net/ipv6/ndisc.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Neighbour Discovery for IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Mike Shaver             <shaver@ingenia.com>
   9  */
  10
  11 /*
  12  *      Changes:
  13  *
  14  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  15  *      Pierre Ynard                    :       export userland ND options
  16  *                                              through netlink (RDNSS support)
  17  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  18  *                                              of an RA.
  19  *      Janos Farkas                    :       kmalloc failure checks
  20  *      Alexey Kuznetsov                :       state machine reworked
  21  *                                              and moved to net/core.
  22  *      Pekka Savola                    :       RFC2461 validation
  23  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  24  */
  25
  26 #define pr_fmt(fmt) "ICMPv6: " fmt
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/sched.h>
  34 #include <linux/net.h>
  35 #include <linux/in6.h>
  36 #include <linux/route.h>
  37 #include <linux/init.h>
  38 #include <linux/rcupdate.h>
  39 #include <linux/slab.h>
  40 #ifdef CONFIG_SYSCTL
  41 #include <linux/sysctl.h>
  42 #endif
  43
  44 #include <linux/if_addr.h>
  45 #include <linux/if_ether.h>
  46 #include <linux/if_arp.h>
  47 #include <linux/ipv6.h>
  48 #include <linux/icmpv6.h>
  49 #include <linux/jhash.h>
  50
  51 #include <net/sock.h>
  52 #include <net/snmp.h>
  53
  54 #include <net/ipv6.h>
  55 #include <net/protocol.h>
  56 #include <net/ndisc.h>
  57 #include <net/ip6_route.h>
  58 #include <net/addrconf.h>
  59 #include <net/icmp.h>
  60
  61 #include <net/netlink.h>
  62 #include <linux/rtnetlink.h>
  63
  64 #include <net/flow.h>
  65 #include <net/ip6_checksum.h>
  66 #include <net/inet_common.h>
  67 #include <linux/proc_fs.h>
  68
  69 #include <linux/netfilter.h>
  70 #include <linux/netfilter_ipv6.h>
  71
  72 static u32 ndisc_hash(const void *pkey,
  73                       const struct net_device *dev,
  74                       __u32 *hash_rnd);
  75 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
  76 static bool ndisc_allow_add(const struct net_device *dev,
  77                             struct netlink_ext_ack *extack);
  78 static int ndisc_constructor(struct neighbour *neigh);
  79 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  80 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  81 static int pndisc_constructor(struct pneigh_entry *n);
  82 static void pndisc_destructor(struct pneigh_entry *n);
  83 static void pndisc_redo(struct sk_buff *skb);
  84 static int ndisc_is_multicast(const void *pkey);
  85
  86 static const struct neigh_ops ndisc_generic_ops = {
  87         .family =               AF_INET6,
  88         .solicit =              ndisc_solicit,
  89         .error_report =         ndisc_error_report,
  90         .output =               neigh_resolve_output,
  91         .connected_output =     neigh_connected_output,
  92 };
  93
  94 static const struct neigh_ops ndisc_hh_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_resolve_output,
 100 };
 101
 102
 103 static const struct neigh_ops ndisc_direct_ops = {
 104         .family =               AF_INET6,
 105         .output =               neigh_direct_output,
 106         .connected_output =     neigh_direct_output,
 107 };
 108
 109 struct neigh_table nd_tbl = {
 110         .family =       AF_INET6,
 111         .key_len =      sizeof(struct in6_addr),
 112         .protocol =     cpu_to_be16(ETH_P_IPV6),
 113         .hash =         ndisc_hash,
 114         .key_eq =       ndisc_key_eq,
 115         .constructor =  ndisc_constructor,
 116         .pconstructor = pndisc_constructor,
 117         .pdestructor =  pndisc_destructor,
 118         .proxy_redo =   pndisc_redo,
 119         .is_multicast = ndisc_is_multicast,
 120         .allow_add  =   ndisc_allow_add,
 121         .id =           "ndisc_cache",
 122         .parms = {
 123                 .tbl                    = &nd_tbl,
 124                 .reachable_time         = ND_REACHABLE_TIME,
 125                 .data = {
 126                         [NEIGH_VAR_MCAST_PROBES] = 3,
 127                         [NEIGH_VAR_UCAST_PROBES] = 3,
 128                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 129                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 130                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 131                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 132                         [NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
 133                         [NEIGH_VAR_PROXY_QLEN] = 64,
 134                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 135                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 136                 },
 137         },
 138         .gc_interval =    30 * HZ,
 139         .gc_thresh1 =    128,
 140         .gc_thresh2 =    512,
 141         .gc_thresh3 =   1024,
 142 };
 143 EXPORT_SYMBOL_GPL(nd_tbl);
 144
 145 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data,
 146                               int data_len, int pad)
 147 {
 148         int space = __ndisc_opt_addr_space(data_len, pad);
 149         u8 *opt = skb_put(skb, space);
 150
 151         opt[0] = type;
 152         opt[1] = space>>3;
 153
 154         memset(opt + 2, 0, pad);
 155         opt   += pad;
 156         space -= pad;
 157
 158         memcpy(opt+2, data, data_len);
 159         data_len += 2;
 160         opt += data_len;
 161         space -= data_len;
 162         if (space > 0)
 163                 memset(opt, 0, space);
 164 }
 165 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
 166
 167 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
 168                                           void *data, u8 icmp6_type)
 169 {
 170         __ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
 171                                  ndisc_addr_option_pad(skb->dev->type));
 172         ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
 173 }
 174
 175 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
 176                                                    void *ha,
 177                                                    const u8 *ops_data)
 178 {
 179         ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
 180         ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
 181 }
 182
 183 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 184                                             struct nd_opt_hdr *end)
 185 {
 186         int type;
 187         if (!cur || !end || cur >= end)
 188                 return NULL;
 189         type = cur->nd_opt_type;
 190         do {
 191                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 192         } while (cur < end && cur->nd_opt_type != type);
 193         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 194 }
 195
 196 static inline int ndisc_is_useropt(const struct net_device *dev,
 197                                    struct nd_opt_hdr *opt)
 198 {
 199         return opt->nd_opt_type == ND_OPT_RDNSS ||
 200                 opt->nd_opt_type == ND_OPT_DNSSL ||
 201                 opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
 202                 opt->nd_opt_type == ND_OPT_PREF64 ||
 203                 ndisc_ops_is_useropt(dev, opt->nd_opt_type);
 204 }
 205
 206 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
 207                                              struct nd_opt_hdr *cur,
 208                                              struct nd_opt_hdr *end)
 209 {
 210         if (!cur || !end || cur >= end)
 211                 return NULL;
 212         do {
 213                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 214         } while (cur < end && !ndisc_is_useropt(dev, cur));
 215         return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
 216 }
 217
 218 struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 219                                           u8 *opt, int opt_len,
 220                                           struct ndisc_options *ndopts)
 221 {
 222         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 223
 224         if (!nd_opt || opt_len < 0 || !ndopts)
 225                 return NULL;
 226         memset(ndopts, 0, sizeof(*ndopts));
 227         while (opt_len) {
 228                 int l;
 229                 if (opt_len < sizeof(struct nd_opt_hdr))
 230                         return NULL;
 231                 l = nd_opt->nd_opt_len << 3;
 232                 if (opt_len < l || l == 0)
 233                         return NULL;
 234                 if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
 235                         goto next_opt;
 236                 switch (nd_opt->nd_opt_type) {
 237                 case ND_OPT_SOURCE_LL_ADDR:
 238                 case ND_OPT_TARGET_LL_ADDR:
 239                 case ND_OPT_MTU:
 240                 case ND_OPT_NONCE:
 241                 case ND_OPT_REDIRECT_HDR:
 242                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 243                                 ND_PRINTK(2, warn,
 244                                           "%s: duplicated ND6 option found: type=%d\n",
 245                                           __func__, nd_opt->nd_opt_type);
 246                         } else {
 247                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 248                         }
 249                         break;
 250                 case ND_OPT_PREFIX_INFO:
 251                         ndopts->nd_opts_pi_end = nd_opt;
 252                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 253                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 254                         break;
 255 #ifdef CONFIG_IPV6_ROUTE_INFO
 256                 case ND_OPT_ROUTE_INFO:
 257                         ndopts->nd_opts_ri_end = nd_opt;
 258                         if (!ndopts->nd_opts_ri)
 259                                 ndopts->nd_opts_ri = nd_opt;
 260                         break;
 261 #endif
 262                 default:
 263                         if (ndisc_is_useropt(dev, nd_opt)) {
 264                                 ndopts->nd_useropts_end = nd_opt;
 265                                 if (!ndopts->nd_useropts)
 266                                         ndopts->nd_useropts = nd_opt;
 267                         } else {
 268                                 /*
 269                                  * Unknown options must be silently ignored,
 270                                  * to accommodate future extension to the
 271                                  * protocol.
 272                                  */
 273                                 ND_PRINTK(2, notice,
 274                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 275                                           __func__,
 276                                           nd_opt->nd_opt_type,
 277                                           nd_opt->nd_opt_len);
 278                         }
 279                 }
 280 next_opt:
 281                 opt_len -= l;
 282                 nd_opt = ((void *)nd_opt) + l;
 283         }
 284         return ndopts;
 285 }
 286
 287 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 288 {
 289         switch (dev->type) {
 290         case ARPHRD_ETHER:
 291         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 292         case ARPHRD_FDDI:
 293                 ipv6_eth_mc_map(addr, buf);
 294                 return 0;
 295         case ARPHRD_ARCNET:
 296                 ipv6_arcnet_mc_map(addr, buf);
 297                 return 0;
 298         case ARPHRD_INFINIBAND:
 299                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 300                 return 0;
 301         case ARPHRD_IPGRE:
 302                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 303         default:
 304                 if (dir) {
 305                         memcpy(buf, dev->broadcast, dev->addr_len);
 306                         return 0;
 307                 }
 308         }
 309         return -EINVAL;
 310 }
 311 EXPORT_SYMBOL(ndisc_mc_map);
 312
 313 static u32 ndisc_hash(const void *pkey,
 314                       const struct net_device *dev,
 315                       __u32 *hash_rnd)
 316 {
 317         return ndisc_hashfn(pkey, dev, hash_rnd);
 318 }
 319
 320 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
 321 {
 322         return neigh_key_eq128(n, pkey);
 323 }
 324
 325 static int ndisc_constructor(struct neighbour *neigh)
 326 {
 327         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 328         struct net_device *dev = neigh->dev;
 329         struct inet6_dev *in6_dev;
 330         struct neigh_parms *parms;
 331         bool is_multicast = ipv6_addr_is_multicast(addr);
 332
 333         in6_dev = in6_dev_get(dev);
 334         if (!in6_dev) {
 335                 return -EINVAL;
 336         }
 337
 338         parms = in6_dev->nd_parms;
 339         __neigh_parms_put(neigh->parms);
 340         neigh->parms = neigh_parms_clone(parms);
 341
 342         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 343         if (!dev->header_ops) {
 344                 neigh->nud_state = NUD_NOARP;
 345                 neigh->ops = &ndisc_direct_ops;
 346                 neigh->output = neigh_direct_output;
 347         } else {
 348                 if (is_multicast) {
 349                         neigh->nud_state = NUD_NOARP;
 350                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 351                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 352                         neigh->nud_state = NUD_NOARP;
 353                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 354                         if (dev->flags&IFF_LOOPBACK)
 355                                 neigh->type = RTN_LOCAL;
 356                 } else if (dev->flags&IFF_POINTOPOINT) {
 357                         neigh->nud_state = NUD_NOARP;
 358                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 359                 }
 360                 if (dev->header_ops->cache)
 361                         neigh->ops = &ndisc_hh_ops;
 362                 else
 363                         neigh->ops = &ndisc_generic_ops;
 364                 if (neigh->nud_state&NUD_VALID)
 365                         neigh->output = neigh->ops->connected_output;
 366                 else
 367                         neigh->output = neigh->ops->output;
 368         }
 369         in6_dev_put(in6_dev);
 370         return 0;
 371 }
 372
 373 static int pndisc_constructor(struct pneigh_entry *n)
 374 {
 375         struct in6_addr *addr = (struct in6_addr *)&n->key;
 376         struct in6_addr maddr;
 377         struct net_device *dev = n->dev;
 378
 379         if (!dev || !__in6_dev_get(dev))
 380                 return -EINVAL;
 381         addrconf_addr_solict_mult(addr, &maddr);
 382         ipv6_dev_mc_inc(dev, &maddr);
 383         return 0;
 384 }
 385
 386 static void pndisc_destructor(struct pneigh_entry *n)
 387 {
 388         struct in6_addr *addr = (struct in6_addr *)&n->key;
 389         struct in6_addr maddr;
 390         struct net_device *dev = n->dev;
 391
 392         if (!dev || !__in6_dev_get(dev))
 393                 return;
 394         addrconf_addr_solict_mult(addr, &maddr);
 395         ipv6_dev_mc_dec(dev, &maddr);
 396 }
 397
 398 /* called with rtnl held */
 399 static bool ndisc_allow_add(const struct net_device *dev,
 400                             struct netlink_ext_ack *extack)
 401 {
 402         struct inet6_dev *idev = __in6_dev_get(dev);
 403
 404         if (!idev || idev->cnf.disable_ipv6) {
 405                 NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device");
 406                 return false;
 407         }
 408
 409         return true;
 410 }
 411
 412 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 413                                        int len)
 414 {
 415         int hlen = LL_RESERVED_SPACE(dev);
 416         int tlen = dev->needed_tailroom;
 417         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 418         struct sk_buff *skb;
 419
 420         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 421         if (!skb) {
 422                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 423                           __func__);
 424                 return NULL;
 425         }
 426
 427         skb->protocol = htons(ETH_P_IPV6);
 428         skb->dev = dev;
 429
 430         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 431         skb_reset_transport_header(skb);
 432
 433         /* Manually assign socket ownership as we avoid calling
 434          * sock_alloc_send_pskb() to bypass wmem buffer limits
 435          */
 436         skb_set_owner_w(skb, sk);
 437
 438         return skb;
 439 }
 440
 441 static void ip6_nd_hdr(struct sk_buff *skb,
 442                        const struct in6_addr *saddr,
 443                        const struct in6_addr *daddr,
 444                        int hop_limit, int len)
 445 {
 446         struct ipv6hdr *hdr;
 447         struct inet6_dev *idev;
 448         unsigned tclass;
 449
 450         rcu_read_lock();
 451         idev = __in6_dev_get(skb->dev);
 452         tclass = idev ? idev->cnf.ndisc_tclass : 0;
 453         rcu_read_unlock();
 454
 455         skb_push(skb, sizeof(*hdr));
 456         skb_reset_network_header(skb);
 457         hdr = ipv6_hdr(skb);
 458
 459         ip6_flow_hdr(hdr, tclass, 0);
 460
 461         hdr->payload_len = htons(len);
 462         hdr->nexthdr = IPPROTO_ICMPV6;
 463         hdr->hop_limit = hop_limit;
 464
 465         hdr->saddr = *saddr;
 466         hdr->daddr = *daddr;
 467 }
 468
 469 static void ndisc_send_skb(struct sk_buff *skb,
 470                            const struct in6_addr *daddr,
 471                            const struct in6_addr *saddr)
 472 {
 473         struct dst_entry *dst = skb_dst(skb);
 474         struct net *net = dev_net(skb->dev);
 475         struct sock *sk = net->ipv6.ndisc_sk;
 476         struct inet6_dev *idev;
 477         int err;
 478         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 479         u8 type;
 480
 481         type = icmp6h->icmp6_type;
 482
 483         if (!dst) {
 484                 struct flowi6 fl6;
 485                 int oif = skb->dev->ifindex;
 486
 487                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 488                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 489                 if (IS_ERR(dst)) {
 490                         kfree_skb(skb);
 491                         return;
 492                 }
 493
 494                 skb_dst_set(skb, dst);
 495         }
 496
 497         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 498                                               IPPROTO_ICMPV6,
 499                                               csum_partial(icmp6h,
 500                                                            skb->len, 0));
 501
 502         ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
 503
 504         rcu_read_lock();
 505         idev = __in6_dev_get(dst->dev);
 506         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 507
 508         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
 509                       net, sk, skb, NULL, dst->dev,
 510                       dst_output);
 511         if (!err) {
 512                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 513                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 514         }
 515
 516         rcu_read_unlock();
 517 }
 518
 519 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
 520                    const struct in6_addr *solicited_addr,
 521                    bool router, bool solicited, bool override, bool inc_opt)
 522 {
 523         struct sk_buff *skb;
 524         struct in6_addr tmpaddr;
 525         struct inet6_ifaddr *ifp;
 526         const struct in6_addr *src_addr;
 527         struct nd_msg *msg;
 528         int optlen = 0;
 529
 530         /* for anycast or proxy, solicited_addr != src_addr */
 531         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 532         if (ifp) {
 533                 src_addr = solicited_addr;
 534                 if (ifp->flags & IFA_F_OPTIMISTIC)
 535                         override = false;
 536                 inc_opt |= ifp->idev->cnf.force_tllao;
 537                 in6_ifa_put(ifp);
 538         } else {
 539                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 540                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 541                                        &tmpaddr))
 542                         return;
 543                 src_addr = &tmpaddr;
 544         }
 545
 546         if (!dev->addr_len)
 547                 inc_opt = false;
 548         if (inc_opt)
 549                 optlen += ndisc_opt_addr_space(dev,
 550                                                NDISC_NEIGHBOUR_ADVERTISEMENT);
 551
 552         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 553         if (!skb)
 554                 return;
 555
 556         msg = skb_put(skb, sizeof(*msg));
 557         *msg = (struct nd_msg) {
 558                 .icmph = {
 559                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 560                         .icmp6_router = router,
 561                         .icmp6_solicited = solicited,
 562                         .icmp6_override = override,
 563                 },
 564                 .target = *solicited_addr,
 565         };
 566
 567         if (inc_opt)
 568                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 569                                        dev->dev_addr,
 570                                        NDISC_NEIGHBOUR_ADVERTISEMENT);
 571
 572         ndisc_send_skb(skb, daddr, src_addr);
 573 }
 574
 575 static void ndisc_send_unsol_na(struct net_device *dev)
 576 {
 577         struct inet6_dev *idev;
 578         struct inet6_ifaddr *ifa;
 579
 580         idev = in6_dev_get(dev);
 581         if (!idev)
 582                 return;
 583
 584         read_lock_bh(&idev->lock);
 585         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 586                 /* skip tentative addresses until dad completes */
 587                 if (ifa->flags & IFA_F_TENTATIVE &&
 588                     !(ifa->flags & IFA_F_OPTIMISTIC))
 589                         continue;
 590
 591                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
 592                               /*router=*/ !!idev->cnf.forwarding,
 593                               /*solicited=*/ false, /*override=*/ true,
 594                               /*inc_opt=*/ true);
 595         }
 596         read_unlock_bh(&idev->lock);
 597
 598         in6_dev_put(idev);
 599 }
 600
 601 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
 602                    const struct in6_addr *daddr, const struct in6_addr *saddr,
 603                    u64 nonce)
 604 {
 605         struct sk_buff *skb;
 606         struct in6_addr addr_buf;
 607         int inc_opt = dev->addr_len;
 608         int optlen = 0;
 609         struct nd_msg *msg;
 610
 611         if (!saddr) {
 612                 if (ipv6_get_lladdr(dev, &addr_buf,
 613                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 614                         return;
 615                 saddr = &addr_buf;
 616         }
 617
 618         if (ipv6_addr_any(saddr))
 619                 inc_opt = false;
 620         if (inc_opt)
 621                 optlen += ndisc_opt_addr_space(dev,
 622                                                NDISC_NEIGHBOUR_SOLICITATION);
 623         if (nonce != 0)
 624                 optlen += 8;
 625
 626         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 627         if (!skb)
 628                 return;
 629
 630         msg = skb_put(skb, sizeof(*msg));
 631         *msg = (struct nd_msg) {
 632                 .icmph = {
 633                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 634                 },
 635                 .target = *solicit,
 636         };
 637
 638         if (inc_opt)
 639                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 640                                        dev->dev_addr,
 641                                        NDISC_NEIGHBOUR_SOLICITATION);
 642         if (nonce != 0) {
 643                 u8 *opt = skb_put(skb, 8);
 644
 645                 opt[0] = ND_OPT_NONCE;
 646                 opt[1] = 8 >> 3;
 647                 memcpy(opt + 2, &nonce, 6);
 648         }
 649
 650         ndisc_send_skb(skb, daddr, saddr);
 651 }
 652
 653 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 654                    const struct in6_addr *daddr)
 655 {
 656         struct sk_buff *skb;
 657         struct rs_msg *msg;
 658         int send_sllao = dev->addr_len;
 659         int optlen = 0;
 660
 661 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 662         /*
 663          * According to section 2.2 of RFC 4429, we must not
 664          * send router solicitations with a sllao from
 665          * optimistic addresses, but we may send the solicitation
 666          * if we don't include the sllao.  So here we check
 667          * if our address is optimistic, and if so, we
 668          * suppress the inclusion of the sllao.
 669          */
 670         if (send_sllao) {
 671                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 672                                                            dev, 1);
 673                 if (ifp) {
 674                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 675                                 send_sllao = 0;
 676                         }
 677                         in6_ifa_put(ifp);
 678                 } else {
 679                         send_sllao = 0;
 680                 }
 681         }
 682 #endif
 683         if (send_sllao)
 684                 optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
 685
 686         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 687         if (!skb)
 688                 return;
 689
 690         msg = skb_put(skb, sizeof(*msg));
 691         *msg = (struct rs_msg) {
 692                 .icmph = {
 693                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 694                 },
 695         };
 696
 697         if (send_sllao)
 698                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 699                                        dev->dev_addr,
 700                                        NDISC_ROUTER_SOLICITATION);
 701
 702         ndisc_send_skb(skb, daddr, saddr);
 703 }
 704
 705
 706 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 707 {
 708         /*
 709          *      "The sender MUST return an ICMP
 710          *       destination unreachable"
 711          */
 712         dst_link_failure(skb);
 713         kfree_skb(skb);
 714 }
 715
 716 /* Called with locked neigh: either read or both */
 717
 718 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 719 {
 720         struct in6_addr *saddr = NULL;
 721         struct in6_addr mcaddr;
 722         struct net_device *dev = neigh->dev;
 723         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 724         int probes = atomic_read(&neigh->probes);
 725
 726         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 727                                            dev, false, 1,
 728                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 729                 saddr = &ipv6_hdr(skb)->saddr;
 730         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 731         if (probes < 0) {
 732                 if (!(neigh->nud_state & NUD_VALID)) {
 733                         ND_PRINTK(1, dbg,
 734                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 735                                   __func__, target);
 736                 }
 737                 ndisc_send_ns(dev, target, target, saddr, 0);
 738         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 739                 neigh_app_ns(neigh);
 740         } else {
 741                 addrconf_addr_solict_mult(target, &mcaddr);
 742                 ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
 743         }
 744 }
 745
 746 static int pndisc_is_router(const void *pkey,
 747                             struct net_device *dev)
 748 {
 749         struct pneigh_entry *n;
 750         int ret = -1;
 751
 752         read_lock_bh(&nd_tbl.lock);
 753         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 754         if (n)
 755                 ret = !!(n->flags & NTF_ROUTER);
 756         read_unlock_bh(&nd_tbl.lock);
 757
 758         return ret;
 759 }
 760
 761 void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
 762                   const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
 763                   struct ndisc_options *ndopts)
 764 {
 765         neigh_update(neigh, lladdr, new, flags, 0);
 766         /* report ndisc ops about neighbour update */
 767         ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
 768 }
 769
 770 static void ndisc_recv_ns(struct sk_buff *skb)
 771 {
 772         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 773         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 774         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 775         u8 *lladdr = NULL;
 776         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 777                                     offsetof(struct nd_msg, opt));
 778         struct ndisc_options ndopts;
 779         struct net_device *dev = skb->dev;
 780         struct inet6_ifaddr *ifp;
 781         struct inet6_dev *idev = NULL;
 782         struct neighbour *neigh;
 783         int dad = ipv6_addr_any(saddr);
 784         bool inc;
 785         int is_router = -1;
 786         u64 nonce = 0;
 787
 788         if (skb->len < sizeof(struct nd_msg)) {
 789                 ND_PRINTK(2, warn, "NS: packet too short\n");
 790                 return;
 791         }
 792
 793         if (ipv6_addr_is_multicast(&msg->target)) {
 794                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 795                 return;
 796         }
 797
 798         /*
 799          * RFC2461 7.1.1:
 800          * DAD has to be destined for solicited node multicast address.
 801          */
 802         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 803                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 804                 return;
 805         }
 806
 807         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 808                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 809                 return;
 810         }
 811
 812         if (ndopts.nd_opts_src_lladdr) {
 813                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 814                 if (!lladdr) {
 815                         ND_PRINTK(2, warn,
 816                                   "NS: invalid link-layer address length\n");
 817                         return;
 818                 }
 819
 820                 /* RFC2461 7.1.1:
 821                  *      If the IP source address is the unspecified address,
 822                  *      there MUST NOT be source link-layer address option
 823                  *      in the message.
 824                  */
 825                 if (dad) {
 826                         ND_PRINTK(2, warn,
 827                                   "NS: bad DAD packet (link-layer address option)\n");
 828                         return;
 829                 }
 830         }
 831         if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
 832                 memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
 833
 834         inc = ipv6_addr_is_multicast(daddr);
 835
 836         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 837         if (ifp) {
 838 have_ifp:
 839                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 840                         if (dad) {
 841                                 if (nonce != 0 && ifp->dad_nonce == nonce) {
 842                                         u8 *np = (u8 *)&nonce;
 843                                         /* Matching nonce if looped back */
 844                                         ND_PRINTK(2, notice,
 845                                                   "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
 846                                                   ifp->idev->dev->name,
 847                                                   &ifp->addr, np);
 848                                         goto out;
 849                                 }
 850                                 /*
 851                                  * We are colliding with another node
 852                                  * who is doing DAD
 853                                  * so fail our DAD process
 854                                  */
 855                                 addrconf_dad_failure(skb, ifp);
 856                                 return;
 857                         } else {
 858                                 /*
 859                                  * This is not a dad solicitation.
 860                                  * If we are an optimistic node,
 861                                  * we should respond.
 862                                  * Otherwise, we should ignore it.
 863                                  */
 864                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 865                                         goto out;
 866                         }
 867                 }
 868
 869                 idev = ifp->idev;
 870         } else {
 871                 struct net *net = dev_net(dev);
 872
 873                 /* perhaps an address on the master device */
 874                 if (netif_is_l3_slave(dev)) {
 875                         struct net_device *mdev;
 876
 877                         mdev = netdev_master_upper_dev_get_rcu(dev);
 878                         if (mdev) {
 879                                 ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
 880                                 if (ifp)
 881                                         goto have_ifp;
 882                         }
 883                 }
 884
 885                 idev = in6_dev_get(dev);
 886                 if (!idev) {
 887                         /* XXX: count this drop? */
 888                         return;
 889                 }
 890
 891                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 892                     (idev->cnf.forwarding &&
 893                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 894                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 895                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 896                             skb->pkt_type != PACKET_HOST &&
 897                             inc &&
 898                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 899                                 /*
 900                                  * for anycast or proxy,
 901                                  * sender should delay its response
 902                                  * by a random time between 0 and
 903                                  * MAX_ANYCAST_DELAY_TIME seconds.
 904                                  * (RFC2461) -- yoshfuji
 905                                  */
 906                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 907                                 if (n)
 908                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 909                                 goto out;
 910                         }
 911                 } else
 912                         goto out;
 913         }
 914
 915         if (is_router < 0)
 916                 is_router = idev->cnf.forwarding;
 917
 918         if (dad) {
 919                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
 920                               !!is_router, false, (ifp != NULL), true);
 921                 goto out;
 922         }
 923
 924         if (inc)
 925                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 926         else
 927                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 928
 929         /*
 930          *      update / create cache entry
 931          *      for the source address
 932          */
 933         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 934                                !inc || lladdr || !dev->addr_len);
 935         if (neigh)
 936                 ndisc_update(dev, neigh, lladdr, NUD_STALE,
 937                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 938                              NEIGH_UPDATE_F_OVERRIDE,
 939                              NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
 940         if (neigh || !dev->header_ops) {
 941                 ndisc_send_na(dev, saddr, &msg->target, !!is_router,
 942                               true, (ifp != NULL && inc), inc);
 943                 if (neigh)
 944                         neigh_release(neigh);
 945         }
 946
 947 out:
 948         if (ifp)
 949                 in6_ifa_put(ifp);
 950         else
 951                 in6_dev_put(idev);
 952 }
 953
 954 static void ndisc_recv_na(struct sk_buff *skb)
 955 {
 956         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 957         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 958         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 959         u8 *lladdr = NULL;
 960         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 961                                     offsetof(struct nd_msg, opt));
 962         struct ndisc_options ndopts;
 963         struct net_device *dev = skb->dev;
 964         struct inet6_dev *idev = __in6_dev_get(dev);
 965         struct inet6_ifaddr *ifp;
 966         struct neighbour *neigh;
 967
 968         if (skb->len < sizeof(struct nd_msg)) {
 969                 ND_PRINTK(2, warn, "NA: packet too short\n");
 970                 return;
 971         }
 972
 973         if (ipv6_addr_is_multicast(&msg->target)) {
 974                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 975                 return;
 976         }
 977
 978         if (ipv6_addr_is_multicast(daddr) &&
 979             msg->icmph.icmp6_solicited) {
 980                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 981                 return;
 982         }
 983
 984         /* For some 802.11 wireless deployments (and possibly other networks),
 985          * there will be a NA proxy and unsolicitd packets are attacks
 986          * and thus should not be accepted.
 987          */
 988         if (!msg->icmph.icmp6_solicited && idev &&
 989             idev->cnf.drop_unsolicited_na)
 990                 return;
 991
 992         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
 993                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 994                 return;
 995         }
 996         if (ndopts.nd_opts_tgt_lladdr) {
 997                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 998                 if (!lladdr) {
 999                         ND_PRINTK(2, warn,
1000                                   "NA: invalid link-layer address length\n");
1001                         return;
1002                 }
1003         }
1004         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
1005         if (ifp) {
1006                 if (skb->pkt_type != PACKET_LOOPBACK
1007                     && (ifp->flags & IFA_F_TENTATIVE)) {
1008                                 addrconf_dad_failure(skb, ifp);
1009                                 return;
1010                 }
1011                 /* What should we make now? The advertisement
1012                    is invalid, but ndisc specs say nothing
1013                    about it. It could be misconfiguration, or
1014                    an smart proxy agent tries to help us :-)
1015
1016                    We should not print the error if NA has been
1017                    received from loopback - it is just our own
1018                    unsolicited advertisement.
1019                  */
1020                 if (skb->pkt_type != PACKET_LOOPBACK)
1021                         ND_PRINTK(1, warn,
1022                                   "NA: %pM advertised our address %pI6c on %s!\n",
1023                                   eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1024                 in6_ifa_put(ifp);
1025                 return;
1026         }
1027         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1028
1029         if (neigh) {
1030                 u8 old_flags = neigh->flags;
1031                 struct net *net = dev_net(dev);
1032
1033                 if (neigh->nud_state & NUD_FAILED)
1034                         goto out;
1035
1036                 /*
1037                  * Don't update the neighbor cache entry on a proxy NA from
1038                  * ourselves because either the proxied node is off link or it
1039                  * has already sent a NA to us.
1040                  */
1041                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1042                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1043                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1044                         /* XXX: idev->cnf.proxy_ndp */
1045                         goto out;
1046                 }
1047
1048                 ndisc_update(dev, neigh, lladdr,
1049                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
1050                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1051                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1052                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1053                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1054                              NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1055
1056                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1057                         /*
1058                          * Change: router to host
1059                          */
1060                         rt6_clean_tohost(dev_net(dev),  saddr);
1061                 }
1062
1063 out:
1064                 neigh_release(neigh);
1065         }
1066 }
1067
1068 static void ndisc_recv_rs(struct sk_buff *skb)
1069 {
1070         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1071         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1072         struct neighbour *neigh;
1073         struct inet6_dev *idev;
1074         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1075         struct ndisc_options ndopts;
1076         u8 *lladdr = NULL;
1077
1078         if (skb->len < sizeof(*rs_msg))
1079                 return;
1080
1081         idev = __in6_dev_get(skb->dev);
1082         if (!idev) {
1083                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
1084                 return;
1085         }
1086
1087         /* Don't accept RS if we're not in router mode */
1088         if (!idev->cnf.forwarding)
1089                 goto out;
1090
1091         /*
1092          * Don't update NCE if src = ::;
1093          * this implies that the source node has no ip address assigned yet.
1094          */
1095         if (ipv6_addr_any(saddr))
1096                 goto out;
1097
1098         /* Parse ND options */
1099         if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts)) {
1100                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
1101                 goto out;
1102         }
1103
1104         if (ndopts.nd_opts_src_lladdr) {
1105                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1106                                              skb->dev);
1107                 if (!lladdr)
1108                         goto out;
1109         }
1110
1111         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1112         if (neigh) {
1113                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1114                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1115                              NEIGH_UPDATE_F_OVERRIDE|
1116                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1117                              NDISC_ROUTER_SOLICITATION, &ndopts);
1118                 neigh_release(neigh);
1119         }
1120 out:
1121         return;
1122 }
1123
1124 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1125 {
1126         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1127         struct sk_buff *skb;
1128         struct nlmsghdr *nlh;
1129         struct nduseroptmsg *ndmsg;
1130         struct net *net = dev_net(ra->dev);
1131         int err;
1132         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1133                                     + (opt->nd_opt_len << 3));
1134         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1135
1136         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1137         if (!skb) {
1138                 err = -ENOBUFS;
1139                 goto errout;
1140         }
1141
1142         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1143         if (!nlh) {
1144                 goto nla_put_failure;
1145         }
1146
1147         ndmsg = nlmsg_data(nlh);
1148         ndmsg->nduseropt_family = AF_INET6;
1149         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1150         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1151         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1152         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1153
1154         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1155
1156         if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1157                 goto nla_put_failure;
1158         nlmsg_end(skb, nlh);
1159
1160         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1161         return;
1162
1163 nla_put_failure:
1164         nlmsg_free(skb);
1165         err = -EMSGSIZE;
1166 errout:
1167         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1168 }
1169
1170 static void ndisc_router_discovery(struct sk_buff *skb)
1171 {
1172         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1173         struct neighbour *neigh = NULL;
1174         struct inet6_dev *in6_dev;
1175         struct fib6_info *rt = NULL;
1176         u32 defrtr_usr_metric;
1177         struct net *net;
1178         int lifetime;
1179         struct ndisc_options ndopts;
1180         int optlen;
1181         unsigned int pref = 0;
1182         __u32 old_if_flags;
1183         bool send_ifinfo_notify = false;
1184
1185         __u8 *opt = (__u8 *)(ra_msg + 1);
1186
1187         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1188                 sizeof(struct ra_msg);
1189
1190         ND_PRINTK(2, info,
1191                   "RA: %s, dev: %s\n",
1192                   __func__, skb->dev->name);
1193         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1194                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1195                 return;
1196         }
1197         if (optlen < 0) {
1198                 ND_PRINTK(2, warn, "RA: packet too short\n");
1199                 return;
1200         }
1201
1202 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1203         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1204                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1205                 return;
1206         }
1207 #endif
1208
1209         /*
1210          *      set the RA_RECV flag in the interface
1211          */
1212
1213         in6_dev = __in6_dev_get(skb->dev);
1214         if (!in6_dev) {
1215                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1216                           skb->dev->name);
1217                 return;
1218         }
1219
1220         if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts)) {
1221                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1222                 return;
1223         }
1224
1225         if (!ipv6_accept_ra(in6_dev)) {
1226                 ND_PRINTK(2, info,
1227                           "RA: %s, did not accept ra for dev: %s\n",
1228                           __func__, skb->dev->name);
1229                 goto skip_linkparms;
1230         }
1231
1232 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1233         /* skip link-specific parameters from interior routers */
1234         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1235                 ND_PRINTK(2, info,
1236                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1237                           __func__, skb->dev->name);
1238                 goto skip_linkparms;
1239         }
1240 #endif
1241
1242         if (in6_dev->if_flags & IF_RS_SENT) {
1243                 /*
1244                  *      flag that an RA was received after an RS was sent
1245                  *      out on this interface.
1246                  */
1247                 in6_dev->if_flags |= IF_RA_RCVD;
1248         }
1249
1250         /*
1251          * Remember the managed/otherconf flags from most recently
1252          * received RA message (RFC 2462) -- yoshfuji
1253          */
1254         old_if_flags = in6_dev->if_flags;
1255         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1256                                 IF_RA_OTHERCONF)) |
1257                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1258                                         IF_RA_MANAGED : 0) |
1259                                 (ra_msg->icmph.icmp6_addrconf_other ?
1260                                         IF_RA_OTHERCONF : 0);
1261
1262         if (old_if_flags != in6_dev->if_flags)
1263                 send_ifinfo_notify = true;
1264
1265         if (!in6_dev->cnf.accept_ra_defrtr) {
1266                 ND_PRINTK(2, info,
1267                           "RA: %s, defrtr is false for dev: %s\n",
1268                           __func__, skb->dev->name);
1269                 goto skip_defrtr;
1270         }
1271
1272         /* Do not accept RA with source-addr found on local machine unless
1273          * accept_ra_from_local is set to true.
1274          */
1275         net = dev_net(in6_dev->dev);
1276         if (!in6_dev->cnf.accept_ra_from_local &&
1277             ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) {
1278                 ND_PRINTK(2, info,
1279                           "RA from local address detected on dev: %s: default router ignored\n",
1280                           skb->dev->name);
1281                 goto skip_defrtr;
1282         }
1283
1284         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1285
1286 #ifdef CONFIG_IPV6_ROUTER_PREF
1287         pref = ra_msg->icmph.icmp6_router_pref;
1288         /* 10b is handled as if it were 00b (medium) */
1289         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1290             !in6_dev->cnf.accept_ra_rtr_pref)
1291                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1292 #endif
1293         /* routes added from RAs do not use nexthop objects */
1294         rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev);
1295         if (rt) {
1296                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1297                                          rt->fib6_nh->fib_nh_dev, NULL,
1298                                           &ipv6_hdr(skb)->saddr);
1299                 if (!neigh) {
1300                         ND_PRINTK(0, err,
1301                                   "RA: %s got default router without neighbour\n",
1302                                   __func__);
1303                         fib6_info_release(rt);
1304                         return;
1305                 }
1306         }
1307         /* Set default route metric as specified by user */
1308         defrtr_usr_metric = in6_dev->cnf.ra_defrtr_metric;
1309         /* delete the route if lifetime is 0 or if metric needs change */
1310         if (rt && (lifetime == 0 || rt->fib6_metric != defrtr_usr_metric)) {
1311                 ip6_del_rt(net, rt, false);
1312                 rt = NULL;
1313         }
1314
1315         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, metric: %d, for dev: %s\n",
1316                   rt, lifetime, defrtr_usr_metric, skb->dev->name);
1317         if (!rt && lifetime) {
1318                 ND_PRINTK(3, info, "RA: adding default router\n");
1319
1320                 if (neigh)
1321                         neigh_release(neigh);
1322
1323                 rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
1324                                          skb->dev, pref, defrtr_usr_metric);
1325                 if (!rt) {
1326                         ND_PRINTK(0, err,
1327                                   "RA: %s failed to add default route\n",
1328                                   __func__);
1329                         return;
1330                 }
1331
1332                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1333                                          rt->fib6_nh->fib_nh_dev, NULL,
1334                                           &ipv6_hdr(skb)->saddr);
1335                 if (!neigh) {
1336                         ND_PRINTK(0, err,
1337                                   "RA: %s got default router without neighbour\n",
1338                                   __func__);
1339                         fib6_info_release(rt);
1340                         return;
1341                 }
1342                 neigh->flags |= NTF_ROUTER;
1343         } else if (rt) {
1344                 rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1345         }
1346
1347         if (rt)
1348                 fib6_set_expires(rt, jiffies + (HZ * lifetime));
1349         if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1350             ra_msg->icmph.icmp6_hop_limit) {
1351                 if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1352                         in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1353                         fib6_metric_set(rt, RTAX_HOPLIMIT,
1354                                         ra_msg->icmph.icmp6_hop_limit);
1355                 } else {
1356                         ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1357                 }
1358         }
1359
1360 skip_defrtr:
1361
1362         /*
1363          *      Update Reachable Time and Retrans Timer
1364          */
1365
1366         if (in6_dev->nd_parms) {
1367                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1368
1369                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1370                         rtime = (rtime*HZ)/1000;
1371                         if (rtime < HZ/100)
1372                                 rtime = HZ/100;
1373                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1374                         in6_dev->tstamp = jiffies;
1375                         send_ifinfo_notify = true;
1376                 }
1377
1378                 rtime = ntohl(ra_msg->reachable_time);
1379                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1380                         rtime = (rtime*HZ)/1000;
1381
1382                         if (rtime < HZ/10)
1383                                 rtime = HZ/10;
1384
1385                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1386                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1387                                               BASE_REACHABLE_TIME, rtime);
1388                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1389                                               GC_STALETIME, 3 * rtime);
1390                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1391                                 in6_dev->tstamp = jiffies;
1392                                 send_ifinfo_notify = true;
1393                         }
1394                 }
1395         }
1396
1397 skip_linkparms:
1398
1399         /*
1400          *      Process options.
1401          */
1402
1403         if (!neigh)
1404                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1405                                        skb->dev, 1);
1406         if (neigh) {
1407                 u8 *lladdr = NULL;
1408                 if (ndopts.nd_opts_src_lladdr) {
1409                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1410                                                      skb->dev);
1411                         if (!lladdr) {
1412                                 ND_PRINTK(2, warn,
1413                                           "RA: invalid link-layer address length\n");
1414                                 goto out;
1415                         }
1416                 }
1417                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1418                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1419                              NEIGH_UPDATE_F_OVERRIDE|
1420                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1421                              NEIGH_UPDATE_F_ISROUTER,
1422                              NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1423         }
1424
1425         if (!ipv6_accept_ra(in6_dev)) {
1426                 ND_PRINTK(2, info,
1427                           "RA: %s, accept_ra is false for dev: %s\n",
1428                           __func__, skb->dev->name);
1429                 goto out;
1430         }
1431
1432 #ifdef CONFIG_IPV6_ROUTE_INFO
1433         if (!in6_dev->cnf.accept_ra_from_local &&
1434             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1435                           in6_dev->dev, 0)) {
1436                 ND_PRINTK(2, info,
1437                           "RA from local address detected on dev: %s: router info ignored.\n",
1438                           skb->dev->name);
1439                 goto skip_routeinfo;
1440         }
1441
1442         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1443                 struct nd_opt_hdr *p;
1444                 for (p = ndopts.nd_opts_ri;
1445                      p;
1446                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1447                         struct route_info *ri = (struct route_info *)p;
1448 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1449                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1450                             ri->prefix_len == 0)
1451                                 continue;
1452 #endif
1453                         if (ri->prefix_len == 0 &&
1454                             !in6_dev->cnf.accept_ra_defrtr)
1455                                 continue;
1456                         if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1457                                 continue;
1458                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1459                                 continue;
1460                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1461                                       &ipv6_hdr(skb)->saddr);
1462                 }
1463         }
1464
1465 skip_routeinfo:
1466 #endif
1467
1468 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1469         /* skip link-specific ndopts from interior routers */
1470         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1471                 ND_PRINTK(2, info,
1472                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1473                           __func__, skb->dev->name);
1474                 goto out;
1475         }
1476 #endif
1477
1478         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1479                 struct nd_opt_hdr *p;
1480                 for (p = ndopts.nd_opts_pi;
1481                      p;
1482                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1483                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1484                                             (p->nd_opt_len) << 3,
1485                                             ndopts.nd_opts_src_lladdr != NULL);
1486                 }
1487         }
1488
1489         if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1490                 __be32 n;
1491                 u32 mtu;
1492
1493                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1494                 mtu = ntohl(n);
1495
1496                 if (in6_dev->ra_mtu != mtu) {
1497                         in6_dev->ra_mtu = mtu;
1498                         send_ifinfo_notify = true;
1499                 }
1500
1501                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1502                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1503                 } else if (in6_dev->cnf.mtu6 != mtu) {
1504                         in6_dev->cnf.mtu6 = mtu;
1505                         fib6_metric_set(rt, RTAX_MTU, mtu);
1506                         rt6_mtu_change(skb->dev, mtu);
1507                 }
1508         }
1509
1510         if (ndopts.nd_useropts) {
1511                 struct nd_opt_hdr *p;
1512                 for (p = ndopts.nd_useropts;
1513                      p;
1514                      p = ndisc_next_useropt(skb->dev, p,
1515                                             ndopts.nd_useropts_end)) {
1516                         ndisc_ra_useropt(skb, p);
1517                 }
1518         }
1519
1520         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1521                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1522         }
1523 out:
1524         /* Send a notify if RA changed managed/otherconf flags or
1525          * timer settings or ra_mtu value
1526          */
1527         if (send_ifinfo_notify)
1528                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1529
1530         fib6_info_release(rt);
1531         if (neigh)
1532                 neigh_release(neigh);
1533 }
1534
1535 static void ndisc_redirect_rcv(struct sk_buff *skb)
1536 {
1537         u8 *hdr;
1538         struct ndisc_options ndopts;
1539         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1540         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1541                                     offsetof(struct rd_msg, opt));
1542
1543 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1544         switch (skb->ndisc_nodetype) {
1545         case NDISC_NODETYPE_HOST:
1546         case NDISC_NODETYPE_NODEFAULT:
1547                 ND_PRINTK(2, warn,
1548                           "Redirect: from host or unauthorized router\n");
1549                 return;
1550         }
1551 #endif
1552
1553         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1554                 ND_PRINTK(2, warn,
1555                           "Redirect: source address is not link-local\n");
1556                 return;
1557         }
1558
1559         if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1560                 return;
1561
1562         if (!ndopts.nd_opts_rh) {
1563                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1564                                         skb->dev->ifindex);
1565                 return;
1566         }
1567
1568         hdr = (u8 *)ndopts.nd_opts_rh;
1569         hdr += 8;
1570         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1571                 return;
1572
1573         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1574 }
1575
1576 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1577                                            struct sk_buff *orig_skb,
1578                                            int rd_len)
1579 {
1580         u8 *opt = skb_put(skb, rd_len);
1581
1582         memset(opt, 0, 8);
1583         *(opt++) = ND_OPT_REDIRECT_HDR;
1584         *(opt++) = (rd_len >> 3);
1585         opt += 6;
1586
1587         skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1588                       rd_len - 8);
1589 }
1590
1591 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1592 {
1593         struct net_device *dev = skb->dev;
1594         struct net *net = dev_net(dev);
1595         struct sock *sk = net->ipv6.ndisc_sk;
1596         int optlen = 0;
1597         struct inet_peer *peer;
1598         struct sk_buff *buff;
1599         struct rd_msg *msg;
1600         struct in6_addr saddr_buf;
1601         struct rt6_info *rt;
1602         struct dst_entry *dst;
1603         struct flowi6 fl6;
1604         int rd_len;
1605         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1606            ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1607         bool ret;
1608
1609         if (netif_is_l3_master(skb->dev)) {
1610                 dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
1611                 if (!dev)
1612                         return;
1613         }
1614
1615         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1616                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1617                           dev->name);
1618                 return;
1619         }
1620
1621         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1622             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1623                 ND_PRINTK(2, warn,
1624                           "Redirect: target address is not link-local unicast\n");
1625                 return;
1626         }
1627
1628         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1629                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1630
1631         dst = ip6_route_output(net, NULL, &fl6);
1632         if (dst->error) {
1633                 dst_release(dst);
1634                 return;
1635         }
1636         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1637         if (IS_ERR(dst))
1638                 return;
1639
1640         rt = (struct rt6_info *) dst;
1641
1642         if (rt->rt6i_flags & RTF_GATEWAY) {
1643                 ND_PRINTK(2, warn,
1644                           "Redirect: destination is not a neighbour\n");
1645                 goto release;
1646         }
1647         peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1648         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1649         if (peer)
1650                 inet_putpeer(peer);
1651         if (!ret)
1652                 goto release;
1653
1654         if (dev->addr_len) {
1655                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1656                 if (!neigh) {
1657                         ND_PRINTK(2, warn,
1658                                   "Redirect: no neigh for target address\n");
1659                         goto release;
1660                 }
1661
1662                 read_lock_bh(&neigh->lock);
1663                 if (neigh->nud_state & NUD_VALID) {
1664                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1665                         read_unlock_bh(&neigh->lock);
1666                         ha = ha_buf;
1667                         optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1668                                                                 ops_data_buf,
1669                                                                 &ops_data);
1670                 } else
1671                         read_unlock_bh(&neigh->lock);
1672
1673                 neigh_release(neigh);
1674         }
1675
1676         rd_len = min_t(unsigned int,
1677                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1678                        skb->len + 8);
1679         rd_len &= ~0x7;
1680         optlen += rd_len;
1681
1682         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1683         if (!buff)
1684                 goto release;
1685
1686         msg = skb_put(buff, sizeof(*msg));
1687         *msg = (struct rd_msg) {
1688                 .icmph = {
1689                         .icmp6_type = NDISC_REDIRECT,
1690                 },
1691                 .target = *target,
1692                 .dest = ipv6_hdr(skb)->daddr,
1693         };
1694
1695         /*
1696          *      include target_address option
1697          */
1698
1699         if (ha)
1700                 ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1701
1702         /*
1703          *      build redirect option and copy skb over to the new packet.
1704          */
1705
1706         if (rd_len)
1707                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1708
1709         skb_dst_set(buff, dst);
1710         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1711         return;
1712
1713 release:
1714         dst_release(dst);
1715 }
1716
1717 static void pndisc_redo(struct sk_buff *skb)
1718 {
1719         ndisc_recv_ns(skb);
1720         kfree_skb(skb);
1721 }
1722
1723 static int ndisc_is_multicast(const void *pkey)
1724 {
1725         return ipv6_addr_is_multicast((struct in6_addr *)pkey);
1726 }
1727
1728 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1729 {
1730         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1731
1732         if (!idev)
1733                 return true;
1734         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1735             idev->cnf.suppress_frag_ndisc) {
1736                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1737                 return true;
1738         }
1739         return false;
1740 }
1741
1742 int ndisc_rcv(struct sk_buff *skb)
1743 {
1744         struct nd_msg *msg;
1745
1746         if (ndisc_suppress_frag_ndisc(skb))
1747                 return 0;
1748
1749         if (skb_linearize(skb))
1750                 return 0;
1751
1752         msg = (struct nd_msg *)skb_transport_header(skb);
1753
1754         __skb_push(skb, skb->data - skb_transport_header(skb));
1755
1756         if (ipv6_hdr(skb)->hop_limit != 255) {
1757                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1758                           ipv6_hdr(skb)->hop_limit);
1759                 return 0;
1760         }
1761
1762         if (msg->icmph.icmp6_code != 0) {
1763                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1764                           msg->icmph.icmp6_code);
1765                 return 0;
1766         }
1767
1768         switch (msg->icmph.icmp6_type) {
1769         case NDISC_NEIGHBOUR_SOLICITATION:
1770                 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1771                 ndisc_recv_ns(skb);
1772                 break;
1773
1774         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1775                 ndisc_recv_na(skb);
1776                 break;
1777
1778         case NDISC_ROUTER_SOLICITATION:
1779                 ndisc_recv_rs(skb);
1780                 break;
1781
1782         case NDISC_ROUTER_ADVERTISEMENT:
1783                 ndisc_router_discovery(skb);
1784                 break;
1785
1786         case NDISC_REDIRECT:
1787                 ndisc_redirect_rcv(skb);
1788                 break;
1789         }
1790
1791         return 0;
1792 }
1793
1794 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1795 {
1796         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1797         struct netdev_notifier_change_info *change_info;
1798         struct net *net = dev_net(dev);
1799         struct inet6_dev *idev;
1800
1801         switch (event) {
1802         case NETDEV_CHANGEADDR:
1803                 neigh_changeaddr(&nd_tbl, dev);
1804                 fib6_run_gc(0, net, false);
1805                 fallthrough;
1806         case NETDEV_UP:
1807                 idev = in6_dev_get(dev);
1808                 if (!idev)
1809                         break;
1810                 if (idev->cnf.ndisc_notify ||
1811                     net->ipv6.devconf_all->ndisc_notify)
1812                         ndisc_send_unsol_na(dev);
1813                 in6_dev_put(idev);
1814                 break;
1815         case NETDEV_CHANGE:
1816                 change_info = ptr;
1817                 if (change_info->flags_changed & IFF_NOARP)
1818                         neigh_changeaddr(&nd_tbl, dev);
1819                 if (!netif_carrier_ok(dev))
1820                         neigh_carrier_down(&nd_tbl, dev);
1821                 break;
1822         case NETDEV_DOWN:
1823                 neigh_ifdown(&nd_tbl, dev);
1824                 fib6_run_gc(0, net, false);
1825                 break;
1826         case NETDEV_NOTIFY_PEERS:
1827                 ndisc_send_unsol_na(dev);
1828                 break;
1829         default:
1830                 break;
1831         }
1832
1833         return NOTIFY_DONE;
1834 }
1835
1836 static struct notifier_block ndisc_netdev_notifier = {
1837         .notifier_call = ndisc_netdev_event,
1838         .priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1839 };
1840
1841 #ifdef CONFIG_SYSCTL
1842 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1843                                          const char *func, const char *dev_name)
1844 {
1845         static char warncomm[TASK_COMM_LEN];
1846         static int warned;
1847         if (strcmp(warncomm, current->comm) && warned < 5) {
1848                 strcpy(warncomm, current->comm);
1849                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1850                         warncomm, func,
1851                         dev_name, ctl->procname,
1852                         dev_name, ctl->procname);
1853                 warned++;
1854         }
1855 }
1856
1857 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void *buffer,
1858                 size_t *lenp, loff_t *ppos)
1859 {
1860         struct net_device *dev = ctl->extra1;
1861         struct inet6_dev *idev;
1862         int ret;
1863
1864         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1865             (strcmp(ctl->procname, "base_reachable_time") == 0))
1866                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1867
1868         if (strcmp(ctl->procname, "retrans_time") == 0)
1869                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1870
1871         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1872                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1873                                                   buffer, lenp, ppos);
1874
1875         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1876                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1877                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1878                                                      buffer, lenp, ppos);
1879         else
1880                 ret = -1;
1881
1882         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1883                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1884                         idev->nd_parms->reachable_time =
1885                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1886                 idev->tstamp = jiffies;
1887                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1888                 in6_dev_put(idev);
1889         }
1890         return ret;
1891 }
1892
1893
1894 #endif
1895
1896 static int __net_init ndisc_net_init(struct net *net)
1897 {
1898         struct ipv6_pinfo *np;
1899         struct sock *sk;
1900         int err;
1901
1902         err = inet_ctl_sock_create(&sk, PF_INET6,
1903                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1904         if (err < 0) {
1905                 ND_PRINTK(0, err,
1906                           "NDISC: Failed to initialize the control socket (err %d)\n",
1907                           err);
1908                 return err;
1909         }
1910
1911         net->ipv6.ndisc_sk = sk;
1912
1913         np = inet6_sk(sk);
1914         np->hop_limit = 255;
1915         /* Do not loopback ndisc messages */
1916         np->mc_loop = 0;
1917
1918         return 0;
1919 }
1920
1921 static void __net_exit ndisc_net_exit(struct net *net)
1922 {
1923         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1924 }
1925
1926 static struct pernet_operations ndisc_net_ops = {
1927         .init = ndisc_net_init,
1928         .exit = ndisc_net_exit,
1929 };
1930
1931 int __init ndisc_init(void)
1932 {
1933         int err;
1934
1935         err = register_pernet_subsys(&ndisc_net_ops);
1936         if (err)
1937                 return err;
1938         /*
1939          * Initialize the neighbour table
1940          */
1941         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1942
1943 #ifdef CONFIG_SYSCTL
1944         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1945                                     ndisc_ifinfo_sysctl_change);
1946         if (err)
1947                 goto out_unregister_pernet;
1948 out:
1949 #endif
1950         return err;
1951
1952 #ifdef CONFIG_SYSCTL
1953 out_unregister_pernet:
1954         unregister_pernet_subsys(&ndisc_net_ops);
1955         goto out;
1956 #endif
1957 }
1958
1959 int __init ndisc_late_init(void)
1960 {
1961         return register_netdevice_notifier(&ndisc_netdev_notifier);
1962 }
1963
1964 void ndisc_late_cleanup(void)
1965 {
1966         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1967 }
1968
1969 void ndisc_cleanup(void)
1970 {
1971 #ifdef CONFIG_SYSCTL
1972         neigh_sysctl_unregister(&nd_tbl.parms);
1973 #endif
1974         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1975         unregister_pernet_subsys(&ndisc_net_ops);
1976 }