xref: /openbmc/linux/net/ipv6/ndisc.c (revision 55b37d9c)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *	Neighbour Discovery for IPv6
4  *	Linux INET6 implementation
5  *
6  *	Authors:
7  *	Pedro Roque		<roque@di.fc.ul.pt>
8  *	Mike Shaver		<shaver@ingenia.com>
9  */
10 
11 /*
12  *	Changes:
13  *
14  *	Alexey I. Froloff		:	RFC6106 (DNSSL) support
15  *	Pierre Ynard			:	export userland ND options
16  *						through netlink (RDNSS support)
17  *	Lars Fenneberg			:	fixed MTU setting on receipt
18  *						of an RA.
19  *	Janos Farkas			:	kmalloc failure checks
20  *	Alexey Kuznetsov		:	state machine reworked
21  *						and moved to net/core.
22  *	Pekka Savola			:	RFC2461 validation
23  *	YOSHIFUJI Hideaki @USAGI	:	Verify ND options properly
24  */
25 
26 #define pr_fmt(fmt) "ICMPv6: " fmt
27 
28 #include <linux/module.h>
29 #include <linux/errno.h>
30 #include <linux/types.h>
31 #include <linux/socket.h>
32 #include <linux/sockios.h>
33 #include <linux/sched.h>
34 #include <linux/net.h>
35 #include <linux/in6.h>
36 #include <linux/route.h>
37 #include <linux/init.h>
38 #include <linux/rcupdate.h>
39 #include <linux/slab.h>
40 #ifdef CONFIG_SYSCTL
41 #include <linux/sysctl.h>
42 #endif
43 
44 #include <linux/if_addr.h>
45 #include <linux/if_ether.h>
46 #include <linux/if_arp.h>
47 #include <linux/ipv6.h>
48 #include <linux/icmpv6.h>
49 #include <linux/jhash.h>
50 
51 #include <net/sock.h>
52 #include <net/snmp.h>
53 
54 #include <net/ipv6.h>
55 #include <net/protocol.h>
56 #include <net/ndisc.h>
57 #include <net/ip6_route.h>
58 #include <net/addrconf.h>
59 #include <net/icmp.h>
60 
61 #include <net/netlink.h>
62 #include <linux/rtnetlink.h>
63 
64 #include <net/flow.h>
65 #include <net/ip6_checksum.h>
66 #include <net/inet_common.h>
67 #include <linux/proc_fs.h>
68 
69 #include <linux/netfilter.h>
70 #include <linux/netfilter_ipv6.h>
71 
72 static u32 ndisc_hash(const void *pkey,
73 		      const struct net_device *dev,
74 		      __u32 *hash_rnd);
75 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
76 static bool ndisc_allow_add(const struct net_device *dev,
77 			    struct netlink_ext_ack *extack);
78 static int ndisc_constructor(struct neighbour *neigh);
79 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
80 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
81 static int pndisc_constructor(struct pneigh_entry *n);
82 static void pndisc_destructor(struct pneigh_entry *n);
83 static void pndisc_redo(struct sk_buff *skb);
84 static int ndisc_is_multicast(const void *pkey);
85 
86 static const struct neigh_ops ndisc_generic_ops = {
87 	.family =		AF_INET6,
88 	.solicit =		ndisc_solicit,
89 	.error_report =		ndisc_error_report,
90 	.output =		neigh_resolve_output,
91 	.connected_output =	neigh_connected_output,
92 };
93 
94 static const struct neigh_ops ndisc_hh_ops = {
95 	.family =		AF_INET6,
96 	.solicit =		ndisc_solicit,
97 	.error_report =		ndisc_error_report,
98 	.output =		neigh_resolve_output,
99 	.connected_output =	neigh_resolve_output,
100 };
101 
102 
103 static const struct neigh_ops ndisc_direct_ops = {
104 	.family =		AF_INET6,
105 	.output =		neigh_direct_output,
106 	.connected_output =	neigh_direct_output,
107 };
108 
109 struct neigh_table nd_tbl = {
110 	.family =	AF_INET6,
111 	.key_len =	sizeof(struct in6_addr),
112 	.protocol =	cpu_to_be16(ETH_P_IPV6),
113 	.hash =		ndisc_hash,
114 	.key_eq =	ndisc_key_eq,
115 	.constructor =	ndisc_constructor,
116 	.pconstructor =	pndisc_constructor,
117 	.pdestructor =	pndisc_destructor,
118 	.proxy_redo =	pndisc_redo,
119 	.is_multicast =	ndisc_is_multicast,
120 	.allow_add  =   ndisc_allow_add,
121 	.id =		"ndisc_cache",
122 	.parms = {
123 		.tbl			= &nd_tbl,
124 		.reachable_time		= ND_REACHABLE_TIME,
125 		.data = {
126 			[NEIGH_VAR_MCAST_PROBES] = 3,
127 			[NEIGH_VAR_UCAST_PROBES] = 3,
128 			[NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
129 			[NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
130 			[NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
131 			[NEIGH_VAR_INTERVAL_PROBE_TIME_MS] = 5 * HZ,
132 			[NEIGH_VAR_GC_STALETIME] = 60 * HZ,
133 			[NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
134 			[NEIGH_VAR_PROXY_QLEN] = 64,
135 			[NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
136 			[NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
137 		},
138 	},
139 	.gc_interval =	  30 * HZ,
140 	.gc_thresh1 =	 128,
141 	.gc_thresh2 =	 512,
142 	.gc_thresh3 =	1024,
143 };
144 EXPORT_SYMBOL_GPL(nd_tbl);
145 
146 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, const void *data,
147 			      int data_len, int pad)
148 {
149 	int space = __ndisc_opt_addr_space(data_len, pad);
150 	u8 *opt = skb_put(skb, space);
151 
152 	opt[0] = type;
153 	opt[1] = space>>3;
154 
155 	memset(opt + 2, 0, pad);
156 	opt   += pad;
157 	space -= pad;
158 
159 	memcpy(opt+2, data, data_len);
160 	data_len += 2;
161 	opt += data_len;
162 	space -= data_len;
163 	if (space > 0)
164 		memset(opt, 0, space);
165 }
166 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
167 
168 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
169 					  const void *data, u8 icmp6_type)
170 {
171 	__ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
172 				 ndisc_addr_option_pad(skb->dev->type));
173 	ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
174 }
175 
176 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
177 						   void *ha,
178 						   const u8 *ops_data)
179 {
180 	ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
181 	ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
182 }
183 
184 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
185 					    struct nd_opt_hdr *end)
186 {
187 	int type;
188 	if (!cur || !end || cur >= end)
189 		return NULL;
190 	type = cur->nd_opt_type;
191 	do {
192 		cur = ((void *)cur) + (cur->nd_opt_len << 3);
193 	} while (cur < end && cur->nd_opt_type != type);
194 	return cur <= end && cur->nd_opt_type == type ? cur : NULL;
195 }
196 
197 static inline int ndisc_is_useropt(const struct net_device *dev,
198 				   struct nd_opt_hdr *opt)
199 {
200 	return opt->nd_opt_type == ND_OPT_RDNSS ||
201 		opt->nd_opt_type == ND_OPT_DNSSL ||
202 		opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
203 		opt->nd_opt_type == ND_OPT_PREF64 ||
204 		ndisc_ops_is_useropt(dev, opt->nd_opt_type);
205 }
206 
207 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
208 					     struct nd_opt_hdr *cur,
209 					     struct nd_opt_hdr *end)
210 {
211 	if (!cur || !end || cur >= end)
212 		return NULL;
213 	do {
214 		cur = ((void *)cur) + (cur->nd_opt_len << 3);
215 	} while (cur < end && !ndisc_is_useropt(dev, cur));
216 	return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
217 }
218 
219 struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
220 					  u8 *opt, int opt_len,
221 					  struct ndisc_options *ndopts)
222 {
223 	struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
224 
225 	if (!nd_opt || opt_len < 0 || !ndopts)
226 		return NULL;
227 	memset(ndopts, 0, sizeof(*ndopts));
228 	while (opt_len) {
229 		int l;
230 		if (opt_len < sizeof(struct nd_opt_hdr))
231 			return NULL;
232 		l = nd_opt->nd_opt_len << 3;
233 		if (opt_len < l || l == 0)
234 			return NULL;
235 		if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
236 			goto next_opt;
237 		switch (nd_opt->nd_opt_type) {
238 		case ND_OPT_SOURCE_LL_ADDR:
239 		case ND_OPT_TARGET_LL_ADDR:
240 		case ND_OPT_MTU:
241 		case ND_OPT_NONCE:
242 		case ND_OPT_REDIRECT_HDR:
243 			if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
244 				ND_PRINTK(2, warn,
245 					  "%s: duplicated ND6 option found: type=%d\n",
246 					  __func__, nd_opt->nd_opt_type);
247 			} else {
248 				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
249 			}
250 			break;
251 		case ND_OPT_PREFIX_INFO:
252 			ndopts->nd_opts_pi_end = nd_opt;
253 			if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
254 				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
255 			break;
256 #ifdef CONFIG_IPV6_ROUTE_INFO
257 		case ND_OPT_ROUTE_INFO:
258 			ndopts->nd_opts_ri_end = nd_opt;
259 			if (!ndopts->nd_opts_ri)
260 				ndopts->nd_opts_ri = nd_opt;
261 			break;
262 #endif
263 		default:
264 			if (ndisc_is_useropt(dev, nd_opt)) {
265 				ndopts->nd_useropts_end = nd_opt;
266 				if (!ndopts->nd_useropts)
267 					ndopts->nd_useropts = nd_opt;
268 			} else {
269 				/*
270 				 * Unknown options must be silently ignored,
271 				 * to accommodate future extension to the
272 				 * protocol.
273 				 */
274 				ND_PRINTK(2, notice,
275 					  "%s: ignored unsupported option; type=%d, len=%d\n",
276 					  __func__,
277 					  nd_opt->nd_opt_type,
278 					  nd_opt->nd_opt_len);
279 			}
280 		}
281 next_opt:
282 		opt_len -= l;
283 		nd_opt = ((void *)nd_opt) + l;
284 	}
285 	return ndopts;
286 }
287 
288 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
289 {
290 	switch (dev->type) {
291 	case ARPHRD_ETHER:
292 	case ARPHRD_IEEE802:	/* Not sure. Check it later. --ANK */
293 	case ARPHRD_FDDI:
294 		ipv6_eth_mc_map(addr, buf);
295 		return 0;
296 	case ARPHRD_ARCNET:
297 		ipv6_arcnet_mc_map(addr, buf);
298 		return 0;
299 	case ARPHRD_INFINIBAND:
300 		ipv6_ib_mc_map(addr, dev->broadcast, buf);
301 		return 0;
302 	case ARPHRD_IPGRE:
303 		return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
304 	default:
305 		if (dir) {
306 			memcpy(buf, dev->broadcast, dev->addr_len);
307 			return 0;
308 		}
309 	}
310 	return -EINVAL;
311 }
312 EXPORT_SYMBOL(ndisc_mc_map);
313 
314 static u32 ndisc_hash(const void *pkey,
315 		      const struct net_device *dev,
316 		      __u32 *hash_rnd)
317 {
318 	return ndisc_hashfn(pkey, dev, hash_rnd);
319 }
320 
321 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
322 {
323 	return neigh_key_eq128(n, pkey);
324 }
325 
326 static int ndisc_constructor(struct neighbour *neigh)
327 {
328 	struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
329 	struct net_device *dev = neigh->dev;
330 	struct inet6_dev *in6_dev;
331 	struct neigh_parms *parms;
332 	bool is_multicast = ipv6_addr_is_multicast(addr);
333 
334 	in6_dev = in6_dev_get(dev);
335 	if (!in6_dev) {
336 		return -EINVAL;
337 	}
338 
339 	parms = in6_dev->nd_parms;
340 	__neigh_parms_put(neigh->parms);
341 	neigh->parms = neigh_parms_clone(parms);
342 
343 	neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
344 	if (!dev->header_ops) {
345 		neigh->nud_state = NUD_NOARP;
346 		neigh->ops = &ndisc_direct_ops;
347 		neigh->output = neigh_direct_output;
348 	} else {
349 		if (is_multicast) {
350 			neigh->nud_state = NUD_NOARP;
351 			ndisc_mc_map(addr, neigh->ha, dev, 1);
352 		} else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
353 			neigh->nud_state = NUD_NOARP;
354 			memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
355 			if (dev->flags&IFF_LOOPBACK)
356 				neigh->type = RTN_LOCAL;
357 		} else if (dev->flags&IFF_POINTOPOINT) {
358 			neigh->nud_state = NUD_NOARP;
359 			memcpy(neigh->ha, dev->broadcast, dev->addr_len);
360 		}
361 		if (dev->header_ops->cache)
362 			neigh->ops = &ndisc_hh_ops;
363 		else
364 			neigh->ops = &ndisc_generic_ops;
365 		if (neigh->nud_state&NUD_VALID)
366 			neigh->output = neigh->ops->connected_output;
367 		else
368 			neigh->output = neigh->ops->output;
369 	}
370 	in6_dev_put(in6_dev);
371 	return 0;
372 }
373 
374 static int pndisc_constructor(struct pneigh_entry *n)
375 {
376 	struct in6_addr *addr = (struct in6_addr *)&n->key;
377 	struct in6_addr maddr;
378 	struct net_device *dev = n->dev;
379 
380 	if (!dev || !__in6_dev_get(dev))
381 		return -EINVAL;
382 	addrconf_addr_solict_mult(addr, &maddr);
383 	ipv6_dev_mc_inc(dev, &maddr);
384 	return 0;
385 }
386 
387 static void pndisc_destructor(struct pneigh_entry *n)
388 {
389 	struct in6_addr *addr = (struct in6_addr *)&n->key;
390 	struct in6_addr maddr;
391 	struct net_device *dev = n->dev;
392 
393 	if (!dev || !__in6_dev_get(dev))
394 		return;
395 	addrconf_addr_solict_mult(addr, &maddr);
396 	ipv6_dev_mc_dec(dev, &maddr);
397 }
398 
399 /* called with rtnl held */
400 static bool ndisc_allow_add(const struct net_device *dev,
401 			    struct netlink_ext_ack *extack)
402 {
403 	struct inet6_dev *idev = __in6_dev_get(dev);
404 
405 	if (!idev || idev->cnf.disable_ipv6) {
406 		NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device");
407 		return false;
408 	}
409 
410 	return true;
411 }
412 
413 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
414 				       int len)
415 {
416 	int hlen = LL_RESERVED_SPACE(dev);
417 	int tlen = dev->needed_tailroom;
418 	struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
419 	struct sk_buff *skb;
420 
421 	skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
422 	if (!skb) {
423 		ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
424 			  __func__);
425 		return NULL;
426 	}
427 
428 	skb->protocol = htons(ETH_P_IPV6);
429 	skb->dev = dev;
430 
431 	skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
432 	skb_reset_transport_header(skb);
433 
434 	/* Manually assign socket ownership as we avoid calling
435 	 * sock_alloc_send_pskb() to bypass wmem buffer limits
436 	 */
437 	skb_set_owner_w(skb, sk);
438 
439 	return skb;
440 }
441 
442 static void ip6_nd_hdr(struct sk_buff *skb,
443 		       const struct in6_addr *saddr,
444 		       const struct in6_addr *daddr,
445 		       int hop_limit, int len)
446 {
447 	struct ipv6hdr *hdr;
448 	struct inet6_dev *idev;
449 	unsigned tclass;
450 
451 	rcu_read_lock();
452 	idev = __in6_dev_get(skb->dev);
453 	tclass = idev ? idev->cnf.ndisc_tclass : 0;
454 	rcu_read_unlock();
455 
456 	skb_push(skb, sizeof(*hdr));
457 	skb_reset_network_header(skb);
458 	hdr = ipv6_hdr(skb);
459 
460 	ip6_flow_hdr(hdr, tclass, 0);
461 
462 	hdr->payload_len = htons(len);
463 	hdr->nexthdr = IPPROTO_ICMPV6;
464 	hdr->hop_limit = hop_limit;
465 
466 	hdr->saddr = *saddr;
467 	hdr->daddr = *daddr;
468 }
469 
470 void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
471 		    const struct in6_addr *saddr)
472 {
473 	struct dst_entry *dst = skb_dst(skb);
474 	struct net *net = dev_net(skb->dev);
475 	struct sock *sk = net->ipv6.ndisc_sk;
476 	struct inet6_dev *idev;
477 	int err;
478 	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
479 	u8 type;
480 
481 	type = icmp6h->icmp6_type;
482 
483 	if (!dst) {
484 		struct flowi6 fl6;
485 		int oif = skb->dev->ifindex;
486 
487 		icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
488 		dst = icmp6_dst_alloc(skb->dev, &fl6);
489 		if (IS_ERR(dst)) {
490 			kfree_skb(skb);
491 			return;
492 		}
493 
494 		skb_dst_set(skb, dst);
495 	}
496 
497 	icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
498 					      IPPROTO_ICMPV6,
499 					      csum_partial(icmp6h,
500 							   skb->len, 0));
501 
502 	ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
503 
504 	rcu_read_lock();
505 	idev = __in6_dev_get(dst->dev);
506 	IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
507 
508 	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
509 		      net, sk, skb, NULL, dst->dev,
510 		      dst_output);
511 	if (!err) {
512 		ICMP6MSGOUT_INC_STATS(net, idev, type);
513 		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
514 	}
515 
516 	rcu_read_unlock();
517 }
518 EXPORT_SYMBOL(ndisc_send_skb);
519 
520 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
521 		   const struct in6_addr *solicited_addr,
522 		   bool router, bool solicited, bool override, bool inc_opt)
523 {
524 	struct sk_buff *skb;
525 	struct in6_addr tmpaddr;
526 	struct inet6_ifaddr *ifp;
527 	const struct in6_addr *src_addr;
528 	struct nd_msg *msg;
529 	int optlen = 0;
530 
531 	/* for anycast or proxy, solicited_addr != src_addr */
532 	ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
533 	if (ifp) {
534 		src_addr = solicited_addr;
535 		if (ifp->flags & IFA_F_OPTIMISTIC)
536 			override = false;
537 		inc_opt |= ifp->idev->cnf.force_tllao;
538 		in6_ifa_put(ifp);
539 	} else {
540 		if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
541 				       inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
542 				       &tmpaddr))
543 			return;
544 		src_addr = &tmpaddr;
545 	}
546 
547 	if (!dev->addr_len)
548 		inc_opt = false;
549 	if (inc_opt)
550 		optlen += ndisc_opt_addr_space(dev,
551 					       NDISC_NEIGHBOUR_ADVERTISEMENT);
552 
553 	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
554 	if (!skb)
555 		return;
556 
557 	msg = skb_put(skb, sizeof(*msg));
558 	*msg = (struct nd_msg) {
559 		.icmph = {
560 			.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
561 			.icmp6_router = router,
562 			.icmp6_solicited = solicited,
563 			.icmp6_override = override,
564 		},
565 		.target = *solicited_addr,
566 	};
567 
568 	if (inc_opt)
569 		ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
570 				       dev->dev_addr,
571 				       NDISC_NEIGHBOUR_ADVERTISEMENT);
572 
573 	ndisc_send_skb(skb, daddr, src_addr);
574 }
575 
576 static void ndisc_send_unsol_na(struct net_device *dev)
577 {
578 	struct inet6_dev *idev;
579 	struct inet6_ifaddr *ifa;
580 
581 	idev = in6_dev_get(dev);
582 	if (!idev)
583 		return;
584 
585 	read_lock_bh(&idev->lock);
586 	list_for_each_entry(ifa, &idev->addr_list, if_list) {
587 		/* skip tentative addresses until dad completes */
588 		if (ifa->flags & IFA_F_TENTATIVE &&
589 		    !(ifa->flags & IFA_F_OPTIMISTIC))
590 			continue;
591 
592 		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
593 			      /*router=*/ !!idev->cnf.forwarding,
594 			      /*solicited=*/ false, /*override=*/ true,
595 			      /*inc_opt=*/ true);
596 	}
597 	read_unlock_bh(&idev->lock);
598 
599 	in6_dev_put(idev);
600 }
601 
602 struct sk_buff *ndisc_ns_create(struct net_device *dev, const struct in6_addr *solicit,
603 				const struct in6_addr *saddr, u64 nonce)
604 {
605 	int inc_opt = dev->addr_len;
606 	struct sk_buff *skb;
607 	struct nd_msg *msg;
608 	int optlen = 0;
609 
610 	if (!saddr)
611 		return NULL;
612 
613 	if (ipv6_addr_any(saddr))
614 		inc_opt = false;
615 	if (inc_opt)
616 		optlen += ndisc_opt_addr_space(dev,
617 					       NDISC_NEIGHBOUR_SOLICITATION);
618 	if (nonce != 0)
619 		optlen += 8;
620 
621 	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
622 	if (!skb)
623 		return NULL;
624 
625 	msg = skb_put(skb, sizeof(*msg));
626 	*msg = (struct nd_msg) {
627 		.icmph = {
628 			.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
629 		},
630 		.target = *solicit,
631 	};
632 
633 	if (inc_opt)
634 		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
635 				       dev->dev_addr,
636 				       NDISC_NEIGHBOUR_SOLICITATION);
637 	if (nonce != 0) {
638 		u8 *opt = skb_put(skb, 8);
639 
640 		opt[0] = ND_OPT_NONCE;
641 		opt[1] = 8 >> 3;
642 		memcpy(opt + 2, &nonce, 6);
643 	}
644 
645 	return skb;
646 }
647 EXPORT_SYMBOL(ndisc_ns_create);
648 
649 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
650 		   const struct in6_addr *daddr, const struct in6_addr *saddr,
651 		   u64 nonce)
652 {
653 	struct in6_addr addr_buf;
654 	struct sk_buff *skb;
655 
656 	if (!saddr) {
657 		if (ipv6_get_lladdr(dev, &addr_buf,
658 				    (IFA_F_TENTATIVE | IFA_F_OPTIMISTIC)))
659 			return;
660 		saddr = &addr_buf;
661 	}
662 
663 	skb = ndisc_ns_create(dev, solicit, saddr, nonce);
664 
665 	if (skb)
666 		ndisc_send_skb(skb, daddr, saddr);
667 }
668 
669 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
670 		   const struct in6_addr *daddr)
671 {
672 	struct sk_buff *skb;
673 	struct rs_msg *msg;
674 	int send_sllao = dev->addr_len;
675 	int optlen = 0;
676 
677 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
678 	/*
679 	 * According to section 2.2 of RFC 4429, we must not
680 	 * send router solicitations with a sllao from
681 	 * optimistic addresses, but we may send the solicitation
682 	 * if we don't include the sllao.  So here we check
683 	 * if our address is optimistic, and if so, we
684 	 * suppress the inclusion of the sllao.
685 	 */
686 	if (send_sllao) {
687 		struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
688 							   dev, 1);
689 		if (ifp) {
690 			if (ifp->flags & IFA_F_OPTIMISTIC)  {
691 				send_sllao = 0;
692 			}
693 			in6_ifa_put(ifp);
694 		} else {
695 			send_sllao = 0;
696 		}
697 	}
698 #endif
699 	if (send_sllao)
700 		optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
701 
702 	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
703 	if (!skb)
704 		return;
705 
706 	msg = skb_put(skb, sizeof(*msg));
707 	*msg = (struct rs_msg) {
708 		.icmph = {
709 			.icmp6_type = NDISC_ROUTER_SOLICITATION,
710 		},
711 	};
712 
713 	if (send_sllao)
714 		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
715 				       dev->dev_addr,
716 				       NDISC_ROUTER_SOLICITATION);
717 
718 	ndisc_send_skb(skb, daddr, saddr);
719 }
720 
721 
722 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
723 {
724 	/*
725 	 *	"The sender MUST return an ICMP
726 	 *	 destination unreachable"
727 	 */
728 	dst_link_failure(skb);
729 	kfree_skb(skb);
730 }
731 
732 /* Called with locked neigh: either read or both */
733 
734 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
735 {
736 	struct in6_addr *saddr = NULL;
737 	struct in6_addr mcaddr;
738 	struct net_device *dev = neigh->dev;
739 	struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
740 	int probes = atomic_read(&neigh->probes);
741 
742 	if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
743 					   dev, false, 1,
744 					   IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
745 		saddr = &ipv6_hdr(skb)->saddr;
746 	probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
747 	if (probes < 0) {
748 		if (!(READ_ONCE(neigh->nud_state) & NUD_VALID)) {
749 			ND_PRINTK(1, dbg,
750 				  "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
751 				  __func__, target);
752 		}
753 		ndisc_send_ns(dev, target, target, saddr, 0);
754 	} else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
755 		neigh_app_ns(neigh);
756 	} else {
757 		addrconf_addr_solict_mult(target, &mcaddr);
758 		ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
759 	}
760 }
761 
762 static int pndisc_is_router(const void *pkey,
763 			    struct net_device *dev)
764 {
765 	struct pneigh_entry *n;
766 	int ret = -1;
767 
768 	read_lock_bh(&nd_tbl.lock);
769 	n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
770 	if (n)
771 		ret = !!(n->flags & NTF_ROUTER);
772 	read_unlock_bh(&nd_tbl.lock);
773 
774 	return ret;
775 }
776 
777 void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
778 		  const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
779 		  struct ndisc_options *ndopts)
780 {
781 	neigh_update(neigh, lladdr, new, flags, 0);
782 	/* report ndisc ops about neighbour update */
783 	ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
784 }
785 
786 static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb)
787 {
788 	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
789 	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
790 	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
791 	u8 *lladdr = NULL;
792 	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
793 				    offsetof(struct nd_msg, opt));
794 	struct ndisc_options ndopts;
795 	struct net_device *dev = skb->dev;
796 	struct inet6_ifaddr *ifp;
797 	struct inet6_dev *idev = NULL;
798 	struct neighbour *neigh;
799 	int dad = ipv6_addr_any(saddr);
800 	int is_router = -1;
801 	SKB_DR(reason);
802 	u64 nonce = 0;
803 	bool inc;
804 
805 	if (skb->len < sizeof(struct nd_msg))
806 		return SKB_DROP_REASON_PKT_TOO_SMALL;
807 
808 	if (ipv6_addr_is_multicast(&msg->target)) {
809 		ND_PRINTK(2, warn, "NS: multicast target address\n");
810 		return reason;
811 	}
812 
813 	/*
814 	 * RFC2461 7.1.1:
815 	 * DAD has to be destined for solicited node multicast address.
816 	 */
817 	if (dad && !ipv6_addr_is_solict_mult(daddr)) {
818 		ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
819 		return reason;
820 	}
821 
822 	if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts))
823 		return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
824 
825 	if (ndopts.nd_opts_src_lladdr) {
826 		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
827 		if (!lladdr) {
828 			ND_PRINTK(2, warn,
829 				  "NS: invalid link-layer address length\n");
830 			return reason;
831 		}
832 
833 		/* RFC2461 7.1.1:
834 		 *	If the IP source address is the unspecified address,
835 		 *	there MUST NOT be source link-layer address option
836 		 *	in the message.
837 		 */
838 		if (dad) {
839 			ND_PRINTK(2, warn,
840 				  "NS: bad DAD packet (link-layer address option)\n");
841 			return reason;
842 		}
843 	}
844 	if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
845 		memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
846 
847 	inc = ipv6_addr_is_multicast(daddr);
848 
849 	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
850 	if (ifp) {
851 have_ifp:
852 		if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
853 			if (dad) {
854 				if (nonce != 0 && ifp->dad_nonce == nonce) {
855 					u8 *np = (u8 *)&nonce;
856 					/* Matching nonce if looped back */
857 					ND_PRINTK(2, notice,
858 						  "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
859 						  ifp->idev->dev->name,
860 						  &ifp->addr, np);
861 					goto out;
862 				}
863 				/*
864 				 * We are colliding with another node
865 				 * who is doing DAD
866 				 * so fail our DAD process
867 				 */
868 				addrconf_dad_failure(skb, ifp);
869 				return reason;
870 			} else {
871 				/*
872 				 * This is not a dad solicitation.
873 				 * If we are an optimistic node,
874 				 * we should respond.
875 				 * Otherwise, we should ignore it.
876 				 */
877 				if (!(ifp->flags & IFA_F_OPTIMISTIC))
878 					goto out;
879 			}
880 		}
881 
882 		idev = ifp->idev;
883 	} else {
884 		struct net *net = dev_net(dev);
885 
886 		/* perhaps an address on the master device */
887 		if (netif_is_l3_slave(dev)) {
888 			struct net_device *mdev;
889 
890 			mdev = netdev_master_upper_dev_get_rcu(dev);
891 			if (mdev) {
892 				ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
893 				if (ifp)
894 					goto have_ifp;
895 			}
896 		}
897 
898 		idev = in6_dev_get(dev);
899 		if (!idev) {
900 			/* XXX: count this drop? */
901 			return reason;
902 		}
903 
904 		if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
905 		    (idev->cnf.forwarding &&
906 		     (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
907 		     (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
908 			if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
909 			    skb->pkt_type != PACKET_HOST &&
910 			    inc &&
911 			    NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
912 				/*
913 				 * for anycast or proxy,
914 				 * sender should delay its response
915 				 * by a random time between 0 and
916 				 * MAX_ANYCAST_DELAY_TIME seconds.
917 				 * (RFC2461) -- yoshfuji
918 				 */
919 				struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
920 				if (n)
921 					pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
922 				goto out;
923 			}
924 		} else {
925 			SKB_DR_SET(reason, IPV6_NDISC_NS_OTHERHOST);
926 			goto out;
927 		}
928 	}
929 
930 	if (is_router < 0)
931 		is_router = idev->cnf.forwarding;
932 
933 	if (dad) {
934 		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
935 			      !!is_router, false, (ifp != NULL), true);
936 		goto out;
937 	}
938 
939 	if (inc)
940 		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
941 	else
942 		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
943 
944 	/*
945 	 *	update / create cache entry
946 	 *	for the source address
947 	 */
948 	neigh = __neigh_lookup(&nd_tbl, saddr, dev,
949 			       !inc || lladdr || !dev->addr_len);
950 	if (neigh)
951 		ndisc_update(dev, neigh, lladdr, NUD_STALE,
952 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
953 			     NEIGH_UPDATE_F_OVERRIDE,
954 			     NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
955 	if (neigh || !dev->header_ops) {
956 		ndisc_send_na(dev, saddr, &msg->target, !!is_router,
957 			      true, (ifp != NULL && inc), inc);
958 		if (neigh)
959 			neigh_release(neigh);
960 		reason = SKB_CONSUMED;
961 	}
962 
963 out:
964 	if (ifp)
965 		in6_ifa_put(ifp);
966 	else
967 		in6_dev_put(idev);
968 	return reason;
969 }
970 
971 static int accept_untracked_na(struct net_device *dev, struct in6_addr *saddr)
972 {
973 	struct inet6_dev *idev = __in6_dev_get(dev);
974 
975 	switch (idev->cnf.accept_untracked_na) {
976 	case 0: /* Don't accept untracked na (absent in neighbor cache) */
977 		return 0;
978 	case 1: /* Create new entries from na if currently untracked */
979 		return 1;
980 	case 2: /* Create new entries from untracked na only if saddr is in the
981 		 * same subnet as an address configured on the interface that
982 		 * received the na
983 		 */
984 		return !!ipv6_chk_prefix(saddr, dev);
985 	default:
986 		return 0;
987 	}
988 }
989 
990 static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb)
991 {
992 	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
993 	struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
994 	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
995 	u8 *lladdr = NULL;
996 	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
997 				    offsetof(struct nd_msg, opt));
998 	struct ndisc_options ndopts;
999 	struct net_device *dev = skb->dev;
1000 	struct inet6_dev *idev = __in6_dev_get(dev);
1001 	struct inet6_ifaddr *ifp;
1002 	struct neighbour *neigh;
1003 	SKB_DR(reason);
1004 	u8 new_state;
1005 
1006 	if (skb->len < sizeof(struct nd_msg))
1007 		return SKB_DROP_REASON_PKT_TOO_SMALL;
1008 
1009 	if (ipv6_addr_is_multicast(&msg->target)) {
1010 		ND_PRINTK(2, warn, "NA: target address is multicast\n");
1011 		return reason;
1012 	}
1013 
1014 	if (ipv6_addr_is_multicast(daddr) &&
1015 	    msg->icmph.icmp6_solicited) {
1016 		ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
1017 		return reason;
1018 	}
1019 
1020 	/* For some 802.11 wireless deployments (and possibly other networks),
1021 	 * there will be a NA proxy and unsolicitd packets are attacks
1022 	 * and thus should not be accepted.
1023 	 * drop_unsolicited_na takes precedence over accept_untracked_na
1024 	 */
1025 	if (!msg->icmph.icmp6_solicited && idev &&
1026 	    idev->cnf.drop_unsolicited_na)
1027 		return reason;
1028 
1029 	if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts))
1030 		return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1031 
1032 	if (ndopts.nd_opts_tgt_lladdr) {
1033 		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
1034 		if (!lladdr) {
1035 			ND_PRINTK(2, warn,
1036 				  "NA: invalid link-layer address length\n");
1037 			return reason;
1038 		}
1039 	}
1040 	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
1041 	if (ifp) {
1042 		if (skb->pkt_type != PACKET_LOOPBACK
1043 		    && (ifp->flags & IFA_F_TENTATIVE)) {
1044 				addrconf_dad_failure(skb, ifp);
1045 				return reason;
1046 		}
1047 		/* What should we make now? The advertisement
1048 		   is invalid, but ndisc specs say nothing
1049 		   about it. It could be misconfiguration, or
1050 		   an smart proxy agent tries to help us :-)
1051 
1052 		   We should not print the error if NA has been
1053 		   received from loopback - it is just our own
1054 		   unsolicited advertisement.
1055 		 */
1056 		if (skb->pkt_type != PACKET_LOOPBACK)
1057 			ND_PRINTK(1, warn,
1058 				  "NA: %pM advertised our address %pI6c on %s!\n",
1059 				  eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1060 		in6_ifa_put(ifp);
1061 		return reason;
1062 	}
1063 
1064 	neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1065 
1066 	/* RFC 9131 updates original Neighbour Discovery RFC 4861.
1067 	 * NAs with Target LL Address option without a corresponding
1068 	 * entry in the neighbour cache can now create a STALE neighbour
1069 	 * cache entry on routers.
1070 	 *
1071 	 *   entry accept  fwding  solicited        behaviour
1072 	 * ------- ------  ------  ---------    ----------------------
1073 	 * present      X       X         0     Set state to STALE
1074 	 * present      X       X         1     Set state to REACHABLE
1075 	 *  absent      0       X         X     Do nothing
1076 	 *  absent      1       0         X     Do nothing
1077 	 *  absent      1       1         X     Add a new STALE entry
1078 	 *
1079 	 * Note that we don't do a (daddr == all-routers-mcast) check.
1080 	 */
1081 	new_state = msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE;
1082 	if (!neigh && lladdr && idev && idev->cnf.forwarding) {
1083 		if (accept_untracked_na(dev, saddr)) {
1084 			neigh = neigh_create(&nd_tbl, &msg->target, dev);
1085 			new_state = NUD_STALE;
1086 		}
1087 	}
1088 
1089 	if (neigh && !IS_ERR(neigh)) {
1090 		u8 old_flags = neigh->flags;
1091 		struct net *net = dev_net(dev);
1092 
1093 		if (READ_ONCE(neigh->nud_state) & NUD_FAILED)
1094 			goto out;
1095 
1096 		/*
1097 		 * Don't update the neighbor cache entry on a proxy NA from
1098 		 * ourselves because either the proxied node is off link or it
1099 		 * has already sent a NA to us.
1100 		 */
1101 		if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1102 		    net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1103 		    pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1104 			/* XXX: idev->cnf.proxy_ndp */
1105 			goto out;
1106 		}
1107 
1108 		ndisc_update(dev, neigh, lladdr,
1109 			     new_state,
1110 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1111 			     (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1112 			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1113 			     (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1114 			     NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1115 
1116 		if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1117 			/*
1118 			 * Change: router to host
1119 			 */
1120 			rt6_clean_tohost(dev_net(dev),  saddr);
1121 		}
1122 		reason = SKB_CONSUMED;
1123 out:
1124 		neigh_release(neigh);
1125 	}
1126 	return reason;
1127 }
1128 
1129 static enum skb_drop_reason ndisc_recv_rs(struct sk_buff *skb)
1130 {
1131 	struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1132 	unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1133 	struct neighbour *neigh;
1134 	struct inet6_dev *idev;
1135 	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1136 	struct ndisc_options ndopts;
1137 	u8 *lladdr = NULL;
1138 	SKB_DR(reason);
1139 
1140 	if (skb->len < sizeof(*rs_msg))
1141 		return SKB_DROP_REASON_PKT_TOO_SMALL;
1142 
1143 	idev = __in6_dev_get(skb->dev);
1144 	if (!idev) {
1145 		ND_PRINTK(1, err, "RS: can't find in6 device\n");
1146 		return reason;
1147 	}
1148 
1149 	/* Don't accept RS if we're not in router mode */
1150 	if (!idev->cnf.forwarding)
1151 		goto out;
1152 
1153 	/*
1154 	 * Don't update NCE if src = ::;
1155 	 * this implies that the source node has no ip address assigned yet.
1156 	 */
1157 	if (ipv6_addr_any(saddr))
1158 		goto out;
1159 
1160 	/* Parse ND options */
1161 	if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts))
1162 		return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1163 
1164 	if (ndopts.nd_opts_src_lladdr) {
1165 		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1166 					     skb->dev);
1167 		if (!lladdr)
1168 			goto out;
1169 	}
1170 
1171 	neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1172 	if (neigh) {
1173 		ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1174 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1175 			     NEIGH_UPDATE_F_OVERRIDE|
1176 			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1177 			     NDISC_ROUTER_SOLICITATION, &ndopts);
1178 		neigh_release(neigh);
1179 		reason = SKB_CONSUMED;
1180 	}
1181 out:
1182 	return reason;
1183 }
1184 
1185 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1186 {
1187 	struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1188 	struct sk_buff *skb;
1189 	struct nlmsghdr *nlh;
1190 	struct nduseroptmsg *ndmsg;
1191 	struct net *net = dev_net(ra->dev);
1192 	int err;
1193 	int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1194 				    + (opt->nd_opt_len << 3));
1195 	size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1196 
1197 	skb = nlmsg_new(msg_size, GFP_ATOMIC);
1198 	if (!skb) {
1199 		err = -ENOBUFS;
1200 		goto errout;
1201 	}
1202 
1203 	nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1204 	if (!nlh) {
1205 		goto nla_put_failure;
1206 	}
1207 
1208 	ndmsg = nlmsg_data(nlh);
1209 	ndmsg->nduseropt_family = AF_INET6;
1210 	ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1211 	ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1212 	ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1213 	ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1214 
1215 	memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1216 
1217 	if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1218 		goto nla_put_failure;
1219 	nlmsg_end(skb, nlh);
1220 
1221 	rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1222 	return;
1223 
1224 nla_put_failure:
1225 	nlmsg_free(skb);
1226 	err = -EMSGSIZE;
1227 errout:
1228 	rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1229 }
1230 
1231 static enum skb_drop_reason ndisc_router_discovery(struct sk_buff *skb)
1232 {
1233 	struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1234 	bool send_ifinfo_notify = false;
1235 	struct neighbour *neigh = NULL;
1236 	struct ndisc_options ndopts;
1237 	struct fib6_info *rt = NULL;
1238 	struct inet6_dev *in6_dev;
1239 	u32 defrtr_usr_metric;
1240 	unsigned int pref = 0;
1241 	__u32 old_if_flags;
1242 	struct net *net;
1243 	SKB_DR(reason);
1244 	int lifetime;
1245 	int optlen;
1246 
1247 	__u8 *opt = (__u8 *)(ra_msg + 1);
1248 
1249 	optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1250 		sizeof(struct ra_msg);
1251 
1252 	ND_PRINTK(2, info,
1253 		  "RA: %s, dev: %s\n",
1254 		  __func__, skb->dev->name);
1255 	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1256 		ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1257 		return reason;
1258 	}
1259 	if (optlen < 0)
1260 		return SKB_DROP_REASON_PKT_TOO_SMALL;
1261 
1262 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1263 	if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1264 		ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1265 		return reason;
1266 	}
1267 #endif
1268 
1269 	/*
1270 	 *	set the RA_RECV flag in the interface
1271 	 */
1272 
1273 	in6_dev = __in6_dev_get(skb->dev);
1274 	if (!in6_dev) {
1275 		ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1276 			  skb->dev->name);
1277 		return reason;
1278 	}
1279 
1280 	if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts))
1281 		return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1282 
1283 	if (!ipv6_accept_ra(in6_dev)) {
1284 		ND_PRINTK(2, info,
1285 			  "RA: %s, did not accept ra for dev: %s\n",
1286 			  __func__, skb->dev->name);
1287 		goto skip_linkparms;
1288 	}
1289 
1290 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1291 	/* skip link-specific parameters from interior routers */
1292 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1293 		ND_PRINTK(2, info,
1294 			  "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1295 			  __func__, skb->dev->name);
1296 		goto skip_linkparms;
1297 	}
1298 #endif
1299 
1300 	if (in6_dev->if_flags & IF_RS_SENT) {
1301 		/*
1302 		 *	flag that an RA was received after an RS was sent
1303 		 *	out on this interface.
1304 		 */
1305 		in6_dev->if_flags |= IF_RA_RCVD;
1306 	}
1307 
1308 	/*
1309 	 * Remember the managed/otherconf flags from most recently
1310 	 * received RA message (RFC 2462) -- yoshfuji
1311 	 */
1312 	old_if_flags = in6_dev->if_flags;
1313 	in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1314 				IF_RA_OTHERCONF)) |
1315 				(ra_msg->icmph.icmp6_addrconf_managed ?
1316 					IF_RA_MANAGED : 0) |
1317 				(ra_msg->icmph.icmp6_addrconf_other ?
1318 					IF_RA_OTHERCONF : 0);
1319 
1320 	if (old_if_flags != in6_dev->if_flags)
1321 		send_ifinfo_notify = true;
1322 
1323 	if (!in6_dev->cnf.accept_ra_defrtr) {
1324 		ND_PRINTK(2, info,
1325 			  "RA: %s, defrtr is false for dev: %s\n",
1326 			  __func__, skb->dev->name);
1327 		goto skip_defrtr;
1328 	}
1329 
1330 	/* Do not accept RA with source-addr found on local machine unless
1331 	 * accept_ra_from_local is set to true.
1332 	 */
1333 	net = dev_net(in6_dev->dev);
1334 	if (!in6_dev->cnf.accept_ra_from_local &&
1335 	    ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) {
1336 		ND_PRINTK(2, info,
1337 			  "RA from local address detected on dev: %s: default router ignored\n",
1338 			  skb->dev->name);
1339 		goto skip_defrtr;
1340 	}
1341 
1342 	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1343 
1344 #ifdef CONFIG_IPV6_ROUTER_PREF
1345 	pref = ra_msg->icmph.icmp6_router_pref;
1346 	/* 10b is handled as if it were 00b (medium) */
1347 	if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1348 	    !in6_dev->cnf.accept_ra_rtr_pref)
1349 		pref = ICMPV6_ROUTER_PREF_MEDIUM;
1350 #endif
1351 	/* routes added from RAs do not use nexthop objects */
1352 	rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev);
1353 	if (rt) {
1354 		neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1355 					 rt->fib6_nh->fib_nh_dev, NULL,
1356 					  &ipv6_hdr(skb)->saddr);
1357 		if (!neigh) {
1358 			ND_PRINTK(0, err,
1359 				  "RA: %s got default router without neighbour\n",
1360 				  __func__);
1361 			fib6_info_release(rt);
1362 			return reason;
1363 		}
1364 	}
1365 	/* Set default route metric as specified by user */
1366 	defrtr_usr_metric = in6_dev->cnf.ra_defrtr_metric;
1367 	/* delete the route if lifetime is 0 or if metric needs change */
1368 	if (rt && (lifetime == 0 || rt->fib6_metric != defrtr_usr_metric)) {
1369 		ip6_del_rt(net, rt, false);
1370 		rt = NULL;
1371 	}
1372 
1373 	ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, metric: %d, for dev: %s\n",
1374 		  rt, lifetime, defrtr_usr_metric, skb->dev->name);
1375 	if (!rt && lifetime) {
1376 		ND_PRINTK(3, info, "RA: adding default router\n");
1377 
1378 		if (neigh)
1379 			neigh_release(neigh);
1380 
1381 		rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
1382 					 skb->dev, pref, defrtr_usr_metric);
1383 		if (!rt) {
1384 			ND_PRINTK(0, err,
1385 				  "RA: %s failed to add default route\n",
1386 				  __func__);
1387 			return reason;
1388 		}
1389 
1390 		neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1391 					 rt->fib6_nh->fib_nh_dev, NULL,
1392 					  &ipv6_hdr(skb)->saddr);
1393 		if (!neigh) {
1394 			ND_PRINTK(0, err,
1395 				  "RA: %s got default router without neighbour\n",
1396 				  __func__);
1397 			fib6_info_release(rt);
1398 			return reason;
1399 		}
1400 		neigh->flags |= NTF_ROUTER;
1401 	} else if (rt && IPV6_EXTRACT_PREF(rt->fib6_flags) != pref) {
1402 		struct nl_info nlinfo = {
1403 			.nl_net = net,
1404 		};
1405 		rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1406 		inet6_rt_notify(RTM_NEWROUTE, rt, &nlinfo, NLM_F_REPLACE);
1407 	}
1408 
1409 	if (rt)
1410 		fib6_set_expires(rt, jiffies + (HZ * lifetime));
1411 	if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1412 	    ra_msg->icmph.icmp6_hop_limit) {
1413 		if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1414 			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1415 			fib6_metric_set(rt, RTAX_HOPLIMIT,
1416 					ra_msg->icmph.icmp6_hop_limit);
1417 		} else {
1418 			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1419 		}
1420 	}
1421 
1422 skip_defrtr:
1423 
1424 	/*
1425 	 *	Update Reachable Time and Retrans Timer
1426 	 */
1427 
1428 	if (in6_dev->nd_parms) {
1429 		unsigned long rtime = ntohl(ra_msg->retrans_timer);
1430 
1431 		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1432 			rtime = (rtime*HZ)/1000;
1433 			if (rtime < HZ/100)
1434 				rtime = HZ/100;
1435 			NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1436 			in6_dev->tstamp = jiffies;
1437 			send_ifinfo_notify = true;
1438 		}
1439 
1440 		rtime = ntohl(ra_msg->reachable_time);
1441 		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1442 			rtime = (rtime*HZ)/1000;
1443 
1444 			if (rtime < HZ/10)
1445 				rtime = HZ/10;
1446 
1447 			if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1448 				NEIGH_VAR_SET(in6_dev->nd_parms,
1449 					      BASE_REACHABLE_TIME, rtime);
1450 				NEIGH_VAR_SET(in6_dev->nd_parms,
1451 					      GC_STALETIME, 3 * rtime);
1452 				in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1453 				in6_dev->tstamp = jiffies;
1454 				send_ifinfo_notify = true;
1455 			}
1456 		}
1457 	}
1458 
1459 skip_linkparms:
1460 
1461 	/*
1462 	 *	Process options.
1463 	 */
1464 
1465 	if (!neigh)
1466 		neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1467 				       skb->dev, 1);
1468 	if (neigh) {
1469 		u8 *lladdr = NULL;
1470 		if (ndopts.nd_opts_src_lladdr) {
1471 			lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1472 						     skb->dev);
1473 			if (!lladdr) {
1474 				ND_PRINTK(2, warn,
1475 					  "RA: invalid link-layer address length\n");
1476 				goto out;
1477 			}
1478 		}
1479 		ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1480 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1481 			     NEIGH_UPDATE_F_OVERRIDE|
1482 			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1483 			     NEIGH_UPDATE_F_ISROUTER,
1484 			     NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1485 		reason = SKB_CONSUMED;
1486 	}
1487 
1488 	if (!ipv6_accept_ra(in6_dev)) {
1489 		ND_PRINTK(2, info,
1490 			  "RA: %s, accept_ra is false for dev: %s\n",
1491 			  __func__, skb->dev->name);
1492 		goto out;
1493 	}
1494 
1495 #ifdef CONFIG_IPV6_ROUTE_INFO
1496 	if (!in6_dev->cnf.accept_ra_from_local &&
1497 	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1498 			  in6_dev->dev, 0)) {
1499 		ND_PRINTK(2, info,
1500 			  "RA from local address detected on dev: %s: router info ignored.\n",
1501 			  skb->dev->name);
1502 		goto skip_routeinfo;
1503 	}
1504 
1505 	if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1506 		struct nd_opt_hdr *p;
1507 		for (p = ndopts.nd_opts_ri;
1508 		     p;
1509 		     p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1510 			struct route_info *ri = (struct route_info *)p;
1511 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1512 			if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1513 			    ri->prefix_len == 0)
1514 				continue;
1515 #endif
1516 			if (ri->prefix_len == 0 &&
1517 			    !in6_dev->cnf.accept_ra_defrtr)
1518 				continue;
1519 			if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1520 				continue;
1521 			if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1522 				continue;
1523 			rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1524 				      &ipv6_hdr(skb)->saddr);
1525 		}
1526 	}
1527 
1528 skip_routeinfo:
1529 #endif
1530 
1531 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1532 	/* skip link-specific ndopts from interior routers */
1533 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1534 		ND_PRINTK(2, info,
1535 			  "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1536 			  __func__, skb->dev->name);
1537 		goto out;
1538 	}
1539 #endif
1540 
1541 	if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1542 		struct nd_opt_hdr *p;
1543 		for (p = ndopts.nd_opts_pi;
1544 		     p;
1545 		     p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1546 			addrconf_prefix_rcv(skb->dev, (u8 *)p,
1547 					    (p->nd_opt_len) << 3,
1548 					    ndopts.nd_opts_src_lladdr != NULL);
1549 		}
1550 	}
1551 
1552 	if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1553 		__be32 n;
1554 		u32 mtu;
1555 
1556 		memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1557 		mtu = ntohl(n);
1558 
1559 		if (in6_dev->ra_mtu != mtu) {
1560 			in6_dev->ra_mtu = mtu;
1561 			send_ifinfo_notify = true;
1562 		}
1563 
1564 		if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1565 			ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1566 		} else if (in6_dev->cnf.mtu6 != mtu) {
1567 			in6_dev->cnf.mtu6 = mtu;
1568 			fib6_metric_set(rt, RTAX_MTU, mtu);
1569 			rt6_mtu_change(skb->dev, mtu);
1570 		}
1571 	}
1572 
1573 	if (ndopts.nd_useropts) {
1574 		struct nd_opt_hdr *p;
1575 		for (p = ndopts.nd_useropts;
1576 		     p;
1577 		     p = ndisc_next_useropt(skb->dev, p,
1578 					    ndopts.nd_useropts_end)) {
1579 			ndisc_ra_useropt(skb, p);
1580 		}
1581 	}
1582 
1583 	if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1584 		ND_PRINTK(2, warn, "RA: invalid RA options\n");
1585 	}
1586 out:
1587 	/* Send a notify if RA changed managed/otherconf flags or
1588 	 * timer settings or ra_mtu value
1589 	 */
1590 	if (send_ifinfo_notify)
1591 		inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1592 
1593 	fib6_info_release(rt);
1594 	if (neigh)
1595 		neigh_release(neigh);
1596 	return reason;
1597 }
1598 
1599 static enum skb_drop_reason ndisc_redirect_rcv(struct sk_buff *skb)
1600 {
1601 	struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1602 	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1603 				    offsetof(struct rd_msg, opt));
1604 	struct ndisc_options ndopts;
1605 	SKB_DR(reason);
1606 	u8 *hdr;
1607 
1608 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1609 	switch (skb->ndisc_nodetype) {
1610 	case NDISC_NODETYPE_HOST:
1611 	case NDISC_NODETYPE_NODEFAULT:
1612 		ND_PRINTK(2, warn,
1613 			  "Redirect: from host or unauthorized router\n");
1614 		return reason;
1615 	}
1616 #endif
1617 
1618 	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1619 		ND_PRINTK(2, warn,
1620 			  "Redirect: source address is not link-local\n");
1621 		return reason;
1622 	}
1623 
1624 	if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1625 		return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1626 
1627 	if (!ndopts.nd_opts_rh) {
1628 		ip6_redirect_no_header(skb, dev_net(skb->dev),
1629 					skb->dev->ifindex);
1630 		return reason;
1631 	}
1632 
1633 	hdr = (u8 *)ndopts.nd_opts_rh;
1634 	hdr += 8;
1635 	if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1636 		return SKB_DROP_REASON_PKT_TOO_SMALL;
1637 
1638 	return icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1639 }
1640 
1641 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1642 					   struct sk_buff *orig_skb,
1643 					   int rd_len)
1644 {
1645 	u8 *opt = skb_put(skb, rd_len);
1646 
1647 	memset(opt, 0, 8);
1648 	*(opt++) = ND_OPT_REDIRECT_HDR;
1649 	*(opt++) = (rd_len >> 3);
1650 	opt += 6;
1651 
1652 	skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1653 		      rd_len - 8);
1654 }
1655 
1656 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1657 {
1658 	struct net_device *dev = skb->dev;
1659 	struct net *net = dev_net(dev);
1660 	struct sock *sk = net->ipv6.ndisc_sk;
1661 	int optlen = 0;
1662 	struct inet_peer *peer;
1663 	struct sk_buff *buff;
1664 	struct rd_msg *msg;
1665 	struct in6_addr saddr_buf;
1666 	struct rt6_info *rt;
1667 	struct dst_entry *dst;
1668 	struct flowi6 fl6;
1669 	int rd_len;
1670 	u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1671 	   ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1672 	bool ret;
1673 
1674 	if (netif_is_l3_master(skb->dev)) {
1675 		dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
1676 		if (!dev)
1677 			return;
1678 	}
1679 
1680 	if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1681 		ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1682 			  dev->name);
1683 		return;
1684 	}
1685 
1686 	if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1687 	    ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1688 		ND_PRINTK(2, warn,
1689 			  "Redirect: target address is not link-local unicast\n");
1690 		return;
1691 	}
1692 
1693 	icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1694 			 &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1695 
1696 	dst = ip6_route_output(net, NULL, &fl6);
1697 	if (dst->error) {
1698 		dst_release(dst);
1699 		return;
1700 	}
1701 	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1702 	if (IS_ERR(dst))
1703 		return;
1704 
1705 	rt = (struct rt6_info *) dst;
1706 
1707 	if (rt->rt6i_flags & RTF_GATEWAY) {
1708 		ND_PRINTK(2, warn,
1709 			  "Redirect: destination is not a neighbour\n");
1710 		goto release;
1711 	}
1712 	peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1713 	ret = inet_peer_xrlim_allow(peer, 1*HZ);
1714 	if (peer)
1715 		inet_putpeer(peer);
1716 	if (!ret)
1717 		goto release;
1718 
1719 	if (dev->addr_len) {
1720 		struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1721 		if (!neigh) {
1722 			ND_PRINTK(2, warn,
1723 				  "Redirect: no neigh for target address\n");
1724 			goto release;
1725 		}
1726 
1727 		read_lock_bh(&neigh->lock);
1728 		if (neigh->nud_state & NUD_VALID) {
1729 			memcpy(ha_buf, neigh->ha, dev->addr_len);
1730 			read_unlock_bh(&neigh->lock);
1731 			ha = ha_buf;
1732 			optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1733 								ops_data_buf,
1734 								&ops_data);
1735 		} else
1736 			read_unlock_bh(&neigh->lock);
1737 
1738 		neigh_release(neigh);
1739 	}
1740 
1741 	rd_len = min_t(unsigned int,
1742 		       IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1743 		       skb->len + 8);
1744 	rd_len &= ~0x7;
1745 	optlen += rd_len;
1746 
1747 	buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1748 	if (!buff)
1749 		goto release;
1750 
1751 	msg = skb_put(buff, sizeof(*msg));
1752 	*msg = (struct rd_msg) {
1753 		.icmph = {
1754 			.icmp6_type = NDISC_REDIRECT,
1755 		},
1756 		.target = *target,
1757 		.dest = ipv6_hdr(skb)->daddr,
1758 	};
1759 
1760 	/*
1761 	 *	include target_address option
1762 	 */
1763 
1764 	if (ha)
1765 		ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1766 
1767 	/*
1768 	 *	build redirect option and copy skb over to the new packet.
1769 	 */
1770 
1771 	if (rd_len)
1772 		ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1773 
1774 	skb_dst_set(buff, dst);
1775 	ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1776 	return;
1777 
1778 release:
1779 	dst_release(dst);
1780 }
1781 
1782 static void pndisc_redo(struct sk_buff *skb)
1783 {
1784 	enum skb_drop_reason reason = ndisc_recv_ns(skb);
1785 
1786 	kfree_skb_reason(skb, reason);
1787 }
1788 
1789 static int ndisc_is_multicast(const void *pkey)
1790 {
1791 	return ipv6_addr_is_multicast((struct in6_addr *)pkey);
1792 }
1793 
1794 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1795 {
1796 	struct inet6_dev *idev = __in6_dev_get(skb->dev);
1797 
1798 	if (!idev)
1799 		return true;
1800 	if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1801 	    idev->cnf.suppress_frag_ndisc) {
1802 		net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1803 		return true;
1804 	}
1805 	return false;
1806 }
1807 
1808 enum skb_drop_reason ndisc_rcv(struct sk_buff *skb)
1809 {
1810 	struct nd_msg *msg;
1811 	SKB_DR(reason);
1812 
1813 	if (ndisc_suppress_frag_ndisc(skb))
1814 		return SKB_DROP_REASON_IPV6_NDISC_FRAG;
1815 
1816 	if (skb_linearize(skb))
1817 		return SKB_DROP_REASON_NOMEM;
1818 
1819 	msg = (struct nd_msg *)skb_transport_header(skb);
1820 
1821 	__skb_push(skb, skb->data - skb_transport_header(skb));
1822 
1823 	if (ipv6_hdr(skb)->hop_limit != 255) {
1824 		ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1825 			  ipv6_hdr(skb)->hop_limit);
1826 		return SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT;
1827 	}
1828 
1829 	if (msg->icmph.icmp6_code != 0) {
1830 		ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1831 			  msg->icmph.icmp6_code);
1832 		return SKB_DROP_REASON_IPV6_NDISC_BAD_CODE;
1833 	}
1834 
1835 	switch (msg->icmph.icmp6_type) {
1836 	case NDISC_NEIGHBOUR_SOLICITATION:
1837 		memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1838 		reason = ndisc_recv_ns(skb);
1839 		break;
1840 
1841 	case NDISC_NEIGHBOUR_ADVERTISEMENT:
1842 		reason = ndisc_recv_na(skb);
1843 		break;
1844 
1845 	case NDISC_ROUTER_SOLICITATION:
1846 		reason = ndisc_recv_rs(skb);
1847 		break;
1848 
1849 	case NDISC_ROUTER_ADVERTISEMENT:
1850 		reason = ndisc_router_discovery(skb);
1851 		break;
1852 
1853 	case NDISC_REDIRECT:
1854 		reason = ndisc_redirect_rcv(skb);
1855 		break;
1856 	}
1857 
1858 	return reason;
1859 }
1860 
1861 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1862 {
1863 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1864 	struct netdev_notifier_change_info *change_info;
1865 	struct net *net = dev_net(dev);
1866 	struct inet6_dev *idev;
1867 	bool evict_nocarrier;
1868 
1869 	switch (event) {
1870 	case NETDEV_CHANGEADDR:
1871 		neigh_changeaddr(&nd_tbl, dev);
1872 		fib6_run_gc(0, net, false);
1873 		fallthrough;
1874 	case NETDEV_UP:
1875 		idev = in6_dev_get(dev);
1876 		if (!idev)
1877 			break;
1878 		if (idev->cnf.ndisc_notify ||
1879 		    net->ipv6.devconf_all->ndisc_notify)
1880 			ndisc_send_unsol_na(dev);
1881 		in6_dev_put(idev);
1882 		break;
1883 	case NETDEV_CHANGE:
1884 		idev = in6_dev_get(dev);
1885 		if (!idev)
1886 			evict_nocarrier = true;
1887 		else {
1888 			evict_nocarrier = idev->cnf.ndisc_evict_nocarrier &&
1889 					  net->ipv6.devconf_all->ndisc_evict_nocarrier;
1890 			in6_dev_put(idev);
1891 		}
1892 
1893 		change_info = ptr;
1894 		if (change_info->flags_changed & IFF_NOARP)
1895 			neigh_changeaddr(&nd_tbl, dev);
1896 		if (evict_nocarrier && !netif_carrier_ok(dev))
1897 			neigh_carrier_down(&nd_tbl, dev);
1898 		break;
1899 	case NETDEV_DOWN:
1900 		neigh_ifdown(&nd_tbl, dev);
1901 		fib6_run_gc(0, net, false);
1902 		break;
1903 	case NETDEV_NOTIFY_PEERS:
1904 		ndisc_send_unsol_na(dev);
1905 		break;
1906 	default:
1907 		break;
1908 	}
1909 
1910 	return NOTIFY_DONE;
1911 }
1912 
1913 static struct notifier_block ndisc_netdev_notifier = {
1914 	.notifier_call = ndisc_netdev_event,
1915 	.priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1916 };
1917 
1918 #ifdef CONFIG_SYSCTL
1919 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1920 					 const char *func, const char *dev_name)
1921 {
1922 	static char warncomm[TASK_COMM_LEN];
1923 	static int warned;
1924 	if (strcmp(warncomm, current->comm) && warned < 5) {
1925 		strcpy(warncomm, current->comm);
1926 		pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1927 			warncomm, func,
1928 			dev_name, ctl->procname,
1929 			dev_name, ctl->procname);
1930 		warned++;
1931 	}
1932 }
1933 
1934 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void *buffer,
1935 		size_t *lenp, loff_t *ppos)
1936 {
1937 	struct net_device *dev = ctl->extra1;
1938 	struct inet6_dev *idev;
1939 	int ret;
1940 
1941 	if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1942 	    (strcmp(ctl->procname, "base_reachable_time") == 0))
1943 		ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1944 
1945 	if (strcmp(ctl->procname, "retrans_time") == 0)
1946 		ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1947 
1948 	else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1949 		ret = neigh_proc_dointvec_jiffies(ctl, write,
1950 						  buffer, lenp, ppos);
1951 
1952 	else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1953 		 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1954 		ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1955 						     buffer, lenp, ppos);
1956 	else
1957 		ret = -1;
1958 
1959 	if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1960 		if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1961 			idev->nd_parms->reachable_time =
1962 					neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1963 		idev->tstamp = jiffies;
1964 		inet6_ifinfo_notify(RTM_NEWLINK, idev);
1965 		in6_dev_put(idev);
1966 	}
1967 	return ret;
1968 }
1969 
1970 
1971 #endif
1972 
1973 static int __net_init ndisc_net_init(struct net *net)
1974 {
1975 	struct ipv6_pinfo *np;
1976 	struct sock *sk;
1977 	int err;
1978 
1979 	err = inet_ctl_sock_create(&sk, PF_INET6,
1980 				   SOCK_RAW, IPPROTO_ICMPV6, net);
1981 	if (err < 0) {
1982 		ND_PRINTK(0, err,
1983 			  "NDISC: Failed to initialize the control socket (err %d)\n",
1984 			  err);
1985 		return err;
1986 	}
1987 
1988 	net->ipv6.ndisc_sk = sk;
1989 
1990 	np = inet6_sk(sk);
1991 	np->hop_limit = 255;
1992 	/* Do not loopback ndisc messages */
1993 	np->mc_loop = 0;
1994 
1995 	return 0;
1996 }
1997 
1998 static void __net_exit ndisc_net_exit(struct net *net)
1999 {
2000 	inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
2001 }
2002 
2003 static struct pernet_operations ndisc_net_ops = {
2004 	.init = ndisc_net_init,
2005 	.exit = ndisc_net_exit,
2006 };
2007 
2008 int __init ndisc_init(void)
2009 {
2010 	int err;
2011 
2012 	err = register_pernet_subsys(&ndisc_net_ops);
2013 	if (err)
2014 		return err;
2015 	/*
2016 	 * Initialize the neighbour table
2017 	 */
2018 	neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
2019 
2020 #ifdef CONFIG_SYSCTL
2021 	err = neigh_sysctl_register(NULL, &nd_tbl.parms,
2022 				    ndisc_ifinfo_sysctl_change);
2023 	if (err)
2024 		goto out_unregister_pernet;
2025 out:
2026 #endif
2027 	return err;
2028 
2029 #ifdef CONFIG_SYSCTL
2030 out_unregister_pernet:
2031 	unregister_pernet_subsys(&ndisc_net_ops);
2032 	goto out;
2033 #endif
2034 }
2035 
2036 int __init ndisc_late_init(void)
2037 {
2038 	return register_netdevice_notifier(&ndisc_netdev_notifier);
2039 }
2040 
2041 void ndisc_late_cleanup(void)
2042 {
2043 	unregister_netdevice_notifier(&ndisc_netdev_notifier);
2044 }
2045 
2046 void ndisc_cleanup(void)
2047 {
2048 #ifdef CONFIG_SYSCTL
2049 	neigh_sysctl_unregister(&nd_tbl.parms);
2050 #endif
2051 	neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
2052 	unregister_pernet_subsys(&ndisc_net_ops);
2053 }
2054