xref: /openbmc/linux/net/ipv6/ndisc.c (revision d2ba09c1)
1 /*
2  *	Neighbour Discovery for IPv6
3  *	Linux INET6 implementation
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *	Mike Shaver		<shaver@ingenia.com>
8  *
9  *	This program is free software; you can redistribute it and/or
10  *      modify it under the terms of the GNU General Public License
11  *      as published by the Free Software Foundation; either version
12  *      2 of the License, or (at your option) any later version.
13  */
14 
15 /*
16  *	Changes:
17  *
18  *	Alexey I. Froloff		:	RFC6106 (DNSSL) support
19  *	Pierre Ynard			:	export userland ND options
20  *						through netlink (RDNSS support)
21  *	Lars Fenneberg			:	fixed MTU setting on receipt
22  *						of an RA.
23  *	Janos Farkas			:	kmalloc failure checks
24  *	Alexey Kuznetsov		:	state machine reworked
25  *						and moved to net/core.
26  *	Pekka Savola			:	RFC2461 validation
27  *	YOSHIFUJI Hideaki @USAGI	:	Verify ND options properly
28  */
29 
30 #define pr_fmt(fmt) "ICMPv6: " fmt
31 
32 #include <linux/module.h>
33 #include <linux/errno.h>
34 #include <linux/types.h>
35 #include <linux/socket.h>
36 #include <linux/sockios.h>
37 #include <linux/sched.h>
38 #include <linux/net.h>
39 #include <linux/in6.h>
40 #include <linux/route.h>
41 #include <linux/init.h>
42 #include <linux/rcupdate.h>
43 #include <linux/slab.h>
44 #ifdef CONFIG_SYSCTL
45 #include <linux/sysctl.h>
46 #endif
47 
48 #include <linux/if_addr.h>
49 #include <linux/if_ether.h>
50 #include <linux/if_arp.h>
51 #include <linux/ipv6.h>
52 #include <linux/icmpv6.h>
53 #include <linux/jhash.h>
54 
55 #include <net/sock.h>
56 #include <net/snmp.h>
57 
58 #include <net/ipv6.h>
59 #include <net/protocol.h>
60 #include <net/ndisc.h>
61 #include <net/ip6_route.h>
62 #include <net/addrconf.h>
63 #include <net/icmp.h>
64 
65 #include <net/netlink.h>
66 #include <linux/rtnetlink.h>
67 
68 #include <net/flow.h>
69 #include <net/ip6_checksum.h>
70 #include <net/inet_common.h>
71 #include <linux/proc_fs.h>
72 
73 #include <linux/netfilter.h>
74 #include <linux/netfilter_ipv6.h>
75 
76 static u32 ndisc_hash(const void *pkey,
77 		      const struct net_device *dev,
78 		      __u32 *hash_rnd);
79 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
80 static int ndisc_constructor(struct neighbour *neigh);
81 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
82 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
83 static int pndisc_constructor(struct pneigh_entry *n);
84 static void pndisc_destructor(struct pneigh_entry *n);
85 static void pndisc_redo(struct sk_buff *skb);
86 
87 static const struct neigh_ops ndisc_generic_ops = {
88 	.family =		AF_INET6,
89 	.solicit =		ndisc_solicit,
90 	.error_report =		ndisc_error_report,
91 	.output =		neigh_resolve_output,
92 	.connected_output =	neigh_connected_output,
93 };
94 
95 static const struct neigh_ops ndisc_hh_ops = {
96 	.family =		AF_INET6,
97 	.solicit =		ndisc_solicit,
98 	.error_report =		ndisc_error_report,
99 	.output =		neigh_resolve_output,
100 	.connected_output =	neigh_resolve_output,
101 };
102 
103 
104 static const struct neigh_ops ndisc_direct_ops = {
105 	.family =		AF_INET6,
106 	.output =		neigh_direct_output,
107 	.connected_output =	neigh_direct_output,
108 };
109 
110 struct neigh_table nd_tbl = {
111 	.family =	AF_INET6,
112 	.key_len =	sizeof(struct in6_addr),
113 	.protocol =	cpu_to_be16(ETH_P_IPV6),
114 	.hash =		ndisc_hash,
115 	.key_eq =	ndisc_key_eq,
116 	.constructor =	ndisc_constructor,
117 	.pconstructor =	pndisc_constructor,
118 	.pdestructor =	pndisc_destructor,
119 	.proxy_redo =	pndisc_redo,
120 	.id =		"ndisc_cache",
121 	.parms = {
122 		.tbl			= &nd_tbl,
123 		.reachable_time		= ND_REACHABLE_TIME,
124 		.data = {
125 			[NEIGH_VAR_MCAST_PROBES] = 3,
126 			[NEIGH_VAR_UCAST_PROBES] = 3,
127 			[NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
128 			[NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
129 			[NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
130 			[NEIGH_VAR_GC_STALETIME] = 60 * HZ,
131 			[NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
132 			[NEIGH_VAR_PROXY_QLEN] = 64,
133 			[NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
134 			[NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
135 		},
136 	},
137 	.gc_interval =	  30 * HZ,
138 	.gc_thresh1 =	 128,
139 	.gc_thresh2 =	 512,
140 	.gc_thresh3 =	1024,
141 };
142 EXPORT_SYMBOL_GPL(nd_tbl);
143 
144 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data,
145 			      int data_len, int pad)
146 {
147 	int space = __ndisc_opt_addr_space(data_len, pad);
148 	u8 *opt = skb_put(skb, space);
149 
150 	opt[0] = type;
151 	opt[1] = space>>3;
152 
153 	memset(opt + 2, 0, pad);
154 	opt   += pad;
155 	space -= pad;
156 
157 	memcpy(opt+2, data, data_len);
158 	data_len += 2;
159 	opt += data_len;
160 	space -= data_len;
161 	if (space > 0)
162 		memset(opt, 0, space);
163 }
164 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
165 
166 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
167 					  void *data, u8 icmp6_type)
168 {
169 	__ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
170 				 ndisc_addr_option_pad(skb->dev->type));
171 	ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type);
172 }
173 
174 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
175 						   void *ha,
176 						   const u8 *ops_data)
177 {
178 	ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT);
179 	ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data);
180 }
181 
182 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
183 					    struct nd_opt_hdr *end)
184 {
185 	int type;
186 	if (!cur || !end || cur >= end)
187 		return NULL;
188 	type = cur->nd_opt_type;
189 	do {
190 		cur = ((void *)cur) + (cur->nd_opt_len << 3);
191 	} while (cur < end && cur->nd_opt_type != type);
192 	return cur <= end && cur->nd_opt_type == type ? cur : NULL;
193 }
194 
195 static inline int ndisc_is_useropt(const struct net_device *dev,
196 				   struct nd_opt_hdr *opt)
197 {
198 	return opt->nd_opt_type == ND_OPT_RDNSS ||
199 		opt->nd_opt_type == ND_OPT_DNSSL ||
200 		ndisc_ops_is_useropt(dev, opt->nd_opt_type);
201 }
202 
203 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
204 					     struct nd_opt_hdr *cur,
205 					     struct nd_opt_hdr *end)
206 {
207 	if (!cur || !end || cur >= end)
208 		return NULL;
209 	do {
210 		cur = ((void *)cur) + (cur->nd_opt_len << 3);
211 	} while (cur < end && !ndisc_is_useropt(dev, cur));
212 	return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL;
213 }
214 
215 struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
216 					  u8 *opt, int opt_len,
217 					  struct ndisc_options *ndopts)
218 {
219 	struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
220 
221 	if (!nd_opt || opt_len < 0 || !ndopts)
222 		return NULL;
223 	memset(ndopts, 0, sizeof(*ndopts));
224 	while (opt_len) {
225 		int l;
226 		if (opt_len < sizeof(struct nd_opt_hdr))
227 			return NULL;
228 		l = nd_opt->nd_opt_len << 3;
229 		if (opt_len < l || l == 0)
230 			return NULL;
231 		if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
232 			goto next_opt;
233 		switch (nd_opt->nd_opt_type) {
234 		case ND_OPT_SOURCE_LL_ADDR:
235 		case ND_OPT_TARGET_LL_ADDR:
236 		case ND_OPT_MTU:
237 		case ND_OPT_NONCE:
238 		case ND_OPT_REDIRECT_HDR:
239 			if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
240 				ND_PRINTK(2, warn,
241 					  "%s: duplicated ND6 option found: type=%d\n",
242 					  __func__, nd_opt->nd_opt_type);
243 			} else {
244 				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
245 			}
246 			break;
247 		case ND_OPT_PREFIX_INFO:
248 			ndopts->nd_opts_pi_end = nd_opt;
249 			if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
250 				ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
251 			break;
252 #ifdef CONFIG_IPV6_ROUTE_INFO
253 		case ND_OPT_ROUTE_INFO:
254 			ndopts->nd_opts_ri_end = nd_opt;
255 			if (!ndopts->nd_opts_ri)
256 				ndopts->nd_opts_ri = nd_opt;
257 			break;
258 #endif
259 		default:
260 			if (ndisc_is_useropt(dev, nd_opt)) {
261 				ndopts->nd_useropts_end = nd_opt;
262 				if (!ndopts->nd_useropts)
263 					ndopts->nd_useropts = nd_opt;
264 			} else {
265 				/*
266 				 * Unknown options must be silently ignored,
267 				 * to accommodate future extension to the
268 				 * protocol.
269 				 */
270 				ND_PRINTK(2, notice,
271 					  "%s: ignored unsupported option; type=%d, len=%d\n",
272 					  __func__,
273 					  nd_opt->nd_opt_type,
274 					  nd_opt->nd_opt_len);
275 			}
276 		}
277 next_opt:
278 		opt_len -= l;
279 		nd_opt = ((void *)nd_opt) + l;
280 	}
281 	return ndopts;
282 }
283 
284 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
285 {
286 	switch (dev->type) {
287 	case ARPHRD_ETHER:
288 	case ARPHRD_IEEE802:	/* Not sure. Check it later. --ANK */
289 	case ARPHRD_FDDI:
290 		ipv6_eth_mc_map(addr, buf);
291 		return 0;
292 	case ARPHRD_ARCNET:
293 		ipv6_arcnet_mc_map(addr, buf);
294 		return 0;
295 	case ARPHRD_INFINIBAND:
296 		ipv6_ib_mc_map(addr, dev->broadcast, buf);
297 		return 0;
298 	case ARPHRD_IPGRE:
299 		return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
300 	default:
301 		if (dir) {
302 			memcpy(buf, dev->broadcast, dev->addr_len);
303 			return 0;
304 		}
305 	}
306 	return -EINVAL;
307 }
308 EXPORT_SYMBOL(ndisc_mc_map);
309 
310 static u32 ndisc_hash(const void *pkey,
311 		      const struct net_device *dev,
312 		      __u32 *hash_rnd)
313 {
314 	return ndisc_hashfn(pkey, dev, hash_rnd);
315 }
316 
317 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
318 {
319 	return neigh_key_eq128(n, pkey);
320 }
321 
322 static int ndisc_constructor(struct neighbour *neigh)
323 {
324 	struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
325 	struct net_device *dev = neigh->dev;
326 	struct inet6_dev *in6_dev;
327 	struct neigh_parms *parms;
328 	bool is_multicast = ipv6_addr_is_multicast(addr);
329 
330 	in6_dev = in6_dev_get(dev);
331 	if (!in6_dev) {
332 		return -EINVAL;
333 	}
334 
335 	parms = in6_dev->nd_parms;
336 	__neigh_parms_put(neigh->parms);
337 	neigh->parms = neigh_parms_clone(parms);
338 
339 	neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
340 	if (!dev->header_ops) {
341 		neigh->nud_state = NUD_NOARP;
342 		neigh->ops = &ndisc_direct_ops;
343 		neigh->output = neigh_direct_output;
344 	} else {
345 		if (is_multicast) {
346 			neigh->nud_state = NUD_NOARP;
347 			ndisc_mc_map(addr, neigh->ha, dev, 1);
348 		} else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
349 			neigh->nud_state = NUD_NOARP;
350 			memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
351 			if (dev->flags&IFF_LOOPBACK)
352 				neigh->type = RTN_LOCAL;
353 		} else if (dev->flags&IFF_POINTOPOINT) {
354 			neigh->nud_state = NUD_NOARP;
355 			memcpy(neigh->ha, dev->broadcast, dev->addr_len);
356 		}
357 		if (dev->header_ops->cache)
358 			neigh->ops = &ndisc_hh_ops;
359 		else
360 			neigh->ops = &ndisc_generic_ops;
361 		if (neigh->nud_state&NUD_VALID)
362 			neigh->output = neigh->ops->connected_output;
363 		else
364 			neigh->output = neigh->ops->output;
365 	}
366 	in6_dev_put(in6_dev);
367 	return 0;
368 }
369 
370 static int pndisc_constructor(struct pneigh_entry *n)
371 {
372 	struct in6_addr *addr = (struct in6_addr *)&n->key;
373 	struct in6_addr maddr;
374 	struct net_device *dev = n->dev;
375 
376 	if (!dev || !__in6_dev_get(dev))
377 		return -EINVAL;
378 	addrconf_addr_solict_mult(addr, &maddr);
379 	ipv6_dev_mc_inc(dev, &maddr);
380 	return 0;
381 }
382 
383 static void pndisc_destructor(struct pneigh_entry *n)
384 {
385 	struct in6_addr *addr = (struct in6_addr *)&n->key;
386 	struct in6_addr maddr;
387 	struct net_device *dev = n->dev;
388 
389 	if (!dev || !__in6_dev_get(dev))
390 		return;
391 	addrconf_addr_solict_mult(addr, &maddr);
392 	ipv6_dev_mc_dec(dev, &maddr);
393 }
394 
395 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
396 				       int len)
397 {
398 	int hlen = LL_RESERVED_SPACE(dev);
399 	int tlen = dev->needed_tailroom;
400 	struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
401 	struct sk_buff *skb;
402 
403 	skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
404 	if (!skb) {
405 		ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
406 			  __func__);
407 		return NULL;
408 	}
409 
410 	skb->protocol = htons(ETH_P_IPV6);
411 	skb->dev = dev;
412 
413 	skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
414 	skb_reset_transport_header(skb);
415 
416 	/* Manually assign socket ownership as we avoid calling
417 	 * sock_alloc_send_pskb() to bypass wmem buffer limits
418 	 */
419 	skb_set_owner_w(skb, sk);
420 
421 	return skb;
422 }
423 
424 static void ip6_nd_hdr(struct sk_buff *skb,
425 		       const struct in6_addr *saddr,
426 		       const struct in6_addr *daddr,
427 		       int hop_limit, int len)
428 {
429 	struct ipv6hdr *hdr;
430 	struct inet6_dev *idev;
431 	unsigned tclass;
432 
433 	rcu_read_lock();
434 	idev = __in6_dev_get(skb->dev);
435 	tclass = idev ? idev->cnf.ndisc_tclass : 0;
436 	rcu_read_unlock();
437 
438 	skb_push(skb, sizeof(*hdr));
439 	skb_reset_network_header(skb);
440 	hdr = ipv6_hdr(skb);
441 
442 	ip6_flow_hdr(hdr, tclass, 0);
443 
444 	hdr->payload_len = htons(len);
445 	hdr->nexthdr = IPPROTO_ICMPV6;
446 	hdr->hop_limit = hop_limit;
447 
448 	hdr->saddr = *saddr;
449 	hdr->daddr = *daddr;
450 }
451 
452 static void ndisc_send_skb(struct sk_buff *skb,
453 			   const struct in6_addr *daddr,
454 			   const struct in6_addr *saddr)
455 {
456 	struct dst_entry *dst = skb_dst(skb);
457 	struct net *net = dev_net(skb->dev);
458 	struct sock *sk = net->ipv6.ndisc_sk;
459 	struct inet6_dev *idev;
460 	int err;
461 	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
462 	u8 type;
463 
464 	type = icmp6h->icmp6_type;
465 
466 	if (!dst) {
467 		struct flowi6 fl6;
468 		int oif = skb->dev->ifindex;
469 
470 		icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif);
471 		dst = icmp6_dst_alloc(skb->dev, &fl6);
472 		if (IS_ERR(dst)) {
473 			kfree_skb(skb);
474 			return;
475 		}
476 
477 		skb_dst_set(skb, dst);
478 	}
479 
480 	icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len,
481 					      IPPROTO_ICMPV6,
482 					      csum_partial(icmp6h,
483 							   skb->len, 0));
484 
485 	ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len);
486 
487 	rcu_read_lock();
488 	idev = __in6_dev_get(dst->dev);
489 	IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
490 
491 	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
492 		      net, sk, skb, NULL, dst->dev,
493 		      dst_output);
494 	if (!err) {
495 		ICMP6MSGOUT_INC_STATS(net, idev, type);
496 		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
497 	}
498 
499 	rcu_read_unlock();
500 }
501 
502 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
503 		   const struct in6_addr *solicited_addr,
504 		   bool router, bool solicited, bool override, bool inc_opt)
505 {
506 	struct sk_buff *skb;
507 	struct in6_addr tmpaddr;
508 	struct inet6_ifaddr *ifp;
509 	const struct in6_addr *src_addr;
510 	struct nd_msg *msg;
511 	int optlen = 0;
512 
513 	/* for anycast or proxy, solicited_addr != src_addr */
514 	ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1);
515 	if (ifp) {
516 		src_addr = solicited_addr;
517 		if (ifp->flags & IFA_F_OPTIMISTIC)
518 			override = false;
519 		inc_opt |= ifp->idev->cnf.force_tllao;
520 		in6_ifa_put(ifp);
521 	} else {
522 		if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
523 				       inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
524 				       &tmpaddr))
525 			return;
526 		src_addr = &tmpaddr;
527 	}
528 
529 	if (!dev->addr_len)
530 		inc_opt = false;
531 	if (inc_opt)
532 		optlen += ndisc_opt_addr_space(dev,
533 					       NDISC_NEIGHBOUR_ADVERTISEMENT);
534 
535 	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
536 	if (!skb)
537 		return;
538 
539 	msg = skb_put(skb, sizeof(*msg));
540 	*msg = (struct nd_msg) {
541 		.icmph = {
542 			.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
543 			.icmp6_router = router,
544 			.icmp6_solicited = solicited,
545 			.icmp6_override = override,
546 		},
547 		.target = *solicited_addr,
548 	};
549 
550 	if (inc_opt)
551 		ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR,
552 				       dev->dev_addr,
553 				       NDISC_NEIGHBOUR_ADVERTISEMENT);
554 
555 	ndisc_send_skb(skb, daddr, src_addr);
556 }
557 
558 static void ndisc_send_unsol_na(struct net_device *dev)
559 {
560 	struct inet6_dev *idev;
561 	struct inet6_ifaddr *ifa;
562 
563 	idev = in6_dev_get(dev);
564 	if (!idev)
565 		return;
566 
567 	read_lock_bh(&idev->lock);
568 	list_for_each_entry(ifa, &idev->addr_list, if_list) {
569 		/* skip tentative addresses until dad completes */
570 		if (ifa->flags & IFA_F_TENTATIVE &&
571 		    !(ifa->flags & IFA_F_OPTIMISTIC))
572 			continue;
573 
574 		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr,
575 			      /*router=*/ !!idev->cnf.forwarding,
576 			      /*solicited=*/ false, /*override=*/ true,
577 			      /*inc_opt=*/ true);
578 	}
579 	read_unlock_bh(&idev->lock);
580 
581 	in6_dev_put(idev);
582 }
583 
584 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
585 		   const struct in6_addr *daddr, const struct in6_addr *saddr,
586 		   u64 nonce)
587 {
588 	struct sk_buff *skb;
589 	struct in6_addr addr_buf;
590 	int inc_opt = dev->addr_len;
591 	int optlen = 0;
592 	struct nd_msg *msg;
593 
594 	if (!saddr) {
595 		if (ipv6_get_lladdr(dev, &addr_buf,
596 				   (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
597 			return;
598 		saddr = &addr_buf;
599 	}
600 
601 	if (ipv6_addr_any(saddr))
602 		inc_opt = false;
603 	if (inc_opt)
604 		optlen += ndisc_opt_addr_space(dev,
605 					       NDISC_NEIGHBOUR_SOLICITATION);
606 	if (nonce != 0)
607 		optlen += 8;
608 
609 	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
610 	if (!skb)
611 		return;
612 
613 	msg = skb_put(skb, sizeof(*msg));
614 	*msg = (struct nd_msg) {
615 		.icmph = {
616 			.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
617 		},
618 		.target = *solicit,
619 	};
620 
621 	if (inc_opt)
622 		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
623 				       dev->dev_addr,
624 				       NDISC_NEIGHBOUR_SOLICITATION);
625 	if (nonce != 0) {
626 		u8 *opt = skb_put(skb, 8);
627 
628 		opt[0] = ND_OPT_NONCE;
629 		opt[1] = 8 >> 3;
630 		memcpy(opt + 2, &nonce, 6);
631 	}
632 
633 	ndisc_send_skb(skb, daddr, saddr);
634 }
635 
636 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
637 		   const struct in6_addr *daddr)
638 {
639 	struct sk_buff *skb;
640 	struct rs_msg *msg;
641 	int send_sllao = dev->addr_len;
642 	int optlen = 0;
643 
644 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
645 	/*
646 	 * According to section 2.2 of RFC 4429, we must not
647 	 * send router solicitations with a sllao from
648 	 * optimistic addresses, but we may send the solicitation
649 	 * if we don't include the sllao.  So here we check
650 	 * if our address is optimistic, and if so, we
651 	 * suppress the inclusion of the sllao.
652 	 */
653 	if (send_sllao) {
654 		struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr,
655 							   dev, 1);
656 		if (ifp) {
657 			if (ifp->flags & IFA_F_OPTIMISTIC)  {
658 				send_sllao = 0;
659 			}
660 			in6_ifa_put(ifp);
661 		} else {
662 			send_sllao = 0;
663 		}
664 	}
665 #endif
666 	if (send_sllao)
667 		optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
668 
669 	skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
670 	if (!skb)
671 		return;
672 
673 	msg = skb_put(skb, sizeof(*msg));
674 	*msg = (struct rs_msg) {
675 		.icmph = {
676 			.icmp6_type = NDISC_ROUTER_SOLICITATION,
677 		},
678 	};
679 
680 	if (send_sllao)
681 		ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR,
682 				       dev->dev_addr,
683 				       NDISC_ROUTER_SOLICITATION);
684 
685 	ndisc_send_skb(skb, daddr, saddr);
686 }
687 
688 
689 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
690 {
691 	/*
692 	 *	"The sender MUST return an ICMP
693 	 *	 destination unreachable"
694 	 */
695 	dst_link_failure(skb);
696 	kfree_skb(skb);
697 }
698 
699 /* Called with locked neigh: either read or both */
700 
701 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
702 {
703 	struct in6_addr *saddr = NULL;
704 	struct in6_addr mcaddr;
705 	struct net_device *dev = neigh->dev;
706 	struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
707 	int probes = atomic_read(&neigh->probes);
708 
709 	if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
710 					   dev, false, 1,
711 					   IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
712 		saddr = &ipv6_hdr(skb)->saddr;
713 	probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
714 	if (probes < 0) {
715 		if (!(neigh->nud_state & NUD_VALID)) {
716 			ND_PRINTK(1, dbg,
717 				  "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
718 				  __func__, target);
719 		}
720 		ndisc_send_ns(dev, target, target, saddr, 0);
721 	} else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
722 		neigh_app_ns(neigh);
723 	} else {
724 		addrconf_addr_solict_mult(target, &mcaddr);
725 		ndisc_send_ns(dev, target, &mcaddr, saddr, 0);
726 	}
727 }
728 
729 static int pndisc_is_router(const void *pkey,
730 			    struct net_device *dev)
731 {
732 	struct pneigh_entry *n;
733 	int ret = -1;
734 
735 	read_lock_bh(&nd_tbl.lock);
736 	n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev);
737 	if (n)
738 		ret = !!(n->flags & NTF_ROUTER);
739 	read_unlock_bh(&nd_tbl.lock);
740 
741 	return ret;
742 }
743 
744 void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
745 		  const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
746 		  struct ndisc_options *ndopts)
747 {
748 	neigh_update(neigh, lladdr, new, flags, 0);
749 	/* report ndisc ops about neighbour update */
750 	ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts);
751 }
752 
753 static void ndisc_recv_ns(struct sk_buff *skb)
754 {
755 	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
756 	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
757 	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
758 	u8 *lladdr = NULL;
759 	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
760 				    offsetof(struct nd_msg, opt));
761 	struct ndisc_options ndopts;
762 	struct net_device *dev = skb->dev;
763 	struct inet6_ifaddr *ifp;
764 	struct inet6_dev *idev = NULL;
765 	struct neighbour *neigh;
766 	int dad = ipv6_addr_any(saddr);
767 	bool inc;
768 	int is_router = -1;
769 	u64 nonce = 0;
770 
771 	if (skb->len < sizeof(struct nd_msg)) {
772 		ND_PRINTK(2, warn, "NS: packet too short\n");
773 		return;
774 	}
775 
776 	if (ipv6_addr_is_multicast(&msg->target)) {
777 		ND_PRINTK(2, warn, "NS: multicast target address\n");
778 		return;
779 	}
780 
781 	/*
782 	 * RFC2461 7.1.1:
783 	 * DAD has to be destined for solicited node multicast address.
784 	 */
785 	if (dad && !ipv6_addr_is_solict_mult(daddr)) {
786 		ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
787 		return;
788 	}
789 
790 	if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
791 		ND_PRINTK(2, warn, "NS: invalid ND options\n");
792 		return;
793 	}
794 
795 	if (ndopts.nd_opts_src_lladdr) {
796 		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
797 		if (!lladdr) {
798 			ND_PRINTK(2, warn,
799 				  "NS: invalid link-layer address length\n");
800 			return;
801 		}
802 
803 		/* RFC2461 7.1.1:
804 		 *	If the IP source address is the unspecified address,
805 		 *	there MUST NOT be source link-layer address option
806 		 *	in the message.
807 		 */
808 		if (dad) {
809 			ND_PRINTK(2, warn,
810 				  "NS: bad DAD packet (link-layer address option)\n");
811 			return;
812 		}
813 	}
814 	if (ndopts.nd_opts_nonce)
815 		memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
816 
817 	inc = ipv6_addr_is_multicast(daddr);
818 
819 	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
820 	if (ifp) {
821 have_ifp:
822 		if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
823 			if (dad) {
824 				if (nonce != 0 && ifp->dad_nonce == nonce) {
825 					u8 *np = (u8 *)&nonce;
826 					/* Matching nonce if looped back */
827 					ND_PRINTK(2, notice,
828 						  "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
829 						  ifp->idev->dev->name,
830 						  &ifp->addr, np);
831 					goto out;
832 				}
833 				/*
834 				 * We are colliding with another node
835 				 * who is doing DAD
836 				 * so fail our DAD process
837 				 */
838 				addrconf_dad_failure(skb, ifp);
839 				return;
840 			} else {
841 				/*
842 				 * This is not a dad solicitation.
843 				 * If we are an optimistic node,
844 				 * we should respond.
845 				 * Otherwise, we should ignore it.
846 				 */
847 				if (!(ifp->flags & IFA_F_OPTIMISTIC))
848 					goto out;
849 			}
850 		}
851 
852 		idev = ifp->idev;
853 	} else {
854 		struct net *net = dev_net(dev);
855 
856 		/* perhaps an address on the master device */
857 		if (netif_is_l3_slave(dev)) {
858 			struct net_device *mdev;
859 
860 			mdev = netdev_master_upper_dev_get_rcu(dev);
861 			if (mdev) {
862 				ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1);
863 				if (ifp)
864 					goto have_ifp;
865 			}
866 		}
867 
868 		idev = in6_dev_get(dev);
869 		if (!idev) {
870 			/* XXX: count this drop? */
871 			return;
872 		}
873 
874 		if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
875 		    (idev->cnf.forwarding &&
876 		     (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
877 		     (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
878 			if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
879 			    skb->pkt_type != PACKET_HOST &&
880 			    inc &&
881 			    NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
882 				/*
883 				 * for anycast or proxy,
884 				 * sender should delay its response
885 				 * by a random time between 0 and
886 				 * MAX_ANYCAST_DELAY_TIME seconds.
887 				 * (RFC2461) -- yoshfuji
888 				 */
889 				struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
890 				if (n)
891 					pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
892 				goto out;
893 			}
894 		} else
895 			goto out;
896 	}
897 
898 	if (is_router < 0)
899 		is_router = idev->cnf.forwarding;
900 
901 	if (dad) {
902 		ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target,
903 			      !!is_router, false, (ifp != NULL), true);
904 		goto out;
905 	}
906 
907 	if (inc)
908 		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
909 	else
910 		NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
911 
912 	/*
913 	 *	update / create cache entry
914 	 *	for the source address
915 	 */
916 	neigh = __neigh_lookup(&nd_tbl, saddr, dev,
917 			       !inc || lladdr || !dev->addr_len);
918 	if (neigh)
919 		ndisc_update(dev, neigh, lladdr, NUD_STALE,
920 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
921 			     NEIGH_UPDATE_F_OVERRIDE,
922 			     NDISC_NEIGHBOUR_SOLICITATION, &ndopts);
923 	if (neigh || !dev->header_ops) {
924 		ndisc_send_na(dev, saddr, &msg->target, !!is_router,
925 			      true, (ifp != NULL && inc), inc);
926 		if (neigh)
927 			neigh_release(neigh);
928 	}
929 
930 out:
931 	if (ifp)
932 		in6_ifa_put(ifp);
933 	else
934 		in6_dev_put(idev);
935 }
936 
937 static void ndisc_recv_na(struct sk_buff *skb)
938 {
939 	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
940 	struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
941 	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
942 	u8 *lladdr = NULL;
943 	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
944 				    offsetof(struct nd_msg, opt));
945 	struct ndisc_options ndopts;
946 	struct net_device *dev = skb->dev;
947 	struct inet6_dev *idev = __in6_dev_get(dev);
948 	struct inet6_ifaddr *ifp;
949 	struct neighbour *neigh;
950 
951 	if (skb->len < sizeof(struct nd_msg)) {
952 		ND_PRINTK(2, warn, "NA: packet too short\n");
953 		return;
954 	}
955 
956 	if (ipv6_addr_is_multicast(&msg->target)) {
957 		ND_PRINTK(2, warn, "NA: target address is multicast\n");
958 		return;
959 	}
960 
961 	if (ipv6_addr_is_multicast(daddr) &&
962 	    msg->icmph.icmp6_solicited) {
963 		ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
964 		return;
965 	}
966 
967 	/* For some 802.11 wireless deployments (and possibly other networks),
968 	 * there will be a NA proxy and unsolicitd packets are attacks
969 	 * and thus should not be accepted.
970 	 */
971 	if (!msg->icmph.icmp6_solicited && idev &&
972 	    idev->cnf.drop_unsolicited_na)
973 		return;
974 
975 	if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) {
976 		ND_PRINTK(2, warn, "NS: invalid ND option\n");
977 		return;
978 	}
979 	if (ndopts.nd_opts_tgt_lladdr) {
980 		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
981 		if (!lladdr) {
982 			ND_PRINTK(2, warn,
983 				  "NA: invalid link-layer address length\n");
984 			return;
985 		}
986 	}
987 	ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
988 	if (ifp) {
989 		if (skb->pkt_type != PACKET_LOOPBACK
990 		    && (ifp->flags & IFA_F_TENTATIVE)) {
991 				addrconf_dad_failure(skb, ifp);
992 				return;
993 		}
994 		/* What should we make now? The advertisement
995 		   is invalid, but ndisc specs say nothing
996 		   about it. It could be misconfiguration, or
997 		   an smart proxy agent tries to help us :-)
998 
999 		   We should not print the error if NA has been
1000 		   received from loopback - it is just our own
1001 		   unsolicited advertisement.
1002 		 */
1003 		if (skb->pkt_type != PACKET_LOOPBACK)
1004 			ND_PRINTK(1, warn,
1005 				  "NA: %pM advertised our address %pI6c on %s!\n",
1006 				  eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1007 		in6_ifa_put(ifp);
1008 		return;
1009 	}
1010 	neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1011 
1012 	if (neigh) {
1013 		u8 old_flags = neigh->flags;
1014 		struct net *net = dev_net(dev);
1015 
1016 		if (neigh->nud_state & NUD_FAILED)
1017 			goto out;
1018 
1019 		/*
1020 		 * Don't update the neighbor cache entry on a proxy NA from
1021 		 * ourselves because either the proxied node is off link or it
1022 		 * has already sent a NA to us.
1023 		 */
1024 		if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1025 		    net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1026 		    pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
1027 			/* XXX: idev->cnf.proxy_ndp */
1028 			goto out;
1029 		}
1030 
1031 		ndisc_update(dev, neigh, lladdr,
1032 			     msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
1033 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1034 			     (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1035 			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1036 			     (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1037 			     NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts);
1038 
1039 		if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1040 			/*
1041 			 * Change: router to host
1042 			 */
1043 			rt6_clean_tohost(dev_net(dev),  saddr);
1044 		}
1045 
1046 out:
1047 		neigh_release(neigh);
1048 	}
1049 }
1050 
1051 static void ndisc_recv_rs(struct sk_buff *skb)
1052 {
1053 	struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1054 	unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1055 	struct neighbour *neigh;
1056 	struct inet6_dev *idev;
1057 	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1058 	struct ndisc_options ndopts;
1059 	u8 *lladdr = NULL;
1060 
1061 	if (skb->len < sizeof(*rs_msg))
1062 		return;
1063 
1064 	idev = __in6_dev_get(skb->dev);
1065 	if (!idev) {
1066 		ND_PRINTK(1, err, "RS: can't find in6 device\n");
1067 		return;
1068 	}
1069 
1070 	/* Don't accept RS if we're not in router mode */
1071 	if (!idev->cnf.forwarding)
1072 		goto out;
1073 
1074 	/*
1075 	 * Don't update NCE if src = ::;
1076 	 * this implies that the source node has no ip address assigned yet.
1077 	 */
1078 	if (ipv6_addr_any(saddr))
1079 		goto out;
1080 
1081 	/* Parse ND options */
1082 	if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts)) {
1083 		ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
1084 		goto out;
1085 	}
1086 
1087 	if (ndopts.nd_opts_src_lladdr) {
1088 		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1089 					     skb->dev);
1090 		if (!lladdr)
1091 			goto out;
1092 	}
1093 
1094 	neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1095 	if (neigh) {
1096 		ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1097 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1098 			     NEIGH_UPDATE_F_OVERRIDE|
1099 			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1100 			     NDISC_ROUTER_SOLICITATION, &ndopts);
1101 		neigh_release(neigh);
1102 	}
1103 out:
1104 	return;
1105 }
1106 
1107 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1108 {
1109 	struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra);
1110 	struct sk_buff *skb;
1111 	struct nlmsghdr *nlh;
1112 	struct nduseroptmsg *ndmsg;
1113 	struct net *net = dev_net(ra->dev);
1114 	int err;
1115 	int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1116 				    + (opt->nd_opt_len << 3));
1117 	size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr));
1118 
1119 	skb = nlmsg_new(msg_size, GFP_ATOMIC);
1120 	if (!skb) {
1121 		err = -ENOBUFS;
1122 		goto errout;
1123 	}
1124 
1125 	nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0);
1126 	if (!nlh) {
1127 		goto nla_put_failure;
1128 	}
1129 
1130 	ndmsg = nlmsg_data(nlh);
1131 	ndmsg->nduseropt_family = AF_INET6;
1132 	ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1133 	ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1134 	ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1135 	ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1136 
1137 	memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1138 
1139 	if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr))
1140 		goto nla_put_failure;
1141 	nlmsg_end(skb, nlh);
1142 
1143 	rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1144 	return;
1145 
1146 nla_put_failure:
1147 	nlmsg_free(skb);
1148 	err = -EMSGSIZE;
1149 errout:
1150 	rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
1151 }
1152 
1153 static void ndisc_router_discovery(struct sk_buff *skb)
1154 {
1155 	struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1156 	struct neighbour *neigh = NULL;
1157 	struct inet6_dev *in6_dev;
1158 	struct fib6_info *rt = NULL;
1159 	struct net *net;
1160 	int lifetime;
1161 	struct ndisc_options ndopts;
1162 	int optlen;
1163 	unsigned int pref = 0;
1164 	__u32 old_if_flags;
1165 	bool send_ifinfo_notify = false;
1166 
1167 	__u8 *opt = (__u8 *)(ra_msg + 1);
1168 
1169 	optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1170 		sizeof(struct ra_msg);
1171 
1172 	ND_PRINTK(2, info,
1173 		  "RA: %s, dev: %s\n",
1174 		  __func__, skb->dev->name);
1175 	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1176 		ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1177 		return;
1178 	}
1179 	if (optlen < 0) {
1180 		ND_PRINTK(2, warn, "RA: packet too short\n");
1181 		return;
1182 	}
1183 
1184 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1185 	if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1186 		ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1187 		return;
1188 	}
1189 #endif
1190 
1191 	/*
1192 	 *	set the RA_RECV flag in the interface
1193 	 */
1194 
1195 	in6_dev = __in6_dev_get(skb->dev);
1196 	if (!in6_dev) {
1197 		ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1198 			  skb->dev->name);
1199 		return;
1200 	}
1201 
1202 	if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts)) {
1203 		ND_PRINTK(2, warn, "RA: invalid ND options\n");
1204 		return;
1205 	}
1206 
1207 	if (!ipv6_accept_ra(in6_dev)) {
1208 		ND_PRINTK(2, info,
1209 			  "RA: %s, did not accept ra for dev: %s\n",
1210 			  __func__, skb->dev->name);
1211 		goto skip_linkparms;
1212 	}
1213 
1214 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1215 	/* skip link-specific parameters from interior routers */
1216 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1217 		ND_PRINTK(2, info,
1218 			  "RA: %s, nodetype is NODEFAULT, dev: %s\n",
1219 			  __func__, skb->dev->name);
1220 		goto skip_linkparms;
1221 	}
1222 #endif
1223 
1224 	if (in6_dev->if_flags & IF_RS_SENT) {
1225 		/*
1226 		 *	flag that an RA was received after an RS was sent
1227 		 *	out on this interface.
1228 		 */
1229 		in6_dev->if_flags |= IF_RA_RCVD;
1230 	}
1231 
1232 	/*
1233 	 * Remember the managed/otherconf flags from most recently
1234 	 * received RA message (RFC 2462) -- yoshfuji
1235 	 */
1236 	old_if_flags = in6_dev->if_flags;
1237 	in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1238 				IF_RA_OTHERCONF)) |
1239 				(ra_msg->icmph.icmp6_addrconf_managed ?
1240 					IF_RA_MANAGED : 0) |
1241 				(ra_msg->icmph.icmp6_addrconf_other ?
1242 					IF_RA_OTHERCONF : 0);
1243 
1244 	if (old_if_flags != in6_dev->if_flags)
1245 		send_ifinfo_notify = true;
1246 
1247 	if (!in6_dev->cnf.accept_ra_defrtr) {
1248 		ND_PRINTK(2, info,
1249 			  "RA: %s, defrtr is false for dev: %s\n",
1250 			  __func__, skb->dev->name);
1251 		goto skip_defrtr;
1252 	}
1253 
1254 	/* Do not accept RA with source-addr found on local machine unless
1255 	 * accept_ra_from_local is set to true.
1256 	 */
1257 	net = dev_net(in6_dev->dev);
1258 	if (!in6_dev->cnf.accept_ra_from_local &&
1259 	    ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) {
1260 		ND_PRINTK(2, info,
1261 			  "RA from local address detected on dev: %s: default router ignored\n",
1262 			  skb->dev->name);
1263 		goto skip_defrtr;
1264 	}
1265 
1266 	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1267 
1268 #ifdef CONFIG_IPV6_ROUTER_PREF
1269 	pref = ra_msg->icmph.icmp6_router_pref;
1270 	/* 10b is handled as if it were 00b (medium) */
1271 	if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1272 	    !in6_dev->cnf.accept_ra_rtr_pref)
1273 		pref = ICMPV6_ROUTER_PREF_MEDIUM;
1274 #endif
1275 
1276 	rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev);
1277 
1278 	if (rt) {
1279 		neigh = ip6_neigh_lookup(&rt->fib6_nh.nh_gw,
1280 					 rt->fib6_nh.nh_dev, NULL,
1281 					  &ipv6_hdr(skb)->saddr);
1282 		if (!neigh) {
1283 			ND_PRINTK(0, err,
1284 				  "RA: %s got default router without neighbour\n",
1285 				  __func__);
1286 			fib6_info_release(rt);
1287 			return;
1288 		}
1289 	}
1290 	if (rt && lifetime == 0) {
1291 		ip6_del_rt(net, rt);
1292 		rt = NULL;
1293 	}
1294 
1295 	ND_PRINTK(3, info, "RA: rt: %p  lifetime: %d, for dev: %s\n",
1296 		  rt, lifetime, skb->dev->name);
1297 	if (!rt && lifetime) {
1298 		ND_PRINTK(3, info, "RA: adding default router\n");
1299 
1300 		rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr,
1301 					 skb->dev, pref);
1302 		if (!rt) {
1303 			ND_PRINTK(0, err,
1304 				  "RA: %s failed to add default route\n",
1305 				  __func__);
1306 			return;
1307 		}
1308 
1309 		neigh = ip6_neigh_lookup(&rt->fib6_nh.nh_gw,
1310 					 rt->fib6_nh.nh_dev, NULL,
1311 					  &ipv6_hdr(skb)->saddr);
1312 		if (!neigh) {
1313 			ND_PRINTK(0, err,
1314 				  "RA: %s got default router without neighbour\n",
1315 				  __func__);
1316 			fib6_info_release(rt);
1317 			return;
1318 		}
1319 		neigh->flags |= NTF_ROUTER;
1320 	} else if (rt) {
1321 		rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1322 	}
1323 
1324 	if (rt)
1325 		fib6_set_expires(rt, jiffies + (HZ * lifetime));
1326 	if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1327 	    ra_msg->icmph.icmp6_hop_limit) {
1328 		if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1329 			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1330 			fib6_metric_set(rt, RTAX_HOPLIMIT,
1331 					ra_msg->icmph.icmp6_hop_limit);
1332 		} else {
1333 			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1334 		}
1335 	}
1336 
1337 skip_defrtr:
1338 
1339 	/*
1340 	 *	Update Reachable Time and Retrans Timer
1341 	 */
1342 
1343 	if (in6_dev->nd_parms) {
1344 		unsigned long rtime = ntohl(ra_msg->retrans_timer);
1345 
1346 		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1347 			rtime = (rtime*HZ)/1000;
1348 			if (rtime < HZ/10)
1349 				rtime = HZ/10;
1350 			NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1351 			in6_dev->tstamp = jiffies;
1352 			send_ifinfo_notify = true;
1353 		}
1354 
1355 		rtime = ntohl(ra_msg->reachable_time);
1356 		if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1357 			rtime = (rtime*HZ)/1000;
1358 
1359 			if (rtime < HZ/10)
1360 				rtime = HZ/10;
1361 
1362 			if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1363 				NEIGH_VAR_SET(in6_dev->nd_parms,
1364 					      BASE_REACHABLE_TIME, rtime);
1365 				NEIGH_VAR_SET(in6_dev->nd_parms,
1366 					      GC_STALETIME, 3 * rtime);
1367 				in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1368 				in6_dev->tstamp = jiffies;
1369 				send_ifinfo_notify = true;
1370 			}
1371 		}
1372 	}
1373 
1374 	/*
1375 	 *	Send a notify if RA changed managed/otherconf flags or timer settings
1376 	 */
1377 	if (send_ifinfo_notify)
1378 		inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1379 
1380 skip_linkparms:
1381 
1382 	/*
1383 	 *	Process options.
1384 	 */
1385 
1386 	if (!neigh)
1387 		neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1388 				       skb->dev, 1);
1389 	if (neigh) {
1390 		u8 *lladdr = NULL;
1391 		if (ndopts.nd_opts_src_lladdr) {
1392 			lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1393 						     skb->dev);
1394 			if (!lladdr) {
1395 				ND_PRINTK(2, warn,
1396 					  "RA: invalid link-layer address length\n");
1397 				goto out;
1398 			}
1399 		}
1400 		ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
1401 			     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1402 			     NEIGH_UPDATE_F_OVERRIDE|
1403 			     NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1404 			     NEIGH_UPDATE_F_ISROUTER,
1405 			     NDISC_ROUTER_ADVERTISEMENT, &ndopts);
1406 	}
1407 
1408 	if (!ipv6_accept_ra(in6_dev)) {
1409 		ND_PRINTK(2, info,
1410 			  "RA: %s, accept_ra is false for dev: %s\n",
1411 			  __func__, skb->dev->name);
1412 		goto out;
1413 	}
1414 
1415 #ifdef CONFIG_IPV6_ROUTE_INFO
1416 	if (!in6_dev->cnf.accept_ra_from_local &&
1417 	    ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
1418 			  in6_dev->dev, 0)) {
1419 		ND_PRINTK(2, info,
1420 			  "RA from local address detected on dev: %s: router info ignored.\n",
1421 			  skb->dev->name);
1422 		goto skip_routeinfo;
1423 	}
1424 
1425 	if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1426 		struct nd_opt_hdr *p;
1427 		for (p = ndopts.nd_opts_ri;
1428 		     p;
1429 		     p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1430 			struct route_info *ri = (struct route_info *)p;
1431 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1432 			if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1433 			    ri->prefix_len == 0)
1434 				continue;
1435 #endif
1436 			if (ri->prefix_len == 0 &&
1437 			    !in6_dev->cnf.accept_ra_defrtr)
1438 				continue;
1439 			if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1440 				continue;
1441 			if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1442 				continue;
1443 			rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
1444 				      &ipv6_hdr(skb)->saddr);
1445 		}
1446 	}
1447 
1448 skip_routeinfo:
1449 #endif
1450 
1451 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1452 	/* skip link-specific ndopts from interior routers */
1453 	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1454 		ND_PRINTK(2, info,
1455 			  "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1456 			  __func__, skb->dev->name);
1457 		goto out;
1458 	}
1459 #endif
1460 
1461 	if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1462 		struct nd_opt_hdr *p;
1463 		for (p = ndopts.nd_opts_pi;
1464 		     p;
1465 		     p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1466 			addrconf_prefix_rcv(skb->dev, (u8 *)p,
1467 					    (p->nd_opt_len) << 3,
1468 					    ndopts.nd_opts_src_lladdr != NULL);
1469 		}
1470 	}
1471 
1472 	if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1473 		__be32 n;
1474 		u32 mtu;
1475 
1476 		memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1477 		mtu = ntohl(n);
1478 
1479 		if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1480 			ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1481 		} else if (in6_dev->cnf.mtu6 != mtu) {
1482 			in6_dev->cnf.mtu6 = mtu;
1483 			fib6_metric_set(rt, RTAX_MTU, mtu);
1484 			rt6_mtu_change(skb->dev, mtu);
1485 		}
1486 	}
1487 
1488 	if (ndopts.nd_useropts) {
1489 		struct nd_opt_hdr *p;
1490 		for (p = ndopts.nd_useropts;
1491 		     p;
1492 		     p = ndisc_next_useropt(skb->dev, p,
1493 					    ndopts.nd_useropts_end)) {
1494 			ndisc_ra_useropt(skb, p);
1495 		}
1496 	}
1497 
1498 	if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1499 		ND_PRINTK(2, warn, "RA: invalid RA options\n");
1500 	}
1501 out:
1502 	fib6_info_release(rt);
1503 	if (neigh)
1504 		neigh_release(neigh);
1505 }
1506 
1507 static void ndisc_redirect_rcv(struct sk_buff *skb)
1508 {
1509 	u8 *hdr;
1510 	struct ndisc_options ndopts;
1511 	struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1512 	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1513 				    offsetof(struct rd_msg, opt));
1514 
1515 #ifdef CONFIG_IPV6_NDISC_NODETYPE
1516 	switch (skb->ndisc_nodetype) {
1517 	case NDISC_NODETYPE_HOST:
1518 	case NDISC_NODETYPE_NODEFAULT:
1519 		ND_PRINTK(2, warn,
1520 			  "Redirect: from host or unauthorized router\n");
1521 		return;
1522 	}
1523 #endif
1524 
1525 	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1526 		ND_PRINTK(2, warn,
1527 			  "Redirect: source address is not link-local\n");
1528 		return;
1529 	}
1530 
1531 	if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts))
1532 		return;
1533 
1534 	if (!ndopts.nd_opts_rh) {
1535 		ip6_redirect_no_header(skb, dev_net(skb->dev),
1536 					skb->dev->ifindex, 0);
1537 		return;
1538 	}
1539 
1540 	hdr = (u8 *)ndopts.nd_opts_rh;
1541 	hdr += 8;
1542 	if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
1543 		return;
1544 
1545 	icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
1546 }
1547 
1548 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1549 					   struct sk_buff *orig_skb,
1550 					   int rd_len)
1551 {
1552 	u8 *opt = skb_put(skb, rd_len);
1553 
1554 	memset(opt, 0, 8);
1555 	*(opt++) = ND_OPT_REDIRECT_HDR;
1556 	*(opt++) = (rd_len >> 3);
1557 	opt += 6;
1558 
1559 	skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
1560 		      rd_len - 8);
1561 }
1562 
1563 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1564 {
1565 	struct net_device *dev = skb->dev;
1566 	struct net *net = dev_net(dev);
1567 	struct sock *sk = net->ipv6.ndisc_sk;
1568 	int optlen = 0;
1569 	struct inet_peer *peer;
1570 	struct sk_buff *buff;
1571 	struct rd_msg *msg;
1572 	struct in6_addr saddr_buf;
1573 	struct rt6_info *rt;
1574 	struct dst_entry *dst;
1575 	struct flowi6 fl6;
1576 	int rd_len;
1577 	u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1578 	   ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1579 	bool ret;
1580 
1581 	if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1582 		ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1583 			  dev->name);
1584 		return;
1585 	}
1586 
1587 	if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1588 	    ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1589 		ND_PRINTK(2, warn,
1590 			  "Redirect: target address is not link-local unicast\n");
1591 		return;
1592 	}
1593 
1594 	icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
1595 			 &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
1596 
1597 	dst = ip6_route_output(net, NULL, &fl6);
1598 	if (dst->error) {
1599 		dst_release(dst);
1600 		return;
1601 	}
1602 	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
1603 	if (IS_ERR(dst))
1604 		return;
1605 
1606 	rt = (struct rt6_info *) dst;
1607 
1608 	if (rt->rt6i_flags & RTF_GATEWAY) {
1609 		ND_PRINTK(2, warn,
1610 			  "Redirect: destination is not a neighbour\n");
1611 		goto release;
1612 	}
1613 	peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
1614 	ret = inet_peer_xrlim_allow(peer, 1*HZ);
1615 	if (peer)
1616 		inet_putpeer(peer);
1617 	if (!ret)
1618 		goto release;
1619 
1620 	if (dev->addr_len) {
1621 		struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
1622 		if (!neigh) {
1623 			ND_PRINTK(2, warn,
1624 				  "Redirect: no neigh for target address\n");
1625 			goto release;
1626 		}
1627 
1628 		read_lock_bh(&neigh->lock);
1629 		if (neigh->nud_state & NUD_VALID) {
1630 			memcpy(ha_buf, neigh->ha, dev->addr_len);
1631 			read_unlock_bh(&neigh->lock);
1632 			ha = ha_buf;
1633 			optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1634 								ops_data_buf,
1635 								&ops_data);
1636 		} else
1637 			read_unlock_bh(&neigh->lock);
1638 
1639 		neigh_release(neigh);
1640 	}
1641 
1642 	rd_len = min_t(unsigned int,
1643 		       IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1644 		       skb->len + 8);
1645 	rd_len &= ~0x7;
1646 	optlen += rd_len;
1647 
1648 	buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen);
1649 	if (!buff)
1650 		goto release;
1651 
1652 	msg = skb_put(buff, sizeof(*msg));
1653 	*msg = (struct rd_msg) {
1654 		.icmph = {
1655 			.icmp6_type = NDISC_REDIRECT,
1656 		},
1657 		.target = *target,
1658 		.dest = ipv6_hdr(skb)->daddr,
1659 	};
1660 
1661 	/*
1662 	 *	include target_address option
1663 	 */
1664 
1665 	if (ha)
1666 		ndisc_fill_redirect_addr_option(buff, ha, ops_data);
1667 
1668 	/*
1669 	 *	build redirect option and copy skb over to the new packet.
1670 	 */
1671 
1672 	if (rd_len)
1673 		ndisc_fill_redirect_hdr_option(buff, skb, rd_len);
1674 
1675 	skb_dst_set(buff, dst);
1676 	ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1677 	return;
1678 
1679 release:
1680 	dst_release(dst);
1681 }
1682 
1683 static void pndisc_redo(struct sk_buff *skb)
1684 {
1685 	ndisc_recv_ns(skb);
1686 	kfree_skb(skb);
1687 }
1688 
1689 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1690 {
1691 	struct inet6_dev *idev = __in6_dev_get(skb->dev);
1692 
1693 	if (!idev)
1694 		return true;
1695 	if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1696 	    idev->cnf.suppress_frag_ndisc) {
1697 		net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1698 		return true;
1699 	}
1700 	return false;
1701 }
1702 
1703 int ndisc_rcv(struct sk_buff *skb)
1704 {
1705 	struct nd_msg *msg;
1706 
1707 	if (ndisc_suppress_frag_ndisc(skb))
1708 		return 0;
1709 
1710 	if (skb_linearize(skb))
1711 		return 0;
1712 
1713 	msg = (struct nd_msg *)skb_transport_header(skb);
1714 
1715 	__skb_push(skb, skb->data - skb_transport_header(skb));
1716 
1717 	if (ipv6_hdr(skb)->hop_limit != 255) {
1718 		ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1719 			  ipv6_hdr(skb)->hop_limit);
1720 		return 0;
1721 	}
1722 
1723 	if (msg->icmph.icmp6_code != 0) {
1724 		ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1725 			  msg->icmph.icmp6_code);
1726 		return 0;
1727 	}
1728 
1729 	memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1730 
1731 	switch (msg->icmph.icmp6_type) {
1732 	case NDISC_NEIGHBOUR_SOLICITATION:
1733 		ndisc_recv_ns(skb);
1734 		break;
1735 
1736 	case NDISC_NEIGHBOUR_ADVERTISEMENT:
1737 		ndisc_recv_na(skb);
1738 		break;
1739 
1740 	case NDISC_ROUTER_SOLICITATION:
1741 		ndisc_recv_rs(skb);
1742 		break;
1743 
1744 	case NDISC_ROUTER_ADVERTISEMENT:
1745 		ndisc_router_discovery(skb);
1746 		break;
1747 
1748 	case NDISC_REDIRECT:
1749 		ndisc_redirect_rcv(skb);
1750 		break;
1751 	}
1752 
1753 	return 0;
1754 }
1755 
1756 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1757 {
1758 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1759 	struct netdev_notifier_change_info *change_info;
1760 	struct net *net = dev_net(dev);
1761 	struct inet6_dev *idev;
1762 
1763 	switch (event) {
1764 	case NETDEV_CHANGEADDR:
1765 		neigh_changeaddr(&nd_tbl, dev);
1766 		fib6_run_gc(0, net, false);
1767 		/* fallthrough */
1768 	case NETDEV_UP:
1769 		idev = in6_dev_get(dev);
1770 		if (!idev)
1771 			break;
1772 		if (idev->cnf.ndisc_notify ||
1773 		    net->ipv6.devconf_all->ndisc_notify)
1774 			ndisc_send_unsol_na(dev);
1775 		in6_dev_put(idev);
1776 		break;
1777 	case NETDEV_CHANGE:
1778 		change_info = ptr;
1779 		if (change_info->flags_changed & IFF_NOARP)
1780 			neigh_changeaddr(&nd_tbl, dev);
1781 		break;
1782 	case NETDEV_DOWN:
1783 		neigh_ifdown(&nd_tbl, dev);
1784 		fib6_run_gc(0, net, false);
1785 		break;
1786 	case NETDEV_NOTIFY_PEERS:
1787 		ndisc_send_unsol_na(dev);
1788 		break;
1789 	default:
1790 		break;
1791 	}
1792 
1793 	return NOTIFY_DONE;
1794 }
1795 
1796 static struct notifier_block ndisc_netdev_notifier = {
1797 	.notifier_call = ndisc_netdev_event,
1798 	.priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1799 };
1800 
1801 #ifdef CONFIG_SYSCTL
1802 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1803 					 const char *func, const char *dev_name)
1804 {
1805 	static char warncomm[TASK_COMM_LEN];
1806 	static int warned;
1807 	if (strcmp(warncomm, current->comm) && warned < 5) {
1808 		strcpy(warncomm, current->comm);
1809 		pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1810 			warncomm, func,
1811 			dev_name, ctl->procname,
1812 			dev_name, ctl->procname);
1813 		warned++;
1814 	}
1815 }
1816 
1817 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
1818 {
1819 	struct net_device *dev = ctl->extra1;
1820 	struct inet6_dev *idev;
1821 	int ret;
1822 
1823 	if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1824 	    (strcmp(ctl->procname, "base_reachable_time") == 0))
1825 		ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1826 
1827 	if (strcmp(ctl->procname, "retrans_time") == 0)
1828 		ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1829 
1830 	else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1831 		ret = neigh_proc_dointvec_jiffies(ctl, write,
1832 						  buffer, lenp, ppos);
1833 
1834 	else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1835 		 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1836 		ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1837 						     buffer, lenp, ppos);
1838 	else
1839 		ret = -1;
1840 
1841 	if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1842 		if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1843 			idev->nd_parms->reachable_time =
1844 					neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1845 		idev->tstamp = jiffies;
1846 		inet6_ifinfo_notify(RTM_NEWLINK, idev);
1847 		in6_dev_put(idev);
1848 	}
1849 	return ret;
1850 }
1851 
1852 
1853 #endif
1854 
1855 static int __net_init ndisc_net_init(struct net *net)
1856 {
1857 	struct ipv6_pinfo *np;
1858 	struct sock *sk;
1859 	int err;
1860 
1861 	err = inet_ctl_sock_create(&sk, PF_INET6,
1862 				   SOCK_RAW, IPPROTO_ICMPV6, net);
1863 	if (err < 0) {
1864 		ND_PRINTK(0, err,
1865 			  "NDISC: Failed to initialize the control socket (err %d)\n",
1866 			  err);
1867 		return err;
1868 	}
1869 
1870 	net->ipv6.ndisc_sk = sk;
1871 
1872 	np = inet6_sk(sk);
1873 	np->hop_limit = 255;
1874 	/* Do not loopback ndisc messages */
1875 	np->mc_loop = 0;
1876 
1877 	return 0;
1878 }
1879 
1880 static void __net_exit ndisc_net_exit(struct net *net)
1881 {
1882 	inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
1883 }
1884 
1885 static struct pernet_operations ndisc_net_ops = {
1886 	.init = ndisc_net_init,
1887 	.exit = ndisc_net_exit,
1888 };
1889 
1890 int __init ndisc_init(void)
1891 {
1892 	int err;
1893 
1894 	err = register_pernet_subsys(&ndisc_net_ops);
1895 	if (err)
1896 		return err;
1897 	/*
1898 	 * Initialize the neighbour table
1899 	 */
1900 	neigh_table_init(NEIGH_ND_TABLE, &nd_tbl);
1901 
1902 #ifdef CONFIG_SYSCTL
1903 	err = neigh_sysctl_register(NULL, &nd_tbl.parms,
1904 				    ndisc_ifinfo_sysctl_change);
1905 	if (err)
1906 		goto out_unregister_pernet;
1907 out:
1908 #endif
1909 	return err;
1910 
1911 #ifdef CONFIG_SYSCTL
1912 out_unregister_pernet:
1913 	unregister_pernet_subsys(&ndisc_net_ops);
1914 	goto out;
1915 #endif
1916 }
1917 
1918 int __init ndisc_late_init(void)
1919 {
1920 	return register_netdevice_notifier(&ndisc_netdev_notifier);
1921 }
1922 
1923 void ndisc_late_cleanup(void)
1924 {
1925 	unregister_netdevice_notifier(&ndisc_netdev_notifier);
1926 }
1927 
1928 void ndisc_cleanup(void)
1929 {
1930 #ifdef CONFIG_SYSCTL
1931 	neigh_sysctl_unregister(&nd_tbl.parms);
1932 #endif
1933 	neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl);
1934 	unregister_pernet_subsys(&ndisc_net_ops);
1935 }
1936