/*
   *	IPv6 Address [auto]configuration
   *	Linux INET6 implementation
   *
   *	Authors:

   *	Pedro Roque		<roque@di.fc.ul.pt>

   *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
   *

   *	This program is free software; you can redistribute it and/or
   *      modify it under the terms of the GNU General Public License
   *      as published by the Free Software Foundation; either version
   *      2 of the License, or (at your option) any later version.
   */
  
  /*
   *	Changes:
   *
   *	Janos Farkas			:	delete timer on ifdown
   *	<chexum@bankinf.banki.hu>
   *	Andi Kleen			:	kill double kfree on module
   *						unload.
   *	Maciej W. Rozycki		:	FDDI support
   *	sekiya@USAGI			:	Don't send too many RS
   *						packets.
   *	yoshfuji@USAGI			:       Fixed interval between DAD
   *						packets.
   *	YOSHIFUJI Hideaki @USAGI	:	improved accuracy of
   *						address validation timer.
   *	YOSHIFUJI Hideaki @USAGI	:	Privacy Extensions (RFC3041)
   *						support.
   *	Yuji SEKIYA @USAGI		:	Don't assign a same IPv6
   *						address on a same interface.
   *	YOSHIFUJI Hideaki @USAGI	:	ARCnet support
   *	YOSHIFUJI Hideaki @USAGI	:	convert /proc/net/if_inet6 to
   *						seq_file.

   *	YOSHIFUJI Hideaki @USAGI	:	improved source address
   *						selection; consider scope,
   *						status etc.

   */

  #define pr_fmt(fmt) "IPv6: " fmt

  #include <linux/errno.h>
  #include <linux/types.h>

  #include <linux/kernel.h>

  #include <linux/socket.h>
  #include <linux/sockios.h>

  #include <linux/net.h>
  #include <linux/in6.h>
  #include <linux/netdevice.h>

  #include <linux/if_addr.h>

  #include <linux/if_arp.h>
  #include <linux/if_arcnet.h>
  #include <linux/if_infiniband.h>
  #include <linux/route.h>
  #include <linux/inetdevice.h>
  #include <linux/init.h>

  #include <linux/slab.h>

  #ifdef CONFIG_SYSCTL
  #include <linux/sysctl.h>
  #endif

  #include <linux/capability.h>

  #include <linux/delay.h>
  #include <linux/notifier.h>

  #include <linux/string.h>

  #include <linux/hash.h>

  #include <net/net_namespace.h>

  #include <net/sock.h>
  #include <net/snmp.h>

  #include <net/af_ieee802154.h>

  #include <net/firewire.h>

  #include <net/ipv6.h>
  #include <net/protocol.h>
  #include <net/ndisc.h>
  #include <net/ip6_route.h>
  #include <net/addrconf.h>
  #include <net/tcp.h>
  #include <net/ip.h>

  #include <net/netlink.h>

  #include <net/pkt_sched.h>

  #include <linux/if_tunnel.h>
  #include <linux/rtnetlink.h>

  #include <linux/netconf.h>

  #include <linux/random.h>

  #include <linux/uaccess.h>

  #include <asm/unaligned.h>

  
  #include <linux/proc_fs.h>
  #include <linux/seq_file.h>

  #include <linux/export.h>

  
  /* Set to 3 to get tracing... */
  #define ACONF_DEBUG 2
  
  #if ACONF_DEBUG >= 3

  #define ADBG(fmt, ...) printk(fmt, ##__VA_ARGS__)

  #else

  #define ADBG(fmt, ...) do { if (0) printk(fmt, ##__VA_ARGS__); } while (0)

  #endif
  
  #define	INFINITY_LIFE_TIME	0xFFFFFFFF

  
  static inline u32 cstamp_delta(unsigned long cstamp)
  {
  	return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
  }

  
  #ifdef CONFIG_SYSCTL

  static void addrconf_sysctl_register(struct inet6_dev *idev);

  static void addrconf_sysctl_unregister(struct inet6_dev *idev);
  #else
  static inline void addrconf_sysctl_register(struct inet6_dev *idev)
  {
  }
  
  static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
  {
  }

  #endif

  static void __ipv6_regen_rndid(struct inet6_dev *idev);
  static void __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);

  static void ipv6_regen_rndid(unsigned long data);

  static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);

  static int ipv6_count_addresses(struct inet6_dev *idev);
  
  /*
   *	Configured unicast address hash table
   */

  static struct hlist_head inet6_addr_lst[IN6_ADDR_HSIZE];

  static DEFINE_SPINLOCK(addrconf_hash_lock);

  static void addrconf_verify(void);
  static void addrconf_verify_rtnl(void);
  static void addrconf_verify_work(struct work_struct *);

  static struct workqueue_struct *addrconf_wq;
  static DECLARE_DELAYED_WORK(addr_chk_work, addrconf_verify_work);

  
  static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
  static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);

  static void addrconf_type_change(struct net_device *dev,
  				 unsigned long event);

  static int addrconf_ifdown(struct net_device *dev, int how);

  static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
  						  int plen,
  						  const struct net_device *dev,
  						  u32 flags, u32 noflags);

  static void addrconf_dad_start(struct inet6_ifaddr *ifp);

  static void addrconf_dad_work(struct work_struct *w);

  static void addrconf_dad_completed(struct inet6_ifaddr *ifp);

  static void addrconf_dad_run(struct inet6_dev *idev);

  static void addrconf_rs_timer(unsigned long data);
  static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
  static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);

  static void inet6_prefix_notify(int event, struct inet6_dev *idev,

  				struct prefix_info *pinfo);

  static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
  			       struct net_device *dev);

  static struct ipv6_devconf ipv6_devconf __read_mostly = {

  	.forwarding		= 0,
  	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
  	.mtu6			= IPV6_MIN_MTU,
  	.accept_ra		= 1,
  	.accept_redirects	= 1,
  	.autoconf		= 1,
  	.force_mld_version	= 0,

  	.mldv1_unsolicited_report_interval = 10 * HZ,
  	.mldv2_unsolicited_report_interval = HZ,

  	.dad_transmits		= 1,
  	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
  	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
  	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,

  	.use_tempaddr 		= 0,
  	.temp_valid_lft		= TEMP_VALID_LIFETIME,
  	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
  	.regen_max_retry	= REGEN_MAX_RETRY,
  	.max_desync_factor	= MAX_DESYNC_FACTOR,

  	.max_addresses		= IPV6_MAX_ADDRESSES,

  	.accept_ra_defrtr	= 1,

  	.accept_ra_pinfo	= 1,

  #ifdef CONFIG_IPV6_ROUTER_PREF
  	.accept_ra_rtr_pref	= 1,

  	.rtr_probe_interval	= 60 * HZ,

  #ifdef CONFIG_IPV6_ROUTE_INFO
  	.accept_ra_rt_info_max_plen = 0,
  #endif

  #endif

  	.proxy_ndp		= 0,

  	.accept_source_route	= 0,	/* we do not accept RH0 by default. */

  	.disable_ipv6		= 0,

  	.accept_dad		= 1,

  	.suppress_frag_ndisc	= 1,

  };

  static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {

  	.forwarding		= 0,
  	.hop_limit		= IPV6_DEFAULT_HOPLIMIT,
  	.mtu6			= IPV6_MIN_MTU,
  	.accept_ra		= 1,
  	.accept_redirects	= 1,
  	.autoconf		= 1,

  	.force_mld_version	= 0,
  	.mldv1_unsolicited_report_interval = 10 * HZ,
  	.mldv2_unsolicited_report_interval = HZ,

  	.dad_transmits		= 1,
  	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
  	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
  	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,

  	.use_tempaddr		= 0,
  	.temp_valid_lft		= TEMP_VALID_LIFETIME,
  	.temp_prefered_lft	= TEMP_PREFERRED_LIFETIME,
  	.regen_max_retry	= REGEN_MAX_RETRY,
  	.max_desync_factor	= MAX_DESYNC_FACTOR,

  	.max_addresses		= IPV6_MAX_ADDRESSES,

  	.accept_ra_defrtr	= 1,

  	.accept_ra_pinfo	= 1,

  #ifdef CONFIG_IPV6_ROUTER_PREF
  	.accept_ra_rtr_pref	= 1,

  	.rtr_probe_interval	= 60 * HZ,

  #ifdef CONFIG_IPV6_ROUTE_INFO
  	.accept_ra_rt_info_max_plen = 0,
  #endif

  #endif

  	.proxy_ndp		= 0,

  	.accept_source_route	= 0,	/* we do not accept RH0 by default. */

  	.disable_ipv6		= 0,

  	.accept_dad		= 1,

  	.suppress_frag_ndisc	= 1,

  };

  /* Check if a valid qdisc is available */

  static inline bool addrconf_qdisc_ok(const struct net_device *dev)

  {

  	return !qdisc_tx_is_noop(dev);

  }

  static void addrconf_del_rs_timer(struct inet6_dev *idev)

  {

  	if (del_timer(&idev->rs_timer))
  		__in6_dev_put(idev);
  }

  static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)

  {

  	if (cancel_delayed_work(&ifp->dad_work))

  		__in6_ifa_put(ifp);
  }

  static void addrconf_mod_rs_timer(struct inet6_dev *idev,
  				  unsigned long when)
  {
  	if (!timer_pending(&idev->rs_timer))
  		in6_dev_hold(idev);
  	mod_timer(&idev->rs_timer, jiffies + when);
  }

  static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
  				   unsigned long delay)

  {

  	if (!delayed_work_pending(&ifp->dad_work))

  		in6_ifa_hold(ifp);

  	mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);

  }

  static int snmp6_alloc_dev(struct inet6_dev *idev)
  {

  	int i;

  	if (snmp_mib_init((void __percpu **)idev->stats.ipv6,

  			  sizeof(struct ipstats_mib),
  			  __alignof__(struct ipstats_mib)) < 0)

  		goto err_ip;

  
  	for_each_possible_cpu(i) {
  		struct ipstats_mib *addrconf_stats;
  		addrconf_stats = per_cpu_ptr(idev->stats.ipv6[0], i);
  		u64_stats_init(&addrconf_stats->syncp);
  #if SNMP_ARRAY_SZ == 2
  		addrconf_stats = per_cpu_ptr(idev->stats.ipv6[1], i);
  		u64_stats_init(&addrconf_stats->syncp);
  #endif
  	}

  	idev->stats.icmpv6dev = kzalloc(sizeof(struct icmpv6_mib_device),
  					GFP_KERNEL);
  	if (!idev->stats.icmpv6dev)

  		goto err_icmp;

  	idev->stats.icmpv6msgdev = kzalloc(sizeof(struct icmpv6msg_mib_device),
  					   GFP_KERNEL);
  	if (!idev->stats.icmpv6msgdev)

  		goto err_icmpmsg;

  
  	return 0;

  err_icmpmsg:

  	kfree(idev->stats.icmpv6dev);

  err_icmp:

  	snmp_mib_free((void __percpu **)idev->stats.ipv6);

  err_ip:

  	return -ENOMEM;

  }

  static struct inet6_dev *ipv6_add_dev(struct net_device *dev)

  {
  	struct inet6_dev *ndev;
  
  	ASSERT_RTNL();
  
  	if (dev->mtu < IPV6_MIN_MTU)
  		return NULL;

  	ndev = kzalloc(sizeof(struct inet6_dev), GFP_KERNEL);

  	if (ndev == NULL)
  		return NULL;

  
  	rwlock_init(&ndev->lock);
  	ndev->dev = dev;

  	INIT_LIST_HEAD(&ndev->addr_list);

  	setup_timer(&ndev->rs_timer, addrconf_rs_timer,
  		    (unsigned long)ndev);

  	memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));

  	ndev->cnf.mtu6 = dev->mtu;
  	ndev->cnf.sysctl = NULL;
  	ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
  	if (ndev->nd_parms == NULL) {
  		kfree(ndev);
  		return NULL;
  	}

  	if (ndev->cnf.forwarding)
  		dev_disable_lro(dev);

  	/* We refer to the device */
  	dev_hold(dev);

  	if (snmp6_alloc_dev(ndev) < 0) {

  		ADBG(KERN_WARNING

  			"%s: cannot allocate memory for statistics; dev=%s.
  ",

  			__func__, dev->name);

  		neigh_parms_release(&nd_tbl, ndev->nd_parms);

  		dev_put(dev);
  		kfree(ndev);

  		return NULL;
  	}

  	if (snmp6_register_dev(ndev) < 0) {

  		ADBG(KERN_WARNING

  			"%s: cannot create /proc/net/dev_snmp6/%s
  ",

  			__func__, dev->name);

  		neigh_parms_release(&nd_tbl, ndev->nd_parms);
  		ndev->dead = 1;
  		in6_dev_finish_destroy(ndev);
  		return NULL;
  	}
  
  	/* One reference from device.  We must do this before
  	 * we invoke __ipv6_regen_rndid().
  	 */
  	in6_dev_hold(ndev);

  	if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
  		ndev->cnf.accept_dad = -1;

  #if IS_ENABLED(CONFIG_IPV6_SIT)

  	if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {

  		pr_info("%s: Disabled Multicast RS
  ", dev->name);

  		ndev->cnf.rtr_solicits = 0;
  	}
  #endif

  	INIT_LIST_HEAD(&ndev->tempaddr_list);

  	setup_timer(&ndev->regen_timer, ipv6_regen_rndid, (unsigned long)ndev);

  	if ((dev->flags&IFF_LOOPBACK) ||
  	    dev->type == ARPHRD_TUNNEL ||

  	    dev->type == ARPHRD_TUNNEL6 ||

  	    dev->type == ARPHRD_SIT ||

  	    dev->type == ARPHRD_NONE) {

  		ndev->cnf.use_tempaddr = -1;
  	} else {
  		in6_dev_hold(ndev);
  		ipv6_regen_rndid((unsigned long) ndev);
  	}

  	ndev->token = in6addr_any;

  	if (netif_running(dev) && addrconf_qdisc_ok(dev))

  		ndev->if_flags |= IF_READY;

  	ipv6_mc_init_dev(ndev);
  	ndev->tstamp = jiffies;

  	addrconf_sysctl_register(ndev);

  	/* protected by rtnl_lock */

  	rcu_assign_pointer(dev->ip6_ptr, ndev);

  	/* Join interface-local all-node multicast group */
  	ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allnodes);

  	/* Join all-node multicast group */

  	ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);

  	/* Join all-router multicast group if forwarding is set */

  	if (ndev->cnf.forwarding && (dev->flags & IFF_MULTICAST))

  		ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);

  	return ndev;
  }

  static struct inet6_dev *ipv6_find_idev(struct net_device *dev)

  {
  	struct inet6_dev *idev;
  
  	ASSERT_RTNL();

  	idev = __in6_dev_get(dev);
  	if (!idev) {
  		idev = ipv6_add_dev(dev);
  		if (!idev)

  			return NULL;
  	}

  	if (dev->flags&IFF_UP)
  		ipv6_mc_up(idev);
  	return idev;
  }

  static int inet6_netconf_msgsize_devconf(int type)
  {
  	int size =  NLMSG_ALIGN(sizeof(struct netconfmsg))
  		    + nla_total_size(4);	/* NETCONFA_IFINDEX */

  	/* type -1 is used for ALL */
  	if (type == -1 || type == NETCONFA_FORWARDING)

  		size += nla_total_size(4);

  #ifdef CONFIG_IPV6_MROUTE

  	if (type == -1 || type == NETCONFA_MC_FORWARDING)
  		size += nla_total_size(4);

  #endif

  	if (type == -1 || type == NETCONFA_PROXY_NEIGH)
  		size += nla_total_size(4);

  
  	return size;
  }
  
  static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
  				      struct ipv6_devconf *devconf, u32 portid,
  				      u32 seq, int event, unsigned int flags,
  				      int type)
  {
  	struct nlmsghdr  *nlh;
  	struct netconfmsg *ncm;
  
  	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct netconfmsg),
  			flags);
  	if (nlh == NULL)
  		return -EMSGSIZE;
  
  	ncm = nlmsg_data(nlh);
  	ncm->ncm_family = AF_INET6;
  
  	if (nla_put_s32(skb, NETCONFA_IFINDEX, ifindex) < 0)
  		goto nla_put_failure;

  	/* type -1 is used for ALL */
  	if ((type == -1 || type == NETCONFA_FORWARDING) &&

  	    nla_put_s32(skb, NETCONFA_FORWARDING, devconf->forwarding) < 0)
  		goto nla_put_failure;

  #ifdef CONFIG_IPV6_MROUTE

  	if ((type == -1 || type == NETCONFA_MC_FORWARDING) &&
  	    nla_put_s32(skb, NETCONFA_MC_FORWARDING,
  			devconf->mc_forwarding) < 0)
  		goto nla_put_failure;

  #endif

  	if ((type == -1 || type == NETCONFA_PROXY_NEIGH) &&
  	    nla_put_s32(skb, NETCONFA_PROXY_NEIGH, devconf->proxy_ndp) < 0)
  		goto nla_put_failure;

  	return nlmsg_end(skb, nlh);
  
  nla_put_failure:
  	nlmsg_cancel(skb, nlh);
  	return -EMSGSIZE;
  }

  void inet6_netconf_notify_devconf(struct net *net, int type, int ifindex,
  				  struct ipv6_devconf *devconf)

  {
  	struct sk_buff *skb;
  	int err = -ENOBUFS;
  
  	skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_ATOMIC);
  	if (skb == NULL)
  		goto errout;
  
  	err = inet6_netconf_fill_devconf(skb, ifindex, devconf, 0, 0,
  					 RTM_NEWNETCONF, 0, type);
  	if (err < 0) {
  		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
  		WARN_ON(err == -EMSGSIZE);
  		kfree_skb(skb);
  		goto errout;
  	}
  	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_ATOMIC);
  	return;
  errout:

  	rtnl_set_sk_err(net, RTNLGRP_IPV6_NETCONF, err);

  }

  static const struct nla_policy devconf_ipv6_policy[NETCONFA_MAX+1] = {
  	[NETCONFA_IFINDEX]	= { .len = sizeof(int) },
  	[NETCONFA_FORWARDING]	= { .len = sizeof(int) },

  	[NETCONFA_PROXY_NEIGH]	= { .len = sizeof(int) },

  };
  
  static int inet6_netconf_get_devconf(struct sk_buff *in_skb,

  				     struct nlmsghdr *nlh)

  {
  	struct net *net = sock_net(in_skb->sk);
  	struct nlattr *tb[NETCONFA_MAX+1];
  	struct netconfmsg *ncm;
  	struct sk_buff *skb;
  	struct ipv6_devconf *devconf;
  	struct inet6_dev *in6_dev;
  	struct net_device *dev;
  	int ifindex;
  	int err;
  
  	err = nlmsg_parse(nlh, sizeof(*ncm), tb, NETCONFA_MAX,
  			  devconf_ipv6_policy);
  	if (err < 0)
  		goto errout;
  
  	err = EINVAL;
  	if (!tb[NETCONFA_IFINDEX])
  		goto errout;
  
  	ifindex = nla_get_s32(tb[NETCONFA_IFINDEX]);
  	switch (ifindex) {
  	case NETCONFA_IFINDEX_ALL:
  		devconf = net->ipv6.devconf_all;
  		break;
  	case NETCONFA_IFINDEX_DEFAULT:
  		devconf = net->ipv6.devconf_dflt;
  		break;
  	default:
  		dev = __dev_get_by_index(net, ifindex);
  		if (dev == NULL)
  			goto errout;
  		in6_dev = __in6_dev_get(dev);
  		if (in6_dev == NULL)
  			goto errout;
  		devconf = &in6_dev->cnf;
  		break;
  	}
  
  	err = -ENOBUFS;
  	skb = nlmsg_new(inet6_netconf_msgsize_devconf(-1), GFP_ATOMIC);
  	if (skb == NULL)
  		goto errout;
  
  	err = inet6_netconf_fill_devconf(skb, ifindex, devconf,
  					 NETLINK_CB(in_skb).portid,
  					 nlh->nlmsg_seq, RTM_NEWNETCONF, 0,
  					 -1);
  	if (err < 0) {
  		/* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
  		WARN_ON(err == -EMSGSIZE);
  		kfree_skb(skb);
  		goto errout;
  	}
  	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
  errout:
  	return err;
  }

  static int inet6_netconf_dump_devconf(struct sk_buff *skb,
  				      struct netlink_callback *cb)
  {
  	struct net *net = sock_net(skb->sk);
  	int h, s_h;
  	int idx, s_idx;
  	struct net_device *dev;
  	struct inet6_dev *idev;
  	struct hlist_head *head;
  
  	s_h = cb->args[0];
  	s_idx = idx = cb->args[1];
  
  	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
  		idx = 0;
  		head = &net->dev_index_head[h];
  		rcu_read_lock();

  		cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^
  			  net->dev_base_seq;

  		hlist_for_each_entry_rcu(dev, head, index_hlist) {
  			if (idx < s_idx)
  				goto cont;
  			idev = __in6_dev_get(dev);
  			if (!idev)
  				goto cont;
  
  			if (inet6_netconf_fill_devconf(skb, dev->ifindex,
  						       &idev->cnf,
  						       NETLINK_CB(cb->skb).portid,
  						       cb->nlh->nlmsg_seq,
  						       RTM_NEWNETCONF,
  						       NLM_F_MULTI,
  						       -1) <= 0) {
  				rcu_read_unlock();
  				goto done;
  			}

  			nl_dump_check_consistent(cb, nlmsg_hdr(skb));

  cont:
  			idx++;
  		}
  		rcu_read_unlock();
  	}
  	if (h == NETDEV_HASHENTRIES) {
  		if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_ALL,
  					       net->ipv6.devconf_all,
  					       NETLINK_CB(cb->skb).portid,
  					       cb->nlh->nlmsg_seq,
  					       RTM_NEWNETCONF, NLM_F_MULTI,
  					       -1) <= 0)
  			goto done;
  		else
  			h++;
  	}
  	if (h == NETDEV_HASHENTRIES + 1) {
  		if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_DEFAULT,
  					       net->ipv6.devconf_dflt,
  					       NETLINK_CB(cb->skb).portid,
  					       cb->nlh->nlmsg_seq,
  					       RTM_NEWNETCONF, NLM_F_MULTI,
  					       -1) <= 0)
  			goto done;
  		else
  			h++;
  	}
  done:
  	cb->args[0] = h;
  	cb->args[1] = idx;
  
  	return skb->len;
  }

  #ifdef CONFIG_SYSCTL
  static void dev_forward_change(struct inet6_dev *idev)
  {
  	struct net_device *dev;
  	struct inet6_ifaddr *ifa;

  
  	if (!idev)
  		return;
  	dev = idev->dev;

  	if (idev->cnf.forwarding)
  		dev_disable_lro(dev);

  	if (dev->flags & IFF_MULTICAST) {

  		if (idev->cnf.forwarding) {

  			ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);

  			ipv6_dev_mc_inc(dev, &in6addr_interfacelocal_allrouters);
  			ipv6_dev_mc_inc(dev, &in6addr_sitelocal_allrouters);
  		} else {

  			ipv6_dev_mc_dec(dev, &in6addr_linklocal_allrouters);

  			ipv6_dev_mc_dec(dev, &in6addr_interfacelocal_allrouters);
  			ipv6_dev_mc_dec(dev, &in6addr_sitelocal_allrouters);
  		}

  	}

  
  	list_for_each_entry(ifa, &idev->addr_list, if_list) {

  		if (ifa->flags&IFA_F_TENTATIVE)
  			continue;

  		if (idev->cnf.forwarding)
  			addrconf_join_anycast(ifa);
  		else
  			addrconf_leave_anycast(ifa);
  	}

  	inet6_netconf_notify_devconf(dev_net(dev), NETCONFA_FORWARDING,
  				     dev->ifindex, &idev->cnf);

  }

  static void addrconf_forward_change(struct net *net, __s32 newf)

  {
  	struct net_device *dev;
  	struct inet6_dev *idev;

  	for_each_netdev(net, dev) {

  		idev = __in6_dev_get(dev);
  		if (idev) {

  			int changed = (!idev->cnf.forwarding) ^ (!newf);
  			idev->cnf.forwarding = newf;

  			if (changed)
  				dev_forward_change(idev);
  		}

  	}

  }

  static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)

  {

  	struct net *net;

  	int old;
  
  	if (!rtnl_trylock())
  		return restart_syscall();

  
  	net = (struct net *)table->extra2;

  	old = *p;
  	*p = newf;

  	if (p == &net->ipv6.devconf_dflt->forwarding) {

  		if ((!newf) ^ (!old))
  			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
  						     NETCONFA_IFINDEX_DEFAULT,
  						     net->ipv6.devconf_dflt);

  		rtnl_unlock();
  		return 0;

  	}

  	if (p == &net->ipv6.devconf_all->forwarding) {

  		net->ipv6.devconf_dflt->forwarding = newf;
  		addrconf_forward_change(net, newf);

  		if ((!newf) ^ (!old))
  			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
  						     NETCONFA_IFINDEX_ALL,
  						     net->ipv6.devconf_all);

  	} else if ((!newf) ^ (!old))

  		dev_forward_change((struct inet6_dev *)table->extra1);

  	rtnl_unlock();

  	if (newf)

  		rt6_purge_dflt_routers(net);

  	return 1;

  }

  #endif

  /* Nobody refers to this ifaddr, destroy it */

  void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
  {

  	WARN_ON(!hlist_unhashed(&ifp->addr_lst));

  #ifdef NET_REFCNT_DEBUG

  	pr_debug("%s
  ", __func__);

  #endif
  
  	in6_dev_put(ifp->idev);

  	if (cancel_delayed_work(&ifp->dad_work))
  		pr_notice("delayed DAD work was pending while freeing ifa=%p
  ",
  			  ifp);

  	if (ifp->state != INET6_IFADDR_STATE_DEAD) {

  		pr_warn("Freeing alive inet6 address %p
  ", ifp);

  		return;
  	}

  	ip6_rt_put(ifp->rt);

  	kfree_rcu(ifp, rcu);

  }

  static void
  ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
  {

  	struct list_head *p;

  	int ifp_scope = ipv6_addr_src_scope(&ifp->addr);

  
  	/*
  	 * Each device address list is sorted in order of scope -
  	 * global before linklocal.
  	 */

  	list_for_each(p, &idev->addr_list) {
  		struct inet6_ifaddr *ifa
  			= list_entry(p, struct inet6_ifaddr, if_list);

  		if (ifp_scope >= ipv6_addr_src_scope(&ifa->addr))

  			break;
  	}

  	list_add_tail(&ifp->if_list, p);

  }

  static u32 inet6_addr_hash(const struct in6_addr *addr)

  {

  	return hash_32(ipv6_addr_hash(addr), IN6_ADDR_HSIZE_SHIFT);

  }

  /* On success it returns ifp with increased reference count */
  
  static struct inet6_ifaddr *

  ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
  	      const struct in6_addr *peer_addr, int pfxlen,

  	      int scope, u32 flags, u32 valid_lft, u32 prefered_lft)

  {
  	struct inet6_ifaddr *ifa = NULL;
  	struct rt6_info *rt;

  	unsigned int hash;

  	int err = 0;

  	int addr_type = ipv6_addr_type(addr);
  
  	if (addr_type == IPV6_ADDR_ANY ||
  	    addr_type & IPV6_ADDR_MULTICAST ||
  	    (!(idev->dev->flags & IFF_LOOPBACK) &&
  	     addr_type & IPV6_ADDR_LOOPBACK))
  		return ERR_PTR(-EADDRNOTAVAIL);

  	rcu_read_lock_bh();

  	if (idev->dead) {
  		err = -ENODEV;			/*XXX*/
  		goto out2;
  	}

  	if (idev->cnf.disable_ipv6) {

  		err = -EACCES;
  		goto out2;
  	}

  	spin_lock(&addrconf_hash_lock);

  
  	/* Ignore adding duplicate addresses on an interface */

  	if (ipv6_chk_same_addr(dev_net(idev->dev), addr, idev->dev)) {

  		ADBG("ipv6_add_addr: already assigned
  ");

  		err = -EEXIST;
  		goto out;
  	}

  	ifa = kzalloc(sizeof(struct inet6_ifaddr), GFP_ATOMIC);

  
  	if (ifa == NULL) {

  		ADBG("ipv6_add_addr: malloc failed
  ");

  		err = -ENOBUFS;
  		goto out;
  	}

  	rt = addrconf_dst_alloc(idev, addr, false);

  	if (IS_ERR(rt)) {
  		err = PTR_ERR(rt);
  		goto out;
  	}

  	neigh_parms_data_state_setall(idev->nd_parms);

  	ifa->addr = *addr;

  	if (peer_addr)
  		ifa->peer_addr = *peer_addr;

  
  	spin_lock_init(&ifa->lock);

  	spin_lock_init(&ifa->state_lock);

  	INIT_DELAYED_WORK(&ifa->dad_work, addrconf_dad_work);

  	INIT_HLIST_NODE(&ifa->addr_lst);

  	ifa->scope = scope;
  	ifa->prefix_len = pfxlen;
  	ifa->flags = flags | IFA_F_TENTATIVE;

  	ifa->valid_lft = valid_lft;
  	ifa->prefered_lft = prefered_lft;

  	ifa->cstamp = ifa->tstamp = jiffies;

  	ifa->tokenized = false;

  	ifa->rt = rt;

  	ifa->idev = idev;
  	in6_dev_hold(idev);
  	/* For caller */
  	in6_ifa_hold(ifa);
  
  	/* Add to big hash table */

  	hash = inet6_addr_hash(addr);

  	hlist_add_head_rcu(&ifa->addr_lst, &inet6_addr_lst[hash]);

  	spin_unlock(&addrconf_hash_lock);

  
  	write_lock(&idev->lock);
  	/* Add to inet6_dev unicast addr list. */

  	ipv6_link_dev_addr(idev, ifa);

  	if (ifa->flags&IFA_F_TEMPORARY) {

  		list_add(&ifa->tmp_list, &idev->tempaddr_list);

  		in6_ifa_hold(ifa);
  	}

  	in6_ifa_hold(ifa);
  	write_unlock(&idev->lock);
  out2:

  	rcu_read_unlock_bh();

  	if (likely(err == 0))

  		inet6addr_notifier_call_chain(NETDEV_UP, ifa);

  	else {
  		kfree(ifa);
  		ifa = ERR_PTR(err);
  	}
  
  	return ifa;
  out:

  	spin_unlock(&addrconf_hash_lock);

  	goto out2;
  }

  enum cleanup_prefix_rt_t {
  	CLEANUP_PREFIX_RT_NOP,    /* no cleanup action for prefix route */
  	CLEANUP_PREFIX_RT_DEL,    /* delete the prefix route */
  	CLEANUP_PREFIX_RT_EXPIRE, /* update the lifetime of the prefix route */
  };
  
  /*
   * Check, whether the prefix for ifp would still need a prefix route
   * after deleting ifp. The function returns one of the CLEANUP_PREFIX_RT_*
   * constants.
   *
   * 1) we don't purge prefix if address was not permanent.
   *    prefix is managed by its own lifetime.
   * 2) we also don't purge, if the address was IFA_F_NOPREFIXROUTE.
   * 3) if there are no addresses, delete prefix.
   * 4) if there are still other permanent address(es),
   *    corresponding prefix is still permanent.
   * 5) if there are still other addresses with IFA_F_NOPREFIXROUTE,
   *    don't purge the prefix, assume user space is managing it.
   * 6) otherwise, update prefix lifetime to the
   *    longest valid lifetime among the corresponding
   *    addresses on the device.
   *    Note: subsequent RA will update lifetime.
   **/
  static enum cleanup_prefix_rt_t
  check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
  {
  	struct inet6_ifaddr *ifa;
  	struct inet6_dev *idev = ifp->idev;
  	unsigned long lifetime;
  	enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_DEL;
  
  	*expires = jiffies;
  
  	list_for_each_entry(ifa, &idev->addr_list, if_list) {
  		if (ifa == ifp)
  			continue;
  		if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
  				       ifp->prefix_len))
  			continue;
  		if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
  			return CLEANUP_PREFIX_RT_NOP;
  
  		action = CLEANUP_PREFIX_RT_EXPIRE;
  
  		spin_lock(&ifa->lock);
  
  		lifetime = addrconf_timeout_fixup(ifa->valid_lft, HZ);
  		/*
  		 * Note: Because this address is
  		 * not permanent, lifetime <
  		 * LONG_MAX / HZ here.
  		 */
  		if (time_before(*expires, ifa->tstamp + lifetime * HZ))
  			*expires = ifa->tstamp + lifetime * HZ;
  		spin_unlock(&ifa->lock);
  	}
  
  	return action;
  }
  
  static void
  cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires, bool del_rt)
  {
  	struct rt6_info *rt;
  
  	rt = addrconf_get_prefix_route(&ifp->addr,
  				       ifp->prefix_len,
  				       ifp->idev->dev,
  				       0, RTF_GATEWAY | RTF_DEFAULT);
  	if (rt) {
  		if (del_rt)
  			ip6_del_rt(rt);
  		else {
  			if (!(rt->rt6i_flags & RTF_EXPIRES))
  				rt6_set_expires(rt, expires);
  			ip6_rt_put(rt);
  		}
  	}
  }

  /* This function wants to get referenced ifp and releases it before return */
  
  static void ipv6_del_addr(struct inet6_ifaddr *ifp)
  {

  	int state;

  	enum cleanup_prefix_rt_t action = CLEANUP_PREFIX_RT_NOP;
  	unsigned long expires;

  	ASSERT_RTNL();

  	spin_lock_bh(&ifp->state_lock);
  	state = ifp->state;

  	ifp->state = INET6_IFADDR_STATE_DEAD;

  	spin_unlock_bh(&ifp->state_lock);
  
  	if (state == INET6_IFADDR_STATE_DEAD)
  		goto out;

  	spin_lock_bh(&addrconf_hash_lock);
  	hlist_del_init_rcu(&ifp->addr_lst);

  	spin_unlock_bh(&addrconf_hash_lock);

  	write_lock_bh(&ifp->idev->lock);

  	if (ifp->flags&IFA_F_TEMPORARY) {

  		list_del(&ifp->tmp_list);
  		if (ifp->ifpub) {
  			in6_ifa_put(ifp->ifpub);
  			ifp->ifpub = NULL;

  		}

  		__in6_ifa_put(ifp);

  	}

  	if (ifp->flags & IFA_F_PERMANENT && !(ifp->flags & IFA_F_NOPREFIXROUTE))
  		action = check_cleanup_prefix_route(ifp, &expires);

  	list_del_init(&ifp->if_list);
  	__in6_ifa_put(ifp);
  
  	write_unlock_bh(&ifp->idev->lock);

  	addrconf_del_dad_work(ifp);

  	ipv6_ifa_notify(RTM_DELADDR, ifp);

  	inet6addr_notifier_call_chain(NETDEV_DOWN, ifp);

  	if (action != CLEANUP_PREFIX_RT_NOP) {
  		cleanup_prefix_route(ifp, expires,
  			action == CLEANUP_PREFIX_RT_DEL);

  	}

  	/* clean up prefsrc entries */
  	rt6_remove_prefsrc(ifp);

  out:

  	in6_ifa_put(ifp);
  }

  static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *ift)
  {
  	struct inet6_dev *idev = ifp->idev;
  	struct in6_addr addr, *tmpaddr;

  	unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_tstamp, age;

  	unsigned long regen_advance;

  	int tmp_plen;
  	int ret = 0;

  	u32 addr_flags;

  	unsigned long now = jiffies;

  	write_lock_bh(&idev->lock);

  	if (ift) {
  		spin_lock_bh(&ift->lock);
  		memcpy(&addr.s6_addr[8], &ift->addr.s6_addr[8], 8);
  		spin_unlock_bh(&ift->lock);
  		tmpaddr = &addr;
  	} else {
  		tmpaddr = NULL;
  	}
  retry:
  	in6_dev_hold(idev);
  	if (idev->cnf.use_tempaddr <= 0) {

  		write_unlock_bh(&idev->lock);

  		pr_info("%s: use_tempaddr is disabled
  ", __func__);

  		in6_dev_put(idev);
  		ret = -1;
  		goto out;
  	}
  	spin_lock_bh(&ifp->lock);
  	if (ifp->regen_count++ >= idev->cnf.regen_max_retry) {
  		idev->cnf.use_tempaddr = -1;	/*XXX*/
  		spin_unlock_bh(&ifp->lock);

  		write_unlock_bh(&idev->lock);

  		pr_warn("%s: regeneration time exceeded - disabled temporary address support
  ",
  			__func__);

  		in6_dev_put(idev);
  		ret = -1;
  		goto out;
  	}
  	in6_ifa_hold(ifp);
  	memcpy(addr.s6_addr, ifp->addr.s6_addr, 8);

  	__ipv6_try_regen_rndid(idev, tmpaddr);

  	memcpy(&addr.s6_addr[8], idev->rndid, 8);

  	age = (now - ifp->tstamp) / HZ;

  	tmp_valid_lft = min_t(__u32,
  			      ifp->valid_lft,

  			      idev->cnf.temp_valid_lft + age);

  	tmp_prefered_lft = min_t(__u32,
  				 ifp->prefered_lft,

  				 idev->cnf.temp_prefered_lft + age -

  				 idev->cnf.max_desync_factor);

  	tmp_plen = ifp->prefix_len;

  	tmp_tstamp = ifp->tstamp;
  	spin_unlock_bh(&ifp->lock);

  	regen_advance = idev->cnf.regen_max_retry *

  	                idev->cnf.dad_transmits *

  	                NEIGH_VAR(idev->nd_parms, RETRANS_TIME) / HZ;

  	write_unlock_bh(&idev->lock);

  	/* A temporary address is created only if this calculated Preferred
  	 * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
  	 * an implementation must not create a temporary address with a zero
  	 * Preferred Lifetime.

  	 * Use age calculation as in addrconf_verify to avoid unnecessary
  	 * temporary addresses being generated.

  	 */

  	age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
  	if (tmp_prefered_lft <= regen_advance + age) {

  		in6_ifa_put(ifp);
  		in6_dev_put(idev);
  		ret = -1;
  		goto out;
  	}

  	addr_flags = IFA_F_TEMPORARY;
  	/* set in addrconf_prefix_rcv() */
  	if (ifp->flags & IFA_F_OPTIMISTIC)
  		addr_flags |= IFA_F_OPTIMISTIC;

  	ift = ipv6_add_addr(idev, &addr, NULL, tmp_plen,
  			    ipv6_addr_scope(&addr), addr_flags,
  			    tmp_valid_lft, tmp_prefered_lft);
  	if (IS_ERR(ift)) {

  		in6_ifa_put(ifp);
  		in6_dev_put(idev);

  		pr_info("%s: retry temporary address regeneration
  ", __func__);

  		tmpaddr = &addr;

  		write_lock_bh(&idev->lock);

  		goto retry;
  	}
  
  	spin_lock_bh(&ift->lock);
  	ift->ifpub = ifp;

  	ift->cstamp = now;

  	ift->tstamp = tmp_tstamp;
  	spin_unlock_bh(&ift->lock);

  	addrconf_dad_start(ift);

  	in6_ifa_put(ift);
  	in6_dev_put(idev);
  out:
  	return ret;
  }

  
  /*

   *	Choose an appropriate source address (RFC3484)

   */

  enum {
  	IPV6_SADDR_RULE_INIT = 0,
  	IPV6_SADDR_RULE_LOCAL,
  	IPV6_SADDR_RULE_SCOPE,
  	IPV6_SADDR_RULE_PREFERRED,
  #ifdef CONFIG_IPV6_MIP6
  	IPV6_SADDR_RULE_HOA,
  #endif
  	IPV6_SADDR_RULE_OIF,
  	IPV6_SADDR_RULE_LABEL,

  	IPV6_SADDR_RULE_PRIVACY,

  	IPV6_SADDR_RULE_ORCHID,
  	IPV6_SADDR_RULE_PREFIX,
  	IPV6_SADDR_RULE_MAX
  };

  struct ipv6_saddr_score {

  	int			rule;
  	int			addr_type;
  	struct inet6_ifaddr	*ifa;
  	DECLARE_BITMAP(scorebits, IPV6_SADDR_RULE_MAX);
  	int			scopedist;
  	int			matchlen;

  };

  struct ipv6_saddr_dst {

  	const struct in6_addr *addr;

  	int ifindex;
  	int scope;
  	int label;

  	unsigned int prefs;

  };

  static inline int ipv6_saddr_preferred(int type)

  {

  	if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|IPV6_ADDR_LOOPBACK))

  		return 1;
  	return 0;

  }

  static int ipv6_get_saddr_eval(struct net *net,
  			       struct ipv6_saddr_score *score,

  			       struct ipv6_saddr_dst *dst,
  			       int i)
  {
  	int ret;
  
  	if (i <= score->rule) {
  		switch (i) {
  		case IPV6_SADDR_RULE_SCOPE:
  			ret = score->scopedist;
  			break;
  		case IPV6_SADDR_RULE_PREFIX:
  			ret = score->matchlen;
  			break;
  		default:
  			ret = !!test_bit(i, score->scorebits);
  		}
  		goto out;
  	}
  
  	switch (i) {
  	case IPV6_SADDR_RULE_INIT:
  		/* Rule 0: remember if hiscore is not ready yet */
  		ret = !!score->ifa;
  		break;
  	case IPV6_SADDR_RULE_LOCAL:
  		/* Rule 1: Prefer same address */
  		ret = ipv6_addr_equal(&score->ifa->addr, dst->addr);
  		break;
  	case IPV6_SADDR_RULE_SCOPE:
  		/* Rule 2: Prefer appropriate scope
  		 *
  		 *      ret
  		 *       ^
  		 *    -1 |  d 15
  		 *    ---+--+-+---> scope
  		 *       |
  		 *       |             d is scope of the destination.
  		 *  B-d  |  \
  		 *       |   \      <- smaller scope is better if

  		 *  B-15 |    \        if scope is enough for destination.

  		 *       |             ret = B - scope (-1 <= scope >= d <= 15).
  		 * d-C-1 | /
  		 *       |/         <- greater is better
  		 *   -C  /             if scope is not enough for destination.
  		 *      /|             ret = scope - C (-1 <= d < scope <= 15).
  		 *
  		 * d - C - 1 < B -15 (for all -1 <= d <= 15).
  		 * C > d + 14 - B >= 15 + 14 - B = 29 - B.
  		 * Assume B = 0 and we get C > 29.
  		 */
  		ret = __ipv6_addr_src_scope(score->addr_type);
  		if (ret >= dst->scope)
  			ret = -ret;
  		else
  			ret -= 128;	/* 30 is enough */
  		score->scopedist = ret;
  		break;
  	case IPV6_SADDR_RULE_PREFERRED:
  		/* Rule 3: Avoid deprecated and optimistic addresses */
  		ret = ipv6_saddr_preferred(score->addr_type) ||
  		      !(score->ifa->flags & (IFA_F_DEPRECATED|IFA_F_OPTIMISTIC));
  		break;
  #ifdef CONFIG_IPV6_MIP6
  	case IPV6_SADDR_RULE_HOA:

  	    {

  		/* Rule 4: Prefer home address */

  		int prefhome = !(dst->prefs & IPV6_PREFER_SRC_COA);
  		ret = !(score->ifa->flags & IFA_F_HOMEADDRESS) ^ prefhome;

  		break;

  	    }

  #endif
  	case IPV6_SADDR_RULE_OIF:
  		/* Rule 5: Prefer outgoing interface */
  		ret = (!dst->ifindex ||
  		       dst->ifindex == score->ifa->idev->dev->ifindex);
  		break;
  	case IPV6_SADDR_RULE_LABEL:
  		/* Rule 6: Prefer matching label */

  		ret = ipv6_addr_label(net,
  				      &score->ifa->addr, score->addr_type,

  				      score->ifa->idev->dev->ifindex) == dst->label;
  		break;

  	case IPV6_SADDR_RULE_PRIVACY:

  	    {

  		/* Rule 7: Prefer public address

  		 * Note: prefer temporary address if use_tempaddr >= 2

  		 */

  		int preftmp = dst->prefs & (IPV6_PREFER_SRC_PUBLIC|IPV6_PREFER_SRC_TMP) ?
  				!!(dst->prefs & IPV6_PREFER_SRC_TMP) :
  				score->ifa->idev->cnf.use_tempaddr >= 2;
  		ret = (!(score->ifa->flags & IFA_F_TEMPORARY)) ^ preftmp;

  		break;

  	    }

  	case IPV6_SADDR_RULE_ORCHID:
  		/* Rule 8-: Prefer ORCHID vs ORCHID or
  		 *	    non-ORCHID vs non-ORCHID
  		 */
  		ret = !(ipv6_addr_orchid(&score->ifa->addr) ^
  			ipv6_addr_orchid(dst->addr));
  		break;
  	case IPV6_SADDR_RULE_PREFIX:
  		/* Rule 8: Use longest matching prefix */

  		ret = ipv6_addr_diff(&score->ifa->addr, dst->addr);
  		if (ret > score->ifa->prefix_len)
  			ret = score->ifa->prefix_len;
  		score->matchlen = ret;

  		break;
  	default:
  		ret = 0;
  	}
  
  	if (ret)
  		__set_bit(i, score->scorebits);
  	score->rule = i;
  out:
  	return ret;
  }

  int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,

  		       const struct in6_addr *daddr, unsigned int prefs,

  		       struct in6_addr *saddr)

  {

  	struct ipv6_saddr_score scores[2],
  				*score = &scores[0], *hiscore = &scores[1];

  	struct ipv6_saddr_dst dst;

  	struct net_device *dev;

  	int dst_type;

  	dst_type = __ipv6_addr_type(daddr);
  	dst.addr = daddr;
  	dst.ifindex = dst_dev ? dst_dev->ifindex : 0;
  	dst.scope = __ipv6_addr_src_scope(dst_type);

  	dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);

  	dst.prefs = prefs;

  
  	hiscore->rule = -1;
  	hiscore->ifa = NULL;

  	rcu_read_lock();

  	for_each_netdev_rcu(net, dev) {

  		struct inet6_dev *idev;

  		/* Candidate Source Address (section 4)

  		 *  - multicast and link-local destination address,
  		 *    the set of candidate source address MUST only
  		 *    include addresses assigned to interfaces
  		 *    belonging to the same link as the outgoing
  		 *    interface.
  		 * (- For site-local destination addresses, the
  		 *    set of candidate source addresses MUST only
  		 *    include addresses assigned to interfaces
  		 *    belonging to the same site as the outgoing
  		 *    interface.)
  		 */

  		if (((dst_type & IPV6_ADDR_MULTICAST) ||
  		     dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL) &&
  		    dst.ifindex && dev->ifindex != dst.ifindex)

  			continue;

  		idev = __in6_dev_get(dev);

  		if (!idev)
  			continue;
  
  		read_lock_bh(&idev->lock);

  		list_for_each_entry(score->ifa, &idev->addr_list, if_list) {

  			int i;

  			/*

  			 * - Tentative Address (RFC2462 section 5.4)
  			 *  - A tentative address is not considered
  			 *    "assigned to an interface" in the traditional

  			 *    sense, unless it is also flagged as optimistic.

  			 * - Candidate Source Address (section 4)

  			 *  - In any case, anycast addresses, multicast
  			 *    addresses, and the unspecified address MUST
  			 *    NOT be included in a candidate set.
  			 */

  			if ((score->ifa->flags & IFA_F_TENTATIVE) &&
  			    (!(score->ifa->flags & IFA_F_OPTIMISTIC)))

  				continue;

  
  			score->addr_type = __ipv6_addr_type(&score->ifa->addr);
  
  			if (unlikely(score->addr_type == IPV6_ADDR_ANY ||
  				     score->addr_type & IPV6_ADDR_MULTICAST)) {

  				LIMIT_NETDEBUG(KERN_DEBUG

  					       "ADDRCONF: unspecified / multicast address "

  					       "assigned as unicast address on %s",
  					       dev->name);
  				continue;
  			}

  			score->rule = -1;
  			bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
  
  			for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
  				int minihiscore, miniscore;

  				minihiscore = ipv6_get_saddr_eval(net, hiscore, &dst, i);
  				miniscore = ipv6_get_saddr_eval(net, score, &dst, i);

  
  				if (minihiscore > miniscore) {
  					if (i == IPV6_SADDR_RULE_SCOPE &&
  					    score->scopedist > 0) {
  						/*
  						 * special case:
  						 * each remaining entry
  						 * has too small (not enough)
  						 * scope, because ifa entries
  						 * are sorted by their scope
  						 * values.
  						 */
  						goto try_nextdev;
  					}
  					break;
  				} else if (minihiscore < miniscore) {

  					if (hiscore->ifa)
  						in6_ifa_put(hiscore->ifa);
  
  					in6_ifa_hold(score->ifa);

  					swap(hiscore, score);

  
  					/* restore our iterator */
  					score->ifa = hiscore->ifa;
  
  					break;

  				}

  			}

  		}

  try_nextdev:

  		read_unlock_bh(&idev->lock);

  	}

  	rcu_read_unlock();

  	if (!hiscore->ifa)

  		return -EADDRNOTAVAIL;

  	*saddr = hiscore->ifa->addr;

  	in6_ifa_put(hiscore->ifa);

  	return 0;

  }

  EXPORT_SYMBOL(ipv6_dev_get_saddr);

  int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,

  		      u32 banned_flags)

  {
  	struct inet6_ifaddr *ifp;
  	int err = -EADDRNOTAVAIL;

  	list_for_each_entry_reverse(ifp, &idev->addr_list, if_list) {
  		if (ifp->scope > IFA_LINK)
  			break;

  		if (ifp->scope == IFA_LINK &&
  		    !(ifp->flags & banned_flags)) {
  			*addr = ifp->addr;
  			err = 0;
  			break;
  		}
  	}
  	return err;
  }

  int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,

  		    u32 banned_flags)

  {
  	struct inet6_dev *idev;
  	int err = -EADDRNOTAVAIL;

  	rcu_read_lock();

  	idev = __in6_dev_get(dev);
  	if (idev) {

  		read_lock_bh(&idev->lock);

  		err = __ipv6_get_lladdr(idev, addr, banned_flags);

  		read_unlock_bh(&idev->lock);
  	}

  	rcu_read_unlock();

  	return err;
  }
  
  static int ipv6_count_addresses(struct inet6_dev *idev)
  {
  	int cnt = 0;
  	struct inet6_ifaddr *ifp;
  
  	read_lock_bh(&idev->lock);

  	list_for_each_entry(ifp, &idev->addr_list, if_list)

  		cnt++;
  	read_unlock_bh(&idev->lock);
  	return cnt;
  }

  int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,

  		  const struct net_device *dev, int strict)

  {

  	struct inet6_ifaddr *ifp;

  	unsigned int hash = inet6_addr_hash(addr);

  	rcu_read_lock_bh();

  	hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {

  		if (!net_eq(dev_net(ifp->idev->dev), net))

  			continue;

  		if (ipv6_addr_equal(&ifp->addr, addr) &&

  		    !(ifp->flags&IFA_F_TENTATIVE) &&
  		    (dev == NULL || ifp->idev->dev == dev ||
  		     !(ifp->scope&(IFA_LINK|IFA_HOST) || strict))) {
  			rcu_read_unlock_bh();
  			return 1;

  		}
  	}

  	rcu_read_unlock_bh();
  	return 0;

  }

  EXPORT_SYMBOL(ipv6_chk_addr);

  static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
  			       struct net_device *dev)

  {

  	unsigned int hash = inet6_addr_hash(addr);

  	struct inet6_ifaddr *ifp;

  	hlist_for_each_entry(ifp, &inet6_addr_lst[hash], addr_lst) {

  		if (!net_eq(dev_net(ifp->idev->dev), net))

  			continue;

  		if (ipv6_addr_equal(&ifp->addr, addr)) {
  			if (dev == NULL || ifp->idev->dev == dev)

  				return true;

  		}
  	}

  	return false;

  }

  /* Compares an address/prefix_len with addresses on device @dev.
   * If one is found it returns true.
   */
  bool ipv6_chk_custom_prefix(const struct in6_addr *addr,
  	const unsigned int prefix_len, struct net_device *dev)
  {
  	struct inet6_dev *idev;
  	struct inet6_ifaddr *ifa;
  	bool ret = false;
  
  	rcu_read_lock();
  	idev = __in6_dev_get(dev);
  	if (idev) {
  		read_lock_bh(&idev->lock);
  		list_for_each_entry(ifa, &idev->addr_list, if_list) {
  			ret = ipv6_prefix_equal(addr, &ifa->addr, prefix_len);
  			if (ret)
  				break;
  		}
  		read_unlock_bh(&idev->lock);
  	}
  	rcu_read_unlock();
  
  	return ret;
  }
  EXPORT_SYMBOL(ipv6_chk_custom_prefix);

  int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)

  {
  	struct inet6_dev *idev;
  	struct inet6_ifaddr *ifa;
  	int	onlink;
  
  	onlink = 0;
  	rcu_read_lock();
  	idev = __in6_dev_get(dev);
  	if (idev) {
  		read_lock_bh(&idev->lock);

  		list_for_each_entry(ifa, &idev->addr_list, if_list) {

  			onlink = ipv6_prefix_equal(addr, &ifa->addr,
  						   ifa->prefix_len);
  			if (onlink)
  				break;
  		}
  		read_unlock_bh(&idev->lock);
  	}
  	rcu_read_unlock();
  	return onlink;
  }

  EXPORT_SYMBOL(ipv6_chk_prefix);

  struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,

  				     struct net_device *dev, int strict)

  {

  	struct inet6_ifaddr *ifp, *result = NULL;

  	unsigned int hash = inet6_addr_hash(addr);

  	rcu_read_lock_bh();

  	hlist_for_each_entry_rcu_bh(ifp, &inet6_addr_lst[hash], addr_lst) {

  		if (!net_eq(dev_net(ifp->idev->dev), net))

  			continue;

  		if (ipv6_addr_equal(&ifp->addr, addr)) {
  			if (dev == NULL || ifp->idev->dev == dev ||
  			    !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) {

  				result = ifp;

  				in6_ifa_hold(ifp);
  				break;
  			}
  		}
  	}

  	rcu_read_unlock_bh();

  	return result;

  }

  /* Gets referenced address, destroys ifaddr */

  static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)

  {

  	if (ifp->flags&IFA_F_PERMANENT) {
  		spin_lock_bh(&ifp->lock);

  		addrconf_del_dad_work(ifp);

  		ifp->flags |= IFA_F_TENTATIVE;

  		if (dad_failed)
  			ifp->flags |= IFA_F_DADFAILED;

  		spin_unlock_bh(&ifp->lock);

  		if (dad_failed)
  			ipv6_ifa_notify(0, ifp);

  		in6_ifa_put(ifp);

  	} else if (ifp->flags&IFA_F_TEMPORARY) {
  		struct inet6_ifaddr *ifpub;
  		spin_lock_bh(&ifp->lock);
  		ifpub = ifp->ifpub;
  		if (ifpub) {
  			in6_ifa_hold(ifpub);
  			spin_unlock_bh(&ifp->lock);
  			ipv6_create_tempaddr(ifpub, ifp);
  			in6_ifa_put(ifpub);
  		} else {
  			spin_unlock_bh(&ifp->lock);
  		}
  		ipv6_del_addr(ifp);

  	} else {

  		ipv6_del_addr(ifp);

  	}

  }

  static int addrconf_dad_end(struct inet6_ifaddr *ifp)
  {
  	int err = -ENOENT;

  	spin_lock_bh(&ifp->state_lock);

  	if (ifp->state == INET6_IFADDR_STATE_DAD) {
  		ifp->state = INET6_IFADDR_STATE_POSTDAD;
  		err = 0;
  	}

  	spin_unlock_bh(&ifp->state_lock);

  
  	return err;
  }

  void addrconf_dad_failure(struct inet6_ifaddr *ifp)
  {

  	struct inet6_dev *idev = ifp->idev;

  	if (addrconf_dad_end(ifp)) {
  		in6_ifa_put(ifp);

  		return;

  	}

  	net_info_ratelimited("%s: IPv6 duplicate address %pI6c detected!
  ",
  			     ifp->idev->dev->name, &ifp->addr);

  	if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
  		struct in6_addr addr;
  
  		addr.s6_addr32[0] = htonl(0xfe800000);
  		addr.s6_addr32[1] = 0;
  
  		if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
  		    ipv6_addr_equal(&ifp->addr, &addr)) {
  			/* DAD failed for link-local based on MAC address */
  			idev->cnf.disable_ipv6 = 1;

  			pr_info("%s: IPv6 being disabled!
  ",

  				ifp->idev->dev->name);

  		}
  	}

  	spin_lock_bh(&ifp->state_lock);
  	/* transition from _POSTDAD to _ERRDAD */
  	ifp->state = INET6_IFADDR_STATE_ERRDAD;
  	spin_unlock_bh(&ifp->state_lock);
  
  	addrconf_mod_dad_work(ifp, 0);

  }

  
  /* Join to solicited addr multicast group. */

  void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)

  {
  	struct in6_addr maddr;