 @@ -1,14 +1,14 @@
-/*	$NetBSD: nd6.c,v 1.262 2019/09/01 18:54:38 roy Exp $	*/
+/*	$NetBSD: nd6.c,v 1.263 2019/09/01 19:26:21 roy Exp $	*/
 /*	$KAME: nd6.c,v 1.279 2002/06/08 11:16:51 itojun Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
 @@ -21,27 +21,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.262 2019/09/01 18:54:38 roy Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd6.c,v 1.263 2019/09/01 19:26:21 roy Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_net_mpsafe.h"
 #endif
 #include "bridge.h"
 #include "carp.h"
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/callout.h>
 #include <sys/kmem.h>
 #include <sys/mbuf.h>
 @@ -470,55 +470,68 @@ nd6_llinfo_timer(void *arg)
 	if ((ln->la_flags & LLE_LINKED) == 0)
 		goto out;
 	if (ln->ln_ntick > 0) {
 		nd6_llinfo_settimer(ln, ln->ln_ntick);
 		goto out;
+	}
 	ifp = ln->lle_tbl->llt_ifp;
 	KASSERT(ifp != NULL);
 	ndi = ND_IFINFO(ifp);
 	switch (ln->ln_state) {
 	case ND6_LLINFO_WAITDELETE:
 		LLE_REMREF(ln);
 		nd6_free(ln, 0);
 		ln = NULL;
 		break;
 	case ND6_LLINFO_INCOMPLETE:
-		if (ln->ln_asked < nd6_mmaxtries) {
+		if (ln->ln_asked++ < nd6_mmaxtries) {
 			ln->ln_asked++;
 			send_ns = true;
 			break;
+		}
 		if (ln->ln_hold) {
 			struct mbuf *m = ln->ln_hold, *m0;
 			/*
 			 * assuming every packet in ln_hold has
 			 * the same IP header
 			 */
 			m0 = m->m_nextpkt;
 			m->m_nextpkt = NULL;
 			ln->ln_hold = m0;
 			clear_llinfo_pqueue(ln);
 			icmp6_error2(m, ICMP6_DST_UNREACH,
 			    ICMP6_DST_UNREACH_ADDR, 0, ifp);
+		}
 		sockaddr_in6_init(&sin6, taddr6, 0, 0, 0);
 		rt_clonedmsg(RTM_MISS, sin6tosa(&sin6), NULL, ifp);
-		LLE_REMREF(ln);
+		/*
-		nd6_free(ln, 0);
+		 * Move to the ND6_LLINFO_WAITDELETE state for another
-		ln = NULL;
+		 * interval at which point the llentry will be freed
 		 * unless it's attempted to be used again and we'll
 		 * resend NS again, rinse and repeat.
 		 */
 		ln->ln_state = ND6_LLINFO_WAITDELETE;
 		if (ln->ln_asked == nd6_mmaxtries)
 			nd6_llinfo_settimer(ln, ndi->retrans * hz / 1000);
 		else
 			send_ns = true;
 		break;
 	case ND6_LLINFO_REACHABLE:
 		if (!ND6_LLINFO_PERMANENT(ln)) {
 			ln->ln_state = ND6_LLINFO_STALE;
 			nd6_llinfo_settimer(ln, nd6_gctimer * hz);
+		}
 		break;
 	case ND6_LLINFO_PURGE:
 	case ND6_LLINFO_STALE:
 		/* Garbage Collection(RFC 2461 5.3) */
 		if (!ND6_LLINFO_PERMANENT(ln)) {
 @@ -2302,26 +2315,27 @@ nd6_slowtimo(void *ignored_arg)
 /*
  * Return 0 if a neighbor cache is found. Return EWOULDBLOCK if a cache is not
  * found and trying to resolve a neighbor; in this case the mbuf is queued in
  * the list. Otherwise return errno after freeing the mbuf.
  */
 int
 nd6_resolve(struct ifnet *ifp, const struct rtentry *rt, struct mbuf *m,
     const struct sockaddr *_dst, uint8_t *lldst, size_t dstsize)
+{
 	struct llentry *ln = NULL;
 	bool created = false;
 	const struct sockaddr_in6 *dst = satocsin6(_dst);
 	int error;
 	/* discard the packet if IPv6 operation is disabled on the interface */
 	if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) {
 		m_freem(m);
 		return ENETDOWN; /* better error? */
+	}
 	/*
 	 * Address resolution or Neighbor Unreachability Detection
 	 * for the next hop.
 	 * At this point, the destination of the packet must be a unicast
 	 * or an anycast address(i.e. not a multicast).
 	 */
 @@ -2396,69 +2410,76 @@ nd6_resolve(struct ifnet *ifp, const str
 		KASSERT((ln->la_flags & LLE_VALID) != 0);
 		memcpy(lldst, &ln->ll_addr, MIN(dstsize, ifp->if_addrlen));
 		LLE_WUNLOCK(ln);
 		return 0;
+	}
 	/*
 	 * There is a neighbor cache entry, but no ethernet address
 	 * response yet.  Append this latest packet to the end of the
 	 * packet queue in the mbuf, unless the number of the packet
 	 * does not exceed nd6_maxqueuelen.  When it exceeds nd6_maxqueuelen,
 	 * the oldest packet in the queue will be removed.
 	 */
-	if (ln->ln_state == ND6_LLINFO_NOSTATE)
+	if (ln->ln_state == ND6_LLINFO_NOSTATE ||
 	    ln->ln_state == ND6_LLINFO_WAITDELETE)
 		ln->ln_state = ND6_LLINFO_INCOMPLETE;
 	if (ln->ln_hold) {
 		struct mbuf *m_hold;
 		int i;
 		i = 0;
 		for (m_hold = ln->ln_hold; m_hold; m_hold = m_hold->m_nextpkt) {
 			i++;
 			if (m_hold->m_nextpkt == NULL) {
 				m_hold->m_nextpkt = m;
 				break;
+			}
+		}
 		while (i >= nd6_maxqueuelen) {
 			m_hold = ln->ln_hold;
 			ln->ln_hold = ln->ln_hold->m_nextpkt;
 			m_freem(m_hold);
 			i--;
+		}
 	} else {
 		ln->ln_hold = m;
+	}
 	if (ln->ln_asked >= nd6_mmaxtries)
 		error = (rt != NULL && rt->rt_flags & RTF_GATEWAY) ?
 		    EHOSTUNREACH : EHOSTDOWN;
 	else
 		error = EWOULDBLOCK;
 	/*
 	 * If there has been no NS for the neighbor after entering the
 	 * INCOMPLETE state, send the first solicitation.
 	 */
 	if (!ND6_LLINFO_PERMANENT(ln) && ln->ln_asked == 0) {
 		struct in6_addr src, *psrc;
 		ln->ln_asked++;
 		nd6_llinfo_settimer(ln, ND_IFINFO(ifp)->retrans * hz / 1000);
 		psrc = nd6_llinfo_get_holdsrc(ln, &src);
 		LLE_WUNLOCK(ln);
 		nd6_ns_output(ifp, NULL, &dst->sin6_addr, psrc, NULL);
 	} else
 		LLE_WUNLOCK(ln);
 	if (created)
 		nd6_gc_neighbors(LLTABLE6(ifp), &dst->sin6_addr);
-	return EWOULDBLOCK;
+	return error;
+}
 int
 nd6_need_cache(struct ifnet *ifp)
+{
 	/*
 	 * XXX: we currently do not make neighbor cache on any interface
 	 * other than ARCnet, Ethernet, FDDI and GIF.
+	 *
 	 * RFC2893 says:
 	 * - unidirectional tunnels needs no ND
 	 */
 	switch (ifp->if_type) {

 @@ -1,14 +1,14 @@
-/*	$NetBSD: nd6.h,v 1.86 2018/03/06 10:57:00 roy Exp $	*/
+/*	$NetBSD: nd6.h,v 1.87 2019/09/01 19:26:21 roy Exp $	*/
 /*	$KAME: nd6.h,v 1.95 2002/06/08 11:31:06 itojun Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
 @@ -28,34 +28,27 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #ifndef _NETINET6_ND6_H_
 #define _NETINET6_ND6_H_
 #include <sys/queue.h>
 #include <sys/callout.h>
 #define ND6_LLINFO_PURGE	-3
 #define ND6_LLINFO_NOSTATE	-2
-/*
+#define ND6_LLINFO_WAITDELETE	-1
  * We don't need the WAITDELETE state any more, but we keep the definition
  * in a comment line instead of removing it. This is necessary to avoid
  * unintentionally reusing the value for another purpose, which might
  * affect backward compatibility with old applications.
  * (20000711 jinmei@kame.net)
  */
 /* #define ND6_LLINFO_WAITDELETE	-1 */
 #define ND6_LLINFO_INCOMPLETE	0
 #define ND6_LLINFO_REACHABLE	1
 #define ND6_LLINFO_STALE	2
 #define ND6_LLINFO_DELAY	3
 #define ND6_LLINFO_PROBE	4
 #define ND6_IS_LLINFO_PROBREACH(n) ((n)->ln_state > ND6_LLINFO_INCOMPLETE)
 #define ND6_LLINFO_PERMANENT(n)	(((n)->ln_expire == 0) && ((n)->ln_state > ND6_LLINFO_INCOMPLETE))
 struct nd_ifinfo {
 	u_int32_t linkmtu;		/* LinkMTU */
 	u_int32_t maxmtu;		/* Upper bound of LinkMTU */
 	u_int32_t basereachable;	/* BaseReachableTime */