/usr/src/sbin/slaacd/frontend.c

Bug Summary

File:	src/sbin/slaacd/frontend.c
Warning:	line 1017, column 19 Access to field 'ipi6_ifindex' results in a dereference of a null pointer (loaded from variable 'pi')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name frontend.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sbin/slaacd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sbin/slaacd -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/sbin/slaacd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/sbin/slaacd/frontend.c
1/*	$OpenBSD: frontend.c,v 1.65 2023/12/14 09:58:59 claudio Exp $	*/

3/*
* Copyright (c) 2017 Florian Obser <florian@openbsd.org>
* Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
* Copyright (c) 2004 Esben Norby <norby@openbsd.org>
* Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
21#include <sys/types.h>
22#include <sys/ioctl.h>
23#include <sys/queue.h>
24#include <sys/socket.h>
25#include <sys/syslog.h>
26#include <sys/uio.h>

28#include <net/if.h>
29#include <net/if_dl.h>
30#include <net/if_types.h>
31#include <net/route.h>

33#include <arpa/inet.h>

35#include <netinet/in.h>
36#include <netinet/if_ether.h>
37#include <netinet6/nd6.h>
38#include <netinet6/in6_var.h>
39#include <netinet/ip6.h>
40#include <netinet6/ip6_var.h>
41#include <netinet/icmp6.h>

43#include <errno(*__errno()).h>
44#include <event.h>
45#include <ifaddrs.h>
46#include <imsg.h>
47#include <pwd.h>
48#include <signal.h>
49#include <stdio.h>
50#include <stdlib.h>
51#include <string.h>
52#include <unistd.h>

54#include "log.h"
55#include "slaacd.h"
56#include "frontend.h"
57#include "control.h"

59#define	ROUTE_SOCKET_BUF_SIZE16384	16384
60#define	ALLROUTER"ff02::2"		"ff02::2"

62struct icmp6_ev {
struct event		 ev;
uint8_t			 answer[1500];
struct msghdr		 rcvmhdr;
struct iovec		 rcviov[1];
struct sockaddr_in6	 from;
int			 refcnt;
69};

71struct iface {
LIST_ENTRY(iface)struct { struct iface *le_next; struct iface **le_prev; }	 entries;
struct icmp6_ev		*icmp6ev;
struct ether_addr	 hw_address;
uint32_t		 if_index;
int			 rdomain;
int			 send_solicitation;
int			 ll_tentative;
79};

81__dead__attribute__((__noreturn__)) void	 frontend_shutdown(void);
82void		 frontend_sig_handler(int, short, void *);
83void		 update_iface(uint32_t, char*);
84void		 frontend_startup(void);
85void		 route_receive(int, short, void *);
86void		 handle_route_message(struct rt_msghdr *, struct sockaddr **);
87void		 get_rtaddrs(int, struct sockaddr *, struct sockaddr **);
88void		 icmp6_receive(int, short, void *);
89int		 get_flags(char *);
90int		 get_xflags(char *);
91int		 get_ifrdomain(char *);
92struct iface	*get_iface_by_id(uint32_t);
93void		 remove_iface(uint32_t);
94struct icmp6_ev	*get_icmp6ev_by_rdomain(int);
95void		 unref_icmp6ev(struct iface *);
96void		 set_icmp6sock(int, int);
97void		 send_solicitation(uint32_t);
98#ifndef	SMALL
99const char	*flags_to_str(int);
100#endif	/* SMALL */

102LIST_HEAD(, iface)struct { struct iface *lh_first; }		 interfaces;
103static struct imsgev		*iev_main;
104static struct imsgev		*iev_engine;
105struct event			 ev_route;
106struct msghdr			 sndmhdr;
107struct iovec			 sndiov[4];
108struct nd_router_solicit	 rs;
109struct nd_opt_hdr		 nd_opt_hdr;
110struct ether_addr		 nd_opt_source_link_addr;
111struct sockaddr_in6		 dst;
112int				 ioctlsock;

114void
115frontend_sig_handler(int sig, short event, void *bula)
116{
/*
* Normal signal handler rules don't apply because libevent
* decouples for us.
*/

switch (sig) {
case SIGINT2:
case SIGTERM15:
frontend_shutdown();
default:
fatalx("unexpected signal");
}
129}

131void
132frontend(int debug, int verbose)
133{
struct event		 ev_sigint, ev_sigterm;
struct passwd		*pw;
struct in6_pktinfo	*pi;
struct cmsghdr		*cm;
size_t			 sndcmsglen;
int			 hoplimit = 255;
uint8_t			*sndcmsgbuf;

log_init(debug, LOG_DAEMON(3<<3));
log_setverbose(verbose);

if ((pw = getpwnam(SLAACD_USER"_slaacd")) == NULL((void *)0))
fatal("getpwnam");

if (chdir("/") == -1)
fatal("chdir(\"/\")");

if (unveil("/", "") == -1)
fatal("unveil /");
if (unveil(NULL((void *)0), NULL((void *)0)) == -1)
fatal("unveil");

setproctitle("%s", "frontend");
log_procinit("frontend");

if ((ioctlsock = socket(AF_INET624, SOCK_DGRAM2 | SOCK_CLOEXEC0x8000, 0)) == -1)
fatal("socket");

if (setgroups(1, &pw->pw_gid) ||
   setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
   setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
fatal("can't drop privileges");

if (pledge("stdio unix recvfd route", NULL((void *)0)) == -1)
fatal("pledge");

event_init();

/* Setup signal handler. */
signal_set(&ev_sigint, SIGINT, frontend_sig_handler, NULL)event_set(&ev_sigint, 2, 0x08|0x10, frontend_sig_handler,
 ((void *)0));
signal_set(&ev_sigterm, SIGTERM, frontend_sig_handler, NULL)event_set(&ev_sigterm, 15, 0x08|0x10, frontend_sig_handler
, ((void *)0));
signal_add(&ev_sigint, NULL)event_add(&ev_sigint, ((void *)0));
signal_add(&ev_sigterm, NULL)event_add(&ev_sigterm, ((void *)0));
signal(SIGPIPE13, SIG_IGN(void (*)(int))1);
signal(SIGHUP1, SIG_IGN(void (*)(int))1);

/* Setup pipe and event handler to the parent process. */
if ((iev_main = malloc(sizeof(struct imsgev))) == NULL((void *)0))
fatal(NULL((void *)0));
imsg_init(&iev_main->ibuf, 3);
iev_main->handler = frontend_dispatch_main;
iev_main->events = EV_READ0x02;
event_set(&iev_main->ev, iev_main->ibuf.fd, iev_main->events,
   iev_main->handler, iev_main);
event_add(&iev_main->ev, NULL((void *)0));

sndcmsglen = CMSG_SPACE(sizeof(struct in6_pktinfo))((((unsigned long)(sizeof(struct cmsghdr)) + (sizeof(long) - 1
)) &~(sizeof(long) - 1)) + (((unsigned long)(sizeof(struct
 in6_pktinfo)) + (sizeof(long) - 1)) &~(sizeof(long) - 1)
)) +
   CMSG_SPACE(sizeof(int))((((unsigned long)(sizeof(struct cmsghdr)) + (sizeof(long) - 1
)) &~(sizeof(long) - 1)) + (((unsigned long)(sizeof(int))
 + (sizeof(long) - 1)) &~(sizeof(long) - 1)));

if ((sndcmsgbuf = malloc(sndcmsglen)) == NULL((void *)0))
fatal("malloc");

rs.nd_rs_typend_rs_hdr.icmp6_type = ND_ROUTER_SOLICIT133;
rs.nd_rs_codend_rs_hdr.icmp6_code = 0;
rs.nd_rs_cksumnd_rs_hdr.icmp6_cksum = 0;
rs.nd_rs_reservednd_rs_hdr.icmp6_dataun.icmp6_un_data32[0] = 0;

nd_opt_hdr.nd_opt_type = ND_OPT_SOURCE_LINKADDR1;
nd_opt_hdr.nd_opt_len = 1;

memset(&dst, 0, sizeof(dst));
dst.sin6_family = AF_INET624;
if (inet_pton(AF_INET624, ALLROUTER"ff02::2", &dst.sin6_addr.s6_addr__u6_addr.__u6_addr8) != 1)
fatal("inet_pton");

sndmhdr.msg_namelen = sizeof(struct sockaddr_in6);
sndmhdr.msg_iov = sndiov;
sndmhdr.msg_iovlen = 3;
sndmhdr.msg_control = (caddr_t)sndcmsgbuf;
sndmhdr.msg_controllen = sndcmsglen;

sndmhdr.msg_name = (caddr_t)&dst;
sndmhdr.msg_iov[0].iov_base = (caddr_t)&rs;
sndmhdr.msg_iov[0].iov_len = sizeof(rs);
sndmhdr.msg_iov[1].iov_base = (caddr_t)&nd_opt_hdr;
sndmhdr.msg_iov[1].iov_len = sizeof(nd_opt_hdr);
sndmhdr.msg_iov[2].iov_base = (caddr_t)&nd_opt_source_link_addr;
sndmhdr.msg_iov[2].iov_len = sizeof(nd_opt_source_link_addr);

cm = CMSG_FIRSTHDR(&sndmhdr)((&sndmhdr)->msg_controllen >= sizeof(struct cmsghdr
) ? (struct cmsghdr *)(&sndmhdr)->msg_control : (struct
 cmsghdr *)((void *)0));

cm->cmsg_level = IPPROTO_IPV641;
cm->cmsg_type = IPV6_PKTINFO46;
cm->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo))((((unsigned long)(sizeof(struct cmsghdr)) + (sizeof(long) - 1
)) &~(sizeof(long) - 1)) + (sizeof(struct in6_pktinfo)));
pi = (struct in6_pktinfo *)CMSG_DATA(cm)((unsigned char *)(cm) + (((unsigned long)(sizeof(struct cmsghdr
)) + (sizeof(long) - 1)) &~(sizeof(long) - 1)));
memset(&pi->ipi6_addr, 0, sizeof(pi->ipi6_addr));
pi->ipi6_ifindex = 0;

cm = CMSG_NXTHDR(&sndmhdr, cm)(((char *)(cm) + (((unsigned long)((cm)->cmsg_len) + (sizeof
(long) - 1)) &~(sizeof(long) - 1)) + (((unsigned long)(sizeof
(struct cmsghdr)) + (sizeof(long) - 1)) &~(sizeof(long) -
 1)) > ((char *)(&sndmhdr)->msg_control) + (&sndmhdr
)->msg_controllen) ? (struct cmsghdr *)((void *)0) : (struct
 cmsghdr *)((char *)(cm) + (((unsigned long)((cm)->cmsg_len
) + (sizeof(long) - 1)) &~(sizeof(long) - 1))));
cm->cmsg_level = IPPROTO_IPV641;
cm->cmsg_type = IPV6_HOPLIMIT47;
cm->cmsg_len = CMSG_LEN(sizeof(int))((((unsigned long)(sizeof(struct cmsghdr)) + (sizeof(long) - 1
)) &~(sizeof(long) - 1)) + (sizeof(int)));
memcpy(CMSG_DATA(cm)((unsigned char *)(cm) + (((unsigned long)(sizeof(struct cmsghdr
)) + (sizeof(long) - 1)) &~(sizeof(long) - 1))), &hoplimit, sizeof(int));

LIST_INIT(&interfaces)do { ((&interfaces)->lh_first) = ((void *)0); } while (
0);

event_dispatch();

frontend_shutdown();
243}

245__dead__attribute__((__noreturn__)) void
246frontend_shutdown(void)
247{
/* Close pipes. */
msgbuf_write(&iev_engine->ibuf.w);
msgbuf_clear(&iev_engine->ibuf.w);
close(iev_engine->ibuf.fd);
msgbuf_write(&iev_main->ibuf.w);
msgbuf_clear(&iev_main->ibuf.w);
close(iev_main->ibuf.fd);

free(iev_engine);
free(iev_main);

log_info("frontend exiting");
exit(0);
261}

263int
264frontend_imsg_compose_main(int type, pid_t pid, void *data,
  uint16_t datalen)
266{
return (imsg_compose_event(iev_main, type, 0, pid, -1, data,
   datalen));
269}

271int
272frontend_imsg_compose_engine(int type, uint32_t peerid, pid_t pid,
  void *data, uint16_t datalen)
274{
return (imsg_compose_event(iev_engine, type, peerid, pid, -1,
   data, datalen));
277}

279void
280frontend_dispatch_main(int fd, short event, void *bula)
281{
struct imsg		 imsg;
struct imsgev		*iev = bula;
struct imsgbuf		*ibuf = &iev->ibuf;
ssize_t			 n;
int			 shut = 0, icmp6sock, rdomain;

if (event & EV_READ0x02) {
if ((n = imsg_read(ibuf)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("imsg_read error");
if (n == 0)	/* Connection closed. */
	shut = 1;
}
if (event & EV_WRITE0x04) {
if ((n = msgbuf_write(&ibuf->w)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("msgbuf_write");
if (n == 0)	/* Connection closed. */
	shut = 1;
}

for (;;) {
if ((n = imsg_get(ibuf, &imsg)) == -1)
	fatal("%s: imsg_get error", __func__);
if (n == 0)	/* No more messages. */
	break;

switch (imsg.hdr.type) {
case IMSG_SOCKET_IPC:
	/*
	 * Setup pipe and event handler to the engine
	 * process.
	 */
	if (iev_engine)
		fatalx("%s: received unexpected imsg fd "
		    "to frontend", __func__);

	if ((fd = imsg_get_fd(&imsg)) == -1)
		fatalx("%s: expected to receive imsg fd to "
		   "frontend but didn't receive any",
		   __func__);

	iev_engine = malloc(sizeof(struct imsgev));
	if (iev_engine == NULL((void *)0))
		fatal(NULL((void *)0));

	imsg_init(&iev_engine->ibuf, fd);
	iev_engine->handler = frontend_dispatch_engine;
	iev_engine->events = EV_READ0x02;

	event_set(&iev_engine->ev, iev_engine->ibuf.fd,
	iev_engine->events, iev_engine->handler, iev_engine);
	event_add(&iev_engine->ev, NULL((void *)0));
	break;
case IMSG_ICMP6SOCK:
	if ((icmp6sock = imsg_get_fd(&imsg)) == -1)
		fatalx("%s: expected to receive imsg "
		    "ICMPv6 fd but didn't receive any",
		    __func__);
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(rdomain))
		fatalx("%s: IMSG_ICMP6SOCK wrong length: "
		    "%lu", __func__, IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&rdomain, imsg.data, sizeof(rdomain));
	set_icmp6sock(icmp6sock, rdomain);
	break;
case IMSG_ROUTESOCK:
	if ((fd = imsg_get_fd(&imsg)) == -1)
		fatalx("%s: expected to receive imsg "
		    "routesocket fd but didn't receive any",
		    __func__);
	event_set(&ev_route, fd, EV_READ0x02 | EV_PERSIST0x10,
	    route_receive, NULL((void *)0));
	break;
case IMSG_STARTUP:
	frontend_startup();
	break;
356#ifndef	SMALL
case IMSG_CONTROLFD:
	if ((fd = imsg_get_fd(&imsg)) == -1)
		fatalx("%s: expected to receive imsg "
		    "control fd but didn't receive any",
		    __func__);
	/* Listen on control socket. */
	control_listen(fd);
	break;
case IMSG_CTL_END:
	control_imsg_relay(&imsg);
	break;
368#endif	/* SMALL */
default:
	log_debug("%s: error handling imsg %d", __func__,
	    imsg.hdr.type);
	break;
}
imsg_free(&imsg);
}
if (!shut)
imsg_event_add(iev);
else {
/* This pipe is dead. Remove its event handler. */
event_del(&iev->ev);
event_loopexit(NULL((void *)0));
}
383}

385void
386frontend_dispatch_engine(int fd, short event, void *bula)
387{
struct imsgev		*iev = bula;
struct imsgbuf		*ibuf = &iev->ibuf;
struct imsg		 imsg;
ssize_t			 n;
int			 shut = 0;
uint32_t		 if_index;

if (event & EV_READ0x02) {
1
Assuming the condition is false→
2
←
Taking false branch→
if ((n = imsg_read(ibuf)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("imsg_read error");
if (n == 0)	/* Connection closed. */
	shut = 1;
}
if (event & EV_WRITE0x04) {
3
←
Assuming the condition is false→
4
←
Taking false branch→
if ((n = msgbuf_write(&ibuf->w)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("msgbuf_write");
if (n == 0)	/* Connection closed. */
	shut = 1;
}

for (;;) {
5
←
Loop condition is true.  Entering loop body→
if ((n = imsg_get(ibuf, &imsg)) == -1)
6
←
Assuming the condition is false→
7
←
Taking false branch→
	fatal("%s: imsg_get error", __func__);
if (n == 0)	/* No more messages. */
8
←
Assuming 'n' is not equal to 0→
9
←
Taking false branch→
	break;

switch (imsg.hdr.type) {
10
←
Control jumps to 'case IMSG_CTL_SEND_SOLICITATION:'  at line 430→
415#ifndef	SMALL
case IMSG_CTL_END:
case IMSG_CTL_SHOW_INTERFACE_INFO:
case IMSG_CTL_SHOW_INTERFACE_INFO_RA:
case IMSG_CTL_SHOW_INTERFACE_INFO_RA_PREFIX:
case IMSG_CTL_SHOW_INTERFACE_INFO_RA_RDNS:
case IMSG_CTL_SHOW_INTERFACE_INFO_ADDR_PROPOSALS:
case IMSG_CTL_SHOW_INTERFACE_INFO_ADDR_PROPOSAL:
case IMSG_CTL_SHOW_INTERFACE_INFO_DFR_PROPOSALS:
case IMSG_CTL_SHOW_INTERFACE_INFO_DFR_PROPOSAL:
case IMSG_CTL_SHOW_INTERFACE_INFO_RDNS_PROPOSALS:
case IMSG_CTL_SHOW_INTERFACE_INFO_RDNS_PROPOSAL:
	control_imsg_relay(&imsg);
	break;
429#endif	/* SMALL */
case IMSG_CTL_SEND_SOLICITATION:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(if_index))
11
←
Assuming the condition is false→
12
←
Taking false branch→
		fatalx("%s: IMSG_CTL_SEND_SOLICITATION wrong "
		    "length: %lu", __func__,
		    IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	if_index = *((uint32_t *)imsg.data);
	send_solicitation(if_index);
13
←
Calling 'send_solicitation'→
	break;
default:
	log_debug("%s: error handling imsg %d", __func__,
	    imsg.hdr.type);
	break;
}
imsg_free(&imsg);
}
if (!shut)
imsg_event_add(iev);
else {
/* This pipe is dead. Remove its event handler. */
event_del(&iev->ev);
event_loopexit(NULL((void *)0));
}
452}

454int
455get_flags(char *if_name)
456{
struct ifreq		 ifr;

strlcpy(ifr.ifr_name, if_name, sizeof(ifr.ifr_name));
if (ioctl(ioctlsock, SIOCGIFFLAGS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((17))), (caddr_t)&ifr) == -1) {
log_warn("SIOCGIFFLAGS");
return -1;
}
return ifr.ifr_flagsifr_ifru.ifru_flags;
465}

467int
468get_xflags(char *if_name)
469{
struct ifreq		 ifr;

strlcpy(ifr.ifr_name, if_name, sizeof(ifr.ifr_name));
if (ioctl(ioctlsock, SIOCGIFXFLAGS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((158))), (caddr_t)&ifr) == -1) {
log_warn("SIOCGIFXFLAGS");
return -1;
}
return ifr.ifr_flagsifr_ifru.ifru_flags;
478}

480int
481get_ifrdomain(char *if_name)
482{
struct ifreq		 ifr;

strlcpy(ifr.ifr_name, if_name, sizeof(ifr.ifr_name));
if (ioctl(ioctlsock, SIOCGIFRDOMAIN(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((160))), (caddr_t)&ifr) == -1) {
log_warn("SIOCGIFRDOMAIN");
return -1;
}
return ifr.ifr_rdomainidifr_ifru.ifru_metric;
491}

493void
494update_iface(uint32_t if_index, char* if_name)
495{
struct iface		*iface;
struct ifaddrs		*ifap, *ifa;
struct imsg_ifinfo	 imsg_ifinfo;
struct sockaddr_dl	*sdl;
struct sockaddr_in6	*sin6;
struct in6_ifreq	 ifr6;
int			 flags, xflags, ifrdomain;

if ((flags = get_flags(if_name)) == -1 || (xflags =
   get_xflags(if_name)) == -1)
return;

if (!(xflags & (IFXF_AUTOCONF60x20 | IFXF_AUTOCONF6TEMP0x4)))
return;

if((ifrdomain = get_ifrdomain(if_name)) == -1)
return;

iface = get_iface_by_id(if_index);

if (iface != NULL((void *)0)) {
if (iface->rdomain != ifrdomain) {
	unref_icmp6ev(iface);
	iface->rdomain = ifrdomain;
	iface->icmp6ev = get_icmp6ev_by_rdomain(ifrdomain);
}
} else {
if ((iface = calloc(1, sizeof(*iface))) == NULL((void *)0))
	fatal("calloc");
iface->if_index = if_index;
iface->rdomain = ifrdomain;
iface->icmp6ev = get_icmp6ev_by_rdomain(ifrdomain);
iface->ll_tentative = 1;

LIST_INSERT_HEAD(&interfaces, iface, entries)do { if (((iface)->entries.le_next = (&interfaces)->
lh_first) != ((void *)0)) (&interfaces)->lh_first->
entries.le_prev = &(iface)->entries.le_next; (&interfaces
)->lh_first = (iface); (iface)->entries.le_prev = &
(&interfaces)->lh_first; } while (0);
}

memset(&imsg_ifinfo, 0, sizeof(imsg_ifinfo));

imsg_ifinfo.if_index = if_index;
imsg_ifinfo.rdomain = ifrdomain;
imsg_ifinfo.running = (flags & (IFF_UP0x1 | IFF_RUNNING0x40)) == (IFF_UP0x1 |
   IFF_RUNNING0x40);
imsg_ifinfo.autoconf = (xflags & IFXF_AUTOCONF60x20);
imsg_ifinfo.temporary = (xflags & IFXF_AUTOCONF6TEMP0x4);
imsg_ifinfo.soii = !(xflags & IFXF_INET6_NOSOII0x40);

if (getifaddrs(&ifap) != 0)
fatal("getifaddrs");

for (ifa = ifap; ifa != NULL((void *)0); ifa = ifa->ifa_next) {
if (strcmp(if_name, ifa->ifa_name) != 0)
	continue;
if (ifa->ifa_addr == NULL((void *)0))
	continue;

switch(ifa->ifa_addr->sa_family) {
case AF_LINK18:
	imsg_ifinfo.link_state =
	    ((struct if_data *)ifa->ifa_data)->ifi_link_state;
	sdl = (struct sockaddr_dl *)ifa->ifa_addr;
	if (sdl->sdl_type != IFT_ETHER0x06 ||
	    sdl->sdl_alen != ETHER_ADDR_LEN6)
		continue;
	memcpy(iface->hw_address.ether_addr_octet,
	    LLADDR(sdl)((caddr_t)((sdl)->sdl_data + (sdl)->sdl_nlen)), ETHER_ADDR_LEN6);
	memcpy(imsg_ifinfo.hw_address.ether_addr_octet,
	    LLADDR(sdl)((caddr_t)((sdl)->sdl_data + (sdl)->sdl_nlen)), ETHER_ADDR_LEN6);
case AF_INET624:
	sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
566#ifdef __KAME__
	if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)(((&sin6->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xfe
) && (((&sin6->sin6_addr)->__u6_addr.__u6_addr8
[1] & 0xc0) == 0x80)) &&
	    sin6->sin6_scope_id == 0) {
		sin6->sin6_scope_id = ntohs(*(u_int16_t *)(__uint16_t)(__builtin_constant_p(*(u_int16_t *) &sin6->
sin6_addr.__u6_addr.__u6_addr8[2]) ? (__uint16_t)(((__uint16_t
)(*(u_int16_t *) &sin6->sin6_addr.__u6_addr.__u6_addr8
[2]) & 0xffU) << 8 | ((__uint16_t)(*(u_int16_t *) &
sin6->sin6_addr.__u6_addr.__u6_addr8[2]) & 0xff00U) >>
 8) : __swap16md(*(u_int16_t *) &sin6->sin6_addr.__u6_addr
.__u6_addr8[2]))
		    &sin6->sin6_addr.s6_addr[2])(__uint16_t)(__builtin_constant_p(*(u_int16_t *) &sin6->
sin6_addr.__u6_addr.__u6_addr8[2]) ? (__uint16_t)(((__uint16_t
)(*(u_int16_t *) &sin6->sin6_addr.__u6_addr.__u6_addr8
[2]) & 0xffU) << 8 | ((__uint16_t)(*(u_int16_t *) &
sin6->sin6_addr.__u6_addr.__u6_addr8[2]) & 0xff00U) >>
 8) : __swap16md(*(u_int16_t *) &sin6->sin6_addr.__u6_addr
.__u6_addr8[2]));
		sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[2] =
		    sin6->sin6_addr.s6_addr__u6_addr.__u6_addr8[3] = 0;
	}
574#endif
	if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)(((&sin6->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xfe
) && (((&sin6->sin6_addr)->__u6_addr.__u6_addr8
[1] & 0xc0) == 0x80))) {
		memcpy(&imsg_ifinfo.ll_address, sin6,
		    sizeof(imsg_ifinfo.ll_address));

		if (!iface->ll_tentative)
			break;

		memset(&ifr6, 0, sizeof(ifr6));
		strlcpy(ifr6.ifr_name, if_name,
		    sizeof(ifr6.ifr_name));
		memcpy(&ifr6.ifr_addrifr_ifru.ifru_addr, sin6,
		    sizeof(ifr6.ifr_addrifr_ifru.ifru_addr));

		if (ioctl(ioctlsock, SIOCGIFAFLAG_IN6(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct in6_ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((73))),
		    (caddr_t)&ifr6) == -1) {
			log_warn("SIOCGIFAFLAG_IN6");
			break;
		}

		if (!(ifr6.ifr_ifru.ifru_flags6 &
		    IN6_IFF_TENTATIVE0x02)) {
			iface->ll_tentative = 0;
			if (iface->send_solicitation)
				send_solicitation(
				    iface->if_index);
		}
	}
	break;
default:
	break;
}
}

freeifaddrs(ifap);

frontend_imsg_compose_main(IMSG_UPDATE_IF, 0, &imsg_ifinfo,
   sizeof(imsg_ifinfo));
612}

614#ifndef	SMALL
615const char*
616flags_to_str(int flags)
617{
static char	buf[sizeof(" anycast tentative duplicated detached "
	    "deprecated autoconf temporary")];

buf[0] = '\0';
if (flags & IN6_IFF_ANYCAST0x01)
strlcat(buf, " anycast", sizeof(buf));
if (flags & IN6_IFF_TENTATIVE0x02)
strlcat(buf, " tentative", sizeof(buf));
if (flags & IN6_IFF_DUPLICATED0x04)
strlcat(buf, " duplicated", sizeof(buf));
if (flags & IN6_IFF_DETACHED0x08)
strlcat(buf, " detached", sizeof(buf));
if (flags & IN6_IFF_DEPRECATED0x10)
strlcat(buf, " deprecated", sizeof(buf));
if (flags & IN6_IFF_AUTOCONF0x40)
strlcat(buf, " autoconf", sizeof(buf));
if (flags & IN6_IFF_TEMPORARY0x80)
strlcat(buf, " temporary", sizeof(buf));

return (buf);
638}
639#endif	/* SMALL */

641void
642frontend_startup(void)
643{
struct if_nameindex	*ifnidxp, *ifnidx;

if (!event_initialized(&ev_route)((&ev_route)->ev_flags & 0x80))
fatalx("%s: did not receive a route socket from the main "
    "process", __func__);

event_add(&ev_route, NULL((void *)0));

if ((ifnidxp = if_nameindex()) == NULL((void *)0))
fatalx("if_nameindex");

for(ifnidx = ifnidxp; ifnidx->if_index !=0 && ifnidx->if_name != NULL((void *)0);
   ifnidx++)
update_iface(ifnidx->if_index, ifnidx->if_name);

if_freenameindex(ifnidxp);
660}

662void
663route_receive(int fd, short events, void *arg)
664{
static uint8_t			 *buf;

struct rt_msghdr		*rtm;
struct sockaddr			*sa, *rti_info[RTAX_MAX15];
ssize_t				 n;

if (buf == NULL((void *)0)) {
buf = malloc(ROUTE_SOCKET_BUF_SIZE16384);
if (buf == NULL((void *)0))
	fatal("malloc");
}
rtm = (struct rt_msghdr *)buf;
if ((n = read(fd, buf, ROUTE_SOCKET_BUF_SIZE16384)) == -1) {
if (errno(*__errno()) == EAGAIN35 || errno(*__errno()) == EINTR4)
	return;
log_warn("dispatch_rtmsg: read error");
return;
}

if (n == 0)
fatal("routing socket closed");

if (n < (ssize_t)sizeof(rtm->rtm_msglen) || n < rtm->rtm_msglen) {
log_warnx("partial rtm of %zd in buffer", n);
return;
}

if (rtm->rtm_version != RTM_VERSION5)
return;

sa = (struct sockaddr *)(buf + rtm->rtm_hdrlen);
get_rtaddrs(rtm->rtm_addrs, sa, rti_info);

handle_route_message(rtm, rti_info);
699}

701void
702handle_route_message(struct rt_msghdr *rtm, struct sockaddr **rti_info)
703{
struct if_msghdr		*ifm;
struct if_announcemsghdr	*ifan;
struct imsg_del_addr		 del_addr;
struct imsg_del_route		 del_route;
struct imsg_dup_addr		 dup_addr;
struct sockaddr_rtlabel		*rl;
struct sockaddr_in6		*sin6;
struct in6_ifreq		 ifr6;
struct in6_addr			*in6;
int				 xflags, if_index;
char				 ifnamebuf[IFNAMSIZ16];
char				*if_name;

switch (rtm->rtm_type) {
case RTM_IFINFO0xe:
ifm = (struct if_msghdr *)rtm;
if_index = ifm->ifm_index;
if_name = if_indextoname(if_index, ifnamebuf);
if (if_name == NULL((void *)0)) {
	log_debug("RTM_IFINFO: lost if %d", if_index);
	frontend_imsg_compose_engine(IMSG_REMOVE_IF, 0, 0,
	    &if_index, sizeof(if_index));
	remove_iface(if_index);
	break;
}
xflags = get_xflags(if_name);
if (xflags == -1 || !(xflags & (IFXF_AUTOCONF60x20 |
    IFXF_AUTOCONF6TEMP0x4))) {
	log_debug("RTM_IFINFO: %s(%d) no(longer) autoconf6",
	    if_name, if_index);
	frontend_imsg_compose_engine(IMSG_REMOVE_IF, 0,
	    0, &if_index, sizeof(if_index));
	remove_iface(if_index);
} else {
	update_iface(if_index, if_name);
}
break;
case RTM_IFANNOUNCE0xf:
ifan = (struct if_announcemsghdr *)rtm;
if_index = ifan->ifan_index;
              if (ifan->ifan_what == IFAN_DEPARTURE1) {
	frontend_imsg_compose_engine(IMSG_REMOVE_IF, 0, 0,
	    &if_index, sizeof(if_index));
	remove_iface(if_index);
}
break;
case RTM_NEWADDR0xc:
ifm = (struct if_msghdr *)rtm;
if_index = ifm->ifm_index;
if_name = if_indextoname(if_index, ifnamebuf);
if (if_name == NULL((void *)0)) {
	log_debug("RTM_NEWADDR: lost if %d", if_index);
	frontend_imsg_compose_engine(IMSG_REMOVE_IF, 0, 0,
	    &if_index, sizeof(if_index));
	remove_iface(if_index);
	break;
}

log_debug("RTM_NEWADDR: %s[%u]", if_name, if_index);
update_iface(if_index, if_name);
break;
case RTM_DELADDR0xd:
ifm = (struct if_msghdr *)rtm;
if_index = ifm->ifm_index;
if_name = if_indextoname(if_index, ifnamebuf);
if (if_name == NULL((void *)0)) {
	log_debug("RTM_DELADDR: lost if %d", if_index);
	frontend_imsg_compose_engine(IMSG_REMOVE_IF, 0, 0,
	    &if_index, sizeof(if_index));
	remove_iface(if_index);
	break;
}
if (rtm->rtm_addrs & RTA_IFA0x20 && rti_info[RTAX_IFA5]->sa_family
    == AF_INET624) {
	del_addr.if_index = if_index;
	memcpy(&del_addr.addr, rti_info[RTAX_IFA5], sizeof(
	    del_addr.addr));
	frontend_imsg_compose_engine(IMSG_DEL_ADDRESS,
		    0, 0, &del_addr, sizeof(del_addr));
	log_debug("RTM_DELADDR: %s[%u]", if_name, if_index);
}
break;
case RTM_CHGADDRATTR0x14:
ifm = (struct if_msghdr *)rtm;
if_index = ifm->ifm_index;
if_name = if_indextoname(if_index, ifnamebuf);
if (if_name == NULL((void *)0)) {
	log_debug("RTM_CHGADDRATTR: lost if %d", if_index);
	frontend_imsg_compose_engine(IMSG_REMOVE_IF, 0, 0,
	    &if_index, sizeof(if_index));
	remove_iface(if_index);
	break;
}
if (rtm->rtm_addrs & RTA_IFA0x20 && rti_info[RTAX_IFA5]->sa_family
    == AF_INET624) {
	sin6 = (struct sockaddr_in6 *) rti_info[RTAX_IFA5];

	if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)(((&sin6->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xfe
) && (((&sin6->sin6_addr)->__u6_addr.__u6_addr8
[1] & 0xc0) == 0x80))) {
		update_iface(if_index, if_name);
		break;
	}

	memset(&ifr6, 0, sizeof(ifr6));
	strlcpy(ifr6.ifr_name, if_name, sizeof(ifr6.ifr_name));
	memcpy(&ifr6.ifr_addrifr_ifru.ifru_addr, sin6, sizeof(ifr6.ifr_addrifr_ifru.ifru_addr));

	if (ioctl(ioctlsock, SIOCGIFAFLAG_IN6(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct in6_ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((73))), (caddr_t)&ifr6)
	    == -1) {
		log_warn("SIOCGIFAFLAG_IN6");
		break;
	}

816#ifndef	SMALL
	log_debug("RTM_CHGADDRATTR: %s - %s",
	    sin6_to_str(sin6),
	    flags_to_str(ifr6.ifr_ifru.ifru_flags6));
820#endif	/* SMALL */

	if (ifr6.ifr_ifru.ifru_flags6 & IN6_IFF_DUPLICATED0x04) {
		dup_addr.if_index = if_index;
		dup_addr.addr = *sin6;
		frontend_imsg_compose_engine(IMSG_DUP_ADDRESS,
		    0, 0, &dup_addr, sizeof(dup_addr));
	}

}
break;
case RTM_DELETE0x2:
ifm = (struct if_msghdr *)rtm;
if ((rtm->rtm_addrs & (RTA_DST0x1 | RTA_GATEWAY0x2 | RTA_LABEL0x400)) !=
    (RTA_DST0x1 | RTA_GATEWAY0x2 | RTA_LABEL0x400))
	break;
if (rti_info[RTAX_DST0]->sa_family != AF_INET624)
	break;
if (!IN6_IS_ADDR_UNSPECIFIED(&((struct sockaddr_in6 *)((*(const u_int32_t *)(const void *)(&(&((struct sockaddr_in6
 *) rti_info[0])->sin6_addr)->__u6_addr.__u6_addr8[0]) ==
 0) && (*(const u_int32_t *)(const void *)(&(&
((struct sockaddr_in6 *) rti_info[0])->sin6_addr)->__u6_addr
.__u6_addr8[4]) == 0) && (*(const u_int32_t *)(const void
 *)(&(&((struct sockaddr_in6 *) rti_info[0])->sin6_addr
)->__u6_addr.__u6_addr8[8]) == 0) && (*(const u_int32_t
 *)(const void *)(&(&((struct sockaddr_in6 *) rti_info
[0])->sin6_addr)->__u6_addr.__u6_addr8[12]) == 0))
    rti_info[RTAX_DST])->sin6_addr)((*(const u_int32_t *)(const void *)(&(&((struct sockaddr_in6
 *) rti_info[0])->sin6_addr)->__u6_addr.__u6_addr8[0]) ==
 0) && (*(const u_int32_t *)(const void *)(&(&
((struct sockaddr_in6 *) rti_info[0])->sin6_addr)->__u6_addr
.__u6_addr8[4]) == 0) && (*(const u_int32_t *)(const void
 *)(&(&((struct sockaddr_in6 *) rti_info[0])->sin6_addr
)->__u6_addr.__u6_addr8[8]) == 0) && (*(const u_int32_t
 *)(const void *)(&(&((struct sockaddr_in6 *) rti_info
[0])->sin6_addr)->__u6_addr.__u6_addr8[12]) == 0)))
	break;
if (rti_info[RTAX_GATEWAY1]->sa_family != AF_INET624)
	break;
if (rti_info[RTAX_LABEL10]->sa_len !=
    sizeof(struct sockaddr_rtlabel))
	break;

rl = (struct sockaddr_rtlabel *)rti_info[RTAX_LABEL10];
if (strcmp(rl->sr_label, SLAACD_RTA_LABEL"slaacd") != 0)
	break;
if_index = ifm->ifm_index;
if_name = if_indextoname(if_index, ifnamebuf);
if (if_name == NULL((void *)0)) {
	log_debug("RTM_DELETE: lost if %d", if_index);
	frontend_imsg_compose_engine(IMSG_REMOVE_IF, 0, 0,
	    &if_index, sizeof(if_index));
	remove_iface(if_index);
	break;
}

del_route.if_index = if_index;
memcpy(&del_route.gw, rti_info[RTAX_GATEWAY1],
    sizeof(del_route.gw));
in6 = &del_route.gw.sin6_addr;
864#ifdef __KAME__
/* XXX from route(8) p_sockaddr() */
if ((IN6_IS_ADDR_LINKLOCAL(in6)(((in6)->__u6_addr.__u6_addr8[0] == 0xfe) && (((in6
)->__u6_addr.__u6_addr8[1] & 0xc0) == 0x80)) ||
    IN6_IS_ADDR_MC_LINKLOCAL(in6)(((in6)->__u6_addr.__u6_addr8[0] == 0xff) && (((in6
)->__u6_addr.__u6_addr8[1] & 0x0f) == 0x02)) ||
    IN6_IS_ADDR_MC_INTFACELOCAL(in6)(((in6)->__u6_addr.__u6_addr8[0] == 0xff) && (((in6
)->__u6_addr.__u6_addr8[1] & 0x0f) == 0x01))) &&
    del_route.gw.sin6_scope_id == 0) {
	del_route.gw.sin6_scope_id =
	    (u_int32_t)ntohs(*(u_short *) &in6->s6_addr[2])(__uint16_t)(__builtin_constant_p(*(u_short *) &in6->__u6_addr
.__u6_addr8[2]) ? (__uint16_t)(((__uint16_t)(*(u_short *) &
in6->__u6_addr.__u6_addr8[2]) & 0xffU) << 8 | ((
__uint16_t)(*(u_short *) &in6->__u6_addr.__u6_addr8[2]
) & 0xff00U) >> 8) : __swap16md(*(u_short *) &in6
->__u6_addr.__u6_addr8[2]));
	*(u_short *)&in6->s6_addr__u6_addr.__u6_addr8[2] = 0;
}
874#endif
frontend_imsg_compose_engine(IMSG_DEL_ROUTE,
    0, 0, &del_route, sizeof(del_route));
log_debug("RTM_DELETE: %s[%u]", if_name,
    ifm->ifm_index);

break;
881#ifndef	SMALL
case RTM_PROPOSAL0x13:
if (rtm->rtm_priority == RTP_PROPOSAL_SOLICIT62) {
	log_debug("RTP_PROPOSAL_SOLICIT");
	frontend_imsg_compose_engine(IMSG_REPROPOSE_RDNS,
	    0, 0, NULL((void *)0), 0);
}
break;
889#endif	/* SMALL */
default:
log_debug("unexpected RTM: %d", rtm->rtm_type);
break;
}

895}

897#define ROUNDUP(a)((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof
(long)) \
((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long))

900void
901get_rtaddrs(int addrs, struct sockaddr *sa, struct sockaddr **rti_info)
902{
int	i;

for (i = 0; i < RTAX_MAX15; i++) {
if (addrs & (1 << i)) {
	rti_info[i] = sa;
	sa = (struct sockaddr *)((char *)(sa) +
	    ROUNDUP(sa->sa_len)((sa->sa_len) > 0 ? (1 + (((sa->sa_len) - 1) | (sizeof
(long) - 1))) : sizeof(long)));
} else
	rti_info[i] = NULL((void *)0);
}
913}

915void
916icmp6_receive(int fd, short events, void *arg)
917{
struct imsg_ra		 ra;
struct icmp6_hdr	*icmp6_hdr;
struct icmp6_ev		*icmp6ev;
struct in6_pktinfo	*pi = NULL((void *)0);
struct cmsghdr		*cm;
ssize_t			 len;
int			 if_index = 0, *hlimp = NULL((void *)0);
char			 ntopbuf[INET6_ADDRSTRLEN46];
926#ifndef SMALL
char			 ifnamebuf[IFNAMSIZ16];
928#endif	/* SMALL */

icmp6ev = arg;
if ((len = recvmsg(fd, &icmp6ev->rcvmhdr, 0)) == -1) {
log_warn("recvmsg");
return;
}

if ((size_t)len < sizeof(struct icmp6_hdr))
return;

icmp6_hdr = (struct icmp6_hdr *)icmp6ev->answer;
if (icmp6_hdr->icmp6_type != ND_ROUTER_ADVERT134)
return;

/* extract optional information via Advanced API */
for (cm = (struct cmsghdr *)CMSG_FIRSTHDR(&icmp6ev->rcvmhdr)((&icmp6ev->rcvmhdr)->msg_controllen >= sizeof(struct
 cmsghdr) ? (struct cmsghdr *)(&icmp6ev->rcvmhdr)->
msg_control : (struct cmsghdr *)((void *)0)); cm;
   cm = (struct cmsghdr *)CMSG_NXTHDR(&icmp6ev->rcvmhdr, cm)(((char *)(cm) + (((unsigned long)((cm)->cmsg_len) + (sizeof
(long) - 1)) &~(sizeof(long) - 1)) + (((unsigned long)(sizeof
(struct cmsghdr)) + (sizeof(long) - 1)) &~(sizeof(long) -
 1)) > ((char *)(&icmp6ev->rcvmhdr)->msg_control
) + (&icmp6ev->rcvmhdr)->msg_controllen) ? (struct cmsghdr
 *)((void *)0) : (struct cmsghdr *)((char *)(cm) + (((unsigned
 long)((cm)->cmsg_len) + (sizeof(long) - 1)) &~(sizeof
(long) - 1))))) {
if (cm->cmsg_level == IPPROTO_IPV641 &&
    cm->cmsg_type == IPV6_PKTINFO46 &&
    cm->cmsg_len == CMSG_LEN(sizeof(struct in6_pktinfo))((((unsigned long)(sizeof(struct cmsghdr)) + (sizeof(long) - 1
)) &~(sizeof(long) - 1)) + (sizeof(struct in6_pktinfo)))) {
	pi = (struct in6_pktinfo *)(CMSG_DATA(cm)((unsigned char *)(cm) + (((unsigned long)(sizeof(struct cmsghdr
)) + (sizeof(long) - 1)) &~(sizeof(long) - 1))));
	if_index = pi->ipi6_ifindex;
}
if (cm->cmsg_level == IPPROTO_IPV641 &&
    cm->cmsg_type == IPV6_HOPLIMIT47 &&
    cm->cmsg_len == CMSG_LEN(sizeof(int))((((unsigned long)(sizeof(struct cmsghdr)) + (sizeof(long) - 1
)) &~(sizeof(long) - 1)) + (sizeof(int))))
	hlimp = (int *)CMSG_DATA(cm)((unsigned char *)(cm) + (((unsigned long)(sizeof(struct cmsghdr
)) + (sizeof(long) - 1)) &~(sizeof(long) - 1)));
}

if (if_index == 0) {
log_warnx("failed to get receiving interface");
return;
}

if (hlimp == NULL((void *)0)) {
log_warnx("failed to get receiving hop limit");
return;
}

if (*hlimp != 255) {
log_warnx("invalid RA with hop limit of %d from %s on %s",
    *hlimp, inet_ntop(AF_INET624, &icmp6ev->from.sin6_addr,
    ntopbuf, INET6_ADDRSTRLEN46), if_indextoname(if_index,
    ifnamebuf));
return;
}

if ((size_t)len > sizeof(ra.packet)) {
log_warnx("invalid RA with size %ld from %s on %s",
    len, inet_ntop(AF_INET624, &icmp6ev->from.sin6_addr,
    ntopbuf, INET6_ADDRSTRLEN46), if_indextoname(if_index,
    ifnamebuf));
return;
}
ra.if_index = if_index;
memcpy(&ra.from,  &icmp6ev->from, sizeof(ra.from));
ra.len = len;
memcpy(ra.packet, icmp6ev->answer, len);

frontend_imsg_compose_engine(IMSG_RA, 0, 0, &ra, sizeof(ra));
989}

991void
992send_solicitation(uint32_t if_index)
993{
struct in6_pktinfo	*pi;
struct cmsghdr		*cm;
struct iface		*iface;

log_debug("%s(%u)", __func__, if_index);

if ((iface = get_iface_by_id(if_index)) == NULL((void *)0))
14
←
Assuming the condition is false→
15
←
Taking false branch→
return;

if (!event_initialized(&iface->icmp6ev->ev)((&iface->icmp6ev->ev)->ev_flags & 0x80)) {
16
←
Assuming the condition is false→
17
←
Taking false branch→
iface->send_solicitation = 1;
return;
} else if (iface->ll_tentative) {
18
←
Assuming field 'll_tentative' is 0→
19
←
Taking false branch→
iface->send_solicitation = 1;
return;
}

iface->send_solicitation = 0;

dst.sin6_scope_id = if_index;

cm = CMSG_FIRSTHDR(&sndmhdr)((&sndmhdr)->msg_controllen >= sizeof(struct cmsghdr
) ? (struct cmsghdr *)(&sndmhdr)->msg_control : (struct
 cmsghdr *)((void *)0));
20
←
Assuming the condition is false→
21
←
'?' condition is false→
22
←
Null pointer value stored to 'cm'→
pi = (struct in6_pktinfo *)CMSG_DATA(cm)((unsigned char *)(cm) + (((unsigned long)(sizeof(struct cmsghdr
)) + (sizeof(long) - 1)) &~(sizeof(long) - 1)));
23
←
Null pointer value stored to 'pi'→
pi->ipi6_ifindex = if_index;
24
←
Access to field 'ipi6_ifindex' results in a dereference of a null pointer (loaded from variable 'pi')

memcpy(&nd_opt_source_link_addr, &iface->hw_address,
   sizeof(nd_opt_source_link_addr));

if (sendmsg(EVENT_FD(&iface->icmp6ev->ev)(int)(&iface->icmp6ev->ev)->ev_fd, &sndmhdr, 0) != sizeof(rs) +
   sizeof(nd_opt_hdr) + sizeof(nd_opt_source_link_addr))
log_warn("sendmsg");
1025}

1027struct iface*
1028get_iface_by_id(uint32_t if_index)
1029{
struct iface	*iface;

LIST_FOREACH (iface, &interfaces, entries)for((iface) = ((&interfaces)->lh_first); (iface)!= ((void
 *)0); (iface) = ((iface)->entries.le_next)) {
if (iface->if_index == if_index)
	return (iface);
}

return (NULL((void *)0));
1038}

1040void
1041remove_iface(uint32_t if_index)
1042{
struct iface	*iface;

iface = get_iface_by_id(if_index);

if (iface == NULL((void *)0))
return;

LIST_REMOVE(iface, entries)do { if ((iface)->entries.le_next != ((void *)0)) (iface)->
entries.le_next->entries.le_prev = (iface)->entries.le_prev
; *(iface)->entries.le_prev = (iface)->entries.le_next;
 ; ; } while (0);

unref_icmp6ev(iface);
free(iface);
1054}

1056struct icmp6_ev*
1057get_icmp6ev_by_rdomain(int rdomain)
1058{
struct iface	*iface;
struct icmp6_ev	*icmp6ev = NULL((void *)0);

LIST_FOREACH (iface, &interfaces, entries)for((iface) = ((&interfaces)->lh_first); (iface)!= ((void
 *)0); (iface) = ((iface)->entries.le_next)) {
if (iface->rdomain == rdomain) {
	icmp6ev = iface->icmp6ev;
	break;
}
}

if (icmp6ev == NULL((void *)0)) {
if ((icmp6ev = calloc(1, sizeof(*icmp6ev))) == NULL((void *)0))
	fatal("calloc");
icmp6ev->rcviov[0].iov_base = (caddr_t)icmp6ev->answer;
icmp6ev->rcviov[0].iov_len = sizeof(icmp6ev->answer);
icmp6ev->rcvmhdr.msg_name = (caddr_t)&icmp6ev->from;
icmp6ev->rcvmhdr.msg_namelen = sizeof(icmp6ev->from);
icmp6ev->rcvmhdr.msg_iov = icmp6ev->rcviov;
icmp6ev->rcvmhdr.msg_iovlen = 1;
icmp6ev->rcvmhdr.msg_controllen =
    CMSG_SPACE(sizeof(struct in6_pktinfo))((((unsigned long)(sizeof(struct cmsghdr)) + (sizeof(long) - 1
)) &~(sizeof(long) - 1)) + (((unsigned long)(sizeof(struct
 in6_pktinfo)) + (sizeof(long) - 1)) &~(sizeof(long) - 1)
)) +
    CMSG_SPACE(sizeof(int))((((unsigned long)(sizeof(struct cmsghdr)) + (sizeof(long) - 1
)) &~(sizeof(long) - 1)) + (((unsigned long)(sizeof(int))
 + (sizeof(long) - 1)) &~(sizeof(long) - 1)));
if ((icmp6ev->rcvmhdr.msg_control = malloc(icmp6ev->
    rcvmhdr.msg_controllen)) == NULL((void *)0))
	fatal("malloc");
frontend_imsg_compose_main(IMSG_OPEN_ICMP6SOCK, 0,
    &rdomain, sizeof(rdomain));
}
icmp6ev->refcnt++;
return (icmp6ev);
1089}

1091void
1092unref_icmp6ev(struct iface *iface)
1093{
struct icmp6_ev *icmp6ev = iface->icmp6ev;

iface->icmp6ev = NULL((void *)0);

if (icmp6ev != NULL((void *)0)) {
icmp6ev->refcnt--;
if (icmp6ev->refcnt == 0) {
	event_del(&icmp6ev->ev);
	close(EVENT_FD(&icmp6ev->ev)(int)(&icmp6ev->ev)->ev_fd);
	free(icmp6ev);
}
}
1106}

1108void
1109set_icmp6sock(int icmp6sock, int rdomain)
1110{
struct iface	*iface;

LIST_FOREACH (iface, &interfaces, entries)for((iface) = ((&interfaces)->lh_first); (iface)!= ((void
 *)0); (iface) = ((iface)->entries.le_next)) {
if (!event_initialized(&iface->icmp6ev->ev)((&iface->icmp6ev->ev)->ev_flags & 0x80) && iface->rdomain
    == rdomain) {
	event_set(&iface->icmp6ev->ev, icmp6sock, EV_READ0x02 |
	    EV_PERSIST0x10, icmp6_receive, iface->icmp6ev);
	event_add(&iface->icmp6ev->ev, NULL((void *)0));
	icmp6sock = -1;
	break;
}
}

if (icmp6sock != -1) {
/*
 * The interface disappeared or changed rdomain while we were
 * waiting for the parent process to open the raw socket.
 */
close(icmp6sock);
return;
}

LIST_FOREACH (iface, &interfaces, entries)for((iface) = ((&interfaces)->lh_first); (iface)!= ((void
 *)0); (iface) = ((iface)->entries.le_next)) {
if (event_initialized(&iface->icmp6ev->ev)((&iface->icmp6ev->ev)->ev_flags & 0x80) &&
    iface->send_solicitation)
	send_solicitation(iface->if_index);
}
1138}