Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netinet6/nd6_nbr.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the project nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 * $KAME: nd6_nbr.c,v 1.86 2002/01/21 02:33:04 jinmei Exp $ 30 */ 31 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD$"); 34 35 #include "opt_inet.h" 36 #include "opt_inet6.h" 37 #include "opt_ipsec.h" 38 #include "opt_carp.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/malloc.h> 43 #include <sys/mbuf.h> 44 #include <sys/socket.h> 45 #include <sys/sockio.h> 46 #include <sys/time.h> 47 #include <sys/kernel.h> 48 #include <sys/errno.h> 49 #include <sys/syslog.h> 50 #include <sys/queue.h> 51 #include <sys/callout.h> 52 53 #include <net/if.h> 54 #include <net/if_types.h> 55 #include <net/if_dl.h> 56 #include <net/if_var.h> 57 #include <net/route.h> 58 59 #include <netinet/in.h> 60 #include <netinet/in_var.h> 61 #include <netinet6/in6_var.h> 62 #include <netinet6/in6_ifattach.h> 63 #include <netinet/ip6.h> 64 #include <netinet6/ip6_var.h> 65 #include <netinet6/scope6_var.h> 66 #include <netinet6/nd6.h> 67 #include <netinet/icmp6.h> 68 69 #ifdef DEV_CARP 70 #include <netinet/ip_carp.h> 71 #endif 72 73 #define SDL(s) ((struct sockaddr_dl *)s) 74 75 struct dadq; 76 static struct dadq *nd6_dad_find(struct ifaddr *); 77 static void nd6_dad_starttimer(struct dadq *, int); 78 static void nd6_dad_stoptimer(struct dadq *); 79 static void nd6_dad_timer(struct ifaddr *); 80 static void nd6_dad_ns_output(struct dadq *, struct ifaddr *); 81 static void nd6_dad_ns_input(struct ifaddr *); 82 static void nd6_dad_na_input(struct ifaddr *); 83 84 static int dad_ignore_ns = 0; /* ignore NS in DAD - specwise incorrect*/ 85 static int dad_maxtry = 15; /* max # of *tries* to transmit DAD packet */ 86 87 /* 88 * Input a Neighbor Solicitation Message. 89 * 90 * Based on RFC 2461 91 * Based on RFC 2462 (duplicate address detection) 92 */ 93 void 94 nd6_ns_input(struct mbuf *m, int off, int icmp6len) 95 { 96 struct ifnet *ifp = m->m_pkthdr.rcvif; 97 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 98 struct nd_neighbor_solicit *nd_ns; 99 struct in6_addr saddr6 = ip6->ip6_src; 100 struct in6_addr daddr6 = ip6->ip6_dst; 101 struct in6_addr taddr6; 102 struct in6_addr myaddr6; 103 char *lladdr = NULL; 104 struct ifaddr *ifa = NULL; 105 int lladdrlen = 0; 106 int anycast = 0, proxy = 0, tentative = 0; 107 int tlladdr; 108 union nd_opts ndopts; 109 struct sockaddr_dl proxydl; 110 char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN]; 111 112 #ifndef PULLDOWN_TEST 113 IP6_EXTHDR_CHECK(m, off, icmp6len,); 114 nd_ns = (struct nd_neighbor_solicit *)((caddr_t)ip6 + off); 115 #else 116 IP6_EXTHDR_GET(nd_ns, struct nd_neighbor_solicit *, m, off, icmp6len); 117 if (nd_ns == NULL) { 118 icmp6stat.icp6s_tooshort++; 119 return; 120 } 121 #endif 122 ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */ 123 taddr6 = nd_ns->nd_ns_target; 124 if (in6_setscope(&taddr6, ifp, NULL) != 0) 125 goto bad; 126 127 if (ip6->ip6_hlim != 255) { 128 nd6log((LOG_ERR, 129 "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n", 130 ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src), 131 ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp))); 132 goto bad; 133 } 134 135 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 136 /* dst has to be a solicited node multicast address. */ 137 if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL && 138 /* don't check ifindex portion */ 139 daddr6.s6_addr32[1] == 0 && 140 daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE && 141 daddr6.s6_addr8[12] == 0xff) { 142 ; /* good */ 143 } else { 144 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet " 145 "(wrong ip6 dst)\n")); 146 goto bad; 147 } 148 } else if (!nd6_onlink_ns_rfc4861) { 149 struct sockaddr_in6 src_sa6; 150 151 /* 152 * According to recent IETF discussions, it is not a good idea 153 * to accept a NS from an address which would not be deemed 154 * to be a neighbor otherwise. This point is expected to be 155 * clarified in future revisions of the specification. 156 */ 157 bzero(&src_sa6, sizeof(src_sa6)); 158 src_sa6.sin6_family = AF_INET6; 159 src_sa6.sin6_len = sizeof(src_sa6); 160 src_sa6.sin6_addr = saddr6; 161 if (!nd6_is_addr_neighbor(&src_sa6, ifp)) { 162 nd6log((LOG_INFO, "nd6_ns_input: " 163 "NS packet from non-neighbor\n")); 164 goto bad; 165 } 166 } 167 168 if (IN6_IS_ADDR_MULTICAST(&taddr6)) { 169 nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n")); 170 goto bad; 171 } 172 173 icmp6len -= sizeof(*nd_ns); 174 nd6_option_init(nd_ns + 1, icmp6len, &ndopts); 175 if (nd6_options(&ndopts) < 0) { 176 nd6log((LOG_INFO, 177 "nd6_ns_input: invalid ND option, ignored\n")); 178 /* nd6_options have incremented stats */ 179 goto freeit; 180 } 181 182 if (ndopts.nd_opts_src_lladdr) { 183 lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1); 184 lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3; 185 } 186 187 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) && lladdr) { 188 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet " 189 "(link-layer address option)\n")); 190 goto bad; 191 } 192 193 /* 194 * Attaching target link-layer address to the NA? 195 * (RFC 2461 7.2.4) 196 * 197 * NS IP dst is unicast/anycast MUST NOT add 198 * NS IP dst is solicited-node multicast MUST add 199 * 200 * In implementation, we add target link-layer address by default. 201 * We do not add one in MUST NOT cases. 202 */ 203 if (!IN6_IS_ADDR_MULTICAST(&daddr6)) 204 tlladdr = 0; 205 else 206 tlladdr = 1; 207 208 /* 209 * Target address (taddr6) must be either: 210 * (1) Valid unicast/anycast address for my receiving interface, 211 * (2) Unicast address for which I'm offering proxy service, or 212 * (3) "tentative" address on which DAD is being performed. 213 */ 214 /* (1) and (3) check. */ 215 #ifdef DEV_CARP 216 if (ifp->if_carp) 217 ifa = carp_iamatch6(ifp->if_carp, &taddr6); 218 if (ifa == NULL) 219 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 220 #else 221 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 222 #endif 223 224 /* (2) check. */ 225 if (ifa == NULL) { 226 struct rtentry *rt; 227 struct sockaddr_in6 tsin6; 228 int need_proxy; 229 230 bzero(&tsin6, sizeof tsin6); 231 tsin6.sin6_len = sizeof(struct sockaddr_in6); 232 tsin6.sin6_family = AF_INET6; 233 tsin6.sin6_addr = taddr6; 234 235 rt = rtalloc1((struct sockaddr *)&tsin6, 0, 0); 236 need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 && 237 rt->rt_gateway->sa_family == AF_LINK); 238 if (rt != NULL) { 239 /* 240 * Make a copy while we can be sure that rt_gateway 241 * is still stable before unlocking to avoid lock 242 * order problems. proxydl will only be used if 243 * proxy will be set in the next block. 244 */ 245 if (need_proxy) 246 proxydl = *SDL(rt->rt_gateway); 247 RTFREE_LOCKED(rt); 248 } 249 if (need_proxy) { 250 /* 251 * proxy NDP for single entry 252 */ 253 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 254 IN6_IFF_NOTREADY|IN6_IFF_ANYCAST); 255 if (ifa) 256 proxy = 1; 257 } 258 } 259 if (ifa == NULL) { 260 /* 261 * We've got an NS packet, and we don't have that adddress 262 * assigned for us. We MUST silently ignore it. 263 * See RFC2461 7.2.3. 264 */ 265 goto freeit; 266 } 267 myaddr6 = *IFA_IN6(ifa); 268 anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST; 269 tentative = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE; 270 if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED) 271 goto freeit; 272 273 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 274 nd6log((LOG_INFO, "nd6_ns_input: lladdrlen mismatch for %s " 275 "(if %d, NS packet %d)\n", 276 ip6_sprintf(ip6bufs, &taddr6), 277 ifp->if_addrlen, lladdrlen - 2)); 278 goto bad; 279 } 280 281 if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) { 282 nd6log((LOG_INFO, "nd6_ns_input: duplicate IP6 address %s\n", 283 ip6_sprintf(ip6bufs, &saddr6))); 284 goto freeit; 285 } 286 287 /* 288 * We have neighbor solicitation packet, with target address equals to 289 * one of my tentative address. 290 * 291 * src addr how to process? 292 * --- --- 293 * multicast of course, invalid (rejected in ip6_input) 294 * unicast somebody is doing address resolution -> ignore 295 * unspec dup address detection 296 * 297 * The processing is defined in RFC 2462. 298 */ 299 if (tentative) { 300 /* 301 * If source address is unspecified address, it is for 302 * duplicate address detection. 303 * 304 * If not, the packet is for addess resolution; 305 * silently ignore it. 306 */ 307 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) 308 nd6_dad_ns_input(ifa); 309 310 goto freeit; 311 } 312 313 /* 314 * If the source address is unspecified address, entries must not 315 * be created or updated. 316 * It looks that sender is performing DAD. Output NA toward 317 * all-node multicast address, to tell the sender that I'm using 318 * the address. 319 * S bit ("solicited") must be zero. 320 */ 321 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 322 struct in6_addr in6_all; 323 324 in6_all = in6addr_linklocal_allnodes; 325 if (in6_setscope(&in6_all, ifp, NULL) != 0) 326 goto bad; 327 nd6_na_output(ifp, &in6_all, &taddr6, 328 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) | 329 (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0), 330 tlladdr, proxy ? (struct sockaddr *)&proxydl : NULL); 331 goto freeit; 332 } 333 334 nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, 335 ND_NEIGHBOR_SOLICIT, 0); 336 337 nd6_na_output(ifp, &saddr6, &taddr6, 338 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) | 339 (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED, 340 tlladdr, proxy ? (struct sockaddr *)&proxydl : NULL); 341 freeit: 342 m_freem(m); 343 return; 344 345 bad: 346 nd6log((LOG_ERR, "nd6_ns_input: src=%s\n", 347 ip6_sprintf(ip6bufs, &saddr6))); 348 nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n", 349 ip6_sprintf(ip6bufs, &daddr6))); 350 nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n", 351 ip6_sprintf(ip6bufs, &taddr6))); 352 icmp6stat.icp6s_badns++; 353 m_freem(m); 354 } 355 356 /* 357 * Output a Neighbor Solicitation Message. Caller specifies: 358 * - ICMP6 header source IP6 address 359 * - ND6 header target IP6 address 360 * - ND6 header source datalink address 361 * 362 * Based on RFC 2461 363 * Based on RFC 2462 (duplicate address detection) 364 * 365 * ln - for source address determination 366 * dad - duplicate address detection 367 */ 368 void 369 nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6, 370 const struct in6_addr *taddr6, struct llinfo_nd6 *ln, int dad) 371 { 372 struct mbuf *m; 373 struct ip6_hdr *ip6; 374 struct nd_neighbor_solicit *nd_ns; 375 struct in6_addr *src, src_in; 376 struct ip6_moptions im6o; 377 int icmp6len; 378 int maxlen; 379 caddr_t mac; 380 struct route_in6 ro; 381 382 if (IN6_IS_ADDR_MULTICAST(taddr6)) 383 return; 384 385 /* estimate the size of message */ 386 maxlen = sizeof(*ip6) + sizeof(*nd_ns); 387 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; 388 if (max_linkhdr + maxlen >= MCLBYTES) { 389 #ifdef DIAGNOSTIC 390 printf("nd6_ns_output: max_linkhdr + maxlen >= MCLBYTES " 391 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES); 392 #endif 393 return; 394 } 395 396 MGETHDR(m, M_DONTWAIT, MT_DATA); 397 if (m && max_linkhdr + maxlen >= MHLEN) { 398 MCLGET(m, M_DONTWAIT); 399 if ((m->m_flags & M_EXT) == 0) { 400 m_free(m); 401 m = NULL; 402 } 403 } 404 if (m == NULL) 405 return; 406 m->m_pkthdr.rcvif = NULL; 407 408 bzero(&ro, sizeof(ro)); 409 410 if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) { 411 m->m_flags |= M_MCAST; 412 im6o.im6o_multicast_ifp = ifp; 413 im6o.im6o_multicast_hlim = 255; 414 im6o.im6o_multicast_loop = 0; 415 } 416 417 icmp6len = sizeof(*nd_ns); 418 m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len; 419 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ 420 421 /* fill neighbor solicitation packet */ 422 ip6 = mtod(m, struct ip6_hdr *); 423 ip6->ip6_flow = 0; 424 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 425 ip6->ip6_vfc |= IPV6_VERSION; 426 /* ip6->ip6_plen will be set later */ 427 ip6->ip6_nxt = IPPROTO_ICMPV6; 428 ip6->ip6_hlim = 255; 429 if (daddr6) 430 ip6->ip6_dst = *daddr6; 431 else { 432 ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL; 433 ip6->ip6_dst.s6_addr16[1] = 0; 434 ip6->ip6_dst.s6_addr32[1] = 0; 435 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE; 436 ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3]; 437 ip6->ip6_dst.s6_addr8[12] = 0xff; 438 if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0) 439 goto bad; 440 } 441 if (!dad) { 442 /* 443 * RFC2461 7.2.2: 444 * "If the source address of the packet prompting the 445 * solicitation is the same as one of the addresses assigned 446 * to the outgoing interface, that address SHOULD be placed 447 * in the IP Source Address of the outgoing solicitation. 448 * Otherwise, any one of the addresses assigned to the 449 * interface should be used." 450 * 451 * We use the source address for the prompting packet 452 * (saddr6), if: 453 * - saddr6 is given from the caller (by giving "ln"), and 454 * - saddr6 belongs to the outgoing interface. 455 * Otherwise, we perform the source address selection as usual. 456 */ 457 struct ip6_hdr *hip6; /* hold ip6 */ 458 struct in6_addr *hsrc = NULL; 459 460 if (ln && ln->ln_hold) { 461 /* 462 * assuming every packet in ln_hold has the same IP 463 * header 464 */ 465 hip6 = mtod(ln->ln_hold, struct ip6_hdr *); 466 /* XXX pullup? */ 467 if (sizeof(*hip6) < ln->ln_hold->m_len) 468 hsrc = &hip6->ip6_src; 469 else 470 hsrc = NULL; 471 } 472 if (hsrc && in6ifa_ifpwithaddr(ifp, hsrc)) 473 src = hsrc; 474 else { 475 int error; 476 struct sockaddr_in6 dst_sa; 477 478 bzero(&dst_sa, sizeof(dst_sa)); 479 dst_sa.sin6_family = AF_INET6; 480 dst_sa.sin6_len = sizeof(dst_sa); 481 dst_sa.sin6_addr = ip6->ip6_dst; 482 483 error = in6_selectsrc(&dst_sa, NULL, 484 NULL, &ro, NULL, NULL, &src_in); 485 if (error) { 486 char ip6buf[INET6_ADDRSTRLEN]; 487 nd6log((LOG_DEBUG, 488 "nd6_ns_output: source can't be " 489 "determined: dst=%s, error=%d\n", 490 ip6_sprintf(ip6buf, &dst_sa.sin6_addr), 491 error)); 492 goto bad; 493 } 494 src = &src_in; 495 } 496 } else { 497 /* 498 * Source address for DAD packet must always be IPv6 499 * unspecified address. (0::0) 500 * We actually don't have to 0-clear the address (we did it 501 * above), but we do so here explicitly to make the intention 502 * clearer. 503 */ 504 bzero(&src_in, sizeof(src_in)); 505 src = &src_in; 506 } 507 ip6->ip6_src = *src; 508 nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1); 509 nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT; 510 nd_ns->nd_ns_code = 0; 511 nd_ns->nd_ns_reserved = 0; 512 nd_ns->nd_ns_target = *taddr6; 513 in6_clearscope(&nd_ns->nd_ns_target); /* XXX */ 514 515 /* 516 * Add source link-layer address option. 517 * 518 * spec implementation 519 * --- --- 520 * DAD packet MUST NOT do not add the option 521 * there's no link layer address: 522 * impossible do not add the option 523 * there's link layer address: 524 * Multicast NS MUST add one add the option 525 * Unicast NS SHOULD add one add the option 526 */ 527 if (!dad && (mac = nd6_ifptomac(ifp))) { 528 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; 529 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1); 530 /* 8 byte alignments... */ 531 optlen = (optlen + 7) & ~7; 532 533 m->m_pkthdr.len += optlen; 534 m->m_len += optlen; 535 icmp6len += optlen; 536 bzero((caddr_t)nd_opt, optlen); 537 nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR; 538 nd_opt->nd_opt_len = optlen >> 3; 539 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen); 540 } 541 542 ip6->ip6_plen = htons((u_short)icmp6len); 543 nd_ns->nd_ns_cksum = 0; 544 nd_ns->nd_ns_cksum = 545 in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len); 546 547 ip6_output(m, NULL, &ro, dad ? IPV6_UNSPECSRC : 0, &im6o, NULL, NULL); 548 icmp6_ifstat_inc(ifp, ifs6_out_msg); 549 icmp6_ifstat_inc(ifp, ifs6_out_neighborsolicit); 550 icmp6stat.icp6s_outhist[ND_NEIGHBOR_SOLICIT]++; 551 552 if (ro.ro_rt) { /* we don't cache this route. */ 553 RTFREE(ro.ro_rt); 554 } 555 return; 556 557 bad: 558 if (ro.ro_rt) { 559 RTFREE(ro.ro_rt); 560 } 561 m_freem(m); 562 return; 563 } 564 565 /* 566 * Neighbor advertisement input handling. 567 * 568 * Based on RFC 2461 569 * Based on RFC 2462 (duplicate address detection) 570 * 571 * the following items are not implemented yet: 572 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) 573 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) 574 */ 575 void 576 nd6_na_input(struct mbuf *m, int off, int icmp6len) 577 { 578 struct ifnet *ifp = m->m_pkthdr.rcvif; 579 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 580 struct nd_neighbor_advert *nd_na; 581 struct in6_addr daddr6 = ip6->ip6_dst; 582 struct in6_addr taddr6; 583 int flags; 584 int is_router; 585 int is_solicited; 586 int is_override; 587 char *lladdr = NULL; 588 int lladdrlen = 0; 589 struct ifaddr *ifa; 590 struct llinfo_nd6 *ln; 591 struct rtentry *rt; 592 struct sockaddr_dl *sdl; 593 union nd_opts ndopts; 594 char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN]; 595 596 if (ip6->ip6_hlim != 255) { 597 nd6log((LOG_ERR, 598 "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n", 599 ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src), 600 ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp))); 601 goto bad; 602 } 603 604 #ifndef PULLDOWN_TEST 605 IP6_EXTHDR_CHECK(m, off, icmp6len,); 606 nd_na = (struct nd_neighbor_advert *)((caddr_t)ip6 + off); 607 #else 608 IP6_EXTHDR_GET(nd_na, struct nd_neighbor_advert *, m, off, icmp6len); 609 if (nd_na == NULL) { 610 icmp6stat.icp6s_tooshort++; 611 return; 612 } 613 #endif 614 615 flags = nd_na->nd_na_flags_reserved; 616 is_router = ((flags & ND_NA_FLAG_ROUTER) != 0); 617 is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0); 618 is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0); 619 620 taddr6 = nd_na->nd_na_target; 621 if (in6_setscope(&taddr6, ifp, NULL)) 622 goto bad; /* XXX: impossible */ 623 624 if (IN6_IS_ADDR_MULTICAST(&taddr6)) { 625 nd6log((LOG_ERR, 626 "nd6_na_input: invalid target address %s\n", 627 ip6_sprintf(ip6bufs, &taddr6))); 628 goto bad; 629 } 630 if (IN6_IS_ADDR_MULTICAST(&daddr6)) 631 if (is_solicited) { 632 nd6log((LOG_ERR, 633 "nd6_na_input: a solicited adv is multicasted\n")); 634 goto bad; 635 } 636 637 icmp6len -= sizeof(*nd_na); 638 nd6_option_init(nd_na + 1, icmp6len, &ndopts); 639 if (nd6_options(&ndopts) < 0) { 640 nd6log((LOG_INFO, 641 "nd6_na_input: invalid ND option, ignored\n")); 642 /* nd6_options have incremented stats */ 643 goto freeit; 644 } 645 646 if (ndopts.nd_opts_tgt_lladdr) { 647 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1); 648 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3; 649 } 650 651 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 652 653 /* 654 * Target address matches one of my interface address. 655 * 656 * If my address is tentative, this means that there's somebody 657 * already using the same address as mine. This indicates DAD failure. 658 * This is defined in RFC 2462. 659 * 660 * Otherwise, process as defined in RFC 2461. 661 */ 662 if (ifa 663 && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) { 664 nd6_dad_na_input(ifa); 665 goto freeit; 666 } 667 668 /* Just for safety, maybe unnecessary. */ 669 if (ifa) { 670 log(LOG_ERR, 671 "nd6_na_input: duplicate IP6 address %s\n", 672 ip6_sprintf(ip6bufs, &taddr6)); 673 goto freeit; 674 } 675 676 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 677 nd6log((LOG_INFO, "nd6_na_input: lladdrlen mismatch for %s " 678 "(if %d, NA packet %d)\n", ip6_sprintf(ip6bufs, &taddr6), 679 ifp->if_addrlen, lladdrlen - 2)); 680 goto bad; 681 } 682 683 /* 684 * If no neighbor cache entry is found, NA SHOULD silently be 685 * discarded. 686 */ 687 rt = nd6_lookup(&taddr6, 0, ifp); 688 if ((rt == NULL) || 689 ((ln = (struct llinfo_nd6 *)rt->rt_llinfo) == NULL) || 690 ((sdl = SDL(rt->rt_gateway)) == NULL)) 691 goto freeit; 692 693 if (ln->ln_state == ND6_LLINFO_INCOMPLETE) { 694 /* 695 * If the link-layer has address, and no lladdr option came, 696 * discard the packet. 697 */ 698 if (ifp->if_addrlen && lladdr == NULL) 699 goto freeit; 700 701 /* 702 * Record link-layer address, and update the state. 703 */ 704 sdl->sdl_alen = ifp->if_addrlen; 705 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); 706 if (is_solicited) { 707 ln->ln_state = ND6_LLINFO_REACHABLE; 708 ln->ln_byhint = 0; 709 if (!ND6_LLINFO_PERMANENT(ln)) { 710 nd6_llinfo_settimer(ln, 711 (long)ND_IFINFO(rt->rt_ifp)->reachable * hz); 712 } 713 } else { 714 ln->ln_state = ND6_LLINFO_STALE; 715 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 716 } 717 if ((ln->ln_router = is_router) != 0) { 718 /* 719 * This means a router's state has changed from 720 * non-reachable to probably reachable, and might 721 * affect the status of associated prefixes.. 722 */ 723 pfxlist_onlink_check(); 724 } 725 } else { 726 int llchange; 727 728 /* 729 * Check if the link-layer address has changed or not. 730 */ 731 if (lladdr == NULL) 732 llchange = 0; 733 else { 734 if (sdl->sdl_alen) { 735 if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen)) 736 llchange = 1; 737 else 738 llchange = 0; 739 } else 740 llchange = 1; 741 } 742 743 /* 744 * This is VERY complex. Look at it with care. 745 * 746 * override solicit lladdr llchange action 747 * (L: record lladdr) 748 * 749 * 0 0 n -- (2c) 750 * 0 0 y n (2b) L 751 * 0 0 y y (1) REACHABLE->STALE 752 * 0 1 n -- (2c) *->REACHABLE 753 * 0 1 y n (2b) L *->REACHABLE 754 * 0 1 y y (1) REACHABLE->STALE 755 * 1 0 n -- (2a) 756 * 1 0 y n (2a) L 757 * 1 0 y y (2a) L *->STALE 758 * 1 1 n -- (2a) *->REACHABLE 759 * 1 1 y n (2a) L *->REACHABLE 760 * 1 1 y y (2a) L *->REACHABLE 761 */ 762 if (!is_override && (lladdr != NULL && llchange)) { /* (1) */ 763 /* 764 * If state is REACHABLE, make it STALE. 765 * no other updates should be done. 766 */ 767 if (ln->ln_state == ND6_LLINFO_REACHABLE) { 768 ln->ln_state = ND6_LLINFO_STALE; 769 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 770 } 771 goto freeit; 772 } else if (is_override /* (2a) */ 773 || (!is_override && (lladdr != NULL && !llchange)) /* (2b) */ 774 || lladdr == NULL) { /* (2c) */ 775 /* 776 * Update link-local address, if any. 777 */ 778 if (lladdr != NULL) { 779 sdl->sdl_alen = ifp->if_addrlen; 780 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); 781 } 782 783 /* 784 * If solicited, make the state REACHABLE. 785 * If not solicited and the link-layer address was 786 * changed, make it STALE. 787 */ 788 if (is_solicited) { 789 ln->ln_state = ND6_LLINFO_REACHABLE; 790 ln->ln_byhint = 0; 791 if (!ND6_LLINFO_PERMANENT(ln)) { 792 nd6_llinfo_settimer(ln, 793 (long)ND_IFINFO(ifp)->reachable * hz); 794 } 795 } else { 796 if (lladdr != NULL && llchange) { 797 ln->ln_state = ND6_LLINFO_STALE; 798 nd6_llinfo_settimer(ln, 799 (long)nd6_gctimer * hz); 800 } 801 } 802 } 803 804 if (ln->ln_router && !is_router) { 805 /* 806 * The peer dropped the router flag. 807 * Remove the sender from the Default Router List and 808 * update the Destination Cache entries. 809 */ 810 struct nd_defrouter *dr; 811 struct in6_addr *in6; 812 int s; 813 814 in6 = &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr; 815 816 /* 817 * Lock to protect the default router list. 818 * XXX: this might be unnecessary, since this function 819 * is only called under the network software interrupt 820 * context. However, we keep it just for safety. 821 */ 822 s = splnet(); 823 dr = defrouter_lookup(in6, ifp); 824 if (dr) 825 defrtrlist_del(dr); 826 else if (!ip6_forwarding) { 827 /* 828 * Even if the neighbor is not in the default 829 * router list, the neighbor may be used 830 * as a next hop for some destinations 831 * (e.g. redirect case). So we must 832 * call rt6_flush explicitly. 833 */ 834 rt6_flush(&ip6->ip6_src, ifp); 835 } 836 splx(s); 837 } 838 ln->ln_router = is_router; 839 } 840 rt->rt_flags &= ~RTF_REJECT; 841 ln->ln_asked = 0; 842 if (ln->ln_hold) { 843 struct mbuf *m_hold, *m_hold_next; 844 845 /* 846 * reset the ln_hold in advance, to explicitly 847 * prevent a ln_hold lookup in nd6_output() 848 * (wouldn't happen, though...) 849 */ 850 for (m_hold = ln->ln_hold; 851 m_hold; m_hold = m_hold_next) { 852 m_hold_next = m_hold->m_nextpkt; 853 m_hold->m_nextpkt = NULL; 854 /* 855 * we assume ifp is not a loopback here, so just set 856 * the 2nd argument as the 1st one. 857 */ 858 nd6_output(ifp, ifp, m_hold, 859 (struct sockaddr_in6 *)rt_key(rt), rt); 860 } 861 ln->ln_hold = NULL; 862 } 863 864 freeit: 865 m_freem(m); 866 return; 867 868 bad: 869 icmp6stat.icp6s_badna++; 870 m_freem(m); 871 } 872 873 /* 874 * Neighbor advertisement output handling. 875 * 876 * Based on RFC 2461 877 * 878 * the following items are not implemented yet: 879 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) 880 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) 881 * 882 * tlladdr - 1 if include target link-layer address 883 * sdl0 - sockaddr_dl (= proxy NA) or NULL 884 */ 885 void 886 nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6_0, 887 const struct in6_addr *taddr6, u_long flags, int tlladdr, 888 struct sockaddr *sdl0) 889 { 890 struct mbuf *m; 891 struct ip6_hdr *ip6; 892 struct nd_neighbor_advert *nd_na; 893 struct ip6_moptions im6o; 894 struct in6_addr src, daddr6; 895 struct sockaddr_in6 dst_sa; 896 int icmp6len, maxlen, error; 897 caddr_t mac = NULL; 898 struct route_in6 ro; 899 900 bzero(&ro, sizeof(ro)); 901 902 daddr6 = *daddr6_0; /* make a local copy for modification */ 903 904 /* estimate the size of message */ 905 maxlen = sizeof(*ip6) + sizeof(*nd_na); 906 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; 907 if (max_linkhdr + maxlen >= MCLBYTES) { 908 #ifdef DIAGNOSTIC 909 printf("nd6_na_output: max_linkhdr + maxlen >= MCLBYTES " 910 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES); 911 #endif 912 return; 913 } 914 915 MGETHDR(m, M_DONTWAIT, MT_DATA); 916 if (m && max_linkhdr + maxlen >= MHLEN) { 917 MCLGET(m, M_DONTWAIT); 918 if ((m->m_flags & M_EXT) == 0) { 919 m_free(m); 920 m = NULL; 921 } 922 } 923 if (m == NULL) 924 return; 925 m->m_pkthdr.rcvif = NULL; 926 927 if (IN6_IS_ADDR_MULTICAST(&daddr6)) { 928 m->m_flags |= M_MCAST; 929 im6o.im6o_multicast_ifp = ifp; 930 im6o.im6o_multicast_hlim = 255; 931 im6o.im6o_multicast_loop = 0; 932 } 933 934 icmp6len = sizeof(*nd_na); 935 m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len; 936 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ 937 938 /* fill neighbor advertisement packet */ 939 ip6 = mtod(m, struct ip6_hdr *); 940 ip6->ip6_flow = 0; 941 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 942 ip6->ip6_vfc |= IPV6_VERSION; 943 ip6->ip6_nxt = IPPROTO_ICMPV6; 944 ip6->ip6_hlim = 255; 945 if (IN6_IS_ADDR_UNSPECIFIED(&daddr6)) { 946 /* reply to DAD */ 947 daddr6.s6_addr16[0] = IPV6_ADDR_INT16_MLL; 948 daddr6.s6_addr16[1] = 0; 949 daddr6.s6_addr32[1] = 0; 950 daddr6.s6_addr32[2] = 0; 951 daddr6.s6_addr32[3] = IPV6_ADDR_INT32_ONE; 952 if (in6_setscope(&daddr6, ifp, NULL)) 953 goto bad; 954 955 flags &= ~ND_NA_FLAG_SOLICITED; 956 } 957 ip6->ip6_dst = daddr6; 958 bzero(&dst_sa, sizeof(struct sockaddr_in6)); 959 dst_sa.sin6_family = AF_INET6; 960 dst_sa.sin6_len = sizeof(struct sockaddr_in6); 961 dst_sa.sin6_addr = daddr6; 962 963 /* 964 * Select a source whose scope is the same as that of the dest. 965 */ 966 bcopy(&dst_sa, &ro.ro_dst, sizeof(dst_sa)); 967 error = in6_selectsrc(&dst_sa, NULL, NULL, &ro, NULL, NULL, &src); 968 if (error) { 969 char ip6buf[INET6_ADDRSTRLEN]; 970 nd6log((LOG_DEBUG, "nd6_na_output: source can't be " 971 "determined: dst=%s, error=%d\n", 972 ip6_sprintf(ip6buf, &dst_sa.sin6_addr), error)); 973 goto bad; 974 } 975 ip6->ip6_src = src; 976 nd_na = (struct nd_neighbor_advert *)(ip6 + 1); 977 nd_na->nd_na_type = ND_NEIGHBOR_ADVERT; 978 nd_na->nd_na_code = 0; 979 nd_na->nd_na_target = *taddr6; 980 in6_clearscope(&nd_na->nd_na_target); /* XXX */ 981 982 /* 983 * "tlladdr" indicates NS's condition for adding tlladdr or not. 984 * see nd6_ns_input() for details. 985 * Basically, if NS packet is sent to unicast/anycast addr, 986 * target lladdr option SHOULD NOT be included. 987 */ 988 if (tlladdr) { 989 /* 990 * sdl0 != NULL indicates proxy NA. If we do proxy, use 991 * lladdr in sdl0. If we are not proxying (sending NA for 992 * my address) use lladdr configured for the interface. 993 */ 994 if (sdl0 == NULL) { 995 #ifdef DEV_CARP 996 if (ifp->if_carp) 997 mac = carp_macmatch6(ifp->if_carp, m, taddr6); 998 if (mac == NULL) 999 mac = nd6_ifptomac(ifp); 1000 #else 1001 mac = nd6_ifptomac(ifp); 1002 #endif 1003 } else if (sdl0->sa_family == AF_LINK) { 1004 struct sockaddr_dl *sdl; 1005 sdl = (struct sockaddr_dl *)sdl0; 1006 if (sdl->sdl_alen == ifp->if_addrlen) 1007 mac = LLADDR(sdl); 1008 } 1009 } 1010 if (tlladdr && mac) { 1011 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; 1012 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1); 1013 1014 /* roundup to 8 bytes alignment! */ 1015 optlen = (optlen + 7) & ~7; 1016 1017 m->m_pkthdr.len += optlen; 1018 m->m_len += optlen; 1019 icmp6len += optlen; 1020 bzero((caddr_t)nd_opt, optlen); 1021 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR; 1022 nd_opt->nd_opt_len = optlen >> 3; 1023 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen); 1024 } else 1025 flags &= ~ND_NA_FLAG_OVERRIDE; 1026 1027 ip6->ip6_plen = htons((u_short)icmp6len); 1028 nd_na->nd_na_flags_reserved = flags; 1029 nd_na->nd_na_cksum = 0; 1030 nd_na->nd_na_cksum = 1031 in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len); 1032 1033 ip6_output(m, NULL, &ro, 0, &im6o, NULL, NULL); 1034 icmp6_ifstat_inc(ifp, ifs6_out_msg); 1035 icmp6_ifstat_inc(ifp, ifs6_out_neighboradvert); 1036 icmp6stat.icp6s_outhist[ND_NEIGHBOR_ADVERT]++; 1037 1038 if (ro.ro_rt) { /* we don't cache this route. */ 1039 RTFREE(ro.ro_rt); 1040 } 1041 return; 1042 1043 bad: 1044 if (ro.ro_rt) { 1045 RTFREE(ro.ro_rt); 1046 } 1047 m_freem(m); 1048 return; 1049 } 1050 1051 caddr_t 1052 nd6_ifptomac(struct ifnet *ifp) 1053 { 1054 switch (ifp->if_type) { 1055 case IFT_ARCNET: 1056 case IFT_ETHER: 1057 case IFT_FDDI: 1058 case IFT_IEEE1394: 1059 #ifdef IFT_L2VLAN 1060 case IFT_L2VLAN: 1061 #endif 1062 #ifdef IFT_IEEE80211 1063 case IFT_IEEE80211: 1064 #endif 1065 #ifdef IFT_CARP 1066 case IFT_CARP: 1067 #endif 1068 case IFT_BRIDGE: 1069 case IFT_ISO88025: 1070 return IF_LLADDR(ifp); 1071 default: 1072 return NULL; 1073 } 1074 } 1075 1076 TAILQ_HEAD(dadq_head, dadq); 1077 struct dadq { 1078 TAILQ_ENTRY(dadq) dad_list; 1079 struct ifaddr *dad_ifa; 1080 int dad_count; /* max NS to send */ 1081 int dad_ns_tcount; /* # of trials to send NS */ 1082 int dad_ns_ocount; /* NS sent so far */ 1083 int dad_ns_icount; 1084 int dad_na_icount; 1085 struct callout dad_timer_ch; 1086 }; 1087 1088 static struct dadq_head dadq; 1089 static int dad_init = 0; 1090 1091 static struct dadq * 1092 nd6_dad_find(struct ifaddr *ifa) 1093 { 1094 struct dadq *dp; 1095 1096 for (dp = dadq.tqh_first; dp; dp = dp->dad_list.tqe_next) { 1097 if (dp->dad_ifa == ifa) 1098 return dp; 1099 } 1100 return NULL; 1101 } 1102 1103 static void 1104 nd6_dad_starttimer(struct dadq *dp, int ticks) 1105 { 1106 1107 callout_reset(&dp->dad_timer_ch, ticks, 1108 (void (*)(void *))nd6_dad_timer, (void *)dp->dad_ifa); 1109 } 1110 1111 static void 1112 nd6_dad_stoptimer(struct dadq *dp) 1113 { 1114 1115 callout_stop(&dp->dad_timer_ch); 1116 } 1117 1118 /* 1119 * Start Duplicate Address Detection (DAD) for specified interface address. 1120 */ 1121 void 1122 nd6_dad_start(struct ifaddr *ifa, int delay) 1123 { 1124 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1125 struct dadq *dp; 1126 char ip6buf[INET6_ADDRSTRLEN]; 1127 1128 if (!dad_init) { 1129 TAILQ_INIT(&dadq); 1130 dad_init++; 1131 } 1132 1133 /* 1134 * If we don't need DAD, don't do it. 1135 * There are several cases: 1136 * - DAD is disabled (ip6_dad_count == 0) 1137 * - the interface address is anycast 1138 */ 1139 if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) { 1140 log(LOG_DEBUG, 1141 "nd6_dad_start: called with non-tentative address " 1142 "%s(%s)\n", 1143 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr), 1144 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1145 return; 1146 } 1147 if (ia->ia6_flags & IN6_IFF_ANYCAST) { 1148 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1149 return; 1150 } 1151 if (!ip6_dad_count) { 1152 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1153 return; 1154 } 1155 if (ifa->ifa_ifp == NULL) 1156 panic("nd6_dad_start: ifa->ifa_ifp == NULL"); 1157 if (!(ifa->ifa_ifp->if_flags & IFF_UP)) { 1158 return; 1159 } 1160 if (nd6_dad_find(ifa) != NULL) { 1161 /* DAD already in progress */ 1162 return; 1163 } 1164 1165 dp = malloc(sizeof(*dp), M_IP6NDP, M_NOWAIT); 1166 if (dp == NULL) { 1167 log(LOG_ERR, "nd6_dad_start: memory allocation failed for " 1168 "%s(%s)\n", 1169 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr), 1170 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1171 return; 1172 } 1173 bzero(dp, sizeof(*dp)); 1174 callout_init(&dp->dad_timer_ch, 0); 1175 TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list); 1176 1177 nd6log((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp), 1178 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr))); 1179 1180 /* 1181 * Send NS packet for DAD, ip6_dad_count times. 1182 * Note that we must delay the first transmission, if this is the 1183 * first packet to be sent from the interface after interface 1184 * (re)initialization. 1185 */ 1186 dp->dad_ifa = ifa; 1187 IFAREF(ifa); /* just for safety */ 1188 dp->dad_count = ip6_dad_count; 1189 dp->dad_ns_icount = dp->dad_na_icount = 0; 1190 dp->dad_ns_ocount = dp->dad_ns_tcount = 0; 1191 if (delay == 0) { 1192 nd6_dad_ns_output(dp, ifa); 1193 nd6_dad_starttimer(dp, 1194 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000); 1195 } else { 1196 nd6_dad_starttimer(dp, delay); 1197 } 1198 } 1199 1200 /* 1201 * terminate DAD unconditionally. used for address removals. 1202 */ 1203 void 1204 nd6_dad_stop(struct ifaddr *ifa) 1205 { 1206 struct dadq *dp; 1207 1208 if (!dad_init) 1209 return; 1210 dp = nd6_dad_find(ifa); 1211 if (!dp) { 1212 /* DAD wasn't started yet */ 1213 return; 1214 } 1215 1216 nd6_dad_stoptimer(dp); 1217 1218 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1219 free(dp, M_IP6NDP); 1220 dp = NULL; 1221 IFAFREE(ifa); 1222 } 1223 1224 static void 1225 nd6_dad_timer(struct ifaddr *ifa) 1226 { 1227 int s; 1228 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1229 struct dadq *dp; 1230 char ip6buf[INET6_ADDRSTRLEN]; 1231 1232 s = splnet(); /* XXX */ 1233 1234 /* Sanity check */ 1235 if (ia == NULL) { 1236 log(LOG_ERR, "nd6_dad_timer: called with null parameter\n"); 1237 goto done; 1238 } 1239 dp = nd6_dad_find(ifa); 1240 if (dp == NULL) { 1241 log(LOG_ERR, "nd6_dad_timer: DAD structure not found\n"); 1242 goto done; 1243 } 1244 if (ia->ia6_flags & IN6_IFF_DUPLICATED) { 1245 log(LOG_ERR, "nd6_dad_timer: called with duplicated address " 1246 "%s(%s)\n", 1247 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr), 1248 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1249 goto done; 1250 } 1251 if ((ia->ia6_flags & IN6_IFF_TENTATIVE) == 0) { 1252 log(LOG_ERR, "nd6_dad_timer: called with non-tentative address " 1253 "%s(%s)\n", 1254 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr), 1255 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1256 goto done; 1257 } 1258 1259 /* timeouted with IFF_{RUNNING,UP} check */ 1260 if (dp->dad_ns_tcount > dad_maxtry) { 1261 nd6log((LOG_INFO, "%s: could not run DAD, driver problem?\n", 1262 if_name(ifa->ifa_ifp))); 1263 1264 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1265 free(dp, M_IP6NDP); 1266 dp = NULL; 1267 IFAFREE(ifa); 1268 goto done; 1269 } 1270 1271 /* Need more checks? */ 1272 if (dp->dad_ns_ocount < dp->dad_count) { 1273 /* 1274 * We have more NS to go. Send NS packet for DAD. 1275 */ 1276 nd6_dad_ns_output(dp, ifa); 1277 nd6_dad_starttimer(dp, 1278 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000); 1279 } else { 1280 /* 1281 * We have transmitted sufficient number of DAD packets. 1282 * See what we've got. 1283 */ 1284 int duplicate; 1285 1286 duplicate = 0; 1287 1288 if (dp->dad_na_icount) { 1289 /* 1290 * the check is in nd6_dad_na_input(), 1291 * but just in case 1292 */ 1293 duplicate++; 1294 } 1295 1296 if (dp->dad_ns_icount) { 1297 /* We've seen NS, means DAD has failed. */ 1298 duplicate++; 1299 } 1300 1301 if (duplicate) { 1302 /* (*dp) will be freed in nd6_dad_duplicated() */ 1303 dp = NULL; 1304 nd6_dad_duplicated(ifa); 1305 } else { 1306 /* 1307 * We are done with DAD. No NA came, no NS came. 1308 * No duplicate address found. 1309 */ 1310 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1311 1312 nd6log((LOG_DEBUG, 1313 "%s: DAD complete for %s - no duplicates found\n", 1314 if_name(ifa->ifa_ifp), 1315 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr))); 1316 1317 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1318 free(dp, M_IP6NDP); 1319 dp = NULL; 1320 IFAFREE(ifa); 1321 } 1322 } 1323 1324 done: 1325 splx(s); 1326 } 1327 1328 void 1329 nd6_dad_duplicated(struct ifaddr *ifa) 1330 { 1331 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1332 struct ifnet *ifp; 1333 struct dadq *dp; 1334 char ip6buf[INET6_ADDRSTRLEN]; 1335 1336 dp = nd6_dad_find(ifa); 1337 if (dp == NULL) { 1338 log(LOG_ERR, "nd6_dad_duplicated: DAD structure not found\n"); 1339 return; 1340 } 1341 1342 log(LOG_ERR, "%s: DAD detected duplicate IPv6 address %s: " 1343 "NS in/out=%d/%d, NA in=%d\n", 1344 if_name(ifa->ifa_ifp), ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr), 1345 dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_na_icount); 1346 1347 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1348 ia->ia6_flags |= IN6_IFF_DUPLICATED; 1349 1350 /* We are done with DAD, with duplicate address found. (failure) */ 1351 nd6_dad_stoptimer(dp); 1352 1353 ifp = ifa->ifa_ifp; 1354 log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n", 1355 if_name(ifp), ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr)); 1356 log(LOG_ERR, "%s: manual intervention required\n", 1357 if_name(ifp)); 1358 1359 /* 1360 * If the address is a link-local address formed from an interface 1361 * identifier based on the hardware address which is supposed to be 1362 * uniquely assigned (e.g., EUI-64 for an Ethernet interface), IP 1363 * operation on the interface SHOULD be disabled. 1364 * [rfc2462bis-03 Section 5.4.5] 1365 */ 1366 if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr)) { 1367 struct in6_addr in6; 1368 1369 /* 1370 * To avoid over-reaction, we only apply this logic when we are 1371 * very sure that hardware addresses are supposed to be unique. 1372 */ 1373 switch (ifp->if_type) { 1374 case IFT_ETHER: 1375 case IFT_FDDI: 1376 case IFT_ATM: 1377 case IFT_IEEE1394: 1378 #ifdef IFT_IEEE80211 1379 case IFT_IEEE80211: 1380 #endif 1381 in6 = ia->ia_addr.sin6_addr; 1382 if (in6_get_hw_ifid(ifp, &in6) == 0 && 1383 IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) { 1384 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED; 1385 log(LOG_ERR, "%s: possible hardware address " 1386 "duplication detected, disable IPv6\n", 1387 if_name(ifp)); 1388 } 1389 break; 1390 } 1391 } 1392 1393 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1394 free(dp, M_IP6NDP); 1395 dp = NULL; 1396 IFAFREE(ifa); 1397 } 1398 1399 static void 1400 nd6_dad_ns_output(struct dadq *dp, struct ifaddr *ifa) 1401 { 1402 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1403 struct ifnet *ifp = ifa->ifa_ifp; 1404 1405 dp->dad_ns_tcount++; 1406 if ((ifp->if_flags & IFF_UP) == 0) { 1407 return; 1408 } 1409 if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) { 1410 return; 1411 } 1412 1413 dp->dad_ns_ocount++; 1414 nd6_ns_output(ifp, NULL, &ia->ia_addr.sin6_addr, NULL, 1); 1415 } 1416 1417 static void 1418 nd6_dad_ns_input(struct ifaddr *ifa) 1419 { 1420 struct in6_ifaddr *ia; 1421 struct ifnet *ifp; 1422 const struct in6_addr *taddr6; 1423 struct dadq *dp; 1424 int duplicate; 1425 1426 if (ifa == NULL) 1427 panic("ifa == NULL in nd6_dad_ns_input"); 1428 1429 ia = (struct in6_ifaddr *)ifa; 1430 ifp = ifa->ifa_ifp; 1431 taddr6 = &ia->ia_addr.sin6_addr; 1432 duplicate = 0; 1433 dp = nd6_dad_find(ifa); 1434 1435 /* Quickhack - completely ignore DAD NS packets */ 1436 if (dad_ignore_ns) { 1437 char ip6buf[INET6_ADDRSTRLEN]; 1438 nd6log((LOG_INFO, 1439 "nd6_dad_ns_input: ignoring DAD NS packet for " 1440 "address %s(%s)\n", ip6_sprintf(ip6buf, taddr6), 1441 if_name(ifa->ifa_ifp))); 1442 return; 1443 } 1444 1445 /* 1446 * if I'm yet to start DAD, someone else started using this address 1447 * first. I have a duplicate and you win. 1448 */ 1449 if (dp == NULL || dp->dad_ns_ocount == 0) 1450 duplicate++; 1451 1452 /* XXX more checks for loopback situation - see nd6_dad_timer too */ 1453 1454 if (duplicate) { 1455 dp = NULL; /* will be freed in nd6_dad_duplicated() */ 1456 nd6_dad_duplicated(ifa); 1457 } else { 1458 /* 1459 * not sure if I got a duplicate. 1460 * increment ns count and see what happens. 1461 */ 1462 if (dp) 1463 dp->dad_ns_icount++; 1464 } 1465 } 1466 1467 static void 1468 nd6_dad_na_input(struct ifaddr *ifa) 1469 { 1470 struct dadq *dp; 1471 1472 if (ifa == NULL) 1473 panic("ifa == NULL in nd6_dad_na_input"); 1474 1475 dp = nd6_dad_find(ifa); 1476 if (dp) 1477 dp->dad_na_icount++; 1478 1479 /* remove the address. */ 1480 nd6_dad_duplicated(ifa); 1481 }
Cache object: 5421082984e2bce8a2eedbeeebc1b12e
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]