nd6_nbr.c revision 1.64
1 /* $NetBSD: nd6_nbr.c,v 1.64 2006/05/18 09:05:51 liamjfoy Exp $ */ 2 /* $KAME: nd6_nbr.c,v 1.61 2001/02/10 16:06:14 jinmei Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.64 2006/05/18 09:05:51 liamjfoy Exp $"); 35 36 #include "opt_inet.h" 37 #include "opt_ipsec.h" 38 39 #include <sys/param.h> 40 #include <sys/systm.h> 41 #include <sys/malloc.h> 42 #include <sys/mbuf.h> 43 #include <sys/socket.h> 44 #include <sys/sockio.h> 45 #include <sys/time.h> 46 #include <sys/kernel.h> 47 #include <sys/errno.h> 48 #include <sys/ioctl.h> 49 #include <sys/syslog.h> 50 #include <sys/queue.h> 51 #include <sys/callout.h> 52 53 #include <net/if.h> 54 #include <net/if_types.h> 55 #include <net/if_dl.h> 56 #include <net/route.h> 57 58 #include <netinet/in.h> 59 #include <netinet/in_var.h> 60 #include <netinet6/in6_var.h> 61 #include <netinet6/in6_ifattach.h> 62 #include <netinet/ip6.h> 63 #include <netinet6/ip6_var.h> 64 #include <netinet6/scope6_var.h> 65 #include <netinet6/nd6.h> 66 #include <netinet/icmp6.h> 67 68 #ifdef IPSEC 69 #include <netinet6/ipsec.h> 70 #endif 71 72 #include "carp.h" 73 #if NCARP > 0 74 #include <netinet/ip_carp.h> 75 #endif 76 77 #include <net/net_osdep.h> 78 79 #define SDL(s) ((struct sockaddr_dl *)s) 80 81 struct dadq; 82 static struct dadq *nd6_dad_find __P((struct ifaddr *)); 83 static void nd6_dad_starttimer __P((struct dadq *, int)); 84 static void nd6_dad_stoptimer __P((struct dadq *)); 85 static void nd6_dad_timer __P((struct ifaddr *)); 86 static void nd6_dad_ns_output __P((struct dadq *, struct ifaddr *)); 87 static void nd6_dad_ns_input __P((struct ifaddr *)); 88 static void nd6_dad_na_input __P((struct ifaddr *)); 89 90 static int dad_ignore_ns = 0; /* ignore NS in DAD - specwise incorrect*/ 91 static int dad_maxtry = 15; /* max # of *tries* to transmit DAD packet */ 92 93 /* 94 * Input a Neighbor Solicitation Message. 95 * 96 * Based on RFC 2461 97 * Based on RFC 2462 (duplicate address detection) 98 */ 99 void 100 nd6_ns_input(m, off, icmp6len) 101 struct mbuf *m; 102 int off, icmp6len; 103 { 104 struct ifnet *ifp = m->m_pkthdr.rcvif; 105 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 106 struct nd_neighbor_solicit *nd_ns; 107 struct in6_addr saddr6 = ip6->ip6_src; 108 struct in6_addr daddr6 = ip6->ip6_dst; 109 struct in6_addr taddr6; 110 struct in6_addr myaddr6; 111 char *lladdr = NULL; 112 struct ifaddr *ifa; 113 int lladdrlen = 0; 114 int anycast = 0, proxy = 0, tentative = 0; 115 int router = ip6_forwarding; 116 int tlladdr; 117 union nd_opts ndopts; 118 struct sockaddr_dl *proxydl = NULL; 119 120 IP6_EXTHDR_GET(nd_ns, struct nd_neighbor_solicit *, m, off, icmp6len); 121 if (nd_ns == NULL) { 122 icmp6stat.icp6s_tooshort++; 123 return; 124 } 125 ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */ 126 taddr6 = nd_ns->nd_ns_target; 127 if (in6_setscope(&taddr6, ifp, NULL) != 0) 128 goto bad; 129 130 if (ip6->ip6_hlim != 255) { 131 nd6log((LOG_ERR, 132 "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n", 133 ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src), 134 ip6_sprintf(&ip6->ip6_dst), if_name(ifp))); 135 goto bad; 136 } 137 138 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 139 /* dst has to be a solicited node multicast address. */ 140 /* don't check ifindex portion */ 141 if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL && 142 daddr6.s6_addr32[1] == 0 && 143 daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE && 144 daddr6.s6_addr8[12] == 0xff) { 145 ; /* good */ 146 } else { 147 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet " 148 "(wrong ip6 dst)\n")); 149 goto bad; 150 } 151 } 152 153 if (IN6_IS_ADDR_MULTICAST(&taddr6)) { 154 nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n")); 155 goto bad; 156 } 157 158 icmp6len -= sizeof(*nd_ns); 159 nd6_option_init(nd_ns + 1, icmp6len, &ndopts); 160 if (nd6_options(&ndopts) < 0) { 161 nd6log((LOG_INFO, 162 "nd6_ns_input: invalid ND option, ignored\n")); 163 /* nd6_options have incremented stats */ 164 goto freeit; 165 } 166 167 if (ndopts.nd_opts_src_lladdr) { 168 lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1); 169 lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3; 170 } 171 172 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) && lladdr) { 173 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet " 174 "(link-layer address option)\n")); 175 goto bad; 176 } 177 178 /* 179 * Attaching target link-layer address to the NA? 180 * (RFC 2461 7.2.4) 181 * 182 * NS IP dst is multicast MUST add 183 * Otherwise MAY be omitted 184 * 185 * In this implementation, we omit the target link-layer address 186 * in the "MAY" case. 187 */ 188 #if 0 /* too much! */ 189 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &daddr6); 190 if (ifa && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST)) 191 tlladdr = 0; 192 else 193 #endif 194 if (!IN6_IS_ADDR_MULTICAST(&daddr6)) 195 tlladdr = 0; 196 else 197 tlladdr = 1; 198 199 /* 200 * Target address (taddr6) must be either: 201 * (1) Valid unicast/anycast address for my receiving interface, 202 * (2) Unicast address for which I'm offering proxy service, or 203 * (3) "tentative" address on which DAD is being performed. 204 */ 205 /* (1) and (3) check. */ 206 #if NCARP > 0 207 if (ifp->if_carp && ifp->if_type != IFT_CARP) 208 ifa = carp_iamatch6(ifp->if_carp, &taddr6); 209 else 210 ifa = NULL; 211 if (!ifa) 212 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 213 #else 214 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 215 #endif 216 217 /* (2) check. */ 218 if (ifa == NULL) { 219 struct rtentry *rt; 220 struct sockaddr_in6 tsin6; 221 222 memset(&tsin6, 0, sizeof(tsin6)); 223 tsin6.sin6_len = sizeof(struct sockaddr_in6); 224 tsin6.sin6_family = AF_INET6; 225 tsin6.sin6_addr = taddr6; 226 227 rt = rtalloc1((struct sockaddr *)&tsin6, 0); 228 if (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 && 229 rt->rt_gateway->sa_family == AF_LINK) { 230 /* 231 * proxy NDP for single entry 232 */ 233 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 234 IN6_IFF_NOTREADY|IN6_IFF_ANYCAST); 235 if (ifa) { 236 proxy = 1; 237 proxydl = SDL(rt->rt_gateway); 238 router = 0; /* XXX */ 239 } 240 } 241 if (rt) 242 rtfree(rt); 243 } 244 if (ifa == NULL) { 245 /* 246 * We've got an NS packet, and we don't have that address 247 * assigned for us. We MUST silently ignore it. 248 * See RFC2461 7.2.3. 249 */ 250 goto freeit; 251 } 252 myaddr6 = *IFA_IN6(ifa); 253 anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST; 254 tentative = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE; 255 if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED) 256 goto freeit; 257 258 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 259 nd6log((LOG_INFO, "nd6_ns_input: lladdrlen mismatch for %s " 260 "(if %d, NS packet %d)\n", 261 ip6_sprintf(&taddr6), ifp->if_addrlen, lladdrlen - 2)); 262 goto bad; 263 } 264 265 if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) { 266 nd6log((LOG_INFO, "nd6_ns_input: duplicate IP6 address %s\n", 267 ip6_sprintf(&saddr6))); 268 goto freeit; 269 } 270 271 /* 272 * We have neighbor solicitation packet, with target address equals to 273 * one of my tentative address. 274 * 275 * src addr how to process? 276 * --- --- 277 * multicast of course, invalid (rejected in ip6_input) 278 * unicast somebody is doing address resolution -> ignore 279 * unspec dup address detection 280 * 281 * The processing is defined in RFC 2462. 282 */ 283 if (tentative) { 284 /* 285 * If source address is unspecified address, it is for 286 * duplicate address detection. 287 * 288 * If not, the packet is for addess resolution; 289 * silently ignore it. 290 */ 291 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) 292 nd6_dad_ns_input(ifa); 293 294 goto freeit; 295 } 296 297 /* 298 * If the source address is unspecified address, entries must not 299 * be created or updated. 300 * It looks that sender is performing DAD. Output NA toward 301 * all-node multicast address, to tell the sender that I'm using 302 * the address. 303 * S bit ("solicited") must be zero. 304 */ 305 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 306 struct in6_addr in6_all; 307 308 in6_all = in6addr_linklocal_allnodes; 309 if (in6_setscope(&in6_all, ifp, NULL) != 0) 310 goto bad; 311 nd6_na_output(ifp, &in6_all, &taddr6, 312 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) | 313 (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0), 314 tlladdr, (struct sockaddr *)proxydl); 315 goto freeit; 316 } 317 318 nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, ND_NEIGHBOR_SOLICIT, 0); 319 320 nd6_na_output(ifp, &saddr6, &taddr6, 321 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) | 322 (router ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED, 323 tlladdr, (struct sockaddr *)proxydl); 324 freeit: 325 m_freem(m); 326 return; 327 328 bad: 329 nd6log((LOG_ERR, "nd6_ns_input: src=%s\n", ip6_sprintf(&saddr6))); 330 nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n", ip6_sprintf(&daddr6))); 331 nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n", ip6_sprintf(&taddr6))); 332 icmp6stat.icp6s_badns++; 333 m_freem(m); 334 } 335 336 /* 337 * Output a Neighbor Solicitation Message. Caller specifies: 338 * - ICMP6 header source IP6 address 339 * - ND6 header target IP6 address 340 * - ND6 header source datalink address 341 * 342 * Based on RFC 2461 343 * Based on RFC 2462 (duplicate address detection) 344 */ 345 void 346 nd6_ns_output(ifp, daddr6, taddr6, ln, dad) 347 struct ifnet *ifp; 348 const struct in6_addr *daddr6, *taddr6; 349 struct llinfo_nd6 *ln; /* for source address determination */ 350 int dad; /* duplicate address detection */ 351 { 352 struct mbuf *m; 353 struct ip6_hdr *ip6; 354 struct nd_neighbor_solicit *nd_ns; 355 struct in6_addr *src, src_in; 356 struct ip6_moptions im6o; 357 int icmp6len; 358 int maxlen; 359 caddr_t mac; 360 struct route_in6 ro; 361 362 bzero(&ro, sizeof(ro)); 363 364 if (IN6_IS_ADDR_MULTICAST(taddr6)) 365 return; 366 367 /* estimate the size of message */ 368 maxlen = sizeof(*ip6) + sizeof(*nd_ns); 369 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; 370 #ifdef DIAGNOSTIC 371 if (max_linkhdr + maxlen >= MCLBYTES) { 372 printf("nd6_ns_output: max_linkhdr + maxlen >= MCLBYTES " 373 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES); 374 panic("nd6_ns_output: insufficient MCLBYTES"); 375 /* NOTREACHED */ 376 } 377 #endif 378 379 MGETHDR(m, M_DONTWAIT, MT_DATA); 380 if (m && max_linkhdr + maxlen >= MHLEN) { 381 MCLGET(m, M_DONTWAIT); 382 if ((m->m_flags & M_EXT) == 0) { 383 m_free(m); 384 m = NULL; 385 } 386 } 387 if (m == NULL) 388 return; 389 m->m_pkthdr.rcvif = NULL; 390 391 if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) { 392 m->m_flags |= M_MCAST; 393 im6o.im6o_multicast_ifp = ifp; 394 im6o.im6o_multicast_hlim = 255; 395 im6o.im6o_multicast_loop = 0; 396 } 397 398 icmp6len = sizeof(*nd_ns); 399 m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len; 400 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ 401 402 /* fill neighbor solicitation packet */ 403 ip6 = mtod(m, struct ip6_hdr *); 404 ip6->ip6_flow = 0; 405 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 406 ip6->ip6_vfc |= IPV6_VERSION; 407 /* ip6->ip6_plen will be set later */ 408 ip6->ip6_nxt = IPPROTO_ICMPV6; 409 ip6->ip6_hlim = 255; 410 if (daddr6) 411 ip6->ip6_dst = *daddr6; 412 else { 413 ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL; 414 ip6->ip6_dst.s6_addr16[1] = 0; 415 ip6->ip6_dst.s6_addr32[1] = 0; 416 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE; 417 ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3]; 418 ip6->ip6_dst.s6_addr8[12] = 0xff; 419 if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0) 420 goto bad; 421 } 422 if (!dad) { 423 /* 424 * RFC2461 7.2.2: 425 * "If the source address of the packet prompting the 426 * solicitation is the same as one of the addresses assigned 427 * to the outgoing interface, that address SHOULD be placed 428 * in the IP Source Address of the outgoing solicitation. 429 * Otherwise, any one of the addresses assigned to the 430 * interface should be used." 431 * 432 * We use the source address for the prompting packet 433 * (hsrc), if: 434 * - hsrc is given from the caller (by giving "ln"), and 435 * - hsrc belongs to the outgoing interface. 436 * Otherwise, we perform the source address selection as usual. 437 */ 438 struct ip6_hdr *hip6; /* hold ip6 */ 439 struct in6_addr *hsrc = NULL; 440 441 if (ln && ln->ln_hold) { 442 /* 443 * assuming every packet in ln_hold has the same IP 444 * header 445 */ 446 hip6 = mtod(ln->ln_hold, struct ip6_hdr *); 447 /* XXX pullup? */ 448 if (sizeof(*hip6) < ln->ln_hold->m_len) 449 hsrc = &hip6->ip6_src; 450 else 451 hsrc = NULL; 452 } 453 if (hsrc && in6ifa_ifpwithaddr(ifp, hsrc)) 454 src = hsrc; 455 else { 456 int error; 457 struct sockaddr_in6 dst_sa; 458 459 bzero(&dst_sa, sizeof(dst_sa)); 460 dst_sa.sin6_family = AF_INET6; 461 dst_sa.sin6_len = sizeof(dst_sa); 462 dst_sa.sin6_addr = ip6->ip6_dst; 463 464 src = in6_selectsrc(&dst_sa, NULL, 465 NULL, &ro, NULL, NULL, &error); 466 if (src == NULL) { 467 nd6log((LOG_DEBUG, 468 "nd6_ns_output: source can't be " 469 "determined: dst=%s, error=%d\n", 470 ip6_sprintf(&dst_sa.sin6_addr), error)); 471 goto bad; 472 } 473 } 474 } else { 475 /* 476 * Source address for DAD packet must always be IPv6 477 * unspecified address. (0::0) 478 * We actually don't have to 0-clear the address (we did it 479 * above), but we do so here explicitly to make the intention 480 * clearer. 481 */ 482 bzero(&src_in, sizeof(src_in)); 483 src = &src_in; 484 } 485 ip6->ip6_src = *src; 486 nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1); 487 nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT; 488 nd_ns->nd_ns_code = 0; 489 nd_ns->nd_ns_reserved = 0; 490 nd_ns->nd_ns_target = *taddr6; 491 in6_clearscope(&nd_ns->nd_ns_target); /* XXX */ 492 493 /* 494 * Add source link-layer address option. 495 * 496 * spec implementation 497 * --- --- 498 * DAD packet MUST NOT do not add the option 499 * there's no link layer address: 500 * impossible do not add the option 501 * there's link layer address: 502 * Multicast NS MUST add one add the option 503 * Unicast NS SHOULD add one add the option 504 */ 505 if (!dad && (mac = nd6_ifptomac(ifp))) { 506 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; 507 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1); 508 /* 8 byte alignments... */ 509 optlen = (optlen + 7) & ~7; 510 511 m->m_pkthdr.len += optlen; 512 m->m_len += optlen; 513 icmp6len += optlen; 514 bzero((caddr_t)nd_opt, optlen); 515 nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR; 516 nd_opt->nd_opt_len = optlen >> 3; 517 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen); 518 } 519 520 ip6->ip6_plen = htons((u_int16_t)icmp6len); 521 nd_ns->nd_ns_cksum = 0; 522 nd_ns->nd_ns_cksum = 523 in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len); 524 525 ip6_output(m, NULL, &ro, dad ? IPV6_UNSPECSRC : 0, &im6o, NULL, NULL); 526 icmp6_ifstat_inc(ifp, ifs6_out_msg); 527 icmp6_ifstat_inc(ifp, ifs6_out_neighborsolicit); 528 icmp6stat.icp6s_outhist[ND_NEIGHBOR_SOLICIT]++; 529 530 if (ro.ro_rt) { /* we don't cache this route. */ 531 RTFREE(ro.ro_rt); 532 } 533 return; 534 535 bad: 536 if (ro.ro_rt) { 537 RTFREE(ro.ro_rt); 538 } 539 m_freem(m); 540 return; 541 } 542 543 /* 544 * Neighbor advertisement input handling. 545 * 546 * Based on RFC 2461 547 * Based on RFC 2462 (duplicate address detection) 548 * 549 * the following items are not implemented yet: 550 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) 551 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) 552 */ 553 void 554 nd6_na_input(m, off, icmp6len) 555 struct mbuf *m; 556 int off, icmp6len; 557 { 558 struct ifnet *ifp = m->m_pkthdr.rcvif; 559 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 560 struct nd_neighbor_advert *nd_na; 561 #if 0 562 struct in6_addr saddr6 = ip6->ip6_src; 563 #endif 564 struct in6_addr daddr6 = ip6->ip6_dst; 565 struct in6_addr taddr6; 566 int flags; 567 int is_router; 568 int is_solicited; 569 int is_override; 570 char *lladdr = NULL; 571 int lladdrlen = 0; 572 struct ifaddr *ifa; 573 struct llinfo_nd6 *ln; 574 struct rtentry *rt; 575 struct sockaddr_dl *sdl; 576 union nd_opts ndopts; 577 578 if (ip6->ip6_hlim != 255) { 579 nd6log((LOG_ERR, 580 "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n", 581 ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src), 582 ip6_sprintf(&ip6->ip6_dst), if_name(ifp))); 583 goto bad; 584 } 585 586 IP6_EXTHDR_GET(nd_na, struct nd_neighbor_advert *, m, off, icmp6len); 587 if (nd_na == NULL) { 588 icmp6stat.icp6s_tooshort++; 589 return; 590 } 591 592 flags = nd_na->nd_na_flags_reserved; 593 is_router = ((flags & ND_NA_FLAG_ROUTER) != 0); 594 is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0); 595 is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0); 596 597 taddr6 = nd_na->nd_na_target; 598 if (in6_setscope(&taddr6, ifp, NULL)) 599 return; /* XXX: impossible */ 600 601 if (IN6_IS_ADDR_MULTICAST(&taddr6)) { 602 nd6log((LOG_ERR, 603 "nd6_na_input: invalid target address %s\n", 604 ip6_sprintf(&taddr6))); 605 goto bad; 606 } 607 if (is_solicited && IN6_IS_ADDR_MULTICAST(&daddr6)) { 608 nd6log((LOG_ERR, 609 "nd6_na_input: a solicited adv is multicasted\n")); 610 goto bad; 611 } 612 613 icmp6len -= sizeof(*nd_na); 614 nd6_option_init(nd_na + 1, icmp6len, &ndopts); 615 if (nd6_options(&ndopts) < 0) { 616 nd6log((LOG_INFO, 617 "nd6_na_input: invalid ND option, ignored\n")); 618 /* nd6_options have incremented stats */ 619 goto freeit; 620 } 621 622 if (ndopts.nd_opts_tgt_lladdr) { 623 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1); 624 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3; 625 } 626 627 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 628 629 /* 630 * Target address matches one of my interface address. 631 * 632 * If my address is tentative, this means that there's somebody 633 * already using the same address as mine. This indicates DAD failure. 634 * This is defined in RFC 2462. 635 * 636 * Otherwise, process as defined in RFC 2461. 637 */ 638 if (ifa 639 && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) { 640 nd6_dad_na_input(ifa); 641 goto freeit; 642 } 643 644 /* Just for safety, maybe unnecessary. */ 645 if (ifa) { 646 log(LOG_ERR, 647 "nd6_na_input: duplicate IP6 address %s\n", 648 ip6_sprintf(&taddr6)); 649 goto freeit; 650 } 651 652 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 653 nd6log((LOG_INFO, "nd6_na_input: lladdrlen mismatch for %s " 654 "(if %d, NA packet %d)\n", ip6_sprintf(&taddr6), 655 ifp->if_addrlen, lladdrlen - 2)); 656 goto bad; 657 } 658 659 /* 660 * If no neighbor cache entry is found, NA SHOULD silently be 661 * discarded. 662 */ 663 rt = nd6_lookup(&taddr6, 0, ifp); 664 if ((rt == NULL) || 665 ((ln = (struct llinfo_nd6 *)rt->rt_llinfo) == NULL) || 666 ((sdl = SDL(rt->rt_gateway)) == NULL)) 667 goto freeit; 668 669 if (ln->ln_state == ND6_LLINFO_INCOMPLETE) { 670 /* 671 * If the link-layer has address, and no lladdr option came, 672 * discard the packet. 673 */ 674 if (ifp->if_addrlen && !lladdr) 675 goto freeit; 676 677 /* 678 * Record link-layer address, and update the state. 679 */ 680 sdl->sdl_alen = ifp->if_addrlen; 681 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); 682 if (is_solicited) { 683 ln->ln_state = ND6_LLINFO_REACHABLE; 684 ln->ln_byhint = 0; 685 if (!ND6_LLINFO_PERMANENT(ln)) { 686 nd6_llinfo_settimer(ln, 687 (long)ND_IFINFO(rt->rt_ifp)->reachable * hz); 688 } 689 } else { 690 ln->ln_state = ND6_LLINFO_STALE; 691 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 692 } 693 if ((ln->ln_router = is_router) != 0) { 694 /* 695 * This means a router's state has changed from 696 * non-reachable to probably reachable, and might 697 * affect the status of associated prefixes.. 698 */ 699 pfxlist_onlink_check(); 700 } 701 } else { 702 int llchange; 703 704 /* 705 * Check if the link-layer address has changed or not. 706 */ 707 if (lladdr == NULL) 708 llchange = 0; 709 else { 710 if (sdl->sdl_alen) { 711 if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen)) 712 llchange = 1; 713 else 714 llchange = 0; 715 } else 716 llchange = 1; 717 } 718 719 /* 720 * This is VERY complex. Look at it with care. 721 * 722 * override solicit lladdr llchange action 723 * (L: record lladdr) 724 * 725 * 0 0 n -- (2c) 726 * 0 0 y n (2b) L 727 * 0 0 y y (1) REACHABLE->STALE 728 * 0 1 n -- (2c) *->REACHABLE 729 * 0 1 y n (2b) L *->REACHABLE 730 * 0 1 y y (1) REACHABLE->STALE 731 * 1 0 n -- (2a) 732 * 1 0 y n (2a) L 733 * 1 0 y y (2a) L *->STALE 734 * 1 1 n -- (2a) *->REACHABLE 735 * 1 1 y n (2a) L *->REACHABLE 736 * 1 1 y y (2a) L *->REACHABLE 737 */ 738 if (!is_override && lladdr != NULL && llchange) { /* (1) */ 739 /* 740 * If state is REACHABLE, make it STALE. 741 * no other updates should be done. 742 */ 743 if (ln->ln_state == ND6_LLINFO_REACHABLE) { 744 ln->ln_state = ND6_LLINFO_STALE; 745 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 746 } 747 goto freeit; 748 } else if (is_override /* (2a) */ 749 || (!is_override && lladdr != NULL && !llchange) /* (2b) */ 750 || lladdr == NULL) { /* (2c) */ 751 /* 752 * Update link-local address, if any. 753 */ 754 if (lladdr != NULL) { 755 sdl->sdl_alen = ifp->if_addrlen; 756 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); 757 } 758 759 /* 760 * If solicited, make the state REACHABLE. 761 * If not solicited and the link-layer address was 762 * changed, make it STALE. 763 */ 764 if (is_solicited) { 765 ln->ln_state = ND6_LLINFO_REACHABLE; 766 ln->ln_byhint = 0; 767 if (!ND6_LLINFO_PERMANENT(ln)) { 768 nd6_llinfo_settimer(ln, 769 (long)ND_IFINFO(ifp)->reachable * hz); 770 } 771 } else { 772 if (lladdr && llchange) { 773 ln->ln_state = ND6_LLINFO_STALE; 774 nd6_llinfo_settimer(ln, 775 (long)nd6_gctimer * hz); 776 } 777 } 778 } 779 780 if (ln->ln_router && !is_router) { 781 /* 782 * The peer dropped the router flag. 783 * Remove the sender from the Default Router List and 784 * update the Destination Cache entries. 785 */ 786 struct nd_defrouter *dr; 787 struct in6_addr *in6; 788 int s; 789 790 in6 = &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr; 791 792 /* 793 * Lock to protect the default router list. 794 * XXX: this might be unnecessary, since this function 795 * is only called under the network software interrupt 796 * context. However, we keep it just for safety. 797 */ 798 s = splsoftnet(); 799 dr = defrouter_lookup(in6, rt->rt_ifp); 800 if (dr) 801 defrtrlist_del(dr); 802 else if (!ip6_forwarding) { 803 /* 804 * Even if the neighbor is not in the default 805 * router list, the neighbor may be used 806 * as a next hop for some destinations 807 * (e.g. redirect case). So we must 808 * call rt6_flush explicitly. 809 */ 810 rt6_flush(&ip6->ip6_src, rt->rt_ifp); 811 } 812 splx(s); 813 } 814 ln->ln_router = is_router; 815 } 816 rt->rt_flags &= ~RTF_REJECT; 817 ln->ln_asked = 0; 818 if (ln->ln_hold) { 819 struct mbuf *m_hold, *m_hold_next; 820 821 for (m_hold = ln->ln_hold; m_hold; m_hold = m_hold_next) { 822 struct mbuf *mpkt = NULL; 823 824 m_hold_next = m_hold->m_nextpkt; 825 mpkt = m_copym(m_hold, 0, M_COPYALL, M_DONTWAIT); 826 if (mpkt == NULL) { 827 m_freem(m_hold); 828 break; 829 } 830 mpkt->m_nextpkt = NULL; 831 /* 832 * we assume ifp is not a loopback here, so just set 833 * the 2nd argument as the 1st one. 834 */ 835 nd6_output(ifp, ifp, mpkt, 836 (struct sockaddr_in6 *)rt_key(rt), rt); 837 } 838 ln->ln_hold = NULL; 839 } 840 841 freeit: 842 m_freem(m); 843 return; 844 845 bad: 846 icmp6stat.icp6s_badna++; 847 m_freem(m); 848 } 849 850 /* 851 * Neighbor advertisement output handling. 852 * 853 * Based on RFC 2461 854 * 855 * the following items are not implemented yet: 856 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) 857 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) 858 */ 859 void 860 nd6_na_output(ifp, daddr6_0, taddr6, flags, tlladdr, sdl0) 861 struct ifnet *ifp; 862 const struct in6_addr *daddr6_0, *taddr6; 863 u_long flags; 864 int tlladdr; /* 1 if include target link-layer address */ 865 struct sockaddr *sdl0; /* sockaddr_dl (= proxy NA) or NULL */ 866 { 867 struct mbuf *m; 868 struct ip6_hdr *ip6; 869 struct nd_neighbor_advert *nd_na; 870 struct ip6_moptions im6o; 871 struct sockaddr_in6 dst_sa; 872 struct in6_addr *src, daddr6; 873 int icmp6len, maxlen, error; 874 caddr_t mac; 875 struct route_in6 ro; 876 877 mac = NULL; 878 bzero(&ro, sizeof(ro)); 879 880 daddr6 = *daddr6_0; /* make a local copy for modification */ 881 882 /* estimate the size of message */ 883 maxlen = sizeof(*ip6) + sizeof(*nd_na); 884 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; 885 #ifdef DIAGNOSTIC 886 if (max_linkhdr + maxlen >= MCLBYTES) { 887 printf("nd6_na_output: max_linkhdr + maxlen >= MCLBYTES " 888 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES); 889 panic("nd6_na_output: insufficient MCLBYTES"); 890 /* NOTREACHED */ 891 } 892 #endif 893 894 MGETHDR(m, M_DONTWAIT, MT_DATA); 895 if (m && max_linkhdr + maxlen >= MHLEN) { 896 MCLGET(m, M_DONTWAIT); 897 if ((m->m_flags & M_EXT) == 0) { 898 m_free(m); 899 m = NULL; 900 } 901 } 902 if (m == NULL) 903 return; 904 m->m_pkthdr.rcvif = NULL; 905 906 if (IN6_IS_ADDR_MULTICAST(&daddr6)) { 907 m->m_flags |= M_MCAST; 908 im6o.im6o_multicast_ifp = ifp; 909 im6o.im6o_multicast_hlim = 255; 910 im6o.im6o_multicast_loop = 0; 911 } 912 913 icmp6len = sizeof(*nd_na); 914 m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len; 915 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ 916 917 /* fill neighbor advertisement packet */ 918 ip6 = mtod(m, struct ip6_hdr *); 919 ip6->ip6_flow = 0; 920 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 921 ip6->ip6_vfc |= IPV6_VERSION; 922 ip6->ip6_nxt = IPPROTO_ICMPV6; 923 ip6->ip6_hlim = 255; 924 if (IN6_IS_ADDR_UNSPECIFIED(&daddr6)) { 925 /* reply to DAD */ 926 daddr6.s6_addr16[0] = IPV6_ADDR_INT16_MLL; 927 daddr6.s6_addr16[1] = 0; 928 daddr6.s6_addr32[1] = 0; 929 daddr6.s6_addr32[2] = 0; 930 daddr6.s6_addr32[3] = IPV6_ADDR_INT32_ONE; 931 if (in6_setscope(&daddr6, ifp, NULL)) 932 goto bad; 933 934 flags &= ~ND_NA_FLAG_SOLICITED; 935 } 936 ip6->ip6_dst = daddr6; 937 bzero(&dst_sa, sizeof(struct sockaddr_in6)); 938 dst_sa.sin6_family = AF_INET6; 939 dst_sa.sin6_len = sizeof(struct sockaddr_in6); 940 dst_sa.sin6_addr = daddr6; 941 942 /* 943 * Select a source whose scope is the same as that of the dest. 944 */ 945 bcopy(&dst_sa, &ro.ro_dst, sizeof(dst_sa)); 946 src = in6_selectsrc(&dst_sa, NULL, NULL, &ro, NULL, NULL, &error); 947 if (src == NULL) { 948 nd6log((LOG_DEBUG, "nd6_na_output: source can't be " 949 "determined: dst=%s, error=%d\n", 950 ip6_sprintf(&dst_sa.sin6_addr), error)); 951 goto bad; 952 } 953 ip6->ip6_src = *src; 954 nd_na = (struct nd_neighbor_advert *)(ip6 + 1); 955 nd_na->nd_na_type = ND_NEIGHBOR_ADVERT; 956 nd_na->nd_na_code = 0; 957 nd_na->nd_na_target = *taddr6; 958 in6_clearscope(&nd_na->nd_na_target); /* XXX */ 959 960 /* 961 * "tlladdr" indicates NS's condition for adding tlladdr or not. 962 * see nd6_ns_input() for details. 963 * Basically, if NS packet is sent to unicast/anycast addr, 964 * target lladdr option SHOULD NOT be included. 965 */ 966 if (tlladdr) { 967 /* 968 * sdl0 != NULL indicates proxy NA. If we do proxy, use 969 * lladdr in sdl0. If we are not proxying (sending NA for 970 * my address) use lladdr configured for the interface. 971 */ 972 if (sdl0 == NULL) 973 mac = nd6_ifptomac(ifp); 974 else if (sdl0->sa_family == AF_LINK) { 975 struct sockaddr_dl *sdl; 976 sdl = (struct sockaddr_dl *)sdl0; 977 if (sdl->sdl_alen == ifp->if_addrlen) 978 mac = LLADDR(sdl); 979 } 980 } 981 if (tlladdr && mac) { 982 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; 983 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1); 984 985 /* roundup to 8 bytes alignment! */ 986 optlen = (optlen + 7) & ~7; 987 988 m->m_pkthdr.len += optlen; 989 m->m_len += optlen; 990 icmp6len += optlen; 991 bzero((caddr_t)nd_opt, optlen); 992 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR; 993 nd_opt->nd_opt_len = optlen >> 3; 994 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen); 995 } else 996 flags &= ~ND_NA_FLAG_OVERRIDE; 997 998 ip6->ip6_plen = htons((u_int16_t)icmp6len); 999 nd_na->nd_na_flags_reserved = flags; 1000 nd_na->nd_na_cksum = 0; 1001 nd_na->nd_na_cksum = 1002 in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len); 1003 1004 ip6_output(m, NULL, NULL, 0, &im6o, (struct socket *)NULL, NULL); 1005 1006 icmp6_ifstat_inc(ifp, ifs6_out_msg); 1007 icmp6_ifstat_inc(ifp, ifs6_out_neighboradvert); 1008 icmp6stat.icp6s_outhist[ND_NEIGHBOR_ADVERT]++; 1009 1010 if (ro.ro_rt) { /* we don't cache this route. */ 1011 RTFREE(ro.ro_rt); 1012 } 1013 return; 1014 1015 bad: 1016 if (ro.ro_rt) { 1017 RTFREE(ro.ro_rt); 1018 } 1019 m_freem(m); 1020 return; 1021 } 1022 1023 caddr_t 1024 nd6_ifptomac(ifp) 1025 struct ifnet *ifp; 1026 { 1027 switch (ifp->if_type) { 1028 case IFT_ARCNET: 1029 case IFT_ETHER: 1030 case IFT_FDDI: 1031 case IFT_IEEE1394: 1032 case IFT_PROPVIRTUAL: 1033 case IFT_CARP: 1034 case IFT_L2VLAN: 1035 case IFT_IEEE80211: 1036 return LLADDR(ifp->if_sadl); 1037 default: 1038 return NULL; 1039 } 1040 } 1041 1042 TAILQ_HEAD(dadq_head, dadq); 1043 struct dadq { 1044 TAILQ_ENTRY(dadq) dad_list; 1045 struct ifaddr *dad_ifa; 1046 int dad_count; /* max NS to send */ 1047 int dad_ns_tcount; /* # of trials to send NS */ 1048 int dad_ns_ocount; /* NS sent so far */ 1049 int dad_ns_icount; 1050 int dad_na_icount; 1051 struct callout dad_timer_ch; 1052 }; 1053 1054 static struct dadq_head dadq; 1055 static int dad_init = 0; 1056 1057 static struct dadq * 1058 nd6_dad_find(ifa) 1059 struct ifaddr *ifa; 1060 { 1061 struct dadq *dp; 1062 1063 for (dp = dadq.tqh_first; dp; dp = dp->dad_list.tqe_next) { 1064 if (dp->dad_ifa == ifa) 1065 return dp; 1066 } 1067 return NULL; 1068 } 1069 1070 static void 1071 nd6_dad_starttimer(dp, ticks) 1072 struct dadq *dp; 1073 int ticks; 1074 { 1075 1076 callout_reset(&dp->dad_timer_ch, ticks, 1077 (void (*) __P((void *)))nd6_dad_timer, (void *)dp->dad_ifa); 1078 } 1079 1080 static void 1081 nd6_dad_stoptimer(dp) 1082 struct dadq *dp; 1083 { 1084 1085 callout_stop(&dp->dad_timer_ch); 1086 } 1087 1088 /* 1089 * Start Duplicate Address Detection (DAD) for specified interface address. 1090 */ 1091 void 1092 nd6_dad_start(ifa, xtick) 1093 struct ifaddr *ifa; 1094 int xtick; /* minimum delay ticks for IFF_UP event */ 1095 { 1096 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1097 struct dadq *dp; 1098 1099 if (!dad_init) { 1100 TAILQ_INIT(&dadq); 1101 dad_init++; 1102 } 1103 1104 /* 1105 * If we don't need DAD, don't do it. 1106 * There are several cases: 1107 * - DAD is disabled (ip6_dad_count == 0) 1108 * - the interface address is anycast 1109 */ 1110 if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) { 1111 log(LOG_DEBUG, 1112 "nd6_dad_start: called with non-tentative address " 1113 "%s(%s)\n", 1114 ip6_sprintf(&ia->ia_addr.sin6_addr), 1115 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1116 return; 1117 } 1118 if (ia->ia6_flags & IN6_IFF_ANYCAST) { 1119 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1120 return; 1121 } 1122 if (!ip6_dad_count) { 1123 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1124 return; 1125 } 1126 if (ifa->ifa_ifp == NULL) 1127 panic("nd6_dad_start: ifa->ifa_ifp == NULL"); 1128 if (!(ifa->ifa_ifp->if_flags & IFF_UP)) 1129 return; 1130 if (nd6_dad_find(ifa) != NULL) { 1131 /* DAD already in progress */ 1132 return; 1133 } 1134 1135 dp = malloc(sizeof(*dp), M_IP6NDP, M_NOWAIT); 1136 if (dp == NULL) { 1137 log(LOG_ERR, "nd6_dad_start: memory allocation failed for " 1138 "%s(%s)\n", 1139 ip6_sprintf(&ia->ia_addr.sin6_addr), 1140 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1141 return; 1142 } 1143 bzero(dp, sizeof(*dp)); 1144 callout_init(&dp->dad_timer_ch); 1145 TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list); 1146 1147 nd6log((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp), 1148 ip6_sprintf(&ia->ia_addr.sin6_addr))); 1149 1150 /* 1151 * Send NS packet for DAD, ip6_dad_count times. 1152 * Note that we must delay the first transmission, if this is the 1153 * first packet to be sent from the interface after interface 1154 * (re)initialization. 1155 */ 1156 dp->dad_ifa = ifa; 1157 IFAREF(ifa); /* just for safety */ 1158 dp->dad_count = ip6_dad_count; 1159 dp->dad_ns_icount = dp->dad_na_icount = 0; 1160 dp->dad_ns_ocount = dp->dad_ns_tcount = 0; 1161 if (xtick == 0) { 1162 nd6_dad_ns_output(dp, ifa); 1163 nd6_dad_starttimer(dp, 1164 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000); 1165 } else 1166 nd6_dad_starttimer(dp, xtick); 1167 } 1168 1169 /* 1170 * terminate DAD unconditionally. used for address removals. 1171 */ 1172 void 1173 nd6_dad_stop(ifa) 1174 struct ifaddr *ifa; 1175 { 1176 struct dadq *dp; 1177 1178 if (!dad_init) 1179 return; 1180 dp = nd6_dad_find(ifa); 1181 if (dp == NULL) { 1182 /* DAD wasn't started yet */ 1183 return; 1184 } 1185 1186 nd6_dad_stoptimer(dp); 1187 1188 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1189 free(dp, M_IP6NDP); 1190 dp = NULL; 1191 IFAFREE(ifa); 1192 } 1193 1194 static void 1195 nd6_dad_timer(ifa) 1196 struct ifaddr *ifa; 1197 { 1198 int s; 1199 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1200 struct dadq *dp; 1201 1202 s = splsoftnet(); /* XXX */ 1203 1204 /* Sanity check */ 1205 if (ia == NULL) { 1206 log(LOG_ERR, "nd6_dad_timer: called with null parameter\n"); 1207 goto done; 1208 } 1209 dp = nd6_dad_find(ifa); 1210 if (dp == NULL) { 1211 log(LOG_ERR, "nd6_dad_timer: DAD structure not found\n"); 1212 goto done; 1213 } 1214 if (ia->ia6_flags & IN6_IFF_DUPLICATED) { 1215 log(LOG_ERR, "nd6_dad_timer: called with duplicate address " 1216 "%s(%s)\n", 1217 ip6_sprintf(&ia->ia_addr.sin6_addr), 1218 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1219 goto done; 1220 } 1221 if ((ia->ia6_flags & IN6_IFF_TENTATIVE) == 0) { 1222 log(LOG_ERR, "nd6_dad_timer: called with non-tentative address " 1223 "%s(%s)\n", 1224 ip6_sprintf(&ia->ia_addr.sin6_addr), 1225 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1226 goto done; 1227 } 1228 1229 /* timeouted with IFF_{RUNNING,UP} check */ 1230 if (dp->dad_ns_tcount > dad_maxtry) { 1231 nd6log((LOG_INFO, "%s: could not run DAD, driver problem?\n", 1232 if_name(ifa->ifa_ifp))); 1233 1234 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1235 free(dp, M_IP6NDP); 1236 dp = NULL; 1237 IFAFREE(ifa); 1238 goto done; 1239 } 1240 1241 /* Need more checks? */ 1242 if (dp->dad_ns_ocount < dp->dad_count) { 1243 /* 1244 * We have more NS to go. Send NS packet for DAD. 1245 */ 1246 nd6_dad_ns_output(dp, ifa); 1247 nd6_dad_starttimer(dp, 1248 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000); 1249 } else { 1250 /* 1251 * We have transmitted sufficient number of DAD packets. 1252 * See what we've got. 1253 */ 1254 int duplicate; 1255 1256 duplicate = 0; 1257 1258 if (dp->dad_na_icount) { 1259 /* 1260 * the check is in nd6_dad_na_input(), 1261 * but just in case 1262 */ 1263 duplicate++; 1264 } 1265 1266 if (dp->dad_ns_icount) { 1267 /* We've seen NS, means DAD has failed. */ 1268 duplicate++; 1269 } 1270 1271 if (duplicate) { 1272 /* (*dp) will be freed in nd6_dad_duplicated() */ 1273 dp = NULL; 1274 nd6_dad_duplicated(ifa); 1275 } else { 1276 /* 1277 * We are done with DAD. No NA came, no NS came. 1278 * No duplicate address found. 1279 */ 1280 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1281 1282 nd6log((LOG_DEBUG, 1283 "%s: DAD complete for %s - no duplicates found\n", 1284 if_name(ifa->ifa_ifp), 1285 ip6_sprintf(&ia->ia_addr.sin6_addr))); 1286 1287 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1288 free(dp, M_IP6NDP); 1289 dp = NULL; 1290 IFAFREE(ifa); 1291 } 1292 } 1293 1294 done: 1295 splx(s); 1296 } 1297 1298 void 1299 nd6_dad_duplicated(ifa) 1300 struct ifaddr *ifa; 1301 { 1302 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1303 struct ifnet *ifp; 1304 struct dadq *dp; 1305 1306 dp = nd6_dad_find(ifa); 1307 if (dp == NULL) { 1308 log(LOG_ERR, "nd6_dad_duplicated: DAD structure not found\n"); 1309 return; 1310 } 1311 1312 ifp = ifa->ifa_ifp; 1313 log(LOG_ERR, "%s: DAD detected duplicate IPv6 address %s: " 1314 "NS in/out=%d/%d, NA in=%d\n", 1315 if_name(ifp), ip6_sprintf(&ia->ia_addr.sin6_addr), 1316 dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_na_icount); 1317 1318 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1319 ia->ia6_flags |= IN6_IFF_DUPLICATED; 1320 1321 /* We are done with DAD, with duplicated address found. (failure) */ 1322 nd6_dad_stoptimer(dp); 1323 1324 log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n", 1325 if_name(ifp), ip6_sprintf(&ia->ia_addr.sin6_addr)); 1326 log(LOG_ERR, "%s: manual intervention required\n", 1327 if_name(ifp)); 1328 1329 /* 1330 * If the address is a link-local address formed from an interface 1331 * identifier based on the hardware address which is supposed to be 1332 * uniquely assigned (e.g., EUI-64 for an Ethernet interface), IP 1333 * operation on the interface SHOULD be disabled. 1334 * [rfc2462bis-03 Section 5.4.5] 1335 */ 1336 if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr)) { 1337 struct in6_addr in6; 1338 1339 /* 1340 * To avoid over-reaction, we only apply this logic when we are 1341 * very sure that hardware addresses are supposed to be unique. 1342 */ 1343 switch (ifp->if_type) { 1344 case IFT_ETHER: 1345 case IFT_FDDI: 1346 case IFT_ATM: 1347 case IFT_IEEE1394: 1348 #ifdef IFT_IEEE80211 1349 case IFT_IEEE80211: 1350 #endif 1351 in6 = ia->ia_addr.sin6_addr; 1352 if (in6_get_hw_ifid(ifp, &in6) == 0 && 1353 IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) { 1354 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED; 1355 log(LOG_ERR, "%s: possible hardware address " 1356 "duplication detected, disable IPv6\n", 1357 if_name(ifp)); 1358 } 1359 break; 1360 } 1361 } 1362 1363 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1364 free(dp, M_IP6NDP); 1365 dp = NULL; 1366 IFAFREE(ifa); 1367 } 1368 1369 static void 1370 nd6_dad_ns_output(dp, ifa) 1371 struct dadq *dp; 1372 struct ifaddr *ifa; 1373 { 1374 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1375 struct ifnet *ifp = ifa->ifa_ifp; 1376 1377 dp->dad_ns_tcount++; 1378 if ((ifp->if_flags & IFF_UP) == 0) { 1379 #if 0 1380 printf("%s: interface down?\n", if_name(ifp)); 1381 #endif 1382 return; 1383 } 1384 if ((ifp->if_flags & IFF_RUNNING) == 0) { 1385 #if 0 1386 printf("%s: interface not running?\n", if_name(ifp)); 1387 #endif 1388 return; 1389 } 1390 1391 dp->dad_ns_ocount++; 1392 nd6_ns_output(ifp, NULL, &ia->ia_addr.sin6_addr, NULL, 1); 1393 } 1394 1395 static void 1396 nd6_dad_ns_input(ifa) 1397 struct ifaddr *ifa; 1398 { 1399 struct in6_ifaddr *ia; 1400 const struct in6_addr *taddr6; 1401 struct dadq *dp; 1402 int duplicate; 1403 1404 if (ifa == NULL) 1405 panic("ifa == NULL in nd6_dad_ns_input"); 1406 1407 ia = (struct in6_ifaddr *)ifa; 1408 taddr6 = &ia->ia_addr.sin6_addr; 1409 duplicate = 0; 1410 dp = nd6_dad_find(ifa); 1411 1412 /* Quickhack - completely ignore DAD NS packets */ 1413 if (dad_ignore_ns) { 1414 nd6log((LOG_INFO, 1415 "nd6_dad_ns_input: ignoring DAD NS packet for " 1416 "address %s(%s)\n", ip6_sprintf(taddr6), 1417 if_name(ifa->ifa_ifp))); 1418 return; 1419 } 1420 1421 /* 1422 * if I'm yet to start DAD, someone else started using this address 1423 * first. I have a duplicate and you win. 1424 */ 1425 if (dp == NULL || dp->dad_ns_ocount == 0) 1426 duplicate++; 1427 1428 /* XXX more checks for loopback situation - see nd6_dad_timer too */ 1429 1430 if (duplicate) { 1431 dp = NULL; /* will be freed in nd6_dad_duplicated() */ 1432 nd6_dad_duplicated(ifa); 1433 } else { 1434 /* 1435 * not sure if I got a duplicate. 1436 * increment ns count and see what happens. 1437 */ 1438 if (dp) 1439 dp->dad_ns_icount++; 1440 } 1441 } 1442 1443 static void 1444 nd6_dad_na_input(ifa) 1445 struct ifaddr *ifa; 1446 { 1447 struct dadq *dp; 1448 1449 if (ifa == NULL) 1450 panic("ifa == NULL in nd6_dad_na_input"); 1451 1452 dp = nd6_dad_find(ifa); 1453 if (dp) 1454 dp->dad_na_icount++; 1455 1456 /* remove the address. */ 1457 nd6_dad_duplicated(ifa); 1458 } 1459
Indexes created Mon Sep 29 21:09:56 GMT 2025