1 /*
2  * This file and its contents are supplied under the terms of the
3  * Common Development and Distribution License ("CDDL"), version 1.0.
4  * You may only use this file in accordance with the terms of version
5  * 1.0 of the CDDL.
6  *
7  * A full copy of the text of the CDDL should have accompanied this
8  * source.  A copy of the CDDL is also available via the Internet at
9  * http://www.illumos.org/license/CDDL.
10  */
11 
12 /*
13  * Copyright 2015 Joyent, Inc. All rights reserved.
14  */
15 
16 #include <strings.h>
17 #include <stdio.h>
18 #include <stdlib.h>
19 #include <errno.h>
20 #include <err.h>
21 #include <sys/types.h>
22 #include <sys/socket.h>
23 #include <sys/sockio.h>
24 #include <sys/wait.h>
25 #include <unistd.h>
26 #include <signal.h>
27 #include <netinet/in_systm.h> /* legacy network types needed by ip_icmp.h */
28 #include <netinet/in.h>
29 #include <netinet/ip.h>
30 #include <netinet/ip6.h>
31 #include <netinet/ip_icmp.h>
32 #include <netinet/icmp6.h>
33 #include <net/if.h>
34 #include <arpa/inet.h>
35 #include <priv.h>
36 
37 /*
38  * This program is meant to test the behaviour of processing incoming Router
39  * Advertisements when IP spoofing protection (ip-nospoof) is enabled. When
40  * run, it creates an etherstub on which it places two VNICs: a source VNIC,
41  * and a destination VNIC with protection enabled. It then sends out spoofed
42  * Router Advertisements with varying incorrect values.
43  *
44  * IMPORTANT: These tests expect that there is no other IPv6 traffic on the
45  * machine that would be delivered to a VNIC with spoofing protection enabled,
46  * since this would trip the DTrace probes installed by this suite of tests.
47  * Care should therefore be taken to not run it as a part of any series of
48  * tests which may be executed in such an environment, as it could lead to
49  * spurious failures.
50  */
51 
52 #define	DLADM(args...) spoof_run_proc("/usr/sbin/dladm", \
53 	(char *[]) { "dladm", args, NULL })
54 #define	IFCONFIG(args...) spoof_run_proc("/usr/sbin/ifconfig", \
55 	(char *[]) { "ifconfig", args, NULL })
56 
57 typedef	struct	sockaddr_in6	sin6_t;
58 typedef	int	(spoof_test_f)(int, struct lif_nd_req *, sin6_t *);
59 
60 /*
61  * Get the link-layer address of the given interface by querying
62  * the neighbour cache.
63  */
64 static int
spoof_get_lla(int s,const char * iface,struct lifreq * addrp,struct lifreq * llap)65 spoof_get_lla(int s, const char *iface, struct lifreq *addrp,
66     struct lifreq *llap)
67 {
68 	if (strstr(iface, ":")) {
69 		warnx("Specified interface should be the zeroth "
70 		    "logical interface on the physical device.");
71 	}
72 
73 	bzero(addrp, sizeof (*addrp));
74 	bzero(llap, sizeof (*llap));
75 
76 	(void) strlcpy(addrp->lifr_name, iface, LIFNAMSIZ);
77 	if (ioctl(s, SIOCGLIFADDR, addrp) < 0) {
78 		warn("Unable to get link-local address");
79 		return (-1);
80 	}
81 
82 	(void) strlcpy(llap->lifr_name, iface, LIFNAMSIZ);
83 	bcopy(&addrp->lifr_addr, &llap->lifr_nd.lnr_addr,
84 	    sizeof (struct sockaddr_storage));
85 
86 	if (ioctl(s, SIOCLIFGETND, llap) < 0) {
87 		warn("Failed to get link-layer address");
88 		return (-1);
89 	}
90 
91 	return (0);
92 }
93 
94 static void
spoof_prepare_lla(struct nd_opt_lla * llap,struct lif_nd_req * nce,struct iovec * iov)95 spoof_prepare_lla(struct nd_opt_lla *llap, struct lif_nd_req *nce,
96     struct iovec *iov)
97 {
98 	uint_t optlen;
99 
100 	bzero(llap, sizeof (*llap));
101 	llap->nd_opt_lla_type = ND_OPT_SOURCE_LINKADDR;
102 	optlen = ((sizeof (struct nd_opt_hdr) +
103 	    nce->lnr_hdw_len + 7) / 8) * 8;
104 	llap->nd_opt_lla_len = optlen / 8;
105 	bcopy(&nce->lnr_hdw_addr,
106 	    &llap->nd_opt_lla_hdw_addr, nce->lnr_hdw_len);
107 
108 	iov->iov_base = (caddr_t)llap;
109 	iov->iov_len = optlen;
110 }
111 
112 static void
spoof_prepare_pi(const char * prefix,int prefix_len,struct nd_opt_prefix_info * pip,struct iovec * iov)113 spoof_prepare_pi(const char *prefix, int prefix_len,
114     struct nd_opt_prefix_info *pip, struct iovec *iov)
115 {
116 	bzero(pip, sizeof (*pip));
117 
118 	pip->nd_opt_pi_type = ND_OPT_PREFIX_INFORMATION;
119 	pip->nd_opt_pi_len = 4;
120 	pip->nd_opt_pi_prefix_len = prefix_len;
121 	pip->nd_opt_pi_flags_reserved =
122 	    ND_OPT_PI_FLAG_AUTO | ND_OPT_PI_FLAG_ONLINK;
123 	pip->nd_opt_pi_valid_time = 86400;
124 	pip->nd_opt_pi_preferred_time = 86400;
125 	if (inet_pton(AF_INET6, prefix, &pip->nd_opt_pi_prefix) == 0) {
126 		errx(EXIT_FAILURE, "The prefix \"%s\" is "
127 		    "not a valid input prefix", prefix);
128 	}
129 
130 	iov->iov_base = (caddr_t)pip;
131 	iov->iov_len = sizeof (*pip);
132 }
133 
134 static void
spoof_prepare_header(struct nd_router_advert * ichdrp,struct iovec * iov)135 spoof_prepare_header(struct nd_router_advert *ichdrp, struct iovec *iov)
136 {
137 	bzero(ichdrp, sizeof (*ichdrp));
138 
139 	ichdrp->nd_ra_type = ND_ROUTER_ADVERT;
140 	ichdrp->nd_ra_curhoplimit = 0;
141 
142 	iov->iov_base = (caddr_t)ichdrp;
143 	iov->iov_len = sizeof (*ichdrp);
144 }
145 
146 static int
spoof_set_max_hops(int s)147 spoof_set_max_hops(int s)
148 {
149 	int ttl = 255;
150 
151 	if (setsockopt(s, IPPROTO_IPV6, IPV6_UNICAST_HOPS,
152 	    (char *)&ttl, sizeof (ttl)) < 0) {
153 		warn("Failed to set IPV6_UNICAST_HOPS socket option");
154 		return (-1);
155 	}
156 	if (setsockopt(s, IPPROTO_IPV6, IPV6_MULTICAST_HOPS,
157 	    (char *)&ttl, sizeof (ttl)) < 0) {
158 		warn("Failed to set IPV6_UNICAST_HOPS socket option");
159 		return (-1);
160 	}
161 
162 	return (0);
163 }
164 
165 /*
166  * Send bad option lengths in the Link-Layer Source Address option
167  */
168 static int
spoof_bad_lla_optlen_test(int s,struct lif_nd_req * nce,sin6_t * multicast)169 spoof_bad_lla_optlen_test(int s, struct lif_nd_req *nce, sin6_t *multicast)
170 {
171 	struct msghdr msg6;
172 	struct iovec iovs[3];
173 	struct nd_router_advert ichdr;
174 	struct nd_opt_lla lla;
175 	struct nd_opt_prefix_info pi;
176 	uint8_t old_lla_len;
177 
178 	spoof_prepare_header(&ichdr, &iovs[0]);
179 	spoof_prepare_lla(&lla, nce, &iovs[1]);
180 	spoof_prepare_pi("fd00::", 64, &pi, &iovs[2]);
181 
182 	/* Prepare message */
183 	bzero(&msg6, sizeof (struct msghdr));
184 	msg6.msg_name = multicast;
185 	msg6.msg_namelen = sizeof (sin6_t);
186 	msg6.msg_iov = iovs;
187 	msg6.msg_iovlen = 3;
188 
189 	old_lla_len = lla.nd_opt_lla_len;
190 
191 
192 	/*
193 	 * Length is now smaller than the option is, so this should
194 	 * be rejected.
195 	 */
196 	lla.nd_opt_lla_len = 0;
197 	if (sendmsg(s, &msg6, 0) < 0) {
198 		warn("Failed to send ICMPv6 message");
199 		return (-1);
200 	}
201 
202 	/*
203 	 * Length is bigger than the option, so the following prefix
204 	 * will be offset.
205 	 */
206 	lla.nd_opt_lla_len = 2;
207 	if (sendmsg(s, &msg6, 0) < 0) {
208 		warn("Failed to send ICMPv6 message");
209 		return (-1);
210 	}
211 
212 	/*
213 	 * Restore the length, but shorten the amount of data to send, so we're
214 	 * sending truncated packets. (Stop before 0, so that we still send part
215 	 * of the option.)
216 	 */
217 	lla.nd_opt_lla_len = old_lla_len;
218 	for (iovs[1].iov_len--; iovs[1].iov_len > 0; iovs[1].iov_len--) {
219 		if (sendmsg(s, &msg6, 0) < 0) {
220 			warn("Failed to send ICMPv6 message");
221 			return (-1);
222 		}
223 	}
224 
225 	return (0);
226 }
227 
228 /*
229  * Send bad option lengths in the Prefix Information option
230  */
231 static int
spoof_bad_pi_optlen_test(int s,struct lif_nd_req * nce,sin6_t * multicast)232 spoof_bad_pi_optlen_test(int s, struct lif_nd_req *nce, sin6_t *multicast)
233 {
234 	struct msghdr msg6;
235 	struct iovec iovs[3];
236 	struct nd_router_advert ichdr;
237 	struct nd_opt_lla lla;
238 	struct nd_opt_prefix_info pi;
239 	uint8_t old_pi_len;
240 
241 	spoof_prepare_header(&ichdr, &iovs[0]);
242 	spoof_prepare_lla(&lla, nce, &iovs[1]);
243 	spoof_prepare_pi("fd00::", 64, &pi, &iovs[2]);
244 
245 	/* Prepare message */
246 	bzero(&msg6, sizeof (struct msghdr));
247 	msg6.msg_name = multicast;
248 	msg6.msg_namelen = sizeof (sin6_t);
249 	msg6.msg_iov = iovs;
250 	msg6.msg_iovlen = 3;
251 
252 	old_pi_len = pi.nd_opt_pi_len;
253 
254 	/*
255 	 * Length is now smaller than the option is, so this should
256 	 * be rejected.
257 	 */
258 	pi.nd_opt_pi_len = 0;
259 	if (sendmsg(s, &msg6, 0) < 0) {
260 		warn("Failed to send ICMPv6 message");
261 		return (-1);
262 	}
263 
264 	/*
265 	 * Length is smaller than a PI option should be.
266 	 */
267 	pi.nd_opt_pi_len = 3;
268 	if (sendmsg(s, &msg6, 0) < 0) {
269 		warn("Failed to send ICMPv6 message");
270 		return (-1);
271 	}
272 
273 	/*
274 	 * Length is bigger than the option, so the following prefix
275 	 * will be offset.
276 	 */
277 	pi.nd_opt_pi_len = 5;
278 	if (sendmsg(s, &msg6, 0) < 0) {
279 		warn("Failed to send ICMPv6 message");
280 		return (-1);
281 	}
282 
283 	/*
284 	 * Restore the length, but shorten the amount of data to send, so we're
285 	 * sending truncated packets. (Stop before 0, so that we still send part
286 	 * of the option.)
287 	 */
288 	pi.nd_opt_pi_len = old_pi_len;
289 	for (iovs[2].iov_len--; iovs[2].iov_len > 0; iovs[2].iov_len--) {
290 		if (sendmsg(s, &msg6, 0) < 0) {
291 			warn("Failed to send ICMPv6 message");
292 			return (-1);
293 		}
294 	}
295 
296 	return (0);
297 }
298 
299 /*
300  * Advertise a prefix with a prefix length greater than 128.
301  */
302 static int
spoof_bad_plen_test(int s,struct lif_nd_req * nce,sin6_t * multicast)303 spoof_bad_plen_test(int s, struct lif_nd_req *nce, sin6_t *multicast)
304 {
305 	struct msghdr msg6;
306 	struct iovec iovs[3];
307 	struct nd_router_advert ichdr;
308 	struct nd_opt_lla lla;
309 	struct nd_opt_prefix_info pi;
310 
311 	spoof_prepare_header(&ichdr, &iovs[0]);
312 	spoof_prepare_lla(&lla, nce, &iovs[1]);
313 	spoof_prepare_pi("fd00::", 130, &pi, &iovs[2]);
314 
315 	/* Prepare message */
316 	bzero(&msg6, sizeof (struct msghdr));
317 	msg6.msg_name = multicast;
318 	msg6.msg_namelen = sizeof (sin6_t);
319 	msg6.msg_iov = iovs;
320 	msg6.msg_iovlen = 3;
321 
322 	if (sendmsg(s, &msg6, 0) < 0) {
323 		warn("Failed to send ICMPv6 message");
324 		return (-1);
325 	}
326 
327 	return (0);
328 }
329 
330 /*
331  * Advertise a link-local prefix, which should be disallowed and ignored.
332  */
333 static int
spoof_link_local_test(int s,struct lif_nd_req * nce,sin6_t * multicast)334 spoof_link_local_test(int s, struct lif_nd_req *nce, sin6_t *multicast)
335 {
336 	struct msghdr msg6;
337 	struct iovec iovs[3];
338 	struct nd_router_advert ichdr;
339 	struct nd_opt_lla lla;
340 	struct nd_opt_prefix_info pi;
341 
342 	spoof_prepare_header(&ichdr, &iovs[0]);
343 	spoof_prepare_lla(&lla, nce, &iovs[1]);
344 	spoof_prepare_pi("fe80::", 64, &pi, &iovs[2]);
345 
346 	/* Prepare message */
347 	bzero(&msg6, sizeof (struct msghdr));
348 	msg6.msg_name = multicast;
349 	msg6.msg_namelen = sizeof (sin6_t);
350 	msg6.msg_iov = iovs;
351 	msg6.msg_iovlen = 3;
352 
353 	if (sendmsg(s, &msg6, 0) < 0) {
354 		warn("Failed to send ICMPv6 message");
355 		return (-1);
356 	}
357 
358 	return (0);
359 }
360 
361 static int
spoof_good_test(int s,struct lif_nd_req * nce,sin6_t * multicast)362 spoof_good_test(int s, struct lif_nd_req *nce, sin6_t *multicast)
363 {
364 	struct msghdr msg6;
365 	struct iovec iovs[3];
366 	struct nd_router_advert ichdr;
367 	struct nd_opt_lla lla;
368 	struct nd_opt_prefix_info pi;
369 
370 	spoof_prepare_header(&ichdr, &iovs[0]);
371 	spoof_prepare_lla(&lla, nce, &iovs[1]);
372 	spoof_prepare_pi("fd00::", 64, &pi, &iovs[2]);
373 
374 	/* Prepare message */
375 	bzero(&msg6, sizeof (struct msghdr));
376 	msg6.msg_name = multicast;
377 	msg6.msg_namelen = sizeof (sin6_t);
378 	msg6.msg_iov = iovs;
379 	msg6.msg_iovlen = 3;
380 
381 	if (sendmsg(s, &msg6, 0) < 0) {
382 		warn("Failed to send ICMPv6 message");
383 		return (-1);
384 	}
385 
386 	return (0);
387 }
388 
389 static spoof_test_f *test_cases[] = {
390 	spoof_bad_lla_optlen_test,
391 	spoof_bad_pi_optlen_test,
392 	spoof_bad_plen_test,
393 	spoof_link_local_test
394 };
395 
396 static int test_cases_count = sizeof (test_cases) / sizeof (spoof_test_f *);
397 
398 static pid_t
spoof_dtrace_launch(void)399 spoof_dtrace_launch(void)
400 {
401 	pid_t child_pid = fork();
402 	if (child_pid == (pid_t)-1) {
403 		err(EXIT_FAILURE, "Failed to fork to execute dtrace");
404 	} else if (child_pid == (pid_t)0) {
405 		(void) execl("/usr/sbin/dtrace", "dtrace", "-q",
406 		    "-n", "sdt:mac:insert_slaac_ip:generated-addr { exit(10) }",
407 		    NULL);
408 		err(EXIT_FAILURE, "Failed to execute dtrace");
409 	}
410 
411 	return (child_pid);
412 }
413 
414 static pid_t
spoof_dtrace_wait(pid_t dtrace,int * stat)415 spoof_dtrace_wait(pid_t dtrace, int *stat)
416 {
417 	int retpid;
418 
419 	/* Give time for probe to fire before checking status */
420 	(void) sleep(5);
421 
422 	while ((retpid = waitpid(dtrace, stat, WNOHANG)) == -1) {
423 		if (errno == EINTR)
424 			continue;
425 
426 		err(EXIT_FAILURE, "Failed to wait on child");
427 	}
428 
429 	return (retpid);
430 }
431 
432 /*
433  * Run a function that's going to exec in a child process, and don't return
434  * until it exits.
435  */
436 static int
spoof_run_proc(char * path,char * args[])437 spoof_run_proc(char *path, char *args[])
438 {
439 	pid_t child_pid;
440 	int childstat = 0, status = 0;
441 
442 	child_pid = fork();
443 	if (child_pid == (pid_t)-1) {
444 		err(EXIT_FAILURE, "Unable to fork to execute %s", path);
445 	} else if (child_pid == (pid_t)0) {
446 		(void) execv(path, args);
447 		err(EXIT_FAILURE, "Failed to execute %s", path);
448 	}
449 
450 	while (waitpid(child_pid, &childstat, 0) == -1) {
451 		if (errno == EINTR)
452 			continue;
453 
454 		warn("Failed to wait on child");
455 		return (-1);
456 	}
457 
458 	status = WEXITSTATUS(childstat);
459 	if (status != 0) {
460 		warnx("Child process %s exited with %d", path, status);
461 		return (-1);
462 	}
463 
464 	return (0);
465 }
466 
467 static void
spoof_network_teardown(char * testether,char * testvnic0,char * testvnic1)468 spoof_network_teardown(char *testether, char *testvnic0, char *testvnic1)
469 {
470 	// Delete dest vnic
471 	(void) IFCONFIG(testvnic1, "inet6", "unplumb");
472 	(void) DLADM("delete-vnic", testvnic1);
473 
474 	// Delete source vnic
475 	(void) IFCONFIG(testvnic0, "inet6", "unplumb");
476 	(void) DLADM("delete-vnic", testvnic0);
477 
478 	// Delete etherstub
479 	(void) DLADM("delete-etherstub", testether);
480 }
481 
482 static int
spoof_network_setup(char * testether,char * testvnic0,char * testvnic1)483 spoof_network_setup(char *testether, char *testvnic0, char *testvnic1)
484 {
485 	// Create etherstub
486 	if (DLADM("create-etherstub", "-t", testether) != 0) {
487 		warnx("Failed to create etherstub for test network");
488 		return (-1);
489 	}
490 
491 	// Create source vnic
492 	if (DLADM("create-vnic", "-t", "-l", testether, testvnic0) != 0) {
493 		warnx("Failed to create source VNIC for test network");
494 		return (-1);
495 	}
496 
497 	if (IFCONFIG(testvnic0, "inet6", "plumb", "up") != 0) {
498 		warnx("Failed to plumb source VNIC for test network");
499 		return (-1);
500 	}
501 
502 	// Create dest vnic
503 	if (DLADM("create-vnic", "-t", "-l", testether,
504 	    "-p", "protection=mac-nospoof,restricted,ip-nospoof,dhcp-nospoof",
505 	    testvnic1) != 0) {
506 		warnx("Failed to create destination VNIC for test network");
507 		return (-1);
508 	}
509 
510 	if (IFCONFIG(testvnic1, "inet6", "plumb", "up") != 0) {
511 		warnx("Failed to plumb destination VNIC for test network");
512 		return (-1);
513 	}
514 
515 	return (0);
516 }
517 
518 static void
spoof_run_test(spoof_test_f * func,int s,struct lif_nd_req * nce,sin6_t * multicast)519 spoof_run_test(spoof_test_f *func, int s, struct lif_nd_req *nce,
520     sin6_t *multicast)
521 {
522 	static int cas = 1;
523 	(void) printf("Executing test case #%d...", cas++);
524 	if (func(s, nce, multicast) == 0) {
525 		(void) printf(" Done.\n");
526 	} else {
527 		(void) printf(" Error while running!\n");
528 	}
529 }
530 
531 static int
spoof_run_tests(int s,struct lif_nd_req * nce)532 spoof_run_tests(int s, struct lif_nd_req *nce)
533 {
534 	int cas, stat;
535 	pid_t dtrace;
536 	sin6_t multicast;
537 
538 	/* Prepare all-nodes multicast address */
539 	bzero(&multicast, sizeof (multicast));
540 	multicast.sin6_family = AF_INET6;
541 	(void) inet_pton(AF_INET6, "ff02::1", &multicast.sin6_addr);
542 
543 	dtrace = spoof_dtrace_launch();
544 
545 	/* Wait an adequate amount of time for the probes to be installed */
546 	(void) sleep(5);
547 
548 	/*
549 	 * We send a packet where everything is good, except for the hop limit.
550 	 * This packet should be rejected.
551 	 */
552 	spoof_run_test(spoof_good_test, s, nce, &multicast);
553 
554 	if (spoof_set_max_hops(s) != 0) {
555 		warnx("Failed to set hop limit on socket");
556 		return (EXIT_FAILURE);
557 	}
558 
559 	for (cas = 0; cas < test_cases_count; cas++) {
560 		spoof_run_test(test_cases[cas], s, nce, &multicast);
561 	}
562 
563 
564 	if (spoof_dtrace_wait(dtrace, &stat) != 0) {
565 		(void) printf("One or more tests of bad behaviour failed!\n");
566 		return (EXIT_FAILURE);
567 	}
568 
569 	/*
570 	 * Now that we've executed all of the test cases that should fail, we
571 	 * can execute the test that should succeed, to make sure the normal
572 	 * case works properly. This should trip the dtrace probe.
573 	 */
574 	spoof_run_test(spoof_good_test, s, nce, &multicast);
575 
576 	if (spoof_dtrace_wait(dtrace, &stat) != 0 && WIFEXITED(stat) &&
577 	    WEXITSTATUS(stat) == 10) {
578 		(void) printf("Tests completed successfully!\n");
579 	} else {
580 		if (kill(dtrace, SIGKILL) != 0)  {
581 			warn("Failed to kill dtrace child (pid %d)", dtrace);
582 		}
583 		(void) printf("Test of normal behaviour didn't succeed!\n");
584 		return (EXIT_FAILURE);
585 	}
586 
587 	return (0);
588 }
589 
590 /*
591  * Make sure that we have all of the privileges we need to execute these tests,
592  * so that we can error out before we would fail.
593  */
594 void
spoof_check_privs(void)595 spoof_check_privs(void)
596 {
597 	priv_set_t *privset = priv_allocset();
598 
599 	if (privset == NULL) {
600 		err(EXIT_FAILURE, "Failed to allocate memory for "
601 		    "checking privileges");
602 	}
603 
604 	if (getppriv(PRIV_EFFECTIVE, privset) != 0) {
605 		err(EXIT_FAILURE, "Failed to get current privileges");
606 	}
607 
608 	if (!priv_ismember(privset, PRIV_DTRACE_KERNEL)) {
609 		errx(EXIT_FAILURE, "These tests need to be run as a user "
610 		    "capable of tracing the kernel.");
611 	}
612 
613 	if (!priv_ismember(privset, PRIV_SYS_NET_CONFIG)) {
614 		errx(EXIT_FAILURE, "These tests need to be run as a user "
615 		    "capable of creating and configuring network interfaces.");
616 	}
617 
618 	if (!priv_ismember(privset, PRIV_NET_ICMPACCESS)) {
619 		errx(EXIT_FAILURE, "These tests need to be run as a user "
620 		    "capable of sending ICMP packets.");
621 	}
622 
623 	priv_freeset(privset);
624 }
625 
626 int
main(void)627 main(void)
628 {
629 	struct lifreq addr, llar;
630 	int error, s;
631 	char testether[LIFNAMSIZ];
632 	char testvnic0[LIFNAMSIZ];
633 	char testvnic1[LIFNAMSIZ];
634 	pid_t curpid = getpid();
635 
636 	spoof_check_privs();
637 
638 	/*
639 	 * Set up the socket and test network for sending
640 	 */
641 	s = socket(PF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
642 	if (s < 0) {
643 		err(EXIT_FAILURE, "Failed to open ICMPv6 socket");
644 	}
645 
646 	(void) snprintf(testether, sizeof (testether), "testether%d", curpid);
647 	(void) snprintf(testvnic0, sizeof (testvnic0), "testvnic%d_0", curpid);
648 	(void) snprintf(testvnic1, sizeof (testvnic1), "testvnic%d_1", curpid);
649 
650 	if (spoof_network_setup(testether, testvnic0, testvnic1) != 0) {
651 		warnx("Failed to set up test network");
652 		error = EXIT_FAILURE;
653 		goto cleanup;
654 	}
655 
656 	if (spoof_get_lla(s, testvnic0, &addr, &llar) != 0) {
657 		warnx("Failed to get link-layer address");
658 		error = EXIT_FAILURE;
659 		goto cleanup;
660 	}
661 
662 	if (setsockopt(s, IPPROTO_IPV6, IPV6_BOUND_IF,
663 	    (char *)&((sin6_t *)&addr.lifr_addr)->sin6_scope_id,
664 	    sizeof (int)) < 0) {
665 		warn("Failed to set IPV6_UNICAST_HOPS socket option");
666 		return (-1);
667 	}
668 
669 	if (bind(s, (struct sockaddr *)&addr.lifr_addr, sizeof (sin6_t)) != 0) {
670 		warnx("Failed to bind to link-local address");
671 		error = EXIT_FAILURE;
672 		goto cleanup;
673 	}
674 
675 	error = spoof_run_tests(s, &llar.lifr_nd);
676 
677 cleanup:
678 	if (close(s) != 0) {
679 		warnx("Failed to close ICMPv6 socket");
680 	}
681 	spoof_network_teardown(testether, testvnic0, testvnic1);
682 	return (error);
683 }
684