1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Neighbour Discovery for IPv6 4 * Linux INET6 implementation 5 * 6 * Authors: 7 * Pedro Roque <roque@di.fc.ul.pt> 8 * Mike Shaver <shaver@ingenia.com> 9 */ 10 11 /* 12 * Changes: 13 * 14 * Alexey I. Froloff : RFC6106 (DNSSL) support 15 * Pierre Ynard : export userland ND options 16 * through netlink (RDNSS support) 17 * Lars Fenneberg : fixed MTU setting on receipt 18 * of an RA. 19 * Janos Farkas : kmalloc failure checks 20 * Alexey Kuznetsov : state machine reworked 21 * and moved to net/core. 22 * Pekka Savola : RFC2461 validation 23 * YOSHIFUJI Hideaki @USAGI : Verify ND options properly 24 */ 25 26 #define pr_fmt(fmt) "ICMPv6: " fmt 27 28 #include <linux/module.h> 29 #include <linux/errno.h> 30 #include <linux/types.h> 31 #include <linux/socket.h> 32 #include <linux/sockios.h> 33 #include <linux/sched.h> 34 #include <linux/net.h> 35 #include <linux/in6.h> 36 #include <linux/route.h> 37 #include <linux/init.h> 38 #include <linux/rcupdate.h> 39 #include <linux/slab.h> 40 #ifdef CONFIG_SYSCTL 41 #include <linux/sysctl.h> 42 #endif 43 44 #include <linux/if_addr.h> 45 #include <linux/if_ether.h> 46 #include <linux/if_arp.h> 47 #include <linux/ipv6.h> 48 #include <linux/icmpv6.h> 49 #include <linux/jhash.h> 50 51 #include <net/sock.h> 52 #include <net/snmp.h> 53 54 #include <net/ipv6.h> 55 #include <net/protocol.h> 56 #include <net/ndisc.h> 57 #include <net/ip6_route.h> 58 #include <net/addrconf.h> 59 #include <net/icmp.h> 60 61 #include <net/netlink.h> 62 #include <linux/rtnetlink.h> 63 64 #include <net/flow.h> 65 #include <net/ip6_checksum.h> 66 #include <net/inet_common.h> 67 #include <linux/proc_fs.h> 68 69 #include <linux/netfilter.h> 70 #include <linux/netfilter_ipv6.h> 71 72 static u32 ndisc_hash(const void *pkey, 73 const struct net_device *dev, 74 __u32 *hash_rnd); 75 static bool ndisc_key_eq(const struct neighbour *neigh, const void *pkey); 76 static bool ndisc_allow_add(const struct net_device *dev, 77 struct netlink_ext_ack *extack); 78 static int ndisc_constructor(struct neighbour *neigh); 79 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb); 80 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb); 81 static int pndisc_constructor(struct pneigh_entry *n); 82 static void pndisc_destructor(struct pneigh_entry *n); 83 static void pndisc_redo(struct sk_buff *skb); 84 static int ndisc_is_multicast(const void *pkey); 85 86 static const struct neigh_ops ndisc_generic_ops = { 87 .family = AF_INET6, 88 .solicit = ndisc_solicit, 89 .error_report = ndisc_error_report, 90 .output = neigh_resolve_output, 91 .connected_output = neigh_connected_output, 92 }; 93 94 static const struct neigh_ops ndisc_hh_ops = { 95 .family = AF_INET6, 96 .solicit = ndisc_solicit, 97 .error_report = ndisc_error_report, 98 .output = neigh_resolve_output, 99 .connected_output = neigh_resolve_output, 100 }; 101 102 103 static const struct neigh_ops ndisc_direct_ops = { 104 .family = AF_INET6, 105 .output = neigh_direct_output, 106 .connected_output = neigh_direct_output, 107 }; 108 109 struct neigh_table nd_tbl = { 110 .family = AF_INET6, 111 .key_len = sizeof(struct in6_addr), 112 .protocol = cpu_to_be16(ETH_P_IPV6), 113 .hash = ndisc_hash, 114 .key_eq = ndisc_key_eq, 115 .constructor = ndisc_constructor, 116 .pconstructor = pndisc_constructor, 117 .pdestructor = pndisc_destructor, 118 .proxy_redo = pndisc_redo, 119 .is_multicast = ndisc_is_multicast, 120 .allow_add = ndisc_allow_add, 121 .id = "ndisc_cache", 122 .parms = { 123 .tbl = &nd_tbl, 124 .reachable_time = ND_REACHABLE_TIME, 125 .data = { 126 [NEIGH_VAR_MCAST_PROBES] = 3, 127 [NEIGH_VAR_UCAST_PROBES] = 3, 128 [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER, 129 [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME, 130 [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ, 131 [NEIGH_VAR_INTERVAL_PROBE_TIME_MS] = 5 * HZ, 132 [NEIGH_VAR_GC_STALETIME] = 60 * HZ, 133 [NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_MAX, 134 [NEIGH_VAR_PROXY_QLEN] = 64, 135 [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ, 136 [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10, 137 }, 138 }, 139 .gc_interval = 30 * HZ, 140 .gc_thresh1 = 128, 141 .gc_thresh2 = 512, 142 .gc_thresh3 = 1024, 143 }; 144 EXPORT_SYMBOL_GPL(nd_tbl); 145 146 void __ndisc_fill_addr_option(struct sk_buff *skb, int type, const void *data, 147 int data_len, int pad) 148 { 149 int space = __ndisc_opt_addr_space(data_len, pad); 150 u8 *opt = skb_put(skb, space); 151 152 opt[0] = type; 153 opt[1] = space>>3; 154 155 memset(opt + 2, 0, pad); 156 opt += pad; 157 space -= pad; 158 159 memcpy(opt+2, data, data_len); 160 data_len += 2; 161 opt += data_len; 162 space -= data_len; 163 if (space > 0) 164 memset(opt, 0, space); 165 } 166 EXPORT_SYMBOL_GPL(__ndisc_fill_addr_option); 167 168 static inline void ndisc_fill_addr_option(struct sk_buff *skb, int type, 169 const void *data, u8 icmp6_type) 170 { 171 __ndisc_fill_addr_option(skb, type, data, skb->dev->addr_len, 172 ndisc_addr_option_pad(skb->dev->type)); 173 ndisc_ops_fill_addr_option(skb->dev, skb, icmp6_type); 174 } 175 176 static inline void ndisc_fill_redirect_addr_option(struct sk_buff *skb, 177 void *ha, 178 const u8 *ops_data) 179 { 180 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, ha, NDISC_REDIRECT); 181 ndisc_ops_fill_redirect_addr_option(skb->dev, skb, ops_data); 182 } 183 184 static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur, 185 struct nd_opt_hdr *end) 186 { 187 int type; 188 if (!cur || !end || cur >= end) 189 return NULL; 190 type = cur->nd_opt_type; 191 do { 192 cur = ((void *)cur) + (cur->nd_opt_len << 3); 193 } while (cur < end && cur->nd_opt_type != type); 194 return cur <= end && cur->nd_opt_type == type ? cur : NULL; 195 } 196 197 static inline int ndisc_is_useropt(const struct net_device *dev, 198 struct nd_opt_hdr *opt) 199 { 200 return opt->nd_opt_type == ND_OPT_PREFIX_INFO || 201 opt->nd_opt_type == ND_OPT_RDNSS || 202 opt->nd_opt_type == ND_OPT_DNSSL || 203 opt->nd_opt_type == ND_OPT_6CO || 204 opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL || 205 opt->nd_opt_type == ND_OPT_PREF64; 206 } 207 208 static struct nd_opt_hdr *ndisc_next_useropt(const struct net_device *dev, 209 struct nd_opt_hdr *cur, 210 struct nd_opt_hdr *end) 211 { 212 if (!cur || !end || cur >= end) 213 return NULL; 214 do { 215 cur = ((void *)cur) + (cur->nd_opt_len << 3); 216 } while (cur < end && !ndisc_is_useropt(dev, cur)); 217 return cur <= end && ndisc_is_useropt(dev, cur) ? cur : NULL; 218 } 219 220 struct ndisc_options *ndisc_parse_options(const struct net_device *dev, 221 u8 *opt, int opt_len, 222 struct ndisc_options *ndopts) 223 { 224 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt; 225 226 if (!nd_opt || opt_len < 0 || !ndopts) 227 return NULL; 228 memset(ndopts, 0, sizeof(*ndopts)); 229 while (opt_len) { 230 bool unknown = false; 231 int l; 232 if (opt_len < sizeof(struct nd_opt_hdr)) 233 return NULL; 234 l = nd_opt->nd_opt_len << 3; 235 if (opt_len < l || l == 0) 236 return NULL; 237 if (ndisc_ops_parse_options(dev, nd_opt, ndopts)) 238 goto next_opt; 239 switch (nd_opt->nd_opt_type) { 240 case ND_OPT_SOURCE_LL_ADDR: 241 case ND_OPT_TARGET_LL_ADDR: 242 case ND_OPT_MTU: 243 case ND_OPT_NONCE: 244 case ND_OPT_REDIRECT_HDR: 245 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) { 246 ND_PRINTK(2, warn, 247 "%s: duplicated ND6 option found: type=%d\n", 248 __func__, nd_opt->nd_opt_type); 249 } else { 250 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt; 251 } 252 break; 253 case ND_OPT_PREFIX_INFO: 254 ndopts->nd_opts_pi_end = nd_opt; 255 if (!ndopts->nd_opt_array[nd_opt->nd_opt_type]) 256 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt; 257 break; 258 #ifdef CONFIG_IPV6_ROUTE_INFO 259 case ND_OPT_ROUTE_INFO: 260 ndopts->nd_opts_ri_end = nd_opt; 261 if (!ndopts->nd_opts_ri) 262 ndopts->nd_opts_ri = nd_opt; 263 break; 264 #endif 265 default: 266 unknown = true; 267 } 268 if (ndisc_is_useropt(dev, nd_opt)) { 269 ndopts->nd_useropts_end = nd_opt; 270 if (!ndopts->nd_useropts) 271 ndopts->nd_useropts = nd_opt; 272 } else if (unknown) { 273 /* 274 * Unknown options must be silently ignored, 275 * to accommodate future extension to the 276 * protocol. 277 */ 278 ND_PRINTK(2, notice, 279 "%s: ignored unsupported option; type=%d, len=%d\n", 280 __func__, 281 nd_opt->nd_opt_type, 282 nd_opt->nd_opt_len); 283 } 284 next_opt: 285 opt_len -= l; 286 nd_opt = ((void *)nd_opt) + l; 287 } 288 return ndopts; 289 } 290 291 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir) 292 { 293 switch (dev->type) { 294 case ARPHRD_ETHER: 295 case ARPHRD_IEEE802: /* Not sure. Check it later. --ANK */ 296 case ARPHRD_FDDI: 297 ipv6_eth_mc_map(addr, buf); 298 return 0; 299 case ARPHRD_ARCNET: 300 ipv6_arcnet_mc_map(addr, buf); 301 return 0; 302 case ARPHRD_INFINIBAND: 303 ipv6_ib_mc_map(addr, dev->broadcast, buf); 304 return 0; 305 case ARPHRD_IPGRE: 306 return ipv6_ipgre_mc_map(addr, dev->broadcast, buf); 307 default: 308 if (dir) { 309 memcpy(buf, dev->broadcast, dev->addr_len); 310 return 0; 311 } 312 } 313 return -EINVAL; 314 } 315 EXPORT_SYMBOL(ndisc_mc_map); 316 317 static u32 ndisc_hash(const void *pkey, 318 const struct net_device *dev, 319 __u32 *hash_rnd) 320 { 321 return ndisc_hashfn(pkey, dev, hash_rnd); 322 } 323 324 static bool ndisc_key_eq(const struct neighbour *n, const void *pkey) 325 { 326 return neigh_key_eq128(n, pkey); 327 } 328 329 static int ndisc_constructor(struct neighbour *neigh) 330 { 331 struct in6_addr *addr = (struct in6_addr *)&neigh->primary_key; 332 struct net_device *dev = neigh->dev; 333 struct inet6_dev *in6_dev; 334 struct neigh_parms *parms; 335 bool is_multicast = ipv6_addr_is_multicast(addr); 336 337 in6_dev = in6_dev_get(dev); 338 if (!in6_dev) { 339 return -EINVAL; 340 } 341 342 parms = in6_dev->nd_parms; 343 __neigh_parms_put(neigh->parms); 344 neigh->parms = neigh_parms_clone(parms); 345 346 neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST; 347 if (!dev->header_ops) { 348 neigh->nud_state = NUD_NOARP; 349 neigh->ops = &ndisc_direct_ops; 350 neigh->output = neigh_direct_output; 351 } else { 352 if (is_multicast) { 353 neigh->nud_state = NUD_NOARP; 354 ndisc_mc_map(addr, neigh->ha, dev, 1); 355 } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) { 356 neigh->nud_state = NUD_NOARP; 357 memcpy(neigh->ha, dev->dev_addr, dev->addr_len); 358 if (dev->flags&IFF_LOOPBACK) 359 neigh->type = RTN_LOCAL; 360 } else if (dev->flags&IFF_POINTOPOINT) { 361 neigh->nud_state = NUD_NOARP; 362 memcpy(neigh->ha, dev->broadcast, dev->addr_len); 363 } 364 if (dev->header_ops->cache) 365 neigh->ops = &ndisc_hh_ops; 366 else 367 neigh->ops = &ndisc_generic_ops; 368 if (neigh->nud_state&NUD_VALID) 369 neigh->output = neigh->ops->connected_output; 370 else 371 neigh->output = neigh->ops->output; 372 } 373 in6_dev_put(in6_dev); 374 return 0; 375 } 376 377 static int pndisc_constructor(struct pneigh_entry *n) 378 { 379 struct in6_addr *addr = (struct in6_addr *)&n->key; 380 struct net_device *dev = n->dev; 381 struct in6_addr maddr; 382 383 if (!dev) 384 return -EINVAL; 385 386 addrconf_addr_solict_mult(addr, &maddr); 387 return ipv6_dev_mc_inc(dev, &maddr); 388 } 389 390 static void pndisc_destructor(struct pneigh_entry *n) 391 { 392 struct in6_addr *addr = (struct in6_addr *)&n->key; 393 struct net_device *dev = n->dev; 394 struct in6_addr maddr; 395 396 if (!dev) 397 return; 398 399 addrconf_addr_solict_mult(addr, &maddr); 400 ipv6_dev_mc_dec(dev, &maddr); 401 } 402 403 /* called with rtnl held */ 404 static bool ndisc_allow_add(const struct net_device *dev, 405 struct netlink_ext_ack *extack) 406 { 407 struct inet6_dev *idev = __in6_dev_get(dev); 408 409 if (!idev || idev->cnf.disable_ipv6) { 410 NL_SET_ERR_MSG(extack, "IPv6 is disabled on this device"); 411 return false; 412 } 413 414 return true; 415 } 416 417 static struct sk_buff *ndisc_alloc_skb(struct net_device *dev, 418 int len) 419 { 420 int hlen = LL_RESERVED_SPACE(dev); 421 int tlen = dev->needed_tailroom; 422 struct sk_buff *skb; 423 424 skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC); 425 if (!skb) 426 return NULL; 427 428 skb->protocol = htons(ETH_P_IPV6); 429 skb->dev = dev; 430 431 skb_reserve(skb, hlen + sizeof(struct ipv6hdr)); 432 skb_reset_transport_header(skb); 433 434 /* Manually assign socket ownership as we avoid calling 435 * sock_alloc_send_pskb() to bypass wmem buffer limits 436 */ 437 rcu_read_lock(); 438 skb_set_owner_w(skb, dev_net_rcu(dev)->ipv6.ndisc_sk); 439 rcu_read_unlock(); 440 441 return skb; 442 } 443 444 static void ip6_nd_hdr(struct sk_buff *skb, 445 const struct in6_addr *saddr, 446 const struct in6_addr *daddr, 447 int hop_limit, int len) 448 { 449 struct ipv6hdr *hdr; 450 struct inet6_dev *idev; 451 unsigned tclass; 452 453 rcu_read_lock(); 454 idev = __in6_dev_get(skb->dev); 455 tclass = idev ? READ_ONCE(idev->cnf.ndisc_tclass) : 0; 456 rcu_read_unlock(); 457 458 skb_push(skb, sizeof(*hdr)); 459 skb_reset_network_header(skb); 460 hdr = ipv6_hdr(skb); 461 462 ip6_flow_hdr(hdr, tclass, 0); 463 464 hdr->payload_len = htons(len); 465 hdr->nexthdr = IPPROTO_ICMPV6; 466 hdr->hop_limit = hop_limit; 467 468 hdr->saddr = *saddr; 469 hdr->daddr = *daddr; 470 } 471 472 void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr, 473 const struct in6_addr *saddr) 474 { 475 struct icmp6hdr *icmp6h = icmp6_hdr(skb); 476 struct dst_entry *dst = skb_dst(skb); 477 struct net_device *dev; 478 struct inet6_dev *idev; 479 struct net *net; 480 struct sock *sk; 481 int err; 482 u8 type; 483 484 type = icmp6h->icmp6_type; 485 486 rcu_read_lock(); 487 488 net = dev_net_rcu(skb->dev); 489 sk = net->ipv6.ndisc_sk; 490 if (!dst) { 491 struct flowi6 fl6; 492 int oif = skb->dev->ifindex; 493 494 icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif); 495 dst = icmp6_dst_alloc(skb->dev, &fl6); 496 if (IS_ERR(dst)) { 497 rcu_read_unlock(); 498 kfree_skb(skb); 499 return; 500 } 501 502 skb_dst_set(skb, dst); 503 } 504 505 icmp6h->icmp6_cksum = csum_ipv6_magic(saddr, daddr, skb->len, 506 IPPROTO_ICMPV6, 507 csum_partial(icmp6h, 508 skb->len, 0)); 509 510 ip6_nd_hdr(skb, saddr, daddr, READ_ONCE(inet6_sk(sk)->hop_limit), skb->len); 511 512 dev = dst_dev(dst); 513 idev = __in6_dev_get(dev); 514 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS); 515 516 err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, 517 net, sk, skb, NULL, dev, 518 dst_output); 519 if (!err) { 520 ICMP6MSGOUT_INC_STATS(net, idev, type); 521 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); 522 } 523 524 rcu_read_unlock(); 525 } 526 EXPORT_SYMBOL(ndisc_send_skb); 527 528 void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr, 529 const struct in6_addr *solicited_addr, 530 bool router, bool solicited, bool override, bool inc_opt) 531 { 532 struct sk_buff *skb; 533 struct in6_addr tmpaddr; 534 struct inet6_ifaddr *ifp; 535 const struct in6_addr *src_addr; 536 struct nd_msg *msg; 537 int optlen = 0; 538 539 /* for anycast or proxy, solicited_addr != src_addr */ 540 ifp = ipv6_get_ifaddr(dev_net(dev), solicited_addr, dev, 1); 541 if (ifp) { 542 src_addr = solicited_addr; 543 if (ifp->flags & IFA_F_OPTIMISTIC) 544 override = false; 545 inc_opt |= READ_ONCE(ifp->idev->cnf.force_tllao); 546 in6_ifa_put(ifp); 547 } else { 548 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr, 549 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs, 550 &tmpaddr)) 551 return; 552 src_addr = &tmpaddr; 553 } 554 555 if (!dev->addr_len) 556 inc_opt = false; 557 if (inc_opt) 558 optlen += ndisc_opt_addr_space(dev, 559 NDISC_NEIGHBOUR_ADVERTISEMENT); 560 561 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 562 if (!skb) 563 return; 564 565 msg = skb_put(skb, sizeof(*msg)); 566 *msg = (struct nd_msg) { 567 .icmph = { 568 .icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT, 569 .icmp6_router = router, 570 .icmp6_solicited = solicited, 571 .icmp6_override = override, 572 }, 573 .target = *solicited_addr, 574 }; 575 576 if (inc_opt) 577 ndisc_fill_addr_option(skb, ND_OPT_TARGET_LL_ADDR, 578 dev->dev_addr, 579 NDISC_NEIGHBOUR_ADVERTISEMENT); 580 581 ndisc_send_skb(skb, daddr, src_addr); 582 } 583 584 static void ndisc_send_unsol_na(struct net_device *dev) 585 { 586 struct inet6_dev *idev; 587 struct inet6_ifaddr *ifa; 588 589 idev = in6_dev_get(dev); 590 if (!idev) 591 return; 592 593 read_lock_bh(&idev->lock); 594 list_for_each_entry(ifa, &idev->addr_list, if_list) { 595 /* skip tentative addresses until dad completes */ 596 if (ifa->flags & IFA_F_TENTATIVE && 597 !(ifa->flags & IFA_F_OPTIMISTIC)) 598 continue; 599 600 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr, 601 /*router=*/ !!idev->cnf.forwarding, 602 /*solicited=*/ false, /*override=*/ true, 603 /*inc_opt=*/ true); 604 } 605 read_unlock_bh(&idev->lock); 606 607 in6_dev_put(idev); 608 } 609 610 struct sk_buff *ndisc_ns_create(struct net_device *dev, const struct in6_addr *solicit, 611 const struct in6_addr *saddr, u64 nonce) 612 { 613 int inc_opt = dev->addr_len; 614 struct sk_buff *skb; 615 struct nd_msg *msg; 616 int optlen = 0; 617 618 if (!saddr) 619 return NULL; 620 621 if (ipv6_addr_any(saddr)) 622 inc_opt = false; 623 if (inc_opt) 624 optlen += ndisc_opt_addr_space(dev, 625 NDISC_NEIGHBOUR_SOLICITATION); 626 if (nonce != 0) 627 optlen += 8; 628 629 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 630 if (!skb) 631 return NULL; 632 633 msg = skb_put(skb, sizeof(*msg)); 634 *msg = (struct nd_msg) { 635 .icmph = { 636 .icmp6_type = NDISC_NEIGHBOUR_SOLICITATION, 637 }, 638 .target = *solicit, 639 }; 640 641 if (inc_opt) 642 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR, 643 dev->dev_addr, 644 NDISC_NEIGHBOUR_SOLICITATION); 645 if (nonce != 0) { 646 u8 *opt = skb_put(skb, 8); 647 648 opt[0] = ND_OPT_NONCE; 649 opt[1] = 8 >> 3; 650 memcpy(opt + 2, &nonce, 6); 651 } 652 653 return skb; 654 } 655 EXPORT_SYMBOL(ndisc_ns_create); 656 657 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit, 658 const struct in6_addr *daddr, const struct in6_addr *saddr, 659 u64 nonce) 660 { 661 struct in6_addr addr_buf; 662 struct sk_buff *skb; 663 664 if (!saddr) { 665 if (ipv6_get_lladdr(dev, &addr_buf, 666 (IFA_F_TENTATIVE | IFA_F_OPTIMISTIC))) 667 return; 668 saddr = &addr_buf; 669 } 670 671 skb = ndisc_ns_create(dev, solicit, saddr, nonce); 672 673 if (skb) 674 ndisc_send_skb(skb, daddr, saddr); 675 } 676 677 void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr, 678 const struct in6_addr *daddr) 679 { 680 struct sk_buff *skb; 681 struct rs_msg *msg; 682 int send_sllao = dev->addr_len; 683 int optlen = 0; 684 685 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD 686 /* 687 * According to section 2.2 of RFC 4429, we must not 688 * send router solicitations with a sllao from 689 * optimistic addresses, but we may send the solicitation 690 * if we don't include the sllao. So here we check 691 * if our address is optimistic, and if so, we 692 * suppress the inclusion of the sllao. 693 */ 694 if (send_sllao) { 695 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(dev_net(dev), saddr, 696 dev, 1); 697 if (ifp) { 698 if (ifp->flags & IFA_F_OPTIMISTIC) { 699 send_sllao = 0; 700 } 701 in6_ifa_put(ifp); 702 } else { 703 send_sllao = 0; 704 } 705 } 706 #endif 707 if (send_sllao) 708 optlen += ndisc_opt_addr_space(dev, NDISC_ROUTER_SOLICITATION); 709 710 skb = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 711 if (!skb) 712 return; 713 714 msg = skb_put(skb, sizeof(*msg)); 715 *msg = (struct rs_msg) { 716 .icmph = { 717 .icmp6_type = NDISC_ROUTER_SOLICITATION, 718 }, 719 }; 720 721 if (send_sllao) 722 ndisc_fill_addr_option(skb, ND_OPT_SOURCE_LL_ADDR, 723 dev->dev_addr, 724 NDISC_ROUTER_SOLICITATION); 725 726 ndisc_send_skb(skb, daddr, saddr); 727 } 728 729 730 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb) 731 { 732 /* 733 * "The sender MUST return an ICMP 734 * destination unreachable" 735 */ 736 dst_link_failure(skb); 737 kfree_skb(skb); 738 } 739 740 /* Called with locked neigh: either read or both */ 741 742 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb) 743 { 744 struct in6_addr *saddr = NULL; 745 struct in6_addr mcaddr; 746 struct net_device *dev = neigh->dev; 747 struct in6_addr *target = (struct in6_addr *)&neigh->primary_key; 748 int probes = atomic_read(&neigh->probes); 749 750 if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr, 751 dev, false, 1, 752 IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) 753 saddr = &ipv6_hdr(skb)->saddr; 754 probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES); 755 if (probes < 0) { 756 if (!(READ_ONCE(neigh->nud_state) & NUD_VALID)) { 757 ND_PRINTK(1, dbg, 758 "%s: trying to ucast probe in NUD_INVALID: %pI6\n", 759 __func__, target); 760 } 761 ndisc_send_ns(dev, target, target, saddr, 0); 762 } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) { 763 neigh_app_ns(neigh); 764 } else { 765 addrconf_addr_solict_mult(target, &mcaddr); 766 ndisc_send_ns(dev, target, &mcaddr, saddr, 0); 767 } 768 } 769 770 static int pndisc_is_router(const void *pkey, 771 struct net_device *dev) 772 { 773 struct pneigh_entry *n; 774 int ret = -1; 775 776 read_lock_bh(&nd_tbl.lock); 777 n = __pneigh_lookup(&nd_tbl, dev_net(dev), pkey, dev); 778 if (n) 779 ret = !!(n->flags & NTF_ROUTER); 780 read_unlock_bh(&nd_tbl.lock); 781 782 return ret; 783 } 784 785 void ndisc_update(const struct net_device *dev, struct neighbour *neigh, 786 const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type, 787 struct ndisc_options *ndopts) 788 { 789 neigh_update(neigh, lladdr, new, flags, 0); 790 /* report ndisc ops about neighbour update */ 791 ndisc_ops_update(dev, neigh, flags, icmp6_type, ndopts); 792 } 793 794 static enum skb_drop_reason ndisc_recv_ns(struct sk_buff *skb) 795 { 796 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb); 797 const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 798 const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr; 799 u8 *lladdr = NULL; 800 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) + 801 offsetof(struct nd_msg, opt)); 802 struct ndisc_options ndopts; 803 struct net_device *dev = skb->dev; 804 struct inet6_ifaddr *ifp; 805 struct inet6_dev *idev = NULL; 806 struct neighbour *neigh; 807 int dad = ipv6_addr_any(saddr); 808 int is_router = -1; 809 SKB_DR(reason); 810 u64 nonce = 0; 811 bool inc; 812 813 if (skb->len < sizeof(struct nd_msg)) 814 return SKB_DROP_REASON_PKT_TOO_SMALL; 815 816 if (ipv6_addr_is_multicast(&msg->target)) { 817 ND_PRINTK(2, warn, "NS: multicast target address\n"); 818 return reason; 819 } 820 821 /* 822 * RFC2461 7.1.1: 823 * DAD has to be destined for solicited node multicast address. 824 */ 825 if (dad && !ipv6_addr_is_solict_mult(daddr)) { 826 ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n"); 827 return reason; 828 } 829 830 if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) 831 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS; 832 833 if (ndopts.nd_opts_src_lladdr) { 834 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev); 835 if (!lladdr) { 836 ND_PRINTK(2, warn, 837 "NS: invalid link-layer address length\n"); 838 return reason; 839 } 840 841 /* RFC2461 7.1.1: 842 * If the IP source address is the unspecified address, 843 * there MUST NOT be source link-layer address option 844 * in the message. 845 */ 846 if (dad) { 847 ND_PRINTK(2, warn, 848 "NS: bad DAD packet (link-layer address option)\n"); 849 return reason; 850 } 851 } 852 if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1) 853 memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6); 854 855 inc = ipv6_addr_is_multicast(daddr); 856 857 ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1); 858 if (ifp) { 859 have_ifp: 860 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) { 861 if (dad) { 862 if (nonce != 0 && ifp->dad_nonce == nonce) { 863 u8 *np = (u8 *)&nonce; 864 /* Matching nonce if looped back */ 865 ND_PRINTK(2, notice, 866 "%s: IPv6 DAD loopback for address %pI6c nonce %pM ignored\n", 867 ifp->idev->dev->name, 868 &ifp->addr, np); 869 goto out; 870 } 871 /* 872 * We are colliding with another node 873 * who is doing DAD 874 * so fail our DAD process 875 */ 876 addrconf_dad_failure(skb, ifp); 877 return reason; 878 } else { 879 /* 880 * This is not a dad solicitation. 881 * If we are an optimistic node, 882 * we should respond. 883 * Otherwise, we should ignore it. 884 */ 885 if (!(ifp->flags & IFA_F_OPTIMISTIC)) 886 goto out; 887 } 888 } 889 890 idev = ifp->idev; 891 } else { 892 struct net *net = dev_net(dev); 893 894 /* perhaps an address on the master device */ 895 if (netif_is_l3_slave(dev)) { 896 struct net_device *mdev; 897 898 mdev = netdev_master_upper_dev_get_rcu(dev); 899 if (mdev) { 900 ifp = ipv6_get_ifaddr(net, &msg->target, mdev, 1); 901 if (ifp) 902 goto have_ifp; 903 } 904 } 905 906 idev = in6_dev_get(dev); 907 if (!idev) { 908 /* XXX: count this drop? */ 909 return reason; 910 } 911 912 if (ipv6_chk_acast_addr(net, dev, &msg->target) || 913 (READ_ONCE(idev->cnf.forwarding) && 914 (READ_ONCE(net->ipv6.devconf_all->proxy_ndp) || 915 READ_ONCE(idev->cnf.proxy_ndp)) && 916 (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) { 917 if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) && 918 skb->pkt_type != PACKET_HOST && 919 inc && 920 NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) { 921 /* 922 * for anycast or proxy, 923 * sender should delay its response 924 * by a random time between 0 and 925 * MAX_ANYCAST_DELAY_TIME seconds. 926 * (RFC2461) -- yoshfuji 927 */ 928 struct sk_buff *n = skb_clone(skb, GFP_ATOMIC); 929 if (n) 930 pneigh_enqueue(&nd_tbl, idev->nd_parms, n); 931 goto out; 932 } 933 } else { 934 SKB_DR_SET(reason, IPV6_NDISC_NS_OTHERHOST); 935 goto out; 936 } 937 } 938 939 if (is_router < 0) 940 is_router = READ_ONCE(idev->cnf.forwarding); 941 942 if (dad) { 943 ndisc_send_na(dev, &in6addr_linklocal_allnodes, &msg->target, 944 !!is_router, false, (ifp != NULL), true); 945 goto out; 946 } 947 948 if (inc) 949 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_mcast); 950 else 951 NEIGH_CACHE_STAT_INC(&nd_tbl, rcv_probes_ucast); 952 953 /* 954 * update / create cache entry 955 * for the source address 956 */ 957 neigh = __neigh_lookup(&nd_tbl, saddr, dev, 958 !inc || lladdr || !dev->addr_len); 959 if (neigh) 960 ndisc_update(dev, neigh, lladdr, NUD_STALE, 961 NEIGH_UPDATE_F_WEAK_OVERRIDE| 962 NEIGH_UPDATE_F_OVERRIDE, 963 NDISC_NEIGHBOUR_SOLICITATION, &ndopts); 964 if (neigh || !dev->header_ops) { 965 ndisc_send_na(dev, saddr, &msg->target, !!is_router, 966 true, (ifp != NULL && inc), inc); 967 if (neigh) 968 neigh_release(neigh); 969 reason = SKB_CONSUMED; 970 } 971 972 out: 973 if (ifp) 974 in6_ifa_put(ifp); 975 else 976 in6_dev_put(idev); 977 return reason; 978 } 979 980 static int accept_untracked_na(struct net_device *dev, struct in6_addr *saddr) 981 { 982 struct inet6_dev *idev = __in6_dev_get(dev); 983 984 switch (READ_ONCE(idev->cnf.accept_untracked_na)) { 985 case 0: /* Don't accept untracked na (absent in neighbor cache) */ 986 return 0; 987 case 1: /* Create new entries from na if currently untracked */ 988 return 1; 989 case 2: /* Create new entries from untracked na only if saddr is in the 990 * same subnet as an address configured on the interface that 991 * received the na 992 */ 993 return !!ipv6_chk_prefix(saddr, dev); 994 default: 995 return 0; 996 } 997 } 998 999 static enum skb_drop_reason ndisc_recv_na(struct sk_buff *skb) 1000 { 1001 struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb); 1002 struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 1003 const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr; 1004 u8 *lladdr = NULL; 1005 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) + 1006 offsetof(struct nd_msg, opt)); 1007 struct ndisc_options ndopts; 1008 struct net_device *dev = skb->dev; 1009 struct inet6_dev *idev = __in6_dev_get(dev); 1010 struct inet6_ifaddr *ifp; 1011 struct neighbour *neigh; 1012 SKB_DR(reason); 1013 u8 new_state; 1014 1015 if (skb->len < sizeof(struct nd_msg)) 1016 return SKB_DROP_REASON_PKT_TOO_SMALL; 1017 1018 if (ipv6_addr_is_multicast(&msg->target)) { 1019 ND_PRINTK(2, warn, "NA: target address is multicast\n"); 1020 return reason; 1021 } 1022 1023 if (ipv6_addr_is_multicast(daddr) && 1024 msg->icmph.icmp6_solicited) { 1025 ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n"); 1026 return reason; 1027 } 1028 1029 /* For some 802.11 wireless deployments (and possibly other networks), 1030 * there will be a NA proxy and unsolicitd packets are attacks 1031 * and thus should not be accepted. 1032 * drop_unsolicited_na takes precedence over accept_untracked_na 1033 */ 1034 if (!msg->icmph.icmp6_solicited && idev && 1035 READ_ONCE(idev->cnf.drop_unsolicited_na)) 1036 return reason; 1037 1038 if (!ndisc_parse_options(dev, msg->opt, ndoptlen, &ndopts)) 1039 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS; 1040 1041 if (ndopts.nd_opts_tgt_lladdr) { 1042 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev); 1043 if (!lladdr) { 1044 ND_PRINTK(2, warn, 1045 "NA: invalid link-layer address length\n"); 1046 return reason; 1047 } 1048 } 1049 ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1); 1050 if (ifp) { 1051 if (skb->pkt_type != PACKET_LOOPBACK 1052 && (ifp->flags & IFA_F_TENTATIVE)) { 1053 addrconf_dad_failure(skb, ifp); 1054 return reason; 1055 } 1056 /* What should we make now? The advertisement 1057 is invalid, but ndisc specs say nothing 1058 about it. It could be misconfiguration, or 1059 an smart proxy agent tries to help us :-) 1060 1061 We should not print the error if NA has been 1062 received from loopback - it is just our own 1063 unsolicited advertisement. 1064 */ 1065 if (skb->pkt_type != PACKET_LOOPBACK) 1066 ND_PRINTK(1, warn, 1067 "NA: %pM advertised our address %pI6c on %s!\n", 1068 eth_hdr(skb)->h_source, &ifp->addr, ifp->idev->dev->name); 1069 in6_ifa_put(ifp); 1070 return reason; 1071 } 1072 1073 neigh = neigh_lookup(&nd_tbl, &msg->target, dev); 1074 1075 /* RFC 9131 updates original Neighbour Discovery RFC 4861. 1076 * NAs with Target LL Address option without a corresponding 1077 * entry in the neighbour cache can now create a STALE neighbour 1078 * cache entry on routers. 1079 * 1080 * entry accept fwding solicited behaviour 1081 * ------- ------ ------ --------- ---------------------- 1082 * present X X 0 Set state to STALE 1083 * present X X 1 Set state to REACHABLE 1084 * absent 0 X X Do nothing 1085 * absent 1 0 X Do nothing 1086 * absent 1 1 X Add a new STALE entry 1087 * 1088 * Note that we don't do a (daddr == all-routers-mcast) check. 1089 */ 1090 new_state = msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE; 1091 if (!neigh && lladdr && idev && READ_ONCE(idev->cnf.forwarding)) { 1092 if (accept_untracked_na(dev, saddr)) { 1093 neigh = neigh_create(&nd_tbl, &msg->target, dev); 1094 new_state = NUD_STALE; 1095 } 1096 } 1097 1098 if (neigh && !IS_ERR(neigh)) { 1099 u8 old_flags = neigh->flags; 1100 struct net *net = dev_net(dev); 1101 1102 if (READ_ONCE(neigh->nud_state) & NUD_FAILED) 1103 goto out; 1104 1105 /* 1106 * Don't update the neighbor cache entry on a proxy NA from 1107 * ourselves because either the proxied node is off link or it 1108 * has already sent a NA to us. 1109 */ 1110 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) && 1111 READ_ONCE(net->ipv6.devconf_all->forwarding) && 1112 READ_ONCE(net->ipv6.devconf_all->proxy_ndp) && 1113 pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) { 1114 /* XXX: idev->cnf.proxy_ndp */ 1115 goto out; 1116 } 1117 1118 ndisc_update(dev, neigh, lladdr, 1119 new_state, 1120 NEIGH_UPDATE_F_WEAK_OVERRIDE| 1121 (msg->icmph.icmp6_override ? NEIGH_UPDATE_F_OVERRIDE : 0)| 1122 NEIGH_UPDATE_F_OVERRIDE_ISROUTER| 1123 (msg->icmph.icmp6_router ? NEIGH_UPDATE_F_ISROUTER : 0), 1124 NDISC_NEIGHBOUR_ADVERTISEMENT, &ndopts); 1125 1126 if ((old_flags & ~neigh->flags) & NTF_ROUTER) { 1127 /* 1128 * Change: router to host 1129 */ 1130 rt6_clean_tohost(dev_net(dev), saddr); 1131 } 1132 reason = SKB_CONSUMED; 1133 out: 1134 neigh_release(neigh); 1135 } 1136 return reason; 1137 } 1138 1139 static enum skb_drop_reason ndisc_recv_rs(struct sk_buff *skb) 1140 { 1141 struct rs_msg *rs_msg = (struct rs_msg *)skb_transport_header(skb); 1142 unsigned long ndoptlen = skb->len - sizeof(*rs_msg); 1143 struct neighbour *neigh; 1144 struct inet6_dev *idev; 1145 const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr; 1146 struct ndisc_options ndopts; 1147 u8 *lladdr = NULL; 1148 SKB_DR(reason); 1149 1150 if (skb->len < sizeof(*rs_msg)) 1151 return SKB_DROP_REASON_PKT_TOO_SMALL; 1152 1153 idev = __in6_dev_get(skb->dev); 1154 if (!idev) { 1155 ND_PRINTK(1, err, "RS: can't find in6 device\n"); 1156 return reason; 1157 } 1158 1159 /* Don't accept RS if we're not in router mode */ 1160 if (!READ_ONCE(idev->cnf.forwarding)) 1161 goto out; 1162 1163 /* 1164 * Don't update NCE if src = ::; 1165 * this implies that the source node has no ip address assigned yet. 1166 */ 1167 if (ipv6_addr_any(saddr)) 1168 goto out; 1169 1170 /* Parse ND options */ 1171 if (!ndisc_parse_options(skb->dev, rs_msg->opt, ndoptlen, &ndopts)) 1172 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS; 1173 1174 if (ndopts.nd_opts_src_lladdr) { 1175 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, 1176 skb->dev); 1177 if (!lladdr) 1178 goto out; 1179 } 1180 1181 neigh = __neigh_lookup(&nd_tbl, saddr, skb->dev, 1); 1182 if (neigh) { 1183 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE, 1184 NEIGH_UPDATE_F_WEAK_OVERRIDE| 1185 NEIGH_UPDATE_F_OVERRIDE| 1186 NEIGH_UPDATE_F_OVERRIDE_ISROUTER, 1187 NDISC_ROUTER_SOLICITATION, &ndopts); 1188 neigh_release(neigh); 1189 reason = SKB_CONSUMED; 1190 } 1191 out: 1192 return reason; 1193 } 1194 1195 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt) 1196 { 1197 struct icmp6hdr *icmp6h = (struct icmp6hdr *)skb_transport_header(ra); 1198 struct sk_buff *skb; 1199 struct nlmsghdr *nlh; 1200 struct nduseroptmsg *ndmsg; 1201 struct net *net = dev_net(ra->dev); 1202 int err; 1203 int base_size = NLMSG_ALIGN(sizeof(struct nduseroptmsg) 1204 + (opt->nd_opt_len << 3)); 1205 size_t msg_size = base_size + nla_total_size(sizeof(struct in6_addr)); 1206 1207 skb = nlmsg_new(msg_size, GFP_ATOMIC); 1208 if (!skb) { 1209 err = -ENOBUFS; 1210 goto errout; 1211 } 1212 1213 nlh = nlmsg_put(skb, 0, 0, RTM_NEWNDUSEROPT, base_size, 0); 1214 if (!nlh) { 1215 goto nla_put_failure; 1216 } 1217 1218 ndmsg = nlmsg_data(nlh); 1219 ndmsg->nduseropt_family = AF_INET6; 1220 ndmsg->nduseropt_ifindex = ra->dev->ifindex; 1221 ndmsg->nduseropt_icmp_type = icmp6h->icmp6_type; 1222 ndmsg->nduseropt_icmp_code = icmp6h->icmp6_code; 1223 ndmsg->nduseropt_opts_len = opt->nd_opt_len << 3; 1224 1225 memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3); 1226 1227 if (nla_put_in6_addr(skb, NDUSEROPT_SRCADDR, &ipv6_hdr(ra)->saddr)) 1228 goto nla_put_failure; 1229 nlmsg_end(skb, nlh); 1230 1231 rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC); 1232 return; 1233 1234 nla_put_failure: 1235 nlmsg_free(skb); 1236 err = -EMSGSIZE; 1237 errout: 1238 rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err); 1239 } 1240 1241 static enum skb_drop_reason ndisc_router_discovery(struct sk_buff *skb) 1242 { 1243 struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb); 1244 bool send_ifinfo_notify = false; 1245 struct neighbour *neigh = NULL; 1246 struct ndisc_options ndopts; 1247 struct fib6_info *rt = NULL; 1248 struct inet6_dev *in6_dev; 1249 struct fib6_table *table; 1250 u32 defrtr_usr_metric; 1251 unsigned int pref = 0; 1252 __u32 old_if_flags; 1253 struct net *net; 1254 SKB_DR(reason); 1255 int lifetime; 1256 int optlen; 1257 1258 __u8 *opt = (__u8 *)(ra_msg + 1); 1259 1260 optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) - 1261 sizeof(struct ra_msg); 1262 1263 ND_PRINTK(2, info, 1264 "RA: %s, dev: %s\n", 1265 __func__, skb->dev->name); 1266 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) { 1267 ND_PRINTK(2, warn, "RA: source address is not link-local\n"); 1268 return reason; 1269 } 1270 if (optlen < 0) 1271 return SKB_DROP_REASON_PKT_TOO_SMALL; 1272 1273 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1274 if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) { 1275 ND_PRINTK(2, warn, "RA: from host or unauthorized router\n"); 1276 return reason; 1277 } 1278 #endif 1279 1280 in6_dev = __in6_dev_get(skb->dev); 1281 if (!in6_dev) { 1282 ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n", 1283 skb->dev->name); 1284 return reason; 1285 } 1286 1287 if (!ndisc_parse_options(skb->dev, opt, optlen, &ndopts)) 1288 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS; 1289 1290 if (!ipv6_accept_ra(in6_dev)) { 1291 ND_PRINTK(2, info, 1292 "RA: %s, did not accept ra for dev: %s\n", 1293 __func__, skb->dev->name); 1294 goto skip_linkparms; 1295 } 1296 1297 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1298 /* skip link-specific parameters from interior routers */ 1299 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) { 1300 ND_PRINTK(2, info, 1301 "RA: %s, nodetype is NODEFAULT, dev: %s\n", 1302 __func__, skb->dev->name); 1303 goto skip_linkparms; 1304 } 1305 #endif 1306 1307 if (in6_dev->if_flags & IF_RS_SENT) { 1308 /* 1309 * flag that an RA was received after an RS was sent 1310 * out on this interface. 1311 */ 1312 in6_dev->if_flags |= IF_RA_RCVD; 1313 } 1314 1315 /* 1316 * Remember the managed/otherconf flags from most recently 1317 * received RA message (RFC 2462) -- yoshfuji 1318 */ 1319 old_if_flags = in6_dev->if_flags; 1320 in6_dev->if_flags = (in6_dev->if_flags & ~(IF_RA_MANAGED | 1321 IF_RA_OTHERCONF)) | 1322 (ra_msg->icmph.icmp6_addrconf_managed ? 1323 IF_RA_MANAGED : 0) | 1324 (ra_msg->icmph.icmp6_addrconf_other ? 1325 IF_RA_OTHERCONF : 0); 1326 1327 if (old_if_flags != in6_dev->if_flags) 1328 send_ifinfo_notify = true; 1329 1330 if (!READ_ONCE(in6_dev->cnf.accept_ra_defrtr)) { 1331 ND_PRINTK(2, info, 1332 "RA: %s, defrtr is false for dev: %s\n", 1333 __func__, skb->dev->name); 1334 goto skip_defrtr; 1335 } 1336 1337 lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime); 1338 if (lifetime != 0 && 1339 lifetime < READ_ONCE(in6_dev->cnf.accept_ra_min_lft)) { 1340 ND_PRINTK(2, info, 1341 "RA: router lifetime (%ds) is too short: %s\n", 1342 lifetime, skb->dev->name); 1343 goto skip_defrtr; 1344 } 1345 1346 /* Do not accept RA with source-addr found on local machine unless 1347 * accept_ra_from_local is set to true. 1348 */ 1349 net = dev_net(in6_dev->dev); 1350 if (!READ_ONCE(in6_dev->cnf.accept_ra_from_local) && 1351 ipv6_chk_addr(net, &ipv6_hdr(skb)->saddr, in6_dev->dev, 0)) { 1352 ND_PRINTK(2, info, 1353 "RA from local address detected on dev: %s: default router ignored\n", 1354 skb->dev->name); 1355 goto skip_defrtr; 1356 } 1357 1358 #ifdef CONFIG_IPV6_ROUTER_PREF 1359 pref = ra_msg->icmph.icmp6_router_pref; 1360 /* 10b is handled as if it were 00b (medium) */ 1361 if (pref == ICMPV6_ROUTER_PREF_INVALID || 1362 !READ_ONCE(in6_dev->cnf.accept_ra_rtr_pref)) 1363 pref = ICMPV6_ROUTER_PREF_MEDIUM; 1364 #endif 1365 /* routes added from RAs do not use nexthop objects */ 1366 rt = rt6_get_dflt_router(net, &ipv6_hdr(skb)->saddr, skb->dev); 1367 if (rt) { 1368 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6, 1369 rt->fib6_nh->fib_nh_dev, NULL, 1370 &ipv6_hdr(skb)->saddr); 1371 if (!neigh) { 1372 ND_PRINTK(0, err, 1373 "RA: %s got default router without neighbour\n", 1374 __func__); 1375 fib6_info_release(rt); 1376 return reason; 1377 } 1378 } 1379 /* Set default route metric as specified by user */ 1380 defrtr_usr_metric = in6_dev->cnf.ra_defrtr_metric; 1381 /* delete the route if lifetime is 0 or if metric needs change */ 1382 if (rt && (lifetime == 0 || rt->fib6_metric != defrtr_usr_metric)) { 1383 ip6_del_rt(net, rt, false); 1384 rt = NULL; 1385 } 1386 1387 ND_PRINTK(3, info, "RA: rt: %p lifetime: %d, metric: %d, for dev: %s\n", 1388 rt, lifetime, defrtr_usr_metric, skb->dev->name); 1389 if (!rt && lifetime) { 1390 ND_PRINTK(3, info, "RA: adding default router\n"); 1391 1392 if (neigh) 1393 neigh_release(neigh); 1394 1395 rt = rt6_add_dflt_router(net, &ipv6_hdr(skb)->saddr, 1396 skb->dev, pref, defrtr_usr_metric, 1397 lifetime); 1398 if (!rt) { 1399 ND_PRINTK(0, err, 1400 "RA: %s failed to add default route\n", 1401 __func__); 1402 return reason; 1403 } 1404 1405 neigh = ip6_neigh_lookup(&rt->fib6_nh->fib_nh_gw6, 1406 rt->fib6_nh->fib_nh_dev, NULL, 1407 &ipv6_hdr(skb)->saddr); 1408 if (!neigh) { 1409 ND_PRINTK(0, err, 1410 "RA: %s got default router without neighbour\n", 1411 __func__); 1412 fib6_info_release(rt); 1413 return reason; 1414 } 1415 neigh->flags |= NTF_ROUTER; 1416 } else if (rt && IPV6_EXTRACT_PREF(rt->fib6_flags) != pref) { 1417 struct nl_info nlinfo = { 1418 .nl_net = net, 1419 }; 1420 rt->fib6_flags = (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref); 1421 inet6_rt_notify(RTM_NEWROUTE, rt, &nlinfo, NLM_F_REPLACE); 1422 } 1423 1424 if (rt) { 1425 table = rt->fib6_table; 1426 spin_lock_bh(&table->tb6_lock); 1427 1428 fib6_set_expires(rt, jiffies + (HZ * lifetime)); 1429 fib6_add_gc_list(rt); 1430 1431 spin_unlock_bh(&table->tb6_lock); 1432 } 1433 if (READ_ONCE(in6_dev->cnf.accept_ra_min_hop_limit) < 256 && 1434 ra_msg->icmph.icmp6_hop_limit) { 1435 if (READ_ONCE(in6_dev->cnf.accept_ra_min_hop_limit) <= 1436 ra_msg->icmph.icmp6_hop_limit) { 1437 WRITE_ONCE(in6_dev->cnf.hop_limit, 1438 ra_msg->icmph.icmp6_hop_limit); 1439 fib6_metric_set(rt, RTAX_HOPLIMIT, 1440 ra_msg->icmph.icmp6_hop_limit); 1441 } else { 1442 ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than minimum\n"); 1443 } 1444 } 1445 1446 skip_defrtr: 1447 1448 /* 1449 * Update Reachable Time and Retrans Timer 1450 */ 1451 1452 if (in6_dev->nd_parms) { 1453 unsigned long rtime = ntohl(ra_msg->retrans_timer); 1454 1455 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/HZ) { 1456 rtime = (rtime*HZ)/1000; 1457 if (rtime < HZ/100) 1458 rtime = HZ/100; 1459 NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime); 1460 in6_dev->tstamp = jiffies; 1461 send_ifinfo_notify = true; 1462 } 1463 1464 rtime = ntohl(ra_msg->reachable_time); 1465 if (rtime && rtime/1000 < MAX_SCHEDULE_TIMEOUT/(3*HZ)) { 1466 rtime = (rtime*HZ)/1000; 1467 1468 if (rtime < HZ/10) 1469 rtime = HZ/10; 1470 1471 if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) { 1472 NEIGH_VAR_SET(in6_dev->nd_parms, 1473 BASE_REACHABLE_TIME, rtime); 1474 NEIGH_VAR_SET(in6_dev->nd_parms, 1475 GC_STALETIME, 3 * rtime); 1476 in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime); 1477 in6_dev->tstamp = jiffies; 1478 send_ifinfo_notify = true; 1479 } 1480 } 1481 } 1482 1483 skip_linkparms: 1484 1485 /* 1486 * Process options. 1487 */ 1488 1489 if (!neigh) 1490 neigh = __neigh_lookup(&nd_tbl, &ipv6_hdr(skb)->saddr, 1491 skb->dev, 1); 1492 if (neigh) { 1493 u8 *lladdr = NULL; 1494 if (ndopts.nd_opts_src_lladdr) { 1495 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, 1496 skb->dev); 1497 if (!lladdr) { 1498 ND_PRINTK(2, warn, 1499 "RA: invalid link-layer address length\n"); 1500 goto out; 1501 } 1502 } 1503 ndisc_update(skb->dev, neigh, lladdr, NUD_STALE, 1504 NEIGH_UPDATE_F_WEAK_OVERRIDE| 1505 NEIGH_UPDATE_F_OVERRIDE| 1506 NEIGH_UPDATE_F_OVERRIDE_ISROUTER| 1507 NEIGH_UPDATE_F_ISROUTER, 1508 NDISC_ROUTER_ADVERTISEMENT, &ndopts); 1509 reason = SKB_CONSUMED; 1510 } 1511 1512 if (!ipv6_accept_ra(in6_dev)) { 1513 ND_PRINTK(2, info, 1514 "RA: %s, accept_ra is false for dev: %s\n", 1515 __func__, skb->dev->name); 1516 goto out; 1517 } 1518 1519 #ifdef CONFIG_IPV6_ROUTE_INFO 1520 if (!READ_ONCE(in6_dev->cnf.accept_ra_from_local) && 1521 ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, 1522 in6_dev->dev, 0)) { 1523 ND_PRINTK(2, info, 1524 "RA from local address detected on dev: %s: router info ignored.\n", 1525 skb->dev->name); 1526 goto skip_routeinfo; 1527 } 1528 1529 if (READ_ONCE(in6_dev->cnf.accept_ra_rtr_pref) && ndopts.nd_opts_ri) { 1530 struct nd_opt_hdr *p; 1531 for (p = ndopts.nd_opts_ri; 1532 p; 1533 p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) { 1534 struct route_info *ri = (struct route_info *)p; 1535 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1536 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT && 1537 ri->prefix_len == 0) 1538 continue; 1539 #endif 1540 if (ri->prefix_len == 0 && 1541 !READ_ONCE(in6_dev->cnf.accept_ra_defrtr)) 1542 continue; 1543 if (ri->lifetime != 0 && 1544 ntohl(ri->lifetime) < READ_ONCE(in6_dev->cnf.accept_ra_min_lft)) 1545 continue; 1546 if (ri->prefix_len < READ_ONCE(in6_dev->cnf.accept_ra_rt_info_min_plen)) 1547 continue; 1548 if (ri->prefix_len > READ_ONCE(in6_dev->cnf.accept_ra_rt_info_max_plen)) 1549 continue; 1550 rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3, 1551 &ipv6_hdr(skb)->saddr); 1552 } 1553 } 1554 1555 skip_routeinfo: 1556 #endif 1557 1558 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1559 /* skip link-specific ndopts from interior routers */ 1560 if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) { 1561 ND_PRINTK(2, info, 1562 "RA: %s, nodetype is NODEFAULT (interior routes), dev: %s\n", 1563 __func__, skb->dev->name); 1564 goto out; 1565 } 1566 #endif 1567 1568 if (READ_ONCE(in6_dev->cnf.accept_ra_pinfo) && ndopts.nd_opts_pi) { 1569 struct nd_opt_hdr *p; 1570 for (p = ndopts.nd_opts_pi; 1571 p; 1572 p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) { 1573 addrconf_prefix_rcv(skb->dev, (u8 *)p, 1574 (p->nd_opt_len) << 3, 1575 ndopts.nd_opts_src_lladdr != NULL); 1576 } 1577 } 1578 1579 if (ndopts.nd_opts_mtu && READ_ONCE(in6_dev->cnf.accept_ra_mtu)) { 1580 __be32 n; 1581 u32 mtu; 1582 1583 memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu)); 1584 mtu = ntohl(n); 1585 1586 if (in6_dev->ra_mtu != mtu) { 1587 in6_dev->ra_mtu = mtu; 1588 send_ifinfo_notify = true; 1589 } 1590 1591 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) { 1592 ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu); 1593 } else if (READ_ONCE(in6_dev->cnf.mtu6) != mtu) { 1594 WRITE_ONCE(in6_dev->cnf.mtu6, mtu); 1595 fib6_metric_set(rt, RTAX_MTU, mtu); 1596 rt6_mtu_change(skb->dev, mtu); 1597 } 1598 } 1599 1600 if (ndopts.nd_useropts) { 1601 struct nd_opt_hdr *p; 1602 for (p = ndopts.nd_useropts; 1603 p; 1604 p = ndisc_next_useropt(skb->dev, p, 1605 ndopts.nd_useropts_end)) { 1606 ndisc_ra_useropt(skb, p); 1607 } 1608 } 1609 1610 if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) { 1611 ND_PRINTK(2, warn, "RA: invalid RA options\n"); 1612 } 1613 out: 1614 /* Send a notify if RA changed managed/otherconf flags or 1615 * timer settings or ra_mtu value 1616 */ 1617 if (send_ifinfo_notify) 1618 inet6_ifinfo_notify(RTM_NEWLINK, in6_dev); 1619 1620 fib6_info_release(rt); 1621 if (neigh) 1622 neigh_release(neigh); 1623 return reason; 1624 } 1625 1626 static enum skb_drop_reason ndisc_redirect_rcv(struct sk_buff *skb) 1627 { 1628 struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb); 1629 u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) + 1630 offsetof(struct rd_msg, opt)); 1631 struct ndisc_options ndopts; 1632 SKB_DR(reason); 1633 u8 *hdr; 1634 1635 #ifdef CONFIG_IPV6_NDISC_NODETYPE 1636 switch (skb->ndisc_nodetype) { 1637 case NDISC_NODETYPE_HOST: 1638 case NDISC_NODETYPE_NODEFAULT: 1639 ND_PRINTK(2, warn, 1640 "Redirect: from host or unauthorized router\n"); 1641 return reason; 1642 } 1643 #endif 1644 1645 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) { 1646 ND_PRINTK(2, warn, 1647 "Redirect: source address is not link-local\n"); 1648 return reason; 1649 } 1650 1651 if (!ndisc_parse_options(skb->dev, msg->opt, ndoptlen, &ndopts)) 1652 return SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS; 1653 1654 if (!ndopts.nd_opts_rh) { 1655 ip6_redirect_no_header(skb, dev_net(skb->dev), 1656 skb->dev->ifindex); 1657 return reason; 1658 } 1659 1660 hdr = (u8 *)ndopts.nd_opts_rh; 1661 hdr += 8; 1662 if (!pskb_pull(skb, hdr - skb_transport_header(skb))) 1663 return SKB_DROP_REASON_PKT_TOO_SMALL; 1664 1665 return icmpv6_notify(skb, NDISC_REDIRECT, 0, 0); 1666 } 1667 1668 static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb, 1669 struct sk_buff *orig_skb, 1670 int rd_len) 1671 { 1672 u8 *opt = skb_put(skb, rd_len); 1673 1674 memset(opt, 0, 8); 1675 *(opt++) = ND_OPT_REDIRECT_HDR; 1676 *(opt++) = (rd_len >> 3); 1677 opt += 6; 1678 1679 skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt, 1680 rd_len - 8); 1681 } 1682 1683 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) 1684 { 1685 struct net_device *dev = skb->dev; 1686 struct net *net = dev_net_rcu(dev); 1687 struct sock *sk = net->ipv6.ndisc_sk; 1688 int optlen = 0; 1689 struct inet_peer *peer; 1690 struct sk_buff *buff; 1691 struct rd_msg *msg; 1692 struct in6_addr saddr_buf; 1693 struct rt6_info *rt; 1694 struct dst_entry *dst; 1695 struct flowi6 fl6; 1696 int rd_len; 1697 u8 ha_buf[MAX_ADDR_LEN], *ha = NULL, 1698 ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL; 1699 bool ret; 1700 1701 if (netif_is_l3_master(dev)) { 1702 dev = dev_get_by_index_rcu(net, IPCB(skb)->iif); 1703 if (!dev) 1704 return; 1705 } 1706 1707 if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) { 1708 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n", 1709 dev->name); 1710 return; 1711 } 1712 1713 if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) && 1714 ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) { 1715 ND_PRINTK(2, warn, 1716 "Redirect: target address is not link-local unicast\n"); 1717 return; 1718 } 1719 1720 icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT, 1721 &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex); 1722 1723 dst = ip6_route_output(net, NULL, &fl6); 1724 if (dst->error) { 1725 dst_release(dst); 1726 return; 1727 } 1728 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0); 1729 if (IS_ERR(dst)) 1730 return; 1731 1732 rt = dst_rt6_info(dst); 1733 1734 if (rt->rt6i_flags & RTF_GATEWAY) { 1735 ND_PRINTK(2, warn, 1736 "Redirect: destination is not a neighbour\n"); 1737 goto release; 1738 } 1739 1740 peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr); 1741 ret = inet_peer_xrlim_allow(peer, 1*HZ); 1742 1743 if (!ret) 1744 goto release; 1745 1746 if (dev->addr_len) { 1747 struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target); 1748 if (!neigh) { 1749 ND_PRINTK(2, warn, 1750 "Redirect: no neigh for target address\n"); 1751 goto release; 1752 } 1753 1754 read_lock_bh(&neigh->lock); 1755 if (neigh->nud_state & NUD_VALID) { 1756 memcpy(ha_buf, neigh->ha, dev->addr_len); 1757 read_unlock_bh(&neigh->lock); 1758 ha = ha_buf; 1759 optlen += ndisc_redirect_opt_addr_space(dev, neigh, 1760 ops_data_buf, 1761 &ops_data); 1762 } else 1763 read_unlock_bh(&neigh->lock); 1764 1765 neigh_release(neigh); 1766 } 1767 1768 rd_len = min_t(unsigned int, 1769 IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(*msg) - optlen, 1770 skb->len + 8); 1771 rd_len &= ~0x7; 1772 optlen += rd_len; 1773 1774 buff = ndisc_alloc_skb(dev, sizeof(*msg) + optlen); 1775 if (!buff) 1776 goto release; 1777 1778 msg = skb_put(buff, sizeof(*msg)); 1779 *msg = (struct rd_msg) { 1780 .icmph = { 1781 .icmp6_type = NDISC_REDIRECT, 1782 }, 1783 .target = *target, 1784 .dest = ipv6_hdr(skb)->daddr, 1785 }; 1786 1787 /* 1788 * include target_address option 1789 */ 1790 1791 if (ha) 1792 ndisc_fill_redirect_addr_option(buff, ha, ops_data); 1793 1794 /* 1795 * build redirect option and copy skb over to the new packet. 1796 */ 1797 1798 if (rd_len) 1799 ndisc_fill_redirect_hdr_option(buff, skb, rd_len); 1800 1801 skb_dst_set(buff, dst); 1802 ndisc_send_skb(buff, &ipv6_hdr(skb)->saddr, &saddr_buf); 1803 return; 1804 1805 release: 1806 dst_release(dst); 1807 } 1808 1809 static void pndisc_redo(struct sk_buff *skb) 1810 { 1811 enum skb_drop_reason reason = ndisc_recv_ns(skb); 1812 1813 kfree_skb_reason(skb, reason); 1814 } 1815 1816 static int ndisc_is_multicast(const void *pkey) 1817 { 1818 return ipv6_addr_is_multicast((struct in6_addr *)pkey); 1819 } 1820 1821 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb) 1822 { 1823 struct inet6_dev *idev = __in6_dev_get(skb->dev); 1824 1825 if (!idev) 1826 return true; 1827 if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED && 1828 READ_ONCE(idev->cnf.suppress_frag_ndisc)) { 1829 net_warn_ratelimited("Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc.\n"); 1830 return true; 1831 } 1832 return false; 1833 } 1834 1835 enum skb_drop_reason ndisc_rcv(struct sk_buff *skb) 1836 { 1837 struct nd_msg *msg; 1838 SKB_DR(reason); 1839 1840 if (ndisc_suppress_frag_ndisc(skb)) 1841 return SKB_DROP_REASON_IPV6_NDISC_FRAG; 1842 1843 if (skb_linearize(skb)) 1844 return SKB_DROP_REASON_NOMEM; 1845 1846 msg = (struct nd_msg *)skb_transport_header(skb); 1847 1848 __skb_push(skb, skb->data - skb_transport_header(skb)); 1849 1850 if (ipv6_hdr(skb)->hop_limit != 255) { 1851 ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n", 1852 ipv6_hdr(skb)->hop_limit); 1853 return SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT; 1854 } 1855 1856 if (msg->icmph.icmp6_code != 0) { 1857 ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n", 1858 msg->icmph.icmp6_code); 1859 return SKB_DROP_REASON_IPV6_NDISC_BAD_CODE; 1860 } 1861 1862 switch (msg->icmph.icmp6_type) { 1863 case NDISC_NEIGHBOUR_SOLICITATION: 1864 memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb)); 1865 reason = ndisc_recv_ns(skb); 1866 break; 1867 1868 case NDISC_NEIGHBOUR_ADVERTISEMENT: 1869 reason = ndisc_recv_na(skb); 1870 break; 1871 1872 case NDISC_ROUTER_SOLICITATION: 1873 reason = ndisc_recv_rs(skb); 1874 break; 1875 1876 case NDISC_ROUTER_ADVERTISEMENT: 1877 reason = ndisc_router_discovery(skb); 1878 break; 1879 1880 case NDISC_REDIRECT: 1881 reason = ndisc_redirect_rcv(skb); 1882 break; 1883 } 1884 1885 return reason; 1886 } 1887 1888 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) 1889 { 1890 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1891 struct netdev_notifier_change_info *change_info; 1892 struct net *net = dev_net(dev); 1893 struct inet6_dev *idev; 1894 bool evict_nocarrier; 1895 1896 switch (event) { 1897 case NETDEV_CHANGEADDR: 1898 neigh_changeaddr(&nd_tbl, dev); 1899 fib6_run_gc(0, net, false); 1900 fallthrough; 1901 case NETDEV_UP: 1902 idev = in6_dev_get(dev); 1903 if (!idev) 1904 break; 1905 if (READ_ONCE(idev->cnf.ndisc_notify) || 1906 READ_ONCE(net->ipv6.devconf_all->ndisc_notify)) 1907 ndisc_send_unsol_na(dev); 1908 in6_dev_put(idev); 1909 break; 1910 case NETDEV_CHANGE: 1911 idev = in6_dev_get(dev); 1912 if (!idev) 1913 evict_nocarrier = true; 1914 else { 1915 evict_nocarrier = READ_ONCE(idev->cnf.ndisc_evict_nocarrier) && 1916 READ_ONCE(net->ipv6.devconf_all->ndisc_evict_nocarrier); 1917 in6_dev_put(idev); 1918 } 1919 1920 change_info = ptr; 1921 if (change_info->flags_changed & IFF_NOARP) 1922 neigh_changeaddr(&nd_tbl, dev); 1923 if (evict_nocarrier && !netif_carrier_ok(dev)) 1924 neigh_carrier_down(&nd_tbl, dev); 1925 break; 1926 case NETDEV_DOWN: 1927 neigh_ifdown(&nd_tbl, dev); 1928 fib6_run_gc(0, net, false); 1929 break; 1930 case NETDEV_NOTIFY_PEERS: 1931 ndisc_send_unsol_na(dev); 1932 break; 1933 default: 1934 break; 1935 } 1936 1937 return NOTIFY_DONE; 1938 } 1939 1940 static struct notifier_block ndisc_netdev_notifier = { 1941 .notifier_call = ndisc_netdev_event, 1942 .priority = ADDRCONF_NOTIFY_PRIORITY - 5, 1943 }; 1944 1945 #ifdef CONFIG_SYSCTL 1946 static void ndisc_warn_deprecated_sysctl(const struct ctl_table *ctl, 1947 const char *func, const char *dev_name) 1948 { 1949 static char warncomm[TASK_COMM_LEN]; 1950 static int warned; 1951 if (strcmp(warncomm, current->comm) && warned < 5) { 1952 strscpy(warncomm, current->comm); 1953 pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n", 1954 warncomm, func, 1955 dev_name, ctl->procname, 1956 dev_name, ctl->procname); 1957 warned++; 1958 } 1959 } 1960 1961 int ndisc_ifinfo_sysctl_change(const struct ctl_table *ctl, int write, void *buffer, 1962 size_t *lenp, loff_t *ppos) 1963 { 1964 struct net_device *dev = ctl->extra1; 1965 struct inet6_dev *idev; 1966 int ret; 1967 1968 if ((strcmp(ctl->procname, "retrans_time") == 0) || 1969 (strcmp(ctl->procname, "base_reachable_time") == 0)) 1970 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default"); 1971 1972 if (strcmp(ctl->procname, "retrans_time") == 0) 1973 ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos); 1974 1975 else if (strcmp(ctl->procname, "base_reachable_time") == 0) 1976 ret = neigh_proc_dointvec_jiffies(ctl, write, 1977 buffer, lenp, ppos); 1978 1979 else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) || 1980 (strcmp(ctl->procname, "base_reachable_time_ms") == 0)) 1981 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, 1982 buffer, lenp, ppos); 1983 else 1984 ret = -1; 1985 1986 if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) { 1987 if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME)) 1988 idev->nd_parms->reachable_time = 1989 neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME)); 1990 WRITE_ONCE(idev->tstamp, jiffies); 1991 inet6_ifinfo_notify(RTM_NEWLINK, idev); 1992 in6_dev_put(idev); 1993 } 1994 return ret; 1995 } 1996 1997 1998 #endif 1999 2000 static int __net_init ndisc_net_init(struct net *net) 2001 { 2002 struct ipv6_pinfo *np; 2003 struct sock *sk; 2004 int err; 2005 2006 err = inet_ctl_sock_create(&sk, PF_INET6, 2007 SOCK_RAW, IPPROTO_ICMPV6, net); 2008 if (err < 0) { 2009 ND_PRINTK(0, err, 2010 "NDISC: Failed to initialize the control socket (err %d)\n", 2011 err); 2012 return err; 2013 } 2014 2015 net->ipv6.ndisc_sk = sk; 2016 2017 np = inet6_sk(sk); 2018 np->hop_limit = 255; 2019 /* Do not loopback ndisc messages */ 2020 inet6_clear_bit(MC6_LOOP, sk); 2021 2022 return 0; 2023 } 2024 2025 static void __net_exit ndisc_net_exit(struct net *net) 2026 { 2027 inet_ctl_sock_destroy(net->ipv6.ndisc_sk); 2028 } 2029 2030 static struct pernet_operations ndisc_net_ops = { 2031 .init = ndisc_net_init, 2032 .exit = ndisc_net_exit, 2033 }; 2034 2035 int __init ndisc_init(void) 2036 { 2037 int err; 2038 2039 err = register_pernet_subsys(&ndisc_net_ops); 2040 if (err) 2041 return err; 2042 /* 2043 * Initialize the neighbour table 2044 */ 2045 neigh_table_init(NEIGH_ND_TABLE, &nd_tbl); 2046 2047 #ifdef CONFIG_SYSCTL 2048 err = neigh_sysctl_register(NULL, &nd_tbl.parms, 2049 ndisc_ifinfo_sysctl_change); 2050 if (err) 2051 goto out_unregister_pernet; 2052 out: 2053 #endif 2054 return err; 2055 2056 #ifdef CONFIG_SYSCTL 2057 out_unregister_pernet: 2058 unregister_pernet_subsys(&ndisc_net_ops); 2059 goto out; 2060 #endif 2061 } 2062 2063 int __init ndisc_late_init(void) 2064 { 2065 return register_netdevice_notifier(&ndisc_netdev_notifier); 2066 } 2067 2068 void ndisc_late_cleanup(void) 2069 { 2070 unregister_netdevice_notifier(&ndisc_netdev_notifier); 2071 } 2072 2073 void ndisc_cleanup(void) 2074 { 2075 #ifdef CONFIG_SYSCTL 2076 neigh_sysctl_unregister(&nd_tbl.parms); 2077 #endif 2078 neigh_table_clear(NEIGH_ND_TABLE, &nd_tbl); 2079 unregister_pernet_subsys(&ndisc_net_ops); 2080 } 2081