FreeBSD/Linux Kernel Cross Reference
sys/netinet6/nd6.c
1 /*-
2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the project nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 * $KAME: nd6.c,v 1.144 2001/05/24 07:44:00 itojun Exp $
30 */
31
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD: releng/9.0/sys/netinet6/nd6.c 228246 2011-12-03 22:15:42Z hrs $");
34
35 #include "opt_inet.h"
36 #include "opt_inet6.h"
37
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/callout.h>
41 #include <sys/malloc.h>
42 #include <sys/mbuf.h>
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/time.h>
46 #include <sys/kernel.h>
47 #include <sys/protosw.h>
48 #include <sys/errno.h>
49 #include <sys/syslog.h>
50 #include <sys/lock.h>
51 #include <sys/rwlock.h>
52 #include <sys/queue.h>
53 #include <sys/sysctl.h>
54
55 #include <net/if.h>
56 #include <net/if_arc.h>
57 #include <net/if_dl.h>
58 #include <net/if_types.h>
59 #include <net/iso88025.h>
60 #include <net/fddi.h>
61 #include <net/route.h>
62 #include <net/vnet.h>
63
64 #include <netinet/in.h>
65 #include <net/if_llatbl.h>
66 #define L3_ADDR_SIN6(le) ((struct sockaddr_in6 *) L3_ADDR(le))
67 #include <netinet/if_ether.h>
68 #include <netinet6/in6_var.h>
69 #include <netinet/ip6.h>
70 #include <netinet6/ip6_var.h>
71 #include <netinet6/scope6_var.h>
72 #include <netinet6/nd6.h>
73 #include <netinet6/in6_ifattach.h>
74 #include <netinet/icmp6.h>
75 #include <netinet6/send.h>
76
77 #include <sys/limits.h>
78
79 #include <security/mac/mac_framework.h>
80
81 #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */
82 #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */
83
84 #define SIN6(s) ((struct sockaddr_in6 *)s)
85
86 /* timer values */
87 VNET_DEFINE(int, nd6_prune) = 1; /* walk list every 1 seconds */
88 VNET_DEFINE(int, nd6_delay) = 5; /* delay first probe time 5 second */
89 VNET_DEFINE(int, nd6_umaxtries) = 3; /* maximum unicast query */
90 VNET_DEFINE(int, nd6_mmaxtries) = 3; /* maximum multicast query */
91 VNET_DEFINE(int, nd6_useloopback) = 1; /* use loopback interface for
92 * local traffic */
93 VNET_DEFINE(int, nd6_gctimer) = (60 * 60 * 24); /* 1 day: garbage
94 * collection timer */
95
96 /* preventing too many loops in ND option parsing */
97 static VNET_DEFINE(int, nd6_maxndopt) = 10; /* max # of ND options allowed */
98
99 VNET_DEFINE(int, nd6_maxnudhint) = 0; /* max # of subsequent upper
100 * layer hints */
101 static VNET_DEFINE(int, nd6_maxqueuelen) = 1; /* max pkts cached in unresolved
102 * ND entries */
103 #define V_nd6_maxndopt VNET(nd6_maxndopt)
104 #define V_nd6_maxqueuelen VNET(nd6_maxqueuelen)
105
106 #ifdef ND6_DEBUG
107 VNET_DEFINE(int, nd6_debug) = 1;
108 #else
109 VNET_DEFINE(int, nd6_debug) = 0;
110 #endif
111
112 /* for debugging? */
113 #if 0
114 static int nd6_inuse, nd6_allocated;
115 #endif
116
117 VNET_DEFINE(struct nd_drhead, nd_defrouter);
118 VNET_DEFINE(struct nd_prhead, nd_prefix);
119
120 VNET_DEFINE(int, nd6_recalc_reachtm_interval) = ND6_RECALC_REACHTM_INTERVAL;
121 #define V_nd6_recalc_reachtm_interval VNET(nd6_recalc_reachtm_interval)
122
123 static struct sockaddr_in6 all1_sa;
124
125 int (*send_sendso_input_hook)(struct mbuf *, struct ifnet *, int, int);
126
127 static int nd6_is_new_addr_neighbor __P((struct sockaddr_in6 *,
128 struct ifnet *));
129 static void nd6_setmtu0(struct ifnet *, struct nd_ifinfo *);
130 static void nd6_slowtimo(void *);
131 static int regen_tmpaddr(struct in6_ifaddr *);
132 static struct llentry *nd6_free(struct llentry *, int);
133 static void nd6_llinfo_timer(void *);
134 static void clear_llinfo_pqueue(struct llentry *);
135
136 static VNET_DEFINE(struct callout, nd6_slowtimo_ch);
137 #define V_nd6_slowtimo_ch VNET(nd6_slowtimo_ch)
138
139 VNET_DEFINE(struct callout, nd6_timer_ch);
140
141 void
142 nd6_init(void)
143 {
144 int i;
145
146 LIST_INIT(&V_nd_prefix);
147
148 all1_sa.sin6_family = AF_INET6;
149 all1_sa.sin6_len = sizeof(struct sockaddr_in6);
150 for (i = 0; i < sizeof(all1_sa.sin6_addr); i++)
151 all1_sa.sin6_addr.s6_addr[i] = 0xff;
152
153 /* initialization of the default router list */
154 TAILQ_INIT(&V_nd_defrouter);
155
156 /* start timer */
157 callout_init(&V_nd6_slowtimo_ch, 0);
158 callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
159 nd6_slowtimo, curvnet);
160 }
161
162 #ifdef VIMAGE
163 void
164 nd6_destroy()
165 {
166
167 callout_drain(&V_nd6_slowtimo_ch);
168 callout_drain(&V_nd6_timer_ch);
169 }
170 #endif
171
172 struct nd_ifinfo *
173 nd6_ifattach(struct ifnet *ifp)
174 {
175 struct nd_ifinfo *nd;
176
177 nd = (struct nd_ifinfo *)malloc(sizeof(*nd), M_IP6NDP, M_WAITOK);
178 bzero(nd, sizeof(*nd));
179
180 nd->initialized = 1;
181
182 nd->chlim = IPV6_DEFHLIM;
183 nd->basereachable = REACHABLE_TIME;
184 nd->reachable = ND_COMPUTE_RTIME(nd->basereachable);
185 nd->retrans = RETRANS_TIMER;
186
187 nd->flags = ND6_IFF_PERFORMNUD;
188
189 /* A loopback interface always has ND6_IFF_AUTO_LINKLOCAL. */
190 if (V_ip6_auto_linklocal || (ifp->if_flags & IFF_LOOPBACK))
191 nd->flags |= ND6_IFF_AUTO_LINKLOCAL;
192
193 /* A loopback interface does not need to accept RTADV. */
194 if (V_ip6_accept_rtadv && !(ifp->if_flags & IFF_LOOPBACK))
195 nd->flags |= ND6_IFF_ACCEPT_RTADV;
196 if (V_ip6_no_radr && !(ifp->if_flags & IFF_LOOPBACK))
197 nd->flags |= ND6_IFF_NO_RADR;
198
199 /* XXX: we cannot call nd6_setmtu since ifp is not fully initialized */
200 nd6_setmtu0(ifp, nd);
201
202 return nd;
203 }
204
205 void
206 nd6_ifdetach(struct nd_ifinfo *nd)
207 {
208
209 free(nd, M_IP6NDP);
210 }
211
212 /*
213 * Reset ND level link MTU. This function is called when the physical MTU
214 * changes, which means we might have to adjust the ND level MTU.
215 */
216 void
217 nd6_setmtu(struct ifnet *ifp)
218 {
219
220 nd6_setmtu0(ifp, ND_IFINFO(ifp));
221 }
222
223 /* XXX todo: do not maintain copy of ifp->if_mtu in ndi->maxmtu */
224 void
225 nd6_setmtu0(struct ifnet *ifp, struct nd_ifinfo *ndi)
226 {
227 u_int32_t omaxmtu;
228
229 omaxmtu = ndi->maxmtu;
230
231 switch (ifp->if_type) {
232 case IFT_ARCNET:
233 ndi->maxmtu = MIN(ARC_PHDS_MAXMTU, ifp->if_mtu); /* RFC2497 */
234 break;
235 case IFT_FDDI:
236 ndi->maxmtu = MIN(FDDIIPMTU, ifp->if_mtu); /* RFC2467 */
237 break;
238 case IFT_ISO88025:
239 ndi->maxmtu = MIN(ISO88025_MAX_MTU, ifp->if_mtu);
240 break;
241 default:
242 ndi->maxmtu = ifp->if_mtu;
243 break;
244 }
245
246 /*
247 * Decreasing the interface MTU under IPV6 minimum MTU may cause
248 * undesirable situation. We thus notify the operator of the change
249 * explicitly. The check for omaxmtu is necessary to restrict the
250 * log to the case of changing the MTU, not initializing it.
251 */
252 if (omaxmtu >= IPV6_MMTU && ndi->maxmtu < IPV6_MMTU) {
253 log(LOG_NOTICE, "nd6_setmtu0: "
254 "new link MTU on %s (%lu) is too small for IPv6\n",
255 if_name(ifp), (unsigned long)ndi->maxmtu);
256 }
257
258 if (ndi->maxmtu > V_in6_maxmtu)
259 in6_setmaxmtu(); /* check all interfaces just in case */
260
261 }
262
263 void
264 nd6_option_init(void *opt, int icmp6len, union nd_opts *ndopts)
265 {
266
267 bzero(ndopts, sizeof(*ndopts));
268 ndopts->nd_opts_search = (struct nd_opt_hdr *)opt;
269 ndopts->nd_opts_last
270 = (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len);
271
272 if (icmp6len == 0) {
273 ndopts->nd_opts_done = 1;
274 ndopts->nd_opts_search = NULL;
275 }
276 }
277
278 /*
279 * Take one ND option.
280 */
281 struct nd_opt_hdr *
282 nd6_option(union nd_opts *ndopts)
283 {
284 struct nd_opt_hdr *nd_opt;
285 int olen;
286
287 if (ndopts == NULL)
288 panic("ndopts == NULL in nd6_option");
289 if (ndopts->nd_opts_last == NULL)
290 panic("uninitialized ndopts in nd6_option");
291 if (ndopts->nd_opts_search == NULL)
292 return NULL;
293 if (ndopts->nd_opts_done)
294 return NULL;
295
296 nd_opt = ndopts->nd_opts_search;
297
298 /* make sure nd_opt_len is inside the buffer */
299 if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) {
300 bzero(ndopts, sizeof(*ndopts));
301 return NULL;
302 }
303
304 olen = nd_opt->nd_opt_len << 3;
305 if (olen == 0) {
306 /*
307 * Message validation requires that all included
308 * options have a length that is greater than zero.
309 */
310 bzero(ndopts, sizeof(*ndopts));
311 return NULL;
312 }
313
314 ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);
315 if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
316 /* option overruns the end of buffer, invalid */
317 bzero(ndopts, sizeof(*ndopts));
318 return NULL;
319 } else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
320 /* reached the end of options chain */
321 ndopts->nd_opts_done = 1;
322 ndopts->nd_opts_search = NULL;
323 }
324 return nd_opt;
325 }
326
327 /*
328 * Parse multiple ND options.
329 * This function is much easier to use, for ND routines that do not need
330 * multiple options of the same type.
331 */
332 int
333 nd6_options(union nd_opts *ndopts)
334 {
335 struct nd_opt_hdr *nd_opt;
336 int i = 0;
337
338 if (ndopts == NULL)
339 panic("ndopts == NULL in nd6_options");
340 if (ndopts->nd_opts_last == NULL)
341 panic("uninitialized ndopts in nd6_options");
342 if (ndopts->nd_opts_search == NULL)
343 return 0;
344
345 while (1) {
346 nd_opt = nd6_option(ndopts);
347 if (nd_opt == NULL && ndopts->nd_opts_last == NULL) {
348 /*
349 * Message validation requires that all included
350 * options have a length that is greater than zero.
351 */
352 ICMP6STAT_INC(icp6s_nd_badopt);
353 bzero(ndopts, sizeof(*ndopts));
354 return -1;
355 }
356
357 if (nd_opt == NULL)
358 goto skip1;
359
360 switch (nd_opt->nd_opt_type) {
361 case ND_OPT_SOURCE_LINKADDR:
362 case ND_OPT_TARGET_LINKADDR:
363 case ND_OPT_MTU:
364 case ND_OPT_REDIRECTED_HEADER:
365 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
366 nd6log((LOG_INFO,
367 "duplicated ND6 option found (type=%d)\n",
368 nd_opt->nd_opt_type));
369 /* XXX bark? */
370 } else {
371 ndopts->nd_opt_array[nd_opt->nd_opt_type]
372 = nd_opt;
373 }
374 break;
375 case ND_OPT_PREFIX_INFORMATION:
376 if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) {
377 ndopts->nd_opt_array[nd_opt->nd_opt_type]
378 = nd_opt;
379 }
380 ndopts->nd_opts_pi_end =
381 (struct nd_opt_prefix_info *)nd_opt;
382 break;
383 default:
384 /*
385 * Unknown options must be silently ignored,
386 * to accomodate future extension to the protocol.
387 */
388 nd6log((LOG_DEBUG,
389 "nd6_options: unsupported option %d - "
390 "option ignored\n", nd_opt->nd_opt_type));
391 }
392
393 skip1:
394 i++;
395 if (i > V_nd6_maxndopt) {
396 ICMP6STAT_INC(icp6s_nd_toomanyopt);
397 nd6log((LOG_INFO, "too many loop in nd opt\n"));
398 break;
399 }
400
401 if (ndopts->nd_opts_done)
402 break;
403 }
404
405 return 0;
406 }
407
408 /*
409 * ND6 timer routine to handle ND6 entries
410 */
411 void
412 nd6_llinfo_settimer_locked(struct llentry *ln, long tick)
413 {
414 int canceled;
415
416 LLE_WLOCK_ASSERT(ln);
417
418 if (tick < 0) {
419 ln->la_expire = 0;
420 ln->ln_ntick = 0;
421 canceled = callout_stop(&ln->ln_timer_ch);
422 } else {
423 ln->la_expire = time_second + tick / hz;
424 LLE_ADDREF(ln);
425 if (tick > INT_MAX) {
426 ln->ln_ntick = tick - INT_MAX;
427 canceled = callout_reset(&ln->ln_timer_ch, INT_MAX,
428 nd6_llinfo_timer, ln);
429 } else {
430 ln->ln_ntick = 0;
431 canceled = callout_reset(&ln->ln_timer_ch, tick,
432 nd6_llinfo_timer, ln);
433 }
434 }
435 if (canceled)
436 LLE_REMREF(ln);
437 }
438
439 void
440 nd6_llinfo_settimer(struct llentry *ln, long tick)
441 {
442
443 LLE_WLOCK(ln);
444 nd6_llinfo_settimer_locked(ln, tick);
445 LLE_WUNLOCK(ln);
446 }
447
448 static void
449 nd6_llinfo_timer(void *arg)
450 {
451 struct llentry *ln;
452 struct in6_addr *dst;
453 struct ifnet *ifp;
454 struct nd_ifinfo *ndi = NULL;
455
456 KASSERT(arg != NULL, ("%s: arg NULL", __func__));
457 ln = (struct llentry *)arg;
458 LLE_WLOCK_ASSERT(ln);
459 ifp = ln->lle_tbl->llt_ifp;
460
461 CURVNET_SET(ifp->if_vnet);
462
463 if (ln->ln_ntick > 0) {
464 if (ln->ln_ntick > INT_MAX) {
465 ln->ln_ntick -= INT_MAX;
466 nd6_llinfo_settimer_locked(ln, INT_MAX);
467 } else {
468 ln->ln_ntick = 0;
469 nd6_llinfo_settimer_locked(ln, ln->ln_ntick);
470 }
471 goto done;
472 }
473
474 ndi = ND_IFINFO(ifp);
475 dst = &L3_ADDR_SIN6(ln)->sin6_addr;
476 if (ln->la_flags & LLE_STATIC) {
477 goto done;
478 }
479
480 if (ln->la_flags & LLE_DELETED) {
481 (void)nd6_free(ln, 0);
482 ln = NULL;
483 goto done;
484 }
485
486 switch (ln->ln_state) {
487 case ND6_LLINFO_INCOMPLETE:
488 if (ln->la_asked < V_nd6_mmaxtries) {
489 ln->la_asked++;
490 nd6_llinfo_settimer_locked(ln, (long)ndi->retrans * hz / 1000);
491 LLE_WUNLOCK(ln);
492 nd6_ns_output(ifp, NULL, dst, ln, 0);
493 LLE_WLOCK(ln);
494 } else {
495 struct mbuf *m = ln->la_hold;
496 if (m) {
497 struct mbuf *m0;
498
499 /*
500 * assuming every packet in la_hold has the
501 * same IP header. Send error after unlock.
502 */
503 m0 = m->m_nextpkt;
504 m->m_nextpkt = NULL;
505 ln->la_hold = m0;
506 clear_llinfo_pqueue(ln);
507 }
508 (void)nd6_free(ln, 0);
509 ln = NULL;
510 if (m != NULL)
511 icmp6_error2(m, ICMP6_DST_UNREACH,
512 ICMP6_DST_UNREACH_ADDR, 0, ifp);
513 }
514 break;
515 case ND6_LLINFO_REACHABLE:
516 if (!ND6_LLINFO_PERMANENT(ln)) {
517 ln->ln_state = ND6_LLINFO_STALE;
518 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
519 }
520 break;
521
522 case ND6_LLINFO_STALE:
523 /* Garbage Collection(RFC 2461 5.3) */
524 if (!ND6_LLINFO_PERMANENT(ln)) {
525 (void)nd6_free(ln, 1);
526 ln = NULL;
527 }
528 break;
529
530 case ND6_LLINFO_DELAY:
531 if (ndi && (ndi->flags & ND6_IFF_PERFORMNUD) != 0) {
532 /* We need NUD */
533 ln->la_asked = 1;
534 ln->ln_state = ND6_LLINFO_PROBE;
535 nd6_llinfo_settimer_locked(ln, (long)ndi->retrans * hz / 1000);
536 LLE_WUNLOCK(ln);
537 nd6_ns_output(ifp, dst, dst, ln, 0);
538 LLE_WLOCK(ln);
539 } else {
540 ln->ln_state = ND6_LLINFO_STALE; /* XXX */
541 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
542 }
543 break;
544 case ND6_LLINFO_PROBE:
545 if (ln->la_asked < V_nd6_umaxtries) {
546 ln->la_asked++;
547 nd6_llinfo_settimer_locked(ln, (long)ndi->retrans * hz / 1000);
548 LLE_WUNLOCK(ln);
549 nd6_ns_output(ifp, dst, dst, ln, 0);
550 LLE_WLOCK(ln);
551 } else {
552 (void)nd6_free(ln, 0);
553 ln = NULL;
554 }
555 break;
556 default:
557 panic("%s: paths in a dark night can be confusing: %d",
558 __func__, ln->ln_state);
559 }
560 done:
561 if (ln != NULL)
562 LLE_FREE_LOCKED(ln);
563 CURVNET_RESTORE();
564 }
565
566
567 /*
568 * ND6 timer routine to expire default route list and prefix list
569 */
570 void
571 nd6_timer(void *arg)
572 {
573 CURVNET_SET((struct vnet *) arg);
574 int s;
575 struct nd_defrouter *dr;
576 struct nd_prefix *pr;
577 struct in6_ifaddr *ia6, *nia6;
578 struct in6_addrlifetime *lt6;
579
580 callout_reset(&V_nd6_timer_ch, V_nd6_prune * hz,
581 nd6_timer, curvnet);
582
583 /* expire default router list */
584 s = splnet();
585 dr = TAILQ_FIRST(&V_nd_defrouter);
586 while (dr) {
587 if (dr->expire && dr->expire < time_second) {
588 struct nd_defrouter *t;
589 t = TAILQ_NEXT(dr, dr_entry);
590 defrtrlist_del(dr);
591 dr = t;
592 } else {
593 dr = TAILQ_NEXT(dr, dr_entry);
594 }
595 }
596
597 /*
598 * expire interface addresses.
599 * in the past the loop was inside prefix expiry processing.
600 * However, from a stricter speci-confrmance standpoint, we should
601 * rather separate address lifetimes and prefix lifetimes.
602 *
603 * XXXRW: in6_ifaddrhead locking.
604 */
605 addrloop:
606 TAILQ_FOREACH_SAFE(ia6, &V_in6_ifaddrhead, ia_link, nia6) {
607 /* check address lifetime */
608 lt6 = &ia6->ia6_lifetime;
609 if (IFA6_IS_INVALID(ia6)) {
610 int regen = 0;
611
612 /*
613 * If the expiring address is temporary, try
614 * regenerating a new one. This would be useful when
615 * we suspended a laptop PC, then turned it on after a
616 * period that could invalidate all temporary
617 * addresses. Although we may have to restart the
618 * loop (see below), it must be after purging the
619 * address. Otherwise, we'd see an infinite loop of
620 * regeneration.
621 */
622 if (V_ip6_use_tempaddr &&
623 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
624 if (regen_tmpaddr(ia6) == 0)
625 regen = 1;
626 }
627
628 in6_purgeaddr(&ia6->ia_ifa);
629
630 if (regen)
631 goto addrloop; /* XXX: see below */
632 } else if (IFA6_IS_DEPRECATED(ia6)) {
633 int oldflags = ia6->ia6_flags;
634
635 ia6->ia6_flags |= IN6_IFF_DEPRECATED;
636
637 /*
638 * If a temporary address has just become deprecated,
639 * regenerate a new one if possible.
640 */
641 if (V_ip6_use_tempaddr &&
642 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
643 (oldflags & IN6_IFF_DEPRECATED) == 0) {
644
645 if (regen_tmpaddr(ia6) == 0) {
646 /*
647 * A new temporary address is
648 * generated.
649 * XXX: this means the address chain
650 * has changed while we are still in
651 * the loop. Although the change
652 * would not cause disaster (because
653 * it's not a deletion, but an
654 * addition,) we'd rather restart the
655 * loop just for safety. Or does this
656 * significantly reduce performance??
657 */
658 goto addrloop;
659 }
660 }
661 } else {
662 /*
663 * A new RA might have made a deprecated address
664 * preferred.
665 */
666 ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;
667 }
668 }
669
670 /* expire prefix list */
671 pr = V_nd_prefix.lh_first;
672 while (pr) {
673 /*
674 * check prefix lifetime.
675 * since pltime is just for autoconf, pltime processing for
676 * prefix is not necessary.
677 */
678 if (pr->ndpr_vltime != ND6_INFINITE_LIFETIME &&
679 time_second - pr->ndpr_lastupdate > pr->ndpr_vltime) {
680 struct nd_prefix *t;
681 t = pr->ndpr_next;
682
683 /*
684 * address expiration and prefix expiration are
685 * separate. NEVER perform in6_purgeaddr here.
686 */
687
688 prelist_remove(pr);
689 pr = t;
690 } else
691 pr = pr->ndpr_next;
692 }
693 splx(s);
694 CURVNET_RESTORE();
695 }
696
697 /*
698 * ia6 - deprecated/invalidated temporary address
699 */
700 static int
701 regen_tmpaddr(struct in6_ifaddr *ia6)
702 {
703 struct ifaddr *ifa;
704 struct ifnet *ifp;
705 struct in6_ifaddr *public_ifa6 = NULL;
706
707 ifp = ia6->ia_ifa.ifa_ifp;
708 IF_ADDR_LOCK(ifp);
709 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
710 struct in6_ifaddr *it6;
711
712 if (ifa->ifa_addr->sa_family != AF_INET6)
713 continue;
714
715 it6 = (struct in6_ifaddr *)ifa;
716
717 /* ignore no autoconf addresses. */
718 if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0)
719 continue;
720
721 /* ignore autoconf addresses with different prefixes. */
722 if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr)
723 continue;
724
725 /*
726 * Now we are looking at an autoconf address with the same
727 * prefix as ours. If the address is temporary and is still
728 * preferred, do not create another one. It would be rare, but
729 * could happen, for example, when we resume a laptop PC after
730 * a long period.
731 */
732 if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
733 !IFA6_IS_DEPRECATED(it6)) {
734 public_ifa6 = NULL;
735 break;
736 }
737
738 /*
739 * This is a public autoconf address that has the same prefix
740 * as ours. If it is preferred, keep it. We can't break the
741 * loop here, because there may be a still-preferred temporary
742 * address with the prefix.
743 */
744 if (!IFA6_IS_DEPRECATED(it6))
745 public_ifa6 = it6;
746
747 if (public_ifa6 != NULL)
748 ifa_ref(&public_ifa6->ia_ifa);
749 }
750 IF_ADDR_UNLOCK(ifp);
751
752 if (public_ifa6 != NULL) {
753 int e;
754
755 if ((e = in6_tmpifadd(public_ifa6, 0, 0)) != 0) {
756 ifa_free(&public_ifa6->ia_ifa);
757 log(LOG_NOTICE, "regen_tmpaddr: failed to create a new"
758 " tmp addr,errno=%d\n", e);
759 return (-1);
760 }
761 ifa_free(&public_ifa6->ia_ifa);
762 return (0);
763 }
764
765 return (-1);
766 }
767
768 /*
769 * Nuke neighbor cache/prefix/default router management table, right before
770 * ifp goes away.
771 */
772 void
773 nd6_purge(struct ifnet *ifp)
774 {
775 struct nd_defrouter *dr, *ndr;
776 struct nd_prefix *pr, *npr;
777
778 /*
779 * Nuke default router list entries toward ifp.
780 * We defer removal of default router list entries that is installed
781 * in the routing table, in order to keep additional side effects as
782 * small as possible.
783 */
784 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
785 ndr = TAILQ_NEXT(dr, dr_entry);
786 if (dr->installed)
787 continue;
788
789 if (dr->ifp == ifp)
790 defrtrlist_del(dr);
791 }
792
793 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
794 ndr = TAILQ_NEXT(dr, dr_entry);
795 if (!dr->installed)
796 continue;
797
798 if (dr->ifp == ifp)
799 defrtrlist_del(dr);
800 }
801
802 /* Nuke prefix list entries toward ifp */
803 for (pr = V_nd_prefix.lh_first; pr; pr = npr) {
804 npr = pr->ndpr_next;
805 if (pr->ndpr_ifp == ifp) {
806 /*
807 * Because if_detach() does *not* release prefixes
808 * while purging addresses the reference count will
809 * still be above zero. We therefore reset it to
810 * make sure that the prefix really gets purged.
811 */
812 pr->ndpr_refcnt = 0;
813
814 /*
815 * Previously, pr->ndpr_addr is removed as well,
816 * but I strongly believe we don't have to do it.
817 * nd6_purge() is only called from in6_ifdetach(),
818 * which removes all the associated interface addresses
819 * by itself.
820 * (jinmei@kame.net 20010129)
821 */
822 prelist_remove(pr);
823 }
824 }
825
826 /* cancel default outgoing interface setting */
827 if (V_nd6_defifindex == ifp->if_index)
828 nd6_setdefaultiface(0);
829
830 if (ND_IFINFO(ifp)->flags & ND6_IFF_ACCEPT_RTADV) {
831 /* Refresh default router list. */
832 defrouter_select();
833 }
834
835 /* XXXXX
836 * We do not nuke the neighbor cache entries here any more
837 * because the neighbor cache is kept in if_afdata[AF_INET6].
838 * nd6_purge() is invoked by in6_ifdetach() which is called
839 * from if_detach() where everything gets purged. So let
840 * in6_domifdetach() do the actual L2 table purging work.
841 */
842 }
843
844 /*
845 * the caller acquires and releases the lock on the lltbls
846 * Returns the llentry locked
847 */
848 struct llentry *
849 nd6_lookup(struct in6_addr *addr6, int flags, struct ifnet *ifp)
850 {
851 struct sockaddr_in6 sin6;
852 struct llentry *ln;
853 int llflags;
854
855 bzero(&sin6, sizeof(sin6));
856 sin6.sin6_len = sizeof(struct sockaddr_in6);
857 sin6.sin6_family = AF_INET6;
858 sin6.sin6_addr = *addr6;
859
860 IF_AFDATA_LOCK_ASSERT(ifp);
861
862 llflags = 0;
863 if (flags & ND6_CREATE)
864 llflags |= LLE_CREATE;
865 if (flags & ND6_EXCLUSIVE)
866 llflags |= LLE_EXCLUSIVE;
867
868 ln = lla_lookup(LLTABLE6(ifp), llflags, (struct sockaddr *)&sin6);
869 if ((ln != NULL) && (llflags & LLE_CREATE))
870 ln->ln_state = ND6_LLINFO_NOSTATE;
871
872 return (ln);
873 }
874
875 /*
876 * Test whether a given IPv6 address is a neighbor or not, ignoring
877 * the actual neighbor cache. The neighbor cache is ignored in order
878 * to not reenter the routing code from within itself.
879 */
880 static int
881 nd6_is_new_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
882 {
883 struct nd_prefix *pr;
884 struct ifaddr *dstaddr;
885
886 /*
887 * A link-local address is always a neighbor.
888 * XXX: a link does not necessarily specify a single interface.
889 */
890 if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr)) {
891 struct sockaddr_in6 sin6_copy;
892 u_int32_t zone;
893
894 /*
895 * We need sin6_copy since sa6_recoverscope() may modify the
896 * content (XXX).
897 */
898 sin6_copy = *addr;
899 if (sa6_recoverscope(&sin6_copy))
900 return (0); /* XXX: should be impossible */
901 if (in6_setscope(&sin6_copy.sin6_addr, ifp, &zone))
902 return (0);
903 if (sin6_copy.sin6_scope_id == zone)
904 return (1);
905 else
906 return (0);
907 }
908
909 /*
910 * If the address matches one of our addresses,
911 * it should be a neighbor.
912 * If the address matches one of our on-link prefixes, it should be a
913 * neighbor.
914 */
915 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
916 if (pr->ndpr_ifp != ifp)
917 continue;
918
919 if (!(pr->ndpr_stateflags & NDPRF_ONLINK)) {
920 struct rtentry *rt;
921 rt = rtalloc1((struct sockaddr *)&pr->ndpr_prefix, 0, 0);
922 if (rt == NULL)
923 continue;
924 /*
925 * This is the case where multiple interfaces
926 * have the same prefix, but only one is installed
927 * into the routing table and that prefix entry
928 * is not the one being examined here. In the case
929 * where RADIX_MPATH is enabled, multiple route
930 * entries (of the same rt_key value) will be
931 * installed because the interface addresses all
932 * differ.
933 */
934 if (!IN6_ARE_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
935 &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr)) {
936 RTFREE_LOCKED(rt);
937 continue;
938 }
939 RTFREE_LOCKED(rt);
940 }
941
942 if (IN6_ARE_MASKED_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
943 &addr->sin6_addr, &pr->ndpr_mask))
944 return (1);
945 }
946
947 /*
948 * If the address is assigned on the node of the other side of
949 * a p2p interface, the address should be a neighbor.
950 */
951 dstaddr = ifa_ifwithdstaddr((struct sockaddr *)addr);
952 if (dstaddr != NULL) {
953 if (dstaddr->ifa_ifp == ifp) {
954 ifa_free(dstaddr);
955 return (1);
956 }
957 ifa_free(dstaddr);
958 }
959
960 /*
961 * If the default router list is empty, all addresses are regarded
962 * as on-link, and thus, as a neighbor.
963 */
964 if (ND_IFINFO(ifp)->flags & ND6_IFF_ACCEPT_RTADV &&
965 TAILQ_FIRST(&V_nd_defrouter) == NULL &&
966 V_nd6_defifindex == ifp->if_index) {
967 return (1);
968 }
969
970 return (0);
971 }
972
973
974 /*
975 * Detect if a given IPv6 address identifies a neighbor on a given link.
976 * XXX: should take care of the destination of a p2p link?
977 */
978 int
979 nd6_is_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
980 {
981 struct llentry *lle;
982 int rc = 0;
983
984 IF_AFDATA_UNLOCK_ASSERT(ifp);
985 if (nd6_is_new_addr_neighbor(addr, ifp))
986 return (1);
987
988 /*
989 * Even if the address matches none of our addresses, it might be
990 * in the neighbor cache.
991 */
992 IF_AFDATA_LOCK(ifp);
993 if ((lle = nd6_lookup(&addr->sin6_addr, 0, ifp)) != NULL) {
994 LLE_RUNLOCK(lle);
995 rc = 1;
996 }
997 IF_AFDATA_UNLOCK(ifp);
998 return (rc);
999 }
1000
1001 /*
1002 * Free an nd6 llinfo entry.
1003 * Since the function would cause significant changes in the kernel, DO NOT
1004 * make it global, unless you have a strong reason for the change, and are sure
1005 * that the change is safe.
1006 */
1007 static struct llentry *
1008 nd6_free(struct llentry *ln, int gc)
1009 {
1010 struct llentry *next;
1011 struct nd_defrouter *dr;
1012 struct ifnet *ifp;
1013
1014 LLE_WLOCK_ASSERT(ln);
1015
1016 /*
1017 * we used to have pfctlinput(PRC_HOSTDEAD) here.
1018 * even though it is not harmful, it was not really necessary.
1019 */
1020
1021 /* cancel timer */
1022 nd6_llinfo_settimer_locked(ln, -1);
1023
1024 ifp = ln->lle_tbl->llt_ifp;
1025
1026 if (ND_IFINFO(ifp)->flags & ND6_IFF_ACCEPT_RTADV) {
1027 dr = defrouter_lookup(&L3_ADDR_SIN6(ln)->sin6_addr, ifp);
1028
1029 if (dr != NULL && dr->expire &&
1030 ln->ln_state == ND6_LLINFO_STALE && gc) {
1031 /*
1032 * If the reason for the deletion is just garbage
1033 * collection, and the neighbor is an active default
1034 * router, do not delete it. Instead, reset the GC
1035 * timer using the router's lifetime.
1036 * Simply deleting the entry would affect default
1037 * router selection, which is not necessarily a good
1038 * thing, especially when we're using router preference
1039 * values.
1040 * XXX: the check for ln_state would be redundant,
1041 * but we intentionally keep it just in case.
1042 */
1043 if (dr->expire > time_second)
1044 nd6_llinfo_settimer_locked(ln,
1045 (dr->expire - time_second) * hz);
1046 else
1047 nd6_llinfo_settimer_locked(ln,
1048 (long)V_nd6_gctimer * hz);
1049
1050 next = LIST_NEXT(ln, lle_next);
1051 LLE_REMREF(ln);
1052 LLE_WUNLOCK(ln);
1053 return (next);
1054 }
1055
1056 if (dr) {
1057 /*
1058 * Unreachablity of a router might affect the default
1059 * router selection and on-link detection of advertised
1060 * prefixes.
1061 */
1062
1063 /*
1064 * Temporarily fake the state to choose a new default
1065 * router and to perform on-link determination of
1066 * prefixes correctly.
1067 * Below the state will be set correctly,
1068 * or the entry itself will be deleted.
1069 */
1070 ln->ln_state = ND6_LLINFO_INCOMPLETE;
1071 }
1072
1073 if (ln->ln_router || dr) {
1074
1075 /*
1076 * We need to unlock to avoid a LOR with rt6_flush() with the
1077 * rnh and for the calls to pfxlist_onlink_check() and
1078 * defrouter_select() in the block further down for calls
1079 * into nd6_lookup(). We still hold a ref.
1080 */
1081 LLE_WUNLOCK(ln);
1082
1083 /*
1084 * rt6_flush must be called whether or not the neighbor
1085 * is in the Default Router List.
1086 * See a corresponding comment in nd6_na_input().
1087 */
1088 rt6_flush(&L3_ADDR_SIN6(ln)->sin6_addr, ifp);
1089 }
1090
1091 if (dr) {
1092 /*
1093 * Since defrouter_select() does not affect the
1094 * on-link determination and MIP6 needs the check
1095 * before the default router selection, we perform
1096 * the check now.
1097 */
1098 pfxlist_onlink_check();
1099
1100 /*
1101 * Refresh default router list.
1102 */
1103 defrouter_select();
1104 }
1105
1106 if (ln->ln_router || dr)
1107 LLE_WLOCK(ln);
1108 }
1109
1110 /*
1111 * Before deleting the entry, remember the next entry as the
1112 * return value. We need this because pfxlist_onlink_check() above
1113 * might have freed other entries (particularly the old next entry) as
1114 * a side effect (XXX).
1115 */
1116 next = LIST_NEXT(ln, lle_next);
1117
1118 /*
1119 * Save to unlock. We still hold an extra reference and will not
1120 * free(9) in llentry_free() if someone else holds one as well.
1121 */
1122 LLE_WUNLOCK(ln);
1123 IF_AFDATA_LOCK(ifp);
1124 LLE_WLOCK(ln);
1125 LLE_REMREF(ln);
1126 llentry_free(ln);
1127 IF_AFDATA_UNLOCK(ifp);
1128
1129 return (next);
1130 }
1131
1132 /*
1133 * Upper-layer reachability hint for Neighbor Unreachability Detection.
1134 *
1135 * XXX cost-effective methods?
1136 */
1137 void
1138 nd6_nud_hint(struct rtentry *rt, struct in6_addr *dst6, int force)
1139 {
1140 struct llentry *ln;
1141 struct ifnet *ifp;
1142
1143 if ((dst6 == NULL) || (rt == NULL))
1144 return;
1145
1146 ifp = rt->rt_ifp;
1147 IF_AFDATA_LOCK(ifp);
1148 ln = nd6_lookup(dst6, ND6_EXCLUSIVE, NULL);
1149 IF_AFDATA_UNLOCK(ifp);
1150 if (ln == NULL)
1151 return;
1152
1153 if (ln->ln_state < ND6_LLINFO_REACHABLE)
1154 goto done;
1155
1156 /*
1157 * if we get upper-layer reachability confirmation many times,
1158 * it is possible we have false information.
1159 */
1160 if (!force) {
1161 ln->ln_byhint++;
1162 if (ln->ln_byhint > V_nd6_maxnudhint) {
1163 goto done;
1164 }
1165 }
1166
1167 ln->ln_state = ND6_LLINFO_REACHABLE;
1168 if (!ND6_LLINFO_PERMANENT(ln)) {
1169 nd6_llinfo_settimer_locked(ln,
1170 (long)ND_IFINFO(rt->rt_ifp)->reachable * hz);
1171 }
1172 done:
1173 LLE_WUNLOCK(ln);
1174 }
1175
1176
1177 int
1178 nd6_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp)
1179 {
1180 struct in6_drlist *drl = (struct in6_drlist *)data;
1181 struct in6_oprlist *oprl = (struct in6_oprlist *)data;
1182 struct in6_ndireq *ndi = (struct in6_ndireq *)data;
1183 struct in6_nbrinfo *nbi = (struct in6_nbrinfo *)data;
1184 struct in6_ndifreq *ndif = (struct in6_ndifreq *)data;
1185 struct nd_defrouter *dr;
1186 struct nd_prefix *pr;
1187 int i = 0, error = 0;
1188 int s;
1189
1190 switch (cmd) {
1191 case SIOCGDRLST_IN6:
1192 /*
1193 * obsolete API, use sysctl under net.inet6.icmp6
1194 */
1195 bzero(drl, sizeof(*drl));
1196 s = splnet();
1197 dr = TAILQ_FIRST(&V_nd_defrouter);
1198 while (dr && i < DRLSTSIZ) {
1199 drl->defrouter[i].rtaddr = dr->rtaddr;
1200 in6_clearscope(&drl->defrouter[i].rtaddr);
1201
1202 drl->defrouter[i].flags = dr->flags;
1203 drl->defrouter[i].rtlifetime = dr->rtlifetime;
1204 drl->defrouter[i].expire = dr->expire;
1205 drl->defrouter[i].if_index = dr->ifp->if_index;
1206 i++;
1207 dr = TAILQ_NEXT(dr, dr_entry);
1208 }
1209 splx(s);
1210 break;
1211 case SIOCGPRLST_IN6:
1212 /*
1213 * obsolete API, use sysctl under net.inet6.icmp6
1214 *
1215 * XXX the structure in6_prlist was changed in backward-
1216 * incompatible manner. in6_oprlist is used for SIOCGPRLST_IN6,
1217 * in6_prlist is used for nd6_sysctl() - fill_prlist().
1218 */
1219 /*
1220 * XXX meaning of fields, especialy "raflags", is very
1221 * differnet between RA prefix list and RR/static prefix list.
1222 * how about separating ioctls into two?
1223 */
1224 bzero(oprl, sizeof(*oprl));
1225 s = splnet();
1226 pr = V_nd_prefix.lh_first;
1227 while (pr && i < PRLSTSIZ) {
1228 struct nd_pfxrouter *pfr;
1229 int j;
1230
1231 oprl->prefix[i].prefix = pr->ndpr_prefix.sin6_addr;
1232 oprl->prefix[i].raflags = pr->ndpr_raf;
1233 oprl->prefix[i].prefixlen = pr->ndpr_plen;
1234 oprl->prefix[i].vltime = pr->ndpr_vltime;
1235 oprl->prefix[i].pltime = pr->ndpr_pltime;
1236 oprl->prefix[i].if_index = pr->ndpr_ifp->if_index;
1237 if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
1238 oprl->prefix[i].expire = 0;
1239 else {
1240 time_t maxexpire;
1241
1242 /* XXX: we assume time_t is signed. */
1243 maxexpire = (-1) &
1244 ~((time_t)1 <<
1245 ((sizeof(maxexpire) * 8) - 1));
1246 if (pr->ndpr_vltime <
1247 maxexpire - pr->ndpr_lastupdate) {
1248 oprl->prefix[i].expire =
1249 pr->ndpr_lastupdate +
1250 pr->ndpr_vltime;
1251 } else
1252 oprl->prefix[i].expire = maxexpire;
1253 }
1254
1255 pfr = pr->ndpr_advrtrs.lh_first;
1256 j = 0;
1257 while (pfr) {
1258 if (j < DRLSTSIZ) {
1259 #define RTRADDR oprl->prefix[i].advrtr[j]
1260 RTRADDR = pfr->router->rtaddr;
1261 in6_clearscope(&RTRADDR);
1262 #undef RTRADDR
1263 }
1264 j++;
1265 pfr = pfr->pfr_next;
1266 }
1267 oprl->prefix[i].advrtrs = j;
1268 oprl->prefix[i].origin = PR_ORIG_RA;
1269
1270 i++;
1271 pr = pr->ndpr_next;
1272 }
1273 splx(s);
1274
1275 break;
1276 case OSIOCGIFINFO_IN6:
1277 #define ND ndi->ndi
1278 /* XXX: old ndp(8) assumes a positive value for linkmtu. */
1279 bzero(&ND, sizeof(ND));
1280 ND.linkmtu = IN6_LINKMTU(ifp);
1281 ND.maxmtu = ND_IFINFO(ifp)->maxmtu;
1282 ND.basereachable = ND_IFINFO(ifp)->basereachable;
1283 ND.reachable = ND_IFINFO(ifp)->reachable;
1284 ND.retrans = ND_IFINFO(ifp)->retrans;
1285 ND.flags = ND_IFINFO(ifp)->flags;
1286 ND.recalctm = ND_IFINFO(ifp)->recalctm;
1287 ND.chlim = ND_IFINFO(ifp)->chlim;
1288 break;
1289 case SIOCGIFINFO_IN6:
1290 ND = *ND_IFINFO(ifp);
1291 break;
1292 case SIOCSIFINFO_IN6:
1293 /*
1294 * used to change host variables from userland.
1295 * intented for a use on router to reflect RA configurations.
1296 */
1297 /* 0 means 'unspecified' */
1298 if (ND.linkmtu != 0) {
1299 if (ND.linkmtu < IPV6_MMTU ||
1300 ND.linkmtu > IN6_LINKMTU(ifp)) {
1301 error = EINVAL;
1302 break;
1303 }
1304 ND_IFINFO(ifp)->linkmtu = ND.linkmtu;
1305 }
1306
1307 if (ND.basereachable != 0) {
1308 int obasereachable = ND_IFINFO(ifp)->basereachable;
1309
1310 ND_IFINFO(ifp)->basereachable = ND.basereachable;
1311 if (ND.basereachable != obasereachable)
1312 ND_IFINFO(ifp)->reachable =
1313 ND_COMPUTE_RTIME(ND.basereachable);
1314 }
1315 if (ND.retrans != 0)
1316 ND_IFINFO(ifp)->retrans = ND.retrans;
1317 if (ND.chlim != 0)
1318 ND_IFINFO(ifp)->chlim = ND.chlim;
1319 /* FALLTHROUGH */
1320 case SIOCSIFINFO_FLAGS:
1321 {
1322 struct ifaddr *ifa;
1323 struct in6_ifaddr *ia;
1324
1325 /*
1326 * Try to clear ifdisabled flag when enabling
1327 * accept_rtadv or auto_linklocal.
1328 */
1329 if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) &&
1330 !(ND.flags & ND6_IFF_IFDISABLED) &&
1331 (ND.flags & (ND6_IFF_ACCEPT_RTADV |
1332 ND6_IFF_AUTO_LINKLOCAL)))
1333 ND.flags &= ~ND6_IFF_IFDISABLED;
1334
1335 if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) &&
1336 !(ND.flags & ND6_IFF_IFDISABLED)) {
1337 /* ifdisabled 1->0 transision */
1338
1339 /*
1340 * If the interface is marked as ND6_IFF_IFDISABLED and
1341 * has an link-local address with IN6_IFF_DUPLICATED,
1342 * do not clear ND6_IFF_IFDISABLED.
1343 * See RFC 4862, Section 5.4.5.
1344 */
1345 int duplicated_linklocal = 0;
1346
1347 IF_ADDR_LOCK(ifp);
1348 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1349 if (ifa->ifa_addr->sa_family != AF_INET6)
1350 continue;
1351 ia = (struct in6_ifaddr *)ifa;
1352 if ((ia->ia6_flags & IN6_IFF_DUPLICATED) &&
1353 IN6_IS_ADDR_LINKLOCAL(IA6_IN6(ia))) {
1354 duplicated_linklocal = 1;
1355 break;
1356 }
1357 }
1358 IF_ADDR_UNLOCK(ifp);
1359
1360 if (duplicated_linklocal) {
1361 ND.flags |= ND6_IFF_IFDISABLED;
1362 log(LOG_ERR, "Cannot enable an interface"
1363 " with a link-local address marked"
1364 " duplicate.\n");
1365 } else {
1366 ND_IFINFO(ifp)->flags &= ~ND6_IFF_IFDISABLED;
1367 if (ifp->if_flags & IFF_UP)
1368 in6_if_up(ifp);
1369 }
1370 } else if (!(ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) &&
1371 (ND.flags & ND6_IFF_IFDISABLED)) {
1372 /* ifdisabled 0->1 transision */
1373 /* Mark all IPv6 address as tentative. */
1374
1375 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED;
1376 IF_ADDR_LOCK(ifp);
1377 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1378 if (ifa->ifa_addr->sa_family != AF_INET6)
1379 continue;
1380 ia = (struct in6_ifaddr *)ifa;
1381 ia->ia6_flags |= IN6_IFF_TENTATIVE;
1382 }
1383 IF_ADDR_UNLOCK(ifp);
1384 }
1385
1386 if (ND.flags & ND6_IFF_AUTO_LINKLOCAL) {
1387 if (!(ND_IFINFO(ifp)->flags & ND6_IFF_AUTO_LINKLOCAL)) {
1388 /* auto_linklocal 0->1 transision */
1389
1390 /* If no link-local address on ifp, configure */
1391 ND_IFINFO(ifp)->flags |= ND6_IFF_AUTO_LINKLOCAL;
1392 in6_ifattach(ifp, NULL);
1393 } else if (!(ND.flags & ND6_IFF_IFDISABLED) &&
1394 ifp->if_flags & IFF_UP) {
1395 /*
1396 * When the IF already has
1397 * ND6_IFF_AUTO_LINKLOCAL, no link-local
1398 * address is assigned, and IFF_UP, try to
1399 * assign one.
1400 */
1401 int haslinklocal = 0;
1402
1403 IF_ADDR_LOCK(ifp);
1404 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1405 if (ifa->ifa_addr->sa_family != AF_INET6)
1406 continue;
1407 ia = (struct in6_ifaddr *)ifa;
1408 if (IN6_IS_ADDR_LINKLOCAL(IA6_IN6(ia))) {
1409 haslinklocal = 1;
1410 break;
1411 }
1412 }
1413 IF_ADDR_UNLOCK(ifp);
1414 if (!haslinklocal)
1415 in6_ifattach(ifp, NULL);
1416 }
1417 }
1418 }
1419 ND_IFINFO(ifp)->flags = ND.flags;
1420 break;
1421 #undef ND
1422 case SIOCSNDFLUSH_IN6: /* XXX: the ioctl name is confusing... */
1423 /* sync kernel routing table with the default router list */
1424 defrouter_reset();
1425 defrouter_select();
1426 break;
1427 case SIOCSPFXFLUSH_IN6:
1428 {
1429 /* flush all the prefix advertised by routers */
1430 struct nd_prefix *pr, *next;
1431
1432 s = splnet();
1433 for (pr = V_nd_prefix.lh_first; pr; pr = next) {
1434 struct in6_ifaddr *ia, *ia_next;
1435
1436 next = pr->ndpr_next;
1437
1438 if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
1439 continue; /* XXX */
1440
1441 /* do we really have to remove addresses as well? */
1442 /* XXXRW: in6_ifaddrhead locking. */
1443 TAILQ_FOREACH_SAFE(ia, &V_in6_ifaddrhead, ia_link,
1444 ia_next) {
1445 if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0)
1446 continue;
1447
1448 if (ia->ia6_ndpr == pr)
1449 in6_purgeaddr(&ia->ia_ifa);
1450 }
1451 prelist_remove(pr);
1452 }
1453 splx(s);
1454 break;
1455 }
1456 case SIOCSRTRFLUSH_IN6:
1457 {
1458 /* flush all the default routers */
1459 struct nd_defrouter *dr, *next;
1460
1461 s = splnet();
1462 defrouter_reset();
1463 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = next) {
1464 next = TAILQ_NEXT(dr, dr_entry);
1465 defrtrlist_del(dr);
1466 }
1467 defrouter_select();
1468 splx(s);
1469 break;
1470 }
1471 case SIOCGNBRINFO_IN6:
1472 {
1473 struct llentry *ln;
1474 struct in6_addr nb_addr = nbi->addr; /* make local for safety */
1475
1476 if ((error = in6_setscope(&nb_addr, ifp, NULL)) != 0)
1477 return (error);
1478
1479 IF_AFDATA_LOCK(ifp);
1480 ln = nd6_lookup(&nb_addr, 0, ifp);
1481 IF_AFDATA_UNLOCK(ifp);
1482
1483 if (ln == NULL) {
1484 error = EINVAL;
1485 break;
1486 }
1487 nbi->state = ln->ln_state;
1488 nbi->asked = ln->la_asked;
1489 nbi->isrouter = ln->ln_router;
1490 nbi->expire = ln->la_expire;
1491 LLE_RUNLOCK(ln);
1492 break;
1493 }
1494 case SIOCGDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */
1495 ndif->ifindex = V_nd6_defifindex;
1496 break;
1497 case SIOCSDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */
1498 return (nd6_setdefaultiface(ndif->ifindex));
1499 }
1500 return (error);
1501 }
1502
1503 /*
1504 * Create neighbor cache entry and cache link-layer address,
1505 * on reception of inbound ND6 packets. (RS/RA/NS/redirect)
1506 *
1507 * type - ICMP6 type
1508 * code - type dependent information
1509 *
1510 * XXXXX
1511 * The caller of this function already acquired the ndp
1512 * cache table lock because the cache entry is returned.
1513 */
1514 struct llentry *
1515 nd6_cache_lladdr(struct ifnet *ifp, struct in6_addr *from, char *lladdr,
1516 int lladdrlen, int type, int code)
1517 {
1518 struct llentry *ln = NULL;
1519 int is_newentry;
1520 int do_update;
1521 int olladdr;
1522 int llchange;
1523 int flags;
1524 int newstate = 0;
1525 uint16_t router = 0;
1526 struct sockaddr_in6 sin6;
1527 struct mbuf *chain = NULL;
1528 int static_route = 0;
1529
1530 IF_AFDATA_UNLOCK_ASSERT(ifp);
1531
1532 if (ifp == NULL)
1533 panic("ifp == NULL in nd6_cache_lladdr");
1534 if (from == NULL)
1535 panic("from == NULL in nd6_cache_lladdr");
1536
1537 /* nothing must be updated for unspecified address */
1538 if (IN6_IS_ADDR_UNSPECIFIED(from))
1539 return NULL;
1540
1541 /*
1542 * Validation about ifp->if_addrlen and lladdrlen must be done in
1543 * the caller.
1544 *
1545 * XXX If the link does not have link-layer adderss, what should
1546 * we do? (ifp->if_addrlen == 0)
1547 * Spec says nothing in sections for RA, RS and NA. There's small
1548 * description on it in NS section (RFC 2461 7.2.3).
1549 */
1550 flags = lladdr ? ND6_EXCLUSIVE : 0;
1551 IF_AFDATA_LOCK(ifp);
1552 ln = nd6_lookup(from, flags, ifp);
1553
1554 if (ln == NULL) {
1555 flags |= ND6_EXCLUSIVE;
1556 ln = nd6_lookup(from, flags | ND6_CREATE, ifp);
1557 IF_AFDATA_UNLOCK(ifp);
1558 is_newentry = 1;
1559 } else {
1560 IF_AFDATA_UNLOCK(ifp);
1561 /* do nothing if static ndp is set */
1562 if (ln->la_flags & LLE_STATIC) {
1563 static_route = 1;
1564 goto done;
1565 }
1566 is_newentry = 0;
1567 }
1568 if (ln == NULL)
1569 return (NULL);
1570
1571 olladdr = (ln->la_flags & LLE_VALID) ? 1 : 0;
1572 if (olladdr && lladdr) {
1573 llchange = bcmp(lladdr, &ln->ll_addr,
1574 ifp->if_addrlen);
1575 } else
1576 llchange = 0;
1577
1578 /*
1579 * newentry olladdr lladdr llchange (*=record)
1580 * 0 n n -- (1)
1581 * 0 y n -- (2)
1582 * 0 n y -- (3) * STALE
1583 * 0 y y n (4) *
1584 * 0 y y y (5) * STALE
1585 * 1 -- n -- (6) NOSTATE(= PASSIVE)
1586 * 1 -- y -- (7) * STALE
1587 */
1588
1589 if (lladdr) { /* (3-5) and (7) */
1590 /*
1591 * Record source link-layer address
1592 * XXX is it dependent to ifp->if_type?
1593 */
1594 bcopy(lladdr, &ln->ll_addr, ifp->if_addrlen);
1595 ln->la_flags |= LLE_VALID;
1596 }
1597
1598 if (!is_newentry) {
1599 if ((!olladdr && lladdr != NULL) || /* (3) */
1600 (olladdr && lladdr != NULL && llchange)) { /* (5) */
1601 do_update = 1;
1602 newstate = ND6_LLINFO_STALE;
1603 } else /* (1-2,4) */
1604 do_update = 0;
1605 } else {
1606 do_update = 1;
1607 if (lladdr == NULL) /* (6) */
1608 newstate = ND6_LLINFO_NOSTATE;
1609 else /* (7) */
1610 newstate = ND6_LLINFO_STALE;
1611 }
1612
1613 if (do_update) {
1614 /*
1615 * Update the state of the neighbor cache.
1616 */
1617 ln->ln_state = newstate;
1618
1619 if (ln->ln_state == ND6_LLINFO_STALE) {
1620 /*
1621 * XXX: since nd6_output() below will cause
1622 * state tansition to DELAY and reset the timer,
1623 * we must set the timer now, although it is actually
1624 * meaningless.
1625 */
1626 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
1627
1628 if (ln->la_hold) {
1629 struct mbuf *m_hold, *m_hold_next;
1630
1631 /*
1632 * reset the la_hold in advance, to explicitly
1633 * prevent a la_hold lookup in nd6_output()
1634 * (wouldn't happen, though...)
1635 */
1636 for (m_hold = ln->la_hold, ln->la_hold = NULL;
1637 m_hold; m_hold = m_hold_next) {
1638 m_hold_next = m_hold->m_nextpkt;
1639 m_hold->m_nextpkt = NULL;
1640
1641 /*
1642 * we assume ifp is not a p2p here, so
1643 * just set the 2nd argument as the
1644 * 1st one.
1645 */
1646 nd6_output_lle(ifp, ifp, m_hold, L3_ADDR_SIN6(ln), NULL, ln, &chain);
1647 }
1648 /*
1649 * If we have mbufs in the chain we need to do
1650 * deferred transmit. Copy the address from the
1651 * llentry before dropping the lock down below.
1652 */
1653 if (chain != NULL)
1654 memcpy(&sin6, L3_ADDR_SIN6(ln), sizeof(sin6));
1655 }
1656 } else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
1657 /* probe right away */
1658 nd6_llinfo_settimer_locked((void *)ln, 0);
1659 }
1660 }
1661
1662 /*
1663 * ICMP6 type dependent behavior.
1664 *
1665 * NS: clear IsRouter if new entry
1666 * RS: clear IsRouter
1667 * RA: set IsRouter if there's lladdr
1668 * redir: clear IsRouter if new entry
1669 *
1670 * RA case, (1):
1671 * The spec says that we must set IsRouter in the following cases:
1672 * - If lladdr exist, set IsRouter. This means (1-5).
1673 * - If it is old entry (!newentry), set IsRouter. This means (7).
1674 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
1675 * A quetion arises for (1) case. (1) case has no lladdr in the
1676 * neighbor cache, this is similar to (6).
1677 * This case is rare but we figured that we MUST NOT set IsRouter.
1678 *
1679 * newentry olladdr lladdr llchange NS RS RA redir
1680 * D R
1681 * 0 n n -- (1) c ? s
1682 * 0 y n -- (2) c s s
1683 * 0 n y -- (3) c s s
1684 * 0 y y n (4) c s s
1685 * 0 y y y (5) c s s
1686 * 1 -- n -- (6) c c c s
1687 * 1 -- y -- (7) c c s c s
1688 *
1689 * (c=clear s=set)
1690 */
1691 switch (type & 0xff) {
1692 case ND_NEIGHBOR_SOLICIT:
1693 /*
1694 * New entry must have is_router flag cleared.
1695 */
1696 if (is_newentry) /* (6-7) */
1697 ln->ln_router = 0;
1698 break;
1699 case ND_REDIRECT:
1700 /*
1701 * If the icmp is a redirect to a better router, always set the
1702 * is_router flag. Otherwise, if the entry is newly created,
1703 * clear the flag. [RFC 2461, sec 8.3]
1704 */
1705 if (code == ND_REDIRECT_ROUTER)
1706 ln->ln_router = 1;
1707 else if (is_newentry) /* (6-7) */
1708 ln->ln_router = 0;
1709 break;
1710 case ND_ROUTER_SOLICIT:
1711 /*
1712 * is_router flag must always be cleared.
1713 */
1714 ln->ln_router = 0;
1715 break;
1716 case ND_ROUTER_ADVERT:
1717 /*
1718 * Mark an entry with lladdr as a router.
1719 */
1720 if ((!is_newentry && (olladdr || lladdr)) || /* (2-5) */
1721 (is_newentry && lladdr)) { /* (7) */
1722 ln->ln_router = 1;
1723 }
1724 break;
1725 }
1726
1727 if (ln != NULL) {
1728 static_route = (ln->la_flags & LLE_STATIC);
1729 router = ln->ln_router;
1730
1731 if (flags & ND6_EXCLUSIVE)
1732 LLE_WUNLOCK(ln);
1733 else
1734 LLE_RUNLOCK(ln);
1735 if (static_route)
1736 ln = NULL;
1737 }
1738 if (chain)
1739 nd6_output_flush(ifp, ifp, chain, &sin6, NULL);
1740
1741 /*
1742 * When the link-layer address of a router changes, select the
1743 * best router again. In particular, when the neighbor entry is newly
1744 * created, it might affect the selection policy.
1745 * Question: can we restrict the first condition to the "is_newentry"
1746 * case?
1747 * XXX: when we hear an RA from a new router with the link-layer
1748 * address option, defrouter_select() is called twice, since
1749 * defrtrlist_update called the function as well. However, I believe
1750 * we can compromise the overhead, since it only happens the first
1751 * time.
1752 * XXX: although defrouter_select() should not have a bad effect
1753 * for those are not autoconfigured hosts, we explicitly avoid such
1754 * cases for safety.
1755 */
1756 if (do_update && router &&
1757 ND_IFINFO(ifp)->flags & ND6_IFF_ACCEPT_RTADV) {
1758 /*
1759 * guaranteed recursion
1760 */
1761 defrouter_select();
1762 }
1763
1764 return (ln);
1765 done:
1766 if (ln != NULL) {
1767 if (flags & ND6_EXCLUSIVE)
1768 LLE_WUNLOCK(ln);
1769 else
1770 LLE_RUNLOCK(ln);
1771 if (static_route)
1772 ln = NULL;
1773 }
1774 return (ln);
1775 }
1776
1777 static void
1778 nd6_slowtimo(void *arg)
1779 {
1780 CURVNET_SET((struct vnet *) arg);
1781 struct nd_ifinfo *nd6if;
1782 struct ifnet *ifp;
1783
1784 callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
1785 nd6_slowtimo, curvnet);
1786 IFNET_RLOCK_NOSLEEP();
1787 for (ifp = TAILQ_FIRST(&V_ifnet); ifp;
1788 ifp = TAILQ_NEXT(ifp, if_list)) {
1789 nd6if = ND_IFINFO(ifp);
1790 if (nd6if->basereachable && /* already initialized */
1791 (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
1792 /*
1793 * Since reachable time rarely changes by router
1794 * advertisements, we SHOULD insure that a new random
1795 * value gets recomputed at least once every few hours.
1796 * (RFC 2461, 6.3.4)
1797 */
1798 nd6if->recalctm = V_nd6_recalc_reachtm_interval;
1799 nd6if->reachable = ND_COMPUTE_RTIME(nd6if->basereachable);
1800 }
1801 }
1802 IFNET_RUNLOCK_NOSLEEP();
1803 CURVNET_RESTORE();
1804 }
1805
1806 int
1807 nd6_output(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
1808 struct sockaddr_in6 *dst, struct rtentry *rt0)
1809 {
1810
1811 return (nd6_output_lle(ifp, origifp, m0, dst, rt0, NULL, NULL));
1812 }
1813
1814
1815 /*
1816 * Note that I'm not enforcing any global serialization
1817 * lle state or asked changes here as the logic is too
1818 * complicated to avoid having to always acquire an exclusive
1819 * lock
1820 * KMM
1821 *
1822 */
1823 #define senderr(e) { error = (e); goto bad;}
1824
1825 int
1826 nd6_output_lle(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
1827 struct sockaddr_in6 *dst, struct rtentry *rt0, struct llentry *lle,
1828 struct mbuf **chain)
1829 {
1830 struct mbuf *m = m0;
1831 struct m_tag *mtag;
1832 struct llentry *ln = lle;
1833 struct ip6_hdr *ip6;
1834 int error = 0;
1835 int flags = 0;
1836 int ip6len;
1837
1838 #ifdef INVARIANTS
1839 if (lle != NULL) {
1840
1841 LLE_WLOCK_ASSERT(lle);
1842
1843 KASSERT(chain != NULL, (" lle locked but no mbuf chain pointer passed"));
1844 }
1845 #endif
1846 if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr))
1847 goto sendpkt;
1848
1849 if (nd6_need_cache(ifp) == 0)
1850 goto sendpkt;
1851
1852 /*
1853 * next hop determination. This routine is derived from ether_output.
1854 */
1855
1856 /*
1857 * Address resolution or Neighbor Unreachability Detection
1858 * for the next hop.
1859 * At this point, the destination of the packet must be a unicast
1860 * or an anycast address(i.e. not a multicast).
1861 */
1862
1863 flags = ((m != NULL) || (lle != NULL)) ? LLE_EXCLUSIVE : 0;
1864 if (ln == NULL) {
1865 retry:
1866 IF_AFDATA_LOCK(ifp);
1867 ln = lla_lookup(LLTABLE6(ifp), flags, (struct sockaddr *)dst);
1868 IF_AFDATA_UNLOCK(ifp);
1869 if ((ln == NULL) && nd6_is_addr_neighbor(dst, ifp)) {
1870 /*
1871 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
1872 * the condition below is not very efficient. But we believe
1873 * it is tolerable, because this should be a rare case.
1874 */
1875 flags = ND6_CREATE | (m ? ND6_EXCLUSIVE : 0);
1876 IF_AFDATA_LOCK(ifp);
1877 ln = nd6_lookup(&dst->sin6_addr, flags, ifp);
1878 IF_AFDATA_UNLOCK(ifp);
1879 }
1880 }
1881 if (ln == NULL) {
1882 if ((ifp->if_flags & IFF_POINTOPOINT) == 0 &&
1883 !(ND_IFINFO(ifp)->flags & ND6_IFF_PERFORMNUD)) {
1884 char ip6buf[INET6_ADDRSTRLEN];
1885 log(LOG_DEBUG,
1886 "nd6_output: can't allocate llinfo for %s "
1887 "(ln=%p)\n",
1888 ip6_sprintf(ip6buf, &dst->sin6_addr), ln);
1889 senderr(EIO); /* XXX: good error? */
1890 }
1891 goto sendpkt; /* send anyway */
1892 }
1893
1894 /* We don't have to do link-layer address resolution on a p2p link. */
1895 if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
1896 ln->ln_state < ND6_LLINFO_REACHABLE) {
1897 if ((flags & LLE_EXCLUSIVE) == 0) {
1898 flags |= LLE_EXCLUSIVE;
1899 goto retry;
1900 }
1901 ln->ln_state = ND6_LLINFO_STALE;
1902 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
1903 }
1904
1905 /*
1906 * The first time we send a packet to a neighbor whose entry is
1907 * STALE, we have to change the state to DELAY and a sets a timer to
1908 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
1909 * neighbor unreachability detection on expiration.
1910 * (RFC 2461 7.3.3)
1911 */
1912 if (ln->ln_state == ND6_LLINFO_STALE) {
1913 if ((flags & LLE_EXCLUSIVE) == 0) {
1914 flags |= LLE_EXCLUSIVE;
1915 LLE_RUNLOCK(ln);
1916 goto retry;
1917 }
1918 ln->la_asked = 0;
1919 ln->ln_state = ND6_LLINFO_DELAY;
1920 nd6_llinfo_settimer_locked(ln, (long)V_nd6_delay * hz);
1921 }
1922
1923 /*
1924 * If the neighbor cache entry has a state other than INCOMPLETE
1925 * (i.e. its link-layer address is already resolved), just
1926 * send the packet.
1927 */
1928 if (ln->ln_state > ND6_LLINFO_INCOMPLETE)
1929 goto sendpkt;
1930
1931 /*
1932 * There is a neighbor cache entry, but no ethernet address
1933 * response yet. Append this latest packet to the end of the
1934 * packet queue in the mbuf, unless the number of the packet
1935 * does not exceed nd6_maxqueuelen. When it exceeds nd6_maxqueuelen,
1936 * the oldest packet in the queue will be removed.
1937 */
1938 if (ln->ln_state == ND6_LLINFO_NOSTATE)
1939 ln->ln_state = ND6_LLINFO_INCOMPLETE;
1940
1941 if ((flags & LLE_EXCLUSIVE) == 0) {
1942 flags |= LLE_EXCLUSIVE;
1943 LLE_RUNLOCK(ln);
1944 goto retry;
1945 }
1946
1947 LLE_WLOCK_ASSERT(ln);
1948
1949 if (ln->la_hold) {
1950 struct mbuf *m_hold;
1951 int i;
1952
1953 i = 0;
1954 for (m_hold = ln->la_hold; m_hold; m_hold = m_hold->m_nextpkt) {
1955 i++;
1956 if (m_hold->m_nextpkt == NULL) {
1957 m_hold->m_nextpkt = m;
1958 break;
1959 }
1960 }
1961 while (i >= V_nd6_maxqueuelen) {
1962 m_hold = ln->la_hold;
1963 ln->la_hold = ln->la_hold->m_nextpkt;
1964 m_freem(m_hold);
1965 i--;
1966 }
1967 } else {
1968 ln->la_hold = m;
1969 }
1970
1971 /*
1972 * If there has been no NS for the neighbor after entering the
1973 * INCOMPLETE state, send the first solicitation.
1974 */
1975 if (!ND6_LLINFO_PERMANENT(ln) && ln->la_asked == 0) {
1976 ln->la_asked++;
1977
1978 nd6_llinfo_settimer_locked(ln,
1979 (long)ND_IFINFO(ifp)->retrans * hz / 1000);
1980 LLE_WUNLOCK(ln);
1981 nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, 0);
1982 if (lle != NULL && ln == lle)
1983 LLE_WLOCK(lle);
1984
1985 } else if (lle == NULL || ln != lle) {
1986 /*
1987 * We did the lookup (no lle arg) so we
1988 * need to do the unlock here.
1989 */
1990 LLE_WUNLOCK(ln);
1991 }
1992
1993 return (0);
1994
1995 sendpkt:
1996 /* discard the packet if IPv6 operation is disabled on the interface */
1997 if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) {
1998 error = ENETDOWN; /* better error? */
1999 goto bad;
2000 }
2001 /*
2002 * ln is valid and the caller did not pass in
2003 * an llentry
2004 */
2005 if ((ln != NULL) && (lle == NULL)) {
2006 if (flags & LLE_EXCLUSIVE)
2007 LLE_WUNLOCK(ln);
2008 else
2009 LLE_RUNLOCK(ln);
2010 }
2011
2012 #ifdef MAC
2013 mac_netinet6_nd6_send(ifp, m);
2014 #endif
2015
2016 /*
2017 * If called from nd6_ns_output() (NS), nd6_na_output() (NA),
2018 * icmp6_redirect_output() (REDIRECT) or from rip6_output() (RS, RA
2019 * as handled by rtsol and rtadvd), mbufs will be tagged for SeND
2020 * to be diverted to user space. When re-injected into the kernel,
2021 * send_output() will directly dispatch them to the outgoing interface.
2022 */
2023 if (send_sendso_input_hook != NULL) {
2024 mtag = m_tag_find(m, PACKET_TAG_ND_OUTGOING, NULL);
2025 if (mtag != NULL) {
2026 ip6 = mtod(m, struct ip6_hdr *);
2027 ip6len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
2028 /* Use the SEND socket */
2029 error = send_sendso_input_hook(m, ifp, SND_OUT,
2030 ip6len);
2031 /* -1 == no app on SEND socket */
2032 if (error == 0 || error != -1)
2033 return (error);
2034 }
2035 }
2036
2037 /*
2038 * We were passed in a pointer to an lle with the lock held
2039 * this means that we can't call if_output as we will
2040 * recurse on the lle lock - so what we do is we create
2041 * a list of mbufs to send and transmit them in the caller
2042 * after the lock is dropped
2043 */
2044 if (lle != NULL) {
2045 if (*chain == NULL)
2046 *chain = m;
2047 else {
2048 struct mbuf *mb;
2049
2050 /*
2051 * append mbuf to end of deferred chain
2052 */
2053 mb = *chain;
2054 while (mb->m_nextpkt != NULL)
2055 mb = mb->m_nextpkt;
2056 mb->m_nextpkt = m;
2057 }
2058 return (error);
2059 }
2060 if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
2061 return ((*ifp->if_output)(origifp, m, (struct sockaddr *)dst,
2062 NULL));
2063 }
2064 error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, NULL);
2065 return (error);
2066
2067 bad:
2068 /*
2069 * ln is valid and the caller did not pass in
2070 * an llentry
2071 */
2072 if ((ln != NULL) && (lle == NULL)) {
2073 if (flags & LLE_EXCLUSIVE)
2074 LLE_WUNLOCK(ln);
2075 else
2076 LLE_RUNLOCK(ln);
2077 }
2078 if (m)
2079 m_freem(m);
2080 return (error);
2081 }
2082 #undef senderr
2083
2084
2085 int
2086 nd6_output_flush(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *chain,
2087 struct sockaddr_in6 *dst, struct route *ro)
2088 {
2089 struct mbuf *m, *m_head;
2090 struct ifnet *outifp;
2091 int error = 0;
2092
2093 m_head = chain;
2094 if ((ifp->if_flags & IFF_LOOPBACK) != 0)
2095 outifp = origifp;
2096 else
2097 outifp = ifp;
2098
2099 while (m_head) {
2100 m = m_head;
2101 m_head = m_head->m_nextpkt;
2102 error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, ro);
2103 }
2104
2105 /*
2106 * XXX
2107 * note that intermediate errors are blindly ignored - but this is
2108 * the same convention as used with nd6_output when called by
2109 * nd6_cache_lladdr
2110 */
2111 return (error);
2112 }
2113
2114
2115 int
2116 nd6_need_cache(struct ifnet *ifp)
2117 {
2118 /*
2119 * XXX: we currently do not make neighbor cache on any interface
2120 * other than ARCnet, Ethernet, FDDI and GIF.
2121 *
2122 * RFC2893 says:
2123 * - unidirectional tunnels needs no ND
2124 */
2125 switch (ifp->if_type) {
2126 case IFT_ARCNET:
2127 case IFT_ETHER:
2128 case IFT_FDDI:
2129 case IFT_IEEE1394:
2130 #ifdef IFT_L2VLAN
2131 case IFT_L2VLAN:
2132 #endif
2133 #ifdef IFT_IEEE80211
2134 case IFT_IEEE80211:
2135 #endif
2136 #ifdef IFT_CARP
2137 case IFT_CARP:
2138 #endif
2139 case IFT_INFINIBAND:
2140 case IFT_GIF: /* XXX need more cases? */
2141 case IFT_PPP:
2142 case IFT_TUNNEL:
2143 case IFT_BRIDGE:
2144 case IFT_PROPVIRTUAL:
2145 return (1);
2146 default:
2147 return (0);
2148 }
2149 }
2150
2151 /*
2152 * the callers of this function need to be re-worked to drop
2153 * the lle lock, drop here for now
2154 */
2155 int
2156 nd6_storelladdr(struct ifnet *ifp, struct mbuf *m,
2157 struct sockaddr *dst, u_char *desten, struct llentry **lle)
2158 {
2159 struct llentry *ln;
2160
2161 *lle = NULL;
2162 IF_AFDATA_UNLOCK_ASSERT(ifp);
2163 if (m->m_flags & M_MCAST) {
2164 int i;
2165
2166 switch (ifp->if_type) {
2167 case IFT_ETHER:
2168 case IFT_FDDI:
2169 #ifdef IFT_L2VLAN
2170 case IFT_L2VLAN:
2171 #endif
2172 #ifdef IFT_IEEE80211
2173 case IFT_IEEE80211:
2174 #endif
2175 case IFT_BRIDGE:
2176 case IFT_ISO88025:
2177 ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr,
2178 desten);
2179 return (0);
2180 case IFT_IEEE1394:
2181 /*
2182 * netbsd can use if_broadcastaddr, but we don't do so
2183 * to reduce # of ifdef.
2184 */
2185 for (i = 0; i < ifp->if_addrlen; i++)
2186 desten[i] = ~0;
2187 return (0);
2188 case IFT_ARCNET:
2189 *desten = 0;
2190 return (0);
2191 default:
2192 m_freem(m);
2193 return (EAFNOSUPPORT);
2194 }
2195 }
2196
2197
2198 /*
2199 * the entry should have been created in nd6_store_lladdr
2200 */
2201 IF_AFDATA_LOCK(ifp);
2202 ln = lla_lookup(LLTABLE6(ifp), 0, dst);
2203 IF_AFDATA_UNLOCK(ifp);
2204 if ((ln == NULL) || !(ln->la_flags & LLE_VALID)) {
2205 if (ln != NULL)
2206 LLE_RUNLOCK(ln);
2207 /* this could happen, if we could not allocate memory */
2208 m_freem(m);
2209 return (1);
2210 }
2211
2212 bcopy(&ln->ll_addr, desten, ifp->if_addrlen);
2213 *lle = ln;
2214 LLE_RUNLOCK(ln);
2215 /*
2216 * A *small* use after free race exists here
2217 */
2218 return (0);
2219 }
2220
2221 static void
2222 clear_llinfo_pqueue(struct llentry *ln)
2223 {
2224 struct mbuf *m_hold, *m_hold_next;
2225
2226 for (m_hold = ln->la_hold; m_hold; m_hold = m_hold_next) {
2227 m_hold_next = m_hold->m_nextpkt;
2228 m_hold->m_nextpkt = NULL;
2229 m_freem(m_hold);
2230 }
2231
2232 ln->la_hold = NULL;
2233 return;
2234 }
2235
2236 static int nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS);
2237 static int nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS);
2238 #ifdef SYSCTL_DECL
2239 SYSCTL_DECL(_net_inet6_icmp6);
2240 #endif
2241 SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_DRLIST, nd6_drlist,
2242 CTLFLAG_RD, nd6_sysctl_drlist, "");
2243 SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_PRLIST, nd6_prlist,
2244 CTLFLAG_RD, nd6_sysctl_prlist, "");
2245 SYSCTL_VNET_INT(_net_inet6_icmp6, ICMPV6CTL_ND6_MAXQLEN, nd6_maxqueuelen,
2246 CTLFLAG_RW, &VNET_NAME(nd6_maxqueuelen), 1, "");
2247
2248 static int
2249 nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS)
2250 {
2251 int error;
2252 char buf[1024] __aligned(4);
2253 struct in6_defrouter *d, *de;
2254 struct nd_defrouter *dr;
2255
2256 if (req->newptr)
2257 return EPERM;
2258 error = 0;
2259
2260 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
2261 dr = TAILQ_NEXT(dr, dr_entry)) {
2262 d = (struct in6_defrouter *)buf;
2263 de = (struct in6_defrouter *)(buf + sizeof(buf));
2264
2265 if (d + 1 <= de) {
2266 bzero(d, sizeof(*d));
2267 d->rtaddr.sin6_family = AF_INET6;
2268 d->rtaddr.sin6_len = sizeof(d->rtaddr);
2269 d->rtaddr.sin6_addr = dr->rtaddr;
2270 error = sa6_recoverscope(&d->rtaddr);
2271 if (error != 0)
2272 return (error);
2273 d->flags = dr->flags;
2274 d->rtlifetime = dr->rtlifetime;
2275 d->expire = dr->expire;
2276 d->if_index = dr->ifp->if_index;
2277 } else
2278 panic("buffer too short");
2279
2280 error = SYSCTL_OUT(req, buf, sizeof(*d));
2281 if (error)
2282 break;
2283 }
2284
2285 return (error);
2286 }
2287
2288 static int
2289 nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS)
2290 {
2291 int error;
2292 char buf[1024] __aligned(4);
2293 struct in6_prefix *p, *pe;
2294 struct nd_prefix *pr;
2295 char ip6buf[INET6_ADDRSTRLEN];
2296
2297 if (req->newptr)
2298 return EPERM;
2299 error = 0;
2300
2301 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
2302 u_short advrtrs;
2303 size_t advance;
2304 struct sockaddr_in6 *sin6, *s6;
2305 struct nd_pfxrouter *pfr;
2306
2307 p = (struct in6_prefix *)buf;
2308 pe = (struct in6_prefix *)(buf + sizeof(buf));
2309
2310 if (p + 1 <= pe) {
2311 bzero(p, sizeof(*p));
2312 sin6 = (struct sockaddr_in6 *)(p + 1);
2313
2314 p->prefix = pr->ndpr_prefix;
2315 if (sa6_recoverscope(&p->prefix)) {
2316 log(LOG_ERR,
2317 "scope error in prefix list (%s)\n",
2318 ip6_sprintf(ip6buf, &p->prefix.sin6_addr));
2319 /* XXX: press on... */
2320 }
2321 p->raflags = pr->ndpr_raf;
2322 p->prefixlen = pr->ndpr_plen;
2323 p->vltime = pr->ndpr_vltime;
2324 p->pltime = pr->ndpr_pltime;
2325 p->if_index = pr->ndpr_ifp->if_index;
2326 if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
2327 p->expire = 0;
2328 else {
2329 time_t maxexpire;
2330
2331 /* XXX: we assume time_t is signed. */
2332 maxexpire = (-1) &
2333 ~((time_t)1 <<
2334 ((sizeof(maxexpire) * 8) - 1));
2335 if (pr->ndpr_vltime <
2336 maxexpire - pr->ndpr_lastupdate) {
2337 p->expire = pr->ndpr_lastupdate +
2338 pr->ndpr_vltime;
2339 } else
2340 p->expire = maxexpire;
2341 }
2342 p->refcnt = pr->ndpr_refcnt;
2343 p->flags = pr->ndpr_stateflags;
2344 p->origin = PR_ORIG_RA;
2345 advrtrs = 0;
2346 for (pfr = pr->ndpr_advrtrs.lh_first; pfr;
2347 pfr = pfr->pfr_next) {
2348 if ((void *)&sin6[advrtrs + 1] > (void *)pe) {
2349 advrtrs++;
2350 continue;
2351 }
2352 s6 = &sin6[advrtrs];
2353 bzero(s6, sizeof(*s6));
2354 s6->sin6_family = AF_INET6;
2355 s6->sin6_len = sizeof(*sin6);
2356 s6->sin6_addr = pfr->router->rtaddr;
2357 if (sa6_recoverscope(s6)) {
2358 log(LOG_ERR,
2359 "scope error in "
2360 "prefix list (%s)\n",
2361 ip6_sprintf(ip6buf,
2362 &pfr->router->rtaddr));
2363 }
2364 advrtrs++;
2365 }
2366 p->advrtrs = advrtrs;
2367 } else
2368 panic("buffer too short");
2369
2370 advance = sizeof(*p) + sizeof(*sin6) * advrtrs;
2371 error = SYSCTL_OUT(req, buf, advance);
2372 if (error)
2373 break;
2374 }
2375
2376 return (error);
2377 }
Cache object: 17c005100bd2d5e85a1340601240e27e
|