }
 428
 429         skb->protocol = htons(ETH_P_IPV6);
 430         skb->dev = dev;
 431
 432         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 433         skb_reset_transport_header(skb);
 434
 435         /* Manually assign socket ownership as we avoid calling
 436          * sock_alloc_send_pskb() to bypass wmem buffer limits
 437          */
 438         skb_set_owner_w(skb, sk);
 439
 440         return skb;
 441 }
 442
 443 static void ip6_nd_hdr(struct sk_buff *skb,
 444                        const struct in6_addr *saddr,
 445                        const struct in6_addr *daddr,
 446                        int hop_limit, int len)
 447 {
 448         struct ipv6hdr *hdr;
 449         struct inet6_dev *idev;
 450         unsigned tclass;
 451
 452         rcu_read_lock();
 453         idev = __in6_dev_get(skb->dev);
 454         tclass = idev ? idev->cnf.ndisc_tclass : 0;
 455         rcu_read_unlock();
 456
 457         skb_push(skb, sizeof(*hdr));
 458         skb_reset_network_header(skb);
 459         hdr = ipv6_hdr(skb);
 460
 461         ip6_flow_hdr(hdr, tclass, 0);
 462
 463         hdr->payload_len = htons(len);
 464         hdr->nexthdr = IPPROTO_ICMPV6;
 465         hdr->hop_limit = hop_limit;
 466
 467         hdr->saddr = *saddr;
 468         hdr->daddr = *daddr;
 469 }
 470
 471 void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
 472                     const struct in6_addr *saddr)
 473 {
 474         struct dst_entry *dst = skb_dst(skb);
 475         struct net *net = dev_net(skb->dev);
 476         struct sock *sk = net->ipv6.ndisc_sk;
 477         struct inet6_dev *idev;
 478         int err;
 479         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 480         u8 type;
 481
 482         type = icmp6h->icmp6_type;
 483
 484         if (!dst) {
 485                 struct flowi6 fl6;
 486                 int oif = skb->dev->ifindex;
 487
 488                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 489                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 490                 if (IS_ERR(dst)) {
 491                         kfree_skb(skb);
 492                         return;
 493                 }
 494
 495                 skb_dst_set(skb, dst);
 496         }
 497
 498         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 499                                               IPPROTO_ICMPV6,
 500                                               csum_partial(icmp6h,
 501                                                            skb->len, 0));
 502
 503         ip6_nd_hdr(skb, saddr, daddr, READ_ONCE(inet6_sk(sk)->hop_limit), skb->len);
 504
 505         rcu_read_lock();
 506         idev = __in6_dev_get(dst->dev);
 507         IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
 508
 509         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
 510                       net, sk, skb, NULL, dst->dev,
 511                       dst_output);
 512         if (!err) {
 513                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 514                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 515         }
 516
 517         rcu_read_unlock();
 518 }
 519 EXPORT_SYMBOL(ndisc_send_skb);
 520
 521 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
 522                    const struct in6_addr *solicited_addr,
 523                    bool router, bool solicited, bool override, bool inc_opt)
 524 {
 525         struct sk_buff *skb;
 526         struct in6_addr tmpaddr;
 527         struct inet6_ifaddr *ifp;
 528         const struct in6_addr *src_addr;
 529         struct nd_msg *msg;
 530         int optlen = 0;
 531
 532         /* for anycast or proxy, solicited_addr != src_addr */
 533         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 534         if (ifp) {
 535                 src_addr = solicited_addr;
 536                 if (ifp->flags & IFA_F_OPTIMISTIC)
 537                         override = false;
 538                 inc_opt |= ifp->idev->cnf.force_tllao;
 539                 in6_ifa_put(ifp);
 540         } else {
 541                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 542                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 543                                        &tmpaddr))
 544                         return;
 545                 src_addr = &tmpaddr;
 546         }
 547
 548         if (!dev->addr_len)
 549                 inc_opt = false;
 550         if (inc_opt)
 551                 optlen += ndisc_opt_addr_space(dev,
 552                                                NDISC_NEIGHBOUR_ADVERTISEMENT);
 553
 554         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 555         if (!skb)
 556                 return;
 557
 558         msg = skb_put(skb, sizeof(*msg));
 559         *msg = (struct nd_msg) {
 560                 .icmph = {
 561                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 562                         .icmp6_router = router,
 563                         .icmp6_solicited = solicited,
 564                         .icmp6_override = override,
 565                 },
 566                 .target = *solicited_addr,
 567         };
 568
 569         if (inc_opt)
 570                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 571                                        dev->dev_addr,
 572                                        NDISC_NEIGHBOUR_ADVERTISEMENT);
 573
 574         ndisc_send_skb(skb, daddr, src_addr);
 575 }
 576
 577 static void ndisc_send_unsol_na(struct net_device *dev)
 578 {
 579         struct inet6_dev *idev;
 580         struct inet6_ifaddr *ifa;
 581
 582         idev = in6_dev_get(dev);
 583         if (!idev)
 584                 return;
 585
 586         read_lock_bh(&idev->lock);
 587         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 588                 /* skip tentative addresses until dad completes */
 589                 if (ifa->flags & IFA_F_TENTATIVE &&
 590                     !(ifa->flags & IFA_F_OPTIMISTIC))
 591                         continue;
 592
 593                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
 594                               /*router=*/ !!idev->cnf.forwarding,
 595                               /*solicited=*/ false, /*override=*/ true,
 596                               /*inc_opt=*/ true);
 597         }
 598         read_unlock_bh(&idev->lock);
 599
 600         in6_dev_put(idev);
 601 }
 602
 603 struct sk_buff *ndisc_ns_create(struct net_device *dev, const struct in6_addr *solicit,
 604                                 const struct in6_addr *saddr, u64 nonce)
 605 {
 606         int inc_opt = dev->addr_len;
 607         struct sk_buff *skb;
 608         struct nd_msg *msg;
 609         int optlen = 0;
 610
 611         if (!saddr)
 612                 return NULL;
 613
 614         if (ipv6_addr_any(saddr))
 615                 inc_opt = false;
 616         if (inc_opt)
 617                 optlen += ndisc_opt_addr_space(dev,
 618                                                NDISC_NEIGHBOUR_SOLICITATION);
 619         if (nonce != 0)
 620                 optlen += 8;
 621
 622         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 623         if (!skb)
 624                 return NULL;
 625
 626         msg = skb_put(skb, sizeof(*msg));
 627         *msg = (struct nd_msg) {
 628                 .icmph = {
 629                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 630                 },
 631                 .target = *solicit,
 632         };
 633
 634         if (inc_opt)
 635                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 636                                        dev->dev_addr,
 637                                        NDISC_NEIGHBOUR_SOLICITATION);
 638         if (nonce != 0) {
 639                 u8 *opt = skb_put(skb, 8);
 640
 641                 opt[0] = ND_OPT_NONCE;
 642                 opt[1] = 8 >> 3;
 643                 memcpy(opt + 2, &nonce, 6);
 644         }
 645
 646         return skb;
 647 }
 648 EXPORT_SYMBOL(ndisc_ns_create);
 649
 650 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
 651                    const struct in6_addr *daddr, const struct in6_addr *saddr,
 652                    u64 nonce)
 653 {
 654         struct in6_addr addr_buf;
 655         struct sk_buff *skb;
 656
 657         if (!saddr) {
 658                 if (ipv6_get_lladdr(dev, &addr_buf,
 659                                     (IFA_F_TENTATIVE | IFA_F_OPTIMISTIC)))
 660                         return;
 661                 saddr = &addr_buf;
 662         }
 663
 664         skb = ndisc_ns_create(dev, solicit, saddr, nonce);
 665
 666         if (skb)
 667                 ndisc_send_skb(skb, daddr, saddr);
 668 }
 669
 670 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 671                    const struct in6_addr *daddr)
 672 {
 673         struct sk_buff *skb;
 674         struct rs_msg *msg;
 675         int send_sllao = dev->addr_len;
 676         int optlen = 0;
 677
 678 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 679         /*
 680          * According to section 2.2 of RFC 4429, we must not
 681          * send router solicitations with a sllao from
 682          * optimistic addresses, but we may send the solicitation
 683          * if we don't include the sllao.  So here we check
 684          * if our address is optimistic, and if so, we
 685          * suppress the inclusion of the sllao.
 686          */
 687         if (send_sllao) {
 688                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 689                                                            dev, 1);
 690                 if (ifp) {
 691                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 692                                 send_sllao = 0;
 693                         }
 694                         in6_ifa_put(ifp);
 695                 } else {
 696                         send_sllao = 0;
 697                 }
 698         }
 699 #endif
 700         if (send_sllao)
 701                 optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
 702
 703         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 704         if (!skb)
 705                 return;
 706
 707         msg = skb_put(skb, sizeof(*msg));
 708         *msg = (struct rs_msg) {
 709                 .icmph = {
 710                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 711                 },
 712         };
 713
 714         if (send_sllao)
 715                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 716                                        dev->dev_addr,
 717                                        NDISC_ROUTER_SOLICITATION);
 718
 719         ndisc_send_skb(skb, daddr, saddr);
 720 }
 721
 722
 723 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 724 {
 725         /*
 726          *      "The sender MUST return an ICMP
 727          *       destination unreachable"
 728          */
 729         dst_link_failure(skb);
 730         kfree_skb(skb);
 731 }
 732
 733 /* Called with locked neigh: either read or both */
 734
 735 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 736 {
 737         struct in6_addr *saddr = NULL;
 738         struct in6_addr mcaddr;
 739         struct net_device *dev = neigh->dev;
 740         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 741         int probes = atomic_read(&neigh->probes);
 742
 743         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 744                                            dev, false, 1,
 745                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 746                 saddr = &ipv6_hdr(skb)->saddr;
 747         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 748         if (probes < 0) {
 749                 if (!(READ_ONCE(neigh->nud_state) & NUD_VALID)) {
 750                         ND_PRINTK(1, dbg,
 751                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 752                                   __func__, target);
 753                 }
 754                 ndisc_send_ns(dev, target, target, saddr, 0);
 755         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 756                 neigh_app_ns(neigh);
 757         } else {
 758                 addrconf_addr_solict_mult(target, &mcaddr);
 759                 ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
 760         }
 761 }
 762
 763 static int pndisc_is_router(const void *pkey,
 764                             struct net_device *dev)
 765 {
 766         struct pneigh_entry *n;
 767         int ret = -1;
 768
 769         read_lock_bh(&nd_tbl.lock);
 770         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 771         if (n)
 772                 ret = !!(n->flags & NTF_ROUTER);
 773         read_unlock_bh(&nd_tbl.lock);
 774
 775         return ret;
 776 }
 777
 778 void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
 779                   const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
 780                   struct ndisc_options *ndopts)
 781 {
 782         neigh_update(neigh, lladdr, new, flags, 0);
 783         /* report ndisc ops about neighbour update */
 784         ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
 785 }
 786
 787 static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb)
 788 {
 789         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 790         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 791         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 792         u8 *lladdr = NULL;
 793         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 794                                     offsetof(struct nd_msg, opt));
 795         struct ndisc_options ndopts;
 796         struct net_device *dev = skb->dev;
 797         struct inet6_ifaddr *ifp;
 798         struct inet6_dev *idev = NULL;
 799         struct neighbour *neigh;
 800         int dad = ipv6_addr_any(saddr);
 801         int is_router = -1;
 802         SKB_DR(reason);
 803         u64 nonce = 0;
 804         bool inc;
 805
 806         if (skb->len < sizeof(struct nd_msg))
 807                 return SKB_DROP_REASON_PKT_TOO_SMALL;
 808
 809         if (ipv6_addr_is_multicast(&msg->target)) {
 810                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 811                 return reason;
 812         }
 813
 814         /*
 815          * RFC2461 7.1.1:
 816          * DAD has to be destined for solicited node multicast address.
 817          */
 818         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 819                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 820                 return reason;
 821         }
 822
 823         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts))
 824                 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
 825
 826         if (ndopts.nd_opts_src_lladdr) {
 827                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 828                 if (!lladdr) {
 829                         ND_PRINTK(2, warn,
 830                                   "NS: invalid link-layer address length\n");
 831                         return reason;
 832                 }
 833
 834                 /* RFC2461 7.1.1:
 835                  *      If the IP source address is the unspecified address,
 836                  *      there MUST NOT be source link-layer address option
 837                  *      in the message.
 838                  */
 839                 if (dad) {
 840                         ND_PRINTK(2, warn,
 841                                   "NS: bad DAD packet (link-layer address option)\n");
 842                         return reason;
 843                 }
 844         }
 845         if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
 846                 memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
 847
 848         inc = ipv6_addr_is_multicast(daddr);
 849
 850         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 851         if (ifp) {
 852 have_ifp:
 853                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 854                         if (dad) {
 855                                 if (nonce != 0 && ifp->dad_nonce == nonce) {
 856                                         u8 *np = (u8 *)&nonce;
 857                                         /* Matching nonce if looped back */
 858                                         ND_PRINTK(2, notice,
 859                                                   "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
 860                                                   ifp->idev->dev->name,
 861                                                   &ifp->addr, np);
 862                                         goto out;
 863                                 }
 864                                 /*
 865                                  * We are colliding with another node
 866                                  * who is doing DAD
 867                                  * so fail our DAD process
 868                                  */
 869                                 addrconf_dad_failure(skb, ifp);
 870                                 return reason;
 871                         } else {
 872                                 /*
 873                                  * This is not a dad solicitation.
 874                                  * If we are an optimistic node,
 875                                  * we should respond.
 876                                  * Otherwise, we should ignore it.
 877                                  */
 878                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 879                                         goto out;
 880                         }
 881                 }
 882
 883                 idev = ifp->idev;
 884         } else {
 885                 struct net *net = dev_net(dev);
 886
 887                 /* perhaps an address on the master device */
 888                 if (netif_is_l3_slave(dev)) {
 889                         struct net_device *mdev;
 890
 891                         mdev = netdev_master_upper_dev_get_rcu(dev);
 892                         if (mdev) {
 893                                 ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
 894                                 if (ifp)
 895                                         goto have_ifp;
 896                         }
 897                 }
 898
 899                 idev = in6_dev_get(dev);
 900                 if (!idev) {
 901                         /* XXX: count this drop? */
 902                         return reason;
 903                 }
 904
 905                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 906                     (idev->cnf.forwarding &&
 907                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 908                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 909                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 910                             skb->pkt_type != PACKET_HOST &&
 911                             inc &&
 912                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 913                                 /*
 914                                  * for anycast or proxy,
 915                                  * sender should delay its response
 916                                  * by a random time between 0 and
 917                                  * MAX_ANYCAST_DELAY_TIME seconds.
 918                                  * (RFC2461) -- yoshfuji
 919                                  */
 920                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 921                                 if (n)
 922                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 923                                 goto out;
 924                         }
 925                 } else {
 926                         SKB_DR_SET(reason, IPV6_NDISC_NS_OTHERHOST);
 927                         goto out;
 928                 }
 929         }
 930
 931         if (is_router < 0)
 932                 is_router = idev->cnf.forwarding;
 933
 934         if (dad) {
 935                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
 936                               !!is_router, false, (ifp != NULL), true);
 937                 goto out;
 938         }
 939
 940         if (inc)
 941                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 942         else
 943                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 944
 945         /*
 946          *      update / create cache entry
 947          *      for the source address
 948          */
 949         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 950                                !inc || lladdr || !dev->addr_len);
 951         if (neigh)
 952                 ndisc_update(dev, neigh, lladdr, NUD_STALE,
 953                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 954                              NEIGH_UPDATE_F_OVERRIDE,
 955                              NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
 956         if (neigh || !dev->header_ops) {
 957                 ndisc_send_na(dev, saddr, &msg->target, !!is_router,
 958                               true, (ifp != NULL && inc), inc);
 959                 if (neigh)
 960                         neigh_release(neigh);
 961                 reason = SKB_CONSUMED;
 962         }
 963
 964 out:
 965         if (ifp)
 966                 in6_ifa_put(ifp);
 967         else
 968                 in6_dev_put(idev);
 969         return reason;
 970 }
 971
 972 static int accept_untracked_na(struct net_device *dev, struct in6_addr *saddr)
 973 {
 974         struct inet6_dev *idev = __in6_dev_get(dev);
 975
 976         switch (idev->cnf.accept_untracked_na) {
 977         case 0: /* Don't accept untracked na (absent in neighbor cache) */
 978                 return 0;
 979         case 1: /* Create new entries from na if currently untracked */
 980                 return 1;
 981         case 2: /* Create new entries from untracked na only if saddr is in the
 982                  * same subnet as an address configured on the interface that
 983                  * received the na
 984                  */
 985                 return !!ipv6_chk_prefix(saddr, dev);
 986         default:
 987                 return 0;
 988         }
 989 }
 990
 991 static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb)
 992 {
 993         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 994         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 995         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 996         u8 *lladdr = NULL;
 997         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 998                                     offsetof(struct nd_msg, opt));
 999         struct ndisc_options ndopts;
1000         struct net_device *dev = skb->dev;
1001         struct inet6_dev *idev = __in6_dev_get(dev);
1002         struct inet6_ifaddr *ifp;
1003         struct neighbour *neigh;
1004         SKB_DR(reason);
1005         u8 new_state;
1006
1007         if (skb->len < sizeof(struct nd_msg))
1008                 return SKB_DROP_REASON_PKT_TOO_SMALL;
1009
1010         if (ipv6_addr_is_multicast(&msg->target)) {
1011                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
1012                 return reason;
1013         }
1014
1015         if (ipv6_addr_is_multicast(daddr) &&
1016             msg->icmph.icmp6_solicited) {
1017                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
1018                 return reason;
1019         }
1020
1021         /* For some 802.11 wireless deployments (and possibly other networks),
1022          * there will be a NA proxy and unsolicitd packets are attacks
1023          * and thus should not be accepted.
1024          * drop_unsolicited_na takes precedence over accept_untracked_na
1025          */
1026         if (!msg->icmph.icmp6_solicited && idev &&
1027             idev->cnf.drop_unsolicited_na)
1028                 return reason;
1029
1030         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts))
1031                 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1032
1033         if (ndopts.nd_opts_tgt_lladdr) {
1034                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
1035                 if (!lladdr) {
1036                         ND_PRINTK(2, warn,
1037                                   "NA: invalid link-layer address length\n");
1038                         return reason;
1039                 }
1040         }
1041         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
1042         if (ifp) {
1043                 if (skb->pkt_type != PACKET_LOOPBACK
1044                     && (ifp->flags & IFA_F_TENTATIVE)) {
1045                                 addrconf_dad_failure(skb, ifp);
1046                                 return reason;
1047                 }
1048                 /* What should we make now? The advertisement
1049                    is invalid, but ndisc specs say nothing
1050                    about it. It could be misconfiguration, or
1051                    an smart proxy agent tries to help us :-)
1052
1053                    We should not print the error if NA has been
1054                    received from loopback - it is just our own
1055                    unsolicited advertisement.
1056                  */
1057                 if (skb->pkt_type != PACKET_LOOPBACK)
1058                         ND_PRINTK(1, warn,
1059                                   "NA: %pM advertised our address %pI6c on %s!\n",
1060                                   eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1061                 in6_ifa_put(ifp);
1062                 return reason;
1063         }
1064
1065         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1066
1067         /* RFC 9131 updates original Neighbour Discovery RFC 4861.
1068          * NAs with Target LL Address option without a corresponding
1069          * entry in the neighbour cache can now create a STALE neighbour
1070          * cache entry on routers.
1071          *
1072          *   entry accept  fwding  solicited        behaviour
1073          * ------- ------  ------  ---------    ----------------------
1074          * present      X       X         0     Set state to STALE
1075          * present      X       X         1     Set state to REACHABLE
1076          *  absent      0       X         X     Do nothing
1077          *  absent      1       0         X     Do nothing
1078          *  absent      1       1         X     Add a new STALE entry
1079          *
1080          * Note that we don't do a (daddr == all-routers-mcast) check.
1081          */
1082         new_state = msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE;
1083         if (!neigh && lladdr && idev && idev->cnf.forwarding) {
1084                 if (accept_untracked_na(dev, saddr)) {
1085                         neigh = neigh_create(&nd_tbl, &msg->target, dev);
1086                         new_state = NUD_STALE;
1087                 }
1088         }
1089
1090         if (neigh && !IS_ERR(neigh)) {
1091                 u8 old_flags = neigh->flags;
1092                 struct net *net = dev_net(dev);
1093
1094                 if (READ_ONCE(neigh->nud_state) & NUD_FAILED)
1095                         goto out;
1096
1097                 /*
1098                  * Don't update the neighbor cache entry on a proxy NA from
1099                  * ourselves because either the proxied node is off link or it
1100                  * has already sent a NA to us.
1101                  */
1102                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1103                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1104                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1105                         /* XXX: idev->cnf.proxy_ndp */
1106                         goto out;
1107                 }
1108
1109                 ndisc_update(dev, neigh, lladdr,
1110                              new_state,
1111                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1112                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1113                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1114                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1115                              NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1116
1117                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1118                         /*
1119                          * Change: router to host
1120                          */
1121                         rt6_clean_tohost(dev_net(dev),  saddr);
1122                 }
1123                 reason = SKB_CONSUMED;
1124 out:
1125                 neigh_release(neigh);
1126         }
1127         return reason;
1128 }
1129
1130 static enum skb_drop_reason ndisc_recv_rs(struct sk_buff *skb)
1131 {
1132         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1133         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1134         struct neighbour *neigh;
1135         struct inet6_dev *idev;
1136         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1137         struct ndisc_options ndopts;
1138         u8 *lladdr = NULL;
1139         SKB_DR(reason);
1140
1141         if (skb->len < sizeof(*rs_msg))
1142                 return SKB_DROP_REASON_PKT_TOO_SMALL;
1143
1144         idev = __in6_dev_get(skb->dev);
1145         if (!idev) {
1146                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
1147                 return reason;
1148         }
1149
1150         /* Don't accept RS if we're not in router mode */
1151         if (!idev->cnf.forwarding)
1152                 goto out;
1153
1154         /*
1155          * Don't update NCE if src = ::;
1156          * this implies that the source node has no ip address assigned yet.
1157          */
1158         if (ipv6_addr_any(saddr))
1159                 goto out;
1160
1161         /* Parse ND options */
1162         if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts))
1163                 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1164
1165         if (ndopts.nd_opts_src_lladdr) {
1166                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1167                                              skb->dev);
1168                 if (!lladdr)
1169                         goto out;
1170         }
1171
1172         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1173         if (neigh) {
1174                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1175                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1176                              NEIGH_UPDATE_F_OVERRIDE|
1177                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1178                              NDISC_ROUTER_SOLICITATION, &ndopts);
1179                 neigh_release(neigh);
1180                 reason = SKB_CONSUMED;
1181         }
1182 out:
1183         return reason;
1184 }
1185
1186 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1187 {
1188         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1189         struct sk_buff *skb;
1190         struct nlmsghdr *nlh;
1191         struct nduseroptmsg *ndmsg;
1192         struct net *net = dev_net(ra->dev);
1193         int err;
1194         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1195                                     + (opt->nd_opt_len << 3));
1196         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1197
1198         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1199         if (!skb) {
1200                 err = -ENOBUFS;
1201                 goto errout;
1202         }
1203
1204         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1205         if (!nlh) {
1206                 goto nla_put_failure;
1207         }
1208
1209         ndmsg = nlmsg_data(nlh);
1210         ndmsg->nduseropt_family = AF_INET6;
1211         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1212         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1213         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1214         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1215
1216         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1217
1218         if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1219                 goto nla_put_failure;
1220         nlmsg_end(skb, nlh);
1221
1222         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1223         return;
1224
1225 nla_put_failure:
1226         nlmsg_free(skb);
1227         err = -EMSGSIZE;
1228 errout:
1229         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1230 }
1231
1232 static enum skb_drop_reason ndisc_router_discovery(struct sk_buff *skb)
1233 {
1234         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1235         bool send_ifinfo_notify = false;
1236         struct neighbour *neigh = NULL;
1237         struct ndisc_options ndopts;
1238         struct fib6_info *rt = NULL;
1239         struct inet6_dev *in6_dev;
1240         struct fib6_table *table;
1241         u32 defrtr_usr_metric;
1242         unsigned int pref = 0;
1243         __u32 old_if_flags;
1244         struct net *net;
1245         SKB_DR(reason);
1246         int lifetime;
1247         int optlen;
1248
1249         __u8 *opt = (__u8 *)(ra_msg + 1);
1250
1251         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1252                 sizeof(struct ra_msg);
1253
1254         ND_PRINTK(2, info,
1255                   "RA: %s, dev: %s\n",
1256                   __func__, skb->dev->name);
1257         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1258                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1259                 return reason;
1260         }
1261         if (optlen < 0)
1262                 return SKB_DROP_REASON_PKT_TOO_SMALL;
1263
1264 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1265         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1266                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1267                 return reason;
1268         }
1269 #endif
1270
1271         in6_dev = __in6_dev_get(skb->dev);
1272         if (!in6_dev) {
1273                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1274                           skb->dev->name);
1275                 return reason;
1276         }
1277
1278         if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts))
1279                 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1280
1281         if (!ipv6_accept_ra(in6_dev)) {
1282                 ND_PRINTK(2, info,
1283                           "RA: %s, did not accept ra for dev: %s\n",
1284                           __func__, skb->dev->name);
1285                 goto skip_linkparms;
1286         }
1287
1288 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1289         /* skip link-specific parameters from interior routers */
1290         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1291                 ND_PRINTK(2, info,
1292                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1293                           __func__, skb->dev->name);
1294                 goto skip_linkparms;
1295         }
1296 #endif
1297
1298         if (in6_dev->if_flags & IF_RS_SENT) {
1299                 /*
1300                  *      flag that an RA was received after an RS was sent
1301                  *      out on this interface.
1302                  */
1303                 in6_dev->if_flags |= IF_RA_RCVD;
1304         }
1305
1306         /*
1307          * Remember the managed/otherconf flags from most recently
1308          * received RA message (RFC 2462) -- yoshfuji
1309          */
1310         old_if_flags = in6_dev->if_flags;
1311         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1312                                 IF_RA_OTHERCONF)) |
1313                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1314                                         IF_RA_MANAGED : 0) |
1315                                 (ra_msg->icmph.icmp6_addrconf_other ?
1316                                         IF_RA_OTHERCONF : 0);
1317
1318         if (old_if_flags != in6_dev->if_flags)
1319                 send_ifinfo_notify = true;
1320
1321         if (!in6_dev->cnf.accept_ra_defrtr) {
1322                 ND_PRINTK(2, info,
1323                           "RA: %s, defrtr is false for dev: %s\n",
1324                           __func__, skb->dev->name);
1325                 goto skip_defrtr;
1326         }
1327
1328         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1329         if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_lft) {
1330                 ND_PRINTK(2, info,
1331                           "RA: router lifetime (%ds) is too short: %s\n",
1332                           lifetime, skb->dev->name);
1333                 goto skip_defrtr;
1334         }
1335
1336         /* Do not accept RA with source-addr found on local machine unless
1337          * accept_ra_from_local is set to true.
1338          */
1339         net = dev_net(in6_dev->dev);
1340         if (!in6_dev->cnf.accept_ra_from_local &&
1341             ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) {
1342                 ND_PRINTK(2, info,
1343                           "RA from local address detected on dev: %s: default router ignored\n",
1344                           skb->dev->name);
1345                 goto skip_defrtr;
1346         }
1347
1348 #ifdef CONFIG_IPV6_ROUTER_PREF
1349         pref = ra_msg->icmph.icmp6_router_pref;
1350         /* 10b is handled as if it were 00b (medium) */
1351         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1352             !in6_dev->cnf.accept_ra_rtr_pref)
1353                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1354 #endif
1355         /* routes added from RAs do not use nexthop objects */
1356         rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev);
1357         if (rt) {
1358                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1359                                          rt->fib6_nh->fib_nh_dev, NULL,
1360                                           &ipv6_hdr(skb)->saddr);
1361                 if (!neigh) {
1362                         ND_PRINTK(0, err,
1363                                   "RA: %s got default router without neighbour\n",
1364                                   __func__);
1365                         fib6_info_release(rt);
1366                         return reason;
1367                 }
1368         }
1369         /* Set default route metric as specified by user */
1370         defrtr_usr_metric = in6_dev->cnf.ra_defrtr_metric;
1371         /* delete the route if lifetime is 0 or if metric needs change */
1372         if (rt && (lifetime == 0 || rt->fib6_metric != defrtr_usr_metric)) {
1373                 ip6_del_rt(net, rt, false);
1374                 rt = NULL;
1375         }
1376
1377         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, metric: %d, for dev: %s\n",
1378                   rt, lifetime, defrtr_usr_metric, skb->dev->name);
1379         if (!rt && lifetime) {
1380                 ND_PRINTK(3, info, "RA: adding default router\n");
1381
1382                 if (neigh)
1383                         neigh_release(neigh);
1384
1385                 rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
1386                                          skb->dev, pref, defrtr_usr_metric,
1387                                          lifetime);
1388                 if (!rt) {
1389                         ND_PRINTK(0, err,
1390                                   "RA: %s failed to add default route\n",
1391                                   __func__);
1392                         return reason;
1393                 }
1394
1395                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1396                                          rt->fib6_nh->fib_nh_dev, NULL,
1397                                           &ipv6_hdr(skb)->saddr);
1398                 if (!neigh) {
1399                         ND_PRINTK(0, err,
1400                                   "RA: %s got default router without neighbour\n",
1401                                   __func__);
1402                         fib6_info_release(rt);
1403                         return reason;
1404                 }
1405                 neigh->flags |= NTF_ROUTER;
1406         } else if (rt && IPV6_EXTRACT_PREF(rt->fib6_flags) != pref) {
1407                 struct nl_info nlinfo = {
1408                         .nl_net = net,
1409                 };
1410                 rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1411                 inet6_rt_notify(RTM_NEWROUTE, rt, &nlinfo, NLM_F_REPLACE);
1412         }
1413
1414         if (rt) {
1415                 table = rt->fib6_table;
1416                 spin_lock_bh(&table->tb6_lock);
1417
1418                 fib6_set_expires(rt, jiffies + (HZ * lifetime));
1419                 fib6_add_gc_list(rt);
1420
1421                 spin_unlock_bh(&table->tb6_lock);
1422         }
1423         if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1424             ra_msg->icmph.icmp6_hop_limit) {
1425                 if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1426                         in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1427                         fib6_metric_set(rt, RTAX_HOPLIMIT,
1428                                         ra_msg->icmph.icmp6_hop_limit);
1429                 } else {
1430                         ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1431                 }
1432         }
1433
1434 skip_defrtr:
1435
1436         /*
1437          *      Update Reachable Time and Retrans Timer
1438          */
1439
1440         if (in6_dev->nd_parms) {
1441                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1442
1443                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1444                         rtime = (rtime*HZ)/1000;
1445                         if (rtime < HZ/100)
1446                                 rtime = HZ/100;
1447                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1448                         in6_dev->tstamp = jiffies;
1449                         send_ifinfo_notify = true;
1450                 }
1451
1452                 rtime = ntohl(ra_msg->reachable_time);
1453                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1454                         rtime = (rtime*HZ)/1000;
1455
1456                         if (rtime < HZ/10)
1457                                 rtime = HZ/10;
1458
1459                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1460                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1461                                               BASE_REACHABLE_TIME, rtime);
1462                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1463                                               GC_STALETIME, 3 * rtime);
1464                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1465                                 in6_dev->tstamp = jiffies;
1466                                 send_ifinfo_notify = true;
1467                         }
1468                 }
1469         }
1470
1471 skip_linkparms:
1472
1473         /*
1474          *      Process options.
1475          */
1476
1477         if (!neigh)
1478                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1479                                        skb->dev, 1);
1480         if (neigh) {
1481                 u8 *lladdr = NULL;
1482                 if (ndopts.nd_opts_src_lladdr) {
1483                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1484                                                      skb->dev);
1485                         if (!lladdr) {
1486                                 ND_PRINTK(2, warn,
1487                                           "RA: invalid link-layer address length\n");
1488                                 goto out;
1489                         }
1490                 }
1491                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1492                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1493                              NEIGH_UPDATE_F_OVERRIDE|
1494                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1495                              NEIGH_UPDATE_F_ISROUTER,
1496                              NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1497                 reason = SKB_CONSUMED;
1498         }
1499
1500         if (!ipv6_accept_ra(in6_dev)) {
1501                 ND_PRINTK(2, info,
1502                           "RA: %s, accept_ra is false for dev: %s\n",
1503                           __func__, skb->dev->name);
1504                 goto out;
1505         }
1506
1507 #ifdef CONFIG_IPV6_ROUTE_INFO
1508         if (!in6_dev->cnf.accept_ra_from_local &&
1509             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1510                           in6_dev->dev, 0)) {
1511                 ND_PRINTK(2, info,
1512                           "RA from local address detected on dev: %s: router info ignored.\n",
1513                           skb->dev->name);
1514                 goto skip_routeinfo;
1515         }
1516
1517         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1518                 struct nd_opt_hdr *p;
1519                 for (p = ndopts.nd_opts_ri;
1520                      p;
1521                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1522                         struct route_info *ri = (struct route_info *)p;
1523 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1524                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1525                             ri->prefix_len == 0)
1526                                 continue;
1527 #endif
1528                         if (ri->prefix_len == 0 &&
1529                             !in6_dev->cnf.accept_ra_defrtr)
1530                                 continue;
1531                         if (ri->lifetime != 0 &&
1532                             ntohl(ri->lifetime) < in6_dev->cnf.accept_ra_min_lft)
1533                                 continue;
1534                         if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1535                                 continue;
1536                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1537                                 continue;
1538                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1539                                       &ipv6_hdr(skb)->saddr);
1540                 }
1541         }
1542
1543 skip_routeinfo:
1544 #endif
1545
1546 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1547         /* skip link-specific ndopts from interior routers */
1548         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1549                 ND_PRINTK(2, info,
1550                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1551                           __func__, skb->dev->name);
1552                 goto out;
1553         }
1554 #endif
1555
1556         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1557                 struct nd_opt_hdr *p;
1558                 for (p = ndopts.nd_opts_pi;
1559                      p;
1560                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1561                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1562                                             (p->nd_opt_len) << 3,
1563                                             ndopts.nd_opts_src_lladdr != NULL);
1564                 }
1565         }
1566
1567         if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1568                 __be32 n;
1569                 u32 mtu;
1570
1571                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1572                 mtu = ntohl(n);
1573
1574                 if (in6_dev->ra_mtu != mtu) {
1575                         in6_dev->ra_mtu = mtu;
1576                         send_ifinfo_notify = true;
1577                 }
1578
1579                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1580                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1581                 } else if (in6_dev->cnf.mtu6 != mtu) {
1582                         in6_dev->cnf.mtu6 = mtu;
1583                         fib6_metric_set(rt, RTAX_MTU, mtu);
1584                         rt6_mtu_change(skb->dev, mtu);
1585                 }
1586         }
1587
1588         if (ndopts.nd_useropts) {
1589                 struct nd_opt_hdr *p;
1590                 for (p = ndopts.nd_useropts;
1591                      p;
1592                      p = ndisc_next_useropt(skb->dev, p,
1593                                             ndopts.nd_useropts_end)) {
1594                         ndisc_ra_useropt(skb, p);
1595                 }
1596         }
1597
1598         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1599                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1600         }
1601 out:
1602         /* Send a notify if RA changed managed/otherconf flags or
1603          * timer settings or ra_mtu value
1604          */
1605         if (send_ifinfo_notify)
1606                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1607
1608         fib6_info_release(rt);
1609         if (neigh)
1610                 neigh_release(neigh);
1611         return reason;
1612 }
1613
1614 static enum skb_drop_reason ndisc_redirect_rcv(struct sk_buff *skb)
1615 {
1616         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1617         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1618                                     offsetof(struct rd_msg, opt));
1619         struct ndisc_options ndopts;
1620         SKB_DR(reason);
1621         u8 *hdr;
1622
1623 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1624         switch (skb->ndisc_nodetype) {
1625         case NDISC_NODETYPE_HOST:
1626         case NDISC_NODETYPE_NODEFAULT:
1627                 ND_PRINTK(2, warn,
1628                           "Redirect: from host or unauthorized router\n");
1629                 return reason;
1630         }
1631 #endif
1632
1633         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1634                 ND_PRINTK(2, warn,
1635                           "Redirect: source address is not link-local\n");
1636                 return reason;
1637         }
1638
1639         if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1640                 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1641
1642         if (!ndopts.nd_opts_rh) {
1643                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1644                                         skb->dev->ifindex);
1645                 return reason;
1646         }
1647
1648         hdr = (u8 *)ndopts.nd_opts_rh;
1649         hdr += 8;
1650         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1651                 return SKB_DROP_REASON_PKT_TOO_SMALL;
1652
1653         return icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1654 }
1655
1656 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1657                                            struct sk_buff *orig_skb,
1658                                            int rd_len)
1659 {
1660         u8 *opt = skb_put(skb, rd_len);
1661
1662         memset(opt, 0, 8);
1663         *(opt++) = ND_OPT_REDIRECT_HDR;
1664         *(opt++) = (rd_len >> 3);
1665         opt += 6;
1666
1667         skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1668                       rd_len - 8);
1669 }
1670
1671 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1672 {
1673         struct net_device *dev = skb->dev;
1674         struct net *net = dev_net(dev);
1675         struct sock *sk = net->ipv6.ndisc_sk;
1676         int optlen = 0;
1677         struct inet_peer *peer;
1678         struct sk_buff *buff;
1679         struct rd_msg *msg;
1680         struct in6_addr saddr_buf;
1681         struct rt6_info *rt;
1682         struct dst_entry *dst;
1683         struct flowi6 fl6;
1684         int rd_len;
1685         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1686            ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1687         bool ret;
1688
1689         if (netif_is_l3_master(skb->dev)) {
1690                 dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
1691                 if (!dev)
1692                         return;
1693         }
1694
1695         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1696                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1697                           dev->name);
1698                 return;
1699         }
1700
1701         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1702             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1703                 ND_PRINTK(2, warn,
1704                           "Redirect: target address is not link-local unicast\n");
1705                 return;
1706         }
1707
1708         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1709                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1710
1711         dst = ip6_route_output(net, NULL, &fl6);
1712         if (dst->error) {
1713                 dst_release(dst);
1714                 return;
1715         }
1716         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1717         if (IS_ERR(dst))
1718                 return;
1719
1720         rt = (struct rt6_info *) dst;
1721
1722         if (rt->rt6i_flags & RTF_GATEWAY) {
1723                 ND_PRINTK(2, warn,
1724                           "Redirect: destination is not a neighbour\n");
1725                 goto release;
1726         }
1727         peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1728         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1729         if (peer)
1730                 inet_putpeer(peer);
1731         if (!ret)
1732                 goto release;
1733
1734         if (dev->addr_len) {
1735                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1736                 if (!neigh) {
1737                         ND_PRINTK(2, warn,
1738                                   "Redirect: no neigh for target address\n");
1739                         goto release;
1740                 }
1741
1742                 read_lock_bh(&neigh->lock);
1743                 if (neigh->nud_state & NUD_VALID) {
1744                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1745                         read_unlock_bh(&neigh->lock);
1746                         ha = ha_buf;
1747                         optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1748                                                                 ops_data_buf,
1749                                                                 &ops_data);
1750                 } else
1751                         read_unlock_bh(&neigh->lock);
1752
1753                 neigh_release(neigh);
1754         }
1755
1756         rd_len = min_t(unsigned int,
1757                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1758                        skb->len + 8);
1759         rd_len &= ~0x7;
1760         optlen += rd_len;
1761
1762         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1763         if (!buff)
1764                 goto release;
1765
1766         msg = skb_put(buff, sizeof(*msg));
1767         *msg = (struct rd_msg) {
1768                 .icmph = {
1769                         .icmp6_type = NDISC_REDIRECT,
1770                 },
1771                 .target = *target,
1772                 .dest = ipv6_hdr(skb)->daddr,
1773         };
1774
1775         /*
1776          *      include target_address option
1777          */
1778
1779         if (ha)
1780                 ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1781
1782         /*
1783          *      build redirect option and copy skb over to the new packet.
1784          */
1785
1786         if (rd_len)
1787                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1788
1789         skb_dst_set(buff, dst);
1790         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1791         return;
1792
1793 release:
1794         dst_release(dst);
1795 }
1796
1797 static void pndisc_redo(struct sk_buff *skb)
1798 {
1799         enum skb_drop_reason reason = ndisc_recv_ns(skb);
1800
1801         kfree_skb_reason(skb, reason);
1802 }
1803
1804 static int ndisc_is_multicast(const void *pkey)
1805 {
1806         return ipv6_addr_is_multicast((struct in6_addr *)pkey);
1807 }
1808
1809 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1810 {
1811         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1812
1813         if (!idev)
1814                 return true;
1815         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1816             idev->cnf.suppress_frag_ndisc) {
1817                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1818                 return true;
1819         }
1820         return false;
1821 }
1822
1823 enum skb_drop_reason ndisc_rcv(struct sk_buff *skb)
1824 {
1825         struct nd_msg *msg;
1826         SKB_DR(reason);
1827
1828         if (ndisc_suppress_frag_ndisc(skb))
1829                 return SKB_DROP_REASON_IPV6_NDISC_FRAG;
1830
1831         if (skb_linearize(skb))
1832                 return SKB_DROP_REASON_NOMEM;
1833
1834         msg = (struct nd_msg *)skb_transport_header(skb);
1835
1836         __skb_push(skb, skb->data - skb_transport_header(skb));
1837
1838         if (ipv6_hdr(skb)->hop_limit != 255) {
1839                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1840                           ipv6_hdr(skb)->hop_limit);
1841                 return SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT;
1842         }
1843
1844         if (msg->icmph.icmp6_code != 0) {
1845                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1846                           msg->icmph.icmp6_code);
1847                 return SKB_DROP_REASON_IPV6_NDISC_BAD_CODE;
1848         }
1849
1850         switch (msg->icmph.icmp6_type) {
1851         case NDISC_NEIGHBOUR_SOLICITATION:
1852                 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1853                 reason = ndisc_recv_ns(skb);
1854                 break;
1855
1856         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1857                 reason = ndisc_recv_na(skb);
1858                 break;
1859
1860         case NDISC_ROUTER_SOLICITATION:
1861                 reason = ndisc_recv_rs(skb);
1862                 break;
1863
1864         case NDISC_ROUTER_ADVERTISEMENT:
1865                 reason = ndisc_router_discovery(skb);
1866                 break;
1867
1868         case NDISC_REDIRECT:
1869                 reason = ndisc_redirect_rcv(skb);
1870                 break;
1871         }
1872
1873         return reason;
1874 }
1875
1876 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1877 {
1878         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1879         struct netdev_notifier_change_info *change_info;
1880         struct net *net = dev_net(dev);
1881         struct inet6_dev *idev;
1882         bool evict_nocarrier;
1883
1884         switch (event) {
1885         case NETDEV_CHANGEADDR:
1886                 neigh_changeaddr(&nd_tbl, dev);
1887                 fib6_run_gc(0, net, false);
1888                 fallthrough;
1889         case NETDEV_UP:
1890                 idev = in6_dev_get(dev);
1891                 if (!idev)
1892                         break;
1893                 if (idev->cnf.ndisc_notify ||
1894                     net->ipv6.devconf_all->ndisc_notify)
1895                         ndisc_send_unsol_na(dev);
1896                 in6_dev_put(idev);
1897                 break;
1898         case NETDEV_CHANGE:
1899                 idev = in6_dev_get(dev);
1900                 if (!idev)
1901                         evict_nocarrier = true;
1902                 else {
1903                         evict_nocarrier = idev->cnf.ndisc_evict_nocarrier &&
1904                                           net->ipv6.devconf_all->ndisc_evict_nocarrier;
1905                         in6_dev_put(idev);
1906                 }
1907
1908                 change_info = ptr;
1909                 if (change_info->flags_changed & IFF_NOARP)
1910                         neigh_changeaddr(&nd_tbl, dev);
1911                 if (evict_nocarrier && !netif_carrier_ok(dev))
1912                         neigh_carrier_down(&nd_tbl, dev);
1913                 break;
1914         case NETDEV_DOWN:
1915                 neigh_ifdown(&nd_tbl, dev);
1916                 fib6_run_gc(0, net, false);
1917                 break;
1918         case NETDEV_NOTIFY_PEERS:
1919                 ndisc_send_unsol_na(dev);
1920                 break;
1921         default:
1922                 break;
1923         }
1924
1925         return NOTIFY_DONE;
1926 }
1927
1928 static struct notifier_block ndisc_netdev_notifier = {
1929         .notifier_call = ndisc_netdev_event,
1930         .priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1931 };
1932
1933 #ifdef CONFIG_SYSCTL
1934 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1935                                          const char *func, const char *dev_name)
1936 {
1937         static char warncomm[TASK_COMM_LEN];
1938         static int warned;
1939         if (strcmp(warncomm, current->comm) && warned < 5) {
1940                 strcpy(warncomm, current->comm);
1941                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1942                         warncomm, func,
1943                         dev_name, ctl->procname,
1944                         dev_name, ctl->procname);
1945                 warned++;
1946         }
1947 }
1948
1949 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void *buffer,
1950                 size_t *lenp, loff_t *ppos)
1951 {
1952         struct net_device *dev = ctl->extra1;
1953         struct inet6_dev *idev;
1954         int ret;
1955
1956         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1957             (strcmp(ctl->procname, "base_reachable_time") == 0))
1958                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1959
1960         if (strcmp(ctl->procname, "retrans_time") == 0)
1961                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1962
1963         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1964                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1965                                                   buffer, lenp, ppos);
1966
1967         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1968                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1969                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1970                                                      buffer, lenp, ppos);
1971         else
1972                 ret = -1;
1973
1974         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1975                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1976                         idev->nd_parms->reachable_time =
1977                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1978                 WRITE_ONCE(idev->tstamp, jiffies);
1979                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1980                 in6_dev_put(idev);
1981         }
1982         return ret;
1983 }
1984
1985
1986 #endif
1987
1988 static int __net_init ndisc_net_init(struct net *net)
1989 {
1990         struct ipv6_pinfo *np;
1991         struct sock *sk;
1992         int err;
1993
1994         err = inet_ctl_sock_create(&sk, PF_INET6,
1995                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1996         if (err < 0) {
1997                 ND_PRINTK(0, err,
1998                           "NDISC: Failed to initialize the control socket (err %d)\n",
1999                           err);
2000                 return err;
2001         }
2002
2003         net->ipv6.ndisc_sk = sk;
2004
2005         np = inet6_sk(sk);
2006         np->hop_limit = 255;
2007         /* Do not loopback ndisc messages */
2008         inet6_clear_bit(MC6_LOOP, sk);
2009
2010         return 0;
2011 }
2012
2013 static void __net_exit ndisc_net_exit(struct net *net)
2014 {
2015         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
2016 }
2017
2018 static struct pernet_operations ndisc_net_ops = {
2019         .init = ndisc_net_init,
2020         .exit = ndisc_net_exit,
2021 };
2022
2023 int __init ndisc_init(void)
2024 {
2025         int err;
2026
2027         err = register_pernet_subsys(&ndisc_net_ops);
2028         if (err)
2029                 return err;
2030         /*
2031          * Initialize the neighbour table
2032          */
2033         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
2034
2035 #ifdef CONFIG_SYSCTL
2036         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
2037                                     ndisc_ifinfo_sysctl_change);
2038         if (err)
2039                 goto out_unregister_pernet;
2040 out:
2041 #endif
2042         return err;
2043
2044 #ifdef CONFIG_SYSCTL
2045 out_unregister_pernet:
2046         unregister_pernet_subsys(&ndisc_net_ops);
2047         goto out;
2048 #endif
2049 }
2050
2051 int __init ndisc_late_init(void)
2052 {
2053         return register_netdevice_notifier(&ndisc_netdev_notifier);
2054 }
2055
2056 void ndisc_late_cleanup(void)
2057 {
2058         unregister_netdevice_notifier(&ndisc_netdev_notifier);
2059 }
2060
2061 void ndisc_cleanup(void)
2062 {
2063 #ifdef CONFIG_SYSCTL
2064         neigh_sysctl_unregister(&nd_tbl.parms);
2065 #endif
2066         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
2067         unregister_pernet_subsys(&ndisc_net_ops);
2068 }