1 /* 2 * Neighbour Discovery for IPv6 3 * Linux INET6 implementation 4 * 5 * Authors: 6 * Pedro Roque <roque@di.fc.ul.pt> 7 * Mike Shaver <shaver@ingenia.com> 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License 11 * as published by the Free Software Foundation; either version 12 * 2 of the License, or (at your option) any later version. 13 */ 14 15 /* 16 * Changes: 17 * 18 * Alexey I. Froloff : RFC6106 (DNSSL) support 19 * Pierre Ynard : export userland ND options 20 * through netlink (RDNSS support) 21 * Lars Fenneberg : fixed MTU setting on receipt 22 * of an RA. 23 * Janos Farkas : kmalloc failure checks 24 * Alexey Kuznetsov : state machine reworked 25 * and moved to net/core. 26 * Pekka Savola : RFC2461 validation 27 * YOSHIFUJI Hideaki @USAGI : Verify ND options properly 28 */ 29 30 #define pr_fmt(fmt) "ICMPv6: " fmt 31 32 #include <linux/module.h> 33 #include <linux/errno.h> 34 #include <linux/types.h> 35 #include <linux/socket.h> 36 #include <linux/sockios.h> 37 #include <linux/sched.h> 38 #include <linux/net.h> 39 #include <linux/in6.h> 40 #include <linux/route.h> 41 #include <linux/init.h> 42 #include <linux/rcupdate.h> 43 #include <linux/slab.h> 44 #ifdef CONFIG_SYSCTL 45 #include <linux/sysctl.h> 46 #endif 47 48 #include <linux/if_addr.h> 49 #include <linux/if_arp.h> 50 #include <linux/ipv6.h> 51 #include <linux/icmpv6.h> 52 #include <linux/jhash.h> 53 54 #include <net/sock.h> 55 #include <net/snmp.h> 56 57 #include <net/ipv6.h> 58 #include <net/protocol.h> 59 #include <net/ndisc.h> 60 #include <net/ip6_route.h> 61 #include <net/addrconf.h> 62 #include <net/icmp.h> 63 64 #include <net/netlink.h> 65 #include <linux/rtnetlink.h> 66 67 #include <net/flow.h> 68 #include <net/ip6_checksum.h> 69 #include <net/inet_common.h> 70 #include <linux/proc_fs.h> 71 72 #include <linux/netfilter.h> 73 #include <linux/netfilter_ipv6.h> 74 75 static u32 ndisc_hash(const void *pkey, 76 const struct net_device *dev, 77 __u32 *hash_rnd); 78 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey); 79 static int ndisc_constructor(struct neighbour *neigh); 80 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb); 81 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb); 82 static int pndisc_constructor(struct pneigh_entry *n); 83 static void pndisc_destructor(struct pneigh_entry *n); 84 static void pndisc_redo(struct sk_buff *skb); 85 86 static const struct neigh_ops ndisc_generic_ops = { 87 .family = AF_INET6, 88 .solicit = ndisc_solicit, 89 .error_report = ndisc_error_report, 90 .output = neigh_resolve_output, 91 .connected_output = neigh_connected_output, 92 }; 93 94 static const struct neigh_ops ndisc_hh_ops = { 95 .family = AF_INET6, 96 .solicit = ndisc_solicit, 97 .error_report = ndisc_error_report, 98 .output = neigh_resolve_output, 99 .connected_output = neigh_resolve_output, 100 }; 101 102 103 static const struct neigh_ops ndisc_direct_ops = { 104 .family = AF_INET6, 105 .output = neigh_direct_output, 106 .connected_output = neigh_direct_output, 107 }; 108 109 struct neigh_table nd_tbl = { 110 .family = AF_INET6, 111 .key_len = sizeof(struct in6_addr), 112 .protocol = cpu_to_be16(ETH_P_IPV6), 113 .hash = ndisc_hash, 114 .key_eq = ndisc_key_eq, 115 .constructor = ndisc_constructor, 116 .pconstructor = pndisc_constructor, 117 .pdestructor = pndisc_destructor, 118 .proxy_redo = pndisc_redo, 119 .id = "ndisc_cache", 120 .parms = { 121 .tbl = &nd_tbl, 122 .reachable_time = ND_REACHABLE_TIME, 123 .data = { 124 [NEIGH_VAR_MCAST_PROBES] = 3, 125 [NEIGH_VAR_UCAST_PROBES] = 3, 126 [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER, 127 [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME, 128 [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ, 129 [NEIGH_VAR_GC_STALETIME] = 60 * HZ, 130 [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024, 131 [NEIGH_VAR_PROXY_QLEN] = 64, 132 [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ, 133 [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10, 134 }, 135 }, 136 .gc_interval = 30 * HZ, 137 .gc_thresh1 = 128, 138 .gc_thresh2 = 512, 139 .gc_thresh3 = 1024, 140 }; 141 EXPORT_SYMBOL_GPL(nd_tbl); 142 143 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, void *data, 144 int data_len, int pad) 145 { 146 int space = __ndisc_opt_addr_space(data_len, pad); 147 u8 *opt = skb_put(skb, space); 148 149 opt[0] = type; 150 opt[1] = space>>3; 151 152 memset(opt + 2, 0, pad); 153 opt += pad; 154 space -= pad; 155 156 memcpy(opt+2, data, data_len); 157 data_len += 2; 158 opt += data_len; 159 space -= data_len; 160 if (space > 0) 161 memset(opt, 0, space); 162 } 163 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option); 164 165 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type, 166 void *data, u8 icmp6_type) 167 { 168 __ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len, 169 ndisc_addr_option_pad(skb->dev->type)); 170 ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type); 171 } 172 173 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb, 174 void *ha, 175 const u8 *ops_data) 176 { 177 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT); 178 ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data); 179 } 180 181 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur, 182 struct nd_opt_hdr *end) 183 { 184 int type; 185 if (!cur || !end || cur >= end) 186 return NULL; 187 type = cur->nd_opt_type; 188 do { 189 cur = ((void *)cur) + (cur->nd_opt_len << 3); 190 } while (cur < end && cur->nd_opt_type != type); 191 return cur <= end && cur->nd_opt_type == type ? cur : NULL; 192 } 193 194 static inline int ndisc_is_useropt(const struct net_device *dev, 195 struct nd_opt_hdr *opt) 196 { 197 return opt->nd_opt_type == ND_OPT_RDNSS || 198 opt->nd_opt_type == ND_OPT_DNSSL || 199 ndisc_ops_is_useropt(dev, opt->nd_opt_type); 200 } 201 202 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev, 203 struct nd_opt_hdr *cur, 204 struct nd_opt_hdr *end) 205 { 206 if (!cur || !end || cur >= end) 207 return NULL; 208 do { 209 cur = ((void *)cur) + (cur->nd_opt_len << 3); 210 } while (cur < end && !ndisc_is_useropt(dev, cur)); 211 return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL; 212 } 213 214 struct ndisc_options *ndisc_parse_options(const struct net_device *dev, 215 u8 *opt, int opt_len, 216 struct ndisc_options *ndopts) 217 { 218 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt; 219 220 if (!nd_opt || opt_len < 0 || !ndopts) 221 return NULL; 222 memset(ndopts, 0, sizeof(*ndopts)); 223 while (opt_len) { 224 int l; 225 if (opt_len < sizeof(struct nd_opt_hdr)) 226 return NULL; 227 l = nd_opt->nd_opt_len << 3; 228 if (opt_len < l || l == 0) 229 return NULL; 230 if (ndisc_ops_parse_options(dev, nd_opt, ndopts)) 231 goto next_opt; 232 switch (nd_opt->nd_opt_type) { 233 case ND_OPT_SOURCE_LL_ADDR: 234 case ND_OPT_TARGET_LL_ADDR: 235 case ND_OPT_MTU: 236 case ND_OPT_REDIRECT_HDR: 237 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) { 238 ND_PRINTK(2, warn, 239 "%s: duplicated ND6 option found: type=%d\n", 240 __func__, nd_opt->nd_opt_type); 241 } else { 242 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt; 243 } 244 break; 245 case ND_OPT_PREFIX_INFO: 246 ndopts->nd_opts_pi_end = nd_opt; 247 if (!ndopts->nd_opt_array[nd_opt->nd_opt_type]) 248 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt; 249 break; 250 #ifdef CONFIG_IPV6_ROUTE_INFO 251 case ND_OPT_ROUTE_INFO: 252 ndopts->nd_opts_ri_end = nd_opt; 253 if (!ndopts->nd_opts_ri) 254 ndopts->nd_opts_ri = nd_opt; 255 break; 256 #endif 257 default: 258 if (ndisc_is_useropt(dev, nd_opt)) { 259 ndopts->nd_useropts_end = nd_opt; 260 if (!ndopts->nd_useropts) 261 ndopts->nd_useropts = nd_opt; 262 } else { 263 /* 264 * Unknown options must be silently ignored, 265 * to accommodate future extension to the 266 * protocol. 267 */ 268 ND_PRINTK(2, notice, 269 "%s: ignored unsupported option; type=%d, len=%d\n", 270 __func__, 271 nd_opt->nd_opt_type, 272 nd_opt->nd_opt_len); 273 } 274 } 275 next_opt: 276 opt_len -= l; 277 nd_opt = ((void *)nd_opt) + l; 278 } 279 return ndopts; 280 } 281 282 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir) 283 { 284 switch (dev->type) { 285 case ARPHRD_ETHER: 286 case ARPHRD_IEEE802: /* Not sure. Check it later. --ANK */ 287 case ARPHRD_FDDI: 288 ipv6_eth_mc_map(addr, buf); 289 return 0; 290 case ARPHRD_ARCNET: 291 ipv6_arcnet_mc_map(addr, buf); 292 return 0; 293 case ARPHRD_INFINIBAND: 294 ipv6_ib_mc_map(addr, dev->broadcast, buf); 295 return 0; 296 case ARPHRD_IPGRE: 297 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf); 298 default: 299 if (dir) { 300 memcpy(buf, dev->broadcast, dev->addr_len); 301 return 0; 302 } 303 } 304 return -EINVAL; 305 } 306 EXPORT_SYMBOL(ndisc_mc_map); 307 308 static u32 ndisc_hash(const void *pkey, 309 const struct net_device *dev, 310 __u32 *hash_rnd) 311 { 312 return ndisc_hashfn(pkey, dev, hash_rnd); 313 } 314 315 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey) 316 { 317 return neigh_key_eq128(n, pkey); 318 } 319 320 static int ndisc_constructor(struct neighbour *neigh) 321 { 322 struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key; 323 struct net_device *dev = neigh->dev; 324 struct inet6_dev *in6_dev; 325 struct neigh_parms *parms; 326 bool is_multicast = ipv6_addr_is_multicast(addr); 327 328 in6_dev = in6_dev_get(dev); 329 if (!in6_dev) { 330 return -EINVAL; 331 } 332 333 parms = in6_dev->nd_parms; 334 __neigh_parms_put(neigh->parms); 335 neigh->parms = neigh_parms_clone(parms); 336 337 neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST; 338 if (!dev->header_ops) { 339 neigh->nud_state = NUD_NOARP; 340 neigh->ops = &ndisc_direct_ops; 341 neigh->output = neigh_direct_output; 342 } else { 343 if (is_multicast) { 344 neigh->nud_state = NUD_NOARP; 345 ndisc_mc_map(addr, neigh->ha, dev, 1); 346 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) { 347 neigh->nud_state = NUD_NOARP; 348 memcpy(neigh->ha, dev->dev_addr, dev->addr_len); 349 if (dev->flags&IFF_LOOPBACK) 350 neigh->type = RTN_LOCAL; 351 } else if (dev->flags&IFF_POINTOPOINT) { 352 neigh->nud_state = NUD_NOARP; 353 memcpy(neigh->ha, dev->broadcast, dev->addr_len); 354 } 355 if (dev->header_ops->cache) 356 neigh->ops = &ndisc_hh_ops; 357 else 358 neigh->ops = &ndisc_generic_ops; 359 if (neigh->nud_state&NUD_VALID) 360 neigh->output = neigh->ops->connected_output; 361 else 362 neigh->output = neigh->ops->output; 363 } 364 in6_dev_put(in6_dev); 365 return 0; 366 } 367 368 static int pndisc_constructor(struct pneigh_entry *n) 369 { 370 struct in6_addr *addr = (struct in6_addr *)&n->key; 371 struct in6_addr maddr; 372 struct net_device *dev = n->dev; 373 374 if (!dev || !__in6_dev_get(dev)) 375 return -EINVAL; 376 addrconf_addr_solict_mult(addr, &maddr); 377 ipv6_dev_mc_inc(dev, &maddr); 378 return 0; 379 } 380 381 static void pndisc_destructor(struct pneigh_entry *n) 382 { 383 struct in6_addr *addr = (struct in6_addr *)&n->key; 384 struct in6_addr maddr; 385 struct net_device *dev = n->dev; 386 387 if (!dev || !__in6_dev_get(dev)) 388 return; 389 addrconf_addr_solict_mult(addr, &maddr); 390 ipv6_dev_mc_dec(dev, &maddr); 391 } 392 393 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev, 394 int len) 395 { 396 int hlen = LL_RESERVED_SPACE(dev); 397 int tlen = dev->needed_tailroom; 398 struct sock *sk = dev_net(dev)->ipv6.ndisc_sk; 399 struct sk_buff *skb; 400 401 skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC); 402 if (!skb) { 403 ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n", 404 __func__); 405 return NULL; 406 } 407 408 skb->protocol = htons(ETH_P_IPV6); 409 skb->dev = dev; 410 411 skb_reserve(skb, hlen + sizeof(struct ipv6hdr)); 412 skb_reset_transport_header(skb); 413 414 /* Manually assign socket ownership as we avoid calling 415 * sock_alloc_send_pskb() to bypass wmem buffer limits 416 */ 417 skb_set_owner_w(skb, sk); 418 419 return skb; 420 } 421 422 static void ip6_nd_hdr(struct sk_buff *skb, 423 const struct in6_addr *saddr, 424 const struct in6_addr *daddr, 425 int hop_limit, int len) 426 { 427 struct ipv6hdr *hdr; 428 429 skb_push(skb, sizeof(*hdr)); 430 skb_reset_network_header(skb); 431 hdr = ipv6_hdr(skb); 432 433 ip6_flow_hdr(hdr, 0, 0); 434 435 hdr->payload_len = htons(len); 436 hdr->nexthdr = IPPROTO_ICMPV6; 437 hdr->hop_limit = hop_limit; 438 439 hdr->saddr = *saddr; 440 hdr->daddr = *daddr; 441 } 442 443 static void ndisc_send_skb(struct sk_buff *skb, 444 const struct in6_addr *daddr, 445 const struct in6_addr *saddr) 446 { 447 struct dst_entry *dst = skb_dst(skb); 448 struct net *net = dev_net(skb->dev); 449 struct sock *sk = net->ipv6.ndisc_sk; 450 struct inet6_dev *idev; 451 int err; 452 struct icmp6hdr *icmp6h = icmp6_hdr(skb); 453 u8 type; 454 455 type = icmp6h->icmp6_type; 456 457 if (!dst) { 458 struct flowi6 fl6; 459 int oif = skb->dev->ifindex; 460 461 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif); 462 dst = icmp6_dst_alloc(skb->dev, &fl6); 463 if (IS_ERR(dst)) { 464 kfree_skb(skb); 465 return; 466 } 467 468 skb_dst_set(skb, dst); 469 } 470 471 icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len, 472 IPPROTO_ICMPV6, 473 csum_partial(icmp6h, 474 skb->len, 0)); 475 476 ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len); 477 478 rcu_read_lock(); 479 idev = __in6_dev_get(dst->dev); 480 IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len); 481 482 err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, 483 net, sk, skb, NULL, dst->dev, 484 dst_output); 485 if (!err) { 486 ICMP6MSGOUT_INC_STATS(net, idev, type); 487 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); 488 } 489 490 rcu_read_unlock(); 491 } 492 493 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr, 494 const struct in6_addr *solicited_addr, 495 bool router, bool solicited, bool override, bool inc_opt) 496 { 497 struct sk_buff *skb; 498 struct in6_addr tmpaddr; 499 struct inet6_ifaddr *ifp; 500 const struct in6_addr *src_addr; 501 struct nd_msg *msg; 502 int optlen = 0; 503 504 /* for anycast or proxy, solicited_addr != src_addr */ 505 ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1); 506 if (ifp) { 507 src_addr = solicited_addr; 508 if (ifp->flags & IFA_F_OPTIMISTIC) 509 override = false; 510 inc_opt |= ifp->idev->cnf.force_tllao; 511 in6_ifa_put(ifp); 512 } else { 513 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr, 514 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs, 515 &tmpaddr)) 516 return; 517 src_addr = &tmpaddr; 518 } 519 520 if (!dev->addr_len) 521 inc_opt = 0; 522 if (inc_opt) 523 optlen += ndisc_opt_addr_space(dev, 524 NDISC_NEIGHBOUR_ADVERTISEMENT); 525 526 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 527 if (!skb) 528 return; 529 530 msg = (struct nd_msg *)skb_put(skb, sizeof(*msg)); 531 *msg = (struct nd_msg) { 532 .icmph = { 533 .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT, 534 .icmp6_router = router, 535 .icmp6_solicited = solicited, 536 .icmp6_override = override, 537 }, 538 .target = *solicited_addr, 539 }; 540 541 if (inc_opt) 542 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, 543 dev->dev_addr, 544 NDISC_NEIGHBOUR_ADVERTISEMENT); 545 546 ndisc_send_skb(skb, daddr, src_addr); 547 } 548 549 static void ndisc_send_unsol_na(struct net_device *dev) 550 { 551 struct inet6_dev *idev; 552 struct inet6_ifaddr *ifa; 553 554 idev = in6_dev_get(dev); 555 if (!idev) 556 return; 557 558 read_lock_bh(&idev->lock); 559 list_for_each_entry(ifa, &idev->addr_list, if_list) { 560 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr, 561 /*router=*/ !!idev->cnf.forwarding, 562 /*solicited=*/ false, /*override=*/ true, 563 /*inc_opt=*/ true); 564 } 565 read_unlock_bh(&idev->lock); 566 567 in6_dev_put(idev); 568 } 569 570 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit, 571 const struct in6_addr *daddr, const struct in6_addr *saddr) 572 { 573 struct sk_buff *skb; 574 struct in6_addr addr_buf; 575 int inc_opt = dev->addr_len; 576 int optlen = 0; 577 struct nd_msg *msg; 578 579 if (!saddr) { 580 if (ipv6_get_lladdr(dev, &addr_buf, 581 (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))) 582 return; 583 saddr = &addr_buf; 584 } 585 586 if (ipv6_addr_any(saddr)) 587 inc_opt = false; 588 if (inc_opt) 589 optlen += ndisc_opt_addr_space(dev, 590 NDISC_NEIGHBOUR_SOLICITATION); 591 592 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 593 if (!skb) 594 return; 595 596 msg = (struct nd_msg *)skb_put(skb, sizeof(*msg)); 597 *msg = (struct nd_msg) { 598 .icmph = { 599 .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION, 600 }, 601 .target = *solicit, 602 }; 603 604 if (inc_opt) 605 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR, 606 dev->dev_addr, 607 NDISC_NEIGHBOUR_SOLICITATION); 608 609 ndisc_send_skb(skb, daddr, saddr); 610 } 611 612 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr, 613 const struct in6_addr *daddr) 614 { 615 struct sk_buff *skb; 616 struct rs_msg *msg; 617 int send_sllao = dev->addr_len; 618 int optlen = 0; 619 620 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD 621 /* 622 * According to section 2.2 of RFC 4429, we must not 623 * send router solicitations with a sllao from 624 * optimistic addresses, but we may send the solicitation 625 * if we don't include the sllao. So here we check 626 * if our address is optimistic, and if so, we 627 * suppress the inclusion of the sllao. 628 */ 629 if (send_sllao) { 630 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr, 631 dev, 1); 632 if (ifp) { 633 if (ifp->flags & IFA_F_OPTIMISTIC) { 634 send_sllao = 0; 635 } 636 in6_ifa_put(ifp); 637 } else { 638 send_sllao = 0; 639 } 640 } 641 #endif 642 if (send_sllao) 643 optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION); 644 645 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 646 if (!skb) 647 return; 648 649 msg = (struct rs_msg *)skb_put(skb, sizeof(*msg)); 650 *msg = (struct rs_msg) { 651 .icmph = { 652 .icmp6_type = NDISC_ROUTER_SOLICITATION, 653 }, 654 }; 655 656 if (send_sllao) 657 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR, 658 dev->dev_addr, 659 NDISC_ROUTER_SOLICITATION); 660 661 ndisc_send_skb(skb, daddr, saddr); 662 } 663 664 665 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb) 666 { 667 /* 668 * "The sender MUST return an ICMP 669 * destination unreachable" 670 */ 671 dst_link_failure(skb); 672 kfree_skb(skb); 673 } 674 675 /* Called with locked neigh: either read or both */ 676 677 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb) 678 { 679 struct in6_addr *saddr = NULL; 680 struct in6_addr mcaddr; 681 struct net_device *dev = neigh->dev; 682 struct in6_addr *target = (struct in6_addr *)&neigh->primary_key; 683 int probes = atomic_read(&neigh->probes); 684 685 if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr, 686 dev, 1, 687 IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) 688 saddr = &ipv6_hdr(skb)->saddr; 689 probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES); 690 if (probes < 0) { 691 if (!(neigh->nud_state & NUD_VALID)) { 692 ND_PRINTK(1, dbg, 693 "%s: trying to ucast probe in NUD_INVALID: %pI6\n", 694 __func__, target); 695 } 696 ndisc_send_ns(dev, target, target, saddr); 697 } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) { 698 neigh_app_ns(neigh); 699 } else { 700 addrconf_addr_solict_mult(target, &mcaddr); 701 ndisc_send_ns(dev, target, &mcaddr, saddr); 702 } 703 } 704 705 static int pndisc_is_router(const void *pkey, 706 struct net_device *dev) 707 { 708 struct pneigh_entry *n; 709 int ret = -1; 710 711 read_lock_bh(&nd_tbl.lock); 712 n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev); 713 if (n) 714 ret = !!(n->flags & NTF_ROUTER); 715 read_unlock_bh(&nd_tbl.lock); 716 717 return ret; 718 } 719 720 void ndisc_update(const struct net_device *dev, struct neighbour *neigh, 721 const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type, 722 struct ndisc_options *ndopts) 723 { 724 neigh_update(neigh, lladdr, new, flags); 725 /* report ndisc ops about neighbour update */ 726 ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts); 727 } 728 729 static void ndisc_recv_ns(struct sk_buff *skb) 730 { 731 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb); 732 const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 733 const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr; 734 u8 *lladdr = NULL; 735 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) + 736 offsetof(struct nd_msg, opt)); 737 struct ndisc_options ndopts; 738 struct net_device *dev = skb->dev; 739 struct inet6_ifaddr *ifp; 740 struct inet6_dev *idev = NULL; 741 struct neighbour *neigh; 742 int dad = ipv6_addr_any(saddr); 743 bool inc; 744 int is_router = -1; 745 746 if (skb->len < sizeof(struct nd_msg)) { 747 ND_PRINTK(2, warn, "NS: packet too short\n"); 748 return; 749 } 750 751 if (ipv6_addr_is_multicast(&msg->target)) { 752 ND_PRINTK(2, warn, "NS: multicast target address\n"); 753 return; 754 } 755 756 /* 757 * RFC2461 7.1.1: 758 * DAD has to be destined for solicited node multicast address. 759 */ 760 if (dad && !ipv6_addr_is_solict_mult(daddr)) { 761 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n"); 762 return; 763 } 764 765 if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) { 766 ND_PRINTK(2, warn, "NS: invalid ND options\n"); 767 return; 768 } 769 770 if (ndopts.nd_opts_src_lladdr) { 771 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev); 772 if (!lladdr) { 773 ND_PRINTK(2, warn, 774 "NS: invalid link-layer address length\n"); 775 return; 776 } 777 778 /* RFC2461 7.1.1: 779 * If the IP source address is the unspecified address, 780 * there MUST NOT be source link-layer address option 781 * in the message. 782 */ 783 if (dad) { 784 ND_PRINTK(2, warn, 785 "NS: bad DAD packet (link-layer address option)\n"); 786 return; 787 } 788 } 789 790 inc = ipv6_addr_is_multicast(daddr); 791 792 ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1); 793 if (ifp) { 794 have_ifp: 795 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) { 796 if (dad) { 797 /* 798 * We are colliding with another node 799 * who is doing DAD 800 * so fail our DAD process 801 */ 802 addrconf_dad_failure(ifp); 803 return; 804 } else { 805 /* 806 * This is not a dad solicitation. 807 * If we are an optimistic node, 808 * we should respond. 809 * Otherwise, we should ignore it. 810 */ 811 if (!(ifp->flags & IFA_F_OPTIMISTIC)) 812 goto out; 813 } 814 } 815 816 idev = ifp->idev; 817 } else { 818 struct net *net = dev_net(dev); 819 820 /* perhaps an address on the master device */ 821 if (netif_is_l3_slave(dev)) { 822 struct net_device *mdev; 823 824 mdev = netdev_master_upper_dev_get_rcu(dev); 825 if (mdev) { 826 ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1); 827 if (ifp) 828 goto have_ifp; 829 } 830 } 831 832 idev = in6_dev_get(dev); 833 if (!idev) { 834 /* XXX: count this drop? */ 835 return; 836 } 837 838 if (ipv6_chk_acast_addr(net, dev, &msg->target) || 839 (idev->cnf.forwarding && 840 (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) && 841 (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) { 842 if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) && 843 skb->pkt_type != PACKET_HOST && 844 inc && 845 NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) { 846 /* 847 * for anycast or proxy, 848 * sender should delay its response 849 * by a random time between 0 and 850 * MAX_ANYCAST_DELAY_TIME seconds. 851 * (RFC2461) -- yoshfuji 852 */ 853 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC); 854 if (n) 855 pneigh_enqueue(&nd_tbl, idev->nd_parms, n); 856 goto out; 857 } 858 } else 859 goto out; 860 } 861 862 if (is_router < 0) 863 is_router = idev->cnf.forwarding; 864 865 if (dad) { 866 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target, 867 !!is_router, false, (ifp != NULL), true); 868 goto out; 869 } 870 871 if (inc) 872 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast); 873 else 874 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast); 875 876 /* 877 * update / create cache entry 878 * for the source address 879 */ 880 neigh = __neigh_lookup(&nd_tbl, saddr, dev, 881 !inc || lladdr || !dev->addr_len); 882 if (neigh) 883 ndisc_update(dev, neigh, lladdr, NUD_STALE, 884 NEIGH_UPDATE_F_WEAK_OVERRIDE| 885 NEIGH_UPDATE_F_OVERRIDE, 886 NDISC_NEIGHBOUR_SOLICITATION, &ndopts); 887 if (neigh || !dev->header_ops) { 888 ndisc_send_na(dev, saddr, &msg->target, !!is_router, 889 true, (ifp != NULL && inc), inc); 890 if (neigh) 891 neigh_release(neigh); 892 } 893 894 out: 895 if (ifp) 896 in6_ifa_put(ifp); 897 else 898 in6_dev_put(idev); 899 } 900 901 static void ndisc_recv_na(struct sk_buff *skb) 902 { 903 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb); 904 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 905 const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr; 906 u8 *lladdr = NULL; 907 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) + 908 offsetof(struct nd_msg, opt)); 909 struct ndisc_options ndopts; 910 struct net_device *dev = skb->dev; 911 struct inet6_dev *idev = __in6_dev_get(dev); 912 struct inet6_ifaddr *ifp; 913 struct neighbour *neigh; 914 915 if (skb->len < sizeof(struct nd_msg)) { 916 ND_PRINTK(2, warn, "NA: packet too short\n"); 917 return; 918 } 919 920 if (ipv6_addr_is_multicast(&msg->target)) { 921 ND_PRINTK(2, warn, "NA: target address is multicast\n"); 922 return; 923 } 924 925 if (ipv6_addr_is_multicast(daddr) && 926 msg->icmph.icmp6_solicited) { 927 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n"); 928 return; 929 } 930 931 /* For some 802.11 wireless deployments (and possibly other networks), 932 * there will be a NA proxy and unsolicitd packets are attacks 933 * and thus should not be accepted. 934 */ 935 if (!msg->icmph.icmp6_solicited && idev && 936 idev->cnf.drop_unsolicited_na) 937 return; 938 939 if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) { 940 ND_PRINTK(2, warn, "NS: invalid ND option\n"); 941 return; 942 } 943 if (ndopts.nd_opts_tgt_lladdr) { 944 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev); 945 if (!lladdr) { 946 ND_PRINTK(2, warn, 947 "NA: invalid link-layer address length\n"); 948 return; 949 } 950 } 951 ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1); 952 if (ifp) { 953 if (skb->pkt_type != PACKET_LOOPBACK 954 && (ifp->flags & IFA_F_TENTATIVE)) { 955 addrconf_dad_failure(ifp); 956 return; 957 } 958 /* What should we make now? The advertisement 959 is invalid, but ndisc specs say nothing 960 about it. It could be misconfiguration, or 961 an smart proxy agent tries to help us :-) 962 963 We should not print the error if NA has been 964 received from loopback - it is just our own 965 unsolicited advertisement. 966 */ 967 if (skb->pkt_type != PACKET_LOOPBACK) 968 ND_PRINTK(1, warn, 969 "NA: someone advertises our address %pI6 on %s!\n", 970 &ifp->addr, ifp->idev->dev->name); 971 in6_ifa_put(ifp); 972 return; 973 } 974 neigh = neigh_lookup(&nd_tbl, &msg->target, dev); 975 976 if (neigh) { 977 u8 old_flags = neigh->flags; 978 struct net *net = dev_net(dev); 979 980 if (neigh->nud_state & NUD_FAILED) 981 goto out; 982 983 /* 984 * Don't update the neighbor cache entry on a proxy NA from 985 * ourselves because either the proxied node is off link or it 986 * has already sent a NA to us. 987 */ 988 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) && 989 net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp && 990 pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) { 991 /* XXX: idev->cnf.proxy_ndp */ 992 goto out; 993 } 994 995 ndisc_update(dev, neigh, lladdr, 996 msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE, 997 NEIGH_UPDATE_F_WEAK_OVERRIDE| 998 (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)| 999 NEIGH_UPDATE_F_OVERRIDE_ISROUTER| 1000 (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0), 1001 NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts); 1002 1003 if ((old_flags & ~neigh->flags) & NTF_ROUTER) { 1004 /* 1005 * Change: router to host 1006 */ 1007 rt6_clean_tohost(dev_net(dev), saddr); 1008 } 1009 1010 out: 1011 neigh_release(neigh); 1012 } 1013 } 1014 1015 static void ndisc_recv_rs(struct sk_buff *skb) 1016 { 1017 struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb); 1018 unsigned long ndoptlen = skb->len - sizeof(*rs_msg); 1019 struct neighbour *neigh; 1020 struct inet6_dev *idev; 1021 const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 1022 struct ndisc_options ndopts; 1023 u8 *lladdr = NULL; 1024 1025 if (skb->len < sizeof(*rs_msg)) 1026 return; 1027 1028 idev = __in6_dev_get(skb->dev); 1029 if (!idev) { 1030 ND_PRINTK(1, err, "RS: can't find in6 device\n"); 1031 return; 1032 } 1033 1034 /* Don't accept RS if we're not in router mode */ 1035 if (!idev->cnf.forwarding) 1036 goto out; 1037 1038 /* 1039 * Don't update NCE if src = ::; 1040 * this implies that the source node has no ip address assigned yet. 1041 */ 1042 if (ipv6_addr_any(saddr)) 1043 goto out; 1044 1045 /* Parse ND options */ 1046 if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts)) { 1047 ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n"); 1048 goto out; 1049 } 1050 1051 if (ndopts.nd_opts_src_lladdr) { 1052 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, 1053 skb->dev); 1054 if (!lladdr) 1055 goto out; 1056 } 1057 1058 neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1); 1059 if (neigh) { 1060 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE, 1061 NEIGH_UPDATE_F_WEAK_OVERRIDE| 1062 NEIGH_UPDATE_F_OVERRIDE| 1063 NEIGH_UPDATE_F_OVERRIDE_ISROUTER, 1064 NDISC_ROUTER_SOLICITATION, &ndopts); 1065 neigh_release(neigh); 1066 } 1067 out: 1068 return; 1069 } 1070 1071 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt) 1072 { 1073 struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra); 1074 struct sk_buff *skb; 1075 struct nlmsghdr *nlh; 1076 struct nduseroptmsg *ndmsg; 1077 struct net *net = dev_net(ra->dev); 1078 int err; 1079 int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg) 1080 + (opt->nd_opt_len << 3)); 1081 size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr)); 1082 1083 skb = nlmsg_new(msg_size, GFP_ATOMIC); 1084 if (!skb) { 1085 err = -ENOBUFS; 1086 goto errout; 1087 } 1088 1089 nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0); 1090 if (!nlh) { 1091 goto nla_put_failure; 1092 } 1093 1094 ndmsg = nlmsg_data(nlh); 1095 ndmsg->nduseropt_family = AF_INET6; 1096 ndmsg->nduseropt_ifindex = ra->dev->ifindex; 1097 ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type; 1098 ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code; 1099 ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3; 1100 1101 memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3); 1102 1103 if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr)) 1104 goto nla_put_failure; 1105 nlmsg_end(skb, nlh); 1106 1107 rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC); 1108 return; 1109 1110 nla_put_failure: 1111 nlmsg_free(skb); 1112 err = -EMSGSIZE; 1113 errout: 1114 rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err); 1115 } 1116 1117 static void ndisc_router_discovery(struct sk_buff *skb) 1118 { 1119 struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb); 1120 struct neighbour *neigh = NULL; 1121 struct inet6_dev *in6_dev; 1122 struct rt6_info *rt = NULL; 1123 int lifetime; 1124 struct ndisc_options ndopts; 1125 int optlen; 1126 unsigned int pref = 0; 1127 __u32 old_if_flags; 1128 bool send_ifinfo_notify = false; 1129 1130 __u8 *opt = (__u8 *)(ra_msg + 1); 1131 1132 optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) - 1133 sizeof(struct ra_msg); 1134 1135 ND_PRINTK(2, info, 1136 "RA: %s, dev: %s\n", 1137 __func__, skb->dev->name); 1138 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) { 1139 ND_PRINTK(2, warn, "RA: source address is not link-local\n"); 1140 return; 1141 } 1142 if (optlen < 0) { 1143 ND_PRINTK(2, warn, "RA: packet too short\n"); 1144 return; 1145 } 1146 1147 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1148 if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) { 1149 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n"); 1150 return; 1151 } 1152 #endif 1153 1154 /* 1155 * set the RA_RECV flag in the interface 1156 */ 1157 1158 in6_dev = __in6_dev_get(skb->dev); 1159 if (!in6_dev) { 1160 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n", 1161 skb->dev->name); 1162 return; 1163 } 1164 1165 if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts)) { 1166 ND_PRINTK(2, warn, "RA: invalid ND options\n"); 1167 return; 1168 } 1169 1170 if (!ipv6_accept_ra(in6_dev)) { 1171 ND_PRINTK(2, info, 1172 "RA: %s, did not accept ra for dev: %s\n", 1173 __func__, skb->dev->name); 1174 goto skip_linkparms; 1175 } 1176 1177 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1178 /* skip link-specific parameters from interior routers */ 1179 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) { 1180 ND_PRINTK(2, info, 1181 "RA: %s, nodetype is NODEFAULT, dev: %s\n", 1182 __func__, skb->dev->name); 1183 goto skip_linkparms; 1184 } 1185 #endif 1186 1187 if (in6_dev->if_flags & IF_RS_SENT) { 1188 /* 1189 * flag that an RA was received after an RS was sent 1190 * out on this interface. 1191 */ 1192 in6_dev->if_flags |= IF_RA_RCVD; 1193 } 1194 1195 /* 1196 * Remember the managed/otherconf flags from most recently 1197 * received RA message (RFC 2462) -- yoshfuji 1198 */ 1199 old_if_flags = in6_dev->if_flags; 1200 in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED | 1201 IF_RA_OTHERCONF)) | 1202 (ra_msg->icmph.icmp6_addrconf_managed ? 1203 IF_RA_MANAGED : 0) | 1204 (ra_msg->icmph.icmp6_addrconf_other ? 1205 IF_RA_OTHERCONF : 0); 1206 1207 if (old_if_flags != in6_dev->if_flags) 1208 send_ifinfo_notify = true; 1209 1210 if (!in6_dev->cnf.accept_ra_defrtr) { 1211 ND_PRINTK(2, info, 1212 "RA: %s, defrtr is false for dev: %s\n", 1213 __func__, skb->dev->name); 1214 goto skip_defrtr; 1215 } 1216 1217 /* Do not accept RA with source-addr found on local machine unless 1218 * accept_ra_from_local is set to true. 1219 */ 1220 if (!in6_dev->cnf.accept_ra_from_local && 1221 ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, 1222 in6_dev->dev, 0)) { 1223 ND_PRINTK(2, info, 1224 "RA from local address detected on dev: %s: default router ignored\n", 1225 skb->dev->name); 1226 goto skip_defrtr; 1227 } 1228 1229 lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime); 1230 1231 #ifdef CONFIG_IPV6_ROUTER_PREF 1232 pref = ra_msg->icmph.icmp6_router_pref; 1233 /* 10b is handled as if it were 00b (medium) */ 1234 if (pref == ICMPV6_ROUTER_PREF_INVALID || 1235 !in6_dev->cnf.accept_ra_rtr_pref) 1236 pref = ICMPV6_ROUTER_PREF_MEDIUM; 1237 #endif 1238 1239 rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev); 1240 1241 if (rt) { 1242 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr); 1243 if (!neigh) { 1244 ND_PRINTK(0, err, 1245 "RA: %s got default router without neighbour\n", 1246 __func__); 1247 ip6_rt_put(rt); 1248 return; 1249 } 1250 } 1251 if (rt && lifetime == 0) { 1252 ip6_del_rt(rt); 1253 rt = NULL; 1254 } 1255 1256 ND_PRINTK(3, info, "RA: rt: %p lifetime: %d, for dev: %s\n", 1257 rt, lifetime, skb->dev->name); 1258 if (!rt && lifetime) { 1259 ND_PRINTK(3, info, "RA: adding default router\n"); 1260 1261 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref); 1262 if (!rt) { 1263 ND_PRINTK(0, err, 1264 "RA: %s failed to add default route\n", 1265 __func__); 1266 return; 1267 } 1268 1269 neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr); 1270 if (!neigh) { 1271 ND_PRINTK(0, err, 1272 "RA: %s got default router without neighbour\n", 1273 __func__); 1274 ip6_rt_put(rt); 1275 return; 1276 } 1277 neigh->flags |= NTF_ROUTER; 1278 } else if (rt) { 1279 rt->rt6i_flags = (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref); 1280 } 1281 1282 if (rt) 1283 rt6_set_expires(rt, jiffies + (HZ * lifetime)); 1284 if (in6_dev->cnf.accept_ra_min_hop_limit < 256 && 1285 ra_msg->icmph.icmp6_hop_limit) { 1286 if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) { 1287 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit; 1288 if (rt) 1289 dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 1290 ra_msg->icmph.icmp6_hop_limit); 1291 } else { 1292 ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n"); 1293 } 1294 } 1295 1296 skip_defrtr: 1297 1298 /* 1299 * Update Reachable Time and Retrans Timer 1300 */ 1301 1302 if (in6_dev->nd_parms) { 1303 unsigned long rtime = ntohl(ra_msg->retrans_timer); 1304 1305 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) { 1306 rtime = (rtime*HZ)/1000; 1307 if (rtime < HZ/10) 1308 rtime = HZ/10; 1309 NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime); 1310 in6_dev->tstamp = jiffies; 1311 send_ifinfo_notify = true; 1312 } 1313 1314 rtime = ntohl(ra_msg->reachable_time); 1315 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) { 1316 rtime = (rtime*HZ)/1000; 1317 1318 if (rtime < HZ/10) 1319 rtime = HZ/10; 1320 1321 if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) { 1322 NEIGH_VAR_SET(in6_dev->nd_parms, 1323 BASE_REACHABLE_TIME, rtime); 1324 NEIGH_VAR_SET(in6_dev->nd_parms, 1325 GC_STALETIME, 3 * rtime); 1326 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime); 1327 in6_dev->tstamp = jiffies; 1328 send_ifinfo_notify = true; 1329 } 1330 } 1331 } 1332 1333 /* 1334 * Send a notify if RA changed managed/otherconf flags or timer settings 1335 */ 1336 if (send_ifinfo_notify) 1337 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev); 1338 1339 skip_linkparms: 1340 1341 /* 1342 * Process options. 1343 */ 1344 1345 if (!neigh) 1346 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr, 1347 skb->dev, 1); 1348 if (neigh) { 1349 u8 *lladdr = NULL; 1350 if (ndopts.nd_opts_src_lladdr) { 1351 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, 1352 skb->dev); 1353 if (!lladdr) { 1354 ND_PRINTK(2, warn, 1355 "RA: invalid link-layer address length\n"); 1356 goto out; 1357 } 1358 } 1359 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE, 1360 NEIGH_UPDATE_F_WEAK_OVERRIDE| 1361 NEIGH_UPDATE_F_OVERRIDE| 1362 NEIGH_UPDATE_F_OVERRIDE_ISROUTER| 1363 NEIGH_UPDATE_F_ISROUTER, 1364 NDISC_ROUTER_ADVERTISEMENT, &ndopts); 1365 } 1366 1367 if (!ipv6_accept_ra(in6_dev)) { 1368 ND_PRINTK(2, info, 1369 "RA: %s, accept_ra is false for dev: %s\n", 1370 __func__, skb->dev->name); 1371 goto out; 1372 } 1373 1374 #ifdef CONFIG_IPV6_ROUTE_INFO 1375 if (!in6_dev->cnf.accept_ra_from_local && 1376 ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, 1377 in6_dev->dev, 0)) { 1378 ND_PRINTK(2, info, 1379 "RA from local address detected on dev: %s: router info ignored.\n", 1380 skb->dev->name); 1381 goto skip_routeinfo; 1382 } 1383 1384 if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) { 1385 struct nd_opt_hdr *p; 1386 for (p = ndopts.nd_opts_ri; 1387 p; 1388 p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) { 1389 struct route_info *ri = (struct route_info *)p; 1390 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1391 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT && 1392 ri->prefix_len == 0) 1393 continue; 1394 #endif 1395 if (ri->prefix_len == 0 && 1396 !in6_dev->cnf.accept_ra_defrtr) 1397 continue; 1398 if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen) 1399 continue; 1400 rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3, 1401 &ipv6_hdr(skb)->saddr); 1402 } 1403 } 1404 1405 skip_routeinfo: 1406 #endif 1407 1408 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1409 /* skip link-specific ndopts from interior routers */ 1410 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) { 1411 ND_PRINTK(2, info, 1412 "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n", 1413 __func__, skb->dev->name); 1414 goto out; 1415 } 1416 #endif 1417 1418 if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) { 1419 struct nd_opt_hdr *p; 1420 for (p = ndopts.nd_opts_pi; 1421 p; 1422 p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) { 1423 addrconf_prefix_rcv(skb->dev, (u8 *)p, 1424 (p->nd_opt_len) << 3, 1425 ndopts.nd_opts_src_lladdr != NULL); 1426 } 1427 } 1428 1429 if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) { 1430 __be32 n; 1431 u32 mtu; 1432 1433 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu)); 1434 mtu = ntohl(n); 1435 1436 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) { 1437 ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu); 1438 } else if (in6_dev->cnf.mtu6 != mtu) { 1439 in6_dev->cnf.mtu6 = mtu; 1440 1441 if (rt) 1442 dst_metric_set(&rt->dst, RTAX_MTU, mtu); 1443 1444 rt6_mtu_change(skb->dev, mtu); 1445 } 1446 } 1447 1448 if (ndopts.nd_useropts) { 1449 struct nd_opt_hdr *p; 1450 for (p = ndopts.nd_useropts; 1451 p; 1452 p = ndisc_next_useropt(skb->dev, p, 1453 ndopts.nd_useropts_end)) { 1454 ndisc_ra_useropt(skb, p); 1455 } 1456 } 1457 1458 if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) { 1459 ND_PRINTK(2, warn, "RA: invalid RA options\n"); 1460 } 1461 out: 1462 ip6_rt_put(rt); 1463 if (neigh) 1464 neigh_release(neigh); 1465 } 1466 1467 static void ndisc_redirect_rcv(struct sk_buff *skb) 1468 { 1469 u8 *hdr; 1470 struct ndisc_options ndopts; 1471 struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb); 1472 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) + 1473 offsetof(struct rd_msg, opt)); 1474 1475 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1476 switch (skb->ndisc_nodetype) { 1477 case NDISC_NODETYPE_HOST: 1478 case NDISC_NODETYPE_NODEFAULT: 1479 ND_PRINTK(2, warn, 1480 "Redirect: from host or unauthorized router\n"); 1481 return; 1482 } 1483 #endif 1484 1485 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) { 1486 ND_PRINTK(2, warn, 1487 "Redirect: source address is not link-local\n"); 1488 return; 1489 } 1490 1491 if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts)) 1492 return; 1493 1494 if (!ndopts.nd_opts_rh) { 1495 ip6_redirect_no_header(skb, dev_net(skb->dev), 1496 skb->dev->ifindex, 0); 1497 return; 1498 } 1499 1500 hdr = (u8 *)ndopts.nd_opts_rh; 1501 hdr += 8; 1502 if (!pskb_pull(skb, hdr - skb_transport_header(skb))) 1503 return; 1504 1505 icmpv6_notify(skb, NDISC_REDIRECT, 0, 0); 1506 } 1507 1508 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb, 1509 struct sk_buff *orig_skb, 1510 int rd_len) 1511 { 1512 u8 *opt = skb_put(skb, rd_len); 1513 1514 memset(opt, 0, 8); 1515 *(opt++) = ND_OPT_REDIRECT_HDR; 1516 *(opt++) = (rd_len >> 3); 1517 opt += 6; 1518 1519 memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8); 1520 } 1521 1522 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) 1523 { 1524 struct net_device *dev = skb->dev; 1525 struct net *net = dev_net(dev); 1526 struct sock *sk = net->ipv6.ndisc_sk; 1527 int optlen = 0; 1528 struct inet_peer *peer; 1529 struct sk_buff *buff; 1530 struct rd_msg *msg; 1531 struct in6_addr saddr_buf; 1532 struct rt6_info *rt; 1533 struct dst_entry *dst; 1534 struct flowi6 fl6; 1535 int rd_len; 1536 u8 ha_buf[MAX_ADDR_LEN], *ha = NULL, 1537 ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL; 1538 bool ret; 1539 1540 if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) { 1541 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n", 1542 dev->name); 1543 return; 1544 } 1545 1546 if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) && 1547 ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) { 1548 ND_PRINTK(2, warn, 1549 "Redirect: target address is not link-local unicast\n"); 1550 return; 1551 } 1552 1553 icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT, 1554 &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex); 1555 1556 dst = ip6_route_output(net, NULL, &fl6); 1557 if (dst->error) { 1558 dst_release(dst); 1559 return; 1560 } 1561 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0); 1562 if (IS_ERR(dst)) 1563 return; 1564 1565 rt = (struct rt6_info *) dst; 1566 1567 if (rt->rt6i_flags & RTF_GATEWAY) { 1568 ND_PRINTK(2, warn, 1569 "Redirect: destination is not a neighbour\n"); 1570 goto release; 1571 } 1572 peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1); 1573 ret = inet_peer_xrlim_allow(peer, 1*HZ); 1574 if (peer) 1575 inet_putpeer(peer); 1576 if (!ret) 1577 goto release; 1578 1579 if (dev->addr_len) { 1580 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target); 1581 if (!neigh) { 1582 ND_PRINTK(2, warn, 1583 "Redirect: no neigh for target address\n"); 1584 goto release; 1585 } 1586 1587 read_lock_bh(&neigh->lock); 1588 if (neigh->nud_state & NUD_VALID) { 1589 memcpy(ha_buf, neigh->ha, dev->addr_len); 1590 read_unlock_bh(&neigh->lock); 1591 ha = ha_buf; 1592 optlen += ndisc_redirect_opt_addr_space(dev, neigh, 1593 ops_data_buf, 1594 &ops_data); 1595 } else 1596 read_unlock_bh(&neigh->lock); 1597 1598 neigh_release(neigh); 1599 } 1600 1601 rd_len = min_t(unsigned int, 1602 IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen, 1603 skb->len + 8); 1604 rd_len &= ~0x7; 1605 optlen += rd_len; 1606 1607 buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 1608 if (!buff) 1609 goto release; 1610 1611 msg = (struct rd_msg *)skb_put(buff, sizeof(*msg)); 1612 *msg = (struct rd_msg) { 1613 .icmph = { 1614 .icmp6_type = NDISC_REDIRECT, 1615 }, 1616 .target = *target, 1617 .dest = ipv6_hdr(skb)->daddr, 1618 }; 1619 1620 /* 1621 * include target_address option 1622 */ 1623 1624 if (ha) 1625 ndisc_fill_redirect_addr_option(buff, ha, ops_data); 1626 1627 /* 1628 * build redirect option and copy skb over to the new packet. 1629 */ 1630 1631 if (rd_len) 1632 ndisc_fill_redirect_hdr_option(buff, skb, rd_len); 1633 1634 skb_dst_set(buff, dst); 1635 ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf); 1636 return; 1637 1638 release: 1639 dst_release(dst); 1640 } 1641 1642 static void pndisc_redo(struct sk_buff *skb) 1643 { 1644 ndisc_recv_ns(skb); 1645 kfree_skb(skb); 1646 } 1647 1648 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb) 1649 { 1650 struct inet6_dev *idev = __in6_dev_get(skb->dev); 1651 1652 if (!idev) 1653 return true; 1654 if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED && 1655 idev->cnf.suppress_frag_ndisc) { 1656 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n"); 1657 return true; 1658 } 1659 return false; 1660 } 1661 1662 int ndisc_rcv(struct sk_buff *skb) 1663 { 1664 struct nd_msg *msg; 1665 1666 if (ndisc_suppress_frag_ndisc(skb)) 1667 return 0; 1668 1669 if (skb_linearize(skb)) 1670 return 0; 1671 1672 msg = (struct nd_msg *)skb_transport_header(skb); 1673 1674 __skb_push(skb, skb->data - skb_transport_header(skb)); 1675 1676 if (ipv6_hdr(skb)->hop_limit != 255) { 1677 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n", 1678 ipv6_hdr(skb)->hop_limit); 1679 return 0; 1680 } 1681 1682 if (msg->icmph.icmp6_code != 0) { 1683 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n", 1684 msg->icmph.icmp6_code); 1685 return 0; 1686 } 1687 1688 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb)); 1689 1690 switch (msg->icmph.icmp6_type) { 1691 case NDISC_NEIGHBOUR_SOLICITATION: 1692 ndisc_recv_ns(skb); 1693 break; 1694 1695 case NDISC_NEIGHBOUR_ADVERTISEMENT: 1696 ndisc_recv_na(skb); 1697 break; 1698 1699 case NDISC_ROUTER_SOLICITATION: 1700 ndisc_recv_rs(skb); 1701 break; 1702 1703 case NDISC_ROUTER_ADVERTISEMENT: 1704 ndisc_router_discovery(skb); 1705 break; 1706 1707 case NDISC_REDIRECT: 1708 ndisc_redirect_rcv(skb); 1709 break; 1710 } 1711 1712 return 0; 1713 } 1714 1715 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) 1716 { 1717 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1718 struct netdev_notifier_change_info *change_info; 1719 struct net *net = dev_net(dev); 1720 struct inet6_dev *idev; 1721 1722 switch (event) { 1723 case NETDEV_CHANGEADDR: 1724 neigh_changeaddr(&nd_tbl, dev); 1725 fib6_run_gc(0, net, false); 1726 idev = in6_dev_get(dev); 1727 if (!idev) 1728 break; 1729 if (idev->cnf.ndisc_notify) 1730 ndisc_send_unsol_na(dev); 1731 in6_dev_put(idev); 1732 break; 1733 case NETDEV_CHANGE: 1734 change_info = ptr; 1735 if (change_info->flags_changed & IFF_NOARP) 1736 neigh_changeaddr(&nd_tbl, dev); 1737 break; 1738 case NETDEV_DOWN: 1739 neigh_ifdown(&nd_tbl, dev); 1740 fib6_run_gc(0, net, false); 1741 break; 1742 case NETDEV_NOTIFY_PEERS: 1743 ndisc_send_unsol_na(dev); 1744 break; 1745 default: 1746 break; 1747 } 1748 1749 return NOTIFY_DONE; 1750 } 1751 1752 static struct notifier_block ndisc_netdev_notifier = { 1753 .notifier_call = ndisc_netdev_event, 1754 }; 1755 1756 #ifdef CONFIG_SYSCTL 1757 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl, 1758 const char *func, const char *dev_name) 1759 { 1760 static char warncomm[TASK_COMM_LEN]; 1761 static int warned; 1762 if (strcmp(warncomm, current->comm) && warned < 5) { 1763 strcpy(warncomm, current->comm); 1764 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n", 1765 warncomm, func, 1766 dev_name, ctl->procname, 1767 dev_name, ctl->procname); 1768 warned++; 1769 } 1770 } 1771 1772 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos) 1773 { 1774 struct net_device *dev = ctl->extra1; 1775 struct inet6_dev *idev; 1776 int ret; 1777 1778 if ((strcmp(ctl->procname, "retrans_time") == 0) || 1779 (strcmp(ctl->procname, "base_reachable_time") == 0)) 1780 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default"); 1781 1782 if (strcmp(ctl->procname, "retrans_time") == 0) 1783 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos); 1784 1785 else if (strcmp(ctl->procname, "base_reachable_time") == 0) 1786 ret = neigh_proc_dointvec_jiffies(ctl, write, 1787 buffer, lenp, ppos); 1788 1789 else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) || 1790 (strcmp(ctl->procname, "base_reachable_time_ms") == 0)) 1791 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, 1792 buffer, lenp, ppos); 1793 else 1794 ret = -1; 1795 1796 if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) { 1797 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME)) 1798 idev->nd_parms->reachable_time = 1799 neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME)); 1800 idev->tstamp = jiffies; 1801 inet6_ifinfo_notify(RTM_NEWLINK, idev); 1802 in6_dev_put(idev); 1803 } 1804 return ret; 1805 } 1806 1807 1808 #endif 1809 1810 static int __net_init ndisc_net_init(struct net *net) 1811 { 1812 struct ipv6_pinfo *np; 1813 struct sock *sk; 1814 int err; 1815 1816 err = inet_ctl_sock_create(&sk, PF_INET6, 1817 SOCK_RAW, IPPROTO_ICMPV6, net); 1818 if (err < 0) { 1819 ND_PRINTK(0, err, 1820 "NDISC: Failed to initialize the control socket (err %d)\n", 1821 err); 1822 return err; 1823 } 1824 1825 net->ipv6.ndisc_sk = sk; 1826 1827 np = inet6_sk(sk); 1828 np->hop_limit = 255; 1829 /* Do not loopback ndisc messages */ 1830 np->mc_loop = 0; 1831 1832 return 0; 1833 } 1834 1835 static void __net_exit ndisc_net_exit(struct net *net) 1836 { 1837 inet_ctl_sock_destroy(net->ipv6.ndisc_sk); 1838 } 1839 1840 static struct pernet_operations ndisc_net_ops = { 1841 .init = ndisc_net_init, 1842 .exit = ndisc_net_exit, 1843 }; 1844 1845 int __init ndisc_init(void) 1846 { 1847 int err; 1848 1849 err = register_pernet_subsys(&ndisc_net_ops); 1850 if (err) 1851 return err; 1852 /* 1853 * Initialize the neighbour table 1854 */ 1855 neigh_table_init(NEIGH_ND_TABLE, &nd_tbl); 1856 1857 #ifdef CONFIG_SYSCTL 1858 err = neigh_sysctl_register(NULL, &nd_tbl.parms, 1859 ndisc_ifinfo_sysctl_change); 1860 if (err) 1861 goto out_unregister_pernet; 1862 out: 1863 #endif 1864 return err; 1865 1866 #ifdef CONFIG_SYSCTL 1867 out_unregister_pernet: 1868 unregister_pernet_subsys(&ndisc_net_ops); 1869 goto out; 1870 #endif 1871 } 1872 1873 int __init ndisc_late_init(void) 1874 { 1875 return register_netdevice_notifier(&ndisc_netdev_notifier); 1876 } 1877 1878 void ndisc_late_cleanup(void) 1879 { 1880 unregister_netdevice_notifier(&ndisc_netdev_notifier); 1881 } 1882 1883 void ndisc_cleanup(void) 1884 { 1885 #ifdef CONFIG_SYSCTL 1886 neigh_sysctl_unregister(&nd_tbl.parms); 1887 #endif 1888 neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl); 1889 unregister_pernet_subsys(&ndisc_net_ops); 1890 } 1891