The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet6/nd6.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*      $FreeBSD$       */
    2 /*      $KAME: nd6.c,v 1.144 2001/05/24 07:44:00 itojun Exp $   */
    3 
    4 /*-
    5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
    6  * All rights reserved.
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  * 1. Redistributions of source code must retain the above copyright
   12  *    notice, this list of conditions and the following disclaimer.
   13  * 2. Redistributions in binary form must reproduce the above copyright
   14  *    notice, this list of conditions and the following disclaimer in the
   15  *    documentation and/or other materials provided with the distribution.
   16  * 3. Neither the name of the project nor the names of its contributors
   17  *    may be used to endorse or promote products derived from this software
   18  *    without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
   21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
   24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   30  * SUCH DAMAGE.
   31  */
   32 
   33 #include "opt_inet.h"
   34 #include "opt_inet6.h"
   35 #include "opt_mac.h"
   36 
   37 #include <sys/param.h>
   38 #include <sys/systm.h>
   39 #include <sys/callout.h>
   40 #include <sys/mac.h>
   41 #include <sys/malloc.h>
   42 #include <sys/mbuf.h>
   43 #include <sys/socket.h>
   44 #include <sys/sockio.h>
   45 #include <sys/time.h>
   46 #include <sys/kernel.h>
   47 #include <sys/protosw.h>
   48 #include <sys/errno.h>
   49 #include <sys/syslog.h>
   50 #include <sys/queue.h>
   51 #include <sys/sysctl.h>
   52 
   53 #include <net/if.h>
   54 #include <net/if_arc.h>
   55 #include <net/if_dl.h>
   56 #include <net/if_types.h>
   57 #include <net/iso88025.h>
   58 #include <net/fddi.h>
   59 #include <net/route.h>
   60 
   61 #include <netinet/in.h>
   62 #include <netinet/if_ether.h>
   63 #include <netinet6/in6_var.h>
   64 #include <netinet/ip6.h>
   65 #include <netinet6/ip6_var.h>
   66 #include <netinet6/nd6.h>
   67 #include <netinet/icmp6.h>
   68 
   69 #include <net/net_osdep.h>
   70 
   71 #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */
   72 #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */
   73 
   74 #define SIN6(s) ((struct sockaddr_in6 *)s)
   75 #define SDL(s) ((struct sockaddr_dl *)s)
   76 
   77 /* timer values */
   78 int     nd6_prune       = 1;    /* walk list every 1 seconds */
   79 int     nd6_delay       = 5;    /* delay first probe time 5 second */
   80 int     nd6_umaxtries   = 3;    /* maximum unicast query */
   81 int     nd6_mmaxtries   = 3;    /* maximum multicast query */
   82 int     nd6_useloopback = 1;    /* use loopback interface for local traffic */
   83 int     nd6_gctimer     = (60 * 60 * 24); /* 1 day: garbage collection timer */
   84 
   85 /* preventing too many loops in ND option parsing */
   86 int nd6_maxndopt = 10;  /* max # of ND options allowed */
   87 
   88 int nd6_maxnudhint = 0; /* max # of subsequent upper layer hints */
   89 
   90 #ifdef ND6_DEBUG
   91 int nd6_debug = 1;
   92 #else
   93 int nd6_debug = 0;
   94 #endif
   95 
   96 /* for debugging? */
   97 static int nd6_inuse, nd6_allocated;
   98 
   99 struct llinfo_nd6 llinfo_nd6 = {&llinfo_nd6, &llinfo_nd6};
  100 struct nd_drhead nd_defrouter;
  101 struct nd_prhead nd_prefix = { 0 };
  102 
  103 int nd6_recalc_reachtm_interval = ND6_RECALC_REACHTM_INTERVAL;
  104 static struct sockaddr_in6 all1_sa;
  105 
  106 static int nd6_is_new_addr_neighbor __P((struct sockaddr_in6 *,
  107         struct ifnet *));
  108 static void nd6_setmtu0 __P((struct ifnet *, struct nd_ifinfo *));
  109 static void nd6_slowtimo __P((void *));
  110 static int regen_tmpaddr __P((struct in6_ifaddr *));
  111 
  112 struct callout nd6_slowtimo_ch;
  113 struct callout nd6_timer_ch;
  114 extern struct callout in6_tmpaddrtimer_ch;
  115 
  116 void
  117 nd6_init()
  118 {
  119         static int nd6_init_done = 0;
  120         int i;
  121 
  122         if (nd6_init_done) {
  123                 log(LOG_NOTICE, "nd6_init called more than once(ignored)\n");
  124                 return;
  125         }
  126 
  127         all1_sa.sin6_family = AF_INET6;
  128         all1_sa.sin6_len = sizeof(struct sockaddr_in6);
  129         for (i = 0; i < sizeof(all1_sa.sin6_addr); i++)
  130                 all1_sa.sin6_addr.s6_addr[i] = 0xff;
  131 
  132         /* initialization of the default router list */
  133         TAILQ_INIT(&nd_defrouter);
  134 
  135         nd6_init_done = 1;
  136 
  137         /* start timer */
  138         callout_init(&nd6_slowtimo_ch, 0);
  139         callout_reset(&nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
  140             nd6_slowtimo, NULL);
  141 }
  142 
  143 struct nd_ifinfo *
  144 nd6_ifattach(ifp)
  145         struct ifnet *ifp;
  146 {
  147         struct nd_ifinfo *nd;
  148 
  149         nd = (struct nd_ifinfo *)malloc(sizeof(*nd), M_IP6NDP, M_WAITOK);
  150         bzero(nd, sizeof(*nd));
  151 
  152         nd->initialized = 1;
  153 
  154         nd->chlim = IPV6_DEFHLIM;
  155         nd->basereachable = REACHABLE_TIME;
  156         nd->reachable = ND_COMPUTE_RTIME(nd->basereachable);
  157         nd->retrans = RETRANS_TIMER;
  158         /*
  159          * Note that the default value of ip6_accept_rtadv is 0, which means
  160          * we won't accept RAs by default even if we set ND6_IFF_ACCEPT_RTADV
  161          * here.
  162          */
  163         nd->flags = (ND6_IFF_PERFORMNUD | ND6_IFF_ACCEPT_RTADV);
  164 
  165         /* XXX: we cannot call nd6_setmtu since ifp is not fully initialized */
  166         nd6_setmtu0(ifp, nd);
  167 
  168         return nd;
  169 }
  170 
  171 void
  172 nd6_ifdetach(nd)
  173         struct nd_ifinfo *nd;
  174 {
  175 
  176         free(nd, M_IP6NDP);
  177 }
  178 
  179 /*
  180  * Reset ND level link MTU. This function is called when the physical MTU
  181  * changes, which means we might have to adjust the ND level MTU.
  182  */
  183 void
  184 nd6_setmtu(ifp)
  185         struct ifnet *ifp;
  186 {
  187 
  188         nd6_setmtu0(ifp, ND_IFINFO(ifp));
  189 }
  190 
  191 /* XXX todo: do not maintain copy of ifp->if_mtu in ndi->maxmtu */
  192 void
  193 nd6_setmtu0(ifp, ndi)
  194         struct ifnet *ifp;
  195         struct nd_ifinfo *ndi;
  196 {
  197         u_int32_t omaxmtu;
  198 
  199         omaxmtu = ndi->maxmtu;
  200 
  201         switch (ifp->if_type) {
  202         case IFT_ARCNET:
  203                 ndi->maxmtu = MIN(ARC_PHDS_MAXMTU, ifp->if_mtu); /* RFC2497 */
  204                 break;
  205         case IFT_FDDI:
  206                 ndi->maxmtu = MIN(FDDIIPMTU, ifp->if_mtu); /* RFC2467 */
  207                 break;
  208          case IFT_ISO88025:
  209                  ndi->maxmtu = MIN(ISO88025_MAX_MTU, ifp->if_mtu);
  210                  break;
  211         default:
  212                 ndi->maxmtu = ifp->if_mtu;
  213                 break;
  214         }
  215 
  216         /*
  217          * Decreasing the interface MTU under IPV6 minimum MTU may cause
  218          * undesirable situation.  We thus notify the operator of the change
  219          * explicitly.  The check for omaxmtu is necessary to restrict the
  220          * log to the case of changing the MTU, not initializing it.
  221          */
  222         if (omaxmtu >= IPV6_MMTU && ndi->maxmtu < IPV6_MMTU) {
  223                 log(LOG_NOTICE, "nd6_setmtu0: "
  224                     "new link MTU on %s (%lu) is too small for IPv6\n",
  225                     if_name(ifp), (unsigned long)ndi->maxmtu);
  226         }
  227 
  228         if (ndi->maxmtu > in6_maxmtu)
  229                 in6_setmaxmtu(); /* check all interfaces just in case */
  230 
  231 #undef MIN
  232 }
  233 
  234 void
  235 nd6_option_init(opt, icmp6len, ndopts)
  236         void *opt;
  237         int icmp6len;
  238         union nd_opts *ndopts;
  239 {
  240 
  241         bzero(ndopts, sizeof(*ndopts));
  242         ndopts->nd_opts_search = (struct nd_opt_hdr *)opt;
  243         ndopts->nd_opts_last
  244                 = (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len);
  245 
  246         if (icmp6len == 0) {
  247                 ndopts->nd_opts_done = 1;
  248                 ndopts->nd_opts_search = NULL;
  249         }
  250 }
  251 
  252 /*
  253  * Take one ND option.
  254  */
  255 struct nd_opt_hdr *
  256 nd6_option(ndopts)
  257         union nd_opts *ndopts;
  258 {
  259         struct nd_opt_hdr *nd_opt;
  260         int olen;
  261 
  262         if (!ndopts)
  263                 panic("ndopts == NULL in nd6_option");
  264         if (!ndopts->nd_opts_last)
  265                 panic("uninitialized ndopts in nd6_option");
  266         if (!ndopts->nd_opts_search)
  267                 return NULL;
  268         if (ndopts->nd_opts_done)
  269                 return NULL;
  270 
  271         nd_opt = ndopts->nd_opts_search;
  272 
  273         /* make sure nd_opt_len is inside the buffer */
  274         if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) {
  275                 bzero(ndopts, sizeof(*ndopts));
  276                 return NULL;
  277         }
  278 
  279         olen = nd_opt->nd_opt_len << 3;
  280         if (olen == 0) {
  281                 /*
  282                  * Message validation requires that all included
  283                  * options have a length that is greater than zero.
  284                  */
  285                 bzero(ndopts, sizeof(*ndopts));
  286                 return NULL;
  287         }
  288 
  289         ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);
  290         if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
  291                 /* option overruns the end of buffer, invalid */
  292                 bzero(ndopts, sizeof(*ndopts));
  293                 return NULL;
  294         } else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
  295                 /* reached the end of options chain */
  296                 ndopts->nd_opts_done = 1;
  297                 ndopts->nd_opts_search = NULL;
  298         }
  299         return nd_opt;
  300 }
  301 
  302 /*
  303  * Parse multiple ND options.
  304  * This function is much easier to use, for ND routines that do not need
  305  * multiple options of the same type.
  306  */
  307 int
  308 nd6_options(ndopts)
  309         union nd_opts *ndopts;
  310 {
  311         struct nd_opt_hdr *nd_opt;
  312         int i = 0;
  313 
  314         if (!ndopts)
  315                 panic("ndopts == NULL in nd6_options");
  316         if (!ndopts->nd_opts_last)
  317                 panic("uninitialized ndopts in nd6_options");
  318         if (!ndopts->nd_opts_search)
  319                 return 0;
  320 
  321         while (1) {
  322                 nd_opt = nd6_option(ndopts);
  323                 if (!nd_opt && !ndopts->nd_opts_last) {
  324                         /*
  325                          * Message validation requires that all included
  326                          * options have a length that is greater than zero.
  327                          */
  328                         icmp6stat.icp6s_nd_badopt++;
  329                         bzero(ndopts, sizeof(*ndopts));
  330                         return -1;
  331                 }
  332 
  333                 if (!nd_opt)
  334                         goto skip1;
  335 
  336                 switch (nd_opt->nd_opt_type) {
  337                 case ND_OPT_SOURCE_LINKADDR:
  338                 case ND_OPT_TARGET_LINKADDR:
  339                 case ND_OPT_MTU:
  340                 case ND_OPT_REDIRECTED_HEADER:
  341                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
  342                                 nd6log((LOG_INFO,
  343                                     "duplicated ND6 option found (type=%d)\n",
  344                                     nd_opt->nd_opt_type));
  345                                 /* XXX bark? */
  346                         } else {
  347                                 ndopts->nd_opt_array[nd_opt->nd_opt_type]
  348                                         = nd_opt;
  349                         }
  350                         break;
  351                 case ND_OPT_PREFIX_INFORMATION:
  352                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) {
  353                                 ndopts->nd_opt_array[nd_opt->nd_opt_type]
  354                                         = nd_opt;
  355                         }
  356                         ndopts->nd_opts_pi_end =
  357                                 (struct nd_opt_prefix_info *)nd_opt;
  358                         break;
  359                 default:
  360                         /*
  361                          * Unknown options must be silently ignored,
  362                          * to accomodate future extension to the protocol.
  363                          */
  364                         nd6log((LOG_DEBUG,
  365                             "nd6_options: unsupported option %d - "
  366                             "option ignored\n", nd_opt->nd_opt_type));
  367                 }
  368 
  369 skip1:
  370                 i++;
  371                 if (i > nd6_maxndopt) {
  372                         icmp6stat.icp6s_nd_toomanyopt++;
  373                         nd6log((LOG_INFO, "too many loop in nd opt\n"));
  374                         break;
  375                 }
  376 
  377                 if (ndopts->nd_opts_done)
  378                         break;
  379         }
  380 
  381         return 0;
  382 }
  383 
  384 /*
  385  * ND6 timer routine to expire default route list and prefix list
  386  */
  387 void
  388 nd6_timer(ignored_arg)
  389         void    *ignored_arg;
  390 {
  391         int s;
  392         struct llinfo_nd6 *ln;
  393         struct nd_defrouter *dr;
  394         struct nd_prefix *pr;
  395         struct ifnet *ifp;
  396         struct in6_ifaddr *ia6, *nia6;
  397         struct in6_addrlifetime *lt6;
  398 
  399         s = splnet();
  400         callout_reset(&nd6_timer_ch, nd6_prune * hz,
  401             nd6_timer, NULL);
  402 
  403         ln = llinfo_nd6.ln_next;
  404         while (ln && ln != &llinfo_nd6) {
  405                 struct rtentry *rt;
  406                 struct sockaddr_in6 *dst;
  407                 struct llinfo_nd6 *next = ln->ln_next;
  408                 /* XXX: used for the DELAY case only: */
  409                 struct nd_ifinfo *ndi = NULL;
  410 
  411                 if ((rt = ln->ln_rt) == NULL) {
  412                         ln = next;
  413                         continue;
  414                 }
  415                 if ((ifp = rt->rt_ifp) == NULL) {
  416                         ln = next;
  417                         continue;
  418                 }
  419                 ndi = ND_IFINFO(ifp);
  420                 dst = (struct sockaddr_in6 *)rt_key(rt);
  421 
  422                 if (ln->ln_expire > time_second) {
  423                         ln = next;
  424                         continue;
  425                 }
  426 
  427                 /* sanity check */
  428                 if (!rt)
  429                         panic("rt=0 in nd6_timer(ln=%p)", ln);
  430                 if (rt->rt_llinfo && (struct llinfo_nd6 *)rt->rt_llinfo != ln)
  431                         panic("rt_llinfo(%p) is not equal to ln(%p)",
  432                               rt->rt_llinfo, ln);
  433                 if (!dst)
  434                         panic("dst=0 in nd6_timer(ln=%p)", ln);
  435 
  436                 switch (ln->ln_state) {
  437                 case ND6_LLINFO_INCOMPLETE:
  438                         if (ln->ln_asked < nd6_mmaxtries) {
  439                                 ln->ln_asked++;
  440                                 ln->ln_expire = time_second +
  441                                         ND_IFINFO(ifp)->retrans / 1000;
  442                                 nd6_ns_output(ifp, NULL, &dst->sin6_addr,
  443                                         ln, 0);
  444                         } else {
  445                                 struct mbuf *m = ln->ln_hold;
  446                                 if (m) {
  447                                         if (rt->rt_ifp) {
  448                                                 /*
  449                                                  * Fake rcvif to make ICMP error
  450                                                  * more helpful in diagnosing
  451                                                  * for the receiver.
  452                                                  * XXX: should we consider
  453                                                  * older rcvif?
  454                                                  */
  455                                                 m->m_pkthdr.rcvif = rt->rt_ifp;
  456                                         }
  457                                         icmp6_error(m, ICMP6_DST_UNREACH,
  458                                                     ICMP6_DST_UNREACH_ADDR, 0);
  459                                         ln->ln_hold = NULL;
  460                                 }
  461                                 next = nd6_free(rt);
  462                         }
  463                         break;
  464                 case ND6_LLINFO_REACHABLE:
  465                         if (ln->ln_expire) {
  466                                 ln->ln_state = ND6_LLINFO_STALE;
  467                                 ln->ln_expire = time_second + nd6_gctimer;
  468                         }
  469                         break;
  470 
  471                 case ND6_LLINFO_STALE:
  472                         /* Garbage Collection(RFC 2461 5.3) */
  473                         if (ln->ln_expire)
  474                                 next = nd6_free(rt);
  475                         break;
  476 
  477                 case ND6_LLINFO_DELAY:
  478                         if (ndi && (ndi->flags & ND6_IFF_PERFORMNUD) != 0) {
  479                                 /* We need NUD */
  480                                 ln->ln_asked = 1;
  481                                 ln->ln_state = ND6_LLINFO_PROBE;
  482                                 ln->ln_expire = time_second +
  483                                         ndi->retrans / 1000;
  484                                 nd6_ns_output(ifp, &dst->sin6_addr,
  485                                               &dst->sin6_addr,
  486                                               ln, 0);
  487                         } else {
  488                                 ln->ln_state = ND6_LLINFO_STALE; /* XXX */
  489                                 ln->ln_expire = time_second + nd6_gctimer;
  490                         }
  491                         break;
  492                 case ND6_LLINFO_PROBE:
  493                         if (ln->ln_asked < nd6_umaxtries) {
  494                                 ln->ln_asked++;
  495                                 ln->ln_expire = time_second +
  496                                         ND_IFINFO(ifp)->retrans / 1000;
  497                                 nd6_ns_output(ifp, &dst->sin6_addr,
  498                                                &dst->sin6_addr, ln, 0);
  499                         } else {
  500                                 next = nd6_free(rt);
  501                         }
  502                         break;
  503                 }
  504                 ln = next;
  505         }
  506 
  507         /* expire default router list */
  508         dr = TAILQ_FIRST(&nd_defrouter);
  509         while (dr) {
  510                 if (dr->expire && dr->expire < time_second) {
  511                         struct nd_defrouter *t;
  512                         t = TAILQ_NEXT(dr, dr_entry);
  513                         defrtrlist_del(dr);
  514                         dr = t;
  515                 } else {
  516                         dr = TAILQ_NEXT(dr, dr_entry);
  517                 }
  518         }
  519 
  520         /*
  521          * expire interface addresses.
  522          * in the past the loop was inside prefix expiry processing.
  523          * However, from a stricter speci-confrmance standpoint, we should
  524          * rather separate address lifetimes and prefix lifetimes.
  525          */
  526   addrloop:
  527         for (ia6 = in6_ifaddr; ia6; ia6 = nia6) {
  528                 nia6 = ia6->ia_next;
  529                 /* check address lifetime */
  530                 lt6 = &ia6->ia6_lifetime;
  531                 if (IFA6_IS_INVALID(ia6)) {
  532                         int regen = 0;
  533 
  534                         /*
  535                          * If the expiring address is temporary, try
  536                          * regenerating a new one.  This would be useful when
  537                          * we suspended a laptop PC, then turned it on after a
  538                          * period that could invalidate all temporary
  539                          * addresses.  Although we may have to restart the
  540                          * loop (see below), it must be after purging the
  541                          * address.  Otherwise, we'd see an infinite loop of
  542                          * regeneration.
  543                          */
  544                         if (ip6_use_tempaddr &&
  545                             (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
  546                                 if (regen_tmpaddr(ia6) == 0)
  547                                         regen = 1;
  548                         }
  549 
  550                         in6_purgeaddr(&ia6->ia_ifa);
  551 
  552                         if (regen)
  553                                 goto addrloop; /* XXX: see below */
  554                 } else if (IFA6_IS_DEPRECATED(ia6)) {
  555                         int oldflags = ia6->ia6_flags;
  556 
  557                         ia6->ia6_flags |= IN6_IFF_DEPRECATED;
  558 
  559                         /*
  560                          * If a temporary address has just become deprecated,
  561                          * regenerate a new one if possible.
  562                          */
  563                         if (ip6_use_tempaddr &&
  564                             (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
  565                             (oldflags & IN6_IFF_DEPRECATED) == 0) {
  566 
  567                                 if (regen_tmpaddr(ia6) == 0) {
  568                                         /*
  569                                          * A new temporary address is
  570                                          * generated.
  571                                          * XXX: this means the address chain
  572                                          * has changed while we are still in
  573                                          * the loop.  Although the change
  574                                          * would not cause disaster (because
  575                                          * it's not a deletion, but an
  576                                          * addition,) we'd rather restart the
  577                                          * loop just for safety.  Or does this
  578                                          * significantly reduce performance??
  579                                          */
  580                                         goto addrloop;
  581                                 }
  582                         }
  583                 } else {
  584                         /*
  585                          * A new RA might have made a deprecated address
  586                          * preferred.
  587                          */
  588                         ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;
  589                 }
  590         }
  591 
  592         /* expire prefix list */
  593         pr = nd_prefix.lh_first;
  594         while (pr) {
  595                 /*
  596                  * check prefix lifetime.
  597                  * since pltime is just for autoconf, pltime processing for
  598                  * prefix is not necessary.
  599                  */
  600                 if (pr->ndpr_expire && pr->ndpr_expire < time_second) {
  601                         struct nd_prefix *t;
  602                         t = pr->ndpr_next;
  603 
  604                         /*
  605                          * address expiration and prefix expiration are
  606                          * separate.  NEVER perform in6_purgeaddr here.
  607                          */
  608 
  609                         prelist_remove(pr);
  610                         pr = t;
  611                 } else
  612                         pr = pr->ndpr_next;
  613         }
  614         splx(s);
  615 }
  616 
  617 static int
  618 regen_tmpaddr(ia6)
  619         struct in6_ifaddr *ia6; /* deprecated/invalidated temporary address */
  620 {
  621         struct ifaddr *ifa;
  622         struct ifnet *ifp;
  623         struct in6_ifaddr *public_ifa6 = NULL;
  624 
  625         ifp = ia6->ia_ifa.ifa_ifp;
  626         for (ifa = ifp->if_addrlist.tqh_first; ifa;
  627              ifa = ifa->ifa_list.tqe_next) {
  628                 struct in6_ifaddr *it6;
  629 
  630                 if (ifa->ifa_addr->sa_family != AF_INET6)
  631                         continue;
  632 
  633                 it6 = (struct in6_ifaddr *)ifa;
  634 
  635                 /* ignore no autoconf addresses. */
  636                 if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0)
  637                         continue;
  638 
  639                 /* ignore autoconf addresses with different prefixes. */
  640                 if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr)
  641                         continue;
  642 
  643                 /*
  644                  * Now we are looking at an autoconf address with the same
  645                  * prefix as ours.  If the address is temporary and is still
  646                  * preferred, do not create another one.  It would be rare, but
  647                  * could happen, for example, when we resume a laptop PC after
  648                  * a long period.
  649                  */
  650                 if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
  651                     !IFA6_IS_DEPRECATED(it6)) {
  652                         public_ifa6 = NULL;
  653                         break;
  654                 }
  655 
  656                 /*
  657                  * This is a public autoconf address that has the same prefix
  658                  * as ours.  If it is preferred, keep it.  We can't break the
  659                  * loop here, because there may be a still-preferred temporary
  660                  * address with the prefix.
  661                  */
  662                 if (!IFA6_IS_DEPRECATED(it6))
  663                     public_ifa6 = it6;
  664         }
  665 
  666         if (public_ifa6 != NULL) {
  667                 int e;
  668 
  669                 if ((e = in6_tmpifadd(public_ifa6, 0)) != 0) {
  670                         log(LOG_NOTICE, "regen_tmpaddr: failed to create a new"
  671                             " tmp addr,errno=%d\n", e);
  672                         return (-1);
  673                 }
  674                 return (0);
  675         }
  676 
  677         return (-1);
  678 }
  679 
  680 /*
  681  * Nuke neighbor cache/prefix/default router management table, right before
  682  * ifp goes away.
  683  */
  684 void
  685 nd6_purge(ifp)
  686         struct ifnet *ifp;
  687 {
  688         struct llinfo_nd6 *ln, *nln;
  689         struct nd_defrouter *dr, *ndr, drany;
  690         struct nd_prefix *pr, *npr;
  691 
  692         /* Nuke default router list entries toward ifp */
  693         if ((dr = TAILQ_FIRST(&nd_defrouter)) != NULL) {
  694                 /*
  695                  * The first entry of the list may be stored in
  696                  * the routing table, so we'll delete it later.
  697                  */
  698                 for (dr = TAILQ_NEXT(dr, dr_entry); dr; dr = ndr) {
  699                         ndr = TAILQ_NEXT(dr, dr_entry);
  700                         if (dr->ifp == ifp)
  701                                 defrtrlist_del(dr);
  702                 }
  703                 dr = TAILQ_FIRST(&nd_defrouter);
  704                 if (dr->ifp == ifp)
  705                         defrtrlist_del(dr);
  706         }
  707 
  708         /* Nuke prefix list entries toward ifp */
  709         for (pr = nd_prefix.lh_first; pr; pr = npr) {
  710                 npr = pr->ndpr_next;
  711                 if (pr->ndpr_ifp == ifp) {
  712                         /*
  713                          * Previously, pr->ndpr_addr is removed as well,
  714                          * but I strongly believe we don't have to do it.
  715                          * nd6_purge() is only called from in6_ifdetach(),
  716                          * which removes all the associated interface addresses
  717                          * by itself.
  718                          * (jinmei@kame.net 20010129)
  719                          */
  720                         prelist_remove(pr);
  721                 }
  722         }
  723 
  724         /* cancel default outgoing interface setting */
  725         if (nd6_defifindex == ifp->if_index)
  726                 nd6_setdefaultiface(0);
  727 
  728         if (!ip6_forwarding && ip6_accept_rtadv) { /* XXX: too restrictive? */
  729                 /* refresh default router list */
  730                 bzero(&drany, sizeof(drany));
  731                 defrouter_delreq(&drany, 0);
  732                 defrouter_select();
  733         }
  734 
  735         /*
  736          * Nuke neighbor cache entries for the ifp.
  737          * Note that rt->rt_ifp may not be the same as ifp,
  738          * due to KAME goto ours hack.  See RTM_RESOLVE case in
  739          * nd6_rtrequest(), and ip6_input().
  740          */
  741         ln = llinfo_nd6.ln_next;
  742         while (ln && ln != &llinfo_nd6) {
  743                 struct rtentry *rt;
  744                 struct sockaddr_dl *sdl;
  745 
  746                 nln = ln->ln_next;
  747                 rt = ln->ln_rt;
  748                 if (rt && rt->rt_gateway &&
  749                     rt->rt_gateway->sa_family == AF_LINK) {
  750                         sdl = (struct sockaddr_dl *)rt->rt_gateway;
  751                         if (sdl->sdl_index == ifp->if_index)
  752                                 nln = nd6_free(rt);
  753                 }
  754                 ln = nln;
  755         }
  756 }
  757 
  758 struct rtentry *
  759 nd6_lookup(addr6, create, ifp)
  760         struct in6_addr *addr6;
  761         int create;
  762         struct ifnet *ifp;
  763 {
  764         struct rtentry *rt;
  765         struct sockaddr_in6 sin6;
  766 
  767         bzero(&sin6, sizeof(sin6));
  768         sin6.sin6_len = sizeof(struct sockaddr_in6);
  769         sin6.sin6_family = AF_INET6;
  770         sin6.sin6_addr = *addr6;
  771         rt = rtalloc1((struct sockaddr *)&sin6, create, 0UL);
  772         if (rt) {
  773                 if ((rt->rt_flags & RTF_LLINFO) == 0 && create) {
  774                         /*
  775                          * This is the case for the default route.
  776                          * If we want to create a neighbor cache for the
  777                          * address, we should free the route for the
  778                          * destination and allocate an interface route.
  779                          */
  780                         RTFREE_LOCKED(rt);
  781                         rt = 0;
  782                 }
  783         }
  784         if (!rt) {
  785                 if (create && ifp) {
  786                         int e;
  787 
  788                         /*
  789                          * If no route is available and create is set,
  790                          * we allocate a host route for the destination
  791                          * and treat it like an interface route.
  792                          * This hack is necessary for a neighbor which can't
  793                          * be covered by our own prefix.
  794                          */
  795                         struct ifaddr *ifa =
  796                             ifaof_ifpforaddr((struct sockaddr *)&sin6, ifp);
  797                         if (ifa == NULL)
  798                                 return (NULL);
  799 
  800                         /*
  801                          * Create a new route.  RTF_LLINFO is necessary
  802                          * to create a Neighbor Cache entry for the
  803                          * destination in nd6_rtrequest which will be
  804                          * called in rtrequest via ifa->ifa_rtrequest.
  805                          */
  806                         if ((e = rtrequest(RTM_ADD, (struct sockaddr *)&sin6,
  807                             ifa->ifa_addr, (struct sockaddr *)&all1_sa,
  808                             (ifa->ifa_flags | RTF_HOST | RTF_LLINFO) &
  809                             ~RTF_CLONING, &rt)) != 0) {
  810                                 log(LOG_ERR,
  811                                     "nd6_lookup: failed to add route for a "
  812                                     "neighbor(%s), errno=%d\n",
  813                                     ip6_sprintf(addr6), e);
  814                         }
  815                         if (rt == NULL)
  816                                 return (NULL);
  817                         RT_LOCK(rt);
  818                         if (rt->rt_llinfo) {
  819                                 struct llinfo_nd6 *ln =
  820                                     (struct llinfo_nd6 *)rt->rt_llinfo;
  821                                 ln->ln_state = ND6_LLINFO_NOSTATE;
  822                         }
  823                 } else
  824                         return (NULL);
  825         }
  826         RT_LOCK_ASSERT(rt);
  827         RT_REMREF(rt);
  828         /*
  829          * Validation for the entry.
  830          * Note that the check for rt_llinfo is necessary because a cloned
  831          * route from a parent route that has the L flag (e.g. the default
  832          * route to a p2p interface) may have the flag, too, while the
  833          * destination is not actually a neighbor.
  834          * XXX: we can't use rt->rt_ifp to check for the interface, since
  835          *      it might be the loopback interface if the entry is for our
  836          *      own address on a non-loopback interface. Instead, we should
  837          *      use rt->rt_ifa->ifa_ifp, which would specify the REAL
  838          *      interface.
  839          */
  840         if ((rt->rt_flags & RTF_GATEWAY) || (rt->rt_flags & RTF_LLINFO) == 0 ||
  841             rt->rt_gateway->sa_family != AF_LINK || rt->rt_llinfo == NULL ||
  842             (ifp && rt->rt_ifa->ifa_ifp != ifp)) {
  843                 if (create) {
  844                         log(LOG_DEBUG,
  845                             "nd6_lookup: failed to lookup %s (if = %s)\n",
  846                             ip6_sprintf(addr6),
  847                             ifp ? if_name(ifp) : "unspec");
  848                         /* xxx more logs... kazu */
  849                 }
  850                 RT_UNLOCK(rt);
  851                 return (NULL);
  852         }
  853         RT_UNLOCK(rt);          /* XXX not ready to return rt locked */
  854         return (rt);
  855 }
  856 
  857 /*
  858  * Test whether a given IPv6 address is a neighbor or not, ignoring
  859  * the actual neighbor cache.  The neighbor cache is ignored in order
  860  * to not reenter the routing code from within itself.
  861  */
  862 static int
  863 nd6_is_new_addr_neighbor(addr, ifp)
  864         struct sockaddr_in6 *addr;
  865         struct ifnet *ifp;
  866 {
  867         struct nd_prefix *pr;
  868 
  869         /*
  870          * A link-local address is always a neighbor.
  871          * XXX: we should use the sin6_scope_id field rather than the embedded
  872          * interface index.
  873          * XXX: a link does not necessarily specify a single interface.
  874          */
  875         if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr) &&
  876             ntohs(*(u_int16_t *)&addr->sin6_addr.s6_addr[2]) == ifp->if_index)
  877                 return (1);
  878 
  879         /*
  880          * If the address matches one of our addresses,
  881          * it should be a neighbor.
  882          * If the address matches one of our on-link prefixes, it should be a
  883          * neighbor.
  884          */
  885         for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
  886                 if (pr->ndpr_ifp != ifp)
  887                         continue;
  888 
  889                 if (!(pr->ndpr_stateflags & NDPRF_ONLINK))
  890                         continue;
  891 
  892                 if (IN6_ARE_MASKED_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
  893                     &addr->sin6_addr, &pr->ndpr_mask))
  894                         return (1);
  895         }
  896 
  897         /*
  898          * If the default router list is empty, all addresses are regarded
  899          * as on-link, and thus, as a neighbor.
  900          * XXX: we restrict the condition to hosts, because routers usually do
  901          * not have the "default router list".
  902          */
  903         if (!ip6_forwarding && TAILQ_FIRST(&nd_defrouter) == NULL &&
  904             nd6_defifindex == ifp->if_index) {
  905                 return (1);
  906         }
  907 
  908         return (0);
  909 }
  910 
  911 
  912 /*
  913  * Detect if a given IPv6 address identifies a neighbor on a given link.
  914  * XXX: should take care of the destination of a p2p link?
  915  */
  916 int
  917 nd6_is_addr_neighbor(addr, ifp)
  918         struct sockaddr_in6 *addr;
  919         struct ifnet *ifp;
  920 {
  921 
  922         if (nd6_is_new_addr_neighbor(addr, ifp))
  923                 return (1);
  924 
  925         /*
  926          * Even if the address matches none of our addresses, it might be
  927          * in the neighbor cache.
  928          */
  929         if (nd6_lookup(&addr->sin6_addr, 0, ifp) != NULL)
  930                 return (1);
  931 
  932         return (0);
  933 }
  934 
  935 /*
  936  * Free an nd6 llinfo entry.
  937  */
  938 struct llinfo_nd6 *
  939 nd6_free(rt)
  940         struct rtentry *rt;
  941 {
  942         struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo, *next;
  943         struct in6_addr in6 = ((struct sockaddr_in6 *)rt_key(rt))->sin6_addr;
  944         struct nd_defrouter *dr;
  945 
  946         /*
  947          * we used to have pfctlinput(PRC_HOSTDEAD) here.
  948          * even though it is not harmful, it was not really necessary.
  949          */
  950 
  951         if (!ip6_forwarding && ip6_accept_rtadv) { /* XXX: too restrictive? */
  952                 int s;
  953                 s = splnet();
  954                 dr = defrouter_lookup(&((struct sockaddr_in6 *)rt_key(rt))->sin6_addr,
  955                     rt->rt_ifp);
  956 
  957                 if (ln->ln_router || dr) {
  958                         /*
  959                          * rt6_flush must be called whether or not the neighbor
  960                          * is in the Default Router List.
  961                          * See a corresponding comment in nd6_na_input().
  962                          */
  963                         rt6_flush(&in6, rt->rt_ifp);
  964                 }
  965 
  966                 if (dr) {
  967                         /*
  968                          * Unreachablity of a router might affect the default
  969                          * router selection and on-link detection of advertised
  970                          * prefixes.
  971                          */
  972 
  973                         /*
  974                          * Temporarily fake the state to choose a new default
  975                          * router and to perform on-link determination of
  976                          * prefixes correctly.
  977                          * Below the state will be set correctly,
  978                          * or the entry itself will be deleted.
  979                          */
  980                         ln->ln_state = ND6_LLINFO_INCOMPLETE;
  981 
  982                         /*
  983                          * Since defrouter_select() does not affect the
  984                          * on-link determination and MIP6 needs the check
  985                          * before the default router selection, we perform
  986                          * the check now.
  987                          */
  988                         pfxlist_onlink_check();
  989 
  990                         if (dr == TAILQ_FIRST(&nd_defrouter)) {
  991                                 /*
  992                                  * It is used as the current default router,
  993                                  * so we have to move it to the end of the
  994                                  * list and choose a new one.
  995                                  * XXX: it is not very efficient if this is
  996                                  *      the only router.
  997                                  */
  998                                 TAILQ_REMOVE(&nd_defrouter, dr, dr_entry);
  999                                 TAILQ_INSERT_TAIL(&nd_defrouter, dr, dr_entry);
 1000 
 1001                                 defrouter_select();
 1002                         }
 1003                 }
 1004                 splx(s);
 1005         }
 1006 
 1007         /*
 1008          * Before deleting the entry, remember the next entry as the
 1009          * return value.  We need this because pfxlist_onlink_check() above
 1010          * might have freed other entries (particularly the old next entry) as
 1011          * a side effect (XXX).
 1012          */
 1013         next = ln->ln_next;
 1014 
 1015         /*
 1016          * Detach the route from the routing tree and the list of neighbor
 1017          * caches, and disable the route entry not to be used in already
 1018          * cached routes.
 1019          */
 1020         rtrequest(RTM_DELETE, rt_key(rt), (struct sockaddr *)0,
 1021             rt_mask(rt), 0, (struct rtentry **)0);
 1022 
 1023         return (next);
 1024 }
 1025 
 1026 /*
 1027  * Upper-layer reachability hint for Neighbor Unreachability Detection.
 1028  *
 1029  * XXX cost-effective metods?
 1030  */
 1031 void
 1032 nd6_nud_hint(rt, dst6, force)
 1033         struct rtentry *rt;
 1034         struct in6_addr *dst6;
 1035         int force;
 1036 {
 1037         struct llinfo_nd6 *ln;
 1038 
 1039         /*
 1040          * If the caller specified "rt", use that.  Otherwise, resolve the
 1041          * routing table by supplied "dst6".
 1042          */
 1043         if (!rt) {
 1044                 if (!dst6)
 1045                         return;
 1046                 if (!(rt = nd6_lookup(dst6, 0, NULL)))
 1047                         return;
 1048         }
 1049 
 1050         if ((rt->rt_flags & RTF_GATEWAY) != 0 ||
 1051             (rt->rt_flags & RTF_LLINFO) == 0 ||
 1052             !rt->rt_llinfo || !rt->rt_gateway ||
 1053             rt->rt_gateway->sa_family != AF_LINK) {
 1054                 /* This is not a host route. */
 1055                 return;
 1056         }
 1057 
 1058         ln = (struct llinfo_nd6 *)rt->rt_llinfo;
 1059         if (ln->ln_state < ND6_LLINFO_REACHABLE)
 1060                 return;
 1061 
 1062         /*
 1063          * if we get upper-layer reachability confirmation many times,
 1064          * it is possible we have false information.
 1065          */
 1066         if (!force) {
 1067                 ln->ln_byhint++;
 1068                 if (ln->ln_byhint > nd6_maxnudhint)
 1069                         return;
 1070         }
 1071 
 1072         ln->ln_state = ND6_LLINFO_REACHABLE;
 1073         if (ln->ln_expire)
 1074                 ln->ln_expire = time_second +
 1075                         ND_IFINFO(rt->rt_ifp)->reachable;
 1076 }
 1077 
 1078 void
 1079 nd6_rtrequest(req, rt, info)
 1080         int     req;
 1081         struct rtentry *rt;
 1082         struct rt_addrinfo *info; /* xxx unused */
 1083 {
 1084         struct sockaddr *gate = rt->rt_gateway;
 1085         struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
 1086         static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK};
 1087         struct ifnet *ifp = rt->rt_ifp;
 1088         struct ifaddr *ifa;
 1089 
 1090         RT_LOCK_ASSERT(rt);
 1091 
 1092         if ((rt->rt_flags & RTF_GATEWAY) != 0)
 1093                 return;
 1094 
 1095         if (nd6_need_cache(ifp) == 0 && (rt->rt_flags & RTF_HOST) == 0) {
 1096                 /*
 1097                  * This is probably an interface direct route for a link
 1098                  * which does not need neighbor caches (e.g. fe80::%lo0/64).
 1099                  * We do not need special treatment below for such a route.
 1100                  * Moreover, the RTF_LLINFO flag which would be set below
 1101                  * would annoy the ndp(8) command.
 1102                  */
 1103                 return;
 1104         }
 1105 
 1106         if (req == RTM_RESOLVE &&
 1107             (nd6_need_cache(ifp) == 0 || /* stf case */
 1108              !nd6_is_new_addr_neighbor((struct sockaddr_in6 *)rt_key(rt),
 1109              ifp))) {
 1110                 /*
 1111                  * FreeBSD and BSD/OS often make a cloned host route based
 1112                  * on a less-specific route (e.g. the default route).
 1113                  * If the less specific route does not have a "gateway"
 1114                  * (this is the case when the route just goes to a p2p or an
 1115                  * stf interface), we'll mistakenly make a neighbor cache for
 1116                  * the host route, and will see strange neighbor solicitation
 1117                  * for the corresponding destination.  In order to avoid the
 1118                  * confusion, we check if the destination of the route is
 1119                  * a neighbor in terms of neighbor discovery, and stop the
 1120                  * process if not.  Additionally, we remove the LLINFO flag
 1121                  * so that ndp(8) will not try to get the neighbor information
 1122                  * of the destination.
 1123                  */
 1124                 rt->rt_flags &= ~RTF_LLINFO;
 1125                 return;
 1126         }
 1127 
 1128         switch (req) {
 1129         case RTM_ADD:
 1130                 /*
 1131                  * There is no backward compatibility :)
 1132                  *
 1133                  * if ((rt->rt_flags & RTF_HOST) == 0 &&
 1134                  *     SIN(rt_mask(rt))->sin_addr.s_addr != 0xffffffff)
 1135                  *         rt->rt_flags |= RTF_CLONING;
 1136                  */
 1137                 if (rt->rt_flags & (RTF_CLONING | RTF_LLINFO)) {
 1138                         /*
 1139                          * Case 1: This route should come from
 1140                          * a route to interface.  RTF_LLINFO flag is set
 1141                          * for a host route whose destination should be
 1142                          * treated as on-link.
 1143                          */
 1144                         rt_setgate(rt, rt_key(rt),
 1145                                    (struct sockaddr *)&null_sdl);
 1146                         gate = rt->rt_gateway;
 1147                         SDL(gate)->sdl_type = ifp->if_type;
 1148                         SDL(gate)->sdl_index = ifp->if_index;
 1149                         if (ln)
 1150                                 ln->ln_expire = time_second;
 1151                         if (ln && ln->ln_expire == 0) {
 1152                                 /* kludge for desktops */
 1153                                 ln->ln_expire = 1;
 1154                         }
 1155                         if ((rt->rt_flags & RTF_CLONING) != 0)
 1156                                 break;
 1157                 }
 1158                 /*
 1159                  * In IPv4 code, we try to annonuce new RTF_ANNOUNCE entry here.
 1160                  * We don't do that here since llinfo is not ready yet.
 1161                  *
 1162                  * There are also couple of other things to be discussed:
 1163                  * - unsolicited NA code needs improvement beforehand
 1164                  * - RFC2461 says we MAY send multicast unsolicited NA
 1165                  *   (7.2.6 paragraph 4), however, it also says that we
 1166                  *   SHOULD provide a mechanism to prevent multicast NA storm.
 1167                  *   we don't have anything like it right now.
 1168                  *   note that the mechanism needs a mutual agreement
 1169                  *   between proxies, which means that we need to implement
 1170                  *   a new protocol, or a new kludge.
 1171                  * - from RFC2461 6.2.4, host MUST NOT send an unsolicited NA.
 1172                  *   we need to check ip6forwarding before sending it.
 1173                  *   (or should we allow proxy ND configuration only for
 1174                  *   routers?  there's no mention about proxy ND from hosts)
 1175                  */
 1176 #if 0
 1177                 /* XXX it does not work */
 1178                 if (rt->rt_flags & RTF_ANNOUNCE)
 1179                         nd6_na_output(ifp,
 1180                               &SIN6(rt_key(rt))->sin6_addr,
 1181                               &SIN6(rt_key(rt))->sin6_addr,
 1182                               ip6_forwarding ? ND_NA_FLAG_ROUTER : 0,
 1183                               1, NULL);
 1184 #endif
 1185                 /* FALLTHROUGH */
 1186         case RTM_RESOLVE:
 1187                 if ((ifp->if_flags & (IFF_POINTOPOINT | IFF_LOOPBACK)) == 0) {
 1188                         /*
 1189                          * Address resolution isn't necessary for a point to
 1190                          * point link, so we can skip this test for a p2p link.
 1191                          */
 1192                         if (gate->sa_family != AF_LINK ||
 1193                             gate->sa_len < sizeof(null_sdl)) {
 1194                                 log(LOG_DEBUG,
 1195                                     "nd6_rtrequest: bad gateway value: %s\n",
 1196                                     if_name(ifp));
 1197                                 break;
 1198                         }
 1199                         SDL(gate)->sdl_type = ifp->if_type;
 1200                         SDL(gate)->sdl_index = ifp->if_index;
 1201                 }
 1202                 if (ln != NULL)
 1203                         break;  /* This happens on a route change */
 1204                 /*
 1205                  * Case 2: This route may come from cloning, or a manual route
 1206                  * add with a LL address.
 1207                  */
 1208                 R_Malloc(ln, struct llinfo_nd6 *, sizeof(*ln));
 1209                 rt->rt_llinfo = (caddr_t)ln;
 1210                 if (!ln) {
 1211                         log(LOG_DEBUG, "nd6_rtrequest: malloc failed\n");
 1212                         break;
 1213                 }
 1214                 nd6_inuse++;
 1215                 nd6_allocated++;
 1216                 bzero(ln, sizeof(*ln));
 1217                 ln->ln_rt = rt;
 1218                 /* this is required for "ndp" command. - shin */
 1219                 if (req == RTM_ADD) {
 1220                         /*
 1221                          * gate should have some valid AF_LINK entry,
 1222                          * and ln->ln_expire should have some lifetime
 1223                          * which is specified by ndp command.
 1224                          */
 1225                         ln->ln_state = ND6_LLINFO_REACHABLE;
 1226                         ln->ln_byhint = 0;
 1227                 } else {
 1228                         /*
 1229                          * When req == RTM_RESOLVE, rt is created and
 1230                          * initialized in rtrequest(), so rt_expire is 0.
 1231                          */
 1232                         ln->ln_state = ND6_LLINFO_NOSTATE;
 1233                         ln->ln_expire = time_second;
 1234                 }
 1235                 rt->rt_flags |= RTF_LLINFO;
 1236                 ln->ln_next = llinfo_nd6.ln_next;
 1237                 llinfo_nd6.ln_next = ln;
 1238                 ln->ln_prev = &llinfo_nd6;
 1239                 ln->ln_next->ln_prev = ln;
 1240 
 1241                 /*
 1242                  * check if rt_key(rt) is one of my address assigned
 1243                  * to the interface.
 1244                  */
 1245                 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(rt->rt_ifp,
 1246                     &SIN6(rt_key(rt))->sin6_addr);
 1247                 if (ifa) {
 1248                         caddr_t macp = nd6_ifptomac(ifp);
 1249                         ln->ln_expire = 0;
 1250                         ln->ln_state = ND6_LLINFO_REACHABLE;
 1251                         ln->ln_byhint = 0;
 1252                         if (macp) {
 1253                                 bcopy(macp, LLADDR(SDL(gate)), ifp->if_addrlen);
 1254                                 SDL(gate)->sdl_alen = ifp->if_addrlen;
 1255                         }
 1256                         if (nd6_useloopback) {
 1257                                 rt->rt_ifp = &loif[0];  /* XXX */
 1258                                 /*
 1259                                  * Make sure rt_ifa be equal to the ifaddr
 1260                                  * corresponding to the address.
 1261                                  * We need this because when we refer
 1262                                  * rt_ifa->ia6_flags in ip6_input, we assume
 1263                                  * that the rt_ifa points to the address instead
 1264                                  * of the loopback address.
 1265                                  */
 1266                                 if (ifa != rt->rt_ifa) {
 1267                                         IFAFREE(rt->rt_ifa);
 1268                                         IFAREF(ifa);
 1269                                         rt->rt_ifa = ifa;
 1270                                 }
 1271                         }
 1272                 } else if (rt->rt_flags & RTF_ANNOUNCE) {
 1273                         ln->ln_expire = 0;
 1274                         ln->ln_state = ND6_LLINFO_REACHABLE;
 1275                         ln->ln_byhint = 0;
 1276 
 1277                         /* join solicited node multicast for proxy ND */
 1278                         if (ifp->if_flags & IFF_MULTICAST) {
 1279                                 struct in6_addr llsol;
 1280                                 int error;
 1281 
 1282                                 llsol = SIN6(rt_key(rt))->sin6_addr;
 1283                                 llsol.s6_addr16[0] = htons(0xff02);
 1284                                 llsol.s6_addr16[1] = htons(ifp->if_index);
 1285                                 llsol.s6_addr32[1] = 0;
 1286                                 llsol.s6_addr32[2] = htonl(1);
 1287                                 llsol.s6_addr8[12] = 0xff;
 1288 
 1289                                 if (!in6_addmulti(&llsol, ifp, &error)) {
 1290                                         nd6log((LOG_ERR, "%s: failed to join "
 1291                                             "%s (errno=%d)\n", if_name(ifp),
 1292                                             ip6_sprintf(&llsol), error));
 1293                                 }
 1294                         }
 1295                 }
 1296                 break;
 1297 
 1298         case RTM_DELETE:
 1299                 if (!ln)
 1300                         break;
 1301                 /* leave from solicited node multicast for proxy ND */
 1302                 if ((rt->rt_flags & RTF_ANNOUNCE) != 0 &&
 1303                     (ifp->if_flags & IFF_MULTICAST) != 0) {
 1304                         struct in6_addr llsol;
 1305                         struct in6_multi *in6m;
 1306 
 1307                         llsol = SIN6(rt_key(rt))->sin6_addr;
 1308                         llsol.s6_addr16[0] = htons(0xff02);
 1309                         llsol.s6_addr16[1] = htons(ifp->if_index);
 1310                         llsol.s6_addr32[1] = 0;
 1311                         llsol.s6_addr32[2] = htonl(1);
 1312                         llsol.s6_addr8[12] = 0xff;
 1313 
 1314                         IN6_LOOKUP_MULTI(llsol, ifp, in6m);
 1315                         if (in6m)
 1316                                 in6_delmulti(in6m);
 1317                 }
 1318                 nd6_inuse--;
 1319                 ln->ln_next->ln_prev = ln->ln_prev;
 1320                 ln->ln_prev->ln_next = ln->ln_next;
 1321                 ln->ln_prev = NULL;
 1322                 rt->rt_llinfo = 0;
 1323                 rt->rt_flags &= ~RTF_LLINFO;
 1324                 if (ln->ln_hold)
 1325                         m_freem(ln->ln_hold);
 1326                 Free((caddr_t)ln);
 1327         }
 1328 }
 1329 
 1330 int
 1331 nd6_ioctl(cmd, data, ifp)
 1332         u_long cmd;
 1333         caddr_t data;
 1334         struct ifnet *ifp;
 1335 {
 1336         struct in6_drlist *drl = (struct in6_drlist *)data;
 1337         struct in6_oprlist *oprl = (struct in6_oprlist *)data;
 1338         struct in6_ndireq *ndi = (struct in6_ndireq *)data;
 1339         struct in6_nbrinfo *nbi = (struct in6_nbrinfo *)data;
 1340         struct in6_ndifreq *ndif = (struct in6_ndifreq *)data;
 1341         struct nd_defrouter *dr, any;
 1342         struct nd_prefix *pr;
 1343         struct rtentry *rt;
 1344         int i = 0, error = 0;
 1345         int s;
 1346 
 1347         switch (cmd) {
 1348         case SIOCGDRLST_IN6:
 1349                 /*
 1350                  * obsolete API, use sysctl under net.inet6.icmp6
 1351                  */
 1352                 bzero(drl, sizeof(*drl));
 1353                 s = splnet();
 1354                 dr = TAILQ_FIRST(&nd_defrouter);
 1355                 while (dr && i < DRLSTSIZ) {
 1356                         drl->defrouter[i].rtaddr = dr->rtaddr;
 1357                         in6_clearscope(&drl->defrouter[i].rtaddr);
 1358 
 1359                         drl->defrouter[i].flags = dr->flags;
 1360                         drl->defrouter[i].rtlifetime = dr->rtlifetime;
 1361                         drl->defrouter[i].expire = dr->expire;
 1362                         drl->defrouter[i].if_index = dr->ifp->if_index;
 1363                         i++;
 1364                         dr = TAILQ_NEXT(dr, dr_entry);
 1365                 }
 1366                 splx(s);
 1367                 break;
 1368         case SIOCGPRLST_IN6:
 1369                 /*
 1370                  * obsolete API, use sysctl under net.inet6.icmp6
 1371                  *
 1372                  * XXX the structure in6_prlist was changed in backward-
 1373                  * incompatible manner.  in6_oprlist is used for SIOCGPRLST_IN6,
 1374                  * in6_prlist is used for nd6_sysctl() - fill_prlist().
 1375                  */
 1376                 /*
 1377                  * XXX meaning of fields, especialy "raflags", is very
 1378                  * differnet between RA prefix list and RR/static prefix list.
 1379                  * how about separating ioctls into two?
 1380                  */
 1381                 bzero(oprl, sizeof(*oprl));
 1382                 s = splnet();
 1383                 pr = nd_prefix.lh_first;
 1384                 while (pr && i < PRLSTSIZ) {
 1385                         struct nd_pfxrouter *pfr;
 1386                         int j;
 1387 
 1388                         (void)in6_embedscope(&oprl->prefix[i].prefix,
 1389                             &pr->ndpr_prefix, NULL, NULL);
 1390                         oprl->prefix[i].raflags = pr->ndpr_raf;
 1391                         oprl->prefix[i].prefixlen = pr->ndpr_plen;
 1392                         oprl->prefix[i].vltime = pr->ndpr_vltime;
 1393                         oprl->prefix[i].pltime = pr->ndpr_pltime;
 1394                         oprl->prefix[i].if_index = pr->ndpr_ifp->if_index;
 1395                         oprl->prefix[i].expire = pr->ndpr_expire;
 1396 
 1397                         pfr = pr->ndpr_advrtrs.lh_first;
 1398                         j = 0;
 1399                         while (pfr) {
 1400                                 if (j < DRLSTSIZ) {
 1401 #define RTRADDR oprl->prefix[i].advrtr[j]
 1402                                         RTRADDR = pfr->router->rtaddr;
 1403                                         in6_clearscope(&RTRADDR);
 1404 #undef RTRADDR
 1405                                 }
 1406                                 j++;
 1407                                 pfr = pfr->pfr_next;
 1408                         }
 1409                         oprl->prefix[i].advrtrs = j;
 1410                         oprl->prefix[i].origin = PR_ORIG_RA;
 1411 
 1412                         i++;
 1413                         pr = pr->ndpr_next;
 1414                 }
 1415                 splx(s);
 1416 
 1417                 break;
 1418         case OSIOCGIFINFO_IN6:
 1419                 /* XXX: old ndp(8) assumes a positive value for linkmtu. */
 1420                 bzero(&ndi->ndi, sizeof(ndi->ndi));
 1421                 ndi->ndi.linkmtu = IN6_LINKMTU(ifp);
 1422                 ndi->ndi.maxmtu = ND_IFINFO(ifp)->maxmtu;
 1423                 ndi->ndi.basereachable = ND_IFINFO(ifp)->basereachable;
 1424                 ndi->ndi.reachable = ND_IFINFO(ifp)->reachable;
 1425                 ndi->ndi.retrans = ND_IFINFO(ifp)->retrans;
 1426                 ndi->ndi.flags = ND_IFINFO(ifp)->flags;
 1427                 ndi->ndi.recalctm = ND_IFINFO(ifp)->recalctm;
 1428                 ndi->ndi.chlim = ND_IFINFO(ifp)->chlim;
 1429                 break;
 1430         case SIOCGIFINFO_IN6:
 1431                 ndi->ndi = *ND_IFINFO(ifp);
 1432                 ndi->ndi.linkmtu = IN6_LINKMTU(ifp);
 1433                 break;
 1434         case SIOCSIFINFO_FLAGS:
 1435                 ND_IFINFO(ifp)->flags = ndi->ndi.flags;
 1436                 break;
 1437         case SIOCSNDFLUSH_IN6:  /* XXX: the ioctl name is confusing... */
 1438                 /* flush default router list */
 1439                 /*
 1440                  * xxx sumikawa: should not delete route if default
 1441                  * route equals to the top of default router list
 1442                  */
 1443                 bzero(&any, sizeof(any));
 1444                 defrouter_delreq(&any, 0);
 1445                 defrouter_select();
 1446                 /* xxx sumikawa: flush prefix list */
 1447                 break;
 1448         case SIOCSPFXFLUSH_IN6:
 1449         {
 1450                 /* flush all the prefix advertised by routers */
 1451                 struct nd_prefix *pr, *next;
 1452 
 1453                 s = splnet();
 1454                 for (pr = nd_prefix.lh_first; pr; pr = next) {
 1455                         struct in6_ifaddr *ia, *ia_next;
 1456 
 1457                         next = pr->ndpr_next;
 1458 
 1459                         if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
 1460                                 continue; /* XXX */
 1461 
 1462                         /* do we really have to remove addresses as well? */
 1463                         for (ia = in6_ifaddr; ia; ia = ia_next) {
 1464                                 /* ia might be removed.  keep the next ptr. */
 1465                                 ia_next = ia->ia_next;
 1466 
 1467                                 if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0)
 1468                                         continue;
 1469 
 1470                                 if (ia->ia6_ndpr == pr)
 1471                                         in6_purgeaddr(&ia->ia_ifa);
 1472                         }
 1473                         prelist_remove(pr);
 1474                 }
 1475                 splx(s);
 1476                 break;
 1477         }
 1478         case SIOCSRTRFLUSH_IN6:
 1479         {
 1480                 /* flush all the default routers */
 1481                 struct nd_defrouter *dr, *next;
 1482 
 1483                 s = splnet();
 1484                 if ((dr = TAILQ_FIRST(&nd_defrouter)) != NULL) {
 1485                         /*
 1486                          * The first entry of the list may be stored in
 1487                          * the routing table, so we'll delete it later.
 1488                          */
 1489                         for (dr = TAILQ_NEXT(dr, dr_entry); dr; dr = next) {
 1490                                 next = TAILQ_NEXT(dr, dr_entry);
 1491                                 defrtrlist_del(dr);
 1492                         }
 1493                         defrtrlist_del(TAILQ_FIRST(&nd_defrouter));
 1494                 }
 1495                 splx(s);
 1496                 break;
 1497         }
 1498         case SIOCGNBRINFO_IN6:
 1499         {
 1500                 struct llinfo_nd6 *ln;
 1501                 struct in6_addr nb_addr = nbi->addr; /* make local for safety */
 1502 
 1503                 /*
 1504                  * XXX: KAME specific hack for scoped addresses
 1505                  *      XXXX: for other scopes than link-local?
 1506                  */
 1507                 if (IN6_IS_ADDR_LINKLOCAL(&nbi->addr) ||
 1508                     IN6_IS_ADDR_MC_LINKLOCAL(&nbi->addr)) {
 1509                         u_int16_t *idp = (u_int16_t *)&nb_addr.s6_addr[2];
 1510 
 1511                         if (*idp == 0)
 1512                                 *idp = htons(ifp->if_index);
 1513                 }
 1514 
 1515                 s = splnet();
 1516                 if ((rt = nd6_lookup(&nb_addr, 0, ifp)) == NULL) {
 1517                         error = EINVAL;
 1518                         splx(s);
 1519                         break;
 1520                 }
 1521                 ln = (struct llinfo_nd6 *)rt->rt_llinfo;
 1522                 nbi->state = ln->ln_state;
 1523                 nbi->asked = ln->ln_asked;
 1524                 nbi->isrouter = ln->ln_router;
 1525                 nbi->expire = ln->ln_expire;
 1526                 splx(s);
 1527 
 1528                 break;
 1529         }
 1530         case SIOCGDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */
 1531                 ndif->ifindex = nd6_defifindex;
 1532                 break;
 1533         case SIOCSDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */
 1534                 return (nd6_setdefaultiface(ndif->ifindex));
 1535         }
 1536         return (error);
 1537 }
 1538 
 1539 /*
 1540  * Create neighbor cache entry and cache link-layer address,
 1541  * on reception of inbound ND6 packets.  (RS/RA/NS/redirect)
 1542  */
 1543 struct rtentry *
 1544 nd6_cache_lladdr(ifp, from, lladdr, lladdrlen, type, code)
 1545         struct ifnet *ifp;
 1546         struct in6_addr *from;
 1547         char *lladdr;
 1548         int lladdrlen;
 1549         int type;       /* ICMP6 type */
 1550         int code;       /* type dependent information */
 1551 {
 1552         struct rtentry *rt = NULL;
 1553         struct llinfo_nd6 *ln = NULL;
 1554         int is_newentry;
 1555         struct sockaddr_dl *sdl = NULL;
 1556         int do_update;
 1557         int olladdr;
 1558         int llchange;
 1559         int newstate = 0;
 1560 
 1561         if (!ifp)
 1562                 panic("ifp == NULL in nd6_cache_lladdr");
 1563         if (!from)
 1564                 panic("from == NULL in nd6_cache_lladdr");
 1565 
 1566         /* nothing must be updated for unspecified address */
 1567         if (IN6_IS_ADDR_UNSPECIFIED(from))
 1568                 return NULL;
 1569 
 1570         /*
 1571          * Validation about ifp->if_addrlen and lladdrlen must be done in
 1572          * the caller.
 1573          *
 1574          * XXX If the link does not have link-layer adderss, what should
 1575          * we do? (ifp->if_addrlen == 0)
 1576          * Spec says nothing in sections for RA, RS and NA.  There's small
 1577          * description on it in NS section (RFC 2461 7.2.3).
 1578          */
 1579 
 1580         rt = nd6_lookup(from, 0, ifp);
 1581         if (!rt) {
 1582 #if 0
 1583                 /* nothing must be done if there's no lladdr */
 1584                 if (!lladdr || !lladdrlen)
 1585                         return NULL;
 1586 #endif
 1587 
 1588                 rt = nd6_lookup(from, 1, ifp);
 1589                 is_newentry = 1;
 1590         } else {
 1591                 /* do nothing if static ndp is set */
 1592                 if (rt->rt_flags & RTF_STATIC)
 1593                         return NULL;
 1594                 is_newentry = 0;
 1595         }
 1596 
 1597         if (!rt)
 1598                 return NULL;
 1599         if ((rt->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) != RTF_LLINFO) {
 1600 fail:
 1601                 (void)nd6_free(rt);
 1602                 return NULL;
 1603         }
 1604         ln = (struct llinfo_nd6 *)rt->rt_llinfo;
 1605         if (!ln)
 1606                 goto fail;
 1607         if (!rt->rt_gateway)
 1608                 goto fail;
 1609         if (rt->rt_gateway->sa_family != AF_LINK)
 1610                 goto fail;
 1611         sdl = SDL(rt->rt_gateway);
 1612 
 1613         olladdr = (sdl->sdl_alen) ? 1 : 0;
 1614         if (olladdr && lladdr) {
 1615                 if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen))
 1616                         llchange = 1;
 1617                 else
 1618                         llchange = 0;
 1619         } else
 1620                 llchange = 0;
 1621 
 1622         /*
 1623          * newentry olladdr  lladdr  llchange   (*=record)
 1624          *      0       n       n       --      (1)
 1625          *      0       y       n       --      (2)
 1626          *      0       n       y       --      (3) * STALE
 1627          *      0       y       y       n       (4) *
 1628          *      0       y       y       y       (5) * STALE
 1629          *      1       --      n       --      (6)   NOSTATE(= PASSIVE)
 1630          *      1       --      y       --      (7) * STALE
 1631          */
 1632 
 1633         if (lladdr) {           /* (3-5) and (7) */
 1634                 /*
 1635                  * Record source link-layer address
 1636                  * XXX is it dependent to ifp->if_type?
 1637                  */
 1638                 sdl->sdl_alen = ifp->if_addrlen;
 1639                 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
 1640         }
 1641 
 1642         if (!is_newentry) {
 1643                 if ((!olladdr && lladdr) ||             /* (3) */
 1644                     (olladdr && lladdr && llchange)) {  /* (5) */
 1645                         do_update = 1;
 1646                         newstate = ND6_LLINFO_STALE;
 1647                 } else                                  /* (1-2,4) */
 1648                         do_update = 0;
 1649         } else {
 1650                 do_update = 1;
 1651                 if (!lladdr)                            /* (6) */
 1652                         newstate = ND6_LLINFO_NOSTATE;
 1653                 else                                    /* (7) */
 1654                         newstate = ND6_LLINFO_STALE;
 1655         }
 1656 
 1657         if (do_update) {
 1658                 /*
 1659                  * Update the state of the neighbor cache.
 1660                  */
 1661                 ln->ln_state = newstate;
 1662 
 1663                 if (ln->ln_state == ND6_LLINFO_STALE) {
 1664                         /*
 1665                          * XXX: since nd6_output() below will cause
 1666                          * state tansition to DELAY and reset the timer,
 1667                          * we must set the timer now, although it is actually
 1668                          * meaningless.
 1669                          */
 1670                         ln->ln_expire = time_second + nd6_gctimer;
 1671 
 1672                         if (ln->ln_hold) {
 1673                                 /*
 1674                                  * we assume ifp is not a p2p here, so just
 1675                                  * set the 2nd argument as the 1st one.
 1676                                  */
 1677                                 nd6_output(ifp, ifp, ln->ln_hold,
 1678                                     (struct sockaddr_in6 *)rt_key(rt), rt);
 1679                                 ln->ln_hold = NULL;
 1680                         }
 1681                 } else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
 1682                         /* probe right away */
 1683                         ln->ln_expire = time_second;
 1684                 }
 1685         }
 1686 
 1687         /*
 1688          * ICMP6 type dependent behavior.
 1689          *
 1690          * NS: clear IsRouter if new entry
 1691          * RS: clear IsRouter
 1692          * RA: set IsRouter if there's lladdr
 1693          * redir: clear IsRouter if new entry
 1694          *
 1695          * RA case, (1):
 1696          * The spec says that we must set IsRouter in the following cases:
 1697          * - If lladdr exist, set IsRouter.  This means (1-5).
 1698          * - If it is old entry (!newentry), set IsRouter.  This means (7).
 1699          * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
 1700          * A quetion arises for (1) case.  (1) case has no lladdr in the
 1701          * neighbor cache, this is similar to (6).
 1702          * This case is rare but we figured that we MUST NOT set IsRouter.
 1703          *
 1704          * newentry olladdr  lladdr  llchange       NS  RS  RA  redir
 1705          *                                                      D R
 1706          *      0       n       n       --      (1)     c   ?     s
 1707          *      0       y       n       --      (2)     c   s     s
 1708          *      0       n       y       --      (3)     c   s     s
 1709          *      0       y       y       n       (4)     c   s     s
 1710          *      0       y       y       y       (5)     c   s     s
 1711          *      1       --      n       --      (6) c   c       c s
 1712          *      1       --      y       --      (7) c   c   s   c s
 1713          *
 1714          *                                      (c=clear s=set)
 1715          */
 1716         switch (type & 0xff) {
 1717         case ND_NEIGHBOR_SOLICIT:
 1718                 /*
 1719                  * New entry must have is_router flag cleared.
 1720                  */
 1721                 if (is_newentry)        /* (6-7) */
 1722                         ln->ln_router = 0;
 1723                 break;
 1724         case ND_REDIRECT:
 1725                 /*
 1726                  * If the icmp is a redirect to a better router, always set the
 1727                  * is_router flag.  Otherwise, if the entry is newly created,
 1728                  * clear the flag.  [RFC 2461, sec 8.3]
 1729                  */
 1730                 if (code == ND_REDIRECT_ROUTER)
 1731                         ln->ln_router = 1;
 1732                 else if (is_newentry) /* (6-7) */
 1733                         ln->ln_router = 0;
 1734                 break;
 1735         case ND_ROUTER_SOLICIT:
 1736                 /*
 1737                  * is_router flag must always be cleared.
 1738                  */
 1739                 ln->ln_router = 0;
 1740                 break;
 1741         case ND_ROUTER_ADVERT:
 1742                 /*
 1743                  * Mark an entry with lladdr as a router.
 1744                  */
 1745                 if ((!is_newentry && (olladdr || lladdr)) ||    /* (2-5) */
 1746                     (is_newentry && lladdr)) {                  /* (7) */
 1747                         ln->ln_router = 1;
 1748                 }
 1749                 break;
 1750         }
 1751 
 1752         /*
 1753          * When the link-layer address of a router changes, select the
 1754          * best router again.  In particular, when the neighbor entry is newly
 1755          * created, it might affect the selection policy.
 1756          * Question: can we restrict the first condition to the "is_newentry"
 1757          * case?
 1758          * XXX: when we hear an RA from a new router with the link-layer
 1759          * address option, defrouter_select() is called twice, since
 1760          * defrtrlist_update called the function as well.  However, I believe
 1761          * we can compromise the overhead, since it only happens the first
 1762          * time.
 1763          * XXX: although defrouter_select() should not have a bad effect
 1764          * for those are not autoconfigured hosts, we explicitly avoid such
 1765          * cases for safety.
 1766          */
 1767         if (do_update && ln->ln_router && !ip6_forwarding && ip6_accept_rtadv)
 1768                 defrouter_select();
 1769 
 1770         return rt;
 1771 }
 1772 
 1773 static void
 1774 nd6_slowtimo(ignored_arg)
 1775     void *ignored_arg;
 1776 {
 1777         int s = splnet();
 1778         struct nd_ifinfo *nd6if;
 1779         struct ifnet *ifp;
 1780 
 1781         callout_reset(&nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
 1782             nd6_slowtimo, NULL);
 1783         IFNET_RLOCK();
 1784         for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list)) {
 1785                 nd6if = ND_IFINFO(ifp);
 1786                 if (nd6if->basereachable && /* already initialized */
 1787                     (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
 1788                         /*
 1789                          * Since reachable time rarely changes by router
 1790                          * advertisements, we SHOULD insure that a new random
 1791                          * value gets recomputed at least once every few hours.
 1792                          * (RFC 2461, 6.3.4)
 1793                          */
 1794                         nd6if->recalctm = nd6_recalc_reachtm_interval;
 1795                         nd6if->reachable = ND_COMPUTE_RTIME(nd6if->basereachable);
 1796                 }
 1797         }
 1798         IFNET_RUNLOCK();
 1799         splx(s);
 1800 }
 1801 
 1802 #define senderr(e) { error = (e); goto bad;}
 1803 int
 1804 nd6_output(ifp, origifp, m0, dst, rt0)
 1805         struct ifnet *ifp;
 1806         struct ifnet *origifp;
 1807         struct mbuf *m0;
 1808         struct sockaddr_in6 *dst;
 1809         struct rtentry *rt0;
 1810 {
 1811         struct mbuf *m = m0;
 1812         struct rtentry *rt = rt0;
 1813         struct sockaddr_in6 *gw6 = NULL;
 1814         struct llinfo_nd6 *ln = NULL;
 1815         int error = 0;
 1816 
 1817         if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr))
 1818                 goto sendpkt;
 1819 
 1820         if (nd6_need_cache(ifp) == 0)
 1821                 goto sendpkt;
 1822 
 1823         /*
 1824          * next hop determination.  This routine is derived from ether_outpout.
 1825          */
 1826 again:
 1827         if (rt) {
 1828                 if ((rt->rt_flags & RTF_UP) == 0) {
 1829                         rt0 = rt = rtalloc1((struct sockaddr *)dst, 1, 0UL);
 1830                         if (rt != NULL) {
 1831                                 RT_REMREF(rt);
 1832                                 RT_UNLOCK(rt);
 1833                                 if (rt->rt_ifp != ifp)
 1834                                         /*
 1835                                          * XXX maybe we should update ifp too,
 1836                                          * but the original code didn't and I
 1837                                          * don't know what is correct here.
 1838                                          */
 1839                                         goto again;
 1840                         } else
 1841                                 senderr(EHOSTUNREACH);
 1842                 }
 1843 
 1844                 if (rt->rt_flags & RTF_GATEWAY) {
 1845                         gw6 = (struct sockaddr_in6 *)rt->rt_gateway;
 1846 
 1847                         /*
 1848                          * We skip link-layer address resolution and NUD
 1849                          * if the gateway is not a neighbor from ND point
 1850                          * of view, regardless of the value of nd_ifinfo.flags.
 1851                          * The second condition is a bit tricky; we skip
 1852                          * if the gateway is our own address, which is
 1853                          * sometimes used to install a route to a p2p link.
 1854                          */
 1855                         if (!nd6_is_addr_neighbor(gw6, ifp) ||
 1856                             in6ifa_ifpwithaddr(ifp, &gw6->sin6_addr)) {
 1857                                 /*
 1858                                  * We allow this kind of tricky route only
 1859                                  * when the outgoing interface is p2p.
 1860                                  * XXX: we may need a more generic rule here.
 1861                                  */
 1862                                 if ((ifp->if_flags & IFF_POINTOPOINT) == 0)
 1863                                         senderr(EHOSTUNREACH);
 1864 
 1865                                 goto sendpkt;
 1866                         }
 1867 
 1868                         if (rt->rt_gwroute == 0)
 1869                                 goto lookup;
 1870                         if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
 1871                                 RT_LOCK(rt);
 1872                                 rtfree(rt); rt = rt0;
 1873                         lookup:
 1874                                 rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1, 0UL);
 1875                                 if ((rt = rt->rt_gwroute) == 0)
 1876                                         senderr(EHOSTUNREACH);
 1877                                 RT_UNLOCK(rt);
 1878                         }
 1879                 }
 1880         }
 1881 
 1882         /*
 1883          * Address resolution or Neighbor Unreachability Detection
 1884          * for the next hop.
 1885          * At this point, the destination of the packet must be a unicast
 1886          * or an anycast address(i.e. not a multicast).
 1887          */
 1888 
 1889         /* Look up the neighbor cache for the nexthop */
 1890         if (rt && (rt->rt_flags & RTF_LLINFO) != 0)
 1891                 ln = (struct llinfo_nd6 *)rt->rt_llinfo;
 1892         else {
 1893                 /*
 1894                  * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
 1895                  * the condition below is not very efficient.  But we believe
 1896                  * it is tolerable, because this should be a rare case.
 1897                  */
 1898                 if (nd6_is_addr_neighbor(dst, ifp) &&
 1899                     (rt = nd6_lookup(&dst->sin6_addr, 1, ifp)) != NULL)
 1900                         ln = (struct llinfo_nd6 *)rt->rt_llinfo;
 1901         }
 1902         if (!ln || !rt) {
 1903                 if ((ifp->if_flags & IFF_POINTOPOINT) == 0 &&
 1904                     !(ND_IFINFO(ifp)->flags & ND6_IFF_PERFORMNUD)) {
 1905                         log(LOG_DEBUG,
 1906                             "nd6_output: can't allocate llinfo for %s "
 1907                             "(ln=%p, rt=%p)\n",
 1908                             ip6_sprintf(&dst->sin6_addr), ln, rt);
 1909                         senderr(EIO);   /* XXX: good error? */
 1910                 }
 1911 
 1912                 goto sendpkt;   /* send anyway */
 1913         }
 1914 
 1915         /* We don't have to do link-layer address resolution on a p2p link. */
 1916         if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
 1917             ln->ln_state < ND6_LLINFO_REACHABLE) {
 1918                 ln->ln_state = ND6_LLINFO_STALE;
 1919                 ln->ln_expire = time_second + nd6_gctimer;
 1920         }
 1921 
 1922         /*
 1923          * The first time we send a packet to a neighbor whose entry is
 1924          * STALE, we have to change the state to DELAY and a sets a timer to
 1925          * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
 1926          * neighbor unreachability detection on expiration.
 1927          * (RFC 2461 7.3.3)
 1928          */
 1929         if (ln->ln_state == ND6_LLINFO_STALE) {
 1930                 ln->ln_asked = 0;
 1931                 ln->ln_state = ND6_LLINFO_DELAY;
 1932                 ln->ln_expire = time_second + nd6_delay;
 1933         }
 1934 
 1935         /*
 1936          * If the neighbor cache entry has a state other than INCOMPLETE
 1937          * (i.e. its link-layer address is already resolved), just
 1938          * send the packet.
 1939          */
 1940         if (ln->ln_state > ND6_LLINFO_INCOMPLETE)
 1941                 goto sendpkt;
 1942 
 1943         /*
 1944          * There is a neighbor cache entry, but no ethernet address
 1945          * response yet.  Replace the held mbuf (if any) with this
 1946          * latest one.
 1947          *
 1948          * This code conforms to the rate-limiting rule described in Section
 1949          * 7.2.2 of RFC 2461, because the timer is set correctly after sending
 1950          * an NS below.
 1951          */
 1952         if (ln->ln_state == ND6_LLINFO_NOSTATE)
 1953                 ln->ln_state = ND6_LLINFO_INCOMPLETE;
 1954         if (ln->ln_hold)
 1955                 m_freem(ln->ln_hold);
 1956         ln->ln_hold = m;
 1957         if (ln->ln_expire) {
 1958                 if (ln->ln_asked < nd6_mmaxtries &&
 1959                     ln->ln_expire < time_second) {
 1960                         ln->ln_asked++;
 1961                         ln->ln_expire = time_second +
 1962                                 ND_IFINFO(ifp)->retrans / 1000;
 1963                         nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, 0);
 1964                 }
 1965         }
 1966         return (0);
 1967 
 1968   sendpkt:
 1969 #ifdef IPSEC
 1970         /* clean ipsec history once it goes out of the node */
 1971         ipsec_delaux(m);
 1972 #endif
 1973 
 1974 #ifdef MAC
 1975         mac_create_mbuf_linklayer(ifp, m);
 1976 #endif
 1977         if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
 1978                 return ((*ifp->if_output)(origifp, m, (struct sockaddr *)dst,
 1979                     rt));
 1980         }
 1981         return ((*ifp->if_output)(ifp, m, (struct sockaddr *)dst, rt));
 1982 
 1983   bad:
 1984         if (m)
 1985                 m_freem(m);
 1986         return (error);
 1987 }
 1988 #undef senderr
 1989 
 1990 int
 1991 nd6_need_cache(ifp)
 1992         struct ifnet *ifp;
 1993 {
 1994         /*
 1995          * XXX: we currently do not make neighbor cache on any interface
 1996          * other than ARCnet, Ethernet, FDDI and GIF.
 1997          *
 1998          * RFC2893 says:
 1999          * - unidirectional tunnels needs no ND
 2000          */
 2001         switch (ifp->if_type) {
 2002         case IFT_ARCNET:
 2003         case IFT_ETHER:
 2004         case IFT_FDDI:
 2005         case IFT_IEEE1394:
 2006 #ifdef IFT_L2VLAN
 2007         case IFT_L2VLAN:
 2008 #endif
 2009 #ifdef IFT_IEEE80211
 2010         case IFT_IEEE80211:
 2011 #endif
 2012 #ifdef IFT_CARP
 2013         case IFT_CARP:
 2014 #endif
 2015         case IFT_GIF:           /* XXX need more cases? */
 2016         case IFT_PPP:
 2017         case IFT_TUNNEL:
 2018         case IFT_BRIDGE:
 2019                 return (1);
 2020         default:
 2021                 return (0);
 2022         }
 2023 }
 2024 
 2025 int
 2026 nd6_storelladdr(ifp, rt0, m, dst, desten)
 2027         struct ifnet *ifp;
 2028         struct rtentry *rt0;
 2029         struct mbuf *m;
 2030         struct sockaddr *dst;
 2031         u_char *desten;
 2032 {
 2033         struct sockaddr_dl *sdl;
 2034         struct rtentry *rt;
 2035         int error;
 2036 
 2037         if (m->m_flags & M_MCAST) {
 2038                 int i;
 2039 
 2040                 switch (ifp->if_type) {
 2041                 case IFT_ETHER:
 2042                 case IFT_FDDI:
 2043 #ifdef IFT_L2VLAN
 2044                 case IFT_L2VLAN:
 2045 #endif
 2046 #ifdef IFT_IEEE80211
 2047                 case IFT_IEEE80211:
 2048 #endif
 2049                 case IFT_BRIDGE:
 2050                 case IFT_ISO88025:
 2051                         ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr,
 2052                                                  desten);
 2053                         return (0);
 2054                 case IFT_IEEE1394:
 2055                         /*
 2056                          * netbsd can use if_broadcastaddr, but we don't do so
 2057                          * to reduce # of ifdef.
 2058                          */
 2059                         for (i = 0; i < ifp->if_addrlen; i++)
 2060                                 desten[i] = ~0;
 2061                         return (0);
 2062                 case IFT_ARCNET:
 2063                         *desten = 0;
 2064                         return (0);
 2065                 default:
 2066                         m_freem(m);
 2067                         return (EAFNOSUPPORT);
 2068                 }
 2069         }
 2070 
 2071         if (rt0 == NULL) {
 2072                 /* this could happen, if we could not allocate memory */
 2073                 m_freem(m);
 2074                 return (ENOMEM);
 2075         }
 2076 
 2077         error = rt_check(&rt, &rt0, dst);
 2078         if (error) {
 2079                 m_freem(m);
 2080                 return (error);
 2081         }
 2082         RT_UNLOCK(rt);
 2083 
 2084         if (rt->rt_gateway->sa_family != AF_LINK) {
 2085                 printf("nd6_storelladdr: something odd happens\n");
 2086                 m_freem(m);
 2087                 return (EINVAL);
 2088         }
 2089         sdl = SDL(rt->rt_gateway);
 2090         if (sdl->sdl_alen == 0) {
 2091                 /* this should be impossible, but we bark here for debugging */
 2092                 printf("nd6_storelladdr: sdl_alen == 0\n");
 2093                 m_freem(m);
 2094                 return (EINVAL);
 2095         }
 2096 
 2097         bcopy(LLADDR(sdl), desten, sdl->sdl_alen);
 2098         return (0);
 2099 }
 2100 
 2101 static int nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS);
 2102 static int nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS);
 2103 #ifdef SYSCTL_DECL
 2104 SYSCTL_DECL(_net_inet6_icmp6);
 2105 #endif
 2106 SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_DRLIST, nd6_drlist,
 2107         CTLFLAG_RD, nd6_sysctl_drlist, "");
 2108 SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_PRLIST, nd6_prlist,
 2109         CTLFLAG_RD, nd6_sysctl_prlist, "");
 2110 
 2111 static int
 2112 nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS)
 2113 {
 2114         int error;
 2115         char buf[1024];
 2116         struct in6_defrouter *d, *de;
 2117         struct nd_defrouter *dr;
 2118 
 2119         if (req->newptr)
 2120                 return EPERM;
 2121         error = 0;
 2122 
 2123         for (dr = TAILQ_FIRST(&nd_defrouter); dr;
 2124              dr = TAILQ_NEXT(dr, dr_entry)) {
 2125                 d = (struct in6_defrouter *)buf;
 2126                 de = (struct in6_defrouter *)(buf + sizeof(buf));
 2127 
 2128                 if (d + 1 <= de) {
 2129                         bzero(d, sizeof(*d));
 2130                         d->rtaddr.sin6_family = AF_INET6;
 2131                         d->rtaddr.sin6_len = sizeof(d->rtaddr);
 2132                         if (in6_recoverscope(&d->rtaddr, &dr->rtaddr,
 2133                             dr->ifp) != 0)
 2134                                 log(LOG_ERR,
 2135                                     "scope error in "
 2136                                     "default router list (%s)\n",
 2137                                     ip6_sprintf(&dr->rtaddr));
 2138                         d->flags = dr->flags;
 2139                         d->rtlifetime = dr->rtlifetime;
 2140                         d->expire = dr->expire;
 2141                         d->if_index = dr->ifp->if_index;
 2142                 } else
 2143                         panic("buffer too short");
 2144 
 2145                 error = SYSCTL_OUT(req, buf, sizeof(*d));
 2146                 if (error)
 2147                         break;
 2148         }
 2149 
 2150         return (error);
 2151 }
 2152 
 2153 static int
 2154 nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS)
 2155 {
 2156         int error;
 2157         char buf[1024];
 2158         struct in6_prefix *p, *pe;
 2159         struct nd_prefix *pr;
 2160 
 2161         if (req->newptr)
 2162                 return EPERM;
 2163         error = 0;
 2164 
 2165         for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
 2166                 u_short advrtrs;
 2167                 size_t advance;
 2168                 struct sockaddr_in6 *sin6, *s6;
 2169                 struct nd_pfxrouter *pfr;
 2170 
 2171                 p = (struct in6_prefix *)buf;
 2172                 pe = (struct in6_prefix *)(buf + sizeof(buf));
 2173 
 2174                 if (p + 1 <= pe) {
 2175                         bzero(p, sizeof(*p));
 2176                         sin6 = (struct sockaddr_in6 *)(p + 1);
 2177 
 2178                         p->prefix = pr->ndpr_prefix;
 2179                         if (in6_recoverscope(&p->prefix,
 2180                             &p->prefix.sin6_addr, pr->ndpr_ifp) != 0)
 2181                                 log(LOG_ERR,
 2182                                     "scope error in prefix list (%s)\n",
 2183                                     ip6_sprintf(&p->prefix.sin6_addr));
 2184                         p->raflags = pr->ndpr_raf;
 2185                         p->prefixlen = pr->ndpr_plen;
 2186                         p->vltime = pr->ndpr_vltime;
 2187                         p->pltime = pr->ndpr_pltime;
 2188                         p->if_index = pr->ndpr_ifp->if_index;
 2189                         p->expire = pr->ndpr_expire;
 2190                         p->refcnt = pr->ndpr_refcnt;
 2191                         p->flags = pr->ndpr_stateflags;
 2192                         p->origin = PR_ORIG_RA;
 2193                         advrtrs = 0;
 2194                         for (pfr = pr->ndpr_advrtrs.lh_first; pfr;
 2195                              pfr = pfr->pfr_next) {
 2196                                 if ((void *)&sin6[advrtrs + 1] > (void *)pe) {
 2197                                         advrtrs++;
 2198                                         continue;
 2199                                 }
 2200                                 s6 = &sin6[advrtrs];
 2201                                 bzero(s6, sizeof(*s6));
 2202                                 s6->sin6_family = AF_INET6;
 2203                                 s6->sin6_len = sizeof(*sin6);
 2204                                 if (in6_recoverscope(s6, &pfr->router->rtaddr,
 2205                                     pfr->router->ifp) != 0)
 2206                                         log(LOG_ERR,
 2207                                             "scope error in "
 2208                                             "prefix list (%s)\n",
 2209                                             ip6_sprintf(&pfr->router->rtaddr));
 2210                                 advrtrs++;
 2211                         }
 2212                         p->advrtrs = advrtrs;
 2213                 } else
 2214                         panic("buffer too short");
 2215 
 2216                 advance = sizeof(*p) + sizeof(*sin6) * advrtrs;
 2217                 error = SYSCTL_OUT(req, buf, advance);
 2218                 if (error)
 2219                         break;
 2220         }
 2221 
 2222         return (error);
 2223 }

Cache object: cd75249f1bd32c6e51ff7a209323d4fe


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.