src/network/networkd-ndisc.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2 /***
   3   Copyright © 2014 Intel Corporation. All rights reserved.
   4 ***/
   5
   6 #include <arpa/inet.h>
   7 #include <netinet/icmp6.h>
   8 #include <linux/if.h>
   9 #include <linux/if_arp.h>
  10
  11 #include "sd-ndisc.h"
  12
  13 #include "event-util.h"
  14 #include "missing_network.h"
  15 #include "networkd-address-generation.h"
  16 #include "networkd-address.h"
  17 #include "networkd-dhcp6.h"
  18 #include "networkd-manager.h"
  19 #include "networkd-ndisc.h"
  20 #include "networkd-queue.h"
  21 #include "networkd-route.h"
  22 #include "networkd-state-file.h"
  23 #include "networkd-sysctl.h"
  24 #include "string-table.h"
  25 #include "string-util.h"
  26 #include "strv.h"
  27 #include "sysctl-util.h"
  28
  29 #define NDISC_DNSSL_MAX 64U
  30 #define NDISC_RDNSS_MAX 64U
  31 /* Not defined in the RFC, but let's set an upper limit to make not consume much memory.
  32  * This should be safe as typically there should be at most 1 portal per network. */
  33 #define NDISC_CAPTIVE_PORTAL_MAX 64U
  34 /* Neither defined in the RFC. Just for safety. Otherwise, malformed messages can make clients trigger OOM.
  35  * Not sure if the threshold is high enough. Let's adjust later if not. */
  36 #define NDISC_PREF64_MAX 64U
  37
  38 bool link_ipv6_accept_ra_enabled(Link *link) {
  39         assert(link);
  40
  41         if (!socket_ipv6_is_supported())
  42                 return false;
  43
  44         if (link->flags & IFF_LOOPBACK)
  45                 return false;
  46
  47         if (link->iftype == ARPHRD_CAN)
  48                 return false;
  49
  50         if (!link->network)
  51                 return false;
  52
  53         if (!link_may_have_ipv6ll(link, /* check_multicast = */ true))
  54                 return false;
  55
  56         if (link->network->ipv6_accept_ra >= 0)
  57                 return link->network->ipv6_accept_ra;
  58
  59         /* Accept RAs if IPv6 forwarding is disabled, and ignore RAs if IPv6 forwarding is enabled. */
  60         int t = link_get_ip_forwarding(link, AF_INET6);
  61         if (t >= 0)
  62                 return !t;
  63
  64         /* Otherwise, defaults to true. */
  65         return true;
  66 }
  67
  68 void network_adjust_ipv6_accept_ra(Network *network) {
  69         assert(network);
  70
  71         if (!FLAGS_SET(network->link_local, ADDRESS_FAMILY_IPV6)) {
  72                 if (network->ipv6_accept_ra > 0)
  73                         log_warning("%s: IPv6AcceptRA= is enabled but IPv6 link-local addressing is disabled or not supported. "
  74                                     "Disabling IPv6AcceptRA=.", network->filename);
  75                 network->ipv6_accept_ra = false;
  76         }
  77
  78         /* When RouterAllowList=, PrefixAllowList= or RouteAllowList= are specified, then
  79          * RouterDenyList=, PrefixDenyList= or RouteDenyList= are ignored, respectively. */
  80         if (!set_isempty(network->ndisc_allow_listed_router))
  81                 network->ndisc_deny_listed_router = set_free_free(network->ndisc_deny_listed_router);
  82         if (!set_isempty(network->ndisc_allow_listed_prefix))
  83                 network->ndisc_deny_listed_prefix = set_free_free(network->ndisc_deny_listed_prefix);
  84         if (!set_isempty(network->ndisc_allow_listed_route_prefix))
  85                 network->ndisc_deny_listed_route_prefix = set_free_free(network->ndisc_deny_listed_route_prefix);
  86 }
  87
  88 static int ndisc_check_ready(Link *link);
  89
  90 static int ndisc_address_ready_callback(Address *address) {
  91         Address *a;
  92
  93         assert(address);
  94         assert(address->link);
  95
  96         SET_FOREACH(a, address->link->addresses)
  97                 if (a->source == NETWORK_CONFIG_SOURCE_NDISC)
  98                         a->callback = NULL;
  99
 100         return ndisc_check_ready(address->link);
 101 }
 102
 103 static int ndisc_check_ready(Link *link) {
 104         bool found = false, ready = false;
 105         Address *address;
 106
 107         assert(link);
 108
 109         if (link->ndisc_messages > 0) {
 110                 log_link_debug(link, "%s(): SLAAC addresses and routes are not set.", __func__);
 111                 return 0;
 112         }
 113
 114         SET_FOREACH(address, link->addresses) {
 115                 if (address->source != NETWORK_CONFIG_SOURCE_NDISC)
 116                         continue;
 117
 118                 found = true;
 119
 120                 if (address_is_ready(address)) {
 121                         ready = true;
 122                         break;
 123                 }
 124         }
 125
 126         if (found && !ready) {
 127                 SET_FOREACH(address, link->addresses)
 128                         if (address->source == NETWORK_CONFIG_SOURCE_NDISC)
 129                                 address->callback = ndisc_address_ready_callback;
 130
 131                 log_link_debug(link, "%s(): no SLAAC address is ready.", __func__);
 132                 return 0;
 133         }
 134
 135         link->ndisc_configured = true;
 136         log_link_debug(link, "SLAAC addresses and routes set.");
 137
 138         link_check_ready(link);
 139         return 0;
 140 }
 141
 142 static int ndisc_route_handler(sd_netlink *rtnl, sd_netlink_message *m, Request *req, Link *link, Route *route) {
 143         int r;
 144
 145         assert(link);
 146
 147         r = route_configure_handler_internal(rtnl, m, link, route, "Could not set NDisc route");
 148         if (r <= 0)
 149                 return r;
 150
 151         r = ndisc_check_ready(link);
 152         if (r < 0)
 153                 link_enter_failed(link);
 154
 155         return 1;
 156 }
 157
 158 static void ndisc_set_route_priority(Link *link, Route *route) {
 159         assert(link);
 160         assert(route);
 161
 162         if (route->priority_set)
 163                 return; /* explicitly configured. */
 164
 165         switch (route->pref) {
 166         case SD_NDISC_PREFERENCE_LOW:
 167                 route->priority = link->network->ipv6_accept_ra_route_metric_low;
 168                 break;
 169         case SD_NDISC_PREFERENCE_MEDIUM:
 170                 route->priority = link->network->ipv6_accept_ra_route_metric_medium;
 171                 break;
 172         case SD_NDISC_PREFERENCE_HIGH:
 173                 route->priority = link->network->ipv6_accept_ra_route_metric_high;
 174                 break;
 175         default:
 176                 assert_not_reached();
 177         }
 178 }
 179
 180 static int ndisc_request_route(Route *route, Link *link, sd_ndisc_router *rt) {
 181         struct in6_addr router;
 182         uint8_t hop_limit = 0;
 183         uint32_t mtu = 0;
 184         bool is_new;
 185         int r;
 186
 187         assert(route);
 188         assert(link);
 189         assert(link->manager);
 190         assert(link->network);
 191         assert(rt);
 192
 193         r = sd_ndisc_router_get_address(rt, &router);
 194         if (r < 0)
 195                 return r;
 196
 197         if (link->network->ipv6_accept_ra_use_mtu) {
 198                 r = sd_ndisc_router_get_mtu(rt, &mtu);
 199                 if (r < 0 && r != -ENODATA)
 200                         return log_link_warning_errno(link, r, "Failed to get MTU from RA: %m");
 201         }
 202
 203         if (link->network->ipv6_accept_ra_use_hop_limit) {
 204                 r = sd_ndisc_router_get_hop_limit(rt, &hop_limit);
 205                 if (r < 0 && r != -ENODATA)
 206                         return log_link_warning_errno(link, r, "Failed to get hop limit from RA: %m");
 207         }
 208
 209         route->source = NETWORK_CONFIG_SOURCE_NDISC;
 210         route->provider.in6 = router;
 211         if (!route->table_set)
 212                 route->table = link_get_ipv6_accept_ra_route_table(link);
 213         if (!route->protocol_set)
 214                 route->protocol = RTPROT_RA;
 215         r = route_metric_set(&route->metric, RTAX_MTU, mtu);
 216         if (r < 0)
 217                 return r;
 218         r = route_metric_set(&route->metric, RTAX_HOPLIMIT, hop_limit);
 219         if (r < 0)
 220                 return r;
 221         r = route_metric_set(&route->metric, RTAX_QUICKACK, link->network->ipv6_accept_ra_quickack);
 222         if (r < 0)
 223                 return r;
 224
 225         r = route_adjust_nexthops(route, link);
 226         if (r < 0)
 227                 return r;
 228
 229         uint8_t pref, pref_original = route->pref;
 230         FOREACH_ARGUMENT(pref, SD_NDISC_PREFERENCE_LOW, SD_NDISC_PREFERENCE_MEDIUM, SD_NDISC_PREFERENCE_HIGH) {
 231                 Route *existing;
 232                 Request *req;
 233
 234                 /* If the preference is specified by the user config (that is, for semi-static routes),
 235                  * rather than RA, then only search conflicting routes that have the same preference. */
 236                 if (route->pref_set && pref != pref_original)
 237                         continue;
 238
 239                 route->pref = pref;
 240                 ndisc_set_route_priority(link, route);
 241
 242                 /* Note, here do not call route_remove_and_cancel() with 'route' directly, otherwise
 243                  * existing route(s) may be removed needlessly. */
 244
 245                 if (route_get(link->manager, route, &existing) >= 0) {
 246                         /* Found an existing route that may conflict with this route. */
 247                         if (!route_can_update(existing, route)) {
 248                                 log_link_debug(link, "Found an existing route that conflicts with new route based on a received RA, removing.");
 249                                 r = route_remove_and_cancel(existing, link->manager);
 250                                 if (r < 0)
 251                                         return r;
 252                         }
 253                 }
 254
 255                 if (route_get_request(link->manager, route, &req) >= 0) {
 256                         existing = ASSERT_PTR(req->userdata);
 257                         if (!route_can_update(existing, route)) {
 258                                 log_link_debug(link, "Found a pending route request that conflicts with new request based on a received RA, cancelling.");
 259                                 r = route_remove_and_cancel(existing, link->manager);
 260                                 if (r < 0)
 261                                         return r;
 262                         }
 263                 }
 264         }
 265
 266         /* The preference (and priority) may be changed in the above loop. Restore it. */
 267         route->pref = pref_original;
 268         ndisc_set_route_priority(link, route);
 269
 270         is_new = route_get(link->manager, route, NULL) < 0;
 271
 272         r = link_request_route(link, route, &link->ndisc_messages, ndisc_route_handler);
 273         if (r < 0)
 274                 return r;
 275         if (r > 0 && is_new)
 276                 link->ndisc_configured = false;
 277
 278         return 0;
 279 }
 280
 281 static int ndisc_remove_route(Route *route, Link *link) {
 282         int r;
 283
 284         assert(route);
 285         assert(link);
 286         assert(link->manager);
 287
 288         ndisc_set_route_priority(link, route);
 289
 290         if (!route->table_set)
 291                 route->table = link_get_ipv6_accept_ra_route_table(link);
 292
 293         r = route_adjust_nexthops(route, link);
 294         if (r < 0)
 295                 return r;
 296
 297         if (route->pref_set) {
 298                 ndisc_set_route_priority(link, route);
 299                 return route_remove_and_cancel(route, link->manager);
 300         }
 301
 302         uint8_t pref;
 303         FOREACH_ARGUMENT(pref, SD_NDISC_PREFERENCE_LOW, SD_NDISC_PREFERENCE_MEDIUM, SD_NDISC_PREFERENCE_HIGH) {
 304                 route->pref = pref;
 305                 ndisc_set_route_priority(link, route);
 306                 r = route_remove_and_cancel(route, link->manager);
 307                 if (r < 0)
 308                         return r;
 309         }
 310
 311         return 0;
 312 }
 313
 314 static int ndisc_address_handler(sd_netlink *rtnl, sd_netlink_message *m, Request *req, Link *link, Address *address) {
 315         int r;
 316
 317         assert(link);
 318
 319         r = address_configure_handler_internal(rtnl, m, link, "Could not set NDisc address");
 320         if (r <= 0)
 321                 return r;
 322
 323         r = ndisc_check_ready(link);
 324         if (r < 0)
 325                 link_enter_failed(link);
 326
 327         return 1;
 328 }
 329
 330 static int ndisc_request_address(Address *address, Link *link, sd_ndisc_router *rt) {
 331         struct in6_addr router;
 332         bool is_new;
 333         int r;
 334
 335         assert(address);
 336         assert(link);
 337         assert(rt);
 338
 339         r = sd_ndisc_router_get_address(rt, &router);
 340         if (r < 0)
 341                 return r;
 342
 343         address->source = NETWORK_CONFIG_SOURCE_NDISC;
 344         address->provider.in6 = router;
 345
 346         r = free_and_strdup_warn(&address->netlabel, link->network->ndisc_netlabel);
 347         if (r < 0)
 348                 return r;
 349
 350         Address *existing;
 351         if (address_get_harder(link, address, &existing) < 0)
 352                 is_new = true;
 353         else if (address_can_update(existing, address))
 354                 is_new = false;
 355         else if (existing->source == NETWORK_CONFIG_SOURCE_DHCP6) {
 356                 /* SLAAC address is preferred over DHCPv6 address. */
 357                 log_link_debug(link, "Conflicting DHCPv6 address %s exists, removing.",
 358                                IN_ADDR_PREFIX_TO_STRING(existing->family, &existing->in_addr, existing->prefixlen));
 359                 r = address_remove(existing, link);
 360                 if (r < 0)
 361                         return r;
 362
 363                 is_new = true;
 364         } else {
 365                 /* Conflicting static address is configured?? */
 366                 log_link_debug(link, "Conflicting address %s exists, ignoring request.",
 367                                IN_ADDR_PREFIX_TO_STRING(existing->family, &existing->in_addr, existing->prefixlen));
 368                 return 0;
 369         }
 370
 371         r = link_request_address(link, address, &link->ndisc_messages,
 372                                  ndisc_address_handler, NULL);
 373         if (r < 0)
 374                 return r;
 375         if (r > 0 && is_new)
 376                 link->ndisc_configured = false;
 377
 378         return 0;
 379 }
 380
 381 static int ndisc_router_drop_default(Link *link, sd_ndisc_router *rt) {
 382         _cleanup_(route_unrefp) Route *route = NULL;
 383         struct in6_addr gateway;
 384         int r;
 385
 386         assert(link);
 387         assert(link->network);
 388         assert(rt);
 389
 390         r = sd_ndisc_router_get_address(rt, &gateway);
 391         if (r < 0)
 392                 return log_link_warning_errno(link, r, "Failed to get router address from RA: %m");
 393
 394         r = route_new(&route);
 395         if (r < 0)
 396                 return log_oom();
 397
 398         route->family = AF_INET6;
 399         route->nexthop.family = AF_INET6;
 400         route->nexthop.gw.in6 = gateway;
 401
 402         r = ndisc_remove_route(route, link);
 403         if (r < 0)
 404                 return log_link_warning_errno(link, r, "Failed to remove the default gateway configured by RA: %m");
 405
 406         Route *route_gw;
 407         HASHMAP_FOREACH(route_gw, link->network->routes_by_section) {
 408                 _cleanup_(route_unrefp) Route *tmp = NULL;
 409
 410                 if (!route_gw->gateway_from_dhcp_or_ra)
 411                         continue;
 412
 413                 if (route_gw->nexthop.family != AF_INET6)
 414                         continue;
 415
 416                 r = route_dup(route_gw, NULL, &tmp);
 417                 if (r < 0)
 418                         return r;
 419
 420                 tmp->nexthop.gw.in6 = gateway;
 421
 422                 r = ndisc_remove_route(tmp, link);
 423                 if (r < 0)
 424                         return log_link_warning_errno(link, r, "Could not remove semi-static gateway: %m");
 425         }
 426
 427         return 0;
 428 }
 429
 430 static int ndisc_router_process_default(Link *link, sd_ndisc_router *rt) {
 431         usec_t lifetime_usec;
 432         struct in6_addr gateway;
 433         unsigned preference;
 434         int r;
 435
 436         assert(link);
 437         assert(link->network);
 438         assert(rt);
 439
 440         /* If the router lifetime is zero, the router should not be used as the default gateway. */
 441         r = sd_ndisc_router_get_lifetime(rt, NULL);
 442         if (r < 0)
 443                 return r;
 444         if (r == 0)
 445                 return ndisc_router_drop_default(link, rt);
 446
 447         if (!link->network->ipv6_accept_ra_use_gateway &&
 448             hashmap_isempty(link->network->routes_by_section))
 449                 return 0;
 450
 451         r = sd_ndisc_router_get_lifetime_timestamp(rt, CLOCK_BOOTTIME, &lifetime_usec);
 452         if (r < 0)
 453                 return log_link_warning_errno(link, r, "Failed to get gateway lifetime from RA: %m");
 454
 455         r = sd_ndisc_router_get_address(rt, &gateway);
 456         if (r < 0)
 457                 return log_link_warning_errno(link, r, "Failed to get gateway address from RA: %m");
 458
 459         if (link_get_ipv6_address(link, &gateway, 0, NULL) >= 0) {
 460                 if (DEBUG_LOGGING)
 461                         log_link_debug(link, "No NDisc route added, gateway %s matches local address",
 462                                        IN6_ADDR_TO_STRING(&gateway));
 463                 return 0;
 464         }
 465
 466         r = sd_ndisc_router_get_preference(rt, &preference);
 467         if (r < 0)
 468                 return log_link_warning_errno(link, r, "Failed to get router preference from RA: %m");
 469
 470         if (link->network->ipv6_accept_ra_use_gateway) {
 471                 _cleanup_(route_unrefp) Route *route = NULL;
 472
 473                 r = route_new(&route);
 474                 if (r < 0)
 475                         return log_oom();
 476
 477                 route->family = AF_INET6;
 478                 route->pref = preference;
 479                 route->nexthop.family = AF_INET6;
 480                 route->nexthop.gw.in6 = gateway;
 481                 route->lifetime_usec = lifetime_usec;
 482
 483                 r = ndisc_request_route(route, link, rt);
 484                 if (r < 0)
 485                         return log_link_warning_errno(link, r, "Could not request default route: %m");
 486         }
 487
 488         Route *route_gw;
 489         HASHMAP_FOREACH(route_gw, link->network->routes_by_section) {
 490                 _cleanup_(route_unrefp) Route *route = NULL;
 491
 492                 if (!route_gw->gateway_from_dhcp_or_ra)
 493                         continue;
 494
 495                 if (route_gw->nexthop.family != AF_INET6)
 496                         continue;
 497
 498                 r = route_dup(route_gw, NULL, &route);
 499                 if (r < 0)
 500                         return r;
 501
 502                 route->nexthop.gw.in6 = gateway;
 503                 if (!route->pref_set)
 504                         route->pref = preference;
 505                 route->lifetime_usec = lifetime_usec;
 506
 507                 r = ndisc_request_route(route, link, rt);
 508                 if (r < 0)
 509                         return log_link_warning_errno(link, r, "Could not request gateway: %m");
 510         }
 511
 512         return 0;
 513 }
 514
 515 static int ndisc_router_process_icmp6_ratelimit(Link *link, sd_ndisc_router *rt) {
 516         usec_t icmp6_ratelimit, msec;
 517         int r;
 518
 519         assert(link);
 520         assert(link->network);
 521         assert(rt);
 522
 523         if (!link->network->ipv6_accept_ra_use_icmp6_ratelimit)
 524                 return 0;
 525
 526         /* Ignore the icmp6 ratelimit field of the RA header if the lifetime is zero. */
 527         r = sd_ndisc_router_get_lifetime(rt, NULL);
 528         if (r <= 0)
 529                 return r;
 530
 531         r = sd_ndisc_router_get_icmp6_ratelimit(rt, &icmp6_ratelimit);
 532         if (r < 0)
 533                 return log_link_warning_errno(link, r, "Failed to get ICMP6 ratelimit from RA: %m");
 534
 535         /* We do not allow 0 here. */
 536         if (!timestamp_is_set(icmp6_ratelimit))
 537                 return 0;
 538
 539         msec = DIV_ROUND_UP(icmp6_ratelimit, USEC_PER_MSEC);
 540         if (msec <= 0 || msec > INT_MAX)
 541                 return 0;
 542
 543         /* Limit the maximal rates for sending ICMPv6 packets. 0 to disable any limiting, otherwise the
 544          * minimal space between responses in milliseconds. Default: 1000. */
 545         r = sysctl_write_ip_property_int(AF_INET6, NULL, "icmp/ratelimit", (int) msec);
 546         if (r < 0)
 547                 log_link_warning_errno(link, r, "Failed to apply ICMP6 ratelimit, ignoring: %m");
 548
 549         return 0;
 550 }
 551
 552 static int ndisc_router_process_reachable_time(Link *link, sd_ndisc_router *rt) {
 553         usec_t reachable_time, msec;
 554         int r;
 555
 556         assert(link);
 557         assert(link->network);
 558         assert(rt);
 559
 560         if (!link->network->ipv6_accept_ra_use_reachable_time)
 561                 return 0;
 562
 563         /* Ignore the reachable time field of the RA header if the lifetime is zero. */
 564         r = sd_ndisc_router_get_lifetime(rt, NULL);
 565         if (r <= 0)
 566                 return r;
 567
 568         r = sd_ndisc_router_get_reachable_time(rt, &reachable_time);
 569         if (r < 0)
 570                 return log_link_warning_errno(link, r, "Failed to get reachable time from RA: %m");
 571
 572         /* 0 is the unspecified value and must not be set (see RFC4861, 6.3.4) */
 573         if (!timestamp_is_set(reachable_time))
 574                 return 0;
 575
 576         msec = DIV_ROUND_UP(reachable_time, USEC_PER_MSEC);
 577         if (msec <= 0 || msec > UINT32_MAX) {
 578                 log_link_debug(link, "Failed to get reachable time from RA - out of range (%"PRIu64"), ignoring", msec);
 579                 return 0;
 580         }
 581
 582         /* Set the reachable time for Neighbor Solicitations. */
 583         r = sysctl_write_ip_neighbor_property_uint32(AF_INET6, link->ifname, "base_reachable_time_ms", (uint32_t) msec);
 584         if (r < 0)
 585                 log_link_warning_errno(link, r, "Failed to apply neighbor reachable time (%"PRIu64"), ignoring: %m", msec);
 586
 587         return 0;
 588 }
 589
 590 static int ndisc_router_process_retransmission_time(Link *link, sd_ndisc_router *rt) {
 591         usec_t retrans_time, msec;
 592         int r;
 593
 594         assert(link);
 595         assert(link->network);
 596         assert(rt);
 597
 598         if (!link->network->ipv6_accept_ra_use_retransmission_time)
 599                 return 0;
 600
 601         /* Ignore the retransmission time field of the RA header if the lifetime is zero. */
 602         r = sd_ndisc_router_get_lifetime(rt, NULL);
 603         if (r <= 0)
 604                 return r;
 605
 606         r = sd_ndisc_router_get_retransmission_time(rt, &retrans_time);
 607         if (r < 0)
 608                 return log_link_warning_errno(link, r, "Failed to get retransmission time from RA: %m");
 609
 610         /* 0 is the unspecified value and must not be set (see RFC4861, 6.3.4) */
 611         if (!timestamp_is_set(retrans_time))
 612                 return 0;
 613
 614         msec = DIV_ROUND_UP(retrans_time, USEC_PER_MSEC);
 615         if (msec <= 0 || msec > UINT32_MAX) {
 616                 log_link_debug(link, "Failed to get retransmission time from RA - out of range (%"PRIu64"), ignoring", msec);
 617                 return 0;
 618         }
 619
 620         /* Set the retransmission time for Neighbor Solicitations. */
 621         r = sysctl_write_ip_neighbor_property_uint32(AF_INET6, link->ifname, "retrans_time_ms", (uint32_t) msec);
 622         if (r < 0)
 623                 log_link_warning_errno(link, r, "Failed to apply neighbor retransmission time (%"PRIu64"), ignoring: %m", msec);
 624
 625         return 0;
 626 }
 627
 628 static int ndisc_router_process_hop_limit(Link *link, sd_ndisc_router *rt) {
 629         uint8_t hop_limit;
 630         int r;
 631
 632         assert(link);
 633         assert(link->network);
 634         assert(rt);
 635
 636         if (!link->network->ipv6_accept_ra_use_hop_limit)
 637                 return 0;
 638
 639         /* Ignore the hop limit field of the RA header if the lifetime is zero. */
 640         r = sd_ndisc_router_get_lifetime(rt, NULL);
 641         if (r <= 0)
 642                 return r;
 643
 644         r = sd_ndisc_router_get_hop_limit(rt, &hop_limit);
 645         if (r < 0)
 646                 return log_link_warning_errno(link, r, "Failed to get hop limit from RA: %m");
 647
 648         /* 0 is the unspecified value and must not be set (see RFC4861, 6.3.4):
 649          *
 650          * A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time, and Retrans Timer) may contain
 651          * a value denoting that it is unspecified. In such cases, the parameter should be ignored and the
 652          * host should continue using whatever value it is already using. In particular, a host MUST NOT
 653          * interpret the unspecified value as meaning change back to the default value that was in use before
 654          * the first Router Advertisement was received.
 655          *
 656          * If the received Cur Hop Limit value is non-zero, the host SHOULD set
 657          * its CurHopLimit variable to the received value.*/
 658         if (hop_limit <= 0)
 659                 return 0;
 660
 661         r = sysctl_write_ip_property_uint32(AF_INET6, link->ifname, "hop_limit", (uint32_t) hop_limit);
 662         if (r < 0)
 663                 log_link_warning_errno(link, r, "Failed to apply hop_limit (%u), ignoring: %m", hop_limit);
 664
 665         return 0;
 666 }
 667
 668 static int ndisc_router_process_autonomous_prefix(Link *link, sd_ndisc_router *rt) {
 669         usec_t lifetime_valid_usec, lifetime_preferred_usec;
 670         _cleanup_set_free_ Set *addresses = NULL;
 671         struct in6_addr prefix, *a;
 672         unsigned prefixlen;
 673         int r;
 674
 675         assert(link);
 676         assert(link->network);
 677         assert(rt);
 678
 679         if (!link->network->ipv6_accept_ra_use_autonomous_prefix)
 680                 return 0;
 681
 682         r = sd_ndisc_router_prefix_get_address(rt, &prefix);
 683         if (r < 0)
 684                 return log_link_warning_errno(link, r, "Failed to get prefix address: %m");
 685
 686         r = sd_ndisc_router_prefix_get_prefixlen(rt, &prefixlen);
 687         if (r < 0)
 688                 return log_link_warning_errno(link, r, "Failed to get prefix length: %m");
 689
 690         /* ndisc_generate_addresses() below requires the prefix length <= 64. */
 691         if (prefixlen > 64) {
 692                 log_link_debug(link, "Prefix is longer than 64, ignoring autonomous prefix %s.",
 693                                IN6_ADDR_PREFIX_TO_STRING(&prefix, prefixlen));
 694                 return 0;
 695         }
 696
 697         r = sd_ndisc_router_prefix_get_valid_lifetime_timestamp(rt, CLOCK_BOOTTIME, &lifetime_valid_usec);
 698         if (r < 0)
 699                 return log_link_warning_errno(link, r, "Failed to get prefix valid lifetime: %m");
 700
 701         r = sd_ndisc_router_prefix_get_preferred_lifetime_timestamp(rt, CLOCK_BOOTTIME, &lifetime_preferred_usec);
 702         if (r < 0)
 703                 return log_link_warning_errno(link, r, "Failed to get prefix preferred lifetime: %m");
 704
 705         /* The preferred lifetime is never greater than the valid lifetime */
 706         if (lifetime_preferred_usec > lifetime_valid_usec)
 707                 return 0;
 708
 709         r = ndisc_generate_addresses(link, &prefix, prefixlen, &addresses);
 710         if (r < 0)
 711                 return log_link_warning_errno(link, r, "Failed to generate SLAAC addresses: %m");
 712
 713         SET_FOREACH(a, addresses) {
 714                 _cleanup_(address_unrefp) Address *address = NULL;
 715
 716                 r = address_new(&address);
 717                 if (r < 0)
 718                         return log_oom();
 719
 720                 address->family = AF_INET6;
 721                 address->in_addr.in6 = *a;
 722                 address->prefixlen = prefixlen;
 723                 address->flags = IFA_F_NOPREFIXROUTE|IFA_F_MANAGETEMPADDR;
 724                 address->lifetime_valid_usec = lifetime_valid_usec;
 725                 address->lifetime_preferred_usec = lifetime_preferred_usec;
 726
 727                 /* draft-ietf-6man-slaac-renum-07 section 4.2
 728                  * https://datatracker.ietf.org/doc/html/draft-ietf-6man-slaac-renum-07#section-4.2
 729                  *
 730                  * If the advertised prefix is equal to the prefix of an address configured by stateless
 731                  * autoconfiguration in the list, the valid lifetime and the preferred lifetime of the
 732                  * address should be updated by processing the Valid Lifetime and the Preferred Lifetime
 733                  * (respectively) in the received advertisement. */
 734                 if (lifetime_valid_usec == 0) {
 735                         r = address_remove_and_cancel(address, link);
 736                         if (r < 0)
 737                                 return log_link_warning_errno(link, r, "Could not remove SLAAC address: %m");
 738                 } else {
 739                         r = ndisc_request_address(address, link, rt);
 740                         if (r < 0)
 741                                 return log_link_warning_errno(link, r, "Could not request SLAAC address: %m");
 742                 }
 743         }
 744
 745         return 0;
 746 }
 747
 748 static int ndisc_router_process_onlink_prefix(Link *link, sd_ndisc_router *rt) {
 749         _cleanup_(route_unrefp) Route *route = NULL;
 750         unsigned prefixlen, preference;
 751         usec_t lifetime_usec;
 752         struct in6_addr prefix;
 753         int r;
 754
 755         assert(link);
 756         assert(link->network);
 757         assert(rt);
 758
 759         if (!link->network->ipv6_accept_ra_use_onlink_prefix)
 760                 return 0;
 761
 762         r = sd_ndisc_router_prefix_get_valid_lifetime_timestamp(rt, CLOCK_BOOTTIME, &lifetime_usec);
 763         if (r < 0)
 764                 return log_link_warning_errno(link, r, "Failed to get prefix lifetime: %m");
 765
 766         r = sd_ndisc_router_prefix_get_address(rt, &prefix);
 767         if (r < 0)
 768                 return log_link_warning_errno(link, r, "Failed to get prefix address: %m");
 769
 770         r = sd_ndisc_router_prefix_get_prefixlen(rt, &prefixlen);
 771         if (r < 0)
 772                 return log_link_warning_errno(link, r, "Failed to get prefix length: %m");
 773
 774         /* Prefix Information option does not have preference, hence we use the 'main' preference here */
 775         r = sd_ndisc_router_get_preference(rt, &preference);
 776         if (r < 0)
 777                 return log_link_warning_errno(link, r, "Failed to get router preference from RA: %m");
 778
 779         r = route_new(&route);
 780         if (r < 0)
 781                 return log_oom();
 782
 783         route->family = AF_INET6;
 784         route->dst.in6 = prefix;
 785         route->dst_prefixlen = prefixlen;
 786         route->pref = preference;
 787         route->lifetime_usec = lifetime_usec;
 788
 789         r = ndisc_request_route(route, link, rt);
 790         if (r < 0)
 791                 return log_link_warning_errno(link, r, "Could not request prefix route: %m");
 792
 793         return 0;
 794 }
 795
 796 static int ndisc_router_drop_onlink_prefix(Link *link, sd_ndisc_router *rt) {
 797         _cleanup_(route_unrefp) Route *route = NULL;
 798         unsigned prefixlen;
 799         struct in6_addr prefix;
 800         usec_t lifetime_usec;
 801         int r;
 802
 803         assert(link);
 804         assert(link->network);
 805         assert(rt);
 806
 807         /* RFC 4861 section 6.3.4.
 808          * Note, however, that a Prefix Information option with the on-link flag set to zero conveys no
 809          * information concerning on-link determination and MUST NOT be interpreted to mean that addresses
 810          * covered by the prefix are off-link. The only way to cancel a previous on-link indication is to
 811          * advertise that prefix with the L-bit set and the Lifetime set to zero. */
 812
 813         if (!link->network->ipv6_accept_ra_use_onlink_prefix)
 814                 return 0;
 815
 816         r = sd_ndisc_router_prefix_get_valid_lifetime(rt, &lifetime_usec);
 817         if (r < 0)
 818                 return log_link_warning_errno(link, r, "Failed to get prefix lifetime: %m");
 819
 820         if (lifetime_usec != 0)
 821                 return 0;
 822
 823         r = sd_ndisc_router_prefix_get_address(rt, &prefix);
 824         if (r < 0)
 825                 return log_link_warning_errno(link, r, "Failed to get prefix address: %m");
 826
 827         r = sd_ndisc_router_prefix_get_prefixlen(rt, &prefixlen);
 828         if (r < 0)
 829                 return log_link_warning_errno(link, r, "Failed to get prefix length: %m");
 830
 831         r = route_new(&route);
 832         if (r < 0)
 833                 return log_oom();
 834
 835         route->family = AF_INET6;
 836         route->dst.in6 = prefix;
 837         route->dst_prefixlen = prefixlen;
 838
 839         r = ndisc_remove_route(route, link);
 840         if (r < 0)
 841                 return log_link_warning_errno(link, r, "Could not remove prefix route: %m");
 842
 843         return 0;
 844 }
 845
 846 static int ndisc_router_process_prefix(Link *link, sd_ndisc_router *rt) {
 847         unsigned prefixlen;
 848         struct in6_addr a;
 849         uint8_t flags;
 850         int r;
 851
 852         assert(link);
 853         assert(link->network);
 854         assert(rt);
 855
 856         r = sd_ndisc_router_prefix_get_address(rt, &a);
 857         if (r < 0)
 858                 return log_link_warning_errno(link, r, "Failed to get prefix address: %m");
 859
 860         /* RFC 4861 Section 4.6.2:
 861          * A router SHOULD NOT send a prefix option for the link-local prefix and a host SHOULD ignore such
 862          * a prefix option. */
 863         if (in6_addr_is_link_local(&a)) {
 864                 log_link_debug(link, "Received link-local prefix, ignoring prefix.");
 865                 return 0;
 866         }
 867
 868         r = sd_ndisc_router_prefix_get_prefixlen(rt, &prefixlen);
 869         if (r < 0)
 870                 return log_link_warning_errno(link, r, "Failed to get prefix length: %m");
 871
 872         if (in6_prefix_is_filtered(&a, prefixlen, link->network->ndisc_allow_listed_prefix, link->network->ndisc_deny_listed_prefix)) {
 873                 if (DEBUG_LOGGING)
 874                         log_link_debug(link, "Prefix '%s' is %s, ignoring",
 875                                        !set_isempty(link->network->ndisc_allow_listed_prefix) ? "not in allow list"
 876                                                                                               : "in deny list",
 877                                        IN6_ADDR_PREFIX_TO_STRING(&a, prefixlen));
 878                 return 0;
 879         }
 880
 881         r = sd_ndisc_router_prefix_get_flags(rt, &flags);
 882         if (r < 0)
 883                 return log_link_warning_errno(link, r, "Failed to get RA prefix flags: %m");
 884
 885         if (FLAGS_SET(flags, ND_OPT_PI_FLAG_ONLINK))
 886                 r = ndisc_router_process_onlink_prefix(link, rt);
 887         else
 888                 r = ndisc_router_drop_onlink_prefix(link, rt);
 889         if (r < 0)
 890                 return r;
 891
 892         if (FLAGS_SET(flags, ND_OPT_PI_FLAG_AUTO)) {
 893                 r = ndisc_router_process_autonomous_prefix(link, rt);
 894                 if (r < 0)
 895                         return r;
 896         }
 897
 898         return 0;
 899 }
 900
 901 static int ndisc_router_process_route(Link *link, sd_ndisc_router *rt) {
 902         _cleanup_(route_unrefp) Route *route = NULL;
 903         unsigned preference, prefixlen;
 904         struct in6_addr gateway, dst;
 905         usec_t lifetime_usec;
 906         int r;
 907
 908         assert(link);
 909
 910         if (!link->network->ipv6_accept_ra_use_route_prefix)
 911                 return 0;
 912
 913         r = sd_ndisc_router_route_get_lifetime_timestamp(rt, CLOCK_BOOTTIME, &lifetime_usec);
 914         if (r < 0)
 915                 return log_link_warning_errno(link, r, "Failed to get route lifetime from RA: %m");
 916
 917         r = sd_ndisc_router_route_get_address(rt, &dst);
 918         if (r < 0)
 919                 return log_link_warning_errno(link, r, "Failed to get route destination address: %m");
 920
 921         r = sd_ndisc_router_route_get_prefixlen(rt, &prefixlen);
 922         if (r < 0)
 923                 return log_link_warning_errno(link, r, "Failed to get route prefix length: %m");
 924
 925         if (in6_addr_is_null(&dst) && prefixlen == 0) {
 926                 log_link_debug(link, "Route prefix is ::/0, ignoring");
 927                 return 0;
 928         }
 929
 930         if (in6_prefix_is_filtered(&dst, prefixlen,
 931                                    link->network->ndisc_allow_listed_route_prefix,
 932                                    link->network->ndisc_deny_listed_route_prefix)) {
 933
 934                 if (DEBUG_LOGGING)
 935                         log_link_debug(link, "Route prefix %s is %s, ignoring",
 936                                        !set_isempty(link->network->ndisc_allow_listed_route_prefix) ? "not in allow list"
 937                                                                                                     : "in deny list",
 938                                        IN6_ADDR_PREFIX_TO_STRING(&dst, prefixlen));
 939                 return 0;
 940         }
 941
 942         r = sd_ndisc_router_get_address(rt, &gateway);
 943         if (r < 0)
 944                 return log_link_warning_errno(link, r, "Failed to get gateway address from RA: %m");
 945
 946         if (link_get_ipv6_address(link, &gateway, 0, NULL) >= 0) {
 947                 if (DEBUG_LOGGING)
 948                         log_link_debug(link, "Advertised route gateway %s is local to the link, ignoring route",
 949                                        IN6_ADDR_TO_STRING(&gateway));
 950                 return 0;
 951         }
 952
 953         r = sd_ndisc_router_route_get_preference(rt, &preference);
 954         if (r == -EOPNOTSUPP) {
 955                 log_link_debug_errno(link, r, "Received route prefix with unsupported preference, ignoring: %m");
 956                 return 0;
 957         }
 958         if (r < 0)
 959                 return log_link_warning_errno(link, r, "Failed to get router preference from RA: %m");
 960
 961         r = route_new(&route);
 962         if (r < 0)
 963                 return log_oom();
 964
 965         route->family = AF_INET6;
 966         route->pref = preference;
 967         route->nexthop.gw.in6 = gateway;
 968         route->nexthop.family = AF_INET6;
 969         route->dst.in6 = dst;
 970         route->dst_prefixlen = prefixlen;
 971         route->lifetime_usec = lifetime_usec;
 972
 973         r = ndisc_request_route(route, link, rt);
 974         if (r < 0)
 975                 return log_link_warning_errno(link, r, "Could not request additional route: %m");
 976
 977         return 0;
 978 }
 979
 980 static void ndisc_rdnss_hash_func(const NDiscRDNSS *x, struct siphash *state) {
 981         siphash24_compress_typesafe(x->address, state);
 982 }
 983
 984 static int ndisc_rdnss_compare_func(const NDiscRDNSS *a, const NDiscRDNSS *b) {
 985         return memcmp(&a->address, &b->address, sizeof(a->address));
 986 }
 987
 988 DEFINE_PRIVATE_HASH_OPS_WITH_KEY_DESTRUCTOR(
 989                 ndisc_rdnss_hash_ops,
 990                 NDiscRDNSS,
 991                 ndisc_rdnss_hash_func,
 992                 ndisc_rdnss_compare_func,
 993                 free);
 994
 995 static int ndisc_router_process_rdnss(Link *link, sd_ndisc_router *rt) {
 996         usec_t lifetime_usec;
 997         const struct in6_addr *a;
 998         struct in6_addr router;
 999         bool updated = false, logged_about_too_many = false;
1000         int n, r;
1001
1002         assert(link);
1003         assert(link->network);
1004         assert(rt);
1005
1006         if (!link->network->ipv6_accept_ra_use_dns)
1007                 return 0;
1008
1009         r = sd_ndisc_router_get_address(rt, &router);
1010         if (r < 0)
1011                 return log_link_warning_errno(link, r, "Failed to get router address from RA: %m");
1012
1013         r = sd_ndisc_router_rdnss_get_lifetime_timestamp(rt, CLOCK_BOOTTIME, &lifetime_usec);
1014         if (r < 0)
1015                 return log_link_warning_errno(link, r, "Failed to get RDNSS lifetime: %m");
1016
1017         n = sd_ndisc_router_rdnss_get_addresses(rt, &a);
1018         if (n < 0)
1019                 return log_link_warning_errno(link, n, "Failed to get RDNSS addresses: %m");
1020
1021         for (int j = 0; j < n; j++) {
1022                 _cleanup_free_ NDiscRDNSS *x = NULL;
1023                 NDiscRDNSS *rdnss, d = {
1024                         .address = a[j],
1025                 };
1026
1027                 if (lifetime_usec == 0) {
1028                         /* The entry is outdated. */
1029                         free(set_remove(link->ndisc_rdnss, &d));
1030                         updated = true;
1031                         continue;
1032                 }
1033
1034                 rdnss = set_get(link->ndisc_rdnss, &d);
1035                 if (rdnss) {
1036                         rdnss->router = router;
1037                         rdnss->lifetime_usec = lifetime_usec;
1038                         continue;
1039                 }
1040
1041                 if (set_size(link->ndisc_rdnss) >= NDISC_RDNSS_MAX) {
1042                         if (!logged_about_too_many)
1043                                 log_link_warning(link, "Too many RDNSS records per link. Only first %u records will be used.", NDISC_RDNSS_MAX);
1044                         logged_about_too_many = true;
1045                         continue;
1046                 }
1047
1048                 x = new(NDiscRDNSS, 1);
1049                 if (!x)
1050                         return log_oom();
1051
1052                 *x = (NDiscRDNSS) {
1053                         .address = a[j],
1054                         .router = router,
1055                         .lifetime_usec = lifetime_usec,
1056                 };
1057
1058                 r = set_ensure_consume(&link->ndisc_rdnss, &ndisc_rdnss_hash_ops, TAKE_PTR(x));
1059                 if (r < 0)
1060                         return log_oom();
1061                 assert(r > 0);
1062
1063                 updated = true;
1064         }
1065
1066         if (updated)
1067                 link_dirty(link);
1068
1069         return 0;
1070 }
1071
1072 static void ndisc_dnssl_hash_func(const NDiscDNSSL *x, struct siphash *state) {
1073         siphash24_compress_string(NDISC_DNSSL_DOMAIN(x), state);
1074 }
1075
1076 static int ndisc_dnssl_compare_func(const NDiscDNSSL *a, const NDiscDNSSL *b) {
1077         return strcmp(NDISC_DNSSL_DOMAIN(a), NDISC_DNSSL_DOMAIN(b));
1078 }
1079
1080 DEFINE_PRIVATE_HASH_OPS_WITH_KEY_DESTRUCTOR(
1081                 ndisc_dnssl_hash_ops,
1082                 NDiscDNSSL,
1083                 ndisc_dnssl_hash_func,
1084                 ndisc_dnssl_compare_func,
1085                 free);
1086
1087 static int ndisc_router_process_dnssl(Link *link, sd_ndisc_router *rt) {
1088         _cleanup_strv_free_ char **l = NULL;
1089         usec_t lifetime_usec;
1090         struct in6_addr router;
1091         bool updated = false, logged_about_too_many = false;
1092         int r;
1093
1094         assert(link);
1095         assert(link->network);
1096         assert(rt);
1097
1098         if (link->network->ipv6_accept_ra_use_domains == DHCP_USE_DOMAINS_NO)
1099                 return 0;
1100
1101         r = sd_ndisc_router_get_address(rt, &router);
1102         if (r < 0)
1103                 return log_link_warning_errno(link, r, "Failed to get router address from RA: %m");
1104
1105         r = sd_ndisc_router_dnssl_get_lifetime_timestamp(rt, CLOCK_BOOTTIME, &lifetime_usec);
1106         if (r < 0)
1107                 return log_link_warning_errno(link, r, "Failed to get DNSSL lifetime: %m");
1108
1109         r = sd_ndisc_router_dnssl_get_domains(rt, &l);
1110         if (r < 0)
1111                 return log_link_warning_errno(link, r, "Failed to get DNSSL addresses: %m");
1112
1113         STRV_FOREACH(j, l) {
1114                 _cleanup_free_ NDiscDNSSL *s = NULL;
1115                 NDiscDNSSL *dnssl;
1116
1117                 s = malloc0(ALIGN(sizeof(NDiscDNSSL)) + strlen(*j) + 1);
1118                 if (!s)
1119                         return log_oom();
1120
1121                 strcpy(NDISC_DNSSL_DOMAIN(s), *j);
1122
1123                 if (lifetime_usec == 0) {
1124                         /* The entry is outdated. */
1125                         free(set_remove(link->ndisc_dnssl, s));
1126                         updated = true;
1127                         continue;
1128                 }
1129
1130                 dnssl = set_get(link->ndisc_dnssl, s);
1131                 if (dnssl) {
1132                         dnssl->router = router;
1133                         dnssl->lifetime_usec = lifetime_usec;
1134                         continue;
1135                 }
1136
1137                 if (set_size(link->ndisc_dnssl) >= NDISC_DNSSL_MAX) {
1138                         if (!logged_about_too_many)
1139                                 log_link_warning(link, "Too many DNSSL records per link. Only first %u records will be used.", NDISC_DNSSL_MAX);
1140                         logged_about_too_many = true;
1141                         continue;
1142                 }
1143
1144                 s->router = router;
1145                 s->lifetime_usec = lifetime_usec;
1146
1147                 r = set_ensure_consume(&link->ndisc_dnssl, &ndisc_dnssl_hash_ops, TAKE_PTR(s));
1148                 if (r < 0)
1149                         return log_oom();
1150                 assert(r > 0);
1151
1152                 updated = true;
1153         }
1154
1155         if (updated)
1156                 link_dirty(link);
1157
1158         return 0;
1159 }
1160
1161 static NDiscCaptivePortal* ndisc_captive_portal_free(NDiscCaptivePortal *x) {
1162         if (!x)
1163                 return NULL;
1164
1165         free(x->captive_portal);
1166         return mfree(x);
1167 }
1168
1169 DEFINE_TRIVIAL_CLEANUP_FUNC(NDiscCaptivePortal*, ndisc_captive_portal_free);
1170
1171 static void ndisc_captive_portal_hash_func(const NDiscCaptivePortal *x, struct siphash *state) {
1172         assert(x);
1173         siphash24_compress_string(x->captive_portal, state);
1174 }
1175
1176 static int ndisc_captive_portal_compare_func(const NDiscCaptivePortal *a, const NDiscCaptivePortal *b) {
1177         assert(a);
1178         assert(b);
1179         return strcmp_ptr(a->captive_portal, b->captive_portal);
1180 }
1181
1182 DEFINE_PRIVATE_HASH_OPS_WITH_KEY_DESTRUCTOR(
1183                 ndisc_captive_portal_hash_ops,
1184                 NDiscCaptivePortal,
1185                 ndisc_captive_portal_hash_func,
1186                 ndisc_captive_portal_compare_func,
1187                 ndisc_captive_portal_free);
1188
1189 static int ndisc_router_process_captive_portal(Link *link, sd_ndisc_router *rt) {
1190         _cleanup_(ndisc_captive_portal_freep) NDiscCaptivePortal *new_entry = NULL;
1191         _cleanup_free_ char *captive_portal = NULL;
1192         usec_t lifetime_usec;
1193         NDiscCaptivePortal *exist;
1194         struct in6_addr router;
1195         const char *uri;
1196         size_t len;
1197         int r;
1198
1199         assert(link);
1200         assert(link->network);
1201         assert(rt);
1202
1203         if (!link->network->ipv6_accept_ra_use_captive_portal)
1204                 return 0;
1205
1206         r = sd_ndisc_router_get_address(rt, &router);
1207         if (r < 0)
1208                 return log_link_warning_errno(link, r, "Failed to get router address from RA: %m");
1209
1210         /* RFC 4861 section 4.2. states that the lifetime in the message header should be used only for the
1211          * default gateway, but the captive portal option does not have a lifetime field, hence, we use the
1212          * main lifetime for the portal. */
1213         r = sd_ndisc_router_get_lifetime_timestamp(rt, CLOCK_BOOTTIME, &lifetime_usec);
1214         if (r < 0)
1215                 return log_link_warning_errno(link, r, "Failed to get lifetime of RA message: %m");
1216
1217         r = sd_ndisc_router_captive_portal_get_uri(rt, &uri, &len);
1218         if (r < 0)
1219                 return log_link_warning_errno(link, r, "Failed to get captive portal from RA: %m");
1220
1221         if (len == 0)
1222                 return log_link_warning_errno(link, SYNTHETIC_ERRNO(EBADMSG), "Received empty captive portal, ignoring.");
1223
1224         r = make_cstring(uri, len, MAKE_CSTRING_REFUSE_TRAILING_NUL, &captive_portal);
1225         if (r < 0)
1226                 return log_link_warning_errno(link, r, "Failed to convert captive portal URI: %m");
1227
1228         if (!in_charset(captive_portal, URI_VALID))
1229                 return log_link_warning_errno(link, SYNTHETIC_ERRNO(EBADMSG), "Received invalid captive portal, ignoring.");
1230
1231         if (lifetime_usec == 0) {
1232                 /* Drop the portal with zero lifetime. */
1233                 ndisc_captive_portal_free(set_remove(link->ndisc_captive_portals,
1234                                                      &(NDiscCaptivePortal) {
1235                                                              .captive_portal = captive_portal,
1236                                                      }));
1237                 return 0;
1238         }
1239
1240         exist = set_get(link->ndisc_captive_portals,
1241                         &(NDiscCaptivePortal) {
1242                                 .captive_portal = captive_portal,
1243                         });
1244         if (exist) {
1245                 /* update existing entry */
1246                 exist->router = router;
1247                 exist->lifetime_usec = lifetime_usec;
1248                 return 1;
1249         }
1250
1251         if (set_size(link->ndisc_captive_portals) >= NDISC_CAPTIVE_PORTAL_MAX) {
1252                 NDiscCaptivePortal *c, *target = NULL;
1253
1254                 /* Find the portal who has the minimal lifetime and drop it to store new one. */
1255                 SET_FOREACH(c, link->ndisc_captive_portals)
1256                         if (!target || c->lifetime_usec < target->lifetime_usec)
1257                                 target = c;
1258
1259                 assert(target);
1260                 assert(set_remove(link->ndisc_captive_portals, target) == target);
1261                 ndisc_captive_portal_free(target);
1262         }
1263
1264         new_entry = new(NDiscCaptivePortal, 1);
1265         if (!new_entry)
1266                 return log_oom();
1267
1268         *new_entry = (NDiscCaptivePortal) {
1269                 .router = router,
1270                 .lifetime_usec = lifetime_usec,
1271                 .captive_portal = TAKE_PTR(captive_portal),
1272         };
1273
1274         r = set_ensure_put(&link->ndisc_captive_portals, &ndisc_captive_portal_hash_ops, new_entry);
1275         if (r < 0)
1276                 return log_oom();
1277         assert(r > 0);
1278         TAKE_PTR(new_entry);
1279
1280         link_dirty(link);
1281         return 1;
1282 }
1283
1284 static void ndisc_pref64_hash_func(const NDiscPREF64 *x, struct siphash *state) {
1285         assert(x);
1286
1287         siphash24_compress_typesafe(x->prefix_len, state);
1288         siphash24_compress_typesafe(x->prefix, state);
1289 }
1290
1291 static int ndisc_pref64_compare_func(const NDiscPREF64 *a, const NDiscPREF64 *b) {
1292         int r;
1293
1294         assert(a);
1295         assert(b);
1296
1297         r = CMP(a->prefix_len, b->prefix_len);
1298         if (r != 0)
1299                 return r;
1300
1301         return memcmp(&a->prefix, &b->prefix, sizeof(a->prefix));
1302 }
1303
1304 DEFINE_PRIVATE_HASH_OPS_WITH_KEY_DESTRUCTOR(
1305                 ndisc_pref64_hash_ops,
1306                 NDiscPREF64,
1307                 ndisc_pref64_hash_func,
1308                 ndisc_pref64_compare_func,
1309                 mfree);
1310
1311 static int ndisc_router_process_pref64(Link *link, sd_ndisc_router *rt) {
1312         _cleanup_free_ NDiscPREF64 *new_entry = NULL;
1313         usec_t lifetime_usec;
1314         struct in6_addr a, router;
1315         unsigned prefix_len;
1316         NDiscPREF64 *exist;
1317         int r;
1318
1319         assert(link);
1320         assert(link->network);
1321         assert(rt);
1322
1323         if (!link->network->ipv6_accept_ra_use_pref64)
1324                 return 0;
1325
1326         r = sd_ndisc_router_get_address(rt, &router);
1327         if (r < 0)
1328                 return log_link_warning_errno(link, r, "Failed to get router address from RA: %m");
1329
1330         r = sd_ndisc_router_prefix64_get_prefix(rt, &a);
1331         if (r < 0)
1332                 return log_link_warning_errno(link, r, "Failed to get pref64 prefix: %m");
1333
1334         r = sd_ndisc_router_prefix64_get_prefixlen(rt, &prefix_len);
1335         if (r < 0)
1336                 return log_link_warning_errno(link, r, "Failed to get pref64 prefix length: %m");
1337
1338         r = sd_ndisc_router_prefix64_get_lifetime_timestamp(rt, CLOCK_BOOTTIME, &lifetime_usec);
1339         if (r < 0)
1340                 return log_link_warning_errno(link, r, "Failed to get pref64 prefix lifetime: %m");
1341
1342         if (lifetime_usec == 0) {
1343                 free(set_remove(link->ndisc_pref64,
1344                                 &(NDiscPREF64) {
1345                                         .prefix = a,
1346                                         .prefix_len = prefix_len
1347                                 }));
1348                 return 0;
1349         }
1350
1351         exist = set_get(link->ndisc_pref64,
1352                         &(NDiscPREF64) {
1353                                 .prefix = a,
1354                                 .prefix_len = prefix_len
1355                 });
1356         if (exist) {
1357                 /* update existing entry */
1358                 exist->router = router;
1359                 exist->lifetime_usec = lifetime_usec;
1360                 return 0;
1361         }
1362
1363         if (set_size(link->ndisc_pref64) >= NDISC_PREF64_MAX) {
1364                 log_link_debug(link, "Too many PREF64 records received. Only first %u records will be used.", NDISC_PREF64_MAX);
1365                 return 0;
1366         }
1367
1368         new_entry = new(NDiscPREF64, 1);
1369         if (!new_entry)
1370                 return log_oom();
1371
1372         *new_entry = (NDiscPREF64) {
1373                 .router = router,
1374                 .lifetime_usec = lifetime_usec,
1375                 .prefix = a,
1376                 .prefix_len = prefix_len,
1377         };
1378
1379         r = set_ensure_put(&link->ndisc_pref64, &ndisc_pref64_hash_ops, new_entry);
1380         if (r < 0)
1381                 return log_oom();
1382
1383         assert(r > 0);
1384         TAKE_PTR(new_entry);
1385
1386         return 0;
1387 }
1388
1389 static int ndisc_router_process_options(Link *link, sd_ndisc_router *rt) {
1390         size_t n_captive_portal = 0;
1391         int r;
1392
1393         assert(link);
1394         assert(link->network);
1395         assert(rt);
1396
1397         for (r = sd_ndisc_router_option_rewind(rt); ; r = sd_ndisc_router_option_next(rt)) {
1398                 uint8_t type;
1399
1400                 if (r < 0)
1401                         return log_link_warning_errno(link, r, "Failed to iterate through options: %m");
1402                 if (r == 0) /* EOF */
1403                         return 0;
1404
1405                 r = sd_ndisc_router_option_get_type(rt, &type);
1406                 if (r < 0)
1407                         return log_link_warning_errno(link, r, "Failed to get RA option type: %m");
1408
1409                 switch (type) {
1410                 case SD_NDISC_OPTION_PREFIX_INFORMATION:
1411                         r = ndisc_router_process_prefix(link, rt);
1412                         break;
1413
1414                 case SD_NDISC_OPTION_ROUTE_INFORMATION:
1415                         r = ndisc_router_process_route(link, rt);
1416                         break;
1417
1418                 case SD_NDISC_OPTION_RDNSS:
1419                         r = ndisc_router_process_rdnss(link, rt);
1420                         break;
1421
1422                 case SD_NDISC_OPTION_DNSSL:
1423                         r = ndisc_router_process_dnssl(link, rt);
1424                         break;
1425                 case SD_NDISC_OPTION_CAPTIVE_PORTAL:
1426                         if (n_captive_portal > 0) {
1427                                 if (n_captive_portal == 1)
1428                                         log_link_notice(link, "Received RA with multiple captive portals, only using the first one.");
1429
1430                                 n_captive_portal++;
1431                                 continue;
1432                         }
1433                         r = ndisc_router_process_captive_portal(link, rt);
1434                         if (r > 0)
1435                                 n_captive_portal++;
1436                         break;
1437                 case SD_NDISC_OPTION_PREF64:
1438                         r = ndisc_router_process_pref64(link, rt);
1439                         break;
1440                 }
1441                 if (r < 0 && r != -EBADMSG)
1442                         return r;
1443         }
1444 }
1445
1446 static int ndisc_drop_outdated(Link *link, usec_t timestamp_usec) {
1447         bool updated = false;
1448         NDiscDNSSL *dnssl;
1449         NDiscRDNSS *rdnss;
1450         NDiscCaptivePortal *cp;
1451         NDiscPREF64 *p64;
1452         Address *address;
1453         Route *route;
1454         int r, ret = 0;
1455
1456         assert(link);
1457         assert(link->manager);
1458
1459         /* If an address or friends is already assigned, but not valid anymore, then refuse to update it,
1460          * and let's immediately remove it.
1461          * See RFC4862, section 5.5.3.e. But the following logic is deviated from RFC4862 by honoring all
1462          * valid lifetimes to improve the reaction of SLAAC to renumbering events.
1463          * See draft-ietf-6man-slaac-renum-02, section 4.2. */
1464
1465         SET_FOREACH(route, link->manager->routes) {
1466                 if (route->source != NETWORK_CONFIG_SOURCE_NDISC)
1467                         continue;
1468
1469                 if (route->nexthop.ifindex != link->ifindex)
1470                         continue;
1471
1472                 if (route->lifetime_usec >= timestamp_usec)
1473                         continue; /* the route is still valid */
1474
1475                 r = route_remove_and_cancel(route, link->manager);
1476                 if (r < 0)
1477                         RET_GATHER(ret, log_link_warning_errno(link, r, "Failed to remove outdated SLAAC route, ignoring: %m"));
1478         }
1479
1480         SET_FOREACH(address, link->addresses) {
1481                 if (address->source != NETWORK_CONFIG_SOURCE_NDISC)
1482                         continue;
1483
1484                 if (address->lifetime_valid_usec >= timestamp_usec)
1485                         continue; /* the address is still valid */
1486
1487                 r = address_remove_and_cancel(address, link);
1488                 if (r < 0)
1489                         RET_GATHER(ret, log_link_warning_errno(link, r, "Failed to remove outdated SLAAC address, ignoring: %m"));
1490         }
1491
1492         SET_FOREACH(rdnss, link->ndisc_rdnss) {
1493                 if (rdnss->lifetime_usec >= timestamp_usec)
1494                         continue; /* the DNS server is still valid */
1495
1496                 free(set_remove(link->ndisc_rdnss, rdnss));
1497                 updated = true;
1498         }
1499
1500         SET_FOREACH(dnssl, link->ndisc_dnssl) {
1501                 if (dnssl->lifetime_usec >= timestamp_usec)
1502                         continue; /* the DNS domain is still valid */
1503
1504                 free(set_remove(link->ndisc_dnssl, dnssl));
1505                 updated = true;
1506         }
1507
1508         SET_FOREACH(cp, link->ndisc_captive_portals) {
1509                 if (cp->lifetime_usec >= timestamp_usec)
1510                         continue; /* the captive portal is still valid */
1511
1512                 ndisc_captive_portal_free(set_remove(link->ndisc_captive_portals, cp));
1513                 updated = true;
1514         }
1515
1516         SET_FOREACH(p64, link->ndisc_pref64) {
1517                 if (p64->lifetime_usec >= timestamp_usec)
1518                         continue; /* the pref64 prefix is still valid */
1519
1520                 free(set_remove(link->ndisc_pref64, p64));
1521                 /* The pref64 prefix is not exported through the state file, hence it is not necessary to set
1522                  * the 'updated' flag. */
1523         }
1524
1525         if (updated)
1526                 link_dirty(link);
1527
1528         return ret;
1529 }
1530
1531 static int ndisc_setup_expire(Link *link);
1532
1533 static int ndisc_expire_handler(sd_event_source *s, uint64_t usec, void *userdata) {
1534         Link *link = ASSERT_PTR(userdata);
1535         usec_t now_usec;
1536
1537         assert(link->manager);
1538
1539         assert_se(sd_event_now(link->manager->event, CLOCK_BOOTTIME, &now_usec) >= 0);
1540
1541         (void) ndisc_drop_outdated(link, now_usec);
1542         (void) ndisc_setup_expire(link);
1543         return 0;
1544 }
1545
1546 static int ndisc_setup_expire(Link *link) {
1547         usec_t lifetime_usec = USEC_INFINITY;
1548         NDiscCaptivePortal *cp;
1549         NDiscDNSSL *dnssl;
1550         NDiscRDNSS *rdnss;
1551         NDiscPREF64 *p64;
1552         Address *address;
1553         Route *route;
1554         int r;
1555
1556         assert(link);
1557         assert(link->manager);
1558
1559         SET_FOREACH(route, link->manager->routes) {
1560                 if (route->source != NETWORK_CONFIG_SOURCE_NDISC)
1561                         continue;
1562
1563                 if (route->nexthop.ifindex != link->ifindex)
1564                         continue;
1565
1566                 if (!route_exists(route))
1567                         continue;
1568
1569                 lifetime_usec = MIN(lifetime_usec, route->lifetime_usec);
1570         }
1571
1572         SET_FOREACH(address, link->addresses) {
1573                 if (address->source != NETWORK_CONFIG_SOURCE_NDISC)
1574                         continue;
1575
1576                 if (!address_exists(address))
1577                         continue;
1578
1579                 lifetime_usec = MIN(lifetime_usec, address->lifetime_valid_usec);
1580         }
1581
1582         SET_FOREACH(rdnss, link->ndisc_rdnss)
1583                 lifetime_usec = MIN(lifetime_usec, rdnss->lifetime_usec);
1584
1585         SET_FOREACH(dnssl, link->ndisc_dnssl)
1586                 lifetime_usec = MIN(lifetime_usec, dnssl->lifetime_usec);
1587
1588         SET_FOREACH(cp, link->ndisc_captive_portals)
1589                 lifetime_usec = MIN(lifetime_usec, cp->lifetime_usec);
1590
1591         SET_FOREACH(p64, link->ndisc_pref64)
1592                 lifetime_usec = MIN(lifetime_usec, p64->lifetime_usec);
1593
1594         if (lifetime_usec == USEC_INFINITY)
1595                 return 0;
1596
1597         r = event_reset_time(link->manager->event, &link->ndisc_expire, CLOCK_BOOTTIME,
1598                              lifetime_usec, 0, ndisc_expire_handler, link, 0, "ndisc-expiration", true);
1599         if (r < 0)
1600                 return log_link_warning_errno(link, r, "Failed to update expiration timer for ndisc: %m");
1601
1602         return 0;
1603 }
1604
1605 static int ndisc_start_dhcp6_client(Link *link, sd_ndisc_router *rt) {
1606         int r;
1607
1608         assert(link);
1609         assert(link->network);
1610
1611         /* Do not start DHCPv6 client if the router lifetime is zero, as the message sent as a signal of
1612          * that the router is e.g. shutting down, revoked, etc,. */
1613         r = sd_ndisc_router_get_lifetime(rt, NULL);
1614         if (r <= 0)
1615                 return r;
1616
1617         switch (link->network->ipv6_accept_ra_start_dhcp6_client) {
1618         case IPV6_ACCEPT_RA_START_DHCP6_CLIENT_NO:
1619                 return 0;
1620
1621         case IPV6_ACCEPT_RA_START_DHCP6_CLIENT_YES: {
1622                 uint64_t flags;
1623
1624                 r = sd_ndisc_router_get_flags(rt, &flags);
1625                 if (r < 0)
1626                         return log_link_warning_errno(link, r, "Failed to get RA flags: %m");
1627
1628                 if ((flags & (ND_RA_FLAG_MANAGED | ND_RA_FLAG_OTHER)) == 0)
1629                         return 0;
1630
1631                 /* (re)start DHCPv6 client in stateful or stateless mode according to RA flags.
1632                  * Note, if both "managed" and "other configuration" bits are set, then ignore
1633                  * "other configuration" bit. See RFC 4861. */
1634                 r = dhcp6_start_on_ra(link, !(flags & ND_RA_FLAG_MANAGED));
1635                 break;
1636         }
1637         case IPV6_ACCEPT_RA_START_DHCP6_CLIENT_ALWAYS:
1638                 /* When IPv6AcceptRA.DHCPv6Client=always, start dhcp6 client in solicit mode
1639                  * even if the router flags have neither M nor O flags. */
1640                 r = dhcp6_start_on_ra(link, /* information_request = */ false);
1641                 break;
1642
1643         default:
1644                 assert_not_reached();
1645         }
1646
1647         if (r < 0)
1648                 return log_link_warning_errno(link, r, "Could not acquire DHCPv6 lease on NDisc request: %m");
1649
1650         log_link_debug(link, "Acquiring DHCPv6 lease on NDisc request");
1651         return 0;
1652 }
1653
1654 static int ndisc_router_handler(Link *link, sd_ndisc_router *rt) {
1655         struct in6_addr router;
1656         usec_t timestamp_usec;
1657         int r;
1658
1659         assert(link);
1660         assert(link->network);
1661         assert(link->manager);
1662         assert(rt);
1663
1664         r = sd_ndisc_router_get_address(rt, &router);
1665         if (r == -ENODATA) {
1666                 log_link_debug(link, "Received RA without router address, ignoring.");
1667                 return 0;
1668         }
1669         if (r < 0)
1670                 return log_link_warning_errno(link, r, "Failed to get router address from RA: %m");
1671
1672         if (in6_prefix_is_filtered(&router, 128, link->network->ndisc_allow_listed_router, link->network->ndisc_deny_listed_router)) {
1673                 if (DEBUG_LOGGING) {
1674                         if (!set_isempty(link->network->ndisc_allow_listed_router))
1675                                 log_link_debug(link, "Router %s is not in allow list, ignoring.", IN6_ADDR_TO_STRING(&router));
1676                         else
1677                                 log_link_debug(link, "Router %s is in deny list, ignoring.", IN6_ADDR_TO_STRING(&router));
1678                 }
1679                 return 0;
1680         }
1681
1682         r = sd_ndisc_router_get_timestamp(rt, CLOCK_BOOTTIME, &timestamp_usec);
1683         if (r == -ENODATA) {
1684                 log_link_debug(link, "Received RA without timestamp, ignoring.");
1685                 return 0;
1686         }
1687         if (r < 0)
1688                 return r;
1689
1690         r = ndisc_drop_outdated(link, timestamp_usec);
1691         if (r < 0)
1692                 return r;
1693
1694         r = ndisc_start_dhcp6_client(link, rt);
1695         if (r < 0)
1696                 return r;
1697
1698         r = ndisc_router_process_default(link, rt);
1699         if (r < 0)
1700                 return r;
1701
1702         r = ndisc_router_process_icmp6_ratelimit(link, rt);
1703         if (r < 0)
1704                 return r;
1705
1706         r = ndisc_router_process_reachable_time(link, rt);
1707         if (r < 0)
1708                 return r;
1709
1710         r = ndisc_router_process_retransmission_time(link, rt);
1711         if (r < 0)
1712                 return r;
1713
1714         r = ndisc_router_process_hop_limit(link, rt);
1715         if (r < 0)
1716                 return r;
1717
1718         r = ndisc_router_process_options(link, rt);
1719         if (r < 0)
1720                 return r;
1721
1722         r = ndisc_setup_expire(link);
1723         if (r < 0)
1724                 return r;
1725
1726         if (link->ndisc_messages == 0)
1727                 link->ndisc_configured = true;
1728         else
1729                 log_link_debug(link, "Setting SLAAC addresses and router.");
1730
1731         if (!link->ndisc_configured)
1732                 link_set_state(link, LINK_STATE_CONFIGURING);
1733
1734         link_check_ready(link);
1735         return 0;
1736 }
1737
1738 static void ndisc_handler(sd_ndisc *nd, sd_ndisc_event_t event, sd_ndisc_router *rt, void *userdata) {
1739         Link *link = ASSERT_PTR(userdata);
1740         int r;
1741
1742         if (IN_SET(link->state, LINK_STATE_FAILED, LINK_STATE_LINGER))
1743                 return;
1744
1745         switch (event) {
1746
1747         case SD_NDISC_EVENT_ROUTER:
1748                 r = ndisc_router_handler(link, rt);
1749                 if (r < 0 && r != -EBADMSG) {
1750                         link_enter_failed(link);
1751                         return;
1752                 }
1753                 break;
1754
1755         case SD_NDISC_EVENT_TIMEOUT:
1756                 log_link_debug(link, "NDisc handler get timeout event");
1757                 if (link->ndisc_messages == 0) {
1758                         link->ndisc_configured = true;
1759                         link_check_ready(link);
1760                 }
1761                 break;
1762         default:
1763                 assert_not_reached();
1764         }
1765 }
1766
1767 static int ndisc_configure(Link *link) {
1768         int r;
1769
1770         assert(link);
1771
1772         if (!link_ipv6_accept_ra_enabled(link))
1773                 return 0;
1774
1775         if (link->ndisc)
1776                 return -EBUSY; /* Already configured. */
1777
1778         r = sd_ndisc_new(&link->ndisc);
1779         if (r < 0)
1780                 return r;
1781
1782         r = sd_ndisc_attach_event(link->ndisc, link->manager->event, 0);
1783         if (r < 0)
1784                 return r;
1785
1786         if (link->hw_addr.length == ETH_ALEN) {
1787                 r = sd_ndisc_set_mac(link->ndisc, &link->hw_addr.ether);
1788                 if (r < 0)
1789                         return r;
1790         }
1791
1792         r = sd_ndisc_set_ifindex(link->ndisc, link->ifindex);
1793         if (r < 0)
1794                 return r;
1795
1796         r = sd_ndisc_set_callback(link->ndisc, ndisc_handler, link);
1797         if (r < 0)
1798                 return r;
1799
1800         return 0;
1801 }
1802
1803 int ndisc_start(Link *link) {
1804         int r;
1805
1806         assert(link);
1807
1808         if (!link->ndisc || !link->dhcp6_client)
1809                 return 0;
1810
1811         if (!link_has_carrier(link))
1812                 return 0;
1813
1814         if (in6_addr_is_null(&link->ipv6ll_address))
1815                 return 0;
1816
1817         log_link_debug(link, "Discovering IPv6 routers");
1818
1819         r = sd_ndisc_start(link->ndisc);
1820         if (r < 0)
1821                 return r;
1822
1823         return 1;
1824 }
1825
1826 static int ndisc_process_request(Request *req, Link *link, void *userdata) {
1827         int r;
1828
1829         assert(link);
1830
1831         if (!link_is_ready_to_configure(link, /* allow_unmanaged = */ false))
1832                 return 0;
1833
1834         r = ndisc_configure(link);
1835         if (r < 0)
1836                 return log_link_warning_errno(link, r, "Failed to configure IPv6 Router Discovery: %m");
1837
1838         r = ndisc_start(link);
1839         if (r < 0)
1840                 return log_link_warning_errno(link, r, "Failed to start IPv6 Router Discovery: %m");
1841
1842         log_link_debug(link, "IPv6 Router Discovery is configured%s.",
1843                        r > 0 ? " and started" : "");
1844         return 1;
1845 }
1846
1847 int link_request_ndisc(Link *link) {
1848         int r;
1849
1850         assert(link);
1851
1852         if (!link_ipv6_accept_ra_enabled(link))
1853                 return 0;
1854
1855         if (link->ndisc)
1856                 return 0;
1857
1858         r = link_queue_request(link, REQUEST_TYPE_NDISC, ndisc_process_request, NULL);
1859         if (r < 0)
1860                 return log_link_warning_errno(link, r, "Failed to request configuring of the IPv6 Router Discovery: %m");
1861
1862         log_link_debug(link, "Requested configuring of the IPv6 Router Discovery.");
1863         return 0;
1864 }
1865
1866 int ndisc_stop(Link *link) {
1867         assert(link);
1868
1869         link->ndisc_expire = sd_event_source_disable_unref(link->ndisc_expire);
1870
1871         return sd_ndisc_stop(link->ndisc);
1872 }
1873
1874
1875 void ndisc_flush(Link *link) {
1876         assert(link);
1877
1878         /* Remove all addresses, routes, RDNSS, DNSSL, and Captive Portal entries, without exception. */
1879         (void) ndisc_drop_outdated(link, /* timestamp_usec = */ USEC_INFINITY);
1880
1881         link->ndisc_rdnss = set_free(link->ndisc_rdnss);
1882         link->ndisc_dnssl = set_free(link->ndisc_dnssl);
1883         link->ndisc_captive_portals = set_free(link->ndisc_captive_portals);
1884         link->ndisc_pref64 = set_free(link->ndisc_pref64);
1885 }
1886
1887 static const char* const ipv6_accept_ra_start_dhcp6_client_table[_IPV6_ACCEPT_RA_START_DHCP6_CLIENT_MAX] = {
1888         [IPV6_ACCEPT_RA_START_DHCP6_CLIENT_NO]     = "no",
1889         [IPV6_ACCEPT_RA_START_DHCP6_CLIENT_ALWAYS] = "always",
1890         [IPV6_ACCEPT_RA_START_DHCP6_CLIENT_YES]    = "yes",
1891 };
1892
1893 DEFINE_PRIVATE_STRING_TABLE_LOOKUP_FROM_STRING_WITH_BOOLEAN(ipv6_accept_ra_start_dhcp6_client, IPv6AcceptRAStartDHCP6Client, IPV6_ACCEPT_RA_START_DHCP6_CLIENT_YES);
1894
1895 DEFINE_CONFIG_PARSE_ENUM(config_parse_ipv6_accept_ra_use_domains, dhcp_use_domains, DHCPUseDomains,
1896                          "Failed to parse UseDomains= setting");
1897 DEFINE_CONFIG_PARSE_ENUM(config_parse_ipv6_accept_ra_start_dhcp6_client, ipv6_accept_ra_start_dhcp6_client, IPv6AcceptRAStartDHCP6Client,
1898                          "Failed to parse DHCPv6Client= setting");