xref: /openbmc/linux/net/ipv6/ndisc.c (revision 78beef62)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *	Neighbour Discovery for IPv6
4  *	Linux INET6 implementation
5  *
6  *	Authors:
7  *	Pedro Roque		<roque@di.fc.ul.pt>
8  *	Mike Shaver		<shaver@ingenia.com>
9  */
10 
11 /*
12  *	Changes:
13  *
14  *	Alexey I. Froloff		:	RFC6106 (DNSSL) support
15  *	Pierre Ynard			:	export userland ND options
16  *						through netlink (RDNSS support)
17  *	Lars Fenneberg			:	fixed MTU setting on receipt
18  *						of an RA.
19  *	Janos Farkas			:	kmalloc failure checks
20  *	Alexey Kuznetsov		:	state machine reworked
21  *						and moved to net/core.
22  *	Pekka Savola			:	RFC2461 validation
23  *	YOSHIFUJI Hideaki @USAGI	:	Verify ND options properly
24  */
25 
26 #define pr_fmt(fmt) "ICMPv6: " fmt
27 
28 #include <linux/module.h>
29 #include <linux/errno.h>
30 #include <linux/types.h>
31 #include <linux/socket.h>
32 #include <linux/sockios.h>
33 #include <linux/sched.h>
34 #include <linux/net.h>
35 #include <linux/in6.h>
36 #include <linux/route.h>
37 #include <linux/init.h>
38 #include <linux/rcupdate.h>
39 #include <linux/slab.h>
40 #ifdef CONFIG_SYSCTL
41 #include <linux/sysctl.h>
42 #endif
43 
44 #include <linux/if_addr.h>
45 #include <linux/if_ether.h>
46 #include <linux/if_arp.h>
47 #include <linux/ipv6.h>
48 #include <linux/icmpv6.h>
49 #include <linux/jhash.h>
50 
51 #include <net/sock.h>
52 #include <net/snmp.h>
53 
54 #include <net/ipv6.h>
55 #include <net/protocol.h>
56 #include <net/ndisc.h>
57 #include <net/ip6_route.h>
58 #include <net/addrconf.h>
59 #include <net/icmp.h>
60 
61 #include <net/netlink.h>
62 #include <linux/rtnetlink.h>
63 
64 #include <net/flow.h>
65 #include <net/ip6_checksum.h>
66 #include <net/inet_common.h>
67 #include <linux/proc_fs.h>
68 
69 #include <linux/netfilter.h>
70 #include <linux/netfilter_ipv6.h>
71 
72 static u32 ndisc_hash(const void *pkey,
73 		      const struct net_device *dev,
74 		      __u32 *hash_rnd);
75 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
76 static bool ndisc_allow_add(const struct net_device *dev,
77 			    struct netlink_ext_ack *extack);
78 static int ndisc_constructor(struct neighbour *neigh);
79 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
80 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
81 static int pndisc_constructor(struct pneigh_entry *n);
82 static void pndisc_destructor(struct pneigh_entry *n);
83 static void pndisc_redo(struct sk_buff *skb);
84 
85 static const struct neigh_ops ndisc_generic_ops = {
86 	.family =		AF_INET6,
87 	.solicit =		ndisc_solicit,
88 	.error_report =		ndisc_error_report,
89 	.output =		neigh_resolve_output,
90 	.connected_output =	neigh_connected_output,
91 };
92 
93 static const struct neigh_ops ndisc_hh_ops = {
94 	.family =		AF_INET6,
95 	.solicit =		ndisc_solicit,
96 	.error_report =		ndisc_error_report,
97 	.output =		neigh_resolve_output,
98 	.connected_output =	neigh_resolve_output,
99 };
100 
101 
102 static const struct neigh_ops ndisc_direct_ops = {
103 	.family =		AF_INET6,
104 	.output =		neigh_direct_output,
105 	.connected_output =	neigh_direct_output,
106 };
107 
108 struct neigh_table nd_tbl = {
109 	.family =	AF_INET6,
110 	.key_len =	sizeof(struct in6_addr),
111 	.protocol =	cpu_to_be16(ETH_P_IPV6),
112 	.hash =		ndisc_hash,
113 	.key_eq =	ndisc_key_eq,
114 	.constructor =	ndisc_constructor,
115 	.pconstructor =	pndisc_constructor,
116 	.pdestructor =	pndisc_destructor,
117 	.proxy_redo =	pndisc_redo,
118 	.allow_add  =   ndisc_allow_add,
119 	.id =		"ndisc_cache",
120 	.parms = {
121 		.tbl			= &nd_tbl,
122 		.reachable_time		= ND_REACHABLE_TIME,
123 		.data = {
124 			[NEIGH_VAR_MCAST_PROBES] = 3,
125 			[NEIGH_VAR_UCAST_PROBES] = 3,
126 			[NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
127 			[NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
128 			[NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
129 			[NEIGH_VAR_GC_STALETIME] = 60 * HZ,
130 			[NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
131 			[NEIGH_VAR_PROXY_QLEN] = 64,
132 			[NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
133 			[NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
134 		},
135 	},
136 	.gc_interval =	  30 * HZ,
137 	.gc_thresh1 =	 128,
138 	.gc_thresh2 =	 512,
139 	.gc_thresh3 =	1024,
140 };
141 EXPORT_SYMBOL_GPL(nd_tbl);
142 
143 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data,
144 			      int data_len, int pad)
145 {
146 	int space = __ndisc_opt_addr_space(data_len, pad);
147 	u8 *opt = skb_put(skb, space);
148 
149 	opt[0] = type;
150 	opt[1] = space>>3;
151 
152 	memset(opt + 2, 0, pad);
153 	opt   += pad;
154 	space -= pad;
155 
156 	memcpy(opt+2, data, data_len);
157 	data_len += 2;
158 	opt += data_len;
159 	space -= data_len;
160 	if (space > 0)
161 		memset(opt, 0, space);
162 }
163 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
164 
165 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
166 					  void *data, u8 icmp6_type)
167 {
168 	__ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
169 				 ndisc_addr_option_pad(skb->dev->type));
170 	ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
171 }
172 
173 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
174 						   void *ha,
175 						   const u8 *ops_data)
176 {
177 	ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
178 	ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
179 }
180 
181 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
182 					    struct nd_opt_hdr *end)
183 {
184 	int type;
185 	if (!cur || !end || cur >= end)
186 		return NULL;
187 	type = cur->nd_opt_type;
188 	do {
189 		cur = ((void *)cur) + (cur->nd_opt_len << 3);
190 	} while (cur < end && cur->nd_opt_type != type);
191 	return cur <= end && cur->nd_opt_type == type ? cur : NULL;
192 }
193 
194 static inline int ndisc_is_useropt(const struct net_device *dev,
195 				   struct nd_opt_hdr *opt)
196 {
197 	return opt->nd_opt_type == ND_OPT_RDNSS ||
198 		opt->nd_opt_type == ND_OPT_DNSSL ||
199 		opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
200 		ndisc_ops_is_useropt(dev, opt->nd_opt_type);
201 }
202 
203 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
204 					     struct nd_opt_hdr *cur,
205 					     struct nd_opt_hdr *end)
206 {
207 	if (!cur || !end || cur >= end)
208 		return NULL;
209 	do {
210 		cur = ((void *)cur) + (cur->nd_opt_len << 3);
211 	} while (cur < end && !ndisc_is_useropt(dev, cur));
212 	return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
213 }
214 
215 struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
216 					  u8 *opt, int opt_len,
217 					  struct ndisc_options *ndopts)
218 {
219 	struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
220 
221 	if (!nd_opt || opt_len < 0 || !ndopts)
222 		return NULL;
223 	memset(ndopts, 0, sizeof(*ndopts));
224 	while (opt_len) {
225 		int l;
226 		if (opt_len < sizeof(struct nd_opt_hdr))
227 			return NULL;
228 		l = nd_opt->nd_opt_len << 3;
229 		if (opt_len < l || l == 0)
230 			return NULL;
231 		if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
232 			goto next_opt;
233 		switch (nd_opt->nd_opt_type) {
234 		case ND_OPT_SOURCE_LL_ADDR:
235 		case ND_OPT_TARGET_LL_ADDR:
236 		case ND_OPT_MTU:
237 		case ND_OPT_NONCE:
238 		case ND_OPT_REDIRECT_HDR:
239 			if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
240 				ND_PRINTK(2, warn,
241 					  "%s: duplicated ND6 option found: type=%d\n",
242 					  __func__, nd_opt->nd_opt_type);
243 			} else {
244 				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
245 			}
246 			break;
247 		case ND_OPT_PREFIX_INFO:
248 			ndopts->nd_opts_pi_end = nd_opt;
249 			if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
250 				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
251 			break;
252 #ifdef CONFIG_IPV6_ROUTE_INFO
253 		case ND_OPT_ROUTE_INFO:
254 			ndopts->nd_opts_ri_end = nd_opt;
255 			if (!ndopts->nd_opts_ri)
256 				ndopts->nd_opts_ri = nd_opt;
257 			break;
258 #endif
259 		default:
260 			if (ndisc_is_useropt(dev, nd_opt)) {
261 				ndopts->nd_useropts_end = nd_opt;
262 				if (!ndopts->nd_useropts)
263 					ndopts->nd_useropts = nd_opt;
264 			} else {
265 				/*
266 				 * Unknown options must be silently ignored,
267 				 * to accommodate future extension to the
268 				 * protocol.
269 				 */
270 				ND_PRINTK(2, notice,
271 					  "%s: ignored unsupported option; type=%d, len=%d\n",
272 					  __func__,
273 					  nd_opt->nd_opt_type,
274 					  nd_opt->nd_opt_len);
275 			}
276 		}
277 next_opt:
278 		opt_len -= l;
279 		nd_opt = ((void *)nd_opt) + l;
280 	}
281 	return ndopts;
282 }
283 
284 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
285 {
286 	switch (dev->type) {
287 	case ARPHRD_ETHER:
288 	case ARPHRD_IEEE802:	/* Not sure. Check it later. --ANK */
289 	case ARPHRD_FDDI:
290 		ipv6_eth_mc_map(addr, buf);
291 		return 0;
292 	case ARPHRD_ARCNET:
293 		ipv6_arcnet_mc_map(addr, buf);
294 		return 0;
295 	case ARPHRD_INFINIBAND:
296 		ipv6_ib_mc_map(addr, dev->broadcast, buf);
297 		return 0;
298 	case ARPHRD_IPGRE:
299 		return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
300 	default:
301 		if (dir) {
302 			memcpy(buf, dev->broadcast, dev->addr_len);
303 			return 0;
304 		}
305 	}
306 	return -EINVAL;
307 }
308 EXPORT_SYMBOL(ndisc_mc_map);
309 
310 static u32 ndisc_hash(const void *pkey,
311 		      const struct net_device *dev,
312 		      __u32 *hash_rnd)
313 {
314 	return ndisc_hashfn(pkey, dev, hash_rnd);
315 }
316 
317 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
318 {
319 	return neigh_key_eq128(n, pkey);
320 }
321 
322 static int ndisc_constructor(struct neighbour *neigh)
323 {
324 	struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
325 	struct net_device *dev = neigh->dev;
326 	struct inet6_dev *in6_dev;
327 	struct neigh_parms *parms;
328 	bool is_multicast = ipv6_addr_is_multicast(addr);
329 
330 	in6_dev = in6_dev_get(dev);
331 	if (!in6_dev) {
332 		return -EINVAL;
333 	}
334 
335 	parms = in6_dev->nd_parms;
336 	__neigh_parms_put(neigh->parms);
337 	neigh->parms = neigh_parms_clone(parms);
338 
339 	neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
340 	if (!dev->header_ops) {
341 		neigh->nud_state = NUD_NOARP;
342 		neigh->ops = &ndisc_direct_ops;
343 		neigh->output = neigh_direct_output;
344 	} else {
345 		if (is_multicast) {
346 			neigh->nud_state = NUD_NOARP;
347 			ndisc_mc_map(addr, neigh->ha, dev, 1);
348 		} else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
349 			neigh->nud_state = NUD_NOARP;
350 			memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
351 			if (dev->flags&IFF_LOOPBACK)
352 				neigh->type = RTN_LOCAL;
353 		} else if (dev->flags&IFF_POINTOPOINT) {
354 			neigh->nud_state = NUD_NOARP;
355 			memcpy(neigh->ha, dev->broadcast, dev->addr_len);
356 		}
357 		if (dev->header_ops->cache)
358 			neigh->ops = &ndisc_hh_ops;
359 		else
360 			neigh->ops = &ndisc_generic_ops;
361 		if (neigh->nud_state&NUD_VALID)
362 			neigh->output = neigh->ops->connected_output;
363 		else
364 			neigh->output = neigh->ops->output;
365 	}
366 	in6_dev_put(in6_dev);
367 	return 0;
368 }
369 
370 static int pndisc_constructor(struct pneigh_entry *n)
371 {
372 	struct in6_addr *addr = (struct in6_addr *)&n->key;
373 	struct in6_addr maddr;
374 	struct net_device *dev = n->dev;
375 
376 	if (!dev || !__in6_dev_get(dev))
377 		return -EINVAL;
378 	addrconf_addr_solict_mult(addr, &maddr);
379 	ipv6_dev_mc_inc(dev, &maddr);
380 	return 0;
381 }
382 
383 static void pndisc_destructor(struct pneigh_entry *n)
384 {
385 	struct in6_addr *addr = (struct in6_addr *)&n->key;
386 	struct in6_addr maddr;
387 	struct net_device *dev = n->dev;
388 
389 	if (!dev || !__in6_dev_get(dev))
390 		return;
391 	addrconf_addr_solict_mult(addr, &maddr);
392 	ipv6_dev_mc_dec(dev, &maddr);
393 }
394 
395 /* called with rtnl held */
396 static bool ndisc_allow_add(const struct net_device *dev,
397 			    struct netlink_ext_ack *extack)
398 {
399 	struct inet6_dev *idev = __in6_dev_get(dev);
400 
401 	if (!idev || idev->cnf.disable_ipv6) {
402 		NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device");
403 		return false;
404 	}
405 
406 	return true;
407 }
408 
409 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
410 				       int len)
411 {
412 	int hlen = LL_RESERVED_SPACE(dev);
413 	int tlen = dev->needed_tailroom;
414 	struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
415 	struct sk_buff *skb;
416 
417 	skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
418 	if (!skb) {
419 		ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
420 			  __func__);
421 		return NULL;
422 	}
423 
424 	skb->protocol = htons(ETH_P_IPV6);
425 	skb->dev = dev;
426 
427 	skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
428 	skb_reset_transport_header(skb);
429 
430 	/* Manually assign socket ownership as we avoid calling
431 	 * sock_alloc_send_pskb() to bypass wmem buffer limits
432 	 */
433 	skb_set_owner_w(skb, sk);
434 
435 	return skb;
436 }
437 
438 static void ip6_nd_hdr(struct sk_buff *skb,
439 		       const struct in6_addr *saddr,
440 		       const struct in6_addr *daddr,
441 		       int hop_limit, int len)
442 {
443 	struct ipv6hdr *hdr;
444 	struct inet6_dev *idev;
445 	unsigned tclass;
446 
447 	rcu_read_lock();
448 	idev = __in6_dev_get(skb->dev);
449 	tclass = idev ? idev->cnf.ndisc_tclass : 0;
450 	rcu_read_unlock();
451 
452 	skb_push(skb, sizeof(*hdr));
453 	skb_reset_network_header(skb);
454 	hdr = ipv6_hdr(skb);
455 
456 	ip6_flow_hdr(hdr, tclass, 0);
457 
458 	hdr->payload_len = htons(len);
459 	hdr->nexthdr = IPPROTO_ICMPV6;
460 	hdr->hop_limit = hop_limit;
461 
462 	hdr->saddr = *saddr;
463 	hdr->daddr = *daddr;
464 }
465 
466 static void ndisc_send_skb(struct sk_buff *skb,
467 			   const struct in6_addr *daddr,
468 			   const struct in6_addr *saddr)
469 {
470 	struct dst_entry *dst = skb_dst(skb);
471 	struct net *net = dev_net(skb->dev);
472 	struct sock *sk = net->ipv6.ndisc_sk;
473 	struct inet6_dev *idev;
474 	int err;
475 	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
476 	u8 type;
477 
478 	type = icmp6h->icmp6_type;
479 
480 	if (!dst) {
481 		struct flowi6 fl6;
482 		int oif = skb->dev->ifindex;
483 
484 		icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
485 		dst = icmp6_dst_alloc(skb->dev, &fl6);
486 		if (IS_ERR(dst)) {
487 			kfree_skb(skb);
488 			return;
489 		}
490 
491 		skb_dst_set(skb, dst);
492 	}
493 
494 	icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
495 					      IPPROTO_ICMPV6,
496 					      csum_partial(icmp6h,
497 							   skb->len, 0));
498 
499 	ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
500 
501 	rcu_read_lock();
502 	idev = __in6_dev_get(dst->dev);
503 	IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
504 
505 	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
506 		      net, sk, skb, NULL, dst->dev,
507 		      dst_output);
508 	if (!err) {
509 		ICMP6MSGOUT_INC_STATS(net, idev, type);
510 		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
511 	}
512 
513 	rcu_read_unlock();
514 }
515 
516 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
517 		   const struct in6_addr *solicited_addr,
518 		   bool router, bool solicited, bool override, bool inc_opt)
519 {
520 	struct sk_buff *skb;
521 	struct in6_addr tmpaddr;
522 	struct inet6_ifaddr *ifp;
523 	const struct in6_addr *src_addr;
524 	struct nd_msg *msg;
525 	int optlen = 0;
526 
527 	/* for anycast or proxy, solicited_addr != src_addr */
528 	ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
529 	if (ifp) {
530 		src_addr = solicited_addr;
531 		if (ifp->flags & IFA_F_OPTIMISTIC)
532 			override = false;
533 		inc_opt |= ifp->idev->cnf.force_tllao;
534 		in6_ifa_put(ifp);
535 	} else {
536 		if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
537 				       inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
538 				       &tmpaddr))
539 			return;
540 		src_addr = &tmpaddr;
541 	}
542 
543 	if (!dev->addr_len)
544 		inc_opt = false;
545 	if (inc_opt)
546 		optlen += ndisc_opt_addr_space(dev,
547 					       NDISC_NEIGHBOUR_ADVERTISEMENT);
548 
549 	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
550 	if (!skb)
551 		return;
552 
553 	msg = skb_put(skb, sizeof(*msg));
554 	*msg = (struct nd_msg) {
555 		.icmph = {
556 			.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
557 			.icmp6_router = router,
558 			.icmp6_solicited = solicited,
559 			.icmp6_override = override,
560 		},
561 		.target = *solicited_addr,
562 	};
563 
564 	if (inc_opt)
565 		ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
566 				       dev->dev_addr,
567 				       NDISC_NEIGHBOUR_ADVERTISEMENT);
568 
569 	ndisc_send_skb(skb, daddr, src_addr);
570 }
571 
572 static void ndisc_send_unsol_na(struct net_device *dev)
573 {
574 	struct inet6_dev *idev;
575 	struct inet6_ifaddr *ifa;
576 
577 	idev = in6_dev_get(dev);
578 	if (!idev)
579 		return;
580 
581 	read_lock_bh(&idev->lock);
582 	list_for_each_entry(ifa, &idev->addr_list, if_list) {
583 		/* skip tentative addresses until dad completes */
584 		if (ifa->flags & IFA_F_TENTATIVE &&
585 		    !(ifa->flags & IFA_F_OPTIMISTIC))
586 			continue;
587 
588 		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
589 			      /*router=*/ !!idev->cnf.forwarding,
590 			      /*solicited=*/ false, /*override=*/ true,
591 			      /*inc_opt=*/ true);
592 	}
593 	read_unlock_bh(&idev->lock);
594 
595 	in6_dev_put(idev);
596 }
597 
598 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
599 		   const struct in6_addr *daddr, const struct in6_addr *saddr,
600 		   u64 nonce)
601 {
602 	struct sk_buff *skb;
603 	struct in6_addr addr_buf;
604 	int inc_opt = dev->addr_len;
605 	int optlen = 0;
606 	struct nd_msg *msg;
607 
608 	if (!saddr) {
609 		if (ipv6_get_lladdr(dev, &addr_buf,
610 				   (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
611 			return;
612 		saddr = &addr_buf;
613 	}
614 
615 	if (ipv6_addr_any(saddr))
616 		inc_opt = false;
617 	if (inc_opt)
618 		optlen += ndisc_opt_addr_space(dev,
619 					       NDISC_NEIGHBOUR_SOLICITATION);
620 	if (nonce != 0)
621 		optlen += 8;
622 
623 	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
624 	if (!skb)
625 		return;
626 
627 	msg = skb_put(skb, sizeof(*msg));
628 	*msg = (struct nd_msg) {
629 		.icmph = {
630 			.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
631 		},
632 		.target = *solicit,
633 	};
634 
635 	if (inc_opt)
636 		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
637 				       dev->dev_addr,
638 				       NDISC_NEIGHBOUR_SOLICITATION);
639 	if (nonce != 0) {
640 		u8 *opt = skb_put(skb, 8);
641 
642 		opt[0] = ND_OPT_NONCE;
643 		opt[1] = 8 >> 3;
644 		memcpy(opt + 2, &nonce, 6);
645 	}
646 
647 	ndisc_send_skb(skb, daddr, saddr);
648 }
649 
650 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
651 		   const struct in6_addr *daddr)
652 {
653 	struct sk_buff *skb;
654 	struct rs_msg *msg;
655 	int send_sllao = dev->addr_len;
656 	int optlen = 0;
657 
658 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
659 	/*
660 	 * According to section 2.2 of RFC 4429, we must not
661 	 * send router solicitations with a sllao from
662 	 * optimistic addresses, but we may send the solicitation
663 	 * if we don't include the sllao.  So here we check
664 	 * if our address is optimistic, and if so, we
665 	 * suppress the inclusion of the sllao.
666 	 */
667 	if (send_sllao) {
668 		struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
669 							   dev, 1);
670 		if (ifp) {
671 			if (ifp->flags & IFA_F_OPTIMISTIC)  {
672 				send_sllao = 0;
673 			}
674 			in6_ifa_put(ifp);
675 		} else {
676 			send_sllao = 0;
677 		}
678 	}
679 #endif
680 	if (send_sllao)
681 		optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
682 
683 	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
684 	if (!skb)
685 		return;
686 
687 	msg = skb_put(skb, sizeof(*msg));
688 	*msg = (struct rs_msg) {
689 		.icmph = {
690 			.icmp6_type = NDISC_ROUTER_SOLICITATION,
691 		},
692 	};
693 
694 	if (send_sllao)
695 		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
696 				       dev->dev_addr,
697 				       NDISC_ROUTER_SOLICITATION);
698 
699 	ndisc_send_skb(skb, daddr, saddr);
700 }
701 
702 
703 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
704 {
705 	/*
706 	 *	"The sender MUST return an ICMP
707 	 *	 destination unreachable"
708 	 */
709 	dst_link_failure(skb);
710 	kfree_skb(skb);
711 }
712 
713 /* Called with locked neigh: either read or both */
714 
715 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
716 {
717 	struct in6_addr *saddr = NULL;
718 	struct in6_addr mcaddr;
719 	struct net_device *dev = neigh->dev;
720 	struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
721 	int probes = atomic_read(&neigh->probes);
722 
723 	if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
724 					   dev, false, 1,
725 					   IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
726 		saddr = &ipv6_hdr(skb)->saddr;
727 	probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
728 	if (probes < 0) {
729 		if (!(neigh->nud_state & NUD_VALID)) {
730 			ND_PRINTK(1, dbg,
731 				  "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
732 				  __func__, target);
733 		}
734 		ndisc_send_ns(dev, target, target, saddr, 0);
735 	} else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
736 		neigh_app_ns(neigh);
737 	} else {
738 		addrconf_addr_solict_mult(target, &mcaddr);
739 		ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
740 	}
741 }
742 
743 static int pndisc_is_router(const void *pkey,
744 			    struct net_device *dev)
745 {
746 	struct pneigh_entry *n;
747 	int ret = -1;
748 
749 	read_lock_bh(&nd_tbl.lock);
750 	n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
751 	if (n)
752 		ret = !!(n->flags & NTF_ROUTER);
753 	read_unlock_bh(&nd_tbl.lock);
754 
755 	return ret;
756 }
757 
758 void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
759 		  const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
760 		  struct ndisc_options *ndopts)
761 {
762 	neigh_update(neigh, lladdr, new, flags, 0);
763 	/* report ndisc ops about neighbour update */
764 	ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
765 }
766 
767 static void ndisc_recv_ns(struct sk_buff *skb)
768 {
769 	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
770 	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
771 	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
772 	u8 *lladdr = NULL;
773 	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
774 				    offsetof(struct nd_msg, opt));
775 	struct ndisc_options ndopts;
776 	struct net_device *dev = skb->dev;
777 	struct inet6_ifaddr *ifp;
778 	struct inet6_dev *idev = NULL;
779 	struct neighbour *neigh;
780 	int dad = ipv6_addr_any(saddr);
781 	bool inc;
782 	int is_router = -1;
783 	u64 nonce = 0;
784 
785 	if (skb->len < sizeof(struct nd_msg)) {
786 		ND_PRINTK(2, warn, "NS: packet too short\n");
787 		return;
788 	}
789 
790 	if (ipv6_addr_is_multicast(&msg->target)) {
791 		ND_PRINTK(2, warn, "NS: multicast target address\n");
792 		return;
793 	}
794 
795 	/*
796 	 * RFC2461 7.1.1:
797 	 * DAD has to be destined for solicited node multicast address.
798 	 */
799 	if (dad && !ipv6_addr_is_solict_mult(daddr)) {
800 		ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
801 		return;
802 	}
803 
804 	if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
805 		ND_PRINTK(2, warn, "NS: invalid ND options\n");
806 		return;
807 	}
808 
809 	if (ndopts.nd_opts_src_lladdr) {
810 		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
811 		if (!lladdr) {
812 			ND_PRINTK(2, warn,
813 				  "NS: invalid link-layer address length\n");
814 			return;
815 		}
816 
817 		/* RFC2461 7.1.1:
818 		 *	If the IP source address is the unspecified address,
819 		 *	there MUST NOT be source link-layer address option
820 		 *	in the message.
821 		 */
822 		if (dad) {
823 			ND_PRINTK(2, warn,
824 				  "NS: bad DAD packet (link-layer address option)\n");
825 			return;
826 		}
827 	}
828 	if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
829 		memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
830 
831 	inc = ipv6_addr_is_multicast(daddr);
832 
833 	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
834 	if (ifp) {
835 have_ifp:
836 		if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
837 			if (dad) {
838 				if (nonce != 0 && ifp->dad_nonce == nonce) {
839 					u8 *np = (u8 *)&nonce;
840 					/* Matching nonce if looped back */
841 					ND_PRINTK(2, notice,
842 						  "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
843 						  ifp->idev->dev->name,
844 						  &ifp->addr, np);
845 					goto out;
846 				}
847 				/*
848 				 * We are colliding with another node
849 				 * who is doing DAD
850 				 * so fail our DAD process
851 				 */
852 				addrconf_dad_failure(skb, ifp);
853 				return;
854 			} else {
855 				/*
856 				 * This is not a dad solicitation.
857 				 * If we are an optimistic node,
858 				 * we should respond.
859 				 * Otherwise, we should ignore it.
860 				 */
861 				if (!(ifp->flags & IFA_F_OPTIMISTIC))
862 					goto out;
863 			}
864 		}
865 
866 		idev = ifp->idev;
867 	} else {
868 		struct net *net = dev_net(dev);
869 
870 		/* perhaps an address on the master device */
871 		if (netif_is_l3_slave(dev)) {
872 			struct net_device *mdev;
873 
874 			mdev = netdev_master_upper_dev_get_rcu(dev);
875 			if (mdev) {
876 				ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
877 				if (ifp)
878 					goto have_ifp;
879 			}
880 		}
881 
882 		idev = in6_dev_get(dev);
883 		if (!idev) {
884 			/* XXX: count this drop? */
885 			return;
886 		}
887 
888 		if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
889 		    (idev->cnf.forwarding &&
890 		     (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
891 		     (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
892 			if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
893 			    skb->pkt_type != PACKET_HOST &&
894 			    inc &&
895 			    NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
896 				/*
897 				 * for anycast or proxy,
898 				 * sender should delay its response
899 				 * by a random time between 0 and
900 				 * MAX_ANYCAST_DELAY_TIME seconds.
901 				 * (RFC2461) -- yoshfuji
902 				 */
903 				struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
904 				if (n)
905 					pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
906 				goto out;
907 			}
908 		} else
909 			goto out;
910 	}
911 
912 	if (is_router < 0)
913 		is_router = idev->cnf.forwarding;
914 
915 	if (dad) {
916 		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
917 			      !!is_router, false, (ifp != NULL), true);
918 		goto out;
919 	}
920 
921 	if (inc)
922 		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
923 	else
924 		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
925 
926 	/*
927 	 *	update / create cache entry
928 	 *	for the source address
929 	 */
930 	neigh = __neigh_lookup(&nd_tbl, saddr, dev,
931 			       !inc || lladdr || !dev->addr_len);
932 	if (neigh)
933 		ndisc_update(dev, neigh, lladdr, NUD_STALE,
934 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
935 			     NEIGH_UPDATE_F_OVERRIDE,
936 			     NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
937 	if (neigh || !dev->header_ops) {
938 		ndisc_send_na(dev, saddr, &msg->target, !!is_router,
939 			      true, (ifp != NULL && inc), inc);
940 		if (neigh)
941 			neigh_release(neigh);
942 	}
943 
944 out:
945 	if (ifp)
946 		in6_ifa_put(ifp);
947 	else
948 		in6_dev_put(idev);
949 }
950 
951 static void ndisc_recv_na(struct sk_buff *skb)
952 {
953 	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
954 	struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
955 	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
956 	u8 *lladdr = NULL;
957 	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
958 				    offsetof(struct nd_msg, opt));
959 	struct ndisc_options ndopts;
960 	struct net_device *dev = skb->dev;
961 	struct inet6_dev *idev = __in6_dev_get(dev);
962 	struct inet6_ifaddr *ifp;
963 	struct neighbour *neigh;
964 
965 	if (skb->len < sizeof(struct nd_msg)) {
966 		ND_PRINTK(2, warn, "NA: packet too short\n");
967 		return;
968 	}
969 
970 	if (ipv6_addr_is_multicast(&msg->target)) {
971 		ND_PRINTK(2, warn, "NA: target address is multicast\n");
972 		return;
973 	}
974 
975 	if (ipv6_addr_is_multicast(daddr) &&
976 	    msg->icmph.icmp6_solicited) {
977 		ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
978 		return;
979 	}
980 
981 	/* For some 802.11 wireless deployments (and possibly other networks),
982 	 * there will be a NA proxy and unsolicitd packets are attacks
983 	 * and thus should not be accepted.
984 	 */
985 	if (!msg->icmph.icmp6_solicited && idev &&
986 	    idev->cnf.drop_unsolicited_na)
987 		return;
988 
989 	if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
990 		ND_PRINTK(2, warn, "NS: invalid ND option\n");
991 		return;
992 	}
993 	if (ndopts.nd_opts_tgt_lladdr) {
994 		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
995 		if (!lladdr) {
996 			ND_PRINTK(2, warn,
997 				  "NA: invalid link-layer address length\n");
998 			return;
999 		}
1000 	}
1001 	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
1002 	if (ifp) {
1003 		if (skb->pkt_type != PACKET_LOOPBACK
1004 		    && (ifp->flags & IFA_F_TENTATIVE)) {
1005 				addrconf_dad_failure(skb, ifp);
1006 				return;
1007 		}
1008 		/* What should we make now? The advertisement
1009 		   is invalid, but ndisc specs say nothing
1010 		   about it. It could be misconfiguration, or
1011 		   an smart proxy agent tries to help us :-)
1012 
1013 		   We should not print the error if NA has been
1014 		   received from loopback - it is just our own
1015 		   unsolicited advertisement.
1016 		 */
1017 		if (skb->pkt_type != PACKET_LOOPBACK)
1018 			ND_PRINTK(1, warn,
1019 				  "NA: %pM advertised our address %pI6c on %s!\n",
1020 				  eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1021 		in6_ifa_put(ifp);
1022 		return;
1023 	}
1024 	neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1025 
1026 	if (neigh) {
1027 		u8 old_flags = neigh->flags;
1028 		struct net *net = dev_net(dev);
1029 
1030 		if (neigh->nud_state & NUD_FAILED)
1031 			goto out;
1032 
1033 		/*
1034 		 * Don't update the neighbor cache entry on a proxy NA from
1035 		 * ourselves because either the proxied node is off link or it
1036 		 * has already sent a NA to us.
1037 		 */
1038 		if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1039 		    net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1040 		    pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1041 			/* XXX: idev->cnf.proxy_ndp */
1042 			goto out;
1043 		}
1044 
1045 		ndisc_update(dev, neigh, lladdr,
1046 			     msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
1047 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1048 			     (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1049 			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1050 			     (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1051 			     NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1052 
1053 		if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1054 			/*
1055 			 * Change: router to host
1056 			 */
1057 			rt6_clean_tohost(dev_net(dev),  saddr);
1058 		}
1059 
1060 out:
1061 		neigh_release(neigh);
1062 	}
1063 }
1064 
1065 static void ndisc_recv_rs(struct sk_buff *skb)
1066 {
1067 	struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1068 	unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1069 	struct neighbour *neigh;
1070 	struct inet6_dev *idev;
1071 	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1072 	struct ndisc_options ndopts;
1073 	u8 *lladdr = NULL;
1074 
1075 	if (skb->len < sizeof(*rs_msg))
1076 		return;
1077 
1078 	idev = __in6_dev_get(skb->dev);
1079 	if (!idev) {
1080 		ND_PRINTK(1, err, "RS: can't find in6 device\n");
1081 		return;
1082 	}
1083 
1084 	/* Don't accept RS if we're not in router mode */
1085 	if (!idev->cnf.forwarding)
1086 		goto out;
1087 
1088 	/*
1089 	 * Don't update NCE if src = ::;
1090 	 * this implies that the source node has no ip address assigned yet.
1091 	 */
1092 	if (ipv6_addr_any(saddr))
1093 		goto out;
1094 
1095 	/* Parse ND options */
1096 	if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts)) {
1097 		ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
1098 		goto out;
1099 	}
1100 
1101 	if (ndopts.nd_opts_src_lladdr) {
1102 		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1103 					     skb->dev);
1104 		if (!lladdr)
1105 			goto out;
1106 	}
1107 
1108 	neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1109 	if (neigh) {
1110 		ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1111 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1112 			     NEIGH_UPDATE_F_OVERRIDE|
1113 			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1114 			     NDISC_ROUTER_SOLICITATION, &ndopts);
1115 		neigh_release(neigh);
1116 	}
1117 out:
1118 	return;
1119 }
1120 
1121 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1122 {
1123 	struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1124 	struct sk_buff *skb;
1125 	struct nlmsghdr *nlh;
1126 	struct nduseroptmsg *ndmsg;
1127 	struct net *net = dev_net(ra->dev);
1128 	int err;
1129 	int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1130 				    + (opt->nd_opt_len << 3));
1131 	size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1132 
1133 	skb = nlmsg_new(msg_size, GFP_ATOMIC);
1134 	if (!skb) {
1135 		err = -ENOBUFS;
1136 		goto errout;
1137 	}
1138 
1139 	nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1140 	if (!nlh) {
1141 		goto nla_put_failure;
1142 	}
1143 
1144 	ndmsg = nlmsg_data(nlh);
1145 	ndmsg->nduseropt_family = AF_INET6;
1146 	ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1147 	ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1148 	ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1149 	ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1150 
1151 	memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1152 
1153 	if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1154 		goto nla_put_failure;
1155 	nlmsg_end(skb, nlh);
1156 
1157 	rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1158 	return;
1159 
1160 nla_put_failure:
1161 	nlmsg_free(skb);
1162 	err = -EMSGSIZE;
1163 errout:
1164 	rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1165 }
1166 
1167 static void ndisc_router_discovery(struct sk_buff *skb)
1168 {
1169 	struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1170 	struct neighbour *neigh = NULL;
1171 	struct inet6_dev *in6_dev;
1172 	struct fib6_info *rt = NULL;
1173 	struct net *net;
1174 	int lifetime;
1175 	struct ndisc_options ndopts;
1176 	int optlen;
1177 	unsigned int pref = 0;
1178 	__u32 old_if_flags;
1179 	bool send_ifinfo_notify = false;
1180 
1181 	__u8 *opt = (__u8 *)(ra_msg + 1);
1182 
1183 	optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1184 		sizeof(struct ra_msg);
1185 
1186 	ND_PRINTK(2, info,
1187 		  "RA: %s, dev: %s\n",
1188 		  __func__, skb->dev->name);
1189 	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1190 		ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1191 		return;
1192 	}
1193 	if (optlen < 0) {
1194 		ND_PRINTK(2, warn, "RA: packet too short\n");
1195 		return;
1196 	}
1197 
1198 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1199 	if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1200 		ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1201 		return;
1202 	}
1203 #endif
1204 
1205 	/*
1206 	 *	set the RA_RECV flag in the interface
1207 	 */
1208 
1209 	in6_dev = __in6_dev_get(skb->dev);
1210 	if (!in6_dev) {
1211 		ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1212 			  skb->dev->name);
1213 		return;
1214 	}
1215 
1216 	if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts)) {
1217 		ND_PRINTK(2, warn, "RA: invalid ND options\n");
1218 		return;
1219 	}
1220 
1221 	if (!ipv6_accept_ra(in6_dev)) {
1222 		ND_PRINTK(2, info,
1223 			  "RA: %s, did not accept ra for dev: %s\n",
1224 			  __func__, skb->dev->name);
1225 		goto skip_linkparms;
1226 	}
1227 
1228 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1229 	/* skip link-specific parameters from interior routers */
1230 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1231 		ND_PRINTK(2, info,
1232 			  "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1233 			  __func__, skb->dev->name);
1234 		goto skip_linkparms;
1235 	}
1236 #endif
1237 
1238 	if (in6_dev->if_flags & IF_RS_SENT) {
1239 		/*
1240 		 *	flag that an RA was received after an RS was sent
1241 		 *	out on this interface.
1242 		 */
1243 		in6_dev->if_flags |= IF_RA_RCVD;
1244 	}
1245 
1246 	/*
1247 	 * Remember the managed/otherconf flags from most recently
1248 	 * received RA message (RFC 2462) -- yoshfuji
1249 	 */
1250 	old_if_flags = in6_dev->if_flags;
1251 	in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1252 				IF_RA_OTHERCONF)) |
1253 				(ra_msg->icmph.icmp6_addrconf_managed ?
1254 					IF_RA_MANAGED : 0) |
1255 				(ra_msg->icmph.icmp6_addrconf_other ?
1256 					IF_RA_OTHERCONF : 0);
1257 
1258 	if (old_if_flags != in6_dev->if_flags)
1259 		send_ifinfo_notify = true;
1260 
1261 	if (!in6_dev->cnf.accept_ra_defrtr) {
1262 		ND_PRINTK(2, info,
1263 			  "RA: %s, defrtr is false for dev: %s\n",
1264 			  __func__, skb->dev->name);
1265 		goto skip_defrtr;
1266 	}
1267 
1268 	/* Do not accept RA with source-addr found on local machine unless
1269 	 * accept_ra_from_local is set to true.
1270 	 */
1271 	net = dev_net(in6_dev->dev);
1272 	if (!in6_dev->cnf.accept_ra_from_local &&
1273 	    ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) {
1274 		ND_PRINTK(2, info,
1275 			  "RA from local address detected on dev: %s: default router ignored\n",
1276 			  skb->dev->name);
1277 		goto skip_defrtr;
1278 	}
1279 
1280 	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1281 
1282 #ifdef CONFIG_IPV6_ROUTER_PREF
1283 	pref = ra_msg->icmph.icmp6_router_pref;
1284 	/* 10b is handled as if it were 00b (medium) */
1285 	if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1286 	    !in6_dev->cnf.accept_ra_rtr_pref)
1287 		pref = ICMPV6_ROUTER_PREF_MEDIUM;
1288 #endif
1289 	/* routes added from RAs do not use nexthop objects */
1290 	rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev);
1291 	if (rt) {
1292 		neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1293 					 rt->fib6_nh->fib_nh_dev, NULL,
1294 					  &ipv6_hdr(skb)->saddr);
1295 		if (!neigh) {
1296 			ND_PRINTK(0, err,
1297 				  "RA: %s got default router without neighbour\n",
1298 				  __func__);
1299 			fib6_info_release(rt);
1300 			return;
1301 		}
1302 	}
1303 	if (rt && lifetime == 0) {
1304 		ip6_del_rt(net, rt);
1305 		rt = NULL;
1306 	}
1307 
1308 	ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, for dev: %s\n",
1309 		  rt, lifetime, skb->dev->name);
1310 	if (!rt && lifetime) {
1311 		ND_PRINTK(3, info, "RA: adding default router\n");
1312 
1313 		rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
1314 					 skb->dev, pref);
1315 		if (!rt) {
1316 			ND_PRINTK(0, err,
1317 				  "RA: %s failed to add default route\n",
1318 				  __func__);
1319 			return;
1320 		}
1321 
1322 		neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6,
1323 					 rt->fib6_nh->fib_nh_dev, NULL,
1324 					  &ipv6_hdr(skb)->saddr);
1325 		if (!neigh) {
1326 			ND_PRINTK(0, err,
1327 				  "RA: %s got default router without neighbour\n",
1328 				  __func__);
1329 			fib6_info_release(rt);
1330 			return;
1331 		}
1332 		neigh->flags |= NTF_ROUTER;
1333 	} else if (rt) {
1334 		rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1335 	}
1336 
1337 	if (rt)
1338 		fib6_set_expires(rt, jiffies + (HZ * lifetime));
1339 	if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1340 	    ra_msg->icmph.icmp6_hop_limit) {
1341 		if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1342 			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1343 			fib6_metric_set(rt, RTAX_HOPLIMIT,
1344 					ra_msg->icmph.icmp6_hop_limit);
1345 		} else {
1346 			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1347 		}
1348 	}
1349 
1350 skip_defrtr:
1351 
1352 	/*
1353 	 *	Update Reachable Time and Retrans Timer
1354 	 */
1355 
1356 	if (in6_dev->nd_parms) {
1357 		unsigned long rtime = ntohl(ra_msg->retrans_timer);
1358 
1359 		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1360 			rtime = (rtime*HZ)/1000;
1361 			if (rtime < HZ/10)
1362 				rtime = HZ/10;
1363 			NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1364 			in6_dev->tstamp = jiffies;
1365 			send_ifinfo_notify = true;
1366 		}
1367 
1368 		rtime = ntohl(ra_msg->reachable_time);
1369 		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1370 			rtime = (rtime*HZ)/1000;
1371 
1372 			if (rtime < HZ/10)
1373 				rtime = HZ/10;
1374 
1375 			if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1376 				NEIGH_VAR_SET(in6_dev->nd_parms,
1377 					      BASE_REACHABLE_TIME, rtime);
1378 				NEIGH_VAR_SET(in6_dev->nd_parms,
1379 					      GC_STALETIME, 3 * rtime);
1380 				in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1381 				in6_dev->tstamp = jiffies;
1382 				send_ifinfo_notify = true;
1383 			}
1384 		}
1385 	}
1386 
1387 	/*
1388 	 *	Send a notify if RA changed managed/otherconf flags or timer settings
1389 	 */
1390 	if (send_ifinfo_notify)
1391 		inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1392 
1393 skip_linkparms:
1394 
1395 	/*
1396 	 *	Process options.
1397 	 */
1398 
1399 	if (!neigh)
1400 		neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1401 				       skb->dev, 1);
1402 	if (neigh) {
1403 		u8 *lladdr = NULL;
1404 		if (ndopts.nd_opts_src_lladdr) {
1405 			lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1406 						     skb->dev);
1407 			if (!lladdr) {
1408 				ND_PRINTK(2, warn,
1409 					  "RA: invalid link-layer address length\n");
1410 				goto out;
1411 			}
1412 		}
1413 		ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1414 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1415 			     NEIGH_UPDATE_F_OVERRIDE|
1416 			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1417 			     NEIGH_UPDATE_F_ISROUTER,
1418 			     NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1419 	}
1420 
1421 	if (!ipv6_accept_ra(in6_dev)) {
1422 		ND_PRINTK(2, info,
1423 			  "RA: %s, accept_ra is false for dev: %s\n",
1424 			  __func__, skb->dev->name);
1425 		goto out;
1426 	}
1427 
1428 #ifdef CONFIG_IPV6_ROUTE_INFO
1429 	if (!in6_dev->cnf.accept_ra_from_local &&
1430 	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1431 			  in6_dev->dev, 0)) {
1432 		ND_PRINTK(2, info,
1433 			  "RA from local address detected on dev: %s: router info ignored.\n",
1434 			  skb->dev->name);
1435 		goto skip_routeinfo;
1436 	}
1437 
1438 	if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1439 		struct nd_opt_hdr *p;
1440 		for (p = ndopts.nd_opts_ri;
1441 		     p;
1442 		     p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1443 			struct route_info *ri = (struct route_info *)p;
1444 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1445 			if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1446 			    ri->prefix_len == 0)
1447 				continue;
1448 #endif
1449 			if (ri->prefix_len == 0 &&
1450 			    !in6_dev->cnf.accept_ra_defrtr)
1451 				continue;
1452 			if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1453 				continue;
1454 			if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1455 				continue;
1456 			rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1457 				      &ipv6_hdr(skb)->saddr);
1458 		}
1459 	}
1460 
1461 skip_routeinfo:
1462 #endif
1463 
1464 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1465 	/* skip link-specific ndopts from interior routers */
1466 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1467 		ND_PRINTK(2, info,
1468 			  "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1469 			  __func__, skb->dev->name);
1470 		goto out;
1471 	}
1472 #endif
1473 
1474 	if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1475 		struct nd_opt_hdr *p;
1476 		for (p = ndopts.nd_opts_pi;
1477 		     p;
1478 		     p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1479 			addrconf_prefix_rcv(skb->dev, (u8 *)p,
1480 					    (p->nd_opt_len) << 3,
1481 					    ndopts.nd_opts_src_lladdr != NULL);
1482 		}
1483 	}
1484 
1485 	if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1486 		__be32 n;
1487 		u32 mtu;
1488 
1489 		memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1490 		mtu = ntohl(n);
1491 
1492 		if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1493 			ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1494 		} else if (in6_dev->cnf.mtu6 != mtu) {
1495 			in6_dev->cnf.mtu6 = mtu;
1496 			fib6_metric_set(rt, RTAX_MTU, mtu);
1497 			rt6_mtu_change(skb->dev, mtu);
1498 		}
1499 	}
1500 
1501 	if (ndopts.nd_useropts) {
1502 		struct nd_opt_hdr *p;
1503 		for (p = ndopts.nd_useropts;
1504 		     p;
1505 		     p = ndisc_next_useropt(skb->dev, p,
1506 					    ndopts.nd_useropts_end)) {
1507 			ndisc_ra_useropt(skb, p);
1508 		}
1509 	}
1510 
1511 	if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1512 		ND_PRINTK(2, warn, "RA: invalid RA options\n");
1513 	}
1514 out:
1515 	fib6_info_release(rt);
1516 	if (neigh)
1517 		neigh_release(neigh);
1518 }
1519 
1520 static void ndisc_redirect_rcv(struct sk_buff *skb)
1521 {
1522 	u8 *hdr;
1523 	struct ndisc_options ndopts;
1524 	struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1525 	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1526 				    offsetof(struct rd_msg, opt));
1527 
1528 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1529 	switch (skb->ndisc_nodetype) {
1530 	case NDISC_NODETYPE_HOST:
1531 	case NDISC_NODETYPE_NODEFAULT:
1532 		ND_PRINTK(2, warn,
1533 			  "Redirect: from host or unauthorized router\n");
1534 		return;
1535 	}
1536 #endif
1537 
1538 	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1539 		ND_PRINTK(2, warn,
1540 			  "Redirect: source address is not link-local\n");
1541 		return;
1542 	}
1543 
1544 	if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1545 		return;
1546 
1547 	if (!ndopts.nd_opts_rh) {
1548 		ip6_redirect_no_header(skb, dev_net(skb->dev),
1549 					skb->dev->ifindex);
1550 		return;
1551 	}
1552 
1553 	hdr = (u8 *)ndopts.nd_opts_rh;
1554 	hdr += 8;
1555 	if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1556 		return;
1557 
1558 	icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1559 }
1560 
1561 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1562 					   struct sk_buff *orig_skb,
1563 					   int rd_len)
1564 {
1565 	u8 *opt = skb_put(skb, rd_len);
1566 
1567 	memset(opt, 0, 8);
1568 	*(opt++) = ND_OPT_REDIRECT_HDR;
1569 	*(opt++) = (rd_len >> 3);
1570 	opt += 6;
1571 
1572 	skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1573 		      rd_len - 8);
1574 }
1575 
1576 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1577 {
1578 	struct net_device *dev = skb->dev;
1579 	struct net *net = dev_net(dev);
1580 	struct sock *sk = net->ipv6.ndisc_sk;
1581 	int optlen = 0;
1582 	struct inet_peer *peer;
1583 	struct sk_buff *buff;
1584 	struct rd_msg *msg;
1585 	struct in6_addr saddr_buf;
1586 	struct rt6_info *rt;
1587 	struct dst_entry *dst;
1588 	struct flowi6 fl6;
1589 	int rd_len;
1590 	u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1591 	   ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1592 	bool ret;
1593 
1594 	if (netif_is_l3_master(skb->dev)) {
1595 		dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
1596 		if (!dev)
1597 			return;
1598 	}
1599 
1600 	if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1601 		ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1602 			  dev->name);
1603 		return;
1604 	}
1605 
1606 	if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1607 	    ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1608 		ND_PRINTK(2, warn,
1609 			  "Redirect: target address is not link-local unicast\n");
1610 		return;
1611 	}
1612 
1613 	icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1614 			 &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1615 
1616 	dst = ip6_route_output(net, NULL, &fl6);
1617 	if (dst->error) {
1618 		dst_release(dst);
1619 		return;
1620 	}
1621 	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1622 	if (IS_ERR(dst))
1623 		return;
1624 
1625 	rt = (struct rt6_info *) dst;
1626 
1627 	if (rt->rt6i_flags & RTF_GATEWAY) {
1628 		ND_PRINTK(2, warn,
1629 			  "Redirect: destination is not a neighbour\n");
1630 		goto release;
1631 	}
1632 	peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1633 	ret = inet_peer_xrlim_allow(peer, 1*HZ);
1634 	if (peer)
1635 		inet_putpeer(peer);
1636 	if (!ret)
1637 		goto release;
1638 
1639 	if (dev->addr_len) {
1640 		struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1641 		if (!neigh) {
1642 			ND_PRINTK(2, warn,
1643 				  "Redirect: no neigh for target address\n");
1644 			goto release;
1645 		}
1646 
1647 		read_lock_bh(&neigh->lock);
1648 		if (neigh->nud_state & NUD_VALID) {
1649 			memcpy(ha_buf, neigh->ha, dev->addr_len);
1650 			read_unlock_bh(&neigh->lock);
1651 			ha = ha_buf;
1652 			optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1653 								ops_data_buf,
1654 								&ops_data);
1655 		} else
1656 			read_unlock_bh(&neigh->lock);
1657 
1658 		neigh_release(neigh);
1659 	}
1660 
1661 	rd_len = min_t(unsigned int,
1662 		       IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1663 		       skb->len + 8);
1664 	rd_len &= ~0x7;
1665 	optlen += rd_len;
1666 
1667 	buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1668 	if (!buff)
1669 		goto release;
1670 
1671 	msg = skb_put(buff, sizeof(*msg));
1672 	*msg = (struct rd_msg) {
1673 		.icmph = {
1674 			.icmp6_type = NDISC_REDIRECT,
1675 		},
1676 		.target = *target,
1677 		.dest = ipv6_hdr(skb)->daddr,
1678 	};
1679 
1680 	/*
1681 	 *	include target_address option
1682 	 */
1683 
1684 	if (ha)
1685 		ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1686 
1687 	/*
1688 	 *	build redirect option and copy skb over to the new packet.
1689 	 */
1690 
1691 	if (rd_len)
1692 		ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1693 
1694 	skb_dst_set(buff, dst);
1695 	ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1696 	return;
1697 
1698 release:
1699 	dst_release(dst);
1700 }
1701 
1702 static void pndisc_redo(struct sk_buff *skb)
1703 {
1704 	ndisc_recv_ns(skb);
1705 	kfree_skb(skb);
1706 }
1707 
1708 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1709 {
1710 	struct inet6_dev *idev = __in6_dev_get(skb->dev);
1711 
1712 	if (!idev)
1713 		return true;
1714 	if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1715 	    idev->cnf.suppress_frag_ndisc) {
1716 		net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1717 		return true;
1718 	}
1719 	return false;
1720 }
1721 
1722 int ndisc_rcv(struct sk_buff *skb)
1723 {
1724 	struct nd_msg *msg;
1725 
1726 	if (ndisc_suppress_frag_ndisc(skb))
1727 		return 0;
1728 
1729 	if (skb_linearize(skb))
1730 		return 0;
1731 
1732 	msg = (struct nd_msg *)skb_transport_header(skb);
1733 
1734 	__skb_push(skb, skb->data - skb_transport_header(skb));
1735 
1736 	if (ipv6_hdr(skb)->hop_limit != 255) {
1737 		ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1738 			  ipv6_hdr(skb)->hop_limit);
1739 		return 0;
1740 	}
1741 
1742 	if (msg->icmph.icmp6_code != 0) {
1743 		ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1744 			  msg->icmph.icmp6_code);
1745 		return 0;
1746 	}
1747 
1748 	switch (msg->icmph.icmp6_type) {
1749 	case NDISC_NEIGHBOUR_SOLICITATION:
1750 		memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1751 		ndisc_recv_ns(skb);
1752 		break;
1753 
1754 	case NDISC_NEIGHBOUR_ADVERTISEMENT:
1755 		ndisc_recv_na(skb);
1756 		break;
1757 
1758 	case NDISC_ROUTER_SOLICITATION:
1759 		ndisc_recv_rs(skb);
1760 		break;
1761 
1762 	case NDISC_ROUTER_ADVERTISEMENT:
1763 		ndisc_router_discovery(skb);
1764 		break;
1765 
1766 	case NDISC_REDIRECT:
1767 		ndisc_redirect_rcv(skb);
1768 		break;
1769 	}
1770 
1771 	return 0;
1772 }
1773 
1774 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1775 {
1776 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1777 	struct netdev_notifier_change_info *change_info;
1778 	struct net *net = dev_net(dev);
1779 	struct inet6_dev *idev;
1780 
1781 	switch (event) {
1782 	case NETDEV_CHANGEADDR:
1783 		neigh_changeaddr(&nd_tbl, dev);
1784 		fib6_run_gc(0, net, false);
1785 		/* fallthrough */
1786 	case NETDEV_UP:
1787 		idev = in6_dev_get(dev);
1788 		if (!idev)
1789 			break;
1790 		if (idev->cnf.ndisc_notify ||
1791 		    net->ipv6.devconf_all->ndisc_notify)
1792 			ndisc_send_unsol_na(dev);
1793 		in6_dev_put(idev);
1794 		break;
1795 	case NETDEV_CHANGE:
1796 		change_info = ptr;
1797 		if (change_info->flags_changed & IFF_NOARP)
1798 			neigh_changeaddr(&nd_tbl, dev);
1799 		if (!netif_carrier_ok(dev))
1800 			neigh_carrier_down(&nd_tbl, dev);
1801 		break;
1802 	case NETDEV_DOWN:
1803 		neigh_ifdown(&nd_tbl, dev);
1804 		fib6_run_gc(0, net, false);
1805 		break;
1806 	case NETDEV_NOTIFY_PEERS:
1807 		ndisc_send_unsol_na(dev);
1808 		break;
1809 	default:
1810 		break;
1811 	}
1812 
1813 	return NOTIFY_DONE;
1814 }
1815 
1816 static struct notifier_block ndisc_netdev_notifier = {
1817 	.notifier_call = ndisc_netdev_event,
1818 	.priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1819 };
1820 
1821 #ifdef CONFIG_SYSCTL
1822 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1823 					 const char *func, const char *dev_name)
1824 {
1825 	static char warncomm[TASK_COMM_LEN];
1826 	static int warned;
1827 	if (strcmp(warncomm, current->comm) && warned < 5) {
1828 		strcpy(warncomm, current->comm);
1829 		pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1830 			warncomm, func,
1831 			dev_name, ctl->procname,
1832 			dev_name, ctl->procname);
1833 		warned++;
1834 	}
1835 }
1836 
1837 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1838 {
1839 	struct net_device *dev = ctl->extra1;
1840 	struct inet6_dev *idev;
1841 	int ret;
1842 
1843 	if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1844 	    (strcmp(ctl->procname, "base_reachable_time") == 0))
1845 		ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1846 
1847 	if (strcmp(ctl->procname, "retrans_time") == 0)
1848 		ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1849 
1850 	else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1851 		ret = neigh_proc_dointvec_jiffies(ctl, write,
1852 						  buffer, lenp, ppos);
1853 
1854 	else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1855 		 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1856 		ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1857 						     buffer, lenp, ppos);
1858 	else
1859 		ret = -1;
1860 
1861 	if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1862 		if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1863 			idev->nd_parms->reachable_time =
1864 					neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1865 		idev->tstamp = jiffies;
1866 		inet6_ifinfo_notify(RTM_NEWLINK, idev);
1867 		in6_dev_put(idev);
1868 	}
1869 	return ret;
1870 }
1871 
1872 
1873 #endif
1874 
1875 static int __net_init ndisc_net_init(struct net *net)
1876 {
1877 	struct ipv6_pinfo *np;
1878 	struct sock *sk;
1879 	int err;
1880 
1881 	err = inet_ctl_sock_create(&sk, PF_INET6,
1882 				   SOCK_RAW, IPPROTO_ICMPV6, net);
1883 	if (err < 0) {
1884 		ND_PRINTK(0, err,
1885 			  "NDISC: Failed to initialize the control socket (err %d)\n",
1886 			  err);
1887 		return err;
1888 	}
1889 
1890 	net->ipv6.ndisc_sk = sk;
1891 
1892 	np = inet6_sk(sk);
1893 	np->hop_limit = 255;
1894 	/* Do not loopback ndisc messages */
1895 	np->mc_loop = 0;
1896 
1897 	return 0;
1898 }
1899 
1900 static void __net_exit ndisc_net_exit(struct net *net)
1901 {
1902 	inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1903 }
1904 
1905 static struct pernet_operations ndisc_net_ops = {
1906 	.init = ndisc_net_init,
1907 	.exit = ndisc_net_exit,
1908 };
1909 
1910 int __init ndisc_init(void)
1911 {
1912 	int err;
1913 
1914 	err = register_pernet_subsys(&ndisc_net_ops);
1915 	if (err)
1916 		return err;
1917 	/*
1918 	 * Initialize the neighbour table
1919 	 */
1920 	neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1921 
1922 #ifdef CONFIG_SYSCTL
1923 	err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1924 				    ndisc_ifinfo_sysctl_change);
1925 	if (err)
1926 		goto out_unregister_pernet;
1927 out:
1928 #endif
1929 	return err;
1930 
1931 #ifdef CONFIG_SYSCTL
1932 out_unregister_pernet:
1933 	unregister_pernet_subsys(&ndisc_net_ops);
1934 	goto out;
1935 #endif
1936 }
1937 
1938 int __init ndisc_late_init(void)
1939 {
1940 	return register_netdevice_notifier(&ndisc_netdev_notifier);
1941 }
1942 
1943 void ndisc_late_cleanup(void)
1944 {
1945 	unregister_netdevice_notifier(&ndisc_netdev_notifier);
1946 }
1947 
1948 void ndisc_cleanup(void)
1949 {
1950 #ifdef CONFIG_SYSCTL
1951 	neigh_sysctl_unregister(&nd_tbl.parms);
1952 #endif
1953 	neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1954 	unregister_pernet_subsys(&ndisc_net_ops);
1955 }
1956