1 /* 2 * Neighbour Discovery for IPv6 3 * Linux INET6 implementation 4 * 5 * Authors: 6 * Pedro Roque <roque@di.fc.ul.pt> 7 * Mike Shaver <shaver@ingenia.com> 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License 11 * as published by the Free Software Foundation; either version 12 * 2 of the License, or (at your option) any later version. 13 */ 14 15 /* 16 * Changes: 17 * 18 * Alexey I. Froloff : RFC6106 (DNSSL) support 19 * Pierre Ynard : export userland ND options 20 * through netlink (RDNSS support) 21 * Lars Fenneberg : fixed MTU setting on receipt 22 * of an RA. 23 * Janos Farkas : kmalloc failure checks 24 * Alexey Kuznetsov : state machine reworked 25 * and moved to net/core. 26 * Pekka Savola : RFC2461 validation 27 * YOSHIFUJI Hideaki @USAGI : Verify ND options properly 28 */ 29 30 #define pr_fmt(fmt) "ICMPv6: " fmt 31 32 #include <linux/module.h> 33 #include <linux/errno.h> 34 #include <linux/types.h> 35 #include <linux/socket.h> 36 #include <linux/sockios.h> 37 #include <linux/sched.h> 38 #include <linux/net.h> 39 #include <linux/in6.h> 40 #include <linux/route.h> 41 #include <linux/init.h> 42 #include <linux/rcupdate.h> 43 #include <linux/slab.h> 44 #ifdef CONFIG_SYSCTL 45 #include <linux/sysctl.h> 46 #endif 47 48 #include <linux/if_addr.h> 49 #include <linux/if_arp.h> 50 #include <linux/ipv6.h> 51 #include <linux/icmpv6.h> 52 #include <linux/jhash.h> 53 54 #include <net/sock.h> 55 #include <net/snmp.h> 56 57 #include <net/ipv6.h> 58 #include <net/protocol.h> 59 #include <net/ndisc.h> 60 #include <net/ip6_route.h> 61 #include <net/addrconf.h> 62 #include <net/icmp.h> 63 64 #include <net/netlink.h> 65 #include <linux/rtnetlink.h> 66 67 #include <net/flow.h> 68 #include <net/ip6_checksum.h> 69 #include <net/inet_common.h> 70 #include <linux/proc_fs.h> 71 72 #include <linux/netfilter.h> 73 #include <linux/netfilter_ipv6.h> 74 75 /* Set to 3 to get tracing... */ 76 #define ND_DEBUG 1 77 78 #define ND_PRINTK(val, level, fmt, ...) \ 79 do { \ 80 if (val <= ND_DEBUG) \ 81 net_##level##_ratelimited(fmt, ##__VA_ARGS__); \ 82 } while (0) 83 84 static u32 ndisc_hash(const void *pkey, 85 const struct net_device *dev, 86 __u32 *hash_rnd); 87 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey); 88 static int ndisc_constructor(struct neighbour *neigh); 89 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb); 90 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb); 91 static int pndisc_constructor(struct pneigh_entry *n); 92 static void pndisc_destructor(struct pneigh_entry *n); 93 static void pndisc_redo(struct sk_buff *skb); 94 95 static const struct neigh_ops ndisc_generic_ops = { 96 .family = AF_INET6, 97 .solicit = ndisc_solicit, 98 .error_report = ndisc_error_report, 99 .output = neigh_resolve_output, 100 .connected_output = neigh_connected_output, 101 }; 102 103 static const struct neigh_ops ndisc_hh_ops = { 104 .family = AF_INET6, 105 .solicit = ndisc_solicit, 106 .error_report = ndisc_error_report, 107 .output = neigh_resolve_output, 108 .connected_output = neigh_resolve_output, 109 }; 110 111 112 static const struct neigh_ops ndisc_direct_ops = { 113 .family = AF_INET6, 114 .output = neigh_direct_output, 115 .connected_output = neigh_direct_output, 116 }; 117 118 struct neigh_table nd_tbl = { 119 .family = AF_INET6, 120 .key_len = sizeof(struct in6_addr), 121 .protocol = cpu_to_be16(ETH_P_IPV6), 122 .hash = ndisc_hash, 123 .key_eq = ndisc_key_eq, 124 .constructor = ndisc_constructor, 125 .pconstructor = pndisc_constructor, 126 .pdestructor = pndisc_destructor, 127 .proxy_redo = pndisc_redo, 128 .id = "ndisc_cache", 129 .parms = { 130 .tbl = &nd_tbl, 131 .reachable_time = ND_REACHABLE_TIME, 132 .data = { 133 [NEIGH_VAR_MCAST_PROBES] = 3, 134 [NEIGH_VAR_UCAST_PROBES] = 3, 135 [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER, 136 [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME, 137 [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ, 138 [NEIGH_VAR_GC_STALETIME] = 60 * HZ, 139 [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024, 140 [NEIGH_VAR_PROXY_QLEN] = 64, 141 [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ, 142 [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10, 143 }, 144 }, 145 .gc_interval = 30 * HZ, 146 .gc_thresh1 = 128, 147 .gc_thresh2 = 512, 148 .gc_thresh3 = 1024, 149 }; 150 151 static void ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data) 152 { 153 int pad = ndisc_addr_option_pad(skb->dev->type); 154 int data_len = skb->dev->addr_len; 155 int space = ndisc_opt_addr_space(skb->dev); 156 u8 *opt = skb_put(skb, space); 157 158 opt[0] = type; 159 opt[1] = space>>3; 160 161 memset(opt + 2, 0, pad); 162 opt += pad; 163 space -= pad; 164 165 memcpy(opt+2, data, data_len); 166 data_len += 2; 167 opt += data_len; 168 space -= data_len; 169 if (space > 0) 170 memset(opt, 0, space); 171 } 172 173 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur, 174 struct nd_opt_hdr *end) 175 { 176 int type; 177 if (!cur || !end || cur >= end) 178 return NULL; 179 type = cur->nd_opt_type; 180 do { 181 cur = ((void *)cur) + (cur->nd_opt_len << 3); 182 } while (cur < end && cur->nd_opt_type != type); 183 return cur <= end && cur->nd_opt_type == type ? cur : NULL; 184 } 185 186 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt) 187 { 188 return opt->nd_opt_type == ND_OPT_RDNSS || 189 opt->nd_opt_type == ND_OPT_DNSSL; 190 } 191 192 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur, 193 struct nd_opt_hdr *end) 194 { 195 if (!cur || !end || cur >= end) 196 return NULL; 197 do { 198 cur = ((void *)cur) + (cur->nd_opt_len << 3); 199 } while (cur < end && !ndisc_is_useropt(cur)); 200 return cur <= end && ndisc_is_useropt(cur) ? cur : NULL; 201 } 202 203 struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len, 204 struct ndisc_options *ndopts) 205 { 206 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt; 207 208 if (!nd_opt || opt_len < 0 || !ndopts) 209 return NULL; 210 memset(ndopts, 0, sizeof(*ndopts)); 211 while (opt_len) { 212 int l; 213 if (opt_len < sizeof(struct nd_opt_hdr)) 214 return NULL; 215 l = nd_opt->nd_opt_len << 3; 216 if (opt_len < l || l == 0) 217 return NULL; 218 switch (nd_opt->nd_opt_type) { 219 case ND_OPT_SOURCE_LL_ADDR: 220 case ND_OPT_TARGET_LL_ADDR: 221 case ND_OPT_MTU: 222 case ND_OPT_REDIRECT_HDR: 223 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) { 224 ND_PRINTK(2, warn, 225 "%s: duplicated ND6 option found: type=%d\n", 226 __func__, nd_opt->nd_opt_type); 227 } else { 228 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt; 229 } 230 break; 231 case ND_OPT_PREFIX_INFO: 232 ndopts->nd_opts_pi_end = nd_opt; 233 if (!ndopts->nd_opt_array[nd_opt->nd_opt_type]) 234 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt; 235 break; 236 #ifdef CONFIG_IPV6_ROUTE_INFO 237 case ND_OPT_ROUTE_INFO: 238 ndopts->nd_opts_ri_end = nd_opt; 239 if (!ndopts->nd_opts_ri) 240 ndopts->nd_opts_ri = nd_opt; 241 break; 242 #endif 243 default: 244 if (ndisc_is_useropt(nd_opt)) { 245 ndopts->nd_useropts_end = nd_opt; 246 if (!ndopts->nd_useropts) 247 ndopts->nd_useropts = nd_opt; 248 } else { 249 /* 250 * Unknown options must be silently ignored, 251 * to accommodate future extension to the 252 * protocol. 253 */ 254 ND_PRINTK(2, notice, 255 "%s: ignored unsupported option; type=%d, len=%d\n", 256 __func__, 257 nd_opt->nd_opt_type, 258 nd_opt->nd_opt_len); 259 } 260 } 261 opt_len -= l; 262 nd_opt = ((void *)nd_opt) + l; 263 } 264 return ndopts; 265 } 266 267 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir) 268 { 269 switch (dev->type) { 270 case ARPHRD_ETHER: 271 case ARPHRD_IEEE802: /* Not sure. Check it later. --ANK */ 272 case ARPHRD_FDDI: 273 ipv6_eth_mc_map(addr, buf); 274 return 0; 275 case ARPHRD_ARCNET: 276 ipv6_arcnet_mc_map(addr, buf); 277 return 0; 278 case ARPHRD_INFINIBAND: 279 ipv6_ib_mc_map(addr, dev->broadcast, buf); 280 return 0; 281 case ARPHRD_IPGRE: 282 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf); 283 default: 284 if (dir) { 285 memcpy(buf, dev->broadcast, dev->addr_len); 286 return 0; 287 } 288 } 289 return -EINVAL; 290 } 291 EXPORT_SYMBOL(ndisc_mc_map); 292 293 static u32 ndisc_hash(const void *pkey, 294 const struct net_device *dev, 295 __u32 *hash_rnd) 296 { 297 return ndisc_hashfn(pkey, dev, hash_rnd); 298 } 299 300 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey) 301 { 302 return neigh_key_eq128(n, pkey); 303 } 304 305 static int ndisc_constructor(struct neighbour *neigh) 306 { 307 struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key; 308 struct net_device *dev = neigh->dev; 309 struct inet6_dev *in6_dev; 310 struct neigh_parms *parms; 311 bool is_multicast = ipv6_addr_is_multicast(addr); 312 313 in6_dev = in6_dev_get(dev); 314 if (!in6_dev) { 315 return -EINVAL; 316 } 317 318 parms = in6_dev->nd_parms; 319 __neigh_parms_put(neigh->parms); 320 neigh->parms = neigh_parms_clone(parms); 321 322 neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST; 323 if (!dev->header_ops) { 324 neigh->nud_state = NUD_NOARP; 325 neigh->ops = &ndisc_direct_ops; 326 neigh->output = neigh_direct_output; 327 } else { 328 if (is_multicast) { 329 neigh->nud_state = NUD_NOARP; 330 ndisc_mc_map(addr, neigh->ha, dev, 1); 331 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) { 332 neigh->nud_state = NUD_NOARP; 333 memcpy(neigh->ha, dev->dev_addr, dev->addr_len); 334 if (dev->flags&IFF_LOOPBACK) 335 neigh->type = RTN_LOCAL; 336 } else if (dev->flags&IFF_POINTOPOINT) { 337 neigh->nud_state = NUD_NOARP; 338 memcpy(neigh->ha, dev->broadcast, dev->addr_len); 339 } 340 if (dev->header_ops->cache) 341 neigh->ops = &ndisc_hh_ops; 342 else 343 neigh->ops = &ndisc_generic_ops; 344 if (neigh->nud_state&NUD_VALID) 345 neigh->output = neigh->ops->connected_output; 346 else 347 neigh->output = neigh->ops->output; 348 } 349 in6_dev_put(in6_dev); 350 return 0; 351 } 352 353 static int pndisc_constructor(struct pneigh_entry *n) 354 { 355 struct in6_addr *addr = (struct in6_addr *)&n->key; 356 struct in6_addr maddr; 357 struct net_device *dev = n->dev; 358 359 if (!dev || !__in6_dev_get(dev)) 360 return -EINVAL; 361 addrconf_addr_solict_mult(addr, &maddr); 362 ipv6_dev_mc_inc(dev, &maddr); 363 return 0; 364 } 365 366 static void pndisc_destructor(struct pneigh_entry *n) 367 { 368 struct in6_addr *addr = (struct in6_addr *)&n->key; 369 struct in6_addr maddr; 370 struct net_device *dev = n->dev; 371 372 if (!dev || !__in6_dev_get(dev)) 373 return; 374 addrconf_addr_solict_mult(addr, &maddr); 375 ipv6_dev_mc_dec(dev, &maddr); 376 } 377 378 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev, 379 int len) 380 { 381 int hlen = LL_RESERVED_SPACE(dev); 382 int tlen = dev->needed_tailroom; 383 struct sock *sk = dev_net(dev)->ipv6.ndisc_sk; 384 struct sk_buff *skb; 385 386 skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC); 387 if (!skb) { 388 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n", 389 __func__); 390 return NULL; 391 } 392 393 skb->protocol = htons(ETH_P_IPV6); 394 skb->dev = dev; 395 396 skb_reserve(skb, hlen + sizeof(struct ipv6hdr)); 397 skb_reset_transport_header(skb); 398 399 /* Manually assign socket ownership as we avoid calling 400 * sock_alloc_send_pskb() to bypass wmem buffer limits 401 */ 402 skb_set_owner_w(skb, sk); 403 404 return skb; 405 } 406 407 static void ip6_nd_hdr(struct sk_buff *skb, 408 const struct in6_addr *saddr, 409 const struct in6_addr *daddr, 410 int hop_limit, int len) 411 { 412 struct ipv6hdr *hdr; 413 414 skb_push(skb, sizeof(*hdr)); 415 skb_reset_network_header(skb); 416 hdr = ipv6_hdr(skb); 417 418 ip6_flow_hdr(hdr, 0, 0); 419 420 hdr->payload_len = htons(len); 421 hdr->nexthdr = IPPROTO_ICMPV6; 422 hdr->hop_limit = hop_limit; 423 424 hdr->saddr = *saddr; 425 hdr->daddr = *daddr; 426 } 427 428 static void ndisc_send_skb(struct sk_buff *skb, 429 const struct in6_addr *daddr, 430 const struct in6_addr *saddr) 431 { 432 struct dst_entry *dst = skb_dst(skb); 433 struct net *net = dev_net(skb->dev); 434 struct sock *sk = net->ipv6.ndisc_sk; 435 struct inet6_dev *idev; 436 int err; 437 struct icmp6hdr *icmp6h = icmp6_hdr(skb); 438 u8 type; 439 440 type = icmp6h->icmp6_type; 441 442 if (!dst) { 443 struct flowi6 fl6; 444 445 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, skb->dev->ifindex); 446 dst = icmp6_dst_alloc(skb->dev, &fl6); 447 if (IS_ERR(dst)) { 448 kfree_skb(skb); 449 return; 450 } 451 452 skb_dst_set(skb, dst); 453 } 454 455 icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len, 456 IPPROTO_ICMPV6, 457 csum_partial(icmp6h, 458 skb->len, 0)); 459 460 ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len); 461 462 rcu_read_lock(); 463 idev = __in6_dev_get(dst->dev); 464 IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len); 465 466 err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, 467 net, sk, skb, NULL, dst->dev, 468 dst_output_okfn); 469 if (!err) { 470 ICMP6MSGOUT_INC_STATS(net, idev, type); 471 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); 472 } 473 474 rcu_read_unlock(); 475 } 476 477 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr, 478 const struct in6_addr *solicited_addr, 479 bool router, bool solicited, bool override, bool inc_opt) 480 { 481 struct sk_buff *skb; 482 struct in6_addr tmpaddr; 483 struct inet6_ifaddr *ifp; 484 const struct in6_addr *src_addr; 485 struct nd_msg *msg; 486 int optlen = 0; 487 488 /* for anycast or proxy, solicited_addr != src_addr */ 489 ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1); 490 if (ifp) { 491 src_addr = solicited_addr; 492 if (ifp->flags & IFA_F_OPTIMISTIC) 493 override = false; 494 inc_opt |= ifp->idev->cnf.force_tllao; 495 in6_ifa_put(ifp); 496 } else { 497 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr, 498 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs, 499 &tmpaddr)) 500 return; 501 src_addr = &tmpaddr; 502 } 503 504 if (!dev->addr_len) 505 inc_opt = 0; 506 if (inc_opt) 507 optlen += ndisc_opt_addr_space(dev); 508 509 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 510 if (!skb) 511 return; 512 513 msg = (struct nd_msg *)skb_put(skb, sizeof(*msg)); 514 *msg = (struct nd_msg) { 515 .icmph = { 516 .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT, 517 .icmp6_router = router, 518 .icmp6_solicited = solicited, 519 .icmp6_override = override, 520 }, 521 .target = *solicited_addr, 522 }; 523 524 if (inc_opt) 525 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, 526 dev->dev_addr); 527 528 529 ndisc_send_skb(skb, daddr, src_addr); 530 } 531 532 static void ndisc_send_unsol_na(struct net_device *dev) 533 { 534 struct inet6_dev *idev; 535 struct inet6_ifaddr *ifa; 536 537 idev = in6_dev_get(dev); 538 if (!idev) 539 return; 540 541 read_lock_bh(&idev->lock); 542 list_for_each_entry(ifa, &idev->addr_list, if_list) { 543 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr, 544 /*router=*/ !!idev->cnf.forwarding, 545 /*solicited=*/ false, /*override=*/ true, 546 /*inc_opt=*/ true); 547 } 548 read_unlock_bh(&idev->lock); 549 550 in6_dev_put(idev); 551 } 552 553 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit, 554 const struct in6_addr *daddr, const struct in6_addr *saddr, 555 struct sk_buff *oskb) 556 { 557 struct sk_buff *skb; 558 struct in6_addr addr_buf; 559 int inc_opt = dev->addr_len; 560 int optlen = 0; 561 struct nd_msg *msg; 562 563 if (!saddr) { 564 if (ipv6_get_lladdr(dev, &addr_buf, 565 (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))) 566 return; 567 saddr = &addr_buf; 568 } 569 570 if (ipv6_addr_any(saddr)) 571 inc_opt = false; 572 if (inc_opt) 573 optlen += ndisc_opt_addr_space(dev); 574 575 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 576 if (!skb) 577 return; 578 579 msg = (struct nd_msg *)skb_put(skb, sizeof(*msg)); 580 *msg = (struct nd_msg) { 581 .icmph = { 582 .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION, 583 }, 584 .target = *solicit, 585 }; 586 587 if (inc_opt) 588 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR, 589 dev->dev_addr); 590 591 if (!(dev->priv_flags & IFF_XMIT_DST_RELEASE) && oskb) 592 skb_dst_copy(skb, oskb); 593 594 ndisc_send_skb(skb, daddr, saddr); 595 } 596 597 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr, 598 const struct in6_addr *daddr) 599 { 600 struct sk_buff *skb; 601 struct rs_msg *msg; 602 int send_sllao = dev->addr_len; 603 int optlen = 0; 604 605 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD 606 /* 607 * According to section 2.2 of RFC 4429, we must not 608 * send router solicitations with a sllao from 609 * optimistic addresses, but we may send the solicitation 610 * if we don't include the sllao. So here we check 611 * if our address is optimistic, and if so, we 612 * suppress the inclusion of the sllao. 613 */ 614 if (send_sllao) { 615 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr, 616 dev, 1); 617 if (ifp) { 618 if (ifp->flags & IFA_F_OPTIMISTIC) { 619 send_sllao = 0; 620 } 621 in6_ifa_put(ifp); 622 } else { 623 send_sllao = 0; 624 } 625 } 626 #endif 627 if (send_sllao) 628 optlen += ndisc_opt_addr_space(dev); 629 630 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 631 if (!skb) 632 return; 633 634 msg = (struct rs_msg *)skb_put(skb, sizeof(*msg)); 635 *msg = (struct rs_msg) { 636 .icmph = { 637 .icmp6_type = NDISC_ROUTER_SOLICITATION, 638 }, 639 }; 640 641 if (send_sllao) 642 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR, 643 dev->dev_addr); 644 645 ndisc_send_skb(skb, daddr, saddr); 646 } 647 648 649 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb) 650 { 651 /* 652 * "The sender MUST return an ICMP 653 * destination unreachable" 654 */ 655 dst_link_failure(skb); 656 kfree_skb(skb); 657 } 658 659 /* Called with locked neigh: either read or both */ 660 661 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb) 662 { 663 struct in6_addr *saddr = NULL; 664 struct in6_addr mcaddr; 665 struct net_device *dev = neigh->dev; 666 struct in6_addr *target = (struct in6_addr *)&neigh->primary_key; 667 int probes = atomic_read(&neigh->probes); 668 669 if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr, 670 dev, 1, 671 IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) 672 saddr = &ipv6_hdr(skb)->saddr; 673 probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES); 674 if (probes < 0) { 675 if (!(neigh->nud_state & NUD_VALID)) { 676 ND_PRINTK(1, dbg, 677 "%s: trying to ucast probe in NUD_INVALID: %pI6\n", 678 __func__, target); 679 } 680 ndisc_send_ns(dev, target, target, saddr, skb); 681 } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) { 682 neigh_app_ns(neigh); 683 } else { 684 addrconf_addr_solict_mult(target, &mcaddr); 685 ndisc_send_ns(dev, target, &mcaddr, saddr, skb); 686 } 687 } 688 689 static int pndisc_is_router(const void *pkey, 690 struct net_device *dev) 691 { 692 struct pneigh_entry *n; 693 int ret = -1; 694 695 read_lock_bh(&nd_tbl.lock); 696 n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev); 697 if (n) 698 ret = !!(n->flags & NTF_ROUTER); 699 read_unlock_bh(&nd_tbl.lock); 700 701 return ret; 702 } 703 704 static void ndisc_recv_ns(struct sk_buff *skb) 705 { 706 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb); 707 const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 708 const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr; 709 u8 *lladdr = NULL; 710 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) + 711 offsetof(struct nd_msg, opt)); 712 struct ndisc_options ndopts; 713 struct net_device *dev = skb->dev; 714 struct inet6_ifaddr *ifp; 715 struct inet6_dev *idev = NULL; 716 struct neighbour *neigh; 717 int dad = ipv6_addr_any(saddr); 718 bool inc; 719 int is_router = -1; 720 721 if (skb->len < sizeof(struct nd_msg)) { 722 ND_PRINTK(2, warn, "NS: packet too short\n"); 723 return; 724 } 725 726 if (ipv6_addr_is_multicast(&msg->target)) { 727 ND_PRINTK(2, warn, "NS: multicast target address\n"); 728 return; 729 } 730 731 /* 732 * RFC2461 7.1.1: 733 * DAD has to be destined for solicited node multicast address. 734 */ 735 if (dad && !ipv6_addr_is_solict_mult(daddr)) { 736 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n"); 737 return; 738 } 739 740 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) { 741 ND_PRINTK(2, warn, "NS: invalid ND options\n"); 742 return; 743 } 744 745 if (ndopts.nd_opts_src_lladdr) { 746 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev); 747 if (!lladdr) { 748 ND_PRINTK(2, warn, 749 "NS: invalid link-layer address length\n"); 750 return; 751 } 752 753 /* RFC2461 7.1.1: 754 * If the IP source address is the unspecified address, 755 * there MUST NOT be source link-layer address option 756 * in the message. 757 */ 758 if (dad) { 759 ND_PRINTK(2, warn, 760 "NS: bad DAD packet (link-layer address option)\n"); 761 return; 762 } 763 } 764 765 inc = ipv6_addr_is_multicast(daddr); 766 767 ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1); 768 if (ifp) { 769 770 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) { 771 if (dad) { 772 /* 773 * We are colliding with another node 774 * who is doing DAD 775 * so fail our DAD process 776 */ 777 addrconf_dad_failure(ifp); 778 return; 779 } else { 780 /* 781 * This is not a dad solicitation. 782 * If we are an optimistic node, 783 * we should respond. 784 * Otherwise, we should ignore it. 785 */ 786 if (!(ifp->flags & IFA_F_OPTIMISTIC)) 787 goto out; 788 } 789 } 790 791 idev = ifp->idev; 792 } else { 793 struct net *net = dev_net(dev); 794 795 idev = in6_dev_get(dev); 796 if (!idev) { 797 /* XXX: count this drop? */ 798 return; 799 } 800 801 if (ipv6_chk_acast_addr(net, dev, &msg->target) || 802 (idev->cnf.forwarding && 803 (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) && 804 (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) { 805 if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) && 806 skb->pkt_type != PACKET_HOST && 807 inc && 808 NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) { 809 /* 810 * for anycast or proxy, 811 * sender should delay its response 812 * by a random time between 0 and 813 * MAX_ANYCAST_DELAY_TIME seconds. 814 * (RFC2461) -- yoshfuji 815 */ 816 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC); 817 if (n) 818 pneigh_enqueue(&nd_tbl, idev->nd_parms, n); 819 goto out; 820 } 821 } else 822 goto out; 823 } 824 825 if (is_router < 0) 826 is_router = idev->cnf.forwarding; 827 828 if (dad) { 829 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target, 830 !!is_router, false, (ifp != NULL), true); 831 goto out; 832 } 833 834 if (inc) 835 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast); 836 else 837 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast); 838 839 /* 840 * update / create cache entry 841 * for the source address 842 */ 843 neigh = __neigh_lookup(&nd_tbl, saddr, dev, 844 !inc || lladdr || !dev->addr_len); 845 if (neigh) 846 neigh_update(neigh, lladdr, NUD_STALE, 847 NEIGH_UPDATE_F_WEAK_OVERRIDE| 848 NEIGH_UPDATE_F_OVERRIDE); 849 if (neigh || !dev->header_ops) { 850 ndisc_send_na(dev, saddr, &msg->target, !!is_router, 851 true, (ifp != NULL && inc), inc); 852 if (neigh) 853 neigh_release(neigh); 854 } 855 856 out: 857 if (ifp) 858 in6_ifa_put(ifp); 859 else 860 in6_dev_put(idev); 861 } 862 863 static void ndisc_recv_na(struct sk_buff *skb) 864 { 865 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb); 866 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 867 const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr; 868 u8 *lladdr = NULL; 869 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) + 870 offsetof(struct nd_msg, opt)); 871 struct ndisc_options ndopts; 872 struct net_device *dev = skb->dev; 873 struct inet6_ifaddr *ifp; 874 struct neighbour *neigh; 875 876 if (skb->len < sizeof(struct nd_msg)) { 877 ND_PRINTK(2, warn, "NA: packet too short\n"); 878 return; 879 } 880 881 if (ipv6_addr_is_multicast(&msg->target)) { 882 ND_PRINTK(2, warn, "NA: target address is multicast\n"); 883 return; 884 } 885 886 if (ipv6_addr_is_multicast(daddr) && 887 msg->icmph.icmp6_solicited) { 888 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n"); 889 return; 890 } 891 892 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) { 893 ND_PRINTK(2, warn, "NS: invalid ND option\n"); 894 return; 895 } 896 if (ndopts.nd_opts_tgt_lladdr) { 897 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev); 898 if (!lladdr) { 899 ND_PRINTK(2, warn, 900 "NA: invalid link-layer address length\n"); 901 return; 902 } 903 } 904 ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1); 905 if (ifp) { 906 if (skb->pkt_type != PACKET_LOOPBACK 907 && (ifp->flags & IFA_F_TENTATIVE)) { 908 addrconf_dad_failure(ifp); 909 return; 910 } 911 /* What should we make now? The advertisement 912 is invalid, but ndisc specs say nothing 913 about it. It could be misconfiguration, or 914 an smart proxy agent tries to help us :-) 915 916 We should not print the error if NA has been 917 received from loopback - it is just our own 918 unsolicited advertisement. 919 */ 920 if (skb->pkt_type != PACKET_LOOPBACK) 921 ND_PRINTK(1, warn, 922 "NA: someone advertises our address %pI6 on %s!\n", 923 &ifp->addr, ifp->idev->dev->name); 924 in6_ifa_put(ifp); 925 return; 926 } 927 neigh = neigh_lookup(&nd_tbl, &msg->target, dev); 928 929 if (neigh) { 930 u8 old_flags = neigh->flags; 931 struct net *net = dev_net(dev); 932 933 if (neigh->nud_state & NUD_FAILED) 934 goto out; 935 936 /* 937 * Don't update the neighbor cache entry on a proxy NA from 938 * ourselves because either the proxied node is off link or it 939 * has already sent a NA to us. 940 */ 941 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) && 942 net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp && 943 pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) { 944 /* XXX: idev->cnf.proxy_ndp */ 945 goto out; 946 } 947 948 neigh_update(neigh, lladdr, 949 msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE, 950 NEIGH_UPDATE_F_WEAK_OVERRIDE| 951 (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)| 952 NEIGH_UPDATE_F_OVERRIDE_ISROUTER| 953 (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0)); 954 955 if ((old_flags & ~neigh->flags) & NTF_ROUTER) { 956 /* 957 * Change: router to host 958 */ 959 rt6_clean_tohost(dev_net(dev), saddr); 960 } 961 962 out: 963 neigh_release(neigh); 964 } 965 } 966 967 static void ndisc_recv_rs(struct sk_buff *skb) 968 { 969 struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb); 970 unsigned long ndoptlen = skb->len - sizeof(*rs_msg); 971 struct neighbour *neigh; 972 struct inet6_dev *idev; 973 const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 974 struct ndisc_options ndopts; 975 u8 *lladdr = NULL; 976 977 if (skb->len < sizeof(*rs_msg)) 978 return; 979 980 idev = __in6_dev_get(skb->dev); 981 if (!idev) { 982 ND_PRINTK(1, err, "RS: can't find in6 device\n"); 983 return; 984 } 985 986 /* Don't accept RS if we're not in router mode */ 987 if (!idev->cnf.forwarding) 988 goto out; 989 990 /* 991 * Don't update NCE if src = ::; 992 * this implies that the source node has no ip address assigned yet. 993 */ 994 if (ipv6_addr_any(saddr)) 995 goto out; 996 997 /* Parse ND options */ 998 if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) { 999 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n"); 1000 goto out; 1001 } 1002 1003 if (ndopts.nd_opts_src_lladdr) { 1004 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, 1005 skb->dev); 1006 if (!lladdr) 1007 goto out; 1008 } 1009 1010 neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1); 1011 if (neigh) { 1012 neigh_update(neigh, lladdr, NUD_STALE, 1013 NEIGH_UPDATE_F_WEAK_OVERRIDE| 1014 NEIGH_UPDATE_F_OVERRIDE| 1015 NEIGH_UPDATE_F_OVERRIDE_ISROUTER); 1016 neigh_release(neigh); 1017 } 1018 out: 1019 return; 1020 } 1021 1022 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt) 1023 { 1024 struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra); 1025 struct sk_buff *skb; 1026 struct nlmsghdr *nlh; 1027 struct nduseroptmsg *ndmsg; 1028 struct net *net = dev_net(ra->dev); 1029 int err; 1030 int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg) 1031 + (opt->nd_opt_len << 3)); 1032 size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr)); 1033 1034 skb = nlmsg_new(msg_size, GFP_ATOMIC); 1035 if (!skb) { 1036 err = -ENOBUFS; 1037 goto errout; 1038 } 1039 1040 nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0); 1041 if (!nlh) { 1042 goto nla_put_failure; 1043 } 1044 1045 ndmsg = nlmsg_data(nlh); 1046 ndmsg->nduseropt_family = AF_INET6; 1047 ndmsg->nduseropt_ifindex = ra->dev->ifindex; 1048 ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type; 1049 ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code; 1050 ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3; 1051 1052 memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3); 1053 1054 if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr)) 1055 goto nla_put_failure; 1056 nlmsg_end(skb, nlh); 1057 1058 rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC); 1059 return; 1060 1061 nla_put_failure: 1062 nlmsg_free(skb); 1063 err = -EMSGSIZE; 1064 errout: 1065 rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err); 1066 } 1067 1068 static void ndisc_router_discovery(struct sk_buff *skb) 1069 { 1070 struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb); 1071 struct neighbour *neigh = NULL; 1072 struct inet6_dev *in6_dev; 1073 struct rt6_info *rt = NULL; 1074 int lifetime; 1075 struct ndisc_options ndopts; 1076 int optlen; 1077 unsigned int pref = 0; 1078 __u32 old_if_flags; 1079 bool send_ifinfo_notify = false; 1080 1081 __u8 *opt = (__u8 *)(ra_msg + 1); 1082 1083 optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) - 1084 sizeof(struct ra_msg); 1085 1086 ND_PRINTK(2, info, 1087 "RA: %s, dev: %s\n", 1088 __func__, skb->dev->name); 1089 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) { 1090 ND_PRINTK(2, warn, "RA: source address is not link-local\n"); 1091 return; 1092 } 1093 if (optlen < 0) { 1094 ND_PRINTK(2, warn, "RA: packet too short\n"); 1095 return; 1096 } 1097 1098 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1099 if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) { 1100 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n"); 1101 return; 1102 } 1103 #endif 1104 1105 /* 1106 * set the RA_RECV flag in the interface 1107 */ 1108 1109 in6_dev = __in6_dev_get(skb->dev); 1110 if (!in6_dev) { 1111 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n", 1112 skb->dev->name); 1113 return; 1114 } 1115 1116 if (!ndisc_parse_options(opt, optlen, &ndopts)) { 1117 ND_PRINTK(2, warn, "RA: invalid ND options\n"); 1118 return; 1119 } 1120 1121 if (!ipv6_accept_ra(in6_dev)) { 1122 ND_PRINTK(2, info, 1123 "RA: %s, did not accept ra for dev: %s\n", 1124 __func__, skb->dev->name); 1125 goto skip_linkparms; 1126 } 1127 1128 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1129 /* skip link-specific parameters from interior routers */ 1130 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) { 1131 ND_PRINTK(2, info, 1132 "RA: %s, nodetype is NODEFAULT, dev: %s\n", 1133 __func__, skb->dev->name); 1134 goto skip_linkparms; 1135 } 1136 #endif 1137 1138 if (in6_dev->if_flags & IF_RS_SENT) { 1139 /* 1140 * flag that an RA was received after an RS was sent 1141 * out on this interface. 1142 */ 1143 in6_dev->if_flags |= IF_RA_RCVD; 1144 } 1145 1146 /* 1147 * Remember the managed/otherconf flags from most recently 1148 * received RA message (RFC 2462) -- yoshfuji 1149 */ 1150 old_if_flags = in6_dev->if_flags; 1151 in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED | 1152 IF_RA_OTHERCONF)) | 1153 (ra_msg->icmph.icmp6_addrconf_managed ? 1154 IF_RA_MANAGED : 0) | 1155 (ra_msg->icmph.icmp6_addrconf_other ? 1156 IF_RA_OTHERCONF : 0); 1157 1158 if (old_if_flags != in6_dev->if_flags) 1159 send_ifinfo_notify = true; 1160 1161 if (!in6_dev->cnf.accept_ra_defrtr) { 1162 ND_PRINTK(2, info, 1163 "RA: %s, defrtr is false for dev: %s\n", 1164 __func__, skb->dev->name); 1165 goto skip_defrtr; 1166 } 1167 1168 /* Do not accept RA with source-addr found on local machine unless 1169 * accept_ra_from_local is set to true. 1170 */ 1171 if (!in6_dev->cnf.accept_ra_from_local && 1172 ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, 1173 NULL, 0)) { 1174 ND_PRINTK(2, info, 1175 "RA from local address detected on dev: %s: default router ignored\n", 1176 skb->dev->name); 1177 goto skip_defrtr; 1178 } 1179 1180 lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime); 1181 1182 #ifdef CONFIG_IPV6_ROUTER_PREF 1183 pref = ra_msg->icmph.icmp6_router_pref; 1184 /* 10b is handled as if it were 00b (medium) */ 1185 if (pref == ICMPV6_ROUTER_PREF_INVALID || 1186 !in6_dev->cnf.accept_ra_rtr_pref) 1187 pref = ICMPV6_ROUTER_PREF_MEDIUM; 1188 #endif 1189 1190 rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev); 1191 1192 if (rt) { 1193 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr); 1194 if (!neigh) { 1195 ND_PRINTK(0, err, 1196 "RA: %s got default router without neighbour\n", 1197 __func__); 1198 ip6_rt_put(rt); 1199 return; 1200 } 1201 } 1202 if (rt && lifetime == 0) { 1203 ip6_del_rt(rt); 1204 rt = NULL; 1205 } 1206 1207 ND_PRINTK(3, info, "RA: rt: %p lifetime: %d, for dev: %s\n", 1208 rt, lifetime, skb->dev->name); 1209 if (!rt && lifetime) { 1210 ND_PRINTK(3, info, "RA: adding default router\n"); 1211 1212 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref); 1213 if (!rt) { 1214 ND_PRINTK(0, err, 1215 "RA: %s failed to add default route\n", 1216 __func__); 1217 return; 1218 } 1219 1220 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr); 1221 if (!neigh) { 1222 ND_PRINTK(0, err, 1223 "RA: %s got default router without neighbour\n", 1224 __func__); 1225 ip6_rt_put(rt); 1226 return; 1227 } 1228 neigh->flags |= NTF_ROUTER; 1229 } else if (rt) { 1230 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref); 1231 } 1232 1233 if (rt) 1234 rt6_set_expires(rt, jiffies + (HZ * lifetime)); 1235 if (in6_dev->cnf.accept_ra_min_hop_limit < 256 && 1236 ra_msg->icmph.icmp6_hop_limit) { 1237 if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) { 1238 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit; 1239 if (rt) 1240 dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 1241 ra_msg->icmph.icmp6_hop_limit); 1242 } else { 1243 ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n"); 1244 } 1245 } 1246 1247 skip_defrtr: 1248 1249 /* 1250 * Update Reachable Time and Retrans Timer 1251 */ 1252 1253 if (in6_dev->nd_parms) { 1254 unsigned long rtime = ntohl(ra_msg->retrans_timer); 1255 1256 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) { 1257 rtime = (rtime*HZ)/1000; 1258 if (rtime < HZ/10) 1259 rtime = HZ/10; 1260 NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime); 1261 in6_dev->tstamp = jiffies; 1262 send_ifinfo_notify = true; 1263 } 1264 1265 rtime = ntohl(ra_msg->reachable_time); 1266 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) { 1267 rtime = (rtime*HZ)/1000; 1268 1269 if (rtime < HZ/10) 1270 rtime = HZ/10; 1271 1272 if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) { 1273 NEIGH_VAR_SET(in6_dev->nd_parms, 1274 BASE_REACHABLE_TIME, rtime); 1275 NEIGH_VAR_SET(in6_dev->nd_parms, 1276 GC_STALETIME, 3 * rtime); 1277 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime); 1278 in6_dev->tstamp = jiffies; 1279 send_ifinfo_notify = true; 1280 } 1281 } 1282 } 1283 1284 /* 1285 * Send a notify if RA changed managed/otherconf flags or timer settings 1286 */ 1287 if (send_ifinfo_notify) 1288 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev); 1289 1290 skip_linkparms: 1291 1292 /* 1293 * Process options. 1294 */ 1295 1296 if (!neigh) 1297 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr, 1298 skb->dev, 1); 1299 if (neigh) { 1300 u8 *lladdr = NULL; 1301 if (ndopts.nd_opts_src_lladdr) { 1302 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, 1303 skb->dev); 1304 if (!lladdr) { 1305 ND_PRINTK(2, warn, 1306 "RA: invalid link-layer address length\n"); 1307 goto out; 1308 } 1309 } 1310 neigh_update(neigh, lladdr, NUD_STALE, 1311 NEIGH_UPDATE_F_WEAK_OVERRIDE| 1312 NEIGH_UPDATE_F_OVERRIDE| 1313 NEIGH_UPDATE_F_OVERRIDE_ISROUTER| 1314 NEIGH_UPDATE_F_ISROUTER); 1315 } 1316 1317 if (!ipv6_accept_ra(in6_dev)) { 1318 ND_PRINTK(2, info, 1319 "RA: %s, accept_ra is false for dev: %s\n", 1320 __func__, skb->dev->name); 1321 goto out; 1322 } 1323 1324 #ifdef CONFIG_IPV6_ROUTE_INFO 1325 if (!in6_dev->cnf.accept_ra_from_local && 1326 ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, 1327 NULL, 0)) { 1328 ND_PRINTK(2, info, 1329 "RA from local address detected on dev: %s: router info ignored.\n", 1330 skb->dev->name); 1331 goto skip_routeinfo; 1332 } 1333 1334 if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) { 1335 struct nd_opt_hdr *p; 1336 for (p = ndopts.nd_opts_ri; 1337 p; 1338 p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) { 1339 struct route_info *ri = (struct route_info *)p; 1340 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1341 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT && 1342 ri->prefix_len == 0) 1343 continue; 1344 #endif 1345 if (ri->prefix_len == 0 && 1346 !in6_dev->cnf.accept_ra_defrtr) 1347 continue; 1348 if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen) 1349 continue; 1350 rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3, 1351 &ipv6_hdr(skb)->saddr); 1352 } 1353 } 1354 1355 skip_routeinfo: 1356 #endif 1357 1358 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1359 /* skip link-specific ndopts from interior routers */ 1360 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) { 1361 ND_PRINTK(2, info, 1362 "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n", 1363 __func__, skb->dev->name); 1364 goto out; 1365 } 1366 #endif 1367 1368 if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) { 1369 struct nd_opt_hdr *p; 1370 for (p = ndopts.nd_opts_pi; 1371 p; 1372 p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) { 1373 addrconf_prefix_rcv(skb->dev, (u8 *)p, 1374 (p->nd_opt_len) << 3, 1375 ndopts.nd_opts_src_lladdr != NULL); 1376 } 1377 } 1378 1379 if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) { 1380 __be32 n; 1381 u32 mtu; 1382 1383 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu)); 1384 mtu = ntohl(n); 1385 1386 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) { 1387 ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu); 1388 } else if (in6_dev->cnf.mtu6 != mtu) { 1389 in6_dev->cnf.mtu6 = mtu; 1390 1391 if (rt) 1392 dst_metric_set(&rt->dst, RTAX_MTU, mtu); 1393 1394 rt6_mtu_change(skb->dev, mtu); 1395 } 1396 } 1397 1398 if (ndopts.nd_useropts) { 1399 struct nd_opt_hdr *p; 1400 for (p = ndopts.nd_useropts; 1401 p; 1402 p = ndisc_next_useropt(p, ndopts.nd_useropts_end)) { 1403 ndisc_ra_useropt(skb, p); 1404 } 1405 } 1406 1407 if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) { 1408 ND_PRINTK(2, warn, "RA: invalid RA options\n"); 1409 } 1410 out: 1411 ip6_rt_put(rt); 1412 if (neigh) 1413 neigh_release(neigh); 1414 } 1415 1416 static void ndisc_redirect_rcv(struct sk_buff *skb) 1417 { 1418 u8 *hdr; 1419 struct ndisc_options ndopts; 1420 struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb); 1421 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) + 1422 offsetof(struct rd_msg, opt)); 1423 1424 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1425 switch (skb->ndisc_nodetype) { 1426 case NDISC_NODETYPE_HOST: 1427 case NDISC_NODETYPE_NODEFAULT: 1428 ND_PRINTK(2, warn, 1429 "Redirect: from host or unauthorized router\n"); 1430 return; 1431 } 1432 #endif 1433 1434 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) { 1435 ND_PRINTK(2, warn, 1436 "Redirect: source address is not link-local\n"); 1437 return; 1438 } 1439 1440 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) 1441 return; 1442 1443 if (!ndopts.nd_opts_rh) { 1444 ip6_redirect_no_header(skb, dev_net(skb->dev), 1445 skb->dev->ifindex, 0); 1446 return; 1447 } 1448 1449 hdr = (u8 *)ndopts.nd_opts_rh; 1450 hdr += 8; 1451 if (!pskb_pull(skb, hdr - skb_transport_header(skb))) 1452 return; 1453 1454 icmpv6_notify(skb, NDISC_REDIRECT, 0, 0); 1455 } 1456 1457 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb, 1458 struct sk_buff *orig_skb, 1459 int rd_len) 1460 { 1461 u8 *opt = skb_put(skb, rd_len); 1462 1463 memset(opt, 0, 8); 1464 *(opt++) = ND_OPT_REDIRECT_HDR; 1465 *(opt++) = (rd_len >> 3); 1466 opt += 6; 1467 1468 memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8); 1469 } 1470 1471 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) 1472 { 1473 struct net_device *dev = skb->dev; 1474 struct net *net = dev_net(dev); 1475 struct sock *sk = net->ipv6.ndisc_sk; 1476 int optlen = 0; 1477 struct inet_peer *peer; 1478 struct sk_buff *buff; 1479 struct rd_msg *msg; 1480 struct in6_addr saddr_buf; 1481 struct rt6_info *rt; 1482 struct dst_entry *dst; 1483 struct flowi6 fl6; 1484 int rd_len; 1485 u8 ha_buf[MAX_ADDR_LEN], *ha = NULL; 1486 bool ret; 1487 1488 if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) { 1489 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n", 1490 dev->name); 1491 return; 1492 } 1493 1494 if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) && 1495 ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) { 1496 ND_PRINTK(2, warn, 1497 "Redirect: target address is not link-local unicast\n"); 1498 return; 1499 } 1500 1501 icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT, 1502 &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex); 1503 1504 dst = ip6_route_output(net, NULL, &fl6); 1505 if (dst->error) { 1506 dst_release(dst); 1507 return; 1508 } 1509 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0); 1510 if (IS_ERR(dst)) 1511 return; 1512 1513 rt = (struct rt6_info *) dst; 1514 1515 if (rt->rt6i_flags & RTF_GATEWAY) { 1516 ND_PRINTK(2, warn, 1517 "Redirect: destination is not a neighbour\n"); 1518 goto release; 1519 } 1520 peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1); 1521 ret = inet_peer_xrlim_allow(peer, 1*HZ); 1522 if (peer) 1523 inet_putpeer(peer); 1524 if (!ret) 1525 goto release; 1526 1527 if (dev->addr_len) { 1528 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target); 1529 if (!neigh) { 1530 ND_PRINTK(2, warn, 1531 "Redirect: no neigh for target address\n"); 1532 goto release; 1533 } 1534 1535 read_lock_bh(&neigh->lock); 1536 if (neigh->nud_state & NUD_VALID) { 1537 memcpy(ha_buf, neigh->ha, dev->addr_len); 1538 read_unlock_bh(&neigh->lock); 1539 ha = ha_buf; 1540 optlen += ndisc_opt_addr_space(dev); 1541 } else 1542 read_unlock_bh(&neigh->lock); 1543 1544 neigh_release(neigh); 1545 } 1546 1547 rd_len = min_t(unsigned int, 1548 IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen, 1549 skb->len + 8); 1550 rd_len &= ~0x7; 1551 optlen += rd_len; 1552 1553 buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 1554 if (!buff) 1555 goto release; 1556 1557 msg = (struct rd_msg *)skb_put(buff, sizeof(*msg)); 1558 *msg = (struct rd_msg) { 1559 .icmph = { 1560 .icmp6_type = NDISC_REDIRECT, 1561 }, 1562 .target = *target, 1563 .dest = ipv6_hdr(skb)->daddr, 1564 }; 1565 1566 /* 1567 * include target_address option 1568 */ 1569 1570 if (ha) 1571 ndisc_fill_addr_option(buff, ND_OPT_TARGET_LL_ADDR, ha); 1572 1573 /* 1574 * build redirect option and copy skb over to the new packet. 1575 */ 1576 1577 if (rd_len) 1578 ndisc_fill_redirect_hdr_option(buff, skb, rd_len); 1579 1580 skb_dst_set(buff, dst); 1581 ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf); 1582 return; 1583 1584 release: 1585 dst_release(dst); 1586 } 1587 1588 static void pndisc_redo(struct sk_buff *skb) 1589 { 1590 ndisc_recv_ns(skb); 1591 kfree_skb(skb); 1592 } 1593 1594 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb) 1595 { 1596 struct inet6_dev *idev = __in6_dev_get(skb->dev); 1597 1598 if (!idev) 1599 return true; 1600 if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED && 1601 idev->cnf.suppress_frag_ndisc) { 1602 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n"); 1603 return true; 1604 } 1605 return false; 1606 } 1607 1608 int ndisc_rcv(struct sk_buff *skb) 1609 { 1610 struct nd_msg *msg; 1611 1612 if (ndisc_suppress_frag_ndisc(skb)) 1613 return 0; 1614 1615 if (skb_linearize(skb)) 1616 return 0; 1617 1618 msg = (struct nd_msg *)skb_transport_header(skb); 1619 1620 __skb_push(skb, skb->data - skb_transport_header(skb)); 1621 1622 if (ipv6_hdr(skb)->hop_limit != 255) { 1623 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n", 1624 ipv6_hdr(skb)->hop_limit); 1625 return 0; 1626 } 1627 1628 if (msg->icmph.icmp6_code != 0) { 1629 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n", 1630 msg->icmph.icmp6_code); 1631 return 0; 1632 } 1633 1634 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb)); 1635 1636 switch (msg->icmph.icmp6_type) { 1637 case NDISC_NEIGHBOUR_SOLICITATION: 1638 ndisc_recv_ns(skb); 1639 break; 1640 1641 case NDISC_NEIGHBOUR_ADVERTISEMENT: 1642 ndisc_recv_na(skb); 1643 break; 1644 1645 case NDISC_ROUTER_SOLICITATION: 1646 ndisc_recv_rs(skb); 1647 break; 1648 1649 case NDISC_ROUTER_ADVERTISEMENT: 1650 ndisc_router_discovery(skb); 1651 break; 1652 1653 case NDISC_REDIRECT: 1654 ndisc_redirect_rcv(skb); 1655 break; 1656 } 1657 1658 return 0; 1659 } 1660 1661 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) 1662 { 1663 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1664 struct netdev_notifier_change_info *change_info; 1665 struct net *net = dev_net(dev); 1666 struct inet6_dev *idev; 1667 1668 switch (event) { 1669 case NETDEV_CHANGEADDR: 1670 neigh_changeaddr(&nd_tbl, dev); 1671 fib6_run_gc(0, net, false); 1672 idev = in6_dev_get(dev); 1673 if (!idev) 1674 break; 1675 if (idev->cnf.ndisc_notify) 1676 ndisc_send_unsol_na(dev); 1677 in6_dev_put(idev); 1678 break; 1679 case NETDEV_CHANGE: 1680 change_info = ptr; 1681 if (change_info->flags_changed & IFF_NOARP) 1682 neigh_changeaddr(&nd_tbl, dev); 1683 break; 1684 case NETDEV_DOWN: 1685 neigh_ifdown(&nd_tbl, dev); 1686 fib6_run_gc(0, net, false); 1687 break; 1688 case NETDEV_NOTIFY_PEERS: 1689 ndisc_send_unsol_na(dev); 1690 break; 1691 default: 1692 break; 1693 } 1694 1695 return NOTIFY_DONE; 1696 } 1697 1698 static struct notifier_block ndisc_netdev_notifier = { 1699 .notifier_call = ndisc_netdev_event, 1700 }; 1701 1702 #ifdef CONFIG_SYSCTL 1703 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl, 1704 const char *func, const char *dev_name) 1705 { 1706 static char warncomm[TASK_COMM_LEN]; 1707 static int warned; 1708 if (strcmp(warncomm, current->comm) && warned < 5) { 1709 strcpy(warncomm, current->comm); 1710 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n", 1711 warncomm, func, 1712 dev_name, ctl->procname, 1713 dev_name, ctl->procname); 1714 warned++; 1715 } 1716 } 1717 1718 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos) 1719 { 1720 struct net_device *dev = ctl->extra1; 1721 struct inet6_dev *idev; 1722 int ret; 1723 1724 if ((strcmp(ctl->procname, "retrans_time") == 0) || 1725 (strcmp(ctl->procname, "base_reachable_time") == 0)) 1726 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default"); 1727 1728 if (strcmp(ctl->procname, "retrans_time") == 0) 1729 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos); 1730 1731 else if (strcmp(ctl->procname, "base_reachable_time") == 0) 1732 ret = neigh_proc_dointvec_jiffies(ctl, write, 1733 buffer, lenp, ppos); 1734 1735 else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) || 1736 (strcmp(ctl->procname, "base_reachable_time_ms") == 0)) 1737 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, 1738 buffer, lenp, ppos); 1739 else 1740 ret = -1; 1741 1742 if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) { 1743 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME)) 1744 idev->nd_parms->reachable_time = 1745 neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME)); 1746 idev->tstamp = jiffies; 1747 inet6_ifinfo_notify(RTM_NEWLINK, idev); 1748 in6_dev_put(idev); 1749 } 1750 return ret; 1751 } 1752 1753 1754 #endif 1755 1756 static int __net_init ndisc_net_init(struct net *net) 1757 { 1758 struct ipv6_pinfo *np; 1759 struct sock *sk; 1760 int err; 1761 1762 err = inet_ctl_sock_create(&sk, PF_INET6, 1763 SOCK_RAW, IPPROTO_ICMPV6, net); 1764 if (err < 0) { 1765 ND_PRINTK(0, err, 1766 "NDISC: Failed to initialize the control socket (err %d)\n", 1767 err); 1768 return err; 1769 } 1770 1771 net->ipv6.ndisc_sk = sk; 1772 1773 np = inet6_sk(sk); 1774 np->hop_limit = 255; 1775 /* Do not loopback ndisc messages */ 1776 np->mc_loop = 0; 1777 1778 return 0; 1779 } 1780 1781 static void __net_exit ndisc_net_exit(struct net *net) 1782 { 1783 inet_ctl_sock_destroy(net->ipv6.ndisc_sk); 1784 } 1785 1786 static struct pernet_operations ndisc_net_ops = { 1787 .init = ndisc_net_init, 1788 .exit = ndisc_net_exit, 1789 }; 1790 1791 int __init ndisc_init(void) 1792 { 1793 int err; 1794 1795 err = register_pernet_subsys(&ndisc_net_ops); 1796 if (err) 1797 return err; 1798 /* 1799 * Initialize the neighbour table 1800 */ 1801 neigh_table_init(NEIGH_ND_TABLE, &nd_tbl); 1802 1803 #ifdef CONFIG_SYSCTL 1804 err = neigh_sysctl_register(NULL, &nd_tbl.parms, 1805 ndisc_ifinfo_sysctl_change); 1806 if (err) 1807 goto out_unregister_pernet; 1808 out: 1809 #endif 1810 return err; 1811 1812 #ifdef CONFIG_SYSCTL 1813 out_unregister_pernet: 1814 unregister_pernet_subsys(&ndisc_net_ops); 1815 goto out; 1816 #endif 1817 } 1818 1819 int __init ndisc_late_init(void) 1820 { 1821 return register_netdevice_notifier(&ndisc_netdev_notifier); 1822 } 1823 1824 void ndisc_late_cleanup(void) 1825 { 1826 unregister_netdevice_notifier(&ndisc_netdev_notifier); 1827 } 1828 1829 void ndisc_cleanup(void) 1830 { 1831 #ifdef CONFIG_SYSCTL 1832 neigh_sysctl_unregister(&nd_tbl.parms); 1833 #endif 1834 neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl); 1835 unregister_pernet_subsys(&ndisc_net_ops); 1836 } 1837