arp.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/* linux/net/ipv4/arp.c
   3 *
   4 * Copyright (C) 1994 by Florian  La Roche
   5 *
   6 * This module implements the Address Resolution Protocol ARP (RFC 826),
   7 * which is used to convert IP addresses (or in the future maybe other
   8 * high-level addresses) into a low-level hardware address (like an Ethernet
   9 * address).
  10 *
  11 * Fixes:
  12 *		Alan Cox	:	Removed the Ethernet assumptions in
  13 *					Florian's code
  14 *		Alan Cox	:	Fixed some small errors in the ARP
  15 *					logic
  16 *		Alan Cox	:	Allow >4K in /proc
  17 *		Alan Cox	:	Make ARP add its own protocol entry
  18 *		Ross Martin     :       Rewrote arp_rcv() and arp_get_info()
  19 *		Stephen Henson	:	Add AX25 support to arp_get_info()
  20 *		Alan Cox	:	Drop data when a device is downed.
  21 *		Alan Cox	:	Use init_timer().
  22 *		Alan Cox	:	Double lock fixes.
  23 *		Martin Seine	:	Move the arphdr structure
  24 *					to if_arp.h for compatibility.
  25 *					with BSD based programs.
  26 *		Andrew Tridgell :       Added ARP netmask code and
  27 *					re-arranged proxy handling.
  28 *		Alan Cox	:	Changed to use notifiers.
  29 *		Niibe Yutaka	:	Reply for this device or proxies only.
  30 *		Alan Cox	:	Don't proxy across hardware types!
  31 *		Jonathan Naylor :	Added support for NET/ROM.
  32 *		Mike Shaver     :       RFC1122 checks.
  33 *		Jonathan Naylor :	Only lookup the hardware address for
  34 *					the correct hardware type.
  35 *		Germano Caronni	:	Assorted subtle races.
  36 *		Craig Schlenter :	Don't modify permanent entry
  37 *					during arp_rcv.
  38 *		Russ Nelson	:	Tidied up a few bits.
  39 *		Alexey Kuznetsov:	Major changes to caching and behaviour,
  40 *					eg intelligent arp probing and
  41 *					generation
  42 *					of host down events.
  43 *		Alan Cox	:	Missing unlock in device events.
  44 *		Eckes		:	ARP ioctl control errors.
  45 *		Alexey Kuznetsov:	Arp free fix.
  46 *		Manuel Rodriguez:	Gratuitous ARP.
  47 *              Jonathan Layes  :       Added arpd support through kerneld
  48 *                                      message queue (960314)
  49 *		Mike Shaver	:	/proc/sys/net/ipv4/arp_* support
  50 *		Mike McLagan    :	Routing by source
  51 *		Stuart Cheshire	:	Metricom and grat arp fixes
  52 *					*** FOR 2.1 clean this up ***
  53 *		Lawrence V. Stefani: (08/12/96) Added FDDI support.
  54 *		Alan Cox	:	Took the AP1000 nasty FDDI hack and
  55 *					folded into the mainstream FDDI code.
  56 *					Ack spit, Linus how did you allow that
  57 *					one in...
  58 *		Jes Sorensen	:	Make FDDI work again in 2.1.x and
  59 *					clean up the APFDDI & gen. FDDI bits.
  60 *		Alexey Kuznetsov:	new arp state machine;
  61 *					now it is in net/core/neighbour.c.
  62 *		Krzysztof Halasa:	Added Frame Relay ARP support.
  63 *		Arnaldo C. Melo :	convert /proc/net/arp to seq_file
  64 *		Shmulik Hen:		Split arp_send to arp_create and
  65 *					arp_xmit so intermediate drivers like
  66 *					bonding can change the skb before
  67 *					sending (e.g. insert 8021q tag).
  68 *		Harald Welte	:	convert to make use of jenkins hash
  69 *		Jesper D. Brouer:       Proxy ARP PVLAN RFC 3069 support.
  70 */
  71
  72#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  73
  74#include <linux/module.h>
  75#include <linux/types.h>
  76#include <linux/string.h>
  77#include <linux/kernel.h>
  78#include <linux/capability.h>
  79#include <linux/socket.h>
  80#include <linux/sockios.h>
  81#include <linux/errno.h>
  82#include <linux/in.h>
  83#include <linux/mm.h>
  84#include <linux/inet.h>
  85#include <linux/inetdevice.h>
  86#include <linux/netdevice.h>
  87#include <linux/etherdevice.h>
  88#include <linux/fddidevice.h>
  89#include <linux/if_arp.h>
  90#include <linux/skbuff.h>
  91#include <linux/proc_fs.h>
  92#include <linux/seq_file.h>
  93#include <linux/stat.h>
  94#include <linux/init.h>
  95#include <linux/net.h>
  96#include <linux/rcupdate.h>
  97#include <linux/slab.h>
  98#ifdef CONFIG_SYSCTL
  99#include <linux/sysctl.h>
 100#endif
 101
 102#include <net/net_namespace.h>
 103#include <net/ip.h>
 104#include <net/icmp.h>
 105#include <net/route.h>
 106#include <net/protocol.h>
 107#include <net/tcp.h>
 108#include <net/sock.h>
 109#include <net/arp.h>
 110#include <net/ax25.h>
 111#include <net/netrom.h>
 112#include <net/dst_metadata.h>
 113#include <net/ip_tunnels.h>
 114
 115#include <linux/uaccess.h>
 116
 117#include <linux/netfilter_arp.h>
 118
 119/*
 120 *	Interface to generic neighbour cache.
 121 */
 122static u32 arp_hash(const void *pkey, const struct net_device *dev, __u32 *hash_rnd);
 123static bool arp_key_eq(const struct neighbour *n, const void *pkey);
 124static int arp_constructor(struct neighbour *neigh);
 125static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb);
 126static void arp_error_report(struct neighbour *neigh, struct sk_buff *skb);
 127static void parp_redo(struct sk_buff *skb);
 128static int arp_is_multicast(const void *pkey);
 129
 130static const struct neigh_ops arp_generic_ops = {
 131	.family =		AF_INET,
 132	.solicit =		arp_solicit,
 133	.error_report =		arp_error_report,
 134	.output =		neigh_resolve_output,
 135	.connected_output =	neigh_connected_output,
 136};
 137
 138static const struct neigh_ops arp_hh_ops = {
 139	.family =		AF_INET,
 140	.solicit =		arp_solicit,
 141	.error_report =		arp_error_report,
 142	.output =		neigh_resolve_output,
 143	.connected_output =	neigh_resolve_output,
 144};
 145
 146static const struct neigh_ops arp_direct_ops = {
 147	.family =		AF_INET,
 148	.output =		neigh_direct_output,
 149	.connected_output =	neigh_direct_output,
 150};
 151
 152struct neigh_table arp_tbl = {
 153	.family		= AF_INET,
 154	.key_len	= 4,
 155	.protocol	= cpu_to_be16(ETH_P_IP),
 156	.hash		= arp_hash,
 157	.key_eq		= arp_key_eq,
 158	.constructor	= arp_constructor,
 159	.proxy_redo	= parp_redo,
 160	.is_multicast	= arp_is_multicast,
 161	.id		= "arp_cache",
 162	.parms		= {
 163		.tbl			= &arp_tbl,
 164		.reachable_time		= 30 * HZ,
 165		.data	= {
 166			[NEIGH_VAR_MCAST_PROBES] = 3,
 167			[NEIGH_VAR_UCAST_PROBES] = 3,
 168			[NEIGH_VAR_RETRANS_TIME] = 1 * HZ,
 169			[NEIGH_VAR_BASE_REACHABLE_TIME] = 30 * HZ,
 170			[NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
 171			[NEIGH_VAR_INTERVAL_PROBE_TIME_MS] = 5 * HZ,
 172			[NEIGH_VAR_GC_STALETIME] = 60 * HZ,
 173			[NEIGH_VAR_QUEUE_LEN_BYTES] = SK_WMEM_DEFAULT,
 174			[NEIGH_VAR_PROXY_QLEN] = 64,
 175			[NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
 176			[NEIGH_VAR_PROXY_DELAY]	= (8 * HZ) / 10,
 177			[NEIGH_VAR_LOCKTIME] = 1 * HZ,
 178		},
 179	},
 180	.gc_interval	= 30 * HZ,
 181	.gc_thresh1	= 128,
 182	.gc_thresh2	= 512,
 183	.gc_thresh3	= 1024,
 184};
 185EXPORT_SYMBOL(arp_tbl);
 186
 187int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir)
 188{
 189	switch (dev->type) {
 190	case ARPHRD_ETHER:
 191	case ARPHRD_FDDI:
 192	case ARPHRD_IEEE802:
 193		ip_eth_mc_map(addr, haddr);
 194		return 0;
 195	case ARPHRD_INFINIBAND:
 196		ip_ib_mc_map(addr, dev->broadcast, haddr);
 197		return 0;
 198	case ARPHRD_IPGRE:
 199		ip_ipgre_mc_map(addr, dev->broadcast, haddr);
 200		return 0;
 201	default:
 202		if (dir) {
 203			memcpy(haddr, dev->broadcast, dev->addr_len);
 204			return 0;
 205		}
 206	}
 207	return -EINVAL;
 208}
 209
 210
 211static u32 arp_hash(const void *pkey,
 212		    const struct net_device *dev,
 213		    __u32 *hash_rnd)
 214{
 215	return arp_hashfn(pkey, dev, hash_rnd);
 216}
 217
 218static bool arp_key_eq(const struct neighbour *neigh, const void *pkey)
 219{
 220	return neigh_key_eq32(neigh, pkey);
 221}
 222
 223static int arp_constructor(struct neighbour *neigh)
 224{
 225	__be32 addr;
 226	struct net_device *dev = neigh->dev;
 227	struct in_device *in_dev;
 228	struct neigh_parms *parms;
 229	u32 inaddr_any = INADDR_ANY;
 230
 231	if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
 232		memcpy(neigh->primary_key, &inaddr_any, arp_tbl.key_len);
 233
 234	addr = *(__be32 *)neigh->primary_key;
 235	rcu_read_lock();
 236	in_dev = __in_dev_get_rcu(dev);
 237	if (!in_dev) {
 238		rcu_read_unlock();
 239		return -EINVAL;
 240	}
 241
 242	neigh->type = inet_addr_type_dev_table(dev_net(dev), dev, addr);
 243
 244	parms = in_dev->arp_parms;
 245	__neigh_parms_put(neigh->parms);
 246	neigh->parms = neigh_parms_clone(parms);
 247	rcu_read_unlock();
 248
 249	if (!dev->header_ops) {
 250		neigh->nud_state = NUD_NOARP;
 251		neigh->ops = &arp_direct_ops;
 252		neigh->output = neigh_direct_output;
 253	} else {
 254		/* Good devices (checked by reading texts, but only Ethernet is
 255		   tested)
 256
 257		   ARPHRD_ETHER: (ethernet, apfddi)
 258		   ARPHRD_FDDI: (fddi)
 259		   ARPHRD_IEEE802: (tr)
 260		   ARPHRD_METRICOM: (strip)
 261		   ARPHRD_ARCNET:
 262		   etc. etc. etc.
 263
 264		   ARPHRD_IPDDP will also work, if author repairs it.
 265		   I did not it, because this driver does not work even
 266		   in old paradigm.
 267		 */
 268
 269		if (neigh->type == RTN_MULTICAST) {
 270			neigh->nud_state = NUD_NOARP;
 271			arp_mc_map(addr, neigh->ha, dev, 1);
 272		} else if (dev->flags & (IFF_NOARP | IFF_LOOPBACK)) {
 273			neigh->nud_state = NUD_NOARP;
 274			memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
 275		} else if (neigh->type == RTN_BROADCAST ||
 276			   (dev->flags & IFF_POINTOPOINT)) {
 277			neigh->nud_state = NUD_NOARP;
 278			memcpy(neigh->ha, dev->broadcast, dev->addr_len);
 279		}
 280
 281		if (dev->header_ops->cache)
 282			neigh->ops = &arp_hh_ops;
 283		else
 284			neigh->ops = &arp_generic_ops;
 285
 286		if (neigh->nud_state & NUD_VALID)
 287			neigh->output = neigh->ops->connected_output;
 288		else
 289			neigh->output = neigh->ops->output;
 290	}
 291	return 0;
 292}
 293
 294static void arp_error_report(struct neighbour *neigh, struct sk_buff *skb)
 295{
 296	dst_link_failure(skb);
 297	kfree_skb_reason(skb, SKB_DROP_REASON_NEIGH_FAILED);
 298}
 299
 300/* Create and send an arp packet. */
 301static void arp_send_dst(int type, int ptype, __be32 dest_ip,
 302			 struct net_device *dev, __be32 src_ip,
 303			 const unsigned char *dest_hw,
 304			 const unsigned char *src_hw,
 305			 const unsigned char *target_hw,
 306			 struct dst_entry *dst)
 307{
 308	struct sk_buff *skb;
 309
 310	/* arp on this interface. */
 311	if (dev->flags & IFF_NOARP)
 312		return;
 313
 314	skb = arp_create(type, ptype, dest_ip, dev, src_ip,
 315			 dest_hw, src_hw, target_hw);
 316	if (!skb)
 317		return;
 318
 319	skb_dst_set(skb, dst_clone(dst));
 320	arp_xmit(skb);
 321}
 322
 323void arp_send(int type, int ptype, __be32 dest_ip,
 324	      struct net_device *dev, __be32 src_ip,
 325	      const unsigned char *dest_hw, const unsigned char *src_hw,
 326	      const unsigned char *target_hw)
 327{
 328	arp_send_dst(type, ptype, dest_ip, dev, src_ip, dest_hw, src_hw,
 329		     target_hw, NULL);
 330}
 331EXPORT_SYMBOL(arp_send);
 332
 333static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
 334{
 335	__be32 saddr = 0;
 336	u8 dst_ha[MAX_ADDR_LEN], *dst_hw = NULL;
 337	struct net_device *dev = neigh->dev;
 338	__be32 target = *(__be32 *)neigh->primary_key;
 339	int probes = atomic_read(&neigh->probes);
 340	struct in_device *in_dev;
 341	struct dst_entry *dst = NULL;
 342
 343	rcu_read_lock();
 344	in_dev = __in_dev_get_rcu(dev);
 345	if (!in_dev) {
 346		rcu_read_unlock();
 347		return;
 348	}
 349	switch (IN_DEV_ARP_ANNOUNCE(in_dev)) {
 350	default:
 351	case 0:		/* By default announce any local IP */
 352		if (skb && inet_addr_type_dev_table(dev_net(dev), dev,
 353					  ip_hdr(skb)->saddr) == RTN_LOCAL)
 354			saddr = ip_hdr(skb)->saddr;
 355		break;
 356	case 1:		/* Restrict announcements of saddr in same subnet */
 357		if (!skb)
 358			break;
 359		saddr = ip_hdr(skb)->saddr;
 360		if (inet_addr_type_dev_table(dev_net(dev), dev,
 361					     saddr) == RTN_LOCAL) {
 362			/* saddr should be known to target */
 363			if (inet_addr_onlink(in_dev, target, saddr))
 364				break;
 365		}
 366		saddr = 0;
 367		break;
 368	case 2:		/* Avoid secondary IPs, get a primary/preferred one */
 369		break;
 370	}
 371	rcu_read_unlock();
 372
 373	if (!saddr)
 374		saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
 375
 376	probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
 377	if (probes < 0) {
 378		if (!(READ_ONCE(neigh->nud_state) & NUD_VALID))
 379			pr_debug("trying to ucast probe in NUD_INVALID\n");
 380		neigh_ha_snapshot(dst_ha, neigh, dev);
 381		dst_hw = dst_ha;
 382	} else {
 383		probes -= NEIGH_VAR(neigh->parms, APP_PROBES);
 384		if (probes < 0) {
 385			neigh_app_ns(neigh);
 386			return;
 387		}
 388	}
 389
 390	if (skb && !(dev->priv_flags & IFF_XMIT_DST_RELEASE))
 391		dst = skb_dst(skb);
 392	arp_send_dst(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr,
 393		     dst_hw, dev->dev_addr, NULL, dst);
 394}
 395
 396static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
 397{
 398	struct net *net = dev_net(in_dev->dev);
 399	int scope;
 400
 401	switch (IN_DEV_ARP_IGNORE(in_dev)) {
 402	case 0:	/* Reply, the tip is already validated */
 403		return 0;
 404	case 1:	/* Reply only if tip is configured on the incoming interface */
 405		sip = 0;
 406		scope = RT_SCOPE_HOST;
 407		break;
 408	case 2:	/*
 409		 * Reply only if tip is configured on the incoming interface
 410		 * and is in same subnet as sip
 411		 */
 412		scope = RT_SCOPE_HOST;
 413		break;
 414	case 3:	/* Do not reply for scope host addresses */
 415		sip = 0;
 416		scope = RT_SCOPE_LINK;
 417		in_dev = NULL;
 418		break;
 419	case 4:	/* Reserved */
 420	case 5:
 421	case 6:
 422	case 7:
 423		return 0;
 424	case 8:	/* Do not reply */
 425		return 1;
 426	default:
 427		return 0;
 428	}
 429	return !inet_confirm_addr(net, in_dev, sip, tip, scope);
 430}
 431
 432static int arp_accept(struct in_device *in_dev, __be32 sip)
 433{
 434	struct net *net = dev_net(in_dev->dev);
 435	int scope = RT_SCOPE_LINK;
 436
 437	switch (IN_DEV_ARP_ACCEPT(in_dev)) {
 438	case 0: /* Don't create new entries from garp */
 439		return 0;
 440	case 1: /* Create new entries from garp */
 441		return 1;
 442	case 2: /* Create a neighbor in the arp table only if sip
 443		 * is in the same subnet as an address configured
 444		 * on the interface that received the garp message
 445		 */
 446		return !!inet_confirm_addr(net, in_dev, sip, 0, scope);
 447	default:
 448		return 0;
 449	}
 450}
 451
 452static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
 453{
 454	struct rtable *rt;
 455	int flag = 0;
 456	/*unsigned long now; */
 457	struct net *net = dev_net(dev);
 458
 459	rt = ip_route_output(net, sip, tip, 0, l3mdev_master_ifindex_rcu(dev),
 460			     RT_SCOPE_UNIVERSE);
 461	if (IS_ERR(rt))
 462		return 1;
 463	if (rt->dst.dev != dev) {
 464		__NET_INC_STATS(net, LINUX_MIB_ARPFILTER);
 465		flag = 1;
 466	}
 467	ip_rt_put(rt);
 468	return flag;
 469}
 470
 471/*
 472 * Check if we can use proxy ARP for this path
 473 */
 474static inline int arp_fwd_proxy(struct in_device *in_dev,
 475				struct net_device *dev,	struct rtable *rt)
 476{
 477	struct in_device *out_dev;
 478	int imi, omi = -1;
 479
 480	if (rt->dst.dev == dev)
 481		return 0;
 482
 483	if (!IN_DEV_PROXY_ARP(in_dev))
 484		return 0;
 485	imi = IN_DEV_MEDIUM_ID(in_dev);
 486	if (imi == 0)
 487		return 1;
 488	if (imi == -1)
 489		return 0;
 490
 491	/* place to check for proxy_arp for routes */
 492
 493	out_dev = __in_dev_get_rcu(rt->dst.dev);
 494	if (out_dev)
 495		omi = IN_DEV_MEDIUM_ID(out_dev);
 496
 497	return omi != imi && omi != -1;
 498}
 499
 500/*
 501 * Check for RFC3069 proxy arp private VLAN (allow to send back to same dev)
 502 *
 503 * RFC3069 supports proxy arp replies back to the same interface.  This
 504 * is done to support (ethernet) switch features, like RFC 3069, where
 505 * the individual ports are not allowed to communicate with each
 506 * other, BUT they are allowed to talk to the upstream router.  As
 507 * described in RFC 3069, it is possible to allow these hosts to
 508 * communicate through the upstream router, by proxy_arp'ing.
 509 *
 510 * RFC 3069: "VLAN Aggregation for Efficient IP Address Allocation"
 511 *
 512 *  This technology is known by different names:
 513 *    In RFC 3069 it is called VLAN Aggregation.
 514 *    Cisco and Allied Telesyn call it Private VLAN.
 515 *    Hewlett-Packard call it Source-Port filtering or port-isolation.
 516 *    Ericsson call it MAC-Forced Forwarding (RFC Draft).
 517 *
 518 */
 519static inline int arp_fwd_pvlan(struct in_device *in_dev,
 520				struct net_device *dev,	struct rtable *rt,
 521				__be32 sip, __be32 tip)
 522{
 523	/* Private VLAN is only concerned about the same ethernet segment */
 524	if (rt->dst.dev != dev)
 525		return 0;
 526
 527	/* Don't reply on self probes (often done by windowz boxes)*/
 528	if (sip == tip)
 529		return 0;
 530
 531	if (IN_DEV_PROXY_ARP_PVLAN(in_dev))
 532		return 1;
 533	else
 534		return 0;
 535}
 536
 537/*
 538 *	Interface to link layer: send routine and receive handler.
 539 */
 540
 541/*
 542 *	Create an arp packet. If dest_hw is not set, we create a broadcast
 543 *	message.
 544 */
 545struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
 546			   struct net_device *dev, __be32 src_ip,
 547			   const unsigned char *dest_hw,
 548			   const unsigned char *src_hw,
 549			   const unsigned char *target_hw)
 550{
 551	struct sk_buff *skb;
 552	struct arphdr *arp;
 553	unsigned char *arp_ptr;
 554	int hlen = LL_RESERVED_SPACE(dev);
 555	int tlen = dev->needed_tailroom;
 556
 557	/*
 558	 *	Allocate a buffer
 559	 */
 560
 561	skb = alloc_skb(arp_hdr_len(dev) + hlen + tlen, GFP_ATOMIC);
 562	if (!skb)
 563		return NULL;
 564
 565	skb_reserve(skb, hlen);
 566	skb_reset_network_header(skb);
 567	skb_put(skb, arp_hdr_len(dev));
 568	skb->dev = dev;
 569	skb->protocol = htons(ETH_P_ARP);
 570	if (!src_hw)
 571		src_hw = dev->dev_addr;
 572	if (!dest_hw)
 573		dest_hw = dev->broadcast;
 574
 575	/* Fill the device header for the ARP frame.
 576	 * Note: skb->head can be changed.
 577	 */
 578	if (dev_hard_header(skb, dev, ptype, dest_hw, src_hw, skb->len) < 0)
 579		goto out;
 580
 581	arp = arp_hdr(skb);
 582	/*
 583	 * Fill out the arp protocol part.
 584	 *
 585	 * The arp hardware type should match the device type, except for FDDI,
 586	 * which (according to RFC 1390) should always equal 1 (Ethernet).
 587	 */
 588	/*
 589	 *	Exceptions everywhere. AX.25 uses the AX.25 PID value not the
 590	 *	DIX code for the protocol. Make these device structure fields.
 591	 */
 592	switch (dev->type) {
 593	default:
 594		arp->ar_hrd = htons(dev->type);
 595		arp->ar_pro = htons(ETH_P_IP);
 596		break;
 597
 598#if IS_ENABLED(CONFIG_AX25)
 599	case ARPHRD_AX25:
 600		arp->ar_hrd = htons(ARPHRD_AX25);
 601		arp->ar_pro = htons(AX25_P_IP);
 602		break;
 603
 604#if IS_ENABLED(CONFIG_NETROM)
 605	case ARPHRD_NETROM:
 606		arp->ar_hrd = htons(ARPHRD_NETROM);
 607		arp->ar_pro = htons(AX25_P_IP);
 608		break;
 609#endif
 610#endif
 611
 612#if IS_ENABLED(CONFIG_FDDI)
 613	case ARPHRD_FDDI:
 614		arp->ar_hrd = htons(ARPHRD_ETHER);
 615		arp->ar_pro = htons(ETH_P_IP);
 616		break;
 617#endif
 618	}
 619
 620	arp->ar_hln = dev->addr_len;
 621	arp->ar_pln = 4;
 622	arp->ar_op = htons(type);
 623
 624	arp_ptr = (unsigned char *)(arp + 1);
 625
 626	memcpy(arp_ptr, src_hw, dev->addr_len);
 627	arp_ptr += dev->addr_len;
 628	memcpy(arp_ptr, &src_ip, 4);
 629	arp_ptr += 4;
 630
 631	switch (dev->type) {
 632#if IS_ENABLED(CONFIG_FIREWIRE_NET)
 633	case ARPHRD_IEEE1394:
 634		break;
 635#endif
 636	default:
 637		if (target_hw)
 638			memcpy(arp_ptr, target_hw, dev->addr_len);
 639		else
 640			memset(arp_ptr, 0, dev->addr_len);
 641		arp_ptr += dev->addr_len;
 642	}
 643	memcpy(arp_ptr, &dest_ip, 4);
 644
 645	return skb;
 646
 647out:
 648	kfree_skb(skb);
 649	return NULL;
 650}
 651EXPORT_SYMBOL(arp_create);
 652
 653static int arp_xmit_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 654{
 655	return dev_queue_xmit(skb);
 656}
 657
 658/*
 659 *	Send an arp packet.
 660 */
 661void arp_xmit(struct sk_buff *skb)
 662{
 663	rcu_read_lock();
 664	/* Send it off, maybe filter it using firewalling first.  */
 665	NF_HOOK(NFPROTO_ARP, NF_ARP_OUT,
 666		dev_net_rcu(skb->dev), NULL, skb, NULL, skb->dev,
 667		arp_xmit_finish);
 668	rcu_read_unlock();
 669}
 670EXPORT_SYMBOL(arp_xmit);
 671
 672static bool arp_is_garp(struct net *net, struct net_device *dev,
 673			int *addr_type, __be16 ar_op,
 674			__be32 sip, __be32 tip,
 675			unsigned char *sha, unsigned char *tha)
 676{
 677	bool is_garp = tip == sip;
 678
 679	/* Gratuitous ARP _replies_ also require target hwaddr to be
 680	 * the same as source.
 681	 */
 682	if (is_garp && ar_op == htons(ARPOP_REPLY))
 683		is_garp =
 684			/* IPv4 over IEEE 1394 doesn't provide target
 685			 * hardware address field in its ARP payload.
 686			 */
 687			tha &&
 688			!memcmp(tha, sha, dev->addr_len);
 689
 690	if (is_garp) {
 691		*addr_type = inet_addr_type_dev_table(net, dev, sip);
 692		if (*addr_type != RTN_UNICAST)
 693			is_garp = false;
 694	}
 695	return is_garp;
 696}
 697
 698/*
 699 *	Process an arp request.
 700 */
 701
 702static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
 703{
 704	struct net_device *dev = skb->dev;
 705	struct in_device *in_dev = __in_dev_get_rcu(dev);
 706	struct arphdr *arp;
 707	unsigned char *arp_ptr;
 708	struct rtable *rt;
 709	unsigned char *sha;
 710	unsigned char *tha = NULL;
 711	__be32 sip, tip;
 712	u16 dev_type = dev->type;
 713	int addr_type;
 714	struct neighbour *n;
 715	struct dst_entry *reply_dst = NULL;
 716	bool is_garp = false;
 717
 718	/* arp_rcv below verifies the ARP header and verifies the device
 719	 * is ARP'able.
 720	 */
 721
 722	if (!in_dev)
 723		goto out_free_skb;
 724
 725	arp = arp_hdr(skb);
 726
 727	switch (dev_type) {
 728	default:
 729		if (arp->ar_pro != htons(ETH_P_IP) ||
 730		    htons(dev_type) != arp->ar_hrd)
 731			goto out_free_skb;
 732		break;
 733	case ARPHRD_ETHER:
 734	case ARPHRD_FDDI:
 735	case ARPHRD_IEEE802:
 736		/*
 737		 * ETHERNET, and Fibre Channel (which are IEEE 802
 738		 * devices, according to RFC 2625) devices will accept ARP
 739		 * hardware types of either 1 (Ethernet) or 6 (IEEE 802.2).
 740		 * This is the case also of FDDI, where the RFC 1390 says that
 741		 * FDDI devices should accept ARP hardware of (1) Ethernet,
 742		 * however, to be more robust, we'll accept both 1 (Ethernet)
 743		 * or 6 (IEEE 802.2)
 744		 */
 745		if ((arp->ar_hrd != htons(ARPHRD_ETHER) &&
 746		     arp->ar_hrd != htons(ARPHRD_IEEE802)) ||
 747		    arp->ar_pro != htons(ETH_P_IP))
 748			goto out_free_skb;
 749		break;
 750	case ARPHRD_AX25:
 751		if (arp->ar_pro != htons(AX25_P_IP) ||
 752		    arp->ar_hrd != htons(ARPHRD_AX25))
 753			goto out_free_skb;
 754		break;
 755	case ARPHRD_NETROM:
 756		if (arp->ar_pro != htons(AX25_P_IP) ||
 757		    arp->ar_hrd != htons(ARPHRD_NETROM))
 758			goto out_free_skb;
 759		break;
 760	}
 761
 762	/* Understand only these message types */
 763
 764	if (arp->ar_op != htons(ARPOP_REPLY) &&
 765	    arp->ar_op != htons(ARPOP_REQUEST))
 766		goto out_free_skb;
 767
 768/*
 769 *	Extract fields
 770 */
 771	arp_ptr = (unsigned char *)(arp + 1);
 772	sha	= arp_ptr;
 773	arp_ptr += dev->addr_len;
 774	memcpy(&sip, arp_ptr, 4);
 775	arp_ptr += 4;
 776	switch (dev_type) {
 777#if IS_ENABLED(CONFIG_FIREWIRE_NET)
 778	case ARPHRD_IEEE1394:
 779		break;
 780#endif
 781	default:
 782		tha = arp_ptr;
 783		arp_ptr += dev->addr_len;
 784	}
 785	memcpy(&tip, arp_ptr, 4);
 786/*
 787 *	Check for bad requests for 127.x.x.x and requests for multicast
 788 *	addresses.  If this is one such, delete it.
 789 */
 790	if (ipv4_is_multicast(tip) ||
 791	    (!IN_DEV_ROUTE_LOCALNET(in_dev) && ipv4_is_loopback(tip)))
 792		goto out_free_skb;
 793
 794 /*
 795  *	For some 802.11 wireless deployments (and possibly other networks),
 796  *	there will be an ARP proxy and gratuitous ARP frames are attacks
 797  *	and thus should not be accepted.
 798  */
 799	if (sip == tip && IN_DEV_ORCONF(in_dev, DROP_GRATUITOUS_ARP))
 800		goto out_free_skb;
 801
 802/*
 803 *     Special case: We must set Frame Relay source Q.922 address
 804 */
 805	if (dev_type == ARPHRD_DLCI)
 806		sha = dev->broadcast;
 807
 808/*
 809 *  Process entry.  The idea here is we want to send a reply if it is a
 810 *  request for us or if it is a request for someone else that we hold
 811 *  a proxy for.  We want to add an entry to our cache if it is a reply
 812 *  to us or if it is a request for our address.
 813 *  (The assumption for this last is that if someone is requesting our
 814 *  address, they are probably intending to talk to us, so it saves time
 815 *  if we cache their address.  Their address is also probably not in
 816 *  our cache, since ours is not in their cache.)
 817 *
 818 *  Putting this another way, we only care about replies if they are to
 819 *  us, in which case we add them to the cache.  For requests, we care
 820 *  about those for us and those for our proxies.  We reply to both,
 821 *  and in the case of requests for us we add the requester to the arp
 822 *  cache.
 823 */
 824
 825	if (arp->ar_op == htons(ARPOP_REQUEST) && skb_metadata_dst(skb))
 826		reply_dst = (struct dst_entry *)
 827			    iptunnel_metadata_reply(skb_metadata_dst(skb),
 828						    GFP_ATOMIC);
 829
 830	/* Special case: IPv4 duplicate address detection packet (RFC2131) */
 831	if (sip == 0) {
 832		if (arp->ar_op == htons(ARPOP_REQUEST) &&
 833		    inet_addr_type_dev_table(net, dev, tip) == RTN_LOCAL &&
 834		    !arp_ignore(in_dev, sip, tip))
 835			arp_send_dst(ARPOP_REPLY, ETH_P_ARP, sip, dev, tip,
 836				     sha, dev->dev_addr, sha, reply_dst);
 837		goto out_consume_skb;
 838	}
 839
 840	if (arp->ar_op == htons(ARPOP_REQUEST) &&
 841	    ip_route_input_noref(skb, tip, sip, 0, dev) == 0) {
 842
 843		rt = skb_rtable(skb);
 844		addr_type = rt->rt_type;
 845
 846		if (addr_type == RTN_LOCAL) {
 847			int dont_send;
 848
 849			dont_send = arp_ignore(in_dev, sip, tip);
 850			if (!dont_send && IN_DEV_ARPFILTER(in_dev))
 851				dont_send = arp_filter(sip, tip, dev);
 852			if (!dont_send) {
 853				n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
 854				if (n) {
 855					arp_send_dst(ARPOP_REPLY, ETH_P_ARP,
 856						     sip, dev, tip, sha,
 857						     dev->dev_addr, sha,
 858						     reply_dst);
 859					neigh_release(n);
 860				}
 861			}
 862			goto out_consume_skb;
 863		} else if (IN_DEV_FORWARD(in_dev)) {
 864			if (addr_type == RTN_UNICAST  &&
 865			    (arp_fwd_proxy(in_dev, dev, rt) ||
 866			     arp_fwd_pvlan(in_dev, dev, rt, sip, tip) ||
 867			     (rt->dst.dev != dev &&
 868			      pneigh_lookup(&arp_tbl, net, &tip, dev)))) {
 869				n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
 870				if (n)
 871					neigh_release(n);
 872
 873				if (NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED ||
 874				    skb->pkt_type == PACKET_HOST ||
 875				    NEIGH_VAR(in_dev->arp_parms, PROXY_DELAY) == 0) {
 876					arp_send_dst(ARPOP_REPLY, ETH_P_ARP,
 877						     sip, dev, tip, sha,
 878						     dev->dev_addr, sha,
 879						     reply_dst);
 880				} else {
 881					pneigh_enqueue(&arp_tbl,
 882						       in_dev->arp_parms, skb);
 883					goto out_free_dst;
 884				}
 885				goto out_consume_skb;
 886			}
 887		}
 888	}
 889
 890	/* Update our ARP tables */
 891
 892	n = __neigh_lookup(&arp_tbl, &sip, dev, 0);
 893
 894	addr_type = -1;
 895	if (n || arp_accept(in_dev, sip)) {
 896		is_garp = arp_is_garp(net, dev, &addr_type, arp->ar_op,
 897				      sip, tip, sha, tha);
 898	}
 899
 900	if (arp_accept(in_dev, sip)) {
 901		/* Unsolicited ARP is not accepted by default.
 902		   It is possible, that this option should be enabled for some
 903		   devices (strip is candidate)
 904		 */
 905		if (!n &&
 906		    (is_garp ||
 907		     (arp->ar_op == htons(ARPOP_REPLY) &&
 908		      (addr_type == RTN_UNICAST ||
 909		       (addr_type < 0 &&
 910			/* postpone calculation to as late as possible */
 911			inet_addr_type_dev_table(net, dev, sip) ==
 912				RTN_UNICAST)))))
 913			n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
 914	}
 915
 916	if (n) {
 917		int state = NUD_REACHABLE;
 918		int override;
 919
 920		/* If several different ARP replies follows back-to-back,
 921		   use the FIRST one. It is possible, if several proxy
 922		   agents are active. Taking the first reply prevents
 923		   arp trashing and chooses the fastest router.
 924		 */
 925		override = time_after(jiffies,
 926				      n->updated +
 927				      NEIGH_VAR(n->parms, LOCKTIME)) ||
 928			   is_garp;
 929
 930		/* Broadcast replies and request packets
 931		   do not assert neighbour reachability.
 932		 */
 933		if (arp->ar_op != htons(ARPOP_REPLY) ||
 934		    skb->pkt_type != PACKET_HOST)
 935			state = NUD_STALE;
 936		neigh_update(n, sha, state,
 937			     override ? NEIGH_UPDATE_F_OVERRIDE : 0, 0);
 938		neigh_release(n);
 939	}
 940
 941out_consume_skb:
 942	consume_skb(skb);
 943
 944out_free_dst:
 945	dst_release(reply_dst);
 946	return NET_RX_SUCCESS;
 947
 948out_free_skb:
 949	kfree_skb(skb);
 950	return NET_RX_DROP;
 951}
 952
 953static void parp_redo(struct sk_buff *skb)
 954{
 955	arp_process(dev_net(skb->dev), NULL, skb);
 956}
 957
 958static int arp_is_multicast(const void *pkey)
 959{
 960	return ipv4_is_multicast(*((__be32 *)pkey));
 961}
 962
 963/*
 964 *	Receive an arp request from the device layer.
 965 */
 966
 967static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
 968		   struct packet_type *pt, struct net_device *orig_dev)
 969{
 970	enum skb_drop_reason drop_reason;
 971	const struct arphdr *arp;
 972
 973	/* do not tweak dropwatch on an ARP we will ignore */
 974	if (dev->flags & IFF_NOARP ||
 975	    skb->pkt_type == PACKET_OTHERHOST ||
 976	    skb->pkt_type == PACKET_LOOPBACK)
 977		goto consumeskb;
 978
 979	skb = skb_share_check(skb, GFP_ATOMIC);
 980	if (!skb)
 981		goto out_of_mem;
 982
 983	/* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
 984	drop_reason = pskb_may_pull_reason(skb, arp_hdr_len(dev));
 985	if (drop_reason != SKB_NOT_DROPPED_YET)
 986		goto freeskb;
 987
 988	arp = arp_hdr(skb);
 989	if (arp->ar_hln != dev->addr_len || arp->ar_pln != 4) {
 990		drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
 991		goto freeskb;
 992	}
 993
 994	memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
 995
 996	return NF_HOOK(NFPROTO_ARP, NF_ARP_IN,
 997		       dev_net(dev), NULL, skb, dev, NULL,
 998		       arp_process);
 999
1000consumeskb:
1001	consume_skb(skb);
1002	return NET_RX_SUCCESS;
1003freeskb:
1004	kfree_skb_reason(skb, drop_reason);
1005out_of_mem:
1006	return NET_RX_DROP;
1007}
1008
1009/*
1010 *	User level interface (ioctl)
1011 */
1012
1013static struct net_device *arp_req_dev_by_name(struct net *net, struct arpreq *r,
1014					      bool getarp)
1015{
1016	struct net_device *dev;
1017
1018	if (getarp)
1019		dev = dev_get_by_name_rcu(net, r->arp_dev);
1020	else
1021		dev = __dev_get_by_name(net, r->arp_dev);
1022	if (!dev)
1023		return ERR_PTR(-ENODEV);
1024
1025	/* Mmmm... It is wrong... ARPHRD_NETROM == 0 */
1026	if (!r->arp_ha.sa_family)
1027		r->arp_ha.sa_family = dev->type;
1028
1029	if ((r->arp_flags & ATF_COM) && r->arp_ha.sa_family != dev->type)
1030		return ERR_PTR(-EINVAL);
1031
1032	return dev;
1033}
1034
1035static struct net_device *arp_req_dev(struct net *net, struct arpreq *r)
1036{
1037	struct net_device *dev;
1038	struct rtable *rt;
1039	__be32 ip;
1040
1041	if (r->arp_dev[0])
1042		return arp_req_dev_by_name(net, r, false);
1043
1044	if (r->arp_flags & ATF_PUBL)
1045		return NULL;
1046
1047	ip = ((struct sockaddr_in *)&r->arp_pa)->sin_addr.s_addr;
1048
1049	rt = ip_route_output(net, ip, 0, 0, 0, RT_SCOPE_LINK);
1050	if (IS_ERR(rt))
1051		return ERR_CAST(rt);
1052
1053	dev = rt->dst.dev;
1054	ip_rt_put(rt);
1055
1056	if (!dev)
1057		return ERR_PTR(-EINVAL);
1058
1059	return dev;
1060}
1061
1062/*
1063 *	Set (create) an ARP cache entry.
1064 */
1065
1066static int arp_req_set_proxy(struct net *net, struct net_device *dev, int on)
1067{
1068	if (!dev) {
1069		IPV4_DEVCONF_ALL(net, PROXY_ARP) = on;
1070		return 0;
1071	}
1072	if (__in_dev_get_rtnl_net(dev)) {
1073		IN_DEV_CONF_SET(__in_dev_get_rtnl_net(dev), PROXY_ARP, on);
1074		return 0;
1075	}
1076	return -ENXIO;
1077}
1078
1079static int arp_req_set_public(struct net *net, struct arpreq *r,
1080		struct net_device *dev)
1081{
1082	__be32 mask = ((struct sockaddr_in *)&r->arp_netmask)->sin_addr.s_addr;
1083
1084	if (!dev && (r->arp_flags & ATF_COM)) {
1085		dev = dev_getbyhwaddr(net, r->arp_ha.sa_family,
1086				      r->arp_ha.sa_data);
1087		if (!dev)
1088			return -ENODEV;
1089	}
1090	if (mask) {
1091		__be32 ip = ((struct sockaddr_in *)&r->arp_pa)->sin_addr.s_addr;
1092
1093		return pneigh_create(&arp_tbl, net, &ip, dev, 0, 0, false);
1094	}
1095
1096	return arp_req_set_proxy(net, dev, 1);
1097}
1098
1099static int arp_req_set(struct net *net, struct arpreq *r)
1100{
1101	struct neighbour *neigh;
1102	struct net_device *dev;
1103	__be32 ip;
1104	int err;
1105
1106	dev = arp_req_dev(net, r);
1107	if (IS_ERR(dev))
1108		return PTR_ERR(dev);
1109
1110	if (r->arp_flags & ATF_PUBL)
1111		return arp_req_set_public(net, r, dev);
1112
1113	switch (dev->type) {
1114#if IS_ENABLED(CONFIG_FDDI)
1115	case ARPHRD_FDDI:
1116		/*
1117		 * According to RFC 1390, FDDI devices should accept ARP
1118		 * hardware types of 1 (Ethernet).  However, to be more
1119		 * robust, we'll accept hardware types of either 1 (Ethernet)
1120		 * or 6 (IEEE 802.2).
1121		 */
1122		if (r->arp_ha.sa_family != ARPHRD_FDDI &&
1123		    r->arp_ha.sa_family != ARPHRD_ETHER &&
1124		    r->arp_ha.sa_family != ARPHRD_IEEE802)
1125			return -EINVAL;
1126		break;
1127#endif
1128	default:
1129		if (r->arp_ha.sa_family != dev->type)
1130			return -EINVAL;
1131		break;
1132	}
1133
1134	ip = ((struct sockaddr_in *)&r->arp_pa)->sin_addr.s_addr;
1135
1136	neigh = __neigh_lookup_errno(&arp_tbl, &ip, dev);
1137	err = PTR_ERR(neigh);
1138	if (!IS_ERR(neigh)) {
1139		unsigned int state = NUD_STALE;
1140
1141		if (r->arp_flags & ATF_PERM) {
1142			r->arp_flags |= ATF_COM;
1143			state = NUD_PERMANENT;
1144		}
1145
1146		err = neigh_update(neigh, (r->arp_flags & ATF_COM) ?
1147				   r->arp_ha.sa_data : NULL, state,
1148				   NEIGH_UPDATE_F_OVERRIDE |
1149				   NEIGH_UPDATE_F_ADMIN, 0);
1150		neigh_release(neigh);
1151	}
1152	return err;
1153}
1154
1155static unsigned int arp_state_to_flags(struct neighbour *neigh)
1156{
1157	if (neigh->nud_state&NUD_PERMANENT)
1158		return ATF_PERM | ATF_COM;
1159	else if (neigh->nud_state&NUD_VALID)
1160		return ATF_COM;
1161	else
1162		return 0;
1163}
1164
1165/*
1166 *	Get an ARP cache entry.
1167 */
1168
1169static int arp_req_get(struct net *net, struct arpreq *r)
1170{
1171	__be32 ip = ((struct sockaddr_in *) &r->arp_pa)->sin_addr.s_addr;
1172	struct neighbour *neigh;
1173	struct net_device *dev;
1174
1175	if (!r->arp_dev[0])
1176		return -ENODEV;
1177
1178	dev = arp_req_dev_by_name(net, r, true);
1179	if (IS_ERR(dev))
1180		return PTR_ERR(dev);
1181
1182	neigh = neigh_lookup(&arp_tbl, &ip, dev);
1183	if (!neigh)
1184		return -ENXIO;
1185
1186	if (READ_ONCE(neigh->nud_state) & NUD_NOARP) {
1187		neigh_release(neigh);
1188		return -ENXIO;
1189	}
1190
1191	read_lock_bh(&neigh->lock);
1192	memcpy(r->arp_ha.sa_data, neigh->ha,
1193	       min(dev->addr_len, sizeof(r->arp_ha.sa_data)));
1194	r->arp_flags = arp_state_to_flags(neigh);
1195	read_unlock_bh(&neigh->lock);
1196
1197	neigh_release(neigh);
1198
1199	r->arp_ha.sa_family = dev->type;
1200	netdev_copy_name(dev, r->arp_dev);
1201
1202	return 0;
1203}
1204
1205int arp_invalidate(struct net_device *dev, __be32 ip, bool force)
1206{
1207	struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev);
1208	int err = -ENXIO;
1209	struct neigh_table *tbl = &arp_tbl;
1210
1211	if (neigh) {
1212		if ((READ_ONCE(neigh->nud_state) & NUD_VALID) && !force) {
1213			neigh_release(neigh);
1214			return 0;
1215		}
1216
1217		if (READ_ONCE(neigh->nud_state) & ~NUD_NOARP)
1218			err = neigh_update(neigh, NULL, NUD_FAILED,
1219					   NEIGH_UPDATE_F_OVERRIDE|
1220					   NEIGH_UPDATE_F_ADMIN, 0);
1221		spin_lock_bh(&tbl->lock);
1222		neigh_release(neigh);
1223		neigh_remove_one(neigh);
1224		spin_unlock_bh(&tbl->lock);
1225	}
1226
1227	return err;
1228}
1229
1230static int arp_req_delete_public(struct net *net, struct arpreq *r,
1231		struct net_device *dev)
1232{
1233	__be32 mask = ((struct sockaddr_in *)&r->arp_netmask)->sin_addr.s_addr;
1234
1235	if (mask) {
1236		__be32 ip = ((struct sockaddr_in *)&r->arp_pa)->sin_addr.s_addr;
1237
1238		return pneigh_delete(&arp_tbl, net, &ip, dev);
1239	}
1240
1241	return arp_req_set_proxy(net, dev, 0);
1242}
1243
1244static int arp_req_delete(struct net *net, struct arpreq *r)
1245{
1246	struct net_device *dev;
1247	__be32 ip;
1248
1249	dev = arp_req_dev(net, r);
1250	if (IS_ERR(dev))
1251		return PTR_ERR(dev);
1252
1253	if (r->arp_flags & ATF_PUBL)
1254		return arp_req_delete_public(net, r, dev);
1255
1256	ip = ((struct sockaddr_in *)&r->arp_pa)->sin_addr.s_addr;
1257
1258	return arp_invalidate(dev, ip, true);
1259}
1260
1261/*
1262 *	Handle an ARP layer I/O control request.
1263 */
1264
1265int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
1266{
1267	struct arpreq r;
1268	__be32 *netmask;
1269	int err;
1270
1271	switch (cmd) {
1272	case SIOCDARP:
1273	case SIOCSARP:
1274		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1275			return -EPERM;
1276		fallthrough;
1277	case SIOCGARP:
1278		err = copy_from_user(&r, arg, sizeof(struct arpreq));
1279		if (err)
1280			return -EFAULT;
1281		break;
1282	default:
1283		return -EINVAL;
1284	}
1285
1286	if (r.arp_pa.sa_family != AF_INET)
1287		return -EPFNOSUPPORT;
1288
1289	if (!(r.arp_flags & ATF_PUBL) &&
1290	    (r.arp_flags & (ATF_NETMASK | ATF_DONTPUB)))
1291		return -EINVAL;
1292
1293	netmask = &((struct sockaddr_in *)&r.arp_netmask)->sin_addr.s_addr;
1294	if (!(r.arp_flags & ATF_NETMASK))
1295		*netmask = htonl(0xFFFFFFFFUL);
1296	else if (*netmask && *netmask != htonl(0xFFFFFFFFUL))
1297		return -EINVAL;
1298
1299	switch (cmd) {
1300	case SIOCDARP:
1301		rtnl_net_lock(net);
1302		err = arp_req_delete(net, &r);
1303		rtnl_net_unlock(net);
1304		break;
1305	case SIOCSARP:
1306		rtnl_net_lock(net);
1307		err = arp_req_set(net, &r);
1308		rtnl_net_unlock(net);
1309		break;
1310	case SIOCGARP:
1311		rcu_read_lock();
1312		err = arp_req_get(net, &r);
1313		rcu_read_unlock();
1314
1315		if (!err && copy_to_user(arg, &r, sizeof(r)))
1316			err = -EFAULT;
1317		break;
1318	}
1319
1320	return err;
1321}
1322
1323static int arp_netdev_event(struct notifier_block *this, unsigned long event,
1324			    void *ptr)
1325{
1326	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1327	struct netdev_notifier_change_info *change_info;
1328	struct in_device *in_dev;
1329	bool evict_nocarrier;
1330
1331	switch (event) {
1332	case NETDEV_CHANGEADDR:
1333		neigh_changeaddr(&arp_tbl, dev);
1334		rt_cache_flush(dev_net(dev));
1335		break;
1336	case NETDEV_CHANGE:
1337		change_info = ptr;
1338		if (change_info->flags_changed & IFF_NOARP)
1339			neigh_changeaddr(&arp_tbl, dev);
1340
1341		in_dev = __in_dev_get_rtnl(dev);
1342		if (!in_dev)
1343			evict_nocarrier = true;
1344		else
1345			evict_nocarrier = IN_DEV_ARP_EVICT_NOCARRIER(in_dev);
1346
1347		if (evict_nocarrier && !netif_carrier_ok(dev))
1348			neigh_carrier_down(&arp_tbl, dev);
1349		break;
1350	default:
1351		break;
1352	}
1353
1354	return NOTIFY_DONE;
1355}
1356
1357static struct notifier_block arp_netdev_notifier = {
1358	.notifier_call = arp_netdev_event,
1359};
1360
1361/* Note, that it is not on notifier chain.
1362   It is necessary, that this routine was called after route cache will be
1363   flushed.
1364 */
1365void arp_ifdown(struct net_device *dev)
1366{
1367	neigh_ifdown(&arp_tbl, dev);
1368}
1369
1370
1371/*
1372 *	Called once on startup.
1373 */
1374
1375static struct packet_type arp_packet_type __read_mostly = {
1376	.type =	cpu_to_be16(ETH_P_ARP),
1377	.func =	arp_rcv,
1378};
1379
1380#ifdef CONFIG_PROC_FS
1381#if IS_ENABLED(CONFIG_AX25)
1382
1383/*
1384 *	ax25 -> ASCII conversion
1385 */
1386static void ax2asc2(ax25_address *a, char *buf)
1387{
1388	char c, *s;
1389	int n;
1390
1391	for (n = 0, s = buf; n < 6; n++) {
1392		c = (a->ax25_call[n] >> 1) & 0x7F;
1393
1394		if (c != ' ')
1395			*s++ = c;
1396	}
1397
1398	*s++ = '-';
1399	n = (a->ax25_call[6] >> 1) & 0x0F;
1400	if (n > 9) {
1401		*s++ = '1';
1402		n -= 10;
1403	}
1404
1405	*s++ = n + '0';
1406	*s++ = '\0';
1407
1408	if (*buf == '\0' || *buf == '-') {
1409		buf[0] = '*';
1410		buf[1] = '\0';
1411	}
1412}
1413#endif /* CONFIG_AX25 */
1414
1415#define HBUFFERLEN 30
1416
1417static void arp_format_neigh_entry(struct seq_file *seq,
1418				   struct neighbour *n)
1419{
1420	char hbuffer[HBUFFERLEN];
1421	int k, j;
1422	char tbuf[16];
1423	struct net_device *dev = n->dev;
1424	int hatype = dev->type;
1425
1426	read_lock(&n->lock);
1427	/* Convert hardware address to XX:XX:XX:XX ... form. */
1428#if IS_ENABLED(CONFIG_AX25)
1429	if (hatype == ARPHRD_AX25 || hatype == ARPHRD_NETROM)
1430		ax2asc2((ax25_address *)n->ha, hbuffer);
1431	else {
1432#endif
1433	for (k = 0, j = 0; k < HBUFFERLEN - 3 && j < dev->addr_len; j++) {
1434		hbuffer[k++] = hex_asc_hi(n->ha[j]);
1435		hbuffer[k++] = hex_asc_lo(n->ha[j]);
1436		hbuffer[k++] = ':';
1437	}
1438	if (k != 0)
1439		--k;
1440	hbuffer[k] = 0;
1441#if IS_ENABLED(CONFIG_AX25)
1442	}
1443#endif
1444	sprintf(tbuf, "%pI4", n->primary_key);
1445	seq_printf(seq, "%-16s 0x%-10x0x%-10x%-17s     *        %s\n",
1446		   tbuf, hatype, arp_state_to_flags(n), hbuffer, dev->name);
1447	read_unlock(&n->lock);
1448}
1449
1450static void arp_format_pneigh_entry(struct seq_file *seq,
1451				    struct pneigh_entry *n)
1452{
1453	struct net_device *dev = n->dev;
1454	int hatype = dev ? dev->type : 0;
1455	char tbuf[16];
1456
1457	sprintf(tbuf, "%pI4", n->key);
1458	seq_printf(seq, "%-16s 0x%-10x0x%-10x%s     *        %s\n",
1459		   tbuf, hatype, ATF_PUBL | ATF_PERM, "00:00:00:00:00:00",
1460		   dev ? dev->name : "*");
1461}
1462
1463static int arp_seq_show(struct seq_file *seq, void *v)
1464{
1465	if (v == SEQ_START_TOKEN) {
1466		seq_puts(seq, "IP address       HW type     Flags       "
1467			      "HW address            Mask     Device\n");
1468	} else {
1469		struct neigh_seq_state *state = seq->private;
1470
1471		if (state->flags & NEIGH_SEQ_IS_PNEIGH)
1472			arp_format_pneigh_entry(seq, v);
1473		else
1474			arp_format_neigh_entry(seq, v);
1475	}
1476
1477	return 0;
1478}
1479
1480static void *arp_seq_start(struct seq_file *seq, loff_t *pos)
1481{
1482	/* Don't want to confuse "arp -a" w/ magic entries,
1483	 * so we tell the generic iterator to skip NUD_NOARP.
1484	 */
1485	return neigh_seq_start(seq, pos, &arp_tbl, NEIGH_SEQ_SKIP_NOARP);
1486}
1487
1488static const struct seq_operations arp_seq_ops = {
1489	.start	= arp_seq_start,
1490	.next	= neigh_seq_next,
1491	.stop	= neigh_seq_stop,
1492	.show	= arp_seq_show,
1493};
1494#endif /* CONFIG_PROC_FS */
1495
1496static int __net_init arp_net_init(struct net *net)
1497{
1498	if (!proc_create_net("arp", 0444, net->proc_net, &arp_seq_ops,
1499			sizeof(struct neigh_seq_state)))
1500		return -ENOMEM;
1501	return 0;
1502}
1503
1504static void __net_exit arp_net_exit(struct net *net)
1505{
1506	remove_proc_entry("arp", net->proc_net);
1507}
1508
1509static struct pernet_operations arp_net_ops = {
1510	.init = arp_net_init,
1511	.exit = arp_net_exit,
1512};
1513
1514void __init arp_init(void)
1515{
1516	neigh_table_init(NEIGH_ARP_TABLE, &arp_tbl);
1517
1518	dev_add_pack(&arp_packet_type);
1519	register_pernet_subsys(&arp_net_ops);
1520#ifdef CONFIG_SYSCTL
1521	neigh_sysctl_register(NULL, &arp_tbl.parms, NULL);
1522#endif
1523	register_netdevice_notifier(&arp_netdev_notifier);
1524}