/usr/src/sbin/slaacd/engine.c

Bug Summary

File:	src/sbin/slaacd/engine.c
Warning:	line 928, column 3 Use of memory after it is freed
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name engine.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sbin/slaacd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sbin/slaacd -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/sbin/slaacd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/sbin/slaacd/engine.c
1/*	$OpenBSD: engine.c,v 1.86 2023/12/14 09:58:59 claudio Exp $	*/

3/*
* Copyright (c) 2017 Florian Obser <florian@openbsd.org>
* Copyright (c) 2004, 2005 Claudio Jeker <claudio@openbsd.org>
* Copyright (c) 2004 Esben Norby <norby@openbsd.org>
* Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

22/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the project nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

51#include <sys/types.h>
52#include <sys/queue.h>
53#include <sys/socket.h>
54#include <sys/syslog.h>
55#include <sys/uio.h>

57#include <net/if.h>
58#include <net/route.h>
59#include <arpa/inet.h>
60#include <netinet/in.h>
61#include <netinet/if_ether.h>
62#include <netinet/ip6.h>
63#include <netinet6/ip6_var.h>
64#include <netinet6/nd6.h>
65#include <netinet/icmp6.h>

67#include <crypto/sha2.h>

69#include <errno(*__errno()).h>
70#include <event.h>
71#include <imsg.h>
72#include <pwd.h>
73#include <signal.h>
74#include <stddef.h>
75#include <stdlib.h>
76#include <string.h>
77#include <time.h>
78#include <unistd.h>

80#include "log.h"
81#include "slaacd.h"
82#include "engine.h"

84#define	MINIMUM(a, b)(((a) < (b)) ? (a) : (b))	(((a) < (b)) ? (a) : (b))

86#define	MAX_RTR_SOLICITATION_DELAY1	1
87#define	MAX_RTR_SOLICITATION_DELAY_USEC1 * 1000000	MAX_RTR_SOLICITATION_DELAY1 * 1000000
88#define	RTR_SOLICITATION_INTERVAL4	4
89#define	MAX_RTR_SOLICITATIONS3		3

91/*
* Constants for RFC 8981 temporary address extensions
*
* PRIV_PREFERRED_LIFETIME > (PRIV_MAX_DESYNC_FACTOR + PRIV_REGEN_ADVANCE)
*/
96#define PRIV_VALID_LIFETIME172800	172800	/* 2 days */
97#define PRIV_PREFERRED_LIFETIME86400	86400	/* 1 day */
98#define PRIV_MAX_DESYNC_FACTOR34560	34560	/* PRIV_PREFERRED_LIFETIME * 0.4 */
99#define	PRIV_REGEN_ADVANCE5	5	/* 5 seconds */

101enum if_state {
IF_DOWN,
IF_INIT,
IF_BOUND,
105};

107enum proposal_state {
PROPOSAL_IF_DOWN,
PROPOSAL_NOT_CONFIGURED,
PROPOSAL_CONFIGURED,
PROPOSAL_NEARLY_EXPIRED,
PROPOSAL_WITHDRAWN,
PROPOSAL_DUPLICATED,
PROPOSAL_STALE,
115};

117const char* rpref_name[] = {
"Low",
"Medium",
"High",
121};

123struct radv_prefix {
LIST_ENTRY(radv_prefix)struct { struct radv_prefix *le_next; struct radv_prefix **le_prev
; }	entries;
struct in6_addr		prefix;
uint8_t			prefix_len; /*XXX int */
int			onlink;
int			autonomous;
uint32_t		vltime;
uint32_t		pltime;
int			dad_counter;
132};

134struct radv_rdns {
LIST_ENTRY(radv_rdns)struct { struct radv_rdns *le_next; struct radv_rdns **le_prev
; }	entries;
struct in6_addr		rdns;
137};

139struct radv {
LIST_ENTRY(radv)struct { struct radv *le_next; struct radv **le_prev; }		 entries;
struct sockaddr_in6		 from;
struct timespec			 when;
struct timespec			 uptime;
struct event			 timer;
uint32_t			 min_lifetime;
uint8_t				 curhoplimit;
int				 managed;
int				 other;
enum rpref			 rpref;
uint16_t			 router_lifetime; /* in seconds */
uint32_t			 reachable_time; /* in milliseconds */
uint32_t			 retrans_time; /* in milliseconds */
LIST_HEAD(, radv_prefix)struct { struct radv_prefix *lh_first; }	 prefixes;
uint32_t			 rdns_lifetime;
LIST_HEAD(, radv_rdns)struct { struct radv_rdns *lh_first; }		 rdns_servers;
uint32_t			 mtu;
157};

159struct address_proposal {
LIST_ENTRY(address_proposal)struct { struct address_proposal *le_next; struct address_proposal
 **le_prev; }	 entries;
struct event			 timer;
int64_t				 id;
enum proposal_state		 state;
struct timeval			 timo;
struct timespec			 created;
struct timespec			 when;
struct timespec			 uptime;
uint32_t			 if_index;
struct ether_addr		 hw_address;
struct sockaddr_in6		 from;
struct sockaddr_in6		 addr;
struct in6_addr			 mask;
struct in6_addr			 prefix;
int				 temporary;
uint8_t				 prefix_len;
uint32_t			 vltime;
uint32_t			 pltime;
uint32_t			 desync_factor;
uint8_t				 soiikey[SLAACD_SOIIKEY_LEN16];
uint32_t			 mtu;
181};

183struct dfr_proposal {
LIST_ENTRY(dfr_proposal)struct { struct dfr_proposal *le_next; struct dfr_proposal **
le_prev; }	 entries;
struct event			 timer;
int64_t				 id;
enum proposal_state		 state;
struct timeval			 timo;
struct timespec			 when;
struct timespec			 uptime;
uint32_t			 if_index;
int				 rdomain;
struct sockaddr_in6		 addr;
uint32_t			 router_lifetime;
enum rpref			 rpref;
196};

198struct rdns_proposal {
LIST_ENTRY(rdns_proposal)struct { struct rdns_proposal *le_next; struct rdns_proposal *
*le_prev; }	 entries;
struct event			 timer;
int64_t				 id;
enum proposal_state		 state;
struct timeval			 timo;
struct timespec			 when;
struct timespec			 uptime;
uint32_t			 if_index;
int				 rdomain;
struct sockaddr_in6		 from;
int				 rdns_count;
struct in6_addr			 rdns[MAX_RDNS_COUNT8];
uint32_t			 rdns_lifetime;
212};

214struct slaacd_iface {
LIST_ENTRY(slaacd_iface)struct { struct slaacd_iface *le_next; struct slaacd_iface **
le_prev; }	 entries;
enum if_state			 state;
struct event			 timer;
struct timeval			 timo;
struct timespec			 last_sol;
int				 probes;
uint32_t			 if_index;
uint32_t			 rdomain;
int				 running;
int				 autoconf;
int				 temporary;
int				 soii;
struct ether_addr		 hw_address;
struct sockaddr_in6		 ll_address;
uint8_t				 soiikey[SLAACD_SOIIKEY_LEN16];
int				 link_state;
uint32_t			 cur_mtu;
LIST_HEAD(, radv)struct { struct radv *lh_first; }		 radvs;
LIST_HEAD(, address_proposal)struct { struct address_proposal *lh_first; }	 addr_proposals;
LIST_HEAD(, dfr_proposal)struct { struct dfr_proposal *lh_first; }	 dfr_proposals;
LIST_HEAD(, rdns_proposal)struct { struct rdns_proposal *lh_first; }	 rdns_proposals;
236};

238LIST_HEAD(, slaacd_iface)struct { struct slaacd_iface *lh_first; } slaacd_interfaces;

240__dead__attribute__((__noreturn__)) void		 engine_shutdown(void);
241void			 engine_sig_handler(int sig, short, void *);
242void			 engine_dispatch_frontend(int, short, void *);
243void			 engine_dispatch_main(int, short, void *);
244#ifndef	SMALL
245void			 send_interface_info(struct slaacd_iface *, pid_t);
246void			 engine_showinfo_ctl(struct imsg *, uint32_t);
247void			 debug_log_ra(struct imsg_ra *);
248int			 in6_mask2prefixlen(struct in6_addr *);
249#endif	/* SMALL */
250struct slaacd_iface	*get_slaacd_iface_by_id(uint32_t);
251void			 remove_slaacd_iface(uint32_t);
252void			 free_ra(struct radv *);
253void			 iface_state_transition(struct slaacd_iface *, enum
	     if_state);
255void			 addr_proposal_state_transition(struct
	     address_proposal *, enum proposal_state);
257void			 dfr_proposal_state_transition(struct dfr_proposal *,
	     enum proposal_state);
259void			 rdns_proposal_state_transition(struct rdns_proposal *,
	     enum proposal_state);
261void			 engine_update_iface(struct imsg_ifinfo *);
262void			 request_solicitation(struct slaacd_iface *);
263void			 parse_ra(struct slaacd_iface *, struct imsg_ra *);
264void			 gen_addr(struct slaacd_iface *, struct radv_prefix *,
	     struct address_proposal *, int);
266void			 gen_address_proposal(struct slaacd_iface *, struct
	     radv *, struct radv_prefix *, int);
268void			 free_address_proposal(struct address_proposal *);
269void			 withdraw_addr(struct address_proposal *);
270void			 configure_address(struct address_proposal *);
271void			 in6_prefixlen2mask(struct in6_addr *, int len);
272void			 gen_dfr_proposal(struct slaacd_iface *, struct
	     radv *);
274void			 configure_dfr(struct dfr_proposal *);
275void			 free_dfr_proposal(struct dfr_proposal *);
276void			 withdraw_dfr(struct dfr_proposal *);
277void			 update_iface_ra_rdns(struct slaacd_iface *,
	     struct radv *);
279void			 gen_rdns_proposal(struct slaacd_iface *, struct
	     radv *);
281void			 free_rdns_proposal(struct rdns_proposal *);
282void			 withdraw_rdns(struct rdns_proposal *);
283void			 compose_rdns_proposal(uint32_t, int);
284void			 update_iface_ra(struct slaacd_iface *, struct radv *);
285void			 update_iface_ra_dfr(struct slaacd_iface *,
  			     struct radv *);
287void			 update_iface_ra_prefix(struct slaacd_iface *,
	     struct radv *, struct radv_prefix *prefix);
289void			 address_proposal_timeout(int, short, void *);
290void			 dfr_proposal_timeout(int, short, void *);
291void			 rdns_proposal_timeout(int, short, void *);
292void			 iface_timeout(int, short, void *);
293struct radv		*find_ra(struct slaacd_iface *, struct sockaddr_in6 *);
294struct address_proposal	*find_address_proposal_by_addr(struct slaacd_iface *,
	     struct sockaddr_in6 *);
296struct dfr_proposal	*find_dfr_proposal_by_gw(struct slaacd_iface *,
	     struct sockaddr_in6 *);
298struct rdns_proposal	*find_rdns_proposal_by_gw(struct slaacd_iface *,
	     struct sockaddr_in6 *);
300struct radv_prefix	*find_prefix(struct radv *, struct in6_addr *, uint8_t);
301int			 engine_imsg_compose_main(int, pid_t, void *, uint16_t);
302uint32_t		 real_lifetime(struct timespec *, uint32_t);
303void			 merge_dad_couters(struct radv *, struct radv *);

305static struct imsgev	*iev_frontend;
306static struct imsgev	*iev_main;
307int64_t			 proposal_id;


310#define	CASE(x)case x : return "x" case x : return #x

312#ifndef SMALL
313static const char*
314if_state_name(enum if_state ifs)
315{
switch (ifs) {
CASE(IF_DOWN)case IF_DOWN : return "IF_DOWN";
CASE(IF_INIT)case IF_INIT : return "IF_INIT";
CASE(IF_BOUND)case IF_BOUND : return "IF_BOUND";
}
321}

323static const char*
324proposal_state_name(enum proposal_state ps)
325{
switch (ps) {
CASE(PROPOSAL_IF_DOWN)case PROPOSAL_IF_DOWN : return "PROPOSAL_IF_DOWN";
CASE(PROPOSAL_NOT_CONFIGURED)case PROPOSAL_NOT_CONFIGURED : return "PROPOSAL_NOT_CONFIGURED";
CASE(PROPOSAL_CONFIGURED)case PROPOSAL_CONFIGURED : return "PROPOSAL_CONFIGURED";
CASE(PROPOSAL_NEARLY_EXPIRED)case PROPOSAL_NEARLY_EXPIRED : return "PROPOSAL_NEARLY_EXPIRED";
CASE(PROPOSAL_WITHDRAWN)case PROPOSAL_WITHDRAWN : return "PROPOSAL_WITHDRAWN";
CASE(PROPOSAL_DUPLICATED)case PROPOSAL_DUPLICATED : return "PROPOSAL_DUPLICATED";
CASE(PROPOSAL_STALE)case PROPOSAL_STALE : return "PROPOSAL_STALE";
}
335}
336#endif

338void
339engine_sig_handler(int sig, short event, void *arg)
340{
/*
* Normal signal handler rules don't apply because libevent
* decouples for us.
*/

switch (sig) {
case SIGINT2:
case SIGTERM15:
engine_shutdown();
default:
fatalx("unexpected signal");
}
353}

355void
356engine(int debug, int verbose)
357{
struct event		 ev_sigint, ev_sigterm;
struct passwd		*pw;

log_init(debug, LOG_DAEMON(3<<3));
log_setverbose(verbose);

if ((pw = getpwnam(SLAACD_USER"_slaacd")) == NULL((void *)0))
fatal("getpwnam");

if (chdir("/") == -1)
fatal("chdir(\"/\")");

if (unveil("/", "") == -1)
fatal("unveil /");
if (unveil(NULL((void *)0), NULL((void *)0)) == -1)
fatal("unveil");

setproctitle("%s", "engine");
log_procinit("engine");

if (setgroups(1, &pw->pw_gid) ||
   setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
   setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
fatal("can't drop privileges");

if (pledge("stdio recvfd", NULL((void *)0)) == -1)
fatal("pledge");

event_init();

/* Setup signal handler(s). */
signal_set(&ev_sigint, SIGINT, engine_sig_handler, NULL)event_set(&ev_sigint, 2, 0x08|0x10, engine_sig_handler, (
(void *)0));
signal_set(&ev_sigterm, SIGTERM, engine_sig_handler, NULL)event_set(&ev_sigterm, 15, 0x08|0x10, engine_sig_handler,
 ((void *)0));
signal_add(&ev_sigint, NULL)event_add(&ev_sigint, ((void *)0));
signal_add(&ev_sigterm, NULL)event_add(&ev_sigterm, ((void *)0));
signal(SIGPIPE13, SIG_IGN(void (*)(int))1);
signal(SIGHUP1, SIG_IGN(void (*)(int))1);

/* Setup pipe and event handler to the main process. */
if ((iev_main = malloc(sizeof(struct imsgev))) == NULL((void *)0))
fatal(NULL((void *)0));

imsg_init(&iev_main->ibuf, 3);
iev_main->handler = engine_dispatch_main;

/* Setup event handlers. */
iev_main->events = EV_READ0x02;
event_set(&iev_main->ev, iev_main->ibuf.fd, iev_main->events,
   iev_main->handler, iev_main);
event_add(&iev_main->ev, NULL((void *)0));

LIST_INIT(&slaacd_interfaces)do { ((&slaacd_interfaces)->lh_first) = ((void *)0); }
 while (0);

event_dispatch();

engine_shutdown();
414}

416__dead__attribute__((__noreturn__)) void
417engine_shutdown(void)
418{
/* Close pipes. */
msgbuf_clear(&iev_frontend->ibuf.w);
close(iev_frontend->ibuf.fd);
msgbuf_clear(&iev_main->ibuf.w);
close(iev_main->ibuf.fd);

free(iev_frontend);
free(iev_main);

log_info("engine exiting");
exit(0);
430}

432int
433engine_imsg_compose_frontend(int type, pid_t pid, void *data,
  uint16_t datalen)
435{
return (imsg_compose_event(iev_frontend, type, 0, pid, -1,
   data, datalen));
438}

440int
441engine_imsg_compose_main(int type, pid_t pid, void *data,
  uint16_t datalen)
443{
return (imsg_compose_event(iev_main, type, 0, pid, -1,
   data, datalen));
446}

448void
449engine_dispatch_frontend(int fd, short event, void *bula)
450{
struct imsgev			*iev = bula;
struct imsgbuf			*ibuf = &iev->ibuf;
struct imsg			 imsg;
struct slaacd_iface		*iface;
struct imsg_ra			 ra;
struct address_proposal		*addr_proposal = NULL((void *)0);
struct dfr_proposal		*dfr_proposal = NULL((void *)0);
struct imsg_del_addr		 del_addr;
struct imsg_del_route		 del_route;
struct imsg_dup_addr		 dup_addr;
ssize_t				 n;
int				 shut = 0;
463#ifndef	SMALL
int				 verbose;
465#endif	/* SMALL */
uint32_t			 if_index;

if (event & EV_READ0x02) {
1
Assuming the condition is false→
2
←
Taking false branch→
if ((n = imsg_read(ibuf)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("imsg_read error");
if (n == 0)	/* Connection closed. */
	shut = 1;
}
if (event & EV_WRITE0x04) {
3
←
Assuming the condition is false→
4
←
Taking false branch→
if ((n = msgbuf_write(&ibuf->w)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("msgbuf_write");
if (n == 0)	/* Connection closed. */
	shut = 1;
}

for (;;) {
5
←
Loop condition is true.  Entering loop body→
if ((n = imsg_get(ibuf, &imsg)) == -1)
6
←
Assuming the condition is false→
7
←
Taking false branch→
	fatal("%s: imsg_get error", __func__);
if (n == 0)	/* No more messages. */
8
←
Assuming 'n' is not equal to 0→
9
←
Taking false branch→
	break;

switch (imsg.hdr.type) {
10
←
Control jumps to 'case IMSG_REMOVE_IF:'  at line 505→
488#ifndef	SMALL
case IMSG_CTL_LOG_VERBOSE:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(verbose))
		fatalx("%s: IMSG_CTL_LOG_VERBOSE wrong length: "
		    "%lu", __func__, IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&verbose, imsg.data, sizeof(verbose));
	log_setverbose(verbose);
	break;
case IMSG_CTL_SHOW_INTERFACE_INFO:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(if_index))
		fatalx("%s: IMSG_CTL_SHOW_INTERFACE_INFO wrong "
		    "length: %lu", __func__,
		    IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&if_index, imsg.data, sizeof(if_index));
	engine_showinfo_ctl(&imsg, if_index);
	break;
504#endif	/* SMALL */
case IMSG_REMOVE_IF:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(if_index))
11
←
Assuming the condition is false→
12
←
Taking false branch→
		fatalx("%s: IMSG_REMOVE_IF wrong length: %lu",
		    __func__, IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&if_index, imsg.data, sizeof(if_index));
	remove_slaacd_iface(if_index);
13
←
Calling 'remove_slaacd_iface'→
	break;
case IMSG_RA:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(ra))
		fatalx("%s: IMSG_RA wrong length: %lu",
		    __func__, IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&ra, imsg.data, sizeof(ra));
	iface = get_slaacd_iface_by_id(ra.if_index);

	/*
	 * Ignore unsolicitated router advertisements
	 * if we think the interface is still down.
	 * Otherwise we confuse the state machine.
	 */
	if (iface != NULL((void *)0) && iface->state != IF_DOWN)
		parse_ra(iface, &ra);
	break;
case IMSG_CTL_SEND_SOLICITATION:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(if_index))
		fatalx("%s: IMSG_CTL_SEND_SOLICITATION wrong "
		    "length: %lu", __func__,
		    IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&if_index, imsg.data, sizeof(if_index));
	iface = get_slaacd_iface_by_id(if_index);
	if (iface == NULL((void *)0))
		log_warnx("requested to send solicitation on "
		    "non-autoconf interface: %u", if_index);
	else {
		iface->last_sol.tv_sec = 0; /* no rate limit */
		request_solicitation(iface);
	}
	break;
case IMSG_DEL_ADDRESS:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(del_addr))
		fatalx("%s: IMSG_DEL_ADDRESS wrong length: %lu",
		    __func__, IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&del_addr, imsg.data, sizeof(del_addr));
	iface = get_slaacd_iface_by_id(del_addr.if_index);
	if (iface == NULL((void *)0)) {
		log_debug("IMSG_DEL_ADDRESS: unknown interface"
		    ", ignoring");
		break;
	}

	addr_proposal = find_address_proposal_by_addr(iface,
	    &del_addr.addr);
	/*
	 * If it's in state PROPOSAL_WITHDRAWN we just
	 * deleted it ourself but want to keep it around
	 * so we can renew it
	 */
	if (addr_proposal && addr_proposal->state !=
	    PROPOSAL_WITHDRAWN)
		free_address_proposal(addr_proposal);
	break;
case IMSG_DEL_ROUTE:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(del_route))
		fatalx("%s: IMSG_DEL_ROUTE wrong length: %lu",
		    __func__, IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&del_route, imsg.data, sizeof(del_route));
	iface = get_slaacd_iface_by_id(del_route.if_index);
	if (iface == NULL((void *)0)) {
		log_debug("IMSG_DEL_ROUTE: unknown interface"
		    ", ignoring");
		break;
	}

	dfr_proposal = find_dfr_proposal_by_gw(iface,
	    &del_route.gw);

	if (dfr_proposal) {
		dfr_proposal->state = PROPOSAL_WITHDRAWN;
		free_dfr_proposal(dfr_proposal);
	}
	break;
case IMSG_DUP_ADDRESS:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(dup_addr))
		fatalx("%s: IMSG_DUP_ADDRESS wrong length: %lu",
		    __func__, IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&dup_addr, imsg.data, sizeof(dup_addr));
	iface = get_slaacd_iface_by_id(dup_addr.if_index);
	if (iface == NULL((void *)0)) {
		log_debug("IMSG_DUP_ADDRESS: unknown interface"
		    ", ignoring");
		break;
	}

	addr_proposal = find_address_proposal_by_addr(iface,
	    &dup_addr.addr);

	if (addr_proposal)
		addr_proposal_state_transition(addr_proposal,
		    PROPOSAL_DUPLICATED);
	break;
case IMSG_REPROPOSE_RDNS:
	LIST_FOREACH (iface, &slaacd_interfaces, entries)for((iface) = ((&slaacd_interfaces)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entries.le_next))
		compose_rdns_proposal(iface->if_index,
		    iface->rdomain);
	break;
default:
	log_debug("%s: unexpected imsg %d", __func__,
	    imsg.hdr.type);
	break;
}
imsg_free(&imsg);
}
if (!shut)
imsg_event_add(iev);
else {
/* This pipe is dead. Remove its event handler. */
event_del(&iev->ev);
event_loopexit(NULL((void *)0));
}
623}

625void
626engine_dispatch_main(int fd, short event, void *bula)
627{
struct imsg		 imsg;
struct imsgev		*iev = bula;
struct imsgbuf		*ibuf = &iev->ibuf;
struct imsg_ifinfo	 imsg_ifinfo;
ssize_t			 n;
int			 shut = 0;

if (event & EV_READ0x02) {
if ((n = imsg_read(ibuf)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("imsg_read error");
if (n == 0)	/* Connection closed. */
	shut = 1;
}
if (event & EV_WRITE0x04) {
if ((n = msgbuf_write(&ibuf->w)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("msgbuf_write");
if (n == 0)	/* Connection closed. */
	shut = 1;
}

for (;;) {
if ((n = imsg_get(ibuf, &imsg)) == -1)
	fatal("%s: imsg_get error", __func__);
if (n == 0)	/* No more messages. */
	break;

switch (imsg.hdr.type) {
case IMSG_SOCKET_IPC:
	/*
	 * Setup pipe and event handler to the frontend
	 * process.
	 */
	if (iev_frontend)
		fatalx("%s: received unexpected imsg fd "
		    "to engine", __func__);

	if ((fd = imsg_get_fd(&imsg)) == -1)
		fatalx("%s: expected to receive imsg fd to "
		   "engine but didn't receive any", __func__);

	iev_frontend = malloc(sizeof(struct imsgev));
	if (iev_frontend == NULL((void *)0))
		fatal(NULL((void *)0));

	imsg_init(&iev_frontend->ibuf, fd);
	iev_frontend->handler = engine_dispatch_frontend;
	iev_frontend->events = EV_READ0x02;

	event_set(&iev_frontend->ev, iev_frontend->ibuf.fd,
	iev_frontend->events, iev_frontend->handler,
	    iev_frontend);
	event_add(&iev_frontend->ev, NULL((void *)0));

	if (pledge("stdio", NULL((void *)0)) == -1)
		fatal("pledge");
	break;
case IMSG_UPDATE_IF:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(imsg_ifinfo))
		fatalx("%s: IMSG_UPDATE_IF wrong length: %lu",
		    __func__, IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&imsg_ifinfo, imsg.data, sizeof(imsg_ifinfo));
	engine_update_iface(&imsg_ifinfo);
	break;
default:
	log_debug("%s: unexpected imsg %d", __func__,
	    imsg.hdr.type);
	break;
}
imsg_free(&imsg);
}
if (!shut)
imsg_event_add(iev);
else {
/* This pipe is dead. Remove its event handler. */
event_del(&iev->ev);
event_loopexit(NULL((void *)0));
}
705}

707#ifndef	SMALL
708void
709send_interface_info(struct slaacd_iface *iface, pid_t pid)
710{
struct ctl_engine_info			 cei;
struct ctl_engine_info_ra		 cei_ra;
struct ctl_engine_info_ra_prefix	 cei_ra_prefix;
struct ctl_engine_info_ra_rdns		 cei_ra_rdns;
struct ctl_engine_info_address_proposal	 cei_addr_proposal;
struct ctl_engine_info_dfr_proposal	 cei_dfr_proposal;
struct ctl_engine_info_rdns_proposal	 cei_rdns_proposal;
struct radv				*ra;
struct radv_prefix			*prefix;
struct radv_rdns			*rdns;
struct address_proposal			*addr_proposal;
struct dfr_proposal			*dfr_proposal;
struct rdns_proposal			*rdns_proposal;

memset(&cei, 0, sizeof(cei));
cei.if_index = iface->if_index;
cei.running = iface->running;
cei.autoconf = iface->autoconf;
cei.temporary = iface->temporary;
cei.soii = iface->soii;
memcpy(&cei.hw_address, &iface->hw_address, sizeof(struct ether_addr));
memcpy(&cei.ll_address, &iface->ll_address,
   sizeof(struct sockaddr_in6));
engine_imsg_compose_frontend(IMSG_CTL_SHOW_INTERFACE_INFO, pid, &cei,
   sizeof(cei));
LIST_FOREACH(ra, &iface->radvs, entries)for((ra) = ((&iface->radvs)->lh_first); (ra)!= ((void
 *)0); (ra) = ((ra)->entries.le_next)) {
memset(&cei_ra, 0, sizeof(cei_ra));
memcpy(&cei_ra.from, &ra->from, sizeof(cei_ra.from));
memcpy(&cei_ra.when, &ra->when, sizeof(cei_ra.when));
memcpy(&cei_ra.uptime, &ra->uptime, sizeof(cei_ra.uptime));
cei_ra.curhoplimit = ra->curhoplimit;
cei_ra.managed = ra->managed;
cei_ra.other = ra->other;
if (strlcpy(cei_ra.rpref, rpref_name[ra->rpref], sizeof(
    cei_ra.rpref)) >= sizeof(cei_ra.rpref))
	log_warnx("truncated router preference");
cei_ra.router_lifetime = ra->router_lifetime;
cei_ra.reachable_time = ra->reachable_time;
cei_ra.retrans_time = ra->retrans_time;
cei_ra.mtu = ra->mtu;
engine_imsg_compose_frontend(IMSG_CTL_SHOW_INTERFACE_INFO_RA,
    pid, &cei_ra, sizeof(cei_ra));

LIST_FOREACH(prefix, &ra->prefixes, entries)for((prefix) = ((&ra->prefixes)->lh_first); (prefix
)!= ((void *)0); (prefix) = ((prefix)->entries.le_next)) {
	memset(&cei_ra_prefix, 0, sizeof(cei_ra_prefix));

	cei_ra_prefix.prefix = prefix->prefix;
	cei_ra_prefix.prefix_len = prefix->prefix_len;
	cei_ra_prefix.onlink = prefix->onlink;
	cei_ra_prefix.autonomous = prefix->autonomous;
	cei_ra_prefix.vltime = prefix->vltime;
	cei_ra_prefix.pltime = prefix->pltime;
	engine_imsg_compose_frontend(
	    IMSG_CTL_SHOW_INTERFACE_INFO_RA_PREFIX, pid,
	    &cei_ra_prefix, sizeof(cei_ra_prefix));
}

LIST_FOREACH(rdns, &ra->rdns_servers, entries)for((rdns) = ((&ra->rdns_servers)->lh_first); (rdns
)!= ((void *)0); (rdns) = ((rdns)->entries.le_next)) {
	memset(&cei_ra_rdns, 0, sizeof(cei_ra_rdns));
	memcpy(&cei_ra_rdns.rdns, &rdns->rdns,
	    sizeof(cei_ra_rdns.rdns));
	cei_ra_rdns.lifetime = ra->rdns_lifetime;
	engine_imsg_compose_frontend(
	    IMSG_CTL_SHOW_INTERFACE_INFO_RA_RDNS, pid,
	    &cei_ra_rdns, sizeof(cei_ra_rdns));
}
}

if (!LIST_EMPTY(&iface->addr_proposals)(((&iface->addr_proposals)->lh_first) == ((void *)0
)))
engine_imsg_compose_frontend(
    IMSG_CTL_SHOW_INTERFACE_INFO_ADDR_PROPOSALS, pid, NULL((void *)0), 0);

LIST_FOREACH(addr_proposal, &iface->addr_proposals, entries)for((addr_proposal) = ((&iface->addr_proposals)->lh_first
); (addr_proposal)!= ((void *)0); (addr_proposal) = ((addr_proposal
)->entries.le_next)) {
memset(&cei_addr_proposal, 0, sizeof(cei_addr_proposal));
cei_addr_proposal.id = addr_proposal->id;
if(strlcpy(cei_addr_proposal.state,
    proposal_state_name(addr_proposal->state),
    sizeof(cei_addr_proposal.state)) >=
    sizeof(cei_addr_proposal.state))
	log_warnx("truncated state name");
cei_addr_proposal.next_timeout = addr_proposal->timo.tv_sec;
cei_addr_proposal.when = addr_proposal->when;
cei_addr_proposal.uptime = addr_proposal->uptime;
memcpy(&cei_addr_proposal.addr, &addr_proposal->addr, sizeof(
    cei_addr_proposal.addr));
memcpy(&cei_addr_proposal.prefix, &addr_proposal->prefix,
    sizeof(cei_addr_proposal.prefix));
cei_addr_proposal.prefix_len = addr_proposal->prefix_len;
cei_addr_proposal.temporary = addr_proposal->temporary;
cei_addr_proposal.vltime = addr_proposal->vltime;
cei_addr_proposal.pltime = addr_proposal->pltime;

engine_imsg_compose_frontend(
    IMSG_CTL_SHOW_INTERFACE_INFO_ADDR_PROPOSAL, pid,
	    &cei_addr_proposal, sizeof(cei_addr_proposal));
}

if (!LIST_EMPTY(&iface->dfr_proposals)(((&iface->dfr_proposals)->lh_first) == ((void *)0)
))
engine_imsg_compose_frontend(
    IMSG_CTL_SHOW_INTERFACE_INFO_DFR_PROPOSALS, pid, NULL((void *)0), 0);

LIST_FOREACH(dfr_proposal, &iface->dfr_proposals, entries)for((dfr_proposal) = ((&iface->dfr_proposals)->lh_first
); (dfr_proposal)!= ((void *)0); (dfr_proposal) = ((dfr_proposal
)->entries.le_next)) {
memset(&cei_dfr_proposal, 0, sizeof(cei_dfr_proposal));
cei_dfr_proposal.id = dfr_proposal->id;
if(strlcpy(cei_dfr_proposal.state,
    proposal_state_name(dfr_proposal->state),
    sizeof(cei_dfr_proposal.state)) >=
    sizeof(cei_dfr_proposal.state))
	log_warnx("truncated state name");
cei_dfr_proposal.next_timeout = dfr_proposal->timo.tv_sec;
cei_dfr_proposal.when = dfr_proposal->when;
cei_dfr_proposal.uptime = dfr_proposal->uptime;
memcpy(&cei_dfr_proposal.addr, &dfr_proposal->addr, sizeof(
    cei_dfr_proposal.addr));
cei_dfr_proposal.router_lifetime =
    dfr_proposal->router_lifetime;
if(strlcpy(cei_dfr_proposal.rpref,
    rpref_name[dfr_proposal->rpref],
    sizeof(cei_dfr_proposal.rpref)) >=
    sizeof(cei_dfr_proposal.rpref))
	log_warnx("truncated router preference");
engine_imsg_compose_frontend(
    IMSG_CTL_SHOW_INTERFACE_INFO_DFR_PROPOSAL, pid,
	    &cei_dfr_proposal, sizeof(cei_dfr_proposal));
}

if (!LIST_EMPTY(&iface->rdns_proposals)(((&iface->rdns_proposals)->lh_first) == ((void *)0
)))
engine_imsg_compose_frontend(
    IMSG_CTL_SHOW_INTERFACE_INFO_RDNS_PROPOSALS, pid, NULL((void *)0), 0);

LIST_FOREACH(rdns_proposal, &iface->rdns_proposals, entries)for((rdns_proposal) = ((&iface->rdns_proposals)->lh_first
); (rdns_proposal)!= ((void *)0); (rdns_proposal) = ((rdns_proposal
)->entries.le_next)) {
memset(&cei_rdns_proposal, 0, sizeof(cei_rdns_proposal));
cei_rdns_proposal.id = rdns_proposal->id;
if(strlcpy(cei_rdns_proposal.state,
    proposal_state_name(rdns_proposal->state),
    sizeof(cei_rdns_proposal.state)) >=
    sizeof(cei_rdns_proposal.state))
	log_warnx("truncated state name");
cei_rdns_proposal.next_timeout = rdns_proposal->timo.tv_sec;
cei_rdns_proposal.when = rdns_proposal->when;
cei_rdns_proposal.uptime = rdns_proposal->uptime;
memcpy(&cei_rdns_proposal.from, &rdns_proposal->from, sizeof(
    cei_rdns_proposal.from));
cei_rdns_proposal.rdns_count = rdns_proposal->rdns_count;
memcpy(&cei_rdns_proposal.rdns,
    &rdns_proposal->rdns, sizeof(cei_rdns_proposal.rdns));
cei_rdns_proposal.rdns_lifetime =
    rdns_proposal->rdns_lifetime;
engine_imsg_compose_frontend(
    IMSG_CTL_SHOW_INTERFACE_INFO_RDNS_PROPOSAL, pid,
	    &cei_rdns_proposal, sizeof(cei_rdns_proposal));
}
863}

865void
866engine_showinfo_ctl(struct imsg *imsg, uint32_t if_index)
867{
struct slaacd_iface			*iface;

switch (imsg->hdr.type) {
case IMSG_CTL_SHOW_INTERFACE_INFO:
if (if_index == 0) {
	LIST_FOREACH (iface, &slaacd_interfaces, entries)for((iface) = ((&slaacd_interfaces)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entries.le_next))
		send_interface_info(iface, imsg->hdr.pid);
} else {
	if ((iface = get_slaacd_iface_by_id(if_index)) != NULL((void *)0))
		send_interface_info(iface, imsg->hdr.pid);
}
engine_imsg_compose_frontend(IMSG_CTL_END, imsg->hdr.pid, NULL((void *)0),
    0);
break;
default:
log_debug("%s: error handling imsg", __func__);
break;
}
886}

888#endif	/* SMALL */

890struct slaacd_iface*
891get_slaacd_iface_by_id(uint32_t if_index)
892{
struct slaacd_iface	*iface;
LIST_FOREACH (iface, &slaacd_interfaces, entries)for((iface) = ((&slaacd_interfaces)->lh_first); (iface
)!= ((void *)0); (iface) = ((iface)->entries.le_next)) {
if (iface->if_index == if_index)
	return (iface);
}

return (NULL((void *)0));
900}

902void
903remove_slaacd_iface(uint32_t if_index)
904{
struct slaacd_iface	*iface;
struct radv		*ra;
struct address_proposal	*addr_proposal;
struct dfr_proposal	*dfr_proposal;
struct rdns_proposal	*rdns_proposal;

iface = get_slaacd_iface_by_id(if_index);

if (iface == NULL((void *)0))
14
←
Assuming 'iface' is not equal to NULL→
15
←
Taking false branch→
return;

LIST_REMOVE(iface, entries)do { if ((iface)->entries.le_next != ((void *)0)) (iface)->
entries.le_next->entries.le_prev = (iface)->entries.le_prev
; *(iface)->entries.le_prev = (iface)->entries.le_next;
 ; ; } while (0);
16
←
Assuming field 'le_next' is equal to null→
17
←
Taking false branch→
18
←
Loop condition is false.  Exiting loop→
while(!LIST_EMPTY(&iface->radvs)(((&iface->radvs)->lh_first) == ((void *)0))) {
19
←
Assuming field 'lh_first' is equal to null→
20
←
Loop condition is false. Execution continues on line 922→
ra = LIST_FIRST(&iface->radvs)((&iface->radvs)->lh_first);
LIST_REMOVE(ra, entries)do { if ((ra)->entries.le_next != ((void *)0)) (ra)->entries
.le_next->entries.le_prev = (ra)->entries.le_prev; *(ra
)->entries.le_prev = (ra)->entries.le_next; ; ; } while
 (0);
free_ra(ra);
}
while(!LIST_EMPTY(&iface->addr_proposals)(((&iface->addr_proposals)->lh_first) == ((void *)0
))) {
21
←
Assuming field 'lh_first' is equal to null→
22
←
Loop condition is false. Execution continues on line 926→
addr_proposal = LIST_FIRST(&iface->addr_proposals)((&iface->addr_proposals)->lh_first);
free_address_proposal(addr_proposal);
}
while(!LIST_EMPTY(&iface->dfr_proposals)(((&iface->dfr_proposals)->lh_first) == ((void *)0)
)) {
23
←
Assuming field 'lh_first' is not equal to null→
24
←
Loop condition is true.  Entering loop body→
33
←
Loop condition is true.  Entering loop body→
dfr_proposal = LIST_FIRST(&iface->dfr_proposals)((&iface->dfr_proposals)->lh_first);
free_dfr_proposal(dfr_proposal);
25
←
Calling 'free_dfr_proposal'→
32
←
Returning; memory was released via 1st parameter→
34
←
Use of memory after it is freed
}
while(!LIST_EMPTY(&iface->rdns_proposals)(((&iface->rdns_proposals)->lh_first) == ((void *)0
))) {
rdns_proposal = LIST_FIRST(&iface->rdns_proposals)((&iface->rdns_proposals)->lh_first);
free_rdns_proposal(rdns_proposal);
}
compose_rdns_proposal(iface->if_index, iface->rdomain);
evtimer_del(&iface->timer)event_del(&iface->timer);
free(iface);
937}

939void
940free_ra(struct radv *ra)
941{
struct radv_prefix	*prefix;
struct radv_rdns	*rdns;

if (ra == NULL((void *)0))
return;

evtimer_del(&ra->timer)event_del(&ra->timer);

while (!LIST_EMPTY(&ra->prefixes)(((&ra->prefixes)->lh_first) == ((void *)0))) {
prefix = LIST_FIRST(&ra->prefixes)((&ra->prefixes)->lh_first);
LIST_REMOVE(prefix, entries)do { if ((prefix)->entries.le_next != ((void *)0)) (prefix
)->entries.le_next->entries.le_prev = (prefix)->entries
.le_prev; *(prefix)->entries.le_prev = (prefix)->entries
.le_next; ; ; } while (0);
free(prefix);
}

while (!LIST_EMPTY(&ra->rdns_servers)(((&ra->rdns_servers)->lh_first) == ((void *)0))) {
rdns = LIST_FIRST(&ra->rdns_servers)((&ra->rdns_servers)->lh_first);
LIST_REMOVE(rdns, entries)do { if ((rdns)->entries.le_next != ((void *)0)) (rdns)->
entries.le_next->entries.le_prev = (rdns)->entries.le_prev
; *(rdns)->entries.le_prev = (rdns)->entries.le_next; ;
 ; } while (0);
free(rdns);
}

free(ra);
963}

965void
966iface_state_transition(struct slaacd_iface *iface, enum if_state new_state)
967{
enum if_state		 old_state = iface->state;
struct address_proposal	*addr_proposal;
struct dfr_proposal	*dfr_proposal;
struct rdns_proposal	*rdns_proposal;
char			 ifnamebuf[IF_NAMESIZE16], *if_name;

iface->state = new_state;

switch (new_state) {
case IF_DOWN:
if (old_state != IF_DOWN) {
	LIST_FOREACH (addr_proposal, &iface->addr_proposals,for((addr_proposal) = ((&iface->addr_proposals)->lh_first
); (addr_proposal)!= ((void *)0); (addr_proposal) = ((addr_proposal
)->entries.le_next))
	    entries)for((addr_proposal) = ((&iface->addr_proposals)->lh_first
); (addr_proposal)!= ((void *)0); (addr_proposal) = ((addr_proposal
)->entries.le_next))
		addr_proposal_state_transition(addr_proposal,
		    PROPOSAL_IF_DOWN);
	LIST_FOREACH (dfr_proposal, &iface->dfr_proposals,for((dfr_proposal) = ((&iface->dfr_proposals)->lh_first
); (dfr_proposal)!= ((void *)0); (dfr_proposal) = ((dfr_proposal
)->entries.le_next))
	    entries)for((dfr_proposal) = ((&iface->dfr_proposals)->lh_first
); (dfr_proposal)!= ((void *)0); (dfr_proposal) = ((dfr_proposal
)->entries.le_next))
		dfr_proposal_state_transition(dfr_proposal,
			PROPOSAL_IF_DOWN);
	LIST_FOREACH (rdns_proposal, &iface->rdns_proposals,for((rdns_proposal) = ((&iface->rdns_proposals)->lh_first
); (rdns_proposal)!= ((void *)0); (rdns_proposal) = ((rdns_proposal
)->entries.le_next))
	    entries)for((rdns_proposal) = ((&iface->rdns_proposals)->lh_first
); (rdns_proposal)!= ((void *)0); (rdns_proposal) = ((rdns_proposal
)->entries.le_next))
		rdns_proposal_state_transition(rdns_proposal,
		    PROPOSAL_IF_DOWN);
}

/* nothing else to do until interface comes back up */
iface->timo.tv_sec = -1;
break;
case IF_INIT:
switch (old_state) {
case IF_INIT:
	iface->probes++;
	break;
case IF_DOWN:
	LIST_FOREACH (addr_proposal, &iface->addr_proposals,for((addr_proposal) = ((&iface->addr_proposals)->lh_first
); (addr_proposal)!= ((void *)0); (addr_proposal) = ((addr_proposal
)->entries.le_next))
	    entries)for((addr_proposal) = ((&iface->addr_proposals)->lh_first
); (addr_proposal)!= ((void *)0); (addr_proposal) = ((addr_proposal
)->entries.le_next))
		addr_proposal_state_transition(addr_proposal,
		    PROPOSAL_WITHDRAWN);
	LIST_FOREACH (dfr_proposal, &iface->dfr_proposals,for((dfr_proposal) = ((&iface->dfr_proposals)->lh_first
); (dfr_proposal)!= ((void *)0); (dfr_proposal) = ((dfr_proposal
)->entries.le_next))
	    entries)for((dfr_proposal) = ((&iface->dfr_proposals)->lh_first
); (dfr_proposal)!= ((void *)0); (dfr_proposal) = ((dfr_proposal
)->entries.le_next))
		dfr_proposal_state_transition(dfr_proposal,
		    PROPOSAL_WITHDRAWN);
	LIST_FOREACH (rdns_proposal, &iface->rdns_proposals,for((rdns_proposal) = ((&iface->rdns_proposals)->lh_first
); (rdns_proposal)!= ((void *)0); (rdns_proposal) = ((rdns_proposal
)->entries.le_next))
	    entries)for((rdns_proposal) = ((&iface->rdns_proposals)->lh_first
); (rdns_proposal)!= ((void *)0); (rdns_proposal) = ((rdns_proposal
)->entries.le_next))
		rdns_proposal_state_transition(rdns_proposal,
		    PROPOSAL_WITHDRAWN);
default:
	iface->probes = 0;
}
if (iface->probes < MAX_RTR_SOLICITATIONS3) {
	iface->timo.tv_sec = RTR_SOLICITATION_INTERVAL4;
	request_solicitation(iface);
} else
	/* no router available, stop probing */
	iface->timo.tv_sec = -1;
break;
case IF_BOUND:
iface->timo.tv_sec = -1;
break;
}

if_name = if_indextoname(iface->if_index, ifnamebuf);
log_debug("%s[%s] %s -> %s, timo: %lld", __func__, if_name == NULL((void *)0) ?
   "?" : if_name, if_state_name(old_state), if_state_name(new_state),
   iface->timo.tv_sec);

if (iface->timo.tv_sec == -1) {
if (evtimer_pending(&iface->timer, NULL)event_pending(&iface->timer, 0x01, ((void *)0)))
	evtimer_del(&iface->timer)event_del(&iface->timer);
} else
evtimer_add(&iface->timer, &iface->timo)event_add(&iface->timer, &iface->timo);
1039}

1041void addr_proposal_state_transition(struct address_proposal *addr_proposal,
  enum proposal_state new_state)
1043{
enum proposal_state	 old_state = addr_proposal->state;
struct slaacd_iface	*iface;
uint32_t		 lifetime;
char			 ifnamebuf[IF_NAMESIZE16], *if_name;

addr_proposal->state = new_state;

if ((iface = get_slaacd_iface_by_id(addr_proposal->if_index)) == NULL((void *)0))
return;

switch (addr_proposal->state) {
case PROPOSAL_IF_DOWN:
if (old_state == PROPOSAL_IF_DOWN) {
	withdraw_addr(addr_proposal);
	addr_proposal->timo.tv_sec = -1;
} else {
	addr_proposal->timo.tv_sec =
	    real_lifetime(&addr_proposal->uptime,
		addr_proposal->vltime);
}
break;
case PROPOSAL_NOT_CONFIGURED:
break;
case PROPOSAL_CONFIGURED:
lifetime = real_lifetime(&addr_proposal->uptime,
    addr_proposal->pltime);
if (lifetime == 0)
	lifetime = real_lifetime(&addr_proposal->uptime,
	    addr_proposal->vltime);
if (lifetime > MAX_RTR_SOLICITATIONS3 *
    (RTR_SOLICITATION_INTERVAL4 + 1))
	addr_proposal->timo.tv_sec = lifetime -
	    MAX_RTR_SOLICITATIONS3 * RTR_SOLICITATION_INTERVAL4;
else
	addr_proposal->timo.tv_sec = RTR_SOLICITATION_INTERVAL4;
break;
case PROPOSAL_NEARLY_EXPIRED:
lifetime = real_lifetime(&addr_proposal->uptime,
    addr_proposal->pltime);
if (lifetime == 0)
	lifetime = real_lifetime(&addr_proposal->uptime,
	    addr_proposal->vltime);
if (lifetime > MAX_RTR_SOLICITATIONS3 *
    (RTR_SOLICITATION_INTERVAL4 + 1))
	addr_proposal->timo.tv_sec = lifetime -
	    MAX_RTR_SOLICITATIONS3 * RTR_SOLICITATION_INTERVAL4;
else
	addr_proposal->timo.tv_sec = RTR_SOLICITATION_INTERVAL4;
request_solicitation(iface);
break;
case PROPOSAL_WITHDRAWN:
withdraw_addr(addr_proposal);
addr_proposal->timo.tv_sec = MAX_RTR_SOLICITATIONS3 *
    RTR_SOLICITATION_INTERVAL4;
break;
case PROPOSAL_DUPLICATED:
addr_proposal->timo.tv_sec = 0;
break;
case PROPOSAL_STALE:
addr_proposal->timo.tv_sec = 0; /* remove immediately */
break;
}

if_name = if_indextoname(addr_proposal->if_index, ifnamebuf);
log_debug("%s[%s] %s -> %s, timo: %lld", __func__, if_name == NULL((void *)0) ?
   "?" : if_name, proposal_state_name(old_state),
   proposal_state_name(new_state),
   addr_proposal->timo.tv_sec);

if (addr_proposal->timo.tv_sec == -1) {
if (evtimer_pending(&addr_proposal->timer, NULL)event_pending(&addr_proposal->timer, 0x01, ((void *)0)
))
	evtimer_del(&addr_proposal->timer)event_del(&addr_proposal->timer);
} else
evtimer_add(&addr_proposal->timer, &addr_proposal->timo)event_add(&addr_proposal->timer, &addr_proposal->
timo);
1118}

1120void dfr_proposal_state_transition(struct dfr_proposal *dfr_proposal,
  enum proposal_state new_state)
1122{
enum proposal_state	 old_state = dfr_proposal->state;
struct slaacd_iface	*iface;
uint32_t		 lifetime;
char			 ifnamebuf[IF_NAMESIZE16], *if_name;

dfr_proposal->state = new_state;

if ((iface = get_slaacd_iface_by_id(dfr_proposal->if_index)) == NULL((void *)0))
return;

switch (dfr_proposal->state) {
case PROPOSAL_IF_DOWN:
if (old_state == PROPOSAL_IF_DOWN) {
	withdraw_dfr(dfr_proposal);
	dfr_proposal->timo.tv_sec = -1;
} else {
	dfr_proposal->timo.tv_sec =
	    real_lifetime(&dfr_proposal->uptime,
		dfr_proposal->router_lifetime);
}
break;
case PROPOSAL_NOT_CONFIGURED:
break;
case PROPOSAL_CONFIGURED:
lifetime = real_lifetime(&dfr_proposal->uptime,
    dfr_proposal->router_lifetime);
if (lifetime > MAX_RTR_SOLICITATIONS3 *
    (RTR_SOLICITATION_INTERVAL4 + 1))
	dfr_proposal->timo.tv_sec = lifetime -
	    MAX_RTR_SOLICITATIONS3 * RTR_SOLICITATION_INTERVAL4;
else
	dfr_proposal->timo.tv_sec = RTR_SOLICITATION_INTERVAL4;
break;
case PROPOSAL_NEARLY_EXPIRED:
lifetime = real_lifetime(&dfr_proposal->uptime,
    dfr_proposal->router_lifetime);
if (lifetime > MAX_RTR_SOLICITATIONS3 *
    (RTR_SOLICITATION_INTERVAL4 + 1))
	dfr_proposal->timo.tv_sec = lifetime -
	    MAX_RTR_SOLICITATIONS3 * RTR_SOLICITATION_INTERVAL4;
else
	dfr_proposal->timo.tv_sec = RTR_SOLICITATION_INTERVAL4;
request_solicitation(iface);
break;
case PROPOSAL_WITHDRAWN:
withdraw_dfr(dfr_proposal);
dfr_proposal->timo.tv_sec = MAX_RTR_SOLICITATIONS3 *
    RTR_SOLICITATION_INTERVAL4;
break;
case PROPOSAL_STALE:
dfr_proposal->timo.tv_sec = 0; /* remove immediately */
break;
case PROPOSAL_DUPLICATED:
fatalx("invalid dfr state: PROPOSAL_DUPLICATED");
break;
}

if_name = if_indextoname(dfr_proposal->if_index, ifnamebuf);
log_debug("%s[%s] %s -> %s, timo: %lld", __func__, if_name == NULL((void *)0) ?
   "?" : if_name, proposal_state_name(old_state),
   proposal_state_name(new_state),
   dfr_proposal->timo.tv_sec);

if (dfr_proposal->timo.tv_sec == -1) {
if (evtimer_pending(&dfr_proposal->timer, NULL)event_pending(&dfr_proposal->timer, 0x01, ((void *)0)))
	evtimer_del(&dfr_proposal->timer)event_del(&dfr_proposal->timer);
} else
evtimer_add(&dfr_proposal->timer, &dfr_proposal->timo)event_add(&dfr_proposal->timer, &dfr_proposal->
timo);

1192}

1194void rdns_proposal_state_transition(struct rdns_proposal *rdns_proposal,
  enum proposal_state new_state)
1196{
enum proposal_state	 old_state = rdns_proposal->state;
struct slaacd_iface	*iface;
uint32_t		 lifetime;
char			 ifnamebuf[IF_NAMESIZE16], *if_name;

rdns_proposal->state = new_state;

if ((iface = get_slaacd_iface_by_id(rdns_proposal->if_index)) == NULL((void *)0))
return;

switch (rdns_proposal->state) {
case PROPOSAL_IF_DOWN:
if (old_state == PROPOSAL_IF_DOWN) {
	withdraw_rdns(rdns_proposal);
	rdns_proposal->timo.tv_sec = -1;
} else {
	rdns_proposal->timo.tv_sec =
	    real_lifetime(&rdns_proposal->uptime,
		rdns_proposal->rdns_lifetime);
}
break;
case PROPOSAL_NOT_CONFIGURED:
break;
case PROPOSAL_CONFIGURED:
lifetime = real_lifetime(&rdns_proposal->uptime,
    rdns_proposal->rdns_lifetime);
if (lifetime > MAX_RTR_SOLICITATIONS3 *
    (RTR_SOLICITATION_INTERVAL4 + 1))
	rdns_proposal->timo.tv_sec = lifetime -
	    MAX_RTR_SOLICITATIONS3 * RTR_SOLICITATION_INTERVAL4;
else
	rdns_proposal->timo.tv_sec = RTR_SOLICITATION_INTERVAL4;
break;
case PROPOSAL_NEARLY_EXPIRED:
lifetime = real_lifetime(&rdns_proposal->uptime,
    rdns_proposal->rdns_lifetime);
if (lifetime > MAX_RTR_SOLICITATIONS3 *
    (RTR_SOLICITATION_INTERVAL4 + 1))
	rdns_proposal->timo.tv_sec = lifetime -
	    MAX_RTR_SOLICITATIONS3 * RTR_SOLICITATION_INTERVAL4;
else
	rdns_proposal->timo.tv_sec = RTR_SOLICITATION_INTERVAL4;
request_solicitation(iface);
break;
case PROPOSAL_WITHDRAWN:
withdraw_rdns(rdns_proposal);
rdns_proposal->timo.tv_sec = MAX_RTR_SOLICITATIONS3 *
    RTR_SOLICITATION_INTERVAL4;
break;
case PROPOSAL_STALE:
rdns_proposal->timo.tv_sec = 0; /* remove immediately */
break;
case PROPOSAL_DUPLICATED:
fatalx("invalid rdns state: PROPOSAL_DUPLICATED");
break;
}

if_name = if_indextoname(rdns_proposal->if_index, ifnamebuf);
log_debug("%s[%s] %s -> %s, timo: %lld", __func__, if_name == NULL((void *)0) ?
   "?" : if_name, proposal_state_name(old_state),
   proposal_state_name(new_state),
   rdns_proposal->timo.tv_sec);

if (rdns_proposal->timo.tv_sec == -1) {
if (evtimer_pending(&rdns_proposal->timer, NULL)event_pending(&rdns_proposal->timer, 0x01, ((void *)0)
))
	evtimer_del(&rdns_proposal->timer)event_del(&rdns_proposal->timer);
} else
evtimer_add(&rdns_proposal->timer, &rdns_proposal->timo)event_add(&rdns_proposal->timer, &rdns_proposal->
timo);
1265}

1267void
1268request_solicitation(struct slaacd_iface *iface)
1269{
struct timespec	now, diff, sol_delay = {RTR_SOLICITATION_INTERVAL4, 0};

clock_gettime(CLOCK_MONOTONIC3, &now);
timespecsub(&now, &iface->last_sol, &diff)do { (&diff)->tv_sec = (&now)->tv_sec - (&iface
->last_sol)->tv_sec; (&diff)->tv_nsec = (&now
)->tv_nsec - (&iface->last_sol)->tv_nsec; if ((&
diff)->tv_nsec < 0) { (&diff)->tv_sec--; (&diff
)->tv_nsec += 1000000000L; } } while (0);
if (timespeccmp(&diff, &sol_delay, <)(((&diff)->tv_sec == (&sol_delay)->tv_sec) ? ((
&diff)->tv_nsec < (&sol_delay)->tv_nsec) : (
(&diff)->tv_sec < (&sol_delay)->tv_sec))) {
log_warnx("last solicitation less then %d seconds ago",
    RTR_SOLICITATION_INTERVAL4);
return;
}

iface->last_sol = now;
engine_imsg_compose_frontend(IMSG_CTL_SEND_SOLICITATION, 0,
   &iface->if_index, sizeof(iface->if_index));
1283}

1285void
1286engine_update_iface(struct imsg_ifinfo *imsg_ifinfo)
1287{
struct slaacd_iface	*iface;
int			 need_refresh = 0;

iface = get_slaacd_iface_by_id(imsg_ifinfo->if_index);
if (iface == NULL((void *)0)) {
if ((iface = calloc(1, sizeof(*iface))) == NULL((void *)0))
	fatal("calloc");
iface->state = IF_DOWN;
iface->timo.tv_usec = arc4random_uniform(1000000);
evtimer_set(&iface->timer, iface_timeout, iface)event_set(&iface->timer, -1, 0, iface_timeout, iface);
iface->if_index = imsg_ifinfo->if_index;
iface->rdomain = imsg_ifinfo->rdomain;
iface->running = imsg_ifinfo->running;
iface->link_state = imsg_ifinfo->link_state;
iface->autoconf = imsg_ifinfo->autoconf;
iface->temporary = imsg_ifinfo->temporary;
iface->soii = imsg_ifinfo->soii;
memcpy(&iface->hw_address, &imsg_ifinfo->hw_address,
    sizeof(struct ether_addr));
memcpy(&iface->ll_address, &imsg_ifinfo->ll_address,
    sizeof(struct sockaddr_in6));
memcpy(iface->soiikey, imsg_ifinfo->soiikey,
    sizeof(iface->soiikey));
LIST_INIT(&iface->radvs)do { ((&iface->radvs)->lh_first) = ((void *)0); } while
 (0);
LIST_INSERT_HEAD(&slaacd_interfaces, iface, entries)do { if (((iface)->entries.le_next = (&slaacd_interfaces
)->lh_first) != ((void *)0)) (&slaacd_interfaces)->
lh_first->entries.le_prev = &(iface)->entries.le_next
; (&slaacd_interfaces)->lh_first = (iface); (iface)->
entries.le_prev = &(&slaacd_interfaces)->lh_first;
 } while (0);
LIST_INIT(&iface->addr_proposals)do { ((&iface->addr_proposals)->lh_first) = ((void *
)0); } while (0);
LIST_INIT(&iface->dfr_proposals)do { ((&iface->dfr_proposals)->lh_first) = ((void *
)0); } while (0);
LIST_INIT(&iface->rdns_proposals)do { ((&iface->rdns_proposals)->lh_first) = ((void *
)0); } while (0);
need_refresh = 1;
} else {
memcpy(&iface->ll_address, &imsg_ifinfo->ll_address,
    sizeof(struct sockaddr_in6));

if (iface->autoconf != imsg_ifinfo->autoconf) {
	iface->autoconf = imsg_ifinfo->autoconf;
	need_refresh = 1;
}

if (iface->temporary != imsg_ifinfo->temporary) {
	iface->temporary = imsg_ifinfo->temporary;
	need_refresh = 1;
}

if (iface->soii != imsg_ifinfo->soii) {
	iface->soii = imsg_ifinfo->soii;
	need_refresh = 1;
}

if (memcmp(&iface->hw_address, &imsg_ifinfo->hw_address,
    sizeof(struct ether_addr)) != 0) {
	memcpy(&iface->hw_address, &imsg_ifinfo->hw_address,
	    sizeof(struct ether_addr));
	need_refresh = 1;
}

if (memcmp(iface->soiikey, imsg_ifinfo->soiikey,
    sizeof(iface->soiikey)) != 0) {
	memcpy(iface->soiikey, imsg_ifinfo->soiikey,
	    sizeof(iface->soiikey));
	need_refresh = 1;
}

if (imsg_ifinfo->running != iface->running) {
	iface->running = imsg_ifinfo->running;
	need_refresh = 1;
}
if (imsg_ifinfo->link_state != iface->link_state) {
	iface->link_state = imsg_ifinfo->link_state;
	need_refresh = 1;
}
}

if (!need_refresh)
return;

if (iface->running && LINK_STATE_IS_UP(iface->link_state)((iface->link_state) >= 4 || (iface->link_state) == 0
))
iface_state_transition(iface, IF_INIT);

else
iface_state_transition(iface, IF_DOWN);
1368}

1370void
1371parse_ra(struct slaacd_iface *iface, struct imsg_ra *ra)
1372{
struct icmp6_hdr	*icmp6_hdr;
struct nd_router_advert	*nd_ra;
struct radv		*radv;
struct radv_prefix	*prefix;
struct radv_rdns	*rdns;
ssize_t			 len = ra->len;
const char		*hbuf;
uint8_t			*p;

1382#ifndef	SMALL
if (log_getverbose() > 1)
debug_log_ra(ra);
1385#endif	/* SMALL */

hbuf = sin6_to_str(&ra->from);
if ((size_t)len < sizeof(struct icmp6_hdr)) {
log_warnx("received too short message (%ld) from %s", len,
    hbuf);
return;
}

p = ra->packet;
icmp6_hdr = (struct icmp6_hdr *)p;
if (icmp6_hdr->icmp6_type != ND_ROUTER_ADVERT134)
return;

if (!IN6_IS_ADDR_LINKLOCAL(&ra->from.sin6_addr)(((&ra->from.sin6_addr)->__u6_addr.__u6_addr8[0] ==
 0xfe) && (((&ra->from.sin6_addr)->__u6_addr
.__u6_addr8[1] & 0xc0) == 0x80))) {
log_debug("RA from non link local address %s", hbuf);
return;
}

if ((size_t)len < sizeof(struct nd_router_advert)) {
log_warnx("received too short message (%ld) from %s", len,
    hbuf);
return;
}

if ((radv = calloc(1, sizeof(*radv))) == NULL((void *)0))
fatal("calloc");

LIST_INIT(&radv->prefixes)do { ((&radv->prefixes)->lh_first) = ((void *)0); }
 while (0);
LIST_INIT(&radv->rdns_servers)do { ((&radv->rdns_servers)->lh_first) = ((void *)0
); } while (0);

radv->min_lifetime = UINT32_MAX0xffffffffU;

nd_ra = (struct nd_router_advert *)p;
len -= sizeof(struct nd_router_advert);
p += sizeof(struct nd_router_advert);

log_debug("ICMPv6 type(%d), code(%d) from %s of length %ld",
   nd_ra->nd_ra_typend_ra_hdr.icmp6_type, nd_ra->nd_ra_codend_ra_hdr.icmp6_code, hbuf, len);

if (nd_ra->nd_ra_codend_ra_hdr.icmp6_code != 0) {
log_warnx("invalid ICMPv6 code (%d) from %s", nd_ra->nd_ra_codend_ra_hdr.icmp6_code,
    hbuf);
goto err;
}

memcpy(&radv->from, &ra->from, sizeof(ra->from));

if (clock_gettime(CLOCK_REALTIME0, &radv->when))
fatal("clock_gettime");
if (clock_gettime(CLOCK_MONOTONIC3, &radv->uptime))
fatal("clock_gettime");

radv->curhoplimit = nd_ra->nd_ra_curhoplimitnd_ra_hdr.icmp6_dataun.icmp6_un_data8[0];
radv->managed = nd_ra->nd_ra_flags_reservednd_ra_hdr.icmp6_dataun.icmp6_un_data8[1] & ND_RA_FLAG_MANAGED0x80;
radv->other = nd_ra->nd_ra_flags_reservednd_ra_hdr.icmp6_dataun.icmp6_un_data8[1] & ND_RA_FLAG_OTHER0x40;

switch (nd_ra->nd_ra_flags_reservednd_ra_hdr.icmp6_dataun.icmp6_un_data8[1] & ND_RA_FLAG_RTPREF_MASK0x18) {
case ND_RA_FLAG_RTPREF_HIGH0x08:
radv->rpref=HIGH;
break;
case ND_RA_FLAG_RTPREF_LOW0x18:
radv->rpref=LOW;
break;
case ND_RA_FLAG_RTPREF_MEDIUM0x00:
/* fallthrough */
default:
radv->rpref=MEDIUM;
break;
}
radv->router_lifetime = ntohs(nd_ra->nd_ra_router_lifetime)(__uint16_t)(__builtin_constant_p(nd_ra->nd_ra_hdr.icmp6_dataun
.icmp6_un_data16[1]) ? (__uint16_t)(((__uint16_t)(nd_ra->nd_ra_hdr
.icmp6_dataun.icmp6_un_data16[1]) & 0xffU) << 8 | (
(__uint16_t)(nd_ra->nd_ra_hdr.icmp6_dataun.icmp6_un_data16
[1]) & 0xff00U) >> 8) : __swap16md(nd_ra->nd_ra_hdr
.icmp6_dataun.icmp6_un_data16[1]));
if (radv->router_lifetime != 0)
radv->min_lifetime = radv->router_lifetime;
radv->reachable_time = ntohl(nd_ra->nd_ra_reachable)(__uint32_t)(__builtin_constant_p(nd_ra->nd_ra_reachable) ?
 (__uint32_t)(((__uint32_t)(nd_ra->nd_ra_reachable) & 0xff
) << 24 | ((__uint32_t)(nd_ra->nd_ra_reachable) &
 0xff00) << 8 | ((__uint32_t)(nd_ra->nd_ra_reachable
) & 0xff0000) >> 8 | ((__uint32_t)(nd_ra->nd_ra_reachable
) & 0xff000000) >> 24) : __swap32md(nd_ra->nd_ra_reachable
));
radv->retrans_time = ntohl(nd_ra->nd_ra_retransmit)(__uint32_t)(__builtin_constant_p(nd_ra->nd_ra_retransmit)
 ? (__uint32_t)(((__uint32_t)(nd_ra->nd_ra_retransmit) &
 0xff) << 24 | ((__uint32_t)(nd_ra->nd_ra_retransmit
) & 0xff00) << 8 | ((__uint32_t)(nd_ra->nd_ra_retransmit
) & 0xff0000) >> 8 | ((__uint32_t)(nd_ra->nd_ra_retransmit
) & 0xff000000) >> 24) : __swap32md(nd_ra->nd_ra_retransmit
));

while ((size_t)len >= sizeof(struct nd_opt_hdr)) {
struct nd_opt_hdr *nd_opt_hdr = (struct nd_opt_hdr *)p;
struct nd_opt_prefix_info *prf;
struct nd_opt_rdnss *rdnss;
struct nd_opt_mtu *mtu;
struct in6_addr *in6;
int i;

len -= sizeof(struct nd_opt_hdr);
p += sizeof(struct nd_opt_hdr);

if (nd_opt_hdr->nd_opt_len * 8 - 2 > len) {
	log_warnx("invalid option len: %u > %ld",
	    nd_opt_hdr->nd_opt_len, len);
	goto err;
}

switch (nd_opt_hdr->nd_opt_type) {
case ND_OPT_PREFIX_INFORMATION3:
	if (nd_opt_hdr->nd_opt_len != 4) {
		log_warnx("invalid ND_OPT_PREFIX_INFORMATION: "
		   "len != 4");
		goto err;
	}

	if ((prefix = calloc(1, sizeof(*prefix))) == NULL((void *)0))
		fatal("calloc");

	prf = (struct nd_opt_prefix_info*) nd_opt_hdr;
	prefix->prefix = prf->nd_opt_pi_prefix;
	prefix->prefix_len = prf->nd_opt_pi_prefix_len;
	prefix->onlink = prf->nd_opt_pi_flags_reserved &
	    ND_OPT_PI_FLAG_ONLINK0x80;
	prefix->autonomous = prf->nd_opt_pi_flags_reserved &
	    ND_OPT_PI_FLAG_AUTO0x40;
	prefix->vltime = ntohl(prf->nd_opt_pi_valid_time)(__uint32_t)(__builtin_constant_p(prf->nd_opt_pi_valid_time
) ? (__uint32_t)(((__uint32_t)(prf->nd_opt_pi_valid_time) &
 0xff) << 24 | ((__uint32_t)(prf->nd_opt_pi_valid_time
) & 0xff00) << 8 | ((__uint32_t)(prf->nd_opt_pi_valid_time
) & 0xff0000) >> 8 | ((__uint32_t)(prf->nd_opt_pi_valid_time
) & 0xff000000) >> 24) : __swap32md(prf->nd_opt_pi_valid_time
));
	prefix->pltime = ntohl(prf->nd_opt_pi_preferred_time)(__uint32_t)(__builtin_constant_p(prf->nd_opt_pi_preferred_time
) ? (__uint32_t)(((__uint32_t)(prf->nd_opt_pi_preferred_time
) & 0xff) << 24 | ((__uint32_t)(prf->nd_opt_pi_preferred_time
) & 0xff00) << 8 | ((__uint32_t)(prf->nd_opt_pi_preferred_time
) & 0xff0000) >> 8 | ((__uint32_t)(prf->nd_opt_pi_preferred_time
) & 0xff000000) >> 24) : __swap32md(prf->nd_opt_pi_preferred_time
));
	if (radv->min_lifetime > prefix->pltime)
		radv->min_lifetime = prefix->pltime;

	LIST_INSERT_HEAD(&radv->prefixes, prefix, entries)do { if (((prefix)->entries.le_next = (&radv->prefixes
)->lh_first) != ((void *)0)) (&radv->prefixes)->
lh_first->entries.le_prev = &(prefix)->entries.le_next
; (&radv->prefixes)->lh_first = (prefix); (prefix)->
entries.le_prev = &(&radv->prefixes)->lh_first;
 } while (0);

	break;

case ND_OPT_RDNSS25:
	if (nd_opt_hdr->nd_opt_len  < 3) {
		log_warnx("invalid ND_OPT_RDNSS: len < 24");
		goto err;
	}

	if ((nd_opt_hdr->nd_opt_len - 1) % 2 != 0) {
		log_warnx("invalid ND_OPT_RDNSS: length with"
		    "out header is not multiply of 16: %d",
		    (nd_opt_hdr->nd_opt_len - 1) * 8);
		goto err;
	}

	rdnss = (struct nd_opt_rdnss*) nd_opt_hdr;

	radv->rdns_lifetime = ntohl((__uint32_t)(__builtin_constant_p(rdnss->nd_opt_rdnss_lifetime
) ? (__uint32_t)(((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff) << 24 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff00) << 8 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff0000) >> 8 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff000000) >> 24) : __swap32md(rdnss->nd_opt_rdnss_lifetime
))
	    rdnss->nd_opt_rdnss_lifetime)(__uint32_t)(__builtin_constant_p(rdnss->nd_opt_rdnss_lifetime
) ? (__uint32_t)(((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff) << 24 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff00) << 8 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff0000) >> 8 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff000000) >> 24) : __swap32md(rdnss->nd_opt_rdnss_lifetime
));
	if (radv->min_lifetime > radv->rdns_lifetime)
		radv->min_lifetime = radv->rdns_lifetime;

	in6 = (struct in6_addr*) (p + 6);
	for (i=0; i < (nd_opt_hdr->nd_opt_len - 1)/2; i++,
	    in6++) {
		if((rdns = calloc(1, sizeof(*rdns))) == NULL((void *)0))
			fatal("calloc");
		memcpy(&rdns->rdns, in6, sizeof(rdns->rdns));
		LIST_INSERT_HEAD(&radv->rdns_servers, rdns,do { if (((rdns)->entries.le_next = (&radv->rdns_servers
)->lh_first) != ((void *)0)) (&radv->rdns_servers)->
lh_first->entries.le_prev = &(rdns)->entries.le_next
; (&radv->rdns_servers)->lh_first = (rdns); (rdns)->
entries.le_prev = &(&radv->rdns_servers)->lh_first
; } while (0)
		    entries)do { if (((rdns)->entries.le_next = (&radv->rdns_servers
)->lh_first) != ((void *)0)) (&radv->rdns_servers)->
lh_first->entries.le_prev = &(rdns)->entries.le_next
; (&radv->rdns_servers)->lh_first = (rdns); (rdns)->
entries.le_prev = &(&radv->rdns_servers)->lh_first
; } while (0);
	}
	break;
case ND_OPT_MTU5:
	if (nd_opt_hdr->nd_opt_len != 1) {
		log_warnx("invalid ND_OPT_MTU: len != 1");
		goto err;
	}
	mtu = (struct nd_opt_mtu*) nd_opt_hdr;
	radv->mtu = ntohl(mtu->nd_opt_mtu_mtu)(__uint32_t)(__builtin_constant_p(mtu->nd_opt_mtu_mtu) ? (
__uint32_t)(((__uint32_t)(mtu->nd_opt_mtu_mtu) & 0xff)
 << 24 | ((__uint32_t)(mtu->nd_opt_mtu_mtu) & 0xff00
) << 8 | ((__uint32_t)(mtu->nd_opt_mtu_mtu) & 0xff0000
) >> 8 | ((__uint32_t)(mtu->nd_opt_mtu_mtu) & 0xff000000
) >> 24) : __swap32md(mtu->nd_opt_mtu_mtu));

	/* path MTU cannot be less than IPV6_MMTU */
	if (radv->mtu < IPV6_MMTU1280) {
		radv->mtu = 0;
		log_warnx("invalid advertised MTU");
	}

	break;
case ND_OPT_DNSSL31:
case ND_OPT_REDIRECTED_HEADER4:
case ND_OPT_SOURCE_LINKADDR1:
case ND_OPT_TARGET_LINKADDR2:
case ND_OPT_ROUTE_INFO24:
1555#if 0
	log_debug("\tOption: %u (len: %u) not implemented",
	    nd_opt_hdr->nd_opt_type, nd_opt_hdr->nd_opt_len *
	    8);
1559#endif
	break;
default:
	log_debug("\t\tUNKNOWN: %d", nd_opt_hdr->nd_opt_type);
	break;

}
len -= nd_opt_hdr->nd_opt_len * 8 - 2;
p += nd_opt_hdr->nd_opt_len * 8 - 2;
}
update_iface_ra(iface, radv);
return;

1572err:
free_ra(radv);
1574}

1576void
1577gen_addr(struct slaacd_iface *iface, struct radv_prefix *prefix, struct
  address_proposal *addr_proposal, int temporary)
1579{
SHA2_CTX ctx;
struct in6_addr	iid;
int i;
u_int8_t digest[SHA512_DIGEST_LENGTH64];

memset(&iid, 0, sizeof(iid));

/* from in6_ifadd() in nd6_rtr.c */
/* XXX from in6.h, guarded by #ifdef _KERNEL   XXX nonstandard */
1589#define s6_addr32 __u6_addr.__u6_addr32

in6_prefixlen2mask(&addr_proposal->mask, addr_proposal->prefix_len);

memset(&addr_proposal->addr, 0, sizeof(addr_proposal->addr));

addr_proposal->addr.sin6_family = AF_INET624;
addr_proposal->addr.sin6_len = sizeof(addr_proposal->addr);

memcpy(&addr_proposal->addr.sin6_addr, &prefix->prefix,
   sizeof(addr_proposal->addr.sin6_addr));

for (i = 0; i < 4; i++)
addr_proposal->addr.sin6_addr.s6_addr32[i] &=
    addr_proposal->mask.s6_addr32[i];

if (temporary) {
arc4random_buf(&iid.s6_addr__u6_addr.__u6_addr8, sizeof(iid.s6_addr__u6_addr.__u6_addr8));
} else if (iface->soii) {
SHA512Init(&ctx);
SHA512Update(&ctx, &prefix->prefix,
    sizeof(prefix->prefix));
SHA512Update(&ctx, &iface->hw_address,
    sizeof(iface->hw_address));
SHA512Update(&ctx, &prefix->dad_counter,
    sizeof(prefix->dad_counter));
SHA512Update(&ctx, addr_proposal->soiikey,
    sizeof(addr_proposal->soiikey));
SHA512Final(digest, &ctx);

memcpy(&iid.s6_addr__u6_addr.__u6_addr8, digest + (sizeof(digest) -
    sizeof(iid.s6_addr__u6_addr.__u6_addr8)), sizeof(iid.s6_addr__u6_addr.__u6_addr8));
} else {
/* This is safe, because we have a 64 prefix len */
memcpy(&iid.s6_addr__u6_addr.__u6_addr8, &iface->ll_address.sin6_addr,
    sizeof(iid.s6_addr__u6_addr.__u6_addr8));
}

for (i = 0; i < 4; i++)
addr_proposal->addr.sin6_addr.s6_addr32[i] |=
    (iid.s6_addr32[i] & ~addr_proposal->mask.s6_addr32[i]);
1630#undef s6_addr32
1631}

1633/* from sys/netinet6/in6.c */
1634void
1635in6_prefixlen2mask(struct in6_addr *maskp, int len)
1636{
u_char maskarray[8] = {0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff};
int bytelen, bitlen, i;

if (0 > len || len > 128)
fatalx("%s: invalid prefix length(%d)\n", __func__, len);

bzero(maskp, sizeof(*maskp));
bytelen = len / 8;
bitlen = len % 8;
for (i = 0; i < bytelen; i++)
maskp->s6_addr__u6_addr.__u6_addr8[i] = 0xff;
/* len == 128 is ok because bitlen == 0 then */
if (bitlen)
maskp->s6_addr__u6_addr.__u6_addr8[bytelen] = maskarray[bitlen - 1];
1651}

1653#ifndef	SMALL
1654/* from kame via ifconfig, where it's called prefix() */
1655int
1656in6_mask2prefixlen(struct in6_addr *in6)
1657{
u_char *nam = (u_char *)in6;
int byte, bit, plen = 0, size = sizeof(struct in6_addr);

for (byte = 0; byte < size; byte++, plen += 8)
if (nam[byte] != 0xff)
	break;
if (byte == size)
return (plen);
for (bit = 7; bit != 0; bit--, plen++)
if (!(nam[byte] & (1 << bit)))
	break;
for (; bit != 0; bit--)
if (nam[byte] & (1 << bit))
	return (0);
byte++;
for (; byte < size; byte++)
if (nam[byte])
	return (0);
return (plen);
1677}

1679void
1680debug_log_ra(struct imsg_ra *ra)
1681{
struct nd_router_advert	*nd_ra;
ssize_t			 len = ra->len;
char			 ntopbuf[INET6_ADDRSTRLEN46];
const char		*hbuf;
uint8_t			*p;

hbuf = sin6_to_str(&ra->from);

if (!IN6_IS_ADDR_LINKLOCAL(&ra->from.sin6_addr)(((&ra->from.sin6_addr)->__u6_addr.__u6_addr8[0] ==
 0xfe) && (((&ra->from.sin6_addr)->__u6_addr
.__u6_addr8[1] & 0xc0) == 0x80))) {
log_warnx("RA from non link local address %s", hbuf);
return;
}

if ((size_t)len < sizeof(struct nd_router_advert)) {
log_warnx("received too short message (%ld) from %s", len,
    hbuf);
return;
}

p = ra->packet;
nd_ra = (struct nd_router_advert *)p;
len -= sizeof(struct nd_router_advert);
p += sizeof(struct nd_router_advert);

log_debug("ICMPv6 type(%d), code(%d) from %s of length %ld",
   nd_ra->nd_ra_typend_ra_hdr.icmp6_type, nd_ra->nd_ra_codend_ra_hdr.icmp6_code, hbuf, len);

if (nd_ra->nd_ra_typend_ra_hdr.icmp6_type != ND_ROUTER_ADVERT134) {
log_warnx("invalid ICMPv6 type (%d) from %s", nd_ra->nd_ra_typend_ra_hdr.icmp6_type,
    hbuf);
return;
}

if (nd_ra->nd_ra_codend_ra_hdr.icmp6_code != 0) {
log_warnx("invalid ICMPv6 code (%d) from %s", nd_ra->nd_ra_codend_ra_hdr.icmp6_code,
    hbuf);
return;
}

log_debug("---");
log_debug("RA from %s", hbuf);
log_debug("\tCur Hop Limit: %u", nd_ra->nd_ra_curhoplimitnd_ra_hdr.icmp6_dataun.icmp6_un_data8[0]);
log_debug("\tManaged address configuration: %d",
   (nd_ra->nd_ra_flags_reservednd_ra_hdr.icmp6_dataun.icmp6_un_data8[1] & ND_RA_FLAG_MANAGED0x80) ? 1 : 0);
log_debug("\tOther configuration: %d",
   (nd_ra->nd_ra_flags_reservednd_ra_hdr.icmp6_dataun.icmp6_un_data8[1] & ND_RA_FLAG_OTHER0x40) ? 1 : 0);
switch (nd_ra->nd_ra_flags_reservednd_ra_hdr.icmp6_dataun.icmp6_un_data8[1] & ND_RA_FLAG_RTPREF_MASK0x18) {
case ND_RA_FLAG_RTPREF_HIGH0x08:
log_debug("\tRouter Preference: high");
break;
case ND_RA_FLAG_RTPREF_MEDIUM0x00:
log_debug("\tRouter Preference: medium");
break;
case ND_RA_FLAG_RTPREF_LOW0x18:
log_debug("\tRouter Preference: low");
break;
case ND_RA_FLAG_RTPREF_RSV0x10:
log_debug("\tRouter Preference: reserved");
break;
}
log_debug("\tRouter Lifetime: %hds",
   ntohs(nd_ra->nd_ra_router_lifetime)(__uint16_t)(__builtin_constant_p(nd_ra->nd_ra_hdr.icmp6_dataun
.icmp6_un_data16[1]) ? (__uint16_t)(((__uint16_t)(nd_ra->nd_ra_hdr
.icmp6_dataun.icmp6_un_data16[1]) & 0xffU) << 8 | (
(__uint16_t)(nd_ra->nd_ra_hdr.icmp6_dataun.icmp6_un_data16
[1]) & 0xff00U) >> 8) : __swap16md(nd_ra->nd_ra_hdr
.icmp6_dataun.icmp6_un_data16[1])));
log_debug("\tReachable Time: %ums", ntohl(nd_ra->nd_ra_reachable)(__uint32_t)(__builtin_constant_p(nd_ra->nd_ra_reachable) ?
 (__uint32_t)(((__uint32_t)(nd_ra->nd_ra_reachable) & 0xff
) << 24 | ((__uint32_t)(nd_ra->nd_ra_reachable) &
 0xff00) << 8 | ((__uint32_t)(nd_ra->nd_ra_reachable
) & 0xff0000) >> 8 | ((__uint32_t)(nd_ra->nd_ra_reachable
) & 0xff000000) >> 24) : __swap32md(nd_ra->nd_ra_reachable
)));
log_debug("\tRetrans Timer: %ums", ntohl(nd_ra->nd_ra_retransmit)(__uint32_t)(__builtin_constant_p(nd_ra->nd_ra_retransmit)
 ? (__uint32_t)(((__uint32_t)(nd_ra->nd_ra_retransmit) &
 0xff) << 24 | ((__uint32_t)(nd_ra->nd_ra_retransmit
) & 0xff00) << 8 | ((__uint32_t)(nd_ra->nd_ra_retransmit
) & 0xff0000) >> 8 | ((__uint32_t)(nd_ra->nd_ra_retransmit
) & 0xff000000) >> 24) : __swap32md(nd_ra->nd_ra_retransmit
)));

while ((size_t)len >= sizeof(struct nd_opt_hdr)) {
struct nd_opt_hdr *nd_opt_hdr = (struct nd_opt_hdr *)p;
struct nd_opt_mtu *mtu;
struct nd_opt_prefix_info *prf;
struct nd_opt_rdnss *rdnss;
struct in6_addr *in6;
int i;

len -= sizeof(struct nd_opt_hdr);
p += sizeof(struct nd_opt_hdr);
if (nd_opt_hdr->nd_opt_len * 8 - 2 > len) {
	log_warnx("invalid option len: %u > %ld",
	    nd_opt_hdr->nd_opt_len, len);
	return;
}
log_debug("\tOption: %u (len: %u)", nd_opt_hdr->nd_opt_type,
    nd_opt_hdr->nd_opt_len * 8);
switch (nd_opt_hdr->nd_opt_type) {
case ND_OPT_SOURCE_LINKADDR1:
	if (nd_opt_hdr->nd_opt_len == 1)
		log_debug("\t\tND_OPT_SOURCE_LINKADDR: "
		    "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x",
		    p[0], p[1], p[2], p[3], p[4], p[5], p[6],
		    p[7]);
	else
		log_debug("\t\tND_OPT_SOURCE_LINKADDR");
	break;
case ND_OPT_TARGET_LINKADDR2:
	if (nd_opt_hdr->nd_opt_len == 1)
		log_debug("\t\tND_OPT_TARGET_LINKADDR: "
		    "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x",
		    p[0], p[1], p[2], p[3], p[4], p[5], p[6],
		    p[7]);
	else
		log_debug("\t\tND_OPT_TARGET_LINKADDR");
	break;
case ND_OPT_PREFIX_INFORMATION3:
	if (nd_opt_hdr->nd_opt_len != 4) {
		log_warnx("invalid ND_OPT_PREFIX_INFORMATION: "
		   "len != 4");
		return;
	}
	prf = (struct nd_opt_prefix_info*) nd_opt_hdr;

	log_debug("\t\tND_OPT_PREFIX_INFORMATION: %s/%u",
	    inet_ntop(AF_INET624, &prf->nd_opt_pi_prefix,
	    ntopbuf, INET6_ADDRSTRLEN46),
	    prf->nd_opt_pi_prefix_len);
	log_debug("\t\t\tOn-link: %d",
	    prf->nd_opt_pi_flags_reserved &
	    ND_OPT_PI_FLAG_ONLINK0x80 ? 1:0);
	log_debug("\t\t\tAutonomous address-configuration: %d",
	    prf->nd_opt_pi_flags_reserved &
	    ND_OPT_PI_FLAG_AUTO0x40 ? 1 : 0);
	log_debug("\t\t\tvltime: %u",
	    ntohl(prf->nd_opt_pi_valid_time)(__uint32_t)(__builtin_constant_p(prf->nd_opt_pi_valid_time
) ? (__uint32_t)(((__uint32_t)(prf->nd_opt_pi_valid_time) &
 0xff) << 24 | ((__uint32_t)(prf->nd_opt_pi_valid_time
) & 0xff00) << 8 | ((__uint32_t)(prf->nd_opt_pi_valid_time
) & 0xff0000) >> 8 | ((__uint32_t)(prf->nd_opt_pi_valid_time
) & 0xff000000) >> 24) : __swap32md(prf->nd_opt_pi_valid_time
)));
	log_debug("\t\t\tpltime: %u",
	    ntohl(prf->nd_opt_pi_preferred_time)(__uint32_t)(__builtin_constant_p(prf->nd_opt_pi_preferred_time
) ? (__uint32_t)(((__uint32_t)(prf->nd_opt_pi_preferred_time
) & 0xff) << 24 | ((__uint32_t)(prf->nd_opt_pi_preferred_time
) & 0xff00) << 8 | ((__uint32_t)(prf->nd_opt_pi_preferred_time
) & 0xff0000) >> 8 | ((__uint32_t)(prf->nd_opt_pi_preferred_time
) & 0xff000000) >> 24) : __swap32md(prf->nd_opt_pi_preferred_time
)));
	break;
case ND_OPT_REDIRECTED_HEADER4:
	log_debug("\t\tND_OPT_REDIRECTED_HEADER");
	break;
case ND_OPT_MTU5:
	if (nd_opt_hdr->nd_opt_len != 1) {
		log_warnx("invalid ND_OPT_MTU: len != 1");
		return;
	}
	mtu = (struct nd_opt_mtu*) nd_opt_hdr;
	log_debug("\t\tND_OPT_MTU: %u",
	    ntohl(mtu->nd_opt_mtu_mtu)(__uint32_t)(__builtin_constant_p(mtu->nd_opt_mtu_mtu) ? (
__uint32_t)(((__uint32_t)(mtu->nd_opt_mtu_mtu) & 0xff)
 << 24 | ((__uint32_t)(mtu->nd_opt_mtu_mtu) & 0xff00
) << 8 | ((__uint32_t)(mtu->nd_opt_mtu_mtu) & 0xff0000
) >> 8 | ((__uint32_t)(mtu->nd_opt_mtu_mtu) & 0xff000000
) >> 24) : __swap32md(mtu->nd_opt_mtu_mtu)));
	break;
case ND_OPT_ROUTE_INFO24:
	log_debug("\t\tND_OPT_ROUTE_INFO");
	break;
case ND_OPT_RDNSS25:
	if (nd_opt_hdr->nd_opt_len  < 3) {
		log_warnx("invalid ND_OPT_RDNSS: len < 24");
		return;
	}
	if ((nd_opt_hdr->nd_opt_len - 1) % 2 != 0) {
		log_warnx("invalid ND_OPT_RDNSS: length with"
		    "out header is not multiply of 16: %d",
		    (nd_opt_hdr->nd_opt_len - 1) * 8);
		return;
	}
	rdnss = (struct nd_opt_rdnss*) nd_opt_hdr;
	log_debug("\t\tND_OPT_RDNSS: lifetime: %u", ntohl((__uint32_t)(__builtin_constant_p(rdnss->nd_opt_rdnss_lifetime
) ? (__uint32_t)(((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff) << 24 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff00) << 8 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff0000) >> 8 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff000000) >> 24) : __swap32md(rdnss->nd_opt_rdnss_lifetime
))
	    rdnss->nd_opt_rdnss_lifetime)(__uint32_t)(__builtin_constant_p(rdnss->nd_opt_rdnss_lifetime
) ? (__uint32_t)(((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff) << 24 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff00) << 8 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff0000) >> 8 | ((__uint32_t)(rdnss->nd_opt_rdnss_lifetime
) & 0xff000000) >> 24) : __swap32md(rdnss->nd_opt_rdnss_lifetime
)));
	in6 = (struct in6_addr*) (p + 6);
	for (i=0; i < (nd_opt_hdr->nd_opt_len - 1)/2; i++,
	    in6++) {
		log_debug("\t\t\t%s", inet_ntop(AF_INET624, in6,
		    ntopbuf, INET6_ADDRSTRLEN46));
	}
	break;
default:
	log_debug("\t\tUNKNOWN: %d", nd_opt_hdr->nd_opt_type);
	break;

}
len -= nd_opt_hdr->nd_opt_len * 8 - 2;
p += nd_opt_hdr->nd_opt_len * 8 - 2;
}
1850}
1851#endif	/* SMALL */

1853void update_iface_ra(struct slaacd_iface *iface, struct radv *ra)
1854{
struct radv		*old_ra;
struct radv_prefix	*prefix;

if ((old_ra = find_ra(iface, &ra->from)) == NULL((void *)0))
LIST_INSERT_HEAD(&iface->radvs, ra, entries)do { if (((ra)->entries.le_next = (&iface->radvs)->
lh_first) != ((void *)0)) (&iface->radvs)->lh_first
->entries.le_prev = &(ra)->entries.le_next; (&iface
->radvs)->lh_first = (ra); (ra)->entries.le_prev = &
(&iface->radvs)->lh_first; } while (0);
else {
LIST_REPLACE(old_ra, ra, entries)do { if (((ra)->entries.le_next = (old_ra)->entries.le_next
) != ((void *)0)) (ra)->entries.le_next->entries.le_prev
 = &(ra)->entries.le_next; (ra)->entries.le_prev = (
old_ra)->entries.le_prev; *(ra)->entries.le_prev = (ra)
; ; ; } while (0);
merge_dad_couters(old_ra, ra);
free_ra(old_ra);
}

update_iface_ra_dfr(iface, ra);

LIST_FOREACH(prefix, &ra->prefixes, entries)for((prefix) = ((&ra->prefixes)->lh_first); (prefix
)!= ((void *)0); (prefix) = ((prefix)->entries.le_next)) {
if (!prefix->autonomous || prefix->vltime == 0 ||
    prefix->pltime > prefix->vltime ||
    IN6_IS_ADDR_LINKLOCAL(&prefix->prefix)(((&prefix->prefix)->__u6_addr.__u6_addr8[0] == 0xfe
) && (((&prefix->prefix)->__u6_addr.__u6_addr8
[1] & 0xc0) == 0x80)))
	continue;
update_iface_ra_prefix(iface, ra, prefix);
}

update_iface_ra_rdns(iface, ra);
1877}

1879void
1880update_iface_ra_dfr(struct slaacd_iface *iface, struct radv *ra)
1881{
struct dfr_proposal	*dfr_proposal;

dfr_proposal = find_dfr_proposal_by_gw(iface, &ra->from);

if (ra->router_lifetime == 0) {
free_dfr_proposal(dfr_proposal);
return;
}

if (!dfr_proposal) {
/* new proposal */
gen_dfr_proposal(iface, ra);
return;
}

dfr_proposal->when = ra->when;
dfr_proposal->uptime = ra->uptime;
dfr_proposal->router_lifetime = ra->router_lifetime;

log_debug("%s, dfr state: %s, rl: %d", __func__,
   proposal_state_name(dfr_proposal->state),
   real_lifetime(&dfr_proposal->uptime,
   dfr_proposal->router_lifetime));

switch (dfr_proposal->state) {
case PROPOSAL_CONFIGURED:
case PROPOSAL_NEARLY_EXPIRED:
/* routes do not expire in the kernel, update timeout */
dfr_proposal_state_transition(dfr_proposal,
    PROPOSAL_CONFIGURED);
break;
case PROPOSAL_IF_DOWN:
case PROPOSAL_WITHDRAWN:
log_debug("updating dfr");
configure_dfr(dfr_proposal);
break;
default:
log_debug("%s: iface %d: %s", __func__, iface->if_index,
    sin6_to_str(&dfr_proposal->addr));
break;
}
1923}

1925void
1926update_iface_ra_prefix(struct slaacd_iface *iface, struct radv *ra,
  struct radv_prefix *prefix)
1928{
struct address_proposal	*addr_proposal;
uint32_t		 pltime, vltime;
int			 found, found_temporary, duplicate_found;

found = found_temporary = duplicate_found = 0;

if (!!iface->autoconf != !!iface->temporary) {
struct address_proposal	*tmp;
/*
 * If only the autoconf or temporary flag is set, check if we
 * have the "other kind" of address configured and delete it.
 */
LIST_FOREACH_SAFE (addr_proposal, &iface->addr_proposals,for ((addr_proposal) = ((&iface->addr_proposals)->lh_first
); (addr_proposal) && ((tmp) = ((addr_proposal)->entries
.le_next), 1); (addr_proposal) = (tmp))
    entries, tmp)for ((addr_proposal) = ((&iface->addr_proposals)->lh_first
); (addr_proposal) && ((tmp) = ((addr_proposal)->entries
.le_next), 1); (addr_proposal) = (tmp)) {
	if ((!addr_proposal->temporary && !iface->autoconf) ||
	    (addr_proposal->temporary && !iface->temporary))
		free_address_proposal(addr_proposal);
}
}

LIST_FOREACH(addr_proposal, &iface->addr_proposals, entries)for((addr_proposal) = ((&iface->addr_proposals)->lh_first
); (addr_proposal)!= ((void *)0); (addr_proposal) = ((addr_proposal
)->entries.le_next)) {
if (prefix->prefix_len == addr_proposal-> prefix_len &&
    memcmp(&prefix->prefix, &addr_proposal->prefix,
    sizeof(struct in6_addr)) != 0)
	continue;

if (memcmp(&addr_proposal->hw_address,
    &iface->hw_address,
    sizeof(addr_proposal->hw_address)) != 0)
	continue;

if (memcmp(&addr_proposal->soiikey, &iface->soiikey,
    sizeof(addr_proposal->soiikey)) != 0)
	continue;

if (addr_proposal->state == PROPOSAL_DUPLICATED) {
	duplicate_found = 1;
	continue;
}

vltime = prefix->vltime;

if (addr_proposal->temporary) {
	struct timespec	now;
	int64_t		ltime, mtime;

	if (clock_gettime(CLOCK_MONOTONIC3, &now))
		fatal("clock_gettime");

	mtime = addr_proposal->created.tv_sec +
	    PRIV_PREFERRED_LIFETIME86400 -
	    addr_proposal->desync_factor;

	ltime = MINIMUM(mtime, now.tv_sec + prefix->pltime)(((mtime) < (now.tv_sec + prefix->pltime)) ? (mtime) : (
now.tv_sec + prefix->pltime)) -
	    now.tv_sec;

	pltime = ltime > 0 ? ltime : 0;

	ltime = MINIMUM(addr_proposal->created.tv_sec +(((addr_proposal->created.tv_sec + 172800) < (now.tv_sec
 + vltime)) ? (addr_proposal->created.tv_sec + 172800) : (
now.tv_sec + vltime))
	    PRIV_VALID_LIFETIME, now.tv_sec + vltime)(((addr_proposal->created.tv_sec + 172800) < (now.tv_sec
 + vltime)) ? (addr_proposal->created.tv_sec + 172800) : (
now.tv_sec + vltime)) -
	    now.tv_sec;
	vltime = ltime > 0 ? ltime : 0;

	if ((mtime - now.tv_sec) > PRIV_REGEN_ADVANCE5)
		found_temporary = 1;
} else {
	pltime = prefix->pltime;
	found = 1;
}

addr_proposal->from = ra->from;
addr_proposal->when = ra->when;
addr_proposal->uptime = ra->uptime;

addr_proposal->vltime = vltime;
addr_proposal->pltime = pltime;

if (ra->mtu == iface->cur_mtu)
	addr_proposal->mtu = 0;
else {
	addr_proposal->mtu = ra->mtu;
	iface->cur_mtu = ra->mtu;
}

log_debug("%s, addr state: %s", __func__,
    proposal_state_name(addr_proposal->state));

switch (addr_proposal->state) {
case PROPOSAL_CONFIGURED:
case PROPOSAL_NEARLY_EXPIRED:
case PROPOSAL_IF_DOWN:
case PROPOSAL_WITHDRAWN:
	log_debug("updating address");
	configure_address(addr_proposal);
	break;
default:
	log_debug("%s: iface %d: %s", __func__, iface->if_index,
	    sin6_to_str(&addr_proposal->addr));
	break;
}
}

if (!found && iface->autoconf && duplicate_found && iface->soii) {
prefix->dad_counter++;
log_debug("%s dad_counter: %d", __func__, prefix->dad_counter);
gen_address_proposal(iface, ra, prefix, 0);
} else if (!found  && iface->autoconf && (iface->soii ||
   prefix->prefix_len <= 64))
/* new proposal */
gen_address_proposal(iface, ra, prefix, 0);

/* temporary addresses do not depend on eui64 */
if (!found_temporary && iface->temporary) {
if (prefix->pltime >= PRIV_REGEN_ADVANCE5) {
	/* new temporary proposal */
	gen_address_proposal(iface, ra, prefix, 1);
} else if (prefix->pltime > 0) {
	log_warnx("%s: pltime from %s is too small: %d < %d; "
	    "not generating temporary address", __func__,
	    sin6_to_str(&ra->from), prefix->pltime,
	    PRIV_REGEN_ADVANCE5);
}
}
2052}

2054void
2055update_iface_ra_rdns(struct slaacd_iface *iface, struct radv *ra)
2056{
struct rdns_proposal	*rdns_proposal;
struct radv_rdns	*radv_rdns;
struct in6_addr		 rdns[MAX_RDNS_COUNT8];
int			 rdns_count;

rdns_proposal = find_rdns_proposal_by_gw(iface, &ra->from);

if (!rdns_proposal) {
/* new proposal */
if (!LIST_EMPTY(&ra->rdns_servers)(((&ra->rdns_servers)->lh_first) == ((void *)0)))
	gen_rdns_proposal(iface, ra);
return;
}

rdns_count = 0;
memset(&rdns, 0, sizeof(rdns));
LIST_FOREACH(radv_rdns, &ra->rdns_servers, entries)for((radv_rdns) = ((&ra->rdns_servers)->lh_first); (
radv_rdns)!= ((void *)0); (radv_rdns) = ((radv_rdns)->entries
.le_next)) {
memcpy(&rdns[rdns_count++],
    &radv_rdns->rdns, sizeof(struct in6_addr));
if (rdns_proposal->rdns_count == MAX_RDNS_COUNT8)
	break;
}

if (rdns_count == 0) {
free_rdns_proposal(rdns_proposal);
return;
}

if (rdns_proposal->rdns_count != rdns_count ||
   memcmp(&rdns_proposal->rdns, &rdns, sizeof(rdns)) != 0) {
memcpy(&rdns_proposal->rdns, &rdns, sizeof(rdns));
rdns_proposal->rdns_count = rdns_count;
rdns_proposal->state = PROPOSAL_NOT_CONFIGURED;
}
rdns_proposal->when = ra->when;
rdns_proposal->uptime = ra->uptime;
rdns_proposal->rdns_lifetime = ra->rdns_lifetime;

log_debug("%s, rdns state: %s, rl: %d", __func__,
   proposal_state_name(rdns_proposal->state),
   real_lifetime(&rdns_proposal->uptime,
   rdns_proposal->rdns_lifetime));

switch (rdns_proposal->state) {
case PROPOSAL_CONFIGURED:
case PROPOSAL_NEARLY_EXPIRED:
/* rdns are not expired by the kernel, update timeout */
rdns_proposal_state_transition(rdns_proposal,
    PROPOSAL_CONFIGURED);
break;
case PROPOSAL_IF_DOWN:
case PROPOSAL_WITHDRAWN:
case PROPOSAL_NOT_CONFIGURED:
log_debug("updating rdns");
rdns_proposal_state_transition(rdns_proposal,
    PROPOSAL_CONFIGURED);
compose_rdns_proposal(rdns_proposal->if_index,
    rdns_proposal->rdomain);
break;
default:
log_debug("%s: iface %d: %s", __func__, iface->if_index,
    sin6_to_str(&rdns_proposal->from));
break;
}
2121}


2124void
2125configure_address(struct address_proposal *addr_proposal)
2126{
struct imsg_configure_address	 address;
struct slaacd_iface		*iface;

log_debug("%s: %d", __func__, addr_proposal->if_index);

address.if_index = addr_proposal->if_index;
memcpy(&address.addr, &addr_proposal->addr, sizeof(address.addr));
memcpy(&address.mask, &addr_proposal->mask, sizeof(address.mask));
address.vltime = addr_proposal->vltime;
address.pltime = addr_proposal->pltime;
address.temporary = addr_proposal->temporary;
address.mtu = addr_proposal->mtu;

engine_imsg_compose_main(IMSG_CONFIGURE_ADDRESS, 0, &address,
   sizeof(address));

if ((iface = get_slaacd_iface_by_id(addr_proposal->if_index)) != NULL((void *)0))
iface_state_transition(iface, IF_BOUND);
addr_proposal_state_transition(addr_proposal, PROPOSAL_CONFIGURED);
2146}

2148void
2149gen_address_proposal(struct slaacd_iface *iface, struct radv *ra, struct
  radv_prefix *prefix, int temporary)
2151{
struct address_proposal	*addr_proposal;
const char		*hbuf;

if ((addr_proposal = calloc(1, sizeof(*addr_proposal))) == NULL((void *)0))
fatal("calloc");
addr_proposal->id = ++proposal_id;
evtimer_set(&addr_proposal->timer, address_proposal_timeout,event_set(&addr_proposal->timer, -1, 0, address_proposal_timeout
, addr_proposal)
   addr_proposal)event_set(&addr_proposal->timer, -1, 0, address_proposal_timeout
, addr_proposal);
addr_proposal->timo.tv_sec = 1;
addr_proposal->timo.tv_usec = arc4random_uniform(1000000);
addr_proposal->state = PROPOSAL_NOT_CONFIGURED;
if (clock_gettime(CLOCK_MONOTONIC3, &addr_proposal->created))
fatal("clock_gettime");
addr_proposal->when = ra->when;
addr_proposal->uptime = ra->uptime;
addr_proposal->if_index = iface->if_index;
memcpy(&addr_proposal->from, &ra->from,
   sizeof(addr_proposal->from));
memcpy(&addr_proposal->hw_address, &iface->hw_address,
   sizeof(addr_proposal->hw_address));
memcpy(&addr_proposal->soiikey, &iface->soiikey,
   sizeof(addr_proposal->soiikey));
addr_proposal->temporary = temporary;
memcpy(&addr_proposal->prefix, &prefix->prefix,
   sizeof(addr_proposal->prefix));
addr_proposal->prefix_len = prefix->prefix_len;

if (temporary) {
addr_proposal->vltime = MINIMUM(prefix->vltime,(((prefix->vltime) < (172800)) ? (prefix->vltime) : (
172800))
    PRIV_VALID_LIFETIME)(((prefix->vltime) < (172800)) ? (prefix->vltime) : (
172800));
addr_proposal->desync_factor =
    arc4random_uniform(PRIV_MAX_DESYNC_FACTOR34560);

addr_proposal->pltime = MINIMUM(prefix->pltime,(((prefix->pltime) < (86400 - addr_proposal->desync_factor
)) ? (prefix->pltime) : (86400 - addr_proposal->desync_factor
))
    PRIV_PREFERRED_LIFETIME - addr_proposal->desync_factor)(((prefix->pltime) < (86400 - addr_proposal->desync_factor
)) ? (prefix->pltime) : (86400 - addr_proposal->desync_factor
));
} else {
addr_proposal->vltime = prefix->vltime;
addr_proposal->pltime = prefix->pltime;
}

if (ra->mtu == iface->cur_mtu)
addr_proposal->mtu = 0;
else {
addr_proposal->mtu = ra->mtu;
iface->cur_mtu = ra->mtu;
}

gen_addr(iface, prefix, addr_proposal, temporary);

LIST_INSERT_HEAD(&iface->addr_proposals, addr_proposal, entries)do { if (((addr_proposal)->entries.le_next = (&iface->
addr_proposals)->lh_first) != ((void *)0)) (&iface->
addr_proposals)->lh_first->entries.le_prev = &(addr_proposal
)->entries.le_next; (&iface->addr_proposals)->lh_first
 = (addr_proposal); (addr_proposal)->entries.le_prev = &
(&iface->addr_proposals)->lh_first; } while (0);
configure_address(addr_proposal);

hbuf = sin6_to_str(&addr_proposal->addr);
log_debug("%s: iface %d: %s", __func__, iface->if_index, hbuf);
2206}

2208void
2209free_address_proposal(struct address_proposal *addr_proposal)
2210{
if (addr_proposal == NULL((void *)0))
return;

LIST_REMOVE(addr_proposal, entries)do { if ((addr_proposal)->entries.le_next != ((void *)0)) (
addr_proposal)->entries.le_next->entries.le_prev = (addr_proposal
)->entries.le_prev; *(addr_proposal)->entries.le_prev =
 (addr_proposal)->entries.le_next; ; ; } while (0);
evtimer_del(&addr_proposal->timer)event_del(&addr_proposal->timer);
switch (addr_proposal->state) {
case PROPOSAL_CONFIGURED:
case PROPOSAL_NEARLY_EXPIRED:
case PROPOSAL_STALE:
withdraw_addr(addr_proposal);
break;
default:
break;
}
free(addr_proposal);
2226}

2228void
2229withdraw_addr(struct address_proposal *addr_proposal)
2230{
struct imsg_configure_address	address;

log_debug("%s: %d", __func__, addr_proposal->if_index);
memset(&address, 0, sizeof(address));
address.if_index = addr_proposal->if_index;
memcpy(&address.addr, &addr_proposal->addr, sizeof(address.addr));

engine_imsg_compose_main(IMSG_WITHDRAW_ADDRESS, 0, &address,
   sizeof(address));
2240}

2242void
2243gen_dfr_proposal(struct slaacd_iface *iface, struct radv *ra)
2244{
struct dfr_proposal	*dfr_proposal;
const char		*hbuf;

if ((dfr_proposal = calloc(1, sizeof(*dfr_proposal))) == NULL((void *)0))
fatal("calloc");
dfr_proposal->id = ++proposal_id;
evtimer_set(&dfr_proposal->timer, dfr_proposal_timeout,event_set(&dfr_proposal->timer, -1, 0, dfr_proposal_timeout
, dfr_proposal)
   dfr_proposal)event_set(&dfr_proposal->timer, -1, 0, dfr_proposal_timeout
, dfr_proposal);
dfr_proposal->timo.tv_sec = 1;
dfr_proposal->timo.tv_usec = arc4random_uniform(1000000);
dfr_proposal->state = PROPOSAL_NOT_CONFIGURED;
dfr_proposal->when = ra->when;
dfr_proposal->uptime = ra->uptime;
dfr_proposal->if_index = iface->if_index;
dfr_proposal->rdomain = iface->rdomain;
memcpy(&dfr_proposal->addr, &ra->from,
   sizeof(dfr_proposal->addr));
dfr_proposal->router_lifetime = ra->router_lifetime;
dfr_proposal->rpref = ra->rpref;

LIST_INSERT_HEAD(&iface->dfr_proposals, dfr_proposal, entries)do { if (((dfr_proposal)->entries.le_next = (&iface->
dfr_proposals)->lh_first) != ((void *)0)) (&iface->
dfr_proposals)->lh_first->entries.le_prev = &(dfr_proposal
)->entries.le_next; (&iface->dfr_proposals)->lh_first
 = (dfr_proposal); (dfr_proposal)->entries.le_prev = &
(&iface->dfr_proposals)->lh_first; } while (0);
configure_dfr(dfr_proposal);

hbuf = sin6_to_str(&dfr_proposal->addr);
log_debug("%s: iface %d: %s", __func__, iface->if_index, hbuf);
2270}

2272void
2273configure_dfr(struct dfr_proposal *dfr_proposal)
2274{
struct imsg_configure_dfr	 dfr;

log_debug("%s: %d", __func__, dfr_proposal->if_index);

dfr.if_index = dfr_proposal->if_index;
dfr.rdomain = dfr_proposal->rdomain;
memcpy(&dfr.addr, &dfr_proposal->addr, sizeof(dfr.addr));
dfr.router_lifetime = dfr_proposal->router_lifetime;

engine_imsg_compose_main(IMSG_CONFIGURE_DFR, 0, &dfr, sizeof(dfr));

dfr_proposal_state_transition(dfr_proposal, PROPOSAL_CONFIGURED);
2287}

2289void
2290withdraw_dfr(struct dfr_proposal *dfr_proposal)
2291{
struct imsg_configure_dfr	 dfr;

log_debug("%s: %d", __func__, dfr_proposal->if_index);

dfr.if_index = dfr_proposal->if_index;
dfr.rdomain = dfr_proposal->rdomain;
memcpy(&dfr.addr, &dfr_proposal->addr, sizeof(dfr.addr));
dfr.router_lifetime = dfr_proposal->router_lifetime;

engine_imsg_compose_main(IMSG_WITHDRAW_DFR, 0, &dfr, sizeof(dfr));
2302}

2304void
2305free_dfr_proposal(struct dfr_proposal *dfr_proposal)
2306{
if (dfr_proposal25.1
'dfr_proposal' is not equal to NULL
 == NULL((void *)0))
26
←
Taking false branch→
return;

LIST_REMOVE(dfr_proposal, entries)do { if ((dfr_proposal)->entries.le_next != ((void *)0)) (
dfr_proposal)->entries.le_next->entries.le_prev = (dfr_proposal
)->entries.le_prev; *(dfr_proposal)->entries.le_prev = (
dfr_proposal)->entries.le_next; ; ; } while (0);
27
←
Assuming field 'le_next' is equal to null→
28
←
Taking false branch→
29
←
Loop condition is false.  Exiting loop→
evtimer_del(&dfr_proposal->timer)event_del(&dfr_proposal->timer);
switch (dfr_proposal->state) {
30
←
Control jumps to the 'default' case at line 2318→
case PROPOSAL_CONFIGURED:
case PROPOSAL_NEARLY_EXPIRED:
case PROPOSAL_STALE:
withdraw_dfr(dfr_proposal);
break;
default:
break;
}
free(dfr_proposal);
31
←
Memory is released→
2322}

2324void
2325gen_rdns_proposal(struct slaacd_iface *iface, struct radv *ra)
2326{
struct rdns_proposal	*rdns_proposal;
struct radv_rdns	*rdns;
const char		*hbuf;

if ((rdns_proposal = calloc(1, sizeof(*rdns_proposal))) == NULL((void *)0))
fatal("calloc");
rdns_proposal->id = ++proposal_id;
evtimer_set(&rdns_proposal->timer, rdns_proposal_timeout,event_set(&rdns_proposal->timer, -1, 0, rdns_proposal_timeout
, rdns_proposal)
   rdns_proposal)event_set(&rdns_proposal->timer, -1, 0, rdns_proposal_timeout
, rdns_proposal);
rdns_proposal->timo.tv_sec = 1;
rdns_proposal->timo.tv_usec = arc4random_uniform(1000000);
rdns_proposal->state = PROPOSAL_NOT_CONFIGURED;
rdns_proposal->when = ra->when;
rdns_proposal->uptime = ra->uptime;
rdns_proposal->if_index = iface->if_index;
rdns_proposal->rdomain = iface->rdomain;
memcpy(&rdns_proposal->from, &ra->from,
   sizeof(rdns_proposal->from));
rdns_proposal->rdns_lifetime = ra->rdns_lifetime;
LIST_FOREACH(rdns, &ra->rdns_servers, entries)for((rdns) = ((&ra->rdns_servers)->lh_first); (rdns
)!= ((void *)0); (rdns) = ((rdns)->entries.le_next)) {
memcpy(&rdns_proposal->rdns[rdns_proposal->rdns_count++],
    &rdns->rdns, sizeof(struct in6_addr));
if (rdns_proposal->rdns_count == MAX_RDNS_COUNT8)
	break;
}

LIST_INSERT_HEAD(&iface->rdns_proposals, rdns_proposal, entries)do { if (((rdns_proposal)->entries.le_next = (&iface->
rdns_proposals)->lh_first) != ((void *)0)) (&iface->
rdns_proposals)->lh_first->entries.le_prev = &(rdns_proposal
)->entries.le_next; (&iface->rdns_proposals)->lh_first
 = (rdns_proposal); (rdns_proposal)->entries.le_prev = &
(&iface->rdns_proposals)->lh_first; } while (0);
compose_rdns_proposal(iface->if_index, iface->rdomain);

hbuf = sin6_to_str(&rdns_proposal->from);
log_debug("%s: iface %d: %s", __func__, iface->if_index, hbuf);
2358}

2360void
2361compose_rdns_proposal(uint32_t if_index, int rdomain)
2362{
struct imsg_propose_rdns rdns;
struct slaacd_iface	*iface;
struct rdns_proposal	*rdns_proposal;
int			 i;

memset(&rdns, 0, sizeof(rdns));
rdns.if_index = if_index;
rdns.rdomain = rdomain;

if ((iface = get_slaacd_iface_by_id(if_index)) != NULL((void *)0)) {
LIST_FOREACH(rdns_proposal, &iface->rdns_proposals, entries)for((rdns_proposal) = ((&iface->rdns_proposals)->lh_first
); (rdns_proposal)!= ((void *)0); (rdns_proposal) = ((rdns_proposal
)->entries.le_next)) {
	if (rdns_proposal->state == PROPOSAL_WITHDRAWN ||
	    rdns_proposal->state == PROPOSAL_STALE)
		continue;
	rdns_proposal_state_transition(rdns_proposal,
	    PROPOSAL_CONFIGURED);
	for (i = 0; i < rdns_proposal->rdns_count &&
		 rdns.rdns_count < MAX_RDNS_COUNT8; i++) {
		rdns.rdns[rdns.rdns_count++] =
		    rdns_proposal->rdns[i];
	}
}
}

engine_imsg_compose_main(IMSG_PROPOSE_RDNS, 0, &rdns, sizeof(rdns));
2388}

2390void
2391free_rdns_proposal(struct rdns_proposal *rdns_proposal)
2392{
if (rdns_proposal == NULL((void *)0))
return;

LIST_REMOVE(rdns_proposal, entries)do { if ((rdns_proposal)->entries.le_next != ((void *)0)) (
rdns_proposal)->entries.le_next->entries.le_prev = (rdns_proposal
)->entries.le_prev; *(rdns_proposal)->entries.le_prev =
 (rdns_proposal)->entries.le_next; ; ; } while (0);
evtimer_del(&rdns_proposal->timer)event_del(&rdns_proposal->timer);
switch (rdns_proposal->state) {
case PROPOSAL_CONFIGURED:
case PROPOSAL_NEARLY_EXPIRED:
case PROPOSAL_STALE:
withdraw_rdns(rdns_proposal);
break;
default:
break;
}
free(rdns_proposal);
2408}

2410void
2411withdraw_rdns(struct rdns_proposal *rdns_proposal)
2412{
log_debug("%s: %d", __func__, rdns_proposal->if_index);

rdns_proposal->state = PROPOSAL_WITHDRAWN;

/* we have to re-propose all rdns servers, minus one */
compose_rdns_proposal(rdns_proposal->if_index, rdns_proposal->rdomain);
2419}

2421void
2422address_proposal_timeout(int fd, short events, void *arg)
2423{
struct address_proposal	*addr_proposal;
struct slaacd_iface	*iface = NULL((void *)0);
struct radv		*ra = NULL((void *)0);
struct radv_prefix	*prefix = NULL((void *)0);
const char		*hbuf;

addr_proposal = (struct address_proposal *)arg;

hbuf = sin6_to_str(&addr_proposal->addr);
log_debug("%s: iface %d: %s [%s], priv: %s", __func__,
   addr_proposal->if_index, hbuf,
   proposal_state_name(addr_proposal->state),
   addr_proposal->temporary ? "y" : "n");

switch (addr_proposal->state) {
case PROPOSAL_IF_DOWN:
addr_proposal_state_transition(addr_proposal, PROPOSAL_STALE);
break;
case PROPOSAL_CONFIGURED:
addr_proposal_state_transition(addr_proposal,
    PROPOSAL_NEARLY_EXPIRED);
break;
case PROPOSAL_NEARLY_EXPIRED:
if (real_lifetime(&addr_proposal->uptime,
    addr_proposal->vltime) > 0)
	addr_proposal_state_transition(addr_proposal,
	    PROPOSAL_NEARLY_EXPIRED);
else
	addr_proposal_state_transition(addr_proposal,
	    PROPOSAL_STALE);
break;
case PROPOSAL_DUPLICATED:
iface = get_slaacd_iface_by_id(addr_proposal->if_index);
if (iface != NULL((void *)0))
	ra = find_ra(iface, &addr_proposal->from);
if (ra != NULL((void *)0))
	prefix = find_prefix(ra, &addr_proposal->prefix,
	    addr_proposal->prefix_len);
if (prefix != NULL((void *)0)) {
	if (!addr_proposal->temporary) {
		prefix->dad_counter++;
		gen_address_proposal(iface, ra, prefix, 0);
	} else
		gen_address_proposal(iface, ra, prefix, 1);
}
addr_proposal_state_transition(addr_proposal, PROPOSAL_STALE);
break;
case PROPOSAL_STALE:
free_address_proposal(addr_proposal);
addr_proposal = NULL((void *)0);
break;
case PROPOSAL_WITHDRAWN:
free_address_proposal(addr_proposal);
addr_proposal = NULL((void *)0);
break;
default:
log_debug("%s: unhandled state: %s", __func__,
    proposal_state_name(addr_proposal->state));
}
2483}

2485void
2486dfr_proposal_timeout(int fd, short events, void *arg)
2487{
struct dfr_proposal	*dfr_proposal;
const char		*hbuf;

dfr_proposal = (struct dfr_proposal *)arg;

hbuf = sin6_to_str(&dfr_proposal->addr);
log_debug("%s: iface %d: %s [%s]", __func__, dfr_proposal->if_index,
   hbuf, proposal_state_name(dfr_proposal->state));

switch (dfr_proposal->state) {
case PROPOSAL_IF_DOWN:
dfr_proposal_state_transition(dfr_proposal, PROPOSAL_STALE);
break;
case PROPOSAL_CONFIGURED:
dfr_proposal_state_transition(dfr_proposal,
    PROPOSAL_NEARLY_EXPIRED);
break;
case PROPOSAL_NEARLY_EXPIRED:
if (real_lifetime(&dfr_proposal->uptime,
    dfr_proposal->router_lifetime) > 0)
	dfr_proposal_state_transition(dfr_proposal,
	    PROPOSAL_NEARLY_EXPIRED);
else
	dfr_proposal_state_transition(dfr_proposal,
	    PROPOSAL_STALE);
break;
case PROPOSAL_STALE:
free_dfr_proposal(dfr_proposal);
dfr_proposal = NULL((void *)0);
break;
case PROPOSAL_WITHDRAWN:
free_dfr_proposal(dfr_proposal);
dfr_proposal = NULL((void *)0);
break;

default:
log_debug("%s: unhandled state: %s", __func__,
    proposal_state_name(dfr_proposal->state));
}
2527}

2529void
2530rdns_proposal_timeout(int fd, short events, void *arg)
2531{
struct rdns_proposal	*rdns_proposal;
const char		*hbuf;

rdns_proposal = (struct rdns_proposal *)arg;

hbuf = sin6_to_str(&rdns_proposal->from);
log_debug("%s: iface %d: %s [%s]", __func__, rdns_proposal->if_index,
   hbuf, proposal_state_name(rdns_proposal->state));

switch (rdns_proposal->state) {
case PROPOSAL_IF_DOWN:
rdns_proposal_state_transition(rdns_proposal, PROPOSAL_STALE);
break;
case PROPOSAL_CONFIGURED:
rdns_proposal_state_transition(rdns_proposal,
    PROPOSAL_NEARLY_EXPIRED);
break;
case PROPOSAL_NEARLY_EXPIRED:
if (real_lifetime(&rdns_proposal->uptime,
    rdns_proposal->rdns_lifetime) > 0)
	rdns_proposal_state_transition(rdns_proposal,
	    PROPOSAL_NEARLY_EXPIRED);
else
	rdns_proposal_state_transition(rdns_proposal,
	    PROPOSAL_STALE);
break;
case PROPOSAL_STALE:
free_rdns_proposal(rdns_proposal);
rdns_proposal = NULL((void *)0);
break;
case PROPOSAL_WITHDRAWN:
free_rdns_proposal(rdns_proposal);
rdns_proposal = NULL((void *)0);
break;

default:
log_debug("%s: unhandled state: %s", __func__,
    proposal_state_name(rdns_proposal->state));
}
2571}

2573void
2574iface_timeout(int fd, short events, void *arg)
2575{
struct slaacd_iface	*iface = (struct slaacd_iface *)arg;

log_debug("%s[%d]: %s", __func__, iface->if_index,
   if_state_name(iface->state));

switch (iface->state) {
case IF_DOWN:
fatalx("%s: timeout in wrong state IF_DOWN", __func__);
break;
case IF_INIT:
iface_state_transition(iface, IF_INIT);
break;
default:
break;
}
2591}

2593struct radv*
2594find_ra(struct slaacd_iface *iface, struct sockaddr_in6 *from)
2595{
struct radv	*ra;

LIST_FOREACH (ra, &iface->radvs, entries)for((ra) = ((&iface->radvs)->lh_first); (ra)!= ((void
 *)0); (ra) = ((ra)->entries.le_next)) {
if (memcmp(&ra->from.sin6_addr, &from->sin6_addr,
    sizeof(from->sin6_addr)) == 0)
	return (ra);
}

return (NULL((void *)0));
2605}

2607struct address_proposal*
2608find_address_proposal_by_addr(struct slaacd_iface *iface, struct sockaddr_in6
  *addr)
2610{
struct address_proposal	*addr_proposal;

LIST_FOREACH (addr_proposal, &iface->addr_proposals, entries)for((addr_proposal) = ((&iface->addr_proposals)->lh_first
); (addr_proposal)!= ((void *)0); (addr_proposal) = ((addr_proposal
)->entries.le_next)) {
if (memcmp(&addr_proposal->addr, addr, sizeof(*addr)) == 0)
	return (addr_proposal);
}

return (NULL((void *)0));
2619}

2621struct dfr_proposal*
2622find_dfr_proposal_by_gw(struct slaacd_iface *iface, struct sockaddr_in6
  *addr)
2624{
struct dfr_proposal	*dfr_proposal;

LIST_FOREACH (dfr_proposal, &iface->dfr_proposals, entries)for((dfr_proposal) = ((&iface->dfr_proposals)->lh_first
); (dfr_proposal)!= ((void *)0); (dfr_proposal) = ((dfr_proposal
)->entries.le_next)) {
if (memcmp(&dfr_proposal->addr, addr, sizeof(*addr)) == 0)
	return (dfr_proposal);
}

return (NULL((void *)0));
2633}

2635struct rdns_proposal*
2636find_rdns_proposal_by_gw(struct slaacd_iface *iface, struct sockaddr_in6
  *from)
2638{
struct rdns_proposal	*rdns_proposal;

LIST_FOREACH (rdns_proposal, &iface->rdns_proposals, entries)for((rdns_proposal) = ((&iface->rdns_proposals)->lh_first
); (rdns_proposal)!= ((void *)0); (rdns_proposal) = ((rdns_proposal
)->entries.le_next)) {
if (memcmp(&rdns_proposal->from, from, sizeof(*from)) == 0)
	return (rdns_proposal);
}

return (NULL((void *)0));
2647}

2649struct radv_prefix *
2650find_prefix(struct radv *ra, struct in6_addr *prefix, uint8_t prefix_len)
2651{
struct radv_prefix	*result;


LIST_FOREACH(result, &ra->prefixes, entries)for((result) = ((&ra->prefixes)->lh_first); (result
)!= ((void *)0); (result) = ((result)->entries.le_next)) {
if (memcmp(&result->prefix, prefix,
    sizeof(result->prefix)) == 0 && result->prefix_len ==
    prefix_len)
	return (result);
}
return (NULL((void *)0));
2662}

2664uint32_t
2665real_lifetime(struct timespec *received_uptime, uint32_t ltime)
2666{
struct timespec	 now, diff;
int64_t		 remaining;

if (clock_gettime(CLOCK_MONOTONIC3, &now))
fatal("clock_gettime");

timespecsub(&now, received_uptime, &diff)do { (&diff)->tv_sec = (&now)->tv_sec - (received_uptime
)->tv_sec; (&diff)->tv_nsec = (&now)->tv_nsec
 - (received_uptime)->tv_nsec; if ((&diff)->tv_nsec
 < 0) { (&diff)->tv_sec--; (&diff)->tv_nsec +=
 1000000000L; } } while (0);

remaining = ((int64_t)ltime) - diff.tv_sec;

if (remaining < 0)
remaining = 0;

return (remaining);
2681}

2683void
2684merge_dad_couters(struct radv *old_ra, struct radv *new_ra)
2685{

struct radv_prefix	*old_prefix, *new_prefix;

LIST_FOREACH(old_prefix, &old_ra->prefixes, entries)for((old_prefix) = ((&old_ra->prefixes)->lh_first);
 (old_prefix)!= ((void *)0); (old_prefix) = ((old_prefix)->
entries.le_next)) {
if (!old_prefix->dad_counter)
	continue;
if ((new_prefix = find_prefix(new_ra, &old_prefix->prefix,
    old_prefix->prefix_len)) != NULL((void *)0))
	new_prefix->dad_counter = old_prefix->dad_counter;
}
2696}