1 | /* |
2 | * Copyright (c) 2000-2022 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* |
30 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
31 | * All rights reserved. |
32 | * |
33 | * Redistribution and use in source and binary forms, with or without |
34 | * modification, are permitted provided that the following conditions |
35 | * are met: |
36 | * 1. Redistributions of source code must retain the above copyright |
37 | * notice, this list of conditions and the following disclaimer. |
38 | * 2. Redistributions in binary form must reproduce the above copyright |
39 | * notice, this list of conditions and the following disclaimer in the |
40 | * documentation and/or other materials provided with the distribution. |
41 | * 3. Neither the name of the project nor the names of its contributors |
42 | * may be used to endorse or promote products derived from this software |
43 | * without specific prior written permission. |
44 | * |
45 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
46 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
47 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
48 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
49 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
50 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
51 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
52 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
53 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
54 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
55 | * SUCH DAMAGE. |
56 | */ |
57 | |
58 | #include <sys/param.h> |
59 | #include <sys/systm.h> |
60 | #include <sys/malloc.h> |
61 | #include <sys/mbuf.h> |
62 | #include <sys/socket.h> |
63 | #include <sys/sockio.h> |
64 | #include <sys/time.h> |
65 | #include <sys/kernel.h> |
66 | #include <sys/errno.h> |
67 | #include <sys/syslog.h> |
68 | #include <sys/sysctl.h> |
69 | #include <sys/mcache.h> |
70 | #include <sys/protosw.h> |
71 | #include <kern/queue.h> |
72 | #include <dev/random/randomdev.h> |
73 | |
74 | #include <kern/locks.h> |
75 | #include <kern/zalloc.h> |
76 | |
77 | #include <net/if.h> |
78 | #include <net/if_var.h> |
79 | #include <net/if_types.h> |
80 | #include <net/if_dl.h> |
81 | #include <net/if_llreach.h> |
82 | #include <net/route.h> |
83 | #include <net/dlil.h> |
84 | #include <net/nwk_wq.h> |
85 | |
86 | #include <netinet/in.h> |
87 | #include <netinet/in_var.h> |
88 | #include <netinet6/in6_var.h> |
89 | #include <netinet6/in6_ifattach.h> |
90 | #include <netinet/ip6.h> |
91 | #include <netinet6/ip6_var.h> |
92 | #include <netinet6/nd6.h> |
93 | #include <netinet6/scope6_var.h> |
94 | #include <netinet/icmp6.h> |
95 | |
96 | #if IPSEC |
97 | #include <netinet6/ipsec.h> |
98 | #include <netinet6/ipsec6.h> |
99 | #endif |
100 | |
101 | #include <net/sockaddr_utils.h> |
102 | |
103 | struct dadq; |
104 | static struct dadq *nd6_dad_find(struct ifaddr *, struct nd_opt_nonce *); |
105 | void nd6_dad_stoptimer(struct ifaddr *); |
106 | static void nd6_dad_timer(struct ifaddr *); |
107 | static void nd6_dad_ns_output(struct dadq *, struct ifaddr *); |
108 | static void nd6_dad_ns_input(struct ifaddr *, char *, int, struct nd_opt_nonce *); |
109 | static struct mbuf *nd6_dad_na_input(struct mbuf *, struct ifnet *, |
110 | struct in6_addr *, caddr_t, int); |
111 | static void dad_addref(struct dadq *, int); |
112 | static void dad_remref(struct dadq *); |
113 | static struct dadq *nd6_dad_attach(struct dadq *, struct ifaddr *); |
114 | static void nd6_dad_detach(struct dadq *, struct ifaddr *); |
115 | static void nd6_dad_duplicated(struct ifaddr *); |
116 | |
117 | static int dad_maxtry = 15; /* max # of *tries* to transmit DAD packet */ |
118 | |
119 | #define DAD_LOCK_ASSERT_HELD(_dp) \ |
120 | LCK_MTX_ASSERT(&(_dp)->dad_lock, LCK_MTX_ASSERT_OWNED) |
121 | |
122 | #define DAD_LOCK_ASSERT_NOTHELD(_dp) \ |
123 | LCK_MTX_ASSERT(&(_dp)->dad_lock, LCK_MTX_ASSERT_NOTOWNED) |
124 | |
125 | #define DAD_LOCK(_dp) \ |
126 | lck_mtx_lock(&(_dp)->dad_lock) |
127 | |
128 | #define DAD_LOCK_SPIN(_dp) \ |
129 | lck_mtx_lock_spin(&(_dp)->dad_lock) |
130 | |
131 | #define DAD_CONVERT_LOCK(_dp) do { \ |
132 | DAD_LOCK_ASSERT_HELD(_dp); \ |
133 | lck_mtx_convert_spin(&(_dp)->dad_lock); \ |
134 | } while (0) |
135 | |
136 | #define DAD_UNLOCK(_dp) \ |
137 | lck_mtx_unlock(&(_dp)->dad_lock) |
138 | |
139 | #define DAD_ADDREF(_dp) \ |
140 | dad_addref(_dp, 0) |
141 | |
142 | #define DAD_ADDREF_LOCKED(_dp) \ |
143 | dad_addref(_dp, 1) |
144 | |
145 | #define DAD_REMREF(_dp) \ |
146 | dad_remref(_dp) |
147 | |
148 | static LCK_MTX_DECLARE_ATTR(dad6_mutex, &ip6_mutex_grp, &ip6_mutex_attr); |
149 | |
150 | static struct sockaddr_in6 hostrtmask; |
151 | |
152 | static int nd6_llreach_base = 30; /* seconds */ |
153 | SYSCTL_DECL(_net_inet6_icmp6); |
154 | SYSCTL_INT(_net_inet6_icmp6, OID_AUTO, nd6_llreach_base, |
155 | CTLFLAG_RW | CTLFLAG_LOCKED, &nd6_llreach_base, 0, |
156 | "default ND6 link-layer reachability max lifetime (in seconds)" ); |
157 | |
158 | int dad_enhanced = ND6_DAD_ENHANCED_DEFAULT; |
159 | SYSCTL_DECL(_net_inet6_ip6); |
160 | SYSCTL_INT(_net_inet6_ip6, OID_AUTO, dad_enhanced, CTLFLAG_RW | CTLFLAG_LOCKED, |
161 | &dad_enhanced, 0, |
162 | "Enable Enhanced DAD, which adds a random nonce to NS messages for DAD." ); |
163 | |
164 | static uint32_t nd6_dad_nonce_max_count = 3; |
165 | SYSCTL_UINT(_net_inet6_ip6, OID_AUTO, nd6_dad_nonce_max_count, |
166 | CTLFLAG_RW | CTLFLAG_LOCKED, &nd6_dad_nonce_max_count, 0, "Number of times to ignore same nonce for DAD" ); |
167 | |
168 | #if DEBUG || DEVELOPMENT |
169 | static int ip6_p2p_debug = 0; |
170 | SYSCTL_INT(_net_inet6_ip6, OID_AUTO, ip6_p2p_debug, CTLFLAG_RW | CTLFLAG_LOCKED, |
171 | &ip6_p2p_debug, 0, |
172 | "Enable more instrumentation for IPv6 P2P use-case" ); |
173 | #endif |
174 | |
175 | /* |
176 | * Obtain a link-layer source cache entry for the sender. |
177 | * |
178 | * NOTE: This is currently only for ND6/Ethernet. |
179 | */ |
180 | void |
181 | nd6_llreach_alloc(struct rtentry *rt, struct ifnet *ifp, void *addr, |
182 | unsigned int alen, boolean_t solicited) |
183 | { |
184 | struct llinfo_nd6 *ln = rt->rt_llinfo; |
185 | |
186 | if (nd6_llreach_base != 0 && |
187 | (ln->ln_expire != 0 || (ifp->if_eflags & IFEF_IPV6_ND6ALT) != 0) && |
188 | !(rt->rt_ifp->if_flags & IFF_LOOPBACK) && |
189 | ifp->if_addrlen == IF_LLREACH_MAXLEN && /* Ethernet */ |
190 | alen == ifp->if_addrlen) { |
191 | struct if_llreach *lr; |
192 | const char *why = NULL, *type = "" ; |
193 | |
194 | /* Become a regular mutex, just in case */ |
195 | RT_CONVERT_LOCK(rt); |
196 | |
197 | if ((lr = ln->ln_llreach) != NULL) { |
198 | type = (solicited ? "ND6 advertisement" : |
199 | "ND6 unsolicited announcement" ); |
200 | /* |
201 | * If target has changed, create a new record; |
202 | * otherwise keep existing record. |
203 | */ |
204 | IFLR_LOCK(lr); |
205 | if (bcmp(s1: addr, s2: lr->lr_key.addr, n: alen) != 0) { |
206 | IFLR_UNLOCK(lr); |
207 | /* Purge any link-layer info caching */ |
208 | VERIFY(rt->rt_llinfo_purge != NULL); |
209 | rt->rt_llinfo_purge(rt); |
210 | lr = NULL; |
211 | why = " for different target HW address; " |
212 | "using new llreach record" ; |
213 | } else { |
214 | lr->lr_probes = 0; /* reset probe count */ |
215 | IFLR_UNLOCK(lr); |
216 | if (solicited) { |
217 | why = " for same target HW address; " |
218 | "keeping existing llreach record" ; |
219 | } |
220 | } |
221 | } |
222 | |
223 | if (lr == NULL) { |
224 | lr = ln->ln_llreach = ifnet_llreach_alloc(ifp, |
225 | ETHERTYPE_IPV6, addr, alen, nd6_llreach_base); |
226 | if (lr != NULL) { |
227 | lr->lr_probes = 0; /* reset probe count */ |
228 | if (why == NULL) { |
229 | why = "creating new llreach record" ; |
230 | } |
231 | } |
232 | } |
233 | |
234 | if (nd6_debug && lr != NULL && why != NULL) { |
235 | char tmp[MAX_IPv6_STR_LEN]; |
236 | |
237 | nd6log(debug, "%s: %s%s for %s\n" , if_name(ifp), |
238 | type, why, inet_ntop(AF_INET6, |
239 | &SIN6(rt_key(rt))->sin6_addr, tmp, sizeof(tmp))); |
240 | } |
241 | } |
242 | } |
243 | |
244 | void |
245 | nd6_llreach_use(struct llinfo_nd6 *ln) |
246 | { |
247 | if (ln->ln_llreach != NULL) { |
248 | ln->ln_lastused = net_uptime(); |
249 | } |
250 | } |
251 | |
252 | /* |
253 | * Input a Neighbor Solicitation Message. |
254 | * |
255 | * Based on RFC 4861 |
256 | * Based on RFC 4862 (duplicate address detection) |
257 | */ |
258 | void |
259 | nd6_ns_input( |
260 | struct mbuf *m, |
261 | int off, |
262 | int icmp6len) |
263 | { |
264 | struct ifnet *ifp = m->m_pkthdr.rcvif; |
265 | struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); |
266 | struct nd_neighbor_solicit *nd_ns = NULL; |
267 | struct in6_addr saddr6 = ip6->ip6_src; |
268 | struct in6_addr daddr6 = ip6->ip6_dst; |
269 | uint32_t saddr_ifscope = IN6_IS_SCOPE_EMBED(&saddr6) ? ip6_input_getsrcifscope(m) : IFSCOPE_NONE; |
270 | struct in6_addr taddr6 = {}; |
271 | struct in6_addr myaddr6 = {}; |
272 | uint32_t myaddr_ifscope = IFSCOPE_NONE; |
273 | char *lladdr = NULL; |
274 | struct ifaddr *ifa = NULL; |
275 | int lladdrlen = 0; |
276 | int anycast = 0, proxy = 0, dadprogress = 0; |
277 | int tlladdr = 0; |
278 | union nd_opts ndopts = {}; |
279 | struct sockaddr_dl proxydl = {}; |
280 | boolean_t advrouter = FALSE; |
281 | boolean_t is_dad_probe = FALSE; |
282 | int oflgclr = 0; |
283 | uint32_t taddr_ifscope; |
284 | |
285 | /* Expect 32-bit aligned data pointer on strict-align platforms */ |
286 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); |
287 | |
288 | IP6_EXTHDR_CHECK(m, off, icmp6len, return ); |
289 | ip6 = mtod(m, struct ip6_hdr *); |
290 | nd_ns = (struct nd_neighbor_solicit *)((caddr_t)ip6 + off); |
291 | m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE; |
292 | |
293 | taddr6 = nd_ns->nd_ns_target; |
294 | if (in6_setscope(&taddr6, ifp, &taddr_ifscope) != 0) { |
295 | goto bad; |
296 | } |
297 | |
298 | if (ip6->ip6_hlim != IPV6_MAXHLIM) { |
299 | nd6log(error, |
300 | "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n" , |
301 | ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src), |
302 | ip6_sprintf(&ip6->ip6_dst), if_name(ifp)); |
303 | goto bad; |
304 | } |
305 | |
306 | is_dad_probe = IN6_IS_ADDR_UNSPECIFIED(&saddr6); |
307 | if (is_dad_probe) { |
308 | /* dst has to be a solicited node multicast address. */ |
309 | if (daddr6.s6_addr16[0] == IPV6_ADDR_INT16_MLL && |
310 | /* don't check ifindex portion */ |
311 | daddr6.s6_addr32[1] == 0 && |
312 | daddr6.s6_addr32[2] == IPV6_ADDR_INT32_ONE && |
313 | daddr6.s6_addr8[12] == 0xff) { |
314 | ; /* good */ |
315 | } else { |
316 | nd6log(info, "nd6_ns_input: bad DAD packet " |
317 | "(wrong ip6 dst)\n" ); |
318 | goto bad; |
319 | } |
320 | } else if (!nd6_onlink_ns_rfc4861) { |
321 | struct sockaddr_in6 src_sa6; |
322 | |
323 | /* |
324 | * According to recent IETF discussions, it is not a good idea |
325 | * to accept a NS from an address which would not be deemed |
326 | * to be a neighbor otherwise. This point is expected to be |
327 | * clarified in future revisions of the specification. |
328 | */ |
329 | SOCKADDR_ZERO(&src_sa6, sizeof(src_sa6)); |
330 | src_sa6.sin6_family = AF_INET6; |
331 | src_sa6.sin6_len = sizeof(src_sa6); |
332 | src_sa6.sin6_addr = saddr6; |
333 | if (!in6_embedded_scope) { |
334 | src_sa6.sin6_scope_id = saddr_ifscope; |
335 | } |
336 | if (!nd6_is_addr_neighbor(&src_sa6, ifp, 0)) { |
337 | nd6log(info, "nd6_ns_input: " |
338 | "NS packet from non-neighbor\n" ); |
339 | goto bad; |
340 | } |
341 | } |
342 | |
343 | if (IN6_IS_ADDR_MULTICAST(&taddr6)) { |
344 | nd6log(info, "nd6_ns_input: bad NS target (multicast)\n" ); |
345 | goto bad; |
346 | } |
347 | |
348 | icmp6len -= sizeof(*nd_ns); |
349 | nd6_option_init(nd_ns + 1, icmp6len, &ndopts); |
350 | if (nd6_options(&ndopts) < 0) { |
351 | nd6log(info, |
352 | "nd6_ns_input: invalid ND option, ignored\n" ); |
353 | /* nd6_options have incremented stats */ |
354 | goto freeit; |
355 | } |
356 | |
357 | if (ndopts.nd_opts_src_lladdr) { |
358 | lladdr = (char *)(ndopts.nd_opts_src_lladdr + 1); |
359 | lladdrlen = ndopts.nd_opts_src_lladdr->nd_opt_len << 3; |
360 | } |
361 | |
362 | if (is_dad_probe && lladdr) { |
363 | nd6log(info, "nd6_ns_input: bad DAD packet " |
364 | "(link-layer address option)\n" ); |
365 | goto bad; |
366 | } |
367 | |
368 | /* |
369 | * Attaching target link-layer address to the NA? |
370 | * (RFC 2461 7.2.4) |
371 | * |
372 | * NS IP dst is unicast/anycast MUST NOT add |
373 | * NS IP dst is solicited-node multicast MUST add |
374 | * |
375 | * In implementation, we add target link-layer address by default. |
376 | * We do not add one in MUST NOT cases. |
377 | */ |
378 | if (!IN6_IS_ADDR_MULTICAST(&daddr6)) { |
379 | tlladdr = 0; |
380 | } else { |
381 | tlladdr = 1; |
382 | } |
383 | |
384 | /* |
385 | * Target address (taddr6) must be either: |
386 | * (1) Valid unicast/anycast address for my receiving interface, |
387 | * (2) Unicast address for which I'm offering proxy service, or |
388 | * (3) "tentative" or "optimistic" address [DAD is in progress]. |
389 | */ |
390 | /* (1) and (3) check. */ |
391 | ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6); |
392 | |
393 | /* (2) check. */ |
394 | if (ifa == NULL) { |
395 | struct rtentry *rt; |
396 | struct sockaddr_in6 tsin6; |
397 | |
398 | SOCKADDR_ZERO(&tsin6, sizeof tsin6); |
399 | tsin6.sin6_len = sizeof(struct sockaddr_in6); |
400 | tsin6.sin6_family = AF_INET6; |
401 | tsin6.sin6_addr = taddr6; |
402 | |
403 | rt = rtalloc1_scoped(SA(&tsin6), 0, 0, ifp->if_index); |
404 | |
405 | if (rt != NULL) { |
406 | RT_LOCK(rt); |
407 | if ((rt->rt_flags & RTF_ANNOUNCE) != 0 && |
408 | rt->rt_gateway->sa_family == AF_LINK) { |
409 | /* |
410 | * proxy NDP for single entry |
411 | */ |
412 | ifa = (struct ifaddr *)in6ifa_ifpforlinklocal( |
413 | ifp, IN6_IFF_NOTREADY | IN6_IFF_ANYCAST); |
414 | if (ifa) { |
415 | proxy = 1; |
416 | proxydl = *SDL(rt->rt_gateway); |
417 | } |
418 | } |
419 | RT_UNLOCK(rt); |
420 | rtfree(rt); |
421 | } |
422 | } |
423 | if (ifa == NULL && ip6_forwarding && nd6_prproxy) { |
424 | /* |
425 | * Is the target address part of the prefix that is being |
426 | * proxied and installed on another interface? |
427 | */ |
428 | ifa = (struct ifaddr *)in6ifa_prproxyaddr(&taddr6, taddr_ifscope); |
429 | } |
430 | if (ifa == NULL) { |
431 | /* |
432 | * We've got an NS packet, and we don't have that address |
433 | * assigned for us. We MUST silently ignore it on this |
434 | * interface, c.f. RFC 4861 7.2.3. |
435 | * |
436 | * Forwarding associated with NDPRF_PRPROXY may apply. |
437 | */ |
438 | if (ip6_forwarding && nd6_prproxy) { |
439 | nd6_prproxy_ns_input(ifp, &saddr6, lladdr, |
440 | lladdrlen, &daddr6, &taddr6, |
441 | nonce: (ndopts.nd_opts_nonce == NULL) ? NULL : |
442 | ndopts.nd_opts_nonce->nd_opt_nonce); |
443 | } |
444 | goto freeit; |
445 | } |
446 | IFA_LOCK(ifa); |
447 | myaddr6 = *IFA_IN6(ifa); |
448 | myaddr_ifscope = IFA_SIN6_SCOPE(ifa); |
449 | anycast = ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_ANYCAST; |
450 | dadprogress = |
451 | ((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DADPROGRESS; |
452 | if (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_DUPLICATED) { |
453 | IFA_UNLOCK(ifa); |
454 | goto freeit; |
455 | } |
456 | IFA_UNLOCK(ifa); |
457 | |
458 | if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { |
459 | nd6log(info, |
460 | "nd6_ns_input: lladdrlen mismatch for %s " |
461 | "(if %d, NS packet %d)\n" , |
462 | ip6_sprintf(&taddr6), ifp->if_addrlen, lladdrlen - 2); |
463 | goto bad; |
464 | } |
465 | |
466 | if (in6_are_addr_equal_scoped(&myaddr6, &saddr6, myaddr_ifscope, saddr_ifscope)) { |
467 | nd6log(info, |
468 | "nd6_ns_input: duplicate IP6 address %s\n" , |
469 | ip6_sprintf(&saddr6)); |
470 | goto freeit; |
471 | } |
472 | |
473 | /* |
474 | * We have neighbor solicitation packet, with target address equals to |
475 | * one of my DAD in-progress addresses. |
476 | * |
477 | * src addr how to process? |
478 | * --- --- |
479 | * multicast of course, invalid (rejected in ip6_input) |
480 | * unicast somebody is doing address resolution |
481 | * unspec dup address detection |
482 | * |
483 | * The processing is defined in the "draft standard" RFC 4862 (and by |
484 | * RFC 4429, which is a "proposed standard" update to its obsolete |
485 | * predecessor, RFC 2462) The reason optimistic DAD is not included |
486 | * in RFC 4862 is entirely due to IETF procedural considerations. |
487 | */ |
488 | if (dadprogress) { |
489 | /* |
490 | * If source address is unspecified address, it is for |
491 | * duplicate address detection. |
492 | * |
493 | * If not, the packet is for addess resolution; |
494 | * silently ignore it when not optimistic |
495 | * |
496 | * Per RFC 4429 the reply for an optimistic address must |
497 | * have the Override flag cleared |
498 | */ |
499 | if (!is_dad_probe && (dadprogress & IN6_IFF_OPTIMISTIC) != 0) { |
500 | oflgclr = 1; |
501 | } else { |
502 | if (is_dad_probe) { |
503 | nd6_dad_ns_input(ifa, lladdr, lladdrlen, ndopts.nd_opts_nonce); |
504 | } |
505 | |
506 | goto freeit; |
507 | } |
508 | } |
509 | |
510 | /* Are we an advertising router on this interface? */ |
511 | advrouter = (ifp->if_ipv6_router_mode != IPV6_ROUTER_MODE_DISABLED); |
512 | |
513 | /* |
514 | * If the source address is unspecified address, entries must not |
515 | * be created or updated. |
516 | * It looks that sender is performing DAD. If I'm using the address, |
517 | * and it's a "preferred" address, i.e. not optimistic, then output NA |
518 | * toward all-node multicast address, to tell the sender that I'm using |
519 | * the address. |
520 | * S bit ("solicited") must be zero. |
521 | */ |
522 | if (is_dad_probe) { |
523 | saddr6 = in6addr_linklocal_allnodes; |
524 | if (in6_setscope(&saddr6, ifp, NULL) != 0) { |
525 | goto bad; |
526 | } |
527 | if ((dadprogress & IN6_IFF_OPTIMISTIC) == 0) { |
528 | nd6_na_output(ifp, &saddr6, &taddr6, |
529 | ((anycast || proxy || !tlladdr) ? 0 : |
530 | ND_NA_FLAG_OVERRIDE) | (advrouter ? |
531 | ND_NA_FLAG_ROUTER : 0), tlladdr, proxy ? |
532 | SA(&proxydl) : NULL); |
533 | } |
534 | goto freeit; |
535 | } |
536 | |
537 | nd6_cache_lladdr(ifp, &saddr6, lladdr, lladdrlen, |
538 | ND_NEIGHBOR_SOLICIT, 0, NULL); |
539 | |
540 | nd6_na_output(ifp, &saddr6, &taddr6, |
541 | ((anycast || proxy || !tlladdr || oflgclr) ? 0 : ND_NA_FLAG_OVERRIDE) | |
542 | (advrouter ? ND_NA_FLAG_ROUTER : 0) | ND_NA_FLAG_SOLICITED, |
543 | tlladdr, proxy ? SA(&proxydl) : NULL); |
544 | freeit: |
545 | m_freem(m); |
546 | if (ifa != NULL) { |
547 | ifa_remref(ifa); |
548 | } |
549 | return; |
550 | |
551 | bad: |
552 | nd6log(error, "nd6_ns_input: src=%s\n" , ip6_sprintf(&saddr6)); |
553 | nd6log(error, "nd6_ns_input: dst=%s\n" , ip6_sprintf(&daddr6)); |
554 | nd6log(error, "nd6_ns_input: tgt=%s\n" , ip6_sprintf(&taddr6)); |
555 | icmp6stat.icp6s_badns++; |
556 | m_freem(m); |
557 | if (ifa != NULL) { |
558 | ifa_remref(ifa); |
559 | } |
560 | } |
561 | |
562 | /* |
563 | * Output a Neighbor Solicitation Message. Caller specifies: |
564 | * - ICMP6 header source IP6 address |
565 | * - ND6 header target IP6 address |
566 | * - ND6 header source datalink address |
567 | * |
568 | * Based on RFC 4861 |
569 | * Based on RFC 4862 (duplicate address detection) |
570 | * Based on RFC 4429 (optimistic duplicate address detection) |
571 | * |
572 | * Caller must bump up ln->ln_rt refcnt to make sure 'ln' doesn't go |
573 | * away if there is a llinfo_nd6 passed in. |
574 | */ |
575 | void |
576 | nd6_ns_output( |
577 | struct ifnet *ifp, |
578 | const struct in6_addr *daddr6, |
579 | const struct in6_addr *taddr6, |
580 | struct llinfo_nd6 *ln, /* for source address determination */ |
581 | uint8_t *nonce) /* duplicated address detection */ |
582 | { |
583 | struct mbuf *m; |
584 | struct ip6_hdr *ip6; |
585 | struct nd_neighbor_solicit *nd_ns; |
586 | struct in6_ifaddr *ia = NULL; |
587 | struct in6_addr *src, src_in, src_storage; |
588 | struct ip6_moptions *im6o = NULL; |
589 | struct ifnet *outif = NULL; |
590 | int icmp6len; |
591 | int maxlen; |
592 | int flags; |
593 | caddr_t mac; |
594 | struct route_in6 ro; |
595 | struct ip6_out_args ip6oa; |
596 | u_int32_t rtflags = 0; |
597 | boolean_t is_optimistic = FALSE; |
598 | |
599 | if ((ifp->if_eflags & IFEF_IPV6_ND6ALT) || IN6_IS_ADDR_MULTICAST(taddr6)) { |
600 | return; |
601 | } |
602 | |
603 | bzero(s: &ro, n: sizeof(ro)); |
604 | bzero(s: &ip6oa, n: sizeof(ip6oa)); |
605 | ip6oa.ip6oa_boundif = ifp->if_index; |
606 | ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR | |
607 | IP6OAF_AWDL_UNRESTRICTED | IP6OAF_INTCOPROC_ALLOWED | |
608 | IP6OAF_MANAGEMENT_ALLOWED; |
609 | ip6oa.ip6oa_sotc = SO_TC_UNSPEC; |
610 | ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC; |
611 | |
612 | ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF; |
613 | |
614 | /* estimate the size of message */ |
615 | maxlen = sizeof(*ip6) + sizeof(*nd_ns); |
616 | maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; |
617 | if (max_linkhdr + maxlen >= MCLBYTES) { |
618 | #if DIAGNOSTIC |
619 | printf("nd6_ns_output: max_linkhdr + maxlen >= MCLBYTES " |
620 | "(%d + %d > %d)\n" , max_linkhdr, maxlen, MCLBYTES); |
621 | #endif |
622 | return; |
623 | } |
624 | |
625 | MGETHDR(m, M_DONTWAIT, MT_DATA); /* XXXMAC: mac_create_mbuf_linklayer() probably */ |
626 | if (m && max_linkhdr + maxlen >= MHLEN) { |
627 | MCLGET(m, M_DONTWAIT); |
628 | if ((m->m_flags & M_EXT) == 0) { |
629 | m_free(m); |
630 | m = NULL; |
631 | } |
632 | } |
633 | if (m == NULL) { |
634 | return; |
635 | } |
636 | m->m_pkthdr.rcvif = NULL; |
637 | |
638 | if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) { |
639 | m->m_flags |= M_MCAST; |
640 | |
641 | im6o = ip6_allocmoptions(Z_NOWAIT); |
642 | if (im6o == NULL) { |
643 | m_freem(m); |
644 | return; |
645 | } |
646 | |
647 | im6o->im6o_multicast_ifp = ifp; |
648 | im6o->im6o_multicast_hlim = IPV6_MAXHLIM; |
649 | im6o->im6o_multicast_loop = 0; |
650 | } |
651 | |
652 | icmp6len = sizeof(*nd_ns); |
653 | m->m_pkthdr.len = m->m_len = sizeof(*ip6) + icmp6len; |
654 | m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ |
655 | |
656 | /* fill neighbor solicitation packet */ |
657 | ip6 = mtod(m, struct ip6_hdr *); |
658 | ip6->ip6_flow = 0; |
659 | ip6->ip6_vfc &= ~IPV6_VERSION_MASK; |
660 | ip6->ip6_vfc |= IPV6_VERSION; |
661 | /* ip6->ip6_plen will be set later */ |
662 | ip6->ip6_nxt = IPPROTO_ICMPV6; |
663 | ip6->ip6_hlim = IPV6_MAXHLIM; |
664 | if (daddr6) { |
665 | ip6->ip6_dst = *daddr6; |
666 | ip6_output_setdstifscope(m, ifp->if_index, NULL); |
667 | } else { |
668 | ip6->ip6_dst.s6_addr16[0] = IPV6_ADDR_INT16_MLL; |
669 | ip6->ip6_dst.s6_addr16[1] = 0; |
670 | ip6->ip6_dst.s6_addr32[1] = 0; |
671 | ip6->ip6_dst.s6_addr32[2] = IPV6_ADDR_INT32_ONE; |
672 | ip6->ip6_dst.s6_addr32[3] = taddr6->s6_addr32[3]; |
673 | ip6->ip6_dst.s6_addr8[12] = 0xff; |
674 | ip6_output_setdstifscope(m, ifp->if_index, NULL); |
675 | if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0) { |
676 | goto bad; |
677 | } |
678 | } |
679 | if (nonce == NULL) { |
680 | /* |
681 | * RFC2461 7.2.2: |
682 | * "If the source address of the packet prompting the |
683 | * solicitation is the same as one of the addresses assigned |
684 | * to the outgoing interface, that address SHOULD be placed |
685 | * in the IP Source Address of the outgoing solicitation. |
686 | * Otherwise, any one of the addresses assigned to the |
687 | * interface should be used." |
688 | * |
689 | * We use the source address for the prompting packet |
690 | * (saddr6), if: |
691 | * - saddr6 is given from the caller (by giving "ln"), and |
692 | * - saddr6 belongs to the outgoing interface. |
693 | * Otherwise, we perform the source address selection as usual. |
694 | */ |
695 | struct ip6_hdr *hip6; /* hold ip6 */ |
696 | struct in6_addr *hsrc = NULL; |
697 | |
698 | /* Caller holds ref on this route */ |
699 | if (ln != NULL) { |
700 | RT_LOCK(ln->ln_rt); |
701 | /* |
702 | * assuming every packet in ln_hold has the same IP |
703 | * header |
704 | */ |
705 | if (ln->ln_hold != NULL) { |
706 | hip6 = mtod(ln->ln_hold, struct ip6_hdr *); |
707 | /* XXX pullup? */ |
708 | if (sizeof(*hip6) < ln->ln_hold->m_len) { |
709 | hsrc = &hip6->ip6_src; |
710 | } else { |
711 | hsrc = NULL; |
712 | } |
713 | } |
714 | /* Update probe count, if applicable */ |
715 | if (ln->ln_llreach != NULL) { |
716 | IFLR_LOCK_SPIN(ln->ln_llreach); |
717 | ln->ln_llreach->lr_probes++; |
718 | IFLR_UNLOCK(ln->ln_llreach); |
719 | } |
720 | rtflags = ln->ln_rt->rt_flags; |
721 | RT_UNLOCK(ln->ln_rt); |
722 | } |
723 | if (hsrc != NULL && (ia = in6ifa_ifpwithaddr(ifp, hsrc)) && |
724 | (ia->ia6_flags & IN6_IFF_OPTIMISTIC) == 0) { |
725 | src = hsrc; |
726 | } else { |
727 | int error; |
728 | struct sockaddr_in6 dst_sa; |
729 | |
730 | SOCKADDR_ZERO(&dst_sa, sizeof(dst_sa)); |
731 | dst_sa.sin6_family = AF_INET6; |
732 | dst_sa.sin6_len = sizeof(dst_sa); |
733 | dst_sa.sin6_addr = ip6->ip6_dst; |
734 | |
735 | src = in6_selectsrc(&dst_sa, NULL, |
736 | NULL, &ro, NULL, &src_storage, ip6oa.ip6oa_boundif, |
737 | &error); |
738 | if (src == NULL) { |
739 | nd6log(debug, |
740 | "nd6_ns_output: source can't be " |
741 | "determined: dst=%s, error=%d\n" , |
742 | ip6_sprintf(&dst_sa.sin6_addr), |
743 | error); |
744 | goto bad; |
745 | } |
746 | |
747 | if (ia != NULL) { |
748 | ifa_remref(ifa: &ia->ia_ifa); |
749 | ia = NULL; |
750 | } |
751 | /* |
752 | * RFC 4429 section 3.2: |
753 | * When a node has a unicast packet to send |
754 | * from an Optimistic Address to a neighbor, |
755 | * but does not know the neighbor's link-layer |
756 | * address, it MUST NOT perform Address |
757 | * Resolution. |
758 | */ |
759 | ia = in6ifa_ifpwithaddr(ifp, src); |
760 | if (ia == NULL) { |
761 | nd6log(debug, |
762 | "nd6_ns_output: no preferred source " |
763 | "available: dst=%s\n" , |
764 | ip6_sprintf(&dst_sa.sin6_addr)); |
765 | goto bad; |
766 | } |
767 | if (ia->ia6_flags & IN6_IFF_OPTIMISTIC) { |
768 | is_optimistic = TRUE; |
769 | nd6log(debug, |
770 | "nd6_ns_output: preferred source " |
771 | "available is optimistic: dst=%s\n" , |
772 | ip6_sprintf(&dst_sa.sin6_addr)); |
773 | } |
774 | } |
775 | } else { |
776 | /* |
777 | * Source address for DAD packet must always be IPv6 |
778 | * unspecified address. (0::0) |
779 | * We actually don't have to 0-clear the address (we did it |
780 | * above), but we do so here explicitly to make the intention |
781 | * clearer. |
782 | */ |
783 | bzero(s: &src_in, n: sizeof(src_in)); |
784 | src = &src_in; |
785 | ip6oa.ip6oa_flags &= ~IP6OAF_BOUND_SRCADDR; |
786 | } |
787 | ip6->ip6_src = *src; |
788 | ip6_output_setsrcifscope(m, ifp->if_index, ia); |
789 | nd_ns = (struct nd_neighbor_solicit *)(ip6 + 1); |
790 | nd_ns->nd_ns_type = ND_NEIGHBOR_SOLICIT; |
791 | nd_ns->nd_ns_code = 0; |
792 | nd_ns->nd_ns_reserved = 0; |
793 | nd_ns->nd_ns_target = *taddr6; |
794 | in6_clearscope(&nd_ns->nd_ns_target); /* XXX */ |
795 | |
796 | /* |
797 | * Add source link-layer address option. |
798 | * |
799 | * spec implementation |
800 | * --- --- |
801 | * DAD packet MUST NOT do not add the option |
802 | * Source is optimistic MUST NOT do not add the option |
803 | * there's no link layer address: |
804 | * impossible do not add the option |
805 | * there's link layer address: |
806 | * Multicast NS MUST add one add the option |
807 | * Unicast NS SHOULD add one add the option |
808 | * |
809 | * XXX We deviate from RFC 4429 and still use optimistic DAD as source |
810 | * for address resolution. However to ensure that we do not interfere |
811 | * with neighbor cache entries of other neighbors, we MUST ensure |
812 | * that SLLAO is not sent. Also note, sending multicast NS without SLLAO |
813 | * is also a deviation from RFC 4861. |
814 | */ |
815 | if (nonce == NULL && (mac = nd6_ifptomac(ifp)) && !is_optimistic) { |
816 | int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; |
817 | struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1); |
818 | /* 8 byte alignments... */ |
819 | optlen = (optlen + 7) & ~7; |
820 | |
821 | m->m_pkthdr.len += optlen; |
822 | m->m_len += optlen; |
823 | icmp6len += optlen; |
824 | bzero(s: (caddr_t)nd_opt, n: optlen); |
825 | nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR; |
826 | nd_opt->nd_opt_len = (uint8_t)(optlen >> 3); |
827 | bcopy(src: mac, dst: (caddr_t)(nd_opt + 1), n: ifp->if_addrlen); |
828 | } |
829 | /* |
830 | * Add a Nonce option (RFC 3971) to detect looped back NS messages. |
831 | * This behavior is documented as Enhanced Duplicate Address |
832 | * Detection in draft-ietf-6man-enhanced-dad-13. |
833 | * net.inet6.ip6.dad_enhanced=0 disables this. |
834 | */ |
835 | if (dad_enhanced != 0 && nonce != NULL && !(ifp->if_flags & IFF_POINTOPOINT)) { |
836 | int optlen = sizeof(struct nd_opt_hdr) + ND_OPT_NONCE_LEN; |
837 | struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1); |
838 | /* 8-byte alignment is required. */ |
839 | optlen = (optlen + 7) & ~7; |
840 | |
841 | m->m_pkthdr.len += optlen; |
842 | m->m_len += optlen; |
843 | icmp6len += optlen; |
844 | bzero(s: (caddr_t)nd_opt, n: optlen); |
845 | nd_opt->nd_opt_type = ND_OPT_NONCE; |
846 | nd_opt->nd_opt_len = (uint8_t)(optlen >> 3); |
847 | bcopy(src: nonce, dst: (caddr_t)(nd_opt + 1), ND_OPT_NONCE_LEN); |
848 | } |
849 | ip6->ip6_plen = htons((u_short)icmp6len); |
850 | nd_ns->nd_ns_cksum = 0; |
851 | nd_ns->nd_ns_cksum |
852 | = in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len); |
853 | |
854 | flags = nonce ? IPV6_UNSPECSRC : 0; |
855 | flags |= IPV6_OUTARGS; |
856 | |
857 | /* |
858 | * PKTF_{INET,INET6}_RESOLVE_RTR are mutually exclusive, so make |
859 | * sure only one of them is set (just in case.) |
860 | */ |
861 | m->m_pkthdr.pkt_flags &= ~(PKTF_INET_RESOLVE | PKTF_RESOLVE_RTR); |
862 | m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE; |
863 | /* |
864 | * If this is a NS for resolving the (default) router, mark |
865 | * the packet accordingly so that the driver can find out, |
866 | * in case it needs to perform driver-specific action(s). |
867 | */ |
868 | if (rtflags & RTF_ROUTER) { |
869 | m->m_pkthdr.pkt_flags |= PKTF_RESOLVE_RTR; |
870 | } |
871 | |
872 | if (ifp->if_eflags & IFEF_TXSTART) { |
873 | /* |
874 | * Use control service class if the interface |
875 | * supports transmit-start model |
876 | */ |
877 | (void) m_set_service_class(m, MBUF_SC_CTL); |
878 | } |
879 | |
880 | ip6oa.ip6oa_flags |= IP6OAF_SKIP_PF; |
881 | ip6oa.ip6oa_flags |= IP6OAF_DONT_FRAG; |
882 | ip6_output(m, NULL, NULL, flags, im6o, &outif, &ip6oa); |
883 | if (outif) { |
884 | icmp6_ifstat_inc(outif, ifs6_out_msg); |
885 | icmp6_ifstat_inc(outif, ifs6_out_neighborsolicit); |
886 | ifnet_release(interface: outif); |
887 | } |
888 | icmp6stat.icp6s_outhist[ND_NEIGHBOR_SOLICIT]++; |
889 | |
890 | exit: |
891 | if (im6o != NULL) { |
892 | IM6O_REMREF(im6o); |
893 | } |
894 | |
895 | ROUTE_RELEASE(&ro); /* we don't cache this route. */ |
896 | |
897 | if (ia != NULL) { |
898 | ifa_remref(ifa: &ia->ia_ifa); |
899 | } |
900 | return; |
901 | |
902 | bad: |
903 | m_freem(m); |
904 | goto exit; |
905 | } |
906 | |
907 | /* |
908 | * Neighbor advertisement input handling. |
909 | * |
910 | * Based on RFC 4861 |
911 | * Based on RFC 4862 (duplicate address detection) |
912 | * |
913 | * the following items are not implemented yet: |
914 | * - anycast advertisement delay rule (RFC 4861 7.2.7, SHOULD) |
915 | * - proxy advertisement delay rule (RFC 4861 7.2.8, last paragraph, "should") |
916 | */ |
917 | void |
918 | nd6_na_input(struct mbuf *m, int off, int icmp6len) |
919 | { |
920 | struct ifnet *ifp = m->m_pkthdr.rcvif; |
921 | struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); |
922 | struct nd_neighbor_advert *nd_na; |
923 | struct in6_addr saddr6 = ip6->ip6_src; |
924 | struct in6_addr daddr6 = ip6->ip6_dst; |
925 | struct in6_addr taddr6; |
926 | int flags; |
927 | int is_router; |
928 | int is_solicited; |
929 | int is_override; |
930 | char *lladdr = NULL; |
931 | int lladdrlen = 0; |
932 | struct llinfo_nd6 *ln; |
933 | struct rtentry *rt; |
934 | struct sockaddr_dl *sdl; |
935 | union nd_opts ndopts; |
936 | uint64_t timenow; |
937 | bool send_nc_alive_kev = false; |
938 | |
939 | if ((ifp->if_eflags & IFEF_IPV6_ND6ALT) != 0) { |
940 | nd6log(info, "nd6_na_input: on ND6ALT interface!\n" ); |
941 | goto freeit; |
942 | } |
943 | |
944 | /* Expect 32-bit aligned data pointer on strict-align platforms */ |
945 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); |
946 | |
947 | if (ip6->ip6_hlim != IPV6_MAXHLIM) { |
948 | nd6log(error, |
949 | "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n" , |
950 | ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src), |
951 | ip6_sprintf(&ip6->ip6_dst), if_name(ifp)); |
952 | goto bad; |
953 | } |
954 | |
955 | IP6_EXTHDR_CHECK(m, off, icmp6len, return ); |
956 | ip6 = mtod(m, struct ip6_hdr *); |
957 | nd_na = (struct nd_neighbor_advert *)((caddr_t)ip6 + off); |
958 | m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE; |
959 | |
960 | flags = nd_na->nd_na_flags_reserved; |
961 | is_router = ((flags & ND_NA_FLAG_ROUTER) != 0); |
962 | is_solicited = ((flags & ND_NA_FLAG_SOLICITED) != 0); |
963 | is_override = ((flags & ND_NA_FLAG_OVERRIDE) != 0); |
964 | |
965 | taddr6 = nd_na->nd_na_target; |
966 | if (in6_setscope(&taddr6, ifp, NULL)) { |
967 | goto bad; /* XXX: impossible */ |
968 | } |
969 | if (IN6_IS_ADDR_MULTICAST(&taddr6)) { |
970 | nd6log(error, |
971 | "nd6_na_input: invalid target address %s\n" , |
972 | ip6_sprintf(&taddr6)); |
973 | goto bad; |
974 | } |
975 | if (IN6_IS_ADDR_MULTICAST(&daddr6)) { |
976 | if (is_solicited) { |
977 | nd6log(error, |
978 | "nd6_na_input: a solicited adv is multicasted\n" ); |
979 | goto bad; |
980 | } |
981 | } |
982 | |
983 | icmp6len -= sizeof(*nd_na); |
984 | nd6_option_init(nd_na + 1, icmp6len, &ndopts); |
985 | if (nd6_options(&ndopts) < 0) { |
986 | nd6log(info, |
987 | "nd6_na_input: invalid ND option, ignored\n" ); |
988 | /* nd6_options have incremented stats */ |
989 | goto freeit; |
990 | } |
991 | |
992 | if (ndopts.nd_opts_tgt_lladdr) { |
993 | lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1); |
994 | lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3; |
995 | |
996 | if (((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) { |
997 | nd6log(info, |
998 | "nd6_na_input: lladdrlen mismatch for %s " |
999 | "(if %d, NA packet %d)\n" , |
1000 | ip6_sprintf(&taddr6), ifp->if_addrlen, |
1001 | lladdrlen - 2); |
1002 | goto bad; |
1003 | } |
1004 | } |
1005 | |
1006 | m = nd6_dad_na_input(m, ifp, &taddr6, lladdr, lladdrlen); |
1007 | if (m == NULL) { |
1008 | return; |
1009 | } |
1010 | |
1011 | /* Forwarding associated with NDPRF_PRPROXY may apply. */ |
1012 | if (ip6_forwarding && nd6_prproxy) { |
1013 | nd6_prproxy_na_input(ifp, &saddr6, &daddr6, &taddr6, flags); |
1014 | } |
1015 | |
1016 | /* |
1017 | * If no neighbor cache entry is found, NA SHOULD silently be |
1018 | * discarded. If we are forwarding (and Scoped Routing is in |
1019 | * effect), try to see if there is a neighbor cache entry on |
1020 | * another interface (in case we are doing prefix proxying.) |
1021 | */ |
1022 | if ((rt = nd6_lookup(&taddr6, 0, ifp, 0)) == NULL) { |
1023 | if (!ip6_forwarding || !nd6_prproxy) { |
1024 | goto freeit; |
1025 | } |
1026 | |
1027 | if ((rt = nd6_lookup(&taddr6, 0, NULL, 0)) == NULL) { |
1028 | goto freeit; |
1029 | } |
1030 | |
1031 | RT_LOCK_ASSERT_HELD(rt); |
1032 | if (rt->rt_ifp != ifp) { |
1033 | /* |
1034 | * Purge any link-layer info caching. |
1035 | */ |
1036 | if (rt->rt_llinfo_purge != NULL) { |
1037 | rt->rt_llinfo_purge(rt); |
1038 | } |
1039 | |
1040 | /* Adjust route ref count for the interfaces */ |
1041 | if (rt->rt_if_ref_fn != NULL) { |
1042 | rt->rt_if_ref_fn(ifp, 1); |
1043 | rt->rt_if_ref_fn(rt->rt_ifp, -1); |
1044 | } |
1045 | |
1046 | /* Change the interface when the existing route is on */ |
1047 | rt->rt_ifp = ifp; |
1048 | |
1049 | /* |
1050 | * If rmx_mtu is not locked, update it |
1051 | * to the MTU used by the new interface. |
1052 | */ |
1053 | if (!(rt->rt_rmx.rmx_locks & RTV_MTU)) { |
1054 | rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu; |
1055 | } |
1056 | } |
1057 | } |
1058 | |
1059 | RT_LOCK_ASSERT_HELD(rt); |
1060 | if ((ln = rt->rt_llinfo) == NULL || |
1061 | (sdl = SDL(rt->rt_gateway)) == NULL) { |
1062 | RT_REMREF_LOCKED(rt); |
1063 | RT_UNLOCK(rt); |
1064 | goto freeit; |
1065 | } |
1066 | |
1067 | timenow = net_uptime(); |
1068 | |
1069 | if (ln->ln_state == ND6_LLINFO_INCOMPLETE) { |
1070 | /* |
1071 | * If the link-layer has address, and no lladdr option came, |
1072 | * discard the packet. |
1073 | */ |
1074 | if (ifp->if_addrlen && !lladdr) { |
1075 | RT_REMREF_LOCKED(rt); |
1076 | RT_UNLOCK(rt); |
1077 | goto freeit; |
1078 | } |
1079 | |
1080 | /* |
1081 | * Record link-layer address, and update the state. |
1082 | */ |
1083 | sdl->sdl_alen = ifp->if_addrlen; |
1084 | bcopy(src: lladdr, LLADDR(sdl), n: ifp->if_addrlen); |
1085 | if (is_solicited) { |
1086 | send_nc_alive_kev = (rt->rt_flags & RTF_ROUTER) ? true : false; |
1087 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_REACHABLE); |
1088 | if (ln->ln_expire != 0) { |
1089 | struct nd_ifinfo *ndi = NULL; |
1090 | |
1091 | ndi = ND_IFINFO(rt->rt_ifp); |
1092 | VERIFY(ndi != NULL && ndi->initialized); |
1093 | lck_mtx_lock(lck: &ndi->lock); |
1094 | ln_setexpire(ln, timenow + ndi->reachable); |
1095 | lck_mtx_unlock(lck: &ndi->lock); |
1096 | RT_UNLOCK(rt); |
1097 | lck_mtx_lock(rnh_lock); |
1098 | nd6_sched_timeout(NULL, NULL); |
1099 | lck_mtx_unlock(rnh_lock); |
1100 | RT_LOCK(rt); |
1101 | } |
1102 | } else { |
1103 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_STALE); |
1104 | ln_setexpire(ln, timenow + nd6_gctimer); |
1105 | } |
1106 | |
1107 | /* |
1108 | * Enqueue work item to invoke callback for this |
1109 | * route entry |
1110 | */ |
1111 | route_event_enqueue_nwk_wq_entry(rt, NULL, |
1112 | ROUTE_LLENTRY_RESOLVED, NULL, TRUE); |
1113 | |
1114 | if ((ln->ln_router = (short)is_router) != 0) { |
1115 | struct radix_node_head *rnh = NULL; |
1116 | struct in6_addr rt_addr = SIN6(rt_key(rt))->sin6_addr; |
1117 | struct ifnet *rt_ifp = rt->rt_ifp; |
1118 | |
1119 | struct route_event rt_ev; |
1120 | route_event_init(p_route_ev: &rt_ev, rt, NULL, route_ev_code: ROUTE_LLENTRY_RESOLVED); |
1121 | /* |
1122 | * This means a router's state has changed from |
1123 | * non-reachable to probably reachable, and might |
1124 | * affect the status of associated prefixes.. |
1125 | * We already have a reference on rt. Don't need to |
1126 | * take one for the unlock/lock. |
1127 | */ |
1128 | RT_UNLOCK(rt); |
1129 | defrouter_set_reachability(&rt_addr, rt_ifp, TRUE); |
1130 | lck_mtx_lock(rnh_lock); |
1131 | rnh = rt_tables[AF_INET6]; |
1132 | |
1133 | if (rnh != NULL) { |
1134 | (void) rnh->rnh_walktree(rnh, route_event_walktree, |
1135 | (void *)&rt_ev); |
1136 | } |
1137 | lck_mtx_unlock(rnh_lock); |
1138 | lck_mtx_lock(nd6_mutex); |
1139 | pfxlist_onlink_check(); |
1140 | lck_mtx_unlock(nd6_mutex); |
1141 | RT_LOCK(rt); |
1142 | } |
1143 | } else { |
1144 | int llchange = 0; |
1145 | |
1146 | /* |
1147 | * Check if the link-layer address has changed or not. |
1148 | */ |
1149 | if (lladdr == NULL) { |
1150 | llchange = 0; |
1151 | } else { |
1152 | if (sdl->sdl_alen) { |
1153 | if (bcmp(s1: lladdr, LLADDR(sdl), n: ifp->if_addrlen)) { |
1154 | llchange = 1; |
1155 | } else { |
1156 | llchange = 0; |
1157 | } |
1158 | } else { |
1159 | llchange = 1; |
1160 | } |
1161 | } |
1162 | |
1163 | /* |
1164 | * This is VERY complex. Look at it with care. |
1165 | * |
1166 | * override solicit lladdr llchange action |
1167 | * (L: record lladdr) |
1168 | * |
1169 | * 0 0 n -- (2c) |
1170 | * 0 0 y n (2b) L |
1171 | * 0 0 y y (1) REACHABLE->STALE |
1172 | * 0 1 n -- (2c) *->REACHABLE |
1173 | * 0 1 y n (2b) L *->REACHABLE |
1174 | * 0 1 y y (1) REACHABLE->STALE |
1175 | * 1 0 n -- (2a) |
1176 | * 1 0 y n (2a) L |
1177 | * 1 0 y y (2a) L *->STALE |
1178 | * 1 1 n -- (2a) *->REACHABLE |
1179 | * 1 1 y n (2a) L *->REACHABLE |
1180 | * 1 1 y y (2a) L *->REACHABLE |
1181 | */ |
1182 | if (!is_override && (lladdr != NULL && llchange)) { /* (1) */ |
1183 | /* |
1184 | * If state is REACHABLE, make it STALE. |
1185 | * no other updates should be done. |
1186 | */ |
1187 | if (ln->ln_state == ND6_LLINFO_REACHABLE) { |
1188 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_STALE); |
1189 | ln_setexpire(ln, timenow + nd6_gctimer); |
1190 | } |
1191 | RT_REMREF_LOCKED(rt); |
1192 | RT_UNLOCK(rt); |
1193 | goto freeit; |
1194 | } else if (is_override /* (2a) */ |
1195 | || (!is_override && (lladdr && !llchange)) /* (2b) */ |
1196 | || !lladdr) { /* (2c) */ |
1197 | /* |
1198 | * Update link-local address, if any. |
1199 | */ |
1200 | if (lladdr) { |
1201 | sdl->sdl_alen = ifp->if_addrlen; |
1202 | bcopy(src: lladdr, LLADDR(sdl), n: ifp->if_addrlen); |
1203 | } |
1204 | |
1205 | /* |
1206 | * If solicited, make the state REACHABLE. |
1207 | * If not solicited and the link-layer address was |
1208 | * changed, make it STALE. |
1209 | */ |
1210 | if (is_solicited) { |
1211 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_REACHABLE); |
1212 | if (ln->ln_expire != 0) { |
1213 | struct nd_ifinfo *ndi = NULL; |
1214 | |
1215 | ndi = ND_IFINFO(ifp); |
1216 | VERIFY(ndi != NULL && ndi->initialized); |
1217 | lck_mtx_lock(lck: &ndi->lock); |
1218 | ln_setexpire(ln, |
1219 | timenow + ndi->reachable); |
1220 | lck_mtx_unlock(lck: &ndi->lock); |
1221 | RT_UNLOCK(rt); |
1222 | lck_mtx_lock(rnh_lock); |
1223 | nd6_sched_timeout(NULL, NULL); |
1224 | lck_mtx_unlock(rnh_lock); |
1225 | RT_LOCK(rt); |
1226 | } |
1227 | } else { |
1228 | if (lladdr && llchange) { |
1229 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_STALE); |
1230 | ln_setexpire(ln, timenow + nd6_gctimer); |
1231 | } |
1232 | } |
1233 | |
1234 | /* |
1235 | * XXX |
1236 | * The above is somewhat convoluted, for now just |
1237 | * issue a callback for LLENTRY changed. |
1238 | */ |
1239 | /* Enqueue work item to invoke callback for this route entry */ |
1240 | if (llchange) { |
1241 | route_event_enqueue_nwk_wq_entry(rt, NULL, |
1242 | ROUTE_LLENTRY_CHANGED, NULL, TRUE); |
1243 | } |
1244 | |
1245 | /* |
1246 | * If the router's link-layer address has changed, |
1247 | * notify routes using this as gateway so they can |
1248 | * update any cached information. |
1249 | */ |
1250 | if (ln->ln_router && is_router && llchange) { |
1251 | struct radix_node_head *rnh = NULL; |
1252 | struct in6_addr rt_addr = SIN6(rt_key(rt))->sin6_addr; |
1253 | struct ifnet *rt_ifp = rt->rt_ifp; |
1254 | struct route_event rt_ev; |
1255 | route_event_init(p_route_ev: &rt_ev, rt, NULL, route_ev_code: ROUTE_LLENTRY_CHANGED); |
1256 | |
1257 | /* |
1258 | * This means a router's state has changed from |
1259 | * non-reachable to probably reachable, and might |
1260 | * affect the status of associated prefixes.. |
1261 | * |
1262 | * We already have a valid rt reference here. |
1263 | * We don't need to take another one for unlock/lock. |
1264 | */ |
1265 | RT_UNLOCK(rt); |
1266 | defrouter_set_reachability(&rt_addr, rt_ifp, TRUE); |
1267 | lck_mtx_lock(rnh_lock); |
1268 | rnh = rt_tables[AF_INET6]; |
1269 | |
1270 | if (rnh != NULL) { |
1271 | (void) rnh->rnh_walktree(rnh, route_event_walktree, |
1272 | (void *)&rt_ev); |
1273 | } |
1274 | lck_mtx_unlock(rnh_lock); |
1275 | RT_LOCK(rt); |
1276 | } |
1277 | } |
1278 | |
1279 | if (ln->ln_router && !is_router) { |
1280 | /* |
1281 | * The peer dropped the router flag. |
1282 | * Remove the sender from the Default Router List and |
1283 | * update the Destination Cache entries. |
1284 | */ |
1285 | struct nd_defrouter *dr; |
1286 | struct in6_addr *in6; |
1287 | struct ifnet *rt_ifp = rt->rt_ifp; |
1288 | |
1289 | in6 = &SIN6(rt_key(rt))->sin6_addr; |
1290 | |
1291 | RT_UNLOCK(rt); |
1292 | lck_mtx_lock(nd6_mutex); |
1293 | /* |
1294 | * XXX Handle router lists for route information option |
1295 | * as well. |
1296 | */ |
1297 | dr = defrouter_lookup(NULL, in6, rt_ifp); |
1298 | if (dr) { |
1299 | TAILQ_REMOVE(&nd_defrouter_list, dr, dr_entry); |
1300 | defrtrlist_del(dr, NULL); |
1301 | NDDR_REMREF(dr); /* remove list reference */ |
1302 | NDDR_REMREF(dr); |
1303 | lck_mtx_unlock(nd6_mutex); |
1304 | } else { |
1305 | lck_mtx_unlock(nd6_mutex); |
1306 | /* |
1307 | * Even if the neighbor is not in the |
1308 | * default router list, the neighbor |
1309 | * may be used as a next hop for some |
1310 | * destinations (e.g. redirect case). |
1311 | * So we must call rt6_flush explicitly. |
1312 | */ |
1313 | rt6_flush(&ip6->ip6_src, rt_ifp); |
1314 | } |
1315 | RT_LOCK(rt); |
1316 | } |
1317 | ln->ln_router = (short)is_router; |
1318 | } |
1319 | |
1320 | if (send_nc_alive_kev && (ifp->if_addrlen == IF_LLREACH_MAXLEN)) { |
1321 | struct kev_msg ev_msg; |
1322 | struct kev_nd6_ndalive nd6_ndalive; |
1323 | bzero(s: &ev_msg, n: sizeof(ev_msg)); |
1324 | bzero(s: &nd6_ndalive, n: sizeof(nd6_ndalive)); |
1325 | ev_msg.vendor_code = KEV_VENDOR_APPLE; |
1326 | ev_msg.kev_class = KEV_NETWORK_CLASS; |
1327 | ev_msg.kev_subclass = KEV_ND6_SUBCLASS; |
1328 | ev_msg.event_code = KEV_ND6_NDALIVE; |
1329 | |
1330 | nd6_ndalive.link_data.if_family = ifp->if_family; |
1331 | nd6_ndalive.link_data.if_unit = ifp->if_unit; |
1332 | strlcpy(dst: nd6_ndalive.link_data.if_name, |
1333 | src: ifp->if_name, |
1334 | n: sizeof(nd6_ndalive.link_data.if_name)); |
1335 | ev_msg.dv[0].data_ptr = &nd6_ndalive; |
1336 | ev_msg.dv[0].data_length = |
1337 | sizeof(nd6_ndalive); |
1338 | dlil_post_complete_msg(NULL, &ev_msg); |
1339 | } |
1340 | |
1341 | RT_LOCK_ASSERT_HELD(rt); |
1342 | rt->rt_flags &= ~RTF_REJECT; |
1343 | |
1344 | /* cache the gateway (sender HW) address */ |
1345 | nd6_llreach_alloc(rt, ifp, LLADDR(sdl), alen: sdl->sdl_alen, TRUE); |
1346 | |
1347 | /* update the llinfo, send a queued packet if there is one */ |
1348 | ln->ln_asked = 0; |
1349 | if (ln->ln_hold != NULL) { |
1350 | struct mbuf *m_hold, *m_hold_next; |
1351 | struct sockaddr_in6 sin6; |
1352 | |
1353 | rtkey_to_sa6(rt, &sin6); |
1354 | /* |
1355 | * reset the ln_hold in advance, to explicitly |
1356 | * prevent a ln_hold lookup in nd6_output() |
1357 | * (wouldn't happen, though...) |
1358 | */ |
1359 | m_hold = ln->ln_hold; |
1360 | ln->ln_hold = NULL; |
1361 | for (; m_hold; m_hold = m_hold_next) { |
1362 | m_hold_next = m_hold->m_nextpkt; |
1363 | m_hold->m_nextpkt = NULL; |
1364 | /* |
1365 | * we assume ifp is not a loopback here, so just set |
1366 | * the 2nd argument as the 1st one. |
1367 | */ |
1368 | RT_UNLOCK(rt); |
1369 | nd6_output(ifp, ifp, m_hold, &sin6, rt, NULL); |
1370 | RT_LOCK_SPIN(rt); |
1371 | } |
1372 | } |
1373 | RT_REMREF_LOCKED(rt); |
1374 | RT_UNLOCK(rt); |
1375 | m_freem(m); |
1376 | return; |
1377 | |
1378 | bad: |
1379 | icmp6stat.icp6s_badna++; |
1380 | /* fall through */ |
1381 | freeit: |
1382 | m_freem(m); |
1383 | return; |
1384 | } |
1385 | |
1386 | /* |
1387 | * Neighbor advertisement output handling. |
1388 | * |
1389 | * Based on RFC 2461 |
1390 | * |
1391 | * the following items are not implemented yet: |
1392 | * - proxy advertisement delay rule (RFC2461 7.2.8, last paragraph, SHOULD) |
1393 | * - anycast advertisement delay rule (RFC2461 7.2.7, SHOULD) |
1394 | * |
1395 | * tlladdr - 1 if include target link-layer address |
1396 | * sdl0 - sockaddr_dl (= proxy NA) or NULL |
1397 | */ |
1398 | void |
1399 | nd6_na_output( |
1400 | struct ifnet *ifp, |
1401 | const struct in6_addr *daddr6_0, |
1402 | const struct in6_addr *taddr6, |
1403 | uint32_t flags, |
1404 | int tlladdr, /* 1 if include target link-layer address */ |
1405 | struct sockaddr *sdl0) /* sockaddr_dl (= proxy NA) or NULL */ |
1406 | { |
1407 | struct mbuf *m; |
1408 | struct ip6_hdr *ip6; |
1409 | struct nd_neighbor_advert *nd_na; |
1410 | struct ip6_moptions *im6o = NULL; |
1411 | caddr_t mac = NULL; |
1412 | struct route_in6 ro; |
1413 | struct in6_addr *src, src_storage, daddr6; |
1414 | struct in6_ifaddr *ia; |
1415 | struct sockaddr_in6 dst_sa; |
1416 | int icmp6len, maxlen, error; |
1417 | struct ifnet *outif = NULL; |
1418 | |
1419 | struct ip6_out_args ip6oa; |
1420 | bzero(s: &ro, n: sizeof(ro)); |
1421 | |
1422 | daddr6 = *daddr6_0; /* make a local copy for modification */ |
1423 | |
1424 | bzero(s: &ip6oa, n: sizeof(ip6oa)); |
1425 | ip6oa.ip6oa_boundif = ifp->if_index; |
1426 | ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR | |
1427 | IP6OAF_AWDL_UNRESTRICTED | IP6OAF_INTCOPROC_ALLOWED | |
1428 | IP6OAF_MANAGEMENT_ALLOWED; |
1429 | ip6oa.ip6oa_sotc = SO_TC_UNSPEC; |
1430 | ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC; |
1431 | |
1432 | ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF; |
1433 | |
1434 | /* estimate the size of message */ |
1435 | maxlen = sizeof(*ip6) + sizeof(*nd_na); |
1436 | maxlen += (sizeof(struct nd_opt_hdr) + ifp->if_addrlen + 7) & ~7; |
1437 | if (max_linkhdr + maxlen >= MCLBYTES) { |
1438 | #if DIAGNOSTIC |
1439 | printf("nd6_na_output: max_linkhdr + maxlen >= MCLBYTES " |
1440 | "(%d + %d > %d)\n" , max_linkhdr, maxlen, MCLBYTES); |
1441 | #endif |
1442 | return; |
1443 | } |
1444 | |
1445 | MGETHDR(m, M_DONTWAIT, MT_DATA); /* XXXMAC: mac_create_mbuf_linklayer() probably */ |
1446 | if (m && max_linkhdr + maxlen >= MHLEN) { |
1447 | MCLGET(m, M_DONTWAIT); |
1448 | if ((m->m_flags & M_EXT) == 0) { |
1449 | m_free(m); |
1450 | m = NULL; |
1451 | } |
1452 | } |
1453 | if (m == NULL) { |
1454 | return; |
1455 | } |
1456 | m->m_pkthdr.rcvif = NULL; |
1457 | |
1458 | if (IN6_IS_ADDR_MULTICAST(&daddr6)) { |
1459 | m->m_flags |= M_MCAST; |
1460 | |
1461 | im6o = ip6_allocmoptions(Z_NOWAIT); |
1462 | if (im6o == NULL) { |
1463 | m_freem(m); |
1464 | return; |
1465 | } |
1466 | |
1467 | im6o->im6o_multicast_ifp = ifp; |
1468 | im6o->im6o_multicast_hlim = IPV6_MAXHLIM; |
1469 | im6o->im6o_multicast_loop = 0; |
1470 | } |
1471 | |
1472 | icmp6len = sizeof(*nd_na); |
1473 | m->m_pkthdr.len = m->m_len = sizeof(struct ip6_hdr) + icmp6len; |
1474 | m->m_data += max_linkhdr; /* or MH_ALIGN() equivalent? */ |
1475 | |
1476 | /* fill neighbor advertisement packet */ |
1477 | ip6 = mtod(m, struct ip6_hdr *); |
1478 | ip6->ip6_flow = 0; |
1479 | ip6->ip6_vfc &= ~IPV6_VERSION_MASK; |
1480 | ip6->ip6_vfc |= IPV6_VERSION; |
1481 | ip6->ip6_nxt = IPPROTO_ICMPV6; |
1482 | ip6->ip6_hlim = IPV6_MAXHLIM; |
1483 | if (IN6_IS_ADDR_UNSPECIFIED(&daddr6)) { |
1484 | /* reply to DAD */ |
1485 | daddr6.s6_addr16[0] = IPV6_ADDR_INT16_MLL; |
1486 | daddr6.s6_addr16[1] = 0; |
1487 | daddr6.s6_addr32[1] = 0; |
1488 | daddr6.s6_addr32[2] = 0; |
1489 | daddr6.s6_addr32[3] = IPV6_ADDR_INT32_ONE; |
1490 | if (in6_setscope(&daddr6, ifp, NULL)) { |
1491 | goto bad; |
1492 | } |
1493 | |
1494 | flags &= ~ND_NA_FLAG_SOLICITED; |
1495 | } else { |
1496 | ip6->ip6_dst = daddr6; |
1497 | ip6_output_setdstifscope(m, ifp->if_index, NULL); |
1498 | } |
1499 | |
1500 | SOCKADDR_ZERO(&dst_sa, sizeof(struct sockaddr_in6)); |
1501 | dst_sa.sin6_family = AF_INET6; |
1502 | dst_sa.sin6_len = sizeof(struct sockaddr_in6); |
1503 | dst_sa.sin6_addr = daddr6; |
1504 | |
1505 | /* |
1506 | * Select a source whose scope is the same as that of the dest. |
1507 | */ |
1508 | SOCKADDR_COPY(&dst_sa, &ro.ro_dst, sizeof(dst_sa)); |
1509 | src = in6_selectsrc(&dst_sa, NULL, NULL, &ro, NULL, &src_storage, |
1510 | ip6oa.ip6oa_boundif, &error); |
1511 | if (src == NULL) { |
1512 | nd6log(debug, "nd6_na_output: source can't be " |
1513 | "determined: dst=%s, error=%d\n" , |
1514 | ip6_sprintf(&dst_sa.sin6_addr), error); |
1515 | goto bad; |
1516 | } |
1517 | ip6->ip6_src = *src; |
1518 | |
1519 | /* |
1520 | * RFC 4429 requires not setting "override" flag on NA packets sent |
1521 | * from optimistic addresses. |
1522 | */ |
1523 | ia = in6ifa_ifpwithaddr(ifp, src); |
1524 | ip6_output_setsrcifscope(m, ifp->if_index, ia); |
1525 | if (ia != NULL) { |
1526 | if (ia->ia6_flags & IN6_IFF_OPTIMISTIC) { |
1527 | flags &= ~ND_NA_FLAG_OVERRIDE; |
1528 | } |
1529 | ifa_remref(ifa: &ia->ia_ifa); |
1530 | } |
1531 | |
1532 | nd_na = (struct nd_neighbor_advert *)(ip6 + 1); |
1533 | nd_na->nd_na_type = ND_NEIGHBOR_ADVERT; |
1534 | nd_na->nd_na_code = 0; |
1535 | nd_na->nd_na_target = *taddr6; |
1536 | in6_clearscope(&nd_na->nd_na_target); /* XXX */ |
1537 | |
1538 | /* |
1539 | * "tlladdr" indicates NS's condition for adding tlladdr or not. |
1540 | * see nd6_ns_input() for details. |
1541 | * Basically, if NS packet is sent to unicast/anycast addr, |
1542 | * target lladdr option SHOULD NOT be included. |
1543 | */ |
1544 | if (tlladdr) { |
1545 | /* |
1546 | * sdl0 != NULL indicates proxy NA. If we do proxy, use |
1547 | * lladdr in sdl0. If we are not proxying (sending NA for |
1548 | * my address) use lladdr configured for the interface. |
1549 | */ |
1550 | if (sdl0 == NULL) { |
1551 | mac = nd6_ifptomac(ifp); |
1552 | } else if (sdl0->sa_family == AF_LINK) { |
1553 | struct sockaddr_dl *sdl; |
1554 | sdl = SDL(sdl0); |
1555 | if (sdl->sdl_alen == ifp->if_addrlen) { |
1556 | mac = LLADDR(sdl); |
1557 | } |
1558 | } |
1559 | } |
1560 | if (tlladdr && mac) { |
1561 | int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen; |
1562 | struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_na + 1); |
1563 | |
1564 | /* roundup to 8 bytes alignment! */ |
1565 | optlen = (optlen + 7) & ~7; |
1566 | |
1567 | m->m_pkthdr.len += optlen; |
1568 | m->m_len += optlen; |
1569 | icmp6len += optlen; |
1570 | bzero(s: (caddr_t)nd_opt, n: optlen); |
1571 | nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR; |
1572 | nd_opt->nd_opt_len = (uint8_t)(optlen >> 3); |
1573 | bcopy(src: mac, dst: (caddr_t)(nd_opt + 1), n: ifp->if_addrlen); |
1574 | } else { |
1575 | flags &= ~ND_NA_FLAG_OVERRIDE; |
1576 | } |
1577 | |
1578 | ip6->ip6_plen = htons((u_short)icmp6len); |
1579 | nd_na->nd_na_flags_reserved = flags; |
1580 | nd_na->nd_na_cksum = 0; |
1581 | nd_na->nd_na_cksum = |
1582 | in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len); |
1583 | |
1584 | m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE; |
1585 | |
1586 | if (ifp->if_eflags & IFEF_TXSTART) { |
1587 | /* Use control service class if the interface supports |
1588 | * transmit-start model. |
1589 | */ |
1590 | (void) m_set_service_class(m, MBUF_SC_CTL); |
1591 | } |
1592 | |
1593 | ip6oa.ip6oa_flags |= IP6OAF_SKIP_PF; |
1594 | ip6oa.ip6oa_flags |= IP6OAF_DONT_FRAG; |
1595 | ip6_output(m, NULL, NULL, IPV6_OUTARGS, im6o, &outif, &ip6oa); |
1596 | if (outif) { |
1597 | icmp6_ifstat_inc(outif, ifs6_out_msg); |
1598 | icmp6_ifstat_inc(outif, ifs6_out_neighboradvert); |
1599 | ifnet_release(interface: outif); |
1600 | } |
1601 | icmp6stat.icp6s_outhist[ND_NEIGHBOR_ADVERT]++; |
1602 | |
1603 | exit: |
1604 | if (im6o != NULL) { |
1605 | IM6O_REMREF(im6o); |
1606 | } |
1607 | |
1608 | ROUTE_RELEASE(&ro); |
1609 | return; |
1610 | |
1611 | bad: |
1612 | m_freem(m); |
1613 | goto exit; |
1614 | } |
1615 | |
1616 | caddr_t |
1617 | nd6_ifptomac( |
1618 | struct ifnet *ifp) |
1619 | { |
1620 | switch (ifp->if_type) { |
1621 | case IFT_ARCNET: |
1622 | case IFT_ETHER: |
1623 | case IFT_IEEE8023ADLAG: |
1624 | case IFT_FDDI: |
1625 | case IFT_IEEE1394: |
1626 | #ifdef IFT_L2VLAN |
1627 | case IFT_L2VLAN: |
1628 | #endif |
1629 | #ifdef IFT_IEEE80211 |
1630 | case IFT_IEEE80211: |
1631 | #endif |
1632 | #ifdef IFT_CARP |
1633 | case IFT_CARP: |
1634 | #endif |
1635 | case IFT_BRIDGE: |
1636 | case IFT_ISO88025: |
1637 | return (caddr_t)IF_LLADDR(ifp); |
1638 | default: |
1639 | return NULL; |
1640 | } |
1641 | } |
1642 | |
1643 | TAILQ_HEAD(dadq_head, dadq); |
1644 | struct dadq { |
1645 | decl_lck_mtx_data(, dad_lock); |
1646 | u_int32_t dad_refcount; /* reference count */ |
1647 | int dad_attached; |
1648 | TAILQ_ENTRY(dadq) dad_list; |
1649 | struct ifaddr *dad_ifa; |
1650 | int dad_count; /* max NS to send */ |
1651 | int dad_ns_tcount; /* # of trials to send NS */ |
1652 | int dad_ns_ocount; /* NS sent so far */ |
1653 | int dad_ns_icount; |
1654 | int dad_na_icount; |
1655 | int dad_ns_lcount; /* looped back NS */ |
1656 | int dad_loopbackprobe; /* probing state for loopback detection */ |
1657 | uint8_t dad_lladdr[ETHER_ADDR_LEN]; |
1658 | uint8_t dad_lladdrlen; |
1659 | #define ND_OPT_NONCE_LEN32 \ |
1660 | ((ND_OPT_NONCE_LEN + sizeof(uint32_t) - 1)/sizeof(uint32_t)) |
1661 | uint32_t dad_nonce[ND_OPT_NONCE_LEN32]; |
1662 | uint32_t dad_same_nonce_count; /* # of consecutive times we've ignored DAD failure because of optimistic DAD */ |
1663 | }; |
1664 | |
1665 | static KALLOC_TYPE_DEFINE(dad_zone, struct dadq, NET_KT_DEFAULT); |
1666 | static struct dadq_head dadq; |
1667 | |
1668 | void |
1669 | nd6_nbr_init(void) |
1670 | { |
1671 | int i; |
1672 | |
1673 | TAILQ_INIT(&dadq); |
1674 | |
1675 | SOCKADDR_ZERO(&hostrtmask, sizeof hostrtmask); |
1676 | hostrtmask.sin6_family = AF_INET6; |
1677 | hostrtmask.sin6_len = sizeof hostrtmask; |
1678 | for (i = 0; i < sizeof hostrtmask.sin6_addr; ++i) { |
1679 | hostrtmask.sin6_addr.s6_addr[i] = 0xff; |
1680 | } |
1681 | } |
1682 | |
1683 | static struct dadq * |
1684 | nd6_dad_find(struct ifaddr *ifa, struct nd_opt_nonce *nonce) |
1685 | { |
1686 | struct dadq *dp; |
1687 | boolean_t same_nonce = false; |
1688 | |
1689 | lck_mtx_lock(lck: &dad6_mutex); |
1690 | for (dp = dadq.tqh_first; dp; dp = dp->dad_list.tqe_next) { |
1691 | DAD_LOCK_SPIN(dp); |
1692 | if (dp->dad_ifa != ifa) { |
1693 | DAD_UNLOCK(dp); |
1694 | continue; |
1695 | } |
1696 | |
1697 | /* |
1698 | * Skip if the nonce matches the received one. |
1699 | * +2 in the length is required because of type and |
1700 | * length fields are included in a header. |
1701 | */ |
1702 | same_nonce = nonce != NULL && |
1703 | nonce->nd_opt_nonce_len == (ND_OPT_NONCE_LEN + 2) / 8 && |
1704 | memcmp(s1: &nonce->nd_opt_nonce[0], s2: &dp->dad_nonce[0], |
1705 | ND_OPT_NONCE_LEN) == 0; |
1706 | |
1707 | if (same_nonce && |
1708 | dp->dad_same_nonce_count <= nd6_dad_nonce_max_count) { |
1709 | nd6log(error, "%s: a looped back NS message is " |
1710 | "detected during DAD for if=%s %s. Ignoring.\n" , |
1711 | __func__, |
1712 | if_name(ifa->ifa_ifp), |
1713 | ip6_sprintf(IFA_IN6(ifa))); |
1714 | dp->dad_same_nonce_count++; |
1715 | dp->dad_ns_lcount++; |
1716 | ++ip6stat.ip6s_dad_loopcount; |
1717 | DAD_UNLOCK(dp); |
1718 | continue; |
1719 | } else if (!same_nonce) { |
1720 | // Not the same nonce, reset counter |
1721 | dp->dad_same_nonce_count = 1; |
1722 | } |
1723 | |
1724 | DAD_ADDREF_LOCKED(dp); |
1725 | DAD_UNLOCK(dp); |
1726 | break; |
1727 | } |
1728 | lck_mtx_unlock(lck: &dad6_mutex); |
1729 | return dp; |
1730 | } |
1731 | |
1732 | void |
1733 | nd6_dad_stoptimer( |
1734 | struct ifaddr *ifa) |
1735 | { |
1736 | untimeout((void (*)(void *))nd6_dad_timer, arg: (void *)ifa); |
1737 | } |
1738 | |
1739 | /* |
1740 | * Start Duplicate Address Detection (DAD) for specified interface address. |
1741 | */ |
1742 | void |
1743 | nd6_dad_start( |
1744 | struct ifaddr *ifa, |
1745 | int *tick_delay) /* minimum delay ticks for IFF_UP event */ |
1746 | { |
1747 | struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; |
1748 | struct dadq *dp; |
1749 | |
1750 | if (ifa->ifa_ifp == NULL) { |
1751 | panic("nd6_dad_start: ifa->ifa_ifp == NULL" ); |
1752 | } |
1753 | |
1754 | nd6log2(debug, "%s - %s ifp %s ia6_flags 0x%x\n" , |
1755 | __func__, |
1756 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1757 | if_name(ia->ia_ifp), |
1758 | ia->ia6_flags); |
1759 | |
1760 | /* |
1761 | * If we don't need DAD, don't do it. |
1762 | * There are several cases: |
1763 | * - DAD is disabled (ip6_dad_count == 0) |
1764 | * - the interface address is anycast |
1765 | */ |
1766 | IFA_LOCK(&ia->ia_ifa); |
1767 | if (!(ia->ia6_flags & IN6_IFF_DADPROGRESS)) { |
1768 | nd6log0(debug, |
1769 | "nd6_dad_start: not a tentative or optimistic address " |
1770 | "%s(%s)\n" , |
1771 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1772 | ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???" ); |
1773 | IFA_UNLOCK(&ia->ia_ifa); |
1774 | return; |
1775 | } |
1776 | if (!ip6_dad_count || (ia->ia6_flags & IN6_IFF_ANYCAST) != 0) { |
1777 | ia->ia6_flags &= ~IN6_IFF_DADPROGRESS; |
1778 | IFA_UNLOCK(&ia->ia_ifa); |
1779 | return; |
1780 | } |
1781 | IFA_UNLOCK(&ia->ia_ifa); |
1782 | |
1783 | if (!(ifa->ifa_ifp->if_flags & IFF_UP) || |
1784 | (ifa->ifa_ifp->if_eflags & IFEF_IPV6_ND6ALT)) { |
1785 | return; |
1786 | } |
1787 | if ((dp = nd6_dad_find(ifa, NULL)) != NULL) { |
1788 | DAD_REMREF(dp); |
1789 | /* DAD already in progress */ |
1790 | return; |
1791 | } |
1792 | |
1793 | dp = zalloc_flags(dad_zone, Z_WAITOK | Z_ZERO); |
1794 | lck_mtx_init(lck: &dp->dad_lock, grp: &ifa_mtx_grp, attr: &ifa_mtx_attr); |
1795 | |
1796 | /* Callee adds one reference for us */ |
1797 | dp = nd6_dad_attach(dp, ifa); |
1798 | |
1799 | nd6log0(debug, "%s: starting %sDAD %sfor %s\n" , |
1800 | if_name(ifa->ifa_ifp), |
1801 | (ia->ia6_flags & IN6_IFF_OPTIMISTIC) ? "optimistic " : "" , |
1802 | (tick_delay == NULL) ? "immediately " : "" , |
1803 | ip6_sprintf(&ia->ia_addr.sin6_addr)); |
1804 | |
1805 | /* |
1806 | * Send NS packet for DAD, ip6_dad_count times. |
1807 | * Note that we must delay the first transmission, if this is the |
1808 | * first packet to be sent from the interface after interface |
1809 | * (re)initialization. |
1810 | */ |
1811 | if (tick_delay == NULL) { |
1812 | u_int32_t retrans; |
1813 | struct nd_ifinfo *ndi = NULL; |
1814 | |
1815 | nd6_dad_ns_output(dp, ifa); |
1816 | ndi = ND_IFINFO(ifa->ifa_ifp); |
1817 | VERIFY(ndi != NULL && ndi->initialized); |
1818 | lck_mtx_lock(lck: &ndi->lock); |
1819 | retrans = ndi->retrans * hz / 1000; |
1820 | lck_mtx_unlock(lck: &ndi->lock); |
1821 | timeout((void (*)(void *))nd6_dad_timer, arg: (void *)ifa, ticks: retrans); |
1822 | } else { |
1823 | int ntick; |
1824 | |
1825 | if (*tick_delay == 0) { |
1826 | ntick = random() % (MAX_RTR_SOLICITATION_DELAY * hz); |
1827 | } else { |
1828 | ntick = *tick_delay + random() % (hz / 2); |
1829 | } |
1830 | *tick_delay = ntick; |
1831 | timeout((void (*)(void *))nd6_dad_timer, arg: (void *)ifa, |
1832 | ticks: ntick); |
1833 | } |
1834 | |
1835 | DAD_REMREF(dp); /* drop our reference */ |
1836 | } |
1837 | |
1838 | static struct dadq * |
1839 | nd6_dad_attach(struct dadq *dp, struct ifaddr *ifa) |
1840 | { |
1841 | lck_mtx_lock(lck: &dad6_mutex); |
1842 | DAD_LOCK(dp); |
1843 | dp->dad_ifa = ifa; |
1844 | ifa_addref(ifa); /* for dad_ifa */ |
1845 | dp->dad_count = ip6_dad_count; |
1846 | dp->dad_ns_icount = dp->dad_na_icount = 0; |
1847 | dp->dad_ns_ocount = dp->dad_ns_tcount = 0; |
1848 | dp->dad_ns_lcount = dp->dad_loopbackprobe = 0; |
1849 | VERIFY(!dp->dad_attached); |
1850 | dp->dad_same_nonce_count = 1; |
1851 | dp->dad_attached = 1; |
1852 | dp->dad_lladdrlen = 0; |
1853 | DAD_ADDREF_LOCKED(dp); /* for caller */ |
1854 | DAD_ADDREF_LOCKED(dp); /* for dadq_head list */ |
1855 | TAILQ_INSERT_TAIL(&dadq, (struct dadq *)dp, dad_list); |
1856 | DAD_UNLOCK(dp); |
1857 | lck_mtx_unlock(lck: &dad6_mutex); |
1858 | |
1859 | return dp; |
1860 | } |
1861 | |
1862 | static void |
1863 | nd6_dad_detach(struct dadq *dp, struct ifaddr *ifa) |
1864 | { |
1865 | int detached; |
1866 | |
1867 | lck_mtx_lock(lck: &dad6_mutex); |
1868 | DAD_LOCK(dp); |
1869 | if ((detached = dp->dad_attached)) { |
1870 | VERIFY(dp->dad_ifa == ifa); |
1871 | TAILQ_REMOVE(&dadq, (struct dadq *)dp, dad_list); |
1872 | dp->dad_list.tqe_next = NULL; |
1873 | dp->dad_list.tqe_prev = NULL; |
1874 | dp->dad_attached = 0; |
1875 | } |
1876 | DAD_UNLOCK(dp); |
1877 | lck_mtx_unlock(lck: &dad6_mutex); |
1878 | if (detached) { |
1879 | DAD_REMREF(dp); /* drop dadq_head reference */ |
1880 | } |
1881 | } |
1882 | |
1883 | /* |
1884 | * terminate DAD unconditionally. used for address removals. |
1885 | */ |
1886 | void |
1887 | nd6_dad_stop(struct ifaddr *ifa) |
1888 | { |
1889 | struct dadq *dp; |
1890 | |
1891 | dp = nd6_dad_find(ifa, NULL); |
1892 | if (!dp) { |
1893 | /* DAD wasn't started yet */ |
1894 | return; |
1895 | } |
1896 | |
1897 | untimeout((void (*)(void *))nd6_dad_timer, arg: (void *)ifa); |
1898 | |
1899 | nd6_dad_detach(dp, ifa); |
1900 | DAD_REMREF(dp); /* drop our reference */ |
1901 | } |
1902 | |
1903 | static void |
1904 | nd6_unsol_na_output(struct ifaddr *ifa) |
1905 | { |
1906 | struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; |
1907 | struct ifnet *ifp = ifa->ifa_ifp; |
1908 | struct in6_addr saddr6, taddr6; |
1909 | |
1910 | if ((ifp->if_flags & IFF_UP) == 0 || |
1911 | (ifp->if_flags & IFF_RUNNING) == 0 || |
1912 | (ifp->if_eflags & IFEF_IPV6_ND6ALT) != 0) { |
1913 | return; |
1914 | } |
1915 | |
1916 | IFA_LOCK_SPIN(&ia->ia_ifa); |
1917 | taddr6 = ia->ia_addr.sin6_addr; |
1918 | IFA_UNLOCK(&ia->ia_ifa); |
1919 | if (in6_setscope(&taddr6, ifp, NULL) != 0) { |
1920 | return; |
1921 | } |
1922 | saddr6 = in6addr_linklocal_allnodes; |
1923 | if (in6_setscope(&saddr6, ifp, NULL) != 0) { |
1924 | return; |
1925 | } |
1926 | |
1927 | nd6log(info, "%s: sending unsolicited NA\n" , |
1928 | if_name(ifa->ifa_ifp)); |
1929 | |
1930 | nd6_na_output(ifp, daddr6_0: &saddr6, taddr6: &taddr6, ND_NA_FLAG_OVERRIDE, tlladdr: 1, NULL); |
1931 | } |
1932 | |
1933 | static void |
1934 | nd6_dad_timer(struct ifaddr *ifa) |
1935 | { |
1936 | struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; |
1937 | struct dadq *dp = NULL; |
1938 | struct nd_ifinfo *ndi = NULL; |
1939 | u_int32_t retrans; |
1940 | |
1941 | /* Sanity check */ |
1942 | if (ia == NULL) { |
1943 | nd6log0(error, "nd6_dad_timer: called with null parameter\n" ); |
1944 | goto done; |
1945 | } |
1946 | |
1947 | nd6log2(debug, "%s - %s ifp %s ia6_flags 0x%x\n" , |
1948 | __func__, |
1949 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1950 | if_name(ia->ia_ifp), |
1951 | ia->ia6_flags); |
1952 | |
1953 | dp = nd6_dad_find(ifa, NULL); |
1954 | if (dp == NULL) { |
1955 | nd6log0(error, "nd6_dad_timer: DAD structure not found\n" ); |
1956 | goto done; |
1957 | } |
1958 | IFA_LOCK(&ia->ia_ifa); |
1959 | if (ia->ia6_flags & IN6_IFF_DUPLICATED) { |
1960 | nd6log0(error, "nd6_dad_timer: called with duplicated address " |
1961 | "%s(%s)\n" , |
1962 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1963 | ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???" ); |
1964 | IFA_UNLOCK(&ia->ia_ifa); |
1965 | goto done; |
1966 | } |
1967 | if ((ia->ia6_flags & IN6_IFF_DADPROGRESS) == 0) { |
1968 | nd6log0(error, "nd6_dad_timer: not a tentative or optimistic " |
1969 | "address %s(%s)\n" , |
1970 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
1971 | ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???" ); |
1972 | IFA_UNLOCK(&ia->ia_ifa); |
1973 | goto done; |
1974 | } |
1975 | IFA_UNLOCK(&ia->ia_ifa); |
1976 | |
1977 | /* timeouted with IFF_{RUNNING,UP} check */ |
1978 | DAD_LOCK(dp); |
1979 | if (dp->dad_ns_tcount > dad_maxtry) { |
1980 | DAD_UNLOCK(dp); |
1981 | nd6log0(info, "%s: could not run DAD, driver problem?\n" , |
1982 | if_name(ifa->ifa_ifp)); |
1983 | |
1984 | nd6_dad_detach(dp, ifa); |
1985 | goto done; |
1986 | } |
1987 | |
1988 | /* Need more checks? */ |
1989 | if (dp->dad_ns_ocount < dp->dad_count) { |
1990 | DAD_UNLOCK(dp); |
1991 | /* |
1992 | * We have more NS to go. Send NS packet for DAD. |
1993 | */ |
1994 | nd6_dad_ns_output(dp, ifa); |
1995 | ndi = ND_IFINFO(ifa->ifa_ifp); |
1996 | VERIFY(ndi != NULL && ndi->initialized); |
1997 | lck_mtx_lock(lck: &ndi->lock); |
1998 | retrans = ndi->retrans * hz / 1000; |
1999 | lck_mtx_unlock(lck: &ndi->lock); |
2000 | timeout((void (*)(void *))nd6_dad_timer, arg: (void *)ifa, ticks: retrans); |
2001 | } else { |
2002 | /* |
2003 | * We have transmitted sufficient number of DAD packets. |
2004 | * See what we've got. |
2005 | */ |
2006 | if (dp->dad_na_icount > 0 || dp->dad_ns_icount) { |
2007 | /* We've seen NS or NA, means DAD has failed. */ |
2008 | DAD_UNLOCK(dp); |
2009 | nd6log0(info, |
2010 | "%s: duplicate IPv6 address %s if:%s [timer]\n" , |
2011 | __func__, ip6_sprintf(&ia->ia_addr.sin6_addr), |
2012 | if_name(ia->ia_ifp)); |
2013 | nd6_dad_duplicated(ifa); |
2014 | /* (*dp) will be freed in nd6_dad_duplicated() */ |
2015 | #if SKYWALK |
2016 | SK_NXS_MS_IF_ADDR_GENCNT_INC(ia->ia_ifp); |
2017 | #endif /* SKYWALK */ |
2018 | } else if (dad_enhanced != 0 && |
2019 | dp->dad_ns_lcount > 0 && |
2020 | dp->dad_ns_lcount > dp->dad_loopbackprobe && |
2021 | dp->dad_same_nonce_count > 0 && |
2022 | dp->dad_same_nonce_count > nd6_dad_nonce_max_count) { |
2023 | dp->dad_loopbackprobe = dp->dad_ns_lcount; |
2024 | dp->dad_count = |
2025 | dp->dad_ns_ocount + dad_maxtry - 1; |
2026 | DAD_UNLOCK(dp); |
2027 | ndi = ND_IFINFO(ifa->ifa_ifp); |
2028 | VERIFY(ndi != NULL && ndi->initialized); |
2029 | lck_mtx_lock(lck: &ndi->lock); |
2030 | retrans = ndi->retrans * hz / 1000; |
2031 | lck_mtx_unlock(lck: &ndi->lock); |
2032 | |
2033 | /* |
2034 | * Sec. 4.1 in RFC 7527 requires transmission of |
2035 | * additional probes until the loopback condition |
2036 | * becomes clear when a looped back probe is detected. |
2037 | */ |
2038 | nd6log0(info, |
2039 | "%s: a looped back NS message is detected during DAD for %s. Another DAD probe is being sent on interface %s.\n" , |
2040 | __func__, ip6_sprintf(&ia->ia_addr.sin6_addr), |
2041 | if_name(ia->ia_ifp)); |
2042 | /* |
2043 | * Send an NS immediately and increase dad_count by |
2044 | * nd6_mmaxtries - 1. |
2045 | */ |
2046 | nd6_dad_ns_output(dp, ifa); |
2047 | timeout((void (*)(void *))nd6_dad_timer, arg: (void *)ifa, ticks: retrans); |
2048 | goto done; |
2049 | } else { |
2050 | boolean_t txunsolna; |
2051 | DAD_UNLOCK(dp); |
2052 | /* |
2053 | * We are done with DAD. No NA came, no NS came. |
2054 | * No duplicate address found. |
2055 | */ |
2056 | IFA_LOCK_SPIN(&ia->ia_ifa); |
2057 | ia->ia6_flags &= ~IN6_IFF_DADPROGRESS; |
2058 | IFA_UNLOCK(&ia->ia_ifa); |
2059 | |
2060 | ndi = ND_IFINFO(ifa->ifa_ifp); |
2061 | VERIFY(ndi != NULL && ndi->initialized); |
2062 | lck_mtx_lock(lck: &ndi->lock); |
2063 | txunsolna = (ndi->flags & ND6_IFF_REPLICATED) != 0; |
2064 | lck_mtx_unlock(lck: &ndi->lock); |
2065 | |
2066 | if (txunsolna) { |
2067 | nd6_unsol_na_output(ifa); |
2068 | } |
2069 | |
2070 | nd6log0(debug, |
2071 | "%s: DAD complete for %s - no duplicates found %s\n" , |
2072 | if_name(ifa->ifa_ifp), |
2073 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
2074 | txunsolna ? ", tx unsolicited NA with O=1" : "." ); |
2075 | |
2076 | if (dp->dad_ns_lcount > 0) { |
2077 | nd6log0(debug, |
2078 | "%s: DAD completed while " |
2079 | "a looped back NS message is detected " |
2080 | "during DAD for %s om interface %s\n" , |
2081 | __func__, |
2082 | ip6_sprintf(&ia->ia_addr.sin6_addr), |
2083 | if_name(ia->ia_ifp)); |
2084 | } |
2085 | |
2086 | in6_post_msg(ia->ia_ifp, KEV_INET6_NEW_USER_ADDR, ia, |
2087 | mac: dp->dad_lladdr); |
2088 | nd6_dad_detach(dp, ifa); |
2089 | #if SKYWALK |
2090 | SK_NXS_MS_IF_ADDR_GENCNT_INC(ia->ia_ifp); |
2091 | #endif /* SKYWALK */ |
2092 | } |
2093 | } |
2094 | |
2095 | done: |
2096 | if (dp != NULL) { |
2097 | DAD_REMREF(dp); /* drop our reference */ |
2098 | } |
2099 | } |
2100 | |
2101 | static void |
2102 | nd6_dad_duplicated(struct ifaddr *ifa) |
2103 | { |
2104 | struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; |
2105 | struct dadq *dp; |
2106 | struct ifnet *ifp = ifa->ifa_ifp; |
2107 | boolean_t candisable; |
2108 | |
2109 | dp = nd6_dad_find(ifa, NULL); |
2110 | if (dp == NULL) { |
2111 | log(LOG_ERR, "%s: DAD structure not found.\n" , __func__); |
2112 | return; |
2113 | } |
2114 | IFA_LOCK(&ia->ia_ifa); |
2115 | DAD_LOCK(dp); |
2116 | nd6log(error, "%s: NS in/out/loopback=%d/%d/%d, NA in=%d\n" , |
2117 | __func__, dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_ns_lcount, |
2118 | dp->dad_na_icount); |
2119 | candisable = FALSE; |
2120 | |
2121 | if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr) && |
2122 | !(ia->ia6_flags & IN6_IFF_SECURED)) { |
2123 | struct in6_addr in6; |
2124 | struct ifaddr *llifa = NULL; |
2125 | struct sockaddr_dl *sdl = NULL; |
2126 | uint8_t *lladdr = dp->dad_lladdr; |
2127 | uint8_t lladdrlen = dp->dad_lladdrlen; |
2128 | |
2129 | /* |
2130 | * To avoid over-reaction, we only apply this logic when we are |
2131 | * very sure that hardware addresses are supposed to be unique. |
2132 | */ |
2133 | switch (ifp->if_type) { |
2134 | case IFT_BRIDGE: |
2135 | case IFT_ETHER: |
2136 | case IFT_FDDI: |
2137 | case IFT_ATM: |
2138 | case IFT_IEEE1394: |
2139 | #ifdef IFT_IEEE80211 |
2140 | case IFT_IEEE80211: |
2141 | #endif |
2142 | /* |
2143 | * Check if our hardware address matches the |
2144 | * link layer information received in the |
2145 | * NS/NA |
2146 | */ |
2147 | llifa = ifp->if_lladdr; |
2148 | IFA_LOCK(llifa); |
2149 | sdl = SDL(llifa->ifa_addr); |
2150 | if (lladdrlen == sdl->sdl_alen && |
2151 | bcmp(s1: lladdr, LLADDR(sdl), n: lladdrlen) == 0) { |
2152 | candisable = TRUE; |
2153 | } |
2154 | IFA_UNLOCK(llifa); |
2155 | |
2156 | in6 = ia->ia_addr.sin6_addr; |
2157 | if (in6_iid_from_hw(ifp, &in6) != 0) { |
2158 | break; |
2159 | } |
2160 | |
2161 | /* Refine decision about whether IPv6 can be disabled */ |
2162 | if (candisable && |
2163 | !IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) { |
2164 | /* |
2165 | * Apply this logic only to the embedded MAC |
2166 | * address form of link-local IPv6 address. |
2167 | */ |
2168 | candisable = FALSE; |
2169 | } else if (lladdr == NULL && |
2170 | IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &in6)) { |
2171 | /* |
2172 | * We received a NA with no target link-layer |
2173 | * address option. This means that someone else |
2174 | * has our address. Mark it as a hardware |
2175 | * duplicate so we disable IPv6 later on. |
2176 | */ |
2177 | candisable = TRUE; |
2178 | } |
2179 | break; |
2180 | default: |
2181 | break; |
2182 | } |
2183 | } |
2184 | DAD_UNLOCK(dp); |
2185 | |
2186 | ia->ia6_flags &= ~IN6_IFF_DADPROGRESS; |
2187 | ia->ia6_flags |= IN6_IFF_DUPLICATED; |
2188 | in6_event_enqueue_nwk_wq_entry(IN6_ADDR_MARKED_DUPLICATED, |
2189 | ia->ia_ifa.ifa_ifp, &ia->ia_addr.sin6_addr, |
2190 | 0); |
2191 | IFA_UNLOCK(&ia->ia_ifa); |
2192 | |
2193 | /* increment DAD collision counter */ |
2194 | ++ip6stat.ip6s_dad_collide; |
2195 | |
2196 | /* We are done with DAD, with duplicated address found. (failure) */ |
2197 | untimeout((void (*)(void *))nd6_dad_timer, arg: (void *)ifa); |
2198 | |
2199 | IFA_LOCK(&ia->ia_ifa); |
2200 | log(LOG_ERR, "%s: DAD complete for %s - duplicate found.\n" , |
2201 | if_name(ifp), ip6_sprintf(&ia->ia_addr.sin6_addr)); |
2202 | IFA_UNLOCK(&ia->ia_ifa); |
2203 | |
2204 | if (candisable) { |
2205 | struct nd_ifinfo *ndi = ND_IFINFO(ifp); |
2206 | log(LOG_ERR, "%s: possible hardware address duplication " |
2207 | "detected, disabling IPv6 for interface.\n" , if_name(ifp)); |
2208 | |
2209 | VERIFY((NULL != ndi) && (TRUE == ndi->initialized)); |
2210 | ndi->flags |= ND6_IFF_IFDISABLED; |
2211 | /* Make sure to set IFEF_IPV6_DISABLED too */ |
2212 | nd6_if_disable(ifp, TRUE); |
2213 | } |
2214 | |
2215 | log(LOG_ERR, |
2216 | "%s: manual intervention may be required.\n" , |
2217 | if_name(ifp)); |
2218 | |
2219 | /* Send an event to the configuration agent so that the |
2220 | * duplicate address will be notified to the user and will |
2221 | * be removed. |
2222 | */ |
2223 | in6_post_msg(ifp, KEV_INET6_NEW_USER_ADDR, ia, mac: dp->dad_lladdr); |
2224 | nd6_dad_detach(dp, ifa); |
2225 | DAD_REMREF(dp); /* drop our reference */ |
2226 | } |
2227 | |
2228 | static void |
2229 | nd6_dad_ns_output(struct dadq *dp, struct ifaddr *ifa) |
2230 | { |
2231 | struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa; |
2232 | struct ifnet *ifp = ifa->ifa_ifp; |
2233 | int i = 0; |
2234 | struct in6_addr taddr6; |
2235 | |
2236 | DAD_LOCK(dp); |
2237 | dp->dad_ns_tcount++; |
2238 | if ((ifp->if_flags & IFF_UP) == 0) { |
2239 | DAD_UNLOCK(dp); |
2240 | return; |
2241 | } |
2242 | if ((ifp->if_flags & IFF_RUNNING) == 0) { |
2243 | DAD_UNLOCK(dp); |
2244 | return; |
2245 | } |
2246 | |
2247 | dp->dad_ns_ocount++; |
2248 | DAD_UNLOCK(dp); |
2249 | IFA_LOCK_SPIN(&ia->ia_ifa); |
2250 | taddr6 = ia->ia_addr.sin6_addr; |
2251 | IFA_UNLOCK(&ia->ia_ifa); |
2252 | if (dad_enhanced != 0 && !(ifp->if_flags & IFF_POINTOPOINT)) { |
2253 | for (i = 0; i < ND_OPT_NONCE_LEN32; i++) { |
2254 | dp->dad_nonce[i] = RandomULong(); |
2255 | } |
2256 | |
2257 | /* |
2258 | * XXXHRS: Note that in the case that |
2259 | * DupAddrDetectTransmits > 1, multiple NS messages with |
2260 | * different nonces can be looped back in an unexpected |
2261 | * order. The current implementation recognizes only |
2262 | * the latest nonce on the sender side. Practically it |
2263 | * should work well in almost all cases. |
2264 | */ |
2265 | } |
2266 | nd6_ns_output(ifp, NULL, taddr6: &taddr6, NULL, |
2267 | nonce: (uint8_t *)&dp->dad_nonce[0]); |
2268 | } |
2269 | |
2270 | /* |
2271 | * @brief Called to process DAD NS |
2272 | * |
2273 | * @param ifa is the pointer to the interface's address |
2274 | * @param lladdr is source link layer information |
2275 | * @param lladdrlen is source's linklayer length |
2276 | * |
2277 | * @return void |
2278 | */ |
2279 | static void |
2280 | nd6_dad_ns_input(struct ifaddr *ifa, char *lladdr, |
2281 | int lladdrlen, struct nd_opt_nonce *ndopt_nonce) |
2282 | { |
2283 | struct dadq *dp; |
2284 | VERIFY(ifa != NULL); |
2285 | |
2286 | /* Ignore Nonce option when Enhanced DAD is disabled. */ |
2287 | if (dad_enhanced == 0) { |
2288 | ndopt_nonce = NULL; |
2289 | } |
2290 | |
2291 | dp = nd6_dad_find(ifa, nonce: ndopt_nonce); |
2292 | if (dp == NULL) { |
2293 | return; |
2294 | } |
2295 | |
2296 | DAD_LOCK(dp); |
2297 | ++dp->dad_ns_icount; |
2298 | if (lladdr && lladdrlen >= ETHER_ADDR_LEN) { |
2299 | memcpy(dst: dp->dad_lladdr, src: lladdr, ETHER_ADDR_LEN); |
2300 | /* fine to truncate as it is compared against sdl_alen */ |
2301 | dp->dad_lladdrlen = (uint8_t)lladdrlen; |
2302 | } |
2303 | DAD_UNLOCK(dp); |
2304 | DAD_REMREF(dp); |
2305 | } |
2306 | |
2307 | /* |
2308 | * @brief Called to process received NA for DAD |
2309 | * |
2310 | * @param m is the pointer to the packet's mbuf |
2311 | * @param ifp is the pointer to the interface on which packet |
2312 | * was receicved. |
2313 | * @param taddr is pointer to target's IPv6 address |
2314 | * @param lladdr is target's link layer information |
2315 | * @param lladdrlen is target's linklayer length |
2316 | * |
2317 | * @return NULL if the packet is consumed by DAD processing, else |
2318 | * pointer to the mbuf. |
2319 | */ |
2320 | static struct mbuf * |
2321 | nd6_dad_na_input(struct mbuf *m, struct ifnet *ifp, struct in6_addr *taddr, |
2322 | caddr_t lladdr, int lladdrlen) |
2323 | { |
2324 | struct ifaddr *ifa = NULL; |
2325 | struct in6_ifaddr *ia = NULL; |
2326 | struct dadq *dp = NULL; |
2327 | struct nd_ifinfo *ndi = NULL; |
2328 | boolean_t replicated; |
2329 | |
2330 | ifa = (struct ifaddr *) in6ifa_ifpwithaddr(ifp, taddr); |
2331 | if (ifa == NULL) { |
2332 | return m; |
2333 | } |
2334 | |
2335 | replicated = FALSE; |
2336 | |
2337 | /* Get the ND6_IFF_REPLICATED flag. */ |
2338 | ndi = ND_IFINFO(ifp); |
2339 | if (ndi != NULL && ndi->initialized) { |
2340 | lck_mtx_lock(lck: &ndi->lock); |
2341 | replicated = !!(ndi->flags & ND6_IFF_REPLICATED); |
2342 | lck_mtx_unlock(lck: &ndi->lock); |
2343 | } |
2344 | |
2345 | if (replicated) { |
2346 | nd6log(info, "%s: ignoring duplicate NA on " |
2347 | "replicated interface %s\n" , __func__, if_name(ifp)); |
2348 | goto done; |
2349 | } |
2350 | |
2351 | /* Lock the interface address until done (see label below). */ |
2352 | IFA_LOCK(ifa); |
2353 | ia = (struct in6_ifaddr *) ifa; |
2354 | |
2355 | if (!(ia->ia6_flags & IN6_IFF_DADPROGRESS)) { |
2356 | IFA_UNLOCK(ifa); |
2357 | nd6log(info, "%s: ignoring duplicate NA on " |
2358 | "%s [DAD not in progress]\n" , __func__, |
2359 | if_name(ifp)); |
2360 | goto done; |
2361 | } |
2362 | |
2363 | /* Some sleep proxies improperly send the client's Ethernet address in |
2364 | * the target link-layer address option, so detect this by comparing |
2365 | * the L2-header source address, if we have seen it, with the target |
2366 | * address, and ignoring the NA if they don't match. |
2367 | */ |
2368 | if (lladdr != NULL && lladdrlen >= ETHER_ADDR_LEN) { |
2369 | struct ip6aux *ip6a = ip6_findaux(m); |
2370 | if (ip6a && (ip6a->ip6a_flags & IP6A_HASEEN) != 0 && |
2371 | bcmp(s1: ip6a->ip6a_ehsrc, s2: lladdr, ETHER_ADDR_LEN) != 0) { |
2372 | IFA_UNLOCK(ifa); |
2373 | nd6log(error, "%s: ignoring duplicate NA on %s " |
2374 | "[eh_src != tgtlladdr]\n" , __func__, if_name(ifp)); |
2375 | goto done; |
2376 | } |
2377 | } |
2378 | |
2379 | IFA_UNLOCK(ifa); |
2380 | |
2381 | dp = nd6_dad_find(ifa, NULL); |
2382 | if (dp == NULL) { |
2383 | nd6log(info, "%s: no DAD structure for %s on %s.\n" , |
2384 | __func__, ip6_sprintf(taddr), if_name(ifp)); |
2385 | goto done; |
2386 | } |
2387 | |
2388 | DAD_LOCK_SPIN(dp); |
2389 | if (lladdr != NULL && lladdrlen >= ETHER_ADDR_LEN) { |
2390 | memcpy(dst: dp->dad_lladdr, src: lladdr, ETHER_ADDR_LEN); |
2391 | dp->dad_lladdrlen = (uint8_t)lladdrlen; |
2392 | } |
2393 | dp->dad_na_icount++; |
2394 | DAD_UNLOCK(dp); |
2395 | DAD_REMREF(dp); |
2396 | |
2397 | /* remove the address. */ |
2398 | nd6log(info, |
2399 | "%s: duplicate IPv6 address %s [processing NA on %s]\n" , __func__, |
2400 | ip6_sprintf(taddr), if_name(ifp)); |
2401 | done: |
2402 | IFA_LOCK_ASSERT_NOTHELD(ifa); |
2403 | ifa_remref(ifa); |
2404 | m_freem(m); |
2405 | return NULL; |
2406 | } |
2407 | |
2408 | static void |
2409 | dad_addref(struct dadq *dp, int locked) |
2410 | { |
2411 | if (!locked) { |
2412 | DAD_LOCK_SPIN(dp); |
2413 | } else { |
2414 | DAD_LOCK_ASSERT_HELD(dp); |
2415 | } |
2416 | |
2417 | if (++dp->dad_refcount == 0) { |
2418 | panic("%s: dad %p wraparound refcnt" , __func__, dp); |
2419 | /* NOTREACHED */ |
2420 | } |
2421 | if (!locked) { |
2422 | DAD_UNLOCK(dp); |
2423 | } |
2424 | } |
2425 | |
2426 | static void |
2427 | dad_remref(struct dadq *dp) |
2428 | { |
2429 | struct ifaddr *ifa; |
2430 | |
2431 | DAD_LOCK_SPIN(dp); |
2432 | if (dp->dad_refcount == 0) { |
2433 | panic("%s: dad %p negative refcnt" , __func__, dp); |
2434 | } |
2435 | --dp->dad_refcount; |
2436 | if (dp->dad_refcount > 0) { |
2437 | DAD_UNLOCK(dp); |
2438 | return; |
2439 | } |
2440 | DAD_UNLOCK(dp); |
2441 | |
2442 | if (dp->dad_attached || |
2443 | dp->dad_list.tqe_next != NULL || dp->dad_list.tqe_prev != NULL) { |
2444 | panic("%s: attached dad=%p is being freed" , __func__, dp); |
2445 | /* NOTREACHED */ |
2446 | } |
2447 | |
2448 | if ((ifa = dp->dad_ifa) != NULL) { |
2449 | ifa_remref(ifa); /* drop dad_ifa reference */ |
2450 | dp->dad_ifa = NULL; |
2451 | } |
2452 | |
2453 | lck_mtx_destroy(lck: &dp->dad_lock, grp: &ifa_mtx_grp); |
2454 | zfree(dad_zone, dp); |
2455 | } |
2456 | |
2457 | void |
2458 | nd6_llreach_set_reachable(struct ifnet *ifp, void *addr, unsigned int alen) |
2459 | { |
2460 | /* Nothing more to do if it's disabled */ |
2461 | if (nd6_llreach_base == 0) { |
2462 | return; |
2463 | } |
2464 | |
2465 | ifnet_llreach_set_reachable(ifp, ETHERTYPE_IPV6, addr, alen); |
2466 | } |
2467 | |
2468 | void |
2469 | nd6_alt_node_addr_decompose(struct ifnet *ifp, struct sockaddr *sa, |
2470 | struct sockaddr_dl* sdl, struct sockaddr_in6 *sin6) |
2471 | { |
2472 | static const size_t EUI64_LENGTH = 8; |
2473 | |
2474 | VERIFY(nd6_need_cache(ifp)); |
2475 | VERIFY(sa); |
2476 | VERIFY(sdl && (void *)sa != (void *)sdl); |
2477 | VERIFY(sin6 && (void *)sa != (void *)sin6); |
2478 | |
2479 | SOCKADDR_ZERO(sin6, sizeof(*sin6)); |
2480 | sin6->sin6_len = sizeof *sin6; |
2481 | sin6->sin6_family = AF_INET6; |
2482 | |
2483 | SOCKADDR_ZERO(sdl, sizeof(*sdl)); |
2484 | sdl->sdl_len = sizeof *sdl; |
2485 | sdl->sdl_family = AF_LINK; |
2486 | sdl->sdl_type = ifp->if_type; |
2487 | sdl->sdl_index = ifp->if_index; |
2488 | sdl->sdl_nlen = 0; |
2489 | |
2490 | switch (sa->sa_family) { |
2491 | case AF_INET6: { |
2492 | struct sockaddr_in6 *sin6a = SIN6(sa); |
2493 | struct in6_addr *in6 = &sin6a->sin6_addr; |
2494 | |
2495 | VERIFY(sa->sa_len == sizeof *sin6); |
2496 | if (in6->s6_addr[11] == 0xff && in6->s6_addr[12] == 0xfe) { |
2497 | sdl->sdl_alen = ETHER_ADDR_LEN; |
2498 | LLADDR(sdl)[0] = (in6->s6_addr[8] ^ ND6_EUI64_UBIT); |
2499 | LLADDR(sdl)[1] = in6->s6_addr[9]; |
2500 | LLADDR(sdl)[2] = in6->s6_addr[10]; |
2501 | LLADDR(sdl)[3] = in6->s6_addr[13]; |
2502 | LLADDR(sdl)[4] = in6->s6_addr[14]; |
2503 | LLADDR(sdl)[5] = in6->s6_addr[15]; |
2504 | } else { |
2505 | sdl->sdl_alen = EUI64_LENGTH; |
2506 | bcopy(src: &in6->s6_addr[8], LLADDR(sdl), n: EUI64_LENGTH); |
2507 | } |
2508 | |
2509 | sdl->sdl_slen = 0; |
2510 | break; |
2511 | } |
2512 | case AF_LINK: { |
2513 | struct sockaddr_dl *sdla = SDL(sa); |
2514 | struct in6_addr *in6 = &sin6->sin6_addr; |
2515 | caddr_t lla = LLADDR(sdla); |
2516 | |
2517 | VERIFY(sa->sa_len <= sizeof(*sdl)); |
2518 | SOCKADDR_COPY(sa, sdl, sa->sa_len); |
2519 | |
2520 | sin6->sin6_scope_id = sdla->sdl_index; |
2521 | if (sin6->sin6_scope_id == 0) { |
2522 | sin6->sin6_scope_id = ifp->if_index; |
2523 | } |
2524 | in6->s6_addr[0] = 0xfe; |
2525 | in6->s6_addr[1] = 0x80; |
2526 | if (sdla->sdl_alen == EUI64_LENGTH) { |
2527 | bcopy(src: lla, dst: &in6->s6_addr[8], n: EUI64_LENGTH); |
2528 | } else { |
2529 | VERIFY(sdla->sdl_alen == ETHER_ADDR_LEN); |
2530 | |
2531 | in6->s6_addr[8] = ((uint8_t) lla[0] ^ ND6_EUI64_UBIT); |
2532 | in6->s6_addr[9] = (uint8_t) lla[1]; |
2533 | in6->s6_addr[10] = (uint8_t) lla[2]; |
2534 | in6->s6_addr[11] = 0xff; |
2535 | in6->s6_addr[12] = 0xfe; |
2536 | in6->s6_addr[13] = (uint8_t) lla[3]; |
2537 | in6->s6_addr[14] = (uint8_t) lla[4]; |
2538 | in6->s6_addr[15] = (uint8_t) lla[5]; |
2539 | } |
2540 | |
2541 | break; |
2542 | } |
2543 | default: |
2544 | VERIFY(false); |
2545 | break; |
2546 | } |
2547 | } |
2548 | |
2549 | int |
2550 | nd6_alt_node_present(struct ifnet *ifp, struct sockaddr_in6 *sin6, |
2551 | struct sockaddr_dl *sdl, int32_t , int lqm, int npm) |
2552 | { |
2553 | struct rtentry *rt = NULL; |
2554 | struct llinfo_nd6 *ln = NULL; |
2555 | struct if_llreach *lr = NULL; |
2556 | int nd6_nc_updated = 0; |
2557 | const uint32_t temp_embedded_id = sin6->sin6_addr.s6_addr16[1]; |
2558 | const uint32_t temp_ifscope_id = sin6->sin6_scope_id; |
2559 | |
2560 | if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) { |
2561 | if (in6_embedded_scope) { |
2562 | if (temp_embedded_id == 0) { |
2563 | sin6->sin6_addr.s6_addr16[1] = htons(ifp->if_index); |
2564 | } |
2565 | } else if (temp_ifscope_id == 0) { |
2566 | sin6->sin6_scope_id = ifp->if_index; |
2567 | } |
2568 | } |
2569 | |
2570 | nd6_cache_lladdr(ifp, &sin6->sin6_addr, LLADDR(sdl), sdl->sdl_alen, |
2571 | ND_NEIGHBOR_ADVERT, 0, &nd6_nc_updated); |
2572 | |
2573 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
2574 | lck_mtx_lock(rnh_lock); |
2575 | |
2576 | rt = rtalloc1_scoped_locked(SA(sin6), 1, 0, ifp->if_index); |
2577 | |
2578 | /* Restore the address that was passed to us */ |
2579 | if (in6_embedded_scope) { |
2580 | if (temp_embedded_id == 0) { |
2581 | sin6->sin6_addr.s6_addr16[1] = 0; |
2582 | } |
2583 | } else if (temp_ifscope_id == 0) { |
2584 | sin6->sin6_scope_id = 0; |
2585 | } |
2586 | |
2587 | if (rt != NULL) { |
2588 | RT_LOCK(rt); |
2589 | VERIFY(rt->rt_flags & RTF_LLINFO); |
2590 | VERIFY(rt->rt_llinfo); |
2591 | |
2592 | ln = rt->rt_llinfo; |
2593 | ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_REACHABLE); |
2594 | ln_setexpire(ln, 0); |
2595 | |
2596 | lr = ln->ln_llreach; |
2597 | if (lr) { |
2598 | IFLR_LOCK(lr); |
2599 | lr->lr_rssi = rssi; |
2600 | lr->lr_lqm = (int32_t) lqm; |
2601 | lr->lr_npm = (int32_t) npm; |
2602 | IFLR_UNLOCK(lr); |
2603 | } |
2604 | |
2605 | RT_UNLOCK(rt); |
2606 | RT_REMREF(rt); |
2607 | } |
2608 | |
2609 | lck_mtx_unlock(rnh_lock); |
2610 | |
2611 | if (rt == NULL) { |
2612 | log(LOG_ERR, "%s: failed to add/update host route to %s.\n" , |
2613 | __func__, ip6_sprintf(&sin6->sin6_addr)); |
2614 | #if DEBUG || DEVELOPMENT |
2615 | if (ip6_p2p_debug) { |
2616 | panic("%s: failed to add/update host route to %s.\n" , |
2617 | __func__, ip6_sprintf(&sin6->sin6_addr)); |
2618 | } |
2619 | #endif |
2620 | return EHOSTUNREACH; |
2621 | } |
2622 | |
2623 | nd6log(debug, "%s: Successfully added/updated host route to %s [lr=0x%llx]\n" , |
2624 | __func__, ip6_sprintf(&sin6->sin6_addr), |
2625 | (uint64_t)VM_KERNEL_ADDRPERM(lr)); |
2626 | /* |
2627 | * nd6_nc_updated not set implies that nothing was updated |
2628 | * in the neighbor cache. Convey that as EEXIST to callers. |
2629 | */ |
2630 | if (nd6_nc_updated == 0) { |
2631 | return EEXIST; |
2632 | } |
2633 | return 0; |
2634 | } |
2635 | |
2636 | int |
2637 | nd6_alt_node_absent(struct ifnet *ifp, struct sockaddr_in6 *sin6, struct sockaddr_dl *sdl) |
2638 | { |
2639 | struct rtentry *rt = NULL; |
2640 | int error = 0; |
2641 | const uint32_t temp_embedded_id = sin6->sin6_addr.s6_addr16[1]; |
2642 | const uint32_t temp_ifscope_id = sin6->sin6_scope_id; |
2643 | |
2644 | nd6log(debug, "%s: host route to %s\n" , __func__, |
2645 | ip6_sprintf(&sin6->sin6_addr)); |
2646 | |
2647 | if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) { |
2648 | if (in6_embedded_scope) { |
2649 | if (temp_embedded_id == 0) { |
2650 | sin6->sin6_addr.s6_addr16[1] = htons(ifp->if_index); |
2651 | } |
2652 | } else if (temp_ifscope_id == 0) { |
2653 | sin6->sin6_scope_id = ifp->if_index; |
2654 | } |
2655 | } |
2656 | |
2657 | LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED); |
2658 | lck_mtx_lock(rnh_lock); |
2659 | |
2660 | rt = rtalloc1_scoped_locked(SA(sin6), 0, 0, ifp->if_index); |
2661 | |
2662 | /* Restore the address that was passed to us */ |
2663 | if (in6_embedded_scope) { |
2664 | if (temp_embedded_id == 0) { |
2665 | sin6->sin6_addr.s6_addr16[1] = 0; |
2666 | } |
2667 | } else if (temp_ifscope_id == 0) { |
2668 | sin6->sin6_scope_id = 0; |
2669 | } |
2670 | |
2671 | if (rt != NULL) { |
2672 | RT_LOCK(rt); |
2673 | if (IS_DYNAMIC_DIRECT_HOSTROUTE(rt)) { |
2674 | /* |
2675 | * Copy the link layer information in SDL when present |
2676 | * as it later gets used to issue the kernel event for |
2677 | * node absence. |
2678 | */ |
2679 | if (sdl != NULL && rt->rt_gateway != NULL && |
2680 | rt->rt_gateway->sa_family == AF_LINK && |
2681 | SDL(rt->rt_gateway)->sdl_len <= sizeof(*sdl)) { |
2682 | SOCKADDR_COPY(rt->rt_gateway, sdl, SDL(rt->rt_gateway)->sdl_len); |
2683 | } |
2684 | |
2685 | rt->rt_flags |= RTF_CONDEMNED; |
2686 | RT_UNLOCK(rt); |
2687 | |
2688 | error = rtrequest_locked(RTM_DELETE, rt_key(rt), NULL, rt_mask(rt), |
2689 | 0, (struct rtentry **)NULL); |
2690 | |
2691 | rtfree_locked(rt); |
2692 | } else { |
2693 | error = EHOSTUNREACH; |
2694 | RT_REMREF_LOCKED(rt); |
2695 | RT_UNLOCK(rt); |
2696 | } |
2697 | } else { |
2698 | error = EHOSTUNREACH; |
2699 | } |
2700 | |
2701 | if (error == 0) { |
2702 | nd6log(debug, "%s: Successfully deleted host route to %s " |
2703 | "for interface %s.\n" , __func__, ip6_sprintf(&sin6->sin6_addr), |
2704 | ifp->if_xname); |
2705 | } else { |
2706 | nd6log(error, "%s: Failed to delete host route to %s " |
2707 | "for interface %s with error :%d.\n" , __func__, |
2708 | ip6_sprintf(&sin6->sin6_addr), |
2709 | ifp->if_xname, error); |
2710 | } |
2711 | |
2712 | lck_mtx_unlock(rnh_lock); |
2713 | return error; |
2714 | } |
2715 | |