1 /* $NetBSD: nd6_nbr.c,v 1.188 2026/07/23 20:25:49 riastradh Exp $ */ 2 /* $KAME: nd6_nbr.c,v 1.61 2001/02/10 16:06:14 jinmei Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.188 2026/07/23 20:25:49 riastradh Exp $"); 35 36 #ifdef _KERNEL_OPT 37 #include "opt_inet.h" 38 #include "opt_net_mpsafe.h" 39 #endif 40 41 #include <sys/param.h> 42 #include <sys/systm.h> 43 #include <sys/kmem.h> 44 #include <sys/mbuf.h> 45 #include <sys/socket.h> 46 #include <sys/socketvar.h> 47 #include <sys/sockio.h> 48 #include <sys/time.h> 49 #include <sys/kernel.h> 50 #include <sys/errno.h> 51 #include <sys/ioctl.h> 52 #include <sys/syslog.h> 53 #include <sys/queue.h> 54 #include <sys/callout.h> 55 #include <sys/cprng.h> 56 57 #include <net/if.h> 58 #include <net/if_types.h> 59 #include <net/if_dl.h> 60 #include <net/if_llatbl.h> 61 #include <net/nd.h> 62 #include <net/route.h> 63 64 #include <netinet/in.h> 65 #include <netinet/in_var.h> 66 #include <netinet6/in6_var.h> 67 #include <netinet6/in6_ifattach.h> 68 #include <netinet/ip6.h> 69 #include <netinet6/ip6_var.h> 70 #include <netinet6/scope6_var.h> 71 #include <netinet6/nd6.h> 72 #include <netinet/icmp6.h> 73 #include <netinet6/icmp6_private.h> 74 75 #include "carp.h" 76 #if NCARP > 0 77 #include <netinet/ip_carp.h> 78 #endif 79 80 struct dadq; 81 static struct dadq *nd6_dad_find(struct ifaddr *, struct nd_opt_nonce *, bool *); 82 static bool nd6_dad_ownnonce(struct ifaddr *, struct nd_opt_nonce *nonce); 83 static void nd6_dad_starttimer(struct dadq *, int); 84 static void nd6_dad_destroytimer(struct dadq *); 85 static void nd6_dad_timer(struct dadq *); 86 static void nd6_dad_ns_output(struct dadq *, struct ifaddr *); 87 static void nd6_dad_input(struct ifaddr *, struct nd_opt_nonce *, 88 const struct sockaddr_dl *); 89 static void nd6_dad_duplicated(struct ifaddr *, struct dadq *, 90 const struct sockaddr_dl *); 91 92 static int dad_maxtry = 15; /* max # of *tries* to transmit DAD packet */ 93 94 /* 95 * Input a Neighbor Solicitation Message. 96 * 97 * Based on RFC 2461 98 * Based on RFC 2462 (duplicate address detection) 99 */ 100 void 101 nd6_ns_input(struct mbuf *m, int off, int icmp6len) 102 { 103 struct ifnet *ifp, *ifpc; 104 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 105 struct nd_neighbor_solicit *nd_ns; 106 struct in6_addr saddr6 = ip6->ip6_src; 107 struct in6_addr daddr6 = ip6->ip6_dst; 108 struct in6_addr taddr6; 109 struct in6_addr myaddr6; 110 char *lladdr = NULL; 111 struct ifaddr *ifa = NULL; 112 int lladdroptlen = 0; 113 int anycast = 0, proxy = 0, tentative = 0; 114 int router = ip6_forwarding; 115 int tlladdr; 116 union nd_opts ndopts; 117 const struct sockaddr_dl *proxydl = NULL; 118 struct psref psref; 119 struct psref psref_c; 120 struct psref psref_ia; 121 char ip6buf[INET6_ADDRSTRLEN], ip6buf2[INET6_ADDRSTRLEN]; 122 123 ifp = ifpc = m_get_rcvif_psref(m, &psref); 124 if (ifp == NULL) 125 goto freeit; 126 127 IP6_EXTHDR_GET(nd_ns, struct nd_neighbor_solicit *, m, off, icmp6len); 128 if (nd_ns == NULL) { 129 ICMP6_STATINC(ICMP6_STAT_TOOSHORT); 130 m_put_rcvif_psref(ifp, &psref); 131 return; 132 } 133 ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */ 134 taddr6 = nd_ns->nd_ns_target; 135 if (in6_setscope(&taddr6, ifp, NULL) != 0) 136 goto bad; 137 138 if (ip6->ip6_hlim != 255) { 139 nd6log(LOG_ERR, "invalid hlim (%d) from %s to %s on %s\n", 140 ip6->ip6_hlim, IN6_PRINT(ip6buf, &ip6->ip6_src), 141 IN6_PRINT(ip6buf2, &ip6->ip6_dst), if_name(ifp)); 142 goto bad; 143 } 144 145 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 146 /* dst has to be a solicited node multicast address. */ 147 /* don't check ifindex portion */ 148 if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL && 149 daddr6.s6_addr32[1] == 0 && 150 daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE && 151 daddr6.s6_addr8[12] == 0xff) { 152 ; /* good */ 153 } else { 154 nd6log(LOG_INFO, "bad DAD packet (wrong ip6 dst)\n"); 155 goto bad; 156 } 157 } else { 158 struct sockaddr_in6 ssin6; 159 160 /* 161 * Make sure the source address is from a neighbor's address. 162 */ 163 sockaddr_in6_init(&ssin6, &saddr6, 0, 0, 0); 164 if (nd6_is_addr_neighbor(&ssin6, ifp) == 0) { 165 nd6log(LOG_INFO, 166 "NS packet from non-neighbor %s on %s\n", 167 IN6_PRINT(ip6buf, &saddr6), if_name(ifp)); 168 goto bad; 169 } 170 } 171 172 if (IN6_IS_ADDR_MULTICAST(&taddr6)) { 173 nd6log(LOG_INFO, "bad NS target (multicast)\n"); 174 goto bad; 175 } 176 177 icmp6len -= sizeof(*nd_ns); 178 nd6_option_init(nd_ns + 1, icmp6len, &ndopts); 179 if (nd6_options(&ndopts) < 0) { 180 nd6log(LOG_INFO, "invalid ND option, ignored\n"); 181 /* nd6_options have incremented stats */ 182 goto freeit; 183 } 184 185 if (ndopts.nd_opts_src_lladdr) { 186 lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1); 187 lladdroptlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3; 188 } 189 190 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) && lladdr) { 191 nd6log(LOG_INFO, 192 "bad DAD packet (link-layer address option)\n"); 193 goto bad; 194 } 195 196 /* 197 * Attaching target link-layer address to the NA? 198 * (RFC 2461 7.2.4) 199 * 200 * NS IP dst is multicast MUST add 201 * Otherwise MAY be omitted 202 * 203 * In this implementation, we omit the target link-layer address 204 * in the "MAY" case. 205 */ 206 #if 0 /* too much! */ 207 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &daddr6); 208 if (ifa && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST)) 209 tlladdr = 0; 210 else 211 #endif 212 if (!IN6_IS_ADDR_MULTICAST(&daddr6)) 213 tlladdr = 0; 214 else 215 tlladdr = 1; 216 217 /* 218 * Target address (taddr6) must be either: 219 * (1) Valid unicast/anycast address for my receiving interface, 220 * (2) Unicast address for which I'm offering proxy service, or 221 * (3) "tentative" address on which DAD is being performed. 222 */ 223 /* (1) and (3) check. */ 224 #if NCARP > 0 225 if (ifp->if_carp && ifp->if_type != IFT_CARP) { 226 int s = pserialize_read_enter(); 227 ifa = carp_iamatch6(ifp->if_carp, &taddr6); 228 if (ifa != NULL) { 229 ifa_acquire(ifa, &psref_ia); 230 if (ifa->ifa_ifp && ifa->ifa_ifp != ifp) { 231 ifpc = ifa->ifa_ifp; 232 if_acquire(ifpc, &psref_c); 233 } 234 } 235 236 pserialize_read_exit(s); 237 } else 238 ifa = NULL; 239 if (!ifa) 240 ifa = (struct ifaddr *)in6ifa_ifpwithaddr_psref(ifp, &taddr6, 241 &psref_ia); 242 #else 243 ifa = (struct ifaddr *)in6ifa_ifpwithaddr_psref(ifp, &taddr6, 244 &psref_ia); 245 #endif 246 247 /* (2) check. */ 248 if (ifa == NULL) { 249 struct rtentry *rt; 250 struct sockaddr_in6 tsin6; 251 252 sockaddr_in6_init(&tsin6, &taddr6, 0, 0, 0); 253 254 rt = rtalloc1(sin6tosa(&tsin6), 0); 255 if (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 && 256 rt->rt_gateway->sa_family == AF_LINK) { 257 /* 258 * proxy NDP for single entry 259 */ 260 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal_psref(ifp, 261 IN6_IFF_NOTREADY|IN6_IFF_ANYCAST, &psref_ia); 262 if (ifa) { 263 proxy = 1; 264 proxydl = satocsdl(rt->rt_gateway); 265 router = 0; /* XXX */ 266 } 267 } 268 if (rt) 269 rt_unref(rt); 270 } 271 if (ifa == NULL) { 272 /* 273 * We've got an NS packet, and we don't have that address 274 * assigned for us. We MUST silently ignore it. 275 * See RFC2461 7.2.3. 276 */ 277 goto freeit; 278 } 279 myaddr6 = *IFA_IN6(ifa); 280 anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST; 281 tentative = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE; 282 if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED) 283 goto freeit; 284 285 if (lladdr && roundup2(ifp->if_addrlen + sizeof(struct nd_opt_hdr), 8) 286 != lladdroptlen) { 287 nd6log(LOG_INFO, "lladdrlen mismatch for %s " 288 "(if %u, NS packet %zu)\n", 289 IN6_PRINT(ip6buf, &taddr6), 290 ifp->if_addrlen, lladdroptlen - sizeof(struct nd_opt_hdr)); 291 goto bad; 292 } 293 294 if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) { 295 nd6log(LOG_INFO, "duplicate IP6 address %s\n", 296 IN6_PRINT(ip6buf, &saddr6)); 297 goto freeit; 298 } 299 300 /* 301 * We have neighbor solicitation packet, with target address equals to 302 * one of my tentative address. 303 * 304 * src addr how to process? 305 * --- --- 306 * multicast of course, invalid (rejected in ip6_input) 307 * unicast somebody is doing address resolution -> ignore 308 * unspec dup address detection 309 * 310 * The processing is defined in RFC 2462. 311 */ 312 if (tentative) { 313 /* 314 * If source address is unspecified address, it is for 315 * duplicate address detection. 316 * 317 * If not, the packet is for address resolution; 318 * silently ignore it. 319 */ 320 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 321 struct sockaddr_dl sdl, *sdlp; 322 323 if (lladdr != NULL) 324 sdlp = sockaddr_dl_init(&sdl, sizeof(sdl), 325 ifp->if_index, ifp->if_type, 326 NULL, 0, lladdr, ifp->if_addrlen); 327 else 328 sdlp = NULL; 329 nd6_dad_input(ifa, ndopts.nd_opts_nonce, sdlp); 330 } 331 goto freeit; 332 } 333 334 /* 335 * It looks that sender is performing DAD. 336 * Check that the nonce is not being used by the same address 337 * on another interface. 338 */ 339 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6) && ndopts.nd_opts_nonce != NULL) { 340 if (nd6_dad_ownnonce(ifa, ndopts.nd_opts_nonce)) 341 goto freeit; 342 } 343 344 ifa_release(ifa, &psref_ia); 345 ifa = NULL; 346 347 /* 348 * If the source address is unspecified address, entries must not 349 * be created or updated. 350 * It looks that sender is performing DAD. Output NA toward 351 * all-node multicast address, to tell the sender that I'm using 352 * the address. 353 * S bit ("solicited") must be zero. 354 */ 355 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 356 struct in6_addr in6_all; 357 358 in6_all = in6addr_linklocal_allnodes; 359 if (in6_setscope(&in6_all, ifp, NULL) != 0) 360 goto bad; 361 nd6_na_output(ifpc, &in6_all, &taddr6, 362 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) | 363 (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0), 364 tlladdr, (const struct sockaddr *)proxydl); 365 goto freeit; 366 } 367 368 nd6_cache_lladdr(ifpc, &saddr6, lladdr, lladdr ? ifp->if_addrlen : 0, 369 ND_NEIGHBOR_SOLICIT, 0); 370 371 nd6_na_output(ifp, &saddr6, &taddr6, 372 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) | 373 (router ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED, 374 tlladdr, (const struct sockaddr *)proxydl); 375 freeit: 376 ifa_release(ifa, &psref_ia); 377 m_put_rcvif_psref(ifp, &psref); 378 if (ifp != ifpc) 379 if_put(ifpc, &psref_c); 380 381 m_freem(m); 382 return; 383 384 bad: 385 nd6log(LOG_ERR, "src=%s\n", IN6_PRINT(ip6buf, &saddr6)); 386 nd6log(LOG_ERR, "dst=%s\n", IN6_PRINT(ip6buf, &daddr6)); 387 nd6log(LOG_ERR, "tgt=%s\n", IN6_PRINT(ip6buf, &taddr6)); 388 ICMP6_STATINC(ICMP6_STAT_BADNS); 389 ifa_release(ifa, &psref_ia); 390 m_put_rcvif_psref(ifp, &psref); 391 m_freem(m); 392 } 393 394 /* 395 * Output a Neighbor Solicitation Message. Caller specifies: 396 * - ICMP6 header source IP6 address 397 * - ND6 header target IP6 address 398 * - ND6 header source datalink address 399 * 400 * Based on RFC 2461 401 * Based on RFC 2462 (duplicate address detection) 402 */ 403 void 404 nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6, 405 const struct in6_addr *taddr6, 406 const struct in6_addr *hsrc, 407 const uint8_t *nonce /* duplicate address detection */) 408 { 409 struct mbuf *m; 410 struct ip6_hdr *ip6; 411 struct nd_neighbor_solicit *nd_ns; 412 const struct in6_addr *src; 413 struct in6_addr src_in; 414 struct ip6_moptions im6o; 415 int icmp6len; 416 int maxlen; 417 const void *mac; 418 struct route ro; 419 420 if (IN6_IS_ADDR_MULTICAST(taddr6)) 421 return; 422 423 memset(&ro, 0, sizeof(ro)); 424 425 /* estimate the size of message */ 426 maxlen = sizeof(*ip6) + sizeof(*nd_ns); 427 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; 428 KASSERTMSG(max_linkhdr + maxlen <= MCLBYTES, 429 "max_linkhdr + maxlen > MCLBYTES (%d + %d > %d)", 430 max_linkhdr, maxlen, MCLBYTES); 431 432 MGETHDR(m, M_DONTWAIT, MT_DATA); 433 if (m && max_linkhdr + maxlen >= MHLEN) { 434 MCLGET(m, M_DONTWAIT); 435 if ((m->m_flags & M_EXT) == 0) { 436 m_free(m); 437 m = NULL; 438 } 439 } 440 if (m == NULL) 441 return; 442 m_reset_rcvif(m); 443 444 if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) { 445 m->m_flags |= M_MCAST; 446 im6o.im6o_multicast_if_index = if_get_index(ifp); 447 im6o.im6o_multicast_hlim = 255; 448 im6o.im6o_multicast_loop = 0; 449 } 450 451 icmp6len = sizeof(*nd_ns); 452 m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len; 453 m->m_data += max_linkhdr; /* or m_align() equivalent? */ 454 455 /* fill neighbor solicitation packet */ 456 ip6 = mtod(m, struct ip6_hdr *); 457 ip6->ip6_flow = 0; 458 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 459 ip6->ip6_vfc |= IPV6_VERSION; 460 /* ip6->ip6_plen will be set later */ 461 ip6->ip6_nxt = IPPROTO_ICMPV6; 462 ip6->ip6_hlim = 255; 463 if (daddr6) 464 ip6->ip6_dst = *daddr6; 465 else { 466 ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL; 467 ip6->ip6_dst.s6_addr16[1] = 0; 468 ip6->ip6_dst.s6_addr32[1] = 0; 469 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE; 470 ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3]; 471 ip6->ip6_dst.s6_addr8[12] = 0xff; 472 if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0) 473 goto bad; 474 } 475 if (nonce == NULL) { 476 int s; 477 /* 478 * RFC2461 7.2.2: 479 * "If the source address of the packet prompting the 480 * solicitation is the same as one of the addresses assigned 481 * to the outgoing interface, that address SHOULD be placed 482 * in the IP Source Address of the outgoing solicitation. 483 * Otherwise, any one of the addresses assigned to the 484 * interface should be used." 485 * 486 * We use the source address for the prompting packet 487 * (hsrc), if: 488 * - hsrc is given from the caller (by giving "ln"), and 489 * - hsrc belongs to the outgoing interface. 490 * Otherwise, we perform the source address selection as usual. 491 */ 492 s = pserialize_read_enter(); 493 if (hsrc && in6ifa_ifpwithaddr(ifp, hsrc)) { 494 pserialize_read_exit(s); 495 src = hsrc; 496 } else { 497 int error; 498 struct sockaddr_in6 dst_sa; 499 500 pserialize_read_exit(s); 501 502 sockaddr_in6_init(&dst_sa, &ip6->ip6_dst, 0, 0, 0); 503 504 error = in6_selectsrc(&dst_sa, NULL, 505 NULL, &ro, NULL, NULL, NULL, &src_in); 506 if (error != 0) { 507 char ip6buf[INET6_ADDRSTRLEN]; 508 nd6log(LOG_DEBUG, "source can't be " 509 "determined: dst=%s, error=%d\n", 510 IN6_PRINT(ip6buf, &dst_sa.sin6_addr), 511 error); 512 goto bad; 513 } 514 src = &src_in; 515 } 516 } else { 517 /* 518 * Source address for DAD packet must always be IPv6 519 * unspecified address. (0::0) 520 * We actually don't have to 0-clear the address (we did it 521 * above), but we do so here explicitly to make the intention 522 * clearer. 523 */ 524 memset(&src_in, 0, sizeof(src_in)); 525 src = &src_in; 526 } 527 ip6->ip6_src = *src; 528 nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1); 529 nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT; 530 nd_ns->nd_ns_code = 0; 531 nd_ns->nd_ns_reserved = 0; 532 nd_ns->nd_ns_target = *taddr6; 533 in6_clearscope(&nd_ns->nd_ns_target); /* XXX */ 534 535 /* 536 * Add source link-layer address option. 537 * 538 * spec implementation 539 * --- --- 540 * DAD packet MUST NOT do not add the option 541 * there's no link layer address: 542 * impossible do not add the option 543 * there's link layer address: 544 * Multicast NS MUST add one add the option 545 * Unicast NS SHOULD add one add the option 546 */ 547 if (nonce == NULL && (mac = nd6_ifptomac(ifp))) { 548 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; 549 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1); 550 /* 8 byte alignments... */ 551 optlen = (optlen + 7) & ~7; 552 553 m->m_pkthdr.len += optlen; 554 m->m_len += optlen; 555 icmp6len += optlen; 556 memset((void *)nd_opt, 0, optlen); 557 nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR; 558 nd_opt->nd_opt_len = optlen >> 3; 559 memcpy((void *)(nd_opt + 1), mac, ifp->if_addrlen); 560 } 561 562 /* Add a nonce option (RFC 3971) to detect looped back NS messages. 563 * This behavior is documented in RFC 7527. */ 564 if (nonce != NULL) { 565 int optlen = sizeof(struct nd_opt_hdr) + ND_OPT_NONCE_LEN; 566 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1); 567 568 /* 8-byte alignment is required. */ 569 optlen = (optlen + 7) & ~7; 570 m->m_pkthdr.len += optlen; 571 m->m_len += optlen; 572 icmp6len += optlen; 573 memset(nd_opt, 0, optlen); 574 nd_opt->nd_opt_type = ND_OPT_NONCE; 575 nd_opt->nd_opt_len = optlen >> 3; 576 memcpy(nd_opt + 1, nonce, ND_OPT_NONCE_LEN); 577 } 578 579 ip6->ip6_plen = htons((u_int16_t)icmp6len); 580 nd_ns->nd_ns_cksum = 0; 581 nd_ns->nd_ns_cksum = 582 in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len); 583 584 ip6_output(m, NULL, &ro, nonce != NULL ? IPV6_UNSPECSRC : 0, 585 &im6o, NULL, NULL); 586 icmp6_ifstat_inc(ifp, ifs6_out_msg); 587 icmp6_ifstat_inc(ifp, ifs6_out_neighborsolicit); 588 ICMP6_STATINC(ICMP6_STAT_OUTHIST + ND_NEIGHBOR_SOLICIT); 589 590 rtcache_free(&ro); 591 return; 592 593 bad: 594 rtcache_free(&ro); 595 m_freem(m); 596 return; 597 } 598 599 /* 600 * Neighbor advertisement input handling. 601 * 602 * Based on RFC 2461 603 * Based on RFC 2462 (duplicate address detection) 604 * 605 * the following items are not implemented yet: 606 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) 607 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) 608 */ 609 void 610 nd6_na_input(struct mbuf *m, int off, int icmp6len) 611 { 612 struct ifnet *ifp; 613 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 614 struct nd_neighbor_advert *nd_na; 615 struct in6_addr saddr6 = ip6->ip6_src; 616 struct in6_addr daddr6 = ip6->ip6_dst; 617 struct in6_addr taddr6; 618 int flags; 619 int is_router; 620 int is_solicited; 621 int is_override; 622 int rt_cmd; 623 char *lladdr = NULL; 624 int lladdroptlen = 0; 625 struct ifaddr *ifa; 626 struct llentry *ln = NULL; 627 union nd_opts ndopts; 628 struct sockaddr_in6 ssin6; 629 struct psref psref; 630 struct psref psref_ia; 631 char ip6buf[INET6_ADDRSTRLEN], ip6buf2[INET6_ADDRSTRLEN]; 632 633 ifp = m_get_rcvif_psref(m, &psref); 634 if (ifp == NULL) 635 goto freeit; 636 637 if (ip6->ip6_hlim != 255) { 638 nd6log(LOG_ERR, 639 "invalid hlim (%d) from %s to %s on %s\n", 640 ip6->ip6_hlim, IN6_PRINT(ip6buf, &ip6->ip6_src), 641 IN6_PRINT(ip6buf2, &ip6->ip6_dst), if_name(ifp)); 642 goto bad; 643 } 644 645 IP6_EXTHDR_GET(nd_na, struct nd_neighbor_advert *, m, off, icmp6len); 646 if (nd_na == NULL) { 647 m_put_rcvif_psref(ifp, &psref); 648 ICMP6_STATINC(ICMP6_STAT_TOOSHORT); 649 return; 650 } 651 652 flags = nd_na->nd_na_flags_reserved; 653 is_router = ((flags & ND_NA_FLAG_ROUTER) != 0); 654 is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0); 655 is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0); 656 657 taddr6 = nd_na->nd_na_target; 658 if (in6_setscope(&taddr6, ifp, NULL)) { 659 goto bad; 660 } 661 662 if (IN6_IS_ADDR_MULTICAST(&taddr6)) { 663 nd6log(LOG_ERR, "invalid target address %s\n", 664 IN6_PRINT(ip6buf, &taddr6)); 665 goto bad; 666 } 667 if (is_solicited && IN6_IS_ADDR_MULTICAST(&daddr6)) { 668 nd6log(LOG_ERR, "a solicited adv is multicasted\n"); 669 goto bad; 670 } 671 672 icmp6len -= sizeof(*nd_na); 673 nd6_option_init(nd_na + 1, icmp6len, &ndopts); 674 if (nd6_options(&ndopts) < 0) { 675 nd6log(LOG_INFO, "invalid ND option, ignored\n"); 676 /* nd6_options have incremented stats */ 677 goto freeit; 678 } 679 680 if (ndopts.nd_opts_tgt_lladdr != NULL) { 681 struct ifnet *ifp_ll; 682 struct psref psref_ll; 683 684 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1); 685 lladdroptlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3; 686 687 if (lladdr && roundup2(ifp->if_addrlen + 688 sizeof(struct nd_opt_hdr), 8) != lladdroptlen) { 689 nd6log(LOG_INFO, "lladdrlen mismatch for %s " 690 "(if %u, NA packet %zu)\n", 691 IN6_PRINT(ip6buf, &taddr6), 692 ifp->if_addrlen, 693 lladdroptlen - sizeof(struct nd_opt_hdr)); 694 goto bad; 695 } 696 697 ifp_ll = if_get_bylla(lladdr, ifp->if_addrlen, &psref_ll); 698 if (ifp_ll != NULL) { 699 /* it's from me, ignore it. */ 700 if_put(ifp_ll, &psref_ll); 701 goto freeit; 702 } 703 } 704 705 ifa = (struct ifaddr *)in6ifa_ifpwithaddr_psref(ifp, &taddr6, &psref_ia); 706 707 /* 708 * Target address matches one of my interface address. 709 * 710 * If my address is tentative, this means that there's somebody 711 * already using the same address as mine. This indicates DAD failure. 712 * This is defined in RFC 2462. 713 * 714 * Otherwise, process as defined in RFC 2461. 715 */ 716 if (ifa) { 717 if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE) { 718 struct sockaddr_dl sdl, *sdlp; 719 720 if (lladdr != NULL) 721 sdlp = sockaddr_dl_init(&sdl, sizeof(sdl), 722 ifp->if_index, ifp->if_type, 723 NULL, 0, lladdr, ifp->if_addrlen); 724 else 725 sdlp = NULL; 726 nd6_dad_input(ifa, NULL, sdlp); 727 } else 728 log(LOG_ERR, 729 "nd6_na_input: duplicate IP6 address %s\n", 730 IN6_PRINT(ip6buf, &taddr6)); 731 ifa_release(ifa, &psref_ia); 732 ifa = NULL; 733 goto freeit; 734 } 735 736 /* 737 * Make sure the source address is from a neighbor's address. 738 */ 739 sockaddr_in6_init(&ssin6, &saddr6, 0, 0, 0); 740 if (nd6_is_addr_neighbor(&ssin6, ifp) == 0) { 741 nd6log(LOG_INFO, "ND packet from non-neighbor %s on %s\n", 742 IN6_PRINT(ip6buf, &saddr6), if_name(ifp)); 743 goto bad; 744 } 745 746 /* 747 * If no neighbor cache entry is found, NA SHOULD silently be 748 * discarded. 749 */ 750 ln = nd6_lookup(&taddr6, ifp, true); 751 if (ln == NULL) 752 goto freeit; 753 754 rt_cmd = 0; 755 if (ln->ln_state <= ND_LLINFO_INCOMPLETE) { 756 /* 757 * If the link-layer has address, and no lladdr option came, 758 * discard the packet. 759 */ 760 if (ifp->if_addrlen && !lladdr) 761 goto freeit; 762 763 /* 764 * Record link-layer address, and update the state. 765 */ 766 memcpy(&ln->ll_addr, lladdr, ifp->if_addrlen); 767 ln->la_flags |= LLE_VALID; 768 rt_cmd = RTM_ADD; 769 if (is_solicited) { 770 ln->ln_state = ND_LLINFO_REACHABLE; 771 ln->ln_byhint = 0; 772 if (!ND_IS_LLINFO_PERMANENT(ln)) 773 nd_set_timer(ln, ND_TIMER_REACHABLE); 774 } else { 775 ln->ln_state = ND_LLINFO_STALE; 776 nd_set_timer(ln, ND_TIMER_GC); 777 } 778 } else { 779 bool llchange; 780 781 /* 782 * Check if the link-layer address has changed or not. 783 */ 784 if (lladdr == NULL) 785 llchange = false; 786 else { 787 if (ln->la_flags & LLE_VALID) { 788 if (memcmp(lladdr, &ln->ll_addr, ifp->if_addrlen)) 789 llchange = true; 790 else 791 llchange = false; 792 } else 793 llchange = true; 794 } 795 if (llchange) 796 rt_cmd = RTM_CHANGE; 797 798 /* 799 * This is VERY complex. Look at it with care. 800 * 801 * override solicit lladdr llchange action 802 * (L: record lladdr) 803 * 804 * 0 0 n -- (2c) 805 * 0 0 y n (2b) L 806 * 0 0 y y (1) REACHABLE->STALE 807 * 0 1 n -- (2c) *->REACHABLE 808 * 0 1 y n (2b) L *->REACHABLE 809 * 0 1 y y (1) REACHABLE->STALE 810 * 1 0 n -- (2a) 811 * 1 0 y n (2a) L 812 * 1 0 y y (2a) L *->STALE 813 * 1 1 n -- (2a) *->REACHABLE 814 * 1 1 y n (2a) L *->REACHABLE 815 * 1 1 y y (2a) L *->REACHABLE 816 */ 817 if (!is_override && lladdr != NULL && llchange) { /* (1) */ 818 /* 819 * If state is REACHABLE, make it STALE. 820 * no other updates should be done. 821 */ 822 if (ln->ln_state == ND_LLINFO_REACHABLE) { 823 ln->ln_state = ND_LLINFO_STALE; 824 nd_set_timer(ln, ND_TIMER_GC); 825 } 826 goto freeit; 827 } else if (is_override /* (2a) */ 828 || (!is_override && lladdr != NULL && !llchange) /* (2b) */ 829 || lladdr == NULL) { /* (2c) */ 830 /* 831 * Update link-local address, if any. 832 */ 833 if (lladdr != NULL) { 834 memcpy(&ln->ll_addr, lladdr, ifp->if_addrlen); 835 ln->la_flags |= LLE_VALID; 836 } 837 838 /* 839 * If solicited, make the state REACHABLE. 840 * If not solicited and the link-layer address was 841 * changed, make it STALE. 842 */ 843 if (is_solicited) { 844 ln->ln_state = ND_LLINFO_REACHABLE; 845 ln->ln_byhint = 0; 846 if (!ND_IS_LLINFO_PERMANENT(ln)) 847 nd_set_timer(ln, ND_TIMER_REACHABLE); 848 } else { 849 if (lladdr && llchange) { 850 ln->ln_state = ND_LLINFO_STALE; 851 nd_set_timer(ln, ND_TIMER_GC); 852 } 853 } 854 } 855 ln->ln_router = is_router; 856 } 857 /* 858 * XXX: does this matter? 859 * rt->rt_flags &= ~RTF_REJECT; 860 */ 861 ln->ln_asked = 0; 862 nd6_llinfo_release_pkts(ln, ifp); 863 864 if (rt_cmd != 0) { 865 struct sockaddr_in6 sin6; 866 867 sockaddr_in6_init(&sin6, &ln->r_l3addr.addr6, 0, 0, 0); 868 rt_clonedmsg(rt_cmd, sin6tosa(&ssin6), sin6tosa(&sin6), 869 (char *)&ln->ll_addr, ln->lle_tbl->llt_ifp); 870 } 871 872 freeit: 873 if (ln != NULL) 874 LLE_WUNLOCK(ln); 875 876 m_put_rcvif_psref(ifp, &psref); 877 m_freem(m); 878 return; 879 880 bad: 881 if (ln != NULL) 882 LLE_WUNLOCK(ln); 883 884 ICMP6_STATINC(ICMP6_STAT_BADNA); 885 m_put_rcvif_psref(ifp, &psref); 886 m_freem(m); 887 } 888 889 /* 890 * Neighbor advertisement output handling. 891 * 892 * Based on RFC 2461 893 * 894 * the following items are not implemented yet: 895 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) 896 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) 897 */ 898 void 899 nd6_na_output( 900 struct ifnet *ifp, 901 const struct in6_addr *daddr6_0, 902 const struct in6_addr *taddr6, 903 u_long flags, 904 int tlladdr, /* 1 if include target link-layer address */ 905 const struct sockaddr *sdl0) /* sockaddr_dl (= proxy NA) or NULL */ 906 { 907 struct mbuf *m; 908 struct ip6_hdr *ip6; 909 struct nd_neighbor_advert *nd_na; 910 struct ip6_moptions im6o; 911 struct sockaddr *dst; 912 union { 913 struct sockaddr dst; 914 struct sockaddr_in6 dst6; 915 } u; 916 struct in6_addr daddr6; 917 int icmp6len, maxlen, error; 918 const void *mac; 919 struct route ro; 920 921 mac = NULL; 922 memset(&ro, 0, sizeof(ro)); 923 924 daddr6 = *daddr6_0; /* make a local copy for modification */ 925 926 /* estimate the size of message */ 927 maxlen = sizeof(*ip6) + sizeof(*nd_na); 928 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; 929 KASSERTMSG(max_linkhdr + maxlen <= MCLBYTES, 930 "max_linkhdr + maxlen > MCLBYTES (%d + %d > %d)", 931 max_linkhdr, maxlen, MCLBYTES); 932 933 MGETHDR(m, M_DONTWAIT, MT_DATA); 934 if (m && max_linkhdr + maxlen >= MHLEN) { 935 MCLGET(m, M_DONTWAIT); 936 if ((m->m_flags & M_EXT) == 0) { 937 m_free(m); 938 m = NULL; 939 } 940 } 941 if (m == NULL) 942 return; 943 m_reset_rcvif(m); 944 945 if (IN6_IS_ADDR_MULTICAST(&daddr6)) { 946 m->m_flags |= M_MCAST; 947 im6o.im6o_multicast_if_index = if_get_index(ifp); 948 im6o.im6o_multicast_hlim = 255; 949 im6o.im6o_multicast_loop = 0; 950 } 951 952 icmp6len = sizeof(*nd_na); 953 m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len; 954 m->m_data += max_linkhdr; /* or m_align() equivalent? */ 955 956 /* fill neighbor advertisement packet */ 957 ip6 = mtod(m, struct ip6_hdr *); 958 ip6->ip6_flow = 0; 959 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 960 ip6->ip6_vfc |= IPV6_VERSION; 961 ip6->ip6_nxt = IPPROTO_ICMPV6; 962 ip6->ip6_hlim = 255; 963 if (IN6_IS_ADDR_UNSPECIFIED(&daddr6)) { 964 /* reply to DAD */ 965 daddr6.s6_addr16[0] = IPV6_ADDR_INT16_MLL; 966 daddr6.s6_addr16[1] = 0; 967 daddr6.s6_addr32[1] = 0; 968 daddr6.s6_addr32[2] = 0; 969 daddr6.s6_addr32[3] = IPV6_ADDR_INT32_ONE; 970 if (in6_setscope(&daddr6, ifp, NULL)) 971 goto bad; 972 973 flags &= ~ND_NA_FLAG_SOLICITED; 974 } 975 ip6->ip6_dst = daddr6; 976 sockaddr_in6_init(&u.dst6, &daddr6, 0, 0, 0); 977 dst = &u.dst; 978 if (rtcache_setdst(&ro, dst) != 0) 979 goto bad; 980 981 /* 982 * Select a source whose scope is the same as that of the dest. 983 */ 984 error = in6_selectsrc(satosin6(dst), NULL, NULL, &ro, NULL, NULL, NULL, 985 &ip6->ip6_src); 986 if (error != 0) { 987 char ip6buf[INET6_ADDRSTRLEN]; 988 nd6log(LOG_DEBUG, "source can't be " 989 "determined: dst=%s, error=%d\n", 990 IN6_PRINT(ip6buf, &satocsin6(dst)->sin6_addr), error); 991 goto bad; 992 } 993 nd_na = (struct nd_neighbor_advert *)(ip6 + 1); 994 nd_na->nd_na_type = ND_NEIGHBOR_ADVERT; 995 nd_na->nd_na_code = 0; 996 nd_na->nd_na_target = *taddr6; 997 in6_clearscope(&nd_na->nd_na_target); /* XXX */ 998 999 /* 1000 * "tlladdr" indicates NS's condition for adding tlladdr or not. 1001 * see nd6_ns_input() for details. 1002 * Basically, if NS packet is sent to unicast/anycast addr, 1003 * target lladdr option SHOULD NOT be included. 1004 */ 1005 if (tlladdr) { 1006 /* 1007 * sdl0 != NULL indicates proxy NA. If we do proxy, use 1008 * lladdr in sdl0. If we are not proxying (sending NA for 1009 * my address) use lladdr configured for the interface. 1010 */ 1011 if (sdl0 == NULL) 1012 mac = nd6_ifptomac(ifp); 1013 else if (sdl0->sa_family == AF_LINK) { 1014 const struct sockaddr_dl *sdl; 1015 sdl = satocsdl(sdl0); 1016 if (sdl->sdl_alen == ifp->if_addrlen) 1017 mac = CLLADDR(sdl); 1018 } 1019 } 1020 if (tlladdr && mac) { 1021 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; 1022 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1); 1023 1024 /* roundup to 8 bytes alignment! */ 1025 optlen = (optlen + 7) & ~7; 1026 1027 m->m_pkthdr.len += optlen; 1028 m->m_len += optlen; 1029 icmp6len += optlen; 1030 memset((void *)nd_opt, 0, optlen); 1031 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR; 1032 nd_opt->nd_opt_len = optlen >> 3; 1033 memcpy((void *)(nd_opt + 1), mac, ifp->if_addrlen); 1034 } else 1035 flags &= ~ND_NA_FLAG_OVERRIDE; 1036 1037 ip6->ip6_plen = htons((u_int16_t)icmp6len); 1038 nd_na->nd_na_flags_reserved = flags; 1039 nd_na->nd_na_cksum = 0; 1040 nd_na->nd_na_cksum = 1041 in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len); 1042 1043 ip6_output(m, NULL, NULL, 0, &im6o, NULL, NULL); 1044 1045 icmp6_ifstat_inc(ifp, ifs6_out_msg); 1046 icmp6_ifstat_inc(ifp, ifs6_out_neighboradvert); 1047 ICMP6_STATINC(ICMP6_STAT_OUTHIST + ND_NEIGHBOR_ADVERT); 1048 1049 rtcache_free(&ro); 1050 return; 1051 1052 bad: 1053 rtcache_free(&ro); 1054 m_freem(m); 1055 return; 1056 } 1057 1058 const void * 1059 nd6_ifptomac(const struct ifnet *ifp) 1060 { 1061 switch (ifp->if_type) { 1062 case IFT_ARCNET: 1063 case IFT_ETHER: 1064 case IFT_IEEE1394: 1065 case IFT_PROPVIRTUAL: 1066 case IFT_CARP: 1067 case IFT_L2VLAN: 1068 case IFT_IEEE80211: 1069 return CLLADDR(ifp->if_sadl); 1070 default: 1071 return NULL; 1072 } 1073 } 1074 1075 TAILQ_HEAD(dadq_head, dadq); 1076 struct dadq { 1077 TAILQ_ENTRY(dadq) dad_list; 1078 struct ifaddr *dad_ifa; 1079 int dad_count; /* max NS to send */ 1080 int dad_ns_tcount; /* # of trials to send NS */ 1081 int dad_ns_ocount; /* NS sent so far */ 1082 int dad_ns_lcount; /* looped back NS */ 1083 struct callout dad_timer_ch; 1084 #define ND_OPT_NONCE_STORE 3 /* dad_count should not exceed this */ 1085 /* 1086 * The default ip6_dad_count is 1 as specified by RFC 4862 and 1087 * practically must users won't exceed this. 1088 * A storage of 3 is defaulted to here, in-case the administrator wants 1089 * to match the equivalent behaviour in our ARP implementation. 1090 * This constraint could be removed by sending the on wire nonce as 1091 * hmac(key, dad_ns_ocount), but that would increase the nonce size 1092 * sent on the wire. 1093 */ 1094 uint8_t dad_nonce[ND_OPT_NONCE_STORE][ND_OPT_NONCE_LEN]; 1095 }; 1096 1097 static struct dadq_head dadq; 1098 static kmutex_t nd6_dad_lock; 1099 1100 void 1101 nd6_nbr_init(void) 1102 { 1103 1104 TAILQ_INIT(&dadq); 1105 mutex_init(&nd6_dad_lock, MUTEX_DEFAULT, IPL_NONE); 1106 } 1107 1108 static struct dadq * 1109 nd6_dad_find(struct ifaddr *ifa, struct nd_opt_nonce *nonce, bool *found_nonce) 1110 { 1111 struct in6_addr *myaddr6, *dadaddr6; 1112 bool match_ifa; 1113 struct dadq *dp; 1114 int i, nonce_max; 1115 1116 KASSERT(mutex_owned(&nd6_dad_lock)); 1117 KASSERT(ifa != NULL); 1118 1119 myaddr6 = IFA_IN6(ifa); 1120 if (nonce != NULL && 1121 nonce->nd_opt_nonce_len != (ND_OPT_NONCE_LEN + 2) / 8) 1122 nonce = NULL; 1123 match_ifa = nonce == NULL || found_nonce == NULL || *found_nonce == false; 1124 if (found_nonce != NULL) 1125 *found_nonce = false; 1126 1127 TAILQ_FOREACH(dp, &dadq, dad_list) { 1128 if (match_ifa) { 1129 if (dp->dad_ifa != ifa) 1130 continue; 1131 } else { 1132 dadaddr6 = IFA_IN6(dp->dad_ifa); 1133 if (!IN6_ARE_ADDR_EQUAL(myaddr6, dadaddr6)) 1134 continue; 1135 } 1136 1137 if (nonce == NULL) 1138 break; 1139 1140 nonce_max = MIN(dp->dad_ns_ocount, ND_OPT_NONCE_STORE); 1141 for (i = 0; i < nonce_max; i++) { 1142 if (memcmp(nonce->nd_opt_nonce, 1143 dp->dad_nonce[i], 1144 ND_OPT_NONCE_LEN) == 0) 1145 break; 1146 } 1147 if (i < nonce_max) { 1148 char ip6buf[INET6_ADDRSTRLEN]; 1149 1150 *found_nonce = true; 1151 log(LOG_DEBUG, 1152 "%s: detected a looped back NS message for %s\n", 1153 if_name(ifa->ifa_ifp), IN6_PRINT(ip6buf, myaddr6)); 1154 dp->dad_ns_lcount++; 1155 continue; 1156 } 1157 1158 break; 1159 } 1160 return dp; 1161 } 1162 1163 static bool 1164 nd6_dad_ownnonce(struct ifaddr *ifa, struct nd_opt_nonce *nonce) 1165 { 1166 bool found_nonce = true; 1167 1168 mutex_enter(&nd6_dad_lock); 1169 nd6_dad_find(ifa, nonce, &found_nonce); 1170 mutex_exit(&nd6_dad_lock); 1171 1172 return found_nonce; 1173 } 1174 1175 static void 1176 nd6_dad_starttimer(struct dadq *dp, int ticks) 1177 { 1178 1179 callout_reset(&dp->dad_timer_ch, ticks, 1180 (void (*)(void *))nd6_dad_timer, dp); 1181 } 1182 1183 static void 1184 nd6_dad_stoptimer(struct dadq *dp) 1185 { 1186 1187 KASSERT(mutex_owned(&nd6_dad_lock)); 1188 1189 TAILQ_REMOVE(&dadq, dp, dad_list); 1190 /* Tell the timer that dp is being destroyed. */ 1191 dp->dad_ifa = NULL; 1192 callout_halt(&dp->dad_timer_ch, &nd6_dad_lock); 1193 } 1194 1195 static void 1196 nd6_dad_destroytimer(struct dadq *dp) 1197 { 1198 1199 KASSERT(dp->dad_ifa == NULL); 1200 callout_destroy(&dp->dad_timer_ch); 1201 kmem_intr_free(dp, sizeof(*dp)); 1202 } 1203 1204 /* 1205 * Start Duplicate Address Detection (DAD) for specified interface address. 1206 * 1207 * Note that callout is used when xtick > 0 and not when xtick == 0. 1208 * 1209 * xtick: minimum delay ticks for IFF_UP event 1210 */ 1211 void 1212 nd6_dad_start(struct ifaddr *ifa, int xtick) 1213 { 1214 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1215 struct dadq *dp; 1216 char ip6buf[INET6_ADDRSTRLEN]; 1217 1218 /* 1219 * If we don't need DAD, don't do it. 1220 * There are several cases: 1221 * - DAD is disabled 1222 * - the interface address is anycast 1223 */ 1224 if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) { 1225 log(LOG_DEBUG, 1226 "nd6_dad_start: called with non-tentative address " 1227 "%s(%s)\n", 1228 IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr), 1229 if_name(ifa->ifa_ifp)); 1230 return; 1231 } 1232 if (ia->ia6_flags & IN6_IFF_ANYCAST || !ip6_dad_enabled()) { 1233 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1234 rt_addrmsg(RTM_NEWADDR, ifa); 1235 return; 1236 } 1237 if (!(ifa->ifa_ifp->if_flags & IFF_UP)) 1238 return; 1239 1240 dp = kmem_intr_alloc(sizeof(*dp), KM_NOSLEEP); 1241 1242 mutex_enter(&nd6_dad_lock); 1243 if (nd6_dad_find(ifa, NULL, NULL) != NULL) { 1244 mutex_exit(&nd6_dad_lock); 1245 /* DAD already in progress */ 1246 if (dp != NULL) 1247 kmem_intr_free(dp, sizeof(*dp)); 1248 return; 1249 } 1250 1251 if (dp == NULL) { 1252 mutex_exit(&nd6_dad_lock); 1253 log(LOG_ERR, "nd6_dad_start: memory allocation failed for " 1254 "%s(%s)\n", 1255 IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr), 1256 if_name(ifa->ifa_ifp)); 1257 return; 1258 } 1259 1260 /* 1261 * Send NS packet for DAD, ip6_dad_count times. 1262 * Note that we must delay the first transmission, if this is the 1263 * first packet to be sent from the interface after interface 1264 * (re)initialization. 1265 */ 1266 callout_init(&dp->dad_timer_ch, CALLOUT_MPSAFE); 1267 dp->dad_ifa = ifa; 1268 ifaref(ifa); /* just for safety */ 1269 dp->dad_count = ip6_dad_count; 1270 dp->dad_ns_ocount = dp->dad_ns_tcount = 0; 1271 dp->dad_ns_lcount = 0; 1272 TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list); 1273 1274 nd6log(LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp), 1275 IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr)); 1276 1277 if (xtick == 0) { 1278 nd6_dad_ns_output(dp, ifa); 1279 nd6_dad_starttimer(dp, 1280 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000); 1281 } else 1282 nd6_dad_starttimer(dp, xtick); 1283 mutex_exit(&nd6_dad_lock); 1284 } 1285 1286 /* 1287 * terminate DAD unconditionally. used for address removals. 1288 */ 1289 void 1290 nd6_dad_stop(struct ifaddr *ifa) 1291 { 1292 struct dadq *dp; 1293 1294 mutex_enter(&nd6_dad_lock); 1295 dp = nd6_dad_find(ifa, NULL, NULL); 1296 if (dp == NULL) { 1297 mutex_exit(&nd6_dad_lock); 1298 /* DAD wasn't started yet */ 1299 return; 1300 } 1301 1302 /* Prevent the timer from running anymore. */ 1303 nd6_dad_stoptimer(dp); 1304 1305 mutex_exit(&nd6_dad_lock); 1306 1307 nd6_dad_destroytimer(dp); 1308 ifafree(ifa); 1309 } 1310 1311 static void 1312 nd6_dad_timer(struct dadq *dp) 1313 { 1314 struct ifaddr *ifa; 1315 struct in6_ifaddr *ia; 1316 char ip6buf[INET6_ADDRSTRLEN]; 1317 bool need_free = false; 1318 1319 KERNEL_LOCK_UNLESS_NET_MPSAFE(); 1320 mutex_enter(&nd6_dad_lock); 1321 1322 ifa = dp->dad_ifa; 1323 if (ifa == NULL) { 1324 /* dp is being destroyed by someone. Do nothing. */ 1325 goto done; 1326 } 1327 1328 ia = (struct in6_ifaddr *)ifa; 1329 if (ia->ia6_flags & IN6_IFF_DUPLICATED) { 1330 log(LOG_ERR, "nd6_dad_timer: called with duplicate address " 1331 "%s(%s)\n", 1332 IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr), 1333 if_name(ifa->ifa_ifp)); 1334 goto done; 1335 } 1336 if ((ia->ia6_flags & IN6_IFF_TENTATIVE) == 0) { 1337 log(LOG_ERR, "nd6_dad_timer: called with non-tentative address " 1338 "%s(%s)\n", 1339 IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr), 1340 if_name(ifa->ifa_ifp)); 1341 goto done; 1342 } 1343 1344 /* timeouted with IFF_{RUNNING,UP} check */ 1345 if (dp->dad_ns_tcount > dad_maxtry) { 1346 nd6log(LOG_INFO, "%s: could not run DAD, driver problem?\n", 1347 if_name(ifa->ifa_ifp)); 1348 1349 nd6_dad_stoptimer(dp); 1350 need_free = true; 1351 goto done; 1352 } 1353 1354 /* Need more checks? */ 1355 if (dp->dad_ns_ocount < dp->dad_count) { 1356 /* 1357 * We have more NS to go. Send NS packet for DAD. 1358 */ 1359 nd6_dad_ns_output(dp, ifa); 1360 nd6_dad_starttimer(dp, 1361 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000); 1362 } else { 1363 /* 1364 * We are done with DAD. No NA came, no NS came. 1365 * No duplicate address found. 1366 */ 1367 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1368 rt_addrmsg(RTM_NEWADDR, ifa); 1369 1370 nd6log(LOG_DEBUG, 1371 "%s: DAD complete for %s - no duplicates found\n", 1372 if_name(ifa->ifa_ifp), 1373 IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr)); 1374 1375 nd6_dad_stoptimer(dp); 1376 need_free = true; 1377 } 1378 done: 1379 mutex_exit(&nd6_dad_lock); 1380 1381 if (need_free) { 1382 nd6_dad_destroytimer(dp); 1383 KASSERT(ifa != NULL); 1384 ifafree(ifa); 1385 } 1386 1387 KERNEL_UNLOCK_UNLESS_NET_MPSAFE(); 1388 } 1389 1390 static void 1391 nd6_dad_duplicated(struct ifaddr *ifa, struct dadq *dp, 1392 const struct sockaddr_dl *from) 1393 { 1394 struct in6_ifaddr *ia; 1395 struct ifnet *ifp; 1396 char ip6buf[INET6_ADDRSTRLEN], llabuf[LLA_ADDRSTRLEN], *llastr; 1397 1398 KASSERT(mutex_owned(&nd6_dad_lock)); 1399 KASSERT(ifa != NULL); 1400 1401 ifp = ifa->ifa_ifp; 1402 ia = (struct in6_ifaddr *)ifa; 1403 1404 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1405 ia->ia6_flags |= IN6_IFF_DUPLICATED; 1406 1407 if (__predict_false(from == NULL)) 1408 llastr = NULL; 1409 else 1410 llastr = lla_snprintf(llabuf, sizeof(llabuf), 1411 CLLADDR(from), from->sdl_alen); 1412 1413 log(LOG_ERR, "%s: DAD duplicate address %s from %s\n", 1414 if_name(ifp), IN6_PRINT(ip6buf, &ia->ia_addr.sin6_addr), llastr); 1415 1416 /* Inform the routing socket that DAD has completed */ 1417 rt_addrmsg_src(RTM_NEWADDR, ifa, (const struct sockaddr *)from); 1418 1419 /* 1420 * If the address is a link-local address formed from an interface 1421 * identifier based on the hardware address which is supposed to be 1422 * uniquely assigned (e.g., EUI-64 for an Ethernet interface), IP 1423 * operation on the interface SHOULD be disabled. 1424 * [rfc2462bis-03 Section 5.4.5] 1425 */ 1426 if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr)) { 1427 struct in6_addr in6; 1428 1429 /* 1430 * To avoid over-reaction, we only apply this logic when we are 1431 * very sure that hardware addresses are supposed to be unique. 1432 */ 1433 switch (ifp->if_type) { 1434 case IFT_ETHER: 1435 case IFT_ATM: 1436 case IFT_IEEE1394: 1437 case IFT_IEEE80211: 1438 in6 = ia->ia_addr.sin6_addr; 1439 if (in6_get_hw_ifid(ifp, &in6) == 0 && 1440 IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) { 1441 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED; 1442 log(LOG_ERR, "%s: possible hardware address " 1443 "duplication detected, disable IPv6\n", 1444 if_name(ifp)); 1445 } 1446 break; 1447 } 1448 } 1449 } 1450 1451 static void 1452 nd6_dad_ns_output(struct dadq *dp, struct ifaddr *ifa) 1453 { 1454 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1455 struct ifnet *ifp = ifa->ifa_ifp; 1456 uint8_t *nonce; 1457 1458 dp->dad_ns_tcount++; 1459 if ((ifp->if_flags & IFF_UP) == 0) { 1460 #if 0 1461 printf("%s: interface down?\n", if_name(ifp)); 1462 #endif 1463 return; 1464 } 1465 if ((ifp->if_flags & IFF_RUNNING) == 0) { 1466 #if 0 1467 printf("%s: interface not running?\n", if_name(ifp)); 1468 #endif 1469 return; 1470 } 1471 1472 dp->dad_ns_tcount = 0; 1473 nonce = dp->dad_nonce[dp->dad_ns_ocount % ND_OPT_NONCE_STORE]; 1474 cprng_fast(nonce, ND_OPT_NONCE_LEN); 1475 dp->dad_ns_ocount++; 1476 1477 nd6_ns_output(ifp, NULL, &ia->ia_addr.sin6_addr, NULL, nonce); 1478 } 1479 1480 static void 1481 nd6_dad_input(struct ifaddr *ifa, struct nd_opt_nonce *nonce, 1482 const struct sockaddr_dl *from) 1483 { 1484 struct dadq *dp; 1485 bool found_nonce = false; 1486 1487 KASSERT(ifa != NULL); 1488 1489 mutex_enter(&nd6_dad_lock); 1490 dp = nd6_dad_find(ifa, nonce, &found_nonce); 1491 if (!found_nonce) { 1492 nd6_dad_duplicated(ifa, dp, from); 1493 if (dp != NULL) 1494 nd6_dad_stoptimer(dp); 1495 } 1496 mutex_exit(&nd6_dad_lock); 1497 if (dp != NULL) { 1498 nd6_dad_destroytimer(dp); 1499 ifafree(ifa); 1500 } 1501 } 1502
Indexes created Mon Aug 10 00:24:53 UTC 2026