• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /**
2  * @file
3  *
4  * Neighbor discovery and stateless address autoconfiguration for IPv6.
5  * Aims to be compliant with RFC 4861 (Neighbor discovery) and RFC 4862
6  * (Address autoconfiguration).
7  */
8 
9 /*
10  * Copyright (c) 2010 Inico Technologies Ltd.
11  * All rights reserved.
12  *
13  * Redistribution and use in source and binary forms, with or without modification,
14  * are permitted provided that the following conditions are met:
15  *
16  * 1. Redistributions of source code must retain the above copyright notice,
17  *    this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright notice,
19  *    this list of conditions and the following disclaimer in the documentation
20  *    and/or other materials provided with the distribution.
21  * 3. The name of the author may not be used to endorse or promote products
22  *    derived from this software without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
25  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
26  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
27  * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
28  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
29  * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
32  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
33  * OF SUCH DAMAGE.
34  *
35  * This file is part of the lwIP TCP/IP stack.
36  *
37  * Author: Ivan Delamer <delamer@inicotech.com>
38  *
39  *
40  * Please coordinate changes and requests with Ivan Delamer
41  * <delamer@inicotech.com>
42  */
43 
44 #include "lwip/opt.h"
45 
46 #if LWIP_IPV6  /* don't build if not configured for use in lwipopts.h */
47 
48 #include "lwip/nd6.h"
49 #include "lwip/priv/nd6_priv.h"
50 #include "lwip/prot/nd6.h"
51 #include "lwip/prot/icmp6.h"
52 #include "lwip/pbuf.h"
53 #include "lwip/mem.h"
54 #include "lwip/memp.h"
55 #include "lwip/ip6.h"
56 #include "lwip/ip6_addr.h"
57 #include "lwip/inet_chksum.h"
58 #include "lwip/netif.h"
59 #include "lwip/icmp6.h"
60 #include "lwip/mld6.h"
61 #include "lwip/dhcp6.h"
62 #include "lwip/ip.h"
63 #include "lwip/stats.h"
64 #include "lwip/dns.h"
65 
66 #include <string.h>
67 
68 #ifdef LWIP_HOOK_FILENAME
69 #include LWIP_HOOK_FILENAME
70 #endif
71 
72 #if LWIP_IPV6_DUP_DETECT_ATTEMPTS > IP6_ADDR_TENTATIVE_COUNT_MASK
73 #error LWIP_IPV6_DUP_DETECT_ATTEMPTS > IP6_ADDR_TENTATIVE_COUNT_MASK
74 #endif
75 #if LWIP_ND6_NUM_NEIGHBORS > 127
76 #error LWIP_ND6_NUM_NEIGHBORS must fit into an s8_t (max value: 127)
77 #endif
78 #if LWIP_ND6_NUM_DESTINATIONS > 32767
79 #error LWIP_ND6_NUM_DESTINATIONS must fit into an s16_t (max value: 32767)
80 #endif
81 #if LWIP_ND6_NUM_PREFIXES > 127
82 #error LWIP_ND6_NUM_PREFIXES must fit into an s8_t (max value: 127)
83 #endif
84 #if LWIP_ND6_NUM_ROUTERS > 127
85 #error LWIP_ND6_NUM_ROUTERS must fit into an s8_t (max value: 127)
86 #endif
87 
88 /* Router tables. */
89 struct nd6_neighbor_cache_entry neighbor_cache[LWIP_ND6_NUM_NEIGHBORS];
90 struct nd6_destination_cache_entry destination_cache[LWIP_ND6_NUM_DESTINATIONS];
91 struct nd6_prefix_list_entry prefix_list[LWIP_ND6_NUM_PREFIXES];
92 struct nd6_router_list_entry default_router_list[LWIP_ND6_NUM_ROUTERS];
93 
94 /* Default values, can be updated by a RA message. */
95 u32_t reachable_time = LWIP_ND6_REACHABLE_TIME;
96 u32_t retrans_timer = LWIP_ND6_RETRANS_TIMER; /* @todo implement this value in timer */
97 
98 #if LWIP_ND6_QUEUEING
99 static u8_t nd6_queue_size = 0;
100 #endif
101 
102 /* Index for cache entries. */
103 static netif_addr_idx_t nd6_cached_destination_index;
104 
105 /* Multicast address holder. */
106 static ip6_addr_t multicast_address;
107 
108 static u8_t nd6_tmr_rs_reduction;
109 
110 /* Static buffer to parse RA packet options */
111 union ra_options {
112   struct lladdr_option  lladdr;
113   struct mtu_option     mtu;
114   struct prefix_option  prefix;
115 #if LWIP_ND6_RDNSS_MAX_DNS_SERVERS
116   struct rdnss_option   rdnss;
117 #endif
118 };
119 static union ra_options nd6_ra_buffer;
120 
121 /* Forward declarations. */
122 static s8_t nd6_find_neighbor_cache_entry(const ip6_addr_t *ip6addr);
123 static s8_t nd6_new_neighbor_cache_entry(void);
124 static void nd6_free_neighbor_cache_entry(s8_t i);
125 static s16_t nd6_find_destination_cache_entry(const ip6_addr_t *ip6addr);
126 static s16_t nd6_new_destination_cache_entry(void);
127 static int nd6_is_prefix_in_netif(const ip6_addr_t *ip6addr, struct netif *netif);
128 static s8_t nd6_select_router(const ip6_addr_t *ip6addr, struct netif *netif);
129 static s8_t nd6_get_router(const ip6_addr_t *router_addr, struct netif *netif);
130 static s8_t nd6_new_router(const ip6_addr_t *router_addr, struct netif *netif);
131 static s8_t nd6_get_onlink_prefix(const ip6_addr_t *prefix, struct netif *netif);
132 static s8_t nd6_new_onlink_prefix(const ip6_addr_t *prefix, struct netif *netif);
133 static s8_t nd6_get_next_hop_entry(const ip6_addr_t *ip6addr, struct netif *netif);
134 static err_t nd6_queue_packet(s8_t neighbor_index, struct pbuf *q);
135 
136 #define ND6_SEND_FLAG_MULTICAST_DEST 0x01
137 #define ND6_SEND_FLAG_ALLNODES_DEST 0x02
138 #define ND6_SEND_FLAG_ANY_SRC 0x04
139 static void nd6_send_ns(struct netif *netif, const ip6_addr_t *target_addr, u8_t flags);
140 static void nd6_send_na(struct netif *netif, const ip6_addr_t *target_addr, u8_t flags);
141 static void nd6_send_neighbor_cache_probe(struct nd6_neighbor_cache_entry *entry, u8_t flags);
142 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
143 static err_t nd6_send_rs(struct netif *netif);
144 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
145 
146 #if LWIP_ND6_QUEUEING
147 static void nd6_free_q(struct nd6_q_entry *q);
148 #else /* LWIP_ND6_QUEUEING */
149 #define nd6_free_q(q) pbuf_free(q)
150 #endif /* LWIP_ND6_QUEUEING */
151 static void nd6_send_q(s8_t i);
152 
153 
154 /**
155  * A local address has been determined to be a duplicate. Take the appropriate
156  * action(s) on the address and the interface as a whole.
157  *
158  * @param netif the netif that owns the address
159  * @param addr_idx the index of the address detected to be a duplicate
160  */
161 static void
nd6_duplicate_addr_detected(struct netif * netif,s8_t addr_idx)162 nd6_duplicate_addr_detected(struct netif *netif, s8_t addr_idx)
163 {
164 
165   /* Mark the address as duplicate, but leave its lifetimes alone. If this was
166    * a manually assigned address, it will remain in existence as duplicate, and
167    * as such be unusable for any practical purposes until manual intervention.
168    * If this was an autogenerated address, the address will follow normal
169    * expiration rules, and thus disappear once its valid lifetime expires. */
170   netif_ip6_addr_set_state(netif, addr_idx, IP6_ADDR_DUPLICATED);
171 
172 #if LWIP_IPV6_AUTOCONFIG
173   /* If the affected address was the link-local address that we use to generate
174    * all other addresses, then we should not continue to use those derived
175    * addresses either, so mark them as duplicate as well. For autoconfig-only
176    * setups, this will make the interface effectively unusable, approaching the
177    * intention of RFC 4862 Sec. 5.4.5. @todo implement the full requirements */
178   if (addr_idx == 0) {
179     s8_t i;
180     for (i = 1; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
181       if (!ip6_addr_isinvalid(netif_ip6_addr_state(netif, i)) &&
182           !netif_ip6_addr_isstatic(netif, i)) {
183         netif_ip6_addr_set_state(netif, i, IP6_ADDR_DUPLICATED);
184       }
185     }
186   }
187 #endif /* LWIP_IPV6_AUTOCONFIG */
188 }
189 
190 #if LWIP_IPV6_AUTOCONFIG
191 /**
192  * We received a router advertisement that contains a prefix with the
193  * autoconfiguration flag set. Add or update an associated autogenerated
194  * address.
195  *
196  * @param netif the netif on which the router advertisement arrived
197  * @param prefix_opt a pointer to the prefix option data
198  * @param prefix_addr an aligned copy of the prefix address
199  */
200 static void
nd6_process_autoconfig_prefix(struct netif * netif,struct prefix_option * prefix_opt,const ip6_addr_t * prefix_addr)201 nd6_process_autoconfig_prefix(struct netif *netif,
202   struct prefix_option *prefix_opt, const ip6_addr_t *prefix_addr)
203 {
204   ip6_addr_t ip6addr;
205   u32_t valid_life, pref_life;
206   u8_t addr_state;
207   s8_t i, free_idx;
208 
209   /* The caller already checks RFC 4862 Sec. 5.5.3 points (a) and (b). We do
210    * the rest, starting with checks for (c) and (d) here. */
211   valid_life = lwip_htonl(prefix_opt->valid_lifetime);
212   pref_life = lwip_htonl(prefix_opt->preferred_lifetime);
213   if (pref_life > valid_life || prefix_opt->prefix_length != 64) {
214     return; /* silently ignore this prefix for autoconfiguration purposes */
215   }
216 
217   /* If an autogenerated address already exists for this prefix, update its
218    * lifetimes. An address is considered autogenerated if 1) it is not static
219    * (i.e., manually assigned), and 2) there is an advertised autoconfiguration
220    * prefix for it (the one we are processing here). This does not necessarily
221    * exclude the possibility that the address was actually assigned by, say,
222    * DHCPv6. If that distinction becomes important in the future, more state
223    * must be kept. As explained elsewhere we also update lifetimes of tentative
224    * and duplicate addresses. Skip address slot 0 (the link-local address). */
225   for (i = 1; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
226     addr_state = netif_ip6_addr_state(netif, i);
227     if (!ip6_addr_isinvalid(addr_state) && !netif_ip6_addr_isstatic(netif, i) &&
228         ip6_addr_net_eq(prefix_addr, netif_ip6_addr(netif, i))) {
229       /* Update the valid lifetime, as per RFC 4862 Sec. 5.5.3 point (e).
230        * The valid lifetime will never drop to zero as a result of this. */
231       u32_t remaining_life = netif_ip6_addr_valid_life(netif, i);
232       if (valid_life > ND6_2HRS || valid_life > remaining_life) {
233         netif_ip6_addr_set_valid_life(netif, i, valid_life);
234       } else if (remaining_life > ND6_2HRS) {
235         netif_ip6_addr_set_valid_life(netif, i, ND6_2HRS);
236       }
237       LWIP_ASSERT("bad valid lifetime", !netif_ip6_addr_isstatic(netif, i));
238       /* Update the preferred lifetime. No bounds checks are needed here. In
239        * rare cases the advertisement may un-deprecate the address, though.
240        * Deprecation is left to the timer code where it is handled anyway. */
241       if (pref_life > 0 && addr_state == IP6_ADDR_DEPRECATED) {
242         netif_ip6_addr_set_state(netif, i, IP6_ADDR_PREFERRED);
243       }
244       netif_ip6_addr_set_pref_life(netif, i, pref_life);
245       return; /* there should be at most one matching address */
246     }
247   }
248 
249   /* No autogenerated address exists for this prefix yet. See if we can add a
250    * new one. However, if IPv6 autoconfiguration is administratively disabled,
251    * do not generate new addresses, but do keep updating lifetimes for existing
252    * addresses. Also, when adding new addresses, we must protect explicitly
253    * against a valid lifetime of zero, because again, we use that as a special
254    * value. The generated address would otherwise expire immediately anyway.
255    * Finally, the original link-local address must be usable at all. We start
256    * creating addresses even if the link-local address is still in tentative
257    * state though, and deal with the fallout of that upon DAD collision. */
258   addr_state = netif_ip6_addr_state(netif, 0);
259   if (!netif->ip6_autoconfig_enabled || valid_life == IP6_ADDR_LIFE_STATIC ||
260       ip6_addr_isinvalid(addr_state) || ip6_addr_isduplicated(addr_state)) {
261     return;
262   }
263 
264   /* Construct the new address that we intend to use, and then see if that
265    * address really does not exist. It might have been added manually, after
266    * all. As a side effect, find a free slot. Note that we cannot use
267    * netif_add_ip6_address() here, as it would return ERR_OK if the address
268    * already did exist, resulting in that address being given lifetimes. */
269   IP6_ADDR(&ip6addr, prefix_addr->addr[0], prefix_addr->addr[1],
270     netif_ip6_addr(netif, 0)->addr[2], netif_ip6_addr(netif, 0)->addr[3]);
271   ip6_addr_assign_zone(&ip6addr, IP6_UNICAST, netif);
272 
273   free_idx = 0;
274   for (i = 1; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
275     if (!ip6_addr_isinvalid(netif_ip6_addr_state(netif, i))) {
276       if (ip6_addr_eq(&ip6addr, netif_ip6_addr(netif, i))) {
277         return; /* formed address already exists */
278       }
279     } else if (free_idx == 0) {
280       free_idx = i;
281     }
282   }
283   if (free_idx == 0) {
284     return; /* no address slots available, try again on next advertisement */
285   }
286 
287   /* Assign the new address to the interface. */
288   ip_addr_copy_from_ip6(netif->ip6_addr[free_idx], ip6addr);
289   netif_ip6_addr_set_valid_life(netif, free_idx, valid_life);
290   netif_ip6_addr_set_pref_life(netif, free_idx, pref_life);
291   netif_ip6_addr_set_state(netif, free_idx, IP6_ADDR_TENTATIVE);
292 }
293 #endif /* LWIP_IPV6_AUTOCONFIG */
294 
295 /**
296  * Process an incoming neighbor discovery message
297  *
298  * @param p the nd packet, p->payload pointing to the icmpv6 header
299  * @param inp the netif on which this packet was received
300  */
301 void
nd6_input(struct pbuf * p,struct netif * inp)302 nd6_input(struct pbuf *p, struct netif *inp)
303 {
304   u8_t msg_type;
305   s8_t i;
306   s16_t dest_idx;
307 
308   ND6_STATS_INC(nd6.recv);
309 
310   msg_type = *((u8_t *)p->payload);
311   switch (msg_type) {
312   case ICMP6_TYPE_NA: /* Neighbor Advertisement. */
313   {
314     struct na_header *na_hdr;
315     struct lladdr_option *lladdr_opt;
316     ip6_addr_t target_address;
317 
318     /* Check that na header fits in packet. */
319     if (p->len < (sizeof(struct na_header))) {
320       /* @todo debug message */
321       pbuf_free(p);
322       ND6_STATS_INC(nd6.lenerr);
323       ND6_STATS_INC(nd6.drop);
324       return;
325     }
326 
327     na_hdr = (struct na_header *)p->payload;
328 
329     /* Create an aligned, zoned copy of the target address. */
330     ip6_addr_copy_from_packed(target_address, na_hdr->target_address);
331     ip6_addr_assign_zone(&target_address, IP6_UNICAST, inp);
332 
333     /* Check a subset of the other RFC 4861 Sec. 7.1.2 requirements. */
334     if (IP6H_HOPLIM(ip6_current_header()) != ND6_HOPLIM || na_hdr->code != 0 ||
335         ip6_addr_ismulticast(&target_address)) {
336       pbuf_free(p);
337       ND6_STATS_INC(nd6.proterr);
338       ND6_STATS_INC(nd6.drop);
339       return;
340     }
341 
342     /* @todo RFC MUST: if IP destination is multicast, Solicited flag is zero */
343     /* @todo RFC MUST: all included options have a length greater than zero */
344 
345     /* Unsolicited NA?*/
346     if (ip6_addr_ismulticast(ip6_current_dest_addr())) {
347       /* This is an unsolicited NA.
348        * link-layer changed?
349        * part of DAD mechanism? */
350 
351 #if LWIP_IPV6_DUP_DETECT_ATTEMPTS
352       /* If the target address matches this netif, it is a DAD response. */
353       for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
354         if (!ip6_addr_isinvalid(netif_ip6_addr_state(inp, i)) &&
355             !ip6_addr_isduplicated(netif_ip6_addr_state(inp, i)) &&
356             ip6_addr_eq(&target_address, netif_ip6_addr(inp, i))) {
357           /* We are using a duplicate address. */
358           nd6_duplicate_addr_detected(inp, i);
359 
360           pbuf_free(p);
361           return;
362         }
363       }
364 #endif /* LWIP_IPV6_DUP_DETECT_ATTEMPTS */
365 
366       /* Check that link-layer address option also fits in packet. */
367       if (p->len < (sizeof(struct na_header) + 2)) {
368         /* @todo debug message */
369         pbuf_free(p);
370         ND6_STATS_INC(nd6.lenerr);
371         ND6_STATS_INC(nd6.drop);
372         return;
373       }
374 
375       lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct na_header));
376 
377       if (p->len < (sizeof(struct na_header) + (lladdr_opt->length << 3))) {
378         /* @todo debug message */
379         pbuf_free(p);
380         ND6_STATS_INC(nd6.lenerr);
381         ND6_STATS_INC(nd6.drop);
382         return;
383       }
384 
385       /* This is an unsolicited NA, most likely there was a LLADDR change. */
386       i = nd6_find_neighbor_cache_entry(&target_address);
387       if (i >= 0) {
388         if (na_hdr->flags & ND6_FLAG_OVERRIDE) {
389           MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
390         }
391       }
392     } else {
393       /* This is a solicited NA.
394        * neighbor address resolution response?
395        * neighbor unreachability detection response? */
396 
397       /* Find the cache entry corresponding to this na. */
398       i = nd6_find_neighbor_cache_entry(&target_address);
399       if (i < 0) {
400         /* We no longer care about this target address. drop it. */
401         pbuf_free(p);
402         return;
403       }
404 
405       /* Update cache entry. */
406       if ((na_hdr->flags & ND6_FLAG_OVERRIDE) ||
407           (neighbor_cache[i].state == ND6_INCOMPLETE)) {
408         /* Check that link-layer address option also fits in packet. */
409         if (p->len < (sizeof(struct na_header) + 2)) {
410           /* @todo debug message */
411           pbuf_free(p);
412           ND6_STATS_INC(nd6.lenerr);
413           ND6_STATS_INC(nd6.drop);
414           return;
415         }
416 
417         lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct na_header));
418 
419         if (p->len < (sizeof(struct na_header) + (lladdr_opt->length << 3))) {
420           /* @todo debug message */
421           pbuf_free(p);
422           ND6_STATS_INC(nd6.lenerr);
423           ND6_STATS_INC(nd6.drop);
424           return;
425         }
426 
427         MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
428       }
429 
430       neighbor_cache[i].netif = inp;
431       neighbor_cache[i].state = ND6_REACHABLE;
432       neighbor_cache[i].counter.reachable_time = reachable_time;
433 
434       /* Send queued packets, if any. */
435       if (neighbor_cache[i].q != NULL) {
436         nd6_send_q(i);
437       }
438     }
439 
440     break; /* ICMP6_TYPE_NA */
441   }
442   case ICMP6_TYPE_NS: /* Neighbor solicitation. */
443   {
444     struct ns_header *ns_hdr;
445     struct lladdr_option *lladdr_opt;
446     ip6_addr_t target_address;
447     u8_t accepted;
448 
449     /* Check that ns header fits in packet. */
450     if (p->len < sizeof(struct ns_header)) {
451       /* @todo debug message */
452       pbuf_free(p);
453       ND6_STATS_INC(nd6.lenerr);
454       ND6_STATS_INC(nd6.drop);
455       return;
456     }
457 
458     ns_hdr = (struct ns_header *)p->payload;
459 
460     /* Create an aligned, zoned copy of the target address. */
461     ip6_addr_copy_from_packed(target_address, ns_hdr->target_address);
462     ip6_addr_assign_zone(&target_address, IP6_UNICAST, inp);
463 
464     /* Check a subset of the other RFC 4861 Sec. 7.1.1 requirements. */
465     if (IP6H_HOPLIM(ip6_current_header()) != ND6_HOPLIM || ns_hdr->code != 0 ||
466        ip6_addr_ismulticast(&target_address)) {
467       pbuf_free(p);
468       ND6_STATS_INC(nd6.proterr);
469       ND6_STATS_INC(nd6.drop);
470       return;
471     }
472 
473     /* @todo RFC MUST: all included options have a length greater than zero */
474     /* @todo RFC MUST: if IP source is 'any', destination is solicited-node multicast address */
475     /* @todo RFC MUST: if IP source is 'any', there is no source LL address option */
476 
477     /* Check if there is a link-layer address provided. Only point to it if in this buffer. */
478     if (p->len >= (sizeof(struct ns_header) + 2)) {
479       lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct ns_header));
480       if (p->len < (sizeof(struct ns_header) + (lladdr_opt->length << 3))) {
481         lladdr_opt = NULL;
482       }
483     } else {
484       lladdr_opt = NULL;
485     }
486 
487     /* Check if the target address is configured on the receiving netif. */
488     accepted = 0;
489     for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; ++i) {
490       if ((ip6_addr_isvalid(netif_ip6_addr_state(inp, i)) ||
491            (ip6_addr_istentative(netif_ip6_addr_state(inp, i)) &&
492             ip6_addr_isany(ip6_current_src_addr()))) &&
493           ip6_addr_eq(&target_address, netif_ip6_addr(inp, i))) {
494         accepted = 1;
495         break;
496       }
497     }
498 
499     /* NS not for us? */
500     if (!accepted) {
501       pbuf_free(p);
502       return;
503     }
504 
505     /* Check for ANY address in src (DAD algorithm). */
506     if (ip6_addr_isany(ip6_current_src_addr())) {
507       /* Sender is validating this address. */
508       for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; ++i) {
509         if (!ip6_addr_isinvalid(netif_ip6_addr_state(inp, i)) &&
510             ip6_addr_eq(&target_address, netif_ip6_addr(inp, i))) {
511           /* Send a NA back so that the sender does not use this address. */
512           nd6_send_na(inp, netif_ip6_addr(inp, i), ND6_FLAG_OVERRIDE | ND6_SEND_FLAG_ALLNODES_DEST);
513           if (ip6_addr_istentative(netif_ip6_addr_state(inp, i))) {
514             /* We shouldn't use this address either. */
515             nd6_duplicate_addr_detected(inp, i);
516           }
517         }
518       }
519     } else {
520       /* Sender is trying to resolve our address. */
521       /* Verify that they included their own link-layer address. */
522       if (lladdr_opt == NULL) {
523         /* Not a valid message. */
524         pbuf_free(p);
525         ND6_STATS_INC(nd6.proterr);
526         ND6_STATS_INC(nd6.drop);
527         return;
528       }
529 
530       i = nd6_find_neighbor_cache_entry(ip6_current_src_addr());
531       if (i>= 0) {
532         /* We already have a record for the solicitor. */
533         if (neighbor_cache[i].state == ND6_INCOMPLETE) {
534           neighbor_cache[i].netif = inp;
535           MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
536 
537           /* Delay probe in case we get confirmation of reachability from upper layer (TCP). */
538           neighbor_cache[i].state = ND6_DELAY;
539           neighbor_cache[i].counter.delay_time = LWIP_ND6_DELAY_FIRST_PROBE_TIME / ND6_TMR_INTERVAL;
540         }
541       } else {
542         /* Add their IPv6 address and link-layer address to neighbor cache.
543          * We will need it at least to send a unicast NA message, but most
544          * likely we will also be communicating with this node soon. */
545         i = nd6_new_neighbor_cache_entry();
546         if (i < 0) {
547           /* We couldn't assign a cache entry for this neighbor.
548            * we won't be able to reply. drop it. */
549           pbuf_free(p);
550           ND6_STATS_INC(nd6.memerr);
551           return;
552         }
553         neighbor_cache[i].netif = inp;
554         MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
555         ip6_addr_set(&(neighbor_cache[i].next_hop_address), ip6_current_src_addr());
556 
557         /* Receiving a message does not prove reachability: only in one direction.
558          * Delay probe in case we get confirmation of reachability from upper layer (TCP). */
559         neighbor_cache[i].state = ND6_DELAY;
560         neighbor_cache[i].counter.delay_time = LWIP_ND6_DELAY_FIRST_PROBE_TIME / ND6_TMR_INTERVAL;
561       }
562 
563       /* Send back a NA for us. Allocate the reply pbuf. */
564       nd6_send_na(inp, &target_address, ND6_FLAG_SOLICITED | ND6_FLAG_OVERRIDE);
565     }
566 
567     break; /* ICMP6_TYPE_NS */
568   }
569   case ICMP6_TYPE_RA: /* Router Advertisement. */
570   {
571     struct ra_header *ra_hdr;
572     u8_t *buffer; /* Used to copy options. */
573     u16_t offset;
574 #if LWIP_ND6_RDNSS_MAX_DNS_SERVERS
575     /* There can be multiple RDNSS options per RA */
576     u8_t rdnss_server_idx = 0;
577 #endif /* LWIP_ND6_RDNSS_MAX_DNS_SERVERS */
578 
579     /* Check that RA header fits in packet. */
580     if (p->len < sizeof(struct ra_header)) {
581       /* @todo debug message */
582       pbuf_free(p);
583       ND6_STATS_INC(nd6.lenerr);
584       ND6_STATS_INC(nd6.drop);
585       return;
586     }
587 
588     ra_hdr = (struct ra_header *)p->payload;
589 
590     /* Check a subset of the other RFC 4861 Sec. 6.1.2 requirements. */
591     if (!ip6_addr_islinklocal(ip6_current_src_addr()) ||
592         IP6H_HOPLIM(ip6_current_header()) != ND6_HOPLIM || ra_hdr->code != 0) {
593       pbuf_free(p);
594       ND6_STATS_INC(nd6.proterr);
595       ND6_STATS_INC(nd6.drop);
596       return;
597     }
598 
599     /* @todo RFC MUST: all included options have a length greater than zero */
600 
601     /* If we are sending RS messages, stop. */
602 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
603     /* ensure at least one solicitation is sent (see RFC 4861, ch. 6.3.7) */
604     if ((inp->rs_count < LWIP_ND6_MAX_MULTICAST_SOLICIT) ||
605         (nd6_send_rs(inp) == ERR_OK)) {
606       inp->rs_count = 0;
607     } else {
608       inp->rs_count = 1;
609     }
610 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
611 
612     /* Get the matching default router entry. */
613     i = nd6_get_router(ip6_current_src_addr(), inp);
614     if (i < 0) {
615       /* Create a new router entry. */
616       i = nd6_new_router(ip6_current_src_addr(), inp);
617     }
618 
619     if (i < 0) {
620       /* Could not create a new router entry. */
621       pbuf_free(p);
622       ND6_STATS_INC(nd6.memerr);
623       return;
624     }
625 
626     /* Re-set invalidation timer. */
627     default_router_list[i].invalidation_timer = lwip_htons(ra_hdr->router_lifetime);
628 
629     /* Re-set default timer values. */
630 #if LWIP_ND6_ALLOW_RA_UPDATES
631     if (ra_hdr->retrans_timer > 0) {
632       retrans_timer = lwip_htonl(ra_hdr->retrans_timer);
633     }
634     if (ra_hdr->reachable_time > 0) {
635       reachable_time = lwip_htonl(ra_hdr->reachable_time);
636     }
637 #endif /* LWIP_ND6_ALLOW_RA_UPDATES */
638 
639     /* @todo set default hop limit... */
640     /* ra_hdr->current_hop_limit;*/
641 
642     /* Update flags in local entry (incl. preference). */
643     default_router_list[i].flags = ra_hdr->flags;
644 
645 #if LWIP_IPV6_DHCP6
646     /* Trigger DHCPv6 if enabled */
647     dhcp6_nd6_ra_trigger(inp, ra_hdr->flags & ND6_RA_FLAG_MANAGED_ADDR_CONFIG,
648       ra_hdr->flags & ND6_RA_FLAG_OTHER_CONFIG);
649 #endif
650 
651     /* Offset to options. */
652     offset = sizeof(struct ra_header);
653 
654     /* Process each option. */
655     while ((p->tot_len - offset) >= 2) {
656       u8_t option_type;
657       u16_t option_len;
658       int option_len8 = pbuf_try_get_at(p, offset + 1);
659       if (option_len8 <= 0) {
660         /* read beyond end or zero length */
661         goto lenerr_drop_free_return;
662       }
663       option_len = ((u8_t)option_len8) << 3;
664       if (option_len > p->tot_len - offset) {
665         /* short packet (option does not fit in) */
666         goto lenerr_drop_free_return;
667       }
668       if (p->len == p->tot_len) {
669         /* no need to copy from contiguous pbuf */
670         buffer = &((u8_t*)p->payload)[offset];
671       } else {
672         /* check if this option fits into our buffer */
673         if (option_len > sizeof(nd6_ra_buffer)) {
674           option_type = pbuf_get_at(p, offset);
675           /* invalid option length */
676           if (option_type != ND6_OPTION_TYPE_RDNSS) {
677             goto lenerr_drop_free_return;
678           }
679           /* we allow RDNSS option to be longer - we'll just drop some servers */
680           option_len = sizeof(nd6_ra_buffer);
681         }
682         buffer = (u8_t*)&nd6_ra_buffer;
683         option_len = pbuf_copy_partial(p, &nd6_ra_buffer, option_len, offset);
684       }
685       option_type = buffer[0];
686       switch (option_type) {
687       case ND6_OPTION_TYPE_SOURCE_LLADDR:
688       {
689         struct lladdr_option *lladdr_opt;
690         if (option_len < (ND6_LLADDR_OPTION_MIN_LENGTH + inp->hwaddr_len)) {
691           goto lenerr_drop_free_return;
692         }
693         lladdr_opt = (struct lladdr_option *)buffer;
694         if ((default_router_list[i].neighbor_entry != NULL) &&
695             (default_router_list[i].neighbor_entry->state == ND6_INCOMPLETE)) {
696           SMEMCPY(default_router_list[i].neighbor_entry->lladdr, lladdr_opt->addr, inp->hwaddr_len);
697           default_router_list[i].neighbor_entry->state = ND6_REACHABLE;
698           default_router_list[i].neighbor_entry->counter.reachable_time = reachable_time;
699         }
700         break;
701       }
702       case ND6_OPTION_TYPE_MTU:
703       {
704         struct mtu_option *mtu_opt;
705         u32_t mtu32;
706         if (option_len < sizeof(struct mtu_option)) {
707           goto lenerr_drop_free_return;
708         }
709         mtu_opt = (struct mtu_option *)buffer;
710         mtu32 = lwip_htonl(mtu_opt->mtu);
711         if ((mtu32 >= IP6_MIN_MTU_LENGTH) && (mtu32 <= 0xffff)) {
712 #if LWIP_ND6_ALLOW_RA_UPDATES
713           if (inp->mtu) {
714             /* don't set the mtu for IPv6 higher than the netif driver supports */
715             inp->mtu6 = LWIP_MIN(LWIP_MIN(inp->mtu, inp->mtu6), (u16_t)mtu32);
716           } else {
717             inp->mtu6 = (u16_t)mtu32;
718           }
719 #endif /* LWIP_ND6_ALLOW_RA_UPDATES */
720         }
721         break;
722       }
723       case ND6_OPTION_TYPE_PREFIX_INFO:
724       {
725         struct prefix_option *prefix_opt;
726         ip6_addr_t prefix_addr;
727         if (option_len < sizeof(struct prefix_option)) {
728           goto lenerr_drop_free_return;
729         }
730 
731         prefix_opt = (struct prefix_option *)buffer;
732 
733         /* Get a memory-aligned copy of the prefix. */
734         ip6_addr_copy_from_packed(prefix_addr, prefix_opt->prefix);
735         ip6_addr_assign_zone(&prefix_addr, IP6_UNICAST, inp);
736 
737         if (!ip6_addr_islinklocal(&prefix_addr)) {
738           if ((prefix_opt->flags & ND6_PREFIX_FLAG_ON_LINK) &&
739               (prefix_opt->prefix_length == 64)) {
740             /* Add to on-link prefix list. */
741             u32_t valid_life;
742             s8_t prefix;
743 
744             valid_life = lwip_htonl(prefix_opt->valid_lifetime);
745 
746             /* find cache entry for this prefix. */
747             prefix = nd6_get_onlink_prefix(&prefix_addr, inp);
748             if (prefix < 0 && valid_life > 0) {
749               /* Create a new cache entry. */
750               prefix = nd6_new_onlink_prefix(&prefix_addr, inp);
751             }
752             if (prefix >= 0) {
753               prefix_list[prefix].invalidation_timer = valid_life;
754             }
755           }
756 #if LWIP_IPV6_AUTOCONFIG
757           if (prefix_opt->flags & ND6_PREFIX_FLAG_AUTONOMOUS) {
758             /* Perform processing for autoconfiguration. */
759             nd6_process_autoconfig_prefix(inp, prefix_opt, &prefix_addr);
760           }
761 #endif /* LWIP_IPV6_AUTOCONFIG */
762         }
763 
764         break;
765       }
766       case ND6_OPTION_TYPE_ROUTE_INFO:
767         /* @todo implement preferred routes.
768         struct route_option * route_opt;
769         route_opt = (struct route_option *)buffer;*/
770 
771         break;
772 #if LWIP_ND6_RDNSS_MAX_DNS_SERVERS
773       case ND6_OPTION_TYPE_RDNSS:
774       {
775         u8_t num, n;
776         u16_t copy_offset = offset + SIZEOF_RDNSS_OPTION_BASE;
777         struct rdnss_option * rdnss_opt;
778         if (option_len < SIZEOF_RDNSS_OPTION_BASE) {
779           goto lenerr_drop_free_return;
780         }
781 
782         rdnss_opt = (struct rdnss_option *)buffer;
783         num = (rdnss_opt->length - 1) / 2;
784         for (n = 0; (rdnss_server_idx < DNS_MAX_SERVERS) && (n < num); n++, copy_offset += sizeof(ip6_addr_p_t)) {
785           ip_addr_t rdnss_address;
786 
787           /* Copy directly from pbuf to get an aligned, zoned copy of the prefix. */
788           if (pbuf_copy_partial(p, &rdnss_address, sizeof(ip6_addr_p_t), copy_offset) == sizeof(ip6_addr_p_t)) {
789             IP_SET_TYPE_VAL(rdnss_address, IPADDR_TYPE_V6);
790             ip6_addr_assign_zone(ip_2_ip6(&rdnss_address), IP6_UNKNOWN, inp);
791 
792             if (htonl(rdnss_opt->lifetime) > 0) {
793               /* TODO implement Lifetime > 0 */
794               dns_setserver(rdnss_server_idx++, &rdnss_address);
795             } else {
796               /* TODO implement DNS removal in dns.c */
797               u8_t s;
798               for (s = 0; s < DNS_MAX_SERVERS; s++) {
799                 const ip_addr_t *addr = dns_getserver(s);
800                 if(ip_addr_eq(addr, &rdnss_address)) {
801                   dns_setserver(s, NULL);
802                 }
803               }
804             }
805           }
806         }
807         break;
808       }
809 #endif /* LWIP_ND6_RDNSS_MAX_DNS_SERVERS */
810       default:
811         /* Unrecognized option, abort. */
812         ND6_STATS_INC(nd6.proterr);
813         break;
814       }
815       /* option length is checked earlier to be non-zero to make sure loop ends */
816       offset += 8 * (u8_t)option_len8;
817     }
818 
819     break; /* ICMP6_TYPE_RA */
820   }
821   case ICMP6_TYPE_RD: /* Redirect */
822   {
823     struct redirect_header *redir_hdr;
824     struct lladdr_option *lladdr_opt;
825     ip6_addr_t destination_address, target_address;
826 
827     /* Check that Redir header fits in packet. */
828     if (p->len < sizeof(struct redirect_header)) {
829       /* @todo debug message */
830       pbuf_free(p);
831       ND6_STATS_INC(nd6.lenerr);
832       ND6_STATS_INC(nd6.drop);
833       return;
834     }
835 
836     redir_hdr = (struct redirect_header *)p->payload;
837 
838     /* Create an aligned, zoned copy of the destination address. */
839     ip6_addr_copy_from_packed(destination_address, redir_hdr->destination_address);
840     ip6_addr_assign_zone(&destination_address, IP6_UNICAST, inp);
841 
842     /* Check a subset of the other RFC 4861 Sec. 8.1 requirements. */
843     if (!ip6_addr_islinklocal(ip6_current_src_addr()) ||
844         IP6H_HOPLIM(ip6_current_header()) != ND6_HOPLIM ||
845         redir_hdr->code != 0 || ip6_addr_ismulticast(&destination_address)) {
846       pbuf_free(p);
847       ND6_STATS_INC(nd6.proterr);
848       ND6_STATS_INC(nd6.drop);
849       return;
850     }
851 
852     /* @todo RFC MUST: IP source address equals first-hop router for destination_address */
853     /* @todo RFC MUST: ICMP target address is either link-local address or same as destination_address */
854     /* @todo RFC MUST: all included options have a length greater than zero */
855 
856     if (p->len >= (sizeof(struct redirect_header) + 2)) {
857       lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct redirect_header));
858       if (p->len < (sizeof(struct redirect_header) + (lladdr_opt->length << 3))) {
859         lladdr_opt = NULL;
860       }
861     } else {
862       lladdr_opt = NULL;
863     }
864 
865     /* Find dest address in cache */
866     dest_idx = nd6_find_destination_cache_entry(&destination_address);
867     if (dest_idx < 0) {
868       /* Destination not in cache, drop packet. */
869       pbuf_free(p);
870       return;
871     }
872 
873     /* Create an aligned, zoned copy of the target address. */
874     ip6_addr_copy_from_packed(target_address, redir_hdr->target_address);
875     ip6_addr_assign_zone(&target_address, IP6_UNICAST, inp);
876 
877     /* Set the new target address. */
878     ip6_addr_copy(destination_cache[dest_idx].next_hop_addr, target_address);
879 
880     /* If Link-layer address of other router is given, try to add to neighbor cache. */
881     if (lladdr_opt != NULL) {
882       if (lladdr_opt->type == ND6_OPTION_TYPE_TARGET_LLADDR) {
883         i = nd6_find_neighbor_cache_entry(&target_address);
884         if (i < 0) {
885           i = nd6_new_neighbor_cache_entry();
886           if (i >= 0) {
887             neighbor_cache[i].netif = inp;
888             MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
889             ip6_addr_copy(neighbor_cache[i].next_hop_address, target_address);
890 
891             /* Receiving a message does not prove reachability: only in one direction.
892              * Delay probe in case we get confirmation of reachability from upper layer (TCP). */
893             neighbor_cache[i].state = ND6_DELAY;
894             neighbor_cache[i].counter.delay_time = LWIP_ND6_DELAY_FIRST_PROBE_TIME / ND6_TMR_INTERVAL;
895           }
896         }
897         if (i >= 0) {
898           if (neighbor_cache[i].state == ND6_INCOMPLETE) {
899             MEMCPY(neighbor_cache[i].lladdr, lladdr_opt->addr, inp->hwaddr_len);
900             /* Receiving a message does not prove reachability: only in one direction.
901              * Delay probe in case we get confirmation of reachability from upper layer (TCP). */
902             neighbor_cache[i].state = ND6_DELAY;
903             neighbor_cache[i].counter.delay_time = LWIP_ND6_DELAY_FIRST_PROBE_TIME / ND6_TMR_INTERVAL;
904           }
905         }
906       }
907     }
908     break; /* ICMP6_TYPE_RD */
909   }
910   case ICMP6_TYPE_PTB: /* Packet too big */
911   {
912     struct icmp6_hdr *icmp6hdr; /* Packet too big message */
913     struct ip6_hdr *ip6hdr; /* IPv6 header of the packet which caused the error */
914     u32_t pmtu;
915     ip6_addr_t destination_address;
916 
917     /* Check that ICMPv6 header + IPv6 header fit in payload */
918     if (p->len < (sizeof(struct icmp6_hdr) + IP6_HLEN)) {
919       /* drop short packets */
920       pbuf_free(p);
921       ND6_STATS_INC(nd6.lenerr);
922       ND6_STATS_INC(nd6.drop);
923       return;
924     }
925 
926     icmp6hdr = (struct icmp6_hdr *)p->payload;
927     ip6hdr = (struct ip6_hdr *)((u8_t*)p->payload + sizeof(struct icmp6_hdr));
928 
929     /* Create an aligned, zoned copy of the destination address. */
930     ip6_addr_copy_from_packed(destination_address, ip6hdr->dest);
931     ip6_addr_assign_zone(&destination_address, IP6_UNKNOWN, inp);
932 
933     /* Look for entry in destination cache. */
934     dest_idx = nd6_find_destination_cache_entry(&destination_address);
935     if (dest_idx < 0) {
936       /* Destination not in cache, drop packet. */
937       pbuf_free(p);
938       return;
939     }
940 
941     /* Change the Path MTU. */
942     pmtu = lwip_htonl(icmp6hdr->data);
943     destination_cache[dest_idx].pmtu = (u16_t)LWIP_MIN(pmtu, 0xFFFF);
944 
945     break; /* ICMP6_TYPE_PTB */
946   }
947 
948   default:
949     ND6_STATS_INC(nd6.proterr);
950     ND6_STATS_INC(nd6.drop);
951     break; /* default */
952   }
953 
954   pbuf_free(p);
955   return;
956 lenerr_drop_free_return:
957   ND6_STATS_INC(nd6.lenerr);
958   ND6_STATS_INC(nd6.drop);
959   pbuf_free(p);
960 }
961 
962 
963 /**
964  * Periodic timer for Neighbor discovery functions:
965  *
966  * - Update neighbor reachability states
967  * - Update destination cache entries age
968  * - Update invalidation timers of default routers and on-link prefixes
969  * - Update lifetimes of our addresses
970  * - Perform duplicate address detection (DAD) for our addresses
971  * - Send router solicitations
972  */
973 void
nd6_tmr(void)974 nd6_tmr(void)
975 {
976   s8_t i;
977   struct netif *netif;
978 
979   /* Process neighbor entries. */
980   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
981     switch (neighbor_cache[i].state) {
982     case ND6_INCOMPLETE:
983       if ((neighbor_cache[i].counter.probes_sent >= LWIP_ND6_MAX_MULTICAST_SOLICIT) &&
984           (!neighbor_cache[i].isrouter)) {
985         /* Retries exceeded. */
986         nd6_free_neighbor_cache_entry(i);
987       } else {
988         /* Send a NS for this entry. */
989         neighbor_cache[i].counter.probes_sent++;
990         nd6_send_neighbor_cache_probe(&neighbor_cache[i], ND6_SEND_FLAG_MULTICAST_DEST);
991       }
992       break;
993     case ND6_REACHABLE:
994       /* Send queued packets, if any are left. Should have been sent already. */
995       if (neighbor_cache[i].q != NULL) {
996         nd6_send_q(i);
997       }
998       if (neighbor_cache[i].counter.reachable_time <= ND6_TMR_INTERVAL) {
999         /* Change to stale state. */
1000         neighbor_cache[i].state = ND6_STALE;
1001         neighbor_cache[i].counter.stale_time = 0;
1002       } else {
1003         neighbor_cache[i].counter.reachable_time -= ND6_TMR_INTERVAL;
1004       }
1005       break;
1006     case ND6_STALE:
1007       neighbor_cache[i].counter.stale_time++;
1008       break;
1009     case ND6_DELAY:
1010       if (neighbor_cache[i].counter.delay_time <= 1) {
1011         /* Change to PROBE state. */
1012         neighbor_cache[i].state = ND6_PROBE;
1013         neighbor_cache[i].counter.probes_sent = 0;
1014       } else {
1015         neighbor_cache[i].counter.delay_time--;
1016       }
1017       break;
1018     case ND6_PROBE:
1019       if ((neighbor_cache[i].counter.probes_sent >= LWIP_ND6_MAX_MULTICAST_SOLICIT) &&
1020           (!neighbor_cache[i].isrouter)) {
1021         /* Retries exceeded. */
1022         nd6_free_neighbor_cache_entry(i);
1023       } else {
1024         /* Send a NS for this entry. */
1025         neighbor_cache[i].counter.probes_sent++;
1026         nd6_send_neighbor_cache_probe(&neighbor_cache[i], 0);
1027       }
1028       break;
1029     case ND6_NO_ENTRY:
1030     default:
1031       /* Do nothing. */
1032       break;
1033     }
1034   }
1035 
1036   /* Process destination entries. */
1037   for (i = 0; i < LWIP_ND6_NUM_DESTINATIONS; i++) {
1038     destination_cache[i].age++;
1039   }
1040 
1041   /* Process router entries. */
1042   for (i = 0; i < LWIP_ND6_NUM_ROUTERS; i++) {
1043     if (default_router_list[i].neighbor_entry != NULL) {
1044       /* Active entry. */
1045       if (default_router_list[i].invalidation_timer <= ND6_TMR_INTERVAL / 1000) {
1046         /* No more than 1 second remaining. Clear this entry. Also clear any of
1047          * its destination cache entries, as per RFC 4861 Sec. 5.3 and 6.3.5. */
1048         s8_t j;
1049         for (j = 0; j < LWIP_ND6_NUM_DESTINATIONS; j++) {
1050           if (ip6_addr_eq(&destination_cache[j].next_hop_addr,
1051                &default_router_list[i].neighbor_entry->next_hop_address)) {
1052              ip6_addr_set_any(&destination_cache[j].destination_addr);
1053           }
1054         }
1055         default_router_list[i].neighbor_entry->isrouter = 0;
1056         default_router_list[i].neighbor_entry = NULL;
1057         default_router_list[i].invalidation_timer = 0;
1058         default_router_list[i].flags = 0;
1059       } else {
1060         default_router_list[i].invalidation_timer -= ND6_TMR_INTERVAL / 1000;
1061       }
1062     }
1063   }
1064 
1065   /* Process prefix entries. */
1066   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; i++) {
1067     if (prefix_list[i].netif != NULL) {
1068       if (prefix_list[i].invalidation_timer <= ND6_TMR_INTERVAL / 1000) {
1069         /* Entry timed out, remove it */
1070         prefix_list[i].invalidation_timer = 0;
1071         prefix_list[i].netif = NULL;
1072       } else {
1073         prefix_list[i].invalidation_timer -= ND6_TMR_INTERVAL / 1000;
1074       }
1075     }
1076   }
1077 
1078   /* Process our own addresses, updating address lifetimes and/or DAD state. */
1079 #ifdef LOSCFG_NET_CONTAINER
1080   NETIF_FOREACH(netif, get_root_net_group()) {
1081 #else
1082   NETIF_FOREACH(netif) {
1083 #endif
1084     for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; ++i) {
1085       u8_t addr_state;
1086 #if LWIP_IPV6_ADDRESS_LIFETIMES
1087       /* Step 1: update address lifetimes (valid and preferred). */
1088       addr_state = netif_ip6_addr_state(netif, i);
1089       /* RFC 4862 is not entirely clear as to whether address lifetimes affect
1090        * tentative addresses, and is even less clear as to what should happen
1091        * with duplicate addresses. We choose to track and update lifetimes for
1092        * both those types, although for different reasons:
1093        * - for tentative addresses, the line of thought of Sec. 5.7 combined
1094        *   with the potentially long period that an address may be in tentative
1095        *   state (due to the interface being down) suggests that lifetimes
1096        *   should be independent of external factors which would include DAD;
1097        * - for duplicate addresses, retiring them early could result in a new
1098        *   but unwanted attempt at marking them as valid, while retiring them
1099        *   late/never could clog up address slots on the netif.
1100        * As a result, we may end up expiring addresses of either type here.
1101        */
1102       if (!ip6_addr_isinvalid(addr_state) &&
1103           !netif_ip6_addr_isstatic(netif, i)) {
1104         u32_t life = netif_ip6_addr_valid_life(netif, i);
1105         if (life <= ND6_TMR_INTERVAL / 1000) {
1106           /* The address has expired. */
1107           netif_ip6_addr_set_valid_life(netif, i, 0);
1108           netif_ip6_addr_set_pref_life(netif, i, 0);
1109           netif_ip6_addr_set_state(netif, i, IP6_ADDR_INVALID);
1110         } else {
1111           if (!ip6_addr_life_isinfinite(life)) {
1112             life -= ND6_TMR_INTERVAL / 1000;
1113             LWIP_ASSERT("bad valid lifetime", life != IP6_ADDR_LIFE_STATIC);
1114             netif_ip6_addr_set_valid_life(netif, i, life);
1115           }
1116           /* The address is still here. Update the preferred lifetime too. */
1117           life = netif_ip6_addr_pref_life(netif, i);
1118           if (life <= ND6_TMR_INTERVAL / 1000) {
1119             /* This case must also trigger if 'life' was already zero, so as to
1120              * deal correctly with advertised preferred-lifetime reductions. */
1121             netif_ip6_addr_set_pref_life(netif, i, 0);
1122             if (addr_state == IP6_ADDR_PREFERRED)
1123               netif_ip6_addr_set_state(netif, i, IP6_ADDR_DEPRECATED);
1124           } else if (!ip6_addr_life_isinfinite(life)) {
1125             life -= ND6_TMR_INTERVAL / 1000;
1126             netif_ip6_addr_set_pref_life(netif, i, life);
1127           }
1128         }
1129       }
1130       /* The address state may now have changed, so reobtain it next. */
1131 #endif /* LWIP_IPV6_ADDRESS_LIFETIMES */
1132       /* Step 2: update DAD state. */
1133       addr_state = netif_ip6_addr_state(netif, i);
1134       if (ip6_addr_istentative(addr_state)) {
1135         if ((addr_state & IP6_ADDR_TENTATIVE_COUNT_MASK) >= LWIP_IPV6_DUP_DETECT_ATTEMPTS) {
1136           /* No NA received in response. Mark address as valid. For dynamic
1137            * addresses with an expired preferred lifetime, the state is set to
1138            * deprecated right away. That should almost never happen, though. */
1139           addr_state = IP6_ADDR_PREFERRED;
1140 #if LWIP_IPV6_ADDRESS_LIFETIMES
1141           if (!netif_ip6_addr_isstatic(netif, i) &&
1142               netif_ip6_addr_pref_life(netif, i) == 0) {
1143             addr_state = IP6_ADDR_DEPRECATED;
1144           }
1145 #endif /* LWIP_IPV6_ADDRESS_LIFETIMES */
1146           netif_ip6_addr_set_state(netif, i, addr_state);
1147         } else if (netif_is_up(netif) && netif_is_link_up(netif)) {
1148           /* tentative: set next state by increasing by one */
1149           netif_ip6_addr_set_state(netif, i, addr_state + 1);
1150           /* Send a NS for this address. Use the unspecified address as source
1151            * address in all cases (RFC 4862 Sec. 5.4.2), not in the least
1152            * because as it is, we only consider multicast replies for DAD. */
1153           nd6_send_ns(netif, netif_ip6_addr(netif, i),
1154             ND6_SEND_FLAG_MULTICAST_DEST | ND6_SEND_FLAG_ANY_SRC);
1155         }
1156       }
1157     }
1158   }
1159 
1160 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
1161   /* Send router solicitation messages, if necessary. */
1162   if (!nd6_tmr_rs_reduction) {
1163     nd6_tmr_rs_reduction = (ND6_RTR_SOLICITATION_INTERVAL / ND6_TMR_INTERVAL) - 1;
1164 #ifdef LOSCFG_NET_CONTAINER
1165     NETIF_FOREACH(netif, get_root_net_group()) {
1166 #else
1167     NETIF_FOREACH(netif) {
1168 #endif
1169       if ((netif->rs_count > 0) && netif_is_up(netif) &&
1170           netif_is_link_up(netif) &&
1171           !ip6_addr_isinvalid(netif_ip6_addr_state(netif, 0)) &&
1172           !ip6_addr_isduplicated(netif_ip6_addr_state(netif, 0))) {
1173         if (nd6_send_rs(netif) == ERR_OK) {
1174           netif->rs_count--;
1175         }
1176       }
1177     }
1178   } else {
1179     nd6_tmr_rs_reduction--;
1180   }
1181 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
1182 
1183 }
1184 
1185 #if LWIP_LOWPOWER
1186 #include "lwip/lowpower.h"
1187 u32_t
1188 nd6_tmr_tick(void)
1189 {
1190   s8_t i;
1191   struct netif *netif = NULL;
1192   u32_t tick = 0;
1193   u32_t val = 0;
1194 
1195   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1196     switch (neighbor_cache[i].state) {
1197       case ND6_PROBE:
1198       case ND6_INCOMPLETE: /* state PROBE and INCOMPLETE return 1 */
1199         return 1;
1200       case ND6_REACHABLE:
1201         /* Send queued packets, if any are left. Should have been sent already. */
1202         if (neighbor_cache[i].q != NULL) {
1203           return 1;
1204         }
1205         if (neighbor_cache[i].counter.reachable_time >= ND6_TMR_INTERVAL) {
1206           val = neighbor_cache[i].counter.reachable_time / ND6_TMR_INTERVAL;
1207           SET_TMR_TICK(tick, val);
1208         }
1209         break;
1210       case ND6_DELAY:
1211         val = neighbor_cache[i].counter.delay_time;
1212         SET_TMR_TICK(tick, val);
1213         break;
1214       default:
1215         /* Do nothing. */
1216         break;
1217     }
1218   }
1219 
1220   /* Process router entries. */
1221   for (i = 0; i < LWIP_ND6_NUM_ROUTERS; i++) {
1222     if (default_router_list[i].neighbor_entry != NULL) {
1223       val = default_router_list[i].invalidation_timer;
1224       SET_TMR_TICK(tick, val);
1225     }
1226   }
1227 
1228   /* Process prefix entries. */
1229   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; i++) {
1230     if (prefix_list[i].netif != NULL) {
1231       val = prefix_list[i].invalidation_timer;
1232       SET_TMR_TICK(tick, val);
1233     }
1234   }
1235 
1236   /* Process our own addresses, updating address lifetimes and/or DAD state. */
1237 #ifdef LOSCFG_NET_CONTAINER
1238   NETIF_FOREACH(netif, get_root_net_group())
1239 #else
1240   NETIF_FOREACH(netif)
1241 #endif
1242   {
1243     for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; ++i) {
1244       u8_t addr_state;
1245 #if LWIP_IPV6_ADDRESS_LIFETIMES
1246       /* Step 1: update address lifetimes (valid and preferred). */
1247       addr_state = netif_ip6_addr_state(netif, i);
1248       if (!ip6_addr_isinvalid(addr_state) &&
1249           !netif_ip6_addr_isstatic(netif, i)) {
1250         u32_t life = netif_ip6_addr_valid_life(netif, i);
1251         if (!ip6_addr_life_isinfinite(life)) {
1252           SET_TMR_TICK(tick, life);
1253         }
1254 
1255         life = netif_ip6_addr_pref_life(netif, i);
1256         if (!ip6_addr_life_isinfinite(life)) {
1257           SET_TMR_TICK(tick, life);
1258         }
1259       }
1260       /* The address state may now have changed, so reobtain it next. */
1261 #endif /* LWIP_IPV6_ADDRESS_LIFETIMES */
1262       /* Step 2: update DAD state. */
1263       addr_state = netif_ip6_addr_state(netif, i);
1264       if (ip6_addr_istentative(addr_state)) {
1265         LWIP_DEBUGF(LOWPOWER_DEBUG, ("%s tmr tick: 1\n", "nd6_tmr_tick"));
1266         return 1;
1267       }
1268     }
1269   }
1270 
1271   /* Router solicitations are sent in 4 second intervals (see RFC 4861, ch. 6.3.7) */
1272   /* ND6_RTR_SOLICITATION_INTERVAL */
1273 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
1274   if (nd6_tmr_rs_reduction > 0) {
1275     val = nd6_tmr_rs_reduction;
1276     SET_TMR_TICK(tick, val);
1277   }
1278 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
1279 
1280   LWIP_DEBUGF(LOWPOWER_DEBUG, ("%s tmr tick: %u\n", "nd6_tmr_tick", tick));
1281   return tick;
1282 }
1283 #endif /* LWIP_LOWPOWER */
1284 
1285 /** Send a neighbor solicitation message for a specific neighbor cache entry
1286  *
1287  * @param entry the neighbor cache entry for which to send the message
1288  * @param flags one of ND6_SEND_FLAG_*
1289  */
1290 static void
1291 nd6_send_neighbor_cache_probe(struct nd6_neighbor_cache_entry *entry, u8_t flags)
1292 {
1293   nd6_send_ns(entry->netif, &entry->next_hop_address, flags);
1294 }
1295 
1296 /**
1297  * Send a neighbor solicitation message
1298  *
1299  * @param netif the netif on which to send the message
1300  * @param target_addr the IPv6 target address for the ND message
1301  * @param flags one of ND6_SEND_FLAG_*
1302  */
1303 static void
1304 nd6_send_ns(struct netif *netif, const ip6_addr_t *target_addr, u8_t flags)
1305 {
1306   struct ns_header *ns_hdr;
1307   struct pbuf *p;
1308   const ip6_addr_t *src_addr = NULL;
1309   u16_t lladdr_opt_len;
1310 
1311   LWIP_ASSERT("target address is required", target_addr != NULL);
1312 
1313   if (!(flags & ND6_SEND_FLAG_ANY_SRC)) {
1314     int i;
1315     for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
1316       if (ip6_addr_isvalid(netif_ip6_addr_state(netif, i)) &&
1317             ip6_addr_net_eq(target_addr, netif_ip6_addr(netif, i))) {
1318         src_addr = netif_ip6_addr(netif, i);
1319         break;
1320       }
1321     }
1322 
1323     if (i == LWIP_IPV6_NUM_ADDRESSES) {
1324       LWIP_DEBUGF(IP6_DEBUG | LWIP_DBG_LEVEL_WARNING, ("ICMPv6 NS: no available src address\n"));
1325       ND6_STATS_INC(nd6.err);
1326       return;
1327     }
1328 
1329     /* calculate option length (in 8-byte-blocks) */
1330     lladdr_opt_len = ((netif->hwaddr_len + 2) + 7) >> 3;
1331   } else {
1332     src_addr = IP6_ADDR_ANY6;
1333     /* Option "MUST NOT be included when the source IP address is the unspecified address." */
1334     lladdr_opt_len = 0;
1335   }
1336 
1337   /* Allocate a packet. */
1338   p = pbuf_alloc(PBUF_IP, sizeof(struct ns_header) + (lladdr_opt_len << 3), PBUF_RAM);
1339   if (p == NULL) {
1340     ND6_STATS_INC(nd6.memerr);
1341     return;
1342   }
1343 
1344   /* Set fields. */
1345   ns_hdr = (struct ns_header *)p->payload;
1346 
1347   ns_hdr->type = ICMP6_TYPE_NS;
1348   ns_hdr->code = 0;
1349   ns_hdr->chksum = 0;
1350   ns_hdr->reserved = 0;
1351   ip6_addr_copy_to_packed(ns_hdr->target_address, *target_addr);
1352 
1353   if (lladdr_opt_len != 0) {
1354     struct lladdr_option *lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct ns_header));
1355     lladdr_opt->type = ND6_OPTION_TYPE_SOURCE_LLADDR;
1356     lladdr_opt->length = (u8_t)lladdr_opt_len;
1357     SMEMCPY(lladdr_opt->addr, netif->hwaddr, netif->hwaddr_len);
1358   }
1359 
1360   /* Generate the solicited node address for the target address. */
1361   if (flags & ND6_SEND_FLAG_MULTICAST_DEST) {
1362     ip6_addr_set_solicitednode(&multicast_address, target_addr->addr[3]);
1363     ip6_addr_assign_zone(&multicast_address, IP6_MULTICAST, netif);
1364     target_addr = &multicast_address;
1365   }
1366 
1367 #if CHECKSUM_GEN_ICMP6
1368   IF__NETIF_CHECKSUM_ENABLED(netif, NETIF_CHECKSUM_GEN_ICMP6) {
1369     ns_hdr->chksum = ip6_chksum_pseudo(p, IP6_NEXTH_ICMP6, p->len, src_addr,
1370       target_addr);
1371   }
1372 #endif /* CHECKSUM_GEN_ICMP6 */
1373 
1374   /* Send the packet out. */
1375   ND6_STATS_INC(nd6.xmit);
1376   ip6_output_if(p, (src_addr == IP6_ADDR_ANY6) ? NULL : src_addr, target_addr,
1377       ND6_HOPLIM, 0, IP6_NEXTH_ICMP6, netif);
1378   pbuf_free(p);
1379 }
1380 
1381 /**
1382  * Send a neighbor advertisement message
1383  *
1384  * @param netif the netif on which to send the message
1385  * @param target_addr the IPv6 target address for the ND message
1386  * @param flags one of ND6_SEND_FLAG_*
1387  */
1388 static void
1389 nd6_send_na(struct netif *netif, const ip6_addr_t *target_addr, u8_t flags)
1390 {
1391   struct na_header *na_hdr;
1392   struct lladdr_option *lladdr_opt;
1393   struct pbuf *p;
1394   const ip6_addr_t *src_addr;
1395   const ip6_addr_t *dest_addr;
1396   u16_t lladdr_opt_len;
1397 
1398   LWIP_ASSERT("target address is required", target_addr != NULL);
1399 
1400   /* Use link-local address as source address. */
1401   /* src_addr = netif_ip6_addr(netif, 0); */
1402   /* Use target address as source address. */
1403   src_addr = target_addr;
1404 
1405   /* Allocate a packet. */
1406   lladdr_opt_len = ((netif->hwaddr_len + 2) >> 3) + (((netif->hwaddr_len + 2) & 0x07) ? 1 : 0);
1407   p = pbuf_alloc(PBUF_IP, sizeof(struct na_header) + (lladdr_opt_len << 3), PBUF_RAM);
1408   if (p == NULL) {
1409     ND6_STATS_INC(nd6.memerr);
1410     return;
1411   }
1412 
1413   /* Set fields. */
1414   na_hdr = (struct na_header *)p->payload;
1415   lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct na_header));
1416 
1417   na_hdr->type = ICMP6_TYPE_NA;
1418   na_hdr->code = 0;
1419   na_hdr->chksum = 0;
1420   na_hdr->flags = flags & 0xf0;
1421   na_hdr->reserved[0] = 0;
1422   na_hdr->reserved[1] = 0;
1423   na_hdr->reserved[2] = 0;
1424   ip6_addr_copy_to_packed(na_hdr->target_address, *target_addr);
1425 
1426   lladdr_opt->type = ND6_OPTION_TYPE_TARGET_LLADDR;
1427   lladdr_opt->length = (u8_t)lladdr_opt_len;
1428   SMEMCPY(lladdr_opt->addr, netif->hwaddr, netif->hwaddr_len);
1429 
1430   /* Generate the solicited node address for the target address. */
1431   if (flags & ND6_SEND_FLAG_MULTICAST_DEST) {
1432     ip6_addr_set_solicitednode(&multicast_address, target_addr->addr[3]);
1433     ip6_addr_assign_zone(&multicast_address, IP6_MULTICAST, netif);
1434     dest_addr = &multicast_address;
1435   } else if (flags & ND6_SEND_FLAG_ALLNODES_DEST) {
1436     ip6_addr_set_allnodes_linklocal(&multicast_address);
1437     ip6_addr_assign_zone(&multicast_address, IP6_MULTICAST, netif);
1438     dest_addr = &multicast_address;
1439   } else {
1440     dest_addr = ip6_current_src_addr();
1441   }
1442 
1443 #if CHECKSUM_GEN_ICMP6
1444   IF__NETIF_CHECKSUM_ENABLED(netif, NETIF_CHECKSUM_GEN_ICMP6) {
1445     na_hdr->chksum = ip6_chksum_pseudo(p, IP6_NEXTH_ICMP6, p->len, src_addr,
1446       dest_addr);
1447   }
1448 #endif /* CHECKSUM_GEN_ICMP6 */
1449 
1450   /* Send the packet out. */
1451   ND6_STATS_INC(nd6.xmit);
1452   ip6_output_if(p, src_addr, dest_addr,
1453       ND6_HOPLIM, 0, IP6_NEXTH_ICMP6, netif);
1454   pbuf_free(p);
1455 }
1456 
1457 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
1458 /**
1459  * Send a router solicitation message
1460  *
1461  * @param netif the netif on which to send the message
1462  */
1463 static err_t
1464 nd6_send_rs(struct netif *netif)
1465 {
1466   struct rs_header *rs_hdr;
1467   struct lladdr_option *lladdr_opt;
1468   struct pbuf *p;
1469   const ip6_addr_t *src_addr;
1470   err_t err;
1471   u16_t lladdr_opt_len = 0;
1472 
1473   /* Link-local source address, or unspecified address? */
1474   if (ip6_addr_isvalid(netif_ip6_addr_state(netif, 0))) {
1475     src_addr = netif_ip6_addr(netif, 0);
1476   } else {
1477     src_addr = IP6_ADDR_ANY6;
1478   }
1479 
1480   /* Generate the all routers target address. */
1481   ip6_addr_set_allrouters_linklocal(&multicast_address);
1482   ip6_addr_assign_zone(&multicast_address, IP6_MULTICAST, netif);
1483 
1484   /* Allocate a packet. */
1485   if (src_addr != IP6_ADDR_ANY6) {
1486     lladdr_opt_len = ((netif->hwaddr_len + 2) >> 3) + (((netif->hwaddr_len + 2) & 0x07) ? 1 : 0);
1487   }
1488   p = pbuf_alloc(PBUF_IP, sizeof(struct rs_header) + (lladdr_opt_len << 3), PBUF_RAM);
1489   if (p == NULL) {
1490     ND6_STATS_INC(nd6.memerr);
1491     return ERR_BUF;
1492   }
1493 
1494   /* Set fields. */
1495   rs_hdr = (struct rs_header *)p->payload;
1496 
1497   rs_hdr->type = ICMP6_TYPE_RS;
1498   rs_hdr->code = 0;
1499   rs_hdr->chksum = 0;
1500   rs_hdr->reserved = 0;
1501 
1502   if (src_addr != IP6_ADDR_ANY6) {
1503     /* Include our hw address. */
1504     lladdr_opt = (struct lladdr_option *)((u8_t*)p->payload + sizeof(struct rs_header));
1505     lladdr_opt->type = ND6_OPTION_TYPE_SOURCE_LLADDR;
1506     lladdr_opt->length = (u8_t)lladdr_opt_len;
1507     SMEMCPY(lladdr_opt->addr, netif->hwaddr, netif->hwaddr_len);
1508   }
1509 
1510 #if CHECKSUM_GEN_ICMP6
1511   IF__NETIF_CHECKSUM_ENABLED(netif, NETIF_CHECKSUM_GEN_ICMP6) {
1512     rs_hdr->chksum = ip6_chksum_pseudo(p, IP6_NEXTH_ICMP6, p->len, src_addr,
1513       &multicast_address);
1514   }
1515 #endif /* CHECKSUM_GEN_ICMP6 */
1516 
1517   /* Send the packet out. */
1518   ND6_STATS_INC(nd6.xmit);
1519 
1520   err = ip6_output_if(p, (src_addr == IP6_ADDR_ANY6) ? NULL : src_addr, &multicast_address,
1521       ND6_HOPLIM, 0, IP6_NEXTH_ICMP6, netif);
1522   pbuf_free(p);
1523 
1524   return err;
1525 }
1526 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
1527 
1528 /**
1529  * Search for a neighbor cache entry
1530  *
1531  * @param ip6addr the IPv6 address of the neighbor
1532  * @return The neighbor cache entry index that matched, -1 if no
1533  * entry is found
1534  */
1535 static s8_t
1536 nd6_find_neighbor_cache_entry(const ip6_addr_t *ip6addr)
1537 {
1538   s8_t i;
1539   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1540     if (ip6_addr_eq(ip6addr, &(neighbor_cache[i].next_hop_address))) {
1541       return i;
1542     }
1543   }
1544   return -1;
1545 }
1546 
1547 /**
1548  * Create a new neighbor cache entry.
1549  *
1550  * If no unused entry is found, will try to recycle an old entry
1551  * according to ad-hoc "age" heuristic.
1552  *
1553  * @return The neighbor cache entry index that was created, -1 if no
1554  * entry could be created
1555  */
1556 static s8_t
1557 nd6_new_neighbor_cache_entry(void)
1558 {
1559   s8_t i;
1560   s8_t j;
1561   u32_t time;
1562 
1563 
1564   /* First, try to find an empty entry. */
1565   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1566     if (neighbor_cache[i].state == ND6_NO_ENTRY) {
1567       return i;
1568     }
1569   }
1570 
1571   /* We need to recycle an entry. in general, do not recycle if it is a router. */
1572 
1573   /* Next, try to find a Stale entry. */
1574   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1575     if ((neighbor_cache[i].state == ND6_STALE) &&
1576         (!neighbor_cache[i].isrouter)) {
1577       nd6_free_neighbor_cache_entry(i);
1578       return i;
1579     }
1580   }
1581 
1582   /* Next, try to find a Probe entry. */
1583   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1584     if ((neighbor_cache[i].state == ND6_PROBE) &&
1585         (!neighbor_cache[i].isrouter)) {
1586       nd6_free_neighbor_cache_entry(i);
1587       return i;
1588     }
1589   }
1590 
1591   /* Next, try to find a Delayed entry. */
1592   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1593     if ((neighbor_cache[i].state == ND6_DELAY) &&
1594         (!neighbor_cache[i].isrouter)) {
1595       nd6_free_neighbor_cache_entry(i);
1596       return i;
1597     }
1598   }
1599 
1600   /* Next, try to find the oldest reachable entry. */
1601   time = 0xfffffffful;
1602   j = -1;
1603   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1604     if ((neighbor_cache[i].state == ND6_REACHABLE) &&
1605         (!neighbor_cache[i].isrouter)) {
1606       if (neighbor_cache[i].counter.reachable_time < time) {
1607         j = i;
1608         time = neighbor_cache[i].counter.reachable_time;
1609       }
1610     }
1611   }
1612   if (j >= 0) {
1613     nd6_free_neighbor_cache_entry(j);
1614     return j;
1615   }
1616 
1617   /* Next, find oldest incomplete entry without queued packets. */
1618   time = 0;
1619   j = -1;
1620   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1621     if (
1622         (neighbor_cache[i].q == NULL) &&
1623         (neighbor_cache[i].state == ND6_INCOMPLETE) &&
1624         (!neighbor_cache[i].isrouter)) {
1625       if (neighbor_cache[i].counter.probes_sent >= time) {
1626         j = i;
1627         time = neighbor_cache[i].counter.probes_sent;
1628       }
1629     }
1630   }
1631   if (j >= 0) {
1632     nd6_free_neighbor_cache_entry(j);
1633     return j;
1634   }
1635 
1636   /* Next, find oldest incomplete entry with queued packets. */
1637   time = 0;
1638   j = -1;
1639   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
1640     if ((neighbor_cache[i].state == ND6_INCOMPLETE) &&
1641         (!neighbor_cache[i].isrouter)) {
1642       if (neighbor_cache[i].counter.probes_sent >= time) {
1643         j = i;
1644         time = neighbor_cache[i].counter.probes_sent;
1645       }
1646     }
1647   }
1648   if (j >= 0) {
1649     nd6_free_neighbor_cache_entry(j);
1650     return j;
1651   }
1652 
1653   /* No more entries to try. */
1654   return -1;
1655 }
1656 
1657 /**
1658  * Will free any resources associated with a neighbor cache
1659  * entry, and will mark it as unused.
1660  *
1661  * @param i the neighbor cache entry index to free
1662  */
1663 static void
1664 nd6_free_neighbor_cache_entry(s8_t i)
1665 {
1666   if ((i < 0) || (i >= LWIP_ND6_NUM_NEIGHBORS)) {
1667     return;
1668   }
1669   if (neighbor_cache[i].isrouter) {
1670     /* isrouter needs to be cleared before deleting a neighbor cache entry */
1671     return;
1672   }
1673 
1674   /* Free any queued packets. */
1675   if (neighbor_cache[i].q != NULL) {
1676     nd6_free_q(neighbor_cache[i].q);
1677     neighbor_cache[i].q = NULL;
1678   }
1679 
1680   neighbor_cache[i].state = ND6_NO_ENTRY;
1681   neighbor_cache[i].isrouter = 0;
1682   neighbor_cache[i].netif = NULL;
1683   neighbor_cache[i].counter.reachable_time = 0;
1684   ip6_addr_set_zero(&(neighbor_cache[i].next_hop_address));
1685 }
1686 
1687 /**
1688  * Search for a destination cache entry
1689  *
1690  * @param ip6addr the IPv6 address of the destination
1691  * @return The destination cache entry index that matched, -1 if no
1692  * entry is found
1693  */
1694 static s16_t
1695 nd6_find_destination_cache_entry(const ip6_addr_t *ip6addr)
1696 {
1697   s16_t i;
1698 
1699   IP6_ADDR_ZONECHECK(ip6addr);
1700 
1701   for (i = 0; i < LWIP_ND6_NUM_DESTINATIONS; i++) {
1702     if (ip6_addr_eq(ip6addr, &(destination_cache[i].destination_addr))) {
1703       return i;
1704     }
1705   }
1706   return -1;
1707 }
1708 
1709 /**
1710  * Create a new destination cache entry. If no unused entry is found,
1711  * will recycle oldest entry.
1712  *
1713  * @return The destination cache entry index that was created, -1 if no
1714  * entry was created
1715  */
1716 static s16_t
1717 nd6_new_destination_cache_entry(void)
1718 {
1719   s16_t i, j;
1720   u32_t age;
1721 
1722   /* Find an empty entry. */
1723   for (i = 0; i < LWIP_ND6_NUM_DESTINATIONS; i++) {
1724     if (ip6_addr_isany(&(destination_cache[i].destination_addr))) {
1725       return i;
1726     }
1727   }
1728 
1729   /* Find oldest entry. */
1730   age = 0;
1731   j = LWIP_ND6_NUM_DESTINATIONS - 1;
1732   for (i = 0; i < LWIP_ND6_NUM_DESTINATIONS; i++) {
1733     if (destination_cache[i].age > age) {
1734       j = i;
1735     }
1736   }
1737 
1738   return j;
1739 }
1740 
1741 /**
1742  * Clear the destination cache.
1743  *
1744  * This operation may be necessary for consistency in the light of changing
1745  * local addresses and/or use of the gateway hook.
1746  */
1747 void
1748 nd6_clear_destination_cache(void)
1749 {
1750   int i;
1751 
1752   for (i = 0; i < LWIP_ND6_NUM_DESTINATIONS; i++) {
1753     ip6_addr_set_any(&destination_cache[i].destination_addr);
1754   }
1755 }
1756 
1757 /**
1758  * Determine whether an address matches an on-link prefix or the subnet of a
1759  * statically assigned address.
1760  *
1761  * @param ip6addr the IPv6 address to match
1762  * @return 1 if the address is on-link, 0 otherwise
1763  */
1764 static int
1765 nd6_is_prefix_in_netif(const ip6_addr_t *ip6addr, struct netif *netif)
1766 {
1767   s8_t i;
1768 
1769   /* Check to see if the address matches an on-link prefix. */
1770   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; i++) {
1771     if ((prefix_list[i].netif == netif) &&
1772         (prefix_list[i].invalidation_timer > 0) &&
1773         ip6_addr_net_eq(ip6addr, &(prefix_list[i].prefix))) {
1774       return 1;
1775     }
1776   }
1777   /* Check to see if address prefix matches a manually configured (= static)
1778    * address. Static addresses have an implied /64 subnet assignment. Dynamic
1779    * addresses (from autoconfiguration) have no implied subnet assignment, and
1780    * are thus effectively /128 assignments. See RFC 5942 for more on this. */
1781   for (i = 0; i < LWIP_IPV6_NUM_ADDRESSES; i++) {
1782     if (ip6_addr_isvalid(netif_ip6_addr_state(netif, i)) &&
1783         netif_ip6_addr_isstatic(netif, i) &&
1784         ip6_addr_net_eq(ip6addr, netif_ip6_addr(netif, i))) {
1785       return 1;
1786     }
1787   }
1788   return 0;
1789 }
1790 
1791 /**
1792  * Select a default router for a destination.
1793  *
1794  * This function is used both for routing and for finding a next-hop target for
1795  * a packet. In the former case, the given netif is NULL, and the returned
1796  * router entry must be for a netif suitable for sending packets (up, link up).
1797  * In the latter case, the given netif is not NULL and restricts router choice.
1798  *
1799  * @param ip6addr the destination address
1800  * @param netif the netif for the outgoing packet, if known
1801  * @return the default router entry index, or -1 if no suitable
1802  *         router is found
1803  */
1804 static s8_t
1805 nd6_select_router(const ip6_addr_t *ip6addr, struct netif *netif)
1806 {
1807   struct netif *router_netif;
1808   s8_t i, j, valid_router;
1809   static s8_t last_router;
1810 
1811   LWIP_UNUSED_ARG(ip6addr); /* @todo match preferred routes!! (must implement ND6_OPTION_TYPE_ROUTE_INFO) */
1812 
1813   /* @todo: implement default router preference */
1814 
1815   /* Look for valid routers. A reachable router is preferred. */
1816   valid_router = -1;
1817   for (i = 0; i < LWIP_ND6_NUM_ROUTERS; i++) {
1818     /* Is the router netif both set and appropriate? */
1819     if (default_router_list[i].neighbor_entry != NULL) {
1820       router_netif = default_router_list[i].neighbor_entry->netif;
1821       if ((router_netif != NULL) && (netif != NULL ? netif == router_netif :
1822           (netif_is_up(router_netif) && netif_is_link_up(router_netif)))) {
1823         /* Is the router valid, i.e., reachable or probably reachable as per
1824          * RFC 4861 Sec. 6.3.6? Note that we will never return a router that
1825          * has no neighbor cache entry, due to the netif association tests. */
1826         if (default_router_list[i].neighbor_entry->state != ND6_INCOMPLETE) {
1827           /* Is the router known to be reachable? */
1828           if (default_router_list[i].neighbor_entry->state == ND6_REACHABLE) {
1829             return i; /* valid and reachable - done! */
1830           } else if (valid_router < 0) {
1831             valid_router = i; /* valid but not known to be reachable */
1832           }
1833         }
1834       }
1835     }
1836   }
1837   if (valid_router >= 0) {
1838     return valid_router;
1839   }
1840 
1841   /* Look for any router for which we have any information at all. */
1842   /* last_router is used for round-robin selection of incomplete routers, as
1843    * recommended in RFC 4861 Sec. 6.3.6 point (2). Advance only when picking a
1844    * route, to select the same router as next-hop target in the common case. */
1845   if ((netif == NULL) && (++last_router >= LWIP_ND6_NUM_ROUTERS)) {
1846     last_router = 0;
1847   }
1848   i = last_router;
1849   for (j = 0; j < LWIP_ND6_NUM_ROUTERS; j++) {
1850     if (default_router_list[i].neighbor_entry != NULL) {
1851       router_netif = default_router_list[i].neighbor_entry->netif;
1852       if ((router_netif != NULL) && (netif != NULL ? netif == router_netif :
1853           (netif_is_up(router_netif) && netif_is_link_up(router_netif)))) {
1854         return i;
1855       }
1856     }
1857     if (++i >= LWIP_ND6_NUM_ROUTERS) {
1858       i = 0;
1859     }
1860   }
1861 
1862   /* no suitable router found. */
1863   return -1;
1864 }
1865 
1866 /**
1867  * Find a router-announced route to the given destination. This route may be
1868  * based on an on-link prefix or a default router.
1869  *
1870  * If a suitable route is found, the returned netif is guaranteed to be in a
1871  * suitable state (up, link up) to be used for packet transmission.
1872  *
1873  * @param ip6addr the destination IPv6 address
1874  * @return the netif to use for the destination, or NULL if none found
1875  */
1876 struct netif *
1877 nd6_find_route(const ip6_addr_t *ip6addr)
1878 {
1879   struct netif *netif;
1880   s8_t i;
1881 
1882   /* @todo decide if it makes sense to check the destination cache first */
1883 
1884   /* Check if there is a matching on-link prefix. There may be multiple
1885    * matches. Pick the first one that is associated with a suitable netif. */
1886   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; ++i) {
1887     netif = prefix_list[i].netif;
1888     if ((netif != NULL) && ip6_addr_net_eq(&prefix_list[i].prefix, ip6addr) &&
1889         netif_is_up(netif) && netif_is_link_up(netif)) {
1890       return netif;
1891     }
1892   }
1893 
1894   /* No on-link prefix match. Find a router that can forward the packet. */
1895   i = nd6_select_router(ip6addr, NULL);
1896   if (i >= 0) {
1897     LWIP_ASSERT("selected router must have a neighbor entry",
1898       default_router_list[i].neighbor_entry != NULL);
1899     return default_router_list[i].neighbor_entry->netif;
1900   }
1901 
1902   return NULL;
1903 }
1904 
1905 /**
1906  * Find an entry for a default router.
1907  *
1908  * @param router_addr the IPv6 address of the router
1909  * @param netif the netif on which the router is found, if known
1910  * @return the index of the router entry, or -1 if not found
1911  */
1912 static s8_t
1913 nd6_get_router(const ip6_addr_t *router_addr, struct netif *netif)
1914 {
1915   s8_t i;
1916 
1917   IP6_ADDR_ZONECHECK_NETIF(router_addr, netif);
1918 
1919   /* Look for router. */
1920   for (i = 0; i < LWIP_ND6_NUM_ROUTERS; i++) {
1921     if ((default_router_list[i].neighbor_entry != NULL) &&
1922         ((netif != NULL) ? netif == default_router_list[i].neighbor_entry->netif : 1) &&
1923         ip6_addr_eq(router_addr, &(default_router_list[i].neighbor_entry->next_hop_address))) {
1924       return i;
1925     }
1926   }
1927 
1928   /* router not found. */
1929   return -1;
1930 }
1931 
1932 /**
1933  * Create a new entry for a default router.
1934  *
1935  * @param router_addr the IPv6 address of the router
1936  * @param netif the netif on which the router is connected, if known
1937  * @return the index on the router table, or -1 if could not be created
1938  */
1939 static s8_t
1940 nd6_new_router(const ip6_addr_t *router_addr, struct netif *netif)
1941 {
1942   s8_t router_index;
1943   s8_t free_router_index;
1944   s8_t neighbor_index;
1945 
1946   IP6_ADDR_ZONECHECK_NETIF(router_addr, netif);
1947 
1948   /* Do we have a neighbor entry for this router? */
1949   neighbor_index = nd6_find_neighbor_cache_entry(router_addr);
1950   if (neighbor_index < 0) {
1951     /* Create a neighbor entry for this router. */
1952     neighbor_index = nd6_new_neighbor_cache_entry();
1953     if (neighbor_index < 0) {
1954       /* Could not create neighbor entry for this router. */
1955       return -1;
1956     }
1957     ip6_addr_set(&(neighbor_cache[neighbor_index].next_hop_address), router_addr);
1958     neighbor_cache[neighbor_index].netif = netif;
1959     neighbor_cache[neighbor_index].q = NULL;
1960     neighbor_cache[neighbor_index].state = ND6_INCOMPLETE;
1961     neighbor_cache[neighbor_index].counter.probes_sent = 1;
1962     nd6_send_neighbor_cache_probe(&neighbor_cache[neighbor_index], ND6_SEND_FLAG_MULTICAST_DEST);
1963   }
1964 
1965   /* Mark neighbor as router. */
1966   neighbor_cache[neighbor_index].isrouter = 1;
1967 
1968   /* Look for empty entry. */
1969   free_router_index = LWIP_ND6_NUM_ROUTERS;
1970   for (router_index = LWIP_ND6_NUM_ROUTERS - 1; router_index >= 0; router_index--) {
1971     /* check if router already exists (this is a special case for 2 netifs on the same subnet
1972        - e.g. wifi and cable) */
1973     if(default_router_list[router_index].neighbor_entry == &(neighbor_cache[neighbor_index])){
1974       return router_index;
1975     }
1976     if (default_router_list[router_index].neighbor_entry == NULL) {
1977       /* remember lowest free index to create a new entry */
1978       free_router_index = router_index;
1979     }
1980   }
1981   if (free_router_index < LWIP_ND6_NUM_ROUTERS) {
1982     default_router_list[free_router_index].neighbor_entry = &(neighbor_cache[neighbor_index]);
1983     return free_router_index;
1984   }
1985 
1986   /* Could not create a router entry. */
1987 
1988   /* Mark neighbor entry as not-router. Entry might be useful as neighbor still. */
1989   neighbor_cache[neighbor_index].isrouter = 0;
1990 
1991   /* router not found. */
1992   return -1;
1993 }
1994 
1995 /**
1996  * Find the cached entry for an on-link prefix.
1997  *
1998  * @param prefix the IPv6 prefix that is on-link
1999  * @param netif the netif on which the prefix is on-link
2000  * @return the index on the prefix table, or -1 if not found
2001  */
2002 static s8_t
2003 nd6_get_onlink_prefix(const ip6_addr_t *prefix, struct netif *netif)
2004 {
2005   s8_t i;
2006 
2007   /* Look for prefix in list. */
2008   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; ++i) {
2009     if ((ip6_addr_net_eq(&(prefix_list[i].prefix), prefix)) &&
2010         (prefix_list[i].netif == netif)) {
2011       return i;
2012     }
2013   }
2014 
2015   /* Entry not available. */
2016   return -1;
2017 }
2018 
2019 /**
2020  * Creates a new entry for an on-link prefix.
2021  *
2022  * @param prefix the IPv6 prefix that is on-link
2023  * @param netif the netif on which the prefix is on-link
2024  * @return the index on the prefix table, or -1 if not created
2025  */
2026 static s8_t
2027 nd6_new_onlink_prefix(const ip6_addr_t *prefix, struct netif *netif)
2028 {
2029   s8_t i;
2030 
2031   /* Create new entry. */
2032   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; ++i) {
2033     if ((prefix_list[i].netif == NULL) ||
2034         (prefix_list[i].invalidation_timer == 0)) {
2035       /* Found empty prefix entry. */
2036       prefix_list[i].netif = netif;
2037       ip6_addr_set(&(prefix_list[i].prefix), prefix);
2038       return i;
2039     }
2040   }
2041 
2042   /* Entry not available. */
2043   return -1;
2044 }
2045 
2046 /**
2047  * Determine the next hop for a destination. Will determine if the
2048  * destination is on-link, else a suitable on-link router is selected.
2049  *
2050  * The last entry index is cached for fast entry search.
2051  *
2052  * @param ip6addr the destination address
2053  * @param netif the netif on which the packet will be sent
2054  * @return the neighbor cache entry for the next hop, ERR_RTE if no
2055  *         suitable next hop was found, ERR_MEM if no cache entry
2056  *         could be created
2057  */
2058 static s8_t
2059 nd6_get_next_hop_entry(const ip6_addr_t *ip6addr, struct netif *netif)
2060 {
2061 #ifdef LWIP_HOOK_ND6_GET_GW
2062   const ip6_addr_t *next_hop_addr;
2063 #endif /* LWIP_HOOK_ND6_GET_GW */
2064   s8_t i;
2065   s16_t dst_idx;
2066   struct nd6_destination_cache_entry *dest;
2067 
2068   IP6_ADDR_ZONECHECK_NETIF(ip6addr, netif);
2069 
2070 #if LWIP_NETIF_HWADDRHINT
2071   if (netif->hints != NULL) {
2072     /* per-pcb cached entry was given */
2073     netif_addr_idx_t addr_hint = netif->hints->addr_hint;
2074     if (addr_hint < LWIP_ND6_NUM_DESTINATIONS) {
2075       nd6_cached_destination_index = addr_hint;
2076     }
2077   }
2078 #endif /* LWIP_NETIF_HWADDRHINT */
2079 
2080   LWIP_ASSERT("sane cache index", nd6_cached_destination_index < LWIP_ND6_NUM_DESTINATIONS);
2081 
2082   /* Look for ip6addr in destination cache. */
2083   dest = &destination_cache[nd6_cached_destination_index];
2084   if (ip6_addr_eq(ip6addr, &dest->destination_addr)) {
2085     /* the cached entry index is the right one! */
2086     /* do nothing. */
2087     ND6_STATS_INC(nd6.cachehit);
2088   } else {
2089     /* Search destination cache. */
2090     dst_idx = nd6_find_destination_cache_entry(ip6addr);
2091     if (dst_idx >= 0) {
2092       /* found destination entry. make it our new cached index. */
2093       LWIP_ASSERT("type overflow", (size_t)dst_idx < NETIF_ADDR_IDX_MAX);
2094       nd6_cached_destination_index = (netif_addr_idx_t)dst_idx;
2095       dest = &destination_cache[dst_idx];
2096     } else {
2097       /* Not found. Create a new destination entry. */
2098       dst_idx = nd6_new_destination_cache_entry();
2099       if (dst_idx >= 0) {
2100         /* got new destination entry. make it our new cached index. */
2101         LWIP_ASSERT("type overflow", (size_t)dst_idx < NETIF_ADDR_IDX_MAX);
2102         nd6_cached_destination_index = (netif_addr_idx_t)dst_idx;
2103         dest = &destination_cache[dst_idx];
2104       } else {
2105         /* Could not create a destination cache entry. */
2106         return ERR_MEM;
2107       }
2108 
2109       /* Copy dest address to destination cache. */
2110       ip6_addr_set(&dest->destination_addr, ip6addr);
2111 
2112       /* Now find the next hop. is it a neighbor? */
2113       if (ip6_addr_islinklocal(ip6addr) ||
2114           nd6_is_prefix_in_netif(ip6addr, netif)) {
2115         /* Destination in local link. */
2116         dest->pmtu = netif_mtu6(netif);
2117         ip6_addr_copy(dest->next_hop_addr, dest->destination_addr);
2118 #ifdef LWIP_HOOK_ND6_GET_GW
2119       } else if ((next_hop_addr = LWIP_HOOK_ND6_GET_GW(netif, ip6addr)) != NULL) {
2120         /* Next hop for destination provided by hook function. */
2121         dest->pmtu = netif->mtu;
2122         ip6_addr_set(&dest->next_hop_addr, next_hop_addr);
2123 #endif /* LWIP_HOOK_ND6_GET_GW */
2124       } else {
2125         /* We need to select a router. */
2126         i = nd6_select_router(ip6addr, netif);
2127         if (i < 0) {
2128           /* No router found. */
2129           ip6_addr_set_any(&dest->destination_addr);
2130           return ERR_RTE;
2131         }
2132         dest->pmtu = netif_mtu6(netif); /* Start with netif mtu, correct through ICMPv6 if necessary */
2133         ip6_addr_copy(dest->next_hop_addr, default_router_list[i].neighbor_entry->next_hop_address);
2134       }
2135     }
2136 #if LWIP_NETIF_HWADDRHINT
2137     if (netif->hints != NULL) {
2138       /* per-pcb cached entry was given */
2139       netif->hints->addr_hint = nd6_cached_destination_index;
2140     }
2141 #endif /* LWIP_NETIF_HWADDRHINT */
2142   }
2143 
2144   /* Look in neighbor cache for the next-hop address. */
2145   if (ip6_addr_eq(&dest->next_hop_addr,
2146                    &(neighbor_cache[dest->cached_neighbor_idx].next_hop_address))) {
2147     /* Cache hit. */
2148     /* Do nothing. */
2149     ND6_STATS_INC(nd6.cachehit);
2150   } else {
2151     i = nd6_find_neighbor_cache_entry(&dest->next_hop_addr);
2152     if (i >= 0) {
2153       /* Found a matching record, make it new cached entry. */
2154       dest->cached_neighbor_idx = i;
2155     } else {
2156       /* Neighbor not in cache. Make a new entry. */
2157       i = nd6_new_neighbor_cache_entry();
2158       if (i >= 0) {
2159         /* got new neighbor entry. make it our new cached index. */
2160         dest->cached_neighbor_idx = i;
2161       } else {
2162         /* Could not create a neighbor cache entry. */
2163         return ERR_MEM;
2164       }
2165 
2166       /* Initialize fields. */
2167       ip6_addr_copy(neighbor_cache[i].next_hop_address, dest->next_hop_addr);
2168       neighbor_cache[i].isrouter = 0;
2169       neighbor_cache[i].netif = netif;
2170       neighbor_cache[i].state = ND6_INCOMPLETE;
2171       neighbor_cache[i].counter.probes_sent = 1;
2172       nd6_send_neighbor_cache_probe(&neighbor_cache[i], ND6_SEND_FLAG_MULTICAST_DEST);
2173     }
2174   }
2175 
2176   /* Reset this destination's age. */
2177   dest->age = 0;
2178 
2179   return dest->cached_neighbor_idx;
2180 }
2181 
2182 /**
2183  * Queue a packet for a neighbor.
2184  *
2185  * @param neighbor_index the index in the neighbor cache table
2186  * @param q packet to be queued
2187  * @return ERR_OK if succeeded, ERR_MEM if out of memory
2188  */
2189 static err_t
2190 nd6_queue_packet(s8_t neighbor_index, struct pbuf *q)
2191 {
2192   err_t result = ERR_MEM;
2193   struct pbuf *p;
2194   int copy_needed = 0;
2195 #if LWIP_ND6_QUEUEING
2196   struct nd6_q_entry *new_entry, *r;
2197 #endif /* LWIP_ND6_QUEUEING */
2198 
2199   if ((neighbor_index < 0) || (neighbor_index >= LWIP_ND6_NUM_NEIGHBORS)) {
2200     return ERR_ARG;
2201   }
2202 
2203   /* IF q includes a pbuf that must be copied, we have to copy the whole chain
2204    * into a new PBUF_RAM. See the definition of PBUF_NEEDS_COPY for details. */
2205   p = q;
2206   while (p) {
2207     if (PBUF_NEEDS_COPY(p)) {
2208       copy_needed = 1;
2209       break;
2210     }
2211     p = p->next;
2212   }
2213   if (copy_needed) {
2214     /* copy the whole packet into new pbufs */
2215     p = pbuf_clone(PBUF_LINK, PBUF_RAM, q);
2216     while ((p == NULL) && (neighbor_cache[neighbor_index].q != NULL)) {
2217       /* Free oldest packet (as per RFC recommendation) */
2218 #if LWIP_ND6_QUEUEING
2219       r = neighbor_cache[neighbor_index].q;
2220       neighbor_cache[neighbor_index].q = r->next;
2221       r->next = NULL;
2222       nd6_free_q(r);
2223 #else /* LWIP_ND6_QUEUEING */
2224       pbuf_free(neighbor_cache[neighbor_index].q);
2225       neighbor_cache[neighbor_index].q = NULL;
2226 #endif /* LWIP_ND6_QUEUEING */
2227       p = pbuf_clone(PBUF_LINK, PBUF_RAM, q);
2228     }
2229   } else {
2230     /* referencing the old pbuf is enough */
2231     p = q;
2232     pbuf_ref(p);
2233   }
2234   /* packet was copied/ref'd? */
2235   if (p != NULL) {
2236     /* queue packet ... */
2237 #if LWIP_ND6_QUEUEING
2238     /* allocate a new nd6 queue entry */
2239     new_entry = NULL;
2240     if (nd6_queue_size < MEMP_NUM_ND6_QUEUE) {
2241       new_entry = (struct nd6_q_entry *)memp_malloc(MEMP_ND6_QUEUE);
2242       nd6_queue_size++;
2243     }
2244     if ((new_entry == NULL) && (neighbor_cache[neighbor_index].q != NULL)) {
2245       /* Free oldest packet (as per RFC recommendation) */
2246       r = neighbor_cache[neighbor_index].q;
2247       neighbor_cache[neighbor_index].q = r->next;
2248       r->next = NULL;
2249       nd6_free_q(r);
2250       new_entry = (struct nd6_q_entry *)memp_malloc(MEMP_ND6_QUEUE);
2251       nd6_queue_size++;
2252     }
2253     if (new_entry != NULL) {
2254       new_entry->next = NULL;
2255       new_entry->p = p;
2256       if (neighbor_cache[neighbor_index].q != NULL) {
2257         /* queue was already existent, append the new entry to the end */
2258         r = neighbor_cache[neighbor_index].q;
2259         while (r->next != NULL) {
2260           r = r->next;
2261         }
2262         r->next = new_entry;
2263       } else {
2264         /* queue did not exist, first item in queue */
2265         neighbor_cache[neighbor_index].q = new_entry;
2266       }
2267       LWIP_DEBUGF(LWIP_DBG_TRACE, ("ipv6: queued packet %p on neighbor entry %"S16_F"\n", (void *)p, (s16_t)neighbor_index));
2268       result = ERR_OK;
2269     } else {
2270       /* the pool MEMP_ND6_QUEUE is empty */
2271       pbuf_free(p);
2272       LWIP_DEBUGF(LWIP_DBG_TRACE, ("ipv6: could not queue a copy of packet %p (out of memory)\n", (void *)p));
2273       /* { result == ERR_MEM } through initialization */
2274     }
2275 #else /* LWIP_ND6_QUEUEING */
2276     /* Queue a single packet. If an older packet is already queued, free it as per RFC. */
2277     if (neighbor_cache[neighbor_index].q != NULL) {
2278       pbuf_free(neighbor_cache[neighbor_index].q);
2279     }
2280     neighbor_cache[neighbor_index].q = p;
2281     LWIP_DEBUGF(LWIP_DBG_TRACE, ("ipv6: queued packet %p on neighbor entry %"S16_F"\n", (void *)p, (s16_t)neighbor_index));
2282     result = ERR_OK;
2283 #endif /* LWIP_ND6_QUEUEING */
2284   } else {
2285     LWIP_DEBUGF(LWIP_DBG_TRACE, ("ipv6: could not queue a copy of packet %p (out of memory)\n", (void *)q));
2286     /* { result == ERR_MEM } through initialization */
2287   }
2288 
2289   return result;
2290 }
2291 
2292 #if LWIP_ND6_QUEUEING
2293 /**
2294  * Free a complete queue of nd6 q entries
2295  *
2296  * @param q a queue of nd6_q_entry to free
2297  */
2298 static void
2299 nd6_free_q(struct nd6_q_entry *q)
2300 {
2301   struct nd6_q_entry *r;
2302   LWIP_ASSERT("q != NULL", q != NULL);
2303   LWIP_ASSERT("q->p != NULL", q->p != NULL);
2304   while (q) {
2305     r = q;
2306     q = q->next;
2307     LWIP_ASSERT("r->p != NULL", (r->p != NULL));
2308     pbuf_free(r->p);
2309     memp_free(MEMP_ND6_QUEUE, r);
2310     nd6_queue_size--;
2311   }
2312 }
2313 #endif /* LWIP_ND6_QUEUEING */
2314 
2315 /**
2316  * Send queued packets for a neighbor
2317  *
2318  * @param i the neighbor to send packets to
2319  */
2320 static void
2321 nd6_send_q(s8_t i)
2322 {
2323   struct ip6_hdr *ip6hdr;
2324   ip6_addr_t dest;
2325 #if LWIP_ND6_QUEUEING
2326   struct nd6_q_entry *q;
2327 #endif /* LWIP_ND6_QUEUEING */
2328 
2329   if ((i < 0) || (i >= LWIP_ND6_NUM_NEIGHBORS)) {
2330     return;
2331   }
2332 
2333 #if LWIP_ND6_QUEUEING
2334   while (neighbor_cache[i].q != NULL) {
2335     /* remember first in queue */
2336     q = neighbor_cache[i].q;
2337     /* pop first item off the queue */
2338     neighbor_cache[i].q = q->next;
2339     /* Get ipv6 header. */
2340     ip6hdr = (struct ip6_hdr *)(q->p->payload);
2341     /* Create an aligned copy. */
2342     ip6_addr_copy_from_packed(dest, ip6hdr->dest);
2343     /* Restore the zone, if applicable. */
2344     ip6_addr_assign_zone(&dest, IP6_UNKNOWN, neighbor_cache[i].netif);
2345     /* send the queued IPv6 packet */
2346     (neighbor_cache[i].netif)->output_ip6(neighbor_cache[i].netif, q->p, &dest);
2347     /* free the queued IP packet */
2348     pbuf_free(q->p);
2349     /* now queue entry can be freed */
2350     memp_free(MEMP_ND6_QUEUE, q);
2351     nd6_queue_size--;
2352   }
2353 #else /* LWIP_ND6_QUEUEING */
2354   if (neighbor_cache[i].q != NULL) {
2355     /* Get ipv6 header. */
2356     ip6hdr = (struct ip6_hdr *)(neighbor_cache[i].q->payload);
2357     /* Create an aligned copy. */
2358     ip6_addr_copy_from_packed(dest, ip6hdr->dest);
2359     /* Restore the zone, if applicable. */
2360     ip6_addr_assign_zone(&dest, IP6_UNKNOWN, neighbor_cache[i].netif);
2361     /* send the queued IPv6 packet */
2362     (neighbor_cache[i].netif)->output_ip6(neighbor_cache[i].netif, neighbor_cache[i].q, &dest);
2363     /* free the queued IP packet */
2364     pbuf_free(neighbor_cache[i].q);
2365     neighbor_cache[i].q = NULL;
2366   }
2367 #endif /* LWIP_ND6_QUEUEING */
2368 }
2369 
2370 /**
2371  * A packet is to be transmitted to a specific IPv6 destination on a specific
2372  * interface. Check if we can find the hardware address of the next hop to use
2373  * for the packet. If so, give the hardware address to the caller, which should
2374  * use it to send the packet right away. Otherwise, enqueue the packet for
2375  * later transmission while looking up the hardware address, if possible.
2376  *
2377  * As such, this function returns one of three different possible results:
2378  *
2379  * - ERR_OK with a non-NULL 'hwaddrp': the caller should send the packet now.
2380  * - ERR_OK with a NULL 'hwaddrp': the packet has been enqueued for later.
2381  * - not ERR_OK: something went wrong; forward the error upward in the stack.
2382  *
2383  * @param netif The lwIP network interface on which the IP packet will be sent.
2384  * @param q The pbuf(s) containing the IP packet to be sent.
2385  * @param ip6addr The destination IPv6 address of the packet.
2386  * @param hwaddrp On success, filled with a pointer to a HW address or NULL (meaning
2387  *        the packet has been queued).
2388  * @return
2389  * - ERR_OK on success, ERR_RTE if no route was found for the packet,
2390  * or ERR_MEM if low memory conditions prohibit sending the packet at all.
2391  */
2392 err_t
2393 nd6_get_next_hop_addr_or_queue(struct netif *netif, struct pbuf *q, const ip6_addr_t *ip6addr, const u8_t **hwaddrp)
2394 {
2395   s8_t i;
2396 
2397   /* Get next hop record. */
2398   i = nd6_get_next_hop_entry(ip6addr, netif);
2399   if (i < 0) {
2400     /* failed to get a next hop neighbor record. */
2401     return i;
2402   }
2403 
2404   /* Now that we have a destination record, send or queue the packet. */
2405   if (neighbor_cache[i].state == ND6_STALE) {
2406     /* Switch to delay state. */
2407     neighbor_cache[i].state = ND6_DELAY;
2408     neighbor_cache[i].counter.delay_time = LWIP_ND6_DELAY_FIRST_PROBE_TIME / ND6_TMR_INTERVAL;
2409   }
2410   /* @todo should we send or queue if PROBE? send for now, to let unicast NS pass. */
2411   if ((neighbor_cache[i].state == ND6_REACHABLE) ||
2412       (neighbor_cache[i].state == ND6_DELAY) ||
2413       (neighbor_cache[i].state == ND6_PROBE)) {
2414 
2415     /* Tell the caller to send out the packet now. */
2416     *hwaddrp = neighbor_cache[i].lladdr;
2417     return ERR_OK;
2418   }
2419 
2420   /* We should queue packet on this interface. */
2421   *hwaddrp = NULL;
2422   return nd6_queue_packet(i, q);
2423 }
2424 
2425 
2426 /**
2427  * Get the Path MTU for a destination.
2428  *
2429  * @param ip6addr the destination address
2430  * @param netif the netif on which the packet will be sent
2431  * @return the Path MTU, if known, or the netif default MTU
2432  */
2433 u16_t
2434 nd6_get_destination_mtu(const ip6_addr_t *ip6addr, struct netif *netif)
2435 {
2436   s16_t i;
2437 
2438   i = nd6_find_destination_cache_entry(ip6addr);
2439   if (i >= 0) {
2440     if (destination_cache[i].pmtu > 0) {
2441       return destination_cache[i].pmtu;
2442     }
2443   }
2444 
2445   if (netif != NULL) {
2446     return netif_mtu6(netif);
2447   }
2448 
2449   return IP6_MIN_MTU_LENGTH; /* Minimum MTU */
2450 }
2451 
2452 
2453 #if LWIP_ND6_TCP_REACHABILITY_HINTS
2454 /**
2455  * Provide the Neighbor discovery process with a hint that a
2456  * destination is reachable. Called by tcp_receive when ACKs are
2457  * received or sent (as per RFC). This is useful to avoid sending
2458  * NS messages every 30 seconds.
2459  *
2460  * @param ip6addr the destination address which is know to be reachable
2461  *                by an upper layer protocol (TCP)
2462  */
2463 void
2464 nd6_reachability_hint(const ip6_addr_t *ip6addr)
2465 {
2466   s8_t i;
2467   s16_t dst_idx;
2468   struct nd6_destination_cache_entry *dest;
2469 
2470   /* Find destination in cache. */
2471   if (ip6_addr_eq(ip6addr, &(destination_cache[nd6_cached_destination_index].destination_addr))) {
2472     dst_idx = nd6_cached_destination_index;
2473     ND6_STATS_INC(nd6.cachehit);
2474   } else {
2475     dst_idx = nd6_find_destination_cache_entry(ip6addr);
2476   }
2477   if (dst_idx < 0) {
2478     return;
2479   }
2480 
2481   /* Find next hop neighbor in cache. */
2482   dest = &destination_cache[dst_idx];
2483   if (ip6_addr_eq(&dest->next_hop_addr, &(neighbor_cache[dest->cached_neighbor_idx].next_hop_address))) {
2484     i = dest->cached_neighbor_idx;
2485     ND6_STATS_INC(nd6.cachehit);
2486   } else {
2487     i = nd6_find_neighbor_cache_entry(&dest->next_hop_addr);
2488   }
2489   if (i < 0) {
2490     return;
2491   }
2492 
2493   /* For safety: don't set as reachable if we don't have a LL address yet. Misuse protection. */
2494   if (neighbor_cache[i].state == ND6_INCOMPLETE || neighbor_cache[i].state == ND6_NO_ENTRY) {
2495     return;
2496   }
2497 
2498   /* Set reachability state. */
2499   neighbor_cache[i].state = ND6_REACHABLE;
2500   neighbor_cache[i].counter.reachable_time = reachable_time;
2501 }
2502 #endif /* LWIP_ND6_TCP_REACHABILITY_HINTS */
2503 
2504 /**
2505  * Remove all prefix, neighbor_cache and router entries of the specified netif.
2506  *
2507  * @param netif points to a network interface
2508  */
2509 void
2510 nd6_cleanup_netif(struct netif *netif)
2511 {
2512   u8_t i;
2513   s8_t router_index;
2514   for (i = 0; i < LWIP_ND6_NUM_PREFIXES; i++) {
2515     if (prefix_list[i].netif == netif) {
2516       prefix_list[i].netif = NULL;
2517     }
2518   }
2519   for (i = 0; i < LWIP_ND6_NUM_NEIGHBORS; i++) {
2520     if (neighbor_cache[i].netif == netif) {
2521       for (router_index = 0; router_index < LWIP_ND6_NUM_ROUTERS; router_index++) {
2522         if (default_router_list[router_index].neighbor_entry == &neighbor_cache[i]) {
2523           default_router_list[router_index].neighbor_entry = NULL;
2524           default_router_list[router_index].flags = 0;
2525         }
2526       }
2527       neighbor_cache[i].isrouter = 0;
2528       nd6_free_neighbor_cache_entry(i);
2529     }
2530   }
2531   /* Clear the destination cache, since many entries may now have become
2532    * invalid for one of several reasons. As destination cache entries have no
2533    * netif association, use a sledgehammer approach (this can be improved). */
2534   nd6_clear_destination_cache();
2535 }
2536 
2537 #if LWIP_IPV6_MLD
2538 /**
2539  * The state of a local IPv6 address entry is about to change. If needed, join
2540  * or leave the solicited-node multicast group for the address.
2541  *
2542  * @param netif The netif that owns the address.
2543  * @param addr_idx The index of the address.
2544  * @param new_state The new (IP6_ADDR_) state for the address.
2545  */
2546 void
2547 nd6_adjust_mld_membership(struct netif *netif, s8_t addr_idx, u8_t new_state)
2548 {
2549   u8_t old_state, old_member, new_member;
2550 
2551   old_state = netif_ip6_addr_state(netif, addr_idx);
2552 
2553   /* Determine whether we were, and should be, a member of the solicited-node
2554    * multicast group for this address. For tentative addresses, the group is
2555    * not joined until the address enters the TENTATIVE_1 (or VALID) state. */
2556   old_member = (old_state != IP6_ADDR_INVALID && old_state != IP6_ADDR_DUPLICATED && old_state != IP6_ADDR_TENTATIVE);
2557   new_member = (new_state != IP6_ADDR_INVALID && new_state != IP6_ADDR_DUPLICATED && new_state != IP6_ADDR_TENTATIVE);
2558 
2559   if (old_member != new_member) {
2560     ip6_addr_set_solicitednode(&multicast_address, netif_ip6_addr(netif, addr_idx)->addr[3]);
2561     ip6_addr_assign_zone(&multicast_address, IP6_MULTICAST, netif);
2562 
2563     if (new_member) {
2564       mld6_joingroup_netif(netif, &multicast_address);
2565     } else {
2566       mld6_leavegroup_netif(netif, &multicast_address);
2567     }
2568   }
2569 }
2570 #endif /* LWIP_IPV6_MLD */
2571 
2572 /** Netif was added, set up, or reconnected (link up) */
2573 void
2574 nd6_restart_netif(struct netif *netif)
2575 {
2576 #if LWIP_IPV6_SEND_ROUTER_SOLICIT
2577   /* Send Router Solicitation messages (see RFC 4861, ch. 6.3.7). */
2578   netif->rs_count = LWIP_ND6_MAX_MULTICAST_SOLICIT;
2579 #endif /* LWIP_IPV6_SEND_ROUTER_SOLICIT */
2580 }
2581 
2582 #endif /* LWIP_IPV6 */
2583