nd6_nbr.c revision 171260
1/* $FreeBSD: head/sys/netinet6/nd6_nbr.c 171260 2007-07-05 16:29:40Z delphij $ */ 2/* $KAME: nd6_nbr.c,v 1.86 2002/01/21 02:33:04 jinmei Exp $ */ 3 4/*- 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33#include "opt_inet.h" 34#include "opt_inet6.h" 35#include "opt_ipsec.h" 36#include "opt_carp.h" 37 38#include <sys/param.h> 39#include <sys/systm.h> 40#include <sys/malloc.h> 41#include <sys/mbuf.h> 42#include <sys/socket.h> 43#include <sys/sockio.h> 44#include <sys/time.h> 45#include <sys/kernel.h> 46#include <sys/errno.h> 47#include <sys/syslog.h> 48#include <sys/queue.h> 49#include <sys/callout.h> 50 51#include <net/if.h> 52#include <net/if_types.h> 53#include <net/if_dl.h> 54#include <net/if_var.h> 55#include <net/route.h> 56 57#include <netinet/in.h> 58#include <netinet/in_var.h> 59#include <netinet6/in6_var.h> 60#include <netinet6/in6_ifattach.h> 61#include <netinet/ip6.h> 62#include <netinet6/ip6_var.h> 63#include <netinet6/scope6_var.h> 64#include <netinet6/nd6.h> 65#include <netinet/icmp6.h> 66 67#ifdef DEV_CARP 68#include <netinet/ip_carp.h> 69#endif 70 71#define SDL(s) ((struct sockaddr_dl *)s) 72 73struct dadq; 74static struct dadq *nd6_dad_find __P((struct ifaddr *)); 75static void nd6_dad_starttimer __P((struct dadq *, int)); 76static void nd6_dad_stoptimer __P((struct dadq *)); 77static void nd6_dad_timer __P((struct ifaddr *)); 78static void nd6_dad_ns_output __P((struct dadq *, struct ifaddr *)); 79static void nd6_dad_ns_input __P((struct ifaddr *)); 80static void nd6_dad_na_input __P((struct ifaddr *)); 81 82static int dad_ignore_ns = 0; /* ignore NS in DAD - specwise incorrect*/ 83static int dad_maxtry = 15; /* max # of *tries* to transmit DAD packet */ 84 85/* 86 * Input a Neighbor Solicitation Message. 87 * 88 * Based on RFC 2461 89 * Based on RFC 2462 (duplicate address detection) 90 */ 91void 92nd6_ns_input(struct mbuf *m, int off, int icmp6len) 93{ 94 struct ifnet *ifp = m->m_pkthdr.rcvif; 95 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 96 struct nd_neighbor_solicit *nd_ns; 97 struct in6_addr saddr6 = ip6->ip6_src; 98 struct in6_addr daddr6 = ip6->ip6_dst; 99 struct in6_addr taddr6; 100 struct in6_addr myaddr6; 101 char *lladdr = NULL; 102 struct ifaddr *ifa = NULL; 103 int lladdrlen = 0; 104 int anycast = 0, proxy = 0, tentative = 0; 105 int tlladdr; 106 union nd_opts ndopts; 107 struct sockaddr_dl *proxydl = NULL; 108 char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN]; 109 110#ifndef PULLDOWN_TEST 111 IP6_EXTHDR_CHECK(m, off, icmp6len,); 112 nd_ns = (struct nd_neighbor_solicit *)((caddr_t)ip6 + off); 113#else 114 IP6_EXTHDR_GET(nd_ns, struct nd_neighbor_solicit *, m, off, icmp6len); 115 if (nd_ns == NULL) { 116 icmp6stat.icp6s_tooshort++; 117 return; 118 } 119#endif 120 ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */ 121 taddr6 = nd_ns->nd_ns_target; 122 if (in6_setscope(&taddr6, ifp, NULL) != 0) 123 goto bad; 124 125 if (ip6->ip6_hlim != 255) { 126 nd6log((LOG_ERR, 127 "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n", 128 ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src), 129 ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp))); 130 goto bad; 131 } 132 133 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 134 /* dst has to be a solicited node multicast address. */ 135 if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL && 136 /* don't check ifindex portion */ 137 daddr6.s6_addr32[1] == 0 && 138 daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE && 139 daddr6.s6_addr8[12] == 0xff) { 140 ; /* good */ 141 } else { 142 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet " 143 "(wrong ip6 dst)\n")); 144 goto bad; 145 } 146 } 147 148 if (IN6_IS_ADDR_MULTICAST(&taddr6)) { 149 nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n")); 150 goto bad; 151 } 152 153 icmp6len -= sizeof(*nd_ns); 154 nd6_option_init(nd_ns + 1, icmp6len, &ndopts); 155 if (nd6_options(&ndopts) < 0) { 156 nd6log((LOG_INFO, 157 "nd6_ns_input: invalid ND option, ignored\n")); 158 /* nd6_options have incremented stats */ 159 goto freeit; 160 } 161 162 if (ndopts.nd_opts_src_lladdr) { 163 lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1); 164 lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3; 165 } 166 167 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) && lladdr) { 168 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet " 169 "(link-layer address option)\n")); 170 goto bad; 171 } 172 173 /* 174 * Attaching target link-layer address to the NA? 175 * (RFC 2461 7.2.4) 176 * 177 * NS IP dst is unicast/anycast MUST NOT add 178 * NS IP dst is solicited-node multicast MUST add 179 * 180 * In implementation, we add target link-layer address by default. 181 * We do not add one in MUST NOT cases. 182 */ 183 if (!IN6_IS_ADDR_MULTICAST(&daddr6)) 184 tlladdr = 0; 185 else 186 tlladdr = 1; 187 188 /* 189 * Target address (taddr6) must be either: 190 * (1) Valid unicast/anycast address for my receiving interface, 191 * (2) Unicast address for which I'm offering proxy service, or 192 * (3) "tentative" address on which DAD is being performed. 193 */ 194 /* (1) and (3) check. */ 195#ifdef DEV_CARP 196 if (ifp->if_carp) 197 ifa = carp_iamatch6(ifp->if_carp, &taddr6); 198 if (ifa == NULL) 199 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 200#else 201 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 202#endif 203 204 /* (2) check. */ 205 if (ifa == NULL) { 206 struct rtentry *rt; 207 struct sockaddr_in6 tsin6; 208 int need_proxy; 209 210 bzero(&tsin6, sizeof tsin6); 211 tsin6.sin6_len = sizeof(struct sockaddr_in6); 212 tsin6.sin6_family = AF_INET6; 213 tsin6.sin6_addr = taddr6; 214 215 rt = rtalloc1((struct sockaddr *)&tsin6, 0, 0); 216 need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 && 217 rt->rt_gateway->sa_family == AF_LINK); 218 if (rt) 219 rtfree(rt); 220 if (need_proxy) { 221 /* 222 * proxy NDP for single entry 223 */ 224 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 225 IN6_IFF_NOTREADY|IN6_IFF_ANYCAST); 226 if (ifa) { 227 proxy = 1; 228 proxydl = SDL(rt->rt_gateway); 229 } 230 } 231 } 232 if (ifa == NULL) { 233 /* 234 * We've got an NS packet, and we don't have that adddress 235 * assigned for us. We MUST silently ignore it. 236 * See RFC2461 7.2.3. 237 */ 238 goto freeit; 239 } 240 myaddr6 = *IFA_IN6(ifa); 241 anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST; 242 tentative = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE; 243 if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED) 244 goto freeit; 245 246 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 247 nd6log((LOG_INFO, "nd6_ns_input: lladdrlen mismatch for %s " 248 "(if %d, NS packet %d)\n", 249 ip6_sprintf(ip6bufs, &taddr6), 250 ifp->if_addrlen, lladdrlen - 2)); 251 goto bad; 252 } 253 254 if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) { 255 nd6log((LOG_INFO, "nd6_ns_input: duplicate IP6 address %s\n", 256 ip6_sprintf(ip6bufs, &saddr6))); 257 goto freeit; 258 } 259 260 /* 261 * We have neighbor solicitation packet, with target address equals to 262 * one of my tentative address. 263 * 264 * src addr how to process? 265 * --- --- 266 * multicast of course, invalid (rejected in ip6_input) 267 * unicast somebody is doing address resolution -> ignore 268 * unspec dup address detection 269 * 270 * The processing is defined in RFC 2462. 271 */ 272 if (tentative) { 273 /* 274 * If source address is unspecified address, it is for 275 * duplicate address detection. 276 * 277 * If not, the packet is for addess resolution; 278 * silently ignore it. 279 */ 280 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) 281 nd6_dad_ns_input(ifa); 282 283 goto freeit; 284 } 285 286 /* 287 * If the source address is unspecified address, entries must not 288 * be created or updated. 289 * It looks that sender is performing DAD. Output NA toward 290 * all-node multicast address, to tell the sender that I'm using 291 * the address. 292 * S bit ("solicited") must be zero. 293 */ 294 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) { 295 struct in6_addr in6_all; 296 297 in6_all = in6addr_linklocal_allnodes; 298 if (in6_setscope(&in6_all, ifp, NULL) != 0) 299 goto bad; 300 nd6_na_output(ifp, &in6_all, &taddr6, 301 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) | 302 (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0), 303 tlladdr, (struct sockaddr *)proxydl); 304 goto freeit; 305 } 306 307 nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, 308 ND_NEIGHBOR_SOLICIT, 0); 309 310 nd6_na_output(ifp, &saddr6, &taddr6, 311 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) | 312 (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED, 313 tlladdr, (struct sockaddr *)proxydl); 314 freeit: 315 m_freem(m); 316 return; 317 318 bad: 319 nd6log((LOG_ERR, "nd6_ns_input: src=%s\n", 320 ip6_sprintf(ip6bufs, &saddr6))); 321 nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n", 322 ip6_sprintf(ip6bufs, &daddr6))); 323 nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n", 324 ip6_sprintf(ip6bufs, &taddr6))); 325 icmp6stat.icp6s_badns++; 326 m_freem(m); 327} 328 329/* 330 * Output a Neighbor Solicitation Message. Caller specifies: 331 * - ICMP6 header source IP6 address 332 * - ND6 header target IP6 address 333 * - ND6 header source datalink address 334 * 335 * Based on RFC 2461 336 * Based on RFC 2462 (duplicate address detection) 337 * 338 * ln - for source address determination 339 * dad - duplicate address detection 340 */ 341void 342nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6, 343 const struct in6_addr *taddr6, struct llinfo_nd6 *ln, int dad) 344{ 345 struct mbuf *m; 346 struct ip6_hdr *ip6; 347 struct nd_neighbor_solicit *nd_ns; 348 struct in6_addr *src, src_in; 349 struct ip6_moptions im6o; 350 int icmp6len; 351 int maxlen; 352 caddr_t mac; 353 struct route_in6 ro; 354 355 bzero(&ro, sizeof(ro)); 356 357 if (IN6_IS_ADDR_MULTICAST(taddr6)) 358 return; 359 360 /* estimate the size of message */ 361 maxlen = sizeof(*ip6) + sizeof(*nd_ns); 362 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; 363 if (max_linkhdr + maxlen >= MCLBYTES) { 364#ifdef DIAGNOSTIC 365 printf("nd6_ns_output: max_linkhdr + maxlen >= MCLBYTES " 366 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES); 367#endif 368 return; 369 } 370 371 MGETHDR(m, M_DONTWAIT, MT_DATA); 372 if (m && max_linkhdr + maxlen >= MHLEN) { 373 MCLGET(m, M_DONTWAIT); 374 if ((m->m_flags & M_EXT) == 0) { 375 m_free(m); 376 m = NULL; 377 } 378 } 379 if (m == NULL) 380 return; 381 m->m_pkthdr.rcvif = NULL; 382 383 if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) { 384 m->m_flags |= M_MCAST; 385 im6o.im6o_multicast_ifp = ifp; 386 im6o.im6o_multicast_hlim = 255; 387 im6o.im6o_multicast_loop = 0; 388 } 389 390 icmp6len = sizeof(*nd_ns); 391 m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len; 392 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ 393 394 /* fill neighbor solicitation packet */ 395 ip6 = mtod(m, struct ip6_hdr *); 396 ip6->ip6_flow = 0; 397 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 398 ip6->ip6_vfc |= IPV6_VERSION; 399 /* ip6->ip6_plen will be set later */ 400 ip6->ip6_nxt = IPPROTO_ICMPV6; 401 ip6->ip6_hlim = 255; 402 if (daddr6) 403 ip6->ip6_dst = *daddr6; 404 else { 405 ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL; 406 ip6->ip6_dst.s6_addr16[1] = 0; 407 ip6->ip6_dst.s6_addr32[1] = 0; 408 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE; 409 ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3]; 410 ip6->ip6_dst.s6_addr8[12] = 0xff; 411 if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0) 412 goto bad; 413 } 414 if (!dad) { 415 /* 416 * RFC2461 7.2.2: 417 * "If the source address of the packet prompting the 418 * solicitation is the same as one of the addresses assigned 419 * to the outgoing interface, that address SHOULD be placed 420 * in the IP Source Address of the outgoing solicitation. 421 * Otherwise, any one of the addresses assigned to the 422 * interface should be used." 423 * 424 * We use the source address for the prompting packet 425 * (saddr6), if: 426 * - saddr6 is given from the caller (by giving "ln"), and 427 * - saddr6 belongs to the outgoing interface. 428 * Otherwise, we perform the source address selection as usual. 429 */ 430 struct ip6_hdr *hip6; /* hold ip6 */ 431 struct in6_addr *hsrc = NULL; 432 433 if (ln && ln->ln_hold) { 434 /* 435 * assuming every packet in ln_hold has the same IP 436 * header 437 */ 438 hip6 = mtod(ln->ln_hold, struct ip6_hdr *); 439 /* XXX pullup? */ 440 if (sizeof(*hip6) < ln->ln_hold->m_len) 441 hsrc = &hip6->ip6_src; 442 else 443 hsrc = NULL; 444 } 445 if (hsrc && in6ifa_ifpwithaddr(ifp, hsrc)) 446 src = hsrc; 447 else { 448 int error; 449 struct sockaddr_in6 dst_sa; 450 451 bzero(&dst_sa, sizeof(dst_sa)); 452 dst_sa.sin6_family = AF_INET6; 453 dst_sa.sin6_len = sizeof(dst_sa); 454 dst_sa.sin6_addr = ip6->ip6_dst; 455 456 src = in6_selectsrc(&dst_sa, NULL, 457 NULL, &ro, NULL, NULL, &error); 458 if (src == NULL) { 459 char ip6buf[INET6_ADDRSTRLEN]; 460 nd6log((LOG_DEBUG, 461 "nd6_ns_output: source can't be " 462 "determined: dst=%s, error=%d\n", 463 ip6_sprintf(ip6buf, &dst_sa.sin6_addr), 464 error)); 465 goto bad; 466 } 467 } 468 } else { 469 /* 470 * Source address for DAD packet must always be IPv6 471 * unspecified address. (0::0) 472 * We actually don't have to 0-clear the address (we did it 473 * above), but we do so here explicitly to make the intention 474 * clearer. 475 */ 476 bzero(&src_in, sizeof(src_in)); 477 src = &src_in; 478 } 479 ip6->ip6_src = *src; 480 nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1); 481 nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT; 482 nd_ns->nd_ns_code = 0; 483 nd_ns->nd_ns_reserved = 0; 484 nd_ns->nd_ns_target = *taddr6; 485 in6_clearscope(&nd_ns->nd_ns_target); /* XXX */ 486 487 /* 488 * Add source link-layer address option. 489 * 490 * spec implementation 491 * --- --- 492 * DAD packet MUST NOT do not add the option 493 * there's no link layer address: 494 * impossible do not add the option 495 * there's link layer address: 496 * Multicast NS MUST add one add the option 497 * Unicast NS SHOULD add one add the option 498 */ 499 if (!dad && (mac = nd6_ifptomac(ifp))) { 500 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; 501 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1); 502 /* 8 byte alignments... */ 503 optlen = (optlen + 7) & ~7; 504 505 m->m_pkthdr.len += optlen; 506 m->m_len += optlen; 507 icmp6len += optlen; 508 bzero((caddr_t)nd_opt, optlen); 509 nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR; 510 nd_opt->nd_opt_len = optlen >> 3; 511 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen); 512 } 513 514 ip6->ip6_plen = htons((u_short)icmp6len); 515 nd_ns->nd_ns_cksum = 0; 516 nd_ns->nd_ns_cksum = 517 in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len); 518 519 ip6_output(m, NULL, &ro, dad ? IPV6_UNSPECSRC : 0, &im6o, NULL, NULL); 520 icmp6_ifstat_inc(ifp, ifs6_out_msg); 521 icmp6_ifstat_inc(ifp, ifs6_out_neighborsolicit); 522 icmp6stat.icp6s_outhist[ND_NEIGHBOR_SOLICIT]++; 523 524 if (ro.ro_rt) { /* we don't cache this route. */ 525 RTFREE(ro.ro_rt); 526 } 527 return; 528 529 bad: 530 if (ro.ro_rt) { 531 RTFREE(ro.ro_rt); 532 } 533 m_freem(m); 534 return; 535} 536 537/* 538 * Neighbor advertisement input handling. 539 * 540 * Based on RFC 2461 541 * Based on RFC 2462 (duplicate address detection) 542 * 543 * the following items are not implemented yet: 544 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) 545 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) 546 */ 547void 548nd6_na_input(struct mbuf *m, int off, int icmp6len) 549{ 550 struct ifnet *ifp = m->m_pkthdr.rcvif; 551 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 552 struct nd_neighbor_advert *nd_na; 553 struct in6_addr daddr6 = ip6->ip6_dst; 554 struct in6_addr taddr6; 555 int flags; 556 int is_router; 557 int is_solicited; 558 int is_override; 559 char *lladdr = NULL; 560 int lladdrlen = 0; 561 struct ifaddr *ifa; 562 struct llinfo_nd6 *ln; 563 struct rtentry *rt; 564 struct sockaddr_dl *sdl; 565 union nd_opts ndopts; 566 char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN]; 567 568 if (ip6->ip6_hlim != 255) { 569 nd6log((LOG_ERR, 570 "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n", 571 ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src), 572 ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp))); 573 goto bad; 574 } 575 576#ifndef PULLDOWN_TEST 577 IP6_EXTHDR_CHECK(m, off, icmp6len,); 578 nd_na = (struct nd_neighbor_advert *)((caddr_t)ip6 + off); 579#else 580 IP6_EXTHDR_GET(nd_na, struct nd_neighbor_advert *, m, off, icmp6len); 581 if (nd_na == NULL) { 582 icmp6stat.icp6s_tooshort++; 583 return; 584 } 585#endif 586 587 flags = nd_na->nd_na_flags_reserved; 588 is_router = ((flags & ND_NA_FLAG_ROUTER) != 0); 589 is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0); 590 is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0); 591 592 taddr6 = nd_na->nd_na_target; 593 if (in6_setscope(&taddr6, ifp, NULL)) 594 goto bad; /* XXX: impossible */ 595 596 if (IN6_IS_ADDR_MULTICAST(&taddr6)) { 597 nd6log((LOG_ERR, 598 "nd6_na_input: invalid target address %s\n", 599 ip6_sprintf(ip6bufs, &taddr6))); 600 goto bad; 601 } 602 if (IN6_IS_ADDR_MULTICAST(&daddr6)) 603 if (is_solicited) { 604 nd6log((LOG_ERR, 605 "nd6_na_input: a solicited adv is multicasted\n")); 606 goto bad; 607 } 608 609 icmp6len -= sizeof(*nd_na); 610 nd6_option_init(nd_na + 1, icmp6len, &ndopts); 611 if (nd6_options(&ndopts) < 0) { 612 nd6log((LOG_INFO, 613 "nd6_na_input: invalid ND option, ignored\n")); 614 /* nd6_options have incremented stats */ 615 goto freeit; 616 } 617 618 if (ndopts.nd_opts_tgt_lladdr) { 619 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1); 620 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3; 621 } 622 623 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); 624 625 /* 626 * Target address matches one of my interface address. 627 * 628 * If my address is tentative, this means that there's somebody 629 * already using the same address as mine. This indicates DAD failure. 630 * This is defined in RFC 2462. 631 * 632 * Otherwise, process as defined in RFC 2461. 633 */ 634 if (ifa 635 && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) { 636 nd6_dad_na_input(ifa); 637 goto freeit; 638 } 639 640 /* Just for safety, maybe unnecessary. */ 641 if (ifa) { 642 log(LOG_ERR, 643 "nd6_na_input: duplicate IP6 address %s\n", 644 ip6_sprintf(ip6bufs, &taddr6)); 645 goto freeit; 646 } 647 648 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 649 nd6log((LOG_INFO, "nd6_na_input: lladdrlen mismatch for %s " 650 "(if %d, NA packet %d)\n", ip6_sprintf(ip6bufs, &taddr6), 651 ifp->if_addrlen, lladdrlen - 2)); 652 goto bad; 653 } 654 655 /* 656 * If no neighbor cache entry is found, NA SHOULD silently be 657 * discarded. 658 */ 659 rt = nd6_lookup(&taddr6, 0, ifp); 660 if ((rt == NULL) || 661 ((ln = (struct llinfo_nd6 *)rt->rt_llinfo) == NULL) || 662 ((sdl = SDL(rt->rt_gateway)) == NULL)) 663 goto freeit; 664 665 if (ln->ln_state == ND6_LLINFO_INCOMPLETE) { 666 /* 667 * If the link-layer has address, and no lladdr option came, 668 * discard the packet. 669 */ 670 if (ifp->if_addrlen && lladdr == NULL) 671 goto freeit; 672 673 /* 674 * Record link-layer address, and update the state. 675 */ 676 sdl->sdl_alen = ifp->if_addrlen; 677 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); 678 if (is_solicited) { 679 ln->ln_state = ND6_LLINFO_REACHABLE; 680 ln->ln_byhint = 0; 681 if (!ND6_LLINFO_PERMANENT(ln)) { 682 nd6_llinfo_settimer(ln, 683 (long)ND_IFINFO(rt->rt_ifp)->reachable * hz); 684 } 685 } else { 686 ln->ln_state = ND6_LLINFO_STALE; 687 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 688 } 689 if ((ln->ln_router = is_router) != 0) { 690 /* 691 * This means a router's state has changed from 692 * non-reachable to probably reachable, and might 693 * affect the status of associated prefixes.. 694 */ 695 pfxlist_onlink_check(); 696 } 697 } else { 698 int llchange; 699 700 /* 701 * Check if the link-layer address has changed or not. 702 */ 703 if (lladdr == NULL) 704 llchange = 0; 705 else { 706 if (sdl->sdl_alen) { 707 if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen)) 708 llchange = 1; 709 else 710 llchange = 0; 711 } else 712 llchange = 1; 713 } 714 715 /* 716 * This is VERY complex. Look at it with care. 717 * 718 * override solicit lladdr llchange action 719 * (L: record lladdr) 720 * 721 * 0 0 n -- (2c) 722 * 0 0 y n (2b) L 723 * 0 0 y y (1) REACHABLE->STALE 724 * 0 1 n -- (2c) *->REACHABLE 725 * 0 1 y n (2b) L *->REACHABLE 726 * 0 1 y y (1) REACHABLE->STALE 727 * 1 0 n -- (2a) 728 * 1 0 y n (2a) L 729 * 1 0 y y (2a) L *->STALE 730 * 1 1 n -- (2a) *->REACHABLE 731 * 1 1 y n (2a) L *->REACHABLE 732 * 1 1 y y (2a) L *->REACHABLE 733 */ 734 if (!is_override && (lladdr != NULL && llchange)) { /* (1) */ 735 /* 736 * If state is REACHABLE, make it STALE. 737 * no other updates should be done. 738 */ 739 if (ln->ln_state == ND6_LLINFO_REACHABLE) { 740 ln->ln_state = ND6_LLINFO_STALE; 741 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 742 } 743 goto freeit; 744 } else if (is_override /* (2a) */ 745 || (!is_override && (lladdr != NULL && !llchange)) /* (2b) */ 746 || lladdr == NULL) { /* (2c) */ 747 /* 748 * Update link-local address, if any. 749 */ 750 if (lladdr != NULL) { 751 sdl->sdl_alen = ifp->if_addrlen; 752 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); 753 } 754 755 /* 756 * If solicited, make the state REACHABLE. 757 * If not solicited and the link-layer address was 758 * changed, make it STALE. 759 */ 760 if (is_solicited) { 761 ln->ln_state = ND6_LLINFO_REACHABLE; 762 ln->ln_byhint = 0; 763 if (!ND6_LLINFO_PERMANENT(ln)) { 764 nd6_llinfo_settimer(ln, 765 (long)ND_IFINFO(ifp)->reachable * hz); 766 } 767 } else { 768 if (lladdr != NULL && llchange) { 769 ln->ln_state = ND6_LLINFO_STALE; 770 nd6_llinfo_settimer(ln, 771 (long)nd6_gctimer * hz); 772 } 773 } 774 } 775 776 if (ln->ln_router && !is_router) { 777 /* 778 * The peer dropped the router flag. 779 * Remove the sender from the Default Router List and 780 * update the Destination Cache entries. 781 */ 782 struct nd_defrouter *dr; 783 struct in6_addr *in6; 784 int s; 785 786 in6 = &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr; 787 788 /* 789 * Lock to protect the default router list. 790 * XXX: this might be unnecessary, since this function 791 * is only called under the network software interrupt 792 * context. However, we keep it just for safety. 793 */ 794 s = splnet(); 795 dr = defrouter_lookup(in6, ifp); 796 if (dr) 797 defrtrlist_del(dr); 798 else if (!ip6_forwarding) { 799 /* 800 * Even if the neighbor is not in the default 801 * router list, the neighbor may be used 802 * as a next hop for some destinations 803 * (e.g. redirect case). So we must 804 * call rt6_flush explicitly. 805 */ 806 rt6_flush(&ip6->ip6_src, ifp); 807 } 808 splx(s); 809 } 810 ln->ln_router = is_router; 811 } 812 rt->rt_flags &= ~RTF_REJECT; 813 ln->ln_asked = 0; 814 if (ln->ln_hold) { 815 struct mbuf *m_hold, *m_hold_next; 816 817 /* 818 * reset the ln_hold in advance, to explicitly 819 * prevent a ln_hold lookup in nd6_output() 820 * (wouldn't happen, though...) 821 */ 822 for (m_hold = ln->ln_hold; 823 m_hold; m_hold = m_hold_next) { 824 m_hold_next = m_hold->m_nextpkt; 825 m_hold->m_nextpkt = NULL; 826 /* 827 * we assume ifp is not a loopback here, so just set 828 * the 2nd argument as the 1st one. 829 */ 830 nd6_output(ifp, ifp, m_hold, 831 (struct sockaddr_in6 *)rt_key(rt), rt); 832 } 833 ln->ln_hold = NULL; 834 } 835 836 freeit: 837 m_freem(m); 838 return; 839 840 bad: 841 icmp6stat.icp6s_badna++; 842 m_freem(m); 843} 844 845/* 846 * Neighbor advertisement output handling. 847 * 848 * Based on RFC 2461 849 * 850 * the following items are not implemented yet: 851 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) 852 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) 853 * 854 * tlladdr - 1 if include target link-layer address 855 * sdl0 - sockaddr_dl (= proxy NA) or NULL 856 */ 857void 858nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6_0, 859 const struct in6_addr *taddr6, u_long flags, int tlladdr, 860 struct sockaddr *sdl0) 861{ 862 struct mbuf *m; 863 struct ip6_hdr *ip6; 864 struct nd_neighbor_advert *nd_na; 865 struct ip6_moptions im6o; 866 struct in6_addr *src, daddr6; 867 struct sockaddr_in6 dst_sa; 868 int icmp6len, maxlen, error; 869 caddr_t mac = NULL; 870 struct route_in6 ro; 871 872 bzero(&ro, sizeof(ro)); 873 874 daddr6 = *daddr6_0; /* make a local copy for modification */ 875 876 /* estimate the size of message */ 877 maxlen = sizeof(*ip6) + sizeof(*nd_na); 878 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; 879 if (max_linkhdr + maxlen >= MCLBYTES) { 880#ifdef DIAGNOSTIC 881 printf("nd6_na_output: max_linkhdr + maxlen >= MCLBYTES " 882 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES); 883#endif 884 return; 885 } 886 887 MGETHDR(m, M_DONTWAIT, MT_DATA); 888 if (m && max_linkhdr + maxlen >= MHLEN) { 889 MCLGET(m, M_DONTWAIT); 890 if ((m->m_flags & M_EXT) == 0) { 891 m_free(m); 892 m = NULL; 893 } 894 } 895 if (m == NULL) 896 return; 897 m->m_pkthdr.rcvif = NULL; 898 899 if (IN6_IS_ADDR_MULTICAST(&daddr6)) { 900 m->m_flags |= M_MCAST; 901 im6o.im6o_multicast_ifp = ifp; 902 im6o.im6o_multicast_hlim = 255; 903 im6o.im6o_multicast_loop = 0; 904 } 905 906 icmp6len = sizeof(*nd_na); 907 m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len; 908 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ 909 910 /* fill neighbor advertisement packet */ 911 ip6 = mtod(m, struct ip6_hdr *); 912 ip6->ip6_flow = 0; 913 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 914 ip6->ip6_vfc |= IPV6_VERSION; 915 ip6->ip6_nxt = IPPROTO_ICMPV6; 916 ip6->ip6_hlim = 255; 917 if (IN6_IS_ADDR_UNSPECIFIED(&daddr6)) { 918 /* reply to DAD */ 919 daddr6.s6_addr16[0] = IPV6_ADDR_INT16_MLL; 920 daddr6.s6_addr16[1] = 0; 921 daddr6.s6_addr32[1] = 0; 922 daddr6.s6_addr32[2] = 0; 923 daddr6.s6_addr32[3] = IPV6_ADDR_INT32_ONE; 924 if (in6_setscope(&daddr6, ifp, NULL)) 925 goto bad; 926 927 flags &= ~ND_NA_FLAG_SOLICITED; 928 } 929 ip6->ip6_dst = daddr6; 930 bzero(&dst_sa, sizeof(struct sockaddr_in6)); 931 dst_sa.sin6_family = AF_INET6; 932 dst_sa.sin6_len = sizeof(struct sockaddr_in6); 933 dst_sa.sin6_addr = daddr6; 934 935 /* 936 * Select a source whose scope is the same as that of the dest. 937 */ 938 bcopy(&dst_sa, &ro.ro_dst, sizeof(dst_sa)); 939 src = in6_selectsrc(&dst_sa, NULL, NULL, &ro, NULL, NULL, &error); 940 if (src == NULL) { 941 char ip6buf[INET6_ADDRSTRLEN]; 942 nd6log((LOG_DEBUG, "nd6_na_output: source can't be " 943 "determined: dst=%s, error=%d\n", 944 ip6_sprintf(ip6buf, &dst_sa.sin6_addr), error)); 945 goto bad; 946 } 947 ip6->ip6_src = *src; 948 nd_na = (struct nd_neighbor_advert *)(ip6 + 1); 949 nd_na->nd_na_type = ND_NEIGHBOR_ADVERT; 950 nd_na->nd_na_code = 0; 951 nd_na->nd_na_target = *taddr6; 952 in6_clearscope(&nd_na->nd_na_target); /* XXX */ 953 954 /* 955 * "tlladdr" indicates NS's condition for adding tlladdr or not. 956 * see nd6_ns_input() for details. 957 * Basically, if NS packet is sent to unicast/anycast addr, 958 * target lladdr option SHOULD NOT be included. 959 */ 960 if (tlladdr) { 961 /* 962 * sdl0 != NULL indicates proxy NA. If we do proxy, use 963 * lladdr in sdl0. If we are not proxying (sending NA for 964 * my address) use lladdr configured for the interface. 965 */ 966 if (sdl0 == NULL) { 967#ifdef DEV_CARP 968 if (ifp->if_carp) 969 mac = carp_macmatch6(ifp->if_carp, m, taddr6); 970 if (mac == NULL) 971 mac = nd6_ifptomac(ifp); 972#else 973 mac = nd6_ifptomac(ifp); 974#endif 975 } else if (sdl0->sa_family == AF_LINK) { 976 struct sockaddr_dl *sdl; 977 sdl = (struct sockaddr_dl *)sdl0; 978 if (sdl->sdl_alen == ifp->if_addrlen) 979 mac = LLADDR(sdl); 980 } 981 } 982 if (tlladdr && mac) { 983 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; 984 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1); 985 986 /* roundup to 8 bytes alignment! */ 987 optlen = (optlen + 7) & ~7; 988 989 m->m_pkthdr.len += optlen; 990 m->m_len += optlen; 991 icmp6len += optlen; 992 bzero((caddr_t)nd_opt, optlen); 993 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR; 994 nd_opt->nd_opt_len = optlen >> 3; 995 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen); 996 } else 997 flags &= ~ND_NA_FLAG_OVERRIDE; 998 999 ip6->ip6_plen = htons((u_short)icmp6len); 1000 nd_na->nd_na_flags_reserved = flags; 1001 nd_na->nd_na_cksum = 0; 1002 nd_na->nd_na_cksum = 1003 in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len); 1004 1005 ip6_output(m, NULL, &ro, 0, &im6o, NULL, NULL); 1006 icmp6_ifstat_inc(ifp, ifs6_out_msg); 1007 icmp6_ifstat_inc(ifp, ifs6_out_neighboradvert); 1008 icmp6stat.icp6s_outhist[ND_NEIGHBOR_ADVERT]++; 1009 1010 if (ro.ro_rt) { /* we don't cache this route. */ 1011 RTFREE(ro.ro_rt); 1012 } 1013 return; 1014 1015 bad: 1016 if (ro.ro_rt) { 1017 RTFREE(ro.ro_rt); 1018 } 1019 m_freem(m); 1020 return; 1021} 1022 1023caddr_t 1024nd6_ifptomac(struct ifnet *ifp) 1025{ 1026 switch (ifp->if_type) { 1027 case IFT_ARCNET: 1028 case IFT_ETHER: 1029 case IFT_FDDI: 1030 case IFT_IEEE1394: 1031#ifdef IFT_L2VLAN 1032 case IFT_L2VLAN: 1033#endif 1034#ifdef IFT_IEEE80211 1035 case IFT_IEEE80211: 1036#endif 1037#ifdef IFT_CARP 1038 case IFT_CARP: 1039#endif 1040 case IFT_BRIDGE: 1041 case IFT_ISO88025: 1042 return IF_LLADDR(ifp); 1043 default: 1044 return NULL; 1045 } 1046} 1047 1048TAILQ_HEAD(dadq_head, dadq); 1049struct dadq { 1050 TAILQ_ENTRY(dadq) dad_list; 1051 struct ifaddr *dad_ifa; 1052 int dad_count; /* max NS to send */ 1053 int dad_ns_tcount; /* # of trials to send NS */ 1054 int dad_ns_ocount; /* NS sent so far */ 1055 int dad_ns_icount; 1056 int dad_na_icount; 1057 struct callout dad_timer_ch; 1058}; 1059 1060static struct dadq_head dadq; 1061static int dad_init = 0; 1062 1063static struct dadq * 1064nd6_dad_find(struct ifaddr *ifa) 1065{ 1066 struct dadq *dp; 1067 1068 for (dp = dadq.tqh_first; dp; dp = dp->dad_list.tqe_next) { 1069 if (dp->dad_ifa == ifa) 1070 return dp; 1071 } 1072 return NULL; 1073} 1074 1075static void 1076nd6_dad_starttimer(struct dadq *dp, int ticks) 1077{ 1078 1079 callout_reset(&dp->dad_timer_ch, ticks, 1080 (void (*) __P((void *)))nd6_dad_timer, (void *)dp->dad_ifa); 1081} 1082 1083static void 1084nd6_dad_stoptimer(struct dadq *dp) 1085{ 1086 1087 callout_stop(&dp->dad_timer_ch); 1088} 1089 1090/* 1091 * Start Duplicate Address Detection (DAD) for specified interface address. 1092 */ 1093void 1094nd6_dad_start(struct ifaddr *ifa, int delay) 1095{ 1096 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1097 struct dadq *dp; 1098 char ip6buf[INET6_ADDRSTRLEN]; 1099 1100 if (!dad_init) { 1101 TAILQ_INIT(&dadq); 1102 dad_init++; 1103 } 1104 1105 /* 1106 * If we don't need DAD, don't do it. 1107 * There are several cases: 1108 * - DAD is disabled (ip6_dad_count == 0) 1109 * - the interface address is anycast 1110 */ 1111 if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) { 1112 log(LOG_DEBUG, 1113 "nd6_dad_start: called with non-tentative address " 1114 "%s(%s)\n", 1115 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr), 1116 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1117 return; 1118 } 1119 if (ia->ia6_flags & IN6_IFF_ANYCAST) { 1120 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1121 return; 1122 } 1123 if (!ip6_dad_count) { 1124 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1125 return; 1126 } 1127 if (ifa->ifa_ifp == NULL) 1128 panic("nd6_dad_start: ifa->ifa_ifp == NULL"); 1129 if (!(ifa->ifa_ifp->if_flags & IFF_UP)) { 1130 return; 1131 } 1132 if (nd6_dad_find(ifa) != NULL) { 1133 /* DAD already in progress */ 1134 return; 1135 } 1136 1137 dp = malloc(sizeof(*dp), M_IP6NDP, M_NOWAIT); 1138 if (dp == NULL) { 1139 log(LOG_ERR, "nd6_dad_start: memory allocation failed for " 1140 "%s(%s)\n", 1141 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr), 1142 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1143 return; 1144 } 1145 bzero(dp, sizeof(*dp)); 1146 callout_init(&dp->dad_timer_ch, 0); 1147 TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list); 1148 1149 nd6log((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp), 1150 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr))); 1151 1152 /* 1153 * Send NS packet for DAD, ip6_dad_count times. 1154 * Note that we must delay the first transmission, if this is the 1155 * first packet to be sent from the interface after interface 1156 * (re)initialization. 1157 */ 1158 dp->dad_ifa = ifa; 1159 IFAREF(ifa); /* just for safety */ 1160 dp->dad_count = ip6_dad_count; 1161 dp->dad_ns_icount = dp->dad_na_icount = 0; 1162 dp->dad_ns_ocount = dp->dad_ns_tcount = 0; 1163 if (delay == 0) { 1164 nd6_dad_ns_output(dp, ifa); 1165 nd6_dad_starttimer(dp, 1166 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000); 1167 } else { 1168 nd6_dad_starttimer(dp, delay); 1169 } 1170} 1171 1172/* 1173 * terminate DAD unconditionally. used for address removals. 1174 */ 1175void 1176nd6_dad_stop(struct ifaddr *ifa) 1177{ 1178 struct dadq *dp; 1179 1180 if (!dad_init) 1181 return; 1182 dp = nd6_dad_find(ifa); 1183 if (!dp) { 1184 /* DAD wasn't started yet */ 1185 return; 1186 } 1187 1188 nd6_dad_stoptimer(dp); 1189 1190 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1191 free(dp, M_IP6NDP); 1192 dp = NULL; 1193 IFAFREE(ifa); 1194} 1195 1196static void 1197nd6_dad_timer(struct ifaddr *ifa) 1198{ 1199 int s; 1200 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1201 struct dadq *dp; 1202 char ip6buf[INET6_ADDRSTRLEN]; 1203 1204 s = splnet(); /* XXX */ 1205 1206 /* Sanity check */ 1207 if (ia == NULL) { 1208 log(LOG_ERR, "nd6_dad_timer: called with null parameter\n"); 1209 goto done; 1210 } 1211 dp = nd6_dad_find(ifa); 1212 if (dp == NULL) { 1213 log(LOG_ERR, "nd6_dad_timer: DAD structure not found\n"); 1214 goto done; 1215 } 1216 if (ia->ia6_flags & IN6_IFF_DUPLICATED) { 1217 log(LOG_ERR, "nd6_dad_timer: called with duplicated address " 1218 "%s(%s)\n", 1219 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr), 1220 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1221 goto done; 1222 } 1223 if ((ia->ia6_flags & IN6_IFF_TENTATIVE) == 0) { 1224 log(LOG_ERR, "nd6_dad_timer: called with non-tentative address " 1225 "%s(%s)\n", 1226 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr), 1227 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"); 1228 goto done; 1229 } 1230 1231 /* timeouted with IFF_{RUNNING,UP} check */ 1232 if (dp->dad_ns_tcount > dad_maxtry) { 1233 nd6log((LOG_INFO, "%s: could not run DAD, driver problem?\n", 1234 if_name(ifa->ifa_ifp))); 1235 1236 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1237 free(dp, M_IP6NDP); 1238 dp = NULL; 1239 IFAFREE(ifa); 1240 goto done; 1241 } 1242 1243 /* Need more checks? */ 1244 if (dp->dad_ns_ocount < dp->dad_count) { 1245 /* 1246 * We have more NS to go. Send NS packet for DAD. 1247 */ 1248 nd6_dad_ns_output(dp, ifa); 1249 nd6_dad_starttimer(dp, 1250 (long)ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000); 1251 } else { 1252 /* 1253 * We have transmitted sufficient number of DAD packets. 1254 * See what we've got. 1255 */ 1256 int duplicate; 1257 1258 duplicate = 0; 1259 1260 if (dp->dad_na_icount) { 1261 /* 1262 * the check is in nd6_dad_na_input(), 1263 * but just in case 1264 */ 1265 duplicate++; 1266 } 1267 1268 if (dp->dad_ns_icount) { 1269 /* We've seen NS, means DAD has failed. */ 1270 duplicate++; 1271 } 1272 1273 if (duplicate) { 1274 /* (*dp) will be freed in nd6_dad_duplicated() */ 1275 dp = NULL; 1276 nd6_dad_duplicated(ifa); 1277 } else { 1278 /* 1279 * We are done with DAD. No NA came, no NS came. 1280 * No duplicate address found. 1281 */ 1282 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1283 1284 nd6log((LOG_DEBUG, 1285 "%s: DAD complete for %s - no duplicates found\n", 1286 if_name(ifa->ifa_ifp), 1287 ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr))); 1288 1289 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1290 free(dp, M_IP6NDP); 1291 dp = NULL; 1292 IFAFREE(ifa); 1293 } 1294 } 1295 1296done: 1297 splx(s); 1298} 1299 1300void 1301nd6_dad_duplicated(struct ifaddr *ifa) 1302{ 1303 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1304 struct ifnet *ifp; 1305 struct dadq *dp; 1306 char ip6buf[INET6_ADDRSTRLEN]; 1307 1308 dp = nd6_dad_find(ifa); 1309 if (dp == NULL) { 1310 log(LOG_ERR, "nd6_dad_duplicated: DAD structure not found\n"); 1311 return; 1312 } 1313 1314 log(LOG_ERR, "%s: DAD detected duplicate IPv6 address %s: " 1315 "NS in/out=%d/%d, NA in=%d\n", 1316 if_name(ifa->ifa_ifp), ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr), 1317 dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_na_icount); 1318 1319 ia->ia6_flags &= ~IN6_IFF_TENTATIVE; 1320 ia->ia6_flags |= IN6_IFF_DUPLICATED; 1321 1322 /* We are done with DAD, with duplicate address found. (failure) */ 1323 nd6_dad_stoptimer(dp); 1324 1325 ifp = ifa->ifa_ifp; 1326 log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n", 1327 if_name(ifp), ip6_sprintf(ip6buf, &ia->ia_addr.sin6_addr)); 1328 log(LOG_ERR, "%s: manual intervention required\n", 1329 if_name(ifp)); 1330 1331 /* 1332 * If the address is a link-local address formed from an interface 1333 * identifier based on the hardware address which is supposed to be 1334 * uniquely assigned (e.g., EUI-64 for an Ethernet interface), IP 1335 * operation on the interface SHOULD be disabled. 1336 * [rfc2462bis-03 Section 5.4.5] 1337 */ 1338 if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr)) { 1339 struct in6_addr in6; 1340 1341 /* 1342 * To avoid over-reaction, we only apply this logic when we are 1343 * very sure that hardware addresses are supposed to be unique. 1344 */ 1345 switch (ifp->if_type) { 1346 case IFT_ETHER: 1347 case IFT_FDDI: 1348 case IFT_ATM: 1349 case IFT_IEEE1394: 1350#ifdef IFT_IEEE80211 1351 case IFT_IEEE80211: 1352#endif 1353 in6 = ia->ia_addr.sin6_addr; 1354 if (in6_get_hw_ifid(ifp, &in6) == 0 && 1355 IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) { 1356 ND_IFINFO(ifp)->flags |= ND6_IFF_IFDISABLED; 1357 log(LOG_ERR, "%s: possible hardware address " 1358 "duplication detected, disable IPv6\n", 1359 if_name(ifp)); 1360 } 1361 break; 1362 } 1363 } 1364 1365 TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); 1366 free(dp, M_IP6NDP); 1367 dp = NULL; 1368 IFAFREE(ifa); 1369} 1370 1371static void 1372nd6_dad_ns_output(struct dadq *dp, struct ifaddr *ifa) 1373{ 1374 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; 1375 struct ifnet *ifp = ifa->ifa_ifp; 1376 1377 dp->dad_ns_tcount++; 1378 if ((ifp->if_flags & IFF_UP) == 0) { 1379 return; 1380 } 1381 if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) { 1382 return; 1383 } 1384 1385 dp->dad_ns_ocount++; 1386 nd6_ns_output(ifp, NULL, &ia->ia_addr.sin6_addr, NULL, 1); 1387} 1388 1389static void 1390nd6_dad_ns_input(struct ifaddr *ifa) 1391{ 1392 struct in6_ifaddr *ia; 1393 struct ifnet *ifp; 1394 const struct in6_addr *taddr6; 1395 struct dadq *dp; 1396 int duplicate; 1397 1398 if (ifa == NULL) 1399 panic("ifa == NULL in nd6_dad_ns_input"); 1400 1401 ia = (struct in6_ifaddr *)ifa; 1402 ifp = ifa->ifa_ifp; 1403 taddr6 = &ia->ia_addr.sin6_addr; 1404 duplicate = 0; 1405 dp = nd6_dad_find(ifa); 1406 1407 /* Quickhack - completely ignore DAD NS packets */ 1408 if (dad_ignore_ns) { 1409 char ip6buf[INET6_ADDRSTRLEN]; 1410 nd6log((LOG_INFO, 1411 "nd6_dad_ns_input: ignoring DAD NS packet for " 1412 "address %s(%s)\n", ip6_sprintf(ip6buf, taddr6), 1413 if_name(ifa->ifa_ifp))); 1414 return; 1415 } 1416 1417 /* 1418 * if I'm yet to start DAD, someone else started using this address 1419 * first. I have a duplicate and you win. 1420 */ 1421 if (dp == NULL || dp->dad_ns_ocount == 0) 1422 duplicate++; 1423 1424 /* XXX more checks for loopback situation - see nd6_dad_timer too */ 1425 1426 if (duplicate) { 1427 dp = NULL; /* will be freed in nd6_dad_duplicated() */ 1428 nd6_dad_duplicated(ifa); 1429 } else { 1430 /* 1431 * not sure if I got a duplicate. 1432 * increment ns count and see what happens. 1433 */ 1434 if (dp) 1435 dp->dad_ns_icount++; 1436 } 1437} 1438 1439static void 1440nd6_dad_na_input(struct ifaddr *ifa) 1441{ 1442 struct dadq *dp; 1443 1444 if (ifa == NULL) 1445 panic("ifa == NULL in nd6_dad_na_input"); 1446 1447 dp = nd6_dad_find(ifa); 1448 if (dp) 1449 dp->dad_na_icount++; 1450 1451 /* remove the address. */ 1452 nd6_dad_duplicated(ifa); 1453} 1454