]> git.saurik.com Git - apple/xnu.git/blob - bsd/netinet6/nd6.c
projects / apple / xnu.git / blob
? search:


92034fc61c8575dfdc7457e29e8a597d6b8513f7
[apple/xnu.git] / bsd / netinet6 / nd6.c
1 /*
2 * Copyright (c) 2008-2009 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /* $FreeBSD: src/sys/netinet6/nd6.c,v 1.20 2002/08/02 20:49:14 rwatson Exp $ */
30 /* $KAME: nd6.c,v 1.144 2001/05/24 07:44:00 itojun Exp $ */
31
32 /*
33 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
34 * All rights reserved.
35 *
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
38 * are met:
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. Neither the name of the project nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 */
60
61 /*
62 * XXX
63 * KAME 970409 note:
64 * BSD/OS version heavily modifies this code, related to llinfo.
65 * Since we don't have BSD/OS version of net/route.c in our hand,
66 * I left the code mostly as it was in 970310. -- itojun
67 */
68
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/malloc.h>
72 #include <sys/mbuf.h>
73 #include <sys/socket.h>
74 #include <sys/sockio.h>
75 #include <sys/time.h>
76 #include <sys/kernel.h>
77 #include <sys/sysctl.h>
78 #include <sys/errno.h>
79 #include <sys/syslog.h>
80 #include <sys/protosw.h>
81 #include <sys/proc.h>
82 #include <kern/queue.h>
83 #include <kern/zalloc.h>
84
85 #define DONT_WARN_OBSOLETE
86 #include <net/if.h>
87 #include <net/if_dl.h>
88 #include <net/if_types.h>
89 #include <net/if_atm.h>
90 #include <net/route.h>
91 #include <net/dlil.h>
92
93 #include <netinet/in.h>
94 #include <netinet/in_arp.h>
95 #include <netinet/if_ether.h>
96 #include <netinet/if_fddi.h>
97 #include <netinet6/in6_var.h>
98 #include <netinet/ip6.h>
99 #include <netinet6/ip6_var.h>
100 #include <netinet6/nd6.h>
101 #include <netinet6/in6_prefix.h>
102 #include <netinet/icmp6.h>
103
104 #include "loop.h"
105
106 #include <net/net_osdep.h>
107
108 #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */
109 #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */
110
111 #define SA(p) ((struct sockaddr *)(p))
112 #define SIN6(s) ((struct sockaddr_in6 *)s)
113 #define SDL(s) ((struct sockaddr_dl *)s)
114 #define equal(a1, a2) (bcmp((caddr_t)(a1), (caddr_t)(a2), (a1)->sa_len) == 0)
115
116 /* timer values */
117 int nd6_prune = 1; /* walk list every 1 seconds */
118 int nd6_delay = 5; /* delay first probe time 5 second */
119 int nd6_umaxtries = 3; /* maximum unicast query */
120 int nd6_mmaxtries = 3; /* maximum multicast query */
121 int nd6_useloopback = 1; /* use loopback interface for local traffic */
122 int nd6_gctimer = (60 * 60 * 24); /* 1 day: garbage collection timer */
123
124 /* preventing too many loops in ND option parsing */
125 int nd6_maxndopt = 10; /* max # of ND options allowed */
126
127 int nd6_maxnudhint = 0; /* max # of subsequent upper layer hints */
128
129 #if ND6_DEBUG
130 int nd6_debug = 1;
131 #else
132 int nd6_debug = 0;
133 #endif
134
135 /* for debugging? */
136 static int nd6_inuse, nd6_allocated;
137
138 /*
139 * Synchronization notes:
140 *
141 * The global list of ND entries are stored in llinfo_nd6; an entry
142 * gets inserted into the list when the route is created and gets
143 * removed from the list when it is deleted; this is done as part
144 * of RTM_ADD/RTM_RESOLVE/RTM_DELETE in nd6_rtrequest().
145 *
146 * Because rnh_lock and rt_lock for the entry are held during those
147 * operations, the same locks (and thus lock ordering) must be used
148 * elsewhere to access the relevant data structure fields:
149 *
150 * ln_next, ln_prev, ln_rt
151 *
152 * - Routing lock (rnh_lock)
153 *
154 * ln_hold, ln_asked, ln_expire, ln_state, ln_router, ln_byhint, ln_flags
155 *
156 * - Routing entry lock (rt_lock)
157 *
158 * Due to the dependency on rt_lock, llinfo_nd6 has the same lifetime
159 * as the route entry itself. When a route is deleted (RTM_DELETE),
160 * it is simply removed from the global list but the memory is not
161 * freed until the route itself is freed.
162 */
163 struct llinfo_nd6 llinfo_nd6 = {
164 &llinfo_nd6, &llinfo_nd6, NULL, NULL, 0, 0, 0, 0, 0, 0
165 };
166
167 /* Protected by nd_if_rwlock */
168 size_t nd_ifinfo_indexlim = 32; /* increased for 5589193 */
169 struct nd_ifinfo *nd_ifinfo = NULL;
170
171 static lck_grp_attr_t *nd_if_rwlock_grp_attr;
172 static lck_grp_t *nd_if_rwlock_grp;
173 static lck_attr_t *nd_if_rwlock_attr;
174 lck_rw_t *nd_if_rwlock;
175
176 /* Protected by nd6_mutex */
177 struct nd_drhead nd_defrouter;
178 struct nd_prhead nd_prefix = { 0 };
179
180 int nd6_recalc_reachtm_interval = ND6_RECALC_REACHTM_INTERVAL;
181 static struct sockaddr_in6 all1_sa;
182
183 static int regen_tmpaddr(struct in6_ifaddr *);
184 extern lck_mtx_t *ip6_mutex;
185 extern lck_mtx_t *nd6_mutex;
186
187 static void nd6_slowtimo(void *ignored_arg);
188 static struct llinfo_nd6 *nd6_llinfo_alloc(void);
189 static void nd6_llinfo_free(void *);
190
191 static void nd6_siocgdrlst(void *, int);
192 static void nd6_siocgprlst(void *, int);
193
194 /*
195 * Insertion and removal from llinfo_nd6 must be done with rnh_lock held.
196 */
197 #define LN_DEQUEUE(_ln) do { \
198 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); \
199 RT_LOCK_ASSERT_HELD((_ln)->ln_rt); \
200 (_ln)->ln_next->ln_prev = (_ln)->ln_prev; \
201 (_ln)->ln_prev->ln_next = (_ln)->ln_next; \
202 (_ln)->ln_prev = (_ln)->ln_next = NULL; \
203 (_ln)->ln_flags &= ~ND6_LNF_IN_USE; \
204 } while (0)
205
206 #define LN_INSERTHEAD(_ln) do { \
207 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED); \
208 RT_LOCK_ASSERT_HELD((_ln)->ln_rt); \
209 (_ln)->ln_next = llinfo_nd6.ln_next; \
210 llinfo_nd6.ln_next = (_ln); \
211 (_ln)->ln_prev = &llinfo_nd6; \
212 (_ln)->ln_next->ln_prev = (_ln); \
213 (_ln)->ln_flags |= ND6_LNF_IN_USE; \
214 } while (0)
215
216 static struct zone *llinfo_nd6_zone;
217 #define LLINFO_ND6_ZONE_MAX 256 /* maximum elements in zone */
218 #define LLINFO_ND6_ZONE_NAME "llinfo_nd6" /* name for zone */
219
220 void
221 nd6_init()
222 {
223 static int nd6_init_done = 0;
224 int i;
225
226 if (nd6_init_done) {
227 log(LOG_NOTICE, "nd6_init called more than once (ignored)\n");
228 return;
229 }
230
231 all1_sa.sin6_family = AF_INET6;
232 all1_sa.sin6_len = sizeof(struct sockaddr_in6);
233 for (i = 0; i < sizeof(all1_sa.sin6_addr); i++)
234 all1_sa.sin6_addr.s6_addr[i] = 0xff;
235
236 /* initialization of the default router list */
237 TAILQ_INIT(&nd_defrouter);
238
239 nd_if_rwlock_grp_attr = lck_grp_attr_alloc_init();
240 nd_if_rwlock_grp = lck_grp_alloc_init("nd_if_rwlock",
241 nd_if_rwlock_grp_attr);
242 nd_if_rwlock_attr = lck_attr_alloc_init();
243 nd_if_rwlock = lck_rw_alloc_init(nd_if_rwlock_grp, nd_if_rwlock_attr);
244
245 llinfo_nd6_zone = zinit(sizeof (struct llinfo_nd6),
246 LLINFO_ND6_ZONE_MAX * sizeof (struct llinfo_nd6), 0,
247 LLINFO_ND6_ZONE_NAME);
248 if (llinfo_nd6_zone == NULL)
249 panic("%s: failed allocating llinfo_nd6_zone", __func__);
250
251 zone_change(llinfo_nd6_zone, Z_EXPAND, TRUE);
252
253 nd6_init_done = 1;
254
255 /* start timer */
256 timeout(nd6_slowtimo, (caddr_t)0, ND6_SLOWTIMER_INTERVAL * hz);
257 }
258
259 static struct llinfo_nd6 *
260 nd6_llinfo_alloc(void)
261 {
262 return (zalloc(llinfo_nd6_zone));
263 }
264
265 static void
266 nd6_llinfo_free(void *arg)
267 {
268 struct llinfo_nd6 *ln = arg;
269
270 if (ln->ln_next != NULL || ln->ln_prev != NULL) {
271 panic("%s: trying to free %p when it is in use", __func__, ln);
272 /* NOTREACHED */
273 }
274
275 /* Just in case there's anything there, free it */
276 if (ln->ln_hold != NULL) {
277 m_freem(ln->ln_hold);
278 ln->ln_hold = NULL;
279 }
280
281 zfree(llinfo_nd6_zone, ln);
282 }
283
284 int
285 nd6_ifattach(struct ifnet *ifp)
286 {
287
288 /*
289 * We have some arrays that should be indexed by if_index.
290 * since if_index will grow dynamically, they should grow too.
291 */
292 lck_rw_lock_exclusive(nd_if_rwlock);
293 if (nd_ifinfo == NULL || if_index >= nd_ifinfo_indexlim) {
294 size_t n;
295 caddr_t q;
296 size_t newlim = nd_ifinfo_indexlim;
297
298 while (if_index >= newlim)
299 newlim <<= 1;
300
301 /* grow nd_ifinfo */
302 n = newlim * sizeof(struct nd_ifinfo);
303 q = (caddr_t)_MALLOC(n, M_IP6NDP, M_WAITOK);
304 if (q == NULL) {
305 lck_rw_done(nd_if_rwlock);
306 return ENOBUFS;
307 }
308 bzero(q, n);
309 nd_ifinfo_indexlim = newlim;
310 if (nd_ifinfo) {
311 bcopy((caddr_t)nd_ifinfo, q, n/2);
312 /*
313 * We might want to pattern fill the old
314 * array to catch use-after-free cases.
315 */
316 FREE((caddr_t)nd_ifinfo, M_IP6NDP);
317 }
318 nd_ifinfo = (struct nd_ifinfo *)q;
319 }
320 lck_rw_done(nd_if_rwlock);
321
322 #define ND nd_ifinfo[ifp->if_index]
323
324 /*
325 * Don't initialize if called twice.
326 * XXX: to detect this, we should choose a member that is never set
327 * before initialization of the ND structure itself. We formaly used
328 * the linkmtu member, which was not suitable because it could be
329 * initialized via "ifconfig mtu".
330 */
331 lck_rw_lock_shared(nd_if_rwlock);
332 if (ND.basereachable) {
333 lck_rw_done(nd_if_rwlock);
334 return 0;
335 }
336 ND.linkmtu = ifp->if_mtu;
337 ND.chlim = IPV6_DEFHLIM;
338 ND.basereachable = REACHABLE_TIME;
339 ND.reachable = ND_COMPUTE_RTIME(ND.basereachable);
340 ND.retrans = RETRANS_TIMER;
341 ND.receivedra = 0;
342 ND.flags = ND6_IFF_PERFORMNUD;
343 lck_rw_done(nd_if_rwlock);
344 nd6_setmtu(ifp);
345 #undef ND
346
347 return 0;
348 }
349
350 /*
351 * Reset ND level link MTU. This function is called when the physical MTU
352 * changes, which means we might have to adjust the ND level MTU.
353 */
354 void
355 nd6_setmtu(struct ifnet *ifp)
356 {
357 struct nd_ifinfo *ndi;
358 u_int32_t oldmaxmtu, maxmtu;
359
360 /*
361 * Make sure IPv6 is enabled for the interface first,
362 * because this can be called directly from SIOCSIFMTU for IPv4
363 */
364 lck_rw_lock_shared(nd_if_rwlock);
365 if (ifp->if_index >= nd_ifinfo_indexlim) {
366 lck_rw_done(nd_if_rwlock);
367 return; /* we're out of bound for nd_ifinfo */
368 }
369
370 ndi = &nd_ifinfo[ifp->if_index];
371 oldmaxmtu = ndi->maxmtu;
372
373 /*
374 * The ND level maxmtu is somewhat redundant to the interface MTU
375 * and is an implementation artifact of KAME. Instead of hard-
376 * limiting the maxmtu based on the interface type here, we simply
377 * take the if_mtu value since SIOCSIFMTU would have taken care of
378 * the sanity checks related to the maximum MTU allowed for the
379 * interface (a value that is known only by the interface layer),
380 * by sending the request down via ifnet_ioctl(). The use of the
381 * ND level maxmtu and linkmtu (the latter obtained via RA) are done
382 * via IN6_LINKMTU() which does further checking against if_mtu.
383 */
384 maxmtu = ndi->maxmtu = ifp->if_mtu;
385
386 /*
387 * Decreasing the interface MTU under IPV6 minimum MTU may cause
388 * undesirable situation. We thus notify the operator of the change
389 * explicitly. The check for oldmaxmtu is necessary to restrict the
390 * log to the case of changing the MTU, not initializing it.
391 */
392 if (oldmaxmtu >= IPV6_MMTU && ndi->maxmtu < IPV6_MMTU) {
393 log(LOG_NOTICE, "nd6_setmtu: "
394 "new link MTU on %s%d (%u) is too small for IPv6\n",
395 ifp->if_name, ifp->if_unit, (uint32_t)ndi->maxmtu);
396 }
397 lck_rw_done(nd_if_rwlock);
398
399 /* also adjust in6_maxmtu if necessary. */
400 if (maxmtu > in6_maxmtu)
401 in6_setmaxmtu();
402 }
403
404 void
405 nd6_option_init(
406 void *opt,
407 int icmp6len,
408 union nd_opts *ndopts)
409 {
410 bzero(ndopts, sizeof(*ndopts));
411 ndopts->nd_opts_search = (struct nd_opt_hdr *)opt;
412 ndopts->nd_opts_last
413 = (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len);
414
415 if (icmp6len == 0) {
416 ndopts->nd_opts_done = 1;
417 ndopts->nd_opts_search = NULL;
418 }
419 }
420
421 /*
422 * Take one ND option.
423 */
424 struct nd_opt_hdr *
425 nd6_option(
426 union nd_opts *ndopts)
427 {
428 struct nd_opt_hdr *nd_opt;
429 int olen;
430
431 if (!ndopts)
432 panic("ndopts == NULL in nd6_option\n");
433 if (!ndopts->nd_opts_last)
434 panic("uninitialized ndopts in nd6_option\n");
435 if (!ndopts->nd_opts_search)
436 return NULL;
437 if (ndopts->nd_opts_done)
438 return NULL;
439
440 nd_opt = ndopts->nd_opts_search;
441
442 /* make sure nd_opt_len is inside the buffer */
443 if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) {
444 bzero(ndopts, sizeof(*ndopts));
445 return NULL;
446 }
447
448 olen = nd_opt->nd_opt_len << 3;
449 if (olen == 0) {
450 /*
451 * Message validation requires that all included
452 * options have a length that is greater than zero.
453 */
454 bzero(ndopts, sizeof(*ndopts));
455 return NULL;
456 }
457
458 ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);
459 if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
460 /* option overruns the end of buffer, invalid */
461 bzero(ndopts, sizeof(*ndopts));
462 return NULL;
463 } else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
464 /* reached the end of options chain */
465 ndopts->nd_opts_done = 1;
466 ndopts->nd_opts_search = NULL;
467 }
468 return nd_opt;
469 }
470
471 /*
472 * Parse multiple ND options.
473 * This function is much easier to use, for ND routines that do not need
474 * multiple options of the same type.
475 */
476 int
477 nd6_options(
478 union nd_opts *ndopts)
479 {
480 struct nd_opt_hdr *nd_opt;
481 int i = 0;
482
483 if (!ndopts)
484 panic("ndopts == NULL in nd6_options\n");
485 if (!ndopts->nd_opts_last)
486 panic("uninitialized ndopts in nd6_options\n");
487 if (!ndopts->nd_opts_search)
488 return 0;
489
490 while (1) {
491 nd_opt = nd6_option(ndopts);
492 if (!nd_opt && !ndopts->nd_opts_last) {
493 /*
494 * Message validation requires that all included
495 * options have a length that is greater than zero.
496 */
497 icmp6stat.icp6s_nd_badopt++;
498 bzero(ndopts, sizeof(*ndopts));
499 return -1;
500 }
501
502 if (!nd_opt)
503 goto skip1;
504
505 switch (nd_opt->nd_opt_type) {
506 case ND_OPT_SOURCE_LINKADDR:
507 case ND_OPT_TARGET_LINKADDR:
508 case ND_OPT_MTU:
509 case ND_OPT_REDIRECTED_HEADER:
510 if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
511 nd6log((LOG_INFO,
512 "duplicated ND6 option found (type=%d)\n",
513 nd_opt->nd_opt_type));
514 /* XXX bark? */
515 } else {
516 ndopts->nd_opt_array[nd_opt->nd_opt_type]
517 = nd_opt;
518 }
519 break;
520 case ND_OPT_PREFIX_INFORMATION:
521 if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) {
522 ndopts->nd_opt_array[nd_opt->nd_opt_type]
523 = nd_opt;
524 }
525 ndopts->nd_opts_pi_end =
526 (struct nd_opt_prefix_info *)nd_opt;
527 break;
528 default:
529 /*
530 * Unknown options must be silently ignored,
531 * to accomodate future extension to the protocol.
532 */
533 nd6log((LOG_DEBUG,
534 "nd6_options: unsupported option %d - "
535 "option ignored\n", nd_opt->nd_opt_type));
536 }
537
538 skip1:
539 i++;
540 if (i > nd6_maxndopt) {
541 icmp6stat.icp6s_nd_toomanyopt++;
542 nd6log((LOG_INFO, "too many loop in nd opt\n"));
543 break;
544 }
545
546 if (ndopts->nd_opts_done)
547 break;
548 }
549
550 return 0;
551 }
552
553 void
554 nd6_drain(__unused void *ignored_arg)
555 {
556 struct llinfo_nd6 *ln;
557 struct nd_defrouter *dr;
558 struct nd_prefix *pr;
559 struct ifnet *ifp = NULL;
560 struct in6_ifaddr *ia6, *nia6;
561 struct in6_addrlifetime *lt6;
562 struct timeval timenow;
563
564 getmicrotime(&timenow);
565 again:
566 /*
567 * The global list llinfo_nd6 is modified by nd6_request() and is
568 * therefore protected by rnh_lock. For obvious reasons, we cannot
569 * hold rnh_lock across calls that might lead to code paths which
570 * attempt to acquire rnh_lock, else we deadlock. Hence for such
571 * cases we drop rt_lock and rnh_lock, make the calls, and repeat the
572 * loop. To ensure that we don't process the same entry more than
573 * once in a single timeout, we mark the "already-seen" entries with
574 * ND6_LNF_TIMER_SKIP flag. At the end of the loop, we do a second
575 * pass thru the entries and clear the flag so they can be processed
576 * during the next timeout.
577 */
578 lck_mtx_lock(rnh_lock);
579 ln = llinfo_nd6.ln_next;
580 while (ln != NULL && ln != &llinfo_nd6) {
581 struct rtentry *rt;
582 struct sockaddr_in6 *dst;
583 struct llinfo_nd6 *next;
584 struct nd_ifinfo ndi;
585
586 /* ln_next/prev/rt is protected by rnh_lock */
587 next = ln->ln_next;
588 rt = ln->ln_rt;
589 RT_LOCK(rt);
590
591 /* We've seen this already; skip it */
592 if (ln->ln_flags & ND6_LNF_TIMER_SKIP) {
593 RT_UNLOCK(rt);
594 ln = next;
595 continue;
596 }
597
598 /* rt->rt_ifp should never be NULL */
599 if ((ifp = rt->rt_ifp) == NULL) {
600 panic("%s: ln(%p) rt(%p) rt_ifp == NULL", __func__,
601 ln, rt);
602 /* NOTREACHED */
603 }
604
605 /* rt_llinfo must always be equal to ln */
606 if ((struct llinfo_nd6 *)rt->rt_llinfo != ln) {
607 panic("%s: rt_llinfo(%p) is not equal to ln(%p)",
608 __func__, rt->rt_llinfo, ln);
609 /* NOTREACHED */
610 }
611
612 /* rt_key should never be NULL */
613 dst = (struct sockaddr_in6 *)rt_key(rt);
614 if (dst == NULL) {
615 panic("%s: rt(%p) key is NULL ln(%p)", __func__,
616 rt, ln);
617 /* NOTREACHED */
618 }
619
620 /* Set the flag in case we jump to "again" */
621 ln->ln_flags |= ND6_LNF_TIMER_SKIP;
622
623 if (ln->ln_expire > timenow.tv_sec) {
624 RT_UNLOCK(rt);
625 ln = next;
626 continue;
627 }
628
629 /* Make a copy (we're using it read-only anyway) */
630 lck_rw_lock_shared(nd_if_rwlock);
631 if (ifp->if_index >= nd_ifinfo_indexlim) {
632 lck_rw_done(nd_if_rwlock);
633 RT_UNLOCK(rt);
634 ln = next;
635 continue;
636 }
637 ndi = nd_ifinfo[ifp->if_index];
638 lck_rw_done(nd_if_rwlock);
639
640 RT_LOCK_ASSERT_HELD(rt);
641
642 switch (ln->ln_state) {
643 case ND6_LLINFO_INCOMPLETE:
644 if (ln->ln_asked < nd6_mmaxtries) {
645 ln->ln_asked++;
646 ln->ln_expire = timenow.tv_sec +
647 ndi.retrans / 1000;
648 RT_ADDREF_LOCKED(rt);
649 RT_UNLOCK(rt);
650 lck_mtx_unlock(rnh_lock);
651 nd6_ns_output(ifp, NULL, &dst->sin6_addr,
652 ln, 0, 0);
653 RT_REMREF(rt);
654 } else {
655 struct mbuf *m = ln->ln_hold;
656 ln->ln_hold = NULL;
657 if (m != NULL) {
658 /*
659 * Fake rcvif to make ICMP error
660 * more helpful in diagnosing
661 * for the receiver.
662 * XXX: should we consider
663 * older rcvif?
664 */
665 m->m_pkthdr.rcvif = ifp;
666 RT_UNLOCK(rt);
667 lck_mtx_unlock(rnh_lock);
668 icmp6_error(m, ICMP6_DST_UNREACH,
669 ICMP6_DST_UNREACH_ADDR, 0);
670 } else {
671 RT_UNLOCK(rt);
672 lck_mtx_unlock(rnh_lock);
673 }
674 nd6_free(rt);
675 }
676 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
677 goto again;
678
679 case ND6_LLINFO_REACHABLE:
680 if (ln->ln_expire) {
681 ln->ln_state = ND6_LLINFO_STALE;
682 ln->ln_expire = rt_expiry(rt, timenow.tv_sec,
683 nd6_gctimer);
684 }
685 RT_UNLOCK(rt);
686 break;
687
688 case ND6_LLINFO_STALE:
689 case ND6_LLINFO_PURGE:
690 /* Garbage Collection(RFC 2461 5.3) */
691 if (ln->ln_expire) {
692 RT_UNLOCK(rt);
693 lck_mtx_unlock(rnh_lock);
694 nd6_free(rt);
695 lck_mtx_assert(rnh_lock,
696 LCK_MTX_ASSERT_NOTOWNED);
697 goto again;
698 } else {
699 RT_UNLOCK(rt);
700 }
701 break;
702
703 case ND6_LLINFO_DELAY:
704 if ((ndi.flags & ND6_IFF_PERFORMNUD) != 0) {
705 /* We need NUD */
706 ln->ln_asked = 1;
707 ln->ln_state = ND6_LLINFO_PROBE;
708 ln->ln_expire = timenow.tv_sec +
709 ndi.retrans / 1000;
710 RT_ADDREF_LOCKED(rt);
711 RT_UNLOCK(rt);
712 lck_mtx_unlock(rnh_lock);
713 nd6_ns_output(ifp, &dst->sin6_addr,
714 &dst->sin6_addr, ln, 0, 0);
715 lck_mtx_assert(rnh_lock,
716 LCK_MTX_ASSERT_NOTOWNED);
717 RT_REMREF(rt);
718 goto again;
719 }
720 ln->ln_state = ND6_LLINFO_STALE; /* XXX */
721 ln->ln_expire = rt_expiry(rt, timenow.tv_sec,
722 nd6_gctimer);
723 RT_UNLOCK(rt);
724 break;
725
726 case ND6_LLINFO_PROBE:
727 if (ln->ln_asked < nd6_umaxtries) {
728 ln->ln_asked++;
729 ln->ln_expire = timenow.tv_sec +
730 ndi.retrans / 1000;
731 RT_ADDREF_LOCKED(rt);
732 RT_UNLOCK(rt);
733 lck_mtx_unlock(rnh_lock);
734 nd6_ns_output(ifp, &dst->sin6_addr,
735 &dst->sin6_addr, ln, 0, 0);
736 RT_REMREF(rt);
737 } else {
738 RT_UNLOCK(rt);
739 lck_mtx_unlock(rnh_lock);
740 nd6_free(rt);
741 }
742 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
743 goto again;
744
745 default:
746 RT_UNLOCK(rt);
747 break;
748 }
749 ln = next;
750 }
751 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED);
752
753 /* Now clear the flag from all entries */
754 ln = llinfo_nd6.ln_next;
755 while (ln != NULL && ln != &llinfo_nd6) {
756 struct rtentry *rt = ln->ln_rt;
757 struct llinfo_nd6 *next = ln->ln_next;
758
759 RT_LOCK_SPIN(rt);
760 if (ln->ln_flags & ND6_LNF_TIMER_SKIP)
761 ln->ln_flags &= ~ND6_LNF_TIMER_SKIP;
762 RT_UNLOCK(rt);
763 ln = next;
764 }
765 lck_mtx_unlock(rnh_lock);
766
767 /* expire default router list */
768 lck_mtx_lock(nd6_mutex);
769 dr = TAILQ_FIRST(&nd_defrouter);
770 while (dr) {
771 if (dr->expire && dr->expire < timenow.tv_sec) {
772 struct nd_defrouter *t;
773 t = TAILQ_NEXT(dr, dr_entry);
774 defrtrlist_del(dr, 1);
775 dr = t;
776 } else {
777 dr = TAILQ_NEXT(dr, dr_entry);
778 }
779 }
780
781 /*
782 * expire interface addresses.
783 * in the past the loop was inside prefix expiry processing.
784 * However, from a stricter speci-confrmance standpoint, we should
785 * rather separate address lifetimes and prefix lifetimes.
786 */
787 addrloop:
788 for (ia6 = in6_ifaddrs; ia6; ia6 = nia6) {
789 nia6 = ia6->ia_next;
790 /* check address lifetime */
791 lt6 = &ia6->ia6_lifetime;
792 if (IFA6_IS_INVALID(ia6)) {
793 int regen = 0;
794
795 /*
796 * Extra reference for ourselves; it's no-op if
797 * we don't have to regenerate temporary address,
798 * otherwise it protects the address from going
799 * away since we drop nd6_mutex below.
800 */
801 ifaref(&ia6->ia_ifa);
802
803 /*
804 * If the expiring address is temporary, try
805 * regenerating a new one. This would be useful when
806 * we suspended a laptop PC, then turned it on after a
807 * period that could invalidate all temporary
808 * addresses. Although we may have to restart the
809 * loop (see below), it must be after purging the
810 * address. Otherwise, we'd see an infinite loop of
811 * regeneration.
812 */
813 if (ip6_use_tempaddr &&
814 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
815 /* NOTE: We have to drop the lock here because
816 * regen_tmpaddr() eventually calls in6_update_ifa(),
817 * which must take the lock and would otherwise cause a
818 * hang. This is safe because the goto addrloop
819 * leads to a reevaluation of the in6_ifaddrs list
820 */
821 lck_mtx_unlock(nd6_mutex);
822 if (regen_tmpaddr(ia6) == 0)
823 regen = 1;
824 lck_mtx_lock(nd6_mutex);
825 }
826
827 in6_purgeaddr(&ia6->ia_ifa, 1);
828
829 /* Release extra reference taken above */
830 ifafree(&ia6->ia_ifa);
831
832 if (regen)
833 goto addrloop; /* XXX: see below */
834 }
835 if (IFA6_IS_DEPRECATED(ia6)) {
836 int oldflags = ia6->ia6_flags;
837
838 ia6->ia6_flags |= IN6_IFF_DEPRECATED;
839
840 /*
841 * If a temporary address has just become deprecated,
842 * regenerate a new one if possible.
843 */
844 if (ip6_use_tempaddr &&
845 (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
846 (oldflags & IN6_IFF_DEPRECATED) == 0) {
847
848 /* see NOTE above */
849 lck_mtx_unlock(nd6_mutex);
850 if (regen_tmpaddr(ia6) == 0) {
851 /*
852 * A new temporary address is
853 * generated.
854 * XXX: this means the address chain
855 * has changed while we are still in
856 * the loop. Although the change
857 * would not cause disaster (because
858 * it's not a deletion, but an
859 * addition,) we'd rather restart the
860 * loop just for safety. Or does this
861 * significantly reduce performance??
862 */
863 lck_mtx_lock(nd6_mutex);
864 goto addrloop;
865 }
866 lck_mtx_lock(nd6_mutex);
867 }
868 } else {
869 /*
870 * A new RA might have made a deprecated address
871 * preferred.
872 */
873 ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;
874 }
875 }
876
877 /* expire prefix list */
878 pr = nd_prefix.lh_first;
879 while (pr) {
880 /*
881 * check prefix lifetime.
882 * since pltime is just for autoconf, pltime processing for
883 * prefix is not necessary.
884 */
885 if (pr->ndpr_expire && pr->ndpr_expire < timenow.tv_sec) {
886 struct nd_prefix *t;
887 t = pr->ndpr_next;
888
889 /*
890 * address expiration and prefix expiration are
891 * separate. NEVER perform in6_purgeaddr here.
892 */
893
894 prelist_remove(pr, 1);
895 pr = t;
896 } else
897 pr = pr->ndpr_next;
898 }
899 lck_mtx_unlock(nd6_mutex);
900 }
901
902 /*
903 * ND6 timer routine to expire default route list and prefix list
904 */
905 void
906 nd6_timer(__unused void *ignored_arg)
907 {
908 nd6_drain(NULL);
909 timeout(nd6_timer, (caddr_t)0, nd6_prune * hz);
910 }
911
912 static int
913 regen_tmpaddr(
914 struct in6_ifaddr *ia6) /* deprecated/invalidated temporary address */
915 {
916 struct ifaddr *ifa;
917 struct ifnet *ifp;
918 struct in6_ifaddr *public_ifa6 = NULL;
919 struct timeval timenow;
920
921 getmicrotime(&timenow);
922
923 ifp = ia6->ia_ifa.ifa_ifp;
924 ifnet_lock_exclusive(ifp);
925 for (ifa = ifp->if_addrlist.tqh_first; ifa;
926 ifa = ifa->ifa_list.tqe_next)
927 {
928 struct in6_ifaddr *it6;
929
930 if (ifa->ifa_addr->sa_family != AF_INET6)
931 continue;
932
933 it6 = (struct in6_ifaddr *)ifa;
934
935 /* ignore no autoconf addresses. */
936 if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0)
937 continue;
938
939 /* ignore autoconf addresses with different prefixes. */
940 if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr)
941 continue;
942
943 /*
944 * Now we are looking at an autoconf address with the same
945 * prefix as ours. If the address is temporary and is still
946 * preferred, do not create another one. It would be rare, but
947 * could happen, for example, when we resume a laptop PC after
948 * a long period.
949 */
950 if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
951 !IFA6_IS_DEPRECATED(it6)) {
952 public_ifa6 = NULL;
953 break;
954 }
955
956 /*
957 * This is a public autoconf address that has the same prefix
958 * as ours. If it is preferred, keep it. We can't break the
959 * loop here, because there may be a still-preferred temporary
960 * address with the prefix.
961 */
962 if (!IFA6_IS_DEPRECATED(it6))
963 public_ifa6 = it6;
964 }
965 ifnet_lock_done(ifp);
966
967 if (public_ifa6 != NULL) {
968 int e;
969
970 if ((e = in6_tmpifadd(public_ifa6, 0, M_WAITOK)) != 0) {
971 log(LOG_NOTICE, "regen_tmpaddr: failed to create a new"
972 " tmp addr,errno=%d\n", e);
973 return(-1);
974 }
975 return(0);
976 }
977
978 return(-1);
979 }
980
981 /*
982 * Nuke neighbor cache/prefix/default router management table, right before
983 * ifp goes away.
984 */
985 void
986 nd6_purge(
987 struct ifnet *ifp)
988 {
989 struct llinfo_nd6 *ln;
990 struct nd_defrouter *dr, *ndr, drany;
991 struct nd_prefix *pr, *npr;
992
993 /* Nuke default router list entries toward ifp */
994 lck_mtx_lock(nd6_mutex);
995 if ((dr = TAILQ_FIRST(&nd_defrouter)) != NULL) {
996 /*
997 * The first entry of the list may be stored in
998 * the routing table, so we'll delete it later.
999 */
1000 for (dr = TAILQ_NEXT(dr, dr_entry); dr; dr = ndr) {
1001 ndr = TAILQ_NEXT(dr, dr_entry);
1002 if (dr->ifp == ifp)
1003 defrtrlist_del(dr, 1);
1004 }
1005 dr = TAILQ_FIRST(&nd_defrouter);
1006 if (dr->ifp == ifp)
1007 defrtrlist_del(dr, 1);
1008 }
1009
1010 /* Nuke prefix list entries toward ifp */
1011 for (pr = nd_prefix.lh_first; pr; pr = npr) {
1012 npr = pr->ndpr_next;
1013 if (pr->ndpr_ifp == ifp) {
1014 /*
1015 * Previously, pr->ndpr_addr is removed as well,
1016 * but I strongly believe we don't have to do it.
1017 * nd6_purge() is only called from in6_ifdetach(),
1018 * which removes all the associated interface addresses
1019 * by itself.
1020 * (jinmei@kame.net 20010129)
1021 */
1022 prelist_remove(pr, 1);
1023 }
1024 }
1025
1026 /* cancel default outgoing interface setting */
1027 if (nd6_defifindex == ifp->if_index) {
1028 /* Release nd6_mutex as it will be acquired
1029 * during nd6_setdefaultiface again
1030 */
1031 lck_mtx_unlock(nd6_mutex);
1032 nd6_setdefaultiface(0);
1033 lck_mtx_lock(nd6_mutex);
1034 }
1035
1036 if (!ip6_forwarding && (ip6_accept_rtadv || (ifp->if_eflags & IFEF_ACCEPT_RTADVD))) {
1037 /* refresh default router list */
1038 bzero(&drany, sizeof(drany));
1039 defrouter_delreq(&drany, 0);
1040 defrouter_select();
1041 }
1042 lck_mtx_unlock(nd6_mutex);
1043
1044 /*
1045 * Nuke neighbor cache entries for the ifp.
1046 * Note that rt->rt_ifp may not be the same as ifp,
1047 * due to KAME goto ours hack. See RTM_RESOLVE case in
1048 * nd6_rtrequest(), and ip6_input().
1049 */
1050 again:
1051 lck_mtx_lock(rnh_lock);
1052 ln = llinfo_nd6.ln_next;
1053 while (ln != NULL && ln != &llinfo_nd6) {
1054 struct rtentry *rt;
1055 struct llinfo_nd6 *nln;
1056
1057 nln = ln->ln_next;
1058 rt = ln->ln_rt;
1059 RT_LOCK(rt);
1060 if (rt->rt_gateway != NULL &&
1061 rt->rt_gateway->sa_family == AF_LINK &&
1062 SDL(rt->rt_gateway)->sdl_index == ifp->if_index) {
1063 RT_UNLOCK(rt);
1064 lck_mtx_unlock(rnh_lock);
1065 /*
1066 * See comments on nd6_timer() for reasons why
1067 * this loop is repeated; we bite the costs of
1068 * going thru the same llinfo_nd6 more than once
1069 * here, since this purge happens during detach,
1070 * and that unlike the timer case, it's possible
1071 * there's more than one purges happening at the
1072 * same time (thus a flag wouldn't buy anything).
1073 */
1074 nd6_free(rt);
1075 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1076 goto again;
1077 } else {
1078 RT_UNLOCK(rt);
1079 }
1080 ln = nln;
1081 }
1082 lck_mtx_unlock(rnh_lock);
1083 }
1084
1085 /*
1086 * Upon success, the returned route will be locked and the caller is
1087 * responsible for releasing the reference and doing RT_UNLOCK(rt).
1088 * This routine does not require rnh_lock to be held by the caller,
1089 * although it needs to be indicated of such a case in order to call
1090 * the correct variant of the relevant routing routines.
1091 */
1092 struct rtentry *
1093 nd6_lookup(
1094 struct in6_addr *addr6,
1095 int create,
1096 struct ifnet *ifp,
1097 int rt_locked)
1098 {
1099 struct rtentry *rt;
1100 struct sockaddr_in6 sin6;
1101
1102 bzero(&sin6, sizeof(sin6));
1103 sin6.sin6_len = sizeof(struct sockaddr_in6);
1104 sin6.sin6_family = AF_INET6;
1105 sin6.sin6_addr = *addr6;
1106 #if SCOPEDROUTING
1107 sin6.sin6_scope_id = in6_addr2scopeid(ifp, addr6);
1108 #endif
1109 if (rt_locked)
1110 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED);
1111
1112 rt = rt_locked ? rtalloc1_locked((struct sockaddr *)&sin6, create, 0) :
1113 rtalloc1((struct sockaddr *)&sin6, create, 0);
1114
1115 if (rt != NULL) {
1116 RT_LOCK(rt);
1117 if ((rt->rt_flags & RTF_LLINFO) == 0) {
1118 /*
1119 * This is the case for the default route. If we
1120 * want to create a neighbor cache for the address,
1121 * we should free the route for the destination and
1122 * allocate an interface route.
1123 */
1124 if (create) {
1125 RT_UNLOCK(rt);
1126 if (rt_locked)
1127 rtfree_locked(rt);
1128 else
1129 rtfree(rt);
1130 rt = NULL;
1131 }
1132 }
1133 }
1134 if (rt == NULL) {
1135 if (create && ifp) {
1136 struct ifaddr *ifa;
1137 int e;
1138
1139 /*
1140 * If no route is available and create is set,
1141 * we allocate a host route for the destination
1142 * and treat it like an interface route.
1143 * This hack is necessary for a neighbor which can't
1144 * be covered by our own prefix.
1145 */
1146 ifa = ifaof_ifpforaddr((struct sockaddr *)&sin6, ifp);
1147 if (ifa == NULL)
1148 return(NULL);
1149
1150 /*
1151 * Create a new route. RTF_LLINFO is necessary
1152 * to create a Neighbor Cache entry for the
1153 * destination in nd6_rtrequest which will be
1154 * called in rtrequest via ifa->ifa_rtrequest.
1155 */
1156 if (!rt_locked)
1157 lck_mtx_lock(rnh_lock);
1158 if ((e = rtrequest_locked(RTM_ADD,
1159 (struct sockaddr *)&sin6, ifa->ifa_addr,
1160 (struct sockaddr *)&all1_sa,
1161 (ifa->ifa_flags | RTF_HOST | RTF_LLINFO) &
1162 ~RTF_CLONING, &rt)) != 0) {
1163 if (e != EEXIST)
1164 log(LOG_ERR, "%s: failed to add route "
1165 "for a neighbor(%s), errno=%d\n",
1166 __func__, ip6_sprintf(addr6), e);
1167 }
1168 if (!rt_locked)
1169 lck_mtx_unlock(rnh_lock);
1170 ifafree(ifa);
1171 if (rt == NULL)
1172 return(NULL);
1173
1174 RT_LOCK(rt);
1175 if (rt->rt_llinfo) {
1176 struct llinfo_nd6 *ln = rt->rt_llinfo;
1177 ln->ln_state = ND6_LLINFO_NOSTATE;
1178 }
1179 } else {
1180 return(NULL);
1181 }
1182 }
1183 RT_LOCK_ASSERT_HELD(rt);
1184 /*
1185 * Validation for the entry.
1186 * Note that the check for rt_llinfo is necessary because a cloned
1187 * route from a parent route that has the L flag (e.g. the default
1188 * route to a p2p interface) may have the flag, too, while the
1189 * destination is not actually a neighbor.
1190 * XXX: we can't use rt->rt_ifp to check for the interface, since
1191 * it might be the loopback interface if the entry is for our
1192 * own address on a non-loopback interface. Instead, we should
1193 * use rt->rt_ifa->ifa_ifp, which would specify the REAL
1194 * interface.
1195 */
1196 if (((ifp && (ifp->if_type != IFT_PPP)) && ((ifp->if_eflags & IFEF_NOAUTOIPV6LL) == 0)) &&
1197 ((rt->rt_flags & RTF_GATEWAY) || (rt->rt_flags & RTF_LLINFO) == 0 ||
1198 rt->rt_gateway->sa_family != AF_LINK || rt->rt_llinfo == NULL ||
1199 (ifp && rt->rt_ifa->ifa_ifp != ifp))) {
1200 RT_REMREF_LOCKED(rt);
1201 RT_UNLOCK(rt);
1202 if (create) {
1203 log(LOG_DEBUG, "%s: failed to lookup %s "
1204 "(if = %s)\n", __func__, ip6_sprintf(addr6),
1205 ifp ? if_name(ifp) : "unspec");
1206 /* xxx more logs... kazu */
1207 }
1208 return(NULL);
1209 }
1210 /*
1211 * Caller needs to release reference and call RT_UNLOCK(rt).
1212 */
1213 return(rt);
1214 }
1215
1216 /*
1217 * Detect if a given IPv6 address identifies a neighbor on a given link.
1218 * XXX: should take care of the destination of a p2p link?
1219 */
1220 int
1221 nd6_is_addr_neighbor(
1222 struct sockaddr_in6 *addr,
1223 struct ifnet *ifp,
1224 int rt_locked)
1225 {
1226 struct ifaddr *ifa;
1227 struct rtentry *rt;
1228 int i;
1229
1230 #define IFADDR6(a) ((((struct in6_ifaddr *)(a))->ia_addr).sin6_addr)
1231 #define IFMASK6(a) ((((struct in6_ifaddr *)(a))->ia_prefixmask).sin6_addr)
1232
1233 /*
1234 * A link-local address is always a neighbor.
1235 * XXX: we should use the sin6_scope_id field rather than the embedded
1236 * interface index.
1237 */
1238 if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr) &&
1239 ntohs(*(u_int16_t *)&addr->sin6_addr.s6_addr[2]) == ifp->if_index)
1240 return(1);
1241
1242 /*
1243 * If the address matches one of our addresses,
1244 * it should be a neighbor.
1245 */
1246 ifnet_lock_shared(ifp);
1247 for (ifa = ifp->if_addrlist.tqh_first;
1248 ifa;
1249 ifa = ifa->ifa_list.tqe_next)
1250 {
1251 if (ifa->ifa_addr->sa_family != AF_INET6)
1252 continue;
1253
1254 for (i = 0; i < 4; i++) {
1255 if ((IFADDR6(ifa).s6_addr32[i] ^
1256 addr->sin6_addr.s6_addr32[i]) &
1257 IFMASK6(ifa).s6_addr32[i])
1258 continue;
1259 }
1260 ifnet_lock_done(ifp);
1261 return(1);
1262 }
1263 ifnet_lock_done(ifp);
1264
1265 /*
1266 * Even if the address matches none of our addresses, it might be
1267 * in the neighbor cache. Callee returns a locked route upon
1268 * success.
1269 */
1270 if ((rt = nd6_lookup(&addr->sin6_addr, 0, ifp, rt_locked)) != NULL) {
1271 RT_LOCK_ASSERT_HELD(rt);
1272 RT_REMREF_LOCKED(rt);
1273 RT_UNLOCK(rt);
1274 return(1);
1275 }
1276
1277 return(0);
1278 #undef IFADDR6
1279 #undef IFMASK6
1280 }
1281
1282 /*
1283 * Free an nd6 llinfo entry.
1284 */
1285 void
1286 nd6_free(
1287 struct rtentry *rt)
1288 {
1289 struct llinfo_nd6 *ln;
1290 struct in6_addr in6;
1291 struct nd_defrouter *dr;
1292
1293 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_NOTOWNED);
1294 RT_LOCK_ASSERT_NOTHELD(rt);
1295 lck_mtx_lock(nd6_mutex);
1296
1297 RT_LOCK(rt);
1298 RT_ADDREF_LOCKED(rt); /* Extra ref */
1299 ln = rt->rt_llinfo;
1300 in6 = ((struct sockaddr_in6 *)rt_key(rt))->sin6_addr;
1301
1302 /*
1303 * Prevent another thread from modifying rt_key, rt_gateway
1304 * via rt_setgate() after the rt_lock is dropped by marking
1305 * the route as defunct.
1306 */
1307 rt->rt_flags |= RTF_CONDEMNED;
1308
1309 /*
1310 * we used to have pfctlinput(PRC_HOSTDEAD) here.
1311 * even though it is not harmful, it was not really necessary.
1312 */
1313
1314 if (!ip6_forwarding && (ip6_accept_rtadv ||
1315 (rt->rt_ifp->if_eflags & IFEF_ACCEPT_RTADVD))) {
1316 dr = defrouter_lookup(&((struct sockaddr_in6 *)rt_key(rt))->
1317 sin6_addr, rt->rt_ifp);
1318
1319 if ((ln && ln->ln_router) || dr) {
1320 /*
1321 * rt6_flush must be called whether or not the neighbor
1322 * is in the Default Router List.
1323 * See a corresponding comment in nd6_na_input().
1324 */
1325 RT_UNLOCK(rt);
1326 rt6_flush(&in6, rt->rt_ifp);
1327 } else {
1328 RT_UNLOCK(rt);
1329 }
1330
1331 if (dr) {
1332 /*
1333 * Unreachablity of a router might affect the default
1334 * router selection and on-link detection of advertised
1335 * prefixes.
1336 */
1337
1338 /*
1339 * Temporarily fake the state to choose a new default
1340 * router and to perform on-link determination of
1341 * prefixes correctly.
1342 * Below the state will be set correctly,
1343 * or the entry itself will be deleted.
1344 */
1345 RT_LOCK_SPIN(rt);
1346 ln->ln_state = ND6_LLINFO_INCOMPLETE;
1347
1348 /*
1349 * Since defrouter_select() does not affect the
1350 * on-link determination and MIP6 needs the check
1351 * before the default router selection, we perform
1352 * the check now.
1353 */
1354 RT_UNLOCK(rt);
1355 pfxlist_onlink_check(1);
1356
1357 if (dr == TAILQ_FIRST(&nd_defrouter)) {
1358 /*
1359 * It is used as the current default router,
1360 * so we have to move it to the end of the
1361 * list and choose a new one.
1362 * XXX: it is not very efficient if this is
1363 * the only router.
1364 */
1365 TAILQ_REMOVE(&nd_defrouter, dr, dr_entry);
1366 TAILQ_INSERT_TAIL(&nd_defrouter, dr, dr_entry);
1367
1368 defrouter_select();
1369 }
1370 }
1371 RT_LOCK_ASSERT_NOTHELD(rt);
1372 } else {
1373 RT_UNLOCK(rt);
1374 }
1375
1376 lck_mtx_unlock(nd6_mutex);
1377 /*
1378 * Detach the route from the routing tree and the list of neighbor
1379 * caches, and disable the route entry not to be used in already
1380 * cached routes.
1381 */
1382 (void) rtrequest(RTM_DELETE, rt_key(rt), (struct sockaddr *)0,
1383 rt_mask(rt), 0, (struct rtentry **)0);
1384
1385 /* Extra ref held above; now free it */
1386 rtfree(rt);
1387 }
1388
1389 /*
1390 * Upper-layer reachability hint for Neighbor Unreachability Detection.
1391 *
1392 * XXX cost-effective metods?
1393 */
1394 void
1395 nd6_nud_hint(
1396 struct rtentry *rt,
1397 struct in6_addr *dst6,
1398 int force)
1399 {
1400 struct llinfo_nd6 *ln;
1401 struct timeval timenow;
1402
1403 getmicrotime(&timenow);
1404
1405 /*
1406 * If the caller specified "rt", use that. Otherwise, resolve the
1407 * routing table by supplied "dst6".
1408 */
1409 if (!rt) {
1410 if (!dst6)
1411 return;
1412 /* Callee returns a locked route upon success */
1413 if ((rt = nd6_lookup(dst6, 0, NULL, 0)) == NULL)
1414 return;
1415 RT_LOCK_ASSERT_HELD(rt);
1416 } else {
1417 RT_LOCK(rt);
1418 RT_ADDREF_LOCKED(rt);
1419 }
1420
1421 if ((rt->rt_flags & RTF_GATEWAY) != 0 ||
1422 (rt->rt_flags & RTF_LLINFO) == 0 ||
1423 !rt->rt_llinfo || !rt->rt_gateway ||
1424 rt->rt_gateway->sa_family != AF_LINK) {
1425 /* This is not a host route. */
1426 goto done;
1427 }
1428
1429 ln = rt->rt_llinfo;
1430 if (ln->ln_state < ND6_LLINFO_REACHABLE)
1431 goto done;
1432
1433 /*
1434 * if we get upper-layer reachability confirmation many times,
1435 * it is possible we have false information.
1436 */
1437 if (!force) {
1438 ln->ln_byhint++;
1439 if (ln->ln_byhint > nd6_maxnudhint)
1440 goto done;
1441 }
1442
1443 ln->ln_state = ND6_LLINFO_REACHABLE;
1444 if (ln->ln_expire) {
1445 lck_rw_lock_shared(nd_if_rwlock);
1446 ln->ln_expire = rt_expiry(rt, timenow.tv_sec,
1447 nd_ifinfo[rt->rt_ifp->if_index].reachable);
1448 lck_rw_done(nd_if_rwlock);
1449 }
1450 done:
1451 RT_REMREF_LOCKED(rt);
1452 RT_UNLOCK(rt);
1453 }
1454
1455 void
1456 nd6_rtrequest(
1457 int req,
1458 struct rtentry *rt,
1459 __unused struct sockaddr *sa)
1460 {
1461 struct sockaddr *gate = rt->rt_gateway;
1462 struct llinfo_nd6 *ln = rt->rt_llinfo;
1463 static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK, 0, 0, 0, 0, 0,
1464 {0,0,0,0,0,0,0,0,0,0,0,0,} };
1465 struct ifnet *ifp = rt->rt_ifp;
1466 struct ifaddr *ifa;
1467 struct timeval timenow;
1468
1469 lck_mtx_assert(rnh_lock, LCK_MTX_ASSERT_OWNED);
1470 RT_LOCK_ASSERT_HELD(rt);
1471
1472 if ((rt->rt_flags & RTF_GATEWAY))
1473 return;
1474
1475 if (nd6_need_cache(ifp) == 0 && (rt->rt_flags & RTF_HOST) == 0) {
1476 /*
1477 * This is probably an interface direct route for a link
1478 * which does not need neighbor caches (e.g. fe80::%lo0/64).
1479 * We do not need special treatment below for such a route.
1480 * Moreover, the RTF_LLINFO flag which would be set below
1481 * would annoy the ndp(8) command.
1482 */
1483 return;
1484 }
1485
1486 if (req == RTM_RESOLVE) {
1487 int no_nd_cache;
1488
1489 if (!nd6_need_cache(ifp)) { /* stf case */
1490 no_nd_cache = 1;
1491 } else {
1492 /*
1493 * nd6_is_addr_neighbor() may call nd6_lookup(),
1494 * therefore we drop rt_lock to avoid deadlock
1495 * during the lookup. Using rt_key(rt) is still
1496 * safe because it won't change while rnh_lock
1497 * is held.
1498 */
1499 RT_ADDREF_LOCKED(rt);
1500 RT_UNLOCK(rt);
1501 no_nd_cache = !nd6_is_addr_neighbor(
1502 (struct sockaddr_in6 *)rt_key(rt), ifp, 1);
1503 RT_LOCK(rt);
1504 RT_REMREF_LOCKED(rt);
1505 }
1506
1507 /*
1508 * FreeBSD and BSD/OS often make a cloned host route based
1509 * on a less-specific route (e.g. the default route).
1510 * If the less specific route does not have a "gateway"
1511 * (this is the case when the route just goes to a p2p or an
1512 * stf interface), we'll mistakenly make a neighbor cache for
1513 * the host route, and will see strange neighbor solicitation
1514 * for the corresponding destination. In order to avoid the
1515 * confusion, we check if the destination of the route is
1516 * a neighbor in terms of neighbor discovery, and stop the
1517 * process if not. Additionally, we remove the LLINFO flag
1518 * so that ndp(8) will not try to get the neighbor information
1519 * of the destination.
1520 */
1521 if (no_nd_cache) {
1522 rt->rt_flags &= ~RTF_LLINFO;
1523 return;
1524 }
1525 }
1526
1527 getmicrotime(&timenow);
1528 switch (req) {
1529 case RTM_ADD:
1530 /*
1531 * There is no backward compatibility :)
1532 *
1533 * if ((rt->rt_flags & RTF_HOST) == 0 &&
1534 * SIN(rt_mask(rt))->sin_addr.s_addr != 0xffffffff)
1535 * rt->rt_flags |= RTF_CLONING;
1536 */
1537 if (rt->rt_flags & (RTF_CLONING | RTF_LLINFO)) {
1538 /*
1539 * Case 1: This route should come from
1540 * a route to interface. RTF_LLINFO flag is set
1541 * for a host route whose destination should be
1542 * treated as on-link.
1543 */
1544 if (rt_setgate(rt, rt_key(rt),
1545 (struct sockaddr *)&null_sdl) == 0) {
1546 gate = rt->rt_gateway;
1547 SDL(gate)->sdl_type = ifp->if_type;
1548 SDL(gate)->sdl_index = ifp->if_index;
1549 /*
1550 * In case we're called before 1.0 sec.
1551 * has elapsed.
1552 */
1553 if (ln != NULL)
1554 ln->ln_expire = MAX(timenow.tv_sec, 1);
1555 }
1556 if ((rt->rt_flags & RTF_CLONING))
1557 break;
1558 }
1559 /*
1560 * In IPv4 code, we try to annonuce new RTF_ANNOUNCE entry here.
1561 * We don't do that here since llinfo is not ready yet.
1562 *
1563 * There are also couple of other things to be discussed:
1564 * - unsolicited NA code needs improvement beforehand
1565 * - RFC2461 says we MAY send multicast unsolicited NA
1566 * (7.2.6 paragraph 4), however, it also says that we
1567 * SHOULD provide a mechanism to prevent multicast NA storm.
1568 * we don't have anything like it right now.
1569 * note that the mechanism needs a mutual agreement
1570 * between proxies, which means that we need to implement
1571 * a new protocol, or a new kludge.
1572 * - from RFC2461 6.2.4, host MUST NOT send an unsolicited NA.
1573 * we need to check ip6forwarding before sending it.
1574 * (or should we allow proxy ND configuration only for
1575 * routers? there's no mention about proxy ND from hosts)
1576 */
1577 #if 0
1578 /* XXX it does not work */
1579 if (rt->rt_flags & RTF_ANNOUNCE)
1580 nd6_na_output(ifp,
1581 &SIN6(rt_key(rt))->sin6_addr,
1582 &SIN6(rt_key(rt))->sin6_addr,
1583 ip6_forwarding ? ND_NA_FLAG_ROUTER : 0,
1584 1, NULL);
1585 #endif
1586 /* FALLTHROUGH */
1587 case RTM_RESOLVE:
1588 if ((ifp->if_flags & (IFF_POINTOPOINT | IFF_LOOPBACK)) == 0) {
1589 /*
1590 * Address resolution isn't necessary for a point to
1591 * point link, so we can skip this test for a p2p link.
1592 */
1593 if (gate->sa_family != AF_LINK ||
1594 gate->sa_len < sizeof(null_sdl)) {
1595 log(LOG_DEBUG,
1596 "nd6_rtrequest: bad gateway value: %s\n",
1597 if_name(ifp));
1598 break;
1599 }
1600 SDL(gate)->sdl_type = ifp->if_type;
1601 SDL(gate)->sdl_index = ifp->if_index;
1602 }
1603 if (ln != NULL)
1604 break; /* This happens on a route change */
1605 /*
1606 * Case 2: This route may come from cloning, or a manual route
1607 * add with a LL address.
1608 */
1609 rt->rt_llinfo = ln = nd6_llinfo_alloc();
1610 if (ln == NULL) {
1611 log(LOG_DEBUG, "nd6_rtrequest: malloc failed\n");
1612 break;
1613 }
1614 rt->rt_llinfo_free = nd6_llinfo_free;
1615
1616 nd6_inuse++;
1617 nd6_allocated++;
1618 Bzero(ln, sizeof(*ln));
1619 ln->ln_rt = rt;
1620 /* this is required for "ndp" command. - shin */
1621 if (req == RTM_ADD) {
1622 /*
1623 * gate should have some valid AF_LINK entry,
1624 * and ln->ln_expire should have some lifetime
1625 * which is specified by ndp command.
1626 */
1627 ln->ln_state = ND6_LLINFO_REACHABLE;
1628 ln->ln_byhint = 0;
1629 } else {
1630 /*
1631 * When req == RTM_RESOLVE, rt is created and
1632 * initialized in rtrequest(), so rt_expire is 0.
1633 */
1634 ln->ln_state = ND6_LLINFO_NOSTATE;
1635 /* In case we're called before 1.0 sec. has elapsed */
1636 ln->ln_expire = MAX(timenow.tv_sec, 1);
1637 }
1638 rt->rt_flags |= RTF_LLINFO;
1639 LN_INSERTHEAD(ln);
1640
1641 /*
1642 * If we have too many cache entries, initiate immediate
1643 * purging for some "less recently used" entries. Note that
1644 * we cannot directly call nd6_free() here because it would
1645 * cause re-entering rtable related routines triggering an LOR
1646 * problem.
1647 */
1648 if (ip6_neighborgcthresh >= 0 &&
1649 nd6_inuse >= ip6_neighborgcthresh) {
1650 int i;
1651
1652 for (i = 0; i < 10 && llinfo_nd6.ln_prev != ln; i++) {
1653 struct llinfo_nd6 *ln_end = llinfo_nd6.ln_prev;
1654 struct rtentry *rt_end = ln_end->ln_rt;
1655
1656 /* Move this entry to the head */
1657 RT_LOCK(rt_end);
1658 LN_DEQUEUE(ln_end);
1659 LN_INSERTHEAD(ln_end);
1660
1661 if (ln_end->ln_expire == 0) {
1662 RT_UNLOCK(rt_end);
1663 continue;
1664 }
1665 if (ln_end->ln_state > ND6_LLINFO_INCOMPLETE)
1666 ln_end->ln_state = ND6_LLINFO_STALE;
1667 else
1668 ln_end->ln_state = ND6_LLINFO_PURGE;
1669 ln_end->ln_expire = timenow.tv_sec;
1670 RT_UNLOCK(rt_end);
1671 }
1672 }
1673
1674 /*
1675 * check if rt_key(rt) is one of my address assigned
1676 * to the interface.
1677 */
1678 ifa = (struct ifaddr *)in6ifa_ifpwithaddr(rt->rt_ifp,
1679 &SIN6(rt_key(rt))->sin6_addr);
1680 if (ifa) {
1681 caddr_t macp = nd6_ifptomac(ifp);
1682 ln->ln_expire = 0;
1683 ln->ln_state = ND6_LLINFO_REACHABLE;
1684 ln->ln_byhint = 0;
1685 if (macp) {
1686 Bcopy(macp, LLADDR(SDL(gate)), ifp->if_addrlen);
1687 SDL(gate)->sdl_alen = ifp->if_addrlen;
1688 }
1689 if (nd6_useloopback) {
1690 #if IFNET_ROUTE_REFCNT
1691 /* Adjust route ref count for the interfaces */
1692 if (rt->rt_if_ref_fn != NULL &&
1693 rt->rt_ifp != lo_ifp) {
1694 rt->rt_if_ref_fn(lo_ifp, 1);
1695 rt->rt_if_ref_fn(rt->rt_ifp, -1);
1696 }
1697 #endif /* IFNET_ROUTE_REFCNT */
1698 rt->rt_ifp = lo_ifp; /* XXX */
1699 /*
1700 * Make sure rt_ifa be equal to the ifaddr
1701 * corresponding to the address.
1702 * We need this because when we refer
1703 * rt_ifa->ia6_flags in ip6_input, we assume
1704 * that the rt_ifa points to the address instead
1705 * of the loopback address.
1706 */
1707 if (ifa != rt->rt_ifa) {
1708 rtsetifa(rt, ifa);
1709 }
1710 }
1711 ifafree(ifa);
1712 } else if (rt->rt_flags & RTF_ANNOUNCE) {
1713 ln->ln_expire = 0;
1714 ln->ln_state = ND6_LLINFO_REACHABLE;
1715 ln->ln_byhint = 0;
1716
1717 /* join solicited node multicast for proxy ND */
1718 if (ifp->if_flags & IFF_MULTICAST) {
1719 struct in6_addr llsol;
1720 int error;
1721
1722 llsol = SIN6(rt_key(rt))->sin6_addr;
1723 llsol.s6_addr16[0] = htons(0xff02);
1724 llsol.s6_addr16[1] = htons(ifp->if_index);
1725 llsol.s6_addr32[1] = 0;
1726 llsol.s6_addr32[2] = htonl(1);
1727 llsol.s6_addr8[12] = 0xff;
1728
1729 if (!in6_addmulti(&llsol, ifp, &error, 0)) {
1730 nd6log((LOG_ERR, "%s: failed to join "
1731 "%s (errno=%d)\n", if_name(ifp),
1732 ip6_sprintf(&llsol), error));
1733 }
1734 }
1735 }
1736 break;
1737
1738 case RTM_DELETE:
1739 if (!ln)
1740 break;
1741 /* leave from solicited node multicast for proxy ND */
1742 if ((rt->rt_flags & RTF_ANNOUNCE) != 0 &&
1743 (ifp->if_flags & IFF_MULTICAST) != 0) {
1744 struct in6_addr llsol;
1745 struct in6_multi *in6m;
1746
1747 llsol = SIN6(rt_key(rt))->sin6_addr;
1748 llsol.s6_addr16[0] = htons(0xff02);
1749 llsol.s6_addr16[1] = htons(ifp->if_index);
1750 llsol.s6_addr32[1] = 0;
1751 llsol.s6_addr32[2] = htonl(1);
1752 llsol.s6_addr8[12] = 0xff;
1753
1754 ifnet_lock_shared(ifp);
1755 IN6_LOOKUP_MULTI(llsol, ifp, in6m);
1756 ifnet_lock_done(ifp);
1757 if (in6m)
1758 in6_delmulti(in6m, 0);
1759 }
1760 nd6_inuse--;
1761 /*
1762 * Unchain it but defer the actual freeing until the route
1763 * itself is to be freed. rt->rt_llinfo still points to
1764 * llinfo_nd6, and likewise, ln->ln_rt stil points to this
1765 * route entry, except that RTF_LLINFO is now cleared.
1766 */
1767 if (ln->ln_flags & ND6_LNF_IN_USE)
1768 LN_DEQUEUE(ln);
1769 rt->rt_flags &= ~RTF_LLINFO;
1770 if (ln->ln_hold != NULL)
1771 m_freem(ln->ln_hold);
1772 ln->ln_hold = NULL;
1773 }
1774 }
1775
1776 static void
1777 nd6_siocgdrlst(void *data, int data_is_64)
1778 {
1779 struct in6_drlist_64 *drl_64 = (struct in6_drlist_64 *)data;
1780 struct in6_drlist_32 *drl_32 = (struct in6_drlist_32 *)data;
1781 struct nd_defrouter *dr;
1782 int i = 0;
1783
1784 lck_mtx_assert(nd6_mutex, LCK_MTX_ASSERT_OWNED);
1785
1786 bzero(data, data_is_64 ? sizeof (*drl_64) : sizeof (*drl_32));
1787 dr = TAILQ_FIRST(&nd_defrouter);
1788 if (data_is_64) {
1789 /* For 64-bit process */
1790 while (dr && i < DRLSTSIZ) {
1791 drl_64->defrouter[i].rtaddr = dr->rtaddr;
1792 if (IN6_IS_ADDR_LINKLOCAL(&drl_64->defrouter[i].rtaddr)) {
1793 /* XXX: need to this hack for KAME stack */
1794 drl_64->defrouter[i].rtaddr.s6_addr16[1] = 0;
1795 } else {
1796 log(LOG_ERR,
1797 "default router list contains a "
1798 "non-linklocal address(%s)\n",
1799 ip6_sprintf(&drl_64->defrouter[i].rtaddr));
1800 }
1801 drl_64->defrouter[i].flags = dr->flags;
1802 drl_64->defrouter[i].rtlifetime = dr->rtlifetime;
1803 drl_64->defrouter[i].expire = dr->expire;
1804 drl_64->defrouter[i].if_index = dr->ifp->if_index;
1805 i++;
1806 dr = TAILQ_NEXT(dr, dr_entry);
1807 }
1808 return;
1809 }
1810 /* For 32-bit process */
1811 while (dr && i < DRLSTSIZ) {
1812 drl_32->defrouter[i].rtaddr = dr->rtaddr;
1813 if (IN6_IS_ADDR_LINKLOCAL(&drl_32->defrouter[i].rtaddr)) {
1814 /* XXX: need to this hack for KAME stack */
1815 drl_32->defrouter[i].rtaddr.s6_addr16[1] = 0;
1816 } else {
1817 log(LOG_ERR,
1818 "default router list contains a "
1819 "non-linklocal address(%s)\n",
1820 ip6_sprintf(&drl_32->defrouter[i].rtaddr));
1821 }
1822 drl_32->defrouter[i].flags = dr->flags;
1823 drl_32->defrouter[i].rtlifetime = dr->rtlifetime;
1824 drl_32->defrouter[i].expire = dr->expire;
1825 drl_32->defrouter[i].if_index = dr->ifp->if_index;
1826 i++;
1827 dr = TAILQ_NEXT(dr, dr_entry);
1828 }
1829 }
1830
1831 static void
1832 nd6_siocgprlst(void *data, int data_is_64)
1833 {
1834 struct in6_prlist_64 *prl_64 = (struct in6_prlist_64 *)data;
1835 struct in6_prlist_32 *prl_32 = (struct in6_prlist_32 *)data;
1836 struct nd_prefix *pr;
1837 struct rr_prefix *rpp;
1838 int i = 0;
1839
1840 lck_mtx_assert(nd6_mutex, LCK_MTX_ASSERT_OWNED);
1841 /*
1842 * XXX meaning of fields, especialy "raflags", is very
1843 * differnet between RA prefix list and RR/static prefix list.
1844 * how about separating ioctls into two?
1845 */
1846 bzero(data, data_is_64 ? sizeof (*prl_64) : sizeof (*prl_32));
1847 pr = nd_prefix.lh_first;
1848 if (data_is_64) {
1849 /* For 64-bit process */
1850 while (pr && i < PRLSTSIZ) {
1851 struct nd_pfxrouter *pfr;
1852 int j;
1853
1854 (void) in6_embedscope(&prl_64->prefix[i].prefix,
1855 &pr->ndpr_prefix, NULL, NULL);
1856 prl_64->prefix[i].raflags = pr->ndpr_raf;
1857 prl_64->prefix[i].prefixlen = pr->ndpr_plen;
1858 prl_64->prefix[i].vltime = pr->ndpr_vltime;
1859 prl_64->prefix[i].pltime = pr->ndpr_pltime;
1860 prl_64->prefix[i].if_index = pr->ndpr_ifp->if_index;
1861 prl_64->prefix[i].expire = pr->ndpr_expire;
1862
1863 pfr = pr->ndpr_advrtrs.lh_first;
1864 j = 0;
1865 while (pfr) {
1866 if (j < DRLSTSIZ) {
1867 #define RTRADDR prl_64->prefix[i].advrtr[j]
1868 RTRADDR = pfr->router->rtaddr;
1869 if (IN6_IS_ADDR_LINKLOCAL(&RTRADDR)) {
1870 /* XXX: hack for KAME */
1871 RTRADDR.s6_addr16[1] = 0;
1872 } else {
1873 log(LOG_ERR,
1874 "a router(%s) advertises "
1875 "a prefix with "
1876 "non-link local address\n",
1877 ip6_sprintf(&RTRADDR));
1878 }
1879 #undef RTRADDR
1880 }
1881 j++;
1882 pfr = pfr->pfr_next;
1883 }
1884 prl_64->prefix[i].advrtrs = j;
1885 prl_64->prefix[i].origin = PR_ORIG_RA;
1886
1887 i++;
1888 pr = pr->ndpr_next;
1889 }
1890
1891 for (rpp = LIST_FIRST(&rr_prefix); rpp;
1892 rpp = LIST_NEXT(rpp, rp_entry)) {
1893 if (i >= PRLSTSIZ)
1894 break;
1895 (void) in6_embedscope(&prl_64->prefix[i].prefix,
1896 &pr->ndpr_prefix, NULL, NULL);
1897 prl_64->prefix[i].raflags = rpp->rp_raf;
1898 prl_64->prefix[i].prefixlen = rpp->rp_plen;
1899 prl_64->prefix[i].vltime = rpp->rp_vltime;
1900 prl_64->prefix[i].pltime = rpp->rp_pltime;
1901 prl_64->prefix[i].if_index = rpp->rp_ifp->if_index;
1902 prl_64->prefix[i].expire = rpp->rp_expire;
1903 prl_64->prefix[i].advrtrs = 0;
1904 prl_64->prefix[i].origin = rpp->rp_origin;
1905 i++;
1906 }
1907 return;
1908 }
1909 /* For 32-bit process */
1910 while (pr && i < PRLSTSIZ) {
1911 struct nd_pfxrouter *pfr;
1912 int j;
1913
1914 (void) in6_embedscope(&prl_32->prefix[i].prefix,
1915 &pr->ndpr_prefix, NULL, NULL);
1916 prl_32->prefix[i].raflags = pr->ndpr_raf;
1917 prl_32->prefix[i].prefixlen = pr->ndpr_plen;
1918 prl_32->prefix[i].vltime = pr->ndpr_vltime;
1919 prl_32->prefix[i].pltime = pr->ndpr_pltime;
1920 prl_32->prefix[i].if_index = pr->ndpr_ifp->if_index;
1921 prl_32->prefix[i].expire = pr->ndpr_expire;
1922
1923 pfr = pr->ndpr_advrtrs.lh_first;
1924 j = 0;
1925 while (pfr) {
1926 if (j < DRLSTSIZ) {
1927 #define RTRADDR prl_32->prefix[i].advrtr[j]
1928 RTRADDR = pfr->router->rtaddr;
1929 if (IN6_IS_ADDR_LINKLOCAL(&RTRADDR)) {
1930 /* XXX: hack for KAME */
1931 RTRADDR.s6_addr16[1] = 0;
1932 } else {
1933 log(LOG_ERR,
1934 "a router(%s) advertises "
1935 "a prefix with "
1936 "non-link local address\n",
1937 ip6_sprintf(&RTRADDR));
1938 }
1939 #undef RTRADDR
1940 }
1941 j++;
1942 pfr = pfr->pfr_next;
1943 }
1944 prl_32->prefix[i].advrtrs = j;
1945 prl_32->prefix[i].origin = PR_ORIG_RA;
1946
1947 i++;
1948 pr = pr->ndpr_next;
1949 }
1950
1951 for (rpp = LIST_FIRST(&rr_prefix); rpp;
1952 rpp = LIST_NEXT(rpp, rp_entry)) {
1953 if (i >= PRLSTSIZ)
1954 break;
1955 (void) in6_embedscope(&prl_32->prefix[i].prefix,
1956 &pr->ndpr_prefix, NULL, NULL);
1957 prl_32->prefix[i].raflags = rpp->rp_raf;
1958 prl_32->prefix[i].prefixlen = rpp->rp_plen;
1959 prl_32->prefix[i].vltime = rpp->rp_vltime;
1960 prl_32->prefix[i].pltime = rpp->rp_pltime;
1961 prl_32->prefix[i].if_index = rpp->rp_ifp->if_index;
1962 prl_32->prefix[i].expire = rpp->rp_expire;
1963 prl_32->prefix[i].advrtrs = 0;
1964 prl_32->prefix[i].origin = rpp->rp_origin;
1965 i++;
1966 }
1967 }
1968
1969 int
1970 nd6_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp)
1971 {
1972 struct in6_ndireq *ndi = (struct in6_ndireq *)data;
1973 struct in6_ondireq *ondi = (struct in6_ondireq *)data;
1974 struct nd_defrouter *dr, any;
1975 struct nd_prefix *pr;
1976 struct rtentry *rt;
1977 int i = ifp->if_index, error = 0;
1978
1979 switch (cmd) {
1980 case SIOCGDRLST_IN6_32:
1981 case SIOCGDRLST_IN6_64:
1982 /*
1983 * obsolete API, use sysctl under net.inet6.icmp6
1984 */
1985 lck_mtx_lock(nd6_mutex);
1986 nd6_siocgdrlst(data, cmd == SIOCGDRLST_IN6_64);
1987 lck_mtx_unlock(nd6_mutex);
1988 break;
1989
1990 case SIOCGPRLST_IN6_32:
1991 case SIOCGPRLST_IN6_64:
1992 /*
1993 * obsolete API, use sysctl under net.inet6.icmp6
1994 */
1995 lck_mtx_lock(nd6_mutex);
1996 nd6_siocgprlst(data, cmd == SIOCGPRLST_IN6_64);
1997 lck_mtx_unlock(nd6_mutex);
1998 break;
1999
2000 case OSIOCGIFINFO_IN6:
2001 case SIOCGIFINFO_IN6:
2002 /*
2003 * SIOCGIFINFO_IN6 ioctl is encoded with in6_ondireq
2004 * instead of in6_ndireq, so we treat it as such.
2005 */
2006 lck_rw_lock_shared(nd_if_rwlock);
2007 if (!nd_ifinfo || i >= nd_ifinfo_indexlim) {
2008 lck_rw_done(nd_if_rwlock);
2009 error = EINVAL;
2010 break;
2011 }
2012 ondi->ndi.linkmtu = IN6_LINKMTU(ifp);
2013 ondi->ndi.maxmtu = nd_ifinfo[i].maxmtu;
2014 ondi->ndi.basereachable = nd_ifinfo[i].basereachable;
2015 ondi->ndi.reachable = nd_ifinfo[i].reachable;
2016 ondi->ndi.retrans = nd_ifinfo[i].retrans;
2017 ondi->ndi.flags = nd_ifinfo[i].flags;
2018 ondi->ndi.recalctm = nd_ifinfo[i].recalctm;
2019 ondi->ndi.chlim = nd_ifinfo[i].chlim;
2020 ondi->ndi.receivedra = nd_ifinfo[i].receivedra;
2021 lck_rw_done(nd_if_rwlock);
2022 break;
2023
2024 case SIOCSIFINFO_FLAGS:
2025 /* XXX: almost all other fields of ndi->ndi is unused */
2026 lck_rw_lock_shared(nd_if_rwlock);
2027 if (!nd_ifinfo || i >= nd_ifinfo_indexlim) {
2028 lck_rw_done(nd_if_rwlock);
2029 error = EINVAL;
2030 break;
2031 }
2032 nd_ifinfo[i].flags = ndi->ndi.flags;
2033 lck_rw_done(nd_if_rwlock);
2034 break;
2035
2036 case SIOCSNDFLUSH_IN6: /* XXX: the ioctl name is confusing... */
2037 /* flush default router list */
2038 /*
2039 * xxx sumikawa: should not delete route if default
2040 * route equals to the top of default router list
2041 */
2042 bzero(&any, sizeof(any));
2043 lck_mtx_lock(nd6_mutex);
2044 defrouter_delreq(&any, 1);
2045 defrouter_select();
2046 lck_mtx_unlock(nd6_mutex);
2047 /* xxx sumikawa: flush prefix list */
2048 break;
2049
2050 case SIOCSPFXFLUSH_IN6: {
2051 /* flush all the prefix advertised by routers */
2052 struct nd_prefix *next;
2053 lck_mtx_lock(nd6_mutex);
2054
2055 for (pr = nd_prefix.lh_first; pr; pr = next) {
2056 struct in6_ifaddr *ia, *ia_next;
2057
2058 next = pr->ndpr_next;
2059
2060 if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
2061 continue; /* XXX */
2062
2063 /* do we really have to remove addresses as well? */
2064 for (ia = in6_ifaddrs; ia; ia = ia_next) {
2065 /* ia might be removed. keep the next ptr. */
2066 ia_next = ia->ia_next;
2067
2068 if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0)
2069 continue;
2070
2071 if (ia->ia6_ndpr == pr)
2072 in6_purgeaddr(&ia->ia_ifa, 1);
2073 }
2074 prelist_remove(pr, 1);
2075 }
2076 lck_mtx_unlock(nd6_mutex);
2077 break;
2078 }
2079
2080 case SIOCSRTRFLUSH_IN6: {
2081 /* flush all the default routers */
2082 struct nd_defrouter *next;
2083
2084 lck_mtx_lock(nd6_mutex);
2085 if ((dr = TAILQ_FIRST(&nd_defrouter)) != NULL) {
2086 /*
2087 * The first entry of the list may be stored in
2088 * the routing table, so we'll delete it later.
2089 */
2090 for (dr = TAILQ_NEXT(dr, dr_entry); dr; dr = next) {
2091 next = TAILQ_NEXT(dr, dr_entry);
2092 defrtrlist_del(dr, 1);
2093 }
2094 defrtrlist_del(TAILQ_FIRST(&nd_defrouter), 1);
2095 }
2096 lck_mtx_unlock(nd6_mutex);
2097 break;
2098 }
2099
2100 case SIOCGNBRINFO_IN6_32: {
2101 struct llinfo_nd6 *ln;
2102 struct in6_nbrinfo_32 *nbi_32 = (struct in6_nbrinfo_32 *)data;
2103 /* make local for safety */
2104 struct in6_addr nb_addr = nbi_32->addr;
2105
2106 /*
2107 * XXX: KAME specific hack for scoped addresses
2108 * XXXX: for other scopes than link-local?
2109 */
2110 if (IN6_IS_ADDR_LINKLOCAL(&nbi_32->addr) ||
2111 IN6_IS_ADDR_MC_LINKLOCAL(&nbi_32->addr)) {
2112 u_int16_t *idp = (u_int16_t *)&nb_addr.s6_addr[2];
2113
2114 if (*idp == 0)
2115 *idp = htons(ifp->if_index);
2116 }
2117
2118 /* Callee returns a locked route upon success */
2119 if ((rt = nd6_lookup(&nb_addr, 0, ifp, 0)) == NULL) {
2120 error = EINVAL;
2121 break;
2122 }
2123 RT_LOCK_ASSERT_HELD(rt);
2124 ln = rt->rt_llinfo;
2125 nbi_32->state = ln->ln_state;
2126 nbi_32->asked = ln->ln_asked;
2127 nbi_32->isrouter = ln->ln_router;
2128 nbi_32->expire = ln->ln_expire;
2129 RT_REMREF_LOCKED(rt);
2130 RT_UNLOCK(rt);
2131 break;
2132 }
2133
2134 case SIOCGNBRINFO_IN6_64: {
2135 struct llinfo_nd6 *ln;
2136 struct in6_nbrinfo_64 *nbi_64 = (struct in6_nbrinfo_64 *)data;
2137 /* make local for safety */
2138 struct in6_addr nb_addr = nbi_64->addr;
2139
2140 /*
2141 * XXX: KAME specific hack for scoped addresses
2142 * XXXX: for other scopes than link-local?
2143 */
2144 if (IN6_IS_ADDR_LINKLOCAL(&nbi_64->addr) ||
2145 IN6_IS_ADDR_MC_LINKLOCAL(&nbi_64->addr)) {
2146 u_int16_t *idp = (u_int16_t *)&nb_addr.s6_addr[2];
2147
2148 if (*idp == 0)
2149 *idp = htons(ifp->if_index);
2150 }
2151
2152 /* Callee returns a locked route upon success */
2153 if ((rt = nd6_lookup(&nb_addr, 0, ifp, 0)) == NULL) {
2154 error = EINVAL;
2155 break;
2156 }
2157 RT_LOCK_ASSERT_HELD(rt);
2158 ln = rt->rt_llinfo;
2159 nbi_64->state = ln->ln_state;
2160 nbi_64->asked = ln->ln_asked;
2161 nbi_64->isrouter = ln->ln_router;
2162 nbi_64->expire = ln->ln_expire;
2163 RT_REMREF_LOCKED(rt);
2164 RT_UNLOCK(rt);
2165 break;
2166 }
2167
2168 case SIOCGDEFIFACE_IN6_32: /* XXX: should be implemented as a sysctl? */
2169 case SIOCGDEFIFACE_IN6_64: {
2170 struct in6_ndifreq_64 *ndif_64 = (struct in6_ndifreq_64 *)data;
2171 struct in6_ndifreq_32 *ndif_32 = (struct in6_ndifreq_32 *)data;
2172
2173 if (cmd == SIOCGDEFIFACE_IN6_64)
2174 ndif_64->ifindex = nd6_defifindex;
2175 else
2176 ndif_32->ifindex = nd6_defifindex;
2177 break;
2178 }
2179
2180 case SIOCSDEFIFACE_IN6_32: /* XXX: should be implemented as a sysctl? */
2181 case SIOCSDEFIFACE_IN6_64: {
2182 struct in6_ndifreq_64 *ndif_64 = (struct in6_ndifreq_64 *)data;
2183 struct in6_ndifreq_32 *ndif_32 = (struct in6_ndifreq_32 *)data;
2184
2185 return (nd6_setdefaultiface(cmd == SIOCSDEFIFACE_IN6_64 ?
2186 ndif_64->ifindex : ndif_32->ifindex));
2187 /* NOTREACHED */
2188 }
2189 }
2190 return (error);
2191 }
2192
2193 /*
2194 * Create neighbor cache entry and cache link-layer address,
2195 * on reception of inbound ND6 packets. (RS/RA/NS/redirect)
2196 */
2197 void
2198 nd6_cache_lladdr(
2199 struct ifnet *ifp,
2200 struct in6_addr *from,
2201 char *lladdr,
2202 __unused int lladdrlen,
2203 int type, /* ICMP6 type */
2204 int code) /* type dependent information */
2205 {
2206 struct rtentry *rt = NULL;
2207 struct llinfo_nd6 *ln = NULL;
2208 int is_newentry;
2209 struct sockaddr_dl *sdl = NULL;
2210 int do_update;
2211 int olladdr;
2212 int llchange;
2213 int newstate = 0;
2214 struct timeval timenow;
2215
2216 if (!ifp)
2217 panic("ifp == NULL in nd6_cache_lladdr");
2218 if (!from)
2219 panic("from == NULL in nd6_cache_lladdr");
2220
2221 /* nothing must be updated for unspecified address */
2222 if (IN6_IS_ADDR_UNSPECIFIED(from))
2223 return;
2224
2225 /*
2226 * Validation about ifp->if_addrlen and lladdrlen must be done in
2227 * the caller.
2228 *
2229 * XXX If the link does not have link-layer adderss, what should
2230 * we do? (ifp->if_addrlen == 0)
2231 * Spec says nothing in sections for RA, RS and NA. There's small
2232 * description on it in NS section (RFC 2461 7.2.3).
2233 */
2234 getmicrotime(&timenow);
2235
2236 rt = nd6_lookup(from, 0, ifp, 0);
2237 if (rt == NULL) {
2238 #if 0
2239 /* nothing must be done if there's no lladdr */
2240 if (!lladdr || !lladdrlen)
2241 return;
2242 #endif
2243
2244 if ((rt = nd6_lookup(from, 1, ifp, 0)) == NULL)
2245 return;
2246 RT_LOCK_ASSERT_HELD(rt);
2247 is_newentry = 1;
2248 } else {
2249 RT_LOCK_ASSERT_HELD(rt);
2250 /* do nothing if static ndp is set */
2251 if (rt->rt_flags & RTF_STATIC) {
2252 RT_REMREF_LOCKED(rt);
2253 RT_UNLOCK(rt);
2254 return;
2255 }
2256 is_newentry = 0;
2257 }
2258
2259 if ((rt->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) != RTF_LLINFO) {
2260 fail:
2261 RT_UNLOCK(rt);
2262 nd6_free(rt);
2263 rtfree(rt);
2264 return;
2265 }
2266 ln = rt->rt_llinfo;
2267 if (!ln)
2268 goto fail;
2269 if (!rt->rt_gateway)
2270 goto fail;
2271 if (rt->rt_gateway->sa_family != AF_LINK)
2272 goto fail;
2273 sdl = SDL(rt->rt_gateway);
2274
2275 olladdr = (sdl->sdl_alen) ? 1 : 0;
2276 if (olladdr && lladdr) {
2277 if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen))
2278 llchange = 1;
2279 else
2280 llchange = 0;
2281 } else
2282 llchange = 0;
2283
2284 /*
2285 * newentry olladdr lladdr llchange (*=record)
2286 * 0 n n -- (1)
2287 * 0 y n -- (2)
2288 * 0 n y -- (3) * STALE
2289 * 0 y y n (4) *
2290 * 0 y y y (5) * STALE
2291 * 1 -- n -- (6) NOSTATE(= PASSIVE)
2292 * 1 -- y -- (7) * STALE
2293 */
2294
2295 if (lladdr) { /* (3-5) and (7) */
2296 /*
2297 * Record source link-layer address
2298 * XXX is it dependent to ifp->if_type?
2299 */
2300 sdl->sdl_alen = ifp->if_addrlen;
2301 bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
2302 }
2303
2304 if (!is_newentry) {
2305 if ((!olladdr && lladdr) /* (3) */
2306 || (olladdr && lladdr && llchange)) { /* (5) */
2307 do_update = 1;
2308 newstate = ND6_LLINFO_STALE;
2309 } else /* (1-2,4) */
2310 do_update = 0;
2311 } else {
2312 do_update = 1;
2313 if (!lladdr) /* (6) */
2314 newstate = ND6_LLINFO_NOSTATE;
2315 else /* (7) */
2316 newstate = ND6_LLINFO_STALE;
2317 }
2318
2319 if (do_update) {
2320 /*
2321 * Update the state of the neighbor cache.
2322 */
2323 ln->ln_state = newstate;
2324
2325 if (ln->ln_state == ND6_LLINFO_STALE) {
2326 struct mbuf *m = ln->ln_hold;
2327 /*
2328 * XXX: since nd6_output() below will cause
2329 * state tansition to DELAY and reset the timer,
2330 * we must set the timer now, although it is actually
2331 * meaningless.
2332 */
2333 ln->ln_expire = rt_expiry(rt, timenow.tv_sec,
2334 nd6_gctimer);
2335 ln->ln_hold = NULL;
2336
2337 if (m != NULL) {
2338 /*
2339 * we assume ifp is not a p2p here, so just
2340 * set the 2nd argument as the 1st one.
2341 */
2342 RT_UNLOCK(rt);
2343 nd6_output(ifp, ifp, m,
2344 (struct sockaddr_in6 *)rt_key(rt), rt, 0);
2345 RT_LOCK(rt);
2346 }
2347 } else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
2348 /* probe right away */
2349 ln->ln_expire = timenow.tv_sec;
2350 }
2351 }
2352
2353 /*
2354 * ICMP6 type dependent behavior.
2355 *
2356 * NS: clear IsRouter if new entry
2357 * RS: clear IsRouter
2358 * RA: set IsRouter if there's lladdr
2359 * redir: clear IsRouter if new entry
2360 *
2361 * RA case, (1):
2362 * The spec says that we must set IsRouter in the following cases:
2363 * - If lladdr exist, set IsRouter. This means (1-5).
2364 * - If it is old entry (!newentry), set IsRouter. This means (7).
2365 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
2366 * A quetion arises for (1) case. (1) case has no lladdr in the
2367 * neighbor cache, this is similar to (6).
2368 * This case is rare but we figured that we MUST NOT set IsRouter.
2369 *
2370 * newentry olladdr lladdr llchange NS RS RA redir
2371 * D R
2372 * 0 n n -- (1) c ? s
2373 * 0 y n -- (2) c s s
2374 * 0 n y -- (3) c s s
2375 * 0 y y n (4) c s s
2376 * 0 y y y (5) c s s
2377 * 1 -- n -- (6) c c c s
2378 * 1 -- y -- (7) c c s c s
2379 *
2380 * (c=clear s=set)
2381 */
2382 switch (type & 0xff) {
2383 case ND_NEIGHBOR_SOLICIT:
2384 /*
2385 * New entry must have is_router flag cleared.
2386 */
2387 if (is_newentry) /* (6-7) */
2388 ln->ln_router = 0;
2389 break;
2390 case ND_REDIRECT:
2391 /*
2392 * If the icmp is a redirect to a better router, always set the
2393 * is_router flag. Otherwise, if the entry is newly created,
2394 * clear the flag. [RFC 2461, sec 8.3]
2395 */
2396 if (code == ND_REDIRECT_ROUTER)
2397 ln->ln_router = 1;
2398 else if (is_newentry) /* (6-7) */
2399 ln->ln_router = 0;
2400 break;
2401 case ND_ROUTER_SOLICIT:
2402 /*
2403 * is_router flag must always be cleared.
2404 */
2405 ln->ln_router = 0;
2406 break;
2407 case ND_ROUTER_ADVERT:
2408 /*
2409 * Mark an entry with lladdr as a router.
2410 */
2411 if ((!is_newentry && (olladdr || lladdr)) /* (2-5) */
2412 || (is_newentry && lladdr)) { /* (7) */
2413 ln->ln_router = 1;
2414 }
2415 break;
2416 }
2417
2418 /*
2419 * When the link-layer address of a router changes, select the
2420 * best router again. In particular, when the neighbor entry is newly
2421 * created, it might affect the selection policy.
2422 * Question: can we restrict the first condition to the "is_newentry"
2423 * case?
2424 * XXX: when we hear an RA from a new router with the link-layer
2425 * address option, defrouter_select() is called twice, since
2426 * defrtrlist_update called the function as well. However, I believe
2427 * we can compromise the overhead, since it only happens the first
2428 * time.
2429 * XXX: although defrouter_select() should not have a bad effect
2430 * for those are not autoconfigured hosts, we explicitly avoid such
2431 * cases for safety.
2432 */
2433 if (do_update && ln->ln_router && !ip6_forwarding &&
2434 (ip6_accept_rtadv || (ifp->if_eflags & IFEF_ACCEPT_RTADVD))) {
2435 RT_REMREF_LOCKED(rt);
2436 RT_UNLOCK(rt);
2437 lck_mtx_lock(nd6_mutex);
2438 defrouter_select();
2439 lck_mtx_unlock(nd6_mutex);
2440 } else {
2441 RT_REMREF_LOCKED(rt);
2442 RT_UNLOCK(rt);
2443 }
2444 }
2445
2446 static void
2447 nd6_slowtimo(
2448 __unused void *ignored_arg)
2449 {
2450 int i;
2451 struct nd_ifinfo *nd6if;
2452
2453 lck_rw_lock_shared(nd_if_rwlock);
2454 for (i = 1; i < if_index + 1; i++) {
2455 if (!nd_ifinfo || i >= nd_ifinfo_indexlim)
2456 break;
2457 nd6if = &nd_ifinfo[i];
2458 if (nd6if->basereachable && /* already initialized */
2459 (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
2460 /*
2461 * Since reachable time rarely changes by router
2462 * advertisements, we SHOULD insure that a new random
2463 * value gets recomputed at least once every few hours.
2464 * (RFC 2461, 6.3.4)
2465 */
2466 nd6if->recalctm = nd6_recalc_reachtm_interval;
2467 nd6if->reachable = ND_COMPUTE_RTIME(nd6if->basereachable);
2468 }
2469 }
2470 lck_rw_done(nd_if_rwlock);
2471 timeout(nd6_slowtimo, (caddr_t)0, ND6_SLOWTIMER_INTERVAL * hz);
2472 }
2473
2474 #define senderr(e) { error = (e); goto bad;}
2475 int
2476 nd6_output(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
2477 struct sockaddr_in6 *dst, struct rtentry *hint0, int locked)
2478 {
2479 struct mbuf *m = m0;
2480 struct rtentry *rt = hint0, *hint = hint0;
2481 struct llinfo_nd6 *ln = NULL;
2482 int error = 0;
2483 struct timeval timenow;
2484 struct rtentry *rtrele = NULL;
2485
2486 if (rt != NULL) {
2487 RT_LOCK_SPIN(rt);
2488 RT_ADDREF_LOCKED(rt);
2489 }
2490
2491 if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr) || !nd6_need_cache(ifp)) {
2492 if (rt != NULL)
2493 RT_UNLOCK(rt);
2494 goto sendpkt;
2495 }
2496
2497 /*
2498 * Next hop determination. Because we may involve the gateway route
2499 * in addition to the original route, locking is rather complicated.
2500 * The general concept is that regardless of whether the route points
2501 * to the original route or to the gateway route, this routine takes
2502 * an extra reference on such a route. This extra reference will be
2503 * released at the end.
2504 *
2505 * Care must be taken to ensure that the "hint0" route never gets freed
2506 * via rtfree(), since the caller may have stored it inside a struct
2507 * route with a reference held for that placeholder.
2508 *
2509 * This logic is similar to, though not exactly the same as the one
2510 * used by arp_route_to_gateway_route().
2511 */
2512 if (rt != NULL) {
2513 /*
2514 * We have a reference to "rt" by now (or below via rtalloc1),
2515 * which will either be released or freed at the end of this
2516 * routine.
2517 */
2518 RT_LOCK_ASSERT_HELD(rt);
2519 if (!(rt->rt_flags & RTF_UP)) {
2520 RT_REMREF_LOCKED(rt);
2521 RT_UNLOCK(rt);
2522 if ((hint = rt = rtalloc1((struct sockaddr *)dst,
2523 1, 0)) != NULL) {
2524 RT_LOCK_SPIN(rt);
2525 if (rt->rt_ifp != ifp) {
2526 /* XXX: loop care? */
2527 RT_UNLOCK(rt);
2528 error = nd6_output(ifp, origifp, m0,
2529 dst, rt, locked);
2530 rtfree(rt);
2531 return (error);
2532 }
2533 } else {
2534 senderr(EHOSTUNREACH);
2535 }
2536 }
2537
2538 if (rt->rt_flags & RTF_GATEWAY) {
2539 struct rtentry *gwrt;
2540 struct in6_ifaddr *ia6 = NULL;
2541 struct sockaddr_in6 gw6;
2542
2543 gw6 = *((struct sockaddr_in6 *)rt->rt_gateway);
2544 /*
2545 * Must drop rt_lock since nd6_is_addr_neighbor()
2546 * calls nd6_lookup() and acquires rnh_lock.
2547 */
2548 RT_UNLOCK(rt);
2549
2550 /*
2551 * We skip link-layer address resolution and NUD
2552 * if the gateway is not a neighbor from ND point
2553 * of view, regardless of the value of nd_ifinfo.flags.
2554 * The second condition is a bit tricky; we skip
2555 * if the gateway is our own address, which is
2556 * sometimes used to install a route to a p2p link.
2557 */
2558 if (!nd6_is_addr_neighbor(&gw6, ifp, 0) ||
2559 (ia6 = in6ifa_ifpwithaddr(ifp, &gw6.sin6_addr))) {
2560 /*
2561 * We allow this kind of tricky route only
2562 * when the outgoing interface is p2p.
2563 * XXX: we may need a more generic rule here.
2564 */
2565 if (ia6 != NULL)
2566 ifafree(&ia6->ia_ifa);
2567 if ((ifp->if_flags & IFF_POINTOPOINT) == 0)
2568 senderr(EHOSTUNREACH);
2569 goto sendpkt;
2570 }
2571
2572 RT_LOCK_SPIN(rt);
2573 gw6 = *((struct sockaddr_in6 *)rt->rt_gateway);
2574
2575 /* If hint is now down, give up */
2576 if (!(rt->rt_flags & RTF_UP)) {
2577 RT_UNLOCK(rt);
2578 senderr(EHOSTUNREACH);
2579 }
2580
2581 /* If there's no gateway route, look it up */
2582 if ((gwrt = rt->rt_gwroute) == NULL) {
2583 RT_UNLOCK(rt);
2584 goto lookup;
2585 }
2586 /* Become a regular mutex */
2587 RT_CONVERT_LOCK(rt);
2588
2589 /*
2590 * Take gwrt's lock while holding route's lock;
2591 * this is okay since gwrt never points back
2592 * to rt, so no lock ordering issues.
2593 */
2594 RT_LOCK_SPIN(gwrt);
2595 if (!(gwrt->rt_flags & RTF_UP)) {
2596 struct rtentry *ogwrt;
2597
2598 rt->rt_gwroute = NULL;
2599 RT_UNLOCK(gwrt);
2600 RT_UNLOCK(rt);
2601 rtfree(gwrt);
2602 lookup:
2603 gwrt = rtalloc1((struct sockaddr *)&gw6, 1, 0);
2604
2605 RT_LOCK(rt);
2606 /*
2607 * Bail out if the route is down, no route
2608 * to gateway, circular route, or if the
2609 * gateway portion of "rt" has changed.
2610 */
2611 if (!(rt->rt_flags & RTF_UP) ||
2612 gwrt == NULL || gwrt == rt ||
2613 !equal(SA(&gw6), rt->rt_gateway)) {
2614 if (gwrt == rt) {
2615 RT_REMREF_LOCKED(gwrt);
2616 gwrt = NULL;
2617 }
2618 RT_UNLOCK(rt);
2619 if (gwrt != NULL)
2620 rtfree(gwrt);
2621 senderr(EHOSTUNREACH);
2622 }
2623
2624 /* Remove any existing gwrt */
2625 ogwrt = rt->rt_gwroute;
2626 if ((rt->rt_gwroute = gwrt) != NULL)
2627 RT_ADDREF(gwrt);
2628
2629 RT_UNLOCK(rt);
2630 /* Now free the replaced gwrt */
2631 if (ogwrt != NULL)
2632 rtfree(ogwrt);
2633 /* If still no route to gateway, bail out */
2634 if (gwrt == NULL)
2635 senderr(EHOSTUNREACH);
2636 /* Remember to release/free "rt" at the end */
2637 rtrele = rt;
2638 rt = gwrt;
2639 RT_LOCK_SPIN(rt);
2640 /* If gwrt is now down, give up */
2641 if (!(rt->rt_flags & RTF_UP)) {
2642 RT_UNLOCK(rt);
2643 rtfree(rt);
2644 rt = NULL;
2645 /* "rtrele" == original "rt" */
2646 senderr(EHOSTUNREACH);
2647 }
2648 } else {
2649 RT_ADDREF_LOCKED(gwrt);
2650 RT_UNLOCK(gwrt);
2651 RT_UNLOCK(rt);
2652 RT_LOCK_SPIN(gwrt);
2653 /* If gwrt is now down, give up */
2654 if (!(gwrt->rt_flags & RTF_UP)) {
2655 RT_UNLOCK(gwrt);
2656 rtfree(gwrt);
2657 senderr(EHOSTUNREACH);
2658 }
2659 /* Remember to release/free "rt" at the end */
2660 rtrele = rt;
2661 rt = gwrt;
2662 }
2663 }
2664 /* Become a regular mutex */
2665 RT_CONVERT_LOCK(rt);
2666 }
2667
2668 if (rt != NULL)
2669 RT_LOCK_ASSERT_HELD(rt);
2670
2671 /*
2672 * Address resolution or Neighbor Unreachability Detection
2673 * for the next hop.
2674 * At this point, the destination of the packet must be a unicast
2675 * or an anycast address(i.e. not a multicast).
2676 */
2677
2678 /* Look up the neighbor cache for the nexthop */
2679 if (rt && (rt->rt_flags & RTF_LLINFO) != 0) {
2680 ln = rt->rt_llinfo;
2681 } else {
2682 /*
2683 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
2684 * the condition below is not very efficient. But we believe
2685 * it is tolerable, because this should be a rare case.
2686 * Must drop rt_lock since nd6_is_addr_neighbor() calls
2687 * nd6_lookup() and acquires rnh_lock.
2688 */
2689 if (rt != NULL)
2690 RT_UNLOCK(rt);
2691 if (nd6_is_addr_neighbor(dst, ifp, 0)) {
2692 /* "rtrele" may have been used, so clean up "rt" now */
2693 if (rt != NULL) {
2694 /* Don't free "hint0" */
2695 if (rt == hint0)
2696 RT_REMREF(rt);
2697 else
2698 rtfree(rt);
2699 }
2700 /* Callee returns a locked route upon success */
2701 rt = nd6_lookup(&dst->sin6_addr, 1, ifp, 0);
2702 if (rt != NULL) {
2703 RT_LOCK_ASSERT_HELD(rt);
2704 ln = rt->rt_llinfo;
2705 }
2706 } else if (rt != NULL) {
2707 RT_LOCK(rt);
2708 }
2709 }
2710
2711 if (!ln || !rt) {
2712 if (rt != NULL)
2713 RT_UNLOCK(rt);
2714 lck_rw_lock_shared(nd_if_rwlock);
2715 if ((ifp->if_flags & IFF_POINTOPOINT) == 0 &&
2716 !(nd_ifinfo[ifp->if_index].flags & ND6_IFF_PERFORMNUD)) {
2717 lck_rw_done(nd_if_rwlock);
2718 log(LOG_DEBUG,
2719 "nd6_output: can't allocate llinfo for %s "
2720 "(ln=%p, rt=%p)\n",
2721 ip6_sprintf(&dst->sin6_addr), ln, rt);
2722 senderr(EIO); /* XXX: good error? */
2723 }
2724 lck_rw_done(nd_if_rwlock);
2725
2726 goto sendpkt; /* send anyway */
2727 }
2728
2729 getmicrotime(&timenow);
2730
2731 /* We don't have to do link-layer address resolution on a p2p link. */
2732 if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
2733 ln->ln_state < ND6_LLINFO_REACHABLE) {
2734 ln->ln_state = ND6_LLINFO_STALE;
2735 ln->ln_expire = rt_expiry(rt, timenow.tv_sec, nd6_gctimer);
2736 }
2737
2738 /*
2739 * The first time we send a packet to a neighbor whose entry is
2740 * STALE, we have to change the state to DELAY and a sets a timer to
2741 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
2742 * neighbor unreachability detection on expiration.
2743 * (RFC 2461 7.3.3)
2744 */
2745 if (ln->ln_state == ND6_LLINFO_STALE) {
2746 ln->ln_asked = 0;
2747 ln->ln_state = ND6_LLINFO_DELAY;
2748 ln->ln_expire = rt_expiry(rt, timenow.tv_sec, nd6_delay);
2749 }
2750
2751 /*
2752 * If the neighbor cache entry has a state other than INCOMPLETE
2753 * (i.e. its link-layer address is already resolved), just
2754 * send the packet.
2755 */
2756 if (ln->ln_state > ND6_LLINFO_INCOMPLETE) {
2757 RT_UNLOCK(rt);
2758 /*
2759 * Move this entry to the head of the queue so that it is
2760 * less likely for this entry to be a target of forced
2761 * garbage collection (see nd6_rtrequest()).
2762 */
2763 lck_mtx_lock(rnh_lock);
2764 RT_LOCK_SPIN(rt);
2765 if (ln->ln_flags & ND6_LNF_IN_USE) {
2766 LN_DEQUEUE(ln);
2767 LN_INSERTHEAD(ln);
2768 }
2769 RT_UNLOCK(rt);
2770 lck_mtx_unlock(rnh_lock);
2771 goto sendpkt;
2772 }
2773
2774 /*
2775 * There is a neighbor cache entry, but no ethernet address
2776 * response yet. Replace the held mbuf (if any) with this
2777 * latest one.
2778 *
2779 * This code conforms to the rate-limiting rule described in Section
2780 * 7.2.2 of RFC 2461, because the timer is set correctly after sending
2781 * an NS below.
2782 */
2783 if (ln->ln_state == ND6_LLINFO_NOSTATE)
2784 ln->ln_state = ND6_LLINFO_INCOMPLETE;
2785 if (ln->ln_hold)
2786 m_freem(ln->ln_hold);
2787 ln->ln_hold = m;
2788 if (ln->ln_expire && ln->ln_asked < nd6_mmaxtries &&
2789 ln->ln_expire < timenow.tv_sec) {
2790 ln->ln_asked++;
2791 lck_rw_lock_shared(nd_if_rwlock);
2792 ln->ln_expire = timenow.tv_sec +
2793 nd_ifinfo[ifp->if_index].retrans / 1000;
2794 lck_rw_done(nd_if_rwlock);
2795 RT_UNLOCK(rt);
2796 /* We still have a reference on rt (for ln) */
2797 nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, 0, locked);
2798 } else {
2799 RT_UNLOCK(rt);
2800 }
2801 /*
2802 * Move this entry to the head of the queue so that it is
2803 * less likely for this entry to be a target of forced
2804 * garbage collection (see nd6_rtrequest()).
2805 */
2806 lck_mtx_lock(rnh_lock);
2807 RT_LOCK_SPIN(rt);
2808 if (ln->ln_flags & ND6_LNF_IN_USE) {
2809 LN_DEQUEUE(ln);
2810 LN_INSERTHEAD(ln);
2811 }
2812 /* Clean up "rt" now while we can */
2813 if (rt == hint0) {
2814 RT_REMREF_LOCKED(rt);
2815 RT_UNLOCK(rt);
2816 } else {
2817 RT_UNLOCK(rt);
2818 rtfree_locked(rt);
2819 }
2820 rt = NULL; /* "rt" has been taken care of */
2821 lck_mtx_unlock(rnh_lock);
2822
2823 error = 0;
2824 goto release;
2825
2826 sendpkt:
2827 if (rt != NULL)
2828 RT_LOCK_ASSERT_NOTHELD(rt);
2829
2830 /* Clean up HW checksum flags before sending the packet */
2831 m->m_pkthdr.csum_data = 0;
2832 m->m_pkthdr.csum_flags = 0;
2833
2834 if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
2835 /* forwarding rules require the original scope_id */
2836 m->m_pkthdr.rcvif = origifp;
2837 if (locked)
2838 lck_mtx_unlock(ip6_mutex);
2839 error = dlil_output(origifp, PF_INET6, m, (caddr_t)rt,
2840 (struct sockaddr *)dst, 0);
2841 if (locked)
2842 lck_mtx_lock(ip6_mutex);
2843 goto release;
2844 } else {
2845 /* Do not allow loopback address to wind up on a wire */
2846 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
2847
2848 if ((IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) ||
2849 IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst))) {
2850 ip6stat.ip6s_badscope++;
2851 /*
2852 * Do not simply drop the packet just like a
2853 * firewall -- we want the the application to feel
2854 * the pain. Return ENETUNREACH like ip6_output
2855 * does in some similar cases. This can startle
2856 * the otherwise clueless process that specifies
2857 * loopback as the source address.
2858 */
2859 error = ENETUNREACH;
2860 goto bad;
2861 }
2862 }
2863
2864 m->m_pkthdr.rcvif = NULL;
2865 if (locked)
2866 lck_mtx_unlock(ip6_mutex);
2867 error = dlil_output(ifp, PF_INET6, m, (caddr_t)rt,
2868 (struct sockaddr *)dst, 0);
2869 if (locked)
2870 lck_mtx_lock(ip6_mutex);
2871 goto release;
2872
2873 bad:
2874 if (m != NULL)
2875 m_freem(m);
2876
2877 release:
2878 /* Clean up "rt" unless it's already been done */
2879 if (rt != NULL) {
2880 RT_LOCK_SPIN(rt);
2881 if (rt == hint0) {
2882 RT_REMREF_LOCKED(rt);
2883 RT_UNLOCK(rt);
2884 } else {
2885 RT_UNLOCK(rt);
2886 rtfree(rt);
2887 }
2888 }
2889 /* And now clean up "rtrele" if there is any */
2890 if (rtrele != NULL) {
2891 RT_LOCK_SPIN(rtrele);
2892 if (rtrele == hint0) {
2893 RT_REMREF_LOCKED(rtrele);
2894 RT_UNLOCK(rtrele);
2895 } else {
2896 RT_UNLOCK(rtrele);
2897 rtfree(rtrele);
2898 }
2899 }
2900 return (error);
2901 }
2902 #undef senderr
2903
2904 int
2905 nd6_need_cache(
2906 struct ifnet *ifp)
2907 {
2908 /*
2909 * XXX: we currently do not make neighbor cache on any interface
2910 * other than ARCnet, Ethernet, FDDI and GIF.
2911 *
2912 * RFC2893 says:
2913 * - unidirectional tunnels needs no ND
2914 */
2915 switch (ifp->if_type) {
2916 case IFT_ARCNET:
2917 case IFT_ETHER:
2918 case IFT_FDDI:
2919 case IFT_IEEE1394:
2920 case IFT_L2VLAN:
2921 case IFT_IEEE8023ADLAG:
2922 #if IFT_IEEE80211
2923 case IFT_IEEE80211:
2924 #endif
2925 case IFT_BRIDGE:
2926 case IFT_GIF: /* XXX need more cases? */
2927 return(1);
2928 default:
2929 return(0);
2930 }
2931 }
2932
2933 int
2934 nd6_storelladdr(
2935 struct ifnet *ifp,
2936 struct rtentry *rt,
2937 struct mbuf *m,
2938 struct sockaddr *dst,
2939 u_char *desten)
2940 {
2941 int i;
2942 struct sockaddr_dl *sdl;
2943
2944 if (m->m_flags & M_MCAST) {
2945 switch (ifp->if_type) {
2946 case IFT_ETHER:
2947 case IFT_FDDI:
2948 case IFT_L2VLAN:
2949 case IFT_IEEE8023ADLAG:
2950 #if IFT_IEEE80211
2951 case IFT_IEEE80211:
2952 #endif
2953 case IFT_BRIDGE:
2954 ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr,
2955 desten);
2956 return(1);
2957 case IFT_IEEE1394:
2958 for (i = 0; i < ifp->if_addrlen; i++)
2959 desten[i] = ~0;
2960 return(1);
2961 case IFT_ARCNET:
2962 *desten = 0;
2963 return(1);
2964 default:
2965 return(0); /* caller will free mbuf */
2966 }
2967 }
2968
2969 if (rt == NULL) {
2970 /* this could happen, if we could not allocate memory */
2971 return(0); /* caller will free mbuf */
2972 }
2973 RT_LOCK(rt);
2974 if (rt->rt_gateway->sa_family != AF_LINK) {
2975 printf("nd6_storelladdr: something odd happens\n");
2976 RT_UNLOCK(rt);
2977 return(0); /* caller will free mbuf */
2978 }
2979 sdl = SDL(rt->rt_gateway);
2980 if (sdl->sdl_alen == 0) {
2981 /* this should be impossible, but we bark here for debugging */
2982 printf("nd6_storelladdr: sdl_alen == 0\n");
2983 RT_UNLOCK(rt);
2984 return(0); /* caller will free mbuf */
2985 }
2986
2987 bcopy(LLADDR(sdl), desten, sdl->sdl_alen);
2988 RT_UNLOCK(rt);
2989 return(1);
2990 }
2991
2992 /*
2993 * This is the ND pre-output routine; care must be taken to ensure that
2994 * the "hint" route never gets freed via rtfree(), since the caller may
2995 * have stored it inside a struct route with a reference held for that
2996 * placeholder.
2997 */
2998 errno_t
2999 nd6_lookup_ipv6(ifnet_t ifp, const struct sockaddr_in6 *ip6_dest,
3000 struct sockaddr_dl *ll_dest, size_t ll_dest_len, route_t hint,
3001 mbuf_t packet)
3002 {
3003 route_t route = hint;
3004 errno_t result = 0;
3005 struct sockaddr_dl *sdl = NULL;
3006 size_t copy_len;
3007
3008 if (ip6_dest->sin6_family != AF_INET6)
3009 return (EAFNOSUPPORT);
3010
3011 if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) != (IFF_UP|IFF_RUNNING))
3012 return (ENETDOWN);
3013
3014 if (hint != NULL) {
3015 /*
3016 * Callee holds a reference on the route and returns
3017 * with the route entry locked, upon success.
3018 */
3019 result = arp_route_to_gateway_route(
3020 (const struct sockaddr*)ip6_dest, hint, &route);
3021 if (result != 0)
3022 return (result);
3023 if (route != NULL)
3024 RT_LOCK_ASSERT_HELD(route);
3025 }
3026
3027 if ((packet->m_flags & M_MCAST) != 0) {
3028 if (route != NULL)
3029 RT_UNLOCK(route);
3030 result = dlil_resolve_multi(ifp,
3031 (const struct sockaddr*)ip6_dest,
3032 (struct sockaddr *)ll_dest, ll_dest_len);
3033 if (route != NULL)
3034 RT_LOCK(route);
3035 goto release;
3036 }
3037
3038 if (route == NULL) {
3039 /*
3040 * This could happen, if we could not allocate memory or
3041 * if arp_route_to_gateway_route() didn't return a route.
3042 */
3043 result = ENOBUFS;
3044 goto release;
3045 }
3046
3047 if (route->rt_gateway->sa_family != AF_LINK) {
3048 printf("nd6_lookup_ipv6: gateway address not AF_LINK\n");
3049 result = EADDRNOTAVAIL;
3050 goto release;
3051 }
3052
3053 sdl = SDL(route->rt_gateway);
3054 if (sdl->sdl_alen == 0) {
3055 /* this should be impossible, but we bark here for debugging */
3056 printf("nd6_lookup_ipv6: sdl_alen == 0\n");
3057 result = EHOSTUNREACH;
3058 goto release;
3059 }
3060
3061 copy_len = sdl->sdl_len <= ll_dest_len ? sdl->sdl_len : ll_dest_len;
3062 bcopy(sdl, ll_dest, copy_len);
3063
3064 release:
3065 if (route != NULL) {
3066 if (route == hint) {
3067 RT_REMREF_LOCKED(route);
3068 RT_UNLOCK(route);
3069 } else {
3070 RT_UNLOCK(route);
3071 rtfree(route);
3072 }
3073 }
3074 return (result);
3075 }
3076
3077 SYSCTL_DECL(_net_inet6_icmp6);
3078
3079 static int
3080 nd6_sysctl_drlist SYSCTL_HANDLER_ARGS
3081 {
3082 #pragma unused(oidp, arg1, arg2)
3083 int error = 0;
3084 char buf[1024];
3085 struct nd_defrouter *dr;
3086 int p64 = proc_is64bit(req->p);
3087
3088 if (req->newptr)
3089 return (EPERM);
3090
3091 lck_mtx_lock(nd6_mutex);
3092 if (p64) {
3093 struct in6_defrouter_64 *d, *de;
3094
3095 for (dr = TAILQ_FIRST(&nd_defrouter);
3096 dr;
3097 dr = TAILQ_NEXT(dr, dr_entry)) {
3098 d = (struct in6_defrouter_64 *)buf;
3099 de = (struct in6_defrouter_64 *)(buf + sizeof (buf));
3100
3101 if (d + 1 <= de) {
3102 bzero(d, sizeof (*d));
3103 d->rtaddr.sin6_family = AF_INET6;
3104 d->rtaddr.sin6_len = sizeof (d->rtaddr);
3105 if (in6_recoverscope(&d->rtaddr, &dr->rtaddr,
3106 dr->ifp) != 0)
3107 log(LOG_ERR,
3108 "scope error in "
3109 "default router list (%s)\n",
3110 ip6_sprintf(&dr->rtaddr));
3111 d->flags = dr->flags;
3112 d->rtlifetime = dr->rtlifetime;
3113 d->expire = dr->expire;
3114 d->if_index = dr->ifp->if_index;
3115 } else {
3116 panic("buffer too short");
3117 }
3118 error = SYSCTL_OUT(req, buf, sizeof (*d));
3119 if (error)
3120 break;
3121 }
3122 } else {
3123 struct in6_defrouter_32 *d_32, *de_32;
3124
3125 for (dr = TAILQ_FIRST(&nd_defrouter);
3126 dr;
3127 dr = TAILQ_NEXT(dr, dr_entry)) {
3128 d_32 = (struct in6_defrouter_32 *)buf;
3129 de_32 = (struct in6_defrouter_32 *)(buf + sizeof (buf));
3130
3131 if (d_32 + 1 <= de_32) {
3132 bzero(d_32, sizeof (*d_32));
3133 d_32->rtaddr.sin6_family = AF_INET6;
3134 d_32->rtaddr.sin6_len = sizeof (d_32->rtaddr);
3135 if (in6_recoverscope(&d_32->rtaddr, &dr->rtaddr,
3136 dr->ifp) != 0)
3137 log(LOG_ERR,
3138 "scope error in "
3139 "default router list (%s)\n",
3140 ip6_sprintf(&dr->rtaddr));
3141 d_32->flags = dr->flags;
3142 d_32->rtlifetime = dr->rtlifetime;
3143 d_32->expire = dr->expire;
3144 d_32->if_index = dr->ifp->if_index;
3145 } else {
3146 panic("buffer too short");
3147 }
3148 error = SYSCTL_OUT(req, buf, sizeof (*d_32));
3149 if (error)
3150 break;
3151 }
3152 }
3153 lck_mtx_unlock(nd6_mutex);
3154 return (error);
3155 }
3156
3157 static int
3158 nd6_sysctl_prlist SYSCTL_HANDLER_ARGS
3159 {
3160 #pragma unused(oidp, arg1, arg2)
3161 int error = 0;
3162 char buf[1024];
3163 struct nd_prefix *pr;
3164 int p64 = proc_is64bit(req->p);
3165
3166 if (req->newptr)
3167 return (EPERM);
3168
3169 lck_mtx_lock(nd6_mutex);
3170 if (p64) {
3171 struct in6_prefix_64 *p, *pe;
3172
3173 for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
3174 u_short advrtrs = 0;
3175 size_t advance;
3176 struct sockaddr_in6 *sin6, *s6;
3177 struct nd_pfxrouter *pfr;
3178
3179 p = (struct in6_prefix_64 *)buf;
3180 pe = (struct in6_prefix_64 *)(buf + sizeof (buf));
3181
3182 if (p + 1 <= pe) {
3183 bzero(p, sizeof (*p));
3184 sin6 = (struct sockaddr_in6 *)(p + 1);
3185
3186 p->prefix = pr->ndpr_prefix;
3187 if (in6_recoverscope(&p->prefix,
3188 &p->prefix.sin6_addr, pr->ndpr_ifp) != 0)
3189 log(LOG_ERR,
3190 "scope error in prefix list (%s)\n",
3191 ip6_sprintf(&p->prefix.sin6_addr));
3192 p->raflags = pr->ndpr_raf;
3193 p->prefixlen = pr->ndpr_plen;
3194 p->vltime = pr->ndpr_vltime;
3195 p->pltime = pr->ndpr_pltime;
3196 p->if_index = pr->ndpr_ifp->if_index;
3197 p->expire = pr->ndpr_expire;
3198 p->refcnt = pr->ndpr_refcnt;
3199 p->flags = pr->ndpr_stateflags;
3200 p->origin = PR_ORIG_RA;
3201 advrtrs = 0;
3202 for (pfr = pr->ndpr_advrtrs.lh_first;
3203 pfr;
3204 pfr = pfr->pfr_next) {
3205 if ((void *)&sin6[advrtrs + 1] >
3206 (void *)pe) {
3207 advrtrs++;
3208 continue;
3209 }
3210 s6 = &sin6[advrtrs];
3211 bzero(s6, sizeof (*s6));
3212 s6->sin6_family = AF_INET6;
3213 s6->sin6_len = sizeof (*sin6);
3214 if (in6_recoverscope(s6,
3215 &pfr->router->rtaddr,
3216 pfr->router->ifp) != 0)
3217 log(LOG_ERR, "scope error in "
3218 "prefix list (%s)\n",
3219 ip6_sprintf(&pfr->router->
3220 rtaddr));
3221 advrtrs++;
3222 }
3223 p->advrtrs = advrtrs;
3224 } else {
3225 panic("buffer too short");
3226 }
3227 advance = sizeof (*p) + sizeof (*sin6) * advrtrs;
3228 error = SYSCTL_OUT(req, buf, advance);
3229 if (error)
3230 break;
3231 }
3232 } else {
3233 struct in6_prefix_32 *p_32, *pe_32;
3234
3235 for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
3236 u_short advrtrs = 0;
3237 size_t advance;
3238 struct sockaddr_in6 *sin6, *s6;
3239 struct nd_pfxrouter *pfr;
3240
3241 p_32 = (struct in6_prefix_32 *)buf;
3242 pe_32 = (struct in6_prefix_32 *)(buf + sizeof (buf));
3243
3244 if (p_32 + 1 <= pe_32) {
3245 bzero(p_32, sizeof (*p_32));
3246 sin6 = (struct sockaddr_in6 *)(p_32 + 1);
3247
3248 p_32->prefix = pr->ndpr_prefix;
3249 if (in6_recoverscope(&p_32->prefix,
3250 &p_32->prefix.sin6_addr, pr->ndpr_ifp) != 0)
3251 log(LOG_ERR, "scope error in prefix "
3252 "list (%s)\n", ip6_sprintf(&p_32->
3253 prefix.sin6_addr));
3254 p_32->raflags = pr->ndpr_raf;
3255 p_32->prefixlen = pr->ndpr_plen;
3256 p_32->vltime = pr->ndpr_vltime;
3257 p_32->pltime = pr->ndpr_pltime;
3258 p_32->if_index = pr->ndpr_ifp->if_index;
3259 p_32->expire = pr->ndpr_expire;
3260 p_32->refcnt = pr->ndpr_refcnt;
3261 p_32->flags = pr->ndpr_stateflags;
3262 p_32->origin = PR_ORIG_RA;
3263 advrtrs = 0;
3264 for (pfr = pr->ndpr_advrtrs.lh_first;
3265 pfr;
3266 pfr = pfr->pfr_next) {
3267 if ((void *)&sin6[advrtrs + 1] >
3268 (void *)pe_32) {
3269 advrtrs++;
3270 continue;
3271 }
3272 s6 = &sin6[advrtrs];
3273 bzero(s6, sizeof (*s6));
3274 s6->sin6_family = AF_INET6;
3275 s6->sin6_len = sizeof (*sin6);
3276 if (in6_recoverscope(s6,
3277 &pfr->router->rtaddr,
3278 pfr->router->ifp) != 0)
3279 log(LOG_ERR, "scope error in "
3280 "prefix list (%s)\n",
3281 ip6_sprintf(&pfr->router->
3282 rtaddr));
3283 advrtrs++;
3284 }
3285 p_32->advrtrs = advrtrs;
3286 } else {
3287 panic("buffer too short");
3288 }
3289 advance = sizeof (*p_32) + sizeof (*sin6) * advrtrs;
3290 error = SYSCTL_OUT(req, buf, advance);
3291 if (error)
3292 break;
3293 }
3294 }
3295 lck_mtx_unlock(nd6_mutex);
3296 return (error);
3297 }
3298 SYSCTL_PROC(_net_inet6_icmp6, ICMPV6CTL_ND6_DRLIST, nd6_drlist,
3299 CTLFLAG_RD, 0, 0, nd6_sysctl_drlist, "S,in6_defrouter","");
3300 SYSCTL_PROC(_net_inet6_icmp6, ICMPV6CTL_ND6_PRLIST, nd6_prlist,
3301 CTLFLAG_RD, 0, 0, nd6_sysctl_prlist, "S,in6_defrouter","");
3302
mirror of XNU