1 files changed, 41 insertions, 12 deletions

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index b50055b9278d..0304b5fe8d6a 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -62,6 +62,7 @@
 #include <linux/sysctl.h>
 #endif
 
+#include <linux/if_addr.h>
 #include <linux/if_arp.h>
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
@@ -411,7 +412,8 @@ static void pndisc_destructor(struct pneigh_entry *n)
  */
 
 static inline void ndisc_flow_init(struct flowi *fl, u8 type,
-                            struct in6_addr *saddr, struct in6_addr *daddr)
+                            struct in6_addr *saddr, struct in6_addr *daddr,
+                            int oif)
 {
         memset(fl, 0, sizeof(*fl));
         ipv6_addr_copy(&fl->fl6_src, saddr);
@@ -419,6 +421,8 @@ static inline void ndisc_flow_init(struct flowi *fl, u8 type,
         fl->proto               = IPPROTO_ICMPV6;
         fl->fl_icmp_type        = type;
         fl->fl_icmp_code        = 0;
+        fl->oif                 = oif;
+        security_sk_classify_flow(ndisc_socket->sk, fl);
 }
 
 static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
@@ -450,7 +454,8 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                 src_addr = &tmpaddr;
         }
 
-        ndisc_flow_init(&fl, NDISC_NEIGHBOUR_ADVERTISEMENT, src_addr, daddr);
+        ndisc_flow_init(&fl, NDISC_NEIGHBOUR_ADVERTISEMENT, src_addr, daddr,
+                        dev->ifindex);
 
         dst = ndisc_dst_alloc(dev, neigh, daddr, ip6_output);
         if (!dst)
@@ -491,7 +496,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
         msg->icmph.icmp6_unused = 0;
         msg->icmph.icmp6_router    = router;
         msg->icmph.icmp6_solicited = solicited;
-        msg->icmph.icmp6_override  = !!override;
+        msg->icmph.icmp6_override  = override;
 
         /* Set the target address. */
         ipv6_addr_copy(&msg->target, solicited_addr);
@@ -540,7 +545,8 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
                 saddr = &addr_buf;
         }
 
-        ndisc_flow_init(&fl, NDISC_NEIGHBOUR_SOLICITATION, saddr, daddr);
+        ndisc_flow_init(&fl, NDISC_NEIGHBOUR_SOLICITATION, saddr, daddr,
+                        dev->ifindex);
 
         dst = ndisc_dst_alloc(dev, neigh, daddr, ip6_output);
         if (!dst)
@@ -615,7 +621,8 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
         int len;
         int err;
 
-        ndisc_flow_init(&fl, NDISC_ROUTER_SOLICITATION, saddr, daddr);
+        ndisc_flow_init(&fl, NDISC_ROUTER_SOLICITATION, saddr, daddr,
+                        dev->ifindex);
 
         dst = ndisc_dst_alloc(dev, NULL, daddr, ip6_output);
         if (!dst)
@@ -729,8 +736,10 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         struct inet6_ifaddr *ifp;
         struct inet6_dev *idev = NULL;
         struct neighbour *neigh;
+        struct pneigh_entry *pneigh = NULL;
         int dad = ipv6_addr_any(saddr);
         int inc;
+        int is_router;
 
         if (ipv6_addr_is_multicast(&msg->target)) {
                 ND_PRINTK2(KERN_WARNING 
@@ -815,7 +824,9 @@ static void ndisc_recv_ns(struct sk_buff *skb)
 
                 if (ipv6_chk_acast_addr(dev, &msg->target) ||
                     (idev->cnf.forwarding && 
-                     pneigh_lookup(&nd_tbl, &msg->target, dev, 0))) {
+                     (ipv6_devconf.proxy_ndp || idev->cnf.proxy_ndp) &&
+                     (pneigh = pneigh_lookup(&nd_tbl,
+                                             &msg->target, dev, 0)) != NULL)) {
                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
                             skb->pkt_type != PACKET_HOST &&
                             inc != 0 &&
@@ -836,12 +847,14 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                         goto out;
         }
 
+        is_router = !!(pneigh ? pneigh->flags & NTF_ROUTER : idev->cnf.forwarding);
+
         if (dad) {
                 struct in6_addr maddr;
 
                 ipv6_addr_all_nodes(&maddr);
                 ndisc_send_na(dev, NULL, &maddr, &msg->target,
-                              idev->cnf.forwarding, 0, (ifp != NULL), 1);
+                              is_router, 0, (ifp != NULL), 1);
                 goto out;
         }
 
@@ -862,7 +875,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                              NEIGH_UPDATE_F_OVERRIDE);
         if (neigh || !dev->hard_header) {
                 ndisc_send_na(dev, neigh, saddr, &msg->target,
-                              idev->cnf.forwarding, 
+                              is_router,
                               1, (ifp != NULL && inc), inc);
                 if (neigh)
                         neigh_release(neigh);
@@ -945,6 +958,20 @@ static void ndisc_recv_na(struct sk_buff *skb)
                 if (neigh->nud_state & NUD_FAILED)
                         goto out;
 
+                /*
+                 * Don't update the neighbor cache entry on a proxy NA from
+                 * ourselves because either the proxied node is off link or it
+                 * has already sent a NA to us.
+                 */
+                if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
+                    ipv6_devconf.forwarding && ipv6_devconf.proxy_ndp &&
+                    pneigh_lookup(&nd_tbl, &msg->target, dev, 0)) {
+                        /* XXX: idev->cnf.prixy_ndp */
+                        WARN_ON(skb->dst != NULL &&
+                                ((struct rt6_info *)skb->dst)->rt6i_idev);
+                        goto out;
+                }
+
                 neigh_update(neigh, lladdr,
                              msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
                              NEIGH_UPDATE_F_WEAK_OVERRIDE|
@@ -959,7 +986,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
                         struct rt6_info *rt;
                         rt = rt6_get_dflt_router(saddr, dev);
                         if (rt)
-                                ip6_del_rt(rt, NULL, NULL, NULL);
+                                ip6_del_rt(rt);
                 }
 
 out:
@@ -1112,7 +1139,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
         if (rt && lifetime == 0) {
                 neigh_clone(neigh);
-                ip6_del_rt(rt, NULL, NULL, NULL);
+                ip6_del_rt(rt);
                 rt = NULL;
         }
 
@@ -1344,7 +1371,8 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
 
         neigh = __neigh_lookup(&nd_tbl, target, skb->dev, 1);
         if (neigh) {
-                rt6_redirect(dest, &skb->nh.ipv6h->saddr, neigh, lladdr, 
+                rt6_redirect(dest, &skb->nh.ipv6h->daddr,
+                             &skb->nh.ipv6h->saddr, neigh, lladdr,
                              on_link);
                 neigh_release(neigh);
         }
@@ -1380,7 +1408,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                 return;
         }
 
-        ndisc_flow_init(&fl, NDISC_REDIRECT, &saddr_buf, &skb->nh.ipv6h->saddr);
+        ndisc_flow_init(&fl, NDISC_REDIRECT, &saddr_buf, &skb->nh.ipv6h->saddr,
+                        dev->ifindex);
 
         dst = ip6_route_output(NULL, &fl);
         if (dst == NULL)