xnu-7195.50.7.100.1.tar.gz

[apple/xnu.git] / bsd / netinet6 / nd6_nbr.c

diff --git a/bsd/netinet6/nd6_nbr.c b/bsd/netinet6/nd6_nbr.c
index 9adb4feae3a6ebc3e711838a534b2a7b196f2255..829c7a7b1a952c49b2f766e452b3aab5c684622e 100644 (file)
--- a/bsd/netinet6/nd6_nbr.c
+++ b/bsd/netinet6/nd6_nbr.c
@@ -1,5 +1,5 @@
 /*
 /*

- * Copyright (c) 2000-2019 Apple Inc. All rights reserved.
+ * Copyright (c) 2000-2020 Apple Inc. All rights reserved.

  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *


@@ -95,10 +95,8 @@
 
 #if IPSEC
 #include <netinet6/ipsec.h>
 
 #if IPSEC
 #include <netinet6/ipsec.h>

-#if INET6

 #include <netinet6/ipsec6.h>
 #endif
 #include <netinet6/ipsec6.h>
 #endif

-#endif

 
 struct dadq;
 static struct dadq *nd6_dad_find(struct ifaddr *, struct nd_opt_nonce *);
 
 struct dadq;
 static struct dadq *nd6_dad_find(struct ifaddr *, struct nd_opt_nonce *);


@@ -112,15 +110,10 @@ static void dad_addref(struct dadq *, int);
 static void dad_remref(struct dadq *);
 static struct dadq *nd6_dad_attach(struct dadq *, struct ifaddr *);
 static void nd6_dad_detach(struct dadq *, struct ifaddr *);
 static void dad_remref(struct dadq *);
 static struct dadq *nd6_dad_attach(struct dadq *, struct ifaddr *);
 static void nd6_dad_detach(struct dadq *, struct ifaddr *);

+static void nd6_dad_duplicated(struct ifaddr *);

 
 static int dad_maxtry = 15;     /* max # of *tries* to transmit DAD packet */
 
 
 static int dad_maxtry = 15;     /* max # of *tries* to transmit DAD packet */
 

-static unsigned int dad_size;                   /* size of zone element */
-static struct zone *dad_zone;                   /* zone for dadq */
-
-#define DAD_ZONE_MAX    64                      /* maximum elements in zone */
-#define DAD_ZONE_NAME   "nd6_dad"               /* zone name */
-

 #define DAD_LOCK_ASSERT_HELD(_dp)                                       \
        LCK_MTX_ASSERT(&(_dp)->dad_lock, LCK_MTX_ASSERT_OWNED)
 
 #define DAD_LOCK_ASSERT_HELD(_dp)                                       \
        LCK_MTX_ASSERT(&(_dp)->dad_lock, LCK_MTX_ASSERT_OWNED)
 


@@ -162,7 +155,7 @@ SYSCTL_INT(_net_inet6_icmp6, OID_AUTO, nd6_llreach_base,
     CTLFLAG_RW | CTLFLAG_LOCKED, &nd6_llreach_base, 0,
     "default ND6 link-layer reachability max lifetime (in seconds)");
 
     CTLFLAG_RW | CTLFLAG_LOCKED, &nd6_llreach_base, 0,
     "default ND6 link-layer reachability max lifetime (in seconds)");
 

-int dad_enhanced = 1;
+int dad_enhanced = ND6_DAD_ENHANCED_DEFAULT;

 SYSCTL_DECL(_net_inet6_ip6);
 SYSCTL_INT(_net_inet6_ip6, OID_AUTO, dad_enhanced, CTLFLAG_RW | CTLFLAG_LOCKED,
     &dad_enhanced, 0,
 SYSCTL_DECL(_net_inet6_ip6);
 SYSCTL_INT(_net_inet6_ip6, OID_AUTO, dad_enhanced, CTLFLAG_RW | CTLFLAG_LOCKED,
     &dad_enhanced, 0,


@@ -230,9 +223,9 @@ nd6_llreach_alloc(struct rtentry *rt, struct ifnet *ifp, void *addr,
                if (nd6_debug && lr != NULL && why != NULL) {
                        char tmp[MAX_IPv6_STR_LEN];
 
                if (nd6_debug && lr != NULL && why != NULL) {
                        char tmp[MAX_IPv6_STR_LEN];
 

-                       nd6log((LOG_DEBUG, "%s: %s%s for %s\n", if_name(ifp),
+                       nd6log(debug, "%s: %s%s for %s\n", if_name(ifp),

                            type, why, inet_ntop(AF_INET6,
                            type, why, inet_ntop(AF_INET6,

-                           &SIN6(rt_key(rt))->sin6_addr, tmp, sizeof(tmp))));
+                           &SIN6(rt_key(rt))->sin6_addr, tmp, sizeof(tmp)));

                }
        }
 }
                }
        }
 }


@@ -259,40 +252,40 @@ nd6_ns_input(
 {
        struct ifnet *ifp = m->m_pkthdr.rcvif;
        struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
 {
        struct ifnet *ifp = m->m_pkthdr.rcvif;
        struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);

-       struct nd_neighbor_solicit *nd_ns;
+       struct nd_neighbor_solicit *nd_ns = NULL;

        struct in6_addr saddr6 = ip6->ip6_src;
        struct in6_addr daddr6 = ip6->ip6_dst;
        struct in6_addr saddr6 = ip6->ip6_src;
        struct in6_addr daddr6 = ip6->ip6_dst;

-       struct in6_addr taddr6;
-       struct in6_addr myaddr6;
+       struct in6_addr taddr6 = {};
+       struct in6_addr myaddr6 = {};

        char *lladdr = NULL;
        struct ifaddr *ifa = NULL;
        int lladdrlen = 0;
        int anycast = 0, proxy = 0, dadprogress = 0;
        char *lladdr = NULL;
        struct ifaddr *ifa = NULL;
        int lladdrlen = 0;
        int anycast = 0, proxy = 0, dadprogress = 0;

-       int tlladdr;
-       union nd_opts ndopts;
-       struct sockaddr_dl proxydl;
-       boolean_t advrouter;
-       boolean_t is_dad_probe;
+       int tlladdr = 0;
+       union nd_opts ndopts = {};
+       struct sockaddr_dl proxydl = {};
+       boolean_t advrouter = FALSE;
+       boolean_t is_dad_probe = FALSE;

        int oflgclr = 0;
 
        /* Expect 32-bit aligned data pointer on strict-align platforms */
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
 
        IP6_EXTHDR_CHECK(m, off, icmp6len, return );
        int oflgclr = 0;
 
        /* Expect 32-bit aligned data pointer on strict-align platforms */
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
 
        IP6_EXTHDR_CHECK(m, off, icmp6len, return );

+       ip6 = mtod(m, struct ip6_hdr *);

        nd_ns = (struct nd_neighbor_solicit *)((caddr_t)ip6 + off);
        m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE;
 
        nd_ns = (struct nd_neighbor_solicit *)((caddr_t)ip6 + off);
        m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE;
 

-       ip6 = mtod(m, struct ip6_hdr *); /* adjust pointer for safety */

        taddr6 = nd_ns->nd_ns_target;
        if (in6_setscope(&taddr6, ifp, NULL) != 0) {
                goto bad;
        }
 
        if (ip6->ip6_hlim != IPV6_MAXHLIM) {
        taddr6 = nd_ns->nd_ns_target;
        if (in6_setscope(&taddr6, ifp, NULL) != 0) {
                goto bad;
        }
 
        if (ip6->ip6_hlim != IPV6_MAXHLIM) {

-               nd6log((LOG_ERR,
+               nd6log(error,

                    "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n",
                    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
                    "nd6_ns_input: invalid hlim (%d) from %s to %s on %s\n",
                    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),

-                   ip6_sprintf(&ip6->ip6_dst), if_name(ifp)));
+                   ip6_sprintf(&ip6->ip6_dst), if_name(ifp));

                goto bad;
        }
 
                goto bad;
        }
 


@@ -306,8 +299,8 @@ nd6_ns_input(
                    daddr6.s6_addr8[12] == 0xff) {
                        ; /* good */
                } else {
                    daddr6.s6_addr8[12] == 0xff) {
                        ; /* good */
                } else {

-                       nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
-                           "(wrong ip6 dst)\n"));
+                       nd6log(info, "nd6_ns_input: bad DAD packet "
+                           "(wrong ip6 dst)\n");

                        goto bad;
                }
        } else if (!nd6_onlink_ns_rfc4861) {
                        goto bad;
                }
        } else if (!nd6_onlink_ns_rfc4861) {


@@ -324,22 +317,22 @@ nd6_ns_input(
                src_sa6.sin6_len = sizeof(src_sa6);
                src_sa6.sin6_addr = saddr6;
                if (!nd6_is_addr_neighbor(&src_sa6, ifp, 0)) {
                src_sa6.sin6_len = sizeof(src_sa6);
                src_sa6.sin6_addr = saddr6;
                if (!nd6_is_addr_neighbor(&src_sa6, ifp, 0)) {

-                       nd6log((LOG_INFO, "nd6_ns_input: "
-                           "NS packet from non-neighbor\n"));
+                       nd6log(info, "nd6_ns_input: "
+                           "NS packet from non-neighbor\n");

                        goto bad;
                }
        }
 
        if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
                        goto bad;
                }
        }
 
        if (IN6_IS_ADDR_MULTICAST(&taddr6)) {

-               nd6log((LOG_INFO, "nd6_ns_input: bad NS target (multicast)\n"));
+               nd6log(info, "nd6_ns_input: bad NS target (multicast)\n");

                goto bad;
        }
 
        icmp6len -= sizeof(*nd_ns);
        nd6_option_init(nd_ns + 1, icmp6len, &ndopts);
        if (nd6_options(&ndopts) < 0) {
                goto bad;
        }
 
        icmp6len -= sizeof(*nd_ns);
        nd6_option_init(nd_ns + 1, icmp6len, &ndopts);
        if (nd6_options(&ndopts) < 0) {

-               nd6log((LOG_INFO,
-                   "nd6_ns_input: invalid ND option, ignored\n"));
+               nd6log(info,
+                   "nd6_ns_input: invalid ND option, ignored\n");

                /* nd6_options have incremented stats */
                goto freeit;
        }
                /* nd6_options have incremented stats */
                goto freeit;
        }


@@ -350,8 +343,8 @@ nd6_ns_input(
        }
 
        if (is_dad_probe && lladdr) {
        }
 
        if (is_dad_probe && lladdr) {

-               nd6log((LOG_INFO, "nd6_ns_input: bad DAD packet "
-                   "(link-layer address option)\n"));
+               nd6log(info, "nd6_ns_input: bad DAD packet "
+                   "(link-layer address option)\n");

                goto bad;
        }
 
                goto bad;
        }
 


@@ -446,17 +439,17 @@ nd6_ns_input(
        IFA_UNLOCK(ifa);
 
        if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
        IFA_UNLOCK(ifa);
 
        if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {

-               nd6log((LOG_INFO,
+               nd6log(info,

                    "nd6_ns_input: lladdrlen mismatch for %s "
                    "(if %d, NS packet %d)\n",
                    "nd6_ns_input: lladdrlen mismatch for %s "
                    "(if %d, NS packet %d)\n",

-                   ip6_sprintf(&taddr6), ifp->if_addrlen, lladdrlen - 2));
+                   ip6_sprintf(&taddr6), ifp->if_addrlen, lladdrlen - 2);

                goto bad;
        }
 
        if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) {
                goto bad;
        }
 
        if (IN6_ARE_ADDR_EQUAL(&myaddr6, &saddr6)) {

-               nd6log((LOG_INFO,
+               nd6log(info,

                    "nd6_ns_input: duplicate IP6 address %s\n",
                    "nd6_ns_input: duplicate IP6 address %s\n",

-                   ip6_sprintf(&saddr6)));
+                   ip6_sprintf(&saddr6));

                goto freeit;
        }
 
                goto freeit;
        }
 


@@ -498,7 +491,7 @@ nd6_ns_input(
        }
 
        /* Are we an advertising router on this interface? */
        }
 
        /* Are we an advertising router on this interface? */

-       advrouter = (ifp->if_eflags & IFEF_IPV6_ROUTER);
+       advrouter = (ifp->if_ipv6_router_mode != IPV6_ROUTER_MODE_DISABLED);

 
        /*
         * If the source address is unspecified address, entries must not
 
        /*
         * If the source address is unspecified address, entries must not


@@ -539,9 +532,9 @@ freeit:
        return;
 
 bad:
        return;
 
 bad:

-       nd6log((LOG_ERR, "nd6_ns_input: src=%s\n", ip6_sprintf(&saddr6)));
-       nd6log((LOG_ERR, "nd6_ns_input: dst=%s\n", ip6_sprintf(&daddr6)));
-       nd6log((LOG_ERR, "nd6_ns_input: tgt=%s\n", ip6_sprintf(&taddr6)));
+       nd6log(error, "nd6_ns_input: src=%s\n", ip6_sprintf(&saddr6));
+       nd6log(error, "nd6_ns_input: dst=%s\n", ip6_sprintf(&daddr6));
+       nd6log(error, "nd6_ns_input: tgt=%s\n", ip6_sprintf(&taddr6));

        icmp6stat.icp6s_badns++;
        m_freem(m);
        if (ifa != NULL) {
        icmp6stat.icp6s_badns++;
        m_freem(m);
        if (ifa != NULL) {


@@ -584,6 +577,7 @@ nd6_ns_output(
        struct route_in6 ro;
        struct ip6_out_args ip6oa;
        u_int32_t rtflags = 0;
        struct route_in6 ro;
        struct ip6_out_args ip6oa;
        u_int32_t rtflags = 0;

+       boolean_t is_optimistic = FALSE;

 
        if ((ifp->if_eflags & IFEF_IPV6_ND6ALT) || IN6_IS_ADDR_MULTICAST(taddr6)) {
                return;
 
        if ((ifp->if_eflags & IFEF_IPV6_ND6ALT) || IN6_IS_ADDR_MULTICAST(taddr6)) {
                return;


@@ -626,7 +620,7 @@ nd6_ns_output(
        if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) {
                m->m_flags |= M_MCAST;
 
        if (daddr6 == NULL || IN6_IS_ADDR_MULTICAST(daddr6)) {
                m->m_flags |= M_MCAST;
 

-               im6o = ip6_allocmoptions(M_DONTWAIT);
+               im6o = ip6_allocmoptions(Z_NOWAIT);

                if (im6o == NULL) {
                        m_freem(m);
                        return;
                if (im6o == NULL) {
                        m_freem(m);
                        return;


@@ -722,11 +716,11 @@ nd6_ns_output(
                            NULL, &ro, NULL, &src_storage, ip6oa.ip6oa_boundif,
                            &error);
                        if (src == NULL) {
                            NULL, &ro, NULL, &src_storage, ip6oa.ip6oa_boundif,
                            &error);
                        if (src == NULL) {

-                               nd6log((LOG_DEBUG,
+                               nd6log(debug,

                                    "nd6_ns_output: source can't be "
                                    "determined: dst=%s, error=%d\n",
                                    ip6_sprintf(&dst_sa.sin6_addr),
                                    "nd6_ns_output: source can't be "
                                    "determined: dst=%s, error=%d\n",
                                    ip6_sprintf(&dst_sa.sin6_addr),

-                                   error));
+                                   error);

                                goto bad;
                        }
 
                                goto bad;
                        }
 


@@ -743,13 +737,20 @@ nd6_ns_output(
                         * Resolution.
                         */
                        ia = in6ifa_ifpwithaddr(ifp, src);
                         * Resolution.
                         */
                        ia = in6ifa_ifpwithaddr(ifp, src);

-                       if (!ia || (ia->ia6_flags & IN6_IFF_OPTIMISTIC)) {
-                               nd6log((LOG_DEBUG,
+                       if (ia == NULL) {
+                               nd6log(debug,

                                    "nd6_ns_output: no preferred source "
                                    "available: dst=%s\n",
                                    "nd6_ns_output: no preferred source "
                                    "available: dst=%s\n",

-                                   ip6_sprintf(&dst_sa.sin6_addr)));
+                                   ip6_sprintf(&dst_sa.sin6_addr));

                                goto bad;
                        }
                                goto bad;
                        }

+                       if (ia->ia6_flags & IN6_IFF_OPTIMISTIC) {
+                               is_optimistic = TRUE;
+                               nd6log(debug,
+                                   "nd6_ns_output: preferred source "
+                                   "available is optimistic: dst=%s\n",
+                                   ip6_sprintf(&dst_sa.sin6_addr));
+                       }

                }
        } else {
                /*
                }
        } else {
                /*


@@ -777,13 +778,20 @@ nd6_ns_output(
         *                              spec            implementation
         *                              ---             ---
         * DAD packet                   MUST NOT        do not add the option
         *                              spec            implementation
         *                              ---             ---
         * DAD packet                   MUST NOT        do not add the option

+        * Source is optimistic         MUST NOT        do not add the option

         * there's no link layer address:
         *                              impossible      do not add the option
         * there's link layer address:
         *      Multicast NS            MUST add one    add the option
         *      Unicast NS              SHOULD add one  add the option
         * there's no link layer address:
         *                              impossible      do not add the option
         * there's link layer address:
         *      Multicast NS            MUST add one    add the option
         *      Unicast NS              SHOULD add one  add the option

+        *
+        * XXX We deviate from RFC 4429 and still use optimistic DAD as source
+        * for address resolution. However to ensure that we do not interfere
+        * with neighbor cache entries of other neighbors, we MUST ensure
+        * that SLLAO is not sent. Also note, sending multicast NS without SLLAO
+        * is also a deviation from RFC 4861.

         */
         */

-       if (nonce == NULL && (mac = nd6_ifptomac(ifp))) {
+       if (nonce == NULL && (mac = nd6_ifptomac(ifp)) && !is_optimistic) {

                int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
                struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1);
                /* 8 byte alignments... */
                int optlen = sizeof(struct nd_opt_hdr) + ifp->if_addrlen;
                struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)(nd_ns + 1);
                /* 8 byte alignments... */


@@ -794,7 +802,7 @@ nd6_ns_output(
                icmp6len += optlen;
                bzero((caddr_t)nd_opt, optlen);
                nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR;
                icmp6len += optlen;
                bzero((caddr_t)nd_opt, optlen);
                nd_opt->nd_opt_type = ND_OPT_SOURCE_LINKADDR;

-               nd_opt->nd_opt_len = optlen >> 3;
+               nd_opt->nd_opt_len = (uint8_t)(optlen >> 3);

                bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
        }
        /*
                bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
        }
        /*


@@ -814,7 +822,7 @@ nd6_ns_output(
                icmp6len += optlen;
                bzero((caddr_t)nd_opt, optlen);
                nd_opt->nd_opt_type = ND_OPT_NONCE;
                icmp6len += optlen;
                bzero((caddr_t)nd_opt, optlen);
                nd_opt->nd_opt_type = ND_OPT_NONCE;

-               nd_opt->nd_opt_len = optlen >> 3;
+               nd_opt->nd_opt_len = (uint8_t)(optlen >> 3);

                bcopy(nonce, (caddr_t)(nd_opt + 1), ND_OPT_NONCE_LEN);
        }
        ip6->ip6_plen = htons((u_short)icmp6len);
                bcopy(nonce, (caddr_t)(nd_opt + 1), ND_OPT_NONCE_LEN);
        }
        ip6->ip6_plen = htons((u_short)icmp6len);


@@ -848,6 +856,8 @@ nd6_ns_output(
                (void) m_set_service_class(m, MBUF_SC_CTL);
        }
 
                (void) m_set_service_class(m, MBUF_SC_CTL);
        }
 

+       ip6oa.ip6oa_flags |= IP6OAF_SKIP_PF;
+       ip6oa.ip6oa_flags |= IP6OAF_DONT_FRAG;

        ip6_output(m, NULL, NULL, flags, im6o, &outif, &ip6oa);
        if (outif) {
                icmp6_ifstat_inc(outif, ifs6_out_msg);
        ip6_output(m, NULL, NULL, flags, im6o, &outif, &ip6oa);
        if (outif) {
                icmp6_ifstat_inc(outif, ifs6_out_msg);


@@ -906,7 +916,7 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
        bool send_nc_alive_kev = false;
 
        if ((ifp->if_eflags & IFEF_IPV6_ND6ALT) != 0) {
        bool send_nc_alive_kev = false;
 
        if ((ifp->if_eflags & IFEF_IPV6_ND6ALT) != 0) {

-               nd6log((LOG_INFO, "nd6_na_input: on ND6ALT interface!\n"));
+               nd6log(info, "nd6_na_input: on ND6ALT interface!\n");

                goto freeit;
        }
 
                goto freeit;
        }
 


@@ -914,14 +924,15 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
 
        if (ip6->ip6_hlim != IPV6_MAXHLIM) {
        MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
 
        if (ip6->ip6_hlim != IPV6_MAXHLIM) {

-               nd6log((LOG_ERR,
+               nd6log(error,

                    "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n",
                    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),
                    "nd6_na_input: invalid hlim (%d) from %s to %s on %s\n",
                    ip6->ip6_hlim, ip6_sprintf(&ip6->ip6_src),

-                   ip6_sprintf(&ip6->ip6_dst), if_name(ifp)));
+                   ip6_sprintf(&ip6->ip6_dst), if_name(ifp));

                goto bad;
        }
 
        IP6_EXTHDR_CHECK(m, off, icmp6len, return );
                goto bad;
        }
 
        IP6_EXTHDR_CHECK(m, off, icmp6len, return );

+       ip6 = mtod(m, struct ip6_hdr *);

        nd_na = (struct nd_neighbor_advert *)((caddr_t)ip6 + off);
        m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE;
 
        nd_na = (struct nd_neighbor_advert *)((caddr_t)ip6 + off);
        m->m_pkthdr.pkt_flags |= PKTF_INET6_RESOLVE;
 


@@ -935,15 +946,15 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
                goto bad;       /* XXX: impossible */
        }
        if (IN6_IS_ADDR_MULTICAST(&taddr6)) {
                goto bad;       /* XXX: impossible */
        }
        if (IN6_IS_ADDR_MULTICAST(&taddr6)) {

-               nd6log((LOG_ERR,
+               nd6log(error,

                    "nd6_na_input: invalid target address %s\n",
                    "nd6_na_input: invalid target address %s\n",

-                   ip6_sprintf(&taddr6)));
+                   ip6_sprintf(&taddr6));

                goto bad;
        }
        if (IN6_IS_ADDR_MULTICAST(&daddr6)) {
                if (is_solicited) {
                goto bad;
        }
        if (IN6_IS_ADDR_MULTICAST(&daddr6)) {
                if (is_solicited) {

-                       nd6log((LOG_ERR,
-                           "nd6_na_input: a solicited adv is multicasted\n"));
+                       nd6log(error,
+                           "nd6_na_input: a solicited adv is multicasted\n");

                        goto bad;
                }
        }
                        goto bad;
                }
        }


@@ -951,8 +962,8 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
        icmp6len -= sizeof(*nd_na);
        nd6_option_init(nd_na + 1, icmp6len, &ndopts);
        if (nd6_options(&ndopts) < 0) {
        icmp6len -= sizeof(*nd_na);
        nd6_option_init(nd_na + 1, icmp6len, &ndopts);
        if (nd6_options(&ndopts) < 0) {

-               nd6log((LOG_INFO,
-                   "nd6_na_input: invalid ND option, ignored\n"));
+               nd6log(info,
+                   "nd6_na_input: invalid ND option, ignored\n");

                /* nd6_options have incremented stats */
                goto freeit;
        }
                /* nd6_options have incremented stats */
                goto freeit;
        }


@@ -962,11 +973,11 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
                lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
 
                if (((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
                lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
 
                if (((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {

-                       nd6log((LOG_INFO,
+                       nd6log(info,

                            "nd6_na_input: lladdrlen mismatch for %s "
                            "(if %d, NA packet %d)\n",
                            ip6_sprintf(&taddr6), ifp->if_addrlen,
                            "nd6_na_input: lladdrlen mismatch for %s "
                            "(if %d, NA packet %d)\n",
                            ip6_sprintf(&taddr6), ifp->if_addrlen,

-                           lladdrlen - 2));
+                           lladdrlen - 2);

                        goto bad;
                }
        }
                        goto bad;
                }
        }


@@ -1080,7 +1091,7 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
                route_event_enqueue_nwk_wq_entry(rt, NULL,
                    ROUTE_LLENTRY_RESOLVED, NULL, TRUE);
 
                route_event_enqueue_nwk_wq_entry(rt, NULL,
                    ROUTE_LLENTRY_RESOLVED, NULL, TRUE);
 

-               if ((ln->ln_router = is_router) != 0) {
+               if ((ln->ln_router = (short)is_router) != 0) {

                        struct radix_node_head  *rnh = NULL;
                        struct route_event rt_ev;
                        route_event_init(&rt_ev, rt, NULL, ROUTE_LLENTRY_RESOLVED);
                        struct radix_node_head  *rnh = NULL;
                        struct route_event rt_ev;
                        route_event_init(&rt_ev, rt, NULL, ROUTE_LLENTRY_RESOLVED);


@@ -1252,10 +1263,14 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
 
                        RT_UNLOCK(rt);
                        lck_mtx_lock(nd6_mutex);
 
                        RT_UNLOCK(rt);
                        lck_mtx_lock(nd6_mutex);

-                       dr = defrouter_lookup(in6, rt_ifp);
+                       /*
+                        * XXX Handle router lists for route information option
+                        * as well.
+                        */
+                       dr = defrouter_lookup(NULL, in6, rt_ifp);

                        if (dr) {
                        if (dr) {

-                               TAILQ_REMOVE(&nd_defrouter, dr, dr_entry);
-                               defrtrlist_del(dr);
+                               TAILQ_REMOVE(&nd_defrouter_list, dr, dr_entry);
+                               defrtrlist_del(dr, NULL);

                                NDDR_REMREF(dr);        /* remove list reference */
                                NDDR_REMREF(dr);
                                lck_mtx_unlock(nd6_mutex);
                                NDDR_REMREF(dr);        /* remove list reference */
                                NDDR_REMREF(dr);
                                lck_mtx_unlock(nd6_mutex);


@@ -1272,7 +1287,7 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
                        }
                        RT_LOCK(rt);
                }
                        }
                        RT_LOCK(rt);
                }

-               ln->ln_router = is_router;
+               ln->ln_router = (short)is_router;

        }
 
        if (send_nc_alive_kev && (ifp->if_addrlen == IF_LLREACH_MAXLEN)) {
        }
 
        if (send_nc_alive_kev && (ifp->if_addrlen == IF_LLREACH_MAXLEN)) {


@@ -1415,7 +1430,7 @@ nd6_na_output(
        if (IN6_IS_ADDR_MULTICAST(&daddr6)) {
                m->m_flags |= M_MCAST;
 
        if (IN6_IS_ADDR_MULTICAST(&daddr6)) {
                m->m_flags |= M_MCAST;
 

-               im6o = ip6_allocmoptions(M_DONTWAIT);
+               im6o = ip6_allocmoptions(Z_NOWAIT);

                if (im6o == NULL) {
                        m_freem(m);
                        return;
                if (im6o == NULL) {
                        m_freem(m);
                        return;


@@ -1465,9 +1480,9 @@ nd6_na_output(
        src = in6_selectsrc(&dst_sa, NULL, NULL, &ro, NULL, &src_storage,
            ip6oa.ip6oa_boundif, &error);
        if (src == NULL) {
        src = in6_selectsrc(&dst_sa, NULL, NULL, &ro, NULL, &src_storage,
            ip6oa.ip6oa_boundif, &error);
        if (src == NULL) {

-               nd6log((LOG_DEBUG, "nd6_na_output: source can't be "
+               nd6log(debug, "nd6_na_output: source can't be "

                    "determined: dst=%s, error=%d\n",
                    "determined: dst=%s, error=%d\n",

-                   ip6_sprintf(&dst_sa.sin6_addr), error));
+                   ip6_sprintf(&dst_sa.sin6_addr), error);

                goto bad;
        }
        ip6->ip6_src = *src;
                goto bad;
        }
        ip6->ip6_src = *src;


@@ -1524,7 +1539,7 @@ nd6_na_output(
                icmp6len += optlen;
                bzero((caddr_t)nd_opt, optlen);
                nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
                icmp6len += optlen;
                bzero((caddr_t)nd_opt, optlen);
                nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;

-               nd_opt->nd_opt_len = optlen >> 3;
+               nd_opt->nd_opt_len = (uint8_t)(optlen >> 3);

                bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
        } else {
                flags &= ~ND_NA_FLAG_OVERRIDE;
                bcopy(mac, (caddr_t)(nd_opt + 1), ifp->if_addrlen);
        } else {
                flags &= ~ND_NA_FLAG_OVERRIDE;


@@ -1545,6 +1560,8 @@ nd6_na_output(
                (void) m_set_service_class(m, MBUF_SC_CTL);
        }
 
                (void) m_set_service_class(m, MBUF_SC_CTL);
        }
 

+       ip6oa.ip6oa_flags |= IP6OAF_SKIP_PF;
+       ip6oa.ip6oa_flags |= IP6OAF_DONT_FRAG;

        ip6_output(m, NULL, NULL, IPV6_OUTARGS, im6o, &outif, &ip6oa);
        if (outif) {
                icmp6_ifstat_inc(outif, ifs6_out_msg);
        ip6_output(m, NULL, NULL, IPV6_OUTARGS, im6o, &outif, &ip6oa);
        if (outif) {
                icmp6_ifstat_inc(outif, ifs6_out_msg);


@@ -1587,6 +1604,7 @@ nd6_ifptomac(
 #endif
        case IFT_BRIDGE:
        case IFT_ISO88025:
 #endif
        case IFT_BRIDGE:
        case IFT_ISO88025:

+       case IFT_6LOWPAN:

                return (caddr_t)IF_LLADDR(ifp);
        default:
                return NULL;
                return (caddr_t)IF_LLADDR(ifp);
        default:
                return NULL;


@@ -1614,6 +1632,7 @@ struct dadq {
        uint32_t dad_nonce[ND_OPT_NONCE_LEN32];
 };
 
        uint32_t dad_nonce[ND_OPT_NONCE_LEN32];
 };
 

+static ZONE_DECLARE(dad_zone, "nd6_dad", sizeof(struct dadq), ZC_ZFREE_CLEARMEM);

 static struct dadq_head dadq;
 
 void
 static struct dadq_head dadq;
 
 void


@@ -1623,15 +1642,6 @@ nd6_nbr_init(void)
 
        TAILQ_INIT(&dadq);
 
 
        TAILQ_INIT(&dadq);
 

-       dad_size = sizeof(struct dadq);
-       dad_zone = zinit(dad_size, DAD_ZONE_MAX * dad_size, 0, DAD_ZONE_NAME);
-       if (dad_zone == NULL) {
-               panic("%s: failed allocating %s", __func__, DAD_ZONE_NAME);
-               /* NOTREACHED */
-       }
-       zone_change(dad_zone, Z_EXPAND, TRUE);
-       zone_change(dad_zone, Z_CALLERACCT, FALSE);
-

        bzero(&hostrtmask, sizeof hostrtmask);
        hostrtmask.sin6_family = AF_INET6;
        hostrtmask.sin6_len = sizeof hostrtmask;
        bzero(&hostrtmask, sizeof hostrtmask);
        hostrtmask.sin6_family = AF_INET6;
        hostrtmask.sin6_len = sizeof hostrtmask;


@@ -1662,10 +1672,10 @@ nd6_dad_find(struct ifaddr *ifa, struct nd_opt_nonce *nonce)
                    nonce->nd_opt_nonce_len == (ND_OPT_NONCE_LEN + 2) / 8 &&
                    memcmp(&nonce->nd_opt_nonce[0], &dp->dad_nonce[0],
                    ND_OPT_NONCE_LEN) == 0) {
                    nonce->nd_opt_nonce_len == (ND_OPT_NONCE_LEN + 2) / 8 &&
                    memcmp(&nonce->nd_opt_nonce[0], &dp->dad_nonce[0],
                    ND_OPT_NONCE_LEN) == 0) {

-                       nd6log((LOG_ERR, "%s: a looped back NS message is "
+                       nd6log(error, "%s: a looped back NS message is "

                            "detected during DAD for %s. Ignoring.\n",
                            if_name(ifa->ifa_ifp),
                            "detected during DAD for %s. Ignoring.\n",
                            if_name(ifa->ifa_ifp),

-                           ip6_sprintf(IFA_IN6(ifa))));
+                           ip6_sprintf(IFA_IN6(ifa)));

                        dp->dad_ns_lcount++;
                        ++ip6stat.ip6s_dad_loopcount;
                        DAD_UNLOCK(dp);
                        dp->dad_ns_lcount++;
                        ++ip6stat.ip6s_dad_loopcount;
                        DAD_UNLOCK(dp);


@@ -1698,11 +1708,11 @@ nd6_dad_start(
        struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
        struct dadq *dp;
 
        struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
        struct dadq *dp;
 

-       nd6log2((LOG_DEBUG, "%s - %s ifp %s ia6_flags 0x%x\n",
+       nd6log2(debug, "%s - %s ifp %s ia6_flags 0x%x\n",

            __func__,
            ip6_sprintf(&ia->ia_addr.sin6_addr),
            if_name(ia->ia_ifp),
            __func__,
            ip6_sprintf(&ia->ia_addr.sin6_addr),
            if_name(ia->ia_ifp),

-           ia->ia6_flags));
+           ia->ia6_flags);

 
        /*
         * If we don't need DAD, don't do it.
 
        /*
         * If we don't need DAD, don't do it.


@@ -1712,11 +1722,11 @@ nd6_dad_start(
         */
        IFA_LOCK(&ia->ia_ifa);
        if (!(ia->ia6_flags & IN6_IFF_DADPROGRESS)) {
         */
        IFA_LOCK(&ia->ia_ifa);
        if (!(ia->ia6_flags & IN6_IFF_DADPROGRESS)) {

-               nd6log0((LOG_DEBUG,
+               nd6log0(debug,

                    "nd6_dad_start: not a tentative or optimistic address "
                    "%s(%s)\n",
                    ip6_sprintf(&ia->ia_addr.sin6_addr),
                    "nd6_dad_start: not a tentative or optimistic address "
                    "%s(%s)\n",
                    ip6_sprintf(&ia->ia_addr.sin6_addr),

-                   ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"));
+                   ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");

                IFA_UNLOCK(&ia->ia_ifa);
                return;
        }
                IFA_UNLOCK(&ia->ia_ifa);
                return;
        }


@@ -1739,25 +1749,17 @@ nd6_dad_start(
                return;
        }
 
                return;
        }
 

-       dp = zalloc(dad_zone);
-       if (dp == NULL) {
-               nd6log0((LOG_ERR, "nd6_dad_start: memory allocation failed for "
-                   "%s(%s)\n",
-                   ip6_sprintf(&ia->ia_addr.sin6_addr),
-                   ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"));
-               return;
-       }
-       bzero(dp, dad_size);
+       dp = zalloc_flags(dad_zone, Z_WAITOK | Z_ZERO);

        lck_mtx_init(&dp->dad_lock, ifa_mtx_grp, ifa_mtx_attr);
 
        /* Callee adds one reference for us */
        dp = nd6_dad_attach(dp, ifa);
 
        lck_mtx_init(&dp->dad_lock, ifa_mtx_grp, ifa_mtx_attr);
 
        /* Callee adds one reference for us */
        dp = nd6_dad_attach(dp, ifa);
 

-       nd6log0((LOG_DEBUG, "%s: starting %sDAD %sfor %s\n",
+       nd6log0(debug, "%s: starting %sDAD %sfor %s\n",

            if_name(ifa->ifa_ifp),
            (ia->ia6_flags & IN6_IFF_OPTIMISTIC) ? "optimistic " : "",
            (tick_delay == NULL) ? "immediately " : "",
            if_name(ifa->ifa_ifp),
            (ia->ia6_flags & IN6_IFF_OPTIMISTIC) ? "optimistic " : "",
            (tick_delay == NULL) ? "immediately " : "",

-           ip6_sprintf(&ia->ia_addr.sin6_addr)));
+           ip6_sprintf(&ia->ia_addr.sin6_addr));

 
        /*
         * Send NS packet for DAD, ip6_dad_count times.
 
        /*
         * Send NS packet for DAD, ip6_dad_count times.


@@ -1880,8 +1882,8 @@ nd6_unsol_na_output(struct ifaddr *ifa)
                return;
        }
 
                return;
        }
 

-       nd6log((LOG_INFO, "%s: sending unsolicited NA\n",
-           if_name(ifa->ifa_ifp)));
+       nd6log(info, "%s: sending unsolicited NA\n",
+           if_name(ifa->ifa_ifp));

 
        nd6_na_output(ifp, &saddr6, &taddr6, ND_NA_FLAG_OVERRIDE, 1, NULL);
 }
 
        nd6_na_output(ifp, &saddr6, &taddr6, ND_NA_FLAG_OVERRIDE, 1, NULL);
 }


@@ -1896,35 +1898,35 @@ nd6_dad_timer(struct ifaddr *ifa)
 
        /* Sanity check */
        if (ia == NULL) {
 
        /* Sanity check */
        if (ia == NULL) {

-               nd6log0((LOG_ERR, "nd6_dad_timer: called with null parameter\n"));
+               nd6log0(error, "nd6_dad_timer: called with null parameter\n");

                goto done;
        }
 
                goto done;
        }
 

-       nd6log2((LOG_DEBUG, "%s - %s ifp %s ia6_flags 0x%x\n",
+       nd6log2(debug, "%s - %s ifp %s ia6_flags 0x%x\n",

            __func__,
            ip6_sprintf(&ia->ia_addr.sin6_addr),
            if_name(ia->ia_ifp),
            __func__,
            ip6_sprintf(&ia->ia_addr.sin6_addr),
            if_name(ia->ia_ifp),

-           ia->ia6_flags));
+           ia->ia6_flags);

 
        dp = nd6_dad_find(ifa, NULL);
        if (dp == NULL) {
 
        dp = nd6_dad_find(ifa, NULL);
        if (dp == NULL) {

-               nd6log0((LOG_ERR, "nd6_dad_timer: DAD structure not found\n"));
+               nd6log0(error, "nd6_dad_timer: DAD structure not found\n");

                goto done;
        }
        IFA_LOCK(&ia->ia_ifa);
        if (ia->ia6_flags & IN6_IFF_DUPLICATED) {
                goto done;
        }
        IFA_LOCK(&ia->ia_ifa);
        if (ia->ia6_flags & IN6_IFF_DUPLICATED) {

-               nd6log0((LOG_ERR, "nd6_dad_timer: called with duplicated address "
+               nd6log0(error, "nd6_dad_timer: called with duplicated address "

                    "%s(%s)\n",
                    ip6_sprintf(&ia->ia_addr.sin6_addr),
                    "%s(%s)\n",
                    ip6_sprintf(&ia->ia_addr.sin6_addr),

-                   ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"));
+                   ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");

                IFA_UNLOCK(&ia->ia_ifa);
                goto done;
        }
        if ((ia->ia6_flags & IN6_IFF_DADPROGRESS) == 0) {
                IFA_UNLOCK(&ia->ia_ifa);
                goto done;
        }
        if ((ia->ia6_flags & IN6_IFF_DADPROGRESS) == 0) {

-               nd6log0((LOG_ERR, "nd6_dad_timer: not a tentative or optimistic "
+               nd6log0(error, "nd6_dad_timer: not a tentative or optimistic "

                    "address %s(%s)\n",
                    ip6_sprintf(&ia->ia_addr.sin6_addr),
                    "address %s(%s)\n",
                    ip6_sprintf(&ia->ia_addr.sin6_addr),

-                   ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???"));
+                   ifa->ifa_ifp ? if_name(ifa->ifa_ifp) : "???");

                IFA_UNLOCK(&ia->ia_ifa);
                goto done;
        }
                IFA_UNLOCK(&ia->ia_ifa);
                goto done;
        }


@@ -1934,8 +1936,8 @@ nd6_dad_timer(struct ifaddr *ifa)
        DAD_LOCK(dp);
        if (dp->dad_ns_tcount > dad_maxtry) {
                DAD_UNLOCK(dp);
        DAD_LOCK(dp);
        if (dp->dad_ns_tcount > dad_maxtry) {
                DAD_UNLOCK(dp);

-               nd6log0((LOG_INFO, "%s: could not run DAD, driver problem?\n",
-                   if_name(ifa->ifa_ifp)));
+               nd6log0(info, "%s: could not run DAD, driver problem?\n",
+                   if_name(ifa->ifa_ifp));

 
                nd6_dad_detach(dp, ifa);
                goto done;
 
                nd6_dad_detach(dp, ifa);
                goto done;


@@ -1962,10 +1964,10 @@ nd6_dad_timer(struct ifaddr *ifa)
                if (dp->dad_na_icount > 0 || dp->dad_ns_icount) {
                        /* We've seen NS or NA, means DAD has failed. */
                        DAD_UNLOCK(dp);
                if (dp->dad_na_icount > 0 || dp->dad_ns_icount) {
                        /* We've seen NS or NA, means DAD has failed. */
                        DAD_UNLOCK(dp);

-                       nd6log0((LOG_INFO,
-                           "%s: duplicate IPv6 address %s [timer]\n",
+                       nd6log0(info,
+                           "%s: duplicate IPv6 address %s if:%s [timer]\n",

                            __func__, ip6_sprintf(&ia->ia_addr.sin6_addr),
                            __func__, ip6_sprintf(&ia->ia_addr.sin6_addr),

-                           if_name(ia->ia_ifp)));
+                           if_name(ia->ia_ifp));

                        nd6_dad_duplicated(ifa);
                        /* (*dp) will be freed in nd6_dad_duplicated() */
                } else if (dad_enhanced != 0 &&
                        nd6_dad_duplicated(ifa);
                        /* (*dp) will be freed in nd6_dad_duplicated() */
                } else if (dad_enhanced != 0 &&


@@ -1986,12 +1988,10 @@ nd6_dad_timer(struct ifaddr *ifa)
                         * additional probes until the loopback condition
                         * becomes clear when a looped back probe is detected.
                         */
                         * additional probes until the loopback condition
                         * becomes clear when a looped back probe is detected.
                         */

-                       nd6log0((LOG_INFO,
-                           "%s: a looped back NS message is "
-                           "detected during DAD for %s. "
-                           "Another DAD probe is being sent on interface.\n",
+                       nd6log0(info,
+                           "%s: a looped back NS message is detected during DAD for %s. Another DAD probe is being sent on interface %s.\n",

                            __func__, ip6_sprintf(&ia->ia_addr.sin6_addr),
                            __func__, ip6_sprintf(&ia->ia_addr.sin6_addr),

-                           if_name(ia->ia_ifp)));
+                           if_name(ia->ia_ifp));

                        /*
                         * Send an NS immediately and increase dad_count by
                         * nd6_mmaxtries - 1.
                        /*
                         * Send an NS immediately and increase dad_count by
                         * nd6_mmaxtries - 1.


@@ -2020,20 +2020,20 @@ nd6_dad_timer(struct ifaddr *ifa)
                                nd6_unsol_na_output(ifa);
                        }
 
                                nd6_unsol_na_output(ifa);
                        }
 

-                       nd6log0((LOG_DEBUG,
-                           "%s: DAD complete for %s - no duplicates found%s\n",
+                       nd6log0(debug,
+                           "%s: DAD complete for %s - no duplicates found %s\n",

                            if_name(ifa->ifa_ifp),
                            ip6_sprintf(&ia->ia_addr.sin6_addr),
                            if_name(ifa->ifa_ifp),
                            ip6_sprintf(&ia->ia_addr.sin6_addr),

-                           txunsolna ? ", tx unsolicited NA with O=1" : "."));
+                           txunsolna ? ", tx unsolicited NA with O=1" : ".");

 
                        if (dp->dad_ns_lcount > 0) {
 
                        if (dp->dad_ns_lcount > 0) {

-                               nd6log0((LOG_DEBUG,
+                               nd6log0(debug,

                                    "%s: DAD completed while "
                                    "a looped back NS message is detected "
                                    "during DAD for %s om interface %s\n",
                                    __func__,
                                    ip6_sprintf(&ia->ia_addr.sin6_addr),
                                    "%s: DAD completed while "
                                    "a looped back NS message is detected "
                                    "during DAD for %s om interface %s\n",
                                    __func__,
                                    ip6_sprintf(&ia->ia_addr.sin6_addr),

-                                   if_name(ia->ia_ifp)));
+                                   if_name(ia->ia_ifp));

                        }
 
                        in6_post_msg(ia->ia_ifp, KEV_INET6_NEW_USER_ADDR, ia,
                        }
 
                        in6_post_msg(ia->ia_ifp, KEV_INET6_NEW_USER_ADDR, ia,


@@ -2048,7 +2048,7 @@ done:
        }
 }
 
        }
 }
 

-void
+static void

 nd6_dad_duplicated(struct ifaddr *ifa)
 {
        struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;
 nd6_dad_duplicated(struct ifaddr *ifa)
 {
        struct in6_ifaddr *ia = (struct in6_ifaddr *)ifa;


@@ -2063,9 +2063,9 @@ nd6_dad_duplicated(struct ifaddr *ifa)
        }
        IFA_LOCK(&ia->ia_ifa);
        DAD_LOCK(dp);
        }
        IFA_LOCK(&ia->ia_ifa);
        DAD_LOCK(dp);

-       nd6log((LOG_ERR, "%s: NS in/out/loopback=%d/%d, NA in=%d\n",
+       nd6log(error, "%s: NS in/out/loopback=%d/%d/%d, NA in=%d\n",

            __func__, dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_ns_lcount,
            __func__, dp->dad_ns_icount, dp->dad_ns_ocount, dp->dad_ns_lcount,

-           dp->dad_na_icount));
+           dp->dad_na_icount);

        candisable = FALSE;
 
        if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr) &&
        candisable = FALSE;
 
        if (IN6_IS_ADDR_LINKLOCAL(&ia->ia_addr.sin6_addr) &&


@@ -2163,7 +2163,9 @@ nd6_dad_duplicated(struct ifaddr *ifa)
                nd6_if_disable(ifp, TRUE);
        }
 
                nd6_if_disable(ifp, TRUE);
        }
 

-       log(LOG_ERR, "%s: manual intervention required!\n", if_name(ifp));
+       log(LOG_ERR,
+           "%s: manual intervention may be required.\n",
+           if_name(ifp));

 
        /* Send an event to the configuration agent so that the
         * duplicate address will be notified to the user and will
 
        /* Send an event to the configuration agent so that the
         * duplicate address will be notified to the user and will


@@ -2245,7 +2247,8 @@ nd6_dad_ns_input(struct ifaddr *ifa, char *lladdr,
        ++dp->dad_ns_icount;
        if (lladdr && lladdrlen >= ETHER_ADDR_LEN) {
                memcpy(dp->dad_lladdr, lladdr, ETHER_ADDR_LEN);
        ++dp->dad_ns_icount;
        if (lladdr && lladdrlen >= ETHER_ADDR_LEN) {
                memcpy(dp->dad_lladdr, lladdr, ETHER_ADDR_LEN);

-               dp->dad_lladdrlen = lladdrlen;
+               /* fine to truncate as it is compared against sdl_alen */
+               dp->dad_lladdrlen = (uint8_t)lladdrlen;

        }
        DAD_UNLOCK(dp);
        DAD_REMREF(dp);
        }
        DAD_UNLOCK(dp);
        DAD_REMREF(dp);


@@ -2290,8 +2293,8 @@ nd6_dad_na_input(struct mbuf *m, struct ifnet *ifp, struct in6_addr *taddr,
        }
 
        if (replicated) {
        }
 
        if (replicated) {

-               nd6log((LOG_INFO, "%s: ignoring duplicate NA on "
-                   "replicated interface %s\n", __func__, if_name(ifp)));
+               nd6log(info, "%s: ignoring duplicate NA on "
+                   "replicated interface %s\n", __func__, if_name(ifp));

                goto done;
        }
 
                goto done;
        }
 


@@ -2301,9 +2304,9 @@ nd6_dad_na_input(struct mbuf *m, struct ifnet *ifp, struct in6_addr *taddr,
 
        if (!(ia->ia6_flags & IN6_IFF_DADPROGRESS)) {
                IFA_UNLOCK(ifa);
 
        if (!(ia->ia6_flags & IN6_IFF_DADPROGRESS)) {
                IFA_UNLOCK(ifa);

-               nd6log((LOG_INFO, "%s: ignoring duplicate NA on "
+               nd6log(info, "%s: ignoring duplicate NA on "

                    "%s [DAD not in progress]\n", __func__,
                    "%s [DAD not in progress]\n", __func__,

-                   if_name(ifp)));
+                   if_name(ifp));

                goto done;
        }
 
                goto done;
        }
 


@@ -2317,8 +2320,8 @@ nd6_dad_na_input(struct mbuf *m, struct ifnet *ifp, struct in6_addr *taddr,
                if (ip6a && (ip6a->ip6a_flags & IP6A_HASEEN) != 0 &&
                    bcmp(ip6a->ip6a_ehsrc, lladdr, ETHER_ADDR_LEN) != 0) {
                        IFA_UNLOCK(ifa);
                if (ip6a && (ip6a->ip6a_flags & IP6A_HASEEN) != 0 &&
                    bcmp(ip6a->ip6a_ehsrc, lladdr, ETHER_ADDR_LEN) != 0) {
                        IFA_UNLOCK(ifa);

-                       nd6log((LOG_ERR, "%s: ignoring duplicate NA on %s "
-                           "[eh_src != tgtlladdr]\n", __func__, if_name(ifp)));
+                       nd6log(error, "%s: ignoring duplicate NA on %s "
+                           "[eh_src != tgtlladdr]\n", __func__, if_name(ifp));

                        goto done;
                }
        }
                        goto done;
                }
        }


@@ -2327,24 +2330,24 @@ nd6_dad_na_input(struct mbuf *m, struct ifnet *ifp, struct in6_addr *taddr,
 
        dp = nd6_dad_find(ifa, NULL);
        if (dp == NULL) {
 
        dp = nd6_dad_find(ifa, NULL);
        if (dp == NULL) {

-               nd6log((LOG_INFO, "%s: no DAD structure for %s on %s.\n",
-                   __func__, ip6_sprintf(taddr), if_name(ifp)));
+               nd6log(info, "%s: no DAD structure for %s on %s.\n",
+                   __func__, ip6_sprintf(taddr), if_name(ifp));

                goto done;
        }
 
        DAD_LOCK_SPIN(dp);
        if (lladdr != NULL && lladdrlen >= ETHER_ADDR_LEN) {
                memcpy(dp->dad_lladdr, lladdr, ETHER_ADDR_LEN);
                goto done;
        }
 
        DAD_LOCK_SPIN(dp);
        if (lladdr != NULL && lladdrlen >= ETHER_ADDR_LEN) {
                memcpy(dp->dad_lladdr, lladdr, ETHER_ADDR_LEN);

-               dp->dad_lladdrlen = lladdrlen;
+               dp->dad_lladdrlen = (uint8_t)lladdrlen;

        }
        dp->dad_na_icount++;
        DAD_UNLOCK(dp);
        DAD_REMREF(dp);
 
        /* remove the address. */
        }
        dp->dad_na_icount++;
        DAD_UNLOCK(dp);
        DAD_REMREF(dp);
 
        /* remove the address. */

-       nd6log((LOG_INFO,
+       nd6log(info,

            "%s: duplicate IPv6 address %s [processing NA on %s]\n", __func__,
            "%s: duplicate IPv6 address %s [processing NA on %s]\n", __func__,

-           ip6_sprintf(taddr), if_name(ifp)));
+           ip6_sprintf(taddr), if_name(ifp));

 done:
        IFA_LOCK_ASSERT_NOTHELD(ifa);
        IFA_REMREF(ifa);
 done:
        IFA_LOCK_ASSERT_NOTHELD(ifa);
        IFA_REMREF(ifa);


@@ -2423,11 +2426,11 @@ nd6_alt_node_addr_decompose(struct ifnet *ifp, struct sockaddr *sa,
        VERIFY(sdl && (void *)sa != (void *)sdl);
        VERIFY(sin6 && (void *)sa != (void *)sin6);
 
        VERIFY(sdl && (void *)sa != (void *)sdl);
        VERIFY(sin6 && (void *)sa != (void *)sin6);
 

-       bzero(sin6, sizeof *sin6);
+       bzero(sin6, sizeof(*sin6));

        sin6->sin6_len = sizeof *sin6;
        sin6->sin6_family = AF_INET6;
 
        sin6->sin6_len = sizeof *sin6;
        sin6->sin6_family = AF_INET6;
 

-       bzero(sdl, sizeof *sdl);
+       bzero(sdl, sizeof(*sdl));

        sdl->sdl_len = sizeof *sdl;
        sdl->sdl_family = AF_LINK;
        sdl->sdl_type = ifp->if_type;
        sdl->sdl_len = sizeof *sdl;
        sdl->sdl_family = AF_LINK;
        sdl->sdl_type = ifp->if_type;


@@ -2439,8 +2442,9 @@ nd6_alt_node_addr_decompose(struct ifnet *ifp, struct sockaddr *sa,
                struct in6_addr *in6 = &sin6a->sin6_addr;
 
                VERIFY(sa->sa_len == sizeof *sin6);
                struct in6_addr *in6 = &sin6a->sin6_addr;
 
                VERIFY(sa->sa_len == sizeof *sin6);

+               VERIFY(strlen(ifp->if_name) <= IFNAMSIZ);

 
 

-               sdl->sdl_nlen = strlen(ifp->if_name);
+               sdl->sdl_nlen = (u_char)strlen(ifp->if_name);

                bcopy(ifp->if_name, sdl->sdl_data, sdl->sdl_nlen);
                if (in6->s6_addr[11] == 0xff && in6->s6_addr[12] == 0xfe) {
                        sdl->sdl_alen = ETHER_ADDR_LEN;
                bcopy(ifp->if_name, sdl->sdl_data, sdl->sdl_nlen);
                if (in6->s6_addr[11] == 0xff && in6->s6_addr[12] == 0xfe) {
                        sdl->sdl_alen = ETHER_ADDR_LEN;


@@ -2463,7 +2467,7 @@ nd6_alt_node_addr_decompose(struct ifnet *ifp, struct sockaddr *sa,
                struct in6_addr *in6 = &sin6->sin6_addr;
                caddr_t lla = LLADDR(sdla);
 
                struct in6_addr *in6 = &sin6->sin6_addr;
                caddr_t lla = LLADDR(sdla);
 

-               VERIFY(sa->sa_len <= sizeof *sdl);
+               VERIFY(sa->sa_len <= sizeof(*sdl));

                bcopy(sa, sdl, sa->sa_len);
 
                sin6->sin6_scope_id = sdla->sdl_index;
                bcopy(sa, sdl, sa->sa_len);
 
                sin6->sin6_scope_id = sdla->sdl_index;


@@ -2495,7 +2499,7 @@ nd6_alt_node_addr_decompose(struct ifnet *ifp, struct sockaddr *sa,
        }
 }
 
        }
 }
 

-void
+int

 nd6_alt_node_present(struct ifnet *ifp, struct sockaddr_in6 *sin6,
     struct sockaddr_dl *sdl, int32_t rssi, int lqm, int npm)
 {
 nd6_alt_node_present(struct ifnet *ifp, struct sockaddr_in6 *sin6,
     struct sockaddr_dl *sdl, int32_t rssi, int lqm, int npm)
 {


@@ -2550,21 +2554,23 @@ nd6_alt_node_present(struct ifnet *ifp, struct sockaddr_in6 *sin6,
        if (rt == NULL) {
                log(LOG_ERR, "%s: failed to add/update host route to %s.\n",
                    __func__, ip6_sprintf(&sin6->sin6_addr));
        if (rt == NULL) {
                log(LOG_ERR, "%s: failed to add/update host route to %s.\n",
                    __func__, ip6_sprintf(&sin6->sin6_addr));

+               return EHOSTUNREACH;

        } else {
        } else {

-               nd6log((LOG_DEBUG, "%s: host route to %s [lr=0x%llx]\n",
+               nd6log(debug, "%s: host route to %s [lr=0x%llx]\n",

                    __func__, ip6_sprintf(&sin6->sin6_addr),
                    __func__, ip6_sprintf(&sin6->sin6_addr),

-                   (uint64_t)VM_KERNEL_ADDRPERM(lr)));
+                   (uint64_t)VM_KERNEL_ADDRPERM(lr));
+               return 0;

        }
 }
 
 void
        }
 }
 
 void

-nd6_alt_node_absent(struct ifnet *ifp, struct sockaddr_in6 *sin6)
+nd6_alt_node_absent(struct ifnet *ifp, struct sockaddr_in6 *sin6, struct sockaddr_dl *sdl)

 {
        struct rtentry *rt;
        const uint16_t temp_embedded_id = sin6->sin6_addr.s6_addr16[1];
 
 {
        struct rtentry *rt;
        const uint16_t temp_embedded_id = sin6->sin6_addr.s6_addr16[1];
 

-       nd6log((LOG_DEBUG, "%s: host route to %s\n", __func__,
-           ip6_sprintf(&sin6->sin6_addr)));
+       nd6log(debug, "%s: host route to %s\n", __func__,
+           ip6_sprintf(&sin6->sin6_addr));

 
        if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr) &&
            (temp_embedded_id == 0)) {
 
        if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr) &&
            (temp_embedded_id == 0)) {


@@ -2588,6 +2594,17 @@ nd6_alt_node_absent(struct ifnet *ifp, struct sockaddr_in6 *sin6)
                if (!(rt->rt_flags & (RTF_CLONING | RTF_PRCLONING)) &&
                    (rt->rt_flags & (RTF_HOST | RTF_LLINFO | RTF_WASCLONED)) ==
                    (RTF_HOST | RTF_LLINFO | RTF_WASCLONED)) {
                if (!(rt->rt_flags & (RTF_CLONING | RTF_PRCLONING)) &&
                    (rt->rt_flags & (RTF_HOST | RTF_LLINFO | RTF_WASCLONED)) ==
                    (RTF_HOST | RTF_LLINFO | RTF_WASCLONED)) {

+                       /*
+                        * Copy the link layer information in SDL when present
+                        * as it later gets used to issue the kernel event for
+                        * node absence.
+                        */
+                       if (sdl != NULL && rt->rt_gateway != NULL &&
+                           rt->rt_gateway->sa_family == AF_LINK &&
+                           SDL(rt->rt_gateway)->sdl_len <= sizeof(*sdl)) {
+                               bcopy(rt->rt_gateway, sdl, SDL(rt->rt_gateway)->sdl_len);
+                       }
+

                        rt->rt_flags |= RTF_CONDEMNED;
                        RT_UNLOCK(rt);
 
                        rt->rt_flags |= RTF_CONDEMNED;
                        RT_UNLOCK(rt);