137#define V_nd6_slowtimo_ch VNET(nd6_slowtimo_ch)
138
139VNET_DEFINE(struct callout, nd6_timer_ch);
140
141void
142nd6_init(void)
143{
144 int i;
145
146 LIST_INIT(&V_nd_prefix);
147
148 all1_sa.sin6_family = AF_INET6;
149 all1_sa.sin6_len = sizeof(struct sockaddr_in6);
150 for (i = 0; i < sizeof(all1_sa.sin6_addr); i++)
151 all1_sa.sin6_addr.s6_addr[i] = 0xff;
152
153 /* initialization of the default router list */
154 TAILQ_INIT(&V_nd_defrouter);
155
156 /* start timer */
157 callout_init(&V_nd6_slowtimo_ch, 0);
158 callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
159 nd6_slowtimo, curvnet);
160}
161
162#ifdef VIMAGE
163void
164nd6_destroy()
165{
166
167 callout_drain(&V_nd6_slowtimo_ch);
168 callout_drain(&V_nd6_timer_ch);
169}
170#endif
171
172struct nd_ifinfo *
173nd6_ifattach(struct ifnet *ifp)
174{
175 struct nd_ifinfo *nd;
176
177 nd = (struct nd_ifinfo *)malloc(sizeof(*nd), M_IP6NDP, M_WAITOK);
178 bzero(nd, sizeof(*nd));
179
180 nd->initialized = 1;
181
182 nd->chlim = IPV6_DEFHLIM;
183 nd->basereachable = REACHABLE_TIME;
184 nd->reachable = ND_COMPUTE_RTIME(nd->basereachable);
185 nd->retrans = RETRANS_TIMER;
186
187 nd->flags = ND6_IFF_PERFORMNUD;
188
189 /* A loopback interface always has ND6_IFF_AUTO_LINKLOCAL. */
190 if (V_ip6_auto_linklocal || (ifp->if_flags & IFF_LOOPBACK))
191 nd->flags |= ND6_IFF_AUTO_LINKLOCAL;
192
193 /* A loopback interface does not need to accept RTADV. */
194 if (V_ip6_accept_rtadv && !(ifp->if_flags & IFF_LOOPBACK))
195 nd->flags |= ND6_IFF_ACCEPT_RTADV;
196
197 /* XXX: we cannot call nd6_setmtu since ifp is not fully initialized */
198 nd6_setmtu0(ifp, nd);
199
200 return nd;
201}
202
203void
204nd6_ifdetach(struct nd_ifinfo *nd)
205{
206
207 free(nd, M_IP6NDP);
208}
209
210/*
211 * Reset ND level link MTU. This function is called when the physical MTU
212 * changes, which means we might have to adjust the ND level MTU.
213 */
214void
215nd6_setmtu(struct ifnet *ifp)
216{
217
218 nd6_setmtu0(ifp, ND_IFINFO(ifp));
219}
220
221/* XXX todo: do not maintain copy of ifp->if_mtu in ndi->maxmtu */
222void
223nd6_setmtu0(struct ifnet *ifp, struct nd_ifinfo *ndi)
224{
225 u_int32_t omaxmtu;
226
227 omaxmtu = ndi->maxmtu;
228
229 switch (ifp->if_type) {
230 case IFT_ARCNET:
231 ndi->maxmtu = MIN(ARC_PHDS_MAXMTU, ifp->if_mtu); /* RFC2497 */
232 break;
233 case IFT_FDDI:
234 ndi->maxmtu = MIN(FDDIIPMTU, ifp->if_mtu); /* RFC2467 */
235 break;
236 case IFT_ISO88025:
237 ndi->maxmtu = MIN(ISO88025_MAX_MTU, ifp->if_mtu);
238 break;
239 default:
240 ndi->maxmtu = ifp->if_mtu;
241 break;
242 }
243
244 /*
245 * Decreasing the interface MTU under IPV6 minimum MTU may cause
246 * undesirable situation. We thus notify the operator of the change
247 * explicitly. The check for omaxmtu is necessary to restrict the
248 * log to the case of changing the MTU, not initializing it.
249 */
250 if (omaxmtu >= IPV6_MMTU && ndi->maxmtu < IPV6_MMTU) {
251 log(LOG_NOTICE, "nd6_setmtu0: "
252 "new link MTU on %s (%lu) is too small for IPv6\n",
253 if_name(ifp), (unsigned long)ndi->maxmtu);
254 }
255
256 if (ndi->maxmtu > V_in6_maxmtu)
257 in6_setmaxmtu(); /* check all interfaces just in case */
258
259}
260
261void
262nd6_option_init(void *opt, int icmp6len, union nd_opts *ndopts)
263{
264
265 bzero(ndopts, sizeof(*ndopts));
266 ndopts->nd_opts_search = (struct nd_opt_hdr *)opt;
267 ndopts->nd_opts_last
268 = (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len);
269
270 if (icmp6len == 0) {
271 ndopts->nd_opts_done = 1;
272 ndopts->nd_opts_search = NULL;
273 }
274}
275
276/*
277 * Take one ND option.
278 */
279struct nd_opt_hdr *
280nd6_option(union nd_opts *ndopts)
281{
282 struct nd_opt_hdr *nd_opt;
283 int olen;
284
285 if (ndopts == NULL)
286 panic("ndopts == NULL in nd6_option");
287 if (ndopts->nd_opts_last == NULL)
288 panic("uninitialized ndopts in nd6_option");
289 if (ndopts->nd_opts_search == NULL)
290 return NULL;
291 if (ndopts->nd_opts_done)
292 return NULL;
293
294 nd_opt = ndopts->nd_opts_search;
295
296 /* make sure nd_opt_len is inside the buffer */
297 if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) {
298 bzero(ndopts, sizeof(*ndopts));
299 return NULL;
300 }
301
302 olen = nd_opt->nd_opt_len << 3;
303 if (olen == 0) {
304 /*
305 * Message validation requires that all included
306 * options have a length that is greater than zero.
307 */
308 bzero(ndopts, sizeof(*ndopts));
309 return NULL;
310 }
311
312 ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);
313 if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
314 /* option overruns the end of buffer, invalid */
315 bzero(ndopts, sizeof(*ndopts));
316 return NULL;
317 } else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
318 /* reached the end of options chain */
319 ndopts->nd_opts_done = 1;
320 ndopts->nd_opts_search = NULL;
321 }
322 return nd_opt;
323}
324
325/*
326 * Parse multiple ND options.
327 * This function is much easier to use, for ND routines that do not need
328 * multiple options of the same type.
329 */
330int
331nd6_options(union nd_opts *ndopts)
332{
333 struct nd_opt_hdr *nd_opt;
334 int i = 0;
335
336 if (ndopts == NULL)
337 panic("ndopts == NULL in nd6_options");
338 if (ndopts->nd_opts_last == NULL)
339 panic("uninitialized ndopts in nd6_options");
340 if (ndopts->nd_opts_search == NULL)
341 return 0;
342
343 while (1) {
344 nd_opt = nd6_option(ndopts);
345 if (nd_opt == NULL && ndopts->nd_opts_last == NULL) {
346 /*
347 * Message validation requires that all included
348 * options have a length that is greater than zero.
349 */
350 ICMP6STAT_INC(icp6s_nd_badopt);
351 bzero(ndopts, sizeof(*ndopts));
352 return -1;
353 }
354
355 if (nd_opt == NULL)
356 goto skip1;
357
358 switch (nd_opt->nd_opt_type) {
359 case ND_OPT_SOURCE_LINKADDR:
360 case ND_OPT_TARGET_LINKADDR:
361 case ND_OPT_MTU:
362 case ND_OPT_REDIRECTED_HEADER:
363 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
364 nd6log((LOG_INFO,
365 "duplicated ND6 option found (type=%d)\n",
366 nd_opt->nd_opt_type));
367 /* XXX bark? */
368 } else {
369 ndopts->nd_opt_array[nd_opt->nd_opt_type]
370 = nd_opt;
371 }
372 break;
373 case ND_OPT_PREFIX_INFORMATION:
374 if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) {
375 ndopts->nd_opt_array[nd_opt->nd_opt_type]
376 = nd_opt;
377 }
378 ndopts->nd_opts_pi_end =
379 (struct nd_opt_prefix_info *)nd_opt;
380 break;
381 default:
382 /*
383 * Unknown options must be silently ignored,
384 * to accomodate future extension to the protocol.
385 */
386 nd6log((LOG_DEBUG,
387 "nd6_options: unsupported option %d - "
388 "option ignored\n", nd_opt->nd_opt_type));
389 }
390
391skip1:
392 i++;
393 if (i > V_nd6_maxndopt) {
394 ICMP6STAT_INC(icp6s_nd_toomanyopt);
395 nd6log((LOG_INFO, "too many loop in nd opt\n"));
396 break;
397 }
398
399 if (ndopts->nd_opts_done)
400 break;
401 }
402
403 return 0;
404}
405
406/*
407 * ND6 timer routine to handle ND6 entries
408 */
409void
410nd6_llinfo_settimer_locked(struct llentry *ln, long tick)
411{
412 int canceled;
413
414 if (tick < 0) {
415 ln->la_expire = 0;
416 ln->ln_ntick = 0;
417 canceled = callout_stop(&ln->ln_timer_ch);
418 } else {
419 ln->la_expire = time_second + tick / hz;
420 LLE_ADDREF(ln);
421 if (tick > INT_MAX) {
422 ln->ln_ntick = tick - INT_MAX;
423 canceled = callout_reset(&ln->ln_timer_ch, INT_MAX,
424 nd6_llinfo_timer, ln);
425 } else {
426 ln->ln_ntick = 0;
427 canceled = callout_reset(&ln->ln_timer_ch, tick,
428 nd6_llinfo_timer, ln);
429 }
430 }
431 if (canceled)
432 LLE_REMREF(ln);
433}
434
435void
436nd6_llinfo_settimer(struct llentry *ln, long tick)
437{
438
439 LLE_WLOCK(ln);
440 nd6_llinfo_settimer_locked(ln, tick);
441 LLE_WUNLOCK(ln);
442}
443
444static void
445nd6_llinfo_timer(void *arg)
446{
447 struct llentry *ln;
448 struct in6_addr *dst;
449 struct ifnet *ifp;
450 struct nd_ifinfo *ndi = NULL;
451
452 KASSERT(arg != NULL, ("%s: arg NULL", __func__));
453 ln = (struct llentry *)arg;
454 ifp = ln->lle_tbl->llt_ifp;
455
456 CURVNET_SET(ifp->if_vnet);
457
458 if (ln->ln_ntick > 0) {
459 if (ln->ln_ntick > INT_MAX) {
460 ln->ln_ntick -= INT_MAX;
461 nd6_llinfo_settimer(ln, INT_MAX);
462 } else {
463 ln->ln_ntick = 0;
464 nd6_llinfo_settimer(ln, ln->ln_ntick);
465 }
466 goto done;
467 }
468
469 ndi = ND_IFINFO(ifp);
470 dst = &L3_ADDR_SIN6(ln)->sin6_addr;
471 if (ln->la_flags & LLE_STATIC) {
472 goto done;
473 }
474
475 if (ln->la_flags & LLE_DELETED) {
476 (void)nd6_free(ln, 0);
477 ln = NULL;
478 goto done;
479 }
480
481 switch (ln->ln_state) {
482 case ND6_LLINFO_INCOMPLETE:
483 if (ln->la_asked < V_nd6_mmaxtries) {
484 ln->la_asked++;
485 nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
486 nd6_ns_output(ifp, NULL, dst, ln, 0);
487 } else {
488 struct mbuf *m = ln->la_hold;
489 if (m) {
490 struct mbuf *m0;
491
492 /*
493 * assuming every packet in la_hold has the
494 * same IP header
495 */
496 m0 = m->m_nextpkt;
497 m->m_nextpkt = NULL;
498 icmp6_error2(m, ICMP6_DST_UNREACH,
499 ICMP6_DST_UNREACH_ADDR, 0, ifp);
500
501 ln->la_hold = m0;
502 clear_llinfo_pqueue(ln);
503 }
504 (void)nd6_free(ln, 0);
505 ln = NULL;
506 }
507 break;
508 case ND6_LLINFO_REACHABLE:
509 if (!ND6_LLINFO_PERMANENT(ln)) {
510 ln->ln_state = ND6_LLINFO_STALE;
511 nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
512 }
513 break;
514
515 case ND6_LLINFO_STALE:
516 /* Garbage Collection(RFC 2461 5.3) */
517 if (!ND6_LLINFO_PERMANENT(ln)) {
518 (void)nd6_free(ln, 1);
519 ln = NULL;
520 }
521 break;
522
523 case ND6_LLINFO_DELAY:
524 if (ndi && (ndi->flags & ND6_IFF_PERFORMNUD) != 0) {
525 /* We need NUD */
526 ln->la_asked = 1;
527 ln->ln_state = ND6_LLINFO_PROBE;
528 nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
529 nd6_ns_output(ifp, dst, dst, ln, 0);
530 } else {
531 ln->ln_state = ND6_LLINFO_STALE; /* XXX */
532 nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
533 }
534 break;
535 case ND6_LLINFO_PROBE:
536 if (ln->la_asked < V_nd6_umaxtries) {
537 ln->la_asked++;
538 nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
539 nd6_ns_output(ifp, dst, dst, ln, 0);
540 } else {
541 (void)nd6_free(ln, 0);
542 ln = NULL;
543 }
544 break;
545 }
546done:
547 if (ln != NULL)
548 LLE_FREE(ln);
549 CURVNET_RESTORE();
550}
551
552
553/*
554 * ND6 timer routine to expire default route list and prefix list
555 */
556void
557nd6_timer(void *arg)
558{
559 CURVNET_SET((struct vnet *) arg);
560 int s;
561 struct nd_defrouter *dr;
562 struct nd_prefix *pr;
563 struct in6_ifaddr *ia6, *nia6;
564 struct in6_addrlifetime *lt6;
565
566 callout_reset(&V_nd6_timer_ch, V_nd6_prune * hz,
567 nd6_timer, curvnet);
568
569 /* expire default router list */
570 s = splnet();
571 dr = TAILQ_FIRST(&V_nd_defrouter);
572 while (dr) {
573 if (dr->expire && dr->expire < time_second) {
574 struct nd_defrouter *t;
575 t = TAILQ_NEXT(dr, dr_entry);
576 defrtrlist_del(dr);
577 dr = t;
578 } else {
579 dr = TAILQ_NEXT(dr, dr_entry);
580 }
581 }
582
583 /*
584 * expire interface addresses.
585 * in the past the loop was inside prefix expiry processing.
586 * However, from a stricter speci-confrmance standpoint, we should
587 * rather separate address lifetimes and prefix lifetimes.
588 *
589 * XXXRW: in6_ifaddrhead locking.
590 */
591 addrloop:
592 TAILQ_FOREACH_SAFE(ia6, &V_in6_ifaddrhead, ia_link, nia6) {
593 /* check address lifetime */
594 lt6 = &ia6->ia6_lifetime;
595 if (IFA6_IS_INVALID(ia6)) {
596 int regen = 0;
597
598 /*
599 * If the expiring address is temporary, try
600 * regenerating a new one. This would be useful when
601 * we suspended a laptop PC, then turned it on after a
602 * period that could invalidate all temporary
603 * addresses. Although we may have to restart the
604 * loop (see below), it must be after purging the
605 * address. Otherwise, we'd see an infinite loop of
606 * regeneration.
607 */
608 if (V_ip6_use_tempaddr &&
609 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
610 if (regen_tmpaddr(ia6) == 0)
611 regen = 1;
612 }
613
614 in6_purgeaddr(&ia6->ia_ifa);
615
616 if (regen)
617 goto addrloop; /* XXX: see below */
618 } else if (IFA6_IS_DEPRECATED(ia6)) {
619 int oldflags = ia6->ia6_flags;
620
621 ia6->ia6_flags |= IN6_IFF_DEPRECATED;
622
623 /*
624 * If a temporary address has just become deprecated,
625 * regenerate a new one if possible.
626 */
627 if (V_ip6_use_tempaddr &&
628 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
629 (oldflags & IN6_IFF_DEPRECATED) == 0) {
630
631 if (regen_tmpaddr(ia6) == 0) {
632 /*
633 * A new temporary address is
634 * generated.
635 * XXX: this means the address chain
636 * has changed while we are still in
637 * the loop. Although the change
638 * would not cause disaster (because
639 * it's not a deletion, but an
640 * addition,) we'd rather restart the
641 * loop just for safety. Or does this
642 * significantly reduce performance??
643 */
644 goto addrloop;
645 }
646 }
647 } else {
648 /*
649 * A new RA might have made a deprecated address
650 * preferred.
651 */
652 ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;
653 }
654 }
655
656 /* expire prefix list */
657 pr = V_nd_prefix.lh_first;
658 while (pr) {
659 /*
660 * check prefix lifetime.
661 * since pltime is just for autoconf, pltime processing for
662 * prefix is not necessary.
663 */
664 if (pr->ndpr_vltime != ND6_INFINITE_LIFETIME &&
665 time_second - pr->ndpr_lastupdate > pr->ndpr_vltime) {
666 struct nd_prefix *t;
667 t = pr->ndpr_next;
668
669 /*
670 * address expiration and prefix expiration are
671 * separate. NEVER perform in6_purgeaddr here.
672 */
673
674 prelist_remove(pr);
675 pr = t;
676 } else
677 pr = pr->ndpr_next;
678 }
679 splx(s);
680 CURVNET_RESTORE();
681}
682
683/*
684 * ia6 - deprecated/invalidated temporary address
685 */
686static int
687regen_tmpaddr(struct in6_ifaddr *ia6)
688{
689 struct ifaddr *ifa;
690 struct ifnet *ifp;
691 struct in6_ifaddr *public_ifa6 = NULL;
692
693 ifp = ia6->ia_ifa.ifa_ifp;
694 IF_ADDR_LOCK(ifp);
695 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
696 struct in6_ifaddr *it6;
697
698 if (ifa->ifa_addr->sa_family != AF_INET6)
699 continue;
700
701 it6 = (struct in6_ifaddr *)ifa;
702
703 /* ignore no autoconf addresses. */
704 if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0)
705 continue;
706
707 /* ignore autoconf addresses with different prefixes. */
708 if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr)
709 continue;
710
711 /*
712 * Now we are looking at an autoconf address with the same
713 * prefix as ours. If the address is temporary and is still
714 * preferred, do not create another one. It would be rare, but
715 * could happen, for example, when we resume a laptop PC after
716 * a long period.
717 */
718 if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
719 !IFA6_IS_DEPRECATED(it6)) {
720 public_ifa6 = NULL;
721 break;
722 }
723
724 /*
725 * This is a public autoconf address that has the same prefix
726 * as ours. If it is preferred, keep it. We can't break the
727 * loop here, because there may be a still-preferred temporary
728 * address with the prefix.
729 */
730 if (!IFA6_IS_DEPRECATED(it6))
731 public_ifa6 = it6;
732
733 if (public_ifa6 != NULL)
734 ifa_ref(&public_ifa6->ia_ifa);
735 }
736 IF_ADDR_UNLOCK(ifp);
737
738 if (public_ifa6 != NULL) {
739 int e;
740
741 if ((e = in6_tmpifadd(public_ifa6, 0, 0)) != 0) {
742 ifa_free(&public_ifa6->ia_ifa);
743 log(LOG_NOTICE, "regen_tmpaddr: failed to create a new"
744 " tmp addr,errno=%d\n", e);
745 return (-1);
746 }
747 ifa_free(&public_ifa6->ia_ifa);
748 return (0);
749 }
750
751 return (-1);
752}
753
754/*
755 * Nuke neighbor cache/prefix/default router management table, right before
756 * ifp goes away.
757 */
758void
759nd6_purge(struct ifnet *ifp)
760{
761 struct nd_defrouter *dr, *ndr;
762 struct nd_prefix *pr, *npr;
763
764 /*
765 * Nuke default router list entries toward ifp.
766 * We defer removal of default router list entries that is installed
767 * in the routing table, in order to keep additional side effects as
768 * small as possible.
769 */
770 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
771 ndr = TAILQ_NEXT(dr, dr_entry);
772 if (dr->installed)
773 continue;
774
775 if (dr->ifp == ifp)
776 defrtrlist_del(dr);
777 }
778
779 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
780 ndr = TAILQ_NEXT(dr, dr_entry);
781 if (!dr->installed)
782 continue;
783
784 if (dr->ifp == ifp)
785 defrtrlist_del(dr);
786 }
787
788 /* Nuke prefix list entries toward ifp */
789 for (pr = V_nd_prefix.lh_first; pr; pr = npr) {
790 npr = pr->ndpr_next;
791 if (pr->ndpr_ifp == ifp) {
792 /*
793 * Because if_detach() does *not* release prefixes
794 * while purging addresses the reference count will
795 * still be above zero. We therefore reset it to
796 * make sure that the prefix really gets purged.
797 */
798 pr->ndpr_refcnt = 0;
799
800 /*
801 * Previously, pr->ndpr_addr is removed as well,
802 * but I strongly believe we don't have to do it.
803 * nd6_purge() is only called from in6_ifdetach(),
804 * which removes all the associated interface addresses
805 * by itself.
806 * (jinmei@kame.net 20010129)
807 */
808 prelist_remove(pr);
809 }
810 }
811
812 /* cancel default outgoing interface setting */
813 if (V_nd6_defifindex == ifp->if_index)
814 nd6_setdefaultiface(0);
815
816 if (!V_ip6_forwarding && ND_IFINFO(ifp)->flags & ND6_IFF_ACCEPT_RTADV) {
817 /* Refresh default router list. */
818 defrouter_select();
819 }
820
821 /* XXXXX
822 * We do not nuke the neighbor cache entries here any more
823 * because the neighbor cache is kept in if_afdata[AF_INET6].
824 * nd6_purge() is invoked by in6_ifdetach() which is called
825 * from if_detach() where everything gets purged. So let
826 * in6_domifdetach() do the actual L2 table purging work.
827 */
828}
829
830/*
831 * the caller acquires and releases the lock on the lltbls
832 * Returns the llentry locked
833 */
834struct llentry *
835nd6_lookup(struct in6_addr *addr6, int flags, struct ifnet *ifp)
836{
837 struct sockaddr_in6 sin6;
838 struct llentry *ln;
839 int llflags;
840
841 bzero(&sin6, sizeof(sin6));
842 sin6.sin6_len = sizeof(struct sockaddr_in6);
843 sin6.sin6_family = AF_INET6;
844 sin6.sin6_addr = *addr6;
845
846 IF_AFDATA_LOCK_ASSERT(ifp);
847
848 llflags = 0;
849 if (flags & ND6_CREATE)
850 llflags |= LLE_CREATE;
851 if (flags & ND6_EXCLUSIVE)
852 llflags |= LLE_EXCLUSIVE;
853
854 ln = lla_lookup(LLTABLE6(ifp), llflags, (struct sockaddr *)&sin6);
855 if ((ln != NULL) && (llflags & LLE_CREATE))
856 ln->ln_state = ND6_LLINFO_NOSTATE;
857
858 return (ln);
859}
860
861/*
862 * Test whether a given IPv6 address is a neighbor or not, ignoring
863 * the actual neighbor cache. The neighbor cache is ignored in order
864 * to not reenter the routing code from within itself.
865 */
866static int
867nd6_is_new_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
868{
869 struct nd_prefix *pr;
870 struct ifaddr *dstaddr;
871
872 /*
873 * A link-local address is always a neighbor.
874 * XXX: a link does not necessarily specify a single interface.
875 */
876 if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr)) {
877 struct sockaddr_in6 sin6_copy;
878 u_int32_t zone;
879
880 /*
881 * We need sin6_copy since sa6_recoverscope() may modify the
882 * content (XXX).
883 */
884 sin6_copy = *addr;
885 if (sa6_recoverscope(&sin6_copy))
886 return (0); /* XXX: should be impossible */
887 if (in6_setscope(&sin6_copy.sin6_addr, ifp, &zone))
888 return (0);
889 if (sin6_copy.sin6_scope_id == zone)
890 return (1);
891 else
892 return (0);
893 }
894
895 /*
896 * If the address matches one of our addresses,
897 * it should be a neighbor.
898 * If the address matches one of our on-link prefixes, it should be a
899 * neighbor.
900 */
901 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
902 if (pr->ndpr_ifp != ifp)
903 continue;
904
905 if (!(pr->ndpr_stateflags & NDPRF_ONLINK)) {
906 struct rtentry *rt;
907 rt = rtalloc1((struct sockaddr *)&pr->ndpr_prefix, 0, 0);
908 if (rt == NULL)
909 continue;
910 /*
911 * This is the case where multiple interfaces
912 * have the same prefix, but only one is installed
913 * into the routing table and that prefix entry
914 * is not the one being examined here. In the case
915 * where RADIX_MPATH is enabled, multiple route
916 * entries (of the same rt_key value) will be
917 * installed because the interface addresses all
918 * differ.
919 */
920 if (!IN6_ARE_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
921 &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr)) {
922 RTFREE_LOCKED(rt);
923 continue;
924 }
925 RTFREE_LOCKED(rt);
926 }
927
928 if (IN6_ARE_MASKED_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
929 &addr->sin6_addr, &pr->ndpr_mask))
930 return (1);
931 }
932
933 /*
934 * If the address is assigned on the node of the other side of
935 * a p2p interface, the address should be a neighbor.
936 */
937 dstaddr = ifa_ifwithdstaddr((struct sockaddr *)addr);
938 if (dstaddr != NULL) {
939 if (dstaddr->ifa_ifp == ifp) {
940 ifa_free(dstaddr);
941 return (1);
942 }
943 ifa_free(dstaddr);
944 }
945
946 /*
947 * If the default router list is empty, all addresses are regarded
948 * as on-link, and thus, as a neighbor.
949 * XXX: we restrict the condition to hosts, because routers usually do
950 * not have the "default router list".
951 */
952 if (!V_ip6_forwarding && TAILQ_FIRST(&V_nd_defrouter) == NULL &&
953 V_nd6_defifindex == ifp->if_index) {
954 return (1);
955 }
956
957 return (0);
958}
959
960
961/*
962 * Detect if a given IPv6 address identifies a neighbor on a given link.
963 * XXX: should take care of the destination of a p2p link?
964 */
965int
966nd6_is_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
967{
968 struct llentry *lle;
969 int rc = 0;
970
971 IF_AFDATA_UNLOCK_ASSERT(ifp);
972 if (nd6_is_new_addr_neighbor(addr, ifp))
973 return (1);
974
975 /*
976 * Even if the address matches none of our addresses, it might be
977 * in the neighbor cache.
978 */
979 IF_AFDATA_LOCK(ifp);
980 if ((lle = nd6_lookup(&addr->sin6_addr, 0, ifp)) != NULL) {
981 LLE_RUNLOCK(lle);
982 rc = 1;
983 }
984 IF_AFDATA_UNLOCK(ifp);
985 return (rc);
986}
987
988/*
989 * Free an nd6 llinfo entry.
990 * Since the function would cause significant changes in the kernel, DO NOT
991 * make it global, unless you have a strong reason for the change, and are sure
992 * that the change is safe.
993 */
994static struct llentry *
995nd6_free(struct llentry *ln, int gc)
996{
997 struct llentry *next;
998 struct nd_defrouter *dr;
999 struct ifnet *ifp=NULL;
1000
1001 /*
1002 * we used to have pfctlinput(PRC_HOSTDEAD) here.
1003 * even though it is not harmful, it was not really necessary.
1004 */
1005
1006 /* cancel timer */
1007 nd6_llinfo_settimer(ln, -1);
1008
1009 if (!V_ip6_forwarding) {
1010 int s;
1011 s = splnet();
1012 dr = defrouter_lookup(&L3_ADDR_SIN6(ln)->sin6_addr, ln->lle_tbl->llt_ifp);
1013
1014 if (dr != NULL && dr->expire &&
1015 ln->ln_state == ND6_LLINFO_STALE && gc) {
1016 /*
1017 * If the reason for the deletion is just garbage
1018 * collection, and the neighbor is an active default
1019 * router, do not delete it. Instead, reset the GC
1020 * timer using the router's lifetime.
1021 * Simply deleting the entry would affect default
1022 * router selection, which is not necessarily a good
1023 * thing, especially when we're using router preference
1024 * values.
1025 * XXX: the check for ln_state would be redundant,
1026 * but we intentionally keep it just in case.
1027 */
1028 if (dr->expire > time_second)
1029 nd6_llinfo_settimer(ln,
1030 (dr->expire - time_second) * hz);
1031 else
1032 nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
1033 splx(s);
1034 LLE_WLOCK(ln);
1035 LLE_REMREF(ln);
1036 LLE_WUNLOCK(ln);
1037 return (LIST_NEXT(ln, lle_next));
1038 }
1039
1040 if (ln->ln_router || dr) {
1041 /*
1042 * rt6_flush must be called whether or not the neighbor
1043 * is in the Default Router List.
1044 * See a corresponding comment in nd6_na_input().
1045 */
1046 rt6_flush(&L3_ADDR_SIN6(ln)->sin6_addr, ln->lle_tbl->llt_ifp);
1047 }
1048
1049 if (dr) {
1050 /*
1051 * Unreachablity of a router might affect the default
1052 * router selection and on-link detection of advertised
1053 * prefixes.
1054 */
1055
1056 /*
1057 * Temporarily fake the state to choose a new default
1058 * router and to perform on-link determination of
1059 * prefixes correctly.
1060 * Below the state will be set correctly,
1061 * or the entry itself will be deleted.
1062 */
1063 ln->ln_state = ND6_LLINFO_INCOMPLETE;
1064
1065 /*
1066 * Since defrouter_select() does not affect the
1067 * on-link determination and MIP6 needs the check
1068 * before the default router selection, we perform
1069 * the check now.
1070 */
1071 pfxlist_onlink_check();
1072
1073 /*
1074 * refresh default router list
1075 */
1076 defrouter_select();
1077 }
1078 splx(s);
1079 }
1080
1081 /*
1082 * Before deleting the entry, remember the next entry as the
1083 * return value. We need this because pfxlist_onlink_check() above
1084 * might have freed other entries (particularly the old next entry) as
1085 * a side effect (XXX).
1086 */
1087 next = LIST_NEXT(ln, lle_next);
1088
1089 ifp = ln->lle_tbl->llt_ifp;
1090 IF_AFDATA_LOCK(ifp);
1091 LLE_WLOCK(ln);
1092 LLE_REMREF(ln);
1093 llentry_free(ln);
1094 IF_AFDATA_UNLOCK(ifp);
1095
1096 return (next);
1097}
1098
1099/*
1100 * Upper-layer reachability hint for Neighbor Unreachability Detection.
1101 *
1102 * XXX cost-effective methods?
1103 */
1104void
1105nd6_nud_hint(struct rtentry *rt, struct in6_addr *dst6, int force)
1106{
1107 struct llentry *ln;
1108 struct ifnet *ifp;
1109
1110 if ((dst6 == NULL) || (rt == NULL))
1111 return;
1112
1113 ifp = rt->rt_ifp;
1114 IF_AFDATA_LOCK(ifp);
1115 ln = nd6_lookup(dst6, ND6_EXCLUSIVE, NULL);
1116 IF_AFDATA_UNLOCK(ifp);
1117 if (ln == NULL)
1118 return;
1119
1120 if (ln->ln_state < ND6_LLINFO_REACHABLE)
1121 goto done;
1122
1123 /*
1124 * if we get upper-layer reachability confirmation many times,
1125 * it is possible we have false information.
1126 */
1127 if (!force) {
1128 ln->ln_byhint++;
1129 if (ln->ln_byhint > V_nd6_maxnudhint) {
1130 goto done;
1131 }
1132 }
1133
1134 ln->ln_state = ND6_LLINFO_REACHABLE;
1135 if (!ND6_LLINFO_PERMANENT(ln)) {
1136 nd6_llinfo_settimer_locked(ln,
1137 (long)ND_IFINFO(rt->rt_ifp)->reachable * hz);
1138 }
1139done:
1140 LLE_WUNLOCK(ln);
1141}
1142
1143
1144int
1145nd6_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp)
1146{
1147 struct in6_drlist *drl = (struct in6_drlist *)data;
1148 struct in6_oprlist *oprl = (struct in6_oprlist *)data;
1149 struct in6_ndireq *ndi = (struct in6_ndireq *)data;
1150 struct in6_nbrinfo *nbi = (struct in6_nbrinfo *)data;
1151 struct in6_ndifreq *ndif = (struct in6_ndifreq *)data;
1152 struct nd_defrouter *dr;
1153 struct nd_prefix *pr;
1154 int i = 0, error = 0;
1155 int s;
1156
1157 switch (cmd) {
1158 case SIOCGDRLST_IN6:
1159 /*
1160 * obsolete API, use sysctl under net.inet6.icmp6
1161 */
1162 bzero(drl, sizeof(*drl));
1163 s = splnet();
1164 dr = TAILQ_FIRST(&V_nd_defrouter);
1165 while (dr && i < DRLSTSIZ) {
1166 drl->defrouter[i].rtaddr = dr->rtaddr;
1167 in6_clearscope(&drl->defrouter[i].rtaddr);
1168
1169 drl->defrouter[i].flags = dr->flags;
1170 drl->defrouter[i].rtlifetime = dr->rtlifetime;
1171 drl->defrouter[i].expire = dr->expire;
1172 drl->defrouter[i].if_index = dr->ifp->if_index;
1173 i++;
1174 dr = TAILQ_NEXT(dr, dr_entry);
1175 }
1176 splx(s);
1177 break;
1178 case SIOCGPRLST_IN6:
1179 /*
1180 * obsolete API, use sysctl under net.inet6.icmp6
1181 *
1182 * XXX the structure in6_prlist was changed in backward-
1183 * incompatible manner. in6_oprlist is used for SIOCGPRLST_IN6,
1184 * in6_prlist is used for nd6_sysctl() - fill_prlist().
1185 */
1186 /*
1187 * XXX meaning of fields, especialy "raflags", is very
1188 * differnet between RA prefix list and RR/static prefix list.
1189 * how about separating ioctls into two?
1190 */
1191 bzero(oprl, sizeof(*oprl));
1192 s = splnet();
1193 pr = V_nd_prefix.lh_first;
1194 while (pr && i < PRLSTSIZ) {
1195 struct nd_pfxrouter *pfr;
1196 int j;
1197
1198 oprl->prefix[i].prefix = pr->ndpr_prefix.sin6_addr;
1199 oprl->prefix[i].raflags = pr->ndpr_raf;
1200 oprl->prefix[i].prefixlen = pr->ndpr_plen;
1201 oprl->prefix[i].vltime = pr->ndpr_vltime;
1202 oprl->prefix[i].pltime = pr->ndpr_pltime;
1203 oprl->prefix[i].if_index = pr->ndpr_ifp->if_index;
1204 if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
1205 oprl->prefix[i].expire = 0;
1206 else {
1207 time_t maxexpire;
1208
1209 /* XXX: we assume time_t is signed. */
1210 maxexpire = (-1) &
1211 ~((time_t)1 <<
1212 ((sizeof(maxexpire) * 8) - 1));
1213 if (pr->ndpr_vltime <
1214 maxexpire - pr->ndpr_lastupdate) {
1215 oprl->prefix[i].expire =
1216 pr->ndpr_lastupdate +
1217 pr->ndpr_vltime;
1218 } else
1219 oprl->prefix[i].expire = maxexpire;
1220 }
1221
1222 pfr = pr->ndpr_advrtrs.lh_first;
1223 j = 0;
1224 while (pfr) {
1225 if (j < DRLSTSIZ) {
1226#define RTRADDR oprl->prefix[i].advrtr[j]
1227 RTRADDR = pfr->router->rtaddr;
1228 in6_clearscope(&RTRADDR);
1229#undef RTRADDR
1230 }
1231 j++;
1232 pfr = pfr->pfr_next;
1233 }
1234 oprl->prefix[i].advrtrs = j;
1235 oprl->prefix[i].origin = PR_ORIG_RA;
1236
1237 i++;
1238 pr = pr->ndpr_next;
1239 }
1240 splx(s);
1241
1242 break;
1243 case OSIOCGIFINFO_IN6:
1244#define ND ndi->ndi
1245 /* XXX: old ndp(8) assumes a positive value for linkmtu. */
1246 bzero(&ND, sizeof(ND));
1247 ND.linkmtu = IN6_LINKMTU(ifp);
1248 ND.maxmtu = ND_IFINFO(ifp)->maxmtu;
1249 ND.basereachable = ND_IFINFO(ifp)->basereachable;
1250 ND.reachable = ND_IFINFO(ifp)->reachable;
1251 ND.retrans = ND_IFINFO(ifp)->retrans;
1252 ND.flags = ND_IFINFO(ifp)->flags;
1253 ND.recalctm = ND_IFINFO(ifp)->recalctm;
1254 ND.chlim = ND_IFINFO(ifp)->chlim;
1255 break;
1256 case SIOCGIFINFO_IN6:
1257 ND = *ND_IFINFO(ifp);
1258 break;
1259 case SIOCSIFINFO_IN6:
1260 /*
1261 * used to change host variables from userland.
1262 * intented for a use on router to reflect RA configurations.
1263 */
1264 /* 0 means 'unspecified' */
1265 if (ND.linkmtu != 0) {
1266 if (ND.linkmtu < IPV6_MMTU ||
1267 ND.linkmtu > IN6_LINKMTU(ifp)) {
1268 error = EINVAL;
1269 break;
1270 }
1271 ND_IFINFO(ifp)->linkmtu = ND.linkmtu;
1272 }
1273
1274 if (ND.basereachable != 0) {
1275 int obasereachable = ND_IFINFO(ifp)->basereachable;
1276
1277 ND_IFINFO(ifp)->basereachable = ND.basereachable;
1278 if (ND.basereachable != obasereachable)
1279 ND_IFINFO(ifp)->reachable =
1280 ND_COMPUTE_RTIME(ND.basereachable);
1281 }
1282 if (ND.retrans != 0)
1283 ND_IFINFO(ifp)->retrans = ND.retrans;
1284 if (ND.chlim != 0)
1285 ND_IFINFO(ifp)->chlim = ND.chlim;
1286 /* FALLTHROUGH */
1287 case SIOCSIFINFO_FLAGS:
1288 {
1289 struct ifaddr *ifa;
1290 struct in6_ifaddr *ia;
1291
1292 if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) &&
1293 !(ND.flags & ND6_IFF_IFDISABLED)) {
1294 /* ifdisabled 1->0 transision */
1295
1296 /*
1297 * If the interface is marked as ND6_IFF_IFDISABLED and
1298 * has an link-local address with IN6_IFF_DUPLICATED,
1299 * do not clear ND6_IFF_IFDISABLED.
1300 * See RFC 4862, Section 5.4.5.
1301 */
1302 int duplicated_linklocal = 0;
1303
1304 IF_ADDR_LOCK(ifp);
1305 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1306 if (ifa->ifa_addr->sa_family != AF_INET6)
1307 continue;
1308 ia = (struct in6_ifaddr *)ifa;
1309 if ((ia->ia6_flags & IN6_IFF_DUPLICATED) &&
1310 IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr)) {
1311 duplicated_linklocal = 1;
1312 break;
1313 }
1314 }
1315 IF_ADDR_UNLOCK(ifp);
1316
1317 if (duplicated_linklocal) {
1318 ND.flags |= ND6_IFF_IFDISABLED;
1319 log(LOG_ERR, "Cannot enable an interface"
1320 " with a link-local address marked"
1321 " duplicate.\n");
1322 } else {
1323 ND_IFINFO(ifp)->flags &= ~ND6_IFF_IFDISABLED;
1324 in6_if_up(ifp);
1325 }
1326 } else if (!(ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) &&
1327 (ND.flags & ND6_IFF_IFDISABLED)) {
1328 /* ifdisabled 0->1 transision */
1329 /* Mark all IPv6 address as tentative. */
1330
1331 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED;
1332 IF_ADDR_LOCK(ifp);
1333 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1334 if (ifa->ifa_addr->sa_family != AF_INET6)
1335 continue;
1336 ia = (struct in6_ifaddr *)ifa;
1337 ia->ia6_flags |= IN6_IFF_TENTATIVE;
1338 }
1339 IF_ADDR_UNLOCK(ifp);
1340 }
1341
1342 if (!(ND_IFINFO(ifp)->flags & ND6_IFF_AUTO_LINKLOCAL) &&
1343 (ND.flags & ND6_IFF_AUTO_LINKLOCAL)) {
1344 /* auto_linklocal 0->1 transision */
1345
1346 /* If no link-local address on ifp, configure */
1347 ND_IFINFO(ifp)->flags |= ND6_IFF_AUTO_LINKLOCAL;
1348 in6_ifattach(ifp, NULL);
1349 }
1350 }
1351 ND_IFINFO(ifp)->flags = ND.flags;
1352 break;
1353#undef ND
1354 case SIOCSNDFLUSH_IN6: /* XXX: the ioctl name is confusing... */
1355 /* sync kernel routing table with the default router list */
1356 defrouter_reset();
1357 defrouter_select();
1358 break;
1359 case SIOCSPFXFLUSH_IN6:
1360 {
1361 /* flush all the prefix advertised by routers */
1362 struct nd_prefix *pr, *next;
1363
1364 s = splnet();
1365 for (pr = V_nd_prefix.lh_first; pr; pr = next) {
1366 struct in6_ifaddr *ia, *ia_next;
1367
1368 next = pr->ndpr_next;
1369
1370 if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
1371 continue; /* XXX */
1372
1373 /* do we really have to remove addresses as well? */
1374 /* XXXRW: in6_ifaddrhead locking. */
1375 TAILQ_FOREACH_SAFE(ia, &V_in6_ifaddrhead, ia_link,
1376 ia_next) {
1377 if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0)
1378 continue;
1379
1380 if (ia->ia6_ndpr == pr)
1381 in6_purgeaddr(&ia->ia_ifa);
1382 }
1383 prelist_remove(pr);
1384 }
1385 splx(s);
1386 break;
1387 }
1388 case SIOCSRTRFLUSH_IN6:
1389 {
1390 /* flush all the default routers */
1391 struct nd_defrouter *dr, *next;
1392
1393 s = splnet();
1394 defrouter_reset();
1395 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = next) {
1396 next = TAILQ_NEXT(dr, dr_entry);
1397 defrtrlist_del(dr);
1398 }
1399 defrouter_select();
1400 splx(s);
1401 break;
1402 }
1403 case SIOCGNBRINFO_IN6:
1404 {
1405 struct llentry *ln;
1406 struct in6_addr nb_addr = nbi->addr; /* make local for safety */
1407
1408 if ((error = in6_setscope(&nb_addr, ifp, NULL)) != 0)
1409 return (error);
1410
1411 IF_AFDATA_LOCK(ifp);
1412 ln = nd6_lookup(&nb_addr, 0, ifp);
1413 IF_AFDATA_UNLOCK(ifp);
1414
1415 if (ln == NULL) {
1416 error = EINVAL;
1417 break;
1418 }
1419 nbi->state = ln->ln_state;
1420 nbi->asked = ln->la_asked;
1421 nbi->isrouter = ln->ln_router;
1422 nbi->expire = ln->la_expire;
1423 LLE_RUNLOCK(ln);
1424 break;
1425 }
1426 case SIOCGDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */
1427 ndif->ifindex = V_nd6_defifindex;
1428 break;
1429 case SIOCSDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */
1430 return (nd6_setdefaultiface(ndif->ifindex));
1431 }
1432 return (error);
1433}
1434
1435/*
1436 * Create neighbor cache entry and cache link-layer address,
1437 * on reception of inbound ND6 packets. (RS/RA/NS/redirect)
1438 *
1439 * type - ICMP6 type
1440 * code - type dependent information
1441 *
1442 * XXXXX
1443 * The caller of this function already acquired the ndp
1444 * cache table lock because the cache entry is returned.
1445 */
1446struct llentry *
1447nd6_cache_lladdr(struct ifnet *ifp, struct in6_addr *from, char *lladdr,
1448 int lladdrlen, int type, int code)
1449{
1450 struct llentry *ln = NULL;
1451 int is_newentry;
1452 int do_update;
1453 int olladdr;
1454 int llchange;
1455 int flags;
1456 int newstate = 0;
1457 uint16_t router = 0;
1458 struct sockaddr_in6 sin6;
1459 struct mbuf *chain = NULL;
1460 int static_route = 0;
1461
1462 IF_AFDATA_UNLOCK_ASSERT(ifp);
1463
1464 if (ifp == NULL)
1465 panic("ifp == NULL in nd6_cache_lladdr");
1466 if (from == NULL)
1467 panic("from == NULL in nd6_cache_lladdr");
1468
1469 /* nothing must be updated for unspecified address */
1470 if (IN6_IS_ADDR_UNSPECIFIED(from))
1471 return NULL;
1472
1473 /*
1474 * Validation about ifp->if_addrlen and lladdrlen must be done in
1475 * the caller.
1476 *
1477 * XXX If the link does not have link-layer adderss, what should
1478 * we do? (ifp->if_addrlen == 0)
1479 * Spec says nothing in sections for RA, RS and NA. There's small
1480 * description on it in NS section (RFC 2461 7.2.3).
1481 */
1482 flags = lladdr ? ND6_EXCLUSIVE : 0;
1483 IF_AFDATA_LOCK(ifp);
1484 ln = nd6_lookup(from, flags, ifp);
1485
1486 if (ln == NULL) {
1487 flags |= ND6_EXCLUSIVE;
1488 ln = nd6_lookup(from, flags | ND6_CREATE, ifp);
1489 IF_AFDATA_UNLOCK(ifp);
1490 is_newentry = 1;
1491 } else {
1492 IF_AFDATA_UNLOCK(ifp);
1493 /* do nothing if static ndp is set */
1494 if (ln->la_flags & LLE_STATIC) {
1495 static_route = 1;
1496 goto done;
1497 }
1498 is_newentry = 0;
1499 }
1500 if (ln == NULL)
1501 return (NULL);
1502
1503 olladdr = (ln->la_flags & LLE_VALID) ? 1 : 0;
1504 if (olladdr && lladdr) {
1505 llchange = bcmp(lladdr, &ln->ll_addr,
1506 ifp->if_addrlen);
1507 } else
1508 llchange = 0;
1509
1510 /*
1511 * newentry olladdr lladdr llchange (*=record)
1512 * 0 n n -- (1)
1513 * 0 y n -- (2)
1514 * 0 n y -- (3) * STALE
1515 * 0 y y n (4) *
1516 * 0 y y y (5) * STALE
1517 * 1 -- n -- (6) NOSTATE(= PASSIVE)
1518 * 1 -- y -- (7) * STALE
1519 */
1520
1521 if (lladdr) { /* (3-5) and (7) */
1522 /*
1523 * Record source link-layer address
1524 * XXX is it dependent to ifp->if_type?
1525 */
1526 bcopy(lladdr, &ln->ll_addr, ifp->if_addrlen);
1527 ln->la_flags |= LLE_VALID;
1528 }
1529
1530 if (!is_newentry) {
1531 if ((!olladdr && lladdr != NULL) || /* (3) */
1532 (olladdr && lladdr != NULL && llchange)) { /* (5) */
1533 do_update = 1;
1534 newstate = ND6_LLINFO_STALE;
1535 } else /* (1-2,4) */
1536 do_update = 0;
1537 } else {
1538 do_update = 1;
1539 if (lladdr == NULL) /* (6) */
1540 newstate = ND6_LLINFO_NOSTATE;
1541 else /* (7) */
1542 newstate = ND6_LLINFO_STALE;
1543 }
1544
1545 if (do_update) {
1546 /*
1547 * Update the state of the neighbor cache.
1548 */
1549 ln->ln_state = newstate;
1550
1551 if (ln->ln_state == ND6_LLINFO_STALE) {
1552 /*
1553 * XXX: since nd6_output() below will cause
1554 * state tansition to DELAY and reset the timer,
1555 * we must set the timer now, although it is actually
1556 * meaningless.
1557 */
1558 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
1559
1560 if (ln->la_hold) {
1561 struct mbuf *m_hold, *m_hold_next;
1562
1563 /*
1564 * reset the la_hold in advance, to explicitly
1565 * prevent a la_hold lookup in nd6_output()
1566 * (wouldn't happen, though...)
1567 */
1568 for (m_hold = ln->la_hold, ln->la_hold = NULL;
1569 m_hold; m_hold = m_hold_next) {
1570 m_hold_next = m_hold->m_nextpkt;
1571 m_hold->m_nextpkt = NULL;
1572
1573 /*
1574 * we assume ifp is not a p2p here, so
1575 * just set the 2nd argument as the
1576 * 1st one.
1577 */
1578 nd6_output_lle(ifp, ifp, m_hold, L3_ADDR_SIN6(ln), NULL, ln, &chain);
1579 }
1580 /*
1581 * If we have mbufs in the chain we need to do
1582 * deferred transmit. Copy the address from the
1583 * llentry before dropping the lock down below.
1584 */
1585 if (chain != NULL)
1586 memcpy(&sin6, L3_ADDR_SIN6(ln), sizeof(sin6));
1587 }
1588 } else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
1589 /* probe right away */
1590 nd6_llinfo_settimer_locked((void *)ln, 0);
1591 }
1592 }
1593
1594 /*
1595 * ICMP6 type dependent behavior.
1596 *
1597 * NS: clear IsRouter if new entry
1598 * RS: clear IsRouter
1599 * RA: set IsRouter if there's lladdr
1600 * redir: clear IsRouter if new entry
1601 *
1602 * RA case, (1):
1603 * The spec says that we must set IsRouter in the following cases:
1604 * - If lladdr exist, set IsRouter. This means (1-5).
1605 * - If it is old entry (!newentry), set IsRouter. This means (7).
1606 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
1607 * A quetion arises for (1) case. (1) case has no lladdr in the
1608 * neighbor cache, this is similar to (6).
1609 * This case is rare but we figured that we MUST NOT set IsRouter.
1610 *
1611 * newentry olladdr lladdr llchange NS RS RA redir
1612 * D R
1613 * 0 n n -- (1) c ? s
1614 * 0 y n -- (2) c s s
1615 * 0 n y -- (3) c s s
1616 * 0 y y n (4) c s s
1617 * 0 y y y (5) c s s
1618 * 1 -- n -- (6) c c c s
1619 * 1 -- y -- (7) c c s c s
1620 *
1621 * (c=clear s=set)
1622 */
1623 switch (type & 0xff) {
1624 case ND_NEIGHBOR_SOLICIT:
1625 /*
1626 * New entry must have is_router flag cleared.
1627 */
1628 if (is_newentry) /* (6-7) */
1629 ln->ln_router = 0;
1630 break;
1631 case ND_REDIRECT:
1632 /*
1633 * If the icmp is a redirect to a better router, always set the
1634 * is_router flag. Otherwise, if the entry is newly created,
1635 * clear the flag. [RFC 2461, sec 8.3]
1636 */
1637 if (code == ND_REDIRECT_ROUTER)
1638 ln->ln_router = 1;
1639 else if (is_newentry) /* (6-7) */
1640 ln->ln_router = 0;
1641 break;
1642 case ND_ROUTER_SOLICIT:
1643 /*
1644 * is_router flag must always be cleared.
1645 */
1646 ln->ln_router = 0;
1647 break;
1648 case ND_ROUTER_ADVERT:
1649 /*
1650 * Mark an entry with lladdr as a router.
1651 */
1652 if ((!is_newentry && (olladdr || lladdr)) || /* (2-5) */
1653 (is_newentry && lladdr)) { /* (7) */
1654 ln->ln_router = 1;
1655 }
1656 break;
1657 }
1658
1659 if (ln != NULL) {
1660 static_route = (ln->la_flags & LLE_STATIC);
1661 router = ln->ln_router;
1662
1663 if (flags & ND6_EXCLUSIVE)
1664 LLE_WUNLOCK(ln);
1665 else
1666 LLE_RUNLOCK(ln);
1667 if (static_route)
1668 ln = NULL;
1669 }
1670 if (chain)
1671 nd6_output_flush(ifp, ifp, chain, &sin6, NULL);
1672
1673 /*
1674 * When the link-layer address of a router changes, select the
1675 * best router again. In particular, when the neighbor entry is newly
1676 * created, it might affect the selection policy.
1677 * Question: can we restrict the first condition to the "is_newentry"
1678 * case?
1679 * XXX: when we hear an RA from a new router with the link-layer
1680 * address option, defrouter_select() is called twice, since
1681 * defrtrlist_update called the function as well. However, I believe
1682 * we can compromise the overhead, since it only happens the first
1683 * time.
1684 * XXX: although defrouter_select() should not have a bad effect
1685 * for those are not autoconfigured hosts, we explicitly avoid such
1686 * cases for safety.
1687 */
1688 if (do_update && router && !V_ip6_forwarding &&
1689 ND_IFINFO(ifp)->flags & ND6_IFF_ACCEPT_RTADV) {
1690 /*
1691 * guaranteed recursion
1692 */
1693 defrouter_select();
1694 }
1695
1696 return (ln);
1697done:
1698 if (ln != NULL) {
1699 if (flags & ND6_EXCLUSIVE)
1700 LLE_WUNLOCK(ln);
1701 else
1702 LLE_RUNLOCK(ln);
1703 if (static_route)
1704 ln = NULL;
1705 }
1706 return (ln);
1707}
1708
1709static void
1710nd6_slowtimo(void *arg)
1711{
1712 CURVNET_SET((struct vnet *) arg);
1713 struct nd_ifinfo *nd6if;
1714 struct ifnet *ifp;
1715
1716 callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
1717 nd6_slowtimo, curvnet);
1718 IFNET_RLOCK_NOSLEEP();
1719 for (ifp = TAILQ_FIRST(&V_ifnet); ifp;
1720 ifp = TAILQ_NEXT(ifp, if_list)) {
1721 nd6if = ND_IFINFO(ifp);
1722 if (nd6if->basereachable && /* already initialized */
1723 (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
1724 /*
1725 * Since reachable time rarely changes by router
1726 * advertisements, we SHOULD insure that a new random
1727 * value gets recomputed at least once every few hours.
1728 * (RFC 2461, 6.3.4)
1729 */
1730 nd6if->recalctm = V_nd6_recalc_reachtm_interval;
1731 nd6if->reachable = ND_COMPUTE_RTIME(nd6if->basereachable);
1732 }
1733 }
1734 IFNET_RUNLOCK_NOSLEEP();
1735 CURVNET_RESTORE();
1736}
1737
1738int
1739nd6_output(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
1740 struct sockaddr_in6 *dst, struct rtentry *rt0)
1741{
1742
1743 return (nd6_output_lle(ifp, origifp, m0, dst, rt0, NULL, NULL));
1744}
1745
1746
1747/*
1748 * Note that I'm not enforcing any global serialization
1749 * lle state or asked changes here as the logic is too
1750 * complicated to avoid having to always acquire an exclusive
1751 * lock
1752 * KMM
1753 *
1754 */
1755#define senderr(e) { error = (e); goto bad;}
1756
1757int
1758nd6_output_lle(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
1759 struct sockaddr_in6 *dst, struct rtentry *rt0, struct llentry *lle,
1760 struct mbuf **chain)
1761{
1762 struct mbuf *m = m0;
1763 struct m_tag *mtag;
1764 struct llentry *ln = lle;
1765 struct ip6_hdr *ip6;
1766 int error = 0;
1767 int flags = 0;
1768 int ip6len;
1769
1770#ifdef INVARIANTS
1771 if (lle != NULL) {
1772
1773 LLE_WLOCK_ASSERT(lle);
1774
1775 KASSERT(chain != NULL, (" lle locked but no mbuf chain pointer passed"));
1776 }
1777#endif
1778 if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr))
1779 goto sendpkt;
1780
1781 if (nd6_need_cache(ifp) == 0)
1782 goto sendpkt;
1783
1784 /*
1785 * next hop determination. This routine is derived from ether_output.
1786 */
1787
1788 /*
1789 * Address resolution or Neighbor Unreachability Detection
1790 * for the next hop.
1791 * At this point, the destination of the packet must be a unicast
1792 * or an anycast address(i.e. not a multicast).
1793 */
1794
1795 flags = ((m != NULL) || (lle != NULL)) ? LLE_EXCLUSIVE : 0;
1796 if (ln == NULL) {
1797 retry:
1798 IF_AFDATA_LOCK(ifp);
1799 ln = lla_lookup(LLTABLE6(ifp), flags, (struct sockaddr *)dst);
1800 IF_AFDATA_UNLOCK(ifp);
1801 if ((ln == NULL) && nd6_is_addr_neighbor(dst, ifp)) {
1802 /*
1803 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
1804 * the condition below is not very efficient. But we believe
1805 * it is tolerable, because this should be a rare case.
1806 */
1807 flags = ND6_CREATE | (m ? ND6_EXCLUSIVE : 0);
1808 IF_AFDATA_LOCK(ifp);
1809 ln = nd6_lookup(&dst->sin6_addr, flags, ifp);
1810 IF_AFDATA_UNLOCK(ifp);
1811 }
1812 }
1813 if (ln == NULL) {
1814 if ((ifp->if_flags & IFF_POINTOPOINT) == 0 &&
1815 !(ND_IFINFO(ifp)->flags & ND6_IFF_PERFORMNUD)) {
1816 char ip6buf[INET6_ADDRSTRLEN];
1817 log(LOG_DEBUG,
1818 "nd6_output: can't allocate llinfo for %s "
1819 "(ln=%p)\n",
1820 ip6_sprintf(ip6buf, &dst->sin6_addr), ln);
1821 senderr(EIO); /* XXX: good error? */
1822 }
1823 goto sendpkt; /* send anyway */
1824 }
1825
1826 /* We don't have to do link-layer address resolution on a p2p link. */
1827 if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
1828 ln->ln_state < ND6_LLINFO_REACHABLE) {
1829 if ((flags & LLE_EXCLUSIVE) == 0) {
1830 flags |= LLE_EXCLUSIVE;
1831 goto retry;
1832 }
1833 ln->ln_state = ND6_LLINFO_STALE;
1834 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
1835 }
1836
1837 /*
1838 * The first time we send a packet to a neighbor whose entry is
1839 * STALE, we have to change the state to DELAY and a sets a timer to
1840 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
1841 * neighbor unreachability detection on expiration.
1842 * (RFC 2461 7.3.3)
1843 */
1844 if (ln->ln_state == ND6_LLINFO_STALE) {
1845 if ((flags & LLE_EXCLUSIVE) == 0) {
1846 flags |= LLE_EXCLUSIVE;
1847 LLE_RUNLOCK(ln);
1848 goto retry;
1849 }
1850 ln->la_asked = 0;
1851 ln->ln_state = ND6_LLINFO_DELAY;
1852 nd6_llinfo_settimer_locked(ln, (long)V_nd6_delay * hz);
1853 }
1854
1855 /*
1856 * If the neighbor cache entry has a state other than INCOMPLETE
1857 * (i.e. its link-layer address is already resolved), just
1858 * send the packet.
1859 */
1860 if (ln->ln_state > ND6_LLINFO_INCOMPLETE)
1861 goto sendpkt;
1862
1863 /*
1864 * There is a neighbor cache entry, but no ethernet address
1865 * response yet. Append this latest packet to the end of the
1866 * packet queue in the mbuf, unless the number of the packet
1867 * does not exceed nd6_maxqueuelen. When it exceeds nd6_maxqueuelen,
1868 * the oldest packet in the queue will be removed.
1869 */
1870 if (ln->ln_state == ND6_LLINFO_NOSTATE)
1871 ln->ln_state = ND6_LLINFO_INCOMPLETE;
1872
1873 if ((flags & LLE_EXCLUSIVE) == 0) {
1874 flags |= LLE_EXCLUSIVE;
1875 LLE_RUNLOCK(ln);
1876 goto retry;
1877 }
1878 if (ln->la_hold) {
1879 struct mbuf *m_hold;
1880 int i;
1881
1882 i = 0;
1883 for (m_hold = ln->la_hold; m_hold; m_hold = m_hold->m_nextpkt) {
1884 i++;
1885 if (m_hold->m_nextpkt == NULL) {
1886 m_hold->m_nextpkt = m;
1887 break;
1888 }
1889 }
1890 while (i >= V_nd6_maxqueuelen) {
1891 m_hold = ln->la_hold;
1892 ln->la_hold = ln->la_hold->m_nextpkt;
1893 m_freem(m_hold);
1894 i--;
1895 }
1896 } else {
1897 ln->la_hold = m;
1898 }
1899 /*
1900 * We did the lookup (no lle arg) so we
1901 * need to do the unlock here
1902 */
1903 if (lle == NULL) {
1904 if (flags & LLE_EXCLUSIVE)
1905 LLE_WUNLOCK(ln);
1906 else
1907 LLE_RUNLOCK(ln);
1908 }
1909
1910 /*
1911 * If there has been no NS for the neighbor after entering the
1912 * INCOMPLETE state, send the first solicitation.
1913 */
1914 if (!ND6_LLINFO_PERMANENT(ln) && ln->la_asked == 0) {
1915 ln->la_asked++;
1916
1917 nd6_llinfo_settimer(ln,
1918 (long)ND_IFINFO(ifp)->retrans * hz / 1000);
1919 nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, 0);
1920 }
1921 return (0);
1922
1923 sendpkt:
1924 /* discard the packet if IPv6 operation is disabled on the interface */
1925 if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) {
1926 error = ENETDOWN; /* better error? */
1927 goto bad;
1928 }
1929 /*
1930 * ln is valid and the caller did not pass in
1931 * an llentry
1932 */
1933 if ((ln != NULL) && (lle == NULL)) {
1934 if (flags & LLE_EXCLUSIVE)
1935 LLE_WUNLOCK(ln);
1936 else
1937 LLE_RUNLOCK(ln);
1938 }
1939
1940#ifdef MAC
1941 mac_netinet6_nd6_send(ifp, m);
1942#endif
1943
1944 /*
1945 * If called from nd6_ns_output() (NS), nd6_na_output() (NA),
1946 * icmp6_redirect_output() (REDIRECT) or from rip6_output() (RS, RA
1947 * as handled by rtsol and rtadvd), mbufs will be tagged for SeND
1948 * to be diverted to user space. When re-injected into the kernel,
1949 * send_output() will directly dispatch them to the outgoing interface.
1950 */
1951 if (send_sendso_input_hook != NULL) {
1952 mtag = m_tag_find(m, PACKET_TAG_ND_OUTGOING, NULL);
1953 if (mtag != NULL) {
1954 ip6 = mtod(m, struct ip6_hdr *);
1955 ip6len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
1956 /* Use the SEND socket */
1957 error = send_sendso_input_hook(m, ifp, SND_OUT,
1958 ip6len);
1959 /* -1 == no app on SEND socket */
1960 if (error == 0 || error != -1)
1961 return (error);
1962 }
1963 }
1964
1965 /*
1966 * We were passed in a pointer to an lle with the lock held
1967 * this means that we can't call if_output as we will
1968 * recurse on the lle lock - so what we do is we create
1969 * a list of mbufs to send and transmit them in the caller
1970 * after the lock is dropped
1971 */
1972 if (lle != NULL) {
1973 if (*chain == NULL)
1974 *chain = m;
1975 else {
1976 struct mbuf *m = *chain;
1977
1978 /*
1979 * append mbuf to end of deferred chain
1980 */
1981 while (m->m_nextpkt != NULL)
1982 m = m->m_nextpkt;
1983 m->m_nextpkt = m;
1984 }
1985 return (error);
1986 }
1987 if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
1988 return ((*ifp->if_output)(origifp, m, (struct sockaddr *)dst,
1989 NULL));
1990 }
1991 error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, NULL);
1992 return (error);
1993
1994 bad:
1995 /*
1996 * ln is valid and the caller did not pass in
1997 * an llentry
1998 */
1999 if ((ln != NULL) && (lle == NULL)) {
2000 if (flags & LLE_EXCLUSIVE)
2001 LLE_WUNLOCK(ln);
2002 else
2003 LLE_RUNLOCK(ln);
2004 }
2005 if (m)
2006 m_freem(m);
2007 return (error);
2008}
2009#undef senderr
2010
2011
2012int
2013nd6_output_flush(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *chain,
2014 struct sockaddr_in6 *dst, struct route *ro)
2015{
2016 struct mbuf *m, *m_head;
2017 struct ifnet *outifp;
2018 int error = 0;
2019
2020 m_head = chain;
2021 if ((ifp->if_flags & IFF_LOOPBACK) != 0)
2022 outifp = origifp;
2023 else
2024 outifp = ifp;
2025
2026 while (m_head) {
2027 m = m_head;
2028 m_head = m_head->m_nextpkt;
2029 error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, ro);
2030 }
2031
2032 /*
2033 * XXX
2034 * note that intermediate errors are blindly ignored - but this is
2035 * the same convention as used with nd6_output when called by
2036 * nd6_cache_lladdr
2037 */
2038 return (error);
2039}
2040
2041
2042int
2043nd6_need_cache(struct ifnet *ifp)
2044{
2045 /*
2046 * XXX: we currently do not make neighbor cache on any interface
2047 * other than ARCnet, Ethernet, FDDI and GIF.
2048 *
2049 * RFC2893 says:
2050 * - unidirectional tunnels needs no ND
2051 */
2052 switch (ifp->if_type) {
2053 case IFT_ARCNET:
2054 case IFT_ETHER:
2055 case IFT_FDDI:
2056 case IFT_IEEE1394:
2057#ifdef IFT_L2VLAN
2058 case IFT_L2VLAN:
2059#endif
2060#ifdef IFT_IEEE80211
2061 case IFT_IEEE80211:
2062#endif
2063#ifdef IFT_CARP
2064 case IFT_CARP:
2065#endif
2066 case IFT_GIF: /* XXX need more cases? */
2067 case IFT_PPP:
2068 case IFT_TUNNEL:
2069 case IFT_BRIDGE:
2070 case IFT_PROPVIRTUAL:
2071 return (1);
2072 default:
2073 return (0);
2074 }
2075}
2076
2077/*
2078 * the callers of this function need to be re-worked to drop
2079 * the lle lock, drop here for now
2080 */
2081int
2082nd6_storelladdr(struct ifnet *ifp, struct mbuf *m,
2083 struct sockaddr *dst, u_char *desten, struct llentry **lle)
2084{
2085 struct llentry *ln;
2086
2087 *lle = NULL;
2088 IF_AFDATA_UNLOCK_ASSERT(ifp);
2089 if (m->m_flags & M_MCAST) {
2090 int i;
2091
2092 switch (ifp->if_type) {
2093 case IFT_ETHER:
2094 case IFT_FDDI:
2095#ifdef IFT_L2VLAN
2096 case IFT_L2VLAN:
2097#endif
2098#ifdef IFT_IEEE80211
2099 case IFT_IEEE80211:
2100#endif
2101 case IFT_BRIDGE:
2102 case IFT_ISO88025:
2103 ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr,
2104 desten);
2105 return (0);
2106 case IFT_IEEE1394:
2107 /*
2108 * netbsd can use if_broadcastaddr, but we don't do so
2109 * to reduce # of ifdef.
2110 */
2111 for (i = 0; i < ifp->if_addrlen; i++)
2112 desten[i] = ~0;
2113 return (0);
2114 case IFT_ARCNET:
2115 *desten = 0;
2116 return (0);
2117 default:
2118 m_freem(m);
2119 return (EAFNOSUPPORT);
2120 }
2121 }
2122
2123
2124 /*
2125 * the entry should have been created in nd6_store_lladdr
2126 */
2127 IF_AFDATA_LOCK(ifp);
2128 ln = lla_lookup(LLTABLE6(ifp), 0, dst);
2129 IF_AFDATA_UNLOCK(ifp);
2130 if ((ln == NULL) || !(ln->la_flags & LLE_VALID)) {
2131 if (ln != NULL)
2132 LLE_RUNLOCK(ln);
2133 /* this could happen, if we could not allocate memory */
2134 m_freem(m);
2135 return (1);
2136 }
2137
2138 bcopy(&ln->ll_addr, desten, ifp->if_addrlen);
2139 *lle = ln;
2140 LLE_RUNLOCK(ln);
2141 /*
2142 * A *small* use after free race exists here
2143 */
2144 return (0);
2145}
2146
2147static void
2148clear_llinfo_pqueue(struct llentry *ln)
2149{
2150 struct mbuf *m_hold, *m_hold_next;
2151
2152 for (m_hold = ln->la_hold; m_hold; m_hold = m_hold_next) {
2153 m_hold_next = m_hold->m_nextpkt;
2154 m_hold->m_nextpkt = NULL;
2155 m_freem(m_hold);
2156 }
2157
2158 ln->la_hold = NULL;
2159 return;
2160}
2161
2162static int nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS);
2163static int nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS);
2164#ifdef SYSCTL_DECL
2165SYSCTL_DECL(_net_inet6_icmp6);
2166#endif
2167SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_DRLIST, nd6_drlist,
2168 CTLFLAG_RD, nd6_sysctl_drlist, "");
2169SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_PRLIST, nd6_prlist,
2170 CTLFLAG_RD, nd6_sysctl_prlist, "");
2171SYSCTL_VNET_INT(_net_inet6_icmp6, ICMPV6CTL_ND6_MAXQLEN, nd6_maxqueuelen,
2172 CTLFLAG_RW, &VNET_NAME(nd6_maxqueuelen), 1, "");
2173
2174static int
2175nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS)
2176{
2177 int error;
2178 char buf[1024] __aligned(4);
2179 struct in6_defrouter *d, *de;
2180 struct nd_defrouter *dr;
2181
2182 if (req->newptr)
2183 return EPERM;
2184 error = 0;
2185
2186 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
2187 dr = TAILQ_NEXT(dr, dr_entry)) {
2188 d = (struct in6_defrouter *)buf;
2189 de = (struct in6_defrouter *)(buf + sizeof(buf));
2190
2191 if (d + 1 <= de) {
2192 bzero(d, sizeof(*d));
2193 d->rtaddr.sin6_family = AF_INET6;
2194 d->rtaddr.sin6_len = sizeof(d->rtaddr);
2195 d->rtaddr.sin6_addr = dr->rtaddr;
2196 error = sa6_recoverscope(&d->rtaddr);
2197 if (error != 0)
2198 return (error);
2199 d->flags = dr->flags;
2200 d->rtlifetime = dr->rtlifetime;
2201 d->expire = dr->expire;
2202 d->if_index = dr->ifp->if_index;
2203 } else
2204 panic("buffer too short");
2205
2206 error = SYSCTL_OUT(req, buf, sizeof(*d));
2207 if (error)
2208 break;
2209 }
2210
2211 return (error);
2212}
2213
2214static int
2215nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS)
2216{
2217 int error;
2218 char buf[1024] __aligned(4);
2219 struct in6_prefix *p, *pe;
2220 struct nd_prefix *pr;
2221 char ip6buf[INET6_ADDRSTRLEN];
2222
2223 if (req->newptr)
2224 return EPERM;
2225 error = 0;
2226
2227 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
2228 u_short advrtrs;
2229 size_t advance;
2230 struct sockaddr_in6 *sin6, *s6;
2231 struct nd_pfxrouter *pfr;
2232
2233 p = (struct in6_prefix *)buf;
2234 pe = (struct in6_prefix *)(buf + sizeof(buf));
2235
2236 if (p + 1 <= pe) {
2237 bzero(p, sizeof(*p));
2238 sin6 = (struct sockaddr_in6 *)(p + 1);
2239
2240 p->prefix = pr->ndpr_prefix;
2241 if (sa6_recoverscope(&p->prefix)) {
2242 log(LOG_ERR,
2243 "scope error in prefix list (%s)\n",
2244 ip6_sprintf(ip6buf, &p->prefix.sin6_addr));
2245 /* XXX: press on... */
2246 }
2247 p->raflags = pr->ndpr_raf;
2248 p->prefixlen = pr->ndpr_plen;
2249 p->vltime = pr->ndpr_vltime;
2250 p->pltime = pr->ndpr_pltime;
2251 p->if_index = pr->ndpr_ifp->if_index;
2252 if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
2253 p->expire = 0;
2254 else {
2255 time_t maxexpire;
2256
2257 /* XXX: we assume time_t is signed. */
2258 maxexpire = (-1) &
2259 ~((time_t)1 <<
2260 ((sizeof(maxexpire) * 8) - 1));
2261 if (pr->ndpr_vltime <
2262 maxexpire - pr->ndpr_lastupdate) {
2263 p->expire = pr->ndpr_lastupdate +
2264 pr->ndpr_vltime;
2265 } else
2266 p->expire = maxexpire;
2267 }
2268 p->refcnt = pr->ndpr_refcnt;
2269 p->flags = pr->ndpr_stateflags;
2270 p->origin = PR_ORIG_RA;
2271 advrtrs = 0;
2272 for (pfr = pr->ndpr_advrtrs.lh_first; pfr;
2273 pfr = pfr->pfr_next) {
2274 if ((void *)&sin6[advrtrs + 1] > (void *)pe) {
2275 advrtrs++;
2276 continue;
2277 }
2278 s6 = &sin6[advrtrs];
2279 bzero(s6, sizeof(*s6));
2280 s6->sin6_family = AF_INET6;
2281 s6->sin6_len = sizeof(*sin6);
2282 s6->sin6_addr = pfr->router->rtaddr;
2283 if (sa6_recoverscope(s6)) {
2284 log(LOG_ERR,
2285 "scope error in "
2286 "prefix list (%s)\n",
2287 ip6_sprintf(ip6buf,
2288 &pfr->router->rtaddr));
2289 }
2290 advrtrs++;
2291 }
2292 p->advrtrs = advrtrs;
2293 } else
2294 panic("buffer too short");
2295
2296 advance = sizeof(*p) + sizeof(*sin6) * advrtrs;
2297 error = SYSCTL_OUT(req, buf, advance);
2298 if (error)
2299 break;
2300 }
2301
2302 return (error);
2303}
| 137#define V_nd6_slowtimo_ch VNET(nd6_slowtimo_ch)
138
139VNET_DEFINE(struct callout, nd6_timer_ch);
140
141void
142nd6_init(void)
143{
144 int i;
145
146 LIST_INIT(&V_nd_prefix);
147
148 all1_sa.sin6_family = AF_INET6;
149 all1_sa.sin6_len = sizeof(struct sockaddr_in6);
150 for (i = 0; i < sizeof(all1_sa.sin6_addr); i++)
151 all1_sa.sin6_addr.s6_addr[i] = 0xff;
152
153 /* initialization of the default router list */
154 TAILQ_INIT(&V_nd_defrouter);
155
156 /* start timer */
157 callout_init(&V_nd6_slowtimo_ch, 0);
158 callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
159 nd6_slowtimo, curvnet);
160}
161
162#ifdef VIMAGE
163void
164nd6_destroy()
165{
166
167 callout_drain(&V_nd6_slowtimo_ch);
168 callout_drain(&V_nd6_timer_ch);
169}
170#endif
171
172struct nd_ifinfo *
173nd6_ifattach(struct ifnet *ifp)
174{
175 struct nd_ifinfo *nd;
176
177 nd = (struct nd_ifinfo *)malloc(sizeof(*nd), M_IP6NDP, M_WAITOK);
178 bzero(nd, sizeof(*nd));
179
180 nd->initialized = 1;
181
182 nd->chlim = IPV6_DEFHLIM;
183 nd->basereachable = REACHABLE_TIME;
184 nd->reachable = ND_COMPUTE_RTIME(nd->basereachable);
185 nd->retrans = RETRANS_TIMER;
186
187 nd->flags = ND6_IFF_PERFORMNUD;
188
189 /* A loopback interface always has ND6_IFF_AUTO_LINKLOCAL. */
190 if (V_ip6_auto_linklocal || (ifp->if_flags & IFF_LOOPBACK))
191 nd->flags |= ND6_IFF_AUTO_LINKLOCAL;
192
193 /* A loopback interface does not need to accept RTADV. */
194 if (V_ip6_accept_rtadv && !(ifp->if_flags & IFF_LOOPBACK))
195 nd->flags |= ND6_IFF_ACCEPT_RTADV;
196
197 /* XXX: we cannot call nd6_setmtu since ifp is not fully initialized */
198 nd6_setmtu0(ifp, nd);
199
200 return nd;
201}
202
203void
204nd6_ifdetach(struct nd_ifinfo *nd)
205{
206
207 free(nd, M_IP6NDP);
208}
209
210/*
211 * Reset ND level link MTU. This function is called when the physical MTU
212 * changes, which means we might have to adjust the ND level MTU.
213 */
214void
215nd6_setmtu(struct ifnet *ifp)
216{
217
218 nd6_setmtu0(ifp, ND_IFINFO(ifp));
219}
220
221/* XXX todo: do not maintain copy of ifp->if_mtu in ndi->maxmtu */
222void
223nd6_setmtu0(struct ifnet *ifp, struct nd_ifinfo *ndi)
224{
225 u_int32_t omaxmtu;
226
227 omaxmtu = ndi->maxmtu;
228
229 switch (ifp->if_type) {
230 case IFT_ARCNET:
231 ndi->maxmtu = MIN(ARC_PHDS_MAXMTU, ifp->if_mtu); /* RFC2497 */
232 break;
233 case IFT_FDDI:
234 ndi->maxmtu = MIN(FDDIIPMTU, ifp->if_mtu); /* RFC2467 */
235 break;
236 case IFT_ISO88025:
237 ndi->maxmtu = MIN(ISO88025_MAX_MTU, ifp->if_mtu);
238 break;
239 default:
240 ndi->maxmtu = ifp->if_mtu;
241 break;
242 }
243
244 /*
245 * Decreasing the interface MTU under IPV6 minimum MTU may cause
246 * undesirable situation. We thus notify the operator of the change
247 * explicitly. The check for omaxmtu is necessary to restrict the
248 * log to the case of changing the MTU, not initializing it.
249 */
250 if (omaxmtu >= IPV6_MMTU && ndi->maxmtu < IPV6_MMTU) {
251 log(LOG_NOTICE, "nd6_setmtu0: "
252 "new link MTU on %s (%lu) is too small for IPv6\n",
253 if_name(ifp), (unsigned long)ndi->maxmtu);
254 }
255
256 if (ndi->maxmtu > V_in6_maxmtu)
257 in6_setmaxmtu(); /* check all interfaces just in case */
258
259}
260
261void
262nd6_option_init(void *opt, int icmp6len, union nd_opts *ndopts)
263{
264
265 bzero(ndopts, sizeof(*ndopts));
266 ndopts->nd_opts_search = (struct nd_opt_hdr *)opt;
267 ndopts->nd_opts_last
268 = (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len);
269
270 if (icmp6len == 0) {
271 ndopts->nd_opts_done = 1;
272 ndopts->nd_opts_search = NULL;
273 }
274}
275
276/*
277 * Take one ND option.
278 */
279struct nd_opt_hdr *
280nd6_option(union nd_opts *ndopts)
281{
282 struct nd_opt_hdr *nd_opt;
283 int olen;
284
285 if (ndopts == NULL)
286 panic("ndopts == NULL in nd6_option");
287 if (ndopts->nd_opts_last == NULL)
288 panic("uninitialized ndopts in nd6_option");
289 if (ndopts->nd_opts_search == NULL)
290 return NULL;
291 if (ndopts->nd_opts_done)
292 return NULL;
293
294 nd_opt = ndopts->nd_opts_search;
295
296 /* make sure nd_opt_len is inside the buffer */
297 if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) {
298 bzero(ndopts, sizeof(*ndopts));
299 return NULL;
300 }
301
302 olen = nd_opt->nd_opt_len << 3;
303 if (olen == 0) {
304 /*
305 * Message validation requires that all included
306 * options have a length that is greater than zero.
307 */
308 bzero(ndopts, sizeof(*ndopts));
309 return NULL;
310 }
311
312 ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);
313 if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
314 /* option overruns the end of buffer, invalid */
315 bzero(ndopts, sizeof(*ndopts));
316 return NULL;
317 } else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
318 /* reached the end of options chain */
319 ndopts->nd_opts_done = 1;
320 ndopts->nd_opts_search = NULL;
321 }
322 return nd_opt;
323}
324
325/*
326 * Parse multiple ND options.
327 * This function is much easier to use, for ND routines that do not need
328 * multiple options of the same type.
329 */
330int
331nd6_options(union nd_opts *ndopts)
332{
333 struct nd_opt_hdr *nd_opt;
334 int i = 0;
335
336 if (ndopts == NULL)
337 panic("ndopts == NULL in nd6_options");
338 if (ndopts->nd_opts_last == NULL)
339 panic("uninitialized ndopts in nd6_options");
340 if (ndopts->nd_opts_search == NULL)
341 return 0;
342
343 while (1) {
344 nd_opt = nd6_option(ndopts);
345 if (nd_opt == NULL && ndopts->nd_opts_last == NULL) {
346 /*
347 * Message validation requires that all included
348 * options have a length that is greater than zero.
349 */
350 ICMP6STAT_INC(icp6s_nd_badopt);
351 bzero(ndopts, sizeof(*ndopts));
352 return -1;
353 }
354
355 if (nd_opt == NULL)
356 goto skip1;
357
358 switch (nd_opt->nd_opt_type) {
359 case ND_OPT_SOURCE_LINKADDR:
360 case ND_OPT_TARGET_LINKADDR:
361 case ND_OPT_MTU:
362 case ND_OPT_REDIRECTED_HEADER:
363 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
364 nd6log((LOG_INFO,
365 "duplicated ND6 option found (type=%d)\n",
366 nd_opt->nd_opt_type));
367 /* XXX bark? */
368 } else {
369 ndopts->nd_opt_array[nd_opt->nd_opt_type]
370 = nd_opt;
371 }
372 break;
373 case ND_OPT_PREFIX_INFORMATION:
374 if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) {
375 ndopts->nd_opt_array[nd_opt->nd_opt_type]
376 = nd_opt;
377 }
378 ndopts->nd_opts_pi_end =
379 (struct nd_opt_prefix_info *)nd_opt;
380 break;
381 default:
382 /*
383 * Unknown options must be silently ignored,
384 * to accomodate future extension to the protocol.
385 */
386 nd6log((LOG_DEBUG,
387 "nd6_options: unsupported option %d - "
388 "option ignored\n", nd_opt->nd_opt_type));
389 }
390
391skip1:
392 i++;
393 if (i > V_nd6_maxndopt) {
394 ICMP6STAT_INC(icp6s_nd_toomanyopt);
395 nd6log((LOG_INFO, "too many loop in nd opt\n"));
396 break;
397 }
398
399 if (ndopts->nd_opts_done)
400 break;
401 }
402
403 return 0;
404}
405
406/*
407 * ND6 timer routine to handle ND6 entries
408 */
409void
410nd6_llinfo_settimer_locked(struct llentry *ln, long tick)
411{
412 int canceled;
413
414 if (tick < 0) {
415 ln->la_expire = 0;
416 ln->ln_ntick = 0;
417 canceled = callout_stop(&ln->ln_timer_ch);
418 } else {
419 ln->la_expire = time_second + tick / hz;
420 LLE_ADDREF(ln);
421 if (tick > INT_MAX) {
422 ln->ln_ntick = tick - INT_MAX;
423 canceled = callout_reset(&ln->ln_timer_ch, INT_MAX,
424 nd6_llinfo_timer, ln);
425 } else {
426 ln->ln_ntick = 0;
427 canceled = callout_reset(&ln->ln_timer_ch, tick,
428 nd6_llinfo_timer, ln);
429 }
430 }
431 if (canceled)
432 LLE_REMREF(ln);
433}
434
435void
436nd6_llinfo_settimer(struct llentry *ln, long tick)
437{
438
439 LLE_WLOCK(ln);
440 nd6_llinfo_settimer_locked(ln, tick);
441 LLE_WUNLOCK(ln);
442}
443
444static void
445nd6_llinfo_timer(void *arg)
446{
447 struct llentry *ln;
448 struct in6_addr *dst;
449 struct ifnet *ifp;
450 struct nd_ifinfo *ndi = NULL;
451
452 KASSERT(arg != NULL, ("%s: arg NULL", __func__));
453 ln = (struct llentry *)arg;
454 ifp = ln->lle_tbl->llt_ifp;
455
456 CURVNET_SET(ifp->if_vnet);
457
458 if (ln->ln_ntick > 0) {
459 if (ln->ln_ntick > INT_MAX) {
460 ln->ln_ntick -= INT_MAX;
461 nd6_llinfo_settimer(ln, INT_MAX);
462 } else {
463 ln->ln_ntick = 0;
464 nd6_llinfo_settimer(ln, ln->ln_ntick);
465 }
466 goto done;
467 }
468
469 ndi = ND_IFINFO(ifp);
470 dst = &L3_ADDR_SIN6(ln)->sin6_addr;
471 if (ln->la_flags & LLE_STATIC) {
472 goto done;
473 }
474
475 if (ln->la_flags & LLE_DELETED) {
476 (void)nd6_free(ln, 0);
477 ln = NULL;
478 goto done;
479 }
480
481 switch (ln->ln_state) {
482 case ND6_LLINFO_INCOMPLETE:
483 if (ln->la_asked < V_nd6_mmaxtries) {
484 ln->la_asked++;
485 nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
486 nd6_ns_output(ifp, NULL, dst, ln, 0);
487 } else {
488 struct mbuf *m = ln->la_hold;
489 if (m) {
490 struct mbuf *m0;
491
492 /*
493 * assuming every packet in la_hold has the
494 * same IP header
495 */
496 m0 = m->m_nextpkt;
497 m->m_nextpkt = NULL;
498 icmp6_error2(m, ICMP6_DST_UNREACH,
499 ICMP6_DST_UNREACH_ADDR, 0, ifp);
500
501 ln->la_hold = m0;
502 clear_llinfo_pqueue(ln);
503 }
504 (void)nd6_free(ln, 0);
505 ln = NULL;
506 }
507 break;
508 case ND6_LLINFO_REACHABLE:
509 if (!ND6_LLINFO_PERMANENT(ln)) {
510 ln->ln_state = ND6_LLINFO_STALE;
511 nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
512 }
513 break;
514
515 case ND6_LLINFO_STALE:
516 /* Garbage Collection(RFC 2461 5.3) */
517 if (!ND6_LLINFO_PERMANENT(ln)) {
518 (void)nd6_free(ln, 1);
519 ln = NULL;
520 }
521 break;
522
523 case ND6_LLINFO_DELAY:
524 if (ndi && (ndi->flags & ND6_IFF_PERFORMNUD) != 0) {
525 /* We need NUD */
526 ln->la_asked = 1;
527 ln->ln_state = ND6_LLINFO_PROBE;
528 nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
529 nd6_ns_output(ifp, dst, dst, ln, 0);
530 } else {
531 ln->ln_state = ND6_LLINFO_STALE; /* XXX */
532 nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
533 }
534 break;
535 case ND6_LLINFO_PROBE:
536 if (ln->la_asked < V_nd6_umaxtries) {
537 ln->la_asked++;
538 nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
539 nd6_ns_output(ifp, dst, dst, ln, 0);
540 } else {
541 (void)nd6_free(ln, 0);
542 ln = NULL;
543 }
544 break;
545 }
546done:
547 if (ln != NULL)
548 LLE_FREE(ln);
549 CURVNET_RESTORE();
550}
551
552
553/*
554 * ND6 timer routine to expire default route list and prefix list
555 */
556void
557nd6_timer(void *arg)
558{
559 CURVNET_SET((struct vnet *) arg);
560 int s;
561 struct nd_defrouter *dr;
562 struct nd_prefix *pr;
563 struct in6_ifaddr *ia6, *nia6;
564 struct in6_addrlifetime *lt6;
565
566 callout_reset(&V_nd6_timer_ch, V_nd6_prune * hz,
567 nd6_timer, curvnet);
568
569 /* expire default router list */
570 s = splnet();
571 dr = TAILQ_FIRST(&V_nd_defrouter);
572 while (dr) {
573 if (dr->expire && dr->expire < time_second) {
574 struct nd_defrouter *t;
575 t = TAILQ_NEXT(dr, dr_entry);
576 defrtrlist_del(dr);
577 dr = t;
578 } else {
579 dr = TAILQ_NEXT(dr, dr_entry);
580 }
581 }
582
583 /*
584 * expire interface addresses.
585 * in the past the loop was inside prefix expiry processing.
586 * However, from a stricter speci-confrmance standpoint, we should
587 * rather separate address lifetimes and prefix lifetimes.
588 *
589 * XXXRW: in6_ifaddrhead locking.
590 */
591 addrloop:
592 TAILQ_FOREACH_SAFE(ia6, &V_in6_ifaddrhead, ia_link, nia6) {
593 /* check address lifetime */
594 lt6 = &ia6->ia6_lifetime;
595 if (IFA6_IS_INVALID(ia6)) {
596 int regen = 0;
597
598 /*
599 * If the expiring address is temporary, try
600 * regenerating a new one. This would be useful when
601 * we suspended a laptop PC, then turned it on after a
602 * period that could invalidate all temporary
603 * addresses. Although we may have to restart the
604 * loop (see below), it must be after purging the
605 * address. Otherwise, we'd see an infinite loop of
606 * regeneration.
607 */
608 if (V_ip6_use_tempaddr &&
609 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
610 if (regen_tmpaddr(ia6) == 0)
611 regen = 1;
612 }
613
614 in6_purgeaddr(&ia6->ia_ifa);
615
616 if (regen)
617 goto addrloop; /* XXX: see below */
618 } else if (IFA6_IS_DEPRECATED(ia6)) {
619 int oldflags = ia6->ia6_flags;
620
621 ia6->ia6_flags |= IN6_IFF_DEPRECATED;
622
623 /*
624 * If a temporary address has just become deprecated,
625 * regenerate a new one if possible.
626 */
627 if (V_ip6_use_tempaddr &&
628 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
629 (oldflags & IN6_IFF_DEPRECATED) == 0) {
630
631 if (regen_tmpaddr(ia6) == 0) {
632 /*
633 * A new temporary address is
634 * generated.
635 * XXX: this means the address chain
636 * has changed while we are still in
637 * the loop. Although the change
638 * would not cause disaster (because
639 * it's not a deletion, but an
640 * addition,) we'd rather restart the
641 * loop just for safety. Or does this
642 * significantly reduce performance??
643 */
644 goto addrloop;
645 }
646 }
647 } else {
648 /*
649 * A new RA might have made a deprecated address
650 * preferred.
651 */
652 ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;
653 }
654 }
655
656 /* expire prefix list */
657 pr = V_nd_prefix.lh_first;
658 while (pr) {
659 /*
660 * check prefix lifetime.
661 * since pltime is just for autoconf, pltime processing for
662 * prefix is not necessary.
663 */
664 if (pr->ndpr_vltime != ND6_INFINITE_LIFETIME &&
665 time_second - pr->ndpr_lastupdate > pr->ndpr_vltime) {
666 struct nd_prefix *t;
667 t = pr->ndpr_next;
668
669 /*
670 * address expiration and prefix expiration are
671 * separate. NEVER perform in6_purgeaddr here.
672 */
673
674 prelist_remove(pr);
675 pr = t;
676 } else
677 pr = pr->ndpr_next;
678 }
679 splx(s);
680 CURVNET_RESTORE();
681}
682
683/*
684 * ia6 - deprecated/invalidated temporary address
685 */
686static int
687regen_tmpaddr(struct in6_ifaddr *ia6)
688{
689 struct ifaddr *ifa;
690 struct ifnet *ifp;
691 struct in6_ifaddr *public_ifa6 = NULL;
692
693 ifp = ia6->ia_ifa.ifa_ifp;
694 IF_ADDR_LOCK(ifp);
695 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
696 struct in6_ifaddr *it6;
697
698 if (ifa->ifa_addr->sa_family != AF_INET6)
699 continue;
700
701 it6 = (struct in6_ifaddr *)ifa;
702
703 /* ignore no autoconf addresses. */
704 if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0)
705 continue;
706
707 /* ignore autoconf addresses with different prefixes. */
708 if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr)
709 continue;
710
711 /*
712 * Now we are looking at an autoconf address with the same
713 * prefix as ours. If the address is temporary and is still
714 * preferred, do not create another one. It would be rare, but
715 * could happen, for example, when we resume a laptop PC after
716 * a long period.
717 */
718 if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
719 !IFA6_IS_DEPRECATED(it6)) {
720 public_ifa6 = NULL;
721 break;
722 }
723
724 /*
725 * This is a public autoconf address that has the same prefix
726 * as ours. If it is preferred, keep it. We can't break the
727 * loop here, because there may be a still-preferred temporary
728 * address with the prefix.
729 */
730 if (!IFA6_IS_DEPRECATED(it6))
731 public_ifa6 = it6;
732
733 if (public_ifa6 != NULL)
734 ifa_ref(&public_ifa6->ia_ifa);
735 }
736 IF_ADDR_UNLOCK(ifp);
737
738 if (public_ifa6 != NULL) {
739 int e;
740
741 if ((e = in6_tmpifadd(public_ifa6, 0, 0)) != 0) {
742 ifa_free(&public_ifa6->ia_ifa);
743 log(LOG_NOTICE, "regen_tmpaddr: failed to create a new"
744 " tmp addr,errno=%d\n", e);
745 return (-1);
746 }
747 ifa_free(&public_ifa6->ia_ifa);
748 return (0);
749 }
750
751 return (-1);
752}
753
754/*
755 * Nuke neighbor cache/prefix/default router management table, right before
756 * ifp goes away.
757 */
758void
759nd6_purge(struct ifnet *ifp)
760{
761 struct nd_defrouter *dr, *ndr;
762 struct nd_prefix *pr, *npr;
763
764 /*
765 * Nuke default router list entries toward ifp.
766 * We defer removal of default router list entries that is installed
767 * in the routing table, in order to keep additional side effects as
768 * small as possible.
769 */
770 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
771 ndr = TAILQ_NEXT(dr, dr_entry);
772 if (dr->installed)
773 continue;
774
775 if (dr->ifp == ifp)
776 defrtrlist_del(dr);
777 }
778
779 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
780 ndr = TAILQ_NEXT(dr, dr_entry);
781 if (!dr->installed)
782 continue;
783
784 if (dr->ifp == ifp)
785 defrtrlist_del(dr);
786 }
787
788 /* Nuke prefix list entries toward ifp */
789 for (pr = V_nd_prefix.lh_first; pr; pr = npr) {
790 npr = pr->ndpr_next;
791 if (pr->ndpr_ifp == ifp) {
792 /*
793 * Because if_detach() does *not* release prefixes
794 * while purging addresses the reference count will
795 * still be above zero. We therefore reset it to
796 * make sure that the prefix really gets purged.
797 */
798 pr->ndpr_refcnt = 0;
799
800 /*
801 * Previously, pr->ndpr_addr is removed as well,
802 * but I strongly believe we don't have to do it.
803 * nd6_purge() is only called from in6_ifdetach(),
804 * which removes all the associated interface addresses
805 * by itself.
806 * (jinmei@kame.net 20010129)
807 */
808 prelist_remove(pr);
809 }
810 }
811
812 /* cancel default outgoing interface setting */
813 if (V_nd6_defifindex == ifp->if_index)
814 nd6_setdefaultiface(0);
815
816 if (!V_ip6_forwarding && ND_IFINFO(ifp)->flags & ND6_IFF_ACCEPT_RTADV) {
817 /* Refresh default router list. */
818 defrouter_select();
819 }
820
821 /* XXXXX
822 * We do not nuke the neighbor cache entries here any more
823 * because the neighbor cache is kept in if_afdata[AF_INET6].
824 * nd6_purge() is invoked by in6_ifdetach() which is called
825 * from if_detach() where everything gets purged. So let
826 * in6_domifdetach() do the actual L2 table purging work.
827 */
828}
829
830/*
831 * the caller acquires and releases the lock on the lltbls
832 * Returns the llentry locked
833 */
834struct llentry *
835nd6_lookup(struct in6_addr *addr6, int flags, struct ifnet *ifp)
836{
837 struct sockaddr_in6 sin6;
838 struct llentry *ln;
839 int llflags;
840
841 bzero(&sin6, sizeof(sin6));
842 sin6.sin6_len = sizeof(struct sockaddr_in6);
843 sin6.sin6_family = AF_INET6;
844 sin6.sin6_addr = *addr6;
845
846 IF_AFDATA_LOCK_ASSERT(ifp);
847
848 llflags = 0;
849 if (flags & ND6_CREATE)
850 llflags |= LLE_CREATE;
851 if (flags & ND6_EXCLUSIVE)
852 llflags |= LLE_EXCLUSIVE;
853
854 ln = lla_lookup(LLTABLE6(ifp), llflags, (struct sockaddr *)&sin6);
855 if ((ln != NULL) && (llflags & LLE_CREATE))
856 ln->ln_state = ND6_LLINFO_NOSTATE;
857
858 return (ln);
859}
860
861/*
862 * Test whether a given IPv6 address is a neighbor or not, ignoring
863 * the actual neighbor cache. The neighbor cache is ignored in order
864 * to not reenter the routing code from within itself.
865 */
866static int
867nd6_is_new_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
868{
869 struct nd_prefix *pr;
870 struct ifaddr *dstaddr;
871
872 /*
873 * A link-local address is always a neighbor.
874 * XXX: a link does not necessarily specify a single interface.
875 */
876 if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr)) {
877 struct sockaddr_in6 sin6_copy;
878 u_int32_t zone;
879
880 /*
881 * We need sin6_copy since sa6_recoverscope() may modify the
882 * content (XXX).
883 */
884 sin6_copy = *addr;
885 if (sa6_recoverscope(&sin6_copy))
886 return (0); /* XXX: should be impossible */
887 if (in6_setscope(&sin6_copy.sin6_addr, ifp, &zone))
888 return (0);
889 if (sin6_copy.sin6_scope_id == zone)
890 return (1);
891 else
892 return (0);
893 }
894
895 /*
896 * If the address matches one of our addresses,
897 * it should be a neighbor.
898 * If the address matches one of our on-link prefixes, it should be a
899 * neighbor.
900 */
901 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
902 if (pr->ndpr_ifp != ifp)
903 continue;
904
905 if (!(pr->ndpr_stateflags & NDPRF_ONLINK)) {
906 struct rtentry *rt;
907 rt = rtalloc1((struct sockaddr *)&pr->ndpr_prefix, 0, 0);
908 if (rt == NULL)
909 continue;
910 /*
911 * This is the case where multiple interfaces
912 * have the same prefix, but only one is installed
913 * into the routing table and that prefix entry
914 * is not the one being examined here. In the case
915 * where RADIX_MPATH is enabled, multiple route
916 * entries (of the same rt_key value) will be
917 * installed because the interface addresses all
918 * differ.
919 */
920 if (!IN6_ARE_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
921 &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr)) {
922 RTFREE_LOCKED(rt);
923 continue;
924 }
925 RTFREE_LOCKED(rt);
926 }
927
928 if (IN6_ARE_MASKED_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
929 &addr->sin6_addr, &pr->ndpr_mask))
930 return (1);
931 }
932
933 /*
934 * If the address is assigned on the node of the other side of
935 * a p2p interface, the address should be a neighbor.
936 */
937 dstaddr = ifa_ifwithdstaddr((struct sockaddr *)addr);
938 if (dstaddr != NULL) {
939 if (dstaddr->ifa_ifp == ifp) {
940 ifa_free(dstaddr);
941 return (1);
942 }
943 ifa_free(dstaddr);
944 }
945
946 /*
947 * If the default router list is empty, all addresses are regarded
948 * as on-link, and thus, as a neighbor.
949 * XXX: we restrict the condition to hosts, because routers usually do
950 * not have the "default router list".
951 */
952 if (!V_ip6_forwarding && TAILQ_FIRST(&V_nd_defrouter) == NULL &&
953 V_nd6_defifindex == ifp->if_index) {
954 return (1);
955 }
956
957 return (0);
958}
959
960
961/*
962 * Detect if a given IPv6 address identifies a neighbor on a given link.
963 * XXX: should take care of the destination of a p2p link?
964 */
965int
966nd6_is_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
967{
968 struct llentry *lle;
969 int rc = 0;
970
971 IF_AFDATA_UNLOCK_ASSERT(ifp);
972 if (nd6_is_new_addr_neighbor(addr, ifp))
973 return (1);
974
975 /*
976 * Even if the address matches none of our addresses, it might be
977 * in the neighbor cache.
978 */
979 IF_AFDATA_LOCK(ifp);
980 if ((lle = nd6_lookup(&addr->sin6_addr, 0, ifp)) != NULL) {
981 LLE_RUNLOCK(lle);
982 rc = 1;
983 }
984 IF_AFDATA_UNLOCK(ifp);
985 return (rc);
986}
987
988/*
989 * Free an nd6 llinfo entry.
990 * Since the function would cause significant changes in the kernel, DO NOT
991 * make it global, unless you have a strong reason for the change, and are sure
992 * that the change is safe.
993 */
994static struct llentry *
995nd6_free(struct llentry *ln, int gc)
996{
997 struct llentry *next;
998 struct nd_defrouter *dr;
999 struct ifnet *ifp=NULL;
1000
1001 /*
1002 * we used to have pfctlinput(PRC_HOSTDEAD) here.
1003 * even though it is not harmful, it was not really necessary.
1004 */
1005
1006 /* cancel timer */
1007 nd6_llinfo_settimer(ln, -1);
1008
1009 if (!V_ip6_forwarding) {
1010 int s;
1011 s = splnet();
1012 dr = defrouter_lookup(&L3_ADDR_SIN6(ln)->sin6_addr, ln->lle_tbl->llt_ifp);
1013
1014 if (dr != NULL && dr->expire &&
1015 ln->ln_state == ND6_LLINFO_STALE && gc) {
1016 /*
1017 * If the reason for the deletion is just garbage
1018 * collection, and the neighbor is an active default
1019 * router, do not delete it. Instead, reset the GC
1020 * timer using the router's lifetime.
1021 * Simply deleting the entry would affect default
1022 * router selection, which is not necessarily a good
1023 * thing, especially when we're using router preference
1024 * values.
1025 * XXX: the check for ln_state would be redundant,
1026 * but we intentionally keep it just in case.
1027 */
1028 if (dr->expire > time_second)
1029 nd6_llinfo_settimer(ln,
1030 (dr->expire - time_second) * hz);
1031 else
1032 nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
1033 splx(s);
1034 LLE_WLOCK(ln);
1035 LLE_REMREF(ln);
1036 LLE_WUNLOCK(ln);
1037 return (LIST_NEXT(ln, lle_next));
1038 }
1039
1040 if (ln->ln_router || dr) {
1041 /*
1042 * rt6_flush must be called whether or not the neighbor
1043 * is in the Default Router List.
1044 * See a corresponding comment in nd6_na_input().
1045 */
1046 rt6_flush(&L3_ADDR_SIN6(ln)->sin6_addr, ln->lle_tbl->llt_ifp);
1047 }
1048
1049 if (dr) {
1050 /*
1051 * Unreachablity of a router might affect the default
1052 * router selection and on-link detection of advertised
1053 * prefixes.
1054 */
1055
1056 /*
1057 * Temporarily fake the state to choose a new default
1058 * router and to perform on-link determination of
1059 * prefixes correctly.
1060 * Below the state will be set correctly,
1061 * or the entry itself will be deleted.
1062 */
1063 ln->ln_state = ND6_LLINFO_INCOMPLETE;
1064
1065 /*
1066 * Since defrouter_select() does not affect the
1067 * on-link determination and MIP6 needs the check
1068 * before the default router selection, we perform
1069 * the check now.
1070 */
1071 pfxlist_onlink_check();
1072
1073 /*
1074 * refresh default router list
1075 */
1076 defrouter_select();
1077 }
1078 splx(s);
1079 }
1080
1081 /*
1082 * Before deleting the entry, remember the next entry as the
1083 * return value. We need this because pfxlist_onlink_check() above
1084 * might have freed other entries (particularly the old next entry) as
1085 * a side effect (XXX).
1086 */
1087 next = LIST_NEXT(ln, lle_next);
1088
1089 ifp = ln->lle_tbl->llt_ifp;
1090 IF_AFDATA_LOCK(ifp);
1091 LLE_WLOCK(ln);
1092 LLE_REMREF(ln);
1093 llentry_free(ln);
1094 IF_AFDATA_UNLOCK(ifp);
1095
1096 return (next);
1097}
1098
1099/*
1100 * Upper-layer reachability hint for Neighbor Unreachability Detection.
1101 *
1102 * XXX cost-effective methods?
1103 */
1104void
1105nd6_nud_hint(struct rtentry *rt, struct in6_addr *dst6, int force)
1106{
1107 struct llentry *ln;
1108 struct ifnet *ifp;
1109
1110 if ((dst6 == NULL) || (rt == NULL))
1111 return;
1112
1113 ifp = rt->rt_ifp;
1114 IF_AFDATA_LOCK(ifp);
1115 ln = nd6_lookup(dst6, ND6_EXCLUSIVE, NULL);
1116 IF_AFDATA_UNLOCK(ifp);
1117 if (ln == NULL)
1118 return;
1119
1120 if (ln->ln_state < ND6_LLINFO_REACHABLE)
1121 goto done;
1122
1123 /*
1124 * if we get upper-layer reachability confirmation many times,
1125 * it is possible we have false information.
1126 */
1127 if (!force) {
1128 ln->ln_byhint++;
1129 if (ln->ln_byhint > V_nd6_maxnudhint) {
1130 goto done;
1131 }
1132 }
1133
1134 ln->ln_state = ND6_LLINFO_REACHABLE;
1135 if (!ND6_LLINFO_PERMANENT(ln)) {
1136 nd6_llinfo_settimer_locked(ln,
1137 (long)ND_IFINFO(rt->rt_ifp)->reachable * hz);
1138 }
1139done:
1140 LLE_WUNLOCK(ln);
1141}
1142
1143
1144int
1145nd6_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp)
1146{
1147 struct in6_drlist *drl = (struct in6_drlist *)data;
1148 struct in6_oprlist *oprl = (struct in6_oprlist *)data;
1149 struct in6_ndireq *ndi = (struct in6_ndireq *)data;
1150 struct in6_nbrinfo *nbi = (struct in6_nbrinfo *)data;
1151 struct in6_ndifreq *ndif = (struct in6_ndifreq *)data;
1152 struct nd_defrouter *dr;
1153 struct nd_prefix *pr;
1154 int i = 0, error = 0;
1155 int s;
1156
1157 switch (cmd) {
1158 case SIOCGDRLST_IN6:
1159 /*
1160 * obsolete API, use sysctl under net.inet6.icmp6
1161 */
1162 bzero(drl, sizeof(*drl));
1163 s = splnet();
1164 dr = TAILQ_FIRST(&V_nd_defrouter);
1165 while (dr && i < DRLSTSIZ) {
1166 drl->defrouter[i].rtaddr = dr->rtaddr;
1167 in6_clearscope(&drl->defrouter[i].rtaddr);
1168
1169 drl->defrouter[i].flags = dr->flags;
1170 drl->defrouter[i].rtlifetime = dr->rtlifetime;
1171 drl->defrouter[i].expire = dr->expire;
1172 drl->defrouter[i].if_index = dr->ifp->if_index;
1173 i++;
1174 dr = TAILQ_NEXT(dr, dr_entry);
1175 }
1176 splx(s);
1177 break;
1178 case SIOCGPRLST_IN6:
1179 /*
1180 * obsolete API, use sysctl under net.inet6.icmp6
1181 *
1182 * XXX the structure in6_prlist was changed in backward-
1183 * incompatible manner. in6_oprlist is used for SIOCGPRLST_IN6,
1184 * in6_prlist is used for nd6_sysctl() - fill_prlist().
1185 */
1186 /*
1187 * XXX meaning of fields, especialy "raflags", is very
1188 * differnet between RA prefix list and RR/static prefix list.
1189 * how about separating ioctls into two?
1190 */
1191 bzero(oprl, sizeof(*oprl));
1192 s = splnet();
1193 pr = V_nd_prefix.lh_first;
1194 while (pr && i < PRLSTSIZ) {
1195 struct nd_pfxrouter *pfr;
1196 int j;
1197
1198 oprl->prefix[i].prefix = pr->ndpr_prefix.sin6_addr;
1199 oprl->prefix[i].raflags = pr->ndpr_raf;
1200 oprl->prefix[i].prefixlen = pr->ndpr_plen;
1201 oprl->prefix[i].vltime = pr->ndpr_vltime;
1202 oprl->prefix[i].pltime = pr->ndpr_pltime;
1203 oprl->prefix[i].if_index = pr->ndpr_ifp->if_index;
1204 if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
1205 oprl->prefix[i].expire = 0;
1206 else {
1207 time_t maxexpire;
1208
1209 /* XXX: we assume time_t is signed. */
1210 maxexpire = (-1) &
1211 ~((time_t)1 <<
1212 ((sizeof(maxexpire) * 8) - 1));
1213 if (pr->ndpr_vltime <
1214 maxexpire - pr->ndpr_lastupdate) {
1215 oprl->prefix[i].expire =
1216 pr->ndpr_lastupdate +
1217 pr->ndpr_vltime;
1218 } else
1219 oprl->prefix[i].expire = maxexpire;
1220 }
1221
1222 pfr = pr->ndpr_advrtrs.lh_first;
1223 j = 0;
1224 while (pfr) {
1225 if (j < DRLSTSIZ) {
1226#define RTRADDR oprl->prefix[i].advrtr[j]
1227 RTRADDR = pfr->router->rtaddr;
1228 in6_clearscope(&RTRADDR);
1229#undef RTRADDR
1230 }
1231 j++;
1232 pfr = pfr->pfr_next;
1233 }
1234 oprl->prefix[i].advrtrs = j;
1235 oprl->prefix[i].origin = PR_ORIG_RA;
1236
1237 i++;
1238 pr = pr->ndpr_next;
1239 }
1240 splx(s);
1241
1242 break;
1243 case OSIOCGIFINFO_IN6:
1244#define ND ndi->ndi
1245 /* XXX: old ndp(8) assumes a positive value for linkmtu. */
1246 bzero(&ND, sizeof(ND));
1247 ND.linkmtu = IN6_LINKMTU(ifp);
1248 ND.maxmtu = ND_IFINFO(ifp)->maxmtu;
1249 ND.basereachable = ND_IFINFO(ifp)->basereachable;
1250 ND.reachable = ND_IFINFO(ifp)->reachable;
1251 ND.retrans = ND_IFINFO(ifp)->retrans;
1252 ND.flags = ND_IFINFO(ifp)->flags;
1253 ND.recalctm = ND_IFINFO(ifp)->recalctm;
1254 ND.chlim = ND_IFINFO(ifp)->chlim;
1255 break;
1256 case SIOCGIFINFO_IN6:
1257 ND = *ND_IFINFO(ifp);
1258 break;
1259 case SIOCSIFINFO_IN6:
1260 /*
1261 * used to change host variables from userland.
1262 * intented for a use on router to reflect RA configurations.
1263 */
1264 /* 0 means 'unspecified' */
1265 if (ND.linkmtu != 0) {
1266 if (ND.linkmtu < IPV6_MMTU ||
1267 ND.linkmtu > IN6_LINKMTU(ifp)) {
1268 error = EINVAL;
1269 break;
1270 }
1271 ND_IFINFO(ifp)->linkmtu = ND.linkmtu;
1272 }
1273
1274 if (ND.basereachable != 0) {
1275 int obasereachable = ND_IFINFO(ifp)->basereachable;
1276
1277 ND_IFINFO(ifp)->basereachable = ND.basereachable;
1278 if (ND.basereachable != obasereachable)
1279 ND_IFINFO(ifp)->reachable =
1280 ND_COMPUTE_RTIME(ND.basereachable);
1281 }
1282 if (ND.retrans != 0)
1283 ND_IFINFO(ifp)->retrans = ND.retrans;
1284 if (ND.chlim != 0)
1285 ND_IFINFO(ifp)->chlim = ND.chlim;
1286 /* FALLTHROUGH */
1287 case SIOCSIFINFO_FLAGS:
1288 {
1289 struct ifaddr *ifa;
1290 struct in6_ifaddr *ia;
1291
1292 if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) &&
1293 !(ND.flags & ND6_IFF_IFDISABLED)) {
1294 /* ifdisabled 1->0 transision */
1295
1296 /*
1297 * If the interface is marked as ND6_IFF_IFDISABLED and
1298 * has an link-local address with IN6_IFF_DUPLICATED,
1299 * do not clear ND6_IFF_IFDISABLED.
1300 * See RFC 4862, Section 5.4.5.
1301 */
1302 int duplicated_linklocal = 0;
1303
1304 IF_ADDR_LOCK(ifp);
1305 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1306 if (ifa->ifa_addr->sa_family != AF_INET6)
1307 continue;
1308 ia = (struct in6_ifaddr *)ifa;
1309 if ((ia->ia6_flags & IN6_IFF_DUPLICATED) &&
1310 IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr)) {
1311 duplicated_linklocal = 1;
1312 break;
1313 }
1314 }
1315 IF_ADDR_UNLOCK(ifp);
1316
1317 if (duplicated_linklocal) {
1318 ND.flags |= ND6_IFF_IFDISABLED;
1319 log(LOG_ERR, "Cannot enable an interface"
1320 " with a link-local address marked"
1321 " duplicate.\n");
1322 } else {
1323 ND_IFINFO(ifp)->flags &= ~ND6_IFF_IFDISABLED;
1324 in6_if_up(ifp);
1325 }
1326 } else if (!(ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED) &&
1327 (ND.flags & ND6_IFF_IFDISABLED)) {
1328 /* ifdisabled 0->1 transision */
1329 /* Mark all IPv6 address as tentative. */
1330
1331 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED;
1332 IF_ADDR_LOCK(ifp);
1333 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1334 if (ifa->ifa_addr->sa_family != AF_INET6)
1335 continue;
1336 ia = (struct in6_ifaddr *)ifa;
1337 ia->ia6_flags |= IN6_IFF_TENTATIVE;
1338 }
1339 IF_ADDR_UNLOCK(ifp);
1340 }
1341
1342 if (!(ND_IFINFO(ifp)->flags & ND6_IFF_AUTO_LINKLOCAL) &&
1343 (ND.flags & ND6_IFF_AUTO_LINKLOCAL)) {
1344 /* auto_linklocal 0->1 transision */
1345
1346 /* If no link-local address on ifp, configure */
1347 ND_IFINFO(ifp)->flags |= ND6_IFF_AUTO_LINKLOCAL;
1348 in6_ifattach(ifp, NULL);
1349 }
1350 }
1351 ND_IFINFO(ifp)->flags = ND.flags;
1352 break;
1353#undef ND
1354 case SIOCSNDFLUSH_IN6: /* XXX: the ioctl name is confusing... */
1355 /* sync kernel routing table with the default router list */
1356 defrouter_reset();
1357 defrouter_select();
1358 break;
1359 case SIOCSPFXFLUSH_IN6:
1360 {
1361 /* flush all the prefix advertised by routers */
1362 struct nd_prefix *pr, *next;
1363
1364 s = splnet();
1365 for (pr = V_nd_prefix.lh_first; pr; pr = next) {
1366 struct in6_ifaddr *ia, *ia_next;
1367
1368 next = pr->ndpr_next;
1369
1370 if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
1371 continue; /* XXX */
1372
1373 /* do we really have to remove addresses as well? */
1374 /* XXXRW: in6_ifaddrhead locking. */
1375 TAILQ_FOREACH_SAFE(ia, &V_in6_ifaddrhead, ia_link,
1376 ia_next) {
1377 if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0)
1378 continue;
1379
1380 if (ia->ia6_ndpr == pr)
1381 in6_purgeaddr(&ia->ia_ifa);
1382 }
1383 prelist_remove(pr);
1384 }
1385 splx(s);
1386 break;
1387 }
1388 case SIOCSRTRFLUSH_IN6:
1389 {
1390 /* flush all the default routers */
1391 struct nd_defrouter *dr, *next;
1392
1393 s = splnet();
1394 defrouter_reset();
1395 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = next) {
1396 next = TAILQ_NEXT(dr, dr_entry);
1397 defrtrlist_del(dr);
1398 }
1399 defrouter_select();
1400 splx(s);
1401 break;
1402 }
1403 case SIOCGNBRINFO_IN6:
1404 {
1405 struct llentry *ln;
1406 struct in6_addr nb_addr = nbi->addr; /* make local for safety */
1407
1408 if ((error = in6_setscope(&nb_addr, ifp, NULL)) != 0)
1409 return (error);
1410
1411 IF_AFDATA_LOCK(ifp);
1412 ln = nd6_lookup(&nb_addr, 0, ifp);
1413 IF_AFDATA_UNLOCK(ifp);
1414
1415 if (ln == NULL) {
1416 error = EINVAL;
1417 break;
1418 }
1419 nbi->state = ln->ln_state;
1420 nbi->asked = ln->la_asked;
1421 nbi->isrouter = ln->ln_router;
1422 nbi->expire = ln->la_expire;
1423 LLE_RUNLOCK(ln);
1424 break;
1425 }
1426 case SIOCGDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */
1427 ndif->ifindex = V_nd6_defifindex;
1428 break;
1429 case SIOCSDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */
1430 return (nd6_setdefaultiface(ndif->ifindex));
1431 }
1432 return (error);
1433}
1434
1435/*
1436 * Create neighbor cache entry and cache link-layer address,
1437 * on reception of inbound ND6 packets. (RS/RA/NS/redirect)
1438 *
1439 * type - ICMP6 type
1440 * code - type dependent information
1441 *
1442 * XXXXX
1443 * The caller of this function already acquired the ndp
1444 * cache table lock because the cache entry is returned.
1445 */
1446struct llentry *
1447nd6_cache_lladdr(struct ifnet *ifp, struct in6_addr *from, char *lladdr,
1448 int lladdrlen, int type, int code)
1449{
1450 struct llentry *ln = NULL;
1451 int is_newentry;
1452 int do_update;
1453 int olladdr;
1454 int llchange;
1455 int flags;
1456 int newstate = 0;
1457 uint16_t router = 0;
1458 struct sockaddr_in6 sin6;
1459 struct mbuf *chain = NULL;
1460 int static_route = 0;
1461
1462 IF_AFDATA_UNLOCK_ASSERT(ifp);
1463
1464 if (ifp == NULL)
1465 panic("ifp == NULL in nd6_cache_lladdr");
1466 if (from == NULL)
1467 panic("from == NULL in nd6_cache_lladdr");
1468
1469 /* nothing must be updated for unspecified address */
1470 if (IN6_IS_ADDR_UNSPECIFIED(from))
1471 return NULL;
1472
1473 /*
1474 * Validation about ifp->if_addrlen and lladdrlen must be done in
1475 * the caller.
1476 *
1477 * XXX If the link does not have link-layer adderss, what should
1478 * we do? (ifp->if_addrlen == 0)
1479 * Spec says nothing in sections for RA, RS and NA. There's small
1480 * description on it in NS section (RFC 2461 7.2.3).
1481 */
1482 flags = lladdr ? ND6_EXCLUSIVE : 0;
1483 IF_AFDATA_LOCK(ifp);
1484 ln = nd6_lookup(from, flags, ifp);
1485
1486 if (ln == NULL) {
1487 flags |= ND6_EXCLUSIVE;
1488 ln = nd6_lookup(from, flags | ND6_CREATE, ifp);
1489 IF_AFDATA_UNLOCK(ifp);
1490 is_newentry = 1;
1491 } else {
1492 IF_AFDATA_UNLOCK(ifp);
1493 /* do nothing if static ndp is set */
1494 if (ln->la_flags & LLE_STATIC) {
1495 static_route = 1;
1496 goto done;
1497 }
1498 is_newentry = 0;
1499 }
1500 if (ln == NULL)
1501 return (NULL);
1502
1503 olladdr = (ln->la_flags & LLE_VALID) ? 1 : 0;
1504 if (olladdr && lladdr) {
1505 llchange = bcmp(lladdr, &ln->ll_addr,
1506 ifp->if_addrlen);
1507 } else
1508 llchange = 0;
1509
1510 /*
1511 * newentry olladdr lladdr llchange (*=record)
1512 * 0 n n -- (1)
1513 * 0 y n -- (2)
1514 * 0 n y -- (3) * STALE
1515 * 0 y y n (4) *
1516 * 0 y y y (5) * STALE
1517 * 1 -- n -- (6) NOSTATE(= PASSIVE)
1518 * 1 -- y -- (7) * STALE
1519 */
1520
1521 if (lladdr) { /* (3-5) and (7) */
1522 /*
1523 * Record source link-layer address
1524 * XXX is it dependent to ifp->if_type?
1525 */
1526 bcopy(lladdr, &ln->ll_addr, ifp->if_addrlen);
1527 ln->la_flags |= LLE_VALID;
1528 }
1529
1530 if (!is_newentry) {
1531 if ((!olladdr && lladdr != NULL) || /* (3) */
1532 (olladdr && lladdr != NULL && llchange)) { /* (5) */
1533 do_update = 1;
1534 newstate = ND6_LLINFO_STALE;
1535 } else /* (1-2,4) */
1536 do_update = 0;
1537 } else {
1538 do_update = 1;
1539 if (lladdr == NULL) /* (6) */
1540 newstate = ND6_LLINFO_NOSTATE;
1541 else /* (7) */
1542 newstate = ND6_LLINFO_STALE;
1543 }
1544
1545 if (do_update) {
1546 /*
1547 * Update the state of the neighbor cache.
1548 */
1549 ln->ln_state = newstate;
1550
1551 if (ln->ln_state == ND6_LLINFO_STALE) {
1552 /*
1553 * XXX: since nd6_output() below will cause
1554 * state tansition to DELAY and reset the timer,
1555 * we must set the timer now, although it is actually
1556 * meaningless.
1557 */
1558 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
1559
1560 if (ln->la_hold) {
1561 struct mbuf *m_hold, *m_hold_next;
1562
1563 /*
1564 * reset the la_hold in advance, to explicitly
1565 * prevent a la_hold lookup in nd6_output()
1566 * (wouldn't happen, though...)
1567 */
1568 for (m_hold = ln->la_hold, ln->la_hold = NULL;
1569 m_hold; m_hold = m_hold_next) {
1570 m_hold_next = m_hold->m_nextpkt;
1571 m_hold->m_nextpkt = NULL;
1572
1573 /*
1574 * we assume ifp is not a p2p here, so
1575 * just set the 2nd argument as the
1576 * 1st one.
1577 */
1578 nd6_output_lle(ifp, ifp, m_hold, L3_ADDR_SIN6(ln), NULL, ln, &chain);
1579 }
1580 /*
1581 * If we have mbufs in the chain we need to do
1582 * deferred transmit. Copy the address from the
1583 * llentry before dropping the lock down below.
1584 */
1585 if (chain != NULL)
1586 memcpy(&sin6, L3_ADDR_SIN6(ln), sizeof(sin6));
1587 }
1588 } else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
1589 /* probe right away */
1590 nd6_llinfo_settimer_locked((void *)ln, 0);
1591 }
1592 }
1593
1594 /*
1595 * ICMP6 type dependent behavior.
1596 *
1597 * NS: clear IsRouter if new entry
1598 * RS: clear IsRouter
1599 * RA: set IsRouter if there's lladdr
1600 * redir: clear IsRouter if new entry
1601 *
1602 * RA case, (1):
1603 * The spec says that we must set IsRouter in the following cases:
1604 * - If lladdr exist, set IsRouter. This means (1-5).
1605 * - If it is old entry (!newentry), set IsRouter. This means (7).
1606 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
1607 * A quetion arises for (1) case. (1) case has no lladdr in the
1608 * neighbor cache, this is similar to (6).
1609 * This case is rare but we figured that we MUST NOT set IsRouter.
1610 *
1611 * newentry olladdr lladdr llchange NS RS RA redir
1612 * D R
1613 * 0 n n -- (1) c ? s
1614 * 0 y n -- (2) c s s
1615 * 0 n y -- (3) c s s
1616 * 0 y y n (4) c s s
1617 * 0 y y y (5) c s s
1618 * 1 -- n -- (6) c c c s
1619 * 1 -- y -- (7) c c s c s
1620 *
1621 * (c=clear s=set)
1622 */
1623 switch (type & 0xff) {
1624 case ND_NEIGHBOR_SOLICIT:
1625 /*
1626 * New entry must have is_router flag cleared.
1627 */
1628 if (is_newentry) /* (6-7) */
1629 ln->ln_router = 0;
1630 break;
1631 case ND_REDIRECT:
1632 /*
1633 * If the icmp is a redirect to a better router, always set the
1634 * is_router flag. Otherwise, if the entry is newly created,
1635 * clear the flag. [RFC 2461, sec 8.3]
1636 */
1637 if (code == ND_REDIRECT_ROUTER)
1638 ln->ln_router = 1;
1639 else if (is_newentry) /* (6-7) */
1640 ln->ln_router = 0;
1641 break;
1642 case ND_ROUTER_SOLICIT:
1643 /*
1644 * is_router flag must always be cleared.
1645 */
1646 ln->ln_router = 0;
1647 break;
1648 case ND_ROUTER_ADVERT:
1649 /*
1650 * Mark an entry with lladdr as a router.
1651 */
1652 if ((!is_newentry && (olladdr || lladdr)) || /* (2-5) */
1653 (is_newentry && lladdr)) { /* (7) */
1654 ln->ln_router = 1;
1655 }
1656 break;
1657 }
1658
1659 if (ln != NULL) {
1660 static_route = (ln->la_flags & LLE_STATIC);
1661 router = ln->ln_router;
1662
1663 if (flags & ND6_EXCLUSIVE)
1664 LLE_WUNLOCK(ln);
1665 else
1666 LLE_RUNLOCK(ln);
1667 if (static_route)
1668 ln = NULL;
1669 }
1670 if (chain)
1671 nd6_output_flush(ifp, ifp, chain, &sin6, NULL);
1672
1673 /*
1674 * When the link-layer address of a router changes, select the
1675 * best router again. In particular, when the neighbor entry is newly
1676 * created, it might affect the selection policy.
1677 * Question: can we restrict the first condition to the "is_newentry"
1678 * case?
1679 * XXX: when we hear an RA from a new router with the link-layer
1680 * address option, defrouter_select() is called twice, since
1681 * defrtrlist_update called the function as well. However, I believe
1682 * we can compromise the overhead, since it only happens the first
1683 * time.
1684 * XXX: although defrouter_select() should not have a bad effect
1685 * for those are not autoconfigured hosts, we explicitly avoid such
1686 * cases for safety.
1687 */
1688 if (do_update && router && !V_ip6_forwarding &&
1689 ND_IFINFO(ifp)->flags & ND6_IFF_ACCEPT_RTADV) {
1690 /*
1691 * guaranteed recursion
1692 */
1693 defrouter_select();
1694 }
1695
1696 return (ln);
1697done:
1698 if (ln != NULL) {
1699 if (flags & ND6_EXCLUSIVE)
1700 LLE_WUNLOCK(ln);
1701 else
1702 LLE_RUNLOCK(ln);
1703 if (static_route)
1704 ln = NULL;
1705 }
1706 return (ln);
1707}
1708
1709static void
1710nd6_slowtimo(void *arg)
1711{
1712 CURVNET_SET((struct vnet *) arg);
1713 struct nd_ifinfo *nd6if;
1714 struct ifnet *ifp;
1715
1716 callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
1717 nd6_slowtimo, curvnet);
1718 IFNET_RLOCK_NOSLEEP();
1719 for (ifp = TAILQ_FIRST(&V_ifnet); ifp;
1720 ifp = TAILQ_NEXT(ifp, if_list)) {
1721 nd6if = ND_IFINFO(ifp);
1722 if (nd6if->basereachable && /* already initialized */
1723 (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
1724 /*
1725 * Since reachable time rarely changes by router
1726 * advertisements, we SHOULD insure that a new random
1727 * value gets recomputed at least once every few hours.
1728 * (RFC 2461, 6.3.4)
1729 */
1730 nd6if->recalctm = V_nd6_recalc_reachtm_interval;
1731 nd6if->reachable = ND_COMPUTE_RTIME(nd6if->basereachable);
1732 }
1733 }
1734 IFNET_RUNLOCK_NOSLEEP();
1735 CURVNET_RESTORE();
1736}
1737
1738int
1739nd6_output(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
1740 struct sockaddr_in6 *dst, struct rtentry *rt0)
1741{
1742
1743 return (nd6_output_lle(ifp, origifp, m0, dst, rt0, NULL, NULL));
1744}
1745
1746
1747/*
1748 * Note that I'm not enforcing any global serialization
1749 * lle state or asked changes here as the logic is too
1750 * complicated to avoid having to always acquire an exclusive
1751 * lock
1752 * KMM
1753 *
1754 */
1755#define senderr(e) { error = (e); goto bad;}
1756
1757int
1758nd6_output_lle(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
1759 struct sockaddr_in6 *dst, struct rtentry *rt0, struct llentry *lle,
1760 struct mbuf **chain)
1761{
1762 struct mbuf *m = m0;
1763 struct m_tag *mtag;
1764 struct llentry *ln = lle;
1765 struct ip6_hdr *ip6;
1766 int error = 0;
1767 int flags = 0;
1768 int ip6len;
1769
1770#ifdef INVARIANTS
1771 if (lle != NULL) {
1772
1773 LLE_WLOCK_ASSERT(lle);
1774
1775 KASSERT(chain != NULL, (" lle locked but no mbuf chain pointer passed"));
1776 }
1777#endif
1778 if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr))
1779 goto sendpkt;
1780
1781 if (nd6_need_cache(ifp) == 0)
1782 goto sendpkt;
1783
1784 /*
1785 * next hop determination. This routine is derived from ether_output.
1786 */
1787
1788 /*
1789 * Address resolution or Neighbor Unreachability Detection
1790 * for the next hop.
1791 * At this point, the destination of the packet must be a unicast
1792 * or an anycast address(i.e. not a multicast).
1793 */
1794
1795 flags = ((m != NULL) || (lle != NULL)) ? LLE_EXCLUSIVE : 0;
1796 if (ln == NULL) {
1797 retry:
1798 IF_AFDATA_LOCK(ifp);
1799 ln = lla_lookup(LLTABLE6(ifp), flags, (struct sockaddr *)dst);
1800 IF_AFDATA_UNLOCK(ifp);
1801 if ((ln == NULL) && nd6_is_addr_neighbor(dst, ifp)) {
1802 /*
1803 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
1804 * the condition below is not very efficient. But we believe
1805 * it is tolerable, because this should be a rare case.
1806 */
1807 flags = ND6_CREATE | (m ? ND6_EXCLUSIVE : 0);
1808 IF_AFDATA_LOCK(ifp);
1809 ln = nd6_lookup(&dst->sin6_addr, flags, ifp);
1810 IF_AFDATA_UNLOCK(ifp);
1811 }
1812 }
1813 if (ln == NULL) {
1814 if ((ifp->if_flags & IFF_POINTOPOINT) == 0 &&
1815 !(ND_IFINFO(ifp)->flags & ND6_IFF_PERFORMNUD)) {
1816 char ip6buf[INET6_ADDRSTRLEN];
1817 log(LOG_DEBUG,
1818 "nd6_output: can't allocate llinfo for %s "
1819 "(ln=%p)\n",
1820 ip6_sprintf(ip6buf, &dst->sin6_addr), ln);
1821 senderr(EIO); /* XXX: good error? */
1822 }
1823 goto sendpkt; /* send anyway */
1824 }
1825
1826 /* We don't have to do link-layer address resolution on a p2p link. */
1827 if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
1828 ln->ln_state < ND6_LLINFO_REACHABLE) {
1829 if ((flags & LLE_EXCLUSIVE) == 0) {
1830 flags |= LLE_EXCLUSIVE;
1831 goto retry;
1832 }
1833 ln->ln_state = ND6_LLINFO_STALE;
1834 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
1835 }
1836
1837 /*
1838 * The first time we send a packet to a neighbor whose entry is
1839 * STALE, we have to change the state to DELAY and a sets a timer to
1840 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
1841 * neighbor unreachability detection on expiration.
1842 * (RFC 2461 7.3.3)
1843 */
1844 if (ln->ln_state == ND6_LLINFO_STALE) {
1845 if ((flags & LLE_EXCLUSIVE) == 0) {
1846 flags |= LLE_EXCLUSIVE;
1847 LLE_RUNLOCK(ln);
1848 goto retry;
1849 }
1850 ln->la_asked = 0;
1851 ln->ln_state = ND6_LLINFO_DELAY;
1852 nd6_llinfo_settimer_locked(ln, (long)V_nd6_delay * hz);
1853 }
1854
1855 /*
1856 * If the neighbor cache entry has a state other than INCOMPLETE
1857 * (i.e. its link-layer address is already resolved), just
1858 * send the packet.
1859 */
1860 if (ln->ln_state > ND6_LLINFO_INCOMPLETE)
1861 goto sendpkt;
1862
1863 /*
1864 * There is a neighbor cache entry, but no ethernet address
1865 * response yet. Append this latest packet to the end of the
1866 * packet queue in the mbuf, unless the number of the packet
1867 * does not exceed nd6_maxqueuelen. When it exceeds nd6_maxqueuelen,
1868 * the oldest packet in the queue will be removed.
1869 */
1870 if (ln->ln_state == ND6_LLINFO_NOSTATE)
1871 ln->ln_state = ND6_LLINFO_INCOMPLETE;
1872
1873 if ((flags & LLE_EXCLUSIVE) == 0) {
1874 flags |= LLE_EXCLUSIVE;
1875 LLE_RUNLOCK(ln);
1876 goto retry;
1877 }
1878 if (ln->la_hold) {
1879 struct mbuf *m_hold;
1880 int i;
1881
1882 i = 0;
1883 for (m_hold = ln->la_hold; m_hold; m_hold = m_hold->m_nextpkt) {
1884 i++;
1885 if (m_hold->m_nextpkt == NULL) {
1886 m_hold->m_nextpkt = m;
1887 break;
1888 }
1889 }
1890 while (i >= V_nd6_maxqueuelen) {
1891 m_hold = ln->la_hold;
1892 ln->la_hold = ln->la_hold->m_nextpkt;
1893 m_freem(m_hold);
1894 i--;
1895 }
1896 } else {
1897 ln->la_hold = m;
1898 }
1899 /*
1900 * We did the lookup (no lle arg) so we
1901 * need to do the unlock here
1902 */
1903 if (lle == NULL) {
1904 if (flags & LLE_EXCLUSIVE)
1905 LLE_WUNLOCK(ln);
1906 else
1907 LLE_RUNLOCK(ln);
1908 }
1909
1910 /*
1911 * If there has been no NS for the neighbor after entering the
1912 * INCOMPLETE state, send the first solicitation.
1913 */
1914 if (!ND6_LLINFO_PERMANENT(ln) && ln->la_asked == 0) {
1915 ln->la_asked++;
1916
1917 nd6_llinfo_settimer(ln,
1918 (long)ND_IFINFO(ifp)->retrans * hz / 1000);
1919 nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, 0);
1920 }
1921 return (0);
1922
1923 sendpkt:
1924 /* discard the packet if IPv6 operation is disabled on the interface */
1925 if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) {
1926 error = ENETDOWN; /* better error? */
1927 goto bad;
1928 }
1929 /*
1930 * ln is valid and the caller did not pass in
1931 * an llentry
1932 */
1933 if ((ln != NULL) && (lle == NULL)) {
1934 if (flags & LLE_EXCLUSIVE)
1935 LLE_WUNLOCK(ln);
1936 else
1937 LLE_RUNLOCK(ln);
1938 }
1939
1940#ifdef MAC
1941 mac_netinet6_nd6_send(ifp, m);
1942#endif
1943
1944 /*
1945 * If called from nd6_ns_output() (NS), nd6_na_output() (NA),
1946 * icmp6_redirect_output() (REDIRECT) or from rip6_output() (RS, RA
1947 * as handled by rtsol and rtadvd), mbufs will be tagged for SeND
1948 * to be diverted to user space. When re-injected into the kernel,
1949 * send_output() will directly dispatch them to the outgoing interface.
1950 */
1951 if (send_sendso_input_hook != NULL) {
1952 mtag = m_tag_find(m, PACKET_TAG_ND_OUTGOING, NULL);
1953 if (mtag != NULL) {
1954 ip6 = mtod(m, struct ip6_hdr *);
1955 ip6len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
1956 /* Use the SEND socket */
1957 error = send_sendso_input_hook(m, ifp, SND_OUT,
1958 ip6len);
1959 /* -1 == no app on SEND socket */
1960 if (error == 0 || error != -1)
1961 return (error);
1962 }
1963 }
1964
1965 /*
1966 * We were passed in a pointer to an lle with the lock held
1967 * this means that we can't call if_output as we will
1968 * recurse on the lle lock - so what we do is we create
1969 * a list of mbufs to send and transmit them in the caller
1970 * after the lock is dropped
1971 */
1972 if (lle != NULL) {
1973 if (*chain == NULL)
1974 *chain = m;
1975 else {
1976 struct mbuf *m = *chain;
1977
1978 /*
1979 * append mbuf to end of deferred chain
1980 */
1981 while (m->m_nextpkt != NULL)
1982 m = m->m_nextpkt;
1983 m->m_nextpkt = m;
1984 }
1985 return (error);
1986 }
1987 if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
1988 return ((*ifp->if_output)(origifp, m, (struct sockaddr *)dst,
1989 NULL));
1990 }
1991 error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, NULL);
1992 return (error);
1993
1994 bad:
1995 /*
1996 * ln is valid and the caller did not pass in
1997 * an llentry
1998 */
1999 if ((ln != NULL) && (lle == NULL)) {
2000 if (flags & LLE_EXCLUSIVE)
2001 LLE_WUNLOCK(ln);
2002 else
2003 LLE_RUNLOCK(ln);
2004 }
2005 if (m)
2006 m_freem(m);
2007 return (error);
2008}
2009#undef senderr
2010
2011
2012int
2013nd6_output_flush(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *chain,
2014 struct sockaddr_in6 *dst, struct route *ro)
2015{
2016 struct mbuf *m, *m_head;
2017 struct ifnet *outifp;
2018 int error = 0;
2019
2020 m_head = chain;
2021 if ((ifp->if_flags & IFF_LOOPBACK) != 0)
2022 outifp = origifp;
2023 else
2024 outifp = ifp;
2025
2026 while (m_head) {
2027 m = m_head;
2028 m_head = m_head->m_nextpkt;
2029 error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, ro);
2030 }
2031
2032 /*
2033 * XXX
2034 * note that intermediate errors are blindly ignored - but this is
2035 * the same convention as used with nd6_output when called by
2036 * nd6_cache_lladdr
2037 */
2038 return (error);
2039}
2040
2041
2042int
2043nd6_need_cache(struct ifnet *ifp)
2044{
2045 /*
2046 * XXX: we currently do not make neighbor cache on any interface
2047 * other than ARCnet, Ethernet, FDDI and GIF.
2048 *
2049 * RFC2893 says:
2050 * - unidirectional tunnels needs no ND
2051 */
2052 switch (ifp->if_type) {
2053 case IFT_ARCNET:
2054 case IFT_ETHER:
2055 case IFT_FDDI:
2056 case IFT_IEEE1394:
2057#ifdef IFT_L2VLAN
2058 case IFT_L2VLAN:
2059#endif
2060#ifdef IFT_IEEE80211
2061 case IFT_IEEE80211:
2062#endif
2063#ifdef IFT_CARP
2064 case IFT_CARP:
2065#endif
2066 case IFT_GIF: /* XXX need more cases? */
2067 case IFT_PPP:
2068 case IFT_TUNNEL:
2069 case IFT_BRIDGE:
2070 case IFT_PROPVIRTUAL:
2071 return (1);
2072 default:
2073 return (0);
2074 }
2075}
2076
2077/*
2078 * the callers of this function need to be re-worked to drop
2079 * the lle lock, drop here for now
2080 */
2081int
2082nd6_storelladdr(struct ifnet *ifp, struct mbuf *m,
2083 struct sockaddr *dst, u_char *desten, struct llentry **lle)
2084{
2085 struct llentry *ln;
2086
2087 *lle = NULL;
2088 IF_AFDATA_UNLOCK_ASSERT(ifp);
2089 if (m->m_flags & M_MCAST) {
2090 int i;
2091
2092 switch (ifp->if_type) {
2093 case IFT_ETHER:
2094 case IFT_FDDI:
2095#ifdef IFT_L2VLAN
2096 case IFT_L2VLAN:
2097#endif
2098#ifdef IFT_IEEE80211
2099 case IFT_IEEE80211:
2100#endif
2101 case IFT_BRIDGE:
2102 case IFT_ISO88025:
2103 ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr,
2104 desten);
2105 return (0);
2106 case IFT_IEEE1394:
2107 /*
2108 * netbsd can use if_broadcastaddr, but we don't do so
2109 * to reduce # of ifdef.
2110 */
2111 for (i = 0; i < ifp->if_addrlen; i++)
2112 desten[i] = ~0;
2113 return (0);
2114 case IFT_ARCNET:
2115 *desten = 0;
2116 return (0);
2117 default:
2118 m_freem(m);
2119 return (EAFNOSUPPORT);
2120 }
2121 }
2122
2123
2124 /*
2125 * the entry should have been created in nd6_store_lladdr
2126 */
2127 IF_AFDATA_LOCK(ifp);
2128 ln = lla_lookup(LLTABLE6(ifp), 0, dst);
2129 IF_AFDATA_UNLOCK(ifp);
2130 if ((ln == NULL) || !(ln->la_flags & LLE_VALID)) {
2131 if (ln != NULL)
2132 LLE_RUNLOCK(ln);
2133 /* this could happen, if we could not allocate memory */
2134 m_freem(m);
2135 return (1);
2136 }
2137
2138 bcopy(&ln->ll_addr, desten, ifp->if_addrlen);
2139 *lle = ln;
2140 LLE_RUNLOCK(ln);
2141 /*
2142 * A *small* use after free race exists here
2143 */
2144 return (0);
2145}
2146
2147static void
2148clear_llinfo_pqueue(struct llentry *ln)
2149{
2150 struct mbuf *m_hold, *m_hold_next;
2151
2152 for (m_hold = ln->la_hold; m_hold; m_hold = m_hold_next) {
2153 m_hold_next = m_hold->m_nextpkt;
2154 m_hold->m_nextpkt = NULL;
2155 m_freem(m_hold);
2156 }
2157
2158 ln->la_hold = NULL;
2159 return;
2160}
2161
2162static int nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS);
2163static int nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS);
2164#ifdef SYSCTL_DECL
2165SYSCTL_DECL(_net_inet6_icmp6);
2166#endif
2167SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_DRLIST, nd6_drlist,
2168 CTLFLAG_RD, nd6_sysctl_drlist, "");
2169SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_PRLIST, nd6_prlist,
2170 CTLFLAG_RD, nd6_sysctl_prlist, "");
2171SYSCTL_VNET_INT(_net_inet6_icmp6, ICMPV6CTL_ND6_MAXQLEN, nd6_maxqueuelen,
2172 CTLFLAG_RW, &VNET_NAME(nd6_maxqueuelen), 1, "");
2173
2174static int
2175nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS)
2176{
2177 int error;
2178 char buf[1024] __aligned(4);
2179 struct in6_defrouter *d, *de;
2180 struct nd_defrouter *dr;
2181
2182 if (req->newptr)
2183 return EPERM;
2184 error = 0;
2185
2186 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
2187 dr = TAILQ_NEXT(dr, dr_entry)) {
2188 d = (struct in6_defrouter *)buf;
2189 de = (struct in6_defrouter *)(buf + sizeof(buf));
2190
2191 if (d + 1 <= de) {
2192 bzero(d, sizeof(*d));
2193 d->rtaddr.sin6_family = AF_INET6;
2194 d->rtaddr.sin6_len = sizeof(d->rtaddr);
2195 d->rtaddr.sin6_addr = dr->rtaddr;
2196 error = sa6_recoverscope(&d->rtaddr);
2197 if (error != 0)
2198 return (error);
2199 d->flags = dr->flags;
2200 d->rtlifetime = dr->rtlifetime;
2201 d->expire = dr->expire;
2202 d->if_index = dr->ifp->if_index;
2203 } else
2204 panic("buffer too short");
2205
2206 error = SYSCTL_OUT(req, buf, sizeof(*d));
2207 if (error)
2208 break;
2209 }
2210
2211 return (error);
2212}
2213
2214static int
2215nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS)
2216{
2217 int error;
2218 char buf[1024] __aligned(4);
2219 struct in6_prefix *p, *pe;
2220 struct nd_prefix *pr;
2221 char ip6buf[INET6_ADDRSTRLEN];
2222
2223 if (req->newptr)
2224 return EPERM;
2225 error = 0;
2226
2227 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
2228 u_short advrtrs;
2229 size_t advance;
2230 struct sockaddr_in6 *sin6, *s6;
2231 struct nd_pfxrouter *pfr;
2232
2233 p = (struct in6_prefix *)buf;
2234 pe = (struct in6_prefix *)(buf + sizeof(buf));
2235
2236 if (p + 1 <= pe) {
2237 bzero(p, sizeof(*p));
2238 sin6 = (struct sockaddr_in6 *)(p + 1);
2239
2240 p->prefix = pr->ndpr_prefix;
2241 if (sa6_recoverscope(&p->prefix)) {
2242 log(LOG_ERR,
2243 "scope error in prefix list (%s)\n",
2244 ip6_sprintf(ip6buf, &p->prefix.sin6_addr));
2245 /* XXX: press on... */
2246 }
2247 p->raflags = pr->ndpr_raf;
2248 p->prefixlen = pr->ndpr_plen;
2249 p->vltime = pr->ndpr_vltime;
2250 p->pltime = pr->ndpr_pltime;
2251 p->if_index = pr->ndpr_ifp->if_index;
2252 if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
2253 p->expire = 0;
2254 else {
2255 time_t maxexpire;
2256
2257 /* XXX: we assume time_t is signed. */
2258 maxexpire = (-1) &
2259 ~((time_t)1 <<
2260 ((sizeof(maxexpire) * 8) - 1));
2261 if (pr->ndpr_vltime <
2262 maxexpire - pr->ndpr_lastupdate) {
2263 p->expire = pr->ndpr_lastupdate +
2264 pr->ndpr_vltime;
2265 } else
2266 p->expire = maxexpire;
2267 }
2268 p->refcnt = pr->ndpr_refcnt;
2269 p->flags = pr->ndpr_stateflags;
2270 p->origin = PR_ORIG_RA;
2271 advrtrs = 0;
2272 for (pfr = pr->ndpr_advrtrs.lh_first; pfr;
2273 pfr = pfr->pfr_next) {
2274 if ((void *)&sin6[advrtrs + 1] > (void *)pe) {
2275 advrtrs++;
2276 continue;
2277 }
2278 s6 = &sin6[advrtrs];
2279 bzero(s6, sizeof(*s6));
2280 s6->sin6_family = AF_INET6;
2281 s6->sin6_len = sizeof(*sin6);
2282 s6->sin6_addr = pfr->router->rtaddr;
2283 if (sa6_recoverscope(s6)) {
2284 log(LOG_ERR,
2285 "scope error in "
2286 "prefix list (%s)\n",
2287 ip6_sprintf(ip6buf,
2288 &pfr->router->rtaddr));
2289 }
2290 advrtrs++;
2291 }
2292 p->advrtrs = advrtrs;
2293 } else
2294 panic("buffer too short");
2295
2296 advance = sizeof(*p) + sizeof(*sin6) * advrtrs;
2297 error = SYSCTL_OUT(req, buf, advance);
2298 if (error)
2299 break;
2300 }
2301
2302 return (error);
2303}
|