diff options
| -rw-r--r-- | sys/netinet6/ip6_input.c | 6 | ||||
| -rw-r--r-- | sys/netinet6/nd6.c | 6 | ||||
| -rw-r--r-- | sys/netinet6/nd6.h | 4 | ||||
| -rw-r--r-- | usr.sbin/ndp/ndp.8 | 13 | ||||
| -rw-r--r-- | usr.sbin/ndp/ndp.c | 5 |
5 files changed, 34 insertions, 0 deletions
diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c index 9c5ff4a49e790..757b1d1e1a594 100644 --- a/sys/netinet6/ip6_input.c +++ b/sys/netinet6/ip6_input.c @@ -278,6 +278,12 @@ ip6_input(m) #undef M2MMAX } + /* drop the packet if IPv6 operation is disabled on the IF */ + if ((ND_IFINFO(m->m_pkthdr.rcvif)->flags & ND6_IFF_IFDISABLED)) { + m_freem(m); + return; + } + in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive); ip6stat.ip6s_total++; diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c index ae3664fa89fc9..93186a5f8d2c9 100644 --- a/sys/netinet6/nd6.c +++ b/sys/netinet6/nd6.c @@ -1996,6 +1996,12 @@ again: return (0); sendpkt: + /* discard the packet if IPv6 operation is disabled on the interface */ + if ((ND_IFINFO(ifp)->flags & ND6_IFF_IFDISABLED)) { + error = ENETDOWN; /* better error? */ + goto bad; + } + #ifdef IPSEC /* clean ipsec history once it goes out of the node */ ipsec_delaux(m); diff --git a/sys/netinet6/nd6.h b/sys/netinet6/nd6.h index 33d241602e9bb..760671c604c35 100644 --- a/sys/netinet6/nd6.h +++ b/sys/netinet6/nd6.h @@ -88,6 +88,10 @@ struct nd_ifinfo { #define ND6_IFF_PERFORMNUD 0x1 #define ND6_IFF_ACCEPT_RTADV 0x2 +#define ND6_IFF_PREFER_SOURCE 0x4 /* XXX: not related to ND. */ +#define ND6_IFF_IFDISABLED 0x8 /* IPv6 operation is disabled due to + * DAD failure. (XXX: not ND-specific) + */ #ifdef _KERNEL #define ND_IFINFO(ifp) \ diff --git a/usr.sbin/ndp/ndp.8 b/usr.sbin/ndp/ndp.8 index ea33646af2d76..4d99527d781fe 100644 --- a/usr.sbin/ndp/ndp.8 +++ b/usr.sbin/ndp/ndp.8 @@ -198,6 +198,19 @@ selection, see the .Pa IMPLEMENTATION file supplied with the KAME kit. .It Xo +.Ic disabled +.Xc +Disable IPv6 operation on the interface. +When disabled, the interface discards any IPv6 packets +received on or being sent to the interface. +In the sending case, an error of ENETDOWN will be returned to the +application. +This flag is typically set automatically in the kernel as a result of +a certain failure of Duplicate Address Detection. +While the flag can be set or cleared by hand with the +.Nm +command, it is not generally advisable to modify this flag manually. +.It Xo .Ic basereachable=(number) .Xc Specify the BaseReachbleTimer on the interface in millisecond. diff --git a/usr.sbin/ndp/ndp.c b/usr.sbin/ndp/ndp.c index 96e8c149a2f28..33e1a6a9b7188 100644 --- a/usr.sbin/ndp/ndp.c +++ b/usr.sbin/ndp/ndp.c @@ -989,6 +989,7 @@ ifinfo(ifname, argc, argv) } \ } while (0) + SETFLAG("disabled", ND6_IFF_IFDISABLED); SETFLAG("nud", ND6_IFF_PERFORMNUD); #ifdef ND6_IFF_ACCEPT_RTADV SETFLAG("accept_rtadv", ND6_IFF_ACCEPT_RTADV); @@ -1055,6 +1056,10 @@ ifinfo(ifname, argc, argv) #endif if (ND.flags) { printf("\nFlags: "); +#ifdef ND6_IFF_IFDISABLED + if ((ND.flags & ND6_IFF_IFDISABLED)) + printf("disabled "); +#endif if ((ND.flags & ND6_IFF_PERFORMNUD)) printf("nud "); #ifdef ND6_IFF_ACCEPT_RTADV |