xnu-517.7.21.tar.gz

[apple/xnu.git] / bsd / netinet6 / nd6.c

diff --git a/bsd/netinet6/nd6.c b/bsd/netinet6/nd6.c
index ca1bcb13dbc1f27f348bc5febea4f2af651015da..baff898b4eef957a1441d070552af20330d22084 100644 (file)
--- a/bsd/netinet6/nd6.c
+++ b/bsd/netinet6/nd6.c
@@ -1,4 +1,5 @@
-/*     $KAME: nd6.c,v 1.51.2.1 2000/04/13 11:59:29 jinmei Exp $        */
+/*     $FreeBSD: src/sys/netinet6/nd6.c,v 1.20 2002/08/02 20:49:14 rwatson Exp $       */
+/*     $KAME: nd6.c,v 1.144 2001/05/24 07:44:00 itojun Exp $   */

 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.


@@ -46,36 +47,21 @@
 #include <sys/time.h>
 #include <sys/kernel.h>
 #include <sys/errno.h>
 #include <sys/time.h>
 #include <sys/kernel.h>
 #include <sys/errno.h>

-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3)
-#include <sys/ioctl.h>
-#endif

 #include <sys/syslog.h>
 #include <sys/protosw.h>
 #include <kern/queue.h>
 
 #include <sys/syslog.h>
 #include <sys/protosw.h>
 #include <kern/queue.h>
 

+#define DONT_WARN_OBSOLETE

 #include <net/if.h>
 #include <net/if_dl.h>
 #include <net/if_types.h>
 #include <net/if.h>
 #include <net/if_dl.h>
 #include <net/if_types.h>

-#if !(defined(__bsdi__) && _BSDI_VERSION >= 199802) && !defined(__APPLE__)

 #include <net/if_atm.h>
 #include <net/if_atm.h>

-#endif

 #include <net/route.h>
 #include <net/dlil.h>
 
 #include <netinet/in.h>
 #include <net/route.h>
 #include <net/dlil.h>
 
 #include <netinet/in.h>

-#ifndef __NetBSD__

 #include <netinet/if_ether.h>
 #include <netinet/if_ether.h>

-#if __FreeBSD__

 #include <netinet/if_fddi.h>
 #include <netinet/if_fddi.h>

-#endif
-#ifdef __bsdi__
-#include <net/if_fddi.h>
-#endif
-#else /* __NetBSD__ */
-#include <net/if_ether.h>
-#include <netinet/if_inarp.h>
-#include <net/if_fddi.h>
-#endif /* __NetBSD__ */

 #include <netinet6/in6_var.h>
 #include <netinet/ip6.h>
 #include <netinet6/ip6_var.h>
 #include <netinet6/in6_var.h>
 #include <netinet/ip6.h>
 #include <netinet6/ip6_var.h>


@@ -83,12 +69,7 @@
 #include <netinet6/in6_prefix.h>
 #include <netinet/icmp6.h>
 
 #include <netinet6/in6_prefix.h>
 #include <netinet/icmp6.h>
 

-#ifndef __bsdi__

 #include "loop.h"
 #include "loop.h"

-#endif
-#if defined(__NetBSD__) || defined(__OpenBSD__)
-extern struct ifnet loif[NLOOP];
-#endif

 
 #include <net/net_osdep.h>
 
 
 #include <net/net_osdep.h>
 


@@ -104,14 +85,24 @@ int        nd6_delay       = 5;    /* delay first probe time 5 second */
 int    nd6_umaxtries   = 3;    /* maximum unicast query */
 int    nd6_mmaxtries   = 3;    /* maximum multicast query */
 int    nd6_useloopback = 1;    /* use loopback interface for local traffic */
 int    nd6_umaxtries   = 3;    /* maximum unicast query */
 int    nd6_mmaxtries   = 3;    /* maximum multicast query */
 int    nd6_useloopback = 1;    /* use loopback interface for local traffic */

+int    nd6_gctimer     = (60 * 60 * 24); /* 1 day: garbage collection timer */

 
 /* preventing too many loops in ND option parsing */
 int nd6_maxndopt = 10; /* max # of ND options allowed */
 
 
 /* preventing too many loops in ND option parsing */
 int nd6_maxndopt = 10; /* max # of ND options allowed */
 

+int nd6_maxnudhint = 0;        /* max # of subsequent upper layer hints */
+
+#if ND6_DEBUG
+int nd6_debug = 1;
+#else
+int nd6_debug = 0;
+#endif
+

 /* for debugging? */
 static int nd6_inuse, nd6_allocated;
 
 struct llinfo_nd6 llinfo_nd6 = {&llinfo_nd6, &llinfo_nd6};
 /* for debugging? */
 static int nd6_inuse, nd6_allocated;
 
 struct llinfo_nd6 llinfo_nd6 = {&llinfo_nd6, &llinfo_nd6};

+size_t nd_ifinfo_indexlim = 8;

 struct nd_ifinfo *nd_ifinfo = NULL;
 struct nd_drhead nd_defrouter;
 struct nd_prhead nd_prefix = { 0 };
 struct nd_ifinfo *nd_ifinfo = NULL;
 struct nd_drhead nd_defrouter;
 struct nd_prhead nd_prefix = { 0 };


@@ -119,11 +110,9 @@ struct nd_prhead nd_prefix = { 0 };
 int nd6_recalc_reachtm_interval = ND6_RECALC_REACHTM_INTERVAL;
 static struct sockaddr_in6 all1_sa;
 
 int nd6_recalc_reachtm_interval = ND6_RECALC_REACHTM_INTERVAL;
 static struct sockaddr_in6 all1_sa;
 

-static void nd6_slowtimo __P((void *));
+static void nd6_slowtimo_funneled __P((void *));
+static int regen_tmpaddr __P((struct in6_ifaddr *));

 
 

-#if MIP6
-void (*mip6_expired_defrouter_hook)(struct nd_defrouter *dr) = 0;
-#endif

 
 void
 nd6_init()
 
 void
 nd6_init()


@@ -147,38 +136,48 @@ nd6_init()
        nd6_init_done = 1;
 
        /* start timer */
        nd6_init_done = 1;
 
        /* start timer */

-       timeout(nd6_slowtimo, (caddr_t)0, ND6_SLOWTIMER_INTERVAL * hz);
+       timeout(nd6_slowtimo_funneled, (caddr_t)0, ND6_SLOWTIMER_INTERVAL * hz);

 }
 
 void
 nd6_ifattach(ifp)
        struct ifnet *ifp;
 {
 }
 
 void
 nd6_ifattach(ifp)
        struct ifnet *ifp;
 {

-       static size_t if_indexlim = 8;

 
        /*
         * We have some arrays that should be indexed by if_index.
         * since if_index will grow dynamically, they should grow too.
         */
 
        /*
         * We have some arrays that should be indexed by if_index.
         * since if_index will grow dynamically, they should grow too.
         */

-       if (nd_ifinfo == NULL || if_index >= if_indexlim) {
+       if (nd_ifinfo == NULL || if_index >= nd_ifinfo_indexlim) {

                size_t n;
                caddr_t q;
 
                size_t n;
                caddr_t q;
 

-               while (if_index >= if_indexlim)
-                       if_indexlim <<= 1;
+               while (if_index >= nd_ifinfo_indexlim)
+                       nd_ifinfo_indexlim <<= 1;

 
                /* grow nd_ifinfo */
 
                /* grow nd_ifinfo */

-               n = if_indexlim * sizeof(struct nd_ifinfo);
+               n = nd_ifinfo_indexlim * sizeof(struct nd_ifinfo);

                q = (caddr_t)_MALLOC(n, M_IP6NDP, M_WAITOK);
                bzero(q, n);
                if (nd_ifinfo) {
                        bcopy((caddr_t)nd_ifinfo, q, n/2);
                q = (caddr_t)_MALLOC(n, M_IP6NDP, M_WAITOK);
                bzero(q, n);
                if (nd_ifinfo) {
                        bcopy((caddr_t)nd_ifinfo, q, n/2);

-                       _FREE((caddr_t)nd_ifinfo, M_IP6NDP);
+                       FREE((caddr_t)nd_ifinfo, M_IP6NDP);

                }
                nd_ifinfo = (struct nd_ifinfo *)q;
        }
 
 #define ND nd_ifinfo[ifp->if_index]
                }
                nd_ifinfo = (struct nd_ifinfo *)q;
        }
 
 #define ND nd_ifinfo[ifp->if_index]

+
+       /*
+        * Don't initialize if called twice.
+        * XXX: to detect this, we should choose a member that is never set
+        * before initialization of the ND structure itself.  We formaly used
+        * the linkmtu member, which was not suitable because it could be 
+        * initialized via "ifconfig mtu".
+        */
+       if (ND.basereachable)
+               return;
+

        ND.linkmtu = ifindex2ifnet[ifp->if_index]->if_mtu;
        ND.chlim = IPV6_DEFHLIM;
        ND.basereachable = REACHABLE_TIME;
        ND.linkmtu = ifindex2ifnet[ifp->if_index]->if_mtu;
        ND.chlim = IPV6_DEFHLIM;
        ND.basereachable = REACHABLE_TIME;


@@ -198,30 +197,52 @@ void
 nd6_setmtu(ifp)
        struct ifnet *ifp;
 {
 nd6_setmtu(ifp)
        struct ifnet *ifp;
 {

-       struct nd_ifinfo *ndi = &nd_ifinfo[ifp->if_index];
-       u_long oldmaxmtu = ndi->maxmtu;
-       u_long oldlinkmtu = ndi->linkmtu;
-
-       switch(ifp->if_type) {
-        case IFT_ARCNET:       /* XXX MTU handling needs more work */
-                ndi->maxmtu = MIN(60480, ifp->if_mtu);
-                break;
-        case IFT_ETHER:
-                ndi->maxmtu = MIN(ETHERMTU, ifp->if_mtu);
-                break;
-#if defined(__FreeBSD__) || defined(__bsdi__)
-        case IFT_FDDI:
-                ndi->maxmtu = MIN(FDDIIPMTU, ifp->if_mtu);
-                break;
+#ifndef MIN
+#define MIN(a,b) ((a) < (b) ? (a) : (b))

 #endif
 #endif

-#if !(defined(__bsdi__) && _BSDI_VERSION >= 199802) && !defined (__APPLE__)
-        case IFT_ATM:
-                ndi->maxmtu = MIN(ATMMTU, ifp->if_mtu);
-                break;
+ 
+       struct nd_ifinfo *ndi;
+       u_long oldmaxmtu, oldlinkmtu, dl_tag;
+
+       /*
+        * Make sure IPv6 is enabled for the interface first, 
+        * because this can be called directly from SIOCSIFMTU for IPv4
+        */
+
+       if (ifp->if_index >= nd_ifinfo_indexlim) {
+               if (dlil_find_dltag(ifp->if_family, ifp->if_unit, PF_INET6, &dl_tag) != EPROTONOSUPPORT)  
+                       nd6log((LOG_INFO, "setmtu for ifp=% but nd6 is not attached\n", if_name(ifp)));
+               return; /* we're  out of bound for nd_ifinfo */
+       }
+
+       ndi = &nd_ifinfo[ifp->if_index];
+       oldmaxmtu = ndi->maxmtu;
+       oldlinkmtu = ndi->linkmtu;
+
+       switch (ifp->if_type) {
+       case IFT_ARCNET:        /* XXX MTU handling needs more work */
+               ndi->maxmtu = MIN(60480, ifp->if_mtu);
+               break;
+       case IFT_ETHER:
+               ndi->maxmtu = MIN(ETHERMTU, ifp->if_mtu);
+               break;
+       case IFT_FDDI:
+               ndi->maxmtu = MIN(FDDIIPMTU, ifp->if_mtu);
+               break;
+       case IFT_ATM:
+               ndi->maxmtu = MIN(ATMMTU, ifp->if_mtu);
+               break;
+       case IFT_IEEE1394:      /* XXX should be IEEE1394MTU(1500) */
+               ndi->maxmtu = MIN(ETHERMTU, ifp->if_mtu);
+               break;
+#if IFT_IEEE80211
+       case IFT_IEEE80211:     /* XXX should be IEEE80211MTU(1500) */
+               ndi->maxmtu = MIN(ETHERMTU, ifp->if_mtu);
+               break;

 #endif
 #endif

-        default:
-                ndi->maxmtu = ifp->if_mtu;
-                break;
+       default:
+               ndi->maxmtu = ifp->if_mtu;
+               break;

        }
 
        if (oldmaxmtu != ndi->maxmtu) {
        }
 
        if (oldmaxmtu != ndi->maxmtu) {


@@ -243,8 +264,7 @@ nd6_setmtu(ifp)
                                 */
                                if (in6_maxmtu < ndi->linkmtu)
                                        in6_maxmtu = ndi->linkmtu;
                                 */
                                if (in6_maxmtu < ndi->linkmtu)
                                        in6_maxmtu = ndi->linkmtu;

-                       }
-                       else
+                       } else

                                in6_setmaxmtu();
                }
        }
                                in6_setmaxmtu();
                }
        }


@@ -289,6 +309,12 @@ nd6_option(ndopts)
 
        nd_opt = ndopts->nd_opts_search;
 
 
        nd_opt = ndopts->nd_opts_search;
 

+       /* make sure nd_opt_len is inside the buffer */
+       if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) {
+               bzero(ndopts, sizeof(*ndopts));
+               return NULL;
+       }
+

        olen = nd_opt->nd_opt_len << 3;
        if (olen == 0) {
                /*
        olen = nd_opt->nd_opt_len << 3;
        if (olen == 0) {
                /*


@@ -300,7 +326,12 @@ nd6_option(ndopts)
        }
 
        ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);
        }
 
        ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);

-       if (!(ndopts->nd_opts_search < ndopts->nd_opts_last)) {
+       if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
+               /* option overruns the end of buffer, invalid */
+               bzero(ndopts, sizeof(*ndopts));
+               return NULL;
+       } else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
+               /* reached the end of options chain */

                ndopts->nd_opts_done = 1;
                ndopts->nd_opts_search = NULL;
        }
                ndopts->nd_opts_done = 1;
                ndopts->nd_opts_search = NULL;
        }


@@ -333,6 +364,7 @@ nd6_options(ndopts)
                         * Message validation requires that all included
                         * options have a length that is greater than zero.
                         */
                         * Message validation requires that all included
                         * options have a length that is greater than zero.
                         */

+                       icmp6stat.icp6s_nd_badopt++;

                        bzero(ndopts, sizeof(*ndopts));
                        return -1;
                }
                        bzero(ndopts, sizeof(*ndopts));
                        return -1;
                }


@@ -345,10 +377,10 @@ nd6_options(ndopts)
                case ND_OPT_TARGET_LINKADDR:
                case ND_OPT_MTU:
                case ND_OPT_REDIRECTED_HEADER:
                case ND_OPT_TARGET_LINKADDR:
                case ND_OPT_MTU:
                case ND_OPT_REDIRECTED_HEADER:

-               case ND_OPT_ADV_INTERVAL:

                        if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
                        if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {

-                               printf("duplicated ND6 option found "
-                                       "(type=%d)\n", nd_opt->nd_opt_type);
+                               nd6log((LOG_INFO,
+                                   "duplicated ND6 option found (type=%d)\n",
+                                   nd_opt->nd_opt_type));

                                /* XXX bark? */
                        } else {
                                ndopts->nd_opt_array[nd_opt->nd_opt_type]
                                /* XXX bark? */
                        } else {
                                ndopts->nd_opt_array[nd_opt->nd_opt_type]


@@ -363,23 +395,21 @@ nd6_options(ndopts)
                        ndopts->nd_opts_pi_end =
                                (struct nd_opt_prefix_info *)nd_opt;
                        break;
                        ndopts->nd_opts_pi_end =
                                (struct nd_opt_prefix_info *)nd_opt;
                        break;

-               case ND_OPT_HA_INFORMATION:
-                       break;

                default:
                        /*
                         * Unknown options must be silently ignored,
                         * to accomodate future extension to the protocol.
                         */
                default:
                        /*
                         * Unknown options must be silently ignored,
                         * to accomodate future extension to the protocol.
                         */

-                       log(LOG_DEBUG,
+                       nd6log((LOG_DEBUG,

                            "nd6_options: unsupported option %d - "
                            "nd6_options: unsupported option %d - "

-                           "option ignored\n", nd_opt->nd_opt_type);
+                           "option ignored\n", nd_opt->nd_opt_type));

                }
 
 skip1:
                i++;
                if (i > nd6_maxndopt) {
                        icmp6stat.icp6s_nd_toomanyopt++;
                }
 
 skip1:
                i++;
                if (i > nd6_maxndopt) {
                        icmp6stat.icp6s_nd_toomanyopt++;

-                       printf("too many loop in nd opt\n");
+                       nd6log((LOG_INFO, "too many loop in nd opt\n"));

                        break;
                }
 
                        break;
                }
 


@@ -394,33 +424,37 @@ skip1:
  * ND6 timer routine to expire default route list and prefix list
  */
 void
  * ND6 timer routine to expire default route list and prefix list
  */
 void

-nd6_timer(ignored_arg)
+nd6_timer_funneled(ignored_arg)

        void    *ignored_arg;
 {
        void    *ignored_arg;
 {

-       int s;
-       register struct llinfo_nd6 *ln;
-       register struct nd_defrouter *dr;
-       register struct nd_prefix *pr;
-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3) && !defined (__APPLE__)
-       long time_second = time.tv_sec;
-#endif

 #ifdef __APPLE__
         boolean_t   funnel_state;
 #ifdef __APPLE__
         boolean_t   funnel_state;

-       funnel_state = thread_set_funneled(TRUE);
+       funnel_state = thread_funnel_set(network_flock, TRUE);
+#endif
+       nd6_timer(ignored_arg);
+#ifdef __APPLE__
+        (void) thread_funnel_set(network_flock, FALSE);

 #endif
 #endif

+}
+void
+nd6_timer(ignored_arg)
+       void    *ignored_arg;
+{
+       int s;
+       struct llinfo_nd6 *ln;
+       struct nd_defrouter *dr;
+       struct nd_prefix *pr;
+       struct ifnet *ifp;
+       struct in6_ifaddr *ia6, *nia6;
+       struct in6_addrlifetime *lt6;

        
        

-#if __NetBSD__
-       s = splsoftnet();
-#else

        s = splnet();
        s = splnet();

-#endif
-       timeout(nd6_timer, (caddr_t)0, nd6_prune * hz);
+
+       timeout(nd6_timer_funneled, (caddr_t)0, nd6_prune * hz);

 
        ln = llinfo_nd6.ln_next;
 
        ln = llinfo_nd6.ln_next;

-       /* XXX BSD/OS separates this code -- itojun */

        while (ln && ln != &llinfo_nd6) {
                struct rtentry *rt;
        while (ln && ln != &llinfo_nd6) {
                struct rtentry *rt;

-               struct ifnet *ifp;

                struct sockaddr_in6 *dst;
                struct llinfo_nd6 *next = ln->ln_next;
                /* XXX: used for the DELAY case only: */
                struct sockaddr_in6 *dst;
                struct llinfo_nd6 *next = ln->ln_next;
                /* XXX: used for the DELAY case only: */


@@ -441,15 +475,24 @@ nd6_timer(ignored_arg)
                        ln = next;
                        continue;
                }
                        ln = next;
                        continue;
                }

-               
+

                /* sanity check */
                /* sanity check */

-               if (!rt)
-                       panic("rt=0 in nd6_timer(ln=%p)\n", ln);
-               if (rt->rt_llinfo && (struct llinfo_nd6 *)rt->rt_llinfo != ln)
-                       panic("rt_llinfo(%p) is not equal to ln(%p)\n",
+               if (!rt) {
+                       printf("rt=0 in nd6_timer(ln=%p)\n", ln);
+                       ln = next;
+                       continue;
+               }
+               if (rt->rt_llinfo && (struct llinfo_nd6 *)rt->rt_llinfo != ln) {
+                       printf("rt_llinfo(%p) is not equal to ln(%p)\n",

                              rt->rt_llinfo, ln);
                              rt->rt_llinfo, ln);

-               if (!dst)
-                       panic("dst=0 in nd6_timer(ln=%p)\n", ln);
+                       ln = next;
+                       continue;       
+               }
+               if (!dst) {
+                       printf("dst=0 in nd6_timer(ln=%p)\n", ln);
+                       ln = next;
+                       continue;
+               }

 
                switch (ln->ln_state) {
                case ND6_LLINFO_INCOMPLETE:
 
                switch (ln->ln_state) {
                case ND6_LLINFO_INCOMPLETE:


@@ -461,6 +504,7 @@ nd6_timer(ignored_arg)
                                        ln, 0);
                        } else {
                                struct mbuf *m = ln->ln_hold;
                                        ln, 0);
                        } else {
                                struct mbuf *m = ln->ln_hold;

+                               ln->ln_hold = NULL;

                                if (m) {
                                        if (rt->rt_ifp) {
                                                /*
                                if (m) {
                                        if (rt->rt_ifp) {
                                                /*


@@ -476,17 +520,22 @@ nd6_timer(ignored_arg)
                                                    ICMP6_DST_UNREACH_ADDR, 0);
                                        ln->ln_hold = NULL;
                                }
                                                    ICMP6_DST_UNREACH_ADDR, 0);
                                        ln->ln_hold = NULL;
                                }

-                               nd6_free(rt);
+                               next = nd6_free(rt);

                        }
                        break;
                case ND6_LLINFO_REACHABLE:
                        }
                        break;
                case ND6_LLINFO_REACHABLE:

-                       if (ln->ln_expire)
+                       if (ln->ln_expire) {

                                ln->ln_state = ND6_LLINFO_STALE;
                                ln->ln_state = ND6_LLINFO_STALE;

+                               ln->ln_expire = time_second + nd6_gctimer;
+                       }

                        break;
                        break;

-               /*
-                * ND6_LLINFO_STALE state requires nothing for timer
-                * routine.
-                */
+
+               case ND6_LLINFO_STALE:
+                       /* Garbage Collection(RFC 2461 5.3) */
+                       if (ln->ln_expire)
+                               next = nd6_free(rt);
+                       break;
+

                case ND6_LLINFO_DELAY:
                        if (ndi && (ndi->flags & ND6_IFF_PERFORMNUD) != 0) {
                                /* We need NUD */
                case ND6_LLINFO_DELAY:
                        if (ndi && (ndi->flags & ND6_IFF_PERFORMNUD) != 0) {
                                /* We need NUD */


@@ -497,9 +546,10 @@ nd6_timer(ignored_arg)
                                nd6_ns_output(ifp, &dst->sin6_addr,
                                              &dst->sin6_addr,
                                              ln, 0);
                                nd6_ns_output(ifp, &dst->sin6_addr,
                                              &dst->sin6_addr,
                                              ln, 0);

-                       }
-                       else
+                       } else {

                                ln->ln_state = ND6_LLINFO_STALE; /* XXX */
                                ln->ln_state = ND6_LLINFO_STALE; /* XXX */

+                               ln->ln_expire = time_second + nd6_gctimer;
+                       }

                        break;
                case ND6_LLINFO_PROBE:
                        if (ln->ln_asked < nd6_umaxtries) {
                        break;
                case ND6_LLINFO_PROBE:
                        if (ln->ln_asked < nd6_umaxtries) {


@@ -509,17 +559,14 @@ nd6_timer(ignored_arg)
                                nd6_ns_output(ifp, &dst->sin6_addr,
                                               &dst->sin6_addr, ln, 0);
                        } else {
                                nd6_ns_output(ifp, &dst->sin6_addr,
                                               &dst->sin6_addr, ln, 0);
                        } else {

-                               nd6_free(rt);
+                               next = nd6_free(rt);

                        }
                        break;
                        }
                        break;

-               case ND6_LLINFO_WAITDELETE:
-                       nd6_free(rt);
-                       break;

                }
                ln = next;
        }
        
                }
                ln = next;
        }
        

-       /* expire */
+       /* expire default router list */

        dr = TAILQ_FIRST(&nd_defrouter);
        while (dr) {
                if (dr->expire && dr->expire < time_second) {
        dr = TAILQ_FIRST(&nd_defrouter);
        while (dr) {
                if (dr->expire && dr->expire < time_second) {


@@ -528,53 +575,98 @@ nd6_timer(ignored_arg)
                        defrtrlist_del(dr);
                        dr = t;
                } else {
                        defrtrlist_del(dr);
                        dr = t;
                } else {

-#if MIP6
-                       if (mip6_expired_defrouter_hook)
-                               (*mip6_expired_defrouter_hook)(dr);
-#endif /* MIP6 */

                        dr = TAILQ_NEXT(dr, dr_entry);
                }
        }
                        dr = TAILQ_NEXT(dr, dr_entry);
                }
        }

-       pr = nd_prefix.lh_first;
-       while (pr) {
-               struct in6_ifaddr *ia6;
-               struct in6_addrlifetime *lt6;

 
 

-               if (IN6_IS_ADDR_UNSPECIFIED(&pr->ndpr_addr))
-                       ia6 = NULL;
-               else
-                       ia6 = in6ifa_ifpwithaddr(pr->ndpr_ifp, &pr->ndpr_addr);
-
-               if (ia6) {
-                       /* check address lifetime */
-                       lt6 = &ia6->ia6_lifetime;
-                       if (lt6->ia6t_preferred && lt6->ia6t_preferred < time_second)
-                               ia6->ia6_flags |= IN6_IFF_DEPRECATED;
-                       if (lt6->ia6t_expire && lt6->ia6t_expire < time_second) {
-                               if (!IN6_IS_ADDR_UNSPECIFIED(&pr->ndpr_addr))
-                                       in6_ifdel(pr->ndpr_ifp, &pr->ndpr_addr);
-                               /* xxx ND_OPT_PI_FLAG_ONLINK processing */
+       /*
+        * expire interface addresses.
+        * in the past the loop was inside prefix expiry processing.
+        * However, from a stricter speci-confrmance standpoint, we should
+        * rather separate address lifetimes and prefix lifetimes.
+        */
+  addrloop:
+       for (ia6 = in6_ifaddr; ia6; ia6 = nia6) {
+               nia6 = ia6->ia_next;
+               /* check address lifetime */
+               lt6 = &ia6->ia6_lifetime;
+               if (IFA6_IS_INVALID(ia6)) {
+                       int regen = 0;
+
+                       /*
+                        * If the expiring address is temporary, try
+                        * regenerating a new one.  This would be useful when
+                        * we suspended a laptop PC, then turned it on after a
+                        * period that could invalidate all temporary
+                        * addresses.  Although we may have to restart the
+                        * loop (see below), it must be after purging the
+                        * address.  Otherwise, we'd see an infinite loop of
+                        * regeneration. 
+                        */
+                       if (ip6_use_tempaddr &&
+                           (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
+                               if (regen_tmpaddr(ia6) == 0)
+                                       regen = 1;
+                       }
+
+                       in6_purgeaddr(&ia6->ia_ifa);
+
+                       if (regen)
+                               goto addrloop; /* XXX: see below */
+               }
+               if (IFA6_IS_DEPRECATED(ia6)) {
+                       int oldflags = ia6->ia6_flags;
+
+                       ia6->ia6_flags |= IN6_IFF_DEPRECATED;
+
+                       /*
+                        * If a temporary address has just become deprecated,
+                        * regenerate a new one if possible.
+                        */
+                       if (ip6_use_tempaddr &&
+                           (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
+                           (oldflags & IN6_IFF_DEPRECATED) == 0) {
+
+                               if (regen_tmpaddr(ia6) == 0) {
+                                       /*
+                                        * A new temporary address is
+                                        * generated.
+                                        * XXX: this means the address chain
+                                        * has changed while we are still in
+                                        * the loop.  Although the change
+                                        * would not cause disaster (because
+                                        * it's not a deletion, but an
+                                        * addition,) we'd rather restart the
+                                        * loop just for safety.  Or does this 
+                                        * significantly reduce performance??
+                                        */
+                                       goto addrloop;
+                               }

                        }
                        }

+               } else {
+                       /*
+                        * A new RA might have made a deprecated address
+                        * preferred.
+                        */
+                       ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;

                }
                }

+       }

 
 

+       /* expire prefix list */
+       pr = nd_prefix.lh_first;
+       while (pr) {

                /*
                 * check prefix lifetime.
                 * since pltime is just for autoconf, pltime processing for
                 * prefix is not necessary.
                /*
                 * check prefix lifetime.
                 * since pltime is just for autoconf, pltime processing for
                 * prefix is not necessary.

-                *
-                * we offset expire time by NDPR_KEEP_EXPIRE, so that we
-                * can use the old prefix information to validate the
-                * next prefix information to come.  See prelist_update()
-                * for actual validation.

                 */
                 */

-               if (pr->ndpr_expire
-                && pr->ndpr_expire + NDPR_KEEP_EXPIRED < time_second) {
+               if (pr->ndpr_expire && pr->ndpr_expire < time_second) {

                        struct nd_prefix *t;
                        t = pr->ndpr_next;
 
                        /*
                         * address expiration and prefix expiration are
                        struct nd_prefix *t;
                        t = pr->ndpr_next;
 
                        /*
                         * address expiration and prefix expiration are

-                        * separate.  NEVER perform in6_ifdel here.
+                        * separate.  NEVER perform in6_purgeaddr here.

                         */
 
                        prelist_remove(pr);
                         */
 
                        prelist_remove(pr);


@@ -583,9 +675,70 @@ nd6_timer(ignored_arg)
                        pr = pr->ndpr_next;
        }
        splx(s);
                        pr = pr->ndpr_next;
        }
        splx(s);

-#ifdef __APPLE__
-       (void) thread_set_funneled(funnel_state);
-#endif
+}
+
+static int
+regen_tmpaddr(ia6)
+       struct in6_ifaddr *ia6; /* deprecated/invalidated temporary address */
+{
+       struct ifaddr *ifa;
+       struct ifnet *ifp;
+       struct in6_ifaddr *public_ifa6 = NULL;
+
+       ifp = ia6->ia_ifa.ifa_ifp;
+       for (ifa = ifp->if_addrlist.tqh_first; ifa;
+            ifa = ifa->ifa_list.tqe_next)
+       {
+               struct in6_ifaddr *it6;
+
+               if (ifa->ifa_addr->sa_family != AF_INET6)
+                       continue;
+
+               it6 = (struct in6_ifaddr *)ifa;
+
+               /* ignore no autoconf addresses. */
+               if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0)
+                       continue;
+
+               /* ignore autoconf addresses with different prefixes. */
+               if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr)
+                       continue;
+
+               /*
+                * Now we are looking at an autoconf address with the same
+                * prefix as ours.  If the address is temporary and is still
+                * preferred, do not create another one.  It would be rare, but
+                * could happen, for example, when we resume a laptop PC after
+                * a long period.
+                */
+               if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
+                   !IFA6_IS_DEPRECATED(it6)) {
+                       public_ifa6 = NULL;
+                       break;
+               }
+
+               /*
+                * This is a public autoconf address that has the same prefix
+                * as ours.  If it is preferred, keep it.  We can't break the
+                * loop here, because there may be a still-preferred temporary
+                * address with the prefix.
+                */
+               if (!IFA6_IS_DEPRECATED(it6))
+                   public_ifa6 = it6;
+       }
+
+       if (public_ifa6 != NULL) {
+               int e;
+
+               if ((e = in6_tmpifadd(public_ifa6, 0)) != 0) {
+                       log(LOG_NOTICE, "regen_tmpaddr: failed to create a new"
+                           " tmp addr,errno=%d\n", e);
+                       return(-1);
+               }
+               return(0);
+       }
+
+       return(-1);

 }
 
 /*
 }
 
 /*


@@ -620,8 +773,14 @@ nd6_purge(ifp)
        for (pr = nd_prefix.lh_first; pr; pr = npr) {
                npr = pr->ndpr_next;
                if (pr->ndpr_ifp == ifp) {
        for (pr = nd_prefix.lh_first; pr; pr = npr) {
                npr = pr->ndpr_next;
                if (pr->ndpr_ifp == ifp) {

-                       if (!IN6_IS_ADDR_UNSPECIFIED(&pr->ndpr_addr))
-                               in6_ifdel(pr->ndpr_ifp, &pr->ndpr_addr);
+                       /*
+                        * Previously, pr->ndpr_addr is removed as well,
+                        * but I strongly believe we don't have to do it.
+                        * nd6_purge() is only called from in6_ifdetach(),
+                        * which removes all the associated interface addresses
+                        * by itself.
+                        * (jinmei@kame.net 20010129)
+                        */

                        prelist_remove(pr);
                }
        }
                        prelist_remove(pr);
                }
        }


@@ -630,10 +789,12 @@ nd6_purge(ifp)
        if (nd6_defifindex == ifp->if_index)
                nd6_setdefaultiface(0);
 
        if (nd6_defifindex == ifp->if_index)
                nd6_setdefaultiface(0);
 

-       /* refresh default router list */
-       bzero(&drany, sizeof(drany));
-       defrouter_delreq(&drany, 0);
-       defrouter_select();
+       if (!ip6_forwarding && (ip6_accept_rtadv || (ifp->if_eflags & IFEF_ACCEPT_RTADVD))) { 
+               /* refresh default router list */
+               bzero(&drany, sizeof(drany));
+               defrouter_delreq(&drany, 0);
+               defrouter_select();
+       }

 
        /*
         * Nuke neighbor cache entries for the ifp.
 
        /*
         * Nuke neighbor cache entries for the ifp.


@@ -652,30 +813,7 @@ nd6_purge(ifp)
                    rt->rt_gateway->sa_family == AF_LINK) {
                        sdl = (struct sockaddr_dl *)rt->rt_gateway;
                        if (sdl->sdl_index == ifp->if_index)
                    rt->rt_gateway->sa_family == AF_LINK) {
                        sdl = (struct sockaddr_dl *)rt->rt_gateway;
                        if (sdl->sdl_index == ifp->if_index)

-                               nd6_free(rt);
-               }
-               ln = nln;
-       }
-
-       /*
-        * Neighbor cache entry for interface route will be retained
-        * with ND6_LLINFO_WAITDELETE state, by nd6_free().  Nuke it.
-        */
-       ln = llinfo_nd6.ln_next;
-       while (ln && ln != &llinfo_nd6) {
-               struct rtentry *rt;
-               struct sockaddr_dl *sdl;
-
-               nln = ln->ln_next;
-               rt = ln->ln_rt;
-               if (rt && rt->rt_gateway &&
-                   rt->rt_gateway->sa_family == AF_LINK) {
-                       sdl = (struct sockaddr_dl *)rt->rt_gateway;
-                       if (sdl->sdl_index == ifp->if_index) {
-                               rtrequest(RTM_DELETE, rt_key(rt),
-                                   (struct sockaddr *)0, rt_mask(rt), 0,
-                                   (struct rtentry **)0);
-                       }
+                               nln = nd6_free(rt);

                }
                ln = nln;
        }
                }
                ln = nln;
        }


@@ -694,11 +832,10 @@ nd6_lookup(addr6, create, ifp)
        sin6.sin6_len = sizeof(struct sockaddr_in6);
        sin6.sin6_family = AF_INET6;
        sin6.sin6_addr = *addr6;
        sin6.sin6_len = sizeof(struct sockaddr_in6);
        sin6.sin6_family = AF_INET6;
        sin6.sin6_addr = *addr6;

-       rt = rtalloc1((struct sockaddr *)&sin6, create
-#if __FreeBSD__ || defined (__APPLE__)
-                     , 0UL
-#endif /*__FreeBSD__*/
-                     );
+#if SCOPEDROUTING
+       sin6.sin6_scope_id = in6_addr2scopeid(ifp, addr6);
+#endif
+       rt = rtalloc1((struct sockaddr *)&sin6, create, 0UL);

        if (rt && (rt->rt_flags & RTF_LLINFO) == 0) {
                /*
                 * This is the case for the default route.
        if (rt && (rt->rt_flags & RTF_LLINFO) == 0) {
                /*
                 * This is the case for the default route.


@@ -707,7 +844,7 @@ nd6_lookup(addr6, create, ifp)
                 * interface route.
                 */
                if (create) {
                 * interface route.
                 */
                if (create) {

-                       RTFREE(rt);
+                       rtfree(rt);

                        rt = 0;
                }
        }
                        rt = 0;
                }
        }


@@ -728,10 +865,10 @@ nd6_lookup(addr6, create, ifp)
                                return(NULL);
 
                        /*
                                return(NULL);
 
                        /*

-                        * Create a new route. RTF_LLINFO is necessary
+                        * Create a new route.  RTF_LLINFO is necessary

                         * to create a Neighbor Cache entry for the
                         * destination in nd6_rtrequest which will be
                         * to create a Neighbor Cache entry for the
                         * destination in nd6_rtrequest which will be

-                        * called in rtequest via ifa->ifa_rtrequest.
+                        * called in rtrequest via ifa->ifa_rtrequest.

                         */
                        if ((e = rtrequest(RTM_ADD, (struct sockaddr *)&sin6,
                                           ifa->ifa_addr,
                         */
                        if ((e = rtrequest(RTM_ADD, (struct sockaddr *)&sin6,
                                           ifa->ifa_addr,


@@ -751,27 +888,32 @@ nd6_lookup(addr6, create, ifp)
                                        (struct llinfo_nd6 *)rt->rt_llinfo;
                                ln->ln_state = ND6_LLINFO_NOSTATE;
                        }
                                        (struct llinfo_nd6 *)rt->rt_llinfo;
                                ln->ln_state = ND6_LLINFO_NOSTATE;
                        }

-               }
-               else
+               } else

                        return(NULL);
        }
                        return(NULL);
        }

-       rt->rt_refcnt--;
+       rtunref(rt);

        /*
         * Validation for the entry.
        /*
         * Validation for the entry.

+        * Note that the check for rt_llinfo is necessary because a cloned
+        * route from a parent route that has the L flag (e.g. the default
+        * route to a p2p interface) may have the flag, too, while the
+        * destination is not actually a neighbor.

         * XXX: we can't use rt->rt_ifp to check for the interface, since
         *      it might be the loopback interface if the entry is for our
         *      own address on a non-loopback interface. Instead, we should
         * XXX: we can't use rt->rt_ifp to check for the interface, since
         *      it might be the loopback interface if the entry is for our
         *      own address on a non-loopback interface. Instead, we should

-        *      use rt->rt_ifa->ifa_ifp, which would specify the REAL interface.
+        *      use rt->rt_ifa->ifa_ifp, which would specify the REAL
+        *      interface.

         */
         */

-       if ((rt->rt_flags & RTF_GATEWAY) || (rt->rt_flags & RTF_LLINFO) == 0 ||
-           rt->rt_gateway->sa_family != AF_LINK ||
-           (ifp && rt->rt_ifa->ifa_ifp != ifp)) {
+       if ((ifp->if_type !=IFT_PPP) && ((rt->rt_flags & RTF_GATEWAY) || (rt->rt_flags & RTF_LLINFO) == 0 ||
+           rt->rt_gateway->sa_family != AF_LINK ||  rt->rt_llinfo == NULL ||
+
+           (ifp && rt->rt_ifa->ifa_ifp != ifp))) {

                if (create) {
                        log(LOG_DEBUG, "nd6_lookup: failed to lookup %s (if = %s)\n",
                            ip6_sprintf(addr6), ifp ? if_name(ifp) : "unspec");
                        /* xxx more logs... kazu */
                }
                if (create) {
                        log(LOG_DEBUG, "nd6_lookup: failed to lookup %s (if = %s)\n",
                            ip6_sprintf(addr6), ifp ? if_name(ifp) : "unspec");
                        /* xxx more logs... kazu */
                }

-               return(0);
+               return(NULL);

        }
        return(rt);
 }
        }
        return(rt);
 }


@@ -782,36 +924,38 @@ nd6_lookup(addr6, create, ifp)
  */
 int
 nd6_is_addr_neighbor(addr, ifp)
  */
 int
 nd6_is_addr_neighbor(addr, ifp)

-       struct in6_addr *addr;
+       struct sockaddr_in6 *addr;

        struct ifnet *ifp;
 {
        struct ifnet *ifp;
 {

-       register struct ifaddr *ifa;
+       struct ifaddr *ifa;

        int i;
 
 #define IFADDR6(a) ((((struct in6_ifaddr *)(a))->ia_addr).sin6_addr)
 #define IFMASK6(a) ((((struct in6_ifaddr *)(a))->ia_prefixmask).sin6_addr)
 
        int i;
 
 #define IFADDR6(a) ((((struct in6_ifaddr *)(a))->ia_addr).sin6_addr)
 #define IFMASK6(a) ((((struct in6_ifaddr *)(a))->ia_prefixmask).sin6_addr)
 

-       /* A link-local address is always a neighbor. */
-       if (IN6_IS_ADDR_LINKLOCAL(addr))
+       /*
+        * A link-local address is always a neighbor.
+        * XXX: we should use the sin6_scope_id field rather than the embedded
+        * interface index.
+        */
+       if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr) &&
+           ntohs(*(u_int16_t *)&addr->sin6_addr.s6_addr[2]) == ifp->if_index)

                return(1);
 
        /*
         * If the address matches one of our addresses,
         * it should be a neighbor.
         */
                return(1);
 
        /*
         * If the address matches one of our addresses,
         * it should be a neighbor.
         */

-#if defined(__bsdi__) || (defined(__FreeBSD__) && __FreeBSD__ < 3)
-       for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
-#else

        for (ifa = ifp->if_addrlist.tqh_first;
             ifa;
             ifa = ifa->ifa_list.tqe_next)
        for (ifa = ifp->if_addrlist.tqh_first;
             ifa;
             ifa = ifa->ifa_list.tqe_next)

-#endif

        {
                if (ifa->ifa_addr->sa_family != AF_INET6)
                        next: continue;
 
                for (i = 0; i < 4; i++) {
        {
                if (ifa->ifa_addr->sa_family != AF_INET6)
                        next: continue;
 
                for (i = 0; i < 4; i++) {

-                       if ((IFADDR6(ifa).s6_addr32[i] ^ addr->s6_addr32[i]) &
+                       if ((IFADDR6(ifa).s6_addr32[i] ^
+                            addr->sin6_addr.s6_addr32[i]) &

                            IFMASK6(ifa).s6_addr32[i])
                                goto next;
                }
                            IFMASK6(ifa).s6_addr32[i])
                                goto next;
                }


@@ -822,7 +966,7 @@ nd6_is_addr_neighbor(addr, ifp)
         * Even if the address matches none of our addresses, it might be
         * in the neighbor cache.
         */
         * Even if the address matches none of our addresses, it might be
         * in the neighbor cache.
         */

-       if (nd6_lookup(addr, 0, ifp))
+       if (nd6_lookup(&addr->sin6_addr, 0, ifp) != NULL)

                return(1);
 
        return(0);
                return(1);
 
        return(0);


@@ -833,31 +977,26 @@ nd6_is_addr_neighbor(addr, ifp)
 /*
  * Free an nd6 llinfo entry.
  */
 /*
  * Free an nd6 llinfo entry.
  */

-void
+struct llinfo_nd6 *

 nd6_free(rt)
        struct rtentry *rt;
 {
 nd6_free(rt)
        struct rtentry *rt;
 {

-       struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
-       struct sockaddr_dl *sdl;
+       struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo, *next;

        struct in6_addr in6 = ((struct sockaddr_in6 *)rt_key(rt))->sin6_addr;
        struct nd_defrouter *dr;
 
        /*
        struct in6_addr in6 = ((struct sockaddr_in6 *)rt_key(rt))->sin6_addr;
        struct nd_defrouter *dr;
 
        /*

-        * Clear all destination cache entries for the neighbor.
-        * XXX: is it better to restrict this to hosts?
+        * we used to have pfctlinput(PRC_HOSTDEAD) here. 
+        * even though it is not harmful, it was not really necessary.

         */
         */

-       pfctlinput(PRC_HOSTDEAD, rt_key(rt));

 
 

-       if (!ip6_forwarding && ip6_accept_rtadv) { /* XXX: too restrictive? */
+       if (!ip6_forwarding && (ip6_accept_rtadv || (rt->rt_ifp->if_eflags & IFEF_ACCEPT_RTADVD))) {

                int s;
                int s;

-#ifdef __NetBSD__
-               s = splsoftnet();
-#else

                s = splnet();
                s = splnet();

-#endif

                dr = defrouter_lookup(&((struct sockaddr_in6 *)rt_key(rt))->sin6_addr,
                                      rt->rt_ifp);
                dr = defrouter_lookup(&((struct sockaddr_in6 *)rt_key(rt))->sin6_addr,
                                      rt->rt_ifp);

-               if (ln->ln_router || dr) {
+
+               if (ln && ln->ln_router || dr) {

                        /*
                         * rt6_flush must be called whether or not the neighbor
                         * is in the Default Router List.
                        /*
                         * rt6_flush must be called whether or not the neighbor
                         * is in the Default Router List.


@@ -876,12 +1015,20 @@ nd6_free(rt)
                        /*
                         * Temporarily fake the state to choose a new default
                         * router and to perform on-link determination of
                        /*
                         * Temporarily fake the state to choose a new default
                         * router and to perform on-link determination of

-                        * prefixes coreectly.
+                        * prefixes correctly.

                         * Below the state will be set correctly,
                         * or the entry itself will be deleted.
                         */
                        ln->ln_state = ND6_LLINFO_INCOMPLETE;
 
                         * Below the state will be set correctly,
                         * or the entry itself will be deleted.
                         */
                        ln->ln_state = ND6_LLINFO_INCOMPLETE;
 

+                       /*
+                        * Since defrouter_select() does not affect the
+                        * on-link determination and MIP6 needs the check
+                        * before the default router selection, we perform
+                        * the check now.
+                        */
+                       pfxlist_onlink_check();
+

                        if (dr == TAILQ_FIRST(&nd_defrouter)) {
                                /*
                                 * It is used as the current default router,
                        if (dr == TAILQ_FIRST(&nd_defrouter)) {
                                /*
                                 * It is used as the current default router,


@@ -895,22 +1042,30 @@ nd6_free(rt)
 
                                defrouter_select();
                        }
 
                                defrouter_select();
                        }

-                       pfxlist_onlink_check();

                }
                splx(s);
        }
 
                }
                splx(s);
        }
 

-       if (rt->rt_refcnt > 0 && (sdl = SDL(rt->rt_gateway)) &&
-           sdl->sdl_family == AF_LINK) {
-               sdl->sdl_alen = 0;
-               ln->ln_state = ND6_LLINFO_WAITDELETE;
-               ln->ln_asked = 0;
-               rt->rt_flags &= ~RTF_REJECT;
-               return;
-       }
+       /*
+        * Before deleting the entry, remember the next entry as the
+        * return value.  We need this because pfxlist_onlink_check() above
+        * might have freed other entries (particularly the old next entry) as
+        * a side effect (XXX).
+        */
+       if (ln)
+               next = ln->ln_next;
+       else
+               next = 0;

 
 

+       /*
+        * Detach the route from the routing tree and the list of neighbor
+        * caches, and disable the route entry not to be used in already
+        * cached routes.
+        */

        rtrequest(RTM_DELETE, rt_key(rt), (struct sockaddr *)0,
                  rt_mask(rt), 0, (struct rtentry **)0);
        rtrequest(RTM_DELETE, rt_key(rt), (struct sockaddr *)0,
                  rt_mask(rt), 0, (struct rtentry **)0);

+
+       return(next);

 }
 
 /*
 }
 
 /*


@@ -919,14 +1074,12 @@ nd6_free(rt)
  * XXX cost-effective metods?
  */
 void
  * XXX cost-effective metods?
  */
 void

-nd6_nud_hint(rt, dst6)
+nd6_nud_hint(rt, dst6, force)

        struct rtentry *rt;
        struct in6_addr *dst6;
        struct rtentry *rt;
        struct in6_addr *dst6;

+       int force;

 {
        struct llinfo_nd6 *ln;
 {
        struct llinfo_nd6 *ln;

-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3) && !defined (__APPLE__)
-       long time_second = time.tv_sec;
-#endif

 
        /*
         * If the caller specified "rt", use that.  Otherwise, resolve the
 
        /*
         * If the caller specified "rt", use that.  Otherwise, resolve the


@@ -939,11 +1092,10 @@ nd6_nud_hint(rt, dst6)
                        return;
        }
 
                        return;
        }
 

-       if ((rt->rt_flags & RTF_GATEWAY)
-        || (rt->rt_flags & RTF_LLINFO) == 0
-        || !rt->rt_llinfo
-        || !rt->rt_gateway
-        || rt->rt_gateway->sa_family != AF_LINK) {
+       if ((rt->rt_flags & RTF_GATEWAY) != 0 ||
+           (rt->rt_flags & RTF_LLINFO) == 0 ||
+           !rt->rt_llinfo || !rt->rt_gateway ||
+           rt->rt_gateway->sa_family != AF_LINK) {

                /* This is not a host route. */
                return;
        }
                /* This is not a host route. */
                return;
        }


@@ -952,134 +1104,68 @@ nd6_nud_hint(rt, dst6)
        if (ln->ln_state < ND6_LLINFO_REACHABLE)
                return;
 
        if (ln->ln_state < ND6_LLINFO_REACHABLE)
                return;
 

-       ln->ln_state = ND6_LLINFO_REACHABLE;
-       if (ln->ln_expire && nd_ifinfo)
-               ln->ln_expire = time_second +
-                       (rt->rt_ifp ? nd_ifinfo[rt->rt_ifp->if_index].reachable : 0) ;
-}
-
-#if OLDIP6OUTPUT
-/*
- * Resolve an IP6 address into an ethernet address. If success,
- * desten is filled in. If there is no entry in ndptab,
- * set one up and multicast a solicitation for the IP6 address.
- * Hold onto this mbuf and resend it once the address
- * is finally resolved. A return value of 1 indicates
- * that desten has been filled in and the packet should be sent
- * normally; a 0 return indicates that the packet has been
- * taken over here, either now or for later transmission.
- */
-int
-nd6_resolve(ifp, rt, m, dst, desten)
-       struct ifnet *ifp;
-       struct rtentry *rt;
-       struct mbuf *m;
-       struct sockaddr *dst;
-       u_char *desten;
-{
-       struct llinfo_nd6 *ln = (struct llinfo_nd6 *)NULL;
-       struct sockaddr_dl *sdl;
-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3) && !defined (__APPLE__)
-       long time_second = time.tv_sec;
-#endif
-
-       if (m->m_flags & M_MCAST) {
-               switch (ifp->if_type) {
-               case IFT_ETHER:
-               case IFT_FDDI:                  
-                       ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr,
-                                                desten);
-                       return(1);
-                       break;
-               case IFT_ARCNET:
-                       *desten = 0;
-                       return(1);
-                       break;
-               default:
-                       return(0);
-               }
-       }
-       if (rt && (rt->rt_flags & RTF_LLINFO) != 0)
-               ln = (struct llinfo_nd6 *)rt->rt_llinfo;
-       else {
-               if ((rt = nd6_lookup(&(SIN6(dst)->sin6_addr), 1, ifp)) != NULL)
-                       ln = (struct llinfo_nd6 *)rt->rt_llinfo;
-       }
-       if (!ln || !rt) {
-               log(LOG_DEBUG, "nd6_resolve: can't allocate llinfo for %s\n",
-                       ip6_sprintf(&(SIN6(dst)->sin6_addr)));
-               m_freem(m);
-               return(0);
-       }
-       sdl = SDL(rt->rt_gateway);

        /*
        /*

-        * Ckeck the address family and length is valid, the address
-        * is resolved; otherwise, try to resolve.
+        * if we get upper-layer reachability confirmation many times,
+        * it is possible we have false information.

         */
         */

-       if (ln->ln_state >= ND6_LLINFO_REACHABLE
-          && sdl->sdl_family == AF_LINK
-          && sdl->sdl_alen != 0) {
-               bcopy(LLADDR(sdl), desten, sdl->sdl_alen);
-               if (ln->ln_state == ND6_LLINFO_STALE) {
-                       ln->ln_asked = 0;
-                       ln->ln_state = ND6_LLINFO_DELAY;
-                       ln->ln_expire = time_second + nd6_delay;
-               }
-               return(1);
-       }
-       /*
-        * There is an ndp entry, but no ethernet address
-        * response yet. Replace the held mbuf with this
-        * latest one.
-        *
-        * XXX Does the code conform to rate-limiting rule?
-        * (RFC 2461 7.2.2)
-        */
-       if (ln->ln_state == ND6_LLINFO_WAITDELETE ||
-           ln->ln_state == ND6_LLINFO_NOSTATE)
-               ln->ln_state = ND6_LLINFO_INCOMPLETE;
-       if (ln->ln_hold)
-               m_freem(ln->ln_hold);
-       ln->ln_hold = m;
-       if (ln->ln_expire) {
-               rt->rt_flags &= ~RTF_REJECT;
-               if (ln->ln_asked < nd6_mmaxtries &&
-                   ln->ln_expire < time_second) {
-                       ln->ln_asked++;
-                       ln->ln_expire = time_second +
-                               nd_ifinfo[ifp->if_index].retrans / 1000;
-                       nd6_ns_output(ifp, NULL, &(SIN6(dst)->sin6_addr),
-                               ln, 0);
-               }
+       if (!force) {
+               ln->ln_byhint++;
+               if (ln->ln_byhint > nd6_maxnudhint)
+                       return;

        }
        }

-       return(0);
+
+       ln->ln_state = ND6_LLINFO_REACHABLE;
+       if (ln->ln_expire)
+               ln->ln_expire = time_second +
+                       nd_ifinfo[rt->rt_ifp->if_index].reachable;

 }
 }

-#endif /* OLDIP6OUTPUT */

 
 void
 
 void

-#if defined(__bsdi__) && _BSDI_VERSION >= 199802
-nd6_rtrequest(req, rt, info)
-       int     req;
-       struct rtentry *rt;
-       struct rt_addrinfo *info; /* xxx unused */
-#else

 nd6_rtrequest(req, rt, sa)
        int     req;
        struct rtentry *rt;
        struct sockaddr *sa; /* xxx unused */
 nd6_rtrequest(req, rt, sa)
        int     req;
        struct rtentry *rt;
        struct sockaddr *sa; /* xxx unused */

-#endif

 {
        struct sockaddr *gate = rt->rt_gateway;
        struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
        static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK};
        struct ifnet *ifp = rt->rt_ifp;
        struct ifaddr *ifa;
 {
        struct sockaddr *gate = rt->rt_gateway;
        struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
        static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK};
        struct ifnet *ifp = rt->rt_ifp;
        struct ifaddr *ifa;

-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3) && !defined (__APPLE__)
-       long time_second = time.tv_sec;
-#endif

 
 

-       if (rt->rt_flags & RTF_GATEWAY)
+       if ((rt->rt_flags & RTF_GATEWAY))
+               return;
+
+       if (nd6_need_cache(ifp) == 0 && (rt->rt_flags & RTF_HOST) == 0) {
+               /*
+                * This is probably an interface direct route for a link
+                * which does not need neighbor caches (e.g. fe80::%lo0/64).
+                * We do not need special treatment below for such a route.
+                * Moreover, the RTF_LLINFO flag which would be set below
+                * would annoy the ndp(8) command.
+                */
+               return;
+       }
+
+       if (req == RTM_RESOLVE &&
+           (nd6_need_cache(ifp) == 0 || /* stf case */
+            !nd6_is_addr_neighbor((struct sockaddr_in6 *)rt_key(rt), ifp))) {
+               /*
+                * FreeBSD and BSD/OS often make a cloned host route based
+                * on a less-specific route (e.g. the default route).
+                * If the less specific route does not have a "gateway"
+                * (this is the case when the route just goes to a p2p or an
+                * stf interface), we'll mistakenly make a neighbor cache for
+                * the host route, and will see strange neighbor solicitation
+                * for the corresponding destination.  In order to avoid the
+                * confusion, we check if the destination of the route is
+                * a neighbor in terms of neighbor discovery, and stop the
+                * process if not.  Additionally, we remove the LLINFO flag
+                * so that ndp(8) will not try to get the neighbor information
+                * of the destination.
+                */
+               rt->rt_flags &= ~RTF_LLINFO;

                return;
                return;

+       }

 
        switch (req) {
        case RTM_ADD:
 
        switch (req) {
        case RTM_ADD:


@@ -1093,7 +1179,7 @@ nd6_rtrequest(req, rt, sa)
                if (rt->rt_flags & (RTF_CLONING | RTF_LLINFO)) {
                        /*
                         * Case 1: This route should come from
                if (rt->rt_flags & (RTF_CLONING | RTF_LLINFO)) {
                        /*
                         * Case 1: This route should come from

-                        * a route to interface. RTF_LLINFO flag is set
+                        * a route to interface.  RTF_LLINFO flag is set

                         * for a host route whose destination should be
                         * treated as on-link.
                         */
                         * for a host route whose destination should be
                         * treated as on-link.
                         */


@@ -1106,15 +1192,15 @@ nd6_rtrequest(req, rt, sa)
                                ln->ln_expire = time_second;
 #if 1
                        if (ln && ln->ln_expire == 0) {
                                ln->ln_expire = time_second;
 #if 1
                        if (ln && ln->ln_expire == 0) {

-                               /* cludge for desktops */
+                               /* kludge for desktops */

 #if 0
 #if 0

-                               printf("nd6_request: time.tv_sec is zero; "
+                               printf("nd6_rtequest: time.tv_sec is zero; "

                                       "treat it as 1\n");
 #endif
                                ln->ln_expire = 1;
                        }
 #endif
                                       "treat it as 1\n");
 #endif
                                ln->ln_expire = 1;
                        }
 #endif

-                       if (rt->rt_flags & RTF_CLONING)
+                       if ((rt->rt_flags & RTF_CLONING))

                                break;
                }
                /*
                                break;
                }
                /*


@@ -1127,10 +1213,10 @@ nd6_rtrequest(req, rt, sa)
                 *   (7.2.6 paragraph 4), however, it also says that we
                 *   SHOULD provide a mechanism to prevent multicast NA storm.
                 *   we don't have anything like it right now.
                 *   (7.2.6 paragraph 4), however, it also says that we
                 *   SHOULD provide a mechanism to prevent multicast NA storm.
                 *   we don't have anything like it right now.

-                *   note that the mechanism need a mutual agreement
+                *   note that the mechanism needs a mutual agreement

                 *   between proxies, which means that we need to implement
                 *   between proxies, which means that we need to implement

-                *   a new protocol, or new kludge.
-                * - from RFC2461 6.2.4, host MUST NOT send unsolicited NA.
+                *   a new protocol, or a new kludge.
+                * - from RFC2461 6.2.4, host MUST NOT send an unsolicited NA.

                 *   we need to check ip6forwarding before sending it.
                 *   (or should we allow proxy ND configuration only for
                 *   routers?  there's no mention about proxy ND from hosts)
                 *   we need to check ip6forwarding before sending it.
                 *   (or should we allow proxy ND configuration only for
                 *   routers?  there's no mention about proxy ND from hosts)


@@ -1146,7 +1232,7 @@ nd6_rtrequest(req, rt, sa)
 #endif
                /* FALLTHROUGH */
        case RTM_RESOLVE:
 #endif
                /* FALLTHROUGH */
        case RTM_RESOLVE:

-               if ((ifp->if_flags & IFF_POINTOPOINT) == 0) {
+               if ((ifp->if_flags & (IFF_POINTOPOINT | IFF_LOOPBACK)) == 0) {

                        /*
                         * Address resolution isn't necessary for a point to
                         * point link, so we can skip this test for a p2p link.
                        /*
                         * Address resolution isn't necessary for a point to
                         * point link, so we can skip this test for a p2p link.


@@ -1154,7 +1240,8 @@ nd6_rtrequest(req, rt, sa)
                        if (gate->sa_family != AF_LINK ||
                            gate->sa_len < sizeof(null_sdl)) {
                                log(LOG_DEBUG,
                        if (gate->sa_family != AF_LINK ||
                            gate->sa_len < sizeof(null_sdl)) {
                                log(LOG_DEBUG,

-                                   "nd6_rtrequest: bad gateway value\n");
+                                   "nd6_rtrequest: bad gateway value: %s\n",
+                                   if_name(ifp));

                                break;
                        }
                        SDL(gate)->sdl_type = ifp->if_type;
                                break;
                        }
                        SDL(gate)->sdl_type = ifp->if_type;


@@ -1184,6 +1271,7 @@ nd6_rtrequest(req, rt, sa)
                         * which is specified by ndp command.
                         */
                        ln->ln_state = ND6_LLINFO_REACHABLE;
                         * which is specified by ndp command.
                         */
                        ln->ln_state = ND6_LLINFO_REACHABLE;

+                       ln->ln_byhint = 0;

                } else {
                        /*
                         * When req == RTM_RESOLVE, rt is created and
                } else {
                        /*
                         * When req == RTM_RESOLVE, rt is created and


@@ -1208,22 +1296,13 @@ nd6_rtrequest(req, rt, sa)
                        caddr_t macp = nd6_ifptomac(ifp);
                        ln->ln_expire = 0;
                        ln->ln_state = ND6_LLINFO_REACHABLE;
                        caddr_t macp = nd6_ifptomac(ifp);
                        ln->ln_expire = 0;
                        ln->ln_state = ND6_LLINFO_REACHABLE;

+                       ln->ln_byhint = 0;

                        if (macp) {
                                Bcopy(macp, LLADDR(SDL(gate)), ifp->if_addrlen);
                                SDL(gate)->sdl_alen = ifp->if_addrlen;
                        }
                        if (nd6_useloopback) {
                        if (macp) {
                                Bcopy(macp, LLADDR(SDL(gate)), ifp->if_addrlen);
                                SDL(gate)->sdl_alen = ifp->if_addrlen;
                        }
                        if (nd6_useloopback) {

-#ifdef __bsdi__
-#if _BSDI_VERSION >= 199802
-                               extern struct ifnet *loifp;
-                               rt->rt_ifp = loifp;     /*XXX*/
-#else
-                               extern struct ifnet loif;
-                               rt->rt_ifp = &loif;     /*XXX*/
-#endif
-#else /* non-bsdi */
-                               rt->rt_ifp = &loif[0];  /*XXX*/
-#endif
+                               rt->rt_ifp = &loif[0];  /* XXX */

                                /*
                                 * Make sure rt_ifa be equal to the ifaddr
                                 * corresponding to the address.
                                /*
                                 * Make sure rt_ifa be equal to the ifaddr
                                 * corresponding to the address.


@@ -1233,14 +1312,13 @@ nd6_rtrequest(req, rt, sa)
                                 * of the loopback address.
                                 */
                                if (ifa != rt->rt_ifa) {
                                 * of the loopback address.
                                 */
                                if (ifa != rt->rt_ifa) {

-                                       rt->rt_ifa->ifa_refcnt--;
-                                       ifa->ifa_refcnt++;
-                                       rt->rt_ifa = ifa;
+                                       rtsetifa(rt, ifa);

                                }
                        }
                } else if (rt->rt_flags & RTF_ANNOUNCE) {
                        ln->ln_expire = 0;
                        ln->ln_state = ND6_LLINFO_REACHABLE;
                                }
                        }
                } else if (rt->rt_flags & RTF_ANNOUNCE) {
                        ln->ln_expire = 0;
                        ln->ln_state = ND6_LLINFO_REACHABLE;

+                       ln->ln_byhint = 0;

 
                        /* join solicited node multicast for proxy ND */
                        if (ifp->if_flags & IFF_MULTICAST) {
 
                        /* join solicited node multicast for proxy ND */
                        if (ifp->if_flags & IFF_MULTICAST) {


@@ -1254,10 +1332,11 @@ nd6_rtrequest(req, rt, sa)
                                llsol.s6_addr32[2] = htonl(1);
                                llsol.s6_addr8[12] = 0xff;
 
                                llsol.s6_addr32[2] = htonl(1);
                                llsol.s6_addr8[12] = 0xff;
 

-                               (void)in6_addmulti(&llsol, ifp, &error);
-                               if (error)
-                                       printf(
-"nd6_rtrequest: could not join solicited node multicast (errno=%d)\n", error);
+                               if (!in6_addmulti(&llsol, ifp, &error)) {
+                                       nd6log((LOG_ERR, "%s: failed to join "
+                                           "%s (errno=%d)\n", if_name(ifp),
+                                           ip6_sprintf(&llsol), error));
+                               }

                        }
                }
                break;
                        }
                }
                break;


@@ -1290,86 +1369,11 @@ nd6_rtrequest(req, rt, sa)
                rt->rt_flags &= ~RTF_LLINFO;
                if (ln->ln_hold)
                        m_freem(ln->ln_hold);
                rt->rt_flags &= ~RTF_LLINFO;
                if (ln->ln_hold)
                        m_freem(ln->ln_hold);

+               ln->ln_hold = NULL;

                Free((caddr_t)ln);
        }
 }
 
                Free((caddr_t)ln);
        }
 }
 

-void
-#if defined(__bsdi__) && _BSDI_VERSION >= 199802
-nd6_p2p_rtrequest(req, rt, info)
-       int     req;
-       struct rtentry *rt;
-       struct rt_addrinfo *info; /* xxx unused */
-#else
-nd6_p2p_rtrequest(req, rt, sa)
-       int     req;
-       struct rtentry *rt;
-       struct sockaddr *sa; /* xxx unused */
-#endif
-{
-       struct sockaddr *gate = rt->rt_gateway;
-       static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK};
-       struct ifnet *ifp = rt->rt_ifp;
-       struct ifaddr *ifa;
-
-       if (rt->rt_flags & RTF_GATEWAY)
-               return;
-
-       switch (req) {
-       case RTM_ADD:
-               /*
-                * There is no backward compatibility :)
-                *
-                * if ((rt->rt_flags & RTF_HOST) == 0 &&
-                *     SIN(rt_mask(rt))->sin_addr.s_addr != 0xffffffff)
-                *         rt->rt_flags |= RTF_CLONING;
-                */
-               if (rt->rt_flags & RTF_CLONING) {
-                       /*
-                        * Case 1: This route should come from
-                        * a route to interface.
-                        */
-                       rt_setgate(rt, rt_key(rt),
-                                  (struct sockaddr *)&null_sdl);
-                       gate = rt->rt_gateway;
-                       SDL(gate)->sdl_type = ifp->if_type;
-                       SDL(gate)->sdl_index = ifp->if_index;
-                       break;
-               }
-               /* Announce a new entry if requested. */
-               if (rt->rt_flags & RTF_ANNOUNCE)
-                       nd6_na_output(ifp,
-                                     &SIN6(rt_key(rt))->sin6_addr,
-                                     &SIN6(rt_key(rt))->sin6_addr,
-                                     ip6_forwarding ? ND_NA_FLAG_ROUTER : 0,
-                                     1, NULL);
-               /* FALLTHROUGH */
-       case RTM_RESOLVE:
-               /*
-                * check if rt_key(rt) is one of my address assigned
-                * to the interface.
-                */
-               ifa = (struct ifaddr *)in6ifa_ifpwithaddr(rt->rt_ifp,
-                                         &SIN6(rt_key(rt))->sin6_addr);
-               if (ifa) {
-                       if (nd6_useloopback) {
-#ifdef __bsdi__
-#if _BSDI_VERSION >= 199802
-                               extern struct ifnet *loifp;
-                               rt->rt_ifp = loifp;     /*XXX*/
-#else
-                               extern struct ifnet loif;
-                               rt->rt_ifp = &loif;     /*XXX*/
-#endif
-#else
-                               rt->rt_ifp = &loif[0];  /*XXX*/
-#endif /*__bsdi__*/
-                       }
-               }
-               break;
-       }
-}
-

 int
 nd6_ioctl(cmd, data, ifp)
        u_long cmd;
 int
 nd6_ioctl(cmd, data, ifp)
        u_long cmd;


@@ -1389,20 +1393,18 @@ nd6_ioctl(cmd, data, ifp)
 
        switch (cmd) {
        case SIOCGDRLST_IN6:
 
        switch (cmd) {
        case SIOCGDRLST_IN6:

+               /*
+                * obsolete API, use sysctl under net.inet6.icmp6
+                */

                bzero(drl, sizeof(*drl));
                bzero(drl, sizeof(*drl));

-#ifdef __NetBSD__
-               s = splsoftnet();
-#else

                s = splnet();
                s = splnet();

-#endif

                dr = TAILQ_FIRST(&nd_defrouter);
                while (dr && i < DRLSTSIZ) {
                        drl->defrouter[i].rtaddr = dr->rtaddr;
                        if (IN6_IS_ADDR_LINKLOCAL(&drl->defrouter[i].rtaddr)) {
                                /* XXX: need to this hack for KAME stack */
                                drl->defrouter[i].rtaddr.s6_addr16[1] = 0;
                dr = TAILQ_FIRST(&nd_defrouter);
                while (dr && i < DRLSTSIZ) {
                        drl->defrouter[i].rtaddr = dr->rtaddr;
                        if (IN6_IS_ADDR_LINKLOCAL(&drl->defrouter[i].rtaddr)) {
                                /* XXX: need to this hack for KAME stack */
                                drl->defrouter[i].rtaddr.s6_addr16[1] = 0;

-                       }
-                       else
+                       } else

                                log(LOG_ERR,
                                    "default router list contains a "
                                    "non-linklocal address(%s)\n",
                                log(LOG_ERR,
                                    "default router list contains a "
                                    "non-linklocal address(%s)\n",


@@ -1418,23 +1420,23 @@ nd6_ioctl(cmd, data, ifp)
                splx(s);
                break;
        case SIOCGPRLST_IN6:
                splx(s);
                break;
        case SIOCGPRLST_IN6:

+               /*
+                * obsolete API, use sysctl under net.inet6.icmp6
+                */

                /*
                 * XXX meaning of fields, especialy "raflags", is very
                 * differnet between RA prefix list and RR/static prefix list.
                 * how about separating ioctls into two?
                 */
                bzero(prl, sizeof(*prl));
                /*
                 * XXX meaning of fields, especialy "raflags", is very
                 * differnet between RA prefix list and RR/static prefix list.
                 * how about separating ioctls into two?
                 */
                bzero(prl, sizeof(*prl));

-#ifdef __NetBSD__
-               s = splsoftnet();
-#else

                s = splnet();
                s = splnet();

-#endif

                pr = nd_prefix.lh_first;
                while (pr && i < PRLSTSIZ) {
                        struct nd_pfxrouter *pfr;
                        int j;
 
                pr = nd_prefix.lh_first;
                while (pr && i < PRLSTSIZ) {
                        struct nd_pfxrouter *pfr;
                        int j;
 

-                       prl->prefix[i].prefix = pr->ndpr_prefix.sin6_addr;
+                       (void)in6_embedscope(&prl->prefix[i].prefix,
+                           &pr->ndpr_prefix, NULL, NULL);

                        prl->prefix[i].raflags = pr->ndpr_raf;
                        prl->prefix[i].prefixlen = pr->ndpr_plen;
                        prl->prefix[i].vltime = pr->ndpr_vltime;
                        prl->prefix[i].raflags = pr->ndpr_raf;
                        prl->prefix[i].prefixlen = pr->ndpr_plen;
                        prl->prefix[i].vltime = pr->ndpr_vltime;


@@ -1444,15 +1446,14 @@ nd6_ioctl(cmd, data, ifp)
 
                        pfr = pr->ndpr_advrtrs.lh_first;
                        j = 0;
 
                        pfr = pr->ndpr_advrtrs.lh_first;
                        j = 0;

-                       while(pfr) {
+                       while (pfr) {

                                if (j < DRLSTSIZ) {
 #define RTRADDR prl->prefix[i].advrtr[j]
                                        RTRADDR = pfr->router->rtaddr;
                                        if (IN6_IS_ADDR_LINKLOCAL(&RTRADDR)) {
                                                /* XXX: hack for KAME */
                                                RTRADDR.s6_addr16[1] = 0;
                                if (j < DRLSTSIZ) {
 #define RTRADDR prl->prefix[i].advrtr[j]
                                        RTRADDR = pfr->router->rtaddr;
                                        if (IN6_IS_ADDR_LINKLOCAL(&RTRADDR)) {
                                                /* XXX: hack for KAME */
                                                RTRADDR.s6_addr16[1] = 0;

-                                       }
-                                       else
+                                       } else

                                                log(LOG_ERR,
                                                    "a router(%s) advertises "
                                                    "a prefix with "
                                                log(LOG_ERR,
                                                    "a router(%s) advertises "
                                                    "a prefix with "


@@ -1476,7 +1477,8 @@ nd6_ioctl(cmd, data, ifp)
                     rpp = LIST_NEXT(rpp, rp_entry)) {
                        if (i >= PRLSTSIZ)
                                break;
                     rpp = LIST_NEXT(rpp, rp_entry)) {
                        if (i >= PRLSTSIZ)
                                break;

-                       prl->prefix[i].prefix = rpp->rp_prefix.sin6_addr;
+                       (void)in6_embedscope(&prl->prefix[i].prefix,
+                           &pr->ndpr_prefix, NULL, NULL);

                        prl->prefix[i].raflags = rpp->rp_raf;
                        prl->prefix[i].prefixlen = rpp->rp_plen;
                        prl->prefix[i].vltime = rpp->rp_vltime;
                        prl->prefix[i].raflags = rpp->rp_raf;
                        prl->prefix[i].prefixlen = rpp->rp_plen;
                        prl->prefix[i].vltime = rpp->rp_vltime;


@@ -1490,12 +1492,36 @@ nd6_ioctl(cmd, data, ifp)
              }
                splx(s);
 
              }
                splx(s);
 

+               break;
+       case OSIOCGIFINFO_IN6:
+               if (!nd_ifinfo || i >= nd_ifinfo_indexlim) {
+                       error = EINVAL;
+                       break;
+               }
+               ndi->ndi.linkmtu = nd_ifinfo[ifp->if_index].linkmtu;
+               ndi->ndi.maxmtu = nd_ifinfo[ifp->if_index].maxmtu;
+               ndi->ndi.basereachable =
+                   nd_ifinfo[ifp->if_index].basereachable;
+               ndi->ndi.reachable = nd_ifinfo[ifp->if_index].reachable;
+               ndi->ndi.retrans = nd_ifinfo[ifp->if_index].retrans;
+               ndi->ndi.flags = nd_ifinfo[ifp->if_index].flags;
+               ndi->ndi.recalctm = nd_ifinfo[ifp->if_index].recalctm;
+               ndi->ndi.chlim = nd_ifinfo[ifp->if_index].chlim;
+               ndi->ndi.receivedra = nd_ifinfo[ifp->if_index].receivedra;

                break;
        case SIOCGIFINFO_IN6:
                break;
        case SIOCGIFINFO_IN6:

+               if (!nd_ifinfo || i >= nd_ifinfo_indexlim) {
+                       error = EINVAL;
+                       break;
+               }

                ndi->ndi = nd_ifinfo[ifp->if_index];
                break;
        case SIOCSIFINFO_FLAGS:
                /* XXX: almost all other fields of ndi->ndi is unused */
                ndi->ndi = nd_ifinfo[ifp->if_index];
                break;
        case SIOCSIFINFO_FLAGS:
                /* XXX: almost all other fields of ndi->ndi is unused */

+               if (!nd_ifinfo || i >= nd_ifinfo_indexlim) {
+                       error = EINVAL;
+                       break;
+               }

                nd_ifinfo[ifp->if_index].flags = ndi->ndi.flags;
                break;
        case SIOCSNDFLUSH_IN6:  /* XXX: the ioctl name is confusing... */
                nd_ifinfo[ifp->if_index].flags = ndi->ndi.flags;
                break;
        case SIOCSNDFLUSH_IN6:  /* XXX: the ioctl name is confusing... */


@@ -1514,15 +1540,26 @@ nd6_ioctl(cmd, data, ifp)
                /* flush all the prefix advertised by routers */
                struct nd_prefix *pr, *next;
 
                /* flush all the prefix advertised by routers */
                struct nd_prefix *pr, *next;
 

-#ifdef __NetBSD__
-               s = splsoftnet();
-#else

                s = splnet();
                s = splnet();

-#endif

                for (pr = nd_prefix.lh_first; pr; pr = next) {
                for (pr = nd_prefix.lh_first; pr; pr = next) {

+                       struct in6_ifaddr *ia, *ia_next;
+

                        next = pr->ndpr_next;
                        next = pr->ndpr_next;

-                       if (!IN6_IS_ADDR_UNSPECIFIED(&pr->ndpr_addr))
-                               in6_ifdel(pr->ndpr_ifp, &pr->ndpr_addr);
+
+                       if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
+                               continue; /* XXX */
+
+                       /* do we really have to remove addresses as well? */
+                       for (ia = in6_ifaddr; ia; ia = ia_next) {
+                               /* ia might be removed.  keep the next ptr. */
+                               ia_next = ia->ia_next;
+
+                               if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0)
+                                       continue;
+
+                               if (ia->ia6_ndpr == pr)
+                                       in6_purgeaddr(&ia->ia_ifa);
+                       }

                        prelist_remove(pr);
                }
                splx(s);
                        prelist_remove(pr);
                }
                splx(s);


@@ -1533,11 +1570,7 @@ nd6_ioctl(cmd, data, ifp)
                /* flush all the default routers */
                struct nd_defrouter *dr, *next;
 
                /* flush all the default routers */
                struct nd_defrouter *dr, *next;
 

-#ifdef __NetBSD__
-               s = splsoftnet();
-#else

                s = splnet();
                s = splnet();

-#endif

                if ((dr = TAILQ_FIRST(&nd_defrouter)) != NULL) {
                        /*
                         * The first entry of the list may be stored in
                if ((dr = TAILQ_FIRST(&nd_defrouter)) != NULL) {
                        /*
                         * The first entry of the list may be stored in


@@ -1569,11 +1602,7 @@ nd6_ioctl(cmd, data, ifp)
                                *idp = htons(ifp->if_index);
                }
 
                                *idp = htons(ifp->if_index);
                }
 

-#ifdef __NetBSD__
-               s = splsoftnet();
-#else

                s = splnet();
                s = splnet();

-#endif

                if ((rt = nd6_lookup(&nb_addr, 0, ifp)) == NULL) {
                        error = EINVAL;
                        splx(s);
                if ((rt = nd6_lookup(&nb_addr, 0, ifp)) == NULL) {
                        error = EINVAL;
                        splx(s);


@@ -1619,9 +1648,6 @@ nd6_cache_lladdr(ifp, from, lladdr, lladdrlen, type, code)
        int olladdr;
        int llchange;
        int newstate = 0;
        int olladdr;
        int llchange;
        int newstate = 0;

-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3) && !defined (__APPLE__)
-       long time_second = time.tv_sec;
-#endif

 
        if (!ifp)
                panic("ifp == NULL in nd6_cache_lladdr");
 
        if (!ifp)
                panic("ifp == NULL in nd6_cache_lladdr");


@@ -1652,14 +1678,18 @@ nd6_cache_lladdr(ifp, from, lladdr, lladdrlen, type, code)
 
                rt = nd6_lookup(from, 1, ifp);
                is_newentry = 1;
 
                rt = nd6_lookup(from, 1, ifp);
                is_newentry = 1;

-       } else
+       } else {
+               /* do nothing if static ndp is set */
+               if (rt->rt_flags & RTF_STATIC)
+                       return NULL;

                is_newentry = 0;
                is_newentry = 0;

+       }

 
        if (!rt)
                return NULL;
        if ((rt->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) != RTF_LLINFO) {
 fail:
 
        if (!rt)
                return NULL;
        if ((rt->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) != RTF_LLINFO) {
 fail:

-               nd6_free(rt);
+               (void)nd6_free(rt);

                return NULL;
        }
        ln = (struct llinfo_nd6 *)rt->rt_llinfo;
                return NULL;
        }
        ln = (struct llinfo_nd6 *)rt->rt_llinfo;


@@ -1691,7 +1721,7 @@ fail:
         *      1       --      y       --      (7) * STALE
         */
 
         *      1       --      y       --      (7) * STALE
         */
 

-       if (lladdr) {           /*(3-5) and (7)*/
+       if (lladdr) {           /* (3-5) and (7) */

                /*
                 * Record source link-layer address
                 * XXX is it dependent to ifp->if_type?
                /*
                 * Record source link-layer address
                 * XXX is it dependent to ifp->if_type?


@@ -1701,17 +1731,17 @@ fail:
        }
 
        if (!is_newentry) {
        }
 
        if (!is_newentry) {

-               if ((!olladdr && lladdr)                /*(3)*/
-                || (olladdr && lladdr && llchange)) {  /*(5)*/
+               if ((!olladdr && lladdr)                /* (3) */
+                || (olladdr && lladdr && llchange)) {  /* (5) */

                        do_update = 1;
                        newstate = ND6_LLINFO_STALE;
                        do_update = 1;
                        newstate = ND6_LLINFO_STALE;

-               } else                                  /*(1-2,4)*/
+               } else                                  /* (1-2,4) */

                        do_update = 0;
        } else {
                do_update = 1;
                        do_update = 0;
        } else {
                do_update = 1;

-               if (!lladdr)                            /*(6)*/
+               if (!lladdr)                            /* (6) */

                        newstate = ND6_LLINFO_NOSTATE;
                        newstate = ND6_LLINFO_NOSTATE;

-               else                                    /*(7)*/
+               else                                    /* (7) */

                        newstate = ND6_LLINFO_STALE;
        }
 
                        newstate = ND6_LLINFO_STALE;
        }
 


@@ -1722,17 +1752,23 @@ fail:
                ln->ln_state = newstate;
 
                if (ln->ln_state == ND6_LLINFO_STALE) {
                ln->ln_state = newstate;
 
                if (ln->ln_state == ND6_LLINFO_STALE) {

-                       rt->rt_flags &= ~RTF_REJECT;
+                       /*
+                        * XXX: since nd6_output() below will cause
+                        * state tansition to DELAY and reset the timer,
+                        * we must set the timer now, although it is actually
+                        * meaningless.
+                        */
+                       ln->ln_expire = time_second + nd6_gctimer;
+

                        if (ln->ln_hold) {
                        if (ln->ln_hold) {

-#if OLDIP6OUTPUT
-                               (*ifp->if_output)(ifp, ln->ln_hold,
-                                                 rt_key(rt), rt);
-#else
-                               nd6_output(ifp, ln->ln_hold,
+                               /*
+                                * we assume ifp is not a p2p here, so just
+                                * set the 2nd argument as the 1st one.
+                                */
+                               nd6_output(ifp, ifp, ln->ln_hold,

                                           (struct sockaddr_in6 *)rt_key(rt),
                                           rt);
                                           (struct sockaddr_in6 *)rt_key(rt),
                                           rt);

-#endif
-                               ln->ln_hold = 0;
+                               ln->ln_hold = NULL;

                        }
                } else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
                        /* probe right away */
                        }
                } else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
                        /* probe right away */


@@ -1774,7 +1810,7 @@ fail:
                /*
                 * New entry must have is_router flag cleared.
                 */
                /*
                 * New entry must have is_router flag cleared.
                 */

-               if (is_newentry)        /*(6-7)*/
+               if (is_newentry)        /* (6-7) */

                        ln->ln_router = 0;
                break;
        case ND_REDIRECT:
                        ln->ln_router = 0;
                break;
        case ND_REDIRECT:


@@ -1782,11 +1818,10 @@ fail:
                 * If the icmp is a redirect to a better router, always set the
                 * is_router flag. Otherwise, if the entry is newly created,
                 * clear the flag. [RFC 2461, sec 8.3]
                 * If the icmp is a redirect to a better router, always set the
                 * is_router flag. Otherwise, if the entry is newly created,
                 * clear the flag. [RFC 2461, sec 8.3]

-                *

                 */
                if (code == ND_REDIRECT_ROUTER)
                        ln->ln_router = 1;
                 */
                if (code == ND_REDIRECT_ROUTER)
                        ln->ln_router = 1;

-               else if (is_newentry) /*(6-7)*/
+               else if (is_newentry) /* (6-7) */

                        ln->ln_router = 0;
                break;
        case ND_ROUTER_SOLICIT:
                        ln->ln_router = 0;
                break;
        case ND_ROUTER_SOLICIT:


@@ -1799,13 +1834,31 @@ fail:
                /*
                 * Mark an entry with lladdr as a router.
                 */
                /*
                 * Mark an entry with lladdr as a router.
                 */

-               if ((!is_newentry && (olladdr || lladdr))       /*(2-5)*/
-                || (is_newentry && lladdr)) {                  /*(7)*/
+               if ((!is_newentry && (olladdr || lladdr))       /* (2-5) */
+                || (is_newentry && lladdr)) {                  /* (7) */

                        ln->ln_router = 1;
                }
                break;
        }
 
                        ln->ln_router = 1;
                }
                break;
        }
 

+       /*
+        * When the link-layer address of a router changes, select the
+        * best router again.  In particular, when the neighbor entry is newly
+        * created, it might affect the selection policy.
+        * Question: can we restrict the first condition to the "is_newentry"
+        * case?
+        * XXX: when we hear an RA from a new router with the link-layer
+        * address option, defrouter_select() is called twice, since
+        * defrtrlist_update called the function as well.  However, I believe
+        * we can compromise the overhead, since it only happens the first
+        * time.
+        * XXX: although defrouter_select() should not have a bad effect
+        * for those are not autoconfigured hosts, we explicitly avoid such
+        * cases for safety.
+        */
+       if (do_update && ln->ln_router && !ip6_forwarding && (ip6_accept_rtadv || (ifp->if_eflags & IFEF_ACCEPT_RTADVD)))
+               defrouter_select();
+

        return rt;
 }
 
        return rt;
 }
 


@@ -1813,22 +1866,15 @@ static void
 nd6_slowtimo(ignored_arg)
     void *ignored_arg;
 {
 nd6_slowtimo(ignored_arg)
     void *ignored_arg;
 {

-       int s;
-       register int i;
-       register struct nd_ifinfo *nd6if;
-#ifdef __APPLE__
-       boolean_t   funnel_state;
-       funnel_state = thread_set_funneled(TRUE);
-#endif
+       int s = splnet();
+       int i;
+       struct nd_ifinfo *nd6if;

 
 

-#ifdef __NetBSD__
-       s = splsoftnet();
-#else

        s = splnet();
        s = splnet();

-#endif
-
-       timeout(nd6_slowtimo, (caddr_t)0, ND6_SLOWTIMER_INTERVAL * hz);
+       timeout(nd6_slowtimo_funneled, (caddr_t)0, ND6_SLOWTIMER_INTERVAL * hz);

        for (i = 1; i < if_index + 1; i++) {
        for (i = 1; i < if_index + 1; i++) {

+               if (!nd_ifinfo || i >= nd_ifinfo_indexlim)
+                       continue;

                nd6if = &nd_ifinfo[i];
                if (nd6if->basereachable && /* already initialized */
                    (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
                nd6if = &nd_ifinfo[i];
                if (nd6if->basereachable && /* already initialized */
                    (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {


@@ -1843,96 +1889,94 @@ nd6_slowtimo(ignored_arg)
                }
        }
        splx(s);
                }
        }
        splx(s);

+}
+
+static void
+nd6_slowtimo_funneled(ignored_arg)
+       void    *ignored_arg;
+{

 #ifdef __APPLE__
 #ifdef __APPLE__

-    (void) thread_set_funneled(funnel_state);
+        boolean_t   funnel_state;
+       funnel_state = thread_funnel_set(network_flock, TRUE);
+#endif
+       nd6_slowtimo(ignored_arg);
+#ifdef __APPLE__
+        (void) thread_funnel_set(network_flock, FALSE);

 #endif
 #endif

-

 }
 
 #define senderr(e) { error = (e); goto bad;}
 int
 }
 
 #define senderr(e) { error = (e); goto bad;}
 int

-nd6_output(ifp, m0, dst, rt0)
-       register struct ifnet *ifp;
+nd6_output(ifp, origifp, m0, dst, rt0)
+       struct ifnet *ifp;
+       struct ifnet *origifp;

        struct mbuf *m0;
        struct sockaddr_in6 *dst;
        struct rtentry *rt0;
 {
        struct mbuf *m0;
        struct sockaddr_in6 *dst;
        struct rtentry *rt0;
 {

-       register struct mbuf *m = m0;
-       register struct rtentry *rt = rt0;
+       struct mbuf *m = m0;
+       struct rtentry *rt = rt0;
+       struct sockaddr_in6 *gw6 = NULL;

        struct llinfo_nd6 *ln = NULL;
        int error = 0;
        struct llinfo_nd6 *ln = NULL;
        int error = 0;

-#if !(defined(__FreeBSD__) && __FreeBSD__ >= 3) && !defined (__APPLE__)
-       long time_second = time.tv_sec;
-#endif

 
        if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr))
                goto sendpkt;
 
 
        if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr))
                goto sendpkt;
 

-       /*
-        * XXX: we currently do not make neighbor cache on any interface
-        * other than ARCnet, Ethernet, FDDI and GIF.
-        *
-        * draft-ietf-ngtrans-mech-04.txt says:
-        * - unidirectional tunnels needs no ND
-        */
-       switch (ifp->if_type) {
-       case IFT_ARCNET:
-       case IFT_ETHER:
-       case IFT_FDDI:
-       case IFT_GIF:           /* XXX need more cases? */
-               break;
-       default:
-               goto sendpkt;
-       }
-
-       if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
-           (nd_ifinfo[ifp->if_index].flags & ND6_IFF_PERFORMNUD) == 0)
+       if (nd6_need_cache(ifp) == 0)

                goto sendpkt;
 
        /*
                goto sendpkt;
 
        /*

-        * next hop determination. This routine is derived from ether_outpout.
+        * next hop determination.  This routine is derived from ether_outpout.

         */
        if (rt) {
                if ((rt->rt_flags & RTF_UP) == 0) {
         */
        if (rt) {
                if ((rt->rt_flags & RTF_UP) == 0) {

-#if __FreeBSD__ || defined (__APPLE__)

                        if ((rt0 = rt = rtalloc1((struct sockaddr *)dst, 1, 0UL)) !=
                                NULL)
                        if ((rt0 = rt = rtalloc1((struct sockaddr *)dst, 1, 0UL)) !=
                                NULL)

-#else
-                       if ((rt0 = rt = rtalloc1((struct sockaddr *)dst, 1)) !=
-                               NULL)
-#endif

                        {
                        {

-                               rt->rt_refcnt--;
-                               if (rt->rt_ifp != ifp)
-                                       return nd6_output(ifp, m0, dst, rt); /* XXX: loop care? */
+                               rtunref(rt);
+                               if (rt->rt_ifp != ifp) {
+                                       /* XXX: loop care? */
+                                       return nd6_output(ifp, origifp, m0,
+                                                         dst, rt);
+                               }

                        } else
                                senderr(EHOSTUNREACH);
                }
                        } else
                                senderr(EHOSTUNREACH);
                }

+

                if (rt->rt_flags & RTF_GATEWAY) {
                if (rt->rt_flags & RTF_GATEWAY) {

+                       gw6 = (struct sockaddr_in6 *)rt->rt_gateway;
+
+                       /*
+                        * We skip link-layer address resolution and NUD
+                        * if the gateway is not a neighbor from ND point
+                        * of view, regardless of the value of nd_ifinfo.flags.
+                        * The second condition is a bit tricky; we skip
+                        * if the gateway is our own address, which is
+                        * sometimes used to install a route to a p2p link.
+                        */
+                       if (!nd6_is_addr_neighbor(gw6, ifp) ||
+                           in6ifa_ifpwithaddr(ifp, &gw6->sin6_addr)) {
+                               /*
+                                * We allow this kind of tricky route only
+                                * when the outgoing interface is p2p.
+                                * XXX: we may need a more generic rule here.
+                                */
+                               if ((ifp->if_flags & IFF_POINTOPOINT) == 0)
+                                       senderr(EHOSTUNREACH);
+
+                               goto sendpkt;
+                       }
+

                        if (rt->rt_gwroute == 0)
                                goto lookup;
                        if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
                                rtfree(rt); rt = rt0;
                        if (rt->rt_gwroute == 0)
                                goto lookup;
                        if (((rt = rt->rt_gwroute)->rt_flags & RTF_UP) == 0) {
                                rtfree(rt); rt = rt0;

-#if __FreeBSD__ || defined (__APPLE__)

                        lookup: rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1, 0UL);
                        lookup: rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1, 0UL);

-#else
-                       lookup: rt->rt_gwroute = rtalloc1(rt->rt_gateway, 1);
-#endif

                                if ((rt = rt->rt_gwroute) == 0)
                                        senderr(EHOSTUNREACH);
                                if ((rt = rt->rt_gwroute) == 0)
                                        senderr(EHOSTUNREACH);

-#ifdef __bsdi__
-                               /* the "G" test below also prevents rt == rt0 */
-                               if ((rt->rt_flags & RTF_GATEWAY) ||
-                                   (rt->rt_ifp != ifp)) {
-                                       rt->rt_refcnt--;
-                                       rt0->rt_gwroute = 0;
-                                       senderr(EHOSTUNREACH);
-                               }
-#endif

                        }
                }
                        }
                }

-               if (rt->rt_flags & RTF_REJECT)
-                       senderr(rt == rt0 ? EHOSTDOWN : EHOSTUNREACH);

        }
 
        /*
        }
 
        /*


@@ -1946,20 +1990,34 @@ nd6_output(ifp, m0, dst, rt0)
        if (rt && (rt->rt_flags & RTF_LLINFO) != 0)
                ln = (struct llinfo_nd6 *)rt->rt_llinfo;
        else {
        if (rt && (rt->rt_flags & RTF_LLINFO) != 0)
                ln = (struct llinfo_nd6 *)rt->rt_llinfo;
        else {

-               if ((rt = nd6_lookup(&dst->sin6_addr, 1, ifp)) != NULL)
+               /*
+                * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
+                * the condition below is not very efficient.  But we believe
+                * it is tolerable, because this should be a rare case.
+                */
+               if (nd6_is_addr_neighbor(dst, ifp) &&
+                   (rt = nd6_lookup(&dst->sin6_addr, 1, ifp)) != NULL)

                        ln = (struct llinfo_nd6 *)rt->rt_llinfo;
        }
        if (!ln || !rt) {
                        ln = (struct llinfo_nd6 *)rt->rt_llinfo;
        }
        if (!ln || !rt) {

-               log(LOG_DEBUG, "nd6_output: can't allocate llinfo for %s "
-                   "(ln=%p, rt=%p)\n",
-                   ip6_sprintf(&dst->sin6_addr), ln, rt);
-               senderr(EIO);   /* XXX: good error? */
+               if ((ifp->if_flags & IFF_POINTOPOINT) == 0 &&
+                   !(nd_ifinfo[ifp->if_index].flags & ND6_IFF_PERFORMNUD)) {
+                       log(LOG_DEBUG,
+                           "nd6_output: can't allocate llinfo for %s "
+                           "(ln=%p, rt=%p)\n",
+                           ip6_sprintf(&dst->sin6_addr), ln, rt);
+                       senderr(EIO);   /* XXX: good error? */
+               }
+
+               goto sendpkt;   /* send anyway */

        }
 
        /* We don't have to do link-layer address resolution on a p2p link. */
        if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
        }
 
        /* We don't have to do link-layer address resolution on a p2p link. */
        if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&

-           ln->ln_state < ND6_LLINFO_REACHABLE)
+           ln->ln_state < ND6_LLINFO_REACHABLE) {

                ln->ln_state = ND6_LLINFO_STALE;
                ln->ln_state = ND6_LLINFO_STALE;

+               ln->ln_expire = time_second + nd6_gctimer;
+       }

 
        /*
         * The first time we send a packet to a neighbor whose entry is
 
        /*
         * The first time we send a packet to a neighbor whose entry is


@@ -1976,7 +2034,7 @@ nd6_output(ifp, m0, dst, rt0)
 
        /*
         * If the neighbor cache entry has a state other than INCOMPLETE
 
        /*
         * If the neighbor cache entry has a state other than INCOMPLETE

-        * (i.e. its link-layer address is already reloved), just
+        * (i.e. its link-layer address is already resolved), just

         * send the packet.
         */
        if (ln->ln_state > ND6_LLINFO_INCOMPLETE)
         * send the packet.
         */
        if (ln->ln_state > ND6_LLINFO_INCOMPLETE)


@@ -1984,20 +2042,19 @@ nd6_output(ifp, m0, dst, rt0)
 
        /*
         * There is a neighbor cache entry, but no ethernet address
 
        /*
         * There is a neighbor cache entry, but no ethernet address

-        * response yet. Replace the held mbuf (if any) with this
+        * response yet.  Replace the held mbuf (if any) with this

         * latest one.
         *
         * latest one.
         *

-        * XXX Does the code conform to rate-limiting rule?
-        * (RFC 2461 7.2.2)
+        * This code conforms to the rate-limiting rule described in Section
+        * 7.2.2 of RFC 2461, because the timer is set correctly after sending
+        * an NS below.

         */
         */

-       if (ln->ln_state == ND6_LLINFO_WAITDELETE ||
-           ln->ln_state == ND6_LLINFO_NOSTATE)
+       if (ln->ln_state == ND6_LLINFO_NOSTATE)

                ln->ln_state = ND6_LLINFO_INCOMPLETE;
        if (ln->ln_hold)
                m_freem(ln->ln_hold);
        ln->ln_hold = m;
        if (ln->ln_expire) {
                ln->ln_state = ND6_LLINFO_INCOMPLETE;
        if (ln->ln_hold)
                m_freem(ln->ln_hold);
        ln->ln_hold = m;
        if (ln->ln_expire) {

-               rt->rt_flags &= ~RTF_REJECT;

                if (ln->ln_asked < nd6_mmaxtries &&
                    ln->ln_expire < time_second) {
                        ln->ln_asked++;
                if (ln->ln_asked < nd6_mmaxtries &&
                    ln->ln_expire < time_second) {
                        ln->ln_asked++;


@@ -2010,8 +2067,40 @@ nd6_output(ifp, m0, dst, rt0)
        
   sendpkt:
 #ifdef __APPLE__
        
   sendpkt:
 #ifdef __APPLE__

-       return (dlil_output(ifptodlt(ifp, PF_INET6), m, rt, (struct sockaddr *)dst, 0));
+
+       /* Make sure the HW checksum flags are cleaned before sending the packet */
+
+       m->m_pkthdr.csum_data = 0;
+       m->m_pkthdr.csum_flags = 0;
+
+       if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
+               m->m_pkthdr.rcvif = origifp; /* forwarding rules require the original scope_id */
+               return (dlil_output(ifptodlt(origifp, PF_INET6), m, (caddr_t)rt, (struct sockaddr *)dst,0));    
+       } else {
+               /* Do not allow loopback address to wind up on a wire */
+               struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
+               
+               if ((IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) ||
+                       IN6_IS_ADDR_LOOPBACK(&ip6->ip6_dst))) {
+                       ip6stat.ip6s_badscope++;
+                       /* 
+                        * Simply drop the packet just like a firewall -- we do not want the 
+                        * the application to feel the pain, not yet...
+                        * Returning ENETUNREACH like ip6_output does in some similar cases  
+                        * could startle the otherwise clueless process that specifies
+                        * loopback as the source address.
+                        */
+                       goto bad;
+               }
+       }
+
+       m->m_pkthdr.rcvif = (struct ifnet *)0;
+       return (dlil_output(ifptodlt(ifp, PF_INET6), m, (caddr_t)rt, (struct sockaddr *)dst, 0));

 #else
 #else

+       if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
+               return((*ifp->if_output)(origifp, m, (struct sockaddr *)dst,
+                                        rt));
+       }

        return((*ifp->if_output)(ifp, m, (struct sockaddr *)dst, rt));
 #endif
        
        return((*ifp->if_output)(ifp, m, (struct sockaddr *)dst, rt));
 #endif
        


@@ -2022,6 +2111,35 @@ nd6_output(ifp, m0, dst, rt0)
 }      
 #undef senderr
 
 }      
 #undef senderr
 

+int
+nd6_need_cache(ifp)
+       struct ifnet *ifp;
+{
+       /*
+        * XXX: we currently do not make neighbor cache on any interface
+        * other than ARCnet, Ethernet, FDDI and GIF.
+        *
+        * RFC2893 says:
+        * - unidirectional tunnels needs no ND
+        */
+       switch (ifp->if_type) {
+       case IFT_ARCNET:
+       case IFT_ETHER:
+       case IFT_FDDI:
+       case IFT_IEEE1394:
+#if IFT_L2VLAN
+       case IFT_L2VLAN:
+#endif
+#if IFT_IEEE80211
+       case IFT_IEEE80211:
+#endif
+       case IFT_GIF:           /* XXX need more cases? */
+               return(1);
+       default:
+               return(0);
+       }
+}
+

 int
 nd6_storelladdr(ifp, rt, m, dst, desten)
        struct ifnet *ifp;
 int
 nd6_storelladdr(ifp, rt, m, dst, desten)
        struct ifnet *ifp;


@@ -2030,36 +2148,174 @@ nd6_storelladdr(ifp, rt, m, dst, desten)
        struct sockaddr *dst;
        u_char *desten;
 {
        struct sockaddr *dst;
        u_char *desten;
 {

+       int i;

        struct sockaddr_dl *sdl;
 
        if (m->m_flags & M_MCAST) {
                switch (ifp->if_type) {
                case IFT_ETHER:
        struct sockaddr_dl *sdl;
 
        if (m->m_flags & M_MCAST) {
                switch (ifp->if_type) {
                case IFT_ETHER:

-               case IFT_FDDI:                  
+               case IFT_FDDI:
+#if IFT_L2VLAN
+       case IFT_L2VLAN:
+#endif
+#if IFT_IEEE80211
+               case IFT_IEEE80211:
+#endif

                        ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr,
                                                 desten);
                        return(1);
                        ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr,
                                                 desten);
                        return(1);

-                       break;
+               case IFT_IEEE1394:
+                       for (i = 0; i < ifp->if_addrlen; i++)
+                               desten[i] = ~0;
+                       return(1);

                case IFT_ARCNET:
                        *desten = 0;
                        return(1);
                default:
                case IFT_ARCNET:
                        *desten = 0;
                        return(1);
                default:

-                       return(0);
+                       return(0); /* caller will free mbuf */

                }
        }
 
                }
        }
 

-       if (rt == NULL ||
-           rt->rt_gateway->sa_family != AF_LINK) {
+       if (rt == NULL) {
+               /* this could happen, if we could not allocate memory */
+               return(0); /* caller will free mbuf */
+       }
+       if (rt->rt_gateway->sa_family != AF_LINK) {

                printf("nd6_storelladdr: something odd happens\n");
                printf("nd6_storelladdr: something odd happens\n");

-               return(0);
+               return(0); /* caller will free mbuf */

        }
        sdl = SDL(rt->rt_gateway);
        if (sdl->sdl_alen == 0) {
                /* this should be impossible, but we bark here for debugging */
                printf("nd6_storelladdr: sdl_alen == 0\n");
        }
        sdl = SDL(rt->rt_gateway);
        if (sdl->sdl_alen == 0) {
                /* this should be impossible, but we bark here for debugging */
                printf("nd6_storelladdr: sdl_alen == 0\n");

-               return(0);
+               return(0); /* caller will free mbuf */

        }
 
        bcopy(LLADDR(sdl), desten, sdl->sdl_alen);
        return(1);
 }
        }
 
        bcopy(LLADDR(sdl), desten, sdl->sdl_alen);
        return(1);
 }

+#ifndef __APPLE__
+static int nd6_sysctl_drlist SYSCTL_HANDLER_ARGS;
+static int nd6_sysctl_prlist SYSCTL_HANDLER_ARGS;
+SYSCTL_DECL(_net_inet6_icmp6);
+SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_DRLIST, nd6_drlist,
+       CTLFLAG_RD, nd6_sysctl_drlist, "");
+SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_PRLIST, nd6_prlist,
+       CTLFLAG_RD, nd6_sysctl_prlist, "");
+
+static int
+nd6_sysctl_drlist SYSCTL_HANDLER_ARGS 
+{
+       int error;
+       char buf[1024];
+       struct in6_defrouter *d, *de;
+       struct nd_defrouter *dr;
+
+       if (req->newptr)
+               return EPERM;
+       error = 0;
+
+       for (dr = TAILQ_FIRST(&nd_defrouter);
+            dr;
+            dr = TAILQ_NEXT(dr, dr_entry)) {
+               d = (struct in6_defrouter *)buf;
+               de = (struct in6_defrouter *)(buf + sizeof(buf));
+
+               if (d + 1 <= de) {
+                       bzero(d, sizeof(*d));
+                       d->rtaddr.sin6_family = AF_INET6;
+                       d->rtaddr.sin6_len = sizeof(d->rtaddr);
+                       if (in6_recoverscope(&d->rtaddr, &dr->rtaddr,
+                           dr->ifp) != 0)
+                               log(LOG_ERR,
+                                   "scope error in "
+                                   "default router list (%s)\n",
+                                   ip6_sprintf(&dr->rtaddr));
+                       d->flags = dr->flags;
+                       d->rtlifetime = dr->rtlifetime;
+                       d->expire = dr->expire;
+                       d->if_index = dr->ifp->if_index;
+               } else
+                       panic("buffer too short");
+
+               error = SYSCTL_OUT(req, buf, sizeof(*d));
+               if (error)
+                       break;
+       }
+       return error;
+}
+
+static int
+nd6_sysctl_prlist SYSCTL_HANDLER_ARGS 
+{
+       int error;
+       char buf[1024];
+       struct in6_prefix *p, *pe;
+       struct nd_prefix *pr;
+
+       if (req->newptr)
+               return EPERM;
+       error = 0;
+
+       for (pr = nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
+               u_short advrtrs;
+               size_t advance;
+               struct sockaddr_in6 *sin6, *s6;
+               struct nd_pfxrouter *pfr;
+
+               p = (struct in6_prefix *)buf;
+               pe = (struct in6_prefix *)(buf + sizeof(buf));
+
+               if (p + 1 <= pe) {
+                       bzero(p, sizeof(*p));
+                       sin6 = (struct sockaddr_in6 *)(p + 1);
+
+                       p->prefix = pr->ndpr_prefix;
+                       if (in6_recoverscope(&p->prefix,
+                           &p->prefix.sin6_addr, pr->ndpr_ifp) != 0)
+                               log(LOG_ERR,
+                                   "scope error in prefix list (%s)\n",
+                                   ip6_sprintf(&p->prefix.sin6_addr));
+                       p->raflags = pr->ndpr_raf;
+                       p->prefixlen = pr->ndpr_plen;
+                       p->vltime = pr->ndpr_vltime;
+                       p->pltime = pr->ndpr_pltime;
+                       p->if_index = pr->ndpr_ifp->if_index;
+                       p->expire = pr->ndpr_expire;
+                       p->refcnt = pr->ndpr_refcnt;
+                       p->flags = pr->ndpr_stateflags;
+                       p->origin = PR_ORIG_RA;
+                       advrtrs = 0;
+                       for (pfr = pr->ndpr_advrtrs.lh_first;
+                            pfr;
+                            pfr = pfr->pfr_next) {
+                               if ((void *)&sin6[advrtrs + 1] >
+                                   (void *)pe) {
+                                       advrtrs++;
+                                       continue;
+                               }
+                               s6 = &sin6[advrtrs];
+                               bzero(s6, sizeof(*s6));
+                               s6->sin6_family = AF_INET6;
+                               s6->sin6_len = sizeof(*sin6);
+                               if (in6_recoverscope(s6,
+                                   &pfr->router->rtaddr,
+                                   pfr->router->ifp) != 0)
+                                       log(LOG_ERR,
+                                           "scope error in "
+                                           "prefix list (%s)\n",
+                                           ip6_sprintf(&pfr->router->rtaddr));
+                               advrtrs++;
+                       }
+                       p->advrtrs = advrtrs;
+               } else 
+                       panic("buffer too short");
+
+               advance = sizeof(*p) + sizeof(*sin6) * advrtrs;
+               error = SYSCTL_OUT(req, buf, advance);
+               if (error)
+                       break;
+       }
+       return error;
+}
+#endif