1 /* $NetBSD: nd6.c,v 1.105 2006/10/12 01:32:39 christos Exp $ */ 2 /* $KAME: nd6.c,v 1.279 2002/06/08 11:16:51 itojun Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.105 2006/10/12 01:32:39 christos Exp $"); 35 36 #include "opt_ipsec.h" 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/callout.h> 41 #include <sys/malloc.h> 42 #include <sys/mbuf.h> 43 #include <sys/socket.h> 44 #include <sys/sockio.h> 45 #include <sys/time.h> 46 #include <sys/kernel.h> 47 #include <sys/protosw.h> 48 #include <sys/errno.h> 49 #include <sys/ioctl.h> 50 #include <sys/syslog.h> 51 #include <sys/queue.h> 52 53 #include <net/if.h> 54 #include <net/if_dl.h> 55 #include <net/if_types.h> 56 #include <net/route.h> 57 #include <net/if_ether.h> 58 #include <net/if_fddi.h> 59 #include <net/if_arc.h> 60 61 #include <netinet/in.h> 62 #include <netinet6/in6_var.h> 63 #include <netinet/ip6.h> 64 #include <netinet6/ip6_var.h> 65 #include <netinet6/scope6_var.h> 66 #include <netinet6/nd6.h> 67 #include <netinet/icmp6.h> 68 69 #ifdef IPSEC 70 #include <netinet6/ipsec.h> 71 #endif 72 73 #include <net/net_osdep.h> 74 75 #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */ 76 #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */ 77 78 #define SIN6(s) ((struct sockaddr_in6 *)s) 79 #define SDL(s) ((struct sockaddr_dl *)s) 80 81 /* timer values */ 82 int nd6_prune = 1; /* walk list every 1 seconds */ 83 int nd6_delay = 5; /* delay first probe time 5 second */ 84 int nd6_umaxtries = 3; /* maximum unicast query */ 85 int nd6_mmaxtries = 3; /* maximum multicast query */ 86 int nd6_useloopback = 1; /* use loopback interface for local traffic */ 87 int nd6_gctimer = (60 * 60 * 24); /* 1 day: garbage collection timer */ 88 89 /* preventing too many loops in ND option parsing */ 90 int nd6_maxndopt = 10; /* max # of ND options allowed */ 91 92 int nd6_maxnudhint = 0; /* max # of subsequent upper layer hints */ 93 94 int nd6_maxqueuelen = 1; /* max # of packets cached in unresolved ND entries */ 95 96 #ifdef ND6_DEBUG 97 int nd6_debug = 1; 98 #else 99 int nd6_debug = 0; 100 #endif 101 102 /* for debugging? */ 103 static int nd6_inuse, nd6_allocated; 104 105 struct llinfo_nd6 llinfo_nd6 = { 106 .ln_prev = &llinfo_nd6, 107 .ln_next = &llinfo_nd6, 108 }; 109 struct nd_drhead nd_defrouter; 110 struct nd_prhead nd_prefix = { 0 }; 111 112 int nd6_recalc_reachtm_interval = ND6_RECALC_REACHTM_INTERVAL; 113 static struct sockaddr_in6 all1_sa; 114 115 static void nd6_setmtu0 __P((struct ifnet *, struct nd_ifinfo *)); 116 static void nd6_slowtimo __P((void *)); 117 static int regen_tmpaddr __P((struct in6_ifaddr *)); 118 static struct llinfo_nd6 *nd6_free __P((struct rtentry *, int)); 119 static void nd6_llinfo_timer __P((void *)); 120 static void clear_llinfo_pqueue __P((struct llinfo_nd6 *)); 121 122 struct callout nd6_slowtimo_ch = CALLOUT_INITIALIZER; 123 struct callout nd6_timer_ch = CALLOUT_INITIALIZER; 124 extern struct callout in6_tmpaddrtimer_ch; 125 126 static int fill_drlist __P((void *, size_t *, size_t)); 127 static int fill_prlist __P((void *, size_t *, size_t)); 128 129 MALLOC_DEFINE(M_IP6NDP, "NDP", "IPv6 Neighbour Discovery"); 130 131 void 132 nd6_init() 133 { 134 static int nd6_init_done = 0; 135 int i; 136 137 if (nd6_init_done) { 138 log(LOG_NOTICE, "nd6_init called more than once(ignored)\n"); 139 return; 140 } 141 142 all1_sa.sin6_family = AF_INET6; 143 all1_sa.sin6_len = sizeof(struct sockaddr_in6); 144 for (i = 0; i < sizeof(all1_sa.sin6_addr); i++) 145 all1_sa.sin6_addr.s6_addr[i] = 0xff; 146 147 /* initialization of the default router list */ 148 TAILQ_INIT(&nd_defrouter); 149 150 nd6_init_done = 1; 151 152 /* start timer */ 153 callout_reset(&nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz, 154 nd6_slowtimo, NULL); 155 } 156 157 struct nd_ifinfo * 158 nd6_ifattach(ifp) 159 struct ifnet *ifp; 160 { 161 struct nd_ifinfo *nd; 162 163 nd = (struct nd_ifinfo *)malloc(sizeof(*nd), M_IP6NDP, M_WAITOK); 164 bzero(nd, sizeof(*nd)); 165 166 nd->initialized = 1; 167 168 nd->chlim = IPV6_DEFHLIM; 169 nd->basereachable = REACHABLE_TIME; 170 nd->reachable = ND_COMPUTE_RTIME(nd->basereachable); 171 nd->retrans = RETRANS_TIMER; 172 /* 173 * Note that the default value of ip6_accept_rtadv is 0, which means 174 * we won't accept RAs by default even if we set ND6_IFF_ACCEPT_RTADV 175 * here. 176 */ 177 nd->flags = (ND6_IFF_PERFORMNUD | ND6_IFF_ACCEPT_RTADV); 178 179 /* XXX: we cannot call nd6_setmtu since ifp is not fully initialized */ 180 nd6_setmtu0(ifp, nd); 181 182 return nd; 183 } 184 185 void 186 nd6_ifdetach(nd) 187 struct nd_ifinfo *nd; 188 { 189 190 free(nd, M_IP6NDP); 191 } 192 193 void 194 nd6_setmtu(ifp) 195 struct ifnet *ifp; 196 { 197 nd6_setmtu0(ifp, ND_IFINFO(ifp)); 198 } 199 200 void 201 nd6_setmtu0(ifp, ndi) 202 struct ifnet *ifp; 203 struct nd_ifinfo *ndi; 204 { 205 u_int32_t omaxmtu; 206 207 omaxmtu = ndi->maxmtu; 208 209 switch (ifp->if_type) { 210 case IFT_ARCNET: 211 ndi->maxmtu = MIN(ARC_PHDS_MAXMTU, ifp->if_mtu); /* RFC2497 */ 212 break; 213 case IFT_FDDI: 214 ndi->maxmtu = MIN(FDDIIPMTU, ifp->if_mtu); 215 break; 216 default: 217 ndi->maxmtu = ifp->if_mtu; 218 break; 219 } 220 221 /* 222 * Decreasing the interface MTU under IPV6 minimum MTU may cause 223 * undesirable situation. We thus notify the operator of the change 224 * explicitly. The check for omaxmtu is necessary to restrict the 225 * log to the case of changing the MTU, not initializing it. 226 */ 227 if (omaxmtu >= IPV6_MMTU && ndi->maxmtu < IPV6_MMTU) { 228 log(LOG_NOTICE, "nd6_setmtu0: new link MTU on %s (%lu) is too" 229 " small for IPv6 which needs %lu\n", 230 if_name(ifp), (unsigned long)ndi->maxmtu, (unsigned long) 231 IPV6_MMTU); 232 } 233 234 if (ndi->maxmtu > in6_maxmtu) 235 in6_setmaxmtu(); /* check all interfaces just in case */ 236 } 237 238 void 239 nd6_option_init(opt, icmp6len, ndopts) 240 void *opt; 241 int icmp6len; 242 union nd_opts *ndopts; 243 { 244 245 bzero(ndopts, sizeof(*ndopts)); 246 ndopts->nd_opts_search = (struct nd_opt_hdr *)opt; 247 ndopts->nd_opts_last 248 = (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len); 249 250 if (icmp6len == 0) { 251 ndopts->nd_opts_done = 1; 252 ndopts->nd_opts_search = NULL; 253 } 254 } 255 256 /* 257 * Take one ND option. 258 */ 259 struct nd_opt_hdr * 260 nd6_option(ndopts) 261 union nd_opts *ndopts; 262 { 263 struct nd_opt_hdr *nd_opt; 264 int olen; 265 266 if (ndopts == NULL) 267 panic("ndopts == NULL in nd6_option"); 268 if (ndopts->nd_opts_last == NULL) 269 panic("uninitialized ndopts in nd6_option"); 270 if (ndopts->nd_opts_search == NULL) 271 return NULL; 272 if (ndopts->nd_opts_done) 273 return NULL; 274 275 nd_opt = ndopts->nd_opts_search; 276 277 /* make sure nd_opt_len is inside the buffer */ 278 if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) { 279 bzero(ndopts, sizeof(*ndopts)); 280 return NULL; 281 } 282 283 olen = nd_opt->nd_opt_len << 3; 284 if (olen == 0) { 285 /* 286 * Message validation requires that all included 287 * options have a length that is greater than zero. 288 */ 289 bzero(ndopts, sizeof(*ndopts)); 290 return NULL; 291 } 292 293 ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen); 294 if (ndopts->nd_opts_search > ndopts->nd_opts_last) { 295 /* option overruns the end of buffer, invalid */ 296 bzero(ndopts, sizeof(*ndopts)); 297 return NULL; 298 } else if (ndopts->nd_opts_search == ndopts->nd_opts_last) { 299 /* reached the end of options chain */ 300 ndopts->nd_opts_done = 1; 301 ndopts->nd_opts_search = NULL; 302 } 303 return nd_opt; 304 } 305 306 /* 307 * Parse multiple ND options. 308 * This function is much easier to use, for ND routines that do not need 309 * multiple options of the same type. 310 */ 311 int 312 nd6_options(ndopts) 313 union nd_opts *ndopts; 314 { 315 struct nd_opt_hdr *nd_opt; 316 int i = 0; 317 318 if (ndopts == NULL) 319 panic("ndopts == NULL in nd6_options"); 320 if (ndopts->nd_opts_last == NULL) 321 panic("uninitialized ndopts in nd6_options"); 322 if (ndopts->nd_opts_search == NULL) 323 return 0; 324 325 while (1) { 326 nd_opt = nd6_option(ndopts); 327 if (nd_opt == NULL && ndopts->nd_opts_last == NULL) { 328 /* 329 * Message validation requires that all included 330 * options have a length that is greater than zero. 331 */ 332 icmp6stat.icp6s_nd_badopt++; 333 bzero(ndopts, sizeof(*ndopts)); 334 return -1; 335 } 336 337 if (nd_opt == NULL) 338 goto skip1; 339 340 switch (nd_opt->nd_opt_type) { 341 case ND_OPT_SOURCE_LINKADDR: 342 case ND_OPT_TARGET_LINKADDR: 343 case ND_OPT_MTU: 344 case ND_OPT_REDIRECTED_HEADER: 345 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) { 346 nd6log((LOG_INFO, 347 "duplicated ND6 option found (type=%d)\n", 348 nd_opt->nd_opt_type)); 349 /* XXX bark? */ 350 } else { 351 ndopts->nd_opt_array[nd_opt->nd_opt_type] 352 = nd_opt; 353 } 354 break; 355 case ND_OPT_PREFIX_INFORMATION: 356 if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) { 357 ndopts->nd_opt_array[nd_opt->nd_opt_type] 358 = nd_opt; 359 } 360 ndopts->nd_opts_pi_end = 361 (struct nd_opt_prefix_info *)nd_opt; 362 break; 363 default: 364 /* 365 * Unknown options must be silently ignored, 366 * to accomodate future extension to the protocol. 367 */ 368 nd6log((LOG_DEBUG, 369 "nd6_options: unsupported option %d - " 370 "option ignored\n", nd_opt->nd_opt_type)); 371 } 372 373 skip1: 374 i++; 375 if (i > nd6_maxndopt) { 376 icmp6stat.icp6s_nd_toomanyopt++; 377 nd6log((LOG_INFO, "too many loop in nd opt\n")); 378 break; 379 } 380 381 if (ndopts->nd_opts_done) 382 break; 383 } 384 385 return 0; 386 } 387 388 /* 389 * ND6 timer routine to handle ND6 entries 390 */ 391 void 392 nd6_llinfo_settimer(ln, xtick) 393 struct llinfo_nd6 *ln; 394 long xtick; 395 { 396 int s; 397 398 s = splsoftnet(); 399 400 if (xtick < 0) { 401 ln->ln_expire = 0; 402 ln->ln_ntick = 0; 403 callout_stop(&ln->ln_timer_ch); 404 } else { 405 ln->ln_expire = time_second + xtick / hz; 406 if (xtick > INT_MAX) { 407 ln->ln_ntick = xtick - INT_MAX; 408 callout_reset(&ln->ln_timer_ch, INT_MAX, 409 nd6_llinfo_timer, ln); 410 } else { 411 ln->ln_ntick = 0; 412 callout_reset(&ln->ln_timer_ch, xtick, 413 nd6_llinfo_timer, ln); 414 } 415 } 416 417 splx(s); 418 } 419 420 static void 421 nd6_llinfo_timer(arg) 422 void *arg; 423 { 424 int s; 425 struct llinfo_nd6 *ln; 426 struct rtentry *rt; 427 const struct sockaddr_in6 *dst; 428 struct ifnet *ifp; 429 struct nd_ifinfo *ndi = NULL; 430 431 s = splsoftnet(); 432 433 ln = (struct llinfo_nd6 *)arg; 434 435 if (ln->ln_ntick > 0) { 436 nd6_llinfo_settimer(ln, ln->ln_ntick); 437 splx(s); 438 return; 439 } 440 441 if ((rt = ln->ln_rt) == NULL) 442 panic("ln->ln_rt == NULL"); 443 if ((ifp = rt->rt_ifp) == NULL) 444 panic("ln->ln_rt->rt_ifp == NULL"); 445 ndi = ND_IFINFO(ifp); 446 dst = (struct sockaddr_in6 *)rt_key(rt); 447 448 /* sanity check */ 449 if (rt->rt_llinfo && (struct llinfo_nd6 *)rt->rt_llinfo != ln) 450 panic("rt_llinfo(%p) is not equal to ln(%p)", 451 rt->rt_llinfo, ln); 452 if (!dst) 453 panic("dst=0 in nd6_timer(ln=%p)", ln); 454 455 switch (ln->ln_state) { 456 case ND6_LLINFO_INCOMPLETE: 457 if (ln->ln_asked < nd6_mmaxtries) { 458 ln->ln_asked++; 459 nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000); 460 nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, 0); 461 } else { 462 struct mbuf *m = ln->ln_hold; 463 if (m) { 464 struct mbuf *m0; 465 466 /* 467 * assuming every packet in ln_hold has 468 * the same IP header 469 */ 470 m0 = m->m_nextpkt; 471 m->m_nextpkt = NULL; 472 icmp6_error2(m, ICMP6_DST_UNREACH, 473 ICMP6_DST_UNREACH_ADDR, 0, rt->rt_ifp); 474 475 ln->ln_hold = m0; 476 clear_llinfo_pqueue(ln); 477 } 478 (void)nd6_free(rt, 0); 479 ln = NULL; 480 } 481 break; 482 case ND6_LLINFO_REACHABLE: 483 if (!ND6_LLINFO_PERMANENT(ln)) { 484 ln->ln_state = ND6_LLINFO_STALE; 485 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 486 } 487 break; 488 489 case ND6_LLINFO_STALE: 490 /* Garbage Collection(RFC 2461 5.3) */ 491 if (!ND6_LLINFO_PERMANENT(ln)) { 492 (void)nd6_free(rt, 1); 493 ln = NULL; 494 } 495 break; 496 497 case ND6_LLINFO_DELAY: 498 if (ndi && (ndi->flags & ND6_IFF_PERFORMNUD) != 0) { 499 /* We need NUD */ 500 ln->ln_asked = 1; 501 ln->ln_state = ND6_LLINFO_PROBE; 502 nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000); 503 nd6_ns_output(ifp, &dst->sin6_addr, 504 &dst->sin6_addr, ln, 0); 505 } else { 506 ln->ln_state = ND6_LLINFO_STALE; /* XXX */ 507 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 508 } 509 break; 510 case ND6_LLINFO_PROBE: 511 if (ln->ln_asked < nd6_umaxtries) { 512 ln->ln_asked++; 513 nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000); 514 nd6_ns_output(ifp, &dst->sin6_addr, 515 &dst->sin6_addr, ln, 0); 516 } else { 517 (void)nd6_free(rt, 0); 518 ln = NULL; 519 } 520 break; 521 } 522 523 splx(s); 524 } 525 526 /* 527 * ND6 timer routine to expire default route list and prefix list 528 */ 529 void 530 nd6_timer(void *ignored_arg __unused) 531 { 532 int s; 533 struct nd_defrouter *dr; 534 struct nd_prefix *pr; 535 struct in6_ifaddr *ia6, *nia6; 536 struct in6_addrlifetime *lt6; 537 538 s = splsoftnet(); 539 callout_reset(&nd6_timer_ch, nd6_prune * hz, 540 nd6_timer, NULL); 541 542 /* expire default router list */ 543 dr = TAILQ_FIRST(&nd_defrouter); 544 while (dr) { 545 if (dr->expire && dr->expire < time_second) { 546 struct nd_defrouter *t; 547 t = TAILQ_NEXT(dr, dr_entry); 548 defrtrlist_del(dr); 549 dr = t; 550 } else { 551 dr = TAILQ_NEXT(dr, dr_entry); 552 } 553 } 554 555 /* 556 * expire interface addresses. 557 * in the past the loop was inside prefix expiry processing. 558 * However, from a stricter speci-confrmance standpoint, we should 559 * rather separate address lifetimes and prefix lifetimes. 560 */ 561 addrloop: 562 for (ia6 = in6_ifaddr; ia6; ia6 = nia6) { 563 nia6 = ia6->ia_next; 564 /* check address lifetime */ 565 lt6 = &ia6->ia6_lifetime; 566 if (IFA6_IS_INVALID(ia6)) { 567 int regen = 0; 568 569 /* 570 * If the expiring address is temporary, try 571 * regenerating a new one. This would be useful when 572 * we suspended a laptop PC, then turned it on after a 573 * period that could invalidate all temporary 574 * addresses. Although we may have to restart the 575 * loop (see below), it must be after purging the 576 * address. Otherwise, we'd see an infinite loop of 577 * regeneration. 578 */ 579 if (ip6_use_tempaddr && 580 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) { 581 if (regen_tmpaddr(ia6) == 0) 582 regen = 1; 583 } 584 585 in6_purgeaddr(&ia6->ia_ifa); 586 587 if (regen) 588 goto addrloop; /* XXX: see below */ 589 } else if (IFA6_IS_DEPRECATED(ia6)) { 590 int oldflags = ia6->ia6_flags; 591 592 ia6->ia6_flags |= IN6_IFF_DEPRECATED; 593 594 /* 595 * If a temporary address has just become deprecated, 596 * regenerate a new one if possible. 597 */ 598 if (ip6_use_tempaddr && 599 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 && 600 (oldflags & IN6_IFF_DEPRECATED) == 0) { 601 602 if (regen_tmpaddr(ia6) == 0) { 603 /* 604 * A new temporary address is 605 * generated. 606 * XXX: this means the address chain 607 * has changed while we are still in 608 * the loop. Although the change 609 * would not cause disaster (because 610 * it's not a deletion, but an 611 * addition,) we'd rather restart the 612 * loop just for safety. Or does this 613 * significantly reduce performance?? 614 */ 615 goto addrloop; 616 } 617 } 618 } else { 619 /* 620 * A new RA might have made a deprecated address 621 * preferred. 622 */ 623 ia6->ia6_flags &= ~IN6_IFF_DEPRECATED; 624 } 625 } 626 627 /* expire prefix list */ 628 pr = nd_prefix.lh_first; 629 while (pr) { 630 /* 631 * check prefix lifetime. 632 * since pltime is just for autoconf, pltime processing for 633 * prefix is not necessary. 634 */ 635 if (pr->ndpr_vltime != ND6_INFINITE_LIFETIME && 636 time_second - pr->ndpr_lastupdate > pr->ndpr_vltime) { 637 struct nd_prefix *t; 638 t = pr->ndpr_next; 639 640 /* 641 * address expiration and prefix expiration are 642 * separate. NEVER perform in6_purgeaddr here. 643 */ 644 645 prelist_remove(pr); 646 pr = t; 647 } else 648 pr = pr->ndpr_next; 649 } 650 splx(s); 651 } 652 653 static int 654 regen_tmpaddr(ia6) 655 struct in6_ifaddr *ia6; /* deprecated/invalidated temporary address */ 656 { 657 struct ifaddr *ifa; 658 struct ifnet *ifp; 659 struct in6_ifaddr *public_ifa6 = NULL; 660 661 ifp = ia6->ia_ifa.ifa_ifp; 662 for (ifa = ifp->if_addrlist.tqh_first; ifa; 663 ifa = ifa->ifa_list.tqe_next) { 664 struct in6_ifaddr *it6; 665 666 if (ifa->ifa_addr->sa_family != AF_INET6) 667 continue; 668 669 it6 = (struct in6_ifaddr *)ifa; 670 671 /* ignore no autoconf addresses. */ 672 if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0) 673 continue; 674 675 /* ignore autoconf addresses with different prefixes. */ 676 if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr) 677 continue; 678 679 /* 680 * Now we are looking at an autoconf address with the same 681 * prefix as ours. If the address is temporary and is still 682 * preferred, do not create another one. It would be rare, but 683 * could happen, for example, when we resume a laptop PC after 684 * a long period. 685 */ 686 if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 && 687 !IFA6_IS_DEPRECATED(it6)) { 688 public_ifa6 = NULL; 689 break; 690 } 691 692 /* 693 * This is a public autoconf address that has the same prefix 694 * as ours. If it is preferred, keep it. We can't break the 695 * loop here, because there may be a still-preferred temporary 696 * address with the prefix. 697 */ 698 if (!IFA6_IS_DEPRECATED(it6)) 699 public_ifa6 = it6; 700 } 701 702 if (public_ifa6 != NULL) { 703 int e; 704 705 /* 706 * Random factor is introduced in the preferred lifetime, so 707 * we do not need additional delay (3rd arg to in6_tmpifadd). 708 */ 709 if ((e = in6_tmpifadd(public_ifa6, 0, 0)) != 0) { 710 log(LOG_NOTICE, "regen_tmpaddr: failed to create a new" 711 " tmp addr, errno=%d\n", e); 712 return (-1); 713 } 714 return (0); 715 } 716 717 return (-1); 718 } 719 720 /* 721 * Nuke neighbor cache/prefix/default router management table, right before 722 * ifp goes away. 723 */ 724 void 725 nd6_purge(ifp) 726 struct ifnet *ifp; 727 { 728 struct llinfo_nd6 *ln, *nln; 729 struct nd_defrouter *dr, *ndr; 730 struct nd_prefix *pr, *npr; 731 732 /* 733 * Nuke default router list entries toward ifp. 734 * We defer removal of default router list entries that is installed 735 * in the routing table, in order to keep additional side effects as 736 * small as possible. 737 */ 738 for (dr = TAILQ_FIRST(&nd_defrouter); dr; dr = ndr) { 739 ndr = TAILQ_NEXT(dr, dr_entry); 740 if (dr->installed) 741 continue; 742 743 if (dr->ifp == ifp) 744 defrtrlist_del(dr); 745 } 746 for (dr = TAILQ_FIRST(&nd_defrouter); dr; dr = ndr) { 747 ndr = TAILQ_NEXT(dr, dr_entry); 748 if (!dr->installed) 749 continue; 750 751 if (dr->ifp == ifp) 752 defrtrlist_del(dr); 753 } 754 755 /* Nuke prefix list entries toward ifp */ 756 for (pr = nd_prefix.lh_first; pr; pr = npr) { 757 npr = pr->ndpr_next; 758 if (pr->ndpr_ifp == ifp) { 759 /* 760 * Because if_detach() does *not* release prefixes 761 * while purging addresses the reference count will 762 * still be above zero. We therefore reset it to 763 * make sure that the prefix really gets purged. 764 */ 765 pr->ndpr_refcnt = 0; 766 /* 767 * Previously, pr->ndpr_addr is removed as well, 768 * but I strongly believe we don't have to do it. 769 * nd6_purge() is only called from in6_ifdetach(), 770 * which removes all the associated interface addresses 771 * by itself. 772 * (jinmei@kame.net 20010129) 773 */ 774 prelist_remove(pr); 775 } 776 } 777 778 /* cancel default outgoing interface setting */ 779 if (nd6_defifindex == ifp->if_index) 780 nd6_setdefaultiface(0); 781 782 if (!ip6_forwarding && ip6_accept_rtadv) { /* XXX: too restrictive? */ 783 /* refresh default router list */ 784 defrouter_select(); 785 } 786 787 /* 788 * Nuke neighbor cache entries for the ifp. 789 * Note that rt->rt_ifp may not be the same as ifp, 790 * due to KAME goto ours hack. See RTM_RESOLVE case in 791 * nd6_rtrequest(), and ip6_input(). 792 */ 793 ln = llinfo_nd6.ln_next; 794 while (ln && ln != &llinfo_nd6) { 795 struct rtentry *rt; 796 struct sockaddr_dl *sdl; 797 798 nln = ln->ln_next; 799 rt = ln->ln_rt; 800 if (rt && rt->rt_gateway && 801 rt->rt_gateway->sa_family == AF_LINK) { 802 sdl = (struct sockaddr_dl *)rt->rt_gateway; 803 if (sdl->sdl_index == ifp->if_index) 804 nln = nd6_free(rt, 0); 805 } 806 ln = nln; 807 } 808 } 809 810 struct rtentry * 811 nd6_lookup(addr6, create, ifp) 812 struct in6_addr *addr6; 813 int create; 814 struct ifnet *ifp; 815 { 816 struct rtentry *rt; 817 struct sockaddr_in6 sin6; 818 819 bzero(&sin6, sizeof(sin6)); 820 sin6.sin6_len = sizeof(struct sockaddr_in6); 821 sin6.sin6_family = AF_INET6; 822 sin6.sin6_addr = *addr6; 823 rt = rtalloc1((struct sockaddr *)&sin6, create); 824 if (rt && (rt->rt_flags & RTF_LLINFO) == 0) { 825 /* 826 * This is the case for the default route. 827 * If we want to create a neighbor cache for the address, we 828 * should free the route for the destination and allocate an 829 * interface route. 830 */ 831 if (create) { 832 RTFREE(rt); 833 rt = NULL; 834 } 835 } 836 if (rt == NULL) { 837 if (create && ifp) { 838 int e; 839 840 /* 841 * If no route is available and create is set, 842 * we allocate a host route for the destination 843 * and treat it like an interface route. 844 * This hack is necessary for a neighbor which can't 845 * be covered by our own prefix. 846 */ 847 struct ifaddr *ifa = 848 ifaof_ifpforaddr((struct sockaddr *)&sin6, ifp); 849 if (ifa == NULL) 850 return (NULL); 851 852 /* 853 * Create a new route. RTF_LLINFO is necessary 854 * to create a Neighbor Cache entry for the 855 * destination in nd6_rtrequest which will be 856 * called in rtrequest via ifa->ifa_rtrequest. 857 */ 858 if ((e = rtrequest(RTM_ADD, (struct sockaddr *)&sin6, 859 ifa->ifa_addr, (struct sockaddr *)&all1_sa, 860 (ifa->ifa_flags | RTF_HOST | RTF_LLINFO) & 861 ~RTF_CLONING, &rt)) != 0) { 862 #if 0 863 log(LOG_ERR, 864 "nd6_lookup: failed to add route for a " 865 "neighbor(%s), errno=%d\n", 866 ip6_sprintf(addr6), e); 867 #endif 868 return (NULL); 869 } 870 if (rt == NULL) 871 return (NULL); 872 if (rt->rt_llinfo) { 873 struct llinfo_nd6 *ln = 874 (struct llinfo_nd6 *)rt->rt_llinfo; 875 ln->ln_state = ND6_LLINFO_NOSTATE; 876 } 877 } else 878 return (NULL); 879 } 880 rt->rt_refcnt--; 881 /* 882 * Validation for the entry. 883 * Note that the check for rt_llinfo is necessary because a cloned 884 * route from a parent route that has the L flag (e.g. the default 885 * route to a p2p interface) may have the flag, too, while the 886 * destination is not actually a neighbor. 887 * XXX: we can't use rt->rt_ifp to check for the interface, since 888 * it might be the loopback interface if the entry is for our 889 * own address on a non-loopback interface. Instead, we should 890 * use rt->rt_ifa->ifa_ifp, which would specify the REAL 891 * interface. 892 * Note also that ifa_ifp and ifp may differ when we connect two 893 * interfaces to a same link, install a link prefix to an interface, 894 * and try to install a neighbor cache on an interface that does not 895 * have a route to the prefix. 896 */ 897 if ((rt->rt_flags & RTF_GATEWAY) || (rt->rt_flags & RTF_LLINFO) == 0 || 898 rt->rt_gateway->sa_family != AF_LINK || rt->rt_llinfo == NULL || 899 (ifp && rt->rt_ifa->ifa_ifp != ifp)) { 900 if (create) { 901 nd6log((LOG_DEBUG, 902 "nd6_lookup: failed to lookup %s (if = %s)\n", 903 ip6_sprintf(addr6), 904 ifp ? if_name(ifp) : "unspec")); 905 } 906 return (NULL); 907 } 908 return (rt); 909 } 910 911 /* 912 * Detect if a given IPv6 address identifies a neighbor on a given link. 913 * XXX: should take care of the destination of a p2p link? 914 */ 915 int 916 nd6_is_addr_neighbor(addr, ifp) 917 struct sockaddr_in6 *addr; 918 struct ifnet *ifp; 919 { 920 struct nd_prefix *pr; 921 922 /* 923 * A link-local address is always a neighbor. 924 * XXX: a link does not necessarily specify a single interface. 925 */ 926 if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr)) { 927 struct sockaddr_in6 sin6_copy; 928 u_int32_t zone; 929 930 /* 931 * We need sin6_copy since sa6_recoverscope() may modify the 932 * content (XXX). 933 */ 934 sin6_copy = *addr; 935 if (sa6_recoverscope(&sin6_copy)) 936 return (0); /* XXX: should be impossible */ 937 if (in6_setscope(&sin6_copy.sin6_addr, ifp, &zone)) 938 return (0); 939 if (sin6_copy.sin6_scope_id == zone) 940 return (1); 941 else 942 return (0); 943 } 944 945 /* 946 * If the address matches one of our on-link prefixes, it should be a 947 * neighbor. 948 */ 949 for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) { 950 if (pr->ndpr_ifp != ifp) 951 continue; 952 953 if (!(pr->ndpr_stateflags & NDPRF_ONLINK)) 954 continue; 955 956 if (IN6_ARE_MASKED_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr, 957 &addr->sin6_addr, &pr->ndpr_mask)) 958 return (1); 959 } 960 961 /* 962 * If the default router list is empty, all addresses are regarded 963 * as on-link, and thus, as a neighbor. 964 * XXX: we restrict the condition to hosts, because routers usually do 965 * not have the "default router list". 966 */ 967 if (!ip6_forwarding && TAILQ_FIRST(&nd_defrouter) == NULL && 968 nd6_defifindex == ifp->if_index) { 969 return (1); 970 } 971 972 /* 973 * Even if the address matches none of our addresses, it might be 974 * in the neighbor cache. 975 */ 976 if (nd6_lookup(&addr->sin6_addr, 0, ifp) != NULL) 977 return (1); 978 979 return (0); 980 } 981 982 /* 983 * Free an nd6 llinfo entry. 984 * Since the function would cause significant changes in the kernel, DO NOT 985 * make it global, unless you have a strong reason for the change, and are sure 986 * that the change is safe. 987 */ 988 static struct llinfo_nd6 * 989 nd6_free(rt, gc) 990 struct rtentry *rt; 991 int gc; 992 { 993 struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo, *next; 994 struct in6_addr in6 = ((struct sockaddr_in6 *)rt_key(rt))->sin6_addr; 995 struct nd_defrouter *dr; 996 997 /* 998 * we used to have pfctlinput(PRC_HOSTDEAD) here. 999 * even though it is not harmful, it was not really necessary. 1000 */ 1001 1002 /* cancel timer */ 1003 nd6_llinfo_settimer(ln, -1); 1004 1005 if (!ip6_forwarding) { 1006 int s; 1007 s = splsoftnet(); 1008 dr = defrouter_lookup(&((struct sockaddr_in6 *)rt_key(rt))->sin6_addr, 1009 rt->rt_ifp); 1010 1011 if (dr != NULL && dr->expire && 1012 ln->ln_state == ND6_LLINFO_STALE && gc) { 1013 /* 1014 * If the reason for the deletion is just garbage 1015 * collection, and the neighbor is an active default 1016 * router, do not delete it. Instead, reset the GC 1017 * timer using the router's lifetime. 1018 * Simply deleting the entry would affect default 1019 * router selection, which is not necessarily a good 1020 * thing, especially when we're using router preference 1021 * values. 1022 * XXX: the check for ln_state would be redundant, 1023 * but we intentionally keep it just in case. 1024 */ 1025 if (dr->expire > time_second) 1026 nd6_llinfo_settimer(ln, 1027 (dr->expire - time_second) * hz); 1028 else 1029 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 1030 splx(s); 1031 return (ln->ln_next); 1032 } 1033 1034 if (ln->ln_router || dr) { 1035 /* 1036 * rt6_flush must be called whether or not the neighbor 1037 * is in the Default Router List. 1038 * See a corresponding comment in nd6_na_input(). 1039 */ 1040 rt6_flush(&in6, rt->rt_ifp); 1041 } 1042 1043 if (dr) { 1044 /* 1045 * Unreachablity of a router might affect the default 1046 * router selection and on-link detection of advertised 1047 * prefixes. 1048 */ 1049 1050 /* 1051 * Temporarily fake the state to choose a new default 1052 * router and to perform on-link determination of 1053 * prefixes correctly. 1054 * Below the state will be set correctly, 1055 * or the entry itself will be deleted. 1056 */ 1057 ln->ln_state = ND6_LLINFO_INCOMPLETE; 1058 1059 /* 1060 * Since defrouter_select() does not affect the 1061 * on-link determination and MIP6 needs the check 1062 * before the default router selection, we perform 1063 * the check now. 1064 */ 1065 pfxlist_onlink_check(); 1066 1067 /* 1068 * refresh default router list 1069 */ 1070 defrouter_select(); 1071 } 1072 splx(s); 1073 } 1074 1075 /* 1076 * Before deleting the entry, remember the next entry as the 1077 * return value. We need this because pfxlist_onlink_check() above 1078 * might have freed other entries (particularly the old next entry) as 1079 * a side effect (XXX). 1080 */ 1081 next = ln->ln_next; 1082 1083 /* 1084 * Detach the route from the routing tree and the list of neighbor 1085 * caches, and disable the route entry not to be used in already 1086 * cached routes. 1087 */ 1088 rtrequest(RTM_DELETE, rt_key(rt), (struct sockaddr *)0, 1089 rt_mask(rt), 0, (struct rtentry **)0); 1090 1091 return (next); 1092 } 1093 1094 /* 1095 * Upper-layer reachability hint for Neighbor Unreachability Detection. 1096 * 1097 * XXX cost-effective methods? 1098 */ 1099 void 1100 nd6_nud_hint(rt, dst6, force) 1101 struct rtentry *rt; 1102 struct in6_addr *dst6; 1103 int force; 1104 { 1105 struct llinfo_nd6 *ln; 1106 1107 /* 1108 * If the caller specified "rt", use that. Otherwise, resolve the 1109 * routing table by supplied "dst6". 1110 */ 1111 if (rt == NULL) { 1112 if (dst6 == NULL) 1113 return; 1114 if ((rt = nd6_lookup(dst6, 0, NULL)) == NULL) 1115 return; 1116 } 1117 1118 if ((rt->rt_flags & RTF_GATEWAY) != 0 || 1119 (rt->rt_flags & RTF_LLINFO) == 0 || 1120 !rt->rt_llinfo || !rt->rt_gateway || 1121 rt->rt_gateway->sa_family != AF_LINK) { 1122 /* This is not a host route. */ 1123 return; 1124 } 1125 1126 ln = (struct llinfo_nd6 *)rt->rt_llinfo; 1127 if (ln->ln_state < ND6_LLINFO_REACHABLE) 1128 return; 1129 1130 /* 1131 * if we get upper-layer reachability confirmation many times, 1132 * it is possible we have false information. 1133 */ 1134 if (!force) { 1135 ln->ln_byhint++; 1136 if (ln->ln_byhint > nd6_maxnudhint) 1137 return; 1138 } 1139 1140 ln->ln_state = ND6_LLINFO_REACHABLE; 1141 if (!ND6_LLINFO_PERMANENT(ln)) { 1142 nd6_llinfo_settimer(ln, 1143 (long)ND_IFINFO(rt->rt_ifp)->reachable * hz); 1144 } 1145 } 1146 1147 void 1148 nd6_rtrequest(int req, struct rtentry *rt, struct rt_addrinfo *info __unused) 1149 { 1150 struct sockaddr *gate = rt->rt_gateway; 1151 struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo; 1152 static const struct sockaddr_dl null_sdl = { 1153 .sdl_len = sizeof(null_sdl), 1154 .sdl_family = AF_LINK, 1155 }; 1156 struct ifnet *ifp = rt->rt_ifp; 1157 struct ifaddr *ifa; 1158 1159 if ((rt->rt_flags & RTF_GATEWAY) != 0) 1160 return; 1161 1162 if (nd6_need_cache(ifp) == 0 && (rt->rt_flags & RTF_HOST) == 0) { 1163 /* 1164 * This is probably an interface direct route for a link 1165 * which does not need neighbor caches (e.g. fe80::%lo0/64). 1166 * We do not need special treatment below for such a route. 1167 * Moreover, the RTF_LLINFO flag which would be set below 1168 * would annoy the ndp(8) command. 1169 */ 1170 return; 1171 } 1172 1173 if (req == RTM_RESOLVE && 1174 (nd6_need_cache(ifp) == 0 || /* stf case */ 1175 !nd6_is_addr_neighbor((struct sockaddr_in6 *)rt_key(rt), ifp))) { 1176 /* 1177 * FreeBSD and BSD/OS often make a cloned host route based 1178 * on a less-specific route (e.g. the default route). 1179 * If the less specific route does not have a "gateway" 1180 * (this is the case when the route just goes to a p2p or an 1181 * stf interface), we'll mistakenly make a neighbor cache for 1182 * the host route, and will see strange neighbor solicitation 1183 * for the corresponding destination. In order to avoid the 1184 * confusion, we check if the destination of the route is 1185 * a neighbor in terms of neighbor discovery, and stop the 1186 * process if not. Additionally, we remove the LLINFO flag 1187 * so that ndp(8) will not try to get the neighbor information 1188 * of the destination. 1189 */ 1190 rt->rt_flags &= ~RTF_LLINFO; 1191 return; 1192 } 1193 1194 switch (req) { 1195 case RTM_ADD: 1196 /* 1197 * There is no backward compatibility :) 1198 * 1199 * if ((rt->rt_flags & RTF_HOST) == 0 && 1200 * SIN(rt_mask(rt))->sin_addr.s_addr != 0xffffffff) 1201 * rt->rt_flags |= RTF_CLONING; 1202 */ 1203 if ((rt->rt_flags & RTF_CLONING) || 1204 ((rt->rt_flags & RTF_LLINFO) && !ln)) { 1205 /* 1206 * Case 1: This route should come from a route to 1207 * interface (RTF_CLONING case) or the route should be 1208 * treated as on-link but is currently not 1209 * (RTF_LLINFO && !ln case). 1210 */ 1211 rt_setgate(rt, rt_key(rt), 1212 (const struct sockaddr *)&null_sdl); 1213 gate = rt->rt_gateway; 1214 SDL(gate)->sdl_type = ifp->if_type; 1215 SDL(gate)->sdl_index = ifp->if_index; 1216 if (ln) 1217 nd6_llinfo_settimer(ln, 0); 1218 if ((rt->rt_flags & RTF_CLONING) != 0) 1219 break; 1220 } 1221 /* 1222 * In IPv4 code, we try to annonuce new RTF_ANNOUNCE entry here. 1223 * We don't do that here since llinfo is not ready yet. 1224 * 1225 * There are also couple of other things to be discussed: 1226 * - unsolicited NA code needs improvement beforehand 1227 * - RFC2461 says we MAY send multicast unsolicited NA 1228 * (7.2.6 paragraph 4), however, it also says that we 1229 * SHOULD provide a mechanism to prevent multicast NA storm. 1230 * we don't have anything like it right now. 1231 * note that the mechanism needs a mutual agreement 1232 * between proxies, which means that we need to implement 1233 * a new protocol, or a new kludge. 1234 * - from RFC2461 6.2.4, host MUST NOT send an unsolicited NA. 1235 * we need to check ip6forwarding before sending it. 1236 * (or should we allow proxy ND configuration only for 1237 * routers? there's no mention about proxy ND from hosts) 1238 */ 1239 #if 0 1240 /* XXX it does not work */ 1241 if (rt->rt_flags & RTF_ANNOUNCE) 1242 nd6_na_output(ifp, 1243 &SIN6(rt_key(rt))->sin6_addr, 1244 &SIN6(rt_key(rt))->sin6_addr, 1245 ip6_forwarding ? ND_NA_FLAG_ROUTER : 0, 1246 1, NULL); 1247 #endif 1248 /* FALLTHROUGH */ 1249 case RTM_RESOLVE: 1250 if ((ifp->if_flags & (IFF_POINTOPOINT | IFF_LOOPBACK)) == 0) { 1251 /* 1252 * Address resolution isn't necessary for a point to 1253 * point link, so we can skip this test for a p2p link. 1254 */ 1255 if (gate->sa_family != AF_LINK || 1256 gate->sa_len < sizeof(null_sdl)) { 1257 log(LOG_DEBUG, 1258 "nd6_rtrequest: bad gateway value: %s\n", 1259 if_name(ifp)); 1260 break; 1261 } 1262 SDL(gate)->sdl_type = ifp->if_type; 1263 SDL(gate)->sdl_index = ifp->if_index; 1264 } 1265 if (ln != NULL) 1266 break; /* This happens on a route change */ 1267 /* 1268 * Case 2: This route may come from cloning, or a manual route 1269 * add with a LL address. 1270 */ 1271 R_Malloc(ln, struct llinfo_nd6 *, sizeof(*ln)); 1272 rt->rt_llinfo = (caddr_t)ln; 1273 if (ln == NULL) { 1274 log(LOG_DEBUG, "nd6_rtrequest: malloc failed\n"); 1275 break; 1276 } 1277 nd6_inuse++; 1278 nd6_allocated++; 1279 bzero(ln, sizeof(*ln)); 1280 ln->ln_rt = rt; 1281 callout_init(&ln->ln_timer_ch); 1282 /* this is required for "ndp" command. - shin */ 1283 if (req == RTM_ADD) { 1284 /* 1285 * gate should have some valid AF_LINK entry, 1286 * and ln->ln_expire should have some lifetime 1287 * which is specified by ndp command. 1288 */ 1289 ln->ln_state = ND6_LLINFO_REACHABLE; 1290 ln->ln_byhint = 0; 1291 } else { 1292 /* 1293 * When req == RTM_RESOLVE, rt is created and 1294 * initialized in rtrequest(), so rt_expire is 0. 1295 */ 1296 ln->ln_state = ND6_LLINFO_NOSTATE; 1297 nd6_llinfo_settimer(ln, 0); 1298 } 1299 rt->rt_flags |= RTF_LLINFO; 1300 ln->ln_next = llinfo_nd6.ln_next; 1301 llinfo_nd6.ln_next = ln; 1302 ln->ln_prev = &llinfo_nd6; 1303 ln->ln_next->ln_prev = ln; 1304 1305 /* 1306 * check if rt_key(rt) is one of my address assigned 1307 * to the interface. 1308 */ 1309 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(rt->rt_ifp, 1310 &SIN6(rt_key(rt))->sin6_addr); 1311 if (ifa) { 1312 caddr_t macp = nd6_ifptomac(ifp); 1313 nd6_llinfo_settimer(ln, -1); 1314 ln->ln_state = ND6_LLINFO_REACHABLE; 1315 ln->ln_byhint = 0; 1316 if (macp) { 1317 bcopy(macp, LLADDR(SDL(gate)), ifp->if_addrlen); 1318 SDL(gate)->sdl_alen = ifp->if_addrlen; 1319 } 1320 if (nd6_useloopback) { 1321 rt->rt_ifp = lo0ifp; /* XXX */ 1322 /* 1323 * Make sure rt_ifa be equal to the ifaddr 1324 * corresponding to the address. 1325 * We need this because when we refer 1326 * rt_ifa->ia6_flags in ip6_input, we assume 1327 * that the rt_ifa points to the address instead 1328 * of the loopback address. 1329 */ 1330 if (ifa != rt->rt_ifa) { 1331 IFAFREE(rt->rt_ifa); 1332 IFAREF(ifa); 1333 rt->rt_ifa = ifa; 1334 } 1335 } 1336 } else if (rt->rt_flags & RTF_ANNOUNCE) { 1337 nd6_llinfo_settimer(ln, -1); 1338 ln->ln_state = ND6_LLINFO_REACHABLE; 1339 ln->ln_byhint = 0; 1340 1341 /* join solicited node multicast for proxy ND */ 1342 if (ifp->if_flags & IFF_MULTICAST) { 1343 struct in6_addr llsol; 1344 int error; 1345 1346 llsol = SIN6(rt_key(rt))->sin6_addr; 1347 llsol.s6_addr32[0] = htonl(0xff020000); 1348 llsol.s6_addr32[1] = 0; 1349 llsol.s6_addr32[2] = htonl(1); 1350 llsol.s6_addr8[12] = 0xff; 1351 if (in6_setscope(&llsol, ifp, NULL)) 1352 break; 1353 if (!in6_addmulti(&llsol, ifp, &error, 0)) { 1354 nd6log((LOG_ERR, "%s: failed to join " 1355 "%s (errno=%d)\n", if_name(ifp), 1356 ip6_sprintf(&llsol), error)); 1357 } 1358 } 1359 } 1360 break; 1361 1362 case RTM_DELETE: 1363 if (ln == NULL) 1364 break; 1365 /* leave from solicited node multicast for proxy ND */ 1366 if ((rt->rt_flags & RTF_ANNOUNCE) != 0 && 1367 (ifp->if_flags & IFF_MULTICAST) != 0) { 1368 struct in6_addr llsol; 1369 struct in6_multi *in6m; 1370 1371 llsol = SIN6(rt_key(rt))->sin6_addr; 1372 llsol.s6_addr32[0] = htonl(0xff020000); 1373 llsol.s6_addr32[1] = 0; 1374 llsol.s6_addr32[2] = htonl(1); 1375 llsol.s6_addr8[12] = 0xff; 1376 if (in6_setscope(&llsol, ifp, NULL) == 0) { 1377 IN6_LOOKUP_MULTI(llsol, ifp, in6m); 1378 if (in6m) 1379 in6_delmulti(in6m); 1380 } 1381 } 1382 nd6_inuse--; 1383 ln->ln_next->ln_prev = ln->ln_prev; 1384 ln->ln_prev->ln_next = ln->ln_next; 1385 ln->ln_prev = NULL; 1386 nd6_llinfo_settimer(ln, -1); 1387 rt->rt_llinfo = 0; 1388 rt->rt_flags &= ~RTF_LLINFO; 1389 clear_llinfo_pqueue(ln); 1390 Free((caddr_t)ln); 1391 } 1392 } 1393 1394 int 1395 nd6_ioctl(cmd, data, ifp) 1396 u_long cmd; 1397 caddr_t data; 1398 struct ifnet *ifp; 1399 { 1400 struct in6_drlist *drl = (struct in6_drlist *)data; 1401 struct in6_oprlist *oprl = (struct in6_oprlist *)data; 1402 struct in6_ndireq *ndi = (struct in6_ndireq *)data; 1403 struct in6_nbrinfo *nbi = (struct in6_nbrinfo *)data; 1404 struct in6_ndifreq *ndif = (struct in6_ndifreq *)data; 1405 struct nd_defrouter *dr; 1406 struct nd_prefix *pr; 1407 struct rtentry *rt; 1408 int i = 0, error = 0; 1409 int s; 1410 1411 switch (cmd) { 1412 case SIOCGDRLST_IN6: 1413 /* 1414 * obsolete API, use sysctl under net.inet6.icmp6 1415 */ 1416 bzero(drl, sizeof(*drl)); 1417 s = splsoftnet(); 1418 dr = TAILQ_FIRST(&nd_defrouter); 1419 while (dr && i < DRLSTSIZ) { 1420 drl->defrouter[i].rtaddr = dr->rtaddr; 1421 in6_clearscope(&drl->defrouter[i].rtaddr); 1422 1423 drl->defrouter[i].flags = dr->flags; 1424 drl->defrouter[i].rtlifetime = dr->rtlifetime; 1425 drl->defrouter[i].expire = dr->expire; 1426 drl->defrouter[i].if_index = dr->ifp->if_index; 1427 i++; 1428 dr = TAILQ_NEXT(dr, dr_entry); 1429 } 1430 splx(s); 1431 break; 1432 case SIOCGPRLST_IN6: 1433 /* 1434 * obsolete API, use sysctl under net.inet6.icmp6 1435 * 1436 * XXX the structure in6_prlist was changed in backward- 1437 * incompatible manner. in6_oprlist is used for SIOCGPRLST_IN6, 1438 * in6_prlist is used for nd6_sysctl() - fill_prlist(). 1439 */ 1440 /* 1441 * XXX meaning of fields, especialy "raflags", is very 1442 * differnet between RA prefix list and RR/static prefix list. 1443 * how about separating ioctls into two? 1444 */ 1445 bzero(oprl, sizeof(*oprl)); 1446 s = splsoftnet(); 1447 pr = nd_prefix.lh_first; 1448 while (pr && i < PRLSTSIZ) { 1449 struct nd_pfxrouter *pfr; 1450 int j; 1451 1452 oprl->prefix[i].prefix = pr->ndpr_prefix.sin6_addr; 1453 oprl->prefix[i].raflags = pr->ndpr_raf; 1454 oprl->prefix[i].prefixlen = pr->ndpr_plen; 1455 oprl->prefix[i].vltime = pr->ndpr_vltime; 1456 oprl->prefix[i].pltime = pr->ndpr_pltime; 1457 oprl->prefix[i].if_index = pr->ndpr_ifp->if_index; 1458 if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME) 1459 oprl->prefix[i].expire = 0; 1460 else { 1461 time_t maxexpire; 1462 1463 /* XXX: we assume time_t is signed. */ 1464 maxexpire = (-1) & 1465 ~((time_t)1 << 1466 ((sizeof(maxexpire) * 8) - 1)); 1467 if (pr->ndpr_vltime < 1468 maxexpire - pr->ndpr_lastupdate) { 1469 oprl->prefix[i].expire = 1470 pr->ndpr_lastupdate + 1471 pr->ndpr_vltime; 1472 } else 1473 oprl->prefix[i].expire = maxexpire; 1474 } 1475 1476 pfr = pr->ndpr_advrtrs.lh_first; 1477 j = 0; 1478 while (pfr) { 1479 if (j < DRLSTSIZ) { 1480 #define RTRADDR oprl->prefix[i].advrtr[j] 1481 RTRADDR = pfr->router->rtaddr; 1482 in6_clearscope(&RTRADDR); 1483 #undef RTRADDR 1484 } 1485 j++; 1486 pfr = pfr->pfr_next; 1487 } 1488 oprl->prefix[i].advrtrs = j; 1489 oprl->prefix[i].origin = PR_ORIG_RA; 1490 1491 i++; 1492 pr = pr->ndpr_next; 1493 } 1494 splx(s); 1495 1496 break; 1497 case OSIOCGIFINFO_IN6: 1498 #define ND ndi->ndi 1499 /* XXX: old ndp(8) assumes a positive value for linkmtu. */ 1500 memset(&ND, 0, sizeof(ND)); 1501 ND.linkmtu = IN6_LINKMTU(ifp); 1502 ND.maxmtu = ND_IFINFO(ifp)->maxmtu; 1503 ND.basereachable = ND_IFINFO(ifp)->basereachable; 1504 ND.reachable = ND_IFINFO(ifp)->reachable; 1505 ND.retrans = ND_IFINFO(ifp)->retrans; 1506 ND.flags = ND_IFINFO(ifp)->flags; 1507 ND.recalctm = ND_IFINFO(ifp)->recalctm; 1508 ND.chlim = ND_IFINFO(ifp)->chlim; 1509 break; 1510 case SIOCGIFINFO_IN6: 1511 ND = *ND_IFINFO(ifp); 1512 break; 1513 case SIOCSIFINFO_IN6: 1514 /* 1515 * used to change host variables from userland. 1516 * intented for a use on router to reflect RA configurations. 1517 */ 1518 /* 0 means 'unspecified' */ 1519 if (ND.linkmtu != 0) { 1520 if (ND.linkmtu < IPV6_MMTU || 1521 ND.linkmtu > IN6_LINKMTU(ifp)) { 1522 error = EINVAL; 1523 break; 1524 } 1525 ND_IFINFO(ifp)->linkmtu = ND.linkmtu; 1526 } 1527 1528 if (ND.basereachable != 0) { 1529 int obasereachable = ND_IFINFO(ifp)->basereachable; 1530 1531 ND_IFINFO(ifp)->basereachable = ND.basereachable; 1532 if (ND.basereachable != obasereachable) 1533 ND_IFINFO(ifp)->reachable = 1534 ND_COMPUTE_RTIME(ND.basereachable); 1535 } 1536 if (ND.retrans != 0) 1537 ND_IFINFO(ifp)->retrans = ND.retrans; 1538 if (ND.chlim != 0) 1539 ND_IFINFO(ifp)->chlim = ND.chlim; 1540 /* FALLTHROUGH */ 1541 case SIOCSIFINFO_FLAGS: 1542 ND_IFINFO(ifp)->flags = ND.flags; 1543 break; 1544 #undef ND 1545 case SIOCSNDFLUSH_IN6: /* XXX: the ioctl name is confusing... */ 1546 /* sync kernel routing table with the default router list */ 1547 defrouter_reset(); 1548 defrouter_select(); 1549 break; 1550 case SIOCSPFXFLUSH_IN6: 1551 { 1552 /* flush all the prefix advertised by routers */ 1553 struct nd_prefix *pfx, *next; 1554 1555 s = splsoftnet(); 1556 for (pfx = nd_prefix.lh_first; pfx; pfx = next) { 1557 struct in6_ifaddr *ia, *ia_next; 1558 1559 next = pfx->ndpr_next; 1560 1561 if (IN6_IS_ADDR_LINKLOCAL(&pfx->ndpr_prefix.sin6_addr)) 1562 continue; /* XXX */ 1563 1564 /* do we really have to remove addresses as well? */ 1565 for (ia = in6_ifaddr; ia; ia = ia_next) { 1566 /* ia might be removed. keep the next ptr. */ 1567 ia_next = ia->ia_next; 1568 1569 if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0) 1570 continue; 1571 1572 if (ia->ia6_ndpr == pfx) 1573 in6_purgeaddr(&ia->ia_ifa); 1574 } 1575 prelist_remove(pfx); 1576 } 1577 splx(s); 1578 break; 1579 } 1580 case SIOCSRTRFLUSH_IN6: 1581 { 1582 /* flush all the default routers */ 1583 struct nd_defrouter *drtr, *next; 1584 1585 s = splsoftnet(); 1586 defrouter_reset(); 1587 for (drtr = TAILQ_FIRST(&nd_defrouter); drtr; drtr = next) { 1588 next = TAILQ_NEXT(drtr, dr_entry); 1589 defrtrlist_del(drtr); 1590 } 1591 defrouter_select(); 1592 splx(s); 1593 break; 1594 } 1595 case SIOCGNBRINFO_IN6: 1596 { 1597 struct llinfo_nd6 *ln; 1598 struct in6_addr nb_addr = nbi->addr; /* make local for safety */ 1599 1600 if ((error = in6_setscope(&nb_addr, ifp, NULL)) != 0) 1601 return (error); 1602 1603 s = splsoftnet(); 1604 if ((rt = nd6_lookup(&nb_addr, 0, ifp)) == NULL || 1605 (ln = (struct llinfo_nd6 *)rt->rt_llinfo) == NULL) { 1606 error = EINVAL; 1607 splx(s); 1608 break; 1609 } 1610 nbi->state = ln->ln_state; 1611 nbi->asked = ln->ln_asked; 1612 nbi->isrouter = ln->ln_router; 1613 nbi->expire = ln->ln_expire; 1614 splx(s); 1615 1616 break; 1617 } 1618 case SIOCGDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */ 1619 ndif->ifindex = nd6_defifindex; 1620 break; 1621 case SIOCSDEFIFACE_IN6: /* XXX: should be implemented as a sysctl? */ 1622 return (nd6_setdefaultiface(ndif->ifindex)); 1623 } 1624 return (error); 1625 } 1626 1627 /* 1628 * Create neighbor cache entry and cache link-layer address, 1629 * on reception of inbound ND6 packets. (RS/RA/NS/redirect) 1630 */ 1631 struct rtentry * 1632 nd6_cache_lladdr( 1633 struct ifnet *ifp, 1634 struct in6_addr *from, 1635 char *lladdr, 1636 int lladdrlen __unused, 1637 int type, /* ICMP6 type */ 1638 int code /* type dependent information */ 1639 ) 1640 { 1641 struct rtentry *rt = NULL; 1642 struct llinfo_nd6 *ln = NULL; 1643 int is_newentry; 1644 struct sockaddr_dl *sdl = NULL; 1645 int do_update; 1646 int olladdr; 1647 int llchange; 1648 int newstate = 0; 1649 1650 if (ifp == NULL) 1651 panic("ifp == NULL in nd6_cache_lladdr"); 1652 if (from == NULL) 1653 panic("from == NULL in nd6_cache_lladdr"); 1654 1655 /* nothing must be updated for unspecified address */ 1656 if (IN6_IS_ADDR_UNSPECIFIED(from)) 1657 return NULL; 1658 1659 /* 1660 * Validation about ifp->if_addrlen and lladdrlen must be done in 1661 * the caller. 1662 * 1663 * XXX If the link does not have link-layer adderss, what should 1664 * we do? (ifp->if_addrlen == 0) 1665 * Spec says nothing in sections for RA, RS and NA. There's small 1666 * description on it in NS section (RFC 2461 7.2.3). 1667 */ 1668 1669 rt = nd6_lookup(from, 0, ifp); 1670 if (rt == NULL) { 1671 #if 0 1672 /* nothing must be done if there's no lladdr */ 1673 if (!lladdr || !lladdrlen) 1674 return NULL; 1675 #endif 1676 1677 rt = nd6_lookup(from, 1, ifp); 1678 is_newentry = 1; 1679 } else { 1680 /* do nothing if static ndp is set */ 1681 if (rt->rt_flags & RTF_STATIC) 1682 return NULL; 1683 is_newentry = 0; 1684 } 1685 1686 if (rt == NULL) 1687 return NULL; 1688 if ((rt->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) != RTF_LLINFO) { 1689 fail: 1690 (void)nd6_free(rt, 0); 1691 return NULL; 1692 } 1693 ln = (struct llinfo_nd6 *)rt->rt_llinfo; 1694 if (ln == NULL) 1695 goto fail; 1696 if (rt->rt_gateway == NULL) 1697 goto fail; 1698 if (rt->rt_gateway->sa_family != AF_LINK) 1699 goto fail; 1700 sdl = SDL(rt->rt_gateway); 1701 1702 olladdr = (sdl->sdl_alen) ? 1 : 0; 1703 if (olladdr && lladdr) { 1704 if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen)) 1705 llchange = 1; 1706 else 1707 llchange = 0; 1708 } else 1709 llchange = 0; 1710 1711 /* 1712 * newentry olladdr lladdr llchange (*=record) 1713 * 0 n n -- (1) 1714 * 0 y n -- (2) 1715 * 0 n y -- (3) * STALE 1716 * 0 y y n (4) * 1717 * 0 y y y (5) * STALE 1718 * 1 -- n -- (6) NOSTATE(= PASSIVE) 1719 * 1 -- y -- (7) * STALE 1720 */ 1721 1722 if (lladdr) { /* (3-5) and (7) */ 1723 /* 1724 * Record source link-layer address 1725 * XXX is it dependent to ifp->if_type? 1726 */ 1727 sdl->sdl_alen = ifp->if_addrlen; 1728 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); 1729 } 1730 1731 if (!is_newentry) { 1732 if ((!olladdr && lladdr) || /* (3) */ 1733 (olladdr && lladdr && llchange)) { /* (5) */ 1734 do_update = 1; 1735 newstate = ND6_LLINFO_STALE; 1736 } else /* (1-2,4) */ 1737 do_update = 0; 1738 } else { 1739 do_update = 1; 1740 if (lladdr == NULL) /* (6) */ 1741 newstate = ND6_LLINFO_NOSTATE; 1742 else /* (7) */ 1743 newstate = ND6_LLINFO_STALE; 1744 } 1745 1746 if (do_update) { 1747 /* 1748 * Update the state of the neighbor cache. 1749 */ 1750 ln->ln_state = newstate; 1751 1752 if (ln->ln_state == ND6_LLINFO_STALE) { 1753 /* 1754 * XXX: since nd6_output() below will cause 1755 * state tansition to DELAY and reset the timer, 1756 * we must set the timer now, although it is actually 1757 * meaningless. 1758 */ 1759 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 1760 1761 if (ln->ln_hold) { 1762 struct mbuf *m_hold, *m_hold_next; 1763 for (m_hold = ln->ln_hold; m_hold; 1764 m_hold = m_hold_next) { 1765 struct mbuf *mpkt = NULL; 1766 1767 m_hold_next = m_hold->m_nextpkt; 1768 mpkt = m_copym(m_hold, 0, M_COPYALL, M_DONTWAIT); 1769 if (mpkt == NULL) { 1770 m_freem(m_hold); 1771 break; 1772 } 1773 mpkt->m_nextpkt = NULL; 1774 1775 /* 1776 * we assume ifp is not a p2p here, so 1777 * just set the 2nd argument as the 1778 * 1st one. 1779 */ 1780 nd6_output(ifp, ifp, mpkt, 1781 (struct sockaddr_in6 *)rt_key(rt), 1782 rt); 1783 } 1784 ln->ln_hold = NULL; 1785 } 1786 } else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) { 1787 /* probe right away */ 1788 nd6_llinfo_settimer((void *)ln, 0); 1789 } 1790 } 1791 1792 /* 1793 * ICMP6 type dependent behavior. 1794 * 1795 * NS: clear IsRouter if new entry 1796 * RS: clear IsRouter 1797 * RA: set IsRouter if there's lladdr 1798 * redir: clear IsRouter if new entry 1799 * 1800 * RA case, (1): 1801 * The spec says that we must set IsRouter in the following cases: 1802 * - If lladdr exist, set IsRouter. This means (1-5). 1803 * - If it is old entry (!newentry), set IsRouter. This means (7). 1804 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter. 1805 * A quetion arises for (1) case. (1) case has no lladdr in the 1806 * neighbor cache, this is similar to (6). 1807 * This case is rare but we figured that we MUST NOT set IsRouter. 1808 * 1809 * newentry olladdr lladdr llchange NS RS RA redir 1810 * D R 1811 * 0 n n -- (1) c ? s 1812 * 0 y n -- (2) c s s 1813 * 0 n y -- (3) c s s 1814 * 0 y y n (4) c s s 1815 * 0 y y y (5) c s s 1816 * 1 -- n -- (6) c c c s 1817 * 1 -- y -- (7) c c s c s 1818 * 1819 * (c=clear s=set) 1820 */ 1821 switch (type & 0xff) { 1822 case ND_NEIGHBOR_SOLICIT: 1823 /* 1824 * New entry must have is_router flag cleared. 1825 */ 1826 if (is_newentry) /* (6-7) */ 1827 ln->ln_router = 0; 1828 break; 1829 case ND_REDIRECT: 1830 /* 1831 * If the icmp is a redirect to a better router, always set the 1832 * is_router flag. Otherwise, if the entry is newly created, 1833 * clear the flag. [RFC 2461, sec 8.3] 1834 */ 1835 if (code == ND_REDIRECT_ROUTER) 1836 ln->ln_router = 1; 1837 else if (is_newentry) /* (6-7) */ 1838 ln->ln_router = 0; 1839 break; 1840 case ND_ROUTER_SOLICIT: 1841 /* 1842 * is_router flag must always be cleared. 1843 */ 1844 ln->ln_router = 0; 1845 break; 1846 case ND_ROUTER_ADVERT: 1847 /* 1848 * Mark an entry with lladdr as a router. 1849 */ 1850 if ((!is_newentry && (olladdr || lladdr)) || /* (2-5) */ 1851 (is_newentry && lladdr)) { /* (7) */ 1852 ln->ln_router = 1; 1853 } 1854 break; 1855 } 1856 1857 /* 1858 * When the link-layer address of a router changes, select the 1859 * best router again. In particular, when the neighbor entry is newly 1860 * created, it might affect the selection policy. 1861 * Question: can we restrict the first condition to the "is_newentry" 1862 * case? 1863 * XXX: when we hear an RA from a new router with the link-layer 1864 * address option, defrouter_select() is called twice, since 1865 * defrtrlist_update called the function as well. However, I believe 1866 * we can compromise the overhead, since it only happens the first 1867 * time. 1868 * XXX: although defrouter_select() should not have a bad effect 1869 * for those are not autoconfigured hosts, we explicitly avoid such 1870 * cases for safety. 1871 */ 1872 if (do_update && ln->ln_router && !ip6_forwarding && ip6_accept_rtadv) 1873 defrouter_select(); 1874 1875 return rt; 1876 } 1877 1878 static void 1879 nd6_slowtimo(void *ignored_arg __unused) 1880 { 1881 int s = splsoftnet(); 1882 struct nd_ifinfo *nd6if; 1883 struct ifnet *ifp; 1884 1885 callout_reset(&nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz, 1886 nd6_slowtimo, NULL); 1887 for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list)) 1888 { 1889 nd6if = ND_IFINFO(ifp); 1890 if (nd6if->basereachable && /* already initialized */ 1891 (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) { 1892 /* 1893 * Since reachable time rarely changes by router 1894 * advertisements, we SHOULD insure that a new random 1895 * value gets recomputed at least once every few hours. 1896 * (RFC 2461, 6.3.4) 1897 */ 1898 nd6if->recalctm = nd6_recalc_reachtm_interval; 1899 nd6if->reachable = ND_COMPUTE_RTIME(nd6if->basereachable); 1900 } 1901 } 1902 splx(s); 1903 } 1904 1905 #define senderr(e) { error = (e); goto bad;} 1906 int 1907 nd6_output(ifp, origifp, m0, dst, rt0) 1908 struct ifnet *ifp; 1909 struct ifnet *origifp; 1910 struct mbuf *m0; 1911 struct sockaddr_in6 *dst; 1912 struct rtentry *rt0; 1913 { 1914 struct mbuf *m = m0; 1915 struct rtentry *rt = rt0; 1916 struct sockaddr_in6 *gw6 = NULL; 1917 struct llinfo_nd6 *ln = NULL; 1918 int error = 0; 1919 1920 if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr)) 1921 goto sendpkt; 1922 1923 if (nd6_need_cache(ifp) == 0) 1924 goto sendpkt; 1925 1926 /* 1927 * next hop determination. This routine is derived from ether_output. 1928 */ 1929 if (rt) { 1930 if ((rt->rt_flags & RTF_UP) == 0) { 1931 if ((rt0 = rt = rtalloc1((struct sockaddr *)dst, 1932 1)) != NULL) 1933 { 1934 rt->rt_refcnt--; 1935 if (rt->rt_ifp != ifp) 1936 senderr(EHOSTUNREACH); 1937 } else 1938 senderr(EHOSTUNREACH); 1939 } 1940 1941 if (rt->rt_flags & RTF_GATEWAY) { 1942 gw6 = (struct sockaddr_in6 *)rt->rt_gateway; 1943 1944 /* 1945 * We skip link-layer address resolution and NUD 1946 * if the gateway is not a neighbor from ND point 1947 * of view, regardless of the value of nd_ifinfo.flags. 1948 * The second condition is a bit tricky; we skip 1949 * if the gateway is our own address, which is 1950 * sometimes used to install a route to a p2p link. 1951 */ 1952 if (!nd6_is_addr_neighbor(gw6, ifp) || 1953 in6ifa_ifpwithaddr(ifp, &gw6->sin6_addr)) { 1954 /* 1955 * We allow this kind of tricky route only 1956 * when the outgoing interface is p2p. 1957 * XXX: we may need a more generic rule here. 1958 */ 1959 if ((ifp->if_flags & IFF_POINTOPOINT) == 0) 1960 senderr(EHOSTUNREACH); 1961 1962 goto sendpkt; 1963 } 1964 1965 if (rt->rt_gwroute == 0) 1966 goto lookup; 1967 if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) { 1968 rtfree(rt); rt = rt0; 1969 lookup: 1970 rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1); 1971 if ((rt = rt->rt_gwroute) == 0) 1972 senderr(EHOSTUNREACH); 1973 /* the "G" test below also prevents rt == rt0 */ 1974 if ((rt->rt_flags & RTF_GATEWAY) || 1975 (rt->rt_ifp != ifp)) { 1976 rt->rt_refcnt--; 1977 rt0->rt_gwroute = 0; 1978 senderr(EHOSTUNREACH); 1979 } 1980 } 1981 } 1982 } 1983 1984 /* 1985 * Address resolution or Neighbor Unreachability Detection 1986 * for the next hop. 1987 * At this point, the destination of the packet must be a unicast 1988 * or an anycast address(i.e. not a multicast). 1989 */ 1990 1991 /* Look up the neighbor cache for the nexthop */ 1992 if (rt && (rt->rt_flags & RTF_LLINFO) != 0) 1993 ln = (struct llinfo_nd6 *)rt->rt_llinfo; 1994 else { 1995 /* 1996 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(), 1997 * the condition below is not very efficient. But we believe 1998 * it is tolerable, because this should be a rare case. 1999 */ 2000 if (nd6_is_addr_neighbor(dst, ifp) && 2001 (rt = nd6_lookup(&dst->sin6_addr, 1, ifp)) != NULL) 2002 ln = (struct llinfo_nd6 *)rt->rt_llinfo; 2003 } 2004 if (ln == NULL || rt == NULL) { 2005 if ((ifp->if_flags & IFF_POINTOPOINT) == 0 && 2006 !(ND_IFINFO(ifp)->flags & ND6_IFF_PERFORMNUD)) { 2007 log(LOG_DEBUG, 2008 "nd6_output: can't allocate llinfo for %s " 2009 "(ln=%p, rt=%p)\n", 2010 ip6_sprintf(&dst->sin6_addr), ln, rt); 2011 senderr(EIO); /* XXX: good error? */ 2012 } 2013 2014 goto sendpkt; /* send anyway */ 2015 } 2016 2017 /* We don't have to do link-layer address resolution on a p2p link. */ 2018 if ((ifp->if_flags & IFF_POINTOPOINT) != 0 && 2019 ln->ln_state < ND6_LLINFO_REACHABLE) { 2020 ln->ln_state = ND6_LLINFO_STALE; 2021 nd6_llinfo_settimer(ln, (long)nd6_gctimer * hz); 2022 } 2023 2024 /* 2025 * The first time we send a packet to a neighbor whose entry is 2026 * STALE, we have to change the state to DELAY and a sets a timer to 2027 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do 2028 * neighbor unreachability detection on expiration. 2029 * (RFC 2461 7.3.3) 2030 */ 2031 if (ln->ln_state == ND6_LLINFO_STALE) { 2032 ln->ln_asked = 0; 2033 ln->ln_state = ND6_LLINFO_DELAY; 2034 nd6_llinfo_settimer(ln, (long)nd6_delay * hz); 2035 } 2036 2037 /* 2038 * If the neighbor cache entry has a state other than INCOMPLETE 2039 * (i.e. its link-layer address is already resolved), just 2040 * send the packet. 2041 */ 2042 if (ln->ln_state > ND6_LLINFO_INCOMPLETE) 2043 goto sendpkt; 2044 2045 /* 2046 * There is a neighbor cache entry, but no ethernet address 2047 * response yet. Append this latest packet to the end of the 2048 * packet queue in the mbuf, unless the number of the packet 2049 * does not exceed nd6_maxqueuelen. When it exceeds nd6_maxqueuelen, 2050 * the oldest packet in the queue will be removed. 2051 */ 2052 if (ln->ln_state == ND6_LLINFO_NOSTATE) 2053 ln->ln_state = ND6_LLINFO_INCOMPLETE; 2054 if (ln->ln_hold) { 2055 struct mbuf *m_hold; 2056 int i; 2057 2058 i = 0; 2059 for (m_hold = ln->ln_hold; m_hold; m_hold = m_hold->m_nextpkt) { 2060 i++; 2061 if (m_hold->m_nextpkt == NULL) { 2062 m_hold->m_nextpkt = m; 2063 break; 2064 } 2065 } 2066 while (i >= nd6_maxqueuelen) { 2067 m_hold = ln->ln_hold; 2068 ln->ln_hold = ln->ln_hold->m_nextpkt; 2069 m_freem(m_hold); 2070 i--; 2071 } 2072 } else { 2073 ln->ln_hold = m; 2074 } 2075 2076 /* 2077 * If there has been no NS for the neighbor after entering the 2078 * INCOMPLETE state, send the first solicitation. 2079 */ 2080 if (!ND6_LLINFO_PERMANENT(ln) && ln->ln_asked == 0) { 2081 ln->ln_asked++; 2082 nd6_llinfo_settimer(ln, 2083 (long)ND_IFINFO(ifp)->retrans * hz / 1000); 2084 nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, 0); 2085 } 2086 return (0); 2087 2088 sendpkt: 2089 /* discard the packet if IPv6 operation is disabled on the interface */ 2090 if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) { 2091 error = ENETDOWN; /* better error? */ 2092 goto bad; 2093 } 2094 2095 #ifdef IPSEC 2096 /* clean ipsec history once it goes out of the node */ 2097 ipsec_delaux(m); 2098 #endif 2099 if ((ifp->if_flags & IFF_LOOPBACK) != 0) { 2100 return ((*ifp->if_output)(origifp, m, (struct sockaddr *)dst, 2101 rt)); 2102 } 2103 return ((*ifp->if_output)(ifp, m, (struct sockaddr *)dst, rt)); 2104 2105 bad: 2106 if (m) 2107 m_freem(m); 2108 return (error); 2109 } 2110 #undef senderr 2111 2112 int 2113 nd6_need_cache(ifp) 2114 struct ifnet *ifp; 2115 { 2116 /* 2117 * XXX: we currently do not make neighbor cache on any interface 2118 * other than ARCnet, Ethernet, FDDI and GIF. 2119 * 2120 * RFC2893 says: 2121 * - unidirectional tunnels needs no ND 2122 */ 2123 switch (ifp->if_type) { 2124 case IFT_ARCNET: 2125 case IFT_ETHER: 2126 case IFT_FDDI: 2127 case IFT_IEEE1394: 2128 case IFT_CARP: 2129 case IFT_GIF: /* XXX need more cases? */ 2130 case IFT_PPP: 2131 case IFT_TUNNEL: 2132 return (1); 2133 default: 2134 return (0); 2135 } 2136 } 2137 2138 int 2139 nd6_storelladdr(ifp, rt, m, dst, desten) 2140 struct ifnet *ifp; 2141 struct rtentry *rt; 2142 struct mbuf *m; 2143 struct sockaddr *dst; 2144 u_char *desten; 2145 { 2146 struct sockaddr_dl *sdl; 2147 2148 if (m->m_flags & M_MCAST) { 2149 switch (ifp->if_type) { 2150 case IFT_ETHER: 2151 case IFT_FDDI: 2152 ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr, 2153 desten); 2154 return (1); 2155 case IFT_IEEE1394: 2156 bcopy(ifp->if_broadcastaddr, desten, ifp->if_addrlen); 2157 return (1); 2158 case IFT_ARCNET: 2159 *desten = 0; 2160 return (1); 2161 default: 2162 m_freem(m); 2163 return (0); 2164 } 2165 } 2166 2167 if (rt == NULL) { 2168 /* this could happen, if we could not allocate memory */ 2169 m_freem(m); 2170 return (0); 2171 } 2172 if (rt->rt_gateway->sa_family != AF_LINK) { 2173 printf("nd6_storelladdr: something odd happens\n"); 2174 m_freem(m); 2175 return (0); 2176 } 2177 sdl = SDL(rt->rt_gateway); 2178 if (sdl->sdl_alen == 0) { 2179 /* this should be impossible, but we bark here for debugging */ 2180 printf("nd6_storelladdr: sdl_alen == 0, dst=%s, if=%s\n", 2181 ip6_sprintf(&SIN6(dst)->sin6_addr), if_name(ifp)); 2182 m_freem(m); 2183 return (0); 2184 } 2185 2186 bcopy(LLADDR(sdl), desten, sdl->sdl_alen); 2187 return (1); 2188 } 2189 2190 static void 2191 clear_llinfo_pqueue(ln) 2192 struct llinfo_nd6 *ln; 2193 { 2194 struct mbuf *m_hold, *m_hold_next; 2195 2196 for (m_hold = ln->ln_hold; m_hold; m_hold = m_hold_next) { 2197 m_hold_next = m_hold->m_nextpkt; 2198 m_hold->m_nextpkt = NULL; 2199 m_freem(m_hold); 2200 } 2201 2202 ln->ln_hold = NULL; 2203 return; 2204 } 2205 2206 int 2207 nd6_sysctl( 2208 int name, 2209 void *oldp, /* syscall arg, need copyout */ 2210 size_t *oldlenp, 2211 void *newp, /* syscall arg, need copyin */ 2212 size_t newlen __unused 2213 ) 2214 { 2215 void *p; 2216 size_t ol; 2217 int error; 2218 2219 error = 0; 2220 2221 if (newp) 2222 return EPERM; 2223 if (oldp && !oldlenp) 2224 return EINVAL; 2225 ol = oldlenp ? *oldlenp : 0; 2226 2227 if (oldp) { 2228 p = malloc(*oldlenp, M_TEMP, M_WAITOK); 2229 if (p == NULL) 2230 return ENOMEM; 2231 } else 2232 p = NULL; 2233 switch (name) { 2234 case ICMPV6CTL_ND6_DRLIST: 2235 error = fill_drlist(p, oldlenp, ol); 2236 if (!error && p != NULL && oldp != NULL) 2237 error = copyout(p, oldp, *oldlenp); 2238 break; 2239 2240 case ICMPV6CTL_ND6_PRLIST: 2241 error = fill_prlist(p, oldlenp, ol); 2242 if (!error && p != NULL && oldp != NULL) 2243 error = copyout(p, oldp, *oldlenp); 2244 break; 2245 2246 case ICMPV6CTL_ND6_MAXQLEN: 2247 break; 2248 2249 default: 2250 error = ENOPROTOOPT; 2251 break; 2252 } 2253 if (p) 2254 free(p, M_TEMP); 2255 2256 return (error); 2257 } 2258 2259 static int 2260 fill_drlist(oldp, oldlenp, ol) 2261 void *oldp; 2262 size_t *oldlenp, ol; 2263 { 2264 int error = 0, s; 2265 struct in6_defrouter *d = NULL, *de = NULL; 2266 struct nd_defrouter *dr; 2267 size_t l; 2268 2269 s = splsoftnet(); 2270 2271 if (oldp) { 2272 d = (struct in6_defrouter *)oldp; 2273 de = (struct in6_defrouter *)((caddr_t)oldp + *oldlenp); 2274 } 2275 l = 0; 2276 2277 for (dr = TAILQ_FIRST(&nd_defrouter); dr; 2278 dr = TAILQ_NEXT(dr, dr_entry)) { 2279 2280 if (oldp && d + 1 <= de) { 2281 bzero(d, sizeof(*d)); 2282 d->rtaddr.sin6_family = AF_INET6; 2283 d->rtaddr.sin6_len = sizeof(struct sockaddr_in6); 2284 d->rtaddr.sin6_addr = dr->rtaddr; 2285 if (sa6_recoverscope(&d->rtaddr)) { 2286 log(LOG_ERR, 2287 "scope error in router list (%s)\n", 2288 ip6_sprintf(&d->rtaddr.sin6_addr)); 2289 /* XXX: press on... */ 2290 } 2291 d->flags = dr->flags; 2292 d->rtlifetime = dr->rtlifetime; 2293 d->expire = dr->expire; 2294 d->if_index = dr->ifp->if_index; 2295 } 2296 2297 l += sizeof(*d); 2298 if (d) 2299 d++; 2300 } 2301 2302 if (oldp) { 2303 if (l > ol) 2304 error = ENOMEM; 2305 } 2306 if (oldlenp) 2307 *oldlenp = l; /* (caddr_t)d - (caddr_t)oldp */ 2308 2309 splx(s); 2310 2311 return (error); 2312 } 2313 2314 static int 2315 fill_prlist(oldp, oldlenp, ol) 2316 void *oldp; 2317 size_t *oldlenp, ol; 2318 { 2319 int error = 0, s; 2320 struct nd_prefix *pr; 2321 struct in6_prefix *p = NULL; 2322 struct in6_prefix *pe = NULL; 2323 size_t l; 2324 2325 s = splsoftnet(); 2326 2327 if (oldp) { 2328 p = (struct in6_prefix *)oldp; 2329 pe = (struct in6_prefix *)((caddr_t)oldp + *oldlenp); 2330 } 2331 l = 0; 2332 2333 for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) { 2334 u_short advrtrs; 2335 size_t advance; 2336 struct sockaddr_in6 *sin6; 2337 struct sockaddr_in6 *s6; 2338 struct nd_pfxrouter *pfr; 2339 2340 if (oldp && p + 1 <= pe) 2341 { 2342 bzero(p, sizeof(*p)); 2343 sin6 = (struct sockaddr_in6 *)(p + 1); 2344 2345 p->prefix = pr->ndpr_prefix; 2346 if (sa6_recoverscope(&p->prefix)) { 2347 log(LOG_ERR, 2348 "scope error in prefix list (%s)\n", 2349 ip6_sprintf(&p->prefix.sin6_addr)); 2350 /* XXX: press on... */ 2351 } 2352 p->raflags = pr->ndpr_raf; 2353 p->prefixlen = pr->ndpr_plen; 2354 p->vltime = pr->ndpr_vltime; 2355 p->pltime = pr->ndpr_pltime; 2356 p->if_index = pr->ndpr_ifp->if_index; 2357 if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME) 2358 p->expire = 0; 2359 else { 2360 time_t maxexpire; 2361 2362 /* XXX: we assume time_t is signed. */ 2363 maxexpire = (-1) & 2364 ~((time_t)1 << 2365 ((sizeof(maxexpire) * 8) - 1)); 2366 if (pr->ndpr_vltime < 2367 maxexpire - pr->ndpr_lastupdate) { 2368 p->expire = pr->ndpr_lastupdate + 2369 pr->ndpr_vltime; 2370 } else 2371 p->expire = maxexpire; 2372 } 2373 p->refcnt = pr->ndpr_refcnt; 2374 p->flags = pr->ndpr_stateflags; 2375 p->origin = PR_ORIG_RA; 2376 advrtrs = 0; 2377 for (pfr = pr->ndpr_advrtrs.lh_first; pfr; 2378 pfr = pfr->pfr_next) { 2379 if ((void *)&sin6[advrtrs + 1] > (void *)pe) { 2380 advrtrs++; 2381 continue; 2382 } 2383 s6 = &sin6[advrtrs]; 2384 s6->sin6_family = AF_INET6; 2385 s6->sin6_len = sizeof(struct sockaddr_in6); 2386 s6->sin6_addr = pfr->router->rtaddr; 2387 s6->sin6_scope_id = 0; 2388 if (sa6_recoverscope(s6)) { 2389 log(LOG_ERR, 2390 "scope error in " 2391 "prefix list (%s)\n", 2392 ip6_sprintf(&pfr->router->rtaddr)); 2393 } 2394 advrtrs++; 2395 } 2396 p->advrtrs = advrtrs; 2397 } 2398 else { 2399 advrtrs = 0; 2400 for (pfr = pr->ndpr_advrtrs.lh_first; pfr; 2401 pfr = pfr->pfr_next) 2402 advrtrs++; 2403 } 2404 2405 advance = sizeof(*p) + sizeof(*sin6) * advrtrs; 2406 l += advance; 2407 if (p) 2408 p = (struct in6_prefix *)((caddr_t)p + advance); 2409 } 2410 2411 if (oldp) { 2412 *oldlenp = l; /* (caddr_t)d - (caddr_t)oldp */ 2413 if (l > ol) 2414 error = ENOMEM; 2415 } else 2416 *oldlenp = l; 2417 2418 splx(s); 2419 2420 return (error); 2421 } 2422