34
35#include "opt_inet.h"
36#include "opt_inet6.h"
37#include "opt_ipsec.h"
38#include "opt_mpath.h"
39
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/malloc.h>
43#include <sys/lock.h>
44#include <sys/rwlock.h>
45#include <sys/mbuf.h>
46#include <sys/socket.h>
47#include <sys/sockio.h>
48#include <sys/time.h>
49#include <sys/kernel.h>
50#include <sys/errno.h>
51#include <sys/syslog.h>
52#include <sys/queue.h>
53#include <sys/callout.h>
54
55#include <net/if.h>
56#include <net/if_types.h>
57#include <net/if_dl.h>
58#include <net/if_var.h>
59#include <net/route.h>
60#ifdef RADIX_MPATH
61#include <net/radix_mpath.h>
62#endif
63
64#include <netinet/in.h>
65#include <netinet/in_var.h>
66#include <net/if_llatbl.h>
67#define L3_ADDR_SIN6(le) ((struct sockaddr_in6 *) L3_ADDR(le))
68#include <netinet6/in6_var.h>
69#include <netinet6/in6_ifattach.h>
70#include <netinet/ip6.h>
71#include <netinet6/ip6_var.h>
72#include <netinet6/scope6_var.h>
73#include <netinet6/nd6.h>
74#include <netinet/icmp6.h>
75#include <netinet/ip_carp.h>
76#include <netinet6/send.h>
77
78#define SDL(s) ((struct sockaddr_dl *)s)
79
80struct dadq;
81static struct dadq *nd6_dad_find(struct ifaddr *);
82static void nd6_dad_starttimer(struct dadq *, int);
83static void nd6_dad_stoptimer(struct dadq *);
84static void nd6_dad_timer(struct dadq *);
85static void nd6_dad_ns_output(struct dadq *, struct ifaddr *);
86static void nd6_dad_ns_input(struct ifaddr *);
87static void nd6_dad_na_input(struct ifaddr *);
88
89VNET_DEFINE(int, dad_ignore_ns) = 0; /* ignore NS in DAD - specwise incorrect*/
90VNET_DEFINE(int, dad_maxtry) = 15; /* max # of *tries* to transmit DAD packet */
91#define V_dad_ignore_ns VNET(dad_ignore_ns)
92#define V_dad_maxtry VNET(dad_maxtry)
93
94/*
95 * Input a Neighbor Solicitation Message.
96 *
97 * Based on RFC 2461
98 * Based on RFC 2462 (duplicate address detection)
99 */
100void
101nd6_ns_input(struct mbuf *m, int off, int icmp6len)
102{
103 struct ifnet *ifp = m->m_pkthdr.rcvif;
104 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
105 struct nd_neighbor_solicit *nd_ns;
106 struct in6_addr saddr6 = ip6->ip6_src;
107 struct in6_addr daddr6 = ip6->ip6_dst;
108 struct in6_addr taddr6;
109 struct in6_addr myaddr6;
110 char *lladdr = NULL;
111 struct ifaddr *ifa = NULL;
112 int lladdrlen = 0;
113 int anycast = 0, proxy = 0, tentative = 0;
114 int tlladdr;
115 union nd_opts ndopts;
116 struct sockaddr_dl *proxydl = NULL;
117 char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
118
119#ifndef PULLDOWN_TEST
120 IP6_EXTHDR_CHECK(m, off, icmp6len,);
121 nd_ns = (struct nd_neighbor_solicit *)((caddr_t)ip6 + off);
122#else
123 IP6_EXTHDR_GET(nd_ns, struct nd_neighbor_solicit *, m, off, icmp6len);
124 if (nd_ns == NULL) {
125 ICMP6STAT_INC(icp6s_tooshort);
126 return;
127 }
128#endif
129 ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */
130 taddr6 = nd_ns->nd_ns_target;
131 if (in6_setscope(&taddr6, ifp, NULL) != 0)
132 goto bad;
133
134 if (ip6->ip6_hlim != 255) {
135 nd6log((LOG_ERR,
136 "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n",
137 ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src),
138 ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp)));
139 goto bad;
140 }
141
142 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) {
143 /* dst has to be a solicited node multicast address. */
144 if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL &&
145 /* don't check ifindex portion */
146 daddr6.s6_addr32[1] == 0 &&
147 daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE &&
148 daddr6.s6_addr8[12] == 0xff) {
149 ; /* good */
150 } else {
151 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
152 "(wrong ip6 dst)\n"));
153 goto bad;
154 }
155 } else if (!V_nd6_onlink_ns_rfc4861) {
156 struct sockaddr_in6 src_sa6;
157
158 /*
159 * According to recent IETF discussions, it is not a good idea
160 * to accept a NS from an address which would not be deemed
161 * to be a neighbor otherwise. This point is expected to be
162 * clarified in future revisions of the specification.
163 */
164 bzero(&src_sa6, sizeof(src_sa6));
165 src_sa6.sin6_family = AF_INET6;
166 src_sa6.sin6_len = sizeof(src_sa6);
167 src_sa6.sin6_addr = saddr6;
168 if (nd6_is_addr_neighbor(&src_sa6, ifp) == 0) {
169 nd6log((LOG_INFO, "nd6_ns_input: "
170 "NS packet from non-neighbor\n"));
171 goto bad;
172 }
173 }
174
175 if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
176 nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n"));
177 goto bad;
178 }
179
180 icmp6len -= sizeof(*nd_ns);
181 nd6_option_init(nd_ns + 1, icmp6len, &ndopts);
182 if (nd6_options(&ndopts) < 0) {
183 nd6log((LOG_INFO,
184 "nd6_ns_input: invalid ND option, ignored\n"));
185 /* nd6_options have incremented stats */
186 goto freeit;
187 }
188
189 if (ndopts.nd_opts_src_lladdr) {
190 lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1);
191 lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3;
192 }
193
194 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) && lladdr) {
195 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
196 "(link-layer address option)\n"));
197 goto bad;
198 }
199
200 /*
201 * Attaching target link-layer address to the NA?
202 * (RFC 2461 7.2.4)
203 *
204 * NS IP dst is unicast/anycast MUST NOT add
205 * NS IP dst is solicited-node multicast MUST add
206 *
207 * In implementation, we add target link-layer address by default.
208 * We do not add one in MUST NOT cases.
209 */
210 if (!IN6_IS_ADDR_MULTICAST(&daddr6))
211 tlladdr = 0;
212 else
213 tlladdr = 1;
214
215 /*
216 * Target address (taddr6) must be either:
217 * (1) Valid unicast/anycast address for my receiving interface,
218 * (2) Unicast address for which I'm offering proxy service, or
219 * (3) "tentative" address on which DAD is being performed.
220 */
221 /* (1) and (3) check. */
222 if (ifp->if_carp)
223 ifa = (*carp_iamatch6_p)(ifp, &taddr6);
224 if (ifa == NULL)
225 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
226
227 /* (2) check. */
228 if (ifa == NULL) {
229 struct rtentry *rt;
230 struct sockaddr_in6 tsin6;
231 int need_proxy;
232#ifdef RADIX_MPATH
233 struct route_in6 ro;
234#endif
235
236 bzero(&tsin6, sizeof tsin6);
237 tsin6.sin6_len = sizeof(struct sockaddr_in6);
238 tsin6.sin6_family = AF_INET6;
239 tsin6.sin6_addr = taddr6;
240
241#ifdef RADIX_MPATH
242 bzero(&ro, sizeof(ro));
243 ro.ro_dst = tsin6;
244 rtalloc_mpath((struct route *)&ro, RTF_ANNOUNCE);
245 rt = ro.ro_rt;
246#else
247 rt = rtalloc1((struct sockaddr *)&tsin6, 0, 0);
248#endif
249 need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 &&
250 rt->rt_gateway->sa_family == AF_LINK);
251 if (rt)
252 RTFREE_LOCKED(rt);
253 if (need_proxy) {
254 /*
255 * proxy NDP for single entry
256 */
257 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp,
258 IN6_IFF_NOTREADY|IN6_IFF_ANYCAST);
259 if (ifa) {
260 proxy = 1;
261 proxydl = SDL(rt->rt_gateway);
262 }
263 }
264 }
265 if (ifa == NULL) {
266 /*
267 * We've got an NS packet, and we don't have that adddress
268 * assigned for us. We MUST silently ignore it.
269 * See RFC2461 7.2.3.
270 */
271 goto freeit;
272 }
273 myaddr6 = *IFA_IN6(ifa);
274 anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST;
275 tentative = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE;
276 if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED)
277 goto freeit;
278
279 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
280 nd6log((LOG_INFO, "nd6_ns_input: lladdrlen mismatch for %s "
281 "(if %d, NS packet %d)\n",
282 ip6_sprintf(ip6bufs, &taddr6),
283 ifp->if_addrlen, lladdrlen - 2));
284 goto bad;
285 }
286
287 if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) {
288 nd6log((LOG_INFO, "nd6_ns_input: duplicate IP6 address %s\n",
289 ip6_sprintf(ip6bufs, &saddr6)));
290 goto freeit;
291 }
292
293 /*
294 * We have neighbor solicitation packet, with target address equals to
295 * one of my tentative address.
296 *
297 * src addr how to process?
298 * --- ---
299 * multicast of course, invalid (rejected in ip6_input)
300 * unicast somebody is doing address resolution -> ignore
301 * unspec dup address detection
302 *
303 * The processing is defined in RFC 2462.
304 */
305 if (tentative) {
306 /*
307 * If source address is unspecified address, it is for
308 * duplicate address detection.
309 *
310 * If not, the packet is for addess resolution;
311 * silently ignore it.
312 */
313 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6))
314 nd6_dad_ns_input(ifa);
315
316 goto freeit;
317 }
318
319 /*
320 * If the source address is unspecified address, entries must not
321 * be created or updated.
322 * It looks that sender is performing DAD. Output NA toward
323 * all-node multicast address, to tell the sender that I'm using
324 * the address.
325 * S bit ("solicited") must be zero.
326 */
327 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) {
328 struct in6_addr in6_all;
329
330 in6_all = in6addr_linklocal_allnodes;
331 if (in6_setscope(&in6_all, ifp, NULL) != 0)
332 goto bad;
333 nd6_na_output(ifp, &in6_all, &taddr6,
334 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) |
335 (V_ip6_forwarding ? ND_NA_FLAG_ROUTER : 0),
336 tlladdr, (struct sockaddr *)proxydl);
337 goto freeit;
338 }
339
340 nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen,
341 ND_NEIGHBOR_SOLICIT, 0);
342
343 nd6_na_output(ifp, &saddr6, &taddr6,
344 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) |
345 (V_ip6_forwarding ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED,
346 tlladdr, (struct sockaddr *)proxydl);
347 freeit:
348 if (ifa != NULL)
349 ifa_free(ifa);
350 m_freem(m);
351 return;
352
353 bad:
354 nd6log((LOG_ERR, "nd6_ns_input: src=%s\n",
355 ip6_sprintf(ip6bufs, &saddr6)));
356 nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n",
357 ip6_sprintf(ip6bufs, &daddr6)));
358 nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n",
359 ip6_sprintf(ip6bufs, &taddr6)));
360 ICMP6STAT_INC(icp6s_badns);
361 if (ifa != NULL)
362 ifa_free(ifa);
363 m_freem(m);
364}
365
366/*
367 * Output a Neighbor Solicitation Message. Caller specifies:
368 * - ICMP6 header source IP6 address
369 * - ND6 header target IP6 address
370 * - ND6 header source datalink address
371 *
372 * Based on RFC 2461
373 * Based on RFC 2462 (duplicate address detection)
374 *
375 * ln - for source address determination
376 * dad - duplicate address detection
377 */
378void
379nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6,
380 const struct in6_addr *taddr6, struct llentry *ln, int dad)
381{
382 struct mbuf *m;
383 struct m_tag *mtag;
384 struct ip6_hdr *ip6;
385 struct nd_neighbor_solicit *nd_ns;
386 struct in6_addr *src, src_in;
387 struct ip6_moptions im6o;
388 int icmp6len;
389 int maxlen;
390 caddr_t mac;
391 struct route_in6 ro;
392
393 if (IN6_IS_ADDR_MULTICAST(taddr6))
394 return;
395
396 /* estimate the size of message */
397 maxlen = sizeof(*ip6) + sizeof(*nd_ns);
398 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7;
399 if (max_linkhdr + maxlen >= MCLBYTES) {
400#ifdef DIAGNOSTIC
401 printf("nd6_ns_output: max_linkhdr + maxlen >= MCLBYTES "
402 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES);
403#endif
404 return;
405 }
406
407 MGETHDR(m, M_DONTWAIT, MT_DATA);
408 if (m && max_linkhdr + maxlen >= MHLEN) {
409 MCLGET(m, M_DONTWAIT);
410 if ((m->m_flags & M_EXT) == 0) {
411 m_free(m);
412 m = NULL;
413 }
414 }
415 if (m == NULL)
416 return;
417 m->m_pkthdr.rcvif = NULL;
418
419 bzero(&ro, sizeof(ro));
420
421 if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) {
422 m->m_flags |= M_MCAST;
423 im6o.im6o_multicast_ifp = ifp;
424 im6o.im6o_multicast_hlim = 255;
425 im6o.im6o_multicast_loop = 0;
426 }
427
428 icmp6len = sizeof(*nd_ns);
429 m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len;
430 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */
431
432 /* fill neighbor solicitation packet */
433 ip6 = mtod(m, struct ip6_hdr *);
434 ip6->ip6_flow = 0;
435 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
436 ip6->ip6_vfc |= IPV6_VERSION;
437 /* ip6->ip6_plen will be set later */
438 ip6->ip6_nxt = IPPROTO_ICMPV6;
439 ip6->ip6_hlim = 255;
440 if (daddr6)
441 ip6->ip6_dst = *daddr6;
442 else {
443 ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL;
444 ip6->ip6_dst.s6_addr16[1] = 0;
445 ip6->ip6_dst.s6_addr32[1] = 0;
446 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE;
447 ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3];
448 ip6->ip6_dst.s6_addr8[12] = 0xff;
449 if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0)
450 goto bad;
451 }
452 if (!dad) {
453 struct ifaddr *ifa;
454
455 /*
456 * RFC2461 7.2.2:
457 * "If the source address of the packet prompting the
458 * solicitation is the same as one of the addresses assigned
459 * to the outgoing interface, that address SHOULD be placed
460 * in the IP Source Address of the outgoing solicitation.
461 * Otherwise, any one of the addresses assigned to the
462 * interface should be used."
463 *
464 * We use the source address for the prompting packet
465 * (saddr6), if:
466 * - saddr6 is given from the caller (by giving "ln"), and
467 * - saddr6 belongs to the outgoing interface.
468 * Otherwise, we perform the source address selection as usual.
469 */
470 struct ip6_hdr *hip6; /* hold ip6 */
471 struct in6_addr *hsrc = NULL;
472
473 if ((ln != NULL) && ln->la_hold) {
474 /*
475 * assuming every packet in la_hold has the same IP
476 * header
477 */
478 hip6 = mtod(ln->la_hold, struct ip6_hdr *);
479 /* XXX pullup? */
480 if (sizeof(*hip6) < ln->la_hold->m_len)
481 hsrc = &hip6->ip6_src;
482 else
483 hsrc = NULL;
484 }
485 if (hsrc && (ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp,
486 hsrc)) != NULL) {
487 src = hsrc;
488 ifa_free(ifa);
489 } else {
490 int error;
491 struct sockaddr_in6 dst_sa;
492
493 bzero(&dst_sa, sizeof(dst_sa));
494 dst_sa.sin6_family = AF_INET6;
495 dst_sa.sin6_len = sizeof(dst_sa);
496 dst_sa.sin6_addr = ip6->ip6_dst;
497
498 error = in6_selectsrc(&dst_sa, NULL,
499 NULL, &ro, NULL, NULL, &src_in);
500 if (error) {
501 char ip6buf[INET6_ADDRSTRLEN];
502 nd6log((LOG_DEBUG,
503 "nd6_ns_output: source can't be "
504 "determined: dst=%s, error=%d\n",
505 ip6_sprintf(ip6buf, &dst_sa.sin6_addr),
506 error));
507 goto bad;
508 }
509 src = &src_in;
510 }
511 } else {
512 /*
513 * Source address for DAD packet must always be IPv6
514 * unspecified address. (0::0)
515 * We actually don't have to 0-clear the address (we did it
516 * above), but we do so here explicitly to make the intention
517 * clearer.
518 */
519 bzero(&src_in, sizeof(src_in));
520 src = &src_in;
521 }
522 ip6->ip6_src = *src;
523 nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1);
524 nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT;
525 nd_ns->nd_ns_code = 0;
526 nd_ns->nd_ns_reserved = 0;
527 nd_ns->nd_ns_target = *taddr6;
528 in6_clearscope(&nd_ns->nd_ns_target); /* XXX */
529
530 /*
531 * Add source link-layer address option.
532 *
533 * spec implementation
534 * --- ---
535 * DAD packet MUST NOT do not add the option
536 * there's no link layer address:
537 * impossible do not add the option
538 * there's link layer address:
539 * Multicast NS MUST add one add the option
540 * Unicast NS SHOULD add one add the option
541 */
542 if (!dad && (mac = nd6_ifptomac(ifp))) {
543 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
544 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1);
545 /* 8 byte alignments... */
546 optlen = (optlen + 7) & ~7;
547
548 m->m_pkthdr.len += optlen;
549 m->m_len += optlen;
550 icmp6len += optlen;
551 bzero((caddr_t)nd_opt, optlen);
552 nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR;
553 nd_opt->nd_opt_len = optlen >> 3;
554 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
555 }
556
557 ip6->ip6_plen = htons((u_short)icmp6len);
558 nd_ns->nd_ns_cksum = 0;
559 nd_ns->nd_ns_cksum =
560 in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len);
561
562 if (send_sendso_input_hook != NULL) {
563 mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
564 sizeof(unsigned short), M_NOWAIT);
565 if (mtag == NULL)
566 goto bad;
567 *(unsigned short *)(mtag + 1) = nd_ns->nd_ns_type;
568 m_tag_prepend(m, mtag);
569 }
570
571 ip6_output(m, NULL, &ro, dad ? IPV6_UNSPECSRC : 0, &im6o, NULL, NULL);
572 icmp6_ifstat_inc(ifp, ifs6_out_msg);
573 icmp6_ifstat_inc(ifp, ifs6_out_neighborsolicit);
574 ICMP6STAT_INC(icp6s_outhist[ND_NEIGHBOR_SOLICIT]);
575
576 if (ro.ro_rt) { /* we don't cache this route. */
577 RTFREE(ro.ro_rt);
578 }
579 return;
580
581 bad:
582 if (ro.ro_rt) {
583 RTFREE(ro.ro_rt);
584 }
585 m_freem(m);
586 return;
587}
588
589/*
590 * Neighbor advertisement input handling.
591 *
592 * Based on RFC 2461
593 * Based on RFC 2462 (duplicate address detection)
594 *
595 * the following items are not implemented yet:
596 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
597 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
598 */
599void
600nd6_na_input(struct mbuf *m, int off, int icmp6len)
601{
602 struct ifnet *ifp = m->m_pkthdr.rcvif;
603 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
604 struct nd_neighbor_advert *nd_na;
605 struct in6_addr daddr6 = ip6->ip6_dst;
606 struct in6_addr taddr6;
607 int flags;
608 int is_router;
609 int is_solicited;
610 int is_override;
611 char *lladdr = NULL;
612 int lladdrlen = 0;
613 int checklink = 0;
614 struct ifaddr *ifa;
615 struct llentry *ln = NULL;
616 union nd_opts ndopts;
617 struct mbuf *chain = NULL;
618 struct m_tag *mtag;
619 struct sockaddr_in6 sin6;
620 char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
621
622 if (ip6->ip6_hlim != 255) {
623 nd6log((LOG_ERR,
624 "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n",
625 ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src),
626 ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp)));
627 goto bad;
628 }
629
630#ifndef PULLDOWN_TEST
631 IP6_EXTHDR_CHECK(m, off, icmp6len,);
632 nd_na = (struct nd_neighbor_advert *)((caddr_t)ip6 + off);
633#else
634 IP6_EXTHDR_GET(nd_na, struct nd_neighbor_advert *, m, off, icmp6len);
635 if (nd_na == NULL) {
636 ICMP6STAT_INC(icp6s_tooshort);
637 return;
638 }
639#endif
640
641 flags = nd_na->nd_na_flags_reserved;
642 is_router = ((flags & ND_NA_FLAG_ROUTER) != 0);
643 is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0);
644 is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0);
645
646 taddr6 = nd_na->nd_na_target;
647 if (in6_setscope(&taddr6, ifp, NULL))
648 goto bad; /* XXX: impossible */
649
650 if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
651 nd6log((LOG_ERR,
652 "nd6_na_input: invalid target address %s\n",
653 ip6_sprintf(ip6bufs, &taddr6)));
654 goto bad;
655 }
656 if (IN6_IS_ADDR_MULTICAST(&daddr6))
657 if (is_solicited) {
658 nd6log((LOG_ERR,
659 "nd6_na_input: a solicited adv is multicasted\n"));
660 goto bad;
661 }
662
663 icmp6len -= sizeof(*nd_na);
664 nd6_option_init(nd_na + 1, icmp6len, &ndopts);
665 if (nd6_options(&ndopts) < 0) {
666 nd6log((LOG_INFO,
667 "nd6_na_input: invalid ND option, ignored\n"));
668 /* nd6_options have incremented stats */
669 goto freeit;
670 }
671
672 if (ndopts.nd_opts_tgt_lladdr) {
673 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
674 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
675 }
676
677 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
678
679 /*
680 * Target address matches one of my interface address.
681 *
682 * If my address is tentative, this means that there's somebody
683 * already using the same address as mine. This indicates DAD failure.
684 * This is defined in RFC 2462.
685 *
686 * Otherwise, process as defined in RFC 2461.
687 */
688 if (ifa
689 && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) {
690 ifa_free(ifa);
691 nd6_dad_na_input(ifa);
692 goto freeit;
693 }
694
695 /* Just for safety, maybe unnecessary. */
696 if (ifa) {
697 ifa_free(ifa);
698 log(LOG_ERR,
699 "nd6_na_input: duplicate IP6 address %s\n",
700 ip6_sprintf(ip6bufs, &taddr6));
701 goto freeit;
702 }
703
704 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
705 nd6log((LOG_INFO, "nd6_na_input: lladdrlen mismatch for %s "
706 "(if %d, NA packet %d)\n", ip6_sprintf(ip6bufs, &taddr6),
707 ifp->if_addrlen, lladdrlen - 2));
708 goto bad;
709 }
710
711 /*
712 * If no neighbor cache entry is found, NA SHOULD silently be
713 * discarded.
714 */
715 IF_AFDATA_LOCK(ifp);
716 ln = nd6_lookup(&taddr6, LLE_EXCLUSIVE, ifp);
717 IF_AFDATA_UNLOCK(ifp);
718 if (ln == NULL) {
719 goto freeit;
720 }
721
722 if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
723 /*
724 * If the link-layer has address, and no lladdr option came,
725 * discard the packet.
726 */
727 if (ifp->if_addrlen && lladdr == NULL) {
728 goto freeit;
729 }
730
731 /*
732 * Record link-layer address, and update the state.
733 */
734 bcopy(lladdr, &ln->ll_addr, ifp->if_addrlen);
735 ln->la_flags |= LLE_VALID;
736 if (is_solicited) {
737 ln->ln_state = ND6_LLINFO_REACHABLE;
738 ln->ln_byhint = 0;
739 if (!ND6_LLINFO_PERMANENT(ln)) {
740 nd6_llinfo_settimer_locked(ln,
741 (long)ND_IFINFO(ln->lle_tbl->llt_ifp)->reachable * hz);
742 }
743 } else {
744 ln->ln_state = ND6_LLINFO_STALE;
745 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
746 }
747 if ((ln->ln_router = is_router) != 0) {
748 /*
749 * This means a router's state has changed from
750 * non-reachable to probably reachable, and might
751 * affect the status of associated prefixes..
752 */
753 checklink = 1;
754 }
755 } else {
756 int llchange;
757
758 /*
759 * Check if the link-layer address has changed or not.
760 */
761 if (lladdr == NULL)
762 llchange = 0;
763 else {
764 if (ln->la_flags & LLE_VALID) {
765 if (bcmp(lladdr, &ln->ll_addr, ifp->if_addrlen))
766 llchange = 1;
767 else
768 llchange = 0;
769 } else
770 llchange = 1;
771 }
772
773 /*
774 * This is VERY complex. Look at it with care.
775 *
776 * override solicit lladdr llchange action
777 * (L: record lladdr)
778 *
779 * 0 0 n -- (2c)
780 * 0 0 y n (2b) L
781 * 0 0 y y (1) REACHABLE->STALE
782 * 0 1 n -- (2c) *->REACHABLE
783 * 0 1 y n (2b) L *->REACHABLE
784 * 0 1 y y (1) REACHABLE->STALE
785 * 1 0 n -- (2a)
786 * 1 0 y n (2a) L
787 * 1 0 y y (2a) L *->STALE
788 * 1 1 n -- (2a) *->REACHABLE
789 * 1 1 y n (2a) L *->REACHABLE
790 * 1 1 y y (2a) L *->REACHABLE
791 */
792 if (!is_override && (lladdr != NULL && llchange)) { /* (1) */
793 /*
794 * If state is REACHABLE, make it STALE.
795 * no other updates should be done.
796 */
797 if (ln->ln_state == ND6_LLINFO_REACHABLE) {
798 ln->ln_state = ND6_LLINFO_STALE;
799 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
800 }
801 goto freeit;
802 } else if (is_override /* (2a) */
803 || (!is_override && (lladdr != NULL && !llchange)) /* (2b) */
804 || lladdr == NULL) { /* (2c) */
805 /*
806 * Update link-local address, if any.
807 */
808 if (lladdr != NULL) {
809 bcopy(lladdr, &ln->ll_addr, ifp->if_addrlen);
810 ln->la_flags |= LLE_VALID;
811 }
812
813 /*
814 * If solicited, make the state REACHABLE.
815 * If not solicited and the link-layer address was
816 * changed, make it STALE.
817 */
818 if (is_solicited) {
819 ln->ln_state = ND6_LLINFO_REACHABLE;
820 ln->ln_byhint = 0;
821 if (!ND6_LLINFO_PERMANENT(ln)) {
822 nd6_llinfo_settimer_locked(ln,
823 (long)ND_IFINFO(ifp)->reachable * hz);
824 }
825 } else {
826 if (lladdr != NULL && llchange) {
827 ln->ln_state = ND6_LLINFO_STALE;
828 nd6_llinfo_settimer_locked(ln,
829 (long)V_nd6_gctimer * hz);
830 }
831 }
832 }
833
834 if (ln->ln_router && !is_router) {
835 /*
836 * The peer dropped the router flag.
837 * Remove the sender from the Default Router List and
838 * update the Destination Cache entries.
839 */
840 struct nd_defrouter *dr;
841 struct in6_addr *in6;
842
843 in6 = &L3_ADDR_SIN6(ln)->sin6_addr;
844
845 /*
846 * Lock to protect the default router list.
847 * XXX: this might be unnecessary, since this function
848 * is only called under the network software interrupt
849 * context. However, we keep it just for safety.
850 */
851 dr = defrouter_lookup(in6, ln->lle_tbl->llt_ifp);
852 if (dr)
853 defrtrlist_del(dr);
854 else if (!V_ip6_forwarding) {
855 /*
856 * Even if the neighbor is not in the default
857 * router list, the neighbor may be used
858 * as a next hop for some destinations
859 * (e.g. redirect case). So we must
860 * call rt6_flush explicitly.
861 */
862 rt6_flush(&ip6->ip6_src, ifp);
863 }
864 }
865 ln->ln_router = is_router;
866 }
867 /* XXX - QL
868 * Does this matter?
869 * rt->rt_flags &= ~RTF_REJECT;
870 */
871 ln->la_asked = 0;
872 if (ln->la_hold) {
873 struct mbuf *m_hold, *m_hold_next;
874
875 /*
876 * reset the la_hold in advance, to explicitly
877 * prevent a la_hold lookup in nd6_output()
878 * (wouldn't happen, though...)
879 */
880 for (m_hold = ln->la_hold, ln->la_hold = NULL;
881 m_hold; m_hold = m_hold_next) {
882 m_hold_next = m_hold->m_nextpkt;
883 m_hold->m_nextpkt = NULL;
884 /*
885 * we assume ifp is not a loopback here, so just set
886 * the 2nd argument as the 1st one.
887 */
888
889 if (send_sendso_input_hook != NULL) {
890 mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
891 sizeof(unsigned short), M_NOWAIT);
892 if (mtag == NULL)
893 goto bad;
894 m_tag_prepend(m, mtag);
895 }
896
897 nd6_output_lle(ifp, ifp, m_hold, L3_ADDR_SIN6(ln), NULL, ln, &chain);
898 }
899 }
900 freeit:
901 if (ln != NULL) {
902 if (chain)
903 memcpy(&sin6, L3_ADDR_SIN6(ln), sizeof(sin6));
904 LLE_WUNLOCK(ln);
905
906 if (chain)
907 nd6_output_flush(ifp, ifp, chain, &sin6, NULL);
908 }
909 if (checklink)
910 pfxlist_onlink_check();
911
912 m_freem(m);
913 return;
914
915 bad:
916 if (ln != NULL)
917 LLE_WUNLOCK(ln);
918
919 ICMP6STAT_INC(icp6s_badna);
920 m_freem(m);
921}
922
923/*
924 * Neighbor advertisement output handling.
925 *
926 * Based on RFC 2461
927 *
928 * the following items are not implemented yet:
929 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
930 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
931 *
932 * tlladdr - 1 if include target link-layer address
933 * sdl0 - sockaddr_dl (= proxy NA) or NULL
934 */
935void
936nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6_0,
937 const struct in6_addr *taddr6, u_long flags, int tlladdr,
938 struct sockaddr *sdl0)
939{
940 struct mbuf *m;
941 struct m_tag *mtag;
942 struct ip6_hdr *ip6;
943 struct nd_neighbor_advert *nd_na;
944 struct ip6_moptions im6o;
945 struct in6_addr src, daddr6;
946 struct sockaddr_in6 dst_sa;
947 int icmp6len, maxlen, error;
948 caddr_t mac = NULL;
949 struct route_in6 ro;
950
951 bzero(&ro, sizeof(ro));
952
953 daddr6 = *daddr6_0; /* make a local copy for modification */
954
955 /* estimate the size of message */
956 maxlen = sizeof(*ip6) + sizeof(*nd_na);
957 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7;
958 if (max_linkhdr + maxlen >= MCLBYTES) {
959#ifdef DIAGNOSTIC
960 printf("nd6_na_output: max_linkhdr + maxlen >= MCLBYTES "
961 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES);
962#endif
963 return;
964 }
965
966 MGETHDR(m, M_DONTWAIT, MT_DATA);
967 if (m && max_linkhdr + maxlen >= MHLEN) {
968 MCLGET(m, M_DONTWAIT);
969 if ((m->m_flags & M_EXT) == 0) {
970 m_free(m);
971 m = NULL;
972 }
973 }
974 if (m == NULL)
975 return;
976 m->m_pkthdr.rcvif = NULL;
977
978 if (IN6_IS_ADDR_MULTICAST(&daddr6)) {
979 m->m_flags |= M_MCAST;
980 im6o.im6o_multicast_ifp = ifp;
981 im6o.im6o_multicast_hlim = 255;
982 im6o.im6o_multicast_loop = 0;
983 }
984
985 icmp6len = sizeof(*nd_na);
986 m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len;
987 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */
988
989 /* fill neighbor advertisement packet */
990 ip6 = mtod(m, struct ip6_hdr *);
991 ip6->ip6_flow = 0;
992 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
993 ip6->ip6_vfc |= IPV6_VERSION;
994 ip6->ip6_nxt = IPPROTO_ICMPV6;
995 ip6->ip6_hlim = 255;
996 if (IN6_IS_ADDR_UNSPECIFIED(&daddr6)) {
997 /* reply to DAD */
998 daddr6.s6_addr16[0] = IPV6_ADDR_INT16_MLL;
999 daddr6.s6_addr16[1] = 0;
1000 daddr6.s6_addr32[1] = 0;
1001 daddr6.s6_addr32[2] = 0;
1002 daddr6.s6_addr32[3] = IPV6_ADDR_INT32_ONE;
1003 if (in6_setscope(&daddr6, ifp, NULL))
1004 goto bad;
1005
1006 flags &= ~ND_NA_FLAG_SOLICITED;
1007 }
1008 ip6->ip6_dst = daddr6;
1009 bzero(&dst_sa, sizeof(struct sockaddr_in6));
1010 dst_sa.sin6_family = AF_INET6;
1011 dst_sa.sin6_len = sizeof(struct sockaddr_in6);
1012 dst_sa.sin6_addr = daddr6;
1013
1014 /*
1015 * Select a source whose scope is the same as that of the dest.
1016 */
1017 bcopy(&dst_sa, &ro.ro_dst, sizeof(dst_sa));
1018 error = in6_selectsrc(&dst_sa, NULL, NULL, &ro, NULL, NULL, &src);
1019 if (error) {
1020 char ip6buf[INET6_ADDRSTRLEN];
1021 nd6log((LOG_DEBUG, "nd6_na_output: source can't be "
1022 "determined: dst=%s, error=%d\n",
1023 ip6_sprintf(ip6buf, &dst_sa.sin6_addr), error));
1024 goto bad;
1025 }
1026 ip6->ip6_src = src;
1027 nd_na = (struct nd_neighbor_advert *)(ip6 + 1);
1028 nd_na->nd_na_type = ND_NEIGHBOR_ADVERT;
1029 nd_na->nd_na_code = 0;
1030 nd_na->nd_na_target = *taddr6;
1031 in6_clearscope(&nd_na->nd_na_target); /* XXX */
1032
1033 /*
1034 * "tlladdr" indicates NS's condition for adding tlladdr or not.
1035 * see nd6_ns_input() for details.
1036 * Basically, if NS packet is sent to unicast/anycast addr,
1037 * target lladdr option SHOULD NOT be included.
1038 */
1039 if (tlladdr) {
1040 /*
1041 * sdl0 != NULL indicates proxy NA. If we do proxy, use
1042 * lladdr in sdl0. If we are not proxying (sending NA for
1043 * my address) use lladdr configured for the interface.
1044 */
1045 if (sdl0 == NULL) {
1046 if (ifp->if_carp)
1047 mac = (*carp_macmatch6_p)(ifp, m, taddr6);
1048 if (mac == NULL)
1049 mac = nd6_ifptomac(ifp);
1050 } else if (sdl0->sa_family == AF_LINK) {
1051 struct sockaddr_dl *sdl;
1052 sdl = (struct sockaddr_dl *)sdl0;
1053 if (sdl->sdl_alen == ifp->if_addrlen)
1054 mac = LLADDR(sdl);
1055 }
1056 }
1057 if (tlladdr && mac) {
1058 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
1059 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1);
1060
1061 /* roundup to 8 bytes alignment! */
1062 optlen = (optlen + 7) & ~7;
1063
1064 m->m_pkthdr.len += optlen;
1065 m->m_len += optlen;
1066 icmp6len += optlen;
1067 bzero((caddr_t)nd_opt, optlen);
1068 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1069 nd_opt->nd_opt_len = optlen >> 3;
1070 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
1071 } else
1072 flags &= ~ND_NA_FLAG_OVERRIDE;
1073
1074 ip6->ip6_plen = htons((u_short)icmp6len);
1075 nd_na->nd_na_flags_reserved = flags;
1076 nd_na->nd_na_cksum = 0;
1077 nd_na->nd_na_cksum =
1078 in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len);
1079
1080 if (send_sendso_input_hook != NULL) {
1081 mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
1082 sizeof(unsigned short), M_NOWAIT);
1083 if (mtag == NULL)
1084 goto bad;
1085 *(unsigned short *)(mtag + 1) = nd_na->nd_na_type;
1086 m_tag_prepend(m, mtag);
1087 }
1088
1089 ip6_output(m, NULL, &ro, 0, &im6o, NULL, NULL);
1090 icmp6_ifstat_inc(ifp, ifs6_out_msg);
1091 icmp6_ifstat_inc(ifp, ifs6_out_neighboradvert);
1092 ICMP6STAT_INC(icp6s_outhist[ND_NEIGHBOR_ADVERT]);
1093
1094 if (ro.ro_rt) { /* we don't cache this route. */
1095 RTFREE(ro.ro_rt);
1096 }
1097 return;
1098
1099 bad:
1100 if (ro.ro_rt) {
1101 RTFREE(ro.ro_rt);
1102 }
1103 m_freem(m);
1104 return;
1105}
1106
1107caddr_t
1108nd6_ifptomac(struct ifnet *ifp)
1109{
1110 switch (ifp->if_type) {
1111 case IFT_ARCNET:
1112 case IFT_ETHER:
1113 case IFT_FDDI:
1114 case IFT_IEEE1394:
1115#ifdef IFT_L2VLAN
1116 case IFT_L2VLAN:
1117#endif
1118#ifdef IFT_IEEE80211
1119 case IFT_IEEE80211:
1120#endif
1121#ifdef IFT_CARP
1122 case IFT_CARP:
1123#endif
1124 case IFT_BRIDGE:
1125 case IFT_ISO88025:
1126 return IF_LLADDR(ifp);
1127 default:
1128 return NULL;
1129 }
1130}
1131
1132struct dadq {
1133 TAILQ_ENTRY(dadq) dad_list;
1134 struct ifaddr *dad_ifa;
1135 int dad_count; /* max NS to send */
1136 int dad_ns_tcount; /* # of trials to send NS */
1137 int dad_ns_ocount; /* NS sent so far */
1138 int dad_ns_icount;
1139 int dad_na_icount;
1140 struct callout dad_timer_ch;
1141 struct vnet *dad_vnet;
1142};
1143
| 34
35#include "opt_inet.h"
36#include "opt_inet6.h"
37#include "opt_ipsec.h"
38#include "opt_mpath.h"
39
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/malloc.h>
43#include <sys/lock.h>
44#include <sys/rwlock.h>
45#include <sys/mbuf.h>
46#include <sys/socket.h>
47#include <sys/sockio.h>
48#include <sys/time.h>
49#include <sys/kernel.h>
50#include <sys/errno.h>
51#include <sys/syslog.h>
52#include <sys/queue.h>
53#include <sys/callout.h>
54
55#include <net/if.h>
56#include <net/if_types.h>
57#include <net/if_dl.h>
58#include <net/if_var.h>
59#include <net/route.h>
60#ifdef RADIX_MPATH
61#include <net/radix_mpath.h>
62#endif
63
64#include <netinet/in.h>
65#include <netinet/in_var.h>
66#include <net/if_llatbl.h>
67#define L3_ADDR_SIN6(le) ((struct sockaddr_in6 *) L3_ADDR(le))
68#include <netinet6/in6_var.h>
69#include <netinet6/in6_ifattach.h>
70#include <netinet/ip6.h>
71#include <netinet6/ip6_var.h>
72#include <netinet6/scope6_var.h>
73#include <netinet6/nd6.h>
74#include <netinet/icmp6.h>
75#include <netinet/ip_carp.h>
76#include <netinet6/send.h>
77
78#define SDL(s) ((struct sockaddr_dl *)s)
79
80struct dadq;
81static struct dadq *nd6_dad_find(struct ifaddr *);
82static void nd6_dad_starttimer(struct dadq *, int);
83static void nd6_dad_stoptimer(struct dadq *);
84static void nd6_dad_timer(struct dadq *);
85static void nd6_dad_ns_output(struct dadq *, struct ifaddr *);
86static void nd6_dad_ns_input(struct ifaddr *);
87static void nd6_dad_na_input(struct ifaddr *);
88
89VNET_DEFINE(int, dad_ignore_ns) = 0; /* ignore NS in DAD - specwise incorrect*/
90VNET_DEFINE(int, dad_maxtry) = 15; /* max # of *tries* to transmit DAD packet */
91#define V_dad_ignore_ns VNET(dad_ignore_ns)
92#define V_dad_maxtry VNET(dad_maxtry)
93
94/*
95 * Input a Neighbor Solicitation Message.
96 *
97 * Based on RFC 2461
98 * Based on RFC 2462 (duplicate address detection)
99 */
100void
101nd6_ns_input(struct mbuf *m, int off, int icmp6len)
102{
103 struct ifnet *ifp = m->m_pkthdr.rcvif;
104 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
105 struct nd_neighbor_solicit *nd_ns;
106 struct in6_addr saddr6 = ip6->ip6_src;
107 struct in6_addr daddr6 = ip6->ip6_dst;
108 struct in6_addr taddr6;
109 struct in6_addr myaddr6;
110 char *lladdr = NULL;
111 struct ifaddr *ifa = NULL;
112 int lladdrlen = 0;
113 int anycast = 0, proxy = 0, tentative = 0;
114 int tlladdr;
115 union nd_opts ndopts;
116 struct sockaddr_dl *proxydl = NULL;
117 char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
118
119#ifndef PULLDOWN_TEST
120 IP6_EXTHDR_CHECK(m, off, icmp6len,);
121 nd_ns = (struct nd_neighbor_solicit *)((caddr_t)ip6 + off);
122#else
123 IP6_EXTHDR_GET(nd_ns, struct nd_neighbor_solicit *, m, off, icmp6len);
124 if (nd_ns == NULL) {
125 ICMP6STAT_INC(icp6s_tooshort);
126 return;
127 }
128#endif
129 ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */
130 taddr6 = nd_ns->nd_ns_target;
131 if (in6_setscope(&taddr6, ifp, NULL) != 0)
132 goto bad;
133
134 if (ip6->ip6_hlim != 255) {
135 nd6log((LOG_ERR,
136 "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n",
137 ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src),
138 ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp)));
139 goto bad;
140 }
141
142 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) {
143 /* dst has to be a solicited node multicast address. */
144 if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL &&
145 /* don't check ifindex portion */
146 daddr6.s6_addr32[1] == 0 &&
147 daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE &&
148 daddr6.s6_addr8[12] == 0xff) {
149 ; /* good */
150 } else {
151 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
152 "(wrong ip6 dst)\n"));
153 goto bad;
154 }
155 } else if (!V_nd6_onlink_ns_rfc4861) {
156 struct sockaddr_in6 src_sa6;
157
158 /*
159 * According to recent IETF discussions, it is not a good idea
160 * to accept a NS from an address which would not be deemed
161 * to be a neighbor otherwise. This point is expected to be
162 * clarified in future revisions of the specification.
163 */
164 bzero(&src_sa6, sizeof(src_sa6));
165 src_sa6.sin6_family = AF_INET6;
166 src_sa6.sin6_len = sizeof(src_sa6);
167 src_sa6.sin6_addr = saddr6;
168 if (nd6_is_addr_neighbor(&src_sa6, ifp) == 0) {
169 nd6log((LOG_INFO, "nd6_ns_input: "
170 "NS packet from non-neighbor\n"));
171 goto bad;
172 }
173 }
174
175 if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
176 nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n"));
177 goto bad;
178 }
179
180 icmp6len -= sizeof(*nd_ns);
181 nd6_option_init(nd_ns + 1, icmp6len, &ndopts);
182 if (nd6_options(&ndopts) < 0) {
183 nd6log((LOG_INFO,
184 "nd6_ns_input: invalid ND option, ignored\n"));
185 /* nd6_options have incremented stats */
186 goto freeit;
187 }
188
189 if (ndopts.nd_opts_src_lladdr) {
190 lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1);
191 lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3;
192 }
193
194 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) && lladdr) {
195 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
196 "(link-layer address option)\n"));
197 goto bad;
198 }
199
200 /*
201 * Attaching target link-layer address to the NA?
202 * (RFC 2461 7.2.4)
203 *
204 * NS IP dst is unicast/anycast MUST NOT add
205 * NS IP dst is solicited-node multicast MUST add
206 *
207 * In implementation, we add target link-layer address by default.
208 * We do not add one in MUST NOT cases.
209 */
210 if (!IN6_IS_ADDR_MULTICAST(&daddr6))
211 tlladdr = 0;
212 else
213 tlladdr = 1;
214
215 /*
216 * Target address (taddr6) must be either:
217 * (1) Valid unicast/anycast address for my receiving interface,
218 * (2) Unicast address for which I'm offering proxy service, or
219 * (3) "tentative" address on which DAD is being performed.
220 */
221 /* (1) and (3) check. */
222 if (ifp->if_carp)
223 ifa = (*carp_iamatch6_p)(ifp, &taddr6);
224 if (ifa == NULL)
225 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
226
227 /* (2) check. */
228 if (ifa == NULL) {
229 struct rtentry *rt;
230 struct sockaddr_in6 tsin6;
231 int need_proxy;
232#ifdef RADIX_MPATH
233 struct route_in6 ro;
234#endif
235
236 bzero(&tsin6, sizeof tsin6);
237 tsin6.sin6_len = sizeof(struct sockaddr_in6);
238 tsin6.sin6_family = AF_INET6;
239 tsin6.sin6_addr = taddr6;
240
241#ifdef RADIX_MPATH
242 bzero(&ro, sizeof(ro));
243 ro.ro_dst = tsin6;
244 rtalloc_mpath((struct route *)&ro, RTF_ANNOUNCE);
245 rt = ro.ro_rt;
246#else
247 rt = rtalloc1((struct sockaddr *)&tsin6, 0, 0);
248#endif
249 need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 &&
250 rt->rt_gateway->sa_family == AF_LINK);
251 if (rt)
252 RTFREE_LOCKED(rt);
253 if (need_proxy) {
254 /*
255 * proxy NDP for single entry
256 */
257 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp,
258 IN6_IFF_NOTREADY|IN6_IFF_ANYCAST);
259 if (ifa) {
260 proxy = 1;
261 proxydl = SDL(rt->rt_gateway);
262 }
263 }
264 }
265 if (ifa == NULL) {
266 /*
267 * We've got an NS packet, and we don't have that adddress
268 * assigned for us. We MUST silently ignore it.
269 * See RFC2461 7.2.3.
270 */
271 goto freeit;
272 }
273 myaddr6 = *IFA_IN6(ifa);
274 anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST;
275 tentative = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE;
276 if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED)
277 goto freeit;
278
279 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
280 nd6log((LOG_INFO, "nd6_ns_input: lladdrlen mismatch for %s "
281 "(if %d, NS packet %d)\n",
282 ip6_sprintf(ip6bufs, &taddr6),
283 ifp->if_addrlen, lladdrlen - 2));
284 goto bad;
285 }
286
287 if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) {
288 nd6log((LOG_INFO, "nd6_ns_input: duplicate IP6 address %s\n",
289 ip6_sprintf(ip6bufs, &saddr6)));
290 goto freeit;
291 }
292
293 /*
294 * We have neighbor solicitation packet, with target address equals to
295 * one of my tentative address.
296 *
297 * src addr how to process?
298 * --- ---
299 * multicast of course, invalid (rejected in ip6_input)
300 * unicast somebody is doing address resolution -> ignore
301 * unspec dup address detection
302 *
303 * The processing is defined in RFC 2462.
304 */
305 if (tentative) {
306 /*
307 * If source address is unspecified address, it is for
308 * duplicate address detection.
309 *
310 * If not, the packet is for addess resolution;
311 * silently ignore it.
312 */
313 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6))
314 nd6_dad_ns_input(ifa);
315
316 goto freeit;
317 }
318
319 /*
320 * If the source address is unspecified address, entries must not
321 * be created or updated.
322 * It looks that sender is performing DAD. Output NA toward
323 * all-node multicast address, to tell the sender that I'm using
324 * the address.
325 * S bit ("solicited") must be zero.
326 */
327 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) {
328 struct in6_addr in6_all;
329
330 in6_all = in6addr_linklocal_allnodes;
331 if (in6_setscope(&in6_all, ifp, NULL) != 0)
332 goto bad;
333 nd6_na_output(ifp, &in6_all, &taddr6,
334 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) |
335 (V_ip6_forwarding ? ND_NA_FLAG_ROUTER : 0),
336 tlladdr, (struct sockaddr *)proxydl);
337 goto freeit;
338 }
339
340 nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen,
341 ND_NEIGHBOR_SOLICIT, 0);
342
343 nd6_na_output(ifp, &saddr6, &taddr6,
344 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) |
345 (V_ip6_forwarding ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED,
346 tlladdr, (struct sockaddr *)proxydl);
347 freeit:
348 if (ifa != NULL)
349 ifa_free(ifa);
350 m_freem(m);
351 return;
352
353 bad:
354 nd6log((LOG_ERR, "nd6_ns_input: src=%s\n",
355 ip6_sprintf(ip6bufs, &saddr6)));
356 nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n",
357 ip6_sprintf(ip6bufs, &daddr6)));
358 nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n",
359 ip6_sprintf(ip6bufs, &taddr6)));
360 ICMP6STAT_INC(icp6s_badns);
361 if (ifa != NULL)
362 ifa_free(ifa);
363 m_freem(m);
364}
365
366/*
367 * Output a Neighbor Solicitation Message. Caller specifies:
368 * - ICMP6 header source IP6 address
369 * - ND6 header target IP6 address
370 * - ND6 header source datalink address
371 *
372 * Based on RFC 2461
373 * Based on RFC 2462 (duplicate address detection)
374 *
375 * ln - for source address determination
376 * dad - duplicate address detection
377 */
378void
379nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6,
380 const struct in6_addr *taddr6, struct llentry *ln, int dad)
381{
382 struct mbuf *m;
383 struct m_tag *mtag;
384 struct ip6_hdr *ip6;
385 struct nd_neighbor_solicit *nd_ns;
386 struct in6_addr *src, src_in;
387 struct ip6_moptions im6o;
388 int icmp6len;
389 int maxlen;
390 caddr_t mac;
391 struct route_in6 ro;
392
393 if (IN6_IS_ADDR_MULTICAST(taddr6))
394 return;
395
396 /* estimate the size of message */
397 maxlen = sizeof(*ip6) + sizeof(*nd_ns);
398 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7;
399 if (max_linkhdr + maxlen >= MCLBYTES) {
400#ifdef DIAGNOSTIC
401 printf("nd6_ns_output: max_linkhdr + maxlen >= MCLBYTES "
402 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES);
403#endif
404 return;
405 }
406
407 MGETHDR(m, M_DONTWAIT, MT_DATA);
408 if (m && max_linkhdr + maxlen >= MHLEN) {
409 MCLGET(m, M_DONTWAIT);
410 if ((m->m_flags & M_EXT) == 0) {
411 m_free(m);
412 m = NULL;
413 }
414 }
415 if (m == NULL)
416 return;
417 m->m_pkthdr.rcvif = NULL;
418
419 bzero(&ro, sizeof(ro));
420
421 if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) {
422 m->m_flags |= M_MCAST;
423 im6o.im6o_multicast_ifp = ifp;
424 im6o.im6o_multicast_hlim = 255;
425 im6o.im6o_multicast_loop = 0;
426 }
427
428 icmp6len = sizeof(*nd_ns);
429 m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len;
430 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */
431
432 /* fill neighbor solicitation packet */
433 ip6 = mtod(m, struct ip6_hdr *);
434 ip6->ip6_flow = 0;
435 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
436 ip6->ip6_vfc |= IPV6_VERSION;
437 /* ip6->ip6_plen will be set later */
438 ip6->ip6_nxt = IPPROTO_ICMPV6;
439 ip6->ip6_hlim = 255;
440 if (daddr6)
441 ip6->ip6_dst = *daddr6;
442 else {
443 ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL;
444 ip6->ip6_dst.s6_addr16[1] = 0;
445 ip6->ip6_dst.s6_addr32[1] = 0;
446 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE;
447 ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3];
448 ip6->ip6_dst.s6_addr8[12] = 0xff;
449 if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0)
450 goto bad;
451 }
452 if (!dad) {
453 struct ifaddr *ifa;
454
455 /*
456 * RFC2461 7.2.2:
457 * "If the source address of the packet prompting the
458 * solicitation is the same as one of the addresses assigned
459 * to the outgoing interface, that address SHOULD be placed
460 * in the IP Source Address of the outgoing solicitation.
461 * Otherwise, any one of the addresses assigned to the
462 * interface should be used."
463 *
464 * We use the source address for the prompting packet
465 * (saddr6), if:
466 * - saddr6 is given from the caller (by giving "ln"), and
467 * - saddr6 belongs to the outgoing interface.
468 * Otherwise, we perform the source address selection as usual.
469 */
470 struct ip6_hdr *hip6; /* hold ip6 */
471 struct in6_addr *hsrc = NULL;
472
473 if ((ln != NULL) && ln->la_hold) {
474 /*
475 * assuming every packet in la_hold has the same IP
476 * header
477 */
478 hip6 = mtod(ln->la_hold, struct ip6_hdr *);
479 /* XXX pullup? */
480 if (sizeof(*hip6) < ln->la_hold->m_len)
481 hsrc = &hip6->ip6_src;
482 else
483 hsrc = NULL;
484 }
485 if (hsrc && (ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp,
486 hsrc)) != NULL) {
487 src = hsrc;
488 ifa_free(ifa);
489 } else {
490 int error;
491 struct sockaddr_in6 dst_sa;
492
493 bzero(&dst_sa, sizeof(dst_sa));
494 dst_sa.sin6_family = AF_INET6;
495 dst_sa.sin6_len = sizeof(dst_sa);
496 dst_sa.sin6_addr = ip6->ip6_dst;
497
498 error = in6_selectsrc(&dst_sa, NULL,
499 NULL, &ro, NULL, NULL, &src_in);
500 if (error) {
501 char ip6buf[INET6_ADDRSTRLEN];
502 nd6log((LOG_DEBUG,
503 "nd6_ns_output: source can't be "
504 "determined: dst=%s, error=%d\n",
505 ip6_sprintf(ip6buf, &dst_sa.sin6_addr),
506 error));
507 goto bad;
508 }
509 src = &src_in;
510 }
511 } else {
512 /*
513 * Source address for DAD packet must always be IPv6
514 * unspecified address. (0::0)
515 * We actually don't have to 0-clear the address (we did it
516 * above), but we do so here explicitly to make the intention
517 * clearer.
518 */
519 bzero(&src_in, sizeof(src_in));
520 src = &src_in;
521 }
522 ip6->ip6_src = *src;
523 nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1);
524 nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT;
525 nd_ns->nd_ns_code = 0;
526 nd_ns->nd_ns_reserved = 0;
527 nd_ns->nd_ns_target = *taddr6;
528 in6_clearscope(&nd_ns->nd_ns_target); /* XXX */
529
530 /*
531 * Add source link-layer address option.
532 *
533 * spec implementation
534 * --- ---
535 * DAD packet MUST NOT do not add the option
536 * there's no link layer address:
537 * impossible do not add the option
538 * there's link layer address:
539 * Multicast NS MUST add one add the option
540 * Unicast NS SHOULD add one add the option
541 */
542 if (!dad && (mac = nd6_ifptomac(ifp))) {
543 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
544 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1);
545 /* 8 byte alignments... */
546 optlen = (optlen + 7) & ~7;
547
548 m->m_pkthdr.len += optlen;
549 m->m_len += optlen;
550 icmp6len += optlen;
551 bzero((caddr_t)nd_opt, optlen);
552 nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR;
553 nd_opt->nd_opt_len = optlen >> 3;
554 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
555 }
556
557 ip6->ip6_plen = htons((u_short)icmp6len);
558 nd_ns->nd_ns_cksum = 0;
559 nd_ns->nd_ns_cksum =
560 in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len);
561
562 if (send_sendso_input_hook != NULL) {
563 mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
564 sizeof(unsigned short), M_NOWAIT);
565 if (mtag == NULL)
566 goto bad;
567 *(unsigned short *)(mtag + 1) = nd_ns->nd_ns_type;
568 m_tag_prepend(m, mtag);
569 }
570
571 ip6_output(m, NULL, &ro, dad ? IPV6_UNSPECSRC : 0, &im6o, NULL, NULL);
572 icmp6_ifstat_inc(ifp, ifs6_out_msg);
573 icmp6_ifstat_inc(ifp, ifs6_out_neighborsolicit);
574 ICMP6STAT_INC(icp6s_outhist[ND_NEIGHBOR_SOLICIT]);
575
576 if (ro.ro_rt) { /* we don't cache this route. */
577 RTFREE(ro.ro_rt);
578 }
579 return;
580
581 bad:
582 if (ro.ro_rt) {
583 RTFREE(ro.ro_rt);
584 }
585 m_freem(m);
586 return;
587}
588
589/*
590 * Neighbor advertisement input handling.
591 *
592 * Based on RFC 2461
593 * Based on RFC 2462 (duplicate address detection)
594 *
595 * the following items are not implemented yet:
596 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
597 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
598 */
599void
600nd6_na_input(struct mbuf *m, int off, int icmp6len)
601{
602 struct ifnet *ifp = m->m_pkthdr.rcvif;
603 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
604 struct nd_neighbor_advert *nd_na;
605 struct in6_addr daddr6 = ip6->ip6_dst;
606 struct in6_addr taddr6;
607 int flags;
608 int is_router;
609 int is_solicited;
610 int is_override;
611 char *lladdr = NULL;
612 int lladdrlen = 0;
613 int checklink = 0;
614 struct ifaddr *ifa;
615 struct llentry *ln = NULL;
616 union nd_opts ndopts;
617 struct mbuf *chain = NULL;
618 struct m_tag *mtag;
619 struct sockaddr_in6 sin6;
620 char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
621
622 if (ip6->ip6_hlim != 255) {
623 nd6log((LOG_ERR,
624 "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n",
625 ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src),
626 ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp)));
627 goto bad;
628 }
629
630#ifndef PULLDOWN_TEST
631 IP6_EXTHDR_CHECK(m, off, icmp6len,);
632 nd_na = (struct nd_neighbor_advert *)((caddr_t)ip6 + off);
633#else
634 IP6_EXTHDR_GET(nd_na, struct nd_neighbor_advert *, m, off, icmp6len);
635 if (nd_na == NULL) {
636 ICMP6STAT_INC(icp6s_tooshort);
637 return;
638 }
639#endif
640
641 flags = nd_na->nd_na_flags_reserved;
642 is_router = ((flags & ND_NA_FLAG_ROUTER) != 0);
643 is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0);
644 is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0);
645
646 taddr6 = nd_na->nd_na_target;
647 if (in6_setscope(&taddr6, ifp, NULL))
648 goto bad; /* XXX: impossible */
649
650 if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
651 nd6log((LOG_ERR,
652 "nd6_na_input: invalid target address %s\n",
653 ip6_sprintf(ip6bufs, &taddr6)));
654 goto bad;
655 }
656 if (IN6_IS_ADDR_MULTICAST(&daddr6))
657 if (is_solicited) {
658 nd6log((LOG_ERR,
659 "nd6_na_input: a solicited adv is multicasted\n"));
660 goto bad;
661 }
662
663 icmp6len -= sizeof(*nd_na);
664 nd6_option_init(nd_na + 1, icmp6len, &ndopts);
665 if (nd6_options(&ndopts) < 0) {
666 nd6log((LOG_INFO,
667 "nd6_na_input: invalid ND option, ignored\n"));
668 /* nd6_options have incremented stats */
669 goto freeit;
670 }
671
672 if (ndopts.nd_opts_tgt_lladdr) {
673 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
674 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
675 }
676
677 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
678
679 /*
680 * Target address matches one of my interface address.
681 *
682 * If my address is tentative, this means that there's somebody
683 * already using the same address as mine. This indicates DAD failure.
684 * This is defined in RFC 2462.
685 *
686 * Otherwise, process as defined in RFC 2461.
687 */
688 if (ifa
689 && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) {
690 ifa_free(ifa);
691 nd6_dad_na_input(ifa);
692 goto freeit;
693 }
694
695 /* Just for safety, maybe unnecessary. */
696 if (ifa) {
697 ifa_free(ifa);
698 log(LOG_ERR,
699 "nd6_na_input: duplicate IP6 address %s\n",
700 ip6_sprintf(ip6bufs, &taddr6));
701 goto freeit;
702 }
703
704 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
705 nd6log((LOG_INFO, "nd6_na_input: lladdrlen mismatch for %s "
706 "(if %d, NA packet %d)\n", ip6_sprintf(ip6bufs, &taddr6),
707 ifp->if_addrlen, lladdrlen - 2));
708 goto bad;
709 }
710
711 /*
712 * If no neighbor cache entry is found, NA SHOULD silently be
713 * discarded.
714 */
715 IF_AFDATA_LOCK(ifp);
716 ln = nd6_lookup(&taddr6, LLE_EXCLUSIVE, ifp);
717 IF_AFDATA_UNLOCK(ifp);
718 if (ln == NULL) {
719 goto freeit;
720 }
721
722 if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
723 /*
724 * If the link-layer has address, and no lladdr option came,
725 * discard the packet.
726 */
727 if (ifp->if_addrlen && lladdr == NULL) {
728 goto freeit;
729 }
730
731 /*
732 * Record link-layer address, and update the state.
733 */
734 bcopy(lladdr, &ln->ll_addr, ifp->if_addrlen);
735 ln->la_flags |= LLE_VALID;
736 if (is_solicited) {
737 ln->ln_state = ND6_LLINFO_REACHABLE;
738 ln->ln_byhint = 0;
739 if (!ND6_LLINFO_PERMANENT(ln)) {
740 nd6_llinfo_settimer_locked(ln,
741 (long)ND_IFINFO(ln->lle_tbl->llt_ifp)->reachable * hz);
742 }
743 } else {
744 ln->ln_state = ND6_LLINFO_STALE;
745 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
746 }
747 if ((ln->ln_router = is_router) != 0) {
748 /*
749 * This means a router's state has changed from
750 * non-reachable to probably reachable, and might
751 * affect the status of associated prefixes..
752 */
753 checklink = 1;
754 }
755 } else {
756 int llchange;
757
758 /*
759 * Check if the link-layer address has changed or not.
760 */
761 if (lladdr == NULL)
762 llchange = 0;
763 else {
764 if (ln->la_flags & LLE_VALID) {
765 if (bcmp(lladdr, &ln->ll_addr, ifp->if_addrlen))
766 llchange = 1;
767 else
768 llchange = 0;
769 } else
770 llchange = 1;
771 }
772
773 /*
774 * This is VERY complex. Look at it with care.
775 *
776 * override solicit lladdr llchange action
777 * (L: record lladdr)
778 *
779 * 0 0 n -- (2c)
780 * 0 0 y n (2b) L
781 * 0 0 y y (1) REACHABLE->STALE
782 * 0 1 n -- (2c) *->REACHABLE
783 * 0 1 y n (2b) L *->REACHABLE
784 * 0 1 y y (1) REACHABLE->STALE
785 * 1 0 n -- (2a)
786 * 1 0 y n (2a) L
787 * 1 0 y y (2a) L *->STALE
788 * 1 1 n -- (2a) *->REACHABLE
789 * 1 1 y n (2a) L *->REACHABLE
790 * 1 1 y y (2a) L *->REACHABLE
791 */
792 if (!is_override && (lladdr != NULL && llchange)) { /* (1) */
793 /*
794 * If state is REACHABLE, make it STALE.
795 * no other updates should be done.
796 */
797 if (ln->ln_state == ND6_LLINFO_REACHABLE) {
798 ln->ln_state = ND6_LLINFO_STALE;
799 nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
800 }
801 goto freeit;
802 } else if (is_override /* (2a) */
803 || (!is_override && (lladdr != NULL && !llchange)) /* (2b) */
804 || lladdr == NULL) { /* (2c) */
805 /*
806 * Update link-local address, if any.
807 */
808 if (lladdr != NULL) {
809 bcopy(lladdr, &ln->ll_addr, ifp->if_addrlen);
810 ln->la_flags |= LLE_VALID;
811 }
812
813 /*
814 * If solicited, make the state REACHABLE.
815 * If not solicited and the link-layer address was
816 * changed, make it STALE.
817 */
818 if (is_solicited) {
819 ln->ln_state = ND6_LLINFO_REACHABLE;
820 ln->ln_byhint = 0;
821 if (!ND6_LLINFO_PERMANENT(ln)) {
822 nd6_llinfo_settimer_locked(ln,
823 (long)ND_IFINFO(ifp)->reachable * hz);
824 }
825 } else {
826 if (lladdr != NULL && llchange) {
827 ln->ln_state = ND6_LLINFO_STALE;
828 nd6_llinfo_settimer_locked(ln,
829 (long)V_nd6_gctimer * hz);
830 }
831 }
832 }
833
834 if (ln->ln_router && !is_router) {
835 /*
836 * The peer dropped the router flag.
837 * Remove the sender from the Default Router List and
838 * update the Destination Cache entries.
839 */
840 struct nd_defrouter *dr;
841 struct in6_addr *in6;
842
843 in6 = &L3_ADDR_SIN6(ln)->sin6_addr;
844
845 /*
846 * Lock to protect the default router list.
847 * XXX: this might be unnecessary, since this function
848 * is only called under the network software interrupt
849 * context. However, we keep it just for safety.
850 */
851 dr = defrouter_lookup(in6, ln->lle_tbl->llt_ifp);
852 if (dr)
853 defrtrlist_del(dr);
854 else if (!V_ip6_forwarding) {
855 /*
856 * Even if the neighbor is not in the default
857 * router list, the neighbor may be used
858 * as a next hop for some destinations
859 * (e.g. redirect case). So we must
860 * call rt6_flush explicitly.
861 */
862 rt6_flush(&ip6->ip6_src, ifp);
863 }
864 }
865 ln->ln_router = is_router;
866 }
867 /* XXX - QL
868 * Does this matter?
869 * rt->rt_flags &= ~RTF_REJECT;
870 */
871 ln->la_asked = 0;
872 if (ln->la_hold) {
873 struct mbuf *m_hold, *m_hold_next;
874
875 /*
876 * reset the la_hold in advance, to explicitly
877 * prevent a la_hold lookup in nd6_output()
878 * (wouldn't happen, though...)
879 */
880 for (m_hold = ln->la_hold, ln->la_hold = NULL;
881 m_hold; m_hold = m_hold_next) {
882 m_hold_next = m_hold->m_nextpkt;
883 m_hold->m_nextpkt = NULL;
884 /*
885 * we assume ifp is not a loopback here, so just set
886 * the 2nd argument as the 1st one.
887 */
888
889 if (send_sendso_input_hook != NULL) {
890 mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
891 sizeof(unsigned short), M_NOWAIT);
892 if (mtag == NULL)
893 goto bad;
894 m_tag_prepend(m, mtag);
895 }
896
897 nd6_output_lle(ifp, ifp, m_hold, L3_ADDR_SIN6(ln), NULL, ln, &chain);
898 }
899 }
900 freeit:
901 if (ln != NULL) {
902 if (chain)
903 memcpy(&sin6, L3_ADDR_SIN6(ln), sizeof(sin6));
904 LLE_WUNLOCK(ln);
905
906 if (chain)
907 nd6_output_flush(ifp, ifp, chain, &sin6, NULL);
908 }
909 if (checklink)
910 pfxlist_onlink_check();
911
912 m_freem(m);
913 return;
914
915 bad:
916 if (ln != NULL)
917 LLE_WUNLOCK(ln);
918
919 ICMP6STAT_INC(icp6s_badna);
920 m_freem(m);
921}
922
923/*
924 * Neighbor advertisement output handling.
925 *
926 * Based on RFC 2461
927 *
928 * the following items are not implemented yet:
929 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
930 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
931 *
932 * tlladdr - 1 if include target link-layer address
933 * sdl0 - sockaddr_dl (= proxy NA) or NULL
934 */
935void
936nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6_0,
937 const struct in6_addr *taddr6, u_long flags, int tlladdr,
938 struct sockaddr *sdl0)
939{
940 struct mbuf *m;
941 struct m_tag *mtag;
942 struct ip6_hdr *ip6;
943 struct nd_neighbor_advert *nd_na;
944 struct ip6_moptions im6o;
945 struct in6_addr src, daddr6;
946 struct sockaddr_in6 dst_sa;
947 int icmp6len, maxlen, error;
948 caddr_t mac = NULL;
949 struct route_in6 ro;
950
951 bzero(&ro, sizeof(ro));
952
953 daddr6 = *daddr6_0; /* make a local copy for modification */
954
955 /* estimate the size of message */
956 maxlen = sizeof(*ip6) + sizeof(*nd_na);
957 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7;
958 if (max_linkhdr + maxlen >= MCLBYTES) {
959#ifdef DIAGNOSTIC
960 printf("nd6_na_output: max_linkhdr + maxlen >= MCLBYTES "
961 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES);
962#endif
963 return;
964 }
965
966 MGETHDR(m, M_DONTWAIT, MT_DATA);
967 if (m && max_linkhdr + maxlen >= MHLEN) {
968 MCLGET(m, M_DONTWAIT);
969 if ((m->m_flags & M_EXT) == 0) {
970 m_free(m);
971 m = NULL;
972 }
973 }
974 if (m == NULL)
975 return;
976 m->m_pkthdr.rcvif = NULL;
977
978 if (IN6_IS_ADDR_MULTICAST(&daddr6)) {
979 m->m_flags |= M_MCAST;
980 im6o.im6o_multicast_ifp = ifp;
981 im6o.im6o_multicast_hlim = 255;
982 im6o.im6o_multicast_loop = 0;
983 }
984
985 icmp6len = sizeof(*nd_na);
986 m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len;
987 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */
988
989 /* fill neighbor advertisement packet */
990 ip6 = mtod(m, struct ip6_hdr *);
991 ip6->ip6_flow = 0;
992 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
993 ip6->ip6_vfc |= IPV6_VERSION;
994 ip6->ip6_nxt = IPPROTO_ICMPV6;
995 ip6->ip6_hlim = 255;
996 if (IN6_IS_ADDR_UNSPECIFIED(&daddr6)) {
997 /* reply to DAD */
998 daddr6.s6_addr16[0] = IPV6_ADDR_INT16_MLL;
999 daddr6.s6_addr16[1] = 0;
1000 daddr6.s6_addr32[1] = 0;
1001 daddr6.s6_addr32[2] = 0;
1002 daddr6.s6_addr32[3] = IPV6_ADDR_INT32_ONE;
1003 if (in6_setscope(&daddr6, ifp, NULL))
1004 goto bad;
1005
1006 flags &= ~ND_NA_FLAG_SOLICITED;
1007 }
1008 ip6->ip6_dst = daddr6;
1009 bzero(&dst_sa, sizeof(struct sockaddr_in6));
1010 dst_sa.sin6_family = AF_INET6;
1011 dst_sa.sin6_len = sizeof(struct sockaddr_in6);
1012 dst_sa.sin6_addr = daddr6;
1013
1014 /*
1015 * Select a source whose scope is the same as that of the dest.
1016 */
1017 bcopy(&dst_sa, &ro.ro_dst, sizeof(dst_sa));
1018 error = in6_selectsrc(&dst_sa, NULL, NULL, &ro, NULL, NULL, &src);
1019 if (error) {
1020 char ip6buf[INET6_ADDRSTRLEN];
1021 nd6log((LOG_DEBUG, "nd6_na_output: source can't be "
1022 "determined: dst=%s, error=%d\n",
1023 ip6_sprintf(ip6buf, &dst_sa.sin6_addr), error));
1024 goto bad;
1025 }
1026 ip6->ip6_src = src;
1027 nd_na = (struct nd_neighbor_advert *)(ip6 + 1);
1028 nd_na->nd_na_type = ND_NEIGHBOR_ADVERT;
1029 nd_na->nd_na_code = 0;
1030 nd_na->nd_na_target = *taddr6;
1031 in6_clearscope(&nd_na->nd_na_target); /* XXX */
1032
1033 /*
1034 * "tlladdr" indicates NS's condition for adding tlladdr or not.
1035 * see nd6_ns_input() for details.
1036 * Basically, if NS packet is sent to unicast/anycast addr,
1037 * target lladdr option SHOULD NOT be included.
1038 */
1039 if (tlladdr) {
1040 /*
1041 * sdl0 != NULL indicates proxy NA. If we do proxy, use
1042 * lladdr in sdl0. If we are not proxying (sending NA for
1043 * my address) use lladdr configured for the interface.
1044 */
1045 if (sdl0 == NULL) {
1046 if (ifp->if_carp)
1047 mac = (*carp_macmatch6_p)(ifp, m, taddr6);
1048 if (mac == NULL)
1049 mac = nd6_ifptomac(ifp);
1050 } else if (sdl0->sa_family == AF_LINK) {
1051 struct sockaddr_dl *sdl;
1052 sdl = (struct sockaddr_dl *)sdl0;
1053 if (sdl->sdl_alen == ifp->if_addrlen)
1054 mac = LLADDR(sdl);
1055 }
1056 }
1057 if (tlladdr && mac) {
1058 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
1059 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1);
1060
1061 /* roundup to 8 bytes alignment! */
1062 optlen = (optlen + 7) & ~7;
1063
1064 m->m_pkthdr.len += optlen;
1065 m->m_len += optlen;
1066 icmp6len += optlen;
1067 bzero((caddr_t)nd_opt, optlen);
1068 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1069 nd_opt->nd_opt_len = optlen >> 3;
1070 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
1071 } else
1072 flags &= ~ND_NA_FLAG_OVERRIDE;
1073
1074 ip6->ip6_plen = htons((u_short)icmp6len);
1075 nd_na->nd_na_flags_reserved = flags;
1076 nd_na->nd_na_cksum = 0;
1077 nd_na->nd_na_cksum =
1078 in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len);
1079
1080 if (send_sendso_input_hook != NULL) {
1081 mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
1082 sizeof(unsigned short), M_NOWAIT);
1083 if (mtag == NULL)
1084 goto bad;
1085 *(unsigned short *)(mtag + 1) = nd_na->nd_na_type;
1086 m_tag_prepend(m, mtag);
1087 }
1088
1089 ip6_output(m, NULL, &ro, 0, &im6o, NULL, NULL);
1090 icmp6_ifstat_inc(ifp, ifs6_out_msg);
1091 icmp6_ifstat_inc(ifp, ifs6_out_neighboradvert);
1092 ICMP6STAT_INC(icp6s_outhist[ND_NEIGHBOR_ADVERT]);
1093
1094 if (ro.ro_rt) { /* we don't cache this route. */
1095 RTFREE(ro.ro_rt);
1096 }
1097 return;
1098
1099 bad:
1100 if (ro.ro_rt) {
1101 RTFREE(ro.ro_rt);
1102 }
1103 m_freem(m);
1104 return;
1105}
1106
1107caddr_t
1108nd6_ifptomac(struct ifnet *ifp)
1109{
1110 switch (ifp->if_type) {
1111 case IFT_ARCNET:
1112 case IFT_ETHER:
1113 case IFT_FDDI:
1114 case IFT_IEEE1394:
1115#ifdef IFT_L2VLAN
1116 case IFT_L2VLAN:
1117#endif
1118#ifdef IFT_IEEE80211
1119 case IFT_IEEE80211:
1120#endif
1121#ifdef IFT_CARP
1122 case IFT_CARP:
1123#endif
1124 case IFT_BRIDGE:
1125 case IFT_ISO88025:
1126 return IF_LLADDR(ifp);
1127 default:
1128 return NULL;
1129 }
1130}
1131
1132struct dadq {
1133 TAILQ_ENTRY(dadq) dad_list;
1134 struct ifaddr *dad_ifa;
1135 int dad_count; /* max NS to send */
1136 int dad_ns_tcount; /* # of trials to send NS */
1137 int dad_ns_ocount; /* NS sent so far */
1138 int dad_ns_icount;
1139 int dad_na_icount;
1140 struct callout dad_timer_ch;
1141 struct vnet *dad_vnet;
1142};
1143
|
1145VNET_DEFINE(int, dad_init) = 0;
1146#define V_dadq VNET(dadq)
1147#define V_dad_init VNET(dad_init)
1148
1149static struct dadq *
1150nd6_dad_find(struct ifaddr *ifa)
1151{
1152 struct dadq *dp;
1153
1154 for (dp = V_dadq.tqh_first; dp; dp = dp->dad_list.tqe_next) {
1155 if (dp->dad_ifa == ifa)
1156 return dp;
1157 }
1158 return NULL;
1159}
1160
1161static void
1162nd6_dad_starttimer(struct dadq *dp, int ticks)
1163{
1164
1165 callout_reset(&dp->dad_timer_ch, ticks,
1166 (void (*)(void *))nd6_dad_timer, (void *)dp);
1167}
1168
1169static void
1170nd6_dad_stoptimer(struct dadq *dp)
1171{
1172
1173 callout_stop(&dp->dad_timer_ch);
1174}
1175
1176/*
1177 * Start Duplicate Address Detection (DAD) for specified interface address.
1178 */
1179void
1180nd6_dad_start(struct ifaddr *ifa, int delay)
1181{
1182 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1183 struct dadq *dp;
1184 char ip6buf[INET6_ADDRSTRLEN];
1185
1186 if (!V_dad_init) {
1187 TAILQ_INIT(&V_dadq);
1188 V_dad_init++;
1189 }
1190
1191 /*
1192 * If we don't need DAD, don't do it.
1193 * There are several cases:
1194 * - DAD is disabled (ip6_dad_count == 0)
1195 * - the interface address is anycast
1196 */
1197 if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) {
1198 log(LOG_DEBUG,
1199 "nd6_dad_start: called with non-tentative address "
1200 "%s(%s)\n",
1201 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
1202 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1203 return;
1204 }
1205 if (ia->ia6_flags & IN6_IFF_ANYCAST) {
1206 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1207 return;
1208 }
1209 if (!V_ip6_dad_count) {
1210 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1211 return;
1212 }
1213 if (ifa->ifa_ifp == NULL)
1214 panic("nd6_dad_start: ifa->ifa_ifp == NULL");
1215 if (!(ifa->ifa_ifp->if_flags & IFF_UP)) {
1216 return;
1217 }
1218 if (ND_IFINFO(ifa->ifa_ifp)->flags & ND6_IFF_IFDISABLED)
1219 return;
1220 if (nd6_dad_find(ifa) != NULL) {
1221 /* DAD already in progress */
1222 return;
1223 }
1224
1225 dp = malloc(sizeof(*dp), M_IP6NDP, M_NOWAIT);
1226 if (dp == NULL) {
1227 log(LOG_ERR, "nd6_dad_start: memory allocation failed for "
1228 "%s(%s)\n",
1229 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
1230 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1231 return;
1232 }
1233 bzero(dp, sizeof(*dp));
1234 callout_init(&dp->dad_timer_ch, 0);
1235#ifdef VIMAGE
1236 dp->dad_vnet = curvnet;
1237#endif
1238 TAILQ_INSERT_TAIL(&V_dadq, (struct dadq *)dp, dad_list);
1239
1240 nd6log((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
1241 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr)));
1242
1243 /*
1244 * Send NS packet for DAD, ip6_dad_count times.
1245 * Note that we must delay the first transmission, if this is the
1246 * first packet to be sent from the interface after interface
1247 * (re)initialization.
1248 */
1249 dp->dad_ifa = ifa;
1250 ifa_ref(ifa); /* just for safety */
1251 dp->dad_count = V_ip6_dad_count;
1252 dp->dad_ns_icount = dp->dad_na_icount = 0;
1253 dp->dad_ns_ocount = dp->dad_ns_tcount = 0;
1254 if (delay == 0) {
1255 nd6_dad_ns_output(dp, ifa);
1256 nd6_dad_starttimer(dp,
1257 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000);
1258 } else {
1259 nd6_dad_starttimer(dp, delay);
1260 }
1261}
1262
1263/*
1264 * terminate DAD unconditionally. used for address removals.
1265 */
1266void
1267nd6_dad_stop(struct ifaddr *ifa)
1268{
1269 struct dadq *dp;
1270
1271 if (!V_dad_init)
1272 return;
1273 dp = nd6_dad_find(ifa);
1274 if (!dp) {
1275 /* DAD wasn't started yet */
1276 return;
1277 }
1278
1279 nd6_dad_stoptimer(dp);
1280
1281 TAILQ_REMOVE(&V_dadq, (struct dadq *)dp, dad_list);
1282 free(dp, M_IP6NDP);
1283 dp = NULL;
1284 ifa_free(ifa);
1285}
1286
1287static void
1288nd6_dad_timer(struct dadq *dp)
1289{
1290 CURVNET_SET(dp->dad_vnet);
1291 int s;
1292 struct ifaddr *ifa = dp->dad_ifa;
1293 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1294 char ip6buf[INET6_ADDRSTRLEN];
1295
1296 s = splnet(); /* XXX */
1297
1298 /* Sanity check */
1299 if (ia == NULL) {
1300 log(LOG_ERR, "nd6_dad_timer: called with null parameter\n");
1301 goto done;
1302 }
1303 if (ia->ia6_flags & IN6_IFF_DUPLICATED) {
1304 log(LOG_ERR, "nd6_dad_timer: called with duplicated address "
1305 "%s(%s)\n",
1306 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
1307 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1308 goto done;
1309 }
1310 if ((ia->ia6_flags & IN6_IFF_TENTATIVE) == 0) {
1311 log(LOG_ERR, "nd6_dad_timer: called with non-tentative address "
1312 "%s(%s)\n",
1313 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
1314 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1315 goto done;
1316 }
1317
1318 /* timeouted with IFF_{RUNNING,UP} check */
1319 if (dp->dad_ns_tcount > V_dad_maxtry) {
1320 nd6log((LOG_INFO, "%s: could not run DAD, driver problem?\n",
1321 if_name(ifa->ifa_ifp)));
1322
1323 TAILQ_REMOVE(&V_dadq, (struct dadq *)dp, dad_list);
1324 free(dp, M_IP6NDP);
1325 dp = NULL;
1326 ifa_free(ifa);
1327 goto done;
1328 }
1329
1330 /* Need more checks? */
1331 if (dp->dad_ns_ocount < dp->dad_count) {
1332 /*
1333 * We have more NS to go. Send NS packet for DAD.
1334 */
1335 nd6_dad_ns_output(dp, ifa);
1336 nd6_dad_starttimer(dp,
1337 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000);
1338 } else {
1339 /*
1340 * We have transmitted sufficient number of DAD packets.
1341 * See what we've got.
1342 */
1343 int duplicate;
1344
1345 duplicate = 0;
1346
1347 if (dp->dad_na_icount) {
1348 /*
1349 * the check is in nd6_dad_na_input(),
1350 * but just in case
1351 */
1352 duplicate++;
1353 }
1354
1355 if (dp->dad_ns_icount) {
1356 /* We've seen NS, means DAD has failed. */
1357 duplicate++;
1358 }
1359
1360 if (duplicate) {
1361 /* (*dp) will be freed in nd6_dad_duplicated() */
1362 dp = NULL;
1363 nd6_dad_duplicated(ifa);
1364 } else {
1365 /*
1366 * We are done with DAD. No NA came, no NS came.
1367 * No duplicate address found.
1368 */
1369 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1370
1371 nd6log((LOG_DEBUG,
1372 "%s: DAD complete for %s - no duplicates found\n",
1373 if_name(ifa->ifa_ifp),
1374 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr)));
1375
1376 TAILQ_REMOVE(&V_dadq, (struct dadq *)dp, dad_list);
1377 free(dp, M_IP6NDP);
1378 dp = NULL;
1379 ifa_free(ifa);
1380 }
1381 }
1382
1383done:
1384 splx(s);
1385 CURVNET_RESTORE();
1386}
1387
1388void
1389nd6_dad_duplicated(struct ifaddr *ifa)
1390{
1391 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1392 struct ifnet *ifp;
1393 struct dadq *dp;
1394 char ip6buf[INET6_ADDRSTRLEN];
1395
1396 dp = nd6_dad_find(ifa);
1397 if (dp == NULL) {
1398 log(LOG_ERR, "nd6_dad_duplicated: DAD structure not found\n");
1399 return;
1400 }
1401
1402 log(LOG_ERR, "%s: DAD detected duplicate IPv6 address %s: "
1403 "NS in/out=%d/%d, NA in=%d\n",
1404 if_name(ifa->ifa_ifp), ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
1405 dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_na_icount);
1406
1407 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1408 ia->ia6_flags |= IN6_IFF_DUPLICATED;
1409
1410 /* We are done with DAD, with duplicate address found. (failure) */
1411 nd6_dad_stoptimer(dp);
1412
1413 ifp = ifa->ifa_ifp;
1414 log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n",
1415 if_name(ifp), ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr));
1416 log(LOG_ERR, "%s: manual intervention required\n",
1417 if_name(ifp));
1418
1419 /*
1420 * If the address is a link-local address formed from an interface
1421 * identifier based on the hardware address which is supposed to be
1422 * uniquely assigned (e.g., EUI-64 for an Ethernet interface), IP
1423 * operation on the interface SHOULD be disabled.
1424 * [RFC 4862, Section 5.4.5]
1425 */
1426 if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr)) {
1427 struct in6_addr in6;
1428
1429 /*
1430 * To avoid over-reaction, we only apply this logic when we are
1431 * very sure that hardware addresses are supposed to be unique.
1432 */
1433 switch (ifp->if_type) {
1434 case IFT_ETHER:
1435 case IFT_FDDI:
1436 case IFT_ATM:
1437 case IFT_IEEE1394:
1438#ifdef IFT_IEEE80211
1439 case IFT_IEEE80211:
1440#endif
1441 in6 = ia->ia_addr.sin6_addr;
1442 if (in6_get_hw_ifid(ifp, &in6) == 0 &&
1443 IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) {
1444 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED;
1445 log(LOG_ERR, "%s: possible hardware address "
1446 "duplication detected, disable IPv6\n",
1447 if_name(ifp));
1448 }
1449 break;
1450 }
1451 }
1452
1453 TAILQ_REMOVE(&V_dadq, (struct dadq *)dp, dad_list);
1454 free(dp, M_IP6NDP);
1455 dp = NULL;
1456 ifa_free(ifa);
1457}
1458
1459static void
1460nd6_dad_ns_output(struct dadq *dp, struct ifaddr *ifa)
1461{
1462 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1463 struct ifnet *ifp = ifa->ifa_ifp;
1464
1465 dp->dad_ns_tcount++;
1466 if ((ifp->if_flags & IFF_UP) == 0) {
1467 return;
1468 }
1469 if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1470 return;
1471 }
1472
1473 dp->dad_ns_ocount++;
1474 nd6_ns_output(ifp, NULL, &ia->ia_addr.sin6_addr, NULL, 1);
1475}
1476
1477static void
1478nd6_dad_ns_input(struct ifaddr *ifa)
1479{
1480 struct in6_ifaddr *ia;
1481 struct ifnet *ifp;
1482 const struct in6_addr *taddr6;
1483 struct dadq *dp;
1484 int duplicate;
1485
1486 if (ifa == NULL)
1487 panic("ifa == NULL in nd6_dad_ns_input");
1488
1489 ia = (struct in6_ifaddr *)ifa;
1490 ifp = ifa->ifa_ifp;
1491 taddr6 = &ia->ia_addr.sin6_addr;
1492 duplicate = 0;
1493 dp = nd6_dad_find(ifa);
1494
1495 /* Quickhack - completely ignore DAD NS packets */
1496 if (V_dad_ignore_ns) {
1497 char ip6buf[INET6_ADDRSTRLEN];
1498 nd6log((LOG_INFO,
1499 "nd6_dad_ns_input: ignoring DAD NS packet for "
1500 "address %s(%s)\n", ip6_sprintf(ip6buf, taddr6),
1501 if_name(ifa->ifa_ifp)));
1502 return;
1503 }
1504
1505 /*
1506 * if I'm yet to start DAD, someone else started using this address
1507 * first. I have a duplicate and you win.
1508 */
1509 if (dp == NULL || dp->dad_ns_ocount == 0)
1510 duplicate++;
1511
1512 /* XXX more checks for loopback situation - see nd6_dad_timer too */
1513
1514 if (duplicate) {
1515 dp = NULL; /* will be freed in nd6_dad_duplicated() */
1516 nd6_dad_duplicated(ifa);
1517 } else {
1518 /*
1519 * not sure if I got a duplicate.
1520 * increment ns count and see what happens.
1521 */
1522 if (dp)
1523 dp->dad_ns_icount++;
1524 }
1525}
1526
1527static void
1528nd6_dad_na_input(struct ifaddr *ifa)
1529{
1530 struct dadq *dp;
1531
1532 if (ifa == NULL)
1533 panic("ifa == NULL in nd6_dad_na_input");
1534
1535 dp = nd6_dad_find(ifa);
1536 if (dp)
1537 dp->dad_na_icount++;
1538
1539 /* remove the address. */
1540 nd6_dad_duplicated(ifa);
1541}
| 1145VNET_DEFINE(int, dad_init) = 0;
1146#define V_dadq VNET(dadq)
1147#define V_dad_init VNET(dad_init)
1148
1149static struct dadq *
1150nd6_dad_find(struct ifaddr *ifa)
1151{
1152 struct dadq *dp;
1153
1154 for (dp = V_dadq.tqh_first; dp; dp = dp->dad_list.tqe_next) {
1155 if (dp->dad_ifa == ifa)
1156 return dp;
1157 }
1158 return NULL;
1159}
1160
1161static void
1162nd6_dad_starttimer(struct dadq *dp, int ticks)
1163{
1164
1165 callout_reset(&dp->dad_timer_ch, ticks,
1166 (void (*)(void *))nd6_dad_timer, (void *)dp);
1167}
1168
1169static void
1170nd6_dad_stoptimer(struct dadq *dp)
1171{
1172
1173 callout_stop(&dp->dad_timer_ch);
1174}
1175
1176/*
1177 * Start Duplicate Address Detection (DAD) for specified interface address.
1178 */
1179void
1180nd6_dad_start(struct ifaddr *ifa, int delay)
1181{
1182 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1183 struct dadq *dp;
1184 char ip6buf[INET6_ADDRSTRLEN];
1185
1186 if (!V_dad_init) {
1187 TAILQ_INIT(&V_dadq);
1188 V_dad_init++;
1189 }
1190
1191 /*
1192 * If we don't need DAD, don't do it.
1193 * There are several cases:
1194 * - DAD is disabled (ip6_dad_count == 0)
1195 * - the interface address is anycast
1196 */
1197 if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) {
1198 log(LOG_DEBUG,
1199 "nd6_dad_start: called with non-tentative address "
1200 "%s(%s)\n",
1201 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
1202 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1203 return;
1204 }
1205 if (ia->ia6_flags & IN6_IFF_ANYCAST) {
1206 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1207 return;
1208 }
1209 if (!V_ip6_dad_count) {
1210 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1211 return;
1212 }
1213 if (ifa->ifa_ifp == NULL)
1214 panic("nd6_dad_start: ifa->ifa_ifp == NULL");
1215 if (!(ifa->ifa_ifp->if_flags & IFF_UP)) {
1216 return;
1217 }
1218 if (ND_IFINFO(ifa->ifa_ifp)->flags & ND6_IFF_IFDISABLED)
1219 return;
1220 if (nd6_dad_find(ifa) != NULL) {
1221 /* DAD already in progress */
1222 return;
1223 }
1224
1225 dp = malloc(sizeof(*dp), M_IP6NDP, M_NOWAIT);
1226 if (dp == NULL) {
1227 log(LOG_ERR, "nd6_dad_start: memory allocation failed for "
1228 "%s(%s)\n",
1229 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
1230 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1231 return;
1232 }
1233 bzero(dp, sizeof(*dp));
1234 callout_init(&dp->dad_timer_ch, 0);
1235#ifdef VIMAGE
1236 dp->dad_vnet = curvnet;
1237#endif
1238 TAILQ_INSERT_TAIL(&V_dadq, (struct dadq *)dp, dad_list);
1239
1240 nd6log((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
1241 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr)));
1242
1243 /*
1244 * Send NS packet for DAD, ip6_dad_count times.
1245 * Note that we must delay the first transmission, if this is the
1246 * first packet to be sent from the interface after interface
1247 * (re)initialization.
1248 */
1249 dp->dad_ifa = ifa;
1250 ifa_ref(ifa); /* just for safety */
1251 dp->dad_count = V_ip6_dad_count;
1252 dp->dad_ns_icount = dp->dad_na_icount = 0;
1253 dp->dad_ns_ocount = dp->dad_ns_tcount = 0;
1254 if (delay == 0) {
1255 nd6_dad_ns_output(dp, ifa);
1256 nd6_dad_starttimer(dp,
1257 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000);
1258 } else {
1259 nd6_dad_starttimer(dp, delay);
1260 }
1261}
1262
1263/*
1264 * terminate DAD unconditionally. used for address removals.
1265 */
1266void
1267nd6_dad_stop(struct ifaddr *ifa)
1268{
1269 struct dadq *dp;
1270
1271 if (!V_dad_init)
1272 return;
1273 dp = nd6_dad_find(ifa);
1274 if (!dp) {
1275 /* DAD wasn't started yet */
1276 return;
1277 }
1278
1279 nd6_dad_stoptimer(dp);
1280
1281 TAILQ_REMOVE(&V_dadq, (struct dadq *)dp, dad_list);
1282 free(dp, M_IP6NDP);
1283 dp = NULL;
1284 ifa_free(ifa);
1285}
1286
1287static void
1288nd6_dad_timer(struct dadq *dp)
1289{
1290 CURVNET_SET(dp->dad_vnet);
1291 int s;
1292 struct ifaddr *ifa = dp->dad_ifa;
1293 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1294 char ip6buf[INET6_ADDRSTRLEN];
1295
1296 s = splnet(); /* XXX */
1297
1298 /* Sanity check */
1299 if (ia == NULL) {
1300 log(LOG_ERR, "nd6_dad_timer: called with null parameter\n");
1301 goto done;
1302 }
1303 if (ia->ia6_flags & IN6_IFF_DUPLICATED) {
1304 log(LOG_ERR, "nd6_dad_timer: called with duplicated address "
1305 "%s(%s)\n",
1306 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
1307 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1308 goto done;
1309 }
1310 if ((ia->ia6_flags & IN6_IFF_TENTATIVE) == 0) {
1311 log(LOG_ERR, "nd6_dad_timer: called with non-tentative address "
1312 "%s(%s)\n",
1313 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
1314 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1315 goto done;
1316 }
1317
1318 /* timeouted with IFF_{RUNNING,UP} check */
1319 if (dp->dad_ns_tcount > V_dad_maxtry) {
1320 nd6log((LOG_INFO, "%s: could not run DAD, driver problem?\n",
1321 if_name(ifa->ifa_ifp)));
1322
1323 TAILQ_REMOVE(&V_dadq, (struct dadq *)dp, dad_list);
1324 free(dp, M_IP6NDP);
1325 dp = NULL;
1326 ifa_free(ifa);
1327 goto done;
1328 }
1329
1330 /* Need more checks? */
1331 if (dp->dad_ns_ocount < dp->dad_count) {
1332 /*
1333 * We have more NS to go. Send NS packet for DAD.
1334 */
1335 nd6_dad_ns_output(dp, ifa);
1336 nd6_dad_starttimer(dp,
1337 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000);
1338 } else {
1339 /*
1340 * We have transmitted sufficient number of DAD packets.
1341 * See what we've got.
1342 */
1343 int duplicate;
1344
1345 duplicate = 0;
1346
1347 if (dp->dad_na_icount) {
1348 /*
1349 * the check is in nd6_dad_na_input(),
1350 * but just in case
1351 */
1352 duplicate++;
1353 }
1354
1355 if (dp->dad_ns_icount) {
1356 /* We've seen NS, means DAD has failed. */
1357 duplicate++;
1358 }
1359
1360 if (duplicate) {
1361 /* (*dp) will be freed in nd6_dad_duplicated() */
1362 dp = NULL;
1363 nd6_dad_duplicated(ifa);
1364 } else {
1365 /*
1366 * We are done with DAD. No NA came, no NS came.
1367 * No duplicate address found.
1368 */
1369 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1370
1371 nd6log((LOG_DEBUG,
1372 "%s: DAD complete for %s - no duplicates found\n",
1373 if_name(ifa->ifa_ifp),
1374 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr)));
1375
1376 TAILQ_REMOVE(&V_dadq, (struct dadq *)dp, dad_list);
1377 free(dp, M_IP6NDP);
1378 dp = NULL;
1379 ifa_free(ifa);
1380 }
1381 }
1382
1383done:
1384 splx(s);
1385 CURVNET_RESTORE();
1386}
1387
1388void
1389nd6_dad_duplicated(struct ifaddr *ifa)
1390{
1391 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1392 struct ifnet *ifp;
1393 struct dadq *dp;
1394 char ip6buf[INET6_ADDRSTRLEN];
1395
1396 dp = nd6_dad_find(ifa);
1397 if (dp == NULL) {
1398 log(LOG_ERR, "nd6_dad_duplicated: DAD structure not found\n");
1399 return;
1400 }
1401
1402 log(LOG_ERR, "%s: DAD detected duplicate IPv6 address %s: "
1403 "NS in/out=%d/%d, NA in=%d\n",
1404 if_name(ifa->ifa_ifp), ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr),
1405 dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_na_icount);
1406
1407 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1408 ia->ia6_flags |= IN6_IFF_DUPLICATED;
1409
1410 /* We are done with DAD, with duplicate address found. (failure) */
1411 nd6_dad_stoptimer(dp);
1412
1413 ifp = ifa->ifa_ifp;
1414 log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n",
1415 if_name(ifp), ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr));
1416 log(LOG_ERR, "%s: manual intervention required\n",
1417 if_name(ifp));
1418
1419 /*
1420 * If the address is a link-local address formed from an interface
1421 * identifier based on the hardware address which is supposed to be
1422 * uniquely assigned (e.g., EUI-64 for an Ethernet interface), IP
1423 * operation on the interface SHOULD be disabled.
1424 * [RFC 4862, Section 5.4.5]
1425 */
1426 if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr)) {
1427 struct in6_addr in6;
1428
1429 /*
1430 * To avoid over-reaction, we only apply this logic when we are
1431 * very sure that hardware addresses are supposed to be unique.
1432 */
1433 switch (ifp->if_type) {
1434 case IFT_ETHER:
1435 case IFT_FDDI:
1436 case IFT_ATM:
1437 case IFT_IEEE1394:
1438#ifdef IFT_IEEE80211
1439 case IFT_IEEE80211:
1440#endif
1441 in6 = ia->ia_addr.sin6_addr;
1442 if (in6_get_hw_ifid(ifp, &in6) == 0 &&
1443 IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) {
1444 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED;
1445 log(LOG_ERR, "%s: possible hardware address "
1446 "duplication detected, disable IPv6\n",
1447 if_name(ifp));
1448 }
1449 break;
1450 }
1451 }
1452
1453 TAILQ_REMOVE(&V_dadq, (struct dadq *)dp, dad_list);
1454 free(dp, M_IP6NDP);
1455 dp = NULL;
1456 ifa_free(ifa);
1457}
1458
1459static void
1460nd6_dad_ns_output(struct dadq *dp, struct ifaddr *ifa)
1461{
1462 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1463 struct ifnet *ifp = ifa->ifa_ifp;
1464
1465 dp->dad_ns_tcount++;
1466 if ((ifp->if_flags & IFF_UP) == 0) {
1467 return;
1468 }
1469 if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1470 return;
1471 }
1472
1473 dp->dad_ns_ocount++;
1474 nd6_ns_output(ifp, NULL, &ia->ia_addr.sin6_addr, NULL, 1);
1475}
1476
1477static void
1478nd6_dad_ns_input(struct ifaddr *ifa)
1479{
1480 struct in6_ifaddr *ia;
1481 struct ifnet *ifp;
1482 const struct in6_addr *taddr6;
1483 struct dadq *dp;
1484 int duplicate;
1485
1486 if (ifa == NULL)
1487 panic("ifa == NULL in nd6_dad_ns_input");
1488
1489 ia = (struct in6_ifaddr *)ifa;
1490 ifp = ifa->ifa_ifp;
1491 taddr6 = &ia->ia_addr.sin6_addr;
1492 duplicate = 0;
1493 dp = nd6_dad_find(ifa);
1494
1495 /* Quickhack - completely ignore DAD NS packets */
1496 if (V_dad_ignore_ns) {
1497 char ip6buf[INET6_ADDRSTRLEN];
1498 nd6log((LOG_INFO,
1499 "nd6_dad_ns_input: ignoring DAD NS packet for "
1500 "address %s(%s)\n", ip6_sprintf(ip6buf, taddr6),
1501 if_name(ifa->ifa_ifp)));
1502 return;
1503 }
1504
1505 /*
1506 * if I'm yet to start DAD, someone else started using this address
1507 * first. I have a duplicate and you win.
1508 */
1509 if (dp == NULL || dp->dad_ns_ocount == 0)
1510 duplicate++;
1511
1512 /* XXX more checks for loopback situation - see nd6_dad_timer too */
1513
1514 if (duplicate) {
1515 dp = NULL; /* will be freed in nd6_dad_duplicated() */
1516 nd6_dad_duplicated(ifa);
1517 } else {
1518 /*
1519 * not sure if I got a duplicate.
1520 * increment ns count and see what happens.
1521 */
1522 if (dp)
1523 dp->dad_ns_icount++;
1524 }
1525}
1526
1527static void
1528nd6_dad_na_input(struct ifaddr *ifa)
1529{
1530 struct dadq *dp;
1531
1532 if (ifa == NULL)
1533 panic("ifa == NULL in nd6_dad_na_input");
1534
1535 dp = nd6_dad_find(ifa);
1536 if (dp)
1537 dp->dad_na_icount++;
1538
1539 /* remove the address. */
1540 nd6_dad_duplicated(ifa);
1541}
|