• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /**
2  * @file
3  *
4  * Neighbor discovery and stateless address autoconfiguration for IPv6.
5  * Aims to be compliant with RFC 4861 (Neighbor discovery) and RFC 4862
6  * (Address autoconfiguration).
7  */
8 
9 /*
10  * Copyright (c) 2010 Inico Technologies Ltd.
11  * All rights reserved.
12  *
13  * Redistribution and use in source and binary forms, with or without modification,
14  * are permitted provided that the following conditions are met:
15  *
16  * 1. Redistributions of source code must retain the above copyright notice,
17  *    this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright notice,
19  *    this list of conditions and the following disclaimer in the documentation
20  *    and/or other materials provided with the distribution.
21  * 3. The name of the author may not be used to endorse or promote products
22  *    derived from this software without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
25  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
26  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
27  * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
28  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
29  * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
32  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
33  * OF SUCH DAMAGE.
34  *
35  * This file is part of the lwIP TCP/IP stack.
36  *
37  * Author: Ivan Delamer <delamer@inicotech.com>
38  *
39  *
40  * Please coordinate changes and requests with Ivan Delamer
41  * <delamer@inicotech.com>
42  */
43 
44 #include "lwip/opt.h"
45 
46 #if LWIP_IPV6  /* don't build if not configured for use in lwipopts.h */
47 
48 #include "lwip/nd6.h"
49 #include "lwip/priv/nd6_priv.h"
50 #include "lwip/prot/nd6.h"
51 #include "lwip/prot/icmp6.h"
52 #include "lwip/pbuf.h"
53 #include "lwip/mem.h"
54 #include "lwip/memp.h"
55 #include "lwip/ip6.h"
56 #include "lwip/ip6_addr.h"
57 #include "lwip/inet_chksum.h"
58 #include "lwip/netif.h"
59 #include "lwip/icmp6.h"
60 #include "lwip/mld6.h"
61 #include "lwip/dhcp6.h"
62 #include "lwip/ip.h"
63 #include "lwip/stats.h"
64 #include "lwip/dns.h"
65 
66 #include <string.h>
67 
68 #ifdef LWIP_HOOK_FILENAME
69 #include LWIP_HOOK_FILENAME
70 #endif
71 
72 #if LWIP_IPV6_DUP_DETECT_ATTEMPTS > IP6_ADDR_TENTATIVE_COUNT_MASK
73 #error LWIP_IPV6_DUP_DETECT_ATTEMPTS > IP6_ADDR_TENTATIVE_COUNT_MASK
74 #endif
75 
76 /* Router tables. */
77 struct nd6_neighbor_cache_entry neighbor_cache[LWIP_ND6_NUM_NEIGHBORS];
78 struct nd6_destination_cache_entry destination_cache[LWIP_ND6_NUM_DESTINATIONS];
79 struct nd6_prefix_list_entry prefix_list[LWIP_ND6_NUM_PREFIXES];
80 struct nd6_router_list_entry default_router_list[LWIP_ND6_NUM_ROUTERS];
81 
82 /* Default values, can be updated by a RA message. */
83 u32_t reachable_time = LWIP_ND6_REACHABLE_TIME;
84 u32_t retrans_timer = LWIP_ND6_RETRANS_TIMER; /* @todo implement this value in timer */
85 
86 /* Index for cache entries. */
87 static u8_t nd6_cached_neighbor_index;
88 static netif_addr_idx_t nd6_cached_destination_index;
89 
90 /* Multicast address holder. */
91 static ip6_addr_t multicast_address;
92 
93 static u8_t nd6_tmr_rs_reduction;
94 
95 /* Static buffer to parse RA packet options */
96 union ra_options {
97   struct lladdr_option  lladdr;
98   struct mtu_option     mtu;
99   struct prefix_option  prefix;
100 #if LWIP_ND6_RDNSS_MAX_DNS_SERVERS
101   struct rdnss_option   rdnss;
102 #endif
103 };
104 static union ra_options nd6_ra_buffer;
105 
106 /* Forward declarations. */
107 static s8_t nd6_find_neighbor_cache_entry(const ip6_addr_t *ip6addr);
108 static s8_t nd6_new_neighbor_cache_entry(void);
109 static void nd6_free_neighbor_cache_entry(s8_t i);
110 static s16_t nd6_find_destination_cache_entry(const ip6_addr_t *ip6addr);
111 static s16_t nd6_new_destination_cache_entry(void);
112 static int nd6_is_prefix_in_netif(const ip6_addr_t *ip6addr, struct netif *netif);
113 static s8_t nd6_select_router(const ip6_addr_t *ip6addr, struct netif *netif);
114 static s8_t nd6_get_router(const ip6_addr_t *router_addr, struct netif *netif);
115 static s8_t nd6_new_router(const ip6_addr_t *router_addr, struct netif *netif);
116 static s8_t nd6_get_onlink_prefix(const ip6_addr_t *prefix, struct netif *netif);
117 static s8_t nd6_new_onlink_prefix(const ip6_addr_t *prefix, struct netif *netif);
118 static s8_t nd6_get_next_hop_entry(const ip6_addr_t *ip6addr, struct netif *netif);
119 static err_t nd6_queue_packet(s8_t neighbor_index, struct pbuf *q);
120 
121 #define ND6_SEND_FLAG_MULTICAST_DEST 0x01
122 #define ND6_SEND_FLAG_ALLNODES_DEST 0x02
123 #define ND6_SEND_FLAG_ANY_SRC 0x04
124 static void nd6_send_ns(struct netif *netif, const ip6_addr_t *target_addr, u8_t flags);
125 static void nd6_send_na(struct netif *netif, const ip6_addr_t *target_addr, u8_t flags);
126 static void nd6_send_neighbor_cache_probe(struct nd6_neighbor_cache_entry *entry, u8_t flags);
127 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
128 static err_t nd6_send_rs(struct netif *netif);
129 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
130 
131 #if LWIP_ND6_QUEUEING
132 static void nd6_free_q(struct nd6_q_entry *q);
133 #else /* LWIP_ND6_QUEUEING */
134 #define nd6_free_q(q) pbuf_free(q)
135 #endif /* LWIP_ND6_QUEUEING */
136 static void nd6_send_q(s8_t i);
137 
138 
139 /**
140  * A local address has been determined to be a duplicate. Take the appropriate
141  * action(s) on the address and the interface as a whole.
142  *
143  * @param netif the netif that owns the address
144  * @param addr_idx the index of the address detected to be a duplicate
145  */
146 static void
nd6_duplicate_addr_detected(struct netif * netif,s8_t addr_idx)147 nd6_duplicate_addr_detected(struct netif *netif, s8_t addr_idx)
148 {
149 
150   /* Mark the address as duplicate, but leave its lifetimes alone. If this was
151    * a manually assigned address, it will remain in existence as duplicate, and
152    * as such be unusable for any practical purposes until manual intervention.
153    * If this was an autogenerated address, the address will follow normal
154    * expiration rules, and thus disappear once its valid lifetime expires. */
155   netif_ip6_addr_set_state(netif, addr_idx, IP6_ADDR_DUPLICATED);
156 
157 #if LWIP_IPV6_AUTOCONFIG
158   /* If the affected address was the link-local address that we use to generate
159    * all other addresses, then we should not continue to use those derived
160    * addresses either, so mark them as duplicate as well. For autoconfig-only
161    * setups, this will make the interface effectively unusable, approaching the
162    * intention of RFC 4862 Sec. 5.4.5. @todo implement the full requirements */
163   if (addr_idx == 0) {
164     s8_t i;
165     for (i = 1; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
166       if (!ip6_addr_isinvalid(netif_ip6_addr_state(netif, i)) &&
167           !netif_ip6_addr_isstatic(netif, i)) {
168         netif_ip6_addr_set_state(netif, i, IP6_ADDR_DUPLICATED);
169       }
170     }
171   }
172 #endif /* LWIP_IPV6_AUTOCONFIG */
173 }
174 
175 #if LWIP_IPV6_AUTOCONFIG
176 /**
177  * We received a router advertisement that contains a prefix with the
178  * autoconfiguration flag set. Add or update an associated autogenerated
179  * address.
180  *
181  * @param netif the netif on which the router advertisement arrived
182  * @param prefix_opt a pointer to the prefix option data
183  * @param prefix_addr an aligned copy of the prefix address
184  */
185 static void
nd6_process_autoconfig_prefix(struct netif * netif,struct prefix_option * prefix_opt,const ip6_addr_t * prefix_addr)186 nd6_process_autoconfig_prefix(struct netif *netif,
187   struct prefix_option *prefix_opt, const ip6_addr_t *prefix_addr)
188 {
189   ip6_addr_t ip6addr;
190   u32_t valid_life, pref_life;
191   u8_t addr_state;
192   s8_t i, free_idx;
193 
194   /* The caller already checks RFC 4862 Sec. 5.5.3 points (a) and (b). We do
195    * the rest, starting with checks for (c) and (d) here. */
196   valid_life = lwip_htonl(prefix_opt->valid_lifetime);
197   pref_life = lwip_htonl(prefix_opt->preferred_lifetime);
198   if (pref_life > valid_life || prefix_opt->prefix_length != 64) {
199     return; /* silently ignore this prefix for autoconfiguration purposes */
200   }
201 
202   /* If an autogenerated address already exists for this prefix, update its
203    * lifetimes. An address is considered autogenerated if 1) it is not static
204    * (i.e., manually assigned), and 2) there is an advertised autoconfiguration
205    * prefix for it (the one we are processing here). This does not necessarily
206    * exclude the possibility that the address was actually assigned by, say,
207    * DHCPv6. If that distinction becomes important in the future, more state
208    * must be kept. As explained elsewhere we also update lifetimes of tentative
209    * and duplicate addresses. Skip address slot 0 (the link-local address). */
210   for (i = 1; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
211     addr_state = netif_ip6_addr_state(netif, i);
212     if (!ip6_addr_isinvalid(addr_state) && !netif_ip6_addr_isstatic(netif, i) &&
213         ip6_addr_netcmp(prefix_addr, netif_ip6_addr(netif, i))) {
214       /* Update the valid lifetime, as per RFC 4862 Sec. 5.5.3 point (e).
215        * The valid lifetime will never drop to zero as a result of this. */
216       u32_t remaining_life = netif_ip6_addr_valid_life(netif, i);
217       if (valid_life > ND6_2HRS || valid_life > remaining_life) {
218         netif_ip6_addr_set_valid_life(netif, i, valid_life);
219       } else if (remaining_life > ND6_2HRS) {
220         netif_ip6_addr_set_valid_life(netif, i, ND6_2HRS);
221       }
222       LWIP_ASSERT("bad valid lifetime", !netif_ip6_addr_isstatic(netif, i));
223       /* Update the preferred lifetime. No bounds checks are needed here. In
224        * rare cases the advertisement may un-deprecate the address, though.
225        * Deprecation is left to the timer code where it is handled anyway. */
226       if (pref_life > 0 && addr_state == IP6_ADDR_DEPRECATED) {
227         netif_ip6_addr_set_state(netif, i, IP6_ADDR_PREFERRED);
228       }
229       netif_ip6_addr_set_pref_life(netif, i, pref_life);
230       return; /* there should be at most one matching address */
231     }
232   }
233 
234   /* No autogenerated address exists for this prefix yet. See if we can add a
235    * new one. However, if IPv6 autoconfiguration is administratively disabled,
236    * do not generate new addresses, but do keep updating lifetimes for existing
237    * addresses. Also, when adding new addresses, we must protect explicitly
238    * against a valid lifetime of zero, because again, we use that as a special
239    * value. The generated address would otherwise expire immediately anyway.
240    * Finally, the original link-local address must be usable at all. We start
241    * creating addresses even if the link-local address is still in tentative
242    * state though, and deal with the fallout of that upon DAD collision. */
243   addr_state = netif_ip6_addr_state(netif, 0);
244   if (!netif->ip6_autoconfig_enabled || valid_life == IP6_ADDR_LIFE_STATIC ||
245       ip6_addr_isinvalid(addr_state) || ip6_addr_isduplicated(addr_state)) {
246     return;
247   }
248 
249   /* Construct the new address that we intend to use, and then see if that
250    * address really does not exist. It might have been added manually, after
251    * all. As a side effect, find a free slot. Note that we cannot use
252    * netif_add_ip6_address() here, as it would return ERR_OK if the address
253    * already did exist, resulting in that address being given lifetimes. */
254   IP6_ADDR(&ip6addr, prefix_addr->addr[0], prefix_addr->addr[1],
255     netif_ip6_addr(netif, 0)->addr[2], netif_ip6_addr(netif, 0)->addr[3]);
256   ip6_addr_assign_zone(&ip6addr, IP6_UNICAST, netif);
257 
258   free_idx = 0;
259   for (i = 1; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
260     if (!ip6_addr_isinvalid(netif_ip6_addr_state(netif, i))) {
261       if (ip6_addr_cmp(&ip6addr, netif_ip6_addr(netif, i))) {
262         return; /* formed address already exists */
263       }
264     } else if (free_idx == 0) {
265       free_idx = i;
266     }
267   }
268   if (free_idx == 0) {
269     return; /* no address slots available, try again on next advertisement */
270   }
271 
272   /* Assign the new address to the interface. */
273   ip_addr_copy_from_ip6(netif->ip6_addr[free_idx], ip6addr);
274   netif_ip6_addr_set_valid_life(netif, free_idx, valid_life);
275   netif_ip6_addr_set_pref_life(netif, free_idx, pref_life);
276   netif_ip6_addr_set_state(netif, free_idx, IP6_ADDR_TENTATIVE);
277 }
278 #endif /* LWIP_IPV6_AUTOCONFIG */
279 
280 /**
281  * Process an incoming neighbor discovery message
282  *
283  * @param p the nd packet, p->payload pointing to the icmpv6 header
284  * @param inp the netif on which this packet was received
285  */
286 void
nd6_input(struct pbuf * p,struct netif * inp)287 nd6_input(struct pbuf *p, struct netif *inp)
288 {
289   u8_t msg_type;
290   s8_t i;
291   s16_t dest_idx;
292 
293   ND6_STATS_INC(nd6.recv);
294 
295   msg_type = *((u8_t *)p->payload);
296   switch (msg_type) {
297   case ICMP6_TYPE_NA: /* Neighbor Advertisement. */
298   {
299     struct na_header *na_hdr;
300     struct lladdr_option *lladdr_opt;
301     ip6_addr_t target_address;
302 
303     /* Check that na header fits in packet. */
304     if (p->len < (sizeof(struct na_header))) {
305       /* @todo debug message */
306       pbuf_free(p);
307       ND6_STATS_INC(nd6.lenerr);
308       ND6_STATS_INC(nd6.drop);
309       return;
310     }
311 
312     na_hdr = (struct na_header *)p->payload;
313 
314     /* Create an aligned, zoned copy of the target address. */
315     ip6_addr_copy_from_packed(target_address, na_hdr->target_address);
316     ip6_addr_assign_zone(&target_address, IP6_UNICAST, inp);
317 
318     /* Check a subset of the other RFC 4861 Sec. 7.1.2 requirements. */
319     if (IP6H_HOPLIM(ip6_current_header()) != ND6_HOPLIM || na_hdr->code != 0 ||
320         ip6_addr_ismulticast(&target_address)) {
321       pbuf_free(p);
322       ND6_STATS_INC(nd6.proterr);
323       ND6_STATS_INC(nd6.drop);
324       return;
325     }
326 
327     /* @todo RFC MUST: if IP destination is multicast, Solicited flag is zero */
328     /* @todo RFC MUST: all included options have a length greater than zero */
329 
330     /* Unsolicited NA?*/
331     if (ip6_addr_ismulticast(ip6_current_dest_addr())) {
332       /* This is an unsolicited NA.
333        * link-layer changed?
334        * part of DAD mechanism? */
335 
336 #if LWIP_IPV6_DUP_DETECT_ATTEMPTS
337       /* If the target address matches this netif, it is a DAD response. */
338       for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
339         if (!ip6_addr_isinvalid(netif_ip6_addr_state(inp, i)) &&
340             !ip6_addr_isduplicated(netif_ip6_addr_state(inp, i)) &&
341             ip6_addr_cmp(&target_address, netif_ip6_addr(inp, i))) {
342           /* We are using a duplicate address. */
343           nd6_duplicate_addr_detected(inp, i);
344 
345           pbuf_free(p);
346           return;
347         }
348       }
349 #endif /* LWIP_IPV6_DUP_DETECT_ATTEMPTS */
350 
351       /* Check that link-layer address option also fits in packet. */
352       if (p->len < (sizeof(struct na_header) + 2)) {
353         /* @todo debug message */
354         pbuf_free(p);
355         ND6_STATS_INC(nd6.lenerr);
356         ND6_STATS_INC(nd6.drop);
357         return;
358       }
359 
360       lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct na_header));
361 
362       if (p->len < (sizeof(struct na_header) + (lladdr_opt->length << 3))) {
363         /* @todo debug message */
364         pbuf_free(p);
365         ND6_STATS_INC(nd6.lenerr);
366         ND6_STATS_INC(nd6.drop);
367         return;
368       }
369 
370       /* This is an unsolicited NA, most likely there was a LLADDR change. */
371       i = nd6_find_neighbor_cache_entry(&target_address);
372       if (i >= 0) {
373         if (na_hdr->flags & ND6_FLAG_OVERRIDE) {
374           MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
375         }
376       }
377     } else {
378       /* This is a solicited NA.
379        * neighbor address resolution response?
380        * neighbor unreachability detection response? */
381 
382       /* Find the cache entry corresponding to this na. */
383       i = nd6_find_neighbor_cache_entry(&target_address);
384       if (i < 0) {
385         /* We no longer care about this target address. drop it. */
386         pbuf_free(p);
387         return;
388       }
389 
390       /* Update cache entry. */
391       if ((na_hdr->flags & ND6_FLAG_OVERRIDE) ||
392           (neighbor_cache[i].state == ND6_INCOMPLETE)) {
393         /* Check that link-layer address option also fits in packet. */
394         if (p->len < (sizeof(struct na_header) + 2)) {
395           /* @todo debug message */
396           pbuf_free(p);
397           ND6_STATS_INC(nd6.lenerr);
398           ND6_STATS_INC(nd6.drop);
399           return;
400         }
401 
402         lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct na_header));
403 
404         if (p->len < (sizeof(struct na_header) + (lladdr_opt->length << 3))) {
405           /* @todo debug message */
406           pbuf_free(p);
407           ND6_STATS_INC(nd6.lenerr);
408           ND6_STATS_INC(nd6.drop);
409           return;
410         }
411 
412         MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
413       }
414 
415       neighbor_cache[i].netif = inp;
416       neighbor_cache[i].state = ND6_REACHABLE;
417       neighbor_cache[i].counter.reachable_time = reachable_time;
418 
419       /* Send queued packets, if any. */
420       if (neighbor_cache[i].q != NULL) {
421         nd6_send_q(i);
422       }
423     }
424 
425     break; /* ICMP6_TYPE_NA */
426   }
427   case ICMP6_TYPE_NS: /* Neighbor solicitation. */
428   {
429     struct ns_header *ns_hdr;
430     struct lladdr_option *lladdr_opt;
431     ip6_addr_t target_address;
432     u8_t accepted;
433 
434     /* Check that ns header fits in packet. */
435     if (p->len < sizeof(struct ns_header)) {
436       /* @todo debug message */
437       pbuf_free(p);
438       ND6_STATS_INC(nd6.lenerr);
439       ND6_STATS_INC(nd6.drop);
440       return;
441     }
442 
443     ns_hdr = (struct ns_header *)p->payload;
444 
445     /* Create an aligned, zoned copy of the target address. */
446     ip6_addr_copy_from_packed(target_address, ns_hdr->target_address);
447     ip6_addr_assign_zone(&target_address, IP6_UNICAST, inp);
448 
449     /* Check a subset of the other RFC 4861 Sec. 7.1.1 requirements. */
450     if (IP6H_HOPLIM(ip6_current_header()) != ND6_HOPLIM || ns_hdr->code != 0 ||
451        ip6_addr_ismulticast(&target_address)) {
452       pbuf_free(p);
453       ND6_STATS_INC(nd6.proterr);
454       ND6_STATS_INC(nd6.drop);
455       return;
456     }
457 
458     /* @todo RFC MUST: all included options have a length greater than zero */
459     /* @todo RFC MUST: if IP source is 'any', destination is solicited-node multicast address */
460     /* @todo RFC MUST: if IP source is 'any', there is no source LL address option */
461 
462     /* Check if there is a link-layer address provided. Only point to it if in this buffer. */
463     if (p->len >= (sizeof(struct ns_header) + 2)) {
464       lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct ns_header));
465       if (p->len < (sizeof(struct ns_header) + (lladdr_opt->length << 3))) {
466         lladdr_opt = NULL;
467       }
468     } else {
469       lladdr_opt = NULL;
470     }
471 
472     /* Check if the target address is configured on the receiving netif. */
473     accepted = 0;
474     for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; ++i) {
475       if ((ip6_addr_isvalid(netif_ip6_addr_state(inp, i)) ||
476            (ip6_addr_istentative(netif_ip6_addr_state(inp, i)) &&
477             ip6_addr_isany(ip6_current_src_addr()))) &&
478           ip6_addr_cmp(&target_address, netif_ip6_addr(inp, i))) {
479         accepted = 1;
480         break;
481       }
482     }
483 
484     /* NS not for us? */
485     if (!accepted) {
486       pbuf_free(p);
487       return;
488     }
489 
490     /* Check for ANY address in src (DAD algorithm). */
491     if (ip6_addr_isany(ip6_current_src_addr())) {
492       /* Sender is validating this address. */
493       for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; ++i) {
494         if (!ip6_addr_isinvalid(netif_ip6_addr_state(inp, i)) &&
495             ip6_addr_cmp(&target_address, netif_ip6_addr(inp, i))) {
496           /* Send a NA back so that the sender does not use this address. */
497           nd6_send_na(inp, netif_ip6_addr(inp, i), ND6_FLAG_OVERRIDE | ND6_SEND_FLAG_ALLNODES_DEST);
498           if (ip6_addr_istentative(netif_ip6_addr_state(inp, i))) {
499             /* We shouldn't use this address either. */
500             nd6_duplicate_addr_detected(inp, i);
501           }
502         }
503       }
504     } else {
505       /* Sender is trying to resolve our address. */
506       /* Verify that they included their own link-layer address. */
507       if (lladdr_opt == NULL) {
508         /* Not a valid message. */
509         pbuf_free(p);
510         ND6_STATS_INC(nd6.proterr);
511         ND6_STATS_INC(nd6.drop);
512         return;
513       }
514 
515       i = nd6_find_neighbor_cache_entry(ip6_current_src_addr());
516       if (i>= 0) {
517         /* We already have a record for the solicitor. */
518         if (neighbor_cache[i].state == ND6_INCOMPLETE) {
519           neighbor_cache[i].netif = inp;
520           MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
521 
522           /* Delay probe in case we get confirmation of reachability from upper layer (TCP). */
523           neighbor_cache[i].state = ND6_DELAY;
524           neighbor_cache[i].counter.delay_time = LWIP_ND6_DELAY_FIRST_PROBE_TIME / ND6_TMR_INTERVAL;
525         }
526       } else {
527         /* Add their IPv6 address and link-layer address to neighbor cache.
528          * We will need it at least to send a unicast NA message, but most
529          * likely we will also be communicating with this node soon. */
530         i = nd6_new_neighbor_cache_entry();
531         if (i < 0) {
532           /* We couldn't assign a cache entry for this neighbor.
533            * we won't be able to reply. drop it. */
534           pbuf_free(p);
535           ND6_STATS_INC(nd6.memerr);
536           return;
537         }
538         neighbor_cache[i].netif = inp;
539         MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
540         ip6_addr_set(&(neighbor_cache[i].next_hop_address), ip6_current_src_addr());
541 
542         /* Receiving a message does not prove reachability: only in one direction.
543          * Delay probe in case we get confirmation of reachability from upper layer (TCP). */
544         neighbor_cache[i].state = ND6_DELAY;
545         neighbor_cache[i].counter.delay_time = LWIP_ND6_DELAY_FIRST_PROBE_TIME / ND6_TMR_INTERVAL;
546       }
547 
548       /* Send back a NA for us. Allocate the reply pbuf. */
549       nd6_send_na(inp, &target_address, ND6_FLAG_SOLICITED | ND6_FLAG_OVERRIDE);
550     }
551 
552     break; /* ICMP6_TYPE_NS */
553   }
554   case ICMP6_TYPE_RA: /* Router Advertisement. */
555   {
556     struct ra_header *ra_hdr;
557     u8_t *buffer; /* Used to copy options. */
558     u16_t offset;
559 #if LWIP_ND6_RDNSS_MAX_DNS_SERVERS
560     /* There can be multiple RDNSS options per RA */
561     u8_t rdnss_server_idx = 0;
562 #endif /* LWIP_ND6_RDNSS_MAX_DNS_SERVERS */
563 
564     /* Check that RA header fits in packet. */
565     if (p->len < sizeof(struct ra_header)) {
566       /* @todo debug message */
567       pbuf_free(p);
568       ND6_STATS_INC(nd6.lenerr);
569       ND6_STATS_INC(nd6.drop);
570       return;
571     }
572 
573     ra_hdr = (struct ra_header *)p->payload;
574 
575     /* Check a subset of the other RFC 4861 Sec. 6.1.2 requirements. */
576     if (!ip6_addr_islinklocal(ip6_current_src_addr()) ||
577         IP6H_HOPLIM(ip6_current_header()) != ND6_HOPLIM || ra_hdr->code != 0) {
578       pbuf_free(p);
579       ND6_STATS_INC(nd6.proterr);
580       ND6_STATS_INC(nd6.drop);
581       return;
582     }
583 
584     /* @todo RFC MUST: all included options have a length greater than zero */
585 
586     /* If we are sending RS messages, stop. */
587 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
588     /* ensure at least one solicitation is sent (see RFC 4861, ch. 6.3.7) */
589     if ((inp->rs_count < LWIP_ND6_MAX_MULTICAST_SOLICIT) ||
590         (nd6_send_rs(inp) == ERR_OK)) {
591       inp->rs_count = 0;
592     } else {
593       inp->rs_count = 1;
594     }
595 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
596 
597     /* Get the matching default router entry. */
598     i = nd6_get_router(ip6_current_src_addr(), inp);
599     if (i < 0) {
600       /* Create a new router entry. */
601       i = nd6_new_router(ip6_current_src_addr(), inp);
602     }
603 
604     if (i < 0) {
605       /* Could not create a new router entry. */
606       pbuf_free(p);
607       ND6_STATS_INC(nd6.memerr);
608       return;
609     }
610 
611     /* Re-set invalidation timer. */
612     default_router_list[i].invalidation_timer = lwip_htons(ra_hdr->router_lifetime);
613 
614     /* Re-set default timer values. */
615 #if LWIP_ND6_ALLOW_RA_UPDATES
616     if (ra_hdr->retrans_timer > 0) {
617       retrans_timer = lwip_htonl(ra_hdr->retrans_timer);
618     }
619     if (ra_hdr->reachable_time > 0) {
620       reachable_time = lwip_htonl(ra_hdr->reachable_time);
621     }
622 #endif /* LWIP_ND6_ALLOW_RA_UPDATES */
623 
624     /* @todo set default hop limit... */
625     /* ra_hdr->current_hop_limit;*/
626 
627     /* Update flags in local entry (incl. preference). */
628     default_router_list[i].flags = ra_hdr->flags;
629 
630 #if LWIP_IPV6_DHCP6
631     /* Trigger DHCPv6 if enabled */
632     dhcp6_nd6_ra_trigger(inp, ra_hdr->flags & ND6_RA_FLAG_MANAGED_ADDR_CONFIG,
633       ra_hdr->flags & ND6_RA_FLAG_OTHER_CONFIG);
634 #endif
635 
636     /* Offset to options. */
637     offset = sizeof(struct ra_header);
638 
639     /* Process each option. */
640     while ((p->tot_len - offset) >= 2) {
641       u8_t option_type;
642       u16_t option_len;
643       int option_len8 = pbuf_try_get_at(p, offset + 1);
644       if (option_len8 <= 0) {
645         /* read beyond end or zero length */
646         goto lenerr_drop_free_return;
647       }
648       option_len = ((u8_t)option_len8) << 3;
649       if (option_len > p->tot_len - offset) {
650         /* short packet (option does not fit in) */
651         goto lenerr_drop_free_return;
652       }
653       if (p->len == p->tot_len) {
654         /* no need to copy from contiguous pbuf */
655         buffer = &((u8_t*)p->payload)[offset];
656       } else {
657         /* check if this option fits into our buffer */
658         if (option_len > sizeof(nd6_ra_buffer)) {
659           option_type = pbuf_get_at(p, offset);
660           /* invalid option length */
661           if (option_type != ND6_OPTION_TYPE_RDNSS) {
662             goto lenerr_drop_free_return;
663           }
664           /* we allow RDNSS option to be longer - we'll just drop some servers */
665           option_len = sizeof(nd6_ra_buffer);
666         }
667         buffer = (u8_t*)&nd6_ra_buffer;
668         option_len = pbuf_copy_partial(p, &nd6_ra_buffer, option_len, offset);
669       }
670       option_type = buffer[0];
671       switch (option_type) {
672       case ND6_OPTION_TYPE_SOURCE_LLADDR:
673       {
674         struct lladdr_option *lladdr_opt;
675         if (option_len < sizeof(struct lladdr_option)) {
676           goto lenerr_drop_free_return;
677         }
678         lladdr_opt = (struct lladdr_option *)buffer;
679         if ((default_router_list[i].neighbor_entry != NULL) &&
680             (default_router_list[i].neighbor_entry->state == ND6_INCOMPLETE)) {
681           SMEMCPY(default_router_list[i].neighbor_entry->lladdr, lladdr_opt->addr, inp->hwaddr_len);
682           default_router_list[i].neighbor_entry->state = ND6_REACHABLE;
683           default_router_list[i].neighbor_entry->counter.reachable_time = reachable_time;
684         }
685         break;
686       }
687       case ND6_OPTION_TYPE_MTU:
688       {
689         struct mtu_option *mtu_opt;
690         u32_t mtu32;
691         if (option_len < sizeof(struct mtu_option)) {
692           goto lenerr_drop_free_return;
693         }
694         mtu_opt = (struct mtu_option *)buffer;
695         mtu32 = lwip_htonl(mtu_opt->mtu);
696         if ((mtu32 >= IP6_MIN_MTU_LENGTH) && (mtu32 <= 0xffff)) {
697 #if LWIP_ND6_ALLOW_RA_UPDATES
698           if (inp->mtu) {
699             /* don't set the mtu for IPv6 higher than the netif driver supports */
700             inp->mtu6 = LWIP_MIN(LWIP_MIN(inp->mtu, inp->mtu6), (u16_t)mtu32);
701           } else {
702             inp->mtu6 = (u16_t)mtu32;
703           }
704 #endif /* LWIP_ND6_ALLOW_RA_UPDATES */
705         }
706         break;
707       }
708       case ND6_OPTION_TYPE_PREFIX_INFO:
709       {
710         struct prefix_option *prefix_opt;
711         ip6_addr_t prefix_addr;
712         if (option_len < sizeof(struct prefix_option)) {
713           goto lenerr_drop_free_return;
714         }
715 
716         prefix_opt = (struct prefix_option *)buffer;
717 
718         /* Get a memory-aligned copy of the prefix. */
719         ip6_addr_copy_from_packed(prefix_addr, prefix_opt->prefix);
720         ip6_addr_assign_zone(&prefix_addr, IP6_UNICAST, inp);
721 
722         if (!ip6_addr_islinklocal(&prefix_addr)) {
723           if ((prefix_opt->flags & ND6_PREFIX_FLAG_ON_LINK) &&
724               (prefix_opt->prefix_length == 64)) {
725             /* Add to on-link prefix list. */
726             u32_t valid_life;
727             s8_t prefix;
728 
729             valid_life = lwip_htonl(prefix_opt->valid_lifetime);
730 
731             /* find cache entry for this prefix. */
732             prefix = nd6_get_onlink_prefix(&prefix_addr, inp);
733             if (prefix < 0 && valid_life > 0) {
734               /* Create a new cache entry. */
735               prefix = nd6_new_onlink_prefix(&prefix_addr, inp);
736             }
737             if (prefix >= 0) {
738               prefix_list[prefix].invalidation_timer = valid_life;
739             }
740           }
741 #if LWIP_IPV6_AUTOCONFIG
742           if (prefix_opt->flags & ND6_PREFIX_FLAG_AUTONOMOUS) {
743             /* Perform processing for autoconfiguration. */
744             nd6_process_autoconfig_prefix(inp, prefix_opt, &prefix_addr);
745           }
746 #endif /* LWIP_IPV6_AUTOCONFIG */
747         }
748 
749         break;
750       }
751       case ND6_OPTION_TYPE_ROUTE_INFO:
752         /* @todo implement preferred routes.
753         struct route_option * route_opt;
754         route_opt = (struct route_option *)buffer;*/
755 
756         break;
757 #if LWIP_ND6_RDNSS_MAX_DNS_SERVERS
758       case ND6_OPTION_TYPE_RDNSS:
759       {
760         u8_t num, n;
761         u16_t copy_offset = offset + SIZEOF_RDNSS_OPTION_BASE;
762         struct rdnss_option * rdnss_opt;
763         if (option_len < SIZEOF_RDNSS_OPTION_BASE) {
764           goto lenerr_drop_free_return;
765         }
766 
767         rdnss_opt = (struct rdnss_option *)buffer;
768         num = (rdnss_opt->length - 1) / 2;
769         for (n = 0; (rdnss_server_idx < DNS_MAX_SERVERS) && (n < num); n++, copy_offset += sizeof(ip6_addr_p_t)) {
770           ip_addr_t rdnss_address;
771 
772           /* Copy directly from pbuf to get an aligned, zoned copy of the prefix. */
773           if (pbuf_copy_partial(p, &rdnss_address, sizeof(ip6_addr_p_t), copy_offset) == sizeof(ip6_addr_p_t)) {
774             IP_SET_TYPE_VAL(rdnss_address, IPADDR_TYPE_V6);
775             ip6_addr_assign_zone(ip_2_ip6(&rdnss_address), IP6_UNKNOWN, inp);
776 
777             if (htonl(rdnss_opt->lifetime) > 0) {
778               /* TODO implement Lifetime > 0 */
779               dns_setserver(rdnss_server_idx++, &rdnss_address);
780             } else {
781               /* TODO implement DNS removal in dns.c */
782               u8_t s;
783               for (s = 0; s < DNS_MAX_SERVERS; s++) {
784                 const ip_addr_t *addr = dns_getserver(s);
785                 if(ip_addr_cmp(addr, &rdnss_address)) {
786                   dns_setserver(s, NULL);
787                 }
788               }
789             }
790           }
791         }
792         break;
793       }
794 #endif /* LWIP_ND6_RDNSS_MAX_DNS_SERVERS */
795       default:
796         /* Unrecognized option, abort. */
797         ND6_STATS_INC(nd6.proterr);
798         break;
799       }
800       /* option length is checked earlier to be non-zero to make sure loop ends */
801       offset += 8 * (u8_t)option_len8;
802     }
803 
804     break; /* ICMP6_TYPE_RA */
805   }
806   case ICMP6_TYPE_RD: /* Redirect */
807   {
808     struct redirect_header *redir_hdr;
809     struct lladdr_option *lladdr_opt;
810     ip6_addr_t destination_address, target_address;
811 
812     /* Check that Redir header fits in packet. */
813     if (p->len < sizeof(struct redirect_header)) {
814       /* @todo debug message */
815       pbuf_free(p);
816       ND6_STATS_INC(nd6.lenerr);
817       ND6_STATS_INC(nd6.drop);
818       return;
819     }
820 
821     redir_hdr = (struct redirect_header *)p->payload;
822 
823     /* Create an aligned, zoned copy of the destination address. */
824     ip6_addr_copy_from_packed(destination_address, redir_hdr->destination_address);
825     ip6_addr_assign_zone(&destination_address, IP6_UNICAST, inp);
826 
827     /* Check a subset of the other RFC 4861 Sec. 8.1 requirements. */
828     if (!ip6_addr_islinklocal(ip6_current_src_addr()) ||
829         IP6H_HOPLIM(ip6_current_header()) != ND6_HOPLIM ||
830         redir_hdr->code != 0 || ip6_addr_ismulticast(&destination_address)) {
831       pbuf_free(p);
832       ND6_STATS_INC(nd6.proterr);
833       ND6_STATS_INC(nd6.drop);
834       return;
835     }
836 
837     /* @todo RFC MUST: IP source address equals first-hop router for destination_address */
838     /* @todo RFC MUST: ICMP target address is either link-local address or same as destination_address */
839     /* @todo RFC MUST: all included options have a length greater than zero */
840 
841     if (p->len >= (sizeof(struct redirect_header) + 2)) {
842       lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct redirect_header));
843       if (p->len < (sizeof(struct redirect_header) + (lladdr_opt->length << 3))) {
844         lladdr_opt = NULL;
845       }
846     } else {
847       lladdr_opt = NULL;
848     }
849 
850     /* Find dest address in cache */
851     dest_idx = nd6_find_destination_cache_entry(&destination_address);
852     if (dest_idx < 0) {
853       /* Destination not in cache, drop packet. */
854       pbuf_free(p);
855       return;
856     }
857 
858     /* Create an aligned, zoned copy of the target address. */
859     ip6_addr_copy_from_packed(target_address, redir_hdr->target_address);
860     ip6_addr_assign_zone(&target_address, IP6_UNICAST, inp);
861 
862     /* Set the new target address. */
863     ip6_addr_copy(destination_cache[dest_idx].next_hop_addr, target_address);
864 
865     /* If Link-layer address of other router is given, try to add to neighbor cache. */
866     if (lladdr_opt != NULL) {
867       if (lladdr_opt->type == ND6_OPTION_TYPE_TARGET_LLADDR) {
868         i = nd6_find_neighbor_cache_entry(&target_address);
869         if (i < 0) {
870           i = nd6_new_neighbor_cache_entry();
871           if (i >= 0) {
872             neighbor_cache[i].netif = inp;
873             MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
874             ip6_addr_copy(neighbor_cache[i].next_hop_address, target_address);
875 
876             /* Receiving a message does not prove reachability: only in one direction.
877              * Delay probe in case we get confirmation of reachability from upper layer (TCP). */
878             neighbor_cache[i].state = ND6_DELAY;
879             neighbor_cache[i].counter.delay_time = LWIP_ND6_DELAY_FIRST_PROBE_TIME / ND6_TMR_INTERVAL;
880           }
881         }
882         if (i >= 0) {
883           if (neighbor_cache[i].state == ND6_INCOMPLETE) {
884             MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
885             /* Receiving a message does not prove reachability: only in one direction.
886              * Delay probe in case we get confirmation of reachability from upper layer (TCP). */
887             neighbor_cache[i].state = ND6_DELAY;
888             neighbor_cache[i].counter.delay_time = LWIP_ND6_DELAY_FIRST_PROBE_TIME / ND6_TMR_INTERVAL;
889           }
890         }
891       }
892     }
893     break; /* ICMP6_TYPE_RD */
894   }
895   case ICMP6_TYPE_PTB: /* Packet too big */
896   {
897     struct icmp6_hdr *icmp6hdr; /* Packet too big message */
898     struct ip6_hdr *ip6hdr; /* IPv6 header of the packet which caused the error */
899     u32_t pmtu;
900     ip6_addr_t destination_address;
901 
902     /* Check that ICMPv6 header + IPv6 header fit in payload */
903     if (p->len < (sizeof(struct icmp6_hdr) + IP6_HLEN)) {
904       /* drop short packets */
905       pbuf_free(p);
906       ND6_STATS_INC(nd6.lenerr);
907       ND6_STATS_INC(nd6.drop);
908       return;
909     }
910 
911     icmp6hdr = (struct icmp6_hdr *)p->payload;
912     ip6hdr = (struct ip6_hdr *)((u8_t*)p->payload + sizeof(struct icmp6_hdr));
913 
914     /* Create an aligned, zoned copy of the destination address. */
915     ip6_addr_copy_from_packed(destination_address, ip6hdr->dest);
916     ip6_addr_assign_zone(&destination_address, IP6_UNKNOWN, inp);
917 
918     /* Look for entry in destination cache. */
919     dest_idx = nd6_find_destination_cache_entry(&destination_address);
920     if (dest_idx < 0) {
921       /* Destination not in cache, drop packet. */
922       pbuf_free(p);
923       return;
924     }
925 
926     /* Change the Path MTU. */
927     pmtu = lwip_htonl(icmp6hdr->data);
928     destination_cache[dest_idx].pmtu = (u16_t)LWIP_MIN(pmtu, 0xFFFF);
929 
930     break; /* ICMP6_TYPE_PTB */
931   }
932 
933   default:
934     ND6_STATS_INC(nd6.proterr);
935     ND6_STATS_INC(nd6.drop);
936     break; /* default */
937   }
938 
939   pbuf_free(p);
940   return;
941 lenerr_drop_free_return:
942   ND6_STATS_INC(nd6.lenerr);
943   ND6_STATS_INC(nd6.drop);
944   pbuf_free(p);
945 }
946 
947 
948 /**
949  * Periodic timer for Neighbor discovery functions:
950  *
951  * - Update neighbor reachability states
952  * - Update destination cache entries age
953  * - Update invalidation timers of default routers and on-link prefixes
954  * - Update lifetimes of our addresses
955  * - Perform duplicate address detection (DAD) for our addresses
956  * - Send router solicitations
957  */
958 void
nd6_tmr(void)959 nd6_tmr(void)
960 {
961   s8_t i;
962   struct netif *netif;
963 
964   /* Process neighbor entries. */
965   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
966     switch (neighbor_cache[i].state) {
967     case ND6_INCOMPLETE:
968       if ((neighbor_cache[i].counter.probes_sent >= LWIP_ND6_MAX_MULTICAST_SOLICIT) &&
969           (!neighbor_cache[i].isrouter)) {
970         /* Retries exceeded. */
971         nd6_free_neighbor_cache_entry(i);
972       } else {
973         /* Send a NS for this entry. */
974         neighbor_cache[i].counter.probes_sent++;
975         nd6_send_neighbor_cache_probe(&neighbor_cache[i], ND6_SEND_FLAG_MULTICAST_DEST);
976       }
977       break;
978     case ND6_REACHABLE:
979       /* Send queued packets, if any are left. Should have been sent already. */
980       if (neighbor_cache[i].q != NULL) {
981         nd6_send_q(i);
982       }
983       if (neighbor_cache[i].counter.reachable_time <= ND6_TMR_INTERVAL) {
984         /* Change to stale state. */
985         neighbor_cache[i].state = ND6_STALE;
986         neighbor_cache[i].counter.stale_time = 0;
987       } else {
988         neighbor_cache[i].counter.reachable_time -= ND6_TMR_INTERVAL;
989       }
990       break;
991     case ND6_STALE:
992       neighbor_cache[i].counter.stale_time++;
993       break;
994     case ND6_DELAY:
995       if (neighbor_cache[i].counter.delay_time <= 1) {
996         /* Change to PROBE state. */
997         neighbor_cache[i].state = ND6_PROBE;
998         neighbor_cache[i].counter.probes_sent = 0;
999       } else {
1000         neighbor_cache[i].counter.delay_time--;
1001       }
1002       break;
1003     case ND6_PROBE:
1004       if ((neighbor_cache[i].counter.probes_sent >= LWIP_ND6_MAX_MULTICAST_SOLICIT) &&
1005           (!neighbor_cache[i].isrouter)) {
1006         /* Retries exceeded. */
1007         nd6_free_neighbor_cache_entry(i);
1008       } else {
1009         /* Send a NS for this entry. */
1010         neighbor_cache[i].counter.probes_sent++;
1011         nd6_send_neighbor_cache_probe(&neighbor_cache[i], 0);
1012       }
1013       break;
1014     case ND6_NO_ENTRY:
1015     default:
1016       /* Do nothing. */
1017       break;
1018     }
1019   }
1020 
1021   /* Process destination entries. */
1022   for (i = 0; i < LWIP_ND6_NUM_DESTINATIONS; i++) {
1023     destination_cache[i].age++;
1024   }
1025 
1026   /* Process router entries. */
1027   for (i = 0; i < LWIP_ND6_NUM_ROUTERS; i++) {
1028     if (default_router_list[i].neighbor_entry != NULL) {
1029       /* Active entry. */
1030       if (default_router_list[i].invalidation_timer <= ND6_TMR_INTERVAL / 1000) {
1031         /* No more than 1 second remaining. Clear this entry. Also clear any of
1032          * its destination cache entries, as per RFC 4861 Sec. 5.3 and 6.3.5. */
1033         s8_t j;
1034         for (j = 0; j < LWIP_ND6_NUM_DESTINATIONS; j++) {
1035           if (ip6_addr_cmp(&destination_cache[j].next_hop_addr,
1036                &default_router_list[i].neighbor_entry->next_hop_address)) {
1037              ip6_addr_set_any(&destination_cache[j].destination_addr);
1038           }
1039         }
1040         default_router_list[i].neighbor_entry->isrouter = 0;
1041         default_router_list[i].neighbor_entry = NULL;
1042         default_router_list[i].invalidation_timer = 0;
1043         default_router_list[i].flags = 0;
1044       } else {
1045         default_router_list[i].invalidation_timer -= ND6_TMR_INTERVAL / 1000;
1046       }
1047     }
1048   }
1049 
1050   /* Process prefix entries. */
1051   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; i++) {
1052     if (prefix_list[i].netif != NULL) {
1053       if (prefix_list[i].invalidation_timer <= ND6_TMR_INTERVAL / 1000) {
1054         /* Entry timed out, remove it */
1055         prefix_list[i].invalidation_timer = 0;
1056         prefix_list[i].netif = NULL;
1057       } else {
1058         prefix_list[i].invalidation_timer -= ND6_TMR_INTERVAL / 1000;
1059       }
1060     }
1061   }
1062 
1063   /* Process our own addresses, updating address lifetimes and/or DAD state. */
1064 #ifdef LOSCFG_NET_CONTAINER
1065   NETIF_FOREACH(netif, get_root_net_group()) {
1066 #else
1067   NETIF_FOREACH(netif) {
1068 #endif
1069     for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; ++i) {
1070       u8_t addr_state;
1071 #if LWIP_IPV6_ADDRESS_LIFETIMES
1072       /* Step 1: update address lifetimes (valid and preferred). */
1073       addr_state = netif_ip6_addr_state(netif, i);
1074       /* RFC 4862 is not entirely clear as to whether address lifetimes affect
1075        * tentative addresses, and is even less clear as to what should happen
1076        * with duplicate addresses. We choose to track and update lifetimes for
1077        * both those types, although for different reasons:
1078        * - for tentative addresses, the line of thought of Sec. 5.7 combined
1079        *   with the potentially long period that an address may be in tentative
1080        *   state (due to the interface being down) suggests that lifetimes
1081        *   should be independent of external factors which would include DAD;
1082        * - for duplicate addresses, retiring them early could result in a new
1083        *   but unwanted attempt at marking them as valid, while retiring them
1084        *   late/never could clog up address slots on the netif.
1085        * As a result, we may end up expiring addresses of either type here.
1086        */
1087       if (!ip6_addr_isinvalid(addr_state) &&
1088           !netif_ip6_addr_isstatic(netif, i)) {
1089         u32_t life = netif_ip6_addr_valid_life(netif, i);
1090         if (life <= ND6_TMR_INTERVAL / 1000) {
1091           /* The address has expired. */
1092           netif_ip6_addr_set_valid_life(netif, i, 0);
1093           netif_ip6_addr_set_pref_life(netif, i, 0);
1094           netif_ip6_addr_set_state(netif, i, IP6_ADDR_INVALID);
1095         } else {
1096           if (!ip6_addr_life_isinfinite(life)) {
1097             life -= ND6_TMR_INTERVAL / 1000;
1098             LWIP_ASSERT("bad valid lifetime", life != IP6_ADDR_LIFE_STATIC);
1099             netif_ip6_addr_set_valid_life(netif, i, life);
1100           }
1101           /* The address is still here. Update the preferred lifetime too. */
1102           life = netif_ip6_addr_pref_life(netif, i);
1103           if (life <= ND6_TMR_INTERVAL / 1000) {
1104             /* This case must also trigger if 'life' was already zero, so as to
1105              * deal correctly with advertised preferred-lifetime reductions. */
1106             netif_ip6_addr_set_pref_life(netif, i, 0);
1107             if (addr_state == IP6_ADDR_PREFERRED)
1108               netif_ip6_addr_set_state(netif, i, IP6_ADDR_DEPRECATED);
1109           } else if (!ip6_addr_life_isinfinite(life)) {
1110             life -= ND6_TMR_INTERVAL / 1000;
1111             netif_ip6_addr_set_pref_life(netif, i, life);
1112           }
1113         }
1114       }
1115       /* The address state may now have changed, so reobtain it next. */
1116 #endif /* LWIP_IPV6_ADDRESS_LIFETIMES */
1117       /* Step 2: update DAD state. */
1118       addr_state = netif_ip6_addr_state(netif, i);
1119       if (ip6_addr_istentative(addr_state)) {
1120         if ((addr_state & IP6_ADDR_TENTATIVE_COUNT_MASK) >= LWIP_IPV6_DUP_DETECT_ATTEMPTS) {
1121           /* No NA received in response. Mark address as valid. For dynamic
1122            * addresses with an expired preferred lifetime, the state is set to
1123            * deprecated right away. That should almost never happen, though. */
1124           addr_state = IP6_ADDR_PREFERRED;
1125 #if LWIP_IPV6_ADDRESS_LIFETIMES
1126           if (!netif_ip6_addr_isstatic(netif, i) &&
1127               netif_ip6_addr_pref_life(netif, i) == 0) {
1128             addr_state = IP6_ADDR_DEPRECATED;
1129           }
1130 #endif /* LWIP_IPV6_ADDRESS_LIFETIMES */
1131           netif_ip6_addr_set_state(netif, i, addr_state);
1132         } else if (netif_is_up(netif) && netif_is_link_up(netif)) {
1133           /* tentative: set next state by increasing by one */
1134           netif_ip6_addr_set_state(netif, i, addr_state + 1);
1135           /* Send a NS for this address. Use the unspecified address as source
1136            * address in all cases (RFC 4862 Sec. 5.4.2), not in the least
1137            * because as it is, we only consider multicast replies for DAD. */
1138           nd6_send_ns(netif, netif_ip6_addr(netif, i),
1139             ND6_SEND_FLAG_MULTICAST_DEST | ND6_SEND_FLAG_ANY_SRC);
1140         }
1141       }
1142     }
1143   }
1144 
1145 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
1146   /* Send router solicitation messages, if necessary. */
1147   if (!nd6_tmr_rs_reduction) {
1148     nd6_tmr_rs_reduction = (ND6_RTR_SOLICITATION_INTERVAL / ND6_TMR_INTERVAL) - 1;
1149 #ifdef LOSCFG_NET_CONTAINER
1150     NETIF_FOREACH(netif, get_root_net_group()) {
1151 #else
1152     NETIF_FOREACH(netif) {
1153 #endif
1154       if ((netif->rs_count > 0) && netif_is_up(netif) &&
1155           netif_is_link_up(netif) &&
1156           !ip6_addr_isinvalid(netif_ip6_addr_state(netif, 0)) &&
1157           !ip6_addr_isduplicated(netif_ip6_addr_state(netif, 0))) {
1158         if (nd6_send_rs(netif) == ERR_OK) {
1159           netif->rs_count--;
1160         }
1161       }
1162     }
1163   } else {
1164     nd6_tmr_rs_reduction--;
1165   }
1166 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
1167 
1168 }
1169 
1170 #if LWIP_LOWPOWER
1171 #include "lwip/lowpower.h"
1172 u32_t
1173 nd6_tmr_tick(void)
1174 {
1175   s8_t i;
1176   struct netif *netif = NULL;
1177   u32_t tick = 0;
1178   u32_t val = 0;
1179 
1180   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1181     switch (neighbor_cache[i].state) {
1182       case ND6_PROBE:
1183       case ND6_INCOMPLETE: /* state PROBE and INCOMPLETE return 1 */
1184         return 1;
1185       case ND6_REACHABLE:
1186         /* Send queued packets, if any are left. Should have been sent already. */
1187         if (neighbor_cache[i].q != NULL) {
1188           return 1;
1189         }
1190         if (neighbor_cache[i].counter.reachable_time >= ND6_TMR_INTERVAL) {
1191           val = neighbor_cache[i].counter.reachable_time / ND6_TMR_INTERVAL;
1192           SET_TMR_TICK(tick, val);
1193         }
1194         break;
1195       case ND6_DELAY:
1196         val = neighbor_cache[i].counter.delay_time;
1197         SET_TMR_TICK(tick, val);
1198         break;
1199       default:
1200         /* Do nothing. */
1201         break;
1202     }
1203   }
1204 
1205   /* Process router entries. */
1206   for (i = 0; i < LWIP_ND6_NUM_ROUTERS; i++) {
1207     if (default_router_list[i].neighbor_entry != NULL) {
1208       val = default_router_list[i].invalidation_timer;
1209       SET_TMR_TICK(tick, val);
1210     }
1211   }
1212 
1213   /* Process prefix entries. */
1214   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; i++) {
1215     if (prefix_list[i].netif != NULL) {
1216       val = prefix_list[i].invalidation_timer;
1217       SET_TMR_TICK(tick, val);
1218     }
1219   }
1220 
1221   /* Process our own addresses, updating address lifetimes and/or DAD state. */
1222 #ifdef LOSCFG_NET_CONTAINER
1223   NETIF_FOREACH(netif, get_root_net_group())
1224 #else
1225   NETIF_FOREACH(netif)
1226 #endif
1227   {
1228     for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; ++i) {
1229       u8_t addr_state;
1230 #if LWIP_IPV6_ADDRESS_LIFETIMES
1231       /* Step 1: update address lifetimes (valid and preferred). */
1232       addr_state = netif_ip6_addr_state(netif, i);
1233       if (!ip6_addr_isinvalid(addr_state) &&
1234           !netif_ip6_addr_isstatic(netif, i)) {
1235         u32_t life = netif_ip6_addr_valid_life(netif, i);
1236         if (!ip6_addr_life_isinfinite(life)) {
1237           SET_TMR_TICK(tick, life);
1238         }
1239 
1240         life = netif_ip6_addr_pref_life(netif, i);
1241         if (!ip6_addr_life_isinfinite(life)) {
1242           SET_TMR_TICK(tick, life);
1243         }
1244       }
1245       /* The address state may now have changed, so reobtain it next. */
1246 #endif /* LWIP_IPV6_ADDRESS_LIFETIMES */
1247       /* Step 2: update DAD state. */
1248       addr_state = netif_ip6_addr_state(netif, i);
1249       if (ip6_addr_istentative(addr_state)) {
1250         LWIP_DEBUGF(LOWPOWER_DEBUG, ("%s tmr tick: 1\n", "nd6_tmr_tick"));
1251         return 1;
1252       }
1253     }
1254   }
1255 
1256   /* Router solicitations are sent in 4 second intervals (see RFC 4861, ch. 6.3.7) */
1257   /* ND6_RTR_SOLICITATION_INTERVAL */
1258 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
1259   if (nd6_tmr_rs_reduction > 0) {
1260     val = nd6_tmr_rs_reduction;
1261     SET_TMR_TICK(tick, val);
1262   }
1263 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
1264 
1265   LWIP_DEBUGF(LOWPOWER_DEBUG, ("%s tmr tick: %u\n", "nd6_tmr_tick", tick));
1266   return tick;
1267 }
1268 #endif /* LWIP_LOWPOWER */
1269 
1270 /** Send a neighbor solicitation message for a specific neighbor cache entry
1271  *
1272  * @param entry the neightbor cache entry for wich to send the message
1273  * @param flags one of ND6_SEND_FLAG_*
1274  */
1275 static void
1276 nd6_send_neighbor_cache_probe(struct nd6_neighbor_cache_entry *entry, u8_t flags)
1277 {
1278   nd6_send_ns(entry->netif, &entry->next_hop_address, flags);
1279 }
1280 
1281 /**
1282  * Send a neighbor solicitation message
1283  *
1284  * @param netif the netif on which to send the message
1285  * @param target_addr the IPv6 target address for the ND message
1286  * @param flags one of ND6_SEND_FLAG_*
1287  */
1288 static void
1289 nd6_send_ns(struct netif *netif, const ip6_addr_t *target_addr, u8_t flags)
1290 {
1291   struct ns_header *ns_hdr;
1292   struct pbuf *p;
1293   const ip6_addr_t *src_addr = NULL;
1294   u16_t lladdr_opt_len;
1295 
1296   LWIP_ASSERT("target address is required", target_addr != NULL);
1297 
1298   if (!(flags & ND6_SEND_FLAG_ANY_SRC)) {
1299     int i;
1300     for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
1301       if (ip6_addr_isvalid(netif_ip6_addr_state(netif, i)) &&
1302             ip6_addr_netcmp(target_addr, netif_ip6_addr(netif, i))) {
1303         src_addr = netif_ip6_addr(netif, i);
1304         break;
1305       }
1306     }
1307 
1308     if (i == LWIP_IPV6_NUM_ADDRESSES) {
1309       LWIP_DEBUGF(IP6_DEBUG | LWIP_DBG_LEVEL_WARNING, ("ICMPv6 NS: no available src address\n"));
1310       ND6_STATS_INC(nd6.err);
1311       return;
1312     }
1313 
1314     /* calculate option length (in 8-byte-blocks) */
1315     lladdr_opt_len = ((netif->hwaddr_len + 2) + 7) >> 3;
1316   } else {
1317     src_addr = IP6_ADDR_ANY6;
1318     /* Option "MUST NOT be included when the source IP address is the unspecified address." */
1319     lladdr_opt_len = 0;
1320   }
1321 
1322   /* Allocate a packet. */
1323   p = pbuf_alloc(PBUF_IP, sizeof(struct ns_header) + (lladdr_opt_len << 3), PBUF_RAM);
1324   if (p == NULL) {
1325     ND6_STATS_INC(nd6.memerr);
1326     return;
1327   }
1328 
1329   /* Set fields. */
1330   ns_hdr = (struct ns_header *)p->payload;
1331 
1332   ns_hdr->type = ICMP6_TYPE_NS;
1333   ns_hdr->code = 0;
1334   ns_hdr->chksum = 0;
1335   ns_hdr->reserved = 0;
1336   ip6_addr_copy_to_packed(ns_hdr->target_address, *target_addr);
1337 
1338   if (lladdr_opt_len != 0) {
1339     struct lladdr_option *lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct ns_header));
1340     lladdr_opt->type = ND6_OPTION_TYPE_SOURCE_LLADDR;
1341     lladdr_opt->length = (u8_t)lladdr_opt_len;
1342     SMEMCPY(lladdr_opt->addr, netif->hwaddr, netif->hwaddr_len);
1343   }
1344 
1345   /* Generate the solicited node address for the target address. */
1346   if (flags & ND6_SEND_FLAG_MULTICAST_DEST) {
1347     ip6_addr_set_solicitednode(&multicast_address, target_addr->addr[3]);
1348     ip6_addr_assign_zone(&multicast_address, IP6_MULTICAST, netif);
1349     target_addr = &multicast_address;
1350   }
1351 
1352 #if CHECKSUM_GEN_ICMP6
1353   IF__NETIF_CHECKSUM_ENABLED(netif, NETIF_CHECKSUM_GEN_ICMP6) {
1354     ns_hdr->chksum = ip6_chksum_pseudo(p, IP6_NEXTH_ICMP6, p->len, src_addr,
1355       target_addr);
1356   }
1357 #endif /* CHECKSUM_GEN_ICMP6 */
1358 
1359   /* Send the packet out. */
1360   ND6_STATS_INC(nd6.xmit);
1361   ip6_output_if(p, (src_addr == IP6_ADDR_ANY6) ? NULL : src_addr, target_addr,
1362       ND6_HOPLIM, 0, IP6_NEXTH_ICMP6, netif);
1363   pbuf_free(p);
1364 }
1365 
1366 /**
1367  * Send a neighbor advertisement message
1368  *
1369  * @param netif the netif on which to send the message
1370  * @param target_addr the IPv6 target address for the ND message
1371  * @param flags one of ND6_SEND_FLAG_*
1372  */
1373 static void
1374 nd6_send_na(struct netif *netif, const ip6_addr_t *target_addr, u8_t flags)
1375 {
1376   struct na_header *na_hdr;
1377   struct lladdr_option *lladdr_opt;
1378   struct pbuf *p;
1379   const ip6_addr_t *src_addr;
1380   const ip6_addr_t *dest_addr;
1381   u16_t lladdr_opt_len;
1382 
1383   LWIP_ASSERT("target address is required", target_addr != NULL);
1384 
1385   /* Use link-local address as source address. */
1386   /* src_addr = netif_ip6_addr(netif, 0); */
1387   /* Use target address as source address. */
1388   src_addr = target_addr;
1389 
1390   /* Allocate a packet. */
1391   lladdr_opt_len = ((netif->hwaddr_len + 2) >> 3) + (((netif->hwaddr_len + 2) & 0x07) ? 1 : 0);
1392   p = pbuf_alloc(PBUF_IP, sizeof(struct na_header) + (lladdr_opt_len << 3), PBUF_RAM);
1393   if (p == NULL) {
1394     ND6_STATS_INC(nd6.memerr);
1395     return;
1396   }
1397 
1398   /* Set fields. */
1399   na_hdr = (struct na_header *)p->payload;
1400   lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct na_header));
1401 
1402   na_hdr->type = ICMP6_TYPE_NA;
1403   na_hdr->code = 0;
1404   na_hdr->chksum = 0;
1405   na_hdr->flags = flags & 0xf0;
1406   na_hdr->reserved[0] = 0;
1407   na_hdr->reserved[1] = 0;
1408   na_hdr->reserved[2] = 0;
1409   ip6_addr_copy_to_packed(na_hdr->target_address, *target_addr);
1410 
1411   lladdr_opt->type = ND6_OPTION_TYPE_TARGET_LLADDR;
1412   lladdr_opt->length = (u8_t)lladdr_opt_len;
1413   SMEMCPY(lladdr_opt->addr, netif->hwaddr, netif->hwaddr_len);
1414 
1415   /* Generate the solicited node address for the target address. */
1416   if (flags & ND6_SEND_FLAG_MULTICAST_DEST) {
1417     ip6_addr_set_solicitednode(&multicast_address, target_addr->addr[3]);
1418     ip6_addr_assign_zone(&multicast_address, IP6_MULTICAST, netif);
1419     dest_addr = &multicast_address;
1420   } else if (flags & ND6_SEND_FLAG_ALLNODES_DEST) {
1421     ip6_addr_set_allnodes_linklocal(&multicast_address);
1422     ip6_addr_assign_zone(&multicast_address, IP6_MULTICAST, netif);
1423     dest_addr = &multicast_address;
1424   } else {
1425     dest_addr = ip6_current_src_addr();
1426   }
1427 
1428 #if CHECKSUM_GEN_ICMP6
1429   IF__NETIF_CHECKSUM_ENABLED(netif, NETIF_CHECKSUM_GEN_ICMP6) {
1430     na_hdr->chksum = ip6_chksum_pseudo(p, IP6_NEXTH_ICMP6, p->len, src_addr,
1431       dest_addr);
1432   }
1433 #endif /* CHECKSUM_GEN_ICMP6 */
1434 
1435   /* Send the packet out. */
1436   ND6_STATS_INC(nd6.xmit);
1437   ip6_output_if(p, src_addr, dest_addr,
1438       ND6_HOPLIM, 0, IP6_NEXTH_ICMP6, netif);
1439   pbuf_free(p);
1440 }
1441 
1442 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
1443 /**
1444  * Send a router solicitation message
1445  *
1446  * @param netif the netif on which to send the message
1447  */
1448 static err_t
1449 nd6_send_rs(struct netif *netif)
1450 {
1451   struct rs_header *rs_hdr;
1452   struct lladdr_option *lladdr_opt;
1453   struct pbuf *p;
1454   const ip6_addr_t *src_addr;
1455   err_t err;
1456   u16_t lladdr_opt_len = 0;
1457 
1458   /* Link-local source address, or unspecified address? */
1459   if (ip6_addr_isvalid(netif_ip6_addr_state(netif, 0))) {
1460     src_addr = netif_ip6_addr(netif, 0);
1461   } else {
1462     src_addr = IP6_ADDR_ANY6;
1463   }
1464 
1465   /* Generate the all routers target address. */
1466   ip6_addr_set_allrouters_linklocal(&multicast_address);
1467   ip6_addr_assign_zone(&multicast_address, IP6_MULTICAST, netif);
1468 
1469   /* Allocate a packet. */
1470   if (src_addr != IP6_ADDR_ANY6) {
1471     lladdr_opt_len = ((netif->hwaddr_len + 2) >> 3) + (((netif->hwaddr_len + 2) & 0x07) ? 1 : 0);
1472   }
1473   p = pbuf_alloc(PBUF_IP, sizeof(struct rs_header) + (lladdr_opt_len << 3), PBUF_RAM);
1474   if (p == NULL) {
1475     ND6_STATS_INC(nd6.memerr);
1476     return ERR_BUF;
1477   }
1478 
1479   /* Set fields. */
1480   rs_hdr = (struct rs_header *)p->payload;
1481 
1482   rs_hdr->type = ICMP6_TYPE_RS;
1483   rs_hdr->code = 0;
1484   rs_hdr->chksum = 0;
1485   rs_hdr->reserved = 0;
1486 
1487   if (src_addr != IP6_ADDR_ANY6) {
1488     /* Include our hw address. */
1489     lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct rs_header));
1490     lladdr_opt->type = ND6_OPTION_TYPE_SOURCE_LLADDR;
1491     lladdr_opt->length = (u8_t)lladdr_opt_len;
1492     SMEMCPY(lladdr_opt->addr, netif->hwaddr, netif->hwaddr_len);
1493   }
1494 
1495 #if CHECKSUM_GEN_ICMP6
1496   IF__NETIF_CHECKSUM_ENABLED(netif, NETIF_CHECKSUM_GEN_ICMP6) {
1497     rs_hdr->chksum = ip6_chksum_pseudo(p, IP6_NEXTH_ICMP6, p->len, src_addr,
1498       &multicast_address);
1499   }
1500 #endif /* CHECKSUM_GEN_ICMP6 */
1501 
1502   /* Send the packet out. */
1503   ND6_STATS_INC(nd6.xmit);
1504 
1505   err = ip6_output_if(p, (src_addr == IP6_ADDR_ANY6) ? NULL : src_addr, &multicast_address,
1506       ND6_HOPLIM, 0, IP6_NEXTH_ICMP6, netif);
1507   pbuf_free(p);
1508 
1509   return err;
1510 }
1511 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
1512 
1513 /**
1514  * Search for a neighbor cache entry
1515  *
1516  * @param ip6addr the IPv6 address of the neighbor
1517  * @return The neighbor cache entry index that matched, -1 if no
1518  * entry is found
1519  */
1520 static s8_t
1521 nd6_find_neighbor_cache_entry(const ip6_addr_t *ip6addr)
1522 {
1523   s8_t i;
1524   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1525     if (ip6_addr_cmp(ip6addr, &(neighbor_cache[i].next_hop_address))) {
1526       return i;
1527     }
1528   }
1529   return -1;
1530 }
1531 
1532 /**
1533  * Create a new neighbor cache entry.
1534  *
1535  * If no unused entry is found, will try to recycle an old entry
1536  * according to ad-hoc "age" heuristic.
1537  *
1538  * @return The neighbor cache entry index that was created, -1 if no
1539  * entry could be created
1540  */
1541 static s8_t
1542 nd6_new_neighbor_cache_entry(void)
1543 {
1544   s8_t i;
1545   s8_t j;
1546   u32_t time;
1547 
1548 
1549   /* First, try to find an empty entry. */
1550   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1551     if (neighbor_cache[i].state == ND6_NO_ENTRY) {
1552       return i;
1553     }
1554   }
1555 
1556   /* We need to recycle an entry. in general, do not recycle if it is a router. */
1557 
1558   /* Next, try to find a Stale entry. */
1559   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1560     if ((neighbor_cache[i].state == ND6_STALE) &&
1561         (!neighbor_cache[i].isrouter)) {
1562       nd6_free_neighbor_cache_entry(i);
1563       return i;
1564     }
1565   }
1566 
1567   /* Next, try to find a Probe entry. */
1568   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1569     if ((neighbor_cache[i].state == ND6_PROBE) &&
1570         (!neighbor_cache[i].isrouter)) {
1571       nd6_free_neighbor_cache_entry(i);
1572       return i;
1573     }
1574   }
1575 
1576   /* Next, try to find a Delayed entry. */
1577   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1578     if ((neighbor_cache[i].state == ND6_DELAY) &&
1579         (!neighbor_cache[i].isrouter)) {
1580       nd6_free_neighbor_cache_entry(i);
1581       return i;
1582     }
1583   }
1584 
1585   /* Next, try to find the oldest reachable entry. */
1586   time = 0xfffffffful;
1587   j = -1;
1588   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1589     if ((neighbor_cache[i].state == ND6_REACHABLE) &&
1590         (!neighbor_cache[i].isrouter)) {
1591       if (neighbor_cache[i].counter.reachable_time < time) {
1592         j = i;
1593         time = neighbor_cache[i].counter.reachable_time;
1594       }
1595     }
1596   }
1597   if (j >= 0) {
1598     nd6_free_neighbor_cache_entry(j);
1599     return j;
1600   }
1601 
1602   /* Next, find oldest incomplete entry without queued packets. */
1603   time = 0;
1604   j = -1;
1605   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1606     if (
1607         (neighbor_cache[i].q == NULL) &&
1608         (neighbor_cache[i].state == ND6_INCOMPLETE) &&
1609         (!neighbor_cache[i].isrouter)) {
1610       if (neighbor_cache[i].counter.probes_sent >= time) {
1611         j = i;
1612         time = neighbor_cache[i].counter.probes_sent;
1613       }
1614     }
1615   }
1616   if (j >= 0) {
1617     nd6_free_neighbor_cache_entry(j);
1618     return j;
1619   }
1620 
1621   /* Next, find oldest incomplete entry with queued packets. */
1622   time = 0;
1623   j = -1;
1624   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1625     if ((neighbor_cache[i].state == ND6_INCOMPLETE) &&
1626         (!neighbor_cache[i].isrouter)) {
1627       if (neighbor_cache[i].counter.probes_sent >= time) {
1628         j = i;
1629         time = neighbor_cache[i].counter.probes_sent;
1630       }
1631     }
1632   }
1633   if (j >= 0) {
1634     nd6_free_neighbor_cache_entry(j);
1635     return j;
1636   }
1637 
1638   /* No more entries to try. */
1639   return -1;
1640 }
1641 
1642 /**
1643  * Will free any resources associated with a neighbor cache
1644  * entry, and will mark it as unused.
1645  *
1646  * @param i the neighbor cache entry index to free
1647  */
1648 static void
1649 nd6_free_neighbor_cache_entry(s8_t i)
1650 {
1651   if ((i < 0) || (i >= LWIP_ND6_NUM_NEIGHBORS)) {
1652     return;
1653   }
1654   if (neighbor_cache[i].isrouter) {
1655     /* isrouter needs to be cleared before deleting a neighbor cache entry */
1656     return;
1657   }
1658 
1659   /* Free any queued packets. */
1660   if (neighbor_cache[i].q != NULL) {
1661     nd6_free_q(neighbor_cache[i].q);
1662     neighbor_cache[i].q = NULL;
1663   }
1664 
1665   neighbor_cache[i].state = ND6_NO_ENTRY;
1666   neighbor_cache[i].isrouter = 0;
1667   neighbor_cache[i].netif = NULL;
1668   neighbor_cache[i].counter.reachable_time = 0;
1669   ip6_addr_set_zero(&(neighbor_cache[i].next_hop_address));
1670 }
1671 
1672 /**
1673  * Search for a destination cache entry
1674  *
1675  * @param ip6addr the IPv6 address of the destination
1676  * @return The destination cache entry index that matched, -1 if no
1677  * entry is found
1678  */
1679 static s16_t
1680 nd6_find_destination_cache_entry(const ip6_addr_t *ip6addr)
1681 {
1682   s16_t i;
1683 
1684   IP6_ADDR_ZONECHECK(ip6addr);
1685 
1686   for (i = 0; i < LWIP_ND6_NUM_DESTINATIONS; i++) {
1687     if (ip6_addr_cmp(ip6addr, &(destination_cache[i].destination_addr))) {
1688       return i;
1689     }
1690   }
1691   return -1;
1692 }
1693 
1694 /**
1695  * Create a new destination cache entry. If no unused entry is found,
1696  * will recycle oldest entry.
1697  *
1698  * @return The destination cache entry index that was created, -1 if no
1699  * entry was created
1700  */
1701 static s16_t
1702 nd6_new_destination_cache_entry(void)
1703 {
1704   s16_t i, j;
1705   u32_t age;
1706 
1707   /* Find an empty entry. */
1708   for (i = 0; i < LWIP_ND6_NUM_DESTINATIONS; i++) {
1709     if (ip6_addr_isany(&(destination_cache[i].destination_addr))) {
1710       return i;
1711     }
1712   }
1713 
1714   /* Find oldest entry. */
1715   age = 0;
1716   j = LWIP_ND6_NUM_DESTINATIONS - 1;
1717   for (i = 0; i < LWIP_ND6_NUM_DESTINATIONS; i++) {
1718     if (destination_cache[i].age > age) {
1719       j = i;
1720     }
1721   }
1722 
1723   return j;
1724 }
1725 
1726 /**
1727  * Clear the destination cache.
1728  *
1729  * This operation may be necessary for consistency in the light of changing
1730  * local addresses and/or use of the gateway hook.
1731  */
1732 void
1733 nd6_clear_destination_cache(void)
1734 {
1735   int i;
1736 
1737   for (i = 0; i < LWIP_ND6_NUM_DESTINATIONS; i++) {
1738     ip6_addr_set_any(&destination_cache[i].destination_addr);
1739   }
1740 }
1741 
1742 /**
1743  * Determine whether an address matches an on-link prefix or the subnet of a
1744  * statically assigned address.
1745  *
1746  * @param ip6addr the IPv6 address to match
1747  * @return 1 if the address is on-link, 0 otherwise
1748  */
1749 static int
1750 nd6_is_prefix_in_netif(const ip6_addr_t *ip6addr, struct netif *netif)
1751 {
1752   s8_t i;
1753 
1754   /* Check to see if the address matches an on-link prefix. */
1755   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; i++) {
1756     if ((prefix_list[i].netif == netif) &&
1757         (prefix_list[i].invalidation_timer > 0) &&
1758         ip6_addr_netcmp(ip6addr, &(prefix_list[i].prefix))) {
1759       return 1;
1760     }
1761   }
1762   /* Check to see if address prefix matches a manually configured (= static)
1763    * address. Static addresses have an implied /64 subnet assignment. Dynamic
1764    * addresses (from autoconfiguration) have no implied subnet assignment, and
1765    * are thus effectively /128 assignments. See RFC 5942 for more on this. */
1766   for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
1767     if (ip6_addr_isvalid(netif_ip6_addr_state(netif, i)) &&
1768         netif_ip6_addr_isstatic(netif, i) &&
1769         ip6_addr_netcmp(ip6addr, netif_ip6_addr(netif, i))) {
1770       return 1;
1771     }
1772   }
1773   return 0;
1774 }
1775 
1776 /**
1777  * Select a default router for a destination.
1778  *
1779  * This function is used both for routing and for finding a next-hop target for
1780  * a packet. In the former case, the given netif is NULL, and the returned
1781  * router entry must be for a netif suitable for sending packets (up, link up).
1782  * In the latter case, the given netif is not NULL and restricts router choice.
1783  *
1784  * @param ip6addr the destination address
1785  * @param netif the netif for the outgoing packet, if known
1786  * @return the default router entry index, or -1 if no suitable
1787  *         router is found
1788  */
1789 static s8_t
1790 nd6_select_router(const ip6_addr_t *ip6addr, struct netif *netif)
1791 {
1792   struct netif *router_netif;
1793   s8_t i, j, valid_router;
1794   static s8_t last_router;
1795 
1796   LWIP_UNUSED_ARG(ip6addr); /* @todo match preferred routes!! (must implement ND6_OPTION_TYPE_ROUTE_INFO) */
1797 
1798   /* @todo: implement default router preference */
1799 
1800   /* Look for valid routers. A reachable router is preferred. */
1801   valid_router = -1;
1802   for (i = 0; i < LWIP_ND6_NUM_ROUTERS; i++) {
1803     /* Is the router netif both set and apppropriate? */
1804     if (default_router_list[i].neighbor_entry != NULL) {
1805       router_netif = default_router_list[i].neighbor_entry->netif;
1806       if ((router_netif != NULL) && (netif != NULL ? netif == router_netif :
1807           (netif_is_up(router_netif) && netif_is_link_up(router_netif)))) {
1808         /* Is the router valid, i.e., reachable or probably reachable as per
1809          * RFC 4861 Sec. 6.3.6? Note that we will never return a router that
1810          * has no neighbor cache entry, due to the netif association tests. */
1811         if (default_router_list[i].neighbor_entry->state != ND6_INCOMPLETE) {
1812           /* Is the router known to be reachable? */
1813           if (default_router_list[i].neighbor_entry->state == ND6_REACHABLE) {
1814             return i; /* valid and reachable - done! */
1815           } else if (valid_router < 0) {
1816             valid_router = i; /* valid but not known to be reachable */
1817           }
1818         }
1819       }
1820     }
1821   }
1822   if (valid_router >= 0) {
1823     return valid_router;
1824   }
1825 
1826   /* Look for any router for which we have any information at all. */
1827   /* last_router is used for round-robin selection of incomplete routers, as
1828    * recommended in RFC 4861 Sec. 6.3.6 point (2). Advance only when picking a
1829    * route, to select the same router as next-hop target in the common case. */
1830   if ((netif == NULL) && (++last_router >= LWIP_ND6_NUM_ROUTERS)) {
1831     last_router = 0;
1832   }
1833   i = last_router;
1834   for (j = 0; j < LWIP_ND6_NUM_ROUTERS; j++) {
1835     if (default_router_list[i].neighbor_entry != NULL) {
1836       router_netif = default_router_list[i].neighbor_entry->netif;
1837       if ((router_netif != NULL) && (netif != NULL ? netif == router_netif :
1838           (netif_is_up(router_netif) && netif_is_link_up(router_netif)))) {
1839         return i;
1840       }
1841     }
1842     if (++i >= LWIP_ND6_NUM_ROUTERS) {
1843       i = 0;
1844     }
1845   }
1846 
1847   /* no suitable router found. */
1848   return -1;
1849 }
1850 
1851 /**
1852  * Find a router-announced route to the given destination. This route may be
1853  * based on an on-link prefix or a default router.
1854  *
1855  * If a suitable route is found, the returned netif is guaranteed to be in a
1856  * suitable state (up, link up) to be used for packet transmission.
1857  *
1858  * @param ip6addr the destination IPv6 address
1859  * @return the netif to use for the destination, or NULL if none found
1860  */
1861 struct netif *
1862 nd6_find_route(const ip6_addr_t *ip6addr)
1863 {
1864   struct netif *netif;
1865   s8_t i;
1866 
1867   /* @todo decide if it makes sense to check the destination cache first */
1868 
1869   /* Check if there is a matching on-link prefix. There may be multiple
1870    * matches. Pick the first one that is associated with a suitable netif. */
1871   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; ++i) {
1872     netif = prefix_list[i].netif;
1873     if ((netif != NULL) && ip6_addr_netcmp(&prefix_list[i].prefix, ip6addr) &&
1874         netif_is_up(netif) && netif_is_link_up(netif)) {
1875       return netif;
1876     }
1877   }
1878 
1879   /* No on-link prefix match. Find a router that can forward the packet. */
1880   i = nd6_select_router(ip6addr, NULL);
1881   if (i >= 0) {
1882     LWIP_ASSERT("selected router must have a neighbor entry",
1883       default_router_list[i].neighbor_entry != NULL);
1884     return default_router_list[i].neighbor_entry->netif;
1885   }
1886 
1887   return NULL;
1888 }
1889 
1890 /**
1891  * Find an entry for a default router.
1892  *
1893  * @param router_addr the IPv6 address of the router
1894  * @param netif the netif on which the router is found, if known
1895  * @return the index of the router entry, or -1 if not found
1896  */
1897 static s8_t
1898 nd6_get_router(const ip6_addr_t *router_addr, struct netif *netif)
1899 {
1900   s8_t i;
1901 
1902   IP6_ADDR_ZONECHECK_NETIF(router_addr, netif);
1903 
1904   /* Look for router. */
1905   for (i = 0; i < LWIP_ND6_NUM_ROUTERS; i++) {
1906     if ((default_router_list[i].neighbor_entry != NULL) &&
1907         ((netif != NULL) ? netif == default_router_list[i].neighbor_entry->netif : 1) &&
1908         ip6_addr_cmp(router_addr, &(default_router_list[i].neighbor_entry->next_hop_address))) {
1909       return i;
1910     }
1911   }
1912 
1913   /* router not found. */
1914   return -1;
1915 }
1916 
1917 /**
1918  * Create a new entry for a default router.
1919  *
1920  * @param router_addr the IPv6 address of the router
1921  * @param netif the netif on which the router is connected, if known
1922  * @return the index on the router table, or -1 if could not be created
1923  */
1924 static s8_t
1925 nd6_new_router(const ip6_addr_t *router_addr, struct netif *netif)
1926 {
1927   s8_t router_index;
1928   s8_t free_router_index;
1929   s8_t neighbor_index;
1930 
1931   IP6_ADDR_ZONECHECK_NETIF(router_addr, netif);
1932 
1933   /* Do we have a neighbor entry for this router? */
1934   neighbor_index = nd6_find_neighbor_cache_entry(router_addr);
1935   if (neighbor_index < 0) {
1936     /* Create a neighbor entry for this router. */
1937     neighbor_index = nd6_new_neighbor_cache_entry();
1938     if (neighbor_index < 0) {
1939       /* Could not create neighbor entry for this router. */
1940       return -1;
1941     }
1942     ip6_addr_set(&(neighbor_cache[neighbor_index].next_hop_address), router_addr);
1943     neighbor_cache[neighbor_index].netif = netif;
1944     neighbor_cache[neighbor_index].q = NULL;
1945     neighbor_cache[neighbor_index].state = ND6_INCOMPLETE;
1946     neighbor_cache[neighbor_index].counter.probes_sent = 1;
1947     nd6_send_neighbor_cache_probe(&neighbor_cache[neighbor_index], ND6_SEND_FLAG_MULTICAST_DEST);
1948   }
1949 
1950   /* Mark neighbor as router. */
1951   neighbor_cache[neighbor_index].isrouter = 1;
1952 
1953   /* Look for empty entry. */
1954   free_router_index = LWIP_ND6_NUM_ROUTERS;
1955   for (router_index = LWIP_ND6_NUM_ROUTERS - 1; router_index >= 0; router_index--) {
1956     /* check if router already exists (this is a special case for 2 netifs on the same subnet
1957        - e.g. wifi and cable) */
1958     if(default_router_list[router_index].neighbor_entry == &(neighbor_cache[neighbor_index])){
1959       return router_index;
1960     }
1961     if (default_router_list[router_index].neighbor_entry == NULL) {
1962       /* remember lowest free index to create a new entry */
1963       free_router_index = router_index;
1964     }
1965   }
1966   if (free_router_index < LWIP_ND6_NUM_ROUTERS) {
1967     default_router_list[free_router_index].neighbor_entry = &(neighbor_cache[neighbor_index]);
1968     return free_router_index;
1969   }
1970 
1971   /* Could not create a router entry. */
1972 
1973   /* Mark neighbor entry as not-router. Entry might be useful as neighbor still. */
1974   neighbor_cache[neighbor_index].isrouter = 0;
1975 
1976   /* router not found. */
1977   return -1;
1978 }
1979 
1980 /**
1981  * Find the cached entry for an on-link prefix.
1982  *
1983  * @param prefix the IPv6 prefix that is on-link
1984  * @param netif the netif on which the prefix is on-link
1985  * @return the index on the prefix table, or -1 if not found
1986  */
1987 static s8_t
1988 nd6_get_onlink_prefix(const ip6_addr_t *prefix, struct netif *netif)
1989 {
1990   s8_t i;
1991 
1992   /* Look for prefix in list. */
1993   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; ++i) {
1994     if ((ip6_addr_netcmp(&(prefix_list[i].prefix), prefix)) &&
1995         (prefix_list[i].netif == netif)) {
1996       return i;
1997     }
1998   }
1999 
2000   /* Entry not available. */
2001   return -1;
2002 }
2003 
2004 /**
2005  * Creates a new entry for an on-link prefix.
2006  *
2007  * @param prefix the IPv6 prefix that is on-link
2008  * @param netif the netif on which the prefix is on-link
2009  * @return the index on the prefix table, or -1 if not created
2010  */
2011 static s8_t
2012 nd6_new_onlink_prefix(const ip6_addr_t *prefix, struct netif *netif)
2013 {
2014   s8_t i;
2015 
2016   /* Create new entry. */
2017   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; ++i) {
2018     if ((prefix_list[i].netif == NULL) ||
2019         (prefix_list[i].invalidation_timer == 0)) {
2020       /* Found empty prefix entry. */
2021       prefix_list[i].netif = netif;
2022       ip6_addr_set(&(prefix_list[i].prefix), prefix);
2023       return i;
2024     }
2025   }
2026 
2027   /* Entry not available. */
2028   return -1;
2029 }
2030 
2031 /**
2032  * Determine the next hop for a destination. Will determine if the
2033  * destination is on-link, else a suitable on-link router is selected.
2034  *
2035  * The last entry index is cached for fast entry search.
2036  *
2037  * @param ip6addr the destination address
2038  * @param netif the netif on which the packet will be sent
2039  * @return the neighbor cache entry for the next hop, ERR_RTE if no
2040  *         suitable next hop was found, ERR_MEM if no cache entry
2041  *         could be created
2042  */
2043 static s8_t
2044 nd6_get_next_hop_entry(const ip6_addr_t *ip6addr, struct netif *netif)
2045 {
2046 #ifdef LWIP_HOOK_ND6_GET_GW
2047   const ip6_addr_t *next_hop_addr;
2048 #endif /* LWIP_HOOK_ND6_GET_GW */
2049   s8_t i;
2050   s16_t dst_idx;
2051 
2052   IP6_ADDR_ZONECHECK_NETIF(ip6addr, netif);
2053 
2054 #if LWIP_NETIF_HWADDRHINT
2055   if (netif->hints != NULL) {
2056     /* per-pcb cached entry was given */
2057     netif_addr_idx_t addr_hint = netif->hints->addr_hint;
2058     if (addr_hint < LWIP_ND6_NUM_DESTINATIONS) {
2059       nd6_cached_destination_index = addr_hint;
2060     }
2061   }
2062 #endif /* LWIP_NETIF_HWADDRHINT */
2063 
2064   /* Look for ip6addr in destination cache. */
2065   if (ip6_addr_cmp(ip6addr, &(destination_cache[nd6_cached_destination_index].destination_addr))) {
2066     /* the cached entry index is the right one! */
2067     /* do nothing. */
2068     ND6_STATS_INC(nd6.cachehit);
2069   } else {
2070     /* Search destination cache. */
2071     dst_idx = nd6_find_destination_cache_entry(ip6addr);
2072     if (dst_idx >= 0) {
2073       /* found destination entry. make it our new cached index. */
2074       LWIP_ASSERT("type overflow", (size_t)dst_idx < NETIF_ADDR_IDX_MAX);
2075       nd6_cached_destination_index = (netif_addr_idx_t)dst_idx;
2076     } else {
2077       /* Not found. Create a new destination entry. */
2078       dst_idx = nd6_new_destination_cache_entry();
2079       if (dst_idx >= 0) {
2080         /* got new destination entry. make it our new cached index. */
2081         LWIP_ASSERT("type overflow", (size_t)dst_idx < NETIF_ADDR_IDX_MAX);
2082         nd6_cached_destination_index = (netif_addr_idx_t)dst_idx;
2083       } else {
2084         /* Could not create a destination cache entry. */
2085         return ERR_MEM;
2086       }
2087 
2088       /* Copy dest address to destination cache. */
2089       ip6_addr_set(&(destination_cache[nd6_cached_destination_index].destination_addr), ip6addr);
2090 
2091       /* Now find the next hop. is it a neighbor? */
2092       if (ip6_addr_islinklocal(ip6addr) ||
2093           nd6_is_prefix_in_netif(ip6addr, netif)) {
2094         /* Destination in local link. */
2095         destination_cache[nd6_cached_destination_index].pmtu = netif_mtu6(netif);
2096         ip6_addr_copy(destination_cache[nd6_cached_destination_index].next_hop_addr, destination_cache[nd6_cached_destination_index].destination_addr);
2097 #ifdef LWIP_HOOK_ND6_GET_GW
2098       } else if ((next_hop_addr = LWIP_HOOK_ND6_GET_GW(netif, ip6addr)) != NULL) {
2099         /* Next hop for destination provided by hook function. */
2100         destination_cache[nd6_cached_destination_index].pmtu = netif->mtu;
2101         ip6_addr_set(&destination_cache[nd6_cached_destination_index].next_hop_addr, next_hop_addr);
2102 #endif /* LWIP_HOOK_ND6_GET_GW */
2103       } else {
2104         /* We need to select a router. */
2105         i = nd6_select_router(ip6addr, netif);
2106         if (i < 0) {
2107           /* No router found. */
2108           ip6_addr_set_any(&(destination_cache[nd6_cached_destination_index].destination_addr));
2109           return ERR_RTE;
2110         }
2111         destination_cache[nd6_cached_destination_index].pmtu = netif_mtu6(netif); /* Start with netif mtu, correct through ICMPv6 if necessary */
2112         ip6_addr_copy(destination_cache[nd6_cached_destination_index].next_hop_addr, default_router_list[i].neighbor_entry->next_hop_address);
2113       }
2114     }
2115   }
2116 
2117 #if LWIP_NETIF_HWADDRHINT
2118   if (netif->hints != NULL) {
2119     /* per-pcb cached entry was given */
2120     netif->hints->addr_hint = nd6_cached_destination_index;
2121   }
2122 #endif /* LWIP_NETIF_HWADDRHINT */
2123 
2124   /* Look in neighbor cache for the next-hop address. */
2125   if (ip6_addr_cmp(&(destination_cache[nd6_cached_destination_index].next_hop_addr),
2126                    &(neighbor_cache[nd6_cached_neighbor_index].next_hop_address))) {
2127     /* Cache hit. */
2128     /* Do nothing. */
2129     ND6_STATS_INC(nd6.cachehit);
2130   } else {
2131     i = nd6_find_neighbor_cache_entry(&(destination_cache[nd6_cached_destination_index].next_hop_addr));
2132     if (i >= 0) {
2133       /* Found a matching record, make it new cached entry. */
2134       nd6_cached_neighbor_index = i;
2135     } else {
2136       /* Neighbor not in cache. Make a new entry. */
2137       i = nd6_new_neighbor_cache_entry();
2138       if (i >= 0) {
2139         /* got new neighbor entry. make it our new cached index. */
2140         nd6_cached_neighbor_index = i;
2141       } else {
2142         /* Could not create a neighbor cache entry. */
2143         return ERR_MEM;
2144       }
2145 
2146       /* Initialize fields. */
2147       ip6_addr_copy(neighbor_cache[i].next_hop_address,
2148                    destination_cache[nd6_cached_destination_index].next_hop_addr);
2149       neighbor_cache[i].isrouter = 0;
2150       neighbor_cache[i].netif = netif;
2151       neighbor_cache[i].state = ND6_INCOMPLETE;
2152       neighbor_cache[i].counter.probes_sent = 1;
2153       nd6_send_neighbor_cache_probe(&neighbor_cache[i], ND6_SEND_FLAG_MULTICAST_DEST);
2154     }
2155   }
2156 
2157   /* Reset this destination's age. */
2158   destination_cache[nd6_cached_destination_index].age = 0;
2159 
2160   return nd6_cached_neighbor_index;
2161 }
2162 
2163 /**
2164  * Queue a packet for a neighbor.
2165  *
2166  * @param neighbor_index the index in the neighbor cache table
2167  * @param q packet to be queued
2168  * @return ERR_OK if succeeded, ERR_MEM if out of memory
2169  */
2170 static err_t
2171 nd6_queue_packet(s8_t neighbor_index, struct pbuf *q)
2172 {
2173   err_t result = ERR_MEM;
2174   struct pbuf *p;
2175   int copy_needed = 0;
2176 #if LWIP_ND6_QUEUEING
2177   struct nd6_q_entry *new_entry, *r;
2178 #endif /* LWIP_ND6_QUEUEING */
2179 
2180   if ((neighbor_index < 0) || (neighbor_index >= LWIP_ND6_NUM_NEIGHBORS)) {
2181     return ERR_ARG;
2182   }
2183 
2184   /* IF q includes a pbuf that must be copied, we have to copy the whole chain
2185    * into a new PBUF_RAM. See the definition of PBUF_NEEDS_COPY for details. */
2186   p = q;
2187   while (p) {
2188     if (PBUF_NEEDS_COPY(p)) {
2189       copy_needed = 1;
2190       break;
2191     }
2192     p = p->next;
2193   }
2194   if (copy_needed) {
2195     /* copy the whole packet into new pbufs */
2196     p = pbuf_clone(PBUF_LINK, PBUF_RAM, q);
2197     while ((p == NULL) && (neighbor_cache[neighbor_index].q != NULL)) {
2198       /* Free oldest packet (as per RFC recommendation) */
2199 #if LWIP_ND6_QUEUEING
2200       r = neighbor_cache[neighbor_index].q;
2201       neighbor_cache[neighbor_index].q = r->next;
2202       r->next = NULL;
2203       nd6_free_q(r);
2204 #else /* LWIP_ND6_QUEUEING */
2205       pbuf_free(neighbor_cache[neighbor_index].q);
2206       neighbor_cache[neighbor_index].q = NULL;
2207 #endif /* LWIP_ND6_QUEUEING */
2208       p = pbuf_clone(PBUF_LINK, PBUF_RAM, q);
2209     }
2210   } else {
2211     /* referencing the old pbuf is enough */
2212     p = q;
2213     pbuf_ref(p);
2214   }
2215   /* packet was copied/ref'd? */
2216   if (p != NULL) {
2217     /* queue packet ... */
2218 #if LWIP_ND6_QUEUEING
2219     /* allocate a new nd6 queue entry */
2220     new_entry = (struct nd6_q_entry *)memp_malloc(MEMP_ND6_QUEUE);
2221     if ((new_entry == NULL) && (neighbor_cache[neighbor_index].q != NULL)) {
2222       /* Free oldest packet (as per RFC recommendation) */
2223       r = neighbor_cache[neighbor_index].q;
2224       neighbor_cache[neighbor_index].q = r->next;
2225       r->next = NULL;
2226       nd6_free_q(r);
2227       new_entry = (struct nd6_q_entry *)memp_malloc(MEMP_ND6_QUEUE);
2228     }
2229     if (new_entry != NULL) {
2230       new_entry->next = NULL;
2231       new_entry->p = p;
2232       if (neighbor_cache[neighbor_index].q != NULL) {
2233         /* queue was already existent, append the new entry to the end */
2234         r = neighbor_cache[neighbor_index].q;
2235         while (r->next != NULL) {
2236           r = r->next;
2237         }
2238         r->next = new_entry;
2239       } else {
2240         /* queue did not exist, first item in queue */
2241         neighbor_cache[neighbor_index].q = new_entry;
2242       }
2243       LWIP_DEBUGF(LWIP_DBG_TRACE, ("ipv6: queued packet %p on neighbor entry %"S16_F"\n", (void *)p, (s16_t)neighbor_index));
2244       result = ERR_OK;
2245     } else {
2246       /* the pool MEMP_ND6_QUEUE is empty */
2247       pbuf_free(p);
2248       LWIP_DEBUGF(LWIP_DBG_TRACE, ("ipv6: could not queue a copy of packet %p (out of memory)\n", (void *)p));
2249       /* { result == ERR_MEM } through initialization */
2250     }
2251 #else /* LWIP_ND6_QUEUEING */
2252     /* Queue a single packet. If an older packet is already queued, free it as per RFC. */
2253     if (neighbor_cache[neighbor_index].q != NULL) {
2254       pbuf_free(neighbor_cache[neighbor_index].q);
2255     }
2256     neighbor_cache[neighbor_index].q = p;
2257     LWIP_DEBUGF(LWIP_DBG_TRACE, ("ipv6: queued packet %p on neighbor entry %"S16_F"\n", (void *)p, (s16_t)neighbor_index));
2258     result = ERR_OK;
2259 #endif /* LWIP_ND6_QUEUEING */
2260   } else {
2261     LWIP_DEBUGF(LWIP_DBG_TRACE, ("ipv6: could not queue a copy of packet %p (out of memory)\n", (void *)q));
2262     /* { result == ERR_MEM } through initialization */
2263   }
2264 
2265   return result;
2266 }
2267 
2268 #if LWIP_ND6_QUEUEING
2269 /**
2270  * Free a complete queue of nd6 q entries
2271  *
2272  * @param q a queue of nd6_q_entry to free
2273  */
2274 static void
2275 nd6_free_q(struct nd6_q_entry *q)
2276 {
2277   struct nd6_q_entry *r;
2278   LWIP_ASSERT("q != NULL", q != NULL);
2279   LWIP_ASSERT("q->p != NULL", q->p != NULL);
2280   while (q) {
2281     r = q;
2282     q = q->next;
2283     LWIP_ASSERT("r->p != NULL", (r->p != NULL));
2284     pbuf_free(r->p);
2285     memp_free(MEMP_ND6_QUEUE, r);
2286   }
2287 }
2288 #endif /* LWIP_ND6_QUEUEING */
2289 
2290 /**
2291  * Send queued packets for a neighbor
2292  *
2293  * @param i the neighbor to send packets to
2294  */
2295 static void
2296 nd6_send_q(s8_t i)
2297 {
2298   struct ip6_hdr *ip6hdr;
2299   ip6_addr_t dest;
2300 #if LWIP_ND6_QUEUEING
2301   struct nd6_q_entry *q;
2302 #endif /* LWIP_ND6_QUEUEING */
2303 
2304   if ((i < 0) || (i >= LWIP_ND6_NUM_NEIGHBORS)) {
2305     return;
2306   }
2307 
2308 #if LWIP_ND6_QUEUEING
2309   while (neighbor_cache[i].q != NULL) {
2310     /* remember first in queue */
2311     q = neighbor_cache[i].q;
2312     /* pop first item off the queue */
2313     neighbor_cache[i].q = q->next;
2314     /* Get ipv6 header. */
2315     ip6hdr = (struct ip6_hdr *)(q->p->payload);
2316     /* Create an aligned copy. */
2317     ip6_addr_copy_from_packed(dest, ip6hdr->dest);
2318     /* Restore the zone, if applicable. */
2319     ip6_addr_assign_zone(&dest, IP6_UNKNOWN, neighbor_cache[i].netif);
2320     /* send the queued IPv6 packet */
2321     (neighbor_cache[i].netif)->output_ip6(neighbor_cache[i].netif, q->p, &dest);
2322     /* free the queued IP packet */
2323     pbuf_free(q->p);
2324     /* now queue entry can be freed */
2325     memp_free(MEMP_ND6_QUEUE, q);
2326   }
2327 #else /* LWIP_ND6_QUEUEING */
2328   if (neighbor_cache[i].q != NULL) {
2329     /* Get ipv6 header. */
2330     ip6hdr = (struct ip6_hdr *)(neighbor_cache[i].q->payload);
2331     /* Create an aligned copy. */
2332     ip6_addr_copy_from_packed(dest, ip6hdr->dest);
2333     /* Restore the zone, if applicable. */
2334     ip6_addr_assign_zone(&dest, IP6_UNKNOWN, neighbor_cache[i].netif);
2335     /* send the queued IPv6 packet */
2336     (neighbor_cache[i].netif)->output_ip6(neighbor_cache[i].netif, neighbor_cache[i].q, &dest);
2337     /* free the queued IP packet */
2338     pbuf_free(neighbor_cache[i].q);
2339     neighbor_cache[i].q = NULL;
2340   }
2341 #endif /* LWIP_ND6_QUEUEING */
2342 }
2343 
2344 /**
2345  * A packet is to be transmitted to a specific IPv6 destination on a specific
2346  * interface. Check if we can find the hardware address of the next hop to use
2347  * for the packet. If so, give the hardware address to the caller, which should
2348  * use it to send the packet right away. Otherwise, enqueue the packet for
2349  * later transmission while looking up the hardware address, if possible.
2350  *
2351  * As such, this function returns one of three different possible results:
2352  *
2353  * - ERR_OK with a non-NULL 'hwaddrp': the caller should send the packet now.
2354  * - ERR_OK with a NULL 'hwaddrp': the packet has been enqueued for later.
2355  * - not ERR_OK: something went wrong; forward the error upward in the stack.
2356  *
2357  * @param netif The lwIP network interface on which the IP packet will be sent.
2358  * @param q The pbuf(s) containing the IP packet to be sent.
2359  * @param ip6addr The destination IPv6 address of the packet.
2360  * @param hwaddrp On success, filled with a pointer to a HW address or NULL (meaning
2361  *        the packet has been queued).
2362  * @return
2363  * - ERR_OK on success, ERR_RTE if no route was found for the packet,
2364  * or ERR_MEM if low memory conditions prohibit sending the packet at all.
2365  */
2366 err_t
2367 nd6_get_next_hop_addr_or_queue(struct netif *netif, struct pbuf *q, const ip6_addr_t *ip6addr, const u8_t **hwaddrp)
2368 {
2369   s8_t i;
2370 
2371   /* Get next hop record. */
2372   i = nd6_get_next_hop_entry(ip6addr, netif);
2373   if (i < 0) {
2374     /* failed to get a next hop neighbor record. */
2375     return i;
2376   }
2377 
2378   /* Now that we have a destination record, send or queue the packet. */
2379   if (neighbor_cache[i].state == ND6_STALE) {
2380     /* Switch to delay state. */
2381     neighbor_cache[i].state = ND6_DELAY;
2382     neighbor_cache[i].counter.delay_time = LWIP_ND6_DELAY_FIRST_PROBE_TIME / ND6_TMR_INTERVAL;
2383   }
2384   /* @todo should we send or queue if PROBE? send for now, to let unicast NS pass. */
2385   if ((neighbor_cache[i].state == ND6_REACHABLE) ||
2386       (neighbor_cache[i].state == ND6_DELAY) ||
2387       (neighbor_cache[i].state == ND6_PROBE)) {
2388 
2389     /* Tell the caller to send out the packet now. */
2390     *hwaddrp = neighbor_cache[i].lladdr;
2391     return ERR_OK;
2392   }
2393 
2394   /* We should queue packet on this interface. */
2395   *hwaddrp = NULL;
2396   return nd6_queue_packet(i, q);
2397 }
2398 
2399 
2400 /**
2401  * Get the Path MTU for a destination.
2402  *
2403  * @param ip6addr the destination address
2404  * @param netif the netif on which the packet will be sent
2405  * @return the Path MTU, if known, or the netif default MTU
2406  */
2407 u16_t
2408 nd6_get_destination_mtu(const ip6_addr_t *ip6addr, struct netif *netif)
2409 {
2410   s16_t i;
2411 
2412   i = nd6_find_destination_cache_entry(ip6addr);
2413   if (i >= 0) {
2414     if (destination_cache[i].pmtu > 0) {
2415       return destination_cache[i].pmtu;
2416     }
2417   }
2418 
2419   if (netif != NULL) {
2420     return netif_mtu6(netif);
2421   }
2422 
2423   return IP6_MIN_MTU_LENGTH; /* Minimum MTU */
2424 }
2425 
2426 
2427 #if LWIP_ND6_TCP_REACHABILITY_HINTS
2428 /**
2429  * Provide the Neighbor discovery process with a hint that a
2430  * destination is reachable. Called by tcp_receive when ACKs are
2431  * received or sent (as per RFC). This is useful to avoid sending
2432  * NS messages every 30 seconds.
2433  *
2434  * @param ip6addr the destination address which is know to be reachable
2435  *                by an upper layer protocol (TCP)
2436  */
2437 void
2438 nd6_reachability_hint(const ip6_addr_t *ip6addr)
2439 {
2440   s8_t i;
2441   s16_t dst_idx;
2442 
2443   /* Find destination in cache. */
2444   if (ip6_addr_cmp(ip6addr, &(destination_cache[nd6_cached_destination_index].destination_addr))) {
2445     dst_idx = nd6_cached_destination_index;
2446     ND6_STATS_INC(nd6.cachehit);
2447   } else {
2448     dst_idx = nd6_find_destination_cache_entry(ip6addr);
2449   }
2450   if (dst_idx < 0) {
2451     return;
2452   }
2453 
2454   /* Find next hop neighbor in cache. */
2455   if (ip6_addr_cmp(&(destination_cache[dst_idx].next_hop_addr), &(neighbor_cache[nd6_cached_neighbor_index].next_hop_address))) {
2456     i = nd6_cached_neighbor_index;
2457     ND6_STATS_INC(nd6.cachehit);
2458   } else {
2459     i = nd6_find_neighbor_cache_entry(&(destination_cache[dst_idx].next_hop_addr));
2460   }
2461   if (i < 0) {
2462     return;
2463   }
2464 
2465   /* For safety: don't set as reachable if we don't have a LL address yet. Misuse protection. */
2466   if (neighbor_cache[i].state == ND6_INCOMPLETE || neighbor_cache[i].state == ND6_NO_ENTRY) {
2467     return;
2468   }
2469 
2470   /* Set reachability state. */
2471   neighbor_cache[i].state = ND6_REACHABLE;
2472   neighbor_cache[i].counter.reachable_time = reachable_time;
2473 }
2474 #endif /* LWIP_ND6_TCP_REACHABILITY_HINTS */
2475 
2476 /**
2477  * Remove all prefix, neighbor_cache and router entries of the specified netif.
2478  *
2479  * @param netif points to a network interface
2480  */
2481 void
2482 nd6_cleanup_netif(struct netif *netif)
2483 {
2484   u8_t i;
2485   s8_t router_index;
2486   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; i++) {
2487     if (prefix_list[i].netif == netif) {
2488       prefix_list[i].netif = NULL;
2489     }
2490   }
2491   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
2492     if (neighbor_cache[i].netif == netif) {
2493       for (router_index = 0; router_index < LWIP_ND6_NUM_ROUTERS; router_index++) {
2494         if (default_router_list[router_index].neighbor_entry == &neighbor_cache[i]) {
2495           default_router_list[router_index].neighbor_entry = NULL;
2496           default_router_list[router_index].flags = 0;
2497         }
2498       }
2499       neighbor_cache[i].isrouter = 0;
2500       nd6_free_neighbor_cache_entry(i);
2501     }
2502   }
2503   /* Clear the destination cache, since many entries may now have become
2504    * invalid for one of several reasons. As destination cache entries have no
2505    * netif association, use a sledgehammer approach (this can be improved). */
2506   nd6_clear_destination_cache();
2507 }
2508 
2509 #if LWIP_IPV6_MLD
2510 /**
2511  * The state of a local IPv6 address entry is about to change. If needed, join
2512  * or leave the solicited-node multicast group for the address.
2513  *
2514  * @param netif The netif that owns the address.
2515  * @param addr_idx The index of the address.
2516  * @param new_state The new (IP6_ADDR_) state for the address.
2517  */
2518 void
2519 nd6_adjust_mld_membership(struct netif *netif, s8_t addr_idx, u8_t new_state)
2520 {
2521   u8_t old_state, old_member, new_member;
2522 
2523   old_state = netif_ip6_addr_state(netif, addr_idx);
2524 
2525   /* Determine whether we were, and should be, a member of the solicited-node
2526    * multicast group for this address. For tentative addresses, the group is
2527    * not joined until the address enters the TENTATIVE_1 (or VALID) state. */
2528   old_member = (old_state != IP6_ADDR_INVALID && old_state != IP6_ADDR_DUPLICATED && old_state != IP6_ADDR_TENTATIVE);
2529   new_member = (new_state != IP6_ADDR_INVALID && new_state != IP6_ADDR_DUPLICATED && new_state != IP6_ADDR_TENTATIVE);
2530 
2531   if (old_member != new_member) {
2532     ip6_addr_set_solicitednode(&multicast_address, netif_ip6_addr(netif, addr_idx)->addr[3]);
2533     ip6_addr_assign_zone(&multicast_address, IP6_MULTICAST, netif);
2534 
2535     if (new_member) {
2536       mld6_joingroup_netif(netif, &multicast_address);
2537     } else {
2538       mld6_leavegroup_netif(netif, &multicast_address);
2539     }
2540   }
2541 }
2542 #endif /* LWIP_IPV6_MLD */
2543 
2544 /** Netif was added, set up, or reconnected (link up) */
2545 void
2546 nd6_restart_netif(struct netif *netif)
2547 {
2548 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
2549   /* Send Router Solicitation messages (see RFC 4861, ch. 6.3.7). */
2550   netif->rs_count = LWIP_ND6_MAX_MULTICAST_SOLICIT;
2551 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
2552 }
2553 
2554 #endif /* LWIP_IPV6 */
2555