4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
26 #include <sys/types.h>
27 #include <sys/socket.h>
28 #include <sys/ksynch.h>
30 #include <sys/errno.h>
31 #include <sys/systm.h>
32 #include <sys/sysmacros.h>
33 #include <sys/cmn_err.h>
34 #include <sys/strsun.h>
36 #include <netinet/in.h>
37 #include <inet/common.h>
40 #include <inet/ip6_asp.h>
41 #include <inet/ip_ire.h>
42 #include <inet/ip_if.h>
43 #include <inet/ipclassifier.h>
45 #define IN6ADDR_MASK128_INIT \
46 IN6ADDR_INITIALIZER(0xffffffffu, 0xffffffffu, 0xffffffffu, 0xffffffffu)
47 #define IN6ADDR_MASK96_INIT \
48 IN6ADDR_INITIALIZER(0xffffffffu, 0xffffffffu, 0xffffffffu, 0)
49 #define IN6ADDR_MASK16_INIT \
50 IN6ADDR_INITIALIZER(0xffff0000u, 0, 0, 0)
54 * This table is ordered such that longest prefix matches are hit first
55 * (longer prefix lengths first). The last entry must be the "default"
58 static ip6_asp_t default_ip6_asp_table
[] = {
59 { IN6ADDR_LOOPBACK_INIT
, IN6ADDR_MASK128_INIT
,
61 { IN6ADDR_ANY_INIT
, IN6ADDR_MASK96_INIT
,
62 "IPv4_Compatible", 20 },
63 { IN6ADDR_INITIALIZER(0, 0, 0x0000ffffu
, 0), IN6ADDR_MASK96_INIT
,
65 { IN6ADDR_INITIALIZER(0x20020000u
, 0, 0, 0), IN6ADDR_MASK16_INIT
,
67 { IN6ADDR_ANY_INIT
, IN6ADDR_ANY_INIT
,
72 * The IPv6 Default Address Selection policy table.
73 * Until someone up above reconfigures the policy table, use the global
74 * default. The table needs no lock since the only way to alter it is
75 * through the SIOCSIP6ADDRPOLICY which is exclusive in ip.
77 static void ip6_asp_copy(ip6_asp_t
*, ip6_asp_t
*, uint_t
);
78 static void ip6_asp_check_for_updates(ip_stack_t
*);
81 ip6_asp_init(ip_stack_t
*ipst
)
83 /* Initialize the table lock */
84 mutex_init(&ipst
->ips_ip6_asp_lock
, NULL
, MUTEX_DEFAULT
, NULL
);
86 ipst
->ips_ip6_asp_table
= default_ip6_asp_table
;
88 ipst
->ips_ip6_asp_table_count
=
89 sizeof (default_ip6_asp_table
) / sizeof (ip6_asp_t
);
93 ip6_asp_free(ip_stack_t
*ipst
)
95 if (ipst
->ips_ip6_asp_table
!= default_ip6_asp_table
) {
96 kmem_free(ipst
->ips_ip6_asp_table
,
97 ipst
->ips_ip6_asp_table_count
* sizeof (ip6_asp_t
));
98 ipst
->ips_ip6_asp_table
= NULL
;
100 mutex_destroy(&ipst
->ips_ip6_asp_lock
);
104 * Return false if the table is being updated. Else, increment the ref
105 * count and return true.
108 ip6_asp_can_lookup(ip_stack_t
*ipst
)
110 mutex_enter(&ipst
->ips_ip6_asp_lock
);
111 if (ipst
->ips_ip6_asp_uip
) {
112 mutex_exit(&ipst
->ips_ip6_asp_lock
);
115 IP6_ASP_TABLE_REFHOLD(ipst
);
116 mutex_exit(&ipst
->ips_ip6_asp_lock
);
122 ip6_asp_pending_op(queue_t
*q
, mblk_t
*mp
, aspfunc_t func
)
124 conn_t
*connp
= Q_TO_CONN(q
);
125 ip_stack_t
*ipst
= connp
->conn_netstack
->netstack_ip
;
127 ASSERT((mp
->b_prev
== NULL
) && (mp
->b_queue
== NULL
) &&
128 (mp
->b_next
== NULL
));
129 mp
->b_queue
= (void *)q
;
130 mp
->b_prev
= (void *)func
;
133 mutex_enter(&ipst
->ips_ip6_asp_lock
);
134 if (ipst
->ips_ip6_asp_pending_ops
== NULL
) {
135 ASSERT(ipst
->ips_ip6_asp_pending_ops_tail
== NULL
);
136 ipst
->ips_ip6_asp_pending_ops
=
137 ipst
->ips_ip6_asp_pending_ops_tail
= mp
;
139 ipst
->ips_ip6_asp_pending_ops_tail
->b_next
= mp
;
140 ipst
->ips_ip6_asp_pending_ops_tail
= mp
;
142 mutex_exit(&ipst
->ips_ip6_asp_lock
);
146 ip6_asp_complete_op(ip_stack_t
*ipst
)
152 mutex_enter(&ipst
->ips_ip6_asp_lock
);
153 while (ipst
->ips_ip6_asp_pending_ops
!= NULL
) {
154 mp
= ipst
->ips_ip6_asp_pending_ops
;
155 ipst
->ips_ip6_asp_pending_ops
= mp
->b_next
;
157 if (ipst
->ips_ip6_asp_pending_ops
== NULL
)
158 ipst
->ips_ip6_asp_pending_ops_tail
= NULL
;
159 mutex_exit(&ipst
->ips_ip6_asp_lock
);
161 q
= (queue_t
*)mp
->b_queue
;
162 func
= (aspfunc_t
)mp
->b_prev
;
168 (*func
)(NULL
, q
, mp
, NULL
);
169 mutex_enter(&ipst
->ips_ip6_asp_lock
);
171 mutex_exit(&ipst
->ips_ip6_asp_lock
);
175 * Decrement reference count. When it gets to 0, we check for (pending)
176 * saved update to the table, if any.
179 ip6_asp_table_refrele(ip_stack_t
*ipst
)
181 IP6_ASP_TABLE_REFRELE(ipst
);
185 * This function is guaranteed never to return a NULL pointer. It
186 * will always return information from one of the entries in the
187 * asp_table (which will never be empty). If a pointer is passed
188 * in for the precedence, the precedence value will be set; a
189 * pointer to the label will be returned by the function.
191 * Since the table is only anticipated to have five or six entries
192 * total, the lookup algorithm hasn't been optimized to anything
196 ip6_asp_lookup(const in6_addr_t
*addr
, uint32_t *precedence
, ip_stack_t
*ipst
)
199 ip6_asp_t
*match
= NULL
;
200 ip6_asp_t
*default_policy
;
202 aspp
= ipst
->ips_ip6_asp_table
;
203 /* The default entry must always be the last one */
204 default_policy
= aspp
+ ipst
->ips_ip6_asp_table_count
- 1;
206 while (match
== NULL
) {
207 if (aspp
== default_policy
) {
210 if (V6_MASK_EQ(*addr
, aspp
->ip6_asp_mask
,
211 aspp
->ip6_asp_prefix
))
218 if (precedence
!= NULL
)
219 *precedence
= match
->ip6_asp_precedence
;
220 return (match
->ip6_asp_label
);
224 * If we had deferred updating the table because of outstanding references,
225 * do it now. Note, we don't do error checking on the queued IOCTL mblk, since
226 * ip_sioctl_ip6addrpolicy() has already done it for us.
229 ip6_asp_check_for_updates(ip_stack_t
*ipst
)
233 mblk_t
*data_mp
, *mp
;
236 mutex_enter(&ipst
->ips_ip6_asp_lock
);
237 if (ipst
->ips_ip6_asp_pending_update
== NULL
||
238 ipst
->ips_ip6_asp_refcnt
> 0) {
239 mutex_exit(&ipst
->ips_ip6_asp_lock
);
243 mp
= ipst
->ips_ip6_asp_pending_update
;
244 ipst
->ips_ip6_asp_pending_update
= NULL
;
245 ASSERT(mp
->b_prev
!= NULL
);
247 ipst
->ips_ip6_asp_uip
= B_TRUE
;
249 iocp
= (struct iocblk
*)mp
->b_rptr
;
250 data_mp
= mp
->b_cont
;
251 if (data_mp
== NULL
) {
253 table_size
= iocp
->ioc_count
;
255 table
= (ip6_asp_t
*)data_mp
->b_rptr
;
256 table_size
= iocp
->ioc_count
;
259 ip6_asp_replace(mp
, table
, table_size
, B_TRUE
, ipst
,
260 iocp
->ioc_flag
& IOC_MODELS
);
264 * ip6_asp_replace replaces the contents of the IPv6 address selection
265 * policy table with those specified in new_table. If new_table is NULL,
266 * this indicates that the caller wishes ip to use the default policy
267 * table. The caller is responsible for making sure that there are exactly
268 * new_count policy entries in new_table.
272 ip6_asp_replace(mblk_t
*mp
, ip6_asp_t
*new_table
, size_t new_size
,
273 boolean_t locked
, ip_stack_t
*ipst
, model_t datamodel
)
276 ip6_asp_t
*tmp_table
;
280 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
281 size_t ip6_asp_size
= SIZEOF_STRUCT(ip6_asp
, datamodel
);
283 const size_t ip6_asp_size
= sizeof (ip6_asp_t
);
286 if (new_size
% ip6_asp_size
!= 0) {
287 ip1dbg(("ip6_asp_replace: invalid table size\n"));
293 count
= new_size
/ ip6_asp_size
;
298 mutex_enter(&ipst
->ips_ip6_asp_lock
);
300 * Check if we are in the process of creating any IRE using the
301 * current information. If so, wait till that is done.
303 if (!locked
&& ipst
->ips_ip6_asp_refcnt
> 0) {
304 /* Save this request for later processing */
305 if (ipst
->ips_ip6_asp_pending_update
== NULL
) {
306 ipst
->ips_ip6_asp_pending_update
= mp
;
308 /* Let's not queue multiple requests for now */
309 ip1dbg(("ip6_asp_replace: discarding request\n"));
310 mutex_exit(&ipst
->ips_ip6_asp_lock
);
314 mutex_exit(&ipst
->ips_ip6_asp_lock
);
318 /* Prevent lookups till the table have been updated */
320 ipst
->ips_ip6_asp_uip
= B_TRUE
;
322 ASSERT(ipst
->ips_ip6_asp_refcnt
== 0);
324 if (new_table
== NULL
) {
326 * This is a special case. The user wants to revert
327 * back to using the default table.
329 if (ipst
->ips_ip6_asp_table
== default_ip6_asp_table
)
332 kmem_free(ipst
->ips_ip6_asp_table
,
333 ipst
->ips_ip6_asp_table_count
* sizeof (ip6_asp_t
));
334 ipst
->ips_ip6_asp_table
= default_ip6_asp_table
;
335 ipst
->ips_ip6_asp_table_count
=
336 sizeof (default_ip6_asp_table
) / sizeof (ip6_asp_t
);
342 ip1dbg(("ip6_asp_replace: empty table\n"));
346 if ((tmp_table
= kmem_alloc(count
* sizeof (ip6_asp_t
), KM_NOSLEEP
)) ==
352 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
355 * If 'new_table' -actually- originates from a 32-bit process
356 * then the nicely aligned ip6_asp_label array will be
357 * subtlely misaligned on this kernel, because the structure
358 * is 8 byte aligned in the kernel, but only 4 byte aligned in
359 * userland. Fix it up here.
361 * XX64 See the notes in ip_sioctl_ip6addrpolicy. Perhaps we could
362 * do the datamodel transformation (below) there instead of here?
364 if (datamodel
== IOC_ILP32
) {
369 if ((dst
= kmem_zalloc(count
* sizeof (*dst
),
370 KM_NOSLEEP
)) == NULL
) {
371 kmem_free(tmp_table
, count
* sizeof (ip6_asp_t
));
377 * Copy each element of the table from ip6_asp32_t
378 * format into ip6_asp_t format. Fortunately, since
379 * we're just dealing with a trailing structure pad,
380 * we can do this straightforwardly with a flurry of
383 src
= (void *)new_table
;
384 for (i
= 0; i
< count
; i
++)
385 bcopy(src
+ i
, dst
+ i
, sizeof (*src
));
387 ip6_asp_copy(dst
, tmp_table
, count
);
388 kmem_free(dst
, count
* sizeof (*dst
));
391 ip6_asp_copy(new_table
, tmp_table
, count
);
393 /* Make sure the last entry is the default entry */
394 if (!IN6_IS_ADDR_UNSPECIFIED(&tmp_table
[count
- 1].ip6_asp_prefix
) ||
395 !IN6_IS_ADDR_UNSPECIFIED(&tmp_table
[count
- 1].ip6_asp_mask
)) {
397 kmem_free(tmp_table
, count
* sizeof (ip6_asp_t
));
398 ip1dbg(("ip6_asp_replace: bad table: no default entry\n"));
401 if (ipst
->ips_ip6_asp_table
!= default_ip6_asp_table
) {
402 kmem_free(ipst
->ips_ip6_asp_table
,
403 ipst
->ips_ip6_asp_table_count
* sizeof (ip6_asp_t
));
405 ipst
->ips_ip6_asp_table
= tmp_table
;
406 ipst
->ips_ip6_asp_table_count
= count
;
409 ipst
->ips_ip6_asp_uip
= B_FALSE
;
410 mutex_exit(&ipst
->ips_ip6_asp_lock
);
412 /* Let conn_ixa caching know that source address selection changed */
413 ip_update_source_selection(ipst
);
416 /* Reply to the ioctl */
417 q
= (queue_t
*)mp
->b_prev
;
423 iocp
= (struct iocblk
*)mp
->b_rptr
;
424 iocp
->ioc_error
= ret_val
;
426 DB_TYPE(mp
) = (iocp
->ioc_error
== 0) ? M_IOCACK
: M_IOCNAK
;
429 ip6_asp_complete_op(ipst
);
433 * Copies the contents of src_table to dst_table, and sorts the
434 * entries in decending order of prefix lengths. It assumes that both
435 * tables are appropriately sized to contain count entries.
438 ip6_asp_copy(ip6_asp_t
*src_table
, ip6_asp_t
*dst_table
, uint_t count
)
440 ip6_asp_t
*src_ptr
, *src_limit
, *dst_ptr
, *dst_limit
, *dp
;
442 dst_table
[0] = src_table
[0];
447 * Sort the entries in descending order of prefix lengths.
449 * Note: this should be a small table. In 99% of cases, we
450 * expect the table to have 5 entries. In the remaining 1%
451 * of cases, we expect the table to have one or two more
452 * entries. It would be very rare for the table to have
453 * double-digit entries.
455 src_limit
= src_table
+ count
;
456 dst_limit
= dst_table
+ 1;
457 for (src_ptr
= src_table
+ 1; src_ptr
!= src_limit
;
458 src_ptr
++, dst_limit
++) {
459 for (dst_ptr
= dst_table
; dst_ptr
< dst_limit
; dst_ptr
++) {
460 if (ip_mask_to_plen_v6(&src_ptr
->ip6_asp_mask
) >
461 ip_mask_to_plen_v6(&dst_ptr
->ip6_asp_mask
)) {
463 * Make room to insert the source entry
464 * before dst_ptr by shifting entries to
467 for (dp
= dst_limit
- 1; dp
>= dst_ptr
; dp
--)
477 * This function copies as many entries from ip6_asp_table as will fit
478 * into dtable. The dtable_size parameter is the size of dtable
479 * in bytes. This function returns the number of entries in
480 * ip6_asp_table, even if it's not able to fit all of the entries into
484 ip6_asp_get(ip6_asp_t
*dtable
, size_t dtable_size
, ip_stack_t
*ipst
)
488 if (dtable
!= NULL
) {
489 if (dtable_size
< sizeof (ip6_asp_t
))
492 dtable_count
= dtable_size
/ sizeof (ip6_asp_t
);
493 bcopy(ipst
->ips_ip6_asp_table
, dtable
,
494 MIN(ipst
->ips_ip6_asp_table_count
, dtable_count
) *
498 return (ipst
->ips_ip6_asp_table_count
);
502 * Compare two labels. Return B_TRUE if they are equal, B_FALSE
506 ip6_asp_labelcmp(const char *label1
, const char *label2
)
508 int64_t *llptr1
, *llptr2
;
511 * The common case, the two labels are actually the same string
512 * from the policy table.
514 if (label1
== label2
)
518 * Since we know the labels are at most 16 bytes long, compare
519 * the two strings as two 8-byte long integers. The ip6_asp_t
520 * structure guarantees that the labels are 8 byte alligned.
522 llptr1
= (int64_t *)label1
;
523 llptr2
= (int64_t *)label2
;
524 if (llptr1
[0] == llptr2
[0] && llptr1
[1] == llptr2
[1])