]> git.saurik.com Git - apple/xnu.git/blob - bsd/netinet6/nd6.c
xnu-4570.1.46.tar.gz
[apple/xnu.git] / bsd / netinet6 / nd6.c
1 /*
2 * Copyright (c) 2000-2017 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /*
30 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
31 * All rights reserved.
32 *
33 * Redistribution and use in source and binary forms, with or without
34 * modification, are permitted provided that the following conditions
35 * are met:
36 * 1. Redistributions of source code must retain the above copyright
37 * notice, this list of conditions and the following disclaimer.
38 * 2. Redistributions in binary form must reproduce the above copyright
39 * notice, this list of conditions and the following disclaimer in the
40 * documentation and/or other materials provided with the distribution.
41 * 3. Neither the name of the project nor the names of its contributors
42 * may be used to endorse or promote products derived from this software
43 * without specific prior written permission.
44 *
45 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
48 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
55 * SUCH DAMAGE.
56 */
57
58 /*
59 * XXX
60 * KAME 970409 note:
61 * BSD/OS version heavily modifies this code, related to llinfo.
62 * Since we don't have BSD/OS version of net/route.c in our hand,
63 * I left the code mostly as it was in 970310. -- itojun
64 */
65
66 #include <sys/param.h>
67 #include <sys/systm.h>
68 #include <sys/malloc.h>
69 #include <sys/mbuf.h>
70 #include <sys/socket.h>
71 #include <sys/sockio.h>
72 #include <sys/time.h>
73 #include <sys/kernel.h>
74 #include <sys/sysctl.h>
75 #include <sys/errno.h>
76 #include <sys/syslog.h>
77 #include <sys/protosw.h>
78 #include <sys/proc.h>
79 #include <sys/mcache.h>
80
81 #include <dev/random/randomdev.h>
82
83 #include <kern/queue.h>
84 #include <kern/zalloc.h>
85
86 #include <net/if.h>
87 #include <net/if_dl.h>
88 #include <net/if_types.h>
89 #include <net/if_llreach.h>
90 #include <net/route.h>
91 #include <net/dlil.h>
92 #include <net/ntstat.h>
93 #include <net/net_osdep.h>
94 #include <net/nwk_wq.h>
95
96 #include <netinet/in.h>
97 #include <netinet/in_arp.h>
98 #include <netinet/if_ether.h>
99 #include <netinet6/in6_var.h>
100 #include <netinet/ip6.h>
101 #include <netinet6/ip6_var.h>
102 #include <netinet6/nd6.h>
103 #include <netinet6/scope6_var.h>
104 #include <netinet/icmp6.h>
105
106 #include "loop.h"
107
108 #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */
109 #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */
110
111 #define equal(a1, a2) (bcmp((caddr_t)(a1), (caddr_t)(a2), (a1)->sa_len) == 0)
112
113 /* timer values */
114 int nd6_prune = 1; /* walk list every 1 seconds */
115 int nd6_prune_lazy = 5; /* lazily walk list every 5 seconds */
116 int nd6_delay = 5; /* delay first probe time 5 second */
117 int nd6_umaxtries = 3; /* maximum unicast query */
118 int nd6_mmaxtries = 3; /* maximum multicast query */
119 int nd6_useloopback = 1; /* use loopback interface for local traffic */
120 int nd6_gctimer = (60 * 60 * 24); /* 1 day: garbage collection timer */
121
122 /* preventing too many loops in ND option parsing */
123 int nd6_maxndopt = 10; /* max # of ND options allowed */
124
125 int nd6_maxqueuelen = 1; /* max # of packets cached in unresolved ND entries */
126
127 #if ND6_DEBUG
128 int nd6_debug = 1;
129 #else
130 int nd6_debug = 0;
131 #endif
132
133 int nd6_optimistic_dad =
134 (ND6_OPTIMISTIC_DAD_LINKLOCAL|ND6_OPTIMISTIC_DAD_AUTOCONF|
135 ND6_OPTIMISTIC_DAD_TEMPORARY|ND6_OPTIMISTIC_DAD_DYNAMIC|
136 ND6_OPTIMISTIC_DAD_SECURED|ND6_OPTIMISTIC_DAD_MANUAL);
137
138 /* for debugging? */
139 static int nd6_inuse, nd6_allocated;
140
141 /*
142 * Synchronization notes:
143 *
144 * The global list of ND entries are stored in llinfo_nd6; an entry
145 * gets inserted into the list when the route is created and gets
146 * removed from the list when it is deleted; this is done as part
147 * of RTM_ADD/RTM_RESOLVE/RTM_DELETE in nd6_rtrequest().
148 *
149 * Because rnh_lock and rt_lock for the entry are held during those
150 * operations, the same locks (and thus lock ordering) must be used
151 * elsewhere to access the relevant data structure fields:
152 *
153 * ln_next, ln_prev, ln_rt
154 *
155 * - Routing lock (rnh_lock)
156 *
157 * ln_hold, ln_asked, ln_expire, ln_state, ln_router, ln_flags,
158 * ln_llreach, ln_lastused
159 *
160 * - Routing entry lock (rt_lock)
161 *
162 * Due to the dependency on rt_lock, llinfo_nd6 has the same lifetime
163 * as the route entry itself. When a route is deleted (RTM_DELETE),
164 * it is simply removed from the global list but the memory is not
165 * freed until the route itself is freed.
166 */
167 struct llinfo_nd6 llinfo_nd6 = {
168 .ln_next = &llinfo_nd6,
169 .ln_prev = &llinfo_nd6,
170 };
171
172 static lck_grp_attr_t *nd_if_lock_grp_attr = NULL;
173 static lck_grp_t *nd_if_lock_grp = NULL;
174 static lck_attr_t *nd_if_lock_attr = NULL;
175
176 /* Protected by nd6_mutex */
177 struct nd_drhead nd_defrouter;
178 struct nd_prhead nd_prefix = { 0 };
179
180 /*
181 * nd6_timeout() is scheduled on a demand basis. nd6_timeout_run is used
182 * to indicate whether or not a timeout has been scheduled. The rnh_lock
183 * mutex is used to protect this scheduling; it is a natural choice given
184 * the work done in the timer callback. Unfortunately, there are cases
185 * when nd6_timeout() needs to be scheduled while rnh_lock cannot be easily
186 * held, due to lock ordering. In those cases, we utilize a "demand" counter
187 * nd6_sched_timeout_want which can be atomically incremented without
188 * having to hold rnh_lock. On places where we acquire rnh_lock, such as
189 * nd6_rtrequest(), we check this counter and schedule the timer if it is
190 * non-zero. The increment happens on various places when we allocate
191 * new ND entries, default routers, prefixes and addresses.
192 */
193 static int nd6_timeout_run; /* nd6_timeout is scheduled to run */
194 static void nd6_timeout(void *);
195 int nd6_sched_timeout_want; /* demand count for timer to be sched */
196 static boolean_t nd6_fast_timer_on = FALSE;
197
198 /* Serialization variables for nd6_service(), protected by rnh_lock */
199 static boolean_t nd6_service_busy;
200 static void *nd6_service_wc = &nd6_service_busy;
201 static int nd6_service_waiters = 0;
202
203 int nd6_recalc_reachtm_interval = ND6_RECALC_REACHTM_INTERVAL;
204 static struct sockaddr_in6 all1_sa;
205
206 static int regen_tmpaddr(struct in6_ifaddr *);
207 extern lck_mtx_t *nd6_mutex;
208
209 static struct llinfo_nd6 *nd6_llinfo_alloc(int);
210 static void nd6_llinfo_free(void *);
211 static void nd6_llinfo_purge(struct rtentry *);
212 static void nd6_llinfo_get_ri(struct rtentry *, struct rt_reach_info *);
213 static void nd6_llinfo_get_iflri(struct rtentry *, struct ifnet_llreach_info *);
214 static void nd6_llinfo_refresh(struct rtentry *);
215 static uint64_t ln_getexpire(struct llinfo_nd6 *);
216
217 static void nd6_service(void *);
218 static void nd6_slowtimo(void *);
219 static int nd6_is_new_addr_neighbor(struct sockaddr_in6 *, struct ifnet *);
220 static int nd6_siocgdrlst(void *, int);
221 static int nd6_siocgprlst(void *, int);
222
223 static int nd6_sysctl_drlist SYSCTL_HANDLER_ARGS;
224 static int nd6_sysctl_prlist SYSCTL_HANDLER_ARGS;
225
226 /*
227 * Insertion and removal from llinfo_nd6 must be done with rnh_lock held.
228 */
229 #define LN_DEQUEUE(_ln) do { \
230 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); \
231 RT_LOCK_ASSERT_HELD((_ln)->ln_rt); \
232 (_ln)->ln_next->ln_prev = (_ln)->ln_prev; \
233 (_ln)->ln_prev->ln_next = (_ln)->ln_next; \
234 (_ln)->ln_prev = (_ln)->ln_next = NULL; \
235 (_ln)->ln_flags &= ~ND6_LNF_IN_USE; \
236 } while (0)
237
238 #define LN_INSERTHEAD(_ln) do { \
239 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED); \
240 RT_LOCK_ASSERT_HELD((_ln)->ln_rt); \
241 (_ln)->ln_next = llinfo_nd6.ln_next; \
242 llinfo_nd6.ln_next = (_ln); \
243 (_ln)->ln_prev = &llinfo_nd6; \
244 (_ln)->ln_next->ln_prev = (_ln); \
245 (_ln)->ln_flags |= ND6_LNF_IN_USE; \
246 } while (0)
247
248 static struct zone *llinfo_nd6_zone;
249 #define LLINFO_ND6_ZONE_MAX 256 /* maximum elements in zone */
250 #define LLINFO_ND6_ZONE_NAME "llinfo_nd6" /* name for zone */
251
252 extern int tvtohz(struct timeval *);
253
254 static int nd6_init_done;
255
256 SYSCTL_DECL(_net_inet6_icmp6);
257
258 SYSCTL_PROC(_net_inet6_icmp6, ICMPV6CTL_ND6_DRLIST, nd6_drlist,
259 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
260 nd6_sysctl_drlist, "S,in6_defrouter", "");
261
262 SYSCTL_PROC(_net_inet6_icmp6, ICMPV6CTL_ND6_PRLIST, nd6_prlist,
263 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0,
264 nd6_sysctl_prlist, "S,in6_defrouter", "");
265
266 SYSCTL_DECL(_net_inet6_ip6);
267
268 static int ip6_maxchainsent = 0;
269 SYSCTL_INT(_net_inet6_ip6, OID_AUTO, maxchainsent,
270 CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_maxchainsent, 0,
271 "use dlil_output_list");
272
273 void
274 nd6_init(void)
275 {
276 int i;
277
278 VERIFY(!nd6_init_done);
279
280 all1_sa.sin6_family = AF_INET6;
281 all1_sa.sin6_len = sizeof (struct sockaddr_in6);
282 for (i = 0; i < sizeof (all1_sa.sin6_addr); i++)
283 all1_sa.sin6_addr.s6_addr[i] = 0xff;
284
285 /* initialization of the default router list */
286 TAILQ_INIT(&nd_defrouter);
287
288 nd_if_lock_grp_attr = lck_grp_attr_alloc_init();
289 nd_if_lock_grp = lck_grp_alloc_init("nd_if_lock", nd_if_lock_grp_attr);
290 nd_if_lock_attr = lck_attr_alloc_init();
291
292 llinfo_nd6_zone = zinit(sizeof (struct llinfo_nd6),
293 LLINFO_ND6_ZONE_MAX * sizeof (struct llinfo_nd6), 0,
294 LLINFO_ND6_ZONE_NAME);
295 if (llinfo_nd6_zone == NULL)
296 panic("%s: failed allocating llinfo_nd6_zone", __func__);
297
298 zone_change(llinfo_nd6_zone, Z_EXPAND, TRUE);
299 zone_change(llinfo_nd6_zone, Z_CALLERACCT, FALSE);
300
301 nd6_nbr_init();
302 nd6_rtr_init();
303 nd6_prproxy_init();
304
305 nd6_init_done = 1;
306
307 /* start timer */
308 timeout(nd6_slowtimo, NULL, ND6_SLOWTIMER_INTERVAL * hz);
309 }
310
311 static struct llinfo_nd6 *
312 nd6_llinfo_alloc(int how)
313 {
314 struct llinfo_nd6 *ln;
315
316 ln = (how == M_WAITOK) ? zalloc(llinfo_nd6_zone) :
317 zalloc_noblock(llinfo_nd6_zone);
318 if (ln != NULL)
319 bzero(ln, sizeof (*ln));
320
321 return (ln);
322 }
323
324 static void
325 nd6_llinfo_free(void *arg)
326 {
327 struct llinfo_nd6 *ln = arg;
328
329 if (ln->ln_next != NULL || ln->ln_prev != NULL) {
330 panic("%s: trying to free %p when it is in use", __func__, ln);
331 /* NOTREACHED */
332 }
333
334 /* Just in case there's anything there, free it */
335 if (ln->ln_hold != NULL) {
336 m_freem_list(ln->ln_hold);
337 ln->ln_hold = NULL;
338 }
339
340 /* Purge any link-layer info caching */
341 VERIFY(ln->ln_rt->rt_llinfo == ln);
342 if (ln->ln_rt->rt_llinfo_purge != NULL)
343 ln->ln_rt->rt_llinfo_purge(ln->ln_rt);
344
345 zfree(llinfo_nd6_zone, ln);
346 }
347
348 static void
349 nd6_llinfo_purge(struct rtentry *rt)
350 {
351 struct llinfo_nd6 *ln = rt->rt_llinfo;
352
353 RT_LOCK_ASSERT_HELD(rt);
354 VERIFY(rt->rt_llinfo_purge == nd6_llinfo_purge && ln != NULL);
355
356 if (ln->ln_llreach != NULL) {
357 RT_CONVERT_LOCK(rt);
358 ifnet_llreach_free(ln->ln_llreach);
359 ln->ln_llreach = NULL;
360 }
361 ln->ln_lastused = 0;
362 }
363
364 static void
365 nd6_llinfo_get_ri(struct rtentry *rt, struct rt_reach_info *ri)
366 {
367 struct llinfo_nd6 *ln = rt->rt_llinfo;
368 struct if_llreach *lr = ln->ln_llreach;
369
370 if (lr == NULL) {
371 bzero(ri, sizeof (*ri));
372 ri->ri_rssi = IFNET_RSSI_UNKNOWN;
373 ri->ri_lqm = IFNET_LQM_THRESH_OFF;
374 ri->ri_npm = IFNET_NPM_THRESH_UNKNOWN;
375 } else {
376 IFLR_LOCK(lr);
377 /* Export to rt_reach_info structure */
378 ifnet_lr2ri(lr, ri);
379 /* Export ND6 send expiration (calendar) time */
380 ri->ri_snd_expire =
381 ifnet_llreach_up2calexp(lr, ln->ln_lastused);
382 IFLR_UNLOCK(lr);
383 }
384 }
385
386 static void
387 nd6_llinfo_get_iflri(struct rtentry *rt, struct ifnet_llreach_info *iflri)
388 {
389 struct llinfo_nd6 *ln = rt->rt_llinfo;
390 struct if_llreach *lr = ln->ln_llreach;
391
392 if (lr == NULL) {
393 bzero(iflri, sizeof (*iflri));
394 iflri->iflri_rssi = IFNET_RSSI_UNKNOWN;
395 iflri->iflri_lqm = IFNET_LQM_THRESH_OFF;
396 iflri->iflri_npm = IFNET_NPM_THRESH_UNKNOWN;
397 } else {
398 IFLR_LOCK(lr);
399 /* Export to ifnet_llreach_info structure */
400 ifnet_lr2iflri(lr, iflri);
401 /* Export ND6 send expiration (uptime) time */
402 iflri->iflri_snd_expire =
403 ifnet_llreach_up2upexp(lr, ln->ln_lastused);
404 IFLR_UNLOCK(lr);
405 }
406 }
407
408 static void
409 nd6_llinfo_refresh(struct rtentry *rt)
410 {
411 struct llinfo_nd6 *ln = rt->rt_llinfo;
412 uint64_t timenow = net_uptime();
413 /*
414 * Can't refresh permanent, static or entries that are
415 * not direct host entries
416 */
417 if (!ln || ln->ln_expire == 0 ||
418 (rt->rt_flags & RTF_STATIC) ||
419 !(rt->rt_flags & RTF_LLINFO)) {
420 return;
421 }
422
423 if ((ln->ln_state > ND6_LLINFO_INCOMPLETE) &&
424 (ln->ln_state < ND6_LLINFO_PROBE)) {
425 if (ln->ln_expire > timenow) {
426 ln_setexpire(ln, timenow);
427 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_PROBE);
428 }
429 }
430 return;
431 }
432
433 const char *
434 ndcache_state2str(short ndp_state)
435 {
436 const char *ndp_state_str = "UNKNOWN";
437 switch (ndp_state) {
438 case ND6_LLINFO_PURGE:
439 ndp_state_str = "ND6_LLINFO_PURGE";
440 break;
441 case ND6_LLINFO_NOSTATE:
442 ndp_state_str = "ND6_LLINFO_NOSTATE";
443 break;
444 case ND6_LLINFO_INCOMPLETE:
445 ndp_state_str = "ND6_LLINFO_INCOMPLETE";
446 break;
447 case ND6_LLINFO_REACHABLE:
448 ndp_state_str = "ND6_LLINFO_REACHABLE";
449 break;
450 case ND6_LLINFO_STALE:
451 ndp_state_str = "ND6_LLINFO_STALE";
452 break;
453 case ND6_LLINFO_DELAY:
454 ndp_state_str = "ND6_LLINFO_DELAY";
455 break;
456 case ND6_LLINFO_PROBE:
457 ndp_state_str = "ND6_LLINFO_PROBE";
458 break;
459 default:
460 /* Init'd to UNKNOWN */
461 break;
462 }
463 return ndp_state_str;
464 }
465
466 void
467 ln_setexpire(struct llinfo_nd6 *ln, uint64_t expiry)
468 {
469 ln->ln_expire = expiry;
470 }
471
472 static uint64_t
473 ln_getexpire(struct llinfo_nd6 *ln)
474 {
475 struct timeval caltime;
476 uint64_t expiry;
477
478 if (ln->ln_expire != 0) {
479 struct rtentry *rt = ln->ln_rt;
480
481 VERIFY(rt != NULL);
482 /* account for system time change */
483 getmicrotime(&caltime);
484
485 rt->base_calendartime +=
486 NET_CALCULATE_CLOCKSKEW(caltime,
487 rt->base_calendartime, net_uptime(), rt->base_uptime);
488
489 expiry = rt->base_calendartime +
490 ln->ln_expire - rt->base_uptime;
491 } else {
492 expiry = 0;
493 }
494 return (expiry);
495 }
496
497 void
498 nd6_ifreset(struct ifnet *ifp)
499 {
500 struct nd_ifinfo *ndi = ND_IFINFO(ifp);
501 VERIFY(NULL != ndi);
502 VERIFY(ndi->initialized);
503
504 LCK_MTX_ASSERT(&ndi->lock, LCK_MTX_ASSERT_OWNED);
505 ndi->linkmtu = ifp->if_mtu;
506 ndi->chlim = IPV6_DEFHLIM;
507 ndi->basereachable = REACHABLE_TIME;
508 ndi->reachable = ND_COMPUTE_RTIME(ndi->basereachable);
509 ndi->retrans = RETRANS_TIMER;
510 }
511
512 void
513 nd6_ifattach(struct ifnet *ifp)
514 {
515 struct nd_ifinfo *ndi = ND_IFINFO(ifp);
516
517 VERIFY(NULL != ndi);
518 if (!ndi->initialized) {
519 lck_mtx_init(&ndi->lock, nd_if_lock_grp, nd_if_lock_attr);
520 ndi->flags = ND6_IFF_PERFORMNUD;
521 ndi->flags |= ND6_IFF_DAD;
522 ndi->initialized = TRUE;
523 }
524
525 lck_mtx_lock(&ndi->lock);
526
527 if (!(ifp->if_flags & IFF_MULTICAST)) {
528 ndi->flags |= ND6_IFF_IFDISABLED;
529 }
530
531 nd6_ifreset(ifp);
532 lck_mtx_unlock(&ndi->lock);
533 nd6_setmtu(ifp);
534 return;
535 }
536
537 #if 0
538 /*
539 * XXX Look more into this. Especially since we recycle ifnets and do delayed
540 * cleanup
541 */
542 void
543 nd6_ifdetach(struct nd_ifinfo *nd)
544 {
545 /* XXX destroy nd's lock? */
546 FREE(nd, M_IP6NDP);
547 }
548 #endif
549
550 void
551 nd6_setmtu(struct ifnet *ifp)
552 {
553 struct nd_ifinfo *ndi = ND_IFINFO(ifp);
554 u_int32_t oldmaxmtu, maxmtu;
555
556 if ((NULL == ndi) || (FALSE == ndi->initialized)) {
557 return;
558 }
559
560 lck_mtx_lock(&ndi->lock);
561 oldmaxmtu = ndi->maxmtu;
562
563 /*
564 * The ND level maxmtu is somewhat redundant to the interface MTU
565 * and is an implementation artifact of KAME. Instead of hard-
566 * limiting the maxmtu based on the interface type here, we simply
567 * take the if_mtu value since SIOCSIFMTU would have taken care of
568 * the sanity checks related to the maximum MTU allowed for the
569 * interface (a value that is known only by the interface layer),
570 * by sending the request down via ifnet_ioctl(). The use of the
571 * ND level maxmtu and linkmtu are done via IN6_LINKMTU() which
572 * does further checking against if_mtu.
573 */
574 maxmtu = ndi->maxmtu = ifp->if_mtu;
575
576 /*
577 * Decreasing the interface MTU under IPV6 minimum MTU may cause
578 * undesirable situation. We thus notify the operator of the change
579 * explicitly. The check for oldmaxmtu is necessary to restrict the
580 * log to the case of changing the MTU, not initializing it.
581 */
582 if (oldmaxmtu >= IPV6_MMTU && ndi->maxmtu < IPV6_MMTU) {
583 log(LOG_NOTICE, "nd6_setmtu: "
584 "new link MTU on %s (%u) is too small for IPv6\n",
585 if_name(ifp), (uint32_t)ndi->maxmtu);
586 }
587 ndi->linkmtu = ifp->if_mtu;
588 lck_mtx_unlock(&ndi->lock);
589
590 /* also adjust in6_maxmtu if necessary. */
591 if (maxmtu > in6_maxmtu) {
592 in6_setmaxmtu();
593 }
594 }
595
596 void
597 nd6_option_init(void *opt, int icmp6len, union nd_opts *ndopts)
598 {
599 bzero(ndopts, sizeof (*ndopts));
600 ndopts->nd_opts_search = (struct nd_opt_hdr *)opt;
601 ndopts->nd_opts_last =
602 (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len);
603
604 if (icmp6len == 0) {
605 ndopts->nd_opts_done = 1;
606 ndopts->nd_opts_search = NULL;
607 }
608 }
609
610 /*
611 * Take one ND option.
612 */
613 struct nd_opt_hdr *
614 nd6_option(union nd_opts *ndopts)
615 {
616 struct nd_opt_hdr *nd_opt;
617 int olen;
618
619 if (!ndopts)
620 panic("ndopts == NULL in nd6_option\n");
621 if (!ndopts->nd_opts_last)
622 panic("uninitialized ndopts in nd6_option\n");
623 if (!ndopts->nd_opts_search)
624 return (NULL);
625 if (ndopts->nd_opts_done)
626 return (NULL);
627
628 nd_opt = ndopts->nd_opts_search;
629
630 /* make sure nd_opt_len is inside the buffer */
631 if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) {
632 bzero(ndopts, sizeof (*ndopts));
633 return (NULL);
634 }
635
636 olen = nd_opt->nd_opt_len << 3;
637 if (olen == 0) {
638 /*
639 * Message validation requires that all included
640 * options have a length that is greater than zero.
641 */
642 bzero(ndopts, sizeof (*ndopts));
643 return (NULL);
644 }
645
646 ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);
647 if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
648 /* option overruns the end of buffer, invalid */
649 bzero(ndopts, sizeof (*ndopts));
650 return (NULL);
651 } else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
652 /* reached the end of options chain */
653 ndopts->nd_opts_done = 1;
654 ndopts->nd_opts_search = NULL;
655 }
656 return (nd_opt);
657 }
658
659 /*
660 * Parse multiple ND options.
661 * This function is much easier to use, for ND routines that do not need
662 * multiple options of the same type.
663 */
664 int
665 nd6_options(union nd_opts *ndopts)
666 {
667 struct nd_opt_hdr *nd_opt;
668 int i = 0;
669
670 if (ndopts == NULL)
671 panic("ndopts == NULL in nd6_options");
672 if (ndopts->nd_opts_last == NULL)
673 panic("uninitialized ndopts in nd6_options");
674 if (ndopts->nd_opts_search == NULL)
675 return (0);
676
677 while (1) {
678 nd_opt = nd6_option(ndopts);
679 if (nd_opt == NULL && ndopts->nd_opts_last == NULL) {
680 /*
681 * Message validation requires that all included
682 * options have a length that is greater than zero.
683 */
684 icmp6stat.icp6s_nd_badopt++;
685 bzero(ndopts, sizeof (*ndopts));
686 return (-1);
687 }
688
689 if (nd_opt == NULL)
690 goto skip1;
691
692 switch (nd_opt->nd_opt_type) {
693 case ND_OPT_SOURCE_LINKADDR:
694 case ND_OPT_TARGET_LINKADDR:
695 case ND_OPT_MTU:
696 case ND_OPT_REDIRECTED_HEADER:
697 case ND_OPT_NONCE:
698 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
699 nd6log((LOG_INFO,
700 "duplicated ND6 option found (type=%d)\n",
701 nd_opt->nd_opt_type));
702 /* XXX bark? */
703 } else {
704 ndopts->nd_opt_array[nd_opt->nd_opt_type] =
705 nd_opt;
706 }
707 break;
708 case ND_OPT_PREFIX_INFORMATION:
709 if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) {
710 ndopts->nd_opt_array[nd_opt->nd_opt_type] =
711 nd_opt;
712 }
713 ndopts->nd_opts_pi_end =
714 (struct nd_opt_prefix_info *)nd_opt;
715 break;
716 case ND_OPT_RDNSS:
717 case ND_OPT_DNSSL:
718 /* ignore */
719 break;
720 default:
721 /*
722 * Unknown options must be silently ignored,
723 * to accomodate future extension to the protocol.
724 */
725 nd6log((LOG_DEBUG,
726 "nd6_options: unsupported option %d - "
727 "option ignored\n", nd_opt->nd_opt_type));
728 }
729
730 skip1:
731 i++;
732 if (i > nd6_maxndopt) {
733 icmp6stat.icp6s_nd_toomanyopt++;
734 nd6log((LOG_INFO, "too many loop in nd opt\n"));
735 break;
736 }
737
738 if (ndopts->nd_opts_done)
739 break;
740 }
741
742 return (0);
743 }
744
745 struct nd6svc_arg {
746 int draining;
747 uint32_t killed;
748 uint32_t aging_lazy;
749 uint32_t aging;
750 uint32_t sticky;
751 uint32_t found;
752 };
753
754 /*
755 * ND6 service routine to expire default route list and prefix list
756 */
757 static void
758 nd6_service(void *arg)
759 {
760 struct nd6svc_arg *ap = arg;
761 struct llinfo_nd6 *ln;
762 struct nd_defrouter *dr = NULL;
763 struct nd_prefix *pr = NULL;
764 struct ifnet *ifp = NULL;
765 struct in6_ifaddr *ia6, *nia6;
766 uint64_t timenow;
767 boolean_t send_nc_failure_kev = FALSE;
768 struct nd_drhead nd_defrouter_tmp;
769 struct nd_defrouter *ndr = NULL;
770 struct radix_node_head *rnh = rt_tables[AF_INET6];
771
772 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
773 /*
774 * Since we may drop rnh_lock and nd6_mutex below, we want
775 * to run this entire operation single threaded.
776 */
777 while (nd6_service_busy) {
778 nd6log2((LOG_DEBUG, "%s: %s is blocked by %d waiters\n",
779 __func__, ap->draining ? "drainer" : "timer",
780 nd6_service_waiters));
781 nd6_service_waiters++;
782 (void) msleep(nd6_service_wc, rnh_lock, (PZERO-1),
783 __func__, NULL);
784 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
785 }
786
787 /* We are busy now; tell everyone else to go away */
788 nd6_service_busy = TRUE;
789
790 net_update_uptime();
791 timenow = net_uptime();
792 again:
793 /*
794 * send_nc_failure_kev gets set when default router's IPv6 address
795 * can't be resolved.
796 * That can happen either:
797 * 1. When the entry has resolved once but can't be
798 * resolved later and the neighbor cache entry for gateway is deleted
799 * after max probe attempts.
800 *
801 * 2. When the entry is in ND6_LLINFO_INCOMPLETE but can not be resolved
802 * after max neighbor address resolution attempts.
803 *
804 * Both set send_nc_failure_kev to true. ifp is also set to the previous
805 * neighbor cache entry's route's ifp.
806 * Once we are done sending the notification, set send_nc_failure_kev
807 * to false to stop sending false notifications for non default router
808 * neighbors.
809 *
810 * We may to send more information like Gateway's IP that could not be
811 * resolved, however right now we do not install more than one default
812 * route per interface in the routing table.
813 */
814 if (send_nc_failure_kev && ifp->if_addrlen == IF_LLREACH_MAXLEN) {
815 struct kev_msg ev_msg;
816 struct kev_nd6_ndfailure nd6_ndfailure;
817 bzero(&ev_msg, sizeof(ev_msg));
818 bzero(&nd6_ndfailure, sizeof(nd6_ndfailure));
819 ev_msg.vendor_code = KEV_VENDOR_APPLE;
820 ev_msg.kev_class = KEV_NETWORK_CLASS;
821 ev_msg.kev_subclass = KEV_ND6_SUBCLASS;
822 ev_msg.event_code = KEV_ND6_NDFAILURE;
823
824 nd6_ndfailure.link_data.if_family = ifp->if_family;
825 nd6_ndfailure.link_data.if_unit = ifp->if_unit;
826 strlcpy(nd6_ndfailure.link_data.if_name,
827 ifp->if_name,
828 sizeof(nd6_ndfailure.link_data.if_name));
829 ev_msg.dv[0].data_ptr = &nd6_ndfailure;
830 ev_msg.dv[0].data_length =
831 sizeof(nd6_ndfailure);
832 dlil_post_complete_msg(NULL, &ev_msg);
833 }
834
835 send_nc_failure_kev = FALSE;
836 ifp = NULL;
837 /*
838 * The global list llinfo_nd6 is modified by nd6_request() and is
839 * therefore protected by rnh_lock. For obvious reasons, we cannot
840 * hold rnh_lock across calls that might lead to code paths which
841 * attempt to acquire rnh_lock, else we deadlock. Hence for such
842 * cases we drop rt_lock and rnh_lock, make the calls, and repeat the
843 * loop. To ensure that we don't process the same entry more than
844 * once in a single timeout, we mark the "already-seen" entries with
845 * ND6_LNF_TIMER_SKIP flag. At the end of the loop, we do a second
846 * pass thru the entries and clear the flag so they can be processed
847 * during the next timeout.
848 */
849 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
850
851 ln = llinfo_nd6.ln_next;
852 while (ln != NULL && ln != &llinfo_nd6) {
853 struct rtentry *rt;
854 struct sockaddr_in6 *dst;
855 struct llinfo_nd6 *next;
856 u_int32_t retrans, flags;
857 struct nd_ifinfo *ndi = NULL;
858 boolean_t is_router = FALSE;
859
860 /* ln_next/prev/rt is protected by rnh_lock */
861 next = ln->ln_next;
862 rt = ln->ln_rt;
863 RT_LOCK(rt);
864
865 /* We've seen this already; skip it */
866 if (ln->ln_flags & ND6_LNF_TIMER_SKIP) {
867 RT_UNLOCK(rt);
868 ln = next;
869 continue;
870 }
871 ap->found++;
872
873 /* rt->rt_ifp should never be NULL */
874 if ((ifp = rt->rt_ifp) == NULL) {
875 panic("%s: ln(%p) rt(%p) rt_ifp == NULL", __func__,
876 ln, rt);
877 /* NOTREACHED */
878 }
879
880 /* rt_llinfo must always be equal to ln */
881 if ((struct llinfo_nd6 *)rt->rt_llinfo != ln) {
882 panic("%s: rt_llinfo(%p) is not equal to ln(%p)",
883 __func__, rt->rt_llinfo, ln);
884 /* NOTREACHED */
885 }
886
887 /* rt_key should never be NULL */
888 dst = SIN6(rt_key(rt));
889 if (dst == NULL) {
890 panic("%s: rt(%p) key is NULL ln(%p)", __func__,
891 rt, ln);
892 /* NOTREACHED */
893 }
894
895 /* Set the flag in case we jump to "again" */
896 ln->ln_flags |= ND6_LNF_TIMER_SKIP;
897
898 if (ln->ln_expire == 0 || (rt->rt_flags & RTF_STATIC)) {
899 ap->sticky++;
900 } else if (ap->draining && (rt->rt_refcnt == 0)) {
901 /*
902 * If we are draining, immediately purge non-static
903 * entries without oustanding route refcnt.
904 */
905 if (ln->ln_state > ND6_LLINFO_INCOMPLETE)
906 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_STALE);
907 else
908 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_PURGE);
909 ln_setexpire(ln, timenow);
910 }
911
912 /*
913 * If the entry has not expired, skip it. Take note on the
914 * state, as entries that are in the STALE state are simply
915 * waiting to be garbage collected, in which case we can
916 * relax the callout scheduling (use nd6_prune_lazy).
917 */
918 if (ln->ln_expire > timenow) {
919 switch (ln->ln_state) {
920 case ND6_LLINFO_STALE:
921 ap->aging_lazy++;
922 break;
923 default:
924 ap->aging++;
925 break;
926 }
927 RT_UNLOCK(rt);
928 ln = next;
929 continue;
930 }
931
932 ndi = ND_IFINFO(ifp);
933 VERIFY(ndi->initialized);
934 retrans = ndi->retrans;
935 flags = ndi->flags;
936
937 RT_LOCK_ASSERT_HELD(rt);
938 is_router = (rt->rt_flags & RTF_ROUTER) ? TRUE : FALSE;
939
940 switch (ln->ln_state) {
941 case ND6_LLINFO_INCOMPLETE:
942 if (ln->ln_asked < nd6_mmaxtries) {
943 struct ifnet *exclifp = ln->ln_exclifp;
944 ln->ln_asked++;
945 ln_setexpire(ln, timenow + retrans / 1000);
946 RT_ADDREF_LOCKED(rt);
947 RT_UNLOCK(rt);
948 lck_mtx_unlock(rnh_lock);
949 if (ip6_forwarding) {
950 nd6_prproxy_ns_output(ifp, exclifp,
951 NULL, &dst->sin6_addr, ln);
952 } else {
953 nd6_ns_output(ifp, NULL,
954 &dst->sin6_addr, ln, NULL);
955 }
956 RT_REMREF(rt);
957 ap->aging++;
958 lck_mtx_lock(rnh_lock);
959 } else {
960 struct mbuf *m = ln->ln_hold;
961 ln->ln_hold = NULL;
962 send_nc_failure_kev = is_router;
963 if (m != NULL) {
964 RT_ADDREF_LOCKED(rt);
965 RT_UNLOCK(rt);
966 lck_mtx_unlock(rnh_lock);
967
968 struct mbuf *mnext;
969 while (m) {
970 mnext = m->m_nextpkt;
971 m->m_nextpkt = NULL;
972 m->m_pkthdr.rcvif = ifp;
973 icmp6_error_flag(m, ICMP6_DST_UNREACH,
974 ICMP6_DST_UNREACH_ADDR, 0, 0);
975 m = mnext;
976 }
977 } else {
978 RT_ADDREF_LOCKED(rt);
979 RT_UNLOCK(rt);
980 lck_mtx_unlock(rnh_lock);
981 }
982
983 /*
984 * Enqueue work item to invoke callback for
985 * this route entry
986 */
987 route_event_enqueue_nwk_wq_entry(rt, NULL,
988 ROUTE_LLENTRY_UNREACH, NULL, FALSE);
989 nd6_free(rt);
990 ap->killed++;
991 lck_mtx_lock(rnh_lock);
992 /*
993 * nd6_free above would flush out the routing table of
994 * any cloned routes with same next-hop.
995 * Walk the tree anyways as there could be static routes
996 * left.
997 *
998 * We also already have a reference to rt that gets freed right
999 * after the block below executes. Don't need an extra reference
1000 * on rt here.
1001 */
1002 if (is_router) {
1003 struct route_event rt_ev;
1004 route_event_init(&rt_ev, rt, NULL, ROUTE_LLENTRY_UNREACH);
1005 (void) rnh->rnh_walktree(rnh, route_event_walktree, (void *)&rt_ev);
1006 }
1007 rtfree_locked(rt);
1008 }
1009 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1010 goto again;
1011
1012 case ND6_LLINFO_REACHABLE:
1013 if (ln->ln_expire != 0) {
1014 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_STALE);
1015 ln_setexpire(ln, timenow + nd6_gctimer);
1016 ap->aging_lazy++;
1017 /*
1018 * Enqueue work item to invoke callback for
1019 * this route entry
1020 */
1021 route_event_enqueue_nwk_wq_entry(rt, NULL,
1022 ROUTE_LLENTRY_STALE, NULL, TRUE);
1023
1024 RT_ADDREF_LOCKED(rt);
1025 RT_UNLOCK(rt);
1026 if (is_router) {
1027 struct route_event rt_ev;
1028 route_event_init(&rt_ev, rt, NULL, ROUTE_LLENTRY_STALE);
1029 (void) rnh->rnh_walktree(rnh, route_event_walktree, (void *)&rt_ev);
1030 }
1031 rtfree_locked(rt);
1032 } else {
1033 RT_UNLOCK(rt);
1034 }
1035 break;
1036
1037 case ND6_LLINFO_STALE:
1038 case ND6_LLINFO_PURGE:
1039 /* Garbage Collection(RFC 4861 5.3) */
1040 if (ln->ln_expire != 0) {
1041 RT_ADDREF_LOCKED(rt);
1042 RT_UNLOCK(rt);
1043 lck_mtx_unlock(rnh_lock);
1044 nd6_free(rt);
1045 ap->killed++;
1046 lck_mtx_lock(rnh_lock);
1047 rtfree_locked(rt);
1048 goto again;
1049 } else {
1050 RT_UNLOCK(rt);
1051 }
1052 break;
1053
1054 case ND6_LLINFO_DELAY:
1055 if ((flags & ND6_IFF_PERFORMNUD) != 0) {
1056 /* We need NUD */
1057 ln->ln_asked = 1;
1058 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_PROBE);
1059 ln_setexpire(ln, timenow + retrans / 1000);
1060 RT_ADDREF_LOCKED(rt);
1061 RT_UNLOCK(rt);
1062 lck_mtx_unlock(rnh_lock);
1063 nd6_ns_output(ifp, &dst->sin6_addr,
1064 &dst->sin6_addr, ln, NULL);
1065 RT_REMREF(rt);
1066 ap->aging++;
1067 lck_mtx_lock(rnh_lock);
1068 goto again;
1069 }
1070 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_STALE); /* XXX */
1071 ln_setexpire(ln, timenow + nd6_gctimer);
1072 RT_UNLOCK(rt);
1073 ap->aging_lazy++;
1074 break;
1075
1076 case ND6_LLINFO_PROBE:
1077 if (ln->ln_asked < nd6_umaxtries) {
1078 ln->ln_asked++;
1079 ln_setexpire(ln, timenow + retrans / 1000);
1080 RT_ADDREF_LOCKED(rt);
1081 RT_UNLOCK(rt);
1082 lck_mtx_unlock(rnh_lock);
1083 nd6_ns_output(ifp, &dst->sin6_addr,
1084 &dst->sin6_addr, ln, NULL);
1085 RT_REMREF(rt);
1086 ap->aging++;
1087 lck_mtx_lock(rnh_lock);
1088 } else {
1089 is_router = (rt->rt_flags & RTF_ROUTER) ? TRUE : FALSE;
1090 send_nc_failure_kev = is_router;
1091 RT_ADDREF_LOCKED(rt);
1092 RT_UNLOCK(rt);
1093 lck_mtx_unlock(rnh_lock);
1094 nd6_free(rt);
1095 ap->killed++;
1096
1097 /*
1098 * Enqueue work item to invoke callback for
1099 * this route entry
1100 */
1101 route_event_enqueue_nwk_wq_entry(rt, NULL,
1102 ROUTE_LLENTRY_UNREACH, NULL, FALSE);
1103
1104 lck_mtx_lock(rnh_lock);
1105 /*
1106 * nd6_free above would flush out the routing table of
1107 * any cloned routes with same next-hop.
1108 * Walk the tree anyways as there could be static routes
1109 * left.
1110 *
1111 * We also already have a reference to rt that gets freed right
1112 * after the block below executes. Don't need an extra reference
1113 * on rt here.
1114 */
1115 if (is_router) {
1116 struct route_event rt_ev;
1117 route_event_init(&rt_ev, rt, NULL, ROUTE_LLENTRY_UNREACH);
1118 (void) rnh->rnh_walktree(rnh,
1119 route_event_walktree, (void *)&rt_ev);
1120 }
1121 rtfree_locked(rt);
1122 }
1123 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1124 goto again;
1125
1126 default:
1127 RT_UNLOCK(rt);
1128 break;
1129 }
1130 ln = next;
1131 }
1132 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1133
1134 /* Now clear the flag from all entries */
1135 ln = llinfo_nd6.ln_next;
1136 while (ln != NULL && ln != &llinfo_nd6) {
1137 struct rtentry *rt = ln->ln_rt;
1138 struct llinfo_nd6 *next = ln->ln_next;
1139
1140 RT_LOCK_SPIN(rt);
1141 if (ln->ln_flags & ND6_LNF_TIMER_SKIP)
1142 ln->ln_flags &= ~ND6_LNF_TIMER_SKIP;
1143 RT_UNLOCK(rt);
1144 ln = next;
1145 }
1146 lck_mtx_unlock(rnh_lock);
1147
1148 /* expire default router list */
1149 TAILQ_INIT(&nd_defrouter_tmp);
1150
1151 lck_mtx_lock(nd6_mutex);
1152 TAILQ_FOREACH_SAFE(dr, &nd_defrouter, dr_entry, ndr) {
1153 ap->found++;
1154 if (dr->expire != 0 && dr->expire < timenow) {
1155 VERIFY(dr->ifp != NULL);
1156 in6_ifstat_inc(dr->ifp, ifs6_defrtr_expiry_cnt);
1157 in6_event_enqueue_nwk_wq_entry(IN6_NDP_RTR_EXPIRY, dr->ifp,
1158 &dr->rtaddr, dr->rtlifetime);
1159 if (dr->ifp != NULL &&
1160 dr->ifp->if_type == IFT_CELLULAR) {
1161 /*
1162 * Some buggy cellular gateways may not send
1163 * periodic router advertisements.
1164 * Or they may send it with router lifetime
1165 * value that is less than the configured Max and Min
1166 * Router Advertisement interval.
1167 * To top that an idle device may not wake up
1168 * when periodic RA is received on cellular
1169 * interface.
1170 * We could send RS on every wake but RFC
1171 * 4861 precludes that.
1172 * The addresses are of infinite lifetimes
1173 * and are tied to the lifetime of the bearer,
1174 * so keeping the addresses and just getting rid of
1175 * the router does not help us anyways.
1176 * If there's network renumbering, a lifetime with
1177 * value 0 would remove the default router.
1178 * Also it will get deleted as part of purge when
1179 * the PDP context is torn down and configured again.
1180 * For that reason, do not expire the default router
1181 * learned on cellular interface. Ever.
1182 */
1183 dr->expire += dr->rtlifetime;
1184 nd6log2((LOG_DEBUG,
1185 "%s: Refreshing expired default router entry "
1186 "%s for interface %s\n", __func__,
1187 ip6_sprintf(&dr->rtaddr), if_name(dr->ifp)));
1188 } else {
1189 ap->killed++;
1190 /*
1191 * Remove the entry from default router list
1192 * and add it to the temp list.
1193 * nd_defrouter_tmp will be a local temporary
1194 * list as no one else can get the same
1195 * removed entry once it is removed from default
1196 * router list.
1197 * Remove the reference after calling defrtrlist_del
1198 */
1199 TAILQ_REMOVE(&nd_defrouter, dr, dr_entry);
1200 TAILQ_INSERT_TAIL(&nd_defrouter_tmp, dr, dr_entry);
1201 }
1202 } else {
1203 if (dr->expire == 0 || (dr->stateflags & NDDRF_STATIC))
1204 ap->sticky++;
1205 else
1206 ap->aging_lazy++;
1207 }
1208 }
1209
1210 /*
1211 * Keep the following separate from the above
1212 * iteration of nd_defrouter because it's not safe
1213 * to call defrtrlist_del while iterating global default
1214 * router list. Global list has to be traversed
1215 * while holding nd6_mutex throughout.
1216 *
1217 * The following call to defrtrlist_del should be
1218 * safe as we are iterating a local list of
1219 * default routers.
1220 */
1221 TAILQ_FOREACH_SAFE(dr, &nd_defrouter_tmp, dr_entry, ndr) {
1222 TAILQ_REMOVE(&nd_defrouter_tmp, dr, dr_entry);
1223 defrtrlist_del(dr);
1224 NDDR_REMREF(dr); /* remove list reference */
1225 }
1226 lck_mtx_unlock(nd6_mutex);
1227
1228 /*
1229 * expire interface addresses.
1230 * in the past the loop was inside prefix expiry processing.
1231 * However, from a stricter speci-confrmance standpoint, we should
1232 * rather separate address lifetimes and prefix lifetimes.
1233 */
1234 addrloop:
1235 lck_rw_lock_exclusive(&in6_ifaddr_rwlock);
1236 for (ia6 = in6_ifaddrs; ia6; ia6 = nia6) {
1237 ap->found++;
1238 nia6 = ia6->ia_next;
1239 IFA_LOCK(&ia6->ia_ifa);
1240 /*
1241 * Extra reference for ourselves; it's no-op if
1242 * we don't have to regenerate temporary address,
1243 * otherwise it protects the address from going
1244 * away since we drop in6_ifaddr_rwlock below.
1245 */
1246 IFA_ADDREF_LOCKED(&ia6->ia_ifa);
1247 /* check address lifetime */
1248 if (IFA6_IS_INVALID(ia6, timenow)) {
1249 /*
1250 * If the expiring address is temporary, try
1251 * regenerating a new one. This would be useful when
1252 * we suspended a laptop PC, then turned it on after a
1253 * period that could invalidate all temporary
1254 * addresses. Although we may have to restart the
1255 * loop (see below), it must be after purging the
1256 * address. Otherwise, we'd see an infinite loop of
1257 * regeneration.
1258 */
1259 if (ip6_use_tempaddr &&
1260 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
1261 /*
1262 * NOTE: We have to drop the lock here
1263 * because regen_tmpaddr() eventually calls
1264 * in6_update_ifa(), which must take the lock
1265 * and would otherwise cause a hang. This is
1266 * safe because the goto addrloop leads to a
1267 * re-evaluation of the in6_ifaddrs list
1268 */
1269 IFA_UNLOCK(&ia6->ia_ifa);
1270 lck_rw_done(&in6_ifaddr_rwlock);
1271 (void) regen_tmpaddr(ia6);
1272 } else {
1273 IFA_UNLOCK(&ia6->ia_ifa);
1274 lck_rw_done(&in6_ifaddr_rwlock);
1275 }
1276
1277 /*
1278 * Purging the address would have caused
1279 * in6_ifaddr_rwlock to be dropped and reacquired;
1280 * therefore search again from the beginning
1281 * of in6_ifaddrs list.
1282 */
1283 in6_purgeaddr(&ia6->ia_ifa);
1284 ap->killed++;
1285
1286 if ((ia6->ia6_flags & IN6_IFF_TEMPORARY) == 0) {
1287 in6_ifstat_inc(ia6->ia_ifa.ifa_ifp, ifs6_addr_expiry_cnt);
1288 in6_event_enqueue_nwk_wq_entry(IN6_NDP_ADDR_EXPIRY,
1289 ia6->ia_ifa.ifa_ifp, &ia6->ia_addr.sin6_addr,
1290 0);
1291 }
1292 /* Release extra reference taken above */
1293 IFA_REMREF(&ia6->ia_ifa);
1294 goto addrloop;
1295 }
1296 /*
1297 * The lazy timer runs every nd6_prune_lazy seconds with at
1298 * most "2 * nd6_prune_lazy - 1" leeway. We consider the worst
1299 * case here and make sure we schedule the regular timer if an
1300 * interface address is about to expire.
1301 */
1302 if (IFA6_IS_INVALID(ia6, timenow + 3 * nd6_prune_lazy))
1303 ap->aging++;
1304 else
1305 ap->aging_lazy++;
1306 IFA_LOCK_ASSERT_HELD(&ia6->ia_ifa);
1307 if (IFA6_IS_DEPRECATED(ia6, timenow)) {
1308 int oldflags = ia6->ia6_flags;
1309 ia6->ia6_flags |= IN6_IFF_DEPRECATED;
1310
1311 /*
1312 * Only enqueue the Deprecated event when the address just
1313 * becomes deprecated
1314 */
1315 if((oldflags & IN6_IFF_DEPRECATED) == 0) {
1316 in6_event_enqueue_nwk_wq_entry(IN6_ADDR_MARKED_DEPRECATED,
1317 ia6->ia_ifa.ifa_ifp, &ia6->ia_addr.sin6_addr,
1318 0);
1319 }
1320 /*
1321 * If a temporary address has just become deprecated,
1322 * regenerate a new one if possible.
1323 */
1324 if (ip6_use_tempaddr &&
1325 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
1326 (oldflags & IN6_IFF_DEPRECATED) == 0) {
1327
1328 /* see NOTE above */
1329 IFA_UNLOCK(&ia6->ia_ifa);
1330 lck_rw_done(&in6_ifaddr_rwlock);
1331 if (regen_tmpaddr(ia6) == 0) {
1332 /*
1333 * A new temporary address is
1334 * generated.
1335 * XXX: this means the address chain
1336 * has changed while we are still in
1337 * the loop. Although the change
1338 * would not cause disaster (because
1339 * it's not a deletion, but an
1340 * addition,) we'd rather restart the
1341 * loop just for safety. Or does this
1342 * significantly reduce performance??
1343 */
1344 /* Release extra reference */
1345 IFA_REMREF(&ia6->ia_ifa);
1346 goto addrloop;
1347 }
1348 lck_rw_lock_exclusive(&in6_ifaddr_rwlock);
1349 } else {
1350 IFA_UNLOCK(&ia6->ia_ifa);
1351 }
1352 } else {
1353 /*
1354 * A new RA might have made a deprecated address
1355 * preferred.
1356 */
1357 ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;
1358 IFA_UNLOCK(&ia6->ia_ifa);
1359 }
1360 LCK_RW_ASSERT(&in6_ifaddr_rwlock, LCK_RW_ASSERT_EXCLUSIVE);
1361 /* Release extra reference taken above */
1362 IFA_REMREF(&ia6->ia_ifa);
1363 }
1364 lck_rw_done(&in6_ifaddr_rwlock);
1365
1366 lck_mtx_lock(nd6_mutex);
1367 /* expire prefix list */
1368 pr = nd_prefix.lh_first;
1369 while (pr != NULL) {
1370 ap->found++;
1371 /*
1372 * check prefix lifetime.
1373 * since pltime is just for autoconf, pltime processing for
1374 * prefix is not necessary.
1375 */
1376 NDPR_LOCK(pr);
1377 if (pr->ndpr_stateflags & NDPRF_PROCESSED_SERVICE ||
1378 pr->ndpr_stateflags & NDPRF_DEFUNCT) {
1379 pr->ndpr_stateflags |= NDPRF_PROCESSED_SERVICE;
1380 NDPR_UNLOCK(pr);
1381 pr = pr->ndpr_next;
1382 continue;
1383 }
1384 if (pr->ndpr_expire != 0 && pr->ndpr_expire < timenow) {
1385 /*
1386 * address expiration and prefix expiration are
1387 * separate. NEVER perform in6_purgeaddr here.
1388 */
1389 pr->ndpr_stateflags |= NDPRF_PROCESSED_SERVICE;
1390 NDPR_ADDREF_LOCKED(pr);
1391 prelist_remove(pr);
1392 NDPR_UNLOCK(pr);
1393
1394 in6_ifstat_inc(pr->ndpr_ifp, ifs6_pfx_expiry_cnt);
1395 in6_event_enqueue_nwk_wq_entry(IN6_NDP_PFX_EXPIRY,
1396 pr->ndpr_ifp, &pr->ndpr_prefix.sin6_addr,
1397 0);
1398 NDPR_REMREF(pr);
1399 pfxlist_onlink_check();
1400 pr = nd_prefix.lh_first;
1401 ap->killed++;
1402 } else {
1403 if (pr->ndpr_expire == 0 ||
1404 (pr->ndpr_stateflags & NDPRF_STATIC))
1405 ap->sticky++;
1406 else
1407 ap->aging_lazy++;
1408 pr->ndpr_stateflags |= NDPRF_PROCESSED_SERVICE;
1409 NDPR_UNLOCK(pr);
1410 pr = pr->ndpr_next;
1411 }
1412 }
1413 LIST_FOREACH(pr, &nd_prefix, ndpr_entry) {
1414 NDPR_LOCK(pr);
1415 pr->ndpr_stateflags &= ~NDPRF_PROCESSED_SERVICE;
1416 NDPR_UNLOCK(pr);
1417 }
1418 lck_mtx_unlock(nd6_mutex);
1419
1420 lck_mtx_lock(rnh_lock);
1421 /* We're done; let others enter */
1422 nd6_service_busy = FALSE;
1423 if (nd6_service_waiters > 0) {
1424 nd6_service_waiters = 0;
1425 wakeup(nd6_service_wc);
1426 }
1427 }
1428
1429
1430 static int nd6_need_draining = 0;
1431
1432 void
1433 nd6_drain(void *arg)
1434 {
1435 #pragma unused(arg)
1436 nd6log2((LOG_DEBUG, "%s: draining ND6 entries\n", __func__));
1437
1438 lck_mtx_lock(rnh_lock);
1439 nd6_need_draining = 1;
1440 nd6_sched_timeout(NULL, NULL);
1441 lck_mtx_unlock(rnh_lock);
1442 }
1443
1444 /*
1445 * We use the ``arg'' variable to decide whether or not the timer we're
1446 * running is the fast timer. We do this to reset the nd6_fast_timer_on
1447 * variable so that later we don't end up ignoring a ``fast timer''
1448 * request if the 5 second timer is running (see nd6_sched_timeout).
1449 */
1450 static void
1451 nd6_timeout(void *arg)
1452 {
1453 struct nd6svc_arg sarg;
1454 uint32_t buf;
1455
1456 lck_mtx_lock(rnh_lock);
1457 bzero(&sarg, sizeof (sarg));
1458 if (nd6_need_draining != 0) {
1459 nd6_need_draining = 0;
1460 sarg.draining = 1;
1461 }
1462 nd6_service(&sarg);
1463 nd6log2((LOG_DEBUG, "%s: found %u, aging_lazy %u, aging %u, "
1464 "sticky %u, killed %u\n", __func__, sarg.found, sarg.aging_lazy,
1465 sarg.aging, sarg.sticky, sarg.killed));
1466 /* re-arm the timer if there's work to do */
1467 nd6_timeout_run--;
1468 VERIFY(nd6_timeout_run >= 0 && nd6_timeout_run < 2);
1469 if (arg == &nd6_fast_timer_on)
1470 nd6_fast_timer_on = FALSE;
1471 if (sarg.aging_lazy > 0 || sarg.aging > 0 || nd6_sched_timeout_want) {
1472 struct timeval atv, ltv, *leeway;
1473 int lazy = nd6_prune_lazy;
1474
1475 if (sarg.aging > 0 || lazy < 1) {
1476 atv.tv_usec = 0;
1477 atv.tv_sec = nd6_prune;
1478 leeway = NULL;
1479 } else {
1480 VERIFY(lazy >= 1);
1481 atv.tv_usec = 0;
1482 atv.tv_sec = MAX(nd6_prune, lazy);
1483 ltv.tv_usec = 0;
1484 read_frandom(&buf, sizeof(buf));
1485 ltv.tv_sec = MAX(buf % lazy, 1) * 2;
1486 leeway = &ltv;
1487 }
1488 nd6_sched_timeout(&atv, leeway);
1489 } else if (nd6_debug) {
1490 nd6log2((LOG_DEBUG, "%s: not rescheduling timer\n", __func__));
1491 }
1492 lck_mtx_unlock(rnh_lock);
1493 }
1494
1495 void
1496 nd6_sched_timeout(struct timeval *atv, struct timeval *ltv)
1497 {
1498 struct timeval tv;
1499
1500 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1501 if (atv == NULL) {
1502 tv.tv_usec = 0;
1503 tv.tv_sec = MAX(nd6_prune, 1);
1504 atv = &tv;
1505 ltv = NULL; /* ignore leeway */
1506 }
1507 /* see comments on top of this file */
1508 if (nd6_timeout_run == 0) {
1509 if (ltv == NULL) {
1510 nd6log2((LOG_DEBUG, "%s: timer scheduled in "
1511 "T+%llus.%lluu (demand %d)\n", __func__,
1512 (uint64_t)atv->tv_sec, (uint64_t)atv->tv_usec,
1513 nd6_sched_timeout_want));
1514 nd6_fast_timer_on = TRUE;
1515 timeout(nd6_timeout, &nd6_fast_timer_on, tvtohz(atv));
1516 } else {
1517 nd6log2((LOG_DEBUG, "%s: timer scheduled in "
1518 "T+%llus.%lluu with %llus.%lluu leeway "
1519 "(demand %d)\n", __func__, (uint64_t)atv->tv_sec,
1520 (uint64_t)atv->tv_usec, (uint64_t)ltv->tv_sec,
1521 (uint64_t)ltv->tv_usec, nd6_sched_timeout_want));
1522 nd6_fast_timer_on = FALSE;
1523 timeout_with_leeway(nd6_timeout, NULL,
1524 tvtohz(atv), tvtohz(ltv));
1525 }
1526 nd6_timeout_run++;
1527 nd6_sched_timeout_want = 0;
1528 } else if (nd6_timeout_run == 1 && ltv == NULL &&
1529 nd6_fast_timer_on == FALSE) {
1530 nd6log2((LOG_DEBUG, "%s: fast timer scheduled in "
1531 "T+%llus.%lluu (demand %d)\n", __func__,
1532 (uint64_t)atv->tv_sec, (uint64_t)atv->tv_usec,
1533 nd6_sched_timeout_want));
1534 nd6_fast_timer_on = TRUE;
1535 nd6_sched_timeout_want = 0;
1536 nd6_timeout_run++;
1537 timeout(nd6_timeout, &nd6_fast_timer_on, tvtohz(atv));
1538 } else {
1539 if (ltv == NULL) {
1540 nd6log2((LOG_DEBUG, "%s: not scheduling timer: "
1541 "timers %d, fast_timer %d, T+%llus.%lluu\n",
1542 __func__, nd6_timeout_run, nd6_fast_timer_on,
1543 (uint64_t)atv->tv_sec, (uint64_t)atv->tv_usec));
1544 } else {
1545 nd6log2((LOG_DEBUG, "%s: not scheduling timer: "
1546 "timers %d, fast_timer %d, T+%llus.%lluu "
1547 "with %llus.%lluu leeway\n", __func__,
1548 nd6_timeout_run, nd6_fast_timer_on,
1549 (uint64_t)atv->tv_sec, (uint64_t)atv->tv_usec,
1550 (uint64_t)ltv->tv_sec, (uint64_t)ltv->tv_usec));
1551 }
1552 }
1553 }
1554
1555 /*
1556 * ND6 router advertisement kernel notification
1557 */
1558 void
1559 nd6_post_msg(u_int32_t code, struct nd_prefix_list *prefix_list,
1560 u_int32_t list_length, u_int32_t mtu)
1561 {
1562 struct kev_msg ev_msg;
1563 struct kev_nd6_ra_data nd6_ra_msg_data;
1564 struct nd_prefix_list *itr = prefix_list;
1565
1566 bzero(&ev_msg, sizeof (struct kev_msg));
1567 ev_msg.vendor_code = KEV_VENDOR_APPLE;
1568 ev_msg.kev_class = KEV_NETWORK_CLASS;
1569 ev_msg.kev_subclass = KEV_ND6_SUBCLASS;
1570 ev_msg.event_code = code;
1571
1572 bzero(&nd6_ra_msg_data, sizeof (nd6_ra_msg_data));
1573
1574 if (mtu > 0 && mtu >= IPV6_MMTU) {
1575 nd6_ra_msg_data.mtu = mtu;
1576 nd6_ra_msg_data.flags |= KEV_ND6_DATA_VALID_MTU;
1577 }
1578
1579 if (list_length > 0 && prefix_list != NULL) {
1580 nd6_ra_msg_data.list_length = list_length;
1581 nd6_ra_msg_data.flags |= KEV_ND6_DATA_VALID_PREFIX;
1582 }
1583
1584 while (itr != NULL && nd6_ra_msg_data.list_index < list_length) {
1585 bcopy(&itr->pr.ndpr_prefix, &nd6_ra_msg_data.prefix.prefix,
1586 sizeof (nd6_ra_msg_data.prefix.prefix));
1587 nd6_ra_msg_data.prefix.raflags = itr->pr.ndpr_raf;
1588 nd6_ra_msg_data.prefix.prefixlen = itr->pr.ndpr_plen;
1589 nd6_ra_msg_data.prefix.origin = PR_ORIG_RA;
1590 nd6_ra_msg_data.prefix.vltime = itr->pr.ndpr_vltime;
1591 nd6_ra_msg_data.prefix.pltime = itr->pr.ndpr_pltime;
1592 nd6_ra_msg_data.prefix.expire = ndpr_getexpire(&itr->pr);
1593 nd6_ra_msg_data.prefix.flags = itr->pr.ndpr_stateflags;
1594 nd6_ra_msg_data.prefix.refcnt = itr->pr.ndpr_addrcnt;
1595 nd6_ra_msg_data.prefix.if_index = itr->pr.ndpr_ifp->if_index;
1596
1597 /* send the message up */
1598 ev_msg.dv[0].data_ptr = &nd6_ra_msg_data;
1599 ev_msg.dv[0].data_length = sizeof (nd6_ra_msg_data);
1600 ev_msg.dv[1].data_length = 0;
1601 dlil_post_complete_msg(NULL, &ev_msg);
1602
1603 /* clean up for the next prefix */
1604 bzero(&nd6_ra_msg_data.prefix, sizeof (nd6_ra_msg_data.prefix));
1605 itr = itr->next;
1606 nd6_ra_msg_data.list_index++;
1607 }
1608 }
1609
1610 /*
1611 * Regenerate deprecated/invalidated temporary address
1612 */
1613 static int
1614 regen_tmpaddr(struct in6_ifaddr *ia6)
1615 {
1616 struct ifaddr *ifa;
1617 struct ifnet *ifp;
1618 struct in6_ifaddr *public_ifa6 = NULL;
1619 uint64_t timenow = net_uptime();
1620
1621 ifp = ia6->ia_ifa.ifa_ifp;
1622 ifnet_lock_shared(ifp);
1623 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1624 struct in6_ifaddr *it6;
1625
1626 IFA_LOCK(ifa);
1627 if (ifa->ifa_addr->sa_family != AF_INET6) {
1628 IFA_UNLOCK(ifa);
1629 continue;
1630 }
1631 it6 = (struct in6_ifaddr *)ifa;
1632
1633 /* ignore no autoconf addresses. */
1634 if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0) {
1635 IFA_UNLOCK(ifa);
1636 continue;
1637 }
1638 /* ignore autoconf addresses with different prefixes. */
1639 if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr) {
1640 IFA_UNLOCK(ifa);
1641 continue;
1642 }
1643 /*
1644 * Now we are looking at an autoconf address with the same
1645 * prefix as ours. If the address is temporary and is still
1646 * preferred, do not create another one. It would be rare, but
1647 * could happen, for example, when we resume a laptop PC after
1648 * a long period.
1649 */
1650 if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
1651 !IFA6_IS_DEPRECATED(it6, timenow)) {
1652 IFA_UNLOCK(ifa);
1653 if (public_ifa6 != NULL)
1654 IFA_REMREF(&public_ifa6->ia_ifa);
1655 public_ifa6 = NULL;
1656 break;
1657 }
1658
1659 /*
1660 * This is a public autoconf address that has the same prefix
1661 * as ours. If it is preferred, keep it. We can't break the
1662 * loop here, because there may be a still-preferred temporary
1663 * address with the prefix.
1664 */
1665 if (!IFA6_IS_DEPRECATED(it6, timenow)) {
1666 IFA_ADDREF_LOCKED(ifa); /* for public_ifa6 */
1667 IFA_UNLOCK(ifa);
1668 if (public_ifa6 != NULL)
1669 IFA_REMREF(&public_ifa6->ia_ifa);
1670 public_ifa6 = it6;
1671 } else {
1672 IFA_UNLOCK(ifa);
1673 }
1674 }
1675 ifnet_lock_done(ifp);
1676
1677 if (public_ifa6 != NULL) {
1678 int e;
1679
1680 if ((e = in6_tmpifadd(public_ifa6, 0)) != 0) {
1681 log(LOG_NOTICE, "regen_tmpaddr: failed to create a new"
1682 " tmp addr,errno=%d\n", e);
1683 IFA_REMREF(&public_ifa6->ia_ifa);
1684 return (-1);
1685 }
1686 IFA_REMREF(&public_ifa6->ia_ifa);
1687 return (0);
1688 }
1689
1690 return (-1);
1691 }
1692
1693 /*
1694 * Nuke neighbor cache/prefix/default router management table, right before
1695 * ifp goes away.
1696 */
1697 void
1698 nd6_purge(struct ifnet *ifp)
1699 {
1700 struct llinfo_nd6 *ln;
1701 struct nd_defrouter *dr, *ndr;
1702 struct nd_prefix *pr, *npr;
1703 boolean_t removed;
1704 struct nd_drhead nd_defrouter_tmp;
1705
1706 TAILQ_INIT(&nd_defrouter_tmp);
1707
1708 /* Nuke default router list entries toward ifp */
1709 lck_mtx_lock(nd6_mutex);
1710 TAILQ_FOREACH_SAFE(dr, &nd_defrouter, dr_entry, ndr) {
1711 if (dr->ifp != ifp)
1712 continue;
1713 /*
1714 * Remove the entry from default router list
1715 * and add it to the temp list.
1716 * nd_defrouter_tmp will be a local temporary
1717 * list as no one else can get the same
1718 * removed entry once it is removed from default
1719 * router list.
1720 * Remove the reference after calling defrtrlist_del.
1721 *
1722 * The uninstalled entries have to be iterated first
1723 * when we call defrtrlist_del.
1724 * This is to ensure that we don't end up calling
1725 * default router selection when there are other
1726 * uninstalled candidate default routers on
1727 * the interface.
1728 * If we don't respect that order, we may end
1729 * up missing out on some entries.
1730 *
1731 * For that reason, installed ones must be inserted
1732 * at the tail and uninstalled ones at the head
1733 */
1734 TAILQ_REMOVE(&nd_defrouter, dr, dr_entry);
1735
1736 if (dr->stateflags & NDDRF_INSTALLED)
1737 TAILQ_INSERT_TAIL(&nd_defrouter_tmp, dr, dr_entry);
1738 else
1739 TAILQ_INSERT_HEAD(&nd_defrouter_tmp, dr, dr_entry);
1740 }
1741
1742 /*
1743 * The following call to defrtrlist_del should be
1744 * safe as we are iterating a local list of
1745 * default routers.
1746 *
1747 * We don't really need nd6_mutex here but keeping
1748 * it as it is to avoid changing assertios held in
1749 * the functions in the call-path.
1750 */
1751 TAILQ_FOREACH_SAFE(dr, &nd_defrouter_tmp, dr_entry, ndr) {
1752 TAILQ_REMOVE(&nd_defrouter_tmp, dr, dr_entry);
1753 defrtrlist_del(dr);
1754 NDDR_REMREF(dr); /* remove list reference */
1755 }
1756
1757 /* Nuke prefix list entries toward ifp */
1758 removed = FALSE;
1759 for (pr = nd_prefix.lh_first; pr; pr = npr) {
1760 NDPR_LOCK(pr);
1761 npr = pr->ndpr_next;
1762 if (pr->ndpr_ifp == ifp &&
1763 !(pr->ndpr_stateflags & NDPRF_DEFUNCT)) {
1764 /*
1765 * Because if_detach() does *not* release prefixes
1766 * while purging addresses the reference count will
1767 * still be above zero. We therefore reset it to
1768 * make sure that the prefix really gets purged.
1769 */
1770 pr->ndpr_addrcnt = 0;
1771
1772 /*
1773 * Previously, pr->ndpr_addr is removed as well,
1774 * but I strongly believe we don't have to do it.
1775 * nd6_purge() is only called from in6_ifdetach(),
1776 * which removes all the associated interface addresses
1777 * by itself.
1778 * (jinmei@kame.net 20010129)
1779 */
1780 NDPR_ADDREF_LOCKED(pr);
1781 prelist_remove(pr);
1782 NDPR_UNLOCK(pr);
1783 NDPR_REMREF(pr);
1784 removed = TRUE;
1785 npr = nd_prefix.lh_first;
1786 } else {
1787 NDPR_UNLOCK(pr);
1788 }
1789 }
1790 if (removed)
1791 pfxlist_onlink_check();
1792 lck_mtx_unlock(nd6_mutex);
1793
1794 /* cancel default outgoing interface setting */
1795 if (nd6_defifindex == ifp->if_index) {
1796 nd6_setdefaultiface(0);
1797 }
1798
1799 /*
1800 * Perform default router selection even when we are a router,
1801 * if Scoped Routing is enabled.
1802 */
1803 lck_mtx_lock(nd6_mutex);
1804 /* refresh default router list */
1805 defrouter_select(ifp);
1806 lck_mtx_unlock(nd6_mutex);
1807
1808 /*
1809 * Nuke neighbor cache entries for the ifp.
1810 * Note that rt->rt_ifp may not be the same as ifp,
1811 * due to KAME goto ours hack. See RTM_RESOLVE case in
1812 * nd6_rtrequest(), and ip6_input().
1813 */
1814 again:
1815 lck_mtx_lock(rnh_lock);
1816 ln = llinfo_nd6.ln_next;
1817 while (ln != NULL && ln != &llinfo_nd6) {
1818 struct rtentry *rt;
1819 struct llinfo_nd6 *nln;
1820
1821 nln = ln->ln_next;
1822 rt = ln->ln_rt;
1823 RT_LOCK(rt);
1824 if (rt->rt_gateway != NULL &&
1825 rt->rt_gateway->sa_family == AF_LINK &&
1826 SDL(rt->rt_gateway)->sdl_index == ifp->if_index) {
1827 RT_ADDREF_LOCKED(rt);
1828 RT_UNLOCK(rt);
1829 lck_mtx_unlock(rnh_lock);
1830 /*
1831 * See comments on nd6_service() for reasons why
1832 * this loop is repeated; we bite the costs of
1833 * going thru the same llinfo_nd6 more than once
1834 * here, since this purge happens during detach,
1835 * and that unlike the timer case, it's possible
1836 * there's more than one purges happening at the
1837 * same time (thus a flag wouldn't buy anything).
1838 */
1839 nd6_free(rt);
1840 RT_REMREF(rt);
1841 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1842 goto again;
1843 } else {
1844 RT_UNLOCK(rt);
1845 }
1846 ln = nln;
1847 }
1848 lck_mtx_unlock(rnh_lock);
1849 }
1850
1851 /*
1852 * Upon success, the returned route will be locked and the caller is
1853 * responsible for releasing the reference and doing RT_UNLOCK(rt).
1854 * This routine does not require rnh_lock to be held by the caller,
1855 * although it needs to be indicated of such a case in order to call
1856 * the correct variant of the relevant routing routines.
1857 */
1858 struct rtentry *
1859 nd6_lookup(struct in6_addr *addr6, int create, struct ifnet *ifp, int rt_locked)
1860 {
1861 struct rtentry *rt;
1862 struct sockaddr_in6 sin6;
1863 unsigned int ifscope;
1864
1865 bzero(&sin6, sizeof (sin6));
1866 sin6.sin6_len = sizeof (struct sockaddr_in6);
1867 sin6.sin6_family = AF_INET6;
1868 sin6.sin6_addr = *addr6;
1869
1870 ifscope = (ifp != NULL) ? ifp->if_index : IFSCOPE_NONE;
1871 if (rt_locked) {
1872 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
1873 rt = rtalloc1_scoped_locked(SA(&sin6), create, 0, ifscope);
1874 } else {
1875 rt = rtalloc1_scoped(SA(&sin6), create, 0, ifscope);
1876 }
1877
1878 if (rt != NULL) {
1879 RT_LOCK(rt);
1880 if ((rt->rt_flags & RTF_LLINFO) == 0) {
1881 /*
1882 * This is the case for the default route.
1883 * If we want to create a neighbor cache for the
1884 * address, we should free the route for the
1885 * destination and allocate an interface route.
1886 */
1887 if (create) {
1888 RT_UNLOCK(rt);
1889 if (rt_locked)
1890 rtfree_locked(rt);
1891 else
1892 rtfree(rt);
1893 rt = NULL;
1894 }
1895 }
1896 }
1897 if (rt == NULL) {
1898 if (create && ifp) {
1899 struct ifaddr *ifa;
1900 u_int32_t ifa_flags;
1901 int e;
1902
1903 /*
1904 * If no route is available and create is set,
1905 * we allocate a host route for the destination
1906 * and treat it like an interface route.
1907 * This hack is necessary for a neighbor which can't
1908 * be covered by our own prefix.
1909 */
1910 ifa = ifaof_ifpforaddr(SA(&sin6), ifp);
1911 if (ifa == NULL)
1912 return (NULL);
1913
1914 /*
1915 * Create a new route. RTF_LLINFO is necessary
1916 * to create a Neighbor Cache entry for the
1917 * destination in nd6_rtrequest which will be
1918 * called in rtrequest via ifa->ifa_rtrequest.
1919 */
1920 if (!rt_locked)
1921 lck_mtx_lock(rnh_lock);
1922 IFA_LOCK_SPIN(ifa);
1923 ifa_flags = ifa->ifa_flags;
1924 IFA_UNLOCK(ifa);
1925 if ((e = rtrequest_scoped_locked(RTM_ADD,
1926 SA(&sin6), ifa->ifa_addr, SA(&all1_sa),
1927 (ifa_flags | RTF_HOST | RTF_LLINFO) &
1928 ~RTF_CLONING, &rt, ifscope)) != 0) {
1929 if (e != EEXIST)
1930 log(LOG_ERR, "%s: failed to add route "
1931 "for a neighbor(%s), errno=%d\n",
1932 __func__, ip6_sprintf(addr6), e);
1933 }
1934 if (!rt_locked)
1935 lck_mtx_unlock(rnh_lock);
1936 IFA_REMREF(ifa);
1937 if (rt == NULL)
1938 return (NULL);
1939
1940 RT_LOCK(rt);
1941 if (rt->rt_llinfo) {
1942 struct llinfo_nd6 *ln = rt->rt_llinfo;
1943 struct nd_ifinfo *ndi = ND_IFINFO(rt->rt_ifp);
1944
1945 VERIFY((NULL != ndi) && (TRUE == ndi->initialized));
1946 /*
1947 * For interface's that do not perform NUD
1948 * neighbor cache entres must always be marked
1949 * reachable with no expiry
1950 */
1951 if (ndi->flags & ND6_IFF_PERFORMNUD) {
1952 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_NOSTATE);
1953 } else {
1954 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_REACHABLE);
1955 ln_setexpire(ln, 0);
1956 }
1957 }
1958 } else {
1959 return (NULL);
1960 }
1961 }
1962 RT_LOCK_ASSERT_HELD(rt);
1963 /*
1964 * Validation for the entry.
1965 * Note that the check for rt_llinfo is necessary because a cloned
1966 * route from a parent route that has the L flag (e.g. the default
1967 * route to a p2p interface) may have the flag, too, while the
1968 * destination is not actually a neighbor.
1969 * XXX: we can't use rt->rt_ifp to check for the interface, since
1970 * it might be the loopback interface if the entry is for our
1971 * own address on a non-loopback interface. Instead, we should
1972 * use rt->rt_ifa->ifa_ifp, which would specify the REAL
1973 * interface.
1974 * Note also that ifa_ifp and ifp may differ when we connect two
1975 * interfaces to a same link, install a link prefix to an interface,
1976 * and try to install a neighbor cache on an interface that does not
1977 * have a route to the prefix.
1978 *
1979 * If the address is from a proxied prefix, the ifa_ifp and ifp might
1980 * not match, because nd6_na_input() could have modified the ifp
1981 * of the route to point to the interface where the NA arrived on,
1982 * hence the test for RTF_PROXY.
1983 */
1984 if ((rt->rt_flags & RTF_GATEWAY) || (rt->rt_flags & RTF_LLINFO) == 0 ||
1985 rt->rt_gateway->sa_family != AF_LINK || rt->rt_llinfo == NULL ||
1986 (ifp && rt->rt_ifa->ifa_ifp != ifp &&
1987 !(rt->rt_flags & RTF_PROXY))) {
1988 RT_REMREF_LOCKED(rt);
1989 RT_UNLOCK(rt);
1990 if (create) {
1991 log(LOG_DEBUG, "%s: failed to lookup %s "
1992 "(if = %s)\n", __func__, ip6_sprintf(addr6),
1993 ifp ? if_name(ifp) : "unspec");
1994 /* xxx more logs... kazu */
1995 }
1996 return (NULL);
1997 }
1998 /*
1999 * Caller needs to release reference and call RT_UNLOCK(rt).
2000 */
2001 return (rt);
2002 }
2003
2004 /*
2005 * Test whether a given IPv6 address is a neighbor or not, ignoring
2006 * the actual neighbor cache. The neighbor cache is ignored in order
2007 * to not reenter the routing code from within itself.
2008 */
2009 static int
2010 nd6_is_new_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
2011 {
2012 struct nd_prefix *pr;
2013 struct ifaddr *dstaddr;
2014
2015 LCK_MTX_ASSERT(nd6_mutex, LCK_MTX_ASSERT_OWNED);
2016
2017 /*
2018 * A link-local address is always a neighbor.
2019 * XXX: a link does not necessarily specify a single interface.
2020 */
2021 if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr)) {
2022 struct sockaddr_in6 sin6_copy;
2023 u_int32_t zone;
2024
2025 /*
2026 * We need sin6_copy since sa6_recoverscope() may modify the
2027 * content (XXX).
2028 */
2029 sin6_copy = *addr;
2030 if (sa6_recoverscope(&sin6_copy, FALSE))
2031 return (0); /* XXX: should be impossible */
2032 if (in6_setscope(&sin6_copy.sin6_addr, ifp, &zone))
2033 return (0);
2034 if (sin6_copy.sin6_scope_id == zone)
2035 return (1);
2036 else
2037 return (0);
2038 }
2039
2040 /*
2041 * If the address matches one of our addresses,
2042 * it should be a neighbor.
2043 * If the address matches one of our on-link prefixes, it should be a
2044 * neighbor.
2045 */
2046 for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
2047 NDPR_LOCK(pr);
2048 if (pr->ndpr_ifp != ifp) {
2049 NDPR_UNLOCK(pr);
2050 continue;
2051 }
2052 if (!(pr->ndpr_stateflags & NDPRF_ONLINK)) {
2053 NDPR_UNLOCK(pr);
2054 continue;
2055 }
2056 if (IN6_ARE_MASKED_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
2057 &addr->sin6_addr, &pr->ndpr_mask)) {
2058 NDPR_UNLOCK(pr);
2059 return (1);
2060 }
2061 NDPR_UNLOCK(pr);
2062 }
2063
2064 /*
2065 * If the address is assigned on the node of the other side of
2066 * a p2p interface, the address should be a neighbor.
2067 */
2068 dstaddr = ifa_ifwithdstaddr(SA(addr));
2069 if (dstaddr != NULL) {
2070 if (dstaddr->ifa_ifp == ifp) {
2071 IFA_REMREF(dstaddr);
2072 return (1);
2073 }
2074 IFA_REMREF(dstaddr);
2075 dstaddr = NULL;
2076 }
2077
2078 return (0);
2079 }
2080
2081
2082 /*
2083 * Detect if a given IPv6 address identifies a neighbor on a given link.
2084 * XXX: should take care of the destination of a p2p link?
2085 */
2086 int
2087 nd6_is_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp,
2088 int rt_locked)
2089 {
2090 struct rtentry *rt;
2091
2092 LCK_MTX_ASSERT(nd6_mutex, LCK_MTX_ASSERT_NOTOWNED);
2093 lck_mtx_lock(nd6_mutex);
2094 if (nd6_is_new_addr_neighbor(addr, ifp)) {
2095 lck_mtx_unlock(nd6_mutex);
2096 return (1);
2097 }
2098 lck_mtx_unlock(nd6_mutex);
2099
2100 /*
2101 * Even if the address matches none of our addresses, it might be
2102 * in the neighbor cache.
2103 */
2104 if ((rt = nd6_lookup(&addr->sin6_addr, 0, ifp, rt_locked)) != NULL) {
2105 RT_LOCK_ASSERT_HELD(rt);
2106 RT_REMREF_LOCKED(rt);
2107 RT_UNLOCK(rt);
2108 return (1);
2109 }
2110
2111 return (0);
2112 }
2113
2114 /*
2115 * Free an nd6 llinfo entry.
2116 * Since the function would cause significant changes in the kernel, DO NOT
2117 * make it global, unless you have a strong reason for the change, and are sure
2118 * that the change is safe.
2119 */
2120 void
2121 nd6_free(struct rtentry *rt)
2122 {
2123 struct llinfo_nd6 *ln;
2124 struct in6_addr in6;
2125 struct nd_defrouter *dr;
2126
2127 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
2128 RT_LOCK_ASSERT_NOTHELD(rt);
2129 lck_mtx_lock(nd6_mutex);
2130
2131 RT_LOCK(rt);
2132 RT_ADDREF_LOCKED(rt); /* Extra ref */
2133 ln = rt->rt_llinfo;
2134 in6 = SIN6(rt_key(rt))->sin6_addr;
2135
2136 /*
2137 * Prevent another thread from modifying rt_key, rt_gateway
2138 * via rt_setgate() after the rt_lock is dropped by marking
2139 * the route as defunct.
2140 */
2141 rt->rt_flags |= RTF_CONDEMNED;
2142
2143 /*
2144 * We used to have pfctlinput(PRC_HOSTDEAD) here. Even though it is
2145 * not harmful, it was not really necessary. Perform default router
2146 * selection even when we are a router, if Scoped Routing is enabled.
2147 */
2148 dr = defrouter_lookup(&SIN6(rt_key(rt))->sin6_addr, rt->rt_ifp);
2149
2150 if ((ln && ln->ln_router) || dr) {
2151 /*
2152 * rt6_flush must be called whether or not the neighbor
2153 * is in the Default Router List.
2154 * See a corresponding comment in nd6_na_input().
2155 */
2156 RT_UNLOCK(rt);
2157 lck_mtx_unlock(nd6_mutex);
2158 rt6_flush(&in6, rt->rt_ifp);
2159 lck_mtx_lock(nd6_mutex);
2160 } else {
2161 RT_UNLOCK(rt);
2162 }
2163
2164 if (dr) {
2165 NDDR_REMREF(dr);
2166 /*
2167 * Unreachablity of a router might affect the default
2168 * router selection and on-link detection of advertised
2169 * prefixes.
2170 */
2171
2172 /*
2173 * Temporarily fake the state to choose a new default
2174 * router and to perform on-link determination of
2175 * prefixes correctly.
2176 * Below the state will be set correctly,
2177 * or the entry itself will be deleted.
2178 */
2179 RT_LOCK_SPIN(rt);
2180 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_INCOMPLETE);
2181
2182 /*
2183 * Since defrouter_select() does not affect the
2184 * on-link determination and MIP6 needs the check
2185 * before the default router selection, we perform
2186 * the check now.
2187 */
2188 RT_UNLOCK(rt);
2189 pfxlist_onlink_check();
2190
2191 /*
2192 * refresh default router list
2193 */
2194 defrouter_select(rt->rt_ifp);
2195 }
2196 RT_LOCK_ASSERT_NOTHELD(rt);
2197 lck_mtx_unlock(nd6_mutex);
2198 /*
2199 * Detach the route from the routing tree and the list of neighbor
2200 * caches, and disable the route entry not to be used in already
2201 * cached routes.
2202 */
2203 (void) rtrequest(RTM_DELETE, rt_key(rt), NULL, rt_mask(rt), 0, NULL);
2204
2205 /* Extra ref held above; now free it */
2206 rtfree(rt);
2207 }
2208
2209 void
2210 nd6_rtrequest(int req, struct rtentry *rt, struct sockaddr *sa)
2211 {
2212 #pragma unused(sa)
2213 struct sockaddr *gate = rt->rt_gateway;
2214 struct llinfo_nd6 *ln = rt->rt_llinfo;
2215 static struct sockaddr_dl null_sdl =
2216 { .sdl_len = sizeof (null_sdl), .sdl_family = AF_LINK };
2217 struct ifnet *ifp = rt->rt_ifp;
2218 struct ifaddr *ifa;
2219 uint64_t timenow;
2220 char buf[MAX_IPv6_STR_LEN];
2221 struct nd_ifinfo *ndi = ND_IFINFO(rt->rt_ifp);
2222
2223 VERIFY((NULL != ndi) && (TRUE == ndi->initialized));
2224 VERIFY(nd6_init_done);
2225 LCK_MTX_ASSERT(rnh_lock, LCK_MTX_ASSERT_OWNED);
2226 RT_LOCK_ASSERT_HELD(rt);
2227
2228 /*
2229 * We have rnh_lock held, see if we need to schedule the timer;
2230 * we might do this again below during RTM_RESOLVE, but doing it
2231 * now handles all other cases.
2232 */
2233 if (nd6_sched_timeout_want)
2234 nd6_sched_timeout(NULL, NULL);
2235
2236 if (rt->rt_flags & RTF_GATEWAY)
2237 return;
2238
2239 if (!nd6_need_cache(ifp) && !(rt->rt_flags & RTF_HOST)) {
2240 /*
2241 * This is probably an interface direct route for a link
2242 * which does not need neighbor caches (e.g. fe80::%lo0/64).
2243 * We do not need special treatment below for such a route.
2244 * Moreover, the RTF_LLINFO flag which would be set below
2245 * would annoy the ndp(8) command.
2246 */
2247 return;
2248 }
2249
2250 if (req == RTM_RESOLVE) {
2251 int no_nd_cache;
2252
2253 if (!nd6_need_cache(ifp)) { /* stf case */
2254 no_nd_cache = 1;
2255 } else {
2256 struct sockaddr_in6 sin6;
2257
2258 rtkey_to_sa6(rt, &sin6);
2259 /*
2260 * nd6_is_addr_neighbor() may call nd6_lookup(),
2261 * therefore we drop rt_lock to avoid deadlock
2262 * during the lookup.
2263 */
2264 RT_ADDREF_LOCKED(rt);
2265 RT_UNLOCK(rt);
2266 no_nd_cache = !nd6_is_addr_neighbor(&sin6, ifp, 1);
2267 RT_LOCK(rt);
2268 RT_REMREF_LOCKED(rt);
2269 }
2270
2271 /*
2272 * FreeBSD and BSD/OS often make a cloned host route based
2273 * on a less-specific route (e.g. the default route).
2274 * If the less specific route does not have a "gateway"
2275 * (this is the case when the route just goes to a p2p or an
2276 * stf interface), we'll mistakenly make a neighbor cache for
2277 * the host route, and will see strange neighbor solicitation
2278 * for the corresponding destination. In order to avoid the
2279 * confusion, we check if the destination of the route is
2280 * a neighbor in terms of neighbor discovery, and stop the
2281 * process if not. Additionally, we remove the LLINFO flag
2282 * so that ndp(8) will not try to get the neighbor information
2283 * of the destination.
2284 */
2285 if (no_nd_cache) {
2286 rt->rt_flags &= ~RTF_LLINFO;
2287 return;
2288 }
2289 }
2290
2291 timenow = net_uptime();
2292
2293 switch (req) {
2294 case RTM_ADD:
2295 /*
2296 * There is no backward compatibility :)
2297 *
2298 * if ((rt->rt_flags & RTF_HOST) == 0 &&
2299 * SIN(rt_mask(rt))->sin_addr.s_addr != 0xffffffff)
2300 * rt->rt_flags |= RTF_CLONING;
2301 */
2302 if ((rt->rt_flags & RTF_CLONING) ||
2303 ((rt->rt_flags & RTF_LLINFO) && ln == NULL)) {
2304 /*
2305 * Case 1: This route should come from a route to
2306 * interface (RTF_CLONING case) or the route should be
2307 * treated as on-link but is currently not
2308 * (RTF_LLINFO && ln == NULL case).
2309 */
2310 if (rt_setgate(rt, rt_key(rt), SA(&null_sdl)) == 0) {
2311 gate = rt->rt_gateway;
2312 SDL(gate)->sdl_type = ifp->if_type;
2313 SDL(gate)->sdl_index = ifp->if_index;
2314 /*
2315 * In case we're called before 1.0 sec.
2316 * has elapsed.
2317 */
2318 if (ln != NULL) {
2319 ln_setexpire(ln,
2320 (ifp->if_eflags & IFEF_IPV6_ND6ALT)
2321 ? 0 : MAX(timenow, 1));
2322 }
2323 }
2324 if (rt->rt_flags & RTF_CLONING)
2325 break;
2326 }
2327 /*
2328 * In IPv4 code, we try to annonuce new RTF_ANNOUNCE entry here.
2329 * We don't do that here since llinfo is not ready yet.
2330 *
2331 * There are also couple of other things to be discussed:
2332 * - unsolicited NA code needs improvement beforehand
2333 * - RFC4861 says we MAY send multicast unsolicited NA
2334 * (7.2.6 paragraph 4), however, it also says that we
2335 * SHOULD provide a mechanism to prevent multicast NA storm.
2336 * we don't have anything like it right now.
2337 * note that the mechanism needs a mutual agreement
2338 * between proxies, which means that we need to implement
2339 * a new protocol, or a new kludge.
2340 * - from RFC4861 6.2.4, host MUST NOT send an unsolicited RA.
2341 * we need to check ip6forwarding before sending it.
2342 * (or should we allow proxy ND configuration only for
2343 * routers? there's no mention about proxy ND from hosts)
2344 */
2345 /* FALLTHROUGH */
2346 case RTM_RESOLVE:
2347 if (!(ifp->if_flags & (IFF_POINTOPOINT | IFF_LOOPBACK))) {
2348 /*
2349 * Address resolution isn't necessary for a point to
2350 * point link, so we can skip this test for a p2p link.
2351 */
2352 if (gate->sa_family != AF_LINK ||
2353 gate->sa_len < sizeof (null_sdl)) {
2354 /* Don't complain in case of RTM_ADD */
2355 if (req == RTM_RESOLVE) {
2356 log(LOG_ERR, "%s: route to %s has bad "
2357 "gateway address (sa_family %u "
2358 "sa_len %u) on %s\n", __func__,
2359 inet_ntop(AF_INET6,
2360 &SIN6(rt_key(rt))->sin6_addr, buf,
2361 sizeof (buf)), gate->sa_family,
2362 gate->sa_len, if_name(ifp));
2363 }
2364 break;
2365 }
2366 SDL(gate)->sdl_type = ifp->if_type;
2367 SDL(gate)->sdl_index = ifp->if_index;
2368 }
2369 if (ln != NULL)
2370 break; /* This happens on a route change */
2371 /*
2372 * Case 2: This route may come from cloning, or a manual route
2373 * add with a LL address.
2374 */
2375 rt->rt_llinfo = ln = nd6_llinfo_alloc(M_WAITOK);
2376 if (ln == NULL)
2377 break;
2378
2379 nd6_allocated++;
2380 rt->rt_llinfo_get_ri = nd6_llinfo_get_ri;
2381 rt->rt_llinfo_get_iflri = nd6_llinfo_get_iflri;
2382 rt->rt_llinfo_purge = nd6_llinfo_purge;
2383 rt->rt_llinfo_free = nd6_llinfo_free;
2384 rt->rt_llinfo_refresh = nd6_llinfo_refresh;
2385 rt->rt_flags |= RTF_LLINFO;
2386 ln->ln_rt = rt;
2387 /* this is required for "ndp" command. - shin */
2388 /*
2389 * For interface's that do not perform NUD
2390 * neighbor cache entries must always be marked
2391 * reachable with no expiry
2392 */
2393 if ((req == RTM_ADD) ||
2394 !(ndi->flags & ND6_IFF_PERFORMNUD)) {
2395 /*
2396 * gate should have some valid AF_LINK entry,
2397 * and ln->ln_expire should have some lifetime
2398 * which is specified by ndp command.
2399 */
2400 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_REACHABLE);
2401 ln_setexpire(ln, 0);
2402 } else {
2403 /*
2404 * When req == RTM_RESOLVE, rt is created and
2405 * initialized in rtrequest(), so rt_expire is 0.
2406 */
2407 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_NOSTATE);
2408 /* In case we're called before 1.0 sec. has elapsed */
2409 ln_setexpire(ln, (ifp->if_eflags & IFEF_IPV6_ND6ALT) ?
2410 0 : MAX(timenow, 1));
2411 }
2412 LN_INSERTHEAD(ln);
2413 nd6_inuse++;
2414
2415 /* We have at least one entry; arm the timer if not already */
2416 nd6_sched_timeout(NULL, NULL);
2417
2418 /*
2419 * If we have too many cache entries, initiate immediate
2420 * purging for some "less recently used" entries. Note that
2421 * we cannot directly call nd6_free() here because it would
2422 * cause re-entering rtable related routines triggering an LOR
2423 * problem.
2424 */
2425 if (ip6_neighborgcthresh > 0 &&
2426 nd6_inuse >= ip6_neighborgcthresh) {
2427 int i;
2428
2429 for (i = 0; i < 10 && llinfo_nd6.ln_prev != ln; i++) {
2430 struct llinfo_nd6 *ln_end = llinfo_nd6.ln_prev;
2431 struct rtentry *rt_end = ln_end->ln_rt;
2432
2433 /* Move this entry to the head */
2434 RT_LOCK(rt_end);
2435 LN_DEQUEUE(ln_end);
2436 LN_INSERTHEAD(ln_end);
2437
2438 if (ln_end->ln_expire == 0) {
2439 RT_UNLOCK(rt_end);
2440 continue;
2441 }
2442 if (ln_end->ln_state > ND6_LLINFO_INCOMPLETE)
2443 ND6_CACHE_STATE_TRANSITION(ln_end, ND6_LLINFO_STALE);
2444 else
2445 ND6_CACHE_STATE_TRANSITION(ln_end, ND6_LLINFO_PURGE);
2446 ln_setexpire(ln_end, timenow);
2447 RT_UNLOCK(rt_end);
2448 }
2449 }
2450
2451 /*
2452 * check if rt_key(rt) is one of my address assigned
2453 * to the interface.
2454 */
2455 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(rt->rt_ifp,
2456 &SIN6(rt_key(rt))->sin6_addr);
2457 if (ifa != NULL) {
2458 caddr_t macp = nd6_ifptomac(ifp);
2459 ln_setexpire(ln, 0);
2460 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_REACHABLE);
2461 if (macp != NULL) {
2462 Bcopy(macp, LLADDR(SDL(gate)), ifp->if_addrlen);
2463 SDL(gate)->sdl_alen = ifp->if_addrlen;
2464 }
2465 if (nd6_useloopback) {
2466 if (rt->rt_ifp != lo_ifp) {
2467 /*
2468 * Purge any link-layer info caching.
2469 */
2470 if (rt->rt_llinfo_purge != NULL)
2471 rt->rt_llinfo_purge(rt);
2472
2473 /*
2474 * Adjust route ref count for the
2475 * interfaces.
2476 */
2477 if (rt->rt_if_ref_fn != NULL) {
2478 rt->rt_if_ref_fn(lo_ifp, 1);
2479 rt->rt_if_ref_fn(rt->rt_ifp,
2480 -1);
2481 }
2482 }
2483 rt->rt_ifp = lo_ifp;
2484 /*
2485 * If rmx_mtu is not locked, update it
2486 * to the MTU used by the new interface.
2487 */
2488 if (!(rt->rt_rmx.rmx_locks & RTV_MTU))
2489 rt->rt_rmx.rmx_mtu = rt->rt_ifp->if_mtu;
2490 /*
2491 * Make sure rt_ifa be equal to the ifaddr
2492 * corresponding to the address.
2493 * We need this because when we refer
2494 * rt_ifa->ia6_flags in ip6_input, we assume
2495 * that the rt_ifa points to the address instead
2496 * of the loopback address.
2497 */
2498 if (ifa != rt->rt_ifa) {
2499 rtsetifa(rt, ifa);
2500 }
2501 }
2502 IFA_REMREF(ifa);
2503 } else if (rt->rt_flags & RTF_ANNOUNCE) {
2504 ln_setexpire(ln, 0);
2505 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_REACHABLE);
2506
2507 /* join solicited node multicast for proxy ND */
2508 if (ifp->if_flags & IFF_MULTICAST) {
2509 struct in6_addr llsol;
2510 struct in6_multi *in6m;
2511 int error;
2512
2513 llsol = SIN6(rt_key(rt))->sin6_addr;
2514 llsol.s6_addr32[0] = IPV6_ADDR_INT32_MLL;
2515 llsol.s6_addr32[1] = 0;
2516 llsol.s6_addr32[2] = htonl(1);
2517 llsol.s6_addr8[12] = 0xff;
2518 if (in6_setscope(&llsol, ifp, NULL))
2519 break;
2520 error = in6_mc_join(ifp, &llsol,
2521 NULL, &in6m, 0);
2522 if (error) {
2523 nd6log((LOG_ERR, "%s: failed to join "
2524 "%s (errno=%d)\n", if_name(ifp),
2525 ip6_sprintf(&llsol), error));
2526 } else {
2527 IN6M_REMREF(in6m);
2528 }
2529 }
2530 }
2531 break;
2532
2533 case RTM_DELETE:
2534 if (ln == NULL)
2535 break;
2536 /* leave from solicited node multicast for proxy ND */
2537 if ((rt->rt_flags & RTF_ANNOUNCE) &&
2538 (ifp->if_flags & IFF_MULTICAST)) {
2539 struct in6_addr llsol;
2540 struct in6_multi *in6m;
2541
2542 llsol = SIN6(rt_key(rt))->sin6_addr;
2543 llsol.s6_addr32[0] = IPV6_ADDR_INT32_MLL;
2544 llsol.s6_addr32[1] = 0;
2545 llsol.s6_addr32[2] = htonl(1);
2546 llsol.s6_addr8[12] = 0xff;
2547 if (in6_setscope(&llsol, ifp, NULL) == 0) {
2548 in6_multihead_lock_shared();
2549 IN6_LOOKUP_MULTI(&llsol, ifp, in6m);
2550 in6_multihead_lock_done();
2551 if (in6m != NULL) {
2552 in6_mc_leave(in6m, NULL);
2553 IN6M_REMREF(in6m);
2554 }
2555 }
2556 }
2557 nd6_inuse--;
2558 /*
2559 * Unchain it but defer the actual freeing until the route
2560 * itself is to be freed. rt->rt_llinfo still points to
2561 * llinfo_nd6, and likewise, ln->ln_rt stil points to this
2562 * route entry, except that RTF_LLINFO is now cleared.
2563 */
2564 if (ln->ln_flags & ND6_LNF_IN_USE)
2565 LN_DEQUEUE(ln);
2566
2567 /*
2568 * Purge any link-layer info caching.
2569 */
2570 if (rt->rt_llinfo_purge != NULL)
2571 rt->rt_llinfo_purge(rt);
2572
2573 rt->rt_flags &= ~RTF_LLINFO;
2574 if (ln->ln_hold != NULL) {
2575 m_freem_list(ln->ln_hold);
2576 ln->ln_hold = NULL;
2577 }
2578 }
2579 }
2580
2581 static int
2582 nd6_siocgdrlst(void *data, int data_is_64)
2583 {
2584 struct in6_drlist_32 *drl_32;
2585 struct nd_defrouter *dr;
2586 int i = 0;
2587
2588 LCK_MTX_ASSERT(nd6_mutex, LCK_MTX_ASSERT_OWNED);
2589
2590 dr = TAILQ_FIRST(&nd_defrouter);
2591
2592 /* XXX Handle mapped defrouter entries */
2593 /* For 64-bit process */
2594 if (data_is_64) {
2595 struct in6_drlist_64 *drl_64;
2596
2597 drl_64 = _MALLOC(sizeof (*drl_64), M_TEMP, M_WAITOK|M_ZERO);
2598 if (drl_64 == NULL)
2599 return (ENOMEM);
2600
2601 /* preserve the interface name */
2602 bcopy(data, drl_64, sizeof (drl_64->ifname));
2603
2604 while (dr && i < DRLSTSIZ) {
2605 drl_64->defrouter[i].rtaddr = dr->rtaddr;
2606 if (IN6_IS_ADDR_LINKLOCAL(
2607 &drl_64->defrouter[i].rtaddr)) {
2608 /* XXX: need to this hack for KAME stack */
2609 drl_64->defrouter[i].rtaddr.s6_addr16[1] = 0;
2610 } else {
2611 log(LOG_ERR,
2612 "default router list contains a "
2613 "non-linklocal address(%s)\n",
2614 ip6_sprintf(&drl_64->defrouter[i].rtaddr));
2615 }
2616 drl_64->defrouter[i].flags = dr->flags;
2617 drl_64->defrouter[i].rtlifetime = dr->rtlifetime;
2618 drl_64->defrouter[i].expire = nddr_getexpire(dr);
2619 drl_64->defrouter[i].if_index = dr->ifp->if_index;
2620 i++;
2621 dr = TAILQ_NEXT(dr, dr_entry);
2622 }
2623 bcopy(drl_64, data, sizeof (*drl_64));
2624 _FREE(drl_64, M_TEMP);
2625 return (0);
2626 }
2627
2628 /* For 32-bit process */
2629 drl_32 = _MALLOC(sizeof (*drl_32), M_TEMP, M_WAITOK|M_ZERO);
2630 if (drl_32 == NULL)
2631 return (ENOMEM);
2632
2633 /* preserve the interface name */
2634 bcopy(data, drl_32, sizeof (drl_32->ifname));
2635
2636 while (dr != NULL && i < DRLSTSIZ) {
2637 drl_32->defrouter[i].rtaddr = dr->rtaddr;
2638 if (IN6_IS_ADDR_LINKLOCAL(&drl_32->defrouter[i].rtaddr)) {
2639 /* XXX: need to this hack for KAME stack */
2640 drl_32->defrouter[i].rtaddr.s6_addr16[1] = 0;
2641 } else {
2642 log(LOG_ERR,
2643 "default router list contains a "
2644 "non-linklocal address(%s)\n",
2645 ip6_sprintf(&drl_32->defrouter[i].rtaddr));
2646 }
2647 drl_32->defrouter[i].flags = dr->flags;
2648 drl_32->defrouter[i].rtlifetime = dr->rtlifetime;
2649 drl_32->defrouter[i].expire = nddr_getexpire(dr);
2650 drl_32->defrouter[i].if_index = dr->ifp->if_index;
2651 i++;
2652 dr = TAILQ_NEXT(dr, dr_entry);
2653 }
2654 bcopy(drl_32, data, sizeof (*drl_32));
2655 _FREE(drl_32, M_TEMP);
2656 return (0);
2657 }
2658
2659 /*
2660 * XXX meaning of fields, especialy "raflags", is very
2661 * differnet between RA prefix list and RR/static prefix list.
2662 * how about separating ioctls into two?
2663 */
2664 static int
2665 nd6_siocgprlst(void *data, int data_is_64)
2666 {
2667 struct in6_prlist_32 *prl_32;
2668 struct nd_prefix *pr;
2669 int i = 0;
2670
2671 LCK_MTX_ASSERT(nd6_mutex, LCK_MTX_ASSERT_OWNED);
2672
2673 pr = nd_prefix.lh_first;
2674
2675 /* XXX Handle mapped defrouter entries */
2676 /* For 64-bit process */
2677 if (data_is_64) {
2678 struct in6_prlist_64 *prl_64;
2679
2680 prl_64 = _MALLOC(sizeof (*prl_64), M_TEMP, M_WAITOK|M_ZERO);
2681 if (prl_64 == NULL)
2682 return (ENOMEM);
2683
2684 /* preserve the interface name */
2685 bcopy(data, prl_64, sizeof (prl_64->ifname));
2686
2687 while (pr && i < PRLSTSIZ) {
2688 struct nd_pfxrouter *pfr;
2689 int j;
2690
2691 NDPR_LOCK(pr);
2692 (void) in6_embedscope(&prl_64->prefix[i].prefix,
2693 &pr->ndpr_prefix, NULL, NULL, NULL);
2694 prl_64->prefix[i].raflags = pr->ndpr_raf;
2695 prl_64->prefix[i].prefixlen = pr->ndpr_plen;
2696 prl_64->prefix[i].vltime = pr->ndpr_vltime;
2697 prl_64->prefix[i].pltime = pr->ndpr_pltime;
2698 prl_64->prefix[i].if_index = pr->ndpr_ifp->if_index;
2699 prl_64->prefix[i].expire = ndpr_getexpire(pr);
2700
2701 pfr = pr->ndpr_advrtrs.lh_first;
2702 j = 0;
2703 while (pfr) {
2704 if (j < DRLSTSIZ) {
2705 #define RTRADDR prl_64->prefix[i].advrtr[j]
2706 RTRADDR = pfr->router->rtaddr;
2707 if (IN6_IS_ADDR_LINKLOCAL(&RTRADDR)) {
2708 /* XXX: hack for KAME */
2709 RTRADDR.s6_addr16[1] = 0;
2710 } else {
2711 log(LOG_ERR,
2712 "a router(%s) advertises "
2713 "a prefix with "
2714 "non-link local address\n",
2715 ip6_sprintf(&RTRADDR));
2716 }
2717 #undef RTRADDR
2718 }
2719 j++;
2720 pfr = pfr->pfr_next;
2721 }
2722 prl_64->prefix[i].advrtrs = j;
2723 prl_64->prefix[i].origin = PR_ORIG_RA;
2724 NDPR_UNLOCK(pr);
2725
2726 i++;
2727 pr = pr->ndpr_next;
2728 }
2729 bcopy(prl_64, data, sizeof (*prl_64));
2730 _FREE(prl_64, M_TEMP);
2731 return (0);
2732 }
2733
2734 /* For 32-bit process */
2735 prl_32 = _MALLOC(sizeof (*prl_32), M_TEMP, M_WAITOK|M_ZERO);
2736 if (prl_32 == NULL)
2737 return (ENOMEM);
2738
2739 /* preserve the interface name */
2740 bcopy(data, prl_32, sizeof (prl_32->ifname));
2741
2742 while (pr && i < PRLSTSIZ) {
2743 struct nd_pfxrouter *pfr;
2744 int j;
2745
2746 NDPR_LOCK(pr);
2747 (void) in6_embedscope(&prl_32->prefix[i].prefix,
2748 &pr->ndpr_prefix, NULL, NULL, NULL);
2749 prl_32->prefix[i].raflags = pr->ndpr_raf;
2750 prl_32->prefix[i].prefixlen = pr->ndpr_plen;
2751 prl_32->prefix[i].vltime = pr->ndpr_vltime;
2752 prl_32->prefix[i].pltime = pr->ndpr_pltime;
2753 prl_32->prefix[i].if_index = pr->ndpr_ifp->if_index;
2754 prl_32->prefix[i].expire = ndpr_getexpire(pr);
2755
2756 pfr = pr->ndpr_advrtrs.lh_first;
2757 j = 0;
2758 while (pfr) {
2759 if (j < DRLSTSIZ) {
2760 #define RTRADDR prl_32->prefix[i].advrtr[j]
2761 RTRADDR = pfr->router->rtaddr;
2762 if (IN6_IS_ADDR_LINKLOCAL(&RTRADDR)) {
2763 /* XXX: hack for KAME */
2764 RTRADDR.s6_addr16[1] = 0;
2765 } else {
2766 log(LOG_ERR,
2767 "a router(%s) advertises "
2768 "a prefix with "
2769 "non-link local address\n",
2770 ip6_sprintf(&RTRADDR));
2771 }
2772 #undef RTRADDR
2773 }
2774 j++;
2775 pfr = pfr->pfr_next;
2776 }
2777 prl_32->prefix[i].advrtrs = j;
2778 prl_32->prefix[i].origin = PR_ORIG_RA;
2779 NDPR_UNLOCK(pr);
2780
2781 i++;
2782 pr = pr->ndpr_next;
2783 }
2784 bcopy(prl_32, data, sizeof (*prl_32));
2785 _FREE(prl_32, M_TEMP);
2786 return (0);
2787 }
2788
2789 int
2790 nd6_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp)
2791 {
2792 struct nd_defrouter *dr;
2793 struct nd_prefix *pr;
2794 struct rtentry *rt;
2795 int error = 0;
2796
2797 VERIFY(ifp != NULL);
2798
2799 switch (cmd) {
2800 case SIOCGDRLST_IN6_32: /* struct in6_drlist_32 */
2801 case SIOCGDRLST_IN6_64: /* struct in6_drlist_64 */
2802 /*
2803 * obsolete API, use sysctl under net.inet6.icmp6
2804 */
2805 lck_mtx_lock(nd6_mutex);
2806 error = nd6_siocgdrlst(data, cmd == SIOCGDRLST_IN6_64);
2807 lck_mtx_unlock(nd6_mutex);
2808 break;
2809
2810 case SIOCGPRLST_IN6_32: /* struct in6_prlist_32 */
2811 case SIOCGPRLST_IN6_64: /* struct in6_prlist_64 */
2812 /*
2813 * obsolete API, use sysctl under net.inet6.icmp6
2814 */
2815 lck_mtx_lock(nd6_mutex);
2816 error = nd6_siocgprlst(data, cmd == SIOCGPRLST_IN6_64);
2817 lck_mtx_unlock(nd6_mutex);
2818 break;
2819
2820 case OSIOCGIFINFO_IN6: /* struct in6_ondireq */
2821 case SIOCGIFINFO_IN6: { /* struct in6_ondireq */
2822 u_int32_t linkmtu;
2823 struct in6_ondireq *ondi = (struct in6_ondireq *)(void *)data;
2824 struct nd_ifinfo *ndi;
2825 /*
2826 * SIOCGIFINFO_IN6 ioctl is encoded with in6_ondireq
2827 * instead of in6_ndireq, so we treat it as such.
2828 */
2829 ndi = ND_IFINFO(ifp);
2830 if ((NULL == ndi) || (FALSE == ndi->initialized)){
2831 error = EINVAL;
2832 break;
2833 }
2834 lck_mtx_lock(&ndi->lock);
2835 linkmtu = IN6_LINKMTU(ifp);
2836 bcopy(&linkmtu, &ondi->ndi.linkmtu, sizeof (linkmtu));
2837 bcopy(&ndi->maxmtu, &ondi->ndi.maxmtu,
2838 sizeof (u_int32_t));
2839 bcopy(&ndi->basereachable, &ondi->ndi.basereachable,
2840 sizeof (u_int32_t));
2841 bcopy(&ndi->reachable, &ondi->ndi.reachable,
2842 sizeof (u_int32_t));
2843 bcopy(&ndi->retrans, &ondi->ndi.retrans,
2844 sizeof (u_int32_t));
2845 bcopy(&ndi->flags, &ondi->ndi.flags,
2846 sizeof (u_int32_t));
2847 bcopy(&ndi->recalctm, &ondi->ndi.recalctm,
2848 sizeof (int));
2849 ondi->ndi.chlim = ndi->chlim;
2850 ondi->ndi.receivedra = 0;
2851 lck_mtx_unlock(&ndi->lock);
2852 break;
2853 }
2854
2855 case SIOCSIFINFO_FLAGS: { /* struct in6_ndireq */
2856 /*
2857 * XXX BSD has a bunch of checks here to ensure
2858 * that interface disabled flag is not reset if
2859 * link local address has failed DAD.
2860 * Investigate that part.
2861 */
2862 struct in6_ndireq *cndi = (struct in6_ndireq *)(void *)data;
2863 u_int32_t oflags, flags;
2864 struct nd_ifinfo *ndi = ND_IFINFO(ifp);
2865
2866 /* XXX: almost all other fields of cndi->ndi is unused */
2867 if ((NULL == ndi) || !ndi->initialized) {
2868 error = EINVAL;
2869 break;
2870 }
2871
2872 lck_mtx_lock(&ndi->lock);
2873 oflags = ndi->flags;
2874 bcopy(&cndi->ndi.flags, &(ndi->flags), sizeof (flags));
2875 flags = ndi->flags;
2876 lck_mtx_unlock(&ndi->lock);
2877
2878 if (oflags == flags) {
2879 break;
2880 }
2881
2882 error = nd6_setifinfo(ifp, oflags, flags);
2883 break;
2884 }
2885
2886 case SIOCSNDFLUSH_IN6: /* struct in6_ifreq */
2887 /* flush default router list */
2888 /*
2889 * xxx sumikawa: should not delete route if default
2890 * route equals to the top of default router list
2891 */
2892 lck_mtx_lock(nd6_mutex);
2893 defrouter_reset();
2894 defrouter_select(ifp);
2895 lck_mtx_unlock(nd6_mutex);
2896 /* xxx sumikawa: flush prefix list */
2897 break;
2898
2899 case SIOCSPFXFLUSH_IN6: { /* struct in6_ifreq */
2900 /* flush all the prefix advertised by routers */
2901 struct nd_prefix *next = NULL;
2902
2903 lck_mtx_lock(nd6_mutex);
2904 for (pr = nd_prefix.lh_first; pr; pr = next) {
2905 struct in6_ifaddr *ia = NULL;
2906 bool iterate_pfxlist_again = false;
2907
2908 next = pr->ndpr_next;
2909
2910 NDPR_LOCK(pr);
2911 if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr)) {
2912 NDPR_UNLOCK(pr);
2913 continue; /* XXX */
2914 }
2915 if (ifp != lo_ifp && pr->ndpr_ifp != ifp) {
2916 NDPR_UNLOCK(pr);
2917 continue;
2918 }
2919 /* do we really have to remove addresses as well? */
2920 NDPR_ADDREF_LOCKED(pr);
2921 NDPR_UNLOCK(pr);
2922 lck_rw_lock_exclusive(&in6_ifaddr_rwlock);
2923 ia = in6_ifaddrs;
2924 while (ia != NULL) {
2925 IFA_LOCK(&ia->ia_ifa);
2926 if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0) {
2927 IFA_UNLOCK(&ia->ia_ifa);
2928 ia = ia->ia_next;
2929 continue;
2930 }
2931
2932 if (ia->ia6_ndpr == pr) {
2933 IFA_ADDREF_LOCKED(&ia->ia_ifa);
2934 IFA_UNLOCK(&ia->ia_ifa);
2935 lck_rw_done(&in6_ifaddr_rwlock);
2936 lck_mtx_unlock(nd6_mutex);
2937 in6_purgeaddr(&ia->ia_ifa);
2938 IFA_REMREF(&ia->ia_ifa);
2939 lck_mtx_lock(nd6_mutex);
2940 lck_rw_lock_exclusive(
2941 &in6_ifaddr_rwlock);
2942 /*
2943 * Purging the address caused
2944 * in6_ifaddr_rwlock to be
2945 * dropped and
2946 * reacquired; therefore search again
2947 * from the beginning of in6_ifaddrs.
2948 * The same applies for the prefix list.
2949 */
2950 ia = in6_ifaddrs;
2951 iterate_pfxlist_again = true;
2952 continue;
2953 }
2954 IFA_UNLOCK(&ia->ia_ifa);
2955 ia = ia->ia_next;
2956 }
2957 lck_rw_done(&in6_ifaddr_rwlock);
2958 NDPR_LOCK(pr);
2959 prelist_remove(pr);
2960 NDPR_UNLOCK(pr);
2961 pfxlist_onlink_check();
2962 NDPR_REMREF(pr);
2963 if (iterate_pfxlist_again) {
2964 next = nd_prefix.lh_first;
2965 }
2966 }
2967 lck_mtx_unlock(nd6_mutex);
2968 break;
2969 }
2970
2971 case SIOCSRTRFLUSH_IN6: { /* struct in6_ifreq */
2972 /* flush all the default routers */
2973 struct nd_defrouter *next;
2974 struct nd_drhead nd_defrouter_tmp;
2975
2976 TAILQ_INIT(&nd_defrouter_tmp);
2977 lck_mtx_lock(nd6_mutex);
2978 if ((dr = TAILQ_FIRST(&nd_defrouter)) != NULL) {
2979 /*
2980 * The first entry of the list may be stored in
2981 * the routing table, so we'll delete it later.
2982 */
2983 for (dr = TAILQ_NEXT(dr, dr_entry); dr; dr = next) {
2984 next = TAILQ_NEXT(dr, dr_entry);
2985 if (ifp == lo_ifp || dr->ifp == ifp) {
2986 /*
2987 * Remove the entry from default router list
2988 * and add it to the temp list.
2989 * nd_defrouter_tmp will be a local temporary
2990 * list as no one else can get the same
2991 * removed entry once it is removed from default
2992 * router list.
2993 * Remove the reference after calling defrtrlist_de
2994 */
2995 TAILQ_REMOVE(&nd_defrouter, dr, dr_entry);
2996 TAILQ_INSERT_TAIL(&nd_defrouter_tmp, dr, dr_entry);
2997 }
2998 }
2999
3000 dr = TAILQ_FIRST(&nd_defrouter);
3001 if (ifp == lo_ifp ||
3002 dr->ifp == ifp) {
3003 TAILQ_REMOVE(&nd_defrouter, dr, dr_entry);
3004 TAILQ_INSERT_TAIL(&nd_defrouter_tmp, dr, dr_entry);
3005 }
3006 }
3007
3008 /*
3009 * Keep the following separate from the above iteration of
3010 * nd_defrouter because it's not safe to call
3011 * defrtrlist_del while iterating global default
3012 * router list. Global list has to be traversed
3013 * while holding nd6_mutex throughout.
3014 *
3015 * The following call to defrtrlist_del should be
3016 * safe as we are iterating a local list of
3017 * default routers.
3018 */
3019 TAILQ_FOREACH_SAFE(dr, &nd_defrouter_tmp, dr_entry, next) {
3020 TAILQ_REMOVE(&nd_defrouter_tmp, dr, dr_entry);
3021 defrtrlist_del(dr);
3022 NDDR_REMREF(dr); /* remove list reference */
3023 }
3024 lck_mtx_unlock(nd6_mutex);
3025 break;
3026 }
3027
3028 case SIOCGNBRINFO_IN6_32: { /* struct in6_nbrinfo_32 */
3029 struct llinfo_nd6 *ln;
3030 struct in6_nbrinfo_32 nbi_32;
3031 struct in6_addr nb_addr; /* make local for safety */
3032
3033 bcopy(data, &nbi_32, sizeof (nbi_32));
3034 nb_addr = nbi_32.addr;
3035 /*
3036 * XXX: KAME specific hack for scoped addresses
3037 * XXXX: for other scopes than link-local?
3038 */
3039 if (IN6_IS_ADDR_LINKLOCAL(&nbi_32.addr) ||
3040 IN6_IS_ADDR_MC_LINKLOCAL(&nbi_32.addr)) {
3041 u_int16_t *idp =
3042 (u_int16_t *)(void *)&nb_addr.s6_addr[2];
3043
3044 if (*idp == 0)
3045 *idp = htons(ifp->if_index);
3046 }
3047
3048 /* Callee returns a locked route upon success */
3049 if ((rt = nd6_lookup(&nb_addr, 0, ifp, 0)) == NULL) {
3050 error = EINVAL;
3051 break;
3052 }
3053 RT_LOCK_ASSERT_HELD(rt);
3054 ln = rt->rt_llinfo;
3055 nbi_32.state = ln->ln_state;
3056 nbi_32.asked = ln->ln_asked;
3057 nbi_32.isrouter = ln->ln_router;
3058 nbi_32.expire = ln_getexpire(ln);
3059 RT_REMREF_LOCKED(rt);
3060 RT_UNLOCK(rt);
3061 bcopy(&nbi_32, data, sizeof (nbi_32));
3062 break;
3063 }
3064
3065 case SIOCGNBRINFO_IN6_64: { /* struct in6_nbrinfo_64 */
3066 struct llinfo_nd6 *ln;
3067 struct in6_nbrinfo_64 nbi_64;
3068 struct in6_addr nb_addr; /* make local for safety */
3069
3070 bcopy(data, &nbi_64, sizeof (nbi_64));
3071 nb_addr = nbi_64.addr;
3072 /*
3073 * XXX: KAME specific hack for scoped addresses
3074 * XXXX: for other scopes than link-local?
3075 */
3076 if (IN6_IS_ADDR_LINKLOCAL(&nbi_64.addr) ||
3077 IN6_IS_ADDR_MC_LINKLOCAL(&nbi_64.addr)) {
3078 u_int16_t *idp =
3079 (u_int16_t *)(void *)&nb_addr.s6_addr[2];
3080
3081 if (*idp == 0)
3082 *idp = htons(ifp->if_index);
3083 }
3084
3085 /* Callee returns a locked route upon success */
3086 if ((rt = nd6_lookup(&nb_addr, 0, ifp, 0)) == NULL) {
3087 error = EINVAL;
3088 break;
3089 }
3090 RT_LOCK_ASSERT_HELD(rt);
3091 ln = rt->rt_llinfo;
3092 nbi_64.state = ln->ln_state;
3093 nbi_64.asked = ln->ln_asked;
3094 nbi_64.isrouter = ln->ln_router;
3095 nbi_64.expire = ln_getexpire(ln);
3096 RT_REMREF_LOCKED(rt);
3097 RT_UNLOCK(rt);
3098 bcopy(&nbi_64, data, sizeof (nbi_64));
3099 break;
3100 }
3101
3102 case SIOCGDEFIFACE_IN6_32: /* struct in6_ndifreq_32 */
3103 case SIOCGDEFIFACE_IN6_64: { /* struct in6_ndifreq_64 */
3104 struct in6_ndifreq_64 *ndif_64 =
3105 (struct in6_ndifreq_64 *)(void *)data;
3106 struct in6_ndifreq_32 *ndif_32 =
3107 (struct in6_ndifreq_32 *)(void *)data;
3108
3109 if (cmd == SIOCGDEFIFACE_IN6_64) {
3110 u_int64_t j = nd6_defifindex;
3111 bcopy(&j, &ndif_64->ifindex, sizeof (j));
3112 } else {
3113 bcopy(&nd6_defifindex, &ndif_32->ifindex,
3114 sizeof (u_int32_t));
3115 }
3116 break;
3117 }
3118
3119 case SIOCSDEFIFACE_IN6_32: /* struct in6_ndifreq_32 */
3120 case SIOCSDEFIFACE_IN6_64: { /* struct in6_ndifreq_64 */
3121 struct in6_ndifreq_64 *ndif_64 =
3122 (struct in6_ndifreq_64 *)(void *)data;
3123 struct in6_ndifreq_32 *ndif_32 =
3124 (struct in6_ndifreq_32 *)(void *)data;
3125 u_int32_t idx;
3126
3127 if (cmd == SIOCSDEFIFACE_IN6_64) {
3128 u_int64_t j;
3129 bcopy(&ndif_64->ifindex, &j, sizeof (j));
3130 idx = (u_int32_t)j;
3131 } else {
3132 bcopy(&ndif_32->ifindex, &idx, sizeof (idx));
3133 }
3134
3135 error = nd6_setdefaultiface(idx);
3136 return (error);
3137 /* NOTREACHED */
3138 }
3139 case SIOCGIFCGAPREP_IN6:
3140 case SIOCSIFCGAPREP_IN6:
3141 {
3142 struct in6_cgareq *p_cgareq =
3143 (struct in6_cgareq *)(void *)data;
3144 struct nd_ifinfo *ndi = ND_IFINFO(ifp);
3145
3146 struct in6_cga_modifier *req_cga_mod =
3147 &(p_cgareq->cgar_cgaprep.cga_modifier);
3148 struct in6_cga_modifier *ndi_cga_mod = NULL;
3149
3150 if ((NULL == ndi) || !ndi->initialized) {
3151 error = EINVAL;
3152 break;
3153 }
3154
3155 lck_mtx_lock(&ndi->lock);
3156 ndi_cga_mod = &(ndi->local_cga_modifier);
3157
3158 if (cmd == SIOCSIFCGAPREP_IN6) {
3159 bcopy(req_cga_mod, ndi_cga_mod, sizeof(*ndi_cga_mod));
3160 ndi->cga_initialized = TRUE;
3161 } else
3162 bcopy(ndi_cga_mod, req_cga_mod, sizeof(*req_cga_mod));
3163
3164 lck_mtx_unlock(&ndi->lock);
3165 return (error);
3166 /* NOTREACHED */
3167 }
3168 }
3169 return (error);
3170 }
3171
3172 /*
3173 * Create neighbor cache entry and cache link-layer address,
3174 * on reception of inbound ND6 packets. (RS/RA/NS/redirect)
3175 */
3176 void
3177 nd6_cache_lladdr(struct ifnet *ifp, struct in6_addr *from, char *lladdr,
3178 int lladdrlen, int type, int code)
3179 {
3180 #pragma unused(lladdrlen)
3181 struct rtentry *rt = NULL;
3182 struct llinfo_nd6 *ln = NULL;
3183 int is_newentry;
3184 struct sockaddr_dl *sdl = NULL;
3185 int do_update;
3186 int olladdr;
3187 int llchange;
3188 int newstate = 0;
3189 uint64_t timenow;
3190 boolean_t sched_timeout = FALSE;
3191 struct nd_ifinfo *ndi = NULL;
3192
3193 if (ifp == NULL)
3194 panic("ifp == NULL in nd6_cache_lladdr");
3195 if (from == NULL)
3196 panic("from == NULL in nd6_cache_lladdr");
3197
3198 /* nothing must be updated for unspecified address */
3199 if (IN6_IS_ADDR_UNSPECIFIED(from))
3200 return;
3201
3202 /*
3203 * Validation about ifp->if_addrlen and lladdrlen must be done in
3204 * the caller.
3205 */
3206 timenow = net_uptime();
3207
3208 rt = nd6_lookup(from, 0, ifp, 0);
3209 if (rt == NULL) {
3210 if ((rt = nd6_lookup(from, 1, ifp, 0)) == NULL)
3211 return;
3212 RT_LOCK_ASSERT_HELD(rt);
3213 is_newentry = 1;
3214 } else {
3215 RT_LOCK_ASSERT_HELD(rt);
3216 /* do nothing if static ndp is set */
3217 if (rt->rt_flags & RTF_STATIC) {
3218 RT_REMREF_LOCKED(rt);
3219 RT_UNLOCK(rt);
3220 return;
3221 }
3222 is_newentry = 0;
3223 }
3224
3225 if (rt == NULL)
3226 return;
3227 if ((rt->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) != RTF_LLINFO) {
3228 fail:
3229 RT_UNLOCK(rt);
3230 nd6_free(rt);
3231 rtfree(rt);
3232 return;
3233 }
3234 ln = (struct llinfo_nd6 *)rt->rt_llinfo;
3235 if (ln == NULL)
3236 goto fail;
3237 if (rt->rt_gateway == NULL)
3238 goto fail;
3239 if (rt->rt_gateway->sa_family != AF_LINK)
3240 goto fail;
3241 sdl = SDL(rt->rt_gateway);
3242
3243 olladdr = (sdl->sdl_alen) ? 1 : 0;
3244 if (olladdr && lladdr) {
3245 if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen))
3246 llchange = 1;
3247 else
3248 llchange = 0;
3249 } else
3250 llchange = 0;
3251
3252 /*
3253 * newentry olladdr lladdr llchange (*=record)
3254 * 0 n n -- (1)
3255 * 0 y n -- (2)
3256 * 0 n y -- (3) * STALE
3257 * 0 y y n (4) *
3258 * 0 y y y (5) * STALE
3259 * 1 -- n -- (6) NOSTATE(= PASSIVE)
3260 * 1 -- y -- (7) * STALE
3261 */
3262
3263 if (lladdr != NULL) { /* (3-5) and (7) */
3264 /*
3265 * Record source link-layer address
3266 * XXX is it dependent to ifp->if_type?
3267 */
3268 sdl->sdl_alen = ifp->if_addrlen;
3269 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
3270
3271 /* cache the gateway (sender HW) address */
3272 nd6_llreach_alloc(rt, ifp, LLADDR(sdl), sdl->sdl_alen, FALSE);
3273 }
3274
3275 if (is_newentry == 0) {
3276 if ((!olladdr && lladdr != NULL) || /* (3) */
3277 (olladdr && lladdr != NULL && llchange)) { /* (5) */
3278 do_update = 1;
3279 newstate = ND6_LLINFO_STALE;
3280 } else /* (1-2,4) */
3281 do_update = 0;
3282 } else {
3283 do_update = 1;
3284 if (lladdr == NULL) /* (6) */
3285 newstate = ND6_LLINFO_NOSTATE;
3286 else /* (7) */
3287 newstate = ND6_LLINFO_STALE;
3288 }
3289
3290 /*
3291 * For interface's that do not perform NUD
3292 * neighbor cache entres must always be marked
3293 * reachable with no expiry
3294 */
3295 ndi = ND_IFINFO(ifp);
3296 VERIFY((NULL != ndi) && (TRUE == ndi->initialized));
3297
3298 if (ndi && !(ndi->flags & ND6_IFF_PERFORMNUD)) {
3299 newstate = ND6_LLINFO_REACHABLE;
3300 ln_setexpire(ln, 0);
3301 }
3302
3303 if (do_update) {
3304 /*
3305 * Update the state of the neighbor cache.
3306 */
3307 ND6_CACHE_STATE_TRANSITION(ln, newstate);
3308
3309 if ((ln->ln_state == ND6_LLINFO_STALE) ||
3310 (ln->ln_state == ND6_LLINFO_REACHABLE)) {
3311 struct mbuf *m = ln->ln_hold;
3312 /*
3313 * XXX: since nd6_output() below will cause
3314 * state tansition to DELAY and reset the timer,
3315 * we must set the timer now, although it is actually
3316 * meaningless.
3317 */
3318 if (ln->ln_state == ND6_LLINFO_STALE)
3319 ln_setexpire(ln, timenow + nd6_gctimer);
3320
3321 ln->ln_hold = NULL;
3322 if (m != NULL) {
3323 struct sockaddr_in6 sin6;
3324
3325 rtkey_to_sa6(rt, &sin6);
3326 /*
3327 * we assume ifp is not a p2p here, so just
3328 * set the 2nd argument as the 1st one.
3329 */
3330 RT_UNLOCK(rt);
3331 nd6_output_list(ifp, ifp, m, &sin6, rt, NULL);
3332 RT_LOCK(rt);
3333 }
3334 } else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
3335 /* probe right away */
3336 ln_setexpire(ln, timenow);
3337 sched_timeout = TRUE;
3338 }
3339 }
3340
3341 /*
3342 * ICMP6 type dependent behavior.
3343 *
3344 * NS: clear IsRouter if new entry
3345 * RS: clear IsRouter
3346 * RA: set IsRouter if there's lladdr
3347 * redir: clear IsRouter if new entry
3348 *
3349 * RA case, (1):
3350 * The spec says that we must set IsRouter in the following cases:
3351 * - If lladdr exist, set IsRouter. This means (1-5).
3352 * - If it is old entry (!newentry), set IsRouter. This means (7).
3353 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
3354 * A quetion arises for (1) case. (1) case has no lladdr in the
3355 * neighbor cache, this is similar to (6).
3356 * This case is rare but we figured that we MUST NOT set IsRouter.
3357 *
3358 * newentry olladdr lladdr llchange NS RS RA redir
3359 * D R
3360 * 0 n n -- (1) c ? s
3361 * 0 y n -- (2) c s s
3362 * 0 n y -- (3) c s s
3363 * 0 y y n (4) c s s
3364 * 0 y y y (5) c s s
3365 * 1 -- n -- (6) c c c s
3366 * 1 -- y -- (7) c c s c s
3367 *
3368 * (c=clear s=set)
3369 */
3370 switch (type & 0xff) {
3371 case ND_NEIGHBOR_SOLICIT:
3372 /*
3373 * New entry must have is_router flag cleared.
3374 */
3375 if (is_newentry) /* (6-7) */
3376 ln->ln_router = 0;
3377 break;
3378 case ND_REDIRECT:
3379 /*
3380 * If the ICMP message is a Redirect to a better router, always
3381 * set the is_router flag. Otherwise, if the entry is newly
3382 * created, then clear the flag. [RFC 4861, sec 8.3]
3383 */
3384 if (code == ND_REDIRECT_ROUTER)
3385 ln->ln_router = 1;
3386 else if (is_newentry) /* (6-7) */
3387 ln->ln_router = 0;
3388 break;
3389 case ND_ROUTER_SOLICIT:
3390 /*
3391 * is_router flag must always be cleared.
3392 */
3393 ln->ln_router = 0;
3394 break;
3395 case ND_ROUTER_ADVERT:
3396 /*
3397 * Mark an entry with lladdr as a router.
3398 */
3399 if ((!is_newentry && (olladdr || lladdr)) || /* (2-5) */
3400 (is_newentry && lladdr)) { /* (7) */
3401 ln->ln_router = 1;
3402 }
3403 break;
3404 }
3405
3406 if (do_update) {
3407 int route_ev_code = 0;
3408
3409 if (llchange)
3410 route_ev_code = ROUTE_LLENTRY_CHANGED;
3411 else
3412 route_ev_code = ROUTE_LLENTRY_RESOLVED;
3413
3414 /* Enqueue work item to invoke callback for this route entry */
3415 route_event_enqueue_nwk_wq_entry(rt, NULL, route_ev_code, NULL, TRUE);
3416
3417 if (ln->ln_router || (rt->rt_flags & RTF_ROUTER)) {
3418 struct radix_node_head *rnh = NULL;
3419 struct route_event rt_ev;
3420 route_event_init(&rt_ev, rt, NULL, llchange ? ROUTE_LLENTRY_CHANGED :
3421 ROUTE_LLENTRY_RESOLVED);
3422 /*
3423 * We already have a valid reference on rt.
3424 * The function frees that before returning.
3425 * We therefore don't need an extra reference here
3426 */
3427 RT_UNLOCK(rt);
3428 lck_mtx_lock(rnh_lock);
3429
3430 rnh = rt_tables[AF_INET6];
3431 if (rnh != NULL)
3432 (void) rnh->rnh_walktree(rnh, route_event_walktree,
3433 (void *)&rt_ev);
3434 lck_mtx_unlock(rnh_lock);
3435 RT_LOCK(rt);
3436 }
3437 }
3438
3439 /*
3440 * When the link-layer address of a router changes, select the
3441 * best router again. In particular, when the neighbor entry is newly
3442 * created, it might affect the selection policy.
3443 * Question: can we restrict the first condition to the "is_newentry"
3444 * case?
3445 *
3446 * Note: Perform default router selection even when we are a router,
3447 * if Scoped Routing is enabled.
3448 */
3449 if (do_update && ln->ln_router) {
3450 RT_REMREF_LOCKED(rt);
3451 RT_UNLOCK(rt);
3452 lck_mtx_lock(nd6_mutex);
3453 defrouter_select(ifp);
3454 lck_mtx_unlock(nd6_mutex);
3455 } else {
3456 RT_REMREF_LOCKED(rt);
3457 RT_UNLOCK(rt);
3458 }
3459 if (sched_timeout) {
3460 lck_mtx_lock(rnh_lock);
3461 nd6_sched_timeout(NULL, NULL);
3462 lck_mtx_unlock(rnh_lock);
3463 }
3464 }
3465
3466 static void
3467 nd6_slowtimo(void *arg)
3468 {
3469 #pragma unused(arg)
3470 struct nd_ifinfo *nd6if = NULL;
3471 struct ifnet *ifp = NULL;
3472
3473 ifnet_head_lock_shared();
3474 for (ifp = ifnet_head.tqh_first; ifp;
3475 ifp = ifp->if_link.tqe_next) {
3476 nd6if = ND_IFINFO(ifp);
3477 if ((NULL == nd6if) || (FALSE == nd6if->initialized)) {
3478 continue;
3479 }
3480
3481 lck_mtx_lock(&nd6if->lock);
3482 if (nd6if->basereachable && /* already initialized */
3483 (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
3484 /*
3485 * Since reachable time rarely changes by router
3486 * advertisements, we SHOULD insure that a new random
3487 * value gets recomputed at least once every few hours.
3488 * (RFC 4861, 6.3.4)
3489 */
3490 nd6if->recalctm = nd6_recalc_reachtm_interval;
3491 nd6if->reachable =
3492 ND_COMPUTE_RTIME(nd6if->basereachable);
3493 }
3494 lck_mtx_unlock(&nd6if->lock);
3495 }
3496 ifnet_head_done();
3497 timeout(nd6_slowtimo, NULL, ND6_SLOWTIMER_INTERVAL * hz);
3498 }
3499
3500 int
3501 nd6_output(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
3502 struct sockaddr_in6 *dst, struct rtentry *hint0, struct flowadv *adv)
3503 {
3504 return nd6_output_list(ifp, origifp, m0, dst, hint0, adv);
3505 }
3506
3507 /*
3508 * nd6_output_list()
3509 *
3510 * Assumption: route determination for first packet can be correctly applied to
3511 * all packets in the chain.
3512 */
3513 #define senderr(e) { error = (e); goto bad; }
3514 int
3515 nd6_output_list(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
3516 struct sockaddr_in6 *dst, struct rtentry *hint0, struct flowadv *adv)
3517 {
3518 struct rtentry *rt = hint0, *hint = hint0;
3519 struct llinfo_nd6 *ln = NULL;
3520 int error = 0;
3521 uint64_t timenow;
3522 struct rtentry *rtrele = NULL;
3523 struct nd_ifinfo *ndi = NULL;
3524
3525 if (rt != NULL) {
3526 RT_LOCK_SPIN(rt);
3527 RT_ADDREF_LOCKED(rt);
3528 }
3529
3530 if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr) || !nd6_need_cache(ifp)) {
3531 if (rt != NULL)
3532 RT_UNLOCK(rt);
3533 goto sendpkt;
3534 }
3535
3536 /*
3537 * Next hop determination. Because we may involve the gateway route
3538 * in addition to the original route, locking is rather complicated.
3539 * The general concept is that regardless of whether the route points
3540 * to the original route or to the gateway route, this routine takes
3541 * an extra reference on such a route. This extra reference will be
3542 * released at the end.
3543 *
3544 * Care must be taken to ensure that the "hint0" route never gets freed
3545 * via rtfree(), since the caller may have stored it inside a struct
3546 * route with a reference held for that placeholder.
3547 *
3548 * This logic is similar to, though not exactly the same as the one
3549 * used by route_to_gwroute().
3550 */
3551 if (rt != NULL) {
3552 /*
3553 * We have a reference to "rt" by now (or below via rtalloc1),
3554 * which will either be released or freed at the end of this
3555 * routine.
3556 */
3557 RT_LOCK_ASSERT_HELD(rt);
3558 if (!(rt->rt_flags & RTF_UP)) {
3559 RT_REMREF_LOCKED(rt);
3560 RT_UNLOCK(rt);
3561 if ((hint = rt = rtalloc1_scoped(SA(dst), 1, 0,
3562 ifp->if_index)) != NULL) {
3563 RT_LOCK_SPIN(rt);
3564 if (rt->rt_ifp != ifp) {
3565 /* XXX: loop care? */
3566 RT_UNLOCK(rt);
3567 error = nd6_output_list(ifp, origifp, m0,
3568 dst, rt, adv);
3569 rtfree(rt);
3570 return (error);
3571 }
3572 } else {
3573 senderr(EHOSTUNREACH);
3574 }
3575 }
3576
3577 if (rt->rt_flags & RTF_GATEWAY) {
3578 struct rtentry *gwrt;
3579 struct in6_ifaddr *ia6 = NULL;
3580 struct sockaddr_in6 gw6;
3581
3582 rtgw_to_sa6(rt, &gw6);
3583 /*
3584 * Must drop rt_lock since nd6_is_addr_neighbor()
3585 * calls nd6_lookup() and acquires rnh_lock.
3586 */
3587 RT_UNLOCK(rt);
3588
3589 /*
3590 * We skip link-layer address resolution and NUD
3591 * if the gateway is not a neighbor from ND point
3592 * of view, regardless of the value of nd_ifinfo.flags.
3593 * The second condition is a bit tricky; we skip
3594 * if the gateway is our own address, which is
3595 * sometimes used to install a route to a p2p link.
3596 */
3597 if (!nd6_is_addr_neighbor(&gw6, ifp, 0) ||
3598 (ia6 = in6ifa_ifpwithaddr(ifp, &gw6.sin6_addr))) {
3599 /*
3600 * We allow this kind of tricky route only
3601 * when the outgoing interface is p2p.
3602 * XXX: we may need a more generic rule here.
3603 */
3604 if (ia6 != NULL)
3605 IFA_REMREF(&ia6->ia_ifa);
3606 if ((ifp->if_flags & IFF_POINTOPOINT) == 0)
3607 senderr(EHOSTUNREACH);
3608 goto sendpkt;
3609 }
3610
3611 RT_LOCK_SPIN(rt);
3612 gw6 = *(SIN6(rt->rt_gateway));
3613
3614 /* If hint is now down, give up */
3615 if (!(rt->rt_flags & RTF_UP)) {
3616 RT_UNLOCK(rt);
3617 senderr(EHOSTUNREACH);
3618 }
3619
3620 /* If there's no gateway route, look it up */
3621 if ((gwrt = rt->rt_gwroute) == NULL) {
3622 RT_UNLOCK(rt);
3623 goto lookup;
3624 }
3625 /* Become a regular mutex */
3626 RT_CONVERT_LOCK(rt);
3627
3628 /*
3629 * Take gwrt's lock while holding route's lock;
3630 * this is okay since gwrt never points back
3631 * to rt, so no lock ordering issues.
3632 */
3633 RT_LOCK_SPIN(gwrt);
3634 if (!(gwrt->rt_flags & RTF_UP)) {
3635 rt->rt_gwroute = NULL;
3636 RT_UNLOCK(gwrt);
3637 RT_UNLOCK(rt);
3638 rtfree(gwrt);
3639 lookup:
3640 lck_mtx_lock(rnh_lock);
3641 gwrt = rtalloc1_scoped_locked(SA(&gw6), 1, 0,
3642 ifp->if_index);
3643
3644 RT_LOCK(rt);
3645 /*
3646 * Bail out if the route is down, no route
3647 * to gateway, circular route, or if the
3648 * gateway portion of "rt" has changed.
3649 */
3650 if (!(rt->rt_flags & RTF_UP) ||
3651 gwrt == NULL || gwrt == rt ||
3652 !equal(SA(&gw6), rt->rt_gateway)) {
3653 if (gwrt == rt) {
3654 RT_REMREF_LOCKED(gwrt);
3655 gwrt = NULL;
3656 }
3657 RT_UNLOCK(rt);
3658 if (gwrt != NULL)
3659 rtfree_locked(gwrt);
3660 lck_mtx_unlock(rnh_lock);
3661 senderr(EHOSTUNREACH);
3662 }
3663 VERIFY(gwrt != NULL);
3664 /*
3665 * Set gateway route; callee adds ref to gwrt;
3666 * gwrt has an extra ref from rtalloc1() for
3667 * this routine.
3668 */
3669 rt_set_gwroute(rt, rt_key(rt), gwrt);
3670 RT_UNLOCK(rt);
3671 lck_mtx_unlock(rnh_lock);
3672 /* Remember to release/free "rt" at the end */
3673 rtrele = rt;
3674 rt = gwrt;
3675 } else {
3676 RT_ADDREF_LOCKED(gwrt);
3677 RT_UNLOCK(gwrt);
3678 RT_UNLOCK(rt);
3679 /* Remember to release/free "rt" at the end */
3680 rtrele = rt;
3681 rt = gwrt;
3682 }
3683 VERIFY(rt == gwrt);
3684
3685 /*
3686 * This is an opportunity to revalidate the parent
3687 * route's gwroute, in case it now points to a dead
3688 * route entry. Parent route won't go away since the
3689 * clone (hint) holds a reference to it. rt == gwrt.
3690 */
3691 RT_LOCK_SPIN(hint);
3692 if ((hint->rt_flags & (RTF_WASCLONED | RTF_UP)) ==
3693 (RTF_WASCLONED | RTF_UP)) {
3694 struct rtentry *prt = hint->rt_parent;
3695 VERIFY(prt != NULL);
3696
3697 RT_CONVERT_LOCK(hint);
3698 RT_ADDREF(prt);
3699 RT_UNLOCK(hint);
3700 rt_revalidate_gwroute(prt, rt);
3701 RT_REMREF(prt);
3702 } else {
3703 RT_UNLOCK(hint);
3704 }
3705
3706 RT_LOCK_SPIN(rt);
3707 /* rt == gwrt; if it is now down, give up */
3708 if (!(rt->rt_flags & RTF_UP)) {
3709 RT_UNLOCK(rt);
3710 rtfree(rt);
3711 rt = NULL;
3712 /* "rtrele" == original "rt" */
3713 senderr(EHOSTUNREACH);
3714 }
3715 }
3716
3717 /* Become a regular mutex */
3718 RT_CONVERT_LOCK(rt);
3719 }
3720
3721 /*
3722 * Address resolution or Neighbor Unreachability Detection
3723 * for the next hop.
3724 * At this point, the destination of the packet must be a unicast
3725 * or an anycast address(i.e. not a multicast).
3726 */
3727
3728 /* Look up the neighbor cache for the nexthop */
3729 if (rt && (rt->rt_flags & RTF_LLINFO) != 0) {
3730 ln = rt->rt_llinfo;
3731 } else {
3732 struct sockaddr_in6 sin6;
3733 /*
3734 * Clear out Scope ID field in case it is set.
3735 */
3736 sin6 = *dst;
3737 sin6.sin6_scope_id = 0;
3738 /*
3739 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
3740 * the condition below is not very efficient. But we believe
3741 * it is tolerable, because this should be a rare case.
3742 * Must drop rt_lock since nd6_is_addr_neighbor() calls
3743 * nd6_lookup() and acquires rnh_lock.
3744 */
3745 if (rt != NULL)
3746 RT_UNLOCK(rt);
3747 if (nd6_is_addr_neighbor(&sin6, ifp, 0)) {
3748 /* "rtrele" may have been used, so clean up "rt" now */
3749 if (rt != NULL) {
3750 /* Don't free "hint0" */
3751 if (rt == hint0)
3752 RT_REMREF(rt);
3753 else
3754 rtfree(rt);
3755 }
3756 /* Callee returns a locked route upon success */
3757 rt = nd6_lookup(&dst->sin6_addr, 1, ifp, 0);
3758 if (rt != NULL) {
3759 RT_LOCK_ASSERT_HELD(rt);
3760 ln = rt->rt_llinfo;
3761 }
3762 } else if (rt != NULL) {
3763 RT_LOCK(rt);
3764 }
3765 }
3766
3767 if (!ln || !rt) {
3768 if (rt != NULL) {
3769 RT_UNLOCK(rt);
3770 }
3771 ndi = ND_IFINFO(ifp);
3772 VERIFY(ndi != NULL && ndi->initialized);
3773 lck_mtx_lock(&ndi->lock);
3774 if ((ifp->if_flags & IFF_POINTOPOINT) == 0 &&
3775 !(ndi->flags & ND6_IFF_PERFORMNUD)) {
3776 lck_mtx_unlock(&ndi->lock);
3777 log(LOG_DEBUG,
3778 "nd6_output: can't allocate llinfo for %s "
3779 "(ln=0x%llx, rt=0x%llx)\n",
3780 ip6_sprintf(&dst->sin6_addr),
3781 (uint64_t)VM_KERNEL_ADDRPERM(ln),
3782 (uint64_t)VM_KERNEL_ADDRPERM(rt));
3783 senderr(EIO); /* XXX: good error? */
3784 }
3785 lck_mtx_unlock(&ndi->lock);
3786
3787 goto sendpkt; /* send anyway */
3788 }
3789
3790 net_update_uptime();
3791 timenow = net_uptime();
3792
3793 /* We don't have to do link-layer address resolution on a p2p link. */
3794 if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
3795 ln->ln_state < ND6_LLINFO_REACHABLE) {
3796 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_STALE);
3797 ln_setexpire(ln, timenow + nd6_gctimer);
3798 }
3799
3800 /*
3801 * The first time we send a packet to a neighbor whose entry is
3802 * STALE, we have to change the state to DELAY and a sets a timer to
3803 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
3804 * neighbor unreachability detection on expiration.
3805 * (RFC 4861 7.3.3)
3806 */
3807 if (ln->ln_state == ND6_LLINFO_STALE) {
3808 ln->ln_asked = 0;
3809 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_DELAY);
3810 ln_setexpire(ln, timenow + nd6_delay);
3811 /* N.B.: we will re-arm the timer below. */
3812 _CASSERT(ND6_LLINFO_DELAY > ND6_LLINFO_INCOMPLETE);
3813 }
3814
3815 /*
3816 * If the neighbor cache entry has a state other than INCOMPLETE
3817 * (i.e. its link-layer address is already resolved), just
3818 * send the packet.
3819 */
3820 if (ln->ln_state > ND6_LLINFO_INCOMPLETE) {
3821 RT_UNLOCK(rt);
3822 /*
3823 * Move this entry to the head of the queue so that it is
3824 * less likely for this entry to be a target of forced
3825 * garbage collection (see nd6_rtrequest()). Do this only
3826 * if the entry is non-permanent (as permanent ones will
3827 * never be purged), and if the number of active entries
3828 * is at least half of the threshold.
3829 */
3830 if (ln->ln_state == ND6_LLINFO_DELAY ||
3831 (ln->ln_expire != 0 && ip6_neighborgcthresh > 0 &&
3832 nd6_inuse >= (ip6_neighborgcthresh >> 1))) {
3833 lck_mtx_lock(rnh_lock);
3834 if (ln->ln_state == ND6_LLINFO_DELAY)
3835 nd6_sched_timeout(NULL, NULL);
3836 if (ln->ln_expire != 0 && ip6_neighborgcthresh > 0 &&
3837 nd6_inuse >= (ip6_neighborgcthresh >> 1)) {
3838 RT_LOCK_SPIN(rt);
3839 if (ln->ln_flags & ND6_LNF_IN_USE) {
3840 LN_DEQUEUE(ln);
3841 LN_INSERTHEAD(ln);
3842 }
3843 RT_UNLOCK(rt);
3844 }
3845 lck_mtx_unlock(rnh_lock);
3846 }
3847 goto sendpkt;
3848 }
3849
3850 /*
3851 * If this is a prefix proxy route, record the inbound interface
3852 * so that it can be excluded from the list of interfaces eligible
3853 * for forwarding the proxied NS in nd6_prproxy_ns_output().
3854 */
3855 if (rt->rt_flags & RTF_PROXY)
3856 ln->ln_exclifp = ((origifp == ifp) ? NULL : origifp);
3857
3858 /*
3859 * There is a neighbor cache entry, but no ethernet address
3860 * response yet. Replace the held mbuf (if any) with this
3861 * latest one.
3862 *
3863 * This code conforms to the rate-limiting rule described in Section
3864 * 7.2.2 of RFC 4861, because the timer is set correctly after sending
3865 * an NS below.
3866 */
3867 if (ln->ln_state == ND6_LLINFO_NOSTATE)
3868 ND6_CACHE_STATE_TRANSITION(ln, ND6_LLINFO_INCOMPLETE);
3869 if (ln->ln_hold)
3870 m_freem_list(ln->ln_hold);
3871 ln->ln_hold = m0;
3872 if (!ND6_LLINFO_PERMANENT(ln) && ln->ln_asked == 0) {
3873 ln->ln_asked++;
3874 ndi = ND_IFINFO(ifp);
3875 VERIFY(ndi != NULL && ndi->initialized);
3876 lck_mtx_lock(&ndi->lock);
3877 ln_setexpire(ln, timenow + ndi->retrans / 1000);
3878 lck_mtx_unlock(&ndi->lock);
3879 RT_UNLOCK(rt);
3880 /* We still have a reference on rt (for ln) */
3881 if (ip6_forwarding)
3882 nd6_prproxy_ns_output(ifp, origifp, NULL,
3883 &dst->sin6_addr, ln);
3884 else
3885 nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, NULL);
3886 lck_mtx_lock(rnh_lock);
3887 nd6_sched_timeout(NULL, NULL);
3888 lck_mtx_unlock(rnh_lock);
3889 } else {
3890 RT_UNLOCK(rt);
3891 }
3892 /*
3893 * Move this entry to the head of the queue so that it is
3894 * less likely for this entry to be a target of forced
3895 * garbage collection (see nd6_rtrequest()). Do this only
3896 * if the entry is non-permanent (as permanent ones will
3897 * never be purged), and if the number of active entries
3898 * is at least half of the threshold.
3899 */
3900 if (ln->ln_expire != 0 && ip6_neighborgcthresh > 0 &&
3901 nd6_inuse >= (ip6_neighborgcthresh >> 1)) {
3902 lck_mtx_lock(rnh_lock);
3903 RT_LOCK_SPIN(rt);
3904 if (ln->ln_flags & ND6_LNF_IN_USE) {
3905 LN_DEQUEUE(ln);
3906 LN_INSERTHEAD(ln);
3907 }
3908 /* Clean up "rt" now while we can */
3909 if (rt == hint0) {
3910 RT_REMREF_LOCKED(rt);
3911 RT_UNLOCK(rt);
3912 } else {
3913 RT_UNLOCK(rt);
3914 rtfree_locked(rt);
3915 }
3916 rt = NULL; /* "rt" has been taken care of */
3917 lck_mtx_unlock(rnh_lock);
3918 }
3919 error = 0;
3920 goto release;
3921
3922 sendpkt:
3923 if (rt != NULL)
3924 RT_LOCK_ASSERT_NOTHELD(rt);
3925
3926 /* discard the packet if IPv6 operation is disabled on the interface */
3927 if (ifp->if_eflags & IFEF_IPV6_DISABLED) {
3928 error = ENETDOWN; /* better error? */
3929 goto bad;
3930 }
3931
3932 if (ifp->if_flags & IFF_LOOPBACK) {
3933 /* forwarding rules require the original scope_id */
3934 m0->m_pkthdr.rcvif = origifp;
3935 error = dlil_output(origifp, PF_INET6, m0, (caddr_t)rt,
3936 SA(dst), 0, adv);
3937 goto release;
3938 } else {
3939 /* Do not allow loopback address to wind up on a wire */
3940 struct ip6_hdr *ip6 = mtod(m0, struct ip6_hdr *);
3941
3942 if ((IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) ||
3943 IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst))) {
3944 ip6stat.ip6s_badscope++;
3945 error = EADDRNOTAVAIL;
3946 goto bad;
3947 }
3948 }
3949
3950 if (rt != NULL) {
3951 RT_LOCK_SPIN(rt);
3952 /* Mark use timestamp */
3953 if (rt->rt_llinfo != NULL)
3954 nd6_llreach_use(rt->rt_llinfo);
3955 RT_UNLOCK(rt);
3956 }
3957
3958 struct mbuf *mcur = m0;
3959 uint32_t pktcnt = 0;
3960
3961 while (mcur) {
3962 if (hint != NULL && nstat_collect) {
3963 int scnt;
3964
3965 if ((mcur->m_pkthdr.csum_flags & CSUM_TSO_IPV6) &&
3966 (mcur->m_pkthdr.tso_segsz > 0))
3967 scnt = mcur->m_pkthdr.len / mcur->m_pkthdr.tso_segsz;
3968 else
3969 scnt = 1;
3970
3971 nstat_route_tx(hint, scnt, mcur->m_pkthdr.len, 0);
3972 }
3973 pktcnt++;
3974
3975 mcur->m_pkthdr.rcvif = NULL;
3976 mcur = mcur->m_nextpkt;
3977 }
3978 if (pktcnt > ip6_maxchainsent)
3979 ip6_maxchainsent = pktcnt;
3980 error = dlil_output(ifp, PF_INET6, m0, (caddr_t)rt, SA(dst), 0, adv);
3981 goto release;
3982
3983 bad:
3984 if (m0 != NULL)
3985 m_freem_list(m0);
3986
3987 release:
3988 /* Clean up "rt" unless it's already been done */
3989 if (rt != NULL) {
3990 RT_LOCK_SPIN(rt);
3991 if (rt == hint0) {
3992 RT_REMREF_LOCKED(rt);
3993 RT_UNLOCK(rt);
3994 } else {
3995 RT_UNLOCK(rt);
3996 rtfree(rt);
3997 }
3998 }
3999 /* And now clean up "rtrele" if there is any */
4000 if (rtrele != NULL) {
4001 RT_LOCK_SPIN(rtrele);
4002 if (rtrele == hint0) {
4003 RT_REMREF_LOCKED(rtrele);
4004 RT_UNLOCK(rtrele);
4005 } else {
4006 RT_UNLOCK(rtrele);
4007 rtfree(rtrele);
4008 }
4009 }
4010 return (error);
4011 }
4012 #undef senderr
4013
4014 int
4015 nd6_need_cache(struct ifnet *ifp)
4016 {
4017 /*
4018 * XXX: we currently do not make neighbor cache on any interface
4019 * other than ARCnet, Ethernet, FDDI and GIF.
4020 *
4021 * RFC2893 says:
4022 * - unidirectional tunnels needs no ND
4023 */
4024 switch (ifp->if_type) {
4025 case IFT_ARCNET:
4026 case IFT_ETHER:
4027 case IFT_FDDI:
4028 case IFT_IEEE1394:
4029 case IFT_L2VLAN:
4030 case IFT_IEEE8023ADLAG:
4031 #if IFT_IEEE80211
4032 case IFT_IEEE80211:
4033 #endif
4034 case IFT_GIF: /* XXX need more cases? */
4035 case IFT_PPP:
4036 #if IFT_TUNNEL
4037 case IFT_TUNNEL:
4038 #endif
4039 case IFT_BRIDGE:
4040 case IFT_CELLULAR:
4041 return (1);
4042 default:
4043 return (0);
4044 }
4045 }
4046
4047 int
4048 nd6_storelladdr(struct ifnet *ifp, struct rtentry *rt, struct mbuf *m,
4049 struct sockaddr *dst, u_char *desten)
4050 {
4051 int i;
4052 struct sockaddr_dl *sdl;
4053
4054 if (m->m_flags & M_MCAST) {
4055 switch (ifp->if_type) {
4056 case IFT_ETHER:
4057 case IFT_FDDI:
4058 case IFT_L2VLAN:
4059 case IFT_IEEE8023ADLAG:
4060 #if IFT_IEEE80211
4061 case IFT_IEEE80211:
4062 #endif
4063 case IFT_BRIDGE:
4064 ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr, desten);
4065 return (1);
4066 case IFT_IEEE1394:
4067 for (i = 0; i < ifp->if_addrlen; i++)
4068 desten[i] = ~0;
4069 return (1);
4070 case IFT_ARCNET:
4071 *desten = 0;
4072 return (1);
4073 default:
4074 return (0); /* caller will free mbuf */
4075 }
4076 }
4077
4078 if (rt == NULL) {
4079 /* this could happen, if we could not allocate memory */
4080 return (0); /* caller will free mbuf */
4081 }
4082 RT_LOCK(rt);
4083 if (rt->rt_gateway->sa_family != AF_LINK) {
4084 printf("nd6_storelladdr: something odd happens\n");
4085 RT_UNLOCK(rt);
4086 return (0); /* caller will free mbuf */
4087 }
4088 sdl = SDL(rt->rt_gateway);
4089 if (sdl->sdl_alen == 0) {
4090 /* this should be impossible, but we bark here for debugging */
4091 printf("nd6_storelladdr: sdl_alen == 0\n");
4092 RT_UNLOCK(rt);
4093 return (0); /* caller will free mbuf */
4094 }
4095
4096 bcopy(LLADDR(sdl), desten, sdl->sdl_alen);
4097 RT_UNLOCK(rt);
4098 return (1);
4099 }
4100
4101 /*
4102 * This is the ND pre-output routine; care must be taken to ensure that
4103 * the "hint" route never gets freed via rtfree(), since the caller may
4104 * have stored it inside a struct route with a reference held for that
4105 * placeholder.
4106 */
4107 errno_t
4108 nd6_lookup_ipv6(ifnet_t ifp, const struct sockaddr_in6 *ip6_dest,
4109 struct sockaddr_dl *ll_dest, size_t ll_dest_len, route_t hint,
4110 mbuf_t packet)
4111 {
4112 route_t route = hint;
4113 errno_t result = 0;
4114 struct sockaddr_dl *sdl = NULL;
4115 size_t copy_len;
4116
4117 if (ifp == NULL || ip6_dest == NULL)
4118 return (EINVAL);
4119
4120 if (ip6_dest->sin6_family != AF_INET6)
4121 return (EAFNOSUPPORT);
4122
4123 if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) != (IFF_UP|IFF_RUNNING))
4124 return (ENETDOWN);
4125
4126 if (hint != NULL) {
4127 /*
4128 * Callee holds a reference on the route and returns
4129 * with the route entry locked, upon success.
4130 */
4131 result = route_to_gwroute((const struct sockaddr *)ip6_dest,
4132 hint, &route);
4133 if (result != 0)
4134 return (result);
4135 if (route != NULL)
4136 RT_LOCK_ASSERT_HELD(route);
4137 }
4138
4139 if ((packet != NULL && (packet->m_flags & M_MCAST) != 0) ||
4140 ((ifp->if_flags & IFF_MULTICAST) &&
4141 IN6_IS_ADDR_MULTICAST(&ip6_dest->sin6_addr))) {
4142 if (route != NULL)
4143 RT_UNLOCK(route);
4144 result = dlil_resolve_multi(ifp,
4145 (const struct sockaddr *)ip6_dest,
4146 SA(ll_dest), ll_dest_len);
4147 if (route != NULL)
4148 RT_LOCK(route);
4149 goto release;
4150 } else if (route == NULL) {
4151 /*
4152 * rdar://24596652
4153 * For unicast, lookup existing ND6 entries but
4154 * do not trigger a resolution
4155 */
4156 lck_mtx_lock(rnh_lock);
4157 route = rt_lookup(TRUE,
4158 __DECONST(struct sockaddr *, ip6_dest), NULL,
4159 rt_tables[AF_INET6], ifp->if_index);
4160 lck_mtx_unlock(rnh_lock);
4161
4162 if (route != NULL) {
4163 RT_LOCK(route);
4164 }
4165 }
4166
4167 if (route == NULL) {
4168 /*
4169 * This could happen, if we could not allocate memory or
4170 * if route_to_gwroute() didn't return a route.
4171 */
4172 result = ENOBUFS;
4173 goto release;
4174 }
4175
4176 if (route->rt_gateway->sa_family != AF_LINK) {
4177 printf("%s: route %s on %s%d gateway address not AF_LINK\n",
4178 __func__, ip6_sprintf(&ip6_dest->sin6_addr),
4179 route->rt_ifp->if_name, route->rt_ifp->if_unit);
4180 result = EADDRNOTAVAIL;
4181 goto release;
4182 }
4183
4184 sdl = SDL(route->rt_gateway);
4185 if (sdl->sdl_alen == 0) {
4186 /* this should be impossible, but we bark here for debugging */
4187 printf("%s: route %s on %s%d sdl_alen == 0\n", __func__,
4188 ip6_sprintf(&ip6_dest->sin6_addr), route->rt_ifp->if_name,
4189 route->rt_ifp->if_unit);
4190 result = EHOSTUNREACH;
4191 goto release;
4192 }
4193
4194 copy_len = sdl->sdl_len <= ll_dest_len ? sdl->sdl_len : ll_dest_len;
4195 bcopy(sdl, ll_dest, copy_len);
4196
4197 release:
4198 if (route != NULL) {
4199 if (route == hint) {
4200 RT_REMREF_LOCKED(route);
4201 RT_UNLOCK(route);
4202 } else {
4203 RT_UNLOCK(route);
4204 rtfree(route);
4205 }
4206 }
4207 return (result);
4208 }
4209
4210 #if (DEVELOPMENT || DEBUG)
4211
4212 static int sysctl_nd6_lookup_ipv6 SYSCTL_HANDLER_ARGS;
4213 SYSCTL_PROC(_net_inet6_icmp6, OID_AUTO, nd6_lookup_ipv6,
4214 CTLTYPE_STRUCT | CTLFLAG_RW | CTLFLAG_LOCKED, 0, 0,
4215 sysctl_nd6_lookup_ipv6, "S", "");
4216
4217 int
4218 sysctl_nd6_lookup_ipv6 SYSCTL_HANDLER_ARGS
4219 {
4220 #pragma unused(oidp, arg1, arg2)
4221 int error = 0;
4222 struct nd6_lookup_ipv6_args nd6_lookup_ipv6_args;
4223 ifnet_t ifp = NULL;
4224
4225 /*
4226 * Only root can lookup MAC addresses
4227 */
4228 error = proc_suser(current_proc());
4229 if (error != 0) {
4230 printf("%s: proc_suser() error %d\n",
4231 __func__, error);
4232 goto done;
4233 }
4234 if (req->oldptr == USER_ADDR_NULL) {
4235 req->oldidx = sizeof(struct nd6_lookup_ipv6_args);
4236 }
4237 if (req->newptr == USER_ADDR_NULL) {
4238 goto done;
4239 }
4240 if (req->oldlen != sizeof(struct nd6_lookup_ipv6_args) ||
4241 req->newlen != sizeof(struct nd6_lookup_ipv6_args)) {
4242 error = EINVAL;
4243 printf("%s: bad req, error %d\n",
4244 __func__, error);
4245 goto done;
4246 }
4247 error = SYSCTL_IN(req, &nd6_lookup_ipv6_args,
4248 sizeof(struct nd6_lookup_ipv6_args));
4249 if (error != 0) {
4250 printf("%s: SYSCTL_IN() error %d\n",
4251 __func__, error);
4252 goto done;
4253 }
4254 /* Make sure to terminate the string */
4255 nd6_lookup_ipv6_args.ifname[IFNAMSIZ - 1] = 0;
4256
4257 error = ifnet_find_by_name(nd6_lookup_ipv6_args.ifname, &ifp);
4258 if (error != 0) {
4259 printf("%s: ifnet_find_by_name() error %d\n",
4260 __func__, error);
4261 goto done;
4262 }
4263
4264 error = nd6_lookup_ipv6(ifp, &nd6_lookup_ipv6_args.ip6_dest,
4265 &nd6_lookup_ipv6_args.ll_dest_._sdl,
4266 nd6_lookup_ipv6_args.ll_dest_len, NULL, NULL);
4267 if (error != 0) {
4268 printf("%s: nd6_lookup_ipv6() error %d\n",
4269 __func__, error);
4270 goto done;
4271 }
4272
4273 error = SYSCTL_OUT(req, &nd6_lookup_ipv6_args,
4274 sizeof(struct nd6_lookup_ipv6_args));
4275 if (error != 0) {
4276 printf("%s: SYSCTL_OUT() error %d\n",
4277 __func__, error);
4278 goto done;
4279 }
4280 done:
4281 return (error);
4282 }
4283
4284 #endif /* (DEVELOPEMENT || DEBUG) */
4285
4286 int
4287 nd6_setifinfo(struct ifnet *ifp, u_int32_t before, u_int32_t after)
4288 {
4289 uint32_t b, a;
4290 int err = 0;
4291
4292 /*
4293 * Handle ND6_IFF_IFDISABLED
4294 */
4295 if ((before & ND6_IFF_IFDISABLED) ||
4296 (after & ND6_IFF_IFDISABLED)) {
4297 b = (before & ND6_IFF_IFDISABLED);
4298 a = (after & ND6_IFF_IFDISABLED);
4299
4300 if (b != a && (err = nd6_if_disable(ifp,
4301 ((int32_t)(a - b) > 0))) != 0)
4302 goto done;
4303 }
4304
4305 /*
4306 * Handle ND6_IFF_PROXY_PREFIXES
4307 */
4308 if ((before & ND6_IFF_PROXY_PREFIXES) ||
4309 (after & ND6_IFF_PROXY_PREFIXES)) {
4310 b = (before & ND6_IFF_PROXY_PREFIXES);
4311 a = (after & ND6_IFF_PROXY_PREFIXES);
4312
4313 if (b != a && (err = nd6_if_prproxy(ifp,
4314 ((int32_t)(a - b) > 0))) != 0)
4315 goto done;
4316 }
4317 done:
4318 return (err);
4319 }
4320
4321 /*
4322 * Enable/disable IPv6 on an interface, called as part of
4323 * setting/clearing ND6_IFF_IFDISABLED, or during DAD failure.
4324 */
4325 int
4326 nd6_if_disable(struct ifnet *ifp, boolean_t enable)
4327 {
4328 ifnet_lock_shared(ifp);
4329 if (enable)
4330 ifp->if_eflags |= IFEF_IPV6_DISABLED;
4331 else
4332 ifp->if_eflags &= ~IFEF_IPV6_DISABLED;
4333 ifnet_lock_done(ifp);
4334
4335 return (0);
4336 }
4337
4338 static int
4339 nd6_sysctl_drlist SYSCTL_HANDLER_ARGS
4340 {
4341 #pragma unused(oidp, arg1, arg2)
4342 char pbuf[MAX_IPv6_STR_LEN];
4343 struct nd_defrouter *dr;
4344 int error = 0;
4345
4346 if (req->newptr != USER_ADDR_NULL)
4347 return (EPERM);
4348
4349 /* XXX Handle mapped defrouter entries */
4350 lck_mtx_lock(nd6_mutex);
4351 if (proc_is64bit(req->p)) {
4352 struct in6_defrouter_64 d;
4353
4354 bzero(&d, sizeof (d));
4355 d.rtaddr.sin6_family = AF_INET6;
4356 d.rtaddr.sin6_len = sizeof (d.rtaddr);
4357
4358 TAILQ_FOREACH(dr, &nd_defrouter, dr_entry) {
4359 d.rtaddr.sin6_addr = dr->rtaddr;
4360 if (in6_recoverscope(&d.rtaddr,
4361 &dr->rtaddr, dr->ifp) != 0)
4362 log(LOG_ERR, "scope error in default router "
4363 "list (%s)\n", inet_ntop(AF_INET6,
4364 &dr->rtaddr, pbuf, sizeof (pbuf)));
4365 d.flags = dr->flags;
4366 d.stateflags = dr->stateflags;
4367 d.rtlifetime = dr->rtlifetime;
4368 d.expire = nddr_getexpire(dr);
4369 d.if_index = dr->ifp->if_index;
4370 error = SYSCTL_OUT(req, &d, sizeof (d));
4371 if (error != 0)
4372 break;
4373 }
4374 } else {
4375 struct in6_defrouter_32 d;
4376
4377 bzero(&d, sizeof (d));
4378 d.rtaddr.sin6_family = AF_INET6;
4379 d.rtaddr.sin6_len = sizeof (d.rtaddr);
4380
4381 TAILQ_FOREACH(dr, &nd_defrouter, dr_entry) {
4382 d.rtaddr.sin6_addr = dr->rtaddr;
4383 if (in6_recoverscope(&d.rtaddr,
4384 &dr->rtaddr, dr->ifp) != 0)
4385 log(LOG_ERR, "scope error in default router "
4386 "list (%s)\n", inet_ntop(AF_INET6,
4387 &dr->rtaddr, pbuf, sizeof (pbuf)));
4388 d.flags = dr->flags;
4389 d.stateflags = dr->stateflags;
4390 d.rtlifetime = dr->rtlifetime;
4391 d.expire = nddr_getexpire(dr);
4392 d.if_index = dr->ifp->if_index;
4393 error = SYSCTL_OUT(req, &d, sizeof (d));
4394 if (error != 0)
4395 break;
4396 }
4397 }
4398 lck_mtx_unlock(nd6_mutex);
4399 return (error);
4400 }
4401
4402 static int
4403 nd6_sysctl_prlist SYSCTL_HANDLER_ARGS
4404 {
4405 #pragma unused(oidp, arg1, arg2)
4406 char pbuf[MAX_IPv6_STR_LEN];
4407 struct nd_pfxrouter *pfr;
4408 struct sockaddr_in6 s6;
4409 struct nd_prefix *pr;
4410 int error = 0;
4411
4412 if (req->newptr != USER_ADDR_NULL)
4413 return (EPERM);
4414
4415 bzero(&s6, sizeof (s6));
4416 s6.sin6_family = AF_INET6;
4417 s6.sin6_len = sizeof (s6);
4418
4419 /* XXX Handle mapped defrouter entries */
4420 lck_mtx_lock(nd6_mutex);
4421 if (proc_is64bit(req->p)) {
4422 struct in6_prefix_64 p;
4423
4424 bzero(&p, sizeof (p));
4425 p.origin = PR_ORIG_RA;
4426
4427 LIST_FOREACH(pr, &nd_prefix, ndpr_entry) {
4428 NDPR_LOCK(pr);
4429 p.prefix = pr->ndpr_prefix;
4430 if (in6_recoverscope(&p.prefix,
4431 &pr->ndpr_prefix.sin6_addr, pr->ndpr_ifp) != 0)
4432 log(LOG_ERR, "scope error in "
4433 "prefix list (%s)\n", inet_ntop(AF_INET6,
4434 &p.prefix.sin6_addr, pbuf, sizeof (pbuf)));
4435 p.raflags = pr->ndpr_raf;
4436 p.prefixlen = pr->ndpr_plen;
4437 p.vltime = pr->ndpr_vltime;
4438 p.pltime = pr->ndpr_pltime;
4439 p.if_index = pr->ndpr_ifp->if_index;
4440 p.expire = ndpr_getexpire(pr);
4441 p.refcnt = pr->ndpr_addrcnt;
4442 p.flags = pr->ndpr_stateflags;
4443 p.advrtrs = 0;
4444 LIST_FOREACH(pfr, &pr->ndpr_advrtrs, pfr_entry)
4445 p.advrtrs++;
4446 error = SYSCTL_OUT(req, &p, sizeof (p));
4447 if (error != 0) {
4448 NDPR_UNLOCK(pr);
4449 break;
4450 }
4451 LIST_FOREACH(pfr, &pr->ndpr_advrtrs, pfr_entry) {
4452 s6.sin6_addr = pfr->router->rtaddr;
4453 if (in6_recoverscope(&s6, &pfr->router->rtaddr,
4454 pfr->router->ifp) != 0)
4455 log(LOG_ERR,
4456 "scope error in prefix list (%s)\n",
4457 inet_ntop(AF_INET6, &s6.sin6_addr,
4458 pbuf, sizeof (pbuf)));
4459 error = SYSCTL_OUT(req, &s6, sizeof (s6));
4460 if (error != 0)
4461 break;
4462 }
4463 NDPR_UNLOCK(pr);
4464 if (error != 0)
4465 break;
4466 }
4467 } else {
4468 struct in6_prefix_32 p;
4469
4470 bzero(&p, sizeof (p));
4471 p.origin = PR_ORIG_RA;
4472
4473 LIST_FOREACH(pr, &nd_prefix, ndpr_entry) {
4474 NDPR_LOCK(pr);
4475 p.prefix = pr->ndpr_prefix;
4476 if (in6_recoverscope(&p.prefix,
4477 &pr->ndpr_prefix.sin6_addr, pr->ndpr_ifp) != 0)
4478 log(LOG_ERR,
4479 "scope error in prefix list (%s)\n",
4480 inet_ntop(AF_INET6, &p.prefix.sin6_addr,
4481 pbuf, sizeof (pbuf)));
4482 p.raflags = pr->ndpr_raf;
4483 p.prefixlen = pr->ndpr_plen;
4484 p.vltime = pr->ndpr_vltime;
4485 p.pltime = pr->ndpr_pltime;
4486 p.if_index = pr->ndpr_ifp->if_index;
4487 p.expire = ndpr_getexpire(pr);
4488 p.refcnt = pr->ndpr_addrcnt;
4489 p.flags = pr->ndpr_stateflags;
4490 p.advrtrs = 0;
4491 LIST_FOREACH(pfr, &pr->ndpr_advrtrs, pfr_entry)
4492 p.advrtrs++;
4493 error = SYSCTL_OUT(req, &p, sizeof (p));
4494 if (error != 0) {
4495 NDPR_UNLOCK(pr);
4496 break;
4497 }
4498 LIST_FOREACH(pfr, &pr->ndpr_advrtrs, pfr_entry) {
4499 s6.sin6_addr = pfr->router->rtaddr;
4500 if (in6_recoverscope(&s6, &pfr->router->rtaddr,
4501 pfr->router->ifp) != 0)
4502 log(LOG_ERR,
4503 "scope error in prefix list (%s)\n",
4504 inet_ntop(AF_INET6, &s6.sin6_addr,
4505 pbuf, sizeof (pbuf)));
4506 error = SYSCTL_OUT(req, &s6, sizeof (s6));
4507 if (error != 0)
4508 break;
4509 }
4510 NDPR_UNLOCK(pr);
4511 if (error != 0)
4512 break;
4513 }
4514 }
4515 lck_mtx_unlock(nd6_mutex);
4516
4517 return (error);
4518 }
4519
4520 void
4521 in6_ifaddr_set_dadprogress(struct in6_ifaddr *ia)
4522 {
4523 struct ifnet* ifp = ia->ia_ifp;
4524 uint32_t flags = IN6_IFF_TENTATIVE;
4525 uint32_t optdad = nd6_optimistic_dad;
4526 struct nd_ifinfo *ndi = NULL;
4527
4528 ndi = ND_IFINFO(ifp);
4529 VERIFY((NULL != ndi) && (TRUE == ndi->initialized));
4530 if (!(ndi->flags & ND6_IFF_DAD))
4531 return;
4532
4533 if (optdad) {
4534 if ((ifp->if_eflags & IFEF_IPV6_ROUTER) != 0) {
4535 optdad = 0;
4536 } else {
4537 lck_mtx_lock(&ndi->lock);
4538 if ((ndi->flags & ND6_IFF_REPLICATED) != 0) {
4539 optdad = 0;
4540 }
4541 lck_mtx_unlock(&ndi->lock);
4542 }
4543 }
4544
4545 if (optdad) {
4546 if ((optdad & ND6_OPTIMISTIC_DAD_LINKLOCAL) &&
4547 IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr))
4548 flags = IN6_IFF_OPTIMISTIC;
4549 else if ((optdad & ND6_OPTIMISTIC_DAD_AUTOCONF) &&
4550 (ia->ia6_flags & IN6_IFF_AUTOCONF)) {
4551 if (ia->ia6_flags & IN6_IFF_TEMPORARY) {
4552 if (optdad & ND6_OPTIMISTIC_DAD_TEMPORARY)
4553 flags = IN6_IFF_OPTIMISTIC;
4554 } else if (ia->ia6_flags & IN6_IFF_SECURED) {
4555 if (optdad & ND6_OPTIMISTIC_DAD_SECURED)
4556 flags = IN6_IFF_OPTIMISTIC;
4557 } else {
4558 /*
4559 * Keeping the behavior for temp and CGA
4560 * SLAAC addresses to have a knob for optimistic
4561 * DAD.
4562 * Other than that if ND6_OPTIMISTIC_DAD_AUTOCONF
4563 * is set, we should default to optimistic
4564 * DAD.
4565 * For now this means SLAAC addresses with interface
4566 * identifier derived from modified EUI-64 bit
4567 * identifiers.
4568 */
4569 flags = IN6_IFF_OPTIMISTIC;
4570 }
4571 } else if ((optdad & ND6_OPTIMISTIC_DAD_DYNAMIC) &&
4572 (ia->ia6_flags & IN6_IFF_DYNAMIC)) {
4573 if (ia->ia6_flags & IN6_IFF_TEMPORARY) {
4574 if (optdad & ND6_OPTIMISTIC_DAD_TEMPORARY)
4575 flags = IN6_IFF_OPTIMISTIC;
4576 } else {
4577 flags = IN6_IFF_OPTIMISTIC;
4578 }
4579 } else if ((optdad & ND6_OPTIMISTIC_DAD_MANUAL) &&
4580 (ia->ia6_flags & IN6_IFF_OPTIMISTIC)) {
4581 /*
4582 * rdar://17483438
4583 * Bypass tentative for address assignments
4584 * not covered above (e.g. manual) upon request
4585 */
4586 if (!IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr) &&
4587 !(ia->ia6_flags & IN6_IFF_AUTOCONF) &&
4588 !(ia->ia6_flags & IN6_IFF_DYNAMIC))
4589 flags = IN6_IFF_OPTIMISTIC;
4590 }
4591 }
4592
4593 ia->ia6_flags &= ~(IN6_IFF_DUPLICATED | IN6_IFF_DADPROGRESS);
4594 ia->ia6_flags |= flags;
4595
4596 nd6log2((LOG_DEBUG, "%s - %s ifp %s ia6_flags 0x%x\n",
4597 __func__,
4598 ip6_sprintf(&ia->ia_addr.sin6_addr),
4599 if_name(ia->ia_ifp),
4600 ia->ia6_flags));
4601 }
4602