xref: /openbsd/sys/netinet6/nd6_nbr.c (revision 1f9e444e)
1 /*	$OpenBSD: nd6_nbr.c,v 1.153 2024/07/14 18:53:39 bluhm Exp $	*/
2 /*	$KAME: nd6_nbr.c,v 1.61 2001/02/10 16:06:14 jinmei Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/malloc.h>
36 #include <sys/mbuf.h>
37 #include <sys/socket.h>
38 #include <sys/sockio.h>
39 #include <sys/time.h>
40 #include <sys/kernel.h>
41 #include <sys/ioctl.h>
42 #include <sys/syslog.h>
43 #include <sys/queue.h>
44 #include <sys/timeout.h>
45 
46 #include <net/if.h>
47 #include <net/if_var.h>
48 #include <net/if_types.h>
49 #include <net/if_dl.h>
50 #include <net/route.h>
51 
52 #include <netinet/in.h>
53 #include <netinet/if_ether.h>
54 #include <netinet6/in6_var.h>
55 #include <netinet/ip6.h>
56 #include <netinet6/ip6_var.h>
57 #include <netinet6/nd6.h>
58 #include <netinet/icmp6.h>
59 
60 #include "carp.h"
61 #if NCARP > 0
62 #include <netinet/ip_carp.h>
63 #endif
64 
65 static TAILQ_HEAD(, dadq) dadq =
66     TAILQ_HEAD_INITIALIZER(dadq);	/* list of addresses to run DAD on */
67 struct dadq {
68 	TAILQ_ENTRY(dadq) dad_list;
69 	struct ifaddr *dad_ifa;
70 	int dad_count;		/* max NS to send */
71 	int dad_ns_tcount;	/* # of trials to send NS */
72 	int dad_ns_ocount;	/* NS sent so far */
73 	int dad_ns_icount;
74 	int dad_na_icount;
75 	struct timeout dad_timer_ch;
76 };
77 
78 struct dadq *nd6_dad_find(struct ifaddr *);
79 void nd6_dad_destroy(struct dadq *);
80 void nd6_dad_starttimer(struct dadq *);
81 void nd6_dad_stoptimer(struct dadq *);
82 void nd6_dad_timer(void *);
83 void nd6_dad_ns_output(struct dadq *, struct ifaddr *);
84 void nd6_dad_ns_input(struct ifaddr *);
85 void nd6_dad_duplicated(struct dadq *);
86 
87 int nd6_isneighbor(const struct ifnet *, const struct in6_addr *);
88 
89 static int dad_maxtry = 15;	/* max # of *tries* to transmit DAD packet */
90 
91 /*
92  * Input an Neighbor Solicitation Message.
93  *
94  * Based on RFC 2461
95  * Based on RFC 2462 (duplicated address detection)
96  */
97 void
nd6_ns_input(struct mbuf * m,int off,int icmp6len)98 nd6_ns_input(struct mbuf *m, int off, int icmp6len)
99 {
100 	struct ifnet *ifp;
101 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
102 	struct nd_neighbor_solicit *nd_ns;
103 	struct in6_addr saddr6 = ip6->ip6_src;
104 	struct in6_addr daddr6 = ip6->ip6_dst;
105 	struct in6_addr taddr6;
106 	struct in6_addr myaddr6;
107 	char *lladdr = NULL;
108 	struct ifaddr *ifa = NULL;
109 	int lladdrlen = 0;
110 	int anycast = 0, proxy = 0, tentative = 0;
111 	int i_am_router = (atomic_load_int(&ip6_forwarding) != 0);
112 	int tlladdr;
113 	struct nd_opts ndopts;
114 	struct sockaddr_dl *proxydl = NULL;
115 	char addr[INET6_ADDRSTRLEN], addr0[INET6_ADDRSTRLEN];
116 
117 	ifp = if_get(m->m_pkthdr.ph_ifidx);
118 	if (ifp == NULL)
119 		goto freeit;
120 
121 	IP6_EXTHDR_GET(nd_ns, struct nd_neighbor_solicit *, m, off, icmp6len);
122 	if (nd_ns == NULL) {
123 		icmp6stat_inc(icp6s_tooshort);
124 		if_put(ifp);
125 		return;
126 	}
127 	ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */
128 	taddr6 = nd_ns->nd_ns_target;
129 
130 	if (ip6->ip6_hlim != 255) {
131 		nd6log((LOG_ERR,
132 		    "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n",
133 		    ip6->ip6_hlim,
134 		    inet_ntop(AF_INET6, &ip6->ip6_src, addr, sizeof(addr)),
135 		    inet_ntop(AF_INET6, &ip6->ip6_dst, addr0, sizeof(addr0)),
136 		    ifp->if_xname));
137 		goto bad;
138 	}
139 
140 	if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) {
141 		/* dst has to be solicited node multicast address. */
142 		/* don't check ifindex portion */
143 		if (daddr6.s6_addr16[0] == __IPV6_ADDR_INT16_MLL &&
144 		    daddr6.s6_addr32[1] == 0 &&
145 		    daddr6.s6_addr32[2] == __IPV6_ADDR_INT32_ONE &&
146 		    daddr6.s6_addr8[12] == 0xff) {
147 			; /*good*/
148 		} else {
149 			nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
150 			    "(wrong ip6 dst)\n"));
151 			goto bad;
152 		}
153 	} else {
154 		/*
155 		 * Make sure the source address is from a neighbor's address.
156 		 */
157 		if (!nd6_isneighbor(ifp, &saddr6)) {
158 			nd6log((LOG_INFO, "nd6_ns_input: "
159 			    "NS packet from non-neighbor\n"));
160 			goto bad;
161 		}
162 	}
163 
164 
165 	if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
166 		nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n"));
167 		goto bad;
168 	}
169 
170 	if (IN6_IS_SCOPE_EMBED(&taddr6))
171 		taddr6.s6_addr16[1] = htons(ifp->if_index);
172 
173 	icmp6len -= sizeof(*nd_ns);
174 	if (nd6_options(nd_ns + 1, icmp6len, &ndopts) < 0) {
175 		nd6log((LOG_INFO,
176 		    "nd6_ns_input: invalid ND option, ignored\n"));
177 		/* nd6_options have incremented stats */
178 		goto freeit;
179 	}
180 
181 	if (ndopts.nd_opts_src_lladdr) {
182 		lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1);
183 		lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3;
184 	}
185 
186 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) && lladdr) {
187 		nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
188 		    "(link-layer address option)\n"));
189 		goto bad;
190 	}
191 
192 	/*
193 	 * Attaching target link-layer address to the NA?
194 	 * (RFC 2461 7.2.4)
195 	 *
196 	 * NS IP dst is unicast/anycast			MUST NOT add
197 	 * NS IP dst is solicited-node multicast	MUST add
198 	 *
199 	 * In implementation, we add target link-layer address by default.
200 	 * We do not add one in MUST NOT cases.
201 	 */
202 #if 0 /* too much! */
203 	ifa = &in6ifa_ifpwithaddr(ifp, &daddr6)->ia_ifa;
204 	if (ifa && (ifatoia6(ifa)->ia6_flags & IN6_IFF_ANYCAST))
205 		tlladdr = 0;
206 	else
207 #endif
208 	if (!IN6_IS_ADDR_MULTICAST(&daddr6))
209 		tlladdr = 0;
210 	else
211 		tlladdr = 1;
212 
213 	/*
214 	 * Target address (taddr6) must be either:
215 	 * (1) Valid unicast/anycast address for my receiving interface,
216 	 * (2) Unicast address for which I'm offering proxy service, or
217 	 * (3) "tentative" address on which DAD is being performed.
218 	 */
219 	/* (1) and (3) check. */
220 	ifa = &in6ifa_ifpwithaddr(ifp, &taddr6)->ia_ifa;
221 #if NCARP > 0
222 	if (ifp->if_type == IFT_CARP && ifa && !carp_iamatch(ifp))
223 		ifa = NULL;
224 #endif
225 
226 	/* (2) check. */
227 	if (!ifa) {
228 		struct rtentry *rt;
229 		struct sockaddr_in6 tsin6;
230 
231 		bzero(&tsin6, sizeof tsin6);
232 		tsin6.sin6_len = sizeof(struct sockaddr_in6);
233 		tsin6.sin6_family = AF_INET6;
234 		tsin6.sin6_addr = taddr6;
235 
236 		rt = rtalloc(sin6tosa(&tsin6), 0, m->m_pkthdr.ph_rtableid);
237 		if (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 &&
238 		    rt->rt_gateway->sa_family == AF_LINK) {
239 			/*
240 			 * proxy NDP for single entry
241 			 */
242 			ifa = &in6ifa_ifpforlinklocal(ifp, IN6_IFF_TENTATIVE|
243 			    IN6_IFF_DUPLICATED|IN6_IFF_ANYCAST)->ia_ifa;
244 			if (ifa) {
245 				proxy = 1;
246 				proxydl = satosdl(rt->rt_gateway);
247 				i_am_router = 0;	/* XXX */
248 			}
249 		}
250 		if (rt)
251 			rtfree(rt);
252 	}
253 	if (!ifa) {
254 		/*
255 		 * We've got an NS packet, and we don't have that address
256 		 * assigned for us.  We MUST silently ignore it.
257 		 * See RFC2461 7.2.3.
258 		 */
259 		goto freeit;
260 	}
261 	myaddr6 = *IFA_IN6(ifa);
262 	anycast = ifatoia6(ifa)->ia6_flags & IN6_IFF_ANYCAST;
263 	tentative = ifatoia6(ifa)->ia6_flags & IN6_IFF_TENTATIVE;
264 	if (ifatoia6(ifa)->ia6_flags & IN6_IFF_DUPLICATED)
265 		goto freeit;
266 
267 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
268 		nd6log((LOG_INFO, "nd6_ns_input: lladdrlen mismatch for %s "
269 		    "(if %d, NS packet %d)\n",
270 		    inet_ntop(AF_INET6, &taddr6, addr, sizeof(addr)),
271 		    ifp->if_addrlen, lladdrlen - 2));
272 		goto bad;
273 	}
274 
275 	if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) {
276 		log(LOG_INFO, "nd6_ns_input: duplicate IP6 address %s\n",
277 		    inet_ntop(AF_INET6, &saddr6, addr, sizeof(addr)));
278 		goto freeit;
279 	}
280 
281 	/*
282 	 * We have neighbor solicitation packet, with target address equals to
283 	 * one of my tentative address.
284 	 *
285 	 * src addr	how to process?
286 	 * ---		---
287 	 * multicast	of course, invalid (rejected in ip6_input)
288 	 * unicast	somebody is doing address resolution -> ignore
289 	 * unspec	dup address detection
290 	 *
291 	 * The processing is defined in RFC 2462.
292 	 */
293 	if (tentative) {
294 		/*
295 		 * If source address is unspecified address, it is for
296 		 * duplicated address detection.
297 		 *
298 		 * If not, the packet is for address resolution;
299 		 * silently ignore it.
300 		 */
301 		if (IN6_IS_ADDR_UNSPECIFIED(&saddr6))
302 			nd6_dad_ns_input(ifa);
303 
304 		goto freeit;
305 	}
306 
307 	/*
308 	 * If the source address is unspecified address, entries must not
309 	 * be created or updated.
310 	 * It looks that sender is performing DAD.  Output NA toward
311 	 * all-node multicast address, to tell the sender that I'm using
312 	 * the address.
313 	 * S bit ("solicited") must be zero.
314 	 */
315 	if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) {
316 		saddr6 = in6addr_linklocal_allnodes;
317 		saddr6.s6_addr16[1] = htons(ifp->if_index);
318 		nd6_na_output(ifp, &saddr6, &taddr6,
319 		    ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) |
320 		    (i_am_router ? ND_NA_FLAG_ROUTER : 0),
321 		    tlladdr, sdltosa(proxydl));
322 		goto freeit;
323 	}
324 
325 	nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, ND_NEIGHBOR_SOLICIT,
326 	    0, i_am_router);
327 
328 	nd6_na_output(ifp, &saddr6, &taddr6,
329 	    ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) |
330 	    (i_am_router ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED,
331 	    tlladdr, sdltosa(proxydl));
332  freeit:
333 	m_freem(m);
334 	if_put(ifp);
335 	return;
336 
337  bad:
338 	nd6log((LOG_ERR, "nd6_ns_input: src=%s\n",
339 	    inet_ntop(AF_INET6, &saddr6, addr, sizeof(addr))));
340 	nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n",
341 	    inet_ntop(AF_INET6, &daddr6, addr, sizeof(addr))));
342 	nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n",
343 	    inet_ntop(AF_INET6, &taddr6, addr, sizeof(addr))));
344 	icmp6stat_inc(icp6s_badns);
345 	m_freem(m);
346 	if_put(ifp);
347 }
348 
349 /*
350  * Output an Neighbor Solicitation Message. Caller specifies:
351  *	- ICMP6 header source IP6 address
352  *	- ND6 header target IP6 address
353  *	- ND6 header source datalink address
354  *
355  * Based on RFC 2461
356  * Based on RFC 2462 (duplicated address detection)
357  *
358  * ln - for source address determination
359  * dad - duplicated address detection
360  */
361 void
nd6_ns_output(struct ifnet * ifp,const struct in6_addr * daddr6,const struct in6_addr * taddr6,const struct in6_addr * saddr6,int dad)362 nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6,
363     const struct in6_addr *taddr6, const struct in6_addr *saddr6, int dad)
364 {
365 	struct mbuf *m;
366 	struct ip6_hdr *ip6;
367 	struct nd_neighbor_solicit *nd_ns;
368 	struct sockaddr_in6 src_sa, dst_sa;
369 	struct ip6_moptions im6o;
370 	int icmp6len;
371 	int maxlen;
372 	caddr_t mac;
373 
374 	if (IN6_IS_ADDR_MULTICAST(taddr6))
375 		return;
376 
377 	/* estimate the size of message */
378 	maxlen = sizeof(*ip6) + sizeof(*nd_ns);
379 	maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7;
380 #ifdef DIAGNOSTIC
381 	if (max_linkhdr + maxlen >= MCLBYTES) {
382 		printf("%s: max_linkhdr + maxlen >= MCLBYTES (%d + %d > %d)\n",
383 		    __func__, max_linkhdr, maxlen, MCLBYTES);
384 		panic("%s: insufficient MCLBYTES", __func__);
385 		/* NOTREACHED */
386 	}
387 #endif
388 
389 	MGETHDR(m, M_DONTWAIT, MT_DATA);
390 	if (m && max_linkhdr + maxlen >= MHLEN) {
391 		MCLGET(m, M_DONTWAIT);
392 		if ((m->m_flags & M_EXT) == 0) {
393 			m_free(m);
394 			m = NULL;
395 		}
396 	}
397 	if (m == NULL)
398 		return;
399 	m->m_pkthdr.ph_ifidx = 0;
400 	m->m_pkthdr.ph_rtableid = ifp->if_rdomain;
401 
402 	if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) {
403 		m->m_flags |= M_MCAST;
404 		im6o.im6o_ifidx = ifp->if_index;
405 		im6o.im6o_hlim = 255;
406 		im6o.im6o_loop = 0;
407 	}
408 
409 	icmp6len = sizeof(*nd_ns);
410 	m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len;
411 	m_align(m, maxlen);
412 
413 	/* fill neighbor solicitation packet */
414 	ip6 = mtod(m, struct ip6_hdr *);
415 	ip6->ip6_flow = 0;
416 	ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
417 	ip6->ip6_vfc |= IPV6_VERSION;
418 	/* ip6->ip6_plen will be set later */
419 	ip6->ip6_nxt = IPPROTO_ICMPV6;
420 	ip6->ip6_hlim = 255;
421 	/* determine the source and destination addresses */
422 	bzero(&src_sa, sizeof(src_sa));
423 	bzero(&dst_sa, sizeof(dst_sa));
424 	src_sa.sin6_family = dst_sa.sin6_family = AF_INET6;
425 	src_sa.sin6_len = dst_sa.sin6_len = sizeof(struct sockaddr_in6);
426 	if (daddr6 != NULL)
427 		dst_sa.sin6_addr = *daddr6;
428 	else {
429 		dst_sa.sin6_addr.s6_addr16[0] = __IPV6_ADDR_INT16_MLL;
430 		dst_sa.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
431 		dst_sa.sin6_addr.s6_addr32[1] = 0;
432 		dst_sa.sin6_addr.s6_addr32[2] = __IPV6_ADDR_INT32_ONE;
433 		dst_sa.sin6_addr.s6_addr32[3] = taddr6->s6_addr32[3];
434 		dst_sa.sin6_addr.s6_addr8[12] = 0xff;
435 	}
436 	ip6->ip6_dst = dst_sa.sin6_addr;
437 	if (!dad) {
438 		/*
439 		 * RFC2461 7.2.2:
440 		 * "If the source address of the packet prompting the
441 		 * solicitation is the same as one of the addresses assigned
442 		 * to the outgoing interface, that address SHOULD be placed
443 		 * in the IP Source Address of the outgoing solicitation.
444 		 * Otherwise, any one of the addresses assigned to the
445 		 * interface should be used."
446 		 *
447 		 * We use the source address for the prompting packet
448 		 * (saddr6), if:
449 		 * - saddr6 is given from the caller (by giving "ln"), and
450 		 * - saddr6 belongs to the outgoing interface and
451 		 * - if taddr is link local saddr6 must be link local as well
452 		 * Otherwise, we perform the source address selection as usual.
453 		 */
454 		if (saddr6 != NULL)
455 			src_sa.sin6_addr = *saddr6;
456 
457 		if (!IN6_IS_ADDR_LINKLOCAL(taddr6) ||
458 		    IN6_IS_ADDR_UNSPECIFIED(&src_sa.sin6_addr) ||
459 		    IN6_IS_ADDR_LINKLOCAL(&src_sa.sin6_addr) ||
460 		    !in6ifa_ifpwithaddr(ifp, &src_sa.sin6_addr)) {
461 			struct rtentry *rt;
462 
463 			rt = rtalloc(sin6tosa(&dst_sa), RT_RESOLVE,
464 			    m->m_pkthdr.ph_rtableid);
465 			if (!rtisvalid(rt)) {
466 				char addr[INET6_ADDRSTRLEN];
467 
468 				nd6log((LOG_DEBUG,
469 				    "%s: source can't be determined: dst=%s\n",
470 				    __func__, inet_ntop(AF_INET6,
471 				    &dst_sa.sin6_addr, addr, sizeof(addr))));
472 				rtfree(rt);
473 				goto bad;
474 			}
475 			src_sa.sin6_addr =
476 			    ifatoia6(rt->rt_ifa)->ia_addr.sin6_addr;
477 			rtfree(rt);
478 		}
479 	} else {
480 		/*
481 		 * Source address for DAD packet must always be IPv6
482 		 * unspecified address. (0::0)
483 		 * We actually don't have to 0-clear the address (we did it
484 		 * above), but we do so here explicitly to make the intention
485 		 * clearer.
486 		 */
487 		bzero(&src_sa.sin6_addr, sizeof(src_sa.sin6_addr));
488 	}
489 	ip6->ip6_src = src_sa.sin6_addr;
490 	nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1);
491 	nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT;
492 	nd_ns->nd_ns_code = 0;
493 	nd_ns->nd_ns_reserved = 0;
494 	nd_ns->nd_ns_target = *taddr6;
495 
496 	if (IN6_IS_SCOPE_EMBED(&nd_ns->nd_ns_target))
497 		nd_ns->nd_ns_target.s6_addr16[1] = 0;
498 
499 	/*
500 	 * Add source link-layer address option.
501 	 *
502 	 *				spec		implementation
503 	 *				---		---
504 	 * DAD packet			MUST NOT	do not add the option
505 	 * there's no link layer address:
506 	 *				impossible	do not add the option
507 	 * there's link layer address:
508 	 *	Multicast NS		MUST add one	add the option
509 	 *	Unicast NS		SHOULD add one	add the option
510 	 */
511 	if (!dad && (mac = nd6_ifptomac(ifp))) {
512 		int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
513 		struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1);
514 		/* 8 byte alignments... */
515 		optlen = (optlen + 7) & ~7;
516 
517 		m->m_pkthdr.len += optlen;
518 		m->m_len += optlen;
519 		icmp6len += optlen;
520 		bzero((caddr_t)nd_opt, optlen);
521 		nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR;
522 		nd_opt->nd_opt_len = optlen >> 3;
523 		bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
524 	}
525 
526 	ip6->ip6_plen = htons((u_short)icmp6len);
527 	nd_ns->nd_ns_cksum = 0;
528 	m->m_pkthdr.csum_flags |= M_ICMP_CSUM_OUT;
529 
530 	ip6_output(m, NULL, NULL, dad ? IPV6_UNSPECSRC : 0, &im6o, NULL);
531 	icmp6stat_inc(icp6s_outhist + ND_NEIGHBOR_SOLICIT);
532 	return;
533 
534   bad:
535 	m_freem(m);
536 }
537 
538 /*
539  * Neighbor advertisement input handling.
540  *
541  * Based on RFC 2461
542  * Based on RFC 2462 (duplicated address detection)
543  *
544  * the following items are not implemented yet:
545  * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
546  * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
547  */
548 void
nd6_na_input(struct mbuf * m,int off,int icmp6len)549 nd6_na_input(struct mbuf *m, int off, int icmp6len)
550 {
551 	struct ifnet *ifp;
552 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
553 	struct nd_neighbor_advert *nd_na;
554 	struct in6_addr daddr6 = ip6->ip6_dst;
555 	struct in6_addr taddr6;
556 	int flags;
557 	int is_router;
558 	int is_solicited;
559 	int is_override;
560 	char *lladdr = NULL;
561 	int lladdrlen = 0;
562 	int i_am_router = (atomic_load_int(&ip6_forwarding) != 0);
563 	struct ifaddr *ifa;
564 	struct in6_ifaddr *ifa6;
565 	struct llinfo_nd6 *ln;
566 	struct rtentry *rt = NULL;
567 	struct sockaddr_dl *sdl;
568 	struct nd_opts ndopts;
569 	char addr[INET6_ADDRSTRLEN], addr0[INET6_ADDRSTRLEN];
570 
571 	NET_ASSERT_LOCKED_EXCLUSIVE();
572 
573 	ifp = if_get(m->m_pkthdr.ph_ifidx);
574 	if (ifp == NULL)
575 		goto freeit;
576 
577 	if (ip6->ip6_hlim != 255) {
578 		nd6log((LOG_ERR,
579 		    "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n",
580 		    ip6->ip6_hlim,
581 		    inet_ntop(AF_INET6, &ip6->ip6_src, addr, sizeof(addr)),
582 		    inet_ntop(AF_INET6, &ip6->ip6_dst, addr0, sizeof(addr0)),
583 		    ifp->if_xname));
584 		goto bad;
585 	}
586 
587 	IP6_EXTHDR_GET(nd_na, struct nd_neighbor_advert *, m, off, icmp6len);
588 	if (nd_na == NULL) {
589 		icmp6stat_inc(icp6s_tooshort);
590 		if_put(ifp);
591 		return;
592 	}
593 	taddr6 = nd_na->nd_na_target;
594 	flags = nd_na->nd_na_flags_reserved;
595 	is_router = ((flags & ND_NA_FLAG_ROUTER) != 0);
596 	is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0);
597 	is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0);
598 
599 	if (IN6_IS_SCOPE_EMBED(&taddr6))
600 		taddr6.s6_addr16[1] = htons(ifp->if_index);
601 
602 	if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
603 		nd6log((LOG_ERR,
604 		    "nd6_na_input: invalid target address %s\n",
605 		    inet_ntop(AF_INET6, &taddr6, addr, sizeof(addr))));
606 		goto bad;
607 	}
608 	if (is_solicited && IN6_IS_ADDR_MULTICAST(&daddr6)) {
609 		nd6log((LOG_ERR,
610 		    "nd6_na_input: a solicited adv is multicasted\n"));
611 		goto bad;
612 	}
613 
614 	icmp6len -= sizeof(*nd_na);
615 	if (nd6_options(nd_na + 1, icmp6len, &ndopts) < 0) {
616 		nd6log((LOG_INFO,
617 		    "nd6_na_input: invalid ND option, ignored\n"));
618 		/* nd6_options have incremented stats */
619 		goto freeit;
620 	}
621 
622 	if (IN6_IS_ADDR_MULTICAST(&daddr6) && !ndopts.nd_opts_tgt_lladdr) {
623 		nd6log((LOG_INFO,
624 		    "nd6_na_input: multicast adv without TLLA\n"));
625 		goto bad;
626 	}
627 
628 	if (ndopts.nd_opts_tgt_lladdr) {
629 		lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
630 		lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
631 	}
632 
633 	ifa6 = in6ifa_ifpwithaddr(ifp, &taddr6);
634 	ifa = ifa6 ? &ifa6->ia_ifa : NULL;
635 
636 	/*
637 	 * Target address matches one of my interface address.
638 	 *
639 	 * If my address is tentative, this means that there's somebody
640 	 * already using the same address as mine.  This indicates DAD failure.
641 	 * This is defined in RFC 2462.
642 	 *
643 	 * Otherwise, process as defined in RFC 2461.
644 	 */
645 	if (ifa && (ifatoia6(ifa)->ia6_flags & IN6_IFF_TENTATIVE)) {
646 		struct dadq *dp;
647 
648 		dp = nd6_dad_find(ifa);
649 		if (dp) {
650 			dp->dad_na_icount++;
651 
652 			/* remove the address. */
653 			nd6_dad_duplicated(dp);
654 		}
655 		goto freeit;
656 	}
657 
658 	if (ifa) {
659 #if NCARP > 0
660 		/*
661 		 * Ignore NAs silently for carp addresses if we're not
662 		 * the CARP master.
663 		 */
664 		if (ifp->if_type == IFT_CARP && !carp_iamatch(ifp))
665 			goto freeit;
666 #endif
667 		log(LOG_ERR,
668 		    "nd6_na_input: duplicate IP6 address %s\n",
669 		    inet_ntop(AF_INET6, &taddr6, addr, sizeof(addr)));
670 		goto freeit;
671 	}
672 
673 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
674 		nd6log((LOG_INFO, "nd6_na_input: lladdrlen mismatch for %s "
675 		    "(if %d, NA packet %d)\n",
676 		    inet_ntop(AF_INET6, &taddr6, addr, sizeof(addr)),
677 		    ifp->if_addrlen, lladdrlen - 2));
678 		goto bad;
679 	}
680 
681 	/* Check if we already have this neighbor in our cache. */
682 	rt = nd6_lookup(&taddr6, 0, ifp, ifp->if_rdomain);
683 
684 	/*
685 	 * If we are a router, we may create new stale cache entries upon
686 	 * receiving Unsolicited Neighbor Advertisements.
687 	 */
688 	if (rt == NULL && i_am_router) {
689 		rt = nd6_lookup(&taddr6, 1, ifp, ifp->if_rdomain);
690 		if (rt == NULL || lladdr == NULL ||
691 		    ((sdl = satosdl(rt->rt_gateway)) == NULL))
692 			goto freeit;
693 
694 		ln = (struct llinfo_nd6 *)rt->rt_llinfo;
695 		sdl->sdl_alen = ifp->if_addrlen;
696 		bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
697 
698 		/*
699 		 * RFC9131 6.1.1
700 		 *
701 		 * Routers SHOULD create a new entry for the target address
702 		 * with the reachability state set to STALE.
703 		 */
704 		ln->ln_state = ND6_LLINFO_STALE;
705 		nd6_llinfo_settimer(ln, nd6_gctimer);
706 
707 		goto freeit;
708 	}
709 
710 	/*
711 	 * Host:
712 	 * If no neighbor cache entry is found, NA SHOULD silently be
713 	 * discarded.
714 	 */
715 	if ((rt == NULL) ||
716 	   ((ln = (struct llinfo_nd6 *)rt->rt_llinfo) == NULL) ||
717 	   ((sdl = satosdl(rt->rt_gateway)) == NULL))
718 		goto freeit;
719 
720 	if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
721 		/*
722 		 * If the link-layer has address, and no lladdr option came,
723 		 * discard the packet.
724 		 */
725 		if (ifp->if_addrlen && !lladdr)
726 			goto freeit;
727 
728 		/*
729 		 * Record link-layer address, and update the state.
730 		 */
731 		sdl->sdl_alen = ifp->if_addrlen;
732 		bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
733 		if (is_solicited) {
734 			ln->ln_state = ND6_LLINFO_REACHABLE;
735 			ln->ln_byhint = 0;
736 			/* Notify userland that a new ND entry is reachable. */
737 			rtm_send(rt, RTM_RESOLVE, 0, ifp->if_rdomain);
738 			if (!ND6_LLINFO_PERMANENT(ln)) {
739 				nd6_llinfo_settimer(ln,
740 				    ifp->if_nd->reachable);
741 			}
742 		} else {
743 			ln->ln_state = ND6_LLINFO_STALE;
744 			nd6_llinfo_settimer(ln, nd6_gctimer);
745 		}
746 		if ((ln->ln_router = is_router) != 0) {
747 			/*
748 			 * This means a router's state has changed from
749 			 * non-reachable to probably reachable, and might
750 			 * affect the status of associated prefixes..
751 			 */
752 			if ((rt->rt_flags & RTF_LLINFO) == 0)
753 				goto freeit;	/* ln is gone */
754 		}
755 	} else {
756 		int llchange;
757 
758 		/*
759 		 * Check if the link-layer address has changed or not.
760 		 */
761 		if (!lladdr)
762 			llchange = 0;
763 		else {
764 			if (sdl->sdl_alen) {
765 				if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen))
766 					llchange = 1;
767 				else
768 					llchange = 0;
769 			} else
770 				llchange = 1;
771 		}
772 
773 		/*
774 		 * This is VERY complex.  Look at it with care.
775 		 *
776 		 * override solicit lladdr llchange	action
777 		 *					(L: record lladdr)
778 		 *
779 		 *	0	0	n	--	(2c)
780 		 *	0	0	y	n	(2b) L
781 		 *	0	0	y	y	(1)    REACHABLE->STALE
782 		 *	0	1	n	--	(2c)   *->REACHABLE
783 		 *	0	1	y	n	(2b) L *->REACHABLE
784 		 *	0	1	y	y	(1)    REACHABLE->STALE
785 		 *	1	0	n	--	(2a)
786 		 *	1	0	y	n	(2a) L
787 		 *	1	0	y	y	(2a) L *->STALE
788 		 *	1	1	n	--	(2a)   *->REACHABLE
789 		 *	1	1	y	n	(2a) L *->REACHABLE
790 		 *	1	1	y	y	(2a) L *->REACHABLE
791 		 */
792 		if (!is_override && (lladdr && llchange)) {	   /* (1) */
793 			/*
794 			 * If state is REACHABLE, make it STALE.
795 			 * no other updates should be done.
796 			 */
797 			if (ln->ln_state == ND6_LLINFO_REACHABLE) {
798 				ln->ln_state = ND6_LLINFO_STALE;
799 				nd6_llinfo_settimer(ln, nd6_gctimer);
800 			}
801 			goto freeit;
802 		} else if (is_override				   /* (2a) */
803 			|| (!is_override && (lladdr && !llchange)) /* (2b) */
804 			|| !lladdr) {				   /* (2c) */
805 			/*
806 			 * Update link-local address, if any.
807 			 */
808 			if (llchange) {
809 				log(LOG_INFO, "ndp info overwritten for %s "
810 				    "by %s on %s\n",
811 				    inet_ntop(AF_INET6, &taddr6,
812 					addr, sizeof(addr)),
813 				    ether_sprintf(lladdr), ifp->if_xname);
814 			}
815 			if (lladdr) {
816 				sdl->sdl_alen = ifp->if_addrlen;
817 				bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
818 			}
819 
820 			/*
821 			 * If solicited, make the state REACHABLE.
822 			 * If not solicited and the link-layer address was
823 			 * changed, make it STALE.
824 			 */
825 			if (is_solicited) {
826 				ln->ln_state = ND6_LLINFO_REACHABLE;
827 				ln->ln_byhint = 0;
828 				if (!ND6_LLINFO_PERMANENT(ln)) {
829 					nd6_llinfo_settimer(ln,
830 					    ifp->if_nd->reachable);
831 				}
832 			} else {
833 				if (lladdr && llchange) {
834 					ln->ln_state = ND6_LLINFO_STALE;
835 					nd6_llinfo_settimer(ln, nd6_gctimer);
836 				}
837 			}
838 		}
839 
840 		if (ln->ln_router && !is_router) {
841 			if (!i_am_router) {
842 				/*
843 				 * The neighbor may be used
844 				 * as a next hop for some destinations
845 				 * (e.g. redirect case). So we must
846 				 * call rt6_flush explicitly.
847 				 */
848 				rt6_flush(&ip6->ip6_src, ifp);
849 			}
850 		}
851 		ln->ln_router = is_router;
852 	}
853 	rt->rt_flags &= ~RTF_REJECT;
854 	ln->ln_asked = 0;
855 	if_output_mq(ifp, &ln->ln_mq, &ln_hold_total, rt_key(rt), rt);
856 
857  freeit:
858 	rtfree(rt);
859 	m_freem(m);
860 	if_put(ifp);
861 	return;
862 
863  bad:
864 	icmp6stat_inc(icp6s_badna);
865 	m_freem(m);
866 	if_put(ifp);
867 }
868 
869 /*
870  * Neighbor advertisement output handling.
871  *
872  * Based on RFC 2461
873  *
874  * the following items are not implemented yet:
875  * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
876  * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
877  *
878  * tlladdr - 1 if include target link-layer address
879  * sdl0 - sockaddr_dl (= proxy NA) or NULL
880  */
881 void
nd6_na_output(struct ifnet * ifp,const struct in6_addr * daddr6,const struct in6_addr * taddr6,u_long flags,int tlladdr,struct sockaddr * sdl0)882 nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6,
883     const struct in6_addr *taddr6, u_long flags, int tlladdr,
884     struct sockaddr *sdl0)
885 {
886 	struct mbuf *m;
887 	struct rtentry *rt = NULL;
888 	struct ip6_hdr *ip6;
889 	struct nd_neighbor_advert *nd_na;
890 	struct ip6_moptions im6o;
891 	struct sockaddr_in6 dst_sa;
892 	int icmp6len, maxlen;
893 	caddr_t mac = NULL;
894 
895 #if NCARP > 0
896 	/* Do not send NAs for carp addresses if we're not the CARP master. */
897 	if (ifp->if_type == IFT_CARP && !carp_iamatch(ifp))
898 		return;
899 #endif
900 
901 	/* estimate the size of message */
902 	maxlen = sizeof(*ip6) + sizeof(*nd_na);
903 	maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7;
904 #ifdef DIAGNOSTIC
905 	if (max_linkhdr + maxlen >= MCLBYTES) {
906 		printf("%s: max_linkhdr + maxlen >= MCLBYTES (%d + %d > %d)\n",
907 		    __func__, max_linkhdr, maxlen, MCLBYTES);
908 		panic("%s: insufficient MCLBYTES", __func__);
909 		/* NOTREACHED */
910 	}
911 #endif
912 
913 	MGETHDR(m, M_DONTWAIT, MT_DATA);
914 	if (m && max_linkhdr + maxlen >= MHLEN) {
915 		MCLGET(m, M_DONTWAIT);
916 		if ((m->m_flags & M_EXT) == 0) {
917 			m_free(m);
918 			m = NULL;
919 		}
920 	}
921 	if (m == NULL)
922 		return;
923 	m->m_pkthdr.ph_rtableid = ifp->if_rdomain;
924 
925 	if (IN6_IS_ADDR_MULTICAST(daddr6)) {
926 		m->m_flags |= M_MCAST;
927 		im6o.im6o_ifidx = ifp->if_index;
928 		im6o.im6o_hlim = 255;
929 		im6o.im6o_loop = 0;
930 	}
931 
932 	icmp6len = sizeof(*nd_na);
933 	m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len;
934 	m_align(m, maxlen);
935 
936 	/* fill neighbor advertisement packet */
937 	ip6 = mtod(m, struct ip6_hdr *);
938 	ip6->ip6_flow = 0;
939 	ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
940 	ip6->ip6_vfc |= IPV6_VERSION;
941 	ip6->ip6_nxt = IPPROTO_ICMPV6;
942 	ip6->ip6_hlim = 255;
943 	bzero(&dst_sa, sizeof(dst_sa));
944 	dst_sa.sin6_len = sizeof(struct sockaddr_in6);
945 	dst_sa.sin6_family = AF_INET6;
946 	dst_sa.sin6_addr = *daddr6;
947 	if (IN6_IS_ADDR_UNSPECIFIED(daddr6)) {
948 		/* reply to DAD */
949 		dst_sa.sin6_addr.s6_addr16[0] = __IPV6_ADDR_INT16_MLL;
950 		dst_sa.sin6_addr.s6_addr16[1] = htons(ifp->if_index);
951 		dst_sa.sin6_addr.s6_addr32[1] = 0;
952 		dst_sa.sin6_addr.s6_addr32[2] = 0;
953 		dst_sa.sin6_addr.s6_addr32[3] = __IPV6_ADDR_INT32_ONE;
954 
955 		flags &= ~ND_NA_FLAG_SOLICITED;
956 	}
957 	ip6->ip6_dst = dst_sa.sin6_addr;
958 
959 	/*
960 	 * Select a source whose scope is the same as that of the dest.
961 	 */
962 	rt = rtalloc(sin6tosa(&dst_sa), RT_RESOLVE, ifp->if_rdomain);
963 	if (!rtisvalid(rt)) {
964 		char addr[INET6_ADDRSTRLEN];
965 
966 		nd6log((LOG_DEBUG, "%s: source can't be determined: dst=%s\n",
967 		    __func__, inet_ntop(AF_INET6, &dst_sa.sin6_addr, addr,
968 		    sizeof(addr))));
969 		rtfree(rt);
970 		goto bad;
971 	}
972 	ip6->ip6_src = ifatoia6(rt->rt_ifa)->ia_addr.sin6_addr;
973 	rtfree(rt);
974 	nd_na = (struct nd_neighbor_advert *)(ip6 + 1);
975 	nd_na->nd_na_type = ND_NEIGHBOR_ADVERT;
976 	nd_na->nd_na_code = 0;
977 	nd_na->nd_na_target = *taddr6;
978 	if (IN6_IS_SCOPE_EMBED(&nd_na->nd_na_target))
979 		nd_na->nd_na_target.s6_addr16[1] = 0;
980 
981 	/*
982 	 * "tlladdr" indicates NS's condition for adding tlladdr or not.
983 	 * see nd6_ns_input() for details.
984 	 * Basically, if NS packet is sent to unicast/anycast addr,
985 	 * target lladdr option SHOULD NOT be included.
986 	 */
987 	if (tlladdr) {
988 		/*
989 		 * sdl0 != NULL indicates proxy NA.  If we do proxy, use
990 		 * lladdr in sdl0.  If we are not proxying (sending NA for
991 		 * my address) use lladdr configured for the interface.
992 		 */
993 		if (sdl0 == NULL) {
994 			mac = nd6_ifptomac(ifp);
995 		} else if (sdl0->sa_family == AF_LINK) {
996 			struct sockaddr_dl *sdl;
997 			sdl = satosdl(sdl0);
998 			if (sdl->sdl_alen == ifp->if_addrlen)
999 				mac = LLADDR(sdl);
1000 		}
1001 	}
1002 	if (tlladdr && mac) {
1003 		int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
1004 		struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1);
1005 
1006 		/* roundup to 8 bytes alignment! */
1007 		optlen = (optlen + 7) & ~7;
1008 
1009 		m->m_pkthdr.len += optlen;
1010 		m->m_len += optlen;
1011 		icmp6len += optlen;
1012 		bzero((caddr_t)nd_opt, optlen);
1013 		nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1014 		nd_opt->nd_opt_len = optlen >> 3;
1015 		bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
1016 	} else
1017 		flags &= ~ND_NA_FLAG_OVERRIDE;
1018 
1019 	ip6->ip6_plen = htons((u_short)icmp6len);
1020 	nd_na->nd_na_flags_reserved = flags;
1021 	nd_na->nd_na_cksum = 0;
1022 	m->m_pkthdr.csum_flags |= M_ICMP_CSUM_OUT;
1023 
1024 	ip6_output(m, NULL, NULL, 0, &im6o, NULL);
1025 	icmp6stat_inc(icp6s_outhist + ND_NEIGHBOR_ADVERT);
1026 	return;
1027 
1028   bad:
1029 	m_freem(m);
1030 }
1031 
1032 caddr_t
nd6_ifptomac(struct ifnet * ifp)1033 nd6_ifptomac(struct ifnet *ifp)
1034 {
1035 	switch (ifp->if_type) {
1036 	case IFT_ETHER:
1037 	case IFT_IEEE1394:
1038 	case IFT_PROPVIRTUAL:
1039 	case IFT_CARP:
1040 	case IFT_IEEE80211:
1041 		return ((caddr_t)(ifp + 1));
1042 	default:
1043 		return NULL;
1044 	}
1045 }
1046 
1047 struct dadq *
nd6_dad_find(struct ifaddr * ifa)1048 nd6_dad_find(struct ifaddr *ifa)
1049 {
1050 	struct dadq *dp;
1051 
1052 	TAILQ_FOREACH(dp, &dadq, dad_list) {
1053 		if (dp->dad_ifa == ifa)
1054 			return dp;
1055 	}
1056 	return NULL;
1057 }
1058 
1059 void
nd6_dad_destroy(struct dadq * dp)1060 nd6_dad_destroy(struct dadq *dp)
1061 {
1062 	TAILQ_REMOVE(&dadq, dp, dad_list);
1063 	ifafree(dp->dad_ifa);
1064 	free(dp, M_IP6NDP, sizeof(*dp));
1065 	ip6_dad_pending--;
1066 }
1067 
1068 void
nd6_dad_starttimer(struct dadq * dp)1069 nd6_dad_starttimer(struct dadq *dp)
1070 {
1071 	timeout_set_proc(&dp->dad_timer_ch, nd6_dad_timer, dp->dad_ifa);
1072 	timeout_add_msec(&dp->dad_timer_ch, RETRANS_TIMER);
1073 }
1074 
1075 void
nd6_dad_stoptimer(struct dadq * dp)1076 nd6_dad_stoptimer(struct dadq *dp)
1077 {
1078 	timeout_del(&dp->dad_timer_ch);
1079 }
1080 
1081 /*
1082  * Start Duplicated Address Detection (DAD) for specified interface address.
1083  */
1084 void
nd6_dad_start(struct ifaddr * ifa)1085 nd6_dad_start(struct ifaddr *ifa)
1086 {
1087 	struct in6_ifaddr *ia6 = ifatoia6(ifa);
1088 	struct dadq *dp;
1089 	char addr[INET6_ADDRSTRLEN];
1090 
1091 	NET_ASSERT_LOCKED();
1092 
1093 	/*
1094 	 * If we don't need DAD, don't do it.
1095 	 * There are several cases:
1096 	 * - DAD is disabled (ip6_dad_count == 0)
1097 	 * - the interface address is anycast
1098 	 */
1099 	KASSERT(ia6->ia6_flags & IN6_IFF_TENTATIVE);
1100 	if ((ia6->ia6_flags & IN6_IFF_ANYCAST) || (!ip6_dad_count)) {
1101 		ia6->ia6_flags &= ~IN6_IFF_TENTATIVE;
1102 
1103 		rtm_addr(RTM_CHGADDRATTR, ifa);
1104 
1105 		return;
1106 	}
1107 
1108 	/* DAD already in progress */
1109 	if (nd6_dad_find(ifa) != NULL)
1110 		return;
1111 
1112 	dp = malloc(sizeof(*dp), M_IP6NDP, M_NOWAIT | M_ZERO);
1113 	if (dp == NULL) {
1114 		log(LOG_ERR, "%s: memory allocation failed for %s(%s)\n",
1115 			__func__, inet_ntop(AF_INET6, &ia6->ia_addr.sin6_addr,
1116 			    addr, sizeof(addr)),
1117 			ifa->ifa_ifp ? ifa->ifa_ifp->if_xname : "???");
1118 		return;
1119 	}
1120 
1121 	TAILQ_INSERT_TAIL(&dadq, dp, dad_list);
1122 	ip6_dad_pending++;
1123 
1124 	nd6log((LOG_DEBUG, "%s: starting DAD for %s\n", ifa->ifa_ifp->if_xname,
1125 	    inet_ntop(AF_INET6, &ia6->ia_addr.sin6_addr, addr, sizeof(addr))));
1126 
1127 	/*
1128 	 * Send NS packet for DAD, ip6_dad_count times.
1129 	 * Note that we must delay the first transmission, if this is the
1130 	 * first packet to be sent from the interface after interface
1131 	 * (re)initialization.
1132 	 */
1133 	dp->dad_ifa = ifaref(ifa);
1134 	dp->dad_count = ip6_dad_count;
1135 	dp->dad_ns_icount = dp->dad_na_icount = 0;
1136 	dp->dad_ns_ocount = dp->dad_ns_tcount = 0;
1137 	nd6_dad_ns_output(dp, ifa);
1138 	nd6_dad_starttimer(dp);
1139 }
1140 
1141 /*
1142  * terminate DAD unconditionally.  used for address removals.
1143  */
1144 void
nd6_dad_stop(struct ifaddr * ifa)1145 nd6_dad_stop(struct ifaddr *ifa)
1146 {
1147 	struct dadq *dp;
1148 
1149 	dp = nd6_dad_find(ifa);
1150 	if (!dp) {
1151 		/* DAD wasn't started yet */
1152 		return;
1153 	}
1154 
1155 	nd6_dad_stoptimer(dp);
1156 	nd6_dad_destroy(dp);
1157 }
1158 
1159 void
nd6_dad_timer(void * xifa)1160 nd6_dad_timer(void *xifa)
1161 {
1162 	struct ifaddr *ifa;
1163 	struct in6_ifaddr *ia6;
1164 	struct in6_addr daddr6, taddr6;
1165 	struct ifnet *ifp;
1166 	struct dadq *dp;
1167 	char addr[INET6_ADDRSTRLEN];
1168 
1169 	NET_LOCK();
1170 
1171 	/* Sanity check */
1172 	if (xifa == NULL) {
1173 		log(LOG_ERR, "%s: called with null parameter\n", __func__);
1174 		goto done;
1175 	}
1176 	ifa = xifa;
1177 	ia6 = ifatoia6(ifa);
1178 	taddr6 = ia6->ia_addr.sin6_addr;
1179 	ifp = ifa->ifa_ifp;
1180 	dp = nd6_dad_find(ifa);
1181 	if (dp == NULL) {
1182 		log(LOG_ERR, "%s: DAD structure not found\n", __func__);
1183 		goto done;
1184 	}
1185 	if (ia6->ia6_flags & IN6_IFF_DUPLICATED) {
1186 		log(LOG_ERR, "%s: called with duplicated address %s(%s)\n",
1187 		    __func__, inet_ntop(AF_INET6, &ia6->ia_addr.sin6_addr,
1188 			addr, sizeof(addr)),
1189 		    ifa->ifa_ifp ? ifa->ifa_ifp->if_xname : "???");
1190 		goto done;
1191 	}
1192 	if ((ia6->ia6_flags & IN6_IFF_TENTATIVE) == 0) {
1193 		log(LOG_ERR, "%s: called with non-tentative address %s(%s)\n",
1194 		    __func__, inet_ntop(AF_INET6, &ia6->ia_addr.sin6_addr,
1195 			addr, sizeof(addr)),
1196 		    ifa->ifa_ifp ? ifa->ifa_ifp->if_xname : "???");
1197 		goto done;
1198 	}
1199 
1200 	/* timeouted with IFF_{RUNNING,UP} check */
1201 	if (dp->dad_ns_tcount > dad_maxtry) {
1202 		nd6log((LOG_INFO, "%s: could not run DAD, driver problem?\n",
1203 			ifa->ifa_ifp->if_xname));
1204 
1205 		nd6_dad_destroy(dp);
1206 		goto done;
1207 	}
1208 
1209 	/* Need more checks? */
1210 	if (dp->dad_ns_ocount < dp->dad_count) {
1211 		/*
1212 		 * We have more NS to go.  Send NS packet for DAD.
1213 		 */
1214 		nd6_dad_ns_output(dp, ifa);
1215 		nd6_dad_starttimer(dp);
1216 	} else {
1217 		/*
1218 		 * We have transmitted sufficient number of DAD packets.
1219 		 */
1220 		if (dp->dad_na_icount || dp->dad_ns_icount) {
1221 			/* dp will be freed in nd6_dad_duplicated() */
1222 			nd6_dad_duplicated(dp);
1223 		} else {
1224 			/*
1225 			 * We are done with DAD.  No NA came, no NS came.
1226 			 */
1227 			ia6->ia6_flags &= ~IN6_IFF_TENTATIVE;
1228 
1229 			rtm_addr(RTM_CHGADDRATTR, ifa);
1230 
1231 			nd6log((LOG_DEBUG,
1232 			    "%s: DAD complete for %s - no duplicates found\n",
1233 			    ifa->ifa_ifp->if_xname,
1234 			    inet_ntop(AF_INET6, &ia6->ia_addr.sin6_addr,
1235 				addr, sizeof(addr))));
1236 
1237 			daddr6 = in6addr_linklocal_allrouters;
1238 			daddr6.s6_addr16[1] = htons(ifp->if_index);
1239 			/* RFC9131 - inform routers about our new address */
1240 			nd6_na_output(ifp, &daddr6, &taddr6, 0, 1, NULL);
1241 
1242 			nd6_dad_destroy(dp);
1243 		}
1244 	}
1245 
1246 done:
1247 	NET_UNLOCK();
1248 }
1249 
1250 void
nd6_dad_duplicated(struct dadq * dp)1251 nd6_dad_duplicated(struct dadq *dp)
1252 {
1253 	struct in6_ifaddr *ia6 = ifatoia6(dp->dad_ifa);
1254 	char addr[INET6_ADDRSTRLEN];
1255 
1256 	log(LOG_ERR, "%s: DAD detected duplicate IPv6 address %s: "
1257 	    "NS in/out=%d/%d, NA in=%d\n",
1258 	    ia6->ia_ifp->if_xname,
1259 	    inet_ntop(AF_INET6, &ia6->ia_addr.sin6_addr, addr, sizeof(addr)),
1260 	    dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_na_icount);
1261 
1262 	ia6->ia6_flags &= ~IN6_IFF_TENTATIVE;
1263 	ia6->ia6_flags |= IN6_IFF_DUPLICATED;
1264 
1265 	/* We are done with DAD, with duplicated address found. (failure) */
1266 	nd6_dad_stoptimer(dp);
1267 
1268 	log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n",
1269 	    ia6->ia_ifp->if_xname,
1270 	    inet_ntop(AF_INET6, &ia6->ia_addr.sin6_addr, addr, sizeof(addr)));
1271 	log(LOG_ERR, "%s: manual intervention required\n",
1272 	    ia6->ia_ifp->if_xname);
1273 
1274 	rtm_addr(RTM_CHGADDRATTR, dp->dad_ifa);
1275 
1276 	nd6_dad_destroy(dp);
1277 }
1278 
1279 void
nd6_dad_ns_output(struct dadq * dp,struct ifaddr * ifa)1280 nd6_dad_ns_output(struct dadq *dp, struct ifaddr *ifa)
1281 {
1282 	struct in6_ifaddr *ia6 = ifatoia6(ifa);
1283 	struct ifnet *ifp = ifa->ifa_ifp;
1284 
1285 	dp->dad_ns_tcount++;
1286 	if ((ifp->if_flags & IFF_UP) == 0) {
1287 #if 0
1288 		printf("%s: interface down?\n", ifp->if_xname);
1289 #endif
1290 		return;
1291 	}
1292 	if ((ifp->if_flags & IFF_RUNNING) == 0) {
1293 #if 0
1294 		printf("%s: interface not running?\n", ifp->if_xname);
1295 #endif
1296 		return;
1297 	}
1298 
1299 	dp->dad_ns_ocount++;
1300 	nd6_ns_output(ifp, NULL, &ia6->ia_addr.sin6_addr, NULL, 1);
1301 }
1302 
1303 void
nd6_dad_ns_input(struct ifaddr * ifa)1304 nd6_dad_ns_input(struct ifaddr *ifa)
1305 {
1306 	struct dadq *dp;
1307 
1308 	if (!ifa)
1309 		panic("%s: ifa == NULL", __func__);
1310 
1311 	dp = nd6_dad_find(ifa);
1312 	if (dp == NULL) {
1313 		log(LOG_ERR, "%s: DAD structure not found\n", __func__);
1314 		return;
1315 	}
1316 
1317 	/*
1318 	 * if I'm yet to start DAD, someone else started using this address
1319 	 * first.  I have a duplicate and you win.
1320 	 */
1321 	/* XXX more checks for loopback situation - see nd6_dad_timer too */
1322 	if (dp->dad_ns_ocount == 0) {
1323 		/* dp will be freed in nd6_dad_duplicated() */
1324 		nd6_dad_duplicated(dp);
1325 	} else {
1326 		/*
1327 		 * not sure if I got a duplicate.
1328 		 * increment ns count and see what happens.
1329 		 */
1330 		dp->dad_ns_icount++;
1331 	}
1332 }
1333 
1334 /*
1335  * Check whether ``addr'' is a neighbor address connected to ``ifp''.
1336  */
1337 int
nd6_isneighbor(const struct ifnet * ifp,const struct in6_addr * addr)1338 nd6_isneighbor(const struct ifnet *ifp, const struct in6_addr *addr)
1339 {
1340 	struct rtentry		*rt;
1341 	struct sockaddr_in6	 sin6;
1342 	unsigned int		 tableid = ifp->if_rdomain;
1343 	int rv = 0;
1344 
1345 	memset(&sin6, 0, sizeof(sin6));
1346 	sin6.sin6_len = sizeof(struct sockaddr_in6);
1347 	sin6.sin6_family = AF_INET6;
1348 	sin6.sin6_addr = *addr;
1349 	rt = rtalloc(sin6tosa(&sin6), 0, tableid);
1350 
1351 	if (rtisvalid(rt) && ISSET(rt->rt_flags, RTF_CLONING|RTF_CLONED))
1352 		rv = if_isconnected(ifp, rt->rt_ifidx);
1353 
1354 	rtfree(rt);
1355 	return (rv);
1356 }
1357