1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* Neighbour Discovery for IPv6
4	* Linux INET6 implementation
5	*
6	* Authors:
7	* Pedro Roque <roque@di.fc.ul.pt>
8	* Mike Shaver <shaver@ingenia.com>
9	*/
10
11	/*
12	* Changes:
13	*
14	* Alexey I. Froloff : RFC6106 (DNSSL) support
15	* Pierre Ynard : export userland ND options
16	* through netlink (RDNSS support)
17	* Lars Fenneberg : fixed MTU setting on receipt
18	* of an RA.
19	* Janos Farkas : kmalloc failure checks
20	* Alexey Kuznetsov : state machine reworked
21	* and moved to net/core.
22	* Pekka Savola : RFC2461 validation
23	* YOSHIFUJI Hideaki @USAGI : Verify ND options properly
24	*/
25
26	#define pr_fmt(fmt) "ICMPv6: " fmt
27
28	#include <linux/module.h>
29	#include <linux/errno.h>
30	#include <linux/types.h>
31	#include <linux/socket.h>
32	#include <linux/sockios.h>
33	#include <linux/sched.h>
34	#include <linux/net.h>
35	#include <linux/in6.h>
36	#include <linux/route.h>
37	#include <linux/init.h>
38	#include <linux/rcupdate.h>
39	#include <linux/slab.h>
40	#ifdef CONFIG_SYSCTL
41	#include <linux/sysctl.h>
42	#endif
43
44	#include <linux/if_addr.h>
45	#include <linux/if_ether.h>
46	#include <linux/if_arp.h>
47	#include <linux/ipv6.h>
48	#include <linux/icmpv6.h>
49	#include <linux/jhash.h>
50
51	#include <net/sock.h>
52	#include <net/snmp.h>
53
54	#include <net/ipv6.h>
55	#include <net/protocol.h>
56	#include <net/ndisc.h>
57	#include <net/ip6_route.h>
58	#include <net/addrconf.h>
59	#include <net/icmp.h>
60
61	#include <net/netlink.h>
62	#include <linux/rtnetlink.h>
63
64	#include <net/flow.h>
65	#include <net/ip6_checksum.h>
66	#include <net/inet_common.h>
67	#include <linux/proc_fs.h>
68
69	#include <linux/netfilter.h>
70	#include <linux/netfilter_ipv6.h>
71
72	static u32 ndisc_hash(const void *pkey,
73	const struct net_device *dev,
74	__u32 *hash_rnd);
75	static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey);
76	static bool ndisc_allow_add(const struct net_device *dev,
77	struct netlink_ext_ack *extack);
78	static int ndisc_constructor(struct neighbour *neigh);
79	static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
80	static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
81	static int pndisc_constructor(struct pneigh_entry *n);
82	static void pndisc_destructor(struct pneigh_entry *n);
83	static void pndisc_redo(struct sk_buff *skb);
84	static int ndisc_is_multicast(const void *pkey);
85
86	static const struct neigh_ops ndisc_generic_ops = {
87	.family = AF_INET6,
88	.solicit = ndisc_solicit,
89	.error_report = ndisc_error_report,
90	.output = neigh_resolve_output,
91	.connected_output = neigh_connected_output,
92	};
93
94	static const struct neigh_ops ndisc_hh_ops = {
95	.family = AF_INET6,
96	.solicit = ndisc_solicit,
97	.error_report = ndisc_error_report,
98	.output = neigh_resolve_output,
99	.connected_output = neigh_resolve_output,
100	};
101
102
103	static const struct neigh_ops ndisc_direct_ops = {
104	.family = AF_INET6,
105	.output = neigh_direct_output,
106	.connected_output = neigh_direct_output,
107	};
108
109	struct neigh_table nd_tbl = {
110	.family = AF_INET6,
111	.key_len = sizeof(struct in6_addr),
112	.protocol = cpu_to_be16(ETH_P_IPV6),
113	.hash = ndisc_hash,
114	.key_eq = ndisc_key_eq,
115	.constructor = ndisc_constructor,
116	.pconstructor = pndisc_constructor,
117	.pdestructor = pndisc_destructor,
118	.proxy_redo = pndisc_redo,
119	.is_multicast = ndisc_is_multicast,
120	.allow_add = ndisc_allow_add,
121	.id = "ndisc_cache",
122	.parms = {
123	.tbl = &nd_tbl,
124	.reachable_time = ND_REACHABLE_TIME,
125	.data = {
126	[NEIGH_VAR_MCAST_PROBES] = 3,
127	[NEIGH_VAR_UCAST_PROBES] = 3,
128	[NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
129	[NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
130	[NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
131	[NEIGH_VAR_INTERVAL_PROBE_TIME_MS] = 5 * HZ,
132	[NEIGH_VAR_GC_STALETIME] = 60 * HZ,
133	[NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX,
134	[NEIGH_VAR_PROXY_QLEN] = 64,
135	[NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
136	[NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
137	},
138	},
139	.gc_interval = 30 * HZ,
140	.gc_thresh1 = 128,
141	.gc_thresh2 = 512,
142	.gc_thresh3 = 1024,
143	};
144	EXPORT_SYMBOL_GPL(nd_tbl);
145
146	void __ndisc_fill_addr_option(struct sk_buff *skb, int type, const void *data,
147	int data_len, int pad)
148	{
149	int space = __ndisc_opt_addr_space(addr_len: data_len, pad);
150	u8 *opt = skb_put(skb, len: space);
151
152	opt[0] = type;
153	opt[1] = space>>3;
154
155	memset(opt + 2, 0, pad);
156	opt += pad;
157	space -= pad;
158
159	memcpy(opt+2, data, data_len);
160	data_len += 2;
161	opt += data_len;
162	space -= data_len;
163	if (space > 0)
164	memset(opt, 0, space);
165	}
166	EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option);
167
168	static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type,
169	const void *data, u8 icmp6_type)
170	{
171	__ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len,
172	ndisc_addr_option_pad(type: skb->dev->type));
173	ndisc_ops_fill_addr_option(dev: skb->dev, skb, icmp6_type);
174	}
175
176	static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb,
177	void *ha,
178	const u8 *ops_data)
179	{
180	ndisc_fill_addr_option(skb, type: ND_OPT_TARGET_LL_ADDR, data: ha, NDISC_REDIRECT);
181	ndisc_ops_fill_redirect_addr_option(dev: skb->dev, skb, ha: ops_data);
182	}
183
184	static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
185	struct nd_opt_hdr *end)
186	{
187	int type;
188	if (!cur || !end || cur >= end)
189	return NULL;
190	type = cur->nd_opt_type;
191	do {
192	cur = ((void *)cur) + (cur->nd_opt_len << 3);
193	} while (cur < end && cur->nd_opt_type != type);
194	return cur <= end && cur->nd_opt_type == type ? cur : NULL;
195	}
196
197	static inline int ndisc_is_useropt(const struct net_device *dev,
198	struct nd_opt_hdr *opt)
199	{
200	return opt->nd_opt_type == ND_OPT_PREFIX_INFO ||
201	opt->nd_opt_type == ND_OPT_RDNSS ||
202	opt->nd_opt_type == ND_OPT_DNSSL ||
203	opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL ||
204	opt->nd_opt_type == ND_OPT_PREF64 ||
205	ndisc_ops_is_useropt(dev, nd_opt_type: opt->nd_opt_type);
206	}
207
208	static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev,
209	struct nd_opt_hdr *cur,
210	struct nd_opt_hdr *end)
211	{
212	if (!cur || !end || cur >= end)
213	return NULL;
214	do {
215	cur = ((void *)cur) + (cur->nd_opt_len << 3);
216	} while (cur < end && !ndisc_is_useropt(dev, opt: cur));
217	return cur <= end && ndisc_is_useropt(dev, opt: cur) ? cur : NULL;
218	}
219
220	struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
221	u8 *opt, int opt_len,
222	struct ndisc_options *ndopts)
223	{
224	struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
225
226	if (!nd_opt || opt_len < 0 || !ndopts)
227	return NULL;
228	memset(ndopts, 0, sizeof(*ndopts));
229	while (opt_len) {
230	int l;
231	if (opt_len < sizeof(struct nd_opt_hdr))
232	return NULL;
233	l = nd_opt->nd_opt_len << 3;
234	if (opt_len < l || l == 0)
235	return NULL;
236	if (ndisc_ops_parse_options(dev, nd_opt, ndopts))
237	goto next_opt;
238	switch (nd_opt->nd_opt_type) {
239	case ND_OPT_SOURCE_LL_ADDR:
240	case ND_OPT_TARGET_LL_ADDR:
241	case ND_OPT_MTU:
242	case ND_OPT_NONCE:
243	case ND_OPT_REDIRECT_HDR:
244	if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
245	ND_PRINTK(2, warn,
246	"%s: duplicated ND6 option found: type=%d\n",
247	__func__, nd_opt->nd_opt_type);
248	} else {
249	ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
250	}
251	break;
252	case ND_OPT_PREFIX_INFO:
253	ndopts->nd_opts_pi_end = nd_opt;
254	if (!ndopts->nd_opt_array[nd_opt->nd_opt_type])
255	ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
256	break;
257	#ifdef CONFIG_IPV6_ROUTE_INFO
258	case ND_OPT_ROUTE_INFO:
259	ndopts->nd_opts_ri_end = nd_opt;
260	if (!ndopts->nd_opts_ri)
261	ndopts->nd_opts_ri = nd_opt;
262	break;
263	#endif
264	default:
265	if (ndisc_is_useropt(dev, opt: nd_opt)) {
266	ndopts->nd_useropts_end = nd_opt;
267	if (!ndopts->nd_useropts)
268	ndopts->nd_useropts = nd_opt;
269	} else {
270	/*
271	* Unknown options must be silently ignored,
272	* to accommodate future extension to the
273	* protocol.
274	*/
275	ND_PRINTK(2, notice,
276	"%s: ignored unsupported option; type=%d, len=%d\n",
277	__func__,
278	nd_opt->nd_opt_type,
279	nd_opt->nd_opt_len);
280	}
281	}
282	next_opt:
283	opt_len -= l;
284	nd_opt = ((void *)nd_opt) + l;
285	}
286	return ndopts;
287	}
288
289	int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
290	{
291	switch (dev->type) {
292	case ARPHRD_ETHER:
293	case ARPHRD_IEEE802: /* Not sure. Check it later. --ANK */
294	case ARPHRD_FDDI:
295	ipv6_eth_mc_map(addr, buf);
296	return 0;
297	case ARPHRD_ARCNET:
298	ipv6_arcnet_mc_map(addr, buf);
299	return 0;
300	case ARPHRD_INFINIBAND:
301	ipv6_ib_mc_map(addr, broadcast: dev->broadcast, buf);
302	return 0;
303	case ARPHRD_IPGRE:
304	return ipv6_ipgre_mc_map(addr, broadcast: dev->broadcast, buf);
305	default:
306	if (dir) {
307	memcpy(buf, dev->broadcast, dev->addr_len);
308	return 0;
309	}
310	}
311	return -EINVAL;
312	}
313	EXPORT_SYMBOL(ndisc_mc_map);
314
315	static u32 ndisc_hash(const void *pkey,
316	const struct net_device *dev,
317	__u32 *hash_rnd)
318	{
319	return ndisc_hashfn(pkey, dev, hash_rnd);
320	}
321
322	static bool ndisc_key_eq(const struct neighbour *n, const void *pkey)
323	{
324	return neigh_key_eq128(n, pkey);
325	}
326
327	static int ndisc_constructor(struct neighbour *neigh)
328	{
329	struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key;
330	struct net_device *dev = neigh->dev;
331	struct inet6_dev *in6_dev;
332	struct neigh_parms *parms;
333	bool is_multicast = ipv6_addr_is_multicast(addr);
334
335	in6_dev = in6_dev_get(dev);
336	if (!in6_dev) {
337	return -EINVAL;
338	}
339
340	parms = in6_dev->nd_parms;
341	__neigh_parms_put(parms: neigh->parms);
342	neigh->parms = neigh_parms_clone(parms);
343
344	neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
345	if (!dev->header_ops) {
346	neigh->nud_state = NUD_NOARP;
347	neigh->ops = &ndisc_direct_ops;
348	neigh->output = neigh_direct_output;
349	} else {
350	if (is_multicast) {
351	neigh->nud_state = NUD_NOARP;
352	ndisc_mc_map(addr, neigh->ha, dev, 1);
353	} else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
354	neigh->nud_state = NUD_NOARP;
355	memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
356	if (dev->flags&IFF_LOOPBACK)
357	neigh->type = RTN_LOCAL;
358	} else if (dev->flags&IFF_POINTOPOINT) {
359	neigh->nud_state = NUD_NOARP;
360	memcpy(neigh->ha, dev->broadcast, dev->addr_len);
361	}
362	if (dev->header_ops->cache)
363	neigh->ops = &ndisc_hh_ops;
364	else
365	neigh->ops = &ndisc_generic_ops;
366	if (neigh->nud_state&NUD_VALID)
367	neigh->output = neigh->ops->connected_output;
368	else
369	neigh->output = neigh->ops->output;
370	}
371	in6_dev_put(idev: in6_dev);
372	return 0;
373	}
374
375	static int pndisc_constructor(struct pneigh_entry *n)
376	{
377	struct in6_addr *addr = (struct in6_addr *)&n->key;
378	struct in6_addr maddr;
379	struct net_device *dev = n->dev;
380
381	if (!dev || !__in6_dev_get(dev))
382	return -EINVAL;
383	addrconf_addr_solict_mult(addr, solicited: &maddr);
384	ipv6_dev_mc_inc(dev, addr: &maddr);
385	return 0;
386	}
387
388	static void pndisc_destructor(struct pneigh_entry *n)
389	{
390	struct in6_addr *addr = (struct in6_addr *)&n->key;
391	struct in6_addr maddr;
392	struct net_device *dev = n->dev;
393
394	if (!dev || !__in6_dev_get(dev))
395	return;
396	addrconf_addr_solict_mult(addr, solicited: &maddr);
397	ipv6_dev_mc_dec(dev, addr: &maddr);
398	}
399
400	/* called with rtnl held */
401	static bool ndisc_allow_add(const struct net_device *dev,
402	struct netlink_ext_ack *extack)
403	{
404	struct inet6_dev *idev = __in6_dev_get(dev);
405
406	if (!idev || idev->cnf.disable_ipv6) {
407	NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device");
408	return false;
409	}
410
411	return true;
412	}
413
414	static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
415	int len)
416	{
417	int hlen = LL_RESERVED_SPACE(dev);
418	int tlen = dev->needed_tailroom;
419	struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
420	struct sk_buff *skb;
421
422	skb = alloc_skb(size: hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
423	if (!skb) {
424	ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
425	__func__);
426	return NULL;
427	}
428
429	skb->protocol = htons(ETH_P_IPV6);
430	skb->dev = dev;
431
432	skb_reserve(skb, len: hlen + sizeof(struct ipv6hdr));
433	skb_reset_transport_header(skb);
434
435	/* Manually assign socket ownership as we avoid calling
436	* sock_alloc_send_pskb() to bypass wmem buffer limits
437	*/
438	skb_set_owner_w(skb, sk);
439
440	return skb;
441	}
442
443	static void ip6_nd_hdr(struct sk_buff *skb,
444	const struct in6_addr *saddr,
445	const struct in6_addr *daddr,
446	int hop_limit, int len)
447	{
448	struct ipv6hdr *hdr;
449	struct inet6_dev *idev;
450	unsigned tclass;
451
452	rcu_read_lock();
453	idev = __in6_dev_get(dev: skb->dev);
454	tclass = idev ? idev->cnf.ndisc_tclass : 0;
455	rcu_read_unlock();
456
457	skb_push(skb, len: sizeof(*hdr));
458	skb_reset_network_header(skb);
459	hdr = ipv6_hdr(skb);
460
461	ip6_flow_hdr(hdr, tclass, flowlabel: 0);
462
463	hdr->payload_len = htons(len);
464	hdr->nexthdr = IPPROTO_ICMPV6;
465	hdr->hop_limit = hop_limit;
466
467	hdr->saddr = *saddr;
468	hdr->daddr = *daddr;
469	}
470
471	void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
472	const struct in6_addr *saddr)
473	{
474	struct dst_entry *dst = skb_dst(skb);
475	struct net *net = dev_net(dev: skb->dev);
476	struct sock *sk = net->ipv6.ndisc_sk;
477	struct inet6_dev *idev;
478	int err;
479	struct icmp6hdr *icmp6h = icmp6_hdr(skb);
480	u8 type;
481
482	type = icmp6h->icmp6_type;
483
484	if (!dst) {
485	struct flowi6 fl6;
486	int oif = skb->dev->ifindex;
487
488	icmpv6_flow_init(sk, fl6: &fl6, type, saddr, daddr, oif);
489	dst = icmp6_dst_alloc(dev: skb->dev, fl6: &fl6);
490	if (IS_ERR(ptr: dst)) {
491	kfree_skb(skb);
492	return;
493	}
494
495	skb_dst_set(skb, dst);
496	}
497
498	icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, len: skb->len,
499	IPPROTO_ICMPV6,
500	sum: csum_partial(buff: icmp6h,
501	len: skb->len, sum: 0));
502
503	ip6_nd_hdr(skb, saddr, daddr, READ_ONCE(inet6_sk(sk)->hop_limit), len: skb->len);
504
505	rcu_read_lock();
506	idev = __in6_dev_get(dev: dst->dev);
507	IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
508
509	err = NF_HOOK(pf: NFPROTO_IPV6, hook: NF_INET_LOCAL_OUT,
510	net, sk, skb, NULL, out: dst->dev,
511	okfn: dst_output);
512	if (!err) {
513	ICMP6MSGOUT_INC_STATS(net, idev, type);
514	ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
515	}
516
517	rcu_read_unlock();
518	}
519	EXPORT_SYMBOL(ndisc_send_skb);
520
521	void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
522	const struct in6_addr *solicited_addr,
523	bool router, bool solicited, bool override, bool inc_opt)
524	{
525	struct sk_buff *skb;
526	struct in6_addr tmpaddr;
527	struct inet6_ifaddr *ifp;
528	const struct in6_addr *src_addr;
529	struct nd_msg *msg;
530	int optlen = 0;
531
532	/* for anycast or proxy, solicited_addr != src_addr */
533	ifp = ipv6_get_ifaddr(net: dev_net(dev), addr: solicited_addr, dev, strict: 1);
534	if (ifp) {
535	src_addr = solicited_addr;
536	if (ifp->flags & IFA_F_OPTIMISTIC)
537	override = false;
538	inc_opt |= ifp->idev->cnf.force_tllao;
539	in6_ifa_put(ifp);
540	} else {
541	if (ipv6_dev_get_saddr(net: dev_net(dev), dev, daddr,
542	srcprefs: inet6_sk(sk: dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
543	saddr: &tmpaddr))
544	return;
545	src_addr = &tmpaddr;
546	}
547
548	if (!dev->addr_len)
549	inc_opt = false;
550	if (inc_opt)
551	optlen += ndisc_opt_addr_space(dev,
552	NDISC_NEIGHBOUR_ADVERTISEMENT);
553
554	skb = ndisc_alloc_skb(dev, len: sizeof(*msg) + optlen);
555	if (!skb)
556	return;
557
558	msg = skb_put(skb, len: sizeof(*msg));
559	*msg = (struct nd_msg) {
560	.icmph = {
561	.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
562	.icmp6_router = router,
563	.icmp6_solicited = solicited,
564	.icmp6_override = override,
565	},
566	.target = *solicited_addr,
567	};
568
569	if (inc_opt)
570	ndisc_fill_addr_option(skb, type: ND_OPT_TARGET_LL_ADDR,
571	data: dev->dev_addr,
572	NDISC_NEIGHBOUR_ADVERTISEMENT);
573
574	ndisc_send_skb(skb, daddr, src_addr);
575	}
576
577	static void ndisc_send_unsol_na(struct net_device *dev)
578	{
579	struct inet6_dev *idev;
580	struct inet6_ifaddr *ifa;
581
582	idev = in6_dev_get(dev);
583	if (!idev)
584	return;
585
586	read_lock_bh(&idev->lock);
587	list_for_each_entry(ifa, &idev->addr_list, if_list) {
588	/* skip tentative addresses until dad completes */
589	if (ifa->flags & IFA_F_TENTATIVE &&
590	!(ifa->flags & IFA_F_OPTIMISTIC))
591	continue;
592
593	ndisc_send_na(dev, daddr: &in6addr_linklocal_allnodes, solicited_addr: &ifa->addr,
594	/*router=*/ !!idev->cnf.forwarding,
595	/*solicited=*/ false, /*override=*/ true,
596	/*inc_opt=*/ true);
597	}
598	read_unlock_bh(&idev->lock);
599
600	in6_dev_put(idev);
601	}
602
603	struct sk_buff *ndisc_ns_create(struct net_device *dev, const struct in6_addr *solicit,
604	const struct in6_addr *saddr, u64 nonce)
605	{
606	int inc_opt = dev->addr_len;
607	struct sk_buff *skb;
608	struct nd_msg *msg;
609	int optlen = 0;
610
611	if (!saddr)
612	return NULL;
613
614	if (ipv6_addr_any(a: saddr))
615	inc_opt = false;
616	if (inc_opt)
617	optlen += ndisc_opt_addr_space(dev,
618	NDISC_NEIGHBOUR_SOLICITATION);
619	if (nonce != 0)
620	optlen += 8;
621
622	skb = ndisc_alloc_skb(dev, len: sizeof(*msg) + optlen);
623	if (!skb)
624	return NULL;
625
626	msg = skb_put(skb, len: sizeof(*msg));
627	*msg = (struct nd_msg) {
628	.icmph = {
629	.icmp6_type = NDISC_NEIGHBOUR_SOLICITATION,
630	},
631	.target = *solicit,
632	};
633
634	if (inc_opt)
635	ndisc_fill_addr_option(skb, type: ND_OPT_SOURCE_LL_ADDR,
636	data: dev->dev_addr,
637	NDISC_NEIGHBOUR_SOLICITATION);
638	if (nonce != 0) {
639	u8 *opt = skb_put(skb, len: 8);
640
641	opt[0] = ND_OPT_NONCE;
642	opt[1] = 8 >> 3;
643	memcpy(opt + 2, &nonce, 6);
644	}
645
646	return skb;
647	}
648	EXPORT_SYMBOL(ndisc_ns_create);
649
650	void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
651	const struct in6_addr *daddr, const struct in6_addr *saddr,
652	u64 nonce)
653	{
654	struct in6_addr addr_buf;
655	struct sk_buff *skb;
656
657	if (!saddr) {
658	if (ipv6_get_lladdr(dev, addr: &addr_buf,
659	banned_flags: (IFA_F_TENTATIVE | IFA_F_OPTIMISTIC)))
660	return;
661	saddr = &addr_buf;
662	}
663
664	skb = ndisc_ns_create(dev, solicit, saddr, nonce);
665
666	if (skb)
667	ndisc_send_skb(skb, daddr, saddr);
668	}
669
670	void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
671	const struct in6_addr *daddr)
672	{
673	struct sk_buff *skb;
674	struct rs_msg *msg;
675	int send_sllao = dev->addr_len;
676	int optlen = 0;
677
678	#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
679	/*
680	* According to section 2.2 of RFC 4429, we must not
681	* send router solicitations with a sllao from
682	* optimistic addresses, but we may send the solicitation
683	* if we don't include the sllao. So here we check
684	* if our address is optimistic, and if so, we
685	* suppress the inclusion of the sllao.
686	*/
687	if (send_sllao) {
688	struct inet6_ifaddr *ifp = ipv6_get_ifaddr(net: dev_net(dev), addr: saddr,
689	dev, strict: 1);
690	if (ifp) {
691	if (ifp->flags & IFA_F_OPTIMISTIC) {
692	send_sllao = 0;
693	}
694	in6_ifa_put(ifp);
695	} else {
696	send_sllao = 0;
697	}
698	}
699	#endif
700	if (send_sllao)
701	optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION);
702
703	skb = ndisc_alloc_skb(dev, len: sizeof(*msg) + optlen);
704	if (!skb)
705	return;
706
707	msg = skb_put(skb, len: sizeof(*msg));
708	*msg = (struct rs_msg) {
709	.icmph = {
710	.icmp6_type = NDISC_ROUTER_SOLICITATION,
711	},
712	};
713
714	if (send_sllao)
715	ndisc_fill_addr_option(skb, type: ND_OPT_SOURCE_LL_ADDR,
716	data: dev->dev_addr,
717	NDISC_ROUTER_SOLICITATION);
718
719	ndisc_send_skb(skb, daddr, saddr);
720	}
721
722
723	static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
724	{
725	/*
726	* "The sender MUST return an ICMP
727	* destination unreachable"
728	*/
729	dst_link_failure(skb);
730	kfree_skb(skb);
731	}
732
733	/* Called with locked neigh: either read or both */
734
735	static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
736	{
737	struct in6_addr *saddr = NULL;
738	struct in6_addr mcaddr;
739	struct net_device *dev = neigh->dev;
740	struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
741	int probes = atomic_read(v: &neigh->probes);
742
743	if (skb && ipv6_chk_addr_and_flags(net: dev_net(dev), addr: &ipv6_hdr(skb)->saddr,
744	dev, skip_dev_check: false, strict: 1,
745	IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
746	saddr = &ipv6_hdr(skb)->saddr;
747	probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
748	if (probes < 0) {
749	if (!(READ_ONCE(neigh->nud_state) & NUD_VALID)) {
750	ND_PRINTK(1, dbg,
751	"%s: trying to ucast probe in NUD_INVALID: %pI6\n",
752	__func__, target);
753	}
754	ndisc_send_ns(dev, solicit: target, daddr: target, saddr, nonce: 0);
755	} else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
756	neigh_app_ns(n: neigh);
757	} else {
758	addrconf_addr_solict_mult(addr: target, solicited: &mcaddr);
759	ndisc_send_ns(dev, solicit: target, daddr: &mcaddr, saddr, nonce: 0);
760	}
761	}
762
763	static int pndisc_is_router(const void *pkey,
764	struct net_device *dev)
765	{
766	struct pneigh_entry *n;
767	int ret = -1;
768
769	read_lock_bh(&nd_tbl.lock);
770	n = __pneigh_lookup(tbl: &nd_tbl, net: dev_net(dev), key: pkey, dev);
771	if (n)
772	ret = !!(n->flags & NTF_ROUTER);
773	read_unlock_bh(&nd_tbl.lock);
774
775	return ret;
776	}
777
778	void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
779	const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
780	struct ndisc_options *ndopts)
781	{
782	neigh_update(neigh, lladdr, new, flags, nlmsg_pid: 0);
783	/* report ndisc ops about neighbour update */
784	ndisc_ops_update(dev, n: neigh, flags, icmp6_type, ndopts);
785	}
786
787	static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb)
788	{
789	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
790	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
791	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
792	u8 *lladdr = NULL;
793	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
794	offsetof(struct nd_msg, opt));
795	struct ndisc_options ndopts;
796	struct net_device *dev = skb->dev;
797	struct inet6_ifaddr *ifp;
798	struct inet6_dev *idev = NULL;
799	struct neighbour *neigh;
800	int dad = ipv6_addr_any(a: saddr);
801	int is_router = -1;
802	SKB_DR(reason);
803	u64 nonce = 0;
804	bool inc;
805
806	if (skb->len < sizeof(struct nd_msg))
807	return SKB_DROP_REASON_PKT_TOO_SMALL;
808
809	if (ipv6_addr_is_multicast(addr: &msg->target)) {
810	ND_PRINTK(2, warn, "NS: multicast target address\n");
811	return reason;
812	}
813
814	/*
815	* RFC2461 7.1.1:
816	* DAD has to be destined for solicited node multicast address.
817	*/
818	if (dad && !ipv6_addr_is_solict_mult(addr: daddr)) {
819	ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
820	return reason;
821	}
822
823	if (!ndisc_parse_options(dev, opt: msg->opt, opt_len: ndoptlen, ndopts: &ndopts))
824	return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
825
826	if (ndopts.nd_opts_src_lladdr) {
827	lladdr = ndisc_opt_addr_data(p: ndopts.nd_opts_src_lladdr, dev);
828	if (!lladdr) {
829	ND_PRINTK(2, warn,
830	"NS: invalid link-layer address length\n");
831	return reason;
832	}
833
834	/* RFC2461 7.1.1:
835	* If the IP source address is the unspecified address,
836	* there MUST NOT be source link-layer address option
837	* in the message.
838	*/
839	if (dad) {
840	ND_PRINTK(2, warn,
841	"NS: bad DAD packet (link-layer address option)\n");
842	return reason;
843	}
844	}
845	if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
846	memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
847
848	inc = ipv6_addr_is_multicast(addr: daddr);
849
850	ifp = ipv6_get_ifaddr(net: dev_net(dev), addr: &msg->target, dev, strict: 1);
851	if (ifp) {
852	have_ifp:
853	if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
854	if (dad) {
855	if (nonce != 0 && ifp->dad_nonce == nonce) {
856	u8 *np = (u8 *)&nonce;
857	/* Matching nonce if looped back */
858	ND_PRINTK(2, notice,
859	"%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n",
860	ifp->idev->dev->name,
861	&ifp->addr, np);
862	goto out;
863	}
864	/*
865	* We are colliding with another node
866	* who is doing DAD
867	* so fail our DAD process
868	*/
869	addrconf_dad_failure(skb, ifp);
870	return reason;
871	} else {
872	/*
873	* This is not a dad solicitation.
874	* If we are an optimistic node,
875	* we should respond.
876	* Otherwise, we should ignore it.
877	*/
878	if (!(ifp->flags & IFA_F_OPTIMISTIC))
879	goto out;
880	}
881	}
882
883	idev = ifp->idev;
884	} else {
885	struct net *net = dev_net(dev);
886
887	/* perhaps an address on the master device */
888	if (netif_is_l3_slave(dev)) {
889	struct net_device *mdev;
890
891	mdev = netdev_master_upper_dev_get_rcu(dev);
892	if (mdev) {
893	ifp = ipv6_get_ifaddr(net, addr: &msg->target, dev: mdev, strict: 1);
894	if (ifp)
895	goto have_ifp;
896	}
897	}
898
899	idev = in6_dev_get(dev);
900	if (!idev) {
901	/* XXX: count this drop? */
902	return reason;
903	}
904
905	if (ipv6_chk_acast_addr(net, dev, addr: &msg->target) ||
906	(idev->cnf.forwarding &&
907	(net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
908	(is_router = pndisc_is_router(pkey: &msg->target, dev)) >= 0)) {
909	if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
910	skb->pkt_type != PACKET_HOST &&
911	inc &&
912	NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
913	/*
914	* for anycast or proxy,
915	* sender should delay its response
916	* by a random time between 0 and
917	* MAX_ANYCAST_DELAY_TIME seconds.
918	* (RFC2461) -- yoshfuji
919	*/
920	struct sk_buff *n = skb_clone(skb, GFP_ATOMIC);
921	if (n)
922	pneigh_enqueue(tbl: &nd_tbl, p: idev->nd_parms, skb: n);
923	goto out;
924	}
925	} else {
926	SKB_DR_SET(reason, IPV6_NDISC_NS_OTHERHOST);
927	goto out;
928	}
929	}
930
931	if (is_router < 0)
932	is_router = idev->cnf.forwarding;
933
934	if (dad) {
935	ndisc_send_na(dev, daddr: &in6addr_linklocal_allnodes, solicited_addr: &msg->target,
936	router: !!is_router, solicited: false, override: (ifp != NULL), inc_opt: true);
937	goto out;
938	}
939
940	if (inc)
941	NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast);
942	else
943	NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast);
944
945	/*
946	* update / create cache entry
947	* for the source address
948	*/
949	neigh = __neigh_lookup(tbl: &nd_tbl, pkey: saddr, dev,
950	creat: !inc || lladdr || !dev->addr_len);
951	if (neigh)
952	ndisc_update(dev, neigh, lladdr, NUD_STALE,
953	NEIGH_UPDATE_F_WEAK_OVERRIDE|
954	NEIGH_UPDATE_F_OVERRIDE,
955	NDISC_NEIGHBOUR_SOLICITATION, ndopts: &ndopts);
956	if (neigh || !dev->header_ops) {
957	ndisc_send_na(dev, daddr: saddr, solicited_addr: &msg->target, router: !!is_router,
958	solicited: true, override: (ifp != NULL && inc), inc_opt: inc);
959	if (neigh)
960	neigh_release(neigh);
961	reason = SKB_CONSUMED;
962	}
963
964	out:
965	if (ifp)
966	in6_ifa_put(ifp);
967	else
968	in6_dev_put(idev);
969	return reason;
970	}
971
972	static int accept_untracked_na(struct net_device *dev, struct in6_addr *saddr)
973	{
974	struct inet6_dev *idev = __in6_dev_get(dev);
975
976	switch (idev->cnf.accept_untracked_na) {
977	case 0: /* Don't accept untracked na (absent in neighbor cache) */
978	return 0;
979	case 1: /* Create new entries from na if currently untracked */
980	return 1;
981	case 2: /* Create new entries from untracked na only if saddr is in the
982	* same subnet as an address configured on the interface that
983	* received the na
984	*/
985	return !!ipv6_chk_prefix(addr: saddr, dev);
986	default:
987	return 0;
988	}
989	}
990
991	static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb)
992	{
993	struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
994	struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
995	const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
996	u8 *lladdr = NULL;
997	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
998	offsetof(struct nd_msg, opt));
999	struct ndisc_options ndopts;
1000	struct net_device *dev = skb->dev;
1001	struct inet6_dev *idev = __in6_dev_get(dev);
1002	struct inet6_ifaddr *ifp;
1003	struct neighbour *neigh;
1004	SKB_DR(reason);
1005	u8 new_state;
1006
1007	if (skb->len < sizeof(struct nd_msg))
1008	return SKB_DROP_REASON_PKT_TOO_SMALL;
1009
1010	if (ipv6_addr_is_multicast(addr: &msg->target)) {
1011	ND_PRINTK(2, warn, "NA: target address is multicast\n");
1012	return reason;
1013	}
1014
1015	if (ipv6_addr_is_multicast(addr: daddr) &&
1016	msg->icmph.icmp6_solicited) {
1017	ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
1018	return reason;
1019	}
1020
1021	/* For some 802.11 wireless deployments (and possibly other networks),
1022	* there will be a NA proxy and unsolicitd packets are attacks
1023	* and thus should not be accepted.
1024	* drop_unsolicited_na takes precedence over accept_untracked_na
1025	*/
1026	if (!msg->icmph.icmp6_solicited && idev &&
1027	idev->cnf.drop_unsolicited_na)
1028	return reason;
1029
1030	if (!ndisc_parse_options(dev, opt: msg->opt, opt_len: ndoptlen, ndopts: &ndopts))
1031	return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1032
1033	if (ndopts.nd_opts_tgt_lladdr) {
1034	lladdr = ndisc_opt_addr_data(p: ndopts.nd_opts_tgt_lladdr, dev);
1035	if (!lladdr) {
1036	ND_PRINTK(2, warn,
1037	"NA: invalid link-layer address length\n");
1038	return reason;
1039	}
1040	}
1041	ifp = ipv6_get_ifaddr(net: dev_net(dev), addr: &msg->target, dev, strict: 1);
1042	if (ifp) {
1043	if (skb->pkt_type != PACKET_LOOPBACK
1044	&& (ifp->flags & IFA_F_TENTATIVE)) {
1045	addrconf_dad_failure(skb, ifp);
1046	return reason;
1047	}
1048	/* What should we make now? The advertisement
1049	is invalid, but ndisc specs say nothing
1050	about it. It could be misconfiguration, or
1051	an smart proxy agent tries to help us :-)
1052
1053	We should not print the error if NA has been
1054	received from loopback - it is just our own
1055	unsolicited advertisement.
1056	*/
1057	if (skb->pkt_type != PACKET_LOOPBACK)
1058	ND_PRINTK(1, warn,
1059	"NA: %pM advertised our address %pI6c on %s!\n",
1060	eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name);
1061	in6_ifa_put(ifp);
1062	return reason;
1063	}
1064
1065	neigh = neigh_lookup(tbl: &nd_tbl, pkey: &msg->target, dev);
1066
1067	/* RFC 9131 updates original Neighbour Discovery RFC 4861.
1068	* NAs with Target LL Address option without a corresponding
1069	* entry in the neighbour cache can now create a STALE neighbour
1070	* cache entry on routers.
1071	*
1072	* entry accept fwding solicited behaviour
1073	* ------- ------ ------ --------- ----------------------
1074	* present X X 0 Set state to STALE
1075	* present X X 1 Set state to REACHABLE
1076	* absent 0 X X Do nothing
1077	* absent 1 0 X Do nothing
1078	* absent 1 1 X Add a new STALE entry
1079	*
1080	* Note that we don't do a (daddr == all-routers-mcast) check.
1081	*/
1082	new_state = msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE;
1083	if (!neigh && lladdr && idev && idev->cnf.forwarding) {
1084	if (accept_untracked_na(dev, saddr)) {
1085	neigh = neigh_create(tbl: &nd_tbl, pkey: &msg->target, dev);
1086	new_state = NUD_STALE;
1087	}
1088	}
1089
1090	if (neigh && !IS_ERR(ptr: neigh)) {
1091	u8 old_flags = neigh->flags;
1092	struct net *net = dev_net(dev);
1093
1094	if (READ_ONCE(neigh->nud_state) & NUD_FAILED)
1095	goto out;
1096
1097	/*
1098	* Don't update the neighbor cache entry on a proxy NA from
1099	* ourselves because either the proxied node is off link or it
1100	* has already sent a NA to us.
1101	*/
1102	if (lladdr && !memcmp(p: lladdr, q: dev->dev_addr, size: dev->addr_len) &&
1103	net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
1104	pneigh_lookup(tbl: &nd_tbl, net, key: &msg->target, dev, creat: 0)) {
1105	/* XXX: idev->cnf.proxy_ndp */
1106	goto out;
1107	}
1108
1109	ndisc_update(dev, neigh, lladdr,
1110	new: new_state,
1111	NEIGH_UPDATE_F_WEAK_OVERRIDE|
1112	(msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)|
1113	NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1114	(msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0),
1115	NDISC_NEIGHBOUR_ADVERTISEMENT, ndopts: &ndopts);
1116
1117	if ((old_flags & ~neigh->flags) & NTF_ROUTER) {
1118	/*
1119	* Change: router to host
1120	*/
1121	rt6_clean_tohost(net: dev_net(dev), gateway: saddr);
1122	}
1123	reason = SKB_CONSUMED;
1124	out:
1125	neigh_release(neigh);
1126	}
1127	return reason;
1128	}
1129
1130	static enum skb_drop_reason ndisc_recv_rs(struct sk_buff *skb)
1131	{
1132	struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb);
1133	unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
1134	struct neighbour *neigh;
1135	struct inet6_dev *idev;
1136	const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
1137	struct ndisc_options ndopts;
1138	u8 *lladdr = NULL;
1139	SKB_DR(reason);
1140
1141	if (skb->len < sizeof(*rs_msg))
1142	return SKB_DROP_REASON_PKT_TOO_SMALL;
1143
1144	idev = __in6_dev_get(dev: skb->dev);
1145	if (!idev) {
1146	ND_PRINTK(1, err, "RS: can't find in6 device\n");
1147	return reason;
1148	}
1149
1150	/* Don't accept RS if we're not in router mode */
1151	if (!idev->cnf.forwarding)
1152	goto out;
1153
1154	/*
1155	* Don't update NCE if src = ::;
1156	* this implies that the source node has no ip address assigned yet.
1157	*/
1158	if (ipv6_addr_any(a: saddr))
1159	goto out;
1160
1161	/* Parse ND options */
1162	if (!ndisc_parse_options(dev: skb->dev, opt: rs_msg->opt, opt_len: ndoptlen, ndopts: &ndopts))
1163	return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1164
1165	if (ndopts.nd_opts_src_lladdr) {
1166	lladdr = ndisc_opt_addr_data(p: ndopts.nd_opts_src_lladdr,
1167	dev: skb->dev);
1168	if (!lladdr)
1169	goto out;
1170	}
1171
1172	neigh = __neigh_lookup(tbl: &nd_tbl, pkey: saddr, dev: skb->dev, creat: 1);
1173	if (neigh) {
1174	ndisc_update(dev: skb->dev, neigh, lladdr, NUD_STALE,
1175	NEIGH_UPDATE_F_WEAK_OVERRIDE|
1176	NEIGH_UPDATE_F_OVERRIDE|
1177	NEIGH_UPDATE_F_OVERRIDE_ISROUTER,
1178	NDISC_ROUTER_SOLICITATION, ndopts: &ndopts);
1179	neigh_release(neigh);
1180	reason = SKB_CONSUMED;
1181	}
1182	out:
1183	return reason;
1184	}
1185
1186	static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
1187	{
1188	struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(skb: ra);
1189	struct sk_buff *skb;
1190	struct nlmsghdr *nlh;
1191	struct nduseroptmsg *ndmsg;
1192	struct net *net = dev_net(dev: ra->dev);
1193	int err;
1194	int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg)
1195	+ (opt->nd_opt_len << 3));
1196	size_t msg_size = base_size + nla_total_size(payload: sizeof(struct in6_addr));
1197
1198	skb = nlmsg_new(payload: msg_size, GFP_ATOMIC);
1199	if (!skb) {
1200	err = -ENOBUFS;
1201	goto errout;
1202	}
1203
1204	nlh = nlmsg_put(skb, portid: 0, seq: 0, RTM_NEWNDUSEROPT, payload: base_size, flags: 0);
1205	if (!nlh) {
1206	goto nla_put_failure;
1207	}
1208
1209	ndmsg = nlmsg_data(nlh);
1210	ndmsg->nduseropt_family = AF_INET6;
1211	ndmsg->nduseropt_ifindex = ra->dev->ifindex;
1212	ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type;
1213	ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code;
1214	ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3;
1215
1216	memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
1217
1218	if (nla_put_in6_addr(skb, attrtype: NDUSEROPT_SRCADDR, addr: &ipv6_hdr(skb: ra)->saddr))
1219	goto nla_put_failure;
1220	nlmsg_end(skb, nlh);
1221
1222	rtnl_notify(skb, net, pid: 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
1223	return;
1224
1225	nla_put_failure:
1226	nlmsg_free(skb);
1227	err = -EMSGSIZE;
1228	errout:
1229	rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, error: err);
1230	}
1231
1232	static enum skb_drop_reason ndisc_router_discovery(struct sk_buff *skb)
1233	{
1234	struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
1235	bool send_ifinfo_notify = false;
1236	struct neighbour *neigh = NULL;
1237	struct ndisc_options ndopts;
1238	struct fib6_info *rt = NULL;
1239	struct inet6_dev *in6_dev;
1240	u32 defrtr_usr_metric;
1241	unsigned int pref = 0;
1242	__u32 old_if_flags;
1243	struct net *net;
1244	SKB_DR(reason);
1245	int lifetime;
1246	int optlen;
1247
1248	__u8 *opt = (__u8 *)(ra_msg + 1);
1249
1250	optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
1251	sizeof(struct ra_msg);
1252
1253	ND_PRINTK(2, info,
1254	"RA: %s, dev: %s\n",
1255	__func__, skb->dev->name);
1256	if (!(ipv6_addr_type(addr: &ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1257	ND_PRINTK(2, warn, "RA: source address is not link-local\n");
1258	return reason;
1259	}
1260	if (optlen < 0)
1261	return SKB_DROP_REASON_PKT_TOO_SMALL;
1262
1263	#ifdef CONFIG_IPV6_NDISC_NODETYPE
1264	if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
1265	ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
1266	return reason;
1267	}
1268	#endif
1269
1270	in6_dev = __in6_dev_get(dev: skb->dev);
1271	if (!in6_dev) {
1272	ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
1273	skb->dev->name);
1274	return reason;
1275	}
1276
1277	if (!ndisc_parse_options(dev: skb->dev, opt, opt_len: optlen, ndopts: &ndopts))
1278	return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1279
1280	if (!ipv6_accept_ra(idev: in6_dev)) {
1281	ND_PRINTK(2, info,
1282	"RA: %s, did not accept ra for dev: %s\n",
1283	__func__, skb->dev->name);
1284	goto skip_linkparms;
1285	}
1286
1287	#ifdef CONFIG_IPV6_NDISC_NODETYPE
1288	/* skip link-specific parameters from interior routers */
1289	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1290	ND_PRINTK(2, info,
1291	"RA: %s, nodetype is NODEFAULT, dev: %s\n",
1292	__func__, skb->dev->name);
1293	goto skip_linkparms;
1294	}
1295	#endif
1296
1297	if (in6_dev->if_flags & IF_RS_SENT) {
1298	/*
1299	* flag that an RA was received after an RS was sent
1300	* out on this interface.
1301	*/
1302	in6_dev->if_flags |= IF_RA_RCVD;
1303	}
1304
1305	/*
1306	* Remember the managed/otherconf flags from most recently
1307	* received RA message (RFC 2462) -- yoshfuji
1308	*/
1309	old_if_flags = in6_dev->if_flags;
1310	in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED |
1311	IF_RA_OTHERCONF)) |
1312	(ra_msg->icmph.icmp6_addrconf_managed ?
1313	IF_RA_MANAGED : 0) |
1314	(ra_msg->icmph.icmp6_addrconf_other ?
1315	IF_RA_OTHERCONF : 0);
1316
1317	if (old_if_flags != in6_dev->if_flags)
1318	send_ifinfo_notify = true;
1319
1320	if (!in6_dev->cnf.accept_ra_defrtr) {
1321	ND_PRINTK(2, info,
1322	"RA: %s, defrtr is false for dev: %s\n",
1323	__func__, skb->dev->name);
1324	goto skip_defrtr;
1325	}
1326
1327	lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
1328	if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_lft) {
1329	ND_PRINTK(2, info,
1330	"RA: router lifetime (%ds) is too short: %s\n",
1331	lifetime, skb->dev->name);
1332	goto skip_defrtr;
1333	}
1334
1335	/* Do not accept RA with source-addr found on local machine unless
1336	* accept_ra_from_local is set to true.
1337	*/
1338	net = dev_net(dev: in6_dev->dev);
1339	if (!in6_dev->cnf.accept_ra_from_local &&
1340	ipv6_chk_addr(net, addr: &ipv6_hdr(skb)->saddr, dev: in6_dev->dev, strict: 0)) {
1341	ND_PRINTK(2, info,
1342	"RA from local address detected on dev: %s: default router ignored\n",
1343	skb->dev->name);
1344	goto skip_defrtr;
1345	}
1346
1347	#ifdef CONFIG_IPV6_ROUTER_PREF
1348	pref = ra_msg->icmph.icmp6_router_pref;
1349	/* 10b is handled as if it were 00b (medium) */
1350	if (pref == ICMPV6_ROUTER_PREF_INVALID ||
1351	!in6_dev->cnf.accept_ra_rtr_pref)
1352	pref = ICMPV6_ROUTER_PREF_MEDIUM;
1353	#endif
1354	/* routes added from RAs do not use nexthop objects */
1355	rt = rt6_get_dflt_router(net, addr: &ipv6_hdr(skb)->saddr, dev: skb->dev);
1356	if (rt) {
1357	neigh = ip6_neigh_lookup(gw: &rt->fib6_nh->fib_nh_gw6,
1358	dev: rt->fib6_nh->fib_nh_dev, NULL,
1359	daddr: &ipv6_hdr(skb)->saddr);
1360	if (!neigh) {
1361	ND_PRINTK(0, err,
1362	"RA: %s got default router without neighbour\n",
1363	__func__);
1364	fib6_info_release(f6i: rt);
1365	return reason;
1366	}
1367	}
1368	/* Set default route metric as specified by user */
1369	defrtr_usr_metric = in6_dev->cnf.ra_defrtr_metric;
1370	/* delete the route if lifetime is 0 or if metric needs change */
1371	if (rt && (lifetime == 0 || rt->fib6_metric != defrtr_usr_metric)) {
1372	ip6_del_rt(net, f6i: rt, skip_notify: false);
1373	rt = NULL;
1374	}
1375
1376	ND_PRINTK(3, info, "RA: rt: %p lifetime: %d, metric: %d, for dev: %s\n",
1377	rt, lifetime, defrtr_usr_metric, skb->dev->name);
1378	if (!rt && lifetime) {
1379	ND_PRINTK(3, info, "RA: adding default router\n");
1380
1381	if (neigh)
1382	neigh_release(neigh);
1383
1384	rt = rt6_add_dflt_router(net, gwaddr: &ipv6_hdr(skb)->saddr,
1385	dev: skb->dev, pref, defrtr_usr_metric);
1386	if (!rt) {
1387	ND_PRINTK(0, err,
1388	"RA: %s failed to add default route\n",
1389	__func__);
1390	return reason;
1391	}
1392
1393	neigh = ip6_neigh_lookup(gw: &rt->fib6_nh->fib_nh_gw6,
1394	dev: rt->fib6_nh->fib_nh_dev, NULL,
1395	daddr: &ipv6_hdr(skb)->saddr);
1396	if (!neigh) {
1397	ND_PRINTK(0, err,
1398	"RA: %s got default router without neighbour\n",
1399	__func__);
1400	fib6_info_release(f6i: rt);
1401	return reason;
1402	}
1403	neigh->flags |= NTF_ROUTER;
1404	} else if (rt && IPV6_EXTRACT_PREF(rt->fib6_flags) != pref) {
1405	struct nl_info nlinfo = {
1406	.nl_net = net,
1407	};
1408	rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
1409	inet6_rt_notify(RTM_NEWROUTE, rt, info: &nlinfo, NLM_F_REPLACE);
1410	}
1411
1412	if (rt)
1413	fib6_set_expires(f6i: rt, expires: jiffies + (HZ * lifetime));
1414	if (in6_dev->cnf.accept_ra_min_hop_limit < 256 &&
1415	ra_msg->icmph.icmp6_hop_limit) {
1416	if (in6_dev->cnf.accept_ra_min_hop_limit <= ra_msg->icmph.icmp6_hop_limit) {
1417	in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
1418	fib6_metric_set(f6i: rt, RTAX_HOPLIMIT,
1419	val: ra_msg->icmph.icmp6_hop_limit);
1420	} else {
1421	ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n");
1422	}
1423	}
1424
1425	skip_defrtr:
1426
1427	/*
1428	* Update Reachable Time and Retrans Timer
1429	*/
1430
1431	if (in6_dev->nd_parms) {
1432	unsigned long rtime = ntohl(ra_msg->retrans_timer);
1433
1434	if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) {
1435	rtime = (rtime*HZ)/1000;
1436	if (rtime < HZ/100)
1437	rtime = HZ/100;
1438	NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
1439	in6_dev->tstamp = jiffies;
1440	send_ifinfo_notify = true;
1441	}
1442
1443	rtime = ntohl(ra_msg->reachable_time);
1444	if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) {
1445	rtime = (rtime*HZ)/1000;
1446
1447	if (rtime < HZ/10)
1448	rtime = HZ/10;
1449
1450	if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
1451	NEIGH_VAR_SET(in6_dev->nd_parms,
1452	BASE_REACHABLE_TIME, rtime);
1453	NEIGH_VAR_SET(in6_dev->nd_parms,
1454	GC_STALETIME, 3 * rtime);
1455	in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(base: rtime);
1456	in6_dev->tstamp = jiffies;
1457	send_ifinfo_notify = true;
1458	}
1459	}
1460	}
1461
1462	skip_linkparms:
1463
1464	/*
1465	* Process options.
1466	*/
1467
1468	if (!neigh)
1469	neigh = __neigh_lookup(tbl: &nd_tbl, pkey: &ipv6_hdr(skb)->saddr,
1470	dev: skb->dev, creat: 1);
1471	if (neigh) {
1472	u8 *lladdr = NULL;
1473	if (ndopts.nd_opts_src_lladdr) {
1474	lladdr = ndisc_opt_addr_data(p: ndopts.nd_opts_src_lladdr,
1475	dev: skb->dev);
1476	if (!lladdr) {
1477	ND_PRINTK(2, warn,
1478	"RA: invalid link-layer address length\n");
1479	goto out;
1480	}
1481	}
1482	ndisc_update(dev: skb->dev, neigh, lladdr, NUD_STALE,
1483	NEIGH_UPDATE_F_WEAK_OVERRIDE|
1484	NEIGH_UPDATE_F_OVERRIDE|
1485	NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1486	NEIGH_UPDATE_F_ISROUTER,
1487	NDISC_ROUTER_ADVERTISEMENT, ndopts: &ndopts);
1488	reason = SKB_CONSUMED;
1489	}
1490
1491	if (!ipv6_accept_ra(idev: in6_dev)) {
1492	ND_PRINTK(2, info,
1493	"RA: %s, accept_ra is false for dev: %s\n",
1494	__func__, skb->dev->name);
1495	goto out;
1496	}
1497
1498	#ifdef CONFIG_IPV6_ROUTE_INFO
1499	if (!in6_dev->cnf.accept_ra_from_local &&
1500	ipv6_chk_addr(net: dev_net(dev: in6_dev->dev), addr: &ipv6_hdr(skb)->saddr,
1501	dev: in6_dev->dev, strict: 0)) {
1502	ND_PRINTK(2, info,
1503	"RA from local address detected on dev: %s: router info ignored.\n",
1504	skb->dev->name);
1505	goto skip_routeinfo;
1506	}
1507
1508	if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
1509	struct nd_opt_hdr *p;
1510	for (p = ndopts.nd_opts_ri;
1511	p;
1512	p = ndisc_next_option(cur: p, end: ndopts.nd_opts_ri_end)) {
1513	struct route_info *ri = (struct route_info *)p;
1514	#ifdef CONFIG_IPV6_NDISC_NODETYPE
1515	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
1516	ri->prefix_len == 0)
1517	continue;
1518	#endif
1519	if (ri->prefix_len == 0 &&
1520	!in6_dev->cnf.accept_ra_defrtr)
1521	continue;
1522	if (ri->lifetime != 0 &&
1523	ntohl(ri->lifetime) < in6_dev->cnf.accept_ra_min_lft)
1524	continue;
1525	if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
1526	continue;
1527	if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
1528	continue;
1529	rt6_route_rcv(dev: skb->dev, opt: (u8 *)p, len: (p->nd_opt_len) << 3,
1530	gwaddr: &ipv6_hdr(skb)->saddr);
1531	}
1532	}
1533
1534	skip_routeinfo:
1535	#endif
1536
1537	#ifdef CONFIG_IPV6_NDISC_NODETYPE
1538	/* skip link-specific ndopts from interior routers */
1539	if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
1540	ND_PRINTK(2, info,
1541	"RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n",
1542	__func__, skb->dev->name);
1543	goto out;
1544	}
1545	#endif
1546
1547	if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
1548	struct nd_opt_hdr *p;
1549	for (p = ndopts.nd_opts_pi;
1550	p;
1551	p = ndisc_next_option(cur: p, end: ndopts.nd_opts_pi_end)) {
1552	addrconf_prefix_rcv(dev: skb->dev, opt: (u8 *)p,
1553	len: (p->nd_opt_len) << 3,
1554	sllao: ndopts.nd_opts_src_lladdr != NULL);
1555	}
1556	}
1557
1558	if (ndopts.nd_opts_mtu && in6_dev->cnf.accept_ra_mtu) {
1559	__be32 n;
1560	u32 mtu;
1561
1562	memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
1563	mtu = ntohl(n);
1564
1565	if (in6_dev->ra_mtu != mtu) {
1566	in6_dev->ra_mtu = mtu;
1567	send_ifinfo_notify = true;
1568	}
1569
1570	if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
1571	ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
1572	} else if (in6_dev->cnf.mtu6 != mtu) {
1573	in6_dev->cnf.mtu6 = mtu;
1574	fib6_metric_set(f6i: rt, RTAX_MTU, val: mtu);
1575	rt6_mtu_change(dev: skb->dev, mtu);
1576	}
1577	}
1578
1579	if (ndopts.nd_useropts) {
1580	struct nd_opt_hdr *p;
1581	for (p = ndopts.nd_useropts;
1582	p;
1583	p = ndisc_next_useropt(dev: skb->dev, cur: p,
1584	end: ndopts.nd_useropts_end)) {
1585	ndisc_ra_useropt(ra: skb, opt: p);
1586	}
1587	}
1588
1589	if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
1590	ND_PRINTK(2, warn, "RA: invalid RA options\n");
1591	}
1592	out:
1593	/* Send a notify if RA changed managed/otherconf flags or
1594	* timer settings or ra_mtu value
1595	*/
1596	if (send_ifinfo_notify)
1597	inet6_ifinfo_notify(RTM_NEWLINK, idev: in6_dev);
1598
1599	fib6_info_release(f6i: rt);
1600	if (neigh)
1601	neigh_release(neigh);
1602	return reason;
1603	}
1604
1605	static enum skb_drop_reason ndisc_redirect_rcv(struct sk_buff *skb)
1606	{
1607	struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
1608	u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
1609	offsetof(struct rd_msg, opt));
1610	struct ndisc_options ndopts;
1611	SKB_DR(reason);
1612	u8 *hdr;
1613
1614	#ifdef CONFIG_IPV6_NDISC_NODETYPE
1615	switch (skb->ndisc_nodetype) {
1616	case NDISC_NODETYPE_HOST:
1617	case NDISC_NODETYPE_NODEFAULT:
1618	ND_PRINTK(2, warn,
1619	"Redirect: from host or unauthorized router\n");
1620	return reason;
1621	}
1622	#endif
1623
1624	if (!(ipv6_addr_type(addr: &ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
1625	ND_PRINTK(2, warn,
1626	"Redirect: source address is not link-local\n");
1627	return reason;
1628	}
1629
1630	if (!ndisc_parse_options(dev: skb->dev, opt: msg->opt, opt_len: ndoptlen, ndopts: &ndopts))
1631	return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS;
1632
1633	if (!ndopts.nd_opts_rh) {
1634	ip6_redirect_no_header(skb, net: dev_net(dev: skb->dev),
1635	oif: skb->dev->ifindex);
1636	return reason;
1637	}
1638
1639	hdr = (u8 *)ndopts.nd_opts_rh;
1640	hdr += 8;
1641	if (!pskb_pull(skb, len: hdr - skb_transport_header(skb)))
1642	return SKB_DROP_REASON_PKT_TOO_SMALL;
1643
1644	return icmpv6_notify(skb, NDISC_REDIRECT, code: 0, info: 0);
1645	}
1646
1647	static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
1648	struct sk_buff *orig_skb,
1649	int rd_len)
1650	{
1651	u8 *opt = skb_put(skb, len: rd_len);
1652
1653	memset(opt, 0, 8);
1654	*(opt++) = ND_OPT_REDIRECT_HDR;
1655	*(opt++) = (rd_len >> 3);
1656	opt += 6;
1657
1658	skb_copy_bits(skb: orig_skb, offset: skb_network_offset(skb: orig_skb), to: opt,
1659	len: rd_len - 8);
1660	}
1661
1662	void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
1663	{
1664	struct net_device *dev = skb->dev;
1665	struct net *net = dev_net(dev);
1666	struct sock *sk = net->ipv6.ndisc_sk;
1667	int optlen = 0;
1668	struct inet_peer *peer;
1669	struct sk_buff *buff;
1670	struct rd_msg *msg;
1671	struct in6_addr saddr_buf;
1672	struct rt6_info *rt;
1673	struct dst_entry *dst;
1674	struct flowi6 fl6;
1675	int rd_len;
1676	u8 ha_buf[MAX_ADDR_LEN], *ha = NULL,
1677	ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
1678	bool ret;
1679
1680	if (netif_is_l3_master(dev: skb->dev)) {
1681	dev = __dev_get_by_index(net: dev_net(dev: skb->dev), IPCB(skb)->iif);
1682	if (!dev)
1683	return;
1684	}
1685
1686	if (ipv6_get_lladdr(dev, addr: &saddr_buf, IFA_F_TENTATIVE)) {
1687	ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
1688	dev->name);
1689	return;
1690	}
1691
1692	if (!ipv6_addr_equal(a1: &ipv6_hdr(skb)->daddr, a2: target) &&
1693	ipv6_addr_type(addr: target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1694	ND_PRINTK(2, warn,
1695	"Redirect: target address is not link-local unicast\n");
1696	return;
1697	}
1698
1699	icmpv6_flow_init(sk, fl6: &fl6, NDISC_REDIRECT,
1700	saddr: &saddr_buf, daddr: &ipv6_hdr(skb)->saddr, oif: dev->ifindex);
1701
1702	dst = ip6_route_output(net, NULL, fl6: &fl6);
1703	if (dst->error) {
1704	dst_release(dst);
1705	return;
1706	}
1707	dst = xfrm_lookup(net, dst_orig: dst, fl: flowi6_to_flowi(fl6: &fl6), NULL, flags: 0);
1708	if (IS_ERR(ptr: dst))
1709	return;
1710
1711	rt = (struct rt6_info *) dst;
1712
1713	if (rt->rt6i_flags & RTF_GATEWAY) {
1714	ND_PRINTK(2, warn,
1715	"Redirect: destination is not a neighbour\n");
1716	goto release;
1717	}
1718	peer = inet_getpeer_v6(base: net->ipv6.peers, v6daddr: &ipv6_hdr(skb)->saddr, create: 1);
1719	ret = inet_peer_xrlim_allow(peer, timeout: 1*HZ);
1720	if (peer)
1721	inet_putpeer(p: peer);
1722	if (!ret)
1723	goto release;
1724
1725	if (dev->addr_len) {
1726	struct neighbour *neigh = dst_neigh_lookup(dst: skb_dst(skb), daddr: target);
1727	if (!neigh) {
1728	ND_PRINTK(2, warn,
1729	"Redirect: no neigh for target address\n");
1730	goto release;
1731	}
1732
1733	read_lock_bh(&neigh->lock);
1734	if (neigh->nud_state & NUD_VALID) {
1735	memcpy(ha_buf, neigh->ha, dev->addr_len);
1736	read_unlock_bh(&neigh->lock);
1737	ha = ha_buf;
1738	optlen += ndisc_redirect_opt_addr_space(dev, neigh,
1739	ops_data_buf,
1740	ops_data: &ops_data);
1741	} else
1742	read_unlock_bh(&neigh->lock);
1743
1744	neigh_release(neigh);
1745	}
1746
1747	rd_len = min_t(unsigned int,
1748	IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen,
1749	skb->len + 8);
1750	rd_len &= ~0x7;
1751	optlen += rd_len;
1752
1753	buff = ndisc_alloc_skb(dev, len: sizeof(*msg) + optlen);
1754	if (!buff)
1755	goto release;
1756
1757	msg = skb_put(skb: buff, len: sizeof(*msg));
1758	*msg = (struct rd_msg) {
1759	.icmph = {
1760	.icmp6_type = NDISC_REDIRECT,
1761	},
1762	.target = *target,
1763	.dest = ipv6_hdr(skb)->daddr,
1764	};
1765
1766	/*
1767	* include target_address option
1768	*/
1769
1770	if (ha)
1771	ndisc_fill_redirect_addr_option(skb: buff, ha, ops_data);
1772
1773	/*
1774	* build redirect option and copy skb over to the new packet.
1775	*/
1776
1777	if (rd_len)
1778	ndisc_fill_redirect_hdr_option(skb: buff, orig_skb: skb, rd_len);
1779
1780	skb_dst_set(skb: buff, dst);
1781	ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf);
1782	return;
1783
1784	release:
1785	dst_release(dst);
1786	}
1787
1788	static void pndisc_redo(struct sk_buff *skb)
1789	{
1790	enum skb_drop_reason reason = ndisc_recv_ns(skb);
1791
1792	kfree_skb_reason(skb, reason);
1793	}
1794
1795	static int ndisc_is_multicast(const void *pkey)
1796	{
1797	return ipv6_addr_is_multicast(addr: (struct in6_addr *)pkey);
1798	}
1799
1800	static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
1801	{
1802	struct inet6_dev *idev = __in6_dev_get(dev: skb->dev);
1803
1804	if (!idev)
1805	return true;
1806	if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED &&
1807	idev->cnf.suppress_frag_ndisc) {
1808	net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n");
1809	return true;
1810	}
1811	return false;
1812	}
1813
1814	enum skb_drop_reason ndisc_rcv(struct sk_buff *skb)
1815	{
1816	struct nd_msg *msg;
1817	SKB_DR(reason);
1818
1819	if (ndisc_suppress_frag_ndisc(skb))
1820	return SKB_DROP_REASON_IPV6_NDISC_FRAG;
1821
1822	if (skb_linearize(skb))
1823	return SKB_DROP_REASON_NOMEM;
1824
1825	msg = (struct nd_msg *)skb_transport_header(skb);
1826
1827	__skb_push(skb, len: skb->data - skb_transport_header(skb));
1828
1829	if (ipv6_hdr(skb)->hop_limit != 255) {
1830	ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
1831	ipv6_hdr(skb)->hop_limit);
1832	return SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT;
1833	}
1834
1835	if (msg->icmph.icmp6_code != 0) {
1836	ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
1837	msg->icmph.icmp6_code);
1838	return SKB_DROP_REASON_IPV6_NDISC_BAD_CODE;
1839	}
1840
1841	switch (msg->icmph.icmp6_type) {
1842	case NDISC_NEIGHBOUR_SOLICITATION:
1843	memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
1844	reason = ndisc_recv_ns(skb);
1845	break;
1846
1847	case NDISC_NEIGHBOUR_ADVERTISEMENT:
1848	reason = ndisc_recv_na(skb);
1849	break;
1850
1851	case NDISC_ROUTER_SOLICITATION:
1852	reason = ndisc_recv_rs(skb);
1853	break;
1854
1855	case NDISC_ROUTER_ADVERTISEMENT:
1856	reason = ndisc_router_discovery(skb);
1857	break;
1858
1859	case NDISC_REDIRECT:
1860	reason = ndisc_redirect_rcv(skb);
1861	break;
1862	}
1863
1864	return reason;
1865	}
1866
1867	static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
1868	{
1869	struct net_device *dev = netdev_notifier_info_to_dev(info: ptr);
1870	struct netdev_notifier_change_info *change_info;
1871	struct net *net = dev_net(dev);
1872	struct inet6_dev *idev;
1873	bool evict_nocarrier;
1874
1875	switch (event) {
1876	case NETDEV_CHANGEADDR:
1877	neigh_changeaddr(tbl: &nd_tbl, dev);
1878	fib6_run_gc(expires: 0, net, force: false);
1879	fallthrough;
1880	case NETDEV_UP:
1881	idev = in6_dev_get(dev);
1882	if (!idev)
1883	break;
1884	if (idev->cnf.ndisc_notify ||
1885	net->ipv6.devconf_all->ndisc_notify)
1886	ndisc_send_unsol_na(dev);
1887	in6_dev_put(idev);
1888	break;
1889	case NETDEV_CHANGE:
1890	idev = in6_dev_get(dev);
1891	if (!idev)
1892	evict_nocarrier = true;
1893	else {
1894	evict_nocarrier = idev->cnf.ndisc_evict_nocarrier &&
1895	net->ipv6.devconf_all->ndisc_evict_nocarrier;
1896	in6_dev_put(idev);
1897	}
1898
1899	change_info = ptr;
1900	if (change_info->flags_changed & IFF_NOARP)
1901	neigh_changeaddr(tbl: &nd_tbl, dev);
1902	if (evict_nocarrier && !netif_carrier_ok(dev))
1903	neigh_carrier_down(tbl: &nd_tbl, dev);
1904	break;
1905	case NETDEV_DOWN:
1906	neigh_ifdown(tbl: &nd_tbl, dev);
1907	fib6_run_gc(expires: 0, net, force: false);
1908	break;
1909	case NETDEV_NOTIFY_PEERS:
1910	ndisc_send_unsol_na(dev);
1911	break;
1912	default:
1913	break;
1914	}
1915
1916	return NOTIFY_DONE;
1917	}
1918
1919	static struct notifier_block ndisc_netdev_notifier = {
1920	.notifier_call = ndisc_netdev_event,
1921	.priority = ADDRCONF_NOTIFY_PRIORITY - 5,
1922	};
1923
1924	#ifdef CONFIG_SYSCTL
1925	static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
1926	const char *func, const char *dev_name)
1927	{
1928	static char warncomm[TASK_COMM_LEN];
1929	static int warned;
1930	if (strcmp(warncomm, current->comm) && warned < 5) {
1931	strcpy(p: warncomm, current->comm);
1932	pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
1933	warncomm, func,
1934	dev_name, ctl->procname,
1935	dev_name, ctl->procname);
1936	warned++;
1937	}
1938	}
1939
1940	int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void *buffer,
1941	size_t *lenp, loff_t *ppos)
1942	{
1943	struct net_device *dev = ctl->extra1;
1944	struct inet6_dev *idev;
1945	int ret;
1946
1947	if ((strcmp(ctl->procname, "retrans_time") == 0) ||
1948	(strcmp(ctl->procname, "base_reachable_time") == 0))
1949	ndisc_warn_deprecated_sysctl(ctl, func: "syscall", dev_name: dev ? dev->name : "default");
1950
1951	if (strcmp(ctl->procname, "retrans_time") == 0)
1952	ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
1953
1954	else if (strcmp(ctl->procname, "base_reachable_time") == 0)
1955	ret = neigh_proc_dointvec_jiffies(ctl, write,
1956	buffer, lenp, ppos);
1957
1958	else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
1959	(strcmp(ctl->procname, "base_reachable_time_ms") == 0))
1960	ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
1961	buffer, lenp, ppos);
1962	else
1963	ret = -1;
1964
1965	if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
1966	if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
1967	idev->nd_parms->reachable_time =
1968	neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
1969	idev->tstamp = jiffies;
1970	inet6_ifinfo_notify(RTM_NEWLINK, idev);
1971	in6_dev_put(idev);
1972	}
1973	return ret;
1974	}
1975
1976
1977	#endif
1978
1979	static int __net_init ndisc_net_init(struct net *net)
1980	{
1981	struct ipv6_pinfo *np;
1982	struct sock *sk;
1983	int err;
1984
1985	err = inet_ctl_sock_create(sk: &sk, PF_INET6,
1986	type: SOCK_RAW, IPPROTO_ICMPV6, net);
1987	if (err < 0) {
1988	ND_PRINTK(0, err,
1989	"NDISC: Failed to initialize the control socket (err %d)\n",
1990	err);
1991	return err;
1992	}
1993
1994	net->ipv6.ndisc_sk = sk;
1995
1996	np = inet6_sk(sk: sk);
1997	np->hop_limit = 255;
1998	/* Do not loopback ndisc messages */
1999	inet6_clear_bit(MC6_LOOP, sk);
2000
2001	return 0;
2002	}
2003
2004	static void __net_exit ndisc_net_exit(struct net *net)
2005	{
2006	inet_ctl_sock_destroy(sk: net->ipv6.ndisc_sk);
2007	}
2008
2009	static struct pernet_operations ndisc_net_ops = {
2010	.init = ndisc_net_init,
2011	.exit = ndisc_net_exit,
2012	};
2013
2014	int __init ndisc_init(void)
2015	{
2016	int err;
2017
2018	err = register_pernet_subsys(&ndisc_net_ops);
2019	if (err)
2020	return err;
2021	/*
2022	* Initialize the neighbour table
2023	*/
2024	neigh_table_init(index: NEIGH_ND_TABLE, tbl: &nd_tbl);
2025
2026	#ifdef CONFIG_SYSCTL
2027	err = neigh_sysctl_register(NULL, p: &nd_tbl.parms,
2028	proc_handler: ndisc_ifinfo_sysctl_change);
2029	if (err)
2030	goto out_unregister_pernet;
2031	out:
2032	#endif
2033	return err;
2034
2035	#ifdef CONFIG_SYSCTL
2036	out_unregister_pernet:
2037	unregister_pernet_subsys(&ndisc_net_ops);
2038	goto out;
2039	#endif
2040	}
2041
2042	int __init ndisc_late_init(void)
2043	{
2044	return register_netdevice_notifier(nb: &ndisc_netdev_notifier);
2045	}
2046
2047	void ndisc_late_cleanup(void)
2048	{
2049	unregister_netdevice_notifier(nb: &ndisc_netdev_notifier);
2050	}
2051
2052	void ndisc_cleanup(void)
2053	{
2054	#ifdef CONFIG_SYSCTL
2055	neigh_sysctl_unregister(p: &nd_tbl.parms);
2056	#endif
2057	neigh_table_clear(index: NEIGH_ND_TABLE, tbl: &nd_tbl);
2058	unregister_pernet_subsys(&ndisc_net_ops);
2059	}
2060