nd6.c revision 1.260 1 /* $NetBSD: nd6.c,v 1.260 2019/08/27 21:11:26 roy Exp $ */
2 /* $KAME: nd6.c,v 1.279 2002/06/08 11:16:51 itojun Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 #include <sys/cdefs.h>
34 __KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.260 2019/08/27 21:11:26 roy Exp $");
35
36 #ifdef _KERNEL_OPT
37 #include "opt_net_mpsafe.h"
38 #endif
39
40 #include "bridge.h"
41 #include "carp.h"
42
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/callout.h>
46 #include <sys/kmem.h>
47 #include <sys/mbuf.h>
48 #include <sys/socket.h>
49 #include <sys/socketvar.h>
50 #include <sys/sockio.h>
51 #include <sys/time.h>
52 #include <sys/kernel.h>
53 #include <sys/errno.h>
54 #include <sys/ioctl.h>
55 #include <sys/syslog.h>
56 #include <sys/queue.h>
57 #include <sys/cprng.h>
58 #include <sys/workqueue.h>
59
60 #include <net/if.h>
61 #include <net/if_dl.h>
62 #include <net/if_llatbl.h>
63 #include <net/if_types.h>
64 #include <net/route.h>
65 #include <net/if_ether.h>
66 #include <net/if_fddi.h>
67 #include <net/if_arc.h>
68
69 #include <netinet/in.h>
70 #include <netinet6/in6_var.h>
71 #include <netinet/ip6.h>
72 #include <netinet6/ip6_var.h>
73 #include <netinet6/scope6_var.h>
74 #include <netinet6/nd6.h>
75 #include <netinet6/in6_ifattach.h>
76 #include <netinet/icmp6.h>
77 #include <netinet6/icmp6_private.h>
78
79 #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */
80 #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */
81
82 /* timer values */
83 int nd6_prune = 1; /* walk list every 1 seconds */
84 int nd6_delay = 5; /* delay first probe time 5 second */
85 int nd6_umaxtries = 3; /* maximum unicast query */
86 int nd6_mmaxtries = 3; /* maximum multicast query */
87 int nd6_useloopback = 1; /* use loopback interface for local traffic */
88 int nd6_gctimer = (60 * 60 * 24); /* 1 day: garbage collection timer */
89
90 /* preventing too many loops in ND option parsing */
91 int nd6_maxndopt = 10; /* max # of ND options allowed */
92
93 int nd6_maxnudhint = 0; /* max # of subsequent upper layer hints */
94
95 int nd6_maxqueuelen = 1; /* max # of packets cached in unresolved ND entries */
96
97 #ifdef ND6_DEBUG
98 int nd6_debug = 1;
99 #else
100 int nd6_debug = 0;
101 #endif
102
103 krwlock_t nd6_lock __cacheline_aligned;
104
105 struct nd_drhead nd_defrouter;
106 struct nd_prhead nd_prefix = { 0 };
107
108 int nd6_recalc_reachtm_interval = ND6_RECALC_REACHTM_INTERVAL;
109
110 static void nd6_setmtu0(struct ifnet *, struct nd_ifinfo *);
111 static void nd6_slowtimo(void *);
112 static int regen_tmpaddr(const struct in6_ifaddr *);
113 static void nd6_free(struct llentry *, int);
114 static void nd6_llinfo_timer(void *);
115 static void nd6_timer(void *);
116 static void nd6_timer_work(struct work *, void *);
117 static void clear_llinfo_pqueue(struct llentry *);
118 static struct nd_opt_hdr *nd6_option(union nd_opts *);
119
120 static callout_t nd6_slowtimo_ch;
121 static callout_t nd6_timer_ch;
122 static struct workqueue *nd6_timer_wq;
123 static struct work nd6_timer_wk;
124
125 static int fill_drlist(void *, size_t *);
126 static int fill_prlist(void *, size_t *);
127
128 static struct ifnet *nd6_defifp;
129 static int nd6_defifindex;
130
131 static int nd6_setdefaultiface(int);
132
133 MALLOC_DEFINE(M_IP6NDP, "NDP", "IPv6 Neighbour Discovery");
134
135 void
136 nd6_init(void)
137 {
138 int error;
139
140 rw_init(&nd6_lock);
141
142 /* initialization of the default router list */
143 ND_DEFROUTER_LIST_INIT();
144
145 callout_init(&nd6_slowtimo_ch, CALLOUT_MPSAFE);
146 callout_init(&nd6_timer_ch, CALLOUT_MPSAFE);
147
148 error = workqueue_create(&nd6_timer_wq, "nd6_timer",
149 nd6_timer_work, NULL, PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE);
150 if (error)
151 panic("%s: workqueue_create failed (%d)\n", __func__, error);
152
153 /* start timer */
154 callout_reset(&nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
155 nd6_slowtimo, NULL);
156 callout_reset(&nd6_timer_ch, hz, nd6_timer, NULL);
157 }
158
159 struct nd_ifinfo *
160 nd6_ifattach(struct ifnet *ifp)
161 {
162 struct nd_ifinfo *nd;
163
164 nd = kmem_zalloc(sizeof(*nd), KM_SLEEP);
165
166 nd->initialized = 1;
167
168 nd->chlim = IPV6_DEFHLIM;
169 nd->basereachable = REACHABLE_TIME;
170 nd->reachable = ND_COMPUTE_RTIME(nd->basereachable);
171 nd->retrans = RETRANS_TIMER;
172
173 nd->flags = ND6_IFF_PERFORMNUD | ND6_IFF_ACCEPT_RTADV;
174
175 /* A loopback interface always has ND6_IFF_AUTO_LINKLOCAL.
176 * A bridge interface should not have ND6_IFF_AUTO_LINKLOCAL
177 * because one of its members should. */
178 if ((ip6_auto_linklocal && ifp->if_type != IFT_BRIDGE) ||
179 (ifp->if_flags & IFF_LOOPBACK))
180 nd->flags |= ND6_IFF_AUTO_LINKLOCAL;
181
182 /* A loopback interface does not need to accept RTADV.
183 * A bridge interface should not accept RTADV
184 * because one of its members should. */
185 if (ip6_accept_rtadv &&
186 !(ifp->if_flags & IFF_LOOPBACK) &&
187 !(ifp->if_type != IFT_BRIDGE))
188 nd->flags |= ND6_IFF_ACCEPT_RTADV;
189
190 /* XXX: we cannot call nd6_setmtu since ifp is not fully initialized */
191 nd6_setmtu0(ifp, nd);
192
193 return nd;
194 }
195
196 void
197 nd6_ifdetach(struct ifnet *ifp, struct in6_ifextra *ext)
198 {
199
200 /* Ensure all IPv6 addresses are purged before calling nd6_purge */
201 if_purgeaddrs(ifp, AF_INET6, in6_purgeaddr);
202 nd6_purge(ifp, ext);
203 kmem_free(ext->nd_ifinfo, sizeof(struct nd_ifinfo));
204 }
205
206 void
207 nd6_setmtu(struct ifnet *ifp)
208 {
209 nd6_setmtu0(ifp, ND_IFINFO(ifp));
210 }
211
212 void
213 nd6_setmtu0(struct ifnet *ifp, struct nd_ifinfo *ndi)
214 {
215 u_int32_t omaxmtu;
216
217 omaxmtu = ndi->maxmtu;
218
219 switch (ifp->if_type) {
220 case IFT_ARCNET:
221 ndi->maxmtu = MIN(ARC_PHDS_MAXMTU, ifp->if_mtu); /* RFC2497 */
222 break;
223 case IFT_FDDI:
224 ndi->maxmtu = MIN(FDDIIPMTU, ifp->if_mtu);
225 break;
226 default:
227 ndi->maxmtu = ifp->if_mtu;
228 break;
229 }
230
231 /*
232 * Decreasing the interface MTU under IPV6 minimum MTU may cause
233 * undesirable situation. We thus notify the operator of the change
234 * explicitly. The check for omaxmtu is necessary to restrict the
235 * log to the case of changing the MTU, not initializing it.
236 */
237 if (omaxmtu >= IPV6_MMTU && ndi->maxmtu < IPV6_MMTU) {
238 log(LOG_NOTICE, "nd6_setmtu0: new link MTU on %s (%lu) is too"
239 " small for IPv6 which needs %lu\n",
240 if_name(ifp), (unsigned long)ndi->maxmtu, (unsigned long)
241 IPV6_MMTU);
242 }
243
244 if (ndi->maxmtu > in6_maxmtu)
245 in6_setmaxmtu(); /* check all interfaces just in case */
246 }
247
248 void
249 nd6_option_init(void *opt, int icmp6len, union nd_opts *ndopts)
250 {
251
252 memset(ndopts, 0, sizeof(*ndopts));
253 ndopts->nd_opts_search = (struct nd_opt_hdr *)opt;
254 ndopts->nd_opts_last
255 = (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len);
256
257 if (icmp6len == 0) {
258 ndopts->nd_opts_done = 1;
259 ndopts->nd_opts_search = NULL;
260 }
261 }
262
263 /*
264 * Take one ND option.
265 */
266 static struct nd_opt_hdr *
267 nd6_option(union nd_opts *ndopts)
268 {
269 struct nd_opt_hdr *nd_opt;
270 int olen;
271
272 KASSERT(ndopts != NULL);
273 KASSERT(ndopts->nd_opts_last != NULL);
274
275 if (ndopts->nd_opts_search == NULL)
276 return NULL;
277 if (ndopts->nd_opts_done)
278 return NULL;
279
280 nd_opt = ndopts->nd_opts_search;
281
282 /* make sure nd_opt_len is inside the buffer */
283 if ((void *)&nd_opt->nd_opt_len >= (void *)ndopts->nd_opts_last) {
284 memset(ndopts, 0, sizeof(*ndopts));
285 return NULL;
286 }
287
288 olen = nd_opt->nd_opt_len << 3;
289 if (olen == 0) {
290 /*
291 * Message validation requires that all included
292 * options have a length that is greater than zero.
293 */
294 memset(ndopts, 0, sizeof(*ndopts));
295 return NULL;
296 }
297
298 ndopts->nd_opts_search = (struct nd_opt_hdr *)((char *)nd_opt + olen);
299 if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
300 /* option overruns the end of buffer, invalid */
301 memset(ndopts, 0, sizeof(*ndopts));
302 return NULL;
303 } else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
304 /* reached the end of options chain */
305 ndopts->nd_opts_done = 1;
306 ndopts->nd_opts_search = NULL;
307 }
308 return nd_opt;
309 }
310
311 /*
312 * Parse multiple ND options.
313 * This function is much easier to use, for ND routines that do not need
314 * multiple options of the same type.
315 */
316 int
317 nd6_options(union nd_opts *ndopts)
318 {
319 struct nd_opt_hdr *nd_opt;
320 int i = 0;
321
322 KASSERT(ndopts != NULL);
323 KASSERT(ndopts->nd_opts_last != NULL);
324
325 if (ndopts->nd_opts_search == NULL)
326 return 0;
327
328 while (1) {
329 nd_opt = nd6_option(ndopts);
330 if (nd_opt == NULL && ndopts->nd_opts_last == NULL) {
331 /*
332 * Message validation requires that all included
333 * options have a length that is greater than zero.
334 */
335 ICMP6_STATINC(ICMP6_STAT_ND_BADOPT);
336 memset(ndopts, 0, sizeof(*ndopts));
337 return -1;
338 }
339
340 if (nd_opt == NULL)
341 goto skip1;
342
343 switch (nd_opt->nd_opt_type) {
344 case ND_OPT_SOURCE_LINKADDR:
345 case ND_OPT_TARGET_LINKADDR:
346 case ND_OPT_MTU:
347 case ND_OPT_REDIRECTED_HEADER:
348 case ND_OPT_NONCE:
349 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
350 nd6log(LOG_INFO,
351 "duplicated ND6 option found (type=%d)\n",
352 nd_opt->nd_opt_type);
353 /* XXX bark? */
354 } else {
355 ndopts->nd_opt_array[nd_opt->nd_opt_type]
356 = nd_opt;
357 }
358 break;
359 case ND_OPT_PREFIX_INFORMATION:
360 if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) {
361 ndopts->nd_opt_array[nd_opt->nd_opt_type]
362 = nd_opt;
363 }
364 ndopts->nd_opts_pi_end =
365 (struct nd_opt_prefix_info *)nd_opt;
366 break;
367 default:
368 /*
369 * Unknown options must be silently ignored,
370 * to accommodate future extension to the protocol.
371 */
372 nd6log(LOG_DEBUG,
373 "nd6_options: unsupported option %d - "
374 "option ignored\n", nd_opt->nd_opt_type);
375 }
376
377 skip1:
378 i++;
379 if (i > nd6_maxndopt) {
380 ICMP6_STATINC(ICMP6_STAT_ND_TOOMANYOPT);
381 nd6log(LOG_INFO, "too many loop in nd opt\n");
382 break;
383 }
384
385 if (ndopts->nd_opts_done)
386 break;
387 }
388
389 return 0;
390 }
391
392 /*
393 * ND6 timer routine to handle ND6 entries
394 */
395 void
396 nd6_llinfo_settimer(struct llentry *ln, time_t xtick)
397 {
398
399 CTASSERT(sizeof(time_t) > sizeof(int));
400 LLE_WLOCK_ASSERT(ln);
401
402 KASSERT(xtick >= 0);
403
404 /*
405 * We have to take care of a reference leak which occurs if
406 * callout_reset overwrites a pending callout schedule. Unfortunately
407 * we don't have a mean to know the overwrite, so we need to know it
408 * using callout_stop. We need to call callout_pending first to exclude
409 * the case that the callout has never been scheduled.
410 */
411 if (callout_pending(&ln->la_timer)) {
412 bool expired = callout_stop(&ln->la_timer);
413 if (!expired)
414 LLE_REMREF(ln);
415 }
416
417 ln->ln_expire = time_uptime + xtick / hz;
418 LLE_ADDREF(ln);
419 if (xtick > INT_MAX) {
420 ln->ln_ntick = xtick - INT_MAX;
421 callout_reset(&ln->ln_timer_ch, INT_MAX,
422 nd6_llinfo_timer, ln);
423 } else {
424 ln->ln_ntick = 0;
425 callout_reset(&ln->ln_timer_ch, xtick,
426 nd6_llinfo_timer, ln);
427 }
428 }
429
430 /*
431 * Gets source address of the first packet in hold queue
432 * and stores it in @src.
433 * Returns pointer to @src (if hold queue is not empty) or NULL.
434 */
435 static struct in6_addr *
436 nd6_llinfo_get_holdsrc(struct llentry *ln, struct in6_addr *src)
437 {
438 struct ip6_hdr *hip6;
439
440 if (ln == NULL || ln->ln_hold == NULL)
441 return NULL;
442
443 /*
444 * assuming every packet in ln_hold has the same IP header
445 */
446 hip6 = mtod(ln->ln_hold, struct ip6_hdr *);
447 /* XXX pullup? */
448 if (sizeof(*hip6) < ln->ln_hold->m_len)
449 *src = hip6->ip6_src;
450 else
451 src = NULL;
452
453 return src;
454 }
455
456 static void
457 nd6_llinfo_timer(void *arg)
458 {
459 struct llentry *ln = arg;
460 struct ifnet *ifp;
461 struct nd_ifinfo *ndi = NULL;
462 bool send_ns = false;
463 const struct in6_addr *daddr6 = NULL;
464
465 SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
466
467 LLE_WLOCK(ln);
468 if ((ln->la_flags & LLE_LINKED) == 0)
469 goto out;
470 if (ln->ln_ntick > 0) {
471 nd6_llinfo_settimer(ln, ln->ln_ntick);
472 goto out;
473 }
474
475
476 ifp = ln->lle_tbl->llt_ifp;
477 KASSERT(ifp != NULL);
478
479 ndi = ND_IFINFO(ifp);
480
481 switch (ln->ln_state) {
482 case ND6_LLINFO_INCOMPLETE:
483 if (ln->ln_asked < nd6_mmaxtries) {
484 ln->ln_asked++;
485 send_ns = true;
486 } else {
487 struct mbuf *m = ln->ln_hold;
488 if (m) {
489 struct mbuf *m0;
490
491 /*
492 * assuming every packet in ln_hold has
493 * the same IP header
494 */
495 m0 = m->m_nextpkt;
496 m->m_nextpkt = NULL;
497 ln->ln_hold = m0;
498 clear_llinfo_pqueue(ln);
499 }
500 LLE_REMREF(ln);
501 nd6_free(ln, 0);
502 ln = NULL;
503 if (m != NULL) {
504 icmp6_error2(m, ICMP6_DST_UNREACH,
505 ICMP6_DST_UNREACH_ADDR, 0, ifp);
506 }
507 }
508 break;
509 case ND6_LLINFO_REACHABLE:
510 if (!ND6_LLINFO_PERMANENT(ln)) {
511 ln->ln_state = ND6_LLINFO_STALE;
512 nd6_llinfo_settimer(ln, nd6_gctimer * hz);
513 }
514 break;
515
516 case ND6_LLINFO_PURGE:
517 case ND6_LLINFO_STALE:
518 /* Garbage Collection(RFC 2461 5.3) */
519 if (!ND6_LLINFO_PERMANENT(ln)) {
520 LLE_REMREF(ln);
521 nd6_free(ln, 1);
522 ln = NULL;
523 }
524 break;
525
526 case ND6_LLINFO_DELAY:
527 if (ndi && (ndi->flags & ND6_IFF_PERFORMNUD) != 0) {
528 /* We need NUD */
529 ln->ln_asked = 1;
530 ln->ln_state = ND6_LLINFO_PROBE;
531 daddr6 = &ln->r_l3addr.addr6;
532 send_ns = true;
533 } else {
534 ln->ln_state = ND6_LLINFO_STALE; /* XXX */
535 nd6_llinfo_settimer(ln, nd6_gctimer * hz);
536 }
537 break;
538 case ND6_LLINFO_PROBE:
539 if (ln->ln_asked < nd6_umaxtries) {
540 ln->ln_asked++;
541 daddr6 = &ln->r_l3addr.addr6;
542 send_ns = true;
543 } else {
544 LLE_REMREF(ln);
545 nd6_free(ln, 0);
546 ln = NULL;
547 }
548 break;
549 }
550
551 if (send_ns) {
552 struct in6_addr src, *psrc;
553 const struct in6_addr *taddr6 = &ln->r_l3addr.addr6;
554
555 nd6_llinfo_settimer(ln, ndi->retrans * hz / 1000);
556 psrc = nd6_llinfo_get_holdsrc(ln, &src);
557 LLE_FREE_LOCKED(ln);
558 ln = NULL;
559 nd6_ns_output(ifp, daddr6, taddr6, psrc, NULL);
560 }
561
562 out:
563 if (ln != NULL)
564 LLE_FREE_LOCKED(ln);
565 SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
566 }
567
568 /*
569 * ND6 timer routine to expire default route list and prefix list
570 */
571 static void
572 nd6_timer_work(struct work *wk, void *arg)
573 {
574 struct nd_defrouter *next_dr, *dr;
575 struct nd_prefix *next_pr, *pr;
576 struct in6_ifaddr *ia6, *nia6;
577 int s, bound;
578 struct psref psref;
579
580 callout_reset(&nd6_timer_ch, nd6_prune * hz,
581 nd6_timer, NULL);
582
583 SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
584
585 /* expire default router list */
586
587 ND6_WLOCK();
588 ND_DEFROUTER_LIST_FOREACH_SAFE(dr, next_dr) {
589 if (dr->expire && dr->expire < time_uptime) {
590 nd6_defrtrlist_del(dr, NULL);
591 }
592 }
593 ND6_UNLOCK();
594
595 /*
596 * expire interface addresses.
597 * in the past the loop was inside prefix expiry processing.
598 * However, from a stricter speci-confrmance standpoint, we should
599 * rather separate address lifetimes and prefix lifetimes.
600 */
601 bound = curlwp_bind();
602 addrloop:
603 s = pserialize_read_enter();
604 for (ia6 = IN6_ADDRLIST_READER_FIRST(); ia6; ia6 = nia6) {
605 nia6 = IN6_ADDRLIST_READER_NEXT(ia6);
606
607 ia6_acquire(ia6, &psref);
608 pserialize_read_exit(s);
609
610 /* check address lifetime */
611 if (IFA6_IS_INVALID(ia6)) {
612 int regen = 0;
613 struct ifnet *ifp;
614
615 /*
616 * If the expiring address is temporary, try
617 * regenerating a new one. This would be useful when
618 * we suspended a laptop PC, then turned it on after a
619 * period that could invalidate all temporary
620 * addresses. Although we may have to restart the
621 * loop (see below), it must be after purging the
622 * address. Otherwise, we'd see an infinite loop of
623 * regeneration.
624 */
625 if (ip6_use_tempaddr &&
626 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
627 IFNET_LOCK(ia6->ia_ifa.ifa_ifp);
628 if (regen_tmpaddr(ia6) == 0)
629 regen = 1;
630 IFNET_UNLOCK(ia6->ia_ifa.ifa_ifp);
631 }
632
633 ifp = ia6->ia_ifa.ifa_ifp;
634 IFNET_LOCK(ifp);
635 /*
636 * Need to take the lock first to prevent if_detach
637 * from running in6_purgeaddr concurrently.
638 */
639 if (!if_is_deactivated(ifp)) {
640 ia6_release(ia6, &psref);
641 in6_purgeaddr(&ia6->ia_ifa);
642 } else {
643 /*
644 * ifp is being destroyed, ia6 will be destroyed
645 * by if_detach.
646 */
647 ia6_release(ia6, &psref);
648 }
649 ia6 = NULL;
650 IFNET_UNLOCK(ifp);
651
652 if (regen)
653 goto addrloop; /* XXX: see below */
654 } else if (IFA6_IS_DEPRECATED(ia6)) {
655 int oldflags = ia6->ia6_flags;
656
657 if ((oldflags & IN6_IFF_DEPRECATED) == 0) {
658 ia6->ia6_flags |= IN6_IFF_DEPRECATED;
659 rt_addrmsg(RTM_NEWADDR, (struct ifaddr *)ia6);
660 }
661
662 /*
663 * If a temporary address has just become deprecated,
664 * regenerate a new one if possible.
665 */
666 if (ip6_use_tempaddr &&
667 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
668 (oldflags & IN6_IFF_DEPRECATED) == 0) {
669 int ret;
670
671 IFNET_LOCK(ia6->ia_ifa.ifa_ifp);
672 ret = regen_tmpaddr(ia6);
673 IFNET_UNLOCK(ia6->ia_ifa.ifa_ifp);
674 if (ret == 0) {
675 /*
676 * A new temporary address is
677 * generated.
678 * XXX: this means the address chain
679 * has changed while we are still in
680 * the loop. Although the change
681 * would not cause disaster (because
682 * it's not a deletion, but an
683 * addition,) we'd rather restart the
684 * loop just for safety. Or does this
685 * significantly reduce performance??
686 */
687 ia6_release(ia6, &psref);
688 goto addrloop;
689 }
690 }
691 } else {
692 /*
693 * A new RA might have made a deprecated address
694 * preferred.
695 */
696 if (ia6->ia6_flags & IN6_IFF_DEPRECATED) {
697 ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;
698 rt_addrmsg(RTM_NEWADDR, (struct ifaddr *)ia6);
699 }
700 }
701 s = pserialize_read_enter();
702 ia6_release(ia6, &psref);
703 }
704 pserialize_read_exit(s);
705 curlwp_bindx(bound);
706
707 /* expire prefix list */
708 ND6_WLOCK();
709 ND_PREFIX_LIST_FOREACH_SAFE(pr, next_pr) {
710 /*
711 * check prefix lifetime.
712 * since pltime is just for autoconf, pltime processing for
713 * prefix is not necessary.
714 */
715 if (pr->ndpr_vltime != ND6_INFINITE_LIFETIME &&
716 time_uptime - pr->ndpr_lastupdate > pr->ndpr_vltime) {
717 /*
718 * Just invalidate the prefix here. Removing it
719 * will be done when purging an associated address.
720 */
721 KASSERT(pr->ndpr_refcnt > 0);
722 nd6_invalidate_prefix(pr);
723 }
724 }
725 ND6_UNLOCK();
726
727 SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
728 }
729
730 static void
731 nd6_timer(void *ignored_arg)
732 {
733
734 workqueue_enqueue(nd6_timer_wq, &nd6_timer_wk, NULL);
735 }
736
737 /* ia6: deprecated/invalidated temporary address */
738 static int
739 regen_tmpaddr(const struct in6_ifaddr *ia6)
740 {
741 struct ifaddr *ifa;
742 struct ifnet *ifp;
743 struct in6_ifaddr *public_ifa6 = NULL;
744 int s;
745
746 ifp = ia6->ia_ifa.ifa_ifp;
747 s = pserialize_read_enter();
748 IFADDR_READER_FOREACH(ifa, ifp) {
749 struct in6_ifaddr *it6;
750
751 if (ifa->ifa_addr->sa_family != AF_INET6)
752 continue;
753
754 it6 = (struct in6_ifaddr *)ifa;
755
756 /* ignore no autoconf addresses. */
757 if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0)
758 continue;
759
760 /* ignore autoconf addresses with different prefixes. */
761 if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr)
762 continue;
763
764 /*
765 * Now we are looking at an autoconf address with the same
766 * prefix as ours. If the address is temporary and is still
767 * preferred, do not create another one. It would be rare, but
768 * could happen, for example, when we resume a laptop PC after
769 * a long period.
770 */
771 if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
772 !IFA6_IS_DEPRECATED(it6)) {
773 public_ifa6 = NULL;
774 break;
775 }
776
777 /*
778 * This is a public autoconf address that has the same prefix
779 * as ours. If it is preferred, keep it. We can't break the
780 * loop here, because there may be a still-preferred temporary
781 * address with the prefix.
782 */
783 if (!IFA6_IS_DEPRECATED(it6))
784 public_ifa6 = it6;
785 }
786
787 if (public_ifa6 != NULL) {
788 int e;
789 struct psref psref;
790
791 ia6_acquire(public_ifa6, &psref);
792 pserialize_read_exit(s);
793 /*
794 * Random factor is introduced in the preferred lifetime, so
795 * we do not need additional delay (3rd arg to in6_tmpifadd).
796 */
797 ND6_WLOCK();
798 e = in6_tmpifadd(public_ifa6, 0, 0);
799 ND6_UNLOCK();
800 if (e != 0) {
801 ia6_release(public_ifa6, &psref);
802 log(LOG_NOTICE, "regen_tmpaddr: failed to create a new"
803 " tmp addr, errno=%d\n", e);
804 return -1;
805 }
806 ia6_release(public_ifa6, &psref);
807 return 0;
808 }
809 pserialize_read_exit(s);
810
811 return -1;
812 }
813
814 bool
815 nd6_accepts_rtadv(const struct nd_ifinfo *ndi)
816 {
817 switch (ndi->flags & (ND6_IFF_ACCEPT_RTADV|ND6_IFF_OVERRIDE_RTADV)) {
818 case ND6_IFF_OVERRIDE_RTADV|ND6_IFF_ACCEPT_RTADV:
819 return true;
820 case ND6_IFF_ACCEPT_RTADV:
821 return ip6_accept_rtadv != 0;
822 case ND6_IFF_OVERRIDE_RTADV:
823 case 0:
824 default:
825 return false;
826 }
827 }
828
829 /*
830 * Nuke neighbor cache/prefix/default router management table, right before
831 * ifp goes away.
832 */
833 void
834 nd6_purge(struct ifnet *ifp, struct in6_ifextra *ext)
835 {
836 struct nd_defrouter *dr, *ndr;
837 struct nd_prefix *pr, *npr;
838
839 /*
840 * During detach, the ND info might be already removed, but
841 * then is explitly passed as argument.
842 * Otherwise get it from ifp->if_afdata.
843 */
844 if (ext == NULL)
845 ext = ifp->if_afdata[AF_INET6];
846 if (ext == NULL)
847 return;
848
849 ND6_WLOCK();
850 /*
851 * Nuke default router list entries toward ifp.
852 * We defer removal of default router list entries that is installed
853 * in the routing table, in order to keep additional side effects as
854 * small as possible.
855 */
856 ND_DEFROUTER_LIST_FOREACH_SAFE(dr, ndr) {
857 if (dr->installed)
858 continue;
859
860 if (dr->ifp == ifp) {
861 KASSERT(ext != NULL);
862 nd6_defrtrlist_del(dr, ext);
863 }
864 }
865
866 ND_DEFROUTER_LIST_FOREACH_SAFE(dr, ndr) {
867 if (!dr->installed)
868 continue;
869
870 if (dr->ifp == ifp) {
871 KASSERT(ext != NULL);
872 nd6_defrtrlist_del(dr, ext);
873 }
874 }
875
876 /* Nuke prefix list entries toward ifp */
877 ND_PREFIX_LIST_FOREACH_SAFE(pr, npr) {
878 if (pr->ndpr_ifp == ifp) {
879 /*
880 * All addresses referencing pr should be already freed.
881 */
882 KASSERT(pr->ndpr_refcnt == 0);
883 nd6_prelist_remove(pr);
884 }
885 }
886
887 /* cancel default outgoing interface setting */
888 if (nd6_defifindex == ifp->if_index)
889 nd6_setdefaultiface(0);
890
891 /* XXX: too restrictive? */
892 if (!ip6_forwarding && ifp->if_afdata[AF_INET6]) {
893 struct nd_ifinfo *ndi = ND_IFINFO(ifp);
894 if (ndi && nd6_accepts_rtadv(ndi)) {
895 /* refresh default router list */
896 nd6_defrouter_select();
897 }
898 }
899 ND6_UNLOCK();
900
901 /*
902 * We may not need to nuke the neighbor cache entries here
903 * because the neighbor cache is kept in if_afdata[AF_INET6].
904 * nd6_purge() is invoked by in6_ifdetach() which is called
905 * from if_detach() where everything gets purged. However
906 * in6_ifdetach is directly called from vlan(4), so we still
907 * need to purge entries here.
908 */
909 if (ext->lltable != NULL)
910 lltable_purge_entries(ext->lltable);
911 }
912
913 void
914 nd6_assert_purged(struct ifnet *ifp)
915 {
916 struct nd_defrouter *dr;
917 struct nd_prefix *pr;
918 char ip6buf[INET6_ADDRSTRLEN] __diagused;
919
920 ND6_RLOCK();
921 ND_DEFROUTER_LIST_FOREACH(dr) {
922 KASSERTMSG(dr->ifp != ifp,
923 "defrouter %s remains on %s",
924 IN6_PRINT(ip6buf, &dr->rtaddr), ifp->if_xname);
925 }
926
927 ND_PREFIX_LIST_FOREACH(pr) {
928 KASSERTMSG(pr->ndpr_ifp != ifp,
929 "prefix %s/%d remains on %s",
930 IN6_PRINT(ip6buf, &pr->ndpr_prefix.sin6_addr),
931 pr->ndpr_plen, ifp->if_xname);
932 }
933 ND6_UNLOCK();
934 }
935
936 struct llentry *
937 nd6_lookup(const struct in6_addr *addr6, const struct ifnet *ifp, bool wlock)
938 {
939 struct sockaddr_in6 sin6;
940 struct llentry *ln;
941
942 sockaddr_in6_init(&sin6, addr6, 0, 0, 0);
943
944 IF_AFDATA_RLOCK(ifp);
945 ln = lla_lookup(LLTABLE6(ifp), wlock ? LLE_EXCLUSIVE : 0,
946 sin6tosa(&sin6));
947 IF_AFDATA_RUNLOCK(ifp);
948
949 return ln;
950 }
951
952 struct llentry *
953 nd6_create(const struct in6_addr *addr6, const struct ifnet *ifp)
954 {
955 struct sockaddr_in6 sin6;
956 struct llentry *ln;
957 struct rtentry *rt;
958
959 sockaddr_in6_init(&sin6, addr6, 0, 0, 0);
960 rt = rtalloc1(sin6tosa(&sin6), 0);
961
962 IF_AFDATA_WLOCK(ifp);
963 ln = lla_create(LLTABLE6(ifp), LLE_EXCLUSIVE, sin6tosa(&sin6), rt);
964 IF_AFDATA_WUNLOCK(ifp);
965
966 if (rt != NULL)
967 rt_unref(rt);
968 if (ln != NULL)
969 ln->ln_state = ND6_LLINFO_NOSTATE;
970
971 return ln;
972 }
973
974 /*
975 * Test whether a given IPv6 address is a neighbor or not, ignoring
976 * the actual neighbor cache. The neighbor cache is ignored in order
977 * to not reenter the routing code from within itself.
978 */
979 static int
980 nd6_is_new_addr_neighbor(const struct sockaddr_in6 *addr, struct ifnet *ifp)
981 {
982 struct nd_prefix *pr;
983 struct ifaddr *dstaddr;
984 int s;
985
986 /*
987 * A link-local address is always a neighbor.
988 * XXX: a link does not necessarily specify a single interface.
989 */
990 if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr)) {
991 struct sockaddr_in6 sin6_copy;
992 u_int32_t zone;
993
994 /*
995 * We need sin6_copy since sa6_recoverscope() may modify the
996 * content (XXX).
997 */
998 sin6_copy = *addr;
999 if (sa6_recoverscope(&sin6_copy))
1000 return 0; /* XXX: should be impossible */
1001 if (in6_setscope(&sin6_copy.sin6_addr, ifp, &zone))
1002 return 0;
1003 if (sin6_copy.sin6_scope_id == zone)
1004 return 1;
1005 else
1006 return 0;
1007 }
1008
1009 /*
1010 * If the address matches one of our addresses,
1011 * it should be a neighbor.
1012 * If the address matches one of our on-link prefixes, it should be a
1013 * neighbor.
1014 */
1015 ND6_RLOCK();
1016 ND_PREFIX_LIST_FOREACH(pr) {
1017 if (pr->ndpr_ifp != ifp)
1018 continue;
1019
1020 if (!(pr->ndpr_stateflags & NDPRF_ONLINK)) {
1021 struct rtentry *rt;
1022
1023 rt = rtalloc1(sin6tosa(&pr->ndpr_prefix), 0);
1024 if (rt == NULL)
1025 continue;
1026 /*
1027 * This is the case where multiple interfaces
1028 * have the same prefix, but only one is installed
1029 * into the routing table and that prefix entry
1030 * is not the one being examined here. In the case
1031 * where RADIX_MPATH is enabled, multiple route
1032 * entries (of the same rt_key value) will be
1033 * installed because the interface addresses all
1034 * differ.
1035 */
1036 if (!IN6_ARE_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
1037 &satocsin6(rt_getkey(rt))->sin6_addr)) {
1038 rt_unref(rt);
1039 continue;
1040 }
1041 rt_unref(rt);
1042 }
1043
1044 if (IN6_ARE_MASKED_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
1045 &addr->sin6_addr, &pr->ndpr_mask)) {
1046 ND6_UNLOCK();
1047 return 1;
1048 }
1049 }
1050 ND6_UNLOCK();
1051
1052 /*
1053 * If the address is assigned on the node of the other side of
1054 * a p2p interface, the address should be a neighbor.
1055 */
1056 s = pserialize_read_enter();
1057 dstaddr = ifa_ifwithdstaddr(sin6tocsa(addr));
1058 if (dstaddr != NULL) {
1059 if (dstaddr->ifa_ifp == ifp) {
1060 pserialize_read_exit(s);
1061 return 1;
1062 }
1063 }
1064 pserialize_read_exit(s);
1065
1066 /*
1067 * If the default router list is empty, all addresses are regarded
1068 * as on-link, and thus, as a neighbor.
1069 */
1070 ND6_RLOCK();
1071 if (ND_IFINFO(ifp)->flags & ND6_IFF_ACCEPT_RTADV &&
1072 ND_DEFROUTER_LIST_EMPTY() && nd6_defifindex == ifp->if_index) {
1073 ND6_UNLOCK();
1074 return 1;
1075 }
1076 ND6_UNLOCK();
1077
1078 return 0;
1079 }
1080
1081 /*
1082 * Detect if a given IPv6 address identifies a neighbor on a given link.
1083 * XXX: should take care of the destination of a p2p link?
1084 */
1085 int
1086 nd6_is_addr_neighbor(const struct sockaddr_in6 *addr, struct ifnet *ifp)
1087 {
1088 struct nd_prefix *pr;
1089 struct llentry *ln;
1090 struct rtentry *rt;
1091
1092 /*
1093 * A link-local address is always a neighbor.
1094 * XXX: a link does not necessarily specify a single interface.
1095 */
1096 if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr)) {
1097 struct sockaddr_in6 sin6_copy;
1098 u_int32_t zone;
1099
1100 /*
1101 * We need sin6_copy since sa6_recoverscope() may modify the
1102 * content (XXX).
1103 */
1104 sin6_copy = *addr;
1105 if (sa6_recoverscope(&sin6_copy))
1106 return 0; /* XXX: should be impossible */
1107 if (in6_setscope(&sin6_copy.sin6_addr, ifp, &zone))
1108 return 0;
1109 if (sin6_copy.sin6_scope_id == zone)
1110 return 1;
1111 else
1112 return 0;
1113 }
1114
1115 /*
1116 * If the address matches one of our on-link prefixes, it should be a
1117 * neighbor.
1118 */
1119 ND6_RLOCK();
1120 ND_PREFIX_LIST_FOREACH(pr) {
1121 if (pr->ndpr_ifp != ifp)
1122 continue;
1123
1124 if (!(pr->ndpr_stateflags & NDPRF_ONLINK))
1125 continue;
1126
1127 if (IN6_ARE_MASKED_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
1128 &addr->sin6_addr, &pr->ndpr_mask)) {
1129 ND6_UNLOCK();
1130 return 1;
1131 }
1132 }
1133
1134 /*
1135 * If the default router list is empty, all addresses are regarded
1136 * as on-link, and thus, as a neighbor.
1137 * XXX: we restrict the condition to hosts, because routers usually do
1138 * not have the "default router list".
1139 */
1140 if (!ip6_forwarding && ND_DEFROUTER_LIST_EMPTY() &&
1141 nd6_defifindex == ifp->if_index) {
1142 ND6_UNLOCK();
1143 return 1;
1144 }
1145 ND6_UNLOCK();
1146
1147 if (nd6_is_new_addr_neighbor(addr, ifp))
1148 return 1;
1149
1150 /*
1151 * Even if the address matches none of our addresses, it might be
1152 * in the neighbor cache or a connected route.
1153 */
1154 ln = nd6_lookup(&addr->sin6_addr, ifp, false);
1155 if (ln != NULL) {
1156 LLE_RUNLOCK(ln);
1157 return 1;
1158 }
1159
1160 rt = rtalloc1(sin6tocsa(addr), 0);
1161 if (rt == NULL)
1162 return 0;
1163
1164 if ((rt->rt_flags & RTF_CONNECTED) && (rt->rt_ifp == ifp
1165 #if NBRIDGE > 0
1166 || rt->rt_ifp->if_bridge == ifp->if_bridge
1167 #endif
1168 #if NCARP > 0
1169 || (ifp->if_type == IFT_CARP && rt->rt_ifp == ifp->if_carpdev) ||
1170 (rt->rt_ifp->if_type == IFT_CARP && rt->rt_ifp->if_carpdev == ifp)||
1171 (ifp->if_type == IFT_CARP && rt->rt_ifp->if_type == IFT_CARP &&
1172 rt->rt_ifp->if_carpdev == ifp->if_carpdev)
1173 #endif
1174 )) {
1175 rt_unref(rt);
1176 return 1;
1177 }
1178 rt_unref(rt);
1179
1180 return 0;
1181 }
1182
1183 /*
1184 * Free an nd6 llinfo entry.
1185 * Since the function would cause significant changes in the kernel, DO NOT
1186 * make it global, unless you have a strong reason for the change, and are sure
1187 * that the change is safe.
1188 */
1189 static void
1190 nd6_free(struct llentry *ln, int gc)
1191 {
1192 struct ifnet *ifp;
1193 struct in6_addr *in6;
1194 struct sockaddr_in6 sin6;
1195
1196 KASSERT(ln != NULL);
1197 LLE_WLOCK_ASSERT(ln);
1198
1199 ifp = ln->lle_tbl->llt_ifp;
1200 in6 = &ln->r_l3addr.addr6;
1201 /*
1202 * we used to have pfctlinput(PRC_HOSTDEAD) here.
1203 * even though it is not harmful, it was not really necessary.
1204 */
1205
1206 if (!ip6_forwarding && ln->ln_router) {
1207 if (ln->ln_state == ND6_LLINFO_STALE && gc) {
1208 /*
1209 * If the reason for the deletion is just garbage
1210 * collection, and the neighbor is an active
1211 * router, do not delete it. Instead, reset the GC
1212 * timer using the router's lifetime.
1213 * Simply deleting the entry may affect default
1214 * router selection, which is not necessarily a good
1215 * thing, especially when we're using router preference
1216 * values.
1217 * XXX: the check for ln_state would be redundant,
1218 * but we intentionally keep it just in case.
1219 */
1220 if (ln->ln_expire > time_uptime)
1221 nd6_llinfo_settimer(ln,
1222 (ln->ln_expire - time_uptime) * hz);
1223 else
1224 nd6_llinfo_settimer(ln, nd6_gctimer * hz);
1225 LLE_WUNLOCK(ln);
1226 return;
1227 }
1228
1229 ND6_WLOCK();
1230
1231 /*
1232 * We need to unlock to avoid a LOR with nd6_rt_flush()
1233 * with the rnh and for the calls to
1234 * nd6_pfxlist_onlink_check() and nd6_defrouter_select() in the
1235 * block further down for calls into nd6_lookup().
1236 * We still hold a ref.
1237 *
1238 * Temporarily fake the state to choose a new default
1239 * router and to perform on-link determination of
1240 * prefixes correctly.
1241 * Below the state will be set correctly,
1242 * or the entry itself will be deleted.
1243 */
1244 ln->ln_state = ND6_LLINFO_INCOMPLETE;
1245 LLE_WUNLOCK(ln);
1246
1247 /*
1248 * nd6_rt_flush must be called whether or not the neighbor
1249 * is in the Default Router List.
1250 * See a corresponding comment in nd6_na_input().
1251 */
1252 nd6_rt_flush(in6, ifp);
1253
1254 /*
1255 * Unreachablity of a router might affect the default
1256 * router selection and on-link detection of advertised
1257 * prefixes.
1258 *
1259 * Since nd6_defrouter_select() does not affect the
1260 * on-link determination and MIP6 needs the check
1261 * before the default router selection, we perform
1262 * the check now.
1263 */
1264 nd6_pfxlist_onlink_check();
1265
1266 /*
1267 * refresh default router list
1268 */
1269 nd6_defrouter_select();
1270
1271 #ifdef __FreeBSD__
1272 /*
1273 * If this entry was added by an on-link redirect, remove the
1274 * corresponding host route.
1275 */
1276 if (ln->la_flags & LLE_REDIRECT)
1277 nd6_free_redirect(ln);
1278 #endif
1279
1280 ND6_UNLOCK();
1281 LLE_WLOCK(ln);
1282 }
1283
1284 sockaddr_in6_init(&sin6, in6, 0, 0, 0);
1285 rt_clonedmsg(RTM_DELETE, sin6tosa(&sin6),
1286 (const uint8_t *)&ln->ll_addr, ifp);
1287
1288 /*
1289 * Save to unlock. We still hold an extra reference and will not
1290 * free(9) in llentry_free() if someone else holds one as well.
1291 */
1292 LLE_WUNLOCK(ln);
1293 IF_AFDATA_LOCK(ifp);
1294 LLE_WLOCK(ln);
1295
1296 lltable_free_entry(LLTABLE6(ifp), ln);
1297
1298 IF_AFDATA_UNLOCK(ifp);
1299 }
1300
1301 /*
1302 * Upper-layer reachability hint for Neighbor Unreachability Detection.
1303 *
1304 * XXX cost-effective methods?
1305 */
1306 void
1307 nd6_nud_hint(struct rtentry *rt)
1308 {
1309 struct llentry *ln;
1310 struct ifnet *ifp;
1311
1312 if (rt == NULL)
1313 return;
1314
1315 ifp = rt->rt_ifp;
1316 ln = nd6_lookup(&(satocsin6(rt_getkey(rt)))->sin6_addr, ifp, true);
1317 if (ln == NULL)
1318 return;
1319
1320 if (ln->ln_state < ND6_LLINFO_REACHABLE)
1321 goto done;
1322
1323 /*
1324 * if we get upper-layer reachability confirmation many times,
1325 * it is possible we have false information.
1326 */
1327 ln->ln_byhint++;
1328 if (ln->ln_byhint > nd6_maxnudhint)
1329 goto done;
1330
1331 ln->ln_state = ND6_LLINFO_REACHABLE;
1332 if (!ND6_LLINFO_PERMANENT(ln))
1333 nd6_llinfo_settimer(ln, ND_IFINFO(rt->rt_ifp)->reachable * hz);
1334
1335 done:
1336 LLE_WUNLOCK(ln);
1337
1338 return;
1339 }
1340
1341 struct gc_args {
1342 int gc_entries;
1343 const struct in6_addr *skip_in6;
1344 };
1345
1346 static int
1347 nd6_purge_entry(struct lltable *llt, struct llentry *ln, void *farg)
1348 {
1349 struct gc_args *args = farg;
1350 int *n = &args->gc_entries;
1351 const struct in6_addr *skip_in6 = args->skip_in6;
1352
1353 if (*n <= 0)
1354 return 0;
1355
1356 if (ND6_LLINFO_PERMANENT(ln))
1357 return 0;
1358
1359 if (IN6_ARE_ADDR_EQUAL(&ln->r_l3addr.addr6, skip_in6))
1360 return 0;
1361
1362 LLE_WLOCK(ln);
1363 if (ln->ln_state > ND6_LLINFO_INCOMPLETE)
1364 ln->ln_state = ND6_LLINFO_STALE;
1365 else
1366 ln->ln_state = ND6_LLINFO_PURGE;
1367 nd6_llinfo_settimer(ln, 0);
1368 LLE_WUNLOCK(ln);
1369
1370 (*n)--;
1371 return 0;
1372 }
1373
1374 static void
1375 nd6_gc_neighbors(struct lltable *llt, const struct in6_addr *in6)
1376 {
1377
1378 if (ip6_neighborgcthresh >= 0 &&
1379 lltable_get_entry_count(llt) >= ip6_neighborgcthresh) {
1380 struct gc_args gc_args = {10, in6};
1381 /*
1382 * XXX entries that are "less recently used" should be
1383 * freed first.
1384 */
1385 lltable_foreach_lle(llt, nd6_purge_entry, &gc_args);
1386 }
1387 }
1388
1389 void
1390 nd6_rtrequest(int req, struct rtentry *rt, const struct rt_addrinfo *info)
1391 {
1392 struct sockaddr *gate = rt->rt_gateway;
1393 struct ifnet *ifp = rt->rt_ifp;
1394 uint8_t namelen = strlen(ifp->if_xname), addrlen = ifp->if_addrlen;
1395 struct ifaddr *ifa;
1396
1397 RT_DPRINTF("rt_getkey(rt) = %p\n", rt_getkey(rt));
1398
1399 if (req == RTM_LLINFO_UPD) {
1400 int rc;
1401 struct in6_addr *in6;
1402 struct in6_addr in6_all;
1403 int anycast;
1404
1405 if ((ifa = info->rti_ifa) == NULL)
1406 return;
1407
1408 in6 = &ifatoia6(ifa)->ia_addr.sin6_addr;
1409 anycast = ifatoia6(ifa)->ia6_flags & IN6_IFF_ANYCAST;
1410
1411 in6_all = in6addr_linklocal_allnodes;
1412 if ((rc = in6_setscope(&in6_all, ifa->ifa_ifp, NULL)) != 0) {
1413 log(LOG_ERR, "%s: failed to set scope %s "
1414 "(errno=%d)\n", __func__, if_name(ifp), rc);
1415 return;
1416 }
1417
1418 /* XXX don't set Override for proxy addresses */
1419 nd6_na_output(ifa->ifa_ifp, &in6_all, in6,
1420 (anycast ? 0 : ND_NA_FLAG_OVERRIDE)
1421 #if 0
1422 | (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0)
1423 #endif
1424 , 1, NULL);
1425 return;
1426 }
1427
1428 if ((rt->rt_flags & RTF_GATEWAY) != 0)
1429 return;
1430
1431 if (nd6_need_cache(ifp) == 0 && (rt->rt_flags & RTF_HOST) == 0) {
1432 RT_DPRINTF("rt_getkey(rt) = %p\n", rt_getkey(rt));
1433 /*
1434 * This is probably an interface direct route for a link
1435 * which does not need neighbor caches (e.g. fe80::%lo0/64).
1436 * We do not need special treatment below for such a route.
1437 * Moreover, the RTF_LLINFO flag which would be set below
1438 * would annoy the ndp(8) command.
1439 */
1440 return;
1441 }
1442
1443 switch (req) {
1444 case RTM_ADD: {
1445 struct psref psref;
1446
1447 RT_DPRINTF("rt_getkey(rt) = %p\n", rt_getkey(rt));
1448 /*
1449 * There is no backward compatibility :)
1450 *
1451 * if ((rt->rt_flags & RTF_HOST) == 0 &&
1452 * SIN(rt_mask(rt))->sin_addr.s_addr != 0xffffffff)
1453 * rt->rt_flags |= RTF_CLONING;
1454 */
1455 /* XXX should move to route.c? */
1456 if (rt->rt_flags & (RTF_CONNECTED | RTF_LOCAL)) {
1457 union {
1458 struct sockaddr sa;
1459 struct sockaddr_dl sdl;
1460 struct sockaddr_storage ss;
1461 } u;
1462 /*
1463 * Case 1: This route should come from a route to
1464 * interface (RTF_CLONING case) or the route should be
1465 * treated as on-link but is currently not
1466 * (RTF_LLINFO && ln == NULL case).
1467 */
1468 if (sockaddr_dl_init(&u.sdl, sizeof(u.ss),
1469 ifp->if_index, ifp->if_type,
1470 NULL, namelen, NULL, addrlen) == NULL) {
1471 printf("%s.%d: sockaddr_dl_init(, %zu, ) "
1472 "failed on %s\n", __func__, __LINE__,
1473 sizeof(u.ss), if_name(ifp));
1474 }
1475 rt_setgate(rt, &u.sa);
1476 gate = rt->rt_gateway;
1477 RT_DPRINTF("rt_getkey(rt) = %p\n", rt_getkey(rt));
1478 if (gate == NULL) {
1479 log(LOG_ERR,
1480 "%s: rt_setgate failed on %s\n", __func__,
1481 if_name(ifp));
1482 break;
1483 }
1484
1485 RT_DPRINTF("rt_getkey(rt) = %p\n", rt_getkey(rt));
1486 if ((rt->rt_flags & RTF_CONNECTED) != 0)
1487 break;
1488 }
1489 RT_DPRINTF("rt_getkey(rt) = %p\n", rt_getkey(rt));
1490 /*
1491 * In IPv4 code, we try to annonuce new RTF_ANNOUNCE entry here.
1492 * We don't do that here since llinfo is not ready yet.
1493 *
1494 * There are also couple of other things to be discussed:
1495 * - unsolicited NA code needs improvement beforehand
1496 * - RFC2461 says we MAY send multicast unsolicited NA
1497 * (7.2.6 paragraph 4), however, it also says that we
1498 * SHOULD provide a mechanism to prevent multicast NA storm.
1499 * we don't have anything like it right now.
1500 * note that the mechanism needs a mutual agreement
1501 * between proxies, which means that we need to implement
1502 * a new protocol, or a new kludge.
1503 * - from RFC2461 6.2.4, host MUST NOT send an unsolicited NA.
1504 * we need to check ip6forwarding before sending it.
1505 * (or should we allow proxy ND configuration only for
1506 * routers? there's no mention about proxy ND from hosts)
1507 */
1508 #if 0
1509 /* XXX it does not work */
1510 if (rt->rt_flags & RTF_ANNOUNCE)
1511 nd6_na_output(ifp,
1512 &satocsin6(rt_getkey(rt))->sin6_addr,
1513 &satocsin6(rt_getkey(rt))->sin6_addr,
1514 ip6_forwarding ? ND_NA_FLAG_ROUTER : 0,
1515 1, NULL);
1516 #endif
1517
1518 if ((ifp->if_flags & (IFF_POINTOPOINT | IFF_LOOPBACK)) == 0) {
1519 RT_DPRINTF("rt_getkey(rt) = %p\n", rt_getkey(rt));
1520 /*
1521 * Address resolution isn't necessary for a point to
1522 * point link, so we can skip this test for a p2p link.
1523 */
1524 if (gate->sa_family != AF_LINK ||
1525 gate->sa_len <
1526 sockaddr_dl_measure(namelen, addrlen)) {
1527 log(LOG_DEBUG,
1528 "nd6_rtrequest: bad gateway value: %s\n",
1529 if_name(ifp));
1530 break;
1531 }
1532 satosdl(gate)->sdl_type = ifp->if_type;
1533 satosdl(gate)->sdl_index = ifp->if_index;
1534 RT_DPRINTF("rt_getkey(rt) = %p\n", rt_getkey(rt));
1535 }
1536 RT_DPRINTF("rt_getkey(rt) = %p\n", rt_getkey(rt));
1537
1538 /*
1539 * When called from rt_ifa_addlocal, we cannot depend on that
1540 * the address (rt_getkey(rt)) exits in the address list of the
1541 * interface. So check RTF_LOCAL instead.
1542 */
1543 if (rt->rt_flags & RTF_LOCAL) {
1544 if (nd6_useloopback)
1545 rt->rt_ifp = lo0ifp; /* XXX */
1546 break;
1547 }
1548
1549 /*
1550 * check if rt_getkey(rt) is an address assigned
1551 * to the interface.
1552 */
1553 ifa = (struct ifaddr *)in6ifa_ifpwithaddr_psref(ifp,
1554 &satocsin6(rt_getkey(rt))->sin6_addr, &psref);
1555 if (ifa != NULL) {
1556 if (nd6_useloopback) {
1557 rt->rt_ifp = lo0ifp; /* XXX */
1558 /*
1559 * Make sure rt_ifa be equal to the ifaddr
1560 * corresponding to the address.
1561 * We need this because when we refer
1562 * rt_ifa->ia6_flags in ip6_input, we assume
1563 * that the rt_ifa points to the address instead
1564 * of the loopback address.
1565 */
1566 if (!ISSET(info->rti_flags, RTF_DONTCHANGEIFA)
1567 && ifa != rt->rt_ifa)
1568 rt_replace_ifa(rt, ifa);
1569 }
1570 } else if (rt->rt_flags & RTF_ANNOUNCE) {
1571 /* join solicited node multicast for proxy ND */
1572 if (ifp->if_flags & IFF_MULTICAST) {
1573 struct in6_addr llsol;
1574 int error;
1575
1576 llsol = satocsin6(rt_getkey(rt))->sin6_addr;
1577 llsol.s6_addr32[0] = htonl(0xff020000);
1578 llsol.s6_addr32[1] = 0;
1579 llsol.s6_addr32[2] = htonl(1);
1580 llsol.s6_addr8[12] = 0xff;
1581 if (in6_setscope(&llsol, ifp, NULL))
1582 goto out;
1583 if (!in6_addmulti(&llsol, ifp, &error, 0)) {
1584 char ip6buf[INET6_ADDRSTRLEN];
1585 nd6log(LOG_ERR, "%s: failed to join "
1586 "%s (errno=%d)\n", if_name(ifp),
1587 IN6_PRINT(ip6buf, &llsol), error);
1588 }
1589 }
1590 }
1591 out:
1592 ifa_release(ifa, &psref);
1593 /*
1594 * If we have too many cache entries, initiate immediate
1595 * purging for some entries.
1596 */
1597 if (rt->rt_ifp != NULL)
1598 nd6_gc_neighbors(LLTABLE6(rt->rt_ifp), NULL);
1599 break;
1600 }
1601
1602 case RTM_DELETE:
1603 /* leave from solicited node multicast for proxy ND */
1604 if ((rt->rt_flags & RTF_ANNOUNCE) != 0 &&
1605 (ifp->if_flags & IFF_MULTICAST) != 0) {
1606 struct in6_addr llsol;
1607
1608 llsol = satocsin6(rt_getkey(rt))->sin6_addr;
1609 llsol.s6_addr32[0] = htonl(0xff020000);
1610 llsol.s6_addr32[1] = 0;
1611 llsol.s6_addr32[2] = htonl(1);
1612 llsol.s6_addr8[12] = 0xff;
1613 if (in6_setscope(&llsol, ifp, NULL) == 0)
1614 in6_lookup_and_delete_multi(&llsol, ifp);
1615 }
1616 break;
1617 }
1618 }
1619
1620 int
1621 nd6_ioctl(u_long cmd, void *data, struct ifnet *ifp)
1622 {
1623 struct in6_drlist *drl = (struct in6_drlist *)data;
1624 struct in6_oprlist *oprl = (struct in6_oprlist *)data;
1625 struct in6_ndireq *ndi = (struct in6_ndireq *)data;
1626 struct in6_nbrinfo *nbi = (struct in6_nbrinfo *)data;
1627 struct in6_ndifreq *ndif = (struct in6_ndifreq *)data;
1628 struct nd_defrouter *dr;
1629 struct nd_prefix *pr;
1630 int i = 0, error = 0;
1631
1632 switch (cmd) {
1633 case SIOCGDRLST_IN6:
1634 /*
1635 * obsolete API, use sysctl under net.inet6.icmp6
1636 */
1637 memset(drl, 0, sizeof(*drl));
1638 ND6_RLOCK();
1639 ND_DEFROUTER_LIST_FOREACH(dr) {
1640 if (i >= DRLSTSIZ)
1641 break;
1642 drl->defrouter[i].rtaddr = dr->rtaddr;
1643 in6_clearscope(&drl->defrouter[i].rtaddr);
1644
1645 drl->defrouter[i].flags = dr->flags;
1646 drl->defrouter[i].rtlifetime = dr->rtlifetime;
1647 drl->defrouter[i].expire = dr->expire ?
1648 time_mono_to_wall(dr->expire) : 0;
1649 drl->defrouter[i].if_index = dr->ifp->if_index;
1650 i++;
1651 }
1652 ND6_UNLOCK();
1653 break;
1654 case SIOCGPRLST_IN6:
1655 /*
1656 * obsolete API, use sysctl under net.inet6.icmp6
1657 *
1658 * XXX the structure in6_prlist was changed in backward-
1659 * incompatible manner. in6_oprlist is used for SIOCGPRLST_IN6,
1660 * in6_prlist is used for nd6_sysctl() - fill_prlist().
1661 */
1662 /*
1663 * XXX meaning of fields, especialy "raflags", is very
1664 * differnet between RA prefix list and RR/static prefix list.
1665 * how about separating ioctls into two?
1666 */
1667 memset(oprl, 0, sizeof(*oprl));
1668 ND6_RLOCK();
1669 ND_PREFIX_LIST_FOREACH(pr) {
1670 struct nd_pfxrouter *pfr;
1671 int j;
1672
1673 if (i >= PRLSTSIZ)
1674 break;
1675 oprl->prefix[i].prefix = pr->ndpr_prefix.sin6_addr;
1676 oprl->prefix[i].raflags = pr->ndpr_raf;
1677 oprl->prefix[i].prefixlen = pr->ndpr_plen;
1678 oprl->prefix[i].vltime = pr->ndpr_vltime;
1679 oprl->prefix[i].pltime = pr->ndpr_pltime;
1680 oprl->prefix[i].if_index = pr->ndpr_ifp->if_index;
1681 if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
1682 oprl->prefix[i].expire = 0;
1683 else {
1684 time_t maxexpire;
1685
1686 /* XXX: we assume time_t is signed. */
1687 maxexpire = (-1) &
1688 ~((time_t)1 <<
1689 ((sizeof(maxexpire) * 8) - 1));
1690 if (pr->ndpr_vltime <
1691 maxexpire - pr->ndpr_lastupdate) {
1692 time_t expire;
1693 expire = pr->ndpr_lastupdate +
1694 pr->ndpr_vltime;
1695 oprl->prefix[i].expire = expire ?
1696 time_mono_to_wall(expire) : 0;
1697 } else
1698 oprl->prefix[i].expire = maxexpire;
1699 }
1700
1701 j = 0;
1702 LIST_FOREACH(pfr, &pr->ndpr_advrtrs, pfr_entry) {
1703 if (j < DRLSTSIZ) {
1704 #define RTRADDR oprl->prefix[i].advrtr[j]
1705 RTRADDR = pfr->router->rtaddr;
1706 in6_clearscope(&RTRADDR);
1707 #undef RTRADDR
1708 }
1709 j++;
1710 }
1711 oprl->prefix[i].advrtrs = j;
1712 oprl->prefix[i].origin = PR_ORIG_RA;
1713
1714 i++;
1715 }
1716 ND6_UNLOCK();
1717
1718 break;
1719 case OSIOCGIFINFO_IN6:
1720 #define ND ndi->ndi
1721 /* XXX: old ndp(8) assumes a positive value for linkmtu. */
1722 memset(&ND, 0, sizeof(ND));
1723 ND.linkmtu = IN6_LINKMTU(ifp);
1724 ND.maxmtu = ND_IFINFO(ifp)->maxmtu;
1725 ND.basereachable = ND_IFINFO(ifp)->basereachable;
1726 ND.reachable = ND_IFINFO(ifp)->reachable;
1727 ND.retrans = ND_IFINFO(ifp)->retrans;
1728 ND.flags = ND_IFINFO(ifp)->flags;
1729 ND.recalctm = ND_IFINFO(ifp)->recalctm;
1730 ND.chlim = ND_IFINFO(ifp)->chlim;
1731 break;
1732 case SIOCGIFINFO_IN6:
1733 ND = *ND_IFINFO(ifp);
1734 break;
1735 case SIOCSIFINFO_IN6:
1736 /*
1737 * used to change host variables from userland.
1738 * intented for a use on router to reflect RA configurations.
1739 */
1740 /* 0 means 'unspecified' */
1741 if (ND.linkmtu != 0) {
1742 if (ND.linkmtu < IPV6_MMTU ||
1743 ND.linkmtu > IN6_LINKMTU(ifp)) {
1744 error = EINVAL;
1745 break;
1746 }
1747 ND_IFINFO(ifp)->linkmtu = ND.linkmtu;
1748 }
1749
1750 if (ND.basereachable != 0) {
1751 int obasereachable = ND_IFINFO(ifp)->basereachable;
1752
1753 ND_IFINFO(ifp)->basereachable = ND.basereachable;
1754 if (ND.basereachable != obasereachable)
1755 ND_IFINFO(ifp)->reachable =
1756 ND_COMPUTE_RTIME(ND.basereachable);
1757 }
1758 if (ND.retrans != 0)
1759 ND_IFINFO(ifp)->retrans = ND.retrans;
1760 if (ND.chlim != 0)
1761 ND_IFINFO(ifp)->chlim = ND.chlim;
1762 /* FALLTHROUGH */
1763 case SIOCSIFINFO_FLAGS:
1764 {
1765 struct ifaddr *ifa;
1766 struct in6_ifaddr *ia;
1767 int s;
1768
1769 if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) &&
1770 !(ND.flags & ND6_IFF_IFDISABLED))
1771 {
1772 /*
1773 * If the interface is marked as ND6_IFF_IFDISABLED and
1774 * has a link-local address with IN6_IFF_DUPLICATED,
1775 * do not clear ND6_IFF_IFDISABLED.
1776 * See RFC 4862, section 5.4.5.
1777 */
1778 int duplicated_linklocal = 0;
1779
1780 s = pserialize_read_enter();
1781 IFADDR_READER_FOREACH(ifa, ifp) {
1782 if (ifa->ifa_addr->sa_family != AF_INET6)
1783 continue;
1784 ia = (struct in6_ifaddr *)ifa;
1785 if ((ia->ia6_flags & IN6_IFF_DUPLICATED) &&
1786 IN6_IS_ADDR_LINKLOCAL(IA6_IN6(ia)))
1787 {
1788 duplicated_linklocal = 1;
1789 break;
1790 }
1791 }
1792 pserialize_read_exit(s);
1793
1794 if (duplicated_linklocal) {
1795 ND.flags |= ND6_IFF_IFDISABLED;
1796 log(LOG_ERR, "%s: Cannot enable an interface"
1797 " with a link-local address marked"
1798 " duplicate.\n", if_name(ifp));
1799 } else {
1800 ND_IFINFO(ifp)->flags &= ~ND6_IFF_IFDISABLED;
1801 if (ifp->if_flags & IFF_UP)
1802 in6_if_up(ifp);
1803 }
1804 } else if (!(ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) &&
1805 (ND.flags & ND6_IFF_IFDISABLED)) {
1806 int bound = curlwp_bind();
1807 /* Mark all IPv6 addresses as tentative. */
1808
1809 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED;
1810 s = pserialize_read_enter();
1811 IFADDR_READER_FOREACH(ifa, ifp) {
1812 struct psref psref;
1813 if (ifa->ifa_addr->sa_family != AF_INET6)
1814 continue;
1815 ifa_acquire(ifa, &psref);
1816 pserialize_read_exit(s);
1817
1818 nd6_dad_stop(ifa);
1819
1820 ia = (struct in6_ifaddr *)ifa;
1821 ia->ia6_flags |= IN6_IFF_TENTATIVE;
1822
1823 s = pserialize_read_enter();
1824 ifa_release(ifa, &psref);
1825 }
1826 pserialize_read_exit(s);
1827 curlwp_bindx(bound);
1828 }
1829
1830 if (ND.flags & ND6_IFF_AUTO_LINKLOCAL) {
1831 if (!(ND_IFINFO(ifp)->flags & ND6_IFF_AUTO_LINKLOCAL)) {
1832 /* auto_linklocal 0->1 transition */
1833
1834 ND_IFINFO(ifp)->flags |= ND6_IFF_AUTO_LINKLOCAL;
1835 in6_ifattach(ifp, NULL);
1836 } else if (!(ND.flags & ND6_IFF_IFDISABLED) &&
1837 ifp->if_flags & IFF_UP)
1838 {
1839 /*
1840 * When the IF already has
1841 * ND6_IFF_AUTO_LINKLOCAL, no link-local
1842 * address is assigned, and IFF_UP, try to
1843 * assign one.
1844 */
1845 int haslinklocal = 0;
1846
1847 s = pserialize_read_enter();
1848 IFADDR_READER_FOREACH(ifa, ifp) {
1849 if (ifa->ifa_addr->sa_family !=AF_INET6)
1850 continue;
1851 ia = (struct in6_ifaddr *)ifa;
1852 if (IN6_IS_ADDR_LINKLOCAL(IA6_IN6(ia))){
1853 haslinklocal = 1;
1854 break;
1855 }
1856 }
1857 pserialize_read_exit(s);
1858 if (!haslinklocal)
1859 in6_ifattach(ifp, NULL);
1860 }
1861 }
1862 }
1863 ND_IFINFO(ifp)->flags = ND.flags;
1864 break;
1865 #undef ND
1866 case SIOCSNDFLUSH_IN6: /* XXX: the ioctl name is confusing... */
1867 /* sync kernel routing table with the default router list */
1868 ND6_WLOCK();
1869 nd6_defrouter_reset();
1870 nd6_defrouter_select();
1871 ND6_UNLOCK();
1872 break;
1873 case SIOCSPFXFLUSH_IN6:
1874 {
1875 /* flush all the prefix advertised by routers */
1876 struct nd_prefix *pfx, *next;
1877
1878 restart:
1879 ND6_WLOCK();
1880 ND_PREFIX_LIST_FOREACH_SAFE(pfx, next) {
1881 struct in6_ifaddr *ia, *ia_next;
1882 int _s;
1883
1884 /* Only flush prefixes for the given interface. */
1885 if (ifp != lo0ifp && ifp != pfx->ndpr_ifp)
1886 continue;
1887
1888 if (IN6_IS_ADDR_LINKLOCAL(&pfx->ndpr_prefix.sin6_addr))
1889 continue; /* XXX */
1890
1891 /* do we really have to remove addresses as well? */
1892 _s = pserialize_read_enter();
1893 for (ia = IN6_ADDRLIST_READER_FIRST(); ia;
1894 ia = ia_next) {
1895 struct ifnet *ifa_ifp;
1896 int bound;
1897 struct psref psref;
1898
1899 /* ia might be removed. keep the next ptr. */
1900 ia_next = IN6_ADDRLIST_READER_NEXT(ia);
1901
1902 if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0)
1903 continue;
1904
1905 if (ia->ia6_ndpr != pfx)
1906 continue;
1907
1908 bound = curlwp_bind();
1909 ia6_acquire(ia, &psref);
1910 pserialize_read_exit(_s);
1911 ND6_UNLOCK();
1912
1913 ifa_ifp = ia->ia_ifa.ifa_ifp;
1914 if (ifa_ifp == ifp) {
1915 /* Already have IFNET_LOCK(ifp) */
1916 KASSERT(!if_is_deactivated(ifp));
1917 ia6_release(ia, &psref);
1918 in6_purgeaddr(&ia->ia_ifa);
1919 curlwp_bindx(bound);
1920 goto restart;
1921 }
1922 IFNET_LOCK(ifa_ifp);
1923 /*
1924 * Need to take the lock first to prevent
1925 * if_detach from running in6_purgeaddr
1926 * concurrently.
1927 */
1928 if (!if_is_deactivated(ifa_ifp)) {
1929 ia6_release(ia, &psref);
1930 in6_purgeaddr(&ia->ia_ifa);
1931 } else {
1932 /*
1933 * ifp is being destroyed, ia will be
1934 * destroyed by if_detach.
1935 */
1936 ia6_release(ia, &psref);
1937 /* XXX may cause busy loop */
1938 }
1939 IFNET_UNLOCK(ifa_ifp);
1940 curlwp_bindx(bound);
1941 goto restart;
1942 }
1943 pserialize_read_exit(_s);
1944
1945 KASSERT(pfx->ndpr_refcnt == 0);
1946 nd6_prelist_remove(pfx);
1947 }
1948 ND6_UNLOCK();
1949 break;
1950 }
1951 case SIOCSRTRFLUSH_IN6:
1952 {
1953 /* flush all the default routers */
1954 struct nd_defrouter *drtr, *next;
1955
1956 ND6_WLOCK();
1957 #if 0
1958 /* XXX Is this really needed? */
1959 nd6_defrouter_reset();
1960 #endif
1961 ND_DEFROUTER_LIST_FOREACH_SAFE(drtr, next) {
1962 /* Only flush routers for the given interface. */
1963 if (ifp != lo0ifp && ifp != drtr->ifp)
1964 continue;
1965
1966 nd6_defrtrlist_del(drtr, NULL);
1967 }
1968 nd6_defrouter_select();
1969 ND6_UNLOCK();
1970 break;
1971 }
1972 case SIOCGNBRINFO_IN6:
1973 {
1974 struct llentry *ln;
1975 struct in6_addr nb_addr = nbi->addr; /* make local for safety */
1976
1977 if ((error = in6_setscope(&nb_addr, ifp, NULL)) != 0)
1978 return error;
1979
1980 ln = nd6_lookup(&nb_addr, ifp, false);
1981 if (ln == NULL) {
1982 error = EINVAL;
1983 break;
1984 }
1985 nbi->state = ln->ln_state;
1986 nbi->asked = ln->ln_asked;
1987 nbi->isrouter = ln->ln_router;
1988 nbi->expire = ln->ln_expire ?
1989 time_mono_to_wall(ln->ln_expire) : 0;
1990 LLE_RUNLOCK(ln);
1991
1992 break;
1993 }
1994 case SIOCGDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */
1995 ndif->ifindex = nd6_defifindex;
1996 break;
1997 case SIOCSDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */
1998 return nd6_setdefaultiface(ndif->ifindex);
1999 }
2000 return error;
2001 }
2002
2003 void
2004 nd6_llinfo_release_pkts(struct llentry *ln, struct ifnet *ifp)
2005 {
2006 struct mbuf *m_hold, *m_hold_next;
2007 struct sockaddr_in6 sin6;
2008
2009 LLE_WLOCK_ASSERT(ln);
2010
2011 sockaddr_in6_init(&sin6, &ln->r_l3addr.addr6, 0, 0, 0);
2012
2013 m_hold = ln->la_hold, ln->la_hold = NULL, ln->la_numheld = 0;
2014
2015 LLE_WUNLOCK(ln);
2016 for (; m_hold != NULL; m_hold = m_hold_next) {
2017 m_hold_next = m_hold->m_nextpkt;
2018 m_hold->m_nextpkt = NULL;
2019
2020 /*
2021 * we assume ifp is not a p2p here, so
2022 * just set the 2nd argument as the
2023 * 1st one.
2024 */
2025 ip6_if_output(ifp, ifp, m_hold, &sin6, NULL);
2026 }
2027 LLE_WLOCK(ln);
2028 }
2029
2030 /*
2031 * Create neighbor cache entry and cache link-layer address,
2032 * on reception of inbound ND6 packets. (RS/RA/NS/redirect)
2033 */
2034 void
2035 nd6_cache_lladdr(
2036 struct ifnet *ifp,
2037 struct in6_addr *from,
2038 char *lladdr,
2039 int lladdrlen,
2040 int type, /* ICMP6 type */
2041 int code /* type dependent information */
2042 )
2043 {
2044 struct nd_ifinfo *ndi = ND_IFINFO(ifp);
2045 struct llentry *ln = NULL;
2046 int is_newentry;
2047 int do_update;
2048 int olladdr;
2049 int llchange;
2050 int newstate = 0;
2051 uint16_t router = 0;
2052
2053 KASSERT(ifp != NULL);
2054 KASSERT(from != NULL);
2055
2056 /* nothing must be updated for unspecified address */
2057 if (IN6_IS_ADDR_UNSPECIFIED(from))
2058 return;
2059
2060 /*
2061 * Validation about ifp->if_addrlen and lladdrlen must be done in
2062 * the caller.
2063 *
2064 * XXX If the link does not have link-layer adderss, what should
2065 * we do? (ifp->if_addrlen == 0)
2066 * Spec says nothing in sections for RA, RS and NA. There's small
2067 * description on it in NS section (RFC 2461 7.2.3).
2068 */
2069
2070 ln = nd6_lookup(from, ifp, true);
2071 if (ln == NULL) {
2072 #if 0
2073 /* nothing must be done if there's no lladdr */
2074 if (!lladdr || !lladdrlen)
2075 return NULL;
2076 #endif
2077
2078 ln = nd6_create(from, ifp);
2079 is_newentry = 1;
2080 } else {
2081 /* do nothing if static ndp is set */
2082 if (ln->la_flags & LLE_STATIC) {
2083 LLE_WUNLOCK(ln);
2084 return;
2085 }
2086 is_newentry = 0;
2087 }
2088
2089 if (ln == NULL)
2090 return;
2091
2092 olladdr = (ln->la_flags & LLE_VALID) ? 1 : 0;
2093 if (olladdr && lladdr) {
2094 llchange = memcmp(lladdr, &ln->ll_addr, ifp->if_addrlen);
2095 } else
2096 llchange = 0;
2097
2098 /*
2099 * newentry olladdr lladdr llchange (*=record)
2100 * 0 n n -- (1)
2101 * 0 y n -- (2)
2102 * 0 n y -- (3) * STALE
2103 * 0 y y n (4) *
2104 * 0 y y y (5) * STALE
2105 * 1 -- n -- (6) NOSTATE(= PASSIVE)
2106 * 1 -- y -- (7) * STALE
2107 */
2108
2109 if (lladdr) { /* (3-5) and (7) */
2110 /*
2111 * Record source link-layer address
2112 * XXX is it dependent to ifp->if_type?
2113 */
2114 memcpy(&ln->ll_addr, lladdr, ifp->if_addrlen);
2115 ln->la_flags |= LLE_VALID;
2116 }
2117
2118 if (!is_newentry) {
2119 if ((!olladdr && lladdr) || /* (3) */
2120 (olladdr && lladdr && llchange)) { /* (5) */
2121 do_update = 1;
2122 newstate = ND6_LLINFO_STALE;
2123 } else /* (1-2,4) */
2124 do_update = 0;
2125 } else {
2126 do_update = 1;
2127 if (lladdr == NULL) /* (6) */
2128 newstate = ND6_LLINFO_NOSTATE;
2129 else /* (7) */
2130 newstate = ND6_LLINFO_STALE;
2131 }
2132
2133 if (do_update) {
2134 /*
2135 * Update the state of the neighbor cache.
2136 */
2137 ln->ln_state = newstate;
2138
2139 if (ln->ln_state == ND6_LLINFO_STALE) {
2140 /*
2141 * XXX: since nd6_output() below will cause
2142 * state tansition to DELAY and reset the timer,
2143 * we must set the timer now, although it is actually
2144 * meaningless.
2145 */
2146 nd6_llinfo_settimer(ln, nd6_gctimer * hz);
2147
2148 nd6_llinfo_release_pkts(ln, ifp);
2149 } else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
2150 /* probe right away */
2151 nd6_llinfo_settimer((void *)ln, 0);
2152 }
2153 }
2154
2155 /*
2156 * ICMP6 type dependent behavior.
2157 *
2158 * NS: clear IsRouter if new entry
2159 * RS: clear IsRouter
2160 * RA: set IsRouter if there's lladdr
2161 * redir: clear IsRouter if new entry
2162 *
2163 * RA case, (1):
2164 * The spec says that we must set IsRouter in the following cases:
2165 * - If lladdr exist, set IsRouter. This means (1-5).
2166 * - If it is old entry (!newentry), set IsRouter. This means (7).
2167 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
2168 * A quetion arises for (1) case. (1) case has no lladdr in the
2169 * neighbor cache, this is similar to (6).
2170 * This case is rare but we figured that we MUST NOT set IsRouter.
2171 *
2172 * newentry olladdr lladdr llchange NS RS RA redir
2173 * D R
2174 * 0 n n -- (1) c ? s
2175 * 0 y n -- (2) c s s
2176 * 0 n y -- (3) c s s
2177 * 0 y y n (4) c s s
2178 * 0 y y y (5) c s s
2179 * 1 -- n -- (6) c c c s
2180 * 1 -- y -- (7) c c s c s
2181 *
2182 * (c=clear s=set)
2183 */
2184 switch (type & 0xff) {
2185 case ND_NEIGHBOR_SOLICIT:
2186 /*
2187 * New entry must have is_router flag cleared.
2188 */
2189 if (is_newentry) /* (6-7) */
2190 ln->ln_router = 0;
2191 break;
2192 case ND_REDIRECT:
2193 /*
2194 * If the icmp is a redirect to a better router, always set the
2195 * is_router flag. Otherwise, if the entry is newly created,
2196 * clear the flag. [RFC 2461, sec 8.3]
2197 */
2198 if (code == ND_REDIRECT_ROUTER)
2199 ln->ln_router = 1;
2200 else if (is_newentry) /* (6-7) */
2201 ln->ln_router = 0;
2202 break;
2203 case ND_ROUTER_SOLICIT:
2204 /*
2205 * is_router flag must always be cleared.
2206 */
2207 ln->ln_router = 0;
2208 break;
2209 case ND_ROUTER_ADVERT:
2210 /*
2211 * Mark an entry with lladdr as a router.
2212 */
2213 if ((!is_newentry && (olladdr || lladdr)) || /* (2-5) */
2214 (is_newentry && lladdr)) { /* (7) */
2215 ln->ln_router = 1;
2216 }
2217 break;
2218 }
2219
2220 if (do_update) {
2221 struct sockaddr_in6 sin6;
2222
2223 sockaddr_in6_init(&sin6, from, 0, 0, 0);
2224 rt_clonedmsg(is_newentry ? RTM_ADD : RTM_CHANGE,
2225 sin6tosa(&sin6), lladdr, ifp);
2226 }
2227
2228 if (ln != NULL) {
2229 router = ln->ln_router;
2230 LLE_WUNLOCK(ln);
2231 }
2232
2233 /*
2234 * If we have too many cache entries, initiate immediate
2235 * purging for some entries.
2236 */
2237 if (is_newentry)
2238 nd6_gc_neighbors(LLTABLE6(ifp), &ln->r_l3addr.addr6);
2239
2240 /*
2241 * When the link-layer address of a router changes, select the
2242 * best router again. In particular, when the neighbor entry is newly
2243 * created, it might affect the selection policy.
2244 * Question: can we restrict the first condition to the "is_newentry"
2245 * case?
2246 * XXX: when we hear an RA from a new router with the link-layer
2247 * address option, nd6_defrouter_select() is called twice, since
2248 * defrtrlist_update called the function as well. However, I believe
2249 * we can compromise the overhead, since it only happens the first
2250 * time.
2251 * XXX: although nd6_defrouter_select() should not have a bad effect
2252 * for those are not autoconfigured hosts, we explicitly avoid such
2253 * cases for safety.
2254 */
2255 if (do_update && router && !ip6_forwarding &&
2256 nd6_accepts_rtadv(ndi)) {
2257 ND6_WLOCK();
2258 nd6_defrouter_select();
2259 ND6_UNLOCK();
2260 }
2261 }
2262
2263 static void
2264 nd6_slowtimo(void *ignored_arg)
2265 {
2266 struct nd_ifinfo *nd6if;
2267 struct ifnet *ifp;
2268 int s;
2269
2270 SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
2271 callout_reset(&nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
2272 nd6_slowtimo, NULL);
2273
2274 s = pserialize_read_enter();
2275 IFNET_READER_FOREACH(ifp) {
2276 nd6if = ND_IFINFO(ifp);
2277 if (nd6if->basereachable && /* already initialized */
2278 (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
2279 /*
2280 * Since reachable time rarely changes by router
2281 * advertisements, we SHOULD insure that a new random
2282 * value gets recomputed at least once every few hours.
2283 * (RFC 2461, 6.3.4)
2284 */
2285 nd6if->recalctm = nd6_recalc_reachtm_interval;
2286 nd6if->reachable = ND_COMPUTE_RTIME(nd6if->basereachable);
2287 }
2288 }
2289 pserialize_read_exit(s);
2290
2291 SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
2292 }
2293
2294 /*
2295 * Return 0 if a neighbor cache is found. Return EWOULDBLOCK if a cache is not
2296 * found and trying to resolve a neighbor; in this case the mbuf is queued in
2297 * the list. Otherwise return errno after freeing the mbuf.
2298 */
2299 int
2300 nd6_resolve(struct ifnet *ifp, const struct rtentry *rt, struct mbuf *m,
2301 const struct sockaddr *_dst, uint8_t *lldst, size_t dstsize)
2302 {
2303 struct llentry *ln = NULL;
2304 bool created = false;
2305 const struct sockaddr_in6 *dst = satocsin6(_dst);
2306
2307 /* discard the packet if IPv6 operation is disabled on the interface */
2308 if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) {
2309 m_freem(m);
2310 return ENETDOWN; /* better error? */
2311 }
2312
2313 /*
2314 * Address resolution or Neighbor Unreachability Detection
2315 * for the next hop.
2316 * At this point, the destination of the packet must be a unicast
2317 * or an anycast address(i.e. not a multicast).
2318 */
2319
2320 /* Look up the neighbor cache for the nexthop */
2321 ln = nd6_lookup(&dst->sin6_addr, ifp, false);
2322
2323 if (ln != NULL && (ln->la_flags & LLE_VALID) != 0 &&
2324 ln->ln_state == ND6_LLINFO_REACHABLE) {
2325 /* Fast path */
2326 memcpy(lldst, &ln->ll_addr, MIN(dstsize, ifp->if_addrlen));
2327 LLE_RUNLOCK(ln);
2328 return 0;
2329 }
2330 if (ln != NULL)
2331 LLE_RUNLOCK(ln);
2332
2333 /* Slow path */
2334 ln = nd6_lookup(&dst->sin6_addr, ifp, true);
2335 if (ln == NULL && nd6_is_addr_neighbor(dst, ifp)) {
2336 struct sockaddr_in6 sin6;
2337 /*
2338 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
2339 * the condition below is not very efficient. But we believe
2340 * it is tolerable, because this should be a rare case.
2341 */
2342 ln = nd6_create(&dst->sin6_addr, ifp);
2343 if (ln == NULL) {
2344 char ip6buf[INET6_ADDRSTRLEN];
2345 log(LOG_DEBUG,
2346 "%s: can't allocate llinfo for %s "
2347 "(ln=%p, rt=%p)\n", __func__,
2348 IN6_PRINT(ip6buf, &dst->sin6_addr), ln, rt);
2349 m_freem(m);
2350 return ENOBUFS;
2351 }
2352
2353 sockaddr_in6_init(&sin6, &ln->r_l3addr.addr6, 0, 0, 0);
2354 if (rt != NULL)
2355 rt_clonedmsg(RTM_ADD, sin6tosa(&sin6), NULL, ifp);
2356
2357 created = true;
2358 }
2359
2360 if (ln == NULL) {
2361 m_freem(m);
2362 return ENETDOWN; /* better error? */
2363 }
2364
2365 LLE_WLOCK_ASSERT(ln);
2366
2367 /* We don't have to do link-layer address resolution on a p2p link. */
2368 if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
2369 ln->ln_state < ND6_LLINFO_REACHABLE) {
2370 ln->ln_state = ND6_LLINFO_STALE;
2371 nd6_llinfo_settimer(ln, nd6_gctimer * hz);
2372 }
2373
2374 /*
2375 * The first time we send a packet to a neighbor whose entry is
2376 * STALE, we have to change the state to DELAY and a sets a timer to
2377 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
2378 * neighbor unreachability detection on expiration.
2379 * (RFC 2461 7.3.3)
2380 */
2381 if (ln->ln_state == ND6_LLINFO_STALE) {
2382 ln->ln_asked = 0;
2383 ln->ln_state = ND6_LLINFO_DELAY;
2384 nd6_llinfo_settimer(ln, nd6_delay * hz);
2385 }
2386
2387 /*
2388 * If the neighbor cache entry has a state other than INCOMPLETE
2389 * (i.e. its link-layer address is already resolved), just
2390 * send the packet.
2391 */
2392 if (ln->ln_state > ND6_LLINFO_INCOMPLETE) {
2393 KASSERT((ln->la_flags & LLE_VALID) != 0);
2394 memcpy(lldst, &ln->ll_addr, MIN(dstsize, ifp->if_addrlen));
2395 LLE_WUNLOCK(ln);
2396 return 0;
2397 }
2398
2399 /*
2400 * There is a neighbor cache entry, but no ethernet address
2401 * response yet. Append this latest packet to the end of the
2402 * packet queue in the mbuf, unless the number of the packet
2403 * does not exceed nd6_maxqueuelen. When it exceeds nd6_maxqueuelen,
2404 * the oldest packet in the queue will be removed.
2405 */
2406 if (ln->ln_state == ND6_LLINFO_NOSTATE)
2407 ln->ln_state = ND6_LLINFO_INCOMPLETE;
2408 if (ln->ln_hold) {
2409 struct mbuf *m_hold;
2410 int i;
2411
2412 i = 0;
2413 for (m_hold = ln->ln_hold; m_hold; m_hold = m_hold->m_nextpkt) {
2414 i++;
2415 if (m_hold->m_nextpkt == NULL) {
2416 m_hold->m_nextpkt = m;
2417 break;
2418 }
2419 }
2420 while (i >= nd6_maxqueuelen) {
2421 m_hold = ln->ln_hold;
2422 ln->ln_hold = ln->ln_hold->m_nextpkt;
2423 m_freem(m_hold);
2424 i--;
2425 }
2426 } else {
2427 ln->ln_hold = m;
2428 }
2429
2430 /*
2431 * If there has been no NS for the neighbor after entering the
2432 * INCOMPLETE state, send the first solicitation.
2433 */
2434 if (!ND6_LLINFO_PERMANENT(ln) && ln->ln_asked == 0) {
2435 struct in6_addr src, *psrc;
2436
2437 ln->ln_asked++;
2438 nd6_llinfo_settimer(ln, ND_IFINFO(ifp)->retrans * hz / 1000);
2439 psrc = nd6_llinfo_get_holdsrc(ln, &src);
2440 LLE_WUNLOCK(ln);
2441 ln = NULL;
2442 nd6_ns_output(ifp, NULL, &dst->sin6_addr, psrc, NULL);
2443 } else {
2444 /* We did the lookup so we need to do the unlock here. */
2445 LLE_WUNLOCK(ln);
2446 }
2447
2448 if (created)
2449 nd6_gc_neighbors(LLTABLE6(ifp), &dst->sin6_addr);
2450
2451 return EWOULDBLOCK;
2452 }
2453
2454 int
2455 nd6_need_cache(struct ifnet *ifp)
2456 {
2457 /*
2458 * XXX: we currently do not make neighbor cache on any interface
2459 * other than ARCnet, Ethernet, FDDI and GIF.
2460 *
2461 * RFC2893 says:
2462 * - unidirectional tunnels needs no ND
2463 */
2464 switch (ifp->if_type) {
2465 case IFT_ARCNET:
2466 case IFT_ETHER:
2467 case IFT_FDDI:
2468 case IFT_IEEE1394:
2469 case IFT_CARP:
2470 case IFT_GIF: /* XXX need more cases? */
2471 case IFT_PPP:
2472 case IFT_TUNNEL:
2473 return 1;
2474 default:
2475 return 0;
2476 }
2477 }
2478
2479 static void
2480 clear_llinfo_pqueue(struct llentry *ln)
2481 {
2482 struct mbuf *m_hold, *m_hold_next;
2483
2484 for (m_hold = ln->ln_hold; m_hold; m_hold = m_hold_next) {
2485 m_hold_next = m_hold->m_nextpkt;
2486 m_hold->m_nextpkt = NULL;
2487 m_freem(m_hold);
2488 }
2489
2490 ln->ln_hold = NULL;
2491 return;
2492 }
2493
2494 int
2495 nd6_sysctl(
2496 int name,
2497 void *oldp, /* syscall arg, need copyout */
2498 size_t *oldlenp,
2499 void *newp, /* syscall arg, need copyin */
2500 size_t newlen
2501 )
2502 {
2503 int (*fill_func)(void *, size_t *);
2504
2505 if (newp)
2506 return EPERM;
2507
2508 switch (name) {
2509 case ICMPV6CTL_ND6_DRLIST:
2510 fill_func = fill_drlist;
2511 break;
2512
2513 case ICMPV6CTL_ND6_PRLIST:
2514 fill_func = fill_prlist;
2515 break;
2516
2517 case ICMPV6CTL_ND6_MAXQLEN:
2518 return 0;
2519
2520 default:
2521 return ENOPROTOOPT;
2522 }
2523
2524 if (oldlenp == NULL)
2525 return EINVAL;
2526
2527 size_t ol;
2528 int error = (*fill_func)(NULL, &ol); /* calc len needed */
2529 if (error)
2530 return error;
2531
2532 if (oldp == NULL) {
2533 *oldlenp = ol;
2534 return 0;
2535 }
2536
2537 ol = *oldlenp = uimin(ol, *oldlenp);
2538 if (ol == 0)
2539 return 0;
2540
2541 void *p = kmem_alloc(ol, KM_SLEEP);
2542 error = (*fill_func)(p, oldlenp);
2543 if (!error)
2544 error = copyout(p, oldp, *oldlenp);
2545 kmem_free(p, ol);
2546
2547 return error;
2548 }
2549
2550 static int
2551 fill_drlist(void *oldp, size_t *oldlenp)
2552 {
2553 int error = 0;
2554 struct in6_defrouter *d = NULL, *de = NULL;
2555 struct nd_defrouter *dr;
2556 size_t l;
2557
2558 if (oldp) {
2559 d = (struct in6_defrouter *)oldp;
2560 de = (struct in6_defrouter *)((char *)oldp + *oldlenp);
2561 }
2562 l = 0;
2563
2564 ND6_RLOCK();
2565 ND_DEFROUTER_LIST_FOREACH(dr) {
2566
2567 if (oldp && d + 1 <= de) {
2568 memset(d, 0, sizeof(*d));
2569 sockaddr_in6_init(&d->rtaddr, &dr->rtaddr, 0, 0, 0);
2570 if (sa6_recoverscope(&d->rtaddr)) {
2571 char ip6buf[INET6_ADDRSTRLEN];
2572 log(LOG_ERR,
2573 "scope error in router list (%s)\n",
2574 IN6_PRINT(ip6buf, &d->rtaddr.sin6_addr));
2575 /* XXX: press on... */
2576 }
2577 d->flags = dr->flags;
2578 d->rtlifetime = dr->rtlifetime;
2579 d->expire = dr->expire ?
2580 time_mono_to_wall(dr->expire) : 0;
2581 d->if_index = dr->ifp->if_index;
2582 }
2583
2584 l += sizeof(*d);
2585 if (d)
2586 d++;
2587 }
2588 ND6_UNLOCK();
2589
2590 *oldlenp = l; /* (void *)d - (void *)oldp */
2591
2592 return error;
2593 }
2594
2595 static int
2596 fill_prlist(void *oldp, size_t *oldlenp)
2597 {
2598 int error = 0;
2599 struct nd_prefix *pr;
2600 uint8_t *p = NULL, *ps = NULL;
2601 uint8_t *pe = NULL;
2602 size_t l;
2603 char ip6buf[INET6_ADDRSTRLEN];
2604
2605 if (oldp) {
2606 ps = p = (uint8_t*)oldp;
2607 pe = (uint8_t*)oldp + *oldlenp;
2608 }
2609 l = 0;
2610
2611 ND6_RLOCK();
2612 ND_PREFIX_LIST_FOREACH(pr) {
2613 u_short advrtrs;
2614 struct sockaddr_in6 sin6;
2615 struct nd_pfxrouter *pfr;
2616 struct in6_prefix pfx;
2617
2618 if (oldp && p + sizeof(struct in6_prefix) <= pe)
2619 {
2620 memset(&pfx, 0, sizeof(pfx));
2621 ps = p;
2622 pfx.prefix = pr->ndpr_prefix;
2623
2624 if (sa6_recoverscope(&pfx.prefix)) {
2625 log(LOG_ERR,
2626 "scope error in prefix list (%s)\n",
2627 IN6_PRINT(ip6buf, &pfx.prefix.sin6_addr));
2628 /* XXX: press on... */
2629 }
2630 pfx.raflags = pr->ndpr_raf;
2631 pfx.prefixlen = pr->ndpr_plen;
2632 pfx.vltime = pr->ndpr_vltime;
2633 pfx.pltime = pr->ndpr_pltime;
2634 pfx.if_index = pr->ndpr_ifp->if_index;
2635 if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
2636 pfx.expire = 0;
2637 else {
2638 time_t maxexpire;
2639
2640 /* XXX: we assume time_t is signed. */
2641 maxexpire = (-1) &
2642 ~((time_t)1 <<
2643 ((sizeof(maxexpire) * 8) - 1));
2644 if (pr->ndpr_vltime <
2645 maxexpire - pr->ndpr_lastupdate) {
2646 pfx.expire = pr->ndpr_lastupdate +
2647 pr->ndpr_vltime;
2648 } else
2649 pfx.expire = maxexpire;
2650 }
2651 pfx.refcnt = pr->ndpr_refcnt;
2652 pfx.flags = pr->ndpr_stateflags;
2653 pfx.origin = PR_ORIG_RA;
2654
2655 p += sizeof(pfx); l += sizeof(pfx);
2656
2657 advrtrs = 0;
2658 LIST_FOREACH(pfr, &pr->ndpr_advrtrs, pfr_entry) {
2659 if (p + sizeof(sin6) > pe) {
2660 advrtrs++;
2661 continue;
2662 }
2663
2664 sockaddr_in6_init(&sin6, &pfr->router->rtaddr,
2665 0, 0, 0);
2666 if (sa6_recoverscope(&sin6)) {
2667 log(LOG_ERR,
2668 "scope error in "
2669 "prefix list (%s)\n",
2670 IN6_PRINT(ip6buf,
2671 &pfr->router->rtaddr));
2672 }
2673 advrtrs++;
2674 memcpy(p, &sin6, sizeof(sin6));
2675 p += sizeof(sin6);
2676 l += sizeof(sin6);
2677 }
2678 pfx.advrtrs = advrtrs;
2679 memcpy(ps, &pfx, sizeof(pfx));
2680 }
2681 else {
2682 l += sizeof(pfx);
2683 advrtrs = 0;
2684 LIST_FOREACH(pfr, &pr->ndpr_advrtrs, pfr_entry) {
2685 advrtrs++;
2686 l += sizeof(sin6);
2687 }
2688 }
2689 }
2690 ND6_UNLOCK();
2691
2692 *oldlenp = l;
2693
2694 return error;
2695 }
2696
2697 static int
2698 nd6_setdefaultiface(int ifindex)
2699 {
2700 ifnet_t *ifp;
2701 int error = 0;
2702 int s;
2703
2704 s = pserialize_read_enter();
2705 ifp = if_byindex(ifindex);
2706 if (ifp == NULL) {
2707 pserialize_read_exit(s);
2708 return EINVAL;
2709 }
2710 if (nd6_defifindex != ifindex) {
2711 nd6_defifindex = ifindex;
2712 nd6_defifp = nd6_defifindex > 0 ? ifp : NULL;
2713
2714 /*
2715 * Our current implementation assumes one-to-one maping between
2716 * interfaces and links, so it would be natural to use the
2717 * default interface as the default link.
2718 */
2719 scope6_setdefault(nd6_defifp);
2720 }
2721 pserialize_read_exit(s);
2722
2723 return (error);
2724 }
2725