Support deprecating SLAAC addresses after the preferred lifetime

Support deprecating network endpoints on a NIC. If an endpoint is deprecated, it
should not be used for new connections unless a more preferred endpoint is not
available, or unless the deprecated endpoint was explicitly requested.

Test: Test that deprecated endpoints are only returned when more preferred
endpoints are not available and SLAAC addresses are deprecated after its
preferred lifetime
PiperOrigin-RevId: 288562705

1 files changed, 196 insertions, 93 deletions

diff --git a/pkg/tcpip/stack/ndp.go b/pkg/tcpip/stack/ndp.go
index 238bc27dc..4722ec9ce 100644
--- a/pkg/tcpip/stack/ndp.go
+++ b/pkg/tcpip/stack/ndp.go
@@ -169,6 +169,15 @@ type NDPDispatcher interface {
 	// call functions on the stack itself.
 	OnAutoGenAddress(tcpip.NICID, tcpip.AddressWithPrefix) bool
 
+	// OnAutoGenAddressDeprecated will be called when an auto-generated
+	// address (as part of SLAAC) has been deprecated, but is still
+	// considered valid. Note, if an address is invalidated at the same
+	// time it is deprecated, the deprecation event MAY be omitted.
+	//
+	// This function is not permitted to block indefinitely. It must not
+	// call functions on the stack itself.
+	OnAutoGenAddressDeprecated(tcpip.NICID, tcpip.AddressWithPrefix)
+
 	// OnAutoGenAddressInvalidated will be called when an auto-generated
 	// address (as part of SLAAC) has been invalidated.
 	//
@@ -335,6 +344,17 @@ type onLinkPrefixState struct {
 // autoGenAddressState holds data associated with an address generated via
 // SLAAC.
 type autoGenAddressState struct {
+	// A reference to the referencedNetworkEndpoint that this autoGenAddressState
+	// is holding state for.
+	ref *referencedNetworkEndpoint
+
+	deprecationTimer *time.Timer
+
+	// Used to signal the timer not to deprecate the SLAAC address in a race
+	// condition. Used for the same reason as doNotInvalidate, but for deprecating
+	// an address.
+	doNotDeprecate *bool
+
 	invalidationTimer *time.Timer
 
 	// Used to signal the timer not to invalidate the SLAAC address (A) in
@@ -912,103 +932,30 @@ func (ndp *ndpState) handleAutonomousPrefixInformation(pi header.NDPPrefixInform
 	prefix := pi.Subnet()
 
 	// Check if we already have an auto-generated address for prefix.
-	for _, ref := range ndp.nic.endpoints {
-		if ref.protocol != header.IPv6ProtocolNumber {
-			continue
-		}
-
-		if ref.configType != slaac {
-			continue
-		}
-
-		addr := ref.ep.ID().LocalAddress
-		refAddrWithPrefix := tcpip.AddressWithPrefix{Address: addr, PrefixLen: ref.ep.PrefixLen()}
+	for addr, addrState := range ndp.autoGenAddresses {
+		refAddrWithPrefix := tcpip.AddressWithPrefix{Address: addr, PrefixLen: addrState.ref.ep.PrefixLen()}
 		if refAddrWithPrefix.Subnet() != prefix {
 			continue
 		}
 
-		//
-		// At this point, we know we are refreshing a SLAAC generated
-		// IPv6 address with the prefix, prefix. Do the work as outlined
-		// by RFC 4862 section 5.5.3.e.
-		//
-
-		addrState, ok := ndp.autoGenAddresses[addr]
-		if !ok {
-			panic(fmt.Sprintf("must have an autoGenAddressess entry for the SLAAC generated IPv6 address %s", addr))
-		}
-
-		// TODO(b/143713887): Handle deprecating auto-generated address
-		//                    after the preferred lifetime.
-
-		// As per RFC 4862 section 5.5.3.e, the valid lifetime of the
-		// address generated by SLAAC is as follows:
-		//
-		// 1) If the received Valid Lifetime is greater than 2 hours or
-		//    greater than RemainingLifetime, set the valid lifetime of
-		//    the address to the advertised Valid Lifetime.
-		//
-		// 2) If RemainingLifetime is less than or equal to 2 hours,
-		//    ignore the advertised Valid Lifetime.
-		//
-		// 3) Otherwise, reset the valid lifetime of the address to 2
-		//    hours.
-
-		// Handle the infinite valid lifetime separately as we do not
-		// keep a timer in this case.
-		if vl >= header.NDPInfiniteLifetime {
-			if addrState.invalidationTimer != nil {
-				// Valid lifetime was finite before, but now it
-				// is valid forever.
-				if !addrState.invalidationTimer.Stop() {
-					*addrState.doNotInvalidate = true
-				}
-				addrState.invalidationTimer = nil
-				addrState.validUntil = time.Time{}
-				ndp.autoGenAddresses[addr] = addrState
-			}
-
-			return
-		}
-
-		var effectiveVl time.Duration
-		var rl time.Duration
-
-		// If the address was originally set to be valid forever,
-		// assume the remaining time to be the maximum possible value.
-		if addrState.invalidationTimer == nil {
-			rl = header.NDPInfiniteLifetime
-		} else {
-			rl = time.Until(addrState.validUntil)
-		}
-
-		if vl > MinPrefixInformationValidLifetimeForUpdate || vl > rl {
-			effectiveVl = vl
-		} else if rl <= MinPrefixInformationValidLifetimeForUpdate {
-			ndp.autoGenAddresses[addr] = addrState
-			return
-		} else {
-			effectiveVl = MinPrefixInformationValidLifetimeForUpdate
-		}
-
-		if addrState.invalidationTimer == nil {
-			addrState.invalidationTimer = ndp.autoGenAddrInvalidationTimer(addr, effectiveVl, addrState.doNotInvalidate)
-		} else {
-			if !addrState.invalidationTimer.Stop() {
-				*addrState.doNotInvalidate = true
-			}
-			addrState.invalidationTimer.Reset(effectiveVl)
-		}
-
-		addrState.validUntil = time.Now().Add(effectiveVl)
-		ndp.autoGenAddresses[addr] = addrState
+		// At this point, we know we are refreshing a SLAAC generated IPv6 address
+		// with the prefix prefix. Do the work as outlined by RFC 4862 section
+		// 5.5.3.e.
+		ndp.refreshAutoGenAddressLifetimes(addr, pl, vl)
 		return
 	}
 
 	// We do not already have an address within the prefix, prefix. Do the
 	// work as outlined by RFC 4862 section 5.5.3.d if n is configured
 	// to auto-generated global addresses by SLAAC.
+	ndp.newAutoGenAddress(prefix, pl, vl)
+}
 
+// newAutoGenAddress generates a new SLAAC address with the provided lifetimes
+// for prefix.
+//
+// pl is the new preferred lifetime. vl is the new valid lifetime.
+func (ndp *ndpState) newAutoGenAddress(prefix tcpip.Subnet, pl, vl time.Duration) {
 	// Are we configured to auto-generate new global addresses?
 	if !ndp.configs.AutoGenGlobalAddresses {
 		return
@@ -1067,18 +1014,25 @@ func (ndp *ndpState) handleAutonomousPrefixInformation(pi header.NDPPrefixInform
 		return
 	}
 
-	if _, err := ndp.nic.addAddressLocked(tcpip.ProtocolAddress{
+	protocolAddr := tcpip.ProtocolAddress{
 		Protocol:          header.IPv6ProtocolNumber,
 		AddressWithPrefix: addrWithPrefix,
-	}, FirstPrimaryEndpoint, permanent, slaac); err != nil {
-		panic(err)
+	}
+	// If the preferred lifetime is zero, then the address should be considered
+	// deprecated.
+	deprecated := pl == 0
+	ref, err := ndp.nic.addAddressLocked(protocolAddr, FirstPrimaryEndpoint, permanent, slaac, deprecated)
+	if err != nil {
+		log.Fatalf("ndp: error when adding address %s: %s", protocolAddr, err)
 	}
 
-	// Setup the timers to deprecate and invalidate this newly generated
-	// address.
+	// Setup the timers to deprecate and invalidate this newly generated address.
 
-	// TODO(b/143713887): Handle deprecating auto-generated addresses
-	//                    after the preferred lifetime.
+	var doNotDeprecate bool
+	var pTimer *time.Timer
+	if !deprecated && pl < header.NDPInfiniteLifetime {
+		pTimer = ndp.autoGenAddrDeprecationTimer(addr, pl, &doNotDeprecate)
+	}
 
 	var doNotInvalidate bool
 	var vTimer *time.Timer
@@ -1087,12 +1041,126 @@ func (ndp *ndpState) handleAutonomousPrefixInformation(pi header.NDPPrefixInform
 	}
 
 	ndp.autoGenAddresses[addr] = autoGenAddressState{
+		ref:               ref,
+		deprecationTimer:  pTimer,
+		doNotDeprecate:    &doNotDeprecate,
 		invalidationTimer: vTimer,
 		doNotInvalidate:   &doNotInvalidate,
 		validUntil:        time.Now().Add(vl),
 	}
 }
 
+// refreshAutoGenAddressLifetimes refreshes the lifetime of a SLAAC generated
+// address addr.
+//
+// pl is the new preferred lifetime. vl is the new valid lifetime.
+func (ndp *ndpState) refreshAutoGenAddressLifetimes(addr tcpip.Address, pl, vl time.Duration) {
+	addrState, ok := ndp.autoGenAddresses[addr]
+	if !ok {
+		log.Fatalf("ndp: SLAAC state not found to refresh lifetimes for %s", addr)
+	}
+	defer func() { ndp.autoGenAddresses[addr] = addrState }()
+
+	// If the preferred lifetime is zero, then the address should be considered
+	// deprecated.
+	deprecated := pl == 0
+	wasDeprecated := addrState.ref.deprecated
+	addrState.ref.deprecated = deprecated
+
+	// Only send the deprecation event if the deprecated status for addr just
+	// changed from non-deprecated to deprecated.
+	if !wasDeprecated && deprecated {
+		ndp.notifyAutoGenAddressDeprecated(addr)
+	}
+
+	// If addr was preferred for some finite lifetime before, stop the deprecation
+	// timer so it can be reset.
+	if t := addrState.deprecationTimer; t != nil && !t.Stop() {
+		*addrState.doNotDeprecate = true
+	}
+
+	// Reset the deprecation timer.
+	if pl >= header.NDPInfiniteLifetime || deprecated {
+		// If addr is preferred forever or it has been deprecated already, there is
+		// no need for a deprecation timer.
+		addrState.deprecationTimer = nil
+	} else if addrState.deprecationTimer == nil {
+		// addr is now preferred for a finite lifetime.
+		addrState.deprecationTimer = ndp.autoGenAddrDeprecationTimer(addr, pl, addrState.doNotDeprecate)
+	} else {
+		// addr continues to be preferred for a finite lifetime.
+		addrState.deprecationTimer.Reset(pl)
+	}
+
+	// As per RFC 4862 section 5.5.3.e, the valid lifetime of the address
+	//
+	//
+	// 1) If the received Valid Lifetime is greater than 2 hours or greater than
+	//    RemainingLifetime, set the valid lifetime of the address to the
+	//    advertised Valid Lifetime.
+	//
+	// 2) If RemainingLifetime is less than or equal to 2 hours, ignore the
+	//    advertised Valid Lifetime.
+	//
+	// 3) Otherwise, reset the valid lifetime of the address to 2 hours.
+
+	// Handle the infinite valid lifetime separately as we do not keep a timer in
+	// this case.
+	if vl >= header.NDPInfiniteLifetime {
+		if addrState.invalidationTimer != nil {
+			// Valid lifetime was finite before, but now it is valid forever.
+			if !addrState.invalidationTimer.Stop() {
+				*addrState.doNotInvalidate = true
+			}
+			addrState.invalidationTimer = nil
+			addrState.validUntil = time.Time{}
+		}
+
+		return
+	}
+
+	var effectiveVl time.Duration
+	var rl time.Duration
+
+	// If the address was originally set to be valid forever, assume the remaining
+	// time to be the maximum possible value.
+	if addrState.invalidationTimer == nil {
+		rl = header.NDPInfiniteLifetime
+	} else {
+		rl = time.Until(addrState.validUntil)
+	}
+
+	if vl > MinPrefixInformationValidLifetimeForUpdate || vl > rl {
+		effectiveVl = vl
+	} else if rl <= MinPrefixInformationValidLifetimeForUpdate {
+		return
+	} else {
+		effectiveVl = MinPrefixInformationValidLifetimeForUpdate
+	}
+
+	if addrState.invalidationTimer == nil {
+		addrState.invalidationTimer = ndp.autoGenAddrInvalidationTimer(addr, effectiveVl, addrState.doNotInvalidate)
+	} else {
+		if !addrState.invalidationTimer.Stop() {
+			*addrState.doNotInvalidate = true
+		}
+		addrState.invalidationTimer.Reset(effectiveVl)
+	}
+
+	addrState.validUntil = time.Now().Add(effectiveVl)
+}
+
+// notifyAutoGenAddressDeprecated notifies the stack's NDP dispatcher that addr
+// has been deprecated.
+func (ndp *ndpState) notifyAutoGenAddressDeprecated(addr tcpip.Address) {
+	if ndpDisp := ndp.nic.stack.ndpDisp; ndpDisp != nil {
+		ndpDisp.OnAutoGenAddressDeprecated(ndp.nic.ID(), tcpip.AddressWithPrefix{
+			Address:   addr,
+			PrefixLen: validPrefixLenForAutoGen,
+		})
+	}
+}
+
 // invalidateAutoGenAddress invalidates an auto-generated address.
 //
 // The NIC that ndp belongs to MUST be locked.
@@ -1118,6 +1186,14 @@ func (ndp *ndpState) cleanupAutoGenAddrResourcesAndNotify(addr tcpip.Address) bo
 		return false
 	}
 
+	if state.deprecationTimer != nil {
+		state.deprecationTimer.Stop()
+		state.deprecationTimer = nil
+		*state.doNotDeprecate = true
+	}
+
+	state.doNotDeprecate = nil
+
 	if state.invalidationTimer != nil {
 		state.invalidationTimer.Stop()
 		state.invalidationTimer = nil
@@ -1138,6 +1214,33 @@ func (ndp *ndpState) cleanupAutoGenAddrResourcesAndNotify(addr tcpip.Address) bo
 	return true
 }
 
+// autoGenAddrDeprecationTimer returns a new deprecation timer for an
+// auto-generated address that fires after pl.
+//
+// doNotDeprecate is used to inform the timer when it fires at the same time
+// that an auto-generated address's preferred lifetime gets refreshed. See
+// autoGenAddrState.doNotDeprecate for more details.
+func (ndp *ndpState) autoGenAddrDeprecationTimer(addr tcpip.Address, pl time.Duration, doNotDeprecate *bool) *time.Timer {
+	return time.AfterFunc(pl, func() {
+		ndp.nic.mu.Lock()
+		defer ndp.nic.mu.Unlock()
+
+		if *doNotDeprecate {
+			*doNotDeprecate = false
+			return
+		}
+
+		addrState, ok := ndp.autoGenAddresses[addr]
+		if !ok {
+			log.Fatalf("ndp: must have an autoGenAddressess entry for the SLAAC generated IPv6 address %s", addr)
+		}
+		addrState.ref.deprecated = true
+		ndp.notifyAutoGenAddressDeprecated(addr)
+		addrState.deprecationTimer = nil
+		ndp.autoGenAddresses[addr] = addrState
+	})
+}
+
 // autoGenAddrInvalidationTimer returns a new invalidation timer for an
 // auto-generated address that fires after vl.
 //