net/core/neighbour.c

   1 /*
   2  *      Generic address resolution entity
   3  *
   4  *      Authors:
   5  *      Pedro Roque             <roque@di.fc.ul.pt>
   6  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   7  *
   8  *      This program is free software; you can redistribute it and/or
   9  *      modify it under the terms of the GNU General Public License
  10  *      as published by the Free Software Foundation; either version
  11  *      2 of the License, or (at your option) any later version.
  12  *
  13  *      Fixes:
  14  *      Vitaly E. Lavrov        releasing NULL neighbor in neigh_add.
  15  *      Harald Welte            Add neighbour cache statistics like rtstat
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <linux/slab.h>
  21 #include <linux/types.h>
  22 #include <linux/kernel.h>
  23 #include <linux/module.h>
  24 #include <linux/socket.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/proc_fs.h>
  27 #ifdef CONFIG_SYSCTL
  28 #include <linux/sysctl.h>
  29 #endif
  30 #include <linux/times.h>
  31 #include <net/net_namespace.h>
  32 #include <net/neighbour.h>
  33 #include <net/dst.h>
  34 #include <net/sock.h>
  35 #include <net/netevent.h>
  36 #include <net/netlink.h>
  37 #include <linux/rtnetlink.h>
  38 #include <linux/random.h>
  39 #include <linux/string.h>
  40 #include <linux/log2.h>
  41 #include <linux/inetdevice.h>
  42 #include <net/addrconf.h>
  43
  44 #define DEBUG
  45 #define NEIGH_DEBUG 1
  46 #define neigh_dbg(level, fmt, ...)              \
  47 do {                                            \
  48         if (level <= NEIGH_DEBUG)               \
  49                 pr_debug(fmt, ##__VA_ARGS__);   \
  50 } while (0)
  51
  52 #define PNEIGH_HASHMASK         0xF
  53
  54 static void neigh_timer_handler(unsigned long arg);
  55 static void __neigh_notify(struct neighbour *n, int type, int flags);
  56 static void neigh_update_notify(struct neighbour *neigh);
  57 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
  58
  59 #ifdef CONFIG_PROC_FS
  60 static const struct file_operations neigh_stat_seq_fops;
  61 #endif
  62
  63 /*
  64    Neighbour hash table buckets are protected with rwlock tbl->lock.
  65
  66    - All the scans/updates to hash buckets MUST be made under this lock.
  67    - NOTHING clever should be made under this lock: no callbacks
  68      to protocol backends, no attempts to send something to network.
  69      It will result in deadlocks, if backend/driver wants to use neighbour
  70      cache.
  71    - If the entry requires some non-trivial actions, increase
  72      its reference count and release table lock.
  73
  74    Neighbour entries are protected:
  75    - with reference count.
  76    - with rwlock neigh->lock
  77
  78    Reference count prevents destruction.
  79
  80    neigh->lock mainly serializes ll address data and its validity state.
  81    However, the same lock is used to protect another entry fields:
  82     - timer
  83     - resolution queue
  84
  85    Again, nothing clever shall be made under neigh->lock,
  86    the most complicated procedure, which we allow is dev->hard_header.
  87    It is supposed, that dev->hard_header is simplistic and does
  88    not make callbacks to neighbour tables.
  89  */
  90
  91 static int neigh_blackhole(struct neighbour *neigh, struct sk_buff *skb)
  92 {
  93         kfree_skb(skb);
  94         return -ENETDOWN;
  95 }
  96
  97 static void neigh_cleanup_and_release(struct neighbour *neigh)
  98 {
  99         if (neigh->parms->neigh_cleanup)
 100                 neigh->parms->neigh_cleanup(neigh);
 101
 102         __neigh_notify(neigh, RTM_DELNEIGH, 0);
 103         neigh_release(neigh);
 104 }
 105
 106 /*
 107  * It is random distribution in the interval (1/2)*base...(3/2)*base.
 108  * It corresponds to default IPv6 settings and is not overridable,
 109  * because it is really reasonable choice.
 110  */
 111
 112 unsigned long neigh_rand_reach_time(unsigned long base)
 113 {
 114         return base ? (prandom_u32() % base) + (base >> 1) : 0;
 115 }
 116 EXPORT_SYMBOL(neigh_rand_reach_time);
 117
 118
 119 static int neigh_forced_gc(struct neigh_table *tbl)
 120 {
 121         int shrunk = 0;
 122         int i;
 123         struct neigh_hash_table *nht;
 124
 125         NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
 126
 127         write_lock_bh(&tbl->lock);
 128         nht = rcu_dereference_protected(tbl->nht,
 129                                         lockdep_is_held(&tbl->lock));
 130         for (i = 0; i < (1 << nht->hash_shift); i++) {
 131                 struct neighbour *n;
 132                 struct neighbour __rcu **np;
 133
 134                 np = &nht->hash_buckets[i];
 135                 while ((n = rcu_dereference_protected(*np,
 136                                         lockdep_is_held(&tbl->lock))) != NULL) {
 137                         /* Neighbour record may be discarded if:
 138                          * - nobody refers to it.
 139                          * - it is not permanent
 140                          */
 141                         write_lock(&n->lock);
 142                         if (atomic_read(&n->refcnt) == 1 &&
 143                             !(n->nud_state & NUD_PERMANENT)) {
 144                                 rcu_assign_pointer(*np,
 145                                         rcu_dereference_protected(n->next,
 146                                                   lockdep_is_held(&tbl->lock)));
 147                                 n->dead = 1;
 148                                 shrunk  = 1;
 149                                 write_unlock(&n->lock);
 150                                 neigh_cleanup_and_release(n);
 151                                 continue;
 152                         }
 153                         write_unlock(&n->lock);
 154                         np = &n->next;
 155                 }
 156         }
 157
 158         tbl->last_flush = jiffies;
 159
 160         write_unlock_bh(&tbl->lock);
 161
 162         return shrunk;
 163 }
 164
 165 static void neigh_add_timer(struct neighbour *n, unsigned long when)
 166 {
 167         neigh_hold(n);
 168         if (unlikely(mod_timer(&n->timer, when))) {
 169                 printk("NEIGH: BUG, double timer add, state is %x\n",
 170                        n->nud_state);
 171                 dump_stack();
 172         }
 173 }
 174
 175 static int neigh_del_timer(struct neighbour *n)
 176 {
 177         if ((n->nud_state & NUD_IN_TIMER) &&
 178             del_timer(&n->timer)) {
 179                 neigh_release(n);
 180                 return 1;
 181         }
 182         return 0;
 183 }
 184
 185 static void pneigh_queue_purge(struct sk_buff_head *list)
 186 {
 187         struct sk_buff *skb;
 188
 189         while ((skb = skb_dequeue(list)) != NULL) {
 190                 dev_put(skb->dev);
 191                 kfree_skb(skb);
 192         }
 193 }
 194
 195 static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 196 {
 197         int i;
 198         struct neigh_hash_table *nht;
 199
 200         nht = rcu_dereference_protected(tbl->nht,
 201                                         lockdep_is_held(&tbl->lock));
 202
 203         for (i = 0; i < (1 << nht->hash_shift); i++) {
 204                 struct neighbour *n;
 205                 struct neighbour __rcu **np = &nht->hash_buckets[i];
 206
 207                 while ((n = rcu_dereference_protected(*np,
 208                                         lockdep_is_held(&tbl->lock))) != NULL) {
 209                         if (dev && n->dev != dev) {
 210                                 np = &n->next;
 211                                 continue;
 212                         }
 213                         rcu_assign_pointer(*np,
 214                                    rcu_dereference_protected(n->next,
 215                                                 lockdep_is_held(&tbl->lock)));
 216                         write_lock(&n->lock);
 217                         neigh_del_timer(n);
 218                         n->dead = 1;
 219
 220                         if (atomic_read(&n->refcnt) != 1) {
 221                                 /* The most unpleasant situation.
 222                                    We must destroy neighbour entry,
 223                                    but someone still uses it.
 224
 225                                    The destroy will be delayed until
 226                                    the last user releases us, but
 227                                    we must kill timers etc. and move
 228                                    it to safe state.
 229                                  */
 230                                 __skb_queue_purge(&n->arp_queue);
 231                                 n->arp_queue_len_bytes = 0;
 232                                 n->output = neigh_blackhole;
 233                                 if (n->nud_state & NUD_VALID)
 234                                         n->nud_state = NUD_NOARP;
 235                                 else
 236                                         n->nud_state = NUD_NONE;
 237                                 neigh_dbg(2, "neigh %p is stray\n", n);
 238                         }
 239                         write_unlock(&n->lock);
 240                         neigh_cleanup_and_release(n);
 241                 }
 242         }
 243 }
 244
 245 void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
 246 {
 247         write_lock_bh(&tbl->lock);
 248         neigh_flush_dev(tbl, dev);
 249         write_unlock_bh(&tbl->lock);
 250 }
 251 EXPORT_SYMBOL(neigh_changeaddr);
 252
 253 int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 254 {
 255         write_lock_bh(&tbl->lock);
 256         neigh_flush_dev(tbl, dev);
 257         pneigh_ifdown(tbl, dev);
 258         write_unlock_bh(&tbl->lock);
 259
 260         del_timer_sync(&tbl->proxy_timer);
 261         pneigh_queue_purge(&tbl->proxy_queue);
 262         return 0;
 263 }
 264 EXPORT_SYMBOL(neigh_ifdown);
 265
 266 static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device *dev)
 267 {
 268         struct neighbour *n = NULL;
 269         unsigned long now = jiffies;
 270         int entries;
 271
 272         entries = atomic_inc_return(&tbl->entries) - 1;
 273         if (entries >= tbl->gc_thresh3 ||
 274             (entries >= tbl->gc_thresh2 &&
 275              time_after(now, tbl->last_flush + 5 * HZ))) {
 276                 if (!neigh_forced_gc(tbl) &&
 277                     entries >= tbl->gc_thresh3) {
 278                         net_info_ratelimited("%s: neighbor table overflow!\n",
 279                                              tbl->id);
 280                         NEIGH_CACHE_STAT_INC(tbl, table_fulls);
 281                         goto out_entries;
 282                 }
 283         }
 284
 285         n = kzalloc(tbl->entry_size + dev->neigh_priv_len, GFP_ATOMIC);
 286         if (!n)
 287                 goto out_entries;
 288
 289         __skb_queue_head_init(&n->arp_queue);
 290         rwlock_init(&n->lock);
 291         seqlock_init(&n->ha_lock);
 292         n->updated        = n->used = now;
 293         n->nud_state      = NUD_NONE;
 294         n->output         = neigh_blackhole;
 295         seqlock_init(&n->hh.hh_lock);
 296         n->parms          = neigh_parms_clone(&tbl->parms);
 297         setup_timer(&n->timer, neigh_timer_handler, (unsigned long)n);
 298
 299         NEIGH_CACHE_STAT_INC(tbl, allocs);
 300         n->tbl            = tbl;
 301         atomic_set(&n->refcnt, 1);
 302         n->dead           = 1;
 303 out:
 304         return n;
 305
 306 out_entries:
 307         atomic_dec(&tbl->entries);
 308         goto out;
 309 }
 310
 311 static void neigh_get_hash_rnd(u32 *x)
 312 {
 313         get_random_bytes(x, sizeof(*x));
 314         *x |= 1;
 315 }
 316
 317 static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
 318 {
 319         size_t size = (1 << shift) * sizeof(struct neighbour *);
 320         struct neigh_hash_table *ret;
 321         struct neighbour __rcu **buckets;
 322         int i;
 323
 324         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
 325         if (!ret)
 326                 return NULL;
 327         if (size <= PAGE_SIZE)
 328                 buckets = kzalloc(size, GFP_ATOMIC);
 329         else
 330                 buckets = (struct neighbour __rcu **)
 331                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
 332                                            get_order(size));
 333         if (!buckets) {
 334                 kfree(ret);
 335                 return NULL;
 336         }
 337         ret->hash_buckets = buckets;
 338         ret->hash_shift = shift;
 339         for (i = 0; i < NEIGH_NUM_HASH_RND; i++)
 340                 neigh_get_hash_rnd(&ret->hash_rnd[i]);
 341         return ret;
 342 }
 343
 344 static void neigh_hash_free_rcu(struct rcu_head *head)
 345 {
 346         struct neigh_hash_table *nht = container_of(head,
 347                                                     struct neigh_hash_table,
 348                                                     rcu);
 349         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
 350         struct neighbour __rcu **buckets = nht->hash_buckets;
 351
 352         if (size <= PAGE_SIZE)
 353                 kfree(buckets);
 354         else
 355                 free_pages((unsigned long)buckets, get_order(size));
 356         kfree(nht);
 357 }
 358
 359 static struct neigh_hash_table *neigh_hash_grow(struct neigh_table *tbl,
 360                                                 unsigned long new_shift)
 361 {
 362         unsigned int i, hash;
 363         struct neigh_hash_table *new_nht, *old_nht;
 364
 365         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 366
 367         old_nht = rcu_dereference_protected(tbl->nht,
 368                                             lockdep_is_held(&tbl->lock));
 369         new_nht = neigh_hash_alloc(new_shift);
 370         if (!new_nht)
 371                 return old_nht;
 372
 373         for (i = 0; i < (1 << old_nht->hash_shift); i++) {
 374                 struct neighbour *n, *next;
 375
 376                 for (n = rcu_dereference_protected(old_nht->hash_buckets[i],
 377                                                    lockdep_is_held(&tbl->lock));
 378                      n != NULL;
 379                      n = next) {
 380                         hash = tbl->hash(n->primary_key, n->dev,
 381                                          new_nht->hash_rnd);
 382
 383                         hash >>= (32 - new_nht->hash_shift);
 384                         next = rcu_dereference_protected(n->next,
 385                                                 lockdep_is_held(&tbl->lock));
 386
 387                         rcu_assign_pointer(n->next,
 388                                            rcu_dereference_protected(
 389                                                 new_nht->hash_buckets[hash],
 390                                                 lockdep_is_held(&tbl->lock)));
 391                         rcu_assign_pointer(new_nht->hash_buckets[hash], n);
 392                 }
 393         }
 394
 395         rcu_assign_pointer(tbl->nht, new_nht);
 396         call_rcu(&old_nht->rcu, neigh_hash_free_rcu);
 397         return new_nht;
 398 }
 399
 400 struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 401                                struct net_device *dev)
 402 {
 403         struct neighbour *n;
 404
 405         NEIGH_CACHE_STAT_INC(tbl, lookups);
 406
 407         rcu_read_lock_bh();
 408         n = __neigh_lookup_noref(tbl, pkey, dev);
 409         if (n) {
 410                 if (!atomic_inc_not_zero(&n->refcnt))
 411                         n = NULL;
 412                 NEIGH_CACHE_STAT_INC(tbl, hits);
 413         }
 414
 415         rcu_read_unlock_bh();
 416         return n;
 417 }
 418 EXPORT_SYMBOL(neigh_lookup);
 419
 420 struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 421                                      const void *pkey)
 422 {
 423         struct neighbour *n;
 424         int key_len = tbl->key_len;
 425         u32 hash_val;
 426         struct neigh_hash_table *nht;
 427
 428         NEIGH_CACHE_STAT_INC(tbl, lookups);
 429
 430         rcu_read_lock_bh();
 431         nht = rcu_dereference_bh(tbl->nht);
 432         hash_val = tbl->hash(pkey, NULL, nht->hash_rnd) >> (32 - nht->hash_shift);
 433
 434         for (n = rcu_dereference_bh(nht->hash_buckets[hash_val]);
 435              n != NULL;
 436              n = rcu_dereference_bh(n->next)) {
 437                 if (!memcmp(n->primary_key, pkey, key_len) &&
 438                     net_eq(dev_net(n->dev), net)) {
 439                         if (!atomic_inc_not_zero(&n->refcnt))
 440                                 n = NULL;
 441                         NEIGH_CACHE_STAT_INC(tbl, hits);
 442                         break;
 443                 }
 444         }
 445
 446         rcu_read_unlock_bh();
 447         return n;
 448 }
 449 EXPORT_SYMBOL(neigh_lookup_nodev);
 450
 451 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 452                                  struct net_device *dev, bool want_ref)
 453 {
 454         u32 hash_val;
 455         int key_len = tbl->key_len;
 456         int error;
 457         struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev);
 458         struct neigh_hash_table *nht;
 459
 460         if (!n) {
 461                 rc = ERR_PTR(-ENOBUFS);
 462                 goto out;
 463         }
 464
 465         memcpy(n->primary_key, pkey, key_len);
 466         n->dev = dev;
 467         dev_hold(dev);
 468
 469         /* Protocol specific setup. */
 470         if (tbl->constructor && (error = tbl->constructor(n)) < 0) {
 471                 rc = ERR_PTR(error);
 472                 goto out_neigh_release;
 473         }
 474
 475         if (dev->netdev_ops->ndo_neigh_construct) {
 476                 error = dev->netdev_ops->ndo_neigh_construct(dev, n);
 477                 if (error < 0) {
 478                         rc = ERR_PTR(error);
 479                         goto out_neigh_release;
 480                 }
 481         }
 482
 483         /* Device specific setup. */
 484         if (n->parms->neigh_setup &&
 485             (error = n->parms->neigh_setup(n)) < 0) {
 486                 rc = ERR_PTR(error);
 487                 goto out_neigh_release;
 488         }
 489
 490         n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
 491
 492         write_lock_bh(&tbl->lock);
 493         nht = rcu_dereference_protected(tbl->nht,
 494                                         lockdep_is_held(&tbl->lock));
 495
 496         if (atomic_read(&tbl->entries) > (1 << nht->hash_shift))
 497                 nht = neigh_hash_grow(tbl, nht->hash_shift + 1);
 498
 499         hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift);
 500
 501         if (n->parms->dead) {
 502                 rc = ERR_PTR(-EINVAL);
 503                 goto out_tbl_unlock;
 504         }
 505
 506         for (n1 = rcu_dereference_protected(nht->hash_buckets[hash_val],
 507                                             lockdep_is_held(&tbl->lock));
 508              n1 != NULL;
 509              n1 = rcu_dereference_protected(n1->next,
 510                         lockdep_is_held(&tbl->lock))) {
 511                 if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) {
 512                         if (want_ref)
 513                                 neigh_hold(n1);
 514                         rc = n1;
 515                         goto out_tbl_unlock;
 516                 }
 517         }
 518
 519         n->dead = 0;
 520         if (want_ref)
 521                 neigh_hold(n);
 522         rcu_assign_pointer(n->next,
 523                            rcu_dereference_protected(nht->hash_buckets[hash_val],
 524                                                      lockdep_is_held(&tbl->lock)));
 525         rcu_assign_pointer(nht->hash_buckets[hash_val], n);
 526         write_unlock_bh(&tbl->lock);
 527         neigh_dbg(2, "neigh %p is created\n", n);
 528         rc = n;
 529 out:
 530         return rc;
 531 out_tbl_unlock:
 532         write_unlock_bh(&tbl->lock);
 533 out_neigh_release:
 534         neigh_release(n);
 535         goto out;
 536 }
 537 EXPORT_SYMBOL(__neigh_create);
 538
 539 static u32 pneigh_hash(const void *pkey, int key_len)
 540 {
 541         u32 hash_val = *(u32 *)(pkey + key_len - 4);
 542         hash_val ^= (hash_val >> 16);
 543         hash_val ^= hash_val >> 8;
 544         hash_val ^= hash_val >> 4;
 545         hash_val &= PNEIGH_HASHMASK;
 546         return hash_val;
 547 }
 548
 549 static struct pneigh_entry *__pneigh_lookup_1(struct pneigh_entry *n,
 550                                               struct net *net,
 551                                               const void *pkey,
 552                                               int key_len,
 553                                               struct net_device *dev)
 554 {
 555         while (n) {
 556                 if (!memcmp(n->key, pkey, key_len) &&
 557                     net_eq(pneigh_net(n), net) &&
 558                     (n->dev == dev || !n->dev))
 559                         return n;
 560                 n = n->next;
 561         }
 562         return NULL;
 563 }
 564
 565 struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
 566                 struct net *net, const void *pkey, struct net_device *dev)
 567 {
 568         int key_len = tbl->key_len;
 569         u32 hash_val = pneigh_hash(pkey, key_len);
 570
 571         return __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 572                                  net, pkey, key_len, dev);
 573 }
 574 EXPORT_SYMBOL_GPL(__pneigh_lookup);
 575
 576 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
 577                                     struct net *net, const void *pkey,
 578                                     struct net_device *dev, int creat)
 579 {
 580         struct pneigh_entry *n;
 581         int key_len = tbl->key_len;
 582         u32 hash_val = pneigh_hash(pkey, key_len);
 583
 584         read_lock_bh(&tbl->lock);
 585         n = __pneigh_lookup_1(tbl->phash_buckets[hash_val],
 586                               net, pkey, key_len, dev);
 587         read_unlock_bh(&tbl->lock);
 588
 589         if (n || !creat)
 590                 goto out;
 591
 592         ASSERT_RTNL();
 593
 594         n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL);
 595         if (!n)
 596                 goto out;
 597
 598         write_pnet(&n->net, net);
 599         memcpy(n->key, pkey, key_len);
 600         n->dev = dev;
 601         if (dev)
 602                 dev_hold(dev);
 603
 604         if (tbl->pconstructor && tbl->pconstructor(n)) {
 605                 if (dev)
 606                         dev_put(dev);
 607                 kfree(n);
 608                 n = NULL;
 609                 goto out;
 610         }
 611
 612         write_lock_bh(&tbl->lock);
 613         n->next = tbl->phash_buckets[hash_val];
 614         tbl->phash_buckets[hash_val] = n;
 615         write_unlock_bh(&tbl->lock);
 616 out:
 617         return n;
 618 }
 619 EXPORT_SYMBOL(pneigh_lookup);
 620
 621
 622 int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
 623                   struct net_device *dev)
 624 {
 625         struct pneigh_entry *n, **np;
 626         int key_len = tbl->key_len;
 627         u32 hash_val = pneigh_hash(pkey, key_len);
 628
 629         write_lock_bh(&tbl->lock);
 630         for (np = &tbl->phash_buckets[hash_val]; (n = *np) != NULL;
 631              np = &n->next) {
 632                 if (!memcmp(n->key, pkey, key_len) && n->dev == dev &&
 633                     net_eq(pneigh_net(n), net)) {
 634                         *np = n->next;
 635                         write_unlock_bh(&tbl->lock);
 636                         if (tbl->pdestructor)
 637                                 tbl->pdestructor(n);
 638                         if (n->dev)
 639                                 dev_put(n->dev);
 640                         kfree(n);
 641                         return 0;
 642                 }
 643         }
 644         write_unlock_bh(&tbl->lock);
 645         return -ENOENT;
 646 }
 647
 648 static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 649 {
 650         struct pneigh_entry *n, **np;
 651         u32 h;
 652
 653         for (h = 0; h <= PNEIGH_HASHMASK; h++) {
 654                 np = &tbl->phash_buckets[h];
 655                 while ((n = *np) != NULL) {
 656                         if (!dev || n->dev == dev) {
 657                                 *np = n->next;
 658                                 if (tbl->pdestructor)
 659                                         tbl->pdestructor(n);
 660                                 if (n->dev)
 661                                         dev_put(n->dev);
 662                                 kfree(n);
 663                                 continue;
 664                         }
 665                         np = &n->next;
 666                 }
 667         }
 668         return -ENOENT;
 669 }
 670
 671 static void neigh_parms_destroy(struct neigh_parms *parms);
 672
 673 static inline void neigh_parms_put(struct neigh_parms *parms)
 674 {
 675         if (atomic_dec_and_test(&parms->refcnt))
 676                 neigh_parms_destroy(parms);
 677 }
 678
 679 /*
 680  *      neighbour must already be out of the table;
 681  *
 682  */
 683 void neigh_destroy(struct neighbour *neigh)
 684 {
 685         struct net_device *dev = neigh->dev;
 686
 687         NEIGH_CACHE_STAT_INC(neigh->tbl, destroys);
 688
 689         if (!neigh->dead) {
 690                 pr_warn("Destroying alive neighbour %p\n", neigh);
 691                 dump_stack();
 692                 return;
 693         }
 694
 695         if (neigh_del_timer(neigh))
 696                 pr_warn("Impossible event\n");
 697
 698         write_lock_bh(&neigh->lock);
 699         __skb_queue_purge(&neigh->arp_queue);
 700         write_unlock_bh(&neigh->lock);
 701         neigh->arp_queue_len_bytes = 0;
 702
 703         if (dev->netdev_ops->ndo_neigh_destroy)
 704                 dev->netdev_ops->ndo_neigh_destroy(dev, neigh);
 705
 706         dev_put(dev);
 707         neigh_parms_put(neigh->parms);
 708
 709         neigh_dbg(2, "neigh %p is destroyed\n", neigh);
 710
 711         atomic_dec(&neigh->tbl->entries);
 712         kfree_rcu(neigh, rcu);
 713 }
 714 EXPORT_SYMBOL(neigh_destroy);
 715
 716 /* Neighbour state is suspicious;
 717    disable fast path.
 718
 719    Called with write_locked neigh.
 720  */
 721 static void neigh_suspect(struct neighbour *neigh)
 722 {
 723         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 724
 725         neigh->output = neigh->ops->output;
 726 }
 727
 728 /* Neighbour state is OK;
 729    enable fast path.
 730
 731    Called with write_locked neigh.
 732  */
 733 static void neigh_connect(struct neighbour *neigh)
 734 {
 735         neigh_dbg(2, "neigh %p is connected\n", neigh);
 736
 737         neigh->output = neigh->ops->connected_output;
 738 }
 739
 740 static void neigh_periodic_work(struct work_struct *work)
 741 {
 742         struct neigh_table *tbl = container_of(work, struct neigh_table, gc_work.work);
 743         struct neighbour *n;
 744         struct neighbour __rcu **np;
 745         unsigned int i;
 746         struct neigh_hash_table *nht;
 747
 748         NEIGH_CACHE_STAT_INC(tbl, periodic_gc_runs);
 749
 750         write_lock_bh(&tbl->lock);
 751         nht = rcu_dereference_protected(tbl->nht,
 752                                         lockdep_is_held(&tbl->lock));
 753
 754         /*
 755          *      periodically recompute ReachableTime from random function
 756          */
 757
 758         if (time_after(jiffies, tbl->last_rand + 300 * HZ)) {
 759                 struct neigh_parms *p;
 760                 tbl->last_rand = jiffies;
 761                 list_for_each_entry(p, &tbl->parms_list, list)
 762                         p->reachable_time =
 763                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
 764         }
 765
 766         if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
 767                 goto out;
 768
 769         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
 770                 np = &nht->hash_buckets[i];
 771
 772                 while ((n = rcu_dereference_protected(*np,
 773                                 lockdep_is_held(&tbl->lock))) != NULL) {
 774                         unsigned int state;
 775
 776                         write_lock(&n->lock);
 777
 778                         state = n->nud_state;
 779                         if (state & (NUD_PERMANENT | NUD_IN_TIMER)) {
 780                                 write_unlock(&n->lock);
 781                                 goto next_elt;
 782                         }
 783
 784                         if (time_before(n->used, n->confirmed))
 785                                 n->used = n->confirmed;
 786
 787                         if (atomic_read(&n->refcnt) == 1 &&
 788                             (state == NUD_FAILED ||
 789                              time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
 790                                 *np = n->next;
 791                                 n->dead = 1;
 792                                 write_unlock(&n->lock);
 793                                 neigh_cleanup_and_release(n);
 794                                 continue;
 795                         }
 796                         write_unlock(&n->lock);
 797
 798 next_elt:
 799                         np = &n->next;
 800                 }
 801                 /*
 802                  * It's fine to release lock here, even if hash table
 803                  * grows while we are preempted.
 804                  */
 805                 write_unlock_bh(&tbl->lock);
 806                 cond_resched();
 807                 write_lock_bh(&tbl->lock);
 808                 nht = rcu_dereference_protected(tbl->nht,
 809                                                 lockdep_is_held(&tbl->lock));
 810         }
 811 out:
 812         /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
 813          * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
 814          * BASE_REACHABLE_TIME.
 815          */
 816         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
 817                               NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
 818         write_unlock_bh(&tbl->lock);
 819 }
 820
 821 static __inline__ int neigh_max_probes(struct neighbour *n)
 822 {
 823         struct neigh_parms *p = n->parms;
 824         return NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
 825                (n->nud_state & NUD_PROBE ? NEIGH_VAR(p, MCAST_REPROBES) :
 826                 NEIGH_VAR(p, MCAST_PROBES));
 827 }
 828
 829 static void neigh_invalidate(struct neighbour *neigh)
 830         __releases(neigh->lock)
 831         __acquires(neigh->lock)
 832 {
 833         struct sk_buff *skb;
 834
 835         NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
 836         neigh_dbg(2, "neigh %p is failed\n", neigh);
 837         neigh->updated = jiffies;
 838
 839         /* It is very thin place. report_unreachable is very complicated
 840            routine. Particularly, it can hit the same neighbour entry!
 841
 842            So that, we try to be accurate and avoid dead loop. --ANK
 843          */
 844         while (neigh->nud_state == NUD_FAILED &&
 845                (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
 846                 write_unlock(&neigh->lock);
 847                 neigh->ops->error_report(neigh, skb);
 848                 write_lock(&neigh->lock);
 849         }
 850         __skb_queue_purge(&neigh->arp_queue);
 851         neigh->arp_queue_len_bytes = 0;
 852 }
 853
 854 static void neigh_probe(struct neighbour *neigh)
 855         __releases(neigh->lock)
 856 {
 857         struct sk_buff *skb = skb_peek_tail(&neigh->arp_queue);
 858         /* keep skb alive even if arp_queue overflows */
 859         if (skb)
 860                 skb = skb_clone(skb, GFP_ATOMIC);
 861         write_unlock(&neigh->lock);
 862         if (neigh->ops->solicit)
 863                 neigh->ops->solicit(neigh, skb);
 864         atomic_inc(&neigh->probes);
 865         kfree_skb(skb);
 866 }
 867
 868 /* Called when a timer expires for a neighbour entry. */
 869
 870 static void neigh_timer_handler(unsigned long arg)
 871 {
 872         unsigned long now, next;
 873         struct neighbour *neigh = (struct neighbour *)arg;
 874         unsigned int state;
 875         int notify = 0;
 876
 877         write_lock(&neigh->lock);
 878
 879         state = neigh->nud_state;
 880         now = jiffies;
 881         next = now + HZ;
 882
 883         if (!(state & NUD_IN_TIMER))
 884                 goto out;
 885
 886         if (state & NUD_REACHABLE) {
 887                 if (time_before_eq(now,
 888                                    neigh->confirmed + neigh->parms->reachable_time)) {
 889                         neigh_dbg(2, "neigh %p is still alive\n", neigh);
 890                         next = neigh->confirmed + neigh->parms->reachable_time;
 891                 } else if (time_before_eq(now,
 892                                           neigh->used +
 893                                           NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 894                         neigh_dbg(2, "neigh %p is delayed\n", neigh);
 895                         neigh->nud_state = NUD_DELAY;
 896                         neigh->updated = jiffies;
 897                         neigh_suspect(neigh);
 898                         next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
 899                 } else {
 900                         neigh_dbg(2, "neigh %p is suspected\n", neigh);
 901                         neigh->nud_state = NUD_STALE;
 902                         neigh->updated = jiffies;
 903                         neigh_suspect(neigh);
 904                         notify = 1;
 905                 }
 906         } else if (state & NUD_DELAY) {
 907                 if (time_before_eq(now,
 908                                    neigh->confirmed +
 909                                    NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
 910                         neigh_dbg(2, "neigh %p is now reachable\n", neigh);
 911                         neigh->nud_state = NUD_REACHABLE;
 912                         neigh->updated = jiffies;
 913                         neigh_connect(neigh);
 914                         notify = 1;
 915                         next = neigh->confirmed + neigh->parms->reachable_time;
 916                 } else {
 917                         neigh_dbg(2, "neigh %p is probed\n", neigh);
 918                         neigh->nud_state = NUD_PROBE;
 919                         neigh->updated = jiffies;
 920                         atomic_set(&neigh->probes, 0);
 921                         notify = 1;
 922                         next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 923                 }
 924         } else {
 925                 /* NUD_PROBE|NUD_INCOMPLETE */
 926                 next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
 927         }
 928
 929         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
 930             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
 931                 neigh->nud_state = NUD_FAILED;
 932                 notify = 1;
 933                 neigh_invalidate(neigh);
 934                 goto out;
 935         }
 936
 937         if (neigh->nud_state & NUD_IN_TIMER) {
 938                 if (time_before(next, jiffies + HZ/2))
 939                         next = jiffies + HZ/2;
 940                 if (!mod_timer(&neigh->timer, next))
 941                         neigh_hold(neigh);
 942         }
 943         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
 944                 neigh_probe(neigh);
 945         } else {
 946 out:
 947                 write_unlock(&neigh->lock);
 948         }
 949
 950         if (notify)
 951                 neigh_update_notify(neigh);
 952
 953         neigh_release(neigh);
 954 }
 955
 956 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 957 {
 958         int rc;
 959         bool immediate_probe = false;
 960
 961         write_lock_bh(&neigh->lock);
 962
 963         rc = 0;
 964         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
 965                 goto out_unlock_bh;
 966         if (neigh->dead)
 967                 goto out_dead;
 968
 969         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
 970                 if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
 971                     NEIGH_VAR(neigh->parms, APP_PROBES)) {
 972                         unsigned long next, now = jiffies;
 973
 974                         atomic_set(&neigh->probes,
 975                                    NEIGH_VAR(neigh->parms, UCAST_PROBES));
 976                         neigh->nud_state     = NUD_INCOMPLETE;
 977                         neigh->updated = now;
 978                         next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
 979                                          HZ/2);
 980                         neigh_add_timer(neigh, next);
 981                         immediate_probe = true;
 982                 } else {
 983                         neigh->nud_state = NUD_FAILED;
 984                         neigh->updated = jiffies;
 985                         write_unlock_bh(&neigh->lock);
 986
 987                         kfree_skb(skb);
 988                         return 1;
 989                 }
 990         } else if (neigh->nud_state & NUD_STALE) {
 991                 neigh_dbg(2, "neigh %p is delayed\n", neigh);
 992                 neigh->nud_state = NUD_DELAY;
 993                 neigh->updated = jiffies;
 994                 neigh_add_timer(neigh, jiffies +
 995                                 NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
 996         }
 997
 998         if (neigh->nud_state == NUD_INCOMPLETE) {
 999                 if (skb) {
1000                         while (neigh->arp_queue_len_bytes + skb->truesize >
1001                                NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
1002                                 struct sk_buff *buff;
1003
1004                                 buff = __skb_dequeue(&neigh->arp_queue);
1005                                 if (!buff)
1006                                         break;
1007                                 neigh->arp_queue_len_bytes -= buff->truesize;
1008                                 kfree_skb(buff);
1009                                 NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
1010                         }
1011                         skb_dst_force(skb);
1012                         __skb_queue_tail(&neigh->arp_queue, skb);
1013                         neigh->arp_queue_len_bytes += skb->truesize;
1014                 }
1015                 rc = 1;
1016         }
1017 out_unlock_bh:
1018         if (immediate_probe)
1019                 neigh_probe(neigh);
1020         else
1021                 write_unlock(&neigh->lock);
1022         local_bh_enable();
1023         return rc;
1024
1025 out_dead:
1026         if (neigh->nud_state & NUD_STALE)
1027                 goto out_unlock_bh;
1028         write_unlock_bh(&neigh->lock);
1029         kfree_skb(skb);
1030         return 1;
1031 }
1032 EXPORT_SYMBOL(__neigh_event_send);
1033
1034 static void neigh_update_hhs(struct neighbour *neigh)
1035 {
1036         struct hh_cache *hh;
1037         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
1038                 = NULL;
1039
1040         if (neigh->dev->header_ops)
1041                 update = neigh->dev->header_ops->cache_update;
1042
1043         if (update) {
1044                 hh = &neigh->hh;
1045                 if (hh->hh_len) {
1046                         write_seqlock_bh(&hh->hh_lock);
1047                         update(hh, neigh->dev, neigh->ha);
1048                         write_sequnlock_bh(&hh->hh_lock);
1049                 }
1050         }
1051 }
1052
1053
1054
1055 /* Generic update routine.
1056    -- lladdr is new lladdr or NULL, if it is not supplied.
1057    -- new    is new state.
1058    -- flags
1059         NEIGH_UPDATE_F_OVERRIDE allows to override existing lladdr,
1060                                 if it is different.
1061         NEIGH_UPDATE_F_WEAK_OVERRIDE will suspect existing "connected"
1062                                 lladdr instead of overriding it
1063                                 if it is different.
1064         NEIGH_UPDATE_F_ADMIN    means that the change is administrative.
1065
1066         NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
1067                                 NTF_ROUTER flag.
1068         NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as
1069                                 a router.
1070
1071    Caller MUST hold reference count on the entry.
1072  */
1073
1074 int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
1075                  u32 flags)
1076 {
1077         u8 old;
1078         int err;
1079         int notify = 0;
1080         struct net_device *dev;
1081         int update_isrouter = 0;
1082
1083         write_lock_bh(&neigh->lock);
1084
1085         dev    = neigh->dev;
1086         old    = neigh->nud_state;
1087         err    = -EPERM;
1088
1089         if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
1090             (old & (NUD_NOARP | NUD_PERMANENT)))
1091                 goto out;
1092         if (neigh->dead)
1093                 goto out;
1094
1095         if (!(new & NUD_VALID)) {
1096                 neigh_del_timer(neigh);
1097                 if (old & NUD_CONNECTED)
1098                         neigh_suspect(neigh);
1099                 neigh->nud_state = new;
1100                 err = 0;
1101                 notify = old & NUD_VALID;
1102                 if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
1103                     (new & NUD_FAILED)) {
1104                         neigh_invalidate(neigh);
1105                         notify = 1;
1106                 }
1107                 goto out;
1108         }
1109
1110         /* Compare new lladdr with cached one */
1111         if (!dev->addr_len) {
1112                 /* First case: device needs no address. */
1113                 lladdr = neigh->ha;
1114         } else if (lladdr) {
1115                 /* The second case: if something is already cached
1116                    and a new address is proposed:
1117                    - compare new & old
1118                    - if they are different, check override flag
1119                  */
1120                 if ((old & NUD_VALID) &&
1121                     !memcmp(lladdr, neigh->ha, dev->addr_len))
1122                         lladdr = neigh->ha;
1123         } else {
1124                 /* No address is supplied; if we know something,
1125                    use it, otherwise discard the request.
1126                  */
1127                 err = -EINVAL;
1128                 if (!(old & NUD_VALID))
1129                         goto out;
1130                 lladdr = neigh->ha;
1131         }
1132
1133         if (new & NUD_CONNECTED)
1134                 neigh->confirmed = jiffies;
1135         neigh->updated = jiffies;
1136
1137         /* If entry was valid and address is not changed,
1138            do not change entry state, if new one is STALE.
1139          */
1140         err = 0;
1141         update_isrouter = flags & NEIGH_UPDATE_F_OVERRIDE_ISROUTER;
1142         if (old & NUD_VALID) {
1143                 if (lladdr != neigh->ha && !(flags & NEIGH_UPDATE_F_OVERRIDE)) {
1144                         update_isrouter = 0;
1145                         if ((flags & NEIGH_UPDATE_F_WEAK_OVERRIDE) &&
1146                             (old & NUD_CONNECTED)) {
1147                                 lladdr = neigh->ha;
1148                                 new = NUD_STALE;
1149                         } else
1150                                 goto out;
1151                 } else {
1152                         if (lladdr == neigh->ha && new == NUD_STALE &&
1153                             !(flags & NEIGH_UPDATE_F_ADMIN))
1154                                 new = old;
1155                 }
1156         }
1157
1158         if (new != old) {
1159                 neigh_del_timer(neigh);
1160                 if (new & NUD_PROBE)
1161                         atomic_set(&neigh->probes, 0);
1162                 if (new & NUD_IN_TIMER)
1163                         neigh_add_timer(neigh, (jiffies +
1164                                                 ((new & NUD_REACHABLE) ?
1165                                                  neigh->parms->reachable_time :
1166                                                  0)));
1167                 neigh->nud_state = new;
1168                 notify = 1;
1169         }
1170
1171         if (lladdr != neigh->ha) {
1172                 write_seqlock(&neigh->ha_lock);
1173                 memcpy(&neigh->ha, lladdr, dev->addr_len);
1174                 write_sequnlock(&neigh->ha_lock);
1175                 neigh_update_hhs(neigh);
1176                 if (!(new & NUD_CONNECTED))
1177                         neigh->confirmed = jiffies -
1178                                       (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
1179                 notify = 1;
1180         }
1181         if (new == old)
1182                 goto out;
1183         if (new & NUD_CONNECTED)
1184                 neigh_connect(neigh);
1185         else
1186                 neigh_suspect(neigh);
1187         if (!(old & NUD_VALID)) {
1188                 struct sk_buff *skb;
1189
1190                 /* Again: avoid dead loop if something went wrong */
1191
1192                 while (neigh->nud_state & NUD_VALID &&
1193                        (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
1194                         struct dst_entry *dst = skb_dst(skb);
1195                         struct neighbour *n2, *n1 = neigh;
1196                         write_unlock_bh(&neigh->lock);
1197
1198                         rcu_read_lock();
1199
1200                         /* Why not just use 'neigh' as-is?  The problem is that
1201                          * things such as shaper, eql, and sch_teql can end up
1202                          * using alternative, different, neigh objects to output
1203                          * the packet in the output path.  So what we need to do
1204                          * here is re-lookup the top-level neigh in the path so
1205                          * we can reinject the packet there.
1206                          */
1207                         n2 = NULL;
1208                         if (dst) {
1209                                 n2 = dst_neigh_lookup_skb(dst, skb);
1210                                 if (n2)
1211                                         n1 = n2;
1212                         }
1213                         n1->output(n1, skb);
1214                         if (n2)
1215                                 neigh_release(n2);
1216                         rcu_read_unlock();
1217
1218                         write_lock_bh(&neigh->lock);
1219                 }
1220                 __skb_queue_purge(&neigh->arp_queue);
1221                 neigh->arp_queue_len_bytes = 0;
1222         }
1223 out:
1224         if (update_isrouter) {
1225                 neigh->flags = (flags & NEIGH_UPDATE_F_ISROUTER) ?
1226                         (neigh->flags | NTF_ROUTER) :
1227                         (neigh->flags & ~NTF_ROUTER);
1228         }
1229         write_unlock_bh(&neigh->lock);
1230
1231         if (notify)
1232                 neigh_update_notify(neigh);
1233
1234         return err;
1235 }
1236 EXPORT_SYMBOL(neigh_update);
1237
1238 /* Update the neigh to listen temporarily for probe responses, even if it is
1239  * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
1240  */
1241 void __neigh_set_probe_once(struct neighbour *neigh)
1242 {
1243         if (neigh->dead)
1244                 return;
1245         neigh->updated = jiffies;
1246         if (!(neigh->nud_state & NUD_FAILED))
1247                 return;
1248         neigh->nud_state = NUD_INCOMPLETE;
1249         atomic_set(&neigh->probes, neigh_max_probes(neigh));
1250         neigh_add_timer(neigh,
1251                         jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
1252 }
1253 EXPORT_SYMBOL(__neigh_set_probe_once);
1254
1255 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
1256                                  u8 *lladdr, void *saddr,
1257                                  struct net_device *dev)
1258 {
1259         struct neighbour *neigh = __neigh_lookup(tbl, saddr, dev,
1260                                                  lladdr || !dev->addr_len);
1261         if (neigh)
1262                 neigh_update(neigh, lladdr, NUD_STALE,
1263                              NEIGH_UPDATE_F_OVERRIDE);
1264         return neigh;
1265 }
1266 EXPORT_SYMBOL(neigh_event_ns);
1267
1268 /* called with read_lock_bh(&n->lock); */
1269 static void neigh_hh_init(struct neighbour *n)
1270 {
1271         struct net_device *dev = n->dev;
1272         __be16 prot = n->tbl->protocol;
1273         struct hh_cache *hh = &n->hh;
1274
1275         write_lock_bh(&n->lock);
1276
1277         /* Only one thread can come in here and initialize the
1278          * hh_cache entry.
1279          */
1280         if (!hh->hh_len)
1281                 dev->header_ops->cache(n, hh, prot);
1282
1283         write_unlock_bh(&n->lock);
1284 }
1285
1286 /* Slow and careful. */
1287
1288 int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
1289 {
1290         int rc = 0;
1291
1292         if (!neigh_event_send(neigh, skb)) {
1293                 int err;
1294                 struct net_device *dev = neigh->dev;
1295                 unsigned int seq;
1296
1297                 if (dev->header_ops->cache && !neigh->hh.hh_len)
1298                         neigh_hh_init(neigh);
1299
1300                 do {
1301                         __skb_pull(skb, skb_network_offset(skb));
1302                         seq = read_seqbegin(&neigh->ha_lock);
1303                         err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1304                                               neigh->ha, NULL, skb->len);
1305                 } while (read_seqretry(&neigh->ha_lock, seq));
1306
1307                 if (err >= 0)
1308                         rc = dev_queue_xmit(skb);
1309                 else
1310                         goto out_kfree_skb;
1311         }
1312 out:
1313         return rc;
1314 out_kfree_skb:
1315         rc = -EINVAL;
1316         kfree_skb(skb);
1317         goto out;
1318 }
1319 EXPORT_SYMBOL(neigh_resolve_output);
1320
1321 /* As fast as possible without hh cache */
1322
1323 int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb)
1324 {
1325         struct net_device *dev = neigh->dev;
1326         unsigned int seq;
1327         int err;
1328
1329         do {
1330                 __skb_pull(skb, skb_network_offset(skb));
1331                 seq = read_seqbegin(&neigh->ha_lock);
1332                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
1333                                       neigh->ha, NULL, skb->len);
1334         } while (read_seqretry(&neigh->ha_lock, seq));
1335
1336         if (err >= 0)
1337                 err = dev_queue_xmit(skb);
1338         else {
1339                 err = -EINVAL;
1340                 kfree_skb(skb);
1341         }
1342         return err;
1343 }
1344 EXPORT_SYMBOL(neigh_connected_output);
1345
1346 int neigh_direct_output(struct neighbour *neigh, struct sk_buff *skb)
1347 {
1348         return dev_queue_xmit(skb);
1349 }
1350 EXPORT_SYMBOL(neigh_direct_output);
1351
1352 static void neigh_proxy_process(unsigned long arg)
1353 {
1354         struct neigh_table *tbl = (struct neigh_table *)arg;
1355         long sched_next = 0;
1356         unsigned long now = jiffies;
1357         struct sk_buff *skb, *n;
1358
1359         spin_lock(&tbl->proxy_queue.lock);
1360
1361         skb_queue_walk_safe(&tbl->proxy_queue, skb, n) {
1362                 long tdif = NEIGH_CB(skb)->sched_next - now;
1363
1364                 if (tdif <= 0) {
1365                         struct net_device *dev = skb->dev;
1366
1367                         __skb_unlink(skb, &tbl->proxy_queue);
1368                         if (tbl->proxy_redo && netif_running(dev)) {
1369                                 rcu_read_lock();
1370                                 tbl->proxy_redo(skb);
1371                                 rcu_read_unlock();
1372                         } else {
1373                                 kfree_skb(skb);
1374                         }
1375
1376                         dev_put(dev);
1377                 } else if (!sched_next || tdif < sched_next)
1378                         sched_next = tdif;
1379         }
1380         del_timer(&tbl->proxy_timer);
1381         if (sched_next)
1382                 mod_timer(&tbl->proxy_timer, jiffies + sched_next);
1383         spin_unlock(&tbl->proxy_queue.lock);
1384 }
1385
1386 void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
1387                     struct sk_buff *skb)
1388 {
1389         unsigned long now = jiffies;
1390
1391         unsigned long sched_next = now + (prandom_u32() %
1392                                           NEIGH_VAR(p, PROXY_DELAY));
1393
1394         if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
1395                 kfree_skb(skb);
1396                 return;
1397         }
1398
1399         NEIGH_CB(skb)->sched_next = sched_next;
1400         NEIGH_CB(skb)->flags |= LOCALLY_ENQUEUED;
1401
1402         spin_lock(&tbl->proxy_queue.lock);
1403         if (del_timer(&tbl->proxy_timer)) {
1404                 if (time_before(tbl->proxy_timer.expires, sched_next))
1405                         sched_next = tbl->proxy_timer.expires;
1406         }
1407         skb_dst_drop(skb);
1408         dev_hold(skb->dev);
1409         __skb_queue_tail(&tbl->proxy_queue, skb);
1410         mod_timer(&tbl->proxy_timer, sched_next);
1411         spin_unlock(&tbl->proxy_queue.lock);
1412 }
1413 EXPORT_SYMBOL(pneigh_enqueue);
1414
1415 static inline struct neigh_parms *lookup_neigh_parms(struct neigh_table *tbl,
1416                                                       struct net *net, int ifindex)
1417 {
1418         struct neigh_parms *p;
1419
1420         list_for_each_entry(p, &tbl->parms_list, list) {
1421                 if ((p->dev && p->dev->ifindex == ifindex && net_eq(neigh_parms_net(p), net)) ||
1422                     (!p->dev && !ifindex && net_eq(net, &init_net)))
1423                         return p;
1424         }
1425
1426         return NULL;
1427 }
1428
1429 struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
1430                                       struct neigh_table *tbl)
1431 {
1432         struct neigh_parms *p;
1433         struct net *net = dev_net(dev);
1434         const struct net_device_ops *ops = dev->netdev_ops;
1435
1436         p = kmemdup(&tbl->parms, sizeof(*p), GFP_KERNEL);
1437         if (p) {
1438                 p->tbl            = tbl;
1439                 atomic_set(&p->refcnt, 1);
1440                 p->reachable_time =
1441                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
1442                 dev_hold(dev);
1443                 p->dev = dev;
1444                 write_pnet(&p->net, net);
1445                 p->sysctl_table = NULL;
1446
1447                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
1448                         dev_put(dev);
1449                         kfree(p);
1450                         return NULL;
1451                 }
1452
1453                 write_lock_bh(&tbl->lock);
1454                 list_add(&p->list, &tbl->parms.list);
1455                 write_unlock_bh(&tbl->lock);
1456
1457                 neigh_parms_data_state_cleanall(p);
1458         }
1459         return p;
1460 }
1461 EXPORT_SYMBOL(neigh_parms_alloc);
1462
1463 static void neigh_rcu_free_parms(struct rcu_head *head)
1464 {
1465         struct neigh_parms *parms =
1466                 container_of(head, struct neigh_parms, rcu_head);
1467
1468         neigh_parms_put(parms);
1469 }
1470
1471 void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
1472 {
1473         if (!parms || parms == &tbl->parms)
1474                 return;
1475         write_lock_bh(&tbl->lock);
1476         list_del(&parms->list);
1477         parms->dead = 1;
1478         write_unlock_bh(&tbl->lock);
1479         if (parms->dev)
1480                 dev_put(parms->dev);
1481         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
1482 }
1483 EXPORT_SYMBOL(neigh_parms_release);
1484
1485 static void neigh_parms_destroy(struct neigh_parms *parms)
1486 {
1487         kfree(parms);
1488 }
1489
1490 static struct lock_class_key neigh_table_proxy_queue_class;
1491
1492 static struct neigh_table *neigh_tables[NEIGH_NR_TABLES] __read_mostly;
1493
1494 void neigh_table_init(int index, struct neigh_table *tbl)
1495 {
1496         unsigned long now = jiffies;
1497         unsigned long phsize;
1498
1499         INIT_LIST_HEAD(&tbl->parms_list);
1500         list_add(&tbl->parms.list, &tbl->parms_list);
1501         write_pnet(&tbl->parms.net, &init_net);
1502         atomic_set(&tbl->parms.refcnt, 1);
1503         tbl->parms.reachable_time =
1504                           neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
1505
1506         tbl->stats = alloc_percpu(struct neigh_statistics);
1507         if (!tbl->stats)
1508                 panic("cannot create neighbour cache statistics");
1509
1510 #ifdef CONFIG_PROC_FS
1511         if (!proc_create_data(tbl->id, 0, init_net.proc_net_stat,
1512                               &neigh_stat_seq_fops, tbl))
1513                 panic("cannot create neighbour proc dir entry");
1514 #endif
1515
1516         RCU_INIT_POINTER(tbl->nht, neigh_hash_alloc(3));
1517
1518         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
1519         tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
1520
1521         if (!tbl->nht || !tbl->phash_buckets)
1522                 panic("cannot allocate neighbour cache hashes");
1523
1524         if (!tbl->entry_size)
1525                 tbl->entry_size = ALIGN(offsetof(struct neighbour, primary_key) +
1526                                         tbl->key_len, NEIGH_PRIV_ALIGN);
1527         else
1528                 WARN_ON(tbl->entry_size % NEIGH_PRIV_ALIGN);
1529
1530         rwlock_init(&tbl->lock);
1531         INIT_DEFERRABLE_WORK(&tbl->gc_work, neigh_periodic_work);
1532         queue_delayed_work(system_power_efficient_wq, &tbl->gc_work,
1533                         tbl->parms.reachable_time);
1534         setup_timer(&tbl->proxy_timer, neigh_proxy_process, (unsigned long)tbl);
1535         skb_queue_head_init_class(&tbl->proxy_queue,
1536                         &neigh_table_proxy_queue_class);
1537
1538         tbl->last_flush = now;
1539         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
1540
1541         neigh_tables[index] = tbl;
1542 }
1543 EXPORT_SYMBOL(neigh_table_init);
1544
1545 int neigh_table_clear(int index, struct neigh_table *tbl)
1546 {
1547         neigh_tables[index] = NULL;
1548         /* It is not clean... Fix it to unload IPv6 module safely */
1549         cancel_delayed_work_sync(&tbl->gc_work);
1550         del_timer_sync(&tbl->proxy_timer);
1551         pneigh_queue_purge(&tbl->proxy_queue);
1552         neigh_ifdown(tbl, NULL);
1553         if (atomic_read(&tbl->entries))
1554                 pr_crit("neighbour leakage\n");
1555
1556         call_rcu(&rcu_dereference_protected(tbl->nht, 1)->rcu,
1557                  neigh_hash_free_rcu);
1558         tbl->nht = NULL;
1559
1560         kfree(tbl->phash_buckets);
1561         tbl->phash_buckets = NULL;
1562
1563         remove_proc_entry(tbl->id, init_net.proc_net_stat);
1564
1565         free_percpu(tbl->stats);
1566         tbl->stats = NULL;
1567
1568         return 0;
1569 }
1570 EXPORT_SYMBOL(neigh_table_clear);
1571
1572 static struct neigh_table *neigh_find_table(int family)
1573 {
1574         struct neigh_table *tbl = NULL;
1575
1576         switch (family) {
1577         case AF_INET:
1578                 tbl = neigh_tables[NEIGH_ARP_TABLE];
1579                 break;
1580         case AF_INET6:
1581                 tbl = neigh_tables[NEIGH_ND_TABLE];
1582                 break;
1583         case AF_DECnet:
1584                 tbl = neigh_tables[NEIGH_DN_TABLE];
1585                 break;
1586         }
1587
1588         return tbl;
1589 }
1590
1591 static int neigh_delete(struct sk_buff *skb, struct nlmsghdr *nlh)
1592 {
1593         struct net *net = sock_net(skb->sk);
1594         struct ndmsg *ndm;
1595         struct nlattr *dst_attr;
1596         struct neigh_table *tbl;
1597         struct neighbour *neigh;
1598         struct net_device *dev = NULL;
1599         int err = -EINVAL;
1600
1601         ASSERT_RTNL();
1602         if (nlmsg_len(nlh) < sizeof(*ndm))
1603                 goto out;
1604
1605         dst_attr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_DST);
1606         if (dst_attr == NULL)
1607                 goto out;
1608
1609         ndm = nlmsg_data(nlh);
1610         if (ndm->ndm_ifindex) {
1611                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1612                 if (dev == NULL) {
1613                         err = -ENODEV;
1614                         goto out;
1615                 }
1616         }
1617
1618         tbl = neigh_find_table(ndm->ndm_family);
1619         if (tbl == NULL)
1620                 return -EAFNOSUPPORT;
1621
1622         if (nla_len(dst_attr) < tbl->key_len)
1623                 goto out;
1624
1625         if (ndm->ndm_flags & NTF_PROXY) {
1626                 err = pneigh_delete(tbl, net, nla_data(dst_attr), dev);
1627                 goto out;
1628         }
1629
1630         if (dev == NULL)
1631                 goto out;
1632
1633         neigh = neigh_lookup(tbl, nla_data(dst_attr), dev);
1634         if (neigh == NULL) {
1635                 err = -ENOENT;
1636                 goto out;
1637         }
1638
1639         err = neigh_update(neigh, NULL, NUD_FAILED,
1640                            NEIGH_UPDATE_F_OVERRIDE |
1641                            NEIGH_UPDATE_F_ADMIN);
1642         neigh_release(neigh);
1643
1644 out:
1645         return err;
1646 }
1647
1648 static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh)
1649 {
1650         int flags = NEIGH_UPDATE_F_ADMIN | NEIGH_UPDATE_F_OVERRIDE;
1651         struct net *net = sock_net(skb->sk);
1652         struct ndmsg *ndm;
1653         struct nlattr *tb[NDA_MAX+1];
1654         struct neigh_table *tbl;
1655         struct net_device *dev = NULL;
1656         struct neighbour *neigh;
1657         void *dst, *lladdr;
1658         int err;
1659
1660         ASSERT_RTNL();
1661         err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
1662         if (err < 0)
1663                 goto out;
1664
1665         err = -EINVAL;
1666         if (tb[NDA_DST] == NULL)
1667                 goto out;
1668
1669         ndm = nlmsg_data(nlh);
1670         if (ndm->ndm_ifindex) {
1671                 dev = __dev_get_by_index(net, ndm->ndm_ifindex);
1672                 if (dev == NULL) {
1673                         err = -ENODEV;
1674                         goto out;
1675                 }
1676
1677                 if (tb[NDA_LLADDR] && nla_len(tb[NDA_LLADDR]) < dev->addr_len)
1678                         goto out;
1679         }
1680
1681         tbl = neigh_find_table(ndm->ndm_family);
1682         if (tbl == NULL)
1683                 return -EAFNOSUPPORT;
1684
1685         if (nla_len(tb[NDA_DST]) < tbl->key_len)
1686                 goto out;
1687         dst = nla_data(tb[NDA_DST]);
1688         lladdr = tb[NDA_LLADDR] ? nla_data(tb[NDA_LLADDR]) : NULL;
1689
1690         if (ndm->ndm_flags & NTF_PROXY) {
1691                 struct pneigh_entry *pn;
1692
1693                 err = -ENOBUFS;
1694                 pn = pneigh_lookup(tbl, net, dst, dev, 1);
1695                 if (pn) {
1696                         pn->flags = ndm->ndm_flags;
1697                         err = 0;
1698                 }
1699                 goto out;
1700         }
1701
1702         if (dev == NULL)
1703                 goto out;
1704
1705         neigh = neigh_lookup(tbl, dst, dev);
1706         if (neigh == NULL) {
1707                 if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
1708                         err = -ENOENT;
1709                         goto out;
1710                 }
1711
1712                 neigh = __neigh_lookup_errno(tbl, dst, dev);
1713                 if (IS_ERR(neigh)) {
1714                         err = PTR_ERR(neigh);
1715                         goto out;
1716                 }
1717         } else {
1718                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1719                         err = -EEXIST;
1720                         neigh_release(neigh);
1721                         goto out;
1722                 }
1723
1724                 if (!(nlh->nlmsg_flags & NLM_F_REPLACE))
1725                         flags &= ~NEIGH_UPDATE_F_OVERRIDE;
1726         }
1727
1728         if (ndm->ndm_flags & NTF_USE) {
1729                 neigh_event_send(neigh, NULL);
1730                 err = 0;
1731         } else
1732                 err = neigh_update(neigh, lladdr, ndm->ndm_state, flags);
1733         neigh_release(neigh);
1734
1735 out:
1736         return err;
1737 }
1738
1739 static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
1740 {
1741         struct nlattr *nest;
1742
1743         nest = nla_nest_start(skb, NDTA_PARMS);
1744         if (nest == NULL)
1745                 return -ENOBUFS;
1746
1747         if ((parms->dev &&
1748              nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
1749             nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
1750             nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
1751                         NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
1752             /* approximative value for deprecated QUEUE_LEN (in packets) */
1753             nla_put_u32(skb, NDTPA_QUEUE_LEN,
1754                         NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
1755             nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
1756             nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
1757             nla_put_u32(skb, NDTPA_UCAST_PROBES,
1758                         NEIGH_VAR(parms, UCAST_PROBES)) ||
1759             nla_put_u32(skb, NDTPA_MCAST_PROBES,
1760                         NEIGH_VAR(parms, MCAST_PROBES)) ||
1761             nla_put_u32(skb, NDTPA_MCAST_REPROBES,
1762                         NEIGH_VAR(parms, MCAST_REPROBES)) ||
1763             nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time,
1764                           NDTPA_PAD) ||
1765             nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
1766                           NEIGH_VAR(parms, BASE_REACHABLE_TIME), NDTPA_PAD) ||
1767             nla_put_msecs(skb, NDTPA_GC_STALETIME,
1768                           NEIGH_VAR(parms, GC_STALETIME), NDTPA_PAD) ||
1769             nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
1770                           NEIGH_VAR(parms, DELAY_PROBE_TIME), NDTPA_PAD) ||
1771             nla_put_msecs(skb, NDTPA_RETRANS_TIME,
1772                           NEIGH_VAR(parms, RETRANS_TIME), NDTPA_PAD) ||
1773             nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
1774                           NEIGH_VAR(parms, ANYCAST_DELAY), NDTPA_PAD) ||
1775             nla_put_msecs(skb, NDTPA_PROXY_DELAY,
1776                           NEIGH_VAR(parms, PROXY_DELAY), NDTPA_PAD) ||
1777             nla_put_msecs(skb, NDTPA_LOCKTIME,
1778                           NEIGH_VAR(parms, LOCKTIME), NDTPA_PAD))
1779                 goto nla_put_failure;
1780         return nla_nest_end(skb, nest);
1781
1782 nla_put_failure:
1783         nla_nest_cancel(skb, nest);
1784         return -EMSGSIZE;
1785 }
1786
1787 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
1788                               u32 pid, u32 seq, int type, int flags)
1789 {
1790         struct nlmsghdr *nlh;
1791         struct ndtmsg *ndtmsg;
1792
1793         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1794         if (nlh == NULL)
1795                 return -EMSGSIZE;
1796
1797         ndtmsg = nlmsg_data(nlh);
1798
1799         read_lock_bh(&tbl->lock);
1800         ndtmsg->ndtm_family = tbl->family;
1801         ndtmsg->ndtm_pad1   = 0;
1802         ndtmsg->ndtm_pad2   = 0;
1803
1804         if (nla_put_string(skb, NDTA_NAME, tbl->id) ||
1805             nla_put_msecs(skb, NDTA_GC_INTERVAL, tbl->gc_interval, NDTA_PAD) ||
1806             nla_put_u32(skb, NDTA_THRESH1, tbl->gc_thresh1) ||
1807             nla_put_u32(skb, NDTA_THRESH2, tbl->gc_thresh2) ||
1808             nla_put_u32(skb, NDTA_THRESH3, tbl->gc_thresh3))
1809                 goto nla_put_failure;
1810         {
1811                 unsigned long now = jiffies;
1812                 unsigned int flush_delta = now - tbl->last_flush;
1813                 unsigned int rand_delta = now - tbl->last_rand;
1814                 struct neigh_hash_table *nht;
1815                 struct ndt_config ndc = {
1816                         .ndtc_key_len           = tbl->key_len,
1817                         .ndtc_entry_size        = tbl->entry_size,
1818                         .ndtc_entries           = atomic_read(&tbl->entries),
1819                         .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
1820                         .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
1821                         .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
1822                 };
1823
1824                 rcu_read_lock_bh();
1825                 nht = rcu_dereference_bh(tbl->nht);
1826                 ndc.ndtc_hash_rnd = nht->hash_rnd[0];
1827                 ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
1828                 rcu_read_unlock_bh();
1829
1830                 if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
1831                         goto nla_put_failure;
1832         }
1833
1834         {
1835                 int cpu;
1836                 struct ndt_stats ndst;
1837
1838                 memset(&ndst, 0, sizeof(ndst));
1839
1840                 for_each_possible_cpu(cpu) {
1841                         struct neigh_statistics *st;
1842
1843                         st = per_cpu_ptr(tbl->stats, cpu);
1844                         ndst.ndts_allocs                += st->allocs;
1845                         ndst.ndts_destroys              += st->destroys;
1846                         ndst.ndts_hash_grows            += st->hash_grows;
1847                         ndst.ndts_res_failed            += st->res_failed;
1848                         ndst.ndts_lookups               += st->lookups;
1849                         ndst.ndts_hits                  += st->hits;
1850                         ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
1851                         ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
1852                         ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
1853                         ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
1854                         ndst.ndts_table_fulls           += st->table_fulls;
1855                 }
1856
1857                 if (nla_put_64bit(skb, NDTA_STATS, sizeof(ndst), &ndst,
1858                                   NDTA_PAD))
1859                         goto nla_put_failure;
1860         }
1861
1862         BUG_ON(tbl->parms.dev);
1863         if (neightbl_fill_parms(skb, &tbl->parms) < 0)
1864                 goto nla_put_failure;
1865
1866         read_unlock_bh(&tbl->lock);
1867         nlmsg_end(skb, nlh);
1868         return 0;
1869
1870 nla_put_failure:
1871         read_unlock_bh(&tbl->lock);
1872         nlmsg_cancel(skb, nlh);
1873         return -EMSGSIZE;
1874 }
1875
1876 static int neightbl_fill_param_info(struct sk_buff *skb,
1877                                     struct neigh_table *tbl,
1878                                     struct neigh_parms *parms,
1879                                     u32 pid, u32 seq, int type,
1880                                     unsigned int flags)
1881 {
1882         struct ndtmsg *ndtmsg;
1883         struct nlmsghdr *nlh;
1884
1885         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndtmsg), flags);
1886         if (nlh == NULL)
1887                 return -EMSGSIZE;
1888
1889         ndtmsg = nlmsg_data(nlh);
1890
1891         read_lock_bh(&tbl->lock);
1892         ndtmsg->ndtm_family = tbl->family;
1893         ndtmsg->ndtm_pad1   = 0;
1894         ndtmsg->ndtm_pad2   = 0;
1895
1896         if (nla_put_string(skb, NDTA_NAME, tbl->id) < 0 ||
1897             neightbl_fill_parms(skb, parms) < 0)
1898                 goto errout;
1899
1900         read_unlock_bh(&tbl->lock);
1901         nlmsg_end(skb, nlh);
1902         return 0;
1903 errout:
1904         read_unlock_bh(&tbl->lock);
1905         nlmsg_cancel(skb, nlh);
1906         return -EMSGSIZE;
1907 }
1908
1909 static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
1910         [NDTA_NAME]             = { .type = NLA_STRING },
1911         [NDTA_THRESH1]          = { .type = NLA_U32 },
1912         [NDTA_THRESH2]          = { .type = NLA_U32 },
1913         [NDTA_THRESH3]          = { .type = NLA_U32 },
1914         [NDTA_GC_INTERVAL]      = { .type = NLA_U64 },
1915         [NDTA_PARMS]            = { .type = NLA_NESTED },
1916 };
1917
1918 static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
1919         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
1920         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
1921         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
1922         [NDTPA_APP_PROBES]              = { .type = NLA_U32 },
1923         [NDTPA_UCAST_PROBES]            = { .type = NLA_U32 },
1924         [NDTPA_MCAST_PROBES]            = { .type = NLA_U32 },
1925         [NDTPA_MCAST_REPROBES]          = { .type = NLA_U32 },
1926         [NDTPA_BASE_REACHABLE_TIME]     = { .type = NLA_U64 },
1927         [NDTPA_GC_STALETIME]            = { .type = NLA_U64 },
1928         [NDTPA_DELAY_PROBE_TIME]        = { .type = NLA_U64 },
1929         [NDTPA_RETRANS_TIME]            = { .type = NLA_U64 },
1930         [NDTPA_ANYCAST_DELAY]           = { .type = NLA_U64 },
1931         [NDTPA_PROXY_DELAY]             = { .type = NLA_U64 },
1932         [NDTPA_LOCKTIME]                = { .type = NLA_U64 },
1933 };
1934
1935 static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh)
1936 {
1937         struct net *net = sock_net(skb->sk);
1938         struct neigh_table *tbl;
1939         struct ndtmsg *ndtmsg;
1940         struct nlattr *tb[NDTA_MAX+1];
1941         bool found = false;
1942         int err, tidx;
1943
1944         err = nlmsg_parse(nlh, sizeof(*ndtmsg), tb, NDTA_MAX,
1945                           nl_neightbl_policy);
1946         if (err < 0)
1947                 goto errout;
1948
1949         if (tb[NDTA_NAME] == NULL) {
1950                 err = -EINVAL;
1951                 goto errout;
1952         }
1953
1954         ndtmsg = nlmsg_data(nlh);
1955
1956         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
1957                 tbl = neigh_tables[tidx];
1958                 if (!tbl)
1959                         continue;
1960                 if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
1961                         continue;
1962                 if (nla_strcmp(tb[NDTA_NAME], tbl->id) == 0) {
1963                         found = true;
1964                         break;
1965                 }
1966         }
1967
1968         if (!found)
1969                 return -ENOENT;
1970
1971         /*
1972          * We acquire tbl->lock to be nice to the periodic timers and
1973          * make sure they always see a consistent set of values.
1974          */
1975         write_lock_bh(&tbl->lock);
1976
1977         if (tb[NDTA_PARMS]) {
1978                 struct nlattr *tbp[NDTPA_MAX+1];
1979                 struct neigh_parms *p;
1980                 int i, ifindex = 0;
1981
1982                 err = nla_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS],
1983                                        nl_ntbl_parm_policy);
1984                 if (err < 0)
1985                         goto errout_tbl_lock;
1986
1987                 if (tbp[NDTPA_IFINDEX])
1988                         ifindex = nla_get_u32(tbp[NDTPA_IFINDEX]);
1989
1990                 p = lookup_neigh_parms(tbl, net, ifindex);
1991                 if (p == NULL) {
1992                         err = -ENOENT;
1993                         goto errout_tbl_lock;
1994                 }
1995
1996                 for (i = 1; i <= NDTPA_MAX; i++) {
1997                         if (tbp[i] == NULL)
1998                                 continue;
1999
2000                         switch (i) {
2001                         case NDTPA_QUEUE_LEN:
2002                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2003                                               nla_get_u32(tbp[i]) *
2004                                               SKB_TRUESIZE(ETH_FRAME_LEN));
2005                                 break;
2006                         case NDTPA_QUEUE_LENBYTES:
2007                                 NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
2008                                               nla_get_u32(tbp[i]));
2009                                 break;
2010                         case NDTPA_PROXY_QLEN:
2011                                 NEIGH_VAR_SET(p, PROXY_QLEN,
2012                                               nla_get_u32(tbp[i]));
2013                                 break;
2014                         case NDTPA_APP_PROBES:
2015                                 NEIGH_VAR_SET(p, APP_PROBES,
2016                                               nla_get_u32(tbp[i]));
2017                                 break;
2018                         case NDTPA_UCAST_PROBES:
2019                                 NEIGH_VAR_SET(p, UCAST_PROBES,
2020                                               nla_get_u32(tbp[i]));
2021                                 break;
2022                         case NDTPA_MCAST_PROBES:
2023                                 NEIGH_VAR_SET(p, MCAST_PROBES,
2024                                               nla_get_u32(tbp[i]));
2025                                 break;
2026                         case NDTPA_MCAST_REPROBES:
2027                                 NEIGH_VAR_SET(p, MCAST_REPROBES,
2028                                               nla_get_u32(tbp[i]));
2029                                 break;
2030                         case NDTPA_BASE_REACHABLE_TIME:
2031                                 NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
2032                                               nla_get_msecs(tbp[i]));
2033                                 /* update reachable_time as well, otherwise, the change will
2034                                  * only be effective after the next time neigh_periodic_work
2035                                  * decides to recompute it (can be multiple minutes)
2036                                  */
2037                                 p->reachable_time =
2038                                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
2039                                 break;
2040                         case NDTPA_GC_STALETIME:
2041                                 NEIGH_VAR_SET(p, GC_STALETIME,
2042                                               nla_get_msecs(tbp[i]));
2043                                 break;
2044                         case NDTPA_DELAY_PROBE_TIME:
2045                                 NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
2046                                               nla_get_msecs(tbp[i]));
2047                                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2048                                 break;
2049                         case NDTPA_RETRANS_TIME:
2050                                 NEIGH_VAR_SET(p, RETRANS_TIME,
2051                                               nla_get_msecs(tbp[i]));
2052                                 break;
2053                         case NDTPA_ANYCAST_DELAY:
2054                                 NEIGH_VAR_SET(p, ANYCAST_DELAY,
2055                                               nla_get_msecs(tbp[i]));
2056                                 break;
2057                         case NDTPA_PROXY_DELAY:
2058                                 NEIGH_VAR_SET(p, PROXY_DELAY,
2059                                               nla_get_msecs(tbp[i]));
2060                                 break;
2061                         case NDTPA_LOCKTIME:
2062                                 NEIGH_VAR_SET(p, LOCKTIME,
2063                                               nla_get_msecs(tbp[i]));
2064                                 break;
2065                         }
2066                 }
2067         }
2068
2069         err = -ENOENT;
2070         if ((tb[NDTA_THRESH1] || tb[NDTA_THRESH2] ||
2071              tb[NDTA_THRESH3] || tb[NDTA_GC_INTERVAL]) &&
2072             !net_eq(net, &init_net))
2073                 goto errout_tbl_lock;
2074
2075         if (tb[NDTA_THRESH1])
2076                 tbl->gc_thresh1 = nla_get_u32(tb[NDTA_THRESH1]);
2077
2078         if (tb[NDTA_THRESH2])
2079                 tbl->gc_thresh2 = nla_get_u32(tb[NDTA_THRESH2]);
2080
2081         if (tb[NDTA_THRESH3])
2082                 tbl->gc_thresh3 = nla_get_u32(tb[NDTA_THRESH3]);
2083
2084         if (tb[NDTA_GC_INTERVAL])
2085                 tbl->gc_interval = nla_get_msecs(tb[NDTA_GC_INTERVAL]);
2086
2087         err = 0;
2088
2089 errout_tbl_lock:
2090         write_unlock_bh(&tbl->lock);
2091 errout:
2092         return err;
2093 }
2094
2095 static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2096 {
2097         struct net *net = sock_net(skb->sk);
2098         int family, tidx, nidx = 0;
2099         int tbl_skip = cb->args[0];
2100         int neigh_skip = cb->args[1];
2101         struct neigh_table *tbl;
2102
2103         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2104
2105         for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
2106                 struct neigh_parms *p;
2107
2108                 tbl = neigh_tables[tidx];
2109                 if (!tbl)
2110                         continue;
2111
2112                 if (tidx < tbl_skip || (family && tbl->family != family))
2113                         continue;
2114
2115                 if (neightbl_fill_info(skb, tbl, NETLINK_CB(cb->skb).portid,
2116                                        cb->nlh->nlmsg_seq, RTM_NEWNEIGHTBL,
2117                                        NLM_F_MULTI) < 0)
2118                         break;
2119
2120                 nidx = 0;
2121                 p = list_next_entry(&tbl->parms, list);
2122                 list_for_each_entry_from(p, &tbl->parms_list, list) {
2123                         if (!net_eq(neigh_parms_net(p), net))
2124                                 continue;
2125
2126                         if (nidx < neigh_skip)
2127                                 goto next;
2128
2129                         if (neightbl_fill_param_info(skb, tbl, p,
2130                                                      NETLINK_CB(cb->skb).portid,
2131                                                      cb->nlh->nlmsg_seq,
2132                                                      RTM_NEWNEIGHTBL,
2133                                                      NLM_F_MULTI) < 0)
2134                                 goto out;
2135                 next:
2136                         nidx++;
2137                 }
2138
2139                 neigh_skip = 0;
2140         }
2141 out:
2142         cb->args[0] = tidx;
2143         cb->args[1] = nidx;
2144
2145         return skb->len;
2146 }
2147
2148 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
2149                            u32 pid, u32 seq, int type, unsigned int flags)
2150 {
2151         unsigned long now = jiffies;
2152         struct nda_cacheinfo ci;
2153         struct nlmsghdr *nlh;
2154         struct ndmsg *ndm;
2155
2156         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2157         if (nlh == NULL)
2158                 return -EMSGSIZE;
2159
2160         ndm = nlmsg_data(nlh);
2161         ndm->ndm_family  = neigh->ops->family;
2162         ndm->ndm_pad1    = 0;
2163         ndm->ndm_pad2    = 0;
2164         ndm->ndm_flags   = neigh->flags;
2165         ndm->ndm_type    = neigh->type;
2166         ndm->ndm_ifindex = neigh->dev->ifindex;
2167
2168         if (nla_put(skb, NDA_DST, neigh->tbl->key_len, neigh->primary_key))
2169                 goto nla_put_failure;
2170
2171         read_lock_bh(&neigh->lock);
2172         ndm->ndm_state   = neigh->nud_state;
2173         if (neigh->nud_state & NUD_VALID) {
2174                 char haddr[MAX_ADDR_LEN];
2175
2176                 neigh_ha_snapshot(haddr, neigh, neigh->dev);
2177                 if (nla_put(skb, NDA_LLADDR, neigh->dev->addr_len, haddr) < 0) {
2178                         read_unlock_bh(&neigh->lock);
2179                         goto nla_put_failure;
2180                 }
2181         }
2182
2183         ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
2184         ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
2185         ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
2186         ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
2187         read_unlock_bh(&neigh->lock);
2188
2189         if (nla_put_u32(skb, NDA_PROBES, atomic_read(&neigh->probes)) ||
2190             nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
2191                 goto nla_put_failure;
2192
2193         nlmsg_end(skb, nlh);
2194         return 0;
2195
2196 nla_put_failure:
2197         nlmsg_cancel(skb, nlh);
2198         return -EMSGSIZE;
2199 }
2200
2201 static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
2202                             u32 pid, u32 seq, int type, unsigned int flags,
2203                             struct neigh_table *tbl)
2204 {
2205         struct nlmsghdr *nlh;
2206         struct ndmsg *ndm;
2207
2208         nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
2209         if (nlh == NULL)
2210                 return -EMSGSIZE;
2211
2212         ndm = nlmsg_data(nlh);
2213         ndm->ndm_family  = tbl->family;
2214         ndm->ndm_pad1    = 0;
2215         ndm->ndm_pad2    = 0;
2216         ndm->ndm_flags   = pn->flags | NTF_PROXY;
2217         ndm->ndm_type    = RTN_UNICAST;
2218         ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
2219         ndm->ndm_state   = NUD_NONE;
2220
2221         if (nla_put(skb, NDA_DST, tbl->key_len, pn->key))
2222                 goto nla_put_failure;
2223
2224         nlmsg_end(skb, nlh);
2225         return 0;
2226
2227 nla_put_failure:
2228         nlmsg_cancel(skb, nlh);
2229         return -EMSGSIZE;
2230 }
2231
2232 static void neigh_update_notify(struct neighbour *neigh)
2233 {
2234         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
2235         __neigh_notify(neigh, RTM_NEWNEIGH, 0);
2236 }
2237
2238 static bool neigh_master_filtered(struct net_device *dev, int master_idx)
2239 {
2240         struct net_device *master;
2241
2242         if (!master_idx)
2243                 return false;
2244
2245         master = netdev_master_upper_dev_get(dev);
2246         if (!master || master->ifindex != master_idx)
2247                 return true;
2248
2249         return false;
2250 }
2251
2252 static bool neigh_ifindex_filtered(struct net_device *dev, int filter_idx)
2253 {
2254         if (filter_idx && dev->ifindex != filter_idx)
2255                 return true;
2256
2257         return false;
2258 }
2259
2260 static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2261                             struct netlink_callback *cb)
2262 {
2263         struct net *net = sock_net(skb->sk);
2264         const struct nlmsghdr *nlh = cb->nlh;
2265         struct nlattr *tb[NDA_MAX + 1];
2266         struct neighbour *n;
2267         int rc, h, s_h = cb->args[1];
2268         int idx, s_idx = idx = cb->args[2];
2269         struct neigh_hash_table *nht;
2270         int filter_master_idx = 0, filter_idx = 0;
2271         unsigned int flags = NLM_F_MULTI;
2272         int err;
2273
2274         err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL);
2275         if (!err) {
2276                 if (tb[NDA_IFINDEX])
2277                         filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
2278
2279                 if (tb[NDA_MASTER])
2280                         filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
2281
2282                 if (filter_idx || filter_master_idx)
2283                         flags |= NLM_F_DUMP_FILTERED;
2284         }
2285
2286         rcu_read_lock_bh();
2287         nht = rcu_dereference_bh(tbl->nht);
2288
2289         for (h = s_h; h < (1 << nht->hash_shift); h++) {
2290                 if (h > s_h)
2291                         s_idx = 0;
2292                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
2293                      n != NULL;
2294                      n = rcu_dereference_bh(n->next)) {
2295                         if (!net_eq(dev_net(n->dev), net))
2296                                 continue;
2297                         if (neigh_ifindex_filtered(n->dev, filter_idx))
2298                                 continue;
2299                         if (neigh_master_filtered(n->dev, filter_master_idx))
2300                                 continue;
2301                         if (idx < s_idx)
2302                                 goto next;
2303                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2304                                             cb->nlh->nlmsg_seq,
2305                                             RTM_NEWNEIGH,
2306                                             flags) < 0) {
2307                                 rc = -1;
2308                                 goto out;
2309                         }
2310 next:
2311                         idx++;
2312                 }
2313         }
2314         rc = skb->len;
2315 out:
2316         rcu_read_unlock_bh();
2317         cb->args[1] = h;
2318         cb->args[2] = idx;
2319         return rc;
2320 }
2321
2322 static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2323                              struct netlink_callback *cb)
2324 {
2325         struct pneigh_entry *n;
2326         struct net *net = sock_net(skb->sk);
2327         int rc, h, s_h = cb->args[3];
2328         int idx, s_idx = idx = cb->args[4];
2329
2330         read_lock_bh(&tbl->lock);
2331
2332         for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2333                 if (h > s_h)
2334                         s_idx = 0;
2335                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
2336                         if (pneigh_net(n) != net)
2337                                 continue;
2338                         if (idx < s_idx)
2339                                 goto next;
2340                         if (pneigh_fill_info(skb, n, NETLINK_CB(cb->skb).portid,
2341                                             cb->nlh->nlmsg_seq,
2342                                             RTM_NEWNEIGH,
2343                                             NLM_F_MULTI, tbl) < 0) {
2344                                 read_unlock_bh(&tbl->lock);
2345                                 rc = -1;
2346                                 goto out;
2347                         }
2348                 next:
2349                         idx++;
2350                 }
2351         }
2352
2353         read_unlock_bh(&tbl->lock);
2354         rc = skb->len;
2355 out:
2356         cb->args[3] = h;
2357         cb->args[4] = idx;
2358         return rc;
2359
2360 }
2361
2362 static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2363 {
2364         struct neigh_table *tbl;
2365         int t, family, s_t;
2366         int proxy = 0;
2367         int err;
2368
2369         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
2370
2371         /* check for full ndmsg structure presence, family member is
2372          * the same for both structures
2373          */
2374         if (nlmsg_len(cb->nlh) >= sizeof(struct ndmsg) &&
2375             ((struct ndmsg *) nlmsg_data(cb->nlh))->ndm_flags == NTF_PROXY)
2376                 proxy = 1;
2377
2378         s_t = cb->args[0];
2379
2380         for (t = 0; t < NEIGH_NR_TABLES; t++) {
2381                 tbl = neigh_tables[t];
2382
2383                 if (!tbl)
2384                         continue;
2385                 if (t < s_t || (family && tbl->family != family))
2386                         continue;
2387                 if (t > s_t)
2388                         memset(&cb->args[1], 0, sizeof(cb->args) -
2389                                                 sizeof(cb->args[0]));
2390                 if (proxy)
2391                         err = pneigh_dump_table(tbl, skb, cb);
2392                 else
2393                         err = neigh_dump_table(tbl, skb, cb);
2394                 if (err < 0)
2395                         break;
2396         }
2397
2398         cb->args[0] = t;
2399         return skb->len;
2400 }
2401
2402 void neigh_for_each(struct neigh_table *tbl, void (*cb)(struct neighbour *, void *), void *cookie)
2403 {
2404         int chain;
2405         struct neigh_hash_table *nht;
2406
2407         rcu_read_lock_bh();
2408         nht = rcu_dereference_bh(tbl->nht);
2409
2410         read_lock(&tbl->lock); /* avoid resizes */
2411         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2412                 struct neighbour *n;
2413
2414                 for (n = rcu_dereference_bh(nht->hash_buckets[chain]);
2415                      n != NULL;
2416                      n = rcu_dereference_bh(n->next))
2417                         cb(n, cookie);
2418         }
2419         read_unlock(&tbl->lock);
2420         rcu_read_unlock_bh();
2421 }
2422 EXPORT_SYMBOL(neigh_for_each);
2423
2424 /* The tbl->lock must be held as a writer and BH disabled. */
2425 void __neigh_for_each_release(struct neigh_table *tbl,
2426                               int (*cb)(struct neighbour *))
2427 {
2428         int chain;
2429         struct neigh_hash_table *nht;
2430
2431         nht = rcu_dereference_protected(tbl->nht,
2432                                         lockdep_is_held(&tbl->lock));
2433         for (chain = 0; chain < (1 << nht->hash_shift); chain++) {
2434                 struct neighbour *n;
2435                 struct neighbour __rcu **np;
2436
2437                 np = &nht->hash_buckets[chain];
2438                 while ((n = rcu_dereference_protected(*np,
2439                                         lockdep_is_held(&tbl->lock))) != NULL) {
2440                         int release;
2441
2442                         write_lock(&n->lock);
2443                         release = cb(n);
2444                         if (release) {
2445                                 rcu_assign_pointer(*np,
2446                                         rcu_dereference_protected(n->next,
2447                                                 lockdep_is_held(&tbl->lock)));
2448                                 n->dead = 1;
2449                         } else
2450                                 np = &n->next;
2451                         write_unlock(&n->lock);
2452                         if (release)
2453                                 neigh_cleanup_and_release(n);
2454                 }
2455         }
2456 }
2457 EXPORT_SYMBOL(__neigh_for_each_release);
2458
2459 int neigh_xmit(int index, struct net_device *dev,
2460                const void *addr, struct sk_buff *skb)
2461 {
2462         int err = -EAFNOSUPPORT;
2463         if (likely(index < NEIGH_NR_TABLES)) {
2464                 struct neigh_table *tbl;
2465                 struct neighbour *neigh;
2466
2467                 tbl = neigh_tables[index];
2468                 if (!tbl)
2469                         goto out;
2470                 rcu_read_lock_bh();
2471                 neigh = __neigh_lookup_noref(tbl, addr, dev);
2472                 if (!neigh)
2473                         neigh = __neigh_create(tbl, addr, dev, false);
2474                 err = PTR_ERR(neigh);
2475                 if (IS_ERR(neigh)) {
2476                         rcu_read_unlock_bh();
2477                         goto out_kfree_skb;
2478                 }
2479                 err = neigh->output(neigh, skb);
2480                 rcu_read_unlock_bh();
2481         }
2482         else if (index == NEIGH_LINK_TABLE) {
2483                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
2484                                       addr, NULL, skb->len);
2485                 if (err < 0)
2486                         goto out_kfree_skb;
2487                 err = dev_queue_xmit(skb);
2488         }
2489 out:
2490         return err;
2491 out_kfree_skb:
2492         kfree_skb(skb);
2493         goto out;
2494 }
2495 EXPORT_SYMBOL(neigh_xmit);
2496
2497 #ifdef CONFIG_PROC_FS
2498
2499 static struct neighbour *neigh_get_first(struct seq_file *seq)
2500 {
2501         struct neigh_seq_state *state = seq->private;
2502         struct net *net = seq_file_net(seq);
2503         struct neigh_hash_table *nht = state->nht;
2504         struct neighbour *n = NULL;
2505         int bucket = state->bucket;
2506
2507         state->flags &= ~NEIGH_SEQ_IS_PNEIGH;
2508         for (bucket = 0; bucket < (1 << nht->hash_shift); bucket++) {
2509                 n = rcu_dereference_bh(nht->hash_buckets[bucket]);
2510
2511                 while (n) {
2512                         if (!net_eq(dev_net(n->dev), net))
2513                                 goto next;
2514                         if (state->neigh_sub_iter) {
2515                                 loff_t fakep = 0;
2516                                 void *v;
2517
2518                                 v = state->neigh_sub_iter(state, n, &fakep);
2519                                 if (!v)
2520                                         goto next;
2521                         }
2522                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2523                                 break;
2524                         if (n->nud_state & ~NUD_NOARP)
2525                                 break;
2526 next:
2527                         n = rcu_dereference_bh(n->next);
2528                 }
2529
2530                 if (n)
2531                         break;
2532         }
2533         state->bucket = bucket;
2534
2535         return n;
2536 }
2537
2538 static struct neighbour *neigh_get_next(struct seq_file *seq,
2539                                         struct neighbour *n,
2540                                         loff_t *pos)
2541 {
2542         struct neigh_seq_state *state = seq->private;
2543         struct net *net = seq_file_net(seq);
2544         struct neigh_hash_table *nht = state->nht;
2545
2546         if (state->neigh_sub_iter) {
2547                 void *v = state->neigh_sub_iter(state, n, pos);
2548                 if (v)
2549                         return n;
2550         }
2551         n = rcu_dereference_bh(n->next);
2552
2553         while (1) {
2554                 while (n) {
2555                         if (!net_eq(dev_net(n->dev), net))
2556                                 goto next;
2557                         if (state->neigh_sub_iter) {
2558                                 void *v = state->neigh_sub_iter(state, n, pos);
2559                                 if (v)
2560                                         return n;
2561                                 goto next;
2562                         }
2563                         if (!(state->flags & NEIGH_SEQ_SKIP_NOARP))
2564                                 break;
2565
2566                         if (n->nud_state & ~NUD_NOARP)
2567                                 break;
2568 next:
2569                         n = rcu_dereference_bh(n->next);
2570                 }
2571
2572                 if (n)
2573                         break;
2574
2575                 if (++state->bucket >= (1 << nht->hash_shift))
2576                         break;
2577
2578                 n = rcu_dereference_bh(nht->hash_buckets[state->bucket]);
2579         }
2580
2581         if (n && pos)
2582                 --(*pos);
2583         return n;
2584 }
2585
2586 static struct neighbour *neigh_get_idx(struct seq_file *seq, loff_t *pos)
2587 {
2588         struct neighbour *n = neigh_get_first(seq);
2589
2590         if (n) {
2591                 --(*pos);
2592                 while (*pos) {
2593                         n = neigh_get_next(seq, n, pos);
2594                         if (!n)
2595                                 break;
2596                 }
2597         }
2598         return *pos ? NULL : n;
2599 }
2600
2601 static struct pneigh_entry *pneigh_get_first(struct seq_file *seq)
2602 {
2603         struct neigh_seq_state *state = seq->private;
2604         struct net *net = seq_file_net(seq);
2605         struct neigh_table *tbl = state->tbl;
2606         struct pneigh_entry *pn = NULL;
2607         int bucket = state->bucket;
2608
2609         state->flags |= NEIGH_SEQ_IS_PNEIGH;
2610         for (bucket = 0; bucket <= PNEIGH_HASHMASK; bucket++) {
2611                 pn = tbl->phash_buckets[bucket];
2612                 while (pn && !net_eq(pneigh_net(pn), net))
2613                         pn = pn->next;
2614                 if (pn)
2615                         break;
2616         }
2617         state->bucket = bucket;
2618
2619         return pn;
2620 }
2621
2622 static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
2623                                             struct pneigh_entry *pn,
2624                                             loff_t *pos)
2625 {
2626         struct neigh_seq_state *state = seq->private;
2627         struct net *net = seq_file_net(seq);
2628         struct neigh_table *tbl = state->tbl;
2629
2630         do {
2631                 pn = pn->next;
2632         } while (pn && !net_eq(pneigh_net(pn), net));
2633
2634         while (!pn) {
2635                 if (++state->bucket > PNEIGH_HASHMASK)
2636                         break;
2637                 pn = tbl->phash_buckets[state->bucket];
2638                 while (pn && !net_eq(pneigh_net(pn), net))
2639                         pn = pn->next;
2640                 if (pn)
2641                         break;
2642         }
2643
2644         if (pn && pos)
2645                 --(*pos);
2646
2647         return pn;
2648 }
2649
2650 static struct pneigh_entry *pneigh_get_idx(struct seq_file *seq, loff_t *pos)
2651 {
2652         struct pneigh_entry *pn = pneigh_get_first(seq);
2653
2654         if (pn) {
2655                 --(*pos);
2656                 while (*pos) {
2657                         pn = pneigh_get_next(seq, pn, pos);
2658                         if (!pn)
2659                                 break;
2660                 }
2661         }
2662         return *pos ? NULL : pn;
2663 }
2664
2665 static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
2666 {
2667         struct neigh_seq_state *state = seq->private;
2668         void *rc;
2669         loff_t idxpos = *pos;
2670
2671         rc = neigh_get_idx(seq, &idxpos);
2672         if (!rc && !(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2673                 rc = pneigh_get_idx(seq, &idxpos);
2674
2675         return rc;
2676 }
2677
2678 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
2679         __acquires(rcu_bh)
2680 {
2681         struct neigh_seq_state *state = seq->private;
2682
2683         state->tbl = tbl;
2684         state->bucket = 0;
2685         state->flags = (neigh_seq_flags & ~NEIGH_SEQ_IS_PNEIGH);
2686
2687         rcu_read_lock_bh();
2688         state->nht = rcu_dereference_bh(tbl->nht);
2689
2690         return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
2691 }
2692 EXPORT_SYMBOL(neigh_seq_start);
2693
2694 void *neigh_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2695 {
2696         struct neigh_seq_state *state;
2697         void *rc;
2698
2699         if (v == SEQ_START_TOKEN) {
2700                 rc = neigh_get_first(seq);
2701                 goto out;
2702         }
2703
2704         state = seq->private;
2705         if (!(state->flags & NEIGH_SEQ_IS_PNEIGH)) {
2706                 rc = neigh_get_next(seq, v, NULL);
2707                 if (rc)
2708                         goto out;
2709                 if (!(state->flags & NEIGH_SEQ_NEIGH_ONLY))
2710                         rc = pneigh_get_first(seq);
2711         } else {
2712                 BUG_ON(state->flags & NEIGH_SEQ_NEIGH_ONLY);
2713                 rc = pneigh_get_next(seq, v, NULL);
2714         }
2715 out:
2716         ++(*pos);
2717         return rc;
2718 }
2719 EXPORT_SYMBOL(neigh_seq_next);
2720
2721 void neigh_seq_stop(struct seq_file *seq, void *v)
2722         __releases(rcu_bh)
2723 {
2724         rcu_read_unlock_bh();
2725 }
2726 EXPORT_SYMBOL(neigh_seq_stop);
2727
2728 /* statistics via seq_file */
2729
2730 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
2731 {
2732         struct neigh_table *tbl = seq->private;
2733         int cpu;
2734
2735         if (*pos == 0)
2736                 return SEQ_START_TOKEN;
2737
2738         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
2739                 if (!cpu_possible(cpu))
2740                         continue;
2741                 *pos = cpu+1;
2742                 return per_cpu_ptr(tbl->stats, cpu);
2743         }
2744         return NULL;
2745 }
2746
2747 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2748 {
2749         struct neigh_table *tbl = seq->private;
2750         int cpu;
2751
2752         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
2753                 if (!cpu_possible(cpu))
2754                         continue;
2755                 *pos = cpu+1;
2756                 return per_cpu_ptr(tbl->stats, cpu);
2757         }
2758         return NULL;
2759 }
2760
2761 static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
2762 {
2763
2764 }
2765
2766 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
2767 {
2768         struct neigh_table *tbl = seq->private;
2769         struct neigh_statistics *st = v;
2770
2771         if (v == SEQ_START_TOKEN) {
2772                 seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs unresolved_discards table_fulls\n");
2773                 return 0;
2774         }
2775
2776         seq_printf(seq, "%08x  %08lx %08lx %08lx  %08lx %08lx  %08lx  "
2777                         "%08lx %08lx  %08lx %08lx %08lx %08lx\n",
2778                    atomic_read(&tbl->entries),
2779
2780                    st->allocs,
2781                    st->destroys,
2782                    st->hash_grows,
2783
2784                    st->lookups,
2785                    st->hits,
2786
2787                    st->res_failed,
2788
2789                    st->rcv_probes_mcast,
2790                    st->rcv_probes_ucast,
2791
2792                    st->periodic_gc_runs,
2793                    st->forced_gc_runs,
2794                    st->unres_discards,
2795                    st->table_fulls
2796                    );
2797
2798         return 0;
2799 }
2800
2801 static const struct seq_operations neigh_stat_seq_ops = {
2802         .start  = neigh_stat_seq_start,
2803         .next   = neigh_stat_seq_next,
2804         .stop   = neigh_stat_seq_stop,
2805         .show   = neigh_stat_seq_show,
2806 };
2807
2808 static int neigh_stat_seq_open(struct inode *inode, struct file *file)
2809 {
2810         int ret = seq_open(file, &neigh_stat_seq_ops);
2811
2812         if (!ret) {
2813                 struct seq_file *sf = file->private_data;
2814                 sf->private = PDE_DATA(inode);
2815         }
2816         return ret;
2817 };
2818
2819 static const struct file_operations neigh_stat_seq_fops = {
2820         .owner   = THIS_MODULE,
2821         .open    = neigh_stat_seq_open,
2822         .read    = seq_read,
2823         .llseek  = seq_lseek,
2824         .release = seq_release,
2825 };
2826
2827 #endif /* CONFIG_PROC_FS */
2828
2829 static inline size_t neigh_nlmsg_size(void)
2830 {
2831         return NLMSG_ALIGN(sizeof(struct ndmsg))
2832                + nla_total_size(MAX_ADDR_LEN) /* NDA_DST */
2833                + nla_total_size(MAX_ADDR_LEN) /* NDA_LLADDR */
2834                + nla_total_size(sizeof(struct nda_cacheinfo))
2835                + nla_total_size(4); /* NDA_PROBES */
2836 }
2837
2838 static void __neigh_notify(struct neighbour *n, int type, int flags)
2839 {
2840         struct net *net = dev_net(n->dev);
2841         struct sk_buff *skb;
2842         int err = -ENOBUFS;
2843
2844         skb = nlmsg_new(neigh_nlmsg_size(), GFP_ATOMIC);
2845         if (skb == NULL)
2846                 goto errout;
2847
2848         err = neigh_fill_info(skb, n, 0, 0, type, flags);
2849         if (err < 0) {
2850                 /* -EMSGSIZE implies BUG in neigh_nlmsg_size() */
2851                 WARN_ON(err == -EMSGSIZE);
2852                 kfree_skb(skb);
2853                 goto errout;
2854         }
2855         rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
2856         return;
2857 errout:
2858         if (err < 0)
2859                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
2860 }
2861
2862 void neigh_app_ns(struct neighbour *n)
2863 {
2864         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
2865 }
2866 EXPORT_SYMBOL(neigh_app_ns);
2867
2868 #ifdef CONFIG_SYSCTL
2869 static int zero;
2870 static int int_max = INT_MAX;
2871 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
2872
2873 static int proc_unres_qlen(struct ctl_table *ctl, int write,
2874                            void __user *buffer, size_t *lenp, loff_t *ppos)
2875 {
2876         int size, ret;
2877         struct ctl_table tmp = *ctl;
2878
2879         tmp.extra1 = &zero;
2880         tmp.extra2 = &unres_qlen_max;
2881         tmp.data = &size;
2882
2883         size = *(int *)ctl->data / SKB_TRUESIZE(ETH_FRAME_LEN);
2884         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2885
2886         if (write && !ret)
2887                 *(int *)ctl->data = size * SKB_TRUESIZE(ETH_FRAME_LEN);
2888         return ret;
2889 }
2890
2891 static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
2892                                                    int family)
2893 {
2894         switch (family) {
2895         case AF_INET:
2896                 return __in_dev_arp_parms_get_rcu(dev);
2897         case AF_INET6:
2898                 return __in6_dev_nd_parms_get_rcu(dev);
2899         }
2900         return NULL;
2901 }
2902
2903 static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
2904                                   int index)
2905 {
2906         struct net_device *dev;
2907         int family = neigh_parms_family(p);
2908
2909         rcu_read_lock();
2910         for_each_netdev_rcu(net, dev) {
2911                 struct neigh_parms *dst_p =
2912                                 neigh_get_dev_parms_rcu(dev, family);
2913
2914                 if (dst_p && !test_bit(index, dst_p->data_state))
2915                         dst_p->data[index] = p->data[index];
2916         }
2917         rcu_read_unlock();
2918 }
2919
2920 static void neigh_proc_update(struct ctl_table *ctl, int write)
2921 {
2922         struct net_device *dev = ctl->extra1;
2923         struct neigh_parms *p = ctl->extra2;
2924         struct net *net = neigh_parms_net(p);
2925         int index = (int *) ctl->data - p->data;
2926
2927         if (!write)
2928                 return;
2929
2930         set_bit(index, p->data_state);
2931         if (index == NEIGH_VAR_DELAY_PROBE_TIME)
2932                 call_netevent_notifiers(NETEVENT_DELAY_PROBE_TIME_UPDATE, p);
2933         if (!dev) /* NULL dev means this is default value */
2934                 neigh_copy_dflt_parms(net, p, index);
2935 }
2936
2937 static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
2938                                            void __user *buffer,
2939                                            size_t *lenp, loff_t *ppos)
2940 {
2941         struct ctl_table tmp = *ctl;
2942         int ret;
2943
2944         tmp.extra1 = &zero;
2945         tmp.extra2 = &int_max;
2946
2947         ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
2948         neigh_proc_update(ctl, write);
2949         return ret;
2950 }
2951
2952 int neigh_proc_dointvec(struct ctl_table *ctl, int write,
2953                         void __user *buffer, size_t *lenp, loff_t *ppos)
2954 {
2955         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
2956
2957         neigh_proc_update(ctl, write);
2958         return ret;
2959 }
2960 EXPORT_SYMBOL(neigh_proc_dointvec);
2961
2962 int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
2963                                 void __user *buffer,
2964                                 size_t *lenp, loff_t *ppos)
2965 {
2966         int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
2967
2968         neigh_proc_update(ctl, write);
2969         return ret;
2970 }
2971 EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
2972
2973 static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
2974                                               void __user *buffer,
2975                                               size_t *lenp, loff_t *ppos)
2976 {
2977         int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
2978
2979         neigh_proc_update(ctl, write);
2980         return ret;
2981 }
2982
2983 int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
2984                                    void __user *buffer,
2985                                    size_t *lenp, loff_t *ppos)
2986 {
2987         int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
2988
2989         neigh_proc_update(ctl, write);
2990         return ret;
2991 }
2992 EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
2993
2994 static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
2995                                           void __user *buffer,
2996                                           size_t *lenp, loff_t *ppos)
2997 {
2998         int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
2999
3000         neigh_proc_update(ctl, write);
3001         return ret;
3002 }
3003
3004 static int neigh_proc_base_reachable_time(struct ctl_table *ctl, int write,
3005                                           void __user *buffer,
3006                                           size_t *lenp, loff_t *ppos)
3007 {
3008         struct neigh_parms *p = ctl->extra2;
3009         int ret;
3010
3011         if (strcmp(ctl->procname, "base_reachable_time") == 0)
3012                 ret = neigh_proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
3013         else if (strcmp(ctl->procname, "base_reachable_time_ms") == 0)
3014                 ret = neigh_proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
3015         else
3016                 ret = -1;
3017
3018         if (write && ret == 0) {
3019                 /* update reachable_time as well, otherwise, the change will
3020                  * only be effective after the next time neigh_periodic_work
3021                  * decides to recompute it
3022                  */
3023                 p->reachable_time =
3024                         neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
3025         }
3026         return ret;
3027 }
3028
3029 #define NEIGH_PARMS_DATA_OFFSET(index)  \
3030         (&((struct neigh_parms *) 0)->data[index])
3031
3032 #define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
3033         [NEIGH_VAR_ ## attr] = { \
3034                 .procname       = name, \
3035                 .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
3036                 .maxlen         = sizeof(int), \
3037                 .mode           = mval, \
3038                 .proc_handler   = proc, \
3039         }
3040
3041 #define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
3042         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
3043
3044 #define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
3045         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
3046
3047 #define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
3048         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
3049
3050 #define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
3051         NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3052
3053 #define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
3054         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
3055
3056 #define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
3057         NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
3058
3059 static struct neigh_sysctl_table {
3060         struct ctl_table_header *sysctl_header;
3061         struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
3062 } neigh_sysctl_template __read_mostly = {
3063         .neigh_vars = {
3064                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
3065                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
3066                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
3067                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_REPROBES, "mcast_resolicit"),
3068                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
3069                 NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
3070                 NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
3071                 NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
3072                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
3073                 NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
3074                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
3075                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
3076                 NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
3077                 NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
3078                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
3079                 NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
3080                 [NEIGH_VAR_GC_INTERVAL] = {
3081                         .procname       = "gc_interval",
3082                         .maxlen         = sizeof(int),
3083                         .mode           = 0644,
3084                         .proc_handler   = proc_dointvec_jiffies,
3085                 },
3086                 [NEIGH_VAR_GC_THRESH1] = {
3087                         .procname       = "gc_thresh1",
3088                         .maxlen         = sizeof(int),
3089                         .mode           = 0644,
3090                         .extra1         = &zero,
3091                         .extra2         = &int_max,
3092                         .proc_handler   = proc_dointvec_minmax,
3093                 },
3094                 [NEIGH_VAR_GC_THRESH2] = {
3095                         .procname       = "gc_thresh2",
3096                         .maxlen         = sizeof(int),
3097                         .mode           = 0644,
3098                         .extra1         = &zero,
3099                         .extra2         = &int_max,
3100                         .proc_handler   = proc_dointvec_minmax,
3101                 },
3102                 [NEIGH_VAR_GC_THRESH3] = {
3103                         .procname       = "gc_thresh3",
3104                         .maxlen         = sizeof(int),
3105                         .mode           = 0644,
3106                         .extra1         = &zero,
3107                         .extra2         = &int_max,
3108                         .proc_handler   = proc_dointvec_minmax,
3109                 },
3110                 {},
3111         },
3112 };
3113
3114 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
3115                           proc_handler *handler)
3116 {
3117         int i;
3118         struct neigh_sysctl_table *t;
3119         const char *dev_name_source;
3120         char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
3121         char *p_name;
3122
3123         t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
3124         if (!t)
3125                 goto err;
3126
3127         for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
3128                 t->neigh_vars[i].data += (long) p;
3129                 t->neigh_vars[i].extra1 = dev;
3130                 t->neigh_vars[i].extra2 = p;
3131         }
3132
3133         if (dev) {
3134                 dev_name_source = dev->name;
3135                 /* Terminate the table early */
3136                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
3137                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
3138         } else {
3139                 struct neigh_table *tbl = p->tbl;
3140                 dev_name_source = "default";
3141                 t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
3142                 t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
3143                 t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
3144                 t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
3145         }
3146
3147         if (handler) {
3148                 /* RetransTime */
3149                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
3150                 /* ReachableTime */
3151                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
3152                 /* RetransTime (in milliseconds)*/
3153                 t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
3154                 /* ReachableTime (in milliseconds) */
3155                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
3156         } else {
3157                 /* Those handlers will update p->reachable_time after
3158                  * base_reachable_time(_ms) is set to ensure the new timer starts being
3159                  * applied after the next neighbour update instead of waiting for
3160                  * neigh_periodic_work to update its value (can be multiple minutes)
3161                  * So any handler that replaces them should do this as well
3162                  */
3163                 /* ReachableTime */
3164                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler =
3165                         neigh_proc_base_reachable_time;
3166                 /* ReachableTime (in milliseconds) */
3167                 t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler =
3168                         neigh_proc_base_reachable_time;
3169         }
3170
3171         /* Don't export sysctls to unprivileged users */
3172         if (neigh_parms_net(p)->user_ns != &init_user_ns)
3173                 t->neigh_vars[0].procname = NULL;
3174
3175         switch (neigh_parms_family(p)) {
3176         case AF_INET:
3177               p_name = "ipv4";
3178               break;
3179         case AF_INET6:
3180               p_name = "ipv6";
3181               break;
3182         default:
3183               BUG();
3184         }
3185
3186         snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
3187                 p_name, dev_name_source);
3188         t->sysctl_header =
3189                 register_net_sysctl(neigh_parms_net(p), neigh_path, t->neigh_vars);
3190         if (!t->sysctl_header)
3191                 goto free;
3192
3193         p->sysctl_table = t;
3194         return 0;
3195
3196 free:
3197         kfree(t);
3198 err:
3199         return -ENOBUFS;
3200 }
3201 EXPORT_SYMBOL(neigh_sysctl_register);
3202
3203 void neigh_sysctl_unregister(struct neigh_parms *p)
3204 {
3205         if (p->sysctl_table) {
3206                 struct neigh_sysctl_table *t = p->sysctl_table;
3207                 p->sysctl_table = NULL;
3208                 unregister_net_sysctl_table(t->sysctl_header);
3209                 kfree(t);
3210         }
3211 }
3212 EXPORT_SYMBOL(neigh_sysctl_unregister);
3213
3214 #endif  /* CONFIG_SYSCTL */
3215
3216 static int __init neigh_init(void)
3217 {
3218         rtnl_register(PF_UNSPEC, RTM_NEWNEIGH, neigh_add, NULL, NULL);
3219         rtnl_register(PF_UNSPEC, RTM_DELNEIGH, neigh_delete, NULL, NULL);
3220         rtnl_register(PF_UNSPEC, RTM_GETNEIGH, NULL, neigh_dump_info, NULL);
3221
3222         rtnl_register(PF_UNSPEC, RTM_GETNEIGHTBL, NULL, neightbl_dump_info,
3223                       NULL);
3224         rtnl_register(PF_UNSPEC, RTM_SETNEIGHTBL, neightbl_set, NULL, NULL);
3225
3226         return 0;
3227 }
3228
3229 subsys_initcall(neigh_init);
3230