net/ipv6/ndisc.c

   1 /*
   2  *      Neighbour Discovery for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Mike Shaver             <shaver@ingenia.com>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 /*
  16  *      Changes:
  17  *
  18  *      Pierre Ynard                    :       export userland ND options
  19  *                                              through netlink (RDNSS support)
  20  *      Lars Fenneberg                  :       fixed MTU setting on receipt
  21  *                                              of an RA.
  22  *      Janos Farkas                    :       kmalloc failure checks
  23  *      Alexey Kuznetsov                :       state machine reworked
  24  *                                              and moved to net/core.
  25  *      Pekka Savola                    :       RFC2461 validation
  26  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  27  */
  28
  29 /* Set to 3 to get tracing... */
  30 #define ND_DEBUG 1
  31
  32 #define ND_PRINTK(fmt, args...) do { if (net_ratelimit()) { printk(fmt, ## args); } } while(0)
  33 #define ND_NOPRINTK(x...) do { ; } while(0)
  34 #define ND_PRINTK0 ND_PRINTK
  35 #define ND_PRINTK1 ND_NOPRINTK
  36 #define ND_PRINTK2 ND_NOPRINTK
  37 #define ND_PRINTK3 ND_NOPRINTK
  38 #if ND_DEBUG >= 1
  39 #undef ND_PRINTK1
  40 #define ND_PRINTK1 ND_PRINTK
  41 #endif
  42 #if ND_DEBUG >= 2
  43 #undef ND_PRINTK2
  44 #define ND_PRINTK2 ND_PRINTK
  45 #endif
  46 #if ND_DEBUG >= 3
  47 #undef ND_PRINTK3
  48 #define ND_PRINTK3 ND_PRINTK
  49 #endif
  50
  51 #include <linux/module.h>
  52 #include <linux/errno.h>
  53 #include <linux/types.h>
  54 #include <linux/socket.h>
  55 #include <linux/sockios.h>
  56 #include <linux/sched.h>
  57 #include <linux/net.h>
  58 #include <linux/in6.h>
  59 #include <linux/route.h>
  60 #include <linux/init.h>
  61 #include <linux/rcupdate.h>
  62 #ifdef CONFIG_SYSCTL
  63 #include <linux/sysctl.h>
  64 #endif
  65
  66 #include <linux/if_addr.h>
  67 #include <linux/if_arp.h>
  68 #include <linux/ipv6.h>
  69 #include <linux/icmpv6.h>
  70 #include <linux/jhash.h>
  71
  72 #include <net/sock.h>
  73 #include <net/snmp.h>
  74
  75 #include <net/ipv6.h>
  76 #include <net/protocol.h>
  77 #include <net/ndisc.h>
  78 #include <net/ip6_route.h>
  79 #include <net/addrconf.h>
  80 #include <net/icmp.h>
  81
  82 #include <net/netlink.h>
  83 #include <linux/rtnetlink.h>
  84
  85 #include <net/flow.h>
  86 #include <net/ip6_checksum.h>
  87 #include <linux/proc_fs.h>
  88
  89 #include <linux/netfilter.h>
  90 #include <linux/netfilter_ipv6.h>
  91
  92 static struct socket *ndisc_socket;
  93
  94 static u32 ndisc_hash(const void *pkey, const struct net_device *dev);
  95 static int ndisc_constructor(struct neighbour *neigh);
  96 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
  97 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
  98 static int pndisc_constructor(struct pneigh_entry *n);
  99 static void pndisc_destructor(struct pneigh_entry *n);
 100 static void pndisc_redo(struct sk_buff *skb);
 101
 102 static struct neigh_ops ndisc_generic_ops = {
 103         .family =               AF_INET6,
 104         .solicit =              ndisc_solicit,
 105         .error_report =         ndisc_error_report,
 106         .output =               neigh_resolve_output,
 107         .connected_output =     neigh_connected_output,
 108         .hh_output =            dev_queue_xmit,
 109         .queue_xmit =           dev_queue_xmit,
 110 };
 111
 112 static struct neigh_ops ndisc_hh_ops = {
 113         .family =               AF_INET6,
 114         .solicit =              ndisc_solicit,
 115         .error_report =         ndisc_error_report,
 116         .output =               neigh_resolve_output,
 117         .connected_output =     neigh_resolve_output,
 118         .hh_output =            dev_queue_xmit,
 119         .queue_xmit =           dev_queue_xmit,
 120 };
 121
 122
 123 static struct neigh_ops ndisc_direct_ops = {
 124         .family =               AF_INET6,
 125         .output =               dev_queue_xmit,
 126         .connected_output =     dev_queue_xmit,
 127         .hh_output =            dev_queue_xmit,
 128         .queue_xmit =           dev_queue_xmit,
 129 };
 130
 131 struct neigh_table nd_tbl = {
 132         .family =       AF_INET6,
 133         .entry_size =   sizeof(struct neighbour) + sizeof(struct in6_addr),
 134         .key_len =      sizeof(struct in6_addr),
 135         .hash =         ndisc_hash,
 136         .constructor =  ndisc_constructor,
 137         .pconstructor = pndisc_constructor,
 138         .pdestructor =  pndisc_destructor,
 139         .proxy_redo =   pndisc_redo,
 140         .id =           "ndisc_cache",
 141         .parms = {
 142                 .tbl =                  &nd_tbl,
 143                 .base_reachable_time =  30 * HZ,
 144                 .retrans_time =  1 * HZ,
 145                 .gc_staletime = 60 * HZ,
 146                 .reachable_time =               30 * HZ,
 147                 .delay_probe_time =      5 * HZ,
 148                 .queue_len =             3,
 149                 .ucast_probes =  3,
 150                 .mcast_probes =  3,
 151                 .anycast_delay =         1 * HZ,
 152                 .proxy_delay =          (8 * HZ) / 10,
 153                 .proxy_qlen =           64,
 154         },
 155         .gc_interval =    30 * HZ,
 156         .gc_thresh1 =    128,
 157         .gc_thresh2 =    512,
 158         .gc_thresh3 =   1024,
 159 };
 160
 161 /* ND options */
 162 struct ndisc_options {
 163         struct nd_opt_hdr *nd_opt_array[__ND_OPT_ARRAY_MAX];
 164 #ifdef CONFIG_IPV6_ROUTE_INFO
 165         struct nd_opt_hdr *nd_opts_ri;
 166         struct nd_opt_hdr *nd_opts_ri_end;
 167 #endif
 168         struct nd_opt_hdr *nd_useropts;
 169         struct nd_opt_hdr *nd_useropts_end;
 170 };
 171
 172 #define nd_opts_src_lladdr      nd_opt_array[ND_OPT_SOURCE_LL_ADDR]
 173 #define nd_opts_tgt_lladdr      nd_opt_array[ND_OPT_TARGET_LL_ADDR]
 174 #define nd_opts_pi              nd_opt_array[ND_OPT_PREFIX_INFO]
 175 #define nd_opts_pi_end          nd_opt_array[__ND_OPT_PREFIX_INFO_END]
 176 #define nd_opts_rh              nd_opt_array[ND_OPT_REDIRECT_HDR]
 177 #define nd_opts_mtu             nd_opt_array[ND_OPT_MTU]
 178
 179 #define NDISC_OPT_SPACE(len) (((len)+2+7)&~7)
 180
 181 /*
 182  * Return the padding between the option length and the start of the
 183  * link addr.  Currently only IP-over-InfiniBand needs this, although
 184  * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
 185  * also need a pad of 2.
 186  */
 187 static int ndisc_addr_option_pad(unsigned short type)
 188 {
 189         switch (type) {
 190         case ARPHRD_INFINIBAND: return 2;
 191         default:                return 0;
 192         }
 193 }
 194
 195 static inline int ndisc_opt_addr_space(struct net_device *dev)
 196 {
 197         return NDISC_OPT_SPACE(dev->addr_len + ndisc_addr_option_pad(dev->type));
 198 }
 199
 200 static u8 *ndisc_fill_addr_option(u8 *opt, int type, void *data, int data_len,
 201                                   unsigned short addr_type)
 202 {
 203         int space = NDISC_OPT_SPACE(data_len);
 204         int pad   = ndisc_addr_option_pad(addr_type);
 205
 206         opt[0] = type;
 207         opt[1] = space>>3;
 208
 209         memset(opt + 2, 0, pad);
 210         opt   += pad;
 211         space -= pad;
 212
 213         memcpy(opt+2, data, data_len);
 214         data_len += 2;
 215         opt += data_len;
 216         if ((space -= data_len) > 0)
 217                 memset(opt, 0, space);
 218         return opt + space;
 219 }
 220
 221 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 222                                             struct nd_opt_hdr *end)
 223 {
 224         int type;
 225         if (!cur || !end || cur >= end)
 226                 return NULL;
 227         type = cur->nd_opt_type;
 228         do {
 229                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 230         } while(cur < end && cur->nd_opt_type != type);
 231         return (cur <= end && cur->nd_opt_type == type ? cur : NULL);
 232 }
 233
 234 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 235 {
 236         return (opt->nd_opt_type == ND_OPT_RDNSS);
 237 }
 238
 239 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
 240                                              struct nd_opt_hdr *end)
 241 {
 242         if (!cur || !end || cur >= end)
 243                 return NULL;
 244         do {
 245                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
 246         } while(cur < end && !ndisc_is_useropt(cur));
 247         return (cur <= end && ndisc_is_useropt(cur) ? cur : NULL);
 248 }
 249
 250 static struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
 251                                                  struct ndisc_options *ndopts)
 252 {
 253         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 254
 255         if (!nd_opt || opt_len < 0 || !ndopts)
 256                 return NULL;
 257         memset(ndopts, 0, sizeof(*ndopts));
 258         while (opt_len) {
 259                 int l;
 260                 if (opt_len < sizeof(struct nd_opt_hdr))
 261                         return NULL;
 262                 l = nd_opt->nd_opt_len << 3;
 263                 if (opt_len < l || l == 0)
 264                         return NULL;
 265                 switch (nd_opt->nd_opt_type) {
 266                 case ND_OPT_SOURCE_LL_ADDR:
 267                 case ND_OPT_TARGET_LL_ADDR:
 268                 case ND_OPT_MTU:
 269                 case ND_OPT_REDIRECT_HDR:
 270                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
 271                                 ND_PRINTK2(KERN_WARNING
 272                                            "%s(): duplicated ND6 option found: type=%d\n",
 273                                            __FUNCTION__,
 274                                            nd_opt->nd_opt_type);
 275                         } else {
 276                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 277                         }
 278                         break;
 279                 case ND_OPT_PREFIX_INFO:
 280                         ndopts->nd_opts_pi_end = nd_opt;
 281                         if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
 282                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
 283                         break;
 284 #ifdef CONFIG_IPV6_ROUTE_INFO
 285                 case ND_OPT_ROUTE_INFO:
 286                         ndopts->nd_opts_ri_end = nd_opt;
 287                         if (!ndopts->nd_opts_ri)
 288                                 ndopts->nd_opts_ri = nd_opt;
 289                         break;
 290 #endif
 291                 default:
 292                         if (ndisc_is_useropt(nd_opt)) {
 293                                 ndopts->nd_useropts_end = nd_opt;
 294                                 if (!ndopts->nd_useropts)
 295                                         ndopts->nd_useropts = nd_opt;
 296                         } else {
 297                                 /*
 298                                  * Unknown options must be silently ignored,
 299                                  * to accommodate future extension to the
 300                                  * protocol.
 301                                  */
 302                                 ND_PRINTK2(KERN_NOTICE
 303                                            "%s(): ignored unsupported option; type=%d, len=%d\n",
 304                                            __FUNCTION__,
 305                                            nd_opt->nd_opt_type, nd_opt->nd_opt_len);
 306                         }
 307                 }
 308                 opt_len -= l;
 309                 nd_opt = ((void *)nd_opt) + l;
 310         }
 311         return ndopts;
 312 }
 313
 314 static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
 315                                       struct net_device *dev)
 316 {
 317         u8 *lladdr = (u8 *)(p + 1);
 318         int lladdrlen = p->nd_opt_len << 3;
 319         int prepad = ndisc_addr_option_pad(dev->type);
 320         if (lladdrlen != NDISC_OPT_SPACE(dev->addr_len + prepad))
 321                 return NULL;
 322         return (lladdr + prepad);
 323 }
 324
 325 int ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 326 {
 327         switch (dev->type) {
 328         case ARPHRD_ETHER:
 329         case ARPHRD_IEEE802:    /* Not sure. Check it later. --ANK */
 330         case ARPHRD_FDDI:
 331                 ipv6_eth_mc_map(addr, buf);
 332                 return 0;
 333         case ARPHRD_IEEE802_TR:
 334                 ipv6_tr_mc_map(addr,buf);
 335                 return 0;
 336         case ARPHRD_ARCNET:
 337                 ipv6_arcnet_mc_map(addr, buf);
 338                 return 0;
 339         case ARPHRD_INFINIBAND:
 340                 ipv6_ib_mc_map(addr, dev->broadcast, buf);
 341                 return 0;
 342         default:
 343                 if (dir) {
 344                         memcpy(buf, dev->broadcast, dev->addr_len);
 345                         return 0;
 346                 }
 347         }
 348         return -EINVAL;
 349 }
 350
 351 EXPORT_SYMBOL(ndisc_mc_map);
 352
 353 static u32 ndisc_hash(const void *pkey, const struct net_device *dev)
 354 {
 355         const u32 *p32 = pkey;
 356         u32 addr_hash, i;
 357
 358         addr_hash = 0;
 359         for (i = 0; i < (sizeof(struct in6_addr) / sizeof(u32)); i++)
 360                 addr_hash ^= *p32++;
 361
 362         return jhash_2words(addr_hash, dev->ifindex, nd_tbl.hash_rnd);
 363 }
 364
 365 static int ndisc_constructor(struct neighbour *neigh)
 366 {
 367         struct in6_addr *addr = (struct in6_addr*)&neigh->primary_key;
 368         struct net_device *dev = neigh->dev;
 369         struct inet6_dev *in6_dev;
 370         struct neigh_parms *parms;
 371         int is_multicast = ipv6_addr_is_multicast(addr);
 372
 373         rcu_read_lock();
 374         in6_dev = in6_dev_get(dev);
 375         if (in6_dev == NULL) {
 376                 rcu_read_unlock();
 377                 return -EINVAL;
 378         }
 379
 380         parms = in6_dev->nd_parms;
 381         __neigh_parms_put(neigh->parms);
 382         neigh->parms = neigh_parms_clone(parms);
 383         rcu_read_unlock();
 384
 385         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
 386         if (!dev->header_ops) {
 387                 neigh->nud_state = NUD_NOARP;
 388                 neigh->ops = &ndisc_direct_ops;
 389                 neigh->output = neigh->ops->queue_xmit;
 390         } else {
 391                 if (is_multicast) {
 392                         neigh->nud_state = NUD_NOARP;
 393                         ndisc_mc_map(addr, neigh->ha, dev, 1);
 394                 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
 395                         neigh->nud_state = NUD_NOARP;
 396                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 397                         if (dev->flags&IFF_LOOPBACK)
 398                                 neigh->type = RTN_LOCAL;
 399                 } else if (dev->flags&IFF_POINTOPOINT) {
 400                         neigh->nud_state = NUD_NOARP;
 401                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 402                 }
 403                 if (dev->header_ops->cache)
 404                         neigh->ops = &ndisc_hh_ops;
 405                 else
 406                         neigh->ops = &ndisc_generic_ops;
 407                 if (neigh->nud_state&NUD_VALID)
 408                         neigh->output = neigh->ops->connected_output;
 409                 else
 410                         neigh->output = neigh->ops->output;
 411         }
 412         in6_dev_put(in6_dev);
 413         return 0;
 414 }
 415
 416 static int pndisc_constructor(struct pneigh_entry *n)
 417 {
 418         struct in6_addr *addr = (struct in6_addr*)&n->key;
 419         struct in6_addr maddr;
 420         struct net_device *dev = n->dev;
 421
 422         if (dev == NULL || __in6_dev_get(dev) == NULL)
 423                 return -EINVAL;
 424         addrconf_addr_solict_mult(addr, &maddr);
 425         ipv6_dev_mc_inc(dev, &maddr);
 426         return 0;
 427 }
 428
 429 static void pndisc_destructor(struct pneigh_entry *n)
 430 {
 431         struct in6_addr *addr = (struct in6_addr*)&n->key;
 432         struct in6_addr maddr;
 433         struct net_device *dev = n->dev;
 434
 435         if (dev == NULL || __in6_dev_get(dev) == NULL)
 436                 return;
 437         addrconf_addr_solict_mult(addr, &maddr);
 438         ipv6_dev_mc_dec(dev, &maddr);
 439 }
 440
 441 /*
 442  *      Send a Neighbour Advertisement
 443  */
 444 static void __ndisc_send(struct net_device *dev,
 445                          struct neighbour *neigh,
 446                          struct in6_addr *daddr, struct in6_addr *saddr,
 447                          struct icmp6hdr *icmp6h, struct in6_addr *target,
 448                          int llinfo)
 449 {
 450         struct flowi fl;
 451         struct dst_entry *dst;
 452         struct sock *sk = ndisc_socket->sk;
 453         struct sk_buff *skb;
 454         struct icmp6hdr *hdr;
 455         struct inet6_dev *idev;
 456         int len;
 457         int err;
 458         u8 *opt, type;
 459
 460         type = icmp6h->icmp6_type;
 461
 462         icmpv6_flow_init(ndisc_socket->sk, &fl, type,
 463                          saddr, daddr, dev->ifindex);
 464
 465         dst = icmp6_dst_alloc(dev, neigh, daddr);
 466         if (!dst)
 467                 return;
 468
 469         err = xfrm_lookup(&dst, &fl, NULL, 0);
 470         if (err < 0)
 471                 return;
 472
 473         if (!dev->addr_len)
 474                 llinfo = 0;
 475
 476         len = sizeof(struct icmp6hdr) + (target ? sizeof(*target) : 0);
 477         if (llinfo)
 478                 len += ndisc_opt_addr_space(dev);
 479
 480         skb = sock_alloc_send_skb(sk,
 481                                   (MAX_HEADER + sizeof(struct ipv6hdr) +
 482                                    len + LL_RESERVED_SPACE(dev)),
 483                                   1, &err);
 484         if (!skb) {
 485                 ND_PRINTK0(KERN_ERR
 486                            "ICMPv6 ND: %s() failed to allocate an skb.\n",
 487                            __FUNCTION__);
 488                 dst_release(dst);
 489                 return;
 490         }
 491
 492         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 493         ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
 494
 495         skb->transport_header = skb->tail;
 496         skb_put(skb, len);
 497
 498         hdr = (struct icmp6hdr *)skb_transport_header(skb);
 499         memcpy(hdr, icmp6h, sizeof(*hdr));
 500
 501         opt = skb_transport_header(skb) + sizeof(struct icmp6hdr);
 502         if (target) {
 503                 ipv6_addr_copy((struct in6_addr *)opt, target);
 504                 opt += sizeof(*target);
 505         }
 506
 507         if (llinfo)
 508                 ndisc_fill_addr_option(opt, llinfo, dev->dev_addr,
 509                                        dev->addr_len, dev->type);
 510
 511         hdr->icmp6_cksum = csum_ipv6_magic(saddr, daddr, len,
 512                                            IPPROTO_ICMPV6,
 513                                            csum_partial((__u8 *) hdr,
 514                                                         len, 0));
 515
 516         skb->dst = dst;
 517
 518         idev = in6_dev_get(dst->dev);
 519         IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
 520
 521         err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 522                       dst_output);
 523         if (!err) {
 524                 ICMP6MSGOUT_INC_STATS(idev, type);
 525                 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
 526         }
 527
 528         if (likely(idev != NULL))
 529                 in6_dev_put(idev);
 530 }
 531
 532 static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 533                    struct in6_addr *daddr, struct in6_addr *solicited_addr,
 534                    int router, int solicited, int override, int inc_opt)
 535 {
 536         struct in6_addr tmpaddr;
 537         struct inet6_ifaddr *ifp;
 538         struct in6_addr *src_addr;
 539         struct icmp6hdr icmp6h = {
 540                 .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
 541         };
 542
 543         /* for anycast or proxy, solicited_addr != src_addr */
 544         ifp = ipv6_get_ifaddr(&init_net, solicited_addr, dev, 1);
 545         if (ifp) {
 546                 src_addr = solicited_addr;
 547                 if (ifp->flags & IFA_F_OPTIMISTIC)
 548                         override = 0;
 549                 in6_ifa_put(ifp);
 550         } else {
 551                 if (ipv6_dev_get_saddr(dev, daddr, &tmpaddr))
 552                         return;
 553                 src_addr = &tmpaddr;
 554         }
 555
 556         icmp6h.icmp6_router = router;
 557         icmp6h.icmp6_solicited = solicited;
 558         icmp6h.icmp6_override = override;
 559
 560         __ndisc_send(dev, neigh, daddr, src_addr,
 561                      &icmp6h, solicited_addr,
 562                      inc_opt ? ND_OPT_TARGET_LL_ADDR : 0);
 563 }
 564
 565 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
 566                    struct in6_addr *solicit,
 567                    struct in6_addr *daddr, struct in6_addr *saddr)
 568 {
 569         struct in6_addr addr_buf;
 570         struct icmp6hdr icmp6h = {
 571                 .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
 572         };
 573
 574         if (saddr == NULL) {
 575                 if (ipv6_get_lladdr(dev, &addr_buf,
 576                                    (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
 577                         return;
 578                 saddr = &addr_buf;
 579         }
 580
 581         __ndisc_send(dev, neigh, daddr, saddr,
 582                      &icmp6h, solicit,
 583                      !ipv6_addr_any(saddr) ? ND_OPT_SOURCE_LL_ADDR : 0);
 584 }
 585
 586 void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
 587                    struct in6_addr *daddr)
 588 {
 589         struct icmp6hdr icmp6h = {
 590                 .icmp6_type = NDISC_ROUTER_SOLICITATION,
 591         };
 592         int send_sllao = dev->addr_len;
 593
 594 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 595         /*
 596          * According to section 2.2 of RFC 4429, we must not
 597          * send router solicitations with a sllao from
 598          * optimistic addresses, but we may send the solicitation
 599          * if we don't include the sllao.  So here we check
 600          * if our address is optimistic, and if so, we
 601          * suppress the inclusion of the sllao.
 602          */
 603         if (send_sllao) {
 604                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(&init_net, saddr,
 605                                                            dev, 1);
 606                 if (ifp) {
 607                         if (ifp->flags & IFA_F_OPTIMISTIC)  {
 608                                 send_sllao = 0;
 609                         }
 610                         in6_ifa_put(ifp);
 611                 } else {
 612                         send_sllao = 0;
 613                 }
 614         }
 615 #endif
 616         __ndisc_send(dev, NULL, daddr, saddr,
 617                      &icmp6h, NULL,
 618                      send_sllao ? ND_OPT_SOURCE_LL_ADDR : 0);
 619 }
 620
 621
 622 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
 623 {
 624         /*
 625          *      "The sender MUST return an ICMP
 626          *       destination unreachable"
 627          */
 628         dst_link_failure(skb);
 629         kfree_skb(skb);
 630 }
 631
 632 /* Called with locked neigh: either read or both */
 633
 634 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 635 {
 636         struct in6_addr *saddr = NULL;
 637         struct in6_addr mcaddr;
 638         struct net_device *dev = neigh->dev;
 639         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
 640         int probes = atomic_read(&neigh->probes);
 641
 642         if (skb && ipv6_chk_addr(&init_net, &ipv6_hdr(skb)->saddr, dev, 1))
 643                 saddr = &ipv6_hdr(skb)->saddr;
 644
 645         if ((probes -= neigh->parms->ucast_probes) < 0) {
 646                 if (!(neigh->nud_state & NUD_VALID)) {
 647                         ND_PRINTK1(KERN_DEBUG
 648                                    "%s(): trying to ucast probe in NUD_INVALID: "
 649                                    NIP6_FMT "\n",
 650                                    __FUNCTION__,
 651                                    NIP6(*target));
 652                 }
 653                 ndisc_send_ns(dev, neigh, target, target, saddr);
 654         } else if ((probes -= neigh->parms->app_probes) < 0) {
 655 #ifdef CONFIG_ARPD
 656                 neigh_app_ns(neigh);
 657 #endif
 658         } else {
 659                 addrconf_addr_solict_mult(target, &mcaddr);
 660                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
 661         }
 662 }
 663
 664 static void ndisc_recv_ns(struct sk_buff *skb)
 665 {
 666         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 667         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 668         struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 669         u8 *lladdr = NULL;
 670         u32 ndoptlen = skb->tail - (skb->transport_header +
 671                                     offsetof(struct nd_msg, opt));
 672         struct ndisc_options ndopts;
 673         struct net_device *dev = skb->dev;
 674         struct inet6_ifaddr *ifp;
 675         struct inet6_dev *idev = NULL;
 676         struct neighbour *neigh;
 677         struct pneigh_entry *pneigh = NULL;
 678         int dad = ipv6_addr_any(saddr);
 679         int inc;
 680         int is_router;
 681
 682         if (ipv6_addr_is_multicast(&msg->target)) {
 683                 ND_PRINTK2(KERN_WARNING
 684                            "ICMPv6 NS: multicast target address");
 685                 return;
 686         }
 687
 688         /*
 689          * RFC2461 7.1.1:
 690          * DAD has to be destined for solicited node multicast address.
 691          */
 692         if (dad &&
 693             !(daddr->s6_addr32[0] == htonl(0xff020000) &&
 694               daddr->s6_addr32[1] == htonl(0x00000000) &&
 695               daddr->s6_addr32[2] == htonl(0x00000001) &&
 696               daddr->s6_addr [12] == 0xff )) {
 697                 ND_PRINTK2(KERN_WARNING
 698                            "ICMPv6 NS: bad DAD packet (wrong destination)\n");
 699                 return;
 700         }
 701
 702         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 703                 ND_PRINTK2(KERN_WARNING
 704                            "ICMPv6 NS: invalid ND options\n");
 705                 return;
 706         }
 707
 708         if (ndopts.nd_opts_src_lladdr) {
 709                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
 710                 if (!lladdr) {
 711                         ND_PRINTK2(KERN_WARNING
 712                                    "ICMPv6 NS: invalid link-layer address length\n");
 713                         return;
 714                 }
 715
 716                 /* RFC2461 7.1.1:
 717                  *      If the IP source address is the unspecified address,
 718                  *      there MUST NOT be source link-layer address option
 719                  *      in the message.
 720                  */
 721                 if (dad) {
 722                         ND_PRINTK2(KERN_WARNING
 723                                    "ICMPv6 NS: bad DAD packet (link-layer address option)\n");
 724                         return;
 725                 }
 726         }
 727
 728         inc = ipv6_addr_is_multicast(daddr);
 729
 730         if ((ifp = ipv6_get_ifaddr(&init_net, &msg->target, dev, 1)) != NULL) {
 731
 732                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
 733                         if (dad) {
 734                                 if (dev->type == ARPHRD_IEEE802_TR) {
 735                                         const unsigned char *sadr;
 736                                         sadr = skb_mac_header(skb);
 737                                         if (((sadr[8] ^ dev->dev_addr[0]) & 0x7f) == 0 &&
 738                                             sadr[9] == dev->dev_addr[1] &&
 739                                             sadr[10] == dev->dev_addr[2] &&
 740                                             sadr[11] == dev->dev_addr[3] &&
 741                                             sadr[12] == dev->dev_addr[4] &&
 742                                             sadr[13] == dev->dev_addr[5]) {
 743                                                 /* looped-back to us */
 744                                                 goto out;
 745                                         }
 746                                 }
 747
 748                                 /*
 749                                  * We are colliding with another node
 750                                  * who is doing DAD
 751                                  * so fail our DAD process
 752                                  */
 753                                 addrconf_dad_failure(ifp);
 754                                 return;
 755                         } else {
 756                                 /*
 757                                  * This is not a dad solicitation.
 758                                  * If we are an optimistic node,
 759                                  * we should respond.
 760                                  * Otherwise, we should ignore it.
 761                                  */
 762                                 if (!(ifp->flags & IFA_F_OPTIMISTIC))
 763                                         goto out;
 764                         }
 765                 }
 766
 767                 idev = ifp->idev;
 768         } else {
 769                 idev = in6_dev_get(dev);
 770                 if (!idev) {
 771                         /* XXX: count this drop? */
 772                         return;
 773                 }
 774
 775                 if (ipv6_chk_acast_addr(dev, &msg->target) ||
 776                     (idev->cnf.forwarding &&
 777                      (ipv6_devconf.proxy_ndp || idev->cnf.proxy_ndp) &&
 778                      (pneigh = pneigh_lookup(&nd_tbl, &init_net,
 779                                              &msg->target, dev, 0)) != NULL)) {
 780                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
 781                             skb->pkt_type != PACKET_HOST &&
 782                             inc != 0 &&
 783                             idev->nd_parms->proxy_delay != 0) {
 784                                 /*
 785                                  * for anycast or proxy,
 786                                  * sender should delay its response
 787                                  * by a random time between 0 and
 788                                  * MAX_ANYCAST_DELAY_TIME seconds.
 789                                  * (RFC2461) -- yoshfuji
 790                                  */
 791                                 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
 792                                 if (n)
 793                                         pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
 794                                 goto out;
 795                         }
 796                 } else
 797                         goto out;
 798         }
 799
 800         is_router = !!(pneigh ? pneigh->flags & NTF_ROUTER : idev->cnf.forwarding);
 801
 802         if (dad) {
 803                 struct in6_addr maddr;
 804
 805                 ipv6_addr_all_nodes(&maddr);
 806                 ndisc_send_na(dev, NULL, &maddr, &msg->target,
 807                               is_router, 0, (ifp != NULL), 1);
 808                 goto out;
 809         }
 810
 811         if (inc)
 812                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
 813         else
 814                 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
 815
 816         /*
 817          *      update / create cache entry
 818          *      for the source address
 819          */
 820         neigh = __neigh_lookup(&nd_tbl, saddr, dev,
 821                                !inc || lladdr || !dev->addr_len);
 822         if (neigh)
 823                 neigh_update(neigh, lladdr, NUD_STALE,
 824                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 825                              NEIGH_UPDATE_F_OVERRIDE);
 826         if (neigh || !dev->header_ops) {
 827                 ndisc_send_na(dev, neigh, saddr, &msg->target,
 828                               is_router,
 829                               1, (ifp != NULL && inc), inc);
 830                 if (neigh)
 831                         neigh_release(neigh);
 832         }
 833
 834 out:
 835         if (ifp)
 836                 in6_ifa_put(ifp);
 837         else
 838                 in6_dev_put(idev);
 839
 840         return;
 841 }
 842
 843 static void ndisc_recv_na(struct sk_buff *skb)
 844 {
 845         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
 846         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 847         struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
 848         u8 *lladdr = NULL;
 849         u32 ndoptlen = skb->tail - (skb->transport_header +
 850                                     offsetof(struct nd_msg, opt));
 851         struct ndisc_options ndopts;
 852         struct net_device *dev = skb->dev;
 853         struct inet6_ifaddr *ifp;
 854         struct neighbour *neigh;
 855
 856         if (skb->len < sizeof(struct nd_msg)) {
 857                 ND_PRINTK2(KERN_WARNING
 858                            "ICMPv6 NA: packet too short\n");
 859                 return;
 860         }
 861
 862         if (ipv6_addr_is_multicast(&msg->target)) {
 863                 ND_PRINTK2(KERN_WARNING
 864                            "ICMPv6 NA: target address is multicast.\n");
 865                 return;
 866         }
 867
 868         if (ipv6_addr_is_multicast(daddr) &&
 869             msg->icmph.icmp6_solicited) {
 870                 ND_PRINTK2(KERN_WARNING
 871                            "ICMPv6 NA: solicited NA is multicasted.\n");
 872                 return;
 873         }
 874
 875         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
 876                 ND_PRINTK2(KERN_WARNING
 877                            "ICMPv6 NS: invalid ND option\n");
 878                 return;
 879         }
 880         if (ndopts.nd_opts_tgt_lladdr) {
 881                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
 882                 if (!lladdr) {
 883                         ND_PRINTK2(KERN_WARNING
 884                                    "ICMPv6 NA: invalid link-layer address length\n");
 885                         return;
 886                 }
 887         }
 888         if ((ifp = ipv6_get_ifaddr(&init_net, &msg->target, dev, 1))) {
 889                 if (ifp->flags & IFA_F_TENTATIVE) {
 890                         addrconf_dad_failure(ifp);
 891                         return;
 892                 }
 893                 /* What should we make now? The advertisement
 894                    is invalid, but ndisc specs say nothing
 895                    about it. It could be misconfiguration, or
 896                    an smart proxy agent tries to help us :-)
 897                  */
 898                 ND_PRINTK1(KERN_WARNING
 899                            "ICMPv6 NA: someone advertises our address on %s!\n",
 900                            ifp->idev->dev->name);
 901                 in6_ifa_put(ifp);
 902                 return;
 903         }
 904         neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
 905
 906         if (neigh) {
 907                 u8 old_flags = neigh->flags;
 908
 909                 if (neigh->nud_state & NUD_FAILED)
 910                         goto out;
 911
 912                 /*
 913                  * Don't update the neighbor cache entry on a proxy NA from
 914                  * ourselves because either the proxied node is off link or it
 915                  * has already sent a NA to us.
 916                  */
 917                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
 918                     ipv6_devconf.forwarding && ipv6_devconf.proxy_ndp &&
 919                     pneigh_lookup(&nd_tbl, &init_net, &msg->target, dev, 0)) {
 920                         /* XXX: idev->cnf.prixy_ndp */
 921                         goto out;
 922                 }
 923
 924                 neigh_update(neigh, lladdr,
 925                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
 926                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 927                              (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
 928                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
 929                              (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
 930
 931                 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
 932                         /*
 933                          * Change: router to host
 934                          */
 935                         struct rt6_info *rt;
 936                         rt = rt6_get_dflt_router(saddr, dev);
 937                         if (rt)
 938                                 ip6_del_rt(rt);
 939                 }
 940
 941 out:
 942                 neigh_release(neigh);
 943         }
 944 }
 945
 946 static void ndisc_recv_rs(struct sk_buff *skb)
 947 {
 948         struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
 949         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
 950         struct neighbour *neigh;
 951         struct inet6_dev *idev;
 952         struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
 953         struct ndisc_options ndopts;
 954         u8 *lladdr = NULL;
 955
 956         if (skb->len < sizeof(*rs_msg))
 957                 return;
 958
 959         idev = in6_dev_get(skb->dev);
 960         if (!idev) {
 961                 if (net_ratelimit())
 962                         ND_PRINTK1("ICMP6 RS: can't find in6 device\n");
 963                 return;
 964         }
 965
 966         /* Don't accept RS if we're not in router mode */
 967         if (!idev->cnf.forwarding)
 968                 goto out;
 969
 970         /*
 971          * Don't update NCE if src = ::;
 972          * this implies that the source node has no ip address assigned yet.
 973          */
 974         if (ipv6_addr_any(saddr))
 975                 goto out;
 976
 977         /* Parse ND options */
 978         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
 979                 if (net_ratelimit())
 980                         ND_PRINTK2("ICMP6 NS: invalid ND option, ignored\n");
 981                 goto out;
 982         }
 983
 984         if (ndopts.nd_opts_src_lladdr) {
 985                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
 986                                              skb->dev);
 987                 if (!lladdr)
 988                         goto out;
 989         }
 990
 991         neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
 992         if (neigh) {
 993                 neigh_update(neigh, lladdr, NUD_STALE,
 994                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
 995                              NEIGH_UPDATE_F_OVERRIDE|
 996                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
 997                 neigh_release(neigh);
 998         }
 999 out:
1000         in6_dev_put(idev);
1001 }
1002
1003 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1004 {
1005         struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1006         struct sk_buff *skb;
1007         struct nlmsghdr *nlh;
1008         struct nduseroptmsg *ndmsg;
1009         int err;
1010         int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1011                                     + (opt->nd_opt_len << 3));
1012         size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1013
1014         skb = nlmsg_new(msg_size, GFP_ATOMIC);
1015         if (skb == NULL) {
1016                 err = -ENOBUFS;
1017                 goto errout;
1018         }
1019
1020         nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1021         if (nlh == NULL) {
1022                 goto nla_put_failure;
1023         }
1024
1025         ndmsg = nlmsg_data(nlh);
1026         ndmsg->nduseropt_family = AF_INET6;
1027         ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1028         ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1029         ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1030         ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1031
1032         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1033
1034         NLA_PUT(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1035                 &ipv6_hdr(ra)->saddr);
1036         nlmsg_end(skb, nlh);
1037
1038         err = rtnl_notify(skb, &init_net, 0, RTNLGRP_ND_USEROPT, NULL,
1039                           GFP_ATOMIC);
1040         if (err < 0)
1041                 goto errout;
1042
1043         return;
1044
1045 nla_put_failure:
1046         nlmsg_free(skb);
1047         err = -EMSGSIZE;
1048 errout:
1049         rtnl_set_sk_err(&init_net, RTNLGRP_ND_USEROPT, err);
1050 }
1051
1052 static void ndisc_router_discovery(struct sk_buff *skb)
1053 {
1054         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1055         struct neighbour *neigh = NULL;
1056         struct inet6_dev *in6_dev;
1057         struct rt6_info *rt = NULL;
1058         int lifetime;
1059         struct ndisc_options ndopts;
1060         int optlen;
1061         unsigned int pref = 0;
1062
1063         __u8 * opt = (__u8 *)(ra_msg + 1);
1064
1065         optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
1066
1067         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1068                 ND_PRINTK2(KERN_WARNING
1069                            "ICMPv6 RA: source address is not link-local.\n");
1070                 return;
1071         }
1072         if (optlen < 0) {
1073                 ND_PRINTK2(KERN_WARNING
1074                            "ICMPv6 RA: packet too short\n");
1075                 return;
1076         }
1077
1078         /*
1079          *      set the RA_RECV flag in the interface
1080          */
1081
1082         in6_dev = in6_dev_get(skb->dev);
1083         if (in6_dev == NULL) {
1084                 ND_PRINTK0(KERN_ERR
1085                            "ICMPv6 RA: can't find inet6 device for %s.\n",
1086                            skb->dev->name);
1087                 return;
1088         }
1089         if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra) {
1090                 in6_dev_put(in6_dev);
1091                 return;
1092         }
1093
1094         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1095                 in6_dev_put(in6_dev);
1096                 ND_PRINTK2(KERN_WARNING
1097                            "ICMP6 RA: invalid ND options\n");
1098                 return;
1099         }
1100
1101         if (in6_dev->if_flags & IF_RS_SENT) {
1102                 /*
1103                  *      flag that an RA was received after an RS was sent
1104                  *      out on this interface.
1105                  */
1106                 in6_dev->if_flags |= IF_RA_RCVD;
1107         }
1108
1109         /*
1110          * Remember the managed/otherconf flags from most recently
1111          * received RA message (RFC 2462) -- yoshfuji
1112          */
1113         in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1114                                 IF_RA_OTHERCONF)) |
1115                                 (ra_msg->icmph.icmp6_addrconf_managed ?
1116                                         IF_RA_MANAGED : 0) |
1117                                 (ra_msg->icmph.icmp6_addrconf_other ?
1118                                         IF_RA_OTHERCONF : 0);
1119
1120         if (!in6_dev->cnf.accept_ra_defrtr)
1121                 goto skip_defrtr;
1122
1123         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1124
1125 #ifdef CONFIG_IPV6_ROUTER_PREF
1126         pref = ra_msg->icmph.icmp6_router_pref;
1127         /* 10b is handled as if it were 00b (medium) */
1128         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1129             !in6_dev->cnf.accept_ra_rtr_pref)
1130                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1131 #endif
1132
1133         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1134
1135         if (rt)
1136                 neigh = rt->rt6i_nexthop;
1137
1138         if (rt && lifetime == 0) {
1139                 neigh_clone(neigh);
1140                 ip6_del_rt(rt);
1141                 rt = NULL;
1142         }
1143
1144         if (rt == NULL && lifetime) {
1145                 ND_PRINTK3(KERN_DEBUG
1146                            "ICMPv6 RA: adding default router.\n");
1147
1148                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1149                 if (rt == NULL) {
1150                         ND_PRINTK0(KERN_ERR
1151                                    "ICMPv6 RA: %s() failed to add default route.\n",
1152                                    __FUNCTION__);
1153                         in6_dev_put(in6_dev);
1154                         return;
1155                 }
1156
1157                 neigh = rt->rt6i_nexthop;
1158                 if (neigh == NULL) {
1159                         ND_PRINTK0(KERN_ERR
1160                                    "ICMPv6 RA: %s() got default router without neighbour.\n",
1161                                    __FUNCTION__);
1162                         dst_release(&rt->u.dst);
1163                         in6_dev_put(in6_dev);
1164                         return;
1165                 }
1166                 neigh->flags |= NTF_ROUTER;
1167         } else if (rt) {
1168                 rt->rt6i_flags |= (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1169         }
1170
1171         if (rt)
1172                 rt->rt6i_expires = jiffies + (HZ * lifetime);
1173
1174         if (ra_msg->icmph.icmp6_hop_limit) {
1175                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1176                 if (rt)
1177                         rt->u.dst.metrics[RTAX_HOPLIMIT-1] = ra_msg->icmph.icmp6_hop_limit;
1178         }
1179
1180 skip_defrtr:
1181
1182         /*
1183          *      Update Reachable Time and Retrans Timer
1184          */
1185
1186         if (in6_dev->nd_parms) {
1187                 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1188
1189                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1190                         rtime = (rtime*HZ)/1000;
1191                         if (rtime < HZ/10)
1192                                 rtime = HZ/10;
1193                         in6_dev->nd_parms->retrans_time = rtime;
1194                         in6_dev->tstamp = jiffies;
1195                         inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1196                 }
1197
1198                 rtime = ntohl(ra_msg->reachable_time);
1199                 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1200                         rtime = (rtime*HZ)/1000;
1201
1202                         if (rtime < HZ/10)
1203                                 rtime = HZ/10;
1204
1205                         if (rtime != in6_dev->nd_parms->base_reachable_time) {
1206                                 in6_dev->nd_parms->base_reachable_time = rtime;
1207                                 in6_dev->nd_parms->gc_staletime = 3 * rtime;
1208                                 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1209                                 in6_dev->tstamp = jiffies;
1210                                 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1211                         }
1212                 }
1213         }
1214
1215         /*
1216          *      Process options.
1217          */
1218
1219         if (!neigh)
1220                 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1221                                        skb->dev, 1);
1222         if (neigh) {
1223                 u8 *lladdr = NULL;
1224                 if (ndopts.nd_opts_src_lladdr) {
1225                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1226                                                      skb->dev);
1227                         if (!lladdr) {
1228                                 ND_PRINTK2(KERN_WARNING
1229                                            "ICMPv6 RA: invalid link-layer address length\n");
1230                                 goto out;
1231                         }
1232                 }
1233                 neigh_update(neigh, lladdr, NUD_STALE,
1234                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
1235                              NEIGH_UPDATE_F_OVERRIDE|
1236                              NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1237                              NEIGH_UPDATE_F_ISROUTER);
1238         }
1239
1240 #ifdef CONFIG_IPV6_ROUTE_INFO
1241         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1242                 struct nd_opt_hdr *p;
1243                 for (p = ndopts.nd_opts_ri;
1244                      p;
1245                      p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1246                         if (((struct route_info *)p)->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1247                                 continue;
1248                         rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
1249                                       &ipv6_hdr(skb)->saddr);
1250                 }
1251         }
1252 #endif
1253
1254         if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1255                 struct nd_opt_hdr *p;
1256                 for (p = ndopts.nd_opts_pi;
1257                      p;
1258                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1259                         addrconf_prefix_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3);
1260                 }
1261         }
1262
1263         if (ndopts.nd_opts_mtu) {
1264                 __be32 n;
1265                 u32 mtu;
1266
1267                 memcpy(&n, ((u8*)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1268                 mtu = ntohl(n);
1269
1270                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1271                         ND_PRINTK2(KERN_WARNING
1272                                    "ICMPv6 RA: invalid mtu: %d\n",
1273                                    mtu);
1274                 } else if (in6_dev->cnf.mtu6 != mtu) {
1275                         in6_dev->cnf.mtu6 = mtu;
1276
1277                         if (rt)
1278                                 rt->u.dst.metrics[RTAX_MTU-1] = mtu;
1279
1280                         rt6_mtu_change(skb->dev, mtu);
1281                 }
1282         }
1283
1284         if (ndopts.nd_useropts) {
1285                 struct nd_opt_hdr *p;
1286                 for (p = ndopts.nd_useropts;
1287                      p;
1288                      p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1289                         ndisc_ra_useropt(skb, p);
1290                 }
1291         }
1292
1293         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1294                 ND_PRINTK2(KERN_WARNING
1295                            "ICMPv6 RA: invalid RA options");
1296         }
1297 out:
1298         if (rt)
1299                 dst_release(&rt->u.dst);
1300         else if (neigh)
1301                 neigh_release(neigh);
1302         in6_dev_put(in6_dev);
1303 }
1304
1305 static void ndisc_redirect_rcv(struct sk_buff *skb)
1306 {
1307         struct inet6_dev *in6_dev;
1308         struct icmp6hdr *icmph;
1309         struct in6_addr *dest;
1310         struct in6_addr *target;        /* new first hop to destination */
1311         struct neighbour *neigh;
1312         int on_link = 0;
1313         struct ndisc_options ndopts;
1314         int optlen;
1315         u8 *lladdr = NULL;
1316
1317         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1318                 ND_PRINTK2(KERN_WARNING
1319                            "ICMPv6 Redirect: source address is not link-local.\n");
1320                 return;
1321         }
1322
1323         optlen = skb->tail - skb->transport_header;
1324         optlen -= sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
1325
1326         if (optlen < 0) {
1327                 ND_PRINTK2(KERN_WARNING
1328                            "ICMPv6 Redirect: packet too short\n");
1329                 return;
1330         }
1331
1332         icmph = icmp6_hdr(skb);
1333         target = (struct in6_addr *) (icmph + 1);
1334         dest = target + 1;
1335
1336         if (ipv6_addr_is_multicast(dest)) {
1337                 ND_PRINTK2(KERN_WARNING
1338                            "ICMPv6 Redirect: destination address is multicast.\n");
1339                 return;
1340         }
1341
1342         if (ipv6_addr_equal(dest, target)) {
1343                 on_link = 1;
1344         } else if (ipv6_addr_type(target) !=
1345                    (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1346                 ND_PRINTK2(KERN_WARNING
1347                            "ICMPv6 Redirect: target address is not link-local unicast.\n");
1348                 return;
1349         }
1350
1351         in6_dev = in6_dev_get(skb->dev);
1352         if (!in6_dev)
1353                 return;
1354         if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_redirects) {
1355                 in6_dev_put(in6_dev);
1356                 return;
1357         }
1358
1359         /* RFC2461 8.1:
1360          *      The IP source address of the Redirect MUST be the same as the current
1361          *      first-hop router for the specified ICMP Destination Address.
1362          */
1363
1364         if (!ndisc_parse_options((u8*)(dest + 1), optlen, &ndopts)) {
1365                 ND_PRINTK2(KERN_WARNING
1366                            "ICMPv6 Redirect: invalid ND options\n");
1367                 in6_dev_put(in6_dev);
1368                 return;
1369         }
1370         if (ndopts.nd_opts_tgt_lladdr) {
1371                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr,
1372                                              skb->dev);
1373                 if (!lladdr) {
1374                         ND_PRINTK2(KERN_WARNING
1375                                    "ICMPv6 Redirect: invalid link-layer address length\n");
1376                         in6_dev_put(in6_dev);
1377                         return;
1378                 }
1379         }
1380
1381         neigh = __neigh_lookup(&nd_tbl, target, skb->dev, 1);
1382         if (neigh) {
1383                 rt6_redirect(dest, &ipv6_hdr(skb)->daddr,
1384                              &ipv6_hdr(skb)->saddr, neigh, lladdr,
1385                              on_link);
1386                 neigh_release(neigh);
1387         }
1388         in6_dev_put(in6_dev);
1389 }
1390
1391 void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
1392                          struct in6_addr *target)
1393 {
1394         struct sock *sk = ndisc_socket->sk;
1395         int len = sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
1396         struct sk_buff *buff;
1397         struct icmp6hdr *icmph;
1398         struct in6_addr saddr_buf;
1399         struct in6_addr *addrp;
1400         struct net_device *dev;
1401         struct rt6_info *rt;
1402         struct dst_entry *dst;
1403         struct inet6_dev *idev;
1404         struct flowi fl;
1405         u8 *opt;
1406         int rd_len;
1407         int err;
1408         int hlen;
1409         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1410
1411         dev = skb->dev;
1412
1413         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1414                 ND_PRINTK2(KERN_WARNING
1415                            "ICMPv6 Redirect: no link-local address on %s\n",
1416                            dev->name);
1417                 return;
1418         }
1419
1420         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1421             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1422                 ND_PRINTK2(KERN_WARNING
1423                         "ICMPv6 Redirect: target address is not link-local unicast.\n");
1424                 return;
1425         }
1426
1427         icmpv6_flow_init(ndisc_socket->sk, &fl, NDISC_REDIRECT,
1428                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1429
1430         dst = ip6_route_output(&init_net, NULL, &fl);
1431         if (dst == NULL)
1432                 return;
1433
1434         err = xfrm_lookup(&dst, &fl, NULL, 0);
1435         if (err)
1436                 return;
1437
1438         rt = (struct rt6_info *) dst;
1439
1440         if (rt->rt6i_flags & RTF_GATEWAY) {
1441                 ND_PRINTK2(KERN_WARNING
1442                            "ICMPv6 Redirect: destination is not a neighbour.\n");
1443                 dst_release(dst);
1444                 return;
1445         }
1446         if (!xrlim_allow(dst, 1*HZ)) {
1447                 dst_release(dst);
1448                 return;
1449         }
1450
1451         if (dev->addr_len) {
1452                 read_lock_bh(&neigh->lock);
1453                 if (neigh->nud_state & NUD_VALID) {
1454                         memcpy(ha_buf, neigh->ha, dev->addr_len);
1455                         read_unlock_bh(&neigh->lock);
1456                         ha = ha_buf;
1457                         len += ndisc_opt_addr_space(dev);
1458                 } else
1459                         read_unlock_bh(&neigh->lock);
1460         }
1461
1462         rd_len = min_t(unsigned int,
1463                      IPV6_MIN_MTU-sizeof(struct ipv6hdr)-len, skb->len + 8);
1464         rd_len &= ~0x7;
1465         len += rd_len;
1466
1467         buff = sock_alloc_send_skb(sk,
1468                                    (MAX_HEADER + sizeof(struct ipv6hdr) +
1469                                     len + LL_RESERVED_SPACE(dev)),
1470                                    1, &err);
1471         if (buff == NULL) {
1472                 ND_PRINTK0(KERN_ERR
1473                            "ICMPv6 Redirect: %s() failed to allocate an skb.\n",
1474                            __FUNCTION__);
1475                 dst_release(dst);
1476                 return;
1477         }
1478
1479         hlen = 0;
1480
1481         skb_reserve(buff, LL_RESERVED_SPACE(dev));
1482         ip6_nd_hdr(sk, buff, dev, &saddr_buf, &ipv6_hdr(skb)->saddr,
1483                    IPPROTO_ICMPV6, len);
1484
1485         skb_set_transport_header(buff, skb_tail_pointer(buff) - buff->data);
1486         skb_put(buff, len);
1487         icmph = icmp6_hdr(buff);
1488
1489         memset(icmph, 0, sizeof(struct icmp6hdr));
1490         icmph->icmp6_type = NDISC_REDIRECT;
1491
1492         /*
1493          *      copy target and destination addresses
1494          */
1495
1496         addrp = (struct in6_addr *)(icmph + 1);
1497         ipv6_addr_copy(addrp, target);
1498         addrp++;
1499         ipv6_addr_copy(addrp, &ipv6_hdr(skb)->daddr);
1500
1501         opt = (u8*) (addrp + 1);
1502
1503         /*
1504          *      include target_address option
1505          */
1506
1507         if (ha)
1508                 opt = ndisc_fill_addr_option(opt, ND_OPT_TARGET_LL_ADDR, ha,
1509                                              dev->addr_len, dev->type);
1510
1511         /*
1512          *      build redirect option and copy skb over to the new packet.
1513          */
1514
1515         memset(opt, 0, 8);
1516         *(opt++) = ND_OPT_REDIRECT_HDR;
1517         *(opt++) = (rd_len >> 3);
1518         opt += 6;
1519
1520         memcpy(opt, ipv6_hdr(skb), rd_len - 8);
1521
1522         icmph->icmp6_cksum = csum_ipv6_magic(&saddr_buf, &ipv6_hdr(skb)->saddr,
1523                                              len, IPPROTO_ICMPV6,
1524                                              csum_partial((u8 *) icmph, len, 0));
1525
1526         buff->dst = dst;
1527         idev = in6_dev_get(dst->dev);
1528         IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
1529         err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, buff, NULL, dst->dev,
1530                       dst_output);
1531         if (!err) {
1532                 ICMP6MSGOUT_INC_STATS(idev, NDISC_REDIRECT);
1533                 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
1534         }
1535
1536         if (likely(idev != NULL))
1537                 in6_dev_put(idev);
1538 }
1539
1540 static void pndisc_redo(struct sk_buff *skb)
1541 {
1542         ndisc_recv_ns(skb);
1543         kfree_skb(skb);
1544 }
1545
1546 int ndisc_rcv(struct sk_buff *skb)
1547 {
1548         struct nd_msg *msg;
1549
1550         if (!pskb_may_pull(skb, skb->len))
1551                 return 0;
1552
1553         msg = (struct nd_msg *)skb_transport_header(skb);
1554
1555         __skb_push(skb, skb->data - skb_transport_header(skb));
1556
1557         if (ipv6_hdr(skb)->hop_limit != 255) {
1558                 ND_PRINTK2(KERN_WARNING
1559                            "ICMPv6 NDISC: invalid hop-limit: %d\n",
1560                            ipv6_hdr(skb)->hop_limit);
1561                 return 0;
1562         }
1563
1564         if (msg->icmph.icmp6_code != 0) {
1565                 ND_PRINTK2(KERN_WARNING
1566                            "ICMPv6 NDISC: invalid ICMPv6 code: %d\n",
1567                            msg->icmph.icmp6_code);
1568                 return 0;
1569         }
1570
1571         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1572
1573         switch (msg->icmph.icmp6_type) {
1574         case NDISC_NEIGHBOUR_SOLICITATION:
1575                 ndisc_recv_ns(skb);
1576                 break;
1577
1578         case NDISC_NEIGHBOUR_ADVERTISEMENT:
1579                 ndisc_recv_na(skb);
1580                 break;
1581
1582         case NDISC_ROUTER_SOLICITATION:
1583                 ndisc_recv_rs(skb);
1584                 break;
1585
1586         case NDISC_ROUTER_ADVERTISEMENT:
1587                 ndisc_router_discovery(skb);
1588                 break;
1589
1590         case NDISC_REDIRECT:
1591                 ndisc_redirect_rcv(skb);
1592                 break;
1593         }
1594
1595         return 0;
1596 }
1597
1598 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1599 {
1600         struct net_device *dev = ptr;
1601         struct net *net = dev->nd_net;
1602
1603         if (dev->nd_net != &init_net)
1604                 return NOTIFY_DONE;
1605
1606         switch (event) {
1607         case NETDEV_CHANGEADDR:
1608                 neigh_changeaddr(&nd_tbl, dev);
1609                 fib6_run_gc(~0UL, net);
1610                 break;
1611         case NETDEV_DOWN:
1612                 neigh_ifdown(&nd_tbl, dev);
1613                 fib6_run_gc(~0UL, net);
1614                 break;
1615         default:
1616                 break;
1617         }
1618
1619         return NOTIFY_DONE;
1620 }
1621
1622 static struct notifier_block ndisc_netdev_notifier = {
1623         .notifier_call = ndisc_netdev_event,
1624 };
1625
1626 #ifdef CONFIG_SYSCTL
1627 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1628                                          const char *func, const char *dev_name)
1629 {
1630         static char warncomm[TASK_COMM_LEN];
1631         static int warned;
1632         if (strcmp(warncomm, current->comm) && warned < 5) {
1633                 strcpy(warncomm, current->comm);
1634                 printk(KERN_WARNING
1635                         "process `%s' is using deprecated sysctl (%s) "
1636                         "net.ipv6.neigh.%s.%s; "
1637                         "Use net.ipv6.neigh.%s.%s_ms "
1638                         "instead.\n",
1639                         warncomm, func,
1640                         dev_name, ctl->procname,
1641                         dev_name, ctl->procname);
1642                 warned++;
1643         }
1644 }
1645
1646 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, struct file * filp, void __user *buffer, size_t *lenp, loff_t *ppos)
1647 {
1648         struct net_device *dev = ctl->extra1;
1649         struct inet6_dev *idev;
1650         int ret;
1651
1652         if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1653             (strcmp(ctl->procname, "base_reachable_time") == 0))
1654                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1655
1656         if (strcmp(ctl->procname, "retrans_time") == 0)
1657                 ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
1658
1659         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1660                 ret = proc_dointvec_jiffies(ctl, write,
1661                                             filp, buffer, lenp, ppos);
1662
1663         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1664                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1665                 ret = proc_dointvec_ms_jiffies(ctl, write,
1666                                                filp, buffer, lenp, ppos);
1667         else
1668                 ret = -1;
1669
1670         if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1671                 if (ctl->data == &idev->nd_parms->base_reachable_time)
1672                         idev->nd_parms->reachable_time = neigh_rand_reach_time(idev->nd_parms->base_reachable_time);
1673                 idev->tstamp = jiffies;
1674                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1675                 in6_dev_put(idev);
1676         }
1677         return ret;
1678 }
1679
1680 static int ndisc_ifinfo_sysctl_strategy(ctl_table *ctl, int __user *name,
1681                                         int nlen, void __user *oldval,
1682                                         size_t __user *oldlenp,
1683                                         void __user *newval, size_t newlen)
1684 {
1685         struct net_device *dev = ctl->extra1;
1686         struct inet6_dev *idev;
1687         int ret;
1688
1689         if (ctl->ctl_name == NET_NEIGH_RETRANS_TIME ||
1690             ctl->ctl_name == NET_NEIGH_REACHABLE_TIME)
1691                 ndisc_warn_deprecated_sysctl(ctl, "procfs", dev ? dev->name : "default");
1692
1693         switch (ctl->ctl_name) {
1694         case NET_NEIGH_REACHABLE_TIME:
1695                 ret = sysctl_jiffies(ctl, name, nlen,
1696                                      oldval, oldlenp, newval, newlen);
1697                 break;
1698         case NET_NEIGH_RETRANS_TIME_MS:
1699         case NET_NEIGH_REACHABLE_TIME_MS:
1700                  ret = sysctl_ms_jiffies(ctl, name, nlen,
1701                                          oldval, oldlenp, newval, newlen);
1702                  break;
1703         default:
1704                 ret = 0;
1705         }
1706
1707         if (newval && newlen && ret > 0 &&
1708             dev && (idev = in6_dev_get(dev)) != NULL) {
1709                 if (ctl->ctl_name == NET_NEIGH_REACHABLE_TIME ||
1710                     ctl->ctl_name == NET_NEIGH_REACHABLE_TIME_MS)
1711                         idev->nd_parms->reachable_time = neigh_rand_reach_time(idev->nd_parms->base_reachable_time);
1712                 idev->tstamp = jiffies;
1713                 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1714                 in6_dev_put(idev);
1715         }
1716
1717         return ret;
1718 }
1719
1720 #endif
1721
1722 int __init ndisc_init(void)
1723 {
1724         struct ipv6_pinfo *np;
1725         struct sock *sk;
1726         int err;
1727
1728         err = sock_create_kern(PF_INET6, SOCK_RAW, IPPROTO_ICMPV6, &ndisc_socket);
1729         if (err < 0) {
1730                 ND_PRINTK0(KERN_ERR
1731                            "ICMPv6 NDISC: Failed to initialize the control socket (err %d).\n",
1732                            err);
1733                 ndisc_socket = NULL; /* For safety. */
1734                 return err;
1735         }
1736
1737         sk = ndisc_socket->sk;
1738         np = inet6_sk(sk);
1739         sk->sk_allocation = GFP_ATOMIC;
1740         np->hop_limit = 255;
1741         /* Do not loopback ndisc messages */
1742         np->mc_loop = 0;
1743         sk->sk_prot->unhash(sk);
1744
1745         /*
1746          * Initialize the neighbour table
1747          */
1748
1749         neigh_table_init(&nd_tbl);
1750
1751 #ifdef CONFIG_SYSCTL
1752         neigh_sysctl_register(NULL, &nd_tbl.parms, NET_IPV6, NET_IPV6_NEIGH,
1753                               "ipv6",
1754                               &ndisc_ifinfo_sysctl_change,
1755                               &ndisc_ifinfo_sysctl_strategy);
1756 #endif
1757
1758         register_netdevice_notifier(&ndisc_netdev_notifier);
1759         return 0;
1760 }
1761
1762 void ndisc_cleanup(void)
1763 {
1764         unregister_netdevice_notifier(&ndisc_netdev_notifier);
1765 #ifdef CONFIG_SYSCTL
1766         neigh_sysctl_unregister(&nd_tbl.parms);
1767 #endif
1768         neigh_table_clear(&nd_tbl);
1769         sock_release(ndisc_socket);
1770         ndisc_socket = NULL; /* For safety. */
1771 }