1 /* $FreeBSD: src/sys/netinet6/nd6_nbr.c,v 1.4.2.6 2003/01/23 21:06:47 sam Exp $ */
2 /* $KAME: nd6_nbr.c,v 1.86 2002/01/21 02:33:04 jinmei Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 #include "opt_inet.h"
34 #include "opt_inet6.h"
35 #include "opt_carp.h"
36
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/malloc.h>
40 #include <sys/mbuf.h>
41 #include <sys/socket.h>
42 #include <sys/sockio.h>
43 #include <sys/time.h>
44 #include <sys/kernel.h>
45 #include <sys/errno.h>
46 #include <sys/syslog.h>
47 #include <sys/queue.h>
48 #include <sys/callout.h>
49 #include <sys/mutex.h>
50
51 #include <sys/thread2.h>
52 #include <sys/mutex2.h>
53
54 #include <net/if.h>
55 #include <net/if_types.h>
56 #include <net/if_dl.h>
57 #include <net/route.h>
58 #include <net/netisr2.h>
59 #include <net/netmsg2.h>
60
61 #include <netinet/in.h>
62 #include <netinet/in_var.h>
63 #include <netinet6/in6_var.h>
64 #include <netinet/ip6.h>
65 #include <netinet6/ip6_var.h>
66 #include <netinet6/nd6.h>
67 #include <netinet/icmp6.h>
68
69 #include <net/net_osdep.h>
70
71 #ifdef CARP
72 #include <netinet/ip_carp.h>
73 #endif
74
75
76 #define SDL(s) ((struct sockaddr_dl *)s)
77
78 struct dadq;
79 static struct dadq *nd6_dad_find(struct ifaddr *);
80 static void nd6_dad_starttimer(struct dadq *, int);
81 static void nd6_dad_stoptimer(struct dadq *);
82 static void nd6_dad_timer(void *);
83 static void nd6_dad_timer_handler(netmsg_t);
84 static void nd6_dad_ns_output(struct dadq *);
85 static void nd6_dad_ns_input(struct ifaddr *);
86 static void nd6_dad_na_input(struct ifaddr *);
87 static struct dadq *nd6_dad_create(struct ifaddr *);
88 static void nd6_dad_destroy(struct dadq *);
89 static void nd6_dad_duplicated(struct ifaddr *);
90
91 static int dad_ignore_ns = 0; /* ignore NS in DAD - specwise incorrect*/
92 static int dad_maxtry = 15; /* max # of *tries* to transmit DAD packet */
93
94 /*
95 * Input an Neighbor Solicitation Message.
96 *
97 * Based on RFC 2461
98 * Based on RFC 2462 (duplicated address detection)
99 */
100 void
nd6_ns_input(struct mbuf * m,int off,int icmp6len)101 nd6_ns_input(struct mbuf *m, int off, int icmp6len)
102 {
103 struct ifnet *ifp = m->m_pkthdr.rcvif;
104 struct ifnet *cmpifp;
105 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
106 struct nd_neighbor_solicit *nd_ns;
107 struct in6_addr saddr6 = ip6->ip6_src;
108 struct in6_addr daddr6 = ip6->ip6_dst;
109 struct in6_addr taddr6;
110 struct in6_addr myaddr6;
111 char *lladdr = NULL;
112 struct ifaddr *ifa = NULL;
113 int lladdrlen = 0;
114 int anycast = 0, proxy = 0, tentative = 0;
115 int tlladdr;
116 union nd_opts ndopts;
117 struct sockaddr_dl *proxydl = NULL;
118
119 /*
120 * Collapse interfaces to the bridge for comparison and
121 * mac (llinfo) purposes.
122 */
123 cmpifp = ifp;
124 if (ifp->if_bridge)
125 cmpifp = ifp->if_bridge;
126
127 #ifndef PULLDOWN_TEST
128 IP6_EXTHDR_CHECK(m, off, icmp6len,);
129 nd_ns = (struct nd_neighbor_solicit *)((caddr_t)ip6 + off);
130 #else
131 IP6_EXTHDR_GET(nd_ns, struct nd_neighbor_solicit *, m, off, icmp6len);
132 if (nd_ns == NULL) {
133 icmp6stat.icp6s_tooshort++;
134 return;
135 }
136 #endif
137 ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */
138 taddr6 = nd_ns->nd_ns_target;
139
140 if (ip6->ip6_hlim != 255) {
141 nd6log((LOG_ERR,
142 "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n",
143 ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
144 ip6_sprintf(&ip6->ip6_dst), if_name(ifp)));
145 goto bad;
146 }
147
148 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) {
149 /* dst has to be solicited node multicast address. */
150 if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL &&
151 /* don't check ifindex portion */
152 daddr6.s6_addr32[1] == 0 &&
153 daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE &&
154 daddr6.s6_addr8[12] == 0xff) {
155 ; /* good */
156 } else {
157 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
158 "(wrong ip6 dst)\n"));
159 goto bad;
160 }
161 } else if (!nd6_onlink_ns_rfc4861) {
162 struct sockaddr_in6 src_sa6;
163
164 /*
165 * According to recent IETF discussions, it is not a good idea
166 * to accept a NS from an address which would not be deemed
167 * to be a neighbor otherwise. This point is expected to be
168 * clarified in future revisions of the specification.
169 */
170 bzero(&src_sa6, sizeof(src_sa6));
171 src_sa6.sin6_family = AF_INET6;
172 src_sa6.sin6_len = sizeof(src_sa6);
173 src_sa6.sin6_addr = saddr6;
174 if (nd6_is_addr_neighbor(&src_sa6, ifp) == 0) {
175 nd6log((LOG_INFO, "nd6_ns_input: "
176 "NS packet from non-neighbor\n"));
177 goto bad;
178 }
179 }
180
181 if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
182 nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n"));
183 goto bad;
184 }
185
186 if (IN6_IS_SCOPE_LINKLOCAL(&taddr6))
187 taddr6.s6_addr16[1] = htons(ifp->if_index);
188
189 icmp6len -= sizeof(*nd_ns);
190 nd6_option_init(nd_ns + 1, icmp6len, &ndopts);
191 if (nd6_options(&ndopts) < 0) {
192 nd6log((LOG_INFO,
193 "nd6_ns_input: invalid ND option, ignored\n"));
194 /* nd6_options have incremented stats */
195 goto freeit;
196 }
197
198 if (ndopts.nd_opts_src_lladdr) {
199 lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1);
200 lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3;
201 }
202
203 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) && lladdr) {
204 nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
205 "(link-layer address option)\n"));
206 goto bad;
207 }
208
209 /*
210 * Attaching target link-layer address to the NA?
211 * (RFC 2461 7.2.4)
212 *
213 * NS IP dst is unicast/anycast MUST NOT add
214 * NS IP dst is solicited-node multicast MUST add
215 *
216 * In implementation, we add target link-layer address by default.
217 * We do not add one in MUST NOT cases.
218 */
219 #if 0 /* too much! */
220 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &daddr6);
221 if (ifa && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST))
222 tlladdr = 0;
223 else
224 #endif
225 if (!IN6_IS_ADDR_MULTICAST(&daddr6))
226 tlladdr = 0;
227 else
228 tlladdr = 1;
229
230 /*
231 * Target address (taddr6) must be either:
232 * (1) Valid unicast/anycast address for my receiving interface.
233 * (2) Unicast or anycast address for which I'm offering proxy
234 * service.
235 * (3) "tentative" address on which DAD is being performed.
236 */
237 /* (1) and (3) check. */
238 #ifdef CARP
239 if (ifp->if_carp)
240 ifa = carp_iamatch6(ifp->if_carp, &taddr6);
241 if (!ifa)
242 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
243 #else
244 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
245 #endif
246
247 /*
248 * (2) Check proxying. Requires ip6_forwarding to be turned on.
249 *
250 * If the packet is anycast the target route must be on a
251 * different interface because the anycast will get anything
252 * on the current interface.
253 *
254 * If the packet is unicast the target route may be on the
255 * same interface. If the gateway is a (typically manually
256 * configured) link address we can directly offer it.
257 * XXX for now we don't do this but instead offer ours and
258 * presumably relay.
259 *
260 * WARNING! Since this is a subnet proxy the interface proxying
261 * the ND6 must be in promiscuous mode or it will not see the
262 * solicited multicast requests for various hosts being proxied.
263 *
264 * WARNING! Since this is a subnet proxy we have to treat bridge
265 * interfaces as being the bridge itself so we do not proxy-nd6
266 * between bridge interfaces (which are effectively switched).
267 *
268 * (In the specific-host-proxy case via RTF_ANNOUNCE, which is
269 * a bitch to configure, a specific multicast route is already
270 * added for that host <-- NOT RECOMMENDED).
271 */
272 if (!ifa && ip6_forwarding) {
273 struct rtentry *rt;
274 struct sockaddr_in6 tsin6;
275 struct ifnet *rtifp;
276
277 bzero(&tsin6, sizeof tsin6);
278 tsin6.sin6_len = sizeof(struct sockaddr_in6);
279 tsin6.sin6_family = AF_INET6;
280 tsin6.sin6_addr = taddr6;
281
282 rt = rtpurelookup((struct sockaddr *)&tsin6);
283 rtifp = rt ? rt->rt_ifp : NULL;
284 if (rtifp && rtifp->if_bridge)
285 rtifp = rtifp->if_bridge;
286
287 if (rt != NULL && (rt->rt_flags & RTF_ANNOUNCE) &&
288 (cmpifp != rtifp || (m->m_flags & M_MCAST) == 0)) {
289 ifa = (struct ifaddr *)in6ifa_ifpforlinklocal(cmpifp,
290 IN6_IFF_NOTREADY|IN6_IFF_ANYCAST);
291 nd6log((LOG_INFO,
292 "nd6_ns_input: nd6 proxy %s(%s)<-%s ifa %p\n",
293 if_name(cmpifp), if_name(ifp),
294 if_name(rtifp), ifa));
295 if (ifa) {
296 proxy = 1;
297 /*
298 * Manual link address on same interface
299 * w/announce flag will proxy-arp using
300 * target mac, else our mac is used.
301 */
302 if (cmpifp == rtifp &&
303 rt->rt_gateway->sa_family == AF_LINK) {
304 proxydl = SDL(rt->rt_gateway);
305 }
306 }
307 }
308 if (rt != NULL)
309 --rt->rt_refcnt;
310 }
311 if (ifa == NULL) {
312 /*
313 * We've got an NS packet, and we don't have that adddress
314 * assigned for us. We MUST silently ignore it.
315 * See RFC2461 7.2.3.
316 */
317 goto freeit;
318 }
319 myaddr6 = *IFA_IN6(ifa);
320 anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST;
321 tentative = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE;
322 if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED)
323 goto freeit;
324
325 if (lladdr && ((cmpifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
326 nd6log((LOG_INFO, "nd6_ns_input: lladdrlen mismatch for %s "
327 "(if %d, NS packet %d)\n",
328 ip6_sprintf(&taddr6), cmpifp->if_addrlen, lladdrlen - 2));
329 goto bad;
330 }
331
332 if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) {
333 nd6log((LOG_INFO, "nd6_ns_input: duplicate IP6 address %s\n",
334 ip6_sprintf(&saddr6)));
335 goto freeit;
336 }
337
338 /*
339 * We have neighbor solicitation packet, with target address equals to
340 * one of my tentative address.
341 *
342 * src addr how to process?
343 * --- ---
344 * multicast of course, invalid (rejected in ip6_input)
345 * unicast somebody is doing address resolution -> ignore
346 * unspec dup address detection
347 *
348 * The processing is defined in RFC 2462.
349 */
350 if (tentative) {
351 /*
352 * If source address is unspecified address, it is for
353 * duplicated address detection.
354 *
355 * If not, the packet is for addess resolution;
356 * silently ignore it.
357 */
358 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6))
359 nd6_dad_ns_input(ifa);
360
361 goto freeit;
362 }
363
364 /*
365 * If the source address is unspecified address, entries must not
366 * be created or updated.
367 * It looks that sender is performing DAD. Output NA toward
368 * all-node multicast address, to tell the sender that I'm using
369 * the address.
370 * S bit ("solicited") must be zero.
371 */
372 if (IN6_IS_ADDR_UNSPECIFIED(&saddr6)) {
373 saddr6 = kin6addr_linklocal_allnodes;
374 saddr6.s6_addr16[1] = htons(cmpifp->if_index);
375 nd6_na_output(cmpifp, &saddr6, &taddr6,
376 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) |
377 (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0),
378 tlladdr, (struct sockaddr *)proxydl);
379 goto freeit;
380 }
381
382 nd6_cache_lladdr(cmpifp, &saddr6, lladdr, lladdrlen,
383 ND_NEIGHBOR_SOLICIT, 0);
384
385 nd6_na_output(ifp, &saddr6, &taddr6,
386 ((anycast || proxy || !tlladdr) ? 0 : ND_NA_FLAG_OVERRIDE) |
387 (ip6_forwarding ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED,
388 tlladdr, (struct sockaddr *)proxydl);
389 freeit:
390 m_freem(m);
391 return;
392
393 bad:
394 nd6log((LOG_ERR, "nd6_ns_input: src=%s\n", ip6_sprintf(&saddr6)));
395 nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n", ip6_sprintf(&daddr6)));
396 nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n", ip6_sprintf(&taddr6)));
397 icmp6stat.icp6s_badns++;
398 m_freem(m);
399 }
400
401 /*
402 * Output an Neighbor Solicitation Message. Caller specifies:
403 * - ICMP6 header source IP6 address
404 * - ND6 header target IP6 address
405 * - ND6 header source datalink address
406 *
407 * Based on RFC 2461
408 * Based on RFC 2462 (duplicated address detection)
409 */
410 void
nd6_ns_output(struct ifnet * ifp,const struct in6_addr * daddr6,const struct in6_addr * taddr6,struct llinfo_nd6 * ln,int dad)411 nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6,
412 const struct in6_addr *taddr6,
413 struct llinfo_nd6 *ln, /* for source address determination */
414 int dad) /* duplicated address detection */
415 {
416 struct mbuf *m;
417 struct ip6_hdr *ip6;
418 struct nd_neighbor_solicit *nd_ns;
419 struct in6_ifaddr *ia = NULL;
420 struct ip6_moptions im6o;
421 int icmp6len;
422 int maxlen;
423 caddr_t mac;
424 struct ifnet *outif = NULL;
425
426 if (IN6_IS_ADDR_MULTICAST(taddr6))
427 return;
428
429 /* estimate the size of message */
430 maxlen = sizeof(*ip6) + sizeof(*nd_ns);
431 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7;
432 if (max_linkhdr + maxlen > MCLBYTES) {
433 #ifdef DIAGNOSTIC
434 kprintf("nd6_ns_output: max_linkhdr + maxlen > MCLBYTES "
435 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES);
436 #endif
437 return;
438 }
439
440 m = m_getb(max_linkhdr + maxlen, M_NOWAIT, MT_DATA, M_PKTHDR);
441 if (m == NULL)
442 return;
443
444 if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) {
445 m->m_flags |= M_MCAST;
446 im6o.im6o_multicast_ifp = ifp;
447 im6o.im6o_multicast_hlim = 255;
448 im6o.im6o_multicast_loop = 0;
449 }
450
451 icmp6len = sizeof(*nd_ns);
452 m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len;
453 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */
454
455 /* fill neighbor solicitation packet */
456 ip6 = mtod(m, struct ip6_hdr *);
457 ip6->ip6_flow = 0;
458 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
459 ip6->ip6_vfc |= IPV6_VERSION;
460 /* ip6->ip6_plen will be set later */
461 ip6->ip6_nxt = IPPROTO_ICMPV6;
462 ip6->ip6_hlim = 255;
463 if (daddr6)
464 ip6->ip6_dst = *daddr6;
465 else {
466 ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL;
467 ip6->ip6_dst.s6_addr16[1] = htons(ifp->if_index);
468 ip6->ip6_dst.s6_addr32[1] = 0;
469 ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE;
470 ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3];
471 ip6->ip6_dst.s6_addr8[12] = 0xff;
472 }
473 if (!dad) {
474 /*
475 * RFC2461 7.2.2:
476 * "If the source address of the packet prompting the
477 * solicitation is the same as one of the addresses assigned
478 * to the outgoing interface, that address SHOULD be placed
479 * in the IP Source Address of the outgoing solicitation.
480 * Otherwise, any one of the addresses assigned to the
481 * interface should be used."
482 *
483 * We use the source address for the prompting packet
484 * (saddr6), if:
485 * - saddr6 is given from the caller (by giving "ln"), and
486 * - saddr6 belongs to the outgoing interface.
487 * Otherwise, we perform a scope-wise match.
488 */
489 struct ip6_hdr *hip6; /* hold ip6 */
490 struct in6_addr *saddr6;
491
492 if (ln && ln->ln_hold) {
493 hip6 = mtod(ln->ln_hold, struct ip6_hdr *);
494 /* XXX pullup? */
495 if (sizeof(*hip6) < ln->ln_hold->m_len)
496 saddr6 = &hip6->ip6_src;
497 else
498 saddr6 = NULL;
499 } else
500 saddr6 = NULL;
501 if (saddr6 && in6ifa_ifpwithaddr(ifp, saddr6))
502 bcopy(saddr6, &ip6->ip6_src, sizeof(*saddr6));
503 else {
504 ia = in6_ifawithifp(ifp, &ip6->ip6_dst);
505 if (ia == NULL) {
506 m_freem(m);
507 return;
508 }
509 ip6->ip6_src = ia->ia_addr.sin6_addr;
510 }
511 } else {
512 /*
513 * Source address for DAD packet must always be IPv6
514 * unspecified address. (0::0)
515 */
516 bzero(&ip6->ip6_src, sizeof(ip6->ip6_src));
517 }
518 nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1);
519 nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT;
520 nd_ns->nd_ns_code = 0;
521 nd_ns->nd_ns_reserved = 0;
522 nd_ns->nd_ns_target = *taddr6;
523 in6_clearscope(&nd_ns->nd_ns_target); /* XXX */
524
525 /*
526 * Add source link-layer address option.
527 *
528 * spec implementation
529 * --- ---
530 * DAD packet MUST NOT do not add the option
531 * there's no link layer address:
532 * impossible do not add the option
533 * there's link layer address:
534 * Multicast NS MUST add one add the option
535 * Unicast NS SHOULD add one add the option
536 */
537 if (!dad && (mac = nd6_ifptomac(ifp))) {
538 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
539 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1);
540 /* 8 byte alignments... */
541 optlen = (optlen + 7) & ~7;
542
543 m->m_pkthdr.len += optlen;
544 m->m_len += optlen;
545 icmp6len += optlen;
546 bzero((caddr_t)nd_opt, optlen);
547 nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR;
548 nd_opt->nd_opt_len = optlen >> 3;
549 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
550 }
551
552 ip6->ip6_plen = htons((u_short)icmp6len);
553 nd_ns->nd_ns_cksum = 0;
554 nd_ns->nd_ns_cksum =
555 in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len);
556
557 ip6_output(m, NULL, NULL, dad ? IPV6_DADOUTPUT : 0, &im6o, &outif, NULL);
558 if (outif) {
559 icmp6_ifstat_inc(outif, ifs6_out_msg);
560 icmp6_ifstat_inc(outif, ifs6_out_neighborsolicit);
561 }
562 icmp6stat.icp6s_outhist[ND_NEIGHBOR_SOLICIT]++;
563 }
564
565 /*
566 * Neighbor advertisement input handling.
567 *
568 * Based on RFC 2461
569 * Based on RFC 2462 (duplicated address detection)
570 *
571 * the following items are not implemented yet:
572 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
573 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
574 */
575 void
nd6_na_input(struct mbuf * m,int off,int icmp6len)576 nd6_na_input(struct mbuf *m, int off, int icmp6len)
577 {
578 struct ifnet *ifp = m->m_pkthdr.rcvif;
579 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
580 struct nd_neighbor_advert *nd_na;
581 struct in6_addr saddr6 = ip6->ip6_src;
582 struct in6_addr daddr6 = ip6->ip6_dst;
583 struct in6_addr taddr6;
584 int flags;
585 int is_router;
586 int is_solicited;
587 int is_override;
588 char *lladdr = NULL;
589 int lladdrlen = 0;
590 struct ifaddr *ifa;
591 struct llinfo_nd6 *ln;
592 struct rtentry *rt;
593 struct sockaddr_dl *sdl;
594 union nd_opts ndopts;
595
596 if (ip6->ip6_hlim != 255) {
597 nd6log((LOG_ERR,
598 "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n",
599 ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
600 ip6_sprintf(&ip6->ip6_dst), if_name(ifp)));
601 goto bad;
602 }
603
604 #ifndef PULLDOWN_TEST
605 IP6_EXTHDR_CHECK(m, off, icmp6len,);
606 nd_na = (struct nd_neighbor_advert *)((caddr_t)ip6 + off);
607 #else
608 IP6_EXTHDR_GET(nd_na, struct nd_neighbor_advert *, m, off, icmp6len);
609 if (nd_na == NULL) {
610 icmp6stat.icp6s_tooshort++;
611 return;
612 }
613 #endif
614 taddr6 = nd_na->nd_na_target;
615 flags = nd_na->nd_na_flags_reserved;
616 is_router = ((flags & ND_NA_FLAG_ROUTER) != 0);
617 is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0);
618 is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0);
619
620 if (IN6_IS_SCOPE_LINKLOCAL(&taddr6))
621 taddr6.s6_addr16[1] = htons(ifp->if_index);
622
623 if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
624 nd6log((LOG_ERR,
625 "nd6_na_input: invalid target address %s\n",
626 ip6_sprintf(&taddr6)));
627 goto bad;
628 }
629 if (IN6_IS_ADDR_MULTICAST(&daddr6))
630 if (is_solicited) {
631 nd6log((LOG_ERR,
632 "nd6_na_input: a solicited adv is multicasted\n"));
633 goto bad;
634 }
635
636 icmp6len -= sizeof(*nd_na);
637 nd6_option_init(nd_na + 1, icmp6len, &ndopts);
638 if (nd6_options(&ndopts) < 0) {
639 nd6log((LOG_INFO,
640 "nd6_na_input: invalid ND option, ignored\n"));
641 /* nd6_options have incremented stats */
642 goto freeit;
643 }
644
645 if (ndopts.nd_opts_tgt_lladdr) {
646 struct ifnet *ifp_ll;
647
648 lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
649 lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
650
651 if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
652 nd6log((LOG_INFO, "nd6_na_input: lladdrlen mismatch "
653 "for %s (if %d, NA packet %d)\n", ip6_sprintf(&taddr6),
654 ifp->if_addrlen, lladdrlen - 2));
655 goto bad;
656 }
657
658 /* If it's from me, ignore it. */
659 ifp_ll = if_bylla(lladdr, ifp->if_addrlen);
660 if (ifp_ll != NULL)
661 goto freeit;
662 }
663
664 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
665
666 /*
667 * Target address matches one of my interface address.
668 *
669 * If my address is tentative, this means that there's somebody
670 * already using the same address as mine. This indicates DAD failure.
671 * This is defined in RFC 2462.
672 *
673 * Otherwise, process as defined in RFC 2461.
674 */
675 if (ifa
676 && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) {
677 nd6_dad_na_input(ifa);
678 goto freeit;
679 }
680
681 /* Just for safety, maybe unnecessary. */
682 if (ifa) {
683 log(LOG_ERR,
684 "nd6_na_input: duplicate IP6 address %s\n",
685 ip6_sprintf(&taddr6));
686 goto freeit;
687 }
688
689 if (!nd6_onlink_ns_rfc4861) {
690 /*
691 * Make sure the source address is from a neighbor's address.
692 */
693 struct sockaddr_in6 src_sa6;
694
695 bzero(&src_sa6, sizeof(src_sa6));
696 src_sa6.sin6_family = AF_INET6;
697 src_sa6.sin6_len = sizeof(src_sa6);
698 src_sa6.sin6_addr = saddr6;
699 if (nd6_is_addr_neighbor(&src_sa6, ifp) == 0) {
700 nd6log((LOG_INFO, "nd6_na_input: "
701 "NA packet from non-neighbor\n"));
702 goto bad;
703 }
704 }
705
706 /*
707 * If no neighbor cache entry is found, NA SHOULD silently be discarded.
708 */
709 rt = nd6_lookup(&taddr6, 0, ifp);
710 if ((rt == NULL) ||
711 ((ln = (struct llinfo_nd6 *)rt->rt_llinfo) == NULL) ||
712 ((sdl = SDL(rt->rt_gateway)) == NULL))
713 goto freeit;
714
715 if (ln->ln_state <= ND6_LLINFO_INCOMPLETE) {
716 /*
717 * If the link-layer has address, and no lladdr option came,
718 * discard the packet.
719 */
720 if (ifp->if_addrlen && !lladdr)
721 goto freeit;
722
723 /*
724 * Record link-layer address, and update the state.
725 */
726 sdl->sdl_alen = ifp->if_addrlen;
727 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
728 if (is_solicited) {
729 ln->ln_state = ND6_LLINFO_REACHABLE;
730 ln->ln_byhint = 0;
731 if (ln->ln_expire) {
732 ln->ln_expire = time_uptime +
733 ND_IFINFO(rt->rt_ifp)->reachable;
734 }
735 } else {
736 ln->ln_state = ND6_LLINFO_STALE;
737 ln->ln_expire = time_uptime + nd6_gctimer;
738 }
739 if ((ln->ln_router = is_router) != 0) {
740 /*
741 * This means a router's state has changed from
742 * non-reachable to probably reachable, and might
743 * affect the status of associated prefixes..
744 */
745 pfxlist_onlink_check();
746 }
747 } else {
748 int llchange;
749
750 /*
751 * Check if the link-layer address has changed or not.
752 */
753 if (!lladdr)
754 llchange = 0;
755 else {
756 if (sdl->sdl_alen) {
757 if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen))
758 llchange = 1;
759 else
760 llchange = 0;
761 } else
762 llchange = 1;
763 }
764
765 /*
766 * This is VERY complex. Look at it with care.
767 *
768 * override solicit lladdr llchange action
769 * (L: record lladdr)
770 *
771 * 0 0 n -- (2c)
772 * 0 0 y n (2b) L
773 * 0 0 y y (1) REACHABLE->STALE
774 * 0 1 n -- (2c) *->REACHABLE
775 * 0 1 y n (2b) L *->REACHABLE
776 * 0 1 y y (1) REACHABLE->STALE
777 * 1 0 n -- (2a)
778 * 1 0 y n (2a) L
779 * 1 0 y y (2a) L *->STALE
780 * 1 1 n -- (2a) *->REACHABLE
781 * 1 1 y n (2a) L *->REACHABLE
782 * 1 1 y y (2a) L *->REACHABLE
783 */
784 if (!is_override && (lladdr && llchange)) { /* (1) */
785 /*
786 * If state is REACHABLE, make it STALE.
787 * no other updates should be done.
788 */
789 if (ln->ln_state == ND6_LLINFO_REACHABLE) {
790 ln->ln_state = ND6_LLINFO_STALE;
791 ln->ln_expire = time_uptime + nd6_gctimer;
792 }
793 goto freeit;
794 } else if (is_override /* (2a) */
795 || (lladdr && !llchange) /* (2b) */
796 || !lladdr) { /* (2c) */
797 /*
798 * Update link-local address, if any.
799 */
800 if (lladdr) {
801 sdl->sdl_alen = ifp->if_addrlen;
802 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
803 }
804
805 /*
806 * If solicited, make the state REACHABLE.
807 * If not solicited and the link-layer address was
808 * changed, make it STALE.
809 */
810 if (is_solicited) {
811 ln->ln_state = ND6_LLINFO_REACHABLE;
812 ln->ln_byhint = 0;
813 if (ln->ln_expire) {
814 ln->ln_expire = time_uptime +
815 ND_IFINFO(ifp)->reachable;
816 }
817 } else {
818 if (lladdr && llchange) {
819 ln->ln_state = ND6_LLINFO_STALE;
820 ln->ln_expire = time_uptime + nd6_gctimer;
821 }
822 }
823 }
824
825 if (ln->ln_router && !is_router) {
826 /*
827 * The peer dropped the router flag.
828 * Remove the sender from the Default Router List and
829 * update the Destination Cache entries.
830 */
831 struct nd_defrouter *dr;
832 struct in6_addr *in6;
833
834 in6 = &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr;
835
836 /*
837 * Lock to protect the default router list.
838 * XXX: this might be unnecessary, since this function
839 * is only called under the network software interrupt
840 * context. However, we keep it just for safety.
841 */
842 mtx_lock(&nd6_mtx);
843 dr = defrouter_lookup(in6, rt->rt_ifp);
844 if (dr)
845 defrtrlist_del(dr);
846 mtx_unlock(&nd6_mtx);
847
848 if (dr == NULL && !ip6_forwarding &&
849 (ND_IFINFO(rt->rt_ifp)->flags &
850 ND6_IFF_ACCEPT_RTADV) != 0) {
851 /*
852 * Even if the neighbor is not in the default
853 * router list, the neighbor may be used
854 * as a next hop for some destinations
855 * (e.g. redirect case). So we must
856 * call rt6_flush explicitly.
857 */
858 rt6_flush(&ip6->ip6_src, rt->rt_ifp);
859 }
860 }
861 ln->ln_router = is_router;
862 }
863 rt->rt_flags &= ~RTF_REJECT;
864 ln->ln_asked = 0;
865 if (ln->ln_hold) {
866 /*
867 * we assume ifp is not a loopback here, so just set the 2nd
868 * argument as the 1st one.
869 */
870 nd6_output(ifp, ifp, ln->ln_hold,
871 (struct sockaddr_in6 *)rt_key(rt), rt);
872 ln->ln_hold = NULL;
873 }
874
875 freeit:
876 m_freem(m);
877 return;
878
879 bad:
880 icmp6stat.icp6s_badna++;
881 m_freem(m);
882 }
883
884 /*
885 * Neighbor advertisement output handling.
886 *
887 * Based on RFC 2461
888 *
889 * the following items are not implemented yet:
890 * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD)
891 * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD)
892 */
893 void
nd6_na_output(struct ifnet * ifp,const struct in6_addr * daddr6,const struct in6_addr * taddr6,u_long flags,int tlladdr,struct sockaddr * sdl0)894 nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6,
895 const struct in6_addr *taddr6, u_long flags,
896 int tlladdr, /* 1 if include target link-layer address */
897 struct sockaddr *sdl0) /* sockaddr_dl (= proxy NA) or NULL */
898 {
899 struct mbuf *m;
900 struct ip6_hdr *ip6;
901 struct nd_neighbor_advert *nd_na;
902 struct in6_ifaddr *ia = NULL;
903 struct ip6_moptions im6o;
904 int icmp6len;
905 int maxlen;
906 caddr_t mac;
907 struct ifnet *outif = NULL;
908
909 /* estimate the size of message */
910 maxlen = sizeof(*ip6) + sizeof(*nd_na);
911 maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7;
912 if (max_linkhdr + maxlen > MCLBYTES) {
913 #ifdef DIAGNOSTIC
914 kprintf("nd6_na_output: max_linkhdr + maxlen > MCLBYTES "
915 "(%d + %d > %d)\n", max_linkhdr, maxlen, MCLBYTES);
916 #endif
917 return;
918 }
919
920 m = m_getb(max_linkhdr + maxlen, M_NOWAIT, MT_DATA, M_PKTHDR);
921 if (m == NULL)
922 return;
923
924 if (IN6_IS_ADDR_MULTICAST(daddr6)) {
925 m->m_flags |= M_MCAST;
926 im6o.im6o_multicast_ifp = ifp;
927 im6o.im6o_multicast_hlim = 255;
928 im6o.im6o_multicast_loop = 0;
929 }
930
931 icmp6len = sizeof(*nd_na);
932 m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len;
933 m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */
934
935 /* fill neighbor advertisement packet */
936 ip6 = mtod(m, struct ip6_hdr *);
937 ip6->ip6_flow = 0;
938 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
939 ip6->ip6_vfc |= IPV6_VERSION;
940 ip6->ip6_nxt = IPPROTO_ICMPV6;
941 ip6->ip6_hlim = 255;
942 if (IN6_IS_ADDR_UNSPECIFIED(daddr6)) {
943 /* reply to DAD */
944 ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL;
945 ip6->ip6_dst.s6_addr16[1] = htons(ifp->if_index);
946 ip6->ip6_dst.s6_addr32[1] = 0;
947 ip6->ip6_dst.s6_addr32[2] = 0;
948 ip6->ip6_dst.s6_addr32[3] = IPV6_ADDR_INT32_ONE;
949 flags &= ~ND_NA_FLAG_SOLICITED;
950 } else
951 ip6->ip6_dst = *daddr6;
952
953 /*
954 * Select a source whose scope is the same as that of the dest.
955 */
956 ia = in6_ifawithifp(ifp, &ip6->ip6_dst);
957 if (ia == NULL) {
958 m_freem(m);
959 return;
960 }
961 ip6->ip6_src = ia->ia_addr.sin6_addr;
962 nd_na = (struct nd_neighbor_advert *)(ip6 + 1);
963 nd_na->nd_na_type = ND_NEIGHBOR_ADVERT;
964 nd_na->nd_na_code = 0;
965 nd_na->nd_na_target = *taddr6;
966 in6_clearscope(&nd_na->nd_na_target); /* XXX */
967
968 /*
969 * "tlladdr" indicates NS's condition for adding tlladdr or not.
970 * see nd6_ns_input() for details.
971 * Basically, if NS packet is sent to unicast/anycast addr,
972 * target lladdr option SHOULD NOT be included.
973 */
974 mac = NULL;
975 if (tlladdr) {
976 /*
977 * sdl0 != NULL indicates proxy NA. If we do proxy, use
978 * lladdr in sdl0. If we are not proxying (sending NA for
979 * my address) use lladdr configured for the interface.
980 */
981 if (sdl0 == NULL) {
982 #ifdef CARP
983 if (ifp->if_carp)
984 mac = carp_macmatch6(ifp->if_carp, m, taddr6);
985 if (mac == NULL)
986 mac = nd6_ifptomac(ifp);
987 #else
988 mac = nd6_ifptomac(ifp);
989 #endif
990 } else if (sdl0->sa_family == AF_LINK) {
991 struct sockaddr_dl *sdl;
992 sdl = (struct sockaddr_dl *)sdl0;
993 if (sdl->sdl_alen == ifp->if_addrlen)
994 mac = LLADDR(sdl);
995 }
996 }
997 if (mac != NULL) {
998 int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
999 struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1);
1000
1001 /* roundup to 8 bytes alignment! */
1002 optlen = (optlen + 7) & ~7;
1003
1004 m->m_pkthdr.len += optlen;
1005 m->m_len += optlen;
1006 icmp6len += optlen;
1007 bzero((caddr_t)nd_opt, optlen);
1008 nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
1009 nd_opt->nd_opt_len = optlen >> 3;
1010 bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
1011 } else
1012 flags &= ~ND_NA_FLAG_OVERRIDE;
1013
1014 ip6->ip6_plen = htons((u_short)icmp6len);
1015 nd_na->nd_na_flags_reserved = flags;
1016 nd_na->nd_na_cksum = 0;
1017 nd_na->nd_na_cksum =
1018 in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len);
1019
1020 ip6_output(m, NULL, NULL, 0, &im6o, &outif, NULL);
1021 if (outif) {
1022 icmp6_ifstat_inc(outif, ifs6_out_msg);
1023 icmp6_ifstat_inc(outif, ifs6_out_neighboradvert);
1024 }
1025 icmp6stat.icp6s_outhist[ND_NEIGHBOR_ADVERT]++;
1026 }
1027
1028 caddr_t
nd6_ifptomac(struct ifnet * ifp)1029 nd6_ifptomac(struct ifnet *ifp)
1030 {
1031 switch (ifp->if_type) {
1032 case IFT_ETHER:
1033 case IFT_IEEE1394:
1034 #ifdef IFT_L2VLAN
1035 case IFT_L2VLAN:
1036 #endif
1037 #ifdef IFT_IEEE80211
1038 case IFT_IEEE80211:
1039 #endif
1040 #ifdef IFT_CARP
1041 case IFT_CARP:
1042 #endif
1043 return ((caddr_t)(ifp + 1));
1044 default:
1045 return NULL;
1046 }
1047 }
1048
1049 struct netmsg_dad {
1050 struct netmsg_base base;
1051 struct dadq *dadq;
1052 };
1053
1054 struct dadq {
1055 TAILQ_ENTRY(dadq) dad_list;
1056 struct ifaddr *dad_ifa;
1057 int dad_count; /* max NS to send */
1058 int dad_ns_tcount; /* # of trials to send NS */
1059 int dad_ns_ocount; /* NS sent so far */
1060 int dad_ns_icount;
1061 int dad_na_icount;
1062 struct callout dad_timer_ch;
1063 struct netmsg_dad dad_nmsg;
1064 };
1065 TAILQ_HEAD(dadq_head, dadq);
1066
1067 static struct dadq_head dadq = TAILQ_HEAD_INITIALIZER(dadq);
1068
1069 static struct dadq *
nd6_dad_find(struct ifaddr * ifa)1070 nd6_dad_find(struct ifaddr *ifa)
1071 {
1072 struct dadq *dp;
1073
1074 ASSERT_NETISR0;
1075
1076 TAILQ_FOREACH(dp, &dadq, dad_list) {
1077 if (dp->dad_ifa == ifa)
1078 return dp;
1079 }
1080 return NULL;
1081 }
1082
1083 static void
nd6_dad_starttimer(struct dadq * dp,int ticks)1084 nd6_dad_starttimer(struct dadq *dp, int ticks)
1085 {
1086 ASSERT_NETISR0;
1087 callout_reset(&dp->dad_timer_ch, ticks, nd6_dad_timer, dp);
1088 }
1089
1090 static void
nd6_dad_stoptimer(struct dadq * dp)1091 nd6_dad_stoptimer(struct dadq *dp)
1092 {
1093 ASSERT_NETISR0;
1094 callout_stop(&dp->dad_timer_ch);
1095 }
1096
1097 /*
1098 * Start Duplicated Address Detection (DAD) for specified interface address.
1099 */
1100 void
nd6_dad_start(struct ifaddr * ifa,int * tick)1101 nd6_dad_start(struct ifaddr *ifa,
1102 int *tick) /* minimum delay ticks for IFF_UP event */
1103 {
1104 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1105 struct dadq *dp;
1106
1107 ASSERT_NETISR0;
1108
1109 /*
1110 * If we don't need DAD, don't do it.
1111 * There are several cases:
1112 * - DAD is disabled globally (ip6_dad_count == 0) or on the interface
1113 * - the interface address is anycast
1114 */
1115 if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) {
1116 log(LOG_DEBUG,
1117 "nd6_dad_start: called with non-tentative address "
1118 "%s(%s)\n",
1119 ip6_sprintf(&ia->ia_addr.sin6_addr),
1120 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1121 return;
1122 }
1123 if ((ia->ia6_flags & IN6_IFF_ANYCAST) ||
1124 ip6_dad_count == 0 ||
1125 (ND_IFINFO(ifa->ifa_ifp)->flags & ND6_IFF_NO_DAD)) {
1126 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1127 in6_newaddrmsg(ifa);
1128 return;
1129 }
1130 if (!(ifa->ifa_ifp->if_flags & IFF_UP))
1131 return;
1132 if (nd6_dad_find(ifa) != NULL) {
1133 /* DAD already in progress */
1134 return;
1135 }
1136
1137 dp = nd6_dad_create(ifa);
1138 nd6log((LOG_DEBUG, "%s: starting DAD for %s\n", if_name(ifa->ifa_ifp),
1139 ip6_sprintf(&ia->ia_addr.sin6_addr)));
1140
1141 /*
1142 * Send NS packet for DAD, dp->dad_count times.
1143 * Note that we must delay the first transmission, if this is the
1144 * first packet to be sent from the interface after interface
1145 * (re)initialization.
1146 */
1147 if (tick == NULL) {
1148 nd6_dad_ns_output(dp);
1149 nd6_dad_starttimer(dp,
1150 ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000);
1151 } else {
1152 int ntick;
1153
1154 if (*tick == 0)
1155 ntick = krandom() % (MAX_RTR_SOLICITATION_DELAY * hz);
1156 else
1157 ntick = *tick + krandom() % (hz / 2);
1158 *tick = ntick;
1159 nd6_dad_starttimer(dp, ntick);
1160 }
1161 }
1162
1163 /*
1164 * Terminate DAD unconditionally. Used for address removals.
1165 */
1166 void
nd6_dad_stop(struct ifaddr * ifa)1167 nd6_dad_stop(struct ifaddr *ifa)
1168 {
1169 struct dadq *dp;
1170
1171 ASSERT_NETISR0;
1172
1173 dp = nd6_dad_find(ifa);
1174 if (!dp) {
1175 /* DAD wasn't started yet */
1176 return;
1177 }
1178 nd6_dad_destroy(dp);
1179 }
1180
1181 static struct dadq *
nd6_dad_create(struct ifaddr * ifa)1182 nd6_dad_create(struct ifaddr *ifa)
1183 {
1184 struct netmsg_dad *dm;
1185 struct dadq *dp;
1186
1187 ASSERT_NETISR0;
1188
1189 dp = kmalloc(sizeof(*dp), M_IP6NDP, M_INTWAIT | M_ZERO);
1190 callout_init_mp(&dp->dad_timer_ch);
1191
1192 dm = &dp->dad_nmsg;
1193 netmsg_init(&dm->base, NULL, &netisr_adone_rport,
1194 MSGF_DROPABLE | MSGF_PRIORITY, nd6_dad_timer_handler);
1195 dm->dadq = dp;
1196
1197 dp->dad_ifa = ifa;
1198 IFAREF(ifa); /* just for safety */
1199
1200 /* Send NS packet for DAD, ip6_dad_count times. */
1201 dp->dad_count = ip6_dad_count;
1202
1203 TAILQ_INSERT_TAIL(&dadq, dp, dad_list);
1204
1205 return dp;
1206 }
1207
1208 static void
nd6_dad_destroy(struct dadq * dp)1209 nd6_dad_destroy(struct dadq *dp)
1210 {
1211 struct lwkt_msg *lmsg = &dp->dad_nmsg.base.lmsg;
1212
1213 ASSERT_NETISR0;
1214
1215 TAILQ_REMOVE(&dadq, dp, dad_list);
1216
1217 nd6_dad_stoptimer(dp);
1218
1219 crit_enter();
1220 if ((lmsg->ms_flags & MSGF_DONE) == 0)
1221 lwkt_dropmsg(lmsg);
1222 crit_exit();
1223
1224 IFAFREE(dp->dad_ifa);
1225 kfree(dp, M_IP6NDP);
1226 }
1227
1228 static void
nd6_dad_timer(void * xdp)1229 nd6_dad_timer(void *xdp)
1230 {
1231 struct dadq *dp = xdp;
1232 struct lwkt_msg *lmsg = &dp->dad_nmsg.base.lmsg;
1233
1234 KASSERT(mycpuid == 0, ("dad timer not on cpu0"));
1235
1236 crit_enter();
1237 if (lmsg->ms_flags & MSGF_DONE)
1238 lwkt_sendmsg_oncpu(netisr_cpuport(0), lmsg);
1239 crit_exit();
1240 }
1241
1242 static void
nd6_dad_timer_handler(netmsg_t msg)1243 nd6_dad_timer_handler(netmsg_t msg)
1244 {
1245 struct netmsg_dad *dm = (struct netmsg_dad *)msg;
1246 struct dadq *dp = dm->dadq;
1247 struct ifaddr *ifa = dp->dad_ifa;
1248 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1249
1250 ASSERT_NETISR0;
1251
1252 /* Reply ASAP */
1253 crit_enter();
1254 lwkt_replymsg(&dm->base.lmsg, 0);
1255 crit_exit();
1256
1257 if (ia->ia6_flags & IN6_IFF_DUPLICATED) {
1258 log(LOG_ERR, "nd6_dad_timer: called with duplicated address "
1259 "%s(%s)\n",
1260 ip6_sprintf(&ia->ia_addr.sin6_addr),
1261 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1262 goto destroy;
1263 }
1264 if (!(ia->ia6_flags & IN6_IFF_TENTATIVE)) {
1265 log(LOG_ERR, "nd6_dad_timer: called with non-tentative address "
1266 "%s(%s)\n",
1267 ip6_sprintf(&ia->ia_addr.sin6_addr),
1268 ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");
1269 goto destroy;
1270 }
1271
1272 /* Timed out with IFF_{RUNNING,UP} check */
1273 if (dp->dad_ns_tcount > dad_maxtry) {
1274 nd6log((LOG_INFO, "%s: could not run DAD, driver problem?\n",
1275 if_name(ifa->ifa_ifp)));
1276 goto destroy;
1277 }
1278
1279 /* Need more checks? */
1280 if (dp->dad_ns_ocount < dp->dad_count) {
1281 /*
1282 * We have more NS to go. Send NS packet for DAD.
1283 */
1284 nd6_dad_ns_output(dp);
1285 nd6_dad_starttimer(dp,
1286 ND_IFINFO(ifa->ifa_ifp)->retrans * hz / 1000);
1287 } else {
1288 /*
1289 * We have transmitted sufficient number of DAD packets.
1290 * See what we've got.
1291 */
1292 int duplicate;
1293
1294 duplicate = 0;
1295
1296 if (dp->dad_na_icount) {
1297 /*
1298 * the check is in nd6_dad_na_input(),
1299 * but just in case
1300 */
1301 duplicate++;
1302 }
1303
1304 if (dp->dad_ns_icount) {
1305 #if 0 /* heuristics */
1306 /*
1307 * if
1308 * - we have sent many(?) DAD NS, and
1309 * - the number of NS we sent equals to the
1310 * number of NS we've got, and
1311 * - we've got no NA
1312 * we may have a faulty network card/driver which
1313 * loops back multicasts to myself.
1314 */
1315 if (3 < dp->dad_count
1316 && dp->dad_ns_icount == dp->dad_count
1317 && dp->dad_na_icount == 0) {
1318 log(LOG_INFO, "DAD questionable for %s(%s): "
1319 "network card loops back multicast?\n",
1320 ip6_sprintf(&ia->ia_addr.sin6_addr),
1321 if_name(ifa->ifa_ifp));
1322 /* XXX consider it a duplicate or not? */
1323 /* duplicate++; */
1324 } else {
1325 /* We've seen NS, means DAD has failed. */
1326 duplicate++;
1327 }
1328 #else
1329 /* We've seen NS, means DAD has failed. */
1330 duplicate++;
1331 #endif
1332 }
1333
1334 if (duplicate) {
1335 /* dp will be freed in nd6_dad_duplicated() */
1336 dp = NULL;
1337 nd6_dad_duplicated(ifa);
1338 } else {
1339 /*
1340 * We are done with DAD. No NA came, no NS came.
1341 * duplicated address found.
1342 */
1343 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1344 in6_newaddrmsg(ifa);
1345 nd6log((LOG_DEBUG,
1346 "%s: DAD complete for %s - no duplicates found\n",
1347 if_name(ifa->ifa_ifp),
1348 ip6_sprintf(&ia->ia_addr.sin6_addr)));
1349 goto destroy;
1350 }
1351 }
1352 return;
1353 destroy:
1354 nd6_dad_destroy(dp);
1355 }
1356
1357 static void
nd6_dad_duplicated(struct ifaddr * ifa)1358 nd6_dad_duplicated(struct ifaddr *ifa)
1359 {
1360 struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
1361 struct dadq *dp;
1362
1363 ASSERT_NETISR0;
1364
1365 dp = nd6_dad_find(ifa);
1366 if (dp == NULL) {
1367 log(LOG_ERR, "nd6_dad_duplicated: DAD structure not found\n");
1368 return;
1369 }
1370
1371 /*
1372 * We are done with DAD, with duplicated address found. (failure)
1373 */
1374 log(LOG_ERR, "%s: DAD detected duplicate IPv6 address %s: "
1375 "NS in/out=%d/%d, NA in=%d\n",
1376 if_name(ifa->ifa_ifp), ip6_sprintf(&ia->ia_addr.sin6_addr),
1377 dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_na_icount);
1378
1379 ia->ia6_flags &= ~IN6_IFF_TENTATIVE;
1380 ia->ia6_flags |= IN6_IFF_DUPLICATED;
1381 in6_newaddrmsg(ifa);
1382
1383 log(LOG_ERR, "%s: DAD complete for %s - duplicate found\n",
1384 if_name(ifa->ifa_ifp), ip6_sprintf(&ia->ia_addr.sin6_addr));
1385 log(LOG_ERR, "%s: manual intervention required\n",
1386 if_name(ifa->ifa_ifp));
1387
1388 nd6_dad_destroy(dp);
1389 }
1390
1391 static void
nd6_dad_ns_output(struct dadq * dp)1392 nd6_dad_ns_output(struct dadq *dp)
1393 {
1394 struct in6_ifaddr *ia = (struct in6_ifaddr *)dp->dad_ifa;
1395 struct ifnet *ifp = dp->dad_ifa->ifa_ifp;
1396
1397 ASSERT_NETISR0;
1398
1399 dp->dad_ns_tcount++;
1400 if (!(ifp->if_flags & IFF_UP)) {
1401 #if 0
1402 kprintf("%s: interface down?\n", if_name(ifp));
1403 #endif
1404 return;
1405 }
1406 if (!(ifp->if_flags & IFF_RUNNING)) {
1407 #if 0
1408 kprintf("%s: interface not running?\n", if_name(ifp));
1409 #endif
1410 return;
1411 }
1412
1413 dp->dad_ns_ocount++;
1414 nd6_ns_output(ifp, NULL, &ia->ia_addr.sin6_addr, NULL, 1);
1415 }
1416
1417 static void
nd6_dad_ns_input(struct ifaddr * ifa)1418 nd6_dad_ns_input(struct ifaddr *ifa)
1419 {
1420 struct in6_ifaddr *ia;
1421 const struct in6_addr *taddr6;
1422 struct dadq *dp;
1423 int duplicate;
1424
1425 ASSERT_NETISR0;
1426
1427 if (!ifa)
1428 panic("ifa == NULL in nd6_dad_ns_input");
1429
1430 ia = (struct in6_ifaddr *)ifa;
1431 taddr6 = &ia->ia_addr.sin6_addr;
1432 duplicate = 0;
1433 dp = nd6_dad_find(ifa);
1434
1435 /* Quickhack - completely ignore DAD NS packets */
1436 if (dad_ignore_ns) {
1437 nd6log((LOG_INFO,
1438 "nd6_dad_ns_input: ignoring DAD NS packet for "
1439 "address %s(%s)\n", ip6_sprintf(taddr6),
1440 if_name(ifa->ifa_ifp)));
1441 return;
1442 }
1443
1444 /*
1445 * if I'm yet to start DAD, someone else started using this address
1446 * first. I have a duplicate and you win.
1447 */
1448 if (!dp || dp->dad_ns_ocount == 0)
1449 duplicate++;
1450
1451 /* XXX more checks for loopback situation - see nd6_dad_timer too */
1452
1453 if (duplicate) {
1454 dp = NULL; /* will be freed in nd6_dad_duplicated() */
1455 nd6_dad_duplicated(ifa);
1456 } else {
1457 /*
1458 * not sure if I got a duplicate.
1459 * increment ns count and see what happens.
1460 */
1461 if (dp)
1462 dp->dad_ns_icount++;
1463 }
1464 }
1465
1466 static void
nd6_dad_na_input(struct ifaddr * ifa)1467 nd6_dad_na_input(struct ifaddr *ifa)
1468 {
1469 struct dadq *dp;
1470
1471 ASSERT_NETISR0;
1472
1473 if (!ifa)
1474 panic("ifa == NULL in nd6_dad_na_input");
1475
1476 dp = nd6_dad_find(ifa);
1477 if (dp)
1478 dp->dad_na_icount++;
1479
1480 /* remove the address. */
1481 nd6_dad_duplicated(ifa);
1482 }
1483