1 | /* |
2 | * Copyright (c) 2000-2018 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* |
30 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
31 | * All rights reserved. |
32 | * |
33 | * Redistribution and use in source and binary forms, with or without |
34 | * modification, are permitted provided that the following conditions |
35 | * are met: |
36 | * 1. Redistributions of source code must retain the above copyright |
37 | * notice, this list of conditions and the following disclaimer. |
38 | * 2. Redistributions in binary form must reproduce the above copyright |
39 | * notice, this list of conditions and the following disclaimer in the |
40 | * documentation and/or other materials provided with the distribution. |
41 | * 3. Neither the name of the project nor the names of its contributors |
42 | * may be used to endorse or promote products derived from this software |
43 | * without specific prior written permission. |
44 | * |
45 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
46 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
47 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
48 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
49 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
50 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
51 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
52 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
53 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
54 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
55 | * SUCH DAMAGE. |
56 | */ |
57 | |
58 | #include <sys/param.h> |
59 | #include <sys/systm.h> |
60 | #include <sys/malloc.h> |
61 | #include <sys/mbuf.h> |
62 | #include <sys/socket.h> |
63 | #include <sys/sockio.h> |
64 | #include <sys/time.h> |
65 | #include <sys/kernel.h> |
66 | #include <sys/errno.h> |
67 | #include <sys/syslog.h> |
68 | #include <sys/sysctl.h> |
69 | #include <sys/mcache.h> |
70 | #include <sys/protosw.h> |
71 | #include <kern/queue.h> |
72 | #include <dev/random/randomdev.h> |
73 | |
74 | #include <kern/locks.h> |
75 | #include <kern/zalloc.h> |
76 | |
77 | #include <net/if.h> |
78 | #include <net/if_var.h> |
79 | #include <net/if_types.h> |
80 | #include <net/if_dl.h> |
81 | #include <net/if_llreach.h> |
82 | #include <net/route.h> |
83 | #include <net/dlil.h> |
84 | #include <net/nwk_wq.h> |
85 | |
86 | #include <netinet/in.h> |
87 | #include <netinet/in_var.h> |
88 | #include <netinet6/in6_var.h> |
89 | #include <netinet6/in6_ifattach.h> |
90 | #include <netinet/ip6.h> |
91 | #include <netinet6/ip6_var.h> |
92 | #include <netinet6/nd6.h> |
93 | #include <netinet6/scope6_var.h> |
94 | #include <netinet/icmp6.h> |
95 | |
96 | #if IPSEC |
97 | #include <netinet6/ipsec.h> |
98 | #if INET6 |
99 | #include <netinet6/ipsec6.h> |
100 | #endif |
101 | #endif |
102 | |
103 | struct dadq; |
104 | static struct dadq *nd6_dad_find(struct ifaddr *, struct nd_opt_nonce *); |
105 | void nd6_dad_stoptimer(struct ifaddr *); |
106 | static void nd6_dad_timer(struct ifaddr *); |
107 | static void nd6_dad_ns_output(struct dadq *, struct ifaddr *); |
108 | static void nd6_dad_ns_input(struct ifaddr *, char *, int, struct nd_opt_nonce *); |
109 | static struct mbuf *nd6_dad_na_input(struct mbuf *, struct ifnet *, |
110 | struct in6_addr *, caddr_t, int); |
111 | static void dad_addref(struct dadq *, int); |
112 | static void dad_remref(struct dadq *); |
113 | static struct dadq *nd6_dad_attach(struct dadq *, struct ifaddr *); |
114 | static void nd6_dad_detach(struct dadq *, struct ifaddr *); |
115 | |
116 | static int dad_maxtry = 15; /* max # of *tries* to transmit DAD packet */ |
117 | |
118 | static unsigned int dad_size; /* size of zone element */ |
119 | static struct zone *dad_zone; /* zone for dadq */ |
120 | |
121 | #define DAD_ZONE_MAX 64 /* maximum elements in zone */ |
122 | #define DAD_ZONE_NAME "nd6_dad" /* zone name */ |
123 | |
124 | #define DAD_LOCK_ASSERT_HELD(_dp) \ |
125 | LCK_MTX_ASSERT(&(_dp)->dad_lock, LCK_MTX_ASSERT_OWNED) |
126 | |
127 | #define DAD_LOCK_ASSERT_NOTHELD(_dp) \ |
128 | LCK_MTX_ASSERT(&(_dp)->dad_lock, LCK_MTX_ASSERT_NOTOWNED) |
129 | |
130 | #define DAD_LOCK(_dp) \ |
131 | lck_mtx_lock(&(_dp)->dad_lock) |
132 | |
133 | #define DAD_LOCK_SPIN(_dp) \ |
134 | lck_mtx_lock_spin(&(_dp)->dad_lock) |
135 | |
136 | #define DAD_CONVERT_LOCK(_dp) do { \ |
137 | DAD_LOCK_ASSERT_HELD(_dp); \ |
138 | lck_mtx_convert_spin(&(_dp)->dad_lock); \ |
139 | } while (0) |
140 | |
141 | #define DAD_UNLOCK(_dp) \ |
142 | lck_mtx_unlock(&(_dp)->dad_lock) |
143 | |
144 | #define DAD_ADDREF(_dp) \ |
145 | dad_addref(_dp, 0) |
146 | |
147 | #define DAD_ADDREF_LOCKED(_dp) \ |
148 | dad_addref(_dp, 1) |
149 | |
150 | #define DAD_REMREF(_dp) \ |
151 | dad_remref(_dp) |
152 | |
153 | extern lck_mtx_t *dad6_mutex; |
154 | extern lck_mtx_t *nd6_mutex; |
155 | |
156 | static int nd6_llreach_base = 30; /* seconds */ |
157 | |
158 | static struct sockaddr_in6 hostrtmask; |
159 | |
160 | SYSCTL_DECL(_net_inet6_icmp6); |
161 | SYSCTL_INT(_net_inet6_icmp6, OID_AUTO, nd6_llreach_base, |
162 | CTLFLAG_RW | CTLFLAG_LOCKED, &nd6_llreach_base, 0, |
163 | "default ND6 link-layer reachability max lifetime (in seconds)" ); |
164 | |
165 | int dad_enhanced = 1; |
166 | SYSCTL_DECL(_net_inet6_ip6); |
167 | SYSCTL_INT(_net_inet6_ip6, OID_AUTO, dad_enhanced, CTLFLAG_RW | CTLFLAG_LOCKED, |
168 | &dad_enhanced, 0, |
169 | "Enable Enhanced DAD, which adds a random nonce to NS messages for DAD." ); |
170 | |
171 | /* |
172 | * Obtain a link-layer source cache entry for the sender. |
173 | * |
174 | * NOTE: This is currently only for ND6/Ethernet. |
175 | */ |
176 | void |
177 | nd6_llreach_alloc(struct rtentry *rt, struct ifnet *ifp, void *addr, |
178 | unsigned int alen, boolean_t solicited) |
179 | { |
180 | struct llinfo_nd6 *ln = rt->rt_llinfo; |
181 | |
182 | if (nd6_llreach_base != 0 && |
183 | (ln->ln_expire != 0 || (ifp->if_eflags & IFEF_IPV6_ND6ALT) != 0) && |
184 | !(rt->rt_ifp->if_flags & IFF_LOOPBACK) && |
185 | ifp->if_addrlen == IF_LLREACH_MAXLEN && /* Ethernet */ |
186 | alen == ifp->if_addrlen) { |
187 | struct if_llreach *lr; |
188 | const char *why = NULL, *type = "" ; |
189 | |
190 | /* Become a regular mutex, just in case */ |
191 | RT_CONVERT_LOCK(rt); |
192 | |
193 | if ((lr = ln->ln_llreach) != NULL) { |
194 | type = (solicited ? "ND6 advertisement" : |
195 | "ND6 unsolicited announcement" ); |
196 | /* |
197 | * If target has changed, create a new record; |
198 | * otherwise keep existing record. |
199 | */ |
200 | IFLR_LOCK(lr); |
201 | if (bcmp(addr, lr->lr_key.addr, alen) != 0) { |
202 | IFLR_UNLOCK(lr); |
203 | /* Purge any link-layer info caching */ |
204 | VERIFY(rt->rt_llinfo_purge != NULL); |
205 | rt->rt_llinfo_purge(rt); |
206 | lr = NULL; |
207 | why = " for different target HW address; " |
208 | "using new llreach record" ; |
209 | } else { |
210 | lr->lr_probes = 0; /* reset probe count */ |
211 | IFLR_UNLOCK(lr); |
212 | if (solicited) { |
213 | why = " for same target HW address; " |
214 | "keeping existing llreach record" ; |
215 | } |
216 | } |
217 | } |
218 | |
219 | if (lr == NULL) { |
220 | lr = ln->ln_llreach = ifnet_llreach_alloc(ifp, |
221 | ETHERTYPE_IPV6, addr, alen, nd6_llreach_base); |
222 | if (lr != NULL) { |
223 | lr->lr_probes = 0; /* reset probe count */ |
224 | if (why == NULL) |
225 | why = "creating new llreach record" ; |
226 | } |
227 | } |
228 | |
229 | if (nd6_debug && lr != NULL && why != NULL) { |
230 | char tmp[MAX_IPv6_STR_LEN]; |
231 | |
232 | nd6log((LOG_DEBUG, "%s: %s%s for %s\n" , if_name(ifp), |
233 | type, why, inet_ntop(AF_INET6, |
234 | &SIN6(rt_key(rt))->sin6_addr, tmp, sizeof (tmp)))); |
235 | } |
236 | } |
237 | } |
238 | |
239 | void |
240 | nd6_llreach_use(struct llinfo_nd6 *ln) |
241 | { |
242 | if (ln->ln_llreach != NULL) |
243 | ln->ln_lastused = net_uptime(); |
244 | } |
245 | |
246 | /* |
247 | * Input a Neighbor Solicitation Message. |
248 | * |
249 | * Based on RFC 4861 |
250 | * Based on RFC 4862 (duplicate address detection) |
251 | */ |
252 | void |
253 | nd6_ns_input( |
254 | struct mbuf *m, |
255 | int off, |
256 | int icmp6len) |
257 | { |
258 | struct ifnet *ifp = m->m_pkthdr.rcvif; |
259 | struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); |
260 | struct nd_neighbor_solicit *nd_ns; |
261 | struct in6_addr saddr6 = ip6->ip6_src; |
262 | struct in6_addr daddr6 = ip6->ip6_dst; |
263 | struct in6_addr taddr6; |
264 | struct in6_addr myaddr6; |
265 | char *lladdr = NULL; |
266 | struct ifaddr *ifa = NULL; |
267 | int lladdrlen = 0; |
268 | int anycast = 0, proxy = 0, dadprogress = 0; |
269 | int tlladdr; |
270 | union nd_opts ndopts; |
271 | struct sockaddr_dl proxydl; |
272 | boolean_t advrouter; |
273 | boolean_t is_dad_probe; |
274 | int oflgclr = 0; |
275 | |
276 | /* Expect 32-bit aligned data pointer on strict-align platforms */ |
277 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); |
278 | |
279 | IP6_EXTHDR_CHECK(m, off, icmp6len, return); |
280 | nd_ns = (struct nd_neighbor_solicit *)((caddr_t)ip6 + off); |
281 | m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE; |
282 | |
283 | ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */ |
284 | taddr6 = nd_ns->nd_ns_target; |
285 | if (in6_setscope(&taddr6, ifp, NULL) != 0) |
286 | goto bad; |
287 | |
288 | if (ip6->ip6_hlim != IPV6_MAXHLIM) { |
289 | nd6log((LOG_ERR, |
290 | "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n" , |
291 | ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src), |
292 | ip6_sprintf(&ip6->ip6_dst), if_name(ifp))); |
293 | goto bad; |
294 | } |
295 | |
296 | is_dad_probe = IN6_IS_ADDR_UNSPECIFIED(&saddr6); |
297 | if (is_dad_probe) { |
298 | /* dst has to be a solicited node multicast address. */ |
299 | if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL && |
300 | /* don't check ifindex portion */ |
301 | daddr6.s6_addr32[1] == 0 && |
302 | daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE && |
303 | daddr6.s6_addr8[12] == 0xff) { |
304 | ; /* good */ |
305 | } else { |
306 | nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet " |
307 | "(wrong ip6 dst)\n" )); |
308 | goto bad; |
309 | } |
310 | } else if (!nd6_onlink_ns_rfc4861) { |
311 | struct sockaddr_in6 src_sa6; |
312 | |
313 | /* |
314 | * According to recent IETF discussions, it is not a good idea |
315 | * to accept a NS from an address which would not be deemed |
316 | * to be a neighbor otherwise. This point is expected to be |
317 | * clarified in future revisions of the specification. |
318 | */ |
319 | bzero(&src_sa6, sizeof(src_sa6)); |
320 | src_sa6.sin6_family = AF_INET6; |
321 | src_sa6.sin6_len = sizeof(src_sa6); |
322 | src_sa6.sin6_addr = saddr6; |
323 | if (!nd6_is_addr_neighbor(&src_sa6, ifp, 0)) { |
324 | nd6log((LOG_INFO, "nd6_ns_input: " |
325 | "NS packet from non-neighbor\n" )); |
326 | goto bad; |
327 | } |
328 | } |
329 | |
330 | if (IN6_IS_ADDR_MULTICAST(&taddr6)) { |
331 | nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n" )); |
332 | goto bad; |
333 | } |
334 | |
335 | icmp6len -= sizeof(*nd_ns); |
336 | nd6_option_init(nd_ns + 1, icmp6len, &ndopts); |
337 | if (nd6_options(&ndopts) < 0) { |
338 | nd6log((LOG_INFO, |
339 | "nd6_ns_input: invalid ND option, ignored\n" )); |
340 | /* nd6_options have incremented stats */ |
341 | goto freeit; |
342 | } |
343 | |
344 | if (ndopts.nd_opts_src_lladdr) { |
345 | lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1); |
346 | lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3; |
347 | } |
348 | |
349 | if (is_dad_probe && lladdr) { |
350 | nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet " |
351 | "(link-layer address option)\n" )); |
352 | goto bad; |
353 | } |
354 | |
355 | /* |
356 | * Attaching target link-layer address to the NA? |
357 | * (RFC 2461 7.2.4) |
358 | * |
359 | * NS IP dst is unicast/anycast MUST NOT add |
360 | * NS IP dst is solicited-node multicast MUST add |
361 | * |
362 | * In implementation, we add target link-layer address by default. |
363 | * We do not add one in MUST NOT cases. |
364 | */ |
365 | if (!IN6_IS_ADDR_MULTICAST(&daddr6)) |
366 | tlladdr = 0; |
367 | else |
368 | tlladdr = 1; |
369 | |
370 | /* |
371 | * Target address (taddr6) must be either: |
372 | * (1) Valid unicast/anycast address for my receiving interface, |
373 | * (2) Unicast address for which I'm offering proxy service, or |
374 | * (3) "tentative" or "optimistic" address [DAD is in progress]. |
375 | */ |
376 | /* (1) and (3) check. */ |
377 | ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); |
378 | |
379 | /* (2) check. */ |
380 | if (ifa == NULL) { |
381 | struct rtentry *rt; |
382 | struct sockaddr_in6 tsin6; |
383 | |
384 | bzero(&tsin6, sizeof tsin6); |
385 | tsin6.sin6_len = sizeof(struct sockaddr_in6); |
386 | tsin6.sin6_family = AF_INET6; |
387 | tsin6.sin6_addr = taddr6; |
388 | |
389 | rt = rtalloc1_scoped((struct sockaddr *)&tsin6, 0, 0, |
390 | ifp->if_index); |
391 | |
392 | if (rt != NULL) { |
393 | RT_LOCK(rt); |
394 | if ((rt->rt_flags & RTF_ANNOUNCE) != 0 && |
395 | rt->rt_gateway->sa_family == AF_LINK) { |
396 | /* |
397 | * proxy NDP for single entry |
398 | */ |
399 | ifa = (struct ifaddr *)in6ifa_ifpforlinklocal( |
400 | ifp, IN6_IFF_NOTREADY|IN6_IFF_ANYCAST); |
401 | if (ifa) { |
402 | proxy = 1; |
403 | proxydl = *SDL(rt->rt_gateway); |
404 | } |
405 | } |
406 | RT_UNLOCK(rt); |
407 | rtfree(rt); |
408 | } |
409 | } |
410 | if (ifa == NULL && ip6_forwarding && nd6_prproxy) { |
411 | /* |
412 | * Is the target address part of the prefix that is being |
413 | * proxied and installed on another interface? |
414 | */ |
415 | ifa = (struct ifaddr *)in6ifa_prproxyaddr(&taddr6); |
416 | } |
417 | if (ifa == NULL) { |
418 | /* |
419 | * We've got an NS packet, and we don't have that address |
420 | * assigned for us. We MUST silently ignore it on this |
421 | * interface, c.f. RFC 4861 7.2.3. |
422 | * |
423 | * Forwarding associated with NDPRF_PRPROXY may apply. |
424 | */ |
425 | if (ip6_forwarding && nd6_prproxy) |
426 | nd6_prproxy_ns_input(ifp, &saddr6, lladdr, |
427 | lladdrlen, &daddr6, &taddr6, |
428 | (ndopts.nd_opts_nonce == NULL) ? NULL : |
429 | ndopts.nd_opts_nonce->nd_opt_nonce); |
430 | goto freeit; |
431 | } |
432 | IFA_LOCK(ifa); |
433 | myaddr6 = *IFA_IN6(ifa); |
434 | anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST; |
435 | dadprogress = |
436 | ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DADPROGRESS; |
437 | if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED) { |
438 | IFA_UNLOCK(ifa); |
439 | goto freeit; |
440 | } |
441 | IFA_UNLOCK(ifa); |
442 | |
443 | if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { |
444 | nd6log((LOG_INFO, |
445 | "nd6_ns_input: lladdrlen mismatch for %s " |
446 | "(if %d, NS packet %d)\n" , |
447 | ip6_sprintf(&taddr6), ifp->if_addrlen, lladdrlen - 2)); |
448 | goto bad; |
449 | } |
450 | |
451 | if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) { |
452 | nd6log((LOG_INFO, |
453 | "nd6_ns_input: duplicate IP6 address %s\n" , |
454 | ip6_sprintf(&saddr6))); |
455 | goto freeit; |
456 | } |
457 | |
458 | /* |
459 | * We have neighbor solicitation packet, with target address equals to |
460 | * one of my DAD in-progress addresses. |
461 | * |
462 | * src addr how to process? |
463 | * --- --- |
464 | * multicast of course, invalid (rejected in ip6_input) |
465 | * unicast somebody is doing address resolution |
466 | * unspec dup address detection |
467 | * |
468 | * The processing is defined in the "draft standard" RFC 4862 (and by |
469 | * RFC 4429, which is a "proposed standard" update to its obsolete |
470 | * predecessor, RFC 2462) The reason optimistic DAD is not included |
471 | * in RFC 4862 is entirely due to IETF procedural considerations. |
472 | */ |
473 | if (dadprogress) { |
474 | /* |
475 | * If source address is unspecified address, it is for |
476 | * duplicate address detection. |
477 | * |
478 | * If not, the packet is for addess resolution; |
479 | * silently ignore it when not optimistic |
480 | * |
481 | * Per RFC 4429 the reply for an optimistic address must |
482 | * have the Override flag cleared |
483 | */ |
484 | if (!is_dad_probe && (dadprogress & IN6_IFF_OPTIMISTIC) != 0) { |
485 | oflgclr = 1; |
486 | } else { |
487 | if (is_dad_probe) |
488 | nd6_dad_ns_input(ifa, lladdr, lladdrlen, ndopts.nd_opts_nonce); |
489 | |
490 | goto freeit; |
491 | } |
492 | } |
493 | |
494 | /* Are we an advertising router on this interface? */ |
495 | advrouter = (ifp->if_eflags & IFEF_IPV6_ROUTER); |
496 | |
497 | /* |
498 | * If the source address is unspecified address, entries must not |
499 | * be created or updated. |
500 | * It looks that sender is performing DAD. If I'm using the address, |
501 | * and it's a "preferred" address, i.e. not optimistic, then output NA |
502 | * toward all-node multicast address, to tell the sender that I'm using |
503 | * the address. |
504 | * S bit ("solicited") must be zero. |
505 | */ |
506 | if (is_dad_probe) { |
507 | saddr6 = in6addr_linklocal_allnodes; |
508 | if (in6_setscope(&saddr6, ifp, NULL) != 0) |
509 | goto bad; |
510 | if ((dadprogress & IN6_IFF_OPTIMISTIC) == 0) |
511 | nd6_na_output(ifp, &saddr6, &taddr6, |
512 | ((anycast || proxy || !tlladdr) ? 0 : |
513 | ND_NA_FLAG_OVERRIDE) | (advrouter ? |
514 | ND_NA_FLAG_ROUTER : 0), tlladdr, proxy ? |
515 | (struct sockaddr *)&proxydl : NULL); |
516 | goto freeit; |
517 | } |
518 | |
519 | nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, |
520 | ND_NEIGHBOR_SOLICIT, 0); |
521 | |
522 | nd6_na_output(ifp, &saddr6, &taddr6, |
523 | ((anycast || proxy || !tlladdr || oflgclr) ? 0 : ND_NA_FLAG_OVERRIDE) | |
524 | (advrouter ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED, |
525 | tlladdr, proxy ? (struct sockaddr *)&proxydl : NULL); |
526 | freeit: |
527 | m_freem(m); |
528 | if (ifa != NULL) |
529 | IFA_REMREF(ifa); |
530 | return; |
531 | |
532 | bad: |
533 | nd6log((LOG_ERR, "nd6_ns_input: src=%s\n" , ip6_sprintf(&saddr6))); |
534 | nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n" , ip6_sprintf(&daddr6))); |
535 | nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n" , ip6_sprintf(&taddr6))); |
536 | icmp6stat.icp6s_badns++; |
537 | m_freem(m); |
538 | if (ifa != NULL) |
539 | IFA_REMREF(ifa); |
540 | } |
541 | |
542 | /* |
543 | * Output a Neighbor Solicitation Message. Caller specifies: |
544 | * - ICMP6 header source IP6 address |
545 | * - ND6 header target IP6 address |
546 | * - ND6 header source datalink address |
547 | * |
548 | * Based on RFC 4861 |
549 | * Based on RFC 4862 (duplicate address detection) |
550 | * Based on RFC 4429 (optimistic duplicate address detection) |
551 | * |
552 | * Caller must bump up ln->ln_rt refcnt to make sure 'ln' doesn't go |
553 | * away if there is a llinfo_nd6 passed in. |
554 | */ |
555 | void |
556 | nd6_ns_output( |
557 | struct ifnet *ifp, |
558 | const struct in6_addr *daddr6, |
559 | const struct in6_addr *taddr6, |
560 | struct llinfo_nd6 *ln, /* for source address determination */ |
561 | uint8_t *nonce) /* duplicated address detection */ |
562 | { |
563 | struct mbuf *m; |
564 | struct ip6_hdr *ip6; |
565 | struct nd_neighbor_solicit *nd_ns; |
566 | struct in6_ifaddr *ia = NULL; |
567 | struct in6_addr *src, src_in, src_storage; |
568 | struct ip6_moptions *im6o = NULL; |
569 | struct ifnet *outif = NULL; |
570 | int icmp6len; |
571 | int maxlen; |
572 | int flags; |
573 | caddr_t mac; |
574 | struct route_in6 ro; |
575 | struct ip6_out_args ip6oa; |
576 | u_int32_t rtflags = 0; |
577 | |
578 | if ((ifp->if_eflags & IFEF_IPV6_ND6ALT) || IN6_IS_ADDR_MULTICAST(taddr6)) |
579 | return; |
580 | |
581 | bzero(&ro, sizeof(ro)); |
582 | bzero(&ip6oa, sizeof(ip6oa)); |
583 | ip6oa.ip6oa_boundif = ifp->if_index; |
584 | ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR | |
585 | IP6OAF_AWDL_UNRESTRICTED | IP6OAF_INTCOPROC_ALLOWED; |
586 | ip6oa.ip6oa_sotc = SO_TC_UNSPEC; |
587 | ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC; |
588 | |
589 | ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF; |
590 | |
591 | /* estimate the size of message */ |
592 | maxlen = sizeof(*ip6) + sizeof(*nd_ns); |
593 | maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; |
594 | if (max_linkhdr + maxlen >= MCLBYTES) { |
595 | #if DIAGNOSTIC |
596 | printf("nd6_ns_output: max_linkhdr + maxlen >= MCLBYTES " |
597 | "(%d + %d > %d)\n" , max_linkhdr, maxlen, MCLBYTES); |
598 | #endif |
599 | return; |
600 | } |
601 | |
602 | MGETHDR(m, M_DONTWAIT, MT_DATA); /* XXXMAC: mac_create_mbuf_linklayer() probably */ |
603 | if (m && max_linkhdr + maxlen >= MHLEN) { |
604 | MCLGET(m, M_DONTWAIT); |
605 | if ((m->m_flags & M_EXT) == 0) { |
606 | m_free(m); |
607 | m = NULL; |
608 | } |
609 | } |
610 | if (m == NULL) |
611 | return; |
612 | m->m_pkthdr.rcvif = NULL; |
613 | |
614 | if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) { |
615 | m->m_flags |= M_MCAST; |
616 | |
617 | im6o = ip6_allocmoptions(M_DONTWAIT); |
618 | if (im6o == NULL) { |
619 | m_freem(m); |
620 | return; |
621 | } |
622 | |
623 | im6o->im6o_multicast_ifp = ifp; |
624 | im6o->im6o_multicast_hlim = IPV6_MAXHLIM; |
625 | im6o->im6o_multicast_loop = 0; |
626 | } |
627 | |
628 | icmp6len = sizeof(*nd_ns); |
629 | m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len; |
630 | m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ |
631 | |
632 | /* fill neighbor solicitation packet */ |
633 | ip6 = mtod(m, struct ip6_hdr *); |
634 | ip6->ip6_flow = 0; |
635 | ip6->ip6_vfc &= ~IPV6_VERSION_MASK; |
636 | ip6->ip6_vfc |= IPV6_VERSION; |
637 | /* ip6->ip6_plen will be set later */ |
638 | ip6->ip6_nxt = IPPROTO_ICMPV6; |
639 | ip6->ip6_hlim = IPV6_MAXHLIM; |
640 | if (daddr6) |
641 | ip6->ip6_dst = *daddr6; |
642 | else { |
643 | ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL; |
644 | ip6->ip6_dst.s6_addr16[1] = 0; |
645 | ip6->ip6_dst.s6_addr32[1] = 0; |
646 | ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE; |
647 | ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3]; |
648 | ip6->ip6_dst.s6_addr8[12] = 0xff; |
649 | if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0) |
650 | goto bad; |
651 | } |
652 | if (nonce == NULL) { |
653 | /* |
654 | * RFC2461 7.2.2: |
655 | * "If the source address of the packet prompting the |
656 | * solicitation is the same as one of the addresses assigned |
657 | * to the outgoing interface, that address SHOULD be placed |
658 | * in the IP Source Address of the outgoing solicitation. |
659 | * Otherwise, any one of the addresses assigned to the |
660 | * interface should be used." |
661 | * |
662 | * We use the source address for the prompting packet |
663 | * (saddr6), if: |
664 | * - saddr6 is given from the caller (by giving "ln"), and |
665 | * - saddr6 belongs to the outgoing interface. |
666 | * Otherwise, we perform the source address selection as usual. |
667 | */ |
668 | struct ip6_hdr *hip6; /* hold ip6 */ |
669 | struct in6_addr *hsrc = NULL; |
670 | |
671 | /* Caller holds ref on this route */ |
672 | if (ln != NULL) { |
673 | RT_LOCK(ln->ln_rt); |
674 | /* |
675 | * assuming every packet in ln_hold has the same IP |
676 | * header |
677 | */ |
678 | if (ln->ln_hold != NULL) { |
679 | hip6 = mtod(ln->ln_hold, struct ip6_hdr *); |
680 | /* XXX pullup? */ |
681 | if (sizeof (*hip6) < ln->ln_hold->m_len) |
682 | hsrc = &hip6->ip6_src; |
683 | else |
684 | hsrc = NULL; |
685 | } |
686 | /* Update probe count, if applicable */ |
687 | if (ln->ln_llreach != NULL) { |
688 | IFLR_LOCK_SPIN(ln->ln_llreach); |
689 | ln->ln_llreach->lr_probes++; |
690 | IFLR_UNLOCK(ln->ln_llreach); |
691 | } |
692 | rtflags = ln->ln_rt->rt_flags; |
693 | RT_UNLOCK(ln->ln_rt); |
694 | } |
695 | if (hsrc != NULL && (ia = in6ifa_ifpwithaddr(ifp, hsrc)) && |
696 | (ia->ia6_flags & IN6_IFF_OPTIMISTIC) == 0) { |
697 | src = hsrc; |
698 | } else { |
699 | int error; |
700 | struct sockaddr_in6 dst_sa; |
701 | |
702 | bzero(&dst_sa, sizeof(dst_sa)); |
703 | dst_sa.sin6_family = AF_INET6; |
704 | dst_sa.sin6_len = sizeof(dst_sa); |
705 | dst_sa.sin6_addr = ip6->ip6_dst; |
706 | |
707 | src = in6_selectsrc(&dst_sa, NULL, |
708 | NULL, &ro, NULL, &src_storage, ip6oa.ip6oa_boundif, |
709 | &error); |
710 | if (src == NULL) { |
711 | nd6log((LOG_DEBUG, |
712 | "nd6_ns_output: source can't be " |
713 | "determined: dst=%s, error=%d\n" , |
714 | ip6_sprintf(&dst_sa.sin6_addr), |
715 | error)); |
716 | goto bad; |
717 | } |
718 | |
719 | if (ia != NULL) { |
720 | IFA_REMREF(&ia->ia_ifa); |
721 | ia = NULL; |
722 | } |
723 | /* |
724 | * RFC 4429 section 3.2: |
725 | * When a node has a unicast packet to send |
726 | * from an Optimistic Address to a neighbor, |
727 | * but does not know the neighbor's link-layer |
728 | * address, it MUST NOT perform Address |
729 | * Resolution. |
730 | */ |
731 | ia = in6ifa_ifpwithaddr(ifp, src); |
732 | if (!ia || (ia->ia6_flags & IN6_IFF_OPTIMISTIC)) { |
733 | nd6log((LOG_DEBUG, |
734 | "nd6_ns_output: no preferred source " |
735 | "available: dst=%s\n" , |
736 | ip6_sprintf(&dst_sa.sin6_addr))); |
737 | goto bad; |
738 | } |
739 | } |
740 | } else { |
741 | /* |
742 | * Source address for DAD packet must always be IPv6 |
743 | * unspecified address. (0::0) |
744 | * We actually don't have to 0-clear the address (we did it |
745 | * above), but we do so here explicitly to make the intention |
746 | * clearer. |
747 | */ |
748 | bzero(&src_in, sizeof(src_in)); |
749 | src = &src_in; |
750 | ip6oa.ip6oa_flags &= ~IP6OAF_BOUND_SRCADDR; |
751 | } |
752 | ip6->ip6_src = *src; |
753 | nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1); |
754 | nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT; |
755 | nd_ns->nd_ns_code = 0; |
756 | nd_ns->nd_ns_reserved = 0; |
757 | nd_ns->nd_ns_target = *taddr6; |
758 | in6_clearscope(&nd_ns->nd_ns_target); /* XXX */ |
759 | |
760 | /* |
761 | * Add source link-layer address option. |
762 | * |
763 | * spec implementation |
764 | * --- --- |
765 | * DAD packet MUST NOT do not add the option |
766 | * there's no link layer address: |
767 | * impossible do not add the option |
768 | * there's link layer address: |
769 | * Multicast NS MUST add one add the option |
770 | * Unicast NS SHOULD add one add the option |
771 | */ |
772 | if (nonce == NULL && (mac = nd6_ifptomac(ifp))) { |
773 | int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; |
774 | struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1); |
775 | /* 8 byte alignments... */ |
776 | optlen = (optlen + 7) & ~7; |
777 | |
778 | m->m_pkthdr.len += optlen; |
779 | m->m_len += optlen; |
780 | icmp6len += optlen; |
781 | bzero((caddr_t)nd_opt, optlen); |
782 | nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR; |
783 | nd_opt->nd_opt_len = optlen >> 3; |
784 | bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen); |
785 | } |
786 | /* |
787 | * Add a Nonce option (RFC 3971) to detect looped back NS messages. |
788 | * This behavior is documented as Enhanced Duplicate Address |
789 | * Detection in draft-ietf-6man-enhanced-dad-13. |
790 | * net.inet6.ip6.dad_enhanced=0 disables this. |
791 | */ |
792 | if (dad_enhanced != 0 && nonce != NULL && !(ifp->if_flags & IFF_POINTOPOINT)) { |
793 | int optlen = sizeof(struct nd_opt_hdr) + ND_OPT_NONCE_LEN; |
794 | struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1); |
795 | /* 8-byte alignment is required. */ |
796 | optlen = (optlen + 7) & ~7; |
797 | |
798 | m->m_pkthdr.len += optlen; |
799 | m->m_len += optlen; |
800 | icmp6len += optlen; |
801 | bzero((caddr_t)nd_opt, optlen); |
802 | nd_opt->nd_opt_type = ND_OPT_NONCE; |
803 | nd_opt->nd_opt_len = optlen >> 3; |
804 | bcopy(nonce, (caddr_t)(nd_opt + 1), ND_OPT_NONCE_LEN); |
805 | } |
806 | ip6->ip6_plen = htons((u_short)icmp6len); |
807 | nd_ns->nd_ns_cksum = 0; |
808 | nd_ns->nd_ns_cksum |
809 | = in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len); |
810 | |
811 | flags = nonce ? IPV6_UNSPECSRC : 0; |
812 | flags |= IPV6_OUTARGS; |
813 | |
814 | /* |
815 | * PKTF_{INET,INET6}_RESOLVE_RTR are mutually exclusive, so make |
816 | * sure only one of them is set (just in case.) |
817 | */ |
818 | m->m_pkthdr.pkt_flags &= ~(PKTF_INET_RESOLVE | PKTF_RESOLVE_RTR); |
819 | m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE; |
820 | /* |
821 | * If this is a NS for resolving the (default) router, mark |
822 | * the packet accordingly so that the driver can find out, |
823 | * in case it needs to perform driver-specific action(s). |
824 | */ |
825 | if (rtflags & RTF_ROUTER) |
826 | m->m_pkthdr.pkt_flags |= PKTF_RESOLVE_RTR; |
827 | |
828 | if (ifp->if_eflags & IFEF_TXSTART) { |
829 | /* |
830 | * Use control service class if the interface |
831 | * supports transmit-start model |
832 | */ |
833 | (void) m_set_service_class(m, MBUF_SC_CTL); |
834 | } |
835 | |
836 | ip6_output(m, NULL, NULL, flags, im6o, &outif, &ip6oa); |
837 | if (outif) { |
838 | icmp6_ifstat_inc(outif, ifs6_out_msg); |
839 | icmp6_ifstat_inc(outif, ifs6_out_neighborsolicit); |
840 | ifnet_release(outif); |
841 | } |
842 | icmp6stat.icp6s_outhist[ND_NEIGHBOR_SOLICIT]++; |
843 | |
844 | exit: |
845 | if (im6o != NULL) |
846 | IM6O_REMREF(im6o); |
847 | |
848 | ROUTE_RELEASE(&ro); /* we don't cache this route. */ |
849 | |
850 | if (ia != NULL) |
851 | IFA_REMREF(&ia->ia_ifa); |
852 | return; |
853 | |
854 | bad: |
855 | m_freem(m); |
856 | goto exit; |
857 | } |
858 | |
859 | /* |
860 | * Neighbor advertisement input handling. |
861 | * |
862 | * Based on RFC 4861 |
863 | * Based on RFC 4862 (duplicate address detection) |
864 | * |
865 | * the following items are not implemented yet: |
866 | * - anycast advertisement delay rule (RFC 4861 7.2.7, SHOULD) |
867 | * - proxy advertisement delay rule (RFC 4861 7.2.8, last paragraph, "should") |
868 | */ |
869 | void |
870 | nd6_na_input(struct mbuf *m, int off, int icmp6len) |
871 | { |
872 | struct ifnet *ifp = m->m_pkthdr.rcvif; |
873 | struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); |
874 | struct nd_neighbor_advert *nd_na; |
875 | struct in6_addr saddr6 = ip6->ip6_src; |
876 | struct in6_addr daddr6 = ip6->ip6_dst; |
877 | struct in6_addr taddr6; |
878 | int flags; |
879 | int is_router; |
880 | int is_solicited; |
881 | int is_override; |
882 | char *lladdr = NULL; |
883 | int lladdrlen = 0; |
884 | struct llinfo_nd6 *ln; |
885 | struct rtentry *rt; |
886 | struct sockaddr_dl *sdl; |
887 | union nd_opts ndopts; |
888 | uint64_t timenow; |
889 | bool send_nc_alive_kev = false; |
890 | |
891 | if ((ifp->if_eflags & IFEF_IPV6_ND6ALT) != 0) { |
892 | nd6log((LOG_INFO, "nd6_na_input: on ND6ALT interface!\n" )); |
893 | return; |
894 | } |
895 | |
896 | /* Expect 32-bit aligned data pointer on strict-align platforms */ |
897 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); |
898 | |
899 | if (ip6->ip6_hlim != IPV6_MAXHLIM) { |
900 | nd6log((LOG_ERR, |
901 | "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n" , |
902 | ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src), |
903 | ip6_sprintf(&ip6->ip6_dst), if_name(ifp))); |
904 | goto bad; |
905 | } |
906 | |
907 | IP6_EXTHDR_CHECK(m, off, icmp6len, return); |
908 | nd_na = (struct nd_neighbor_advert *)((caddr_t)ip6 + off); |
909 | m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE; |
910 | |
911 | flags = nd_na->nd_na_flags_reserved; |
912 | is_router = ((flags & ND_NA_FLAG_ROUTER) != 0); |
913 | is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0); |
914 | is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0); |
915 | |
916 | taddr6 = nd_na->nd_na_target; |
917 | if (in6_setscope(&taddr6, ifp, NULL)) |
918 | goto bad; /* XXX: impossible */ |
919 | |
920 | if (IN6_IS_ADDR_MULTICAST(&taddr6)) { |
921 | nd6log((LOG_ERR, |
922 | "nd6_na_input: invalid target address %s\n" , |
923 | ip6_sprintf(&taddr6))); |
924 | goto bad; |
925 | } |
926 | if (IN6_IS_ADDR_MULTICAST(&daddr6)) |
927 | if (is_solicited) { |
928 | nd6log((LOG_ERR, |
929 | "nd6_na_input: a solicited adv is multicasted\n" )); |
930 | goto bad; |
931 | } |
932 | |
933 | icmp6len -= sizeof(*nd_na); |
934 | nd6_option_init(nd_na + 1, icmp6len, &ndopts); |
935 | if (nd6_options(&ndopts) < 0) { |
936 | nd6log((LOG_INFO, |
937 | "nd6_na_input: invalid ND option, ignored\n" )); |
938 | /* nd6_options have incremented stats */ |
939 | goto freeit; |
940 | } |
941 | |
942 | if (ndopts.nd_opts_tgt_lladdr) { |
943 | lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1); |
944 | lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3; |
945 | |
946 | if (((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { |
947 | nd6log((LOG_INFO, |
948 | "nd6_na_input: lladdrlen mismatch for %s " |
949 | "(if %d, NA packet %d)\n" , |
950 | ip6_sprintf(&taddr6), ifp->if_addrlen, |
951 | lladdrlen - 2)); |
952 | goto bad; |
953 | } |
954 | } |
955 | |
956 | m = nd6_dad_na_input(m, ifp, &taddr6, lladdr, lladdrlen); |
957 | if (m == NULL) |
958 | return; |
959 | |
960 | /* Forwarding associated with NDPRF_PRPROXY may apply. */ |
961 | if (ip6_forwarding && nd6_prproxy) |
962 | nd6_prproxy_na_input(ifp, &saddr6, &daddr6, &taddr6, flags); |
963 | |
964 | /* |
965 | * If no neighbor cache entry is found, NA SHOULD silently be |
966 | * discarded. If we are forwarding (and Scoped Routing is in |
967 | * effect), try to see if there is a neighbor cache entry on |
968 | * another interface (in case we are doing prefix proxying.) |
969 | */ |
970 | if ((rt = nd6_lookup(&taddr6, 0, ifp, 0)) == NULL) { |
971 | if (!ip6_forwarding || !nd6_prproxy) |
972 | goto freeit; |
973 | |
974 | if ((rt = nd6_lookup(&taddr6, 0, NULL, 0)) == NULL) |
975 | goto freeit; |
976 | |
977 | RT_LOCK_ASSERT_HELD(rt); |
978 | if (rt->rt_ifp != ifp) { |
979 | /* |
980 | * Purge any link-layer info caching. |
981 | */ |
982 | if (rt->rt_llinfo_purge != NULL) |
983 | rt->rt_llinfo_purge(rt); |
984 | |
985 | /* Adjust route ref count for the interfaces */ |
986 | if (rt->rt_if_ref_fn != NULL) { |
987 | rt->rt_if_ref_fn(ifp, 1); |
988 | rt->rt_if_ref_fn(rt->rt_ifp, -1); |
989 | } |
990 | |
991 | /* Change the interface when the existing route is on */ |
992 | rt->rt_ifp = ifp; |
993 | |
994 | /* |
995 | * If rmx_mtu is not locked, update it |
996 | * to the MTU used by the new interface. |
997 | */ |
998 | if (!(rt->rt_rmx.rmx_locks & RTV_MTU)) |
999 | rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu; |
1000 | } |
1001 | } |
1002 | |
1003 | RT_LOCK_ASSERT_HELD(rt); |
1004 | if ((ln = rt->rt_llinfo) == NULL || |
1005 | (sdl = SDL(rt->rt_gateway)) == NULL) { |
1006 | RT_REMREF_LOCKED(rt); |
1007 | RT_UNLOCK(rt); |
1008 | goto freeit; |
1009 | } |
1010 | |
1011 | timenow = net_uptime(); |
1012 | |
1013 | if (ln->ln_state == ND6_LLINFO_INCOMPLETE) { |
1014 | /* |
1015 | * If the link-layer has address, and no lladdr option came, |
1016 | * discard the packet. |
1017 | */ |
1018 | if (ifp->if_addrlen && !lladdr) { |
1019 | RT_REMREF_LOCKED(rt); |
1020 | RT_UNLOCK(rt); |
1021 | goto freeit; |
1022 | } |
1023 | |
1024 | /* |
1025 | * Record link-layer address, and update the state. |
1026 | */ |
1027 | sdl->sdl_alen = ifp->if_addrlen; |
1028 | bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); |
1029 | if (is_solicited) { |
1030 | send_nc_alive_kev = (rt->rt_flags & RTF_ROUTER) ? true : false; |
1031 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_REACHABLE); |
1032 | if (ln->ln_expire != 0) { |
1033 | struct nd_ifinfo *ndi = NULL; |
1034 | |
1035 | ndi = ND_IFINFO(rt->rt_ifp); |
1036 | VERIFY(ndi != NULL && ndi->initialized); |
1037 | lck_mtx_lock(&ndi->lock); |
1038 | ln_setexpire(ln, timenow + ndi->reachable); |
1039 | lck_mtx_unlock(&ndi->lock); |
1040 | RT_UNLOCK(rt); |
1041 | lck_mtx_lock(rnh_lock); |
1042 | nd6_sched_timeout(NULL, NULL); |
1043 | lck_mtx_unlock(rnh_lock); |
1044 | RT_LOCK(rt); |
1045 | } |
1046 | } else { |
1047 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_STALE); |
1048 | ln_setexpire(ln, timenow + nd6_gctimer); |
1049 | } |
1050 | |
1051 | |
1052 | /* |
1053 | * Enqueue work item to invoke callback for this |
1054 | * route entry |
1055 | */ |
1056 | route_event_enqueue_nwk_wq_entry(rt, NULL, |
1057 | ROUTE_LLENTRY_RESOLVED, NULL, TRUE); |
1058 | |
1059 | if ((ln->ln_router = is_router) != 0) { |
1060 | struct radix_node_head *rnh = NULL; |
1061 | struct route_event rt_ev; |
1062 | route_event_init(&rt_ev, rt, NULL, ROUTE_LLENTRY_RESOLVED); |
1063 | /* |
1064 | * This means a router's state has changed from |
1065 | * non-reachable to probably reachable, and might |
1066 | * affect the status of associated prefixes.. |
1067 | * We already have a reference on rt. Don't need to |
1068 | * take one for the unlock/lock. |
1069 | */ |
1070 | RT_UNLOCK(rt); |
1071 | lck_mtx_lock(rnh_lock); |
1072 | rnh = rt_tables[AF_INET6]; |
1073 | |
1074 | if (rnh != NULL) |
1075 | (void) rnh->rnh_walktree(rnh, route_event_walktree, |
1076 | (void *)&rt_ev); |
1077 | lck_mtx_unlock(rnh_lock); |
1078 | lck_mtx_lock(nd6_mutex); |
1079 | pfxlist_onlink_check(); |
1080 | lck_mtx_unlock(nd6_mutex); |
1081 | RT_LOCK(rt); |
1082 | } |
1083 | } else { |
1084 | int llchange = 0; |
1085 | |
1086 | /* |
1087 | * Check if the link-layer address has changed or not. |
1088 | */ |
1089 | if (lladdr == NULL) |
1090 | llchange = 0; |
1091 | else { |
1092 | if (sdl->sdl_alen) { |
1093 | if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen)) |
1094 | llchange = 1; |
1095 | else |
1096 | llchange = 0; |
1097 | } else |
1098 | llchange = 1; |
1099 | } |
1100 | |
1101 | /* |
1102 | * This is VERY complex. Look at it with care. |
1103 | * |
1104 | * override solicit lladdr llchange action |
1105 | * (L: record lladdr) |
1106 | * |
1107 | * 0 0 n -- (2c) |
1108 | * 0 0 y n (2b) L |
1109 | * 0 0 y y (1) REACHABLE->STALE |
1110 | * 0 1 n -- (2c) *->REACHABLE |
1111 | * 0 1 y n (2b) L *->REACHABLE |
1112 | * 0 1 y y (1) REACHABLE->STALE |
1113 | * 1 0 n -- (2a) |
1114 | * 1 0 y n (2a) L |
1115 | * 1 0 y y (2a) L *->STALE |
1116 | * 1 1 n -- (2a) *->REACHABLE |
1117 | * 1 1 y n (2a) L *->REACHABLE |
1118 | * 1 1 y y (2a) L *->REACHABLE |
1119 | */ |
1120 | if (!is_override && (lladdr != NULL && llchange)) { /* (1) */ |
1121 | /* |
1122 | * If state is REACHABLE, make it STALE. |
1123 | * no other updates should be done. |
1124 | */ |
1125 | if (ln->ln_state == ND6_LLINFO_REACHABLE) { |
1126 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_STALE); |
1127 | ln_setexpire(ln, timenow + nd6_gctimer); |
1128 | } |
1129 | RT_REMREF_LOCKED(rt); |
1130 | RT_UNLOCK(rt); |
1131 | goto freeit; |
1132 | } else if (is_override /* (2a) */ |
1133 | || (!is_override && (lladdr && !llchange)) /* (2b) */ |
1134 | || !lladdr) { /* (2c) */ |
1135 | /* |
1136 | * Update link-local address, if any. |
1137 | */ |
1138 | if (lladdr) { |
1139 | sdl->sdl_alen = ifp->if_addrlen; |
1140 | bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen); |
1141 | } |
1142 | |
1143 | /* |
1144 | * If solicited, make the state REACHABLE. |
1145 | * If not solicited and the link-layer address was |
1146 | * changed, make it STALE. |
1147 | */ |
1148 | if (is_solicited) { |
1149 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_REACHABLE); |
1150 | if (ln->ln_expire != 0) { |
1151 | struct nd_ifinfo *ndi = NULL; |
1152 | |
1153 | ndi = ND_IFINFO(ifp); |
1154 | VERIFY(ndi != NULL && ndi->initialized); |
1155 | lck_mtx_lock(&ndi->lock); |
1156 | ln_setexpire(ln, |
1157 | timenow + ndi->reachable); |
1158 | lck_mtx_unlock(&ndi->lock); |
1159 | RT_UNLOCK(rt); |
1160 | lck_mtx_lock(rnh_lock); |
1161 | nd6_sched_timeout(NULL, NULL); |
1162 | lck_mtx_unlock(rnh_lock); |
1163 | RT_LOCK(rt); |
1164 | } |
1165 | } else { |
1166 | if (lladdr && llchange) { |
1167 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_STALE); |
1168 | ln_setexpire(ln, timenow + nd6_gctimer); |
1169 | } |
1170 | } |
1171 | |
1172 | /* |
1173 | * XXX |
1174 | * The above is somewhat convoluted, for now just |
1175 | * issue a callback for LLENTRY changed. |
1176 | */ |
1177 | /* Enqueue work item to invoke callback for this route entry */ |
1178 | if (llchange) { |
1179 | route_event_enqueue_nwk_wq_entry(rt, NULL, |
1180 | ROUTE_LLENTRY_CHANGED, NULL, TRUE); |
1181 | } |
1182 | |
1183 | /* |
1184 | * If the router's link-layer address has changed, |
1185 | * notify routes using this as gateway so they can |
1186 | * update any cached information. |
1187 | */ |
1188 | if (ln->ln_router && is_router && llchange) { |
1189 | struct radix_node_head *rnh = NULL; |
1190 | struct route_event rt_ev; |
1191 | route_event_init(&rt_ev, rt, NULL, ROUTE_LLENTRY_CHANGED); |
1192 | /* |
1193 | * This means a router's state has changed from |
1194 | * non-reachable to probably reachable, and might |
1195 | * affect the status of associated prefixes.. |
1196 | * |
1197 | * We already have a valid rt reference here. |
1198 | * We don't need to take another one for unlock/lock. |
1199 | */ |
1200 | RT_UNLOCK(rt); |
1201 | lck_mtx_lock(rnh_lock); |
1202 | rnh = rt_tables[AF_INET6]; |
1203 | |
1204 | if (rnh != NULL) |
1205 | (void) rnh->rnh_walktree(rnh, route_event_walktree, |
1206 | (void *)&rt_ev); |
1207 | lck_mtx_unlock(rnh_lock); |
1208 | RT_LOCK(rt); |
1209 | } |
1210 | } |
1211 | |
1212 | if (ln->ln_router && !is_router) { |
1213 | /* |
1214 | * The peer dropped the router flag. |
1215 | * Remove the sender from the Default Router List and |
1216 | * update the Destination Cache entries. |
1217 | */ |
1218 | struct nd_defrouter *dr; |
1219 | struct in6_addr *in6; |
1220 | struct ifnet *rt_ifp = rt->rt_ifp; |
1221 | |
1222 | in6 = &((struct sockaddr_in6 *) |
1223 | (void *)rt_key(rt))->sin6_addr; |
1224 | |
1225 | RT_UNLOCK(rt); |
1226 | lck_mtx_lock(nd6_mutex); |
1227 | dr = defrouter_lookup(in6, rt_ifp); |
1228 | if (dr) { |
1229 | TAILQ_REMOVE(&nd_defrouter, dr, dr_entry); |
1230 | defrtrlist_del(dr); |
1231 | NDDR_REMREF(dr); /* remove list reference */ |
1232 | NDDR_REMREF(dr); |
1233 | lck_mtx_unlock(nd6_mutex); |
1234 | } else { |
1235 | lck_mtx_unlock(nd6_mutex); |
1236 | /* |
1237 | * Even if the neighbor is not in the |
1238 | * default router list, the neighbor |
1239 | * may be used as a next hop for some |
1240 | * destinations (e.g. redirect case). |
1241 | * So we must call rt6_flush explicitly. |
1242 | */ |
1243 | rt6_flush(&ip6->ip6_src, rt_ifp); |
1244 | } |
1245 | RT_LOCK(rt); |
1246 | } |
1247 | ln->ln_router = is_router; |
1248 | } |
1249 | |
1250 | if (send_nc_alive_kev && (ifp->if_addrlen == IF_LLREACH_MAXLEN)) { |
1251 | struct kev_msg ev_msg; |
1252 | struct kev_nd6_ndalive nd6_ndalive; |
1253 | bzero(&ev_msg, sizeof(ev_msg)); |
1254 | bzero(&nd6_ndalive, sizeof(nd6_ndalive)); |
1255 | ev_msg.vendor_code = KEV_VENDOR_APPLE; |
1256 | ev_msg.kev_class = KEV_NETWORK_CLASS; |
1257 | ev_msg.kev_subclass = KEV_ND6_SUBCLASS; |
1258 | ev_msg.event_code = KEV_ND6_NDALIVE; |
1259 | |
1260 | nd6_ndalive.link_data.if_family = ifp->if_family; |
1261 | nd6_ndalive.link_data.if_unit = ifp->if_unit; |
1262 | strlcpy(nd6_ndalive.link_data.if_name, |
1263 | ifp->if_name, |
1264 | sizeof(nd6_ndalive.link_data.if_name)); |
1265 | ev_msg.dv[0].data_ptr = &nd6_ndalive; |
1266 | ev_msg.dv[0].data_length = |
1267 | sizeof(nd6_ndalive); |
1268 | dlil_post_complete_msg(NULL, &ev_msg); |
1269 | } |
1270 | |
1271 | RT_LOCK_ASSERT_HELD(rt); |
1272 | rt->rt_flags &= ~RTF_REJECT; |
1273 | |
1274 | /* cache the gateway (sender HW) address */ |
1275 | nd6_llreach_alloc(rt, ifp, LLADDR(sdl), sdl->sdl_alen, TRUE); |
1276 | |
1277 | /* update the llinfo, send a queued packet if there is one */ |
1278 | ln->ln_asked = 0; |
1279 | if (ln->ln_hold != NULL) { |
1280 | struct mbuf *m_hold, *m_hold_next; |
1281 | struct sockaddr_in6 sin6; |
1282 | |
1283 | rtkey_to_sa6(rt, &sin6); |
1284 | /* |
1285 | * reset the ln_hold in advance, to explicitly |
1286 | * prevent a ln_hold lookup in nd6_output() |
1287 | * (wouldn't happen, though...) |
1288 | */ |
1289 | m_hold = ln->ln_hold; |
1290 | ln->ln_hold = NULL; |
1291 | for ( ; m_hold; m_hold = m_hold_next) { |
1292 | m_hold_next = m_hold->m_nextpkt; |
1293 | m_hold->m_nextpkt = NULL; |
1294 | /* |
1295 | * we assume ifp is not a loopback here, so just set |
1296 | * the 2nd argument as the 1st one. |
1297 | */ |
1298 | RT_UNLOCK(rt); |
1299 | nd6_output(ifp, ifp, m_hold, &sin6, rt, NULL); |
1300 | RT_LOCK_SPIN(rt); |
1301 | } |
1302 | } |
1303 | RT_REMREF_LOCKED(rt); |
1304 | RT_UNLOCK(rt); |
1305 | m_freem(m); |
1306 | return; |
1307 | |
1308 | bad: |
1309 | icmp6stat.icp6s_badna++; |
1310 | /* fall through */ |
1311 | freeit: |
1312 | m_freem(m); |
1313 | return; |
1314 | } |
1315 | |
1316 | /* |
1317 | * Neighbor advertisement output handling. |
1318 | * |
1319 | * Based on RFC 2461 |
1320 | * |
1321 | * the following items are not implemented yet: |
1322 | * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) |
1323 | * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) |
1324 | * |
1325 | * tlladdr - 1 if include target link-layer address |
1326 | * sdl0 - sockaddr_dl (= proxy NA) or NULL |
1327 | */ |
1328 | void |
1329 | nd6_na_output( |
1330 | struct ifnet *ifp, |
1331 | const struct in6_addr *daddr6_0, |
1332 | const struct in6_addr *taddr6, |
1333 | uint32_t flags, |
1334 | int tlladdr, /* 1 if include target link-layer address */ |
1335 | struct sockaddr *sdl0) /* sockaddr_dl (= proxy NA) or NULL */ |
1336 | { |
1337 | struct mbuf *m; |
1338 | struct ip6_hdr *ip6; |
1339 | struct nd_neighbor_advert *nd_na; |
1340 | struct ip6_moptions *im6o = NULL; |
1341 | caddr_t mac = NULL; |
1342 | struct route_in6 ro; |
1343 | struct in6_addr *src, src_storage, daddr6; |
1344 | struct in6_ifaddr *ia; |
1345 | struct sockaddr_in6 dst_sa; |
1346 | int icmp6len, maxlen, error; |
1347 | struct ifnet *outif = NULL; |
1348 | |
1349 | struct ip6_out_args ip6oa; |
1350 | bzero(&ro, sizeof(ro)); |
1351 | |
1352 | daddr6 = *daddr6_0; /* make a local copy for modification */ |
1353 | |
1354 | bzero(&ip6oa, sizeof(ip6oa)); |
1355 | ip6oa.ip6oa_boundif = ifp->if_index; |
1356 | ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR | |
1357 | IP6OAF_AWDL_UNRESTRICTED | IP6OAF_INTCOPROC_ALLOWED; |
1358 | ip6oa.ip6oa_sotc = SO_TC_UNSPEC; |
1359 | ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC; |
1360 | |
1361 | ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF; |
1362 | |
1363 | /* estimate the size of message */ |
1364 | maxlen = sizeof(*ip6) + sizeof(*nd_na); |
1365 | maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; |
1366 | if (max_linkhdr + maxlen >= MCLBYTES) { |
1367 | #if DIAGNOSTIC |
1368 | printf("nd6_na_output: max_linkhdr + maxlen >= MCLBYTES " |
1369 | "(%d + %d > %d)\n" , max_linkhdr, maxlen, MCLBYTES); |
1370 | #endif |
1371 | return; |
1372 | } |
1373 | |
1374 | MGETHDR(m, M_DONTWAIT, MT_DATA); /* XXXMAC: mac_create_mbuf_linklayer() probably */ |
1375 | if (m && max_linkhdr + maxlen >= MHLEN) { |
1376 | MCLGET(m, M_DONTWAIT); |
1377 | if ((m->m_flags & M_EXT) == 0) { |
1378 | m_free(m); |
1379 | m = NULL; |
1380 | } |
1381 | } |
1382 | if (m == NULL) |
1383 | return; |
1384 | m->m_pkthdr.rcvif = NULL; |
1385 | |
1386 | if (IN6_IS_ADDR_MULTICAST(&daddr6)) { |
1387 | m->m_flags |= M_MCAST; |
1388 | |
1389 | im6o = ip6_allocmoptions(M_DONTWAIT); |
1390 | if (im6o == NULL) { |
1391 | m_freem(m); |
1392 | return; |
1393 | } |
1394 | |
1395 | im6o->im6o_multicast_ifp = ifp; |
1396 | im6o->im6o_multicast_hlim = IPV6_MAXHLIM; |
1397 | im6o->im6o_multicast_loop = 0; |
1398 | } |
1399 | |
1400 | icmp6len = sizeof(*nd_na); |
1401 | m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len; |
1402 | m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ |
1403 | |
1404 | /* fill neighbor advertisement packet */ |
1405 | ip6 = mtod(m, struct ip6_hdr *); |
1406 | ip6->ip6_flow = 0; |
1407 | ip6->ip6_vfc &= ~IPV6_VERSION_MASK; |
1408 | ip6->ip6_vfc |= IPV6_VERSION; |
1409 | ip6->ip6_nxt = IPPROTO_ICMPV6; |
1410 | ip6->ip6_hlim = IPV6_MAXHLIM; |
1411 | if (IN6_IS_ADDR_UNSPECIFIED(&daddr6)) { |
1412 | /* reply to DAD */ |
1413 | daddr6.s6_addr16[0] = IPV6_ADDR_INT16_MLL; |
1414 | daddr6.s6_addr16[1] = 0; |
1415 | daddr6.s6_addr32[1] = 0; |
1416 | daddr6.s6_addr32[2] = 0; |
1417 | daddr6.s6_addr32[3] = IPV6_ADDR_INT32_ONE; |
1418 | if (in6_setscope(&daddr6, ifp, NULL)) |
1419 | goto bad; |
1420 | |
1421 | flags &= ~ND_NA_FLAG_SOLICITED; |
1422 | } else |
1423 | ip6->ip6_dst = daddr6; |
1424 | |
1425 | bzero(&dst_sa, sizeof(struct sockaddr_in6)); |
1426 | dst_sa.sin6_family = AF_INET6; |
1427 | dst_sa.sin6_len = sizeof(struct sockaddr_in6); |
1428 | dst_sa.sin6_addr = daddr6; |
1429 | |
1430 | /* |
1431 | * Select a source whose scope is the same as that of the dest. |
1432 | */ |
1433 | bcopy(&dst_sa, &ro.ro_dst, sizeof(dst_sa)); |
1434 | src = in6_selectsrc(&dst_sa, NULL, NULL, &ro, NULL, &src_storage, |
1435 | ip6oa.ip6oa_boundif, &error); |
1436 | if (src == NULL) { |
1437 | nd6log((LOG_DEBUG, "nd6_na_output: source can't be " |
1438 | "determined: dst=%s, error=%d\n" , |
1439 | ip6_sprintf(&dst_sa.sin6_addr), error)); |
1440 | goto bad; |
1441 | } |
1442 | ip6->ip6_src = *src; |
1443 | |
1444 | /* |
1445 | * RFC 4429 requires not setting "override" flag on NA packets sent |
1446 | * from optimistic addresses. |
1447 | */ |
1448 | ia = in6ifa_ifpwithaddr(ifp, src); |
1449 | if (ia != NULL) { |
1450 | if (ia->ia6_flags & IN6_IFF_OPTIMISTIC) |
1451 | flags &= ~ND_NA_FLAG_OVERRIDE; |
1452 | IFA_REMREF(&ia->ia_ifa); |
1453 | } |
1454 | |
1455 | nd_na = (struct nd_neighbor_advert *)(ip6 + 1); |
1456 | nd_na->nd_na_type = ND_NEIGHBOR_ADVERT; |
1457 | nd_na->nd_na_code = 0; |
1458 | nd_na->nd_na_target = *taddr6; |
1459 | in6_clearscope(&nd_na->nd_na_target); /* XXX */ |
1460 | |
1461 | /* |
1462 | * "tlladdr" indicates NS's condition for adding tlladdr or not. |
1463 | * see nd6_ns_input() for details. |
1464 | * Basically, if NS packet is sent to unicast/anycast addr, |
1465 | * target lladdr option SHOULD NOT be included. |
1466 | */ |
1467 | if (tlladdr) { |
1468 | /* |
1469 | * sdl0 != NULL indicates proxy NA. If we do proxy, use |
1470 | * lladdr in sdl0. If we are not proxying (sending NA for |
1471 | * my address) use lladdr configured for the interface. |
1472 | */ |
1473 | if (sdl0 == NULL) |
1474 | mac = nd6_ifptomac(ifp); |
1475 | else if (sdl0->sa_family == AF_LINK) { |
1476 | struct sockaddr_dl *sdl; |
1477 | sdl = (struct sockaddr_dl *)(void *)sdl0; |
1478 | if (sdl->sdl_alen == ifp->if_addrlen) |
1479 | mac = LLADDR(sdl); |
1480 | } |
1481 | } |
1482 | if (tlladdr && mac) { |
1483 | int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; |
1484 | struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1); |
1485 | |
1486 | /* roundup to 8 bytes alignment! */ |
1487 | optlen = (optlen + 7) & ~7; |
1488 | |
1489 | m->m_pkthdr.len += optlen; |
1490 | m->m_len += optlen; |
1491 | icmp6len += optlen; |
1492 | bzero((caddr_t)nd_opt, optlen); |
1493 | nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR; |
1494 | nd_opt->nd_opt_len = optlen >> 3; |
1495 | bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen); |
1496 | } else |
1497 | flags &= ~ND_NA_FLAG_OVERRIDE; |
1498 | |
1499 | ip6->ip6_plen = htons((u_short)icmp6len); |
1500 | nd_na->nd_na_flags_reserved = flags; |
1501 | nd_na->nd_na_cksum = 0; |
1502 | nd_na->nd_na_cksum = |
1503 | in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len); |
1504 | |
1505 | m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE; |
1506 | |
1507 | if (ifp->if_eflags & IFEF_TXSTART) { |
1508 | /* Use control service class if the interface supports |
1509 | * transmit-start model. |
1510 | */ |
1511 | (void) m_set_service_class(m, MBUF_SC_CTL); |
1512 | } |
1513 | |
1514 | ip6_output(m, NULL, NULL, IPV6_OUTARGS, im6o, &outif, &ip6oa); |
1515 | if (outif) { |
1516 | icmp6_ifstat_inc(outif, ifs6_out_msg); |
1517 | icmp6_ifstat_inc(outif, ifs6_out_neighboradvert); |
1518 | ifnet_release(outif); |
1519 | } |
1520 | icmp6stat.icp6s_outhist[ND_NEIGHBOR_ADVERT]++; |
1521 | |
1522 | exit: |
1523 | if (im6o != NULL) |
1524 | IM6O_REMREF(im6o); |
1525 | |
1526 | ROUTE_RELEASE(&ro); |
1527 | return; |
1528 | |
1529 | bad: |
1530 | m_freem(m); |
1531 | goto exit; |
1532 | } |
1533 | |
1534 | caddr_t |
1535 | nd6_ifptomac( |
1536 | struct ifnet *ifp) |
1537 | { |
1538 | switch (ifp->if_type) { |
1539 | case IFT_ARCNET: |
1540 | case IFT_ETHER: |
1541 | case IFT_IEEE8023ADLAG: |
1542 | case IFT_FDDI: |
1543 | case IFT_IEEE1394: |
1544 | #ifdef IFT_L2VLAN |
1545 | case IFT_L2VLAN: |
1546 | #endif |
1547 | #ifdef IFT_IEEE80211 |
1548 | case IFT_IEEE80211: |
1549 | #endif |
1550 | #ifdef IFT_CARP |
1551 | case IFT_CARP: |
1552 | #endif |
1553 | case IFT_BRIDGE: |
1554 | case IFT_ISO88025: |
1555 | return ((caddr_t)IF_LLADDR(ifp)); |
1556 | default: |
1557 | return NULL; |
1558 | } |
1559 | } |
1560 | |
1561 | TAILQ_HEAD(dadq_head, dadq); |
1562 | struct dadq { |
1563 | decl_lck_mtx_data(, dad_lock); |
1564 | u_int32_t dad_refcount; /* reference count */ |
1565 | int dad_attached; |
1566 | TAILQ_ENTRY(dadq) dad_list; |
1567 | struct ifaddr *dad_ifa; |
1568 | int dad_count; /* max NS to send */ |
1569 | int dad_ns_tcount; /* # of trials to send NS */ |
1570 | int dad_ns_ocount; /* NS sent so far */ |
1571 | int dad_ns_icount; |
1572 | int dad_na_icount; |
1573 | int dad_ns_lcount; /* looped back NS */ |
1574 | int dad_loopbackprobe; /* probing state for loopback detection */ |
1575 | uint8_t dad_lladdr[ETHER_ADDR_LEN]; |
1576 | uint8_t dad_lladdrlen; |
1577 | #define ND_OPT_NONCE_LEN32 \ |
1578 | ((ND_OPT_NONCE_LEN + sizeof(uint32_t) - 1)/sizeof(uint32_t)) |
1579 | uint32_t dad_nonce[ND_OPT_NONCE_LEN32]; |
1580 | }; |
1581 | |
1582 | static struct dadq_head dadq; |
1583 | |
1584 | void |
1585 | nd6_nbr_init(void) |
1586 | { |
1587 | int i; |
1588 | |
1589 | TAILQ_INIT(&dadq); |
1590 | |
1591 | dad_size = sizeof (struct dadq); |
1592 | dad_zone = zinit(dad_size, DAD_ZONE_MAX * dad_size, 0, DAD_ZONE_NAME); |
1593 | if (dad_zone == NULL) { |
1594 | panic("%s: failed allocating %s" , __func__, DAD_ZONE_NAME); |
1595 | /* NOTREACHED */ |
1596 | } |
1597 | zone_change(dad_zone, Z_EXPAND, TRUE); |
1598 | zone_change(dad_zone, Z_CALLERACCT, FALSE); |
1599 | |
1600 | bzero(&hostrtmask, sizeof hostrtmask); |
1601 | hostrtmask.sin6_family = AF_INET6; |
1602 | hostrtmask.sin6_len = sizeof hostrtmask; |
1603 | for (i = 0; i < sizeof hostrtmask.sin6_addr; ++i) |
1604 | hostrtmask.sin6_addr.s6_addr[i] = 0xff; |
1605 | } |
1606 | |
1607 | static struct dadq * |
1608 | nd6_dad_find(struct ifaddr *ifa, struct nd_opt_nonce *nonce) |
1609 | { |
1610 | struct dadq *dp; |
1611 | |
1612 | lck_mtx_lock(dad6_mutex); |
1613 | for (dp = dadq.tqh_first; dp; dp = dp->dad_list.tqe_next) { |
1614 | DAD_LOCK_SPIN(dp); |
1615 | if (dp->dad_ifa != ifa) { |
1616 | DAD_UNLOCK(dp); |
1617 | continue; |
1618 | } |
1619 | |
1620 | /* |
1621 | * Skip if the nonce matches the received one. |
1622 | * +2 in the length is required because of type and |
1623 | * length fields are included in a header. |
1624 | */ |
1625 | if (nonce != NULL && |
1626 | nonce->nd_opt_nonce_len == (ND_OPT_NONCE_LEN + 2) / 8 && |
1627 | memcmp(&nonce->nd_opt_nonce[0], &dp->dad_nonce[0], |
1628 | ND_OPT_NONCE_LEN) == 0) { |
1629 | nd6log((LOG_ERR, "%s: a looped back NS message is " |
1630 | "detected during DAD for %s. Ignoring.\n" , |
1631 | if_name(ifa->ifa_ifp), |
1632 | ip6_sprintf(IFA_IN6(ifa)))); |
1633 | dp->dad_ns_lcount++; |
1634 | ++ip6stat.ip6s_dad_loopcount; |
1635 | DAD_UNLOCK(dp); |
1636 | continue; |
1637 | } |
1638 | |
1639 | DAD_ADDREF_LOCKED(dp); |
1640 | DAD_UNLOCK(dp); |
1641 | break; |
1642 | } |
1643 | lck_mtx_unlock(dad6_mutex); |
1644 | return (dp); |
1645 | } |
1646 | |
1647 | void |
1648 | nd6_dad_stoptimer( |
1649 | struct ifaddr *ifa) |
1650 | { |
1651 | |
1652 | untimeout((void (*)(void *))nd6_dad_timer, (void *)ifa); |
1653 | } |
1654 | |
1655 | /* |
1656 | * Start Duplicate Address Detection (DAD) for specified interface address. |
1657 | */ |
1658 | void |
1659 | nd6_dad_start( |
1660 | struct ifaddr *ifa, |
1661 | int *tick_delay) /* minimum delay ticks for IFF_UP event */ |
1662 | { |
1663 | struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; |
1664 | struct dadq *dp; |
1665 | |
1666 | nd6log2((LOG_DEBUG, "%s - %s ifp %s ia6_flags 0x%x\n" , |
1667 | __func__, |
1668 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1669 | if_name(ia->ia_ifp), |
1670 | ia->ia6_flags)); |
1671 | |
1672 | /* |
1673 | * If we don't need DAD, don't do it. |
1674 | * There are several cases: |
1675 | * - DAD is disabled (ip6_dad_count == 0) |
1676 | * - the interface address is anycast |
1677 | */ |
1678 | IFA_LOCK(&ia->ia_ifa); |
1679 | if (!(ia->ia6_flags & IN6_IFF_DADPROGRESS)) { |
1680 | nd6log0((LOG_DEBUG, |
1681 | "nd6_dad_start: not a tentative or optimistic address " |
1682 | "%s(%s)\n" , |
1683 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1684 | ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???" )); |
1685 | IFA_UNLOCK(&ia->ia_ifa); |
1686 | return; |
1687 | } |
1688 | if (!ip6_dad_count || (ia->ia6_flags & IN6_IFF_ANYCAST) != 0) { |
1689 | ia->ia6_flags &= ~IN6_IFF_DADPROGRESS; |
1690 | IFA_UNLOCK(&ia->ia_ifa); |
1691 | return; |
1692 | } |
1693 | IFA_UNLOCK(&ia->ia_ifa); |
1694 | if (ifa->ifa_ifp == NULL) |
1695 | panic("nd6_dad_start: ifa->ifa_ifp == NULL" ); |
1696 | if (!(ifa->ifa_ifp->if_flags & IFF_UP) || |
1697 | (ifa->ifa_ifp->if_eflags & IFEF_IPV6_ND6ALT)) { |
1698 | return; |
1699 | } |
1700 | if ((dp = nd6_dad_find(ifa, NULL)) != NULL) { |
1701 | DAD_REMREF(dp); |
1702 | /* DAD already in progress */ |
1703 | return; |
1704 | } |
1705 | |
1706 | dp = zalloc(dad_zone); |
1707 | if (dp == NULL) { |
1708 | nd6log0((LOG_ERR, "nd6_dad_start: memory allocation failed for " |
1709 | "%s(%s)\n" , |
1710 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1711 | ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???" )); |
1712 | return; |
1713 | } |
1714 | bzero(dp, dad_size); |
1715 | lck_mtx_init(&dp->dad_lock, ifa_mtx_grp, ifa_mtx_attr); |
1716 | |
1717 | /* Callee adds one reference for us */ |
1718 | dp = nd6_dad_attach(dp, ifa); |
1719 | |
1720 | nd6log0((LOG_DEBUG, "%s: starting %sDAD %sfor %s\n" , |
1721 | if_name(ifa->ifa_ifp), |
1722 | (ia->ia6_flags & IN6_IFF_OPTIMISTIC) ? "optimistic " : "" , |
1723 | (tick_delay == NULL) ? "immediately " : "" , |
1724 | ip6_sprintf(&ia->ia_addr.sin6_addr))); |
1725 | |
1726 | /* |
1727 | * Send NS packet for DAD, ip6_dad_count times. |
1728 | * Note that we must delay the first transmission, if this is the |
1729 | * first packet to be sent from the interface after interface |
1730 | * (re)initialization. |
1731 | */ |
1732 | if (tick_delay == NULL) { |
1733 | u_int32_t retrans; |
1734 | struct nd_ifinfo *ndi = NULL; |
1735 | |
1736 | nd6_dad_ns_output(dp, ifa); |
1737 | ndi = ND_IFINFO(ifa->ifa_ifp); |
1738 | VERIFY(ndi != NULL && ndi->initialized); |
1739 | lck_mtx_lock(&ndi->lock); |
1740 | retrans = ndi->retrans * hz / 1000; |
1741 | lck_mtx_unlock(&ndi->lock); |
1742 | timeout((void (*)(void *))nd6_dad_timer, (void *)ifa, retrans); |
1743 | } else { |
1744 | int ntick; |
1745 | |
1746 | if (*tick_delay == 0) |
1747 | ntick = random() % (MAX_RTR_SOLICITATION_DELAY * hz); |
1748 | else |
1749 | ntick = *tick_delay + random() % (hz / 2); |
1750 | *tick_delay = ntick; |
1751 | timeout((void (*)(void *))nd6_dad_timer, (void *)ifa, |
1752 | ntick); |
1753 | } |
1754 | |
1755 | DAD_REMREF(dp); /* drop our reference */ |
1756 | } |
1757 | |
1758 | static struct dadq * |
1759 | nd6_dad_attach(struct dadq *dp, struct ifaddr *ifa) |
1760 | { |
1761 | lck_mtx_lock(dad6_mutex); |
1762 | DAD_LOCK(dp); |
1763 | dp->dad_ifa = ifa; |
1764 | IFA_ADDREF(ifa); /* for dad_ifa */ |
1765 | dp->dad_count = ip6_dad_count; |
1766 | dp->dad_ns_icount = dp->dad_na_icount = 0; |
1767 | dp->dad_ns_ocount = dp->dad_ns_tcount = 0; |
1768 | dp->dad_ns_lcount = dp->dad_loopbackprobe = 0; |
1769 | VERIFY(!dp->dad_attached); |
1770 | dp->dad_attached = 1; |
1771 | dp->dad_lladdrlen = 0; |
1772 | DAD_ADDREF_LOCKED(dp); /* for caller */ |
1773 | DAD_ADDREF_LOCKED(dp); /* for dadq_head list */ |
1774 | TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list); |
1775 | DAD_UNLOCK(dp); |
1776 | lck_mtx_unlock(dad6_mutex); |
1777 | |
1778 | return (dp); |
1779 | } |
1780 | |
1781 | static void |
1782 | nd6_dad_detach(struct dadq *dp, struct ifaddr *ifa) |
1783 | { |
1784 | int detached; |
1785 | |
1786 | lck_mtx_lock(dad6_mutex); |
1787 | DAD_LOCK(dp); |
1788 | if ((detached = dp->dad_attached)) { |
1789 | VERIFY(dp->dad_ifa == ifa); |
1790 | TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); |
1791 | dp->dad_list.tqe_next = NULL; |
1792 | dp->dad_list.tqe_prev = NULL; |
1793 | dp->dad_attached = 0; |
1794 | } |
1795 | DAD_UNLOCK(dp); |
1796 | lck_mtx_unlock(dad6_mutex); |
1797 | if (detached) { |
1798 | DAD_REMREF(dp); /* drop dadq_head reference */ |
1799 | } |
1800 | } |
1801 | |
1802 | /* |
1803 | * terminate DAD unconditionally. used for address removals. |
1804 | */ |
1805 | void |
1806 | nd6_dad_stop(struct ifaddr *ifa) |
1807 | { |
1808 | struct dadq *dp; |
1809 | |
1810 | dp = nd6_dad_find(ifa, NULL); |
1811 | if (!dp) { |
1812 | /* DAD wasn't started yet */ |
1813 | return; |
1814 | } |
1815 | |
1816 | untimeout((void (*)(void *))nd6_dad_timer, (void *)ifa); |
1817 | |
1818 | nd6_dad_detach(dp, ifa); |
1819 | DAD_REMREF(dp); /* drop our reference */ |
1820 | } |
1821 | |
1822 | static void |
1823 | nd6_unsol_na_output(struct ifaddr *ifa) |
1824 | { |
1825 | struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; |
1826 | struct ifnet *ifp = ifa->ifa_ifp; |
1827 | struct in6_addr saddr6, taddr6; |
1828 | |
1829 | if ((ifp->if_flags & IFF_UP) == 0 || |
1830 | (ifp->if_flags & IFF_RUNNING) == 0 || |
1831 | (ifp->if_eflags & IFEF_IPV6_ND6ALT) != 0) |
1832 | return; |
1833 | |
1834 | IFA_LOCK_SPIN(&ia->ia_ifa); |
1835 | taddr6 = ia->ia_addr.sin6_addr; |
1836 | IFA_UNLOCK(&ia->ia_ifa); |
1837 | if (in6_setscope(&taddr6, ifp, NULL) != 0) |
1838 | return; |
1839 | saddr6 = in6addr_linklocal_allnodes; |
1840 | if (in6_setscope(&saddr6, ifp, NULL) != 0) |
1841 | return; |
1842 | |
1843 | nd6log((LOG_INFO, "%s: sending unsolicited NA\n" , |
1844 | if_name(ifa->ifa_ifp))); |
1845 | |
1846 | nd6_na_output(ifp, &saddr6, &taddr6, ND_NA_FLAG_OVERRIDE, 1, NULL); |
1847 | } |
1848 | |
1849 | static void |
1850 | nd6_dad_timer(struct ifaddr *ifa) |
1851 | { |
1852 | struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; |
1853 | struct dadq *dp = NULL; |
1854 | struct nd_ifinfo *ndi = NULL; |
1855 | u_int32_t retrans; |
1856 | |
1857 | /* Sanity check */ |
1858 | if (ia == NULL) { |
1859 | nd6log0((LOG_ERR, "nd6_dad_timer: called with null parameter\n" )); |
1860 | goto done; |
1861 | } |
1862 | |
1863 | nd6log2((LOG_DEBUG, "%s - %s ifp %s ia6_flags 0x%x\n" , |
1864 | __func__, |
1865 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1866 | if_name(ia->ia_ifp), |
1867 | ia->ia6_flags)); |
1868 | |
1869 | dp = nd6_dad_find(ifa, NULL); |
1870 | if (dp == NULL) { |
1871 | nd6log0((LOG_ERR, "nd6_dad_timer: DAD structure not found\n" )); |
1872 | goto done; |
1873 | } |
1874 | IFA_LOCK(&ia->ia_ifa); |
1875 | if (ia->ia6_flags & IN6_IFF_DUPLICATED) { |
1876 | nd6log0((LOG_ERR, "nd6_dad_timer: called with duplicated address " |
1877 | "%s(%s)\n" , |
1878 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1879 | ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???" )); |
1880 | IFA_UNLOCK(&ia->ia_ifa); |
1881 | goto done; |
1882 | } |
1883 | if ((ia->ia6_flags & IN6_IFF_DADPROGRESS) == 0) { |
1884 | nd6log0((LOG_ERR, "nd6_dad_timer: not a tentative or optimistic " |
1885 | "address %s(%s)\n" , |
1886 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1887 | ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???" )); |
1888 | IFA_UNLOCK(&ia->ia_ifa); |
1889 | goto done; |
1890 | } |
1891 | IFA_UNLOCK(&ia->ia_ifa); |
1892 | |
1893 | /* timeouted with IFF_{RUNNING,UP} check */ |
1894 | DAD_LOCK(dp); |
1895 | if (dp->dad_ns_tcount > dad_maxtry) { |
1896 | DAD_UNLOCK(dp); |
1897 | nd6log0((LOG_INFO, "%s: could not run DAD, driver problem?\n" , |
1898 | if_name(ifa->ifa_ifp))); |
1899 | |
1900 | nd6_dad_detach(dp, ifa); |
1901 | goto done; |
1902 | } |
1903 | |
1904 | /* Need more checks? */ |
1905 | if (dp->dad_ns_ocount < dp->dad_count) { |
1906 | DAD_UNLOCK(dp); |
1907 | /* |
1908 | * We have more NS to go. Send NS packet for DAD. |
1909 | */ |
1910 | nd6_dad_ns_output(dp, ifa); |
1911 | ndi = ND_IFINFO(ifa->ifa_ifp); |
1912 | VERIFY(ndi != NULL && ndi->initialized); |
1913 | lck_mtx_lock(&ndi->lock); |
1914 | retrans = ndi->retrans * hz / 1000; |
1915 | lck_mtx_unlock(&ndi->lock); |
1916 | timeout((void (*)(void *))nd6_dad_timer, (void *)ifa, retrans); |
1917 | } else { |
1918 | /* |
1919 | * We have transmitted sufficient number of DAD packets. |
1920 | * See what we've got. |
1921 | */ |
1922 | if (dp->dad_na_icount > 0 || dp->dad_ns_icount) { |
1923 | /* We've seen NS or NA, means DAD has failed. */ |
1924 | DAD_UNLOCK(dp); |
1925 | nd6log0((LOG_INFO, |
1926 | "%s: duplicate IPv6 address %s [timer]\n" , |
1927 | __func__, ip6_sprintf(&ia->ia_addr.sin6_addr), |
1928 | if_name(ia->ia_ifp))); |
1929 | nd6_dad_duplicated(ifa); |
1930 | /* (*dp) will be freed in nd6_dad_duplicated() */ |
1931 | } else if (dad_enhanced != 0 && |
1932 | dp->dad_ns_lcount > 0 && |
1933 | dp->dad_ns_lcount > dp->dad_loopbackprobe) { |
1934 | dp->dad_loopbackprobe = dp->dad_ns_lcount; |
1935 | dp->dad_count = |
1936 | dp->dad_ns_ocount + dad_maxtry - 1; |
1937 | DAD_UNLOCK(dp); |
1938 | ndi = ND_IFINFO(ifa->ifa_ifp); |
1939 | VERIFY(ndi != NULL && ndi->initialized); |
1940 | lck_mtx_lock(&ndi->lock); |
1941 | retrans = ndi->retrans * hz / 1000; |
1942 | lck_mtx_unlock(&ndi->lock); |
1943 | |
1944 | /* |
1945 | * Sec. 4.1 in RFC 7527 requires transmission of |
1946 | * additional probes until the loopback condition |
1947 | * becomes clear when a looped back probe is detected. |
1948 | */ |
1949 | nd6log0((LOG_INFO, |
1950 | "%s: a looped back NS message is " |
1951 | "detected during DAD for %s. " |
1952 | "Another DAD probe is being sent on interface.\n" , |
1953 | __func__, ip6_sprintf(&ia->ia_addr.sin6_addr), |
1954 | if_name(ia->ia_ifp))); |
1955 | /* |
1956 | * Send an NS immediately and increase dad_count by |
1957 | * nd6_mmaxtries - 1. |
1958 | */ |
1959 | nd6_dad_ns_output(dp, ifa); |
1960 | timeout((void (*)(void *))nd6_dad_timer, (void *)ifa, retrans); |
1961 | goto done; |
1962 | } else { |
1963 | boolean_t txunsolna; |
1964 | DAD_UNLOCK(dp); |
1965 | /* |
1966 | * We are done with DAD. No NA came, no NS came. |
1967 | * No duplicate address found. |
1968 | */ |
1969 | IFA_LOCK_SPIN(&ia->ia_ifa); |
1970 | ia->ia6_flags &= ~IN6_IFF_DADPROGRESS; |
1971 | IFA_UNLOCK(&ia->ia_ifa); |
1972 | |
1973 | ndi = ND_IFINFO(ifa->ifa_ifp); |
1974 | VERIFY(ndi != NULL && ndi->initialized); |
1975 | lck_mtx_lock(&ndi->lock); |
1976 | txunsolna = (ndi->flags & ND6_IFF_REPLICATED) != 0; |
1977 | lck_mtx_unlock(&ndi->lock); |
1978 | |
1979 | if (txunsolna) { |
1980 | nd6_unsol_na_output(ifa); |
1981 | } |
1982 | |
1983 | nd6log0((LOG_DEBUG, |
1984 | "%s: DAD complete for %s - no duplicates found%s\n" , |
1985 | if_name(ifa->ifa_ifp), |
1986 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1987 | txunsolna ? ", tx unsolicited NA with O=1" : "." )); |
1988 | |
1989 | if (dp->dad_ns_lcount > 0) |
1990 | nd6log0((LOG_DEBUG, |
1991 | "%s: DAD completed while " |
1992 | "a looped back NS message is detected " |
1993 | "during DAD for %s om interface %s\n" , |
1994 | __func__, |
1995 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1996 | if_name(ia->ia_ifp))); |
1997 | |
1998 | in6_post_msg(ia->ia_ifp, KEV_INET6_NEW_USER_ADDR, ia, |
1999 | dp->dad_lladdr); |
2000 | nd6_dad_detach(dp, ifa); |
2001 | } |
2002 | } |
2003 | |
2004 | done: |
2005 | if (dp != NULL) |
2006 | DAD_REMREF(dp); /* drop our reference */ |
2007 | } |
2008 | |
2009 | void |
2010 | nd6_dad_duplicated(struct ifaddr *ifa) |
2011 | { |
2012 | struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; |
2013 | struct dadq *dp; |
2014 | struct ifnet *ifp = ifa->ifa_ifp; |
2015 | boolean_t candisable; |
2016 | |
2017 | dp = nd6_dad_find(ifa, NULL); |
2018 | if (dp == NULL) { |
2019 | log(LOG_ERR, "%s: DAD structure not found.\n" , __func__); |
2020 | return; |
2021 | } |
2022 | IFA_LOCK(&ia->ia_ifa); |
2023 | DAD_LOCK(dp); |
2024 | nd6log((LOG_ERR, "%s: NS in/out/loopback=%d/%d, NA in=%d\n" , |
2025 | __func__, dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_ns_lcount, |
2026 | dp->dad_na_icount)); |
2027 | candisable = FALSE; |
2028 | |
2029 | if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr) && |
2030 | !(ia->ia6_flags & IN6_IFF_SECURED)) { |
2031 | struct in6_addr in6; |
2032 | struct ifaddr *llifa = NULL; |
2033 | struct sockaddr_dl *sdl = NULL; |
2034 | uint8_t *lladdr = dp->dad_lladdr; |
2035 | uint8_t lladdrlen = dp->dad_lladdrlen; |
2036 | |
2037 | /* |
2038 | * To avoid over-reaction, we only apply this logic when we are |
2039 | * very sure that hardware addresses are supposed to be unique. |
2040 | */ |
2041 | switch (ifp->if_type) { |
2042 | case IFT_BRIDGE: |
2043 | case IFT_ETHER: |
2044 | case IFT_FDDI: |
2045 | case IFT_ATM: |
2046 | case IFT_IEEE1394: |
2047 | #ifdef IFT_IEEE80211 |
2048 | case IFT_IEEE80211: |
2049 | #endif |
2050 | /* |
2051 | * Check if our hardware address matches the |
2052 | * link layer information received in the |
2053 | * NS/NA |
2054 | */ |
2055 | llifa = ifp->if_lladdr; |
2056 | IFA_LOCK(llifa); |
2057 | sdl = (struct sockaddr_dl *)(void *) |
2058 | llifa->ifa_addr; |
2059 | if (lladdrlen == sdl->sdl_alen && |
2060 | bcmp(lladdr, LLADDR(sdl), lladdrlen) == 0) |
2061 | candisable = TRUE; |
2062 | IFA_UNLOCK(llifa); |
2063 | |
2064 | in6 = ia->ia_addr.sin6_addr; |
2065 | if (in6_iid_from_hw(ifp, &in6) != 0) |
2066 | break; |
2067 | |
2068 | /* Refine decision about whether IPv6 can be disabled */ |
2069 | if (candisable && |
2070 | !IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) { |
2071 | /* |
2072 | * Apply this logic only to the embedded MAC |
2073 | * address form of link-local IPv6 address. |
2074 | */ |
2075 | candisable = FALSE; |
2076 | } else if (lladdr == NULL && |
2077 | IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) { |
2078 | /* |
2079 | * We received a NA with no target link-layer |
2080 | * address option. This means that someone else |
2081 | * has our address. Mark it as a hardware |
2082 | * duplicate so we disable IPv6 later on. |
2083 | */ |
2084 | candisable = TRUE; |
2085 | } |
2086 | break; |
2087 | default: |
2088 | break; |
2089 | } |
2090 | } |
2091 | DAD_UNLOCK(dp); |
2092 | |
2093 | ia->ia6_flags &= ~IN6_IFF_DADPROGRESS; |
2094 | ia->ia6_flags |= IN6_IFF_DUPLICATED; |
2095 | in6_event_enqueue_nwk_wq_entry(IN6_ADDR_MARKED_DUPLICATED, |
2096 | ia->ia_ifa.ifa_ifp, &ia->ia_addr.sin6_addr, |
2097 | 0); |
2098 | IFA_UNLOCK(&ia->ia_ifa); |
2099 | |
2100 | /* increment DAD collision counter */ |
2101 | ++ip6stat.ip6s_dad_collide; |
2102 | |
2103 | /* We are done with DAD, with duplicated address found. (failure) */ |
2104 | untimeout((void (*)(void *))nd6_dad_timer, (void *)ifa); |
2105 | |
2106 | IFA_LOCK(&ia->ia_ifa); |
2107 | log(LOG_ERR, "%s: DAD complete for %s - duplicate found.\n" , |
2108 | if_name(ifp), ip6_sprintf(&ia->ia_addr.sin6_addr)); |
2109 | IFA_UNLOCK(&ia->ia_ifa); |
2110 | |
2111 | if (candisable) { |
2112 | struct nd_ifinfo *ndi = ND_IFINFO(ifp); |
2113 | log(LOG_ERR, "%s: possible hardware address duplication " |
2114 | "detected, disabling IPv6 for interface.\n" , if_name(ifp)); |
2115 | |
2116 | VERIFY((NULL != ndi) && (TRUE == ndi->initialized)); |
2117 | ndi->flags |= ND6_IFF_IFDISABLED; |
2118 | /* Make sure to set IFEF_IPV6_DISABLED too */ |
2119 | nd6_if_disable(ifp, TRUE); |
2120 | } |
2121 | |
2122 | log(LOG_ERR, "%s: manual intervention required!\n" , if_name(ifp)); |
2123 | |
2124 | /* Send an event to the configuration agent so that the |
2125 | * duplicate address will be notified to the user and will |
2126 | * be removed. |
2127 | */ |
2128 | in6_post_msg(ifp, KEV_INET6_NEW_USER_ADDR, ia, dp->dad_lladdr); |
2129 | nd6_dad_detach(dp, ifa); |
2130 | DAD_REMREF(dp); /* drop our reference */ |
2131 | } |
2132 | |
2133 | static void |
2134 | nd6_dad_ns_output(struct dadq *dp, struct ifaddr *ifa) |
2135 | { |
2136 | struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; |
2137 | struct ifnet *ifp = ifa->ifa_ifp; |
2138 | int i = 0; |
2139 | struct in6_addr taddr6; |
2140 | |
2141 | DAD_LOCK(dp); |
2142 | dp->dad_ns_tcount++; |
2143 | if ((ifp->if_flags & IFF_UP) == 0) { |
2144 | DAD_UNLOCK(dp); |
2145 | return; |
2146 | } |
2147 | if ((ifp->if_flags & IFF_RUNNING) == 0) { |
2148 | DAD_UNLOCK(dp); |
2149 | return; |
2150 | } |
2151 | |
2152 | dp->dad_ns_ocount++; |
2153 | DAD_UNLOCK(dp); |
2154 | IFA_LOCK_SPIN(&ia->ia_ifa); |
2155 | taddr6 = ia->ia_addr.sin6_addr; |
2156 | IFA_UNLOCK(&ia->ia_ifa); |
2157 | if (dad_enhanced != 0 && !(ifp->if_flags & IFF_POINTOPOINT)) { |
2158 | for (i = 0; i < ND_OPT_NONCE_LEN32; i++) |
2159 | dp->dad_nonce[i] = RandomULong(); |
2160 | /* |
2161 | * XXXHRS: Note that in the case that |
2162 | * DupAddrDetectTransmits > 1, multiple NS messages with |
2163 | * different nonces can be looped back in an unexpected |
2164 | * order. The current implementation recognizes only |
2165 | * the latest nonce on the sender side. Practically it |
2166 | * should work well in almost all cases. |
2167 | */ |
2168 | } |
2169 | nd6_ns_output(ifp, NULL, &taddr6, NULL, |
2170 | (uint8_t *)&dp->dad_nonce[0]); |
2171 | } |
2172 | |
2173 | /* |
2174 | * @brief Called to process DAD NS |
2175 | * |
2176 | * @param ifa is the pointer to the interface's address |
2177 | * @param lladdr is source link layer information |
2178 | * @param lladdrlen is source's linklayer length |
2179 | * |
2180 | * @return void |
2181 | */ |
2182 | static void |
2183 | nd6_dad_ns_input(struct ifaddr *ifa, char *lladdr, |
2184 | int lladdrlen, struct nd_opt_nonce *ndopt_nonce) |
2185 | { |
2186 | struct dadq *dp; |
2187 | VERIFY(ifa != NULL); |
2188 | |
2189 | /* Ignore Nonce option when Enhanced DAD is disabled. */ |
2190 | if (dad_enhanced == 0) |
2191 | ndopt_nonce = NULL; |
2192 | |
2193 | dp = nd6_dad_find(ifa, ndopt_nonce); |
2194 | if (dp == NULL) |
2195 | return; |
2196 | |
2197 | DAD_LOCK(dp); |
2198 | ++dp->dad_ns_icount; |
2199 | if (lladdr && lladdrlen >= ETHER_ADDR_LEN) { |
2200 | memcpy(dp->dad_lladdr, lladdr, ETHER_ADDR_LEN); |
2201 | dp->dad_lladdrlen = lladdrlen; |
2202 | } |
2203 | DAD_UNLOCK(dp); |
2204 | DAD_REMREF(dp); |
2205 | } |
2206 | |
2207 | /* |
2208 | * @brief Called to process received NA for DAD |
2209 | * |
2210 | * @param m is the pointer to the packet's mbuf |
2211 | * @param ifp is the pointer to the interface on which packet |
2212 | * was receicved. |
2213 | * @param taddr is pointer to target's IPv6 address |
2214 | * @param lladdr is target's link layer information |
2215 | * @param lladdrlen is target's linklayer length |
2216 | * |
2217 | * @return NULL if the packet is consumed by DAD processing, else |
2218 | * pointer to the mbuf. |
2219 | */ |
2220 | static struct mbuf * |
2221 | nd6_dad_na_input(struct mbuf *m, struct ifnet *ifp, struct in6_addr *taddr, |
2222 | caddr_t lladdr, int lladdrlen) |
2223 | { |
2224 | struct ifaddr *ifa = NULL; |
2225 | struct in6_ifaddr *ia = NULL; |
2226 | struct dadq *dp = NULL; |
2227 | struct nd_ifinfo *ndi = NULL; |
2228 | boolean_t replicated; |
2229 | |
2230 | ifa = (struct ifaddr *) in6ifa_ifpwithaddr(ifp, taddr); |
2231 | if (ifa == NULL) |
2232 | return m; |
2233 | |
2234 | replicated = FALSE; |
2235 | |
2236 | /* Get the ND6_IFF_REPLICATED flag. */ |
2237 | ndi = ND_IFINFO(ifp); |
2238 | if (ndi != NULL && ndi->initialized) { |
2239 | lck_mtx_lock(&ndi->lock); |
2240 | replicated = !!(ndi->flags & ND6_IFF_REPLICATED); |
2241 | lck_mtx_unlock(&ndi->lock); |
2242 | } |
2243 | |
2244 | if (replicated) { |
2245 | nd6log((LOG_INFO, "%s: ignoring duplicate NA on " |
2246 | "replicated interface %s\n" , __func__, if_name(ifp))); |
2247 | goto done; |
2248 | } |
2249 | |
2250 | /* Lock the interface address until done (see label below). */ |
2251 | IFA_LOCK(ifa); |
2252 | ia = (struct in6_ifaddr *) ifa; |
2253 | |
2254 | if (!(ia->ia6_flags & IN6_IFF_DADPROGRESS)) { |
2255 | IFA_UNLOCK(ifa); |
2256 | nd6log((LOG_INFO, "%s: ignoring duplicate NA on " |
2257 | "%s [DAD not in progress]\n" , __func__, |
2258 | if_name(ifp))); |
2259 | goto done; |
2260 | } |
2261 | |
2262 | /* Some sleep proxies improperly send the client's Ethernet address in |
2263 | * the target link-layer address option, so detect this by comparing |
2264 | * the L2-header source address, if we have seen it, with the target |
2265 | * address, and ignoring the NA if they don't match. |
2266 | */ |
2267 | if (lladdr != NULL && lladdrlen >= ETHER_ADDR_LEN) { |
2268 | struct ip6aux *ip6a = ip6_findaux(m); |
2269 | if (ip6a && (ip6a->ip6a_flags & IP6A_HASEEN) != 0 && |
2270 | bcmp(ip6a->ip6a_ehsrc, lladdr, ETHER_ADDR_LEN) != 0) { |
2271 | IFA_UNLOCK(ifa); |
2272 | nd6log((LOG_ERR, "%s: ignoring duplicate NA on %s " |
2273 | "[eh_src != tgtlladdr]\n" , __func__, if_name(ifp))); |
2274 | goto done; |
2275 | } |
2276 | } |
2277 | |
2278 | IFA_UNLOCK(ifa); |
2279 | |
2280 | dp = nd6_dad_find(ifa, NULL); |
2281 | if (dp == NULL) { |
2282 | nd6log((LOG_INFO, "%s: no DAD structure for %s on %s.\n" , |
2283 | __func__, ip6_sprintf(taddr), if_name(ifp))); |
2284 | goto done; |
2285 | } |
2286 | |
2287 | DAD_LOCK_SPIN(dp); |
2288 | if (lladdr != NULL && lladdrlen >= ETHER_ADDR_LEN) { |
2289 | memcpy(dp->dad_lladdr, lladdr, ETHER_ADDR_LEN); |
2290 | dp->dad_lladdrlen = lladdrlen; |
2291 | } |
2292 | dp->dad_na_icount++; |
2293 | DAD_UNLOCK(dp); |
2294 | DAD_REMREF(dp); |
2295 | |
2296 | /* remove the address. */ |
2297 | nd6log((LOG_INFO, |
2298 | "%s: duplicate IPv6 address %s [processing NA on %s]\n" , __func__, |
2299 | ip6_sprintf(taddr), if_name(ifp))); |
2300 | done: |
2301 | IFA_LOCK_ASSERT_NOTHELD(ifa); |
2302 | IFA_REMREF(ifa); |
2303 | m_freem(m); |
2304 | return NULL; |
2305 | } |
2306 | |
2307 | static void |
2308 | dad_addref(struct dadq *dp, int locked) |
2309 | { |
2310 | if (!locked) |
2311 | DAD_LOCK_SPIN(dp); |
2312 | else |
2313 | DAD_LOCK_ASSERT_HELD(dp); |
2314 | |
2315 | if (++dp->dad_refcount == 0) { |
2316 | panic("%s: dad %p wraparound refcnt\n" , __func__, dp); |
2317 | /* NOTREACHED */ |
2318 | } |
2319 | if (!locked) |
2320 | DAD_UNLOCK(dp); |
2321 | } |
2322 | |
2323 | static void |
2324 | dad_remref(struct dadq *dp) |
2325 | { |
2326 | struct ifaddr *ifa; |
2327 | |
2328 | DAD_LOCK_SPIN(dp); |
2329 | if (dp->dad_refcount == 0) |
2330 | panic("%s: dad %p negative refcnt\n" , __func__, dp); |
2331 | --dp->dad_refcount; |
2332 | if (dp->dad_refcount > 0) { |
2333 | DAD_UNLOCK(dp); |
2334 | return; |
2335 | } |
2336 | DAD_UNLOCK(dp); |
2337 | |
2338 | if (dp->dad_attached || |
2339 | dp->dad_list.tqe_next != NULL || dp->dad_list.tqe_prev != NULL) { |
2340 | panic("%s: attached dad=%p is being freed" , __func__, dp); |
2341 | /* NOTREACHED */ |
2342 | } |
2343 | |
2344 | if ((ifa = dp->dad_ifa) != NULL) { |
2345 | IFA_REMREF(ifa); /* drop dad_ifa reference */ |
2346 | dp->dad_ifa = NULL; |
2347 | } |
2348 | |
2349 | lck_mtx_destroy(&dp->dad_lock, ifa_mtx_grp); |
2350 | zfree(dad_zone, dp); |
2351 | } |
2352 | |
2353 | void |
2354 | nd6_llreach_set_reachable(struct ifnet *ifp, void *addr, unsigned int alen) |
2355 | { |
2356 | /* Nothing more to do if it's disabled */ |
2357 | if (nd6_llreach_base == 0) |
2358 | return; |
2359 | |
2360 | ifnet_llreach_set_reachable(ifp, ETHERTYPE_IPV6, addr, alen); |
2361 | } |
2362 | |
2363 | void |
2364 | nd6_alt_node_addr_decompose(struct ifnet *ifp, struct sockaddr *sa, |
2365 | struct sockaddr_dl* sdl, struct sockaddr_in6 *sin6) |
2366 | { |
2367 | static const size_t EUI64_LENGTH = 8; |
2368 | |
2369 | VERIFY(nd6_need_cache(ifp)); |
2370 | VERIFY(sa); |
2371 | VERIFY(sdl && (void *)sa != (void *)sdl); |
2372 | VERIFY(sin6 && (void *)sa != (void *)sin6); |
2373 | |
2374 | bzero(sin6, sizeof *sin6); |
2375 | sin6->sin6_len = sizeof *sin6; |
2376 | sin6->sin6_family = AF_INET6; |
2377 | |
2378 | bzero(sdl, sizeof *sdl); |
2379 | sdl->sdl_len = sizeof *sdl; |
2380 | sdl->sdl_family = AF_LINK; |
2381 | sdl->sdl_type = ifp->if_type; |
2382 | sdl->sdl_index = ifp->if_index; |
2383 | |
2384 | switch (sa->sa_family) { |
2385 | case AF_INET6: { |
2386 | struct sockaddr_in6 *sin6a = (struct sockaddr_in6 *)(void *)sa; |
2387 | struct in6_addr *in6 = &sin6a->sin6_addr; |
2388 | |
2389 | VERIFY(sa->sa_len == sizeof *sin6); |
2390 | |
2391 | sdl->sdl_nlen = strlen(ifp->if_name); |
2392 | bcopy(ifp->if_name, sdl->sdl_data, sdl->sdl_nlen); |
2393 | if (in6->s6_addr[11] == 0xff && in6->s6_addr[12] == 0xfe) { |
2394 | sdl->sdl_alen = ETHER_ADDR_LEN; |
2395 | LLADDR(sdl)[0] = (in6->s6_addr[8] ^ ND6_EUI64_UBIT); |
2396 | LLADDR(sdl)[1] = in6->s6_addr[9]; |
2397 | LLADDR(sdl)[2] = in6->s6_addr[10]; |
2398 | LLADDR(sdl)[3] = in6->s6_addr[13]; |
2399 | LLADDR(sdl)[4] = in6->s6_addr[14]; |
2400 | LLADDR(sdl)[5] = in6->s6_addr[15]; |
2401 | } else { |
2402 | sdl->sdl_alen = EUI64_LENGTH; |
2403 | bcopy(&in6->s6_addr[8], LLADDR(sdl), EUI64_LENGTH); |
2404 | } |
2405 | |
2406 | sdl->sdl_slen = 0; |
2407 | break; |
2408 | } |
2409 | case AF_LINK: { |
2410 | struct sockaddr_dl *sdla = (struct sockaddr_dl *)(void *)sa; |
2411 | struct in6_addr *in6 = &sin6->sin6_addr; |
2412 | caddr_t lla = LLADDR(sdla); |
2413 | |
2414 | VERIFY(sa->sa_len <= sizeof *sdl); |
2415 | bcopy(sa, sdl, sa->sa_len); |
2416 | |
2417 | sin6->sin6_scope_id = sdla->sdl_index; |
2418 | if (sin6->sin6_scope_id == 0) |
2419 | sin6->sin6_scope_id = ifp->if_index; |
2420 | in6->s6_addr[0] = 0xfe; |
2421 | in6->s6_addr[1] = 0x80; |
2422 | if (sdla->sdl_alen == EUI64_LENGTH) |
2423 | bcopy(lla, &in6->s6_addr[8], EUI64_LENGTH); |
2424 | else { |
2425 | VERIFY(sdla->sdl_alen == ETHER_ADDR_LEN); |
2426 | |
2427 | in6->s6_addr[8] = ((uint8_t) lla[0] ^ ND6_EUI64_UBIT); |
2428 | in6->s6_addr[9] = (uint8_t) lla[1]; |
2429 | in6->s6_addr[10] = (uint8_t) lla[2]; |
2430 | in6->s6_addr[11] = 0xff; |
2431 | in6->s6_addr[12] = 0xfe; |
2432 | in6->s6_addr[13] = (uint8_t) lla[3]; |
2433 | in6->s6_addr[14] = (uint8_t) lla[4]; |
2434 | in6->s6_addr[15] = (uint8_t) lla[5]; |
2435 | } |
2436 | |
2437 | break; |
2438 | } |
2439 | default: |
2440 | VERIFY(false); |
2441 | break; |
2442 | } |
2443 | } |
2444 | |
2445 | void |
2446 | nd6_alt_node_present(struct ifnet *ifp, struct sockaddr_in6 *sin6, |
2447 | struct sockaddr_dl *sdl, int32_t , int lqm, int npm) |
2448 | { |
2449 | struct rtentry *rt; |
2450 | struct llinfo_nd6 *ln; |
2451 | struct if_llreach *lr = NULL; |
2452 | const uint16_t temp_embedded_id = sin6->sin6_addr.s6_addr16[1]; |
2453 | |
2454 | if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr) && |
2455 | (temp_embedded_id == 0)) |
2456 | sin6->sin6_addr.s6_addr16[1] = htons(ifp->if_index); |
2457 | |
2458 | nd6_cache_lladdr(ifp, &sin6->sin6_addr, LLADDR(sdl), sdl->sdl_alen, |
2459 | ND_NEIGHBOR_ADVERT, 0); |
2460 | |
2461 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
2462 | lck_mtx_lock(rnh_lock); |
2463 | |
2464 | rt = rtalloc1_scoped_locked((struct sockaddr *)sin6, 1, 0, |
2465 | ifp->if_index); |
2466 | |
2467 | /* Restore the address that was passed to us */ |
2468 | if (temp_embedded_id == 0) |
2469 | sin6->sin6_addr.s6_addr16[1] = 0; |
2470 | |
2471 | if (rt != NULL) { |
2472 | RT_LOCK(rt); |
2473 | VERIFY(rt->rt_flags & RTF_LLINFO); |
2474 | VERIFY(rt->rt_llinfo); |
2475 | |
2476 | ln = rt->rt_llinfo; |
2477 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_REACHABLE); |
2478 | ln_setexpire(ln, 0); |
2479 | |
2480 | lr = ln->ln_llreach; |
2481 | if (lr) { |
2482 | IFLR_LOCK(lr); |
2483 | lr->lr_rssi = rssi; |
2484 | lr->lr_lqm = (int32_t) lqm; |
2485 | lr->lr_npm = (int32_t) npm; |
2486 | IFLR_UNLOCK(lr); |
2487 | } |
2488 | |
2489 | RT_UNLOCK(rt); |
2490 | RT_REMREF(rt); |
2491 | } |
2492 | |
2493 | lck_mtx_unlock(rnh_lock); |
2494 | |
2495 | if (rt == NULL) { |
2496 | log(LOG_ERR, "%s: failed to add/update host route to %s.\n" , |
2497 | __func__, ip6_sprintf(&sin6->sin6_addr)); |
2498 | } else { |
2499 | nd6log((LOG_DEBUG, "%s: host route to %s [lr=0x%llx]\n" , |
2500 | __func__, ip6_sprintf(&sin6->sin6_addr), |
2501 | (uint64_t)VM_KERNEL_ADDRPERM(lr))); |
2502 | } |
2503 | } |
2504 | |
2505 | void |
2506 | nd6_alt_node_absent(struct ifnet *ifp, struct sockaddr_in6 *sin6) |
2507 | { |
2508 | struct rtentry *rt; |
2509 | const uint16_t temp_embedded_id = sin6->sin6_addr.s6_addr16[1]; |
2510 | |
2511 | nd6log((LOG_DEBUG, "%s: host route to %s\n" , __func__, |
2512 | ip6_sprintf(&sin6->sin6_addr))); |
2513 | |
2514 | if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr) && |
2515 | (temp_embedded_id == 0)) |
2516 | sin6->sin6_addr.s6_addr16[1] = htons(ifp->if_index); |
2517 | |
2518 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
2519 | lck_mtx_lock(rnh_lock); |
2520 | |
2521 | rt = rtalloc1_scoped_locked((struct sockaddr *)sin6, 0, 0, |
2522 | ifp->if_index); |
2523 | |
2524 | /* Restore the address that was passed to us */ |
2525 | if (temp_embedded_id == 0) |
2526 | sin6->sin6_addr.s6_addr16[1] = 0; |
2527 | |
2528 | if (rt != NULL) { |
2529 | RT_LOCK(rt); |
2530 | |
2531 | if (!(rt->rt_flags & (RTF_CLONING|RTF_PRCLONING)) && |
2532 | (rt->rt_flags & (RTF_HOST|RTF_LLINFO|RTF_WASCLONED)) == |
2533 | (RTF_HOST|RTF_LLINFO|RTF_WASCLONED)) { |
2534 | rt->rt_flags |= RTF_CONDEMNED; |
2535 | RT_UNLOCK(rt); |
2536 | |
2537 | (void) rtrequest_locked(RTM_DELETE, rt_key(rt), |
2538 | (struct sockaddr *)NULL, rt_mask(rt), 0, |
2539 | (struct rtentry **)NULL); |
2540 | |
2541 | rtfree_locked(rt); |
2542 | } else { |
2543 | RT_REMREF_LOCKED(rt); |
2544 | RT_UNLOCK(rt); |
2545 | } |
2546 | } |
2547 | |
2548 | lck_mtx_unlock(rnh_lock); |
2549 | } |
2550 | |