xref: /freebsd/sys/netinet6/nd6.c (revision 82431678fce5c893ef9c7418ad6d998ad4187de6)
1 /*-
2  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the project nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	$KAME: nd6.c,v 1.144 2001/05/24 07:44:00 itojun Exp $
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_inet.h"
36 #include "opt_inet6.h"
37 #include "opt_mac.h"
38 #include "opt_route.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/callout.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/socket.h>
46 #include <sys/sockio.h>
47 #include <sys/time.h>
48 #include <sys/kernel.h>
49 #include <sys/protosw.h>
50 #include <sys/errno.h>
51 #include <sys/syslog.h>
52 #include <sys/lock.h>
53 #include <sys/rwlock.h>
54 #include <sys/queue.h>
55 #include <sys/sysctl.h>
56 #include <sys/vimage.h>
57 
58 #include <net/if.h>
59 #include <net/if_arc.h>
60 #include <net/if_dl.h>
61 #include <net/if_types.h>
62 #include <net/iso88025.h>
63 #include <net/fddi.h>
64 #include <net/route.h>
65 #include <net/vnet.h>
66 
67 #include <netinet/in.h>
68 #include <net/if_llatbl.h>
69 #define	L3_ADDR_SIN6(le)	((struct sockaddr_in6 *) L3_ADDR(le))
70 #include <netinet/if_ether.h>
71 #include <netinet6/in6_var.h>
72 #include <netinet/ip6.h>
73 #include <netinet6/ip6_var.h>
74 #include <netinet6/scope6_var.h>
75 #include <netinet6/nd6.h>
76 #include <netinet/icmp6.h>
77 #include <netinet6/vinet6.h>
78 
79 #include <sys/limits.h>
80 
81 #include <security/mac/mac_framework.h>
82 
83 #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */
84 #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */
85 
86 #define SIN6(s) ((struct sockaddr_in6 *)s)
87 
88 #ifdef VIMAGE_GLOBALS
89 int nd6_prune;
90 int nd6_delay;
91 int nd6_umaxtries;
92 int nd6_mmaxtries;
93 int nd6_useloopback;
94 int nd6_gctimer;
95 
96 /* preventing too many loops in ND option parsing */
97 int nd6_maxndopt;
98 
99 int nd6_maxnudhint;
100 int nd6_maxqueuelen;
101 
102 int nd6_debug;
103 
104 /* for debugging? */
105 #if 0
106 static int nd6_inuse, nd6_allocated;
107 #endif
108 
109 struct nd_drhead nd_defrouter;
110 struct nd_prhead nd_prefix;
111 
112 int nd6_recalc_reachtm_interval;
113 #endif /* VIMAGE_GLOBALS */
114 
115 static struct sockaddr_in6 all1_sa;
116 
117 static int nd6_is_new_addr_neighbor __P((struct sockaddr_in6 *,
118 	struct ifnet *));
119 static void nd6_setmtu0(struct ifnet *, struct nd_ifinfo *);
120 static void nd6_slowtimo(void *);
121 static int regen_tmpaddr(struct in6_ifaddr *);
122 static struct llentry *nd6_free(struct llentry *, int);
123 static void nd6_llinfo_timer(void *);
124 static void clear_llinfo_pqueue(struct llentry *);
125 
126 #ifdef VIMAGE_GLOBALS
127 struct callout nd6_slowtimo_ch;
128 struct callout nd6_timer_ch;
129 extern struct callout in6_tmpaddrtimer_ch;
130 extern int dad_ignore_ns;
131 extern int dad_maxtry;
132 #endif
133 
134 void
135 nd6_init(void)
136 {
137 	INIT_VNET_INET6(curvnet);
138 	static int nd6_init_done = 0;
139 	int i;
140 
141 	if (nd6_init_done) {
142 		log(LOG_NOTICE, "nd6_init called more than once(ignored)\n");
143 		return;
144 	}
145 
146 	V_nd6_prune	= 1;	/* walk list every 1 seconds */
147 	V_nd6_delay	= 5;	/* delay first probe time 5 second */
148 	V_nd6_umaxtries	= 3;	/* maximum unicast query */
149 	V_nd6_mmaxtries	= 3;	/* maximum multicast query */
150 	V_nd6_useloopback = 1;	/* use loopback interface for local traffic */
151 	V_nd6_gctimer	= (60 * 60 * 24); /* 1 day: garbage collection timer */
152 
153 	/* preventing too many loops in ND option parsing */
154 	V_nd6_maxndopt = 10;	/* max # of ND options allowed */
155 
156 	V_nd6_maxnudhint = 0;	/* max # of subsequent upper layer hints */
157 	V_nd6_maxqueuelen = 1;	/* max pkts cached in unresolved ND entries */
158 
159 #ifdef ND6_DEBUG
160 	V_nd6_debug = 1;
161 #else
162 	V_nd6_debug = 0;
163 #endif
164 
165 	V_nd6_recalc_reachtm_interval = ND6_RECALC_REACHTM_INTERVAL;
166 
167 	V_dad_ignore_ns = 0;	/* ignore NS in DAD - specwise incorrect*/
168 	V_dad_maxtry = 15;	/* max # of *tries* to transmit DAD packet */
169 
170 	/*
171 	 * XXX just to get this to compile KMM
172 	 */
173 #ifdef notyet
174 	V_llinfo_nd6.ln_next = &V_llinfo_nd6;
175 	V_llinfo_nd6.ln_prev = &V_llinfo_nd6;
176 #endif
177 	LIST_INIT(&V_nd_prefix);
178 
179 	V_ip6_use_tempaddr = 0;
180 	V_ip6_temp_preferred_lifetime = DEF_TEMP_PREFERRED_LIFETIME;
181 	V_ip6_temp_valid_lifetime = DEF_TEMP_VALID_LIFETIME;
182 	V_ip6_temp_regen_advance = TEMPADDR_REGEN_ADVANCE;
183 
184 	all1_sa.sin6_family = AF_INET6;
185 	all1_sa.sin6_len = sizeof(struct sockaddr_in6);
186 	for (i = 0; i < sizeof(all1_sa.sin6_addr); i++)
187 		all1_sa.sin6_addr.s6_addr[i] = 0xff;
188 
189 	/* initialization of the default router list */
190 	TAILQ_INIT(&V_nd_defrouter);
191 	/* start timer */
192 	callout_init(&V_nd6_slowtimo_ch, 0);
193 	callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
194 	    nd6_slowtimo, curvnet);
195 
196 	nd6_init_done = 1;
197 
198 }
199 
200 struct nd_ifinfo *
201 nd6_ifattach(struct ifnet *ifp)
202 {
203 	struct nd_ifinfo *nd;
204 
205 	nd = (struct nd_ifinfo *)malloc(sizeof(*nd), M_IP6NDP, M_WAITOK);
206 	bzero(nd, sizeof(*nd));
207 
208 	nd->initialized = 1;
209 
210 	nd->chlim = IPV6_DEFHLIM;
211 	nd->basereachable = REACHABLE_TIME;
212 	nd->reachable = ND_COMPUTE_RTIME(nd->basereachable);
213 	nd->retrans = RETRANS_TIMER;
214 	/*
215 	 * Note that the default value of ip6_accept_rtadv is 0, which means
216 	 * we won't accept RAs by default even if we set ND6_IFF_ACCEPT_RTADV
217 	 * here.
218 	 */
219 	nd->flags = (ND6_IFF_PERFORMNUD | ND6_IFF_ACCEPT_RTADV);
220 
221 	/* XXX: we cannot call nd6_setmtu since ifp is not fully initialized */
222 	nd6_setmtu0(ifp, nd);
223 
224 	return nd;
225 }
226 
227 void
228 nd6_ifdetach(struct nd_ifinfo *nd)
229 {
230 
231 	free(nd, M_IP6NDP);
232 }
233 
234 /*
235  * Reset ND level link MTU. This function is called when the physical MTU
236  * changes, which means we might have to adjust the ND level MTU.
237  */
238 void
239 nd6_setmtu(struct ifnet *ifp)
240 {
241 
242 	nd6_setmtu0(ifp, ND_IFINFO(ifp));
243 }
244 
245 /* XXX todo: do not maintain copy of ifp->if_mtu in ndi->maxmtu */
246 void
247 nd6_setmtu0(struct ifnet *ifp, struct nd_ifinfo *ndi)
248 {
249 	INIT_VNET_INET6(ifp->if_vnet);
250 	u_int32_t omaxmtu;
251 
252 	omaxmtu = ndi->maxmtu;
253 
254 	switch (ifp->if_type) {
255 	case IFT_ARCNET:
256 		ndi->maxmtu = MIN(ARC_PHDS_MAXMTU, ifp->if_mtu); /* RFC2497 */
257 		break;
258 	case IFT_FDDI:
259 		ndi->maxmtu = MIN(FDDIIPMTU, ifp->if_mtu); /* RFC2467 */
260 		break;
261 	case IFT_ISO88025:
262 		 ndi->maxmtu = MIN(ISO88025_MAX_MTU, ifp->if_mtu);
263 		 break;
264 	default:
265 		ndi->maxmtu = ifp->if_mtu;
266 		break;
267 	}
268 
269 	/*
270 	 * Decreasing the interface MTU under IPV6 minimum MTU may cause
271 	 * undesirable situation.  We thus notify the operator of the change
272 	 * explicitly.  The check for omaxmtu is necessary to restrict the
273 	 * log to the case of changing the MTU, not initializing it.
274 	 */
275 	if (omaxmtu >= IPV6_MMTU && ndi->maxmtu < IPV6_MMTU) {
276 		log(LOG_NOTICE, "nd6_setmtu0: "
277 		    "new link MTU on %s (%lu) is too small for IPv6\n",
278 		    if_name(ifp), (unsigned long)ndi->maxmtu);
279 	}
280 
281 	if (ndi->maxmtu > V_in6_maxmtu)
282 		in6_setmaxmtu(); /* check all interfaces just in case */
283 
284 #undef MIN
285 }
286 
287 void
288 nd6_option_init(void *opt, int icmp6len, union nd_opts *ndopts)
289 {
290 
291 	bzero(ndopts, sizeof(*ndopts));
292 	ndopts->nd_opts_search = (struct nd_opt_hdr *)opt;
293 	ndopts->nd_opts_last
294 		= (struct nd_opt_hdr *)(((u_char *)opt) + icmp6len);
295 
296 	if (icmp6len == 0) {
297 		ndopts->nd_opts_done = 1;
298 		ndopts->nd_opts_search = NULL;
299 	}
300 }
301 
302 /*
303  * Take one ND option.
304  */
305 struct nd_opt_hdr *
306 nd6_option(union nd_opts *ndopts)
307 {
308 	struct nd_opt_hdr *nd_opt;
309 	int olen;
310 
311 	if (ndopts == NULL)
312 		panic("ndopts == NULL in nd6_option");
313 	if (ndopts->nd_opts_last == NULL)
314 		panic("uninitialized ndopts in nd6_option");
315 	if (ndopts->nd_opts_search == NULL)
316 		return NULL;
317 	if (ndopts->nd_opts_done)
318 		return NULL;
319 
320 	nd_opt = ndopts->nd_opts_search;
321 
322 	/* make sure nd_opt_len is inside the buffer */
323 	if ((caddr_t)&nd_opt->nd_opt_len >= (caddr_t)ndopts->nd_opts_last) {
324 		bzero(ndopts, sizeof(*ndopts));
325 		return NULL;
326 	}
327 
328 	olen = nd_opt->nd_opt_len << 3;
329 	if (olen == 0) {
330 		/*
331 		 * Message validation requires that all included
332 		 * options have a length that is greater than zero.
333 		 */
334 		bzero(ndopts, sizeof(*ndopts));
335 		return NULL;
336 	}
337 
338 	ndopts->nd_opts_search = (struct nd_opt_hdr *)((caddr_t)nd_opt + olen);
339 	if (ndopts->nd_opts_search > ndopts->nd_opts_last) {
340 		/* option overruns the end of buffer, invalid */
341 		bzero(ndopts, sizeof(*ndopts));
342 		return NULL;
343 	} else if (ndopts->nd_opts_search == ndopts->nd_opts_last) {
344 		/* reached the end of options chain */
345 		ndopts->nd_opts_done = 1;
346 		ndopts->nd_opts_search = NULL;
347 	}
348 	return nd_opt;
349 }
350 
351 /*
352  * Parse multiple ND options.
353  * This function is much easier to use, for ND routines that do not need
354  * multiple options of the same type.
355  */
356 int
357 nd6_options(union nd_opts *ndopts)
358 {
359 	INIT_VNET_INET6(curvnet);
360 	struct nd_opt_hdr *nd_opt;
361 	int i = 0;
362 
363 	if (ndopts == NULL)
364 		panic("ndopts == NULL in nd6_options");
365 	if (ndopts->nd_opts_last == NULL)
366 		panic("uninitialized ndopts in nd6_options");
367 	if (ndopts->nd_opts_search == NULL)
368 		return 0;
369 
370 	while (1) {
371 		nd_opt = nd6_option(ndopts);
372 		if (nd_opt == NULL && ndopts->nd_opts_last == NULL) {
373 			/*
374 			 * Message validation requires that all included
375 			 * options have a length that is greater than zero.
376 			 */
377 			ICMP6STAT_INC(icp6s_nd_badopt);
378 			bzero(ndopts, sizeof(*ndopts));
379 			return -1;
380 		}
381 
382 		if (nd_opt == NULL)
383 			goto skip1;
384 
385 		switch (nd_opt->nd_opt_type) {
386 		case ND_OPT_SOURCE_LINKADDR:
387 		case ND_OPT_TARGET_LINKADDR:
388 		case ND_OPT_MTU:
389 		case ND_OPT_REDIRECTED_HEADER:
390 			if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
391 				nd6log((LOG_INFO,
392 				    "duplicated ND6 option found (type=%d)\n",
393 				    nd_opt->nd_opt_type));
394 				/* XXX bark? */
395 			} else {
396 				ndopts->nd_opt_array[nd_opt->nd_opt_type]
397 					= nd_opt;
398 			}
399 			break;
400 		case ND_OPT_PREFIX_INFORMATION:
401 			if (ndopts->nd_opt_array[nd_opt->nd_opt_type] == 0) {
402 				ndopts->nd_opt_array[nd_opt->nd_opt_type]
403 					= nd_opt;
404 			}
405 			ndopts->nd_opts_pi_end =
406 				(struct nd_opt_prefix_info *)nd_opt;
407 			break;
408 		default:
409 			/*
410 			 * Unknown options must be silently ignored,
411 			 * to accomodate future extension to the protocol.
412 			 */
413 			nd6log((LOG_DEBUG,
414 			    "nd6_options: unsupported option %d - "
415 			    "option ignored\n", nd_opt->nd_opt_type));
416 		}
417 
418 skip1:
419 		i++;
420 		if (i > V_nd6_maxndopt) {
421 			ICMP6STAT_INC(icp6s_nd_toomanyopt);
422 			nd6log((LOG_INFO, "too many loop in nd opt\n"));
423 			break;
424 		}
425 
426 		if (ndopts->nd_opts_done)
427 			break;
428 	}
429 
430 	return 0;
431 }
432 
433 /*
434  * ND6 timer routine to handle ND6 entries
435  */
436 void
437 nd6_llinfo_settimer_locked(struct llentry *ln, long tick)
438 {
439 	if (tick < 0) {
440 		ln->la_expire = 0;
441 		ln->ln_ntick = 0;
442 		callout_stop(&ln->ln_timer_ch);
443 		/*
444 		 * XXX - do we know that there is
445 		 * callout installed? i.e. are we
446 		 * guaranteed that we're not dropping
447 		 * a reference that we did not add?
448 		 * KMM
449 		 */
450 		LLE_REMREF(ln);
451 	} else {
452 		ln->la_expire = time_second + tick / hz;
453 		LLE_ADDREF(ln);
454 		if (tick > INT_MAX) {
455 			ln->ln_ntick = tick - INT_MAX;
456 			callout_reset(&ln->ln_timer_ch, INT_MAX,
457 			    nd6_llinfo_timer, ln);
458 		} else {
459 			ln->ln_ntick = 0;
460 			callout_reset(&ln->ln_timer_ch, tick,
461 			    nd6_llinfo_timer, ln);
462 		}
463 	}
464 }
465 
466 void
467 nd6_llinfo_settimer(struct llentry *ln, long tick)
468 {
469 
470 	LLE_WLOCK(ln);
471 	nd6_llinfo_settimer_locked(ln, tick);
472 	LLE_WUNLOCK(ln);
473 }
474 
475 static void
476 nd6_llinfo_timer(void *arg)
477 {
478 	struct llentry *ln;
479 	struct in6_addr *dst;
480 	struct ifnet *ifp;
481 	struct nd_ifinfo *ndi = NULL;
482 
483 	ln = (struct llentry *)arg;
484 	if (ln == NULL) {
485 		panic("%s: NULL entry!\n", __func__);
486 		return;
487 	}
488 
489 	if ((ifp = ((ln->lle_tbl != NULL) ? ln->lle_tbl->llt_ifp : NULL)) == NULL)
490 		panic("ln ifp == NULL");
491 
492 /*
493  * XXX XXX XXX XXX XXX
494  *
495  * Why the ^%(@)*&%^) is this #define MIN() needed for CURVNET_SET()?!?
496  * And #define MIN() is in sys/param.h already, which is #included first
497  * here?!?
498  */
499 #define       MIN(a,b) (((a)<(b))?(a):(b))
500 	CURVNET_SET(ifp->if_vnet);
501 	INIT_VNET_INET6(curvnet);
502 
503 	if (ln->ln_ntick > 0) {
504 		if (ln->ln_ntick > INT_MAX) {
505 			ln->ln_ntick -= INT_MAX;
506 			nd6_llinfo_settimer(ln, INT_MAX);
507 		} else {
508 			ln->ln_ntick = 0;
509 			nd6_llinfo_settimer(ln, ln->ln_ntick);
510 		}
511 		goto done;
512 	}
513 
514 	ndi = ND_IFINFO(ifp);
515 	dst = &L3_ADDR_SIN6(ln)->sin6_addr;
516 	if ((ln->la_flags & LLE_STATIC) || (ln->la_expire > time_second)) {
517 		goto done;
518 	}
519 
520 	if (ln->la_flags & LLE_DELETED) {
521 		(void)nd6_free(ln, 0);
522 		goto done;
523 	}
524 
525 	switch (ln->ln_state) {
526 	case ND6_LLINFO_INCOMPLETE:
527 		if (ln->la_asked < V_nd6_mmaxtries) {
528 			ln->la_asked++;
529 			nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
530 			nd6_ns_output(ifp, NULL, dst, ln, 0);
531 		} else {
532 			struct mbuf *m = ln->la_hold;
533 			if (m) {
534 				struct mbuf *m0;
535 
536 				/*
537 				 * assuming every packet in la_hold has the
538 				 * same IP header
539 				 */
540 				m0 = m->m_nextpkt;
541 				m->m_nextpkt = NULL;
542 				icmp6_error2(m, ICMP6_DST_UNREACH,
543 				    ICMP6_DST_UNREACH_ADDR, 0, ifp);
544 
545 				ln->la_hold = m0;
546 				clear_llinfo_pqueue(ln);
547 			}
548 			(void)nd6_free(ln, 0);
549 			ln = NULL;
550 		}
551 		break;
552 	case ND6_LLINFO_REACHABLE:
553 		if (!ND6_LLINFO_PERMANENT(ln)) {
554 			ln->ln_state = ND6_LLINFO_STALE;
555 			nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
556 		}
557 		break;
558 
559 	case ND6_LLINFO_STALE:
560 		/* Garbage Collection(RFC 2461 5.3) */
561 		if (!ND6_LLINFO_PERMANENT(ln)) {
562 			(void)nd6_free(ln, 1);
563 			ln = NULL;
564 		}
565 		break;
566 
567 	case ND6_LLINFO_DELAY:
568 		if (ndi && (ndi->flags & ND6_IFF_PERFORMNUD) != 0) {
569 			/* We need NUD */
570 			ln->la_asked = 1;
571 			ln->ln_state = ND6_LLINFO_PROBE;
572 			nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
573 			nd6_ns_output(ifp, dst, dst, ln, 0);
574 		} else {
575 			ln->ln_state = ND6_LLINFO_STALE; /* XXX */
576 			nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
577 		}
578 		break;
579 	case ND6_LLINFO_PROBE:
580 		if (ln->la_asked < V_nd6_umaxtries) {
581 			ln->la_asked++;
582 			nd6_llinfo_settimer(ln, (long)ndi->retrans * hz / 1000);
583 			nd6_ns_output(ifp, dst, dst, ln, 0);
584 		} else {
585 			(void)nd6_free(ln, 0);
586 			ln = NULL;
587 		}
588 		break;
589 	}
590 	CURVNET_RESTORE();
591 done:
592 	if (ln != NULL)
593 		LLE_FREE(ln);
594 }
595 
596 
597 /*
598  * ND6 timer routine to expire default route list and prefix list
599  */
600 void
601 nd6_timer(void *arg)
602 {
603 	CURVNET_SET((struct vnet *) arg);
604 	INIT_VNET_INET6(curvnet);
605 	int s;
606 	struct nd_defrouter *dr;
607 	struct nd_prefix *pr;
608 	struct in6_ifaddr *ia6, *nia6;
609 	struct in6_addrlifetime *lt6;
610 
611 	callout_reset(&V_nd6_timer_ch, V_nd6_prune * hz,
612 	    nd6_timer, curvnet);
613 
614 	/* expire default router list */
615 	s = splnet();
616 	dr = TAILQ_FIRST(&V_nd_defrouter);
617 	while (dr) {
618 		if (dr->expire && dr->expire < time_second) {
619 			struct nd_defrouter *t;
620 			t = TAILQ_NEXT(dr, dr_entry);
621 			defrtrlist_del(dr);
622 			dr = t;
623 		} else {
624 			dr = TAILQ_NEXT(dr, dr_entry);
625 		}
626 	}
627 
628 	/*
629 	 * expire interface addresses.
630 	 * in the past the loop was inside prefix expiry processing.
631 	 * However, from a stricter speci-confrmance standpoint, we should
632 	 * rather separate address lifetimes and prefix lifetimes.
633 	 */
634   addrloop:
635 	for (ia6 = V_in6_ifaddr; ia6; ia6 = nia6) {
636 		nia6 = ia6->ia_next;
637 		/* check address lifetime */
638 		lt6 = &ia6->ia6_lifetime;
639 		if (IFA6_IS_INVALID(ia6)) {
640 			int regen = 0;
641 
642 			/*
643 			 * If the expiring address is temporary, try
644 			 * regenerating a new one.  This would be useful when
645 			 * we suspended a laptop PC, then turned it on after a
646 			 * period that could invalidate all temporary
647 			 * addresses.  Although we may have to restart the
648 			 * loop (see below), it must be after purging the
649 			 * address.  Otherwise, we'd see an infinite loop of
650 			 * regeneration.
651 			 */
652 			if (V_ip6_use_tempaddr &&
653 			    (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0) {
654 				if (regen_tmpaddr(ia6) == 0)
655 					regen = 1;
656 			}
657 
658 			in6_purgeaddr(&ia6->ia_ifa);
659 
660 			if (regen)
661 				goto addrloop; /* XXX: see below */
662 		} else if (IFA6_IS_DEPRECATED(ia6)) {
663 			int oldflags = ia6->ia6_flags;
664 
665 			ia6->ia6_flags |= IN6_IFF_DEPRECATED;
666 
667 			/*
668 			 * If a temporary address has just become deprecated,
669 			 * regenerate a new one if possible.
670 			 */
671 			if (V_ip6_use_tempaddr &&
672 			    (ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
673 			    (oldflags & IN6_IFF_DEPRECATED) == 0) {
674 
675 				if (regen_tmpaddr(ia6) == 0) {
676 					/*
677 					 * A new temporary address is
678 					 * generated.
679 					 * XXX: this means the address chain
680 					 * has changed while we are still in
681 					 * the loop.  Although the change
682 					 * would not cause disaster (because
683 					 * it's not a deletion, but an
684 					 * addition,) we'd rather restart the
685 					 * loop just for safety.  Or does this
686 					 * significantly reduce performance??
687 					 */
688 					goto addrloop;
689 				}
690 			}
691 		} else {
692 			/*
693 			 * A new RA might have made a deprecated address
694 			 * preferred.
695 			 */
696 			ia6->ia6_flags &= ~IN6_IFF_DEPRECATED;
697 		}
698 	}
699 
700 	/* expire prefix list */
701 	pr = V_nd_prefix.lh_first;
702 	while (pr) {
703 		/*
704 		 * check prefix lifetime.
705 		 * since pltime is just for autoconf, pltime processing for
706 		 * prefix is not necessary.
707 		 */
708 		if (pr->ndpr_vltime != ND6_INFINITE_LIFETIME &&
709 		    time_second - pr->ndpr_lastupdate > pr->ndpr_vltime) {
710 			struct nd_prefix *t;
711 			t = pr->ndpr_next;
712 
713 			/*
714 			 * address expiration and prefix expiration are
715 			 * separate.  NEVER perform in6_purgeaddr here.
716 			 */
717 
718 			prelist_remove(pr);
719 			pr = t;
720 		} else
721 			pr = pr->ndpr_next;
722 	}
723 	splx(s);
724 	CURVNET_RESTORE();
725 }
726 
727 /*
728  * ia6 - deprecated/invalidated temporary address
729  */
730 static int
731 regen_tmpaddr(struct in6_ifaddr *ia6)
732 {
733 	struct ifaddr *ifa;
734 	struct ifnet *ifp;
735 	struct in6_ifaddr *public_ifa6 = NULL;
736 
737 	ifp = ia6->ia_ifa.ifa_ifp;
738 	IF_ADDR_LOCK(ifp);
739 	TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
740 		struct in6_ifaddr *it6;
741 
742 		if (ifa->ifa_addr->sa_family != AF_INET6)
743 			continue;
744 
745 		it6 = (struct in6_ifaddr *)ifa;
746 
747 		/* ignore no autoconf addresses. */
748 		if ((it6->ia6_flags & IN6_IFF_AUTOCONF) == 0)
749 			continue;
750 
751 		/* ignore autoconf addresses with different prefixes. */
752 		if (it6->ia6_ndpr == NULL || it6->ia6_ndpr != ia6->ia6_ndpr)
753 			continue;
754 
755 		/*
756 		 * Now we are looking at an autoconf address with the same
757 		 * prefix as ours.  If the address is temporary and is still
758 		 * preferred, do not create another one.  It would be rare, but
759 		 * could happen, for example, when we resume a laptop PC after
760 		 * a long period.
761 		 */
762 		if ((it6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
763 		    !IFA6_IS_DEPRECATED(it6)) {
764 			public_ifa6 = NULL;
765 			break;
766 		}
767 
768 		/*
769 		 * This is a public autoconf address that has the same prefix
770 		 * as ours.  If it is preferred, keep it.  We can't break the
771 		 * loop here, because there may be a still-preferred temporary
772 		 * address with the prefix.
773 		 */
774 		if (!IFA6_IS_DEPRECATED(it6))
775 		    public_ifa6 = it6;
776 	}
777 
778 	if (public_ifa6 != NULL) {
779 		int e;
780 
781 		if ((e = in6_tmpifadd(public_ifa6, 0, 0)) != 0) {
782 			IF_ADDR_UNLOCK(ifp);
783 			log(LOG_NOTICE, "regen_tmpaddr: failed to create a new"
784 			    " tmp addr,errno=%d\n", e);
785 			return (-1);
786 		}
787 		IF_ADDR_UNLOCK(ifp);
788 		return (0);
789 	}
790 
791 	IF_ADDR_UNLOCK(ifp);
792 	return (-1);
793 }
794 
795 /*
796  * Nuke neighbor cache/prefix/default router management table, right before
797  * ifp goes away.
798  */
799 void
800 nd6_purge(struct ifnet *ifp)
801 {
802 	INIT_VNET_INET6(ifp->if_vnet);
803 	struct nd_defrouter *dr, *ndr;
804 	struct nd_prefix *pr, *npr;
805 
806 	/*
807 	 * Nuke default router list entries toward ifp.
808 	 * We defer removal of default router list entries that is installed
809 	 * in the routing table, in order to keep additional side effects as
810 	 * small as possible.
811 	 */
812 	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
813 		ndr = TAILQ_NEXT(dr, dr_entry);
814 		if (dr->installed)
815 			continue;
816 
817 		if (dr->ifp == ifp)
818 			defrtrlist_del(dr);
819 	}
820 
821 	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = ndr) {
822 		ndr = TAILQ_NEXT(dr, dr_entry);
823 		if (!dr->installed)
824 			continue;
825 
826 		if (dr->ifp == ifp)
827 			defrtrlist_del(dr);
828 	}
829 
830 	/* Nuke prefix list entries toward ifp */
831 	for (pr = V_nd_prefix.lh_first; pr; pr = npr) {
832 		npr = pr->ndpr_next;
833 		if (pr->ndpr_ifp == ifp) {
834 			/*
835 			 * Because if_detach() does *not* release prefixes
836 			 * while purging addresses the reference count will
837 			 * still be above zero. We therefore reset it to
838 			 * make sure that the prefix really gets purged.
839 			 */
840 			pr->ndpr_refcnt = 0;
841 
842 			/*
843 			 * Previously, pr->ndpr_addr is removed as well,
844 			 * but I strongly believe we don't have to do it.
845 			 * nd6_purge() is only called from in6_ifdetach(),
846 			 * which removes all the associated interface addresses
847 			 * by itself.
848 			 * (jinmei@kame.net 20010129)
849 			 */
850 			prelist_remove(pr);
851 		}
852 	}
853 
854 	/* cancel default outgoing interface setting */
855 	if (V_nd6_defifindex == ifp->if_index)
856 		nd6_setdefaultiface(0);
857 
858 	if (!V_ip6_forwarding && V_ip6_accept_rtadv) { /* XXX: too restrictive? */
859 		/* refresh default router list
860 		 *
861 		 *
862 		 */
863 		defrouter_select();
864 
865 	}
866 
867 	/* XXXXX
868 	 * We do not nuke the neighbor cache entries here any more
869 	 * because the neighbor cache is kept in if_afdata[AF_INET6].
870 	 * nd6_purge() is invoked by in6_ifdetach() which is called
871 	 * from if_detach() where everything gets purged. So let
872 	 * in6_domifdetach() do the actual L2 table purging work.
873 	 */
874 }
875 
876 /*
877  * the caller acquires and releases the lock on the lltbls
878  * Returns the llentry locked
879  */
880 struct llentry *
881 nd6_lookup(struct in6_addr *addr6, int flags, struct ifnet *ifp)
882 {
883 	struct sockaddr_in6 sin6;
884 	struct llentry *ln;
885 	int llflags = 0;
886 
887 	bzero(&sin6, sizeof(sin6));
888 	sin6.sin6_len = sizeof(struct sockaddr_in6);
889 	sin6.sin6_family = AF_INET6;
890 	sin6.sin6_addr = *addr6;
891 
892 	IF_AFDATA_LOCK_ASSERT(ifp);
893 
894 	if (flags & ND6_CREATE)
895 	    llflags |= LLE_CREATE;
896 	if (flags & ND6_EXCLUSIVE)
897 	    llflags |= LLE_EXCLUSIVE;
898 
899 	ln = lla_lookup(LLTABLE6(ifp), llflags, (struct sockaddr *)&sin6);
900 	if ((ln != NULL) && (flags & LLE_CREATE)) {
901 		ln->ln_state = ND6_LLINFO_NOSTATE;
902 		callout_init(&ln->ln_timer_ch, 0);
903 	}
904 
905 	return (ln);
906 }
907 
908 /*
909  * Test whether a given IPv6 address is a neighbor or not, ignoring
910  * the actual neighbor cache.  The neighbor cache is ignored in order
911  * to not reenter the routing code from within itself.
912  */
913 static int
914 nd6_is_new_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
915 {
916 	INIT_VNET_INET6(ifp->if_vnet);
917 	struct nd_prefix *pr;
918 	struct ifaddr *dstaddr;
919 
920 	/*
921 	 * A link-local address is always a neighbor.
922 	 * XXX: a link does not necessarily specify a single interface.
923 	 */
924 	if (IN6_IS_ADDR_LINKLOCAL(&addr->sin6_addr)) {
925 		struct sockaddr_in6 sin6_copy;
926 		u_int32_t zone;
927 
928 		/*
929 		 * We need sin6_copy since sa6_recoverscope() may modify the
930 		 * content (XXX).
931 		 */
932 		sin6_copy = *addr;
933 		if (sa6_recoverscope(&sin6_copy))
934 			return (0); /* XXX: should be impossible */
935 		if (in6_setscope(&sin6_copy.sin6_addr, ifp, &zone))
936 			return (0);
937 		if (sin6_copy.sin6_scope_id == zone)
938 			return (1);
939 		else
940 			return (0);
941 	}
942 
943 	/*
944 	 * If the address matches one of our addresses,
945 	 * it should be a neighbor.
946 	 * If the address matches one of our on-link prefixes, it should be a
947 	 * neighbor.
948 	 */
949 	for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
950 		if (pr->ndpr_ifp != ifp)
951 			continue;
952 
953 		if (!(pr->ndpr_stateflags & NDPRF_ONLINK))
954 			continue;
955 
956 		if (IN6_ARE_MASKED_ADDR_EQUAL(&pr->ndpr_prefix.sin6_addr,
957 		    &addr->sin6_addr, &pr->ndpr_mask))
958 			return (1);
959 	}
960 
961 	/*
962 	 * If the address is assigned on the node of the other side of
963 	 * a p2p interface, the address should be a neighbor.
964 	 */
965 	dstaddr = ifa_ifwithdstaddr((struct sockaddr *)addr);
966 	if ((dstaddr != NULL) && (dstaddr->ifa_ifp == ifp))
967 		return (1);
968 
969 	/*
970 	 * If the default router list is empty, all addresses are regarded
971 	 * as on-link, and thus, as a neighbor.
972 	 * XXX: we restrict the condition to hosts, because routers usually do
973 	 * not have the "default router list".
974 	 */
975 	if (!V_ip6_forwarding && TAILQ_FIRST(&V_nd_defrouter) == NULL &&
976 	    V_nd6_defifindex == ifp->if_index) {
977 		return (1);
978 	}
979 
980 	return (0);
981 }
982 
983 
984 /*
985  * Detect if a given IPv6 address identifies a neighbor on a given link.
986  * XXX: should take care of the destination of a p2p link?
987  */
988 int
989 nd6_is_addr_neighbor(struct sockaddr_in6 *addr, struct ifnet *ifp)
990 {
991 	struct llentry *lle;
992 	int rc = 0;
993 
994 	IF_AFDATA_UNLOCK_ASSERT(ifp);
995 	if (nd6_is_new_addr_neighbor(addr, ifp))
996 		return (1);
997 
998 	/*
999 	 * Even if the address matches none of our addresses, it might be
1000 	 * in the neighbor cache.
1001 	 */
1002 	IF_AFDATA_LOCK(ifp);
1003 	if ((lle = nd6_lookup(&addr->sin6_addr, 0, ifp)) != NULL) {
1004 		LLE_RUNLOCK(lle);
1005 		rc = 1;
1006 	}
1007 	IF_AFDATA_UNLOCK(ifp);
1008 	return (rc);
1009 }
1010 
1011 /*
1012  * Free an nd6 llinfo entry.
1013  * Since the function would cause significant changes in the kernel, DO NOT
1014  * make it global, unless you have a strong reason for the change, and are sure
1015  * that the change is safe.
1016  */
1017 static struct llentry *
1018 nd6_free(struct llentry *ln, int gc)
1019 {
1020 	INIT_VNET_INET6(curvnet);
1021         struct llentry *next;
1022 	struct nd_defrouter *dr;
1023 	struct ifnet *ifp=NULL;
1024 
1025 	/*
1026 	 * we used to have pfctlinput(PRC_HOSTDEAD) here.
1027 	 * even though it is not harmful, it was not really necessary.
1028 	 */
1029 
1030 	/* cancel timer */
1031 	nd6_llinfo_settimer(ln, -1);
1032 
1033 	if (!V_ip6_forwarding) {
1034 		int s;
1035 		s = splnet();
1036 		dr = defrouter_lookup(&L3_ADDR_SIN6(ln)->sin6_addr, ln->lle_tbl->llt_ifp);
1037 
1038 		if (dr != NULL && dr->expire &&
1039 		    ln->ln_state == ND6_LLINFO_STALE && gc) {
1040 			/*
1041 			 * If the reason for the deletion is just garbage
1042 			 * collection, and the neighbor is an active default
1043 			 * router, do not delete it.  Instead, reset the GC
1044 			 * timer using the router's lifetime.
1045 			 * Simply deleting the entry would affect default
1046 			 * router selection, which is not necessarily a good
1047 			 * thing, especially when we're using router preference
1048 			 * values.
1049 			 * XXX: the check for ln_state would be redundant,
1050 			 *      but we intentionally keep it just in case.
1051 			 */
1052 			if (dr->expire > time_second)
1053 				nd6_llinfo_settimer(ln,
1054 				    (dr->expire - time_second) * hz);
1055 			else
1056 				nd6_llinfo_settimer(ln, (long)V_nd6_gctimer * hz);
1057 			splx(s);
1058 			return (LIST_NEXT(ln, lle_next));
1059 		}
1060 
1061 		if (ln->ln_router || dr) {
1062 			/*
1063 			 * rt6_flush must be called whether or not the neighbor
1064 			 * is in the Default Router List.
1065 			 * See a corresponding comment in nd6_na_input().
1066 			 */
1067 			rt6_flush(&L3_ADDR_SIN6(ln)->sin6_addr, ln->lle_tbl->llt_ifp);
1068 		}
1069 
1070 		if (dr) {
1071 			/*
1072 			 * Unreachablity of a router might affect the default
1073 			 * router selection and on-link detection of advertised
1074 			 * prefixes.
1075 			 */
1076 
1077 			/*
1078 			 * Temporarily fake the state to choose a new default
1079 			 * router and to perform on-link determination of
1080 			 * prefixes correctly.
1081 			 * Below the state will be set correctly,
1082 			 * or the entry itself will be deleted.
1083 			 */
1084 			ln->ln_state = ND6_LLINFO_INCOMPLETE;
1085 
1086 			/*
1087 			 * Since defrouter_select() does not affect the
1088 			 * on-link determination and MIP6 needs the check
1089 			 * before the default router selection, we perform
1090 			 * the check now.
1091 			 */
1092 			pfxlist_onlink_check();
1093 
1094 			/*
1095 			 * refresh default router list
1096 			 */
1097 			defrouter_select();
1098 		}
1099 		splx(s);
1100 	}
1101 
1102 	/*
1103 	 * Before deleting the entry, remember the next entry as the
1104 	 * return value.  We need this because pfxlist_onlink_check() above
1105 	 * might have freed other entries (particularly the old next entry) as
1106 	 * a side effect (XXX).
1107 	 */
1108 	next = LIST_NEXT(ln, lle_next);
1109 
1110 	ifp = ln->lle_tbl->llt_ifp;
1111 	IF_AFDATA_LOCK(ifp);
1112 	LLE_WLOCK(ln);
1113 	llentry_free(ln);
1114 	IF_AFDATA_UNLOCK(ifp);
1115 
1116 	return (next);
1117 }
1118 
1119 /*
1120  * Upper-layer reachability hint for Neighbor Unreachability Detection.
1121  *
1122  * XXX cost-effective methods?
1123  */
1124 void
1125 nd6_nud_hint(struct rtentry *rt, struct in6_addr *dst6, int force)
1126 {
1127 	INIT_VNET_INET6(curvnet);
1128 	struct llentry *ln;
1129 	struct ifnet *ifp;
1130 
1131 	if ((dst6 == NULL) || (rt == NULL))
1132 		return;
1133 
1134 	ifp = rt->rt_ifp;
1135 	IF_AFDATA_LOCK(ifp);
1136 	ln = nd6_lookup(dst6, ND6_EXCLUSIVE, NULL);
1137 	IF_AFDATA_UNLOCK(ifp);
1138 	if (ln == NULL)
1139 		return;
1140 
1141 	if (ln->ln_state < ND6_LLINFO_REACHABLE)
1142 		goto done;
1143 
1144 	/*
1145 	 * if we get upper-layer reachability confirmation many times,
1146 	 * it is possible we have false information.
1147 	 */
1148 	if (!force) {
1149 		ln->ln_byhint++;
1150 		if (ln->ln_byhint > V_nd6_maxnudhint) {
1151 			goto done;
1152 		}
1153 	}
1154 
1155  	ln->ln_state = ND6_LLINFO_REACHABLE;
1156 	if (!ND6_LLINFO_PERMANENT(ln)) {
1157 		nd6_llinfo_settimer(ln,
1158 		    (long)ND_IFINFO(rt->rt_ifp)->reachable * hz);
1159 	}
1160 done:
1161 	LLE_WUNLOCK(ln);
1162 }
1163 
1164 
1165 int
1166 nd6_ioctl(u_long cmd, caddr_t data, struct ifnet *ifp)
1167 {
1168 	INIT_VNET_INET6(ifp->if_vnet);
1169 	struct in6_drlist *drl = (struct in6_drlist *)data;
1170 	struct in6_oprlist *oprl = (struct in6_oprlist *)data;
1171 	struct in6_ndireq *ndi = (struct in6_ndireq *)data;
1172 	struct in6_nbrinfo *nbi = (struct in6_nbrinfo *)data;
1173 	struct in6_ndifreq *ndif = (struct in6_ndifreq *)data;
1174 	struct nd_defrouter *dr;
1175 	struct nd_prefix *pr;
1176 	int i = 0, error = 0;
1177 	int s;
1178 
1179 	switch (cmd) {
1180 	case SIOCGDRLST_IN6:
1181 		/*
1182 		 * obsolete API, use sysctl under net.inet6.icmp6
1183 		 */
1184 		bzero(drl, sizeof(*drl));
1185 		s = splnet();
1186 		dr = TAILQ_FIRST(&V_nd_defrouter);
1187 		while (dr && i < DRLSTSIZ) {
1188 			drl->defrouter[i].rtaddr = dr->rtaddr;
1189 			in6_clearscope(&drl->defrouter[i].rtaddr);
1190 
1191 			drl->defrouter[i].flags = dr->flags;
1192 			drl->defrouter[i].rtlifetime = dr->rtlifetime;
1193 			drl->defrouter[i].expire = dr->expire;
1194 			drl->defrouter[i].if_index = dr->ifp->if_index;
1195 			i++;
1196 			dr = TAILQ_NEXT(dr, dr_entry);
1197 		}
1198 		splx(s);
1199 		break;
1200 	case SIOCGPRLST_IN6:
1201 		/*
1202 		 * obsolete API, use sysctl under net.inet6.icmp6
1203 		 *
1204 		 * XXX the structure in6_prlist was changed in backward-
1205 		 * incompatible manner.  in6_oprlist is used for SIOCGPRLST_IN6,
1206 		 * in6_prlist is used for nd6_sysctl() - fill_prlist().
1207 		 */
1208 		/*
1209 		 * XXX meaning of fields, especialy "raflags", is very
1210 		 * differnet between RA prefix list and RR/static prefix list.
1211 		 * how about separating ioctls into two?
1212 		 */
1213 		bzero(oprl, sizeof(*oprl));
1214 		s = splnet();
1215 		pr = V_nd_prefix.lh_first;
1216 		while (pr && i < PRLSTSIZ) {
1217 			struct nd_pfxrouter *pfr;
1218 			int j;
1219 
1220 			oprl->prefix[i].prefix = pr->ndpr_prefix.sin6_addr;
1221 			oprl->prefix[i].raflags = pr->ndpr_raf;
1222 			oprl->prefix[i].prefixlen = pr->ndpr_plen;
1223 			oprl->prefix[i].vltime = pr->ndpr_vltime;
1224 			oprl->prefix[i].pltime = pr->ndpr_pltime;
1225 			oprl->prefix[i].if_index = pr->ndpr_ifp->if_index;
1226 			if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
1227 				oprl->prefix[i].expire = 0;
1228 			else {
1229 				time_t maxexpire;
1230 
1231 				/* XXX: we assume time_t is signed. */
1232 				maxexpire = (-1) &
1233 				    ~((time_t)1 <<
1234 				    ((sizeof(maxexpire) * 8) - 1));
1235 				if (pr->ndpr_vltime <
1236 				    maxexpire - pr->ndpr_lastupdate) {
1237 					oprl->prefix[i].expire =
1238 					    pr->ndpr_lastupdate +
1239 					    pr->ndpr_vltime;
1240 				} else
1241 					oprl->prefix[i].expire = maxexpire;
1242 			}
1243 
1244 			pfr = pr->ndpr_advrtrs.lh_first;
1245 			j = 0;
1246 			while (pfr) {
1247 				if (j < DRLSTSIZ) {
1248 #define RTRADDR oprl->prefix[i].advrtr[j]
1249 					RTRADDR = pfr->router->rtaddr;
1250 					in6_clearscope(&RTRADDR);
1251 #undef RTRADDR
1252 				}
1253 				j++;
1254 				pfr = pfr->pfr_next;
1255 			}
1256 			oprl->prefix[i].advrtrs = j;
1257 			oprl->prefix[i].origin = PR_ORIG_RA;
1258 
1259 			i++;
1260 			pr = pr->ndpr_next;
1261 		}
1262 		splx(s);
1263 
1264 		break;
1265 	case OSIOCGIFINFO_IN6:
1266 #define ND	ndi->ndi
1267 		/* XXX: old ndp(8) assumes a positive value for linkmtu. */
1268 		bzero(&ND, sizeof(ND));
1269 		ND.linkmtu = IN6_LINKMTU(ifp);
1270 		ND.maxmtu = ND_IFINFO(ifp)->maxmtu;
1271 		ND.basereachable = ND_IFINFO(ifp)->basereachable;
1272 		ND.reachable = ND_IFINFO(ifp)->reachable;
1273 		ND.retrans = ND_IFINFO(ifp)->retrans;
1274 		ND.flags = ND_IFINFO(ifp)->flags;
1275 		ND.recalctm = ND_IFINFO(ifp)->recalctm;
1276 		ND.chlim = ND_IFINFO(ifp)->chlim;
1277 		break;
1278 	case SIOCGIFINFO_IN6:
1279 		ND = *ND_IFINFO(ifp);
1280 		break;
1281 	case SIOCSIFINFO_IN6:
1282 		/*
1283 		 * used to change host variables from userland.
1284 		 * intented for a use on router to reflect RA configurations.
1285 		 */
1286 		/* 0 means 'unspecified' */
1287 		if (ND.linkmtu != 0) {
1288 			if (ND.linkmtu < IPV6_MMTU ||
1289 			    ND.linkmtu > IN6_LINKMTU(ifp)) {
1290 				error = EINVAL;
1291 				break;
1292 			}
1293 			ND_IFINFO(ifp)->linkmtu = ND.linkmtu;
1294 		}
1295 
1296 		if (ND.basereachable != 0) {
1297 			int obasereachable = ND_IFINFO(ifp)->basereachable;
1298 
1299 			ND_IFINFO(ifp)->basereachable = ND.basereachable;
1300 			if (ND.basereachable != obasereachable)
1301 				ND_IFINFO(ifp)->reachable =
1302 				    ND_COMPUTE_RTIME(ND.basereachable);
1303 		}
1304 		if (ND.retrans != 0)
1305 			ND_IFINFO(ifp)->retrans = ND.retrans;
1306 		if (ND.chlim != 0)
1307 			ND_IFINFO(ifp)->chlim = ND.chlim;
1308 		/* FALLTHROUGH */
1309 	case SIOCSIFINFO_FLAGS:
1310 		ND_IFINFO(ifp)->flags = ND.flags;
1311 		break;
1312 #undef ND
1313 	case SIOCSNDFLUSH_IN6:	/* XXX: the ioctl name is confusing... */
1314 		/* sync kernel routing table with the default router list */
1315 		defrouter_reset();
1316 		defrouter_select();
1317 		break;
1318 	case SIOCSPFXFLUSH_IN6:
1319 	{
1320 		/* flush all the prefix advertised by routers */
1321 		struct nd_prefix *pr, *next;
1322 
1323 		s = splnet();
1324 		for (pr = V_nd_prefix.lh_first; pr; pr = next) {
1325 			struct in6_ifaddr *ia, *ia_next;
1326 
1327 			next = pr->ndpr_next;
1328 
1329 			if (IN6_IS_ADDR_LINKLOCAL(&pr->ndpr_prefix.sin6_addr))
1330 				continue; /* XXX */
1331 
1332 			/* do we really have to remove addresses as well? */
1333 			for (ia = V_in6_ifaddr; ia; ia = ia_next) {
1334 				/* ia might be removed.  keep the next ptr. */
1335 				ia_next = ia->ia_next;
1336 
1337 				if ((ia->ia6_flags & IN6_IFF_AUTOCONF) == 0)
1338 					continue;
1339 
1340 				if (ia->ia6_ndpr == pr)
1341 					in6_purgeaddr(&ia->ia_ifa);
1342 			}
1343 			prelist_remove(pr);
1344 		}
1345 		splx(s);
1346 		break;
1347 	}
1348 	case SIOCSRTRFLUSH_IN6:
1349 	{
1350 		/* flush all the default routers */
1351 		struct nd_defrouter *dr, *next;
1352 
1353 		s = splnet();
1354 		defrouter_reset();
1355 		for (dr = TAILQ_FIRST(&V_nd_defrouter); dr; dr = next) {
1356 			next = TAILQ_NEXT(dr, dr_entry);
1357 			defrtrlist_del(dr);
1358 		}
1359 		defrouter_select();
1360 		splx(s);
1361 		break;
1362 	}
1363 	case SIOCGNBRINFO_IN6:
1364 	{
1365 		struct llentry *ln;
1366 		struct in6_addr nb_addr = nbi->addr; /* make local for safety */
1367 
1368 		if ((error = in6_setscope(&nb_addr, ifp, NULL)) != 0)
1369 			return (error);
1370 
1371 		IF_AFDATA_LOCK(ifp);
1372 		ln = nd6_lookup(&nb_addr, 0, ifp);
1373 		IF_AFDATA_UNLOCK(ifp);
1374 
1375 		if (ln == NULL) {
1376 			error = EINVAL;
1377 			break;
1378 		}
1379 		nbi->state = ln->ln_state;
1380 		nbi->asked = ln->la_asked;
1381 		nbi->isrouter = ln->ln_router;
1382 		nbi->expire = ln->la_expire;
1383 		LLE_RUNLOCK(ln);
1384 		break;
1385 	}
1386 	case SIOCGDEFIFACE_IN6:	/* XXX: should be implemented as a sysctl? */
1387 		ndif->ifindex = V_nd6_defifindex;
1388 		break;
1389 	case SIOCSDEFIFACE_IN6:	/* XXX: should be implemented as a sysctl? */
1390 		return (nd6_setdefaultiface(ndif->ifindex));
1391 	}
1392 	return (error);
1393 }
1394 
1395 /*
1396  * Create neighbor cache entry and cache link-layer address,
1397  * on reception of inbound ND6 packets.  (RS/RA/NS/redirect)
1398  *
1399  * type - ICMP6 type
1400  * code - type dependent information
1401  *
1402  * XXXXX
1403  *  The caller of this function already acquired the ndp
1404  *  cache table lock because the cache entry is returned.
1405  */
1406 struct llentry *
1407 nd6_cache_lladdr(struct ifnet *ifp, struct in6_addr *from, char *lladdr,
1408     int lladdrlen, int type, int code)
1409 {
1410 	INIT_VNET_INET6(curvnet);
1411 	struct llentry *ln = NULL;
1412 	int is_newentry;
1413 	int do_update;
1414 	int olladdr;
1415 	int llchange;
1416 	int flags = 0;
1417 	int newstate = 0;
1418 	uint16_t router = 0;
1419 	struct sockaddr_in6 sin6;
1420 	struct mbuf *chain = NULL;
1421 	int static_route = 0;
1422 
1423 	IF_AFDATA_UNLOCK_ASSERT(ifp);
1424 
1425 	if (ifp == NULL)
1426 		panic("ifp == NULL in nd6_cache_lladdr");
1427 	if (from == NULL)
1428 		panic("from == NULL in nd6_cache_lladdr");
1429 
1430 	/* nothing must be updated for unspecified address */
1431 	if (IN6_IS_ADDR_UNSPECIFIED(from))
1432 		return NULL;
1433 
1434 	/*
1435 	 * Validation about ifp->if_addrlen and lladdrlen must be done in
1436 	 * the caller.
1437 	 *
1438 	 * XXX If the link does not have link-layer adderss, what should
1439 	 * we do? (ifp->if_addrlen == 0)
1440 	 * Spec says nothing in sections for RA, RS and NA.  There's small
1441 	 * description on it in NS section (RFC 2461 7.2.3).
1442 	 */
1443 	flags |= lladdr ? ND6_EXCLUSIVE : 0;
1444 	IF_AFDATA_LOCK(ifp);
1445 	ln = nd6_lookup(from, flags, ifp);
1446 
1447 	if (ln == NULL) {
1448 		flags |= LLE_EXCLUSIVE;
1449 		ln = nd6_lookup(from, flags |ND6_CREATE, ifp);
1450 		IF_AFDATA_UNLOCK(ifp);
1451 		is_newentry = 1;
1452 	} else {
1453 		IF_AFDATA_UNLOCK(ifp);
1454 		/* do nothing if static ndp is set */
1455 		if (ln->la_flags & LLE_STATIC) {
1456 			static_route = 1;
1457 			goto done;
1458 		}
1459 		is_newentry = 0;
1460 	}
1461 	if (ln == NULL)
1462 		return (NULL);
1463 
1464 	olladdr = (ln->la_flags & LLE_VALID) ? 1 : 0;
1465 	if (olladdr && lladdr) {
1466 		llchange = bcmp(lladdr, &ln->ll_addr,
1467 		    ifp->if_addrlen);
1468 	} else
1469 		llchange = 0;
1470 
1471 	/*
1472 	 * newentry olladdr  lladdr  llchange	(*=record)
1473 	 *	0	n	n	--	(1)
1474 	 *	0	y	n	--	(2)
1475 	 *	0	n	y	--	(3) * STALE
1476 	 *	0	y	y	n	(4) *
1477 	 *	0	y	y	y	(5) * STALE
1478 	 *	1	--	n	--	(6)   NOSTATE(= PASSIVE)
1479 	 *	1	--	y	--	(7) * STALE
1480 	 */
1481 
1482 	if (lladdr) {		/* (3-5) and (7) */
1483 		/*
1484 		 * Record source link-layer address
1485 		 * XXX is it dependent to ifp->if_type?
1486 		 */
1487 		bcopy(lladdr, &ln->ll_addr, ifp->if_addrlen);
1488 		ln->la_flags |= LLE_VALID;
1489 	}
1490 
1491 	if (!is_newentry) {
1492 		if ((!olladdr && lladdr != NULL) ||	/* (3) */
1493 		    (olladdr && lladdr != NULL && llchange)) {	/* (5) */
1494 			do_update = 1;
1495 			newstate = ND6_LLINFO_STALE;
1496 		} else					/* (1-2,4) */
1497 			do_update = 0;
1498 	} else {
1499 		do_update = 1;
1500 		if (lladdr == NULL)			/* (6) */
1501 			newstate = ND6_LLINFO_NOSTATE;
1502 		else					/* (7) */
1503 			newstate = ND6_LLINFO_STALE;
1504 	}
1505 
1506 	if (do_update) {
1507 		/*
1508 		 * Update the state of the neighbor cache.
1509 		 */
1510 		ln->ln_state = newstate;
1511 
1512 		if (ln->ln_state == ND6_LLINFO_STALE) {
1513 			/*
1514 			 * XXX: since nd6_output() below will cause
1515 			 * state tansition to DELAY and reset the timer,
1516 			 * we must set the timer now, although it is actually
1517 			 * meaningless.
1518 			 */
1519 			nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
1520 
1521 			if (ln->la_hold) {
1522 				struct mbuf *m_hold, *m_hold_next;
1523 
1524 				/*
1525 				 * reset the la_hold in advance, to explicitly
1526 				 * prevent a la_hold lookup in nd6_output()
1527 				 * (wouldn't happen, though...)
1528 				 */
1529 				for (m_hold = ln->la_hold, ln->la_hold = NULL;
1530 				    m_hold; m_hold = m_hold_next) {
1531 					m_hold_next = m_hold->m_nextpkt;
1532 					m_hold->m_nextpkt = NULL;
1533 
1534 					/*
1535 					 * we assume ifp is not a p2p here, so
1536 					 * just set the 2nd argument as the
1537 					 * 1st one.
1538 					 */
1539 					nd6_output_lle(ifp, ifp, m_hold, L3_ADDR_SIN6(ln), NULL, ln, &chain);
1540 				}
1541 				/*
1542 				 * If we have mbufs in the chain we need to do
1543 				 * deferred transmit. Copy the address from the
1544 				 * llentry before dropping the lock down below.
1545 				 */
1546 				if (chain != NULL)
1547 					memcpy(&sin6, L3_ADDR_SIN6(ln), sizeof(sin6));
1548 			}
1549 		} else if (ln->ln_state == ND6_LLINFO_INCOMPLETE) {
1550 			/* probe right away */
1551 			nd6_llinfo_settimer_locked((void *)ln, 0);
1552 		}
1553 	}
1554 
1555 	/*
1556 	 * ICMP6 type dependent behavior.
1557 	 *
1558 	 * NS: clear IsRouter if new entry
1559 	 * RS: clear IsRouter
1560 	 * RA: set IsRouter if there's lladdr
1561 	 * redir: clear IsRouter if new entry
1562 	 *
1563 	 * RA case, (1):
1564 	 * The spec says that we must set IsRouter in the following cases:
1565 	 * - If lladdr exist, set IsRouter.  This means (1-5).
1566 	 * - If it is old entry (!newentry), set IsRouter.  This means (7).
1567 	 * So, based on the spec, in (1-5) and (7) cases we must set IsRouter.
1568 	 * A quetion arises for (1) case.  (1) case has no lladdr in the
1569 	 * neighbor cache, this is similar to (6).
1570 	 * This case is rare but we figured that we MUST NOT set IsRouter.
1571 	 *
1572 	 * newentry olladdr  lladdr  llchange	    NS  RS  RA	redir
1573 	 *							D R
1574 	 *	0	n	n	--	(1)	c   ?     s
1575 	 *	0	y	n	--	(2)	c   s     s
1576 	 *	0	n	y	--	(3)	c   s     s
1577 	 *	0	y	y	n	(4)	c   s     s
1578 	 *	0	y	y	y	(5)	c   s     s
1579 	 *	1	--	n	--	(6) c	c	c s
1580 	 *	1	--	y	--	(7) c	c   s	c s
1581 	 *
1582 	 *					(c=clear s=set)
1583 	 */
1584 	switch (type & 0xff) {
1585 	case ND_NEIGHBOR_SOLICIT:
1586 		/*
1587 		 * New entry must have is_router flag cleared.
1588 		 */
1589 		if (is_newentry)	/* (6-7) */
1590 			ln->ln_router = 0;
1591 		break;
1592 	case ND_REDIRECT:
1593 		/*
1594 		 * If the icmp is a redirect to a better router, always set the
1595 		 * is_router flag.  Otherwise, if the entry is newly created,
1596 		 * clear the flag.  [RFC 2461, sec 8.3]
1597 		 */
1598 		if (code == ND_REDIRECT_ROUTER)
1599 			ln->ln_router = 1;
1600 		else if (is_newentry) /* (6-7) */
1601 			ln->ln_router = 0;
1602 		break;
1603 	case ND_ROUTER_SOLICIT:
1604 		/*
1605 		 * is_router flag must always be cleared.
1606 		 */
1607 		ln->ln_router = 0;
1608 		break;
1609 	case ND_ROUTER_ADVERT:
1610 		/*
1611 		 * Mark an entry with lladdr as a router.
1612 		 */
1613 		if ((!is_newentry && (olladdr || lladdr)) ||	/* (2-5) */
1614 		    (is_newentry && lladdr)) {			/* (7) */
1615 			ln->ln_router = 1;
1616 		}
1617 		break;
1618 	}
1619 
1620 	if (ln != NULL) {
1621 		static_route = (ln->la_flags & LLE_STATIC);
1622 		router = ln->ln_router;
1623 
1624 		if (flags & ND6_EXCLUSIVE)
1625 			LLE_WUNLOCK(ln);
1626 		else
1627 			LLE_RUNLOCK(ln);
1628 		if (static_route)
1629 			ln = NULL;
1630 	}
1631 	if (chain)
1632 		nd6_output_flush(ifp, ifp, chain, &sin6, NULL);
1633 
1634 	/*
1635 	 * When the link-layer address of a router changes, select the
1636 	 * best router again.  In particular, when the neighbor entry is newly
1637 	 * created, it might affect the selection policy.
1638 	 * Question: can we restrict the first condition to the "is_newentry"
1639 	 * case?
1640 	 * XXX: when we hear an RA from a new router with the link-layer
1641 	 * address option, defrouter_select() is called twice, since
1642 	 * defrtrlist_update called the function as well.  However, I believe
1643 	 * we can compromise the overhead, since it only happens the first
1644 	 * time.
1645 	 * XXX: although defrouter_select() should not have a bad effect
1646 	 * for those are not autoconfigured hosts, we explicitly avoid such
1647 	 * cases for safety.
1648 	 */
1649 	if (do_update && router && !V_ip6_forwarding && V_ip6_accept_rtadv) {
1650 		/*
1651 		 * guaranteed recursion
1652 		 */
1653 		defrouter_select();
1654 	}
1655 
1656 	return (ln);
1657 done:
1658 	if (ln != NULL) {
1659 		if (flags & ND6_EXCLUSIVE)
1660 			LLE_WUNLOCK(ln);
1661 		else
1662 			LLE_RUNLOCK(ln);
1663 		if (static_route)
1664 			ln = NULL;
1665 	}
1666 	return (ln);
1667 }
1668 
1669 static void
1670 nd6_slowtimo(void *arg)
1671 {
1672 	CURVNET_SET((struct vnet *) arg);
1673 	INIT_VNET_NET((struct vnet *) arg);
1674 	INIT_VNET_INET6((struct vnet *) arg);
1675 	struct nd_ifinfo *nd6if;
1676 	struct ifnet *ifp;
1677 
1678 	callout_reset(&V_nd6_slowtimo_ch, ND6_SLOWTIMER_INTERVAL * hz,
1679 	    nd6_slowtimo, curvnet);
1680 	IFNET_RLOCK();
1681 	for (ifp = TAILQ_FIRST(&V_ifnet); ifp;
1682 	    ifp = TAILQ_NEXT(ifp, if_list)) {
1683 		nd6if = ND_IFINFO(ifp);
1684 		if (nd6if->basereachable && /* already initialized */
1685 		    (nd6if->recalctm -= ND6_SLOWTIMER_INTERVAL) <= 0) {
1686 			/*
1687 			 * Since reachable time rarely changes by router
1688 			 * advertisements, we SHOULD insure that a new random
1689 			 * value gets recomputed at least once every few hours.
1690 			 * (RFC 2461, 6.3.4)
1691 			 */
1692 			nd6if->recalctm = V_nd6_recalc_reachtm_interval;
1693 			nd6if->reachable = ND_COMPUTE_RTIME(nd6if->basereachable);
1694 		}
1695 	}
1696 	IFNET_RUNLOCK();
1697 	CURVNET_RESTORE();
1698 }
1699 
1700 int
1701 nd6_output(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
1702     struct sockaddr_in6 *dst, struct rtentry *rt0)
1703 {
1704 
1705 	return (nd6_output_lle(ifp, origifp, m0, dst, rt0, NULL, NULL));
1706 }
1707 
1708 
1709 /*
1710  * Note that I'm not enforcing any global serialization
1711  * lle state or asked changes here as the logic is too
1712  * complicated to avoid having to always acquire an exclusive
1713  * lock
1714  * KMM
1715  *
1716  */
1717 #define senderr(e) { error = (e); goto bad;}
1718 
1719 int
1720 nd6_output_lle(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
1721     struct sockaddr_in6 *dst, struct rtentry *rt0, struct llentry *lle,
1722 	struct mbuf **chain)
1723 {
1724 	INIT_VNET_INET6(curvnet);
1725 	struct mbuf *m = m0;
1726 	struct llentry *ln = lle;
1727 	int error = 0;
1728 	int flags = 0;
1729 
1730 #ifdef INVARIANTS
1731 	if (lle != NULL) {
1732 
1733 		LLE_WLOCK_ASSERT(lle);
1734 
1735 		KASSERT(chain != NULL, (" lle locked but no mbuf chain pointer passed"));
1736 	}
1737 #endif
1738 	if (IN6_IS_ADDR_MULTICAST(&dst->sin6_addr))
1739 		goto sendpkt;
1740 
1741 	if (nd6_need_cache(ifp) == 0)
1742 		goto sendpkt;
1743 
1744 	/*
1745 	 * next hop determination.  This routine is derived from ether_output.
1746 	 */
1747 
1748 	/*
1749 	 * Address resolution or Neighbor Unreachability Detection
1750 	 * for the next hop.
1751 	 * At this point, the destination of the packet must be a unicast
1752 	 * or an anycast address(i.e. not a multicast).
1753 	 */
1754 
1755 	flags = ((m != NULL) || (lle != NULL)) ? LLE_EXCLUSIVE : 0;
1756 	if (ln == NULL) {
1757 	retry:
1758 		IF_AFDATA_LOCK(ifp);
1759 		ln = lla_lookup(LLTABLE6(ifp), flags, (struct sockaddr *)dst);
1760 		IF_AFDATA_UNLOCK(ifp);
1761 		if ((ln == NULL) && nd6_is_addr_neighbor(dst, ifp))  {
1762 			/*
1763 			 * Since nd6_is_addr_neighbor() internally calls nd6_lookup(),
1764 			 * the condition below is not very efficient.  But we believe
1765 			 * it is tolerable, because this should be a rare case.
1766 			 */
1767 			flags = ND6_CREATE | (m ? ND6_EXCLUSIVE : 0);
1768 			IF_AFDATA_LOCK(ifp);
1769 			ln = nd6_lookup(&dst->sin6_addr, flags, ifp);
1770 			IF_AFDATA_UNLOCK(ifp);
1771 		}
1772 	}
1773 	if (ln == NULL) {
1774 		if ((ifp->if_flags & IFF_POINTOPOINT) == 0 &&
1775 		    !(ND_IFINFO(ifp)->flags & ND6_IFF_PERFORMNUD)) {
1776 			char ip6buf[INET6_ADDRSTRLEN];
1777 			log(LOG_DEBUG,
1778 			    "nd6_output: can't allocate llinfo for %s "
1779 			    "(ln=%p)\n",
1780 			    ip6_sprintf(ip6buf, &dst->sin6_addr), ln);
1781 			senderr(EIO);	/* XXX: good error? */
1782 		}
1783 		goto sendpkt;	/* send anyway */
1784 	}
1785 
1786 	/* We don't have to do link-layer address resolution on a p2p link. */
1787 	if ((ifp->if_flags & IFF_POINTOPOINT) != 0 &&
1788 	    ln->ln_state < ND6_LLINFO_REACHABLE) {
1789 		if ((flags & LLE_EXCLUSIVE) == 0) {
1790 			flags |= LLE_EXCLUSIVE;
1791 			goto retry;
1792 		}
1793 		ln->ln_state = ND6_LLINFO_STALE;
1794 		nd6_llinfo_settimer_locked(ln, (long)V_nd6_gctimer * hz);
1795 	}
1796 
1797 	/*
1798 	 * The first time we send a packet to a neighbor whose entry is
1799 	 * STALE, we have to change the state to DELAY and a sets a timer to
1800 	 * expire in DELAY_FIRST_PROBE_TIME seconds to ensure do
1801 	 * neighbor unreachability detection on expiration.
1802 	 * (RFC 2461 7.3.3)
1803 	 */
1804 	if (ln->ln_state == ND6_LLINFO_STALE) {
1805 		if ((flags & LLE_EXCLUSIVE) == 0) {
1806 			flags |= LLE_EXCLUSIVE;
1807 			LLE_RUNLOCK(ln);
1808 			goto retry;
1809 		}
1810 		ln->la_asked = 0;
1811 		ln->ln_state = ND6_LLINFO_DELAY;
1812 		nd6_llinfo_settimer_locked(ln, (long)V_nd6_delay * hz);
1813 	}
1814 
1815 	/*
1816 	 * If the neighbor cache entry has a state other than INCOMPLETE
1817 	 * (i.e. its link-layer address is already resolved), just
1818 	 * send the packet.
1819 	 */
1820 	if (ln->ln_state > ND6_LLINFO_INCOMPLETE)
1821 		goto sendpkt;
1822 
1823 	/*
1824 	 * There is a neighbor cache entry, but no ethernet address
1825 	 * response yet.  Append this latest packet to the end of the
1826 	 * packet queue in the mbuf, unless the number of the packet
1827 	 * does not exceed nd6_maxqueuelen.  When it exceeds nd6_maxqueuelen,
1828 	 * the oldest packet in the queue will be removed.
1829 	 */
1830 	if (ln->ln_state == ND6_LLINFO_NOSTATE)
1831 		ln->ln_state = ND6_LLINFO_INCOMPLETE;
1832 
1833 	if ((flags & LLE_EXCLUSIVE) == 0) {
1834 		flags |= LLE_EXCLUSIVE;
1835 		LLE_RUNLOCK(ln);
1836 		goto retry;
1837 	}
1838 	if (ln->la_hold) {
1839 		struct mbuf *m_hold;
1840 		int i;
1841 
1842 		i = 0;
1843 		for (m_hold = ln->la_hold; m_hold; m_hold = m_hold->m_nextpkt) {
1844 			i++;
1845 			if (m_hold->m_nextpkt == NULL) {
1846 				m_hold->m_nextpkt = m;
1847 				break;
1848 			}
1849 		}
1850 		while (i >= V_nd6_maxqueuelen) {
1851 			m_hold = ln->la_hold;
1852 			ln->la_hold = ln->la_hold->m_nextpkt;
1853 			m_freem(m_hold);
1854 			i--;
1855 		}
1856 	} else {
1857 		ln->la_hold = m;
1858 	}
1859 	/*
1860 	 * We did the lookup (no lle arg) so we
1861 	 * need to do the unlock here
1862 	 */
1863 	if (lle == NULL) {
1864 		if (flags & LLE_EXCLUSIVE)
1865 			LLE_WUNLOCK(ln);
1866 		else
1867 			LLE_RUNLOCK(ln);
1868 	}
1869 
1870 	/*
1871 	 * If there has been no NS for the neighbor after entering the
1872 	 * INCOMPLETE state, send the first solicitation.
1873 	 */
1874 	if (!ND6_LLINFO_PERMANENT(ln) && ln->la_asked == 0) {
1875 		ln->la_asked++;
1876 
1877 		nd6_llinfo_settimer(ln,
1878 		    (long)ND_IFINFO(ifp)->retrans * hz / 1000);
1879 		nd6_ns_output(ifp, NULL, &dst->sin6_addr, ln, 0);
1880 	}
1881 	return (0);
1882 
1883   sendpkt:
1884 	/* discard the packet if IPv6 operation is disabled on the interface */
1885 	if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) {
1886 		error = ENETDOWN; /* better error? */
1887 		goto bad;
1888 	}
1889 	/*
1890 	 * ln is valid and the caller did not pass in
1891 	 * an llentry
1892 	 */
1893 	if ((ln != NULL) && (lle == NULL)) {
1894 		if (flags & LLE_EXCLUSIVE)
1895 			LLE_WUNLOCK(ln);
1896 		else
1897 			LLE_RUNLOCK(ln);
1898 	}
1899 
1900 #ifdef MAC
1901 	mac_netinet6_nd6_send(ifp, m);
1902 #endif
1903 	/*
1904 	 * We were passed in a pointer to an lle with the lock held
1905 	 * this means that we can't call if_output as we will
1906 	 * recurse on the lle lock - so what we do is we create
1907 	 * a list of mbufs to send and transmit them in the caller
1908 	 * after the lock is dropped
1909 	 */
1910 	if (lle != NULL) {
1911 		if (*chain == NULL)
1912 			*chain = m;
1913 		else {
1914 			struct mbuf *m = *chain;
1915 
1916 			/*
1917 			 * append mbuf to end of deferred chain
1918 			 */
1919 			while (m->m_nextpkt != NULL)
1920 				m = m->m_nextpkt;
1921 			m->m_nextpkt = m;
1922 		}
1923 		return (error);
1924 	}
1925 	if ((ifp->if_flags & IFF_LOOPBACK) != 0) {
1926 		return ((*ifp->if_output)(origifp, m, (struct sockaddr *)dst,
1927 		    NULL));
1928 	}
1929 	error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, NULL);
1930 	return (error);
1931 
1932   bad:
1933 	/*
1934 	 * ln is valid and the caller did not pass in
1935 	 * an llentry
1936 	 */
1937 	if ((ln != NULL) && (lle == NULL)) {
1938 		if (flags & LLE_EXCLUSIVE)
1939 			LLE_WUNLOCK(ln);
1940 		else
1941 			LLE_RUNLOCK(ln);
1942 	}
1943 	if (m)
1944 		m_freem(m);
1945 	return (error);
1946 }
1947 #undef senderr
1948 
1949 
1950 int
1951 nd6_output_flush(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *chain,
1952     struct sockaddr_in6 *dst, struct route *ro)
1953 {
1954 	struct mbuf *m, *m_head;
1955 	struct ifnet *outifp;
1956 	int error = 0;
1957 
1958 	m_head = chain;
1959 	if ((ifp->if_flags & IFF_LOOPBACK) != 0)
1960 		outifp = origifp;
1961 	else
1962 		outifp = ifp;
1963 
1964 	while (m_head) {
1965 		m = m_head;
1966 		m_head = m_head->m_nextpkt;
1967 		error = (*ifp->if_output)(ifp, m, (struct sockaddr *)dst, ro);
1968 	}
1969 
1970 	/*
1971 	 * XXX
1972 	 * note that intermediate errors are blindly ignored - but this is
1973 	 * the same convention as used with nd6_output when called by
1974 	 * nd6_cache_lladdr
1975 	 */
1976 	return (error);
1977 }
1978 
1979 
1980 int
1981 nd6_need_cache(struct ifnet *ifp)
1982 {
1983 	/*
1984 	 * XXX: we currently do not make neighbor cache on any interface
1985 	 * other than ARCnet, Ethernet, FDDI and GIF.
1986 	 *
1987 	 * RFC2893 says:
1988 	 * - unidirectional tunnels needs no ND
1989 	 */
1990 	switch (ifp->if_type) {
1991 	case IFT_ARCNET:
1992 	case IFT_ETHER:
1993 	case IFT_FDDI:
1994 	case IFT_IEEE1394:
1995 #ifdef IFT_L2VLAN
1996 	case IFT_L2VLAN:
1997 #endif
1998 #ifdef IFT_IEEE80211
1999 	case IFT_IEEE80211:
2000 #endif
2001 #ifdef IFT_CARP
2002 	case IFT_CARP:
2003 #endif
2004 	case IFT_GIF:		/* XXX need more cases? */
2005 	case IFT_PPP:
2006 	case IFT_TUNNEL:
2007 	case IFT_BRIDGE:
2008 	case IFT_PROPVIRTUAL:
2009 		return (1);
2010 	default:
2011 		return (0);
2012 	}
2013 }
2014 
2015 /*
2016  * the callers of this function need to be re-worked to drop
2017  * the lle lock, drop here for now
2018  */
2019 int
2020 nd6_storelladdr(struct ifnet *ifp, struct mbuf *m,
2021     struct sockaddr *dst, u_char *desten, struct llentry **lle)
2022 {
2023 	struct llentry *ln;
2024 
2025 	*lle = NULL;
2026 	IF_AFDATA_UNLOCK_ASSERT(ifp);
2027 	if (m->m_flags & M_MCAST) {
2028 		int i;
2029 
2030 		switch (ifp->if_type) {
2031 		case IFT_ETHER:
2032 		case IFT_FDDI:
2033 #ifdef IFT_L2VLAN
2034 		case IFT_L2VLAN:
2035 #endif
2036 #ifdef IFT_IEEE80211
2037 		case IFT_IEEE80211:
2038 #endif
2039 		case IFT_BRIDGE:
2040 		case IFT_ISO88025:
2041 			ETHER_MAP_IPV6_MULTICAST(&SIN6(dst)->sin6_addr,
2042 						 desten);
2043 			return (0);
2044 		case IFT_IEEE1394:
2045 			/*
2046 			 * netbsd can use if_broadcastaddr, but we don't do so
2047 			 * to reduce # of ifdef.
2048 			 */
2049 			for (i = 0; i < ifp->if_addrlen; i++)
2050 				desten[i] = ~0;
2051 			return (0);
2052 		case IFT_ARCNET:
2053 			*desten = 0;
2054 			return (0);
2055 		default:
2056 			m_freem(m);
2057 			return (EAFNOSUPPORT);
2058 		}
2059 	}
2060 
2061 
2062 	/*
2063 	 * the entry should have been created in nd6_store_lladdr
2064 	 */
2065 	IF_AFDATA_LOCK(ifp);
2066 	ln = lla_lookup(LLTABLE6(ifp), 0, dst);
2067 	IF_AFDATA_UNLOCK(ifp);
2068 	if ((ln == NULL) || !(ln->la_flags & LLE_VALID)) {
2069 		if (ln != NULL)
2070 			LLE_RUNLOCK(ln);
2071 		/* this could happen, if we could not allocate memory */
2072 		m_freem(m);
2073 		return (1);
2074 	}
2075 
2076 	bcopy(&ln->ll_addr, desten, ifp->if_addrlen);
2077 	*lle = ln;
2078 	LLE_RUNLOCK(ln);
2079 	/*
2080 	 * A *small* use after free race exists here
2081 	 */
2082 	return (0);
2083 }
2084 
2085 static void
2086 clear_llinfo_pqueue(struct llentry *ln)
2087 {
2088 	struct mbuf *m_hold, *m_hold_next;
2089 
2090 	for (m_hold = ln->la_hold; m_hold; m_hold = m_hold_next) {
2091 		m_hold_next = m_hold->m_nextpkt;
2092 		m_hold->m_nextpkt = NULL;
2093 		m_freem(m_hold);
2094 	}
2095 
2096 	ln->la_hold = NULL;
2097 	return;
2098 }
2099 
2100 static int nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS);
2101 static int nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS);
2102 #ifdef SYSCTL_DECL
2103 SYSCTL_DECL(_net_inet6_icmp6);
2104 #endif
2105 SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_DRLIST, nd6_drlist,
2106 	CTLFLAG_RD, nd6_sysctl_drlist, "");
2107 SYSCTL_NODE(_net_inet6_icmp6, ICMPV6CTL_ND6_PRLIST, nd6_prlist,
2108 	CTLFLAG_RD, nd6_sysctl_prlist, "");
2109 SYSCTL_V_INT(V_NET, vnet_inet6, _net_inet6_icmp6, ICMPV6CTL_ND6_MAXQLEN,
2110 	nd6_maxqueuelen, CTLFLAG_RW, nd6_maxqueuelen, 1, "");
2111 
2112 static int
2113 nd6_sysctl_drlist(SYSCTL_HANDLER_ARGS)
2114 {
2115 	INIT_VNET_INET6(curvnet);
2116 	int error;
2117 	char buf[1024] __aligned(4);
2118 	struct in6_defrouter *d, *de;
2119 	struct nd_defrouter *dr;
2120 
2121 	if (req->newptr)
2122 		return EPERM;
2123 	error = 0;
2124 
2125 	for (dr = TAILQ_FIRST(&V_nd_defrouter); dr;
2126 	     dr = TAILQ_NEXT(dr, dr_entry)) {
2127 		d = (struct in6_defrouter *)buf;
2128 		de = (struct in6_defrouter *)(buf + sizeof(buf));
2129 
2130 		if (d + 1 <= de) {
2131 			bzero(d, sizeof(*d));
2132 			d->rtaddr.sin6_family = AF_INET6;
2133 			d->rtaddr.sin6_len = sizeof(d->rtaddr);
2134 			d->rtaddr.sin6_addr = dr->rtaddr;
2135 			error = sa6_recoverscope(&d->rtaddr);
2136 			if (error != 0)
2137 				return (error);
2138 			d->flags = dr->flags;
2139 			d->rtlifetime = dr->rtlifetime;
2140 			d->expire = dr->expire;
2141 			d->if_index = dr->ifp->if_index;
2142 		} else
2143 			panic("buffer too short");
2144 
2145 		error = SYSCTL_OUT(req, buf, sizeof(*d));
2146 		if (error)
2147 			break;
2148 	}
2149 
2150 	return (error);
2151 }
2152 
2153 static int
2154 nd6_sysctl_prlist(SYSCTL_HANDLER_ARGS)
2155 {
2156 	INIT_VNET_INET6(curvnet);
2157 	int error;
2158 	char buf[1024] __aligned(4);
2159 	struct in6_prefix *p, *pe;
2160 	struct nd_prefix *pr;
2161 	char ip6buf[INET6_ADDRSTRLEN];
2162 
2163 	if (req->newptr)
2164 		return EPERM;
2165 	error = 0;
2166 
2167 	for (pr = V_nd_prefix.lh_first; pr; pr = pr->ndpr_next) {
2168 		u_short advrtrs;
2169 		size_t advance;
2170 		struct sockaddr_in6 *sin6, *s6;
2171 		struct nd_pfxrouter *pfr;
2172 
2173 		p = (struct in6_prefix *)buf;
2174 		pe = (struct in6_prefix *)(buf + sizeof(buf));
2175 
2176 		if (p + 1 <= pe) {
2177 			bzero(p, sizeof(*p));
2178 			sin6 = (struct sockaddr_in6 *)(p + 1);
2179 
2180 			p->prefix = pr->ndpr_prefix;
2181 			if (sa6_recoverscope(&p->prefix)) {
2182 				log(LOG_ERR,
2183 				    "scope error in prefix list (%s)\n",
2184 				    ip6_sprintf(ip6buf, &p->prefix.sin6_addr));
2185 				/* XXX: press on... */
2186 			}
2187 			p->raflags = pr->ndpr_raf;
2188 			p->prefixlen = pr->ndpr_plen;
2189 			p->vltime = pr->ndpr_vltime;
2190 			p->pltime = pr->ndpr_pltime;
2191 			p->if_index = pr->ndpr_ifp->if_index;
2192 			if (pr->ndpr_vltime == ND6_INFINITE_LIFETIME)
2193 				p->expire = 0;
2194 			else {
2195 				time_t maxexpire;
2196 
2197 				/* XXX: we assume time_t is signed. */
2198 				maxexpire = (-1) &
2199 				    ~((time_t)1 <<
2200 				    ((sizeof(maxexpire) * 8) - 1));
2201 				if (pr->ndpr_vltime <
2202 				    maxexpire - pr->ndpr_lastupdate) {
2203 				    p->expire = pr->ndpr_lastupdate +
2204 				        pr->ndpr_vltime;
2205 				} else
2206 					p->expire = maxexpire;
2207 			}
2208 			p->refcnt = pr->ndpr_refcnt;
2209 			p->flags = pr->ndpr_stateflags;
2210 			p->origin = PR_ORIG_RA;
2211 			advrtrs = 0;
2212 			for (pfr = pr->ndpr_advrtrs.lh_first; pfr;
2213 			     pfr = pfr->pfr_next) {
2214 				if ((void *)&sin6[advrtrs + 1] > (void *)pe) {
2215 					advrtrs++;
2216 					continue;
2217 				}
2218 				s6 = &sin6[advrtrs];
2219 				bzero(s6, sizeof(*s6));
2220 				s6->sin6_family = AF_INET6;
2221 				s6->sin6_len = sizeof(*sin6);
2222 				s6->sin6_addr = pfr->router->rtaddr;
2223 				if (sa6_recoverscope(s6)) {
2224 					log(LOG_ERR,
2225 					    "scope error in "
2226 					    "prefix list (%s)\n",
2227 					    ip6_sprintf(ip6buf,
2228 						    &pfr->router->rtaddr));
2229 				}
2230 				advrtrs++;
2231 			}
2232 			p->advrtrs = advrtrs;
2233 		} else
2234 			panic("buffer too short");
2235 
2236 		advance = sizeof(*p) + sizeof(*sin6) * advrtrs;
2237 		error = SYSCTL_OUT(req, buf, advance);
2238 		if (error)
2239 			break;
2240 	}
2241 
2242 	return (error);
2243 }
2244