xref: /freebsd/sys/netinet6/nd6.c (revision 52267f7411adcc76ede961420e08c0e42f42d415)
1 /*-
2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the project nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	$KAME: nd6.c,v 1.144 2001/05/24 07:44:00 itojun Exp $
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_inet.h"
36 #include "opt_inet6.h"
37 #include "opt_mac.h"
38 
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/callout.h>
42 #include <sys/malloc.h>
43 #include <sys/mbuf.h>
44 #include <sys/socket.h>
45 #include <sys/sockio.h>
46 #include <sys/time.h>
47 #include <sys/kernel.h>
48 #include <sys/protosw.h>
49 #include <sys/errno.h>
50 #include <sys/syslog.h>
51 #include <sys/queue.h>
52 #include <sys/sysctl.h>
53 
54 #include <net/if.h>
55 #include <net/if_arc.h>
56 #include <net/if_dl.h>
57 #include <net/if_types.h>
58 #include <net/iso88025.h>
59 #include <net/fddi.h>
60 #include <net/route.h>
61 #include <net/vnet.h>
62 
63 #include <netinet/in.h>
64 #include <netinet/if_ether.h>
65 #include <netinet6/in6_var.h>
66 #include <netinet/ip6.h>
67 #include <netinet6/ip6_var.h>
68 #include <netinet6/scope6_var.h>
69 #include <netinet6/nd6.h>
70 #include <netinet/icmp6.h>
71 #include <netinet6/vinet6.h>
72 
73 #include <sys/limits.h>
74 #include <sys/vimage.h>
75 
76 #include <security/mac/mac_framework.h>
77 
78 #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */
79 #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */
80 
81 #define SIN6(s) ((struct sockaddr_in6 *)s)
82 #define SDL(s) ((struct sockaddr_dl *)s)
83 
84 #ifdef VIMAGE_GLOBALS
85 int nd6_prune;
86 int nd6_delay;
87 int nd6_umaxtries;
88 int nd6_mmaxtries;
89 int nd6_useloopback;
90 int nd6_gctimer;
91 
92 /* preventing too many loops in ND option parsing */
93 int nd6_maxndopt;
94 
95 int nd6_maxnudhint;
96 int nd6_maxqueuelen;
97 
98 int nd6_debug;
99 
100 /* for debugging? */
101 static int nd6_inuse, nd6_allocated;
102 struct llinfo_nd6 llinfo_nd6;
103 
104 struct nd_drhead nd_defrouter;
105 struct nd_prhead nd_prefix;
106 
107 int nd6_recalc_reachtm_interval;
108 #endif /* VIMAGE_GLOBALS */
109 
110 static struct sockaddr_in6 all1_sa;
111 
112 static int nd6_is_new_addr_neighbor __P((struct sockaddr_in6 *,
113 	struct ifnet *));
114 static void nd6_setmtu0(struct ifnet *, struct nd_ifinfo *);
115 static void nd6_slowtimo(void *);
116 static int regen_tmpaddr(struct in6_ifaddr *);
117 static struct llinfo_nd6 *nd6_free(struct rtentry *, int);
118 static void nd6_llinfo_timer(void *);
119 static void clear_llinfo_pqueue(struct llinfo_nd6 *);
120 
121 #ifdef VIMAGE_GLOBALS
122 struct callout nd6_slowtimo_ch;
123 struct callout nd6_timer_ch;
124 extern struct callout in6_tmpaddrtimer_ch;
125 extern int dad_ignore_ns;
126 extern int dad_maxtry;
127 #endif
128 
129 void
130 nd6_init(void)
131 {
132 	INIT_VNET_INET6(curvnet);
133 	static int nd6_init_done = 0;
134 	int i;
135 
136 	if (nd6_init_done) {
137 		log(LOG_NOTICE, "nd6_init called more than once(ignored)\n");
138 		return;
139 	}
140 
141 	V_nd6_prune	= 1;	/* walk list every 1 seconds */
142 	V_nd6_delay	= 5;	/* delay first probe time 5 second */
143 	V_nd6_umaxtries	= 3;	/* maximum unicast query */
144 	V_nd6_mmaxtries	= 3;	/* maximum multicast query */
145 	V_nd6_useloopback = 1;	/* use loopback interface for local traffic */
146 	V_nd6_gctimer	= (60 * 60 * 24); /* 1 day: garbage collection timer */
147 
148 	/* preventing too many loops in ND option parsing */
149 	V_nd6_maxndopt = 10;	/* max # of ND options allowed */
150 
151 	V_nd6_maxnudhint = 0;	/* max # of subsequent upper layer hints */
152 	V_nd6_maxqueuelen = 1;	/* max pkts cached in unresolved ND entries */
153 
154 #ifdef ND6_DEBUG
155 	V_nd6_debug = 1;
156 #else
157 	V_nd6_debug = 0;
158 #endif
159 
160 	V_nd6_recalc_reachtm_interval = ND6_RECALC_REACHTM_INTERVAL;
161 
162 	V_dad_ignore_ns = 0;	/* ignore NS in DAD - specwise incorrect*/
163 	V_dad_maxtry = 15;	/* max # of *tries* to transmit DAD packet */
164 
165 	V_llinfo_nd6.ln_next = &V_llinfo_nd6;
166 	V_llinfo_nd6.ln_prev = &V_llinfo_nd6;
167 	LIST_INIT(&V_nd_prefix);
168 
169 	ip6_use_tempaddr = 0;
170 	ip6_temp_preferred_lifetime = DEF_TEMP_PREFERRED_LIFETIME;
171 	ip6_temp_valid_lifetime = DEF_TEMP_VALID_LIFETIME;
172 	ip6_temp_regen_advance = TEMPADDR_REGEN_ADVANCE;
173 
174 	all1_sa.sin6_family = AF_INET6;
175 	all1_sa.sin6_len = sizeof(struct sockaddr_in6);
176 	for (i = 0; i < sizeof(all1_sa.sin6_addr); i++)
177 		all1_sa.sin6_addr.s6_addr[i] = 0xff;
178 
179 	/* initialization of the default router list */
180 	TAILQ_INIT(&V_nd_defrouter);
181 	/* start timer */
182 	callout_init(&V_nd6_slowtimo_ch, 0);
183 	callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
184 	    nd6_slowtimo, NULL);
185 
186 	nd6_init_done = 1;
187 
188 }
189 
190 struct nd_ifinfo *
191 nd6_ifattach(struct ifnet *ifp)
192 {
193 	struct nd_ifinfo *nd;
194 
195 	nd = (struct nd_ifinfo *)malloc(sizeof(*nd), M_IP6NDP, M_WAITOK);
196 	bzero(nd, sizeof(*nd));
197 
198 	nd->initialized = 1;
199 
200 	nd->chlim = IPV6_DEFHLIM;
201 	nd->basereachable = REACHABLE_TIME;
202 	nd->reachable = ND_COMPUTE_RTIME(nd->basereachable);
203 	nd->retrans = RETRANS_TIMER;
204 	/*
205 	 * Note that the default value of ip6_accept_rtadv is 0, which means
206 	 * we won't accept RAs by default even if we set ND6_IFF_ACCEPT_RTADV
207 	 * here.
208 	 */
209 	nd->flags = (ND6_IFF_PERFORMNUD | ND6_IFF_ACCEPT_RTADV);
210 
211 	/* XXX: we cannot call nd6_setmtu since ifp is not fully initialized */
212 	nd6_setmtu0(ifp, nd);
213 
214 	return nd;
215 }
216 
217 void
218 nd6_ifdetach(struct nd_ifinfo *nd)
219 {
220 
221 	free(nd, M_IP6NDP);
222 }
223 
224 /*
225  * Reset ND level link MTU. This function is called when the physical MTU
226  * changes, which means we might have to adjust the ND level MTU.
227  */
228 void
229 nd6_setmtu(struct ifnet *ifp)
230 {
231 
232 	nd6_setmtu0(ifp, ND_IFINFO(ifp));
233 }
234 
235 /* XXX todo: do not maintain copy of ifp->if_mtu in ndi->maxmtu */
236 void
237 nd6_setmtu0(struct ifnet *ifp, struct nd_ifinfo *ndi)
238 {
239 	INIT_VNET_INET6(ifp->if_vnet);
240 	u_int32_t omaxmtu;
241 
242 	omaxmtu = ndi->maxmtu;
243 
244 	switch (ifp->if_type) {
245 	case IFT_ARCNET:
246 		ndi->maxmtu = MIN(ARC_PHDS_MAXMTU, ifp->if_mtu); /* RFC2497 */
247 		break;
248 	case IFT_FDDI:
249 		ndi->maxmtu = MIN(FDDIIPMTU, ifp->if_mtu); /* RFC2467 */
250 		break;
251 	case IFT_ISO88025:
252 		 ndi->maxmtu = MIN(ISO88025_MAX_MTU, ifp->if_mtu);
253 		 break;
254 	default:
255 		ndi->maxmtu = ifp->if_mtu;
256 		break;
257 	}
258 
259 	/*
260 	 * Decreasing the interface MTU under IPV6 minimum MTU may cause
261 	 * undesirable situation.  We thus notify the operator of the change
262 	 * explicitly.  The check for omaxmtu is necessary to restrict the
263 	 * log to the case of changing the MTU, not initializing it.
264 	 */
265 	if (omaxmtu >= IPV6_MMTU && ndi->maxmtu < IPV6_MMTU) {
266 		log(LOG_NOTICE, "nd6_setmtu0: "
267 		    "new link MTU on %s (%lu) is too small for IPv6\n",
268 		    if_name(ifp), (unsigned long)ndi->maxmtu);
269 	}
270 
271 	if (ndi->maxmtu > V_in6_maxmtu)
272 		in6_setmaxmtu(); /* check all interfaces just in case */
273 
274 #undef MIN
275 }
276 
277 void
278 nd6_option_init(void *opt, int icmp6len, union nd_opts *ndopts)
279 {
280 
281 	bzero(ndopts, sizeof(*ndopts));
282 	ndopts->nd_opts_search = (struct nd_opt_hdr *)opt;
283 	ndopts->nd_opts_last
284 		= (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len);
285 
286 	if (icmp6len == 0) {
287 		ndopts->nd_opts_done = 1;
288 		ndopts->nd_opts_search = NULL;
289 	}
290 }
291 
292 /*
293  * Take one ND option.
294  */
295 struct nd_opt_hdr *
296 nd6_option(union nd_opts *ndopts)
297 {
298 	struct nd_opt_hdr *nd_opt;
299 	int olen;
300 
301 	if (ndopts == NULL)
302 		panic("ndopts == NULL in nd6_option");
303 	if (ndopts->nd_opts_last == NULL)
304 		panic("uninitialized ndopts in nd6_option");
305 	if (ndopts->nd_opts_search == NULL)
306 		return NULL;
307 	if (ndopts->nd_opts_done)
308 		return NULL;
309 
310 	nd_opt = ndopts->nd_opts_search;
311 
312 	/* make sure nd_opt_len is inside the buffer */
313 	if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) {
314 		bzero(ndopts, sizeof(*ndopts));
315 		return NULL;
316 	}
317 
318 	olen = nd_opt->nd_opt_len << 3;
319 	if (olen == 0) {
320 		/*
321 		 * Message validation requires that all included
322 		 * options have a length that is greater than zero.
323 		 */
324 		bzero(ndopts, sizeof(*ndopts));
325 		return NULL;
326 	}
327 
328 	ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);
329 	if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
330 		/* option overruns the end of buffer, invalid */
331 		bzero(ndopts, sizeof(*ndopts));
332 		return NULL;
333 	} else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
334 		/* reached the end of options chain */
335 		ndopts->nd_opts_done = 1;
336 		ndopts->nd_opts_search = NULL;
337 	}
338 	return nd_opt;
339 }
340 
341 /*
342  * Parse multiple ND options.
343  * This function is much easier to use, for ND routines that do not need
344  * multiple options of the same type.
345  */
346 int
347 nd6_options(union nd_opts *ndopts)
348 {
349 	INIT_VNET_INET6(curvnet);
350 	struct nd_opt_hdr *nd_opt;
351 	int i = 0;
352 
353 	if (ndopts == NULL)
354 		panic("ndopts == NULL in nd6_options");
355 	if (ndopts->nd_opts_last == NULL)
356 		panic("uninitialized ndopts in nd6_options");
357 	if (ndopts->nd_opts_search == NULL)
358 		return 0;
359 
360 	while (1) {
361 		nd_opt = nd6_option(ndopts);
362 		if (nd_opt == NULL && ndopts->nd_opts_last == NULL) {
363 			/*
364 			 * Message validation requires that all included
365 			 * options have a length that is greater than zero.
366 			 */
367 			V_icmp6stat.icp6s_nd_badopt++;
368 			bzero(ndopts, sizeof(*ndopts));
369 			return -1;
370 		}
371 
372 		if (nd_opt == NULL)
373 			goto skip1;
374 
375 		switch (nd_opt->nd_opt_type) {
376 		case ND_OPT_SOURCE_LINKADDR:
377 		case ND_OPT_TARGET_LINKADDR:
378 		case ND_OPT_MTU:
379 		case ND_OPT_REDIRECTED_HEADER:
380 			if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
381 				nd6log((LOG_INFO,
382 				    "duplicated ND6 option found (type=%d)\n",
383 				    nd_opt->nd_opt_type));
384 				/* XXX bark? */
385 			} else {
386 				ndopts->nd_opt_array[nd_opt->nd_opt_type]
387 					= nd_opt;
388 			}
389 			break;
390 		case ND_OPT_PREFIX_INFORMATION:
391 			if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) {
392 				ndopts->nd_opt_array[nd_opt->nd_opt_type]
393 					= nd_opt;
394 			}
395 			ndopts->nd_opts_pi_end =
396 				(struct nd_opt_prefix_info *)nd_opt;
397 			break;
398 		default:
399 			/*
400 			 * Unknown options must be silently ignored,
401 			 * to accomodate future extension to the protocol.
402 			 */
403 			nd6log((LOG_DEBUG,
404 			    "nd6_options: unsupported option %d - "
405 			    "option ignored\n", nd_opt->nd_opt_type));
406 		}
407 
408 skip1:
409 		i++;
410 		if (i > V_nd6_maxndopt) {
411 			V_icmp6stat.icp6s_nd_toomanyopt++;
412 			nd6log((LOG_INFO, "too many loop in nd opt\n"));
413 			break;
414 		}
415 
416 		if (ndopts->nd_opts_done)
417 			break;
418 	}
419 
420 	return 0;
421 }
422 
423 /*
424  * ND6 timer routine to handle ND6 entries
425  */
426 void
427 nd6_llinfo_settimer(struct llinfo_nd6 *ln, long tick)
428 {
429 	if (tick < 0) {
430 		ln->ln_expire = 0;
431 		ln->ln_ntick = 0;
432 		callout_stop(&ln->ln_timer_ch);
433 	} else {
434 		ln->ln_expire = time_second + tick / hz;
435 		if (tick > INT_MAX) {
436 			ln->ln_ntick = tick - INT_MAX;
437 			callout_reset(&ln->ln_timer_ch, INT_MAX,
438 			    nd6_llinfo_timer, ln);
439 		} else {
440 			ln->ln_ntick = 0;
441 			callout_reset(&ln->ln_timer_ch, tick,
442 			    nd6_llinfo_timer, ln);
443 		}
444 	}
445 }
446 
447 static void
448 nd6_llinfo_timer(void *arg)
449 {
450 	struct llinfo_nd6 *ln;
451 	struct rtentry *rt;
452 	struct in6_addr *dst;
453 	struct ifnet *ifp;
454 	struct nd_ifinfo *ndi = NULL;
455 
456 	ln = (struct llinfo_nd6 *)arg;
457 
458 	if (ln->ln_ntick > 0) {
459 		if (ln->ln_ntick > INT_MAX) {
460 			ln->ln_ntick -= INT_MAX;
461 			nd6_llinfo_settimer(ln, INT_MAX);
462 		} else {
463 			ln->ln_ntick = 0;
464 			nd6_llinfo_settimer(ln, ln->ln_ntick);
465 		}
466 		return;
467 	}
468 
469 	if ((rt = ln->ln_rt) == NULL)
470 		panic("ln->ln_rt == NULL");
471 	if ((ifp = rt->rt_ifp) == NULL)
472 		panic("ln->ln_rt->rt_ifp == NULL");
473 	ndi = ND_IFINFO(ifp);
474 
475 	CURVNET_SET(ifp->if_vnet);
476 	INIT_VNET_INET6(curvnet);
477 
478 	/* sanity check */
479 	if (rt->rt_llinfo && (struct llinfo_nd6 *)rt->rt_llinfo != ln)
480 		panic("rt_llinfo(%p) is not equal to ln(%p)",
481 		      rt->rt_llinfo, ln);
482 	if (rt_key(rt) == NULL)
483 		panic("rt key is NULL in nd6_timer(ln=%p)", ln);
484 
485 	dst = &((struct sockaddr_in6 *)rt_key(rt))->sin6_addr;
486 
487 	switch (ln->ln_state) {
488 	case ND6_LLINFO_INCOMPLETE:
489 		if (ln->ln_asked < V_nd6_mmaxtries) {
490 			ln->ln_asked++;
491 			nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
492 			nd6_ns_output(ifp, NULL, dst, ln, 0);
493 		} else {
494 			struct mbuf *m = ln->ln_hold;
495 			if (m) {
496 				struct mbuf *m0;
497 
498 				/*
499 				 * assuming every packet in ln_hold has the
500 				 * same IP header
501 				 */
502 				m0 = m->m_nextpkt;
503 				m->m_nextpkt = NULL;
504 				icmp6_error2(m, ICMP6_DST_UNREACH,
505 				    ICMP6_DST_UNREACH_ADDR, 0, rt->rt_ifp);
506 
507 				ln->ln_hold = m0;
508 				clear_llinfo_pqueue(ln);
509 			}
510 			if (rt && rt->rt_llinfo)
511 				(void)nd6_free(rt, 0);
512 			ln = NULL;
513 		}
514 		break;
515 	case ND6_LLINFO_REACHABLE:
516 		if (!ND6_LLINFO_PERMANENT(ln)) {
517 			ln->ln_state = ND6_LLINFO_STALE;
518 			nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
519 		}
520 		break;
521 
522 	case ND6_LLINFO_STALE:
523 		/* Garbage Collection(RFC 2461 5.3) */
524 		if (!ND6_LLINFO_PERMANENT(ln)) {
525 			if (rt && rt->rt_llinfo)
526 				(void)nd6_free(rt, 1);
527 			ln = NULL;
528 		}
529 		break;
530 
531 	case ND6_LLINFO_DELAY:
532 		if (ndi && (ndi->flags & ND6_IFF_PERFORMNUD) != 0) {
533 			/* We need NUD */
534 			ln->ln_asked = 1;
535 			ln->ln_state = ND6_LLINFO_PROBE;
536 			nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
537 			nd6_ns_output(ifp, dst, dst, ln, 0);
538 		} else {
539 			ln->ln_state = ND6_LLINFO_STALE; /* XXX */
540 			nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
541 		}
542 		break;
543 	case ND6_LLINFO_PROBE:
544 		if (ln->ln_asked < V_nd6_umaxtries) {
545 			ln->ln_asked++;
546 			nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
547 			nd6_ns_output(ifp, dst, dst, ln, 0);
548 		} else if (rt->rt_ifa != NULL &&
549 		    rt->rt_ifa->ifa_addr->sa_family == AF_INET6 &&
550 		    (((struct in6_ifaddr *)rt->rt_ifa)->ia_flags & IFA_ROUTE)) {
551 			/*
552 			 * This is an unreachable neighbor whose address is
553 			 * specified as the destination of a p2p interface
554 			 * (see in6_ifinit()).  We should not free the entry
555 			 * since this is sort of a "static" entry generated
556 			 * via interface address configuration.
557 			 */
558 			ln->ln_asked = 0;
559 			ln->ln_expire = 0; /* make it permanent */
560 			ln->ln_state = ND6_LLINFO_STALE;
561 		} else {
562 			if (rt && rt->rt_llinfo)
563 				(void)nd6_free(rt, 0);
564 			ln = NULL;
565 		}
566 		break;
567 	}
568 	CURVNET_RESTORE();
569 }
570 
571 
572 /*
573  * ND6 timer routine to expire default route list and prefix list
574  */
575 void
576 nd6_timer(void *arg)
577 {
578 	CURVNET_SET_QUIET((struct vnet *) arg);
579 	INIT_VNET_INET6((struct vnet *) arg);
580 	int s;
581 	struct nd_defrouter *dr;
582 	struct nd_prefix *pr;
583 	struct in6_ifaddr *ia6, *nia6;
584 	struct in6_addrlifetime *lt6;
585 
586 	callout_reset(&V_nd6_timer_ch, V_nd6_prune * hz,
587 	    nd6_timer, NULL);
588 
589 	/* expire default router list */
590 	s = splnet();
591 	dr = TAILQ_FIRST(&V_nd_defrouter);
592 	while (dr) {
593 		if (dr->expire && dr->expire < time_second) {
594 			struct nd_defrouter *t;
595 			t = TAILQ_NEXT(dr, dr_entry);
596 			defrtrlist_del(dr);
597 			dr = t;
598 		} else {
599 			dr = TAILQ_NEXT(dr, dr_entry);
600 		}
601 	}
602 
603 	/*
604 	 * expire interface addresses.
605 	 * in the past the loop was inside prefix expiry processing.
606 	 * However, from a stricter speci-confrmance standpoint, we should
607 	 * rather separate address lifetimes and prefix lifetimes.
608 	 */
609   addrloop:
610 	for (ia6 = V_in6_ifaddr; ia6; ia6 = nia6) {
611 		nia6 = ia6->ia_next;
612 		/* check address lifetime */
613 		lt6 = &ia6->ia6_lifetime;
614 		if (IFA6_IS_INVALID(ia6)) {
615 			int regen = 0;
616 
617 			/*
618 			 * If the expiring address is temporary, try
619 			 * regenerating a new one.  This would be useful when
620 			 * we suspended a laptop PC, then turned it on after a
621 			 * period that could invalidate all temporary
622 			 * addresses.  Although we may have to restart the
623 			 * loop (see below), it must be after purging the
624 			 * address.  Otherwise, we'd see an infinite loop of
625 			 * regeneration.
626 			 */
627 			if (V_ip6_use_tempaddr &&
628 			    (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
629 				if (regen_tmpaddr(ia6) == 0)
630 					regen = 1;
631 			}
632 
633 			in6_purgeaddr(&ia6->ia_ifa);
634 
635 			if (regen)
636 				goto addrloop; /* XXX: see below */
637 		} else if (IFA6_IS_DEPRECATED(ia6)) {
638 			int oldflags = ia6->ia6_flags;
639 
640 			ia6->ia6_flags |= IN6_IFF_DEPRECATED;
641 
642 			/*
643 			 * If a temporary address has just become deprecated,
644 			 * regenerate a new one if possible.
645 			 */
646 			if (V_ip6_use_tempaddr &&
647 			    (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
648 			    (oldflags & IN6_IFF_DEPRECATED) == 0) {
649 
650 				if (regen_tmpaddr(ia6) == 0) {
651 					/*
652 					 * A new temporary address is
653 					 * generated.
654 					 * XXX: this means the address chain
655 					 * has changed while we are still in
656 					 * the loop.  Although the change
657 					 * would not cause disaster (because
658 					 * it's not a deletion, but an
659 					 * addition,) we'd rather restart the
660 					 * loop just for safety.  Or does this
661 					 * significantly reduce performance??
662 					 */
663 					goto addrloop;
664 				}
665 			}
666 		} else {
667 			/*
668 			 * A new RA might have made a deprecated address
669 			 * preferred.
670 			 */
671 			ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;
672 		}
673 	}
674 
675 	/* expire prefix list */
676 	pr = V_nd_prefix.lh_first;
677 	while (pr) {
678 		/*
679 		 * check prefix lifetime.
680 		 * since pltime is just for autoconf, pltime processing for
681 		 * prefix is not necessary.
682 		 */
683 		if (pr->ndpr_vltime != ND6_INFINITE_LIFETIME &&
684 		    time_second - pr->ndpr_lastupdate > pr->ndpr_vltime) {
685 			struct nd_prefix *t;
686 			t = pr->ndpr_next;
687 
688 			/*
689 			 * address expiration and prefix expiration are
690 			 * separate.  NEVER perform in6_purgeaddr here.
691 			 */
692 
693 			prelist_remove(pr);
694 			pr = t;
695 		} else
696 			pr = pr->ndpr_next;
697 	}
698 	splx(s);
699 	CURVNET_RESTORE();
700 }
701 
702 /*
703  * ia6 - deprecated/invalidated temporary address
704  */
705 static int
706 regen_tmpaddr(struct in6_ifaddr *ia6)
707 {
708 	struct ifaddr *ifa;
709 	struct ifnet *ifp;
710 	struct in6_ifaddr *public_ifa6 = NULL;
711 
712 	ifp = ia6->ia_ifa.ifa_ifp;
713 	for (ifa = ifp->if_addrlist.tqh_first; ifa;
714 	     ifa = ifa->ifa_list.tqe_next) {
715 		struct in6_ifaddr *it6;
716 
717 		if (ifa->ifa_addr->sa_family != AF_INET6)
718 			continue;
719 
720 		it6 = (struct in6_ifaddr *)ifa;
721 
722 		/* ignore no autoconf addresses. */
723 		if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0)
724 			continue;
725 
726 		/* ignore autoconf addresses with different prefixes. */
727 		if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr)
728 			continue;
729 
730 		/*
731 		 * Now we are looking at an autoconf address with the same
732 		 * prefix as ours.  If the address is temporary and is still
733 		 * preferred, do not create another one.  It would be rare, but
734 		 * could happen, for example, when we resume a laptop PC after
735 		 * a long period.
736 		 */
737 		if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
738 		    !IFA6_IS_DEPRECATED(it6)) {
739 			public_ifa6 = NULL;
740 			break;
741 		}
742 
743 		/*
744 		 * This is a public autoconf address that has the same prefix
745 		 * as ours.  If it is preferred, keep it.  We can't break the
746 		 * loop here, because there may be a still-preferred temporary
747 		 * address with the prefix.
748 		 */
749 		if (!IFA6_IS_DEPRECATED(it6))
750 		    public_ifa6 = it6;
751 	}
752 
753 	if (public_ifa6 != NULL) {
754 		int e;
755 
756 		if ((e = in6_tmpifadd(public_ifa6, 0, 0)) != 0) {
757 			log(LOG_NOTICE, "regen_tmpaddr: failed to create a new"
758 			    " tmp addr,errno=%d\n", e);
759 			return (-1);
760 		}
761 		return (0);
762 	}
763 
764 	return (-1);
765 }
766 
767 /*
768  * Nuke neighbor cache/prefix/default router management table, right before
769  * ifp goes away.
770  */
771 void
772 nd6_purge(struct ifnet *ifp)
773 {
774 	INIT_VNET_INET6(ifp->if_vnet);
775 	struct llinfo_nd6 *ln, *nln;
776 	struct nd_defrouter *dr, *ndr;
777 	struct nd_prefix *pr, *npr;
778 
779 	/*
780 	 * Nuke default router list entries toward ifp.
781 	 * We defer removal of default router list entries that is installed
782 	 * in the routing table, in order to keep additional side effects as
783 	 * small as possible.
784 	 */
785 	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
786 		ndr = TAILQ_NEXT(dr, dr_entry);
787 		if (dr->installed)
788 			continue;
789 
790 		if (dr->ifp == ifp)
791 			defrtrlist_del(dr);
792 	}
793 
794 	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
795 		ndr = TAILQ_NEXT(dr, dr_entry);
796 		if (!dr->installed)
797 			continue;
798 
799 		if (dr->ifp == ifp)
800 			defrtrlist_del(dr);
801 	}
802 
803 	/* Nuke prefix list entries toward ifp */
804 	for (pr = V_nd_prefix.lh_first; pr; pr = npr) {
805 		npr = pr->ndpr_next;
806 		if (pr->ndpr_ifp == ifp) {
807 			/*
808 			 * Because if_detach() does *not* release prefixes
809 			 * while purging addresses the reference count will
810 			 * still be above zero. We therefore reset it to
811 			 * make sure that the prefix really gets purged.
812 			 */
813 			pr->ndpr_refcnt = 0;
814 
815 			/*
816 			 * Previously, pr->ndpr_addr is removed as well,
817 			 * but I strongly believe we don't have to do it.
818 			 * nd6_purge() is only called from in6_ifdetach(),
819 			 * which removes all the associated interface addresses
820 			 * by itself.
821 			 * (jinmei@kame.net 20010129)
822 			 */
823 			prelist_remove(pr);
824 		}
825 	}
826 
827 	/* cancel default outgoing interface setting */
828 	if (V_nd6_defifindex == ifp->if_index)
829 		nd6_setdefaultiface(0);
830 
831 	if (!V_ip6_forwarding && V_ip6_accept_rtadv) { /* XXX: too restrictive? */
832 		/* refresh default router list */
833 		defrouter_select();
834 	}
835 
836 	/*
837 	 * Nuke neighbor cache entries for the ifp.
838 	 * Note that rt->rt_ifp may not be the same as ifp,
839 	 * due to KAME goto ours hack.  See RTM_RESOLVE case in
840 	 * nd6_rtrequest(), and ip6_input().
841 	 */
842 	ln = V_llinfo_nd6.ln_next;
843 	while (ln && ln != &V_llinfo_nd6) {
844 		struct rtentry *rt;
845 		struct sockaddr_dl *sdl;
846 
847 		nln = ln->ln_next;
848 		rt = ln->ln_rt;
849 		if (rt && rt->rt_gateway &&
850 		    rt->rt_gateway->sa_family == AF_LINK) {
851 			sdl = (struct sockaddr_dl *)rt->rt_gateway;
852 			if (sdl->sdl_index == ifp->if_index)
853 				nln = nd6_free(rt, 0);
854 		}
855 		ln = nln;
856 	}
857 }
858 
859 struct rtentry *
860 nd6_lookup(struct in6_addr *addr6, int create, struct ifnet *ifp)
861 {
862 	INIT_VNET_INET6(curvnet);
863 	struct rtentry *rt;
864 	struct sockaddr_in6 sin6;
865 	char ip6buf[INET6_ADDRSTRLEN];
866 
867 	bzero(&sin6, sizeof(sin6));
868 	sin6.sin6_len = sizeof(struct sockaddr_in6);
869 	sin6.sin6_family = AF_INET6;
870 	sin6.sin6_addr = *addr6;
871 	rt = rtalloc1((struct sockaddr *)&sin6, create, 0UL);
872 	if (rt) {
873 		if ((rt->rt_flags & RTF_LLINFO) == 0 && create) {
874 			/*
875 			 * This is the case for the default route.
876 			 * If we want to create a neighbor cache for the
877 			 * address, we should free the route for the
878 			 * destination and allocate an interface route.
879 			 */
880 			RTFREE_LOCKED(rt);
881 			rt = NULL;
882 		}
883 	}
884 	if (rt == NULL) {
885 		if (create && ifp) {
886 			int e;
887 
888 			/*
889 			 * If no route is available and create is set,
890 			 * we allocate a host route for the destination
891 			 * and treat it like an interface route.
892 			 * This hack is necessary for a neighbor which can't
893 			 * be covered by our own prefix.
894 			 */
895 			struct ifaddr *ifa =
896 			    ifaof_ifpforaddr((struct sockaddr *)&sin6, ifp);
897 			if (ifa == NULL)
898 				return (NULL);
899 
900 			/*
901 			 * Create a new route.  RTF_LLINFO is necessary
902 			 * to create a Neighbor Cache entry for the
903 			 * destination in nd6_rtrequest which will be
904 			 * called in rtrequest via ifa->ifa_rtrequest.
905 			 */
906 			if ((e = rtrequest(RTM_ADD, (struct sockaddr *)&sin6,
907 			    ifa->ifa_addr, (struct sockaddr *)&all1_sa,
908 			    (ifa->ifa_flags | RTF_HOST | RTF_LLINFO) &
909 			    ~RTF_CLONING, &rt)) != 0) {
910 				log(LOG_ERR,
911 				    "nd6_lookup: failed to add route for a "
912 				    "neighbor(%s), errno=%d\n",
913 				    ip6_sprintf(ip6buf, addr6), e);
914 			}
915 			if (rt == NULL)
916 				return (NULL);
917 			RT_LOCK(rt);
918 			if (rt->rt_llinfo) {
919 				struct llinfo_nd6 *ln =
920 				    (struct llinfo_nd6 *)rt->rt_llinfo;
921 				ln->ln_state = ND6_LLINFO_NOSTATE;
922 			}
923 		} else
924 			return (NULL);
925 	}
926 	RT_LOCK_ASSERT(rt);
927 	RT_REMREF(rt);
928 	/*
929 	 * Validation for the entry.
930 	 * Note that the check for rt_llinfo is necessary because a cloned
931 	 * route from a parent route that has the L flag (e.g. the default
932 	 * route to a p2p interface) may have the flag, too, while the
933 	 * destination is not actually a neighbor.
934 	 * XXX: we can't use rt->rt_ifp to check for the interface, since
935 	 *      it might be the loopback interface if the entry is for our
936 	 *      own address on a non-loopback interface. Instead, we should
937 	 *      use rt->rt_ifa->ifa_ifp, which would specify the REAL
938 	 *	interface.
939 	 * Note also that ifa_ifp and ifp may differ when we connect two
940 	 * interfaces to a same link, install a link prefix to an interface,
941 	 * and try to install a neighbor cache on an interface that does not
942 	 * have a route to the prefix.
943 	 */
944 	if ((rt->rt_flags & RTF_GATEWAY) || (rt->rt_flags & RTF_LLINFO) == 0 ||
945 	    rt->rt_gateway->sa_family != AF_LINK || rt->rt_llinfo == NULL ||
946 	    (ifp && rt->rt_ifa->ifa_ifp != ifp)) {
947 		if (create) {
948 			nd6log((LOG_DEBUG,
949 			    "nd6_lookup: failed to lookup %s (if = %s)\n",
950 			    ip6_sprintf(ip6buf, addr6),
951 			    ifp ? if_name(ifp) : "unspec"));
952 		}
953 		RT_UNLOCK(rt);
954 		return (NULL);
955 	}
956 	RT_UNLOCK(rt);		/* XXX not ready to return rt locked */
957 	return (rt);
958 }
959 
960 /*
961  * Test whether a given IPv6 address is a neighbor or not, ignoring
962  * the actual neighbor cache.  The neighbor cache is ignored in order
963  * to not reenter the routing code from within itself.
964  */
965 static int
966 nd6_is_new_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
967 {
968 	INIT_VNET_INET6(ifp->if_vnet);
969 	struct nd_prefix *pr;
970 	struct ifaddr *dstaddr;
971 
972 	/*
973 	 * A link-local address is always a neighbor.
974 	 * XXX: a link does not necessarily specify a single interface.
975 	 */
976 	if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr)) {
977 		struct sockaddr_in6 sin6_copy;
978 		u_int32_t zone;
979 
980 		/*
981 		 * We need sin6_copy since sa6_recoverscope() may modify the
982 		 * content (XXX).
983 		 */
984 		sin6_copy = *addr;
985 		if (sa6_recoverscope(&sin6_copy))
986 			return (0); /* XXX: should be impossible */
987 		if (in6_setscope(&sin6_copy.sin6_addr, ifp, &zone))
988 			return (0);
989 		if (sin6_copy.sin6_scope_id == zone)
990 			return (1);
991 		else
992 			return (0);
993 	}
994 
995 	/*
996 	 * If the address matches one of our addresses,
997 	 * it should be a neighbor.
998 	 * If the address matches one of our on-link prefixes, it should be a
999 	 * neighbor.
1000 	 */
1001 	for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
1002 		if (pr->ndpr_ifp != ifp)
1003 			continue;
1004 
1005 		if (!(pr->ndpr_stateflags & NDPRF_ONLINK))
1006 			continue;
1007 
1008 		if (IN6_ARE_MASKED_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
1009 		    &addr->sin6_addr, &pr->ndpr_mask))
1010 			return (1);
1011 	}
1012 
1013 	/*
1014 	 * If the address is assigned on the node of the other side of
1015 	 * a p2p interface, the address should be a neighbor.
1016 	 */
1017 	dstaddr = ifa_ifwithdstaddr((struct sockaddr *)addr);
1018 	if ((dstaddr != NULL) && (dstaddr->ifa_ifp == ifp))
1019 		return (1);
1020 
1021 	/*
1022 	 * If the default router list is empty, all addresses are regarded
1023 	 * as on-link, and thus, as a neighbor.
1024 	 * XXX: we restrict the condition to hosts, because routers usually do
1025 	 * not have the "default router list".
1026 	 */
1027 	if (!V_ip6_forwarding && TAILQ_FIRST(&V_nd_defrouter) == NULL &&
1028 	    V_nd6_defifindex == ifp->if_index) {
1029 		return (1);
1030 	}
1031 
1032 	return (0);
1033 }
1034 
1035 
1036 /*
1037  * Detect if a given IPv6 address identifies a neighbor on a given link.
1038  * XXX: should take care of the destination of a p2p link?
1039  */
1040 int
1041 nd6_is_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
1042 {
1043 
1044 	if (nd6_is_new_addr_neighbor(addr, ifp))
1045 		return (1);
1046 
1047 	/*
1048 	 * Even if the address matches none of our addresses, it might be
1049 	 * in the neighbor cache.
1050 	 */
1051 	if (nd6_lookup(&addr->sin6_addr, 0, ifp) != NULL)
1052 		return (1);
1053 
1054 	return (0);
1055 }
1056 
1057 /*
1058  * Free an nd6 llinfo entry.
1059  * Since the function would cause significant changes in the kernel, DO NOT
1060  * make it global, unless you have a strong reason for the change, and are sure
1061  * that the change is safe.
1062  */
1063 static struct llinfo_nd6 *
1064 nd6_free(struct rtentry *rt, int gc)
1065 {
1066 	INIT_VNET_INET6(curvnet);
1067 	struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo, *next;
1068 	struct in6_addr in6 = ((struct sockaddr_in6 *)rt_key(rt))->sin6_addr;
1069 	struct nd_defrouter *dr;
1070 
1071 	/*
1072 	 * we used to have pfctlinput(PRC_HOSTDEAD) here.
1073 	 * even though it is not harmful, it was not really necessary.
1074 	 */
1075 
1076 	/* cancel timer */
1077 	nd6_llinfo_settimer(ln, -1);
1078 
1079 	if (!V_ip6_forwarding) {
1080 		int s;
1081 		s = splnet();
1082 		dr = defrouter_lookup(&((struct sockaddr_in6 *)rt_key(rt))->sin6_addr,
1083 		    rt->rt_ifp);
1084 
1085 		if (dr != NULL && dr->expire &&
1086 		    ln->ln_state == ND6_LLINFO_STALE && gc) {
1087 			/*
1088 			 * If the reason for the deletion is just garbage
1089 			 * collection, and the neighbor is an active default
1090 			 * router, do not delete it.  Instead, reset the GC
1091 			 * timer using the router's lifetime.
1092 			 * Simply deleting the entry would affect default
1093 			 * router selection, which is not necessarily a good
1094 			 * thing, especially when we're using router preference
1095 			 * values.
1096 			 * XXX: the check for ln_state would be redundant,
1097 			 *      but we intentionally keep it just in case.
1098 			 */
1099 			if (dr->expire > time_second)
1100 				nd6_llinfo_settimer(ln,
1101 				    (dr->expire - time_second) * hz);
1102 			else
1103 				nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
1104 			splx(s);
1105 			return (ln->ln_next);
1106 		}
1107 
1108 		if (ln->ln_router || dr) {
1109 			/*
1110 			 * rt6_flush must be called whether or not the neighbor
1111 			 * is in the Default Router List.
1112 			 * See a corresponding comment in nd6_na_input().
1113 			 */
1114 			rt6_flush(&in6, rt->rt_ifp);
1115 		}
1116 
1117 		if (dr) {
1118 			/*
1119 			 * Unreachablity of a router might affect the default
1120 			 * router selection and on-link detection of advertised
1121 			 * prefixes.
1122 			 */
1123 
1124 			/*
1125 			 * Temporarily fake the state to choose a new default
1126 			 * router and to perform on-link determination of
1127 			 * prefixes correctly.
1128 			 * Below the state will be set correctly,
1129 			 * or the entry itself will be deleted.
1130 			 */
1131 			ln->ln_state = ND6_LLINFO_INCOMPLETE;
1132 
1133 			/*
1134 			 * Since defrouter_select() does not affect the
1135 			 * on-link determination and MIP6 needs the check
1136 			 * before the default router selection, we perform
1137 			 * the check now.
1138 			 */
1139 			pfxlist_onlink_check();
1140 
1141 			/*
1142 			 * refresh default router list
1143 			 */
1144 			defrouter_select();
1145 		}
1146 		splx(s);
1147 	}
1148 
1149 	/*
1150 	 * Before deleting the entry, remember the next entry as the
1151 	 * return value.  We need this because pfxlist_onlink_check() above
1152 	 * might have freed other entries (particularly the old next entry) as
1153 	 * a side effect (XXX).
1154 	 */
1155 	next = ln->ln_next;
1156 
1157 	/*
1158 	 * Detach the route from the routing tree and the list of neighbor
1159 	 * caches, and disable the route entry not to be used in already
1160 	 * cached routes.
1161 	 */
1162 	rtrequest(RTM_DELETE, rt_key(rt), (struct sockaddr *)0,
1163 	    rt_mask(rt), 0, (struct rtentry **)0);
1164 
1165 	return (next);
1166 }
1167 
1168 /*
1169  * Upper-layer reachability hint for Neighbor Unreachability Detection.
1170  *
1171  * XXX cost-effective methods?
1172  */
1173 void
1174 nd6_nud_hint(struct rtentry *rt, struct in6_addr *dst6, int force)
1175 {
1176 	INIT_VNET_INET6(curvnet);
1177 	struct llinfo_nd6 *ln;
1178 
1179 	/*
1180 	 * If the caller specified "rt", use that.  Otherwise, resolve the
1181 	 * routing table by supplied "dst6".
1182 	 */
1183 	if (rt == NULL) {
1184 		if (dst6 == NULL)
1185 			return;
1186 		if ((rt = nd6_lookup(dst6, 0, NULL)) == NULL)
1187 			return;
1188 	}
1189 
1190 	if ((rt->rt_flags & RTF_GATEWAY) != 0 ||
1191 	    (rt->rt_flags & RTF_LLINFO) == 0 ||
1192 	    rt->rt_llinfo == NULL || rt->rt_gateway == NULL ||
1193 	    rt->rt_gateway->sa_family != AF_LINK) {
1194 		/* This is not a host route. */
1195 		return;
1196 	}
1197 
1198 	ln = (struct llinfo_nd6 *)rt->rt_llinfo;
1199 	if (ln->ln_state < ND6_LLINFO_REACHABLE)
1200 		return;
1201 
1202 	/*
1203 	 * if we get upper-layer reachability confirmation many times,
1204 	 * it is possible we have false information.
1205 	 */
1206 	if (!force) {
1207 		ln->ln_byhint++;
1208 		if (ln->ln_byhint > V_nd6_maxnudhint)
1209 			return;
1210 	}
1211 
1212 	ln->ln_state = ND6_LLINFO_REACHABLE;
1213 	if (!ND6_LLINFO_PERMANENT(ln)) {
1214 		nd6_llinfo_settimer(ln,
1215 		    (long)ND_IFINFO(rt->rt_ifp)->reachable * hz);
1216 	}
1217 }
1218 
1219 /*
1220  * info - XXX unused
1221  */
1222 void
1223 nd6_rtrequest(int req, struct rtentry *rt, struct rt_addrinfo *info)
1224 {
1225 	struct sockaddr *gate = rt->rt_gateway;
1226 	struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
1227 	static struct sockaddr_dl null_sdl = {sizeof(null_sdl), AF_LINK};
1228 	struct ifnet *ifp = rt->rt_ifp;
1229 	struct ifaddr *ifa;
1230 	INIT_VNET_NET(ifp->if_vnet);
1231 	INIT_VNET_INET6(ifp->if_vnet);
1232 
1233 	RT_LOCK_ASSERT(rt);
1234 
1235 	if ((rt->rt_flags & RTF_GATEWAY) != 0)
1236 		return;
1237 
1238 	if (nd6_need_cache(ifp) == 0 && (rt->rt_flags & RTF_HOST) == 0) {
1239 		/*
1240 		 * This is probably an interface direct route for a link
1241 		 * which does not need neighbor caches (e.g. fe80::%lo0/64).
1242 		 * We do not need special treatment below for such a route.
1243 		 * Moreover, the RTF_LLINFO flag which would be set below
1244 		 * would annoy the ndp(8) command.
1245 		 */
1246 		return;
1247 	}
1248 
1249 	if (req == RTM_RESOLVE &&
1250 	    (nd6_need_cache(ifp) == 0 || /* stf case */
1251 	     !nd6_is_new_addr_neighbor((struct sockaddr_in6 *)rt_key(rt),
1252 	     ifp))) {
1253 		/*
1254 		 * FreeBSD and BSD/OS often make a cloned host route based
1255 		 * on a less-specific route (e.g. the default route).
1256 		 * If the less specific route does not have a "gateway"
1257 		 * (this is the case when the route just goes to a p2p or an
1258 		 * stf interface), we'll mistakenly make a neighbor cache for
1259 		 * the host route, and will see strange neighbor solicitation
1260 		 * for the corresponding destination.  In order to avoid the
1261 		 * confusion, we check if the destination of the route is
1262 		 * a neighbor in terms of neighbor discovery, and stop the
1263 		 * process if not.  Additionally, we remove the LLINFO flag
1264 		 * so that ndp(8) will not try to get the neighbor information
1265 		 * of the destination.
1266 		 */
1267 		rt->rt_flags &= ~RTF_LLINFO;
1268 		return;
1269 	}
1270 
1271 	switch (req) {
1272 	case RTM_ADD:
1273 		/*
1274 		 * There is no backward compatibility :)
1275 		 *
1276 		 * if ((rt->rt_flags & RTF_HOST) == 0 &&
1277 		 *     SIN(rt_mask(rt))->sin_addr.s_addr != 0xffffffff)
1278 		 *	   rt->rt_flags |= RTF_CLONING;
1279 		 */
1280 		if ((rt->rt_flags & RTF_CLONING) ||
1281 		    ((rt->rt_flags & RTF_LLINFO) && ln == NULL)) {
1282 			/*
1283 			 * Case 1: This route should come from a route to
1284 			 * interface (RTF_CLONING case) or the route should be
1285 			 * treated as on-link but is currently not
1286 			 * (RTF_LLINFO && ln == NULL case).
1287 			 */
1288 			rt_setgate(rt, rt_key(rt),
1289 				   (struct sockaddr *)&null_sdl);
1290 			gate = rt->rt_gateway;
1291 			SDL(gate)->sdl_type = ifp->if_type;
1292 			SDL(gate)->sdl_index = ifp->if_index;
1293 			if (ln)
1294 				nd6_llinfo_settimer(ln, 0);
1295 			if ((rt->rt_flags & RTF_CLONING) != 0)
1296 				break;
1297 		}
1298 		/*
1299 		 * In IPv4 code, we try to annonuce new RTF_ANNOUNCE entry here.
1300 		 * We don't do that here since llinfo is not ready yet.
1301 		 *
1302 		 * There are also couple of other things to be discussed:
1303 		 * - unsolicited NA code needs improvement beforehand
1304 		 * - RFC2461 says we MAY send multicast unsolicited NA
1305 		 *   (7.2.6 paragraph 4), however, it also says that we
1306 		 *   SHOULD provide a mechanism to prevent multicast NA storm.
1307 		 *   we don't have anything like it right now.
1308 		 *   note that the mechanism needs a mutual agreement
1309 		 *   between proxies, which means that we need to implement
1310 		 *   a new protocol, or a new kludge.
1311 		 * - from RFC2461 6.2.4, host MUST NOT send an unsolicited NA.
1312 		 *   we need to check ip6forwarding before sending it.
1313 		 *   (or should we allow proxy ND configuration only for
1314 		 *   routers?  there's no mention about proxy ND from hosts)
1315 		 */
1316 		/* FALLTHROUGH */
1317 	case RTM_RESOLVE:
1318 		if ((ifp->if_flags & (IFF_POINTOPOINT | IFF_LOOPBACK)) == 0) {
1319 			/*
1320 			 * Address resolution isn't necessary for a point to
1321 			 * point link, so we can skip this test for a p2p link.
1322 			 */
1323 			if (gate->sa_family != AF_LINK ||
1324 			    gate->sa_len < sizeof(null_sdl)) {
1325 				log(LOG_DEBUG,
1326 				    "nd6_rtrequest: bad gateway value: %s\n",
1327 				    if_name(ifp));
1328 				break;
1329 			}
1330 			SDL(gate)->sdl_type = ifp->if_type;
1331 			SDL(gate)->sdl_index = ifp->if_index;
1332 		}
1333 		if (ln != NULL)
1334 			break;	/* This happens on a route change */
1335 		/*
1336 		 * Case 2: This route may come from cloning, or a manual route
1337 		 * add with a LL address.
1338 		 */
1339 		R_Malloc(ln, struct llinfo_nd6 *, sizeof(*ln));
1340 		rt->rt_llinfo = (caddr_t)ln;
1341 		if (ln == NULL) {
1342 			log(LOG_DEBUG, "nd6_rtrequest: malloc failed\n");
1343 			break;
1344 		}
1345 		V_nd6_inuse++;
1346 		V_nd6_allocated++;
1347 		bzero(ln, sizeof(*ln));
1348 		RT_ADDREF(rt);
1349 		ln->ln_rt = rt;
1350 		callout_init(&ln->ln_timer_ch, 0);
1351 
1352 		/* this is required for "ndp" command. - shin */
1353 		if (req == RTM_ADD) {
1354 		        /*
1355 			 * gate should have some valid AF_LINK entry,
1356 			 * and ln->ln_expire should have some lifetime
1357 			 * which is specified by ndp command.
1358 			 */
1359 			ln->ln_state = ND6_LLINFO_REACHABLE;
1360 			ln->ln_byhint = 0;
1361 		} else {
1362 		        /*
1363 			 * When req == RTM_RESOLVE, rt is created and
1364 			 * initialized in rtrequest(), so rt_expire is 0.
1365 			 */
1366 			ln->ln_state = ND6_LLINFO_NOSTATE;
1367 			nd6_llinfo_settimer(ln, 0);
1368 		}
1369 		rt->rt_flags |= RTF_LLINFO;
1370 		ln->ln_next = V_llinfo_nd6.ln_next;
1371 		V_llinfo_nd6.ln_next = ln;
1372 		ln->ln_prev = &V_llinfo_nd6;
1373 		ln->ln_next->ln_prev = ln;
1374 
1375 		/*
1376 		 * check if rt_key(rt) is one of my address assigned
1377 		 * to the interface.
1378 		 */
1379 		ifa = (struct ifaddr *)in6ifa_ifpwithaddr(rt->rt_ifp,
1380 		    &SIN6(rt_key(rt))->sin6_addr);
1381 		if (ifa) {
1382 			caddr_t macp = nd6_ifptomac(ifp);
1383 			nd6_llinfo_settimer(ln, -1);
1384 			ln->ln_state = ND6_LLINFO_REACHABLE;
1385 			ln->ln_byhint = 0;
1386 			if (macp) {
1387 				bcopy(macp, LLADDR(SDL(gate)), ifp->if_addrlen);
1388 				SDL(gate)->sdl_alen = ifp->if_addrlen;
1389 			}
1390 			if (V_nd6_useloopback) {
1391 				rt->rt_ifp = &V_loif[0];	/* XXX */
1392 				/*
1393 				 * Make sure rt_ifa be equal to the ifaddr
1394 				 * corresponding to the address.
1395 				 * We need this because when we refer
1396 				 * rt_ifa->ia6_flags in ip6_input, we assume
1397 				 * that the rt_ifa points to the address instead
1398 				 * of the loopback address.
1399 				 */
1400 				if (ifa != rt->rt_ifa) {
1401 					IFAFREE(rt->rt_ifa);
1402 					IFAREF(ifa);
1403 					rt->rt_ifa = ifa;
1404 				}
1405 			}
1406 		} else if (rt->rt_flags & RTF_ANNOUNCE) {
1407 			nd6_llinfo_settimer(ln, -1);
1408 			ln->ln_state = ND6_LLINFO_REACHABLE;
1409 			ln->ln_byhint = 0;
1410 
1411 			/* join solicited node multicast for proxy ND */
1412 			if (ifp->if_flags & IFF_MULTICAST) {
1413 				struct in6_addr llsol;
1414 				int error;
1415 
1416 				llsol = SIN6(rt_key(rt))->sin6_addr;
1417 				llsol.s6_addr32[0] = IPV6_ADDR_INT32_MLL;
1418 				llsol.s6_addr32[1] = 0;
1419 				llsol.s6_addr32[2] = htonl(1);
1420 				llsol.s6_addr8[12] = 0xff;
1421 				if (in6_setscope(&llsol, ifp, NULL))
1422 					break;
1423 				if (in6_addmulti(&llsol, ifp,
1424 				    &error, 0) == NULL) {
1425 					char ip6buf[INET6_ADDRSTRLEN];
1426 					nd6log((LOG_ERR, "%s: failed to join "
1427 					    "%s (errno=%d)\n", if_name(ifp),
1428 					    ip6_sprintf(ip6buf, &llsol),
1429 					    error));
1430 				}
1431 			}
1432 		}
1433 		break;
1434 
1435 	case RTM_DELETE:
1436 		if (ln == NULL)
1437 			break;
1438 		/* leave from solicited node multicast for proxy ND */
1439 		if ((rt->rt_flags & RTF_ANNOUNCE) != 0 &&
1440 		    (ifp->if_flags & IFF_MULTICAST) != 0) {
1441 			struct in6_addr llsol;
1442 			struct in6_multi *in6m;
1443 
1444 			llsol = SIN6(rt_key(rt))->sin6_addr;
1445 			llsol.s6_addr32[0] = IPV6_ADDR_INT32_MLL;
1446 			llsol.s6_addr32[1] = 0;
1447 			llsol.s6_addr32[2] = htonl(1);
1448 			llsol.s6_addr8[12] = 0xff;
1449 			if (in6_setscope(&llsol, ifp, NULL) == 0) {
1450 				IN6_LOOKUP_MULTI(llsol, ifp, in6m);
1451 				if (in6m)
1452 					in6_delmulti(in6m);
1453 			} else
1454 				; /* XXX: should not happen. bark here? */
1455 		}
1456 		V_nd6_inuse--;
1457 		ln->ln_next->ln_prev = ln->ln_prev;
1458 		ln->ln_prev->ln_next = ln->ln_next;
1459 		ln->ln_prev = NULL;
1460 		nd6_llinfo_settimer(ln, -1);
1461 		RT_REMREF(rt);
1462 		rt->rt_llinfo = 0;
1463 		rt->rt_flags &= ~RTF_LLINFO;
1464 		clear_llinfo_pqueue(ln);
1465 		Free((caddr_t)ln);
1466 	}
1467 }
1468 
1469 int
1470 nd6_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp)
1471 {
1472 	INIT_VNET_INET6(ifp->if_vnet);
1473 	struct in6_drlist *drl = (struct in6_drlist *)data;
1474 	struct in6_oprlist *oprl = (struct in6_oprlist *)data;
1475 	struct in6_ndireq *ndi = (struct in6_ndireq *)data;
1476 	struct in6_nbrinfo *nbi = (struct in6_nbrinfo *)data;
1477 	struct in6_ndifreq *ndif = (struct in6_ndifreq *)data;
1478 	struct nd_defrouter *dr;
1479 	struct nd_prefix *pr;
1480 	struct rtentry *rt;
1481 	int i = 0, error = 0;
1482 	int s;
1483 
1484 	switch (cmd) {
1485 	case SIOCGDRLST_IN6:
1486 		/*
1487 		 * obsolete API, use sysctl under net.inet6.icmp6
1488 		 */
1489 		bzero(drl, sizeof(*drl));
1490 		s = splnet();
1491 		dr = TAILQ_FIRST(&V_nd_defrouter);
1492 		while (dr && i < DRLSTSIZ) {
1493 			drl->defrouter[i].rtaddr = dr->rtaddr;
1494 			in6_clearscope(&drl->defrouter[i].rtaddr);
1495 
1496 			drl->defrouter[i].flags = dr->flags;
1497 			drl->defrouter[i].rtlifetime = dr->rtlifetime;
1498 			drl->defrouter[i].expire = dr->expire;
1499 			drl->defrouter[i].if_index = dr->ifp->if_index;
1500 			i++;
1501 			dr = TAILQ_NEXT(dr, dr_entry);
1502 		}
1503 		splx(s);
1504 		break;
1505 	case SIOCGPRLST_IN6:
1506 		/*
1507 		 * obsolete API, use sysctl under net.inet6.icmp6
1508 		 *
1509 		 * XXX the structure in6_prlist was changed in backward-
1510 		 * incompatible manner.  in6_oprlist is used for SIOCGPRLST_IN6,
1511 		 * in6_prlist is used for nd6_sysctl() - fill_prlist().
1512 		 */
1513 		/*
1514 		 * XXX meaning of fields, especialy "raflags", is very
1515 		 * differnet between RA prefix list and RR/static prefix list.
1516 		 * how about separating ioctls into two?
1517 		 */
1518 		bzero(oprl, sizeof(*oprl));
1519 		s = splnet();
1520 		pr = V_nd_prefix.lh_first;
1521 		while (pr && i < PRLSTSIZ) {
1522 			struct nd_pfxrouter *pfr;
1523 			int j;
1524 
1525 			oprl->prefix[i].prefix = pr->ndpr_prefix.sin6_addr;
1526 			oprl->prefix[i].raflags = pr->ndpr_raf;
1527 			oprl->prefix[i].prefixlen = pr->ndpr_plen;
1528 			oprl->prefix[i].vltime = pr->ndpr_vltime;
1529 			oprl->prefix[i].pltime = pr->ndpr_pltime;
1530 			oprl->prefix[i].if_index = pr->ndpr_ifp->if_index;
1531 			if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
1532 				oprl->prefix[i].expire = 0;
1533 			else {
1534 				time_t maxexpire;
1535 
1536 				/* XXX: we assume time_t is signed. */
1537 				maxexpire = (-1) &
1538 				    ~((time_t)1 <<
1539 				    ((sizeof(maxexpire) * 8) - 1));
1540 				if (pr->ndpr_vltime <
1541 				    maxexpire - pr->ndpr_lastupdate) {
1542 					oprl->prefix[i].expire =
1543 					    pr->ndpr_lastupdate +
1544 					    pr->ndpr_vltime;
1545 				} else
1546 					oprl->prefix[i].expire = maxexpire;
1547 			}
1548 
1549 			pfr = pr->ndpr_advrtrs.lh_first;
1550 			j = 0;
1551 			while (pfr) {
1552 				if (j < DRLSTSIZ) {
1553 #define RTRADDR oprl->prefix[i].advrtr[j]
1554 					RTRADDR = pfr->router->rtaddr;
1555 					in6_clearscope(&RTRADDR);
1556 #undef RTRADDR
1557 				}
1558 				j++;
1559 				pfr = pfr->pfr_next;
1560 			}
1561 			oprl->prefix[i].advrtrs = j;
1562 			oprl->prefix[i].origin = PR_ORIG_RA;
1563 
1564 			i++;
1565 			pr = pr->ndpr_next;
1566 		}
1567 		splx(s);
1568 
1569 		break;
1570 	case OSIOCGIFINFO_IN6:
1571 #define ND	ndi->ndi
1572 		/* XXX: old ndp(8) assumes a positive value for linkmtu. */
1573 		bzero(&ND, sizeof(ND));
1574 		ND.linkmtu = IN6_LINKMTU(ifp);
1575 		ND.maxmtu = ND_IFINFO(ifp)->maxmtu;
1576 		ND.basereachable = ND_IFINFO(ifp)->basereachable;
1577 		ND.reachable = ND_IFINFO(ifp)->reachable;
1578 		ND.retrans = ND_IFINFO(ifp)->retrans;
1579 		ND.flags = ND_IFINFO(ifp)->flags;
1580 		ND.recalctm = ND_IFINFO(ifp)->recalctm;
1581 		ND.chlim = ND_IFINFO(ifp)->chlim;
1582 		break;
1583 	case SIOCGIFINFO_IN6:
1584 		ND = *ND_IFINFO(ifp);
1585 		break;
1586 	case SIOCSIFINFO_IN6:
1587 		/*
1588 		 * used to change host variables from userland.
1589 		 * intented for a use on router to reflect RA configurations.
1590 		 */
1591 		/* 0 means 'unspecified' */
1592 		if (ND.linkmtu != 0) {
1593 			if (ND.linkmtu < IPV6_MMTU ||
1594 			    ND.linkmtu > IN6_LINKMTU(ifp)) {
1595 				error = EINVAL;
1596 				break;
1597 			}
1598 			ND_IFINFO(ifp)->linkmtu = ND.linkmtu;
1599 		}
1600 
1601 		if (ND.basereachable != 0) {
1602 			int obasereachable = ND_IFINFO(ifp)->basereachable;
1603 
1604 			ND_IFINFO(ifp)->basereachable = ND.basereachable;
1605 			if (ND.basereachable != obasereachable)
1606 				ND_IFINFO(ifp)->reachable =
1607 				    ND_COMPUTE_RTIME(ND.basereachable);
1608 		}
1609 		if (ND.retrans != 0)
1610 			ND_IFINFO(ifp)->retrans = ND.retrans;
1611 		if (ND.chlim != 0)
1612 			ND_IFINFO(ifp)->chlim = ND.chlim;
1613 		/* FALLTHROUGH */
1614 	case SIOCSIFINFO_FLAGS:
1615 		ND_IFINFO(ifp)->flags = ND.flags;
1616 		break;
1617 #undef ND
1618 	case SIOCSNDFLUSH_IN6:	/* XXX: the ioctl name is confusing... */
1619 		/* sync kernel routing table with the default router list */
1620 		defrouter_reset();
1621 		defrouter_select();
1622 		break;
1623 	case SIOCSPFXFLUSH_IN6:
1624 	{
1625 		/* flush all the prefix advertised by routers */
1626 		struct nd_prefix *pr, *next;
1627 
1628 		s = splnet();
1629 		for (pr = V_nd_prefix.lh_first; pr; pr = next) {
1630 			struct in6_ifaddr *ia, *ia_next;
1631 
1632 			next = pr->ndpr_next;
1633 
1634 			if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
1635 				continue; /* XXX */
1636 
1637 			/* do we really have to remove addresses as well? */
1638 			for (ia = V_in6_ifaddr; ia; ia = ia_next) {
1639 				/* ia might be removed.  keep the next ptr. */
1640 				ia_next = ia->ia_next;
1641 
1642 				if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0)
1643 					continue;
1644 
1645 				if (ia->ia6_ndpr == pr)
1646 					in6_purgeaddr(&ia->ia_ifa);
1647 			}
1648 			prelist_remove(pr);
1649 		}
1650 		splx(s);
1651 		break;
1652 	}
1653 	case SIOCSRTRFLUSH_IN6:
1654 	{
1655 		/* flush all the default routers */
1656 		struct nd_defrouter *dr, *next;
1657 
1658 		s = splnet();
1659 		defrouter_reset();
1660 		for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = next) {
1661 			next = TAILQ_NEXT(dr, dr_entry);
1662 			defrtrlist_del(dr);
1663 		}
1664 		defrouter_select();
1665 		splx(s);
1666 		break;
1667 	}
1668 	case SIOCGNBRINFO_IN6:
1669 	{
1670 		struct llinfo_nd6 *ln;
1671 		struct in6_addr nb_addr = nbi->addr; /* make local for safety */
1672 
1673 		if ((error = in6_setscope(&nb_addr, ifp, NULL)) != 0)
1674 			return (error);
1675 
1676 		s = splnet();
1677 		if ((rt = nd6_lookup(&nb_addr, 0, ifp)) == NULL) {
1678 			error = EINVAL;
1679 			splx(s);
1680 			break;
1681 		}
1682 		ln = (struct llinfo_nd6 *)rt->rt_llinfo;
1683 		nbi->state = ln->ln_state;
1684 		nbi->asked = ln->ln_asked;
1685 		nbi->isrouter = ln->ln_router;
1686 		nbi->expire = ln->ln_expire;
1687 		splx(s);
1688 
1689 		break;
1690 	}
1691 	case SIOCGDEFIFACE_IN6:	/* XXX: should be implemented as a sysctl? */
1692 		ndif->ifindex = V_nd6_defifindex;
1693 		break;
1694 	case SIOCSDEFIFACE_IN6:	/* XXX: should be implemented as a sysctl? */
1695 		return (nd6_setdefaultiface(ndif->ifindex));
1696 	}
1697 	return (error);
1698 }
1699 
1700 /*
1701  * Create neighbor cache entry and cache link-layer address,
1702  * on reception of inbound ND6 packets.  (RS/RA/NS/redirect)
1703  *
1704  * type - ICMP6 type
1705  * code - type dependent information
1706  */
1707 struct rtentry *
1708 nd6_cache_lladdr(struct ifnet *ifp, struct in6_addr *from, char *lladdr,
1709     int lladdrlen, int type, int code)
1710 {
1711 	INIT_VNET_INET6(curvnet);
1712 	struct rtentry *rt = NULL;
1713 	struct llinfo_nd6 *ln = NULL;
1714 	int is_newentry;
1715 	struct sockaddr_dl *sdl = NULL;
1716 	int do_update;
1717 	int olladdr;
1718 	int llchange;
1719 	int newstate = 0;
1720 
1721 	if (ifp == NULL)
1722 		panic("ifp == NULL in nd6_cache_lladdr");
1723 	if (from == NULL)
1724 		panic("from == NULL in nd6_cache_lladdr");
1725 
1726 	/* nothing must be updated for unspecified address */
1727 	if (IN6_IS_ADDR_UNSPECIFIED(from))
1728 		return NULL;
1729 
1730 	/*
1731 	 * Validation about ifp->if_addrlen and lladdrlen must be done in
1732 	 * the caller.
1733 	 *
1734 	 * XXX If the link does not have link-layer adderss, what should
1735 	 * we do? (ifp->if_addrlen == 0)
1736 	 * Spec says nothing in sections for RA, RS and NA.  There's small
1737 	 * description on it in NS section (RFC 2461 7.2.3).
1738 	 */
1739 
1740 	rt = nd6_lookup(from, 0, ifp);
1741 	if (rt == NULL) {
1742 		rt = nd6_lookup(from, 1, ifp);
1743 		is_newentry = 1;
1744 	} else {
1745 		/* do nothing if static ndp is set */
1746 		if (rt->rt_flags & RTF_STATIC)
1747 			return NULL;
1748 		is_newentry = 0;
1749 	}
1750 
1751 	if (rt == NULL)
1752 		return NULL;
1753 	if ((rt->rt_flags & (RTF_GATEWAY | RTF_LLINFO)) != RTF_LLINFO) {
1754 fail:
1755 		(void)nd6_free(rt, 0);
1756 		return NULL;
1757 	}
1758 	ln = (struct llinfo_nd6 *)rt->rt_llinfo;
1759 	if (ln == NULL)
1760 		goto fail;
1761 	if (rt->rt_gateway == NULL)
1762 		goto fail;
1763 	if (rt->rt_gateway->sa_family != AF_LINK)
1764 		goto fail;
1765 	sdl = SDL(rt->rt_gateway);
1766 
1767 	olladdr = (sdl->sdl_alen) ? 1 : 0;
1768 	if (olladdr && lladdr) {
1769 		if (bcmp(lladdr, LLADDR(sdl), ifp->if_addrlen))
1770 			llchange = 1;
1771 		else
1772 			llchange = 0;
1773 	} else
1774 		llchange = 0;
1775 
1776 	/*
1777 	 * newentry olladdr  lladdr  llchange	(*=record)
1778 	 *	0	n	n	--	(1)
1779 	 *	0	y	n	--	(2)
1780 	 *	0	n	y	--	(3) * STALE
1781 	 *	0	y	y	n	(4) *
1782 	 *	0	y	y	y	(5) * STALE
1783 	 *	1	--	n	--	(6)   NOSTATE(= PASSIVE)
1784 	 *	1	--	y	--	(7) * STALE
1785 	 */
1786 
1787 	if (lladdr) {		/* (3-5) and (7) */
1788 		/*
1789 		 * Record source link-layer address
1790 		 * XXX is it dependent to ifp->if_type?
1791 		 */
1792 		sdl->sdl_alen = ifp->if_addrlen;
1793 		bcopy(lladdr, LLADDR(sdl), ifp->if_addrlen);
1794 	}
1795 
1796 	if (!is_newentry) {
1797 		if ((!olladdr && lladdr != NULL) ||	/* (3) */
1798 		    (olladdr && lladdr != NULL && llchange)) {	/* (5) */
1799 			do_update = 1;
1800 			newstate = ND6_LLINFO_STALE;
1801 		} else					/* (1-2,4) */
1802 			do_update = 0;
1803 	} else {
1804 		do_update = 1;
1805 		if (lladdr == NULL)			/* (6) */
1806 			newstate = ND6_LLINFO_NOSTATE;
1807 		else					/* (7) */
1808 			newstate = ND6_LLINFO_STALE;
1809 	}
1810 
1811 	if (do_update) {
1812 		/*
1813 		 * Update the state of the neighbor cache.
1814 		 */
1815 		ln->ln_state = newstate;
1816 
1817 		if (ln->ln_state == ND6_LLINFO_STALE) {
1818 			/*
1819 			 * XXX: since nd6_output() below will cause
1820 			 * state tansition to DELAY and reset the timer,
1821 			 * we must set the timer now, although it is actually
1822 			 * meaningless.
1823 			 */
1824 			nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
1825 
1826 			if (ln->ln_hold) {
1827 				struct mbuf *m_hold, *m_hold_next;
1828 
1829 				/*
1830 				 * reset the ln_hold in advance, to explicitly
1831 				 * prevent a ln_hold lookup in nd6_output()
1832 				 * (wouldn't happen, though...)
1833 				 */
1834 				for (m_hold = ln->ln_hold, ln->ln_hold = NULL;
1835 				    m_hold; m_hold = m_hold_next) {
1836 					m_hold_next = m_hold->m_nextpkt;
1837 					m_hold->m_nextpkt = NULL;
1838 
1839 					/*
1840 					 * we assume ifp is not a p2p here, so
1841 					 * just set the 2nd argument as the
1842 					 * 1st one.
1843 					 */
1844 					nd6_output(ifp, ifp, m_hold,
1845 					     (struct sockaddr_in6 *)rt_key(rt),
1846 					     rt);
1847 				}
1848 			}
1849 		} else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
1850 			/* probe right away */
1851 			nd6_llinfo_settimer((void *)ln, 0);
1852 		}
1853 	}
1854 
1855 	/*
1856 	 * ICMP6 type dependent behavior.
1857 	 *
1858 	 * NS: clear IsRouter if new entry
1859 	 * RS: clear IsRouter
1860 	 * RA: set IsRouter if there's lladdr
1861 	 * redir: clear IsRouter if new entry
1862 	 *
1863 	 * RA case, (1):
1864 	 * The spec says that we must set IsRouter in the following cases:
1865 	 * - If lladdr exist, set IsRouter.  This means (1-5).
1866 	 * - If it is old entry (!newentry), set IsRouter.  This means (7).
1867 	 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
1868 	 * A quetion arises for (1) case.  (1) case has no lladdr in the
1869 	 * neighbor cache, this is similar to (6).
1870 	 * This case is rare but we figured that we MUST NOT set IsRouter.
1871 	 *
1872 	 * newentry olladdr  lladdr  llchange	    NS  RS  RA	redir
1873 	 *							D R
1874 	 *	0	n	n	--	(1)	c   ?     s
1875 	 *	0	y	n	--	(2)	c   s     s
1876 	 *	0	n	y	--	(3)	c   s     s
1877 	 *	0	y	y	n	(4)	c   s     s
1878 	 *	0	y	y	y	(5)	c   s     s
1879 	 *	1	--	n	--	(6) c	c	c s
1880 	 *	1	--	y	--	(7) c	c   s	c s
1881 	 *
1882 	 *					(c=clear s=set)
1883 	 */
1884 	switch (type & 0xff) {
1885 	case ND_NEIGHBOR_SOLICIT:
1886 		/*
1887 		 * New entry must have is_router flag cleared.
1888 		 */
1889 		if (is_newentry)	/* (6-7) */
1890 			ln->ln_router = 0;
1891 		break;
1892 	case ND_REDIRECT:
1893 		/*
1894 		 * If the icmp is a redirect to a better router, always set the
1895 		 * is_router flag.  Otherwise, if the entry is newly created,
1896 		 * clear the flag.  [RFC 2461, sec 8.3]
1897 		 */
1898 		if (code == ND_REDIRECT_ROUTER)
1899 			ln->ln_router = 1;
1900 		else if (is_newentry) /* (6-7) */
1901 			ln->ln_router = 0;
1902 		break;
1903 	case ND_ROUTER_SOLICIT:
1904 		/*
1905 		 * is_router flag must always be cleared.
1906 		 */
1907 		ln->ln_router = 0;
1908 		break;
1909 	case ND_ROUTER_ADVERT:
1910 		/*
1911 		 * Mark an entry with lladdr as a router.
1912 		 */
1913 		if ((!is_newentry && (olladdr || lladdr)) ||	/* (2-5) */
1914 		    (is_newentry && lladdr)) {			/* (7) */
1915 			ln->ln_router = 1;
1916 		}
1917 		break;
1918 	}
1919 
1920 	/*
1921 	 * When the link-layer address of a router changes, select the
1922 	 * best router again.  In particular, when the neighbor entry is newly
1923 	 * created, it might affect the selection policy.
1924 	 * Question: can we restrict the first condition to the "is_newentry"
1925 	 * case?
1926 	 * XXX: when we hear an RA from a new router with the link-layer
1927 	 * address option, defrouter_select() is called twice, since
1928 	 * defrtrlist_update called the function as well.  However, I believe
1929 	 * we can compromise the overhead, since it only happens the first
1930 	 * time.
1931 	 * XXX: although defrouter_select() should not have a bad effect
1932 	 * for those are not autoconfigured hosts, we explicitly avoid such
1933 	 * cases for safety.
1934 	 */
1935 	if (do_update && ln->ln_router && !V_ip6_forwarding && V_ip6_accept_rtadv)
1936 		defrouter_select();
1937 
1938 	return rt;
1939 }
1940 
1941 static void
1942 nd6_slowtimo(void *arg)
1943 {
1944 	CURVNET_SET((struct vnet *) arg);
1945 	INIT_VNET_NET((struct vnet *) arg);
1946 	INIT_VNET_INET6((struct vnet *) arg);
1947 	struct nd_ifinfo *nd6if;
1948 	struct ifnet *ifp;
1949 
1950 	callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
1951 	    nd6_slowtimo, NULL);
1952 	IFNET_RLOCK();
1953 	for (ifp = TAILQ_FIRST(&V_ifnet); ifp;
1954 	    ifp = TAILQ_NEXT(ifp, if_list)) {
1955 		nd6if = ND_IFINFO(ifp);
1956 		if (nd6if->basereachable && /* already initialized */
1957 		    (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
1958 			/*
1959 			 * Since reachable time rarely changes by router
1960 			 * advertisements, we SHOULD insure that a new random
1961 			 * value gets recomputed at least once every few hours.
1962 			 * (RFC 2461, 6.3.4)
1963 			 */
1964 			nd6if->recalctm = V_nd6_recalc_reachtm_interval;
1965 			nd6if->reachable = ND_COMPUTE_RTIME(nd6if->basereachable);
1966 		}
1967 	}
1968 	IFNET_RUNLOCK();
1969 	CURVNET_RESTORE();
1970 }
1971 
1972 #define senderr(e) { error = (e); goto bad;}
1973 int
1974 nd6_output(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
1975     struct sockaddr_in6 *dst, struct rtentry *rt0)
1976 {
1977 	INIT_VNET_INET6(curvnet);
1978 	struct mbuf *m = m0;
1979 	struct rtentry *rt = rt0;
1980 	struct sockaddr_in6 *gw6 = NULL;
1981 	struct llinfo_nd6 *ln = NULL;
1982 	int error = 0;
1983 
1984 	if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr))
1985 		goto sendpkt;
1986 
1987 	if (nd6_need_cache(ifp) == 0)
1988 		goto sendpkt;
1989 
1990 	/*
1991 	 * next hop determination.  This routine is derived from ether_output.
1992 	 */
1993 	/* NB: the locking here is tortuous... */
1994 	if (rt != NULL)
1995 		RT_LOCK(rt);
1996 again:
1997 	if (rt != NULL) {
1998 		if ((rt->rt_flags & RTF_UP) == 0) {
1999 			RT_UNLOCK(rt);
2000 			rt0 = rt = rtalloc1((struct sockaddr *)dst, 1, 0UL);
2001 			if (rt != NULL) {
2002 				RT_REMREF(rt);
2003 				if (rt->rt_ifp != ifp)
2004 					/*
2005 					 * XXX maybe we should update ifp too,
2006 					 * but the original code didn't and I
2007 					 * don't know what is correct here.
2008 					 */
2009 					goto again;
2010 			} else
2011 				senderr(EHOSTUNREACH);
2012 		}
2013 
2014 		if (rt->rt_flags & RTF_GATEWAY) {
2015 			gw6 = (struct sockaddr_in6 *)rt->rt_gateway;
2016 
2017 			/*
2018 			 * We skip link-layer address resolution and NUD
2019 			 * if the gateway is not a neighbor from ND point
2020 			 * of view, regardless of the value of nd_ifinfo.flags.
2021 			 * The second condition is a bit tricky; we skip
2022 			 * if the gateway is our own address, which is
2023 			 * sometimes used to install a route to a p2p link.
2024 			 */
2025 			if (!nd6_is_addr_neighbor(gw6, ifp) ||
2026 			    in6ifa_ifpwithaddr(ifp, &gw6->sin6_addr)) {
2027 				RT_UNLOCK(rt);
2028 				/*
2029 				 * We allow this kind of tricky route only
2030 				 * when the outgoing interface is p2p.
2031 				 * XXX: we may need a more generic rule here.
2032 				 */
2033 				if ((ifp->if_flags & IFF_POINTOPOINT) == 0)
2034 					senderr(EHOSTUNREACH);
2035 
2036 				goto sendpkt;
2037 			}
2038 
2039 			if (rt->rt_gwroute == NULL)
2040 				goto lookup;
2041 			rt = rt->rt_gwroute;
2042 			RT_LOCK(rt);		/* NB: gwroute */
2043 			if ((rt->rt_flags & RTF_UP) == 0) {
2044 				RTFREE_LOCKED(rt);	/* unlock gwroute */
2045 				rt = rt0;
2046 				rt0->rt_gwroute = NULL;
2047 			lookup:
2048 				RT_UNLOCK(rt0);
2049 				rt = rtalloc1(rt->rt_gateway, 1, 0UL);
2050 				if (rt == rt0) {
2051 					RT_REMREF(rt0);
2052 					RT_UNLOCK(rt0);
2053 					senderr(EHOSTUNREACH);
2054 				}
2055 				RT_LOCK(rt0);
2056 				if (rt0->rt_gwroute != NULL)
2057 					RTFREE(rt0->rt_gwroute);
2058 				rt0->rt_gwroute = rt;
2059 				if (rt == NULL) {
2060 					RT_UNLOCK(rt0);
2061 					senderr(EHOSTUNREACH);
2062 				}
2063 			}
2064 			RT_UNLOCK(rt0);
2065 		}
2066 		RT_UNLOCK(rt);
2067 	}
2068 
2069 	/*
2070 	 * Address resolution or Neighbor Unreachability Detection
2071 	 * for the next hop.
2072 	 * At this point, the destination of the packet must be a unicast
2073 	 * or an anycast address(i.e. not a multicast).
2074 	 */
2075 
2076 	/* Look up the neighbor cache for the nexthop */
2077 	if (rt && (rt->rt_flags & RTF_LLINFO) != 0)
2078 		ln = (struct llinfo_nd6 *)rt->rt_llinfo;
2079 	else {
2080 		/*
2081 		 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
2082 		 * the condition below is not very efficient.  But we believe
2083 		 * it is tolerable, because this should be a rare case.
2084 		 */
2085 		if (nd6_is_addr_neighbor(dst, ifp) &&
2086 		    (rt = nd6_lookup(&dst->sin6_addr, 1, ifp)) != NULL)
2087 			ln = (struct llinfo_nd6 *)rt->rt_llinfo;
2088 	}
2089 	if (ln == NULL || rt == NULL) {
2090 		if ((ifp->if_flags & IFF_POINTOPOINT) == 0 &&
2091 		    !(ND_IFINFO(ifp)->flags & ND6_IFF_PERFORMNUD)) {
2092 			char ip6buf[INET6_ADDRSTRLEN];
2093 			log(LOG_DEBUG,
2094 			    "nd6_output: can't allocate llinfo for %s "
2095 			    "(ln=%p, rt=%p)\n",
2096 			    ip6_sprintf(ip6buf, &dst->sin6_addr), ln, rt);
2097 			senderr(EIO);	/* XXX: good error? */
2098 		}
2099 
2100 		goto sendpkt;	/* send anyway */
2101 	}
2102 
2103 	/* We don't have to do link-layer address resolution on a p2p link. */
2104 	if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
2105 	    ln->ln_state < ND6_LLINFO_REACHABLE) {
2106 		ln->ln_state = ND6_LLINFO_STALE;
2107 		nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
2108 	}
2109 
2110 	/*
2111 	 * The first time we send a packet to a neighbor whose entry is
2112 	 * STALE, we have to change the state to DELAY and a sets a timer to
2113 	 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
2114 	 * neighbor unreachability detection on expiration.
2115 	 * (RFC 2461 7.3.3)
2116 	 */
2117 	if (ln->ln_state == ND6_LLINFO_STALE) {
2118 		ln->ln_asked = 0;
2119 		ln->ln_state = ND6_LLINFO_DELAY;
2120 		nd6_llinfo_settimer(ln, (long)V_nd6_delay * hz);
2121 	}
2122 
2123 	/*
2124 	 * If the neighbor cache entry has a state other than INCOMPLETE
2125 	 * (i.e. its link-layer address is already resolved), just
2126 	 * send the packet.
2127 	 */
2128 	if (ln->ln_state > ND6_LLINFO_INCOMPLETE)
2129 		goto sendpkt;
2130 
2131 	/*
2132 	 * There is a neighbor cache entry, but no ethernet address
2133 	 * response yet.  Append this latest packet to the end of the
2134 	 * packet queue in the mbuf, unless the number of the packet
2135 	 * does not exceed nd6_maxqueuelen.  When it exceeds nd6_maxqueuelen,
2136 	 * the oldest packet in the queue will be removed.
2137 	 */
2138 	if (ln->ln_state == ND6_LLINFO_NOSTATE)
2139 		ln->ln_state = ND6_LLINFO_INCOMPLETE;
2140 	if (ln->ln_hold) {
2141 		struct mbuf *m_hold;
2142 		int i;
2143 
2144 		i = 0;
2145 		for (m_hold = ln->ln_hold; m_hold; m_hold = m_hold->m_nextpkt) {
2146 			i++;
2147 			if (m_hold->m_nextpkt == NULL) {
2148 				m_hold->m_nextpkt = m;
2149 				break;
2150 			}
2151 		}
2152 		while (i >= V_nd6_maxqueuelen) {
2153 			m_hold = ln->ln_hold;
2154 			ln->ln_hold = ln->ln_hold->m_nextpkt;
2155 			m_freem(m_hold);
2156 			i--;
2157 		}
2158 	} else {
2159 		ln->ln_hold = m;
2160 	}
2161 
2162 	/*
2163 	 * If there has been no NS for the neighbor after entering the
2164 	 * INCOMPLETE state, send the first solicitation.
2165 	 */
2166 	if (!ND6_LLINFO_PERMANENT(ln) && ln->ln_asked == 0) {
2167 		ln->ln_asked++;
2168 		nd6_llinfo_settimer(ln,
2169 		    (long)ND_IFINFO(ifp)->retrans * hz / 1000);
2170 		nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, 0);
2171 	}
2172 	return (0);
2173 
2174   sendpkt:
2175 	/* discard the packet if IPv6 operation is disabled on the interface */
2176 	if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) {
2177 		error = ENETDOWN; /* better error? */
2178 		goto bad;
2179 	}
2180 
2181 #ifdef MAC
2182 	mac_netinet6_nd6_send(ifp, m);
2183 #endif
2184 	if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
2185 		return ((*ifp->if_output)(origifp, m, (struct sockaddr *)dst,
2186 		    rt));
2187 	}
2188 	return ((*ifp->if_output)(ifp, m, (struct sockaddr *)dst, rt));
2189 
2190   bad:
2191 	if (m)
2192 		m_freem(m);
2193 	return (error);
2194 }
2195 #undef senderr
2196 
2197 int
2198 nd6_need_cache(struct ifnet *ifp)
2199 {
2200 	/*
2201 	 * XXX: we currently do not make neighbor cache on any interface
2202 	 * other than ARCnet, Ethernet, FDDI and GIF.
2203 	 *
2204 	 * RFC2893 says:
2205 	 * - unidirectional tunnels needs no ND
2206 	 */
2207 	switch (ifp->if_type) {
2208 	case IFT_ARCNET:
2209 	case IFT_ETHER:
2210 	case IFT_FDDI:
2211 	case IFT_IEEE1394:
2212 #ifdef IFT_L2VLAN
2213 	case IFT_L2VLAN:
2214 #endif
2215 #ifdef IFT_IEEE80211
2216 	case IFT_IEEE80211:
2217 #endif
2218 #ifdef IFT_CARP
2219 	case IFT_CARP:
2220 #endif
2221 	case IFT_GIF:		/* XXX need more cases? */
2222 	case IFT_PPP:
2223 	case IFT_TUNNEL:
2224 	case IFT_BRIDGE:
2225 	case IFT_PROPVIRTUAL:
2226 		return (1);
2227 	default:
2228 		return (0);
2229 	}
2230 }
2231 
2232 int
2233 nd6_storelladdr(struct ifnet *ifp, struct rtentry *rt0, struct mbuf *m,
2234     struct sockaddr *dst, u_char *desten)
2235 {
2236 	struct sockaddr_dl *sdl;
2237 	struct rtentry *rt;
2238 	int error;
2239 
2240 	if (m->m_flags & M_MCAST) {
2241 		int i;
2242 
2243 		switch (ifp->if_type) {
2244 		case IFT_ETHER:
2245 		case IFT_FDDI:
2246 #ifdef IFT_L2VLAN
2247 		case IFT_L2VLAN:
2248 #endif
2249 #ifdef IFT_IEEE80211
2250 		case IFT_IEEE80211:
2251 #endif
2252 		case IFT_BRIDGE:
2253 		case IFT_ISO88025:
2254 			ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr,
2255 						 desten);
2256 			return (0);
2257 		case IFT_IEEE1394:
2258 			/*
2259 			 * netbsd can use if_broadcastaddr, but we don't do so
2260 			 * to reduce # of ifdef.
2261 			 */
2262 			for (i = 0; i < ifp->if_addrlen; i++)
2263 				desten[i] = ~0;
2264 			return (0);
2265 		case IFT_ARCNET:
2266 			*desten = 0;
2267 			return (0);
2268 		default:
2269 			m_freem(m);
2270 			return (EAFNOSUPPORT);
2271 		}
2272 	}
2273 
2274 	if (rt0 == NULL) {
2275 		/* this could happen, if we could not allocate memory */
2276 		m_freem(m);
2277 		return (ENOMEM);
2278 	}
2279 
2280 	error = rt_check(&rt, &rt0, dst);
2281 	if (error) {
2282 		m_freem(m);
2283 		return (error);
2284 	}
2285 	RT_UNLOCK(rt);
2286 
2287 	if (rt->rt_gateway->sa_family != AF_LINK) {
2288 		printf("nd6_storelladdr: something odd happens\n");
2289 		m_freem(m);
2290 		return (EINVAL);
2291 	}
2292 	sdl = SDL(rt->rt_gateway);
2293 	if (sdl->sdl_alen == 0) {
2294 		/* this should be impossible, but we bark here for debugging */
2295 		printf("nd6_storelladdr: sdl_alen == 0\n");
2296 		m_freem(m);
2297 		return (EINVAL);
2298 	}
2299 
2300 	bcopy(LLADDR(sdl), desten, sdl->sdl_alen);
2301 	return (0);
2302 }
2303 
2304 static void
2305 clear_llinfo_pqueue(struct llinfo_nd6 *ln)
2306 {
2307 	struct mbuf *m_hold, *m_hold_next;
2308 
2309 	for (m_hold = ln->ln_hold; m_hold; m_hold = m_hold_next) {
2310 		m_hold_next = m_hold->m_nextpkt;
2311 		m_hold->m_nextpkt = NULL;
2312 		m_freem(m_hold);
2313 	}
2314 
2315 	ln->ln_hold = NULL;
2316 	return;
2317 }
2318 
2319 static int nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS);
2320 static int nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS);
2321 #ifdef SYSCTL_DECL
2322 SYSCTL_DECL(_net_inet6_icmp6);
2323 #endif
2324 SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_DRLIST, nd6_drlist,
2325 	CTLFLAG_RD, nd6_sysctl_drlist, "");
2326 SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_PRLIST, nd6_prlist,
2327 	CTLFLAG_RD, nd6_sysctl_prlist, "");
2328 SYSCTL_V_INT(V_NET, vnet_inet6, _net_inet6_icmp6, ICMPV6CTL_ND6_MAXQLEN,
2329 	nd6_maxqueuelen, CTLFLAG_RW, nd6_maxqueuelen, 1, "");
2330 
2331 static int
2332 nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS)
2333 {
2334 	INIT_VNET_INET6(curvnet);
2335 	int error;
2336 	char buf[1024] __aligned(4);
2337 	struct in6_defrouter *d, *de;
2338 	struct nd_defrouter *dr;
2339 
2340 	if (req->newptr)
2341 		return EPERM;
2342 	error = 0;
2343 
2344 	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
2345 	     dr = TAILQ_NEXT(dr, dr_entry)) {
2346 		d = (struct in6_defrouter *)buf;
2347 		de = (struct in6_defrouter *)(buf + sizeof(buf));
2348 
2349 		if (d + 1 <= de) {
2350 			bzero(d, sizeof(*d));
2351 			d->rtaddr.sin6_family = AF_INET6;
2352 			d->rtaddr.sin6_len = sizeof(d->rtaddr);
2353 			d->rtaddr.sin6_addr = dr->rtaddr;
2354 			error = sa6_recoverscope(&d->rtaddr);
2355 			if (error != 0)
2356 				return (error);
2357 			d->flags = dr->flags;
2358 			d->rtlifetime = dr->rtlifetime;
2359 			d->expire = dr->expire;
2360 			d->if_index = dr->ifp->if_index;
2361 		} else
2362 			panic("buffer too short");
2363 
2364 		error = SYSCTL_OUT(req, buf, sizeof(*d));
2365 		if (error)
2366 			break;
2367 	}
2368 
2369 	return (error);
2370 }
2371 
2372 static int
2373 nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS)
2374 {
2375 	INIT_VNET_INET6(curvnet);
2376 	int error;
2377 	char buf[1024] __aligned(4);
2378 	struct in6_prefix *p, *pe;
2379 	struct nd_prefix *pr;
2380 	char ip6buf[INET6_ADDRSTRLEN];
2381 
2382 	if (req->newptr)
2383 		return EPERM;
2384 	error = 0;
2385 
2386 	for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
2387 		u_short advrtrs;
2388 		size_t advance;
2389 		struct sockaddr_in6 *sin6, *s6;
2390 		struct nd_pfxrouter *pfr;
2391 
2392 		p = (struct in6_prefix *)buf;
2393 		pe = (struct in6_prefix *)(buf + sizeof(buf));
2394 
2395 		if (p + 1 <= pe) {
2396 			bzero(p, sizeof(*p));
2397 			sin6 = (struct sockaddr_in6 *)(p + 1);
2398 
2399 			p->prefix = pr->ndpr_prefix;
2400 			if (sa6_recoverscope(&p->prefix)) {
2401 				log(LOG_ERR,
2402 				    "scope error in prefix list (%s)\n",
2403 				    ip6_sprintf(ip6buf, &p->prefix.sin6_addr));
2404 				/* XXX: press on... */
2405 			}
2406 			p->raflags = pr->ndpr_raf;
2407 			p->prefixlen = pr->ndpr_plen;
2408 			p->vltime = pr->ndpr_vltime;
2409 			p->pltime = pr->ndpr_pltime;
2410 			p->if_index = pr->ndpr_ifp->if_index;
2411 			if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
2412 				p->expire = 0;
2413 			else {
2414 				time_t maxexpire;
2415 
2416 				/* XXX: we assume time_t is signed. */
2417 				maxexpire = (-1) &
2418 				    ~((time_t)1 <<
2419 				    ((sizeof(maxexpire) * 8) - 1));
2420 				if (pr->ndpr_vltime <
2421 				    maxexpire - pr->ndpr_lastupdate) {
2422 				    p->expire = pr->ndpr_lastupdate +
2423 				        pr->ndpr_vltime;
2424 				} else
2425 					p->expire = maxexpire;
2426 			}
2427 			p->refcnt = pr->ndpr_refcnt;
2428 			p->flags = pr->ndpr_stateflags;
2429 			p->origin = PR_ORIG_RA;
2430 			advrtrs = 0;
2431 			for (pfr = pr->ndpr_advrtrs.lh_first; pfr;
2432 			     pfr = pfr->pfr_next) {
2433 				if ((void *)&sin6[advrtrs + 1] > (void *)pe) {
2434 					advrtrs++;
2435 					continue;
2436 				}
2437 				s6 = &sin6[advrtrs];
2438 				bzero(s6, sizeof(*s6));
2439 				s6->sin6_family = AF_INET6;
2440 				s6->sin6_len = sizeof(*sin6);
2441 				s6->sin6_addr = pfr->router->rtaddr;
2442 				if (sa6_recoverscope(s6)) {
2443 					log(LOG_ERR,
2444 					    "scope error in "
2445 					    "prefix list (%s)\n",
2446 					    ip6_sprintf(ip6buf,
2447 						    &pfr->router->rtaddr));
2448 				}
2449 				advrtrs++;
2450 			}
2451 			p->advrtrs = advrtrs;
2452 		} else
2453 			panic("buffer too short");
2454 
2455 		advance = sizeof(*p) + sizeof(*sin6) * advrtrs;
2456 		error = SYSCTL_OUT(req, buf, advance);
2457 		if (error)
2458 			break;
2459 	}
2460 
2461 	return (error);
2462 }
2463