| blob | b8a0ed09476e714d32a060e626d5c0e70c82abc1 |
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 */
25 /*
26 * Copyright (c) 1990 Mentat Inc.
27 */
29 #include <sys/types.h>
30 #include <sys/stream.h>
31 #include <sys/dlpi.h>
32 #include <sys/stropts.h>
33 #include <sys/sysmacros.h>
34 #include <sys/strsun.h>
35 #include <sys/strlog.h>
36 #include <sys/strsubr.h>
37 #define _SUN_TPI_VERSION 2
38 #include <sys/tihdr.h>
39 #include <sys/ddi.h>
40 #include <sys/sunddi.h>
41 #include <sys/cmn_err.h>
42 #include <sys/debug.h>
43 #include <sys/sdt.h>
44 #include <sys/kobj.h>
45 #include <sys/zone.h>
46 #include <sys/neti.h>
47 #include <sys/hook.h>
49 #include <sys/kmem.h>
50 #include <sys/systm.h>
51 #include <sys/param.h>
52 #include <sys/socket.h>
53 #include <sys/vtrace.h>
54 #include <sys/isa_defs.h>
55 #include <sys/atomic.h>
56 #include <sys/iphada.h>
57 #include <sys/policy.h>
58 #include <net/if.h>
59 #include <net/if_types.h>
60 #include <net/route.h>
61 #include <net/if_dl.h>
62 #include <sys/sockio.h>
63 #include <netinet/in.h>
64 #include <netinet/ip6.h>
65 #include <netinet/icmp6.h>
66 #include <netinet/sctp.h>
68 #include <inet/common.h>
69 #include <inet/mi.h>
70 #include <inet/optcom.h>
71 #include <inet/mib2.h>
72 #include <inet/nd.h>
73 #include <inet/arp.h>
75 #include <inet/ip.h>
76 #include <inet/ip_impl.h>
77 #include <inet/ip6.h>
78 #include <inet/ip6_asp.h>
79 #include <inet/tcp.h>
80 #include <inet/tcp_impl.h>
81 #include <inet/udp_impl.h>
82 #include <inet/ipp_common.h>
84 #include <inet/ip_multi.h>
85 #include <inet/ip_if.h>
86 #include <inet/ip_ire.h>
87 #include <inet/ip_rts.h>
88 #include <inet/ip_ndp.h>
89 #include <net/pfkeyv2.h>
90 #include <inet/ipsec_info.h>
91 #include <inet/sadb.h>
92 #include <inet/ipsec_impl.h>
93 #include <inet/tun.h>
94 #include <inet/sctp_ip.h>
95 #include <sys/pattr.h>
96 #include <inet/ipclassifier.h>
97 #include <inet/ipsecah.h>
98 #include <inet/rawip_impl.h>
99 #include <inet/rts_impl.h>
100 #include <sys/squeue_impl.h>
101 #include <sys/squeue.h>
103 #include <sys/tsol/label.h>
104 #include <sys/tsol/tnet.h>
106 #include <rpc/pmap_prot.h>
108 /* Temporary; for CR 6451644 work-around */
109 #include <sys/ethernet.h>
113 /*
114 * Naming conventions:
115 * These rules should be judiciously applied
116 * if there is a need to identify something as IPv6 versus IPv4
117 * IPv6 funcions will end with _v6 in the ip module.
118 * IPv6 funcions will end with _ipv6 in the transport modules.
119 * IPv6 macros:
120 * Some macros end with _V6; e.g. ILL_FRAG_HASH_V6
121 * Some macros start with V6_; e.g. V6_OR_V4_INADDR_ANY
122 * And then there are ..V4_PART_OF_V6.
123 * The intent is that macros in the ip module end with _V6.
124 * IPv6 global variables will start with ipv6_
125 * IPv6 structures will start with ipv6
126 * IPv6 defined constants should start with IPV6_
127 * (but then there are NDP_DEFAULT_VERS_PRI_AND_FLOW, etc)
128 */
130 /*
131 * ip6opt_ls is used to enable IPv6 (via /etc/system on TX systems).
132 * We need to do this because we didn't obtain the IP6OPT_LS (0x0a)
133 * from IANA. This mechanism will remain in effect until an official
134 * number is obtained.
135 */
136 uchar_t ip6opt_ls;
142 #ifdef _BIG_ENDIAN
148 #ifdef _BIG_ENDIAN
154 #ifdef _BIG_ENDIAN
160 #ifdef _BIG_ENDIAN
166 #ifdef _BIG_ENDIAN
172 #ifdef _BIG_ENDIAN
180 /* Leave room for ip_newroute to tack on the src and target addresses */
181 #define OK_RESOLVER_MP_V6(mp) \
182 ((mp) && ((mp)->b_wptr - (mp)->b_rptr) >= (2 * IPV6_ADDR_LEN))
184 #define IP6_MBLK_OK 0
185 #define IP6_MBLK_HDR_ERR 1
186 #define IP6_MBLK_LEN_ERR 2
216 ipif_t **);
218 /*
219 * A template for an IPv6 AR_ENTRY_QUERY
220 */
234 /* anything else filled in by the code */
235 };
237 /*
238 * Handle IPv6 ICMP packets sent to us. Consume the mblk passed in.
239 * The message has already been checksummed and if needed,
240 * a copy has been made to be sent any interested ICMP client (conn)
241 * Note that this is different than icmp_inbound() which does the fanout
242 * to conn's as well as local processing of the ICMP packets.
243 *
244 * All error messages are passed to the matching transport stream.
245 *
246 * Zones notes:
247 * The packet is only processed in the context of the specified zone: typically
248 * only this zone will reply to an echo request. This means that the caller must
249 * call icmp_inbound_v6() for each relevant zone.
250 */
251 static void
255 {
258 boolean_t interested;
259 in6_addr_t origsrc;
272 }
284 }
286 }
292 }
294 /*
295 * On a labeled system, we have to check whether the zone itself is
296 * permitted to receive raw traffic.
297 */
303 zoneid));
307 }
308 }
315 /* Initiate IPPF processing here */
318 /*
319 * If the ifindex changes due to SIOCSLIFINDEX
320 * packet may return to IP on the wrong ill.
321 */
326 }
328 }
329 }
348 zoneid);
356 /*
357 * We must have exclusive use of the mblk to convert it to
358 * a response.
359 * If not, we copy it.
360 */
368 ipv6IfIcmpInErrors);
372 }
378 else
380 }
382 /*
383 * Turn the echo into an echo reply.
384 * Remove any extension headers (do not reverse a source route)
385 * and clear the flow id (keep traffic class for now).
386 */
397 }
404 /*
405 * Reverse the source and destination addresses.
406 * If the return address is a multicast, zero out the source
407 * (ip_wput_v6 will set an address).
408 */
415 }
417 /* set the hop limit */
420 /*
421 * Prepare for checksum by putting icmp length in the icmp
422 * checksum field. The checksum is calculated in ip_wput_v6.
423 */
427 /*
428 * This packet should go out the same way as it
429 * came in i.e in clear. To make sure that global
430 * policy will not be applied to this in ip_wput,
431 * we attach a IPSEC_IN mp and clear ipsec_in_secure.
432 */
439 }
442 /* This is not a secure packet */
445 }
451 }
471 /* XXX may wish to pass first_mp up to ndp_input someday. */
477 ipv6IfIcmpInNeighborAdvertisements);
480 /* XXX may wish to pass first_mp up to ndp_input someday. */
490 /*
491 * As there is no upper client to deliver, we don't
492 * need the first_mp any more.
493 */
499 }
502 }
504 /*
505 * The next three icmp messages will be handled by MLD.
506 * Pass all valid MLD packets up to any process(es)
507 * listening on a raw ICMP socket. MLD messages are
508 * freed by mld_input function.
509 */
519 }
525 }
526 }
528 /*
529 * Process received IPv6 ICMP Packet too big.
530 * After updating any IRE it does the fanout to any matching transport streams.
531 * Assumes the IPv6 plus ICMPv6 headers have been pulled up but nothing else.
532 */
533 /* ARGSUSED */
534 static void
537 {
550 /*
551 * We must have exclusive use of the mblk to update the MTU
552 * in the packet.
553 * If not, we copy it.
554 *
555 * If there's an M_CTL present, we know that allocated first_mp
556 * earlier in this function, so we know first_mp has refcnt of one.
557 */
569 }
573 else
575 }
579 else
590 }
594 }
596 /*
597 * For link local destinations matching simply on IRE type is not
598 * sufficient. Same link local addresses for different ILL's is
599 * possible.
600 */
608 /* ip1dbg */
612 }
615 }
627 /*
628 * If an mtu less than IPv6 min mtu is received,
629 * we must include a fragment header in
630 * subsequent packets.
631 */
633 }
636 /* Record the new max frag size for the ULP. */
638 /*
639 * If we need a fragment header in every packet
640 * (above case or multirouting), make sure the
641 * ULP takes it into account when computing the
642 * payload size.
643 */
648 }
650 }
655 /*
656 * for non-link local destinations we match only on the IRE type
657 */
660 ipst);
663 /* ip1dbg */
667 }
670 }
684 /*
685 * If an mtu less than IPv6 min mtu is
686 * received, we must include a fragment
687 * header in subsequent packets.
688 */
690 }
694 /* Record the new max frag size for the ULP. */
696 /*
697 * If we need a fragment header in
698 * every packet (above case or
699 * multirouting), make sure the ULP
700 * takes it into account when computing
701 * the payload size.
702 */
709 }
711 }
712 }
714 }
717 }
719 /*
720 * Fanout received ICMPv6 error packets to the transports.
721 * Assumes the IPv6 plus ICMPv6 headers have been pulled up but nothing else.
722 */
723 void
726 zoneid_t zoneid)
727 {
749 }
754 /*
755 * Need to pullup everything in order to use
756 * ip_hdr_length_nexthdr_v6()
757 */
763 }
766 }
776 /* Set message type, must be done after pullups */
779 /* Try to pass the ICMP message to clients who need it */
782 /*
783 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
784 * UDP header to get the port information.
785 */
789 }
790 /*
791 * Attempt to find a client stream based on port.
792 * Note that we do a reverse lookup since the header is
793 * in the form we sent it out.
794 * The rip6h header is only used for the IPCL_UDP_MATCH_V6
795 * and we only set the src and dst addresses and nexthdr.
796 */
807 }
809 /*
810 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
811 * the TCP header to get the port information.
812 */
816 }
818 /*
819 * Attempt to find a client stream based on port.
820 * Note that we do a reverse lookup since the header is
821 * in the form we sent it out.
822 * The rip6h header is only used for the IP_TCP_*MATCH_V6 and
823 * we only set the src and dst addresses and nexthdr.
824 */
831 }
837 }
839 /*
840 * Verify we have at least ICMP_MIN_TP_HDR_LEN bytes of
841 * the SCTP header to get the port information.
842 */
846 }
859 /*
860 * We need a IPSEC_IN in the front to fanout to AH/ESP.
861 * We will re-use the IPSEC_IN if it is already present as
862 * AH/ESP will not affect any fields in the IPSEC_IN for
863 * ICMP errors. If there is no IPSEC_IN, allocate a new
864 * one and attach it in the front.
865 */
867 /*
868 * ip_fanout_proto_again converts the ICMP errors
869 * that come back from AH/ESP to M_DATA so that
870 * if it is non-AH/ESP and we do a pullupmsg in
871 * this function, it would work. Convert it back
872 * to M_CTL before we send up as this is a ICMP
873 * error. This could have been generated locally or
874 * by some router. Validate the inner IPSEC
875 * headers.
876 *
877 * NOTE : ill_index is used by ip_fanout_proto_again
878 * to locate the ill.
879 */
887 /*
888 * IPSEC_IN is not present. We attach a ipsec_in
889 * message and send up to IPSEC for validating
890 * and removing the IPSEC headers. Clear
891 * ipsec_in_secure so that when we return
892 * from IPSEC, we don't mistakenly think that this
893 * is a secure packet came from the network.
894 *
895 * NOTE : ill_index is used by ip_fanout_proto_again
896 * to locate the ill.
897 */
905 }
908 /* This is not a secure packet */
916 }
921 }
925 else
932 }
939 }
948 /*
949 * For tunnels that have used IPsec protection,
950 * we need to adjust the MTU to take into account
951 * the IPsec overhead.
952 */
958 /*
959 * Self-encapsulated case. As in the ipv4 case,
960 * we need to strip the 2nd IP header. Since mp
961 * is already pulled-up, we can simply bcopy
962 * the 3rd header + data over the 2nd header.
963 */
968 /*
969 * Make sure we don't do recursion more than once.
970 */
975 }
977 /*
978 * We are about to modify the packet. Make a copy if
979 * someone else has a reference to it.
980 */
988 }
1001 else
1003 }
1005 /*
1006 * Need to set db_type back to M_DATA before
1007 * refeeding mp into this function.
1008 */
1011 /*
1012 * Copy the 3rd header + remaining data on top
1013 * of the 2nd header.
1014 */
1018 /*
1019 * Subtract length of the 2nd header.
1020 */
1023 /*
1024 * Now recurse, and see what I _really_ should be
1025 * doing here.
1026 */
1031 }
1032 /* FALLTHRU */
1034 /*
1035 * The rip6h header is only used for the lookup and we
1036 * only set the src and dst addresses and nexthdr.
1037 */
1044 }
1045 /* NOTREACHED */
1046 drop_pkt:
1050 }
1052 /*
1053 * Process received IPv6 ICMP Redirect messages.
1054 */
1055 /* ARGSUSED */
1056 static void
1058 {
1081 else
1090 /* Verify if it is a valid redirect */
1100 }
1107 }
1115 }
1116 }
1121 }
1123 /* ipif will be refreleased afterwards */
1128 }
1130 /*
1131 * Verify that the IP source address of the redirect is
1132 * the same as the current first-hop router for the specified
1133 * ICMP destination address.
1134 * Also, Make sure we had a route for the dest in question and
1135 * that route was pointing to the old gateway (the source of the
1136 * redirect packet.)
1137 */
1142 /*
1143 * Check that
1144 * the redirect was not from ourselves
1145 * old gateway is still directly reachable
1146 */
1152 }
1158 /*
1159 * Should we use the old ULP info to create the new gateway? From
1160 * a user's perspective, we should inherit the info so that it
1161 * is a "smooth" transition. If we do not do that, then new
1162 * connections going thru the new gateway will have no route metrics,
1163 * which is counter-intuitive to user. From a network point of
1164 * view, this may or may not make sense even though the new gateway
1165 * is still directly connected to us so the route metrics should not
1166 * change much.
1167 *
1168 * But if the old ire_uinfo is not initialized, we do another
1169 * recursive lookup on the dest using the new gateway. There may
1170 * be a route to that. If so, use it to initialize the redirect
1171 * route.
1172 */
1176 /*
1177 * Only do the following if the redirection is really to
1178 * a router.
1179 */
1186 ipst);
1196 }
1197 }
1206 gateway,
1210 nce_flags,
1211 ND_STALE,
1218 /*
1219 * Check to see if link layer address has changed and
1220 * process the nce_state accordingly.
1221 */
1227 err));
1230 }
1231 }
1233 /* icmp_redirect_ok_v6() must have already verified this */
1236 /*
1237 * Create a Route Association. This will allow us to remember
1238 * a router told us to use the particular gateway.
1239 */
1241 dst,
1249 IRE_HOST,
1251 NULL,
1256 NULL,
1257 NULL,
1258 ipst);
1265 /*
1266 * Just create an on link entry, i.e. interface route.
1267 */
1284 NULL,
1285 NULL,
1286 ipst);
1287 }
1289 /* Release reference from earlier ipif_get_next_ipif() */
1297 /* tell routing sockets that we received a redirect */
1305 /*
1306 * Delete any existing IRE_HOST type ires for this destination.
1307 * This together with the added IRE has the effect of
1308 * modifying an existing redirect.
1309 */
1320 }
1321 }
1328 fail_redirect:
1332 }
1336 {
1345 else
1350 }
1354 }
1356 /*
1357 * Assigns an appropriate source address to the packet.
1358 * If origdst is one of our IP addresses that use it as the source.
1359 * If the queue is an ill queue then select a source from that ill.
1360 * Otherwise pick a source based on a route lookup back to the origsrc.
1361 *
1362 * src is the return parameter. Returns a pointer to src or NULL if failure.
1363 */
1367 {
1377 }
1381 ipst);
1383 /* Destined to one of our addresses */
1387 }
1391 }
1393 /* What is the route back to the original source? */
1400 }
1404 }
1411 }
1412 /*
1413 * Unusual case - can't find a usable source address to reach the
1414 * original source. Use what in the route to the source.
1415 */
1422 }
1427 }
1429 /*
1430 * Build and ship an IPv6 ICMP message using the packet data in mp,
1431 * and the ICMP header pointed to by "stuff". (May be called as
1432 * writer.)
1433 * Note: assumes that icmp_pkt_err_ok_v6 has been called to
1434 * verify that an icmp error packet can be sent.
1435 *
1436 * If q is an ill write side queue (which is the case when packets
1437 * arrive from ip_rput) then ip_wput code will ensure that packets to
1438 * link-local destinations are sent out that ill.
1439 *
1440 * If v6src_ptr is set use it as a source. Otherwise select a reasonable
1441 * source address (see above function).
1442 */
1443 static void
1447 {
1449 in6_addr_t v6dst;
1455 in6_addr_t v6src;
1463 }
1466 /*
1467 * If it is :
1468 *
1469 * 1) a IPSEC_OUT, then this is caused by outbound
1470 * datagram originating on this host. IPSEC processing
1471 * may or may not have been done. Refer to comments above
1472 * icmp_inbound_error_fanout for details.
1473 *
1474 * 2) a IPSEC_IN if we are generating a icmp_message
1475 * for an incoming datagram destined for us i.e called
1476 * from ip_fanout_send_icmp.
1477 */
1490 /*
1491 * Convert the IPSEC_IN to IPSEC_OUT.
1492 */
1497 }
1501 /*
1502 * Clear out ipsec_out_proc_begin, so we do a fresh
1503 * ire lookup.
1504 */
1506 }
1508 /*
1509 * This is in clear. The icmp message we are building
1510 * here should go out in clear.
1511 */
1520 }
1523 /* This is not a secure packet */
1525 /*
1526 * For trusted extensions using a shared IP address we can
1527 * send using any zoneid.
1528 */
1531 else
1535 /*
1536 * Convert the IPSEC_IN to IPSEC_OUT.
1537 */
1542 }
1543 }
1554 }
1555 }
1565 }
1567 }
1574 }
1582 /*
1583 * Set ipsec_out_icmp_loopback so we can let the ICMP messages this
1584 * node generates be accepted in peace by all on-host destinations.
1585 * If we do NOT assume that all on-host destinations trust
1586 * self-generated ICMP messages, then rework here, ip.c, and spd.c.
1587 * (Look for ipsec_out_icmp_loopback).
1588 */
1603 }
1607 /*
1608 * Prepare for checksum by putting icmp length in the icmp
1609 * checksum field. The checksum is calculated in ip_wput_v6.
1610 */
1614 }
1615 /* Send to V6 writeside put routine */
1617 }
1619 /*
1620 * Update the output mib when ICMPv6 packets are sent.
1621 */
1622 static void
1624 {
1668 ipv6IfIcmpOutNeighborAdvertisements);
1687 }
1688 }
1690 /*
1691 * Check if it is ok to send an ICMPv6 error packet in
1692 * response to the IP packet in mp.
1693 * Free the message and return null if no
1694 * ICMP error packet should be sent.
1695 */
1699 {
1707 /* Check if source address uniquely identifies the host */
1714 }
1727 ipv6IfIcmpInErrors);
1730 ipv6IfIcmpInErrors);
1732 }
1735 }
1737 }
1739 /* Explicitly do not generate errors in response to redirects */
1744 }
1745 }
1746 /*
1747 * Check that the destination is not multicast and that the packet
1748 * was not sent on link layer broadcast or multicast. (Exception
1749 * is Packet too big message as per the draft - when mcast_ok is set.)
1750 */
1755 }
1757 /*
1758 * Only send ICMP error packets every so often.
1759 * This should be done on a per port/source basis,
1760 * but for now this will suffice.
1761 */
1764 }
1766 }
1768 /*
1769 * Generate an ICMPv6 redirect message.
1770 * Include target link layer address option if it exits.
1771 * Always include redirect header.
1772 */
1773 static void
1776 {
1789 /*
1790 * We are called from ip_rput where we could
1791 * not have attached an IPSEC_IN.
1792 */
1802 }
1811 }
1827 }
1832 /* max_redir_hdr_data_len and nd_opt_rh_len must be multiple of 8 */
1833 max_redir_hdr_data_len =
1836 /* Make sure mp is 8 byte aligned */
1844 }
1847 /* ipif_v6src_addr contains the link-local source address */
1850 /* Redirects sent by router, and router is global zone */
1853 }
1856 /* Generate an ICMP time exceeded message. (May be called as writer.) */
1857 void
1861 {
1862 icmp6_t icmp6;
1863 boolean_t mctl_present;
1873 }
1879 }
1881 /*
1882 * Generate an ICMP unreachable message.
1883 */
1884 void
1888 {
1889 icmp6_t icmp6;
1890 boolean_t mctl_present;
1900 }
1906 }
1908 /*
1909 * Generate an ICMP pkt too big message.
1910 */
1911 static void
1914 {
1915 icmp6_t icmp6;
1917 boolean_t mctl_present;
1926 }
1934 }
1936 /*
1937 * Generate an ICMP parameter problem message. (May be called as writer.)
1938 * 'offset' is the offset from the beginning of the packet in error.
1939 */
1940 static void
1944 {
1945 icmp6_t icmp6;
1946 boolean_t mctl_present;
1956 }
1963 }
1965 /*
1966 * This code will need to take into account the possibility of binding
1967 * to a link local address on a multi-homed host, in which case the
1968 * outgoing interface (from the conn) will need to be used when getting
1969 * an ire for the dst. Going through proper outgoing interface and
1970 * choosing the source address corresponding to the outgoing interface
1971 * is necessary when the destination address is a link-local address and
1972 * IPV6_BOUND_IF or IPV6_PKTINFO or scope_id has been set.
1973 * This can happen when active connection is setup; thus ipp pointer
1974 * is passed here from tcp_connect_*() routines, in non-TCP cases NULL
1975 * pointer is passed as ipp pointer.
1976 */
1977 mblk_t *
1979 {
1980 ssize_t len;
1991 boolean_t local_bind;
1993 boolean_t verify_dst;
1997 /*
1998 * All Solaris components should pass a db_credp
1999 * for this TPI message, hence we ASSERT.
2000 * But in case there is some other M_PROTO that looks
2001 * like a TPI message sent by some other kernel
2002 * component, we check and return an error.
2003 */
2009 }
2017 }
2018 /* Back up and extract the protocol identifier. */
2021 /* Reset the message type in preparation for shipping it back. */
2027 /*
2028 * Check for a zero length address. This is from a protocol that
2029 * wants to register to receive all packets of its type.
2030 */
2035 NULL) {
2036 /*
2037 * TCP, SCTP, AH, and ESP have single protocol fanouts.
2038 * Do not allow others to bind to these.
2039 */
2041 }
2043 /*
2044 *
2045 * The udp module never sends down a zero-length address,
2046 * and allowing this on a labeled system will break MLP
2047 * functionality.
2048 */
2052 /* Allow ipsec plumbing */
2062 }
2064 /* Extract the address pointer from the message. */
2070 }
2074 }
2083 /* Verification of local address only */
2097 /*
2098 * Verify that both the source and destination addresses
2099 * are valid.
2100 */
2105 /* For raw socket, the local port is not set. */
2109 /* Always verify destination reachability. */
2114 /*
2115 * Verify that the source address is valid.
2116 */
2124 /*
2125 * Client that passed ipa6_conn_x_t to us specifies whether to
2126 * verify destination reachability.
2127 */
2130 }
2137 }
2140 /* Send it home. */
2144 }
2146 bad_addr:
2150 else
2153 }
2155 static void
2158 {
2159 /* Update conn_send and pktversion if v4/v6 changed */
2162 }
2164 /*
2165 * Pass the IPSEC headers size in ire_ipsec_overhead.
2166 * We can't do this in ip_bind_insert_ire because the policy
2167 * may not have been inherited at that point in time and hence
2168 * conn_out_enforce_policy may not be set.
2169 */
2175 }
2176 }
2178 /*
2179 * Here address is verified to be a valid local address.
2180 * If the IRE_DB_REQ_TYPE mp is present, a multicast
2181 * address is also considered a valid local address.
2182 * In the case of a multicast address, however, the
2183 * upper protocol is expected to reset the src address
2184 * to 0 if it sees an ire with IN6_IS_ADDR_MULTICAST returned so that
2185 * no packets are emitted with multicast address as
2186 * source address.
2187 * The addresses valid for bind are:
2188 * (1) - in6addr_any
2189 * (2) - IP address of an UP interface
2190 * (3) - IP address of a DOWN interface
2191 * (4) - a multicast address. In this case
2192 * the conn will only receive packets destined to
2193 * the specified multicast address. Note: the
2194 * application still has to issue an
2195 * IPV6_JOIN_GROUP socket option.
2196 *
2197 * In all the above cases, the bound address must be valid in the current zone.
2198 * When the address is loopback or multicast, there might be many matching IREs
2199 * so bind has to look up based on the zone.
2200 */
2201 /*
2202 * Verify the local IP address. Does not change the conn_t except
2203 * conn_fully_bound and conn_policy_cached.
2204 */
2205 static int
2208 {
2211 zoneid_t zoneid;
2213 boolean_t ire_requested;
2214 boolean_t ipsec_policy_set;
2223 /*
2224 * If it was previously connected, conn_fully_bound would have
2225 * been set.
2226 */
2234 /*
2235 * If an address other than in6addr_any is requested,
2236 * we verify that it is a valid address for bind
2237 * Note: Following code is in if-else-if form for
2238 * readability compared to a condition check.
2239 */
2241 /* LINTED - statement has no consequent */
2243 /*
2244 * (2) Bind to address of local UP interface
2245 */
2249 /*
2250 * (4) bind to multicast address.
2251 * Fake out the IRE returned to upper
2252 * layer to be a broadcast IRE in
2253 * ip_bind_insert_ire_v6().
2254 * Pass other information that matches
2255 * the ipif (e.g. the source address).
2256 * conn_multicast_ill is only used for
2257 * IPv6 packets
2258 */
2265 /*
2266 * Look for default like
2267 * ip_wput_v6
2268 */
2271 }
2283 }
2288 /*
2289 * Not a valid address for bind
2290 */
2292 }
2293 }
2296 /* Red Alert! Attempting to be a bogon! */
2298 /* ip1dbg */
2301 }
2303 }
2304 }
2306 /*
2307 * Allow setting new policies. For example, disconnects come
2308 * down as ipa_t bind. As we would have set conn_policy_cached
2309 * to B_TRUE before, we should set it to B_FALSE, so that policy
2310 * can change after the disconnect.
2311 */
2314 /* If not fanout_insert this was just an address verification */
2316 /*
2317 * The addresses have been verified. Time to insert in
2318 * the correct fanout list.
2319 */
2325 }
2329 ipst)) {
2332 }
2338 }
2339 }
2340 }
2341 bad_addr:
2346 B_FALSE);
2347 }
2349 }
2357 /*
2358 * As of now assume that nothing else accompanies
2359 * IPSEC_POLICY_SET.
2360 */
2362 }
2365 }
2366 int
2369 {
2371 boolean_t ire_requested;
2376 /*
2377 * Note that we allow connect to broadcast and multicast
2378 * address when ire_requested is set. Thus the ULP
2379 * has to check for IRE_BROADCAST and multicast.
2380 */
2389 /* Bind to IPv4 address */
2390 ipaddr_t v4src;
2395 fanout_insert);
2403 }
2409 }
2415 bad_addr:
2419 }
2421 /*
2422 * Verify that both the source and destination addresses
2423 * are valid. If verify_dst, then destination address must also be reachable,
2424 * i.e. have a route. Protocols like TCP want this. Tunnels do not.
2425 * It takes ip6_pkt_t * as one of the arguments to determine correct
2426 * source address when IPV6_PKTINFO or scope_id is set along with a link-local
2427 * destination address. Note that parameter ipp is only useful for TCP connect
2428 * when scope_id is set or IPV6_PKTINFO option is set with an ifindex. For all
2429 * non-TCP cases, it is NULL and for all other tcp cases it is not useful.
2430 *
2431 */
2432 int
2437 {
2446 zoneid_t zoneid;
2460 }
2465 /*
2466 * If we never got a disconnect before, clear it now.
2467 */
2475 /*
2476 * Use an "emulated" IRE_BROADCAST to tell the transport it
2477 * is a multicast.
2478 * Pass other information that matches
2479 * the ipif (e.g. the source address).
2480 *
2481 * conn_multicast_ill is only used for IPv6 packets
2482 */
2488 /* Look for default like ip_wput_v6 */
2490 }
2497 /* ip1dbg */
2500 v6dst);
2501 }
2504 }
2512 ipst);
2513 /*
2514 * We also prevent ire's with src address INADDR_ANY to
2515 * be used, which are created temporarily for
2516 * sending out packets from endpoints that have
2517 * conn_unspec_src set.
2518 */
2522 /*
2523 * When verifying destination reachability, we always
2524 * complain.
2525 *
2526 * When not verifying destination reachability but we
2527 * found an IRE, i.e. the destination is reachable,
2528 * then the other tests still apply and we complain.
2529 */
2532 /* ip1dbg */
2535 v6dst);
2536 }
2542 }
2544 }
2545 }
2546 }
2548 /*
2549 * We now know that routing will allow us to reach the destination.
2550 * Check whether Trusted Solaris policy allows communication with this
2551 * host, and pretend that the destination is unreachable if not.
2552 *
2553 * This is never a problem for TCP, since that transport is known to
2554 * compute the label properly as part of the tcp_rput_other T_BIND_ACK
2555 * handling. If the remote is unreachable, it will be detected at that
2556 * point, so there's no reason to check it here.
2557 *
2558 * Note that for sendto (and other datagram-oriented friends), this
2559 * check is done as part of the data path label computation instead.
2560 * The check here is just to make non-TCP connect() report the right
2561 * error.
2562 */
2571 }
2573 }
2575 /*
2576 * If the app does a connect(), it means that it will most likely
2577 * send more than 1 packet to the destination. It makes sense
2578 * to clear the temporary flag.
2579 */
2585 /*
2586 * We need to recheck for IRE_MARK_TEMPORARY after acquiring
2587 * the lock in order to guarantee irb_tmp_ire_cnt.
2588 */
2592 }
2594 }
2598 /*
2599 * See if we should notify ULP about MDT; we do this whether or not
2600 * ire_requested is TRUE, in order to handle active connects; MDT
2601 * eligibility tests for passive connects are handled separately
2602 * through tcp_adapt_ire(). We do this before the source address
2603 * selection, because dst_ire may change after a call to
2604 * ipif_select_source_v6(). This is a best-effort check, as the
2605 * packet for this connection may not actually go through
2606 * dst_ire->ire_stq, and the exact IRE can only be known after
2607 * calling ip_newroute_v6(). This is why we further check on the
2608 * IRE during Multidata packet transmission in tcp_multisend().
2609 */
2617 }
2633 else
2636 }
2641 }
2656 /*
2657 * Pick a source address so that a proper inbound load
2658 * spreading would happen. Use dst_ill specified by the
2659 * app. when socket option or scopeid is set.
2660 */
2664 uint_t if_index;
2666 /*
2667 * Scope id or IPV6_PKTINFO
2668 */
2673 ipst);
2679 }
2682 /*
2683 * For IPV6_BOUND_IF socket option,
2684 * conn_outgoing_ill should be set
2685 * already in TCP or UDP/ICMP.
2686 */
2694 }
2697 /* No need to hold ill here */
2700 /* No need to hold ill here */
2702 }
2706 zoneid);
2710 "no usable source address for "
2715 }
2720 }
2721 }
2722 }
2724 /*
2725 * We do ire_route_lookup_v6() here (and not an interface lookup)
2726 * as we assert that v6src should only come from an
2727 * UP interface for hard binding.
2728 */
2732 /* src_ire must be a local|loopback */
2735 /* ip1dbg */
2738 }
2741 }
2743 /*
2744 * If the source address is a loopback address, the
2745 * destination had best be local or multicast.
2746 * The transports that can't handle multicast will reject
2747 * those addresses.
2748 */
2755 }
2756 /*
2757 * Allow setting new policies. For example, disconnects come
2758 * down as ipa_t bind. As we would have set conn_policy_cached
2759 * to B_TRUE before, we should set it to B_FALSE, so that policy
2760 * can change after the disconnect.
2761 */
2764 /*
2765 * The addresses have been verified. Initialize the conn
2766 * before calling the policy as they expect the conns
2767 * initialized.
2768 */
2778 /*
2779 * Note that sire will not be NULL if this is an off-link
2780 * connection and there is not cache for that dest yet.
2781 *
2782 * XXX Because of an existing bug, if there are multiple
2783 * default routes, the IRE returned now may not be the actual
2784 * default route used (default routes are chosen in a
2785 * round robin fashion). So if the metrics for different
2786 * default routes are different, we may return the wrong
2787 * metrics. This will not be a problem if the existing
2788 * bug is fixed.
2789 */
2794 ipst)) {
2797 }
2802 }
2803 }
2805 /*
2806 * Cache IPsec policy in this conn. If we have per-socket policy,
2807 * we'll cache that. If we don't, we'll inherit global policy.
2808 *
2809 * We can't insert until the conn reflects the policy. Note that
2810 * conn_policy_cached is set by ipsec_conn_cache_policy() even for
2811 * connections where we don't have a policy. This is to prevent
2812 * global policy lookups in the inbound path.
2813 *
2814 * If we insert before we set conn_policy_cached,
2815 * CONN_INBOUND_POLICY_PRESENT_V6() check can still evaluate true
2816 * because global policy cound be non-empty. We normally call
2817 * ipsec_check_policy() for conn_policy_cached connections only if
2818 * conn_in_enforce_policy is set. But in this case,
2819 * conn_policy_cached can get set anytime since we made the
2820 * CONN_INBOUND_POLICY_PRESENT_V6() check and ipsec_check_policy()
2821 * is called, which will make the above assumption false. Thus, we
2822 * need to insert after we set conn_policy_cached.
2823 */
2827 /* If not fanout_insert this was just an address verification */
2829 /*
2830 * The addresses have been verified. Time to insert in
2831 * the correct fanout list.
2832 */
2836 }
2839 /*
2840 * Our initial checks for MDT have passed; the IRE is not
2841 * LOCAL/LOOPBACK/BROADCAST, and the link layer seems to
2842 * be supporting MDT. Pass the IRE, IPC and ILL into
2843 * ip_mdinfo_return(), which performs further checks
2844 * against them and upon success, returns the MDT info
2845 * mblk which we will attach to the bind acknowledgment.
2846 */
2858 }
2859 }
2860 }
2861 }
2862 bad_addr:
2866 /*
2867 * As of now assume that nothing else accompanies
2868 * IPSEC_POLICY_SET.
2869 */
2871 }
2872 refrele_and_quit:
2886 }
2888 /* ARGSUSED */
2889 int
2894 {
2897 boolean_t ire_requested;
2900 /*
2901 * Note that we allow connect to broadcast and multicast
2902 * address when ire_requested is set. Thus the ULP
2903 * has to check for IRE_BROADCAST and multicast.
2904 */
2911 /* For raw socket, the local port is not set. */
2914 /*
2915 * Bind to local and remote address. Local might be
2916 * unspecified in which case it will be extracted from
2917 * ire_src_addr_v6
2918 */
2920 /* Connect to IPv4 address */
2921 ipaddr_t v4src;
2922 ipaddr_t v4dst;
2924 /* Is the source unspecified or mapped? */
2930 }
2934 /* Always verify destination reachability. */
2951 }
2956 /* Send it home. */
2959 bad_addr:
2963 }
2965 /*
2966 * Get the ire in *mpp. Returns false if it fails (due to lack of space).
2967 * Makes the IRE be IRE_BROADCAST if dst is a multicast address.
2968 */
2969 /* ARGSUSED4 */
2970 static boolean_t
2973 {
2980 /*
2981 * mp initialized above to IRE_DB_REQ_TYPE
2982 * appended mblk. Its <upper protocol>'s
2983 * job to make sure there is room.
2984 */
2996 }
3000 }
3003 /*
3004 * No IRE was found. Remove IRE mblk.
3005 */
3008 }
3010 }
3012 /*
3013 * Add an ip6i_t header to the front of the mblk.
3014 * Inline if possible else allocate a separate mblk containing only the ip6i_t.
3015 * Returns NULL if allocation fails (and frees original message).
3016 * Used in outgoing path when going through ip_newroute_*v6().
3017 * Used in incoming path to pass ifindex to transports.
3018 */
3019 mblk_t *
3021 {
3034 }
3039 }
3045 /*
3046 * If `ill' is in an IPMP group, make sure we use the IPMP
3047 * interface index so that e.g. IPV6_RECVPKTINFO will get the
3048 * IPMP interface index and not an underlying interface index.
3049 */
3052 else
3056 }
3059 }
3061 /*
3062 * Handle protocols with which IP is less intimate. There
3063 * can be more than one stream bound to a particular
3064 * protocol. When this is the case, normally each one gets a copy
3065 * of any incoming packets.
3066 * However, if the packet was tunneled and not multicast we only send to it
3067 * the first match.
3068 *
3069 * Zones notes:
3070 * Packets will be distributed to streams in all zones. This is really only
3071 * useful for ICMPv6 as only applications in the global zone can create raw
3072 * sockets for other protocols.
3073 */
3074 static void
3078 {
3083 boolean_t one_only;
3097 }
3099 /*
3100 * If the packet was tunneled and not multicast we only send to it
3101 * the first match.
3102 */
3108 /*
3109 * We don't allow multilevel ports for raw IP, so no need to
3110 * check for that here.
3111 */
3113 }
3121 zoneid) &&
3124 connp)))
3126 }
3129 /*
3130 * No one bound to this port. Is
3131 * there a client that wants all
3132 * unclaimed datagrams?
3133 */
3139 }
3142 }
3149 /*
3150 * XXX: Fix the multiple protocol listeners case. We should not
3151 * be walking the conn->next list here.
3152 */
3154 /*
3155 * Only send message to one tunnel driver by immediately
3156 * terminating the loop.
3157 */
3162 }
3172 }
3174 /*
3175 * Just copy the data part alone. The mctl part is
3176 * needed just for verifying policy and it is never
3177 * sent up.
3178 */
3182 /*
3183 * No more intested clients or memory
3184 * allocation failed
3185 */
3188 }
3194 /*
3195 * For link-local always add ifindex so that transport can set
3196 * sin6_scope_id. Avoid it for ICMP error fanout.
3197 */
3201 /* Add header */
3203 }
3211 rawipIfStatsInOverflows);
3214 ipv6IfIcmpInOverflows);
3215 }
3219 /*
3220 * Don't enforce here if we're a tunnel - let "tun" do
3221 * it instead.
3222 */
3225 secure)) {
3228 }
3233 ipIfStatsHCInDelivers);
3235 }
3236 }
3238 /* Follow the next pointer before releasing the conn. */
3242 }
3244 /* Last one. Send it upstream. */
3247 /* Initiate IPPF processing */
3249 uint_t ifindex;
3260 }
3261 }
3263 /*
3264 * For link-local always add ifindex so that transport can set
3265 * sin6_scope_id. Avoid it for ICMP error fanout.
3266 */
3269 /* Add header */
3281 }
3282 }
3292 }
3297 /*
3298 * Tunneled packet. We enforce policy in the tunnel
3299 * module itself.
3300 *
3301 * Send the WHOLE packet up (incl. IPSEC_IN) without
3302 * a policy check.
3303 */
3307 }
3308 /*
3309 * Don't enforce here if we're a tunnel - let "tun" do
3310 * it instead.
3311 */
3319 }
3320 }
3325 }
3327 }
3329 /*
3330 * Send an ICMP error after patching up the packet appropriately. Returns
3331 * non-zero if the appropriate MIB should be bumped; zero otherwise.
3332 */
3333 int
3337 {
3340 boolean_t secure;
3350 /*
3351 * If this is an ICMP error being reported - which goes
3352 * up as M_CTLs, we need to convert them to M_DATA till
3353 * we finish checking with global policy because
3354 * ipsec_check_global_policy() assumes M_DATA as clear
3355 * and M_CTL as secure.
3356 */
3360 }
3361 /*
3362 * We are generating an icmp error for some inbound packet.
3363 * Called from all ip_fanout_(udp, tcp, proto) functions.
3364 * Before we generate an error, check with global policy
3365 * to see whether this is allowed to enter the system. As
3366 * there is no "conn", we are checking with global policy.
3367 */
3374 }
3384 }
3385 }
3396 #ifdef DEBUG
3398 /*NOTREACHED*/
3399 #else
3402 #endif
3403 }
3407 }
3410 }
3413 /*
3414 * Fanout for TCP packets
3415 * The caller puts <fport, lport> in the ports parameter.
3416 */
3417 static void
3420 {
3422 boolean_t secure;
3436 }
3442 /*
3443 * No hard-bound match. Send Reset.
3444 */
3450 /* Initiate IPPf processing, if needed. */
3459 }
3460 }
3467 }
3474 /*
3475 * For fused tcp loopback, assign the eager's
3476 * squeue to be that of the active connect's.
3477 */
3486 }
3491 /*
3492 * db_cksumstuff is unused in the incoming
3493 * path; Thus store the ifindex here. It will
3494 * be cleared in tcp_conn_create_v6().
3495 */
3499 }
3500 }
3508 }
3514 }
3519 }
3527 }
3533 STRUIO_POLICY;
3539 STRUIO_POLICY;
3540 }
3542 /*
3543 * Discard first_mp early since we're dealing with a
3544 * fully-connected conn_t and tcp doesn't do policy in
3545 * this case. Also, if someone is bound to IPPROTO_TCP
3546 * over raw IP, they don't expect to see a M_CTL.
3547 */
3551 }
3553 }
3554 }
3556 /* Initiate IPPF processing */
3558 uint_t ifindex;
3568 }
3571 /*
3572 * ip_add_info_v6 might return a new mp.
3573 */
3578 }
3579 }
3581 /*
3582 * For link-local always add ifindex so that TCP can bind to that
3583 * interface. Avoid it for ICMP error fanout.
3584 */
3588 /* Add header */
3601 }
3602 }
3609 /* SOCK_RAW, IPPROTO_TCP case */
3612 }
3613 }
3615 /*
3616 * Fanout for UDP packets.
3617 * The caller puts <fport, lport> in the ports parameter.
3618 * ire_type must be IRE_BROADCAST for multicast and broadcast packets.
3619 *
3620 * If SO_REUSEADDR is set all multicast and broadcast packets
3621 * will be delivered to all streams bound to the same port.
3622 *
3623 * Zones notes:
3624 * Multicast packets will be distributed to streams in all zones.
3625 */
3626 static void
3629 zoneid_t zoneid)
3630 {
3632 in6_addr_t dst;
3634 boolean_t secure;
3640 in6_addr_t src;
3641 boolean_t shared_addr;
3652 }
3654 /* Extract ports in net byte order */
3662 /*
3663 * No need to handle exclusive-stack zones since ALL_ZONES
3664 * only applies to the shared stack.
3665 */
3667 /*
3668 * If no shared MLP is found, tsol_mlp_findzone returns
3669 * ALL_ZONES. In that case, we assume it's SLP, and
3670 * search for the zone based on the packet label.
3671 * That will also return ALL_ZONES on failure, but
3672 * we never allow conn_zoneid to be set to ALL_ZONES.
3673 */
3676 }
3678 /* Attempt to find a client stream based on destination port. */
3683 /*
3684 * Not multicast. Send to the one (first) client we find.
3685 */
3692 }
3694 }
3700 connp))
3703 /* Found a client */
3712 }
3719 }
3720 }
3721 /* Initiate IPPF processing */
3723 uint_t ifindex;
3734 }
3735 }
3736 /*
3737 * For link-local always add ifindex so that
3738 * transport can set sin6_scope_id. Avoid it for
3739 * ICMP error fanout.
3740 */
3744 /* Add header */
3756 }
3757 }
3760 /* Send it upstream */
3768 }
3775 connp)))
3778 }
3797 }
3798 /*
3799 * Just copy the data part alone. The mctl part is
3800 * needed just for verifying policy and it is never
3801 * sent up.
3802 */
3806 /*
3807 * No more interested clients or memory
3808 * allocation failed
3809 */
3812 }
3816 /*
3817 * For link-local always add ifindex so that transport
3818 * can set sin6_scope_id. Avoid it for ICMP error
3819 * fanout.
3820 */
3824 /* Add header */
3826 }
3827 /* mp1 could have changed */
3830 else
3837 }
3843 }
3846 first_mp1 = ipsec_check_inbound_policy
3848 mctl_present);
3849 }
3855 /* Send it upstream */
3857 }
3858 next_one:
3860 /* Follow the next pointer before releasing the conn. */
3865 }
3867 /* Last one. Send it upstream. */
3870 /* Initiate IPPF processing */
3872 uint_t ifindex;
3882 }
3884 }
3885 }
3887 /*
3888 * For link-local always add ifindex so that transport can set
3889 * sin6_scope_id. Avoid it for ICMP error fanout.
3890 */
3893 /* Add header */
3905 }
3906 }
3919 }
3920 }
3923 /* Send it upstream */
3925 }
3932 notfound:
3934 /*
3935 * No one bound to this port. Is
3936 * there a client that wants all
3937 * unclaimed datagrams?
3938 */
3942 zoneid);
3948 }
3949 }
3950 }
3952 /*
3953 * int ip_find_hdr_v6()
3954 *
3955 * This routine is used by the upper layer protocols and the IP tunnel
3956 * module to:
3957 * - Set extension header pointers to appropriate locations
3958 * - Determine IPv6 header length and return it
3959 * - Return a pointer to the last nexthdr value
3960 *
3961 * The caller must initialize ipp_fields.
3962 *
3963 * NOTE: If multiple extension headers of the same type are present,
3964 * ip_find_hdr_v6() will set the respective extension header pointers
3965 * to the first one that it encounters in the IPv6 header. It also
3966 * skips fragment headers. This routine deals with malformed packets
3967 * of various sorts in which case the returned length is up to the
3968 * malformed part.
3969 */
3970 int
3972 {
3987 /* Is there enough left for len + nexthdr? */
3998 /* return only 1st hbh */
4003 }
4011 /*
4012 * ipp_dstopts is set to the destination header after a
4013 * routing header.
4014 * Assume it is a post-rthdr destination header
4015 * and adjust when we find an rthdr.
4016 */
4021 }
4029 /* return only 1st rthdr */
4034 }
4035 /*
4036 * Make any destination header we've seen be a
4037 * pre-rthdr destination header.
4038 */
4046 }
4058 }
4063 }
4066 }
4067 done:
4071 }
4073 int
4075 {
4083 }
4086 }
4090 }
4092 /*
4093 * Try to determine where and what are the IPv6 header length and
4094 * pointer to nexthdr value for the upper layer protocol (or an
4095 * unknown next hdr).
4096 *
4097 * Parameters returns a pointer to the nexthdr value;
4098 * Must handle malformed packets of various sorts.
4099 * Function returns failure for malformed cases.
4100 */
4101 boolean_t
4104 {
4106 uint_t ehdrlen;
4121 /* Is there enough left for len + nexthdr? */
4128 /* Assumes the headers are identical for hbh and dst */
4150 /* No next header means we're finished */
4155 }
4160 }
4166 /*
4167 * If any know extension headers are still to be processed,
4168 * the packet's malformed (or at least all the IP header(s) are
4169 * not in the same mblk - and that should never happen.
4170 */
4174 /*
4175 * If we get here, we know that all of the IP headers were in
4176 * the same mblk, even if the ULP header is in the next mblk.
4177 */
4181 }
4182 }
4184 /*
4185 * Return the length of the IPv6 related headers (including extension headers)
4186 * Returns a length even if the packet is malformed.
4187 */
4188 int
4190 {
4196 }
4198 /*
4199 * IPv6 -
4200 * ip_newroute_v6 is called by ip_rput_data_v6 or ip_wput_v6 whenever we need
4201 * to send out a packet to a destination address for which we do not have
4202 * specific routing information.
4203 *
4204 * Handle non-multicast packets. If ill is non-NULL the match is done
4205 * for that ill.
4206 *
4207 * When a specific ill is specified (using IPV6_PKTINFO,
4208 * IPV6_MULTICAST_IF, or IPV6_BOUND_IF) we will only match
4209 * on routing entries (ftable and ctable) that have a matching
4210 * ire->ire_ipif->ipif_ill. Thus this can only be used
4211 * for destinations that are on-link for the specific ill
4212 * and that can appear on multiple links. Thus it is useful
4213 * for multicast destinations, link-local destinations, and
4214 * at some point perhaps for site-local destinations (if the
4215 * node sits at a site boundary).
4216 * We create the cache entries in the regular ctable since
4217 * it can not "confuse" things for other destinations.
4218 *
4219 * NOTE : These are the scopes of some of the variables that point at IRE,
4220 * which needs to be followed while making any future modifications
4221 * to avoid memory leaks.
4222 *
4223 * - ire and sire are the entries looked up initially by
4224 * ire_ftable_lookup_v6.
4225 * - ipif_ire is used to hold the interface ire associated with
4226 * the new cache ire. But it's scope is limited, so we always REFRELE
4227 * it before branching out to error paths.
4228 * - save_ire is initialized before ire_create, so that ire returned
4229 * by ire_create will not over-write the ire. We REFRELE save_ire
4230 * before breaking out of the switch.
4231 *
4232 * Thus on failures, we have to REFRELE only ire and sire, if they
4233 * are not NULL.
4234 */
4235 /* ARGSUSED */
4236 void
4239 {
4240 in6_addr_t v6gw;
4241 in6_addr_t dst;
4256 in6_addr_t save_dst;
4259 boolean_t multirt_is_resolvable;
4260 boolean_t multirt_resolve_next;
4265 tsol_gcgrp_addr_t ga;
4276 }
4286 }
4288 /*
4289 * If this IRE is created for forwarding or it is not for
4290 * TCP traffic, mark it as temporary.
4291 *
4292 * Is it sufficient just to check the next header??
4293 */
4297 /*
4298 * Get what we can from ire_ftable_lookup_v6 which will follow an IRE
4299 * chain until it gets the most specific information available.
4300 * For example, we know that there is no IRE_CACHE for this dest,
4301 * but there may be an IRE_OFFSUBNET which specifies a gateway.
4302 * ire_ftable_lookup_v6 will look up the gateway, etc.
4303 */
4316 /*
4317 * Because nce_xmit() calls ip_output_v6() and NCEs are always
4318 * tied to an underlying interface, IS_UNDER_IPMP() may be
4319 * true even when building IREs that will be used for data
4320 * traffic. As such, use the packet's source address to
4321 * determine whether the traffic is test traffic, and set
4322 * MATCH_IRE_MARK_TESTHIDDEN if so.
4323 */
4327 }
4331 }
4336 /*
4337 * We enter a loop that will be run only once in most cases.
4338 * The loop is re-entered in the case where the destination
4339 * can be reached through multiple RTF_MULTIRT-flagged routes.
4340 * The intention is to compute multiple routes to a single
4341 * destination in a single ip_newroute_v6 call.
4342 * The information is contained in sire->ire_flags.
4343 */
4350 }
4354 }
4360 /*
4361 * We check if there are trailing unresolved routes for
4362 * the destination contained in sire.
4363 */
4372 /*
4373 * No more multirt routes to resolve; give up
4374 * (all routes resolved or no more resolvable
4375 * routes).
4376 */
4380 }
4384 /*
4385 * We simply use first_sire as a flag that
4386 * indicates if a resolvable multirt route has
4387 * already been found during the preceding
4388 * loops. If it is not the case, we may have
4389 * to send an ICMP error to report that the
4390 * destination is unreachable. We do not
4391 * IRE_REFHOLD first_sire.
4392 */
4395 }
4396 }
4397 }
4399 /*
4400 * either ire == NULL (the destination cannot be
4401 * resolved) or ire == sire (the gateway cannot be
4402 * resolved). At this point, there are no more routes
4403 * to resolve for the destination, thus we exit.
4404 */
4406 /* ip2dbg */
4409 }
4417 }
4420 /*
4421 * At least one multirt route has been found
4422 * in the same ip_newroute() call; there is no
4423 * need to report an ICMP error.
4424 * first_sire was not IRE_REFHOLDed.
4425 */
4429 }
4433 }
4437 /*
4438 * Verify that the returned IRE does not have either the
4439 * RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is
4440 * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER.
4441 */
4446 /*
4447 * Increment the ire_ob_pkt_count field for ire if it is an
4448 * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and
4449 * increment the same for the parent IRE, sire, if it is some
4450 * sort of prefix IRE (which includes DEFAULT, PREFIX, and HOST)
4451 */
4455 }
4467 }
4469 /*
4470 * We have a route to reach the destination. Find the
4471 * appropriate ill, then get a source address that matches the
4472 * right scope via ipif_select_source_v6().
4473 *
4474 * If we are here trying to create an IRE_CACHE for an offlink
4475 * destination and have an IRE_CACHE entry for VNI, then use
4476 * ire_stq instead since VNI's queue is a black hole.
4477 *
4478 * Note: While we pick a dst_ill we are really only interested
4479 * in the ill for load spreading. The source ipif is
4480 * determined by source address selection below.
4481 */
4490 dst_ill =
4495 }
4496 }
4502 }
4504 }
4508 /*
4509 * We should have found a route matching "ill"
4510 * as we called ire_ftable_lookup_v6 with
4511 * MATCH_IRE_ILL. Rather than asserting when
4512 * there is a mismatch, we just drop the packet.
4513 */
4518 }
4520 /*
4521 * Pick a source address which matches the scope of the
4522 * destination address.
4523 * For RTF_SETSRC routes, the source address is imposed by the
4524 * parent ire (sire).
4525 */
4528 /*
4529 * Because nce_xmit() calls ip_output_v6() and NCEs are always
4530 * tied to the underlying interface, IS_UNDER_IPMP() may be
4531 * true even when building IREs that will be used for data
4532 * traffic. As such, see if the packet's source address is a
4533 * test address, and if so use that test address's ipif for
4534 * the IRE so that the logic that sets IRE_MARK_TESTHIDDEN in
4535 * ire_add_v6() can work properly.
4536 */
4543 /*
4544 * The ire cache entry we're adding is for the
4545 * gateway itself. The source address in this case
4546 * is relative to the gateway's address.
4547 */
4555 /*
4556 * Check that the ipif matching the requested
4557 * source address still exists.
4558 */
4562 }
4570 }
4571 }
4575 /* ip1dbg */
4580 }
4582 }
4585 /* ip2dbg */
4588 }
4592 /*
4593 * At this point in ip_newroute_v6(), ire is either the
4594 * IRE_CACHE of the next-hop gateway for an off-subnet
4595 * destination or an IRE_INTERFACE type that should be used
4596 * to resolve an on-subnet destination or an on-subnet
4597 * next-hop gateway.
4598 *
4599 * In the IRE_CACHE case, we have the following :
4600 *
4601 * 1) src_ipif - used for getting a source address.
4602 *
4603 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
4604 * means packets using this IRE_CACHE will go out on dst_ill.
4605 *
4606 * 3) The IRE sire will point to the prefix that is the longest
4607 * matching route for the destination. These prefix types
4608 * include IRE_DEFAULT, IRE_PREFIX, IRE_HOST.
4609 *
4610 * The newly created IRE_CACHE entry for the off-subnet
4611 * destination is tied to both the prefix route and the
4612 * interface route used to resolve the next-hop gateway
4613 * via the ire_phandle and ire_ihandle fields, respectively.
4614 *
4615 * In the IRE_INTERFACE case, we have the following :
4616 *
4617 * 1) src_ipif - used for getting a source address.
4618 *
4619 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
4620 * means packets using the IRE_CACHE that we will build
4621 * here will go out on dst_ill.
4622 *
4623 * 3) sire may or may not be NULL. But, the IRE_CACHE that is
4624 * to be created will only be tied to the IRE_INTERFACE that
4625 * was derived from the ire_ihandle field.
4626 *
4627 * If sire is non-NULL, it means the destination is off-link
4628 * and we will first create the IRE_CACHE for the gateway.
4629 * Next time through ip_newroute_v6, we will create the
4630 * IRE_CACHE for the final destination as described above.
4631 */
4642 }
4643 /*
4644 * We need 3 ire's to create a new cache ire for an
4645 * off-link destination from the cache ire of the
4646 * gateway.
4647 *
4648 * 1. The prefix ire 'sire'
4649 * 2. The cache ire of the gateway 'ire'
4650 * 3. The interface ire 'ipif_ire'
4651 *
4652 * We have (1) and (2). We lookup (3) below.
4653 *
4654 * If there is no interface route to the gateway,
4655 * it is a race condition, where we found the cache
4656 * but the inteface route has been deleted.
4657 */
4663 }
4665 /*
4666 * Note: the new ire inherits RTF_SETSRC
4667 * and RTF_MULTIRT to propagate these flags from prefix
4668 * to cache.
4669 */
4671 /*
4672 * Check cached gateway IRE for any security
4673 * attributes; if found, associate the gateway
4674 * credentials group to the destination IRE.
4675 */
4681 }
4692 IRE_CACHE,
4693 src_ipif,
4700 NULL,
4701 gcgrp,
4702 ipst);
4708 }
4712 }
4714 /* reference now held by IRE */
4719 /*
4720 * Prevent sire and ipif_ire from getting deleted. The
4721 * newly created ire is tied to both of them via the
4722 * phandle and ihandle respectively.
4723 */
4725 /* Has it been removed already ? */
4731 }
4734 /* Has it been removed already ? */
4741 }
4749 }
4750 }
4755 }
4758 /* Assert that sire is not deleted yet. */
4762 /* Assert that ipif_ire is not deleted yet. */
4768 /*
4769 * Search for the next unresolved
4770 * multirt route.
4771 */
4775 /* re-enter the loop */
4778 }
4783 }
4785 /*
4786 * We have what we need to build an IRE_CACHE.
4787 *
4788 * handle the Gated case, where we create
4789 * a NORESOLVER route for loopback.
4790 */
4793 /*
4794 * TSol note: We are creating the ire cache for the
4795 * destination 'dst'. If 'dst' is offlink, going
4796 * through the first hop 'gw', the security attributes
4797 * of 'dst' must be set to point to the gateway
4798 * credentials of gateway 'gw'. If 'dst' is onlink, it
4799 * is possible that 'dst' is a potential gateway that is
4800 * referenced by some route that has some security
4801 * attributes. Thus in the former case, we need to do a
4802 * gcgrp_lookup of 'gw' while in the latter case we
4803 * need to do gcgrp_lookup of 'dst' itself.
4804 */
4808 else
4812 /*
4813 * Note: the new ire inherits sire flags RTF_SETSRC
4814 * and RTF_MULTIRT to propagate those rules from prefix
4815 * to cache.
4816 */
4826 IRE_CACHE,
4827 src_ipif,
4836 NULL,
4837 gcgrp,
4838 ipst);
4844 }
4847 }
4849 /* reference now held by IRE */
4856 else
4862 }
4864 /* Prevent save_ire from getting deleted */
4866 /* Has it been removed already ? */
4871 }
4874 /*
4875 * In case of MULTIRT, a copy of the current packet
4876 * to send is made to further re-enter the
4877 * loop and attempt another route resolution
4878 */
4884 }
4885 }
4890 }
4892 /* Assert that it is not deleted yet. */
4898 /*
4899 * If we found a (no)resolver, we ignore any
4900 * trailing top priority IRE_CACHE in
4901 * further loops. This ensures that we do not
4902 * omit any (no)resolver despite the priority
4903 * in this call.
4904 * IRE_CACHE, if any, will be processed
4905 * by another thread entering ip_newroute(),
4906 * (on resolver response, for example).
4907 * We use this to force multiple parallel
4908 * resolution as soon as a packet needs to be
4909 * sent. The result is, after one packet
4910 * emission all reachable routes are generally
4911 * resolved.
4912 * Otherwise, complete resolution of MULTIRT
4913 * routes would require several emissions as
4914 * side effect.
4915 */
4918 /*
4919 * Search for the next unresolved multirt
4920 * route.
4921 */
4925 /* re-enter the loop */
4928 }
4930 /* Don't need sire anymore */
4938 /*
4939 * We can't build an IRE_CACHE yet, but at least we
4940 * found a resolver that can help.
4941 */
4944 /*
4945 * To be at this point in the code with a non-zero gw
4946 * means that dst is reachable through a gateway that
4947 * we have never resolved. By changing dst to the gw
4948 * addr we resolve the gateway first. When
4949 * ire_add_then_send() tries to put the IP dg to dst,
4950 * it will reenter ip_newroute() at which time we will
4951 * find the IRE_CACHE for the gw and create another
4952 * IRE_CACHE above (for dst itself).
4953 */
4958 }
4960 /*
4961 * Ask the external resolver to do its thing.
4962 * Make an mblk chain in the following form:
4963 * ARQ_REQ_MBLK-->IRE_MBLK-->packet
4964 */
4974 }
4979 /* source address */
4984 IRE_CACHE,
4985 src_ipif,
4989 /* Interface handle */
4992 NULL,
4993 NULL,
4994 ipst);
5001 }
5005 /*
5006 * processing a copy of the packet to
5007 * send for further resolution loops
5008 */
5012 }
5015 /*
5016 * Now create or find an nce for this interface.
5017 * The hw addr will need to to be set from
5018 * the reply to the AR_ENTRY_QUERY that
5019 * we're about to send. This will be done in
5020 * ire_add_v6().
5021 */
5025 /*
5026 * New cache entry created.
5027 * Break, then ask the external
5028 * resolver.
5029 */
5032 /*
5033 * Resolution in progress;
5034 * packet has been queued by
5035 * ndp_resolver().
5036 */
5039 /*
5040 * Check if another multirt
5041 * route must be resolved.
5042 */
5044 /*
5045 * If we found a resolver, we
5046 * ignore any trailing top
5047 * priority IRE_CACHE in
5048 * further loops. The reason is
5049 * the same as for noresolver.
5050 */
5051 multirt_flags &=
5053 /*
5054 * Search for the next
5055 * unresolved multirt route.
5056 */
5061 M_CTL) {
5063 }
5066 /*
5067 * re-enter the loop
5068 */
5069 multirt_resolve_next =
5070 B_TRUE;
5072 }
5080 /*
5081 * Transient error; packet will be
5082 * freed.
5083 */
5087 }
5090 /*
5091 * Now set up the AR_ENTRY_QUERY and send it.
5092 */
5101 }
5109 /*
5110 * link the chain, then send up to the resolver.
5111 */
5117 /*
5118 * Check if another multirt route
5119 * must be resolved.
5120 */
5123 /*
5124 * If we find a resolver, we ignore any
5125 * trailing top priority IRE_CACHE in
5126 * further loops. The reason is the
5127 * same as for noresolver.
5128 */
5130 /*
5131 * Search for the next unresolved
5132 * multirt route.
5133 */
5139 }
5142 /*
5143 * re-enter the loop
5144 */
5147 }
5154 }
5155 /*
5156 * Non-external resolver case.
5157 *
5158 * TSol note: Please see the note above the
5159 * IRE_IF_NORESOLVER case.
5160 */
5174 IRE_CACHE,
5175 src_ipif,
5181 NULL,
5182 gcgrp,
5183 ipst);
5189 }
5192 }
5194 /* reference now held by IRE */
5202 }
5208 /* Prevent save_ire from getting deleted */
5210 /* Has it been removed already ? */
5215 }
5217 /*
5218 * We have a resolved cache entry,
5219 * add in the IRE.
5220 */
5225 }
5227 /* Assert that it is not deleted yet. */
5231 /*
5232 * Check if another multirt route
5233 * must be resolved.
5234 */
5237 /*
5238 * If we find a resolver, we ignore any
5239 * trailing top priority IRE_CACHE in
5240 * further loops. The reason is the
5241 * same as for noresolver.
5242 */
5244 /*
5245 * Search for the next unresolved
5246 * multirt route.
5247 */
5253 }
5256 /*
5257 * re-enter the loop
5258 */
5261 }
5270 /*
5271 * mp was consumed - presumably queued.
5272 * No need for ire, presumably resolution is
5273 * in progress, and ire will be added when the
5274 * address is resolved.
5275 */
5279 }
5283 /*
5284 * Check if another multirt route
5285 * must be resolved.
5286 */
5289 /*
5290 * If we find a resolver, we ignore any
5291 * trailing top priority IRE_CACHE in
5292 * further loops. The reason is the
5293 * same as for noresolver.
5294 */
5296 /*
5297 * Search for the next unresolved
5298 * multirt route.
5299 */
5305 }
5308 /*
5309 * re-enter the loop
5310 */
5313 }
5320 /* Some transient error */
5324 }
5328 }
5332 }
5335 err_ret:
5342 }
5348 }
5357 }
5358 }
5359 /* Did this packet originate externally? */
5363 }
5367 }
5376 icmp_err_ret:
5384 }
5388 /*
5389 * We need to set sire to NULL to avoid double freeing if we
5390 * ever goto err_ret from below.
5391 */
5394 /* Skip ip6i_t header if present */
5396 /* Make sure the IPv6 header is present */
5402 }
5403 }
5406 }
5407 /* Did this packet originate externally? */
5413 }
5422 }
5424 /* Failed */
5428 }
5436 }
5437 }
5442 /*
5443 * At this point we will have ire only if RTF_BLACKHOLE
5444 * or RTF_REJECT flags are set on the IRE. It will not
5445 * generate ICMP6_DST_UNREACH_NOROUTE if RTF_BLACKHOLE is set.
5446 */
5453 }
5457 }
5459 }
5461 /* ip2dbg */
5464 }
5467 }
5469 /*
5470 * ip_newroute_ipif_v6 is called by ip_wput_v6 and ip_wput_ipsec_out_v6 whenever
5471 * we need to send out a packet to a destination address for which we do not
5472 * have specific routing information. It is only used for multicast packets.
5473 *
5474 * If unspec_src we allow creating an IRE with source address zero.
5475 * ire_send_v6() will delete it after the packet is sent.
5476 */
5477 void
5480 zoneid_t zoneid)
5481 {
5494 boolean_t multirt_resolve_next;
5500 /*
5501 * This loop is run only once in most cases.
5502 * We loop to resolve further routes only when the destination
5503 * can be reached through multiple RTF_MULTIRT-flagged ires.
5504 */
5510 }
5515 }
5521 /* ip1dbg */
5526 }
5535 }
5537 /*
5538 * If the interface is a pt-pt interface we look for an
5539 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER that matches both the
5540 * local_address and the pt-pt destination address.
5541 * Otherwise we just match the local address.
5542 */
5545 }
5547 /*
5548 * We check if an IRE_OFFSUBNET for the addr that goes through
5549 * ipif exists. We need it to determine if the RTF_SETSRC and/or
5550 * RTF_MULTIRT flags must be honored.
5551 */
5554 "ipif_lookup_multi_ire_v6("
5561 /*
5562 * Because nce_xmit() calls ip_output_v6() and NCEs are always
5563 * tied to the underlying interface, IS_UNDER_IPMP() may be
5564 * true even when building IREs that will be used for data
5565 * traffic. As such, see if the packet's source address is a
5566 * test address, and if so use that test address's ipif for
5567 * the IRE so that the logic that sets IRE_MARK_TESTHIDDEN in
5568 * ire_add_v6() can work properly.
5569 */
5573 /*
5574 * Determine the outbound (destination) ill for this route.
5575 * If IPMP is not in use, that's the same as our ill. If IPMP
5576 * is in-use and we're on the IPMP interface, or we're on an
5577 * underlying ill but sending data traffic, use a suitable
5578 * destination ill from the group. The latter case covers a
5579 * subtle edge condition with multicast: when we bring up an
5580 * IPv6 data address, we will create an NCE on an underlying
5581 * interface, and send solitications to ff02::1, which would
5582 * take us through here, and cause us to create an IRE for
5583 * ff02::1. To meet our defined semantics for multicast (and
5584 * ensure there aren't unexpected echoes), that IRE needs to
5585 * use the IPMP group's nominated multicast interface.
5586 *
5587 * Note: the source ipif is determined by source address
5588 * selection later.
5589 */
5599 }
5607 else
5614 }
5621 }
5623 }
5625 /*
5626 * Pick a source address which matches the scope of the
5627 * destination address.
5628 * For RTF_SETSRC routes, the source address is imposed by the
5629 * parent ire (fire).
5630 */
5634 /*
5635 * Check that the ipif matching the requested source
5636 * address still exists.
5637 */
5640 }
5646 }
5651 /* ip1dbg */
5657 }
5659 }
5665 }
5670 /* ip1dbg */
5675 }
5677 }
5686 /* ip1dbg */
5689 }
5695 /*
5696 * an IRE_OFFSUBET was looked up
5697 * on that interface.
5698 * this ire has RTF_MULTIRT flag,
5699 * so the resolution loop
5700 * will be re-entered to resolve
5701 * additional routes on other
5702 * interfaces. For that purpose,
5703 * a copy of the packet is
5704 * made at this point.
5705 */
5710 }
5711 }
5715 /*
5716 * We have what we need to build an IRE_CACHE.
5717 *
5718 * handle the Gated case, where we create
5719 * a NORESOLVER route for loopback.
5720 */
5723 /*
5724 * The newly created ire will inherit the flags of the
5725 * parent ire, if any.
5726 */
5736 IRE_CACHE,
5737 src_ipif,
5738 NULL,
5746 NULL,
5747 NULL,
5748 ipst);
5753 }
5759 }
5761 /* Prevent save_ire from getting deleted */
5763 /* Has it been removed already ? */
5768 }
5774 }
5776 /* Assert that it is not deleted yet. */
5783 }
5785 /*
5786 * The resolution loop is re-entered if we
5787 * actually are in a multirouting case.
5788 */
5790 boolean_t need_resolve =
5798 /*
5799 * ipif_lookup_group_v6() calls
5800 * ire_lookup_multi_v6() that uses
5801 * ire_ftable_lookup_v6() to find
5802 * an IRE_INTERFACE for the group.
5803 * In the multirt case,
5804 * ire_lookup_multi_v6() then invokes
5805 * ire_multirt_lookup_v6() to find
5806 * the next resolvable ire.
5807 * As a result, we obtain a new
5808 * interface, derived from the
5809 * next ire.
5810 */
5814 }
5825 multirt_resolve_next =
5826 B_TRUE;
5830 }
5831 }
5832 }
5837 }
5841 }
5846 /*
5847 * We obtain a partial IRE_CACHE which we will pass
5848 * along with the resolver query. When the response
5849 * comes back it will be there ready for us to add.
5850 */
5851 /*
5852 * the newly created ire will inherit the flags of the
5853 * parent ire, if any.
5854 */
5864 IRE_CACHE,
5865 src_ipif,
5866 NULL,
5874 NULL,
5875 NULL,
5876 ipst);
5881 }
5883 /* Resolve and add ire to the ctable */
5887 /* Prevent save_ire from getting deleted */
5889 /* Has it been removed already ? */
5894 }
5895 /*
5896 * We have a resolved cache entry,
5897 * add in the IRE.
5898 */
5903 }
5905 /* Assert that it is not deleted yet. */
5912 }
5914 /*
5915 * The resolution loop is re-entered if we
5916 * actually are in a multirouting case.
5917 */
5919 boolean_t need_resolve =
5927 /*
5928 * ipif_lookup_group_v6() calls
5929 * ire_lookup_multi_v6() that
5930 * uses ire_ftable_lookup_v6()
5931 * to find an IRE_INTERFACE for
5932 * the group. In the multirt
5933 * case, ire_lookup_multi_v6()
5934 * then invokes
5935 * ire_multirt_lookup_v6() to
5936 * find the next resolvable ire.
5937 * As a result, we obtain a new
5938 * interface, derived from the
5939 * next ire.
5940 */
5944 }
5948 "multirt dst %08x, "
5957 multirt_resolve_next =
5958 B_TRUE;
5962 }
5963 }
5964 }
5969 }
5975 /*
5976 * mp was consumed - presumably queued.
5977 * No need for ire, presumably resolution is
5978 * in progress, and ire will be added when the
5979 * address is resolved.
5980 */
5984 }
5990 }
5992 /*
5993 * The resolution loop is re-entered if we
5994 * actually are in a multirouting case.
5995 */
5997 boolean_t need_resolve =
6005 /*
6006 * ipif_lookup_group_v6() calls
6007 * ire_lookup_multi_v6() that
6008 * uses ire_ftable_lookup_v6()
6009 * to find an IRE_INTERFACE for
6010 * the group. In the multirt
6011 * case, ire_lookup_multi_v6()
6012 * then invokes
6013 * ire_multirt_lookup_v6() to
6014 * find the next resolvable ire.
6015 * As a result, we obtain a new
6016 * interface, derived from the
6017 * next ire.
6018 */
6022 }
6026 "multirt dst %08x, "
6035 multirt_resolve_next =
6036 B_TRUE;
6040 }
6041 }
6042 }
6047 }
6052 /* Some transient error */
6055 }
6057 }
6060 }
6064 }
6067 err_ret:
6079 /* Multicast - no point in trying to generate ICMP error */
6083 }
6088 }
6095 }
6097 /*
6098 * Parse and process any hop-by-hop or destination options.
6099 *
6100 * Assumes that q is an ill read queue so that ICMP errors for link-local
6101 * destinations are sent out the correct interface.
6102 *
6103 * Returns -1 if there was an error and mp has been consumed.
6104 * Returns 0 if no special action is needed.
6105 * Returns 1 if the packet contained a router alert option for this node
6106 * which is verified to be "interesting/known" for our implementation.
6107 *
6108 * XXX Note: In future as more hbh or dest options are defined,
6109 * it may be better to have different routines for hbh and dest
6110 * options as opt_type fields other than IP6OPT_PAD1 and IP6OPT_PADN
6111 * may have same value in different namespaces. Or is it same namespace ??
6112 * Current code checks for each opt_type (other than pads) if it is in
6113 * the expected nexthdr (hbh or dest)
6114 */
6115 static int
6118 {
6120 uint_t optused;
6124 zoneid_t zoneid;
6131 }
6147 /*
6148 * Note:We don't verify that (N-2) pad octets
6149 * are zero as required by spec. Adhere to
6150 * "be liberal in what you accept..." part of
6151 * implementation philosophy (RFC791,RFC1122)
6152 */
6172 /* Check total length and alignment */
6176 /* Check value */
6181 }
6183 }
6185 /*
6186 * Minimal support for the home address option
6187 * (which is required by all IPv6 nodes).
6188 * Implement by just swapping the home address
6189 * and source address.
6190 * XXX Note: this has IPsec implications since
6191 * AH needs to take this into account.
6192 * Also, when IPsec is used we need to ensure
6193 * that this is only processed once
6194 * in the received packet (to avoid swapping
6195 * back and forth).
6196 * NOTE:This option processing is considered
6197 * to be unsafe and prone to a denial of
6198 * service attack.
6199 * The current processing is not safe even with
6200 * IPsec secured IP packets. Since the home
6201 * address option processing requirement still
6202 * is in the IETF draft and in the process of
6203 * being redefined for its usage, it has been
6204 * decided to turn off the option by default.
6205 * If this section of code needs to be executed,
6206 * ndd variable ip6_ignore_home_address_opt
6207 * should be set to 0 at the user's own risk.
6208 */
6210 in6_addr_t tmp;
6221 /*
6222 * We did this dest. opt the first time
6223 * around (i.e. before AH processing).
6224 * If we've done AH... stop now.
6225 */
6232 }
6235 /* Check total length and alignment */
6239 /* Swap ip6_src and the home address */
6241 /* XXX Note: only 8 byte alignment option */
6245 }
6250 }
6254 }
6257 }
6262 /* FALLTHROUGH */
6263 opt_error:
6264 /* Determine which zone should send error */
6286 }
6288 ICMP6_PARAMPROB_OPTION,
6294 /*
6295 * If we don't have a zone and the dst
6296 * addr is multicast, then pick a zone
6297 * based on the inbound interface.
6298 */
6304 B_TRUE,
6305 IPV6_PREFER_SRC_DEFAULT,
6306 ALL_ZONES);
6308 zoneid =
6311 }
6312 }
6316 }
6318 ICMP6_PARAMPROB_OPTION,
6325 }
6326 }
6327 }
6330 }
6333 bad_opt:
6334 /* Determine which zone should send error */
6342 }
6344 }
6346 /*
6347 * Process a routing header that is not yet empty.
6348 * Only handles type 0 routing headers.
6349 */
6350 static void
6353 {
6355 uint_t ehdrlen;
6356 uint_t numaddr;
6358 in6_addr_t tmp;
6364 /* XXX Check for source routed out same interface? */
6370 }
6375 /* Sent by forwarding path, and router is global zone */
6377 ICMP6_PARAMPROB_HEADER,
6381 }
6386 /* rthdr->ip6r0_len is twice the number of addresses in the header */
6388 /* An odd length is impossible */
6391 /* Sent by forwarding path, and router is global zone */
6393 ICMP6_PARAMPROB_HEADER,
6397 }
6400 /* segleft exceeds number of addresses in routing header */
6403 /* Sent by forwarding path, and router is global zone */
6405 ICMP6_PARAMPROB_HEADER,
6410 }
6418 }
6419 /* Swap */
6424 /* Don't allow any mapped addresses - ip_wput_v6 can't handle them */
6428 /* Sent by forwarding path, and router is global zone */
6432 }
6438 }
6440 hada_drop:
6441 /* IPsec kstats: bean counter? */
6444 }
6446 /*
6447 * Read side put procedure for IPv6 module.
6448 */
6449 void
6451 {
6470 /*
6471 * Things are opening or closing - only accept DLPI
6472 * ack messages. If the stream is closing and ip_wsrv
6473 * has completed, ip_close is out of the qwait, but has
6474 * not yet completed qprocsoff. Don't proceed any further
6475 * because the ill has been cleaned up and things hanging
6476 * off the ill have been freed.
6477 */
6482 }
6483 }
6493 /*
6494 * This is a work-around for CR 6451644, a bug in Nemo. It
6495 * should be removed when that problem is fixed.
6496 */
6504 else
6506 /*
6507 * If it's a group address, then fabricate a
6508 * DL_UNITDATA_IND message.
6509 */
6534 }
6535 }
6537 }
6542 DL_UNITDATA_IND) {
6543 /* Go handle anything other than data elsewhere. */
6546 }
6549 /* Save the DLPI header. */
6556 /*NOTREACHED*/
6572 /* Go through qwriter */
6577 }
6578 /* FALLTHRU */
6586 }
6597 }
6616 }
6623 }
6624 /* FALLTHRU */
6628 }
6632 /*
6633 * if db_ref > 1 then copymsg and free original. Packet may be
6634 * changed and do not want other entity who has a reference to this
6635 * message to trip over the changes. This is a blind change because
6636 * trying to catch all places that might change packet is too
6637 * difficult (since it may be a module above this one).
6638 */
6647 }
6649 }
6654 }
6659 }
6663 /*
6664 * ip:::receive must see ipv6 packets with a full header,
6665 * and so is placed after the IP6_MBLK_HDR_ERR check.
6666 */
6674 }
6689 /*
6690 * Attach any necessary label information to this packet.
6691 */
6697 }
6699 /* IP observability hook. */
6701 zoneid_t dzone;
6704 ALL_ZONES);
6707 }
6710 IPV6_DEFAULT_VERS_AND_FLOW) {
6711 /*
6712 * It may be a bit too expensive to do this mapped address
6713 * check here, but in the interest of robustness, it seems
6714 * like the correct place.
6715 * TODO: Avoid this check for e.g. connected TCP sockets
6716 */
6720 }
6728 }
6735 }
6739 discard:
6744 }
6746 /*
6747 * Walk through the IPv6 packet in mp and see if there's an AH header
6748 * in it. See if the AH header needs to get done before other headers in
6749 * the packet. (Worker function for ipsec_early_ah_v6().)
6750 */
6751 #define IPSEC_HDR_DONT_PROCESS 0
6752 #define IPSEC_HDR_PROCESS 1
6754 static int
6756 {
6757 uint_t length;
6758 uint_t ehdrlen;
6766 /*
6767 * For now just pullup everything. In general, the less pullups,
6768 * the better, but there's so much squirrelling through anyway,
6769 * it's just easier this way.
6770 */
6773 }
6780 /*
6781 * We can't just use the argument nexthdr in the place
6782 * of nexthdrp becaue we don't dereference nexthdrp
6783 * till we confirm whether it is a valid address.
6784 */
6787 /* Is there enough left for len + nexthdr? */
6794 /* Assumes the headers are identical for hbh and dst */
6799 /*
6800 * Return DONT_PROCESS because the destination
6801 * options header may be for each hop in a
6802 * routing-header, and we only want AH if we're
6803 * finished with routing headers.
6804 */
6812 /*
6813 * If there's more hops left on the routing header,
6814 * return now with DON'T PROCESS.
6815 */
6825 /* Wait for reassembly */
6831 /* No next header means we're finished */
6834 }
6837 }
6838 /*
6839 * Malformed/truncated packet.
6840 */
6842 }
6844 /*
6845 * Path for AH if options are present. If this is the first time we are
6846 * sending a datagram to AH, allocate a IPSEC_IN message and prepend it.
6847 * Otherwise, just fanout. Return value answers the boolean question:
6848 * "Did I consume the mblk you sent me?"
6849 *
6850 * Sometimes AH needs to be done before other IPv6 headers for security
6851 * reasons. This function (and its ipsec_needs_processing_v6() above)
6852 * indicates if that is so, and fans out to the appropriate IPsec protocol
6853 * for the datagram passed in.
6854 */
6855 static boolean_t
6858 {
6863 ipsec_status_t ipsec_rc;
6879 }
6881 /* Default means send it to AH! */
6893 }
6894 /*
6895 * Store the ill_index so that when we come back
6896 * from IPSEC we ride on the same queue.
6897 */
6902 }
6903 /*
6904 * Cache hardware acceleration info.
6905 */
6912 }
6917 }
6928 /* we're done with IPsec processing, send it up */
6935 /* no action needed */
6937 }
6939 }
6941 /*
6942 * Validate the IPv6 mblk for alignment.
6943 */
6944 int
6946 {
6950 /* check for alignment and full IPv6 header */
6957 }
6959 }
6966 else
6970 /*
6971 * Check for bogus (too short packet) and packet which
6972 * was padded by the link layer.
6973 */
6975 ssize_t diff;
6982 }
6989 }
6990 }
6992 }
6994 /*
6995 * ip_rput_data_v6 -- received IPv6 packets in M_DATA messages show up here.
6996 * ip_rput_v6 has already verified alignment, the min length, the version,
6997 * and db_ref = 1.
6998 *
6999 * The ill passed in (the arg named inill) is the ill that the packet
7000 * actually arrived on. We need to remember this when saving the
7001 * input interface index into potential IPV6_PKTINFO data in
7002 * ip_add_info_v6().
7003 *
7004 * This routine doesn't free dl_mp; that's the caller's responsibility on
7005 * return. (Note that the callers are complex enough that there's no tail
7006 * recursion here anyway.)
7007 */
7008 void
7011 {
7019 uint_t prev_nexthdr_offset;
7020 uint_t used;
7024 uint_t hdr_len;
7025 boolean_t mctl_present;
7028 boolean_t no_forward;
7036 boolean_t cksum_err;
7043 /*
7044 * It's an IPsec accelerated packet.
7045 * Keep a pointer to the data attributes around until
7046 * we allocate the ipsecinfo structure.
7047 */
7051 /*
7052 * Since it is accelerated, it came directly from
7053 * the ill.
7054 */
7057 }
7065 else
7068 /* Clear checksum flags in case we need to forward */
7079 /* Process hop by hop header options */
7081 uint_t ehdrlen;
7093 }
7096 }
7111 }
7115 }
7123 /*
7124 * Packet has been consumed and any
7125 * needed ICMP messages sent.
7126 */
7131 /* no action needed */
7134 /* Known router alert */
7136 }
7137 }
7139 /*
7140 * On incoming v6 multicast packets we will bypass the ire table,
7141 * and assume that the read queue corresponds to the targetted
7142 * interface.
7143 *
7144 * The effect of this is the same as the IPv4 original code, but is
7145 * much cleaner I think. See ip_rput for how that was done.
7146 */
7151 /*
7152 * So that we don't end up with dups, only one ill in an IPMP
7153 * group is nominated to receive multicast data traffic.
7154 * However, link-locals on any underlying interfaces will have
7155 * joined their solicited-node multicast addresses and we must
7156 * accept those packets. (We don't attempt to precisely
7157 * filter out duplicate solicited-node multicast packets since
7158 * e.g. an IPMP interface and underlying interface may have
7159 * the same solicited-node multicast address.) Note that we
7160 * won't generally have duplicates because we only issue a
7161 * DL_ENABMULTI_REQ on one interface in a group; the exception
7162 * is when PHYI_MULTI_BCAST is set.
7163 */
7167 }
7169 /*
7170 * XXX TODO Give to mrouted to for multicast forwarding.
7171 */
7175 /* ip2dbg */
7179 }
7184 }
7186 /* ip2dbg */
7189 }
7192 }
7196 /*
7197 * If a packet was received on an interface that is a 6to4 tunnel,
7198 * incoming IPv6 packets, with a 6to4 addressed IPv6 destination, must
7199 * be checked to have a 6to4 prefix (2002:V4ADDR::/48) that is equal to
7200 * the 6to4 prefix of the address configured on the receiving interface.
7201 * Otherwise, the packet was delivered to this interface in error and
7202 * the packet must be dropped.
7203 */
7209 /* ip1dbg */
7211 "addressed packet which is not for us: "
7213 }
7217 }
7218 }
7220 /*
7221 * Find an ire that matches destination. For link-local addresses
7222 * we have to match the ill.
7223 * TBD for site local addresses.
7224 */
7236 /*
7237 * Should only use IREs that are visible from the
7238 * global zone for forwarding.
7239 */
7243 }
7244 }
7247 /*
7248 * No matching IRE found. Mark this packet as having
7249 * originated externally.
7250 */
7255 ipIfStatsInAddrErrors);
7256 }
7260 }
7264 /* Sent by forwarding path, and router is global zone */
7269 }
7270 /*
7271 * Per RFC 3513 section 2.5.2, we must not forward packets with
7272 * an unspecified source address.
7273 */
7279 }
7286 }
7287 /* we have a matching IRE */
7289 /*
7290 * To be quicker, we may wish not to chase pointers
7291 * (ire->ire_ipif->ipif_ill...) and instead store the
7292 * forwarding policy in the ire. An unfortunate side-
7293 * effect of this would be requiring an ire flush whenever
7294 * the ILLF_ROUTER flag changes. For now, chase pointers
7295 * once and store in the boolean no_forward.
7296 *
7297 * This appears twice to keep it out of the non-forwarding,
7298 * yes-it's-for-us-on-the-right-interface case.
7299 */
7304 /*
7305 * This ire has a send-to queue - forward the packet.
7306 */
7312 ipIfStatsInAddrErrors);
7313 }
7317 }
7318 /*
7319 * ipIfStatsHCInForwDatagrams should only be increment if there
7320 * will be an attempt to forward the packet, which is why we
7321 * increment after the above condition has been checked.
7322 */
7326 /* Sent by forwarding path, and router is global zone */
7332 }
7333 /*
7334 * Per RFC 3513 section 2.5.2, we must not forward packets with
7335 * an unspecified source address.
7336 */
7342 }
7349 ipIfStatsForwProhibits);
7353 }
7354 /* Size may have changed */
7358 }
7363 /*
7364 * Handle labeled packet resizing.
7365 */
7369 }
7371 /* Sent by forwarding path, and router is global zone */
7376 }
7378 /*
7379 * Check to see if we're forwarding the packet to a
7380 * different link from which it came. If so, check the
7381 * source and destination addresses since routers must not
7382 * forward any packets with link-local source or
7383 * destination addresses to other links. Otherwise (if
7384 * we're forwarding onto the same link), conditionally send
7385 * a redirect message.
7386 */
7392 ipIfStatsInAddrErrors);
7396 }
7397 /* TBD add site-local check at site boundary? */
7400 in6_addr_t gw_addr_v6;
7403 /*
7404 * Don't send a redirect when forwarding a source
7405 * routed packet.
7406 */
7415 /*
7416 * We won't send redirects to a router
7417 * that doesn't have a link local
7418 * address, but will forward.
7419 */
7422 ipIfStatsInAddrErrors);
7424 }
7427 }
7433 ipst);
7436 /*
7437 * The source is directly connected.
7438 */
7444 }
7446 }
7447 }
7449 forward:
7450 /* Hoplimit verified above */
7470 }
7473 }
7475 /*
7476 * Need to put on correct queue for reassembly to find it.
7477 * No need to use put() since reassembly has its own locks.
7478 * Note: multicast packets and packets destined to addresses
7479 * assigned to loopback (ire_rfq is NULL) will be reassembled on
7480 * the arriving ill. Unlike the IPv4 case, enabling strict
7481 * destination multihoming will prevent accepting packets
7482 * addressed to an IRE_LOCAL on lo0.
7483 */
7491 }
7496 }
7497 }
7502 /* Don't use the ire after this point, we'll NULL it out to be sure. */
7505 ipv6forus:
7506 /*
7507 * Looks like this packet is for us one way or another.
7508 * This is where we'll process destination headers etc.
7509 */
7522 }
7525 /* TCP needs all of the TCP header */
7533 ipIfStatsInDiscards);
7536 }
7540 }
7541 /*
7542 * Extract the offset field from the TCP header.
7543 */
7550 ipIfStatsInDiscards);
7553 }
7554 /*
7555 * There must be TCP options.
7556 * Make sure we can grab them.
7557 */
7566 ipIfStatsInDiscards);
7569 }
7573 }
7574 }
7577 /*
7578 * TCP checksum calculation. First sum up the
7579 * pseudo-header fields:
7580 * - Source IPv6 address
7581 * - Destination IPv6 address
7582 * - TCP payload length
7583 * - TCP protocol ID
7584 */
7591 /* Fold initial sum */
7609 ip6_tcp_in_full_hw_cksum_err);
7612 ip6_tcp_in_part_hw_cksum_err);
7615 }
7618 }
7619 tcp_fanout:
7624 }
7626 {
7634 /* SCTP needs all of the SCTP header */
7637 }
7642 ipIfStatsInDiscards);
7645 }
7648 }
7651 /* checksum */
7659 }
7666 mctl_present,
7670 }
7675 }
7685 }
7687 /* Verify that at least the ports are present */
7694 ipIfStatsInDiscards);
7697 }
7701 }
7703 /*
7704 * Before going through the regular checksum
7705 * calculation, make sure the received checksum
7706 * is non-zero. RFC 2460 says, a 0x0000 checksum
7707 * in a UDP packet (within IPv6 packet) is invalid
7708 * and should be replaced by 0xffff. This makes
7709 * sense as regular checksum calculation will
7710 * pass for both the cases i.e. 0x0000 and 0xffff.
7711 * Removing one of the case makes error detection
7712 * stronger.
7713 */
7716 /* 0x0000 checksum is invalid */
7720 udpIfStatsInCksumErrs);
7723 }
7727 /*
7728 * UDP checksum calculation. First sum up the
7729 * pseudo-header fields:
7730 * - Source IPv6 address
7731 * - Destination IPv6 address
7732 * - UDP payload length
7733 * - UDP protocol ID
7734 */
7742 /* Fold initial sum */
7758 }
7765 udpIfStatsInCksumErrs);
7769 ip6_udp_in_full_hw_cksum_err);
7772 ip6_udp_in_part_hw_cksum_err);
7773 else
7778 }
7780 }
7789 }
7800 /* IPv6 ICMP checksum failed */
7803 sum));
7806 ipv6IfIcmpInErrors);
7809 }
7811 icmp_fanout:
7812 /* Check variable for testing applications */
7816 }
7817 /*
7818 * Assume that there is always at least one conn for
7819 * ICMPv6 (in.ndpd) i.e. don't optimize the case
7820 * where there is no conn.
7821 */
7824 ilm_walker_t ilw;
7827 /*
7828 * In the multicast case, applications may have
7829 * joined the group from different zones, so we
7830 * need to deliver the packet to each of them.
7831 * Loop through the multicast memberships
7832 * structures (ilm) on the receive ill and send
7833 * a copy of the packet up each matching one.
7834 */
7853 }
7861 }
7862 }
7863 /* FALLTHRU */
7865 /*
7866 * Handle protocols with which IPv6 is less intimate.
7867 */
7873 }
7875 /*
7876 * Enable sending ICMP for "Unknown" nexthdr
7877 * case. i.e. where we did not FALLTHRU from
7878 * IPPROTO_ICMPV6 processing case above.
7879 * If we did FALLTHRU, then the packet has already been
7880 * processed for IPPF, don't process it again in
7881 * ip_fanout_proto_v6; set IP6_NO_IPPOLICY in the
7882 * flags
7883 */
7886 else
7893 }
7896 uint_t ehdrlen;
7900 /* If packet is too short, look no further */
7904 /* Check if AH is present. */
7908 }
7910 /*
7911 * Reinitialize pointers, as ipsec_early_ah_v6() does
7912 * complete pullups. We don't have to do more pullups
7913 * as a result.
7914 */
7927 /*
7928 * Note: XXX This code does not seem to make
7929 * distinction between Destination Options Header
7930 * being before/after Routing Header which can
7931 * happen if we are at the end of source route.
7932 * This may become significant in future.
7933 * (No real significant Destination Options are
7934 * defined/implemented yet ).
7935 */
7939 /*
7940 * Packet has been consumed and any needed
7941 * ICMP errors sent.
7942 */
7947 /* No action needed continue */
7950 /*
7951 * Unnexpected return value
7952 * (Router alert is a Hop-by-Hop option)
7953 */
7954 #ifdef DEBUG
7957 /*NOTREACHED*/
7958 #else
7963 #endif
7964 }
7967 }
7975 }
7986 ipIfStatsInDiscards);
7989 }
7993 }
7999 /*
8000 * Invoke the CGTP (multirouting) filtering module to
8001 * process the incoming packet. Packets identified as
8002 * duplicates must be discarded. Filtering is active
8003 * only if the the ip_cgtp_filter ndd variable is
8004 * non-zero.
8005 */
8009 netstackid_t stackid;
8013 cgtp_flt_pkt =
8020 }
8021 }
8023 /* Restore the flags */
8030 /* Reassembly is still pending */
8032 }
8033 /* The first mblk are the headers before the frag hdr */
8046 }
8051 }
8052 /*
8053 * Illegal header sequence.
8054 * (Hop-by-hop headers are processed above
8055 * and required to immediately follow IPv6 header)
8056 */
8058 ICMP6_PARAMPROB_NEXTHEADER,
8059 prev_nexthdr_offset,
8062 }
8064 uint_t ehdrlen;
8067 /* If packet is too short, look no further */
8071 /* Check if AH is present. */
8075 }
8077 /*
8078 * Reinitialize pointers, as ipsec_early_ah_v6() does
8079 * complete pullups. We don't have to do more pullups
8080 * as a result.
8081 */
8094 /* Not end of source route */
8097 ipIfStatsForwProhibits);
8101 }
8105 }
8108 }
8111 /*
8112 * Fast path for AH/ESP. If this is the first time
8113 * we are sending a datagram to AH/ESP, allocate
8114 * a IPSEC_IN message and prepend it. Otherwise,
8115 * just fanout.
8116 */
8131 ipIfStatsInDiscards);
8134 }
8135 /*
8136 * Store the ill_index so that when we come back
8137 * from IPSEC we ride on the same queue.
8138 */
8145 /*
8146 * Cache hardware acceleration info.
8147 */
8155 }
8158 }
8164 }
8166 /* select inbound SA and have IPsec process the pkt */
8174 NULL);
8184 NULL);
8187 }
8194 /* FALLTHRU */
8197 }
8198 /* we're done with IPsec processing, send it up */
8201 }
8203 /* All processing is done. Count as "delivered". */
8208 }
8212 }
8213 /* NOTREACHED */
8215 pkt_too_short:
8222 udp_fanout:
8227 ipst);
8231 }
8232 }
8238 UDP_PORTS_OFFSET);
8242 zoneid);
8244 }
8252 }
8254 /* Initiate IPPF processing */
8261 }
8262 }
8271 }
8272 }
8277 /* Send it upstream */
8284 hada_drop:
8286 /* IPsec kstats: bump counter here */
8289 }
8291 /*
8292 * Reassemble fragment.
8293 * When it returns a completed message the first mblk will only contain
8294 * the headers prior to the fragment header.
8295 *
8296 * prev_nexthdr_offset is an offset indication of where the nexthdr field is
8297 * of the preceding header. This is needed to patch the previous header's
8298 * nexthdr field when reassembly completes.
8299 */
8304 {
8307 boolean_t more_frags;
8311 uint_t end;
8312 uint_t hdr_length;
8332 /*
8333 * We utilize hardware computed checksum info only for UDP since
8334 * IP fragmentation is a normal occurence for the protocol. In
8335 * addition, checksum offload support for IP fragments carrying
8336 * UDP payload is commonly implemented across network adapters.
8337 */
8344 /* Record checksum information from the packet */
8348 /* fragmented payload offset from beginning of mblk */
8356 /*
8357 * Partial checksum has been calculated by hardware
8358 * and attached to the packet; in addition, any
8359 * prepended extraneous data is even byte aligned.
8360 * If any such data exists, we adjust the checksum;
8361 * this would also handle any postpended data.
8362 */
8366 /* One's complement subtract extraneous checksum */
8369 else
8371 }
8375 }
8377 /* Clear hardware checksumming flag */
8380 /*
8381 * Note: Fragment offset in header is in 8-octet units.
8382 * Clearing least significant 3 bits not only extracts
8383 * it but also gets it in units of octets.
8384 */
8388 /*
8389 * Is the more frags flag on and the payload length not a multiple
8390 * of eight?
8391 */
8393 zoneid_t zoneid;
8400 }
8405 }
8414 /*
8415 * Would fragment cause reassembled packet to have a payload length
8416 * greater than IP_MAXPACKET - the max payload size?
8417 */
8419 zoneid_t zoneid;
8426 }
8431 }
8433 /*
8434 * This packet just has one fragment. Reassembly not
8435 * needed.
8436 */
8439 }
8441 /*
8442 * Drop the fragmented as early as possible, if
8443 * we don't have resource(s) to re-assemble.
8444 */
8448 }
8450 /* Record the ECN field info. */
8452 /*
8453 * If this is not the first fragment, dump the unfragmentable
8454 * portion of the packet.
8455 */
8459 /*
8460 * Fragmentation reassembly. Each ILL has a hash table for
8461 * queueing packets undergoing reassembly for all IPIFs
8462 * associated with the ILL. The hash is based on the packet
8463 * IP ident field. The ILL frag hash table was allocated
8464 * as a timer block at the time the ILL was created. Whenever
8465 * there is anything on the reassembly queue, the timer will
8466 * be running.
8467 */
8473 }
8474 /*
8475 * If the reassembly list for this ILL will get too big
8476 * prune it.
8477 */
8485 }
8491 /* Try to find an existing fragment queue for this packet. */
8495 /*
8496 * It has to match on ident, source address, and
8497 * dest address.
8498 */
8503 /*
8504 * If we have received too many
8505 * duplicate fragments for this packet
8506 * free it.
8507 */
8513 }
8516 }
8519 }
8522 /*
8523 * If we pruned the list, do we want to store this new
8524 * fragment?. We apply an optimization here based on the
8525 * fact that most fragments will be received in order.
8526 * So if the offset of this incoming fragment is zero,
8527 * it is the first fragment of a new packet. We will
8528 * keep it. Otherwise drop the fragment, as we have
8529 * probably pruned the packet already (since the
8530 * packet cannot be found).
8531 */
8537 }
8539 /* New guy. Allocate a frag message. */
8544 partial_reass_done:
8547 }
8550 /*
8551 * Too many fragmented packets in this hash bucket.
8552 * Free the oldest.
8553 */
8555 }
8559 /* Initialize the fragment header. */
8568 /* Record reassembly start time. */
8570 /* Record ipf generation and account for frag header */
8583 /* Store checksum value in fragment header */
8589 }
8591 /*
8592 * We handle reassembly two ways. In the easy case,
8593 * where all the fragments show up in order, we do
8594 * minimal bookkeeping, and just clip new pieces on
8595 * the end. If we ever see a hole, then we go off
8596 * to ip_reassemble which has to mark the pieces and
8597 * keep track of the number of holes, etc. Obviously,
8598 * the point of having both mechanisms is so we can
8599 * handle the easy case as efficiently as possible.
8600 */
8602 /* Easy case, in-order reassembly so far. */
8603 /* Update the byte count */
8606 /*
8607 * Keep track of next expected offset in
8608 * ipf_end.
8609 */
8614 /* Hard case, hole at the beginning. */
8616 /*
8617 * ipf_end == 0 means that we have given up
8618 * on easy reassembly.
8619 */
8622 /* Forget checksum offload from now on */
8625 /*
8626 * ipf_hole_cnt is set by ip_reassemble.
8627 * ipf_count is updated by ip_reassemble.
8628 * No need to check for return value here
8629 * as we don't expect reassembly to complete or
8630 * fail for the first fragment itself.
8631 */
8633 msg_len);
8634 }
8635 /* Update per ipfb and ill byte counts */
8639 /* If the frag timer wasn't already going, start it. */
8644 }
8646 /*
8647 * If the packet's flag has changed (it could be coming up
8648 * from an interface different than the previous, therefore
8649 * possibly different checksum capability), then forget about
8650 * any stored checksum states. Otherwise add the value to
8651 * the existing one stored in the fragment header.
8652 */
8659 /* Forget checksum offload from now on */
8661 }
8663 /*
8664 * We have a new piece of a datagram which is already being
8665 * reassembled. Update the ECN info if all IP fragments
8666 * are ECN capable. If there is one which is not, clear
8667 * all the info. If there is at least one which has CE
8668 * code point, IP needs to report that up to transport.
8669 */
8675 }
8678 /* The new fragment fits at the end */
8680 /* Update the byte count */
8682 /* Update per ipfb and ill byte counts */
8687 /* More to come. */
8691 }
8693 /*
8694 * Go do the hard cases.
8695 * Call ip_reassemble().
8696 */
8704 }
8705 }
8706 /* Save current byte count */
8710 /* Count of bytes added and subtracted (freeb()ed) */
8713 /* Update per ipfb and ill byte counts */
8717 }
8721 /* Reassembly failed. Free up all resources */
8726 }
8729 }
8731 /* We will reach here iff 'ret' is IP_REASS_COMPLETE */
8732 }
8733 /*
8734 * We have completed reassembly. Unhook the frag header from
8735 * the reassembly list.
8736 *
8737 * Grab the unfragmentable header length next header value out
8738 * of the first fragment
8739 */
8743 /*
8744 * Before we free the frag header, record the ECN info
8745 * to report back to the transport.
8746 */
8749 /*
8750 * Store the nextheader field in the header preceding the fragment
8751 * header
8752 */
8757 /* We need to supply these to caller */
8760 else
8774 /* Ditch the frag header. */
8778 /*
8779 * Make sure the packet is good by doing some sanity
8780 * check. If bad we can silentely drop the packet.
8781 */
8782 reass_done:
8788 }
8790 /*
8791 * Remove the fragment header from the initial header by
8792 * splitting the mblk into the non-fragmentable header and
8793 * everthing after the fragment extension header. This has the
8794 * side effect of putting all the headers that need destination
8795 * processing into the b_cont block-- on return this fact is
8796 * used in order to avoid having to look at the extensions
8797 * already processed.
8798 *
8799 * Note that this code assumes that the unfragmentable portion
8800 * of the header is in the first mblk and increments
8801 * the read pointer past it. If this assumption is broken
8802 * this code fails badly.
8803 */
8812 }
8816 }
8822 /* Restore original IP length in header. */
8824 /* Record the ECN info. */
8828 /* Reassembly is successful; return checksum information if needed */
8835 }
8837 /*
8838 * Given an mblk and a ptr, find the destination address in an IPv6 routing
8839 * header.
8840 */
8841 static in6_addr_t
8843 {
8853 }
8860 /*
8861 * Corrupt packet. Either the routing header length is odd
8862 * (can't happen) or mismatched compared to the packet, or the
8863 * number of addresses is. Return what we can. This will
8864 * only be a problem on forwarded packets that get squeezed
8865 * through an outbound tunnel enforcing IPsec Tunnel Mode.
8866 */
8868 whereptr);
8870 }
8875 }
8878 }
8880 /*
8881 * Walk through the options to see if there is a routing header.
8882 * If present get the destination which is the last address of
8883 * the option.
8884 */
8885 in6_addr_t
8887 {
8892 in6_addr_t rv;
8897 /* We assume at least the IPv6 base header is within one mblk. */
8905 /*
8906 * We also assume (thanks to ipsec_tun_outbound()'s pullup) that
8907 * no extension headers will be split across mblks.
8908 */
8915 /*
8916 * All IPv6 extension headers have the next-header in byte
8917 * 0, and the (length - 8) in 8-byte-words.
8918 */
8923 /* Bad packet. Return what we can. */
8927 }
8929 }
8935 }
8937 done:
8941 }
8943 /*
8944 * ip_source_routed_v6:
8945 * This function is called by redirect code in ip_rput_data_v6 to
8946 * know whether this packet is source routed through this node i.e
8947 * whether this node (router) is part of the journey. This
8948 * function is called under two cases :
8949 *
8950 * case 1 : Routing header was processed by this node and
8951 * ip_process_rthdr replaced ip6_dst with the next hop
8952 * and we are forwarding the packet to the next hop.
8953 *
8954 * case 2 : Routing header was not processed by this node and we
8955 * are just forwarding the packet.
8956 *
8957 * For case (1) we don't want to send redirects. For case(2) we
8958 * want to send redirects.
8959 */
8960 static boolean_t
8962 {
8968 uint_t ehdrlen;
8975 /* if a routing hdr is preceeded by HOPOPT or DSTOPT */
8979 /*
8980 * Check if we have already processed
8981 * packets or we are just a forwarding
8982 * router which only pulled up msgs up
8983 * to IPV6HDR and one HBH ext header
8984 */
8989 }
8993 }
8997 /*
8998 * If for some reason, we haven't pulled up
8999 * the routing hdr data mblk, then we must
9000 * not have processed it at all. So for sure
9001 * we are not part of the source routed journey.
9002 */
9007 }
9009 /*
9010 * Either we are an intermediate router or the
9011 * last hop before destination and we have
9012 * already processed the routing header.
9013 * If segment_left is greater than or equal to zero,
9014 * then we must be the (numaddr - segleft) entry
9015 * of the routing header. Although ip6r0_segleft
9016 * is a unit8_t variable, we still check for zero
9017 * or greater value, if in case the data type
9018 * is changed someday in future.
9019 */
9031 MATCH_IRE_TYPE,
9032 ipst);
9036 }
9038 }
9039 }
9040 /* FALLTHRU */
9044 }
9045 }
9047 /*
9048 * ip_wput_v6 -- Packets sent down from transport modules show up here.
9049 * Assumes that the following set of headers appear in the first
9050 * mblk:
9051 * ip6i_t (if present) CAN also appear as a separate mblk.
9052 * ip6_t
9053 * Any extension headers
9054 * TCP/UDP/SCTP header (if present)
9055 * The routine can handle an ICMPv6 header that is not in the first mblk.
9056 *
9057 * The order to determine the outgoing interface is as follows:
9058 * 1. If an ip6i_t with IP6I_IFINDEX set then use that ill.
9059 * 2. If q is an ill queue and (link local or multicast destination) then
9060 * use that ill.
9061 * 3. If IPV6_BOUND_IF has been set use that ill.
9062 * 4. For multicast: if IPV6_MULTICAST_IF has been set use it. Otherwise
9063 * look for the best IRE match for the unspecified group to determine
9064 * the ill.
9065 * 5. For unicast: Just do an IRE lookup for the best match.
9066 *
9067 * arg2 is always a queue_t *.
9068 * When that queue is an ill_t (i.e. q_next != NULL), then arg must be
9069 * the zoneid.
9070 * When that queue is not an ill_t, then arg must be a conn_t pointer.
9071 */
9072 void
9074 {
9085 /* 1 => Skip TCP/UDP/SCTP checksum */
9086 /* Otherwise contains insert offset for checksum */
9092 boolean_t mctl_present;
9098 zoneid_t zoneid;
9100 boolean_t conn_lock_held;
9111 }
9113 /*
9114 * Highest bit in version field is Reachability Confirmation bit
9115 * used by NUD in ip_xmit_v6().
9116 */
9117 #ifdef _BIG_ENDIAN
9118 #define IPVER(ip6h) ((((uint32_t *)ip6h)[0] >> 28) & 0x7)
9119 #else
9120 #define IPVER(ip6h) ((((uint32_t *)ip6h)[0] >> 4) & 0x7)
9121 #endif
9123 /*
9124 * M_CTL comes from 6 places
9125 *
9126 * 1) TCP sends down IPSEC_OUT(M_CTL) for detached connections
9127 * both V4 and V6 datagrams.
9128 *
9129 * 2) AH/ESP sends down M_CTL after doing their job with both
9130 * V4 and V6 datagrams.
9131 *
9132 * 3) NDP callbacks when nce is resolved and IPSEC_OUT has been
9133 * attached.
9134 *
9135 * 4) Notifications from an external resolver (for XRESOLV ifs)
9136 *
9137 * 5) AH/ESP send down IPSEC_CTL(M_CTL) to be relayed to hardware for
9138 * IPsec hardware acceleration support.
9139 *
9140 * 6) TUN_HELLO.
9141 *
9142 * We need to handle (1)'s IPv6 case and (3) here. For the
9143 * IPv4 case in (1), and (2), IPSEC processing has already
9144 * started. The code in ip_wput() already knows how to handle
9145 * continuing IPSEC processing (for IPv4 and IPv6). All other
9146 * M_CTLs (including case (4)) are passed on to ip_wput_nondata()
9147 * for handling.
9148 */
9153 /* Multidata transmit? */
9155 /*
9156 * We should never get here, since all Multidata messages
9157 * originating from tcp should have been directed over to
9158 * tcp_multisend() in the first place.
9159 */
9171 /*
9172 * Validate this M_CTL message. The only three types of
9173 * M_CTL messages we expect to see in this code path are
9174 * ipsec_out_t or ipsec_in_t structures (allocated as
9175 * ipsec_info_t unions), or ipsec_ctl_t structures.
9176 * The ipsec_out_type and ipsec_in_type overlap in the two
9177 * data structures, and they are either set to IPSEC_OUT
9178 * or IPSEC_IN depending on which data structure it is.
9179 * ipsec_ctl_t is an IPSEC_CTL.
9180 *
9181 * All other M_CTL messages are sent to ip_wput_nondata()
9182 * for handling.
9183 */
9191 }
9198 }
9199 /* NDP callbacks have q_next non-NULL. That's case #3. */
9202 /*
9203 * For a freshly-generated TCP dgram that needs IPV6
9204 * processing, don't call ip_wput immediately. We can
9205 * tell this by the ipsec_out_proc_begin. In-progress
9206 * IPSEC_OUT messages have proc_begin set to TRUE,
9207 * and we want to send all IPSEC_IN messages to
9208 * ip_wput() for IPsec processing or finishing.
9209 */
9215 }
9216 }
9220 }
9227 }
9239 }
9242 else
9251 }
9253 }
9255 /*
9256 * We don't know if this ill will be used for IPv6
9257 * until the ILLF_IPV6 flag is set via SIOCSLIFNAME.
9258 * ipif_set_values() sets the ill_isv6 flag to true if
9259 * ILLF_IPV6 is set. If the ill_isv6 flag isn't true,
9260 * just drop the packet.
9261 */
9267 }
9268 /* For uniformity do a refhold */
9274 }
9288 /* is queue flow controlled? */
9291 /*
9292 * 1) TCP sends down M_CTL for detached connections.
9293 * 2) AH/ESP sends down M_CTL.
9294 *
9295 * We don't flow control either of the above. Only
9296 * UDP and others are flow controlled for which we
9297 * can't have a M_CTL.
9298 */
9302 }
9311 }
9313 /*
9314 * If there is a policy, try to attach an ipsec_out in
9315 * the front. At the end, first_mp either points to a
9316 * M_DATA message or IPSEC_OUT message linked to a
9317 * M_DATA message. We have to do it now as we might
9318 * lose the "conn" if we go through ip_newroute.
9319 */
9324 /* XXX Any better way to get the protocol fast ? */
9337 }
9338 }
9339 }
9341 /* check for alignment and full IPv6 header */
9354 }
9359 /*
9360 * Once neighbor discovery has completed, ndp_process() will provide
9361 * locally generated packets for which processing can be reattempted.
9362 * In these cases, connp is NULL and the original zone is part of a
9363 * prepended ipsec_out_t.
9364 */
9366 /*
9367 * When coming from icmp_input_v6, the zoneid might not match
9368 * for the loopback case, because inside icmp_input_v6 the
9369 * queue_t is a conn queue from the sending side.
9370 */
9373 }
9376 /*
9377 * This is an ip6i_t header followed by an ip6_hdr.
9378 * Check which fields are set.
9379 *
9380 * When the packet comes from a transport we should have
9381 * all needed headers in the first mblk. However, when
9382 * going through ip_newroute*_v6 the ip6i might be in
9383 * a separate mblk when we return here. In that case
9384 * we pullup everything to ensure that extension and transport
9385 * headers "stay" in the first mblk.
9386 */
9399 ipIfStatsHCOutRequests);
9400 }
9408 }
9412 }
9415 /*
9416 * Advance rptr past the ip6i_t to get ready for
9417 * transmitting the packet. However, if the packet gets
9418 * passed to ip_newroute*_v6 then rptr is moved back so
9419 * that the ip6i_t header can be inspected when the
9420 * packet comes back here after passing through
9421 * ire_add_then_send.
9422 */
9434 ipIfStatsHCOutRequests);
9435 }
9443 }
9445 /*
9446 * Preserve the index so that when we return from
9447 * IPSEC processing, we know where to send the packet.
9448 */
9452 }
9453 }
9459 /*
9460 * Use IPCL_ZONEID to honor SO_ALLZONES.
9461 */
9470 ipIfStatsHCOutRequests);
9480 }
9482 }
9483 /* No need to verify again when using ip_newroute */
9485 }
9487 /*
9488 * Make sure they match since ip_newroute*_v6 etc might
9489 * (unknown to them) inspect ip6i_nexthop when
9490 * they think they access ip6_dst.
9491 */
9493 }
9504 }
9505 /*
9506 * Store ip6i_t info that we need after we come back
9507 * from IPSEC processing.
9508 */
9512 }
9513 }
9520 /* 1. If an ip6i_t with IP6I_IFINDEX set then use that ill. */
9524 }
9526 /*
9527 * 2. If q is an ill queue and there's a link-local destination
9528 * then use that ill.
9529 */
9533 /* 3. If IPV6_BOUND_IF has been set use that ill. */
9546 }
9552 }
9554 /*
9555 * 4. For unicast: Just do an IRE lookup for the best match.
9556 * If we get here for a link-local address it is rather random
9557 * what interface we pick on a multihomed host.
9558 * *If* there is an IRE_CACHE (and the link-local address
9559 * isn't duplicated on multi links) this will find the IRE_CACHE.
9560 * Otherwise it will use one of the matching IRE_INTERFACE routes
9561 * for the link-local prefix. Hence, applications
9562 * *should* be encouraged to specify an outgoing interface when sending
9563 * to a link local address.
9564 */
9567 /*
9568 * We cache IRE_CACHEs to avoid lookups. We don't do
9569 * this for the tcp global queue and listen end point
9570 * as it does not really have a real destination to
9571 * talk to.
9572 */
9574 ipst);
9576 /*
9577 * IRE_MARK_CONDEMNED is marked in ire_delete. We don't
9578 * grab a lock here to check for CONDEMNED as it is okay
9579 * to send a packet or two with the IRE_CACHE that is going
9580 * away.
9581 */
9596 /* Release the old ire */
9609 RW_READER);
9611 IRE_MARK_CONDEMNED)) {
9614 }
9616 }
9619 /*
9620 * We can continue to use the ire but since it
9621 * was not cached, we should drop the extra
9622 * reference.
9623 */
9626 }
9627 }
9628 }
9632 /* Handle IRE_LOCAL's that might appear here */
9635 ill_ip_mib;
9638 }
9640 }
9642 /*
9643 * Check if the ire has the RTF_MULTIRT flag, inherited
9644 * from an IRE_OFFSUBNET ire entry in ip_newroute().
9645 */
9647 /*
9648 * Force hop limit of multirouted packets if required.
9649 * The hop limit of such packets is bounded by the
9650 * ip_multirt_ttl ndd variable.
9651 * NDP packets must have a hop limit of 255; don't
9652 * change the hop limit in that case.
9653 */
9664 }
9666 }
9668 /*
9669 * We look at this point if there are pending
9670 * unresolved routes. ire_multirt_need_resolve_v6()
9671 * checks in O(n) that all IRE_OFFSUBNET ire
9672 * entries for the packet's destination and
9673 * flagged RTF_MULTIRT are currently resolved.
9674 * If some remain unresolved, we do a copy
9675 * of the current message. It will be used
9676 * to initiate additional route resolutions.
9677 */
9678 multirt_need_resolve =
9689 }
9690 }
9691 }
9697 }
9700 /*
9701 * Try to resolve another multiroute if
9702 * ire_multirt_need_resolve_v6() deemed it necessary.
9703 * copy_mp will be consumed (sent or freed) by
9704 * ip_newroute_v6().
9705 */
9711 }
9714 }
9718 }
9720 /*
9721 * No full IRE for this destination. Send it to
9722 * ip_newroute_v6 to see if anything else matches.
9723 * Mark this packet as having originated on this
9724 * machine.
9725 * Update rptr if there was an ip6i_t header.
9726 */
9734 /*
9735 * Add ip6i_t header to carry unspec_src
9736 * until the packet comes back in ip_wput_v6.
9737 */
9742 ipIfStatsHCOutRequests);
9751 }
9759 }
9763 /*
9764 * ndp_resolver called from ip_newroute_v6
9765 * expects pulled up message.
9766 */
9772 ipIfStatsHCOutRequests);
9773 }
9781 }
9783 }
9786 }
9791 }
9792 }
9803 /*
9804 * Handle multicast packets with or without an conn.
9805 * Assumes that the transports set ip6_hops taking
9806 * IPV6_MULTICAST_HOPS (and the other ways to set the hoplimit)
9807 * into account.
9808 */
9809 ipv6multicast:
9812 /*
9813 * Hold the conn_lock till we refhold the ill of interest that is
9814 * pointed to from the conn. Since we cannot do an ill/ipif_refrele
9815 * while holding any locks, postpone the refrele until after the
9816 * conn_lock is dropped.
9817 */
9823 }
9825 /* 1. If an ip6i_t with IP6I_IFINDEX set then use that ill. */
9828 /*
9829 * 2. If q is an ill queue and (link local or multicast
9830 * destination) then use that ill.
9831 * We don't need the ipif initialization here.
9832 * This useless assert below is just to prevent lint from
9833 * reporting a null body if statement.
9834 */
9837 /*
9838 * 3. If IPV6_BOUND_IF has been set use that ill.
9839 *
9840 * 4. For multicast: if IPV6_MULTICAST_IF has been set use it.
9841 * Otherwise look for the best IRE match for the unspecified
9842 * group to determine the ill.
9843 *
9844 * conn_multicast_ill is used for only IPv6 packets.
9845 * conn_multicast_ipif is used for only IPv4 packets.
9846 * Thus a PF_INET6 socket send both IPv4 and IPv6
9847 * multicast packets using different IP*_MULTICAST_IF
9848 * interfaces.
9849 */
9855 multicast_discard:
9867 }
9875 }
9884 }
9885 /*
9886 * We have a ref to this ipif, so we can safely
9887 * access ipif_ill.
9888 */
9897 }
9901 /*
9902 * Save binding until IPV6_MULTICAST_IF
9903 * changes it
9904 */
9908 }
9909 }
9917 /*
9918 * For multicast loopback interfaces replace the multicast address
9919 * with a unicast address for the ire lookup.
9920 */
9928 }
9933 /*
9934 * As we may lose the conn by the time we reach ip_wput_ire_v6
9935 * we copy conn_multicast_loop and conn_dontroute on to an
9936 * ipsec_out. In case if this datagram goes out secure,
9937 * we need the ill_index also. Copy that also into the
9938 * ipsec_out.
9939 */
9947 NULL) {
9955 }
9957 /* This is not a secure packet */
9964 }
9970 send_from_ill:
9977 }
9979 /*
9980 * Because nce_xmit() calls ip_output_v6() and NCEs are always tied to
9981 * an underlying interface, IS_UNDER_IPMP() may be true even when
9982 * building IREs that will be used for data traffic. As such, use the
9983 * packet's source address to determine whether the traffic is test
9984 * traffic, and set MATCH_IRE_MARK_TESTHIDDEN if so.
9985 *
9986 * Separately, we also need to mark probe packets so that ND can
9987 * process them specially; see the comments in nce_queue_mp_common().
9988 */
9996 }
10000 else
10003 /* ndp_resolver() expects a pulled-up message */
10012 }
10017 }
10020 }
10025 /*
10026 * When a specific ill is specified (using IPV6_PKTINFO,
10027 * IPV6_MULTICAST_IF, or IPV6_BOUND_IF) we will only match
10028 * on routing entries (ftable and ctable) that have a matching
10029 * ire->ire_ipif->ipif_ill. Thus this can only be used
10030 * for destinations that are on-link for the specific ill
10031 * and that can appear on multiple links. Thus it is useful
10032 * for multicast destinations, link-local destinations, and
10033 * at some point perhaps for site-local destinations (if the
10034 * node sits at a site boundary).
10035 * We create the cache entries in the regular ctable since
10036 * it can not "confuse" things for other destinations.
10037 * table.
10038 *
10039 * NOTE : conn_ire_cache is not used for caching ire_ctable_lookups.
10040 * It is used only when ire_cache_lookup is used above.
10041 */
10045 /*
10046 * Check if the ire has the RTF_MULTIRT flag, inherited
10047 * from an IRE_OFFSUBNET ire entry in ip_newroute().
10048 */
10050 /*
10051 * Force hop limit of multirouted packets if required.
10052 * The hop limit of such packets is bounded by the
10053 * ip_multirt_ttl ndd variable.
10054 * NDP packets must have a hop limit of 255; don't
10055 * change the hop limit in that case.
10056 */
10067 }
10069 }
10071 /*
10072 * We look at this point if there are pending
10073 * unresolved routes. ire_multirt_need_resolve_v6()
10074 * checks in O(n) that all IRE_OFFSUBNET ire
10075 * entries for the packet's destination and
10076 * flagged RTF_MULTIRT are currently resolved.
10077 * If some remain unresolved, we make a copy
10078 * of the current message. It will be used
10079 * to initiate additional route resolutions.
10080 */
10081 multirt_need_resolve =
10092 }
10093 }
10094 }
10105 }
10107 /*
10108 * Try to resolve another multiroute if
10109 * ire_multirt_need_resolve_v6() deemed it necessary.
10110 * copy_mp will be consumed (sent or freed) by
10111 * ip_newroute_[ipif_]v6().
10112 */
10118 }
10128 }
10131 zoneid);
10136 }
10137 }
10140 }
10144 }
10146 /* Update rptr if there was an ip6i_t header. */
10151 /*
10152 * Add ip6i_t header to carry unspec_src
10153 * until the packet comes back in ip_wput_v6.
10154 */
10163 v6dstp);
10164 }
10169 }
10173 /*
10174 * ndp_resolver called from ip_newroute_v6
10175 * expects a pulled up message.
10176 */
10183 }
10185 }
10188 }
10193 }
10194 }
10201 }
10205 notv6:
10206 /* FIXME?: assume the caller calls the right version of ip_output? */
10210 /*
10211 * We can change conn_send for all types of conn, even
10212 * though only TCP uses it right now.
10213 * FIXME: sctp could use conn_send but doesn't currently.
10214 */
10216 }
10221 }
10223 /*
10224 * If this is a conn_t queue, then we pass in the conn. This includes the
10225 * zoneid.
10226 * Otherwise, this is a message for an ill_t queue,
10227 * in which case we use the global zoneid since those are all part of
10228 * the global zone.
10229 */
10230 void
10232 {
10235 else
10237 }
10239 /*
10240 * NULL send-to queue - packet is to be delivered locally.
10241 */
10242 void
10245 {
10248 boolean_t mctl_present;
10254 uint_t nexthdr_offset;
10268 }
10271 }
10273 /*
10274 * Remove reachability confirmation bit from version field
10275 * before passing the packet on to any firewall hooks or
10276 * looping back the packet.
10277 */
10300 /*
10301 * ::1 is special, as we cannot lookup its zoneid by
10302 * address. For this case, restrict the lookup to the
10303 * source zone.
10304 */
10308 lookup_zoneid);
10311 }
10320 /* Fastpath */
10335 /* Malformed packet */
10339 }
10343 }
10344 }
10352 /*
10353 * M_DATA mblk, so init mblk (chain) for
10354 * no struio().
10355 */
10361 }
10363 TCP_PORTS_OFFSET);
10372 UDP_PORTS_OFFSET);
10379 {
10385 }
10389 /* check for full IPv6+ICMPv6 header */
10398 }
10400 }
10403 /* Update output mib stats */
10406 /* Check variable for testing applications */
10410 }
10411 /*
10412 * Assume that there is always at least one conn for
10413 * ICMPv6 (in.ndpd) i.e. don't optimize the case
10414 * where there is no conn.
10415 */
10418 ilm_walker_t ilw;
10420 /*
10421 * In the multicast case, applications may have
10422 * joined the group from different zones, so we
10423 * need to deliver the packet to each of them.
10424 * Loop through the multicast memberships
10425 * structures (ilm) on the receive ill and send
10426 * a copy of the packet up each matching one.
10427 * However, we don't do this for multicasts sent
10428 * on the loopback interface (PHYI_LOOPBACK flag
10429 * set) as they must stay in the sender's zone.
10430 */
10438 IP_FF_NO_MCAST_LOOP) &&
10453 }
10461 NULL);
10462 }
10463 }
10464 /* FALLTHRU */
10466 /*
10467 * Handle protocols with which IPv6 is less intimate.
10468 */
10471 /*
10472 * Enable sending ICMP for "Unknown" nexthdr
10473 * case. i.e. where we did not FALLTHRU from
10474 * IPPROTO_ICMPV6 processing case above.
10475 */
10478 /*
10479 * Note: There can be more than one stream bound
10480 * to a particular protocol. When this is the case,
10481 * each one gets a copy of any incoming packets.
10482 */
10487 }
10488 }
10489 }
10491 /*
10492 * Send packet using IRE.
10493 * Checksumming is controlled by cksum_request:
10494 * -1 => normal i.e. TCP/UDP/SCTP/ICMPv6 are checksummed and nothing else.
10495 * 1 => Skip TCP/UDP/SCTP checksum
10496 * Otherwise => checksum_request contains insert offset for checksum
10497 *
10498 * Assumes that the following set of headers appear in the first
10499 * mblk:
10500 * ip6_t
10501 * Any extension headers
10502 * TCP/UDP/SCTP header (if present)
10503 * The routine can handle an ICMPv6 header that is not in the first mblk.
10504 *
10505 * NOTE : This function does not ire_refrele the ire passed in as the
10506 * argument unlike ip_wput_ire where the REFRELE is done.
10507 * Refer to ip_wput_ire for more on this.
10508 */
10509 static void
10512 {
10520 boolean_t mctl_present;
10538 /*
10539 * Grab the zone id now because the M_CTL can be discarded by
10540 * ip_wput_ire_parse_ipsec_out() below.
10541 */
10545 /*
10546 * For the multicast case, ipsec_out carries conn_dontroute and
10547 * conn_multicast_loop as conn may not be available here. We
10548 * need this for multicast loopback and forwarding which is done
10549 * later in the code.
10550 */
10554 /*
10555 * If conn_dontroute is not set or conn_multicast_loop
10556 * is set, we need to do forwarding/loopback. For
10557 * datagrams from ip_wput_multicast, conn_dontroute is
10558 * set to B_TRUE and conn_multicast_loop is set to
10559 * B_FALSE so that we neither do forwarding nor
10560 * loopback.
10561 */
10564 }
10565 }
10567 /*
10568 * If the sender didn't supply the hop limit and there is a default
10569 * unicast hop limit associated with the output interface, we use
10570 * that if the packet is unicast. Interface specific unicast hop
10571 * limits as set via the SIOCSLIFLNKINFO ioctl.
10572 */
10576 }
10580 /*
10581 * When a zone sends a packet to another zone, we try to deliver
10582 * the packet under the same conditions as if the destination
10583 * was a real node on the network. To do so, we look for a
10584 * matching route in the forwarding table.
10585 * RTF_REJECT and RTF_BLACKHOLE are handled just like
10586 * ip_newroute_v6() does.
10587 * Note that IRE_LOCAL are special, since they are used
10588 * when the zoneid doesn't match in some cases. This means that
10589 * we need to handle ipha_src differently since ire_src_addr
10590 * belongs to the receiving zone instead of the sending zone.
10591 * When ip_restrict_interzone_loopback is set, then
10592 * ire_cache_lookup_v6() ensures that IRE_LOCAL are only used
10593 * for loopback between zones when the logical "Ethernet" would
10594 * have looped them back.
10595 */
10608 }
10617 }
10619 }
10621 /* Failed */
10624 }
10629 }
10630 }
10638 }
10639 }
10649 }
10658 /*
10659 * Select the source address using ipif_select_source_v6.
10660 */
10665 /* ip1dbg */
10669 }
10672 }
10675 }
10687 }
10702 }
10705 ip6__loopback__out__start,
10718 ip6__loopback__out__end,
10721 /*
10722 * DTrace this as ip:::send. A blocked
10723 * packet will fire the send probe, but
10724 * not the receive probe.
10725 */
10733 /*
10734 * Deliver locally and to
10735 * every local zone, except
10736 * the sending zone when
10737 * IPV6_MULTICAST_LOOP is
10738 * disabled.
10739 */
10743 }
10748 }
10749 }
10750 }
10754 /*
10755 * Local multicast or just loopback on loopback
10756 * interface.
10757 */
10764 }
10765 }
10773 /*
10774 * non-NULL send-to queue - packet is to be sent
10775 * out an interface.
10776 */
10778 /* Driver is flow-controlling? */
10781 /*
10782 * Queue packet if we have an conn to give back
10783 * pressure. We can't queue packets intended for
10784 * hardware acceleration since we've tossed that
10785 * state already. If the packet is being fed back
10786 * from ire_send_v6, we don't know the position in
10787 * the queue to enqueue the packet and we discard
10788 * the packet.
10789 */
10799 /*
10800 * caller == IP_WSRV implies we are
10801 * the service thread, and the
10802 * queue is already noenabled.
10803 * The check for canput and
10804 * the putbq is not atomic.
10805 * So we need to check again.
10806 */
10811 }
10813 }
10817 }
10819 /*
10820 * Look for reachability confirmations from the transport.
10821 */
10827 }
10828 /* Fastpath */
10841 /* Malformed packet */
10845 }
10848 }
10849 }
10855 /*
10856 * The packet header is processed once for all, even
10857 * in the multirouting case. We disable hardware
10858 * checksum if the packet is multirouted, as it will be
10859 * replicated via several interfaces, and not all of
10860 * them may have this capability.
10861 */
10864 /* Skip the transport checksum */
10866 }
10867 /*
10868 * Do user-configured raw checksum.
10869 * Compute checksum and insert at offset "cksum_request"
10870 */
10872 /* check for enough headers for checksum */
10883 }
10885 }
10889 /*
10890 * icmp has placed length and routing
10891 * header adjustment in *insp.
10892 */
10903 /*
10904 * Check for full IPv6 header + enough TCP header
10905 * to get at the checksum field.
10906 */
10909 TCP_CHECKSUM_SIZE)) {
10917 }
10919 }
10922 /*
10923 * Note: The TCP module has stored the length value
10924 * into the tcp checksum field, so we don't
10925 * need to explicitly sum it in here.
10926 */
10932 /* Fold the initial sum */
10942 /* Software checksum? */
10946 ip6_tcp_out_sw_cksum_bytes,
10948 hdr_length);
10949 }
10953 /*
10954 * check for full IPv6 header + enough UDP header
10955 * to get at the UDP checksum field
10956 */
10966 }
10968 }
10970 /*
10971 * Note: The UDP module has stored the length value
10972 * into the udp checksum field, so we don't
10973 * need to explicitly sum it in here.
10974 */
10980 /* Fold the initial sum */
10990 /* Software checksum? */
10994 ip6_udp_out_sw_cksum_bytes,
10996 hdr_length);
10997 }
11002 /* check for full IPv6+ICMPv6 header */
11011 }
11013 }
11016 /*
11017 * icmp has placed length and routing
11018 * header adjustment in icmp6_cksum.
11019 */
11028 /* Update output mib stats */
11039 ipIfStatsOutDiscards);
11042 }
11044 }
11048 }
11050 cksum_done:
11051 /*
11052 * We force the insertion of a fragment header using the
11053 * IPH_FRAG_HDR flag in two cases:
11054 * - after reception of an ICMPv6 "packet too big" message
11055 * with a MTU < 1280 (cf. RFC 2460 section 5)
11056 * - for multirouted IPv6 packets, so that the receiver can
11057 * discard duplicates according to their fragment identifier
11058 *
11059 * Two flags modifed from the API can modify this behavior.
11060 * The first is IPV6_USE_MIN_MTU. With this API the user
11061 * can specify how to manage PMTUD for unicast and multicast.
11062 *
11063 * IPV6_DONTFRAG disallows fragmentation.
11064 */
11071 }
11077 }
11084 }
11094 }
11095 /* Do IPSEC processing first */
11099 }
11105 /* Initiate IPPF processing */
11110 }
11111 }
11115 }
11116 /* Do IPSEC processing first */
11121 max_frag) {
11122 /*
11123 * IPsec headers will push the packet over the
11124 * MTU limit. Issue an ICMPv6 Packet Too Big
11125 * message for this packet if the upper-layer
11126 * that issued this packet will be able to
11127 * react to the icmp_pkt2big_v6() that we'll
11128 * generate.
11129 */
11133 }
11136 }
11137 /*
11138 * XXX multicast: add ip_mforward_v6() here.
11139 * Check conn_dontroute
11140 */
11141 #ifdef lint
11142 /*
11143 * XXX The only purpose of this statement is to avoid lint
11144 * errors. See the above "XXX multicast". When that gets
11145 * fixed, remove this whole #ifdef lint section.
11146 */
11149 #endif
11156 /*
11157 * DTrace this as ip:::send. A blocked packet will fire the
11158 * send probe, but not the receive probe.
11159 */
11172 zoneid);
11173 }
11174 }
11175 }
11177 /*
11178 * Outbound IPv6 fragmentation routine using MDT.
11179 */
11180 static void
11183 {
11190 ip_pdescinfo_t pdi;
11201 /*
11202 * Move read ptr past unfragmentable portion, we don't want this part
11203 * of the data in our fragments.
11204 */
11207 /* Calculate how many packets we will send out */
11212 /* Allocate a message block which will hold all the IP Headers. */
11217 /*
11218 * Create the header buffer, Multidata and destination address
11219 * and SAP attribute that should be associated with it.
11220 */
11231 }
11235 }
11238 /*
11239 * Add a payload buffer to the Multidata; this operation must not
11240 * fail, or otherwise our logic in this routine is broken. There
11241 * is no memory allocation done by the routine, so any returned
11242 * failure simply tells us that we've done something wrong.
11243 *
11244 * A failure tells us that either we're adding the same payload
11245 * buffer more than once, or we're trying to add more buffers than
11246 * allowed. None of the above cases should happen, and we panic
11247 * because either there's horrible heap corruption, and/or
11248 * programming mistake.
11249 */
11252 }
11261 /*
11262 * len is the total length of the fragmentable data in this
11263 * datagram. For each fragment sent, we will decrement len
11264 * by the amount of fragmentable data sent in that fragment
11265 * until len reaches zero.
11266 */
11291 unfragmentable_len);
11298 /*
11299 * Record offset and size of header and data of the next packet
11300 * in the multidata message.
11301 */
11315 /*
11316 * Attach the next payload message block to the
11317 * multidata message.
11318 */
11323 }
11327 /*
11328 * Any failure other than ENOMEM indicates that we
11329 * have passed in invalid pdesc info or parameters
11330 * to mmd_addpdesc, which must not happen.
11331 *
11332 * EINVAL is a result of failure on boundary checks
11333 * against the pdesc info contents. It should not
11334 * happen, and we panic because either there's
11335 * horrible heap corruption, and/or programming
11336 * mistake.
11337 */
11340 "pdesc logic error detected for "
11343 /* NOTREACHED */
11344 }
11346 /* Free unattached payload message blocks as well */
11349 }
11351 /* Advance fragment offset. */
11354 /* Advance to location for next header in the buffer. */
11357 /* Did we reach the next payload message block? */
11360 /*
11361 * Attach the next message block with payload
11362 * data to the multidata message.
11363 */
11367 }
11368 }
11373 /* Update IP statistics */
11377 /*
11378 * The ipv6 header len is accounted for in unfragmentable_len so
11379 * when calculating the fragmentation overhead just add the frag
11380 * header len.
11381 */
11392 /* Send it down */
11396 pbuf_panic:
11399 pbuf_idx);
11400 /* NOTREACHED */
11401 }
11403 /*
11404 * IPv6 fragmentation. Essentially the same as IPv4 fragmentation.
11405 * We have not optimized this in terms of number of mblks
11406 * allocated. For instance, for each fragment sent we always allocate a
11407 * mblk to hold the IPv6 header and fragment header.
11408 *
11409 * Assumes that all the extension headers are contained in the first mblk.
11410 *
11411 * The fragment header is inserted after an hop-by-hop options header
11412 * and after [an optional destinations header followed by] a routing header.
11413 *
11414 * NOTE : This function does not ire_refrele the ire passed in as
11415 * the argument.
11416 */
11417 void
11420 {
11436 uint_t prev_nexthdr_offset;
11447 }
11450 /*
11451 * Determine the length of the unfragmentable portion of this
11452 * datagram. This consists of the IPv6 header, a potential
11453 * hop-by-hop options header, a potential pre-routing-header
11454 * destination options header, and a potential routing header.
11455 */
11462 uint_t hdr_len;
11470 }
11473 uint_t hdr_len;
11482 }
11483 }
11486 uint_t hdr_len;
11494 }
11500 /* Check if we can use MDT to send out the frags. */
11508 }
11510 /*
11511 * Allocate an mblk with enough room for the link-layer
11512 * header, the unfragmentable part of the datagram, and the
11513 * fragment header. This (or a copy) will be used as the
11514 * first mblk for each fragment we send.
11515 */
11522 }
11539 /*
11540 * len is the total length of the fragmentable data in this
11541 * datagram. For each fragment sent, we will decrement len
11542 * by the amount of fragmentable data sent in that fragment
11543 * until len reaches zero.
11544 */
11547 /*
11548 * Move read ptr past unfragmentable portion, we don't want this part
11549 * of the data in our fragments.
11550 */
11557 /* Not last */
11563 ipIfStatsOutFragFails);
11566 }
11569 /* Last fragment */
11573 }
11579 /*
11580 * Note: Optimization alert.
11581 * In IPv6 (and IPv4) protocol header, Fragment Offset
11582 * ("offset") is 13 bits wide and in 8-octet units.
11583 * In IPv6 protocol header (unlike IPv4) in a 16 bit field,
11584 * it occupies the most significant 13 bits.
11585 * (least significant 13 bits in IPv4).
11586 * We do not do any shifts here. Not shifting is same effect
11587 * as taking offset value in octet units, dividing by 8 and
11588 * then shifting 3 bits left to line it up in place in proper
11589 * place protocol header.
11590 */
11594 /* mp has already been freed by ip_carve_mp() */
11601 }
11603 /* Get the priority marking, if any */
11612 }
11614 }
11616 /*
11617 * Determine if the ill and multicast aspects of that packets
11618 * "matches" the conn.
11619 */
11620 boolean_t
11622 zoneid_t zoneid)
11623 {
11625 boolean_t wantpacket;
11629 /*
11630 * conn_incoming_ill is set by IPV6_BOUND_IF which limits
11631 * unicast and multicast reception to conn_incoming_ill.
11632 * conn_wantpacket_v6 is called both for unicast and
11633 * multicast.
11634 */
11643 }
11644 }
11651 /*
11652 * Unicast case: we match the conn only if it's in the specified
11653 * zone.
11654 */
11656 }
11660 /*
11661 * Loopback case: the sending endpoint has IP_MULTICAST_LOOP
11662 * disabled, therefore we don't dispatch the multicast packet to
11663 * the sending zone.
11664 */
11666 }
11670 /*
11671 * Multicast packet on the loopback interface: we only match
11672 * conns who joined the group in the specified zone.
11673 */
11675 }
11678 wantpacket =
11683 }
11686 /*
11687 * Transmit a packet and update any NUD state based on the flags
11688 * XXX need to "recover" any ip6i_t when doing putq!
11689 *
11690 * NOTE : This function does not ire_refrele the ire passed in as the
11691 * argument.
11692 */
11693 void
11696 {
11724 }
11726 /*
11727 * If a packet is to be sent out an interface that is a 6to4
11728 * tunnel, outgoing IPv6 packets, with a 6to4 addressed IPv6
11729 * destination, must be checked to have a 6to4 prefix
11730 * (2002:V4ADDR::/48) that is NOT equal to the 6to4 prefix of
11731 * address configured on the sending interface. Otherwise,
11732 * the packet was delivered to this interface in error and the
11733 * packet must be dropped.
11734 */
11741 /* ip1dbg */
11743 "send 6to4 addressed IPv6 "
11744 "destination (%s) out the wrong "
11747 }
11751 }
11752 }
11754 /* Flow-control check has been done in ip_wput_ire_v6 */
11759 /*
11760 * In most cases, the emission loop below is entered only
11761 * once. Only in the case where the ire holds the
11762 * RTF_MULTIRT flag, do we loop to process all RTF_MULTIRT
11763 * flagged ires in the bucket, and send the packet
11764 * through all crossed RTF_MULTIRT routes.
11765 */
11767 /*
11768 * Multirouting case. The bucket where ire is stored
11769 * probably holds other RTF_MULTIRT flagged ires
11770 * to the destination. In this call to ip_xmit_v6,
11771 * we attempt to send the packet through all
11772 * those ires. Thus, we first ensure that ire is the
11773 * first RTF_MULTIRT ire in the bucket,
11774 * before walking the ire list.
11775 */
11781 /* Make sure we do not omit any multiroute ire. */
11792 }
11796 /* ire will be released by the caller */
11801 }
11806 /*
11807 * This tcp connection was marked as MDT-capable, but
11808 * it has been turned off due changes in the interface.
11809 * Now that the interface support is back, turn it on
11810 * by notifying tcp. We don't directly modify tcp_mdt,
11811 * since we leave all the details to the tcp code that
11812 * knows better.
11813 */
11823 SQTAG_TCP_INPUT_MCTL);
11824 }
11825 }
11832 /*
11833 * We are in a multiple send case, need to get
11834 * the next ire and make a duplicate of the
11835 * packet. ire1 holds here the next ire to
11836 * process in the bucket. If multirouting is
11837 * expected, any non-RTF_MULTIRT ire that has
11838 * the right destination address is ignored.
11839 */
11854 IRE_MARK_CONDEMNED)
11857 /* Got one */
11860 }
11862 }
11875 }
11876 }
11878 /* Last multiroute ire; don't loop anymore. */
11881 }
11882 }
11884 ill_index =
11887 /* Initiate IPPF processing */
11892 ipIfStatsOutDiscards);
11897 }
11899 }
11901 }
11904 /*
11905 * Check for fastpath, we need to hold nce_lock to
11906 * prevent fastpath update from chaining nce_fp_mp.
11907 */
11916 /*
11917 * make sure there is room for the fastpath
11918 * datalink header
11919 */
11925 ipIfStatsOutDiscards);
11931 }
11933 }
11936 /* Get the priority marking, if any */
11941 /*
11942 * fastpath - pre-pend datalink
11943 * header
11944 */
11948 }
11950 /*
11951 * Get the DL_UNITDATA_REQ.
11952 */
11963 }
11965 }
11966 /*
11967 * Prepend the DL_UNITDATA_REQ.
11968 */
11973 ipIfStatsOutDiscards);
11979 }
11981 }
11984 /* Get the priority marking, if any */
11987 }
12006 }
12007 /*
12008 * Proceed with the next RTF_MULTIRT
12009 * ire, also set up the send-to queue
12010 * accordingly.
12011 */
12024 }
12025 }
12028 zoneid_t szone;
12035 }
12037 /*
12038 * Update ire and MIB counters; for save_ire, this has
12039 * been done by the caller.
12040 */
12047 ipIfStatsHCOutMcastPkts);
12049 ipIfStatsHCOutMcastOctets,
12051 IPV6_HDR_LEN);
12052 }
12053 }
12055 /*
12056 * Send it down. XXX Do we want to flow control AH/ESP
12057 * packets that carry TCP payloads? We don't flow
12058 * control TCP packets, but we should also not
12059 * flow-control TCP packets that have been protected.
12060 * We don't have an easy way to find out if an AH/ESP
12061 * packet was originally TCP or not currently.
12062 */
12065 ipIfStatsHCOutTransmits);
12067 ipIfStatsHCOutOctets,
12076 /*
12077 * Safety Pup says: make sure this is
12078 * going to the right interface!
12079 */
12081 ill_index) {
12082 /* IPsec kstats: bump lose counter */
12086 ipIfStatsHCOutTransmits);
12088 ipIfStatsHCOutOctets,
12090 IPV6_HDR_LEN);
12097 }
12098 }
12103 }
12106 /*
12107 * Proceed with the next RTF_MULTIRT
12108 * ire, also set up the send-to queue
12109 * accordingly.
12110 */
12119 }
12123 }
12127 /*
12128 * Check for upper layer advice
12129 */
12131 /*
12132 * It should be o.k. to check the state without
12133 * a lock here, at most we lose an advice.
12134 */
12144 /* ip1dbg */
12146 " for %s changed to"
12149 }
12150 }
12153 }
12156 /*
12157 * Proceed with the next RTF_MULTIRT
12158 * ire, also set up the send-to queue
12159 * accordingly.
12160 */
12169 }
12173 }
12185 /*
12186 * ND_REACHABLE is identical to
12187 * ND_STALE in this specific case. If
12188 * reachable time has expired for this
12189 * neighbor (delta is greater than
12190 * reachable time), conceptually, the
12191 * neighbor cache is no longer in
12192 * REACHABLE state, but already in
12193 * STALE state. So the correct
12194 * transition here is to ND_DELAY.
12195 */
12201 /* ip2dbg */
12203 " for %s changed to"
12206 }
12211 /* Timers have already started */
12214 /*
12215 * ndp timer has detected that this nce
12216 * is unreachable and initiated deleting
12217 * this nce and all its associated IREs.
12218 * This is a race where we found the
12219 * ire before it was deleted and have
12220 * just sent out a packet using this
12221 * unreachable nce.
12222 */
12227 }
12228 }
12232 /*
12233 * Proceed with the next RTF_MULTIRT ire,
12234 * Also set up the send-to queue accordingly.
12235 */
12238 }
12246 }
12248 /*
12249 * In the multirouting case, release the last ire used for
12250 * emission. save_ire will be released by the caller.
12251 */
12254 }
12256 /*
12257 * Can't apply backpressure, just discard the packet.
12258 */
12262 }
12263 }
12265 /*
12266 * pr_addr_dbg function provides the needed buffer space to call
12267 * inet_ntop() function's 3rd argument. This function should be
12268 * used by any kernel routine which wants to save INET6_ADDRSTRLEN
12269 * stack buffer space in it's own stack frame. This function uses
12270 * a buffer from it's own stack and prints the information.
12271 * Example: pr_addr_dbg("func: no route for %s\n ", AF_INET, addr)
12272 *
12273 * Note: This function can call inet_ntop() once.
12274 */
12275 void
12277 {
12283 }
12285 /*
12286 * This does not compare debug level and just prints
12287 * out. Thus it is the responsibility of the caller
12288 * to check the appropriate debug-level before calling
12289 * this function.
12290 */
12293 }
12296 }
12299 /*
12300 * Return the length in bytes of the IPv6 headers (base header, ip6i_t
12301 * if needed and extension headers) that will be needed based on the
12302 * ip6_pkt_t structure passed by the caller.
12303 *
12304 * The returned length does not include the length of the upper level
12305 * protocol (ULP) header.
12306 */
12307 int
12309 {
12318 }
12322 }
12323 /*
12324 * En-route destination options
12325 * Only do them if there's a routing header as well
12326 */
12331 }
12335 }
12337 }
12339 /*
12340 * All-purpose routine to build a header chain of an IPv6 header
12341 * followed by any required extension headers and a proto header,
12342 * preceeded (where necessary) by an ip6i_t private header.
12343 *
12344 * The fields of the IPv6 header that are derived from the ip6_pkt_t
12345 * will be filled in appropriately.
12346 * Thus the caller must fill in the rest of the IPv6 header, such as
12347 * traffic class/flowid, source address (if not set here), hoplimit (if not
12348 * set here) and destination address.
12349 *
12350 * The extension headers and ip6i_t header will all be fully filled in.
12351 */
12352 void
12355 {
12361 /*
12362 * If sending private ip6i_t header down (checksum info, nexthop,
12363 * or ifindex), adjust ip header pointer and set ip6i_t header pointer,
12364 * then fill it in. (The checksum info will be filled in by icmp).
12365 */
12377 }
12379 /*
12380 * Enable per-packet source address verification if
12381 * IPV6_PKTINFO specified the source address.
12382 * ip6_src is set in the transport's _wput function.
12383 */
12387 }
12390 /*
12391 * We need to set this flag so that IP doesn't
12392 * rewrite the IPv6 header's hoplimit with the
12393 * current default value.
12394 */
12396 }
12402 }
12403 /*
12404 * tell IP this is an ip6i_t private header
12405 */
12407 }
12408 /* Initialize IPv6 header */
12413 }
12419 /*
12420 * Here's where we have to start stringing together
12421 * any extension headers in the right order:
12422 * Hop-by-hop, destination, routing, and final destination opts.
12423 */
12425 /* Hop-by-hop options */
12433 }
12434 /*
12435 * En-route destination options
12436 * Only do them if there's a routing header as well
12437 */
12447 }
12448 /*
12449 * Routing header next
12450 */
12459 }
12460 /*
12461 * Do ultimate destination options
12462 */
12471 }
12472 /*
12473 * Now set the last header pointer to the proto passed in
12474 */
12477 }
12479 /*
12480 * Return a pointer to the routing header extension header
12481 * in the IPv6 header(s) chain passed in.
12482 * If none found, return NULL
12483 * Assumes that all extension headers are in same mblk as the v6 header
12484 */
12485 ip6_rthdr_t *
12487 {
12490 uint_t hdrlen;
12497 /*
12498 * The routing header will precede all extension headers
12499 * other than the hop-by-hop and destination options
12500 * extension headers, so if we see anything other than those,
12501 * we're done and didn't find it.
12502 * We could see a destination options header alone but no
12503 * routing header, in which case we'll return NULL as soon as
12504 * we see anything after that.
12505 * Hop-by-hop and destination option headers are identical,
12506 * so we can use either one we want as a template.
12507 */
12510 /* Is there enough left for len + nexthdr? */
12517 /* Assumes the headers are identical for hbh and dst */
12534 }
12536 }
12538 }
12540 /*
12541 * Called for source-routed packets originating on this node.
12542 * Manipulates the original routing header by moving every entry up
12543 * one slot, placing the first entry in the v6 header's v6_dst field,
12544 * and placing the ultimate destination in the routing header's last
12545 * slot.
12546 *
12547 * Returns the checksum diference between the ultimate destination
12548 * (last hop in the routing header when the packet is sent) and
12549 * the first hop (ip6_dst when the packet is sent)
12550 */
12551 /* ARGSUSED2 */
12552 uint32_t
12554 {
12555 uint_t numaddr;
12556 uint_t i;
12558 in6_addr_t tmp;
12564 /*
12565 * Perform any processing needed for source routing.
12566 * We know that all extension headers will be in the same mblk
12567 * as the IPv6 header.
12568 */
12570 /*
12571 * If no segments left in header, or the header length field is zero,
12572 * don't move hop addresses around;
12573 * Checksum difference is zero.
12574 */
12582 }
12585 /*
12586 * Here's where the fun begins - we have to
12587 * move all addresses up one spot, take the
12588 * first hop and make it our first ip6_dst,
12589 * and place the ultimate destination in the
12590 * newly-opened last slot.
12591 */
12597 }
12601 /*
12602 * From the checksummed ultimate destination subtract the checksummed
12603 * current ip6_dst (the first hop address). Return that number.
12604 * (In the v4 case, the second part of this is done in each routine
12605 * that calls ip_massage_options(). We do it all in this one place
12606 * for v6).
12607 */
12611 }
12614 cksm--;
12618 }
12620 /*
12621 * Propagate a multicast group membership operation (join/leave) (*fn) on
12622 * all interfaces crossed by the related multirt routes.
12623 * The call is considered successful if the operation succeeds
12624 * on at least one interface.
12625 * The function is called if the destination address in the packet to send
12626 * is multirouted.
12627 */
12628 int
12633 {
12656 /* No resolver exists for the gateway; skip this ire. */
12660 /*
12661 * A resolver exists: we can get the interface on which we have
12662 * to apply the operation.
12663 */
12665 first_mp);
12670 ulong_t off;
12675 "called %s, multirt group 0x%08x via itf 0x%08x, "
12681 }
12687 }
12688 }
12690 /*
12691 * Consider the call as successful if we succeeded on at least
12692 * one interface. Otherwise, return the last encountered error.
12693 */
12695 }
12697 void
12699 {
12722 };
12736 }
12738 void
12740 {
12744 }
12745 }
12747 /*
12748 * The following two functions set and get the value for the
12749 * IPV6_SRC_PREFERENCES socket option.
12750 */
12751 int
12753 {
12754 /*
12755 * We only support preferences that are covered by
12756 * IPV6_PREFER_SRC_MASK.
12757 */
12761 /*
12762 * Look for conflicting preferences or default preferences. If
12763 * both bits of a related pair are clear, the application wants the
12764 * system's default value for that pair. Both bits in a pair can't
12765 * be set.
12766 */
12770 IPV6_PREFER_SRC_MIPMASK) {
12772 }
12776 IPV6_PREFER_SRC_TMPMASK) {
12778 }
12782 IPV6_PREFER_SRC_CGAMASK) {
12784 }
12788 }
12790 size_t
12792 {
12795 }
12797 int
12799 {
12803 /*
12804 * Verify the source address and ifindex. Privileged users can use
12805 * any source address. For ancillary data the source address is
12806 * checked in ip_wput_v6.
12807 */
12813 }
12815 }
12823 else
12825 }
12827 }
12829 /*
12830 * Get the size of the IP options (including the IP headers size)
12831 * without including the AH header's size. If till_ah is B_FALSE,
12832 * and if AH header is present, dest options beyond AH header will
12833 * also be included in the returned size.
12834 */
12835 int
12837 {
12853 /* Assume IP has already stripped it */
12875 }
12876 /*
12877 * If we don't have a AH header to traverse,
12878 * return now. This happens normally for
12879 * outbound datagrams where we have not inserted
12880 * the AH header.
12881 */
12884 }
12886 /*
12887 * We don't include the AH header's size
12888 * to be symmetrical with other cases where
12889 * we either don't have a AH header (outbound)
12890 * or peek into the AH header yet (inbound and
12891 * not pulled up yet).
12892 */
12899 /*
12900 * The destination options header
12901 * is not part of the first mblk.
12902 */
12906 }
12911 }
12913 }
12916 }
12917 }
12919 /*
12920 * Utility routine that checks if `v6srcp' is a valid address on underlying
12921 * interface `ill'. If `ipifp' is non-NULL, it's set to a held ipif
12922 * associated with `v6srcp' on success. NOTE: if this is not called from
12923 * inside the IPSQ (ill_g_lock is not held), `ill' may be removed from the
12924 * group during or after this lookup.
12925 */
12926 static boolean_t
12928 {
12935 else
12938 }
12943 }
12945 }