2 * Copyright (C) 2012-2013 Steven Barth <steven@midlink.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License v2 as published by
6 * the Free Software Foundation.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
22 #include <arpa/inet.h>
23 #include <sys/socket.h>
24 #include <net/ethernet.h>
25 #include <netinet/ip6.h>
26 #include <netinet/icmp6.h>
27 #include <netpacket/packet.h>
29 #include <linux/filter.h>
30 #include <linux/neighbour.h>
36 static void ndp_netevent_cb(unsigned long event
, struct netevent_handler_info
*info
);
37 static void setup_route(struct in6_addr
*addr
, struct interface
*iface
, bool add
);
38 static void setup_addr_for_relaying(struct in6_addr
*addr
, struct interface
*iface
, bool add
);
39 static void handle_solicit(void *addr
, void *data
, size_t len
,
40 struct interface
*iface
, void *dest
);
42 static int ping_socket
= -1;
44 /* Filter ICMPv6 messages of type neighbor soliciation */
45 static struct sock_filter bpf
[] = {
46 BPF_STMT(BPF_LD
| BPF_B
| BPF_ABS
, offsetof(struct ip6_hdr
, ip6_nxt
)),
47 BPF_JUMP(BPF_JMP
| BPF_JEQ
| BPF_K
, IPPROTO_ICMPV6
, 0, 3),
48 BPF_STMT(BPF_LD
| BPF_B
| BPF_ABS
, sizeof(struct ip6_hdr
) +
49 offsetof(struct icmp6_hdr
, icmp6_type
)),
50 BPF_JUMP(BPF_JMP
| BPF_JEQ
| BPF_K
, ND_NEIGHBOR_SOLICIT
, 0, 1),
51 BPF_STMT(BPF_RET
| BPF_K
, 0xffffffff),
52 BPF_STMT(BPF_RET
| BPF_K
, 0),
54 static const struct sock_fprog bpf_prog
= {sizeof(bpf
) / sizeof(*bpf
), bpf
};
55 static struct netevent_handler ndp_netevent_handler
= { .cb
= ndp_netevent_cb
, };
57 /* Initialize NDP-proxy */
60 struct icmp6_filter filt
;
63 /* Open ICMPv6 socket */
64 ping_socket
= socket(AF_INET6
, SOCK_RAW
| SOCK_CLOEXEC
, IPPROTO_ICMPV6
);
65 if (ping_socket
< 0) {
66 syslog(LOG_ERR
, "socket(AF_INET6): %m");
71 if (setsockopt(ping_socket
, IPPROTO_RAW
, IPV6_CHECKSUM
,
72 &val
, sizeof(val
)) < 0) {
73 syslog(LOG_ERR
, "setsockopt(IPV6_CHECKSUM): %m");
78 /* This is required by RFC 4861 */
80 if (setsockopt(ping_socket
, IPPROTO_IPV6
, IPV6_MULTICAST_HOPS
,
81 &val
, sizeof(val
)) < 0) {
82 syslog(LOG_ERR
, "setsockopt(IPV6_MULTICAST_HOPS): %m");
87 if (setsockopt(ping_socket
, IPPROTO_IPV6
, IPV6_UNICAST_HOPS
,
88 &val
, sizeof(val
)) < 0) {
89 syslog(LOG_ERR
, "setsockopt(IPV6_UNICAST_HOPS): %m");
94 /* Filter all packages, we only want to send */
95 ICMP6_FILTER_SETBLOCKALL(&filt
);
96 if (setsockopt(ping_socket
, IPPROTO_ICMPV6
, ICMP6_FILTER
,
97 &filt
, sizeof(filt
)) < 0) {
98 syslog(LOG_ERR
, "setsockopt(ICMP6_FILTER): %m");
103 netlink_add_netevent_handler(&ndp_netevent_handler
);
106 if (ret
< 0 && ping_socket
> 0) {
114 int ndp_setup_interface(struct interface
*iface
, bool enable
)
117 bool dump_neigh
= false;
120 snprintf(procbuf
, sizeof(procbuf
), "/proc/sys/net/ipv6/conf/%s/proxy_ndp", iface
->ifname
);
121 procfd
= open(procbuf
, O_WRONLY
);
128 if (iface
->ndp_event
.uloop
.fd
> 0) {
129 uloop_fd_delete(&iface
->ndp_event
.uloop
);
130 close(iface
->ndp_event
.uloop
.fd
);
131 iface
->ndp_event
.uloop
.fd
= -1;
133 if (!enable
|| iface
->ndp
!= MODE_RELAY
)
134 if (write(procfd
, "0\n", 2) < 0) {}
139 if (enable
&& iface
->ndp
== MODE_RELAY
) {
140 struct sockaddr_ll ll
;
141 struct packet_mreq mreq
;
143 if (write(procfd
, "1\n", 2) < 0) {}
145 iface
->ndp_event
.uloop
.fd
= socket(AF_PACKET
, SOCK_DGRAM
| SOCK_CLOEXEC
, htons(ETH_P_IPV6
));
146 if (iface
->ndp_event
.uloop
.fd
< 0) {
147 syslog(LOG_ERR
, "socket(AF_PACKET): %m");
152 #ifdef PACKET_RECV_TYPE
153 int pktt
= 1 << PACKET_MULTICAST
;
154 if (setsockopt(iface
->ndp_event
.uloop
.fd
, SOL_PACKET
, PACKET_RECV_TYPE
,
155 &pktt
, sizeof(pktt
)) < 0) {
156 syslog(LOG_ERR
, "setsockopt(PACKET_RECV_TYPE): %m");
162 if (setsockopt(iface
->ndp_event
.uloop
.fd
, SOL_SOCKET
, SO_ATTACH_FILTER
,
163 &bpf_prog
, sizeof(bpf_prog
))) {
164 syslog(LOG_ERR
, "setsockopt(SO_ATTACH_FILTER): %m");
169 memset(&ll
, 0, sizeof(ll
));
170 ll
.sll_family
= AF_PACKET
;
171 ll
.sll_ifindex
= iface
->ifindex
;
172 ll
.sll_protocol
= htons(ETH_P_IPV6
);
174 if (bind(iface
->ndp_event
.uloop
.fd
, (struct sockaddr
*)&ll
, sizeof(ll
)) < 0) {
175 syslog(LOG_ERR
, "bind(): %m");
180 memset(&mreq
, 0, sizeof(mreq
));
181 mreq
.mr_ifindex
= iface
->ifindex
;
182 mreq
.mr_type
= PACKET_MR_ALLMULTI
;
183 mreq
.mr_alen
= ETH_ALEN
;
185 if (setsockopt(iface
->ndp_event
.uloop
.fd
, SOL_PACKET
, PACKET_ADD_MEMBERSHIP
,
186 &mreq
, sizeof(mreq
)) < 0) {
187 syslog(LOG_ERR
, "setsockopt(PACKET_ADD_MEMBERSHIP): %m");
192 iface
->ndp_event
.handle_dgram
= handle_solicit
;
193 odhcpd_register(&iface
->ndp_event
);
195 /* If we already were enabled dump is unnecessary, if not do dump */
197 netlink_dump_neigh_table(false);
203 netlink_dump_neigh_table(true);
206 if (ret
< 0 && iface
->ndp_event
.uloop
.fd
> 0) {
207 close(iface
->ndp_event
.uloop
.fd
);
208 iface
->ndp_event
.uloop
.fd
= -1;
217 static void ndp_netevent_cb(unsigned long event
, struct netevent_handler_info
*info
)
219 struct interface
*iface
= info
->iface
;
222 if (!iface
|| iface
->ndp
== MODE_DISABLED
)
226 case NETEV_ADDR6_DEL
:
228 netlink_dump_neigh_table(false);
230 case NETEV_ADDR6_ADD
:
231 setup_addr_for_relaying(&info
->addr
.in6
, iface
, add
);
233 case NETEV_NEIGH6_DEL
:
236 case NETEV_NEIGH6_ADD
:
237 if (info
->neigh
.flags
& NTF_PROXY
) {
239 netlink_setup_proxy_neigh(&info
->neigh
.dst
.in6
, iface
->ifindex
, false);
240 setup_route(&info
->neigh
.dst
.in6
, iface
, false);
241 netlink_dump_neigh_table(false);
247 !(info
->neigh
.state
&
248 (NUD_REACHABLE
|NUD_STALE
|NUD_DELAY
|NUD_PROBE
|NUD_PERMANENT
|NUD_NOARP
)))
251 setup_addr_for_relaying(&info
->neigh
.dst
.in6
, iface
, add
);
252 setup_route(&info
->neigh
.dst
.in6
, iface
, add
);
255 netlink_dump_neigh_table(false);
262 /* Send an ICMP-ECHO. This is less for actually pinging but for the
263 * neighbor cache to be kept up-to-date. */
264 static void ping6(struct in6_addr
*addr
,
265 const struct interface
*iface
)
267 struct sockaddr_in6 dest
= { .sin6_family
= AF_INET6
, .sin6_addr
= *addr
, .sin6_scope_id
= iface
->ifindex
, };
268 struct icmp6_hdr echo
= { .icmp6_type
= ICMP6_ECHO_REQUEST
};
269 struct iovec iov
= { .iov_base
= &echo
, .iov_len
= sizeof(echo
) };
270 char ipbuf
[INET6_ADDRSTRLEN
];
272 inet_ntop(AF_INET6
, addr
, ipbuf
, sizeof(ipbuf
));
273 syslog(LOG_NOTICE
, "Pinging for %s%%%s", ipbuf
, iface
->ifname
);
275 netlink_setup_route(addr
, 128, iface
->ifindex
, NULL
, 128, true);
276 odhcpd_send(ping_socket
, &dest
, &iov
, 1, iface
);
277 netlink_setup_route(addr
, 128, iface
->ifindex
, NULL
, 128, false);
280 /* Handle solicitations */
281 static void handle_solicit(void *addr
, void *data
, size_t len
,
282 struct interface
*iface
, _unused
void *dest
)
284 struct ip6_hdr
*ip6
= data
;
285 struct nd_neighbor_solicit
*req
= (struct nd_neighbor_solicit
*)&ip6
[1];
286 struct sockaddr_ll
*ll
= addr
;
287 char ipbuf
[INET6_ADDRSTRLEN
];
290 /* Solicitation is for duplicate address detection */
291 bool ns_is_dad
= IN6_IS_ADDR_UNSPECIFIED(&ip6
->ip6_src
);
293 /* Don't process solicit messages on non relay interfaces
294 * Don't forward any non-DAD solicitation for external ifaces
295 * TODO: check if we should even forward DADs for them */
296 if (iface
->ndp
!= MODE_RELAY
|| (iface
->external
&& !ns_is_dad
))
299 if (len
< sizeof(*ip6
) + sizeof(*req
))
300 return; // Invalid reqicitation
302 if (IN6_IS_ADDR_LINKLOCAL(&req
->nd_ns_target
) ||
303 IN6_IS_ADDR_LOOPBACK(&req
->nd_ns_target
) ||
304 IN6_IS_ADDR_MULTICAST(&req
->nd_ns_target
))
305 return; /* Invalid target */
307 inet_ntop(AF_INET6
, &req
->nd_ns_target
, ipbuf
, sizeof(ipbuf
));
308 syslog(LOG_DEBUG
, "Got a NS for %s%%%s", ipbuf
, iface
->ifname
);
310 odhcpd_get_mac(iface
, mac
);
311 if (!memcmp(ll
->sll_addr
, mac
, sizeof(mac
)))
312 return; /* Looped back */
315 list_for_each_entry(c
, &interfaces
, head
)
316 if (iface
!= c
&& c
->ndp
== MODE_RELAY
&&
317 (ns_is_dad
|| !c
->external
))
318 ping6(&req
->nd_ns_target
, c
);
321 /* Use rtnetlink to modify kernel routes */
322 static void setup_route(struct in6_addr
*addr
, struct interface
*iface
, bool add
)
324 char ipbuf
[INET6_ADDRSTRLEN
];
326 inet_ntop(AF_INET6
, addr
, ipbuf
, sizeof(ipbuf
));
327 syslog(LOG_NOTICE
, "%s about %s%s%%%s",
328 (add
) ? "Learning" : "Forgetting",
329 iface
->learn_routes
? "proxy routing for " : "",
330 ipbuf
, iface
->ifname
);
332 if (iface
->learn_routes
)
333 netlink_setup_route(addr
, 128, iface
->ifindex
, NULL
, 1024, add
);
336 static void setup_addr_for_relaying(struct in6_addr
*addr
, struct interface
*iface
, bool add
)
339 char ipbuf
[INET6_ADDRSTRLEN
];
341 inet_ntop(AF_INET6
, addr
, ipbuf
, sizeof(ipbuf
));
343 list_for_each_entry(c
, &interfaces
, head
) {
344 if (iface
== c
|| (c
->ndp
!= MODE_RELAY
&& !add
))
347 bool neigh_add
= (c
->ndp
== MODE_RELAY
? add
: false);
349 if (netlink_setup_proxy_neigh(addr
, c
->ifindex
, neigh_add
))
350 syslog(LOG_DEBUG
, "Failed to %s proxy neighbour entry %s%%%s",
351 neigh_add
? "add" : "delete", ipbuf
, c
->ifname
);
353 syslog(LOG_DEBUG
, "%s proxy neighbour entry %s%%%s",
354 neigh_add
? "Added" : "Deleted", ipbuf
, c
->ifname
);