nd6_rtr.c revision 186215
1/*- 2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the project nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 * $KAME: nd6_rtr.c,v 1.111 2001/04/27 01:37:15 jinmei Exp $ 30 */ 31 32#include <sys/cdefs.h> 33__FBSDID("$FreeBSD: head/sys/netinet6/nd6_rtr.c 186215 2008-12-17 10:03:49Z qingli $"); 34 35#include "opt_inet.h" 36#include "opt_inet6.h" 37 38#include <sys/param.h> 39#include <sys/systm.h> 40#include <sys/malloc.h> 41#include <sys/mbuf.h> 42#include <sys/socket.h> 43#include <sys/sockio.h> 44#include <sys/time.h> 45#include <sys/kernel.h> 46#include <sys/lock.h> 47#include <sys/errno.h> 48#include <sys/rwlock.h> 49#include <sys/syslog.h> 50#include <sys/queue.h> 51#include <sys/vimage.h> 52 53#include <net/if.h> 54#include <net/if_types.h> 55#include <net/if_dl.h> 56#include <net/route.h> 57#include <net/radix.h> 58#include <net/vnet.h> 59 60#include <netinet/in.h> 61#include <net/if_llatbl.h> 62#include <netinet6/in6_var.h> 63#include <netinet6/in6_ifattach.h> 64#include <netinet/ip6.h> 65#include <netinet6/ip6_var.h> 66#include <netinet6/nd6.h> 67#include <netinet/icmp6.h> 68#include <netinet6/scope6_var.h> 69#include <netinet6/vinet6.h> 70 71#define SDL(s) ((struct sockaddr_dl *)s) 72 73static int rtpref(struct nd_defrouter *); 74static struct nd_defrouter *defrtrlist_update(struct nd_defrouter *); 75static int prelist_update __P((struct nd_prefixctl *, struct nd_defrouter *, 76 struct mbuf *, int)); 77static struct in6_ifaddr *in6_ifadd(struct nd_prefixctl *, int); 78static struct nd_pfxrouter *pfxrtr_lookup __P((struct nd_prefix *, 79 struct nd_defrouter *)); 80static void pfxrtr_add(struct nd_prefix *, struct nd_defrouter *); 81static void pfxrtr_del(struct nd_pfxrouter *); 82static struct nd_pfxrouter *find_pfxlist_reachable_router 83(struct nd_prefix *); 84static void defrouter_delreq(struct nd_defrouter *); 85static void nd6_rtmsg(int, struct rtentry *); 86 87static int in6_init_prefix_ltimes(struct nd_prefix *); 88static void in6_init_address_ltimes __P((struct nd_prefix *, 89 struct in6_addrlifetime *)); 90 91static int rt6_deleteroute(struct radix_node *, void *); 92 93#ifdef VIMAGE_GLOBALS 94extern int nd6_recalc_reachtm_interval; 95 96static struct ifnet *nd6_defifp; 97int nd6_defifindex; 98 99int ip6_use_tempaddr; 100int ip6_desync_factor; 101u_int32_t ip6_temp_preferred_lifetime; 102u_int32_t ip6_temp_valid_lifetime; 103int ip6_temp_regen_advance; 104#endif 105 106/* RTPREF_MEDIUM has to be 0! */ 107#define RTPREF_HIGH 1 108#define RTPREF_MEDIUM 0 109#define RTPREF_LOW (-1) 110#define RTPREF_RESERVED (-2) 111#define RTPREF_INVALID (-3) /* internal */ 112 113/* 114 * Receive Router Solicitation Message - just for routers. 115 * Router solicitation/advertisement is mostly managed by userland program 116 * (rtadvd) so here we have no function like nd6_ra_output(). 117 * 118 * Based on RFC 2461 119 */ 120void 121nd6_rs_input(struct mbuf *m, int off, int icmp6len) 122{ 123 INIT_VNET_INET6(curvnet); 124 struct ifnet *ifp = m->m_pkthdr.rcvif; 125 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 126 struct nd_router_solicit *nd_rs; 127 struct in6_addr saddr6 = ip6->ip6_src; 128 char *lladdr = NULL; 129 int lladdrlen = 0; 130 union nd_opts ndopts; 131 char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN]; 132 133 /* If I'm not a router, ignore it. */ 134 if (V_ip6_accept_rtadv != 0 || V_ip6_forwarding != 1) 135 goto freeit; 136 137 /* Sanity checks */ 138 if (ip6->ip6_hlim != 255) { 139 nd6log((LOG_ERR, 140 "nd6_rs_input: invalid hlim (%d) from %s to %s on %s\n", 141 ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src), 142 ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp))); 143 goto bad; 144 } 145 146 /* 147 * Don't update the neighbor cache, if src = ::. 148 * This indicates that the src has no IP address assigned yet. 149 */ 150 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) 151 goto freeit; 152 153#ifndef PULLDOWN_TEST 154 IP6_EXTHDR_CHECK(m, off, icmp6len,); 155 nd_rs = (struct nd_router_solicit *)((caddr_t)ip6 + off); 156#else 157 IP6_EXTHDR_GET(nd_rs, struct nd_router_solicit *, m, off, icmp6len); 158 if (nd_rs == NULL) { 159 V_icmp6stat.icp6s_tooshort++; 160 return; 161 } 162#endif 163 164 icmp6len -= sizeof(*nd_rs); 165 nd6_option_init(nd_rs + 1, icmp6len, &ndopts); 166 if (nd6_options(&ndopts) < 0) { 167 nd6log((LOG_INFO, 168 "nd6_rs_input: invalid ND option, ignored\n")); 169 /* nd6_options have incremented stats */ 170 goto freeit; 171 } 172 173 if (ndopts.nd_opts_src_lladdr) { 174 lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1); 175 lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3; 176 } 177 178 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 179 nd6log((LOG_INFO, 180 "nd6_rs_input: lladdrlen mismatch for %s " 181 "(if %d, RS packet %d)\n", 182 ip6_sprintf(ip6bufs, &saddr6), 183 ifp->if_addrlen, lladdrlen - 2)); 184 goto bad; 185 } 186 187 nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, ND_ROUTER_SOLICIT, 0); 188 189 freeit: 190 m_freem(m); 191 return; 192 193 bad: 194 V_icmp6stat.icp6s_badrs++; 195 m_freem(m); 196} 197 198/* 199 * Receive Router Advertisement Message. 200 * 201 * Based on RFC 2461 202 * TODO: on-link bit on prefix information 203 * TODO: ND_RA_FLAG_{OTHER,MANAGED} processing 204 */ 205void 206nd6_ra_input(struct mbuf *m, int off, int icmp6len) 207{ 208 INIT_VNET_INET6(curvnet); 209 struct ifnet *ifp = m->m_pkthdr.rcvif; 210 struct nd_ifinfo *ndi = ND_IFINFO(ifp); 211 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 212 struct nd_router_advert *nd_ra; 213 struct in6_addr saddr6 = ip6->ip6_src; 214 int mcast = 0; 215 union nd_opts ndopts; 216 struct nd_defrouter *dr; 217 char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN]; 218 219 /* 220 * We only accept RAs only when 221 * the system-wide variable allows the acceptance, and 222 * per-interface variable allows RAs on the receiving interface. 223 */ 224 if (V_ip6_accept_rtadv == 0) 225 goto freeit; 226 if (!(ndi->flags & ND6_IFF_ACCEPT_RTADV)) 227 goto freeit; 228 229 if (ip6->ip6_hlim != 255) { 230 nd6log((LOG_ERR, 231 "nd6_ra_input: invalid hlim (%d) from %s to %s on %s\n", 232 ip6->ip6_hlim, ip6_sprintf(ip6bufs, &ip6->ip6_src), 233 ip6_sprintf(ip6bufd, &ip6->ip6_dst), if_name(ifp))); 234 goto bad; 235 } 236 237 if (!IN6_IS_ADDR_LINKLOCAL(&saddr6)) { 238 nd6log((LOG_ERR, 239 "nd6_ra_input: src %s is not link-local\n", 240 ip6_sprintf(ip6bufs, &saddr6))); 241 goto bad; 242 } 243 244#ifndef PULLDOWN_TEST 245 IP6_EXTHDR_CHECK(m, off, icmp6len,); 246 nd_ra = (struct nd_router_advert *)((caddr_t)ip6 + off); 247#else 248 IP6_EXTHDR_GET(nd_ra, struct nd_router_advert *, m, off, icmp6len); 249 if (nd_ra == NULL) { 250 V_icmp6stat.icp6s_tooshort++; 251 return; 252 } 253#endif 254 255 icmp6len -= sizeof(*nd_ra); 256 nd6_option_init(nd_ra + 1, icmp6len, &ndopts); 257 if (nd6_options(&ndopts) < 0) { 258 nd6log((LOG_INFO, 259 "nd6_ra_input: invalid ND option, ignored\n")); 260 /* nd6_options have incremented stats */ 261 goto freeit; 262 } 263 264 { 265 struct nd_defrouter dr0; 266 u_int32_t advreachable = nd_ra->nd_ra_reachable; 267 268 /* remember if this is a multicasted advertisement */ 269 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) 270 mcast = 1; 271 272 bzero(&dr0, sizeof(dr0)); 273 dr0.rtaddr = saddr6; 274 dr0.flags = nd_ra->nd_ra_flags_reserved; 275 dr0.rtlifetime = ntohs(nd_ra->nd_ra_router_lifetime); 276 dr0.expire = time_second + dr0.rtlifetime; 277 dr0.ifp = ifp; 278 /* unspecified or not? (RFC 2461 6.3.4) */ 279 if (advreachable) { 280 advreachable = ntohl(advreachable); 281 if (advreachable <= MAX_REACHABLE_TIME && 282 ndi->basereachable != advreachable) { 283 ndi->basereachable = advreachable; 284 ndi->reachable = ND_COMPUTE_RTIME(ndi->basereachable); 285 ndi->recalctm = V_nd6_recalc_reachtm_interval; /* reset */ 286 } 287 } 288 if (nd_ra->nd_ra_retransmit) 289 ndi->retrans = ntohl(nd_ra->nd_ra_retransmit); 290 if (nd_ra->nd_ra_curhoplimit) 291 ndi->chlim = nd_ra->nd_ra_curhoplimit; 292 dr = defrtrlist_update(&dr0); 293 } 294 295 /* 296 * prefix 297 */ 298 if (ndopts.nd_opts_pi) { 299 struct nd_opt_hdr *pt; 300 struct nd_opt_prefix_info *pi = NULL; 301 struct nd_prefixctl pr; 302 303 for (pt = (struct nd_opt_hdr *)ndopts.nd_opts_pi; 304 pt <= (struct nd_opt_hdr *)ndopts.nd_opts_pi_end; 305 pt = (struct nd_opt_hdr *)((caddr_t)pt + 306 (pt->nd_opt_len << 3))) { 307 if (pt->nd_opt_type != ND_OPT_PREFIX_INFORMATION) 308 continue; 309 pi = (struct nd_opt_prefix_info *)pt; 310 311 if (pi->nd_opt_pi_len != 4) { 312 nd6log((LOG_INFO, 313 "nd6_ra_input: invalid option " 314 "len %d for prefix information option, " 315 "ignored\n", pi->nd_opt_pi_len)); 316 continue; 317 } 318 319 if (128 < pi->nd_opt_pi_prefix_len) { 320 nd6log((LOG_INFO, 321 "nd6_ra_input: invalid prefix " 322 "len %d for prefix information option, " 323 "ignored\n", pi->nd_opt_pi_prefix_len)); 324 continue; 325 } 326 327 if (IN6_IS_ADDR_MULTICAST(&pi->nd_opt_pi_prefix) 328 || IN6_IS_ADDR_LINKLOCAL(&pi->nd_opt_pi_prefix)) { 329 nd6log((LOG_INFO, 330 "nd6_ra_input: invalid prefix " 331 "%s, ignored\n", 332 ip6_sprintf(ip6bufs, 333 &pi->nd_opt_pi_prefix))); 334 continue; 335 } 336 337 bzero(&pr, sizeof(pr)); 338 pr.ndpr_prefix.sin6_family = AF_INET6; 339 pr.ndpr_prefix.sin6_len = sizeof(pr.ndpr_prefix); 340 pr.ndpr_prefix.sin6_addr = pi->nd_opt_pi_prefix; 341 pr.ndpr_ifp = (struct ifnet *)m->m_pkthdr.rcvif; 342 343 pr.ndpr_raf_onlink = (pi->nd_opt_pi_flags_reserved & 344 ND_OPT_PI_FLAG_ONLINK) ? 1 : 0; 345 pr.ndpr_raf_auto = (pi->nd_opt_pi_flags_reserved & 346 ND_OPT_PI_FLAG_AUTO) ? 1 : 0; 347 pr.ndpr_plen = pi->nd_opt_pi_prefix_len; 348 pr.ndpr_vltime = ntohl(pi->nd_opt_pi_valid_time); 349 pr.ndpr_pltime = ntohl(pi->nd_opt_pi_preferred_time); 350 (void)prelist_update(&pr, dr, m, mcast); 351 } 352 } 353 354 /* 355 * MTU 356 */ 357 if (ndopts.nd_opts_mtu && ndopts.nd_opts_mtu->nd_opt_mtu_len == 1) { 358 u_long mtu; 359 u_long maxmtu; 360 361 mtu = (u_long)ntohl(ndopts.nd_opts_mtu->nd_opt_mtu_mtu); 362 363 /* lower bound */ 364 if (mtu < IPV6_MMTU) { 365 nd6log((LOG_INFO, "nd6_ra_input: bogus mtu option " 366 "mtu=%lu sent from %s, ignoring\n", 367 mtu, ip6_sprintf(ip6bufs, &ip6->ip6_src))); 368 goto skip; 369 } 370 371 /* upper bound */ 372 maxmtu = (ndi->maxmtu && ndi->maxmtu < ifp->if_mtu) 373 ? ndi->maxmtu : ifp->if_mtu; 374 if (mtu <= maxmtu) { 375 int change = (ndi->linkmtu != mtu); 376 377 ndi->linkmtu = mtu; 378 if (change) /* in6_maxmtu may change */ 379 in6_setmaxmtu(); 380 } else { 381 nd6log((LOG_INFO, "nd6_ra_input: bogus mtu " 382 "mtu=%lu sent from %s; " 383 "exceeds maxmtu %lu, ignoring\n", 384 mtu, ip6_sprintf(ip6bufs, &ip6->ip6_src), maxmtu)); 385 } 386 } 387 388 skip: 389 390 /* 391 * Source link layer address 392 */ 393 { 394 char *lladdr = NULL; 395 int lladdrlen = 0; 396 397 if (ndopts.nd_opts_src_lladdr) { 398 lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1); 399 lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3; 400 } 401 402 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { 403 nd6log((LOG_INFO, 404 "nd6_ra_input: lladdrlen mismatch for %s " 405 "(if %d, RA packet %d)\n", ip6_sprintf(ip6bufs, &saddr6), 406 ifp->if_addrlen, lladdrlen - 2)); 407 goto bad; 408 } 409 410 nd6_cache_lladdr(ifp, &saddr6, lladdr, 411 lladdrlen, ND_ROUTER_ADVERT, 0); 412 413 /* 414 * Installing a link-layer address might change the state of the 415 * router's neighbor cache, which might also affect our on-link 416 * detection of adveritsed prefixes. 417 */ 418 pfxlist_onlink_check(); 419 } 420 421 freeit: 422 m_freem(m); 423 return; 424 425 bad: 426 V_icmp6stat.icp6s_badra++; 427 m_freem(m); 428} 429 430/* 431 * default router list proccessing sub routines 432 */ 433 434/* tell the change to user processes watching the routing socket. */ 435static void 436nd6_rtmsg(int cmd, struct rtentry *rt) 437{ 438 struct rt_addrinfo info; 439 440 bzero((caddr_t)&info, sizeof(info)); 441 info.rti_info[RTAX_DST] = rt_key(rt); 442 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway; 443 info.rti_info[RTAX_NETMASK] = rt_mask(rt); 444 if (rt->rt_ifp) { 445 info.rti_info[RTAX_IFP] = 446 TAILQ_FIRST(&rt->rt_ifp->if_addrlist)->ifa_addr; 447 info.rti_info[RTAX_IFA] = rt->rt_ifa->ifa_addr; 448 } 449 450 rt_missmsg(cmd, &info, rt->rt_flags, 0); 451} 452 453void 454defrouter_addreq(struct nd_defrouter *new) 455{ 456 struct sockaddr_in6 def, mask, gate; 457 struct rtentry *newrt = NULL; 458 int s; 459 int error; 460 461 bzero(&def, sizeof(def)); 462 bzero(&mask, sizeof(mask)); 463 bzero(&gate, sizeof(gate)); 464 465 def.sin6_len = mask.sin6_len = gate.sin6_len = 466 sizeof(struct sockaddr_in6); 467 def.sin6_family = gate.sin6_family = AF_INET6; 468 gate.sin6_addr = new->rtaddr; 469 470 s = splnet(); 471 error = rtrequest(RTM_ADD, (struct sockaddr *)&def, 472 (struct sockaddr *)&gate, (struct sockaddr *)&mask, 473 RTF_GATEWAY, &newrt); 474 if (newrt) { 475 nd6_rtmsg(RTM_ADD, newrt); /* tell user process */ 476 RTFREE(newrt); 477 } 478 if (error == 0) 479 new->installed = 1; 480 splx(s); 481 return; 482} 483 484struct nd_defrouter * 485defrouter_lookup(struct in6_addr *addr, struct ifnet *ifp) 486{ 487 INIT_VNET_INET6(ifp->if_vnet); 488 struct nd_defrouter *dr; 489 490 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; 491 dr = TAILQ_NEXT(dr, dr_entry)) { 492 if (dr->ifp == ifp && IN6_ARE_ADDR_EQUAL(addr, &dr->rtaddr)) 493 return (dr); 494 } 495 496 return (NULL); /* search failed */ 497} 498 499/* 500 * Remove the default route for a given router. 501 * This is just a subroutine function for defrouter_select(), and should 502 * not be called from anywhere else. 503 */ 504static void 505defrouter_delreq(struct nd_defrouter *dr) 506{ 507 struct sockaddr_in6 def, mask, gate; 508 struct rtentry *oldrt = NULL; 509 510 bzero(&def, sizeof(def)); 511 bzero(&mask, sizeof(mask)); 512 bzero(&gate, sizeof(gate)); 513 514 def.sin6_len = mask.sin6_len = gate.sin6_len = 515 sizeof(struct sockaddr_in6); 516 def.sin6_family = gate.sin6_family = AF_INET6; 517 gate.sin6_addr = dr->rtaddr; 518 519 rtrequest(RTM_DELETE, (struct sockaddr *)&def, 520 (struct sockaddr *)&gate, 521 (struct sockaddr *)&mask, RTF_GATEWAY, &oldrt); 522 if (oldrt) { 523 nd6_rtmsg(RTM_DELETE, oldrt); 524 RTFREE(oldrt); 525 } 526 527 dr->installed = 0; 528} 529 530/* 531 * remove all default routes from default router list 532 */ 533void 534defrouter_reset(void) 535{ 536 INIT_VNET_INET6(curvnet); 537 struct nd_defrouter *dr; 538 539 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; 540 dr = TAILQ_NEXT(dr, dr_entry)) 541 defrouter_delreq(dr); 542 543 /* 544 * XXX should we also nuke any default routers in the kernel, by 545 * going through them by rtalloc1()? 546 */ 547} 548 549void 550defrtrlist_del(struct nd_defrouter *dr) 551{ 552 INIT_VNET_INET6(curvnet); 553 struct nd_defrouter *deldr = NULL; 554 struct nd_prefix *pr; 555 556 /* 557 * Flush all the routing table entries that use the router 558 * as a next hop. 559 */ 560 if (!V_ip6_forwarding && V_ip6_accept_rtadv) /* XXX: better condition? */ 561 rt6_flush(&dr->rtaddr, dr->ifp); 562 563 if (dr->installed) { 564 deldr = dr; 565 defrouter_delreq(dr); 566 } 567 TAILQ_REMOVE(&V_nd_defrouter, dr, dr_entry); 568 569 /* 570 * Also delete all the pointers to the router in each prefix lists. 571 */ 572 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) { 573 struct nd_pfxrouter *pfxrtr; 574 if ((pfxrtr = pfxrtr_lookup(pr, dr)) != NULL) 575 pfxrtr_del(pfxrtr); 576 } 577 pfxlist_onlink_check(); 578 579 /* 580 * If the router is the primary one, choose a new one. 581 * Note that defrouter_select() will remove the current gateway 582 * from the routing table. 583 */ 584 if (deldr) 585 defrouter_select(); 586 587 free(dr, M_IP6NDP); 588} 589 590/* 591 * Default Router Selection according to Section 6.3.6 of RFC 2461 and 592 * draft-ietf-ipngwg-router-selection: 593 * 1) Routers that are reachable or probably reachable should be preferred. 594 * If we have more than one (probably) reachable router, prefer ones 595 * with the highest router preference. 596 * 2) When no routers on the list are known to be reachable or 597 * probably reachable, routers SHOULD be selected in a round-robin 598 * fashion, regardless of router preference values. 599 * 3) If the Default Router List is empty, assume that all 600 * destinations are on-link. 601 * 602 * We assume nd_defrouter is sorted by router preference value. 603 * Since the code below covers both with and without router preference cases, 604 * we do not need to classify the cases by ifdef. 605 * 606 * At this moment, we do not try to install more than one default router, 607 * even when the multipath routing is available, because we're not sure about 608 * the benefits for stub hosts comparing to the risk of making the code 609 * complicated and the possibility of introducing bugs. 610 */ 611void 612defrouter_select(void) 613{ 614 INIT_VNET_INET6(curvnet); 615 int s = splnet(); 616 struct nd_defrouter *dr, *selected_dr = NULL, *installed_dr = NULL; 617 struct llentry *ln = NULL; 618 619 /* 620 * This function should be called only when acting as an autoconfigured 621 * host. Although the remaining part of this function is not effective 622 * if the node is not an autoconfigured host, we explicitly exclude 623 * such cases here for safety. 624 */ 625 if (V_ip6_forwarding || !V_ip6_accept_rtadv) { 626 nd6log((LOG_WARNING, 627 "defrouter_select: called unexpectedly (forwarding=%d, " 628 "accept_rtadv=%d)\n", V_ip6_forwarding, V_ip6_accept_rtadv)); 629 splx(s); 630 return; 631 } 632 633 /* 634 * Let's handle easy case (3) first: 635 * If default router list is empty, there's nothing to be done. 636 */ 637 if (!TAILQ_FIRST(&V_nd_defrouter)) { 638 splx(s); 639 return; 640 } 641 642 /* 643 * Search for a (probably) reachable router from the list. 644 * We just pick up the first reachable one (if any), assuming that 645 * the ordering rule of the list described in defrtrlist_update(). 646 */ 647 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; 648 dr = TAILQ_NEXT(dr, dr_entry)) { 649 IF_AFDATA_LOCK(dr->ifp); 650 if (selected_dr == NULL && 651 (ln = nd6_lookup(&dr->rtaddr, 0, dr->ifp)) && 652 ND6_IS_LLINFO_PROBREACH(ln)) { 653 selected_dr = dr; 654 } 655 IF_AFDATA_UNLOCK(dr->ifp); 656 if (ln != NULL) 657 LLE_RUNLOCK(ln); 658 659 if (dr->installed && installed_dr == NULL) 660 installed_dr = dr; 661 else if (dr->installed && installed_dr) { 662 /* this should not happen. warn for diagnosis. */ 663 log(LOG_ERR, "defrouter_select: more than one router" 664 " is installed\n"); 665 } 666 } 667 /* 668 * If none of the default routers was found to be reachable, 669 * round-robin the list regardless of preference. 670 * Otherwise, if we have an installed router, check if the selected 671 * (reachable) router should really be preferred to the installed one. 672 * We only prefer the new router when the old one is not reachable 673 * or when the new one has a really higher preference value. 674 */ 675 if (selected_dr == NULL) { 676 if (installed_dr == NULL || !TAILQ_NEXT(installed_dr, dr_entry)) 677 selected_dr = TAILQ_FIRST(&V_nd_defrouter); 678 else 679 selected_dr = TAILQ_NEXT(installed_dr, dr_entry); 680 } else if (installed_dr) { 681 IF_AFDATA_LOCK(installed_dr->ifp); 682 if ((ln = nd6_lookup(&installed_dr->rtaddr, 0, installed_dr->ifp)) && 683 ND6_IS_LLINFO_PROBREACH(ln) && 684 rtpref(selected_dr) <= rtpref(installed_dr)) { 685 selected_dr = installed_dr; 686 } 687 IF_AFDATA_UNLOCK(installed_dr->ifp); 688 if (ln != NULL) 689 LLE_RUNLOCK(ln); 690 } 691 692 /* 693 * If the selected router is different than the installed one, 694 * remove the installed router and install the selected one. 695 * Note that the selected router is never NULL here. 696 */ 697 if (installed_dr != selected_dr) { 698 if (installed_dr) 699 defrouter_delreq(installed_dr); 700 defrouter_addreq(selected_dr); 701 } 702 703 splx(s); 704 return; 705} 706 707/* 708 * for default router selection 709 * regards router-preference field as a 2-bit signed integer 710 */ 711static int 712rtpref(struct nd_defrouter *dr) 713{ 714 switch (dr->flags & ND_RA_FLAG_RTPREF_MASK) { 715 case ND_RA_FLAG_RTPREF_HIGH: 716 return (RTPREF_HIGH); 717 case ND_RA_FLAG_RTPREF_MEDIUM: 718 case ND_RA_FLAG_RTPREF_RSV: 719 return (RTPREF_MEDIUM); 720 case ND_RA_FLAG_RTPREF_LOW: 721 return (RTPREF_LOW); 722 default: 723 /* 724 * This case should never happen. If it did, it would mean a 725 * serious bug of kernel internal. We thus always bark here. 726 * Or, can we even panic? 727 */ 728 log(LOG_ERR, "rtpref: impossible RA flag %x\n", dr->flags); 729 return (RTPREF_INVALID); 730 } 731 /* NOTREACHED */ 732} 733 734static struct nd_defrouter * 735defrtrlist_update(struct nd_defrouter *new) 736{ 737 INIT_VNET_INET6(curvnet); 738 struct nd_defrouter *dr, *n; 739 int s = splnet(); 740 741 if ((dr = defrouter_lookup(&new->rtaddr, new->ifp)) != NULL) { 742 /* entry exists */ 743 if (new->rtlifetime == 0) { 744 defrtrlist_del(dr); 745 dr = NULL; 746 } else { 747 int oldpref = rtpref(dr); 748 749 /* override */ 750 dr->flags = new->flags; /* xxx flag check */ 751 dr->rtlifetime = new->rtlifetime; 752 dr->expire = new->expire; 753 754 /* 755 * If the preference does not change, there's no need 756 * to sort the entries. 757 */ 758 if (rtpref(new) == oldpref) { 759 splx(s); 760 return (dr); 761 } 762 763 /* 764 * preferred router may be changed, so relocate 765 * this router. 766 * XXX: calling TAILQ_REMOVE directly is a bad manner. 767 * However, since defrtrlist_del() has many side 768 * effects, we intentionally do so here. 769 * defrouter_select() below will handle routing 770 * changes later. 771 */ 772 TAILQ_REMOVE(&V_nd_defrouter, dr, dr_entry); 773 n = dr; 774 goto insert; 775 } 776 splx(s); 777 return (dr); 778 } 779 780 /* entry does not exist */ 781 if (new->rtlifetime == 0) { 782 splx(s); 783 return (NULL); 784 } 785 786 n = (struct nd_defrouter *)malloc(sizeof(*n), M_IP6NDP, M_NOWAIT); 787 if (n == NULL) { 788 splx(s); 789 return (NULL); 790 } 791 bzero(n, sizeof(*n)); 792 *n = *new; 793 794insert: 795 /* 796 * Insert the new router in the Default Router List; 797 * The Default Router List should be in the descending order 798 * of router-preferece. Routers with the same preference are 799 * sorted in the arriving time order. 800 */ 801 802 /* insert at the end of the group */ 803 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; 804 dr = TAILQ_NEXT(dr, dr_entry)) { 805 if (rtpref(n) > rtpref(dr)) 806 break; 807 } 808 if (dr) 809 TAILQ_INSERT_BEFORE(dr, n, dr_entry); 810 else 811 TAILQ_INSERT_TAIL(&V_nd_defrouter, n, dr_entry); 812 813 defrouter_select(); 814 815 splx(s); 816 817 return (n); 818} 819 820static struct nd_pfxrouter * 821pfxrtr_lookup(struct nd_prefix *pr, struct nd_defrouter *dr) 822{ 823 struct nd_pfxrouter *search; 824 825 for (search = pr->ndpr_advrtrs.lh_first; search; search = search->pfr_next) { 826 if (search->router == dr) 827 break; 828 } 829 830 return (search); 831} 832 833static void 834pfxrtr_add(struct nd_prefix *pr, struct nd_defrouter *dr) 835{ 836 struct nd_pfxrouter *new; 837 838 new = (struct nd_pfxrouter *)malloc(sizeof(*new), M_IP6NDP, M_NOWAIT); 839 if (new == NULL) 840 return; 841 bzero(new, sizeof(*new)); 842 new->router = dr; 843 844 LIST_INSERT_HEAD(&pr->ndpr_advrtrs, new, pfr_entry); 845 846 pfxlist_onlink_check(); 847} 848 849static void 850pfxrtr_del(struct nd_pfxrouter *pfr) 851{ 852 LIST_REMOVE(pfr, pfr_entry); 853 free(pfr, M_IP6NDP); 854} 855 856struct nd_prefix * 857nd6_prefix_lookup(struct nd_prefixctl *key) 858{ 859 INIT_VNET_INET6(curvnet); 860 struct nd_prefix *search; 861 862 for (search = V_nd_prefix.lh_first; 863 search; search = search->ndpr_next) { 864 if (key->ndpr_ifp == search->ndpr_ifp && 865 key->ndpr_plen == search->ndpr_plen && 866 in6_are_prefix_equal(&key->ndpr_prefix.sin6_addr, 867 &search->ndpr_prefix.sin6_addr, key->ndpr_plen)) { 868 break; 869 } 870 } 871 872 return (search); 873} 874 875int 876nd6_prelist_add(struct nd_prefixctl *pr, struct nd_defrouter *dr, 877 struct nd_prefix **newp) 878{ 879 INIT_VNET_INET6(curvnet); 880 struct nd_prefix *new = NULL; 881 int error = 0; 882 int i, s; 883 char ip6buf[INET6_ADDRSTRLEN]; 884 885 new = (struct nd_prefix *)malloc(sizeof(*new), M_IP6NDP, M_NOWAIT); 886 if (new == NULL) 887 return(ENOMEM); 888 bzero(new, sizeof(*new)); 889 new->ndpr_ifp = pr->ndpr_ifp; 890 new->ndpr_prefix = pr->ndpr_prefix; 891 new->ndpr_plen = pr->ndpr_plen; 892 new->ndpr_vltime = pr->ndpr_vltime; 893 new->ndpr_pltime = pr->ndpr_pltime; 894 new->ndpr_flags = pr->ndpr_flags; 895 if ((error = in6_init_prefix_ltimes(new)) != 0) { 896 free(new, M_IP6NDP); 897 return(error); 898 } 899 new->ndpr_lastupdate = time_second; 900 if (newp != NULL) 901 *newp = new; 902 903 /* initialization */ 904 LIST_INIT(&new->ndpr_advrtrs); 905 in6_prefixlen2mask(&new->ndpr_mask, new->ndpr_plen); 906 /* make prefix in the canonical form */ 907 for (i = 0; i < 4; i++) 908 new->ndpr_prefix.sin6_addr.s6_addr32[i] &= 909 new->ndpr_mask.s6_addr32[i]; 910 911 s = splnet(); 912 /* link ndpr_entry to nd_prefix list */ 913 LIST_INSERT_HEAD(&V_nd_prefix, new, ndpr_entry); 914 splx(s); 915 916 /* ND_OPT_PI_FLAG_ONLINK processing */ 917 if (new->ndpr_raf_onlink) { 918 int e; 919 920 if ((e = nd6_prefix_onlink(new)) != 0) { 921 nd6log((LOG_ERR, "nd6_prelist_add: failed to make " 922 "the prefix %s/%d on-link on %s (errno=%d)\n", 923 ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr), 924 pr->ndpr_plen, if_name(pr->ndpr_ifp), e)); 925 /* proceed anyway. XXX: is it correct? */ 926 } 927 } 928 929 if (dr) 930 pfxrtr_add(new, dr); 931 932 return 0; 933} 934 935void 936prelist_remove(struct nd_prefix *pr) 937{ 938 INIT_VNET_INET6(curvnet); 939 struct nd_pfxrouter *pfr, *next; 940 int e, s; 941 char ip6buf[INET6_ADDRSTRLEN]; 942 943 /* make sure to invalidate the prefix until it is really freed. */ 944 pr->ndpr_vltime = 0; 945 pr->ndpr_pltime = 0; 946 947 /* 948 * Though these flags are now meaningless, we'd rather keep the value 949 * of pr->ndpr_raf_onlink and pr->ndpr_raf_auto not to confuse users 950 * when executing "ndp -p". 951 */ 952 953 if ((pr->ndpr_stateflags & NDPRF_ONLINK) != 0 && 954 (e = nd6_prefix_offlink(pr)) != 0) { 955 nd6log((LOG_ERR, "prelist_remove: failed to make %s/%d offlink " 956 "on %s, errno=%d\n", 957 ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr), 958 pr->ndpr_plen, if_name(pr->ndpr_ifp), e)); 959 /* what should we do? */ 960 } 961 962 if (pr->ndpr_refcnt > 0) 963 return; /* notice here? */ 964 965 s = splnet(); 966 967 /* unlink ndpr_entry from nd_prefix list */ 968 LIST_REMOVE(pr, ndpr_entry); 969 970 /* free list of routers that adversed the prefix */ 971 for (pfr = pr->ndpr_advrtrs.lh_first; pfr; pfr = next) { 972 next = pfr->pfr_next; 973 974 free(pfr, M_IP6NDP); 975 } 976 splx(s); 977 978 free(pr, M_IP6NDP); 979 980 pfxlist_onlink_check(); 981} 982 983/* 984 * dr - may be NULL 985 */ 986 987static int 988prelist_update(struct nd_prefixctl *new, struct nd_defrouter *dr, 989 struct mbuf *m, int mcast) 990{ 991 INIT_VNET_INET6(curvnet); 992 struct in6_ifaddr *ia6 = NULL, *ia6_match = NULL; 993 struct ifaddr *ifa; 994 struct ifnet *ifp = new->ndpr_ifp; 995 struct nd_prefix *pr; 996 int s = splnet(); 997 int error = 0; 998 int newprefix = 0; 999 int auth; 1000 struct in6_addrlifetime lt6_tmp; 1001 char ip6buf[INET6_ADDRSTRLEN]; 1002 1003 auth = 0; 1004 if (m) { 1005 /* 1006 * Authenticity for NA consists authentication for 1007 * both IP header and IP datagrams, doesn't it ? 1008 */ 1009#if defined(M_AUTHIPHDR) && defined(M_AUTHIPDGM) 1010 auth = ((m->m_flags & M_AUTHIPHDR) && 1011 (m->m_flags & M_AUTHIPDGM)); 1012#endif 1013 } 1014 1015 if ((pr = nd6_prefix_lookup(new)) != NULL) { 1016 /* 1017 * nd6_prefix_lookup() ensures that pr and new have the same 1018 * prefix on a same interface. 1019 */ 1020 1021 /* 1022 * Update prefix information. Note that the on-link (L) bit 1023 * and the autonomous (A) bit should NOT be changed from 1 1024 * to 0. 1025 */ 1026 if (new->ndpr_raf_onlink == 1) 1027 pr->ndpr_raf_onlink = 1; 1028 if (new->ndpr_raf_auto == 1) 1029 pr->ndpr_raf_auto = 1; 1030 if (new->ndpr_raf_onlink) { 1031 pr->ndpr_vltime = new->ndpr_vltime; 1032 pr->ndpr_pltime = new->ndpr_pltime; 1033 (void)in6_init_prefix_ltimes(pr); /* XXX error case? */ 1034 pr->ndpr_lastupdate = time_second; 1035 } 1036 1037 if (new->ndpr_raf_onlink && 1038 (pr->ndpr_stateflags & NDPRF_ONLINK) == 0) { 1039 int e; 1040 1041 if ((e = nd6_prefix_onlink(pr)) != 0) { 1042 nd6log((LOG_ERR, 1043 "prelist_update: failed to make " 1044 "the prefix %s/%d on-link on %s " 1045 "(errno=%d)\n", 1046 ip6_sprintf(ip6buf, 1047 &pr->ndpr_prefix.sin6_addr), 1048 pr->ndpr_plen, if_name(pr->ndpr_ifp), e)); 1049 /* proceed anyway. XXX: is it correct? */ 1050 } 1051 } 1052 1053 if (dr && pfxrtr_lookup(pr, dr) == NULL) 1054 pfxrtr_add(pr, dr); 1055 } else { 1056 struct nd_prefix *newpr = NULL; 1057 1058 newprefix = 1; 1059 1060 if (new->ndpr_vltime == 0) 1061 goto end; 1062 if (new->ndpr_raf_onlink == 0 && new->ndpr_raf_auto == 0) 1063 goto end; 1064 1065 error = nd6_prelist_add(new, dr, &newpr); 1066 if (error != 0 || newpr == NULL) { 1067 nd6log((LOG_NOTICE, "prelist_update: " 1068 "nd6_prelist_add failed for %s/%d on %s " 1069 "errno=%d, returnpr=%p\n", 1070 ip6_sprintf(ip6buf, &new->ndpr_prefix.sin6_addr), 1071 new->ndpr_plen, if_name(new->ndpr_ifp), 1072 error, newpr)); 1073 goto end; /* we should just give up in this case. */ 1074 } 1075 1076 /* 1077 * XXX: from the ND point of view, we can ignore a prefix 1078 * with the on-link bit being zero. However, we need a 1079 * prefix structure for references from autoconfigured 1080 * addresses. Thus, we explicitly make sure that the prefix 1081 * itself expires now. 1082 */ 1083 if (newpr->ndpr_raf_onlink == 0) { 1084 newpr->ndpr_vltime = 0; 1085 newpr->ndpr_pltime = 0; 1086 in6_init_prefix_ltimes(newpr); 1087 } 1088 1089 pr = newpr; 1090 } 1091 1092 /* 1093 * Address autoconfiguration based on Section 5.5.3 of RFC 2462. 1094 * Note that pr must be non NULL at this point. 1095 */ 1096 1097 /* 5.5.3 (a). Ignore the prefix without the A bit set. */ 1098 if (!new->ndpr_raf_auto) 1099 goto end; 1100 1101 /* 1102 * 5.5.3 (b). the link-local prefix should have been ignored in 1103 * nd6_ra_input. 1104 */ 1105 1106 /* 5.5.3 (c). Consistency check on lifetimes: pltime <= vltime. */ 1107 if (new->ndpr_pltime > new->ndpr_vltime) { 1108 error = EINVAL; /* XXX: won't be used */ 1109 goto end; 1110 } 1111 1112 /* 1113 * 5.5.3 (d). If the prefix advertised is not equal to the prefix of 1114 * an address configured by stateless autoconfiguration already in the 1115 * list of addresses associated with the interface, and the Valid 1116 * Lifetime is not 0, form an address. We first check if we have 1117 * a matching prefix. 1118 * Note: we apply a clarification in rfc2462bis-02 here. We only 1119 * consider autoconfigured addresses while RFC2462 simply said 1120 * "address". 1121 */ 1122 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 1123 struct in6_ifaddr *ifa6; 1124 u_int32_t remaininglifetime; 1125 1126 if (ifa->ifa_addr->sa_family != AF_INET6) 1127 continue; 1128 1129 ifa6 = (struct in6_ifaddr *)ifa; 1130 1131 /* 1132 * We only consider autoconfigured addresses as per rfc2462bis. 1133 */ 1134 if (!(ifa6->ia6_flags & IN6_IFF_AUTOCONF)) 1135 continue; 1136 1137 /* 1138 * Spec is not clear here, but I believe we should concentrate 1139 * on unicast (i.e. not anycast) addresses. 1140 * XXX: other ia6_flags? detached or duplicated? 1141 */ 1142 if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0) 1143 continue; 1144 1145 /* 1146 * Ignore the address if it is not associated with a prefix 1147 * or is associated with a prefix that is different from this 1148 * one. (pr is never NULL here) 1149 */ 1150 if (ifa6->ia6_ndpr != pr) 1151 continue; 1152 1153 if (ia6_match == NULL) /* remember the first one */ 1154 ia6_match = ifa6; 1155 1156 /* 1157 * An already autoconfigured address matched. Now that we 1158 * are sure there is at least one matched address, we can 1159 * proceed to 5.5.3. (e): update the lifetimes according to the 1160 * "two hours" rule and the privacy extension. 1161 * We apply some clarifications in rfc2462bis: 1162 * - use remaininglifetime instead of storedlifetime as a 1163 * variable name 1164 * - remove the dead code in the "two-hour" rule 1165 */ 1166#define TWOHOUR (120*60) 1167 lt6_tmp = ifa6->ia6_lifetime; 1168 1169 if (lt6_tmp.ia6t_vltime == ND6_INFINITE_LIFETIME) 1170 remaininglifetime = ND6_INFINITE_LIFETIME; 1171 else if (time_second - ifa6->ia6_updatetime > 1172 lt6_tmp.ia6t_vltime) { 1173 /* 1174 * The case of "invalid" address. We should usually 1175 * not see this case. 1176 */ 1177 remaininglifetime = 0; 1178 } else 1179 remaininglifetime = lt6_tmp.ia6t_vltime - 1180 (time_second - ifa6->ia6_updatetime); 1181 1182 /* when not updating, keep the current stored lifetime. */ 1183 lt6_tmp.ia6t_vltime = remaininglifetime; 1184 1185 if (TWOHOUR < new->ndpr_vltime || 1186 remaininglifetime < new->ndpr_vltime) { 1187 lt6_tmp.ia6t_vltime = new->ndpr_vltime; 1188 } else if (remaininglifetime <= TWOHOUR) { 1189 if (auth) { 1190 lt6_tmp.ia6t_vltime = new->ndpr_vltime; 1191 } 1192 } else { 1193 /* 1194 * new->ndpr_vltime <= TWOHOUR && 1195 * TWOHOUR < remaininglifetime 1196 */ 1197 lt6_tmp.ia6t_vltime = TWOHOUR; 1198 } 1199 1200 /* The 2 hour rule is not imposed for preferred lifetime. */ 1201 lt6_tmp.ia6t_pltime = new->ndpr_pltime; 1202 1203 in6_init_address_ltimes(pr, <6_tmp); 1204 1205 /* 1206 * We need to treat lifetimes for temporary addresses 1207 * differently, according to 1208 * draft-ietf-ipv6-privacy-addrs-v2-01.txt 3.3 (1); 1209 * we only update the lifetimes when they are in the maximum 1210 * intervals. 1211 */ 1212 if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0) { 1213 u_int32_t maxvltime, maxpltime; 1214 1215 if (V_ip6_temp_valid_lifetime > 1216 (u_int32_t)((time_second - ifa6->ia6_createtime) + 1217 V_ip6_desync_factor)) { 1218 maxvltime = V_ip6_temp_valid_lifetime - 1219 (time_second - ifa6->ia6_createtime) - 1220 V_ip6_desync_factor; 1221 } else 1222 maxvltime = 0; 1223 if (V_ip6_temp_preferred_lifetime > 1224 (u_int32_t)((time_second - ifa6->ia6_createtime) + 1225 V_ip6_desync_factor)) { 1226 maxpltime = V_ip6_temp_preferred_lifetime - 1227 (time_second - ifa6->ia6_createtime) - 1228 V_ip6_desync_factor; 1229 } else 1230 maxpltime = 0; 1231 1232 if (lt6_tmp.ia6t_vltime == ND6_INFINITE_LIFETIME || 1233 lt6_tmp.ia6t_vltime > maxvltime) { 1234 lt6_tmp.ia6t_vltime = maxvltime; 1235 } 1236 if (lt6_tmp.ia6t_pltime == ND6_INFINITE_LIFETIME || 1237 lt6_tmp.ia6t_pltime > maxpltime) { 1238 lt6_tmp.ia6t_pltime = maxpltime; 1239 } 1240 } 1241 ifa6->ia6_lifetime = lt6_tmp; 1242 ifa6->ia6_updatetime = time_second; 1243 } 1244 if (ia6_match == NULL && new->ndpr_vltime) { 1245 int ifidlen; 1246 1247 /* 1248 * 5.5.3 (d) (continued) 1249 * No address matched and the valid lifetime is non-zero. 1250 * Create a new address. 1251 */ 1252 1253 /* 1254 * Prefix Length check: 1255 * If the sum of the prefix length and interface identifier 1256 * length does not equal 128 bits, the Prefix Information 1257 * option MUST be ignored. The length of the interface 1258 * identifier is defined in a separate link-type specific 1259 * document. 1260 */ 1261 ifidlen = in6_if2idlen(ifp); 1262 if (ifidlen < 0) { 1263 /* this should not happen, so we always log it. */ 1264 log(LOG_ERR, "prelist_update: IFID undefined (%s)\n", 1265 if_name(ifp)); 1266 goto end; 1267 } 1268 if (ifidlen + pr->ndpr_plen != 128) { 1269 nd6log((LOG_INFO, 1270 "prelist_update: invalid prefixlen " 1271 "%d for %s, ignored\n", 1272 pr->ndpr_plen, if_name(ifp))); 1273 goto end; 1274 } 1275 1276 if ((ia6 = in6_ifadd(new, mcast)) != NULL) { 1277 /* 1278 * note that we should use pr (not new) for reference. 1279 */ 1280 pr->ndpr_refcnt++; 1281 ia6->ia6_ndpr = pr; 1282 1283 /* 1284 * RFC 3041 3.3 (2). 1285 * When a new public address is created as described 1286 * in RFC2462, also create a new temporary address. 1287 * 1288 * RFC 3041 3.5. 1289 * When an interface connects to a new link, a new 1290 * randomized interface identifier should be generated 1291 * immediately together with a new set of temporary 1292 * addresses. Thus, we specifiy 1 as the 2nd arg of 1293 * in6_tmpifadd(). 1294 */ 1295 if (V_ip6_use_tempaddr) { 1296 int e; 1297 if ((e = in6_tmpifadd(ia6, 1, 1)) != 0) { 1298 nd6log((LOG_NOTICE, "prelist_update: " 1299 "failed to create a temporary " 1300 "address, errno=%d\n", 1301 e)); 1302 } 1303 } 1304 1305 /* 1306 * A newly added address might affect the status 1307 * of other addresses, so we check and update it. 1308 * XXX: what if address duplication happens? 1309 */ 1310 pfxlist_onlink_check(); 1311 } else { 1312 /* just set an error. do not bark here. */ 1313 error = EADDRNOTAVAIL; /* XXX: might be unused. */ 1314 } 1315 } 1316 1317 end: 1318 splx(s); 1319 return error; 1320} 1321 1322/* 1323 * A supplement function used in the on-link detection below; 1324 * detect if a given prefix has a (probably) reachable advertising router. 1325 * XXX: lengthy function name... 1326 */ 1327static struct nd_pfxrouter * 1328find_pfxlist_reachable_router(struct nd_prefix *pr) 1329{ 1330 struct nd_pfxrouter *pfxrtr; 1331 struct llentry *ln; 1332 int canreach; 1333 1334 for (pfxrtr = LIST_FIRST(&pr->ndpr_advrtrs); pfxrtr != NULL; 1335 pfxrtr = LIST_NEXT(pfxrtr, pfr_entry)) { 1336 IF_AFDATA_LOCK(pfxrtr->router->ifp); 1337 ln = nd6_lookup(&pfxrtr->router->rtaddr, 0, pfxrtr->router->ifp); 1338 IF_AFDATA_UNLOCK(pfxrtr->router->ifp); 1339 if (ln == NULL) 1340 continue; 1341 canreach = ND6_IS_LLINFO_PROBREACH(ln); 1342 LLE_RUNLOCK(ln); 1343 if (canreach) 1344 break; 1345 } 1346 return (pfxrtr); 1347} 1348 1349/* 1350 * Check if each prefix in the prefix list has at least one available router 1351 * that advertised the prefix (a router is "available" if its neighbor cache 1352 * entry is reachable or probably reachable). 1353 * If the check fails, the prefix may be off-link, because, for example, 1354 * we have moved from the network but the lifetime of the prefix has not 1355 * expired yet. So we should not use the prefix if there is another prefix 1356 * that has an available router. 1357 * But, if there is no prefix that has an available router, we still regards 1358 * all the prefixes as on-link. This is because we can't tell if all the 1359 * routers are simply dead or if we really moved from the network and there 1360 * is no router around us. 1361 */ 1362void 1363pfxlist_onlink_check() 1364{ 1365 INIT_VNET_INET6(curvnet); 1366 struct nd_prefix *pr; 1367 struct in6_ifaddr *ifa; 1368 struct nd_defrouter *dr; 1369 struct nd_pfxrouter *pfxrtr = NULL; 1370 1371 /* 1372 * Check if there is a prefix that has a reachable advertising 1373 * router. 1374 */ 1375 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) { 1376 if (pr->ndpr_raf_onlink && find_pfxlist_reachable_router(pr)) 1377 break; 1378 } 1379 1380 /* 1381 * If we have no such prefix, check whether we still have a router 1382 * that does not advertise any prefixes. 1383 */ 1384 if (pr == NULL) { 1385 for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; 1386 dr = TAILQ_NEXT(dr, dr_entry)) { 1387 struct nd_prefix *pr0; 1388 1389 for (pr0 = V_nd_prefix.lh_first; pr0; 1390 pr0 = pr0->ndpr_next) { 1391 if ((pfxrtr = pfxrtr_lookup(pr0, dr)) != NULL) 1392 break; 1393 } 1394 if (pfxrtr != NULL) 1395 break; 1396 } 1397 } 1398 if (pr != NULL || (TAILQ_FIRST(&V_nd_defrouter) && pfxrtr == NULL)) { 1399 /* 1400 * There is at least one prefix that has a reachable router, 1401 * or at least a router which probably does not advertise 1402 * any prefixes. The latter would be the case when we move 1403 * to a new link where we have a router that does not provide 1404 * prefixes and we configure an address by hand. 1405 * Detach prefixes which have no reachable advertising 1406 * router, and attach other prefixes. 1407 */ 1408 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) { 1409 /* XXX: a link-local prefix should never be detached */ 1410 if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr)) 1411 continue; 1412 1413 /* 1414 * we aren't interested in prefixes without the L bit 1415 * set. 1416 */ 1417 if (pr->ndpr_raf_onlink == 0) 1418 continue; 1419 1420 if ((pr->ndpr_stateflags & NDPRF_DETACHED) == 0 && 1421 find_pfxlist_reachable_router(pr) == NULL) 1422 pr->ndpr_stateflags |= NDPRF_DETACHED; 1423 if ((pr->ndpr_stateflags & NDPRF_DETACHED) != 0 && 1424 find_pfxlist_reachable_router(pr) != 0) 1425 pr->ndpr_stateflags &= ~NDPRF_DETACHED; 1426 } 1427 } else { 1428 /* there is no prefix that has a reachable router */ 1429 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) { 1430 if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr)) 1431 continue; 1432 1433 if (pr->ndpr_raf_onlink == 0) 1434 continue; 1435 1436 if ((pr->ndpr_stateflags & NDPRF_DETACHED) != 0) 1437 pr->ndpr_stateflags &= ~NDPRF_DETACHED; 1438 } 1439 } 1440 1441 /* 1442 * Remove each interface route associated with a (just) detached 1443 * prefix, and reinstall the interface route for a (just) attached 1444 * prefix. Note that all attempt of reinstallation does not 1445 * necessarily success, when a same prefix is shared among multiple 1446 * interfaces. Such cases will be handled in nd6_prefix_onlink, 1447 * so we don't have to care about them. 1448 */ 1449 for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) { 1450 int e; 1451 char ip6buf[INET6_ADDRSTRLEN]; 1452 1453 if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr)) 1454 continue; 1455 1456 if (pr->ndpr_raf_onlink == 0) 1457 continue; 1458 1459 if ((pr->ndpr_stateflags & NDPRF_DETACHED) != 0 && 1460 (pr->ndpr_stateflags & NDPRF_ONLINK) != 0) { 1461 if ((e = nd6_prefix_offlink(pr)) != 0) { 1462 nd6log((LOG_ERR, 1463 "pfxlist_onlink_check: failed to " 1464 "make %s/%d offlink, errno=%d\n", 1465 ip6_sprintf(ip6buf, 1466 &pr->ndpr_prefix.sin6_addr), 1467 pr->ndpr_plen, e)); 1468 } 1469 } 1470 if ((pr->ndpr_stateflags & NDPRF_DETACHED) == 0 && 1471 (pr->ndpr_stateflags & NDPRF_ONLINK) == 0 && 1472 pr->ndpr_raf_onlink) { 1473 if ((e = nd6_prefix_onlink(pr)) != 0) { 1474 nd6log((LOG_ERR, 1475 "pfxlist_onlink_check: failed to " 1476 "make %s/%d onlink, errno=%d\n", 1477 ip6_sprintf(ip6buf, 1478 &pr->ndpr_prefix.sin6_addr), 1479 pr->ndpr_plen, e)); 1480 } 1481 } 1482 } 1483 1484 /* 1485 * Changes on the prefix status might affect address status as well. 1486 * Make sure that all addresses derived from an attached prefix are 1487 * attached, and that all addresses derived from a detached prefix are 1488 * detached. Note, however, that a manually configured address should 1489 * always be attached. 1490 * The precise detection logic is same as the one for prefixes. 1491 */ 1492 for (ifa = V_in6_ifaddr; ifa; ifa = ifa->ia_next) { 1493 if (!(ifa->ia6_flags & IN6_IFF_AUTOCONF)) 1494 continue; 1495 1496 if (ifa->ia6_ndpr == NULL) { 1497 /* 1498 * This can happen when we first configure the address 1499 * (i.e. the address exists, but the prefix does not). 1500 * XXX: complicated relationships... 1501 */ 1502 continue; 1503 } 1504 1505 if (find_pfxlist_reachable_router(ifa->ia6_ndpr)) 1506 break; 1507 } 1508 if (ifa) { 1509 for (ifa = V_in6_ifaddr; ifa; ifa = ifa->ia_next) { 1510 if ((ifa->ia6_flags & IN6_IFF_AUTOCONF) == 0) 1511 continue; 1512 1513 if (ifa->ia6_ndpr == NULL) /* XXX: see above. */ 1514 continue; 1515 1516 if (find_pfxlist_reachable_router(ifa->ia6_ndpr)) { 1517 if (ifa->ia6_flags & IN6_IFF_DETACHED) { 1518 ifa->ia6_flags &= ~IN6_IFF_DETACHED; 1519 ifa->ia6_flags |= IN6_IFF_TENTATIVE; 1520 nd6_dad_start((struct ifaddr *)ifa, 0); 1521 } 1522 } else { 1523 ifa->ia6_flags |= IN6_IFF_DETACHED; 1524 } 1525 } 1526 } 1527 else { 1528 for (ifa = V_in6_ifaddr; ifa; ifa = ifa->ia_next) { 1529 if ((ifa->ia6_flags & IN6_IFF_AUTOCONF) == 0) 1530 continue; 1531 1532 if (ifa->ia6_flags & IN6_IFF_DETACHED) { 1533 ifa->ia6_flags &= ~IN6_IFF_DETACHED; 1534 ifa->ia6_flags |= IN6_IFF_TENTATIVE; 1535 /* Do we need a delay in this case? */ 1536 nd6_dad_start((struct ifaddr *)ifa, 0); 1537 } 1538 } 1539 } 1540} 1541 1542int 1543nd6_prefix_onlink(struct nd_prefix *pr) 1544{ 1545 INIT_VNET_INET6(curvnet); 1546 struct ifaddr *ifa; 1547 struct ifnet *ifp = pr->ndpr_ifp; 1548 struct sockaddr_in6 mask6; 1549 struct nd_prefix *opr; 1550 u_long rtflags; 1551 int error = 0; 1552 struct radix_node_head *rnh; 1553 struct rtentry *rt = NULL; 1554 char ip6buf[INET6_ADDRSTRLEN]; 1555 struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK}; 1556 1557 1558 log(LOG_DEBUG, "##1 nd6_prefix_onlink: %s, vltime = %x, pltime = %x\n", 1559 ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr), 1560 pr->ndpr_vltime, pr->ndpr_pltime); 1561 1562 1563 /* sanity check */ 1564 if ((pr->ndpr_stateflags & NDPRF_ONLINK) != 0) { 1565 nd6log((LOG_ERR, 1566 "nd6_prefix_onlink: %s/%d is already on-link\n", 1567 ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr), 1568 pr->ndpr_plen)); 1569 return (EEXIST); 1570 } 1571 1572 /* 1573 * Add the interface route associated with the prefix. Before 1574 * installing the route, check if there's the same prefix on another 1575 * interface, and the prefix has already installed the interface route. 1576 * Although such a configuration is expected to be rare, we explicitly 1577 * allow it. 1578 */ 1579 for (opr = V_nd_prefix.lh_first; opr; opr = opr->ndpr_next) { 1580 if (opr == pr) 1581 continue; 1582 1583 if ((opr->ndpr_stateflags & NDPRF_ONLINK) == 0) 1584 continue; 1585 1586 if (opr->ndpr_plen == pr->ndpr_plen && 1587 in6_are_prefix_equal(&pr->ndpr_prefix.sin6_addr, 1588 &opr->ndpr_prefix.sin6_addr, pr->ndpr_plen)) 1589 return (0); 1590 } 1591 1592 /* 1593 * We prefer link-local addresses as the associated interface address. 1594 */ 1595 /* search for a link-local addr */ 1596 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 1597 IN6_IFF_NOTREADY | IN6_IFF_ANYCAST); 1598 if (ifa == NULL) { 1599 /* XXX: freebsd does not have ifa_ifwithaf */ 1600 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 1601 if (ifa->ifa_addr->sa_family == AF_INET6) 1602 break; 1603 } 1604 /* should we care about ia6_flags? */ 1605 } 1606 if (ifa == NULL) { 1607 /* 1608 * This can still happen, when, for example, we receive an RA 1609 * containing a prefix with the L bit set and the A bit clear, 1610 * after removing all IPv6 addresses on the receiving 1611 * interface. This should, of course, be rare though. 1612 */ 1613 nd6log((LOG_NOTICE, 1614 "nd6_prefix_onlink: failed to find any ifaddr" 1615 " to add route for a prefix(%s/%d) on %s\n", 1616 ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr), 1617 pr->ndpr_plen, if_name(ifp))); 1618 return (0); 1619 } 1620 1621 /* 1622 * in6_ifinit() sets nd6_rtrequest to ifa_rtrequest for all ifaddrs. 1623 * ifa->ifa_rtrequest = nd6_rtrequest; 1624 */ 1625 bzero(&mask6, sizeof(mask6)); 1626 mask6.sin6_len = sizeof(mask6); 1627 mask6.sin6_addr = pr->ndpr_mask; 1628 rtflags = ifa->ifa_flags | RTF_UP; 1629 error = rtrequest(RTM_ADD, (struct sockaddr *)&pr->ndpr_prefix, 1630 ifa->ifa_addr, (struct sockaddr *)&mask6, rtflags, &rt); 1631 1632 log(LOG_DEBUG, "##2 nd6_prefix_onlink: %s, vltime = %x, pltime = %x\n", 1633 ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr), 1634 pr->ndpr_vltime, pr->ndpr_pltime); 1635 1636 1637 if (error == 0) { 1638 if (rt != NULL) /* this should be non NULL, though */ { 1639 rnh = V_rt_tables[rt->rt_fibnum][AF_INET6]; 1640 RADIX_NODE_HEAD_LOCK(rnh); 1641 RT_LOCK(rt); 1642 if (!rt_setgate(rt, rt_key(rt), (struct sockaddr *)&null_sdl)) { 1643 ((struct sockaddr_dl *)rt->rt_gateway)->sdl_type = 1644 rt->rt_ifp->if_type; 1645 ((struct sockaddr_dl *)rt->rt_gateway)->sdl_index = 1646 rt->rt_ifp->if_index; 1647 } 1648 RADIX_NODE_HEAD_UNLOCK(rnh); 1649 nd6_rtmsg(RTM_ADD, rt); 1650 RT_UNLOCK(rt); 1651 } 1652 pr->ndpr_stateflags |= NDPRF_ONLINK; 1653 } else { 1654 char ip6bufg[INET6_ADDRSTRLEN], ip6bufm[INET6_ADDRSTRLEN]; 1655 nd6log((LOG_ERR, "nd6_prefix_onlink: failed to add route for a" 1656 " prefix (%s/%d) on %s, gw=%s, mask=%s, flags=%lx " 1657 "errno = %d\n", 1658 ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr), 1659 pr->ndpr_plen, if_name(ifp), 1660 ip6_sprintf(ip6bufg, &((struct sockaddr_in6 *)ifa->ifa_addr)->sin6_addr), 1661 ip6_sprintf(ip6bufm, &mask6.sin6_addr), rtflags, error)); 1662 } 1663 1664 if (rt != NULL) { 1665 RT_LOCK(rt); 1666 RT_REMREF(rt); 1667 RT_UNLOCK(rt); 1668 } 1669 1670 return (error); 1671} 1672 1673int 1674nd6_prefix_offlink(struct nd_prefix *pr) 1675{ 1676 INIT_VNET_INET6(curvnet); 1677 int error = 0; 1678 struct ifnet *ifp = pr->ndpr_ifp; 1679 struct nd_prefix *opr; 1680 struct sockaddr_in6 sa6, mask6; 1681 struct rtentry *rt = NULL; 1682 char ip6buf[INET6_ADDRSTRLEN]; 1683 1684 /* sanity check */ 1685 if ((pr->ndpr_stateflags & NDPRF_ONLINK) == 0) { 1686 nd6log((LOG_ERR, 1687 "nd6_prefix_offlink: %s/%d is already off-link\n", 1688 ip6_sprintf(ip6buf, &pr->ndpr_prefix.sin6_addr), 1689 pr->ndpr_plen)); 1690 return (EEXIST); 1691 } 1692 1693 bzero(&sa6, sizeof(sa6)); 1694 sa6.sin6_family = AF_INET6; 1695 sa6.sin6_len = sizeof(sa6); 1696 bcopy(&pr->ndpr_prefix.sin6_addr, &sa6.sin6_addr, 1697 sizeof(struct in6_addr)); 1698 bzero(&mask6, sizeof(mask6)); 1699 mask6.sin6_family = AF_INET6; 1700 mask6.sin6_len = sizeof(sa6); 1701 bcopy(&pr->ndpr_mask, &mask6.sin6_addr, sizeof(struct in6_addr)); 1702 error = rtrequest(RTM_DELETE, (struct sockaddr *)&sa6, NULL, 1703 (struct sockaddr *)&mask6, 0, &rt); 1704 if (error == 0) { 1705 pr->ndpr_stateflags &= ~NDPRF_ONLINK; 1706 1707 /* report the route deletion to the routing socket. */ 1708 if (rt != NULL) 1709 nd6_rtmsg(RTM_DELETE, rt); 1710 1711 /* 1712 * There might be the same prefix on another interface, 1713 * the prefix which could not be on-link just because we have 1714 * the interface route (see comments in nd6_prefix_onlink). 1715 * If there's one, try to make the prefix on-link on the 1716 * interface. 1717 */ 1718 for (opr = V_nd_prefix.lh_first; opr; opr = opr->ndpr_next) { 1719 if (opr == pr) 1720 continue; 1721 1722 if ((opr->ndpr_stateflags & NDPRF_ONLINK) != 0) 1723 continue; 1724 1725 /* 1726 * KAME specific: detached prefixes should not be 1727 * on-link. 1728 */ 1729 if ((opr->ndpr_stateflags & NDPRF_DETACHED) != 0) 1730 continue; 1731 1732 if (opr->ndpr_plen == pr->ndpr_plen && 1733 in6_are_prefix_equal(&pr->ndpr_prefix.sin6_addr, 1734 &opr->ndpr_prefix.sin6_addr, pr->ndpr_plen)) { 1735 int e; 1736 1737 if ((e = nd6_prefix_onlink(opr)) != 0) { 1738 nd6log((LOG_ERR, 1739 "nd6_prefix_offlink: failed to " 1740 "recover a prefix %s/%d from %s " 1741 "to %s (errno = %d)\n", 1742 ip6_sprintf(ip6buf, 1743 &opr->ndpr_prefix.sin6_addr), 1744 opr->ndpr_plen, if_name(ifp), 1745 if_name(opr->ndpr_ifp), e)); 1746 } 1747 } 1748 } 1749 } else { 1750 /* XXX: can we still set the NDPRF_ONLINK flag? */ 1751 nd6log((LOG_ERR, 1752 "nd6_prefix_offlink: failed to delete route: " 1753 "%s/%d on %s (errno = %d)\n", 1754 ip6_sprintf(ip6buf, &sa6.sin6_addr), pr->ndpr_plen, 1755 if_name(ifp), error)); 1756 } 1757 1758 if (rt != NULL) { 1759 RTFREE(rt); 1760 } 1761 1762 return (error); 1763} 1764 1765static struct in6_ifaddr * 1766in6_ifadd(struct nd_prefixctl *pr, int mcast) 1767{ 1768 INIT_VNET_INET6(curvnet); 1769 struct ifnet *ifp = pr->ndpr_ifp; 1770 struct ifaddr *ifa; 1771 struct in6_aliasreq ifra; 1772 struct in6_ifaddr *ia, *ib; 1773 int error, plen0; 1774 struct in6_addr mask; 1775 int prefixlen = pr->ndpr_plen; 1776 int updateflags; 1777 char ip6buf[INET6_ADDRSTRLEN]; 1778 1779 in6_prefixlen2mask(&mask, prefixlen); 1780 1781 /* 1782 * find a link-local address (will be interface ID). 1783 * Is it really mandatory? Theoretically, a global or a site-local 1784 * address can be configured without a link-local address, if we 1785 * have a unique interface identifier... 1786 * 1787 * it is not mandatory to have a link-local address, we can generate 1788 * interface identifier on the fly. we do this because: 1789 * (1) it should be the easiest way to find interface identifier. 1790 * (2) RFC2462 5.4 suggesting the use of the same interface identifier 1791 * for multiple addresses on a single interface, and possible shortcut 1792 * of DAD. we omitted DAD for this reason in the past. 1793 * (3) a user can prevent autoconfiguration of global address 1794 * by removing link-local address by hand (this is partly because we 1795 * don't have other way to control the use of IPv6 on an interface. 1796 * this has been our design choice - cf. NRL's "ifconfig auto"). 1797 * (4) it is easier to manage when an interface has addresses 1798 * with the same interface identifier, than to have multiple addresses 1799 * with different interface identifiers. 1800 */ 1801 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(ifp, 0); /* 0 is OK? */ 1802 if (ifa) 1803 ib = (struct in6_ifaddr *)ifa; 1804 else 1805 return NULL; 1806 1807 /* prefixlen + ifidlen must be equal to 128 */ 1808 plen0 = in6_mask2len(&ib->ia_prefixmask.sin6_addr, NULL); 1809 if (prefixlen != plen0) { 1810 nd6log((LOG_INFO, "in6_ifadd: wrong prefixlen for %s " 1811 "(prefix=%d ifid=%d)\n", 1812 if_name(ifp), prefixlen, 128 - plen0)); 1813 return NULL; 1814 } 1815 1816 /* make ifaddr */ 1817 1818 bzero(&ifra, sizeof(ifra)); 1819 /* 1820 * in6_update_ifa() does not use ifra_name, but we accurately set it 1821 * for safety. 1822 */ 1823 strncpy(ifra.ifra_name, if_name(ifp), sizeof(ifra.ifra_name)); 1824 ifra.ifra_addr.sin6_family = AF_INET6; 1825 ifra.ifra_addr.sin6_len = sizeof(struct sockaddr_in6); 1826 /* prefix */ 1827 ifra.ifra_addr.sin6_addr = pr->ndpr_prefix.sin6_addr; 1828 ifra.ifra_addr.sin6_addr.s6_addr32[0] &= mask.s6_addr32[0]; 1829 ifra.ifra_addr.sin6_addr.s6_addr32[1] &= mask.s6_addr32[1]; 1830 ifra.ifra_addr.sin6_addr.s6_addr32[2] &= mask.s6_addr32[2]; 1831 ifra.ifra_addr.sin6_addr.s6_addr32[3] &= mask.s6_addr32[3]; 1832 1833 /* interface ID */ 1834 ifra.ifra_addr.sin6_addr.s6_addr32[0] |= 1835 (ib->ia_addr.sin6_addr.s6_addr32[0] & ~mask.s6_addr32[0]); 1836 ifra.ifra_addr.sin6_addr.s6_addr32[1] |= 1837 (ib->ia_addr.sin6_addr.s6_addr32[1] & ~mask.s6_addr32[1]); 1838 ifra.ifra_addr.sin6_addr.s6_addr32[2] |= 1839 (ib->ia_addr.sin6_addr.s6_addr32[2] & ~mask.s6_addr32[2]); 1840 ifra.ifra_addr.sin6_addr.s6_addr32[3] |= 1841 (ib->ia_addr.sin6_addr.s6_addr32[3] & ~mask.s6_addr32[3]); 1842 1843 /* new prefix mask. */ 1844 ifra.ifra_prefixmask.sin6_len = sizeof(struct sockaddr_in6); 1845 ifra.ifra_prefixmask.sin6_family = AF_INET6; 1846 bcopy(&mask, &ifra.ifra_prefixmask.sin6_addr, 1847 sizeof(ifra.ifra_prefixmask.sin6_addr)); 1848 1849 /* lifetimes. */ 1850 ifra.ifra_lifetime.ia6t_vltime = pr->ndpr_vltime; 1851 ifra.ifra_lifetime.ia6t_pltime = pr->ndpr_pltime; 1852 1853 /* XXX: scope zone ID? */ 1854 1855 ifra.ifra_flags |= IN6_IFF_AUTOCONF; /* obey autoconf */ 1856 1857 /* 1858 * Make sure that we do not have this address already. This should 1859 * usually not happen, but we can still see this case, e.g., if we 1860 * have manually configured the exact address to be configured. 1861 */ 1862 if (in6ifa_ifpwithaddr(ifp, &ifra.ifra_addr.sin6_addr) != NULL) { 1863 /* this should be rare enough to make an explicit log */ 1864 log(LOG_INFO, "in6_ifadd: %s is already configured\n", 1865 ip6_sprintf(ip6buf, &ifra.ifra_addr.sin6_addr)); 1866 return (NULL); 1867 } 1868 1869 /* 1870 * Allocate ifaddr structure, link into chain, etc. 1871 * If we are going to create a new address upon receiving a multicasted 1872 * RA, we need to impose a random delay before starting DAD. 1873 * [draft-ietf-ipv6-rfc2462bis-02.txt, Section 5.4.2] 1874 */ 1875 updateflags = 0; 1876 if (mcast) 1877 updateflags |= IN6_IFAUPDATE_DADDELAY; 1878 if ((error = in6_update_ifa(ifp, &ifra, NULL, updateflags)) != 0) { 1879 nd6log((LOG_ERR, 1880 "in6_ifadd: failed to make ifaddr %s on %s (errno=%d)\n", 1881 ip6_sprintf(ip6buf, &ifra.ifra_addr.sin6_addr), 1882 if_name(ifp), error)); 1883 return (NULL); /* ifaddr must not have been allocated. */ 1884 } 1885 1886 ia = in6ifa_ifpwithaddr(ifp, &ifra.ifra_addr.sin6_addr); 1887 1888 return (ia); /* this is always non-NULL */ 1889} 1890 1891/* 1892 * ia0 - corresponding public address 1893 */ 1894int 1895in6_tmpifadd(const struct in6_ifaddr *ia0, int forcegen, int delay) 1896{ 1897 INIT_VNET_INET6(curvnet); 1898 struct ifnet *ifp = ia0->ia_ifa.ifa_ifp; 1899 struct in6_ifaddr *newia, *ia; 1900 struct in6_aliasreq ifra; 1901 int i, error; 1902 int trylimit = 3; /* XXX: adhoc value */ 1903 int updateflags; 1904 u_int32_t randid[2]; 1905 time_t vltime0, pltime0; 1906 1907 bzero(&ifra, sizeof(ifra)); 1908 strncpy(ifra.ifra_name, if_name(ifp), sizeof(ifra.ifra_name)); 1909 ifra.ifra_addr = ia0->ia_addr; 1910 /* copy prefix mask */ 1911 ifra.ifra_prefixmask = ia0->ia_prefixmask; 1912 /* clear the old IFID */ 1913 for (i = 0; i < 4; i++) { 1914 ifra.ifra_addr.sin6_addr.s6_addr32[i] &= 1915 ifra.ifra_prefixmask.sin6_addr.s6_addr32[i]; 1916 } 1917 1918 again: 1919 if (in6_get_tmpifid(ifp, (u_int8_t *)randid, 1920 (const u_int8_t *)&ia0->ia_addr.sin6_addr.s6_addr[8], forcegen)) { 1921 nd6log((LOG_NOTICE, "in6_tmpifadd: failed to find a good " 1922 "random IFID\n")); 1923 return (EINVAL); 1924 } 1925 ifra.ifra_addr.sin6_addr.s6_addr32[2] |= 1926 (randid[0] & ~(ifra.ifra_prefixmask.sin6_addr.s6_addr32[2])); 1927 ifra.ifra_addr.sin6_addr.s6_addr32[3] |= 1928 (randid[1] & ~(ifra.ifra_prefixmask.sin6_addr.s6_addr32[3])); 1929 1930 /* 1931 * in6_get_tmpifid() quite likely provided a unique interface ID. 1932 * However, we may still have a chance to see collision, because 1933 * there may be a time lag between generation of the ID and generation 1934 * of the address. So, we'll do one more sanity check. 1935 */ 1936 for (ia = V_in6_ifaddr; ia; ia = ia->ia_next) { 1937 if (IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, 1938 &ifra.ifra_addr.sin6_addr)) { 1939 if (trylimit-- == 0) { 1940 /* 1941 * Give up. Something strange should have 1942 * happened. 1943 */ 1944 nd6log((LOG_NOTICE, "in6_tmpifadd: failed to " 1945 "find a unique random IFID\n")); 1946 return (EEXIST); 1947 } 1948 forcegen = 1; 1949 goto again; 1950 } 1951 } 1952 1953 /* 1954 * The Valid Lifetime is the lower of the Valid Lifetime of the 1955 * public address or TEMP_VALID_LIFETIME. 1956 * The Preferred Lifetime is the lower of the Preferred Lifetime 1957 * of the public address or TEMP_PREFERRED_LIFETIME - 1958 * DESYNC_FACTOR. 1959 */ 1960 if (ia0->ia6_lifetime.ia6t_vltime != ND6_INFINITE_LIFETIME) { 1961 vltime0 = IFA6_IS_INVALID(ia0) ? 0 : 1962 (ia0->ia6_lifetime.ia6t_vltime - 1963 (time_second - ia0->ia6_updatetime)); 1964 if (vltime0 > V_ip6_temp_valid_lifetime) 1965 vltime0 = V_ip6_temp_valid_lifetime; 1966 } else 1967 vltime0 = V_ip6_temp_valid_lifetime; 1968 if (ia0->ia6_lifetime.ia6t_pltime != ND6_INFINITE_LIFETIME) { 1969 pltime0 = IFA6_IS_DEPRECATED(ia0) ? 0 : 1970 (ia0->ia6_lifetime.ia6t_pltime - 1971 (time_second - ia0->ia6_updatetime)); 1972 if (pltime0 > V_ip6_temp_preferred_lifetime - V_ip6_desync_factor){ 1973 pltime0 = V_ip6_temp_preferred_lifetime - 1974 V_ip6_desync_factor; 1975 } 1976 } else 1977 pltime0 = V_ip6_temp_preferred_lifetime - V_ip6_desync_factor; 1978 ifra.ifra_lifetime.ia6t_vltime = vltime0; 1979 ifra.ifra_lifetime.ia6t_pltime = pltime0; 1980 1981 /* 1982 * A temporary address is created only if this calculated Preferred 1983 * Lifetime is greater than REGEN_ADVANCE time units. 1984 */ 1985 if (ifra.ifra_lifetime.ia6t_pltime <= V_ip6_temp_regen_advance) 1986 return (0); 1987 1988 /* XXX: scope zone ID? */ 1989 1990 ifra.ifra_flags |= (IN6_IFF_AUTOCONF|IN6_IFF_TEMPORARY); 1991 1992 /* allocate ifaddr structure, link into chain, etc. */ 1993 updateflags = 0; 1994 if (delay) 1995 updateflags |= IN6_IFAUPDATE_DADDELAY; 1996 if ((error = in6_update_ifa(ifp, &ifra, NULL, updateflags)) != 0) 1997 return (error); 1998 1999 newia = in6ifa_ifpwithaddr(ifp, &ifra.ifra_addr.sin6_addr); 2000 if (newia == NULL) { /* XXX: can it happen? */ 2001 nd6log((LOG_ERR, 2002 "in6_tmpifadd: ifa update succeeded, but we got " 2003 "no ifaddr\n")); 2004 return (EINVAL); /* XXX */ 2005 } 2006 newia->ia6_ndpr = ia0->ia6_ndpr; 2007 newia->ia6_ndpr->ndpr_refcnt++; 2008 2009 /* 2010 * A newly added address might affect the status of other addresses. 2011 * XXX: when the temporary address is generated with a new public 2012 * address, the onlink check is redundant. However, it would be safe 2013 * to do the check explicitly everywhere a new address is generated, 2014 * and, in fact, we surely need the check when we create a new 2015 * temporary address due to deprecation of an old temporary address. 2016 */ 2017 pfxlist_onlink_check(); 2018 2019 return (0); 2020} 2021 2022static int 2023in6_init_prefix_ltimes(struct nd_prefix *ndpr) 2024{ 2025 if (ndpr->ndpr_pltime == ND6_INFINITE_LIFETIME) 2026 ndpr->ndpr_preferred = 0; 2027 else 2028 ndpr->ndpr_preferred = time_second + ndpr->ndpr_pltime; 2029 if (ndpr->ndpr_vltime == ND6_INFINITE_LIFETIME) 2030 ndpr->ndpr_expire = 0; 2031 else 2032 ndpr->ndpr_expire = time_second + ndpr->ndpr_vltime; 2033 2034 return 0; 2035} 2036 2037static void 2038in6_init_address_ltimes(struct nd_prefix *new, struct in6_addrlifetime *lt6) 2039{ 2040 /* init ia6t_expire */ 2041 if (lt6->ia6t_vltime == ND6_INFINITE_LIFETIME) 2042 lt6->ia6t_expire = 0; 2043 else { 2044 lt6->ia6t_expire = time_second; 2045 lt6->ia6t_expire += lt6->ia6t_vltime; 2046 } 2047 2048 /* init ia6t_preferred */ 2049 if (lt6->ia6t_pltime == ND6_INFINITE_LIFETIME) 2050 lt6->ia6t_preferred = 0; 2051 else { 2052 lt6->ia6t_preferred = time_second; 2053 lt6->ia6t_preferred += lt6->ia6t_pltime; 2054 } 2055} 2056 2057/* 2058 * Delete all the routing table entries that use the specified gateway. 2059 * XXX: this function causes search through all entries of routing table, so 2060 * it shouldn't be called when acting as a router. 2061 */ 2062void 2063rt6_flush(struct in6_addr *gateway, struct ifnet *ifp) 2064{ 2065 INIT_VNET_NET(curvnet); 2066 struct radix_node_head *rnh = V_rt_tables[0][AF_INET6]; 2067 int s = splnet(); 2068 2069 /* We'll care only link-local addresses */ 2070 if (!IN6_IS_ADDR_LINKLOCAL(gateway)) { 2071 splx(s); 2072 return; 2073 } 2074 2075 RADIX_NODE_HEAD_LOCK(rnh); 2076 rnh->rnh_walktree(rnh, rt6_deleteroute, (void *)gateway); 2077 RADIX_NODE_HEAD_UNLOCK(rnh); 2078 splx(s); 2079} 2080 2081static int 2082rt6_deleteroute(struct radix_node *rn, void *arg) 2083{ 2084#define SIN6(s) ((struct sockaddr_in6 *)s) 2085 struct rtentry *rt = (struct rtentry *)rn; 2086 struct in6_addr *gate = (struct in6_addr *)arg; 2087 2088 if (rt->rt_gateway == NULL || rt->rt_gateway->sa_family != AF_INET6) 2089 return (0); 2090 2091 if (!IN6_ARE_ADDR_EQUAL(gate, &SIN6(rt->rt_gateway)->sin6_addr)) { 2092 return (0); 2093 } 2094 2095 /* 2096 * Do not delete a static route. 2097 * XXX: this seems to be a bit ad-hoc. Should we consider the 2098 * 'cloned' bit instead? 2099 */ 2100 if ((rt->rt_flags & RTF_STATIC) != 0) 2101 return (0); 2102 2103 /* 2104 * We delete only host route. This means, in particular, we don't 2105 * delete default route. 2106 */ 2107 if ((rt->rt_flags & RTF_HOST) == 0) 2108 return (0); 2109 2110 return (rtrequest(RTM_DELETE, rt_key(rt), rt->rt_gateway, 2111 rt_mask(rt), rt->rt_flags, 0)); 2112#undef SIN6 2113} 2114 2115int 2116nd6_setdefaultiface(int ifindex) 2117{ 2118 INIT_VNET_NET(curvnet); 2119 INIT_VNET_INET6(curvnet); 2120 int error = 0; 2121 2122 if (ifindex < 0 || V_if_index < ifindex) 2123 return (EINVAL); 2124 if (ifindex != 0 && !ifnet_byindex(ifindex)) 2125 return (EINVAL); 2126 2127 if (V_nd6_defifindex != ifindex) { 2128 V_nd6_defifindex = ifindex; 2129 if (V_nd6_defifindex > 0) 2130 V_nd6_defifp = ifnet_byindex(V_nd6_defifindex); 2131 else 2132 V_nd6_defifp = NULL; 2133 2134 /* 2135 * Our current implementation assumes one-to-one maping between 2136 * interfaces and links, so it would be natural to use the 2137 * default interface as the default link. 2138 */ 2139 scope6_setdefault(V_nd6_defifp); 2140 } 2141 2142 return (error); 2143} 2144