xref: /openbsd/sys/netinet6/nd6.c (revision 7e3957d1)
1*7e3957d1Sbluhm /*	$OpenBSD: nd6.c,v 1.237 2022/02/07 15:23:43 bluhm Exp $	*/
2d8a7e3a7Sitojun /*	$KAME: nd6.c,v 1.280 2002/06/08 19:52:07 itojun Exp $	*/
3287546eaSitojun 
4287546eaSitojun /*
5287546eaSitojun  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6287546eaSitojun  * All rights reserved.
7287546eaSitojun  *
8287546eaSitojun  * Redistribution and use in source and binary forms, with or without
9287546eaSitojun  * modification, are permitted provided that the following conditions
10287546eaSitojun  * are met:
11287546eaSitojun  * 1. Redistributions of source code must retain the above copyright
12287546eaSitojun  *    notice, this list of conditions and the following disclaimer.
13287546eaSitojun  * 2. Redistributions in binary form must reproduce the above copyright
14287546eaSitojun  *    notice, this list of conditions and the following disclaimer in the
15287546eaSitojun  *    documentation and/or other materials provided with the distribution.
16287546eaSitojun  * 3. Neither the name of the project nor the names of its contributors
17287546eaSitojun  *    may be used to endorse or promote products derived from this software
18287546eaSitojun  *    without specific prior written permission.
19287546eaSitojun  *
20287546eaSitojun  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21287546eaSitojun  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22287546eaSitojun  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23287546eaSitojun  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24287546eaSitojun  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25287546eaSitojun  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26287546eaSitojun  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27287546eaSitojun  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28287546eaSitojun  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29287546eaSitojun  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30287546eaSitojun  * SUCH DAMAGE.
31287546eaSitojun  */
32287546eaSitojun 
33287546eaSitojun #include <sys/param.h>
34287546eaSitojun #include <sys/systm.h>
35b3c1e4c1Sitojun #include <sys/timeout.h>
36287546eaSitojun #include <sys/malloc.h>
37287546eaSitojun #include <sys/mbuf.h>
38287546eaSitojun #include <sys/socket.h>
39287546eaSitojun #include <sys/sockio.h>
40287546eaSitojun #include <sys/time.h>
41287546eaSitojun #include <sys/kernel.h>
4293fbd125Sbluhm #include <sys/pool.h>
43f4f4d166Sitojun #include <sys/protosw.h>
44287546eaSitojun #include <sys/errno.h>
45287546eaSitojun #include <sys/ioctl.h>
46287546eaSitojun #include <sys/syslog.h>
47287546eaSitojun #include <sys/queue.h>
48c6bbd2a8Sflorian #include <sys/stdint.h>
49a09574ebSkettenis #include <sys/task.h>
50287546eaSitojun 
51287546eaSitojun #include <net/if.h>
52287546eaSitojun #include <net/if_dl.h>
53287546eaSitojun #include <net/if_types.h>
54287546eaSitojun #include <net/route.h>
55287546eaSitojun 
56287546eaSitojun #include <netinet/in.h>
57287546eaSitojun #include <netinet/if_ether.h>
58cb39d30aSangelos #include <netinet/ip_ipsp.h>
5958aa7d74Sangelos 
60287546eaSitojun #include <netinet6/in6_var.h>
61fa86ee14Sitojun #include <netinet/ip6.h>
62287546eaSitojun #include <netinet6/ip6_var.h>
63287546eaSitojun #include <netinet6/nd6.h>
64fa86ee14Sitojun #include <netinet/icmp6.h>
65287546eaSitojun 
66287546eaSitojun #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */
67287546eaSitojun #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */
68287546eaSitojun 
69287546eaSitojun /* timer values */
703209772dScheloha int	nd6_timer_next	= -1;	/* at which uptime nd6_timer runs */
713209772dScheloha time_t	nd6_expire_next	= -1;	/* at which uptime nd6_expire runs */
72287546eaSitojun int	nd6_delay	= 5;	/* delay first probe time 5 second */
73287546eaSitojun int	nd6_umaxtries	= 3;	/* maximum unicast query */
74287546eaSitojun int	nd6_mmaxtries	= 3;	/* maximum multicast query */
75be4e9e12Sitojun int	nd6_gctimer	= (60 * 60 * 24); /* 1 day: garbage collection timer */
76287546eaSitojun 
77287546eaSitojun /* preventing too many loops in ND option parsing */
78287546eaSitojun int nd6_maxndopt = 10;	/* max # of ND options allowed */
79287546eaSitojun 
80f6e55599Sitojun int nd6_maxnudhint = 0;	/* max # of subsequent upper layer hints */
81f6e55599Sitojun 
82b79da24aSitojun #ifdef ND6_DEBUG
83b79da24aSitojun int nd6_debug = 1;
84b79da24aSitojun #else
85b79da24aSitojun int nd6_debug = 0;
86b79da24aSitojun #endif
87b79da24aSitojun 
8892c821ddSbluhm TAILQ_HEAD(llinfo_nd6_head, llinfo_nd6) nd6_list;
8993fbd125Sbluhm struct	pool nd6_pool;		/* pool for llinfo_nd6 structures */
9092c821ddSbluhm int	nd6_inuse, nd6_allocated;
91287546eaSitojun 
92287546eaSitojun int nd6_recalc_reachtm_interval = ND6_RECALC_REACHTM_INTERVAL;
93287546eaSitojun 
94334bfa0aSmpi void nd6_timer(void *);
95a0aa363cSjsing void nd6_slowtimo(void *);
96088d4855Smpi void nd6_expire(void *);
97088d4855Smpi void nd6_expire_timer(void *);
98c370e97fSmpi void nd6_invalidate(struct rtentry *);
9918e33022Sbluhm void nd6_free(struct rtentry *);
100334bfa0aSmpi int nd6_llinfo_timer(struct rtentry *);
101287546eaSitojun 
102334bfa0aSmpi struct timeout nd6_timer_to;
103b3c1e4c1Sitojun struct timeout nd6_slowtimo_ch;
104088d4855Smpi struct timeout nd6_expire_timeout;
105088d4855Smpi struct task nd6_expire_task;
106b3c1e4c1Sitojun 
107287546eaSitojun void
108a0aa363cSjsing nd6_init(void)
109287546eaSitojun {
110287546eaSitojun 	static int nd6_init_done = 0;
111287546eaSitojun 
112287546eaSitojun 	if (nd6_init_done) {
11335075f95Smpi 		log(LOG_NOTICE, "%s called more than once\n", __func__);
114287546eaSitojun 		return;
115287546eaSitojun 	}
116287546eaSitojun 
11792c821ddSbluhm 	TAILQ_INIT(&nd6_list);
1181378bae2Sdlg 	pool_init(&nd6_pool, sizeof(struct llinfo_nd6), 0,
1191378bae2Sdlg 	    IPL_SOFTNET, 0, "nd6", NULL);
12093fbd125Sbluhm 
121088d4855Smpi 	task_set(&nd6_expire_task, nd6_expire, NULL);
122a09574ebSkettenis 
123287546eaSitojun 	nd6_init_done = 1;
124287546eaSitojun 
125287546eaSitojun 	/* start timer */
126334bfa0aSmpi 	timeout_set_proc(&nd6_timer_to, nd6_timer, &nd6_timer_to);
12722e88dadSmpi 	timeout_set_proc(&nd6_slowtimo_ch, nd6_slowtimo, NULL);
12829e86e5eSblambert 	timeout_add_sec(&nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL);
129088d4855Smpi 	timeout_set(&nd6_expire_timeout, nd6_expire_timer, NULL);
130287546eaSitojun }
131287546eaSitojun 
132d6b9e9b9Sitojun struct nd_ifinfo *
133ee37ea65Smcbride nd6_ifattach(struct ifnet *ifp)
134287546eaSitojun {
135d6b9e9b9Sitojun 	struct nd_ifinfo *nd;
136287546eaSitojun 
137393af863Skrw 	nd = malloc(sizeof(*nd), M_IP6NDP, M_WAITOK | M_ZERO);
138287546eaSitojun 
139d6b9e9b9Sitojun 	nd->initialized = 1;
140287546eaSitojun 
141d6b9e9b9Sitojun 	nd->basereachable = REACHABLE_TIME;
142d6b9e9b9Sitojun 	nd->reachable = ND_COMPUTE_RTIME(nd->basereachable);
143d6b9e9b9Sitojun 	nd->retrans = RETRANS_TIMER;
1441b5f410aSitojun 
145d6b9e9b9Sitojun 	return nd;
146287546eaSitojun }
147287546eaSitojun 
148d6b9e9b9Sitojun void
149ee37ea65Smcbride nd6_ifdetach(struct nd_ifinfo *nd)
150d6b9e9b9Sitojun {
151d374aaacSitojun 
15262cf959dSmpi 	free(nd, M_IP6NDP, sizeof(*nd));
153287546eaSitojun }
154287546eaSitojun 
155287546eaSitojun void
156ee37ea65Smcbride nd6_option_init(void *opt, int icmp6len, union nd_opts *ndopts)
157287546eaSitojun {
158287546eaSitojun 	bzero(ndopts, sizeof(*ndopts));
159287546eaSitojun 	ndopts->nd_opts_search = (struct nd_opt_hdr *)opt;
160287546eaSitojun 	ndopts->nd_opts_last
161287546eaSitojun 		= (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len);
162287546eaSitojun 
163287546eaSitojun 	if (icmp6len == 0) {
164287546eaSitojun 		ndopts->nd_opts_done = 1;
165287546eaSitojun 		ndopts->nd_opts_search = NULL;
166287546eaSitojun 	}
167287546eaSitojun }
168287546eaSitojun 
169287546eaSitojun /*
170287546eaSitojun  * Take one ND option.
171287546eaSitojun  */
172287546eaSitojun struct nd_opt_hdr *
173ee37ea65Smcbride nd6_option(union nd_opts *ndopts)
174287546eaSitojun {
175287546eaSitojun 	struct nd_opt_hdr *nd_opt;
176287546eaSitojun 	int olen;
177287546eaSitojun 
178287546eaSitojun 	if (!ndopts)
179ab0ea4a9Snayden 		panic("%s: ndopts == NULL", __func__);
180287546eaSitojun 	if (!ndopts->nd_opts_last)
18140e42c82Snayden 		panic("%s: uninitialized ndopts", __func__);
182287546eaSitojun 	if (!ndopts->nd_opts_search)
183287546eaSitojun 		return NULL;
184287546eaSitojun 	if (ndopts->nd_opts_done)
185287546eaSitojun 		return NULL;
186287546eaSitojun 
187287546eaSitojun 	nd_opt = ndopts->nd_opts_search;
188287546eaSitojun 
18915bd77d2Sitojun 	/* make sure nd_opt_len is inside the buffer */
19015bd77d2Sitojun 	if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) {
19115bd77d2Sitojun 		bzero(ndopts, sizeof(*ndopts));
19215bd77d2Sitojun 		return NULL;
19315bd77d2Sitojun 	}
19415bd77d2Sitojun 
195287546eaSitojun 	olen = nd_opt->nd_opt_len << 3;
196287546eaSitojun 	if (olen == 0) {
197287546eaSitojun 		/*
198287546eaSitojun 		 * Message validation requires that all included
199287546eaSitojun 		 * options have a length that is greater than zero.
200287546eaSitojun 		 */
201287546eaSitojun 		bzero(ndopts, sizeof(*ndopts));
202287546eaSitojun 		return NULL;
203287546eaSitojun 	}
204287546eaSitojun 
205287546eaSitojun 	ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);
20615bd77d2Sitojun 	if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
20715bd77d2Sitojun 		/* option overruns the end of buffer, invalid */
20815bd77d2Sitojun 		bzero(ndopts, sizeof(*ndopts));
20915bd77d2Sitojun 		return NULL;
21015bd77d2Sitojun 	} else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
21115bd77d2Sitojun 		/* reached the end of options chain */
212287546eaSitojun 		ndopts->nd_opts_done = 1;
213287546eaSitojun 		ndopts->nd_opts_search = NULL;
214287546eaSitojun 	}
215287546eaSitojun 	return nd_opt;
216287546eaSitojun }
217287546eaSitojun 
218287546eaSitojun /*
219287546eaSitojun  * Parse multiple ND options.
220287546eaSitojun  * This function is much easier to use, for ND routines that do not need
221287546eaSitojun  * multiple options of the same type.
222287546eaSitojun  */
223287546eaSitojun int
224ee37ea65Smcbride nd6_options(union nd_opts *ndopts)
225287546eaSitojun {
226287546eaSitojun 	struct nd_opt_hdr *nd_opt;
227287546eaSitojun 	int i = 0;
228287546eaSitojun 
229287546eaSitojun 	if (!ndopts)
230ab0ea4a9Snayden 		panic("%s: ndopts == NULL", __func__);
231287546eaSitojun 	if (!ndopts->nd_opts_last)
23240e42c82Snayden 		panic("%s: uninitialized ndopts", __func__);
233287546eaSitojun 	if (!ndopts->nd_opts_search)
234287546eaSitojun 		return 0;
235287546eaSitojun 
236287546eaSitojun 	while (1) {
237287546eaSitojun 		nd_opt = nd6_option(ndopts);
238287546eaSitojun 		if (!nd_opt && !ndopts->nd_opts_last) {
239287546eaSitojun 			/*
240287546eaSitojun 			 * Message validation requires that all included
241287546eaSitojun 			 * options have a length that is greater than zero.
242287546eaSitojun 			 */
24307ba5f7cSjca 			icmp6stat_inc(icp6s_nd_badopt);
244287546eaSitojun 			bzero(ndopts, sizeof(*ndopts));
245287546eaSitojun 			return -1;
246287546eaSitojun 		}
247287546eaSitojun 
248287546eaSitojun 		if (!nd_opt)
249287546eaSitojun 			goto skip1;
250287546eaSitojun 
251287546eaSitojun 		switch (nd_opt->nd_opt_type) {
252287546eaSitojun 		case ND_OPT_SOURCE_LINKADDR:
253287546eaSitojun 		case ND_OPT_TARGET_LINKADDR:
254287546eaSitojun 		case ND_OPT_MTU:
255287546eaSitojun 		case ND_OPT_REDIRECTED_HEADER:
256287546eaSitojun 			if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
25715bd77d2Sitojun 				nd6log((LOG_INFO,
25815bd77d2Sitojun 				    "duplicated ND6 option found (type=%d)\n",
25915bd77d2Sitojun 				    nd_opt->nd_opt_type));
260287546eaSitojun 				/* XXX bark? */
261287546eaSitojun 			} else {
262287546eaSitojun 				ndopts->nd_opt_array[nd_opt->nd_opt_type]
263287546eaSitojun 					= nd_opt;
264287546eaSitojun 			}
265287546eaSitojun 			break;
266287546eaSitojun 		case ND_OPT_PREFIX_INFORMATION:
267287546eaSitojun 			if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) {
268287546eaSitojun 				ndopts->nd_opt_array[nd_opt->nd_opt_type]
269287546eaSitojun 					= nd_opt;
270287546eaSitojun 			}
271287546eaSitojun 			ndopts->nd_opts_pi_end =
272287546eaSitojun 				(struct nd_opt_prefix_info *)nd_opt;
273287546eaSitojun 			break;
2744043f337Ssthen 		case ND_OPT_DNSSL:
2754043f337Ssthen 		case ND_OPT_RDNSS:
2764043f337Ssthen 			/* Don't warn */
2774043f337Ssthen 			break;
278287546eaSitojun 		default:
279287546eaSitojun 			/*
280287546eaSitojun 			 * Unknown options must be silently ignored,
281e4d25771Stodd 			 * to accommodate future extension to the protocol.
282287546eaSitojun 			 */
283b79da24aSitojun 			nd6log((LOG_DEBUG,
284287546eaSitojun 			    "nd6_options: unsupported option %d - "
285b79da24aSitojun 			    "option ignored\n", nd_opt->nd_opt_type));
286287546eaSitojun 		}
287287546eaSitojun 
288287546eaSitojun skip1:
289287546eaSitojun 		i++;
290287546eaSitojun 		if (i > nd6_maxndopt) {
29107ba5f7cSjca 			icmp6stat_inc(icp6s_nd_toomanyopt);
292b79da24aSitojun 			nd6log((LOG_INFO, "too many loop in nd opt\n"));
293287546eaSitojun 			break;
294287546eaSitojun 		}
295287546eaSitojun 
296287546eaSitojun 		if (ndopts->nd_opts_done)
297287546eaSitojun 			break;
298287546eaSitojun 	}
299287546eaSitojun 
300287546eaSitojun 	return 0;
301287546eaSitojun }
302287546eaSitojun 
303287546eaSitojun /*
3049631a17bSitojun  * ND6 timer routine to handle ND6 entries
305287546eaSitojun  */
306287546eaSitojun void
307334bfa0aSmpi nd6_llinfo_settimer(struct llinfo_nd6 *ln, unsigned int secs)
3089631a17bSitojun {
3093209772dScheloha 	time_t expire = getuptime() + secs;
310334bfa0aSmpi 
311334bfa0aSmpi 	NET_ASSERT_LOCKED();
3129a2314e5Smpi 	KASSERT(!ISSET(ln->ln_rt->rt_flags, RTF_LOCAL));
313334bfa0aSmpi 
314334bfa0aSmpi 	ln->ln_rt->rt_expire = expire;
315334bfa0aSmpi 	if (!timeout_pending(&nd6_timer_to) || expire < nd6_timer_next) {
316334bfa0aSmpi 		nd6_timer_next = expire;
317334bfa0aSmpi 		timeout_add_sec(&nd6_timer_to, secs);
3189631a17bSitojun 	}
3199631a17bSitojun }
3209631a17bSitojun 
321a0aa363cSjsing void
322334bfa0aSmpi nd6_timer(void *arg)
323287546eaSitojun {
324334bfa0aSmpi 	struct llinfo_nd6 *ln, *nln;
3253209772dScheloha 	time_t expire = getuptime() + nd6_gctimer;
326334bfa0aSmpi 	int secs;
327334bfa0aSmpi 
328334bfa0aSmpi 	NET_LOCK();
329334bfa0aSmpi 	TAILQ_FOREACH_SAFE(ln, &nd6_list, ln_list, nln) {
330334bfa0aSmpi 		struct rtentry *rt = ln->ln_rt;
331334bfa0aSmpi 
3323209772dScheloha 		if (rt->rt_expire && rt->rt_expire <= getuptime())
333334bfa0aSmpi 			if (nd6_llinfo_timer(rt))
334334bfa0aSmpi 				continue;
335334bfa0aSmpi 
336334bfa0aSmpi 		if (rt->rt_expire && rt->rt_expire < expire)
337334bfa0aSmpi 			expire = rt->rt_expire;
338334bfa0aSmpi 	}
339334bfa0aSmpi 
3403209772dScheloha 	secs = expire - getuptime();
341334bfa0aSmpi 	if (secs < 0)
342334bfa0aSmpi 		secs = 0;
343b089e30eSflorian 	if (!TAILQ_EMPTY(&nd6_list)) {
3443209772dScheloha 		nd6_timer_next = getuptime() + secs;
345334bfa0aSmpi 		timeout_add_sec(&nd6_timer_to, secs);
346b089e30eSflorian 	}
347334bfa0aSmpi 
348334bfa0aSmpi 	NET_UNLOCK();
349334bfa0aSmpi }
350334bfa0aSmpi 
351334bfa0aSmpi /*
352334bfa0aSmpi  * ND timer state handling.
353334bfa0aSmpi  *
354334bfa0aSmpi  * Returns 1 if `rt' should no longer be used, 0 otherwise.
355334bfa0aSmpi  */
356334bfa0aSmpi int
357334bfa0aSmpi nd6_llinfo_timer(struct rtentry *rt)
358334bfa0aSmpi {
359334bfa0aSmpi 	struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
360334bfa0aSmpi 	struct sockaddr_in6 *dst = satosin6(rt_key(rt));
3619631a17bSitojun 	struct ifnet *ifp;
362d374aaacSitojun 	struct nd_ifinfo *ndi = NULL;
363287546eaSitojun 
364334bfa0aSmpi 	NET_ASSERT_LOCKED();
3659631a17bSitojun 
366334bfa0aSmpi 	if ((ifp = if_get(rt->rt_ifidx)) == NULL)
367334bfa0aSmpi 		return 1;
3689631a17bSitojun 
369d6b9e9b9Sitojun 	ndi = ND_IFINFO(ifp);
370287546eaSitojun 
371287546eaSitojun 	switch (ln->ln_state) {
372287546eaSitojun 	case ND6_LLINFO_INCOMPLETE:
373287546eaSitojun 		if (ln->ln_asked < nd6_mmaxtries) {
374287546eaSitojun 			ln->ln_asked++;
375134b71fcSdlg 			nd6_llinfo_settimer(ln, ndi->retrans / 1000);
3769631a17bSitojun 			nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, 0);
377287546eaSitojun 		} else {
378287546eaSitojun 			struct mbuf *m = ln->ln_hold;
379287546eaSitojun 			if (m) {
3808294a4dfSitojun 				ln->ln_hold = NULL;
381287546eaSitojun 				/*
382d8a7e3a7Sitojun 				 * Fake rcvif to make the ICMP error
383d8a7e3a7Sitojun 				 * more helpful in diagnosing for the
384d8a7e3a7Sitojun 				 * receiver.
385287546eaSitojun 				 * XXX: should we consider
386287546eaSitojun 				 * older rcvif?
387287546eaSitojun 				 */
38828112c65Smpi 				m->m_pkthdr.ph_ifidx = rt->rt_ifidx;
389d8a7e3a7Sitojun 
390287546eaSitojun 				icmp6_error(m, ICMP6_DST_UNREACH,
391287546eaSitojun 				    ICMP6_DST_UNREACH_ADDR, 0);
392e212adedSkrw 				if (ln->ln_hold == m) {
393e212adedSkrw 					/* m is back in ln_hold. Discard. */
394e212adedSkrw 					m_freem(ln->ln_hold);
395e212adedSkrw 					ln->ln_hold = NULL;
396e212adedSkrw 				}
397287546eaSitojun 			}
39818e33022Sbluhm 			nd6_free(rt);
3999631a17bSitojun 			ln = NULL;
400287546eaSitojun 		}
401287546eaSitojun 		break;
402287546eaSitojun 	case ND6_LLINFO_REACHABLE:
4039631a17bSitojun 		if (!ND6_LLINFO_PERMANENT(ln)) {
404287546eaSitojun 			ln->ln_state = ND6_LLINFO_STALE;
405134b71fcSdlg 			nd6_llinfo_settimer(ln, nd6_gctimer);
406be4e9e12Sitojun 		}
407287546eaSitojun 		break;
408be4e9e12Sitojun 
409be4e9e12Sitojun 	case ND6_LLINFO_STALE:
410f3fcf2f3Smcbride 	case ND6_LLINFO_PURGE:
411be4e9e12Sitojun 		/* Garbage Collection(RFC 2461 5.3) */
4129631a17bSitojun 		if (!ND6_LLINFO_PERMANENT(ln)) {
41318e33022Sbluhm 			nd6_free(rt);
4149631a17bSitojun 			ln = NULL;
4159631a17bSitojun 		}
416be4e9e12Sitojun 		break;
417be4e9e12Sitojun 
418287546eaSitojun 	case ND6_LLINFO_DELAY:
4190e39def2Sflorian 		if (ndi) {
420d374aaacSitojun 			/* We need NUD */
421287546eaSitojun 			ln->ln_asked = 1;
422287546eaSitojun 			ln->ln_state = ND6_LLINFO_PROBE;
423134b71fcSdlg 			nd6_llinfo_settimer(ln, ndi->retrans / 1000);
424d374aaacSitojun 			nd6_ns_output(ifp, &dst->sin6_addr,
425d8a7e3a7Sitojun 			    &dst->sin6_addr, ln, 0);
426be4e9e12Sitojun 		}
427287546eaSitojun 		break;
428287546eaSitojun 	case ND6_LLINFO_PROBE:
429287546eaSitojun 		if (ln->ln_asked < nd6_umaxtries) {
430287546eaSitojun 			ln->ln_asked++;
431134b71fcSdlg 			nd6_llinfo_settimer(ln, ndi->retrans / 1000);
432287546eaSitojun 			nd6_ns_output(ifp, &dst->sin6_addr,
433287546eaSitojun 			    &dst->sin6_addr, ln, 0);
434d8a7e3a7Sitojun 		} else {
43518e33022Sbluhm 			nd6_free(rt);
4369631a17bSitojun 			ln = NULL;
437d8a7e3a7Sitojun 		}
438287546eaSitojun 		break;
439287546eaSitojun 	}
4409631a17bSitojun 
441f5e0f62bSmpi 	if_put(ifp);
442334bfa0aSmpi 
443334bfa0aSmpi 	return (ln == NULL);
444287546eaSitojun }
445287546eaSitojun 
446c6bbd2a8Sflorian void
447c6bbd2a8Sflorian nd6_expire_timer_update(struct in6_ifaddr *ia6)
448c6bbd2a8Sflorian {
449c6bbd2a8Sflorian 	time_t expire_time = INT64_MAX;
450c6bbd2a8Sflorian 	int secs;
451c6bbd2a8Sflorian 
452c6bbd2a8Sflorian 	KERNEL_ASSERT_LOCKED();
453c6bbd2a8Sflorian 
454c6bbd2a8Sflorian 	if (ia6->ia6_lifetime.ia6t_vltime != ND6_INFINITE_LIFETIME)
455c6bbd2a8Sflorian 		expire_time = ia6->ia6_lifetime.ia6t_expire;
456c6bbd2a8Sflorian 
457c6bbd2a8Sflorian 	if (!(ia6->ia6_flags & IN6_IFF_DEPRECATED) &&
458c6bbd2a8Sflorian 	    ia6->ia6_lifetime.ia6t_pltime != ND6_INFINITE_LIFETIME &&
459c6bbd2a8Sflorian 	    expire_time > ia6->ia6_lifetime.ia6t_preferred)
460c6bbd2a8Sflorian 		expire_time = ia6->ia6_lifetime.ia6t_preferred;
461c6bbd2a8Sflorian 
462c6bbd2a8Sflorian 	if (expire_time == INT64_MAX)
463c6bbd2a8Sflorian 		return;
464c6bbd2a8Sflorian 
465c6bbd2a8Sflorian 	/*
466c6bbd2a8Sflorian 	 * IFA6_IS_INVALID() and IFA6_IS_DEPRECATED() check for uptime
467c6bbd2a8Sflorian 	 * greater than ia6t_expire or ia6t_preferred, not greater or equal.
468c6bbd2a8Sflorian 	 * Schedule timeout one second later so that either IFA6_IS_INVALID()
469c6bbd2a8Sflorian 	 * or IFA6_IS_DEPRECATED() is true.
470c6bbd2a8Sflorian 	 */
471c6bbd2a8Sflorian 	expire_time++;
472c6bbd2a8Sflorian 
473334bfa0aSmpi 	if (!timeout_pending(&nd6_expire_timeout) ||
474334bfa0aSmpi 	    nd6_expire_next > expire_time) {
4753209772dScheloha 		secs = expire_time - getuptime();
476c6bbd2a8Sflorian 		if (secs < 0)
477c6bbd2a8Sflorian 			secs = 0;
478c6bbd2a8Sflorian 
479c6bbd2a8Sflorian 		timeout_add_sec(&nd6_expire_timeout, secs);
480334bfa0aSmpi 		nd6_expire_next = expire_time;
481c6bbd2a8Sflorian 	}
482c6bbd2a8Sflorian }
483c6bbd2a8Sflorian 
4849631a17bSitojun /*
485088d4855Smpi  * Expire interface addresses.
4869631a17bSitojun  */
4879631a17bSitojun void
488088d4855Smpi nd6_expire(void *unused)
4899631a17bSitojun {
490a44d5cf0Smpi 	struct ifnet *ifp;
4919631a17bSitojun 
492088d4855Smpi 	KERNEL_LOCK();
493aa28b9a6Smpi 	NET_LOCK();
49422e88dadSmpi 
495a44d5cf0Smpi 	TAILQ_FOREACH(ifp, &ifnet, if_list) {
496a44d5cf0Smpi 		struct ifaddr *ifa, *nifa;
497a44d5cf0Smpi 		struct in6_ifaddr *ia6;
498a44d5cf0Smpi 
499a44d5cf0Smpi 		TAILQ_FOREACH_SAFE(ifa, &ifp->if_addrlist, ifa_list, nifa) {
500a44d5cf0Smpi 			if (ifa->ifa_addr->sa_family != AF_INET6)
501a44d5cf0Smpi 				continue;
502a44d5cf0Smpi 			ia6 = ifatoia6(ifa);
503d8a7e3a7Sitojun 			/* check address lifetime */
504d8a7e3a7Sitojun 			if (IFA6_IS_INVALID(ia6)) {
505d8a7e3a7Sitojun 				in6_purgeaddr(&ia6->ia_ifa);
506d8a7e3a7Sitojun 			} else {
507c6bbd2a8Sflorian 				if (IFA6_IS_DEPRECATED(ia6))
508c6bbd2a8Sflorian 					ia6->ia6_flags |= IN6_IFF_DEPRECATED;
509c6bbd2a8Sflorian 				nd6_expire_timer_update(ia6);
510d8a7e3a7Sitojun 			}
511d8a7e3a7Sitojun 		}
512a44d5cf0Smpi 	}
513d8a7e3a7Sitojun 
514aa28b9a6Smpi 	NET_UNLOCK();
515088d4855Smpi 	KERNEL_UNLOCK();
516287546eaSitojun }
517287546eaSitojun 
518a09574ebSkettenis void
519088d4855Smpi nd6_expire_timer(void *unused)
520a09574ebSkettenis {
52193865884Ssashan 	task_add(net_tq(0), &nd6_expire_task);
522a09574ebSkettenis }
523a09574ebSkettenis 
52422770369Sitojun /*
52522770369Sitojun  * Nuke neighbor cache/prefix/default router management table, right before
52622770369Sitojun  * ifp goes away.
52722770369Sitojun  */
52822770369Sitojun void
529ee37ea65Smcbride nd6_purge(struct ifnet *ifp)
53022770369Sitojun {
53122770369Sitojun 	struct llinfo_nd6 *ln, *nln;
53222770369Sitojun 
53366736630Smpi 	NET_ASSERT_LOCKED();
53445ffa37bSmpi 
53522770369Sitojun 	/*
53622770369Sitojun 	 * Nuke neighbor cache entries for the ifp.
53722770369Sitojun 	 */
53892c821ddSbluhm 	TAILQ_FOREACH_SAFE(ln, &nd6_list, ln_list, nln) {
53922770369Sitojun 		struct rtentry *rt;
54022770369Sitojun 		struct sockaddr_dl *sdl;
54122770369Sitojun 
54222770369Sitojun 		rt = ln->ln_rt;
54392c821ddSbluhm 		if (rt != NULL && rt->rt_gateway != NULL &&
54422770369Sitojun 		    rt->rt_gateway->sa_family == AF_LINK) {
545c7b7b779Sbluhm 			sdl = satosdl(rt->rt_gateway);
54622770369Sitojun 			if (sdl->sdl_index == ifp->if_index)
54718e33022Sbluhm 				nd6_free(rt);
54822770369Sitojun 		}
54922770369Sitojun 	}
55022770369Sitojun }
55122770369Sitojun 
552287546eaSitojun struct rtentry *
553f4d1af37Smikeb nd6_lookup(struct in6_addr *addr6, int create, struct ifnet *ifp,
554f4d1af37Smikeb     u_int rtableid)
555287546eaSitojun {
556287546eaSitojun 	struct rtentry *rt;
557287546eaSitojun 	struct sockaddr_in6 sin6;
5585148b194Smpi 	int flags;
559287546eaSitojun 
560287546eaSitojun 	bzero(&sin6, sizeof(sin6));
561287546eaSitojun 	sin6.sin6_len = sizeof(struct sockaddr_in6);
562287546eaSitojun 	sin6.sin6_family = AF_INET6;
563287546eaSitojun 	sin6.sin6_addr = *addr6;
56412d3c25cSclaudio 	flags = (create) ? RT_RESOLVE : 0;
565d8a7e3a7Sitojun 
5665148b194Smpi 	rt = rtalloc(sin6tosa(&sin6), flags, rtableid);
56716119bbfSmpi 	if (rt != NULL && (rt->rt_flags & RTF_LLINFO) == 0) {
568287546eaSitojun 		/*
569287546eaSitojun 		 * This is the case for the default route.
570287546eaSitojun 		 * If we want to create a neighbor cache for the address, we
571287546eaSitojun 		 * should free the route for the destination and allocate an
572287546eaSitojun 		 * interface route.
573287546eaSitojun 		 */
574287546eaSitojun 		if (create) {
57527ae666cSmpi 			rtfree(rt);
57627ae666cSmpi 			rt = NULL;
577287546eaSitojun 		}
578287546eaSitojun 	}
57916119bbfSmpi 	if (rt == NULL) {
580287546eaSitojun 		if (create && ifp) {
581cb24f5e5Sclaudio 			struct rt_addrinfo info;
58266f69fe1Smpi 			struct ifaddr *ifa;
5830ffd01d4Sbluhm 			int error;
584d374aaacSitojun 
585287546eaSitojun 			/*
586287546eaSitojun 			 * If no route is available and create is set,
587287546eaSitojun 			 * we allocate a host route for the destination
588287546eaSitojun 			 * and treat it like an interface route.
589287546eaSitojun 			 * This hack is necessary for a neighbor which can't
590287546eaSitojun 			 * be covered by our own prefix.
591287546eaSitojun 			 */
59266f69fe1Smpi 			ifa = ifaof_ifpforaddr(sin6tosa(&sin6), ifp);
593287546eaSitojun 			if (ifa == NULL)
594287546eaSitojun 				return (NULL);
595287546eaSitojun 
596287546eaSitojun 			/*
597287546eaSitojun 			 * Create a new route.  RTF_LLINFO is necessary
598287546eaSitojun 			 * to create a Neighbor Cache entry for the
599287546eaSitojun 			 * destination in nd6_rtrequest which will be
6007ffb277fSbluhm 			 * called in rtrequest.
601287546eaSitojun 			 */
602cb24f5e5Sclaudio 			bzero(&info, sizeof(info));
60366f69fe1Smpi 			info.rti_ifa = ifa;
604c29fc46aSmpi 			info.rti_flags = RTF_HOST | RTF_LLINFO;
605c3c56496Sbluhm 			info.rti_info[RTAX_DST] = sin6tosa(&sin6);
606c7b7b779Sbluhm 			info.rti_info[RTAX_GATEWAY] = sdltosa(ifp->if_sadl);
6077ffb277fSbluhm 			error = rtrequest(RTM_ADD, &info, RTP_CONNECTED, &rt,
6080ffd01d4Sbluhm 			    rtableid);
6090ffd01d4Sbluhm 			if (error)
610287546eaSitojun 				return (NULL);
6119c0643cdSbluhm 			if (rt->rt_llinfo != NULL) {
612287546eaSitojun 				struct llinfo_nd6 *ln =
613287546eaSitojun 				    (struct llinfo_nd6 *)rt->rt_llinfo;
614287546eaSitojun 				ln->ln_state = ND6_LLINFO_NOSTATE;
615287546eaSitojun 			}
616f6e55599Sitojun 		} else
617287546eaSitojun 			return (NULL);
618287546eaSitojun 	}
619287546eaSitojun 	/*
620287546eaSitojun 	 * Validation for the entry.
621d8a7e3a7Sitojun 	 * Note that the check for rt_llinfo is necessary because a cloned
622d8a7e3a7Sitojun 	 * route from a parent route that has the L flag (e.g. the default
623d8a7e3a7Sitojun 	 * route to a p2p interface) may have the flag, too, while the
624d8a7e3a7Sitojun 	 * destination is not actually a neighbor.
625287546eaSitojun 	 */
626287546eaSitojun 	if ((rt->rt_flags & RTF_GATEWAY) || (rt->rt_flags & RTF_LLINFO) == 0 ||
627d8a7e3a7Sitojun 	    rt->rt_gateway->sa_family != AF_LINK || rt->rt_llinfo == NULL ||
628248f6870Smpi 	    (ifp != NULL && rt->rt_ifidx != ifp->if_index)) {
629287546eaSitojun 		if (create) {
630bbcf0337Smpi 			char addr[INET6_ADDRSTRLEN];
63135075f95Smpi 			nd6log((LOG_DEBUG, "%s: failed to lookup %s (if=%s)\n",
63235075f95Smpi 			    __func__,
633bbcf0337Smpi 			    inet_ntop(AF_INET6, addr6, addr, sizeof(addr)),
634da592434Sitojun 			    ifp ? ifp->if_xname : "unspec"));
635287546eaSitojun 		}
63616119bbfSmpi 		rtfree(rt);
637d8a7e3a7Sitojun 		return (NULL);
638287546eaSitojun 	}
639287546eaSitojun 	return (rt);
640287546eaSitojun }
641287546eaSitojun 
642287546eaSitojun /*
643287546eaSitojun  * Detect if a given IPv6 address identifies a neighbor on a given link.
644287546eaSitojun  * XXX: should take care of the destination of a p2p link?
645287546eaSitojun  */
646287546eaSitojun int
647ee37ea65Smcbride nd6_is_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
648287546eaSitojun {
649ef6620bcSmpi 	struct in6_ifaddr *ia6;
650ef6620bcSmpi 	struct ifaddr *ifa;
651d8a7e3a7Sitojun 	struct rtentry *rt;
652287546eaSitojun 
653cfb6b8dfSitojun 	/*
654cfb6b8dfSitojun 	 * A link-local address is always a neighbor.
655cfb6b8dfSitojun 	 * XXX: we should use the sin6_scope_id field rather than the embedded
656cfb6b8dfSitojun 	 * interface index.
657d8a7e3a7Sitojun 	 * XXX: a link does not necessarily specify a single interface.
658cfb6b8dfSitojun 	 */
659cfb6b8dfSitojun 	if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr) &&
660cfb6b8dfSitojun 	    ntohs(*(u_int16_t *)&addr->sin6_addr.s6_addr[2]) == ifp->if_index)
661287546eaSitojun 		return (1);
662287546eaSitojun 
663ef6620bcSmpi 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
664ef6620bcSmpi 		if (ifa->ifa_addr->sa_family != AF_INET6)
665ef6620bcSmpi 			continue;
666ef6620bcSmpi 
667ef6620bcSmpi 		ia6 = ifatoia6(ifa);
668ef6620bcSmpi 
669ef6620bcSmpi 		/* Prefix check down below. */
670ef6620bcSmpi 		if (ia6->ia6_flags & IN6_IFF_AUTOCONF)
671ef6620bcSmpi 			continue;
672ef6620bcSmpi 
673ef6620bcSmpi 		if (IN6_ARE_MASKED_ADDR_EQUAL(&addr->sin6_addr,
674ef6620bcSmpi 		    &ia6->ia_addr.sin6_addr,
675ef6620bcSmpi 		    &ia6->ia_prefixmask.sin6_addr))
676ef6620bcSmpi 			return (1);
677ef6620bcSmpi 	}
678ef6620bcSmpi 
679287546eaSitojun 	/*
680287546eaSitojun 	 * Even if the address matches none of our addresses, it might be
681287546eaSitojun 	 * in the neighbor cache.
682287546eaSitojun 	 */
68316119bbfSmpi 	rt = nd6_lookup(&addr->sin6_addr, 0, ifp, ifp->if_rdomain);
68416119bbfSmpi 	if (rt != NULL) {
68516119bbfSmpi 		rtfree(rt);
686287546eaSitojun 		return (1);
68716119bbfSmpi 	}
688287546eaSitojun 
689287546eaSitojun 	return (0);
690287546eaSitojun }
691287546eaSitojun 
692c370e97fSmpi void
693c370e97fSmpi nd6_invalidate(struct rtentry *rt)
694c370e97fSmpi {
695c370e97fSmpi 	struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
6966143f866Sflorian 	struct sockaddr_dl *sdl = satosdl(rt->rt_gateway);
697c370e97fSmpi 
698c370e97fSmpi 	m_freem(ln->ln_hold);
6996143f866Sflorian 	sdl->sdl_alen = 0;
700c370e97fSmpi 	ln->ln_hold = NULL;
701c370e97fSmpi 	ln->ln_state = ND6_LLINFO_INCOMPLETE;
702c370e97fSmpi 	ln->ln_asked = 0;
703c370e97fSmpi }
704c370e97fSmpi 
705287546eaSitojun /*
706287546eaSitojun  * Free an nd6 llinfo entry.
707d8a7e3a7Sitojun  * Since the function would cause significant changes in the kernel, DO NOT
708d8a7e3a7Sitojun  * make it global, unless you have a strong reason for the change, and are sure
709d8a7e3a7Sitojun  * that the change is safe.
710287546eaSitojun  */
71118e33022Sbluhm void
71218e33022Sbluhm nd6_free(struct rtentry *rt)
713287546eaSitojun {
71418e33022Sbluhm 	struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
715c3c56496Sbluhm 	struct in6_addr in6 = satosin6(rt_key(rt))->sin6_addr;
716248f6870Smpi 	struct ifnet *ifp;
71745ffa37bSmpi 
71866736630Smpi 	NET_ASSERT_LOCKED();
719287546eaSitojun 
720248f6870Smpi 	ifp = if_get(rt->rt_ifidx);
721f4f4d166Sitojun 
72281d38878Smpi 	if (!ip6_forwarding) {
7234a2f474dSflorian 		if (ln->ln_router) {
724f4f4d166Sitojun 			/*
725f4f4d166Sitojun 			 * rt6_flush must be called whether or not the neighbor
726f4f4d166Sitojun 			 * is in the Default Router List.
727f4f4d166Sitojun 			 * See a corresponding comment in nd6_na_input().
728f4f4d166Sitojun 			 */
729248f6870Smpi 			rt6_flush(&in6, ifp);
730f4f4d166Sitojun 		}
731287546eaSitojun 	}
732287546eaSitojun 
7336348db95Sbluhm 	KASSERT(!ISSET(rt->rt_flags, RTF_LOCAL));
7344dfec2cfSmpi 	nd6_invalidate(rt);
7354dfec2cfSmpi 
73629760ae1Sitojun 	/*
73729760ae1Sitojun 	 * Detach the route from the routing tree and the list of neighbor
73829760ae1Sitojun 	 * caches, and disable the route entry not to be used in already
73929760ae1Sitojun 	 * cached routes.
74029760ae1Sitojun 	 */
741c370e97fSmpi 	if (!ISSET(rt->rt_flags, RTF_STATIC|RTF_CACHED))
742c4cbcae8Sbluhm 		rtdeletemsg(rt, ifp, ifp->if_rdomain);
74329760ae1Sitojun 
744248f6870Smpi 	if_put(ifp);
745287546eaSitojun }
746287546eaSitojun 
747287546eaSitojun /*
748287546eaSitojun  * Upper-layer reachability hint for Neighbor Unreachability Detection.
749287546eaSitojun  *
7508b542bbeSpascoe  * XXX cost-effective methods?
751287546eaSitojun  */
752287546eaSitojun void
753a7fa3e84Smpi nd6_nud_hint(struct rtentry *rt)
754287546eaSitojun {
755287546eaSitojun 	struct llinfo_nd6 *ln;
756a7fa3e84Smpi 	struct ifnet *ifp;
757287546eaSitojun 
758a7fa3e84Smpi 	ifp = if_get(rt->rt_ifidx);
759a7fa3e84Smpi 	if (ifp == NULL)
760287546eaSitojun 		return;
761287546eaSitojun 
762f6e55599Sitojun 	if ((rt->rt_flags & RTF_GATEWAY) != 0 ||
763f6e55599Sitojun 	    (rt->rt_flags & RTF_LLINFO) == 0 ||
7649c0643cdSbluhm 	    rt->rt_llinfo == NULL || rt->rt_gateway == NULL ||
765f6e55599Sitojun 	    rt->rt_gateway->sa_family != AF_LINK) {
766287546eaSitojun 		/* This is not a host route. */
767a7fa3e84Smpi 		goto out;
768287546eaSitojun 	}
769287546eaSitojun 
770287546eaSitojun 	ln = (struct llinfo_nd6 *)rt->rt_llinfo;
771804d8827Sitojun 	if (ln->ln_state < ND6_LLINFO_REACHABLE)
772a7fa3e84Smpi 		goto out;
773287546eaSitojun 
774f6e55599Sitojun 	/*
775f6e55599Sitojun 	 * if we get upper-layer reachability confirmation many times,
776f6e55599Sitojun 	 * it is possible we have false information.
777f6e55599Sitojun 	 */
778f6e55599Sitojun 	ln->ln_byhint++;
779f6e55599Sitojun 	if (ln->ln_byhint > nd6_maxnudhint)
780a7fa3e84Smpi 		goto out;
781f6e55599Sitojun 
782287546eaSitojun 	ln->ln_state = ND6_LLINFO_REACHABLE;
783a7fa3e84Smpi 	if (!ND6_LLINFO_PERMANENT(ln))
784134b71fcSdlg 		nd6_llinfo_settimer(ln, ND_IFINFO(ifp)->reachable);
785a7fa3e84Smpi out:
786a7fa3e84Smpi 	if_put(ifp);
787287546eaSitojun }
788287546eaSitojun 
789287546eaSitojun void
790dcb17c31Smpi nd6_rtrequest(struct ifnet *ifp, int req, struct rtentry *rt)
791287546eaSitojun {
792287546eaSitojun 	struct sockaddr *gate = rt->rt_gateway;
793287546eaSitojun 	struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
794287546eaSitojun 	struct ifaddr *ifa;
795*7e3957d1Sbluhm 	struct in6_ifaddr *ifa6;
796287546eaSitojun 
7974cb08838Sclaudio 	if (ISSET(rt->rt_flags, RTF_GATEWAY|RTF_MULTICAST|RTF_MPLS))
798287546eaSitojun 		return;
799287546eaSitojun 
800d8a7e3a7Sitojun 	if (nd6_need_cache(ifp) == 0 && (rt->rt_flags & RTF_HOST) == 0) {
801d8a7e3a7Sitojun 		/*
802d8a7e3a7Sitojun 		 * This is probably an interface direct route for a link
803d8a7e3a7Sitojun 		 * which does not need neighbor caches (e.g. fe80::%lo0/64).
804d8a7e3a7Sitojun 		 * We do not need special treatment below for such a route.
805d8a7e3a7Sitojun 		 * Moreover, the RTF_LLINFO flag which would be set below
806d8a7e3a7Sitojun 		 * would annoy the ndp(8) command.
807d8a7e3a7Sitojun 		 */
808d8a7e3a7Sitojun 		return;
809d8a7e3a7Sitojun 	}
810d8a7e3a7Sitojun 
811af1344beSbluhm 	if (req == RTM_RESOLVE && nd6_need_cache(ifp) == 0) {
812d8a7e3a7Sitojun 		/*
813af1344beSbluhm 		 * For routing daemons like ospf6d we allow neighbor discovery
814af1344beSbluhm 		 * based on the cloning route only.  This allows us to sent
815af1344beSbluhm 		 * packets directly into a network without having an address
816af1344beSbluhm 		 * with matching prefix on the interface.  If the cloning
817af1344beSbluhm 		 * route is used for an stf interface, we would mistakenly
818af1344beSbluhm 		 * make a neighbor cache for the host route, and would see
819af1344beSbluhm 		 * strange neighbor solicitation for the corresponding
820af1344beSbluhm 		 * destination.  In order to avoid confusion, we check if the
821af1344beSbluhm 		 * interface is suitable for neighbor discovery, and stop the
822d8a7e3a7Sitojun 		 * process if not.  Additionally, we remove the LLINFO flag
823d8a7e3a7Sitojun 		 * so that ndp(8) will not try to get the neighbor information
824d8a7e3a7Sitojun 		 * of the destination.
825d8a7e3a7Sitojun 		 */
826d8a7e3a7Sitojun 		rt->rt_flags &= ~RTF_LLINFO;
827d8a7e3a7Sitojun 		return;
828d8a7e3a7Sitojun 	}
829d8a7e3a7Sitojun 
830287546eaSitojun 	switch (req) {
831287546eaSitojun 	case RTM_ADD:
83248ebf8e1Sitojun 		if ((rt->rt_flags & RTF_CLONING) ||
8339c0643cdSbluhm 		    ((rt->rt_flags & (RTF_LLINFO | RTF_LOCAL)) && ln == NULL)) {
8349c0643cdSbluhm 			if (ln != NULL)
8359631a17bSitojun 				nd6_llinfo_settimer(ln, 0);
836d8a7e3a7Sitojun 			if ((rt->rt_flags & RTF_CLONING) != 0)
837287546eaSitojun 				break;
838287546eaSitojun 		}
839f4f4d166Sitojun 		/*
8408b542bbeSpascoe 		 * In IPv4 code, we try to announce new RTF_ANNOUNCE entry here.
841f4f4d166Sitojun 		 * We don't do that here since llinfo is not ready yet.
842f4f4d166Sitojun 		 *
843f4f4d166Sitojun 		 * There are also couple of other things to be discussed:
844f4f4d166Sitojun 		 * - unsolicited NA code needs improvement beforehand
845f4f4d166Sitojun 		 * - RFC2461 says we MAY send multicast unsolicited NA
846f4f4d166Sitojun 		 *   (7.2.6 paragraph 4), however, it also says that we
847f4f4d166Sitojun 		 *   SHOULD provide a mechanism to prevent multicast NA storm.
848f4f4d166Sitojun 		 *   we don't have anything like it right now.
849841d7adbSitojun 		 *   note that the mechanism needs a mutual agreement
850f4f4d166Sitojun 		 *   between proxies, which means that we need to implement
851841d7adbSitojun 		 *   a new protocol, or a new kludge.
852841d7adbSitojun 		 * - from RFC2461 6.2.4, host MUST NOT send an unsolicited NA.
853f4f4d166Sitojun 		 *   we need to check ip6forwarding before sending it.
854f4f4d166Sitojun 		 *   (or should we allow proxy ND configuration only for
855f4f4d166Sitojun 		 *   routers?  there's no mention about proxy ND from hosts)
856f4f4d166Sitojun 		 */
857f4f4d166Sitojun #if 0
858f4f4d166Sitojun 		/* XXX it does not work */
859287546eaSitojun 		if (rt->rt_flags & RTF_ANNOUNCE)
860287546eaSitojun 			nd6_na_output(ifp,
861c3c56496Sbluhm 			      &satosin6(rt_key(rt))->sin6_addr,
862c3c56496Sbluhm 			      &satosin6(rt_key(rt))->sin6_addr,
863287546eaSitojun 			      ip6_forwarding ? ND_NA_FLAG_ROUTER : 0,
864f4f4d166Sitojun 			      1, NULL);
865f4f4d166Sitojun #endif
866287546eaSitojun 		/* FALLTHROUGH */
867287546eaSitojun 	case RTM_RESOLVE:
868287546eaSitojun 		if (gate->sa_family != AF_LINK ||
869cfc71c8bSclaudio 		    gate->sa_len < sizeof(struct sockaddr_dl)) {
87086b61919Smpi 			log(LOG_DEBUG, "%s: bad gateway value: %s\n",
87186b61919Smpi 			    __func__, ifp->if_xname);
872287546eaSitojun 			break;
873287546eaSitojun 		}
874c7b7b779Sbluhm 		satosdl(gate)->sdl_type = ifp->if_type;
875c7b7b779Sbluhm 		satosdl(gate)->sdl_index = ifp->if_index;
876d374aaacSitojun 		if (ln != NULL)
877287546eaSitojun 			break;	/* This happens on a route change */
878287546eaSitojun 		/*
879287546eaSitojun 		 * Case 2: This route may come from cloning, or a manual route
880287546eaSitojun 		 * add with a LL address.
881287546eaSitojun 		 */
88293fbd125Sbluhm 		ln = pool_get(&nd6_pool, PR_NOWAIT | PR_ZERO);
883287546eaSitojun 		rt->rt_llinfo = (caddr_t)ln;
8849c0643cdSbluhm 		if (ln == NULL) {
88593fbd125Sbluhm 			log(LOG_DEBUG, "%s: pool get failed\n", __func__);
886287546eaSitojun 			break;
887287546eaSitojun 		}
888287546eaSitojun 		nd6_inuse++;
889287546eaSitojun 		nd6_allocated++;
890287546eaSitojun 		ln->ln_rt = rt;
891287546eaSitojun 		/* this is required for "ndp" command. - shin */
892287546eaSitojun 		if (req == RTM_ADD) {
893287546eaSitojun 		        /*
894287546eaSitojun 			 * gate should have some valid AF_LINK entry,
8953bc414e3Sdlg 			 * and ln expire should have some lifetime
896287546eaSitojun 			 * which is specified by ndp command.
897287546eaSitojun 			 */
898287546eaSitojun 			ln->ln_state = ND6_LLINFO_REACHABLE;
899f6e55599Sitojun 			ln->ln_byhint = 0;
900287546eaSitojun 		} else {
901287546eaSitojun 		        /*
902287546eaSitojun 			 * When req == RTM_RESOLVE, rt is created and
903287546eaSitojun 			 * initialized in rtrequest(), so rt_expire is 0.
904287546eaSitojun 			 */
905287546eaSitojun 			ln->ln_state = ND6_LLINFO_NOSTATE;
9069631a17bSitojun 			nd6_llinfo_settimer(ln, 0);
907287546eaSitojun 		}
908287546eaSitojun 		rt->rt_flags |= RTF_LLINFO;
90992c821ddSbluhm 		TAILQ_INSERT_HEAD(&nd6_list, ln, ln_list);
910287546eaSitojun 
911287546eaSitojun 		/*
912f3fcf2f3Smcbride 		 * If we have too many cache entries, initiate immediate
913f3fcf2f3Smcbride 		 * purging for some "less recently used" entries.  Note that
914f3fcf2f3Smcbride 		 * we cannot directly call nd6_free() here because it would
915f3fcf2f3Smcbride 		 * cause re-entering rtable related routines triggering an LOR
916f3fcf2f3Smcbride 		 * problem for FreeBSD.
917f3fcf2f3Smcbride 		 */
918f3fcf2f3Smcbride 		if (ip6_neighborgcthresh >= 0 &&
919f3fcf2f3Smcbride 		    nd6_inuse >= ip6_neighborgcthresh) {
920f3fcf2f3Smcbride 			int i;
921f3fcf2f3Smcbride 
92292c821ddSbluhm 			for (i = 0; i < 10; i++) {
92392c821ddSbluhm 				struct llinfo_nd6 *ln_end;
92492c821ddSbluhm 
92592c821ddSbluhm 				ln_end = TAILQ_LAST(&nd6_list, llinfo_nd6_head);
92692c821ddSbluhm 				if (ln_end == ln)
92792c821ddSbluhm 					break;
928f3fcf2f3Smcbride 
929f3fcf2f3Smcbride 				/* Move this entry to the head */
93092c821ddSbluhm 				TAILQ_REMOVE(&nd6_list, ln_end, ln_list);
93192c821ddSbluhm 				TAILQ_INSERT_HEAD(&nd6_list, ln_end, ln_list);
932f3fcf2f3Smcbride 
933f3fcf2f3Smcbride 				if (ND6_LLINFO_PERMANENT(ln_end))
934f3fcf2f3Smcbride 					continue;
935f3fcf2f3Smcbride 
936f3fcf2f3Smcbride 				if (ln_end->ln_state > ND6_LLINFO_INCOMPLETE)
937f3fcf2f3Smcbride 					ln_end->ln_state = ND6_LLINFO_STALE;
938f3fcf2f3Smcbride 				else
939f3fcf2f3Smcbride 					ln_end->ln_state = ND6_LLINFO_PURGE;
940f3fcf2f3Smcbride 				nd6_llinfo_settimer(ln_end, 0);
941f3fcf2f3Smcbride 			}
942f3fcf2f3Smcbride 		}
943f3fcf2f3Smcbride 
944f3fcf2f3Smcbride 		/*
945287546eaSitojun 		 * check if rt_key(rt) is one of my address assigned
946287546eaSitojun 		 * to the interface.
947287546eaSitojun 		 */
948*7e3957d1Sbluhm 		ifa6 = in6ifa_ifpwithaddr(ifp,
949*7e3957d1Sbluhm 		    &satosin6(rt_key(rt))->sin6_addr);
950*7e3957d1Sbluhm 		ifa = ifa6 ? &ifa6->ia_ifa : NULL;
951287546eaSitojun 		if (ifa) {
952287546eaSitojun 			ln->ln_state = ND6_LLINFO_REACHABLE;
953f6e55599Sitojun 			ln->ln_byhint = 0;
954334bfa0aSmpi 			rt->rt_expire = 0;
955fac399ceSmpi 			KASSERT(ifa == rt->rt_ifa);
956f4f4d166Sitojun 		} else if (rt->rt_flags & RTF_ANNOUNCE) {
957f4f4d166Sitojun 			ln->ln_state = ND6_LLINFO_REACHABLE;
958f6e55599Sitojun 			ln->ln_byhint = 0;
959334bfa0aSmpi 			rt->rt_expire = 0;
960f4f4d166Sitojun 
961f4f4d166Sitojun 			/* join solicited node multicast for proxy ND */
962f4f4d166Sitojun 			if (ifp->if_flags & IFF_MULTICAST) {
963f4f4d166Sitojun 				struct in6_addr llsol;
964f4f4d166Sitojun 				int error;
965f4f4d166Sitojun 
966c3c56496Sbluhm 				llsol = satosin6(rt_key(rt))->sin6_addr;
967f4f4d166Sitojun 				llsol.s6_addr16[0] = htons(0xff02);
968f4f4d166Sitojun 				llsol.s6_addr16[1] = htons(ifp->if_index);
969f4f4d166Sitojun 				llsol.s6_addr32[1] = 0;
970f4f4d166Sitojun 				llsol.s6_addr32[2] = htonl(1);
971f4f4d166Sitojun 				llsol.s6_addr8[12] = 0xff;
972f4f4d166Sitojun 
973d8a7e3a7Sitojun 				if (in6_addmulti(&llsol, ifp, &error)) {
974bbcf0337Smpi 					char addr[INET6_ADDRSTRLEN];
975d8a7e3a7Sitojun 					nd6log((LOG_ERR, "%s: failed to join "
976d8a7e3a7Sitojun 					    "%s (errno=%d)\n", ifp->if_xname,
977bbcf0337Smpi 					    inet_ntop(AF_INET6, &llsol,
978bbcf0337Smpi 						addr, sizeof(addr)),
979bbcf0337Smpi 					    error));
980d8a7e3a7Sitojun 				}
981f4f4d166Sitojun 			}
982287546eaSitojun 		}
983287546eaSitojun 		break;
984287546eaSitojun 
985287546eaSitojun 	case RTM_DELETE:
9869c0643cdSbluhm 		if (ln == NULL)
987287546eaSitojun 			break;
988f4f4d166Sitojun 		/* leave from solicited node multicast for proxy ND */
989f4f4d166Sitojun 		if ((rt->rt_flags & RTF_ANNOUNCE) != 0 &&
990f4f4d166Sitojun 		    (ifp->if_flags & IFF_MULTICAST) != 0) {
991f4f4d166Sitojun 			struct in6_addr llsol;
992f4f4d166Sitojun 			struct in6_multi *in6m;
993f4f4d166Sitojun 
994c3c56496Sbluhm 			llsol = satosin6(rt_key(rt))->sin6_addr;
995f4f4d166Sitojun 			llsol.s6_addr16[0] = htons(0xff02);
996f4f4d166Sitojun 			llsol.s6_addr16[1] = htons(ifp->if_index);
997f4f4d166Sitojun 			llsol.s6_addr32[1] = 0;
998f4f4d166Sitojun 			llsol.s6_addr32[2] = htonl(1);
999f4f4d166Sitojun 			llsol.s6_addr8[12] = 0xff;
1000f4f4d166Sitojun 
1001f4f4d166Sitojun 			IN6_LOOKUP_MULTI(llsol, ifp, in6m);
1002f4f4d166Sitojun 			if (in6m)
1003f4f4d166Sitojun 				in6_delmulti(in6m);
1004f4f4d166Sitojun 		}
1005287546eaSitojun 		nd6_inuse--;
100692c821ddSbluhm 		TAILQ_REMOVE(&nd6_list, ln, ln_list);
1007334bfa0aSmpi 		rt->rt_expire = 0;
10089c0643cdSbluhm 		rt->rt_llinfo = NULL;
1009287546eaSitojun 		rt->rt_flags &= ~RTF_LLINFO;
1010287546eaSitojun 		m_freem(ln->ln_hold);
101193fbd125Sbluhm 		pool_put(&nd6_pool, ln);
1012c370e97fSmpi 		break;
1013c370e97fSmpi 
1014c370e97fSmpi 	case RTM_INVALIDATE:
1015b5675ff3Skrw 		if (ln == NULL)
1016b5675ff3Skrw 			break;
1017ad57c59cSbluhm 		if (!ISSET(rt->rt_flags, RTF_LOCAL))
1018c370e97fSmpi 			nd6_invalidate(rt);
1019c370e97fSmpi 		break;
1020287546eaSitojun 	}
1021287546eaSitojun }
1022287546eaSitojun 
1023287546eaSitojun int
1024ee37ea65Smcbride nd6_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp)
1025287546eaSitojun {
1026287546eaSitojun 	struct in6_ndireq *ndi = (struct in6_ndireq *)data;
1027287546eaSitojun 	struct in6_nbrinfo *nbi = (struct in6_nbrinfo *)data;
1028287546eaSitojun 	struct rtentry *rt;
1029287546eaSitojun 
1030287546eaSitojun 	switch (cmd) {
1031d6b9e9b9Sitojun 	case SIOCGIFINFO_IN6:
10324d5cbc65Smpi 		NET_RLOCK_IN_IOCTL();
1033d6b9e9b9Sitojun 		ndi->ndi = *ND_IFINFO(ifp);
10344d5cbc65Smpi 		NET_RUNLOCK_IN_IOCTL();
1035dd66399bStb 		return (0);
1036287546eaSitojun 	case SIOCGNBRINFO_IN6:
1037287546eaSitojun 	{
1038287546eaSitojun 		struct llinfo_nd6 *ln;
1039287546eaSitojun 		struct in6_addr nb_addr = nbi->addr; /* make local for safety */
1040f303499dSdlg 		time_t expire;
1041287546eaSitojun 
10424d5cbc65Smpi 		NET_RLOCK_IN_IOCTL();
1043287546eaSitojun 		/*
1044287546eaSitojun 		 * XXX: KAME specific hack for scoped addresses
1045287546eaSitojun 		 *      XXXX: for other scopes than link-local?
1046287546eaSitojun 		 */
1047287546eaSitojun 		if (IN6_IS_ADDR_LINKLOCAL(&nbi->addr) ||
1048287546eaSitojun 		    IN6_IS_ADDR_MC_LINKLOCAL(&nbi->addr)) {
1049287546eaSitojun 			u_int16_t *idp = (u_int16_t *)&nb_addr.s6_addr[2];
1050287546eaSitojun 
1051287546eaSitojun 			if (*idp == 0)
1052287546eaSitojun 				*idp = htons(ifp->if_index);
1053287546eaSitojun 		}
1054287546eaSitojun 
105516119bbfSmpi 		rt = nd6_lookup(&nb_addr, 0, ifp, ifp->if_rdomain);
105616119bbfSmpi 		if (rt == NULL ||
1057d8a7e3a7Sitojun 		    (ln = (struct llinfo_nd6 *)rt->rt_llinfo) == NULL) {
105816119bbfSmpi 			rtfree(rt);
10594d5cbc65Smpi 			NET_RUNLOCK_IN_IOCTL();
1060dd66399bStb 			return (EINVAL);
1061287546eaSitojun 		}
10623bc414e3Sdlg 		expire = ln->ln_rt->rt_expire;
1063f303499dSdlg 		if (expire != 0) {
10643209772dScheloha 			expire -= getuptime();
10653209772dScheloha 			expire += gettime();
1066f303499dSdlg 		}
1067f303499dSdlg 
1068287546eaSitojun 		nbi->state = ln->ln_state;
1069287546eaSitojun 		nbi->asked = ln->ln_asked;
1070287546eaSitojun 		nbi->isrouter = ln->ln_router;
1071f303499dSdlg 		nbi->expire = expire;
1072287546eaSitojun 
1073dd66399bStb 		rtfree(rt);
10744d5cbc65Smpi 		NET_RUNLOCK_IN_IOCTL();
1075dd66399bStb 		return (0);
1076287546eaSitojun 	}
1077287546eaSitojun 	}
1078dd66399bStb 	return (0);
1079287546eaSitojun }
1080287546eaSitojun 
1081287546eaSitojun /*
1082287546eaSitojun  * Create neighbor cache entry and cache link-layer address,
1083287546eaSitojun  * on reception of inbound ND6 packets.  (RS/RA/NS/redirect)
1084ee37ea65Smcbride  *
1085ee37ea65Smcbride  * type - ICMP6 type
1086ee37ea65Smcbride  * code - type dependent information
1087287546eaSitojun  */
1088db435b2aSmpi void
1089ee37ea65Smcbride nd6_cache_lladdr(struct ifnet *ifp, struct in6_addr *from, char *lladdr,
1090ee37ea65Smcbride     int lladdrlen, int type, int code)
1091287546eaSitojun {
1092287546eaSitojun 	struct rtentry *rt = NULL;
1093287546eaSitojun 	struct llinfo_nd6 *ln = NULL;
1094287546eaSitojun 	int is_newentry;
1095287546eaSitojun 	struct sockaddr_dl *sdl = NULL;
1096287546eaSitojun 	int do_update;
1097287546eaSitojun 	int olladdr;
1098287546eaSitojun 	int llchange;
1099287546eaSitojun 	int newstate = 0;
1100287546eaSitojun 
1101287546eaSitojun 	if (!ifp)
1102ab0ea4a9Snayden 		panic("%s: ifp == NULL", __func__);
1103287546eaSitojun 	if (!from)
1104ab0ea4a9Snayden 		panic("%s: from == NULL", __func__);
1105287546eaSitojun 
1106287546eaSitojun 	/* nothing must be updated for unspecified address */
1107287546eaSitojun 	if (IN6_IS_ADDR_UNSPECIFIED(from))
1108db435b2aSmpi 		return;
1109287546eaSitojun 
1110287546eaSitojun 	/*
1111287546eaSitojun 	 * Validation about ifp->if_addrlen and lladdrlen must be done in
1112287546eaSitojun 	 * the caller.
1113287546eaSitojun 	 *
11148b542bbeSpascoe 	 * XXX If the link does not have link-layer address, what should
1115287546eaSitojun 	 * we do? (ifp->if_addrlen == 0)
1116287546eaSitojun 	 * Spec says nothing in sections for RA, RS and NA.  There's small
1117287546eaSitojun 	 * description on it in NS section (RFC 2461 7.2.3).
1118287546eaSitojun 	 */
1119287546eaSitojun 
1120f4d1af37Smikeb 	rt = nd6_lookup(from, 0, ifp, ifp->if_rdomain);
112116119bbfSmpi 	if (rt == NULL) {
11225148b194Smpi 		rt = nd6_lookup(from, 1, ifp, ifp->if_rdomain);
1123287546eaSitojun 		is_newentry = 1;
11240a2c5741Sitojun 	} else {
11258e6c5245Smpi 		/* do not overwrite local or static entry */
11268e6c5245Smpi 		if (ISSET(rt->rt_flags, RTF_STATIC|RTF_LOCAL)) {
112716119bbfSmpi 			rtfree(rt);
1128db435b2aSmpi 			return;
112916119bbfSmpi 		}
1130287546eaSitojun 		is_newentry = 0;
11310a2c5741Sitojun 	}
1132287546eaSitojun 
1133287546eaSitojun 	if (!rt)
1134db435b2aSmpi 		return;
1135287546eaSitojun 	if ((rt->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) != RTF_LLINFO) {
1136287546eaSitojun fail:
113718e33022Sbluhm 		nd6_free(rt);
113816119bbfSmpi 		rtfree(rt);
1139db435b2aSmpi 		return;
1140287546eaSitojun 	}
1141287546eaSitojun 	ln = (struct llinfo_nd6 *)rt->rt_llinfo;
11429c0643cdSbluhm 	if (ln == NULL)
1143287546eaSitojun 		goto fail;
11449c0643cdSbluhm 	if (rt->rt_gateway == NULL)
1145287546eaSitojun 		goto fail;
1146287546eaSitojun 	if (rt->rt_gateway->sa_family != AF_LINK)
1147287546eaSitojun 		goto fail;
1148c7b7b779Sbluhm 	sdl = satosdl(rt->rt_gateway);
1149287546eaSitojun 
1150287546eaSitojun 	olladdr = (sdl->sdl_alen) ? 1 : 0;
1151287546eaSitojun 	if (olladdr && lladdr) {
1152287546eaSitojun 		if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen))
1153287546eaSitojun 			llchange = 1;
1154287546eaSitojun 		else
1155287546eaSitojun 			llchange = 0;
1156287546eaSitojun 	} else
1157287546eaSitojun 		llchange = 0;
1158287546eaSitojun 
1159287546eaSitojun 	/*
1160287546eaSitojun 	 * newentry olladdr  lladdr  llchange	(*=record)
1161287546eaSitojun 	 *	0	n	n	--	(1)
1162287546eaSitojun 	 *	0	y	n	--	(2)
1163287546eaSitojun 	 *	0	n	y	--	(3) * STALE
1164287546eaSitojun 	 *	0	y	y	n	(4) *
1165287546eaSitojun 	 *	0	y	y	y	(5) * STALE
1166287546eaSitojun 	 *	1	--	n	--	(6)   NOSTATE(= PASSIVE)
1167287546eaSitojun 	 *	1	--	y	--	(7) * STALE
1168287546eaSitojun 	 */
1169287546eaSitojun 
1170c8a7c9e3Sbluhm 	if (llchange) {
1171bbcf0337Smpi 		char addr[INET6_ADDRSTRLEN];
1172c8a7c9e3Sbluhm 		log(LOG_INFO, "ndp info overwritten for %s by %s on %s\n",
1173bbcf0337Smpi 		    inet_ntop(AF_INET6, from, addr, sizeof(addr)),
1174bbcf0337Smpi 		    ether_sprintf(lladdr), ifp->if_xname);
1175c8a7c9e3Sbluhm 	}
1176287546eaSitojun 	if (lladdr) {		/* (3-5) and (7) */
1177287546eaSitojun 		/*
1178287546eaSitojun 		 * Record source link-layer address
1179287546eaSitojun 		 * XXX is it dependent to ifp->if_type?
1180287546eaSitojun 		 */
1181287546eaSitojun 		sdl->sdl_alen = ifp->if_addrlen;
1182287546eaSitojun 		bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
1183287546eaSitojun 	}
1184287546eaSitojun 
1185287546eaSitojun 	if (!is_newentry) {
1186d8a7e3a7Sitojun 		if ((!olladdr && lladdr) ||		/* (3) */
1187d8a7e3a7Sitojun 		    (olladdr && lladdr && llchange)) {	/* (5) */
1188287546eaSitojun 			do_update = 1;
1189287546eaSitojun 			newstate = ND6_LLINFO_STALE;
1190287546eaSitojun 		} else					/* (1-2,4) */
1191287546eaSitojun 			do_update = 0;
1192287546eaSitojun 	} else {
1193287546eaSitojun 		do_update = 1;
1194287546eaSitojun 		if (!lladdr)				/* (6) */
1195287546eaSitojun 			newstate = ND6_LLINFO_NOSTATE;
1196287546eaSitojun 		else					/* (7) */
1197287546eaSitojun 			newstate = ND6_LLINFO_STALE;
1198287546eaSitojun 	}
1199287546eaSitojun 
1200287546eaSitojun 	if (do_update) {
1201287546eaSitojun 		/*
1202287546eaSitojun 		 * Update the state of the neighbor cache.
1203287546eaSitojun 		 */
1204287546eaSitojun 		ln->ln_state = newstate;
1205287546eaSitojun 
1206287546eaSitojun 		if (ln->ln_state == ND6_LLINFO_STALE) {
12078a7bb304Sitojun 			/*
120853b39a0bSmpi 			 * Since nd6_resolve() in ifp->if_output() will cause
12098b542bbeSpascoe 			 * state transition to DELAY and reset the timer,
12108a7bb304Sitojun 			 * we must set the timer now, although it is actually
12118a7bb304Sitojun 			 * meaningless.
12128a7bb304Sitojun 			 */
1213134b71fcSdlg 			nd6_llinfo_settimer(ln, nd6_gctimer);
12148a7bb304Sitojun 
1215287546eaSitojun 			if (ln->ln_hold) {
1216e212adedSkrw 				struct mbuf *n = ln->ln_hold;
1217e212adedSkrw 				ln->ln_hold = NULL;
12186afad192Sitojun 				/*
12196afad192Sitojun 				 * we assume ifp is not a p2p here, so just
12206afad192Sitojun 				 * set the 2nd argument as the 1st one.
12216afad192Sitojun 				 */
122253b39a0bSmpi 				ifp->if_output(ifp, n, rt_key(rt), rt);
1223e212adedSkrw 				if (ln->ln_hold == n) {
1224e212adedSkrw 					/* n is back in ln_hold. Discard. */
1225e212adedSkrw 					m_freem(ln->ln_hold);
12268a7bb304Sitojun 					ln->ln_hold = NULL;
1227287546eaSitojun 				}
1228e212adedSkrw 			}
1229287546eaSitojun 		} else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
1230287546eaSitojun 			/* probe right away */
1231334bfa0aSmpi 			nd6_llinfo_settimer(ln, 0);
1232287546eaSitojun 		}
1233287546eaSitojun 	}
1234287546eaSitojun 
1235287546eaSitojun 	/*
1236287546eaSitojun 	 * ICMP6 type dependent behavior.
1237287546eaSitojun 	 *
1238287546eaSitojun 	 * NS: clear IsRouter if new entry
1239287546eaSitojun 	 * RS: clear IsRouter
1240287546eaSitojun 	 * RA: set IsRouter if there's lladdr
1241287546eaSitojun 	 * redir: clear IsRouter if new entry
1242287546eaSitojun 	 *
1243287546eaSitojun 	 * RA case, (1):
1244287546eaSitojun 	 * The spec says that we must set IsRouter in the following cases:
1245287546eaSitojun 	 * - If lladdr exist, set IsRouter.  This means (1-5).
1246287546eaSitojun 	 * - If it is old entry (!newentry), set IsRouter.  This means (7).
1247287546eaSitojun 	 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
12488b542bbeSpascoe 	 * A question arises for (1) case.  (1) case has no lladdr in the
1249287546eaSitojun 	 * neighbor cache, this is similar to (6).
1250287546eaSitojun 	 * This case is rare but we figured that we MUST NOT set IsRouter.
1251287546eaSitojun 	 *
1252287546eaSitojun 	 * newentry olladdr  lladdr  llchange	    NS  RS  RA	redir
1253287546eaSitojun 	 *							D R
1254287546eaSitojun 	 *	0	n	n	--	(1)	c   ?     s
1255287546eaSitojun 	 *	0	y	n	--	(2)	c   s     s
1256287546eaSitojun 	 *	0	n	y	--	(3)	c   s     s
1257287546eaSitojun 	 *	0	y	y	n	(4)	c   s     s
1258287546eaSitojun 	 *	0	y	y	y	(5)	c   s     s
1259287546eaSitojun 	 *	1	--	n	--	(6) c	c	c s
1260287546eaSitojun 	 *	1	--	y	--	(7) c	c   s	c s
1261287546eaSitojun 	 *
1262287546eaSitojun 	 *					(c=clear s=set)
1263287546eaSitojun 	 */
1264287546eaSitojun 	switch (type & 0xff) {
1265287546eaSitojun 	case ND_NEIGHBOR_SOLICIT:
1266287546eaSitojun 		/*
1267287546eaSitojun 		 * New entry must have is_router flag cleared.
1268287546eaSitojun 		 */
1269287546eaSitojun 		if (is_newentry)	/* (6-7) */
1270287546eaSitojun 			ln->ln_router = 0;
1271287546eaSitojun 		break;
1272287546eaSitojun 	case ND_REDIRECT:
1273287546eaSitojun 		/*
1274287546eaSitojun 		 * If the icmp is a redirect to a better router, always set the
1275287546eaSitojun 		 * is_router flag.  Otherwise, if the entry is newly created,
1276287546eaSitojun 		 * clear the flag.  [RFC 2461, sec 8.3]
1277287546eaSitojun 		 */
1278287546eaSitojun 		if (code == ND_REDIRECT_ROUTER)
1279287546eaSitojun 			ln->ln_router = 1;
1280287546eaSitojun 		else if (is_newentry) /* (6-7) */
1281287546eaSitojun 			ln->ln_router = 0;
1282287546eaSitojun 		break;
1283287546eaSitojun 	case ND_ROUTER_SOLICIT:
1284287546eaSitojun 		/*
1285287546eaSitojun 		 * is_router flag must always be cleared.
1286287546eaSitojun 		 */
1287287546eaSitojun 		ln->ln_router = 0;
1288287546eaSitojun 		break;
1289287546eaSitojun 	case ND_ROUTER_ADVERT:
1290287546eaSitojun 		/*
1291287546eaSitojun 		 * Mark an entry with lladdr as a router.
1292287546eaSitojun 		 */
1293d8a7e3a7Sitojun 		if ((!is_newentry && (olladdr || lladdr)) ||	/* (2-5) */
1294d8a7e3a7Sitojun 		    (is_newentry && lladdr)) {			/* (7) */
1295287546eaSitojun 			ln->ln_router = 1;
1296287546eaSitojun 		}
1297287546eaSitojun 		break;
1298287546eaSitojun 	}
1299287546eaSitojun 
130016119bbfSmpi 	rtfree(rt);
1301287546eaSitojun }
1302287546eaSitojun 
1303a0aa363cSjsing void
1304ee37ea65Smcbride nd6_slowtimo(void *ignored_arg)
1305287546eaSitojun {
1306b3c1e4c1Sitojun 	struct nd_ifinfo *nd6if;
1307d6b9e9b9Sitojun 	struct ifnet *ifp;
130822e88dadSmpi 
1309aa28b9a6Smpi 	NET_LOCK();
1310287546eaSitojun 
131129e86e5eSblambert 	timeout_add_sec(&nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL);
131222e88dadSmpi 
1313d814b14cSbluhm 	TAILQ_FOREACH(ifp, &ifnet, if_list) {
1314d6b9e9b9Sitojun 		nd6if = ND_IFINFO(ifp);
1315287546eaSitojun 		if (nd6if->basereachable && /* already initialized */
1316287546eaSitojun 		    (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
1317287546eaSitojun 			/*
1318287546eaSitojun 			 * Since reachable time rarely changes by router
1319287546eaSitojun 			 * advertisements, we SHOULD insure that a new random
1320287546eaSitojun 			 * value gets recomputed at least once every few hours.
1321287546eaSitojun 			 * (RFC 2461, 6.3.4)
1322287546eaSitojun 			 */
1323287546eaSitojun 			nd6if->recalctm = nd6_recalc_reachtm_interval;
1324287546eaSitojun 			nd6if->reachable = ND_COMPUTE_RTIME(nd6if->basereachable);
1325287546eaSitojun 		}
1326287546eaSitojun 	}
1327aa28b9a6Smpi 	NET_UNLOCK();
1328287546eaSitojun }
1329287546eaSitojun 
1330287546eaSitojun int
13315d32b3a0Smpi nd6_resolve(struct ifnet *ifp, struct rtentry *rt0, struct mbuf *m,
13325d32b3a0Smpi     struct sockaddr *dst, u_char *desten)
13335d32b3a0Smpi {
13345d32b3a0Smpi 	struct sockaddr_dl *sdl;
13355d32b3a0Smpi 	struct rtentry *rt;
1336287546eaSitojun 	struct llinfo_nd6 *ln = NULL;
1337287546eaSitojun 
13385d32b3a0Smpi 	if (m->m_flags & M_MCAST) {
13395d32b3a0Smpi 		ETHER_MAP_IPV6_MULTICAST(&satosin6(dst)->sin6_addr, desten);
13405d32b3a0Smpi 		return (0);
13415d32b3a0Smpi 	}
13425b3a2895Ssthen 
1343c370e97fSmpi 	rt = rt_getll(rt0);
1344c370e97fSmpi 
1345c370e97fSmpi 	if (ISSET(rt->rt_flags, RTF_REJECT) &&
13463209772dScheloha 	    (rt->rt_expire == 0 || getuptime() < rt->rt_expire)) {
13478c023157Smpi 		m_freem(m);
1348c370e97fSmpi 		return (rt == rt0 ? EHOSTDOWN : EHOSTUNREACH);
1349287546eaSitojun 	}
1350cfb6b8dfSitojun 
1351287546eaSitojun 	/*
1352287546eaSitojun 	 * Address resolution or Neighbor Unreachability Detection
1353287546eaSitojun 	 * for the next hop.
1354287546eaSitojun 	 * At this point, the destination of the packet must be a unicast
1355287546eaSitojun 	 * or an anycast address(i.e. not a multicast).
1356287546eaSitojun 	 */
13575da3fb44Smpi 	if (!ISSET(rt->rt_flags, RTF_LLINFO)) {
1358bbcf0337Smpi 		char addr[INET6_ADDRSTRLEN];
13595da3fb44Smpi 		log(LOG_DEBUG, "%s: %s: route contains no ND information\n",
13605da3fb44Smpi 		    __func__, inet_ntop(AF_INET6,
13615da3fb44Smpi 		    &satosin6(rt_key(rt))->sin6_addr, addr, sizeof(addr)));
136216119bbfSmpi 		m_freem(m);
13635da3fb44Smpi 		return (EINVAL);
1364287546eaSitojun 	}
1365287546eaSitojun 
13665d32b3a0Smpi 	if (rt->rt_gateway->sa_family != AF_LINK) {
13675d32b3a0Smpi 		printf("%s: something odd happens\n", __func__);
13685d32b3a0Smpi 		m_freem(m);
13695d32b3a0Smpi 		return (EINVAL);
13705d32b3a0Smpi 	}
13715d32b3a0Smpi 
13725da3fb44Smpi 	ln = (struct llinfo_nd6 *)rt->rt_llinfo;
13735da3fb44Smpi 	KASSERT(ln != NULL);
1374cfb6b8dfSitojun 
1375f3fcf2f3Smcbride 	/*
1376f3fcf2f3Smcbride 	 * Move this entry to the head of the queue so that it is less likely
1377f3fcf2f3Smcbride 	 * for this entry to be a target of forced garbage collection (see
1378f3fcf2f3Smcbride 	 * nd6_rtrequest()).
1379f3fcf2f3Smcbride 	 */
138092c821ddSbluhm 	TAILQ_REMOVE(&nd6_list, ln, ln_list);
138192c821ddSbluhm 	TAILQ_INSERT_HEAD(&nd6_list, ln, ln_list);
1382f3fcf2f3Smcbride 
1383287546eaSitojun 	/*
1384287546eaSitojun 	 * The first time we send a packet to a neighbor whose entry is
1385287546eaSitojun 	 * STALE, we have to change the state to DELAY and a sets a timer to
1386287546eaSitojun 	 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
1387287546eaSitojun 	 * neighbor unreachability detection on expiration.
1388287546eaSitojun 	 * (RFC 2461 7.3.3)
1389287546eaSitojun 	 */
1390287546eaSitojun 	if (ln->ln_state == ND6_LLINFO_STALE) {
1391287546eaSitojun 		ln->ln_asked = 0;
1392287546eaSitojun 		ln->ln_state = ND6_LLINFO_DELAY;
1393134b71fcSdlg 		nd6_llinfo_settimer(ln, nd6_delay);
1394287546eaSitojun 	}
1395287546eaSitojun 
1396287546eaSitojun 	/*
1397287546eaSitojun 	 * If the neighbor cache entry has a state other than INCOMPLETE
139834deef1eSitojun 	 * (i.e. its link-layer address is already resolved), just
1399287546eaSitojun 	 * send the packet.
1400287546eaSitojun 	 */
14015d32b3a0Smpi 	if (ln->ln_state > ND6_LLINFO_INCOMPLETE) {
14025d32b3a0Smpi 		sdl = satosdl(rt->rt_gateway);
14035d32b3a0Smpi 		if (sdl->sdl_alen != ETHER_ADDR_LEN) {
14045d32b3a0Smpi 			char addr[INET6_ADDRSTRLEN];
14055d32b3a0Smpi 			log(LOG_DEBUG, "%s: %s: incorrect nd6 information\n",
14065d32b3a0Smpi 			    __func__,
14075d32b3a0Smpi 			    inet_ntop(AF_INET6, &satosin6(dst)->sin6_addr,
14085d32b3a0Smpi 				addr, sizeof(addr)));
14095d32b3a0Smpi 			m_freem(m);
14105d32b3a0Smpi 			return (EINVAL);
14115d32b3a0Smpi 		}
14125d32b3a0Smpi 
14135d32b3a0Smpi 		bcopy(LLADDR(sdl), desten, sdl->sdl_alen);
14145d32b3a0Smpi 		return (0);
14155d32b3a0Smpi 	}
1416287546eaSitojun 
1417287546eaSitojun 	/*
1418287546eaSitojun 	 * There is a neighbor cache entry, but no ethernet address
1419287546eaSitojun 	 * response yet.  Replace the held mbuf (if any) with this
1420287546eaSitojun 	 * latest one.
1421287546eaSitojun 	 */
1422efcf292bSitojun 	if (ln->ln_state == ND6_LLINFO_NOSTATE)
1423287546eaSitojun 		ln->ln_state = ND6_LLINFO_INCOMPLETE;
1424287546eaSitojun 	m_freem(ln->ln_hold);
1425287546eaSitojun 	ln->ln_hold = m;
14265d32b3a0Smpi 
142776843262Sitojun 	/*
142876843262Sitojun 	 * If there has been no NS for the neighbor after entering the
142976843262Sitojun 	 * INCOMPLETE state, send the first solicitation.
143076843262Sitojun 	 */
14319631a17bSitojun 	if (!ND6_LLINFO_PERMANENT(ln) && ln->ln_asked == 0) {
1432287546eaSitojun 		ln->ln_asked++;
1433134b71fcSdlg 		nd6_llinfo_settimer(ln, ND_IFINFO(ifp)->retrans / 1000);
14345d32b3a0Smpi 		nd6_ns_output(ifp, NULL, &satosin6(dst)->sin6_addr, ln, 0);
1435287546eaSitojun 	}
14365d32b3a0Smpi 	return (EAGAIN);
1437287546eaSitojun }
1438287546eaSitojun 
1439287546eaSitojun int
1440ee37ea65Smcbride nd6_need_cache(struct ifnet *ifp)
1441d8a7e3a7Sitojun {
1442d8a7e3a7Sitojun 	/*
1443d8a7e3a7Sitojun 	 * RFC2893 says:
1444d8a7e3a7Sitojun 	 * - unidirectional tunnels needs no ND
1445d8a7e3a7Sitojun 	 */
1446d8a7e3a7Sitojun 	switch (ifp->if_type) {
1447d8a7e3a7Sitojun 	case IFT_ETHER:
1448d8a7e3a7Sitojun 	case IFT_IEEE80211:
1449f4433d56Shenning 	case IFT_CARP:
1450d8a7e3a7Sitojun 		return (1);
1451d8a7e3a7Sitojun 	default:
1452d8a7e3a7Sitojun 		return (0);
1453d8a7e3a7Sitojun 	}
1454d8a7e3a7Sitojun }
1455