contrib/dhcpcd/src/dhcp6.c

   1 /* SPDX-License-Identifier: BSD-2-Clause */
   2 /*
   3  * dhcpcd - DHCP client daemon
   4  * Copyright (c) 2006-2020 Roy Marples <roy@marples.name>
   5  * All rights reserved
   6
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  26  * SUCH DAMAGE.
  27  */
  28
  29 #include <sys/utsname.h>
  30 #include <sys/types.h>
  31
  32 #include <netinet/in.h>
  33 #include <netinet/ip6.h>
  34
  35 #include <assert.h>
  36 #include <ctype.h>
  37 #include <errno.h>
  38 #include <fcntl.h>
  39 #include <inttypes.h>
  40 #include <stdbool.h>
  41 #include <stddef.h>
  42 #include <stdlib.h>
  43 #include <string.h>
  44 #include <unistd.h>
  45 #include <fcntl.h>
  46 #include <syslog.h>
  47
  48 #define ELOOP_QUEUE     ELOOP_DHCP6
  49 #include "config.h"
  50 #include "common.h"
  51 #include "dhcp.h"
  52 #include "dhcp6.h"
  53 #include "duid.h"
  54 #include "eloop.h"
  55 #include "if.h"
  56 #include "if-options.h"
  57 #include "ipv6nd.h"
  58 #include "logerr.h"
  59 #include "privsep.h"
  60 #include "script.h"
  61
  62 #ifdef HAVE_SYS_BITOPS_H
  63 #include <sys/bitops.h>
  64 #else
  65 #include "compat/bitops.h"
  66 #endif
  67
  68 /* DHCPCD Project has been assigned an IANA PEN of 40712 */
  69 #define DHCPCD_IANA_PEN 40712
  70
  71 /* Unsure if I want this */
  72 //#define VENDOR_SPLIT
  73
  74 /* Support older systems with different defines */
  75 #if !defined(IPV6_RECVPKTINFO) && defined(IPV6_PKTINFO)
  76 #define IPV6_RECVPKTINFO IPV6_PKTINFO
  77 #endif
  78
  79 #ifdef DHCP6
  80
  81 /* Assert the correct structure size for on wire */
  82 struct dhcp6_message {
  83         uint8_t type;
  84         uint8_t xid[3];
  85         /* followed by options */
  86 };
  87 __CTASSERT(sizeof(struct dhcp6_message) == 4);
  88
  89 struct dhcp6_option {
  90         uint16_t code;
  91         uint16_t len;
  92         /* followed by data */
  93 };
  94 __CTASSERT(sizeof(struct dhcp6_option) == 4);
  95
  96 struct dhcp6_ia_na {
  97         uint8_t iaid[4];
  98         uint32_t t1;
  99         uint32_t t2;
 100 };
 101 __CTASSERT(sizeof(struct dhcp6_ia_na) == 12);
 102
 103 struct dhcp6_ia_ta {
 104         uint8_t iaid[4];
 105 };
 106 __CTASSERT(sizeof(struct dhcp6_ia_ta) == 4);
 107
 108 struct dhcp6_ia_addr {
 109         struct in6_addr addr;
 110         uint32_t pltime;
 111         uint32_t vltime;
 112 };
 113 __CTASSERT(sizeof(struct dhcp6_ia_addr) == 16 + 8);
 114
 115 /* XXX FIXME: This is the only packed structure and it does not align.
 116  * Maybe manually decode it? */
 117 struct dhcp6_pd_addr {
 118         uint32_t pltime;
 119         uint32_t vltime;
 120         uint8_t prefix_len;
 121         struct in6_addr prefix;
 122 } __packed;
 123 __CTASSERT(sizeof(struct dhcp6_pd_addr) == 8 + 1 + 16);
 124
 125 struct dhcp6_op {
 126         uint16_t type;
 127         const char *name;
 128 };
 129
 130 static const struct dhcp6_op dhcp6_ops[] = {
 131         { DHCP6_SOLICIT, "SOLICIT6" },
 132         { DHCP6_ADVERTISE, "ADVERTISE6" },
 133         { DHCP6_REQUEST, "REQUEST6" },
 134         { DHCP6_REPLY, "REPLY6" },
 135         { DHCP6_RENEW, "RENEW6" },
 136         { DHCP6_REBIND, "REBIND6" },
 137         { DHCP6_CONFIRM, "CONFIRM6" },
 138         { DHCP6_INFORMATION_REQ, "INFORM6" },
 139         { DHCP6_RELEASE, "RELEASE6" },
 140         { DHCP6_RECONFIGURE, "RECONFIGURE6" },
 141         { DHCP6_DECLINE, "DECLINE6" },
 142         { 0, NULL }
 143 };
 144
 145 struct dhcp_compat {
 146         uint8_t dhcp_opt;
 147         uint16_t dhcp6_opt;
 148 };
 149
 150 static const struct dhcp_compat dhcp_compats[] = {
 151         { DHO_DNSSERVER,        D6_OPTION_DNS_SERVERS },
 152         { DHO_HOSTNAME,         D6_OPTION_FQDN },
 153         { DHO_DNSDOMAIN,        D6_OPTION_FQDN },
 154         { DHO_NISSERVER,        D6_OPTION_NIS_SERVERS },
 155         { DHO_NTPSERVER,        D6_OPTION_SNTP_SERVERS },
 156         { DHO_RAPIDCOMMIT,      D6_OPTION_RAPID_COMMIT },
 157         { DHO_FQDN,             D6_OPTION_FQDN },
 158         { DHO_VIVCO,            D6_OPTION_VENDOR_CLASS },
 159         { DHO_VIVSO,            D6_OPTION_VENDOR_OPTS },
 160         { DHO_DNSSEARCH,        D6_OPTION_DOMAIN_LIST },
 161         { 0, 0 }
 162 };
 163
 164 static const char * const dhcp6_statuses[] = {
 165         "Success",
 166         "Unspecified Failure",
 167         "No Addresses Available",
 168         "No Binding",
 169         "Not On Link",
 170         "Use Multicast",
 171         "No Prefix Available"
 172 };
 173
 174 static void dhcp6_bind(struct interface *, const char *, const char *);
 175 static void dhcp6_failinform(void *);
 176 static void dhcp6_recvaddr(void *);
 177 static void dhcp6_startdecline(struct interface *);
 178
 179 #ifdef SMALL
 180 #define dhcp6_hasprefixdelegation(a)    (0)
 181 #else
 182 static int dhcp6_hasprefixdelegation(struct interface *);
 183 #endif
 184
 185 #define DECLINE_IA(ia) \
 186         ((ia)->addr_flags & IN6_IFF_DUPLICATED && \
 187         (ia)->ia_type != 0 && (ia)->ia_type != D6_OPTION_IA_PD && \
 188         !((ia)->flags & IPV6_AF_STALE) && \
 189         (ia)->prefix_vltime != 0)
 190
 191 void
 192 dhcp6_printoptions(const struct dhcpcd_ctx *ctx,
 193     const struct dhcp_opt *opts, size_t opts_len)
 194 {
 195         size_t i, j;
 196         const struct dhcp_opt *opt, *opt2;
 197         int cols;
 198
 199         for (i = 0, opt = ctx->dhcp6_opts;
 200             i < ctx->dhcp6_opts_len; i++, opt++)
 201         {
 202                 for (j = 0, opt2 = opts; j < opts_len; j++, opt2++)
 203                         if (opt2->option == opt->option)
 204                                 break;
 205                 if (j == opts_len) {
 206                         cols = printf("%05d %s", opt->option, opt->var);
 207                         dhcp_print_option_encoding(opt, cols);
 208                 }
 209         }
 210         for (i = 0, opt = opts; i < opts_len; i++, opt++) {
 211                 cols = printf("%05d %s", opt->option, opt->var);
 212                 dhcp_print_option_encoding(opt, cols);
 213         }
 214 }
 215
 216 static size_t
 217 dhcp6_makeuser(void *data, const struct interface *ifp)
 218 {
 219         const struct if_options *ifo = ifp->options;
 220         struct dhcp6_option o;
 221         uint8_t *p;
 222         const uint8_t *up, *ue;
 223         uint16_t ulen, unlen;
 224         size_t olen;
 225
 226         /* Convert the DHCPv4 user class option to DHCPv6 */
 227         up = ifo->userclass;
 228         ulen = *up++;
 229         if (ulen == 0)
 230                 return 0;
 231
 232         p = data;
 233         olen = 0;
 234         if (p != NULL)
 235                 p += sizeof(o);
 236
 237         ue = up + ulen;
 238         for (; up < ue; up += ulen) {
 239                 ulen = *up++;
 240                 olen += sizeof(ulen) + ulen;
 241                 if (data == NULL)
 242                         continue;
 243                 unlen = htons(ulen);
 244                 memcpy(p, &unlen, sizeof(unlen));
 245                 p += sizeof(unlen);
 246                 memcpy(p, up, ulen);
 247                 p += ulen;
 248         }
 249         if (data != NULL) {
 250                 o.code = htons(D6_OPTION_USER_CLASS);
 251                 o.len = htons((uint16_t)olen);
 252                 memcpy(data, &o, sizeof(o));
 253         }
 254
 255         return sizeof(o) + olen;
 256 }
 257
 258 static size_t
 259 dhcp6_makevendor(void *data, const struct interface *ifp)
 260 {
 261         const struct if_options *ifo;
 262         size_t len, vlen, i;
 263         uint8_t *p;
 264         const struct vivco *vivco;
 265         struct dhcp6_option o;
 266
 267         ifo = ifp->options;
 268         len = sizeof(uint32_t); /* IANA PEN */
 269         if (ifo->vivco_en) {
 270                 vlen = 0;
 271                 for (i = 0, vivco = ifo->vivco;
 272                     i < ifo->vivco_len;
 273                     i++, vivco++)
 274                         vlen += sizeof(uint16_t) + vivco->len;
 275                 len += vlen;
 276         } else if (ifo->vendorclassid[0] != '\0') {
 277                 /* dhcpcd owns DHCPCD_IANA_PEN.
 278                  * If you need your own string, get your own IANA PEN. */
 279                 vlen = strlen(ifp->ctx->vendor);
 280                 len += sizeof(uint16_t) + vlen;
 281         } else
 282                 return 0;
 283
 284         if (len > UINT16_MAX) {
 285                 logerrx("%s: DHCPv6 Vendor Class too big", ifp->name);
 286                 return 0;
 287         }
 288
 289         if (data != NULL) {
 290                 uint32_t pen;
 291                 uint16_t hvlen;
 292
 293                 p = data;
 294                 o.code = htons(D6_OPTION_VENDOR_CLASS);
 295                 o.len = htons((uint16_t)len);
 296                 memcpy(p, &o, sizeof(o));
 297                 p += sizeof(o);
 298                 pen = htonl(ifo->vivco_en ? ifo->vivco_en : DHCPCD_IANA_PEN);
 299                 memcpy(p, &pen, sizeof(pen));
 300                 p += sizeof(pen);
 301
 302                 if (ifo->vivco_en) {
 303                         for (i = 0, vivco = ifo->vivco;
 304                             i < ifo->vivco_len;
 305                             i++, vivco++)
 306                         {
 307                                 hvlen = htons((uint16_t)vivco->len);
 308                                 memcpy(p, &hvlen, sizeof(hvlen));
 309                                 p += sizeof(hvlen);
 310                                 memcpy(p, vivco->data, vivco->len);
 311                                 p += vivco->len;
 312                         }
 313                 } else if (ifo->vendorclassid[0] != '\0') {
 314                         hvlen = htons((uint16_t)vlen);
 315                         memcpy(p, &hvlen, sizeof(hvlen));
 316                         p += sizeof(hvlen);
 317                         memcpy(p, ifp->ctx->vendor, vlen);
 318                 }
 319         }
 320
 321         return sizeof(o) + len;
 322 }
 323
 324 static void *
 325 dhcp6_findoption(void *data, size_t data_len, uint16_t code, uint16_t *len)
 326 {
 327         uint8_t *d;
 328         struct dhcp6_option o;
 329
 330         code = htons(code);
 331         for (d = data; data_len != 0; d += o.len, data_len -= o.len) {
 332                 if (data_len < sizeof(o)) {
 333                         errno = EINVAL;
 334                         return NULL;
 335                 }
 336                 memcpy(&o, d, sizeof(o));
 337                 d += sizeof(o);
 338                 data_len -= sizeof(o);
 339                 o.len = htons(o.len);
 340                 if (data_len < o.len) {
 341                         errno = EINVAL;
 342                         return NULL;
 343                 }
 344                 if (o.code == code) {
 345                         if (len != NULL)
 346                                 *len = o.len;
 347                         return d;
 348                 }
 349         }
 350
 351         errno = ENOENT;
 352         return NULL;
 353 }
 354
 355 static void *
 356 dhcp6_findmoption(void *data, size_t data_len, uint16_t code,
 357     uint16_t *len)
 358 {
 359         uint8_t *d;
 360
 361         if (data_len < sizeof(struct dhcp6_message)) {
 362                 errno = EINVAL;
 363                 return false;
 364         }
 365         d = data;
 366         d += sizeof(struct dhcp6_message);
 367         data_len -= sizeof(struct dhcp6_message);
 368         return dhcp6_findoption(d, data_len, code, len);
 369 }
 370
 371 static const uint8_t *
 372 dhcp6_getoption(struct dhcpcd_ctx *ctx,
 373     size_t *os, unsigned int *code, size_t *len,
 374     const uint8_t *od, size_t ol, struct dhcp_opt **oopt)
 375 {
 376         struct dhcp6_option o;
 377         size_t i;
 378         struct dhcp_opt *opt;
 379
 380         if (od != NULL) {
 381                 *os = sizeof(o);
 382                 if (ol < *os) {
 383                         errno = EINVAL;
 384                         return NULL;
 385                 }
 386                 memcpy(&o, od, sizeof(o));
 387                 *len = ntohs(o.len);
 388                 if (*len > ol - *os) {
 389                         errno = ERANGE;
 390                         return NULL;
 391                 }
 392                 *code = ntohs(o.code);
 393         }
 394
 395         *oopt = NULL;
 396         for (i = 0, opt = ctx->dhcp6_opts;
 397             i < ctx->dhcp6_opts_len; i++, opt++)
 398         {
 399                 if (opt->option == *code) {
 400                         *oopt = opt;
 401                         break;
 402                 }
 403         }
 404
 405         if (od != NULL)
 406                 return od + sizeof(o);
 407         return NULL;
 408 }
 409
 410 static bool
 411 dhcp6_updateelapsed(struct interface *ifp, struct dhcp6_message *m, size_t len)
 412 {
 413         uint8_t *opt;
 414         uint16_t opt_len;
 415         struct dhcp6_state *state;
 416         struct timespec tv;
 417         unsigned long long hsec;
 418         uint16_t sec;
 419
 420         opt = dhcp6_findmoption(m, len, D6_OPTION_ELAPSED, &opt_len);
 421         if (opt == NULL)
 422                 return false;
 423         if (opt_len != sizeof(sec)) {
 424                 errno = EINVAL;
 425                 return false;
 426         }
 427
 428         state = D6_STATE(ifp);
 429         clock_gettime(CLOCK_MONOTONIC, &tv);
 430         if (state->RTC == 0) {
 431                 /* An RTC of zero means we're the first message
 432                  * out of the door, so the elapsed time is zero. */
 433                 state->started = tv;
 434                 hsec = 0;
 435         } else {
 436                 unsigned long long secs;
 437                 unsigned int nsecs;
 438
 439                 secs = eloop_timespec_diff(&tv, &state->started, &nsecs);
 440                 /* Elapsed time is measured in centiseconds.
 441                  * We need to be sure it will not potentially overflow. */
 442                 if (secs >= (UINT16_MAX / CSEC_PER_SEC) + 1)
 443                         hsec = UINT16_MAX;
 444                 else {
 445                         hsec = (secs * CSEC_PER_SEC) +
 446                             (nsecs / NSEC_PER_CSEC);
 447                         if (hsec > UINT16_MAX)
 448                                 hsec = UINT16_MAX;
 449                 }
 450         }
 451         sec = htons((uint16_t)hsec);
 452         memcpy(opt, &sec, sizeof(sec));
 453         return true;
 454 }
 455
 456 static void
 457 dhcp6_newxid(const struct interface *ifp, struct dhcp6_message *m)
 458 {
 459         const struct interface *ifp1;
 460         const struct dhcp6_state *state1;
 461         uint32_t xid;
 462
 463         if (ifp->options->options & DHCPCD_XID_HWADDR &&
 464             ifp->hwlen >= sizeof(xid))
 465                 /* The lower bits are probably more unique on the network */
 466                 memcpy(&xid, (ifp->hwaddr + ifp->hwlen) - sizeof(xid),
 467                     sizeof(xid));
 468         else {
 469 again:
 470                 xid = arc4random();
 471         }
 472
 473         m->xid[0] = (xid >> 16) & 0xff;
 474         m->xid[1] = (xid >> 8) & 0xff;
 475         m->xid[2] = xid & 0xff;
 476
 477         /* Ensure it's unique */
 478         TAILQ_FOREACH(ifp1, ifp->ctx->ifaces, next) {
 479                 if (ifp == ifp1)
 480                         continue;
 481                 if ((state1 = D6_CSTATE(ifp1)) == NULL)
 482                         continue;
 483                 if (state1->send != NULL &&
 484                     state1->send->xid[0] == m->xid[0] &&
 485                     state1->send->xid[1] == m->xid[1] &&
 486                     state1->send->xid[2] == m->xid[2])
 487                         break;
 488         }
 489
 490         if (ifp1 != NULL) {
 491                 if (ifp->options->options & DHCPCD_XID_HWADDR &&
 492                     ifp->hwlen >= sizeof(xid))
 493                 {
 494                         logerrx("%s: duplicate xid on %s",
 495                             ifp->name, ifp1->name);
 496                             return;
 497                 }
 498                 goto again;
 499         }
 500 }
 501
 502 #ifndef SMALL
 503 static const struct if_sla *
 504 dhcp6_findselfsla(struct interface *ifp)
 505 {
 506         size_t i, j;
 507         struct if_ia *ia;
 508
 509         for (i = 0; i < ifp->options->ia_len; i++) {
 510                 ia = &ifp->options->ia[i];
 511                 if (ia->ia_type != D6_OPTION_IA_PD)
 512                         continue;
 513                 for (j = 0; j < ia->sla_len; j++) {
 514                         if (strcmp(ia->sla[j].ifname, ifp->name) == 0)
 515                                 return &ia->sla[j];
 516                 }
 517         }
 518         return NULL;
 519 }
 520
 521 static int
 522 dhcp6_delegateaddr(struct in6_addr *addr, struct interface *ifp,
 523     const struct ipv6_addr *prefix, const struct if_sla *sla, struct if_ia *ia)
 524 {
 525         struct dhcp6_state *state;
 526         struct if_sla asla;
 527         char sabuf[INET6_ADDRSTRLEN];
 528         const char *sa;
 529
 530         state = D6_STATE(ifp);
 531         if (state == NULL) {
 532                 ifp->if_data[IF_DATA_DHCP6] = calloc(1, sizeof(*state));
 533                 state = D6_STATE(ifp);
 534                 if (state == NULL) {
 535                         logerr(__func__);
 536                         return -1;
 537                 }
 538
 539                 TAILQ_INIT(&state->addrs);
 540                 state->state = DH6S_DELEGATED;
 541                 state->reason = "DELEGATED6";
 542         }
 543
 544         if (sla == NULL || !sla->sla_set) {
 545                 /* No SLA set, so make an assumption of
 546                  * desired SLA and prefix length. */
 547                 asla.sla = ifp->index;
 548                 asla.prefix_len = 0;
 549                 asla.sla_set = false;
 550                 sla = &asla;
 551         } else if (sla->prefix_len == 0) {
 552                 /* An SLA was given, but prefix length was not.
 553                  * We need to work out a suitable prefix length for
 554                  * potentially more than one interface. */
 555                 asla.sla = sla->sla;
 556                 asla.prefix_len = 0;
 557                 asla.sla_set = sla->sla_set;
 558                 sla = &asla;
 559         }
 560
 561         if (sla->prefix_len == 0) {
 562                 uint32_t sla_max;
 563                 int bits;
 564
 565                 sla_max = ia->sla_max;
 566                 if (sla_max == 0 && (sla == NULL || !sla->sla_set)) {
 567                         const struct interface *ifi;
 568
 569                         TAILQ_FOREACH(ifi, ifp->ctx->ifaces, next) {
 570                                 if (ifi->index > sla_max)
 571                                         sla_max = ifi->index;
 572                         }
 573                 }
 574
 575                 bits = fls32(sla_max);
 576
 577                 if (prefix->prefix_len + bits > (int)UINT8_MAX)
 578                         asla.prefix_len = UINT8_MAX;
 579                 else {
 580                         asla.prefix_len = (uint8_t)(prefix->prefix_len + bits);
 581
 582                         /* Make a 64 prefix by default, as this makes SLAAC
 583                          * possible.
 584                          * Otherwise round up to the nearest 4 bits. */
 585                         if (asla.prefix_len <= 64)
 586                                 asla.prefix_len = 64;
 587                         else
 588                                 asla.prefix_len =
 589                                     (uint8_t)ROUNDUP4(asla.prefix_len);
 590                 }
 591
 592 #define BIT(n) (1UL << (n))
 593 #define BIT_MASK(len) (BIT(len) - 1)
 594                 if (ia->sla_max == 0) {
 595                         /* Work out the real sla_max from our bits used */
 596                         bits = asla.prefix_len - prefix->prefix_len;
 597                         /* Make static analysis happy.
 598                          * Bits cannot be bigger than 32 thanks to fls32. */
 599                         assert(bits <= 32);
 600                         ia->sla_max = (uint32_t)BIT_MASK(bits);
 601                 }
 602         }
 603
 604         if (ipv6_userprefix(&prefix->prefix, prefix->prefix_len,
 605                 sla->sla, addr, sla->prefix_len) == -1)
 606         {
 607                 sa = inet_ntop(AF_INET6, &prefix->prefix,
 608                     sabuf, sizeof(sabuf));
 609                 logerr("%s: invalid prefix %s/%d + %d/%d",
 610                     ifp->name, sa, prefix->prefix_len,
 611                     sla->sla, sla->prefix_len);
 612                 return -1;
 613         }
 614
 615         if (prefix->prefix_exclude_len &&
 616             IN6_ARE_ADDR_EQUAL(addr, &prefix->prefix_exclude))
 617         {
 618                 sa = inet_ntop(AF_INET6, &prefix->prefix_exclude,
 619                     sabuf, sizeof(sabuf));
 620                 logerrx("%s: cannot delegate excluded prefix %s/%d",
 621                     ifp->name, sa, prefix->prefix_exclude_len);
 622                 return -1;
 623         }
 624
 625         return sla->prefix_len;
 626 }
 627 #endif
 628
 629 static int
 630 dhcp6_makemessage(struct interface *ifp)
 631 {
 632         struct dhcp6_state *state;
 633         struct dhcp6_message *m;
 634         struct dhcp6_option o;
 635         uint8_t *p, *si, *unicast, IA;
 636         size_t n, l, len, ml, hl;
 637         uint8_t type;
 638         uint16_t si_len, uni_len, n_options;
 639         uint8_t *o_lenp;
 640         struct if_options *ifo;
 641         const struct dhcp_opt *opt, *opt2;
 642         const struct ipv6_addr *ap;
 643         char hbuf[HOSTNAME_MAX_LEN + 1];
 644         const char *hostname;
 645         int fqdn;
 646         struct dhcp6_ia_na ia_na;
 647         uint16_t ia_na_len;
 648         struct if_ia *ifia;
 649 #ifdef AUTH
 650         uint16_t auth_len;
 651 #endif
 652         uint8_t duid[DUID_LEN];
 653         size_t duid_len = 0;
 654
 655         state = D6_STATE(ifp);
 656         if (state->send) {
 657                 free(state->send);
 658                 state->send = NULL;
 659         }
 660
 661         ifo = ifp->options;
 662         fqdn = ifo->fqdn;
 663
 664         if (fqdn == FQDN_DISABLE && ifo->options & DHCPCD_HOSTNAME) {
 665                 /* We're sending the DHCPv4 hostname option, so send FQDN as
 666                  * DHCPv6 has no FQDN option and DHCPv4 must not send
 667                  * hostname and FQDN according to RFC4702 */
 668                 fqdn = FQDN_BOTH;
 669         }
 670         if (fqdn != FQDN_DISABLE)
 671                 hostname = dhcp_get_hostname(hbuf, sizeof(hbuf), ifo);
 672         else
 673                 hostname = NULL; /* appearse gcc */
 674
 675         /* Work out option size first */
 676         n_options = 0;
 677         len = 0;
 678         si = NULL;
 679         hl = 0; /* Appease gcc */
 680         if (state->state != DH6S_RELEASE && state->state != DH6S_DECLINE) {
 681                 for (l = 0, opt = ifp->ctx->dhcp6_opts;
 682                     l < ifp->ctx->dhcp6_opts_len;
 683                     l++, opt++)
 684                 {
 685                         for (n = 0, opt2 = ifo->dhcp6_override;
 686                             n < ifo->dhcp6_override_len;
 687                             n++, opt2++)
 688                         {
 689                                 if (opt->option == opt2->option)
 690                                         break;
 691                         }
 692                         if (n < ifo->dhcp6_override_len)
 693                                 continue;
 694                         if (!DHC_REQOPT(opt, ifo->requestmask6, ifo->nomask6))
 695                                 continue;
 696                         n_options++;
 697                         len += sizeof(o.len);
 698                 }
 699 #ifndef SMALL
 700                 for (l = 0, opt = ifo->dhcp6_override;
 701                     l < ifo->dhcp6_override_len;
 702                     l++, opt++)
 703                 {
 704                         if (!DHC_REQOPT(opt, ifo->requestmask6, ifo->nomask6))
 705                                 continue;
 706                         n_options++;
 707                         len += sizeof(o.len);
 708                 }
 709                 if (dhcp6_findselfsla(ifp)) {
 710                         n_options++;
 711                         len += sizeof(o.len);
 712                 }
 713 #endif
 714                 if (len)
 715                         len += sizeof(o);
 716
 717                 if (fqdn != FQDN_DISABLE) {
 718                         hl = encode_rfc1035(hostname, NULL);
 719                         len += sizeof(o) + 1 + hl;
 720                 }
 721
 722                 if (!has_option_mask(ifo->nomask6, D6_OPTION_MUDURL) &&
 723                     ifo->mudurl[0])
 724                         len += sizeof(o) + ifo->mudurl[0];
 725
 726 #ifdef AUTH
 727                 if ((ifo->auth.options & DHCPCD_AUTH_SENDREQUIRE) !=
 728                     DHCPCD_AUTH_SENDREQUIRE &&
 729                     DHC_REQ(ifo->requestmask6, ifo->nomask6,
 730                     D6_OPTION_RECONF_ACCEPT))
 731                         len += sizeof(o); /* Reconfigure Accept */
 732 #endif
 733         }
 734
 735         len += sizeof(*state->send);
 736         len += sizeof(o) + sizeof(uint16_t); /* elapsed */
 737
 738         if (ifo->options & DHCPCD_ANONYMOUS) {
 739                 duid_len = duid_make(duid, ifp, DUID_LL);
 740                 len += sizeof(o) + duid_len;
 741         } else {
 742                 len += sizeof(o) + ifp->ctx->duid_len;
 743         }
 744
 745         if (!has_option_mask(ifo->nomask6, D6_OPTION_USER_CLASS))
 746                 len += dhcp6_makeuser(NULL, ifp);
 747         if (!has_option_mask(ifo->nomask6, D6_OPTION_VENDOR_CLASS))
 748                 len += dhcp6_makevendor(NULL, ifp);
 749
 750         /* IA */
 751         m = NULL;
 752         ml = 0;
 753         switch(state->state) {
 754         case DH6S_REQUEST:
 755                 m = state->recv;
 756                 ml = state->recv_len;
 757                 /* FALLTHROUGH */
 758         case DH6S_DECLINE:
 759                 /* FALLTHROUGH */
 760         case DH6S_RELEASE:
 761                 /* FALLTHROUGH */
 762         case DH6S_RENEW:
 763                 if (m == NULL) {
 764                         m = state->new;
 765                         ml = state->new_len;
 766                 }
 767                 si = dhcp6_findmoption(m, ml, D6_OPTION_SERVERID, &si_len);
 768                 if (si == NULL)
 769                         return -1;
 770                 len += sizeof(o) + si_len;
 771                 /* FALLTHROUGH */
 772         case DH6S_REBIND:
 773                 /* FALLTHROUGH */
 774         case DH6S_CONFIRM:
 775                 /* FALLTHROUGH */
 776         case DH6S_DISCOVER:
 777                 if (m == NULL) {
 778                         m = state->new;
 779                         ml = state->new_len;
 780                 }
 781                 TAILQ_FOREACH(ap, &state->addrs, next) {
 782                         if (ap->flags & IPV6_AF_STALE)
 783                                 continue;
 784                         if (!(ap->flags & IPV6_AF_REQUEST) &&
 785                             (ap->prefix_vltime == 0 ||
 786                             state->state == DH6S_DISCOVER))
 787                                 continue;
 788                         if (DECLINE_IA(ap) && state->state != DH6S_DECLINE)
 789                                 continue;
 790                         if (ap->ia_type == D6_OPTION_IA_PD) {
 791 #ifndef SMALL
 792                                 len += sizeof(o) + sizeof(struct dhcp6_pd_addr);
 793                                 if (ap->prefix_exclude_len)
 794                                         len += sizeof(o) + 1 +
 795                                             (uint8_t)((ap->prefix_exclude_len -
 796                                             ap->prefix_len - 1) / NBBY) + 1;
 797 #endif
 798                         } else
 799                                 len += sizeof(o) + sizeof(struct dhcp6_ia_addr);
 800                 }
 801                 /* FALLTHROUGH */
 802         case DH6S_INIT:
 803                 for (l = 0; l < ifo->ia_len; l++) {
 804                         len += sizeof(o) + sizeof(uint32_t); /* IAID */
 805                         /* IA_TA does not have T1 or T2 timers */
 806                         if (ifo->ia[l].ia_type != D6_OPTION_IA_TA)
 807                                 len += sizeof(uint32_t) + sizeof(uint32_t);
 808                 }
 809                 IA = 1;
 810                 break;
 811         default:
 812                 IA = 0;
 813         }
 814
 815         if (state->state == DH6S_DISCOVER &&
 816             !(ifp->ctx->options & DHCPCD_TEST) &&
 817             DHC_REQ(ifo->requestmask6, ifo->nomask6, D6_OPTION_RAPID_COMMIT))
 818                 len += sizeof(o);
 819
 820         if (m == NULL) {
 821                 m = state->new;
 822                 ml = state->new_len;
 823         }
 824
 825         switch(state->state) {
 826         case DH6S_INIT: /* FALLTHROUGH */
 827         case DH6S_DISCOVER:
 828                 type = DHCP6_SOLICIT;
 829                 break;
 830         case DH6S_REQUEST:
 831                 type = DHCP6_REQUEST;
 832                 break;
 833         case DH6S_CONFIRM:
 834                 type = DHCP6_CONFIRM;
 835                 break;
 836         case DH6S_REBIND:
 837                 type = DHCP6_REBIND;
 838                 break;
 839         case DH6S_RENEW:
 840                 type = DHCP6_RENEW;
 841                 break;
 842         case DH6S_INFORM:
 843                 type = DHCP6_INFORMATION_REQ;
 844                 break;
 845         case DH6S_RELEASE:
 846                 type = DHCP6_RELEASE;
 847                 break;
 848         case DH6S_DECLINE:
 849                 type = DHCP6_DECLINE;
 850                 break;
 851         default:
 852                 errno = EINVAL;
 853                 return -1;
 854         }
 855
 856         switch(state->state) {
 857         case DH6S_REQUEST: /* FALLTHROUGH */
 858         case DH6S_RENEW:   /* FALLTHROUGH */
 859         case DH6S_RELEASE:
 860                 if (has_option_mask(ifo->nomask6, D6_OPTION_UNICAST)) {
 861                         unicast = NULL;
 862                         break;
 863                 }
 864                 unicast = dhcp6_findmoption(m, ml, D6_OPTION_UNICAST, &uni_len);
 865                 break;
 866         default:
 867                 unicast = NULL;
 868                 break;
 869         }
 870
 871         /* In non master mode we listen and send from fixed addresses.
 872          * We should try and match an address we have to unicast to,
 873          * but for now this is the safest policy. */
 874         if (unicast != NULL && !(ifp->ctx->options & DHCPCD_MASTER)) {
 875                 logdebugx("%s: ignoring unicast option as not master",
 876                     ifp->name);
 877                 unicast = NULL;
 878         }
 879
 880 #ifdef AUTH
 881         auth_len = 0;
 882         if (ifo->auth.options & DHCPCD_AUTH_SEND) {
 883                 ssize_t alen = dhcp_auth_encode(ifp->ctx, &ifo->auth,
 884                     state->auth.token, NULL, 0, 6, type, NULL, 0);
 885                 if (alen != -1 && alen > UINT16_MAX) {
 886                         errno = ERANGE;
 887                         alen = -1;
 888                 }
 889                 if (alen == -1)
 890                         logerr("%s: %s: dhcp_auth_encode", __func__, ifp->name);
 891                 else if (alen != 0) {
 892                         auth_len = (uint16_t)alen;
 893                         len += sizeof(o) + auth_len;
 894                 }
 895         }
 896 #endif
 897
 898         state->send = malloc(len);
 899         if (state->send == NULL)
 900                 return -1;
 901
 902         state->send_len = len;
 903         state->send->type = type;
 904
 905         /* If we found a unicast option, copy it to our state for sending */
 906         if (unicast && uni_len == sizeof(state->unicast))
 907                 memcpy(&state->unicast, unicast, sizeof(state->unicast));
 908         else
 909                 state->unicast = in6addr_any;
 910
 911         dhcp6_newxid(ifp, state->send);
 912
 913 #define COPYIN1(_code, _len)            {       \
 914         o.code = htons((_code));                \
 915         o.len = htons((_len));                  \
 916         memcpy(p, &o, sizeof(o));               \
 917         p += sizeof(o);                         \
 918 }
 919 #define COPYIN(_code, _data, _len)      do {    \
 920         COPYIN1((_code), (_len));               \
 921         if ((_len) != 0) {                      \
 922                 memcpy(p, (_data), (_len));     \
 923                 p += (_len);                    \
 924         }                                       \
 925 } while (0 /* CONSTCOND */)
 926 #define NEXTLEN (p + offsetof(struct dhcp6_option, len))
 927
 928         /* Options are listed in numerical order as per RFC 7844 Section 4.1
 929          * XXX: They should be randomised. */
 930
 931         p = (uint8_t *)state->send + sizeof(*state->send);
 932         if (ifo->options & DHCPCD_ANONYMOUS)
 933                 COPYIN(D6_OPTION_CLIENTID, duid,
 934                     (uint16_t)duid_len);
 935         else
 936                 COPYIN(D6_OPTION_CLIENTID, ifp->ctx->duid,
 937                     (uint16_t)ifp->ctx->duid_len);
 938
 939         if (si != NULL)
 940                 COPYIN(D6_OPTION_SERVERID, si, si_len);
 941
 942         for (l = 0; IA && l < ifo->ia_len; l++) {
 943                 ifia = &ifo->ia[l];
 944                 o_lenp = NEXTLEN;
 945                 /* TA structure is the same as the others,
 946                  * it just lacks the T1 and T2 timers.
 947                  * These happen to be at the end of the struct,
 948                  * so we just don't copy them in. */
 949                 if (ifia->ia_type == D6_OPTION_IA_TA)
 950                         ia_na_len = sizeof(struct dhcp6_ia_ta);
 951                 else
 952                         ia_na_len = sizeof(ia_na);
 953                 memcpy(ia_na.iaid, ifia->iaid, sizeof(ia_na.iaid));
 954                 ia_na.t1 = 0;
 955                 ia_na.t2 = 0;
 956                 COPYIN(ifia->ia_type, &ia_na, ia_na_len);
 957                 TAILQ_FOREACH(ap, &state->addrs, next) {
 958                         if (ap->flags & IPV6_AF_STALE)
 959                                 continue;
 960                         if (!(ap->flags & IPV6_AF_REQUEST) &&
 961                             (ap->prefix_vltime == 0 ||
 962                             state->state == DH6S_DISCOVER))
 963                                 continue;
 964                         if (DECLINE_IA(ap) && state->state != DH6S_DECLINE)
 965                                 continue;
 966                         if (ap->ia_type != ifia->ia_type)
 967                                 continue;
 968                         if (memcmp(ap->iaid, ifia->iaid, sizeof(ap->iaid)))
 969                                 continue;
 970                         if (ap->ia_type == D6_OPTION_IA_PD) {
 971 #ifndef SMALL
 972                                 struct dhcp6_pd_addr pdp;
 973
 974                                 pdp.pltime = htonl(ap->prefix_pltime);
 975                                 pdp.vltime = htonl(ap->prefix_vltime);
 976                                 pdp.prefix_len = ap->prefix_len;
 977                                 /* pdp.prefix is not aligned, so copy it in. */
 978                                 memcpy(&pdp.prefix, &ap->prefix, sizeof(pdp.prefix));
 979                                 COPYIN(D6_OPTION_IAPREFIX, &pdp, sizeof(pdp));
 980                                 ia_na_len = (uint16_t)
 981                                     (ia_na_len + sizeof(o) + sizeof(pdp));
 982
 983                                 /* RFC6603 Section 4.2 */
 984                                 if (ap->prefix_exclude_len) {
 985                                         uint8_t exb[16], *ep, u8;
 986                                         const uint8_t *pp;
 987
 988                                         n = (size_t)((ap->prefix_exclude_len -
 989                                             ap->prefix_len - 1) / NBBY) + 1;
 990                                         ep = exb;
 991                                         *ep++ = (uint8_t)ap->prefix_exclude_len;
 992                                         pp = ap->prefix_exclude.s6_addr;
 993                                         pp += (size_t)
 994                                             ((ap->prefix_len - 1) / NBBY) +
 995                                             (n - 1);
 996                                         u8 = ap->prefix_len % NBBY;
 997                                         if (u8)
 998                                                 n--;
 999                                         while (n-- > 0)
1000                                                 *ep++ = *pp--;
1001                                         if (u8)
1002                                                 *ep = (uint8_t)(*pp << u8);
1003                                         n++;
1004                                         COPYIN(D6_OPTION_PD_EXCLUDE, exb,
1005                                             (uint16_t)n);
1006                                         ia_na_len = (uint16_t)
1007                                             (ia_na_len + sizeof(o) + n);
1008                                 }
1009 #endif
1010                         } else {
1011                                 struct dhcp6_ia_addr ia;
1012
1013                                 ia.addr = ap->addr;
1014                                 ia.pltime = htonl(ap->prefix_pltime);
1015                                 ia.vltime = htonl(ap->prefix_vltime);
1016                                 COPYIN(D6_OPTION_IA_ADDR, &ia, sizeof(ia));
1017                                 ia_na_len = (uint16_t)
1018                                     (ia_na_len + sizeof(o) + sizeof(ia));
1019                         }
1020                 }
1021
1022                 /* Update the total option lenth. */
1023                 ia_na_len = htons(ia_na_len);
1024                 memcpy(o_lenp, &ia_na_len, sizeof(ia_na_len));
1025         }
1026
1027         if (state->send->type != DHCP6_RELEASE &&
1028             state->send->type != DHCP6_DECLINE &&
1029             n_options)
1030         {
1031                 o_lenp = NEXTLEN;
1032                 o.len = 0;
1033                 COPYIN1(D6_OPTION_ORO, 0);
1034                 for (l = 0, opt = ifp->ctx->dhcp6_opts;
1035                     l < ifp->ctx->dhcp6_opts_len;
1036                     l++, opt++)
1037                 {
1038 #ifndef SMALL
1039                         for (n = 0, opt2 = ifo->dhcp6_override;
1040                             n < ifo->dhcp6_override_len;
1041                             n++, opt2++)
1042                         {
1043                                 if (opt->option == opt2->option)
1044                                         break;
1045                         }
1046                         if (n < ifo->dhcp6_override_len)
1047                             continue;
1048 #endif
1049                         if (!DHC_REQOPT(opt, ifo->requestmask6, ifo->nomask6))
1050                                 continue;
1051                         o.code = htons((uint16_t)opt->option);
1052                         memcpy(p, &o.code, sizeof(o.code));
1053                         p += sizeof(o.code);
1054                         o.len = (uint16_t)(o.len + sizeof(o.code));
1055                 }
1056 #ifndef SMALL
1057                 for (l = 0, opt = ifo->dhcp6_override;
1058                     l < ifo->dhcp6_override_len;
1059                     l++, opt++)
1060                 {
1061                         if (!DHC_REQOPT(opt, ifo->requestmask6, ifo->nomask6))
1062                                 continue;
1063                         o.code = htons((uint16_t)opt->option);
1064                         memcpy(p, &o.code, sizeof(o.code));
1065                         p += sizeof(o.code);
1066                         o.len = (uint16_t)(o.len + sizeof(o.code));
1067                 }
1068                 if (dhcp6_findselfsla(ifp)) {
1069                         o.code = htons(D6_OPTION_PD_EXCLUDE);
1070                         memcpy(p, &o.code, sizeof(o.code));
1071                         p += sizeof(o.code);
1072                         o.len = (uint16_t)(o.len + sizeof(o.code));
1073                 }
1074 #endif
1075                 o.len = htons(o.len);
1076                 memcpy(o_lenp, &o.len, sizeof(o.len));
1077         }
1078
1079         si_len = 0;
1080         COPYIN(D6_OPTION_ELAPSED, &si_len, sizeof(si_len));
1081
1082         if (state->state == DH6S_DISCOVER &&
1083             !(ifp->ctx->options & DHCPCD_TEST) &&
1084             DHC_REQ(ifo->requestmask6, ifo->nomask6, D6_OPTION_RAPID_COMMIT))
1085                 COPYIN1(D6_OPTION_RAPID_COMMIT, 0);
1086
1087         if (!has_option_mask(ifo->nomask6, D6_OPTION_USER_CLASS))
1088                 p += dhcp6_makeuser(p, ifp);
1089         if (!has_option_mask(ifo->nomask6, D6_OPTION_VENDOR_CLASS))
1090                 p += dhcp6_makevendor(p, ifp);
1091
1092         if (state->send->type != DHCP6_RELEASE &&
1093             state->send->type != DHCP6_DECLINE)
1094         {
1095                 if (fqdn != FQDN_DISABLE) {
1096                         o_lenp = NEXTLEN;
1097                         COPYIN1(D6_OPTION_FQDN, 0);
1098                         if (hl == 0)
1099                                 *p = D6_FQDN_NONE;
1100                         else {
1101                                 switch (fqdn) {
1102                                 case FQDN_BOTH:
1103                                         *p = D6_FQDN_BOTH;
1104                                         break;
1105                                 case FQDN_PTR:
1106                                         *p = D6_FQDN_PTR;
1107                                         break;
1108                                 default:
1109                                         *p = D6_FQDN_NONE;
1110                                         break;
1111                                 }
1112                         }
1113                         p++;
1114                         encode_rfc1035(hostname, p);
1115                         p += hl;
1116                         o.len = htons((uint16_t)(hl + 1));
1117                         memcpy(o_lenp, &o.len, sizeof(o.len));
1118                 }
1119
1120                 if (!has_option_mask(ifo->nomask6, D6_OPTION_MUDURL) &&
1121                     ifo->mudurl[0])
1122                         COPYIN(D6_OPTION_MUDURL,
1123                             ifo->mudurl + 1, ifo->mudurl[0]);
1124
1125 #ifdef AUTH
1126                 if ((ifo->auth.options & DHCPCD_AUTH_SENDREQUIRE) !=
1127                     DHCPCD_AUTH_SENDREQUIRE &&
1128                     DHC_REQ(ifo->requestmask6, ifo->nomask6,
1129                     D6_OPTION_RECONF_ACCEPT))
1130                         COPYIN1(D6_OPTION_RECONF_ACCEPT, 0);
1131 #endif
1132
1133         }
1134
1135 #ifdef AUTH
1136         /* This has to be the last option */
1137         if (ifo->auth.options & DHCPCD_AUTH_SEND && auth_len != 0) {
1138                 COPYIN1(D6_OPTION_AUTH, auth_len);
1139                 /* data will be filled at send message time */
1140         }
1141 #endif
1142
1143         return 0;
1144 }
1145
1146 static const char *
1147 dhcp6_get_op(uint16_t type)
1148 {
1149         const struct dhcp6_op *d;
1150
1151         for (d = dhcp6_ops; d->name; d++)
1152                 if (d->type == type)
1153                         return d->name;
1154         return NULL;
1155 }
1156
1157 static void
1158 dhcp6_freedrop_addrs(struct interface *ifp, int drop,
1159     const struct interface *ifd)
1160 {
1161         struct dhcp6_state *state;
1162
1163         state = D6_STATE(ifp);
1164         if (state) {
1165                 ipv6_freedrop_addrs(&state->addrs, drop, ifd);
1166                 if (drop)
1167                         rt_build(ifp->ctx, AF_INET6);
1168         }
1169 }
1170
1171 #ifndef SMALL
1172 static void dhcp6_delete_delegates(struct interface *ifp)
1173 {
1174         struct interface *ifp0;
1175
1176         if (ifp->ctx->ifaces) {
1177                 TAILQ_FOREACH(ifp0, ifp->ctx->ifaces, next) {
1178                         if (ifp0 != ifp)
1179                                 dhcp6_freedrop_addrs(ifp0, 1, ifp);
1180                 }
1181         }
1182 }
1183 #endif
1184
1185 #ifdef AUTH
1186 static ssize_t
1187 dhcp6_update_auth(struct interface *ifp, struct dhcp6_message *m, size_t len)
1188 {
1189         struct dhcp6_state *state;
1190         uint8_t *opt;
1191         uint16_t opt_len;
1192
1193         opt = dhcp6_findmoption(m, len, D6_OPTION_AUTH, &opt_len);
1194         if (opt == NULL)
1195                 return -1;
1196
1197         state = D6_STATE(ifp);
1198         return dhcp_auth_encode(ifp->ctx, &ifp->options->auth,
1199             state->auth.token, (uint8_t *)state->send, state->send_len, 6,
1200             state->send->type, opt, opt_len);
1201 }
1202 #endif
1203
1204 static const struct in6_addr alldhcp = IN6ADDR_LINKLOCAL_ALLDHCP_INIT;
1205 static int
1206 dhcp6_sendmessage(struct interface *ifp, void (*callback)(void *))
1207 {
1208         struct dhcp6_state *state = D6_STATE(ifp);
1209         struct dhcpcd_ctx *ctx = ifp->ctx;
1210         unsigned int RT;
1211         bool broadcast = true;
1212         struct sockaddr_in6 dst = {
1213             .sin6_family = AF_INET6,
1214             /* Setting the port on Linux gives EINVAL when sending.
1215              * This looks like a kernel bug as the equivalent works
1216              * fine with the DHCP counterpart. */
1217 #ifndef __linux__
1218             .sin6_port = htons(DHCP6_SERVER_PORT),
1219 #endif
1220         };
1221         struct udphdr udp = {
1222             .uh_sport = htons(DHCP6_CLIENT_PORT),
1223             .uh_dport = htons(DHCP6_SERVER_PORT),
1224             .uh_ulen = htons((uint16_t)(sizeof(udp) + state->send_len)),
1225         };
1226         struct iovec iov[] = {
1227             { .iov_base = &udp, .iov_len = sizeof(udp), },
1228             { .iov_base = state->send, .iov_len = state->send_len, },
1229         };
1230         union {
1231                 struct cmsghdr hdr;
1232                 uint8_t buf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
1233         } cmsgbuf = { .buf = { 0 } };
1234         struct msghdr msg = {
1235             .msg_name = &dst, .msg_namelen = sizeof(dst),
1236             .msg_iov = iov, .msg_iovlen = __arraycount(iov),
1237         };
1238         char uaddr[INET6_ADDRSTRLEN];
1239
1240         if (!callback && !if_is_link_up(ifp))
1241                 return 0;
1242
1243         if (!IN6_IS_ADDR_UNSPECIFIED(&state->unicast)) {
1244                 switch (state->send->type) {
1245                 case DHCP6_SOLICIT:     /* FALLTHROUGH */
1246                 case DHCP6_CONFIRM:     /* FALLTHROUGH */
1247                 case DHCP6_REBIND:
1248                         /* Unicasting is denied for these types. */
1249                         break;
1250                 default:
1251                         broadcast = false;
1252                         inet_ntop(AF_INET6, &state->unicast, uaddr,
1253                             sizeof(uaddr));
1254                         break;
1255                 }
1256         }
1257         dst.sin6_addr = broadcast ? alldhcp : state->unicast;
1258
1259         if (!callback) {
1260                 logdebugx("%s: %s %s with xid 0x%02x%02x%02x%s%s",
1261                     ifp->name,
1262                     broadcast ? "broadcasting" : "unicasting",
1263                     dhcp6_get_op(state->send->type),
1264                     state->send->xid[0],
1265                     state->send->xid[1],
1266                     state->send->xid[2],
1267                     !broadcast ? " " : "",
1268                     !broadcast ? uaddr : "");
1269                 RT = 0;
1270         } else {
1271                 if (state->IMD &&
1272                     !(ifp->options->options & DHCPCD_INITIAL_DELAY))
1273                         state->IMD = 0;
1274                 if (state->IMD) {
1275                         state->RT = state->IMD * MSEC_PER_SEC;
1276                         /* Some buggy PPP servers close the link too early
1277                          * after sending an invalid status in their reply
1278                          * which means this host won't see it.
1279                          * 1 second grace seems to be the sweet spot. */
1280                         if (ifp->flags & IFF_POINTOPOINT)
1281                                 state->RT += MSEC_PER_SEC;
1282                 } else if (state->RTC == 0)
1283                         state->RT = state->IRT * MSEC_PER_SEC;
1284
1285                 if (state->MRT != 0) {
1286                         unsigned int mrt = state->MRT * MSEC_PER_SEC;
1287
1288                         if (state->RT > mrt)
1289                                 state->RT = mrt;
1290                 }
1291
1292                 /* Add -.1 to .1 * RT randomness as per RFC8415 section 15 */
1293                 uint32_t lru = arc4random_uniform(
1294                     state->RTC == 0 ? DHCP6_RAND_MAX
1295                     : DHCP6_RAND_MAX - DHCP6_RAND_MIN);
1296                 int lr = (int)lru - (state->RTC == 0 ? 0 : DHCP6_RAND_MAX);
1297                 RT = state->RT
1298                     + (unsigned int)((float)state->RT
1299                     * ((float)lr / DHCP6_RAND_DIV));
1300
1301                 if (if_is_link_up(ifp))
1302                         logdebugx("%s: %s %s (xid 0x%02x%02x%02x)%s%s,"
1303                             " next in %0.1f seconds",
1304                             ifp->name,
1305                             state->IMD != 0 ? "delaying" :
1306                             broadcast ? "broadcasting" : "unicasting",
1307                             dhcp6_get_op(state->send->type),
1308                             state->send->xid[0],
1309                             state->send->xid[1],
1310                             state->send->xid[2],
1311                             state->IMD == 0 && !broadcast ? " " : "",
1312                             state->IMD == 0 && !broadcast ? uaddr : "",
1313                             (float)RT / MSEC_PER_SEC);
1314
1315                 /* Wait the initial delay */
1316                 if (state->IMD != 0) {
1317                         state->IMD = 0;
1318                         eloop_timeout_add_msec(ctx->eloop, RT, callback, ifp);
1319                         return 0;
1320                 }
1321         }
1322
1323         if (!if_is_link_up(ifp))
1324                 return 0;
1325
1326         /* Update the elapsed time */
1327         dhcp6_updateelapsed(ifp, state->send, state->send_len);
1328 #ifdef AUTH
1329         if (ifp->options->auth.options & DHCPCD_AUTH_SEND &&
1330             dhcp6_update_auth(ifp, state->send, state->send_len) == -1)
1331         {
1332                 logerr("%s: %s: dhcp6_updateauth", __func__, ifp->name);
1333                 if (errno != ESRCH)
1334                         return -1;
1335         }
1336 #endif
1337
1338         /* Set the outbound interface */
1339         if (broadcast) {
1340                 struct cmsghdr *cm;
1341                 struct in6_pktinfo pi = { .ipi6_ifindex = ifp->index };
1342
1343                 dst.sin6_scope_id = ifp->index;
1344                 msg.msg_control = cmsgbuf.buf;
1345                 msg.msg_controllen = sizeof(cmsgbuf.buf);
1346                 cm = CMSG_FIRSTHDR(&msg);
1347                 if (cm == NULL) /* unlikely */
1348                         return -1;
1349                 cm->cmsg_level = IPPROTO_IPV6;
1350                 cm->cmsg_type = IPV6_PKTINFO;
1351                 cm->cmsg_len = CMSG_LEN(sizeof(pi));
1352                 memcpy(CMSG_DATA(cm), &pi, sizeof(pi));
1353         }
1354
1355 #ifdef PRIVSEP
1356         if (IN_PRIVSEP(ifp->ctx)) {
1357                 if (ps_inet_senddhcp6(ifp, &msg) == -1)
1358                         logerr(__func__);
1359                 goto sent;
1360         }
1361 #endif
1362
1363         if (sendmsg(ctx->dhcp6_wfd, &msg, 0) == -1) {
1364                 logerr("%s: %s: sendmsg", __func__, ifp->name);
1365                 /* Allow DHCPv6 to continue .... the errors
1366                  * would be rate limited by the protocol.
1367                  * Generally the error is ENOBUFS when struggling to
1368                  * associate with an access point. */
1369         }
1370
1371 #ifdef PRIVSEP
1372 sent:
1373 #endif
1374         state->RTC++;
1375         if (callback) {
1376                 state->RT = RT * 2;
1377                 if (state->RT < RT) /* Check overflow */
1378                         state->RT = RT;
1379                 if (state->MRC == 0 || state->RTC < state->MRC)
1380                         eloop_timeout_add_msec(ctx->eloop,
1381                             RT, callback, ifp);
1382                 else if (state->MRC != 0 && state->MRCcallback)
1383                         eloop_timeout_add_msec(ctx->eloop,
1384                             RT, state->MRCcallback, ifp);
1385                 else
1386                         logwarnx("%s: sent %d times with no reply",
1387                             ifp->name, state->RTC);
1388         }
1389         return 0;
1390 }
1391
1392 static void
1393 dhcp6_sendinform(void *arg)
1394 {
1395
1396         dhcp6_sendmessage(arg, dhcp6_sendinform);
1397 }
1398
1399 static void
1400 dhcp6_senddiscover(void *arg)
1401 {
1402
1403         dhcp6_sendmessage(arg, dhcp6_senddiscover);
1404 }
1405
1406 static void
1407 dhcp6_sendrequest(void *arg)
1408 {
1409
1410         dhcp6_sendmessage(arg, dhcp6_sendrequest);
1411 }
1412
1413 static void
1414 dhcp6_sendrebind(void *arg)
1415 {
1416
1417         dhcp6_sendmessage(arg, dhcp6_sendrebind);
1418 }
1419
1420 static void
1421 dhcp6_sendrenew(void *arg)
1422 {
1423
1424         dhcp6_sendmessage(arg, dhcp6_sendrenew);
1425 }
1426
1427 static void
1428 dhcp6_sendconfirm(void *arg)
1429 {
1430
1431         dhcp6_sendmessage(arg, dhcp6_sendconfirm);
1432 }
1433
1434 static void
1435 dhcp6_senddecline(void *arg)
1436 {
1437
1438         dhcp6_sendmessage(arg, dhcp6_senddecline);
1439 }
1440
1441 static void
1442 dhcp6_sendrelease(void *arg)
1443 {
1444
1445         dhcp6_sendmessage(arg, dhcp6_sendrelease);
1446 }
1447
1448 static void
1449 dhcp6_startrenew(void *arg)
1450 {
1451         struct interface *ifp;
1452         struct dhcp6_state *state;
1453
1454         ifp = arg;
1455         if ((state = D6_STATE(ifp)) == NULL)
1456                 return;
1457
1458         /* Only renew in the bound or renew states */
1459         if (state->state != DH6S_BOUND &&
1460             state->state != DH6S_RENEW)
1461                 return;
1462
1463         /* Remove the timeout as the renew may have been forced. */
1464         eloop_timeout_delete(ifp->ctx->eloop, dhcp6_startrenew, ifp);
1465
1466         state->state = DH6S_RENEW;
1467         state->RTC = 0;
1468         state->IMD = REN_MAX_DELAY;
1469         state->IRT = REN_TIMEOUT;
1470         state->MRT = REN_MAX_RT;
1471         state->MRC = 0;
1472
1473         if (dhcp6_makemessage(ifp) == -1)
1474                 logerr("%s: %s", __func__, ifp->name);
1475         else
1476                 dhcp6_sendrenew(ifp);
1477 }
1478
1479 void dhcp6_renew(struct interface *ifp)
1480 {
1481
1482         dhcp6_startrenew(ifp);
1483 }
1484
1485 bool
1486 dhcp6_dadcompleted(const struct interface *ifp)
1487 {
1488         const struct dhcp6_state *state;
1489         const struct ipv6_addr *ap;
1490
1491         state = D6_CSTATE(ifp);
1492         TAILQ_FOREACH(ap, &state->addrs, next) {
1493                 if (ap->flags & IPV6_AF_ADDED &&
1494                     !(ap->flags & IPV6_AF_DADCOMPLETED))
1495                         return false;
1496         }
1497         return true;
1498 }
1499
1500 static void
1501 dhcp6_dadcallback(void *arg)
1502 {
1503         struct ipv6_addr *ia = arg;
1504         struct interface *ifp;
1505         struct dhcp6_state *state;
1506         struct ipv6_addr *ia2;
1507         bool completed, valid, oneduplicated;
1508
1509         completed = (ia->flags & IPV6_AF_DADCOMPLETED);
1510         ia->flags |= IPV6_AF_DADCOMPLETED;
1511         if (ia->addr_flags & IN6_IFF_DUPLICATED)
1512                 logwarnx("%s: DAD detected %s", ia->iface->name, ia->saddr);
1513
1514 #ifdef ND6_ADVERTISE
1515         else
1516                 ipv6nd_advertise(ia);
1517 #endif
1518         if (completed)
1519                 return;
1520
1521         ifp = ia->iface;
1522         state = D6_STATE(ifp);
1523         if (state->state != DH6S_BOUND && state->state != DH6S_DELEGATED)
1524                 return;
1525
1526 #ifdef SMALL
1527         valid = true;
1528 #else
1529         valid = (ia->delegating_prefix == NULL);
1530 #endif
1531         completed = true;
1532         oneduplicated = false;
1533         TAILQ_FOREACH(ia2, &state->addrs, next) {
1534                 if (ia2->flags & IPV6_AF_ADDED &&
1535                     !(ia2->flags & IPV6_AF_DADCOMPLETED))
1536                 {
1537                         completed = false;
1538                         break;
1539                 }
1540                 if (DECLINE_IA(ia))
1541                         oneduplicated = true;
1542         }
1543         if (!completed)
1544                 return;
1545
1546         logdebugx("%s: DHCPv6 DAD completed", ifp->name);
1547
1548         if (oneduplicated && state->state == DH6S_BOUND) {
1549                 dhcp6_startdecline(ifp);
1550                 return;
1551         }
1552
1553         script_runreason(ifp,
1554 #ifndef SMALL
1555             ia->delegating_prefix ? "DELEGATED6" :
1556 #endif
1557             state->reason);
1558         if (valid)
1559                 dhcpcd_daemonise(ifp->ctx);
1560 }
1561
1562 static void
1563 dhcp6_addrequestedaddrs(struct interface *ifp)
1564 {
1565         struct dhcp6_state *state;
1566         size_t i;
1567         struct if_ia *ia;
1568         struct ipv6_addr *a;
1569
1570         state = D6_STATE(ifp);
1571         /* Add any requested prefixes / addresses */
1572         for (i = 0; i < ifp->options->ia_len; i++) {
1573                 ia = &ifp->options->ia[i];
1574                 if (!((ia->ia_type == D6_OPTION_IA_PD && ia->prefix_len) ||
1575                     !IN6_IS_ADDR_UNSPECIFIED(&ia->addr)))
1576                         continue;
1577                 a = ipv6_newaddr(ifp, &ia->addr,
1578                         /*
1579                          * RFC 5942 Section 5
1580                          * We cannot assume any prefix length, nor tie the
1581                          * address to an existing one as it could expire
1582                          * before the address.
1583                          * As such we just give it a 128 prefix.
1584                          */
1585                     ia->ia_type == D6_OPTION_IA_PD ? ia->prefix_len : 128,
1586                     IPV6_AF_REQUEST);
1587                 if (a == NULL)
1588                         continue;
1589                 a->dadcallback = dhcp6_dadcallback;
1590                 memcpy(&a->iaid, &ia->iaid, sizeof(a->iaid));
1591                 a->ia_type = ia->ia_type;
1592                 TAILQ_INSERT_TAIL(&state->addrs, a, next);
1593         }
1594 }
1595
1596 static void
1597 dhcp6_startdiscover(void *arg)
1598 {
1599         struct interface *ifp;
1600         struct dhcp6_state *state;
1601         int llevel;
1602
1603         ifp = arg;
1604         state = D6_STATE(ifp);
1605 #ifndef SMALL
1606         if (state->reason == NULL || strcmp(state->reason, "TIMEOUT6") != 0)
1607                 dhcp6_delete_delegates(ifp);
1608 #endif
1609         if (state->new == NULL && !state->failed)
1610                 llevel = LOG_INFO;
1611         else
1612                 llevel = LOG_DEBUG;
1613         logmessage(llevel, "%s: soliciting a DHCPv6 lease", ifp->name);
1614         state->state = DH6S_DISCOVER;
1615         state->RTC = 0;
1616         state->IMD = SOL_MAX_DELAY;
1617         state->IRT = SOL_TIMEOUT;
1618         state->MRT = state->sol_max_rt;
1619         state->MRC = SOL_MAX_RC;
1620
1621         eloop_timeout_delete(ifp->ctx->eloop, NULL, ifp);
1622         free(state->new);
1623         state->new = NULL;
1624         state->new_len = 0;
1625
1626         if (dhcp6_makemessage(ifp) == -1)
1627                 logerr("%s: %s", __func__, ifp->name);
1628         else
1629                 dhcp6_senddiscover(ifp);
1630 }
1631
1632 static void
1633 dhcp6_startinform(void *arg)
1634 {
1635         struct interface *ifp;
1636         struct dhcp6_state *state;
1637         int llevel;
1638
1639         ifp = arg;
1640         state = D6_STATE(ifp);
1641         if (state->new == NULL && !state->failed)
1642                 llevel = LOG_INFO;
1643         else
1644                 llevel = LOG_DEBUG;
1645         logmessage(llevel, "%s: requesting DHCPv6 information", ifp->name);
1646         state->state = DH6S_INFORM;
1647         state->RTC = 0;
1648         state->IMD = INF_MAX_DELAY;
1649         state->IRT = INF_TIMEOUT;
1650         state->MRT = state->inf_max_rt;
1651         state->MRC = 0;
1652
1653         eloop_timeout_delete(ifp->ctx->eloop, NULL, ifp);
1654         if (dhcp6_makemessage(ifp) == -1) {
1655                 logerr("%s: %s", __func__, ifp->name);
1656                 return;
1657         }
1658         dhcp6_sendinform(ifp);
1659         /* RFC3315 18.1.2 says that if CONFIRM failed then the prior addresses
1660          * SHOULD be used. The wording here is poor, because the addresses are
1661          * merely one facet of the lease as a whole.
1662          * This poor wording might explain the lack of similar text for INFORM
1663          * in 18.1.5 because there are no addresses in the INFORM message. */
1664         eloop_timeout_add_sec(ifp->ctx->eloop,
1665             INF_MAX_RD, dhcp6_failinform, ifp);
1666 }
1667
1668 static bool
1669 dhcp6_startdiscoinform(struct interface *ifp)
1670 {
1671         unsigned long long opts = ifp->options->options;
1672
1673         if (opts & DHCPCD_IA_FORCED || ipv6nd_hasradhcp(ifp, true))
1674                 dhcp6_startdiscover(ifp);
1675         else if (opts & DHCPCD_INFORM6 || ipv6nd_hasradhcp(ifp, false))
1676                 dhcp6_startinform(ifp);
1677         else
1678                 return false;
1679         return true;
1680 }
1681
1682 static void
1683 dhcp6_leaseextend(struct interface *ifp)
1684 {
1685         struct dhcp6_state *state = D6_STATE(ifp);
1686         struct ipv6_addr *ia;
1687
1688         logwarnx("%s: extending DHCPv6 lease", ifp->name);
1689         TAILQ_FOREACH(ia, &state->addrs, next) {
1690                 ia->flags |= IPV6_AF_EXTENDED;
1691                 /* Set infinite lifetimes. */
1692                 ia->prefix_pltime = ND6_INFINITE_LIFETIME;
1693                 ia->prefix_vltime = ND6_INFINITE_LIFETIME;
1694         }
1695 }
1696
1697 static void
1698 dhcp6_fail(struct interface *ifp)
1699 {
1700         struct dhcp6_state *state = D6_STATE(ifp);
1701
1702         state->failed = true;
1703
1704         /* RFC3315 18.1.2 says that prior addresses SHOULD be used on failure.
1705          * RFC2131 3.2.3 says that MAY chose to use the prior address.
1706          * Because dhcpcd was written first for RFC2131, we have the LASTLEASE
1707          * option which defaults to off as that makes the most sense for
1708          * mobile clients.
1709          * dhcpcd also has LASTLEASE_EXTEND to extend this lease past it's
1710          * expiry, but this is strictly not RFC compliant in any way or form. */
1711         if (state->new != NULL &&
1712             ifp->options->options & DHCPCD_LASTLEASE_EXTEND)
1713         {
1714                 dhcp6_leaseextend(ifp);
1715                 dhcp6_bind(ifp, NULL, NULL);
1716         } else {
1717                 dhcp6_freedrop_addrs(ifp, 1, NULL);
1718 #ifndef SMALL
1719                 dhcp6_delete_delegates(ifp);
1720 #endif
1721                 free(state->old);
1722                 state->old = state->new;
1723                 state->old_len = state->new_len;
1724                 state->new = NULL;
1725                 state->new_len = 0;
1726                 if (state->old != NULL)
1727                         script_runreason(ifp, "EXPIRE6");
1728                 dhcp_unlink(ifp->ctx, state->leasefile);
1729                 dhcp6_addrequestedaddrs(ifp);
1730         }
1731
1732         if (!dhcp6_startdiscoinform(ifp)) {
1733                 logwarnx("%s: no advertising IPv6 router wants DHCP",ifp->name);
1734                 state->state = DH6S_INIT;
1735                 eloop_timeout_delete(ifp->ctx->eloop, NULL, ifp);
1736         }
1737 }
1738
1739 static int
1740 dhcp6_failloglevel(struct interface *ifp)
1741 {
1742         const struct dhcp6_state *state = D6_CSTATE(ifp);
1743
1744         return state->failed ? LOG_DEBUG : LOG_ERR;
1745 }
1746
1747 static void
1748 dhcp6_failconfirm(void *arg)
1749 {
1750         struct interface *ifp = arg;
1751         int llevel = dhcp6_failloglevel(ifp);
1752
1753         logmessage(llevel, "%s: failed to confirm prior DHCPv6 address",
1754             ifp->name);
1755         dhcp6_fail(ifp);
1756 }
1757
1758 static void
1759 dhcp6_failrequest(void *arg)
1760 {
1761         struct interface *ifp = arg;
1762         int llevel = dhcp6_failloglevel(ifp);
1763
1764         logmessage(llevel, "%s: failed to request DHCPv6 address", ifp->name);
1765         dhcp6_fail(ifp);
1766 }
1767
1768 static void
1769 dhcp6_failinform(void *arg)
1770 {
1771         struct interface *ifp = arg;
1772         int llevel = dhcp6_failloglevel(ifp);
1773
1774         logmessage(llevel, "%s: failed to request DHCPv6 information",
1775             ifp->name);
1776         dhcp6_fail(ifp);
1777 }
1778
1779 #ifndef SMALL
1780 static void
1781 dhcp6_failrebind(void *arg)
1782 {
1783         struct interface *ifp = arg;
1784
1785         logerrx("%s: failed to rebind prior DHCPv6 delegation", ifp->name);
1786         dhcp6_fail(ifp);
1787 }
1788
1789 static int
1790 dhcp6_hasprefixdelegation(struct interface *ifp)
1791 {
1792         size_t i;
1793         uint16_t t;
1794
1795         t = 0;
1796         for (i = 0; i < ifp->options->ia_len; i++) {
1797                 if (t && t != ifp->options->ia[i].ia_type) {
1798                         if (t == D6_OPTION_IA_PD ||
1799                             ifp->options->ia[i].ia_type == D6_OPTION_IA_PD)
1800                                 return 2;
1801                 }
1802                 t = ifp->options->ia[i].ia_type;
1803         }
1804         return t == D6_OPTION_IA_PD ? 1 : 0;
1805 }
1806 #endif
1807
1808 static void
1809 dhcp6_startrebind(void *arg)
1810 {
1811         struct interface *ifp;
1812         struct dhcp6_state *state;
1813 #ifndef SMALL
1814         int pd;
1815 #endif
1816
1817         ifp = arg;
1818         eloop_timeout_delete(ifp->ctx->eloop, dhcp6_sendrenew, ifp);
1819         state = D6_STATE(ifp);
1820         if (state->state == DH6S_RENEW)
1821                 logwarnx("%s: failed to renew DHCPv6, rebinding", ifp->name);
1822         else
1823                 loginfox("%s: rebinding prior DHCPv6 lease", ifp->name);
1824         state->state = DH6S_REBIND;
1825         state->RTC = 0;
1826         state->MRC = 0;
1827
1828 #ifndef SMALL
1829         /* RFC 3633 section 12.1 */
1830         pd = dhcp6_hasprefixdelegation(ifp);
1831         if (pd) {
1832                 state->IMD = CNF_MAX_DELAY;
1833                 state->IRT = CNF_TIMEOUT;
1834                 state->MRT = CNF_MAX_RT;
1835         } else
1836 #endif
1837         {
1838                 state->IMD = REB_MAX_DELAY;
1839                 state->IRT = REB_TIMEOUT;
1840                 state->MRT = REB_MAX_RT;
1841         }
1842
1843         if (dhcp6_makemessage(ifp) == -1)
1844                 logerr("%s: %s", __func__, ifp->name);
1845         else
1846                 dhcp6_sendrebind(ifp);
1847
1848 #ifndef SMALL
1849         /* RFC 3633 section 12.1 */
1850         if (pd)
1851                 eloop_timeout_add_sec(ifp->ctx->eloop,
1852                     CNF_MAX_RD, dhcp6_failrebind, ifp);
1853 #endif
1854 }
1855
1856
1857 static void
1858 dhcp6_startrequest(struct interface *ifp)
1859 {
1860         struct dhcp6_state *state;
1861
1862         eloop_timeout_delete(ifp->ctx->eloop, dhcp6_senddiscover, ifp);
1863         state = D6_STATE(ifp);
1864         state->state = DH6S_REQUEST;
1865         state->RTC = 0;
1866         state->IMD = 0;
1867         state->IRT = REQ_TIMEOUT;
1868         state->MRT = REQ_MAX_RT;
1869         state->MRC = REQ_MAX_RC;
1870         state->MRCcallback = dhcp6_failrequest;
1871
1872         if (dhcp6_makemessage(ifp) == -1) {
1873                 logerr("%s: %s", __func__, ifp->name);
1874                 return;
1875         }
1876
1877         dhcp6_sendrequest(ifp);
1878 }
1879
1880 static void
1881 dhcp6_startconfirm(struct interface *ifp)
1882 {
1883         struct dhcp6_state *state;
1884         struct ipv6_addr *ia;
1885
1886         state = D6_STATE(ifp);
1887
1888         TAILQ_FOREACH(ia, &state->addrs, next) {
1889                 if (!DECLINE_IA(ia))
1890                         continue;
1891                 logerrx("%s: prior DHCPv6 has a duplicated address", ifp->name);
1892                 dhcp6_startdecline(ifp);
1893                 return;
1894         }
1895
1896         state->state = DH6S_CONFIRM;
1897         state->RTC = 0;
1898         state->IMD = CNF_MAX_DELAY;
1899         state->IRT = CNF_TIMEOUT;
1900         state->MRT = CNF_MAX_RT;
1901         state->MRC = CNF_MAX_RC;
1902
1903         loginfox("%s: confirming prior DHCPv6 lease", ifp->name);
1904
1905         if (dhcp6_makemessage(ifp) == -1) {
1906                 logerr("%s: %s", __func__, ifp->name);
1907                 return;
1908         }
1909         dhcp6_sendconfirm(ifp);
1910         eloop_timeout_add_sec(ifp->ctx->eloop,
1911             CNF_MAX_RD, dhcp6_failconfirm, ifp);
1912 }
1913
1914 static void
1915 dhcp6_startexpire(void *arg)
1916 {
1917         struct interface *ifp;
1918
1919         ifp = arg;
1920         eloop_timeout_delete(ifp->ctx->eloop, dhcp6_sendrebind, ifp);
1921
1922         logerrx("%s: DHCPv6 lease expired", ifp->name);
1923         dhcp6_fail(ifp);
1924 }
1925
1926 static void
1927 dhcp6_faildecline(void *arg)
1928 {
1929         struct interface *ifp = arg;
1930
1931         logerrx("%s: failed to decline duplicated DHCPv6 addresses", ifp->name);
1932         dhcp6_fail(ifp);
1933 }
1934
1935 static void
1936 dhcp6_startdecline(struct interface *ifp)
1937 {
1938         struct dhcp6_state *state;
1939
1940         state = D6_STATE(ifp);
1941         loginfox("%s: declining failed DHCPv6 addresses", ifp->name);
1942         state->state = DH6S_DECLINE;
1943         state->RTC = 0;
1944         state->IMD = 0;
1945         state->IRT = DEC_TIMEOUT;
1946         state->MRT = 0;
1947         state->MRC = DEC_MAX_RC;
1948         state->MRCcallback = dhcp6_faildecline;
1949
1950         if (dhcp6_makemessage(ifp) == -1)
1951                 logerr("%s: %s", __func__, ifp->name);
1952         else
1953                 dhcp6_senddecline(ifp);
1954 }
1955
1956 static void
1957 dhcp6_finishrelease(void *arg)
1958 {
1959         struct interface *ifp;
1960         struct dhcp6_state *state;
1961
1962         ifp = (struct interface *)arg;
1963         if ((state = D6_STATE(ifp)) != NULL) {
1964                 state->state = DH6S_RELEASED;
1965                 dhcp6_drop(ifp, "RELEASE6");
1966         }
1967 }
1968
1969 static void
1970 dhcp6_startrelease(struct interface *ifp)
1971 {
1972         struct dhcp6_state *state;
1973
1974         state = D6_STATE(ifp);
1975         if (state->state != DH6S_BOUND)
1976                 return;
1977
1978         state->state = DH6S_RELEASE;
1979         state->RTC = 0;
1980         state->IMD = REL_MAX_DELAY;
1981         state->IRT = REL_TIMEOUT;
1982         state->MRT = REL_MAX_RT;
1983         /* MRC of REL_MAX_RC is optional in RFC 3315 18.1.6 */
1984 #if 0
1985         state->MRC = REL_MAX_RC;
1986         state->MRCcallback = dhcp6_finishrelease;
1987 #else
1988         state->MRC = 0;
1989         state->MRCcallback = NULL;
1990 #endif
1991
1992         if (dhcp6_makemessage(ifp) == -1)
1993                 logerr("%s: %s", __func__, ifp->name);
1994         else {
1995                 dhcp6_sendrelease(ifp);
1996                 dhcp6_finishrelease(ifp);
1997         }
1998 }
1999
2000 static int
2001 dhcp6_checkstatusok(const struct interface *ifp,
2002     struct dhcp6_message *m, uint8_t *p, size_t len)
2003 {
2004         struct dhcp6_state *state;
2005         uint8_t *opt;
2006         uint16_t opt_len, code;
2007         size_t mlen;
2008         void * (*f)(void *, size_t, uint16_t, uint16_t *), *farg;
2009         char buf[32], *sbuf;
2010         const char *status;
2011         int loglevel;
2012
2013         state = D6_STATE(ifp);
2014         f = p ? dhcp6_findoption : dhcp6_findmoption;
2015         if (p)
2016                 farg = p;
2017         else
2018                 farg = m;
2019         if ((opt = f(farg, len, D6_OPTION_STATUS_CODE, &opt_len)) == NULL) {
2020                 //logdebugx("%s: no status", ifp->name);
2021                 state->lerror = 0;
2022                 errno = ESRCH;
2023                 return 0;
2024         }
2025
2026         if (opt_len < sizeof(code)) {
2027                 logerrx("%s: status truncated", ifp->name);
2028                 return -1;
2029         }
2030         memcpy(&code, opt, sizeof(code));
2031         code = ntohs(code);
2032         if (code == D6_STATUS_OK) {
2033                 state->lerror = 0;
2034                 errno = 0;
2035                 return 0;
2036         }
2037
2038         /* Anything after the code is a message. */
2039         opt += sizeof(code);
2040         mlen = opt_len - sizeof(code);
2041         if (mlen == 0) {
2042                 sbuf = NULL;
2043                 if (code < sizeof(dhcp6_statuses) / sizeof(char *))
2044                         status = dhcp6_statuses[code];
2045                 else {
2046                         snprintf(buf, sizeof(buf), "Unknown Status (%d)", code);
2047                         status = buf;
2048                 }
2049         } else {
2050                 if ((sbuf = malloc(mlen + 1)) == NULL) {
2051                         logerr(__func__);
2052                         return -1;
2053                 }
2054                 memcpy(sbuf, opt, mlen);
2055                 sbuf[mlen] = '\0';
2056                 status = sbuf;
2057         }
2058
2059         if (state->lerror == code || state->state == DH6S_INIT)
2060                 loglevel = LOG_DEBUG;
2061         else
2062                 loglevel = LOG_ERR;
2063         logmessage(loglevel, "%s: DHCPv6 REPLY: %s", ifp->name, status);
2064         free(sbuf);
2065         state->lerror = code;
2066         errno = 0;
2067
2068         if (code != 0 && ifp->ctx->options & DHCPCD_TEST)
2069                 eloop_exit(ifp->ctx->eloop, EXIT_FAILURE);
2070
2071         return (int)code;
2072 }
2073
2074 const struct ipv6_addr *
2075 dhcp6_iffindaddr(const struct interface *ifp, const struct in6_addr *addr,
2076     unsigned int flags)
2077 {
2078         const struct dhcp6_state *state;
2079         const struct ipv6_addr *ap;
2080
2081         if ((state = D6_STATE(ifp)) != NULL) {
2082                 TAILQ_FOREACH(ap, &state->addrs, next) {
2083                         if (ipv6_findaddrmatch(ap, addr, flags))
2084                                 return ap;
2085                 }
2086         }
2087         return NULL;
2088 }
2089
2090 struct ipv6_addr *
2091 dhcp6_findaddr(struct dhcpcd_ctx *ctx, const struct in6_addr *addr,
2092     unsigned int flags)
2093 {
2094         struct interface *ifp;
2095         struct ipv6_addr *ap;
2096         struct dhcp6_state *state;
2097
2098         TAILQ_FOREACH(ifp, ctx->ifaces, next) {
2099                 if ((state = D6_STATE(ifp)) != NULL) {
2100                         TAILQ_FOREACH(ap, &state->addrs, next) {
2101                                 if (ipv6_findaddrmatch(ap, addr, flags))
2102                                         return ap;
2103                         }
2104                 }
2105         }
2106         return NULL;
2107 }
2108
2109 static int
2110 dhcp6_findna(struct interface *ifp, uint16_t ot, const uint8_t *iaid,
2111     uint8_t *d, size_t l, const struct timespec *acquired)
2112 {
2113         struct dhcp6_state *state;
2114         uint8_t *o, *nd;
2115         uint16_t ol;
2116         struct ipv6_addr *a;
2117         int i;
2118         struct dhcp6_ia_addr ia;
2119
2120         i = 0;
2121         state = D6_STATE(ifp);
2122         while ((o = dhcp6_findoption(d, l, D6_OPTION_IA_ADDR, &ol))) {
2123                 /* Set d and l first to ensure we find the next option. */
2124                 nd = o + ol;
2125                 l -= (size_t)(nd - d);
2126                 d = nd;
2127                 if (ol < sizeof(ia)) {
2128                         errno = EINVAL;
2129                         logerrx("%s: IA Address option truncated", ifp->name);
2130                         continue;
2131                 }
2132                 memcpy(&ia, o, sizeof(ia));
2133                 ia.pltime = ntohl(ia.pltime);
2134                 ia.vltime = ntohl(ia.vltime);
2135                 /* RFC 3315 22.6 */
2136                 if (ia.pltime > ia.vltime) {
2137                         errno = EINVAL;
2138                         logerr("%s: IA Address pltime %"PRIu32
2139                             " > vltime %"PRIu32,
2140                             ifp->name, ia.pltime, ia.vltime);
2141                         continue;
2142                 }
2143                 TAILQ_FOREACH(a, &state->addrs, next) {
2144                         if (ipv6_findaddrmatch(a, &ia.addr, 0))
2145                                 break;
2146                 }
2147                 if (a == NULL) {
2148                         /*
2149                          * RFC 5942 Section 5
2150                          * We cannot assume any prefix length, nor tie the
2151                          * address to an existing one as it could expire
2152                          * before the address.
2153                          * As such we just give it a 128 prefix.
2154                          */
2155                         a = ipv6_newaddr(ifp, &ia.addr, 128, IPV6_AF_ONLINK);
2156                         a->dadcallback = dhcp6_dadcallback;
2157                         a->ia_type = ot;
2158                         memcpy(a->iaid, iaid, sizeof(a->iaid));
2159                         a->created = *acquired;
2160
2161                         TAILQ_INSERT_TAIL(&state->addrs, a, next);
2162                 } else {
2163                         if (!(a->flags & IPV6_AF_ONLINK))
2164                                 a->flags |= IPV6_AF_ONLINK | IPV6_AF_NEW;
2165                         a->flags &= ~(IPV6_AF_STALE | IPV6_AF_EXTENDED);
2166                 }
2167                 a->acquired = *acquired;
2168                 a->prefix_pltime = ia.pltime;
2169                 if (a->prefix_vltime != ia.vltime) {
2170                         a->flags |= IPV6_AF_NEW;
2171                         a->prefix_vltime = ia.vltime;
2172                 }
2173                 if (a->prefix_pltime && a->prefix_pltime < state->lowpl)
2174                     state->lowpl = a->prefix_pltime;
2175                 if (a->prefix_vltime && a->prefix_vltime > state->expire)
2176                     state->expire = a->prefix_vltime;
2177                 i++;
2178         }
2179         return i;
2180 }
2181
2182 #ifndef SMALL
2183 static int
2184 dhcp6_findpd(struct interface *ifp, const uint8_t *iaid,
2185     uint8_t *d, size_t l, const struct timespec *acquired)
2186 {
2187         struct dhcp6_state *state;
2188         uint8_t *o, *nd;
2189         struct ipv6_addr *a;
2190         int i;
2191         uint8_t nb, *pw;
2192         uint16_t ol;
2193         struct dhcp6_pd_addr pdp;
2194         struct in6_addr pdp_prefix;
2195
2196         i = 0;
2197         state = D6_STATE(ifp);
2198         while ((o = dhcp6_findoption(d, l, D6_OPTION_IAPREFIX, &ol))) {
2199                 /* Set d and l first to ensure we find the next option. */
2200                 nd = o + ol;
2201                 l -= (size_t)(nd - d);
2202                 d = nd;
2203                 if (ol < sizeof(pdp)) {
2204                         errno = EINVAL;
2205                         logerrx("%s: IA Prefix option truncated", ifp->name);
2206                         continue;
2207                 }
2208
2209                 memcpy(&pdp, o, sizeof(pdp));
2210                 pdp.pltime = ntohl(pdp.pltime);
2211                 pdp.vltime = ntohl(pdp.vltime);
2212                 /* RFC 3315 22.6 */
2213                 if (pdp.pltime > pdp.vltime) {
2214                         errno = EINVAL;
2215                         logerrx("%s: IA Prefix pltime %"PRIu32
2216                             " > vltime %"PRIu32,
2217                             ifp->name, pdp.pltime, pdp.vltime);
2218                         continue;
2219                 }
2220
2221                 o += sizeof(pdp);
2222                 ol = (uint16_t)(ol - sizeof(pdp));
2223
2224                 /* pdp.prefix is not aligned so copy it out. */
2225                 memcpy(&pdp_prefix, &pdp.prefix, sizeof(pdp_prefix));
2226                 TAILQ_FOREACH(a, &state->addrs, next) {
2227                         if (IN6_ARE_ADDR_EQUAL(&a->prefix, &pdp_prefix))
2228                                 break;
2229                 }
2230
2231                 if (a == NULL) {
2232                         a = ipv6_newaddr(ifp, &pdp_prefix, pdp.prefix_len,
2233                             IPV6_AF_DELEGATEDPFX);
2234                         if (a == NULL)
2235                                 break;
2236                         a->created = *acquired;
2237                         a->dadcallback = dhcp6_dadcallback;
2238                         a->ia_type = D6_OPTION_IA_PD;
2239                         memcpy(a->iaid, iaid, sizeof(a->iaid));
2240                         TAILQ_INSERT_TAIL(&state->addrs, a, next);
2241                 } else {
2242                         if (!(a->flags & IPV6_AF_DELEGATEDPFX))
2243                                 a->flags |= IPV6_AF_NEW | IPV6_AF_DELEGATEDPFX;
2244                         a->flags &= ~(IPV6_AF_STALE |
2245                                       IPV6_AF_EXTENDED |
2246                                       IPV6_AF_REQUEST);
2247                         if (a->prefix_vltime != pdp.vltime)
2248                                 a->flags |= IPV6_AF_NEW;
2249                 }
2250
2251                 a->acquired = *acquired;
2252                 a->prefix_pltime = pdp.pltime;
2253                 a->prefix_vltime = pdp.vltime;
2254
2255                 if (a->prefix_pltime && a->prefix_pltime < state->lowpl)
2256                         state->lowpl = a->prefix_pltime;
2257                 if (a->prefix_vltime && a->prefix_vltime > state->expire)
2258                         state->expire = a->prefix_vltime;
2259                 i++;
2260
2261                 a->prefix_exclude_len = 0;
2262                 memset(&a->prefix_exclude, 0, sizeof(a->prefix_exclude));
2263                 o = dhcp6_findoption(o, ol, D6_OPTION_PD_EXCLUDE, &ol);
2264                 if (o == NULL)
2265                         continue;
2266
2267                 /* RFC 6603 4.2 says option length MUST be between 2 and 17.
2268                  * This allows 1 octet for prefix length and 16 for the
2269                  * subnet ID. */
2270                 if (ol < 2 || ol > 17) {
2271                         logerrx("%s: invalid PD Exclude option", ifp->name);
2272                         continue;
2273                 }
2274
2275                 /* RFC 6603 4.2 says prefix length MUST be between the
2276                  * length of the IAPREFIX prefix length + 1 and 128. */
2277                 if (*o < a->prefix_len + 1 || *o > 128) {
2278                         logerrx("%s: invalid PD Exclude length", ifp->name);
2279                         continue;
2280                 }
2281
2282                 ol--;
2283                 /* Check option length matches prefix length. */
2284                 if (((*o - a->prefix_len - 1) / NBBY) + 1 != ol) {
2285                         logerrx("%s: PD Exclude length mismatch", ifp->name);
2286                         continue;
2287                 }
2288                 a->prefix_exclude_len = *o++;
2289
2290                 memcpy(&a->prefix_exclude, &a->prefix,
2291                     sizeof(a->prefix_exclude));
2292                 nb = a->prefix_len % NBBY;
2293                 if (nb)
2294                         ol--;
2295                 pw = a->prefix_exclude.s6_addr +
2296                     (a->prefix_exclude_len / NBBY) - 1;
2297                 while (ol-- > 0)
2298                         *pw-- = *o++;
2299                 if (nb)
2300                         *pw = (uint8_t)(*pw | (*o >> nb));
2301         }
2302         return i;
2303 }
2304 #endif
2305
2306 static int
2307 dhcp6_findia(struct interface *ifp, struct dhcp6_message *m, size_t l,
2308     const char *sfrom, const struct timespec *acquired)
2309 {
2310         struct dhcp6_state *state;
2311         const struct if_options *ifo;
2312         struct dhcp6_option o;
2313         uint8_t *d, *p;
2314         struct dhcp6_ia_na ia;
2315         int i, e, error;
2316         size_t j;
2317         uint16_t nl;
2318         uint8_t iaid[4];
2319         char buf[sizeof(iaid) * 3];
2320         struct ipv6_addr *ap;
2321         struct if_ia *ifia;
2322
2323         if (l < sizeof(*m)) {
2324                 /* Should be impossible with guards at packet in
2325                  * and reading leases */
2326                 errno = EINVAL;
2327                 return -1;
2328         }
2329
2330         ifo = ifp->options;
2331         i = e = 0;
2332         state = D6_STATE(ifp);
2333         TAILQ_FOREACH(ap, &state->addrs, next) {
2334                 if (!(ap->flags & IPV6_AF_DELEGATED))
2335                         ap->flags |= IPV6_AF_STALE;
2336         }
2337
2338         d = (uint8_t *)m + sizeof(*m);
2339         l -= sizeof(*m);
2340         while (l > sizeof(o)) {
2341                 memcpy(&o, d, sizeof(o));
2342                 o.len = ntohs(o.len);
2343                 if (o.len > l || sizeof(o) + o.len > l) {
2344                         errno = EINVAL;
2345                         logerrx("%s: option overflow", ifp->name);
2346                         break;
2347                 }
2348                 p = d + sizeof(o);
2349                 d = p + o.len;
2350                 l -= sizeof(o) + o.len;
2351
2352                 o.code = ntohs(o.code);
2353                 switch(o.code) {
2354                 case D6_OPTION_IA_TA:
2355                         nl = 4;
2356                         break;
2357                 case D6_OPTION_IA_NA:
2358                 case D6_OPTION_IA_PD:
2359                         nl = 12;
2360                         break;
2361                 default:
2362                         continue;
2363                 }
2364                 if (o.len < nl) {
2365                         errno = EINVAL;
2366                         logerrx("%s: IA option truncated", ifp->name);
2367                         continue;
2368                 }
2369
2370                 memcpy(&ia, p, nl);
2371                 p += nl;
2372                 o.len = (uint16_t)(o.len - nl);
2373
2374                 for (j = 0; j < ifo->ia_len; j++) {
2375                         ifia = &ifo->ia[j];
2376                         if (ifia->ia_type == o.code &&
2377                             memcmp(ifia->iaid, ia.iaid, sizeof(ia.iaid)) == 0)
2378                                 break;
2379                 }
2380                 if (j == ifo->ia_len &&
2381                     !(ifo->ia_len == 0 && ifp->ctx->options & DHCPCD_DUMPLEASE))
2382                 {
2383                         logdebugx("%s: ignoring unrequested IAID %s",
2384                             ifp->name,
2385                             hwaddr_ntoa(ia.iaid, sizeof(ia.iaid),
2386                             buf, sizeof(buf)));
2387                         continue;
2388                 }
2389
2390                 if (o.code != D6_OPTION_IA_TA) {
2391                         ia.t1 = ntohl(ia.t1);
2392                         ia.t2 = ntohl(ia.t2);
2393                         /* RFC 3315 22.4 */
2394                         if (ia.t2 > 0 && ia.t1 > ia.t2) {
2395                                 logwarnx("%s: IAID %s T1(%d) > T2(%d) from %s",
2396                                     ifp->name,
2397                                     hwaddr_ntoa(iaid, sizeof(iaid), buf,
2398                                                 sizeof(buf)),
2399                                     ia.t1, ia.t2, sfrom);
2400                                 continue;
2401                         }
2402                 } else
2403                         ia.t1 = ia.t2 = 0; /* appease gcc */
2404                 if ((error = dhcp6_checkstatusok(ifp, NULL, p, o.len)) != 0) {
2405                         if (error == D6_STATUS_NOBINDING)
2406                                 state->has_no_binding = true;
2407                         e = 1;
2408                         continue;
2409                 }
2410                 if (o.code == D6_OPTION_IA_PD) {
2411 #ifndef SMALL
2412                         if (dhcp6_findpd(ifp, ia.iaid, p, o.len,
2413                                          acquired) == 0)
2414                         {
2415                                 logwarnx("%s: %s: DHCPv6 REPLY missing Prefix",
2416                                     ifp->name, sfrom);
2417                                 continue;
2418                         }
2419 #endif
2420                 } else {
2421                         if (dhcp6_findna(ifp, o.code, ia.iaid, p, o.len,
2422                                          acquired) == 0)
2423                         {
2424                                 logwarnx("%s: %s: DHCPv6 REPLY missing "
2425                                     "IA Address",
2426                                     ifp->name, sfrom);
2427                                 continue;
2428                         }
2429                 }
2430                 if (o.code != D6_OPTION_IA_TA) {
2431                         if (ia.t1 != 0 &&
2432                             (ia.t1 < state->renew || state->renew == 0))
2433                                 state->renew = ia.t1;
2434                         if (ia.t2 != 0 &&
2435                             (ia.t2 < state->rebind || state->rebind == 0))
2436                                 state->rebind = ia.t2;
2437                 }
2438                 i++;
2439         }
2440
2441         if (i == 0 && e)
2442                 return -1;
2443         return i;
2444 }
2445
2446 #ifndef SMALL
2447 static void
2448 dhcp6_deprecatedele(struct ipv6_addr *ia)
2449 {
2450         struct ipv6_addr *da, *dan, *dda;
2451         struct timespec now;
2452         struct dhcp6_state *state;
2453
2454         timespecclear(&now);
2455         TAILQ_FOREACH_SAFE(da, &ia->pd_pfxs, pd_next, dan) {
2456                 if (ia->prefix_vltime == 0) {
2457                         if (da->prefix_vltime != 0)
2458                                 da->prefix_vltime = 0;
2459                         else
2460                                 continue;
2461                 } else if (da->prefix_pltime != 0)
2462                         da->prefix_pltime = 0;
2463                 else
2464                         continue;
2465
2466                 if (ipv6_doaddr(da, &now) != -1)
2467                         continue;
2468
2469                 /* Delegation deleted, forget it. */
2470                 TAILQ_REMOVE(&ia->pd_pfxs, da, pd_next);
2471
2472                 /* Delete it from the interface. */
2473                 state = D6_STATE(da->iface);
2474                 TAILQ_FOREACH(dda, &state->addrs, next) {
2475                         if (IN6_ARE_ADDR_EQUAL(&dda->addr, &da->addr))
2476                                 break;
2477                 }
2478                 if (dda != NULL) {
2479                         TAILQ_REMOVE(&state->addrs, dda, next);
2480                         ipv6_freeaddr(dda);
2481                 }
2482         }
2483 }
2484 #endif
2485
2486 static void
2487 dhcp6_deprecateaddrs(struct ipv6_addrhead *addrs)
2488 {
2489         struct ipv6_addr *ia, *ian;
2490
2491         TAILQ_FOREACH_SAFE(ia, addrs, next, ian) {
2492                 if (ia->flags & IPV6_AF_EXTENDED)
2493                         ;
2494                 else if (ia->flags & IPV6_AF_STALE) {
2495                         if (ia->prefix_vltime != 0)
2496                                 logdebugx("%s: %s: became stale",
2497                                     ia->iface->name, ia->saddr);
2498                         /* Technically this violates RFC 8415 18.2.10.1,
2499                          * but we need a mechanism to tell the kernel to
2500                          * try and prefer other addresses. */
2501                         ia->prefix_pltime = 0;
2502                 } else if (ia->prefix_vltime == 0)
2503                         loginfox("%s: %s: no valid lifetime",
2504                             ia->iface->name, ia->saddr);
2505                 else
2506                         continue;
2507
2508 #ifndef SMALL
2509                 /* If we delegated from this prefix, deprecate or remove
2510                  * the delegations. */
2511                 if (ia->flags & IPV6_AF_DELEGATEDPFX)
2512                         dhcp6_deprecatedele(ia);
2513 #endif
2514
2515                 if (ia->flags & IPV6_AF_REQUEST) {
2516                         ia->prefix_vltime = ia->prefix_pltime = 0;
2517                         eloop_q_timeout_delete(ia->iface->ctx->eloop,
2518                             ELOOP_QUEUE_ALL, NULL, ia);
2519                         continue;
2520                 }
2521                 TAILQ_REMOVE(addrs, ia, next);
2522                 if (ia->flags & IPV6_AF_EXTENDED)
2523                         ipv6_deleteaddr(ia);
2524                 ipv6_freeaddr(ia);
2525         }
2526 }
2527
2528 static int
2529 dhcp6_validatelease(struct interface *ifp,
2530     struct dhcp6_message *m, size_t len,
2531     const char *sfrom, const struct timespec *acquired)
2532 {
2533         struct dhcp6_state *state;
2534         int nia, ok_errno;
2535         struct timespec aq;
2536
2537         if (len <= sizeof(*m)) {
2538                 logerrx("%s: DHCPv6 lease truncated", ifp->name);
2539                 return -1;
2540         }
2541
2542         state = D6_STATE(ifp);
2543         errno = 0;
2544         if (dhcp6_checkstatusok(ifp, m, NULL, len) != 0)
2545                 return -1;
2546         ok_errno = errno;
2547
2548         state->renew = state->rebind = state->expire = 0;
2549         state->lowpl = ND6_INFINITE_LIFETIME;
2550         if (!acquired) {
2551                 clock_gettime(CLOCK_MONOTONIC, &aq);
2552                 acquired = &aq;
2553         }
2554         state->has_no_binding = false;
2555         nia = dhcp6_findia(ifp, m, len, sfrom, acquired);
2556         if (nia == 0) {
2557                 if (state->state != DH6S_CONFIRM && ok_errno != 0) {
2558                         logerrx("%s: no useable IA found in lease", ifp->name);
2559                         return -1;
2560                 }
2561
2562                 /* We are confirming and have an OK,
2563                  * so look for ia's in our old lease.
2564                  * IA's must have existed here otherwise we would
2565                  * have rejected it earlier. */
2566                 assert(state->new != NULL && state->new_len != 0);
2567                 state->has_no_binding = false;
2568                 nia = dhcp6_findia(ifp, state->new, state->new_len,
2569                     sfrom, acquired);
2570         }
2571         return nia;
2572 }
2573
2574 static ssize_t
2575 dhcp6_readlease(struct interface *ifp, int validate)
2576 {
2577         union {
2578                 struct dhcp6_message dhcp6;
2579                 uint8_t buf[UDPLEN_MAX];
2580         } buf;
2581         struct dhcp6_state *state;
2582         ssize_t bytes;
2583         int fd;
2584         time_t mtime, now;
2585 #ifdef AUTH
2586         uint8_t *o;
2587         uint16_t ol;
2588 #endif
2589
2590         state = D6_STATE(ifp);
2591         if (state->leasefile[0] == '\0') {
2592                 logdebugx("reading standard input");
2593                 bytes = read(fileno(stdin), buf.buf, sizeof(buf.buf));
2594         } else {
2595                 logdebugx("%s: reading lease: %s",
2596                     ifp->name, state->leasefile);
2597                 bytes = dhcp_readfile(ifp->ctx, state->leasefile,
2598                     buf.buf, sizeof(buf.buf));
2599         }
2600         if (bytes == -1)
2601                 goto ex;
2602
2603         if (ifp->ctx->options & DHCPCD_DUMPLEASE || state->leasefile[0] == '\0')
2604                 goto out;
2605
2606         if (bytes == 0)
2607                 goto ex;
2608
2609         /* If not validating IA's and if they have expired,
2610          * skip to the auth check. */
2611         if (!validate)
2612                 goto auth;
2613
2614         if (dhcp_filemtime(ifp->ctx, state->leasefile, &mtime) == -1)
2615                 goto ex;
2616         clock_gettime(CLOCK_MONOTONIC, &state->acquired);
2617         if ((now = time(NULL)) == -1)
2618                 goto ex;
2619         state->acquired.tv_sec -= now - mtime;
2620
2621         /* Check to see if the lease is still valid */
2622         fd = dhcp6_validatelease(ifp, &buf.dhcp6, (size_t)bytes, NULL,
2623             &state->acquired);
2624         if (fd == -1)
2625                 goto ex;
2626
2627         if (state->expire != ND6_INFINITE_LIFETIME &&
2628             (time_t)state->expire < now - mtime &&
2629             !(ifp->options->options & DHCPCD_LASTLEASE_EXTEND))
2630         {
2631                 logdebugx("%s: discarding expired lease", ifp->name);
2632                 bytes = 0;
2633                 goto ex;
2634         }
2635
2636 auth:
2637 #ifdef AUTH
2638         /* Authenticate the message */
2639         o = dhcp6_findmoption(&buf.dhcp6, (size_t)bytes, D6_OPTION_AUTH, &ol);
2640         if (o) {
2641                 if (dhcp_auth_validate(&state->auth, &ifp->options->auth,
2642                     buf.buf, (size_t)bytes, 6, buf.dhcp6.type, o, ol) == NULL)
2643                 {
2644                         logerr("%s: authentication failed", ifp->name);
2645                         bytes = 0;
2646                         goto ex;
2647                 }
2648                 if (state->auth.token)
2649                         logdebugx("%s: validated using 0x%08" PRIu32,
2650                             ifp->name, state->auth.token->secretid);
2651                 else
2652                         loginfox("%s: accepted reconfigure key", ifp->name);
2653         } else if ((ifp->options->auth.options & DHCPCD_AUTH_SENDREQUIRE) ==
2654             DHCPCD_AUTH_SENDREQUIRE)
2655         {
2656                 logerrx("%s: authentication now required", ifp->name);
2657                 goto ex;
2658         }
2659 #endif
2660
2661 out:
2662         free(state->new);
2663         state->new = malloc((size_t)bytes);
2664         if (state->new == NULL) {
2665                 logerr(__func__);
2666                 goto ex;
2667         }
2668
2669         memcpy(state->new, buf.buf, (size_t)bytes);
2670         state->new_len = (size_t)bytes;
2671         return bytes;
2672
2673 ex:
2674         dhcp6_freedrop_addrs(ifp, 0, NULL);
2675         dhcp_unlink(ifp->ctx, state->leasefile);
2676         free(state->new);
2677         state->new = NULL;
2678         state->new_len = 0;
2679         dhcp6_addrequestedaddrs(ifp);
2680         return bytes == 0 ? 0 : -1;
2681 }
2682
2683 static void
2684 dhcp6_startinit(struct interface *ifp)
2685 {
2686         struct dhcp6_state *state;
2687         ssize_t r;
2688         uint8_t has_ta, has_non_ta;
2689         size_t i;
2690
2691         state = D6_STATE(ifp);
2692         state->state = DH6S_INIT;
2693         state->expire = ND6_INFINITE_LIFETIME;
2694         state->lowpl = ND6_INFINITE_LIFETIME;
2695
2696         dhcp6_addrequestedaddrs(ifp);
2697         has_ta = has_non_ta = 0;
2698         for (i = 0; i < ifp->options->ia_len; i++) {
2699                 switch (ifp->options->ia[i].ia_type) {
2700                 case D6_OPTION_IA_TA:
2701                         has_ta = 1;
2702                         break;
2703                 default:
2704                         has_non_ta = 1;
2705                 }
2706         }
2707
2708         if (!(ifp->ctx->options & DHCPCD_TEST) &&
2709             !(has_ta && !has_non_ta) &&
2710             ifp->options->reboot != 0)
2711         {
2712                 r = dhcp6_readlease(ifp, 1);
2713                 if (r == -1) {
2714                         if (errno != ENOENT && errno != ESRCH)
2715                                 logerr("%s: %s", __func__, state->leasefile);
2716                 } else if (r != 0 &&
2717                     !(ifp->options->options & DHCPCD_ANONYMOUS))
2718                 {
2719                         /* RFC 3633 section 12.1 */
2720 #ifndef SMALL
2721                         if (dhcp6_hasprefixdelegation(ifp))
2722                                 dhcp6_startrebind(ifp);
2723                         else
2724 #endif
2725                                 dhcp6_startconfirm(ifp);
2726                         return;
2727                 }
2728         }
2729         dhcp6_startdiscoinform(ifp);
2730 }
2731
2732 #ifndef SMALL
2733 static struct ipv6_addr *
2734 dhcp6_ifdelegateaddr(struct interface *ifp, struct ipv6_addr *prefix,
2735     const struct if_sla *sla, struct if_ia *if_ia)
2736 {
2737         struct dhcp6_state *state;
2738         struct in6_addr addr, daddr;
2739         struct ipv6_addr *ia;
2740         int pfxlen, dadcounter;
2741         uint64_t vl;
2742
2743         /* RFC6603 Section 4.2 */
2744         if (strcmp(ifp->name, prefix->iface->name) == 0) {
2745                 if (prefix->prefix_exclude_len == 0) {
2746                         /* Don't spam the log automatically */
2747                         if (sla != NULL)
2748                                 logwarnx("%s: DHCPv6 server does not support "
2749                                     "OPTION_PD_EXCLUDE",
2750                                     ifp->name);
2751                         return NULL;
2752                 }
2753                 pfxlen = prefix->prefix_exclude_len;
2754                 memcpy(&addr, &prefix->prefix_exclude, sizeof(addr));
2755         } else if ((pfxlen = dhcp6_delegateaddr(&addr, ifp, prefix,
2756             sla, if_ia)) == -1)
2757                 return NULL;
2758
2759         if (sla != NULL && fls64(sla->suffix) > 128 - pfxlen) {
2760                 logerrx("%s: suffix %" PRIu64 " + prefix_len %d > 128",
2761                     ifp->name, sla->suffix, pfxlen);
2762                 return NULL;
2763         }
2764
2765         /* Add our suffix */
2766         if (sla != NULL && sla->suffix != 0) {
2767                 daddr = addr;
2768                 vl = be64dec(addr.s6_addr + 8);
2769                 vl |= sla->suffix;
2770                 be64enc(daddr.s6_addr + 8, vl);
2771         } else {
2772                 dadcounter = ipv6_makeaddr(&daddr, ifp, &addr, pfxlen, 0);
2773                 if (dadcounter == -1) {
2774                         logerrx("%s: error adding slaac to prefix_len %d",
2775                             ifp->name, pfxlen);
2776                         return NULL;
2777                 }
2778         }
2779
2780         /* Find an existing address */
2781         state = D6_STATE(ifp);
2782         TAILQ_FOREACH(ia, &state->addrs, next) {
2783                 if (IN6_ARE_ADDR_EQUAL(&ia->addr, &daddr))
2784                         break;
2785         }
2786         if (ia == NULL) {
2787                 ia = ipv6_newaddr(ifp, &daddr, (uint8_t)pfxlen, IPV6_AF_ONLINK);
2788                 if (ia == NULL)
2789                         return NULL;
2790                 ia->dadcallback = dhcp6_dadcallback;
2791                 memcpy(&ia->iaid, &prefix->iaid, sizeof(ia->iaid));
2792                 ia->created = prefix->acquired;
2793
2794                 TAILQ_INSERT_TAIL(&state->addrs, ia, next);
2795                 TAILQ_INSERT_TAIL(&prefix->pd_pfxs, ia, pd_next);
2796         }
2797         ia->delegating_prefix = prefix;
2798         ia->prefix = addr;
2799         ia->prefix_len = (uint8_t)pfxlen;
2800         ia->acquired = prefix->acquired;
2801         ia->prefix_pltime = prefix->prefix_pltime;
2802         ia->prefix_vltime = prefix->prefix_vltime;
2803
2804         /* If the prefix length hasn't changed,
2805          * don't install a reject route. */
2806         if (prefix->prefix_len == pfxlen)
2807                 prefix->flags |= IPV6_AF_NOREJECT;
2808         else
2809                 prefix->flags &= ~IPV6_AF_NOREJECT;
2810
2811         return ia;
2812 }
2813 #endif
2814
2815 static void
2816 dhcp6_script_try_run(struct interface *ifp, int delegated)
2817 {
2818         struct dhcp6_state *state;
2819         struct ipv6_addr *ap;
2820         int completed;
2821
2822         state = D6_STATE(ifp);
2823         completed = 1;
2824         /* If all addresses have completed DAD run the script */
2825         TAILQ_FOREACH(ap, &state->addrs, next) {
2826                 if (!(ap->flags & IPV6_AF_ADDED))
2827                         continue;
2828                 if (ap->flags & IPV6_AF_ONLINK) {
2829                         if (!(ap->flags & IPV6_AF_DADCOMPLETED) &&
2830                             ipv6_iffindaddr(ap->iface, &ap->addr,
2831                                             IN6_IFF_TENTATIVE))
2832                                 ap->flags |= IPV6_AF_DADCOMPLETED;
2833                         if ((ap->flags & IPV6_AF_DADCOMPLETED) == 0
2834 #ifndef SMALL
2835                             && ((delegated && ap->delegating_prefix) ||
2836                             (!delegated && !ap->delegating_prefix))
2837 #endif
2838                             )
2839                         {
2840                                 completed = 0;
2841                                 break;
2842                         }
2843                 }
2844         }
2845         if (completed) {
2846                 script_runreason(ifp, delegated ? "DELEGATED6" : state->reason);
2847                 if (!delegated)
2848                         dhcpcd_daemonise(ifp->ctx);
2849         } else
2850                 logdebugx("%s: waiting for DHCPv6 DAD to complete", ifp->name);
2851 }
2852
2853 #ifdef SMALL
2854 size_t
2855 dhcp6_find_delegates(__unused struct interface *ifp)
2856 {
2857
2858         return 0;
2859 }
2860 #else
2861 static void
2862 dhcp6_delegate_prefix(struct interface *ifp)
2863 {
2864         struct if_options *ifo;
2865         struct dhcp6_state *state;
2866         struct ipv6_addr *ap;
2867         size_t i, j, k;
2868         struct if_ia *ia;
2869         struct if_sla *sla;
2870         struct interface *ifd;
2871         bool carrier_warned;
2872
2873         ifo = ifp->options;
2874         state = D6_STATE(ifp);
2875
2876         /* Clear the logged flag. */
2877         TAILQ_FOREACH(ap, &state->addrs, next) {
2878                 ap->flags &= ~IPV6_AF_DELEGATEDLOG;
2879         }
2880
2881         TAILQ_FOREACH(ifd, ifp->ctx->ifaces, next) {
2882                 if (!ifd->active)
2883                         continue;
2884                 if (!(ifd->options->options & DHCPCD_CONFIGURE))
2885                         continue;
2886                 k = 0;
2887                 carrier_warned = false;
2888                 TAILQ_FOREACH(ap, &state->addrs, next) {
2889                         if (!(ap->flags & IPV6_AF_DELEGATEDPFX))
2890                                 continue;
2891                         if (!(ap->flags & IPV6_AF_DELEGATEDLOG)) {
2892                                 int loglevel;
2893
2894                                 if (ap->flags & IPV6_AF_NEW)
2895                                         loglevel = LOG_INFO;
2896                                 else
2897                                         loglevel = LOG_DEBUG;
2898                                 /* We only want to log this the once as we loop
2899                                  * through many interfaces first. */
2900                                 ap->flags |= IPV6_AF_DELEGATEDLOG;
2901                                 logmessage(loglevel, "%s: delegated prefix %s",
2902                                     ifp->name, ap->saddr);
2903                                 ap->flags &= ~IPV6_AF_NEW;
2904                         }
2905                         for (i = 0; i < ifo->ia_len; i++) {
2906                                 ia = &ifo->ia[i];
2907                                 if (ia->ia_type != D6_OPTION_IA_PD)
2908                                         continue;
2909                                 if (memcmp(ia->iaid, ap->iaid,
2910                                     sizeof(ia->iaid)))
2911                                         continue;
2912                                 if (ia->sla_len == 0) {
2913                                         /* no SLA configured, so lets
2914                                          * automate it */
2915                                         if (!if_is_link_up(ifd)) {
2916                                                 logdebugx(
2917                                                     "%s: has no carrier, cannot"
2918                                                     " delegate addresses",
2919                                                     ifd->name);
2920                                                 carrier_warned = true;
2921                                                 break;
2922                                         }
2923                                         if (dhcp6_ifdelegateaddr(ifd, ap,
2924                                             NULL, ia))
2925                                                 k++;
2926                                 }
2927                                 for (j = 0; j < ia->sla_len; j++) {
2928                                         sla = &ia->sla[j];
2929                                         if (strcmp(ifd->name, sla->ifname))
2930                                                 continue;
2931                                         if (!if_is_link_up(ifd)) {
2932                                                 logdebugx(
2933                                                     "%s: has no carrier, cannot"
2934                                                     " delegate addresses",
2935                                                     ifd->name);
2936                                                 carrier_warned = true;
2937                                                 break;
2938                                         }
2939                                         if (dhcp6_ifdelegateaddr(ifd, ap,
2940                                             sla, ia))
2941                                                 k++;
2942                                 }
2943                                 if (carrier_warned)
2944                                         break;
2945                         }
2946                         if (carrier_warned)
2947                                 break;
2948                 }
2949                 if (k && !carrier_warned) {
2950                         struct dhcp6_state *s = D6_STATE(ifd);
2951
2952                         ipv6_addaddrs(&s->addrs);
2953                         dhcp6_script_try_run(ifd, 1);
2954                 }
2955         }
2956
2957         /* Now all addresses have been added, rebuild the routing table. */
2958         rt_build(ifp->ctx, AF_INET6);
2959 }
2960
2961 static void
2962 dhcp6_find_delegates1(void *arg)
2963 {
2964
2965         dhcp6_find_delegates(arg);
2966 }
2967
2968 size_t
2969 dhcp6_find_delegates(struct interface *ifp)
2970 {
2971         struct if_options *ifo;
2972         struct dhcp6_state *state;
2973         struct ipv6_addr *ap;
2974         size_t i, j, k;
2975         struct if_ia *ia;
2976         struct if_sla *sla;
2977         struct interface *ifd;
2978
2979         if (ifp->options != NULL &&
2980             !(ifp->options->options & DHCPCD_CONFIGURE))
2981                 return 0;
2982
2983         k = 0;
2984         TAILQ_FOREACH(ifd, ifp->ctx->ifaces, next) {
2985                 ifo = ifd->options;
2986                 state = D6_STATE(ifd);
2987                 if (state == NULL || state->state != DH6S_BOUND)
2988                         continue;
2989                 TAILQ_FOREACH(ap, &state->addrs, next) {
2990                         if (!(ap->flags & IPV6_AF_DELEGATEDPFX))
2991                                 continue;
2992                         for (i = 0; i < ifo->ia_len; i++) {
2993                                 ia = &ifo->ia[i];
2994                                 if (ia->ia_type != D6_OPTION_IA_PD)
2995                                         continue;
2996                                 if (memcmp(ia->iaid, ap->iaid,
2997                                     sizeof(ia->iaid)))
2998                                         continue;
2999                                 for (j = 0; j < ia->sla_len; j++) {
3000                                         sla = &ia->sla[j];
3001                                         if (strcmp(ifp->name, sla->ifname))
3002                                                 continue;
3003                                         if (ipv6_linklocal(ifp) == NULL) {
3004                                                 logdebugx(
3005                                                     "%s: delaying adding"
3006                                                     " delegated addresses for"
3007                                                     " LL address",
3008                                                     ifp->name);
3009                                                 ipv6_addlinklocalcallback(ifp,
3010                                                     dhcp6_find_delegates1, ifp);
3011                                                 return 1;
3012                                         }
3013                                         if (dhcp6_ifdelegateaddr(ifp, ap,
3014                                             sla, ia))
3015                                             k++;
3016                                 }
3017                         }
3018                 }
3019         }
3020
3021         if (k) {
3022                 loginfox("%s: adding delegated prefixes", ifp->name);
3023                 state = D6_STATE(ifp);
3024                 state->state = DH6S_DELEGATED;
3025                 ipv6_addaddrs(&state->addrs);
3026                 rt_build(ifp->ctx, AF_INET6);
3027                 dhcp6_script_try_run(ifp, 1);
3028         }
3029         return k;
3030 }
3031 #endif
3032
3033 static void
3034 dhcp6_bind(struct interface *ifp, const char *op, const char *sfrom)
3035 {
3036         struct dhcp6_state *state = D6_STATE(ifp);
3037         bool timedout = (op == NULL), has_new = false, confirmed;
3038         struct ipv6_addr *ia;
3039         int loglevel;
3040         struct timespec now;
3041
3042         TAILQ_FOREACH(ia, &state->addrs, next) {
3043                 if (ia->flags & IPV6_AF_NEW) {
3044                         has_new = true;
3045                         break;
3046                 }
3047         }
3048         loglevel = has_new || state->state != DH6S_RENEW ? LOG_INFO : LOG_DEBUG;
3049         if (!timedout) {
3050                 logmessage(loglevel, "%s: %s received from %s",
3051                     ifp->name, op, sfrom);
3052 #ifndef SMALL
3053                 /* If we delegated from an unconfirmed lease we MUST drop
3054                  * them now. Hopefully we have new delegations. */
3055                 if (state->reason != NULL &&
3056                     strcmp(state->reason, "TIMEOUT6") == 0)
3057                         dhcp6_delete_delegates(ifp);
3058 #endif
3059                 state->reason = NULL;
3060         } else
3061                 state->reason = "TIMEOUT6";
3062
3063         eloop_timeout_delete(ifp->ctx->eloop, NULL, ifp);
3064         clock_gettime(CLOCK_MONOTONIC, &now);
3065
3066         switch(state->state) {
3067         case DH6S_INFORM:
3068         {
3069                 struct dhcp6_option *o;
3070                 uint16_t ol;
3071
3072                 if (state->reason == NULL)
3073                         state->reason = "INFORM6";
3074                 o = dhcp6_findmoption(state->new, state->new_len,
3075                                       D6_OPTION_INFO_REFRESH_TIME, &ol);
3076                 if (o == NULL || ol != sizeof(uint32_t))
3077                         state->renew = IRT_DEFAULT;
3078                 else {
3079                         memcpy(&state->renew, o, ol);
3080                         state->renew = ntohl(state->renew);
3081                         if (state->renew < IRT_MINIMUM)
3082                                 state->renew = IRT_MINIMUM;
3083                 }
3084                 state->rebind = 0;
3085                 state->expire = ND6_INFINITE_LIFETIME;
3086                 state->lowpl = ND6_INFINITE_LIFETIME;
3087         }
3088                 break;
3089
3090         case DH6S_REQUEST:
3091                 if (state->reason == NULL)
3092                         state->reason = "BOUND6";
3093                 /* FALLTHROUGH */
3094         case DH6S_RENEW:
3095                 if (state->reason == NULL)
3096                         state->reason = "RENEW6";
3097                 /* FALLTHROUGH */
3098         case DH6S_REBIND:
3099                 if (state->reason == NULL)
3100                         state->reason = "REBIND6";
3101                 /* FALLTHROUGH */
3102         case DH6S_CONFIRM:
3103                 if (state->reason == NULL)
3104                         state->reason = "REBOOT6";
3105                 if (state->renew != 0) {
3106                         bool all_expired = true;
3107
3108                         TAILQ_FOREACH(ia, &state->addrs, next) {
3109                                 if (ia->flags & IPV6_AF_STALE)
3110                                         continue;
3111                                 if (!(state->renew == ND6_INFINITE_LIFETIME
3112                                     && ia->prefix_vltime == ND6_INFINITE_LIFETIME)
3113                                     && ia->prefix_vltime != 0
3114                                     && ia->prefix_vltime <= state->renew)
3115                                         logwarnx(
3116                                             "%s: %s will expire before renewal",
3117                                             ifp->name, ia->saddr);
3118                                 else
3119                                         all_expired = false;
3120                         }
3121                         if (all_expired) {
3122                                 /* All address's vltime happens at or before
3123                                  * the configured T1 in the IA.
3124                                  * This is a badly configured server and we
3125                                  * have to use our own notion of what
3126                                  * T1 and T2 should be as a result.
3127                                  *
3128                                  * Doing this violates RFC 3315 22.4:
3129                                  * In a message sent by a server to a client,
3130                                  * the client MUST use the values in the T1
3131                                  * and T2 fields for the T1 and T2 parameters,
3132                                  * unless those values in those fields are 0.
3133                                  */
3134                                 logwarnx("%s: ignoring T1 %"PRIu32
3135                                     " due to address expiry",
3136                                     ifp->name, state->renew);
3137                                 state->renew = state->rebind = 0;
3138                         }
3139                 }
3140                 if (state->renew == 0 && state->lowpl != ND6_INFINITE_LIFETIME)
3141                         state->renew = (uint32_t)(state->lowpl * 0.5);
3142                 if (state->rebind == 0 && state->lowpl != ND6_INFINITE_LIFETIME)
3143                         state->rebind = (uint32_t)(state->lowpl * 0.8);
3144                 break;
3145         default:
3146                 state->reason = "UNKNOWN6";
3147                 break;
3148         }
3149
3150         if (state->state != DH6S_CONFIRM && !timedout) {
3151                 state->acquired = now;
3152                 free(state->old);
3153                 state->old = state->new;
3154                 state->old_len = state->new_len;
3155                 state->new = state->recv;
3156                 state->new_len = state->recv_len;
3157                 state->recv = NULL;
3158                 state->recv_len = 0;
3159                 confirmed = false;
3160         } else {
3161                 /* Reduce timers based on when we got the lease. */
3162                 uint32_t elapsed;
3163
3164                 elapsed = (uint32_t)eloop_timespec_diff(&now,
3165                     &state->acquired, NULL);
3166                 if (state->renew && state->renew != ND6_INFINITE_LIFETIME) {
3167                         if (state->renew > elapsed)
3168                                 state->renew -= elapsed;
3169                         else
3170                                 state->renew = 0;
3171                 }
3172                 if (state->rebind && state->rebind != ND6_INFINITE_LIFETIME) {
3173                         if (state->rebind > elapsed)
3174                                 state->rebind -= elapsed;
3175                         else
3176                                 state->rebind = 0;
3177                 }
3178                 if (state->expire && state->expire != ND6_INFINITE_LIFETIME) {
3179                         if (state->expire > elapsed)
3180                                 state->expire -= elapsed;
3181                         else
3182                                 state->expire = 0;
3183                 }
3184                 confirmed = true;
3185         }
3186
3187         if (ifp->ctx->options & DHCPCD_TEST)
3188                 script_runreason(ifp, "TEST");
3189         else {
3190                 if (state->state == DH6S_INFORM)
3191                         state->state = DH6S_INFORMED;
3192                 else
3193                         state->state = DH6S_BOUND;
3194                 state->failed = false;
3195
3196                 if (state->renew && state->renew != ND6_INFINITE_LIFETIME)
3197                         eloop_timeout_add_sec(ifp->ctx->eloop,
3198                             state->renew,
3199                             state->state == DH6S_INFORMED ?
3200                             dhcp6_startinform : dhcp6_startrenew, ifp);
3201                 if (state->rebind && state->rebind != ND6_INFINITE_LIFETIME)
3202                         eloop_timeout_add_sec(ifp->ctx->eloop,
3203                             state->rebind, dhcp6_startrebind, ifp);
3204                 if (state->expire != ND6_INFINITE_LIFETIME)
3205                         eloop_timeout_add_sec(ifp->ctx->eloop,
3206                             state->expire, dhcp6_startexpire, ifp);
3207
3208                 if (ifp->options->options & DHCPCD_CONFIGURE) {
3209                         ipv6_addaddrs(&state->addrs);
3210                         if (!timedout)
3211                                 dhcp6_deprecateaddrs(&state->addrs);
3212                 }
3213
3214                 if (state->state == DH6S_INFORMED)
3215                         logmessage(loglevel, "%s: refresh in %"PRIu32" seconds",
3216                             ifp->name, state->renew);
3217                 else if (state->renew == ND6_INFINITE_LIFETIME)
3218                         logmessage(loglevel, "%s: leased for infinity",
3219                             ifp->name);
3220                 else if (state->renew || state->rebind)
3221                         logmessage(loglevel, "%s: renew in %"PRIu32", "
3222                             "rebind in %"PRIu32", "
3223                             "expire in %"PRIu32" seconds",
3224                             ifp->name,
3225                             state->renew, state->rebind, state->expire);
3226                 else if (state->expire == 0)
3227                         logmessage(loglevel, "%s: will expire", ifp->name);
3228                 else
3229                         logmessage(loglevel, "%s: expire in %"PRIu32" seconds",
3230                             ifp->name, state->expire);
3231                 rt_build(ifp->ctx, AF_INET6);
3232                 if (!confirmed && !timedout) {
3233                         logdebugx("%s: writing lease: %s",
3234                             ifp->name, state->leasefile);
3235                         if (dhcp_writefile(ifp->ctx, state->leasefile, 0640,
3236                             state->new, state->new_len) == -1)
3237                                 logerr("dhcp_writefile: %s",state->leasefile);
3238                 }
3239 #ifndef SMALL
3240                 dhcp6_delegate_prefix(ifp);
3241 #endif
3242                 dhcp6_script_try_run(ifp, 0);
3243         }
3244
3245         if (ifp->ctx->options & DHCPCD_TEST ||
3246             (ifp->options->options & DHCPCD_INFORM &&
3247             !(ifp->ctx->options & DHCPCD_MASTER)))
3248         {
3249                 eloop_exit(ifp->ctx->eloop, EXIT_SUCCESS);
3250         }
3251 }
3252
3253 static void
3254 dhcp6_recvif(struct interface *ifp, const char *sfrom,
3255     struct dhcp6_message *r, size_t len)
3256 {
3257         struct dhcpcd_ctx *ctx;
3258         size_t i;
3259         const char *op;
3260         struct dhcp6_state *state;
3261         uint8_t *o;
3262         uint16_t ol;
3263         const struct dhcp_opt *opt;
3264         const struct if_options *ifo;
3265         bool valid_op;
3266 #ifdef AUTH
3267         uint8_t *auth;
3268         uint16_t auth_len;
3269 #endif
3270
3271         ctx = ifp->ctx;
3272         state = D6_STATE(ifp);
3273         if (state == NULL || state->send == NULL) {
3274                 logdebugx("%s: DHCPv6 reply received but not running",
3275                     ifp->name);
3276                 return;
3277         }
3278
3279         /* We're already bound and this message is for another machine */
3280         /* XXX DELEGATED? */
3281         if (r->type != DHCP6_RECONFIGURE &&
3282             (state->state == DH6S_BOUND || state->state == DH6S_INFORMED))
3283         {
3284                 logdebugx("%s: DHCPv6 reply received but already bound",
3285                     ifp->name);
3286                 return;
3287         }
3288
3289         if (dhcp6_findmoption(r, len, D6_OPTION_SERVERID, NULL) == NULL) {
3290                 logdebugx("%s: no DHCPv6 server ID from %s", ifp->name, sfrom);
3291                 return;
3292         }
3293
3294         ifo = ifp->options;
3295         for (i = 0, opt = ctx->dhcp6_opts;
3296             i < ctx->dhcp6_opts_len;
3297             i++, opt++)
3298         {
3299                 if (has_option_mask(ifo->requiremask6, opt->option) &&
3300                     !dhcp6_findmoption(r, len, (uint16_t)opt->option, NULL))
3301                 {
3302                         logwarnx("%s: reject DHCPv6 (no option %s) from %s",
3303                             ifp->name, opt->var, sfrom);
3304                         return;
3305                 }
3306                 if (has_option_mask(ifo->rejectmask6, opt->option) &&
3307                     dhcp6_findmoption(r, len, (uint16_t)opt->option, NULL))
3308                 {
3309                         logwarnx("%s: reject DHCPv6 (option %s) from %s",
3310                             ifp->name, opt->var, sfrom);
3311                         return;
3312                 }
3313         }
3314
3315 #ifdef AUTH
3316         /* Authenticate the message */
3317         auth = dhcp6_findmoption(r, len, D6_OPTION_AUTH, &auth_len);
3318         if (auth != NULL) {
3319                 if (dhcp_auth_validate(&state->auth, &ifo->auth,
3320                     (uint8_t *)r, len, 6, r->type, auth, auth_len) == NULL)
3321                 {
3322                         logerr("%s: authentication failed from %s",
3323                             ifp->name, sfrom);
3324                         return;
3325                 }
3326                 if (state->auth.token)
3327                         logdebugx("%s: validated using 0x%08" PRIu32,
3328                             ifp->name, state->auth.token->secretid);
3329                 else
3330                         loginfox("%s: accepted reconfigure key", ifp->name);
3331         } else if (ifo->auth.options & DHCPCD_AUTH_SEND) {
3332                 if (ifo->auth.options & DHCPCD_AUTH_REQUIRE) {
3333                         logerrx("%s: no authentication from %s",
3334                             ifp->name, sfrom);
3335                         return;
3336                 }
3337                 logwarnx("%s: no authentication from %s", ifp->name, sfrom);
3338         }
3339 #endif
3340
3341         op = dhcp6_get_op(r->type);
3342         valid_op = op != NULL;
3343         switch(r->type) {
3344         case DHCP6_REPLY:
3345                 switch(state->state) {
3346                 case DH6S_INFORM:
3347                         if (dhcp6_checkstatusok(ifp, r, NULL, len) != 0)
3348                                 return;
3349                         break;
3350                 case DH6S_CONFIRM:
3351                         if (dhcp6_validatelease(ifp, r, len, sfrom, NULL) == -1)
3352                         {
3353                                 dhcp6_startdiscoinform(ifp);
3354                                 return;
3355                         }
3356                         break;
3357                 case DH6S_DISCOVER:
3358                         /* Only accept REPLY in DISCOVER for RAPID_COMMIT.
3359                          * Normally we get an ADVERTISE for a DISCOVER. */
3360                         if (!has_option_mask(ifo->requestmask6,
3361                             D6_OPTION_RAPID_COMMIT) ||
3362                             !dhcp6_findmoption(r, len, D6_OPTION_RAPID_COMMIT,
3363                                               NULL))
3364                         {
3365                                 valid_op = false;
3366                                 break;
3367                         }
3368                         /* Validate lease before setting state to REQUEST. */
3369                         /* FALLTHROUGH */
3370                 case DH6S_REQUEST: /* FALLTHROUGH */
3371                 case DH6S_RENEW: /* FALLTHROUGH */
3372                 case DH6S_REBIND:
3373                         if (dhcp6_validatelease(ifp, r, len, sfrom, NULL) == -1)
3374                         {
3375                                 /*
3376                                  * If we can't use the lease, fallback to
3377                                  * DISCOVER and try and get a new one.
3378                                  *
3379                                  * This is needed become some servers
3380                                  * renumber the prefix or address
3381                                  * and deny the current one before it expires
3382                                  * rather than sending it back with a zero
3383                                  * lifetime along with the new prefix or
3384                                  * address to use.
3385                                  * This behavior is wrong, but moving to the
3386                                  * DISCOVER phase works around it.
3387                                  *
3388                                  * The currently held lease is still valid
3389                                  * until a new one is found.
3390                                  */
3391                                 if (state->state != DH6S_DISCOVER)
3392                                         dhcp6_startdiscoinform(ifp);
3393                                 return;
3394                         }
3395                         /* RFC8415 18.2.10.1 */
3396                         if ((state->state == DH6S_RENEW ||
3397                             state->state == DH6S_REBIND) &&
3398                             state->has_no_binding)
3399                         {
3400                                 dhcp6_startrequest(ifp);
3401                                 return;
3402                         }
3403                         if (state->state == DH6S_DISCOVER)
3404                                 state->state = DH6S_REQUEST;
3405                         break;
3406                 case DH6S_DECLINE:
3407                         /* This isnt really a failure, but an
3408                          * acknowledgement of one. */
3409                         loginfox("%s: %s acknowledged DECLINE6",
3410                             ifp->name, sfrom);
3411                         dhcp6_fail(ifp);
3412                         return;
3413                 default:
3414                         valid_op = false;
3415                         break;
3416                 }
3417                 break;
3418         case DHCP6_ADVERTISE:
3419                 if (state->state != DH6S_DISCOVER) {
3420                         valid_op = false;
3421                         break;
3422                 }
3423                 /* RFC7083 */
3424                 o = dhcp6_findmoption(r, len, D6_OPTION_SOL_MAX_RT, &ol);
3425                 if (o && ol == sizeof(uint32_t)) {
3426                         uint32_t max_rt;
3427
3428                         memcpy(&max_rt, o, sizeof(max_rt));
3429                         max_rt = ntohl(max_rt);
3430                         if (max_rt >= 60 && max_rt <= 86400) {
3431                                 logdebugx("%s: SOL_MAX_RT %llu -> %u",
3432                                     ifp->name,
3433                                     (unsigned long long)state->sol_max_rt,
3434                                     max_rt);
3435                                 state->sol_max_rt = max_rt;
3436                         } else
3437                                 logerr("%s: invalid SOL_MAX_RT %u",
3438                                     ifp->name, max_rt);
3439                 }
3440                 o = dhcp6_findmoption(r, len, D6_OPTION_INF_MAX_RT, &ol);
3441                 if (o && ol == sizeof(uint32_t)) {
3442                         uint32_t max_rt;
3443
3444                         memcpy(&max_rt, o, sizeof(max_rt));
3445                         max_rt = ntohl(max_rt);
3446                         if (max_rt >= 60 && max_rt <= 86400) {
3447                                 logdebugx("%s: INF_MAX_RT %llu -> %u",
3448                                     ifp->name,
3449                                     (unsigned long long)state->inf_max_rt,
3450                                     max_rt);
3451                                 state->inf_max_rt = max_rt;
3452                         } else
3453                                 logerrx("%s: invalid INF_MAX_RT %u",
3454                                     ifp->name, max_rt);
3455                 }
3456                 if (dhcp6_validatelease(ifp, r, len, sfrom, NULL) == -1)
3457                         return;
3458                 break;
3459         case DHCP6_RECONFIGURE:
3460 #ifdef AUTH
3461                 if (auth == NULL) {
3462 #endif
3463                         logerrx("%s: unauthenticated %s from %s",
3464                             ifp->name, op, sfrom);
3465                         if (ifo->auth.options & DHCPCD_AUTH_REQUIRE)
3466                                 return;
3467 #ifdef AUTH
3468                 }
3469                 loginfox("%s: %s from %s", ifp->name, op, sfrom);
3470                 o = dhcp6_findmoption(r, len, D6_OPTION_RECONF_MSG, &ol);
3471                 if (o == NULL) {
3472                         logerrx("%s: missing Reconfigure Message option",
3473                             ifp->name);
3474                         return;
3475                 }
3476                 if (ol != 1) {
3477                         logerrx("%s: missing Reconfigure Message type",
3478                             ifp->name);
3479                         return;
3480                 }
3481                 switch(*o) {
3482                 case DHCP6_RENEW:
3483                         if (state->state != DH6S_BOUND) {
3484                                 logerrx("%s: not bound, ignoring %s",
3485                                     ifp->name, op);
3486                                 return;
3487                         }
3488                         dhcp6_startrenew(ifp);
3489                         break;
3490                 case DHCP6_INFORMATION_REQ:
3491                         if (state->state != DH6S_INFORMED) {
3492                                 logerrx("%s: not informed, ignoring %s",
3493                                     ifp->name, op);
3494                                 return;
3495                         }
3496                         eloop_timeout_delete(ifp->ctx->eloop,
3497                             dhcp6_sendinform, ifp);
3498                         dhcp6_startinform(ifp);
3499                         break;
3500                 default:
3501                         logerr("%s: unsupported %s type %d",
3502                             ifp->name, op, *o);
3503                         break;
3504                 }
3505                 return;
3506 #else
3507                 break;
3508 #endif
3509         default:
3510                 logerrx("%s: invalid DHCP6 type %s (%d)",
3511                     ifp->name, op, r->type);
3512                 return;
3513         }
3514         if (!valid_op) {
3515                 logwarnx("%s: invalid state for DHCP6 type %s (%d)",
3516                     ifp->name, op, r->type);
3517                 return;
3518         }
3519
3520         if (state->recv_len < (size_t)len) {
3521                 free(state->recv);
3522                 state->recv = malloc(len);
3523                 if (state->recv == NULL) {
3524                         logerr(__func__);
3525                         return;
3526                 }
3527         }
3528         memcpy(state->recv, r, len);
3529         state->recv_len = len;
3530
3531         if (r->type == DHCP6_ADVERTISE) {
3532                 struct ipv6_addr *ia;
3533
3534                 if (state->state == DH6S_REQUEST) /* rapid commit */
3535                         goto bind;
3536                 TAILQ_FOREACH(ia, &state->addrs, next) {
3537                         if (!(ia->flags & (IPV6_AF_STALE | IPV6_AF_REQUEST)))
3538                                 break;
3539                 }
3540                 if (ia == NULL)
3541                         ia = TAILQ_FIRST(&state->addrs);
3542                 if (ia == NULL)
3543                         loginfox("%s: ADV (no address) from %s",
3544                             ifp->name, sfrom);
3545                 else
3546                         loginfox("%s: ADV %s from %s",
3547                             ifp->name, ia->saddr, sfrom);
3548                 dhcp6_startrequest(ifp);
3549                 return;
3550         }
3551
3552 bind:
3553         dhcp6_bind(ifp, op, sfrom);
3554 }
3555
3556 void
3557 dhcp6_recvmsg(struct dhcpcd_ctx *ctx, struct msghdr *msg, struct ipv6_addr *ia)
3558 {
3559         struct sockaddr_in6 *from = msg->msg_name;
3560         size_t len = msg->msg_iov[0].iov_len;
3561         char sfrom[INET6_ADDRSTRLEN];
3562         struct interface *ifp;
3563         struct dhcp6_message *r;
3564         const struct dhcp6_state *state;
3565         uint8_t *o;
3566         uint16_t ol;
3567
3568         inet_ntop(AF_INET6, &from->sin6_addr, sfrom, sizeof(sfrom));
3569         if (len < sizeof(struct dhcp6_message)) {
3570                 logerrx("DHCPv6 packet too short from %s", sfrom);
3571                 return;
3572         }
3573
3574         if (ia != NULL)
3575                 ifp = ia->iface;
3576         else {
3577                 ifp = if_findifpfromcmsg(ctx, msg, NULL);
3578                 if (ifp == NULL) {
3579                         logerr(__func__);
3580                         return;
3581                 }
3582         }
3583
3584         r = (struct dhcp6_message *)msg->msg_iov[0].iov_base;
3585
3586         uint8_t duid[DUID_LEN], *dp;
3587         size_t duid_len;
3588         o = dhcp6_findmoption(r, len, D6_OPTION_CLIENTID, &ol);
3589         if (ifp->options->options & DHCPCD_ANONYMOUS) {
3590                 duid_len = duid_make(duid, ifp, DUID_LL);
3591                 dp = duid;
3592         } else {
3593                 duid_len = ctx->duid_len;
3594                 dp = ctx->duid;
3595         }
3596         if (o == NULL || ol != duid_len || memcmp(o, dp, ol) != 0) {
3597                 logdebugx("%s: incorrect client ID from %s",
3598                     ifp->name, sfrom);
3599                 return;
3600         }
3601
3602         if (dhcp6_findmoption(r, len, D6_OPTION_SERVERID, NULL) == NULL) {
3603                 logdebugx("%s: no DHCPv6 server ID from %s",
3604                     ifp->name, sfrom);
3605                 return;
3606         }
3607
3608         if (r->type == DHCP6_RECONFIGURE) {
3609                 if (!IN6_IS_ADDR_LINKLOCAL(&from->sin6_addr)) {
3610                         logerrx("%s: RECONFIGURE6 recv from %s, not LL",
3611                             ifp->name, sfrom);
3612                         return;
3613                 }
3614                 goto recvif;
3615         }
3616
3617         state = D6_CSTATE(ifp);
3618         if (state == NULL ||
3619             r->xid[0] != state->send->xid[0] ||
3620             r->xid[1] != state->send->xid[1] ||
3621             r->xid[2] != state->send->xid[2])
3622         {
3623                 struct interface *ifp1;
3624                 const struct dhcp6_state *state1;
3625
3626                 /* Find an interface with a matching xid. */
3627                 TAILQ_FOREACH(ifp1, ctx->ifaces, next) {
3628                         state1 = D6_CSTATE(ifp1);
3629                         if (state1 == NULL || state1->send == NULL)
3630                                 continue;
3631                         if (r->xid[0] == state1->send->xid[0] &&
3632                             r->xid[1] == state1->send->xid[1] &&
3633                             r->xid[2] == state1->send->xid[2])
3634                                 break;
3635                 }
3636
3637                 if (ifp1 == NULL) {
3638                         if (state != NULL)
3639                                 logdebugx("%s: wrong xid 0x%02x%02x%02x"
3640                                     " (expecting 0x%02x%02x%02x) from %s",
3641                                     ifp->name,
3642                                     r->xid[0], r->xid[1], r->xid[2],
3643                                     state->send->xid[0],
3644                                     state->send->xid[1],
3645                                     state->send->xid[2],
3646                                     sfrom);
3647                         return;
3648                 }
3649                 logdebugx("%s: redirecting DHCP6 message to %s",
3650                     ifp->name, ifp1->name);
3651                 ifp = ifp1;
3652         }
3653
3654 #if 0
3655         /*
3656          * Handy code to inject raw DHCPv6 packets over responses
3657          * from our server.
3658          * This allows me to take a 3rd party wireshark trace and
3659          * replay it in my code.
3660          */
3661         static int replyn = 0;
3662         char fname[PATH_MAX], tbuf[UDPLEN_MAX];
3663         int fd;
3664         ssize_t tlen;
3665         uint8_t *si1, *si2;
3666         uint16_t si_len1, si_len2;
3667
3668         snprintf(fname, sizeof(fname),
3669             "/tmp/dhcp6.reply%d.raw", replyn++);
3670         fd = open(fname, O_RDONLY, 0);
3671         if (fd == -1) {
3672                 logerr("%s: open: %s", __func__, fname);
3673                 return;
3674         }
3675         tlen = read(fd, tbuf, sizeof(tbuf));
3676         if (tlen == -1)
3677                 logerr("%s: read: %s", __func__, fname);
3678         close(fd);
3679
3680         /* Copy across ServerID so we can work with our own server. */
3681         si1 = dhcp6_findmoption(r, len, D6_OPTION_SERVERID, &si_len1);
3682         si2 = dhcp6_findmoption(tbuf, (size_t)tlen,
3683             D6_OPTION_SERVERID, &si_len2);
3684         if (si1 != NULL && si2 != NULL && si_len1 == si_len2)
3685                 memcpy(si2, si1, si_len2);
3686         r = (struct dhcp6_message *)tbuf;
3687         len = (size_t)tlen;
3688 #endif
3689
3690 recvif:
3691         dhcp6_recvif(ifp, sfrom, r, len);
3692 }
3693
3694 static void
3695 dhcp6_recv(struct dhcpcd_ctx *ctx, struct ipv6_addr *ia)
3696 {
3697         struct sockaddr_in6 from;
3698         union {
3699                 struct dhcp6_message dhcp6;
3700                 uint8_t buf[UDPLEN_MAX]; /* Maximum UDP message size */
3701         } iovbuf;
3702         struct iovec iov = {
3703                 .iov_base = iovbuf.buf, .iov_len = sizeof(iovbuf.buf),
3704         };
3705         union {
3706                 struct cmsghdr hdr;
3707                 uint8_t buf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
3708         } cmsgbuf = { .buf = { 0 } };
3709         struct msghdr msg = {
3710             .msg_name = &from, .msg_namelen = sizeof(from),
3711             .msg_iov = &iov, .msg_iovlen = 1,
3712             .msg_control = cmsgbuf.buf, .msg_controllen = sizeof(cmsgbuf.buf),
3713         };
3714         int s;
3715         ssize_t bytes;
3716
3717         s = ia != NULL ? ia->dhcp6_fd : ctx->dhcp6_rfd;
3718         bytes = recvmsg(s, &msg, 0);
3719         if (bytes == -1) {
3720                 logerr(__func__);
3721                 return;
3722         }
3723
3724         iov.iov_len = (size_t)bytes;
3725         dhcp6_recvmsg(ctx, &msg, ia);
3726 }
3727
3728 static void
3729 dhcp6_recvaddr(void *arg)
3730 {
3731         struct ipv6_addr *ia = arg;
3732
3733         dhcp6_recv(ia->iface->ctx, ia);
3734 }
3735
3736 static void
3737 dhcp6_recvctx(void *arg)
3738 {
3739         struct dhcpcd_ctx *ctx = arg;
3740
3741         dhcp6_recv(ctx, NULL);
3742 }
3743
3744 int
3745 dhcp6_openraw(void)
3746 {
3747         int fd, v;
3748
3749         fd = socket(PF_INET6, SOCK_RAW | SOCK_CXNB, IPPROTO_UDP);
3750         if (fd == -1)
3751                 return -1;
3752
3753         v = 1;
3754         if (setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &v, sizeof(v)) == -1)
3755                 goto errexit;
3756
3757         v = offsetof(struct udphdr, uh_sum);
3758         if (setsockopt(fd, IPPROTO_IPV6, IPV6_CHECKSUM, &v, sizeof(v)) == -1)
3759                 goto errexit;
3760
3761         return fd;
3762
3763 errexit:
3764         close(fd);
3765         return -1;
3766 }
3767
3768 int
3769 dhcp6_openudp(unsigned int ifindex, struct in6_addr *ia)
3770 {
3771         struct sockaddr_in6 sa;
3772         int n, s;
3773
3774         s = xsocket(PF_INET6, SOCK_DGRAM | SOCK_CXNB, IPPROTO_UDP);
3775         if (s == -1)
3776                 goto errexit;
3777
3778         memset(&sa, 0, sizeof(sa));
3779         sa.sin6_family = AF_INET6;
3780         sa.sin6_port = htons(DHCP6_CLIENT_PORT);
3781 #ifdef BSD
3782         sa.sin6_len = sizeof(sa);
3783 #endif
3784
3785         if (ia != NULL) {
3786                 memcpy(&sa.sin6_addr, ia, sizeof(sa.sin6_addr));
3787                 ipv6_setscope(&sa, ifindex);
3788         }
3789
3790         if (bind(s, (struct sockaddr *)&sa, sizeof(sa)) == -1)
3791                 goto errexit;
3792
3793         n = 1;
3794         if (setsockopt(s, IPPROTO_IPV6, IPV6_RECVPKTINFO, &n, sizeof(n)) == -1)
3795                 goto errexit;
3796
3797 #ifdef SO_RERROR
3798         n = 1;
3799         if (setsockopt(s, SOL_SOCKET, SO_RERROR, &n, sizeof(n)) == -1)
3800                 goto errexit;
3801 #endif
3802
3803         return s;
3804
3805 errexit:
3806         logerr(__func__);
3807         if (s != -1)
3808                 close(s);
3809         return -1;
3810 }
3811
3812 #ifndef SMALL
3813 static void
3814 dhcp6_activateinterfaces(struct interface *ifp)
3815 {
3816         struct interface *ifd;
3817         size_t i, j;
3818         struct if_ia *ia;
3819         struct if_sla *sla;
3820
3821         for (i = 0; i < ifp->options->ia_len; i++) {
3822                 ia = &ifp->options->ia[i];
3823                 if (ia->ia_type != D6_OPTION_IA_PD)
3824                         continue;
3825                 for (j = 0; j < ia->sla_len; j++) {
3826                         sla = &ia->sla[j];
3827                         ifd = if_find(ifp->ctx->ifaces, sla->ifname);
3828                         if (ifd == NULL) {
3829                                 logwarn("%s: cannot delegate to %s",
3830                                     ifp->name, sla->ifname);
3831                                 continue;
3832                         }
3833                         if (!ifd->active) {
3834                                 loginfox("%s: activating for delegation",
3835                                     sla->ifname);
3836                                 dhcpcd_activateinterface(ifd,
3837                                     DHCPCD_IPV6 | DHCPCD_DHCP6);
3838                         }
3839                 }
3840         }
3841 }
3842 #endif
3843
3844 static void
3845 dhcp6_start1(void *arg)
3846 {
3847         struct interface *ifp = arg;
3848         struct dhcpcd_ctx *ctx = ifp->ctx;
3849         struct if_options *ifo = ifp->options;
3850         struct dhcp6_state *state;
3851         size_t i;
3852         const struct dhcp_compat *dhc;
3853
3854         if ((ctx->options & (DHCPCD_MASTER|DHCPCD_PRIVSEP)) == DHCPCD_MASTER &&
3855             ctx->dhcp6_rfd == -1)
3856         {
3857                 ctx->dhcp6_rfd = dhcp6_openudp(0, NULL);
3858                 if (ctx->dhcp6_rfd == -1) {
3859                         logerr(__func__);
3860                         return;
3861                 }
3862                 eloop_event_add(ctx->eloop, ctx->dhcp6_rfd, dhcp6_recvctx, ctx);
3863         }
3864
3865         if (!IN_PRIVSEP(ctx) && ctx->dhcp6_wfd == -1) {
3866                 ctx->dhcp6_wfd = dhcp6_openraw();
3867                 if (ctx->dhcp6_wfd == -1) {
3868                         logerr(__func__);
3869                         return;
3870                 }
3871         }
3872
3873         state = D6_STATE(ifp);
3874         /* If no DHCPv6 options are configured,
3875            match configured DHCPv4 options to DHCPv6 equivalents. */
3876         for (i = 0; i < sizeof(ifo->requestmask6); i++) {
3877                 if (ifo->requestmask6[i] != '\0')
3878                         break;
3879         }
3880         if (i == sizeof(ifo->requestmask6)) {
3881                 for (dhc = dhcp_compats; dhc->dhcp_opt; dhc++) {
3882                         if (DHC_REQ(ifo->requestmask, ifo->nomask, dhc->dhcp_opt))
3883                                 add_option_mask(ifo->requestmask6,
3884                                     dhc->dhcp6_opt);
3885                 }
3886                 if (ifo->fqdn != FQDN_DISABLE || ifo->options & DHCPCD_HOSTNAME)
3887                         add_option_mask(ifo->requestmask6, D6_OPTION_FQDN);
3888         }
3889
3890 #ifndef SMALL
3891         /* Rapid commit won't work with Prefix Delegation Exclusion */
3892         if (dhcp6_findselfsla(ifp))
3893                 del_option_mask(ifo->requestmask6, D6_OPTION_RAPID_COMMIT);
3894 #endif
3895
3896         if (state->state == DH6S_INFORM) {
3897                 add_option_mask(ifo->requestmask6, D6_OPTION_INFO_REFRESH_TIME);
3898                 dhcp6_startinform(ifp);
3899         } else {
3900                 del_option_mask(ifo->requestmask6, D6_OPTION_INFO_REFRESH_TIME);
3901                 dhcp6_startinit(ifp);
3902         }
3903
3904 #ifndef SMALL
3905         dhcp6_activateinterfaces(ifp);
3906 #endif
3907 }
3908
3909 int
3910 dhcp6_start(struct interface *ifp, enum DH6S init_state)
3911 {
3912         struct dhcp6_state *state;
3913
3914         state = D6_STATE(ifp);
3915         if (state != NULL) {
3916                 switch (init_state) {
3917                 case DH6S_INIT:
3918                         goto gogogo;
3919                 case DH6S_INFORM:
3920                         if (state->state == DH6S_INIT ||
3921                             state->state == DH6S_INFORMED ||
3922                             (state->state == DH6S_DISCOVER &&
3923                             !(ifp->options->options & DHCPCD_IA_FORCED) &&
3924                             !ipv6nd_hasradhcp(ifp, true)))
3925                                 dhcp6_startinform(ifp);
3926                         break;
3927                 case DH6S_REQUEST:
3928                         if (ifp->options->options & DHCPCD_DHCP6 &&
3929                             (state->state == DH6S_INIT ||
3930                              state->state == DH6S_INFORM ||
3931                              state->state == DH6S_INFORMED ||
3932                              state->state == DH6S_DELEGATED))
3933                         {
3934                                 /* Change from stateless to stateful */
3935                                 init_state = DH6S_INIT;
3936                                 goto gogogo;
3937                         }
3938                         break;
3939                 case DH6S_CONFIRM:
3940                         init_state = DH6S_INIT;
3941                         goto gogogo;
3942                 default:
3943                         /* Not possible, but sushes some compiler warnings. */
3944                         break;
3945                 }
3946                 return 0;
3947         } else {
3948                 switch (init_state) {
3949                 case DH6S_CONFIRM:
3950                         /* No DHCPv6 config, no existing state
3951                          * so nothing to do. */
3952                         return 0;
3953                 case DH6S_INFORM:
3954                         break;
3955                 default:
3956                         init_state = DH6S_INIT;
3957                         break;
3958                 }
3959         }
3960
3961         if (!(ifp->options->options & DHCPCD_DHCP6))
3962                 return 0;
3963
3964         ifp->if_data[IF_DATA_DHCP6] = calloc(1, sizeof(*state));
3965         state = D6_STATE(ifp);
3966         if (state == NULL)
3967                 return -1;
3968
3969         state->sol_max_rt = SOL_MAX_RT;
3970         state->inf_max_rt = INF_MAX_RT;
3971         TAILQ_INIT(&state->addrs);
3972
3973 gogogo:
3974         state->state = init_state;
3975         state->lerror = 0;
3976         state->failed = false;
3977         dhcp_set_leasefile(state->leasefile, sizeof(state->leasefile),
3978             AF_INET6, ifp);
3979         if (ipv6_linklocal(ifp) == NULL) {
3980                 logdebugx("%s: delaying DHCPv6 for LL address", ifp->name);
3981                 ipv6_addlinklocalcallback(ifp, dhcp6_start1, ifp);
3982                 return 0;
3983         }
3984
3985         dhcp6_start1(ifp);
3986         return 0;
3987 }
3988
3989 void
3990 dhcp6_reboot(struct interface *ifp)
3991 {
3992         struct dhcp6_state *state;
3993
3994         state = D6_STATE(ifp);
3995         if (state == NULL)
3996                 return;
3997
3998         state->lerror = 0;
3999         switch (state->state) {
4000         case DH6S_BOUND:
4001                 dhcp6_startrebind(ifp);
4002                 break;
4003         default:
4004                 dhcp6_startdiscoinform(ifp);
4005                 break;
4006         }
4007 }
4008
4009 static void
4010 dhcp6_freedrop(struct interface *ifp, int drop, const char *reason)
4011 {
4012         struct dhcp6_state *state;
4013         struct dhcpcd_ctx *ctx;
4014         unsigned long long options;
4015
4016         if (ifp->options)
4017                 options = ifp->options->options;
4018         else
4019                 options = ifp->ctx->options;
4020
4021         if (ifp->ctx->eloop)
4022                 eloop_timeout_delete(ifp->ctx->eloop, NULL, ifp);
4023
4024 #ifndef SMALL
4025         /* If we're dropping the lease, drop delegated addresses.
4026          * If, for whatever reason, we don't drop them in the future
4027          * then they should at least be marked as deprecated (pltime 0). */
4028         if (drop && (options & DHCPCD_NODROP) != DHCPCD_NODROP)
4029                 dhcp6_delete_delegates(ifp);
4030 #endif
4031
4032         state = D6_STATE(ifp);
4033         if (state) {
4034                 /* Failure to send the release may cause this function to
4035                  * re-enter */
4036                 if (state->state == DH6S_RELEASE) {
4037                         dhcp6_finishrelease(ifp);
4038                         return;
4039                 }
4040
4041                 if (drop && options & DHCPCD_RELEASE &&
4042                     state->state != DH6S_DELEGATED)
4043                 {
4044                         if (if_is_link_up(ifp) &&
4045                             state->state != DH6S_RELEASED &&
4046                             state->state != DH6S_INFORMED)
4047                         {
4048                                 dhcp6_startrelease(ifp);
4049                                 return;
4050                         }
4051                         dhcp_unlink(ifp->ctx, state->leasefile);
4052                 }
4053 #ifdef AUTH
4054                 else if (state->auth.reconf != NULL) {
4055                         /*
4056                          * Drop the lease as the token may only be present
4057                          * in the initial reply message and not subsequent
4058                          * renewals.
4059                          * If dhcpcd is restarted, the token is lost.
4060                          * XXX persist this in another file?
4061                          */
4062                         dhcp_unlink(ifp->ctx, state->leasefile);
4063                 }
4064 #endif
4065
4066                 dhcp6_freedrop_addrs(ifp, drop, NULL);
4067                 free(state->old);
4068                 state->old = state->new;
4069                 state->old_len = state->new_len;
4070                 state->new = NULL;
4071                 state->new_len = 0;
4072                 if (drop && state->old &&
4073                     (options & DHCPCD_NODROP) != DHCPCD_NODROP)
4074                 {
4075                         if (reason == NULL)
4076                                 reason = "STOP6";
4077                         script_runreason(ifp, reason);
4078                 }
4079                 free(state->old);
4080                 free(state->send);
4081                 free(state->recv);
4082                 free(state);
4083                 ifp->if_data[IF_DATA_DHCP6] = NULL;
4084         }
4085
4086         /* If we don't have any more DHCP6 enabled interfaces,
4087          * close the global socket and release resources */
4088         ctx = ifp->ctx;
4089         if (ctx->ifaces) {
4090                 TAILQ_FOREACH(ifp, ctx->ifaces, next) {
4091                         if (D6_STATE(ifp))
4092                                 break;
4093                 }
4094         }
4095         if (ifp == NULL && ctx->dhcp6_rfd != -1) {
4096                 eloop_event_delete(ctx->eloop, ctx->dhcp6_rfd);
4097                 close(ctx->dhcp6_rfd);
4098                 ctx->dhcp6_rfd = -1;
4099         }
4100 }
4101
4102 void
4103 dhcp6_drop(struct interface *ifp, const char *reason)
4104 {
4105
4106         dhcp6_freedrop(ifp, 1, reason);
4107 }
4108
4109 void
4110 dhcp6_free(struct interface *ifp)
4111 {
4112
4113         dhcp6_freedrop(ifp, 0, NULL);
4114 }
4115
4116 void
4117 dhcp6_abort(struct interface *ifp)
4118 {
4119         struct dhcp6_state *state;
4120 #ifdef ND6_ADVERTISE
4121         struct ipv6_addr *ia;
4122 #endif
4123
4124         eloop_timeout_delete(ifp->ctx->eloop, dhcp6_start1, ifp);
4125         state = D6_STATE(ifp);
4126         if (state == NULL)
4127                 return;
4128
4129 #ifdef ND6_ADVERTISE
4130         TAILQ_FOREACH(ia, &state->addrs, next) {
4131                 ipv6nd_advertise(ia);
4132         }
4133 #endif
4134
4135         eloop_timeout_delete(ifp->ctx->eloop, dhcp6_startdiscover, ifp);
4136         eloop_timeout_delete(ifp->ctx->eloop, dhcp6_senddiscover, ifp);
4137         eloop_timeout_delete(ifp->ctx->eloop, dhcp6_startinform, ifp);
4138         eloop_timeout_delete(ifp->ctx->eloop, dhcp6_sendinform, ifp);
4139
4140         switch (state->state) {
4141         case DH6S_DISCOVER:     /* FALLTHROUGH */
4142         case DH6S_REQUEST:      /* FALLTHROUGH */
4143         case DH6S_INFORM:
4144                 state->state = DH6S_INIT;
4145                 break;
4146         default:
4147                 break;
4148         }
4149 }
4150
4151 void
4152 dhcp6_handleifa(int cmd, struct ipv6_addr *ia, pid_t pid)
4153 {
4154         struct dhcp6_state *state;
4155         struct interface *ifp = ia->iface;
4156
4157         /* If not running in master mode, listen to this address */
4158         if (cmd == RTM_NEWADDR &&
4159             !(ia->addr_flags & IN6_IFF_NOTUSEABLE) &&
4160             ifp->active == IF_ACTIVE_USER &&
4161             !(ifp->ctx->options & DHCPCD_MASTER) &&
4162             ifp->options->options & DHCPCD_DHCP6)
4163         {
4164 #ifdef PRIVSEP
4165                 if (IN_PRIVSEP_SE(ifp->ctx)) {
4166                         if (ps_inet_opendhcp6(ia) == -1)
4167                                 logerr(__func__);
4168                 } else
4169 #endif
4170                 {
4171                         if (ia->dhcp6_fd == -1)
4172                                 ia->dhcp6_fd = dhcp6_openudp(ia->iface->index,
4173                                     &ia->addr);
4174                         if (ia->dhcp6_fd != -1)
4175                                 eloop_event_add(ia->iface->ctx->eloop,
4176                                 ia->dhcp6_fd, dhcp6_recvaddr, ia);
4177                 }
4178         }
4179
4180
4181         if ((state = D6_STATE(ifp)) != NULL)
4182                 ipv6_handleifa_addrs(cmd, &state->addrs, ia, pid);
4183 }
4184
4185 ssize_t
4186 dhcp6_env(FILE *fp, const char *prefix, const struct interface *ifp,
4187     const struct dhcp6_message *m, size_t len)
4188 {
4189         const struct if_options *ifo;
4190         struct dhcp_opt *opt, *vo;
4191         const uint8_t *p;
4192         struct dhcp6_option o;
4193         size_t i;
4194         char *pfx;
4195         uint32_t en;
4196         const struct dhcpcd_ctx *ctx;
4197 #ifndef SMALL
4198         const struct dhcp6_state *state;
4199         const struct ipv6_addr *ap;
4200 #endif
4201
4202         if (m == NULL)
4203                 goto delegated;
4204
4205         if (len < sizeof(*m)) {
4206                 /* Should be impossible with guards at packet in
4207                  * and reading leases */
4208                 errno = EINVAL;
4209                 return -1;
4210         }
4211
4212         ifo = ifp->options;
4213         ctx = ifp->ctx;
4214
4215         /* Zero our indexes */
4216         for (i = 0, opt = ctx->dhcp6_opts;
4217             i < ctx->dhcp6_opts_len;
4218             i++, opt++)
4219                 dhcp_zero_index(opt);
4220         for (i = 0, opt = ifp->options->dhcp6_override;
4221             i < ifp->options->dhcp6_override_len;
4222             i++, opt++)
4223                 dhcp_zero_index(opt);
4224         for (i = 0, opt = ctx->vivso;
4225             i < ctx->vivso_len;
4226             i++, opt++)
4227                 dhcp_zero_index(opt);
4228         if (asprintf(&pfx, "%s_dhcp6", prefix) == -1)
4229                 return -1;
4230
4231         /* Unlike DHCP, DHCPv6 options *may* occur more than once.
4232          * There is also no provision for option concatenation unlike DHCP. */
4233         p = (const uint8_t *)m + sizeof(*m);
4234         len -= sizeof(*m);
4235         for (; len != 0; p += o.len, len -= o.len) {
4236                 if (len < sizeof(o)) {
4237                         errno = EINVAL;
4238                         break;
4239                 }
4240                 memcpy(&o, p, sizeof(o));
4241                 p += sizeof(o);
4242                 len -= sizeof(o);
4243                 o.len = ntohs(o.len);
4244                 if (len < o.len) {
4245                         errno = EINVAL;
4246                         break;
4247                 }
4248                 o.code = ntohs(o.code);
4249                 if (has_option_mask(ifo->nomask6, o.code))
4250                         continue;
4251                 for (i = 0, opt = ifo->dhcp6_override;
4252                     i < ifo->dhcp6_override_len;
4253                     i++, opt++)
4254                         if (opt->option == o.code)
4255                                 break;
4256                 if (i == ifo->dhcp6_override_len &&
4257                     o.code == D6_OPTION_VENDOR_OPTS &&
4258                     o.len > sizeof(en))
4259                 {
4260                         memcpy(&en, p, sizeof(en));
4261                         en = ntohl(en);
4262                         vo = vivso_find(en, ifp);
4263                 } else
4264                         vo = NULL;
4265                 if (i == ifo->dhcp6_override_len) {
4266                         for (i = 0, opt = ctx->dhcp6_opts;
4267                             i < ctx->dhcp6_opts_len;
4268                             i++, opt++)
4269                                 if (opt->option == o.code)
4270                                         break;
4271                         if (i == ctx->dhcp6_opts_len)
4272                                 opt = NULL;
4273                 }
4274                 if (opt) {
4275                         dhcp_envoption(ifp->ctx,
4276                             fp, pfx, ifp->name,
4277                             opt, dhcp6_getoption, p, o.len);
4278                 }
4279                 if (vo) {
4280                         dhcp_envoption(ifp->ctx,
4281                             fp, pfx, ifp->name,
4282                             vo, dhcp6_getoption,
4283                             p + sizeof(en),
4284                             o.len - sizeof(en));
4285                 }
4286         }
4287         free(pfx);
4288
4289 delegated:
4290 #ifndef SMALL
4291         /* Needed for Delegated Prefixes */
4292         state = D6_CSTATE(ifp);
4293         TAILQ_FOREACH(ap, &state->addrs, next) {
4294                 if (ap->delegating_prefix)
4295                         break;
4296         }
4297         if (ap == NULL)
4298                 return 1;
4299         if (fprintf(fp, "%s_delegated_dhcp6_prefix=", prefix) == -1)
4300                 return -1;
4301         TAILQ_FOREACH(ap, &state->addrs, next) {
4302                 if (ap->delegating_prefix == NULL)
4303                         continue;
4304                 if (ap != TAILQ_FIRST(&state->addrs)) {
4305                         if (fputc(' ', fp) == EOF)
4306                                 return -1;
4307                 }
4308                 if (fprintf(fp, "%s", ap->saddr) == -1)
4309                         return -1;
4310         }
4311         if (fputc('\0', fp) == EOF)
4312                 return -1;
4313 #endif
4314
4315         return 1;
4316 }
4317 #endif
4318
4319 #ifndef SMALL
4320 int
4321 dhcp6_dump(struct interface *ifp)
4322 {
4323         struct dhcp6_state *state;
4324
4325         ifp->if_data[IF_DATA_DHCP6] = state = calloc(1, sizeof(*state));
4326         if (state == NULL) {
4327                 logerr(__func__);
4328                 return -1;
4329         }
4330         TAILQ_INIT(&state->addrs);
4331         if (dhcp6_readlease(ifp, 0) == -1) {
4332                 logerr("dhcp6_readlease");
4333                 return -1;
4334         }
4335         state->reason = "DUMP6";
4336         return script_runreason(ifp, state->reason);
4337 }
4338 #endif