xref: /dragonfly/sys/netinet6/nd6_nbr.c (revision 2f08963f)
1 /*	$FreeBSD: src/sys/netinet6/nd6_nbr.c,v 1.4.2.6 2003/01/23 21:06:47 sam Exp $	*/
2 /*	$KAME: nd6_nbr.c,v 1.86 2002/01/21 02:33:04 jinmei Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #include "opt_inet.h"
34 #include "opt_inet6.h"
35 #include "opt_carp.h"
36 
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/malloc.h>
40 #include <sys/mbuf.h>
41 #include <sys/socket.h>
42 #include <sys/sockio.h>
43 #include <sys/time.h>
44 #include <sys/kernel.h>
45 #include <sys/errno.h>
46 #include <sys/syslog.h>
47 #include <sys/queue.h>
48 #include <sys/callout.h>
49 #include <sys/mutex.h>
50 
51 #include <sys/thread2.h>
52 #include <sys/mutex2.h>
53 
54 #include <net/if.h>
55 #include <net/if_types.h>
56 #include <net/if_dl.h>
57 #include <net/route.h>
58 #include <net/netisr2.h>
59 #include <net/netmsg2.h>
60 
61 #include <netinet/in.h>
62 #include <netinet/in_var.h>
63 #include <netinet6/in6_var.h>
64 #include <netinet/ip6.h>
65 #include <netinet6/ip6_var.h>
66 #include <netinet6/nd6.h>
67 #include <netinet/icmp6.h>
68 
69 #include <net/net_osdep.h>
70 
71 #ifdef CARP
72 #include <netinet/ip_carp.h>
73 #endif
74 
75 
76 #define SDL(s) ((struct sockaddr_dl *)s)
77 
78 struct dadq;
79 static struct dadq *nd6_dad_find(struct ifaddr *);
80 static void nd6_dad_starttimer(struct dadq *, int);
81 static void nd6_dad_stoptimer(struct dadq *);
82 static void nd6_dad_timer(void *);
83 static void nd6_dad_timer_handler(netmsg_t);
84 static void nd6_dad_ns_output(struct dadq *);
85 static void nd6_dad_ns_input(struct ifaddr *);
86 static void nd6_dad_na_input(struct ifaddr *);
87 static struct dadq *nd6_dad_create(struct ifaddr *);
88 static void nd6_dad_destroy(struct dadq *);
89 static void nd6_dad_duplicated(struct ifaddr *);
90 
91 static int dad_ignore_ns = 0;	/* ignore NS in DAD - specwise incorrect*/
92 static int dad_maxtry = 15;	/* max # of *tries* to transmit DAD packet */
93 
94 /*
95  * Input an Neighbor Solicitation Message.
96  *
97  * Based on RFC 2461
98  * Based on RFC 2462 (duplicated address detection)
99  */
100 void
nd6_ns_input(struct mbuf * m,int off,int icmp6len)101 nd6_ns_input(struct mbuf *m, int off, int icmp6len)
102 {
103 	struct ifnet *ifp = m->m_pkthdr.rcvif;
104 	struct ifnet *cmpifp;
105 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
106 	struct nd_neighbor_solicit *nd_ns;
107 	struct in6_addr saddr6 = ip6->ip6_src;
108 	struct in6_addr daddr6 = ip6->ip6_dst;
109 	struct in6_addr taddr6;
110 	struct in6_addr myaddr6;
111 	char *lladdr = NULL;
112 	struct ifaddr *ifa = NULL;
113 	int lladdrlen = 0;
114 	int anycast = 0, proxy = 0, tentative = 0;
115 	int tlladdr;
116 	union nd_opts ndopts;
117 	struct sockaddr_dl *proxydl = NULL;
118 
119 	/*
120 	 * Collapse interfaces to the bridge for comparison and
121 	 * mac (llinfo) purposes.
122 	 */
123 	cmpifp = ifp;
124 	if (ifp->if_bridge)
125 		cmpifp = ifp->if_bridge;
126 
127 #ifndef PULLDOWN_TEST
128 	IP6_EXTHDR_CHECK(m, off, icmp6len,);
129 	nd_ns = (struct nd_neighbor_solicit *)((caddr_t)ip6 + off);
130 #else
131 	IP6_EXTHDR_GET(nd_ns, struct nd_neighbor_solicit *, m, off, icmp6len);
132 	if (nd_ns == NULL) {
133 		icmp6stat.icp6s_tooshort++;
134 		return;
135 	}
136 #endif
137 	ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */
138 	taddr6 = nd_ns->nd_ns_target;
139 
140 	if (ip6->ip6_hlim != 255) {
141 		nd6log((LOG_ERR,
142 		    "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n",
143 		    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
144 		    ip6_sprintf(&ip6->ip6_dst), if_name(ifp)));
145 		goto bad;
146 	}
147 
148 	if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) {
149 		/* dst has to be solicited node multicast address. */
150 		if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL &&
151 		    /* don't check ifindex portion */
152 		    daddr6.s6_addr32[1] == 0 &&
153 		    daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE &&
154 		    daddr6.s6_addr8[12] == 0xff) {
155 			; /* good */
156 		} else {
157 			nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
158 			    "(wrong ip6 dst)\n"));
159 			goto bad;
160 		}
161 	} else if (!nd6_onlink_ns_rfc4861) {
162 		struct sockaddr_in6 src_sa6;
163 
164 		/*
165 		 * According to recent IETF discussions, it is not a good idea
166 		 * to accept a NS from an address which would not be deemed
167 		 * to be a neighbor otherwise.  This point is expected to be
168 		 * clarified in future revisions of the specification.
169 		 */
170 		bzero(&src_sa6, sizeof(src_sa6));
171 		src_sa6.sin6_family = AF_INET6;
172 		src_sa6.sin6_len = sizeof(src_sa6);
173 		src_sa6.sin6_addr = saddr6;
174 		if (nd6_is_addr_neighbor(&src_sa6, ifp) == 0) {
175 			nd6log((LOG_INFO, "nd6_ns_input: "
176 			    "NS packet from non-neighbor\n"));
177 			goto bad;
178 		}
179 	}
180 
181 	if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
182 		nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n"));
183 		goto bad;
184 	}
185 
186 	if (IN6_IS_SCOPE_LINKLOCAL(&taddr6))
187 		taddr6.s6_addr16[1] = htons(ifp->if_index);
188 
189 	icmp6len -= sizeof(*nd_ns);
190 	nd6_option_init(nd_ns + 1, icmp6len, &ndopts);
191 	if (nd6_options(&ndopts) < 0) {
192 		nd6log((LOG_INFO,
193 		    "nd6_ns_input: invalid ND option, ignored\n"));
194 		/* nd6_options have incremented stats */
195 		goto freeit;
196 	}
197 
198 	if (ndopts.nd_opts_src_lladdr) {
199 		lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1);
200 		lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3;
201 	}
202 
203 	if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) && lladdr) {
204 		nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
205 		    "(link-layer address option)\n"));
206 		goto bad;
207 	}
208 
209 	/*
210 	 * Attaching target link-layer address to the NA?
211 	 * (RFC 2461 7.2.4)
212 	 *
213 	 * NS IP dst is unicast/anycast			MUST NOT add
214 	 * NS IP dst is solicited-node multicast	MUST add
215 	 *
216 	 * In implementation, we add target link-layer address by default.
217 	 * We do not add one in MUST NOT cases.
218 	 */
219 #if 0 /* too much! */
220 	ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &daddr6);
221 	if (ifa && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST))
222 		tlladdr = 0;
223 	else
224 #endif
225 	if (!IN6_IS_ADDR_MULTICAST(&daddr6))
226 		tlladdr = 0;
227 	else
228 		tlladdr = 1;
229 
230 	/*
231 	 * Target address (taddr6) must be either:
232 	 * (1) Valid unicast/anycast address for my receiving interface.
233 	 * (2) Unicast or anycast address for which I'm offering proxy
234 	 *     service.
235 	 * (3) "tentative" address on which DAD is being performed.
236 	 */
237 	/* (1) and (3) check. */
238 #ifdef CARP
239 	if (ifp->if_carp)
240 		ifa = carp_iamatch6(ifp->if_carp, &taddr6);
241 	if (!ifa)
242 		ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
243 #else
244 	ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
245 #endif
246 
247 	/*
248 	 * (2) Check proxying.  Requires ip6_forwarding to be turned on.
249 	 *
250 	 *     If the packet is anycast the target route must be on a
251 	 *     different interface because the anycast will get anything
252 	 *     on the current interface.
253 	 *
254 	 *     If the packet is unicast the target route may be on the
255 	 *     same interface.  If the gateway is a (typically manually
256 	 *     configured) link address we can directly offer it.
257 	 *     XXX for now we don't do this but instead offer ours and
258 	 *     presumably relay.
259 	 *
260 	 *     WARNING! Since this is a subnet proxy the interface proxying
261 	 *     the ND6 must be in promiscuous mode or it will not see the
262 	 *     solicited multicast requests for various hosts being proxied.
263 	 *
264 	 *     WARNING! Since this is a subnet proxy we have to treat bridge
265 	 *     interfaces as being the bridge itself so we do not proxy-nd6
266 	 *     between bridge interfaces (which are effectively switched).
267 	 *
268 	 *     (In the specific-host-proxy case via RTF_ANNOUNCE, which is
269 	 *     a bitch to configure, a specific multicast route is already
270 	 *     added for that host <-- NOT RECOMMENDED).
271 	 */
272 	if (!ifa && ip6_forwarding) {
273 		struct rtentry *rt;
274 		struct sockaddr_in6 tsin6;
275 		struct ifnet *rtifp;
276 
277 		bzero(&tsin6, sizeof tsin6);
278 		tsin6.sin6_len = sizeof(struct sockaddr_in6);
279 		tsin6.sin6_family = AF_INET6;
280 		tsin6.sin6_addr = taddr6;
281 
282 		rt = rtpurelookup((struct sockaddr *)&tsin6);
283 		rtifp = rt ? rt->rt_ifp : NULL;
284 		if (rtifp && rtifp->if_bridge)
285 			rtifp = rtifp->if_bridge;
286 
287 		if (rt != NULL && (rt->rt_flags & RTF_ANNOUNCE) &&
288 		    (cmpifp != rtifp || (m->m_flags & M_MCAST) == 0)) {
289 			ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(cmpifp,
290 				IN6_IFF_NOTREADY|IN6_IFF_ANYCAST);
291 			nd6log((LOG_INFO,
292 			       "nd6_ns_input: nd6 proxy %s(%s)<-%s ifa %p\n",
293 			       if_name(cmpifp), if_name(ifp),
294 			       if_name(rtifp), ifa));
295 			if (ifa) {
296 				proxy = 1;
297 				/*
298 				 * Manual link address on same interface
299 				 * w/announce flag will proxy-arp using
300 				 * target mac, else our mac is used.
301 				 */
302 				if (cmpifp == rtifp &&
303 				    rt->rt_gateway->sa_family == AF_LINK) {
304 					proxydl = SDL(rt->rt_gateway);
305 				}
306 			}
307 		}
308 		if (rt != NULL)
309 			--rt->rt_refcnt;
310 	}
311 	if (ifa == NULL) {
312 		/*
313 		 * We've got an NS packet, and we don't have that adddress
314 		 * assigned for us.  We MUST silently ignore it.
315 		 * See RFC2461 7.2.3.
316 		 */
317 		goto freeit;
318 	}
319 	myaddr6 = *IFA_IN6(ifa);
320 	anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST;
321 	tentative = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE;
322 	if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED)
323 		goto freeit;
324 
325 	if (lladdr && ((cmpifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
326 		nd6log((LOG_INFO, "nd6_ns_input: lladdrlen mismatch for %s "
327 		    "(if %d, NS packet %d)\n",
328 		    ip6_sprintf(&taddr6), cmpifp->if_addrlen, lladdrlen - 2));
329 		goto bad;
330 	}
331 
332 	if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) {
333 		nd6log((LOG_INFO, "nd6_ns_input: duplicate IP6 address %s\n",
334 		    ip6_sprintf(&saddr6)));
335 		goto freeit;
336 	}
337 
338 	/*
339 	 * We have neighbor solicitation packet, with target address equals to
340 	 * one of my tentative address.
341 	 *
342 	 * src addr	how to process?
343 	 * ---		---
344 	 * multicast	of course, invalid (rejected in ip6_input)
345 	 * unicast	somebody is doing address resolution -> ignore
346 	 * unspec	dup address detection
347 	 *
348 	 * The processing is defined in RFC 2462.
349 	 */
350 	if (tentative) {
351 		/*
352 		 * If source address is unspecified address, it is for
353 		 * duplicated address detection.
354 		 *
355 		 * If not, the packet is for addess resolution;
356 		 * silently ignore it.
357 		 */
358 		if (IN6_IS_ADDR_UNSPECIFIED(&saddr6))
359 			nd6_dad_ns_input(ifa);
360 
361 		goto freeit;
362 	}
363 
364 	/*
365 	 * If the source address is unspecified address, entries must not
366 	 * be created or updated.
367 	 * It looks that sender is performing DAD.  Output NA toward
368 	 * all-node multicast address, to tell the sender that I'm using
369 	 * the address.
370 	 * S bit ("solicited") must be zero.
371 	 */
372 	if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) {
373 		saddr6 = kin6addr_linklocal_allnodes;
374 		saddr6.s6_addr16[1] = htons(cmpifp->if_index);
375 		nd6_na_output(cmpifp, &saddr6, &taddr6,
376 		    ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) |
377 		    (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0),
378 		    tlladdr, (struct sockaddr *)proxydl);
379 		goto freeit;
380 	}
381 
382 	nd6_cache_lladdr(cmpifp, &saddr6, lladdr, lladdrlen,
383 	    ND_NEIGHBOR_SOLICIT, 0);
384 
385 	nd6_na_output(ifp, &saddr6, &taddr6,
386 	    ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) |
387 	    (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED,
388 	    tlladdr, (struct sockaddr *)proxydl);
389 freeit:
390 	m_freem(m);
391 	return;
392 
393 bad:
394 	nd6log((LOG_ERR, "nd6_ns_input: src=%s\n", ip6_sprintf(&saddr6)));
395 	nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n", ip6_sprintf(&daddr6)));
396 	nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n", ip6_sprintf(&taddr6)));
397 	icmp6stat.icp6s_badns++;
398 	m_freem(m);
399 }
400 
401 /*
402  * Output an Neighbor Solicitation Message. Caller specifies:
403  *	- ICMP6 header source IP6 address
404  *	- ND6 header target IP6 address
405  *	- ND6 header source datalink address
406  *
407  * Based on RFC 2461
408  * Based on RFC 2462 (duplicated address detection)
409  */
410 void
nd6_ns_output(struct ifnet * ifp,const struct in6_addr * daddr6,const struct in6_addr * taddr6,struct llinfo_nd6 * ln,int dad)411 nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6,
412 	      const struct in6_addr *taddr6,
413 	      struct llinfo_nd6 *ln,	/* for source address determination */
414 	      int dad)			/* duplicated address detection */
415 {
416 	struct mbuf *m;
417 	struct ip6_hdr *ip6;
418 	struct nd_neighbor_solicit *nd_ns;
419 	struct in6_ifaddr *ia = NULL;
420 	struct ip6_moptions im6o;
421 	int icmp6len;
422 	int maxlen;
423 	caddr_t mac;
424 	struct ifnet *outif = NULL;
425 
426 	if (IN6_IS_ADDR_MULTICAST(taddr6))
427 		return;
428 
429 	/* estimate the size of message */
430 	maxlen = sizeof(*ip6) + sizeof(*nd_ns);
431 	maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7;
432 	if (max_linkhdr + maxlen > MCLBYTES) {
433 #ifdef DIAGNOSTIC
434 		kprintf("nd6_ns_output: max_linkhdr + maxlen > MCLBYTES "
435 		    "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES);
436 #endif
437 		return;
438 	}
439 
440 	m = m_getb(max_linkhdr + maxlen, M_NOWAIT, MT_DATA, M_PKTHDR);
441 	if (m == NULL)
442 		return;
443 
444 	if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) {
445 		m->m_flags |= M_MCAST;
446 		im6o.im6o_multicast_ifp = ifp;
447 		im6o.im6o_multicast_hlim = 255;
448 		im6o.im6o_multicast_loop = 0;
449 	}
450 
451 	icmp6len = sizeof(*nd_ns);
452 	m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len;
453 	m->m_data += max_linkhdr;	/* or MH_ALIGN() equivalent? */
454 
455 	/* fill neighbor solicitation packet */
456 	ip6 = mtod(m, struct ip6_hdr *);
457 	ip6->ip6_flow = 0;
458 	ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
459 	ip6->ip6_vfc |= IPV6_VERSION;
460 	/* ip6->ip6_plen will be set later */
461 	ip6->ip6_nxt = IPPROTO_ICMPV6;
462 	ip6->ip6_hlim = 255;
463 	if (daddr6)
464 		ip6->ip6_dst = *daddr6;
465 	else {
466 		ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL;
467 		ip6->ip6_dst.s6_addr16[1] = htons(ifp->if_index);
468 		ip6->ip6_dst.s6_addr32[1] = 0;
469 		ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE;
470 		ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3];
471 		ip6->ip6_dst.s6_addr8[12] = 0xff;
472 	}
473 	if (!dad) {
474 		/*
475 		 * RFC2461 7.2.2:
476 		 * "If the source address of the packet prompting the
477 		 * solicitation is the same as one of the addresses assigned
478 		 * to the outgoing interface, that address SHOULD be placed
479 		 * in the IP Source Address of the outgoing solicitation.
480 		 * Otherwise, any one of the addresses assigned to the
481 		 * interface should be used."
482 		 *
483 		 * We use the source address for the prompting packet
484 		 * (saddr6), if:
485 		 * - saddr6 is given from the caller (by giving "ln"), and
486 		 * - saddr6 belongs to the outgoing interface.
487 		 * Otherwise, we perform a scope-wise match.
488 		 */
489 		struct ip6_hdr *hip6;		/* hold ip6 */
490 		struct in6_addr *saddr6;
491 
492 		if (ln && ln->ln_hold) {
493 			hip6 = mtod(ln->ln_hold, struct ip6_hdr *);
494 			/* XXX pullup? */
495 			if (sizeof(*hip6) < ln->ln_hold->m_len)
496 				saddr6 = &hip6->ip6_src;
497 			else
498 				saddr6 = NULL;
499 		} else
500 			saddr6 = NULL;
501 		if (saddr6 && in6ifa_ifpwithaddr(ifp, saddr6))
502 			bcopy(saddr6, &ip6->ip6_src, sizeof(*saddr6));
503 		else {
504 			ia = in6_ifawithifp(ifp, &ip6->ip6_dst);
505 			if (ia == NULL) {
506 				m_freem(m);
507 				return;
508 			}
509 			ip6->ip6_src = ia->ia_addr.sin6_addr;
510 		}
511 	} else {
512 		/*
513 		 * Source address for DAD packet must always be IPv6
514 		 * unspecified address. (0::0)
515 		 */
516 		bzero(&ip6->ip6_src, sizeof(ip6->ip6_src));
517 	}
518 	nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1);
519 	nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT;
520 	nd_ns->nd_ns_code = 0;
521 	nd_ns->nd_ns_reserved = 0;
522 	nd_ns->nd_ns_target = *taddr6;
523 	in6_clearscope(&nd_ns->nd_ns_target); /* XXX */
524 
525 	/*
526 	 * Add source link-layer address option.
527 	 *
528 	 *				spec		implementation
529 	 *				---		---
530 	 * DAD packet			MUST NOT	do not add the option
531 	 * there's no link layer address:
532 	 *				impossible	do not add the option
533 	 * there's link layer address:
534 	 *	Multicast NS		MUST add one	add the option
535 	 *	Unicast NS		SHOULD add one	add the option
536 	 */
537 	if (!dad && (mac = nd6_ifptomac(ifp))) {
538 		int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
539 		struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1);
540 		/* 8 byte alignments... */
541 		optlen = (optlen + 7) & ~7;
542 
543 		m->m_pkthdr.len += optlen;
544 		m->m_len += optlen;
545 		icmp6len += optlen;
546 		bzero((caddr_t)nd_opt, optlen);
547 		nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR;
548 		nd_opt->nd_opt_len = optlen >> 3;
549 		bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
550 	}
551 
552 	ip6->ip6_plen = htons((u_short)icmp6len);
553 	nd_ns->nd_ns_cksum = 0;
554 	nd_ns->nd_ns_cksum =
555 	    in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len);
556 
557 	ip6_output(m, NULL, NULL, dad ? IPV6_DADOUTPUT : 0, &im6o, &outif, NULL);
558 	if (outif) {
559 		icmp6_ifstat_inc(outif, ifs6_out_msg);
560 		icmp6_ifstat_inc(outif, ifs6_out_neighborsolicit);
561 	}
562 	icmp6stat.icp6s_outhist[ND_NEIGHBOR_SOLICIT]++;
563 }
564 
565 /*
566  * Neighbor advertisement input handling.
567  *
568  * Based on RFC 2461
569  * Based on RFC 2462 (duplicated address detection)
570  *
571  * the following items are not implemented yet:
572  * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
573  * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
574  */
575 void
nd6_na_input(struct mbuf * m,int off,int icmp6len)576 nd6_na_input(struct mbuf *m, int off, int icmp6len)
577 {
578 	struct ifnet *ifp = m->m_pkthdr.rcvif;
579 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
580 	struct nd_neighbor_advert *nd_na;
581 	struct in6_addr saddr6 = ip6->ip6_src;
582 	struct in6_addr daddr6 = ip6->ip6_dst;
583 	struct in6_addr taddr6;
584 	int flags;
585 	int is_router;
586 	int is_solicited;
587 	int is_override;
588 	char *lladdr = NULL;
589 	int lladdrlen = 0;
590 	struct ifaddr *ifa;
591 	struct llinfo_nd6 *ln;
592 	struct rtentry *rt;
593 	struct sockaddr_dl *sdl;
594 	union nd_opts ndopts;
595 
596 	if (ip6->ip6_hlim != 255) {
597 		nd6log((LOG_ERR,
598 		    "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n",
599 		    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
600 		    ip6_sprintf(&ip6->ip6_dst), if_name(ifp)));
601 		goto bad;
602 	}
603 
604 #ifndef PULLDOWN_TEST
605 	IP6_EXTHDR_CHECK(m, off, icmp6len,);
606 	nd_na = (struct nd_neighbor_advert *)((caddr_t)ip6 + off);
607 #else
608 	IP6_EXTHDR_GET(nd_na, struct nd_neighbor_advert *, m, off, icmp6len);
609 	if (nd_na == NULL) {
610 		icmp6stat.icp6s_tooshort++;
611 		return;
612 	}
613 #endif
614 	taddr6 = nd_na->nd_na_target;
615 	flags = nd_na->nd_na_flags_reserved;
616 	is_router = ((flags & ND_NA_FLAG_ROUTER) != 0);
617 	is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0);
618 	is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0);
619 
620 	if (IN6_IS_SCOPE_LINKLOCAL(&taddr6))
621 		taddr6.s6_addr16[1] = htons(ifp->if_index);
622 
623 	if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
624 		nd6log((LOG_ERR,
625 		    "nd6_na_input: invalid target address %s\n",
626 		    ip6_sprintf(&taddr6)));
627 		goto bad;
628 	}
629 	if (IN6_IS_ADDR_MULTICAST(&daddr6))
630 		if (is_solicited) {
631 			nd6log((LOG_ERR,
632 			    "nd6_na_input: a solicited adv is multicasted\n"));
633 			goto bad;
634 		}
635 
636 	icmp6len -= sizeof(*nd_na);
637 	nd6_option_init(nd_na + 1, icmp6len, &ndopts);
638 	if (nd6_options(&ndopts) < 0) {
639 		nd6log((LOG_INFO,
640 		    "nd6_na_input: invalid ND option, ignored\n"));
641 		/* nd6_options have incremented stats */
642 		goto freeit;
643 	}
644 
645 	if (ndopts.nd_opts_tgt_lladdr) {
646 		struct ifnet *ifp_ll;
647 
648 		lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
649 		lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
650 
651 		if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
652 			nd6log((LOG_INFO, "nd6_na_input: lladdrlen mismatch "
653 			    "for %s (if %d, NA packet %d)\n", ip6_sprintf(&taddr6),
654 			    ifp->if_addrlen, lladdrlen - 2));
655 			goto bad;
656 		}
657 
658 		/* If it's from me, ignore it. */
659 		ifp_ll = if_bylla(lladdr, ifp->if_addrlen);
660 		if (ifp_ll != NULL)
661 			goto freeit;
662 	}
663 
664 	ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
665 
666 	/*
667 	 * Target address matches one of my interface address.
668 	 *
669 	 * If my address is tentative, this means that there's somebody
670 	 * already using the same address as mine.  This indicates DAD failure.
671 	 * This is defined in RFC 2462.
672 	 *
673 	 * Otherwise, process as defined in RFC 2461.
674 	 */
675 	if (ifa
676 	 && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) {
677 		nd6_dad_na_input(ifa);
678 		goto freeit;
679 	}
680 
681 	/* Just for safety, maybe unnecessary. */
682 	if (ifa) {
683 		log(LOG_ERR,
684 		    "nd6_na_input: duplicate IP6 address %s\n",
685 		    ip6_sprintf(&taddr6));
686 		goto freeit;
687 	}
688 
689 	if (!nd6_onlink_ns_rfc4861) {
690 		/*
691 		 * Make sure the source address is from a neighbor's address.
692 		 */
693 		struct sockaddr_in6 src_sa6;
694 
695 		bzero(&src_sa6, sizeof(src_sa6));
696 		src_sa6.sin6_family = AF_INET6;
697 		src_sa6.sin6_len = sizeof(src_sa6);
698 		src_sa6.sin6_addr = saddr6;
699 		if (nd6_is_addr_neighbor(&src_sa6, ifp) == 0) {
700 			nd6log((LOG_INFO, "nd6_na_input: "
701 			    "NA packet from non-neighbor\n"));
702 			goto bad;
703 		}
704 	}
705 
706 	/*
707 	 * If no neighbor cache entry is found, NA SHOULD silently be discarded.
708 	 */
709 	rt = nd6_lookup(&taddr6, 0, ifp);
710 	if ((rt == NULL) ||
711 	   ((ln = (struct llinfo_nd6 *)rt->rt_llinfo) == NULL) ||
712 	   ((sdl = SDL(rt->rt_gateway)) == NULL))
713 		goto freeit;
714 
715 	if (ln->ln_state <= ND6_LLINFO_INCOMPLETE) {
716 		/*
717 		 * If the link-layer has address, and no lladdr option came,
718 		 * discard the packet.
719 		 */
720 		if (ifp->if_addrlen && !lladdr)
721 			goto freeit;
722 
723 		/*
724 		 * Record link-layer address, and update the state.
725 		 */
726 		sdl->sdl_alen = ifp->if_addrlen;
727 		bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
728 		if (is_solicited) {
729 			ln->ln_state = ND6_LLINFO_REACHABLE;
730 			ln->ln_byhint = 0;
731 			if (ln->ln_expire) {
732 				ln->ln_expire = time_uptime +
733 				    ND_IFINFO(rt->rt_ifp)->reachable;
734 			}
735 		} else {
736 			ln->ln_state = ND6_LLINFO_STALE;
737 			ln->ln_expire = time_uptime + nd6_gctimer;
738 		}
739 		if ((ln->ln_router = is_router) != 0) {
740 			/*
741 			 * This means a router's state has changed from
742 			 * non-reachable to probably reachable, and might
743 			 * affect the status of associated prefixes..
744 			 */
745 			pfxlist_onlink_check();
746 		}
747 	} else {
748 		int llchange;
749 
750 		/*
751 		 * Check if the link-layer address has changed or not.
752 		 */
753 		if (!lladdr)
754 			llchange = 0;
755 		else {
756 			if (sdl->sdl_alen) {
757 				if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen))
758 					llchange = 1;
759 				else
760 					llchange = 0;
761 			} else
762 				llchange = 1;
763 		}
764 
765 		/*
766 		 * This is VERY complex.  Look at it with care.
767 		 *
768 		 * override solicit lladdr llchange	action
769 		 *					(L: record lladdr)
770 		 *
771 		 *	0	0	n	--	(2c)
772 		 *	0	0	y	n	(2b) L
773 		 *	0	0	y	y	(1)    REACHABLE->STALE
774 		 *	0	1	n	--	(2c)   *->REACHABLE
775 		 *	0	1	y	n	(2b) L *->REACHABLE
776 		 *	0	1	y	y	(1)    REACHABLE->STALE
777 		 *	1	0	n	--	(2a)
778 		 *	1	0	y	n	(2a) L
779 		 *	1	0	y	y	(2a) L *->STALE
780 		 *	1	1	n	--	(2a)   *->REACHABLE
781 		 *	1	1	y	n	(2a) L *->REACHABLE
782 		 *	1	1	y	y	(2a) L *->REACHABLE
783 		 */
784 		if (!is_override && (lladdr && llchange)) {	   /* (1) */
785 			/*
786 			 * If state is REACHABLE, make it STALE.
787 			 * no other updates should be done.
788 			 */
789 			if (ln->ln_state == ND6_LLINFO_REACHABLE) {
790 				ln->ln_state = ND6_LLINFO_STALE;
791 				ln->ln_expire = time_uptime + nd6_gctimer;
792 			}
793 			goto freeit;
794 		} else if (is_override				   /* (2a) */
795 			|| (lladdr && !llchange)                   /* (2b) */
796 			|| !lladdr) {				   /* (2c) */
797 			/*
798 			 * Update link-local address, if any.
799 			 */
800 			if (lladdr) {
801 				sdl->sdl_alen = ifp->if_addrlen;
802 				bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
803 			}
804 
805 			/*
806 			 * If solicited, make the state REACHABLE.
807 			 * If not solicited and the link-layer address was
808 			 * changed, make it STALE.
809 			 */
810 			if (is_solicited) {
811 				ln->ln_state = ND6_LLINFO_REACHABLE;
812 				ln->ln_byhint = 0;
813 				if (ln->ln_expire) {
814 					ln->ln_expire = time_uptime +
815 					    ND_IFINFO(ifp)->reachable;
816 				}
817 			} else {
818 				if (lladdr && llchange) {
819 					ln->ln_state = ND6_LLINFO_STALE;
820 					ln->ln_expire = time_uptime + nd6_gctimer;
821 				}
822 			}
823 		}
824 
825 		if (ln->ln_router && !is_router) {
826 			/*
827 			 * The peer dropped the router flag.
828 			 * Remove the sender from the Default Router List and
829 			 * update the Destination Cache entries.
830 			 */
831 			struct nd_defrouter *dr;
832 			struct in6_addr *in6;
833 
834 			in6 = &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr;
835 
836 			/*
837 			 * Lock to protect the default router list.
838 			 * XXX: this might be unnecessary, since this function
839 			 * is only called under the network software interrupt
840 			 * context.  However, we keep it just for safety.
841 			 */
842 			mtx_lock(&nd6_mtx);
843 			dr = defrouter_lookup(in6, rt->rt_ifp);
844 			if (dr)
845 				defrtrlist_del(dr);
846 			mtx_unlock(&nd6_mtx);
847 
848 			if (dr == NULL && !ip6_forwarding &&
849 			    (ND_IFINFO(rt->rt_ifp)->flags &
850 			     ND6_IFF_ACCEPT_RTADV) != 0) {
851 				/*
852 				 * Even if the neighbor is not in the default
853 				 * router list, the neighbor may be used
854 				 * as a next hop for some destinations
855 				 * (e.g. redirect case). So we must
856 				 * call rt6_flush explicitly.
857 				 */
858 				rt6_flush(&ip6->ip6_src, rt->rt_ifp);
859 			}
860 		}
861 		ln->ln_router = is_router;
862 	}
863 	rt->rt_flags &= ~RTF_REJECT;
864 	ln->ln_asked = 0;
865 	if (ln->ln_hold) {
866 		/*
867 		 * we assume ifp is not a loopback here, so just set the 2nd
868 		 * argument as the 1st one.
869 		 */
870 		nd6_output(ifp, ifp, ln->ln_hold,
871 			   (struct sockaddr_in6 *)rt_key(rt), rt);
872 		ln->ln_hold = NULL;
873 	}
874 
875 freeit:
876 	m_freem(m);
877 	return;
878 
879 bad:
880 	icmp6stat.icp6s_badna++;
881 	m_freem(m);
882 }
883 
884 /*
885  * Neighbor advertisement output handling.
886  *
887  * Based on RFC 2461
888  *
889  * the following items are not implemented yet:
890  * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
891  * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
892  */
893 void
nd6_na_output(struct ifnet * ifp,const struct in6_addr * daddr6,const struct in6_addr * taddr6,u_long flags,int tlladdr,struct sockaddr * sdl0)894 nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6,
895 	      const struct in6_addr *taddr6, u_long flags,
896 	      int tlladdr,	/* 1 if include target link-layer address */
897 	      struct sockaddr *sdl0)	/* sockaddr_dl (= proxy NA) or NULL */
898 {
899 	struct mbuf *m;
900 	struct ip6_hdr *ip6;
901 	struct nd_neighbor_advert *nd_na;
902 	struct in6_ifaddr *ia = NULL;
903 	struct ip6_moptions im6o;
904 	int icmp6len;
905 	int maxlen;
906 	caddr_t mac;
907 	struct ifnet *outif = NULL;
908 
909 	/* estimate the size of message */
910 	maxlen = sizeof(*ip6) + sizeof(*nd_na);
911 	maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7;
912 	if (max_linkhdr + maxlen > MCLBYTES) {
913 #ifdef DIAGNOSTIC
914 		kprintf("nd6_na_output: max_linkhdr + maxlen > MCLBYTES "
915 		    "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES);
916 #endif
917 		return;
918 	}
919 
920 	m = m_getb(max_linkhdr + maxlen, M_NOWAIT, MT_DATA, M_PKTHDR);
921 	if (m == NULL)
922 		return;
923 
924 	if (IN6_IS_ADDR_MULTICAST(daddr6)) {
925 		m->m_flags |= M_MCAST;
926 		im6o.im6o_multicast_ifp = ifp;
927 		im6o.im6o_multicast_hlim = 255;
928 		im6o.im6o_multicast_loop = 0;
929 	}
930 
931 	icmp6len = sizeof(*nd_na);
932 	m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len;
933 	m->m_data += max_linkhdr;	/* or MH_ALIGN() equivalent? */
934 
935 	/* fill neighbor advertisement packet */
936 	ip6 = mtod(m, struct ip6_hdr *);
937 	ip6->ip6_flow = 0;
938 	ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
939 	ip6->ip6_vfc |= IPV6_VERSION;
940 	ip6->ip6_nxt = IPPROTO_ICMPV6;
941 	ip6->ip6_hlim = 255;
942 	if (IN6_IS_ADDR_UNSPECIFIED(daddr6)) {
943 		/* reply to DAD */
944 		ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL;
945 		ip6->ip6_dst.s6_addr16[1] = htons(ifp->if_index);
946 		ip6->ip6_dst.s6_addr32[1] = 0;
947 		ip6->ip6_dst.s6_addr32[2] = 0;
948 		ip6->ip6_dst.s6_addr32[3] = IPV6_ADDR_INT32_ONE;
949 		flags &= ~ND_NA_FLAG_SOLICITED;
950 	} else
951 		ip6->ip6_dst = *daddr6;
952 
953 	/*
954 	 * Select a source whose scope is the same as that of the dest.
955 	 */
956 	ia = in6_ifawithifp(ifp, &ip6->ip6_dst);
957 	if (ia == NULL) {
958 		m_freem(m);
959 		return;
960 	}
961 	ip6->ip6_src = ia->ia_addr.sin6_addr;
962 	nd_na = (struct nd_neighbor_advert *)(ip6 + 1);
963 	nd_na->nd_na_type = ND_NEIGHBOR_ADVERT;
964 	nd_na->nd_na_code = 0;
965 	nd_na->nd_na_target = *taddr6;
966 	in6_clearscope(&nd_na->nd_na_target); /* XXX */
967 
968 	/*
969 	 * "tlladdr" indicates NS's condition for adding tlladdr or not.
970 	 * see nd6_ns_input() for details.
971 	 * Basically, if NS packet is sent to unicast/anycast addr,
972 	 * target lladdr option SHOULD NOT be included.
973 	 */
974 	mac = NULL;
975 	if (tlladdr) {
976 		/*
977 		 * sdl0 != NULL indicates proxy NA.  If we do proxy, use
978 		 * lladdr in sdl0.  If we are not proxying (sending NA for
979 		 * my address) use lladdr configured for the interface.
980 		 */
981 		if (sdl0 == NULL) {
982 #ifdef CARP
983 			if (ifp->if_carp)
984 				mac = carp_macmatch6(ifp->if_carp, m, taddr6);
985 			if (mac == NULL)
986 				mac = nd6_ifptomac(ifp);
987 #else
988 			mac = nd6_ifptomac(ifp);
989 #endif
990 		} else if (sdl0->sa_family == AF_LINK) {
991 			struct sockaddr_dl *sdl;
992 			sdl = (struct sockaddr_dl *)sdl0;
993 			if (sdl->sdl_alen == ifp->if_addrlen)
994 				mac = LLADDR(sdl);
995 		}
996 	}
997 	if (mac != NULL) {
998 		int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
999 		struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1);
1000 
1001 		/* roundup to 8 bytes alignment! */
1002 		optlen = (optlen + 7) & ~7;
1003 
1004 		m->m_pkthdr.len += optlen;
1005 		m->m_len += optlen;
1006 		icmp6len += optlen;
1007 		bzero((caddr_t)nd_opt, optlen);
1008 		nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1009 		nd_opt->nd_opt_len = optlen >> 3;
1010 		bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
1011 	} else
1012 		flags &= ~ND_NA_FLAG_OVERRIDE;
1013 
1014 	ip6->ip6_plen = htons((u_short)icmp6len);
1015 	nd_na->nd_na_flags_reserved = flags;
1016 	nd_na->nd_na_cksum = 0;
1017 	nd_na->nd_na_cksum =
1018 	    in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len);
1019 
1020 	ip6_output(m, NULL, NULL, 0, &im6o, &outif, NULL);
1021 	if (outif) {
1022 		icmp6_ifstat_inc(outif, ifs6_out_msg);
1023 		icmp6_ifstat_inc(outif, ifs6_out_neighboradvert);
1024 	}
1025 	icmp6stat.icp6s_outhist[ND_NEIGHBOR_ADVERT]++;
1026 }
1027 
1028 caddr_t
nd6_ifptomac(struct ifnet * ifp)1029 nd6_ifptomac(struct ifnet *ifp)
1030 {
1031 	switch (ifp->if_type) {
1032 	case IFT_ETHER:
1033 	case IFT_IEEE1394:
1034 #ifdef IFT_L2VLAN
1035 	case IFT_L2VLAN:
1036 #endif
1037 #ifdef IFT_IEEE80211
1038 	case IFT_IEEE80211:
1039 #endif
1040 #ifdef IFT_CARP
1041 	case IFT_CARP:
1042 #endif
1043 		return ((caddr_t)(ifp + 1));
1044 	default:
1045 		return NULL;
1046 	}
1047 }
1048 
1049 struct netmsg_dad {
1050 	struct netmsg_base	base;
1051 	struct dadq		*dadq;
1052 };
1053 
1054 struct dadq {
1055 	TAILQ_ENTRY(dadq) dad_list;
1056 	struct ifaddr *dad_ifa;
1057 	int dad_count;		/* max NS to send */
1058 	int dad_ns_tcount;	/* # of trials to send NS */
1059 	int dad_ns_ocount;	/* NS sent so far */
1060 	int dad_ns_icount;
1061 	int dad_na_icount;
1062 	struct callout dad_timer_ch;
1063 	struct netmsg_dad dad_nmsg;
1064 };
1065 TAILQ_HEAD(dadq_head, dadq);
1066 
1067 static struct dadq_head dadq = TAILQ_HEAD_INITIALIZER(dadq);
1068 
1069 static struct dadq *
nd6_dad_find(struct ifaddr * ifa)1070 nd6_dad_find(struct ifaddr *ifa)
1071 {
1072 	struct dadq *dp;
1073 
1074 	ASSERT_NETISR0;
1075 
1076 	TAILQ_FOREACH(dp, &dadq, dad_list) {
1077 		if (dp->dad_ifa == ifa)
1078 			return dp;
1079 	}
1080 	return NULL;
1081 }
1082 
1083 static void
nd6_dad_starttimer(struct dadq * dp,int ticks)1084 nd6_dad_starttimer(struct dadq *dp, int ticks)
1085 {
1086 	ASSERT_NETISR0;
1087 	callout_reset(&dp->dad_timer_ch, ticks, nd6_dad_timer, dp);
1088 }
1089 
1090 static void
nd6_dad_stoptimer(struct dadq * dp)1091 nd6_dad_stoptimer(struct dadq *dp)
1092 {
1093 	ASSERT_NETISR0;
1094 	callout_stop(&dp->dad_timer_ch);
1095 }
1096 
1097 /*
1098  * Start Duplicated Address Detection (DAD) for specified interface address.
1099  */
1100 void
nd6_dad_start(struct ifaddr * ifa,int * tick)1101 nd6_dad_start(struct ifaddr *ifa,
1102 	      int *tick)	/* minimum delay ticks for IFF_UP event */
1103 {
1104 	struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1105 	struct dadq *dp;
1106 
1107 	ASSERT_NETISR0;
1108 
1109 	/*
1110 	 * If we don't need DAD, don't do it.
1111 	 * There are several cases:
1112 	 * - DAD is disabled globally (ip6_dad_count == 0) or on the interface
1113 	 * - the interface address is anycast
1114 	 */
1115 	if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) {
1116 		log(LOG_DEBUG,
1117 			"nd6_dad_start: called with non-tentative address "
1118 			"%s(%s)\n",
1119 			ip6_sprintf(&ia->ia_addr.sin6_addr),
1120 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1121 		return;
1122 	}
1123 	if ((ia->ia6_flags & IN6_IFF_ANYCAST) ||
1124 	    ip6_dad_count == 0 ||
1125 	    (ND_IFINFO(ifa->ifa_ifp)->flags & ND6_IFF_NO_DAD)) {
1126 		ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1127 		in6_newaddrmsg(ifa);
1128 		return;
1129 	}
1130 	if (!(ifa->ifa_ifp->if_flags & IFF_UP))
1131 		return;
1132 	if (nd6_dad_find(ifa) != NULL) {
1133 		/* DAD already in progress */
1134 		return;
1135 	}
1136 
1137 	dp = nd6_dad_create(ifa);
1138 	nd6log((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
1139 	    ip6_sprintf(&ia->ia_addr.sin6_addr)));
1140 
1141 	/*
1142 	 * Send NS packet for DAD, dp->dad_count times.
1143 	 * Note that we must delay the first transmission, if this is the
1144 	 * first packet to be sent from the interface after interface
1145 	 * (re)initialization.
1146 	 */
1147 	if (tick == NULL) {
1148 		nd6_dad_ns_output(dp);
1149 		nd6_dad_starttimer(dp,
1150 		    ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000);
1151 	} else {
1152 		int ntick;
1153 
1154 		if (*tick == 0)
1155 			ntick = krandom() % (MAX_RTR_SOLICITATION_DELAY * hz);
1156 		else
1157 			ntick = *tick + krandom() % (hz / 2);
1158 		*tick = ntick;
1159 		nd6_dad_starttimer(dp, ntick);
1160 	}
1161 }
1162 
1163 /*
1164  * Terminate DAD unconditionally.  Used for address removals.
1165  */
1166 void
nd6_dad_stop(struct ifaddr * ifa)1167 nd6_dad_stop(struct ifaddr *ifa)
1168 {
1169 	struct dadq *dp;
1170 
1171 	ASSERT_NETISR0;
1172 
1173 	dp = nd6_dad_find(ifa);
1174 	if (!dp) {
1175 		/* DAD wasn't started yet */
1176 		return;
1177 	}
1178 	nd6_dad_destroy(dp);
1179 }
1180 
1181 static struct dadq *
nd6_dad_create(struct ifaddr * ifa)1182 nd6_dad_create(struct ifaddr *ifa)
1183 {
1184 	struct netmsg_dad *dm;
1185 	struct dadq *dp;
1186 
1187 	ASSERT_NETISR0;
1188 
1189 	dp = kmalloc(sizeof(*dp), M_IP6NDP, M_INTWAIT | M_ZERO);
1190 	callout_init_mp(&dp->dad_timer_ch);
1191 
1192 	dm = &dp->dad_nmsg;
1193 	netmsg_init(&dm->base, NULL, &netisr_adone_rport,
1194 	    MSGF_DROPABLE | MSGF_PRIORITY, nd6_dad_timer_handler);
1195 	dm->dadq = dp;
1196 
1197 	dp->dad_ifa = ifa;
1198 	IFAREF(ifa);	/* just for safety */
1199 
1200 	/* Send NS packet for DAD, ip6_dad_count times. */
1201 	dp->dad_count = ip6_dad_count;
1202 
1203 	TAILQ_INSERT_TAIL(&dadq, dp, dad_list);
1204 
1205 	return dp;
1206 }
1207 
1208 static void
nd6_dad_destroy(struct dadq * dp)1209 nd6_dad_destroy(struct dadq *dp)
1210 {
1211 	struct lwkt_msg *lmsg = &dp->dad_nmsg.base.lmsg;
1212 
1213 	ASSERT_NETISR0;
1214 
1215 	TAILQ_REMOVE(&dadq, dp, dad_list);
1216 
1217 	nd6_dad_stoptimer(dp);
1218 
1219 	crit_enter();
1220 	if ((lmsg->ms_flags & MSGF_DONE) == 0)
1221 		lwkt_dropmsg(lmsg);
1222 	crit_exit();
1223 
1224 	IFAFREE(dp->dad_ifa);
1225 	kfree(dp, M_IP6NDP);
1226 }
1227 
1228 static void
nd6_dad_timer(void * xdp)1229 nd6_dad_timer(void *xdp)
1230 {
1231 	struct dadq *dp = xdp;
1232 	struct lwkt_msg *lmsg = &dp->dad_nmsg.base.lmsg;
1233 
1234 	KASSERT(mycpuid == 0, ("dad timer not on cpu0"));
1235 
1236 	crit_enter();
1237 	if (lmsg->ms_flags & MSGF_DONE)
1238 		lwkt_sendmsg_oncpu(netisr_cpuport(0), lmsg);
1239 	crit_exit();
1240 }
1241 
1242 static void
nd6_dad_timer_handler(netmsg_t msg)1243 nd6_dad_timer_handler(netmsg_t msg)
1244 {
1245 	struct netmsg_dad *dm = (struct netmsg_dad *)msg;
1246 	struct dadq *dp = dm->dadq;
1247 	struct ifaddr *ifa = dp->dad_ifa;
1248 	struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1249 
1250 	ASSERT_NETISR0;
1251 
1252 	/* Reply ASAP */
1253 	crit_enter();
1254 	lwkt_replymsg(&dm->base.lmsg, 0);
1255 	crit_exit();
1256 
1257 	if (ia->ia6_flags & IN6_IFF_DUPLICATED) {
1258 		log(LOG_ERR, "nd6_dad_timer: called with duplicated address "
1259 			"%s(%s)\n",
1260 			ip6_sprintf(&ia->ia_addr.sin6_addr),
1261 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1262 		goto destroy;
1263 	}
1264 	if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) {
1265 		log(LOG_ERR, "nd6_dad_timer: called with non-tentative address "
1266 			"%s(%s)\n",
1267 			ip6_sprintf(&ia->ia_addr.sin6_addr),
1268 			ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1269 		goto destroy;
1270 	}
1271 
1272 	/* Timed out with IFF_{RUNNING,UP} check */
1273 	if (dp->dad_ns_tcount > dad_maxtry) {
1274 		nd6log((LOG_INFO, "%s: could not run DAD, driver problem?\n",
1275 		    if_name(ifa->ifa_ifp)));
1276 		goto destroy;
1277 	}
1278 
1279 	/* Need more checks? */
1280 	if (dp->dad_ns_ocount < dp->dad_count) {
1281 		/*
1282 		 * We have more NS to go.  Send NS packet for DAD.
1283 		 */
1284 		nd6_dad_ns_output(dp);
1285 		nd6_dad_starttimer(dp,
1286 		    ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000);
1287 	} else {
1288 		/*
1289 		 * We have transmitted sufficient number of DAD packets.
1290 		 * See what we've got.
1291 		 */
1292 		int duplicate;
1293 
1294 		duplicate = 0;
1295 
1296 		if (dp->dad_na_icount) {
1297 			/*
1298 			 * the check is in nd6_dad_na_input(),
1299 			 * but just in case
1300 			 */
1301 			duplicate++;
1302 		}
1303 
1304 		if (dp->dad_ns_icount) {
1305 #if 0 /* heuristics */
1306 			/*
1307 			 * if
1308 			 * - we have sent many(?) DAD NS, and
1309 			 * - the number of NS we sent equals to the
1310 			 *   number of NS we've got, and
1311 			 * - we've got no NA
1312 			 * we may have a faulty network card/driver which
1313 			 * loops back multicasts to myself.
1314 			 */
1315 			if (3 < dp->dad_count
1316 			 && dp->dad_ns_icount == dp->dad_count
1317 			 && dp->dad_na_icount == 0) {
1318 				log(LOG_INFO, "DAD questionable for %s(%s): "
1319 				    "network card loops back multicast?\n",
1320 				    ip6_sprintf(&ia->ia_addr.sin6_addr),
1321 				    if_name(ifa->ifa_ifp));
1322 				/* XXX consider it a duplicate or not? */
1323 				/* duplicate++; */
1324 			} else {
1325 				/* We've seen NS, means DAD has failed. */
1326 				duplicate++;
1327 			}
1328 #else
1329 			/* We've seen NS, means DAD has failed. */
1330 			duplicate++;
1331 #endif
1332 		}
1333 
1334 		if (duplicate) {
1335 			/* dp will be freed in nd6_dad_duplicated() */
1336 			dp = NULL;
1337 			nd6_dad_duplicated(ifa);
1338 		} else {
1339 			/*
1340 			 * We are done with DAD.  No NA came, no NS came.
1341 			 * duplicated address found.
1342 			 */
1343 			ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1344 			in6_newaddrmsg(ifa);
1345 			nd6log((LOG_DEBUG,
1346 			    "%s: DAD complete for %s - no duplicates found\n",
1347 			    if_name(ifa->ifa_ifp),
1348 			    ip6_sprintf(&ia->ia_addr.sin6_addr)));
1349 			goto destroy;
1350 		}
1351 	}
1352 	return;
1353 destroy:
1354 	nd6_dad_destroy(dp);
1355 }
1356 
1357 static void
nd6_dad_duplicated(struct ifaddr * ifa)1358 nd6_dad_duplicated(struct ifaddr *ifa)
1359 {
1360 	struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1361 	struct dadq *dp;
1362 
1363 	ASSERT_NETISR0;
1364 
1365 	dp = nd6_dad_find(ifa);
1366 	if (dp == NULL) {
1367 		log(LOG_ERR, "nd6_dad_duplicated: DAD structure not found\n");
1368 		return;
1369 	}
1370 
1371 	/*
1372 	 * We are done with DAD, with duplicated address found. (failure)
1373 	 */
1374 	log(LOG_ERR, "%s: DAD detected duplicate IPv6 address %s: "
1375 	    "NS in/out=%d/%d, NA in=%d\n",
1376 	    if_name(ifa->ifa_ifp), ip6_sprintf(&ia->ia_addr.sin6_addr),
1377 	    dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_na_icount);
1378 
1379 	ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1380 	ia->ia6_flags |= IN6_IFF_DUPLICATED;
1381 	in6_newaddrmsg(ifa);
1382 
1383 	log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n",
1384 	    if_name(ifa->ifa_ifp), ip6_sprintf(&ia->ia_addr.sin6_addr));
1385 	log(LOG_ERR, "%s: manual intervention required\n",
1386 	    if_name(ifa->ifa_ifp));
1387 
1388 	nd6_dad_destroy(dp);
1389 }
1390 
1391 static void
nd6_dad_ns_output(struct dadq * dp)1392 nd6_dad_ns_output(struct dadq *dp)
1393 {
1394 	struct in6_ifaddr *ia = (struct in6_ifaddr *)dp->dad_ifa;
1395 	struct ifnet *ifp = dp->dad_ifa->ifa_ifp;
1396 
1397 	ASSERT_NETISR0;
1398 
1399 	dp->dad_ns_tcount++;
1400 	if (!(ifp->if_flags & IFF_UP)) {
1401 #if 0
1402 		kprintf("%s: interface down?\n", if_name(ifp));
1403 #endif
1404 		return;
1405 	}
1406 	if (!(ifp->if_flags & IFF_RUNNING)) {
1407 #if 0
1408 		kprintf("%s: interface not running?\n", if_name(ifp));
1409 #endif
1410 		return;
1411 	}
1412 
1413 	dp->dad_ns_ocount++;
1414 	nd6_ns_output(ifp, NULL, &ia->ia_addr.sin6_addr, NULL, 1);
1415 }
1416 
1417 static void
nd6_dad_ns_input(struct ifaddr * ifa)1418 nd6_dad_ns_input(struct ifaddr *ifa)
1419 {
1420 	struct in6_ifaddr *ia;
1421 	const struct in6_addr *taddr6;
1422 	struct dadq *dp;
1423 	int duplicate;
1424 
1425 	ASSERT_NETISR0;
1426 
1427 	if (!ifa)
1428 		panic("ifa == NULL in nd6_dad_ns_input");
1429 
1430 	ia = (struct in6_ifaddr *)ifa;
1431 	taddr6 = &ia->ia_addr.sin6_addr;
1432 	duplicate = 0;
1433 	dp = nd6_dad_find(ifa);
1434 
1435 	/* Quickhack - completely ignore DAD NS packets */
1436 	if (dad_ignore_ns) {
1437 		nd6log((LOG_INFO,
1438 		    "nd6_dad_ns_input: ignoring DAD NS packet for "
1439 		    "address %s(%s)\n", ip6_sprintf(taddr6),
1440 		    if_name(ifa->ifa_ifp)));
1441 		return;
1442 	}
1443 
1444 	/*
1445 	 * if I'm yet to start DAD, someone else started using this address
1446 	 * first.  I have a duplicate and you win.
1447 	 */
1448 	if (!dp || dp->dad_ns_ocount == 0)
1449 		duplicate++;
1450 
1451 	/* XXX more checks for loopback situation - see nd6_dad_timer too */
1452 
1453 	if (duplicate) {
1454 		dp = NULL;	/* will be freed in nd6_dad_duplicated() */
1455 		nd6_dad_duplicated(ifa);
1456 	} else {
1457 		/*
1458 		 * not sure if I got a duplicate.
1459 		 * increment ns count and see what happens.
1460 		 */
1461 		if (dp)
1462 			dp->dad_ns_icount++;
1463 	}
1464 }
1465 
1466 static void
nd6_dad_na_input(struct ifaddr * ifa)1467 nd6_dad_na_input(struct ifaddr *ifa)
1468 {
1469 	struct dadq *dp;
1470 
1471 	ASSERT_NETISR0;
1472 
1473 	if (!ifa)
1474 		panic("ifa == NULL in nd6_dad_na_input");
1475 
1476 	dp = nd6_dad_find(ifa);
1477 	if (dp)
1478 		dp->dad_na_icount++;
1479 
1480 	/* remove the address. */
1481 	nd6_dad_duplicated(ifa);
1482 }
1483