nd6_nbr.c revision 1.76
1 /* $NetBSD: nd6_nbr.c,v 1.76 2007/07/09 21:11:13 ad Exp $ */ 2 /* $KAME: nd6_nbr.c,v 1.61 2001/02/10 16:06:14 jinmei Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: nd6_nbr.c,v 1.76 2007/07/09 21:11:13 ad Exp $"); 35 36 #include "opt_inet.h" 37 #include "opt_ipsec.h" 38 39 #include <sys/param.h> 40 #include <sys/systm.h> 41 #include <sys/malloc.h> 42 #include <sys/mbuf.h> 43 #include <sys/socket.h> 44 #include <sys/sockio.h> 45 #include <sys/time.h> 46 #include <sys/kernel.h> 47 #include <sys/errno.h> 48 #include <sys/ioctl.h> 49 #include <sys/syslog.h> 50 #include <sys/queue.h> 51 #include <sys/callout.h> 52 53 #include <net/if.h> 54 #include <net/if_types.h> 55 #include <net/if_dl.h> 56 #include <net/route.h> 57 58 #include <netinet/in.h> 59 #include <netinet/in_var.h> 60 #include <netinet6/in6_var.h> 61 #include <netinet6/in6_ifattach.h> 62 #include <netinet/ip6.h> 63 #include <netinet6/ip6_var.h> 64 #include <netinet6/scope6_var.h> 65 #include <netinet6/nd6.h> 66 #include <netinet/icmp6.h> 67 68 #ifdef IPSEC 69 #include <netinet6/ipsec.h> 70 #endif 71 72 #include "carp.h" 73 #if NCARP > 0 74 #include <netinet/ip_carp.h> 75 #endif 76 77 #include <net/net_osdep.h> 78 79 #define SDL(s) ((struct sockaddr_dl *)s) 80 81 struct dadq; 82 static struct dadq *nd6_dad_find(struct ifaddr *); 83 static void nd6_dad_starttimer(struct dadq *, int); 84 static void nd6_dad_stoptimer(struct dadq *); 85 static void nd6_dad_timer(struct ifaddr *); 86 static void nd6_dad_ns_output(struct dadq *, struct ifaddr *); 87 static void nd6_dad_ns_input(struct ifaddr *); 88 static void nd6_dad_na_input(struct ifaddr *); 89 90 static int dad_ignore_ns = 0; /* ignore NS in DAD - specwise incorrect*/ 91 static int dad_maxtry = 15; /* max # of *tries* to transmit DAD packet */ 92 93 /* 94 * Input a Neighbor Solicitation Message. 95 * 96 * Based on RFC 2461 97 * Based on RFC 2462 (duplicate address detection) 98 */ 99 void 100 nd6_ns_input(struct mbuf *m, int off, int icmp6len) 101 { 102 struct ifnet *ifp = m->m_pkthdr.rcvif; 103 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 104 struct nd_neighbor_solicit *nd_ns; 105 struct in6_addr saddr6 = ip6->ip6_src; 106 struct in6_addr daddr6 = ip6->ip6_dst; 107 struct in6_addr taddr6; 108 struct in6_addr myaddr6; 109 char *lladdr = NULL; 110 struct ifaddr *ifa; 111 int lladdrlen = 0; 112 int anycast = 0, proxy = 0, tentative = 0; 113 int router = ip6_forwarding; 114 int tlladdr; 115 union nd_opts ndopts; 116 struct sockaddr_dl *proxydl = NULL; 117 118 IP6_EXTHDR_GET(nd_ns, struct nd_neighbor_solicit *, m, off, icmp6len); 119 if (nd_ns == NULL) { 120 icmp6stat.icp6s_tooshort++; 121 return; 122 } 123 ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */ 124 taddr6 = nd_ns->nd_ns_target; 125 if (in6_setscope(&taddr6, ifp, NULL) != 0) 126 goto bad; 127 128 if (ip6->ip6_hlim != 255) { 129 nd6log((LOG_ERR, 130 "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n", 131 ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src), 132 ip6_sprintf(&ip6->ip6_dst), if_name(ifp))); 133 goto bad; 134 } 135 136 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 137 /* dst has to be a solicited node multicast address. */ 138 /* don't check ifindex portion */ 139 if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL && 140 daddr6.s6_addr32[1] == 0 && 141 daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE && 142 daddr6.s6_addr8[12] == 0xff) { 143 ; /* good */ 144 } else { 145 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet " 146 "(wrong ip6 dst)\n")); 147 goto bad; 148 } 149 } 150 151 if (IN6_IS_ADDR_MULTICAST(&taddr6)) { 152 nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n")); 153 goto bad; 154 } 155 156 icmp6len -= sizeof(*nd_ns); 157 nd6_option_init(nd_ns + 1, icmp6len, &ndopts); 158 if (nd6_options(&ndopts) < 0) { 159 nd6log((LOG_INFO, 160 "nd6_ns_input: invalid ND option, ignored\n")); 161 /* nd6_options have incremented stats */ 162 goto freeit; 163 } 164 165 if (ndopts.nd_opts_src_lladdr) { 166 lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1); 167 lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3; 168 } 169 170 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) && lladdr) { 171 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet " 172 "(link-layer address option)\n")); 173 goto bad; 174 } 175 176 /* 177 * Attaching target link-layer address to the NA? 178 * (RFC 2461 7.2.4) 179 * 180 * NS IP dst is multicast MUST add 181 * Otherwise MAY be omitted 182 * 183 * In this implementation, we omit the target link-layer address 184 * in the "MAY" case. 185 */ 186 #if 0 /* too much! */ 187 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &daddr6); 188 if (ifa && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST)) 189 tlladdr = 0; 190 else 191 #endif 192 if (!IN6_IS_ADDR_MULTICAST(&daddr6)) 193 tlladdr = 0; 194 else 195 tlladdr = 1; 196 197 /* 198 * Target address (taddr6) must be either: 199 * (1) Valid unicast/anycast address for my receiving interface, 200 * (2) Unicast address for which I'm offering proxy service, or 201 * (3) "tentative" address on which DAD is being performed. 202 */ 203 /* (1) and (3) check. */ 204 #if NCARP > 0 205 if (ifp->if_carp && ifp->if_type != IFT_CARP) 206 ifa = carp_iamatch6(ifp->if_carp, &taddr6); 207 else 208 ifa = NULL; 209 if (!ifa) 210 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 211 #else 212 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 213 #endif 214 215 /* (2) check. */ 216 if (ifa == NULL) { 217 struct rtentry *rt; 218 struct sockaddr_in6 tsin6; 219 220 memset(&tsin6, 0, sizeof(tsin6)); 221 tsin6.sin6_len = sizeof(struct sockaddr_in6); 222 tsin6.sin6_family = AF_INET6; 223 tsin6.sin6_addr = taddr6; 224 225 rt = rtalloc1((struct sockaddr *)&tsin6, 0); 226 if (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 && 227 rt->rt_gateway->sa_family == AF_LINK) { 228 /* 229 * proxy NDP for single entry 230 */ 231 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 232 IN6_IFF_NOTREADY|IN6_IFF_ANYCAST); 233 if (ifa) { 234 proxy = 1; 235 proxydl = SDL(rt->rt_gateway); 236 router = 0; /* XXX */ 237 } 238 } 239 if (rt) 240 rtfree(rt); 241 } 242 if (ifa == NULL) { 243 /* 244 * We've got an NS packet, and we don't have that address 245 * assigned for us. We MUST silently ignore it. 246 * See RFC2461 7.2.3. 247 */ 248 goto freeit; 249 } 250 myaddr6 = *IFA_IN6(ifa); 251 anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST; 252 tentative = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE; 253 if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED) 254 goto freeit; 255 256 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 257 nd6log((LOG_INFO, "nd6_ns_input: lladdrlen mismatch for %s " 258 "(if %d, NS packet %d)\n", 259 ip6_sprintf(&taddr6), ifp->if_addrlen, lladdrlen - 2)); 260 goto bad; 261 } 262 263 if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) { 264 nd6log((LOG_INFO, "nd6_ns_input: duplicate IP6 address %s\n", 265 ip6_sprintf(&saddr6))); 266 goto freeit; 267 } 268 269 /* 270 * We have neighbor solicitation packet, with target address equals to 271 * one of my tentative address. 272 * 273 * src addr how to process? 274 * --- --- 275 * multicast of course, invalid (rejected in ip6_input) 276 * unicast somebody is doing address resolution -> ignore 277 * unspec dup address detection 278 * 279 * The processing is defined in RFC 2462. 280 */ 281 if (tentative) { 282 /* 283 * If source address is unspecified address, it is for 284 * duplicate address detection. 285 * 286 * If not, the packet is for addess resolution; 287 * silently ignore it. 288 */ 289 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) 290 nd6_dad_ns_input(ifa); 291 292 goto freeit; 293 } 294 295 /* 296 * If the source address is unspecified address, entries must not 297 * be created or updated. 298 * It looks that sender is performing DAD. Output NA toward 299 * all-node multicast address, to tell the sender that I'm using 300 * the address. 301 * S bit ("solicited") must be zero. 302 */ 303 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 304 struct in6_addr in6_all; 305 306 in6_all = in6addr_linklocal_allnodes; 307 if (in6_setscope(&in6_all, ifp, NULL) != 0) 308 goto bad; 309 nd6_na_output(ifp, &in6_all, &taddr6, 310 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) | 311 (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0), 312 tlladdr, (struct sockaddr *)proxydl); 313 goto freeit; 314 } 315 316 nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, ND_NEIGHBOR_SOLICIT, 0); 317 318 nd6_na_output(ifp, &saddr6, &taddr6, 319 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) | 320 (router ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED, 321 tlladdr, (struct sockaddr *)proxydl); 322 freeit: 323 m_freem(m); 324 return; 325 326 bad: 327 nd6log((LOG_ERR, "nd6_ns_input: src=%s\n", ip6_sprintf(&saddr6))); 328 nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n", ip6_sprintf(&daddr6))); 329 nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n", ip6_sprintf(&taddr6))); 330 icmp6stat.icp6s_badns++; 331 m_freem(m); 332 } 333 334 /* 335 * Output a Neighbor Solicitation Message. Caller specifies: 336 * - ICMP6 header source IP6 address 337 * - ND6 header target IP6 address 338 * - ND6 header source datalink address 339 * 340 * Based on RFC 2461 341 * Based on RFC 2462 (duplicate address detection) 342 */ 343 void 344 nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6, 345 const struct in6_addr *taddr6, 346 struct llinfo_nd6 *ln, /* for source address determination */ 347 int dad /* duplicate address detection */) 348 { 349 struct mbuf *m; 350 struct ip6_hdr *ip6; 351 struct nd_neighbor_solicit *nd_ns; 352 struct in6_addr *src, src_in; 353 struct ip6_moptions im6o; 354 int icmp6len; 355 int maxlen; 356 void *mac; 357 struct route ro; 358 359 memset(&ro, 0, sizeof(ro)); 360 361 if (IN6_IS_ADDR_MULTICAST(taddr6)) 362 return; 363 364 /* estimate the size of message */ 365 maxlen = sizeof(*ip6) + sizeof(*nd_ns); 366 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; 367 #ifdef DIAGNOSTIC 368 if (max_linkhdr + maxlen >= MCLBYTES) { 369 printf("nd6_ns_output: max_linkhdr + maxlen >= MCLBYTES " 370 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES); 371 panic("nd6_ns_output: insufficient MCLBYTES"); 372 /* NOTREACHED */ 373 } 374 #endif 375 376 MGETHDR(m, M_DONTWAIT, MT_DATA); 377 if (m && max_linkhdr + maxlen >= MHLEN) { 378 MCLGET(m, M_DONTWAIT); 379 if ((m->m_flags & M_EXT) == 0) { 380 m_free(m); 381 m = NULL; 382 } 383 } 384 if (m == NULL) 385 return; 386 m->m_pkthdr.rcvif = NULL; 387 388 if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) { 389 m->m_flags |= M_MCAST; 390 im6o.im6o_multicast_ifp = ifp; 391 im6o.im6o_multicast_hlim = 255; 392 im6o.im6o_multicast_loop = 0; 393 } 394 395 icmp6len = sizeof(*nd_ns); 396 m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len; 397 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ 398 399 /* fill neighbor solicitation packet */ 400 ip6 = mtod(m, struct ip6_hdr *); 401 ip6->ip6_flow = 0; 402 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 403 ip6->ip6_vfc |= IPV6_VERSION; 404 /* ip6->ip6_plen will be set later */ 405 ip6->ip6_nxt = IPPROTO_ICMPV6; 406 ip6->ip6_hlim = 255; 407 if (daddr6) 408 ip6->ip6_dst = *daddr6; 409 else { 410 ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL; 411 ip6->ip6_dst.s6_addr16[1] = 0; 412 ip6->ip6_dst.s6_addr32[1] = 0; 413 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE; 414 ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3]; 415 ip6->ip6_dst.s6_addr8[12] = 0xff; 416 if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0) 417 goto bad; 418 } 419 if (!dad) { 420 /* 421 * RFC2461 7.2.2: 422 * "If the source address of the packet prompting the 423 * solicitation is the same as one of the addresses assigned 424 * to the outgoing interface, that address SHOULD be placed 425 * in the IP Source Address of the outgoing solicitation. 426 * Otherwise, any one of the addresses assigned to the 427 * interface should be used." 428 * 429 * We use the source address for the prompting packet 430 * (hsrc), if: 431 * - hsrc is given from the caller (by giving "ln"), and 432 * - hsrc belongs to the outgoing interface. 433 * Otherwise, we perform the source address selection as usual. 434 */ 435 struct ip6_hdr *hip6; /* hold ip6 */ 436 struct in6_addr *hsrc = NULL; 437 438 if (ln && ln->ln_hold) { 439 /* 440 * assuming every packet in ln_hold has the same IP 441 * header 442 */ 443 hip6 = mtod(ln->ln_hold, struct ip6_hdr *); 444 /* XXX pullup? */ 445 if (sizeof(*hip6) < ln->ln_hold->m_len) 446 hsrc = &hip6->ip6_src; 447 else 448 hsrc = NULL; 449 } 450 if (hsrc && in6ifa_ifpwithaddr(ifp, hsrc)) 451 src = hsrc; 452 else { 453 int error; 454 struct sockaddr_in6 dst_sa; 455 456 bzero(&dst_sa, sizeof(dst_sa)); 457 dst_sa.sin6_family = AF_INET6; 458 dst_sa.sin6_len = sizeof(dst_sa); 459 dst_sa.sin6_addr = ip6->ip6_dst; 460 461 src = in6_selectsrc(&dst_sa, NULL, 462 NULL, &ro, NULL, NULL, &error); 463 if (src == NULL) { 464 nd6log((LOG_DEBUG, 465 "nd6_ns_output: source can't be " 466 "determined: dst=%s, error=%d\n", 467 ip6_sprintf(&dst_sa.sin6_addr), error)); 468 goto bad; 469 } 470 } 471 } else { 472 /* 473 * Source address for DAD packet must always be IPv6 474 * unspecified address. (0::0) 475 * We actually don't have to 0-clear the address (we did it 476 * above), but we do so here explicitly to make the intention 477 * clearer. 478 */ 479 bzero(&src_in, sizeof(src_in)); 480 src = &src_in; 481 } 482 ip6->ip6_src = *src; 483 nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1); 484 nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT; 485 nd_ns->nd_ns_code = 0; 486 nd_ns->nd_ns_reserved = 0; 487 nd_ns->nd_ns_target = *taddr6; 488 in6_clearscope(&nd_ns->nd_ns_target); /* XXX */ 489 490 /* 491 * Add source link-layer address option. 492 * 493 * spec implementation 494 * --- --- 495 * DAD packet MUST NOT do not add the option 496 * there's no link layer address: 497 * impossible do not add the option 498 * there's link layer address: 499 * Multicast NS MUST add one add the option 500 * Unicast NS SHOULD add one add the option 501 */ 502 if (!dad && (mac = nd6_ifptomac(ifp))) { 503 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; 504 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1); 505 /* 8 byte alignments... */ 506 optlen = (optlen + 7) & ~7; 507 508 m->m_pkthdr.len += optlen; 509 m->m_len += optlen; 510 icmp6len += optlen; 511 bzero((void *)nd_opt, optlen); 512 nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR; 513 nd_opt->nd_opt_len = optlen >> 3; 514 bcopy(mac, (void *)(nd_opt + 1), ifp->if_addrlen); 515 } 516 517 ip6->ip6_plen = htons((u_int16_t)icmp6len); 518 nd_ns->nd_ns_cksum = 0; 519 nd_ns->nd_ns_cksum = 520 in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len); 521 522 ip6_output(m, NULL, &ro, dad ? IPV6_UNSPECSRC : 0, &im6o, NULL, NULL); 523 icmp6_ifstat_inc(ifp, ifs6_out_msg); 524 icmp6_ifstat_inc(ifp, ifs6_out_neighborsolicit); 525 icmp6stat.icp6s_outhist[ND_NEIGHBOR_SOLICIT]++; 526 527 rtcache_free(&ro); 528 return; 529 530 bad: 531 rtcache_free(&ro); 532 m_freem(m); 533 return; 534 } 535 536 /* 537 * Neighbor advertisement input handling. 538 * 539 * Based on RFC 2461 540 * Based on RFC 2462 (duplicate address detection) 541 * 542 * the following items are not implemented yet: 543 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) 544 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) 545 */ 546 void 547 nd6_na_input(struct mbuf *m, int off, int icmp6len) 548 { 549 struct ifnet *ifp = m->m_pkthdr.rcvif; 550 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 551 struct nd_neighbor_advert *nd_na; 552 #if 0 553 struct in6_addr saddr6 = ip6->ip6_src; 554 #endif 555 struct in6_addr daddr6 = ip6->ip6_dst; 556 struct in6_addr taddr6; 557 int flags; 558 int is_router; 559 int is_solicited; 560 int is_override; 561 char *lladdr = NULL; 562 int lladdrlen = 0; 563 struct ifaddr *ifa; 564 struct llinfo_nd6 *ln; 565 struct rtentry *rt; 566 struct sockaddr_dl *sdl; 567 union nd_opts ndopts; 568 569 if (ip6->ip6_hlim != 255) { 570 nd6log((LOG_ERR, 571 "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n", 572 ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src), 573 ip6_sprintf(&ip6->ip6_dst), if_name(ifp))); 574 goto bad; 575 } 576 577 IP6_EXTHDR_GET(nd_na, struct nd_neighbor_advert *, m, off, icmp6len); 578 if (nd_na == NULL) { 579 icmp6stat.icp6s_tooshort++; 580 return; 581 } 582 583 flags = nd_na->nd_na_flags_reserved; 584 is_router = ((flags & ND_NA_FLAG_ROUTER) != 0); 585 is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0); 586 is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0); 587 588 taddr6 = nd_na->nd_na_target; 589 if (in6_setscope(&taddr6, ifp, NULL)) 590 return; /* XXX: impossible */ 591 592 if (IN6_IS_ADDR_MULTICAST(&taddr6)) { 593 nd6log((LOG_ERR, 594 "nd6_na_input: invalid target address %s\n", 595 ip6_sprintf(&taddr6))); 596 goto bad; 597 } 598 if (is_solicited && IN6_IS_ADDR_MULTICAST(&daddr6)) { 599 nd6log((LOG_ERR, 600 "nd6_na_input: a solicited adv is multicasted\n")); 601 goto bad; 602 } 603 604 icmp6len -= sizeof(*nd_na); 605 nd6_option_init(nd_na + 1, icmp6len, &ndopts); 606 if (nd6_options(&ndopts) < 0) { 607 nd6log((LOG_INFO, 608 "nd6_na_input: invalid ND option, ignored\n")); 609 /* nd6_options have incremented stats */ 610 goto freeit; 611 } 612 613 if (ndopts.nd_opts_tgt_lladdr) { 614 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1); 615 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3; 616 } 617 618 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 619 620 /* 621 * Target address matches one of my interface address. 622 * 623 * If my address is tentative, this means that there's somebody 624 * already using the same address as mine. This indicates DAD failure. 625 * This is defined in RFC 2462. 626 * 627 * Otherwise, process as defined in RFC 2461. 628 */ 629 if (ifa 630 && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) { 631 nd6_dad_na_input(ifa); 632 goto freeit; 633 } 634 635 /* Just for safety, maybe unnecessary. */ 636 if (ifa) { 637 log(LOG_ERR, 638 "nd6_na_input: duplicate IP6 address %s\n", 639 ip6_sprintf(&taddr6)); 640 goto freeit; 641 } 642 643 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 644 nd6log((LOG_INFO, "nd6_na_input: lladdrlen mismatch for %s " 645 "(if %d, NA packet %d)\n", ip6_sprintf(&taddr6), 646 ifp->if_addrlen, lladdrlen - 2)); 647 goto bad; 648 } 649 650 /* 651 * If no neighbor cache entry is found, NA SHOULD silently be 652 * discarded. 653 */ 654 rt = nd6_lookup(&taddr6, 0, ifp); 655 if ((rt == NULL) || 656 ((ln = (struct llinfo_nd6 *)rt->rt_llinfo) == NULL) || 657 ((sdl = SDL(rt->rt_gateway)) == NULL)) 658 goto freeit; 659 660 if (ln->ln_state == ND6_LLINFO_INCOMPLETE) { 661 /* 662 * If the link-layer has address, and no lladdr option came, 663 * discard the packet. 664 */ 665 if (ifp->if_addrlen && !lladdr) 666 goto freeit; 667 668 /* 669 * Record link-layer address, and update the state. 670 */ 671 sdl->sdl_alen = ifp->if_addrlen; 672 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); 673 if (is_solicited) { 674 ln->ln_state = ND6_LLINFO_REACHABLE; 675 ln->ln_byhint = 0; 676 if (!ND6_LLINFO_PERMANENT(ln)) { 677 nd6_llinfo_settimer(ln, 678 (long)ND_IFINFO(rt->rt_ifp)->reachable * hz); 679 } 680 } else { 681 ln->ln_state = ND6_LLINFO_STALE; 682 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 683 } 684 if ((ln->ln_router = is_router) != 0) { 685 /* 686 * This means a router's state has changed from 687 * non-reachable to probably reachable, and might 688 * affect the status of associated prefixes.. 689 */ 690 pfxlist_onlink_check(); 691 } 692 } else { 693 int llchange; 694 695 /* 696 * Check if the link-layer address has changed or not. 697 */ 698 if (lladdr == NULL) 699 llchange = 0; 700 else { 701 if (sdl->sdl_alen) { 702 if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen)) 703 llchange = 1; 704 else 705 llchange = 0; 706 } else 707 llchange = 1; 708 } 709 710 /* 711 * This is VERY complex. Look at it with care. 712 * 713 * override solicit lladdr llchange action 714 * (L: record lladdr) 715 * 716 * 0 0 n -- (2c) 717 * 0 0 y n (2b) L 718 * 0 0 y y (1) REACHABLE->STALE 719 * 0 1 n -- (2c) *->REACHABLE 720 * 0 1 y n (2b) L *->REACHABLE 721 * 0 1 y y (1) REACHABLE->STALE 722 * 1 0 n -- (2a) 723 * 1 0 y n (2a) L 724 * 1 0 y y (2a) L *->STALE 725 * 1 1 n -- (2a) *->REACHABLE 726 * 1 1 y n (2a) L *->REACHABLE 727 * 1 1 y y (2a) L *->REACHABLE 728 */ 729 if (!is_override && lladdr != NULL && llchange) { /* (1) */ 730 /* 731 * If state is REACHABLE, make it STALE. 732 * no other updates should be done. 733 */ 734 if (ln->ln_state == ND6_LLINFO_REACHABLE) { 735 ln->ln_state = ND6_LLINFO_STALE; 736 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 737 } 738 goto freeit; 739 } else if (is_override /* (2a) */ 740 || (!is_override && lladdr != NULL && !llchange) /* (2b) */ 741 || lladdr == NULL) { /* (2c) */ 742 /* 743 * Update link-local address, if any. 744 */ 745 if (lladdr != NULL) { 746 sdl->sdl_alen = ifp->if_addrlen; 747 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); 748 } 749 750 /* 751 * If solicited, make the state REACHABLE. 752 * If not solicited and the link-layer address was 753 * changed, make it STALE. 754 */ 755 if (is_solicited) { 756 ln->ln_state = ND6_LLINFO_REACHABLE; 757 ln->ln_byhint = 0; 758 if (!ND6_LLINFO_PERMANENT(ln)) { 759 nd6_llinfo_settimer(ln, 760 (long)ND_IFINFO(ifp)->reachable * hz); 761 } 762 } else { 763 if (lladdr && llchange) { 764 ln->ln_state = ND6_LLINFO_STALE; 765 nd6_llinfo_settimer(ln, 766 (long)nd6_gctimer * hz); 767 } 768 } 769 } 770 771 if (ln->ln_router && !is_router) { 772 /* 773 * The peer dropped the router flag. 774 * Remove the sender from the Default Router List and 775 * update the Destination Cache entries. 776 */ 777 struct nd_defrouter *dr; 778 struct in6_addr *in6; 779 int s; 780 781 in6 = &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr; 782 783 /* 784 * Lock to protect the default router list. 785 * XXX: this might be unnecessary, since this function 786 * is only called under the network software interrupt 787 * context. However, we keep it just for safety. 788 */ 789 s = splsoftnet(); 790 dr = defrouter_lookup(in6, rt->rt_ifp); 791 if (dr) 792 defrtrlist_del(dr); 793 else if (!ip6_forwarding) { 794 /* 795 * Even if the neighbor is not in the default 796 * router list, the neighbor may be used 797 * as a next hop for some destinations 798 * (e.g. redirect case). So we must 799 * call rt6_flush explicitly. 800 */ 801 rt6_flush(&ip6->ip6_src, rt->rt_ifp); 802 } 803 splx(s); 804 } 805 ln->ln_router = is_router; 806 } 807 rt->rt_flags &= ~RTF_REJECT; 808 ln->ln_asked = 0; 809 nd6_llinfo_release_pkts(ln, ifp, rt); 810 811 freeit: 812 m_freem(m); 813 return; 814 815 bad: 816 icmp6stat.icp6s_badna++; 817 m_freem(m); 818 } 819 820 /* 821 * Neighbor advertisement output handling. 822 * 823 * Based on RFC 2461 824 * 825 * the following items are not implemented yet: 826 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) 827 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) 828 */ 829 void 830 nd6_na_output(ifp, daddr6_0, taddr6, flags, tlladdr, sdl0) 831 struct ifnet *ifp; 832 const struct in6_addr *daddr6_0, *taddr6; 833 u_long flags; 834 int tlladdr; /* 1 if include target link-layer address */ 835 struct sockaddr *sdl0; /* sockaddr_dl (= proxy NA) or NULL */ 836 { 837 struct mbuf *m; 838 struct ip6_hdr *ip6; 839 struct nd_neighbor_advert *nd_na; 840 struct ip6_moptions im6o; 841 struct sockaddr *dst; 842 union { 843 struct sockaddr dst; 844 struct sockaddr_in6 dst6; 845 } u; 846 struct in6_addr *src, daddr6; 847 int icmp6len, maxlen, error; 848 void *mac; 849 struct route ro; 850 851 mac = NULL; 852 memset(&ro, 0, sizeof(ro)); 853 854 daddr6 = *daddr6_0; /* make a local copy for modification */ 855 856 /* estimate the size of message */ 857 maxlen = sizeof(*ip6) + sizeof(*nd_na); 858 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; 859 #ifdef DIAGNOSTIC 860 if (max_linkhdr + maxlen >= MCLBYTES) { 861 printf("nd6_na_output: max_linkhdr + maxlen >= MCLBYTES " 862 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES); 863 panic("nd6_na_output: insufficient MCLBYTES"); 864 /* NOTREACHED */ 865 } 866 #endif 867 868 MGETHDR(m, M_DONTWAIT, MT_DATA); 869 if (m && max_linkhdr + maxlen >= MHLEN) { 870 MCLGET(m, M_DONTWAIT); 871 if ((m->m_flags & M_EXT) == 0) { 872 m_free(m); 873 m = NULL; 874 } 875 } 876 if (m == NULL) 877 return; 878 m->m_pkthdr.rcvif = NULL; 879 880 if (IN6_IS_ADDR_MULTICAST(&daddr6)) { 881 m->m_flags |= M_MCAST; 882 im6o.im6o_multicast_ifp = ifp; 883 im6o.im6o_multicast_hlim = 255; 884 im6o.im6o_multicast_loop = 0; 885 } 886 887 icmp6len = sizeof(*nd_na); 888 m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len; 889 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ 890 891 /* fill neighbor advertisement packet */ 892 ip6 = mtod(m, struct ip6_hdr *); 893 ip6->ip6_flow = 0; 894 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 895 ip6->ip6_vfc |= IPV6_VERSION; 896 ip6->ip6_nxt = IPPROTO_ICMPV6; 897 ip6->ip6_hlim = 255; 898 if (IN6_IS_ADDR_UNSPECIFIED(&daddr6)) { 899 /* reply to DAD */ 900 daddr6.s6_addr16[0] = IPV6_ADDR_INT16_MLL; 901 daddr6.s6_addr16[1] = 0; 902 daddr6.s6_addr32[1] = 0; 903 daddr6.s6_addr32[2] = 0; 904 daddr6.s6_addr32[3] = IPV6_ADDR_INT32_ONE; 905 if (in6_setscope(&daddr6, ifp, NULL)) 906 goto bad; 907 908 flags &= ~ND_NA_FLAG_SOLICITED; 909 } 910 ip6->ip6_dst = daddr6; 911 sockaddr_in6_init(&u.dst6, &daddr6, 0, 0, 0); 912 dst = &u.dst; 913 rtcache_setdst(&ro, dst); 914 915 /* 916 * Select a source whose scope is the same as that of the dest. 917 */ 918 src = in6_selectsrc(satosin6(dst), NULL, NULL, &ro, NULL, NULL, 919 &error); 920 if (src == NULL) { 921 nd6log((LOG_DEBUG, "nd6_na_output: source can't be " 922 "determined: dst=%s, error=%d\n", 923 ip6_sprintf(&satocsin6(dst)->sin6_addr), error)); 924 goto bad; 925 } 926 ip6->ip6_src = *src; 927 nd_na = (struct nd_neighbor_advert *)(ip6 + 1); 928 nd_na->nd_na_type = ND_NEIGHBOR_ADVERT; 929 nd_na->nd_na_code = 0; 930 nd_na->nd_na_target = *taddr6; 931 in6_clearscope(&nd_na->nd_na_target); /* XXX */ 932 933 /* 934 * "tlladdr" indicates NS's condition for adding tlladdr or not. 935 * see nd6_ns_input() for details. 936 * Basically, if NS packet is sent to unicast/anycast addr, 937 * target lladdr option SHOULD NOT be included. 938 */ 939 if (tlladdr) { 940 /* 941 * sdl0 != NULL indicates proxy NA. If we do proxy, use 942 * lladdr in sdl0. If we are not proxying (sending NA for 943 * my address) use lladdr configured for the interface. 944 */ 945 if (sdl0 == NULL) 946 mac = nd6_ifptomac(ifp); 947 else if (sdl0->sa_family == AF_LINK) { 948 struct sockaddr_dl *sdl; 949 sdl = (struct sockaddr_dl *)sdl0; 950 if (sdl->sdl_alen == ifp->if_addrlen) 951 mac = LLADDR(sdl); 952 } 953 } 954 if (tlladdr && mac) { 955 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; 956 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1); 957 958 /* roundup to 8 bytes alignment! */ 959 optlen = (optlen + 7) & ~7; 960 961 m->m_pkthdr.len += optlen; 962 m->m_len += optlen; 963 icmp6len += optlen; 964 bzero((void *)nd_opt, optlen); 965 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR; 966 nd_opt->nd_opt_len = optlen >> 3; 967 bcopy(mac, (void *)(nd_opt + 1), ifp->if_addrlen); 968 } else 969 flags &= ~ND_NA_FLAG_OVERRIDE; 970 971 ip6->ip6_plen = htons((u_int16_t)icmp6len); 972 nd_na->nd_na_flags_reserved = flags; 973 nd_na->nd_na_cksum = 0; 974 nd_na->nd_na_cksum = 975 in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len); 976 977 ip6_output(m, NULL, NULL, 0, &im6o, (struct socket *)NULL, NULL); 978 979 icmp6_ifstat_inc(ifp, ifs6_out_msg); 980 icmp6_ifstat_inc(ifp, ifs6_out_neighboradvert); 981 icmp6stat.icp6s_outhist[ND_NEIGHBOR_ADVERT]++; 982 983 rtcache_free(&ro); 984 return; 985 986 bad: 987 rtcache_free(&ro); 988 m_freem(m); 989 return; 990 } 991 992 void * 993 nd6_ifptomac(struct ifnet *ifp) 994 { 995 switch (ifp->if_type) { 996 case IFT_ARCNET: 997 case IFT_ETHER: 998 case IFT_FDDI: 999 case IFT_IEEE1394: 1000 case IFT_PROPVIRTUAL: 1001 case IFT_CARP: 1002 case IFT_L2VLAN: 1003 case IFT_IEEE80211: 1004 return LLADDR(ifp->if_sadl); 1005 default: 1006 return NULL; 1007 } 1008 } 1009 1010 TAILQ_HEAD(dadq_head, dadq); 1011 struct dadq { 1012 TAILQ_ENTRY(dadq) dad_list; 1013 struct ifaddr *dad_ifa; 1014 int dad_count; /* max NS to send */ 1015 int dad_ns_tcount; /* # of trials to send NS */ 1016 int dad_ns_ocount; /* NS sent so far */ 1017 int dad_ns_icount; 1018 int dad_na_icount; 1019 struct callout dad_timer_ch; 1020 }; 1021 1022 static struct dadq_head dadq; 1023 static int dad_init = 0; 1024 1025 static struct dadq * 1026 nd6_dad_find(struct ifaddr *ifa) 1027 { 1028 struct dadq *dp; 1029 1030 TAILQ_FOREACH(dp, &dadq, dad_list) { 1031 if (dp->dad_ifa == ifa) 1032 return dp; 1033 } 1034 return NULL; 1035 } 1036 1037 static void 1038 nd6_dad_starttimer(struct dadq *dp, int ticks) 1039 { 1040 1041 callout_reset(&dp->dad_timer_ch, ticks, 1042 (void (*)(void *))nd6_dad_timer, (void *)dp->dad_ifa); 1043 } 1044 1045 static void 1046 nd6_dad_stoptimer(struct dadq *dp) 1047 { 1048 1049 callout_stop(&dp->dad_timer_ch); 1050 } 1051 1052 /* 1053 * Start Duplicate Address Detection (DAD) for specified interface address. 1054 * 1055 * xtick: minimum delay ticks for IFF_UP event 1056 */ 1057 void 1058 nd6_dad_start(struct ifaddr *ifa, int xtick) 1059 { 1060 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1061 struct dadq *dp; 1062 1063 if (!dad_init) { 1064 TAILQ_INIT(&dadq); 1065 dad_init++; 1066 } 1067 1068 /* 1069 * If we don't need DAD, don't do it. 1070 * There are several cases: 1071 * - DAD is disabled (ip6_dad_count == 0) 1072 * - the interface address is anycast 1073 */ 1074 if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) { 1075 log(LOG_DEBUG, 1076 "nd6_dad_start: called with non-tentative address " 1077 "%s(%s)\n", 1078 ip6_sprintf(&ia->ia_addr.sin6_addr), 1079 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1080 return; 1081 } 1082 if (ia->ia6_flags & IN6_IFF_ANYCAST) { 1083 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1084 return; 1085 } 1086 if (!ip6_dad_count) { 1087 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1088 return; 1089 } 1090 if (ifa->ifa_ifp == NULL) 1091 panic("nd6_dad_start: ifa->ifa_ifp == NULL"); 1092 if (!(ifa->ifa_ifp->if_flags & IFF_UP)) 1093 return; 1094 if (nd6_dad_find(ifa) != NULL) { 1095 /* DAD already in progress */ 1096 return; 1097 } 1098 1099 dp = malloc(sizeof(*dp), M_IP6NDP, M_NOWAIT); 1100 if (dp == NULL) { 1101 log(LOG_ERR, "nd6_dad_start: memory allocation failed for " 1102 "%s(%s)\n", 1103 ip6_sprintf(&ia->ia_addr.sin6_addr), 1104 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1105 return; 1106 } 1107 bzero(dp, sizeof(*dp)); 1108 callout_init(&dp->dad_timer_ch, 0); 1109 TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list); 1110 1111 nd6log((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp), 1112 ip6_sprintf(&ia->ia_addr.sin6_addr))); 1113 1114 /* 1115 * Send NS packet for DAD, ip6_dad_count times. 1116 * Note that we must delay the first transmission, if this is the 1117 * first packet to be sent from the interface after interface 1118 * (re)initialization. 1119 */ 1120 dp->dad_ifa = ifa; 1121 IFAREF(ifa); /* just for safety */ 1122 dp->dad_count = ip6_dad_count; 1123 dp->dad_ns_icount = dp->dad_na_icount = 0; 1124 dp->dad_ns_ocount = dp->dad_ns_tcount = 0; 1125 if (xtick == 0) { 1126 nd6_dad_ns_output(dp, ifa); 1127 nd6_dad_starttimer(dp, 1128 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000); 1129 } else 1130 nd6_dad_starttimer(dp, xtick); 1131 } 1132 1133 /* 1134 * terminate DAD unconditionally. used for address removals. 1135 */ 1136 void 1137 nd6_dad_stop(struct ifaddr *ifa) 1138 { 1139 struct dadq *dp; 1140 1141 if (!dad_init) 1142 return; 1143 dp = nd6_dad_find(ifa); 1144 if (dp == NULL) { 1145 /* DAD wasn't started yet */ 1146 return; 1147 } 1148 1149 nd6_dad_stoptimer(dp); 1150 1151 TAILQ_REMOVE(&dadq, dp, dad_list); 1152 free(dp, M_IP6NDP); 1153 dp = NULL; 1154 IFAFREE(ifa); 1155 } 1156 1157 static void 1158 nd6_dad_timer(struct ifaddr *ifa) 1159 { 1160 int s; 1161 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1162 struct dadq *dp; 1163 1164 s = splsoftnet(); /* XXX */ 1165 1166 /* Sanity check */ 1167 if (ia == NULL) { 1168 log(LOG_ERR, "nd6_dad_timer: called with null parameter\n"); 1169 goto done; 1170 } 1171 dp = nd6_dad_find(ifa); 1172 if (dp == NULL) { 1173 log(LOG_ERR, "nd6_dad_timer: DAD structure not found\n"); 1174 goto done; 1175 } 1176 if (ia->ia6_flags & IN6_IFF_DUPLICATED) { 1177 log(LOG_ERR, "nd6_dad_timer: called with duplicate address " 1178 "%s(%s)\n", 1179 ip6_sprintf(&ia->ia_addr.sin6_addr), 1180 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1181 goto done; 1182 } 1183 if ((ia->ia6_flags & IN6_IFF_TENTATIVE) == 0) { 1184 log(LOG_ERR, "nd6_dad_timer: called with non-tentative address " 1185 "%s(%s)\n", 1186 ip6_sprintf(&ia->ia_addr.sin6_addr), 1187 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1188 goto done; 1189 } 1190 1191 /* timeouted with IFF_{RUNNING,UP} check */ 1192 if (dp->dad_ns_tcount > dad_maxtry) { 1193 nd6log((LOG_INFO, "%s: could not run DAD, driver problem?\n", 1194 if_name(ifa->ifa_ifp))); 1195 1196 TAILQ_REMOVE(&dadq, dp, dad_list); 1197 free(dp, M_IP6NDP); 1198 dp = NULL; 1199 IFAFREE(ifa); 1200 goto done; 1201 } 1202 1203 /* Need more checks? */ 1204 if (dp->dad_ns_ocount < dp->dad_count) { 1205 /* 1206 * We have more NS to go. Send NS packet for DAD. 1207 */ 1208 nd6_dad_ns_output(dp, ifa); 1209 nd6_dad_starttimer(dp, 1210 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000); 1211 } else { 1212 /* 1213 * We have transmitted sufficient number of DAD packets. 1214 * See what we've got. 1215 */ 1216 int duplicate; 1217 1218 duplicate = 0; 1219 1220 if (dp->dad_na_icount) { 1221 /* 1222 * the check is in nd6_dad_na_input(), 1223 * but just in case 1224 */ 1225 duplicate++; 1226 } 1227 1228 if (dp->dad_ns_icount) { 1229 /* We've seen NS, means DAD has failed. */ 1230 duplicate++; 1231 } 1232 1233 if (duplicate) { 1234 /* (*dp) will be freed in nd6_dad_duplicated() */ 1235 dp = NULL; 1236 nd6_dad_duplicated(ifa); 1237 } else { 1238 /* 1239 * We are done with DAD. No NA came, no NS came. 1240 * No duplicate address found. 1241 */ 1242 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1243 1244 nd6log((LOG_DEBUG, 1245 "%s: DAD complete for %s - no duplicates found\n", 1246 if_name(ifa->ifa_ifp), 1247 ip6_sprintf(&ia->ia_addr.sin6_addr))); 1248 1249 TAILQ_REMOVE(&dadq, dp, dad_list); 1250 free(dp, M_IP6NDP); 1251 dp = NULL; 1252 IFAFREE(ifa); 1253 } 1254 } 1255 1256 done: 1257 splx(s); 1258 } 1259 1260 void 1261 nd6_dad_duplicated(struct ifaddr *ifa) 1262 { 1263 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1264 struct ifnet *ifp; 1265 struct dadq *dp; 1266 1267 dp = nd6_dad_find(ifa); 1268 if (dp == NULL) { 1269 log(LOG_ERR, "nd6_dad_duplicated: DAD structure not found\n"); 1270 return; 1271 } 1272 1273 ifp = ifa->ifa_ifp; 1274 log(LOG_ERR, "%s: DAD detected duplicate IPv6 address %s: " 1275 "NS in/out=%d/%d, NA in=%d\n", 1276 if_name(ifp), ip6_sprintf(&ia->ia_addr.sin6_addr), 1277 dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_na_icount); 1278 1279 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1280 ia->ia6_flags |= IN6_IFF_DUPLICATED; 1281 1282 /* We are done with DAD, with duplicated address found. (failure) */ 1283 nd6_dad_stoptimer(dp); 1284 1285 log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n", 1286 if_name(ifp), ip6_sprintf(&ia->ia_addr.sin6_addr)); 1287 log(LOG_ERR, "%s: manual intervention required\n", 1288 if_name(ifp)); 1289 1290 /* 1291 * If the address is a link-local address formed from an interface 1292 * identifier based on the hardware address which is supposed to be 1293 * uniquely assigned (e.g., EUI-64 for an Ethernet interface), IP 1294 * operation on the interface SHOULD be disabled. 1295 * [rfc2462bis-03 Section 5.4.5] 1296 */ 1297 if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr)) { 1298 struct in6_addr in6; 1299 1300 /* 1301 * To avoid over-reaction, we only apply this logic when we are 1302 * very sure that hardware addresses are supposed to be unique. 1303 */ 1304 switch (ifp->if_type) { 1305 case IFT_ETHER: 1306 case IFT_FDDI: 1307 case IFT_ATM: 1308 case IFT_IEEE1394: 1309 #ifdef IFT_IEEE80211 1310 case IFT_IEEE80211: 1311 #endif 1312 in6 = ia->ia_addr.sin6_addr; 1313 if (in6_get_hw_ifid(ifp, &in6) == 0 && 1314 IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) { 1315 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED; 1316 log(LOG_ERR, "%s: possible hardware address " 1317 "duplication detected, disable IPv6\n", 1318 if_name(ifp)); 1319 } 1320 break; 1321 } 1322 } 1323 1324 TAILQ_REMOVE(&dadq, dp, dad_list); 1325 free(dp, M_IP6NDP); 1326 dp = NULL; 1327 IFAFREE(ifa); 1328 } 1329 1330 static void 1331 nd6_dad_ns_output(struct dadq *dp, struct ifaddr *ifa) 1332 { 1333 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1334 struct ifnet *ifp = ifa->ifa_ifp; 1335 1336 dp->dad_ns_tcount++; 1337 if ((ifp->if_flags & IFF_UP) == 0) { 1338 #if 0 1339 printf("%s: interface down?\n", if_name(ifp)); 1340 #endif 1341 return; 1342 } 1343 if ((ifp->if_flags & IFF_RUNNING) == 0) { 1344 #if 0 1345 printf("%s: interface not running?\n", if_name(ifp)); 1346 #endif 1347 return; 1348 } 1349 1350 dp->dad_ns_tcount = 0; 1351 dp->dad_ns_ocount++; 1352 nd6_ns_output(ifp, NULL, &ia->ia_addr.sin6_addr, NULL, 1); 1353 } 1354 1355 static void 1356 nd6_dad_ns_input(struct ifaddr *ifa) 1357 { 1358 struct in6_ifaddr *ia; 1359 const struct in6_addr *taddr6; 1360 struct dadq *dp; 1361 int duplicate; 1362 1363 if (ifa == NULL) 1364 panic("ifa == NULL in nd6_dad_ns_input"); 1365 1366 ia = (struct in6_ifaddr *)ifa; 1367 taddr6 = &ia->ia_addr.sin6_addr; 1368 duplicate = 0; 1369 dp = nd6_dad_find(ifa); 1370 1371 /* Quickhack - completely ignore DAD NS packets */ 1372 if (dad_ignore_ns) { 1373 nd6log((LOG_INFO, 1374 "nd6_dad_ns_input: ignoring DAD NS packet for " 1375 "address %s(%s)\n", ip6_sprintf(taddr6), 1376 if_name(ifa->ifa_ifp))); 1377 return; 1378 } 1379 1380 /* 1381 * if I'm yet to start DAD, someone else started using this address 1382 * first. I have a duplicate and you win. 1383 */ 1384 if (dp == NULL || dp->dad_ns_ocount == 0) 1385 duplicate++; 1386 1387 /* XXX more checks for loopback situation - see nd6_dad_timer too */ 1388 1389 if (duplicate) { 1390 dp = NULL; /* will be freed in nd6_dad_duplicated() */ 1391 nd6_dad_duplicated(ifa); 1392 } else { 1393 /* 1394 * not sure if I got a duplicate. 1395 * increment ns count and see what happens. 1396 */ 1397 if (dp) 1398 dp->dad_ns_icount++; 1399 } 1400 } 1401 1402 static void 1403 nd6_dad_na_input(struct ifaddr *ifa) 1404 { 1405 struct dadq *dp; 1406 1407 if (ifa == NULL) 1408 panic("ifa == NULL in nd6_dad_na_input"); 1409 1410 dp = nd6_dad_find(ifa); 1411 if (dp) 1412 dp->dad_na_icount++; 1413 1414 /* remove the address. */ 1415 nd6_dad_duplicated(ifa); 1416 } 1417
Indexes created Mon Sep 29 21:09:56 GMT 2025