1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30#define pr_fmt(fmt) "ICMPv6: " fmt
31
32#include <linux/module.h>
33#include <linux/errno.h>
34#include <linux/types.h>
35#include <linux/socket.h>
36#include <linux/sockios.h>
37#include <linux/sched.h>
38#include <linux/net.h>
39#include <linux/in6.h>
40#include <linux/route.h>
41#include <linux/init.h>
42#include <linux/rcupdate.h>
43#include <linux/slab.h>
44#ifdef CONFIG_SYSCTL
45#include <linux/sysctl.h>
46#endif
47
48#include <linux/if_addr.h>
49#include <linux/if_arp.h>
50#include <linux/ipv6.h>
51#include <linux/icmpv6.h>
52#include <linux/jhash.h>
53
54#include <net/sock.h>
55#include <net/snmp.h>
56
57#include <net/ipv6.h>
58#include <net/protocol.h>
59#include <net/ndisc.h>
60#include <net/ip6_route.h>
61#include <net/addrconf.h>
62#include <net/icmp.h>
63
64#include <net/netlink.h>
65#include <linux/rtnetlink.h>
66
67#include <net/flow.h>
68#include <net/ip6_checksum.h>
69#include <net/inet_common.h>
70#include <net/l3mdev.h>
71#include <linux/proc_fs.h>
72
73#include <linux/netfilter.h>
74#include <linux/netfilter_ipv6.h>
75
76
77#define ND_DEBUG 1
78
79#define ND_PRINTK(val, level, fmt, ...) \
80do { \
81 if (val <= ND_DEBUG) \
82 net_##level##_ratelimited(fmt, ##__VA_ARGS__); \
83} while (0)
84
85static u32 ndisc_hash(const void *pkey,
86 const struct net_device *dev,
87 __u32 *hash_rnd);
88static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
89static int ndisc_constructor(struct neighbour *neigh);
90static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
91static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
92static int pndisc_constructor(struct pneigh_entry *n);
93static void pndisc_destructor(struct pneigh_entry *n);
94static void pndisc_redo(struct sk_buff *skb);
95
96static const struct neigh_ops ndisc_generic_ops = {
97 .family = AF_INET6,
98 .solicit = ndisc_solicit,
99 .error_report = ndisc_error_report,
100 .output = neigh_resolve_output,
101 .connected_output = neigh_connected_output,
102};
103
104static const struct neigh_ops ndisc_hh_ops = {
105 .family = AF_INET6,
106 .solicit = ndisc_solicit,
107 .error_report = ndisc_error_report,
108 .output = neigh_resolve_output,
109 .connected_output = neigh_resolve_output,
110};
111
112
113static const struct neigh_ops ndisc_direct_ops = {
114 .family = AF_INET6,
115 .output = neigh_direct_output,
116 .connected_output = neigh_direct_output,
117};
118
119struct neigh_table nd_tbl = {
120 .family = AF_INET6,
121 .key_len = sizeof(struct in6_addr),
122 .protocol = cpu_to_be16(ETH_P_IPV6),
123 .hash = ndisc_hash,
124 .key_eq = ndisc_key_eq,
125 .constructor = ndisc_constructor,
126 .pconstructor = pndisc_constructor,
127 .pdestructor = pndisc_destructor,
128 .proxy_redo = pndisc_redo,
129 .id = "ndisc_cache",
130 .parms = {
131 .tbl = &nd_tbl,
132 .reachable_time = ND_REACHABLE_TIME,
133 .data = {
134 [NEIGH_VAR_MCAST_PROBES] = 3,
135 [NEIGH_VAR_UCAST_PROBES] = 3,
136 [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
137 [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
138 [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
139 [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
140 [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
141 [NEIGH_VAR_PROXY_QLEN] = 64,
142 [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
143 [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
144 },
145 },
146 .gc_interval = 30 * HZ,
147 .gc_thresh1 = 128,
148 .gc_thresh2 = 512,
149 .gc_thresh3 = 1024,
150};
151EXPORT_SYMBOL_GPL(nd_tbl);
152
153static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
154{
155 int pad = ndisc_addr_option_pad(skb->dev->type);
156 int data_len = skb->dev->addr_len;
157 int space = ndisc_opt_addr_space(skb->dev);
158 u8 *opt = skb_put(skb, space);
159
160 opt[0] = type;
161 opt[1] = space>>3;
162
163 memset(opt + 2, 0, pad);
164 opt += pad;
165 space -= pad;
166
167 memcpy(opt+2, data, data_len);
168 data_len += 2;
169 opt += data_len;
170 space -= data_len;
171 if (space > 0)
172 memset(opt, 0, space);
173}
174
175static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
176 struct nd_opt_hdr *end)
177{
178 int type;
179 if (!cur || !end || cur >= end)
180 return NULL;
181 type = cur->nd_opt_type;
182 do {
183 cur = ((void *)cur) + (cur->nd_opt_len << 3);
184 } while (cur < end && cur->nd_opt_type != type);
185 return cur <= end && cur->nd_opt_type == type ? cur : NULL;
186}
187
188static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
189{
190 return opt->nd_opt_type == ND_OPT_RDNSS ||
191 opt->nd_opt_type == ND_OPT_DNSSL;
192}
193
194static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
195 struct nd_opt_hdr *end)
196{
197 if (!cur || !end || cur >= end)
198 return NULL;
199 do {
200 cur = ((void *)cur) + (cur->nd_opt_len << 3);
201 } while (cur < end && !ndisc_is_useropt(cur));
202 return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
203}
204
205struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
206 struct ndisc_options *ndopts)
207{
208 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
209
210 if (!nd_opt || opt_len < 0 || !ndopts)
211 return NULL;
212 memset(ndopts, 0, sizeof(*ndopts));
213 while (opt_len) {
214 int l;
215 if (opt_len < sizeof(struct nd_opt_hdr))
216 return NULL;
217 l = nd_opt->nd_opt_len << 3;
218 if (opt_len < l || l == 0)
219 return NULL;
220 switch (nd_opt->nd_opt_type) {
221 case ND_OPT_SOURCE_LL_ADDR:
222 case ND_OPT_TARGET_LL_ADDR:
223 case ND_OPT_MTU:
224 case ND_OPT_REDIRECT_HDR:
225 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
226 ND_PRINTK(2, warn,
227 "%s: duplicated ND6 option found: type=%d\n",
228 __func__, nd_opt->nd_opt_type);
229 } else {
230 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
231 }
232 break;
233 case ND_OPT_PREFIX_INFO:
234 ndopts->nd_opts_pi_end = nd_opt;
235 if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
236 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
237 break;
238#ifdef CONFIG_IPV6_ROUTE_INFO
239 case ND_OPT_ROUTE_INFO:
240 ndopts->nd_opts_ri_end = nd_opt;
241 if (!ndopts->nd_opts_ri)
242 ndopts->nd_opts_ri = nd_opt;
243 break;
244#endif
245 default:
246 if (ndisc_is_useropt(nd_opt)) {
247 ndopts->nd_useropts_end = nd_opt;
248 if (!ndopts->nd_useropts)
249 ndopts->nd_useropts = nd_opt;
250 } else {
251
252
253
254
255
256 ND_PRINTK(2, notice,
257 "%s: ignored unsupported option; type=%d, len=%d\n",
258 __func__,
259 nd_opt->nd_opt_type,
260 nd_opt->nd_opt_len);
261 }
262 }
263 opt_len -= l;
264 nd_opt = ((void *)nd_opt) + l;
265 }
266 return ndopts;
267}
268
269int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
270{
271 switch (dev->type) {
272 case ARPHRD_ETHER:
273 case ARPHRD_IEEE802:
274 case ARPHRD_FDDI:
275 ipv6_eth_mc_map(addr, buf);
276 return 0;
277 case ARPHRD_ARCNET:
278 ipv6_arcnet_mc_map(addr, buf);
279 return 0;
280 case ARPHRD_INFINIBAND:
281 ipv6_ib_mc_map(addr, dev->broadcast, buf);
282 return 0;
283 case ARPHRD_IPGRE:
284 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
285 default:
286 if (dir) {
287 memcpy(buf, dev->broadcast, dev->addr_len);
288 return 0;
289 }
290 }
291 return -EINVAL;
292}
293EXPORT_SYMBOL(ndisc_mc_map);
294
295static u32 ndisc_hash(const void *pkey,
296 const struct net_device *dev,
297 __u32 *hash_rnd)
298{
299 return ndisc_hashfn(pkey, dev, hash_rnd);
300}
301
302static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
303{
304 return neigh_key_eq128(n, pkey);
305}
306
307static int ndisc_constructor(struct neighbour *neigh)
308{
309 struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
310 struct net_device *dev = neigh->dev;
311 struct inet6_dev *in6_dev;
312 struct neigh_parms *parms;
313 bool is_multicast = ipv6_addr_is_multicast(addr);
314
315 in6_dev = in6_dev_get(dev);
316 if (!in6_dev) {
317 return -EINVAL;
318 }
319
320 parms = in6_dev->nd_parms;
321 __neigh_parms_put(neigh->parms);
322 neigh->parms = neigh_parms_clone(parms);
323
324 neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
325 if (!dev->header_ops) {
326 neigh->nud_state = NUD_NOARP;
327 neigh->ops = &ndisc_direct_ops;
328 neigh->output = neigh_direct_output;
329 } else {
330 if (is_multicast) {
331 neigh->nud_state = NUD_NOARP;
332 ndisc_mc_map(addr, neigh->ha, dev, 1);
333 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
334 neigh->nud_state = NUD_NOARP;
335 memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
336 if (dev->flags&IFF_LOOPBACK)
337 neigh->type = RTN_LOCAL;
338 } else if (dev->flags&IFF_POINTOPOINT) {
339 neigh->nud_state = NUD_NOARP;
340 memcpy(neigh->ha, dev->broadcast, dev->addr_len);
341 }
342 if (dev->header_ops->cache)
343 neigh->ops = &ndisc_hh_ops;
344 else
345 neigh->ops = &ndisc_generic_ops;
346 if (neigh->nud_state&NUD_VALID)
347 neigh->output = neigh->ops->connected_output;
348 else
349 neigh->output = neigh->ops->output;
350 }
351 in6_dev_put(in6_dev);
352 return 0;
353}
354
355static int pndisc_constructor(struct pneigh_entry *n)
356{
357 struct in6_addr *addr = (struct in6_addr *)&n->key;
358 struct in6_addr maddr;
359 struct net_device *dev = n->dev;
360
361 if (!dev || !__in6_dev_get(dev))
362 return -EINVAL;
363 addrconf_addr_solict_mult(addr, &maddr);
364 ipv6_dev_mc_inc(dev, &maddr);
365 return 0;
366}
367
368static void pndisc_destructor(struct pneigh_entry *n)
369{
370 struct in6_addr *addr = (struct in6_addr *)&n->key;
371 struct in6_addr maddr;
372 struct net_device *dev = n->dev;
373
374 if (!dev || !__in6_dev_get(dev))
375 return;
376 addrconf_addr_solict_mult(addr, &maddr);
377 ipv6_dev_mc_dec(dev, &maddr);
378}
379
380static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
381 int len)
382{
383 int hlen = LL_RESERVED_SPACE(dev);
384 int tlen = dev->needed_tailroom;
385 struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
386 struct sk_buff *skb;
387
388 skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
389 if (!skb) {
390 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
391 __func__);
392 return NULL;
393 }
394
395 skb->protocol = htons(ETH_P_IPV6);
396 skb->dev = dev;
397
398 skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
399 skb_reset_transport_header(skb);
400
401
402
403
404 skb_set_owner_w(skb, sk);
405
406 return skb;
407}
408
409static void ip6_nd_hdr(struct sk_buff *skb,
410 const struct in6_addr *saddr,
411 const struct in6_addr *daddr,
412 int hop_limit, int len)
413{
414 struct ipv6hdr *hdr;
415
416 skb_push(skb, sizeof(*hdr));
417 skb_reset_network_header(skb);
418 hdr = ipv6_hdr(skb);
419
420 ip6_flow_hdr(hdr, 0, 0);
421
422 hdr->payload_len = htons(len);
423 hdr->nexthdr = IPPROTO_ICMPV6;
424 hdr->hop_limit = hop_limit;
425
426 hdr->saddr = *saddr;
427 hdr->daddr = *daddr;
428}
429
430static void ndisc_send_skb(struct sk_buff *skb,
431 const struct in6_addr *daddr,
432 const struct in6_addr *saddr)
433{
434 struct dst_entry *dst = skb_dst(skb);
435 struct net *net = dev_net(skb->dev);
436 struct sock *sk = net->ipv6.ndisc_sk;
437 struct inet6_dev *idev;
438 int err;
439 struct icmp6hdr *icmp6h = icmp6_hdr(skb);
440 u8 type;
441
442 type = icmp6h->icmp6_type;
443
444 if (!dst) {
445 struct flowi6 fl6;
446 int oif = l3mdev_fib_oif(skb->dev);
447
448 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
449 if (oif != skb->dev->ifindex)
450 fl6.flowi6_flags |= FLOWI_FLAG_L3MDEV_SRC;
451 dst = icmp6_dst_alloc(skb->dev, &fl6);
452 if (IS_ERR(dst)) {
453 kfree_skb(skb);
454 return;
455 }
456
457 skb_dst_set(skb, dst);
458 }
459
460 icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
461 IPPROTO_ICMPV6,
462 csum_partial(icmp6h,
463 skb->len, 0));
464
465 ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
466
467 rcu_read_lock();
468 idev = __in6_dev_get(dst->dev);
469 IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
470
471 err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
472 net, sk, skb, NULL, dst->dev,
473 dst_output);
474 if (!err) {
475 ICMP6MSGOUT_INC_STATS(net, idev, type);
476 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
477 }
478
479 rcu_read_unlock();
480}
481
482void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
483 const struct in6_addr *solicited_addr,
484 bool router, bool solicited, bool override, bool inc_opt)
485{
486 struct sk_buff *skb;
487 struct in6_addr tmpaddr;
488 struct inet6_ifaddr *ifp;
489 const struct in6_addr *src_addr;
490 struct nd_msg *msg;
491 int optlen = 0;
492
493
494 ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
495 if (ifp) {
496 src_addr = solicited_addr;
497 if (ifp->flags & IFA_F_OPTIMISTIC)
498 override = false;
499 inc_opt |= ifp->idev->cnf.force_tllao;
500 in6_ifa_put(ifp);
501 } else {
502 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
503 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
504 &tmpaddr))
505 return;
506 src_addr = &tmpaddr;
507 }
508
509 if (!dev->addr_len)
510 inc_opt = 0;
511 if (inc_opt)
512 optlen += ndisc_opt_addr_space(dev);
513
514 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
515 if (!skb)
516 return;
517
518 msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
519 *msg = (struct nd_msg) {
520 .icmph = {
521 .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
522 .icmp6_router = router,
523 .icmp6_solicited = solicited,
524 .icmp6_override = override,
525 },
526 .target = *solicited_addr,
527 };
528
529 if (inc_opt)
530 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
531 dev->dev_addr);
532
533
534 ndisc_send_skb(skb, daddr, src_addr);
535}
536
537static void ndisc_send_unsol_na(struct net_device *dev)
538{
539 struct inet6_dev *idev;
540 struct inet6_ifaddr *ifa;
541
542 idev = in6_dev_get(dev);
543 if (!idev)
544 return;
545
546 read_lock_bh(&idev->lock);
547 list_for_each_entry(ifa, &idev->addr_list, if_list) {
548 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
549 !!idev->cnf.forwarding,
550 false, true,
551 true);
552 }
553 read_unlock_bh(&idev->lock);
554
555 in6_dev_put(idev);
556}
557
558void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
559 const struct in6_addr *daddr, const struct in6_addr *saddr)
560{
561 struct sk_buff *skb;
562 struct in6_addr addr_buf;
563 int inc_opt = dev->addr_len;
564 int optlen = 0;
565 struct nd_msg *msg;
566
567 if (!saddr) {
568 if (ipv6_get_lladdr(dev, &addr_buf,
569 (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
570 return;
571 saddr = &addr_buf;
572 }
573
574 if (ipv6_addr_any(saddr))
575 inc_opt = false;
576 if (inc_opt)
577 optlen += ndisc_opt_addr_space(dev);
578
579 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
580 if (!skb)
581 return;
582
583 msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
584 *msg = (struct nd_msg) {
585 .icmph = {
586 .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
587 },
588 .target = *solicit,
589 };
590
591 if (inc_opt)
592 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
593 dev->dev_addr);
594
595 ndisc_send_skb(skb, daddr, saddr);
596}
597
598void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
599 const struct in6_addr *daddr)
600{
601 struct sk_buff *skb;
602 struct rs_msg *msg;
603 int send_sllao = dev->addr_len;
604 int optlen = 0;
605
606#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
607
608
609
610
611
612
613
614
615 if (send_sllao) {
616 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
617 dev, 1);
618 if (ifp) {
619 if (ifp->flags & IFA_F_OPTIMISTIC) {
620 send_sllao = 0;
621 }
622 in6_ifa_put(ifp);
623 } else {
624 send_sllao = 0;
625 }
626 }
627#endif
628 if (send_sllao)
629 optlen += ndisc_opt_addr_space(dev);
630
631 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
632 if (!skb)
633 return;
634
635 msg = (struct rs_msg *)skb_put(skb, sizeof(*msg));
636 *msg = (struct rs_msg) {
637 .icmph = {
638 .icmp6_type = NDISC_ROUTER_SOLICITATION,
639 },
640 };
641
642 if (send_sllao)
643 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
644 dev->dev_addr);
645
646 ndisc_send_skb(skb, daddr, saddr);
647}
648
649
650static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
651{
652
653
654
655
656 dst_link_failure(skb);
657 kfree_skb(skb);
658}
659
660
661
662static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
663{
664 struct in6_addr *saddr = NULL;
665 struct in6_addr mcaddr;
666 struct net_device *dev = neigh->dev;
667 struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
668 int probes = atomic_read(&neigh->probes);
669
670 if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
671 dev, 1,
672 IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
673 saddr = &ipv6_hdr(skb)->saddr;
674 probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
675 if (probes < 0) {
676 if (!(neigh->nud_state & NUD_VALID)) {
677 ND_PRINTK(1, dbg,
678 "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
679 __func__, target);
680 }
681 ndisc_send_ns(dev, target, target, saddr);
682 } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
683 neigh_app_ns(neigh);
684 } else {
685 addrconf_addr_solict_mult(target, &mcaddr);
686 ndisc_send_ns(dev, target, &mcaddr, saddr);
687 }
688}
689
690static int pndisc_is_router(const void *pkey,
691 struct net_device *dev)
692{
693 struct pneigh_entry *n;
694 int ret = -1;
695
696 read_lock_bh(&nd_tbl.lock);
697 n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
698 if (n)
699 ret = !!(n->flags & NTF_ROUTER);
700 read_unlock_bh(&nd_tbl.lock);
701
702 return ret;
703}
704
705static void ndisc_recv_ns(struct sk_buff *skb)
706{
707 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
708 const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
709 const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
710 u8 *lladdr = NULL;
711 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
712 offsetof(struct nd_msg, opt));
713 struct ndisc_options ndopts;
714 struct net_device *dev = skb->dev;
715 struct inet6_ifaddr *ifp;
716 struct inet6_dev *idev = NULL;
717 struct neighbour *neigh;
718 int dad = ipv6_addr_any(saddr);
719 bool inc;
720 int is_router = -1;
721
722 if (skb->len < sizeof(struct nd_msg)) {
723 ND_PRINTK(2, warn, "NS: packet too short\n");
724 return;
725 }
726
727 if (ipv6_addr_is_multicast(&msg->target)) {
728 ND_PRINTK(2, warn, "NS: multicast target address\n");
729 return;
730 }
731
732
733
734
735
736 if (dad && !ipv6_addr_is_solict_mult(daddr)) {
737 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
738 return;
739 }
740
741 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
742 ND_PRINTK(2, warn, "NS: invalid ND options\n");
743 return;
744 }
745
746 if (ndopts.nd_opts_src_lladdr) {
747 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
748 if (!lladdr) {
749 ND_PRINTK(2, warn,
750 "NS: invalid link-layer address length\n");
751 return;
752 }
753
754
755
756
757
758
759 if (dad) {
760 ND_PRINTK(2, warn,
761 "NS: bad DAD packet (link-layer address option)\n");
762 return;
763 }
764 }
765
766 inc = ipv6_addr_is_multicast(daddr);
767
768 ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
769 if (ifp) {
770have_ifp:
771 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
772 if (dad) {
773
774
775
776
777
778 addrconf_dad_failure(ifp);
779 return;
780 } else {
781
782
783
784
785
786
787 if (!(ifp->flags & IFA_F_OPTIMISTIC))
788 goto out;
789 }
790 }
791
792 idev = ifp->idev;
793 } else {
794 struct net *net = dev_net(dev);
795
796
797 if (netif_is_l3_slave(dev)) {
798 struct net_device *mdev;
799
800 mdev = netdev_master_upper_dev_get_rcu(dev);
801 if (mdev) {
802 ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
803 if (ifp)
804 goto have_ifp;
805 }
806 }
807
808 idev = in6_dev_get(dev);
809 if (!idev) {
810
811 return;
812 }
813
814 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
815 (idev->cnf.forwarding &&
816 (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
817 (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
818 if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
819 skb->pkt_type != PACKET_HOST &&
820 inc &&
821 NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
822
823
824
825
826
827
828
829 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
830 if (n)
831 pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
832 goto out;
833 }
834 } else
835 goto out;
836 }
837
838 if (is_router < 0)
839 is_router = idev->cnf.forwarding;
840
841 if (dad) {
842 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
843 !!is_router, false, (ifp != NULL), true);
844 goto out;
845 }
846
847 if (inc)
848 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
849 else
850 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
851
852
853
854
855
856 neigh = __neigh_lookup(&nd_tbl, saddr, dev,
857 !inc || lladdr || !dev->addr_len);
858 if (neigh)
859 neigh_update(neigh, lladdr, NUD_STALE,
860 NEIGH_UPDATE_F_WEAK_OVERRIDE|
861 NEIGH_UPDATE_F_OVERRIDE);
862 if (neigh || !dev->header_ops) {
863 ndisc_send_na(dev, saddr, &msg->target, !!is_router,
864 true, (ifp != NULL && inc), inc);
865 if (neigh)
866 neigh_release(neigh);
867 }
868
869out:
870 if (ifp)
871 in6_ifa_put(ifp);
872 else
873 in6_dev_put(idev);
874}
875
876static void ndisc_recv_na(struct sk_buff *skb)
877{
878 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
879 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
880 const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
881 u8 *lladdr = NULL;
882 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
883 offsetof(struct nd_msg, opt));
884 struct ndisc_options ndopts;
885 struct net_device *dev = skb->dev;
886 struct inet6_dev *idev = __in6_dev_get(dev);
887 struct inet6_ifaddr *ifp;
888 struct neighbour *neigh;
889
890 if (skb->len < sizeof(struct nd_msg)) {
891 ND_PRINTK(2, warn, "NA: packet too short\n");
892 return;
893 }
894
895 if (ipv6_addr_is_multicast(&msg->target)) {
896 ND_PRINTK(2, warn, "NA: target address is multicast\n");
897 return;
898 }
899
900 if (ipv6_addr_is_multicast(daddr) &&
901 msg->icmph.icmp6_solicited) {
902 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
903 return;
904 }
905
906
907
908
909
910 if (!msg->icmph.icmp6_solicited && idev &&
911 idev->cnf.drop_unsolicited_na)
912 return;
913
914 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
915 ND_PRINTK(2, warn, "NS: invalid ND option\n");
916 return;
917 }
918 if (ndopts.nd_opts_tgt_lladdr) {
919 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
920 if (!lladdr) {
921 ND_PRINTK(2, warn,
922 "NA: invalid link-layer address length\n");
923 return;
924 }
925 }
926 ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
927 if (ifp) {
928 if (skb->pkt_type != PACKET_LOOPBACK
929 && (ifp->flags & IFA_F_TENTATIVE)) {
930 addrconf_dad_failure(ifp);
931 return;
932 }
933
934
935
936
937
938
939
940
941
942 if (skb->pkt_type != PACKET_LOOPBACK)
943 ND_PRINTK(1, warn,
944 "NA: someone advertises our address %pI6 on %s!\n",
945 &ifp->addr, ifp->idev->dev->name);
946 in6_ifa_put(ifp);
947 return;
948 }
949 neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
950
951 if (neigh) {
952 u8 old_flags = neigh->flags;
953 struct net *net = dev_net(dev);
954
955 if (neigh->nud_state & NUD_FAILED)
956 goto out;
957
958
959
960
961
962
963 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
964 net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
965 pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
966
967 goto out;
968 }
969
970 neigh_update(neigh, lladdr,
971 msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
972 NEIGH_UPDATE_F_WEAK_OVERRIDE|
973 (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
974 NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
975 (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
976
977 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
978
979
980
981 rt6_clean_tohost(dev_net(dev), saddr);
982 }
983
984out:
985 neigh_release(neigh);
986 }
987}
988
989static void ndisc_recv_rs(struct sk_buff *skb)
990{
991 struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
992 unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
993 struct neighbour *neigh;
994 struct inet6_dev *idev;
995 const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
996 struct ndisc_options ndopts;
997 u8 *lladdr = NULL;
998
999 if (skb->len < sizeof(*rs_msg))
1000 return;
1001
1002 idev = __in6_dev_get(skb->dev);
1003 if (!idev) {
1004 ND_PRINTK(1, err, "RS: can't find in6 device\n");
1005 return;
1006 }
1007
1008
1009 if (!idev->cnf.forwarding)
1010 goto out;
1011
1012
1013
1014
1015
1016 if (ipv6_addr_any(saddr))
1017 goto out;
1018
1019
1020 if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
1021 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
1022 goto out;
1023 }
1024
1025 if (ndopts.nd_opts_src_lladdr) {
1026 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1027 skb->dev);
1028 if (!lladdr)
1029 goto out;
1030 }
1031
1032 neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1033 if (neigh) {
1034 neigh_update(neigh, lladdr, NUD_STALE,
1035 NEIGH_UPDATE_F_WEAK_OVERRIDE|
1036 NEIGH_UPDATE_F_OVERRIDE|
1037 NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1038 neigh_release(neigh);
1039 }
1040out:
1041 return;
1042}
1043
1044static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1045{
1046 struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1047 struct sk_buff *skb;
1048 struct nlmsghdr *nlh;
1049 struct nduseroptmsg *ndmsg;
1050 struct net *net = dev_net(ra->dev);
1051 int err;
1052 int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1053 + (opt->nd_opt_len << 3));
1054 size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1055
1056 skb = nlmsg_new(msg_size, GFP_ATOMIC);
1057 if (!skb) {
1058 err = -ENOBUFS;
1059 goto errout;
1060 }
1061
1062 nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1063 if (!nlh) {
1064 goto nla_put_failure;
1065 }
1066
1067 ndmsg = nlmsg_data(nlh);
1068 ndmsg->nduseropt_family = AF_INET6;
1069 ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1070 ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1071 ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1072 ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1073
1074 memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1075
1076 if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1077 goto nla_put_failure;
1078 nlmsg_end(skb, nlh);
1079
1080 rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1081 return;
1082
1083nla_put_failure:
1084 nlmsg_free(skb);
1085 err = -EMSGSIZE;
1086errout:
1087 rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1088}
1089
1090static void ndisc_router_discovery(struct sk_buff *skb)
1091{
1092 struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1093 struct neighbour *neigh = NULL;
1094 struct inet6_dev *in6_dev;
1095 struct rt6_info *rt = NULL;
1096 int lifetime;
1097 struct ndisc_options ndopts;
1098 int optlen;
1099 unsigned int pref = 0;
1100 __u32 old_if_flags;
1101 bool send_ifinfo_notify = false;
1102
1103 __u8 *opt = (__u8 *)(ra_msg + 1);
1104
1105 optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1106 sizeof(struct ra_msg);
1107
1108 ND_PRINTK(2, info,
1109 "RA: %s, dev: %s\n",
1110 __func__, skb->dev->name);
1111 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1112 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1113 return;
1114 }
1115 if (optlen < 0) {
1116 ND_PRINTK(2, warn, "RA: packet too short\n");
1117 return;
1118 }
1119
1120#ifdef CONFIG_IPV6_NDISC_NODETYPE
1121 if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1122 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1123 return;
1124 }
1125#endif
1126
1127
1128
1129
1130
1131 in6_dev = __in6_dev_get(skb->dev);
1132 if (!in6_dev) {
1133 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1134 skb->dev->name);
1135 return;
1136 }
1137
1138 if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1139 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1140 return;
1141 }
1142
1143 if (!ipv6_accept_ra(in6_dev)) {
1144 ND_PRINTK(2, info,
1145 "RA: %s, did not accept ra for dev: %s\n",
1146 __func__, skb->dev->name);
1147 goto skip_linkparms;
1148 }
1149
1150#ifdef CONFIG_IPV6_NDISC_NODETYPE
1151
1152 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1153 ND_PRINTK(2, info,
1154 "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1155 __func__, skb->dev->name);
1156 goto skip_linkparms;
1157 }
1158#endif
1159
1160 if (in6_dev->if_flags & IF_RS_SENT) {
1161
1162
1163
1164
1165 in6_dev->if_flags |= IF_RA_RCVD;
1166 }
1167
1168
1169
1170
1171
1172 old_if_flags = in6_dev->if_flags;
1173 in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1174 IF_RA_OTHERCONF)) |
1175 (ra_msg->icmph.icmp6_addrconf_managed ?
1176 IF_RA_MANAGED : 0) |
1177 (ra_msg->icmph.icmp6_addrconf_other ?
1178 IF_RA_OTHERCONF : 0);
1179
1180 if (old_if_flags != in6_dev->if_flags)
1181 send_ifinfo_notify = true;
1182
1183 if (!in6_dev->cnf.accept_ra_defrtr) {
1184 ND_PRINTK(2, info,
1185 "RA: %s, defrtr is false for dev: %s\n",
1186 __func__, skb->dev->name);
1187 goto skip_defrtr;
1188 }
1189
1190
1191
1192
1193 if (!in6_dev->cnf.accept_ra_from_local &&
1194 ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1195 in6_dev->dev, 0)) {
1196 ND_PRINTK(2, info,
1197 "RA from local address detected on dev: %s: default router ignored\n",
1198 skb->dev->name);
1199 goto skip_defrtr;
1200 }
1201
1202 lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1203
1204#ifdef CONFIG_IPV6_ROUTER_PREF
1205 pref = ra_msg->icmph.icmp6_router_pref;
1206
1207 if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1208 !in6_dev->cnf.accept_ra_rtr_pref)
1209 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1210#endif
1211
1212 rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1213
1214 if (rt) {
1215 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1216 if (!neigh) {
1217 ND_PRINTK(0, err,
1218 "RA: %s got default router without neighbour\n",
1219 __func__);
1220 ip6_rt_put(rt);
1221 return;
1222 }
1223 }
1224 if (rt && lifetime == 0) {
1225 ip6_del_rt(rt);
1226 rt = NULL;
1227 }
1228
1229 ND_PRINTK(3, info, "RA: rt: %p lifetime: %d, for dev: %s\n",
1230 rt, lifetime, skb->dev->name);
1231 if (!rt && lifetime) {
1232 ND_PRINTK(3, info, "RA: adding default router\n");
1233
1234 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1235 if (!rt) {
1236 ND_PRINTK(0, err,
1237 "RA: %s failed to add default route\n",
1238 __func__);
1239 return;
1240 }
1241
1242 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1243 if (!neigh) {
1244 ND_PRINTK(0, err,
1245 "RA: %s got default router without neighbour\n",
1246 __func__);
1247 ip6_rt_put(rt);
1248 return;
1249 }
1250 neigh->flags |= NTF_ROUTER;
1251 } else if (rt) {
1252 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1253 }
1254
1255 if (rt)
1256 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1257 if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1258 ra_msg->icmph.icmp6_hop_limit) {
1259 if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1260 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1261 if (rt)
1262 dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1263 ra_msg->icmph.icmp6_hop_limit);
1264 } else {
1265 ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1266 }
1267 }
1268
1269skip_defrtr:
1270
1271
1272
1273
1274
1275 if (in6_dev->nd_parms) {
1276 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1277
1278 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1279 rtime = (rtime*HZ)/1000;
1280 if (rtime < HZ/10)
1281 rtime = HZ/10;
1282 NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1283 in6_dev->tstamp = jiffies;
1284 send_ifinfo_notify = true;
1285 }
1286
1287 rtime = ntohl(ra_msg->reachable_time);
1288 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1289 rtime = (rtime*HZ)/1000;
1290
1291 if (rtime < HZ/10)
1292 rtime = HZ/10;
1293
1294 if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1295 NEIGH_VAR_SET(in6_dev->nd_parms,
1296 BASE_REACHABLE_TIME, rtime);
1297 NEIGH_VAR_SET(in6_dev->nd_parms,
1298 GC_STALETIME, 3 * rtime);
1299 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1300 in6_dev->tstamp = jiffies;
1301 send_ifinfo_notify = true;
1302 }
1303 }
1304 }
1305
1306
1307
1308
1309 if (send_ifinfo_notify)
1310 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1311
1312skip_linkparms:
1313
1314
1315
1316
1317
1318 if (!neigh)
1319 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1320 skb->dev, 1);
1321 if (neigh) {
1322 u8 *lladdr = NULL;
1323 if (ndopts.nd_opts_src_lladdr) {
1324 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1325 skb->dev);
1326 if (!lladdr) {
1327 ND_PRINTK(2, warn,
1328 "RA: invalid link-layer address length\n");
1329 goto out;
1330 }
1331 }
1332 neigh_update(neigh, lladdr, NUD_STALE,
1333 NEIGH_UPDATE_F_WEAK_OVERRIDE|
1334 NEIGH_UPDATE_F_OVERRIDE|
1335 NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1336 NEIGH_UPDATE_F_ISROUTER);
1337 }
1338
1339 if (!ipv6_accept_ra(in6_dev)) {
1340 ND_PRINTK(2, info,
1341 "RA: %s, accept_ra is false for dev: %s\n",
1342 __func__, skb->dev->name);
1343 goto out;
1344 }
1345
1346#ifdef CONFIG_IPV6_ROUTE_INFO
1347 if (!in6_dev->cnf.accept_ra_from_local &&
1348 ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1349 in6_dev->dev, 0)) {
1350 ND_PRINTK(2, info,
1351 "RA from local address detected on dev: %s: router info ignored.\n",
1352 skb->dev->name);
1353 goto skip_routeinfo;
1354 }
1355
1356 if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1357 struct nd_opt_hdr *p;
1358 for (p = ndopts.nd_opts_ri;
1359 p;
1360 p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1361 struct route_info *ri = (struct route_info *)p;
1362#ifdef CONFIG_IPV6_NDISC_NODETYPE
1363 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1364 ri->prefix_len == 0)
1365 continue;
1366#endif
1367 if (ri->prefix_len == 0 &&
1368 !in6_dev->cnf.accept_ra_defrtr)
1369 continue;
1370 if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1371 continue;
1372 rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1373 &ipv6_hdr(skb)->saddr);
1374 }
1375 }
1376
1377skip_routeinfo:
1378#endif
1379
1380#ifdef CONFIG_IPV6_NDISC_NODETYPE
1381
1382 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1383 ND_PRINTK(2, info,
1384 "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1385 __func__, skb->dev->name);
1386 goto out;
1387 }
1388#endif
1389
1390 if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1391 struct nd_opt_hdr *p;
1392 for (p = ndopts.nd_opts_pi;
1393 p;
1394 p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1395 addrconf_prefix_rcv(skb->dev, (u8 *)p,
1396 (p->nd_opt_len) << 3,
1397 ndopts.nd_opts_src_lladdr != NULL);
1398 }
1399 }
1400
1401 if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1402 __be32 n;
1403 u32 mtu;
1404
1405 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1406 mtu = ntohl(n);
1407
1408 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1409 ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1410 } else if (in6_dev->cnf.mtu6 != mtu) {
1411 in6_dev->cnf.mtu6 = mtu;
1412
1413 if (rt)
1414 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1415
1416 rt6_mtu_change(skb->dev, mtu);
1417 }
1418 }
1419
1420 if (ndopts.nd_useropts) {
1421 struct nd_opt_hdr *p;
1422 for (p = ndopts.nd_useropts;
1423 p;
1424 p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1425 ndisc_ra_useropt(skb, p);
1426 }
1427 }
1428
1429 if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1430 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1431 }
1432out:
1433 ip6_rt_put(rt);
1434 if (neigh)
1435 neigh_release(neigh);
1436}
1437
1438static void ndisc_redirect_rcv(struct sk_buff *skb)
1439{
1440 u8 *hdr;
1441 struct ndisc_options ndopts;
1442 struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1443 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1444 offsetof(struct rd_msg, opt));
1445
1446#ifdef CONFIG_IPV6_NDISC_NODETYPE
1447 switch (skb->ndisc_nodetype) {
1448 case NDISC_NODETYPE_HOST:
1449 case NDISC_NODETYPE_NODEFAULT:
1450 ND_PRINTK(2, warn,
1451 "Redirect: from host or unauthorized router\n");
1452 return;
1453 }
1454#endif
1455
1456 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1457 ND_PRINTK(2, warn,
1458 "Redirect: source address is not link-local\n");
1459 return;
1460 }
1461
1462 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1463 return;
1464
1465 if (!ndopts.nd_opts_rh) {
1466 ip6_redirect_no_header(skb, dev_net(skb->dev),
1467 skb->dev->ifindex, 0);
1468 return;
1469 }
1470
1471 hdr = (u8 *)ndopts.nd_opts_rh;
1472 hdr += 8;
1473 if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1474 return;
1475
1476 icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1477}
1478
1479static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1480 struct sk_buff *orig_skb,
1481 int rd_len)
1482{
1483 u8 *opt = skb_put(skb, rd_len);
1484
1485 memset(opt, 0, 8);
1486 *(opt++) = ND_OPT_REDIRECT_HDR;
1487 *(opt++) = (rd_len >> 3);
1488 opt += 6;
1489
1490 memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
1491}
1492
1493void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1494{
1495 struct net_device *dev = skb->dev;
1496 struct net *net = dev_net(dev);
1497 struct sock *sk = net->ipv6.ndisc_sk;
1498 int optlen = 0;
1499 struct inet_peer *peer;
1500 struct sk_buff *buff;
1501 struct rd_msg *msg;
1502 struct in6_addr saddr_buf;
1503 struct rt6_info *rt;
1504 struct dst_entry *dst;
1505 struct flowi6 fl6;
1506 int rd_len;
1507 u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1508 int oif = l3mdev_fib_oif(dev);
1509 bool ret;
1510
1511 if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1512 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1513 dev->name);
1514 return;
1515 }
1516
1517 if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1518 ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1519 ND_PRINTK(2, warn,
1520 "Redirect: target address is not link-local unicast\n");
1521 return;
1522 }
1523
1524 icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1525 &saddr_buf, &ipv6_hdr(skb)->saddr, oif);
1526
1527 if (oif != skb->dev->ifindex)
1528 fl6.flowi6_flags |= FLOWI_FLAG_L3MDEV_SRC;
1529
1530 dst = ip6_route_output(net, NULL, &fl6);
1531 if (dst->error) {
1532 dst_release(dst);
1533 return;
1534 }
1535 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1536 if (IS_ERR(dst))
1537 return;
1538
1539 rt = (struct rt6_info *) dst;
1540
1541 if (rt->rt6i_flags & RTF_GATEWAY) {
1542 ND_PRINTK(2, warn,
1543 "Redirect: destination is not a neighbour\n");
1544 goto release;
1545 }
1546 peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1547 ret = inet_peer_xrlim_allow(peer, 1*HZ);
1548 if (peer)
1549 inet_putpeer(peer);
1550 if (!ret)
1551 goto release;
1552
1553 if (dev->addr_len) {
1554 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1555 if (!neigh) {
1556 ND_PRINTK(2, warn,
1557 "Redirect: no neigh for target address\n");
1558 goto release;
1559 }
1560
1561 read_lock_bh(&neigh->lock);
1562 if (neigh->nud_state & NUD_VALID) {
1563 memcpy(ha_buf, neigh->ha, dev->addr_len);
1564 read_unlock_bh(&neigh->lock);
1565 ha = ha_buf;
1566 optlen += ndisc_opt_addr_space(dev);
1567 } else
1568 read_unlock_bh(&neigh->lock);
1569
1570 neigh_release(neigh);
1571 }
1572
1573 rd_len = min_t(unsigned int,
1574 IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1575 skb->len + 8);
1576 rd_len &= ~0x7;
1577 optlen += rd_len;
1578
1579 buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1580 if (!buff)
1581 goto release;
1582
1583 msg = (struct rd_msg *)skb_put(buff, sizeof(*msg));
1584 *msg = (struct rd_msg) {
1585 .icmph = {
1586 .icmp6_type = NDISC_REDIRECT,
1587 },
1588 .target = *target,
1589 .dest = ipv6_hdr(skb)->daddr,
1590 };
1591
1592
1593
1594
1595
1596 if (ha)
1597 ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
1598
1599
1600
1601
1602
1603 if (rd_len)
1604 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1605
1606 skb_dst_set(buff, dst);
1607 ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1608 return;
1609
1610release:
1611 dst_release(dst);
1612}
1613
1614static void pndisc_redo(struct sk_buff *skb)
1615{
1616 ndisc_recv_ns(skb);
1617 kfree_skb(skb);
1618}
1619
1620static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1621{
1622 struct inet6_dev *idev = __in6_dev_get(skb->dev);
1623
1624 if (!idev)
1625 return true;
1626 if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1627 idev->cnf.suppress_frag_ndisc) {
1628 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1629 return true;
1630 }
1631 return false;
1632}
1633
1634int ndisc_rcv(struct sk_buff *skb)
1635{
1636 struct nd_msg *msg;
1637
1638 if (ndisc_suppress_frag_ndisc(skb))
1639 return 0;
1640
1641 if (skb_linearize(skb))
1642 return 0;
1643
1644 msg = (struct nd_msg *)skb_transport_header(skb);
1645
1646 __skb_push(skb, skb->data - skb_transport_header(skb));
1647
1648 if (ipv6_hdr(skb)->hop_limit != 255) {
1649 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1650 ipv6_hdr(skb)->hop_limit);
1651 return 0;
1652 }
1653
1654 if (msg->icmph.icmp6_code != 0) {
1655 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1656 msg->icmph.icmp6_code);
1657 return 0;
1658 }
1659
1660 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1661
1662 switch (msg->icmph.icmp6_type) {
1663 case NDISC_NEIGHBOUR_SOLICITATION:
1664 ndisc_recv_ns(skb);
1665 break;
1666
1667 case NDISC_NEIGHBOUR_ADVERTISEMENT:
1668 ndisc_recv_na(skb);
1669 break;
1670
1671 case NDISC_ROUTER_SOLICITATION:
1672 ndisc_recv_rs(skb);
1673 break;
1674
1675 case NDISC_ROUTER_ADVERTISEMENT:
1676 ndisc_router_discovery(skb);
1677 break;
1678
1679 case NDISC_REDIRECT:
1680 ndisc_redirect_rcv(skb);
1681 break;
1682 }
1683
1684 return 0;
1685}
1686
1687static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1688{
1689 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1690 struct netdev_notifier_change_info *change_info;
1691 struct net *net = dev_net(dev);
1692 struct inet6_dev *idev;
1693
1694 switch (event) {
1695 case NETDEV_CHANGEADDR:
1696 neigh_changeaddr(&nd_tbl, dev);
1697 fib6_run_gc(0, net, false);
1698 idev = in6_dev_get(dev);
1699 if (!idev)
1700 break;
1701 if (idev->cnf.ndisc_notify)
1702 ndisc_send_unsol_na(dev);
1703 in6_dev_put(idev);
1704 break;
1705 case NETDEV_CHANGE:
1706 change_info = ptr;
1707 if (change_info->flags_changed & IFF_NOARP)
1708 neigh_changeaddr(&nd_tbl, dev);
1709 break;
1710 case NETDEV_DOWN:
1711 neigh_ifdown(&nd_tbl, dev);
1712 fib6_run_gc(0, net, false);
1713 break;
1714 case NETDEV_NOTIFY_PEERS:
1715 ndisc_send_unsol_na(dev);
1716 break;
1717 default:
1718 break;
1719 }
1720
1721 return NOTIFY_DONE;
1722}
1723
1724static struct notifier_block ndisc_netdev_notifier = {
1725 .notifier_call = ndisc_netdev_event,
1726};
1727
1728#ifdef CONFIG_SYSCTL
1729static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1730 const char *func, const char *dev_name)
1731{
1732 static char warncomm[TASK_COMM_LEN];
1733 static int warned;
1734 if (strcmp(warncomm, current->comm) && warned < 5) {
1735 strcpy(warncomm, current->comm);
1736 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1737 warncomm, func,
1738 dev_name, ctl->procname,
1739 dev_name, ctl->procname);
1740 warned++;
1741 }
1742}
1743
1744int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1745{
1746 struct net_device *dev = ctl->extra1;
1747 struct inet6_dev *idev;
1748 int ret;
1749
1750 if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1751 (strcmp(ctl->procname, "base_reachable_time") == 0))
1752 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1753
1754 if (strcmp(ctl->procname, "retrans_time") == 0)
1755 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1756
1757 else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1758 ret = neigh_proc_dointvec_jiffies(ctl, write,
1759 buffer, lenp, ppos);
1760
1761 else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1762 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1763 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1764 buffer, lenp, ppos);
1765 else
1766 ret = -1;
1767
1768 if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1769 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1770 idev->nd_parms->reachable_time =
1771 neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1772 idev->tstamp = jiffies;
1773 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1774 in6_dev_put(idev);
1775 }
1776 return ret;
1777}
1778
1779
1780#endif
1781
1782static int __net_init ndisc_net_init(struct net *net)
1783{
1784 struct ipv6_pinfo *np;
1785 struct sock *sk;
1786 int err;
1787
1788 err = inet_ctl_sock_create(&sk, PF_INET6,
1789 SOCK_RAW, IPPROTO_ICMPV6, net);
1790 if (err < 0) {
1791 ND_PRINTK(0, err,
1792 "NDISC: Failed to initialize the control socket (err %d)\n",
1793 err);
1794 return err;
1795 }
1796
1797 net->ipv6.ndisc_sk = sk;
1798
1799 np = inet6_sk(sk);
1800 np->hop_limit = 255;
1801
1802 np->mc_loop = 0;
1803
1804 return 0;
1805}
1806
1807static void __net_exit ndisc_net_exit(struct net *net)
1808{
1809 inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1810}
1811
1812static struct pernet_operations ndisc_net_ops = {
1813 .init = ndisc_net_init,
1814 .exit = ndisc_net_exit,
1815};
1816
1817int __init ndisc_init(void)
1818{
1819 int err;
1820
1821 err = register_pernet_subsys(&ndisc_net_ops);
1822 if (err)
1823 return err;
1824
1825
1826
1827 neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1828
1829#ifdef CONFIG_SYSCTL
1830 err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1831 ndisc_ifinfo_sysctl_change);
1832 if (err)
1833 goto out_unregister_pernet;
1834out:
1835#endif
1836 return err;
1837
1838#ifdef CONFIG_SYSCTL
1839out_unregister_pernet:
1840 unregister_pernet_subsys(&ndisc_net_ops);
1841 goto out;
1842#endif
1843}
1844
1845int __init ndisc_late_init(void)
1846{
1847 return register_netdevice_notifier(&ndisc_netdev_notifier);
1848}
1849
1850void ndisc_late_cleanup(void)
1851{
1852 unregister_netdevice_notifier(&ndisc_netdev_notifier);
1853}
1854
1855void ndisc_cleanup(void)
1856{
1857#ifdef CONFIG_SYSCTL
1858 neigh_sysctl_unregister(&nd_tbl.parms);
1859#endif
1860 neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1861 unregister_pernet_subsys(&ndisc_net_ops);
1862}
1863
