2 * Copyright (c) 2000-2017 Apple Inc. All rights reserved.
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
30 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
31 * All rights reserved.
33 * Redistribution and use in source and binary forms, with or without
34 * modification, are permitted provided that the following conditions
36 * 1. Redistributions of source code must retain the above copyright
37 * notice, this list of conditions and the following disclaimer.
38 * 2. Redistributions in binary form must reproduce the above copyright
39 * notice, this list of conditions and the following disclaimer in the
40 * documentation and/or other materials provided with the distribution.
41 * 3. Neither the name of the project nor the names of its contributors
42 * may be used to endorse or promote products derived from this software
43 * without specific prior written permission.
45 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
48 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
61 * BSD/OS version heavily modifies this code, related to llinfo.
62 * Since we don't have BSD/OS version of net/route.c in our hand,
63 * I left the code mostly as it was in 970310. -- itojun
66 #include <sys/param.h>
67 #include <sys/systm.h>
68 #include <sys/malloc.h>
70 #include <sys/socket.h>
71 #include <sys/sockio.h>
73 #include <sys/kernel.h>
74 #include <sys/sysctl.h>
75 #include <sys/errno.h>
76 #include <sys/syslog.h>
77 #include <sys/protosw.h>
79 #include <sys/mcache.h>
81 #include <dev/random/randomdev.h>
83 #include <kern/queue.h>
84 #include <kern/zalloc.h>
87 #include <net/if_dl.h>
88 #include <net/if_types.h>
89 #include <net/if_llreach.h>
90 #include <net/route.h>
92 #include <net/ntstat.h>
93 #include <net/net_osdep.h>
94 #include <net/nwk_wq.h>
96 #include <netinet/in.h>
97 #include <netinet/in_arp.h>
98 #include <netinet/if_ether.h>
99 #include <netinet6/in6_var.h>
100 #include <netinet/ip6.h>
101 #include <netinet6/ip6_var.h>
102 #include <netinet6/nd6.h>
103 #include <netinet6/scope6_var.h>
104 #include <netinet/icmp6.h>
108 #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */
109 #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */
111 #define equal(a1, a2) (bcmp((caddr_t)(a1), (caddr_t)(a2), (a1)->sa_len) == 0)
114 int nd6_prune
= 1; /* walk list every 1 seconds */
115 int nd6_prune_lazy
= 5; /* lazily walk list every 5 seconds */
116 int nd6_delay
= 5; /* delay first probe time 5 second */
117 int nd6_umaxtries
= 3; /* maximum unicast query */
118 int nd6_mmaxtries
= 3; /* maximum multicast query */
119 int nd6_useloopback
= 1; /* use loopback interface for local traffic */
120 int nd6_gctimer
= (60 * 60 * 24); /* 1 day: garbage collection timer */
122 /* preventing too many loops in ND option parsing */
123 int nd6_maxndopt
= 10; /* max # of ND options allowed */
125 int nd6_maxqueuelen
= 1; /* max # of packets cached in unresolved ND entries */
133 int nd6_optimistic_dad
=
134 (ND6_OPTIMISTIC_DAD_LINKLOCAL
|ND6_OPTIMISTIC_DAD_AUTOCONF
|
135 ND6_OPTIMISTIC_DAD_TEMPORARY
|ND6_OPTIMISTIC_DAD_DYNAMIC
|
136 ND6_OPTIMISTIC_DAD_SECURED
|ND6_OPTIMISTIC_DAD_MANUAL
);
139 static int nd6_inuse
, nd6_allocated
;
142 * Synchronization notes:
144 * The global list of ND entries are stored in llinfo_nd6; an entry
145 * gets inserted into the list when the route is created and gets
146 * removed from the list when it is deleted; this is done as part
147 * of RTM_ADD/RTM_RESOLVE/RTM_DELETE in nd6_rtrequest().
149 * Because rnh_lock and rt_lock for the entry are held during those
150 * operations, the same locks (and thus lock ordering) must be used
151 * elsewhere to access the relevant data structure fields:
153 * ln_next, ln_prev, ln_rt
155 * - Routing lock (rnh_lock)
157 * ln_hold, ln_asked, ln_expire, ln_state, ln_router, ln_flags,
158 * ln_llreach, ln_lastused
160 * - Routing entry lock (rt_lock)
162 * Due to the dependency on rt_lock, llinfo_nd6 has the same lifetime
163 * as the route entry itself. When a route is deleted (RTM_DELETE),
164 * it is simply removed from the global list but the memory is not
165 * freed until the route itself is freed.
167 struct llinfo_nd6 llinfo_nd6
= {
168 .ln_next
= &llinfo_nd6
,
169 .ln_prev
= &llinfo_nd6
,
172 static lck_grp_attr_t
*nd_if_lock_grp_attr
= NULL
;
173 static lck_grp_t
*nd_if_lock_grp
= NULL
;
174 static lck_attr_t
*nd_if_lock_attr
= NULL
;
176 /* Protected by nd6_mutex */
177 struct nd_drhead nd_defrouter
;
178 struct nd_prhead nd_prefix
= { 0 };
181 * nd6_timeout() is scheduled on a demand basis. nd6_timeout_run is used
182 * to indicate whether or not a timeout has been scheduled. The rnh_lock
183 * mutex is used to protect this scheduling; it is a natural choice given
184 * the work done in the timer callback. Unfortunately, there are cases
185 * when nd6_timeout() needs to be scheduled while rnh_lock cannot be easily
186 * held, due to lock ordering. In those cases, we utilize a "demand" counter
187 * nd6_sched_timeout_want which can be atomically incremented without
188 * having to hold rnh_lock. On places where we acquire rnh_lock, such as
189 * nd6_rtrequest(), we check this counter and schedule the timer if it is
190 * non-zero. The increment happens on various places when we allocate
191 * new ND entries, default routers, prefixes and addresses.
193 static int nd6_timeout_run
; /* nd6_timeout is scheduled to run */
194 static void nd6_timeout(void *);
195 int nd6_sched_timeout_want
; /* demand count for timer to be sched */
196 static boolean_t nd6_fast_timer_on
= FALSE
;
198 /* Serialization variables for nd6_service(), protected by rnh_lock */
199 static boolean_t nd6_service_busy
;
200 static void *nd6_service_wc
= &nd6_service_busy
;
201 static int nd6_service_waiters
= 0;
203 int nd6_recalc_reachtm_interval
= ND6_RECALC_REACHTM_INTERVAL
;
204 static struct sockaddr_in6 all1_sa
;
206 static int regen_tmpaddr(struct in6_ifaddr
*);
207 extern lck_mtx_t
*nd6_mutex
;
209 static struct llinfo_nd6
*nd6_llinfo_alloc(int);
210 static void nd6_llinfo_free(void *);
211 static void nd6_llinfo_purge(struct rtentry
*);
212 static void nd6_llinfo_get_ri(struct rtentry
*, struct rt_reach_info
*);
213 static void nd6_llinfo_get_iflri(struct rtentry
*, struct ifnet_llreach_info
*);
214 static void nd6_llinfo_refresh(struct rtentry
*);
215 static uint64_t ln_getexpire(struct llinfo_nd6
*);
217 static void nd6_service(void *);
218 static void nd6_slowtimo(void *);
219 static int nd6_is_new_addr_neighbor(struct sockaddr_in6
*, struct ifnet
*);
220 static int nd6_siocgdrlst(void *, int);
221 static int nd6_siocgprlst(void *, int);
223 static int nd6_sysctl_drlist SYSCTL_HANDLER_ARGS
;
224 static int nd6_sysctl_prlist SYSCTL_HANDLER_ARGS
;
227 * Insertion and removal from llinfo_nd6 must be done with rnh_lock held.
229 #define LN_DEQUEUE(_ln) do { \
230 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); \
231 RT_LOCK_ASSERT_HELD((_ln)->ln_rt); \
232 (_ln)->ln_next->ln_prev = (_ln)->ln_prev; \
233 (_ln)->ln_prev->ln_next = (_ln)->ln_next; \
234 (_ln)->ln_prev = (_ln)->ln_next = NULL; \
235 (_ln)->ln_flags &= ~ND6_LNF_IN_USE; \
238 #define LN_INSERTHEAD(_ln) do { \
239 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); \
240 RT_LOCK_ASSERT_HELD((_ln)->ln_rt); \
241 (_ln)->ln_next = llinfo_nd6.ln_next; \
242 llinfo_nd6.ln_next = (_ln); \
243 (_ln)->ln_prev = &llinfo_nd6; \
244 (_ln)->ln_next->ln_prev = (_ln); \
245 (_ln)->ln_flags |= ND6_LNF_IN_USE; \
248 static struct zone
*llinfo_nd6_zone
;
249 #define LLINFO_ND6_ZONE_MAX 256 /* maximum elements in zone */
250 #define LLINFO_ND6_ZONE_NAME "llinfo_nd6" /* name for zone */
252 extern int tvtohz(struct timeval
*);
254 static int nd6_init_done
;
256 SYSCTL_DECL(_net_inet6_icmp6
);
258 SYSCTL_PROC(_net_inet6_icmp6
, ICMPV6CTL_ND6_DRLIST
, nd6_drlist
,
259 CTLTYPE_STRUCT
| CTLFLAG_RD
| CTLFLAG_LOCKED
, 0, 0,
260 nd6_sysctl_drlist
, "S,in6_defrouter", "");
262 SYSCTL_PROC(_net_inet6_icmp6
, ICMPV6CTL_ND6_PRLIST
, nd6_prlist
,
263 CTLTYPE_STRUCT
| CTLFLAG_RD
| CTLFLAG_LOCKED
, 0, 0,
264 nd6_sysctl_prlist
, "S,in6_defrouter", "");
266 SYSCTL_DECL(_net_inet6_ip6
);
268 static int ip6_maxchainsent
= 0;
269 SYSCTL_INT(_net_inet6_ip6
, OID_AUTO
, maxchainsent
,
270 CTLFLAG_RW
| CTLFLAG_LOCKED
, &ip6_maxchainsent
, 0,
271 "use dlil_output_list");
278 VERIFY(!nd6_init_done
);
280 all1_sa
.sin6_family
= AF_INET6
;
281 all1_sa
.sin6_len
= sizeof (struct sockaddr_in6
);
282 for (i
= 0; i
< sizeof (all1_sa
.sin6_addr
); i
++)
283 all1_sa
.sin6_addr
.s6_addr
[i
] = 0xff;
285 /* initialization of the default router list */
286 TAILQ_INIT(&nd_defrouter
);
288 nd_if_lock_grp_attr
= lck_grp_attr_alloc_init();
289 nd_if_lock_grp
= lck_grp_alloc_init("nd_if_lock", nd_if_lock_grp_attr
);
290 nd_if_lock_attr
= lck_attr_alloc_init();
292 llinfo_nd6_zone
= zinit(sizeof (struct llinfo_nd6
),
293 LLINFO_ND6_ZONE_MAX
* sizeof (struct llinfo_nd6
), 0,
294 LLINFO_ND6_ZONE_NAME
);
295 if (llinfo_nd6_zone
== NULL
)
296 panic("%s: failed allocating llinfo_nd6_zone", __func__
);
298 zone_change(llinfo_nd6_zone
, Z_EXPAND
, TRUE
);
299 zone_change(llinfo_nd6_zone
, Z_CALLERACCT
, FALSE
);
308 timeout(nd6_slowtimo
, NULL
, ND6_SLOWTIMER_INTERVAL
* hz
);
311 static struct llinfo_nd6
*
312 nd6_llinfo_alloc(int how
)
314 struct llinfo_nd6
*ln
;
316 ln
= (how
== M_WAITOK
) ? zalloc(llinfo_nd6_zone
) :
317 zalloc_noblock(llinfo_nd6_zone
);
319 bzero(ln
, sizeof (*ln
));
325 nd6_llinfo_free(void *arg
)
327 struct llinfo_nd6
*ln
= arg
;
329 if (ln
->ln_next
!= NULL
|| ln
->ln_prev
!= NULL
) {
330 panic("%s: trying to free %p when it is in use", __func__
, ln
);
334 /* Just in case there's anything there, free it */
335 if (ln
->ln_hold
!= NULL
) {
336 m_freem_list(ln
->ln_hold
);
340 /* Purge any link-layer info caching */
341 VERIFY(ln
->ln_rt
->rt_llinfo
== ln
);
342 if (ln
->ln_rt
->rt_llinfo_purge
!= NULL
)
343 ln
->ln_rt
->rt_llinfo_purge(ln
->ln_rt
);
345 zfree(llinfo_nd6_zone
, ln
);
349 nd6_llinfo_purge(struct rtentry
*rt
)
351 struct llinfo_nd6
*ln
= rt
->rt_llinfo
;
353 RT_LOCK_ASSERT_HELD(rt
);
354 VERIFY(rt
->rt_llinfo_purge
== nd6_llinfo_purge
&& ln
!= NULL
);
356 if (ln
->ln_llreach
!= NULL
) {
358 ifnet_llreach_free(ln
->ln_llreach
);
359 ln
->ln_llreach
= NULL
;
365 nd6_llinfo_get_ri(struct rtentry
*rt
, struct rt_reach_info
*ri
)
367 struct llinfo_nd6
*ln
= rt
->rt_llinfo
;
368 struct if_llreach
*lr
= ln
->ln_llreach
;
371 bzero(ri
, sizeof (*ri
));
372 ri
->ri_rssi
= IFNET_RSSI_UNKNOWN
;
373 ri
->ri_lqm
= IFNET_LQM_THRESH_OFF
;
374 ri
->ri_npm
= IFNET_NPM_THRESH_UNKNOWN
;
377 /* Export to rt_reach_info structure */
379 /* Export ND6 send expiration (calendar) time */
381 ifnet_llreach_up2calexp(lr
, ln
->ln_lastused
);
387 nd6_llinfo_get_iflri(struct rtentry
*rt
, struct ifnet_llreach_info
*iflri
)
389 struct llinfo_nd6
*ln
= rt
->rt_llinfo
;
390 struct if_llreach
*lr
= ln
->ln_llreach
;
393 bzero(iflri
, sizeof (*iflri
));
394 iflri
->iflri_rssi
= IFNET_RSSI_UNKNOWN
;
395 iflri
->iflri_lqm
= IFNET_LQM_THRESH_OFF
;
396 iflri
->iflri_npm
= IFNET_NPM_THRESH_UNKNOWN
;
399 /* Export to ifnet_llreach_info structure */
400 ifnet_lr2iflri(lr
, iflri
);
401 /* Export ND6 send expiration (uptime) time */
402 iflri
->iflri_snd_expire
=
403 ifnet_llreach_up2upexp(lr
, ln
->ln_lastused
);
409 nd6_llinfo_refresh(struct rtentry
*rt
)
411 struct llinfo_nd6
*ln
= rt
->rt_llinfo
;
412 uint64_t timenow
= net_uptime();
414 * Can't refresh permanent, static or entries that are
415 * not direct host entries
417 if (!ln
|| ln
->ln_expire
== 0 ||
418 (rt
->rt_flags
& RTF_STATIC
) ||
419 !(rt
->rt_flags
& RTF_LLINFO
)) {
423 if ((ln
->ln_state
> ND6_LLINFO_INCOMPLETE
) &&
424 (ln
->ln_state
< ND6_LLINFO_PROBE
)) {
425 if (ln
->ln_expire
> timenow
) {
426 ln_setexpire(ln
, timenow
);
427 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_PROBE
);
434 ndcache_state2str(short ndp_state
)
436 const char *ndp_state_str
= "UNKNOWN";
438 case ND6_LLINFO_PURGE
:
439 ndp_state_str
= "ND6_LLINFO_PURGE";
441 case ND6_LLINFO_NOSTATE
:
442 ndp_state_str
= "ND6_LLINFO_NOSTATE";
444 case ND6_LLINFO_INCOMPLETE
:
445 ndp_state_str
= "ND6_LLINFO_INCOMPLETE";
447 case ND6_LLINFO_REACHABLE
:
448 ndp_state_str
= "ND6_LLINFO_REACHABLE";
450 case ND6_LLINFO_STALE
:
451 ndp_state_str
= "ND6_LLINFO_STALE";
453 case ND6_LLINFO_DELAY
:
454 ndp_state_str
= "ND6_LLINFO_DELAY";
456 case ND6_LLINFO_PROBE
:
457 ndp_state_str
= "ND6_LLINFO_PROBE";
460 /* Init'd to UNKNOWN */
463 return ndp_state_str
;
467 ln_setexpire(struct llinfo_nd6
*ln
, uint64_t expiry
)
469 ln
->ln_expire
= expiry
;
473 ln_getexpire(struct llinfo_nd6
*ln
)
475 struct timeval caltime
;
478 if (ln
->ln_expire
!= 0) {
479 struct rtentry
*rt
= ln
->ln_rt
;
482 /* account for system time change */
483 getmicrotime(&caltime
);
485 rt
->base_calendartime
+=
486 NET_CALCULATE_CLOCKSKEW(caltime
,
487 rt
->base_calendartime
, net_uptime(), rt
->base_uptime
);
489 expiry
= rt
->base_calendartime
+
490 ln
->ln_expire
- rt
->base_uptime
;
498 nd6_ifreset(struct ifnet
*ifp
)
500 struct nd_ifinfo
*ndi
= ND_IFINFO(ifp
);
502 VERIFY(ndi
->initialized
);
504 LCK_MTX_ASSERT(&ndi
->lock
, LCK_MTX_ASSERT_OWNED
);
505 ndi
->linkmtu
= ifp
->if_mtu
;
506 ndi
->chlim
= IPV6_DEFHLIM
;
507 ndi
->basereachable
= REACHABLE_TIME
;
508 ndi
->reachable
= ND_COMPUTE_RTIME(ndi
->basereachable
);
509 ndi
->retrans
= RETRANS_TIMER
;
513 nd6_ifattach(struct ifnet
*ifp
)
515 struct nd_ifinfo
*ndi
= ND_IFINFO(ifp
);
518 if (!ndi
->initialized
) {
519 lck_mtx_init(&ndi
->lock
, nd_if_lock_grp
, nd_if_lock_attr
);
520 ndi
->flags
= ND6_IFF_PERFORMNUD
;
521 ndi
->flags
|= ND6_IFF_DAD
;
522 ndi
->initialized
= TRUE
;
525 lck_mtx_lock(&ndi
->lock
);
527 if (!(ifp
->if_flags
& IFF_MULTICAST
)) {
528 ndi
->flags
|= ND6_IFF_IFDISABLED
;
532 lck_mtx_unlock(&ndi
->lock
);
539 * XXX Look more into this. Especially since we recycle ifnets and do delayed
543 nd6_ifdetach(struct nd_ifinfo
*nd
)
545 /* XXX destroy nd's lock? */
551 nd6_setmtu(struct ifnet
*ifp
)
553 struct nd_ifinfo
*ndi
= ND_IFINFO(ifp
);
554 u_int32_t oldmaxmtu
, maxmtu
;
556 if ((NULL
== ndi
) || (FALSE
== ndi
->initialized
)) {
560 lck_mtx_lock(&ndi
->lock
);
561 oldmaxmtu
= ndi
->maxmtu
;
564 * The ND level maxmtu is somewhat redundant to the interface MTU
565 * and is an implementation artifact of KAME. Instead of hard-
566 * limiting the maxmtu based on the interface type here, we simply
567 * take the if_mtu value since SIOCSIFMTU would have taken care of
568 * the sanity checks related to the maximum MTU allowed for the
569 * interface (a value that is known only by the interface layer),
570 * by sending the request down via ifnet_ioctl(). The use of the
571 * ND level maxmtu and linkmtu are done via IN6_LINKMTU() which
572 * does further checking against if_mtu.
574 maxmtu
= ndi
->maxmtu
= ifp
->if_mtu
;
577 * Decreasing the interface MTU under IPV6 minimum MTU may cause
578 * undesirable situation. We thus notify the operator of the change
579 * explicitly. The check for oldmaxmtu is necessary to restrict the
580 * log to the case of changing the MTU, not initializing it.
582 if (oldmaxmtu
>= IPV6_MMTU
&& ndi
->maxmtu
< IPV6_MMTU
) {
583 log(LOG_NOTICE
, "nd6_setmtu: "
584 "new link MTU on %s (%u) is too small for IPv6\n",
585 if_name(ifp
), (uint32_t)ndi
->maxmtu
);
587 ndi
->linkmtu
= ifp
->if_mtu
;
588 lck_mtx_unlock(&ndi
->lock
);
590 /* also adjust in6_maxmtu if necessary. */
591 if (maxmtu
> in6_maxmtu
) {
597 nd6_option_init(void *opt
, int icmp6len
, union nd_opts
*ndopts
)
599 bzero(ndopts
, sizeof (*ndopts
));
600 ndopts
->nd_opts_search
= (struct nd_opt_hdr
*)opt
;
601 ndopts
->nd_opts_last
=
602 (struct nd_opt_hdr
*)(((u_char
*)opt
) + icmp6len
);
605 ndopts
->nd_opts_done
= 1;
606 ndopts
->nd_opts_search
= NULL
;
611 * Take one ND option.
614 nd6_option(union nd_opts
*ndopts
)
616 struct nd_opt_hdr
*nd_opt
;
620 panic("ndopts == NULL in nd6_option\n");
621 if (!ndopts
->nd_opts_last
)
622 panic("uninitialized ndopts in nd6_option\n");
623 if (!ndopts
->nd_opts_search
)
625 if (ndopts
->nd_opts_done
)
628 nd_opt
= ndopts
->nd_opts_search
;
630 /* make sure nd_opt_len is inside the buffer */
631 if ((caddr_t
)&nd_opt
->nd_opt_len
>= (caddr_t
)ndopts
->nd_opts_last
) {
632 bzero(ndopts
, sizeof (*ndopts
));
636 olen
= nd_opt
->nd_opt_len
<< 3;
639 * Message validation requires that all included
640 * options have a length that is greater than zero.
642 bzero(ndopts
, sizeof (*ndopts
));
646 ndopts
->nd_opts_search
= (struct nd_opt_hdr
*)((caddr_t
)nd_opt
+ olen
);
647 if (ndopts
->nd_opts_search
> ndopts
->nd_opts_last
) {
648 /* option overruns the end of buffer, invalid */
649 bzero(ndopts
, sizeof (*ndopts
));
651 } else if (ndopts
->nd_opts_search
== ndopts
->nd_opts_last
) {
652 /* reached the end of options chain */
653 ndopts
->nd_opts_done
= 1;
654 ndopts
->nd_opts_search
= NULL
;
660 * Parse multiple ND options.
661 * This function is much easier to use, for ND routines that do not need
662 * multiple options of the same type.
665 nd6_options(union nd_opts
*ndopts
)
667 struct nd_opt_hdr
*nd_opt
;
671 panic("ndopts == NULL in nd6_options");
672 if (ndopts
->nd_opts_last
== NULL
)
673 panic("uninitialized ndopts in nd6_options");
674 if (ndopts
->nd_opts_search
== NULL
)
678 nd_opt
= nd6_option(ndopts
);
679 if (nd_opt
== NULL
&& ndopts
->nd_opts_last
== NULL
) {
681 * Message validation requires that all included
682 * options have a length that is greater than zero.
684 icmp6stat
.icp6s_nd_badopt
++;
685 bzero(ndopts
, sizeof (*ndopts
));
692 switch (nd_opt
->nd_opt_type
) {
693 case ND_OPT_SOURCE_LINKADDR
:
694 case ND_OPT_TARGET_LINKADDR
:
696 case ND_OPT_REDIRECTED_HEADER
:
698 if (ndopts
->nd_opt_array
[nd_opt
->nd_opt_type
]) {
700 "duplicated ND6 option found (type=%d)\n",
701 nd_opt
->nd_opt_type
));
704 ndopts
->nd_opt_array
[nd_opt
->nd_opt_type
] =
708 case ND_OPT_PREFIX_INFORMATION
:
709 if (ndopts
->nd_opt_array
[nd_opt
->nd_opt_type
] == 0) {
710 ndopts
->nd_opt_array
[nd_opt
->nd_opt_type
] =
713 ndopts
->nd_opts_pi_end
=
714 (struct nd_opt_prefix_info
*)nd_opt
;
722 * Unknown options must be silently ignored,
723 * to accomodate future extension to the protocol.
726 "nd6_options: unsupported option %d - "
727 "option ignored\n", nd_opt
->nd_opt_type
));
732 if (i
> nd6_maxndopt
) {
733 icmp6stat
.icp6s_nd_toomanyopt
++;
734 nd6log((LOG_INFO
, "too many loop in nd opt\n"));
738 if (ndopts
->nd_opts_done
)
755 * ND6 service routine to expire default route list and prefix list
758 nd6_service(void *arg
)
760 struct nd6svc_arg
*ap
= arg
;
761 struct llinfo_nd6
*ln
;
762 struct nd_defrouter
*dr
= NULL
;
763 struct nd_prefix
*pr
= NULL
;
764 struct ifnet
*ifp
= NULL
;
765 struct in6_ifaddr
*ia6
, *nia6
;
767 boolean_t send_nc_failure_kev
= FALSE
;
768 struct nd_drhead nd_defrouter_tmp
;
769 struct nd_defrouter
*ndr
= NULL
;
770 struct radix_node_head
*rnh
= rt_tables
[AF_INET6
];
772 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_OWNED
);
774 * Since we may drop rnh_lock and nd6_mutex below, we want
775 * to run this entire operation single threaded.
777 while (nd6_service_busy
) {
778 nd6log2((LOG_DEBUG
, "%s: %s is blocked by %d waiters\n",
779 __func__
, ap
->draining
? "drainer" : "timer",
780 nd6_service_waiters
));
781 nd6_service_waiters
++;
782 (void) msleep(nd6_service_wc
, rnh_lock
, (PZERO
-1),
784 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_OWNED
);
787 /* We are busy now; tell everyone else to go away */
788 nd6_service_busy
= TRUE
;
791 timenow
= net_uptime();
794 * send_nc_failure_kev gets set when default router's IPv6 address
796 * That can happen either:
797 * 1. When the entry has resolved once but can't be
798 * resolved later and the neighbor cache entry for gateway is deleted
799 * after max probe attempts.
801 * 2. When the entry is in ND6_LLINFO_INCOMPLETE but can not be resolved
802 * after max neighbor address resolution attempts.
804 * Both set send_nc_failure_kev to true. ifp is also set to the previous
805 * neighbor cache entry's route's ifp.
806 * Once we are done sending the notification, set send_nc_failure_kev
807 * to false to stop sending false notifications for non default router
810 * We may to send more information like Gateway's IP that could not be
811 * resolved, however right now we do not install more than one default
812 * route per interface in the routing table.
814 if (send_nc_failure_kev
&& ifp
->if_addrlen
== IF_LLREACH_MAXLEN
) {
815 struct kev_msg ev_msg
;
816 struct kev_nd6_ndfailure nd6_ndfailure
;
817 bzero(&ev_msg
, sizeof(ev_msg
));
818 bzero(&nd6_ndfailure
, sizeof(nd6_ndfailure
));
819 ev_msg
.vendor_code
= KEV_VENDOR_APPLE
;
820 ev_msg
.kev_class
= KEV_NETWORK_CLASS
;
821 ev_msg
.kev_subclass
= KEV_ND6_SUBCLASS
;
822 ev_msg
.event_code
= KEV_ND6_NDFAILURE
;
824 nd6_ndfailure
.link_data
.if_family
= ifp
->if_family
;
825 nd6_ndfailure
.link_data
.if_unit
= ifp
->if_unit
;
826 strlcpy(nd6_ndfailure
.link_data
.if_name
,
828 sizeof(nd6_ndfailure
.link_data
.if_name
));
829 ev_msg
.dv
[0].data_ptr
= &nd6_ndfailure
;
830 ev_msg
.dv
[0].data_length
=
831 sizeof(nd6_ndfailure
);
832 dlil_post_complete_msg(NULL
, &ev_msg
);
835 send_nc_failure_kev
= FALSE
;
838 * The global list llinfo_nd6 is modified by nd6_request() and is
839 * therefore protected by rnh_lock. For obvious reasons, we cannot
840 * hold rnh_lock across calls that might lead to code paths which
841 * attempt to acquire rnh_lock, else we deadlock. Hence for such
842 * cases we drop rt_lock and rnh_lock, make the calls, and repeat the
843 * loop. To ensure that we don't process the same entry more than
844 * once in a single timeout, we mark the "already-seen" entries with
845 * ND6_LNF_TIMER_SKIP flag. At the end of the loop, we do a second
846 * pass thru the entries and clear the flag so they can be processed
847 * during the next timeout.
849 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_OWNED
);
851 ln
= llinfo_nd6
.ln_next
;
852 while (ln
!= NULL
&& ln
!= &llinfo_nd6
) {
854 struct sockaddr_in6
*dst
;
855 struct llinfo_nd6
*next
;
856 u_int32_t retrans
, flags
;
857 struct nd_ifinfo
*ndi
= NULL
;
858 boolean_t is_router
= FALSE
;
860 /* ln_next/prev/rt is protected by rnh_lock */
865 /* We've seen this already; skip it */
866 if (ln
->ln_flags
& ND6_LNF_TIMER_SKIP
) {
873 /* rt->rt_ifp should never be NULL */
874 if ((ifp
= rt
->rt_ifp
) == NULL
) {
875 panic("%s: ln(%p) rt(%p) rt_ifp == NULL", __func__
,
880 /* rt_llinfo must always be equal to ln */
881 if ((struct llinfo_nd6
*)rt
->rt_llinfo
!= ln
) {
882 panic("%s: rt_llinfo(%p) is not equal to ln(%p)",
883 __func__
, rt
->rt_llinfo
, ln
);
887 /* rt_key should never be NULL */
888 dst
= SIN6(rt_key(rt
));
890 panic("%s: rt(%p) key is NULL ln(%p)", __func__
,
895 /* Set the flag in case we jump to "again" */
896 ln
->ln_flags
|= ND6_LNF_TIMER_SKIP
;
898 if (ln
->ln_expire
== 0 || (rt
->rt_flags
& RTF_STATIC
)) {
900 } else if (ap
->draining
&& (rt
->rt_refcnt
== 0)) {
902 * If we are draining, immediately purge non-static
903 * entries without oustanding route refcnt.
905 if (ln
->ln_state
> ND6_LLINFO_INCOMPLETE
)
906 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_STALE
);
908 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_PURGE
);
909 ln_setexpire(ln
, timenow
);
913 * If the entry has not expired, skip it. Take note on the
914 * state, as entries that are in the STALE state are simply
915 * waiting to be garbage collected, in which case we can
916 * relax the callout scheduling (use nd6_prune_lazy).
918 if (ln
->ln_expire
> timenow
) {
919 switch (ln
->ln_state
) {
920 case ND6_LLINFO_STALE
:
932 ndi
= ND_IFINFO(ifp
);
933 VERIFY(ndi
->initialized
);
934 retrans
= ndi
->retrans
;
937 RT_LOCK_ASSERT_HELD(rt
);
938 is_router
= (rt
->rt_flags
& RTF_ROUTER
) ? TRUE
: FALSE
;
940 switch (ln
->ln_state
) {
941 case ND6_LLINFO_INCOMPLETE
:
942 if (ln
->ln_asked
< nd6_mmaxtries
) {
943 struct ifnet
*exclifp
= ln
->ln_exclifp
;
945 ln_setexpire(ln
, timenow
+ retrans
/ 1000);
946 RT_ADDREF_LOCKED(rt
);
948 lck_mtx_unlock(rnh_lock
);
949 if (ip6_forwarding
) {
950 nd6_prproxy_ns_output(ifp
, exclifp
,
951 NULL
, &dst
->sin6_addr
, ln
);
953 nd6_ns_output(ifp
, NULL
,
954 &dst
->sin6_addr
, ln
, NULL
);
958 lck_mtx_lock(rnh_lock
);
960 struct mbuf
*m
= ln
->ln_hold
;
962 send_nc_failure_kev
= is_router
;
964 RT_ADDREF_LOCKED(rt
);
966 lck_mtx_unlock(rnh_lock
);
970 mnext
= m
->m_nextpkt
;
972 m
->m_pkthdr
.rcvif
= ifp
;
973 icmp6_error_flag(m
, ICMP6_DST_UNREACH
,
974 ICMP6_DST_UNREACH_ADDR
, 0, 0);
978 RT_ADDREF_LOCKED(rt
);
980 lck_mtx_unlock(rnh_lock
);
984 * Enqueue work item to invoke callback for
987 route_event_enqueue_nwk_wq_entry(rt
, NULL
,
988 ROUTE_LLENTRY_UNREACH
, NULL
, FALSE
);
991 lck_mtx_lock(rnh_lock
);
993 * nd6_free above would flush out the routing table of
994 * any cloned routes with same next-hop.
995 * Walk the tree anyways as there could be static routes
998 * We also already have a reference to rt that gets freed right
999 * after the block below executes. Don't need an extra reference
1003 struct route_event rt_ev
;
1004 route_event_init(&rt_ev
, rt
, NULL
, ROUTE_LLENTRY_UNREACH
);
1005 (void) rnh
->rnh_walktree(rnh
, route_event_walktree
, (void *)&rt_ev
);
1009 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_OWNED
);
1012 case ND6_LLINFO_REACHABLE
:
1013 if (ln
->ln_expire
!= 0) {
1014 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_STALE
);
1015 ln_setexpire(ln
, timenow
+ nd6_gctimer
);
1018 * Enqueue work item to invoke callback for
1021 route_event_enqueue_nwk_wq_entry(rt
, NULL
,
1022 ROUTE_LLENTRY_STALE
, NULL
, TRUE
);
1024 RT_ADDREF_LOCKED(rt
);
1027 struct route_event rt_ev
;
1028 route_event_init(&rt_ev
, rt
, NULL
, ROUTE_LLENTRY_STALE
);
1029 (void) rnh
->rnh_walktree(rnh
, route_event_walktree
, (void *)&rt_ev
);
1037 case ND6_LLINFO_STALE
:
1038 case ND6_LLINFO_PURGE
:
1039 /* Garbage Collection(RFC 4861 5.3) */
1040 if (ln
->ln_expire
!= 0) {
1041 RT_ADDREF_LOCKED(rt
);
1043 lck_mtx_unlock(rnh_lock
);
1046 lck_mtx_lock(rnh_lock
);
1054 case ND6_LLINFO_DELAY
:
1055 if ((flags
& ND6_IFF_PERFORMNUD
) != 0) {
1058 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_PROBE
);
1059 ln_setexpire(ln
, timenow
+ retrans
/ 1000);
1060 RT_ADDREF_LOCKED(rt
);
1062 lck_mtx_unlock(rnh_lock
);
1063 nd6_ns_output(ifp
, &dst
->sin6_addr
,
1064 &dst
->sin6_addr
, ln
, NULL
);
1067 lck_mtx_lock(rnh_lock
);
1070 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_STALE
); /* XXX */
1071 ln_setexpire(ln
, timenow
+ nd6_gctimer
);
1076 case ND6_LLINFO_PROBE
:
1077 if (ln
->ln_asked
< nd6_umaxtries
) {
1079 ln_setexpire(ln
, timenow
+ retrans
/ 1000);
1080 RT_ADDREF_LOCKED(rt
);
1082 lck_mtx_unlock(rnh_lock
);
1083 nd6_ns_output(ifp
, &dst
->sin6_addr
,
1084 &dst
->sin6_addr
, ln
, NULL
);
1087 lck_mtx_lock(rnh_lock
);
1089 is_router
= (rt
->rt_flags
& RTF_ROUTER
) ? TRUE
: FALSE
;
1090 send_nc_failure_kev
= is_router
;
1091 RT_ADDREF_LOCKED(rt
);
1093 lck_mtx_unlock(rnh_lock
);
1098 * Enqueue work item to invoke callback for
1101 route_event_enqueue_nwk_wq_entry(rt
, NULL
,
1102 ROUTE_LLENTRY_UNREACH
, NULL
, FALSE
);
1104 lck_mtx_lock(rnh_lock
);
1106 * nd6_free above would flush out the routing table of
1107 * any cloned routes with same next-hop.
1108 * Walk the tree anyways as there could be static routes
1111 * We also already have a reference to rt that gets freed right
1112 * after the block below executes. Don't need an extra reference
1116 struct route_event rt_ev
;
1117 route_event_init(&rt_ev
, rt
, NULL
, ROUTE_LLENTRY_UNREACH
);
1118 (void) rnh
->rnh_walktree(rnh
,
1119 route_event_walktree
, (void *)&rt_ev
);
1123 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_OWNED
);
1132 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_OWNED
);
1134 /* Now clear the flag from all entries */
1135 ln
= llinfo_nd6
.ln_next
;
1136 while (ln
!= NULL
&& ln
!= &llinfo_nd6
) {
1137 struct rtentry
*rt
= ln
->ln_rt
;
1138 struct llinfo_nd6
*next
= ln
->ln_next
;
1141 if (ln
->ln_flags
& ND6_LNF_TIMER_SKIP
)
1142 ln
->ln_flags
&= ~ND6_LNF_TIMER_SKIP
;
1146 lck_mtx_unlock(rnh_lock
);
1148 /* expire default router list */
1149 TAILQ_INIT(&nd_defrouter_tmp
);
1151 lck_mtx_lock(nd6_mutex
);
1152 TAILQ_FOREACH_SAFE(dr
, &nd_defrouter
, dr_entry
, ndr
) {
1154 if (dr
->expire
!= 0 && dr
->expire
< timenow
) {
1155 VERIFY(dr
->ifp
!= NULL
);
1156 in6_ifstat_inc(dr
->ifp
, ifs6_defrtr_expiry_cnt
);
1157 in6_event_enqueue_nwk_wq_entry(IN6_NDP_RTR_EXPIRY
, dr
->ifp
,
1158 &dr
->rtaddr
, dr
->rtlifetime
);
1159 if (dr
->ifp
!= NULL
&&
1160 dr
->ifp
->if_type
== IFT_CELLULAR
) {
1162 * Some buggy cellular gateways may not send
1163 * periodic router advertisements.
1164 * Or they may send it with router lifetime
1165 * value that is less than the configured Max and Min
1166 * Router Advertisement interval.
1167 * To top that an idle device may not wake up
1168 * when periodic RA is received on cellular
1170 * We could send RS on every wake but RFC
1171 * 4861 precludes that.
1172 * The addresses are of infinite lifetimes
1173 * and are tied to the lifetime of the bearer,
1174 * so keeping the addresses and just getting rid of
1175 * the router does not help us anyways.
1176 * If there's network renumbering, a lifetime with
1177 * value 0 would remove the default router.
1178 * Also it will get deleted as part of purge when
1179 * the PDP context is torn down and configured again.
1180 * For that reason, do not expire the default router
1181 * learned on cellular interface. Ever.
1183 dr
->expire
+= dr
->rtlifetime
;
1185 "%s: Refreshing expired default router entry "
1186 "%s for interface %s\n", __func__
,
1187 ip6_sprintf(&dr
->rtaddr
), if_name(dr
->ifp
)));
1191 * Remove the entry from default router list
1192 * and add it to the temp list.
1193 * nd_defrouter_tmp will be a local temporary
1194 * list as no one else can get the same
1195 * removed entry once it is removed from default
1197 * Remove the reference after calling defrtrlist_del
1199 TAILQ_REMOVE(&nd_defrouter
, dr
, dr_entry
);
1200 TAILQ_INSERT_TAIL(&nd_defrouter_tmp
, dr
, dr_entry
);
1203 if (dr
->expire
== 0 || (dr
->stateflags
& NDDRF_STATIC
))
1211 * Keep the following separate from the above
1212 * iteration of nd_defrouter because it's not safe
1213 * to call defrtrlist_del while iterating global default
1214 * router list. Global list has to be traversed
1215 * while holding nd6_mutex throughout.
1217 * The following call to defrtrlist_del should be
1218 * safe as we are iterating a local list of
1221 TAILQ_FOREACH_SAFE(dr
, &nd_defrouter_tmp
, dr_entry
, ndr
) {
1222 TAILQ_REMOVE(&nd_defrouter_tmp
, dr
, dr_entry
);
1224 NDDR_REMREF(dr
); /* remove list reference */
1226 lck_mtx_unlock(nd6_mutex
);
1229 * expire interface addresses.
1230 * in the past the loop was inside prefix expiry processing.
1231 * However, from a stricter speci-confrmance standpoint, we should
1232 * rather separate address lifetimes and prefix lifetimes.
1235 lck_rw_lock_exclusive(&in6_ifaddr_rwlock
);
1236 for (ia6
= in6_ifaddrs
; ia6
; ia6
= nia6
) {
1238 nia6
= ia6
->ia_next
;
1239 IFA_LOCK(&ia6
->ia_ifa
);
1241 * Extra reference for ourselves; it's no-op if
1242 * we don't have to regenerate temporary address,
1243 * otherwise it protects the address from going
1244 * away since we drop in6_ifaddr_rwlock below.
1246 IFA_ADDREF_LOCKED(&ia6
->ia_ifa
);
1247 /* check address lifetime */
1248 if (IFA6_IS_INVALID(ia6
, timenow
)) {
1250 * If the expiring address is temporary, try
1251 * regenerating a new one. This would be useful when
1252 * we suspended a laptop PC, then turned it on after a
1253 * period that could invalidate all temporary
1254 * addresses. Although we may have to restart the
1255 * loop (see below), it must be after purging the
1256 * address. Otherwise, we'd see an infinite loop of
1259 if (ip6_use_tempaddr
&&
1260 (ia6
->ia6_flags
& IN6_IFF_TEMPORARY
) != 0) {
1262 * NOTE: We have to drop the lock here
1263 * because regen_tmpaddr() eventually calls
1264 * in6_update_ifa(), which must take the lock
1265 * and would otherwise cause a hang. This is
1266 * safe because the goto addrloop leads to a
1267 * re-evaluation of the in6_ifaddrs list
1269 IFA_UNLOCK(&ia6
->ia_ifa
);
1270 lck_rw_done(&in6_ifaddr_rwlock
);
1271 (void) regen_tmpaddr(ia6
);
1273 IFA_UNLOCK(&ia6
->ia_ifa
);
1274 lck_rw_done(&in6_ifaddr_rwlock
);
1278 * Purging the address would have caused
1279 * in6_ifaddr_rwlock to be dropped and reacquired;
1280 * therefore search again from the beginning
1281 * of in6_ifaddrs list.
1283 in6_purgeaddr(&ia6
->ia_ifa
);
1286 if ((ia6
->ia6_flags
& IN6_IFF_TEMPORARY
) == 0) {
1287 in6_ifstat_inc(ia6
->ia_ifa
.ifa_ifp
, ifs6_addr_expiry_cnt
);
1288 in6_event_enqueue_nwk_wq_entry(IN6_NDP_ADDR_EXPIRY
,
1289 ia6
->ia_ifa
.ifa_ifp
, &ia6
->ia_addr
.sin6_addr
,
1292 /* Release extra reference taken above */
1293 IFA_REMREF(&ia6
->ia_ifa
);
1297 * The lazy timer runs every nd6_prune_lazy seconds with at
1298 * most "2 * nd6_prune_lazy - 1" leeway. We consider the worst
1299 * case here and make sure we schedule the regular timer if an
1300 * interface address is about to expire.
1302 if (IFA6_IS_INVALID(ia6
, timenow
+ 3 * nd6_prune_lazy
))
1306 IFA_LOCK_ASSERT_HELD(&ia6
->ia_ifa
);
1307 if (IFA6_IS_DEPRECATED(ia6
, timenow
)) {
1308 int oldflags
= ia6
->ia6_flags
;
1309 ia6
->ia6_flags
|= IN6_IFF_DEPRECATED
;
1312 * Only enqueue the Deprecated event when the address just
1313 * becomes deprecated
1315 if((oldflags
& IN6_IFF_DEPRECATED
) == 0) {
1316 in6_event_enqueue_nwk_wq_entry(IN6_ADDR_MARKED_DEPRECATED
,
1317 ia6
->ia_ifa
.ifa_ifp
, &ia6
->ia_addr
.sin6_addr
,
1321 * If a temporary address has just become deprecated,
1322 * regenerate a new one if possible.
1324 if (ip6_use_tempaddr
&&
1325 (ia6
->ia6_flags
& IN6_IFF_TEMPORARY
) != 0 &&
1326 (oldflags
& IN6_IFF_DEPRECATED
) == 0) {
1328 /* see NOTE above */
1329 IFA_UNLOCK(&ia6
->ia_ifa
);
1330 lck_rw_done(&in6_ifaddr_rwlock
);
1331 if (regen_tmpaddr(ia6
) == 0) {
1333 * A new temporary address is
1335 * XXX: this means the address chain
1336 * has changed while we are still in
1337 * the loop. Although the change
1338 * would not cause disaster (because
1339 * it's not a deletion, but an
1340 * addition,) we'd rather restart the
1341 * loop just for safety. Or does this
1342 * significantly reduce performance??
1344 /* Release extra reference */
1345 IFA_REMREF(&ia6
->ia_ifa
);
1348 lck_rw_lock_exclusive(&in6_ifaddr_rwlock
);
1350 IFA_UNLOCK(&ia6
->ia_ifa
);
1354 * A new RA might have made a deprecated address
1357 ia6
->ia6_flags
&= ~IN6_IFF_DEPRECATED
;
1358 IFA_UNLOCK(&ia6
->ia_ifa
);
1360 LCK_RW_ASSERT(&in6_ifaddr_rwlock
, LCK_RW_ASSERT_EXCLUSIVE
);
1361 /* Release extra reference taken above */
1362 IFA_REMREF(&ia6
->ia_ifa
);
1364 lck_rw_done(&in6_ifaddr_rwlock
);
1366 lck_mtx_lock(nd6_mutex
);
1367 /* expire prefix list */
1368 pr
= nd_prefix
.lh_first
;
1369 while (pr
!= NULL
) {
1372 * check prefix lifetime.
1373 * since pltime is just for autoconf, pltime processing for
1374 * prefix is not necessary.
1377 if (pr
->ndpr_stateflags
& NDPRF_PROCESSED_SERVICE
||
1378 pr
->ndpr_stateflags
& NDPRF_DEFUNCT
) {
1379 pr
->ndpr_stateflags
|= NDPRF_PROCESSED_SERVICE
;
1384 if (pr
->ndpr_expire
!= 0 && pr
->ndpr_expire
< timenow
) {
1386 * address expiration and prefix expiration are
1387 * separate. NEVER perform in6_purgeaddr here.
1389 pr
->ndpr_stateflags
|= NDPRF_PROCESSED_SERVICE
;
1390 NDPR_ADDREF_LOCKED(pr
);
1394 in6_ifstat_inc(pr
->ndpr_ifp
, ifs6_pfx_expiry_cnt
);
1395 in6_event_enqueue_nwk_wq_entry(IN6_NDP_PFX_EXPIRY
,
1396 pr
->ndpr_ifp
, &pr
->ndpr_prefix
.sin6_addr
,
1399 pfxlist_onlink_check();
1400 pr
= nd_prefix
.lh_first
;
1403 if (pr
->ndpr_expire
== 0 ||
1404 (pr
->ndpr_stateflags
& NDPRF_STATIC
))
1408 pr
->ndpr_stateflags
|= NDPRF_PROCESSED_SERVICE
;
1413 LIST_FOREACH(pr
, &nd_prefix
, ndpr_entry
) {
1415 pr
->ndpr_stateflags
&= ~NDPRF_PROCESSED_SERVICE
;
1418 lck_mtx_unlock(nd6_mutex
);
1420 lck_mtx_lock(rnh_lock
);
1421 /* We're done; let others enter */
1422 nd6_service_busy
= FALSE
;
1423 if (nd6_service_waiters
> 0) {
1424 nd6_service_waiters
= 0;
1425 wakeup(nd6_service_wc
);
1430 static int nd6_need_draining
= 0;
1433 nd6_drain(void *arg
)
1436 nd6log2((LOG_DEBUG
, "%s: draining ND6 entries\n", __func__
));
1438 lck_mtx_lock(rnh_lock
);
1439 nd6_need_draining
= 1;
1440 nd6_sched_timeout(NULL
, NULL
);
1441 lck_mtx_unlock(rnh_lock
);
1445 * We use the ``arg'' variable to decide whether or not the timer we're
1446 * running is the fast timer. We do this to reset the nd6_fast_timer_on
1447 * variable so that later we don't end up ignoring a ``fast timer''
1448 * request if the 5 second timer is running (see nd6_sched_timeout).
1451 nd6_timeout(void *arg
)
1453 struct nd6svc_arg sarg
;
1456 lck_mtx_lock(rnh_lock
);
1457 bzero(&sarg
, sizeof (sarg
));
1458 if (nd6_need_draining
!= 0) {
1459 nd6_need_draining
= 0;
1463 nd6log2((LOG_DEBUG
, "%s: found %u, aging_lazy %u, aging %u, "
1464 "sticky %u, killed %u\n", __func__
, sarg
.found
, sarg
.aging_lazy
,
1465 sarg
.aging
, sarg
.sticky
, sarg
.killed
));
1466 /* re-arm the timer if there's work to do */
1468 VERIFY(nd6_timeout_run
>= 0 && nd6_timeout_run
< 2);
1469 if (arg
== &nd6_fast_timer_on
)
1470 nd6_fast_timer_on
= FALSE
;
1471 if (sarg
.aging_lazy
> 0 || sarg
.aging
> 0 || nd6_sched_timeout_want
) {
1472 struct timeval atv
, ltv
, *leeway
;
1473 int lazy
= nd6_prune_lazy
;
1475 if (sarg
.aging
> 0 || lazy
< 1) {
1477 atv
.tv_sec
= nd6_prune
;
1482 atv
.tv_sec
= MAX(nd6_prune
, lazy
);
1484 read_frandom(&buf
, sizeof(buf
));
1485 ltv
.tv_sec
= MAX(buf
% lazy
, 1) * 2;
1488 nd6_sched_timeout(&atv
, leeway
);
1489 } else if (nd6_debug
) {
1490 nd6log2((LOG_DEBUG
, "%s: not rescheduling timer\n", __func__
));
1492 lck_mtx_unlock(rnh_lock
);
1496 nd6_sched_timeout(struct timeval
*atv
, struct timeval
*ltv
)
1500 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_OWNED
);
1503 tv
.tv_sec
= MAX(nd6_prune
, 1);
1505 ltv
= NULL
; /* ignore leeway */
1507 /* see comments on top of this file */
1508 if (nd6_timeout_run
== 0) {
1510 nd6log2((LOG_DEBUG
, "%s: timer scheduled in "
1511 "T+%llus.%lluu (demand %d)\n", __func__
,
1512 (uint64_t)atv
->tv_sec
, (uint64_t)atv
->tv_usec
,
1513 nd6_sched_timeout_want
));
1514 nd6_fast_timer_on
= TRUE
;
1515 timeout(nd6_timeout
, &nd6_fast_timer_on
, tvtohz(atv
));
1517 nd6log2((LOG_DEBUG
, "%s: timer scheduled in "
1518 "T+%llus.%lluu with %llus.%lluu leeway "
1519 "(demand %d)\n", __func__
, (uint64_t)atv
->tv_sec
,
1520 (uint64_t)atv
->tv_usec
, (uint64_t)ltv
->tv_sec
,
1521 (uint64_t)ltv
->tv_usec
, nd6_sched_timeout_want
));
1522 nd6_fast_timer_on
= FALSE
;
1523 timeout_with_leeway(nd6_timeout
, NULL
,
1524 tvtohz(atv
), tvtohz(ltv
));
1527 nd6_sched_timeout_want
= 0;
1528 } else if (nd6_timeout_run
== 1 && ltv
== NULL
&&
1529 nd6_fast_timer_on
== FALSE
) {
1530 nd6log2((LOG_DEBUG
, "%s: fast timer scheduled in "
1531 "T+%llus.%lluu (demand %d)\n", __func__
,
1532 (uint64_t)atv
->tv_sec
, (uint64_t)atv
->tv_usec
,
1533 nd6_sched_timeout_want
));
1534 nd6_fast_timer_on
= TRUE
;
1535 nd6_sched_timeout_want
= 0;
1537 timeout(nd6_timeout
, &nd6_fast_timer_on
, tvtohz(atv
));
1540 nd6log2((LOG_DEBUG
, "%s: not scheduling timer: "
1541 "timers %d, fast_timer %d, T+%llus.%lluu\n",
1542 __func__
, nd6_timeout_run
, nd6_fast_timer_on
,
1543 (uint64_t)atv
->tv_sec
, (uint64_t)atv
->tv_usec
));
1545 nd6log2((LOG_DEBUG
, "%s: not scheduling timer: "
1546 "timers %d, fast_timer %d, T+%llus.%lluu "
1547 "with %llus.%lluu leeway\n", __func__
,
1548 nd6_timeout_run
, nd6_fast_timer_on
,
1549 (uint64_t)atv
->tv_sec
, (uint64_t)atv
->tv_usec
,
1550 (uint64_t)ltv
->tv_sec
, (uint64_t)ltv
->tv_usec
));
1556 * ND6 router advertisement kernel notification
1559 nd6_post_msg(u_int32_t code
, struct nd_prefix_list
*prefix_list
,
1560 u_int32_t list_length
, u_int32_t mtu
)
1562 struct kev_msg ev_msg
;
1563 struct kev_nd6_ra_data nd6_ra_msg_data
;
1564 struct nd_prefix_list
*itr
= prefix_list
;
1566 bzero(&ev_msg
, sizeof (struct kev_msg
));
1567 ev_msg
.vendor_code
= KEV_VENDOR_APPLE
;
1568 ev_msg
.kev_class
= KEV_NETWORK_CLASS
;
1569 ev_msg
.kev_subclass
= KEV_ND6_SUBCLASS
;
1570 ev_msg
.event_code
= code
;
1572 bzero(&nd6_ra_msg_data
, sizeof (nd6_ra_msg_data
));
1574 if (mtu
> 0 && mtu
>= IPV6_MMTU
) {
1575 nd6_ra_msg_data
.mtu
= mtu
;
1576 nd6_ra_msg_data
.flags
|= KEV_ND6_DATA_VALID_MTU
;
1579 if (list_length
> 0 && prefix_list
!= NULL
) {
1580 nd6_ra_msg_data
.list_length
= list_length
;
1581 nd6_ra_msg_data
.flags
|= KEV_ND6_DATA_VALID_PREFIX
;
1584 while (itr
!= NULL
&& nd6_ra_msg_data
.list_index
< list_length
) {
1585 bcopy(&itr
->pr
.ndpr_prefix
, &nd6_ra_msg_data
.prefix
.prefix
,
1586 sizeof (nd6_ra_msg_data
.prefix
.prefix
));
1587 nd6_ra_msg_data
.prefix
.raflags
= itr
->pr
.ndpr_raf
;
1588 nd6_ra_msg_data
.prefix
.prefixlen
= itr
->pr
.ndpr_plen
;
1589 nd6_ra_msg_data
.prefix
.origin
= PR_ORIG_RA
;
1590 nd6_ra_msg_data
.prefix
.vltime
= itr
->pr
.ndpr_vltime
;
1591 nd6_ra_msg_data
.prefix
.pltime
= itr
->pr
.ndpr_pltime
;
1592 nd6_ra_msg_data
.prefix
.expire
= ndpr_getexpire(&itr
->pr
);
1593 nd6_ra_msg_data
.prefix
.flags
= itr
->pr
.ndpr_stateflags
;
1594 nd6_ra_msg_data
.prefix
.refcnt
= itr
->pr
.ndpr_addrcnt
;
1595 nd6_ra_msg_data
.prefix
.if_index
= itr
->pr
.ndpr_ifp
->if_index
;
1597 /* send the message up */
1598 ev_msg
.dv
[0].data_ptr
= &nd6_ra_msg_data
;
1599 ev_msg
.dv
[0].data_length
= sizeof (nd6_ra_msg_data
);
1600 ev_msg
.dv
[1].data_length
= 0;
1601 dlil_post_complete_msg(NULL
, &ev_msg
);
1603 /* clean up for the next prefix */
1604 bzero(&nd6_ra_msg_data
.prefix
, sizeof (nd6_ra_msg_data
.prefix
));
1606 nd6_ra_msg_data
.list_index
++;
1611 * Regenerate deprecated/invalidated temporary address
1614 regen_tmpaddr(struct in6_ifaddr
*ia6
)
1618 struct in6_ifaddr
*public_ifa6
= NULL
;
1619 uint64_t timenow
= net_uptime();
1621 ifp
= ia6
->ia_ifa
.ifa_ifp
;
1622 ifnet_lock_shared(ifp
);
1623 TAILQ_FOREACH(ifa
, &ifp
->if_addrlist
, ifa_list
) {
1624 struct in6_ifaddr
*it6
;
1627 if (ifa
->ifa_addr
->sa_family
!= AF_INET6
) {
1631 it6
= (struct in6_ifaddr
*)ifa
;
1633 /* ignore no autoconf addresses. */
1634 if ((it6
->ia6_flags
& IN6_IFF_AUTOCONF
) == 0) {
1638 /* ignore autoconf addresses with different prefixes. */
1639 if (it6
->ia6_ndpr
== NULL
|| it6
->ia6_ndpr
!= ia6
->ia6_ndpr
) {
1644 * Now we are looking at an autoconf address with the same
1645 * prefix as ours. If the address is temporary and is still
1646 * preferred, do not create another one. It would be rare, but
1647 * could happen, for example, when we resume a laptop PC after
1650 if ((it6
->ia6_flags
& IN6_IFF_TEMPORARY
) != 0 &&
1651 !IFA6_IS_DEPRECATED(it6
, timenow
)) {
1653 if (public_ifa6
!= NULL
)
1654 IFA_REMREF(&public_ifa6
->ia_ifa
);
1660 * This is a public autoconf address that has the same prefix
1661 * as ours. If it is preferred, keep it. We can't break the
1662 * loop here, because there may be a still-preferred temporary
1663 * address with the prefix.
1665 if (!IFA6_IS_DEPRECATED(it6
, timenow
)) {
1666 IFA_ADDREF_LOCKED(ifa
); /* for public_ifa6 */
1668 if (public_ifa6
!= NULL
)
1669 IFA_REMREF(&public_ifa6
->ia_ifa
);
1675 ifnet_lock_done(ifp
);
1677 if (public_ifa6
!= NULL
) {
1680 if ((e
= in6_tmpifadd(public_ifa6
, 0)) != 0) {
1681 log(LOG_NOTICE
, "regen_tmpaddr: failed to create a new"
1682 " tmp addr,errno=%d\n", e
);
1683 IFA_REMREF(&public_ifa6
->ia_ifa
);
1686 IFA_REMREF(&public_ifa6
->ia_ifa
);
1694 * Nuke neighbor cache/prefix/default router management table, right before
1698 nd6_purge(struct ifnet
*ifp
)
1700 struct llinfo_nd6
*ln
;
1701 struct nd_defrouter
*dr
, *ndr
;
1702 struct nd_prefix
*pr
, *npr
;
1704 struct nd_drhead nd_defrouter_tmp
;
1706 TAILQ_INIT(&nd_defrouter_tmp
);
1708 /* Nuke default router list entries toward ifp */
1709 lck_mtx_lock(nd6_mutex
);
1710 TAILQ_FOREACH_SAFE(dr
, &nd_defrouter
, dr_entry
, ndr
) {
1714 * Remove the entry from default router list
1715 * and add it to the temp list.
1716 * nd_defrouter_tmp will be a local temporary
1717 * list as no one else can get the same
1718 * removed entry once it is removed from default
1720 * Remove the reference after calling defrtrlist_del.
1722 * The uninstalled entries have to be iterated first
1723 * when we call defrtrlist_del.
1724 * This is to ensure that we don't end up calling
1725 * default router selection when there are other
1726 * uninstalled candidate default routers on
1728 * If we don't respect that order, we may end
1729 * up missing out on some entries.
1731 * For that reason, installed ones must be inserted
1732 * at the tail and uninstalled ones at the head
1734 TAILQ_REMOVE(&nd_defrouter
, dr
, dr_entry
);
1736 if (dr
->stateflags
& NDDRF_INSTALLED
)
1737 TAILQ_INSERT_TAIL(&nd_defrouter_tmp
, dr
, dr_entry
);
1739 TAILQ_INSERT_HEAD(&nd_defrouter_tmp
, dr
, dr_entry
);
1743 * The following call to defrtrlist_del should be
1744 * safe as we are iterating a local list of
1747 * We don't really need nd6_mutex here but keeping
1748 * it as it is to avoid changing assertios held in
1749 * the functions in the call-path.
1751 TAILQ_FOREACH_SAFE(dr
, &nd_defrouter_tmp
, dr_entry
, ndr
) {
1752 TAILQ_REMOVE(&nd_defrouter_tmp
, dr
, dr_entry
);
1754 NDDR_REMREF(dr
); /* remove list reference */
1757 /* Nuke prefix list entries toward ifp */
1759 for (pr
= nd_prefix
.lh_first
; pr
; pr
= npr
) {
1761 npr
= pr
->ndpr_next
;
1762 if (pr
->ndpr_ifp
== ifp
&&
1763 !(pr
->ndpr_stateflags
& NDPRF_DEFUNCT
)) {
1765 * Because if_detach() does *not* release prefixes
1766 * while purging addresses the reference count will
1767 * still be above zero. We therefore reset it to
1768 * make sure that the prefix really gets purged.
1770 pr
->ndpr_addrcnt
= 0;
1773 * Previously, pr->ndpr_addr is removed as well,
1774 * but I strongly believe we don't have to do it.
1775 * nd6_purge() is only called from in6_ifdetach(),
1776 * which removes all the associated interface addresses
1778 * (jinmei@kame.net 20010129)
1780 NDPR_ADDREF_LOCKED(pr
);
1785 npr
= nd_prefix
.lh_first
;
1791 pfxlist_onlink_check();
1792 lck_mtx_unlock(nd6_mutex
);
1794 /* cancel default outgoing interface setting */
1795 if (nd6_defifindex
== ifp
->if_index
) {
1796 nd6_setdefaultiface(0);
1800 * Perform default router selection even when we are a router,
1801 * if Scoped Routing is enabled.
1803 lck_mtx_lock(nd6_mutex
);
1804 /* refresh default router list */
1805 defrouter_select(ifp
);
1806 lck_mtx_unlock(nd6_mutex
);
1809 * Nuke neighbor cache entries for the ifp.
1810 * Note that rt->rt_ifp may not be the same as ifp,
1811 * due to KAME goto ours hack. See RTM_RESOLVE case in
1812 * nd6_rtrequest(), and ip6_input().
1815 lck_mtx_lock(rnh_lock
);
1816 ln
= llinfo_nd6
.ln_next
;
1817 while (ln
!= NULL
&& ln
!= &llinfo_nd6
) {
1819 struct llinfo_nd6
*nln
;
1824 if (rt
->rt_gateway
!= NULL
&&
1825 rt
->rt_gateway
->sa_family
== AF_LINK
&&
1826 SDL(rt
->rt_gateway
)->sdl_index
== ifp
->if_index
) {
1827 RT_ADDREF_LOCKED(rt
);
1829 lck_mtx_unlock(rnh_lock
);
1831 * See comments on nd6_service() for reasons why
1832 * this loop is repeated; we bite the costs of
1833 * going thru the same llinfo_nd6 more than once
1834 * here, since this purge happens during detach,
1835 * and that unlike the timer case, it's possible
1836 * there's more than one purges happening at the
1837 * same time (thus a flag wouldn't buy anything).
1841 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_NOTOWNED
);
1848 lck_mtx_unlock(rnh_lock
);
1852 * Upon success, the returned route will be locked and the caller is
1853 * responsible for releasing the reference and doing RT_UNLOCK(rt).
1854 * This routine does not require rnh_lock to be held by the caller,
1855 * although it needs to be indicated of such a case in order to call
1856 * the correct variant of the relevant routing routines.
1859 nd6_lookup(struct in6_addr
*addr6
, int create
, struct ifnet
*ifp
, int rt_locked
)
1862 struct sockaddr_in6 sin6
;
1863 unsigned int ifscope
;
1865 bzero(&sin6
, sizeof (sin6
));
1866 sin6
.sin6_len
= sizeof (struct sockaddr_in6
);
1867 sin6
.sin6_family
= AF_INET6
;
1868 sin6
.sin6_addr
= *addr6
;
1870 ifscope
= (ifp
!= NULL
) ? ifp
->if_index
: IFSCOPE_NONE
;
1872 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_OWNED
);
1873 rt
= rtalloc1_scoped_locked(SA(&sin6
), create
, 0, ifscope
);
1875 rt
= rtalloc1_scoped(SA(&sin6
), create
, 0, ifscope
);
1880 if ((rt
->rt_flags
& RTF_LLINFO
) == 0) {
1882 * This is the case for the default route.
1883 * If we want to create a neighbor cache for the
1884 * address, we should free the route for the
1885 * destination and allocate an interface route.
1898 if (create
&& ifp
) {
1900 u_int32_t ifa_flags
;
1904 * If no route is available and create is set,
1905 * we allocate a host route for the destination
1906 * and treat it like an interface route.
1907 * This hack is necessary for a neighbor which can't
1908 * be covered by our own prefix.
1910 ifa
= ifaof_ifpforaddr(SA(&sin6
), ifp
);
1915 * Create a new route. RTF_LLINFO is necessary
1916 * to create a Neighbor Cache entry for the
1917 * destination in nd6_rtrequest which will be
1918 * called in rtrequest via ifa->ifa_rtrequest.
1921 lck_mtx_lock(rnh_lock
);
1923 ifa_flags
= ifa
->ifa_flags
;
1925 if ((e
= rtrequest_scoped_locked(RTM_ADD
,
1926 SA(&sin6
), ifa
->ifa_addr
, SA(&all1_sa
),
1927 (ifa_flags
| RTF_HOST
| RTF_LLINFO
) &
1928 ~RTF_CLONING
, &rt
, ifscope
)) != 0) {
1930 log(LOG_ERR
, "%s: failed to add route "
1931 "for a neighbor(%s), errno=%d\n",
1932 __func__
, ip6_sprintf(addr6
), e
);
1935 lck_mtx_unlock(rnh_lock
);
1941 if (rt
->rt_llinfo
) {
1942 struct llinfo_nd6
*ln
= rt
->rt_llinfo
;
1943 struct nd_ifinfo
*ndi
= ND_IFINFO(rt
->rt_ifp
);
1945 VERIFY((NULL
!= ndi
) && (TRUE
== ndi
->initialized
));
1947 * For interface's that do not perform NUD
1948 * neighbor cache entres must always be marked
1949 * reachable with no expiry
1951 if (ndi
->flags
& ND6_IFF_PERFORMNUD
) {
1952 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_NOSTATE
);
1954 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_REACHABLE
);
1955 ln_setexpire(ln
, 0);
1962 RT_LOCK_ASSERT_HELD(rt
);
1964 * Validation for the entry.
1965 * Note that the check for rt_llinfo is necessary because a cloned
1966 * route from a parent route that has the L flag (e.g. the default
1967 * route to a p2p interface) may have the flag, too, while the
1968 * destination is not actually a neighbor.
1969 * XXX: we can't use rt->rt_ifp to check for the interface, since
1970 * it might be the loopback interface if the entry is for our
1971 * own address on a non-loopback interface. Instead, we should
1972 * use rt->rt_ifa->ifa_ifp, which would specify the REAL
1974 * Note also that ifa_ifp and ifp may differ when we connect two
1975 * interfaces to a same link, install a link prefix to an interface,
1976 * and try to install a neighbor cache on an interface that does not
1977 * have a route to the prefix.
1979 * If the address is from a proxied prefix, the ifa_ifp and ifp might
1980 * not match, because nd6_na_input() could have modified the ifp
1981 * of the route to point to the interface where the NA arrived on,
1982 * hence the test for RTF_PROXY.
1984 if ((rt
->rt_flags
& RTF_GATEWAY
) || (rt
->rt_flags
& RTF_LLINFO
) == 0 ||
1985 rt
->rt_gateway
->sa_family
!= AF_LINK
|| rt
->rt_llinfo
== NULL
||
1986 (ifp
&& rt
->rt_ifa
->ifa_ifp
!= ifp
&&
1987 !(rt
->rt_flags
& RTF_PROXY
))) {
1988 RT_REMREF_LOCKED(rt
);
1991 log(LOG_DEBUG
, "%s: failed to lookup %s "
1992 "(if = %s)\n", __func__
, ip6_sprintf(addr6
),
1993 ifp
? if_name(ifp
) : "unspec");
1994 /* xxx more logs... kazu */
1999 * Caller needs to release reference and call RT_UNLOCK(rt).
2005 * Test whether a given IPv6 address is a neighbor or not, ignoring
2006 * the actual neighbor cache. The neighbor cache is ignored in order
2007 * to not reenter the routing code from within itself.
2010 nd6_is_new_addr_neighbor(struct sockaddr_in6
*addr
, struct ifnet
*ifp
)
2012 struct nd_prefix
*pr
;
2013 struct ifaddr
*dstaddr
;
2015 LCK_MTX_ASSERT(nd6_mutex
, LCK_MTX_ASSERT_OWNED
);
2018 * A link-local address is always a neighbor.
2019 * XXX: a link does not necessarily specify a single interface.
2021 if (IN6_IS_ADDR_LINKLOCAL(&addr
->sin6_addr
)) {
2022 struct sockaddr_in6 sin6_copy
;
2026 * We need sin6_copy since sa6_recoverscope() may modify the
2030 if (sa6_recoverscope(&sin6_copy
, FALSE
))
2031 return (0); /* XXX: should be impossible */
2032 if (in6_setscope(&sin6_copy
.sin6_addr
, ifp
, &zone
))
2034 if (sin6_copy
.sin6_scope_id
== zone
)
2041 * If the address matches one of our addresses,
2042 * it should be a neighbor.
2043 * If the address matches one of our on-link prefixes, it should be a
2046 for (pr
= nd_prefix
.lh_first
; pr
; pr
= pr
->ndpr_next
) {
2048 if (pr
->ndpr_ifp
!= ifp
) {
2052 if (!(pr
->ndpr_stateflags
& NDPRF_ONLINK
)) {
2056 if (IN6_ARE_MASKED_ADDR_EQUAL(&pr
->ndpr_prefix
.sin6_addr
,
2057 &addr
->sin6_addr
, &pr
->ndpr_mask
)) {
2065 * If the address is assigned on the node of the other side of
2066 * a p2p interface, the address should be a neighbor.
2068 dstaddr
= ifa_ifwithdstaddr(SA(addr
));
2069 if (dstaddr
!= NULL
) {
2070 if (dstaddr
->ifa_ifp
== ifp
) {
2071 IFA_REMREF(dstaddr
);
2074 IFA_REMREF(dstaddr
);
2083 * Detect if a given IPv6 address identifies a neighbor on a given link.
2084 * XXX: should take care of the destination of a p2p link?
2087 nd6_is_addr_neighbor(struct sockaddr_in6
*addr
, struct ifnet
*ifp
,
2092 LCK_MTX_ASSERT(nd6_mutex
, LCK_MTX_ASSERT_NOTOWNED
);
2093 lck_mtx_lock(nd6_mutex
);
2094 if (nd6_is_new_addr_neighbor(addr
, ifp
)) {
2095 lck_mtx_unlock(nd6_mutex
);
2098 lck_mtx_unlock(nd6_mutex
);
2101 * Even if the address matches none of our addresses, it might be
2102 * in the neighbor cache.
2104 if ((rt
= nd6_lookup(&addr
->sin6_addr
, 0, ifp
, rt_locked
)) != NULL
) {
2105 RT_LOCK_ASSERT_HELD(rt
);
2106 RT_REMREF_LOCKED(rt
);
2115 * Free an nd6 llinfo entry.
2116 * Since the function would cause significant changes in the kernel, DO NOT
2117 * make it global, unless you have a strong reason for the change, and are sure
2118 * that the change is safe.
2121 nd6_free(struct rtentry
*rt
)
2123 struct llinfo_nd6
*ln
;
2124 struct in6_addr in6
;
2125 struct nd_defrouter
*dr
;
2127 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_NOTOWNED
);
2128 RT_LOCK_ASSERT_NOTHELD(rt
);
2129 lck_mtx_lock(nd6_mutex
);
2132 RT_ADDREF_LOCKED(rt
); /* Extra ref */
2134 in6
= SIN6(rt_key(rt
))->sin6_addr
;
2137 * Prevent another thread from modifying rt_key, rt_gateway
2138 * via rt_setgate() after the rt_lock is dropped by marking
2139 * the route as defunct.
2141 rt
->rt_flags
|= RTF_CONDEMNED
;
2144 * We used to have pfctlinput(PRC_HOSTDEAD) here. Even though it is
2145 * not harmful, it was not really necessary. Perform default router
2146 * selection even when we are a router, if Scoped Routing is enabled.
2148 dr
= defrouter_lookup(&SIN6(rt_key(rt
))->sin6_addr
, rt
->rt_ifp
);
2150 if ((ln
&& ln
->ln_router
) || dr
) {
2152 * rt6_flush must be called whether or not the neighbor
2153 * is in the Default Router List.
2154 * See a corresponding comment in nd6_na_input().
2157 lck_mtx_unlock(nd6_mutex
);
2158 rt6_flush(&in6
, rt
->rt_ifp
);
2159 lck_mtx_lock(nd6_mutex
);
2167 * Unreachablity of a router might affect the default
2168 * router selection and on-link detection of advertised
2173 * Temporarily fake the state to choose a new default
2174 * router and to perform on-link determination of
2175 * prefixes correctly.
2176 * Below the state will be set correctly,
2177 * or the entry itself will be deleted.
2180 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_INCOMPLETE
);
2183 * Since defrouter_select() does not affect the
2184 * on-link determination and MIP6 needs the check
2185 * before the default router selection, we perform
2189 pfxlist_onlink_check();
2192 * refresh default router list
2194 defrouter_select(rt
->rt_ifp
);
2196 RT_LOCK_ASSERT_NOTHELD(rt
);
2197 lck_mtx_unlock(nd6_mutex
);
2199 * Detach the route from the routing tree and the list of neighbor
2200 * caches, and disable the route entry not to be used in already
2203 (void) rtrequest(RTM_DELETE
, rt_key(rt
), NULL
, rt_mask(rt
), 0, NULL
);
2205 /* Extra ref held above; now free it */
2210 nd6_rtrequest(int req
, struct rtentry
*rt
, struct sockaddr
*sa
)
2213 struct sockaddr
*gate
= rt
->rt_gateway
;
2214 struct llinfo_nd6
*ln
= rt
->rt_llinfo
;
2215 static struct sockaddr_dl null_sdl
=
2216 { .sdl_len
= sizeof (null_sdl
), .sdl_family
= AF_LINK
};
2217 struct ifnet
*ifp
= rt
->rt_ifp
;
2220 char buf
[MAX_IPv6_STR_LEN
];
2221 struct nd_ifinfo
*ndi
= ND_IFINFO(rt
->rt_ifp
);
2223 VERIFY((NULL
!= ndi
) && (TRUE
== ndi
->initialized
));
2224 VERIFY(nd6_init_done
);
2225 LCK_MTX_ASSERT(rnh_lock
, LCK_MTX_ASSERT_OWNED
);
2226 RT_LOCK_ASSERT_HELD(rt
);
2229 * We have rnh_lock held, see if we need to schedule the timer;
2230 * we might do this again below during RTM_RESOLVE, but doing it
2231 * now handles all other cases.
2233 if (nd6_sched_timeout_want
)
2234 nd6_sched_timeout(NULL
, NULL
);
2236 if (rt
->rt_flags
& RTF_GATEWAY
)
2239 if (!nd6_need_cache(ifp
) && !(rt
->rt_flags
& RTF_HOST
)) {
2241 * This is probably an interface direct route for a link
2242 * which does not need neighbor caches (e.g. fe80::%lo0/64).
2243 * We do not need special treatment below for such a route.
2244 * Moreover, the RTF_LLINFO flag which would be set below
2245 * would annoy the ndp(8) command.
2250 if (req
== RTM_RESOLVE
) {
2253 if (!nd6_need_cache(ifp
)) { /* stf case */
2256 struct sockaddr_in6 sin6
;
2258 rtkey_to_sa6(rt
, &sin6
);
2260 * nd6_is_addr_neighbor() may call nd6_lookup(),
2261 * therefore we drop rt_lock to avoid deadlock
2262 * during the lookup.
2264 RT_ADDREF_LOCKED(rt
);
2266 no_nd_cache
= !nd6_is_addr_neighbor(&sin6
, ifp
, 1);
2268 RT_REMREF_LOCKED(rt
);
2272 * FreeBSD and BSD/OS often make a cloned host route based
2273 * on a less-specific route (e.g. the default route).
2274 * If the less specific route does not have a "gateway"
2275 * (this is the case when the route just goes to a p2p or an
2276 * stf interface), we'll mistakenly make a neighbor cache for
2277 * the host route, and will see strange neighbor solicitation
2278 * for the corresponding destination. In order to avoid the
2279 * confusion, we check if the destination of the route is
2280 * a neighbor in terms of neighbor discovery, and stop the
2281 * process if not. Additionally, we remove the LLINFO flag
2282 * so that ndp(8) will not try to get the neighbor information
2283 * of the destination.
2286 rt
->rt_flags
&= ~RTF_LLINFO
;
2291 timenow
= net_uptime();
2296 * There is no backward compatibility :)
2298 * if ((rt->rt_flags & RTF_HOST) == 0 &&
2299 * SIN(rt_mask(rt))->sin_addr.s_addr != 0xffffffff)
2300 * rt->rt_flags |= RTF_CLONING;
2302 if ((rt
->rt_flags
& RTF_CLONING
) ||
2303 ((rt
->rt_flags
& RTF_LLINFO
) && ln
== NULL
)) {
2305 * Case 1: This route should come from a route to
2306 * interface (RTF_CLONING case) or the route should be
2307 * treated as on-link but is currently not
2308 * (RTF_LLINFO && ln == NULL case).
2310 if (rt_setgate(rt
, rt_key(rt
), SA(&null_sdl
)) == 0) {
2311 gate
= rt
->rt_gateway
;
2312 SDL(gate
)->sdl_type
= ifp
->if_type
;
2313 SDL(gate
)->sdl_index
= ifp
->if_index
;
2315 * In case we're called before 1.0 sec.
2320 (ifp
->if_eflags
& IFEF_IPV6_ND6ALT
)
2321 ? 0 : MAX(timenow
, 1));
2324 if (rt
->rt_flags
& RTF_CLONING
)
2328 * In IPv4 code, we try to annonuce new RTF_ANNOUNCE entry here.
2329 * We don't do that here since llinfo is not ready yet.
2331 * There are also couple of other things to be discussed:
2332 * - unsolicited NA code needs improvement beforehand
2333 * - RFC4861 says we MAY send multicast unsolicited NA
2334 * (7.2.6 paragraph 4), however, it also says that we
2335 * SHOULD provide a mechanism to prevent multicast NA storm.
2336 * we don't have anything like it right now.
2337 * note that the mechanism needs a mutual agreement
2338 * between proxies, which means that we need to implement
2339 * a new protocol, or a new kludge.
2340 * - from RFC4861 6.2.4, host MUST NOT send an unsolicited RA.
2341 * we need to check ip6forwarding before sending it.
2342 * (or should we allow proxy ND configuration only for
2343 * routers? there's no mention about proxy ND from hosts)
2347 if (!(ifp
->if_flags
& (IFF_POINTOPOINT
| IFF_LOOPBACK
))) {
2349 * Address resolution isn't necessary for a point to
2350 * point link, so we can skip this test for a p2p link.
2352 if (gate
->sa_family
!= AF_LINK
||
2353 gate
->sa_len
< sizeof (null_sdl
)) {
2354 /* Don't complain in case of RTM_ADD */
2355 if (req
== RTM_RESOLVE
) {
2356 log(LOG_ERR
, "%s: route to %s has bad "
2357 "gateway address (sa_family %u "
2358 "sa_len %u) on %s\n", __func__
,
2360 &SIN6(rt_key(rt
))->sin6_addr
, buf
,
2361 sizeof (buf
)), gate
->sa_family
,
2362 gate
->sa_len
, if_name(ifp
));
2366 SDL(gate
)->sdl_type
= ifp
->if_type
;
2367 SDL(gate
)->sdl_index
= ifp
->if_index
;
2370 break; /* This happens on a route change */
2372 * Case 2: This route may come from cloning, or a manual route
2373 * add with a LL address.
2375 rt
->rt_llinfo
= ln
= nd6_llinfo_alloc(M_WAITOK
);
2380 rt
->rt_llinfo_get_ri
= nd6_llinfo_get_ri
;
2381 rt
->rt_llinfo_get_iflri
= nd6_llinfo_get_iflri
;
2382 rt
->rt_llinfo_purge
= nd6_llinfo_purge
;
2383 rt
->rt_llinfo_free
= nd6_llinfo_free
;
2384 rt
->rt_llinfo_refresh
= nd6_llinfo_refresh
;
2385 rt
->rt_flags
|= RTF_LLINFO
;
2387 /* this is required for "ndp" command. - shin */
2389 * For interface's that do not perform NUD
2390 * neighbor cache entries must always be marked
2391 * reachable with no expiry
2393 if ((req
== RTM_ADD
) ||
2394 !(ndi
->flags
& ND6_IFF_PERFORMNUD
)) {
2396 * gate should have some valid AF_LINK entry,
2397 * and ln->ln_expire should have some lifetime
2398 * which is specified by ndp command.
2400 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_REACHABLE
);
2401 ln_setexpire(ln
, 0);
2404 * When req == RTM_RESOLVE, rt is created and
2405 * initialized in rtrequest(), so rt_expire is 0.
2407 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_NOSTATE
);
2408 /* In case we're called before 1.0 sec. has elapsed */
2409 ln_setexpire(ln
, (ifp
->if_eflags
& IFEF_IPV6_ND6ALT
) ?
2410 0 : MAX(timenow
, 1));
2415 /* We have at least one entry; arm the timer if not already */
2416 nd6_sched_timeout(NULL
, NULL
);
2419 * If we have too many cache entries, initiate immediate
2420 * purging for some "less recently used" entries. Note that
2421 * we cannot directly call nd6_free() here because it would
2422 * cause re-entering rtable related routines triggering an LOR
2425 if (ip6_neighborgcthresh
> 0 &&
2426 nd6_inuse
>= ip6_neighborgcthresh
) {
2429 for (i
= 0; i
< 10 && llinfo_nd6
.ln_prev
!= ln
; i
++) {
2430 struct llinfo_nd6
*ln_end
= llinfo_nd6
.ln_prev
;
2431 struct rtentry
*rt_end
= ln_end
->ln_rt
;
2433 /* Move this entry to the head */
2436 LN_INSERTHEAD(ln_end
);
2438 if (ln_end
->ln_expire
== 0) {
2442 if (ln_end
->ln_state
> ND6_LLINFO_INCOMPLETE
)
2443 ND6_CACHE_STATE_TRANSITION(ln_end
, ND6_LLINFO_STALE
);
2445 ND6_CACHE_STATE_TRANSITION(ln_end
, ND6_LLINFO_PURGE
);
2446 ln_setexpire(ln_end
, timenow
);
2452 * check if rt_key(rt) is one of my address assigned
2455 ifa
= (struct ifaddr
*)in6ifa_ifpwithaddr(rt
->rt_ifp
,
2456 &SIN6(rt_key(rt
))->sin6_addr
);
2458 caddr_t macp
= nd6_ifptomac(ifp
);
2459 ln_setexpire(ln
, 0);
2460 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_REACHABLE
);
2462 Bcopy(macp
, LLADDR(SDL(gate
)), ifp
->if_addrlen
);
2463 SDL(gate
)->sdl_alen
= ifp
->if_addrlen
;
2465 if (nd6_useloopback
) {
2466 if (rt
->rt_ifp
!= lo_ifp
) {
2468 * Purge any link-layer info caching.
2470 if (rt
->rt_llinfo_purge
!= NULL
)
2471 rt
->rt_llinfo_purge(rt
);
2474 * Adjust route ref count for the
2477 if (rt
->rt_if_ref_fn
!= NULL
) {
2478 rt
->rt_if_ref_fn(lo_ifp
, 1);
2479 rt
->rt_if_ref_fn(rt
->rt_ifp
,
2483 rt
->rt_ifp
= lo_ifp
;
2485 * If rmx_mtu is not locked, update it
2486 * to the MTU used by the new interface.
2488 if (!(rt
->rt_rmx
.rmx_locks
& RTV_MTU
))
2489 rt
->rt_rmx
.rmx_mtu
= rt
->rt_ifp
->if_mtu
;
2491 * Make sure rt_ifa be equal to the ifaddr
2492 * corresponding to the address.
2493 * We need this because when we refer
2494 * rt_ifa->ia6_flags in ip6_input, we assume
2495 * that the rt_ifa points to the address instead
2496 * of the loopback address.
2498 if (ifa
!= rt
->rt_ifa
) {
2503 } else if (rt
->rt_flags
& RTF_ANNOUNCE
) {
2504 ln_setexpire(ln
, 0);
2505 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_REACHABLE
);
2507 /* join solicited node multicast for proxy ND */
2508 if (ifp
->if_flags
& IFF_MULTICAST
) {
2509 struct in6_addr llsol
;
2510 struct in6_multi
*in6m
;
2513 llsol
= SIN6(rt_key(rt
))->sin6_addr
;
2514 llsol
.s6_addr32
[0] = IPV6_ADDR_INT32_MLL
;
2515 llsol
.s6_addr32
[1] = 0;
2516 llsol
.s6_addr32
[2] = htonl(1);
2517 llsol
.s6_addr8
[12] = 0xff;
2518 if (in6_setscope(&llsol
, ifp
, NULL
))
2520 error
= in6_mc_join(ifp
, &llsol
,
2523 nd6log((LOG_ERR
, "%s: failed to join "
2524 "%s (errno=%d)\n", if_name(ifp
),
2525 ip6_sprintf(&llsol
), error
));
2536 /* leave from solicited node multicast for proxy ND */
2537 if ((rt
->rt_flags
& RTF_ANNOUNCE
) &&
2538 (ifp
->if_flags
& IFF_MULTICAST
)) {
2539 struct in6_addr llsol
;
2540 struct in6_multi
*in6m
;
2542 llsol
= SIN6(rt_key(rt
))->sin6_addr
;
2543 llsol
.s6_addr32
[0] = IPV6_ADDR_INT32_MLL
;
2544 llsol
.s6_addr32
[1] = 0;
2545 llsol
.s6_addr32
[2] = htonl(1);
2546 llsol
.s6_addr8
[12] = 0xff;
2547 if (in6_setscope(&llsol
, ifp
, NULL
) == 0) {
2548 in6_multihead_lock_shared();
2549 IN6_LOOKUP_MULTI(&llsol
, ifp
, in6m
);
2550 in6_multihead_lock_done();
2552 in6_mc_leave(in6m
, NULL
);
2559 * Unchain it but defer the actual freeing until the route
2560 * itself is to be freed. rt->rt_llinfo still points to
2561 * llinfo_nd6, and likewise, ln->ln_rt stil points to this
2562 * route entry, except that RTF_LLINFO is now cleared.
2564 if (ln
->ln_flags
& ND6_LNF_IN_USE
)
2568 * Purge any link-layer info caching.
2570 if (rt
->rt_llinfo_purge
!= NULL
)
2571 rt
->rt_llinfo_purge(rt
);
2573 rt
->rt_flags
&= ~RTF_LLINFO
;
2574 if (ln
->ln_hold
!= NULL
) {
2575 m_freem_list(ln
->ln_hold
);
2582 nd6_siocgdrlst(void *data
, int data_is_64
)
2584 struct in6_drlist_32
*drl_32
;
2585 struct nd_defrouter
*dr
;
2588 LCK_MTX_ASSERT(nd6_mutex
, LCK_MTX_ASSERT_OWNED
);
2590 dr
= TAILQ_FIRST(&nd_defrouter
);
2592 /* XXX Handle mapped defrouter entries */
2593 /* For 64-bit process */
2595 struct in6_drlist_64
*drl_64
;
2597 drl_64
= _MALLOC(sizeof (*drl_64
), M_TEMP
, M_WAITOK
|M_ZERO
);
2601 /* preserve the interface name */
2602 bcopy(data
, drl_64
, sizeof (drl_64
->ifname
));
2604 while (dr
&& i
< DRLSTSIZ
) {
2605 drl_64
->defrouter
[i
].rtaddr
= dr
->rtaddr
;
2606 if (IN6_IS_ADDR_LINKLOCAL(
2607 &drl_64
->defrouter
[i
].rtaddr
)) {
2608 /* XXX: need to this hack for KAME stack */
2609 drl_64
->defrouter
[i
].rtaddr
.s6_addr16
[1] = 0;
2612 "default router list contains a "
2613 "non-linklocal address(%s)\n",
2614 ip6_sprintf(&drl_64
->defrouter
[i
].rtaddr
));
2616 drl_64
->defrouter
[i
].flags
= dr
->flags
;
2617 drl_64
->defrouter
[i
].rtlifetime
= dr
->rtlifetime
;
2618 drl_64
->defrouter
[i
].expire
= nddr_getexpire(dr
);
2619 drl_64
->defrouter
[i
].if_index
= dr
->ifp
->if_index
;
2621 dr
= TAILQ_NEXT(dr
, dr_entry
);
2623 bcopy(drl_64
, data
, sizeof (*drl_64
));
2624 _FREE(drl_64
, M_TEMP
);
2628 /* For 32-bit process */
2629 drl_32
= _MALLOC(sizeof (*drl_32
), M_TEMP
, M_WAITOK
|M_ZERO
);
2633 /* preserve the interface name */
2634 bcopy(data
, drl_32
, sizeof (drl_32
->ifname
));
2636 while (dr
!= NULL
&& i
< DRLSTSIZ
) {
2637 drl_32
->defrouter
[i
].rtaddr
= dr
->rtaddr
;
2638 if (IN6_IS_ADDR_LINKLOCAL(&drl_32
->defrouter
[i
].rtaddr
)) {
2639 /* XXX: need to this hack for KAME stack */
2640 drl_32
->defrouter
[i
].rtaddr
.s6_addr16
[1] = 0;
2643 "default router list contains a "
2644 "non-linklocal address(%s)\n",
2645 ip6_sprintf(&drl_32
->defrouter
[i
].rtaddr
));
2647 drl_32
->defrouter
[i
].flags
= dr
->flags
;
2648 drl_32
->defrouter
[i
].rtlifetime
= dr
->rtlifetime
;
2649 drl_32
->defrouter
[i
].expire
= nddr_getexpire(dr
);
2650 drl_32
->defrouter
[i
].if_index
= dr
->ifp
->if_index
;
2652 dr
= TAILQ_NEXT(dr
, dr_entry
);
2654 bcopy(drl_32
, data
, sizeof (*drl_32
));
2655 _FREE(drl_32
, M_TEMP
);
2660 * XXX meaning of fields, especialy "raflags", is very
2661 * differnet between RA prefix list and RR/static prefix list.
2662 * how about separating ioctls into two?
2665 nd6_siocgprlst(void *data
, int data_is_64
)
2667 struct in6_prlist_32
*prl_32
;
2668 struct nd_prefix
*pr
;
2671 LCK_MTX_ASSERT(nd6_mutex
, LCK_MTX_ASSERT_OWNED
);
2673 pr
= nd_prefix
.lh_first
;
2675 /* XXX Handle mapped defrouter entries */
2676 /* For 64-bit process */
2678 struct in6_prlist_64
*prl_64
;
2680 prl_64
= _MALLOC(sizeof (*prl_64
), M_TEMP
, M_WAITOK
|M_ZERO
);
2684 /* preserve the interface name */
2685 bcopy(data
, prl_64
, sizeof (prl_64
->ifname
));
2687 while (pr
&& i
< PRLSTSIZ
) {
2688 struct nd_pfxrouter
*pfr
;
2692 (void) in6_embedscope(&prl_64
->prefix
[i
].prefix
,
2693 &pr
->ndpr_prefix
, NULL
, NULL
, NULL
);
2694 prl_64
->prefix
[i
].raflags
= pr
->ndpr_raf
;
2695 prl_64
->prefix
[i
].prefixlen
= pr
->ndpr_plen
;
2696 prl_64
->prefix
[i
].vltime
= pr
->ndpr_vltime
;
2697 prl_64
->prefix
[i
].pltime
= pr
->ndpr_pltime
;
2698 prl_64
->prefix
[i
].if_index
= pr
->ndpr_ifp
->if_index
;
2699 prl_64
->prefix
[i
].expire
= ndpr_getexpire(pr
);
2701 pfr
= pr
->ndpr_advrtrs
.lh_first
;
2705 #define RTRADDR prl_64->prefix[i].advrtr[j]
2706 RTRADDR
= pfr
->router
->rtaddr
;
2707 if (IN6_IS_ADDR_LINKLOCAL(&RTRADDR
)) {
2708 /* XXX: hack for KAME */
2709 RTRADDR
.s6_addr16
[1] = 0;
2712 "a router(%s) advertises "
2714 "non-link local address\n",
2715 ip6_sprintf(&RTRADDR
));
2720 pfr
= pfr
->pfr_next
;
2722 prl_64
->prefix
[i
].advrtrs
= j
;
2723 prl_64
->prefix
[i
].origin
= PR_ORIG_RA
;
2729 bcopy(prl_64
, data
, sizeof (*prl_64
));
2730 _FREE(prl_64
, M_TEMP
);
2734 /* For 32-bit process */
2735 prl_32
= _MALLOC(sizeof (*prl_32
), M_TEMP
, M_WAITOK
|M_ZERO
);
2739 /* preserve the interface name */
2740 bcopy(data
, prl_32
, sizeof (prl_32
->ifname
));
2742 while (pr
&& i
< PRLSTSIZ
) {
2743 struct nd_pfxrouter
*pfr
;
2747 (void) in6_embedscope(&prl_32
->prefix
[i
].prefix
,
2748 &pr
->ndpr_prefix
, NULL
, NULL
, NULL
);
2749 prl_32
->prefix
[i
].raflags
= pr
->ndpr_raf
;
2750 prl_32
->prefix
[i
].prefixlen
= pr
->ndpr_plen
;
2751 prl_32
->prefix
[i
].vltime
= pr
->ndpr_vltime
;
2752 prl_32
->prefix
[i
].pltime
= pr
->ndpr_pltime
;
2753 prl_32
->prefix
[i
].if_index
= pr
->ndpr_ifp
->if_index
;
2754 prl_32
->prefix
[i
].expire
= ndpr_getexpire(pr
);
2756 pfr
= pr
->ndpr_advrtrs
.lh_first
;
2760 #define RTRADDR prl_32->prefix[i].advrtr[j]
2761 RTRADDR
= pfr
->router
->rtaddr
;
2762 if (IN6_IS_ADDR_LINKLOCAL(&RTRADDR
)) {
2763 /* XXX: hack for KAME */
2764 RTRADDR
.s6_addr16
[1] = 0;
2767 "a router(%s) advertises "
2769 "non-link local address\n",
2770 ip6_sprintf(&RTRADDR
));
2775 pfr
= pfr
->pfr_next
;
2777 prl_32
->prefix
[i
].advrtrs
= j
;
2778 prl_32
->prefix
[i
].origin
= PR_ORIG_RA
;
2784 bcopy(prl_32
, data
, sizeof (*prl_32
));
2785 _FREE(prl_32
, M_TEMP
);
2790 nd6_ioctl(u_long cmd
, caddr_t data
, struct ifnet
*ifp
)
2792 struct nd_defrouter
*dr
;
2793 struct nd_prefix
*pr
;
2797 VERIFY(ifp
!= NULL
);
2800 case SIOCGDRLST_IN6_32
: /* struct in6_drlist_32 */
2801 case SIOCGDRLST_IN6_64
: /* struct in6_drlist_64 */
2803 * obsolete API, use sysctl under net.inet6.icmp6
2805 lck_mtx_lock(nd6_mutex
);
2806 error
= nd6_siocgdrlst(data
, cmd
== SIOCGDRLST_IN6_64
);
2807 lck_mtx_unlock(nd6_mutex
);
2810 case SIOCGPRLST_IN6_32
: /* struct in6_prlist_32 */
2811 case SIOCGPRLST_IN6_64
: /* struct in6_prlist_64 */
2813 * obsolete API, use sysctl under net.inet6.icmp6
2815 lck_mtx_lock(nd6_mutex
);
2816 error
= nd6_siocgprlst(data
, cmd
== SIOCGPRLST_IN6_64
);
2817 lck_mtx_unlock(nd6_mutex
);
2820 case OSIOCGIFINFO_IN6
: /* struct in6_ondireq */
2821 case SIOCGIFINFO_IN6
: { /* struct in6_ondireq */
2823 struct in6_ondireq
*ondi
= (struct in6_ondireq
*)(void *)data
;
2824 struct nd_ifinfo
*ndi
;
2826 * SIOCGIFINFO_IN6 ioctl is encoded with in6_ondireq
2827 * instead of in6_ndireq, so we treat it as such.
2829 ndi
= ND_IFINFO(ifp
);
2830 if ((NULL
== ndi
) || (FALSE
== ndi
->initialized
)){
2834 lck_mtx_lock(&ndi
->lock
);
2835 linkmtu
= IN6_LINKMTU(ifp
);
2836 bcopy(&linkmtu
, &ondi
->ndi
.linkmtu
, sizeof (linkmtu
));
2837 bcopy(&ndi
->maxmtu
, &ondi
->ndi
.maxmtu
,
2838 sizeof (u_int32_t
));
2839 bcopy(&ndi
->basereachable
, &ondi
->ndi
.basereachable
,
2840 sizeof (u_int32_t
));
2841 bcopy(&ndi
->reachable
, &ondi
->ndi
.reachable
,
2842 sizeof (u_int32_t
));
2843 bcopy(&ndi
->retrans
, &ondi
->ndi
.retrans
,
2844 sizeof (u_int32_t
));
2845 bcopy(&ndi
->flags
, &ondi
->ndi
.flags
,
2846 sizeof (u_int32_t
));
2847 bcopy(&ndi
->recalctm
, &ondi
->ndi
.recalctm
,
2849 ondi
->ndi
.chlim
= ndi
->chlim
;
2850 ondi
->ndi
.receivedra
= 0;
2851 lck_mtx_unlock(&ndi
->lock
);
2855 case SIOCSIFINFO_FLAGS
: { /* struct in6_ndireq */
2857 * XXX BSD has a bunch of checks here to ensure
2858 * that interface disabled flag is not reset if
2859 * link local address has failed DAD.
2860 * Investigate that part.
2862 struct in6_ndireq
*cndi
= (struct in6_ndireq
*)(void *)data
;
2863 u_int32_t oflags
, flags
;
2864 struct nd_ifinfo
*ndi
= ND_IFINFO(ifp
);
2866 /* XXX: almost all other fields of cndi->ndi is unused */
2867 if ((NULL
== ndi
) || !ndi
->initialized
) {
2872 lck_mtx_lock(&ndi
->lock
);
2873 oflags
= ndi
->flags
;
2874 bcopy(&cndi
->ndi
.flags
, &(ndi
->flags
), sizeof (flags
));
2876 lck_mtx_unlock(&ndi
->lock
);
2878 if (oflags
== flags
) {
2882 error
= nd6_setifinfo(ifp
, oflags
, flags
);
2886 case SIOCSNDFLUSH_IN6
: /* struct in6_ifreq */
2887 /* flush default router list */
2889 * xxx sumikawa: should not delete route if default
2890 * route equals to the top of default router list
2892 lck_mtx_lock(nd6_mutex
);
2894 defrouter_select(ifp
);
2895 lck_mtx_unlock(nd6_mutex
);
2896 /* xxx sumikawa: flush prefix list */
2899 case SIOCSPFXFLUSH_IN6
: { /* struct in6_ifreq */
2900 /* flush all the prefix advertised by routers */
2901 struct nd_prefix
*next
= NULL
;
2903 lck_mtx_lock(nd6_mutex
);
2904 for (pr
= nd_prefix
.lh_first
; pr
; pr
= next
) {
2905 struct in6_ifaddr
*ia
= NULL
;
2906 bool iterate_pfxlist_again
= false;
2908 next
= pr
->ndpr_next
;
2911 if (IN6_IS_ADDR_LINKLOCAL(&pr
->ndpr_prefix
.sin6_addr
)) {
2915 if (ifp
!= lo_ifp
&& pr
->ndpr_ifp
!= ifp
) {
2919 /* do we really have to remove addresses as well? */
2920 NDPR_ADDREF_LOCKED(pr
);
2922 lck_rw_lock_exclusive(&in6_ifaddr_rwlock
);
2924 while (ia
!= NULL
) {
2925 IFA_LOCK(&ia
->ia_ifa
);
2926 if ((ia
->ia6_flags
& IN6_IFF_AUTOCONF
) == 0) {
2927 IFA_UNLOCK(&ia
->ia_ifa
);
2932 if (ia
->ia6_ndpr
== pr
) {
2933 IFA_ADDREF_LOCKED(&ia
->ia_ifa
);
2934 IFA_UNLOCK(&ia
->ia_ifa
);
2935 lck_rw_done(&in6_ifaddr_rwlock
);
2936 lck_mtx_unlock(nd6_mutex
);
2937 in6_purgeaddr(&ia
->ia_ifa
);
2938 IFA_REMREF(&ia
->ia_ifa
);
2939 lck_mtx_lock(nd6_mutex
);
2940 lck_rw_lock_exclusive(
2941 &in6_ifaddr_rwlock
);
2943 * Purging the address caused
2944 * in6_ifaddr_rwlock to be
2946 * reacquired; therefore search again
2947 * from the beginning of in6_ifaddrs.
2948 * The same applies for the prefix list.
2951 iterate_pfxlist_again
= true;
2954 IFA_UNLOCK(&ia
->ia_ifa
);
2957 lck_rw_done(&in6_ifaddr_rwlock
);
2961 pfxlist_onlink_check();
2963 if (iterate_pfxlist_again
) {
2964 next
= nd_prefix
.lh_first
;
2967 lck_mtx_unlock(nd6_mutex
);
2971 case SIOCSRTRFLUSH_IN6
: { /* struct in6_ifreq */
2972 /* flush all the default routers */
2973 struct nd_defrouter
*next
;
2974 struct nd_drhead nd_defrouter_tmp
;
2976 TAILQ_INIT(&nd_defrouter_tmp
);
2977 lck_mtx_lock(nd6_mutex
);
2978 if ((dr
= TAILQ_FIRST(&nd_defrouter
)) != NULL
) {
2980 * The first entry of the list may be stored in
2981 * the routing table, so we'll delete it later.
2983 for (dr
= TAILQ_NEXT(dr
, dr_entry
); dr
; dr
= next
) {
2984 next
= TAILQ_NEXT(dr
, dr_entry
);
2985 if (ifp
== lo_ifp
|| dr
->ifp
== ifp
) {
2987 * Remove the entry from default router list
2988 * and add it to the temp list.
2989 * nd_defrouter_tmp will be a local temporary
2990 * list as no one else can get the same
2991 * removed entry once it is removed from default
2993 * Remove the reference after calling defrtrlist_de
2995 TAILQ_REMOVE(&nd_defrouter
, dr
, dr_entry
);
2996 TAILQ_INSERT_TAIL(&nd_defrouter_tmp
, dr
, dr_entry
);
3000 dr
= TAILQ_FIRST(&nd_defrouter
);
3001 if (ifp
== lo_ifp
||
3003 TAILQ_REMOVE(&nd_defrouter
, dr
, dr_entry
);
3004 TAILQ_INSERT_TAIL(&nd_defrouter_tmp
, dr
, dr_entry
);
3009 * Keep the following separate from the above iteration of
3010 * nd_defrouter because it's not safe to call
3011 * defrtrlist_del while iterating global default
3012 * router list. Global list has to be traversed
3013 * while holding nd6_mutex throughout.
3015 * The following call to defrtrlist_del should be
3016 * safe as we are iterating a local list of
3019 TAILQ_FOREACH_SAFE(dr
, &nd_defrouter_tmp
, dr_entry
, next
) {
3020 TAILQ_REMOVE(&nd_defrouter_tmp
, dr
, dr_entry
);
3022 NDDR_REMREF(dr
); /* remove list reference */
3024 lck_mtx_unlock(nd6_mutex
);
3028 case SIOCGNBRINFO_IN6_32
: { /* struct in6_nbrinfo_32 */
3029 struct llinfo_nd6
*ln
;
3030 struct in6_nbrinfo_32 nbi_32
;
3031 struct in6_addr nb_addr
; /* make local for safety */
3033 bcopy(data
, &nbi_32
, sizeof (nbi_32
));
3034 nb_addr
= nbi_32
.addr
;
3036 * XXX: KAME specific hack for scoped addresses
3037 * XXXX: for other scopes than link-local?
3039 if (IN6_IS_ADDR_LINKLOCAL(&nbi_32
.addr
) ||
3040 IN6_IS_ADDR_MC_LINKLOCAL(&nbi_32
.addr
)) {
3042 (u_int16_t
*)(void *)&nb_addr
.s6_addr
[2];
3045 *idp
= htons(ifp
->if_index
);
3048 /* Callee returns a locked route upon success */
3049 if ((rt
= nd6_lookup(&nb_addr
, 0, ifp
, 0)) == NULL
) {
3053 RT_LOCK_ASSERT_HELD(rt
);
3055 nbi_32
.state
= ln
->ln_state
;
3056 nbi_32
.asked
= ln
->ln_asked
;
3057 nbi_32
.isrouter
= ln
->ln_router
;
3058 nbi_32
.expire
= ln_getexpire(ln
);
3059 RT_REMREF_LOCKED(rt
);
3061 bcopy(&nbi_32
, data
, sizeof (nbi_32
));
3065 case SIOCGNBRINFO_IN6_64
: { /* struct in6_nbrinfo_64 */
3066 struct llinfo_nd6
*ln
;
3067 struct in6_nbrinfo_64 nbi_64
;
3068 struct in6_addr nb_addr
; /* make local for safety */
3070 bcopy(data
, &nbi_64
, sizeof (nbi_64
));
3071 nb_addr
= nbi_64
.addr
;
3073 * XXX: KAME specific hack for scoped addresses
3074 * XXXX: for other scopes than link-local?
3076 if (IN6_IS_ADDR_LINKLOCAL(&nbi_64
.addr
) ||
3077 IN6_IS_ADDR_MC_LINKLOCAL(&nbi_64
.addr
)) {
3079 (u_int16_t
*)(void *)&nb_addr
.s6_addr
[2];
3082 *idp
= htons(ifp
->if_index
);
3085 /* Callee returns a locked route upon success */
3086 if ((rt
= nd6_lookup(&nb_addr
, 0, ifp
, 0)) == NULL
) {
3090 RT_LOCK_ASSERT_HELD(rt
);
3092 nbi_64
.state
= ln
->ln_state
;
3093 nbi_64
.asked
= ln
->ln_asked
;
3094 nbi_64
.isrouter
= ln
->ln_router
;
3095 nbi_64
.expire
= ln_getexpire(ln
);
3096 RT_REMREF_LOCKED(rt
);
3098 bcopy(&nbi_64
, data
, sizeof (nbi_64
));
3102 case SIOCGDEFIFACE_IN6_32
: /* struct in6_ndifreq_32 */
3103 case SIOCGDEFIFACE_IN6_64
: { /* struct in6_ndifreq_64 */
3104 struct in6_ndifreq_64
*ndif_64
=
3105 (struct in6_ndifreq_64
*)(void *)data
;
3106 struct in6_ndifreq_32
*ndif_32
=
3107 (struct in6_ndifreq_32
*)(void *)data
;
3109 if (cmd
== SIOCGDEFIFACE_IN6_64
) {
3110 u_int64_t j
= nd6_defifindex
;
3111 bcopy(&j
, &ndif_64
->ifindex
, sizeof (j
));
3113 bcopy(&nd6_defifindex
, &ndif_32
->ifindex
,
3114 sizeof (u_int32_t
));
3119 case SIOCSDEFIFACE_IN6_32
: /* struct in6_ndifreq_32 */
3120 case SIOCSDEFIFACE_IN6_64
: { /* struct in6_ndifreq_64 */
3121 struct in6_ndifreq_64
*ndif_64
=
3122 (struct in6_ndifreq_64
*)(void *)data
;
3123 struct in6_ndifreq_32
*ndif_32
=
3124 (struct in6_ndifreq_32
*)(void *)data
;
3127 if (cmd
== SIOCSDEFIFACE_IN6_64
) {
3129 bcopy(&ndif_64
->ifindex
, &j
, sizeof (j
));
3132 bcopy(&ndif_32
->ifindex
, &idx
, sizeof (idx
));
3135 error
= nd6_setdefaultiface(idx
);
3139 case SIOCGIFCGAPREP_IN6
:
3140 case SIOCSIFCGAPREP_IN6
:
3142 struct in6_cgareq
*p_cgareq
=
3143 (struct in6_cgareq
*)(void *)data
;
3144 struct nd_ifinfo
*ndi
= ND_IFINFO(ifp
);
3146 struct in6_cga_modifier
*req_cga_mod
=
3147 &(p_cgareq
->cgar_cgaprep
.cga_modifier
);
3148 struct in6_cga_modifier
*ndi_cga_mod
= NULL
;
3150 if ((NULL
== ndi
) || !ndi
->initialized
) {
3155 lck_mtx_lock(&ndi
->lock
);
3156 ndi_cga_mod
= &(ndi
->local_cga_modifier
);
3158 if (cmd
== SIOCSIFCGAPREP_IN6
) {
3159 bcopy(req_cga_mod
, ndi_cga_mod
, sizeof(*ndi_cga_mod
));
3160 ndi
->cga_initialized
= TRUE
;
3162 bcopy(ndi_cga_mod
, req_cga_mod
, sizeof(*req_cga_mod
));
3164 lck_mtx_unlock(&ndi
->lock
);
3173 * Create neighbor cache entry and cache link-layer address,
3174 * on reception of inbound ND6 packets. (RS/RA/NS/redirect)
3177 nd6_cache_lladdr(struct ifnet
*ifp
, struct in6_addr
*from
, char *lladdr
,
3178 int lladdrlen
, int type
, int code
)
3180 #pragma unused(lladdrlen)
3181 struct rtentry
*rt
= NULL
;
3182 struct llinfo_nd6
*ln
= NULL
;
3184 struct sockaddr_dl
*sdl
= NULL
;
3190 boolean_t sched_timeout
= FALSE
;
3191 struct nd_ifinfo
*ndi
= NULL
;
3194 panic("ifp == NULL in nd6_cache_lladdr");
3196 panic("from == NULL in nd6_cache_lladdr");
3198 /* nothing must be updated for unspecified address */
3199 if (IN6_IS_ADDR_UNSPECIFIED(from
))
3203 * Validation about ifp->if_addrlen and lladdrlen must be done in
3206 timenow
= net_uptime();
3208 rt
= nd6_lookup(from
, 0, ifp
, 0);
3210 if ((rt
= nd6_lookup(from
, 1, ifp
, 0)) == NULL
)
3212 RT_LOCK_ASSERT_HELD(rt
);
3215 RT_LOCK_ASSERT_HELD(rt
);
3216 /* do nothing if static ndp is set */
3217 if (rt
->rt_flags
& RTF_STATIC
) {
3218 RT_REMREF_LOCKED(rt
);
3227 if ((rt
->rt_flags
& (RTF_GATEWAY
| RTF_LLINFO
)) != RTF_LLINFO
) {
3234 ln
= (struct llinfo_nd6
*)rt
->rt_llinfo
;
3237 if (rt
->rt_gateway
== NULL
)
3239 if (rt
->rt_gateway
->sa_family
!= AF_LINK
)
3241 sdl
= SDL(rt
->rt_gateway
);
3243 olladdr
= (sdl
->sdl_alen
) ? 1 : 0;
3244 if (olladdr
&& lladdr
) {
3245 if (bcmp(lladdr
, LLADDR(sdl
), ifp
->if_addrlen
))
3253 * newentry olladdr lladdr llchange (*=record)
3256 * 0 n y -- (3) * STALE
3258 * 0 y y y (5) * STALE
3259 * 1 -- n -- (6) NOSTATE(= PASSIVE)
3260 * 1 -- y -- (7) * STALE
3263 if (lladdr
!= NULL
) { /* (3-5) and (7) */
3265 * Record source link-layer address
3266 * XXX is it dependent to ifp->if_type?
3268 sdl
->sdl_alen
= ifp
->if_addrlen
;
3269 bcopy(lladdr
, LLADDR(sdl
), ifp
->if_addrlen
);
3271 /* cache the gateway (sender HW) address */
3272 nd6_llreach_alloc(rt
, ifp
, LLADDR(sdl
), sdl
->sdl_alen
, FALSE
);
3275 if (is_newentry
== 0) {
3276 if ((!olladdr
&& lladdr
!= NULL
) || /* (3) */
3277 (olladdr
&& lladdr
!= NULL
&& llchange
)) { /* (5) */
3279 newstate
= ND6_LLINFO_STALE
;
3280 } else /* (1-2,4) */
3284 if (lladdr
== NULL
) /* (6) */
3285 newstate
= ND6_LLINFO_NOSTATE
;
3287 newstate
= ND6_LLINFO_STALE
;
3291 * For interface's that do not perform NUD
3292 * neighbor cache entres must always be marked
3293 * reachable with no expiry
3295 ndi
= ND_IFINFO(ifp
);
3296 VERIFY((NULL
!= ndi
) && (TRUE
== ndi
->initialized
));
3298 if (ndi
&& !(ndi
->flags
& ND6_IFF_PERFORMNUD
)) {
3299 newstate
= ND6_LLINFO_REACHABLE
;
3300 ln_setexpire(ln
, 0);
3305 * Update the state of the neighbor cache.
3307 ND6_CACHE_STATE_TRANSITION(ln
, newstate
);
3309 if ((ln
->ln_state
== ND6_LLINFO_STALE
) ||
3310 (ln
->ln_state
== ND6_LLINFO_REACHABLE
)) {
3311 struct mbuf
*m
= ln
->ln_hold
;
3313 * XXX: since nd6_output() below will cause
3314 * state tansition to DELAY and reset the timer,
3315 * we must set the timer now, although it is actually
3318 if (ln
->ln_state
== ND6_LLINFO_STALE
)
3319 ln_setexpire(ln
, timenow
+ nd6_gctimer
);
3323 struct sockaddr_in6 sin6
;
3325 rtkey_to_sa6(rt
, &sin6
);
3327 * we assume ifp is not a p2p here, so just
3328 * set the 2nd argument as the 1st one.
3331 nd6_output_list(ifp
, ifp
, m
, &sin6
, rt
, NULL
);
3334 } else if (ln
->ln_state
== ND6_LLINFO_INCOMPLETE
) {
3335 /* probe right away */
3336 ln_setexpire(ln
, timenow
);
3337 sched_timeout
= TRUE
;
3342 * ICMP6 type dependent behavior.
3344 * NS: clear IsRouter if new entry
3345 * RS: clear IsRouter
3346 * RA: set IsRouter if there's lladdr
3347 * redir: clear IsRouter if new entry
3350 * The spec says that we must set IsRouter in the following cases:
3351 * - If lladdr exist, set IsRouter. This means (1-5).
3352 * - If it is old entry (!newentry), set IsRouter. This means (7).
3353 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
3354 * A quetion arises for (1) case. (1) case has no lladdr in the
3355 * neighbor cache, this is similar to (6).
3356 * This case is rare but we figured that we MUST NOT set IsRouter.
3358 * newentry olladdr lladdr llchange NS RS RA redir
3360 * 0 n n -- (1) c ? s
3361 * 0 y n -- (2) c s s
3362 * 0 n y -- (3) c s s
3365 * 1 -- n -- (6) c c c s
3366 * 1 -- y -- (7) c c s c s
3370 switch (type
& 0xff) {
3371 case ND_NEIGHBOR_SOLICIT
:
3373 * New entry must have is_router flag cleared.
3375 if (is_newentry
) /* (6-7) */
3380 * If the ICMP message is a Redirect to a better router, always
3381 * set the is_router flag. Otherwise, if the entry is newly
3382 * created, then clear the flag. [RFC 4861, sec 8.3]
3384 if (code
== ND_REDIRECT_ROUTER
)
3386 else if (is_newentry
) /* (6-7) */
3389 case ND_ROUTER_SOLICIT
:
3391 * is_router flag must always be cleared.
3395 case ND_ROUTER_ADVERT
:
3397 * Mark an entry with lladdr as a router.
3399 if ((!is_newentry
&& (olladdr
|| lladdr
)) || /* (2-5) */
3400 (is_newentry
&& lladdr
)) { /* (7) */
3407 int route_ev_code
= 0;
3410 route_ev_code
= ROUTE_LLENTRY_CHANGED
;
3412 route_ev_code
= ROUTE_LLENTRY_RESOLVED
;
3414 /* Enqueue work item to invoke callback for this route entry */
3415 route_event_enqueue_nwk_wq_entry(rt
, NULL
, route_ev_code
, NULL
, TRUE
);
3417 if (ln
->ln_router
|| (rt
->rt_flags
& RTF_ROUTER
)) {
3418 struct radix_node_head
*rnh
= NULL
;
3419 struct route_event rt_ev
;
3420 route_event_init(&rt_ev
, rt
, NULL
, llchange
? ROUTE_LLENTRY_CHANGED
:
3421 ROUTE_LLENTRY_RESOLVED
);
3423 * We already have a valid reference on rt.
3424 * The function frees that before returning.
3425 * We therefore don't need an extra reference here
3428 lck_mtx_lock(rnh_lock
);
3430 rnh
= rt_tables
[AF_INET6
];
3432 (void) rnh
->rnh_walktree(rnh
, route_event_walktree
,
3434 lck_mtx_unlock(rnh_lock
);
3440 * When the link-layer address of a router changes, select the
3441 * best router again. In particular, when the neighbor entry is newly
3442 * created, it might affect the selection policy.
3443 * Question: can we restrict the first condition to the "is_newentry"
3446 * Note: Perform default router selection even when we are a router,
3447 * if Scoped Routing is enabled.
3449 if (do_update
&& ln
->ln_router
) {
3450 RT_REMREF_LOCKED(rt
);
3452 lck_mtx_lock(nd6_mutex
);
3453 defrouter_select(ifp
);
3454 lck_mtx_unlock(nd6_mutex
);
3456 RT_REMREF_LOCKED(rt
);
3459 if (sched_timeout
) {
3460 lck_mtx_lock(rnh_lock
);
3461 nd6_sched_timeout(NULL
, NULL
);
3462 lck_mtx_unlock(rnh_lock
);
3467 nd6_slowtimo(void *arg
)
3470 struct nd_ifinfo
*nd6if
= NULL
;
3471 struct ifnet
*ifp
= NULL
;
3473 ifnet_head_lock_shared();
3474 for (ifp
= ifnet_head
.tqh_first
; ifp
;
3475 ifp
= ifp
->if_link
.tqe_next
) {
3476 nd6if
= ND_IFINFO(ifp
);
3477 if ((NULL
== nd6if
) || (FALSE
== nd6if
->initialized
)) {
3481 lck_mtx_lock(&nd6if
->lock
);
3482 if (nd6if
->basereachable
&& /* already initialized */
3483 (nd6if
->recalctm
-= ND6_SLOWTIMER_INTERVAL
) <= 0) {
3485 * Since reachable time rarely changes by router
3486 * advertisements, we SHOULD insure that a new random
3487 * value gets recomputed at least once every few hours.
3490 nd6if
->recalctm
= nd6_recalc_reachtm_interval
;
3492 ND_COMPUTE_RTIME(nd6if
->basereachable
);
3494 lck_mtx_unlock(&nd6if
->lock
);
3497 timeout(nd6_slowtimo
, NULL
, ND6_SLOWTIMER_INTERVAL
* hz
);
3501 nd6_output(struct ifnet
*ifp
, struct ifnet
*origifp
, struct mbuf
*m0
,
3502 struct sockaddr_in6
*dst
, struct rtentry
*hint0
, struct flowadv
*adv
)
3504 return nd6_output_list(ifp
, origifp
, m0
, dst
, hint0
, adv
);
3510 * Assumption: route determination for first packet can be correctly applied to
3511 * all packets in the chain.
3513 #define senderr(e) { error = (e); goto bad; }
3515 nd6_output_list(struct ifnet
*ifp
, struct ifnet
*origifp
, struct mbuf
*m0
,
3516 struct sockaddr_in6
*dst
, struct rtentry
*hint0
, struct flowadv
*adv
)
3518 struct rtentry
*rt
= hint0
, *hint
= hint0
;
3519 struct llinfo_nd6
*ln
= NULL
;
3522 struct rtentry
*rtrele
= NULL
;
3523 struct nd_ifinfo
*ndi
= NULL
;
3527 RT_ADDREF_LOCKED(rt
);
3530 if (IN6_IS_ADDR_MULTICAST(&dst
->sin6_addr
) || !nd6_need_cache(ifp
)) {
3537 * Next hop determination. Because we may involve the gateway route
3538 * in addition to the original route, locking is rather complicated.
3539 * The general concept is that regardless of whether the route points
3540 * to the original route or to the gateway route, this routine takes
3541 * an extra reference on such a route. This extra reference will be
3542 * released at the end.
3544 * Care must be taken to ensure that the "hint0" route never gets freed
3545 * via rtfree(), since the caller may have stored it inside a struct
3546 * route with a reference held for that placeholder.
3548 * This logic is similar to, though not exactly the same as the one
3549 * used by route_to_gwroute().
3553 * We have a reference to "rt" by now (or below via rtalloc1),
3554 * which will either be released or freed at the end of this
3557 RT_LOCK_ASSERT_HELD(rt
);
3558 if (!(rt
->rt_flags
& RTF_UP
)) {
3559 RT_REMREF_LOCKED(rt
);
3561 if ((hint
= rt
= rtalloc1_scoped(SA(dst
), 1, 0,
3562 ifp
->if_index
)) != NULL
) {
3564 if (rt
->rt_ifp
!= ifp
) {
3565 /* XXX: loop care? */
3567 error
= nd6_output_list(ifp
, origifp
, m0
,
3573 senderr(EHOSTUNREACH
);
3577 if (rt
->rt_flags
& RTF_GATEWAY
) {
3578 struct rtentry
*gwrt
;
3579 struct in6_ifaddr
*ia6
= NULL
;
3580 struct sockaddr_in6 gw6
;
3582 rtgw_to_sa6(rt
, &gw6
);
3584 * Must drop rt_lock since nd6_is_addr_neighbor()
3585 * calls nd6_lookup() and acquires rnh_lock.
3590 * We skip link-layer address resolution and NUD
3591 * if the gateway is not a neighbor from ND point
3592 * of view, regardless of the value of nd_ifinfo.flags.
3593 * The second condition is a bit tricky; we skip
3594 * if the gateway is our own address, which is
3595 * sometimes used to install a route to a p2p link.
3597 if (!nd6_is_addr_neighbor(&gw6
, ifp
, 0) ||
3598 (ia6
= in6ifa_ifpwithaddr(ifp
, &gw6
.sin6_addr
))) {
3600 * We allow this kind of tricky route only
3601 * when the outgoing interface is p2p.
3602 * XXX: we may need a more generic rule here.
3605 IFA_REMREF(&ia6
->ia_ifa
);
3606 if ((ifp
->if_flags
& IFF_POINTOPOINT
) == 0)
3607 senderr(EHOSTUNREACH
);
3612 gw6
= *(SIN6(rt
->rt_gateway
));
3614 /* If hint is now down, give up */
3615 if (!(rt
->rt_flags
& RTF_UP
)) {
3617 senderr(EHOSTUNREACH
);
3620 /* If there's no gateway route, look it up */
3621 if ((gwrt
= rt
->rt_gwroute
) == NULL
) {
3625 /* Become a regular mutex */
3626 RT_CONVERT_LOCK(rt
);
3629 * Take gwrt's lock while holding route's lock;
3630 * this is okay since gwrt never points back
3631 * to rt, so no lock ordering issues.
3634 if (!(gwrt
->rt_flags
& RTF_UP
)) {
3635 rt
->rt_gwroute
= NULL
;
3640 lck_mtx_lock(rnh_lock
);
3641 gwrt
= rtalloc1_scoped_locked(SA(&gw6
), 1, 0,
3646 * Bail out if the route is down, no route
3647 * to gateway, circular route, or if the
3648 * gateway portion of "rt" has changed.
3650 if (!(rt
->rt_flags
& RTF_UP
) ||
3651 gwrt
== NULL
|| gwrt
== rt
||
3652 !equal(SA(&gw6
), rt
->rt_gateway
)) {
3654 RT_REMREF_LOCKED(gwrt
);
3659 rtfree_locked(gwrt
);
3660 lck_mtx_unlock(rnh_lock
);
3661 senderr(EHOSTUNREACH
);
3663 VERIFY(gwrt
!= NULL
);
3665 * Set gateway route; callee adds ref to gwrt;
3666 * gwrt has an extra ref from rtalloc1() for
3669 rt_set_gwroute(rt
, rt_key(rt
), gwrt
);
3671 lck_mtx_unlock(rnh_lock
);
3672 /* Remember to release/free "rt" at the end */
3676 RT_ADDREF_LOCKED(gwrt
);
3679 /* Remember to release/free "rt" at the end */
3686 * This is an opportunity to revalidate the parent
3687 * route's gwroute, in case it now points to a dead
3688 * route entry. Parent route won't go away since the
3689 * clone (hint) holds a reference to it. rt == gwrt.
3692 if ((hint
->rt_flags
& (RTF_WASCLONED
| RTF_UP
)) ==
3693 (RTF_WASCLONED
| RTF_UP
)) {
3694 struct rtentry
*prt
= hint
->rt_parent
;
3695 VERIFY(prt
!= NULL
);
3697 RT_CONVERT_LOCK(hint
);
3700 rt_revalidate_gwroute(prt
, rt
);
3707 /* rt == gwrt; if it is now down, give up */
3708 if (!(rt
->rt_flags
& RTF_UP
)) {
3712 /* "rtrele" == original "rt" */
3713 senderr(EHOSTUNREACH
);
3717 /* Become a regular mutex */
3718 RT_CONVERT_LOCK(rt
);
3722 * Address resolution or Neighbor Unreachability Detection
3724 * At this point, the destination of the packet must be a unicast
3725 * or an anycast address(i.e. not a multicast).
3728 /* Look up the neighbor cache for the nexthop */
3729 if (rt
&& (rt
->rt_flags
& RTF_LLINFO
) != 0) {
3732 struct sockaddr_in6 sin6
;
3734 * Clear out Scope ID field in case it is set.
3737 sin6
.sin6_scope_id
= 0;
3739 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
3740 * the condition below is not very efficient. But we believe
3741 * it is tolerable, because this should be a rare case.
3742 * Must drop rt_lock since nd6_is_addr_neighbor() calls
3743 * nd6_lookup() and acquires rnh_lock.
3747 if (nd6_is_addr_neighbor(&sin6
, ifp
, 0)) {
3748 /* "rtrele" may have been used, so clean up "rt" now */
3750 /* Don't free "hint0" */
3756 /* Callee returns a locked route upon success */
3757 rt
= nd6_lookup(&dst
->sin6_addr
, 1, ifp
, 0);
3759 RT_LOCK_ASSERT_HELD(rt
);
3762 } else if (rt
!= NULL
) {
3771 ndi
= ND_IFINFO(ifp
);
3772 VERIFY(ndi
!= NULL
&& ndi
->initialized
);
3773 lck_mtx_lock(&ndi
->lock
);
3774 if ((ifp
->if_flags
& IFF_POINTOPOINT
) == 0 &&
3775 !(ndi
->flags
& ND6_IFF_PERFORMNUD
)) {
3776 lck_mtx_unlock(&ndi
->lock
);
3778 "nd6_output: can't allocate llinfo for %s "
3779 "(ln=0x%llx, rt=0x%llx)\n",
3780 ip6_sprintf(&dst
->sin6_addr
),
3781 (uint64_t)VM_KERNEL_ADDRPERM(ln
),
3782 (uint64_t)VM_KERNEL_ADDRPERM(rt
));
3783 senderr(EIO
); /* XXX: good error? */
3785 lck_mtx_unlock(&ndi
->lock
);
3787 goto sendpkt
; /* send anyway */
3790 net_update_uptime();
3791 timenow
= net_uptime();
3793 /* We don't have to do link-layer address resolution on a p2p link. */
3794 if ((ifp
->if_flags
& IFF_POINTOPOINT
) != 0 &&
3795 ln
->ln_state
< ND6_LLINFO_REACHABLE
) {
3796 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_STALE
);
3797 ln_setexpire(ln
, timenow
+ nd6_gctimer
);
3801 * The first time we send a packet to a neighbor whose entry is
3802 * STALE, we have to change the state to DELAY and a sets a timer to
3803 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
3804 * neighbor unreachability detection on expiration.
3807 if (ln
->ln_state
== ND6_LLINFO_STALE
) {
3809 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_DELAY
);
3810 ln_setexpire(ln
, timenow
+ nd6_delay
);
3811 /* N.B.: we will re-arm the timer below. */
3812 _CASSERT(ND6_LLINFO_DELAY
> ND6_LLINFO_INCOMPLETE
);
3816 * If the neighbor cache entry has a state other than INCOMPLETE
3817 * (i.e. its link-layer address is already resolved), just
3820 if (ln
->ln_state
> ND6_LLINFO_INCOMPLETE
) {
3823 * Move this entry to the head of the queue so that it is
3824 * less likely for this entry to be a target of forced
3825 * garbage collection (see nd6_rtrequest()). Do this only
3826 * if the entry is non-permanent (as permanent ones will
3827 * never be purged), and if the number of active entries
3828 * is at least half of the threshold.
3830 if (ln
->ln_state
== ND6_LLINFO_DELAY
||
3831 (ln
->ln_expire
!= 0 && ip6_neighborgcthresh
> 0 &&
3832 nd6_inuse
>= (ip6_neighborgcthresh
>> 1))) {
3833 lck_mtx_lock(rnh_lock
);
3834 if (ln
->ln_state
== ND6_LLINFO_DELAY
)
3835 nd6_sched_timeout(NULL
, NULL
);
3836 if (ln
->ln_expire
!= 0 && ip6_neighborgcthresh
> 0 &&
3837 nd6_inuse
>= (ip6_neighborgcthresh
>> 1)) {
3839 if (ln
->ln_flags
& ND6_LNF_IN_USE
) {
3845 lck_mtx_unlock(rnh_lock
);
3851 * If this is a prefix proxy route, record the inbound interface
3852 * so that it can be excluded from the list of interfaces eligible
3853 * for forwarding the proxied NS in nd6_prproxy_ns_output().
3855 if (rt
->rt_flags
& RTF_PROXY
)
3856 ln
->ln_exclifp
= ((origifp
== ifp
) ? NULL
: origifp
);
3859 * There is a neighbor cache entry, but no ethernet address
3860 * response yet. Replace the held mbuf (if any) with this
3863 * This code conforms to the rate-limiting rule described in Section
3864 * 7.2.2 of RFC 4861, because the timer is set correctly after sending
3867 if (ln
->ln_state
== ND6_LLINFO_NOSTATE
)
3868 ND6_CACHE_STATE_TRANSITION(ln
, ND6_LLINFO_INCOMPLETE
);
3870 m_freem_list(ln
->ln_hold
);
3872 if (!ND6_LLINFO_PERMANENT(ln
) && ln
->ln_asked
== 0) {
3874 ndi
= ND_IFINFO(ifp
);
3875 VERIFY(ndi
!= NULL
&& ndi
->initialized
);
3876 lck_mtx_lock(&ndi
->lock
);
3877 ln_setexpire(ln
, timenow
+ ndi
->retrans
/ 1000);
3878 lck_mtx_unlock(&ndi
->lock
);
3880 /* We still have a reference on rt (for ln) */
3882 nd6_prproxy_ns_output(ifp
, origifp
, NULL
,
3883 &dst
->sin6_addr
, ln
);
3885 nd6_ns_output(ifp
, NULL
, &dst
->sin6_addr
, ln
, NULL
);
3886 lck_mtx_lock(rnh_lock
);
3887 nd6_sched_timeout(NULL
, NULL
);
3888 lck_mtx_unlock(rnh_lock
);
3893 * Move this entry to the head of the queue so that it is
3894 * less likely for this entry to be a target of forced
3895 * garbage collection (see nd6_rtrequest()). Do this only
3896 * if the entry is non-permanent (as permanent ones will
3897 * never be purged), and if the number of active entries
3898 * is at least half of the threshold.
3900 if (ln
->ln_expire
!= 0 && ip6_neighborgcthresh
> 0 &&
3901 nd6_inuse
>= (ip6_neighborgcthresh
>> 1)) {
3902 lck_mtx_lock(rnh_lock
);
3904 if (ln
->ln_flags
& ND6_LNF_IN_USE
) {
3908 /* Clean up "rt" now while we can */
3910 RT_REMREF_LOCKED(rt
);
3916 rt
= NULL
; /* "rt" has been taken care of */
3917 lck_mtx_unlock(rnh_lock
);
3924 RT_LOCK_ASSERT_NOTHELD(rt
);
3926 /* discard the packet if IPv6 operation is disabled on the interface */
3927 if (ifp
->if_eflags
& IFEF_IPV6_DISABLED
) {
3928 error
= ENETDOWN
; /* better error? */
3932 if (ifp
->if_flags
& IFF_LOOPBACK
) {
3933 /* forwarding rules require the original scope_id */
3934 m0
->m_pkthdr
.rcvif
= origifp
;
3935 error
= dlil_output(origifp
, PF_INET6
, m0
, (caddr_t
)rt
,
3939 /* Do not allow loopback address to wind up on a wire */
3940 struct ip6_hdr
*ip6
= mtod(m0
, struct ip6_hdr
*);
3942 if ((IN6_IS_ADDR_LOOPBACK(&ip6
->ip6_src
) ||
3943 IN6_IS_ADDR_LOOPBACK(&ip6
->ip6_dst
))) {
3944 ip6stat
.ip6s_badscope
++;
3945 error
= EADDRNOTAVAIL
;
3952 /* Mark use timestamp */
3953 if (rt
->rt_llinfo
!= NULL
)
3954 nd6_llreach_use(rt
->rt_llinfo
);
3958 struct mbuf
*mcur
= m0
;
3959 uint32_t pktcnt
= 0;
3962 if (hint
!= NULL
&& nstat_collect
) {
3965 if ((mcur
->m_pkthdr
.csum_flags
& CSUM_TSO_IPV6
) &&
3966 (mcur
->m_pkthdr
.tso_segsz
> 0))
3967 scnt
= mcur
->m_pkthdr
.len
/ mcur
->m_pkthdr
.tso_segsz
;
3971 nstat_route_tx(hint
, scnt
, mcur
->m_pkthdr
.len
, 0);
3975 mcur
->m_pkthdr
.rcvif
= NULL
;
3976 mcur
= mcur
->m_nextpkt
;
3978 if (pktcnt
> ip6_maxchainsent
)
3979 ip6_maxchainsent
= pktcnt
;
3980 error
= dlil_output(ifp
, PF_INET6
, m0
, (caddr_t
)rt
, SA(dst
), 0, adv
);
3988 /* Clean up "rt" unless it's already been done */
3992 RT_REMREF_LOCKED(rt
);
3999 /* And now clean up "rtrele" if there is any */
4000 if (rtrele
!= NULL
) {
4001 RT_LOCK_SPIN(rtrele
);
4002 if (rtrele
== hint0
) {
4003 RT_REMREF_LOCKED(rtrele
);
4015 nd6_need_cache(struct ifnet
*ifp
)
4018 * XXX: we currently do not make neighbor cache on any interface
4019 * other than ARCnet, Ethernet, FDDI and GIF.
4022 * - unidirectional tunnels needs no ND
4024 switch (ifp
->if_type
) {
4030 case IFT_IEEE8023ADLAG
:
4034 case IFT_GIF
: /* XXX need more cases? */
4048 nd6_storelladdr(struct ifnet
*ifp
, struct rtentry
*rt
, struct mbuf
*m
,
4049 struct sockaddr
*dst
, u_char
*desten
)
4052 struct sockaddr_dl
*sdl
;
4054 if (m
->m_flags
& M_MCAST
) {
4055 switch (ifp
->if_type
) {
4059 case IFT_IEEE8023ADLAG
:
4064 ETHER_MAP_IPV6_MULTICAST(&SIN6(dst
)->sin6_addr
, desten
);
4067 for (i
= 0; i
< ifp
->if_addrlen
; i
++)
4074 return (0); /* caller will free mbuf */
4079 /* this could happen, if we could not allocate memory */
4080 return (0); /* caller will free mbuf */
4083 if (rt
->rt_gateway
->sa_family
!= AF_LINK
) {
4084 printf("nd6_storelladdr: something odd happens\n");
4086 return (0); /* caller will free mbuf */
4088 sdl
= SDL(rt
->rt_gateway
);
4089 if (sdl
->sdl_alen
== 0) {
4090 /* this should be impossible, but we bark here for debugging */
4091 printf("nd6_storelladdr: sdl_alen == 0\n");
4093 return (0); /* caller will free mbuf */
4096 bcopy(LLADDR(sdl
), desten
, sdl
->sdl_alen
);
4102 * This is the ND pre-output routine; care must be taken to ensure that
4103 * the "hint" route never gets freed via rtfree(), since the caller may
4104 * have stored it inside a struct route with a reference held for that
4108 nd6_lookup_ipv6(ifnet_t ifp
, const struct sockaddr_in6
*ip6_dest
,
4109 struct sockaddr_dl
*ll_dest
, size_t ll_dest_len
, route_t hint
,
4112 route_t route
= hint
;
4114 struct sockaddr_dl
*sdl
= NULL
;
4117 if (ifp
== NULL
|| ip6_dest
== NULL
)
4120 if (ip6_dest
->sin6_family
!= AF_INET6
)
4121 return (EAFNOSUPPORT
);
4123 if ((ifp
->if_flags
& (IFF_UP
|IFF_RUNNING
)) != (IFF_UP
|IFF_RUNNING
))
4128 * Callee holds a reference on the route and returns
4129 * with the route entry locked, upon success.
4131 result
= route_to_gwroute((const struct sockaddr
*)ip6_dest
,
4136 RT_LOCK_ASSERT_HELD(route
);
4139 if ((packet
!= NULL
&& (packet
->m_flags
& M_MCAST
) != 0) ||
4140 ((ifp
->if_flags
& IFF_MULTICAST
) &&
4141 IN6_IS_ADDR_MULTICAST(&ip6_dest
->sin6_addr
))) {
4144 result
= dlil_resolve_multi(ifp
,
4145 (const struct sockaddr
*)ip6_dest
,
4146 SA(ll_dest
), ll_dest_len
);
4150 } else if (route
== NULL
) {
4153 * For unicast, lookup existing ND6 entries but
4154 * do not trigger a resolution
4156 lck_mtx_lock(rnh_lock
);
4157 route
= rt_lookup(TRUE
,
4158 __DECONST(struct sockaddr
*, ip6_dest
), NULL
,
4159 rt_tables
[AF_INET6
], ifp
->if_index
);
4160 lck_mtx_unlock(rnh_lock
);
4162 if (route
!= NULL
) {
4167 if (route
== NULL
) {
4169 * This could happen, if we could not allocate memory or
4170 * if route_to_gwroute() didn't return a route.
4176 if (route
->rt_gateway
->sa_family
!= AF_LINK
) {
4177 printf("%s: route %s on %s%d gateway address not AF_LINK\n",
4178 __func__
, ip6_sprintf(&ip6_dest
->sin6_addr
),
4179 route
->rt_ifp
->if_name
, route
->rt_ifp
->if_unit
);
4180 result
= EADDRNOTAVAIL
;
4184 sdl
= SDL(route
->rt_gateway
);
4185 if (sdl
->sdl_alen
== 0) {
4186 /* this should be impossible, but we bark here for debugging */
4187 printf("%s: route %s on %s%d sdl_alen == 0\n", __func__
,
4188 ip6_sprintf(&ip6_dest
->sin6_addr
), route
->rt_ifp
->if_name
,
4189 route
->rt_ifp
->if_unit
);
4190 result
= EHOSTUNREACH
;
4194 copy_len
= sdl
->sdl_len
<= ll_dest_len
? sdl
->sdl_len
: ll_dest_len
;
4195 bcopy(sdl
, ll_dest
, copy_len
);
4198 if (route
!= NULL
) {
4199 if (route
== hint
) {
4200 RT_REMREF_LOCKED(route
);
4210 #if (DEVELOPMENT || DEBUG)
4212 static int sysctl_nd6_lookup_ipv6 SYSCTL_HANDLER_ARGS
;
4213 SYSCTL_PROC(_net_inet6_icmp6
, OID_AUTO
, nd6_lookup_ipv6
,
4214 CTLTYPE_STRUCT
| CTLFLAG_RW
| CTLFLAG_LOCKED
, 0, 0,
4215 sysctl_nd6_lookup_ipv6
, "S", "");
4218 sysctl_nd6_lookup_ipv6 SYSCTL_HANDLER_ARGS
4220 #pragma unused(oidp, arg1, arg2)
4222 struct nd6_lookup_ipv6_args nd6_lookup_ipv6_args
;
4226 * Only root can lookup MAC addresses
4228 error
= proc_suser(current_proc());
4230 printf("%s: proc_suser() error %d\n",
4234 if (req
->oldptr
== USER_ADDR_NULL
) {
4235 req
->oldidx
= sizeof(struct nd6_lookup_ipv6_args
);
4237 if (req
->newptr
== USER_ADDR_NULL
) {
4240 if (req
->oldlen
!= sizeof(struct nd6_lookup_ipv6_args
) ||
4241 req
->newlen
!= sizeof(struct nd6_lookup_ipv6_args
)) {
4243 printf("%s: bad req, error %d\n",
4247 error
= SYSCTL_IN(req
, &nd6_lookup_ipv6_args
,
4248 sizeof(struct nd6_lookup_ipv6_args
));
4250 printf("%s: SYSCTL_IN() error %d\n",
4254 /* Make sure to terminate the string */
4255 nd6_lookup_ipv6_args
.ifname
[IFNAMSIZ
- 1] = 0;
4257 error
= ifnet_find_by_name(nd6_lookup_ipv6_args
.ifname
, &ifp
);
4259 printf("%s: ifnet_find_by_name() error %d\n",
4264 error
= nd6_lookup_ipv6(ifp
, &nd6_lookup_ipv6_args
.ip6_dest
,
4265 &nd6_lookup_ipv6_args
.ll_dest_
._sdl
,
4266 nd6_lookup_ipv6_args
.ll_dest_len
, NULL
, NULL
);
4268 printf("%s: nd6_lookup_ipv6() error %d\n",
4273 error
= SYSCTL_OUT(req
, &nd6_lookup_ipv6_args
,
4274 sizeof(struct nd6_lookup_ipv6_args
));
4276 printf("%s: SYSCTL_OUT() error %d\n",
4284 #endif /* (DEVELOPEMENT || DEBUG) */
4287 nd6_setifinfo(struct ifnet
*ifp
, u_int32_t before
, u_int32_t after
)
4293 * Handle ND6_IFF_IFDISABLED
4295 if ((before
& ND6_IFF_IFDISABLED
) ||
4296 (after
& ND6_IFF_IFDISABLED
)) {
4297 b
= (before
& ND6_IFF_IFDISABLED
);
4298 a
= (after
& ND6_IFF_IFDISABLED
);
4300 if (b
!= a
&& (err
= nd6_if_disable(ifp
,
4301 ((int32_t)(a
- b
) > 0))) != 0)
4306 * Handle ND6_IFF_PROXY_PREFIXES
4308 if ((before
& ND6_IFF_PROXY_PREFIXES
) ||
4309 (after
& ND6_IFF_PROXY_PREFIXES
)) {
4310 b
= (before
& ND6_IFF_PROXY_PREFIXES
);
4311 a
= (after
& ND6_IFF_PROXY_PREFIXES
);
4313 if (b
!= a
&& (err
= nd6_if_prproxy(ifp
,
4314 ((int32_t)(a
- b
) > 0))) != 0)
4322 * Enable/disable IPv6 on an interface, called as part of
4323 * setting/clearing ND6_IFF_IFDISABLED, or during DAD failure.
4326 nd6_if_disable(struct ifnet
*ifp
, boolean_t enable
)
4328 ifnet_lock_shared(ifp
);
4330 ifp
->if_eflags
|= IFEF_IPV6_DISABLED
;
4332 ifp
->if_eflags
&= ~IFEF_IPV6_DISABLED
;
4333 ifnet_lock_done(ifp
);
4339 nd6_sysctl_drlist SYSCTL_HANDLER_ARGS
4341 #pragma unused(oidp, arg1, arg2)
4342 char pbuf
[MAX_IPv6_STR_LEN
];
4343 struct nd_defrouter
*dr
;
4346 if (req
->newptr
!= USER_ADDR_NULL
)
4349 /* XXX Handle mapped defrouter entries */
4350 lck_mtx_lock(nd6_mutex
);
4351 if (proc_is64bit(req
->p
)) {
4352 struct in6_defrouter_64 d
;
4354 bzero(&d
, sizeof (d
));
4355 d
.rtaddr
.sin6_family
= AF_INET6
;
4356 d
.rtaddr
.sin6_len
= sizeof (d
.rtaddr
);
4358 TAILQ_FOREACH(dr
, &nd_defrouter
, dr_entry
) {
4359 d
.rtaddr
.sin6_addr
= dr
->rtaddr
;
4360 if (in6_recoverscope(&d
.rtaddr
,
4361 &dr
->rtaddr
, dr
->ifp
) != 0)
4362 log(LOG_ERR
, "scope error in default router "
4363 "list (%s)\n", inet_ntop(AF_INET6
,
4364 &dr
->rtaddr
, pbuf
, sizeof (pbuf
)));
4365 d
.flags
= dr
->flags
;
4366 d
.stateflags
= dr
->stateflags
;
4367 d
.rtlifetime
= dr
->rtlifetime
;
4368 d
.expire
= nddr_getexpire(dr
);
4369 d
.if_index
= dr
->ifp
->if_index
;
4370 error
= SYSCTL_OUT(req
, &d
, sizeof (d
));
4375 struct in6_defrouter_32 d
;
4377 bzero(&d
, sizeof (d
));
4378 d
.rtaddr
.sin6_family
= AF_INET6
;
4379 d
.rtaddr
.sin6_len
= sizeof (d
.rtaddr
);
4381 TAILQ_FOREACH(dr
, &nd_defrouter
, dr_entry
) {
4382 d
.rtaddr
.sin6_addr
= dr
->rtaddr
;
4383 if (in6_recoverscope(&d
.rtaddr
,
4384 &dr
->rtaddr
, dr
->ifp
) != 0)
4385 log(LOG_ERR
, "scope error in default router "
4386 "list (%s)\n", inet_ntop(AF_INET6
,
4387 &dr
->rtaddr
, pbuf
, sizeof (pbuf
)));
4388 d
.flags
= dr
->flags
;
4389 d
.stateflags
= dr
->stateflags
;
4390 d
.rtlifetime
= dr
->rtlifetime
;
4391 d
.expire
= nddr_getexpire(dr
);
4392 d
.if_index
= dr
->ifp
->if_index
;
4393 error
= SYSCTL_OUT(req
, &d
, sizeof (d
));
4398 lck_mtx_unlock(nd6_mutex
);
4403 nd6_sysctl_prlist SYSCTL_HANDLER_ARGS
4405 #pragma unused(oidp, arg1, arg2)
4406 char pbuf
[MAX_IPv6_STR_LEN
];
4407 struct nd_pfxrouter
*pfr
;
4408 struct sockaddr_in6 s6
;
4409 struct nd_prefix
*pr
;
4412 if (req
->newptr
!= USER_ADDR_NULL
)
4415 bzero(&s6
, sizeof (s6
));
4416 s6
.sin6_family
= AF_INET6
;
4417 s6
.sin6_len
= sizeof (s6
);
4419 /* XXX Handle mapped defrouter entries */
4420 lck_mtx_lock(nd6_mutex
);
4421 if (proc_is64bit(req
->p
)) {
4422 struct in6_prefix_64 p
;
4424 bzero(&p
, sizeof (p
));
4425 p
.origin
= PR_ORIG_RA
;
4427 LIST_FOREACH(pr
, &nd_prefix
, ndpr_entry
) {
4429 p
.prefix
= pr
->ndpr_prefix
;
4430 if (in6_recoverscope(&p
.prefix
,
4431 &pr
->ndpr_prefix
.sin6_addr
, pr
->ndpr_ifp
) != 0)
4432 log(LOG_ERR
, "scope error in "
4433 "prefix list (%s)\n", inet_ntop(AF_INET6
,
4434 &p
.prefix
.sin6_addr
, pbuf
, sizeof (pbuf
)));
4435 p
.raflags
= pr
->ndpr_raf
;
4436 p
.prefixlen
= pr
->ndpr_plen
;
4437 p
.vltime
= pr
->ndpr_vltime
;
4438 p
.pltime
= pr
->ndpr_pltime
;
4439 p
.if_index
= pr
->ndpr_ifp
->if_index
;
4440 p
.expire
= ndpr_getexpire(pr
);
4441 p
.refcnt
= pr
->ndpr_addrcnt
;
4442 p
.flags
= pr
->ndpr_stateflags
;
4444 LIST_FOREACH(pfr
, &pr
->ndpr_advrtrs
, pfr_entry
)
4446 error
= SYSCTL_OUT(req
, &p
, sizeof (p
));
4451 LIST_FOREACH(pfr
, &pr
->ndpr_advrtrs
, pfr_entry
) {
4452 s6
.sin6_addr
= pfr
->router
->rtaddr
;
4453 if (in6_recoverscope(&s6
, &pfr
->router
->rtaddr
,
4454 pfr
->router
->ifp
) != 0)
4456 "scope error in prefix list (%s)\n",
4457 inet_ntop(AF_INET6
, &s6
.sin6_addr
,
4458 pbuf
, sizeof (pbuf
)));
4459 error
= SYSCTL_OUT(req
, &s6
, sizeof (s6
));
4468 struct in6_prefix_32 p
;
4470 bzero(&p
, sizeof (p
));
4471 p
.origin
= PR_ORIG_RA
;
4473 LIST_FOREACH(pr
, &nd_prefix
, ndpr_entry
) {
4475 p
.prefix
= pr
->ndpr_prefix
;
4476 if (in6_recoverscope(&p
.prefix
,
4477 &pr
->ndpr_prefix
.sin6_addr
, pr
->ndpr_ifp
) != 0)
4479 "scope error in prefix list (%s)\n",
4480 inet_ntop(AF_INET6
, &p
.prefix
.sin6_addr
,
4481 pbuf
, sizeof (pbuf
)));
4482 p
.raflags
= pr
->ndpr_raf
;
4483 p
.prefixlen
= pr
->ndpr_plen
;
4484 p
.vltime
= pr
->ndpr_vltime
;
4485 p
.pltime
= pr
->ndpr_pltime
;
4486 p
.if_index
= pr
->ndpr_ifp
->if_index
;
4487 p
.expire
= ndpr_getexpire(pr
);
4488 p
.refcnt
= pr
->ndpr_addrcnt
;
4489 p
.flags
= pr
->ndpr_stateflags
;
4491 LIST_FOREACH(pfr
, &pr
->ndpr_advrtrs
, pfr_entry
)
4493 error
= SYSCTL_OUT(req
, &p
, sizeof (p
));
4498 LIST_FOREACH(pfr
, &pr
->ndpr_advrtrs
, pfr_entry
) {
4499 s6
.sin6_addr
= pfr
->router
->rtaddr
;
4500 if (in6_recoverscope(&s6
, &pfr
->router
->rtaddr
,
4501 pfr
->router
->ifp
) != 0)
4503 "scope error in prefix list (%s)\n",
4504 inet_ntop(AF_INET6
, &s6
.sin6_addr
,
4505 pbuf
, sizeof (pbuf
)));
4506 error
= SYSCTL_OUT(req
, &s6
, sizeof (s6
));
4515 lck_mtx_unlock(nd6_mutex
);
4521 in6_ifaddr_set_dadprogress(struct in6_ifaddr
*ia
)
4523 struct ifnet
* ifp
= ia
->ia_ifp
;
4524 uint32_t flags
= IN6_IFF_TENTATIVE
;
4525 uint32_t optdad
= nd6_optimistic_dad
;
4526 struct nd_ifinfo
*ndi
= NULL
;
4528 ndi
= ND_IFINFO(ifp
);
4529 VERIFY((NULL
!= ndi
) && (TRUE
== ndi
->initialized
));
4530 if (!(ndi
->flags
& ND6_IFF_DAD
))
4534 if ((ifp
->if_eflags
& IFEF_IPV6_ROUTER
) != 0) {
4537 lck_mtx_lock(&ndi
->lock
);
4538 if ((ndi
->flags
& ND6_IFF_REPLICATED
) != 0) {
4541 lck_mtx_unlock(&ndi
->lock
);
4546 if ((optdad
& ND6_OPTIMISTIC_DAD_LINKLOCAL
) &&
4547 IN6_IS_ADDR_LINKLOCAL(&ia
->ia_addr
.sin6_addr
))
4548 flags
= IN6_IFF_OPTIMISTIC
;
4549 else if ((optdad
& ND6_OPTIMISTIC_DAD_AUTOCONF
) &&
4550 (ia
->ia6_flags
& IN6_IFF_AUTOCONF
)) {
4551 if (ia
->ia6_flags
& IN6_IFF_TEMPORARY
) {
4552 if (optdad
& ND6_OPTIMISTIC_DAD_TEMPORARY
)
4553 flags
= IN6_IFF_OPTIMISTIC
;
4554 } else if (ia
->ia6_flags
& IN6_IFF_SECURED
) {
4555 if (optdad
& ND6_OPTIMISTIC_DAD_SECURED
)
4556 flags
= IN6_IFF_OPTIMISTIC
;
4559 * Keeping the behavior for temp and CGA
4560 * SLAAC addresses to have a knob for optimistic
4562 * Other than that if ND6_OPTIMISTIC_DAD_AUTOCONF
4563 * is set, we should default to optimistic
4565 * For now this means SLAAC addresses with interface
4566 * identifier derived from modified EUI-64 bit
4569 flags
= IN6_IFF_OPTIMISTIC
;
4571 } else if ((optdad
& ND6_OPTIMISTIC_DAD_DYNAMIC
) &&
4572 (ia
->ia6_flags
& IN6_IFF_DYNAMIC
)) {
4573 if (ia
->ia6_flags
& IN6_IFF_TEMPORARY
) {
4574 if (optdad
& ND6_OPTIMISTIC_DAD_TEMPORARY
)
4575 flags
= IN6_IFF_OPTIMISTIC
;
4577 flags
= IN6_IFF_OPTIMISTIC
;
4579 } else if ((optdad
& ND6_OPTIMISTIC_DAD_MANUAL
) &&
4580 (ia
->ia6_flags
& IN6_IFF_OPTIMISTIC
)) {
4583 * Bypass tentative for address assignments
4584 * not covered above (e.g. manual) upon request
4586 if (!IN6_IS_ADDR_LINKLOCAL(&ia
->ia_addr
.sin6_addr
) &&
4587 !(ia
->ia6_flags
& IN6_IFF_AUTOCONF
) &&
4588 !(ia
->ia6_flags
& IN6_IFF_DYNAMIC
))
4589 flags
= IN6_IFF_OPTIMISTIC
;
4593 ia
->ia6_flags
&= ~(IN6_IFF_DUPLICATED
| IN6_IFF_DADPROGRESS
);
4594 ia
->ia6_flags
|= flags
;
4596 nd6log2((LOG_DEBUG
, "%s - %s ifp %s ia6_flags 0x%x\n",
4598 ip6_sprintf(&ia
->ia_addr
.sin6_addr
),
4599 if_name(ia
->ia_ifp
),