1 /* $FreeBSD: src/sys/netinet6/nd6_nbr.c,v 1.4.2.6 2003/01/23 21:06:47 sam Exp $ */
2 /* $DragonFly: src/sys/netinet6/nd6_nbr.c,v 1.18 2006/12/23 00:57:53 swildner Exp $ */
3 /* $KAME: nd6_nbr.c,v 1.86 2002/01/21 02:33:04 jinmei Exp $ */
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 #include "opt_inet6.h"
36 #include "opt_ipsec.h"
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/malloc.h>
42 #include <sys/socket.h>
43 #include <sys/sockio.h>
45 #include <sys/kernel.h>
46 #include <sys/errno.h>
47 #include <sys/syslog.h>
48 #include <sys/queue.h>
49 #include <sys/callout.h>
50 #include <sys/thread2.h>
53 #include <net/if_types.h>
54 #include <net/if_dl.h>
55 #include <net/route.h>
57 #include <netinet/in.h>
58 #include <netinet/in_var.h>
59 #include <netinet6/in6_var.h>
60 #include <netinet/ip6.h>
61 #include <netinet6/ip6_var.h>
62 #include <netinet6/nd6.h>
63 #include <netinet/icmp6.h>
66 #include <netinet6/ipsec.h>
68 #include <netinet6/ipsec6.h>
72 #include <net/net_osdep.h>
74 #define SDL(s) ((struct sockaddr_dl *)s)
77 static struct dadq
*nd6_dad_find (struct ifaddr
*);
78 static void nd6_dad_starttimer (struct dadq
*, int);
79 static void nd6_dad_stoptimer (struct dadq
*);
80 static void nd6_dad_timer (struct ifaddr
*);
81 static void nd6_dad_ns_output (struct dadq
*, struct ifaddr
*);
82 static void nd6_dad_ns_input (struct ifaddr
*);
83 static void nd6_dad_na_input (struct ifaddr
*);
85 static int dad_ignore_ns
= 0; /* ignore NS in DAD - specwise incorrect*/
86 static int dad_maxtry
= 15; /* max # of *tries* to transmit DAD packet */
89 * Input an Neighbor Solicitation Message.
92 * Based on RFC 2462 (duplicated address detection)
95 nd6_ns_input(struct mbuf
*m
, int off
, int icmp6len
)
97 struct ifnet
*ifp
= m
->m_pkthdr
.rcvif
;
98 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
99 struct nd_neighbor_solicit
*nd_ns
;
100 struct in6_addr saddr6
= ip6
->ip6_src
;
101 struct in6_addr daddr6
= ip6
->ip6_dst
;
102 struct in6_addr taddr6
;
103 struct in6_addr myaddr6
;
107 int anycast
= 0, proxy
= 0, tentative
= 0;
109 union nd_opts ndopts
;
110 struct sockaddr_dl
*proxydl
= NULL
;
112 #ifndef PULLDOWN_TEST
113 IP6_EXTHDR_CHECK(m
, off
, icmp6len
,);
114 nd_ns
= (struct nd_neighbor_solicit
*)((caddr_t
)ip6
+ off
);
116 IP6_EXTHDR_GET(nd_ns
, struct nd_neighbor_solicit
*, m
, off
, icmp6len
);
118 icmp6stat
.icp6s_tooshort
++;
122 ip6
= mtod(m
, struct ip6_hdr
*); /* adjust pointer for safety */
123 taddr6
= nd_ns
->nd_ns_target
;
125 if (ip6
->ip6_hlim
!= 255) {
127 "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n",
128 ip6
->ip6_hlim
, ip6_sprintf(&ip6
->ip6_src
),
129 ip6_sprintf(&ip6
->ip6_dst
), if_name(ifp
)));
133 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6
)) {
134 /* dst has to be solicited node multicast address. */
135 if (daddr6
.s6_addr16
[0] == IPV6_ADDR_INT16_MLL
136 /* don't check ifindex portion */
137 && daddr6
.s6_addr32
[1] == 0
138 && daddr6
.s6_addr32
[2] == IPV6_ADDR_INT32_ONE
139 && daddr6
.s6_addr8
[12] == 0xff) {
142 nd6log((LOG_INFO
, "nd6_ns_input: bad DAD packet "
143 "(wrong ip6 dst)\n"));
148 if (IN6_IS_ADDR_MULTICAST(&taddr6
)) {
149 nd6log((LOG_INFO
, "nd6_ns_input: bad NS target (multicast)\n"));
153 if (IN6_IS_SCOPE_LINKLOCAL(&taddr6
))
154 taddr6
.s6_addr16
[1] = htons(ifp
->if_index
);
156 icmp6len
-= sizeof(*nd_ns
);
157 nd6_option_init(nd_ns
+ 1, icmp6len
, &ndopts
);
158 if (nd6_options(&ndopts
) < 0) {
160 "nd6_ns_input: invalid ND option, ignored\n"));
161 /* nd6_options have incremented stats */
165 if (ndopts
.nd_opts_src_lladdr
) {
166 lladdr
= (char *)(ndopts
.nd_opts_src_lladdr
+ 1);
167 lladdrlen
= ndopts
.nd_opts_src_lladdr
->nd_opt_len
<< 3;
170 if (IN6_IS_ADDR_UNSPECIFIED(&ip6
->ip6_src
) && lladdr
) {
171 nd6log((LOG_INFO
, "nd6_ns_input: bad DAD packet "
172 "(link-layer address option)\n"));
177 * Attaching target link-layer address to the NA?
180 * NS IP dst is unicast/anycast MUST NOT add
181 * NS IP dst is solicited-node multicast MUST add
183 * In implementation, we add target link-layer address by default.
184 * We do not add one in MUST NOT cases.
186 #if 0 /* too much! */
187 ifa
= (struct ifaddr
*)in6ifa_ifpwithaddr(ifp
, &daddr6
);
188 if (ifa
&& (((struct in6_ifaddr
*)ifa
)->ia6_flags
& IN6_IFF_ANYCAST
))
192 if (!IN6_IS_ADDR_MULTICAST(&daddr6
))
198 * Target address (taddr6) must be either:
199 * (1) Valid unicast/anycast address for my receiving interface,
200 * (2) Unicast address for which I'm offering proxy service, or
201 * (3) "tentative" address on which DAD is being performed.
203 /* (1) and (3) check. */
204 ifa
= (struct ifaddr
*)in6ifa_ifpwithaddr(ifp
, &taddr6
);
209 struct sockaddr_in6 tsin6
;
211 bzero(&tsin6
, sizeof tsin6
);
212 tsin6
.sin6_len
= sizeof(struct sockaddr_in6
);
213 tsin6
.sin6_family
= AF_INET6
;
214 tsin6
.sin6_addr
= taddr6
;
216 rt
= rtpurelookup((struct sockaddr
*)&tsin6
);
217 if (rt
!= NULL
&& (rt
->rt_flags
& RTF_ANNOUNCE
) &&
218 rt
->rt_gateway
->sa_family
== AF_LINK
) {
220 * proxy NDP for single entry
222 ifa
= (struct ifaddr
*)in6ifa_ifpforlinklocal(ifp
,
223 IN6_IFF_NOTREADY
|IN6_IFF_ANYCAST
);
226 proxydl
= SDL(rt
->rt_gateway
);
234 * We've got an NS packet, and we don't have that adddress
235 * assigned for us. We MUST silently ignore it.
240 myaddr6
= *IFA_IN6(ifa
);
241 anycast
= ((struct in6_ifaddr
*)ifa
)->ia6_flags
& IN6_IFF_ANYCAST
;
242 tentative
= ((struct in6_ifaddr
*)ifa
)->ia6_flags
& IN6_IFF_TENTATIVE
;
243 if (((struct in6_ifaddr
*)ifa
)->ia6_flags
& IN6_IFF_DUPLICATED
)
246 if (lladdr
&& ((ifp
->if_addrlen
+ 2 + 7) & ~7) != lladdrlen
) {
248 "nd6_ns_input: lladdrlen mismatch for %s "
249 "(if %d, NS packet %d)\n",
250 ip6_sprintf(&taddr6
), ifp
->if_addrlen
, lladdrlen
- 2));
254 if (IN6_ARE_ADDR_EQUAL(&myaddr6
, &saddr6
)) {
256 "nd6_ns_input: duplicate IP6 address %s\n",
257 ip6_sprintf(&saddr6
)));
262 * We have neighbor solicitation packet, with target address equals to
263 * one of my tentative address.
265 * src addr how to process?
267 * multicast of course, invalid (rejected in ip6_input)
268 * unicast somebody is doing address resolution -> ignore
269 * unspec dup address detection
271 * The processing is defined in RFC 2462.
275 * If source address is unspecified address, it is for
276 * duplicated address detection.
278 * If not, the packet is for addess resolution;
279 * silently ignore it.
281 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6
))
282 nd6_dad_ns_input(ifa
);
288 * If the source address is unspecified address, entries must not
289 * be created or updated.
290 * It looks that sender is performing DAD. Output NA toward
291 * all-node multicast address, to tell the sender that I'm using
293 * S bit ("solicited") must be zero.
295 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6
)) {
296 saddr6
= kin6addr_linklocal_allnodes
;
297 saddr6
.s6_addr16
[1] = htons(ifp
->if_index
);
298 nd6_na_output(ifp
, &saddr6
, &taddr6
,
299 ((anycast
|| proxy
|| !tlladdr
)
300 ? 0 : ND_NA_FLAG_OVERRIDE
)
301 | (ip6_forwarding
? ND_NA_FLAG_ROUTER
: 0),
302 tlladdr
, (struct sockaddr
*)proxydl
);
306 nd6_cache_lladdr(ifp
, &saddr6
, lladdr
, lladdrlen
, ND_NEIGHBOR_SOLICIT
, 0);
308 nd6_na_output(ifp
, &saddr6
, &taddr6
,
309 ((anycast
|| proxy
|| !tlladdr
) ? 0 : ND_NA_FLAG_OVERRIDE
)
310 | (ip6_forwarding
? ND_NA_FLAG_ROUTER
: 0)
311 | ND_NA_FLAG_SOLICITED
,
312 tlladdr
, (struct sockaddr
*)proxydl
);
318 nd6log((LOG_ERR
, "nd6_ns_input: src=%s\n", ip6_sprintf(&saddr6
)));
319 nd6log((LOG_ERR
, "nd6_ns_input: dst=%s\n", ip6_sprintf(&daddr6
)));
320 nd6log((LOG_ERR
, "nd6_ns_input: tgt=%s\n", ip6_sprintf(&taddr6
)));
321 icmp6stat
.icp6s_badns
++;
326 * Output an Neighbor Solicitation Message. Caller specifies:
327 * - ICMP6 header source IP6 address
328 * - ND6 header target IP6 address
329 * - ND6 header source datalink address
332 * Based on RFC 2462 (duplicated address detection)
335 nd6_ns_output(struct ifnet
*ifp
, const struct in6_addr
*daddr6
,
336 const struct in6_addr
*taddr6
,
337 struct llinfo_nd6
*ln
, /* for source address determination */
338 int dad
) /* duplicated address detection */
342 struct nd_neighbor_solicit
*nd_ns
;
343 struct in6_ifaddr
*ia
= NULL
;
344 struct ip6_moptions im6o
;
348 struct ifnet
*outif
= NULL
;
350 if (IN6_IS_ADDR_MULTICAST(taddr6
))
353 /* estimate the size of message */
354 maxlen
= sizeof(*ip6
) + sizeof(*nd_ns
);
355 maxlen
+= (sizeof(struct nd_opt_hdr
) + ifp
->if_addrlen
+ 7) & ~7;
356 if (max_linkhdr
+ maxlen
>= MCLBYTES
) {
358 kprintf("nd6_ns_output: max_linkhdr + maxlen >= MCLBYTES "
359 "(%d + %d > %d)\n", max_linkhdr
, maxlen
, MCLBYTES
);
364 m
= m_getb(max_linkhdr
+ maxlen
, MB_DONTWAIT
, MT_DATA
, M_PKTHDR
);
368 if (daddr6
== NULL
|| IN6_IS_ADDR_MULTICAST(daddr6
)) {
369 m
->m_flags
|= M_MCAST
;
370 im6o
.im6o_multicast_ifp
= ifp
;
371 im6o
.im6o_multicast_hlim
= 255;
372 im6o
.im6o_multicast_loop
= 0;
375 icmp6len
= sizeof(*nd_ns
);
376 m
->m_pkthdr
.len
= m
->m_len
= sizeof(*ip6
) + icmp6len
;
377 m
->m_data
+= max_linkhdr
; /* or MH_ALIGN() equivalent? */
379 /* fill neighbor solicitation packet */
380 ip6
= mtod(m
, struct ip6_hdr
*);
382 ip6
->ip6_vfc
&= ~IPV6_VERSION_MASK
;
383 ip6
->ip6_vfc
|= IPV6_VERSION
;
384 /* ip6->ip6_plen will be set later */
385 ip6
->ip6_nxt
= IPPROTO_ICMPV6
;
388 ip6
->ip6_dst
= *daddr6
;
390 ip6
->ip6_dst
.s6_addr16
[0] = IPV6_ADDR_INT16_MLL
;
391 ip6
->ip6_dst
.s6_addr16
[1] = htons(ifp
->if_index
);
392 ip6
->ip6_dst
.s6_addr32
[1] = 0;
393 ip6
->ip6_dst
.s6_addr32
[2] = IPV6_ADDR_INT32_ONE
;
394 ip6
->ip6_dst
.s6_addr32
[3] = taddr6
->s6_addr32
[3];
395 ip6
->ip6_dst
.s6_addr8
[12] = 0xff;
398 #if 0 /* KAME way, exact address scope match */
400 * Select a source whose scope is the same as that of the dest.
401 * Typically, the dest is link-local solicitation multicast
402 * (i.e. neighbor discovery) or link-local/global unicast
403 * (i.e. neighbor un-reachability detection).
405 ia
= in6_ifawithifp(ifp
, &ip6
->ip6_dst
);
410 ip6
->ip6_src
= ia
->ia_addr
.sin6_addr
;
411 #else /* spec-wise correct */
414 * "If the source address of the packet prompting the
415 * solicitation is the same as one of the addresses assigned
416 * to the outgoing interface, that address SHOULD be placed
417 * in the IP Source Address of the outgoing solicitation.
418 * Otherwise, any one of the addresses assigned to the
419 * interface should be used."
421 * We use the source address for the prompting packet
423 * - saddr6 is given from the caller (by giving "ln"), and
424 * - saddr6 belongs to the outgoing interface.
425 * Otherwise, we perform a scope-wise match.
427 struct ip6_hdr
*hip6
; /* hold ip6 */
428 struct in6_addr
*saddr6
;
430 if (ln
&& ln
->ln_hold
) {
431 hip6
= mtod(ln
->ln_hold
, struct ip6_hdr
*);
433 if (sizeof(*hip6
) < ln
->ln_hold
->m_len
)
434 saddr6
= &hip6
->ip6_src
;
439 if (saddr6
&& in6ifa_ifpwithaddr(ifp
, saddr6
))
440 bcopy(saddr6
, &ip6
->ip6_src
, sizeof(*saddr6
));
442 ia
= in6_ifawithifp(ifp
, &ip6
->ip6_dst
);
447 ip6
->ip6_src
= ia
->ia_addr
.sin6_addr
;
452 * Source address for DAD packet must always be IPv6
453 * unspecified address. (0::0)
455 bzero(&ip6
->ip6_src
, sizeof(ip6
->ip6_src
));
457 nd_ns
= (struct nd_neighbor_solicit
*)(ip6
+ 1);
458 nd_ns
->nd_ns_type
= ND_NEIGHBOR_SOLICIT
;
459 nd_ns
->nd_ns_code
= 0;
460 nd_ns
->nd_ns_reserved
= 0;
461 nd_ns
->nd_ns_target
= *taddr6
;
463 if (IN6_IS_SCOPE_LINKLOCAL(&nd_ns
->nd_ns_target
))
464 nd_ns
->nd_ns_target
.s6_addr16
[1] = 0;
467 * Add source link-layer address option.
469 * spec implementation
471 * DAD packet MUST NOT do not add the option
472 * there's no link layer address:
473 * impossible do not add the option
474 * there's link layer address:
475 * Multicast NS MUST add one add the option
476 * Unicast NS SHOULD add one add the option
478 if (!dad
&& (mac
= nd6_ifptomac(ifp
))) {
479 int optlen
= sizeof(struct nd_opt_hdr
) + ifp
->if_addrlen
;
480 struct nd_opt_hdr
*nd_opt
= (struct nd_opt_hdr
*)(nd_ns
+ 1);
481 /* 8 byte alignments... */
482 optlen
= (optlen
+ 7) & ~7;
484 m
->m_pkthdr
.len
+= optlen
;
487 bzero((caddr_t
)nd_opt
, optlen
);
488 nd_opt
->nd_opt_type
= ND_OPT_SOURCE_LINKADDR
;
489 nd_opt
->nd_opt_len
= optlen
>> 3;
490 bcopy(mac
, (caddr_t
)(nd_opt
+ 1), ifp
->if_addrlen
);
493 ip6
->ip6_plen
= htons((u_short
)icmp6len
);
494 nd_ns
->nd_ns_cksum
= 0;
496 = in6_cksum(m
, IPPROTO_ICMPV6
, sizeof(*ip6
), icmp6len
);
498 ip6_output(m
, NULL
, NULL
, dad
? IPV6_DADOUTPUT
: 0, &im6o
, &outif
, NULL
);
500 icmp6_ifstat_inc(outif
, ifs6_out_msg
);
501 icmp6_ifstat_inc(outif
, ifs6_out_neighborsolicit
);
503 icmp6stat
.icp6s_outhist
[ND_NEIGHBOR_SOLICIT
]++;
507 * Neighbor advertisement input handling.
510 * Based on RFC 2462 (duplicated address detection)
512 * the following items are not implemented yet:
513 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
514 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
517 nd6_na_input(struct mbuf
*m
, int off
, int icmp6len
)
519 struct ifnet
*ifp
= m
->m_pkthdr
.rcvif
;
520 struct ip6_hdr
*ip6
= mtod(m
, struct ip6_hdr
*);
521 struct nd_neighbor_advert
*nd_na
;
523 struct in6_addr saddr6
= ip6
->ip6_src
;
525 struct in6_addr daddr6
= ip6
->ip6_dst
;
526 struct in6_addr taddr6
;
534 struct llinfo_nd6
*ln
;
536 struct sockaddr_dl
*sdl
;
537 union nd_opts ndopts
;
539 if (ip6
->ip6_hlim
!= 255) {
541 "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n",
542 ip6
->ip6_hlim
, ip6_sprintf(&ip6
->ip6_src
),
543 ip6_sprintf(&ip6
->ip6_dst
), if_name(ifp
)));
547 #ifndef PULLDOWN_TEST
548 IP6_EXTHDR_CHECK(m
, off
, icmp6len
,);
549 nd_na
= (struct nd_neighbor_advert
*)((caddr_t
)ip6
+ off
);
551 IP6_EXTHDR_GET(nd_na
, struct nd_neighbor_advert
*, m
, off
, icmp6len
);
553 icmp6stat
.icp6s_tooshort
++;
557 taddr6
= nd_na
->nd_na_target
;
558 flags
= nd_na
->nd_na_flags_reserved
;
559 is_router
= ((flags
& ND_NA_FLAG_ROUTER
) != 0);
560 is_solicited
= ((flags
& ND_NA_FLAG_SOLICITED
) != 0);
561 is_override
= ((flags
& ND_NA_FLAG_OVERRIDE
) != 0);
563 if (IN6_IS_SCOPE_LINKLOCAL(&taddr6
))
564 taddr6
.s6_addr16
[1] = htons(ifp
->if_index
);
566 if (IN6_IS_ADDR_MULTICAST(&taddr6
)) {
568 "nd6_na_input: invalid target address %s\n",
569 ip6_sprintf(&taddr6
)));
572 if (IN6_IS_ADDR_MULTICAST(&daddr6
))
575 "nd6_na_input: a solicited adv is multicasted\n"));
579 icmp6len
-= sizeof(*nd_na
);
580 nd6_option_init(nd_na
+ 1, icmp6len
, &ndopts
);
581 if (nd6_options(&ndopts
) < 0) {
583 "nd6_na_input: invalid ND option, ignored\n"));
584 /* nd6_options have incremented stats */
588 if (ndopts
.nd_opts_tgt_lladdr
) {
589 lladdr
= (char *)(ndopts
.nd_opts_tgt_lladdr
+ 1);
590 lladdrlen
= ndopts
.nd_opts_tgt_lladdr
->nd_opt_len
<< 3;
593 ifa
= (struct ifaddr
*)in6ifa_ifpwithaddr(ifp
, &taddr6
);
596 * Target address matches one of my interface address.
598 * If my address is tentative, this means that there's somebody
599 * already using the same address as mine. This indicates DAD failure.
600 * This is defined in RFC 2462.
602 * Otherwise, process as defined in RFC 2461.
605 && (((struct in6_ifaddr
*)ifa
)->ia6_flags
& IN6_IFF_TENTATIVE
)) {
606 nd6_dad_na_input(ifa
);
610 /* Just for safety, maybe unnecessary. */
613 "nd6_na_input: duplicate IP6 address %s\n",
614 ip6_sprintf(&taddr6
));
618 if (lladdr
&& ((ifp
->if_addrlen
+ 2 + 7) & ~7) != lladdrlen
) {
620 "nd6_na_input: lladdrlen mismatch for %s "
621 "(if %d, NA packet %d)\n",
622 ip6_sprintf(&taddr6
), ifp
->if_addrlen
, lladdrlen
- 2));
627 * If no neighbor cache entry is found, NA SHOULD silently be discarded.
629 rt
= nd6_lookup(&taddr6
, 0, ifp
);
631 ((ln
= (struct llinfo_nd6
*)rt
->rt_llinfo
) == NULL
) ||
632 ((sdl
= SDL(rt
->rt_gateway
)) == NULL
))
635 if (ln
->ln_state
== ND6_LLINFO_INCOMPLETE
) {
637 * If the link-layer has address, and no lladdr option came,
638 * discard the packet.
640 if (ifp
->if_addrlen
&& !lladdr
)
644 * Record link-layer address, and update the state.
646 sdl
->sdl_alen
= ifp
->if_addrlen
;
647 bcopy(lladdr
, LLADDR(sdl
), ifp
->if_addrlen
);
649 ln
->ln_state
= ND6_LLINFO_REACHABLE
;
652 ln
->ln_expire
= time_second
+
653 ND_IFINFO(rt
->rt_ifp
)->reachable
;
655 ln
->ln_state
= ND6_LLINFO_STALE
;
656 ln
->ln_expire
= time_second
+ nd6_gctimer
;
658 if ((ln
->ln_router
= is_router
) != 0) {
660 * This means a router's state has changed from
661 * non-reachable to probably reachable, and might
662 * affect the status of associated prefixes..
664 pfxlist_onlink_check();
670 * Check if the link-layer address has changed or not.
676 if (bcmp(lladdr
, LLADDR(sdl
), ifp
->if_addrlen
))
685 * This is VERY complex. Look at it with care.
687 * override solicit lladdr llchange action
692 * 0 0 y y (1) REACHABLE->STALE
693 * 0 1 n -- (2c) *->REACHABLE
694 * 0 1 y n (2b) L *->REACHABLE
695 * 0 1 y y (1) REACHABLE->STALE
698 * 1 0 y y (2a) L *->STALE
699 * 1 1 n -- (2a) *->REACHABLE
700 * 1 1 y n (2a) L *->REACHABLE
701 * 1 1 y y (2a) L *->REACHABLE
703 if (!is_override
&& (lladdr
&& llchange
)) { /* (1) */
705 * If state is REACHABLE, make it STALE.
706 * no other updates should be done.
708 if (ln
->ln_state
== ND6_LLINFO_REACHABLE
) {
709 ln
->ln_state
= ND6_LLINFO_STALE
;
710 ln
->ln_expire
= time_second
+ nd6_gctimer
;
713 } else if (is_override
/* (2a) */
714 || (!is_override
&& (lladdr
&& !llchange
)) /* (2b) */
715 || !lladdr
) { /* (2c) */
717 * Update link-local address, if any.
720 sdl
->sdl_alen
= ifp
->if_addrlen
;
721 bcopy(lladdr
, LLADDR(sdl
), ifp
->if_addrlen
);
725 * If solicited, make the state REACHABLE.
726 * If not solicited and the link-layer address was
727 * changed, make it STALE.
730 ln
->ln_state
= ND6_LLINFO_REACHABLE
;
733 ln
->ln_expire
= time_second
+
734 ND_IFINFO(ifp
)->reachable
;
737 if (lladdr
&& llchange
) {
738 ln
->ln_state
= ND6_LLINFO_STALE
;
739 ln
->ln_expire
= time_second
+ nd6_gctimer
;
744 if (ln
->ln_router
&& !is_router
) {
746 * The peer dropped the router flag.
747 * Remove the sender from the Default Router List and
748 * update the Destination Cache entries.
750 struct nd_defrouter
*dr
;
751 struct in6_addr
*in6
;
753 in6
= &((struct sockaddr_in6
*)rt_key(rt
))->sin6_addr
;
756 * Lock to protect the default router list.
757 * XXX: this might be unnecessary, since this function
758 * is only called under the network software interrupt
759 * context. However, we keep it just for safety.
762 dr
= defrouter_lookup(in6
, rt
->rt_ifp
);
765 else if (!ip6_forwarding
&& ip6_accept_rtadv
) {
767 * Even if the neighbor is not in the default
768 * router list, the neighbor may be used
769 * as a next hop for some destinations
770 * (e.g. redirect case). So we must
771 * call rt6_flush explicitly.
773 rt6_flush(&ip6
->ip6_src
, rt
->rt_ifp
);
777 ln
->ln_router
= is_router
;
779 rt
->rt_flags
&= ~RTF_REJECT
;
783 * we assume ifp is not a loopback here, so just set the 2nd
784 * argument as the 1st one.
786 nd6_output(ifp
, ifp
, ln
->ln_hold
,
787 (struct sockaddr_in6
*)rt_key(rt
), rt
);
796 icmp6stat
.icp6s_badna
++;
801 * Neighbor advertisement output handling.
805 * the following items are not implemented yet:
806 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
807 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
810 nd6_na_output(struct ifnet
*ifp
, const struct in6_addr
*daddr6
,
811 const struct in6_addr
*taddr6
, u_long flags
,
812 int tlladdr
, /* 1 if include target link-layer address */
813 struct sockaddr
*sdl0
) /* sockaddr_dl (= proxy NA) or NULL */
817 struct nd_neighbor_advert
*nd_na
;
818 struct in6_ifaddr
*ia
= NULL
;
819 struct ip6_moptions im6o
;
823 struct ifnet
*outif
= NULL
;
825 /* estimate the size of message */
826 maxlen
= sizeof(*ip6
) + sizeof(*nd_na
);
827 maxlen
+= (sizeof(struct nd_opt_hdr
) + ifp
->if_addrlen
+ 7) & ~7;
828 if (max_linkhdr
+ maxlen
>= MCLBYTES
) {
830 kprintf("nd6_na_output: max_linkhdr + maxlen >= MCLBYTES "
831 "(%d + %d > %d)\n", max_linkhdr
, maxlen
, MCLBYTES
);
836 m
= m_getb(max_linkhdr
+ maxlen
, MB_DONTWAIT
, MT_DATA
, M_PKTHDR
);
840 if (IN6_IS_ADDR_MULTICAST(daddr6
)) {
841 m
->m_flags
|= M_MCAST
;
842 im6o
.im6o_multicast_ifp
= ifp
;
843 im6o
.im6o_multicast_hlim
= 255;
844 im6o
.im6o_multicast_loop
= 0;
847 icmp6len
= sizeof(*nd_na
);
848 m
->m_pkthdr
.len
= m
->m_len
= sizeof(struct ip6_hdr
) + icmp6len
;
849 m
->m_data
+= max_linkhdr
; /* or MH_ALIGN() equivalent? */
851 /* fill neighbor advertisement packet */
852 ip6
= mtod(m
, struct ip6_hdr
*);
854 ip6
->ip6_vfc
&= ~IPV6_VERSION_MASK
;
855 ip6
->ip6_vfc
|= IPV6_VERSION
;
856 ip6
->ip6_nxt
= IPPROTO_ICMPV6
;
858 if (IN6_IS_ADDR_UNSPECIFIED(daddr6
)) {
860 ip6
->ip6_dst
.s6_addr16
[0] = IPV6_ADDR_INT16_MLL
;
861 ip6
->ip6_dst
.s6_addr16
[1] = htons(ifp
->if_index
);
862 ip6
->ip6_dst
.s6_addr32
[1] = 0;
863 ip6
->ip6_dst
.s6_addr32
[2] = 0;
864 ip6
->ip6_dst
.s6_addr32
[3] = IPV6_ADDR_INT32_ONE
;
865 flags
&= ~ND_NA_FLAG_SOLICITED
;
867 ip6
->ip6_dst
= *daddr6
;
870 * Select a source whose scope is the same as that of the dest.
872 ia
= in6_ifawithifp(ifp
, &ip6
->ip6_dst
);
877 ip6
->ip6_src
= ia
->ia_addr
.sin6_addr
;
878 nd_na
= (struct nd_neighbor_advert
*)(ip6
+ 1);
879 nd_na
->nd_na_type
= ND_NEIGHBOR_ADVERT
;
880 nd_na
->nd_na_code
= 0;
881 nd_na
->nd_na_target
= *taddr6
;
882 if (IN6_IS_SCOPE_LINKLOCAL(&nd_na
->nd_na_target
))
883 nd_na
->nd_na_target
.s6_addr16
[1] = 0;
886 * "tlladdr" indicates NS's condition for adding tlladdr or not.
887 * see nd6_ns_input() for details.
888 * Basically, if NS packet is sent to unicast/anycast addr,
889 * target lladdr option SHOULD NOT be included.
894 * sdl0 != NULL indicates proxy NA. If we do proxy, use
895 * lladdr in sdl0. If we are not proxying (sending NA for
896 * my address) use lladdr configured for the interface.
899 mac
= nd6_ifptomac(ifp
);
900 else if (sdl0
->sa_family
== AF_LINK
) {
901 struct sockaddr_dl
*sdl
;
902 sdl
= (struct sockaddr_dl
*)sdl0
;
903 if (sdl
->sdl_alen
== ifp
->if_addrlen
)
908 int optlen
= sizeof(struct nd_opt_hdr
) + ifp
->if_addrlen
;
909 struct nd_opt_hdr
*nd_opt
= (struct nd_opt_hdr
*)(nd_na
+ 1);
911 /* roundup to 8 bytes alignment! */
912 optlen
= (optlen
+ 7) & ~7;
914 m
->m_pkthdr
.len
+= optlen
;
917 bzero((caddr_t
)nd_opt
, optlen
);
918 nd_opt
->nd_opt_type
= ND_OPT_TARGET_LINKADDR
;
919 nd_opt
->nd_opt_len
= optlen
>> 3;
920 bcopy(mac
, (caddr_t
)(nd_opt
+ 1), ifp
->if_addrlen
);
922 flags
&= ~ND_NA_FLAG_OVERRIDE
;
924 ip6
->ip6_plen
= htons((u_short
)icmp6len
);
925 nd_na
->nd_na_flags_reserved
= flags
;
926 nd_na
->nd_na_cksum
= 0;
928 in6_cksum(m
, IPPROTO_ICMPV6
, sizeof(struct ip6_hdr
), icmp6len
);
930 ip6_output(m
, NULL
, NULL
, 0, &im6o
, &outif
, NULL
);
932 icmp6_ifstat_inc(outif
, ifs6_out_msg
);
933 icmp6_ifstat_inc(outif
, ifs6_out_neighboradvert
);
935 icmp6stat
.icp6s_outhist
[ND_NEIGHBOR_ADVERT
]++;
939 nd6_ifptomac(struct ifnet
*ifp
)
941 switch (ifp
->if_type
) {
952 return ((caddr_t
)(ifp
+ 1));
959 TAILQ_HEAD(dadq_head
, dadq
);
961 TAILQ_ENTRY(dadq
) dad_list
;
962 struct ifaddr
*dad_ifa
;
963 int dad_count
; /* max NS to send */
964 int dad_ns_tcount
; /* # of trials to send NS */
965 int dad_ns_ocount
; /* NS sent so far */
968 struct callout dad_timer_ch
;
971 static struct dadq_head dadq
;
972 static int dad_init
= 0;
975 nd6_dad_find(struct ifaddr
*ifa
)
979 TAILQ_FOREACH(dp
, &dadq
, dad_list
) {
980 if (dp
->dad_ifa
== ifa
)
987 nd6_dad_starttimer(struct dadq
*dp
, int ticks
)
990 callout_reset(&dp
->dad_timer_ch
, ticks
,
991 (void (*) (void *))nd6_dad_timer
, (void *)dp
->dad_ifa
);
995 nd6_dad_stoptimer(struct dadq
*dp
)
998 callout_stop(&dp
->dad_timer_ch
);
1002 * Start Duplicated Address Detection (DAD) for specified interface address.
1005 nd6_dad_start(struct ifaddr
*ifa
,
1006 int *tick
) /* minimum delay ticks for IFF_UP event */
1008 struct in6_ifaddr
*ia
= (struct in6_ifaddr
*)ifa
;
1017 * If we don't need DAD, don't do it.
1018 * There are several cases:
1019 * - DAD is disabled (ip6_dad_count == 0)
1020 * - the interface address is anycast
1022 if (!(ia
->ia6_flags
& IN6_IFF_TENTATIVE
)) {
1024 "nd6_dad_start: called with non-tentative address "
1026 ip6_sprintf(&ia
->ia_addr
.sin6_addr
),
1027 ifa
->ifa_ifp
? if_name(ifa
->ifa_ifp
) : "???");
1030 if (ia
->ia6_flags
& IN6_IFF_ANYCAST
) {
1031 ia
->ia6_flags
&= ~IN6_IFF_TENTATIVE
;
1034 if (!ip6_dad_count
) {
1035 ia
->ia6_flags
&= ~IN6_IFF_TENTATIVE
;
1039 panic("nd6_dad_start: ifa->ifa_ifp == NULL");
1040 if (!(ifa
->ifa_ifp
->if_flags
& IFF_UP
))
1042 if (nd6_dad_find(ifa
) != NULL
) {
1043 /* DAD already in progress */
1047 dp
= kmalloc(sizeof(*dp
), M_IP6NDP
, M_NOWAIT
);
1049 log(LOG_ERR
, "nd6_dad_start: memory allocation failed for "
1051 ip6_sprintf(&ia
->ia_addr
.sin6_addr
),
1052 ifa
->ifa_ifp
? if_name(ifa
->ifa_ifp
) : "???");
1055 bzero(dp
, sizeof(*dp
));
1056 callout_init(&dp
->dad_timer_ch
);
1057 TAILQ_INSERT_TAIL(&dadq
, (struct dadq
*)dp
, dad_list
);
1059 nd6log((LOG_DEBUG
, "%s: starting DAD for %s\n", if_name(ifa
->ifa_ifp
),
1060 ip6_sprintf(&ia
->ia_addr
.sin6_addr
)));
1063 * Send NS packet for DAD, ip6_dad_count times.
1064 * Note that we must delay the first transmission, if this is the
1065 * first packet to be sent from the interface after interface
1066 * (re)initialization.
1069 IFAREF(ifa
); /* just for safety */
1070 dp
->dad_count
= ip6_dad_count
;
1071 dp
->dad_ns_icount
= dp
->dad_na_icount
= 0;
1072 dp
->dad_ns_ocount
= dp
->dad_ns_tcount
= 0;
1074 nd6_dad_ns_output(dp
, ifa
);
1075 nd6_dad_starttimer(dp
,
1076 ND_IFINFO(ifa
->ifa_ifp
)->retrans
* hz
/ 1000);
1081 ntick
= krandom() % (MAX_RTR_SOLICITATION_DELAY
* hz
);
1083 ntick
= *tick
+ krandom() % (hz
/ 2);
1085 nd6_dad_starttimer(dp
, ntick
);
1090 * terminate DAD unconditionally. used for address removals.
1093 nd6_dad_stop(struct ifaddr
*ifa
)
1099 dp
= nd6_dad_find(ifa
);
1101 /* DAD wasn't started yet */
1105 nd6_dad_stoptimer(dp
);
1107 TAILQ_REMOVE(&dadq
, (struct dadq
*)dp
, dad_list
);
1108 kfree(dp
, M_IP6NDP
);
1114 nd6_dad_timer(struct ifaddr
*ifa
)
1116 struct in6_ifaddr
*ia
= (struct in6_ifaddr
*)ifa
;
1119 crit_enter(); /* XXX */
1123 log(LOG_ERR
, "nd6_dad_timer: called with null parameter\n");
1126 dp
= nd6_dad_find(ifa
);
1128 log(LOG_ERR
, "nd6_dad_timer: DAD structure not found\n");
1131 if (ia
->ia6_flags
& IN6_IFF_DUPLICATED
) {
1132 log(LOG_ERR
, "nd6_dad_timer: called with duplicated address "
1134 ip6_sprintf(&ia
->ia_addr
.sin6_addr
),
1135 ifa
->ifa_ifp
? if_name(ifa
->ifa_ifp
) : "???");
1138 if (!(ia
->ia6_flags
& IN6_IFF_TENTATIVE
)) {
1139 log(LOG_ERR
, "nd6_dad_timer: called with non-tentative address "
1141 ip6_sprintf(&ia
->ia_addr
.sin6_addr
),
1142 ifa
->ifa_ifp
? if_name(ifa
->ifa_ifp
) : "???");
1146 /* timeouted with IFF_{RUNNING,UP} check */
1147 if (dp
->dad_ns_tcount
> dad_maxtry
) {
1148 nd6log((LOG_INFO
, "%s: could not run DAD, driver problem?\n",
1149 if_name(ifa
->ifa_ifp
)));
1151 TAILQ_REMOVE(&dadq
, (struct dadq
*)dp
, dad_list
);
1152 kfree(dp
, M_IP6NDP
);
1158 /* Need more checks? */
1159 if (dp
->dad_ns_ocount
< dp
->dad_count
) {
1161 * We have more NS to go. Send NS packet for DAD.
1163 nd6_dad_ns_output(dp
, ifa
);
1164 nd6_dad_starttimer(dp
,
1165 ND_IFINFO(ifa
->ifa_ifp
)->retrans
* hz
/ 1000);
1168 * We have transmitted sufficient number of DAD packets.
1169 * See what we've got.
1175 if (dp
->dad_na_icount
) {
1177 * the check is in nd6_dad_na_input(),
1183 if (dp
->dad_ns_icount
) {
1184 #if 0 /* heuristics */
1187 * - we have sent many(?) DAD NS, and
1188 * - the number of NS we sent equals to the
1189 * number of NS we've got, and
1191 * we may have a faulty network card/driver which
1192 * loops back multicasts to myself.
1194 if (3 < dp
->dad_count
1195 && dp
->dad_ns_icount
== dp
->dad_count
1196 && dp
->dad_na_icount
== 0) {
1197 log(LOG_INFO
, "DAD questionable for %s(%s): "
1198 "network card loops back multicast?\n",
1199 ip6_sprintf(&ia
->ia_addr
.sin6_addr
),
1200 if_name(ifa
->ifa_ifp
));
1201 /* XXX consider it a duplicate or not? */
1204 /* We've seen NS, means DAD has failed. */
1208 /* We've seen NS, means DAD has failed. */
1214 /* (*dp) will be freed in nd6_dad_duplicated() */
1216 nd6_dad_duplicated(ifa
);
1219 * We are done with DAD. No NA came, no NS came.
1220 * duplicated address found.
1222 ia
->ia6_flags
&= ~IN6_IFF_TENTATIVE
;
1225 "%s: DAD complete for %s - no duplicates found\n",
1226 if_name(ifa
->ifa_ifp
),
1227 ip6_sprintf(&ia
->ia_addr
.sin6_addr
)));
1229 TAILQ_REMOVE(&dadq
, (struct dadq
*)dp
, dad_list
);
1230 kfree(dp
, M_IP6NDP
);
1241 nd6_dad_duplicated(struct ifaddr
*ifa
)
1243 struct in6_ifaddr
*ia
= (struct in6_ifaddr
*)ifa
;
1246 dp
= nd6_dad_find(ifa
);
1248 log(LOG_ERR
, "nd6_dad_duplicated: DAD structure not found\n");
1252 log(LOG_ERR
, "%s: DAD detected duplicate IPv6 address %s: "
1253 "NS in/out=%d/%d, NA in=%d\n",
1254 if_name(ifa
->ifa_ifp
), ip6_sprintf(&ia
->ia_addr
.sin6_addr
),
1255 dp
->dad_ns_icount
, dp
->dad_ns_ocount
, dp
->dad_na_icount
);
1257 ia
->ia6_flags
&= ~IN6_IFF_TENTATIVE
;
1258 ia
->ia6_flags
|= IN6_IFF_DUPLICATED
;
1260 /* We are done with DAD, with duplicated address found. (failure) */
1261 nd6_dad_stoptimer(dp
);
1263 log(LOG_ERR
, "%s: DAD complete for %s - duplicate found\n",
1264 if_name(ifa
->ifa_ifp
), ip6_sprintf(&ia
->ia_addr
.sin6_addr
));
1265 log(LOG_ERR
, "%s: manual intervention required\n",
1266 if_name(ifa
->ifa_ifp
));
1268 TAILQ_REMOVE(&dadq
, (struct dadq
*)dp
, dad_list
);
1269 kfree(dp
, M_IP6NDP
);
1275 nd6_dad_ns_output(struct dadq
*dp
, struct ifaddr
*ifa
)
1277 struct in6_ifaddr
*ia
= (struct in6_ifaddr
*)ifa
;
1278 struct ifnet
*ifp
= ifa
->ifa_ifp
;
1280 dp
->dad_ns_tcount
++;
1281 if (!(ifp
->if_flags
& IFF_UP
)) {
1283 kprintf("%s: interface down?\n", if_name(ifp
));
1287 if (!(ifp
->if_flags
& IFF_RUNNING
)) {
1289 kprintf("%s: interface not running?\n", if_name(ifp
));
1294 dp
->dad_ns_ocount
++;
1295 nd6_ns_output(ifp
, NULL
, &ia
->ia_addr
.sin6_addr
, NULL
, 1);
1299 nd6_dad_ns_input(struct ifaddr
*ifa
)
1301 struct in6_ifaddr
*ia
;
1303 const struct in6_addr
*taddr6
;
1308 panic("ifa == NULL in nd6_dad_ns_input");
1310 ia
= (struct in6_ifaddr
*)ifa
;
1312 taddr6
= &ia
->ia_addr
.sin6_addr
;
1314 dp
= nd6_dad_find(ifa
);
1316 /* Quickhack - completely ignore DAD NS packets */
1317 if (dad_ignore_ns
) {
1319 "nd6_dad_ns_input: ignoring DAD NS packet for "
1320 "address %s(%s)\n", ip6_sprintf(taddr6
),
1321 if_name(ifa
->ifa_ifp
)));
1326 * if I'm yet to start DAD, someone else started using this address
1327 * first. I have a duplicate and you win.
1329 if (!dp
|| dp
->dad_ns_ocount
== 0)
1332 /* XXX more checks for loopback situation - see nd6_dad_timer too */
1335 dp
= NULL
; /* will be freed in nd6_dad_duplicated() */
1336 nd6_dad_duplicated(ifa
);
1339 * not sure if I got a duplicate.
1340 * increment ns count and see what happens.
1343 dp
->dad_ns_icount
++;
1348 nd6_dad_na_input(struct ifaddr
*ifa
)
1353 panic("ifa == NULL in nd6_dad_na_input");
1355 dp
= nd6_dad_find(ifa
);
1357 dp
->dad_na_icount
++;
1359 /* remove the address. */
1360 nd6_dad_duplicated(ifa
);