?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[SK_BUFF]: More skb_put related skb_reset_transport_header
[linux-2.6/kvm.git] / net / ipv6 / ndisc.c
blobf8e619772fb4795021a1cc5d8c4eba4bce3234cc
1 /*
2 * Neighbour Discovery for IPv6
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 * Mike Shaver <shaver@ingenia.com>
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; either version
12 * 2 of the License, or (at your option) any later version.
13 */
14
15 /*
16 * Changes:
17 *
18 * Lars Fenneberg : fixed MTU setting on receipt
19 * of an RA.
20 *
21 * Janos Farkas : kmalloc failure checks
22 * Alexey Kuznetsov : state machine reworked
23 * and moved to net/core.
24 * Pekka Savola : RFC2461 validation
25 * YOSHIFUJI Hideaki @USAGI : Verify ND options properly
26 */
27
28 /* Set to 3 to get tracing... */
29 #define ND_DEBUG 1
30
31 #define ND_PRINTK(fmt, args...) do { if (net_ratelimit()) { printk(fmt, ## args); } } while(0)
32 #define ND_NOPRINTK(x...) do { ; } while(0)
33 #define ND_PRINTK0 ND_PRINTK
34 #define ND_PRINTK1 ND_NOPRINTK
35 #define ND_PRINTK2 ND_NOPRINTK
36 #define ND_PRINTK3 ND_NOPRINTK
37 #if ND_DEBUG >= 1
38 #undef ND_PRINTK1
39 #define ND_PRINTK1 ND_PRINTK
40 #endif
41 #if ND_DEBUG >= 2
42 #undef ND_PRINTK2
43 #define ND_PRINTK2 ND_PRINTK
44 #endif
45 #if ND_DEBUG >= 3
46 #undef ND_PRINTK3
47 #define ND_PRINTK3 ND_PRINTK
48 #endif
49
50 #include <linux/module.h>
51 #include <linux/errno.h>
52 #include <linux/types.h>
53 #include <linux/socket.h>
54 #include <linux/sockios.h>
55 #include <linux/sched.h>
56 #include <linux/net.h>
57 #include <linux/in6.h>
58 #include <linux/route.h>
59 #include <linux/init.h>
60 #include <linux/rcupdate.h>
61 #ifdef CONFIG_SYSCTL
62 #include <linux/sysctl.h>
63 #endif
64
65 #include <linux/if_addr.h>
66 #include <linux/if_arp.h>
67 #include <linux/ipv6.h>
68 #include <linux/icmpv6.h>
69 #include <linux/jhash.h>
70
71 #include <net/sock.h>
72 #include <net/snmp.h>
73
74 #include <net/ipv6.h>
75 #include <net/protocol.h>
76 #include <net/ndisc.h>
77 #include <net/ip6_route.h>
78 #include <net/addrconf.h>
79 #include <net/icmp.h>
80
81 #include <net/flow.h>
82 #include <net/ip6_checksum.h>
83 #include <linux/proc_fs.h>
84
85 #include <linux/netfilter.h>
86 #include <linux/netfilter_ipv6.h>
87
88 static struct socket *ndisc_socket;
89
90 static u32 ndisc_hash(const void *pkey, const struct net_device *dev);
91 static int ndisc_constructor(struct neighbour *neigh);
92 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
93 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
94 static int pndisc_constructor(struct pneigh_entry *n);
95 static void pndisc_destructor(struct pneigh_entry *n);
96 static void pndisc_redo(struct sk_buff *skb);
97
98 static struct neigh_ops ndisc_generic_ops = {
99 .family = AF_INET6,
100 .solicit = ndisc_solicit,
101 .error_report = ndisc_error_report,
102 .output = neigh_resolve_output,
103 .connected_output = neigh_connected_output,
104 .hh_output = dev_queue_xmit,
105 .queue_xmit = dev_queue_xmit,
106 };
107
108 static struct neigh_ops ndisc_hh_ops = {
109 .family = AF_INET6,
110 .solicit = ndisc_solicit,
111 .error_report = ndisc_error_report,
112 .output = neigh_resolve_output,
113 .connected_output = neigh_resolve_output,
114 .hh_output = dev_queue_xmit,
115 .queue_xmit = dev_queue_xmit,
116 };
117
118
119 static struct neigh_ops ndisc_direct_ops = {
120 .family = AF_INET6,
121 .output = dev_queue_xmit,
122 .connected_output = dev_queue_xmit,
123 .hh_output = dev_queue_xmit,
124 .queue_xmit = dev_queue_xmit,
125 };
126
127 struct neigh_table nd_tbl = {
128 .family = AF_INET6,
129 .entry_size = sizeof(struct neighbour) + sizeof(struct in6_addr),
130 .key_len = sizeof(struct in6_addr),
131 .hash = ndisc_hash,
132 .constructor = ndisc_constructor,
133 .pconstructor = pndisc_constructor,
134 .pdestructor = pndisc_destructor,
135 .proxy_redo = pndisc_redo,
136 .id = "ndisc_cache",
137 .parms = {
138 .tbl = &nd_tbl,
139 .base_reachable_time = 30 * HZ,
140 .retrans_time = 1 * HZ,
141 .gc_staletime = 60 * HZ,
142 .reachable_time = 30 * HZ,
143 .delay_probe_time = 5 * HZ,
144 .queue_len = 3,
145 .ucast_probes = 3,
146 .mcast_probes = 3,
147 .anycast_delay = 1 * HZ,
148 .proxy_delay = (8 * HZ) / 10,
149 .proxy_qlen = 64,
150 },
151 .gc_interval = 30 * HZ,
152 .gc_thresh1 = 128,
153 .gc_thresh2 = 512,
154 .gc_thresh3 = 1024,
155 };
156
157 /* ND options */
158 struct ndisc_options {
159 struct nd_opt_hdr *nd_opt_array[__ND_OPT_ARRAY_MAX];
160 #ifdef CONFIG_IPV6_ROUTE_INFO
161 struct nd_opt_hdr *nd_opts_ri;
162 struct nd_opt_hdr *nd_opts_ri_end;
163 #endif
164 };
165
166 #define nd_opts_src_lladdr nd_opt_array[ND_OPT_SOURCE_LL_ADDR]
167 #define nd_opts_tgt_lladdr nd_opt_array[ND_OPT_TARGET_LL_ADDR]
168 #define nd_opts_pi nd_opt_array[ND_OPT_PREFIX_INFO]
169 #define nd_opts_pi_end nd_opt_array[__ND_OPT_PREFIX_INFO_END]
170 #define nd_opts_rh nd_opt_array[ND_OPT_REDIRECT_HDR]
171 #define nd_opts_mtu nd_opt_array[ND_OPT_MTU]
172
173 #define NDISC_OPT_SPACE(len) (((len)+2+7)&~7)
174
175 /*
176 * Return the padding between the option length and the start of the
177 * link addr. Currently only IP-over-InfiniBand needs this, although
178 * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
179 * also need a pad of 2.
180 */
181 static int ndisc_addr_option_pad(unsigned short type)
182 {
183 switch (type) {
184 case ARPHRD_INFINIBAND: return 2;
185 default: return 0;
186 }
187 }
188
189 static inline int ndisc_opt_addr_space(struct net_device *dev)
190 {
191 return NDISC_OPT_SPACE(dev->addr_len + ndisc_addr_option_pad(dev->type));
192 }
193
194 static u8 *ndisc_fill_addr_option(u8 *opt, int type, void *data, int data_len,
195 unsigned short addr_type)
196 {
197 int space = NDISC_OPT_SPACE(data_len);
198 int pad = ndisc_addr_option_pad(addr_type);
199
200 opt[0] = type;
201 opt[1] = space>>3;
202
203 memset(opt + 2, 0, pad);
204 opt += pad;
205 space -= pad;
206
207 memcpy(opt+2, data, data_len);
208 data_len += 2;
209 opt += data_len;
210 if ((space -= data_len) > 0)
211 memset(opt, 0, space);
212 return opt + space;
213 }
214
215 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
216 struct nd_opt_hdr *end)
217 {
218 int type;
219 if (!cur || !end || cur >= end)
220 return NULL;
221 type = cur->nd_opt_type;
222 do {
223 cur = ((void *)cur) + (cur->nd_opt_len << 3);
224 } while(cur < end && cur->nd_opt_type != type);
225 return (cur <= end && cur->nd_opt_type == type ? cur : NULL);
226 }
227
228 static struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
229 struct ndisc_options *ndopts)
230 {
231 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
232
233 if (!nd_opt || opt_len < 0 || !ndopts)
234 return NULL;
235 memset(ndopts, 0, sizeof(*ndopts));
236 while (opt_len) {
237 int l;
238 if (opt_len < sizeof(struct nd_opt_hdr))
239 return NULL;
240 l = nd_opt->nd_opt_len << 3;
241 if (opt_len < l || l == 0)
242 return NULL;
243 switch (nd_opt->nd_opt_type) {
244 case ND_OPT_SOURCE_LL_ADDR:
245 case ND_OPT_TARGET_LL_ADDR:
246 case ND_OPT_MTU:
247 case ND_OPT_REDIRECT_HDR:
248 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
249 ND_PRINTK2(KERN_WARNING
250 "%s(): duplicated ND6 option found: type=%d\n",
251 __FUNCTION__,
252 nd_opt->nd_opt_type);
253 } else {
254 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
255 }
256 break;
257 case ND_OPT_PREFIX_INFO:
258 ndopts->nd_opts_pi_end = nd_opt;
259 if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0)
260 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
261 break;
262 #ifdef CONFIG_IPV6_ROUTE_INFO
263 case ND_OPT_ROUTE_INFO:
264 ndopts->nd_opts_ri_end = nd_opt;
265 if (!ndopts->nd_opts_ri)
266 ndopts->nd_opts_ri = nd_opt;
267 break;
268 #endif
269 default:
270 /*
271 * Unknown options must be silently ignored,
272 * to accommodate future extension to the protocol.
273 */
274 ND_PRINTK2(KERN_NOTICE
275 "%s(): ignored unsupported option; type=%d, len=%d\n",
276 __FUNCTION__,
277 nd_opt->nd_opt_type, nd_opt->nd_opt_len);
278 }
279 opt_len -= l;
280 nd_opt = ((void *)nd_opt) + l;
281 }
282 return ndopts;
283 }
284
285 static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
286 struct net_device *dev)
287 {
288 u8 *lladdr = (u8 *)(p + 1);
289 int lladdrlen = p->nd_opt_len << 3;
290 int prepad = ndisc_addr_option_pad(dev->type);
291 if (lladdrlen != NDISC_OPT_SPACE(dev->addr_len + prepad))
292 return NULL;
293 return (lladdr + prepad);
294 }
295
296 int ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
297 {
298 switch (dev->type) {
299 case ARPHRD_ETHER:
300 case ARPHRD_IEEE802: /* Not sure. Check it later. --ANK */
301 case ARPHRD_FDDI:
302 ipv6_eth_mc_map(addr, buf);
303 return 0;
304 case ARPHRD_IEEE802_TR:
305 ipv6_tr_mc_map(addr,buf);
306 return 0;
307 case ARPHRD_ARCNET:
308 ipv6_arcnet_mc_map(addr, buf);
309 return 0;
310 case ARPHRD_INFINIBAND:
311 ipv6_ib_mc_map(addr, buf);
312 return 0;
313 default:
314 if (dir) {
315 memcpy(buf, dev->broadcast, dev->addr_len);
316 return 0;
317 }
318 }
319 return -EINVAL;
320 }
321
322 EXPORT_SYMBOL(ndisc_mc_map);
323
324 static u32 ndisc_hash(const void *pkey, const struct net_device *dev)
325 {
326 const u32 *p32 = pkey;
327 u32 addr_hash, i;
328
329 addr_hash = 0;
330 for (i = 0; i < (sizeof(struct in6_addr) / sizeof(u32)); i++)
331 addr_hash ^= *p32++;
332
333 return jhash_2words(addr_hash, dev->ifindex, nd_tbl.hash_rnd);
334 }
335
336 static int ndisc_constructor(struct neighbour *neigh)
337 {
338 struct in6_addr *addr = (struct in6_addr*)&neigh->primary_key;
339 struct net_device *dev = neigh->dev;
340 struct inet6_dev *in6_dev;
341 struct neigh_parms *parms;
342 int is_multicast = ipv6_addr_is_multicast(addr);
343
344 rcu_read_lock();
345 in6_dev = in6_dev_get(dev);
346 if (in6_dev == NULL) {
347 rcu_read_unlock();
348 return -EINVAL;
349 }
350
351 parms = in6_dev->nd_parms;
352 __neigh_parms_put(neigh->parms);
353 neigh->parms = neigh_parms_clone(parms);
354 rcu_read_unlock();
355
356 neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
357 if (dev->hard_header == NULL) {
358 neigh->nud_state = NUD_NOARP;
359 neigh->ops = &ndisc_direct_ops;
360 neigh->output = neigh->ops->queue_xmit;
361 } else {
362 if (is_multicast) {
363 neigh->nud_state = NUD_NOARP;
364 ndisc_mc_map(addr, neigh->ha, dev, 1);
365 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
366 neigh->nud_state = NUD_NOARP;
367 memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
368 if (dev->flags&IFF_LOOPBACK)
369 neigh->type = RTN_LOCAL;
370 } else if (dev->flags&IFF_POINTOPOINT) {
371 neigh->nud_state = NUD_NOARP;
372 memcpy(neigh->ha, dev->broadcast, dev->addr_len);
373 }
374 if (dev->hard_header_cache)
375 neigh->ops = &ndisc_hh_ops;
376 else
377 neigh->ops = &ndisc_generic_ops;
378 if (neigh->nud_state&NUD_VALID)
379 neigh->output = neigh->ops->connected_output;
380 else
381 neigh->output = neigh->ops->output;
382 }
383 in6_dev_put(in6_dev);
384 return 0;
385 }
386
387 static int pndisc_constructor(struct pneigh_entry *n)
388 {
389 struct in6_addr *addr = (struct in6_addr*)&n->key;
390 struct in6_addr maddr;
391 struct net_device *dev = n->dev;
392
393 if (dev == NULL || __in6_dev_get(dev) == NULL)
394 return -EINVAL;
395 addrconf_addr_solict_mult(addr, &maddr);
396 ipv6_dev_mc_inc(dev, &maddr);
397 return 0;
398 }
399
400 static void pndisc_destructor(struct pneigh_entry *n)
401 {
402 struct in6_addr *addr = (struct in6_addr*)&n->key;
403 struct in6_addr maddr;
404 struct net_device *dev = n->dev;
405
406 if (dev == NULL || __in6_dev_get(dev) == NULL)
407 return;
408 addrconf_addr_solict_mult(addr, &maddr);
409 ipv6_dev_mc_dec(dev, &maddr);
410 }
411
412 /*
413 * Send a Neighbour Advertisement
414 */
415
416 static inline void ndisc_flow_init(struct flowi *fl, u8 type,
417 struct in6_addr *saddr, struct in6_addr *daddr,
418 int oif)
419 {
420 memset(fl, 0, sizeof(*fl));
421 ipv6_addr_copy(&fl->fl6_src, saddr);
422 ipv6_addr_copy(&fl->fl6_dst, daddr);
423 fl->proto = IPPROTO_ICMPV6;
424 fl->fl_icmp_type = type;
425 fl->fl_icmp_code = 0;
426 fl->oif = oif;
427 security_sk_classify_flow(ndisc_socket->sk, fl);
428 }
429
430 static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
431 struct in6_addr *daddr, struct in6_addr *solicited_addr,
432 int router, int solicited, int override, int inc_opt)
433 {
434 struct in6_addr tmpaddr;
435 struct inet6_ifaddr *ifp;
436 struct inet6_dev *idev;
437 struct flowi fl;
438 struct dst_entry* dst;
439 struct sock *sk = ndisc_socket->sk;
440 struct in6_addr *src_addr;
441 struct nd_msg *msg;
442 int len;
443 struct sk_buff *skb;
444 int err;
445
446 len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
447
448 /* for anycast or proxy, solicited_addr != src_addr */
449 ifp = ipv6_get_ifaddr(solicited_addr, dev, 1);
450 if (ifp) {
451 src_addr = solicited_addr;
452 if (ifp->flags & IFA_F_OPTIMISTIC)
453 override = 0;
454 in6_ifa_put(ifp);
455 } else {
456 if (ipv6_dev_get_saddr(dev, daddr, &tmpaddr))
457 return;
458 src_addr = &tmpaddr;
459 }
460
461 ndisc_flow_init(&fl, NDISC_NEIGHBOUR_ADVERTISEMENT, src_addr, daddr,
462 dev->ifindex);
463
464 dst = ndisc_dst_alloc(dev, neigh, daddr, ip6_output);
465 if (!dst)
466 return;
467
468 err = xfrm_lookup(&dst, &fl, NULL, 0);
469 if (err < 0)
470 return;
471
472 if (inc_opt) {
473 if (dev->addr_len)
474 len += ndisc_opt_addr_space(dev);
475 else
476 inc_opt = 0;
477 }
478
479 skb = sock_alloc_send_skb(sk,
480 (MAX_HEADER + sizeof(struct ipv6hdr) +
481 len + LL_RESERVED_SPACE(dev)),
482 1, &err);
483
484 if (skb == NULL) {
485 ND_PRINTK0(KERN_ERR
486 "ICMPv6 NA: %s() failed to allocate an skb.\n",
487 __FUNCTION__);
488 dst_release(dst);
489 return;
490 }
491
492 skb_reserve(skb, LL_RESERVED_SPACE(dev));
493 ip6_nd_hdr(sk, skb, dev, src_addr, daddr, IPPROTO_ICMPV6, len);
494
495 skb_set_transport_header(skb, skb->tail - skb->data);
496 skb_put(skb, len);
497 msg = (struct nd_msg *)skb_transport_header(skb);
498
499 msg->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
500 msg->icmph.icmp6_code = 0;
501 msg->icmph.icmp6_cksum = 0;
502
503 msg->icmph.icmp6_unused = 0;
504 msg->icmph.icmp6_router = router;
505 msg->icmph.icmp6_solicited = solicited;
506 msg->icmph.icmp6_override = override;
507
508 /* Set the target address. */
509 ipv6_addr_copy(&msg->target, solicited_addr);
510
511 if (inc_opt)
512 ndisc_fill_addr_option(msg->opt, ND_OPT_TARGET_LL_ADDR, dev->dev_addr,
513 dev->addr_len, dev->type);
514
515 /* checksum */
516 msg->icmph.icmp6_cksum = csum_ipv6_magic(src_addr, daddr, len,
517 IPPROTO_ICMPV6,
518 csum_partial((__u8 *) msg,
519 len, 0));
520
521 skb->dst = dst;
522 idev = in6_dev_get(dst->dev);
523 IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
524 err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, dst_output);
525 if (!err) {
526 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTNEIGHBORADVERTISEMENTS);
527 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
528 }
529
530 if (likely(idev != NULL))
531 in6_dev_put(idev);
532 }
533
534 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
535 struct in6_addr *solicit,
536 struct in6_addr *daddr, struct in6_addr *saddr)
537 {
538 struct flowi fl;
539 struct dst_entry* dst;
540 struct inet6_dev *idev;
541 struct sock *sk = ndisc_socket->sk;
542 struct sk_buff *skb;
543 struct nd_msg *msg;
544 struct in6_addr addr_buf;
545 int len;
546 int err;
547 int send_llinfo;
548
549 if (saddr == NULL) {
550 if (ipv6_get_lladdr(dev, &addr_buf,
551 (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)))
552 return;
553 saddr = &addr_buf;
554 }
555
556 ndisc_flow_init(&fl, NDISC_NEIGHBOUR_SOLICITATION, saddr, daddr,
557 dev->ifindex);
558
559 dst = ndisc_dst_alloc(dev, neigh, daddr, ip6_output);
560 if (!dst)
561 return;
562
563 err = xfrm_lookup(&dst, &fl, NULL, 0);
564 if (err < 0)
565 return;
566
567 len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
568 send_llinfo = dev->addr_len && !ipv6_addr_any(saddr);
569 if (send_llinfo)
570 len += ndisc_opt_addr_space(dev);
571
572 skb = sock_alloc_send_skb(sk,
573 (MAX_HEADER + sizeof(struct ipv6hdr) +
574 len + LL_RESERVED_SPACE(dev)),
575 1, &err);
576 if (skb == NULL) {
577 ND_PRINTK0(KERN_ERR
578 "ICMPv6 NA: %s() failed to allocate an skb.\n",
579 __FUNCTION__);
580 dst_release(dst);
581 return;
582 }
583
584 skb_reserve(skb, LL_RESERVED_SPACE(dev));
585 ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
586
587 skb_set_transport_header(skb, skb->tail - skb->data);
588 skb_put(skb, len);
589 msg = (struct nd_msg *)skb_transport_header(skb);
590 msg->icmph.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION;
591 msg->icmph.icmp6_code = 0;
592 msg->icmph.icmp6_cksum = 0;
593 msg->icmph.icmp6_unused = 0;
594
595 /* Set the target address. */
596 ipv6_addr_copy(&msg->target, solicit);
597
598 if (send_llinfo)
599 ndisc_fill_addr_option(msg->opt, ND_OPT_SOURCE_LL_ADDR, dev->dev_addr,
600 dev->addr_len, dev->type);
601
602 /* checksum */
603 msg->icmph.icmp6_cksum = csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
604 daddr, len,
605 IPPROTO_ICMPV6,
606 csum_partial((__u8 *) msg,
607 len, 0));
608 /* send it! */
609 skb->dst = dst;
610 idev = in6_dev_get(dst->dev);
611 IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
612 err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, dst_output);
613 if (!err) {
614 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTNEIGHBORSOLICITS);
615 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
616 }
617
618 if (likely(idev != NULL))
619 in6_dev_put(idev);
620 }
621
622 void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
623 struct in6_addr *daddr)
624 {
625 struct flowi fl;
626 struct dst_entry* dst;
627 struct inet6_dev *idev;
628 struct sock *sk = ndisc_socket->sk;
629 struct sk_buff *skb;
630 struct icmp6hdr *hdr;
631 __u8 * opt;
632 int send_sllao = dev->addr_len;
633 int len;
634 int err;
635
636
637 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
638 /*
639 * According to section 2.2 of RFC 4429, we must not
640 * send router solicitations with a sllao from
641 * optimistic addresses, but we may send the solicitation
642 * if we don't include the sllao. So here we check
643 * if our address is optimistic, and if so, we
644 * supress the inclusion of the sllao.
645 */
646 if (send_sllao) {
647 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(saddr, dev, 1);
648 if (ifp) {
649 if (ifp->flags & IFA_F_OPTIMISTIC) {
650 send_sllao = 0;
651 }
652 in6_ifa_put(ifp);
653 } else {
654 send_sllao = 0;
655 }
656 }
657 #endif
658 ndisc_flow_init(&fl, NDISC_ROUTER_SOLICITATION, saddr, daddr,
659 dev->ifindex);
660
661 dst = ndisc_dst_alloc(dev, NULL, daddr, ip6_output);
662 if (!dst)
663 return;
664
665 err = xfrm_lookup(&dst, &fl, NULL, 0);
666 if (err < 0)
667 return;
668
669 len = sizeof(struct icmp6hdr);
670 if (send_sllao)
671 len += ndisc_opt_addr_space(dev);
672
673 skb = sock_alloc_send_skb(sk,
674 (MAX_HEADER + sizeof(struct ipv6hdr) +
675 len + LL_RESERVED_SPACE(dev)),
676 1, &err);
677 if (skb == NULL) {
678 ND_PRINTK0(KERN_ERR
679 "ICMPv6 RS: %s() failed to allocate an skb.\n",
680 __FUNCTION__);
681 dst_release(dst);
682 return;
683 }
684
685 skb_reserve(skb, LL_RESERVED_SPACE(dev));
686 ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
687
688 skb_set_transport_header(skb, skb->tail - skb->data);
689 skb_put(skb, len);
690 hdr = icmp6_hdr(skb);
691 hdr->icmp6_type = NDISC_ROUTER_SOLICITATION;
692 hdr->icmp6_code = 0;
693 hdr->icmp6_cksum = 0;
694 hdr->icmp6_unused = 0;
695
696 opt = (u8*) (hdr + 1);
697
698 if (send_sllao)
699 ndisc_fill_addr_option(opt, ND_OPT_SOURCE_LL_ADDR, dev->dev_addr,
700 dev->addr_len, dev->type);
701
702 /* checksum */
703 hdr->icmp6_cksum = csum_ipv6_magic(&ipv6_hdr(skb)->saddr, daddr, len,
704 IPPROTO_ICMPV6,
705 csum_partial((__u8 *) hdr, len, 0));
706
707 /* send it! */
708 skb->dst = dst;
709 idev = in6_dev_get(dst->dev);
710 IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
711 err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, dst_output);
712 if (!err) {
713 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTROUTERSOLICITS);
714 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
715 }
716
717 if (likely(idev != NULL))
718 in6_dev_put(idev);
719 }
720
721
722 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
723 {
724 /*
725 * "The sender MUST return an ICMP
726 * destination unreachable"
727 */
728 dst_link_failure(skb);
729 kfree_skb(skb);
730 }
731
732 /* Called with locked neigh: either read or both */
733
734 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
735 {
736 struct in6_addr *saddr = NULL;
737 struct in6_addr mcaddr;
738 struct net_device *dev = neigh->dev;
739 struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
740 int probes = atomic_read(&neigh->probes);
741
742 if (skb && ipv6_chk_addr(&ipv6_hdr(skb)->saddr, dev, 1))
743 saddr = &ipv6_hdr(skb)->saddr;
744
745 if ((probes -= neigh->parms->ucast_probes) < 0) {
746 if (!(neigh->nud_state & NUD_VALID)) {
747 ND_PRINTK1(KERN_DEBUG
748 "%s(): trying to ucast probe in NUD_INVALID: "
749 NIP6_FMT "\n",
750 __FUNCTION__,
751 NIP6(*target));
752 }
753 ndisc_send_ns(dev, neigh, target, target, saddr);
754 } else if ((probes -= neigh->parms->app_probes) < 0) {
755 #ifdef CONFIG_ARPD
756 neigh_app_ns(neigh);
757 #endif
758 } else {
759 addrconf_addr_solict_mult(target, &mcaddr);
760 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
761 }
762 }
763
764 static void ndisc_recv_ns(struct sk_buff *skb)
765 {
766 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
767 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
768 struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
769 u8 *lladdr = NULL;
770 u32 ndoptlen = skb->tail - msg->opt;
771 struct ndisc_options ndopts;
772 struct net_device *dev = skb->dev;
773 struct inet6_ifaddr *ifp;
774 struct inet6_dev *idev = NULL;
775 struct neighbour *neigh;
776 struct pneigh_entry *pneigh = NULL;
777 int dad = ipv6_addr_any(saddr);
778 int inc;
779 int is_router;
780
781 if (ipv6_addr_is_multicast(&msg->target)) {
782 ND_PRINTK2(KERN_WARNING
783 "ICMPv6 NS: multicast target address");
784 return;
785 }
786
787 /*
788 * RFC2461 7.1.1:
789 * DAD has to be destined for solicited node multicast address.
790 */
791 if (dad &&
792 !(daddr->s6_addr32[0] == htonl(0xff020000) &&
793 daddr->s6_addr32[1] == htonl(0x00000000) &&
794 daddr->s6_addr32[2] == htonl(0x00000001) &&
795 daddr->s6_addr [12] == 0xff )) {
796 ND_PRINTK2(KERN_WARNING
797 "ICMPv6 NS: bad DAD packet (wrong destination)\n");
798 return;
799 }
800
801 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
802 ND_PRINTK2(KERN_WARNING
803 "ICMPv6 NS: invalid ND options\n");
804 return;
805 }
806
807 if (ndopts.nd_opts_src_lladdr) {
808 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
809 if (!lladdr) {
810 ND_PRINTK2(KERN_WARNING
811 "ICMPv6 NS: invalid link-layer address length\n");
812 return;
813 }
814
815 /* RFC2461 7.1.1:
816 * If the IP source address is the unspecified address,
817 * there MUST NOT be source link-layer address option
818 * in the message.
819 */
820 if (dad) {
821 ND_PRINTK2(KERN_WARNING
822 "ICMPv6 NS: bad DAD packet (link-layer address option)\n");
823 return;
824 }
825 }
826
827 inc = ipv6_addr_is_multicast(daddr);
828
829 if ((ifp = ipv6_get_ifaddr(&msg->target, dev, 1)) != NULL) {
830
831 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
832 if (dad) {
833 if (dev->type == ARPHRD_IEEE802_TR) {
834 const unsigned char *sadr;
835 sadr = skb_mac_header(skb);
836 if (((sadr[8] ^ dev->dev_addr[0]) & 0x7f) == 0 &&
837 sadr[9] == dev->dev_addr[1] &&
838 sadr[10] == dev->dev_addr[2] &&
839 sadr[11] == dev->dev_addr[3] &&
840 sadr[12] == dev->dev_addr[4] &&
841 sadr[13] == dev->dev_addr[5]) {
842 /* looped-back to us */
843 goto out;
844 }
845 }
846
847 /*
848 * We are colliding with another node
849 * who is doing DAD
850 * so fail our DAD process
851 */
852 addrconf_dad_failure(ifp);
853 goto out;
854 } else {
855 /*
856 * This is not a dad solicitation.
857 * If we are an optimistic node,
858 * we should respond.
859 * Otherwise, we should ignore it.
860 */
861 if (!(ifp->flags & IFA_F_OPTIMISTIC))
862 goto out;
863 }
864 }
865
866 idev = ifp->idev;
867 } else {
868 idev = in6_dev_get(dev);
869 if (!idev) {
870 /* XXX: count this drop? */
871 return;
872 }
873
874 if (ipv6_chk_acast_addr(dev, &msg->target) ||
875 (idev->cnf.forwarding &&
876 (ipv6_devconf.proxy_ndp || idev->cnf.proxy_ndp) &&
877 (pneigh = pneigh_lookup(&nd_tbl,
878 &msg->target, dev, 0)) != NULL)) {
879 if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
880 skb->pkt_type != PACKET_HOST &&
881 inc != 0 &&
882 idev->nd_parms->proxy_delay != 0) {
883 /*
884 * for anycast or proxy,
885 * sender should delay its response
886 * by a random time between 0 and
887 * MAX_ANYCAST_DELAY_TIME seconds.
888 * (RFC2461) -- yoshfuji
889 */
890 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
891 if (n)
892 pneigh_enqueue(&nd_tbl, idev->nd_parms, n);
893 goto out;
894 }
895 } else
896 goto out;
897 }
898
899 is_router = !!(pneigh ? pneigh->flags & NTF_ROUTER : idev->cnf.forwarding);
900
901 if (dad) {
902 struct in6_addr maddr;
903
904 ipv6_addr_all_nodes(&maddr);
905 ndisc_send_na(dev, NULL, &maddr, &msg->target,
906 is_router, 0, (ifp != NULL), 1);
907 goto out;
908 }
909
910 if (inc)
911 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
912 else
913 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
914
915 /*
916 * update / create cache entry
917 * for the source address
918 */
919 neigh = __neigh_lookup(&nd_tbl, saddr, dev,
920 !inc || lladdr || !dev->addr_len);
921 if (neigh)
922 neigh_update(neigh, lladdr, NUD_STALE,
923 NEIGH_UPDATE_F_WEAK_OVERRIDE|
924 NEIGH_UPDATE_F_OVERRIDE);
925 if (neigh || !dev->hard_header) {
926 ndisc_send_na(dev, neigh, saddr, &msg->target,
927 is_router,
928 1, (ifp != NULL && inc), inc);
929 if (neigh)
930 neigh_release(neigh);
931 }
932
933 out:
934 if (ifp)
935 in6_ifa_put(ifp);
936 else
937 in6_dev_put(idev);
938
939 return;
940 }
941
942 static void ndisc_recv_na(struct sk_buff *skb)
943 {
944 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
945 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
946 struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
947 u8 *lladdr = NULL;
948 u32 ndoptlen = skb->tail - msg->opt;
949 struct ndisc_options ndopts;
950 struct net_device *dev = skb->dev;
951 struct inet6_ifaddr *ifp;
952 struct neighbour *neigh;
953
954 if (skb->len < sizeof(struct nd_msg)) {
955 ND_PRINTK2(KERN_WARNING
956 "ICMPv6 NA: packet too short\n");
957 return;
958 }
959
960 if (ipv6_addr_is_multicast(&msg->target)) {
961 ND_PRINTK2(KERN_WARNING
962 "ICMPv6 NA: target address is multicast.\n");
963 return;
964 }
965
966 if (ipv6_addr_is_multicast(daddr) &&
967 msg->icmph.icmp6_solicited) {
968 ND_PRINTK2(KERN_WARNING
969 "ICMPv6 NA: solicited NA is multicasted.\n");
970 return;
971 }
972
973 if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
974 ND_PRINTK2(KERN_WARNING
975 "ICMPv6 NS: invalid ND option\n");
976 return;
977 }
978 if (ndopts.nd_opts_tgt_lladdr) {
979 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
980 if (!lladdr) {
981 ND_PRINTK2(KERN_WARNING
982 "ICMPv6 NA: invalid link-layer address length\n");
983 return;
984 }
985 }
986 if ((ifp = ipv6_get_ifaddr(&msg->target, dev, 1))) {
987 if (ifp->flags & IFA_F_TENTATIVE) {
988 addrconf_dad_failure(ifp);
989 return;
990 }
991 /* What should we make now? The advertisement
992 is invalid, but ndisc specs say nothing
993 about it. It could be misconfiguration, or
994 an smart proxy agent tries to help us :-)
995 */
996 ND_PRINTK1(KERN_WARNING
997 "ICMPv6 NA: someone advertises our address on %s!\n",
998 ifp->idev->dev->name);
999 in6_ifa_put(ifp);
1000 return;
1001 }
1002 neigh = neigh_lookup(&nd_tbl, &msg->target, dev);
1003
1004 if (neigh) {
1005 u8 old_flags = neigh->flags;
1006
1007 if (neigh->nud_state & NUD_FAILED)
1008 goto out;
1009
1010 /*
1011 * Don't update the neighbor cache entry on a proxy NA from
1012 * ourselves because either the proxied node is off link or it
1013 * has already sent a NA to us.
1014 */
1015 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
1016 ipv6_devconf.forwarding && ipv6_devconf.proxy_ndp &&
1017 pneigh_lookup(&nd_tbl, &msg->target, dev, 0)) {
1018 /* XXX: idev->cnf.prixy_ndp */
1019 goto out;
1020 }
1021
1022 neigh_update(neigh, lladdr,
1023 msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
1024 NEIGH_UPDATE_F_WEAK_OVERRIDE|
1025 (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1026 NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1027 (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0));
1028
1029 if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1030 /*
1031 * Change: router to host
1032 */
1033 struct rt6_info *rt;
1034 rt = rt6_get_dflt_router(saddr, dev);
1035 if (rt)
1036 ip6_del_rt(rt);
1037 }
1038
1039 out:
1040 neigh_release(neigh);
1041 }
1042 }
1043
1044 static void ndisc_recv_rs(struct sk_buff *skb)
1045 {
1046 struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1047 unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1048 struct neighbour *neigh;
1049 struct inet6_dev *idev;
1050 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1051 struct ndisc_options ndopts;
1052 u8 *lladdr = NULL;
1053
1054 if (skb->len < sizeof(*rs_msg))
1055 return;
1056
1057 idev = in6_dev_get(skb->dev);
1058 if (!idev) {
1059 if (net_ratelimit())
1060 ND_PRINTK1("ICMP6 RS: can't find in6 device\n");
1061 return;
1062 }
1063
1064 /* Don't accept RS if we're not in router mode */
1065 if (!idev->cnf.forwarding)
1066 goto out;
1067
1068 /*
1069 * Don't update NCE if src = ::;
1070 * this implies that the source node has no ip address assigned yet.
1071 */
1072 if (ipv6_addr_any(saddr))
1073 goto out;
1074
1075 /* Parse ND options */
1076 if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
1077 if (net_ratelimit())
1078 ND_PRINTK2("ICMP6 NS: invalid ND option, ignored\n");
1079 goto out;
1080 }
1081
1082 if (ndopts.nd_opts_src_lladdr) {
1083 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1084 skb->dev);
1085 if (!lladdr)
1086 goto out;
1087 }
1088
1089 neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1);
1090 if (neigh) {
1091 neigh_update(neigh, lladdr, NUD_STALE,
1092 NEIGH_UPDATE_F_WEAK_OVERRIDE|
1093 NEIGH_UPDATE_F_OVERRIDE|
1094 NEIGH_UPDATE_F_OVERRIDE_ISROUTER);
1095 neigh_release(neigh);
1096 }
1097 out:
1098 in6_dev_put(idev);
1099 }
1100
1101 static void ndisc_router_discovery(struct sk_buff *skb)
1102 {
1103 struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1104 struct neighbour *neigh = NULL;
1105 struct inet6_dev *in6_dev;
1106 struct rt6_info *rt = NULL;
1107 int lifetime;
1108 struct ndisc_options ndopts;
1109 int optlen;
1110 unsigned int pref = 0;
1111
1112 __u8 * opt = (__u8 *)(ra_msg + 1);
1113
1114 optlen = (skb->tail - skb_transport_header(skb)) -
1115 sizeof(struct ra_msg);
1116
1117 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1118 ND_PRINTK2(KERN_WARNING
1119 "ICMPv6 RA: source address is not link-local.\n");
1120 return;
1121 }
1122 if (optlen < 0) {
1123 ND_PRINTK2(KERN_WARNING
1124 "ICMPv6 RA: packet too short\n");
1125 return;
1126 }
1127
1128 /*
1129 * set the RA_RECV flag in the interface
1130 */
1131
1132 in6_dev = in6_dev_get(skb->dev);
1133 if (in6_dev == NULL) {
1134 ND_PRINTK0(KERN_ERR
1135 "ICMPv6 RA: can't find inet6 device for %s.\n",
1136 skb->dev->name);
1137 return;
1138 }
1139 if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra) {
1140 in6_dev_put(in6_dev);
1141 return;
1142 }
1143
1144 if (!ndisc_parse_options(opt, optlen, &ndopts)) {
1145 in6_dev_put(in6_dev);
1146 ND_PRINTK2(KERN_WARNING
1147 "ICMP6 RA: invalid ND options\n");
1148 return;
1149 }
1150
1151 if (in6_dev->if_flags & IF_RS_SENT) {
1152 /*
1153 * flag that an RA was received after an RS was sent
1154 * out on this interface.
1155 */
1156 in6_dev->if_flags |= IF_RA_RCVD;
1157 }
1158
1159 /*
1160 * Remember the managed/otherconf flags from most recently
1161 * received RA message (RFC 2462) -- yoshfuji
1162 */
1163 in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1164 IF_RA_OTHERCONF)) |
1165 (ra_msg->icmph.icmp6_addrconf_managed ?
1166 IF_RA_MANAGED : 0) |
1167 (ra_msg->icmph.icmp6_addrconf_other ?
1168 IF_RA_OTHERCONF : 0);
1169
1170 if (!in6_dev->cnf.accept_ra_defrtr)
1171 goto skip_defrtr;
1172
1173 lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1174
1175 #ifdef CONFIG_IPV6_ROUTER_PREF
1176 pref = ra_msg->icmph.icmp6_router_pref;
1177 /* 10b is handled as if it were 00b (medium) */
1178 if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1179 in6_dev->cnf.accept_ra_rtr_pref)
1180 pref = ICMPV6_ROUTER_PREF_MEDIUM;
1181 #endif
1182
1183 rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
1184
1185 if (rt)
1186 neigh = rt->rt6i_nexthop;
1187
1188 if (rt && lifetime == 0) {
1189 neigh_clone(neigh);
1190 ip6_del_rt(rt);
1191 rt = NULL;
1192 }
1193
1194 if (rt == NULL && lifetime) {
1195 ND_PRINTK3(KERN_DEBUG
1196 "ICMPv6 RA: adding default router.\n");
1197
1198 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
1199 if (rt == NULL) {
1200 ND_PRINTK0(KERN_ERR
1201 "ICMPv6 RA: %s() failed to add default route.\n",
1202 __FUNCTION__);
1203 in6_dev_put(in6_dev);
1204 return;
1205 }
1206
1207 neigh = rt->rt6i_nexthop;
1208 if (neigh == NULL) {
1209 ND_PRINTK0(KERN_ERR
1210 "ICMPv6 RA: %s() got default router without neighbour.\n",
1211 __FUNCTION__);
1212 dst_release(&rt->u.dst);
1213 in6_dev_put(in6_dev);
1214 return;
1215 }
1216 neigh->flags |= NTF_ROUTER;
1217 } else if (rt) {
1218 rt->rt6i_flags |= (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1219 }
1220
1221 if (rt)
1222 rt->rt6i_expires = jiffies + (HZ * lifetime);
1223
1224 if (ra_msg->icmph.icmp6_hop_limit) {
1225 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1226 if (rt)
1227 rt->u.dst.metrics[RTAX_HOPLIMIT-1] = ra_msg->icmph.icmp6_hop_limit;
1228 }
1229
1230 skip_defrtr:
1231
1232 /*
1233 * Update Reachable Time and Retrans Timer
1234 */
1235
1236 if (in6_dev->nd_parms) {
1237 unsigned long rtime = ntohl(ra_msg->retrans_timer);
1238
1239 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1240 rtime = (rtime*HZ)/1000;
1241 if (rtime < HZ/10)
1242 rtime = HZ/10;
1243 in6_dev->nd_parms->retrans_time = rtime;
1244 in6_dev->tstamp = jiffies;
1245 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1246 }
1247
1248 rtime = ntohl(ra_msg->reachable_time);
1249 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1250 rtime = (rtime*HZ)/1000;
1251
1252 if (rtime < HZ/10)
1253 rtime = HZ/10;
1254
1255 if (rtime != in6_dev->nd_parms->base_reachable_time) {
1256 in6_dev->nd_parms->base_reachable_time = rtime;
1257 in6_dev->nd_parms->gc_staletime = 3 * rtime;
1258 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
1259 in6_dev->tstamp = jiffies;
1260 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
1261 }
1262 }
1263 }
1264
1265 /*
1266 * Process options.
1267 */
1268
1269 if (!neigh)
1270 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr,
1271 skb->dev, 1);
1272 if (neigh) {
1273 u8 *lladdr = NULL;
1274 if (ndopts.nd_opts_src_lladdr) {
1275 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
1276 skb->dev);
1277 if (!lladdr) {
1278 ND_PRINTK2(KERN_WARNING
1279 "ICMPv6 RA: invalid link-layer address length\n");
1280 goto out;
1281 }
1282 }
1283 neigh_update(neigh, lladdr, NUD_STALE,
1284 NEIGH_UPDATE_F_WEAK_OVERRIDE|
1285 NEIGH_UPDATE_F_OVERRIDE|
1286 NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1287 NEIGH_UPDATE_F_ISROUTER);
1288 }
1289
1290 #ifdef CONFIG_IPV6_ROUTE_INFO
1291 if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1292 struct nd_opt_hdr *p;
1293 for (p = ndopts.nd_opts_ri;
1294 p;
1295 p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
1296 if (((struct route_info *)p)->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1297 continue;
1298 rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
1299 &ipv6_hdr(skb)->saddr);
1300 }
1301 }
1302 #endif
1303
1304 if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1305 struct nd_opt_hdr *p;
1306 for (p = ndopts.nd_opts_pi;
1307 p;
1308 p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
1309 addrconf_prefix_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3);
1310 }
1311 }
1312
1313 if (ndopts.nd_opts_mtu) {
1314 __be32 n;
1315 u32 mtu;
1316
1317 memcpy(&n, ((u8*)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1318 mtu = ntohl(n);
1319
1320 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1321 ND_PRINTK2(KERN_WARNING
1322 "ICMPv6 RA: invalid mtu: %d\n",
1323 mtu);
1324 } else if (in6_dev->cnf.mtu6 != mtu) {
1325 in6_dev->cnf.mtu6 = mtu;
1326
1327 if (rt)
1328 rt->u.dst.metrics[RTAX_MTU-1] = mtu;
1329
1330 rt6_mtu_change(skb->dev, mtu);
1331 }
1332 }
1333
1334 if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1335 ND_PRINTK2(KERN_WARNING
1336 "ICMPv6 RA: invalid RA options");
1337 }
1338 out:
1339 if (rt)
1340 dst_release(&rt->u.dst);
1341 else if (neigh)
1342 neigh_release(neigh);
1343 in6_dev_put(in6_dev);
1344 }
1345
1346 static void ndisc_redirect_rcv(struct sk_buff *skb)
1347 {
1348 struct inet6_dev *in6_dev;
1349 struct icmp6hdr *icmph;
1350 struct in6_addr *dest;
1351 struct in6_addr *target; /* new first hop to destination */
1352 struct neighbour *neigh;
1353 int on_link = 0;
1354 struct ndisc_options ndopts;
1355 int optlen;
1356 u8 *lladdr = NULL;
1357
1358 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1359 ND_PRINTK2(KERN_WARNING
1360 "ICMPv6 Redirect: source address is not link-local.\n");
1361 return;
1362 }
1363
1364 optlen = skb->tail - skb_transport_header(skb);
1365 optlen -= sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
1366
1367 if (optlen < 0) {
1368 ND_PRINTK2(KERN_WARNING
1369 "ICMPv6 Redirect: packet too short\n");
1370 return;
1371 }
1372
1373 icmph = icmp6_hdr(skb);
1374 target = (struct in6_addr *) (icmph + 1);
1375 dest = target + 1;
1376
1377 if (ipv6_addr_is_multicast(dest)) {
1378 ND_PRINTK2(KERN_WARNING
1379 "ICMPv6 Redirect: destination address is multicast.\n");
1380 return;
1381 }
1382
1383 if (ipv6_addr_equal(dest, target)) {
1384 on_link = 1;
1385 } else if (!(ipv6_addr_type(target) & IPV6_ADDR_LINKLOCAL)) {
1386 ND_PRINTK2(KERN_WARNING
1387 "ICMPv6 Redirect: target address is not link-local.\n");
1388 return;
1389 }
1390
1391 in6_dev = in6_dev_get(skb->dev);
1392 if (!in6_dev)
1393 return;
1394 if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_redirects) {
1395 in6_dev_put(in6_dev);
1396 return;
1397 }
1398
1399 /* RFC2461 8.1:
1400 * The IP source address of the Redirect MUST be the same as the current
1401 * first-hop router for the specified ICMP Destination Address.
1402 */
1403
1404 if (!ndisc_parse_options((u8*)(dest + 1), optlen, &ndopts)) {
1405 ND_PRINTK2(KERN_WARNING
1406 "ICMPv6 Redirect: invalid ND options\n");
1407 in6_dev_put(in6_dev);
1408 return;
1409 }
1410 if (ndopts.nd_opts_tgt_lladdr) {
1411 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr,
1412 skb->dev);
1413 if (!lladdr) {
1414 ND_PRINTK2(KERN_WARNING
1415 "ICMPv6 Redirect: invalid link-layer address length\n");
1416 in6_dev_put(in6_dev);
1417 return;
1418 }
1419 }
1420
1421 neigh = __neigh_lookup(&nd_tbl, target, skb->dev, 1);
1422 if (neigh) {
1423 rt6_redirect(dest, &ipv6_hdr(skb)->daddr,
1424 &ipv6_hdr(skb)->saddr, neigh, lladdr,
1425 on_link);
1426 neigh_release(neigh);
1427 }
1428 in6_dev_put(in6_dev);
1429 }
1430
1431 void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
1432 struct in6_addr *target)
1433 {
1434 struct sock *sk = ndisc_socket->sk;
1435 int len = sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
1436 struct sk_buff *buff;
1437 struct icmp6hdr *icmph;
1438 struct in6_addr saddr_buf;
1439 struct in6_addr *addrp;
1440 struct net_device *dev;
1441 struct rt6_info *rt;
1442 struct dst_entry *dst;
1443 struct inet6_dev *idev;
1444 struct flowi fl;
1445 u8 *opt;
1446 int rd_len;
1447 int err;
1448 int hlen;
1449 u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
1450
1451 dev = skb->dev;
1452
1453 if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
1454 ND_PRINTK2(KERN_WARNING
1455 "ICMPv6 Redirect: no link-local address on %s\n",
1456 dev->name);
1457 return;
1458 }
1459
1460 if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
1461 !(ipv6_addr_type(target) & IPV6_ADDR_LINKLOCAL)) {
1462 ND_PRINTK2(KERN_WARNING
1463 "ICMPv6 Redirect: target address is not link-local.\n");
1464 return;
1465 }
1466
1467 ndisc_flow_init(&fl, NDISC_REDIRECT, &saddr_buf, &ipv6_hdr(skb)->saddr,
1468 dev->ifindex);
1469
1470 dst = ip6_route_output(NULL, &fl);
1471 if (dst == NULL)
1472 return;
1473
1474 err = xfrm_lookup(&dst, &fl, NULL, 0);
1475 if (err)
1476 return;
1477
1478 rt = (struct rt6_info *) dst;
1479
1480 if (rt->rt6i_flags & RTF_GATEWAY) {
1481 ND_PRINTK2(KERN_WARNING
1482 "ICMPv6 Redirect: destination is not a neighbour.\n");
1483 dst_release(dst);
1484 return;
1485 }
1486 if (!xrlim_allow(dst, 1*HZ)) {
1487 dst_release(dst);
1488 return;
1489 }
1490
1491 if (dev->addr_len) {
1492 read_lock_bh(&neigh->lock);
1493 if (neigh->nud_state & NUD_VALID) {
1494 memcpy(ha_buf, neigh->ha, dev->addr_len);
1495 read_unlock_bh(&neigh->lock);
1496 ha = ha_buf;
1497 len += ndisc_opt_addr_space(dev);
1498 } else
1499 read_unlock_bh(&neigh->lock);
1500 }
1501
1502 rd_len = min_t(unsigned int,
1503 IPV6_MIN_MTU-sizeof(struct ipv6hdr)-len, skb->len + 8);
1504 rd_len &= ~0x7;
1505 len += rd_len;
1506
1507 buff = sock_alloc_send_skb(sk,
1508 (MAX_HEADER + sizeof(struct ipv6hdr) +
1509 len + LL_RESERVED_SPACE(dev)),
1510 1, &err);
1511 if (buff == NULL) {
1512 ND_PRINTK0(KERN_ERR
1513 "ICMPv6 Redirect: %s() failed to allocate an skb.\n",
1514 __FUNCTION__);
1515 dst_release(dst);
1516 return;
1517 }
1518
1519 hlen = 0;
1520
1521 skb_reserve(buff, LL_RESERVED_SPACE(dev));
1522 ip6_nd_hdr(sk, buff, dev, &saddr_buf, &ipv6_hdr(skb)->saddr,
1523 IPPROTO_ICMPV6, len);
1524
1525 skb_set_transport_header(buff, buff->tail - buff->data);
1526 skb_put(buff, len);
1527 icmph = icmp6_hdr(buff);
1528
1529 memset(icmph, 0, sizeof(struct icmp6hdr));
1530 icmph->icmp6_type = NDISC_REDIRECT;
1531
1532 /*
1533 * copy target and destination addresses
1534 */
1535
1536 addrp = (struct in6_addr *)(icmph + 1);
1537 ipv6_addr_copy(addrp, target);
1538 addrp++;
1539 ipv6_addr_copy(addrp, &ipv6_hdr(skb)->daddr);
1540
1541 opt = (u8*) (addrp + 1);
1542
1543 /*
1544 * include target_address option
1545 */
1546
1547 if (ha)
1548 opt = ndisc_fill_addr_option(opt, ND_OPT_TARGET_LL_ADDR, ha,
1549 dev->addr_len, dev->type);
1550
1551 /*
1552 * build redirect option and copy skb over to the new packet.
1553 */
1554
1555 memset(opt, 0, 8);
1556 *(opt++) = ND_OPT_REDIRECT_HDR;
1557 *(opt++) = (rd_len >> 3);
1558 opt += 6;
1559
1560 memcpy(opt, ipv6_hdr(skb), rd_len - 8);
1561
1562 icmph->icmp6_cksum = csum_ipv6_magic(&saddr_buf, &ipv6_hdr(skb)->saddr,
1563 len, IPPROTO_ICMPV6,
1564 csum_partial((u8 *) icmph, len, 0));
1565
1566 buff->dst = dst;
1567 idev = in6_dev_get(dst->dev);
1568 IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
1569 err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, buff, NULL, dst->dev, dst_output);
1570 if (!err) {
1571 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTREDIRECTS);
1572 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
1573 }
1574
1575 if (likely(idev != NULL))
1576 in6_dev_put(idev);
1577 }
1578
1579 static void pndisc_redo(struct sk_buff *skb)
1580 {
1581 ndisc_recv_ns(skb);
1582 kfree_skb(skb);
1583 }
1584
1585 int ndisc_rcv(struct sk_buff *skb)
1586 {
1587 struct nd_msg *msg;
1588
1589 if (!pskb_may_pull(skb, skb->len))
1590 return 0;
1591
1592 msg = (struct nd_msg *)skb_transport_header(skb);
1593
1594 __skb_push(skb, skb->data - skb_transport_header(skb));
1595
1596 if (ipv6_hdr(skb)->hop_limit != 255) {
1597 ND_PRINTK2(KERN_WARNING
1598 "ICMPv6 NDISC: invalid hop-limit: %d\n",
1599 ipv6_hdr(skb)->hop_limit);
1600 return 0;
1601 }
1602
1603 if (msg->icmph.icmp6_code != 0) {
1604 ND_PRINTK2(KERN_WARNING
1605 "ICMPv6 NDISC: invalid ICMPv6 code: %d\n",
1606 msg->icmph.icmp6_code);
1607 return 0;
1608 }
1609
1610 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1611
1612 switch (msg->icmph.icmp6_type) {
1613 case NDISC_NEIGHBOUR_SOLICITATION:
1614 ndisc_recv_ns(skb);
1615 break;
1616
1617 case NDISC_NEIGHBOUR_ADVERTISEMENT:
1618 ndisc_recv_na(skb);
1619 break;
1620
1621 case NDISC_ROUTER_SOLICITATION:
1622 ndisc_recv_rs(skb);
1623 break;
1624
1625 case NDISC_ROUTER_ADVERTISEMENT:
1626 ndisc_router_discovery(skb);
1627 break;
1628
1629 case NDISC_REDIRECT:
1630 ndisc_redirect_rcv(skb);
1631 break;
1632 };
1633
1634 return 0;
1635 }
1636
1637 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1638 {
1639 struct net_device *dev = ptr;
1640
1641 switch (event) {
1642 case NETDEV_CHANGEADDR:
1643 neigh_changeaddr(&nd_tbl, dev);
1644 fib6_run_gc(~0UL);
1645 break;
1646 case NETDEV_DOWN:
1647 neigh_ifdown(&nd_tbl, dev);
1648 fib6_run_gc(~0UL);
1649 break;
1650 default:
1651 break;
1652 }
1653
1654 return NOTIFY_DONE;
1655 }
1656
1657 static struct notifier_block ndisc_netdev_notifier = {
1658 .notifier_call = ndisc_netdev_event,
1659 };
1660
1661 #ifdef CONFIG_SYSCTL
1662 static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1663 const char *func, const char *dev_name)
1664 {
1665 static char warncomm[TASK_COMM_LEN];
1666 static int warned;
1667 if (strcmp(warncomm, current->comm) && warned < 5) {
1668 strcpy(warncomm, current->comm);
1669 printk(KERN_WARNING
1670 "process `%s' is using deprecated sysctl (%s) "
1671 "net.ipv6.neigh.%s.%s; "
1672 "Use net.ipv6.neigh.%s.%s_ms "
1673 "instead.\n",
1674 warncomm, func,
1675 dev_name, ctl->procname,
1676 dev_name, ctl->procname);
1677 warned++;
1678 }
1679 }
1680
1681 int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, struct file * filp, void __user *buffer, size_t *lenp, loff_t *ppos)
1682 {
1683 struct net_device *dev = ctl->extra1;
1684 struct inet6_dev *idev;
1685 int ret;
1686
1687 if (ctl->ctl_name == NET_NEIGH_RETRANS_TIME ||
1688 ctl->ctl_name == NET_NEIGH_REACHABLE_TIME)
1689 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
1690
1691 switch (ctl->ctl_name) {
1692 case NET_NEIGH_RETRANS_TIME:
1693 ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
1694 break;
1695 case NET_NEIGH_REACHABLE_TIME:
1696 ret = proc_dointvec_jiffies(ctl, write,
1697 filp, buffer, lenp, ppos);
1698 break;
1699 case NET_NEIGH_RETRANS_TIME_MS:
1700 case NET_NEIGH_REACHABLE_TIME_MS:
1701 ret = proc_dointvec_ms_jiffies(ctl, write,
1702 filp, buffer, lenp, ppos);
1703 break;
1704 default:
1705 ret = -1;
1706 }
1707
1708 if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1709 if (ctl->ctl_name == NET_NEIGH_REACHABLE_TIME ||
1710 ctl->ctl_name == NET_NEIGH_REACHABLE_TIME_MS)
1711 idev->nd_parms->reachable_time = neigh_rand_reach_time(idev->nd_parms->base_reachable_time);
1712 idev->tstamp = jiffies;
1713 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1714 in6_dev_put(idev);
1715 }
1716 return ret;
1717 }
1718
1719 static int ndisc_ifinfo_sysctl_strategy(ctl_table *ctl, int __user *name,
1720 int nlen, void __user *oldval,
1721 size_t __user *oldlenp,
1722 void __user *newval, size_t newlen)
1723 {
1724 struct net_device *dev = ctl->extra1;
1725 struct inet6_dev *idev;
1726 int ret;
1727
1728 if (ctl->ctl_name == NET_NEIGH_RETRANS_TIME ||
1729 ctl->ctl_name == NET_NEIGH_REACHABLE_TIME)
1730 ndisc_warn_deprecated_sysctl(ctl, "procfs", dev ? dev->name : "default");
1731
1732 switch (ctl->ctl_name) {
1733 case NET_NEIGH_REACHABLE_TIME:
1734 ret = sysctl_jiffies(ctl, name, nlen,
1735 oldval, oldlenp, newval, newlen);
1736 break;
1737 case NET_NEIGH_RETRANS_TIME_MS:
1738 case NET_NEIGH_REACHABLE_TIME_MS:
1739 ret = sysctl_ms_jiffies(ctl, name, nlen,
1740 oldval, oldlenp, newval, newlen);
1741 break;
1742 default:
1743 ret = 0;
1744 }
1745
1746 if (newval && newlen && ret > 0 &&
1747 dev && (idev = in6_dev_get(dev)) != NULL) {
1748 if (ctl->ctl_name == NET_NEIGH_REACHABLE_TIME ||
1749 ctl->ctl_name == NET_NEIGH_REACHABLE_TIME_MS)
1750 idev->nd_parms->reachable_time = neigh_rand_reach_time(idev->nd_parms->base_reachable_time);
1751 idev->tstamp = jiffies;
1752 inet6_ifinfo_notify(RTM_NEWLINK, idev);
1753 in6_dev_put(idev);
1754 }
1755
1756 return ret;
1757 }
1758
1759 #endif
1760
1761 int __init ndisc_init(struct net_proto_family *ops)
1762 {
1763 struct ipv6_pinfo *np;
1764 struct sock *sk;
1765 int err;
1766
1767 err = sock_create_kern(PF_INET6, SOCK_RAW, IPPROTO_ICMPV6, &ndisc_socket);
1768 if (err < 0) {
1769 ND_PRINTK0(KERN_ERR
1770 "ICMPv6 NDISC: Failed to initialize the control socket (err %d).\n",
1771 err);
1772 ndisc_socket = NULL; /* For safety. */
1773 return err;
1774 }
1775
1776 sk = ndisc_socket->sk;
1777 np = inet6_sk(sk);
1778 sk->sk_allocation = GFP_ATOMIC;
1779 np->hop_limit = 255;
1780 /* Do not loopback ndisc messages */
1781 np->mc_loop = 0;
1782 sk->sk_prot->unhash(sk);
1783
1784 /*
1785 * Initialize the neighbour table
1786 */
1787
1788 neigh_table_init(&nd_tbl);
1789
1790 #ifdef CONFIG_SYSCTL
1791 neigh_sysctl_register(NULL, &nd_tbl.parms, NET_IPV6, NET_IPV6_NEIGH,
1792 "ipv6",
1793 &ndisc_ifinfo_sysctl_change,
1794 &ndisc_ifinfo_sysctl_strategy);
1795 #endif
1796
1797 register_netdevice_notifier(&ndisc_netdev_notifier);
1798 return 0;
1799 }
1800
1801 void ndisc_cleanup(void)
1802 {
1803 unregister_netdevice_notifier(&ndisc_netdev_notifier);
1804 #ifdef CONFIG_SYSCTL
1805 neigh_sysctl_unregister(&nd_tbl.parms);
1806 #endif
1807 neigh_table_clear(&nd_tbl);
1808 sock_release(ndisc_socket);
1809 ndisc_socket = NULL; /* For safety. */
1810 }
kernel-based virtual machine