contrib/dhcpcd/src/ipv6.c

   1 /* SPDX-License-Identifier: BSD-2-Clause */
   2 /*
   3  * dhcpcd - DHCP client daemon
   4  * Copyright (c) 2006-2019 Roy Marples <roy@marples.name>
   5  * All rights reserved
   6
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  26  * SUCH DAMAGE.
  27  */
  28
  29 #include <sys/param.h>
  30 #include <sys/types.h>
  31 #include <sys/socket.h>
  32 #include <sys/stat.h>
  33
  34 #include <arpa/inet.h>
  35 #include <net/if.h>
  36 #include <net/route.h>
  37 #include <netinet/in.h>
  38 #include <netinet/if_ether.h>
  39
  40 #include "config.h"
  41
  42 #ifdef HAVE_SYS_BITOPS_H
  43 #include <sys/bitops.h>
  44 #else
  45 #include "compat/bitops.h"
  46 #endif
  47
  48 #ifdef BSD
  49 /* Purely for the ND6_IFF_AUTO_LINKLOCAL #define which is solely used
  50  * to generate our CAN_ADD_LLADDR #define. */
  51 #  include <netinet6/in6_var.h>
  52 #  include <netinet6/nd6.h>
  53 #endif
  54
  55 #include <errno.h>
  56 #include <ifaddrs.h>
  57 #include <inttypes.h>
  58 #include <stdlib.h>
  59 #include <string.h>
  60 #include <unistd.h>
  61
  62 #define ELOOP_QUEUE 7
  63 #include "common.h"
  64 #include "if.h"
  65 #include "dhcpcd.h"
  66 #include "dhcp6.h"
  67 #include "eloop.h"
  68 #include "ipv6.h"
  69 #include "ipv6nd.h"
  70 #include "logerr.h"
  71 #include "sa.h"
  72 #include "script.h"
  73
  74 #ifdef HAVE_MD5_H
  75 #  ifndef DEPGEN
  76 #    include <md5.h>
  77 #  endif
  78 #endif
  79
  80 #ifdef SHA2_H
  81 #  include SHA2_H
  82 #endif
  83
  84 #ifndef SHA256_DIGEST_LENGTH
  85 #  define SHA256_DIGEST_LENGTH          32
  86 #endif
  87
  88 #ifdef IPV6_POLLADDRFLAG
  89 #  warning kernel does not report IPv6 address flag changes
  90 #  warning polling tentative address flags periodically
  91 #endif
  92
  93 /* Hackery at it's finest. */
  94 #ifndef s6_addr32
  95 #  ifdef __sun
  96 #    define s6_addr32   _S6_un._S6_u32
  97 #  else
  98 #    define s6_addr32   __u6_addr.__u6_addr32
  99 #  endif
 100 #endif
 101
 102 #if defined(HAVE_IN6_ADDR_GEN_MODE_NONE) || defined(ND6_IFF_AUTO_LINKLOCAL) || \
 103     defined(IFF_NOLINKLOCAL)
 104 /* Only add the LL address if we have a carrier, so DaD works. */
 105 #define CAN_ADD_LLADDR(ifp) \
 106     (!((ifp)->options->options & DHCPCD_LINK) || (ifp)->carrier != LINK_DOWN)
 107 #ifdef __sun
 108 /* Although we can add our own LL address, we cannot drop it
 109  * without unplumbing the if which is a lot of code.
 110  * So just keep it for the time being. */
 111 #define CAN_DROP_LLADDR(ifp)    (0)
 112 #else
 113 #define CAN_DROP_LLADDR(ifp)    (1)
 114 #endif
 115 #else
 116 /* We have no control over the OS adding the LLADDR, so just let it do it
 117  * as we cannot force our own view on it. */
 118 #define CAN_ADD_LLADDR(ifp)     (0)
 119 #define CAN_DROP_LLADDR(ifp)    (0)
 120 #endif
 121
 122 #ifdef IPV6_MANAGETEMPADDR
 123 static void ipv6_regentempifid(void *);
 124 static void ipv6_regentempaddr(void *);
 125 #else
 126 #define ipv6_regentempifid(a) {}
 127 #endif
 128
 129 int
 130 ipv6_init(struct dhcpcd_ctx *ctx)
 131 {
 132
 133         if (ctx->ra_routers != NULL)
 134                 return 0;
 135
 136         ctx->ra_routers = malloc(sizeof(*ctx->ra_routers));
 137         if (ctx->ra_routers == NULL)
 138                 return -1;
 139         TAILQ_INIT(ctx->ra_routers);
 140
 141 #ifndef __sun
 142         ctx->nd_fd = -1;
 143 #endif
 144         ctx->dhcp6_fd = -1;
 145         return 0;
 146 }
 147
 148 static ssize_t
 149 ipv6_readsecret(struct dhcpcd_ctx *ctx)
 150 {
 151         FILE *fp;
 152         char line[1024];
 153         unsigned char *p;
 154         size_t len;
 155         uint32_t r;
 156         int x;
 157
 158         if ((ctx->secret_len = read_hwaddr_aton(&ctx->secret, SECRET)) != 0)
 159                 return (ssize_t)ctx->secret_len;
 160
 161         if (errno != ENOENT)
 162                 logerr("%s: %s", __func__, SECRET);
 163
 164         /* Chaining arc4random should be good enough.
 165          * RFC7217 section 5.1 states the key SHOULD be at least 128 bits.
 166          * To attempt and future proof ourselves, we'll generate a key of
 167          * 512 bits (64 bytes). */
 168         if (ctx->secret_len < 64) {
 169                 if ((ctx->secret = malloc(64)) == NULL) {
 170                         logerr(__func__);
 171                         return -1;
 172                 }
 173                 ctx->secret_len = 64;
 174         }
 175         p = ctx->secret;
 176         for (len = 0; len < 512 / NBBY; len += sizeof(r)) {
 177                 r = arc4random();
 178                 memcpy(p, &r, sizeof(r));
 179                 p += sizeof(r);
 180         }
 181
 182         /* Ensure that only the dhcpcd user can read the secret.
 183          * Write permission is also denied as chaning it would remove
 184          * it's stability. */
 185         if ((fp = fopen(SECRET, "w")) == NULL ||
 186             chmod(SECRET, S_IRUSR) == -1)
 187                 goto eexit;
 188         x = fprintf(fp, "%s\n",
 189             hwaddr_ntoa(ctx->secret, ctx->secret_len, line, sizeof(line)));
 190         if (fclose(fp) == EOF)
 191                 x = -1;
 192         fp = NULL;
 193         if (x > 0)
 194                 return (ssize_t)ctx->secret_len;
 195
 196 eexit:
 197         logerr("%s: %s", __func__, SECRET);
 198         if (fp != NULL)
 199                 fclose(fp);
 200         unlink(SECRET);
 201         ctx->secret_len = 0;
 202         return -1;
 203 }
 204
 205 /* http://www.iana.org/assignments/ipv6-interface-ids/ipv6-interface-ids.xhtml
 206  * RFC5453 */
 207 static const struct reslowhigh {
 208         const uint8_t high[8];
 209         const uint8_t low[8];
 210 } reslowhigh[] = {
 211         /* RFC4291 + RFC6543 */
 212         { { 0x02, 0x00, 0x5e, 0xff, 0xfe, 0x00, 0x00, 0x00 },
 213           { 0x02, 0x00, 0x5e, 0xff, 0xfe, 0xff, 0xff, 0xff } },
 214         /* RFC2526 */
 215         { { 0xfd, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x80 },
 216           { 0xfd, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff } }
 217 };
 218
 219 static int
 220 ipv6_reserved(const struct in6_addr *addr)
 221 {
 222         uint64_t id, low, high;
 223         size_t i;
 224         const struct reslowhigh *r;
 225
 226         id = be64dec(addr->s6_addr + sizeof(id));
 227         if (id == 0) /* RFC4291 */
 228                 return 1;
 229         for (i = 0; i < sizeof(reslowhigh) / sizeof(reslowhigh[0]); i++) {
 230                 r = &reslowhigh[i];
 231                 low = be64dec(r->low);
 232                 high = be64dec(r->high);
 233                 if (id >= low && id <= high)
 234                         return 1;
 235         }
 236         return 0;
 237 }
 238
 239 /* RFC7217 */
 240 static int
 241 ipv6_makestableprivate1(struct in6_addr *addr,
 242     const struct in6_addr *prefix, int prefix_len,
 243     const unsigned char *netiface, size_t netiface_len,
 244     const unsigned char *netid, size_t netid_len,
 245     unsigned short vlanid,
 246     uint32_t *dad_counter,
 247     const unsigned char *secret, size_t secret_len)
 248 {
 249         unsigned char buf[2048], *p, digest[SHA256_DIGEST_LENGTH];
 250         size_t len, l;
 251         SHA256_CTX ctx;
 252
 253         if (prefix_len < 0 || prefix_len > 120) {
 254                 errno = EINVAL;
 255                 return -1;
 256         }
 257
 258         l = (size_t)(ROUNDUP8(prefix_len) / NBBY);
 259         len = l + netiface_len + netid_len + sizeof(*dad_counter) + secret_len;
 260         if (vlanid != 0)
 261                 len += sizeof(vlanid);
 262         if (len > sizeof(buf)) {
 263                 errno = ENOBUFS;
 264                 return -1;
 265         }
 266
 267         for (;; (*dad_counter)++) {
 268                 /* Combine all parameters into one buffer */
 269                 p = buf;
 270                 memcpy(p, prefix, l);
 271                 p += l;
 272                 memcpy(p, netiface, netiface_len);
 273                 p += netiface_len;
 274                 memcpy(p, netid, netid_len);
 275                 p += netid_len;
 276                 /* Don't use a vlanid if not set.
 277                  * This ensures prior versions have the same unique address. */
 278                 if (vlanid != 0) {
 279                         memcpy(p, &vlanid, sizeof(vlanid));
 280                         p += sizeof(vlanid);
 281                 }
 282                 memcpy(p, dad_counter, sizeof(*dad_counter));
 283                 p += sizeof(*dad_counter);
 284                 memcpy(p, secret, secret_len);
 285
 286                 /* Make an address using the digest of the above.
 287                  * RFC7217 Section 5.1 states that we shouldn't use MD5.
 288                  * Pity as we use that for HMAC-MD5 which is still deemed OK.
 289                  * SHA-256 is recommended */
 290                 SHA256_Init(&ctx);
 291                 SHA256_Update(&ctx, buf, len);
 292                 SHA256_Final(digest, &ctx);
 293
 294                 p = addr->s6_addr;
 295                 memcpy(p, prefix, l);
 296                 /* RFC7217 section 5.2 says we need to start taking the id from
 297                  * the least significant bit */
 298                 len = sizeof(addr->s6_addr) - l;
 299                 memcpy(p + l, digest + (sizeof(digest) - len), len);
 300
 301                 /* Ensure that the Interface ID does not match a reserved one,
 302                  * if it does then treat it as a DAD failure.
 303                  * RFC7217 section 5.2 */
 304                 if (prefix_len != 64)
 305                         break;
 306                 if (!ipv6_reserved(addr))
 307                         break;
 308         }
 309
 310         return 0;
 311 }
 312
 313 int
 314 ipv6_makestableprivate(struct in6_addr *addr,
 315     const struct in6_addr *prefix, int prefix_len,
 316     const struct interface *ifp,
 317     int *dad_counter)
 318 {
 319         uint32_t dad;
 320         int r;
 321
 322         if (ifp->ctx->secret_len == 0) {
 323                 if (ipv6_readsecret(ifp->ctx) == -1)
 324                         return -1;
 325         }
 326
 327         dad = (uint32_t)*dad_counter;
 328
 329         /* For our implementation, we shall set the hardware address
 330          * as the interface identifier */
 331         r = ipv6_makestableprivate1(addr, prefix, prefix_len,
 332             ifp->hwaddr, ifp->hwlen,
 333             ifp->ssid, ifp->ssid_len,
 334             ifp->vlanid, &dad,
 335             ifp->ctx->secret, ifp->ctx->secret_len);
 336
 337         if (r == 0)
 338                 *dad_counter = (int)dad;
 339         return r;
 340 }
 341
 342 int
 343 ipv6_makeaddr(struct in6_addr *addr, struct interface *ifp,
 344     const struct in6_addr *prefix, int prefix_len)
 345 {
 346         const struct ipv6_addr *ap;
 347         int dad;
 348
 349         if (prefix_len < 0 || prefix_len > 120) {
 350                 errno = EINVAL;
 351                 return -1;
 352         }
 353
 354         if (ifp->options->options & DHCPCD_SLAACPRIVATE) {
 355                 dad = 0;
 356                 if (ipv6_makestableprivate(addr,
 357                     prefix, prefix_len, ifp, &dad) == -1)
 358                         return -1;
 359                 return dad;
 360         }
 361
 362         if (prefix_len > 64) {
 363                 errno = EINVAL;
 364                 return -1;
 365         }
 366         if ((ap = ipv6_linklocal(ifp)) == NULL) {
 367                 /* We delay a few functions until we get a local-link address
 368                  * so this should never be hit. */
 369                 errno = ENOENT;
 370                 return -1;
 371         }
 372
 373         /* Make the address from the first local-link address */
 374         memcpy(addr, prefix, sizeof(*prefix));
 375         addr->s6_addr32[2] = ap->addr.s6_addr32[2];
 376         addr->s6_addr32[3] = ap->addr.s6_addr32[3];
 377         return 0;
 378 }
 379
 380 static int
 381 ipv6_makeprefix(struct in6_addr *prefix, const struct in6_addr *addr, int len)
 382 {
 383         int bytes, bits;
 384
 385         if (len < 0 || len > 128) {
 386                 errno = EINVAL;
 387                 return -1;
 388         }
 389
 390         bytes = len / NBBY;
 391         bits = len % NBBY;
 392         memcpy(&prefix->s6_addr, &addr->s6_addr, (size_t)bytes);
 393         if (bits != 0) {
 394                 /* Coverify false positive.
 395                  * bytelen cannot be 16 if bitlen is non zero */
 396                 /* coverity[overrun-local] */
 397                 prefix->s6_addr[bytes] =
 398                     (uint8_t)(prefix->s6_addr[bytes] >> (NBBY - bits));
 399         }
 400         memset((char *)prefix->s6_addr + bytes, 0,
 401             sizeof(prefix->s6_addr) - (size_t)bytes);
 402         return 0;
 403 }
 404
 405 int
 406 ipv6_mask(struct in6_addr *mask, int len)
 407 {
 408         static const unsigned char masks[NBBY] =
 409             { 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff };
 410         int bytes, bits, i;
 411
 412         if (len < 0 || len > 128) {
 413                 errno = EINVAL;
 414                 return -1;
 415         }
 416
 417         memset(mask, 0, sizeof(*mask));
 418         bytes = len / NBBY;
 419         bits = len % NBBY;
 420         for (i = 0; i < bytes; i++)
 421                 mask->s6_addr[i] = 0xff;
 422         if (bits != 0) {
 423                 /* Coverify false positive.
 424                  * bytelen cannot be 16 if bitlen is non zero */
 425                 /* coverity[overrun-local] */
 426                 mask->s6_addr[bytes] = masks[bits - 1];
 427         }
 428         return 0;
 429 }
 430
 431 uint8_t
 432 ipv6_prefixlen(const struct in6_addr *mask)
 433 {
 434         int x = 0, y;
 435         const unsigned char *lim, *p;
 436
 437         lim = (const unsigned char *)mask + sizeof(*mask);
 438         for (p = (const unsigned char *)mask; p < lim; x++, p++) {
 439                 if (*p != 0xff)
 440                         break;
 441         }
 442         y = 0;
 443         if (p < lim) {
 444                 for (y = 0; y < NBBY; y++) {
 445                         if ((*p & (0x80 >> y)) == 0)
 446                                 break;
 447                 }
 448         }
 449
 450         /*
 451          * when the limit pointer is given, do a stricter check on the
 452          * remaining bits.
 453          */
 454         if (p < lim) {
 455                 if (y != 0 && (*p & (0x00ff >> y)) != 0)
 456                         return 0;
 457                 for (p = p + 1; p < lim; p++)
 458                         if (*p != 0)
 459                                 return 0;
 460         }
 461
 462         return (uint8_t)(x * NBBY + y);
 463 }
 464
 465 static void
 466 in6_to_h64(uint64_t *vhigh, uint64_t *vlow, const struct in6_addr *addr)
 467 {
 468
 469         *vhigh = be64dec(addr->s6_addr);
 470         *vlow = be64dec(addr->s6_addr + 8);
 471 }
 472
 473 static void
 474 h64_to_in6(struct in6_addr *addr, uint64_t vhigh, uint64_t vlow)
 475 {
 476
 477         be64enc(addr->s6_addr, vhigh);
 478         be64enc(addr->s6_addr + 8, vlow);
 479 }
 480
 481 int
 482 ipv6_userprefix(
 483         const struct in6_addr *prefix,  // prefix from router
 484         short prefix_len,               // length of prefix received
 485         uint64_t user_number,           // "random" number from user
 486         struct in6_addr *result,        // resultant prefix
 487         short result_len)               // desired prefix length
 488 {
 489         uint64_t vh, vl, user_low, user_high;
 490
 491         if (prefix_len < 1 || prefix_len > 128 ||
 492             result_len < 1 || result_len > 128)
 493         {
 494                 errno = EINVAL;
 495                 return -1;
 496         }
 497
 498         /* Check that the user_number fits inside result_len less prefix_len */
 499         if (result_len < prefix_len ||
 500             fls64(user_number) > result_len - prefix_len)
 501         {
 502                errno = ERANGE;
 503                return -1;
 504         }
 505
 506         /* If user_number is zero, just copy the prefix into the result. */
 507         if (user_number == 0) {
 508                 *result = *prefix;
 509                 return 0;
 510         }
 511
 512         /* Shift user_number so it fit's just inside result_len.
 513          * Shifting by 0 or sizeof(user_number) is undefined,
 514          * so we cater for that. */
 515         if (result_len == 128) {
 516                 user_high = 0;
 517                 user_low = user_number;
 518         } else if (result_len > 64) {
 519                 if (prefix_len >= 64)
 520                         user_high = 0;
 521                 else
 522                         user_high = user_number >> (result_len - prefix_len);
 523                 user_low = user_number << (128 - result_len);
 524         } else if (result_len == 64) {
 525                 user_high = user_number;
 526                 user_low = 0;
 527         } else {
 528                 user_high = user_number << (64 - result_len);
 529                 user_low = 0;
 530         }
 531
 532         /* convert to two 64bit host order values */
 533         in6_to_h64(&vh, &vl, prefix);
 534
 535         vh |= user_high;
 536         vl |= user_low;
 537
 538         /* copy back result */
 539         h64_to_in6(result, vh, vl);
 540
 541         return 0;
 542 }
 543
 544 #ifdef IPV6_POLLADDRFLAG
 545 void
 546 ipv6_checkaddrflags(void *arg)
 547 {
 548         struct ipv6_addr *ia;
 549         int flags;
 550         const char *alias;
 551
 552         ia = arg;
 553 #ifdef ALIAS_ADDR
 554         alias = ia->alias;
 555 #else
 556         alias = NULL;
 557 #endif
 558         if ((flags = if_addrflags6(ia->iface, &ia->addr, alias)) == -1) {
 559                 if (errno != EEXIST && errno != EADDRNOTAVAIL)
 560                         logerr("%s: if_addrflags6", __func__);
 561                 return;
 562         }
 563
 564         if (!(flags & IN6_IFF_TENTATIVE)) {
 565                 /* Simulate the kernel announcing the new address. */
 566                 ipv6_handleifa(ia->iface->ctx, RTM_NEWADDR,
 567                     ia->iface->ctx->ifaces, ia->iface->name,
 568                     &ia->addr, ia->prefix_len, flags, 0);
 569         } else {
 570                 /* Still tentative? Check again in a bit. */
 571                 struct timespec tv;
 572
 573                 ms_to_ts(&tv, RETRANS_TIMER / 2);
 574                 eloop_timeout_add_tv(ia->iface->ctx->eloop, &tv,
 575                     ipv6_checkaddrflags, ia);
 576         }
 577 }
 578 #endif
 579
 580 static void
 581 ipv6_deletedaddr(struct ipv6_addr *ia)
 582 {
 583
 584 #ifdef SMALL
 585         UNUSED(ia);
 586 #else
 587         /* NOREJECT is set if we delegated exactly the prefix to another
 588          * address.
 589          * This can only be one address, so just clear the flag.
 590          * This should ensure the reject route will be restored. */
 591         if (ia->delegating_prefix != NULL)
 592                 ia->delegating_prefix->flags &= ~IPV6_AF_NOREJECT;
 593 #endif
 594 }
 595
 596 void
 597 ipv6_deleteaddr(struct ipv6_addr *ia)
 598 {
 599         struct ipv6_state *state;
 600         struct ipv6_addr *ap;
 601
 602         loginfox("%s: deleting address %s", ia->iface->name, ia->saddr);
 603         if (if_address6(RTM_DELADDR, ia) == -1 &&
 604             errno != EADDRNOTAVAIL && errno != ESRCH &&
 605             errno != ENXIO && errno != ENODEV)
 606                 logerr(__func__);
 607
 608         ipv6_deletedaddr(ia);
 609
 610         state = IPV6_STATE(ia->iface);
 611         TAILQ_FOREACH(ap, &state->addrs, next) {
 612                 if (IN6_ARE_ADDR_EQUAL(&ap->addr, &ia->addr)) {
 613                         TAILQ_REMOVE(&state->addrs, ap, next);
 614                         ipv6_freeaddr(ap);
 615                         break;
 616                 }
 617         }
 618
 619 #ifdef ND6_ADVERTISE
 620         /* Advertise the address if it exists on another interface. */
 621         ipv6nd_advertise(ia);
 622 #endif
 623 }
 624
 625 static int
 626 ipv6_addaddr1(struct ipv6_addr *ia, const struct timespec *now)
 627 {
 628         struct interface *ifp;
 629         uint32_t pltime, vltime;
 630         __printflike(1, 2) void (*logfunc)(const char *, ...);
 631 #ifdef ND6_ADVERTISE
 632         bool vltime_was_zero = ia->prefix_vltime == 0;
 633 #endif
 634 #ifdef __sun
 635         struct ipv6_state *state;
 636         struct ipv6_addr *ia2;
 637
 638         /* If we re-add then address on Solaris then the prefix
 639          * route will be scrubbed and re-added. Something might
 640          * be using it, so let's avoid it. */
 641         if (ia->flags & IPV6_AF_DADCOMPLETED) {
 642                 logdebugx("%s: IP address %s already exists",
 643                     ia->iface->name, ia->saddr);
 644 #ifdef ND6_ADVERTISE
 645                 goto advertise;
 646 #else
 647                 return 0;
 648 #endif
 649         }
 650 #endif
 651
 652         /* Remember the interface of the address. */
 653         ifp = ia->iface;
 654
 655         if (!(ia->flags & IPV6_AF_DADCOMPLETED) &&
 656             ipv6_iffindaddr(ifp, &ia->addr, IN6_IFF_NOTUSEABLE))
 657                 ia->flags |= IPV6_AF_DADCOMPLETED;
 658
 659         /* Adjust plftime and vltime based on acquired time */
 660         pltime = ia->prefix_pltime;
 661         vltime = ia->prefix_vltime;
 662         if (timespecisset(&ia->acquired) &&
 663             (ia->prefix_pltime != ND6_INFINITE_LIFETIME ||
 664             ia->prefix_vltime != ND6_INFINITE_LIFETIME))
 665         {
 666                 struct timespec n;
 667
 668                 if (now == NULL) {
 669                         clock_gettime(CLOCK_MONOTONIC, &n);
 670                         now = &n;
 671                 }
 672                 timespecsub(now, &ia->acquired, &n);
 673                 if (ia->prefix_pltime != ND6_INFINITE_LIFETIME) {
 674                         ia->prefix_pltime -= (uint32_t)n.tv_sec;
 675                         /* This can happen when confirming a
 676                          * deprecated but still valid lease. */
 677                         if (ia->prefix_pltime > pltime)
 678                                 ia->prefix_pltime = 0;
 679                 }
 680                 if (ia->prefix_vltime != ND6_INFINITE_LIFETIME) {
 681                         ia->prefix_vltime -= (uint32_t)n.tv_sec;
 682                         /* This should never happen. */
 683                         if (ia->prefix_vltime > vltime) {
 684                                 logerrx("%s: %s: lifetime overflow",
 685                                     ifp->name, ia->saddr);
 686                                 ia->prefix_vltime = ia->prefix_pltime = 0;
 687                         }
 688                 }
 689         }
 690
 691         logfunc = ia->flags & IPV6_AF_NEW ? loginfox : logdebugx;
 692         logfunc("%s: adding %saddress %s", ifp->name,
 693 #ifdef IPV6_AF_TEMPORARY
 694             ia->flags & IPV6_AF_TEMPORARY ? "temporary " : "",
 695 #else
 696             "",
 697 #endif
 698             ia->saddr);
 699         if (ia->prefix_pltime == ND6_INFINITE_LIFETIME &&
 700             ia->prefix_vltime == ND6_INFINITE_LIFETIME)
 701                 logdebugx("%s: pltime infinity, vltime infinity",
 702                     ifp->name);
 703         else if (ia->prefix_pltime == ND6_INFINITE_LIFETIME)
 704                 logdebugx("%s: pltime infinity, vltime %"PRIu32" seconds",
 705                     ifp->name, ia->prefix_vltime);
 706         else if (ia->prefix_vltime == ND6_INFINITE_LIFETIME)
 707                 logdebugx("%s: pltime %"PRIu32"seconds, vltime infinity",
 708                     ifp->name, ia->prefix_pltime);
 709         else
 710                 logdebugx("%s: pltime %"PRIu32" seconds, vltime %"PRIu32
 711                     " seconds",
 712                     ifp->name, ia->prefix_pltime, ia->prefix_vltime);
 713
 714         if (if_address6(RTM_NEWADDR, ia) == -1) {
 715                 logerr(__func__);
 716                 /* Restore real pltime and vltime */
 717                 ia->prefix_pltime = pltime;
 718                 ia->prefix_vltime = vltime;
 719                 return -1;
 720         }
 721
 722 #ifdef IPV6_MANAGETEMPADDR
 723         /* RFC4941 Section 3.4 */
 724         if (ia->flags & IPV6_AF_TEMPORARY &&
 725             ia->prefix_pltime &&
 726             ia->prefix_vltime &&
 727             ip6_use_tempaddr(ifp->name))
 728                 eloop_timeout_add_sec(ifp->ctx->eloop,
 729                     (time_t)ia->prefix_pltime - REGEN_ADVANCE,
 730                     ipv6_regentempaddr, ia);
 731 #endif
 732
 733         /* Restore real pltime and vltime */
 734         ia->prefix_pltime = pltime;
 735         ia->prefix_vltime = vltime;
 736
 737         ia->flags &= ~IPV6_AF_NEW;
 738         ia->flags |= IPV6_AF_ADDED;
 739 #ifndef SMALL
 740         if (ia->delegating_prefix != NULL)
 741                 ia->flags |= IPV6_AF_DELEGATED;
 742 #endif
 743
 744 #ifdef IPV6_POLLADDRFLAG
 745         eloop_timeout_delete(ifp->ctx->eloop,
 746                 ipv6_checkaddrflags, ia);
 747         if (!(ia->flags & IPV6_AF_DADCOMPLETED)) {
 748                 struct timespec tv;
 749
 750                 ms_to_ts(&tv, RETRANS_TIMER / 2);
 751                 eloop_timeout_add_tv(ifp->ctx->eloop,
 752                     &tv, ipv6_checkaddrflags, ia);
 753         }
 754 #endif
 755
 756 #ifdef __sun
 757         /* Solaris does not announce new addresses which need DaD
 758          * so we need to take a copy and add it to our list.
 759          * Otherwise aliasing gets confused if we add another
 760          * address during DaD. */
 761
 762         state = IPV6_STATE(ifp);
 763         TAILQ_FOREACH(ia2, &state->addrs, next) {
 764                 if (IN6_ARE_ADDR_EQUAL(&ia2->addr, &ia->addr))
 765                         break;
 766         }
 767         if (ia2 == NULL) {
 768                 if ((ia2 = malloc(sizeof(*ia2))) == NULL) {
 769                         logerr(__func__);
 770                         return 0; /* Well, we did add the address */
 771                 }
 772                 memcpy(ia2, ia, sizeof(*ia2));
 773                 TAILQ_INSERT_TAIL(&state->addrs, ia2, next);
 774         }
 775 #endif
 776
 777 #ifdef ND6_ADVERTISE
 778 #ifdef __sun
 779 advertise:
 780 #endif
 781         /* Re-advertise the preferred address to be safe. */
 782         if (!vltime_was_zero)
 783                 ipv6nd_advertise(ia);
 784 #endif
 785
 786         return 0;
 787 }
 788
 789 #ifdef ALIAS_ADDR
 790 /* Find the next logical alias address we can use. */
 791 static int
 792 ipv6_aliasaddr(struct ipv6_addr *ia, struct ipv6_addr **repl)
 793 {
 794         struct ipv6_state *state;
 795         struct ipv6_addr *iap;
 796         unsigned int lun;
 797         char alias[IF_NAMESIZE];
 798
 799         if (ia->alias[0] != '\0')
 800                 return 0;
 801         state = IPV6_STATE(ia->iface);
 802
 803         /* First find an existng address.
 804          * This can happen when dhcpcd restarts as ND and DHCPv6
 805          * maintain their own lists of addresses. */
 806         TAILQ_FOREACH(iap, &state->addrs, next) {
 807                 if (iap->alias[0] != '\0' &&
 808                     IN6_ARE_ADDR_EQUAL(&iap->addr, &ia->addr))
 809                 {
 810                         strlcpy(ia->alias, iap->alias, sizeof(ia->alias));
 811                         return 0;
 812                 }
 813         }
 814
 815         lun = 0;
 816 find_unit:
 817         if (if_makealias(alias, IF_NAMESIZE, ia->iface->name, lun) >=
 818             IF_NAMESIZE)
 819         {
 820                 errno = ENOMEM;
 821                 return -1;
 822         }
 823         TAILQ_FOREACH(iap, &state->addrs, next) {
 824                 if (iap->alias[0] == '\0')
 825                         continue;
 826                 if (IN6_IS_ADDR_UNSPECIFIED(&iap->addr)) {
 827                         /* No address assigned? Lets use it. */
 828                         strlcpy(ia->alias, iap->alias, sizeof(ia->alias));
 829                         if (repl)
 830                                 *repl = iap;
 831                         return 1;
 832                 }
 833                 if (strcmp(iap->alias, alias) == 0)
 834                         break;
 835         }
 836
 837         if (iap != NULL) {
 838                 if (lun == UINT_MAX) {
 839                         errno = ERANGE;
 840                         return -1;
 841                 }
 842                 lun++;
 843                 goto find_unit;
 844         }
 845
 846         strlcpy(ia->alias, alias, sizeof(ia->alias));
 847         return 0;
 848 }
 849 #endif
 850
 851 int
 852 ipv6_addaddr(struct ipv6_addr *ia, const struct timespec *now)
 853 {
 854         int r;
 855 #ifdef ALIAS_ADDR
 856         int replaced, blank;
 857         struct ipv6_addr *replaced_ia;
 858
 859         blank = (ia->alias[0] == '\0');
 860         if ((replaced = ipv6_aliasaddr(ia, &replaced_ia)) == -1)
 861                 return -1;
 862         if (blank)
 863                 logdebugx("%s: aliased %s", ia->alias, ia->saddr);
 864 #endif
 865
 866         if ((r = ipv6_addaddr1(ia, now)) == 0) {
 867 #ifdef ALIAS_ADDR
 868                 if (replaced) {
 869                         struct ipv6_state *state;
 870
 871                         state = IPV6_STATE(ia->iface);
 872                         TAILQ_REMOVE(&state->addrs, replaced_ia, next);
 873                         ipv6_freeaddr(replaced_ia);
 874                 }
 875 #endif
 876         }
 877         return r;
 878 }
 879
 880 int
 881 ipv6_findaddrmatch(const struct ipv6_addr *addr, const struct in6_addr *match,
 882     unsigned int flags)
 883 {
 884
 885         if (match == NULL) {
 886                 if ((addr->flags &
 887                     (IPV6_AF_ADDED | IPV6_AF_DADCOMPLETED)) ==
 888                     (IPV6_AF_ADDED | IPV6_AF_DADCOMPLETED))
 889                         return 1;
 890         } else if (addr->prefix_vltime &&
 891             IN6_ARE_ADDR_EQUAL(&addr->addr, match) &&
 892             (!flags || addr->flags & flags))
 893                 return 1;
 894
 895         return 0;
 896 }
 897
 898 struct ipv6_addr *
 899 ipv6_findaddr(struct dhcpcd_ctx *ctx, const struct in6_addr *addr, unsigned int flags)
 900 {
 901         struct ipv6_addr *nap;
 902 #ifdef DHCP6
 903         struct ipv6_addr *dap;
 904 #endif
 905
 906         nap = ipv6nd_findaddr(ctx, addr, flags);
 907 #ifdef DHCP6
 908         dap = dhcp6_findaddr(ctx, addr, flags);
 909         if (!dap && !nap)
 910                 return NULL;
 911         if (dap && !nap)
 912                 return dap;
 913         if (nap && !dap)
 914                 return nap;
 915         if (nap->iface->metric < dap->iface->metric)
 916                 return nap;
 917         return dap;
 918 #else
 919         return nap;
 920 #endif
 921 }
 922
 923 ssize_t
 924 ipv6_addaddrs(struct ipv6_addrhead *addrs)
 925 {
 926         struct ipv6_addr *ap, *apn;
 927         ssize_t i;
 928         struct timespec now;
 929
 930         i = 0;
 931         timespecclear(&now);
 932         TAILQ_FOREACH_SAFE(ap, addrs, next, apn) {
 933                 /* A delegated prefix is not an address. */
 934                 if (ap->flags & IPV6_AF_DELEGATEDPFX)
 935                         continue;
 936                 if (ap->prefix_vltime == 0) {
 937                         if (ap->flags & IPV6_AF_ADDED) {
 938                                 ipv6_deleteaddr(ap);
 939                                 i++;
 940                         }
 941                         eloop_q_timeout_delete(ap->iface->ctx->eloop,
 942                             0, NULL, ap);
 943                         if (ap->flags & IPV6_AF_REQUEST) {
 944                                 ap->flags &= ~IPV6_AF_ADDED;
 945                         } else {
 946                                 TAILQ_REMOVE(addrs, ap, next);
 947                                 ipv6_freeaddr(ap);
 948                         }
 949                 } else if (!(ap->flags & IPV6_AF_STALE) &&
 950                     !IN6_IS_ADDR_UNSPECIFIED(&ap->addr))
 951                 {
 952                         if (ap->flags & IPV6_AF_NEW)
 953                                 i++;
 954                         if (!timespecisset(&now))
 955                                 clock_gettime(CLOCK_MONOTONIC, &now);
 956                         ipv6_addaddr(ap, &now);
 957                 }
 958         }
 959
 960         return i;
 961 }
 962
 963 void
 964 ipv6_freeaddr(struct ipv6_addr *ia)
 965 {
 966 #ifndef SMALL
 967         struct ipv6_addr *iad;
 968
 969         /* Forget the reference */
 970         if (ia->flags & IPV6_AF_DELEGATEDPFX) {
 971                 TAILQ_FOREACH(iad, &ia->pd_pfxs, pd_next) {
 972                         iad->delegating_prefix = NULL;
 973                 }
 974         } else if (ia->delegating_prefix != NULL) {
 975                 TAILQ_REMOVE(&ia->delegating_prefix->pd_pfxs, ia, pd_next);
 976         }
 977 #endif
 978
 979         if (ia->dhcp6_fd != -1) {
 980                 close(ia->dhcp6_fd);
 981                 eloop_event_delete(ia->iface->ctx->eloop, ia->dhcp6_fd);
 982         }
 983
 984         eloop_q_timeout_delete(ia->iface->ctx->eloop, 0, NULL, ia);
 985         free(ia->na);
 986         free(ia);
 987 }
 988
 989 void
 990 ipv6_freedrop_addrs(struct ipv6_addrhead *addrs, int drop,
 991     const struct interface *ifd)
 992 {
 993         struct ipv6_addr *ap, *apn, *apf;
 994         struct timespec now;
 995
 996 #ifdef SMALL
 997         UNUSED(ifd);
 998 #endif
 999         timespecclear(&now);
1000         TAILQ_FOREACH_SAFE(ap, addrs, next, apn) {
1001 #ifndef SMALL
1002                 if (ifd != NULL &&
1003                     (ap->delegating_prefix == NULL ||
1004                     ap->delegating_prefix->iface != ifd))
1005                         continue;
1006 #endif
1007                 if (drop != 2)
1008                         TAILQ_REMOVE(addrs, ap, next);
1009                 if (drop && ap->flags & IPV6_AF_ADDED &&
1010                     (ap->iface->options->options &
1011                     (DHCPCD_EXITING | DHCPCD_PERSISTENT)) !=
1012                     (DHCPCD_EXITING | DHCPCD_PERSISTENT))
1013                 {
1014                         /* Don't drop link-local addresses. */
1015                         if (!IN6_IS_ADDR_LINKLOCAL(&ap->addr) ||
1016                             CAN_DROP_LLADDR(ap->iface))
1017                         {
1018                                 if (drop == 2)
1019                                         TAILQ_REMOVE(addrs, ap, next);
1020                                 /* Find the same address somewhere else */
1021                                 apf = ipv6_findaddr(ap->iface->ctx, &ap->addr,
1022                                     0);
1023                                 if ((apf == NULL ||
1024                                     (apf->iface != ap->iface)))
1025                                         ipv6_deleteaddr(ap);
1026                                 if (!(ap->iface->options->options &
1027                                     DHCPCD_EXITING) && apf)
1028                                 {
1029                                         if (!timespecisset(&now))
1030                                                 clock_gettime(CLOCK_MONOTONIC,
1031                                                     &now);
1032                                         ipv6_addaddr(apf, &now);
1033                                 }
1034                                 if (drop == 2)
1035                                         ipv6_freeaddr(ap);
1036                         }
1037                 }
1038                 if (drop != 2)
1039                         ipv6_freeaddr(ap);
1040         }
1041 }
1042
1043 static struct ipv6_state *
1044 ipv6_getstate(struct interface *ifp)
1045 {
1046         struct ipv6_state *state;
1047
1048         state = IPV6_STATE(ifp);
1049         if (state == NULL) {
1050                 ifp->if_data[IF_DATA_IPV6] = calloc(1, sizeof(*state));
1051                 state = IPV6_STATE(ifp);
1052                 if (state == NULL) {
1053                         logerr(__func__);
1054                         return NULL;
1055                 }
1056                 TAILQ_INIT(&state->addrs);
1057                 TAILQ_INIT(&state->ll_callbacks);
1058
1059                 /* Regenerate new ids */
1060                 if (ifp->options &&
1061                     ip6_use_tempaddr(ifp->name))
1062                         ipv6_regentempifid(ifp);
1063         }
1064         return state;
1065 }
1066
1067 struct ipv6_addr *
1068 ipv6_anyglobal(struct interface *sifp)
1069 {
1070         struct interface *ifp;
1071         struct ipv6_state *state;
1072         struct ipv6_addr *ia;
1073
1074         TAILQ_FOREACH(ifp, sifp->ctx->ifaces, next) {
1075                 if (ifp != sifp && ip6_forwarding(ifp->name) != 1)
1076                         continue;
1077
1078                 state = IPV6_STATE(ifp);
1079                 if (state == NULL)
1080                         continue;
1081
1082                 TAILQ_FOREACH(ia, &state->addrs, next) {
1083                         if (IN6_IS_ADDR_LINKLOCAL(&ia->addr))
1084                                 continue;
1085                         /* Let's be optimistic.
1086                          * Any decent OS won't forward or accept traffic
1087                          * from/to tentative or detached addresses. */
1088                         if (!(ia->addr_flags & IN6_IFF_DUPLICATED))
1089                                 return ia;
1090                 }
1091         }
1092         return NULL;
1093 }
1094
1095 void
1096 ipv6_handleifa(struct dhcpcd_ctx *ctx,
1097     int cmd, struct if_head *ifs, const char *ifname,
1098     const struct in6_addr *addr, uint8_t prefix_len, int addrflags, pid_t pid)
1099 {
1100         struct interface *ifp;
1101         struct ipv6_state *state;
1102         struct ipv6_addr *ia;
1103         struct ll_callback *cb;
1104         bool anyglobal;
1105
1106 #ifdef __sun
1107         struct sockaddr_in6 subnet;
1108
1109         /* Solaris on-link route is an unspecified address! */
1110         if (IN6_IS_ADDR_UNSPECIFIED(addr)) {
1111                 if (if_getsubnet(ctx, ifname, AF_INET6,
1112                     &subnet, sizeof(subnet)) == -1)
1113                 {
1114                         logerr(__func__);
1115                         return;
1116                 }
1117                 addr = &subnet.sin6_addr;
1118         }
1119 #endif
1120
1121 #if 0
1122         char dbuf[INET6_ADDRSTRLEN];
1123         const char *dbp;
1124
1125         dbp = inet_ntop(AF_INET6, &addr->s6_addr,
1126             dbuf, INET6_ADDRSTRLEN);
1127         loginfox("%s: cmd %d addr %s addrflags %d",
1128             ifname, cmd, dbp, addrflags);
1129 #endif
1130
1131         if (ifs == NULL)
1132                 ifs = ctx->ifaces;
1133         if (ifs == NULL)
1134                 return;
1135         if ((ifp = if_find(ifs, ifname)) == NULL)
1136                 return;
1137         if ((state = ipv6_getstate(ifp)) == NULL)
1138                 return;
1139         anyglobal = ipv6_anyglobal(ifp) != NULL;
1140
1141         TAILQ_FOREACH(ia, &state->addrs, next) {
1142                 if (IN6_ARE_ADDR_EQUAL(&ia->addr, addr))
1143                         break;
1144         }
1145
1146         switch (cmd) {
1147         case RTM_DELADDR:
1148                 if (ia != NULL) {
1149                         TAILQ_REMOVE(&state->addrs, ia, next);
1150 #ifdef ND6_ADVERTISE
1151                         /* Advertise the address if it exists on
1152                          * another interface. */
1153                         ipv6nd_advertise(ia);
1154 #endif
1155                         /* We'll free it at the end of the function. */
1156                 }
1157                 break;
1158         case RTM_NEWADDR:
1159                 if (ia == NULL) {
1160                         ia = ipv6_newaddr(ifp, addr, prefix_len, 0);
1161 #ifdef ALIAS_ADDR
1162                         strlcpy(ia->alias, ifname, sizeof(ia->alias));
1163 #endif
1164                         if (if_getlifetime6(ia) == -1) {
1165                                 /* No support or address vanished.
1166                                  * Either way, just set a deprecated
1167                                  * infinite time lifetime and continue.
1168                                  * This is fine because we only want
1169                                  * to know this when trying to extend
1170                                  * temporary addresses.
1171                                  * As we can't extend infinite, we'll
1172                                  * create a new temporary address. */
1173                                 ia->prefix_pltime = 0;
1174                                 ia->prefix_vltime =
1175                                     ND6_INFINITE_LIFETIME;
1176                         }
1177                         /* This is a minor regression against RFC 4941
1178                          * because the kernel only knows when the
1179                          * lifetimes were last updated, not when the
1180                          * address was initially created.
1181                          * Provided dhcpcd is not restarted, this
1182                          * won't be a problem.
1183                          * If we don't like it, we can always
1184                          * pretend lifetimes are infinite and always
1185                          * generate a new temporary address on
1186                          * restart. */
1187                         ia->acquired = ia->created;
1188                         TAILQ_INSERT_TAIL(&state->addrs, ia, next);
1189                 }
1190                 ia->addr_flags = addrflags;
1191                 ia->flags &= ~IPV6_AF_STALE;
1192 #ifdef IPV6_MANAGETEMPADDR
1193                 if (ia->addr_flags & IN6_IFF_TEMPORARY)
1194                         ia->flags |= IPV6_AF_TEMPORARY;
1195 #endif
1196                 if (IN6_IS_ADDR_LINKLOCAL(&ia->addr) || ia->dadcallback) {
1197 #ifdef IPV6_POLLADDRFLAG
1198                         if (ia->addr_flags & IN6_IFF_TENTATIVE) {
1199                                 struct timespec tv;
1200
1201                                 ms_to_ts(&tv, RETRANS_TIMER / 2);
1202                                 eloop_timeout_add_tv(
1203                                     ia->iface->ctx->eloop,
1204                                     &tv, ipv6_checkaddrflags, ia);
1205                                 break;
1206                         }
1207 #endif
1208
1209                         if (ia->dadcallback) {
1210                                 ia->dadcallback(ia);
1211                                 if (ctx->options & DHCPCD_FORKED)
1212                                         goto out;
1213                         }
1214
1215                         if (IN6_IS_ADDR_LINKLOCAL(&ia->addr) &&
1216                             !(ia->addr_flags & IN6_IFF_NOTUSEABLE))
1217                         {
1218                                 /* Now run any callbacks.
1219                                  * Typically IPv6RS or DHCPv6 */
1220                                 while ((cb =
1221                                     TAILQ_FIRST(&state->ll_callbacks)))
1222                                 {
1223                                         TAILQ_REMOVE(
1224                                             &state->ll_callbacks,
1225                                             cb, next);
1226                                         cb->callback(cb->arg);
1227                                         free(cb);
1228                                         if (ctx->options & DHCPCD_FORKED)
1229                                                 goto out;
1230                                 }
1231                         }
1232                 }
1233                 break;
1234         }
1235
1236         if (ia == NULL)
1237                 return;
1238
1239         ctx->options &= ~DHCPCD_RTBUILD;
1240         ipv6nd_handleifa(cmd, ia, pid);
1241 #ifdef DHCP6
1242         dhcp6_handleifa(cmd, ia, pid);
1243 #endif
1244
1245 out:
1246         /* Done with the ia now, so free it. */
1247         if (cmd == RTM_DELADDR)
1248                 ipv6_freeaddr(ia);
1249         else if (!(ia->addr_flags & IN6_IFF_NOTUSEABLE))
1250                 ia->flags |= IPV6_AF_DADCOMPLETED;
1251
1252         /* If we've not already called rt_build via the IPv6ND
1253          * or DHCP6 handlers and the existance of any useable
1254          * global address on the interface has changed,
1255          * call rt_build to add/remove the default route. */
1256         if (ifp->active && ifp->options->options & DHCPCD_IPV6 &&
1257             !(ctx->options & DHCPCD_RTBUILD) &&
1258             (ipv6_anyglobal(ifp) != NULL) != anyglobal)
1259                 rt_build(ctx, AF_INET6);
1260 }
1261
1262 int
1263 ipv6_hasaddr(const struct interface *ifp)
1264 {
1265
1266         if (ipv6nd_iffindaddr(ifp, NULL, 0) != NULL)
1267                 return 1;
1268 #ifdef DHCP6
1269         if (dhcp6_iffindaddr(ifp, NULL, 0) != NULL)
1270                 return 1;
1271 #endif
1272         return 0;
1273 }
1274
1275 struct ipv6_addr *
1276 ipv6_iffindaddr(struct interface *ifp, const struct in6_addr *addr,
1277     int revflags)
1278 {
1279         struct ipv6_state *state;
1280         struct ipv6_addr *ap;
1281
1282         state = IPV6_STATE(ifp);
1283         if (state) {
1284                 TAILQ_FOREACH(ap, &state->addrs, next) {
1285                         if (addr == NULL) {
1286                                 if (IN6_IS_ADDR_LINKLOCAL(&ap->addr) &&
1287                                     (!revflags || !(ap->addr_flags & revflags)))
1288                                         return ap;
1289                         } else {
1290                                 if (IN6_ARE_ADDR_EQUAL(&ap->addr, addr) &&
1291                                     (!revflags || !(ap->addr_flags & revflags)))
1292                                         return ap;
1293                         }
1294                 }
1295         }
1296         return NULL;
1297 }
1298
1299 static struct ipv6_addr *
1300 ipv6_iffindmaskaddr(const struct interface *ifp, const struct in6_addr *addr)
1301 {
1302         struct ipv6_state *state;
1303         struct ipv6_addr *ap;
1304         struct in6_addr mask;
1305
1306         state = IPV6_STATE(ifp);
1307         if (state) {
1308                 TAILQ_FOREACH(ap, &state->addrs, next) {
1309                         if (ipv6_mask(&mask, ap->prefix_len) == -1)
1310                                 continue;
1311                         if (IN6_ARE_MASKED_ADDR_EQUAL(&ap->addr, addr, &mask))
1312                                 return ap;
1313                 }
1314         }
1315         return NULL;
1316 }
1317
1318 struct ipv6_addr *
1319 ipv6_findmaskaddr(struct dhcpcd_ctx *ctx, const struct in6_addr *addr)
1320 {
1321         struct interface *ifp;
1322         struct ipv6_addr *ap;
1323
1324         TAILQ_FOREACH(ifp, ctx->ifaces, next) {
1325                 ap = ipv6_iffindmaskaddr(ifp, addr);
1326                 if (ap != NULL)
1327                         return ap;
1328         }
1329         return NULL;
1330 }
1331
1332 int
1333 ipv6_addlinklocalcallback(struct interface *ifp,
1334     void (*callback)(void *), void *arg)
1335 {
1336         struct ipv6_state *state;
1337         struct ll_callback *cb;
1338
1339         state = ipv6_getstate(ifp);
1340         TAILQ_FOREACH(cb, &state->ll_callbacks, next) {
1341                 if (cb->callback == callback && cb->arg == arg)
1342                         break;
1343         }
1344         if (cb == NULL) {
1345                 cb = malloc(sizeof(*cb));
1346                 if (cb == NULL) {
1347                         logerr(__func__);
1348                         return -1;
1349                 }
1350                 cb->callback = callback;
1351                 cb->arg = arg;
1352                 TAILQ_INSERT_TAIL(&state->ll_callbacks, cb, next);
1353         }
1354         return 0;
1355 }
1356
1357 static struct ipv6_addr *
1358 ipv6_newlinklocal(struct interface *ifp)
1359 {
1360         struct ipv6_addr *ia;
1361         struct in6_addr in6;
1362
1363         memset(&in6, 0, sizeof(in6));
1364         in6.s6_addr32[0] = htonl(0xfe800000);
1365         ia = ipv6_newaddr(ifp, &in6, 64, 0);
1366         if (ia != NULL) {
1367                 ia->prefix_pltime = ND6_INFINITE_LIFETIME;
1368                 ia->prefix_vltime = ND6_INFINITE_LIFETIME;
1369         }
1370         return ia;
1371 }
1372
1373 static const uint8_t allzero[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
1374 static const uint8_t allone[8] =
1375     { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
1376
1377 static int
1378 ipv6_addlinklocal(struct interface *ifp)
1379 {
1380         struct ipv6_state *state;
1381         struct ipv6_addr *ap, *ap2;
1382         int dadcounter;
1383
1384         /* Check sanity before malloc */
1385         if (!(ifp->options->options & DHCPCD_SLAACPRIVATE)) {
1386                 switch (ifp->family) {
1387                 case ARPHRD_ETHER:
1388                         /* Check for a valid hardware address */
1389                         if (ifp->hwlen != 6 && ifp->hwlen != 8) {
1390                                 errno = ENOTSUP;
1391                                 return -1;
1392                         }
1393                         if (memcmp(ifp->hwaddr, allzero, ifp->hwlen) == 0 ||
1394                             memcmp(ifp->hwaddr, allone, ifp->hwlen) == 0)
1395                         {
1396                                 errno = EINVAL;
1397                                 return -1;
1398                         }
1399                         break;
1400                 default:
1401                         errno = ENOTSUP;
1402                         return -1;
1403                 }
1404         }
1405
1406         state = ipv6_getstate(ifp);
1407         if (state == NULL)
1408                 return -1;
1409
1410         ap = ipv6_newlinklocal(ifp);
1411         if (ap == NULL)
1412                 return -1;
1413
1414         dadcounter = 0;
1415         if (ifp->options->options & DHCPCD_SLAACPRIVATE) {
1416 nextslaacprivate:
1417                 if (ipv6_makestableprivate(&ap->addr,
1418                         &ap->prefix, ap->prefix_len, ifp, &dadcounter) == -1)
1419                 {
1420                         free(ap);
1421                         return -1;
1422                 }
1423                 ap->dadcounter = dadcounter;
1424         } else {
1425                 memcpy(ap->addr.s6_addr, ap->prefix.s6_addr, 8);
1426                 switch (ifp->family) {
1427                 case ARPHRD_ETHER:
1428                         if (ifp->hwlen == 6) {
1429                                 ap->addr.s6_addr[ 8] = ifp->hwaddr[0];
1430                                 ap->addr.s6_addr[ 9] = ifp->hwaddr[1];
1431                                 ap->addr.s6_addr[10] = ifp->hwaddr[2];
1432                                 ap->addr.s6_addr[11] = 0xff;
1433                                 ap->addr.s6_addr[12] = 0xfe;
1434                                 ap->addr.s6_addr[13] = ifp->hwaddr[3];
1435                                 ap->addr.s6_addr[14] = ifp->hwaddr[4];
1436                                 ap->addr.s6_addr[15] = ifp->hwaddr[5];
1437                         } else if (ifp->hwlen == 8)
1438                                 memcpy(&ap->addr.s6_addr[8], ifp->hwaddr, 8);
1439                         else {
1440                                 free(ap);
1441                                 errno = ENOTSUP;
1442                                 return -1;
1443                         }
1444                         break;
1445                 }
1446
1447                 /* Sanity check: g bit must not indciate "group" */
1448                 if (EUI64_GROUP(&ap->addr)) {
1449                         free(ap);
1450                         errno = EINVAL;
1451                         return -1;
1452                 }
1453                 EUI64_TO_IFID(&ap->addr);
1454         }
1455
1456         /* Do we already have this address? */
1457         TAILQ_FOREACH(ap2, &state->addrs, next) {
1458                 if (IN6_ARE_ADDR_EQUAL(&ap->addr, &ap2->addr)) {
1459                         if (ap2->addr_flags & IN6_IFF_DUPLICATED) {
1460                                 if (ifp->options->options &
1461                                     DHCPCD_SLAACPRIVATE)
1462                                 {
1463                                         dadcounter++;
1464                                         goto nextslaacprivate;
1465                                 }
1466                                 free(ap);
1467                                 errno = EADDRNOTAVAIL;
1468                                 return -1;
1469                         }
1470
1471                         logwarnx("%s: waiting for %s to complete",
1472                             ap2->iface->name, ap2->saddr);
1473                         free(ap);
1474                         errno = EEXIST;
1475                         return 0;
1476                 }
1477         }
1478
1479         inet_ntop(AF_INET6, &ap->addr, ap->saddr, sizeof(ap->saddr));
1480         TAILQ_INSERT_TAIL(&state->addrs, ap, next);
1481         ipv6_addaddr(ap, NULL);
1482         return 1;
1483 }
1484
1485 static int
1486 ipv6_tryaddlinklocal(struct interface *ifp)
1487 {
1488         struct ipv6_addr *ia;
1489
1490         /* We can't assign a link-locak address to this,
1491          * the ppp process has to. */
1492         if (ifp->flags & IFF_POINTOPOINT)
1493                 return 0;
1494
1495         ia = ipv6_iffindaddr(ifp, NULL, IN6_IFF_DUPLICATED);
1496         if (ia != NULL) {
1497 #ifdef IPV6_POLLADDRFLAG
1498                 if (ia->addr_flags & IN6_IFF_TENTATIVE) {
1499                         struct timespec tv;
1500
1501                         ms_to_ts(&tv, RETRANS_TIMER / 2);
1502                         eloop_timeout_add_tv(
1503                             ia->iface->ctx->eloop,
1504                             &tv, ipv6_checkaddrflags, ia);
1505                 }
1506 #endif
1507                 return 0;
1508         }
1509         if (!CAN_ADD_LLADDR(ifp))
1510                 return 0;
1511
1512         return ipv6_addlinklocal(ifp);
1513 }
1514
1515 struct ipv6_addr *
1516 ipv6_newaddr(struct interface *ifp, const struct in6_addr *addr,
1517     uint8_t prefix_len, unsigned int flags)
1518 {
1519         struct ipv6_addr *ia;
1520         char buf[INET6_ADDRSTRLEN];
1521         const char *cbp;
1522         bool tempaddr;
1523         int addr_flags;
1524
1525         /* If adding a new DHCP / RA derived address, check current flags
1526          * from an existing address. */
1527         ia = ipv6_iffindaddr(ifp, addr, 0);
1528         if (ia != NULL)
1529                 addr_flags = ia->addr_flags;
1530         else
1531                 addr_flags = IN6_IFF_TENTATIVE;
1532
1533         ia = calloc(1, sizeof(*ia));
1534         if (ia == NULL)
1535                 goto err;
1536
1537         ia->iface = ifp;
1538         ia->addr_flags = addr_flags;
1539         ia->flags = IPV6_AF_NEW | flags;
1540         if (!(ia->addr_flags & IN6_IFF_NOTUSEABLE))
1541                 ia->flags |= IPV6_AF_DADCOMPLETED;
1542         ia->prefix_len = prefix_len;
1543         ia->dhcp6_fd = -1;
1544
1545 #ifdef IPV6_AF_TEMPORARY
1546         tempaddr = ia->flags & IPV6_AF_TEMPORARY;
1547 #else
1548         tempaddr = false;
1549 #endif
1550
1551         if (ia->flags & IPV6_AF_AUTOCONF && !tempaddr) {
1552                 ia->prefix = *addr;
1553                 ia->dadcounter = ipv6_makeaddr(&ia->addr, ifp,
1554                                                &ia->prefix,
1555                                                ia->prefix_len);
1556                 if (ia->dadcounter == -1)
1557                         goto err;
1558         } else if (ia->flags & IPV6_AF_RAPFX) {
1559                 ia->prefix = *addr;
1560 #ifdef __sun
1561                 ia->addr = *addr;
1562                 cbp = inet_ntop(AF_INET6, &ia->addr, buf, sizeof(buf));
1563                 goto paddr;
1564 #else
1565                 return ia;
1566 #endif
1567         } else if (ia->flags & (IPV6_AF_REQUEST | IPV6_AF_DELEGATEDPFX) &&
1568                    prefix_len != 128)
1569         {
1570                 ia->prefix = *addr;
1571                 cbp = inet_ntop(AF_INET6, &ia->prefix, buf, sizeof(buf));
1572                 goto paddr;
1573         } else {
1574                 ia->addr = *addr;
1575                 if (ipv6_makeprefix(&ia->prefix,
1576                                     &ia->addr, ia->prefix_len) == -1)
1577                         goto err;
1578         }
1579
1580         cbp = inet_ntop(AF_INET6, &ia->addr, buf, sizeof(buf));
1581 paddr:
1582         if (cbp == NULL)
1583                 goto err;
1584         snprintf(ia->saddr, sizeof(ia->saddr), "%s/%d", cbp, ia->prefix_len);
1585
1586         return ia;
1587
1588 err:
1589         logerr(__func__);
1590         free(ia);
1591         return NULL;
1592 }
1593
1594 static void
1595 ipv6_staticdadcallback(void *arg)
1596 {
1597         struct ipv6_addr *ia = arg;
1598         int wascompleted;
1599
1600         wascompleted = (ia->flags & IPV6_AF_DADCOMPLETED);
1601         ia->flags |= IPV6_AF_DADCOMPLETED;
1602         if (ia->flags & IPV6_AF_DUPLICATED)
1603                 logwarnx("%s: DAD detected %s", ia->iface->name,
1604                     ia->saddr);
1605         else if (!wascompleted) {
1606                 logdebugx("%s: IPv6 static DAD completed",
1607                     ia->iface->name);
1608         }
1609
1610 #define FINISHED (IPV6_AF_ADDED | IPV6_AF_DADCOMPLETED)
1611         if (!wascompleted) {
1612                 struct interface *ifp;
1613                 struct ipv6_state *state;
1614
1615                 ifp = ia->iface;
1616                 state = IPV6_STATE(ifp);
1617                 TAILQ_FOREACH(ia, &state->addrs, next) {
1618                         if (ia->flags & IPV6_AF_STATIC &&
1619                             (ia->flags & FINISHED) != FINISHED)
1620                         {
1621                                 wascompleted = 1;
1622                                 break;
1623                         }
1624                 }
1625                 if (!wascompleted)
1626                         script_runreason(ifp, "STATIC6");
1627         }
1628 #undef FINISHED
1629 }
1630
1631 ssize_t
1632 ipv6_env(FILE *fp, const char *prefix, const struct interface *ifp)
1633 {
1634         struct ipv6_addr *ia;
1635
1636         ia = ipv6_iffindaddr(UNCONST(ifp), &ifp->options->req_addr6,
1637             IN6_IFF_NOTUSEABLE);
1638         if (ia == NULL)
1639                 return 0;
1640         if (efprintf(fp, "%s_ip6_address=%s", prefix, ia->saddr) == -1)
1641                 return -1;
1642         return 1;
1643 }
1644
1645 int
1646 ipv6_staticdadcompleted(const struct interface *ifp)
1647 {
1648         const struct ipv6_state *state;
1649         const struct ipv6_addr *ia;
1650         int n;
1651
1652         if ((state = IPV6_CSTATE(ifp)) == NULL)
1653                 return 0;
1654         n = 0;
1655 #define COMPLETED (IPV6_AF_STATIC | IPV6_AF_ADDED | IPV6_AF_DADCOMPLETED)
1656         TAILQ_FOREACH(ia, &state->addrs, next) {
1657                 if ((ia->flags & COMPLETED) == COMPLETED &&
1658                     !(ia->addr_flags & IN6_IFF_NOTUSEABLE))
1659                         n++;
1660         }
1661         return n;
1662 }
1663
1664 int
1665 ipv6_startstatic(struct interface *ifp)
1666 {
1667         struct ipv6_addr *ia;
1668         int run_script;
1669
1670         if (IN6_IS_ADDR_UNSPECIFIED(&ifp->options->req_addr6))
1671                 return 0;
1672
1673         ia = ipv6_iffindaddr(ifp, &ifp->options->req_addr6, 0);
1674         if (ia != NULL &&
1675             (ia->prefix_len != ifp->options->req_prefix_len ||
1676             ia->addr_flags & IN6_IFF_NOTUSEABLE))
1677         {
1678                 ipv6_deleteaddr(ia);
1679                 ia = NULL;
1680         }
1681         if (ia == NULL) {
1682                 struct ipv6_state *state;
1683
1684                 ia = ipv6_newaddr(ifp, &ifp->options->req_addr6,
1685                     ifp->options->req_prefix_len, 0);
1686                 if (ia == NULL)
1687                         return -1;
1688                 state = IPV6_STATE(ifp);
1689                 TAILQ_INSERT_TAIL(&state->addrs, ia, next);
1690                 run_script = 0;
1691         } else
1692                 run_script = 1;
1693         ia->flags |= IPV6_AF_STATIC | IPV6_AF_ONLINK;
1694         ia->prefix_vltime = ND6_INFINITE_LIFETIME;
1695         ia->prefix_pltime = ND6_INFINITE_LIFETIME;
1696         ia->dadcallback = ipv6_staticdadcallback;
1697         ipv6_addaddr(ia, NULL);
1698         rt_build(ifp->ctx, AF_INET6);
1699         if (run_script)
1700                 script_runreason(ifp, "STATIC6");
1701         return 1;
1702 }
1703
1704 /* Ensure the interface has a link-local address */
1705 int
1706 ipv6_start(struct interface *ifp)
1707 {
1708 #ifdef IPV6_POLLADDRFLAG
1709         struct ipv6_state *state;
1710
1711         /* We need to update the address flags. */
1712         if ((state = IPV6_STATE(ifp)) != NULL) {
1713                 struct ipv6_addr *ia;
1714                 const char *alias;
1715                 int flags;
1716
1717                 TAILQ_FOREACH(ia, &state->addrs, next) {
1718 #ifdef ALIAS_ADDR
1719                         alias = ia->alias;
1720 #else
1721                         alias = NULL;
1722 #endif
1723                         flags = if_addrflags6(ia->iface, &ia->addr, alias);
1724                         if (flags != -1)
1725                                 ia->addr_flags = flags;
1726                 }
1727         }
1728 #endif
1729
1730         if (ipv6_tryaddlinklocal(ifp) == -1)
1731                 return -1;
1732
1733         if (IPV6_CSTATE(ifp)) {
1734                 /* Regenerate new ids */
1735                 if (ip6_use_tempaddr(ifp->name))
1736                         ipv6_regentempifid(ifp);
1737         }
1738
1739         return 0;
1740 }
1741
1742 void
1743 ipv6_freedrop(struct interface *ifp, int drop)
1744 {
1745         struct ipv6_state *state;
1746         struct ll_callback *cb;
1747
1748         if (ifp == NULL)
1749                 return;
1750
1751         if ((state = IPV6_STATE(ifp)) == NULL)
1752                 return;
1753
1754         /* If we got here, we can get rid of any LL callbacks. */
1755         while ((cb = TAILQ_FIRST(&state->ll_callbacks))) {
1756                 TAILQ_REMOVE(&state->ll_callbacks, cb, next);
1757                 free(cb);
1758         }
1759
1760         ipv6_freedrop_addrs(&state->addrs, drop ? 2 : 0, NULL);
1761         if (drop) {
1762                 if (ifp->ctx->ra_routers != NULL)
1763                         rt_build(ifp->ctx, AF_INET6);
1764         } else {
1765                 /* Because we need to cache the addresses we don't control,
1766                  * we only free the state on when NOT dropping addresses. */
1767                 free(state);
1768                 ifp->if_data[IF_DATA_IPV6] = NULL;
1769                 eloop_timeout_delete(ifp->ctx->eloop, NULL, ifp);
1770         }
1771 }
1772
1773 void
1774 ipv6_ctxfree(struct dhcpcd_ctx *ctx)
1775 {
1776
1777         free(ctx->ra_routers);
1778         free(ctx->secret);
1779 }
1780
1781 int
1782 ipv6_handleifa_addrs(int cmd,
1783     struct ipv6_addrhead *addrs, const struct ipv6_addr *addr, pid_t pid)
1784 {
1785         struct ipv6_addr *ia, *ian;
1786         uint8_t found, alldadcompleted;
1787
1788         alldadcompleted = 1;
1789         found = 0;
1790         TAILQ_FOREACH_SAFE(ia, addrs, next, ian) {
1791                 if (!IN6_ARE_ADDR_EQUAL(&addr->addr, &ia->addr)) {
1792                         if (ia->flags & IPV6_AF_ADDED &&
1793                             !(ia->flags & IPV6_AF_DADCOMPLETED))
1794                                 alldadcompleted = 0;
1795                         continue;
1796                 }
1797                 switch (cmd) {
1798                 case RTM_DELADDR:
1799                         if (ia->flags & IPV6_AF_ADDED) {
1800                                 logwarnx("%s: pid %d deleted address %s",
1801                                     ia->iface->name, pid, ia->saddr);
1802                                 ia->flags &= ~IPV6_AF_ADDED;
1803                         }
1804                         if (ia->flags & IPV6_AF_DELEGATED) {
1805                                 TAILQ_REMOVE(addrs, ia, next);
1806                                 ipv6_deletedaddr(ia);
1807                                 ipv6_freeaddr(ia);
1808                         }
1809                         break;
1810                 case RTM_NEWADDR:
1811                         /* Safety - ignore tentative announcements */
1812                         if (addr->addr_flags &
1813                             (IN6_IFF_DETACHED | IN6_IFF_TENTATIVE))
1814                                 break;
1815                         if ((ia->flags & IPV6_AF_DADCOMPLETED) == 0) {
1816                                 found++;
1817                                 if (addr->addr_flags & IN6_IFF_DUPLICATED)
1818                                         ia->flags |= IPV6_AF_DUPLICATED;
1819                                 else
1820                                         ia->flags &= ~IPV6_AF_DUPLICATED;
1821                                 if (ia->dadcallback)
1822                                         ia->dadcallback(ia);
1823                                 /* We need to set this here in-case the
1824                                  * dadcallback function checks it */
1825                                 ia->flags |= IPV6_AF_DADCOMPLETED;
1826                         }
1827                         break;
1828                 }
1829         }
1830
1831         return alldadcompleted ? found : 0;
1832 }
1833
1834 #ifdef IPV6_MANAGETEMPADDR
1835 static const struct ipv6_addr *
1836 ipv6_findaddrid(struct dhcpcd_ctx *ctx, uint8_t *addr)
1837 {
1838         const struct interface *ifp;
1839         const struct ipv6_state *state;
1840         const struct ipv6_addr *ia;
1841
1842         TAILQ_FOREACH(ifp, ctx->ifaces, next) {
1843                 if ((state = IPV6_CSTATE(ifp))) {
1844                         TAILQ_FOREACH(ia, &state->addrs, next) {
1845                                 if (memcmp(&ia->addr.s6_addr[8], addr, 8) == 0)
1846                                         return ia;
1847                         }
1848                 }
1849         }
1850         return NULL;
1851 }
1852
1853 static const uint8_t nullid[8];
1854 static const uint8_t anycastid[8] = {
1855     0xfd, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x80 };
1856 static const uint8_t isatapid[4] = { 0x00, 0x00, 0x5e, 0xfe };
1857
1858 static void
1859 ipv6_regen_desync(struct interface *ifp, int force)
1860 {
1861         struct ipv6_state *state;
1862         time_t max;
1863
1864         state = IPV6_STATE(ifp);
1865
1866         /* RFC4941 Section 5 states that DESYNC_FACTOR must never be
1867          * greater than TEMP_VALID_LIFETIME - REGEN_ADVANCE.
1868          * I believe this is an error and it should be never be greateter than
1869          * TEMP_PREFERRED_LIFETIME - REGEN_ADVANCE. */
1870         max = ip6_temp_preferred_lifetime(ifp->name) - REGEN_ADVANCE;
1871         if (state->desync_factor && !force && state->desync_factor < max)
1872                 return;
1873         if (state->desync_factor == 0)
1874                 state->desync_factor =
1875                     (time_t)arc4random_uniform(MIN(MAX_DESYNC_FACTOR,
1876                     (uint32_t)max));
1877         max = ip6_temp_preferred_lifetime(ifp->name) -
1878             state->desync_factor - REGEN_ADVANCE;
1879         eloop_timeout_add_sec(ifp->ctx->eloop, max, ipv6_regentempifid, ifp);
1880 }
1881
1882 void
1883 ipv6_gentempifid(struct interface *ifp)
1884 {
1885         struct ipv6_state *state;
1886         MD5_CTX md5;
1887         uint8_t seed[16], digest[16];
1888         int retry;
1889
1890         if ((state = IPV6_STATE(ifp)) == NULL)
1891                 return;
1892
1893         retry = 0;
1894         if (memcmp(nullid, state->randomseed0, sizeof(nullid)) == 0) {
1895                 uint32_t r;
1896
1897                 r = arc4random();
1898                 memcpy(seed, &r, sizeof(r));
1899                 r = arc4random();
1900                 memcpy(seed + sizeof(r), &r, sizeof(r));
1901         } else
1902                 memcpy(seed, state->randomseed0, sizeof(state->randomseed0));
1903
1904         memcpy(seed + sizeof(state->randomseed0),
1905             state->randomseed1, sizeof(state->randomseed1));
1906
1907 again:
1908         MD5Init(&md5);
1909         MD5Update(&md5, seed, sizeof(seed));
1910         MD5Final(digest, &md5);
1911
1912         /* RFC4941 Section 3.2.1.1
1913          * Take the left-most 64bits and set bit 6 to zero */
1914         memcpy(state->randomid, digest, sizeof(state->randomid));
1915         state->randomid[0] = (uint8_t)(state->randomid[0] & ~EUI64_UBIT);
1916
1917         /* RFC4941 Section 3.2.1.4
1918          * Reject reserved or existing id's */
1919         if (memcmp(nullid, state->randomid, sizeof(nullid)) == 0 ||
1920             (memcmp(anycastid, state->randomid, 7) == 0 &&
1921             (anycastid[7] & state->randomid[7]) == anycastid[7]) ||
1922             memcmp(isatapid, state->randomid, sizeof(isatapid)) == 0 ||
1923             ipv6_findaddrid(ifp->ctx, state->randomid))
1924         {
1925                 if (++retry < GEN_TEMPID_RETRY_MAX) {
1926                         memcpy(seed, digest + 8, 8);
1927                         goto again;
1928                 }
1929                 memset(state->randomid, 0, sizeof(state->randomid));
1930         }
1931
1932         /* RFC4941 Section 3.2.1.6
1933          * Save the right-most 64bits of the digest */
1934         memcpy(state->randomseed0, digest + 8,
1935             sizeof(state->randomseed0));
1936 }
1937
1938 /* RFC4941 Section 3.3.7 */
1939 static void
1940 ipv6_tempdadcallback(void *arg)
1941 {
1942         struct ipv6_addr *ia = arg;
1943
1944         if (ia->flags & IPV6_AF_DUPLICATED) {
1945                 struct ipv6_addr *ia1;
1946                 struct timespec tv;
1947
1948                 if (++ia->dadcounter == TEMP_IDGEN_RETRIES) {
1949                         logerrx("%s: too many duplicate temporary addresses",
1950                             ia->iface->name);
1951                         return;
1952                 }
1953                 clock_gettime(CLOCK_MONOTONIC, &tv);
1954                 if ((ia1 = ipv6_createtempaddr(ia, &tv)) == NULL)
1955                         logerr(__func__);
1956                 else
1957                         ia1->dadcounter = ia->dadcounter;
1958                 ipv6_deleteaddr(ia);
1959                 if (ia1)
1960                         ipv6_addaddr(ia1, &ia1->acquired);
1961         }
1962 }
1963
1964 struct ipv6_addr *
1965 ipv6_createtempaddr(struct ipv6_addr *ia0, const struct timespec *now)
1966 {
1967         struct ipv6_state *state;
1968         const struct ipv6_state *cstate;
1969         int genid;
1970         struct in6_addr addr, mask;
1971         uint32_t randid[2];
1972         const struct interface *ifp;
1973         const struct ipv6_addr *ap;
1974         struct ipv6_addr *ia;
1975         uint32_t i, trylimit;
1976
1977         trylimit = TEMP_IDGEN_RETRIES;
1978         state = IPV6_STATE(ia0->iface);
1979         genid = 0;
1980
1981         addr = ia0->addr;
1982         ipv6_mask(&mask, ia0->prefix_len);
1983         /* clear the old ifid */
1984         for (i = 0; i < 4; i++)
1985                 addr.s6_addr32[i] &= mask.s6_addr32[i];
1986
1987 again:
1988         if (memcmp(state->randomid, nullid, sizeof(nullid)) == 0)
1989                 genid = 1;
1990         if (genid) {
1991                 memcpy(state->randomseed1, &ia0->addr.s6_addr[8],
1992                     sizeof(state->randomseed1));
1993                 ipv6_gentempifid(ia0->iface);
1994                 if (memcmp(state->randomid, nullid, sizeof(nullid)) == 0) {
1995                         errno = EFAULT;
1996                         return NULL;
1997                 }
1998         }
1999         memcpy(&randid[0], state->randomid, sizeof(randid[0]));
2000         memcpy(&randid[1], state->randomid + sizeof(randid[1]),
2001             sizeof(randid[2]));
2002         addr.s6_addr32[2] |= randid[0] & ~mask.s6_addr32[2];
2003         addr.s6_addr32[3] |= randid[1] & ~mask.s6_addr32[3];
2004
2005         /* Ensure we don't already have it */
2006         TAILQ_FOREACH(ifp, ia0->iface->ctx->ifaces, next) {
2007                 cstate = IPV6_CSTATE(ifp);
2008                 if (cstate) {
2009                         TAILQ_FOREACH(ap, &cstate->addrs, next) {
2010                                 if (IN6_ARE_ADDR_EQUAL(&ap->addr, &addr)) {
2011                                         if (--trylimit == 0) {
2012                                                 errno = EEXIST;
2013                                                 return NULL;
2014                                         }
2015                                         genid = 1;
2016                                         goto again;
2017                                 }
2018                         }
2019                 }
2020         }
2021
2022         ia = ipv6_newaddr(ia0->iface, &addr, ia0->prefix_len,
2023             IPV6_AF_AUTOCONF | IPV6_AF_TEMPORARY);
2024         /* Must be made tentative, for our DaD to work */
2025         ia->addr_flags = IN6_IFF_TENTATIVE;
2026         ia->dadcallback = ipv6_tempdadcallback;
2027         ia->created = ia->acquired = now ? *now : ia0->acquired;
2028
2029         /* Ensure desync is still valid */
2030         ipv6_regen_desync(ia->iface, 0);
2031
2032         /* RFC4941 Section 3.3.4 */
2033         i = (uint32_t)(ip6_temp_preferred_lifetime(ia0->iface->name) -
2034             state->desync_factor);
2035         ia->prefix_pltime = MIN(ia0->prefix_pltime, i);
2036         i = (uint32_t)ip6_temp_valid_lifetime(ia0->iface->name);
2037         ia->prefix_vltime = MIN(ia0->prefix_vltime, i);
2038         if (ia->prefix_pltime <= REGEN_ADVANCE ||
2039             ia->prefix_pltime > ia0->prefix_vltime)
2040         {
2041                 errno = EINVAL;
2042                 free(ia);
2043                 return NULL;
2044         }
2045
2046         TAILQ_INSERT_TAIL(&state->addrs, ia, next);
2047         return ia;
2048 }
2049
2050 struct ipv6_addr *
2051 ipv6_settemptime(struct ipv6_addr *ia, int flags)
2052 {
2053         struct ipv6_state *state;
2054         struct ipv6_addr *ap, *first;
2055
2056         state = IPV6_STATE(ia->iface);
2057         first = NULL;
2058         TAILQ_FOREACH_REVERSE(ap, &state->addrs, ipv6_addrhead, next) {
2059                 if (ap->flags & IPV6_AF_TEMPORARY &&
2060                     ap->prefix_pltime &&
2061                     IN6_ARE_ADDR_EQUAL(&ia->prefix, &ap->prefix))
2062                 {
2063                         time_t max, ext;
2064
2065                         if (flags == 0) {
2066                                 if (ap->prefix_pltime -
2067                                     (uint32_t)(ia->acquired.tv_sec -
2068                                     ap->acquired.tv_sec)
2069                                     < REGEN_ADVANCE)
2070                                         continue;
2071
2072                                 return ap;
2073                         }
2074
2075                         if (!(ap->flags & IPV6_AF_ADDED))
2076                                 ap->flags |= IPV6_AF_NEW | IPV6_AF_AUTOCONF;
2077                         ap->flags &= ~IPV6_AF_STALE;
2078
2079                         /* RFC4941 Section 3.4
2080                          * Deprecated prefix, deprecate the temporary address */
2081                         if (ia->prefix_pltime == 0) {
2082                                 ap->prefix_pltime = 0;
2083                                 goto valid;
2084                         }
2085
2086                         /* Ensure desync is still valid */
2087                         ipv6_regen_desync(ap->iface, 0);
2088
2089                         /* RFC4941 Section 3.3.2
2090                          * Extend temporary times, but ensure that they
2091                          * never last beyond the system limit. */
2092                         ext = ia->acquired.tv_sec + (time_t)ia->prefix_pltime;
2093                         max = ap->created.tv_sec +
2094                             ip6_temp_preferred_lifetime(ap->iface->name) -
2095                             state->desync_factor;
2096                         if (ext < max)
2097                                 ap->prefix_pltime = ia->prefix_pltime;
2098                         else
2099                                 ap->prefix_pltime =
2100                                     (uint32_t)(max - ia->acquired.tv_sec);
2101
2102 valid:
2103                         ext = ia->acquired.tv_sec + (time_t)ia->prefix_vltime;
2104                         max = ap->created.tv_sec +
2105                             ip6_temp_valid_lifetime(ap->iface->name);
2106                         if (ext < max)
2107                                 ap->prefix_vltime = ia->prefix_vltime;
2108                         else
2109                                 ap->prefix_vltime =
2110                                     (uint32_t)(max - ia->acquired.tv_sec);
2111
2112                         /* Just extend the latest matching prefix */
2113                         ap->acquired = ia->acquired;
2114
2115                         /* If extending return the last match as
2116                          * it's the most current.
2117                          * If deprecating, deprecate any other addresses we
2118                          * may have, although this should not be needed */
2119                         if (ia->prefix_pltime)
2120                                 return ap;
2121                         if (first == NULL)
2122                                 first = ap;
2123                 }
2124         }
2125         return first;
2126 }
2127
2128 void
2129 ipv6_addtempaddrs(struct interface *ifp, const struct timespec *now)
2130 {
2131         struct ipv6_state *state;
2132         struct ipv6_addr *ia;
2133
2134         state = IPV6_STATE(ifp);
2135         TAILQ_FOREACH(ia, &state->addrs, next) {
2136                 if (ia->flags & IPV6_AF_TEMPORARY &&
2137                     !(ia->flags & IPV6_AF_STALE))
2138                         ipv6_addaddr(ia, now);
2139         }
2140 }
2141
2142 static void
2143 ipv6_regentempaddr(void *arg)
2144 {
2145         struct ipv6_addr *ia = arg, *ia1;
2146         struct timespec tv;
2147
2148         logdebugx("%s: regen temp addr %s", ia->iface->name, ia->saddr);
2149         clock_gettime(CLOCK_MONOTONIC, &tv);
2150         ia1 = ipv6_createtempaddr(ia, &tv);
2151         if (ia1)
2152                 ipv6_addaddr(ia1, &tv);
2153         else
2154                 logerr(__func__);
2155 }
2156
2157 static void
2158 ipv6_regentempifid(void *arg)
2159 {
2160         struct interface *ifp = arg;
2161         struct ipv6_state *state;
2162
2163         state = IPV6_STATE(ifp);
2164         if (memcmp(state->randomid, nullid, sizeof(state->randomid)))
2165                 ipv6_gentempifid(ifp);
2166
2167         ipv6_regen_desync(ifp, 1);
2168 }
2169 #endif /* IPV6_MANAGETEMPADDR */
2170
2171 void
2172 ipv6_markaddrsstale(struct interface *ifp, unsigned int flags)
2173 {
2174         struct ipv6_state *state;
2175         struct ipv6_addr *ia;
2176
2177         state = IPV6_STATE(ifp);
2178         if (state == NULL)
2179                 return;
2180
2181         TAILQ_FOREACH(ia, &state->addrs, next) {
2182                 if (flags == 0 || ia->flags & flags)
2183                         ia->flags |= IPV6_AF_STALE;
2184         }
2185 }
2186
2187 void
2188 ipv6_deletestaleaddrs(struct interface *ifp)
2189 {
2190         struct ipv6_state *state;
2191         struct ipv6_addr *ia, *ia1;
2192
2193         state = IPV6_STATE(ifp);
2194         if (state == NULL)
2195                 return;
2196
2197         TAILQ_FOREACH_SAFE(ia, &state->addrs, next, ia1) {
2198                 if (ia->flags & IPV6_AF_STALE)
2199                         ipv6_handleifa(ifp->ctx, RTM_DELADDR,
2200                             ifp->ctx->ifaces, ifp->name,
2201                             &ia->addr, ia->prefix_len, 0, getpid());
2202         }
2203 }
2204
2205
2206 static struct rt *
2207 inet6_makeroute(struct interface *ifp, const struct ra *rap)
2208 {
2209         struct rt *rt;
2210
2211         if ((rt = rt_new(ifp)) == NULL)
2212                 return NULL;
2213
2214 #ifdef HAVE_ROUTE_METRIC
2215         rt->rt_metric = ifp->metric;
2216 #endif
2217         if (rap != NULL)
2218                 rt->rt_mtu = rap->mtu;
2219         return rt;
2220 }
2221
2222 static struct rt *
2223 inet6_makeprefix(struct interface *ifp, const struct ra *rap,
2224     const struct ipv6_addr *addr)
2225 {
2226         struct rt *rt;
2227         struct in6_addr netmask;
2228
2229         if (addr == NULL || addr->prefix_len > 128) {
2230                 errno = EINVAL;
2231                 return NULL;
2232         }
2233
2234         /* There is no point in trying to manage a /128 prefix,
2235          * ones without a lifetime.  */
2236         if (addr->prefix_len == 128 || addr->prefix_vltime == 0)
2237                 return NULL;
2238
2239         /* Don't install a reject route when not creating bigger prefixes. */
2240         if (addr->flags & IPV6_AF_NOREJECT)
2241                 return NULL;
2242
2243         /* This address is the delegated prefix, so add a reject route for
2244          * it via the loopback interface. */
2245         if (addr->flags & IPV6_AF_DELEGATEDPFX) {
2246                 struct interface *lo0;
2247
2248                 TAILQ_FOREACH(lo0, ifp->ctx->ifaces, next) {
2249                         if (lo0->flags & IFF_LOOPBACK)
2250                                 break;
2251                 }
2252                 if (lo0 == NULL)
2253                         logwarnx("cannot find a loopback interface "
2254                             "to reject via");
2255                 else
2256                         ifp = lo0;
2257         }
2258
2259         if ((rt = inet6_makeroute(ifp, rap)) == NULL)
2260                 return NULL;
2261
2262         sa_in6_init(&rt->rt_dest, &addr->prefix);
2263         ipv6_mask(&netmask, addr->prefix_len);
2264         sa_in6_init(&rt->rt_netmask, &netmask);
2265         if (addr->flags & IPV6_AF_DELEGATEDPFX) {
2266                 rt->rt_flags |= RTF_REJECT;
2267                 /* Linux does not like a gateway for a reject route. */
2268 #ifndef __linux__
2269                 sa_in6_init(&rt->rt_gateway, &in6addr_loopback);
2270 #endif
2271         } else if (!(addr->flags & IPV6_AF_ONLINK))
2272                 sa_in6_init(&rt->rt_gateway, &rap->from);
2273         else
2274                 rt->rt_gateway.sa_family = AF_UNSPEC;
2275         sa_in6_init(&rt->rt_ifa, &addr->addr);
2276         return rt;
2277 }
2278
2279 static struct rt *
2280 inet6_makerouter(struct ra *rap)
2281 {
2282         struct rt *rt;
2283
2284         if ((rt = inet6_makeroute(rap->iface, rap)) == NULL)
2285                 return NULL;
2286         sa_in6_init(&rt->rt_dest, &in6addr_any);
2287         sa_in6_init(&rt->rt_netmask, &in6addr_any);
2288         sa_in6_init(&rt->rt_gateway, &rap->from);
2289         return rt;
2290 }
2291
2292 #define RT_IS_DEFAULT(rtp) \
2293         (IN6_ARE_ADDR_EQUAL(&((rtp)->dest), &in6addr_any) &&                  \
2294             IN6_ARE_ADDR_EQUAL(&((rtp)->mask), &in6addr_any))
2295
2296 static int
2297 inet6_staticroutes(rb_tree_t *routes, struct dhcpcd_ctx *ctx)
2298 {
2299         struct interface *ifp;
2300         struct ipv6_state *state;
2301         struct ipv6_addr *ia;
2302         struct rt *rt;
2303
2304         TAILQ_FOREACH(ifp, ctx->ifaces, next) {
2305                 if ((state = IPV6_STATE(ifp)) == NULL)
2306                         continue;
2307                 TAILQ_FOREACH(ia, &state->addrs, next) {
2308                         if ((ia->flags & (IPV6_AF_ADDED | IPV6_AF_STATIC)) ==
2309                             (IPV6_AF_ADDED | IPV6_AF_STATIC))
2310                         {
2311                                 rt = inet6_makeprefix(ifp, NULL, ia);
2312                                 if (rt)
2313                                         rt_proto_add(routes, rt);
2314                         }
2315                 }
2316         }
2317         return 0;
2318 }
2319
2320 static int
2321 inet6_raroutes(rb_tree_t *routes, struct dhcpcd_ctx *ctx)
2322 {
2323         struct rt *rt;
2324         struct ra *rap;
2325         const struct ipv6_addr *addr;
2326
2327         TAILQ_FOREACH(rap, ctx->ra_routers, next) {
2328                 if (rap->expired)
2329                         continue;
2330                 TAILQ_FOREACH(addr, &rap->addrs, next) {
2331                         if (addr->prefix_vltime == 0)
2332                                 continue;
2333                         rt = inet6_makeprefix(rap->iface, rap, addr);
2334                         if (rt) {
2335                                 rt->rt_dflags |= RTDF_RA;
2336                                 rt_proto_add(routes, rt);
2337                         }
2338                 }
2339                 if (rap->lifetime == 0)
2340                         continue;
2341                 if (ipv6_anyglobal(rap->iface) == NULL)
2342                         continue;
2343                 rt = inet6_makerouter(rap);
2344                 if (rt == NULL)
2345                         continue;
2346                 rt->rt_dflags |= RTDF_RA;
2347                 rt_proto_add(routes, rt);
2348         }
2349         return 0;
2350 }
2351
2352 #ifdef DHCP6
2353 static int
2354 inet6_dhcproutes(rb_tree_t *routes, struct dhcpcd_ctx *ctx,
2355     enum DH6S dstate)
2356 {
2357         struct interface *ifp;
2358         const struct dhcp6_state *d6_state;
2359         const struct ipv6_addr *addr;
2360         struct rt *rt;
2361
2362         TAILQ_FOREACH(ifp, ctx->ifaces, next) {
2363                 d6_state = D6_CSTATE(ifp);
2364                 if (d6_state && d6_state->state == dstate) {
2365                         TAILQ_FOREACH(addr, &d6_state->addrs, next) {
2366                                 rt = inet6_makeprefix(ifp, NULL, addr);
2367                                 if (rt == NULL)
2368                                         continue;
2369                                 rt->rt_dflags |= RTDF_DHCP;
2370                                 rt_proto_add(routes, rt);
2371                         }
2372                 }
2373         }
2374         return 0;
2375 }
2376 #endif
2377
2378 bool
2379 inet6_getroutes(struct dhcpcd_ctx *ctx, rb_tree_t *routes)
2380 {
2381
2382         /* Should static take priority? */
2383         if (inet6_staticroutes(routes, ctx) == -1)
2384                 return false;
2385
2386         /* First add reachable routers and their prefixes */
2387         if (inet6_raroutes(routes, ctx) == -1)
2388                 return false;
2389
2390 #ifdef DHCP6
2391         /* We have no way of knowing if prefixes added by DHCP are reachable
2392          * or not, so we have to assume they are.
2393          * Add bound before delegated so we can prefer interfaces better. */
2394         if (inet6_dhcproutes(routes, ctx, DH6S_BOUND) == -1)
2395                 return false;
2396         if (inet6_dhcproutes(routes, ctx, DH6S_DELEGATED) == -1)
2397                 return false;
2398 #endif
2399
2400         return true;
2401 }