1 /*
2 * Neighbour Discovery for IPv6
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 * Mike Shaver <shaver@ingenia.com>
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; either version
12 * 2 of the License, or (at your option) any later version.
13 */
14
15 /*
16 * Changes:
17 *
18 * Alexey I. Froloff : RFC6106 (DNSSL) support
19 * Pierre Ynard : export userland ND options
20 * through netlink (RDNSS support)
21 * Lars Fenneberg : fixed MTU setting on receipt
22 * of an RA.
23 * Janos Farkas : kmalloc failure checks
24 * Alexey Kuznetsov : state machine reworked
25 * and moved to net/core.
26 * Pekka Savola : RFC2461 validation
27 * YOSHIFUJI Hideaki @USAGI : Verify ND options properly
28 */
29
30 #define pr_fmt(fmt) "ICMPv6: " fmt
31
32 #include <linux/module.h>
33 #include <linux/errno.h>
34 #include <linux/types.h>
35 #include <linux/socket.h>
36 #include <linux/sockios.h>
37 #include <linux/sched.h>
38 #include <linux/net.h>
39 #include <linux/in6.h>
40 #include <linux/route.h>
41 #include <linux/init.h>
42 #include <linux/rcupdate.h>
43 #include <linux/slab.h>
44 #ifdef CONFIG_SYSCTL
45 #include <linux/sysctl.h>
46 #endif
47
48 #include <linux/if_addr.h>
49 #include <linux/if_arp.h>
50 #include <linux/ipv6.h>
51 #include <linux/icmpv6.h>
52 #include <linux/jhash.h>
53
54 #include <net/sock.h>
55 #include <net/snmp.h>
56
57 #include <net/ipv6.h>
58 #include <net/protocol.h>
59 #include <net/ndisc.h>
60 #include <net/ip6_route.h>
61 #include <net/addrconf.h>
62 #include <net/icmp.h>
63
64 #include <net/netlink.h>
65 #include <linux/rtnetlink.h>
66
67 #include <net/flow.h>
68 #include <net/ip6_checksum.h>
69 #include <net/inet_common.h>
70 #include <linux/proc_fs.h>
71
72 #include <linux/netfilter.h>
73 #include <linux/netfilter_ipv6.h>
74
75 /* Set to 3 to get tracing... */
76 #define ND_DEBUG 1
77
78 #define ND_PRINTK(val, level, fmt, ...) \
79 do { \
80 if (val <= ND_DEBUG) \
81 net_##level##_ratelimited(fmt, ##__VA_ARGS__); \
82 } while (0)
83
84 static u32 ndisc_hash(const void *pkey,
85 const struct net_device *dev,
86 __u32 *hash_rnd);
87 static int ndisc_constructor(struct neighbour *neigh);
88 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
89 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
90 static int pndisc_constructor(struct pneigh_entry *n);
91 static void pndisc_destructor(struct pneigh_entry *n);
92 static void pndisc_redo(struct sk_buff *skb);
93
94 static const struct neigh_ops ndisc_generic_ops = {
95 .family = AF_INET6,
96 .solicit = ndisc_solicit,
97 .error_report = ndisc_error_report,
98 .output = neigh_resolve_output,
99 .connected_output = neigh_connected_output,
100 };
101
102 static const struct neigh_ops ndisc_hh_ops = {
103 .family = AF_INET6,
104 .solicit = ndisc_solicit,
105 .error_report = ndisc_error_report,
106 .output = neigh_resolve_output,
107 .connected_output = neigh_resolve_output,
108 };
109
110
111 static const struct neigh_ops ndisc_direct_ops = {
112 .family = AF_INET6,
113 .output = neigh_direct_output,
114 .connected_output = neigh_direct_output,
115 };
116
117 struct neigh_table nd_tbl = {
118 .family = AF_INET6,
119 .key_len = sizeof(struct in6_addr),
120 .hash = ndisc_hash,
121 .constructor = ndisc_constructor,
122 .pconstructor = pndisc_constructor,
123 .pdestructor = pndisc_destructor,
124 .proxy_redo = pndisc_redo,
125 .id = "ndisc_cache",
126 .parms = {
127 .tbl = &nd_tbl,
128 .reachable_time = ND_REACHABLE_TIME,
129 .data = {
130 [NEIGH_VAR_MCAST_PROBES] = 3,
131 [NEIGH_VAR_UCAST_PROBES] = 3,
132 [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
133 [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
134 [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
135 [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
136 [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
137 [NEIGH_VAR_PROXY_QLEN] = 64,
138 [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
139 [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
140 },
141 },
142 .gc_interval = 30 * HZ,
143 .gc_thresh1 = 128,
144 .gc_thresh2 = 512,
145 .gc_thresh3 = 1024,
146 };
147
ndisc_fill_addr_option(struct sk_buff * skb,int type,void * data)148 static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data)
149 {
150 int pad = ndisc_addr_option_pad(skb->dev->type);
151 int data_len = skb->dev->addr_len;
152 int space = ndisc_opt_addr_space(skb->dev);
153 u8 *opt = skb_put(skb, space);
154
155 opt[0] = type;
156 opt[1] = space>>3;
157
158 memset(opt + 2, 0, pad);
159 opt += pad;
160 space -= pad;
161
162 memcpy(opt+2, data, data_len);
163 data_len += 2;
164 opt += data_len;
165 if ((space -= data_len) > 0)
166 memset(opt, 0, space);
167 }
168
ndisc_next_option(struct nd_opt_hdr * cur,struct nd_opt_hdr * end)169 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
170 struct nd_opt_hdr *end)
171 {
172 int type;
173 if (!cur || !end || cur >= end)
174 return NULL;
175 type = cur->nd_opt_type;
176 do {
177 cur = ((void *)cur) + (cur->nd_opt_len << 3);
178 } while (cur < end && cur->nd_opt_type != type);
179 return cur <= end && cur->nd_opt_type == type ? cur : NULL;
180 }
181
ndisc_is_useropt(struct nd_opt_hdr * opt)182 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
183 {
184 return opt->nd_opt_type == ND_OPT_RDNSS ||
185 opt->nd_opt_type == ND_OPT_DNSSL;
186 }
187
ndisc_next_useropt(struct nd_opt_hdr * cur,struct nd_opt_hdr * end)188 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
189 struct nd_opt_hdr *end)
190 {
191 if (!cur || !end || cur >= end)
192 return NULL;
193 do {
194 cur = ((void *)cur) + (cur->nd_opt_len << 3);
195 } while (cur < end && !ndisc_is_useropt(cur));
196 return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
197 }
198
ndisc_parse_options(u8 * opt,int opt_len,struct ndisc_options * ndopts)199 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
200 struct ndisc_options *ndopts)
201 {
202 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
203
204 if (!nd_opt || opt_len < 0 || !ndopts)
205 return NULL;
206 memset(ndopts, 0, sizeof(*ndopts));
207 while (opt_len) {
208 int l;
209 if (opt_len < sizeof(struct nd_opt_hdr))
210 return NULL;
211 l = nd_opt->nd_opt_len << 3;
212 if (opt_len < l || l == 0)
213 return NULL;
214 switch (nd_opt->nd_opt_type) {
215 case ND_OPT_SOURCE_LL_ADDR:
216 case ND_OPT_TARGET_LL_ADDR:
217 case ND_OPT_MTU:
218 case ND_OPT_REDIRECT_HDR:
219 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
220 ND_PRINTK(2, warn,
221 "%s: duplicated ND6 option found: type=%d\n",
222 __func__, nd_opt->nd_opt_type);
223 } else {
224 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
225 }
226 break;
227 case ND_OPT_PREFIX_INFO:
228 ndopts->nd_opts_pi_end = nd_opt;
229 if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
230 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
231 break;
232 #ifdef CONFIG_IPV6_ROUTE_INFO
233 case ND_OPT_ROUTE_INFO:
234 ndopts->nd_opts_ri_end = nd_opt;
235 if (!ndopts->nd_opts_ri)
236 ndopts->nd_opts_ri = nd_opt;
237 break;
238 #endif
239 default:
240 if (ndisc_is_useropt(nd_opt)) {
241 ndopts->nd_useropts_end = nd_opt;
242 if (!ndopts->nd_useropts)
243 ndopts->nd_useropts = nd_opt;
244 } else {
245 /*
246 * Unknown options must be silently ignored,
247 * to accommodate future extension to the
248 * protocol.
249 */
250 ND_PRINTK(2, notice,
251 "%s: ignored unsupported option; type=%d, len=%d\n",
252 __func__,
253 nd_opt->nd_opt_type,
254 nd_opt->nd_opt_len);
255 }
256 }
257 opt_len -= l;
258 nd_opt = ((void *)nd_opt) + l;
259 }
260 return ndopts;
261 }
262
ndisc_mc_map(const struct in6_addr * addr,char * buf,struct net_device * dev,int dir)263 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
264 {
265 switch (dev->type) {
266 case ARPHRD_ETHER:
267 case ARPHRD_IEEE802: /* Not sure. Check it later. --ANK */
268 case ARPHRD_FDDI:
269 ipv6_eth_mc_map(addr, buf);
270 return 0;
271 case ARPHRD_ARCNET:
272 ipv6_arcnet_mc_map(addr, buf);
273 return 0;
274 case ARPHRD_INFINIBAND:
275 ipv6_ib_mc_map(addr, dev->broadcast, buf);
276 return 0;
277 case ARPHRD_IPGRE:
278 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
279 default:
280 if (dir) {
281 memcpy(buf, dev->broadcast, dev->addr_len);
282 return 0;
283 }
284 }
285 return -EINVAL;
286 }
287 EXPORT_SYMBOL(ndisc_mc_map);
288
ndisc_hash(const void * pkey,const struct net_device * dev,__u32 * hash_rnd)289 static u32 ndisc_hash(const void *pkey,
290 const struct net_device *dev,
291 __u32 *hash_rnd)
292 {
293 return ndisc_hashfn(pkey, dev, hash_rnd);
294 }
295
ndisc_constructor(struct neighbour * neigh)296 static int ndisc_constructor(struct neighbour *neigh)
297 {
298 struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
299 struct net_device *dev = neigh->dev;
300 struct inet6_dev *in6_dev;
301 struct neigh_parms *parms;
302 bool is_multicast = ipv6_addr_is_multicast(addr);
303
304 in6_dev = in6_dev_get(dev);
305 if (in6_dev == NULL) {
306 return -EINVAL;
307 }
308
309 parms = in6_dev->nd_parms;
310 __neigh_parms_put(neigh->parms);
311 neigh->parms = neigh_parms_clone(parms);
312
313 neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
314 if (!dev->header_ops) {
315 neigh->nud_state = NUD_NOARP;
316 neigh->ops = &ndisc_direct_ops;
317 neigh->output = neigh_direct_output;
318 } else {
319 if (is_multicast) {
320 neigh->nud_state = NUD_NOARP;
321 ndisc_mc_map(addr, neigh->ha, dev, 1);
322 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
323 neigh->nud_state = NUD_NOARP;
324 memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
325 if (dev->flags&IFF_LOOPBACK)
326 neigh->type = RTN_LOCAL;
327 } else if (dev->flags&IFF_POINTOPOINT) {
328 neigh->nud_state = NUD_NOARP;
329 memcpy(neigh->ha, dev->broadcast, dev->addr_len);
330 }
331 if (dev->header_ops->cache)
332 neigh->ops = &ndisc_hh_ops;
333 else
334 neigh->ops = &ndisc_generic_ops;
335 if (neigh->nud_state&NUD_VALID)
336 neigh->output = neigh->ops->connected_output;
337 else
338 neigh->output = neigh->ops->output;
339 }
340 in6_dev_put(in6_dev);
341 return 0;
342 }
343
pndisc_constructor(struct pneigh_entry * n)344 static int pndisc_constructor(struct pneigh_entry *n)
345 {
346 struct in6_addr *addr = (struct in6_addr *)&n->key;
347 struct in6_addr maddr;
348 struct net_device *dev = n->dev;
349
350 if (dev == NULL || __in6_dev_get(dev) == NULL)
351 return -EINVAL;
352 addrconf_addr_solict_mult(addr, &maddr);
353 ipv6_dev_mc_inc(dev, &maddr);
354 return 0;
355 }
356
pndisc_destructor(struct pneigh_entry * n)357 static void pndisc_destructor(struct pneigh_entry *n)
358 {
359 struct in6_addr *addr = (struct in6_addr *)&n->key;
360 struct in6_addr maddr;
361 struct net_device *dev = n->dev;
362
363 if (dev == NULL || __in6_dev_get(dev) == NULL)
364 return;
365 addrconf_addr_solict_mult(addr, &maddr);
366 ipv6_dev_mc_dec(dev, &maddr);
367 }
368
ndisc_alloc_skb(struct net_device * dev,int len)369 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
370 int len)
371 {
372 int hlen = LL_RESERVED_SPACE(dev);
373 int tlen = dev->needed_tailroom;
374 struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
375 struct sk_buff *skb;
376
377 skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
378 if (!skb) {
379 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
380 __func__);
381 return NULL;
382 }
383
384 skb->protocol = htons(ETH_P_IPV6);
385 skb->dev = dev;
386
387 skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
388 skb_reset_transport_header(skb);
389
390 /* Manually assign socket ownership as we avoid calling
391 * sock_alloc_send_pskb() to bypass wmem buffer limits
392 */
393 skb_set_owner_w(skb, sk);
394
395 return skb;
396 }
397
ip6_nd_hdr(struct sk_buff * skb,const struct in6_addr * saddr,const struct in6_addr * daddr,int hop_limit,int len)398 static void ip6_nd_hdr(struct sk_buff *skb,
399 const struct in6_addr *saddr,
400 const struct in6_addr *daddr,
401 int hop_limit, int len)
402 {
403 struct ipv6hdr *hdr;
404
405 skb_push(skb, sizeof(*hdr));
406 skb_reset_network_header(skb);
407 hdr = ipv6_hdr(skb);
408
409 ip6_flow_hdr(hdr, 0, 0);
410
411 hdr->payload_len = htons(len);
412 hdr->nexthdr = IPPROTO_ICMPV6;
413 hdr->hop_limit = hop_limit;
414
415 hdr->saddr = *saddr;
416 hdr->daddr = *daddr;
417 }
418
ndisc_send_skb(struct sk_buff * skb,const struct in6_addr * daddr,const struct in6_addr * saddr)419 static void ndisc_send_skb(struct sk_buff *skb,
420 const struct in6_addr *daddr,
421 const struct in6_addr *saddr)
422 {
423 struct dst_entry *dst = skb_dst(skb);
424 struct net *net = dev_net(skb->dev);
425 struct sock *sk = net->ipv6.ndisc_sk;
426 struct inet6_dev *idev;
427 int err;
428 struct icmp6hdr *icmp6h = icmp6_hdr(skb);
429 u8 type;
430
431 type = icmp6h->icmp6_type;
432
433 if (!dst) {
434 struct flowi6 fl6;
435
436 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex);
437 dst = icmp6_dst_alloc(skb->dev, &fl6);
438 if (IS_ERR(dst)) {
439 kfree_skb(skb);
440 return;
441 }
442
443 skb_dst_set(skb, dst);
444 }
445
446 icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
447 IPPROTO_ICMPV6,
448 csum_partial(icmp6h,
449 skb->len, 0));
450
451 ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
452
453 rcu_read_lock();
454 idev = __in6_dev_get(dst->dev);
455 IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
456
457 err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
458 dst_output);
459 if (!err) {
460 ICMP6MSGOUT_INC_STATS(net, idev, type);
461 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
462 }
463
464 rcu_read_unlock();
465 }
466
ndisc_send_na(struct net_device * dev,struct neighbour * neigh,const struct in6_addr * daddr,const struct in6_addr * solicited_addr,bool router,bool solicited,bool override,bool inc_opt)467 void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
468 const struct in6_addr *daddr,
469 const struct in6_addr *solicited_addr,
470 bool router, bool solicited, bool override, bool inc_opt)
471 {
472 struct sk_buff *skb;
473 struct in6_addr tmpaddr;
474 struct inet6_ifaddr *ifp;
475 const struct in6_addr *src_addr;
476 struct nd_msg *msg;
477 int optlen = 0;
478
479 /* for anycast or proxy, solicited_addr != src_addr */
480 ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
481 if (ifp) {
482 src_addr = solicited_addr;
483 if (ifp->flags & IFA_F_OPTIMISTIC)
484 override = false;
485 inc_opt |= ifp->idev->cnf.force_tllao;
486 in6_ifa_put(ifp);
487 } else {
488 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
489 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
490 &tmpaddr))
491 return;
492 src_addr = &tmpaddr;
493 }
494
495 if (!dev->addr_len)
496 inc_opt = 0;
497 if (inc_opt)
498 optlen += ndisc_opt_addr_space(dev);
499
500 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
501 if (!skb)
502 return;
503
504 msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
505 *msg = (struct nd_msg) {
506 .icmph = {
507 .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
508 .icmp6_router = router,
509 .icmp6_solicited = solicited,
510 .icmp6_override = override,
511 },
512 .target = *solicited_addr,
513 };
514
515 if (inc_opt)
516 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
517 dev->dev_addr);
518
519
520 ndisc_send_skb(skb, daddr, src_addr);
521 }
522
ndisc_send_unsol_na(struct net_device * dev)523 static void ndisc_send_unsol_na(struct net_device *dev)
524 {
525 struct inet6_dev *idev;
526 struct inet6_ifaddr *ifa;
527
528 idev = in6_dev_get(dev);
529 if (!idev)
530 return;
531
532 read_lock_bh(&idev->lock);
533 list_for_each_entry(ifa, &idev->addr_list, if_list) {
534 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
535 /*router=*/ !!idev->cnf.forwarding,
536 /*solicited=*/ false, /*override=*/ true,
537 /*inc_opt=*/ true);
538 }
539 read_unlock_bh(&idev->lock);
540
541 in6_dev_put(idev);
542 }
543
ndisc_send_ns(struct net_device * dev,struct neighbour * neigh,const struct in6_addr * solicit,const struct in6_addr * daddr,const struct in6_addr * saddr)544 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
545 const struct in6_addr *solicit,
546 const struct in6_addr *daddr, const struct in6_addr *saddr)
547 {
548 struct sk_buff *skb;
549 struct in6_addr addr_buf;
550 int inc_opt = dev->addr_len;
551 int optlen = 0;
552 struct nd_msg *msg;
553
554 if (saddr == NULL) {
555 if (ipv6_get_lladdr(dev, &addr_buf,
556 (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
557 return;
558 saddr = &addr_buf;
559 }
560
561 if (ipv6_addr_any(saddr))
562 inc_opt = false;
563 if (inc_opt)
564 optlen += ndisc_opt_addr_space(dev);
565
566 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
567 if (!skb)
568 return;
569
570 msg = (struct nd_msg *)skb_put(skb, sizeof(*msg));
571 *msg = (struct nd_msg) {
572 .icmph = {
573 .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
574 },
575 .target = *solicit,
576 };
577
578 if (inc_opt)
579 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
580 dev->dev_addr);
581
582 ndisc_send_skb(skb, daddr, saddr);
583 }
584
ndisc_send_rs(struct net_device * dev,const struct in6_addr * saddr,const struct in6_addr * daddr)585 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
586 const struct in6_addr *daddr)
587 {
588 struct sk_buff *skb;
589 struct rs_msg *msg;
590 int send_sllao = dev->addr_len;
591 int optlen = 0;
592
593 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
594 /*
595 * According to section 2.2 of RFC 4429, we must not
596 * send router solicitations with a sllao from
597 * optimistic addresses, but we may send the solicitation
598 * if we don't include the sllao. So here we check
599 * if our address is optimistic, and if so, we
600 * suppress the inclusion of the sllao.
601 */
602 if (send_sllao) {
603 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
604 dev, 1);
605 if (ifp) {
606 if (ifp->flags & IFA_F_OPTIMISTIC) {
607 send_sllao = 0;
608 }
609 in6_ifa_put(ifp);
610 } else {
611 send_sllao = 0;
612 }
613 }
614 #endif
615 if (send_sllao)
616 optlen += ndisc_opt_addr_space(dev);
617
618 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
619 if (!skb)
620 return;
621
622 msg = (struct rs_msg *)skb_put(skb, sizeof(*msg));
623 *msg = (struct rs_msg) {
624 .icmph = {
625 .icmp6_type = NDISC_ROUTER_SOLICITATION,
626 },
627 };
628
629 if (send_sllao)
630 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
631 dev->dev_addr);
632
633 ndisc_send_skb(skb, daddr, saddr);
634 }
635
636
ndisc_error_report(struct neighbour * neigh,struct sk_buff * skb)637 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
638 {
639 /*
640 * "The sender MUST return an ICMP
641 * destination unreachable"
642 */
643 dst_link_failure(skb);
644 kfree_skb(skb);
645 }
646
647 /* Called with locked neigh: either read or both */
648
ndisc_solicit(struct neighbour * neigh,struct sk_buff * skb)649 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
650 {
651 struct in6_addr *saddr = NULL;
652 struct in6_addr mcaddr;
653 struct net_device *dev = neigh->dev;
654 struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
655 int probes = atomic_read(&neigh->probes);
656
657 if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
658 dev, 1,
659 IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
660 saddr = &ipv6_hdr(skb)->saddr;
661
662 if ((probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES)) < 0) {
663 if (!(neigh->nud_state & NUD_VALID)) {
664 ND_PRINTK(1, dbg,
665 "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
666 __func__, target);
667 }
668 ndisc_send_ns(dev, neigh, target, target, saddr);
669 } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
670 neigh_app_ns(neigh);
671 } else {
672 addrconf_addr_solict_mult(target, &mcaddr);
673 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
674 }
675 }
676
pndisc_is_router(const void * pkey,struct net_device * dev)677 static int pndisc_is_router(const void *pkey,
678 struct net_device *dev)
679 {
680 struct pneigh_entry *n;
681 int ret = -1;
682
683 read_lock_bh(&nd_tbl.lock);
684 n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
685 if (n)
686 ret = !!(n->flags & NTF_ROUTER);
687 read_unlock_bh(&nd_tbl.lock);
688
689 return ret;
690 }
691
ndisc_recv_ns(struct sk_buff * skb)692 static void ndisc_recv_ns(struct sk_buff *skb)
693 {
694 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
695 const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
696 const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
697 u8 *lladdr = NULL;
698 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
699 offsetof(struct nd_msg, opt));
700 struct ndisc_options ndopts;
701 struct net_device *dev = skb->dev;
702 struct inet6_ifaddr *ifp;
703 struct inet6_dev *idev = NULL;
704 struct neighbour *neigh;
705 int dad = ipv6_addr_any(saddr);
706 bool inc;
707 int is_router = -1;
708
709 if (skb->len < sizeof(struct nd_msg)) {
710 ND_PRINTK(2, warn, "NS: packet too short\n");
711 return;
712 }
713
714 if (ipv6_addr_is_multicast(&msg->target)) {
715 ND_PRINTK(2, warn, "NS: multicast target address\n");
716 return;
717 }
718
719 /*
720 * RFC2461 7.1.1:
721 * DAD has to be destined for solicited node multicast address.
722 */
723 if (dad && !ipv6_addr_is_solict_mult(daddr)) {
724 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
725 return;
726 }
727
728 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
729 ND_PRINTK(2, warn, "NS: invalid ND options\n");
730 return;
731 }
732
733 if (ndopts.nd_opts_src_lladdr) {
734 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
735 if (!lladdr) {
736 ND_PRINTK(2, warn,
737 "NS: invalid link-layer address length\n");
738 return;
739 }
740
741 /* RFC2461 7.1.1:
742 * If the IP source address is the unspecified address,
743 * there MUST NOT be source link-layer address option
744 * in the message.
745 */
746 if (dad) {
747 ND_PRINTK(2, warn,
748 "NS: bad DAD packet (link-layer address option)\n");
749 return;
750 }
751 }
752
753 inc = ipv6_addr_is_multicast(daddr);
754
755 ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
756 if (ifp) {
757
758 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
759 if (dad) {
760 /*
761 * We are colliding with another node
762 * who is doing DAD
763 * so fail our DAD process
764 */
765 addrconf_dad_failure(ifp);
766 return;
767 } else {
768 /*
769 * This is not a dad solicitation.
770 * If we are an optimistic node,
771 * we should respond.
772 * Otherwise, we should ignore it.
773 */
774 if (!(ifp->flags & IFA_F_OPTIMISTIC))
775 goto out;
776 }
777 }
778
779 idev = ifp->idev;
780 } else {
781 struct net *net = dev_net(dev);
782
783 idev = in6_dev_get(dev);
784 if (!idev) {
785 /* XXX: count this drop? */
786 return;
787 }
788
789 if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
790 (idev->cnf.forwarding &&
791 (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
792 (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
793 if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
794 skb->pkt_type != PACKET_HOST &&
795 inc &&
796 NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
797 /*
798 * for anycast or proxy,
799 * sender should delay its response
800 * by a random time between 0 and
801 * MAX_ANYCAST_DELAY_TIME seconds.
802 * (RFC2461) -- yoshfuji
803 */
804 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
805 if (n)
806 pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
807 goto out;
808 }
809 } else
810 goto out;
811 }
812
813 if (is_router < 0)
814 is_router = idev->cnf.forwarding;
815
816 if (dad) {
817 ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &msg->target,
818 !!is_router, false, (ifp != NULL), true);
819 goto out;
820 }
821
822 if (inc)
823 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
824 else
825 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
826
827 /*
828 * update / create cache entry
829 * for the source address
830 */
831 neigh = __neigh_lookup(&nd_tbl, saddr, dev,
832 !inc || lladdr || !dev->addr_len);
833 if (neigh)
834 neigh_update(neigh, lladdr, NUD_STALE,
835 NEIGH_UPDATE_F_WEAK_OVERRIDE|
836 NEIGH_UPDATE_F_OVERRIDE);
837 if (neigh || !dev->header_ops) {
838 ndisc_send_na(dev, neigh, saddr, &msg->target,
839 !!is_router,
840 true, (ifp != NULL && inc), inc);
841 if (neigh)
842 neigh_release(neigh);
843 }
844
845 out:
846 if (ifp)
847 in6_ifa_put(ifp);
848 else
849 in6_dev_put(idev);
850 }
851
ndisc_recv_na(struct sk_buff * skb)852 static void ndisc_recv_na(struct sk_buff *skb)
853 {
854 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
855 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
856 const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
857 u8 *lladdr = NULL;
858 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
859 offsetof(struct nd_msg, opt));
860 struct ndisc_options ndopts;
861 struct net_device *dev = skb->dev;
862 struct inet6_ifaddr *ifp;
863 struct neighbour *neigh;
864
865 if (skb->len < sizeof(struct nd_msg)) {
866 ND_PRINTK(2, warn, "NA: packet too short\n");
867 return;
868 }
869
870 if (ipv6_addr_is_multicast(&msg->target)) {
871 ND_PRINTK(2, warn, "NA: target address is multicast\n");
872 return;
873 }
874
875 if (ipv6_addr_is_multicast(daddr) &&
876 msg->icmph.icmp6_solicited) {
877 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
878 return;
879 }
880
881 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
882 ND_PRINTK(2, warn, "NS: invalid ND option\n");
883 return;
884 }
885 if (ndopts.nd_opts_tgt_lladdr) {
886 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
887 if (!lladdr) {
888 ND_PRINTK(2, warn,
889 "NA: invalid link-layer address length\n");
890 return;
891 }
892 }
893 ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
894 if (ifp) {
895 if (skb->pkt_type != PACKET_LOOPBACK
896 && (ifp->flags & IFA_F_TENTATIVE)) {
897 addrconf_dad_failure(ifp);
898 return;
899 }
900 /* What should we make now? The advertisement
901 is invalid, but ndisc specs say nothing
902 about it. It could be misconfiguration, or
903 an smart proxy agent tries to help us :-)
904
905 We should not print the error if NA has been
906 received from loopback - it is just our own
907 unsolicited advertisement.
908 */
909 if (skb->pkt_type != PACKET_LOOPBACK)
910 ND_PRINTK(1, warn,
911 "NA: someone advertises our address %pI6 on %s!\n",
912 &ifp->addr, ifp->idev->dev->name);
913 in6_ifa_put(ifp);
914 return;
915 }
916 neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
917
918 if (neigh) {
919 u8 old_flags = neigh->flags;
920 struct net *net = dev_net(dev);
921
922 if (neigh->nud_state & NUD_FAILED)
923 goto out;
924
925 /*
926 * Don't update the neighbor cache entry on a proxy NA from
927 * ourselves because either the proxied node is off link or it
928 * has already sent a NA to us.
929 */
930 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
931 net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
932 pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
933 /* XXX: idev->cnf.proxy_ndp */
934 goto out;
935 }
936
937 neigh_update(neigh, lladdr,
938 msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
939 NEIGH_UPDATE_F_WEAK_OVERRIDE|
940 (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
941 NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
942 (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
943
944 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
945 /*
946 * Change: router to host
947 */
948 rt6_clean_tohost(dev_net(dev), saddr);
949 }
950
951 out:
952 neigh_release(neigh);
953 }
954 }
955
ndisc_recv_rs(struct sk_buff * skb)956 static void ndisc_recv_rs(struct sk_buff *skb)
957 {
958 struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
959 unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
960 struct neighbour *neigh;
961 struct inet6_dev *idev;
962 const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
963 struct ndisc_options ndopts;
964 u8 *lladdr = NULL;
965
966 if (skb->len < sizeof(*rs_msg))
967 return;
968
969 idev = __in6_dev_get(skb->dev);
970 if (!idev) {
971 ND_PRINTK(1, err, "RS: can't find in6 device\n");
972 return;
973 }
974
975 /* Don't accept RS if we're not in router mode */
976 if (!idev->cnf.forwarding)
977 goto out;
978
979 /*
980 * Don't update NCE if src = ::;
981 * this implies that the source node has no ip address assigned yet.
982 */
983 if (ipv6_addr_any(saddr))
984 goto out;
985
986 /* Parse ND options */
987 if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
988 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
989 goto out;
990 }
991
992 if (ndopts.nd_opts_src_lladdr) {
993 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
994 skb->dev);
995 if (!lladdr)
996 goto out;
997 }
998
999 neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1000 if (neigh) {
1001 neigh_update(neigh, lladdr, NUD_STALE,
1002 NEIGH_UPDATE_F_WEAK_OVERRIDE|
1003 NEIGH_UPDATE_F_OVERRIDE|
1004 NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1005 neigh_release(neigh);
1006 }
1007 out:
1008 return;
1009 }
1010
ndisc_ra_useropt(struct sk_buff * ra,struct nd_opt_hdr * opt)1011 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1012 {
1013 struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1014 struct sk_buff *skb;
1015 struct nlmsghdr *nlh;
1016 struct nduseroptmsg *ndmsg;
1017 struct net *net = dev_net(ra->dev);
1018 int err;
1019 int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1020 + (opt->nd_opt_len << 3));
1021 size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1022
1023 skb = nlmsg_new(msg_size, GFP_ATOMIC);
1024 if (skb == NULL) {
1025 err = -ENOBUFS;
1026 goto errout;
1027 }
1028
1029 nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1030 if (nlh == NULL) {
1031 goto nla_put_failure;
1032 }
1033
1034 ndmsg = nlmsg_data(nlh);
1035 ndmsg->nduseropt_family = AF_INET6;
1036 ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1037 ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1038 ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1039 ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1040
1041 memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1042
1043 if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
1044 &ipv6_hdr(ra)->saddr))
1045 goto nla_put_failure;
1046 nlmsg_end(skb, nlh);
1047
1048 rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1049 return;
1050
1051 nla_put_failure:
1052 nlmsg_free(skb);
1053 err = -EMSGSIZE;
1054 errout:
1055 rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1056 }
1057
ndisc_router_discovery(struct sk_buff * skb)1058 static void ndisc_router_discovery(struct sk_buff *skb)
1059 {
1060 struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1061 struct neighbour *neigh = NULL;
1062 struct inet6_dev *in6_dev;
1063 struct rt6_info *rt = NULL;
1064 int lifetime;
1065 struct ndisc_options ndopts;
1066 int optlen;
1067 unsigned int pref = 0;
1068
1069 __u8 *opt = (__u8 *)(ra_msg + 1);
1070
1071 optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1072 sizeof(struct ra_msg);
1073
1074 ND_PRINTK(2, info,
1075 "RA: %s, dev: %s\n",
1076 __func__, skb->dev->name);
1077 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1078 ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1079 return;
1080 }
1081 if (optlen < 0) {
1082 ND_PRINTK(2, warn, "RA: packet too short\n");
1083 return;
1084 }
1085
1086 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1087 if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1088 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1089 return;
1090 }
1091 #endif
1092
1093 /*
1094 * set the RA_RECV flag in the interface
1095 */
1096
1097 in6_dev = __in6_dev_get(skb->dev);
1098 if (in6_dev == NULL) {
1099 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1100 skb->dev->name);
1101 return;
1102 }
1103
1104 if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1105 ND_PRINTK(2, warn, "RA: invalid ND options\n");
1106 return;
1107 }
1108
1109 if (!ipv6_accept_ra(in6_dev)) {
1110 ND_PRINTK(2, info,
1111 "RA: %s, did not accept ra for dev: %s\n",
1112 __func__, skb->dev->name);
1113 goto skip_linkparms;
1114 }
1115
1116 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1117 /* skip link-specific parameters from interior routers */
1118 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1119 ND_PRINTK(2, info,
1120 "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1121 __func__, skb->dev->name);
1122 goto skip_linkparms;
1123 }
1124 #endif
1125
1126 if (in6_dev->if_flags & IF_RS_SENT) {
1127 /*
1128 * flag that an RA was received after an RS was sent
1129 * out on this interface.
1130 */
1131 in6_dev->if_flags |= IF_RA_RCVD;
1132 }
1133
1134 /*
1135 * Remember the managed/otherconf flags from most recently
1136 * received RA message (RFC 2462) -- yoshfuji
1137 */
1138 in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1139 IF_RA_OTHERCONF)) |
1140 (ra_msg->icmph.icmp6_addrconf_managed ?
1141 IF_RA_MANAGED : 0) |
1142 (ra_msg->icmph.icmp6_addrconf_other ?
1143 IF_RA_OTHERCONF : 0);
1144
1145 if (!in6_dev->cnf.accept_ra_defrtr) {
1146 ND_PRINTK(2, info,
1147 "RA: %s, defrtr is false for dev: %s\n",
1148 __func__, skb->dev->name);
1149 goto skip_defrtr;
1150 }
1151
1152 /* Do not accept RA with source-addr found on local machine unless
1153 * accept_ra_from_local is set to true.
1154 */
1155 if (!in6_dev->cnf.accept_ra_from_local &&
1156 ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1157 NULL, 0)) {
1158 ND_PRINTK(2, info,
1159 "RA from local address detected on dev: %s: default router ignored\n",
1160 skb->dev->name);
1161 goto skip_defrtr;
1162 }
1163
1164 lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1165
1166 #ifdef CONFIG_IPV6_ROUTER_PREF
1167 pref = ra_msg->icmph.icmp6_router_pref;
1168 /* 10b is handled as if it were 00b (medium) */
1169 if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1170 !in6_dev->cnf.accept_ra_rtr_pref)
1171 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1172 #endif
1173
1174 rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1175
1176 if (rt) {
1177 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1178 if (!neigh) {
1179 ND_PRINTK(0, err,
1180 "RA: %s got default router without neighbour\n",
1181 __func__);
1182 ip6_rt_put(rt);
1183 return;
1184 }
1185 }
1186 if (rt && lifetime == 0) {
1187 ip6_del_rt(rt);
1188 rt = NULL;
1189 }
1190
1191 ND_PRINTK(3, info, "RA: rt: %p lifetime: %d, for dev: %s\n",
1192 rt, lifetime, skb->dev->name);
1193 if (rt == NULL && lifetime) {
1194 ND_PRINTK(3, info, "RA: adding default router\n");
1195
1196 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1197 if (rt == NULL) {
1198 ND_PRINTK(0, err,
1199 "RA: %s failed to add default route\n",
1200 __func__);
1201 return;
1202 }
1203
1204 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
1205 if (neigh == NULL) {
1206 ND_PRINTK(0, err,
1207 "RA: %s got default router without neighbour\n",
1208 __func__);
1209 ip6_rt_put(rt);
1210 return;
1211 }
1212 neigh->flags |= NTF_ROUTER;
1213 } else if (rt) {
1214 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1215 }
1216
1217 if (rt)
1218 rt6_set_expires(rt, jiffies + (HZ * lifetime));
1219 if (ra_msg->icmph.icmp6_hop_limit) {
1220 /* Only set hop_limit on the interface if it is higher than
1221 * the current hop_limit.
1222 */
1223 if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
1224 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1225 } else {
1226 ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
1227 }
1228 if (rt)
1229 dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
1230 ra_msg->icmph.icmp6_hop_limit);
1231 }
1232
1233 skip_defrtr:
1234
1235 /*
1236 * Update Reachable Time and Retrans Timer
1237 */
1238
1239 if (in6_dev->nd_parms) {
1240 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1241
1242 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1243 rtime = (rtime*HZ)/1000;
1244 if (rtime < HZ/10)
1245 rtime = HZ/10;
1246 NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1247 in6_dev->tstamp = jiffies;
1248 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1249 }
1250
1251 rtime = ntohl(ra_msg->reachable_time);
1252 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1253 rtime = (rtime*HZ)/1000;
1254
1255 if (rtime < HZ/10)
1256 rtime = HZ/10;
1257
1258 if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1259 NEIGH_VAR_SET(in6_dev->nd_parms,
1260 BASE_REACHABLE_TIME, rtime);
1261 NEIGH_VAR_SET(in6_dev->nd_parms,
1262 GC_STALETIME, 3 * rtime);
1263 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1264 in6_dev->tstamp = jiffies;
1265 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1266 }
1267 }
1268 }
1269
1270 skip_linkparms:
1271
1272 /*
1273 * Process options.
1274 */
1275
1276 if (!neigh)
1277 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1278 skb->dev, 1);
1279 if (neigh) {
1280 u8 *lladdr = NULL;
1281 if (ndopts.nd_opts_src_lladdr) {
1282 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1283 skb->dev);
1284 if (!lladdr) {
1285 ND_PRINTK(2, warn,
1286 "RA: invalid link-layer address length\n");
1287 goto out;
1288 }
1289 }
1290 neigh_update(neigh, lladdr, NUD_STALE,
1291 NEIGH_UPDATE_F_WEAK_OVERRIDE|
1292 NEIGH_UPDATE_F_OVERRIDE|
1293 NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1294 NEIGH_UPDATE_F_ISROUTER);
1295 }
1296
1297 if (!ipv6_accept_ra(in6_dev)) {
1298 ND_PRINTK(2, info,
1299 "RA: %s, accept_ra is false for dev: %s\n",
1300 __func__, skb->dev->name);
1301 goto out;
1302 }
1303
1304 #ifdef CONFIG_IPV6_ROUTE_INFO
1305 if (!in6_dev->cnf.accept_ra_from_local &&
1306 ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1307 NULL, 0)) {
1308 ND_PRINTK(2, info,
1309 "RA from local address detected on dev: %s: router info ignored.\n",
1310 skb->dev->name);
1311 goto skip_routeinfo;
1312 }
1313
1314 if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1315 struct nd_opt_hdr *p;
1316 for (p = ndopts.nd_opts_ri;
1317 p;
1318 p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1319 struct route_info *ri = (struct route_info *)p;
1320 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1321 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1322 ri->prefix_len == 0)
1323 continue;
1324 #endif
1325 if (ri->prefix_len == 0 &&
1326 !in6_dev->cnf.accept_ra_defrtr)
1327 continue;
1328 if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1329 continue;
1330 if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1331 continue;
1332 rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1333 &ipv6_hdr(skb)->saddr);
1334 }
1335 }
1336
1337 skip_routeinfo:
1338 #endif
1339
1340 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1341 /* skip link-specific ndopts from interior routers */
1342 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1343 ND_PRINTK(2, info,
1344 "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1345 __func__, skb->dev->name);
1346 goto out;
1347 }
1348 #endif
1349
1350 if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1351 struct nd_opt_hdr *p;
1352 for (p = ndopts.nd_opts_pi;
1353 p;
1354 p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1355 addrconf_prefix_rcv(skb->dev, (u8 *)p,
1356 (p->nd_opt_len) << 3,
1357 ndopts.nd_opts_src_lladdr != NULL);
1358 }
1359 }
1360
1361 if (ndopts.nd_opts_mtu) {
1362 __be32 n;
1363 u32 mtu;
1364
1365 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1366 mtu = ntohl(n);
1367
1368 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1369 ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1370 } else if (in6_dev->cnf.mtu6 != mtu) {
1371 in6_dev->cnf.mtu6 = mtu;
1372
1373 if (rt)
1374 dst_metric_set(&rt->dst, RTAX_MTU, mtu);
1375
1376 rt6_mtu_change(skb->dev, mtu);
1377 }
1378 }
1379
1380 if (ndopts.nd_useropts) {
1381 struct nd_opt_hdr *p;
1382 for (p = ndopts.nd_useropts;
1383 p;
1384 p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) {
1385 ndisc_ra_useropt(skb, p);
1386 }
1387 }
1388
1389 if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1390 ND_PRINTK(2, warn, "RA: invalid RA options\n");
1391 }
1392 out:
1393 ip6_rt_put(rt);
1394 if (neigh)
1395 neigh_release(neigh);
1396 }
1397
ndisc_redirect_rcv(struct sk_buff * skb)1398 static void ndisc_redirect_rcv(struct sk_buff *skb)
1399 {
1400 u8 *hdr;
1401 struct ndisc_options ndopts;
1402 struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1403 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1404 offsetof(struct rd_msg, opt));
1405
1406 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1407 switch (skb->ndisc_nodetype) {
1408 case NDISC_NODETYPE_HOST:
1409 case NDISC_NODETYPE_NODEFAULT:
1410 ND_PRINTK(2, warn,
1411 "Redirect: from host or unauthorized router\n");
1412 return;
1413 }
1414 #endif
1415
1416 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1417 ND_PRINTK(2, warn,
1418 "Redirect: source address is not link-local\n");
1419 return;
1420 }
1421
1422 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
1423 return;
1424
1425 if (!ndopts.nd_opts_rh) {
1426 ip6_redirect_no_header(skb, dev_net(skb->dev),
1427 skb->dev->ifindex, 0);
1428 return;
1429 }
1430
1431 hdr = (u8 *)ndopts.nd_opts_rh;
1432 hdr += 8;
1433 if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1434 return;
1435
1436 icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1437 }
1438
ndisc_fill_redirect_hdr_option(struct sk_buff * skb,struct sk_buff * orig_skb,int rd_len)1439 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1440 struct sk_buff *orig_skb,
1441 int rd_len)
1442 {
1443 u8 *opt = skb_put(skb, rd_len);
1444
1445 memset(opt, 0, 8);
1446 *(opt++) = ND_OPT_REDIRECT_HDR;
1447 *(opt++) = (rd_len >> 3);
1448 opt += 6;
1449
1450 memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
1451 }
1452
ndisc_send_redirect(struct sk_buff * skb,const struct in6_addr * target)1453 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1454 {
1455 struct net_device *dev = skb->dev;
1456 struct net *net = dev_net(dev);
1457 struct sock *sk = net->ipv6.ndisc_sk;
1458 int optlen = 0;
1459 struct inet_peer *peer;
1460 struct sk_buff *buff;
1461 struct rd_msg *msg;
1462 struct in6_addr saddr_buf;
1463 struct rt6_info *rt;
1464 struct dst_entry *dst;
1465 struct flowi6 fl6;
1466 int rd_len;
1467 u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1468 bool ret;
1469
1470 if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1471 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1472 dev->name);
1473 return;
1474 }
1475
1476 if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1477 ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1478 ND_PRINTK(2, warn,
1479 "Redirect: target address is not link-local unicast\n");
1480 return;
1481 }
1482
1483 icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1484 &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1485
1486 dst = ip6_route_output(net, NULL, &fl6);
1487 if (dst->error) {
1488 dst_release(dst);
1489 return;
1490 }
1491 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1492 if (IS_ERR(dst))
1493 return;
1494
1495 rt = (struct rt6_info *) dst;
1496
1497 if (rt->rt6i_flags & RTF_GATEWAY) {
1498 ND_PRINTK(2, warn,
1499 "Redirect: destination is not a neighbour\n");
1500 goto release;
1501 }
1502 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
1503 ret = inet_peer_xrlim_allow(peer, 1*HZ);
1504 if (peer)
1505 inet_putpeer(peer);
1506 if (!ret)
1507 goto release;
1508
1509 if (dev->addr_len) {
1510 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1511 if (!neigh) {
1512 ND_PRINTK(2, warn,
1513 "Redirect: no neigh for target address\n");
1514 goto release;
1515 }
1516
1517 read_lock_bh(&neigh->lock);
1518 if (neigh->nud_state & NUD_VALID) {
1519 memcpy(ha_buf, neigh->ha, dev->addr_len);
1520 read_unlock_bh(&neigh->lock);
1521 ha = ha_buf;
1522 optlen += ndisc_opt_addr_space(dev);
1523 } else
1524 read_unlock_bh(&neigh->lock);
1525
1526 neigh_release(neigh);
1527 }
1528
1529 rd_len = min_t(unsigned int,
1530 IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1531 skb->len + 8);
1532 rd_len &= ~0x7;
1533 optlen += rd_len;
1534
1535 buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1536 if (!buff)
1537 goto release;
1538
1539 msg = (struct rd_msg *)skb_put(buff, sizeof(*msg));
1540 *msg = (struct rd_msg) {
1541 .icmph = {
1542 .icmp6_type = NDISC_REDIRECT,
1543 },
1544 .target = *target,
1545 .dest = ipv6_hdr(skb)->daddr,
1546 };
1547
1548 /*
1549 * include target_address option
1550 */
1551
1552 if (ha)
1553 ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha);
1554
1555 /*
1556 * build redirect option and copy skb over to the new packet.
1557 */
1558
1559 if (rd_len)
1560 ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1561
1562 skb_dst_set(buff, dst);
1563 ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1564 return;
1565
1566 release:
1567 dst_release(dst);
1568 }
1569
pndisc_redo(struct sk_buff * skb)1570 static void pndisc_redo(struct sk_buff *skb)
1571 {
1572 ndisc_recv_ns(skb);
1573 kfree_skb(skb);
1574 }
1575
ndisc_suppress_frag_ndisc(struct sk_buff * skb)1576 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1577 {
1578 struct inet6_dev *idev = __in6_dev_get(skb->dev);
1579
1580 if (!idev)
1581 return true;
1582 if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1583 idev->cnf.suppress_frag_ndisc) {
1584 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1585 return true;
1586 }
1587 return false;
1588 }
1589
ndisc_rcv(struct sk_buff * skb)1590 int ndisc_rcv(struct sk_buff *skb)
1591 {
1592 struct nd_msg *msg;
1593
1594 if (ndisc_suppress_frag_ndisc(skb))
1595 return 0;
1596
1597 if (skb_linearize(skb))
1598 return 0;
1599
1600 msg = (struct nd_msg *)skb_transport_header(skb);
1601
1602 __skb_push(skb, skb->data - skb_transport_header(skb));
1603
1604 if (ipv6_hdr(skb)->hop_limit != 255) {
1605 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1606 ipv6_hdr(skb)->hop_limit);
1607 return 0;
1608 }
1609
1610 if (msg->icmph.icmp6_code != 0) {
1611 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1612 msg->icmph.icmp6_code);
1613 return 0;
1614 }
1615
1616 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1617
1618 switch (msg->icmph.icmp6_type) {
1619 case NDISC_NEIGHBOUR_SOLICITATION:
1620 ndisc_recv_ns(skb);
1621 break;
1622
1623 case NDISC_NEIGHBOUR_ADVERTISEMENT:
1624 ndisc_recv_na(skb);
1625 break;
1626
1627 case NDISC_ROUTER_SOLICITATION:
1628 ndisc_recv_rs(skb);
1629 break;
1630
1631 case NDISC_ROUTER_ADVERTISEMENT:
1632 ndisc_router_discovery(skb);
1633 break;
1634
1635 case NDISC_REDIRECT:
1636 ndisc_redirect_rcv(skb);
1637 break;
1638 }
1639
1640 return 0;
1641 }
1642
ndisc_netdev_event(struct notifier_block * this,unsigned long event,void * ptr)1643 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1644 {
1645 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1646 struct net *net = dev_net(dev);
1647 struct inet6_dev *idev;
1648
1649 switch (event) {
1650 case NETDEV_CHANGEADDR:
1651 neigh_changeaddr(&nd_tbl, dev);
1652 fib6_run_gc(0, net, false);
1653 idev = in6_dev_get(dev);
1654 if (!idev)
1655 break;
1656 if (idev->cnf.ndisc_notify)
1657 ndisc_send_unsol_na(dev);
1658 in6_dev_put(idev);
1659 break;
1660 case NETDEV_DOWN:
1661 neigh_ifdown(&nd_tbl, dev);
1662 fib6_run_gc(0, net, false);
1663 break;
1664 case NETDEV_NOTIFY_PEERS:
1665 ndisc_send_unsol_na(dev);
1666 break;
1667 default:
1668 break;
1669 }
1670
1671 return NOTIFY_DONE;
1672 }
1673
1674 static struct notifier_block ndisc_netdev_notifier = {
1675 .notifier_call = ndisc_netdev_event,
1676 };
1677
1678 #ifdef CONFIG_SYSCTL
ndisc_warn_deprecated_sysctl(struct ctl_table * ctl,const char * func,const char * dev_name)1679 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1680 const char *func, const char *dev_name)
1681 {
1682 static char warncomm[TASK_COMM_LEN];
1683 static int warned;
1684 if (strcmp(warncomm, current->comm) && warned < 5) {
1685 strcpy(warncomm, current->comm);
1686 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1687 warncomm, func,
1688 dev_name, ctl->procname,
1689 dev_name, ctl->procname);
1690 warned++;
1691 }
1692 }
1693
ndisc_ifinfo_sysctl_change(struct ctl_table * ctl,int write,void __user * buffer,size_t * lenp,loff_t * ppos)1694 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1695 {
1696 struct net_device *dev = ctl->extra1;
1697 struct inet6_dev *idev;
1698 int ret;
1699
1700 if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1701 (strcmp(ctl->procname, "base_reachable_time") == 0))
1702 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1703
1704 if (strcmp(ctl->procname, "retrans_time") == 0)
1705 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1706
1707 else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1708 ret = neigh_proc_dointvec_jiffies(ctl, write,
1709 buffer, lenp, ppos);
1710
1711 else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1712 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1713 ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1714 buffer, lenp, ppos);
1715 else
1716 ret = -1;
1717
1718 if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1719 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1720 idev->nd_parms->reachable_time =
1721 neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1722 idev->tstamp = jiffies;
1723 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1724 in6_dev_put(idev);
1725 }
1726 return ret;
1727 }
1728
1729
1730 #endif
1731
ndisc_net_init(struct net * net)1732 static int __net_init ndisc_net_init(struct net *net)
1733 {
1734 struct ipv6_pinfo *np;
1735 struct sock *sk;
1736 int err;
1737
1738 err = inet_ctl_sock_create(&sk, PF_INET6,
1739 SOCK_RAW, IPPROTO_ICMPV6, net);
1740 if (err < 0) {
1741 ND_PRINTK(0, err,
1742 "NDISC: Failed to initialize the control socket (err %d)\n",
1743 err);
1744 return err;
1745 }
1746
1747 net->ipv6.ndisc_sk = sk;
1748
1749 np = inet6_sk(sk);
1750 np->hop_limit = 255;
1751 /* Do not loopback ndisc messages */
1752 np->mc_loop = 0;
1753
1754 return 0;
1755 }
1756
ndisc_net_exit(struct net * net)1757 static void __net_exit ndisc_net_exit(struct net *net)
1758 {
1759 inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1760 }
1761
1762 static struct pernet_operations ndisc_net_ops = {
1763 .init = ndisc_net_init,
1764 .exit = ndisc_net_exit,
1765 };
1766
ndisc_init(void)1767 int __init ndisc_init(void)
1768 {
1769 int err;
1770
1771 err = register_pernet_subsys(&ndisc_net_ops);
1772 if (err)
1773 return err;
1774 /*
1775 * Initialize the neighbour table
1776 */
1777 neigh_table_init(&nd_tbl);
1778
1779 #ifdef CONFIG_SYSCTL
1780 err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1781 ndisc_ifinfo_sysctl_change);
1782 if (err)
1783 goto out_unregister_pernet;
1784 out:
1785 #endif
1786 return err;
1787
1788 #ifdef CONFIG_SYSCTL
1789 out_unregister_pernet:
1790 unregister_pernet_subsys(&ndisc_net_ops);
1791 goto out;
1792 #endif
1793 }
1794
ndisc_late_init(void)1795 int __init ndisc_late_init(void)
1796 {
1797 return register_netdevice_notifier(&ndisc_netdev_notifier);
1798 }
1799
ndisc_late_cleanup(void)1800 void ndisc_late_cleanup(void)
1801 {
1802 unregister_netdevice_notifier(&ndisc_netdev_notifier);
1803 }
1804
ndisc_cleanup(void)1805 void ndisc_cleanup(void)
1806 {
1807 #ifdef CONFIG_SYSCTL
1808 neigh_sysctl_unregister(&nd_tbl.parms);
1809 #endif
1810 neigh_table_clear(&nd_tbl);
1811 unregister_pernet_subsys(&ndisc_net_ops);
1812 }
1813