net/ipv6/ndisc.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Neighbour Discovery for IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Mike Shaver             <shaver@ingenia.com>
   9  */
  10
  11 /*
  12  *      Changes:
  13  *
  14  *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  15  *      Pierre Ynard                    :       export userland ND options
  16  *                                              through netlink (RDNSS support)
  17  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  18  *                                              of an RA.
  19  *      Janos Farkas                    :       kmalloc failure checks
  20  *      Alexey Kuznetsov                :       state machine reworked
  21  *                                              and moved to net/core.
  22  *      Pekka Savola                    :       RFC2461 validation
  23  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  24  */
  25
  26 #define pr_fmt(fmt) "ICMPv6: " fmt
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/sched.h>
  34 #include <linux/net.h>
  35 #include <linux/in6.h>
  36 #include <linux/route.h>
  37 #include <linux/init.h>
  38 #include <linux/rcupdate.h>
  39 #include <linux/slab.h>
  40 #ifdef CONFIG_SYSCTL
  41 #include <linux/sysctl.h>
  42 #endif
  43
  44 #include <linux/if_addr.h>
  45 #include <linux/if_ether.h>
  46 #include <linux/if_arp.h>
  47 #include <linux/ipv6.h>
  48 #include <linux/icmpv6.h>
  49 #include <linux/jhash.h>
  50
  51 #include <net/sock.h>
  52 #include <net/snmp.h>
  53
  54 #include <net/ipv6.h>
  55 #include <net/protocol.h>
  56 #include <net/ndisc.h>
  57 #include <net/ip6_route.h>
  58 #include <net/addrconf.h>
  59 #include <net/icmp.h>
  60
  61 #include <net/netlink.h>
  62 #include <linux/rtnetlink.h>
  63
  64 #include <net/flow.h>
  65 #include <net/ip6_checksum.h>
  66 #include <net/inet_common.h>
  67 #include <linux/proc_fs.h>
  68
  69 #include <linux/netfilter.h>
  70 #include <linux/netfilter_ipv6.h>
  71
  72 static u32 ndisc_hash(const void *pkey,
  73                       const struct net_device *dev,
  74                       __u32 *hash_rnd);
  75 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
  76 static bool ndisc_allow_add(const struct net_device *dev,
  77                             struct netlink_ext_ack *extack);
  78 static int ndisc_constructor(struct neighbour *neigh);
  79 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  80 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  81 static int pndisc_constructor(struct pneigh_entry *n);
  82 static void pndisc_destructor(struct pneigh_entry *n);
  83 static void pndisc_redo(struct sk_buff *skb);
  84 static int ndisc_is_multicast(const void *pkey);
  85
  86 static const struct neigh_ops ndisc_generic_ops = {
  87         .family =               AF_INET6,
  88         .solicit =              ndisc_solicit,
  89         .error_report =         ndisc_error_report,
  90         .output =               neigh_resolve_output,
  91         .connected_output =     neigh_connected_output,
  92 };
  93
  94 static const struct neigh_ops ndisc_hh_ops = {
  95         .family =               AF_INET6,
  96         .solicit =              ndisc_solicit,
  97         .error_report =         ndisc_error_report,
  98         .output =               neigh_resolve_output,
  99         .connected_output =     neigh_resolve_output,
 100 };
 101
 102
 103 static const struct neigh_ops ndisc_direct_ops = {
 104         .family =               AF_INET6,
 105         .output =               neigh_direct_output,
 106         .connected_output =     neigh_direct_output,
 107 };
 108
 109 struct neigh_table nd_tbl = {
 110         .family =       AF_INET6,
 111         .key_len =      sizeof(struct in6_addr),
 112         .protocol =     cpu_to_be16(ETH_P_IPV6),
 113         .hash =         ndisc_hash,
 114         .key_eq =       ndisc_key_eq,
 115         .constructor =  ndisc_constructor,
 116         .pconstructor = pndisc_constructor,
 117         .pdestructor =  pndisc_destructor,
 118         .proxy_redo =   pndisc_redo,
 119         .is_multicast = ndisc_is_multicast,
 120         .allow_add  =   ndisc_allow_add,
 121         .id =           "ndisc_cache",
 122         .parms = {
 123                 .tbl                    = &nd_tbl,
 124                 .reachable_time         = ND_REACHABLE_TIME,
 125                 .data = {
 126                         [NEIGH_VAR_MCAST_PROBES] = 3,
 127                         [NEIGH_VAR_UCAST_PROBES] = 3,
 128                         [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
 129                         [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
 130                         [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 131                         [NEIGH_VAR_INTERVAL_PROBE_TIME_MS] = 5 * HZ,
 132                         [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 133                         [NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
 134                         [NEIGH_VAR_PROXY_QLEN] = 64,
 135                         [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 136                         [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
 137                 },
 138         },
 139         .gc_interval =    30 * HZ,
 140         .gc_thresh1 =    128,
 141         .gc_thresh2 =    512,
 142         .gc_thresh3 =   1024,
 143 };
 144 EXPORT_SYMBOL_GPL(nd_tbl);
 145
 146 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, const void *data,
 147                               int data_len, int pad)
 148 {
 149         int space = __ndisc_opt_addr_space(data_len, pad);
 150         u8 *opt = skb_put(skb, space);
 151
 152         opt[0] = type;
 153         opt[1] = space>>3;
 154
 155         memset(opt + 2, 0, pad);
 156         opt   += pad;
 157         space -= pad;
 158
 159         memcpy(opt+2, data, data_len);
 160         data_len += 2;
 161         opt += data_len;
 162         space -= data_len;
 163         if (space > 0)
 164                 memset(opt, 0, space);
 165 }
 166 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
 167
 168 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
 169                                           const void *data, u8 icmp6_type)
 170 {
 171         __ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
 172                                  ndisc_addr_option_pad(skb->dev->type));
 173         ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
 174 }
 175
 176 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
 177                                                    void *ha,
 178                                                    const u8 *ops_data)
 179 {
 180         ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
 181         ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
 182 }
 183
 184 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 185                                             struct nd_opt_hdr *end)
 186 {
 187         int type;
 188         if (!cur || !end || cur >= end)
 189                 return NULL;
 190         type = cur->nd_opt_type;
 191         do {
 192                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 193         } while (cur < end && cur->nd_opt_type != type);
 194         return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 195 }
 196
 197 static inline int ndisc_is_useropt(const struct net_device *dev,
 198                                    struct nd_opt_hdr *opt)
 199 {
 200         return opt->nd_opt_type == ND_OPT_PREFIX_INFO ||
 201                 opt->nd_opt_type == ND_OPT_RDNSS ||
 202                 opt->nd_opt_type == ND_OPT_DNSSL ||
 203                 opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
 204                 opt->nd_opt_type == ND_OPT_PREF64 ||
 205                 ndisc_ops_is_useropt(dev, opt->nd_opt_type);
 206 }
 207
 208 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
 209                                              struct nd_opt_hdr *cur,
 210                                              struct nd_opt_hdr *end)
 211 {
 212         if (!cur || !end || cur >= end)
 213                 return NULL;
 214         do {
 215                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 216         } while (cur < end && !ndisc_is_useropt(dev, cur));
 217         return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
 218 }
 219
 220 struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
 221                                           u8 *opt, int opt_len,
 222                                           struct ndisc_options *ndopts)
 223 {
 224         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 225
 226         if (!nd_opt || opt_len < 0 || !ndopts)
 227                 return NULL;
 228         memset(ndopts, 0, sizeof(*ndopts));
 229         while (opt_len) {
 230                 int l;
 231                 if (opt_len < sizeof(struct nd_opt_hdr))
 232                         return NULL;
 233                 l = nd_opt->nd_opt_len << 3;
 234                 if (opt_len < l || l == 0)
 235                         return NULL;
 236                 if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
 237                         goto next_opt;
 238                 switch (nd_opt->nd_opt_type) {
 239                 case ND_OPT_SOURCE_LL_ADDR:
 240                 case ND_OPT_TARGET_LL_ADDR:
 241                 case ND_OPT_MTU:
 242                 case ND_OPT_NONCE:
 243                 case ND_OPT_REDIRECT_HDR:
 244                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 245                                 ND_PRINTK(2, warn,
 246                                           "%s: duplicated ND6 option found: type=%d\n",
 247                                           __func__, nd_opt->nd_opt_type);
 248                         } else {
 249                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 250                         }
 251                         break;
 252                 case ND_OPT_PREFIX_INFO:
 253                         ndopts->nd_opts_pi_end = nd_opt;
 254                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 255                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 256                         break;
 257 #ifdef CONFIG_IPV6_ROUTE_INFO
 258                 case ND_OPT_ROUTE_INFO:
 259                         ndopts->nd_opts_ri_end = nd_opt;
 260                         if (!ndopts->nd_opts_ri)
 261                                 ndopts->nd_opts_ri = nd_opt;
 262                         break;
 263 #endif
 264                 default:
 265                         if (ndisc_is_useropt(dev, nd_opt)) {
 266                                 ndopts->nd_useropts_end = nd_opt;
 267                                 if (!ndopts->nd_useropts)
 268                                         ndopts->nd_useropts = nd_opt;
 269                         } else {
 270                                 /*
 271                                  * Unknown options must be silently ignored,
 272                                  * to accommodate future extension to the
 273                                  * protocol.
 274                                  */
 275                                 ND_PRINTK(2, notice,
 276                                           "%s: ignored unsupported option; type=%d, len=%d\n",
 277                                           __func__,
 278                                           nd_opt->nd_opt_type,
 279                                           nd_opt->nd_opt_len);
 280                         }
 281                 }
 282 next_opt:
 283                 opt_len -= l;
 284                 nd_opt = ((void *)nd_opt) + l;
 285         }
 286         return ndopts;
 287 }
 288
 289 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 290 {
 291         switch (dev->type) {
 292         case ARPHRD_ETHER:
 293         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 294         case ARPHRD_FDDI:
 295                 ipv6_eth_mc_map(addr, buf);
 296                 return 0;
 297         case ARPHRD_ARCNET:
 298                 ipv6_arcnet_mc_map(addr, buf);
 299                 return 0;
 300         case ARPHRD_INFINIBAND:
 301                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 302                 return 0;
 303         case ARPHRD_IPGRE:
 304                 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
 305         default:
 306                 if (dir) {
 307                         memcpy(buf, dev->broadcast, dev->addr_len);
 308                         return 0;
 309                 }
 310         }
 311         return -EINVAL;
 312 }
 313 EXPORT_SYMBOL(ndisc_mc_map);
 314
 315 static u32 ndisc_hash(const void *pkey,
 316                       const struct net_device *dev,
 317                       __u32 *hash_rnd)
 318 {
 319         return ndisc_hashfn(pkey, dev, hash_rnd);
 320 }
 321
 322 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
 323 {
 324         return neigh_key_eq128(n, pkey);
 325 }
 326
 327 static int ndisc_constructor(struct neighbour *neigh)
 328 {
 329         struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
 330         struct net_device *dev = neigh->dev;
 331         struct inet6_dev *in6_dev;
 332         struct neigh_parms *parms;
 333         bool is_multicast = ipv6_addr_is_multicast(addr);
 334
 335         in6_dev = in6_dev_get(dev);
 336         if (!in6_dev) {
 337                 return -EINVAL;
 338         }
 339
 340         parms = in6_dev->nd_parms;
 341         __neigh_parms_put(neigh->parms);
 342         neigh->parms = neigh_parms_clone(parms);
 343
 344         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 345         if (!dev->header_ops) {
 346                 neigh->nud_state = NUD_NOARP;
 347                 neigh->ops = &ndisc_direct_ops;
 348                 neigh->output = neigh_direct_output;
 349         } else {
 350                 if (is_multicast) {
 351                         neigh->nud_state = NUD_NOARP;
 352                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 353                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 354                         neigh->nud_state = NUD_NOARP;
 355                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 356                         if (dev->flags&IFF_LOOPBACK)
 357                                 neigh->type = RTN_LOCAL;
 358                 } else if (dev->flags&IFF_POINTOPOINT) {
 359                         neigh->nud_state = NUD_NOARP;
 360                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 361                 }
 362                 if (dev->header_ops->cache)
 363                         neigh->ops = &ndisc_hh_ops;
 364                 else
 365                         neigh->ops = &ndisc_generic_ops;
 366                 if (neigh->nud_state&NUD_VALID)
 367                         neigh->output = neigh->ops->connected_output;
 368                 else
 369                         neigh->output = neigh->ops->output;
 370         }
 371         in6_dev_put(in6_dev);
 372         return 0;
 373 }
 374
 375 static int pndisc_constructor(struct pneigh_entry *n)
 376 {
 377         struct in6_addr *addr = (struct in6_addr *)&n->key;
 378         struct in6_addr maddr;
 379         struct net_device *dev = n->dev;
 380
 381         if (!dev || !__in6_dev_get(dev))
 382                 return -EINVAL;
 383         addrconf_addr_solict_mult(addr, &maddr);
 384         ipv6_dev_mc_inc(dev, &maddr);
 385         return 0;
 386 }
 387
 388 static void pndisc_destructor(struct pneigh_entry *n)
 389 {
 390         struct in6_addr *addr = (struct in6_addr *)&n->key;
 391         struct in6_addr maddr;
 392         struct net_device *dev = n->dev;
 393
 394         if (!dev || !__in6_dev_get(dev))
 395                 return;
 396         addrconf_addr_solict_mult(addr, &maddr);
 397         ipv6_dev_mc_dec(dev, &maddr);
 398 }
 399
 400 /* called with rtnl held */
 401 static bool ndisc_allow_add(const struct net_device *dev,
 402                             struct netlink_ext_ack *extack)
 403 {
 404         struct inet6_dev *idev = __in6_dev_get(dev);
 405
 406         if (!idev || idev->cnf.disable_ipv6) {
 407                 NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device");
 408                 return false;
 409         }
 410
 411         return true;
 412 }
 413
 414 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
 415                                        int len)
 416 {
 417         int hlen = LL_RESERVED_SPACE(dev);
 418         int tlen = dev->needed_tailroom;
 419         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
 420         struct sk_buff *skb;
 421
 422         skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
 423         if (!skb) {
 424                 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
 425                           __func__);
 426                 return NULL;
 427         }
 428
 429         skb->protocol = htons(ETH_P_IPV6);
 430         skb->dev = dev;
 431
 432         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
 433         skb_reset_transport_header(skb);
 434
 435         /* Manually assign socket ownership as we avoid calling
 436          * sock_alloc_send_pskb() to bypass wmem buffer limits
 437          */
 438         skb_set_owner_w(skb, sk);
 439
 440         return skb;
 441 }
 442
 443 static void ip6_nd_hdr(struct sk_buff *skb,
 444                        const struct in6_addr *saddr,
 445                        const struct in6_addr *daddr,
 446                        int hop_limit, int len)
 447 {
 448         struct ipv6hdr *hdr;
 449         struct inet6_dev *idev;
 450         unsigned tclass;
 451
 452         rcu_read_lock();
 453         idev = __in6_dev_get(skb->dev);
 454         tclass = idev ? READ_ONCE(idev->cnf.ndisc_tclass) : 0;
 455         rcu_read_unlock();
 456
 457         skb_push(skb, sizeof(*hdr));
 458         skb_reset_network_header(skb);
 459         hdr = ipv6_hdr(skb);
 460
 461         ip6_flow_hdr(hdr, tclass, 0);
 462
 463         hdr->payload_len = htons(len);
 464         hdr->nexthdr = IPPROTO_ICMPV6;
 465         hdr->hop_limit = hop_limit;
 466
 467         hdr->saddr = *saddr;
 468         hdr->daddr = *daddr;
 469 }
 470
 471 void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
 472                     const struct in6_addr *saddr)
 473 {
 474         struct dst_entry *dst = skb_dst(skb);
 475         struct net *net = dev_net(skb->dev);
 476         struct sock *sk = net->ipv6.ndisc_sk;
 477         struct inet6_dev *idev;
 478         int err;
 479         struct icmp6hdr *icmp6h = icmp6_hdr(skb);
 480         u8 type;
 481
 482         type = icmp6h->icmp6_type;
 483
 484         if (!dst) {
 485                 struct flowi6 fl6;
 486                 int oif = skb->dev->ifindex;
 487
 488                 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
 489                 dst = icmp6_dst_alloc(skb->dev, &fl6);
 490                 if (IS_ERR(dst)) {
 491                         kfree_skb(skb);
 492                         return;
 493                 }
 494
 495                 skb_dst_set(skb, dst);
 496         }
 497
 498         icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
 499                                               IPPROTO_ICMPV6,
 500                                               csum_partial(icmp6h,
 501                                                            skb->len, 0));
 502
 503         ip6_nd_hdr(skb, saddr, daddr, READ_ONCE(inet6_sk(sk)->hop_limit), skb->len);
 504
 505         rcu_read_lock();
 506         idev = __in6_dev_get(dst->dev);
 507         IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
 508
 509         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
 510                       net, sk, skb, NULL, dst->dev,
 511                       dst_output);
 512         if (!err) {
 513                 ICMP6MSGOUT_INC_STATS(net, idev, type);
 514                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
 515         }
 516
 517         rcu_read_unlock();
 518 }
 519 EXPORT_SYMBOL(ndisc_send_skb);
 520
 521 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
 522                    const struct in6_addr *solicited_addr,
 523                    bool router, bool solicited, bool override, bool inc_opt)
 524 {
 525         struct sk_buff *skb;
 526         struct in6_addr tmpaddr;
 527         struct inet6_ifaddr *ifp;
 528         const struct in6_addr *src_addr;
 529         struct nd_msg *msg;
 530         int optlen = 0;
 531
 532         /* for anycast or proxy, solicited_addr != src_addr */
 533         ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
 534         if (ifp) {
 535                 src_addr = solicited_addr;
 536                 if (ifp->flags & IFA_F_OPTIMISTIC)
 537                         override = false;
 538                 inc_opt |= READ_ONCE(ifp->idev->cnf.force_tllao);
 539                 in6_ifa_put(ifp);
 540         } else {
 541                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 542                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
 543                                        &tmpaddr))
 544                         return;
 545                 src_addr = &tmpaddr;
 546         }
 547
 548         if (!dev->addr_len)
 549                 inc_opt = false;
 550         if (inc_opt)
 551                 optlen += ndisc_opt_addr_space(dev,
 552                                                NDISC_NEIGHBOUR_ADVERTISEMENT);
 553
 554         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 555         if (!skb)
 556                 return;
 557
 558         msg = skb_put(skb, sizeof(*msg));
 559         *msg = (struct nd_msg) {
 560                 .icmph = {
 561                         .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 562                         .icmp6_router = router,
 563                         .icmp6_solicited = solicited,
 564                         .icmp6_override = override,
 565                 },
 566                 .target = *solicited_addr,
 567         };
 568
 569         if (inc_opt)
 570                 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
 571                                        dev->dev_addr,
 572                                        NDISC_NEIGHBOUR_ADVERTISEMENT);
 573
 574         ndisc_send_skb(skb, daddr, src_addr);
 575 }
 576
 577 static void ndisc_send_unsol_na(struct net_device *dev)
 578 {
 579         struct inet6_dev *idev;
 580         struct inet6_ifaddr *ifa;
 581
 582         idev = in6_dev_get(dev);
 583         if (!idev)
 584                 return;
 585
 586         read_lock_bh(&idev->lock);
 587         list_for_each_entry(ifa, &idev->addr_list, if_list) {
 588                 /* skip tentative addresses until dad completes */
 589                 if (ifa->flags & IFA_F_TENTATIVE &&
 590                     !(ifa->flags & IFA_F_OPTIMISTIC))
 591                         continue;
 592
 593                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
 594                               /*router=*/ !!idev->cnf.forwarding,
 595                               /*solicited=*/ false, /*override=*/ true,
 596                               /*inc_opt=*/ true);
 597         }
 598         read_unlock_bh(&idev->lock);
 599
 600         in6_dev_put(idev);
 601 }
 602
 603 struct sk_buff *ndisc_ns_create(struct net_device *dev, const struct in6_addr *solicit,
 604                                 const struct in6_addr *saddr, u64 nonce)
 605 {
 606         int inc_opt = dev->addr_len;
 607         struct sk_buff *skb;
 608         struct nd_msg *msg;
 609         int optlen = 0;
 610
 611         if (!saddr)
 612                 return NULL;
 613
 614         if (ipv6_addr_any(saddr))
 615                 inc_opt = false;
 616         if (inc_opt)
 617                 optlen += ndisc_opt_addr_space(dev,
 618                                                NDISC_NEIGHBOUR_SOLICITATION);
 619         if (nonce != 0)
 620                 optlen += 8;
 621
 622         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 623         if (!skb)
 624                 return NULL;
 625
 626         msg = skb_put(skb, sizeof(*msg));
 627         *msg = (struct nd_msg) {
 628                 .icmph = {
 629                         .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 630                 },
 631                 .target = *solicit,
 632         };
 633
 634         if (inc_opt)
 635                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 636                                        dev->dev_addr,
 637                                        NDISC_NEIGHBOUR_SOLICITATION);
 638         if (nonce != 0) {
 639                 u8 *opt = skb_put(skb, 8);
 640
 641                 opt[0] = ND_OPT_NONCE;
 642                 opt[1] = 8 >> 3;
 643                 memcpy(opt + 2, &nonce, 6);
 644         }
 645
 646         return skb;
 647 }
 648 EXPORT_SYMBOL(ndisc_ns_create);
 649
 650 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
 651                    const struct in6_addr *daddr, const struct in6_addr *saddr,
 652                    u64 nonce)
 653 {
 654         struct in6_addr addr_buf;
 655         struct sk_buff *skb;
 656
 657         if (!saddr) {
 658                 if (ipv6_get_lladdr(dev, &addr_buf,
 659                                     (IFA_F_TENTATIVE | IFA_F_OPTIMISTIC)))
 660                         return;
 661                 saddr = &addr_buf;
 662         }
 663
 664         skb = ndisc_ns_create(dev, solicit, saddr, nonce);
 665
 666         if (skb)
 667                 ndisc_send_skb(skb, daddr, saddr);
 668 }
 669
 670 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
 671                    const struct in6_addr *daddr)
 672 {
 673         struct sk_buff *skb;
 674         struct rs_msg *msg;
 675         int send_sllao = dev->addr_len;
 676         int optlen = 0;
 677
 678 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 679         /*
 680          * According to section 2.2 of RFC 4429, we must not
 681          * send router solicitations with a sllao from
 682          * optimistic addresses, but we may send the solicitation
 683          * if we don't include the sllao.  So here we check
 684          * if our address is optimistic, and if so, we
 685          * suppress the inclusion of the sllao.
 686          */
 687         if (send_sllao) {
 688                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
 689                                                            dev, 1);
 690                 if (ifp) {
 691                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 692                                 send_sllao = 0;
 693                         }
 694                         in6_ifa_put(ifp);
 695                 } else {
 696                         send_sllao = 0;
 697                 }
 698         }
 699 #endif
 700         if (send_sllao)
 701                 optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
 702
 703         skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
 704         if (!skb)
 705                 return;
 706
 707         msg = skb_put(skb, sizeof(*msg));
 708         *msg = (struct rs_msg) {
 709                 .icmph = {
 710                         .icmp6_type = NDISC_ROUTER_SOLICITATION,
 711                 },
 712         };
 713
 714         if (send_sllao)
 715                 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
 716                                        dev->dev_addr,
 717                                        NDISC_ROUTER_SOLICITATION);
 718
 719         ndisc_send_skb(skb, daddr, saddr);
 720 }
 721
 722
 723 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 724 {
 725         /*
 726          *      "The sender MUST return an ICMP
 727          *       destination unreachable"
 728          */
 729         dst_link_failure(skb);
 730         kfree_skb(skb);
 731 }
 732
 733 /* Called with locked neigh: either read or both */
 734
 735 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 736 {
 737         struct in6_addr *saddr = NULL;
 738         struct in6_addr mcaddr;
 739         struct net_device *dev = neigh->dev;
 740         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 741         int probes = atomic_read(&neigh->probes);
 742
 743         if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
 744                                            dev, false, 1,
 745                                            IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
 746                 saddr = &ipv6_hdr(skb)->saddr;
 747         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 748         if (probes < 0) {
 749                 if (!(READ_ONCE(neigh->nud_state) & NUD_VALID)) {
 750                         ND_PRINTK(1, dbg,
 751                                   "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
 752                                   __func__, target);
 753                 }
 754                 ndisc_send_ns(dev, target, target, saddr, 0);
 755         } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
 756                 neigh_app_ns(neigh);
 757         } else {
 758                 addrconf_addr_solict_mult(target, &mcaddr);
 759                 ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
 760         }
 761 }
 762
 763 static int pndisc_is_router(const void *pkey,
 764                             struct net_device *dev)
 765 {
 766         struct pneigh_entry *n;
 767         int ret = -1;
 768
 769         read_lock_bh(&nd_tbl.lock);
 770         n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
 771         if (n)
 772                 ret = !!(n->flags & NTF_ROUTER);
 773         read_unlock_bh(&nd_tbl.lock);
 774
 775         return ret;
 776 }
 777
 778 void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
 779                   const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
 780                   struct ndisc_options *ndopts)
 781 {
 782         neigh_update(neigh, lladdr, new, flags, 0);
 783         /* report ndisc ops about neighbour update */
 784         ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
 785 }
 786
 787 static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb)
 788 {
 789         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 790         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 791         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 792         u8 *lladdr = NULL;
 793         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 794                                     offsetof(struct nd_msg, opt));
 795         struct ndisc_options ndopts;
 796         struct net_device *dev = skb->dev;
 797         struct inet6_ifaddr *ifp;
 798         struct inet6_dev *idev = NULL;
 799         struct neighbour *neigh;
 800         int dad = ipv6_addr_any(saddr);
 801         int is_router = -1;
 802         SKB_DR(reason);
 803         u64 nonce = 0;
 804         bool inc;
 805
 806         if (skb->len < sizeof(struct nd_msg))
 807                 return SKB_DROP_REASON_PKT_TOO_SMALL;
 808
 809         if (ipv6_addr_is_multicast(&msg->target)) {
 810                 ND_PRINTK(2, warn, "NS: multicast target address\n");
 811                 return reason;
 812         }
 813
 814         /*
 815          * RFC2461 7.1.1:
 816          * DAD has to be destined for solicited node multicast address.
 817          */
 818         if (dad && !ipv6_addr_is_solict_mult(daddr)) {
 819                 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
 820                 return reason;
 821         }
 822
 823         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts))
 824                 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
 825
 826         if (ndopts.nd_opts_src_lladdr) {
 827                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 828                 if (!lladdr) {
 829                         ND_PRINTK(2, warn,
 830                                   "NS: invalid link-layer address length\n");
 831                         return reason;
 832                 }
 833
 834                 /* RFC2461 7.1.1:
 835                  *      If the IP source address is the unspecified address,
 836                  *      there MUST NOT be source link-layer address option
 837                  *      in the message.
 838                  */
 839                 if (dad) {
 840                         ND_PRINTK(2, warn,
 841                                   "NS: bad DAD packet (link-layer address option)\n");
 842                         return reason;
 843                 }
 844         }
 845         if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
 846                 memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
 847
 848         inc = ipv6_addr_is_multicast(daddr);
 849
 850         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
 851         if (ifp) {
 852 have_ifp:
 853                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 854                         if (dad) {
 855                                 if (nonce != 0 && ifp->dad_nonce == nonce) {
 856                                         u8 *np = (u8 *)&nonce;
 857                                         /* Matching nonce if looped back */
 858                                         ND_PRINTK(2, notice,
 859                                                   "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
 860                                                   ifp->idev->dev->name,
 861                                                   &ifp->addr, np);
 862                                         goto out;
 863                                 }
 864                                 /*
 865                                  * We are colliding with another node
 866                                  * who is doing DAD
 867                                  * so fail our DAD process
 868                                  */
 869                                 addrconf_dad_failure(skb, ifp);
 870                                 return reason;
 871                         } else {
 872                                 /*
 873                                  * This is not a dad solicitation.
 874                                  * If we are an optimistic node,
 875                                  * we should respond.
 876                                  * Otherwise, we should ignore it.
 877                                  */
 878                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 879                                         goto out;
 880                         }
 881                 }
 882
 883                 idev = ifp->idev;
 884         } else {
 885                 struct net *net = dev_net(dev);
 886
 887                 /* perhaps an address on the master device */
 888                 if (netif_is_l3_slave(dev)) {
 889                         struct net_device *mdev;
 890
 891                         mdev = netdev_master_upper_dev_get_rcu(dev);
 892                         if (mdev) {
 893                                 ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
 894                                 if (ifp)
 895                                         goto have_ifp;
 896                         }
 897                 }
 898
 899                 idev = in6_dev_get(dev);
 900                 if (!idev) {
 901                         /* XXX: count this drop? */
 902                         return reason;
 903                 }
 904
 905                 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
 906                     (READ_ONCE(idev->cnf.forwarding) &&
 907                      (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) ||
 908                       READ_ONCE(idev->cnf.proxy_ndp)) &&
 909                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
 910                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 911                             skb->pkt_type != PACKET_HOST &&
 912                             inc &&
 913                             NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
 914                                 /*
 915                                  * for anycast or proxy,
 916                                  * sender should delay its response
 917                                  * by a random time between 0 and
 918                                  * MAX_ANYCAST_DELAY_TIME seconds.
 919                                  * (RFC2461) -- yoshfuji
 920                                  */
 921                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 922                                 if (n)
 923                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 924                                 goto out;
 925                         }
 926                 } else {
 927                         SKB_DR_SET(reason, IPV6_NDISC_NS_OTHERHOST);
 928                         goto out;
 929                 }
 930         }
 931
 932         if (is_router < 0)
 933                 is_router = READ_ONCE(idev->cnf.forwarding);
 934
 935         if (dad) {
 936                 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
 937                               !!is_router, false, (ifp != NULL), true);
 938                 goto out;
 939         }
 940
 941         if (inc)
 942                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 943         else
 944                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 945
 946         /*
 947          *      update / create cache entry
 948          *      for the source address
 949          */
 950         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 951                                !inc || lladdr || !dev->addr_len);
 952         if (neigh)
 953                 ndisc_update(dev, neigh, lladdr, NUD_STALE,
 954                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 955                              NEIGH_UPDATE_F_OVERRIDE,
 956                              NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
 957         if (neigh || !dev->header_ops) {
 958                 ndisc_send_na(dev, saddr, &msg->target, !!is_router,
 959                               true, (ifp != NULL && inc), inc);
 960                 if (neigh)
 961                         neigh_release(neigh);
 962                 reason = SKB_CONSUMED;
 963         }
 964
 965 out:
 966         if (ifp)
 967                 in6_ifa_put(ifp);
 968         else
 969                 in6_dev_put(idev);
 970         return reason;
 971 }
 972
 973 static int accept_untracked_na(struct net_device *dev, struct in6_addr *saddr)
 974 {
 975         struct inet6_dev *idev = __in6_dev_get(dev);
 976
 977         switch (READ_ONCE(idev->cnf.accept_untracked_na)) {
 978         case 0: /* Don't accept untracked na (absent in neighbor cache) */
 979                 return 0;
 980         case 1: /* Create new entries from na if currently untracked */
 981                 return 1;
 982         case 2: /* Create new entries from untracked na only if saddr is in the
 983                  * same subnet as an address configured on the interface that
 984                  * received the na
 985                  */
 986                 return !!ipv6_chk_prefix(saddr, dev);
 987         default:
 988                 return 0;
 989         }
 990 }
 991
 992 static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb)
 993 {
 994         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 995         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 996         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 997         u8 *lladdr = NULL;
 998         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
 999                                     offsetof(struct nd_msg, opt));
1000         struct ndisc_options ndopts;
1001         struct net_device *dev = skb->dev;
1002         struct inet6_dev *idev = __in6_dev_get(dev);
1003         struct inet6_ifaddr *ifp;
1004         struct neighbour *neigh;
1005         SKB_DR(reason);
1006         u8 new_state;
1007
1008         if (skb->len < sizeof(struct nd_msg))
1009                 return SKB_DROP_REASON_PKT_TOO_SMALL;
1010
1011         if (ipv6_addr_is_multicast(&msg->target)) {
1012                 ND_PRINTK(2, warn, "NA: target address is multicast\n");
1013                 return reason;
1014         }
1015
1016         if (ipv6_addr_is_multicast(daddr) &&
1017             msg->icmph.icmp6_solicited) {
1018                 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
1019                 return reason;
1020         }
1021
1022         /* For some 802.11 wireless deployments (and possibly other networks),
1023          * there will be a NA proxy and unsolicitd packets are attacks
1024          * and thus should not be accepted.
1025          * drop_unsolicited_na takes precedence over accept_untracked_na
1026          */
1027         if (!msg->icmph.icmp6_solicited && idev &&
1028             READ_ONCE(idev->cnf.drop_unsolicited_na))
1029                 return reason;
1030
1031         if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts))
1032                 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1033
1034         if (ndopts.nd_opts_tgt_lladdr) {
1035                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
1036                 if (!lladdr) {
1037                         ND_PRINTK(2, warn,
1038                                   "NA: invalid link-layer address length\n");
1039                         return reason;
1040                 }
1041         }
1042         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
1043         if (ifp) {
1044                 if (skb->pkt_type != PACKET_LOOPBACK
1045                     && (ifp->flags & IFA_F_TENTATIVE)) {
1046                                 addrconf_dad_failure(skb, ifp);
1047                                 return reason;
1048                 }
1049                 /* What should we make now? The advertisement
1050                    is invalid, but ndisc specs say nothing
1051                    about it. It could be misconfiguration, or
1052                    an smart proxy agent tries to help us :-)
1053
1054                    We should not print the error if NA has been
1055                    received from loopback - it is just our own
1056                    unsolicited advertisement.
1057                  */
1058                 if (skb->pkt_type != PACKET_LOOPBACK)
1059                         ND_PRINTK(1, warn,
1060                                   "NA: %pM advertised our address %pI6c on %s!\n",
1061                                   eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1062                 in6_ifa_put(ifp);
1063                 return reason;
1064         }
1065
1066         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1067
1068         /* RFC 9131 updates original Neighbour Discovery RFC 4861.
1069          * NAs with Target LL Address option without a corresponding
1070          * entry in the neighbour cache can now create a STALE neighbour
1071          * cache entry on routers.
1072          *
1073          *   entry accept  fwding  solicited        behaviour
1074          * ------- ------  ------  ---------    ----------------------
1075          * present      X       X         0     Set state to STALE
1076          * present      X       X         1     Set state to REACHABLE
1077          *  absent      0       X         X     Do nothing
1078          *  absent      1       0         X     Do nothing
1079          *  absent      1       1         X     Add a new STALE entry
1080          *
1081          * Note that we don't do a (daddr == all-routers-mcast) check.
1082          */
1083         new_state = msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE;
1084         if (!neigh && lladdr && idev && READ_ONCE(idev->cnf.forwarding)) {
1085                 if (accept_untracked_na(dev, saddr)) {
1086                         neigh = neigh_create(&nd_tbl, &msg->target, dev);
1087                         new_state = NUD_STALE;
1088                 }
1089         }
1090
1091         if (neigh && !IS_ERR(neigh)) {
1092                 u8 old_flags = neigh->flags;
1093                 struct net *net = dev_net(dev);
1094
1095                 if (READ_ONCE(neigh->nud_state) & NUD_FAILED)
1096                         goto out;
1097
1098                 /*
1099                  * Don't update the neighbor cache entry on a proxy NA from
1100                  * ourselves because either the proxied node is off link or it
1101                  * has already sent a NA to us.
1102                  */
1103                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1104                     READ_ONCE(net->ipv6.devconf_all->forwarding) &&
1105                     READ_ONCE(net->ipv6.devconf_all->proxy_ndp) &&
1106                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1107                         /* XXX: idev->cnf.proxy_ndp */
1108                         goto out;
1109                 }
1110
1111                 ndisc_update(dev, neigh, lladdr,
1112                              new_state,
1113                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1114                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1115                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1116                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1117                              NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1118
1119                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1120                         /*
1121                          * Change: router to host
1122                          */
1123                         rt6_clean_tohost(dev_net(dev),  saddr);
1124                 }
1125                 reason = SKB_CONSUMED;
1126 out:
1127                 neigh_release(neigh);
1128         }
1129         return reason;
1130 }
1131
1132 static enum skb_drop_reason ndisc_recv_rs(struct sk_buff *skb)
1133 {
1134         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1135         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1136         struct neighbour *neigh;
1137         struct inet6_dev *idev;
1138         const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1139         struct ndisc_options ndopts;
1140         u8 *lladdr = NULL;
1141         SKB_DR(reason);
1142
1143         if (skb->len < sizeof(*rs_msg))
1144                 return SKB_DROP_REASON_PKT_TOO_SMALL;
1145
1146         idev = __in6_dev_get(skb->dev);
1147         if (!idev) {
1148                 ND_PRINTK(1, err, "RS: can't find in6 device\n");
1149                 return reason;
1150         }
1151
1152         /* Don't accept RS if we're not in router mode */
1153         if (!READ_ONCE(idev->cnf.forwarding))
1154                 goto out;
1155
1156         /*
1157          * Don't update NCE if src = ::;
1158          * this implies that the source node has no ip address assigned yet.
1159          */
1160         if (ipv6_addr_any(saddr))
1161                 goto out;
1162
1163         /* Parse ND options */
1164         if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts))
1165                 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1166
1167         if (ndopts.nd_opts_src_lladdr) {
1168                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1169                                              skb->dev);
1170                 if (!lladdr)
1171                         goto out;
1172         }
1173
1174         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1175         if (neigh) {
1176                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1177                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1178                              NEIGH_UPDATE_F_OVERRIDE|
1179                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1180                              NDISC_ROUTER_SOLICITATION, &ndopts);
1181                 neigh_release(neigh);
1182                 reason = SKB_CONSUMED;
1183         }
1184 out:
1185         return reason;
1186 }
1187
1188 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1189 {
1190         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1191         struct sk_buff *skb;
1192         struct nlmsghdr *nlh;
1193         struct nduseroptmsg *ndmsg;
1194         struct net *net = dev_net(ra->dev);
1195         int err;
1196         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1197                                     + (opt->nd_opt_len << 3));
1198         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1199
1200         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1201         if (!skb) {
1202                 err = -ENOBUFS;
1203                 goto errout;
1204         }
1205
1206         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1207         if (!nlh) {
1208                 goto nla_put_failure;
1209         }
1210
1211         ndmsg = nlmsg_data(nlh);
1212         ndmsg->nduseropt_family = AF_INET6;
1213         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1214         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1215         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1216         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1217
1218         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1219
1220         if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1221                 goto nla_put_failure;
1222         nlmsg_end(skb, nlh);
1223
1224         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1225         return;
1226
1227 nla_put_failure:
1228         nlmsg_free(skb);
1229         err = -EMSGSIZE;
1230 errout:
1231         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1232 }
1233
1234 static enum skb_drop_reason ndisc_router_discovery(struct sk_buff *skb)
1235 {
1236         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1237         bool send_ifinfo_notify = false;
1238         struct neighbour *neigh = NULL;
1239         struct ndisc_options ndopts;
1240         struct fib6_info *rt = NULL;
1241         struct inet6_dev *in6_dev;
1242         struct fib6_table *table;
1243         u32 defrtr_usr_metric;
1244         unsigned int pref = 0;
1245         __u32 old_if_flags;
1246         struct net *net;
1247         SKB_DR(reason);
1248         int lifetime;
1249         int optlen;
1250
1251         __u8 *opt = (__u8 *)(ra_msg + 1);
1252
1253         optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1254                 sizeof(struct ra_msg);
1255
1256         ND_PRINTK(2, info,
1257                   "RA: %s, dev: %s\n",
1258                   __func__, skb->dev->name);
1259         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1260                 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1261                 return reason;
1262         }
1263         if (optlen < 0)
1264                 return SKB_DROP_REASON_PKT_TOO_SMALL;
1265
1266 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1267         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1268                 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1269                 return reason;
1270         }
1271 #endif
1272
1273         in6_dev = __in6_dev_get(skb->dev);
1274         if (!in6_dev) {
1275                 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1276                           skb->dev->name);
1277                 return reason;
1278         }
1279
1280         if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts))
1281                 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1282
1283         if (!ipv6_accept_ra(in6_dev)) {
1284                 ND_PRINTK(2, info,
1285                           "RA: %s, did not accept ra for dev: %s\n",
1286                           __func__, skb->dev->name);
1287                 goto skip_linkparms;
1288         }
1289
1290 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1291         /* skip link-specific parameters from interior routers */
1292         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1293                 ND_PRINTK(2, info,
1294                           "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1295                           __func__, skb->dev->name);
1296                 goto skip_linkparms;
1297         }
1298 #endif
1299
1300         if (in6_dev->if_flags & IF_RS_SENT) {
1301                 /*
1302                  *      flag that an RA was received after an RS was sent
1303                  *      out on this interface.
1304                  */
1305                 in6_dev->if_flags |= IF_RA_RCVD;
1306         }
1307
1308         /*
1309          * Remember the managed/otherconf flags from most recently
1310          * received RA message (RFC 2462) -- yoshfuji
1311          */
1312         old_if_flags = in6_dev->if_flags;
1313         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1314                                 IF_RA_OTHERCONF)) |
1315                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1316                                         IF_RA_MANAGED : 0) |
1317                                 (ra_msg->icmph.icmp6_addrconf_other ?
1318                                         IF_RA_OTHERCONF : 0);
1319
1320         if (old_if_flags != in6_dev->if_flags)
1321                 send_ifinfo_notify = true;
1322
1323         if (!READ_ONCE(in6_dev->cnf.accept_ra_defrtr)) {
1324                 ND_PRINTK(2, info,
1325                           "RA: %s, defrtr is false for dev: %s\n",
1326                           __func__, skb->dev->name);
1327                 goto skip_defrtr;
1328         }
1329
1330         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1331         if (lifetime != 0 &&
1332             lifetime < READ_ONCE(in6_dev->cnf.accept_ra_min_lft)) {
1333                 ND_PRINTK(2, info,
1334                           "RA: router lifetime (%ds) is too short: %s\n",
1335                           lifetime, skb->dev->name);
1336                 goto skip_defrtr;
1337         }
1338
1339         /* Do not accept RA with source-addr found on local machine unless
1340          * accept_ra_from_local is set to true.
1341          */
1342         net = dev_net(in6_dev->dev);
1343         if (!READ_ONCE(in6_dev->cnf.accept_ra_from_local) &&
1344             ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) {
1345                 ND_PRINTK(2, info,
1346                           "RA from local address detected on dev: %s: default router ignored\n",
1347                           skb->dev->name);
1348                 goto skip_defrtr;
1349         }
1350
1351 #ifdef CONFIG_IPV6_ROUTER_PREF
1352         pref = ra_msg->icmph.icmp6_router_pref;
1353         /* 10b is handled as if it were 00b (medium) */
1354         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1355             !READ_ONCE(in6_dev->cnf.accept_ra_rtr_pref))
1356                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1357 #endif
1358         /* routes added from RAs do not use nexthop objects */
1359         rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev);
1360         if (rt) {
1361                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1362                                          rt->fib6_nh->fib_nh_dev, NULL,
1363                                           &ipv6_hdr(skb)->saddr);
1364                 if (!neigh) {
1365                         ND_PRINTK(0, err,
1366                                   "RA: %s got default router without neighbour\n",
1367                                   __func__);
1368                         fib6_info_release(rt);
1369                         return reason;
1370                 }
1371         }
1372         /* Set default route metric as specified by user */
1373         defrtr_usr_metric = in6_dev->cnf.ra_defrtr_metric;
1374         /* delete the route if lifetime is 0 or if metric needs change */
1375         if (rt && (lifetime == 0 || rt->fib6_metric != defrtr_usr_metric)) {
1376                 ip6_del_rt(net, rt, false);
1377                 rt = NULL;
1378         }
1379
1380         ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, metric: %d, for dev: %s\n",
1381                   rt, lifetime, defrtr_usr_metric, skb->dev->name);
1382         if (!rt && lifetime) {
1383                 ND_PRINTK(3, info, "RA: adding default router\n");
1384
1385                 if (neigh)
1386                         neigh_release(neigh);
1387
1388                 rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
1389                                          skb->dev, pref, defrtr_usr_metric,
1390                                          lifetime);
1391                 if (!rt) {
1392                         ND_PRINTK(0, err,
1393                                   "RA: %s failed to add default route\n",
1394                                   __func__);
1395                         return reason;
1396                 }
1397
1398                 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1399                                          rt->fib6_nh->fib_nh_dev, NULL,
1400                                           &ipv6_hdr(skb)->saddr);
1401                 if (!neigh) {
1402                         ND_PRINTK(0, err,
1403                                   "RA: %s got default router without neighbour\n",
1404                                   __func__);
1405                         fib6_info_release(rt);
1406                         return reason;
1407                 }
1408                 neigh->flags |= NTF_ROUTER;
1409         } else if (rt && IPV6_EXTRACT_PREF(rt->fib6_flags) != pref) {
1410                 struct nl_info nlinfo = {
1411                         .nl_net = net,
1412                 };
1413                 rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1414                 inet6_rt_notify(RTM_NEWROUTE, rt, &nlinfo, NLM_F_REPLACE);
1415         }
1416
1417         if (rt) {
1418                 table = rt->fib6_table;
1419                 spin_lock_bh(&table->tb6_lock);
1420
1421                 fib6_set_expires(rt, jiffies + (HZ * lifetime));
1422                 fib6_add_gc_list(rt);
1423
1424                 spin_unlock_bh(&table->tb6_lock);
1425         }
1426         if (READ_ONCE(in6_dev->cnf.accept_ra_min_hop_limit) < 256 &&
1427             ra_msg->icmph.icmp6_hop_limit) {
1428                 if (READ_ONCE(in6_dev->cnf.accept_ra_min_hop_limit) <=
1429                     ra_msg->icmph.icmp6_hop_limit) {
1430                         WRITE_ONCE(in6_dev->cnf.hop_limit,
1431                                    ra_msg->icmph.icmp6_hop_limit);
1432                         fib6_metric_set(rt, RTAX_HOPLIMIT,
1433                                         ra_msg->icmph.icmp6_hop_limit);
1434                 } else {
1435                         ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1436                 }
1437         }
1438
1439 skip_defrtr:
1440
1441         /*
1442          *      Update Reachable Time and Retrans Timer
1443          */
1444
1445         if (in6_dev->nd_parms) {
1446                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1447
1448                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1449                         rtime = (rtime*HZ)/1000;
1450                         if (rtime < HZ/100)
1451                                 rtime = HZ/100;
1452                         NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1453                         in6_dev->tstamp = jiffies;
1454                         send_ifinfo_notify = true;
1455                 }
1456
1457                 rtime = ntohl(ra_msg->reachable_time);
1458                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1459                         rtime = (rtime*HZ)/1000;
1460
1461                         if (rtime < HZ/10)
1462                                 rtime = HZ/10;
1463
1464                         if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1465                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1466                                               BASE_REACHABLE_TIME, rtime);
1467                                 NEIGH_VAR_SET(in6_dev->nd_parms,
1468                                               GC_STALETIME, 3 * rtime);
1469                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1470                                 in6_dev->tstamp = jiffies;
1471                                 send_ifinfo_notify = true;
1472                         }
1473                 }
1474         }
1475
1476 skip_linkparms:
1477
1478         /*
1479          *      Process options.
1480          */
1481
1482         if (!neigh)
1483                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1484                                        skb->dev, 1);
1485         if (neigh) {
1486                 u8 *lladdr = NULL;
1487                 if (ndopts.nd_opts_src_lladdr) {
1488                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1489                                                      skb->dev);
1490                         if (!lladdr) {
1491                                 ND_PRINTK(2, warn,
1492                                           "RA: invalid link-layer address length\n");
1493                                 goto out;
1494                         }
1495                 }
1496                 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1497                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1498                              NEIGH_UPDATE_F_OVERRIDE|
1499                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1500                              NEIGH_UPDATE_F_ISROUTER,
1501                              NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1502                 reason = SKB_CONSUMED;
1503         }
1504
1505         if (!ipv6_accept_ra(in6_dev)) {
1506                 ND_PRINTK(2, info,
1507                           "RA: %s, accept_ra is false for dev: %s\n",
1508                           __func__, skb->dev->name);
1509                 goto out;
1510         }
1511
1512 #ifdef CONFIG_IPV6_ROUTE_INFO
1513         if (!READ_ONCE(in6_dev->cnf.accept_ra_from_local) &&
1514             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1515                           in6_dev->dev, 0)) {
1516                 ND_PRINTK(2, info,
1517                           "RA from local address detected on dev: %s: router info ignored.\n",
1518                           skb->dev->name);
1519                 goto skip_routeinfo;
1520         }
1521
1522         if (READ_ONCE(in6_dev->cnf.accept_ra_rtr_pref) && ndopts.nd_opts_ri) {
1523                 struct nd_opt_hdr *p;
1524                 for (p = ndopts.nd_opts_ri;
1525                      p;
1526                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1527                         struct route_info *ri = (struct route_info *)p;
1528 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1529                         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1530                             ri->prefix_len == 0)
1531                                 continue;
1532 #endif
1533                         if (ri->prefix_len == 0 &&
1534                             !READ_ONCE(in6_dev->cnf.accept_ra_defrtr))
1535                                 continue;
1536                         if (ri->lifetime != 0 &&
1537                             ntohl(ri->lifetime) < READ_ONCE(in6_dev->cnf.accept_ra_min_lft))
1538                                 continue;
1539                         if (ri->prefix_len < READ_ONCE(in6_dev->cnf.accept_ra_rt_info_min_plen))
1540                                 continue;
1541                         if (ri->prefix_len > READ_ONCE(in6_dev->cnf.accept_ra_rt_info_max_plen))
1542                                 continue;
1543                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1544                                       &ipv6_hdr(skb)->saddr);
1545                 }
1546         }
1547
1548 skip_routeinfo:
1549 #endif
1550
1551 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1552         /* skip link-specific ndopts from interior routers */
1553         if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1554                 ND_PRINTK(2, info,
1555                           "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1556                           __func__, skb->dev->name);
1557                 goto out;
1558         }
1559 #endif
1560
1561         if (READ_ONCE(in6_dev->cnf.accept_ra_pinfo) && ndopts.nd_opts_pi) {
1562                 struct nd_opt_hdr *p;
1563                 for (p = ndopts.nd_opts_pi;
1564                      p;
1565                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1566                         addrconf_prefix_rcv(skb->dev, (u8 *)p,
1567                                             (p->nd_opt_len) << 3,
1568                                             ndopts.nd_opts_src_lladdr != NULL);
1569                 }
1570         }
1571
1572         if (ndopts.nd_opts_mtu && READ_ONCE(in6_dev->cnf.accept_ra_mtu)) {
1573                 __be32 n;
1574                 u32 mtu;
1575
1576                 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1577                 mtu = ntohl(n);
1578
1579                 if (in6_dev->ra_mtu != mtu) {
1580                         in6_dev->ra_mtu = mtu;
1581                         send_ifinfo_notify = true;
1582                 }
1583
1584                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1585                         ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1586                 } else if (READ_ONCE(in6_dev->cnf.mtu6) != mtu) {
1587                         WRITE_ONCE(in6_dev->cnf.mtu6, mtu);
1588                         fib6_metric_set(rt, RTAX_MTU, mtu);
1589                         rt6_mtu_change(skb->dev, mtu);
1590                 }
1591         }
1592
1593         if (ndopts.nd_useropts) {
1594                 struct nd_opt_hdr *p;
1595                 for (p = ndopts.nd_useropts;
1596                      p;
1597                      p = ndisc_next_useropt(skb->dev, p,
1598                                             ndopts.nd_useropts_end)) {
1599                         ndisc_ra_useropt(skb, p);
1600                 }
1601         }
1602
1603         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1604                 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1605         }
1606 out:
1607         /* Send a notify if RA changed managed/otherconf flags or
1608          * timer settings or ra_mtu value
1609          */
1610         if (send_ifinfo_notify)
1611                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1612
1613         fib6_info_release(rt);
1614         if (neigh)
1615                 neigh_release(neigh);
1616         return reason;
1617 }
1618
1619 static enum skb_drop_reason ndisc_redirect_rcv(struct sk_buff *skb)
1620 {
1621         struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1622         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1623                                     offsetof(struct rd_msg, opt));
1624         struct ndisc_options ndopts;
1625         SKB_DR(reason);
1626         u8 *hdr;
1627
1628 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1629         switch (skb->ndisc_nodetype) {
1630         case NDISC_NODETYPE_HOST:
1631         case NDISC_NODETYPE_NODEFAULT:
1632                 ND_PRINTK(2, warn,
1633                           "Redirect: from host or unauthorized router\n");
1634                 return reason;
1635         }
1636 #endif
1637
1638         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1639                 ND_PRINTK(2, warn,
1640                           "Redirect: source address is not link-local\n");
1641                 return reason;
1642         }
1643
1644         if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1645                 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1646
1647         if (!ndopts.nd_opts_rh) {
1648                 ip6_redirect_no_header(skb, dev_net(skb->dev),
1649                                         skb->dev->ifindex);
1650                 return reason;
1651         }
1652
1653         hdr = (u8 *)ndopts.nd_opts_rh;
1654         hdr += 8;
1655         if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1656                 return SKB_DROP_REASON_PKT_TOO_SMALL;
1657
1658         return icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1659 }
1660
1661 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1662                                            struct sk_buff *orig_skb,
1663                                            int rd_len)
1664 {
1665         u8 *opt = skb_put(skb, rd_len);
1666
1667         memset(opt, 0, 8);
1668         *(opt++) = ND_OPT_REDIRECT_HDR;
1669         *(opt++) = (rd_len >> 3);
1670         opt += 6;
1671
1672         skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1673                       rd_len - 8);
1674 }
1675
1676 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1677 {
1678         struct net_device *dev = skb->dev;
1679         struct net *net = dev_net(dev);
1680         struct sock *sk = net->ipv6.ndisc_sk;
1681         int optlen = 0;
1682         struct inet_peer *peer;
1683         struct sk_buff *buff;
1684         struct rd_msg *msg;
1685         struct in6_addr saddr_buf;
1686         struct rt6_info *rt;
1687         struct dst_entry *dst;
1688         struct flowi6 fl6;
1689         int rd_len;
1690         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1691            ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1692         bool ret;
1693
1694         if (netif_is_l3_master(skb->dev)) {
1695                 dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
1696                 if (!dev)
1697                         return;
1698         }
1699
1700         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1701                 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1702                           dev->name);
1703                 return;
1704         }
1705
1706         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1707             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1708                 ND_PRINTK(2, warn,
1709                           "Redirect: target address is not link-local unicast\n");
1710                 return;
1711         }
1712
1713         icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1714                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1715
1716         dst = ip6_route_output(net, NULL, &fl6);
1717         if (dst->error) {
1718                 dst_release(dst);
1719                 return;
1720         }
1721         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1722         if (IS_ERR(dst))
1723                 return;
1724
1725         rt = (struct rt6_info *) dst;
1726
1727         if (rt->rt6i_flags & RTF_GATEWAY) {
1728                 ND_PRINTK(2, warn,
1729                           "Redirect: destination is not a neighbour\n");
1730                 goto release;
1731         }
1732         peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1733         ret = inet_peer_xrlim_allow(peer, 1*HZ);
1734         if (peer)
1735                 inet_putpeer(peer);
1736         if (!ret)
1737                 goto release;
1738
1739         if (dev->addr_len) {
1740                 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1741                 if (!neigh) {
1742                         ND_PRINTK(2, warn,
1743                                   "Redirect: no neigh for target address\n");
1744                         goto release;
1745                 }
1746
1747                 read_lock_bh(&neigh->lock);
1748                 if (neigh->nud_state & NUD_VALID) {
1749                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1750                         read_unlock_bh(&neigh->lock);
1751                         ha = ha_buf;
1752                         optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1753                                                                 ops_data_buf,
1754                                                                 &ops_data);
1755                 } else
1756                         read_unlock_bh(&neigh->lock);
1757
1758                 neigh_release(neigh);
1759         }
1760
1761         rd_len = min_t(unsigned int,
1762                        IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1763                        skb->len + 8);
1764         rd_len &= ~0x7;
1765         optlen += rd_len;
1766
1767         buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1768         if (!buff)
1769                 goto release;
1770
1771         msg = skb_put(buff, sizeof(*msg));
1772         *msg = (struct rd_msg) {
1773                 .icmph = {
1774                         .icmp6_type = NDISC_REDIRECT,
1775                 },
1776                 .target = *target,
1777                 .dest = ipv6_hdr(skb)->daddr,
1778         };
1779
1780         /*
1781          *      include target_address option
1782          */
1783
1784         if (ha)
1785                 ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1786
1787         /*
1788          *      build redirect option and copy skb over to the new packet.
1789          */
1790
1791         if (rd_len)
1792                 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1793
1794         skb_dst_set(buff, dst);
1795         ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1796         return;
1797
1798 release:
1799         dst_release(dst);
1800 }
1801
1802 static void pndisc_redo(struct sk_buff *skb)
1803 {
1804         enum skb_drop_reason reason = ndisc_recv_ns(skb);
1805
1806         kfree_skb_reason(skb, reason);
1807 }
1808
1809 static int ndisc_is_multicast(const void *pkey)
1810 {
1811         return ipv6_addr_is_multicast((struct in6_addr *)pkey);
1812 }
1813
1814 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1815 {
1816         struct inet6_dev *idev = __in6_dev_get(skb->dev);
1817
1818         if (!idev)
1819                 return true;
1820         if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1821             READ_ONCE(idev->cnf.suppress_frag_ndisc)) {
1822                 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1823                 return true;
1824         }
1825         return false;
1826 }
1827
1828 enum skb_drop_reason ndisc_rcv(struct sk_buff *skb)
1829 {
1830         struct nd_msg *msg;
1831         SKB_DR(reason);
1832
1833         if (ndisc_suppress_frag_ndisc(skb))
1834                 return SKB_DROP_REASON_IPV6_NDISC_FRAG;
1835
1836         if (skb_linearize(skb))
1837                 return SKB_DROP_REASON_NOMEM;
1838
1839         msg = (struct nd_msg *)skb_transport_header(skb);
1840
1841         __skb_push(skb, skb->data - skb_transport_header(skb));
1842
1843         if (ipv6_hdr(skb)->hop_limit != 255) {
1844                 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1845                           ipv6_hdr(skb)->hop_limit);
1846                 return SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT;
1847         }
1848
1849         if (msg->icmph.icmp6_code != 0) {
1850                 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1851                           msg->icmph.icmp6_code);
1852                 return SKB_DROP_REASON_IPV6_NDISC_BAD_CODE;
1853         }
1854
1855         switch (msg->icmph.icmp6_type) {
1856         case NDISC_NEIGHBOUR_SOLICITATION:
1857                 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1858                 reason = ndisc_recv_ns(skb);
1859                 break;
1860
1861         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1862                 reason = ndisc_recv_na(skb);
1863                 break;
1864
1865         case NDISC_ROUTER_SOLICITATION:
1866                 reason = ndisc_recv_rs(skb);
1867                 break;
1868
1869         case NDISC_ROUTER_ADVERTISEMENT:
1870                 reason = ndisc_router_discovery(skb);
1871                 break;
1872
1873         case NDISC_REDIRECT:
1874                 reason = ndisc_redirect_rcv(skb);
1875                 break;
1876         }
1877
1878         return reason;
1879 }
1880
1881 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1882 {
1883         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1884         struct netdev_notifier_change_info *change_info;
1885         struct net *net = dev_net(dev);
1886         struct inet6_dev *idev;
1887         bool evict_nocarrier;
1888
1889         switch (event) {
1890         case NETDEV_CHANGEADDR:
1891                 neigh_changeaddr(&nd_tbl, dev);
1892                 fib6_run_gc(0, net, false);
1893                 fallthrough;
1894         case NETDEV_UP:
1895                 idev = in6_dev_get(dev);
1896                 if (!idev)
1897                         break;
1898                 if (READ_ONCE(idev->cnf.ndisc_notify) ||
1899                     READ_ONCE(net->ipv6.devconf_all->ndisc_notify))
1900                         ndisc_send_unsol_na(dev);
1901                 in6_dev_put(idev);
1902                 break;
1903         case NETDEV_CHANGE:
1904                 idev = in6_dev_get(dev);
1905                 if (!idev)
1906                         evict_nocarrier = true;
1907                 else {
1908                         evict_nocarrier = READ_ONCE(idev->cnf.ndisc_evict_nocarrier) &&
1909                                           READ_ONCE(net->ipv6.devconf_all->ndisc_evict_nocarrier);
1910                         in6_dev_put(idev);
1911                 }
1912
1913                 change_info = ptr;
1914                 if (change_info->flags_changed & IFF_NOARP)
1915                         neigh_changeaddr(&nd_tbl, dev);
1916                 if (evict_nocarrier && !netif_carrier_ok(dev))
1917                         neigh_carrier_down(&nd_tbl, dev);
1918                 break;
1919         case NETDEV_DOWN:
1920                 neigh_ifdown(&nd_tbl, dev);
1921                 fib6_run_gc(0, net, false);
1922                 break;
1923         case NETDEV_NOTIFY_PEERS:
1924                 ndisc_send_unsol_na(dev);
1925                 break;
1926         default:
1927                 break;
1928         }
1929
1930         return NOTIFY_DONE;
1931 }
1932
1933 static struct notifier_block ndisc_netdev_notifier = {
1934         .notifier_call = ndisc_netdev_event,
1935         .priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1936 };
1937
1938 #ifdef CONFIG_SYSCTL
1939 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1940                                          const char *func, const char *dev_name)
1941 {
1942         static char warncomm[TASK_COMM_LEN];
1943         static int warned;
1944         if (strcmp(warncomm, current->comm) && warned < 5) {
1945                 strcpy(warncomm, current->comm);
1946                 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1947                         warncomm, func,
1948                         dev_name, ctl->procname,
1949                         dev_name, ctl->procname);
1950                 warned++;
1951         }
1952 }
1953
1954 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void *buffer,
1955                 size_t *lenp, loff_t *ppos)
1956 {
1957         struct net_device *dev = ctl->extra1;
1958         struct inet6_dev *idev;
1959         int ret;
1960
1961         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1962             (strcmp(ctl->procname, "base_reachable_time") == 0))
1963                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1964
1965         if (strcmp(ctl->procname, "retrans_time") == 0)
1966                 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1967
1968         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1969                 ret = neigh_proc_dointvec_jiffies(ctl, write,
1970                                                   buffer, lenp, ppos);
1971
1972         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1973                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1974                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1975                                                      buffer, lenp, ppos);
1976         else
1977                 ret = -1;
1978
1979         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1980                 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1981                         idev->nd_parms->reachable_time =
1982                                         neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1983                 WRITE_ONCE(idev->tstamp, jiffies);
1984                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1985                 in6_dev_put(idev);
1986         }
1987         return ret;
1988 }
1989
1990
1991 #endif
1992
1993 static int __net_init ndisc_net_init(struct net *net)
1994 {
1995         struct ipv6_pinfo *np;
1996         struct sock *sk;
1997         int err;
1998
1999         err = inet_ctl_sock_create(&sk, PF_INET6,
2000                                    SOCK_RAW, IPPROTO_ICMPV6, net);
2001         if (err < 0) {
2002                 ND_PRINTK(0, err,
2003                           "NDISC: Failed to initialize the control socket (err %d)\n",
2004                           err);
2005                 return err;
2006         }
2007
2008         net->ipv6.ndisc_sk = sk;
2009
2010         np = inet6_sk(sk);
2011         np->hop_limit = 255;
2012         /* Do not loopback ndisc messages */
2013         inet6_clear_bit(MC6_LOOP, sk);
2014
2015         return 0;
2016 }
2017
2018 static void __net_exit ndisc_net_exit(struct net *net)
2019 {
2020         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
2021 }
2022
2023 static struct pernet_operations ndisc_net_ops = {
2024         .init = ndisc_net_init,
2025         .exit = ndisc_net_exit,
2026 };
2027
2028 int __init ndisc_init(void)
2029 {
2030         int err;
2031
2032         err = register_pernet_subsys(&ndisc_net_ops);
2033         if (err)
2034                 return err;
2035         /*
2036          * Initialize the neighbour table
2037          */
2038         neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
2039
2040 #ifdef CONFIG_SYSCTL
2041         err = neigh_sysctl_register(NULL, &nd_tbl.parms,
2042                                     ndisc_ifinfo_sysctl_change);
2043         if (err)
2044                 goto out_unregister_pernet;
2045 out:
2046 #endif
2047         return err;
2048
2049 #ifdef CONFIG_SYSCTL
2050 out_unregister_pernet:
2051         unregister_pernet_subsys(&ndisc_net_ops);
2052         goto out;
2053 #endif
2054 }
2055
2056 int __init ndisc_late_init(void)
2057 {
2058         return register_netdevice_notifier(&ndisc_netdev_notifier);
2059 }
2060
2061 void ndisc_late_cleanup(void)
2062 {
2063         unregister_netdevice_notifier(&ndisc_netdev_notifier);
2064 }
2065
2066 void ndisc_cleanup(void)
2067 {
2068 #ifdef CONFIG_SYSCTL
2069         neigh_sysctl_unregister(&nd_tbl.parms);
2070 #endif
2071         neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
2072         unregister_pernet_subsys(&ndisc_net_ops);
2073 }