Pileus Git - ~andy/linux/blob - net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Mike Shaver             <shaver@ingenia.com>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  19  *      Pierre Ynard                    :       export userland ND options
  20  *                                              through netlink (RDNSS support)
  21  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  22  *                                              of an RA.
  23  *      Janos Farkas                    :       kmalloc failure checks
  24  *      Alexey Kuznetsov                :       state machine reworked
  25  *                                              and moved to net/core.
  26  *      Pekka Savola                    :       RFC2461 validation
  27  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  28  */
  29
  30 #define pr_fmt(fmt) "ICMPv6: " fmt
  31
  32 #include <linux/module.h>
  33 #include <linux/errno.h>
  34 #include <linux/types.h>
  35 #include <linux/socket.h>
  36 #include <linux/sockios.h>
  37 #include <linux/sched.h>
  38 #include <linux/net.h>
  39 #include <linux/in6.h>
  40 #include <linux/route.h>
  41 #include <linux/init.h>
  42 #include <linux/rcupdate.h>
  43 #include <linux/slab.h>
  44 #ifdef CONFIG_SYSCTL
  45 #include <linux/sysctl.h>
  46 #endif
  47
  48 #include <linux/if_addr.h>
  49 #include <linux/if_arp.h>
  50 #include <linux/ipv6.h>
  51 #include <linux/icmpv6.h>
  52 #include <linux/jhash.h>
  53
  54 #include <net/sock.h>
  55 #include <net/snmp.h>
  56
  57 #include <net/ipv6.h>
  58 #include <net/protocol.h>
  59 #include <net/ndisc.h>
  60 #include <net/ip6_route.h>
  61 #include <net/addrconf.h>
  62 #include <net/icmp.h>
  63
  64 #include <net/netlink.h>
  65 #include <linux/rtnetlink.h>
  66
  67 #include <net/flow.h>
  68 #include <net/ip6_checksum.h>
  69 #include <net/inet_common.h>
  70 #include <linux/proc_fs.h>
  71
  72 #include <linux/netfilter.h>
  73 #include <linux/netfilter_ipv6.h>
  74
  75 /* Set to 3 to get tracing... */
  76 #define ND_DEBUG 1
  77
  78 #define ND_PRINTK(val, level, fmt, ...)                         \
  79 do {                                                            \
  80         if (val <= ND_DEBUG)                                    \
  81                 net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
  82 } while (0)
  83
  84 static u32 ndisc_hash(const void *pkey,
  85                       const struct net_device *dev,
  86                       __u32 *hash_rnd);
  87 static int ndisc_constructor(struct neighbour *neigh);
  88 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  89 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  90 static int pndisc_constructor(struct pneigh_entry *n);
  91 static void pndisc_destructor(struct pneigh_entry *n);
  92 static void pndisc_redo(struct sk_buff *skb);
  93
  94 static const struct neigh_ops ndisc_generic_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_connected_output,
 100 };
 101
 102 static const struct neigh_ops ndisc_hh_ops = {
 103         .family =               AF_INET6,
 104         .solicit =              ndisc_solicit,
 105         .error_report =         ndisc_error_report,
 106         .output =               neigh_resolve_output,
 107         .connected_output =     neigh_resolve_output,
 108 };
 109
 110
 111 static const struct neigh_ops ndisc_direct_ops = {
 112         .family =               AF_INET6,
 113         .output =               neigh_direct_output,
 114         .connected_output =     neigh_direct_output,
 115 };
 116
 117 struct neigh_table nd_tbl = {
 118         .family =       AF_INET6,
 119         .key_len =      sizeof(struct in6_addr),
 120         .hash =         ndisc_hash,
 121         .constructor =  ndisc_constructor,
 122         .pconstructor = pndisc_constructor,
 123         .pdestructor =  pndisc_destructor,
 124         .proxy_redo =   pndisc_redo,
 125         .id =           "ndisc_cache",
 126         .parms = {
 127                 .tbl                    = &nd_tbl,
 128                 .base_reachable_time    = ND_REACHABLE_TIME,
 129                 .retrans_time           = ND_RETRANS_TIMER,
 130                 .gc_staletime           = 60 * HZ,
 131                 .reachable_time         = ND_REACHABLE_TIME,
 132                 .delay_probe_time       = 5 * HZ,
 133                 .queue_len_bytes        = 64*1024,
 134                 .ucast_probes           = 3,
 135                 .mcast_probes           = 3,
 136                 .anycast_delay          = 1 * HZ,
 137                 .proxy_delay            = (8 * HZ) / 10,
 138                 .proxy_qlen             = 64,
 139         },
 140         .gc_interval =    30 * HZ,
 141         .gc_thresh1 =    128,
 142         .gc_thresh2 =    512,
 143         .gc_thresh3 =   1024,
 144 };
 145
 146 static inline int ndisc_opt_addr_space(struct net_device *dev)
 147 {
 148         return NDISC_OPT_SPACE(dev->addr_len + ndisc_addr_option_pad(dev->type));
 149 }
 150
 151 static u8 *ndisc_fill_addr_option(u8 *opt, int type, void *data, int data_len,
 152                                   unsigned short addr_type)
 153 {
 154         int space = NDISC_OPT_SPACE(data_len);
 155         int pad   = ndisc_addr_option_pad(addr_type);
 156
 157         opt[0] = type;
 158         opt[1] = space>>3;
 159
 160         memset(opt + 2, 0, pad);
 161         opt   += pad;
 162         space -= pad;
 163
 164         memcpy(opt+2, data, data_len);
 165         data_len += 2;
 166         opt += data_len;
 167         if ((space -= data_len) > 0)
 168                 memset(opt, 0, space);
 169         return opt + space;
 170 }
 171
 172 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 173                                             struct nd_opt_hdr *end)
 174 {
 175         int type;
 176         if (!cur || !end || cur >= end)
 177                 return NULL;
 178         type = cur->nd_opt_type;
 179         do {
 180                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 181         } while(cur < end && cur->nd_opt_type != type);
 182         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 183 }
 184
 185 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 186 {
 187         return opt->nd_opt_type == ND_OPT_RDNSS ||
 188                 opt->nd_opt_type == ND_OPT_DNSSL;
 189 }
 190
 191 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 192                                              struct nd_opt_hdr *end)
 193 {
 194         if (!cur || !end || cur >= end)
 195                 return NULL;
 196         do {
 197                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 198         } while(cur < end && !ndisc_is_useropt(cur));
 199         return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 200 }
 201
 202 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 203                                           struct ndisc_options *ndopts)
 204 {
 205         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 206
 207         if (!nd_opt || opt_len < 0 || !ndopts)
 208                 return NULL;
 209         memset(ndopts, 0, sizeof(*ndopts));
 210         while (opt_len) {
 211                 int l;
 212                 if (opt_len < sizeof(struct nd_opt_hdr))
 213                         return NULL;
 214                 l = nd_opt->nd_opt_len << 3;
 215                 if (opt_len < l || l == 0)
 216                         return NULL;
 217                 switch (nd_opt->nd_opt_type) {
 218                 case ND_OPT_SOURCE_LL_ADDR:
 219                 case ND_OPT_TARGET_LL_ADDR:
 220                 case ND_OPT_MTU:
 221                 case ND_OPT_REDIRECT_HDR:
 222                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 223                                 ND_PRINTK(2, warn,
 224                                           "%s: duplicated ND6 option found: type=%d\n",
 225                                           __func__, nd_opt->nd_opt_type);
 226                         } else {
 227                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 228                         }
 229                         break;
 230                 case ND_OPT_PREFIX_INFO:
 231                         ndopts->nd_opts_pi_end = nd_opt;
 232                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 233                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 234                         break;
 235 #ifdef CONFIG_IPV6_ROUTE_INFO
 236                 case ND_OPT_ROUTE_INFO:
 237                         ndopts->nd_opts_ri_end = nd_opt;
 238                         if (!ndopts->nd_opts_ri)
 239                                 ndopts->nd_opts_ri = nd_opt;
 240                         break;
 241 #endif
 242                 default:
 243                         if (ndisc_is_useropt(nd_opt)) {
 244                                 ndopts->nd_useropts_end = nd_opt;
 245                                 if (!ndopts->nd_useropts)
 246                                         ndopts->nd_useropts = nd_opt;
 247                         } else {
 248                                 /*
 249                                  * Unknown options must be silently ignored,
 250                                  * to accommodate future extension to the
 251                                  * protocol.
 252                                  */
 253                                 ND_PRINTK(2, notice,
 254                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 255                                           __func__,
 256                                           nd_opt->nd_opt_type,
 257                                           nd_opt->nd_opt_len);
 258                         }
 259                 }
 260                 opt_len -= l;
 261                 nd_opt = ((void *)nd_opt) + l;
 262         }
 263         return ndopts;
 264 }
 265
 266 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 267 {
 268         switch (dev->type) {
 269         case ARPHRD_ETHER:
 270         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 271         case ARPHRD_FDDI:
 272                 ipv6_eth_mc_map(addr, buf);
 273                 return 0;
 274         case ARPHRD_ARCNET:
 275                 ipv6_arcnet_mc_map(addr, buf);
 276                 return 0;
 277         case ARPHRD_INFINIBAND:
 278                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 279                 return 0;
 280         case ARPHRD_IPGRE:
 281                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 282         default:
 283                 if (dir) {
 284                         memcpy(buf, dev->broadcast, dev->addr_len);
 285                         return 0;
 286                 }
 287         }
 288         return -EINVAL;
 289 }
 290
 291 EXPORT_SYMBOL(ndisc_mc_map);
 292
 293 static u32 ndisc_hash(const void *pkey,
 294                       const struct net_device *dev,
 295                       __u32 *hash_rnd)
 296 {
 297         return ndisc_hashfn(pkey, dev, hash_rnd);
 298 }
 299
 300 static int ndisc_constructor(struct neighbour *neigh)
 301 {
 302         struct in6_addr *addr = (struct in6_addr*)&neigh->primary_key;
 303         struct net_device *dev = neigh->dev;
 304         struct inet6_dev *in6_dev;
 305         struct neigh_parms *parms;
 306         bool is_multicast = ipv6_addr_is_multicast(addr);
 307
 308         in6_dev = in6_dev_get(dev);
 309         if (in6_dev == NULL) {
 310                 return -EINVAL;
 311         }
 312
 313         parms = in6_dev->nd_parms;
 314         __neigh_parms_put(neigh->parms);
 315         neigh->parms = neigh_parms_clone(parms);
 316
 317         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 318         if (!dev->header_ops) {
 319                 neigh->nud_state = NUD_NOARP;
 320                 neigh->ops = &ndisc_direct_ops;
 321                 neigh->output = neigh_direct_output;
 322         } else {
 323                 if (is_multicast) {
 324                         neigh->nud_state = NUD_NOARP;
 325                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 326                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 327                         neigh->nud_state = NUD_NOARP;
 328                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 329                         if (dev->flags&IFF_LOOPBACK)
 330                                 neigh->type = RTN_LOCAL;
 331                 } else if (dev->flags&IFF_POINTOPOINT) {
 332                         neigh->nud_state = NUD_NOARP;
 333                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 334                 }
 335                 if (dev->header_ops->cache)
 336                         neigh->ops = &ndisc_hh_ops;
 337                 else
 338                         neigh->ops = &ndisc_generic_ops;
 339                 if (neigh->nud_state&NUD_VALID)
 340                         neigh->output = neigh->ops->connected_output;
 341                 else
 342                         neigh->output = neigh->ops->output;
 343         }
 344         in6_dev_put(in6_dev);
 345         return 0;
 346 }
 347
 348 static int pndisc_constructor(struct pneigh_entry *n)
 349 {
 350         struct in6_addr *addr = (struct in6_addr*)&n->key;
 351         struct in6_addr maddr;
 352         struct net_device *dev = n->dev;
 353
 354         if (dev == NULL || __in6_dev_get(dev) == NULL)
 355                 return -EINVAL;
 356         addrconf_addr_solict_mult(addr, &maddr);
 357         ipv6_dev_mc_inc(dev, &maddr);
 358         return 0;
 359 }
 360
 361 static void pndisc_destructor(struct pneigh_entry *n)
 362 {
 363         struct in6_addr *addr = (struct in6_addr*)&n->key;
 364         struct in6_addr maddr;
 365         struct net_device *dev = n->dev;
 366
 367         if (dev == NULL || __in6_dev_get(dev) == NULL)
 368                 return;
 369         addrconf_addr_solict_mult(addr, &maddr);
 370         ipv6_dev_mc_dec(dev, &maddr);
 371 }
 372
 373 struct sk_buff *ndisc_build_skb(struct net_device *dev,
 374                                 const struct in6_addr *daddr,
 375                                 const struct in6_addr *saddr,
 376                                 struct icmp6hdr *icmp6h,
 377                                 const struct in6_addr *target,
 378                                 int llinfo)
 379 {
 380         struct net *net = dev_net(dev);
 381         struct sock *sk = net->ipv6.ndisc_sk;
 382         struct sk_buff *skb;
 383         struct icmp6hdr *hdr;
 384         int hlen = LL_RESERVED_SPACE(dev);
 385         int tlen = dev->needed_tailroom;
 386         int len;
 387         int err;
 388         u8 *opt;
 389
 390         if (!dev->addr_len)
 391                 llinfo = 0;
 392
 393         len = sizeof(struct icmp6hdr) + (target ? sizeof(*target) : 0);
 394         if (llinfo)
 395                 len += ndisc_opt_addr_space(dev);
 396
 397         skb = sock_alloc_send_skb(sk,
 398                                   (MAX_HEADER + sizeof(struct ipv6hdr) +
 399                                    len + hlen + tlen),
 400                                   1, &err);
 401         if (!skb) {
 402                 ND_PRINTK(0, err, "ND: %s failed to allocate an skb, err=%d\n",
 403                           __func__, err);
 404                 return NULL;
 405         }
 406
 407         skb_reserve(skb, hlen);
 408         ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
 409
 410         skb->transport_header = skb->tail;
 411         skb_put(skb, len);
 412
 413         hdr = (struct icmp6hdr *)skb_transport_header(skb);
 414         memcpy(hdr, icmp6h, sizeof(*hdr));
 415
 416         opt = skb_transport_header(skb) + sizeof(struct icmp6hdr);
 417         if (target) {
 418                 *(struct in6_addr *)opt = *target;
 419                 opt += sizeof(*target);
 420         }
 421
 422         if (llinfo)
 423                 ndisc_fill_addr_option(opt, llinfo, dev->dev_addr,
 424                                        dev->addr_len, dev->type);
 425
 426         hdr->icmp6_cksum = csum_ipv6_magic(saddr, daddr, len,
 427                                            IPPROTO_ICMPV6,
 428                                            csum_partial(hdr,
 429                                                         len, 0));
 430
 431         return skb;
 432 }
 433
 434 EXPORT_SYMBOL(ndisc_build_skb);
 435
 436 void ndisc_send_skb(struct sk_buff *skb,
 437                     struct net_device *dev,
 438                     struct neighbour *neigh,
 439                     const struct in6_addr *daddr,
 440                     const struct in6_addr *saddr,
 441                     struct icmp6hdr *icmp6h)
 442 {
 443         struct flowi6 fl6;
 444         struct dst_entry *dst;
 445         struct net *net = dev_net(dev);
 446         struct sock *sk = net->ipv6.ndisc_sk;
 447         struct inet6_dev *idev;
 448         int err;
 449         u8 type;
 450
 451         type = icmp6h->icmp6_type;
 452
 453         icmpv6_flow_init(sk, &fl6, type, saddr, daddr, dev->ifindex);
 454         dst = icmp6_dst_alloc(dev, neigh, &fl6);
 455         if (IS_ERR(dst)) {
 456                 kfree_skb(skb);
 457                 return;
 458         }
 459
 460         skb_dst_set(skb, dst);
 461
 462         rcu_read_lock();
 463         idev = __in6_dev_get(dst->dev);
 464         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 465
 466         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 467                       dst_output);
 468         if (!err) {
 469                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 470                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 471         }
 472
 473         rcu_read_unlock();
 474 }
 475
 476 EXPORT_SYMBOL(ndisc_send_skb);
 477
 478 /*
 479  *      Send a Neighbour Discover packet
 480  */
 481 static void __ndisc_send(struct net_device *dev,
 482                          struct neighbour *neigh,
 483                          const struct in6_addr *daddr,
 484                          const struct in6_addr *saddr,
 485                          struct icmp6hdr *icmp6h, const struct in6_addr *target,
 486                          int llinfo)
 487 {
 488         struct sk_buff *skb;
 489
 490         skb = ndisc_build_skb(dev, daddr, saddr, icmp6h, target, llinfo);
 491         if (!skb)
 492                 return;
 493
 494         ndisc_send_skb(skb, dev, neigh, daddr, saddr, icmp6h);
 495 }
 496
 497 static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 498                           const struct in6_addr *daddr,
 499                           const struct in6_addr *solicited_addr,
 500                           int router, int solicited, int override, int inc_opt)
 501 {
 502         struct in6_addr tmpaddr;
 503         struct inet6_ifaddr *ifp;
 504         const struct in6_addr *src_addr;
 505         struct icmp6hdr icmp6h = {
 506                 .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 507         };
 508
 509         /* for anycast or proxy, solicited_addr != src_addr */
 510         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 511         if (ifp) {
 512                 src_addr = solicited_addr;
 513                 if (ifp->flags & IFA_F_OPTIMISTIC)
 514                         override = 0;
 515                 inc_opt |= ifp->idev->cnf.force_tllao;
 516                 in6_ifa_put(ifp);
 517         } else {
 518                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 519                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 520                                        &tmpaddr))
 521                         return;
 522                 src_addr = &tmpaddr;
 523         }
 524
 525         icmp6h.icmp6_router = router;
 526         icmp6h.icmp6_solicited = solicited;
 527         icmp6h.icmp6_override = override;
 528
 529         __ndisc_send(dev, neigh, daddr, src_addr,
 530                      &icmp6h, solicited_addr,
 531                      inc_opt ? ND_OPT_TARGET_LL_ADDR : 0);
 532 }
 533
 534 static void ndisc_send_unsol_na(struct net_device *dev)
 535 {
 536         struct inet6_dev *idev;
 537         struct inet6_ifaddr *ifa;
 538
 539         idev = in6_dev_get(dev);
 540         if (!idev)
 541                 return;
 542
 543         read_lock_bh(&idev->lock);
 544         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 545                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
 546                               /*router=*/ !!idev->cnf.forwarding,
 547                               /*solicited=*/ false, /*override=*/ true,
 548                               /*inc_opt=*/ true);
 549         }
 550         read_unlock_bh(&idev->lock);
 551
 552         in6_dev_put(idev);
 553 }
 554
 555 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 556                    const struct in6_addr *solicit,
 557                    const struct in6_addr *daddr, const struct in6_addr *saddr)
 558 {
 559         struct in6_addr addr_buf;
 560         struct icmp6hdr icmp6h = {
 561                 .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 562         };
 563
 564         if (saddr == NULL) {
 565                 if (ipv6_get_lladdr(dev, &addr_buf,
 566                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 567                         return;
 568                 saddr = &addr_buf;
 569         }
 570
 571         __ndisc_send(dev, neigh, daddr, saddr,
 572                      &icmp6h, solicit,
 573                      !ipv6_addr_any(saddr) ? ND_OPT_SOURCE_LL_ADDR : 0);
 574 }
 575
 576 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 577                    const struct in6_addr *daddr)
 578 {
 579         struct icmp6hdr icmp6h = {
 580                 .icmp6_type = NDISC_ROUTER_SOLICITATION,
 581         };
 582         int send_sllao = dev->addr_len;
 583
 584 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 585         /*
 586          * According to section 2.2 of RFC 4429, we must not
 587          * send router solicitations with a sllao from
 588          * optimistic addresses, but we may send the solicitation
 589          * if we don't include the sllao.  So here we check
 590          * if our address is optimistic, and if so, we
 591          * suppress the inclusion of the sllao.
 592          */
 593         if (send_sllao) {
 594                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 595                                                            dev, 1);
 596                 if (ifp) {
 597                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 598                                 send_sllao = 0;
 599                         }
 600                         in6_ifa_put(ifp);
 601                 } else {
 602                         send_sllao = 0;
 603                 }
 604         }
 605 #endif
 606         __ndisc_send(dev, NULL, daddr, saddr,
 607                      &icmp6h, NULL,
 608                      send_sllao ? ND_OPT_SOURCE_LL_ADDR : 0);
 609 }
 610
 611
 612 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 613 {
 614         /*
 615          *      "The sender MUST return an ICMP
 616          *       destination unreachable"
 617          */
 618         dst_link_failure(skb);
 619         kfree_skb(skb);
 620 }
 621
 622 /* Called with locked neigh: either read or both */
 623
 624 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 625 {
 626         struct in6_addr *saddr = NULL;
 627         struct in6_addr mcaddr;
 628         struct net_device *dev = neigh->dev;
 629         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 630         int probes = atomic_read(&neigh->probes);
 631
 632         if (skb && ipv6_chk_addr(dev_net(dev), &ipv6_hdr(skb)->saddr, dev, 1))
 633                 saddr = &ipv6_hdr(skb)->saddr;
 634
 635         if ((probes -= neigh->parms->ucast_probes) < 0) {
 636                 if (!(neigh->nud_state & NUD_VALID)) {
 637                         ND_PRINTK(1, dbg,
 638                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 639                                   __func__, target);
 640                 }
 641                 ndisc_send_ns(dev, neigh, target, target, saddr);
 642         } else if ((probes -= neigh->parms->app_probes) < 0) {
 643 #ifdef CONFIG_ARPD
 644                 neigh_app_ns(neigh);
 645 #endif
 646         } else {
 647                 addrconf_addr_solict_mult(target, &mcaddr);
 648                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 649         }
 650 }
 651
 652 static int pndisc_is_router(const void *pkey,
 653                             struct net_device *dev)
 654 {
 655         struct pneigh_entry *n;
 656         int ret = -1;
 657
 658         read_lock_bh(&nd_tbl.lock);
 659         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 660         if (n)
 661                 ret = !!(n->flags & NTF_ROUTER);
 662         read_unlock_bh(&nd_tbl.lock);
 663
 664         return ret;
 665 }
 666
 667 static void ndisc_recv_ns(struct sk_buff *skb)
 668 {
 669         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 670         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 671         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 672         u8 *lladdr = NULL;
 673         u32 ndoptlen = skb->tail - (skb->transport_header +
 674                                     offsetof(struct nd_msg, opt));
 675         struct ndisc_options ndopts;
 676         struct net_device *dev = skb->dev;
 677         struct inet6_ifaddr *ifp;
 678         struct inet6_dev *idev = NULL;
 679         struct neighbour *neigh;
 680         int dad = ipv6_addr_any(saddr);
 681         bool inc;
 682         int is_router = -1;
 683
 684         if (ipv6_addr_is_multicast(&msg->target)) {
 685                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 686                 return;
 687         }
 688
 689         /*
 690          * RFC2461 7.1.1:
 691          * DAD has to be destined for solicited node multicast address.
 692          */
 693         if (dad &&
 694             !(daddr->s6_addr32[0] == htonl(0xff020000) &&
 695               daddr->s6_addr32[1] == htonl(0x00000000) &&
 696               daddr->s6_addr32[2] == htonl(0x00000001) &&
 697               daddr->s6_addr [12] == 0xff )) {
 698                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 699                 return;
 700         }
 701
 702         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 703                 ND_PRINTK(2, warn, "NS: invalid ND options\n");
 704                 return;
 705         }
 706
 707         if (ndopts.nd_opts_src_lladdr) {
 708                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 709                 if (!lladdr) {
 710                         ND_PRINTK(2, warn,
 711                                   "NS: invalid link-layer address length\n");
 712                         return;
 713                 }
 714
 715                 /* RFC2461 7.1.1:
 716                  *      If the IP source address is the unspecified address,
 717                  *      there MUST NOT be source link-layer address option
 718                  *      in the message.
 719                  */
 720                 if (dad) {
 721                         ND_PRINTK(2, warn,
 722                                   "NS: bad DAD packet (link-layer address option)\n");
 723                         return;
 724                 }
 725         }
 726
 727         inc = ipv6_addr_is_multicast(daddr);
 728
 729         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 730         if (ifp) {
 731
 732                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 733                         if (dad) {
 734                                 /*
 735                                  * We are colliding with another node
 736                                  * who is doing DAD
 737                                  * so fail our DAD process
 738                                  */
 739                                 addrconf_dad_failure(ifp);
 740                                 return;
 741                         } else {
 742                                 /*
 743                                  * This is not a dad solicitation.
 744                                  * If we are an optimistic node,
 745                                  * we should respond.
 746                                  * Otherwise, we should ignore it.
 747                                  */
 748                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 749                                         goto out;
 750                         }
 751                 }
 752
 753                 idev = ifp->idev;
 754         } else {
 755                 struct net *net = dev_net(dev);
 756
 757                 idev = in6_dev_get(dev);
 758                 if (!idev) {
 759                         /* XXX: count this drop? */
 760                         return;
 761                 }
 762
 763                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 764                     (idev->cnf.forwarding &&
 765                      (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
 766                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 767                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 768                             skb->pkt_type != PACKET_HOST &&
 769                             inc != 0 &&
 770                             idev->nd_parms->proxy_delay != 0) {
 771                                 /*
 772                                  * for anycast or proxy,
 773                                  * sender should delay its response
 774                                  * by a random time between 0 and
 775                                  * MAX_ANYCAST_DELAY_TIME seconds.
 776                                  * (RFC2461) -- yoshfuji
 777                                  */
 778                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 779                                 if (n)
 780                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 781                                 goto out;
 782                         }
 783                 } else
 784                         goto out;
 785         }
 786
 787         if (is_router < 0)
 788                 is_router = !!idev->cnf.forwarding;
 789
 790         if (dad) {
 791                 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
 792                               is_router, 0, (ifp != NULL), 1);
 793                 goto out;
 794         }
 795
 796         if (inc)
 797                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 798         else
 799                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 800
 801         /*
 802          *      update / create cache entry
 803          *      for the source address
 804          */
 805         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 806                                !inc || lladdr || !dev->addr_len);
 807         if (neigh)
 808                 neigh_update(neigh, lladdr, NUD_STALE,
 809                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 810                              NEIGH_UPDATE_F_OVERRIDE);
 811         if (neigh || !dev->header_ops) {
 812                 ndisc_send_na(dev, neigh, saddr, &msg->target,
 813                               is_router,
 814                               1, (ifp != NULL && inc), inc);
 815                 if (neigh)
 816                         neigh_release(neigh);
 817         }
 818
 819 out:
 820         if (ifp)
 821                 in6_ifa_put(ifp);
 822         else
 823                 in6_dev_put(idev);
 824 }
 825
 826 static void ndisc_recv_na(struct sk_buff *skb)
 827 {
 828         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 829         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 830         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 831         u8 *lladdr = NULL;
 832         u32 ndoptlen = skb->tail - (skb->transport_header +
 833                                     offsetof(struct nd_msg, opt));
 834         struct ndisc_options ndopts;
 835         struct net_device *dev = skb->dev;
 836         struct inet6_ifaddr *ifp;
 837         struct neighbour *neigh;
 838
 839         if (skb->len < sizeof(struct nd_msg)) {
 840                 ND_PRINTK(2, warn, "NA: packet too short\n");
 841                 return;
 842         }
 843
 844         if (ipv6_addr_is_multicast(&msg->target)) {
 845                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
 846                 return;
 847         }
 848
 849         if (ipv6_addr_is_multicast(daddr) &&
 850             msg->icmph.icmp6_solicited) {
 851                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
 852                 return;
 853         }
 854
 855         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 856                 ND_PRINTK(2, warn, "NS: invalid ND option\n");
 857                 return;
 858         }
 859         if (ndopts.nd_opts_tgt_lladdr) {
 860                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 861                 if (!lladdr) {
 862                         ND_PRINTK(2, warn,
 863                                   "NA: invalid link-layer address length\n");
 864                         return;
 865                 }
 866         }
 867         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 868         if (ifp) {
 869                 if (skb->pkt_type != PACKET_LOOPBACK
 870                     && (ifp->flags & IFA_F_TENTATIVE)) {
 871                                 addrconf_dad_failure(ifp);
 872                                 return;
 873                 }
 874                 /* What should we make now? The advertisement
 875                    is invalid, but ndisc specs say nothing
 876                    about it. It could be misconfiguration, or
 877                    an smart proxy agent tries to help us :-)
 878
 879                    We should not print the error if NA has been
 880                    received from loopback - it is just our own
 881                    unsolicited advertisement.
 882                  */
 883                 if (skb->pkt_type != PACKET_LOOPBACK)
 884                         ND_PRINTK(1, warn,
 885                                   "NA: someone advertises our address %pI6 on %s!\n",
 886                                   &ifp->addr, ifp->idev->dev->name);
 887                 in6_ifa_put(ifp);
 888                 return;
 889         }
 890         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 891
 892         if (neigh) {
 893                 u8 old_flags = neigh->flags;
 894                 struct net *net = dev_net(dev);
 895
 896                 if (neigh->nud_state & NUD_FAILED)
 897                         goto out;
 898
 899                 /*
 900                  * Don't update the neighbor cache entry on a proxy NA from
 901                  * ourselves because either the proxied node is off link or it
 902                  * has already sent a NA to us.
 903                  */
 904                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 905                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
 906                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
 907                         /* XXX: idev->cnf.proxy_ndp */
 908                         goto out;
 909                 }
 910
 911                 neigh_update(neigh, lladdr,
 912                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 913                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 914                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 915                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 916                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 917
 918                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 919                         /*
 920                          * Change: router to host
 921                          */
 922                         struct rt6_info *rt;
 923                         rt = rt6_get_dflt_router(saddr, dev);
 924                         if (rt)
 925                                 ip6_del_rt(rt);
 926                 }
 927
 928 out:
 929                 neigh_release(neigh);
 930         }
 931 }
 932
 933 static void ndisc_recv_rs(struct sk_buff *skb)
 934 {
 935         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 936         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 937         struct neighbour *neigh;
 938         struct inet6_dev *idev;
 939         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 940         struct ndisc_options ndopts;
 941         u8 *lladdr = NULL;
 942
 943         if (skb->len < sizeof(*rs_msg))
 944                 return;
 945
 946         idev = __in6_dev_get(skb->dev);
 947         if (!idev) {
 948                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
 949                 return;
 950         }
 951
 952         /* Don't accept RS if we're not in router mode */
 953         if (!idev->cnf.forwarding)
 954                 goto out;
 955
 956         /*
 957          * Don't update NCE if src = ::;
 958          * this implies that the source node has no ip address assigned yet.
 959          */
 960         if (ipv6_addr_any(saddr))
 961                 goto out;
 962
 963         /* Parse ND options */
 964         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 965                 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
 966                 goto out;
 967         }
 968
 969         if (ndopts.nd_opts_src_lladdr) {
 970                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
 971                                              skb->dev);
 972                 if (!lladdr)
 973                         goto out;
 974         }
 975
 976         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
 977         if (neigh) {
 978                 neigh_update(neigh, lladdr, NUD_STALE,
 979                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 980                              NEIGH_UPDATE_F_OVERRIDE|
 981                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
 982                 neigh_release(neigh);
 983         }
 984 out:
 985         return;
 986 }
 987
 988 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
 989 {
 990         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
 991         struct sk_buff *skb;
 992         struct nlmsghdr *nlh;
 993         struct nduseroptmsg *ndmsg;
 994         struct net *net = dev_net(ra->dev);
 995         int err;
 996         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
 997                                     + (opt->nd_opt_len << 3));
 998         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
 999
1000         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1001         if (skb == NULL) {
1002                 err = -ENOBUFS;
1003                 goto errout;
1004         }
1005
1006         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1007         if (nlh == NULL) {
1008                 goto nla_put_failure;
1009         }
1010
1011         ndmsg = nlmsg_data(nlh);
1012         ndmsg->nduseropt_family = AF_INET6;
1013         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1014         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1015         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1016         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1017
1018         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1019
1020         if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1021                     &ipv6_hdr(ra)->saddr))
1022                 goto nla_put_failure;
1023         nlmsg_end(skb, nlh);
1024
1025         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1026         return;
1027
1028 nla_put_failure:
1029         nlmsg_free(skb);
1030         err = -EMSGSIZE;
1031 errout:
1032         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1033 }
1034
1035 static inline int accept_ra(struct inet6_dev *in6_dev)
1036 {
1037         /*
1038          * If forwarding is enabled, RA are not accepted unless the special
1039          * hybrid mode (accept_ra=2) is enabled.
1040          */
1041         if (in6_dev->cnf.forwarding && in6_dev->cnf.accept_ra < 2)
1042                 return 0;
1043
1044         return in6_dev->cnf.accept_ra;
1045 }
1046
1047 static void ndisc_router_discovery(struct sk_buff *skb)
1048 {
1049         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1050         struct neighbour *neigh = NULL;
1051         struct inet6_dev *in6_dev;
1052         struct rt6_info *rt = NULL;
1053         int lifetime;
1054         struct ndisc_options ndopts;
1055         int optlen;
1056         unsigned int pref = 0;
1057
1058         __u8 * opt = (__u8 *)(ra_msg + 1);
1059
1060         optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
1061
1062         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1063                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1064                 return;
1065         }
1066         if (optlen < 0) {
1067                 ND_PRINTK(2, warn, "RA: packet too short\n");
1068                 return;
1069         }
1070
1071 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1072         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1073                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1074                 return;
1075         }
1076 #endif
1077
1078         /*
1079          *      set the RA_RECV flag in the interface
1080          */
1081
1082         in6_dev = __in6_dev_get(skb->dev);
1083         if (in6_dev == NULL) {
1084                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1085                           skb->dev->name);
1086                 return;
1087         }
1088
1089         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1090                 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1091                 return;
1092         }
1093
1094         if (!accept_ra(in6_dev))
1095                 goto skip_linkparms;
1096
1097 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1098         /* skip link-specific parameters from interior routers */
1099         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
1100                 goto skip_linkparms;
1101 #endif
1102
1103         if (in6_dev->if_flags & IF_RS_SENT) {
1104                 /*
1105                  *      flag that an RA was received after an RS was sent
1106                  *      out on this interface.
1107                  */
1108                 in6_dev->if_flags |= IF_RA_RCVD;
1109         }
1110
1111         /*
1112          * Remember the managed/otherconf flags from most recently
1113          * received RA message (RFC 2462) -- yoshfuji
1114          */
1115         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1116                                 IF_RA_OTHERCONF)) |
1117                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1118                                         IF_RA_MANAGED : 0) |
1119                                 (ra_msg->icmph.icmp6_addrconf_other ?
1120                                         IF_RA_OTHERCONF : 0);
1121
1122         if (!in6_dev->cnf.accept_ra_defrtr)
1123                 goto skip_defrtr;
1124
1125         if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
1126                 goto skip_defrtr;
1127
1128         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1129
1130 #ifdef CONFIG_IPV6_ROUTER_PREF
1131         pref = ra_msg->icmph.icmp6_router_pref;
1132         /* 10b is handled as if it were 00b (medium) */
1133         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1134             !in6_dev->cnf.accept_ra_rtr_pref)
1135                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1136 #endif
1137
1138         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1139
1140         if (rt) {
1141                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1142                 if (!neigh) {
1143                         ND_PRINTK(0, err,
1144                                   "RA: %s got default router without neighbour\n",
1145                                   __func__);
1146                         ip6_rt_put(rt);
1147                         return;
1148                 }
1149         }
1150         if (rt && lifetime == 0) {
1151                 ip6_del_rt(rt);
1152                 rt = NULL;
1153         }
1154
1155         if (rt == NULL && lifetime) {
1156                 ND_PRINTK(3, dbg, "RA: adding default router\n");
1157
1158                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1159                 if (rt == NULL) {
1160                         ND_PRINTK(0, err,
1161                                   "RA: %s failed to add default route\n",
1162                                   __func__);
1163                         return;
1164                 }
1165
1166                 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1167                 if (neigh == NULL) {
1168                         ND_PRINTK(0, err,
1169                                   "RA: %s got default router without neighbour\n",
1170                                   __func__);
1171                         ip6_rt_put(rt);
1172                         return;
1173                 }
1174                 neigh->flags |= NTF_ROUTER;
1175         } else if (rt) {
1176                 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1177         }
1178
1179         if (rt)
1180                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1181         if (ra_msg->icmph.icmp6_hop_limit) {
1182                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1183                 if (rt)
1184                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1185                                        ra_msg->icmph.icmp6_hop_limit);
1186         }
1187
1188 skip_defrtr:
1189
1190         /*
1191          *      Update Reachable Time and Retrans Timer
1192          */
1193
1194         if (in6_dev->nd_parms) {
1195                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1196
1197                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1198                         rtime = (rtime*HZ)/1000;
1199                         if (rtime < HZ/10)
1200                                 rtime = HZ/10;
1201                         in6_dev->nd_parms->retrans_time = rtime;
1202                         in6_dev->tstamp = jiffies;
1203                         inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1204                 }
1205
1206                 rtime = ntohl(ra_msg->reachable_time);
1207                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1208                         rtime = (rtime*HZ)/1000;
1209
1210                         if (rtime < HZ/10)
1211                                 rtime = HZ/10;
1212
1213                         if (rtime != in6_dev->nd_parms->base_reachable_time) {
1214                                 in6_dev->nd_parms->base_reachable_time = rtime;
1215                                 in6_dev->nd_parms->gc_staletime = 3 * rtime;
1216                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1217                                 in6_dev->tstamp = jiffies;
1218                                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1219                         }
1220                 }
1221         }
1222
1223 skip_linkparms:
1224
1225         /*
1226          *      Process options.
1227          */
1228
1229         if (!neigh)
1230                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1231                                        skb->dev, 1);
1232         if (neigh) {
1233                 u8 *lladdr = NULL;
1234                 if (ndopts.nd_opts_src_lladdr) {
1235                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1236                                                      skb->dev);
1237                         if (!lladdr) {
1238                                 ND_PRINTK(2, warn,
1239                                           "RA: invalid link-layer address length\n");
1240                                 goto out;
1241                         }
1242                 }
1243                 neigh_update(neigh, lladdr, NUD_STALE,
1244                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1245                              NEIGH_UPDATE_F_OVERRIDE|
1246                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1247                              NEIGH_UPDATE_F_ISROUTER);
1248         }
1249
1250         if (!accept_ra(in6_dev))
1251                 goto out;
1252
1253 #ifdef CONFIG_IPV6_ROUTE_INFO
1254         if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
1255                 goto skip_routeinfo;
1256
1257         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1258                 struct nd_opt_hdr *p;
1259                 for (p = ndopts.nd_opts_ri;
1260                      p;
1261                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1262                         struct route_info *ri = (struct route_info *)p;
1263 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1264                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1265                             ri->prefix_len == 0)
1266                                 continue;
1267 #endif
1268                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1269                                 continue;
1270                         rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
1271                                       &ipv6_hdr(skb)->saddr);
1272                 }
1273         }
1274
1275 skip_routeinfo:
1276 #endif
1277
1278 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1279         /* skip link-specific ndopts from interior routers */
1280         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
1281                 goto out;
1282 #endif
1283
1284         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1285                 struct nd_opt_hdr *p;
1286                 for (p = ndopts.nd_opts_pi;
1287                      p;
1288                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1289                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1290                                             (p->nd_opt_len) << 3,
1291                                             ndopts.nd_opts_src_lladdr != NULL);
1292                 }
1293         }
1294
1295         if (ndopts.nd_opts_mtu) {
1296                 __be32 n;
1297                 u32 mtu;
1298
1299                 memcpy(&n, ((u8*)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1300                 mtu = ntohl(n);
1301
1302                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1303                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1304                 } else if (in6_dev->cnf.mtu6 != mtu) {
1305                         in6_dev->cnf.mtu6 = mtu;
1306
1307                         if (rt)
1308                                 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1309
1310                         rt6_mtu_change(skb->dev, mtu);
1311                 }
1312         }
1313
1314         if (ndopts.nd_useropts) {
1315                 struct nd_opt_hdr *p;
1316                 for (p = ndopts.nd_useropts;
1317                      p;
1318                      p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1319                         ndisc_ra_useropt(skb, p);
1320                 }
1321         }
1322
1323         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1324                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1325         }
1326 out:
1327         ip6_rt_put(rt);
1328         if (neigh)
1329                 neigh_release(neigh);
1330 }
1331
1332 static void ndisc_redirect_rcv(struct sk_buff *skb)
1333 {
1334 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1335         switch (skb->ndisc_nodetype) {
1336         case NDISC_NODETYPE_HOST:
1337         case NDISC_NODETYPE_NODEFAULT:
1338                 ND_PRINTK(2, warn,
1339                           "Redirect: from host or unauthorized router\n");
1340                 return;
1341         }
1342 #endif
1343
1344         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1345                 ND_PRINTK(2, warn,
1346                           "Redirect: source address is not link-local\n");
1347                 return;
1348         }
1349
1350         icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1351 }
1352
1353 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1354 {
1355         struct net_device *dev = skb->dev;
1356         struct net *net = dev_net(dev);
1357         struct sock *sk = net->ipv6.ndisc_sk;
1358         int len = sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
1359         struct inet_peer *peer;
1360         struct sk_buff *buff;
1361         struct icmp6hdr *icmph;
1362         struct in6_addr saddr_buf;
1363         struct in6_addr *addrp;
1364         struct rt6_info *rt;
1365         struct dst_entry *dst;
1366         struct inet6_dev *idev;
1367         struct flowi6 fl6;
1368         u8 *opt;
1369         int hlen, tlen;
1370         int rd_len;
1371         int err;
1372         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1373         bool ret;
1374
1375         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1376                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1377                           dev->name);
1378                 return;
1379         }
1380
1381         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1382             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1383                 ND_PRINTK(2, warn,
1384                           "Redirect: target address is not link-local unicast\n");
1385                 return;
1386         }
1387
1388         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1389                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1390
1391         dst = ip6_route_output(net, NULL, &fl6);
1392         if (dst->error) {
1393                 dst_release(dst);
1394                 return;
1395         }
1396         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1397         if (IS_ERR(dst))
1398                 return;
1399
1400         rt = (struct rt6_info *) dst;
1401
1402         if (rt->rt6i_flags & RTF_GATEWAY) {
1403                 ND_PRINTK(2, warn,
1404                           "Redirect: destination is not a neighbour\n");
1405                 goto release;
1406         }
1407         peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
1408         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1409         if (peer)
1410                 inet_putpeer(peer);
1411         if (!ret)
1412                 goto release;
1413
1414         if (dev->addr_len) {
1415                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1416                 if (!neigh) {
1417                         ND_PRINTK(2, warn,
1418                                   "Redirect: no neigh for target address\n");
1419                         goto release;
1420                 }
1421
1422                 read_lock_bh(&neigh->lock);
1423                 if (neigh->nud_state & NUD_VALID) {
1424                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1425                         read_unlock_bh(&neigh->lock);
1426                         ha = ha_buf;
1427                         len += ndisc_opt_addr_space(dev);
1428                 } else
1429                         read_unlock_bh(&neigh->lock);
1430
1431                 neigh_release(neigh);
1432         }
1433
1434         rd_len = min_t(unsigned int,
1435                      IPV6_MIN_MTU-sizeof(struct ipv6hdr)-len, skb->len + 8);
1436         rd_len &= ~0x7;
1437         len += rd_len;
1438
1439         hlen = LL_RESERVED_SPACE(dev);
1440         tlen = dev->needed_tailroom;
1441         buff = sock_alloc_send_skb(sk,
1442                                    (MAX_HEADER + sizeof(struct ipv6hdr) +
1443                                     len + hlen + tlen),
1444                                    1, &err);
1445         if (buff == NULL) {
1446                 ND_PRINTK(0, err,
1447                           "Redirect: %s failed to allocate an skb, err=%d\n",
1448                           __func__, err);
1449                 goto release;
1450         }
1451
1452         skb_reserve(buff, hlen);
1453         ip6_nd_hdr(sk, buff, dev, &saddr_buf, &ipv6_hdr(skb)->saddr,
1454                    IPPROTO_ICMPV6, len);
1455
1456         skb_set_transport_header(buff, skb_tail_pointer(buff) - buff->data);
1457         skb_put(buff, len);
1458         icmph = icmp6_hdr(buff);
1459
1460         memset(icmph, 0, sizeof(struct icmp6hdr));
1461         icmph->icmp6_type = NDISC_REDIRECT;
1462
1463         /*
1464          *      copy target and destination addresses
1465          */
1466
1467         addrp = (struct in6_addr *)(icmph + 1);
1468         *addrp = *target;
1469         addrp++;
1470         *addrp = ipv6_hdr(skb)->daddr;
1471
1472         opt = (u8*) (addrp + 1);
1473
1474         /*
1475          *      include target_address option
1476          */
1477
1478         if (ha)
1479                 opt = ndisc_fill_addr_option(opt, ND_OPT_TARGET_LL_ADDR, ha,
1480                                              dev->addr_len, dev->type);
1481
1482         /*
1483          *      build redirect option and copy skb over to the new packet.
1484          */
1485
1486         memset(opt, 0, 8);
1487         *(opt++) = ND_OPT_REDIRECT_HDR;
1488         *(opt++) = (rd_len >> 3);
1489         opt += 6;
1490
1491         memcpy(opt, ipv6_hdr(skb), rd_len - 8);
1492
1493         icmph->icmp6_cksum = csum_ipv6_magic(&saddr_buf, &ipv6_hdr(skb)->saddr,
1494                                              len, IPPROTO_ICMPV6,
1495                                              csum_partial(icmph, len, 0));
1496
1497         skb_dst_set(buff, dst);
1498         rcu_read_lock();
1499         idev = __in6_dev_get(dst->dev);
1500         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
1501         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, buff, NULL, dst->dev,
1502                       dst_output);
1503         if (!err) {
1504                 ICMP6MSGOUT_INC_STATS(net, idev, NDISC_REDIRECT);
1505                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1506         }
1507
1508         rcu_read_unlock();
1509         return;
1510
1511 release:
1512         dst_release(dst);
1513 }
1514
1515 static void pndisc_redo(struct sk_buff *skb)
1516 {
1517         ndisc_recv_ns(skb);
1518         kfree_skb(skb);
1519 }
1520
1521 int ndisc_rcv(struct sk_buff *skb)
1522 {
1523         struct nd_msg *msg;
1524
1525         if (!pskb_may_pull(skb, skb->len))
1526                 return 0;
1527
1528         msg = (struct nd_msg *)skb_transport_header(skb);
1529
1530         __skb_push(skb, skb->data - skb_transport_header(skb));
1531
1532         if (ipv6_hdr(skb)->hop_limit != 255) {
1533                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1534                           ipv6_hdr(skb)->hop_limit);
1535                 return 0;
1536         }
1537
1538         if (msg->icmph.icmp6_code != 0) {
1539                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1540                           msg->icmph.icmp6_code);
1541                 return 0;
1542         }
1543
1544         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1545
1546         switch (msg->icmph.icmp6_type) {
1547         case NDISC_NEIGHBOUR_SOLICITATION:
1548                 ndisc_recv_ns(skb);
1549                 break;
1550
1551         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1552                 ndisc_recv_na(skb);
1553                 break;
1554
1555         case NDISC_ROUTER_SOLICITATION:
1556                 ndisc_recv_rs(skb);
1557                 break;
1558
1559         case NDISC_ROUTER_ADVERTISEMENT:
1560                 ndisc_router_discovery(skb);
1561                 break;
1562
1563         case NDISC_REDIRECT:
1564                 ndisc_redirect_rcv(skb);
1565                 break;
1566         }
1567
1568         return 0;
1569 }
1570
1571 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1572 {
1573         struct net_device *dev = ptr;
1574         struct net *net = dev_net(dev);
1575         struct inet6_dev *idev;
1576
1577         switch (event) {
1578         case NETDEV_CHANGEADDR:
1579                 neigh_changeaddr(&nd_tbl, dev);
1580                 fib6_run_gc(~0UL, net);
1581                 idev = in6_dev_get(dev);
1582                 if (!idev)
1583                         break;
1584                 if (idev->cnf.ndisc_notify)
1585                         ndisc_send_unsol_na(dev);
1586                 in6_dev_put(idev);
1587                 break;
1588         case NETDEV_DOWN:
1589                 neigh_ifdown(&nd_tbl, dev);
1590                 fib6_run_gc(~0UL, net);
1591                 break;
1592         case NETDEV_NOTIFY_PEERS:
1593                 ndisc_send_unsol_na(dev);
1594                 break;
1595         default:
1596                 break;
1597         }
1598
1599         return NOTIFY_DONE;
1600 }
1601
1602 static struct notifier_block ndisc_netdev_notifier = {
1603         .notifier_call = ndisc_netdev_event,
1604 };
1605
1606 #ifdef CONFIG_SYSCTL
1607 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1608                                          const char *func, const char *dev_name)
1609 {
1610         static char warncomm[TASK_COMM_LEN];
1611         static int warned;
1612         if (strcmp(warncomm, current->comm) && warned < 5) {
1613                 strcpy(warncomm, current->comm);
1614                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1615                         warncomm, func,
1616                         dev_name, ctl->procname,
1617                         dev_name, ctl->procname);
1618                 warned++;
1619         }
1620 }
1621
1622 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1623 {
1624         struct net_device *dev = ctl->extra1;
1625         struct inet6_dev *idev;
1626         int ret;
1627
1628         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1629             (strcmp(ctl->procname, "base_reachable_time") == 0))
1630                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1631
1632         if (strcmp(ctl->procname, "retrans_time") == 0)
1633                 ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
1634
1635         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1636                 ret = proc_dointvec_jiffies(ctl, write,
1637                                             buffer, lenp, ppos);
1638
1639         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1640                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1641                 ret = proc_dointvec_ms_jiffies(ctl, write,
1642                                                buffer, lenp, ppos);
1643         else
1644                 ret = -1;
1645
1646         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1647                 if (ctl->data == &idev->nd_parms->base_reachable_time)
1648                         idev->nd_parms->reachable_time = neigh_rand_reach_time(idev->nd_parms->base_reachable_time);
1649                 idev->tstamp = jiffies;
1650                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1651                 in6_dev_put(idev);
1652         }
1653         return ret;
1654 }
1655
1656
1657 #endif
1658
1659 static int __net_init ndisc_net_init(struct net *net)
1660 {
1661         struct ipv6_pinfo *np;
1662         struct sock *sk;
1663         int err;
1664
1665         err = inet_ctl_sock_create(&sk, PF_INET6,
1666                                    SOCK_RAW, IPPROTO_ICMPV6, net);
1667         if (err < 0) {
1668                 ND_PRINTK(0, err,
1669                           "NDISC: Failed to initialize the control socket (err %d)\n",
1670                           err);
1671                 return err;
1672         }
1673
1674         net->ipv6.ndisc_sk = sk;
1675
1676         np = inet6_sk(sk);
1677         np->hop_limit = 255;
1678         /* Do not loopback ndisc messages */
1679         np->mc_loop = 0;
1680
1681         return 0;
1682 }
1683
1684 static void __net_exit ndisc_net_exit(struct net *net)
1685 {
1686         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1687 }
1688
1689 static struct pernet_operations ndisc_net_ops = {
1690         .init = ndisc_net_init,
1691         .exit = ndisc_net_exit,
1692 };
1693
1694 int __init ndisc_init(void)
1695 {
1696         int err;
1697
1698         err = register_pernet_subsys(&ndisc_net_ops);
1699         if (err)
1700                 return err;
1701         /*
1702          * Initialize the neighbour table
1703          */
1704         neigh_table_init(&nd_tbl);
1705
1706 #ifdef CONFIG_SYSCTL
1707         err = neigh_sysctl_register(NULL, &nd_tbl.parms, "ipv6",
1708                                     &ndisc_ifinfo_sysctl_change);
1709         if (err)
1710                 goto out_unregister_pernet;
1711 #endif
1712         err = register_netdevice_notifier(&ndisc_netdev_notifier);
1713         if (err)
1714                 goto out_unregister_sysctl;
1715 out:
1716         return err;
1717
1718 out_unregister_sysctl:
1719 #ifdef CONFIG_SYSCTL
1720         neigh_sysctl_unregister(&nd_tbl.parms);
1721 out_unregister_pernet:
1722 #endif
1723         unregister_pernet_subsys(&ndisc_net_ops);
1724         goto out;
1725 }
1726
1727 void ndisc_cleanup(void)
1728 {
1729         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1730 #ifdef CONFIG_SYSCTL
1731         neigh_sysctl_unregister(&nd_tbl.parms);
1732 #endif
1733         neigh_table_clear(&nd_tbl);
1734         unregister_pernet_subsys(&ndisc_net_ops);
1735 }