3 files changed, 16 insertions, 0 deletions

diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c
index 9c5ff4a49e790..757b1d1e1a594 100644
--- a/sys/netinet6/ip6_input.c
+++ b/sys/netinet6/ip6_input.c
@@ -278,6 +278,12 @@ ip6_input(m)
 #undef M2MMAX
 	}
 
+	/* drop the packet if IPv6 operation is disabled on the IF */
+	if ((ND_IFINFO(m->m_pkthdr.rcvif)->flags & ND6_IFF_IFDISABLED)) {
+		m_freem(m);
+		return;
+	}
+
 	in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive);
 	ip6stat.ip6s_total++;
 
diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c
index ae3664fa89fc9..93186a5f8d2c9 100644
--- a/sys/netinet6/nd6.c
+++ b/sys/netinet6/nd6.c
@@ -1996,6 +1996,12 @@ again:
 	return (0);
 
   sendpkt:
+	/* discard the packet if IPv6 operation is disabled on the interface */
+	if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) {
+		error = ENETDOWN; /* better error? */
+		goto bad;
+	}
+
 #ifdef IPSEC
 	/* clean ipsec history once it goes out of the node */
 	ipsec_delaux(m);
diff --git a/sys/netinet6/nd6.h b/sys/netinet6/nd6.h
index 33d241602e9bb..760671c604c35 100644
--- a/sys/netinet6/nd6.h
+++ b/sys/netinet6/nd6.h
@@ -88,6 +88,10 @@ struct nd_ifinfo {
 
 #define ND6_IFF_PERFORMNUD	0x1
 #define ND6_IFF_ACCEPT_RTADV	0x2
+#define ND6_IFF_PREFER_SOURCE	0x4 /* XXX: not related to ND. */
+#define ND6_IFF_IFDISABLED	0x8 /* IPv6 operation is disabled due to
+				     * DAD failure.  (XXX: not ND-specific)
+				     */
 
 #ifdef _KERNEL
 #define ND_IFINFO(ifp) \