?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge commit 'b1e7e97d3b60469b243b3b2e22c7d8cbd11c7c90'
[unleashed.git] / kernel / net / ip / ip6_ire.c
blob985572fffde8a4816237cd4c3ef5a3ea817e7ddc
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright (c) 1990 Mentat Inc.
24 */
25
26 /*
27 * This file contains routines that manipulate Internet Routing Entries (IREs).
28 */
29 #include <sys/types.h>
30 #include <sys/stream.h>
31 #include <sys/stropts.h>
32 #include <sys/ddi.h>
33 #include <sys/cmn_err.h>
34
35 #include <sys/systm.h>
36 #include <sys/param.h>
37 #include <sys/socket.h>
38 #include <net/if.h>
39 #include <net/route.h>
40 #include <netinet/in.h>
41 #include <net/if_dl.h>
42 #include <netinet/ip6.h>
43 #include <netinet/icmp6.h>
44
45 #include <inet/common.h>
46 #include <inet/mi.h>
47 #include <inet/ip.h>
48 #include <inet/ip6.h>
49 #include <inet/ip_ndp.h>
50 #include <inet/ip_if.h>
51 #include <inet/ip_ire.h>
52 #include <inet/ipclassifier.h>
53 #include <inet/nd.h>
54 #include <inet/tunables.h>
55 #include <sys/kmem.h>
56 #include <sys/zone.h>
57
58 #define IS_DEFAULT_ROUTE_V6(ire) \
59 (((ire)->ire_type & IRE_DEFAULT) || \
60 (((ire)->ire_type & IRE_INTERFACE) && \
61 (IN6_IS_ADDR_UNSPECIFIED(&(ire)->ire_addr_v6))))
62
63 static ire_t ire_null;
64
65 static ire_t *
66 ire_ftable_lookup_impl_v6(const in6_addr_t *addr, const in6_addr_t *mask,
67 const in6_addr_t *gateway, int type, const ill_t *ill,
68 zoneid_t zoneid, int flags, ip_stack_t *ipst);
69
70 /*
71 * Initialize the ire that is specific to IPv6 part and call
72 * ire_init_common to finish it.
73 * Returns zero or errno.
74 */
75 int
76 ire_init_v6(ire_t *ire, const in6_addr_t *v6addr, const in6_addr_t *v6mask,
77 const in6_addr_t *v6gateway, ushort_t type, ill_t *ill,
78 zoneid_t zoneid, uint_t flags, ip_stack_t *ipst)
79 {
80 int error;
81
82 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_alloced);
83 if (v6addr != NULL)
84 ire->ire_addr_v6 = *v6addr;
85 if (v6gateway != NULL)
86 ire->ire_gateway_addr_v6 = *v6gateway;
87
88 /* Make sure we don't have stray values in some fields */
89 switch (type) {
90 case IRE_LOOPBACK:
91 case IRE_HOST:
92 case IRE_LOCAL:
93 case IRE_IF_CLONE:
94 ire->ire_mask_v6 = ipv6_all_ones;
95 ire->ire_masklen = IPV6_ABITS;
96 break;
97 case IRE_PREFIX:
98 case IRE_DEFAULT:
99 case IRE_IF_RESOLVER:
100 case IRE_IF_NORESOLVER:
101 if (v6mask != NULL) {
102 ire->ire_mask_v6 = *v6mask;
103 ire->ire_masklen =
104 ip_mask_to_plen_v6(&ire->ire_mask_v6);
105 }
106 break;
107 case IRE_MULTICAST:
108 case IRE_NOROUTE:
109 ASSERT(v6mask == NULL);
110 break;
111 default:
112 ASSERT(0);
113 return (EINVAL);
114 }
115
116 error = ire_init_common(ire, type, ill, zoneid, flags, IPV6_VERSION,
117 ipst);
118 if (error != 0)
119 return (error);
120
121 /* Determine which function pointers to use */
122 ire->ire_postfragfn = ip_xmit; /* Common case */
123
124 switch (ire->ire_type) {
125 case IRE_LOCAL:
126 ire->ire_sendfn = ire_send_local_v6;
127 ire->ire_recvfn = ire_recv_local_v6;
128 ASSERT(ire->ire_ill != NULL);
129 if (ire->ire_ill->ill_flags & ILLF_NOACCEPT)
130 ire->ire_recvfn = ire_recv_noaccept_v6;
131 break;
132 case IRE_LOOPBACK:
133 ire->ire_sendfn = ire_send_local_v6;
134 ire->ire_recvfn = ire_recv_loopback_v6;
135 break;
136 case IRE_MULTICAST:
137 ire->ire_postfragfn = ip_postfrag_loopcheck;
138 ire->ire_sendfn = ire_send_multicast_v6;
139 ire->ire_recvfn = ire_recv_multicast_v6;
140 break;
141 default:
142 /*
143 * For IRE_IF_ALL and IRE_OFFLINK we forward received
144 * packets by default.
145 */
146 ire->ire_sendfn = ire_send_wire_v6;
147 ire->ire_recvfn = ire_recv_forward_v6;
148 break;
149 }
150 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
151 ire->ire_sendfn = ire_send_noroute_v6;
152 ire->ire_recvfn = ire_recv_noroute_v6;
153 }
154 ire->ire_nce_capable = ire_determine_nce_capable(ire);
155 return (0);
156 }
157
158 /*
159 * ire_create_v6 is called to allocate and initialize a new IRE.
160 *
161 * NOTE : This is called as writer sometimes though not required
162 * by this function.
163 */
164 /* ARGSUSED */
165 ire_t *
166 ire_create_v6(const in6_addr_t *v6addr, const in6_addr_t *v6mask,
167 const in6_addr_t *v6gateway, ushort_t type, ill_t *ill, zoneid_t zoneid,
168 uint_t flags, ip_stack_t *ipst)
169 {
170 ire_t *ire;
171 int error;
172
173 ASSERT(!IN6_IS_ADDR_V4MAPPED(v6addr));
174
175 ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
176 if (ire == NULL) {
177 DTRACE_PROBE(kmem__cache__alloc);
178 return (NULL);
179 }
180 *ire = ire_null;
181
182 error = ire_init_v6(ire, v6addr, v6mask, v6gateway,
183 type, ill, zoneid, flags, ipst);
184
185 if (error != 0) {
186 DTRACE_PROBE2(ire__init__v6, ire_t *, ire, int, error);
187 kmem_cache_free(ire_cache, ire);
188 return (NULL);
189 }
190 return (ire);
191 }
192
193 /*
194 * Find the ill matching a multicast group.
195 * Allows different routes for multicast addresses
196 * in the unicast routing table (akin to FF::0/8 but could be more specific)
197 * which point at different interfaces. This is used when IPV6_MULTICAST_IF
198 * isn't specified (when sending) and when IPV6_JOIN_GROUP doesn't
199 * specify the interface to join on.
200 *
201 * Supports link-local addresses by using ire_route_recursive which follows
202 * the ill when recursing.
203 *
204 * This is used in ip_set_destination etc to set ixa_postfragfn for multicast.
205 * We have a setsrcp argument for the same reason.
206 */
207 ill_t *
208 ire_lookup_multi_ill_v6(const in6_addr_t *group, zoneid_t zoneid,
209 ip_stack_t *ipst, in6_addr_t *setsrcp)
210 {
211 ire_t *ire;
212 ill_t *ill;
213
214 ire = ire_route_recursive_v6(group, 0, NULL, zoneid,
215 MATCH_IRE_DSTONLY, IRR_NONE, 0, ipst, setsrcp, NULL);
216 ASSERT(ire != NULL);
217
218 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
219 ire_refrele(ire);
220 return (NULL);
221 }
222
223 ill = ire_nexthop_ill(ire);
224 ire_refrele(ire);
225 return (ill);
226 }
227
228 /*
229 * This function takes a mask and returns number of bits set in the
230 * mask (the represented prefix length). Assumes a contiguous mask.
231 */
232 int
233 ip_mask_to_plen_v6(const in6_addr_t *v6mask)
234 {
235 int bits;
236 int plen = IPV6_ABITS;
237 int i;
238
239 for (i = 3; i >= 0; i--) {
240 if (v6mask->s6_addr32[i] == 0) {
241 plen -= 32;
242 continue;
243 }
244 bits = ffs(ntohl(v6mask->s6_addr32[i])) - 1;
245 if (bits == 0)
246 break;
247 plen -= bits;
248 }
249
250 return (plen);
251 }
252
253 /*
254 * Convert a prefix length to the mask for that prefix.
255 * Returns the argument bitmask.
256 */
257 in6_addr_t *
258 ip_plen_to_mask_v6(uint_t plen, in6_addr_t *bitmask)
259 {
260 uint32_t *ptr;
261
262 if (plen < 0 || plen > IPV6_ABITS)
263 return (NULL);
264 *bitmask = ipv6_all_zeros;
265 if (plen == 0)
266 return (bitmask);
267
268 ptr = (uint32_t *)bitmask;
269 while (plen > 32) {
270 *ptr++ = 0xffffffffU;
271 plen -= 32;
272 }
273 *ptr = htonl(0xffffffffU << (32 - plen));
274 return (bitmask);
275 }
276
277 /*
278 * Add a fully initialized IPv6 IRE to the forwarding table.
279 * This returns NULL on failure, or a held IRE on success.
280 * Normally the returned IRE is the same as the argument. But a different
281 * IRE will be returned if the added IRE is deemed identical to an existing
282 * one. In that case ire_identical_ref will be increased.
283 * The caller always needs to do an ire_refrele() on the returned IRE.
284 */
285 ire_t *
286 ire_add_v6(ire_t *ire)
287 {
288 ire_t *ire1;
289 int mask_table_index;
290 irb_t *irb_ptr;
291 ire_t **irep;
292 int match_flags;
293 int error;
294 ip_stack_t *ipst = ire->ire_ipst;
295
296 ASSERT(ire->ire_ipversion == IPV6_VERSION);
297
298 /* Make sure the address is properly masked. */
299 V6_MASK_COPY(ire->ire_addr_v6, ire->ire_mask_v6, ire->ire_addr_v6);
300
301 mask_table_index = ip_mask_to_plen_v6(&ire->ire_mask_v6);
302 if ((ipst->ips_ip_forwarding_table_v6[mask_table_index]) == NULL) {
303 irb_t *ptr;
304 int i;
305
306 ptr = (irb_t *)mi_zalloc((ipst->ips_ip6_ftable_hash_size *
307 sizeof (irb_t)));
308 if (ptr == NULL) {
309 ire_delete(ire);
310 return (NULL);
311 }
312 for (i = 0; i < ipst->ips_ip6_ftable_hash_size; i++) {
313 rw_init(&ptr[i].irb_lock, NULL, RW_DEFAULT, NULL);
314 ptr[i].irb_ipst = ipst;
315 }
316 mutex_enter(&ipst->ips_ire_ft_init_lock);
317 if (ipst->ips_ip_forwarding_table_v6[mask_table_index] ==
318 NULL) {
319 ipst->ips_ip_forwarding_table_v6[mask_table_index] =
320 ptr;
321 mutex_exit(&ipst->ips_ire_ft_init_lock);
322 } else {
323 /*
324 * Some other thread won the race in
325 * initializing the forwarding table at the
326 * same index.
327 */
328 mutex_exit(&ipst->ips_ire_ft_init_lock);
329 for (i = 0; i < ipst->ips_ip6_ftable_hash_size; i++) {
330 rw_destroy(&ptr[i].irb_lock);
331 }
332 mi_free(ptr);
333 }
334 }
335 irb_ptr = &(ipst->ips_ip_forwarding_table_v6[mask_table_index][
336 IRE_ADDR_MASK_HASH_V6(ire->ire_addr_v6, ire->ire_mask_v6,
337 ipst->ips_ip6_ftable_hash_size)]);
338
339 match_flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW);
340 if (ire->ire_ill != NULL)
341 match_flags |= MATCH_IRE_ILL;
342 /*
343 * Start the atomic add of the ire. Grab the bucket lock and the
344 * ill lock. Check for condemned.
345 */
346 error = ire_atomic_start(irb_ptr, ire);
347 if (error != 0) {
348 ire_delete(ire);
349 return (NULL);
350 }
351
352 /*
353 * If we are creating a hidden IRE, make sure we search for
354 * hidden IREs when searching for duplicates below.
355 * Otherwise, we might find an IRE on some other interface
356 * that's not marked hidden.
357 */
358 if (ire->ire_testhidden)
359 match_flags |= MATCH_IRE_TESTHIDDEN;
360
361 /*
362 * Atomically check for duplicate and insert in the table.
363 */
364 for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
365 if (IRE_IS_CONDEMNED(ire1))
366 continue;
367 /*
368 * Here we need an exact match on zoneid, i.e.,
369 * ire_match_args doesn't fit.
370 */
371 if (ire1->ire_zoneid != ire->ire_zoneid)
372 continue;
373
374 if (ire1->ire_type != ire->ire_type)
375 continue;
376
377 /*
378 * Note: We do not allow multiple routes that differ only
379 * in the gateway security attributes; such routes are
380 * considered duplicates.
381 * To change that we explicitly have to treat them as
382 * different here.
383 */
384 if (ire_match_args_v6(ire1, &ire->ire_addr_v6,
385 &ire->ire_mask_v6, &ire->ire_gateway_addr_v6,
386 ire->ire_type, ire->ire_ill, ire->ire_zoneid,
387 match_flags)) {
388 /*
389 * Return the old ire after doing a REFHOLD.
390 * As most of the callers continue to use the IRE
391 * after adding, we return a held ire. This will
392 * avoid a lookup in the caller again. If the callers
393 * don't want to use it, they need to do a REFRELE.
394 *
395 * We only allow exactly one IRE_IF_CLONE for any dst,
396 * so, if the is an IF_CLONE, return the ire without
397 * an identical_ref, but with an ire_ref held.
398 */
399 if (ire->ire_type != IRE_IF_CLONE) {
400 atomic_add_32(&ire1->ire_identical_ref, 1);
401 DTRACE_PROBE2(ire__add__exist, ire_t *, ire1,
402 ire_t *, ire);
403 }
404 ip1dbg(("found dup ire existing %p new %p",
405 (void *)ire1, (void *)ire));
406 ire_refhold(ire1);
407 ire_atomic_end(irb_ptr, ire);
408 ire_delete(ire);
409 return (ire1);
410 }
411 }
412
413 /*
414 * Normally we do head insertion since most things do not care about
415 * the order of the IREs in the bucket.
416 * However, due to shared-IP zones (and restrict_interzone_loopback)
417 * we can have an IRE_LOCAL as well as IRE_IF_CLONE for the same
418 * address. For that reason we do tail insertion for IRE_IF_CLONE.
419 */
420 irep = (ire_t **)irb_ptr;
421 if (ire->ire_type & IRE_IF_CLONE) {
422 while ((ire1 = *irep) != NULL)
423 irep = &ire1->ire_next;
424 }
425 /* Insert at *irep */
426 ire1 = *irep;
427 if (ire1 != NULL)
428 ire1->ire_ptpn = &ire->ire_next;
429 ire->ire_next = ire1;
430 /* Link the new one in. */
431 ire->ire_ptpn = irep;
432 /*
433 * ire_walk routines de-reference ire_next without holding
434 * a lock. Before we point to the new ire, we want to make
435 * sure the store that sets the ire_next of the new ire
436 * reaches global visibility, so that ire_walk routines
437 * don't see a truncated list of ires i.e if the ire_next
438 * of the new ire gets set after we do "*irep = ire" due
439 * to re-ordering, the ire_walk thread will see a NULL
440 * once it accesses the ire_next of the new ire.
441 * membar_producer() makes sure that the following store
442 * happens *after* all of the above stores.
443 */
444 membar_producer();
445 *irep = ire;
446 ire->ire_bucket = irb_ptr;
447 /*
448 * We return a bumped up IRE above. Keep it symmetrical
449 * so that the callers will always have to release. This
450 * helps the callers of this function because they continue
451 * to use the IRE after adding and hence they don't have to
452 * lookup again after we return the IRE.
453 *
454 * NOTE : We don't have to use atomics as this is appearing
455 * in the list for the first time and no one else can bump
456 * up the reference count on this yet.
457 */
458 ire_refhold_locked(ire);
459 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_inserted);
460 irb_ptr->irb_ire_cnt++;
461
462 if (ire->ire_ill != NULL) {
463 DTRACE_PROBE3(ill__incr__cnt, (ill_t *), ire->ire_ill,
464 (char *), "ire", (void *), ire);
465 ire->ire_ill->ill_ire_cnt++;
466 ASSERT(ire->ire_ill->ill_ire_cnt != 0); /* Wraparound */
467 }
468 ire_atomic_end(irb_ptr, ire);
469
470 /* Make any caching of the IREs be notified or updated */
471 ire_flush_cache_v6(ire, IRE_FLUSH_ADD);
472
473 return (ire);
474 }
475
476 /*
477 * Search for all HOST REDIRECT routes that are
478 * pointing at the specified gateway and
479 * delete them. This routine is called only
480 * when a default gateway is going away.
481 */
482 static void
483 ire_delete_host_redirects_v6(const in6_addr_t *gateway, ip_stack_t *ipst)
484 {
485 irb_t *irb_ptr;
486 irb_t *irb;
487 ire_t *ire;
488 in6_addr_t gw_addr_v6;
489 int i;
490
491 /* get the hash table for HOST routes */
492 irb_ptr = ipst->ips_ip_forwarding_table_v6[(IP6_MASK_TABLE_SIZE - 1)];
493 if (irb_ptr == NULL)
494 return;
495 for (i = 0; (i < ipst->ips_ip6_ftable_hash_size); i++) {
496 irb = &irb_ptr[i];
497 irb_refhold(irb);
498 for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
499 if (!(ire->ire_flags & RTF_DYNAMIC))
500 continue;
501 mutex_enter(&ire->ire_lock);
502 gw_addr_v6 = ire->ire_gateway_addr_v6;
503 mutex_exit(&ire->ire_lock);
504 if (IN6_ARE_ADDR_EQUAL(&gw_addr_v6, gateway))
505 ire_delete(ire);
506 }
507 irb_refrele(irb);
508 }
509 }
510
511 /*
512 * Delete the specified IRE.
513 * All calls should use ire_delete().
514 * Sometimes called as writer though not required by this function.
515 *
516 * NOTE : This function is called only if the ire was added
517 * in the list.
518 */
519 void
520 ire_delete_v6(ire_t *ire)
521 {
522 in6_addr_t gw_addr_v6;
523 ip_stack_t *ipst = ire->ire_ipst;
524
525 /*
526 * Make sure ire_generation increases from ire_flush_cache happen
527 * after any lookup/reader has read ire_generation.
528 * Since the rw_enter makes us wait until any lookup/reader has
529 * completed we can exit the lock immediately.
530 */
531 rw_enter(&ipst->ips_ip6_ire_head_lock, RW_WRITER);
532 rw_exit(&ipst->ips_ip6_ire_head_lock);
533
534 ASSERT(ire->ire_refcnt >= 1);
535 ASSERT(ire->ire_ipversion == IPV6_VERSION);
536
537 ire_flush_cache_v6(ire, IRE_FLUSH_DELETE);
538
539 if (ire->ire_type == IRE_DEFAULT) {
540 /*
541 * when a default gateway is going away
542 * delete all the host redirects pointing at that
543 * gateway.
544 */
545 mutex_enter(&ire->ire_lock);
546 gw_addr_v6 = ire->ire_gateway_addr_v6;
547 mutex_exit(&ire->ire_lock);
548 ire_delete_host_redirects_v6(&gw_addr_v6, ipst);
549 }
550
551 /*
552 * If we are deleting an IRE_INTERFACE then we make sure we also
553 * delete any IRE_IF_CLONE that has been created from it.
554 * Those are always in ire_dep_children.
555 */
556 if ((ire->ire_type & IRE_INTERFACE) && ire->ire_dep_children != 0)
557 ire_dep_delete_if_clone(ire);
558
559 /* Remove from parent dependencies and child */
560 rw_enter(&ipst->ips_ire_dep_lock, RW_WRITER);
561 if (ire->ire_dep_parent != NULL) {
562 ire_dep_remove(ire);
563 }
564 while (ire->ire_dep_children != NULL)
565 ire_dep_remove(ire->ire_dep_children);
566 rw_exit(&ipst->ips_ire_dep_lock);
567 }
568
569 /*
570 * When an IRE is added or deleted this routine is called to make sure
571 * any caching of IRE information is notified or updated.
572 *
573 * The flag argument indicates if the flush request is due to addition
574 * of new route (IRE_FLUSH_ADD), deletion of old route (IRE_FLUSH_DELETE),
575 * or a change to ire_gateway_addr (IRE_FLUSH_GWCHANGE).
576 */
577 void
578 ire_flush_cache_v6(ire_t *ire, int flag)
579 {
580 ip_stack_t *ipst = ire->ire_ipst;
581
582 /*
583 * IRE_IF_CLONE ire's don't provide any new information
584 * than the parent from which they are cloned, so don't
585 * perturb the generation numbers.
586 */
587 if (ire->ire_type & IRE_IF_CLONE)
588 return;
589
590 /*
591 * Ensure that an ire_add during a lookup serializes the updates of
592 * the generation numbers under ire_head_lock so that the lookup gets
593 * either the old ire and old generation number, or a new ire and new
594 * generation number.
595 */
596 rw_enter(&ipst->ips_ip6_ire_head_lock, RW_WRITER);
597
598 /*
599 * If a route was just added, we need to notify everybody that
600 * has cached an IRE_NOROUTE since there might now be a better
601 * route for them.
602 */
603 if (flag == IRE_FLUSH_ADD) {
604 ire_increment_generation(ipst->ips_ire_reject_v6);
605 ire_increment_generation(ipst->ips_ire_blackhole_v6);
606 }
607
608 /* Adding a default can't otherwise provide a better route */
609 if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD) {
610 rw_exit(&ipst->ips_ip6_ire_head_lock);
611 return;
612 }
613
614 switch (flag) {
615 case IRE_FLUSH_DELETE:
616 case IRE_FLUSH_GWCHANGE:
617 /*
618 * Update ire_generation for all ire_dep_children chains
619 * starting with this IRE
620 */
621 ire_dep_incr_generation(ire);
622 break;
623 case IRE_FLUSH_ADD: {
624 in6_addr_t addr;
625 in6_addr_t mask;
626 ip_stack_t *ipst = ire->ire_ipst;
627 uint_t masklen;
628
629 /*
630 * Find an IRE which is a shorter match than the ire to be added
631 * For any such IRE (which we repeat) we update the
632 * ire_generation the same way as in the delete case.
633 */
634 addr = ire->ire_addr_v6;
635 mask = ire->ire_mask_v6;
636 masklen = ip_mask_to_plen_v6(&mask);
637
638 ire = ire_ftable_lookup_impl_v6(&addr, &mask, NULL, 0, NULL,
639 ALL_ZONES, MATCH_IRE_SHORTERMASK, ipst);
640 while (ire != NULL) {
641 /* We need to handle all in the same bucket */
642 irb_increment_generation(ire->ire_bucket);
643
644 mask = ire->ire_mask_v6;
645 ASSERT(masklen > ip_mask_to_plen_v6(&mask));
646 masklen = ip_mask_to_plen_v6(&mask);
647 ire_refrele(ire);
648 ire = ire_ftable_lookup_impl_v6(&addr, &mask, NULL, 0,
649 NULL, ALL_ZONES, MATCH_IRE_SHORTERMASK, ipst);
650 }
651 }
652 break;
653 }
654 rw_exit(&ipst->ips_ip6_ire_head_lock);
655 }
656
657 /*
658 * Matches the arguments passed with the values in the ire.
659 *
660 * Note: for match types that match using "ill" passed in, ill
661 * must be checked for non-NULL before calling this routine.
662 */
663 boolean_t
664 ire_match_args_v6(ire_t *ire, const in6_addr_t *addr, const in6_addr_t *mask,
665 const in6_addr_t *gateway, int type, const ill_t *ill, zoneid_t zoneid,
666 int match_flags)
667 {
668 in6_addr_t gw_addr_v6;
669 ill_t *ire_ill = NULL, *dst_ill;
670 ip_stack_t *ipst = ire->ire_ipst;
671
672 ASSERT(ire->ire_ipversion == IPV6_VERSION);
673 ASSERT(addr != NULL);
674 ASSERT(mask != NULL);
675 ASSERT((!(match_flags & MATCH_IRE_GW)) || gateway != NULL);
676 ASSERT((!(match_flags & (MATCH_IRE_ILL|MATCH_IRE_SRC_ILL))) ||
677 (ill != NULL && ill->ill_isv6));
678
679 /*
680 * If MATCH_IRE_TESTHIDDEN is set, then only return the IRE if it
681 * is in fact hidden, to ensure the caller gets the right one.
682 */
683 if (ire->ire_testhidden) {
684 if (!(match_flags & MATCH_IRE_TESTHIDDEN))
685 return (B_FALSE);
686 }
687
688 if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid &&
689 ire->ire_zoneid != ALL_ZONES) {
690 /*
691 * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid
692 * does not match that of ire_zoneid, a failure to
693 * match is reported at this point. Otherwise, since some IREs
694 * that are available in the global zone can be used in local
695 * zones, additional checks need to be performed:
696 *
697 * IRE_LOOPBACK
698 * entries should never be matched in this situation.
699 * Each zone has its own IRE_LOOPBACK.
700 *
701 * IRE_LOCAL
702 * We allow them for any zoneid. ire_route_recursive
703 * does additional checks when
704 * ip_restrict_interzone_loopback is set.
705 *
706 * If ill_usesrc_ifindex is set
707 * Then we check if the zone has a valid source address
708 * on the usesrc ill.
709 *
710 * If ire_ill is set, then check that the zone has an ipif
711 * on that ill.
712 *
713 * Outside of this function (in ire_round_robin) we check
714 * that any IRE_OFFLINK has a gateway that reachable from the
715 * zone when we have multiple choices (ECMP).
716 */
717 if (match_flags & MATCH_IRE_ZONEONLY)
718 return (B_FALSE);
719 if (ire->ire_type & IRE_LOOPBACK)
720 return (B_FALSE);
721
722 if (ire->ire_type & IRE_LOCAL)
723 goto matchit;
724
725 /*
726 * The normal case of IRE_ONLINK has a matching zoneid.
727 * Here we handle the case when shared-IP zones have been
728 * configured with IP addresses on vniN. In that case it
729 * is ok for traffic from a zone to use IRE_ONLINK routes
730 * if the ill has a usesrc pointing at vniN
731 * Applies to IRE_INTERFACE.
732 */
733 dst_ill = ire->ire_ill;
734 if (ire->ire_type & IRE_ONLINK) {
735 uint_t ifindex;
736
737 /*
738 * Note there is no IRE_INTERFACE on vniN thus
739 * can't do an IRE lookup for a matching route.
740 */
741 ifindex = dst_ill->ill_usesrc_ifindex;
742 if (ifindex == 0)
743 return (B_FALSE);
744
745 /*
746 * If there is a usable source address in the
747 * zone, then it's ok to return this IRE_INTERFACE
748 */
749 if (!ipif_zone_avail(ifindex, dst_ill->ill_isv6,
750 zoneid, ipst)) {
751 ip3dbg(("ire_match_args: no usrsrc for zone"
752 " dst_ill %p\n", (void *)dst_ill));
753 return (B_FALSE);
754 }
755 }
756 /*
757 * For example, with
758 * route add 11.0.0.0 gw1 -ifp bge0
759 * route add 11.0.0.0 gw2 -ifp bge1
760 * this code would differentiate based on
761 * where the sending zone has addresses.
762 * Only if the zone has an address on bge0 can it use the first
763 * route. It isn't clear if this behavior is documented
764 * anywhere.
765 */
766 if (dst_ill != NULL && (ire->ire_type & IRE_OFFLINK)) {
767 ipif_t *tipif;
768
769 mutex_enter(&dst_ill->ill_lock);
770 for (tipif = dst_ill->ill_ipif;
771 tipif != NULL; tipif = tipif->ipif_next) {
772 if (!IPIF_IS_CONDEMNED(tipif) &&
773 (tipif->ipif_flags & IPIF_UP) &&
774 (tipif->ipif_zoneid == zoneid ||
775 tipif->ipif_zoneid == ALL_ZONES))
776 break;
777 }
778 mutex_exit(&dst_ill->ill_lock);
779 if (tipif == NULL)
780 return (B_FALSE);
781 }
782 }
783
784 matchit:
785 ire_ill = ire->ire_ill;
786 if (match_flags & MATCH_IRE_GW) {
787 mutex_enter(&ire->ire_lock);
788 gw_addr_v6 = ire->ire_gateway_addr_v6;
789 mutex_exit(&ire->ire_lock);
790 }
791 if (match_flags & MATCH_IRE_ILL) {
792
793 /*
794 * If asked to match an ill, we *must* match
795 * on the ire_ill for ipmp test addresses, or
796 * any of the ill in the group for data addresses.
797 * If we don't, we may as well fail.
798 * However, we need an exception for IRE_LOCALs to ensure
799 * we loopback packets even sent to test addresses on different
800 * interfaces in the group.
801 */
802 if ((match_flags & MATCH_IRE_TESTHIDDEN) &&
803 !(ire->ire_type & IRE_LOCAL)) {
804 if (ire->ire_ill != ill)
805 return (B_FALSE);
806 } else {
807 match_flags &= ~MATCH_IRE_TESTHIDDEN;
808 /*
809 * We know that ill is not NULL, but ire_ill could be
810 * NULL
811 */
812 if (ire_ill == NULL || !IS_ON_SAME_LAN(ill, ire_ill))
813 return (B_FALSE);
814 }
815 }
816 if (match_flags & MATCH_IRE_SRC_ILL) {
817 if (ire_ill == NULL)
818 return (B_FALSE);
819 if (!IS_ON_SAME_LAN(ill, ire_ill)) {
820 if (ire_ill->ill_usesrc_ifindex == 0 ||
821 (ire_ill->ill_usesrc_ifindex !=
822 ill->ill_phyint->phyint_ifindex))
823 return (B_FALSE);
824 }
825 }
826
827 /* No ire_addr_v6 bits set past the mask */
828 ASSERT(V6_MASK_EQ(ire->ire_addr_v6, ire->ire_mask_v6,
829 ire->ire_addr_v6));
830 if (V6_MASK_EQ(*addr, *mask, ire->ire_addr_v6) &&
831 ((!(match_flags & MATCH_IRE_GW)) ||
832 ((!(match_flags & MATCH_IRE_DIRECT)) ||
833 !(ire->ire_flags & RTF_INDIRECT)) &&
834 IN6_ARE_ADDR_EQUAL(&gw_addr_v6, gateway)) &&
835 ((!(match_flags & MATCH_IRE_TYPE)) || (ire->ire_type & type)) &&
836 ((!(match_flags & MATCH_IRE_TESTHIDDEN)) || ire->ire_testhidden) &&
837 ((!(match_flags & MATCH_IRE_MASK)) ||
838 (IN6_ARE_ADDR_EQUAL(&ire->ire_mask_v6, mask)))) {
839 /* We found the matched IRE */
840 return (B_TRUE);
841 }
842 return (B_FALSE);
843 }
844
845 /*
846 * Check if the zoneid (not ALL_ZONES) has an IRE_INTERFACE for the specified
847 * gateway address. If ill is non-NULL we also match on it.
848 * The caller must hold a read lock on RADIX_NODE_HEAD if lock_held is set.
849 */
850 boolean_t
851 ire_gateway_ok_zone_v6(const in6_addr_t *gateway, zoneid_t zoneid, ill_t *ill,
852 ip_stack_t *ipst, boolean_t lock_held)
853 {
854 ire_t *ire;
855 uint_t match_flags;
856
857 if (lock_held)
858 ASSERT(RW_READ_HELD(&ipst->ips_ip6_ire_head_lock));
859 else
860 rw_enter(&ipst->ips_ip6_ire_head_lock, RW_READER);
861
862 match_flags = MATCH_IRE_TYPE;
863 if (ill != NULL)
864 match_flags |= MATCH_IRE_ILL;
865
866 ire = ire_ftable_lookup_impl_v6(gateway, &ipv6_all_zeros,
867 &ipv6_all_zeros, IRE_INTERFACE, ill, zoneid, match_flags,
868 ipst);
869
870 if (!lock_held)
871 rw_exit(&ipst->ips_ip6_ire_head_lock);
872 if (ire != NULL) {
873 ire_refrele(ire);
874 return (B_TRUE);
875 } else {
876 return (B_FALSE);
877 }
878 }
879
880 /*
881 * Lookup a route in forwarding table.
882 * specific lookup is indicated by passing the
883 * required parameters and indicating the
884 * match required in flag field.
885 *
886 * Supports link-local addresses by following the ipif/ill when recursing.
887 */
888 ire_t *
889 ire_ftable_lookup_v6(const in6_addr_t *addr, const in6_addr_t *mask,
890 const in6_addr_t *gateway, int type, const ill_t *ill,
891 zoneid_t zoneid, int flags, uint32_t xmit_hint, ip_stack_t *ipst,
892 uint_t *generationp)
893 {
894 ire_t *ire = NULL;
895
896 ASSERT(addr != NULL);
897 ASSERT((!(flags & MATCH_IRE_MASK)) || mask != NULL);
898 ASSERT((!(flags & MATCH_IRE_GW)) || gateway != NULL);
899 ASSERT(ill == NULL || ill->ill_isv6);
900
901 ASSERT(!IN6_IS_ADDR_V4MAPPED(addr));
902
903 /*
904 * ire_match_args_v6() will dereference ill if MATCH_IRE_ILL
905 * or MATCH_IRE_SRC_ILL is set.
906 */
907 if ((flags & (MATCH_IRE_ILL|MATCH_IRE_SRC_ILL)) && (ill == NULL))
908 return (NULL);
909
910 rw_enter(&ipst->ips_ip6_ire_head_lock, RW_READER);
911 ire = ire_ftable_lookup_impl_v6(addr, mask, gateway, type, ill, zoneid,
912 flags, ipst);
913 if (ire == NULL) {
914 rw_exit(&ipst->ips_ip6_ire_head_lock);
915 return (NULL);
916 }
917
918 /*
919 * round-robin only if we have more than one route in the bucket.
920 * ips_ip_ecmp_behavior controls when we do ECMP
921 * 2: always
922 * 1: for IRE_DEFAULT and /0 IRE_INTERFACE
923 * 0: never
924 *
925 * Note: if we found an IRE_IF_CLONE we won't look at the bucket with
926 * other ECMP IRE_INTERFACEs since the IRE_IF_CLONE is a /128 match
927 * and the IRE_INTERFACESs are likely to be shorter matches.
928 */
929 if (ire->ire_bucket->irb_ire_cnt > 1 && !(flags & MATCH_IRE_GW)) {
930 if (ipst->ips_ip_ecmp_behavior == 2 ||
931 (ipst->ips_ip_ecmp_behavior == 1 &&
932 IS_DEFAULT_ROUTE_V6(ire))) {
933 ire_t *next_ire;
934 ire_ftable_args_t margs;
935
936 bzero(&margs, sizeof (margs));
937 margs.ift_addr_v6 = *addr;
938 if (mask != NULL)
939 margs.ift_mask_v6 = *mask;
940 if (gateway != NULL)
941 margs.ift_gateway_v6 = *gateway;
942 margs.ift_type = type;
943 margs.ift_ill = ill;
944 margs.ift_zoneid = zoneid;
945 margs.ift_flags = flags;
946
947 next_ire = ire_round_robin(ire->ire_bucket, &margs,
948 xmit_hint, ire, ipst);
949 if (next_ire == NULL) {
950 /* keep ire if next_ire is null */
951 goto done;
952 }
953 ire_refrele(ire);
954 ire = next_ire;
955 }
956 }
957
958 done:
959 /* Return generation before dropping lock */
960 if (generationp != NULL)
961 *generationp = ire->ire_generation;
962
963 rw_exit(&ipst->ips_ip6_ire_head_lock);
964
965 /*
966 * For shared-IP zones we need additional checks to what was
967 * done in ire_match_args to make sure IRE_LOCALs are handled.
968 *
969 * When ip_restrict_interzone_loopback is set, then
970 * we ensure that IRE_LOCAL are only used for loopback
971 * between zones when the logical "Ethernet" would
972 * have looped them back. That is, if in the absense of
973 * the IRE_LOCAL we would have sent to packet out the
974 * same ill.
975 */
976 if ((ire->ire_type & IRE_LOCAL) && zoneid != ALL_ZONES &&
977 ire->ire_zoneid != zoneid && ire->ire_zoneid != ALL_ZONES &&
978 ipst->ips_ip_restrict_interzone_loopback) {
979 ire = ire_alt_local(ire, zoneid, ill, generationp);
980 ASSERT(ire != NULL);
981 }
982
983 return (ire);
984 }
985
986 /*
987 * Look up a single ire. The caller holds either the read or write lock.
988 */
989 ire_t *
990 ire_ftable_lookup_impl_v6(const in6_addr_t *addr, const in6_addr_t *mask,
991 const in6_addr_t *gateway, int type, const ill_t *ill,
992 zoneid_t zoneid, int flags, ip_stack_t *ipst)
993 {
994 irb_t *irb_ptr;
995 ire_t *ire = NULL;
996 int i;
997
998 ASSERT(RW_LOCK_HELD(&ipst->ips_ip6_ire_head_lock));
999
1000 /*
1001 * If the mask is known, the lookup
1002 * is simple, if the mask is not known
1003 * we need to search.
1004 */
1005 if (flags & MATCH_IRE_MASK) {
1006 uint_t masklen;
1007
1008 masklen = ip_mask_to_plen_v6(mask);
1009 if (ipst->ips_ip_forwarding_table_v6[masklen] == NULL) {
1010 return (NULL);
1011 }
1012 irb_ptr = &(ipst->ips_ip_forwarding_table_v6[masklen][
1013 IRE_ADDR_MASK_HASH_V6(*addr, *mask,
1014 ipst->ips_ip6_ftable_hash_size)]);
1015 rw_enter(&irb_ptr->irb_lock, RW_READER);
1016 for (ire = irb_ptr->irb_ire; ire != NULL;
1017 ire = ire->ire_next) {
1018 if (IRE_IS_CONDEMNED(ire))
1019 continue;
1020 if (ire_match_args_v6(ire, addr, mask, gateway, type,
1021 ill, zoneid, flags))
1022 goto found_ire;
1023 }
1024 rw_exit(&irb_ptr->irb_lock);
1025 } else {
1026 uint_t masklen;
1027
1028 /*
1029 * In this case we don't know the mask, we need to
1030 * search the table assuming different mask sizes.
1031 */
1032 if (flags & MATCH_IRE_SHORTERMASK) {
1033 masklen = ip_mask_to_plen_v6(mask);
1034 if (masklen == 0) {
1035 /* Nothing shorter than zero */
1036 return (NULL);
1037 }
1038 masklen--;
1039 } else {
1040 masklen = IP6_MASK_TABLE_SIZE - 1;
1041 }
1042
1043 for (i = masklen; i >= 0; i--) {
1044 in6_addr_t tmpmask;
1045
1046 if ((ipst->ips_ip_forwarding_table_v6[i]) == NULL)
1047 continue;
1048 (void) ip_plen_to_mask_v6(i, &tmpmask);
1049 irb_ptr = &ipst->ips_ip_forwarding_table_v6[i][
1050 IRE_ADDR_MASK_HASH_V6(*addr, tmpmask,
1051 ipst->ips_ip6_ftable_hash_size)];
1052 rw_enter(&irb_ptr->irb_lock, RW_READER);
1053 for (ire = irb_ptr->irb_ire; ire != NULL;
1054 ire = ire->ire_next) {
1055 if (IRE_IS_CONDEMNED(ire))
1056 continue;
1057 if (ire_match_args_v6(ire, addr,
1058 &ire->ire_mask_v6, gateway, type, ill,
1059 zoneid, flags))
1060 goto found_ire;
1061 }
1062 rw_exit(&irb_ptr->irb_lock);
1063 }
1064 }
1065 ASSERT(ire == NULL);
1066 ip1dbg(("ire_ftable_lookup_v6: returning NULL ire"));
1067 return (NULL);
1068
1069 found_ire:
1070 ire_refhold(ire);
1071 rw_exit(&irb_ptr->irb_lock);
1072 return (ire);
1073 }
1074
1075
1076 /*
1077 * This function is called by
1078 * ip_input/ire_route_recursive when doing a route lookup on only the
1079 * destination address.
1080 *
1081 * The optimizations of this function over ire_ftable_lookup are:
1082 * o removing unnecessary flag matching
1083 * o doing longest prefix match instead of overloading it further
1084 * with the unnecessary "best_prefix_match"
1085 *
1086 * If no route is found we return IRE_NOROUTE.
1087 */
1088 ire_t *
1089 ire_ftable_lookup_simple_v6(const in6_addr_t *addr, uint32_t xmit_hint,
1090 ip_stack_t *ipst, uint_t *generationp)
1091 {
1092 ire_t *ire;
1093
1094 ire = ire_ftable_lookup_v6(addr, NULL, NULL, 0, NULL, ALL_ZONES,
1095 MATCH_IRE_DSTONLY, xmit_hint, ipst, generationp);
1096 if (ire == NULL) {
1097 ire = ire_reject(ipst, B_TRUE);
1098 if (generationp != NULL)
1099 *generationp = IRE_GENERATION_VERIFY;
1100 }
1101 /* ftable_lookup did round robin */
1102 return (ire);
1103 }
1104
1105 ire_t *
1106 ip_select_route_v6(const in6_addr_t *dst, const in6_addr_t src,
1107 ip_xmit_attr_t *ixa, uint_t *generationp, in6_addr_t *setsrcp,
1108 int *errorp)
1109 {
1110 ASSERT(!(ixa->ixa_flags & IXAF_IS_IPV4));
1111
1112 return (ip_select_route(dst, src, ixa, generationp, setsrcp, errorp));
1113 }
1114
1115 /*
1116 * Recursively look for a route to the destination. Can also match on
1117 * the zoneid and ill. Used for the data paths. See also
1118 * ire_route_recursive_dstonly.
1119 *
1120 * If IRR_ALLOCATE is not set then we will only inspect the existing IREs; never
1121 * create an IRE_IF_CLONE. This is used on the receive side when we are not
1122 * forwarding.
1123 * If IRR_INCOMPLETE is set then we return the IRE even if we can't correctly
1124 * resolve the gateway.
1125 *
1126 * Note that this function never returns NULL. It returns an IRE_NOROUTE
1127 * instead.
1128 *
1129 * If we find any IRE_LOCAL|BROADCAST etc past the first iteration it
1130 * is an error.
1131 * Allow at most one RTF_INDIRECT.
1132 */
1133 ire_t *
1134 ire_route_recursive_impl_v6(ire_t *ire,
1135 const in6_addr_t *nexthop, uint_t ire_type, const ill_t *ill_arg,
1136 zoneid_t zoneid, uint_t match_args,
1137 uint_t irr_flags, uint32_t xmit_hint, ip_stack_t *ipst,
1138 in6_addr_t *setsrcp, uint_t *generationp)
1139 {
1140 int i, j;
1141 in6_addr_t v6nexthop = *nexthop;
1142 ire_t *ires[MAX_IRE_RECURSION];
1143 uint_t generation;
1144 uint_t generations[MAX_IRE_RECURSION];
1145 boolean_t need_refrele = B_FALSE;
1146 boolean_t invalidate = B_FALSE;
1147 ill_t *ill = NULL;
1148 uint_t maskoff = (IRE_LOCAL|IRE_LOOPBACK);
1149
1150 if (setsrcp != NULL)
1151 ASSERT(IN6_IS_ADDR_UNSPECIFIED(setsrcp));
1152
1153 /*
1154 * We iterate up to three times to resolve a route, even though
1155 * we have four slots in the array. The extra slot is for an
1156 * IRE_IF_CLONE we might need to create.
1157 */
1158 i = 0;
1159 while (i < MAX_IRE_RECURSION - 1) {
1160 /* ire_ftable_lookup handles round-robin/ECMP */
1161 if (ire == NULL) {
1162 ire = ire_ftable_lookup_v6(&v6nexthop, 0, 0, ire_type,
1163 (ill != NULL ? ill : ill_arg), zoneid, match_args,
1164 xmit_hint, ipst, &generation);
1165 } else {
1166 /* Caller passed it; extra hold since we will rele */
1167 ire_refhold(ire);
1168 if (generationp != NULL)
1169 generation = *generationp;
1170 else
1171 generation = IRE_GENERATION_VERIFY;
1172 }
1173
1174 if (ire == NULL) {
1175 if (i > 0 && (irr_flags & IRR_INCOMPLETE)) {
1176 ire = ires[0];
1177 ire_refhold(ire);
1178 } else {
1179 ire = ire_reject(ipst, B_TRUE);
1180 }
1181 goto error;
1182 }
1183
1184 /* Need to return the ire with RTF_REJECT|BLACKHOLE */
1185 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))
1186 goto error;
1187
1188 ASSERT(!(ire->ire_type & IRE_MULTICAST)); /* Not in ftable */
1189 /*
1190 * Verify that the IRE_IF_CLONE has a consistent generation
1191 * number.
1192 */
1193 if ((ire->ire_type & IRE_IF_CLONE) && !ire_clone_verify(ire)) {
1194 ire_refrele(ire);
1195 ire = NULL;
1196 continue;
1197 }
1198
1199 /*
1200 * Don't allow anything unusual past the first iteration.
1201 * After the first lookup, we should no longer look for
1202 * (IRE_LOCAL|IRE_LOOPBACK) or RTF_INDIRECT routes.
1203 *
1204 * In addition, after we have found a direct IRE_OFFLINK,
1205 * we should only look for interface or clone routes.
1206 */
1207 match_args |= MATCH_IRE_DIRECT; /* no more RTF_INDIRECTs */
1208 if ((ire->ire_type & IRE_OFFLINK) &&
1209 !(ire->ire_flags & RTF_INDIRECT)) {
1210 ire_type = IRE_IF_ALL;
1211 } else {
1212 if (!(match_args & MATCH_IRE_TYPE))
1213 ire_type = (IRE_OFFLINK|IRE_ONLINK);
1214 ire_type &= ~maskoff; /* no more LOCAL, LOOPBACK */
1215 }
1216 match_args |= MATCH_IRE_TYPE;
1217 /* We have a usable IRE */
1218 ires[i] = ire;
1219 generations[i] = generation;
1220 i++;
1221
1222 /* The first RTF_SETSRC address is passed back if setsrcp */
1223 if ((ire->ire_flags & RTF_SETSRC) &&
1224 setsrcp != NULL && IN6_IS_ADDR_UNSPECIFIED(setsrcp)) {
1225 ASSERT(!IN6_IS_ADDR_UNSPECIFIED(
1226 &ire->ire_setsrc_addr_v6));
1227 *setsrcp = ire->ire_setsrc_addr_v6;
1228 }
1229
1230 /*
1231 * Check if we have a short-cut pointer to an IRE for this
1232 * destination, and that the cached dependency isn't stale.
1233 * In that case we've rejoined an existing tree towards a
1234 * parent, thus we don't need to continue the loop to
1235 * discover the rest of the tree.
1236 */
1237 mutex_enter(&ire->ire_lock);
1238 if (ire->ire_dep_parent != NULL &&
1239 ire->ire_dep_parent->ire_generation ==
1240 ire->ire_dep_parent_generation) {
1241 mutex_exit(&ire->ire_lock);
1242 ire = NULL;
1243 goto done;
1244 }
1245 mutex_exit(&ire->ire_lock);
1246
1247 /*
1248 * If this type should have an ire_nce_cache (even if it
1249 * doesn't yet have one) then we are done. Includes
1250 * IRE_INTERFACE with a full 128 bit mask.
1251 */
1252 if (ire->ire_nce_capable) {
1253 ire = NULL;
1254 goto done;
1255 }
1256 ASSERT(!(ire->ire_type & IRE_IF_CLONE));
1257 /*
1258 * For an IRE_INTERFACE we create an IRE_IF_CLONE for this
1259 * particular destination
1260 */
1261 if (ire->ire_type & IRE_INTERFACE) {
1262 ire_t *clone;
1263
1264 ASSERT(ire->ire_masklen != IPV6_ABITS);
1265
1266 /*
1267 * In the case of ip_input and ILLF_FORWARDING not
1268 * being set, and in the case of RTM_GET, there is
1269 * no point in allocating an IRE_IF_CLONE. We return
1270 * the IRE_INTERFACE. Note that !IRR_ALLOCATE can
1271 * result in a ire_dep_parent which is IRE_IF_*
1272 * without an IRE_IF_CLONE.
1273 * We recover from that when we need to send packets
1274 * by ensuring that the generations become
1275 * IRE_GENERATION_VERIFY in this case.
1276 */
1277 if (!(irr_flags & IRR_ALLOCATE)) {
1278 invalidate = B_TRUE;
1279 ire = NULL;
1280 goto done;
1281 }
1282
1283 clone = ire_create_if_clone(ire, &v6nexthop,
1284 &generation);
1285 if (clone == NULL) {
1286 /*
1287 * Temporary failure - no memory.
1288 * Don't want caller to cache IRE_NOROUTE.
1289 */
1290 invalidate = B_TRUE;
1291 ire = ire_blackhole(ipst, B_TRUE);
1292 goto error;
1293 }
1294 /*
1295 * Make clone next to last entry and the
1296 * IRE_INTERFACE the last in the dependency
1297 * chain since the clone depends on the
1298 * IRE_INTERFACE.
1299 */
1300 ASSERT(i >= 1);
1301 ASSERT(i < MAX_IRE_RECURSION);
1302
1303 ires[i] = ires[i-1];
1304 generations[i] = generations[i-1];
1305 ires[i-1] = clone;
1306 generations[i-1] = generation;
1307 i++;
1308
1309 ire = NULL;
1310 goto done;
1311 }
1312
1313 /*
1314 * We only match on the type and optionally ILL when
1315 * recursing. The type match is used by some callers
1316 * to exclude certain types (such as IRE_IF_CLONE or
1317 * IRE_LOCAL|IRE_LOOPBACK).
1318 *
1319 * In the MATCH_IRE_SRC_ILL case, ill_arg may be the 'srcof'
1320 * ire->ire_ill, and we want to find the IRE_INTERFACE for
1321 * ire_ill, so we set ill to the ire_ill
1322 */
1323 match_args &= (MATCH_IRE_TYPE | MATCH_IRE_DIRECT);
1324 v6nexthop = ire->ire_gateway_addr_v6;
1325 if (ill == NULL && ire->ire_ill != NULL) {
1326 ill = ire->ire_ill;
1327 need_refrele = B_TRUE;
1328 ill_refhold(ill);
1329 match_args |= MATCH_IRE_ILL;
1330 }
1331 ire = NULL;
1332 }
1333 ASSERT(ire == NULL);
1334 ire = ire_reject(ipst, B_TRUE);
1335
1336 error:
1337 ASSERT(ire != NULL);
1338 if (need_refrele)
1339 ill_refrele(ill);
1340
1341 cleanup:
1342 /* cleanup ires[i] */
1343 ire_dep_unbuild(ires, i);
1344 for (j = 0; j < i; j++)
1345 ire_refrele(ires[j]);
1346
1347 ASSERT((ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) ||
1348 (irr_flags & IRR_INCOMPLETE));
1349 /*
1350 * Use IRE_GENERATION_VERIFY to ensure that ip_output will redo the
1351 * ip_select_route since the reject or lack of memory might be gone.
1352 */
1353 if (generationp != NULL)
1354 *generationp = IRE_GENERATION_VERIFY;
1355 return (ire);
1356
1357 done:
1358 ASSERT(ire == NULL);
1359 if (need_refrele)
1360 ill_refrele(ill);
1361
1362 /* Build dependencies */
1363 if (i > 1 && !ire_dep_build(ires, generations, i)) {
1364 /* Something in chain was condemned; tear it apart */
1365 ire = ire_blackhole(ipst, B_TRUE);
1366 goto cleanup;
1367 }
1368
1369 /*
1370 * Release all refholds except the one for ires[0] that we
1371 * will return to the caller.
1372 */
1373 for (j = 1; j < i; j++)
1374 ire_refrele(ires[j]);
1375
1376 if (invalidate) {
1377 /*
1378 * Since we needed to allocate but couldn't we need to make
1379 * sure that the dependency chain is rebuilt the next time.
1380 */
1381 ire_dep_invalidate_generations(ires[0]);
1382 generation = IRE_GENERATION_VERIFY;
1383 } else {
1384 /*
1385 * IREs can have been added or deleted while we did the
1386 * recursive lookup and we can't catch those until we've built
1387 * the dependencies. We verify the stored
1388 * ire_dep_parent_generation to catch any such changes and
1389 * return IRE_GENERATION_VERIFY (which will cause
1390 * ip_select_route to be called again so we can redo the
1391 * recursive lookup next time we send a packet.
1392 */
1393 if (ires[0]->ire_dep_parent == NULL)
1394 generation = ires[0]->ire_generation;
1395 else
1396 generation = ire_dep_validate_generations(ires[0]);
1397 if (generations[0] != ires[0]->ire_generation) {
1398 /* Something changed at the top */
1399 generation = IRE_GENERATION_VERIFY;
1400 }
1401 }
1402 if (generationp != NULL)
1403 *generationp = generation;
1404
1405 return (ires[0]);
1406 }
1407
1408 ire_t *
1409 ire_route_recursive_v6(const in6_addr_t *nexthop, uint_t ire_type,
1410 const ill_t *ill, zoneid_t zoneid, uint_t match_args, uint_t irr_flags,
1411 uint32_t xmit_hint, ip_stack_t *ipst, in6_addr_t *setsrcp,
1412 uint_t *generationp)
1413 {
1414 return (ire_route_recursive_impl_v6(NULL, nexthop, ire_type, ill,
1415 zoneid, match_args, irr_flags, xmit_hint, ipst, setsrcp,
1416 generationp));
1417 }
1418
1419 /*
1420 * Recursively look for a route to the destination.
1421 * We only handle a destination match here, yet we have the same arguments
1422 * as the full match to allow function pointers to select between the two.
1423 *
1424 * Note that this function never returns NULL. It returns an IRE_NOROUTE
1425 * instead.
1426 *
1427 * If we find any IRE_LOCAL|BROADCAST etc past the first iteration it
1428 * is an error.
1429 * Allow at most one RTF_INDIRECT.
1430 */
1431 ire_t *
1432 ire_route_recursive_dstonly_v6(const in6_addr_t *nexthop, uint_t irr_flags,
1433 uint32_t xmit_hint, ip_stack_t *ipst)
1434 {
1435 ire_t *ire;
1436 ire_t *ire1;
1437 uint_t generation;
1438
1439 /* ire_ftable_lookup handles round-robin/ECMP */
1440 ire = ire_ftable_lookup_simple_v6(nexthop, xmit_hint, ipst,
1441 &generation);
1442 ASSERT(ire != NULL);
1443
1444 /*
1445 * If the IRE has a current cached parent we know that the whole
1446 * parent chain is current, hence we don't need to discover and
1447 * build any dependencies by doing a recursive lookup.
1448 */
1449 mutex_enter(&ire->ire_lock);
1450 if (ire->ire_dep_parent != NULL) {
1451 if (ire->ire_dep_parent->ire_generation ==
1452 ire->ire_dep_parent_generation) {
1453 mutex_exit(&ire->ire_lock);
1454 return (ire);
1455 }
1456 mutex_exit(&ire->ire_lock);
1457 } else {
1458 mutex_exit(&ire->ire_lock);
1459 /*
1460 * If this type should have an ire_nce_cache (even if it
1461 * doesn't yet have one) then we are done. Includes
1462 * IRE_INTERFACE with a full 128 bit mask.
1463 */
1464 if (ire->ire_nce_capable)
1465 return (ire);
1466 }
1467
1468 /*
1469 * Fallback to loop in the normal code starting with the ire
1470 * we found. Normally this would return the same ire.
1471 */
1472 ire1 = ire_route_recursive_impl_v6(ire, nexthop, 0, NULL, ALL_ZONES,
1473 MATCH_IRE_DSTONLY, irr_flags, xmit_hint, ipst, NULL, &generation);
1474 ire_refrele(ire);
1475 return (ire1);
1476 }
Unleashed OS