4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
22 * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
26 * Copyright (c) 2018, Joyent, Inc.
29 #include <sys/types.h>
30 #include <sys/stream.h>
31 #include <sys/stropts.h>
32 #include <sys/strsun.h>
33 #include <sys/sysmacros.h>
34 #include <sys/errno.h>
36 #include <sys/socket.h>
38 #include <sys/sunddi.h>
39 #include <sys/cmn_err.h>
40 #include <sys/debug.h>
41 #include <sys/vtrace.h>
44 #include <sys/ethernet.h>
49 #include <net/if_types.h>
50 #include <net/if_dl.h>
51 #include <net/route.h>
52 #include <netinet/in.h>
53 #include <netinet/ip6.h>
54 #include <netinet/icmp6.h>
56 #include <inet/common.h>
58 #include <inet/mib2.h>
61 #include <inet/ip_impl.h>
62 #include <inet/ipclassifier.h>
63 #include <inet/ip_if.h>
64 #include <inet/ip_ire.h>
65 #include <inet/ip_rts.h>
67 #include <inet/ip_ndp.h>
68 #include <inet/sctp_ip.h>
69 #include <inet/ip_arp.h>
70 #include <inet/ip2mac_impl.h>
72 #define ANNOUNCE_INTERVAL(isv6) \
73 (isv6 ? ipst->ips_ip_ndp_unsolicit_interval : \
74 ipst->ips_ip_arp_publish_interval)
76 #define DEFENSE_INTERVAL(isv6) \
77 (isv6 ? ipst->ips_ndp_defend_interval : \
78 ipst->ips_arp_defend_interval)
80 /* Non-tunable probe interval, based on link capabilities */
81 #define ILL_PROBE_INTERVAL(ill) ((ill)->ill_note_link ? 150 : 1500)
84 * The IPv4 Link Local address space is special; we do extra duplicate checking
85 * there, as the entire assignment mechanism rests on random numbers.
87 #define IS_IPV4_LL_SPACE(ptr) (((uchar_t *)ptr)[0] == 169 && \
88 ((uchar_t *)ptr)[1] == 254)
91 * NCE_EXTERNAL_FLAGS_MASK defines the set of ncec_flags that may be passed
92 * in to the ncec*add* functions.
94 * NCE_F_AUTHORITY means that we ignore any incoming adverts for that
95 * mapping (though DAD is performed for the mapping). NCE_F_PUBLISH means
96 * that we will respond to requests for the protocol address.
98 #define NCE_EXTERNAL_FLAGS_MASK \
99 (NCE_F_MYADDR | NCE_F_ISROUTER | NCE_F_NONUD | \
100 NCE_F_ANYCAST | NCE_F_UNSOL_ADV | NCE_F_BCAST | NCE_F_MCAST | \
101 NCE_F_AUTHORITY | NCE_F_PUBLISH | NCE_F_STATIC)
106 * ndp_g_lock -> ill_lock -> ncec_lock
108 * The ndp_g_lock protects the NCE hash (nce_hash_tbl, NCE_HASH_PTR) and
109 * ncec_next. ncec_lock protects the contents of the NCE (particularly
113 static void nce_cleanup_list(ncec_t
*ncec
);
114 static void nce_set_ll(ncec_t
*ncec
, uchar_t
*ll_addr
);
115 static ncec_t
*ncec_lookup_illgrp(ill_t
*, const in6_addr_t
*,
117 static nce_t
*nce_lookup_addr(ill_t
*, const in6_addr_t
*);
118 static int nce_set_multicast_v6(ill_t
*ill
, const in6_addr_t
*addr
,
119 uint16_t ncec_flags
, nce_t
**newnce
);
120 static int nce_set_multicast_v4(ill_t
*ill
, const in_addr_t
*dst
,
121 uint16_t ncec_flags
, nce_t
**newnce
);
122 static boolean_t
ndp_xmit(ill_t
*ill
, uint32_t operation
,
123 uint8_t *hwaddr
, uint_t hwaddr_len
, const in6_addr_t
*sender
,
124 const in6_addr_t
*target
, int flag
);
125 static void ncec_refhold_locked(ncec_t
*);
126 static boolean_t
ill_defend_rate_limit(ill_t
*, ncec_t
*);
127 static void nce_queue_mp_common(ncec_t
*, mblk_t
*, boolean_t
);
128 static int nce_add_common(ill_t
*, uchar_t
*, uint_t
, const in6_addr_t
*,
129 uint16_t, uint16_t, nce_t
**);
130 static nce_t
*nce_add_impl(ill_t
*, ncec_t
*, nce_t
*, mblk_t
*);
131 static nce_t
*nce_add(ill_t
*, ncec_t
*);
132 static void nce_inactive(nce_t
*);
133 extern nce_t
*nce_lookup(ill_t
*, const in6_addr_t
*);
134 static nce_t
*nce_ill_lookup_then_add(ill_t
*, ncec_t
*);
135 static int nce_add_v6(ill_t
*, uchar_t
*, uint_t
, const in6_addr_t
*,
136 uint16_t, uint16_t, nce_t
**);
137 static int nce_add_v4(ill_t
*, uchar_t
*, uint_t
, const in_addr_t
*,
138 uint16_t, uint16_t, nce_t
**);
139 static int nce_add_v6_postprocess(nce_t
*);
140 static int nce_add_v4_postprocess(nce_t
*);
141 static ill_t
*nce_resolve_src(ncec_t
*, in6_addr_t
*);
142 static clock_t nce_fuzz_interval(clock_t, boolean_t
);
143 static void nce_resolv_ipmp_ok(ncec_t
*);
144 static void nce_walk_common(ill_t
*, pfi_t
, void *);
145 static void nce_start_timer(ncec_t
*, uint_t
);
146 static nce_t
*nce_fastpath_create(ill_t
*, ncec_t
*);
147 static void nce_fastpath_trigger(nce_t
*);
148 static nce_t
*nce_fastpath(ncec_t
*, boolean_t
, nce_t
*);
151 static void ncec_trace_cleanup(const ncec_t
*);
154 #define NCE_HASH_PTR_V4(ipst, addr) \
155 (&((ipst)->ips_ndp4->nce_hash_tbl[IRE_ADDR_HASH(addr, NCE_TABLE_SIZE)]))
157 #define NCE_HASH_PTR_V6(ipst, addr) \
158 (&((ipst)->ips_ndp6->nce_hash_tbl[NCE_ADDR_HASH_V6(addr, \
161 extern kmem_cache_t
*ncec_cache
;
162 extern kmem_cache_t
*nce_cache
;
165 * Send out a IPv6 (unicast) or IPv4 (broadcast) DAD probe
166 * If src_ill is not null, the ncec_addr is bound to src_ill. The
167 * src_ill is ignored by nce_dad for IPv4 Neighbor Cache entries where
168 * the probe is sent on the ncec_ill (in the non-IPMP case) or the
169 * IPMP cast_ill (in the IPMP case).
171 * Note that the probe interval is based on the src_ill for IPv6, and
172 * the ncec_xmit_interval for IPv4.
175 nce_dad(ncec_t
*ncec
, ill_t
*src_ill
, boolean_t send_probe
)
178 uint32_t probe_interval
;
180 ASSERT(!(ncec
->ncec_flags
& NCE_F_MCAST
));
181 ASSERT(!(ncec
->ncec_flags
& NCE_F_BCAST
));
182 if (ncec
->ncec_ipversion
== IPV6_VERSION
) {
183 dropped
= ndp_xmit(src_ill
, ND_NEIGHBOR_SOLICIT
,
184 ncec
->ncec_lladdr
, ncec
->ncec_lladdr_length
,
185 &ipv6_all_zeros
, &ncec
->ncec_addr
, NDP_PROBE
);
186 probe_interval
= ILL_PROBE_INTERVAL(src_ill
);
188 /* IPv4 DAD delay the initial probe. */
190 dropped
= arp_probe(ncec
);
193 probe_interval
= nce_fuzz_interval(ncec
->ncec_xmit_interval
,
197 mutex_enter(&ncec
->ncec_lock
);
199 mutex_exit(&ncec
->ncec_lock
);
201 nce_restart_timer(ncec
, probe_interval
);
205 * Compute default flags to use for an advertisement of this ncec's address.
208 nce_advert_flags(const ncec_t
*ncec
)
212 if (ncec
->ncec_flags
& NCE_F_ISROUTER
)
213 flag
|= NDP_ISROUTER
;
214 if (!(ncec
->ncec_flags
& NCE_F_ANYCAST
))
221 * NDP Cache Entry creation routine.
222 * This routine must always be called with ndp6->ndp_g_lock held.
225 nce_add_v6(ill_t
*ill
, uchar_t
*hw_addr
, uint_t hw_addr_len
,
226 const in6_addr_t
*addr
, uint16_t flags
, uint16_t state
, nce_t
**newnce
)
231 ASSERT(MUTEX_HELD(&ill
->ill_ipst
->ips_ndp6
->ndp_g_lock
));
232 ASSERT(ill
!= NULL
&& ill
->ill_isv6
);
234 err
= nce_add_common(ill
, hw_addr
, hw_addr_len
, addr
, flags
, state
,
238 ASSERT(newnce
!= NULL
);
244 * Post-processing routine to be executed after nce_add_v6(). This function
245 * triggers fastpath (if appropriate) and DAD on the newly added nce entry
246 * and must be called without any locks held.
249 nce_add_v6_postprocess(nce_t
*nce
)
251 ncec_t
*ncec
= nce
->nce_common
;
252 boolean_t dropped
= B_FALSE
;
253 uchar_t
*hw_addr
= ncec
->ncec_lladdr
;
254 uint_t hw_addr_len
= ncec
->ncec_lladdr_length
;
255 ill_t
*ill
= ncec
->ncec_ill
;
257 uint16_t flags
= ncec
->ncec_flags
;
258 ip_stack_t
*ipst
= ill
->ill_ipst
;
259 boolean_t trigger_fastpath
= B_TRUE
;
262 * If the hw_addr is NULL, typically for ND_INCOMPLETE nces, then
263 * we call nce_fastpath as soon as the ncec is resolved in nce_process.
264 * We call nce_fastpath from nce_update if the link layer address of
265 * the peer changes from nce_update
267 if (NCE_PUBLISH(ncec
) || !NCE_ISREACHABLE(ncec
) ||
268 (hw_addr
== NULL
&& ill
->ill_net_type
!= IRE_IF_NORESOLVER
))
269 trigger_fastpath
= B_FALSE
;
271 if (trigger_fastpath
)
272 nce_fastpath_trigger(nce
);
273 if (NCE_PUBLISH(ncec
) && ncec
->ncec_state
== ND_PROBE
) {
276 * Unicast entry that needs DAD.
279 hwaddr_ill
= ipmp_illgrp_find_ill(ill
->ill_grp
,
280 hw_addr
, hw_addr_len
);
284 nce_dad(ncec
, hwaddr_ill
, B_TRUE
);
286 } else if (flags
& NCE_F_UNSOL_ADV
) {
288 * We account for the transmit below by assigning one
289 * less than the ndd variable. Subsequent decrements
290 * are done in nce_timer.
292 mutex_enter(&ncec
->ncec_lock
);
293 ncec
->ncec_unsolicit_count
=
294 ipst
->ips_ip_ndp_unsolicit_count
- 1;
295 mutex_exit(&ncec
->ncec_lock
);
296 dropped
= ndp_xmit(ill
,
300 &ncec
->ncec_addr
, /* Source and target of the adv */
301 &ipv6_all_hosts_mcast
, /* Destination of the packet */
302 nce_advert_flags(ncec
));
303 mutex_enter(&ncec
->ncec_lock
);
305 ncec
->ncec_unsolicit_count
++;
307 ncec
->ncec_last_time_defended
= ddi_get_lbolt();
308 if (ncec
->ncec_unsolicit_count
!= 0) {
309 nce_start_timer(ncec
,
310 ipst
->ips_ip_ndp_unsolicit_interval
);
312 mutex_exit(&ncec
->ncec_lock
);
318 * Atomically lookup and add (if needed) Neighbor Cache information for
321 * IPMP notes: the ncec for non-local (i.e., !NCE_MYADDR(ncec) addresses
322 * are always added pointing at the ipmp_ill. Thus, when the ill passed
323 * to nce_add_v6 is an under_ill (i.e., IS_UNDER_IPMP(ill)) two nce_t
324 * entries will be created, both pointing at the same ncec_t. The nce_t
325 * entries will have their nce_ill set to the ipmp_ill and the under_ill
326 * respectively, with the ncec_t having its ncec_ill pointing at the ipmp_ill.
327 * Local addresses are always created on the ill passed to nce_add_v6.
330 nce_lookup_then_add_v6(ill_t
*ill
, uchar_t
*hw_addr
, uint_t hw_addr_len
,
331 const in6_addr_t
*addr
, uint16_t flags
, uint16_t state
, nce_t
**newnce
)
334 ip_stack_t
*ipst
= ill
->ill_ipst
;
335 nce_t
*nce
, *upper_nce
= NULL
;
337 boolean_t need_ill_refrele
= B_FALSE
;
339 if (flags
& NCE_F_MCAST
) {
341 * hw_addr will be figured out in nce_set_multicast_v6;
342 * caller has to select the cast_ill
344 ASSERT(hw_addr
== NULL
);
345 ASSERT(!IS_IPMP(ill
));
346 err
= nce_set_multicast_v6(ill
, addr
, flags
, newnce
);
349 ASSERT(ill
->ill_isv6
);
350 if (IS_UNDER_IPMP(ill
) && !(flags
& NCE_F_MYADDR
)) {
351 ill
= ipmp_ill_hold_ipmp_ill(ill
);
354 need_ill_refrele
= B_TRUE
;
357 mutex_enter(&ipst
->ips_ndp6
->ndp_g_lock
);
358 nce
= nce_lookup_addr(ill
, addr
);
360 err
= nce_add_v6(ill
, hw_addr
, hw_addr_len
, addr
, flags
, state
,
365 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
367 err
= nce_add_v6_postprocess(nce
);
368 if (in_ill
!= ill
&& nce
!= NULL
) {
369 nce_t
*under_nce
= NULL
;
372 * in_ill was the under_ill. Try to create the under_nce.
373 * Hold the ill_g_lock to prevent changes to group membership
376 rw_enter(&ipst
->ips_ill_g_lock
, RW_READER
);
377 if (!IS_IN_SAME_ILLGRP(in_ill
, ill
)) {
378 DTRACE_PROBE2(ill__not__in__group
, nce_t
*, nce
,
380 rw_exit(&ipst
->ips_ill_g_lock
);
386 under_nce
= nce_fastpath_create(in_ill
, nce
->nce_common
);
387 if (under_nce
== NULL
) {
388 rw_exit(&ipst
->ips_ill_g_lock
);
394 rw_exit(&ipst
->ips_ill_g_lock
);
396 nce
= under_nce
; /* will be returned to caller */
397 if (NCE_ISREACHABLE(nce
->nce_common
))
398 nce_fastpath_trigger(under_nce
);
400 /* nce_refrele is deferred until the lock is dropped */
408 if (upper_nce
!= NULL
)
409 nce_refrele(upper_nce
);
410 if (need_ill_refrele
)
416 * Remove all the CONDEMNED nces from the appropriate hash table.
417 * We create a private list of NCEs, these may have ires pointing
418 * to them, so the list will be passed through to clean up dependent
419 * ires and only then we can do ncec_refrele() which can make NCE inactive.
422 nce_remove(ndp_g_t
*ndp
, ncec_t
*ncec
, ncec_t
**free_nce_list
)
427 ASSERT(MUTEX_HELD(&ndp
->ndp_g_lock
));
428 ASSERT(ndp
->ndp_g_walker
== 0);
429 for (; ncec
; ncec
= ncec1
) {
430 ncec1
= ncec
->ncec_next
;
431 mutex_enter(&ncec
->ncec_lock
);
432 if (NCE_ISCONDEMNED(ncec
)) {
433 ptpn
= ncec
->ncec_ptpn
;
434 ncec1
= ncec
->ncec_next
;
436 ncec1
->ncec_ptpn
= ptpn
;
438 ncec
->ncec_ptpn
= NULL
;
439 ncec
->ncec_next
= NULL
;
440 ncec
->ncec_next
= *free_nce_list
;
441 *free_nce_list
= ncec
;
443 mutex_exit(&ncec
->ncec_lock
);
448 * 1. Mark the entry CONDEMNED. This ensures that no new nce_lookup()
449 * will return this NCE. Also no new timeouts will
450 * be started (See nce_restart_timer).
451 * 2. Cancel any currently running timeouts.
452 * 3. If there is an ndp walker, return. The walker will do the cleanup.
453 * This ensures that walkers see a consistent list of NCEs while walking.
454 * 4. Otherwise remove the NCE from the list of NCEs
457 ncec_delete(ncec_t
*ncec
)
461 int ipversion
= ncec
->ncec_ipversion
;
463 ip_stack_t
*ipst
= ncec
->ncec_ipst
;
465 if (ipversion
== IPV4_VERSION
)
466 ndp
= ipst
->ips_ndp4
;
468 ndp
= ipst
->ips_ndp6
;
470 /* Serialize deletes */
471 mutex_enter(&ncec
->ncec_lock
);
472 if (NCE_ISCONDEMNED(ncec
)) {
473 /* Some other thread is doing the delete */
474 mutex_exit(&ncec
->ncec_lock
);
478 * Caller has a refhold. Also 1 ref for being in the list. Thus
479 * refcnt has to be >= 2
481 ASSERT(ncec
->ncec_refcnt
>= 2);
482 ncec
->ncec_flags
|= NCE_F_CONDEMNED
;
483 mutex_exit(&ncec
->ncec_lock
);
485 /* Count how many condemned ires for kmem_cache callback */
486 atomic_inc_32(&ipst
->ips_num_nce_condemned
);
487 nce_fastpath_list_delete(ncec
->ncec_ill
, ncec
, NULL
);
489 /* Complete any waiting callbacks */
490 ncec_cb_dispatch(ncec
);
493 * Cancel any running timer. Timeout can't be restarted
494 * since CONDEMNED is set. Can't hold ncec_lock across untimeout.
495 * Passing invalid timeout id is fine.
497 if (ncec
->ncec_timeout_id
!= 0) {
498 (void) untimeout(ncec
->ncec_timeout_id
);
499 ncec
->ncec_timeout_id
= 0;
502 mutex_enter(&ndp
->ndp_g_lock
);
503 if (ncec
->ncec_ptpn
== NULL
) {
505 * The last ndp walker has already removed this ncec from
506 * the list after we marked the ncec CONDEMNED and before
507 * we grabbed the global lock.
509 mutex_exit(&ndp
->ndp_g_lock
);
512 if (ndp
->ndp_g_walker
> 0) {
514 * Can't unlink. The walker will clean up
516 ndp
->ndp_g_walker_cleanup
= B_TRUE
;
517 mutex_exit(&ndp
->ndp_g_lock
);
522 * Now remove the ncec from the list. nce_restart_timer won't restart
523 * the timer since it is marked CONDEMNED.
525 ptpn
= ncec
->ncec_ptpn
;
526 ncec1
= ncec
->ncec_next
;
528 ncec1
->ncec_ptpn
= ptpn
;
530 ncec
->ncec_ptpn
= NULL
;
531 ncec
->ncec_next
= NULL
;
532 mutex_exit(&ndp
->ndp_g_lock
);
534 /* Removed from ncec_ptpn/ncec_next list */
535 ncec_refrele_notr(ncec
);
539 ncec_inactive(ncec_t
*ncec
)
542 ill_t
*ill
= ncec
->ncec_ill
;
543 ip_stack_t
*ipst
= ncec
->ncec_ipst
;
545 ASSERT(ncec
->ncec_refcnt
== 0);
546 ASSERT(MUTEX_HELD(&ncec
->ncec_lock
));
548 /* Count how many condemned nces for kmem_cache callback */
549 if (NCE_ISCONDEMNED(ncec
))
550 atomic_add_32(&ipst
->ips_num_nce_condemned
, -1);
552 /* Free all allocated messages */
553 mpp
= &ncec
->ncec_qd_mp
;
554 while (*mpp
!= NULL
) {
563 * must have been cleaned up in ncec_delete
565 ASSERT(list_is_empty(&ncec
->ncec_cb
));
566 list_destroy(&ncec
->ncec_cb
);
568 * free the ncec_lladdr if one was allocated in nce_add_common()
570 if (ncec
->ncec_lladdr_length
> 0)
571 kmem_free(ncec
->ncec_lladdr
, ncec
->ncec_lladdr_length
);
574 ncec_trace_cleanup(ncec
);
577 mutex_enter(&ill
->ill_lock
);
578 DTRACE_PROBE3(ill__decr__cnt
, (ill_t
*), ill
,
579 (char *), "ncec", (void *), ncec
);
581 ncec
->ncec_ill
= NULL
;
583 * If the number of ncec's associated with this ill have dropped
584 * to zero, check whether we need to restart any operation that
585 * is waiting for this to happen.
587 if (ILL_DOWN_OK(ill
)) {
588 /* ipif_ill_refrele_tail drops the ill_lock */
589 ipif_ill_refrele_tail(ill
);
591 mutex_exit(&ill
->ill_lock
);
594 mutex_destroy(&ncec
->ncec_lock
);
595 kmem_cache_free(ncec_cache
, ncec
);
599 * ncec_walk routine. Delete the ncec if it is associated with the ill
600 * that is going away. Always called as a writer.
603 ncec_delete_per_ill(ncec_t
*ncec
, void *arg
)
605 if ((ncec
!= NULL
) && ncec
->ncec_ill
== arg
) {
611 * Neighbor Cache cleanup logic for a list of ncec_t entries.
614 nce_cleanup_list(ncec_t
*ncec
)
618 ASSERT(ncec
!= NULL
);
619 while (ncec
!= NULL
) {
620 ncec_next
= ncec
->ncec_next
;
621 ncec
->ncec_next
= NULL
;
624 * It is possible for the last ndp walker (this thread)
625 * to come here after ncec_delete has marked the ncec CONDEMNED
626 * and before it has removed the ncec from the fastpath list
627 * or called untimeout. So we need to do it here. It is safe
628 * for both ncec_delete and this thread to do it twice or
629 * even simultaneously since each of the threads has a
630 * reference on the ncec.
632 nce_fastpath_list_delete(ncec
->ncec_ill
, ncec
, NULL
);
634 * Cancel any running timer. Timeout can't be restarted
635 * since CONDEMNED is set. The ncec_lock can't be
636 * held across untimeout though passing invalid timeout
639 if (ncec
->ncec_timeout_id
!= 0) {
640 (void) untimeout(ncec
->ncec_timeout_id
);
641 ncec
->ncec_timeout_id
= 0;
643 /* Removed from ncec_ptpn/ncec_next list */
644 ncec_refrele_notr(ncec
);
650 * Restart DAD on given NCE. Returns B_TRUE if DAD has been restarted.
653 nce_restart_dad(ncec_t
*ncec
)
656 ill_t
*ill
, *hwaddr_ill
;
660 ill
= ncec
->ncec_ill
;
661 mutex_enter(&ncec
->ncec_lock
);
662 if (ncec
->ncec_state
== ND_PROBE
) {
663 mutex_exit(&ncec
->ncec_lock
);
665 } else if (ncec
->ncec_state
== ND_REACHABLE
) {
666 ASSERT(ncec
->ncec_lladdr
!= NULL
);
667 ncec
->ncec_state
= ND_PROBE
;
668 ncec
->ncec_pcnt
= ND_MAX_UNICAST_SOLICIT
;
670 * Slight cheat here: we don't use the initial probe delay
671 * for IPv4 in this obscure case.
673 mutex_exit(&ncec
->ncec_lock
);
675 hwaddr_ill
= ipmp_illgrp_find_ill(ill
->ill_grp
,
676 ncec
->ncec_lladdr
, ncec
->ncec_lladdr_length
);
680 nce_dad(ncec
, hwaddr_ill
, B_TRUE
);
683 mutex_exit(&ncec
->ncec_lock
);
690 * IPv6 Cache entry lookup. Try to find an ncec matching the parameters passed.
691 * If one is found, the refcnt on the ncec will be incremented.
694 ncec_lookup_illgrp_v6(ill_t
*ill
, const in6_addr_t
*addr
)
697 ip_stack_t
*ipst
= ill
->ill_ipst
;
699 rw_enter(&ipst
->ips_ill_g_lock
, RW_READER
);
700 mutex_enter(&ipst
->ips_ndp6
->ndp_g_lock
);
702 /* Get head of v6 hash table */
703 ncec
= *((ncec_t
**)NCE_HASH_PTR_V6(ipst
, *addr
));
704 ncec
= ncec_lookup_illgrp(ill
, addr
, ncec
);
705 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
706 rw_exit(&ipst
->ips_ill_g_lock
);
710 * IPv4 Cache entry lookup. Try to find an ncec matching the parameters passed.
711 * If one is found, the refcnt on the ncec will be incremented.
714 ncec_lookup_illgrp_v4(ill_t
*ill
, const in_addr_t
*addr
)
718 ip_stack_t
*ipst
= ill
->ill_ipst
;
720 rw_enter(&ipst
->ips_ill_g_lock
, RW_READER
);
721 mutex_enter(&ipst
->ips_ndp4
->ndp_g_lock
);
723 /* Get head of v4 hash table */
724 ncec
= *((ncec_t
**)NCE_HASH_PTR_V4(ipst
, *addr
));
725 IN6_IPADDR_TO_V4MAPPED(*addr
, &addr6
);
726 ncec
= ncec_lookup_illgrp(ill
, &addr6
, ncec
);
727 mutex_exit(&ipst
->ips_ndp4
->ndp_g_lock
);
728 rw_exit(&ipst
->ips_ill_g_lock
);
733 * Cache entry lookup. Try to find an ncec matching the parameters passed.
734 * If an ncec is found, increment the hold count on that ncec.
735 * The caller passes in the start of the appropriate hash table, and must
736 * be holding the appropriate global lock (ndp_g_lock). In addition, since
737 * this function matches ncec_t entries across the illgrp, the ips_ill_g_lock
738 * must be held as reader.
740 * This function always matches across the ipmp group.
743 ncec_lookup_illgrp(ill_t
*ill
, const in6_addr_t
*addr
, ncec_t
*ncec
)
746 ip_stack_t
*ipst
= ill
->ill_ipst
;
749 ndp
= ipst
->ips_ndp6
;
751 ndp
= ipst
->ips_ndp4
;
754 ASSERT(MUTEX_HELD(&ndp
->ndp_g_lock
));
755 if (IN6_IS_ADDR_UNSPECIFIED(addr
))
757 for (; ncec
!= NULL
; ncec
= ncec
->ncec_next
) {
758 if (ncec
->ncec_ill
== ill
||
759 IS_IN_SAME_ILLGRP(ill
, ncec
->ncec_ill
)) {
760 if (IN6_ARE_ADDR_EQUAL(&ncec
->ncec_addr
, addr
)) {
761 mutex_enter(&ncec
->ncec_lock
);
762 if (!NCE_ISCONDEMNED(ncec
)) {
763 ncec_refhold_locked(ncec
);
764 mutex_exit(&ncec
->ncec_lock
);
767 mutex_exit(&ncec
->ncec_lock
);
775 * Find an nce_t on ill with nce_addr == addr. Lookup the nce_t
776 * entries for ill only, i.e., when ill is part of an ipmp group,
777 * nce_lookup_v4 will never try to match across the group.
780 nce_lookup_v4(ill_t
*ill
, const in_addr_t
*addr
)
784 ip_stack_t
*ipst
= ill
->ill_ipst
;
786 mutex_enter(&ipst
->ips_ndp4
->ndp_g_lock
);
787 IN6_IPADDR_TO_V4MAPPED(*addr
, &addr6
);
788 nce
= nce_lookup_addr(ill
, &addr6
);
789 mutex_exit(&ipst
->ips_ndp4
->ndp_g_lock
);
794 * Find an nce_t on ill with nce_addr == addr. Lookup the nce_t
795 * entries for ill only, i.e., when ill is part of an ipmp group,
796 * nce_lookup_v6 will never try to match across the group.
799 nce_lookup_v6(ill_t
*ill
, const in6_addr_t
*addr6
)
802 ip_stack_t
*ipst
= ill
->ill_ipst
;
804 mutex_enter(&ipst
->ips_ndp6
->ndp_g_lock
);
805 nce
= nce_lookup_addr(ill
, addr6
);
806 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
811 nce_lookup_addr(ill_t
*ill
, const in6_addr_t
*addr
)
818 ASSERT(MUTEX_HELD(&ill
->ill_ipst
->ips_ndp6
->ndp_g_lock
));
820 ASSERT(MUTEX_HELD(&ill
->ill_ipst
->ips_ndp4
->ndp_g_lock
));
822 mutex_enter(&ill
->ill_lock
);
823 nce
= nce_lookup(ill
, addr
);
824 mutex_exit(&ill
->ill_lock
);
830 * Router turned to host. We need to make sure that cached copies of the ncec
831 * are not used for forwarding packets if they were derived from the default
832 * route, and that the default route itself is removed, as required by
833 * section 7.2.5 of RFC 2461.
835 * Note that the ncec itself probably has valid link-layer information for the
836 * nexthop, so that there is no reason to delete the ncec, as long as the
837 * ISROUTER flag is turned off.
840 ncec_router_to_host(ncec_t
*ncec
)
843 ip_stack_t
*ipst
= ncec
->ncec_ipst
;
845 mutex_enter(&ncec
->ncec_lock
);
846 ncec
->ncec_flags
&= ~NCE_F_ISROUTER
;
847 mutex_exit(&ncec
->ncec_lock
);
849 ire
= ire_ftable_lookup_v6(&ipv6_all_zeros
, &ipv6_all_zeros
,
850 &ncec
->ncec_addr
, IRE_DEFAULT
, ncec
->ncec_ill
, ALL_ZONES
,
851 MATCH_IRE_ILL
| MATCH_IRE_TYPE
| MATCH_IRE_GW
, 0, ipst
, NULL
);
853 ip_rts_rtmsg(RTM_DELETE
, ire
, 0, ipst
);
860 * Process passed in parameters either from an incoming packet or via
864 nce_process(ncec_t
*ncec
, uchar_t
*hw_addr
, uint32_t flag
, boolean_t is_adv
)
866 ill_t
*ill
= ncec
->ncec_ill
;
867 uint32_t hw_addr_len
= ill
->ill_phys_addr_length
;
868 boolean_t ll_updated
= B_FALSE
;
869 boolean_t ll_changed
;
872 ASSERT(ncec
->ncec_ipversion
== IPV6_VERSION
);
874 * No updates of link layer address or the neighbor state is
875 * allowed, when the cache is in NONUD state. This still
876 * allows for responding to reachability solicitation.
878 mutex_enter(&ncec
->ncec_lock
);
879 if (ncec
->ncec_state
== ND_INCOMPLETE
) {
880 if (hw_addr
== NULL
) {
881 mutex_exit(&ncec
->ncec_lock
);
884 nce_set_ll(ncec
, hw_addr
);
886 * Update ncec state and send the queued packets
887 * back to ip this time ire will be added.
889 if (flag
& ND_NA_FLAG_SOLICITED
) {
890 nce_update(ncec
, ND_REACHABLE
, NULL
);
892 nce_update(ncec
, ND_STALE
, NULL
);
894 mutex_exit(&ncec
->ncec_lock
);
895 nce
= nce_fastpath(ncec
, B_TRUE
, NULL
);
901 ll_changed
= nce_cmp_ll_addr(ncec
, hw_addr
, hw_addr_len
);
903 /* If this is a SOLICITATION request only */
905 nce_update(ncec
, ND_STALE
, hw_addr
);
906 mutex_exit(&ncec
->ncec_lock
);
907 ncec_cb_dispatch(ncec
);
910 if (!(flag
& ND_NA_FLAG_OVERRIDE
) && ll_changed
) {
911 /* If in any other state than REACHABLE, ignore */
912 if (ncec
->ncec_state
== ND_REACHABLE
) {
913 nce_update(ncec
, ND_STALE
, NULL
);
915 mutex_exit(&ncec
->ncec_lock
);
916 ncec_cb_dispatch(ncec
);
920 nce_update(ncec
, ND_UNCHANGED
, hw_addr
);
923 if (flag
& ND_NA_FLAG_SOLICITED
) {
924 nce_update(ncec
, ND_REACHABLE
, NULL
);
927 nce_update(ncec
, ND_STALE
, NULL
);
930 mutex_exit(&ncec
->ncec_lock
);
931 if (!(flag
& ND_NA_FLAG_ROUTER
) && (ncec
->ncec_flags
&
933 ncec_router_to_host(ncec
);
935 ncec_cb_dispatch(ncec
);
941 * Pass arg1 to the cbf supplied, along with each ncec in existence.
942 * ncec_walk() places a REFHOLD on the ncec and drops the lock when
943 * walking the hash list.
946 ncec_walk_common(ndp_g_t
*ndp
, ill_t
*ill
, ncec_walk_cb_t cbf
,
947 void *arg1
, boolean_t trace
)
952 ncec_t
*free_nce_list
= NULL
;
954 mutex_enter(&ndp
->ndp_g_lock
);
955 /* Prevent ncec_delete from unlink and free of NCE */
957 mutex_exit(&ndp
->ndp_g_lock
);
958 for (ncep
= ndp
->nce_hash_tbl
;
959 ncep
< A_END(ndp
->nce_hash_tbl
); ncep
++) {
960 for (ncec
= *ncep
; ncec
!= NULL
; ncec
= ncec1
) {
961 ncec1
= ncec
->ncec_next
;
962 if (ill
== NULL
|| ncec
->ncec_ill
== ill
) {
968 ncec_refhold_notr(ncec
);
970 ncec_refrele_notr(ncec
);
975 mutex_enter(&ndp
->ndp_g_lock
);
977 if (ndp
->ndp_g_walker_cleanup
&& ndp
->ndp_g_walker
== 0) {
978 /* Time to delete condemned entries */
979 for (ncep
= ndp
->nce_hash_tbl
;
980 ncep
< A_END(ndp
->nce_hash_tbl
); ncep
++) {
983 nce_remove(ndp
, ncec
, &free_nce_list
);
986 ndp
->ndp_g_walker_cleanup
= B_FALSE
;
989 mutex_exit(&ndp
->ndp_g_lock
);
991 if (free_nce_list
!= NULL
) {
992 nce_cleanup_list(free_nce_list
);
998 * Note that ill can be NULL hence can't derive the ipst from it.
1001 ncec_walk(ill_t
*ill
, ncec_walk_cb_t cbf
, void *arg1
, ip_stack_t
*ipst
)
1003 ncec_walk_common(ipst
->ips_ndp4
, ill
, cbf
, arg1
, B_TRUE
);
1004 ncec_walk_common(ipst
->ips_ndp6
, ill
, cbf
, arg1
, B_TRUE
);
1008 * For each interface an entry is added for the unspecified multicast group.
1009 * Here that mapping is used to form the multicast cache entry for a particular
1010 * multicast destination.
1013 nce_set_multicast_v6(ill_t
*ill
, const in6_addr_t
*dst
,
1014 uint16_t flags
, nce_t
**newnce
)
1018 ip_stack_t
*ipst
= ill
->ill_ipst
;
1021 ASSERT(ill
!= NULL
);
1022 ASSERT(ill
->ill_isv6
);
1023 ASSERT(!(IN6_IS_ADDR_UNSPECIFIED(dst
)));
1025 mutex_enter(&ipst
->ips_ndp6
->ndp_g_lock
);
1026 nce
= nce_lookup_addr(ill
, dst
);
1028 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
1031 if (ill
->ill_net_type
== IRE_IF_RESOLVER
) {
1033 * For IRE_IF_RESOLVER a hardware mapping can be
1036 hw_addr
= kmem_alloc(ill
->ill_nd_lla_len
, KM_NOSLEEP
);
1037 if (hw_addr
== NULL
) {
1038 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
1041 ip_mcast_mapping(ill
, (uchar_t
*)dst
, hw_addr
);
1043 /* No hw_addr is needed for IRE_IF_NORESOLVER. */
1046 ASSERT((flags
& NCE_F_MCAST
) != 0);
1047 ASSERT((flags
& NCE_F_NONUD
) != 0);
1048 /* nce_state will be computed by nce_add_common() */
1049 err
= nce_add_v6(ill
, hw_addr
, ill
->ill_phys_addr_length
, dst
, flags
,
1050 ND_UNCHANGED
, &nce
);
1051 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
1053 err
= nce_add_v6_postprocess(nce
);
1054 if (hw_addr
!= NULL
)
1055 kmem_free(hw_addr
, ill
->ill_nd_lla_len
);
1057 ip1dbg(("nce_set_multicast_v6: create failed" "%d\n", err
));
1061 ASSERT(nce
->nce_common
->ncec_state
== ND_REACHABLE
);
1070 * Return the link layer address, and any flags of a ncec.
1073 ndp_query(ill_t
*ill
, struct lif_nd_req
*lnr
)
1079 ASSERT(ill
!= NULL
&& ill
->ill_isv6
);
1080 sin6
= (sin6_t
*)&lnr
->lnr_addr
;
1081 addr
= &sin6
->sin6_addr
;
1084 * NOTE: if the ill is an IPMP interface, then match against the whole
1085 * illgrp. This e.g. allows in.ndpd to retrieve the link layer
1086 * addresses for the data addresses on an IPMP interface even though
1087 * ipif_ndp_up() created them with an ncec_ill of ipif_bound_ill.
1089 ncec
= ncec_lookup_illgrp_v6(ill
, addr
);
1092 /* If no link layer address is available yet, return ESRCH */
1093 if (!NCE_ISREACHABLE(ncec
)) {
1097 lnr
->lnr_hdw_len
= ill
->ill_phys_addr_length
;
1098 bcopy(ncec
->ncec_lladdr
, (uchar_t
*)&lnr
->lnr_hdw_addr
,
1100 if (ncec
->ncec_flags
& NCE_F_ISROUTER
)
1101 lnr
->lnr_flags
= NDF_ISROUTER_ON
;
1102 if (ncec
->ncec_flags
& NCE_F_ANYCAST
)
1103 lnr
->lnr_flags
|= NDF_ANYCAST_ON
;
1104 if (ncec
->ncec_flags
& NCE_F_STATIC
)
1105 lnr
->lnr_flags
|= NDF_STATIC
;
1111 * Finish setting up the Enable/Disable multicast for the driver.
1114 ndp_mcastreq(ill_t
*ill
, const in6_addr_t
*v6group
, uint32_t hw_addr_len
,
1115 uint32_t hw_addr_offset
, mblk_t
*mp
)
1121 ASSERT(ill
->ill_net_type
== IRE_IF_RESOLVER
);
1122 if (IN6_IS_ADDR_V4MAPPED(v6group
)) {
1123 IN6_V4MAPPED_TO_IPADDR(v6group
, v4group
);
1125 ASSERT(CLASSD(v4group
));
1126 ASSERT(!(ill
->ill_isv6
));
1128 addr
= (uchar_t
*)&v4group
;
1130 ASSERT(IN6_IS_ADDR_MULTICAST(v6group
));
1131 ASSERT(ill
->ill_isv6
);
1133 addr
= (uchar_t
*)v6group
;
1135 hw_addr
= mi_offset_paramc(mp
, hw_addr_offset
, hw_addr_len
);
1136 if (hw_addr
== NULL
) {
1137 ip0dbg(("ndp_mcastreq NULL hw_addr\n"));
1142 ip_mcast_mapping(ill
, addr
, hw_addr
);
1147 ip_ndp_resolve(ncec_t
*ncec
)
1149 in_addr_t sender4
= INADDR_ANY
;
1150 in6_addr_t sender6
= ipv6_all_zeros
;
1154 src_ill
= nce_resolve_src(ncec
, &sender6
);
1155 if (src_ill
== NULL
) {
1156 /* Make sure we try again later */
1157 ms
= ncec
->ncec_ill
->ill_reachable_retrans_time
;
1158 nce_restart_timer(ncec
, (clock_t)ms
);
1161 if (ncec
->ncec_ipversion
== IPV4_VERSION
)
1162 IN6_V4MAPPED_TO_IPADDR(&sender6
, sender4
);
1163 mutex_enter(&ncec
->ncec_lock
);
1164 if (ncec
->ncec_ipversion
== IPV6_VERSION
)
1165 ms
= ndp_solicit(ncec
, sender6
, src_ill
);
1167 ms
= arp_request(ncec
, sender4
, src_ill
);
1168 mutex_exit(&ncec
->ncec_lock
);
1170 if (ncec
->ncec_state
!= ND_REACHABLE
) {
1171 if (ncec
->ncec_ipversion
== IPV6_VERSION
)
1172 ndp_resolv_failed(ncec
);
1174 arp_resolv_failed(ncec
);
1175 ASSERT((ncec
->ncec_flags
& NCE_F_STATIC
) == 0);
1176 nce_make_unreachable(ncec
);
1180 nce_restart_timer(ncec
, (clock_t)ms
);
1183 ill_refrele(src_ill
);
1187 * Send an IPv6 neighbor solicitation.
1188 * Returns number of milliseconds after which we should either rexmit or abort.
1189 * Return of zero means we should abort.
1190 * The caller holds the ncec_lock to protect ncec_qd_mp and ncec_rcnt.
1191 * The optional source address is used as a hint to ndp_solicit for
1192 * which source to use in the packet.
1194 * NOTE: This routine drops ncec_lock (and later reacquires it) when sending
1198 ndp_solicit(ncec_t
*ncec
, in6_addr_t src
, ill_t
*ill
)
1201 boolean_t dropped
= B_FALSE
;
1203 ASSERT(ncec
->ncec_ipversion
== IPV6_VERSION
);
1204 ASSERT(MUTEX_HELD(&ncec
->ncec_lock
));
1206 if (ncec
->ncec_rcnt
== 0)
1209 dst
= ncec
->ncec_addr
;
1211 mutex_exit(&ncec
->ncec_lock
);
1212 dropped
= ndp_xmit(ill
, ND_NEIGHBOR_SOLICIT
, ill
->ill_phys_addr
,
1213 ill
->ill_phys_addr_length
, &src
, &dst
, 0);
1214 mutex_enter(&ncec
->ncec_lock
);
1217 return (ncec
->ncec_ill
->ill_reachable_retrans_time
);
1221 * Attempt to recover an address on an interface that's been marked as a
1222 * duplicate. Because NCEs are destroyed when the interface goes down, there's
1223 * no easy way to just probe the address and have the right thing happen if
1224 * it's no longer in use. Instead, we just bring it up normally and allow the
1225 * regular interface start-up logic to probe for a remaining duplicate and take
1226 * us back down if necessary.
1227 * Neither DHCP nor temporary addresses arrive here; they're excluded by
1232 ip_addr_recover(ipsq_t
*ipsq
, queue_t
*rq
, mblk_t
*mp
, void *dummy_arg
)
1234 ill_t
*ill
= rq
->q_ptr
;
1236 in6_addr_t
*addr6
= (in6_addr_t
*)mp
->b_rptr
;
1237 in_addr_t
*addr4
= (in_addr_t
*)mp
->b_rptr
;
1238 boolean_t addr_equal
;
1240 for (ipif
= ill
->ill_ipif
; ipif
!= NULL
; ipif
= ipif
->ipif_next
) {
1242 * We do not support recovery of proxy ARP'd interfaces,
1243 * because the system lacks a complete proxy ARP mechanism.
1245 if (ill
->ill_isv6
) {
1246 addr_equal
= IN6_ARE_ADDR_EQUAL(&ipif
->ipif_v6lcl_addr
,
1249 addr_equal
= (ipif
->ipif_lcl_addr
== *addr4
);
1252 if ((ipif
->ipif_flags
& IPIF_POINTOPOINT
) || !addr_equal
)
1256 * If we have already recovered or if the interface is going
1257 * away, then ignore.
1259 mutex_enter(&ill
->ill_lock
);
1260 if (!(ipif
->ipif_flags
& IPIF_DUPLICATE
) ||
1261 (ipif
->ipif_state_flags
& IPIF_CONDEMNED
)) {
1262 mutex_exit(&ill
->ill_lock
);
1266 ipif
->ipif_flags
&= ~IPIF_DUPLICATE
;
1267 ill
->ill_ipif_dup_count
--;
1268 mutex_exit(&ill
->ill_lock
);
1269 ipif
->ipif_was_dup
= B_TRUE
;
1271 if (ill
->ill_isv6
) {
1272 VERIFY(ipif_ndp_up(ipif
, B_TRUE
) != EINPROGRESS
);
1273 (void) ipif_up_done_v6(ipif
);
1275 VERIFY(ipif_arp_up(ipif
, Res_act_initial
, B_TRUE
) !=
1277 (void) ipif_up_done(ipif
);
1284 * Attempt to recover an IPv6 interface that's been shut down as a duplicate.
1285 * As long as someone else holds the address, the interface will stay down.
1286 * When that conflict goes away, the interface is brought back up. This is
1287 * done so that accidental shutdowns of addresses aren't made permanent. Your
1288 * server will recover from a failure.
1290 * For DHCP and temporary addresses, recovery is not done in the kernel.
1291 * Instead, it's handled by user space processes (dhcpagent and in.ndpd).
1293 * This function is entered on a timer expiry; the ID is in ipif_recovery_id.
1296 ipif_dup_recovery(void *arg
)
1300 ipif
->ipif_recovery_id
= 0;
1301 if (!(ipif
->ipif_flags
& IPIF_DUPLICATE
))
1305 * No lock, because this is just an optimization.
1307 if (ipif
->ipif_state_flags
& IPIF_CONDEMNED
)
1310 /* If the link is down, we'll retry this later */
1311 if (!(ipif
->ipif_ill
->ill_phyint
->phyint_flags
& PHYI_RUNNING
))
1314 ipif_do_recovery(ipif
);
1318 * Perform interface recovery by forcing the duplicate interfaces up and
1319 * allowing the system to determine which ones should stay up.
1321 * Called both by recovery timer expiry and link-up notification.
1324 ipif_do_recovery(ipif_t
*ipif
)
1326 ill_t
*ill
= ipif
->ipif_ill
;
1328 ip_stack_t
*ipst
= ill
->ill_ipst
;
1331 if (ipif
->ipif_isv6
)
1332 mp_size
= sizeof (ipif
->ipif_v6lcl_addr
);
1334 mp_size
= sizeof (ipif
->ipif_lcl_addr
);
1335 mp
= allocb(mp_size
, BPRI_MED
);
1337 mutex_enter(&ill
->ill_lock
);
1338 if (ipst
->ips_ip_dup_recovery
> 0 &&
1339 ipif
->ipif_recovery_id
== 0 &&
1340 !(ipif
->ipif_state_flags
& IPIF_CONDEMNED
)) {
1341 ipif
->ipif_recovery_id
= timeout(ipif_dup_recovery
,
1342 ipif
, MSEC_TO_TICK(ipst
->ips_ip_dup_recovery
));
1344 mutex_exit(&ill
->ill_lock
);
1347 * A recovery timer may still be running if we got here from
1348 * ill_restart_dad(); cancel that timer.
1350 if (ipif
->ipif_recovery_id
!= 0)
1351 (void) untimeout(ipif
->ipif_recovery_id
);
1352 ipif
->ipif_recovery_id
= 0;
1354 if (ipif
->ipif_isv6
) {
1355 bcopy(&ipif
->ipif_v6lcl_addr
, mp
->b_rptr
,
1356 sizeof (ipif
->ipif_v6lcl_addr
));
1358 bcopy(&ipif
->ipif_lcl_addr
, mp
->b_rptr
,
1359 sizeof (ipif
->ipif_lcl_addr
));
1362 qwriter_ip(ill
, ill
->ill_rq
, mp
, ip_addr_recover
, NEW_OP
,
1368 * Find the MAC and IP addresses in an NA/NS message.
1371 ip_ndp_find_addresses(mblk_t
*mp
, ip_recv_attr_t
*ira
, ill_t
*ill
,
1372 in6_addr_t
*targp
, uchar_t
**haddr
, uint_t
*haddrlenp
)
1374 icmp6_t
*icmp6
= (icmp6_t
*)(mp
->b_rptr
+ IPV6_HDR_LEN
);
1375 nd_neighbor_solicit_t
*ns
= (nd_neighbor_solicit_t
*)icmp6
;
1379 /* icmp_inbound_v6 ensures this */
1380 ASSERT(ira
->ira_flags
& IRAF_L2SRC_SET
);
1382 addr
= ira
->ira_l2src
;
1383 alen
= ill
->ill_phys_addr_length
;
1392 /* nd_ns_target and nd_na_target are at the same offset, so we cheat */
1393 *targp
= ns
->nd_ns_target
;
1397 * This is for exclusive changes due to NDP duplicate address detection
1402 ip_ndp_excl(ipsq_t
*ipsq
, queue_t
*rq
, mblk_t
*mp
, void *dummy_arg
)
1404 ill_t
*ill
= rq
->q_ptr
;
1408 ip_stack_t
*ipst
= ill
->ill_ipst
;
1410 ip_recv_attr_t iras
;
1415 attrmp
->b_cont
= NULL
;
1416 if (!ip_recv_attr_from_mblk(attrmp
, &iras
)) {
1417 /* The ill or ip_stack_t disappeared on us */
1418 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
1419 ip_drop_input("ip_recv_attr_from_mblk", mp
, ill
);
1421 ira_cleanup(&iras
, B_TRUE
);
1425 ASSERT(ill
== iras
.ira_rill
);
1427 ip_ndp_find_addresses(mp
, &iras
, ill
, &targ
, &haddr
, &haddrlen
);
1428 if (haddr
!= NULL
&& haddrlen
== ill
->ill_phys_addr_length
) {
1430 * Ignore conflicts generated by misbehaving switches that
1431 * just reflect our own messages back to us. For IPMP, we may
1432 * see reflections across any ill in the illgrp.
1434 * RFC2462 and revisions tried to detect both the case
1435 * when a statically configured IPv6 address is a duplicate,
1436 * and the case when the L2 address itself is a duplicate. The
1437 * later is important because, with stateles address autoconf,
1438 * if the L2 address is a duplicate, the resulting IPv6
1439 * address(es) would also be duplicates. We rely on DAD of the
1440 * IPv6 address itself to detect the latter case.
1442 /* For an under ill_grp can change under lock */
1443 rw_enter(&ipst
->ips_ill_g_lock
, RW_READER
);
1444 if (bcmp(haddr
, ill
->ill_phys_addr
, haddrlen
) == 0 ||
1445 IS_UNDER_IPMP(ill
) &&
1446 ipmp_illgrp_find_ill(ill
->ill_grp
, haddr
,
1447 haddrlen
) != NULL
) {
1448 rw_exit(&ipst
->ips_ill_g_lock
);
1449 goto ignore_conflict
;
1451 rw_exit(&ipst
->ips_ill_g_lock
);
1455 * Look up the appropriate ipif.
1457 ipif
= ipif_lookup_addr_v6(&targ
, ill
, ALL_ZONES
, ipst
);
1459 goto ignore_conflict
;
1461 /* Reload the ill to match the ipif */
1462 ill
= ipif
->ipif_ill
;
1464 /* If it's already duplicate or ineligible, then don't do anything. */
1465 if (ipif
->ipif_flags
& (IPIF_POINTOPOINT
|IPIF_DUPLICATE
)) {
1467 goto ignore_conflict
;
1471 * If this is a failure during duplicate recovery, then don't
1472 * complain. It may take a long time to recover.
1474 if (!ipif
->ipif_was_dup
) {
1475 char ibuf
[LIFNAMSIZ
];
1476 char hbuf
[MAC_STR_LEN
];
1477 char sbuf
[INET6_ADDRSTRLEN
];
1479 ipif_get_name(ipif
, ibuf
, sizeof (ibuf
));
1480 cmn_err(CE_WARN
, "%s has duplicate address %s (in use by %s);"
1482 inet_ntop(AF_INET6
, &targ
, sbuf
, sizeof (sbuf
)),
1483 mac_colon_addr(haddr
, haddrlen
, hbuf
, sizeof (hbuf
)));
1485 mutex_enter(&ill
->ill_lock
);
1486 ASSERT(!(ipif
->ipif_flags
& IPIF_DUPLICATE
));
1487 ipif
->ipif_flags
|= IPIF_DUPLICATE
;
1488 ill
->ill_ipif_dup_count
++;
1489 mutex_exit(&ill
->ill_lock
);
1490 (void) ipif_down(ipif
, NULL
, NULL
);
1491 (void) ipif_down_tail(ipif
);
1492 mutex_enter(&ill
->ill_lock
);
1493 if (!(ipif
->ipif_flags
& (IPIF_DHCPRUNNING
|IPIF_TEMPORARY
)) &&
1494 ill
->ill_net_type
== IRE_IF_RESOLVER
&&
1495 !(ipif
->ipif_state_flags
& IPIF_CONDEMNED
) &&
1496 ipst
->ips_ip_dup_recovery
> 0) {
1497 ASSERT(ipif
->ipif_recovery_id
== 0);
1498 ipif
->ipif_recovery_id
= timeout(ipif_dup_recovery
,
1499 ipif
, MSEC_TO_TICK(ipst
->ips_ip_dup_recovery
));
1501 mutex_exit(&ill
->ill_lock
);
1506 ira_cleanup(&iras
, B_TRUE
);
1510 * Handle failure by tearing down the ipifs with the specified address. Note
1511 * that tearing down the ipif also means deleting the ncec through ipif_down, so
1512 * it's not possible to do recovery by just restarting the ncec timer. Instead,
1513 * we start a timer on the ipif.
1514 * Caller has to free mp;
1517 ndp_failure(mblk_t
*mp
, ip_recv_attr_t
*ira
)
1519 const uchar_t
*haddr
;
1520 ill_t
*ill
= ira
->ira_rill
;
1523 * Ignore conflicts generated by misbehaving switches that just
1524 * reflect our own messages back to us.
1527 /* icmp_inbound_v6 ensures this */
1528 ASSERT(ira
->ira_flags
& IRAF_L2SRC_SET
);
1529 haddr
= ira
->ira_l2src
;
1530 if (haddr
!= NULL
&&
1531 bcmp(haddr
, ill
->ill_phys_addr
, ill
->ill_phys_addr_length
) == 0) {
1535 if ((mp
= copymsg(mp
)) != NULL
) {
1538 attrmp
= ip_recv_attr_to_mblk(ira
);
1539 if (attrmp
== NULL
) {
1540 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
1541 ip_drop_input("ipIfStatsInDiscards", mp
, ill
);
1544 ASSERT(attrmp
->b_cont
== NULL
);
1545 attrmp
->b_cont
= mp
;
1548 qwriter_ip(ill
, ill
->ill_rq
, mp
, ip_ndp_excl
, NEW_OP
,
1555 * Handle a discovered conflict: some other system is advertising that it owns
1556 * one of our IP addresses. We need to defend ourselves, or just shut down the
1559 * Handles both IPv4 and IPv6
1562 ip_nce_conflict(mblk_t
*mp
, ip_recv_attr_t
*ira
, ncec_t
*ncec
)
1568 ill_t
*ill
= ira
->ira_ill
;
1569 ip_stack_t
*ipst
= ill
->ill_ipst
;
1571 boolean_t isv6
= ill
->ill_isv6
;
1575 ipif
= ipif_lookup_addr_v6(&ncec
->ncec_addr
, ill
, ALL_ZONES
,
1578 if (arp_no_defense
) {
1580 * Yes, there is a conflict, but no, we do not
1585 IN6_V4MAPPED_TO_IPADDR(&ncec
->ncec_addr
, ncec_addr
);
1586 ipif
= ipif_lookup_addr(ncec_addr
, ill
, ALL_ZONES
,
1593 * First, figure out if this address is disposable.
1595 if (ipif
->ipif_flags
& (IPIF_DHCPRUNNING
| IPIF_TEMPORARY
))
1596 maxdefense
= ipst
->ips_ip_max_temp_defend
;
1598 maxdefense
= ipst
->ips_ip_max_defend
;
1601 * Now figure out how many times we've defended ourselves. Ignore
1602 * defenses that happened long in the past.
1604 now
= ddi_get_lbolt();
1605 elapsed
= (drv_hztousec(now
- ncec
->ncec_last_time_defended
))/1000000;
1606 mutex_enter(&ncec
->ncec_lock
);
1607 if ((defs
= ncec
->ncec_defense_count
) > 0 &&
1608 elapsed
> ipst
->ips_ip_defend_interval
) {
1610 * ip_defend_interval has elapsed.
1611 * reset the defense count.
1613 ncec
->ncec_defense_count
= defs
= 0;
1615 ncec
->ncec_defense_count
++;
1616 ncec
->ncec_last_time_defended
= now
;
1617 mutex_exit(&ncec
->ncec_lock
);
1621 * If we've defended ourselves too many times already, then give up and
1622 * tear down the interface(s) using this address.
1623 * Otherwise, caller has to defend by sending out an announce.
1625 if (defs
>= maxdefense
) {
1627 ndp_failure(mp
, ira
);
1629 arp_failure(mp
, ira
);
1631 return (B_TRUE
); /* caller must defend this address */
1637 * Handle reception of Neighbor Solicitation messages.
1640 ndp_input_solicit(mblk_t
*mp
, ip_recv_attr_t
*ira
)
1642 ill_t
*ill
= ira
->ira_ill
, *under_ill
;
1643 nd_neighbor_solicit_t
*ns
;
1644 uint32_t hlen
= ill
->ill_phys_addr_length
;
1645 uchar_t
*haddr
= NULL
;
1648 ncec_t
*our_ncec
= NULL
;
1653 nd_opt_hdr_t
*opt
= NULL
;
1654 boolean_t bad_solicit
= B_FALSE
;
1655 mib2_ipv6IfIcmpEntry_t
*mib
= ill
->ill_icmp6_mib
;
1656 boolean_t need_ill_refrele
= B_FALSE
;
1658 ip6h
= (ip6_t
*)mp
->b_rptr
;
1659 icmp_nd
= (icmp6_t
*)(mp
->b_rptr
+ IPV6_HDR_LEN
);
1660 len
= mp
->b_wptr
- mp
->b_rptr
- IPV6_HDR_LEN
;
1661 src
= ip6h
->ip6_src
;
1662 ns
= (nd_neighbor_solicit_t
*)icmp_nd
;
1663 target
= ns
->nd_ns_target
;
1664 if (IN6_IS_ADDR_MULTICAST(&target
) || IN6_IS_ADDR_V4MAPPED(&target
) ||
1665 IN6_IS_ADDR_LOOPBACK(&target
)) {
1668 pr_addr_dbg("ndp_input_solicit: Martian Target %s\n",
1671 bad_solicit
= B_TRUE
;
1674 if (len
> sizeof (nd_neighbor_solicit_t
)) {
1675 /* Options present */
1676 opt
= (nd_opt_hdr_t
*)&ns
[1];
1677 len
-= sizeof (nd_neighbor_solicit_t
);
1678 if (!ndp_verify_optlen(opt
, len
)) {
1679 ip1dbg(("ndp_input_solicit: Bad opt len\n"));
1680 bad_solicit
= B_TRUE
;
1684 if (IN6_IS_ADDR_UNSPECIFIED(&src
)) {
1685 /* Check to see if this is a valid DAD solicitation */
1686 if (!IN6_IS_ADDR_MC_SOLICITEDNODE(&ip6h
->ip6_dst
)) {
1689 pr_addr_dbg("ndp_input_solicit: IPv6 "
1690 "Destination is not solicited node "
1691 "multicast %s\n", AF_INET6
,
1694 bad_solicit
= B_TRUE
;
1700 * NOTE: with IPMP, it's possible the nominated multicast ill (which
1701 * received this packet if it's multicast) is not the ill tied to
1702 * e.g. the IPMP ill's data link-local. So we match across the illgrp
1703 * to ensure we find the associated NCE.
1705 our_ncec
= ncec_lookup_illgrp_v6(ill
, &target
);
1707 * If this is a valid Solicitation for an address we are publishing,
1708 * then a PUBLISH entry should exist in the cache
1710 if (our_ncec
== NULL
|| !NCE_PUBLISH(our_ncec
)) {
1711 ip1dbg(("ndp_input_solicit: Wrong target in NS?!"
1712 "ifname=%s ", ill
->ill_name
));
1715 pr_addr_dbg(" dst %s\n", AF_INET6
, &target
);
1717 if (our_ncec
== NULL
)
1718 bad_solicit
= B_TRUE
;
1722 /* At this point we should have a verified NS per spec */
1724 opt
= ndp_get_option(opt
, len
, ND_OPT_SOURCE_LINKADDR
);
1726 haddr
= (uchar_t
*)&opt
[1];
1727 if (hlen
> opt
->nd_opt_len
* 8 - sizeof (*opt
) ||
1729 ip1dbg(("ndp_input_advert: bad SLLA\n"));
1730 bad_solicit
= B_TRUE
;
1736 /* If sending directly to peer, set the unicast flag */
1737 if (!IN6_IS_ADDR_MULTICAST(&ip6h
->ip6_dst
))
1738 flag
|= NDP_UNICAST
;
1741 * Create/update the entry for the soliciting node on the ipmp_ill.
1742 * or respond to outstanding queries, don't if
1743 * the source is unspecified address.
1745 if (!IN6_IS_ADDR_UNSPECIFIED(&src
)) {
1749 ASSERT(ill
->ill_isv6
);
1751 * Regular solicitations *must* include the Source Link-Layer
1752 * Address option. Ignore messages that do not.
1754 if (haddr
== NULL
&& IN6_IS_ADDR_MULTICAST(&ip6h
->ip6_dst
)) {
1755 ip1dbg(("ndp_input_solicit: source link-layer address "
1756 "option missing with a specified source.\n"));
1757 bad_solicit
= B_TRUE
;
1762 * This is a regular solicitation. If we're still in the
1763 * process of verifying the address, then don't respond at all
1764 * and don't keep track of the sender.
1766 if (our_ncec
->ncec_state
== ND_PROBE
)
1770 * If the solicitation doesn't have sender hardware address
1771 * (legal for unicast solicitation), then process without
1772 * installing the return NCE. Either we already know it, or
1773 * we'll be forced to look it up when (and if) we reply to the
1780 if (IS_UNDER_IPMP(under_ill
)) {
1781 ill
= ipmp_ill_hold_ipmp_ill(under_ill
);
1785 need_ill_refrele
= B_TRUE
;
1787 err
= nce_lookup_then_add_v6(ill
,
1789 &src
, /* Soliciting nodes address */
1794 if (need_ill_refrele
) {
1797 need_ill_refrele
= B_FALSE
;
1801 /* done with this entry */
1806 * B_FALSE indicates this is not an an advertisement.
1808 nce_process(nnce
->nce_common
, haddr
, 0, B_FALSE
);
1812 ip1dbg(("ndp_input_solicit: Can't create NCE %d\n",
1817 flag
|= NDP_SOLICITED
;
1820 * No source link layer address option should be present in a
1821 * valid DAD request.
1823 if (haddr
!= NULL
) {
1824 ip1dbg(("ndp_input_solicit: source link-layer address "
1825 "option present with an unspecified source.\n"));
1826 bad_solicit
= B_TRUE
;
1829 if (our_ncec
->ncec_state
== ND_PROBE
) {
1831 * Internally looped-back probes will have
1832 * IRAF_L2SRC_LOOPBACK set so we can ignore our own
1835 if (!(ira
->ira_flags
& IRAF_L2SRC_LOOPBACK
)) {
1837 * If someone else is probing our address, then
1838 * we've crossed wires. Declare failure.
1840 ndp_failure(mp
, ira
);
1845 * This is a DAD probe. Multicast the advertisement to the
1846 * all-nodes address.
1848 src
= ipv6_all_hosts_mcast
;
1850 flag
|= nce_advert_flags(our_ncec
);
1851 (void) ndp_xmit(ill
,
1853 our_ncec
->ncec_lladdr
,
1854 our_ncec
->ncec_lladdr_length
,
1855 &target
, /* Source and target of the advertisement pkt */
1856 &src
, /* IP Destination (source of original pkt) */
1860 BUMP_MIB(mib
, ipv6IfIcmpInBadNeighborSolicitations
);
1861 if (our_ncec
!= NULL
)
1862 ncec_refrele(our_ncec
);
1866 * Handle reception of Neighbor Solicitation messages
1869 ndp_input_advert(mblk_t
*mp
, ip_recv_attr_t
*ira
)
1871 ill_t
*ill
= ira
->ira_ill
;
1872 nd_neighbor_advert_t
*na
;
1873 uint32_t hlen
= ill
->ill_phys_addr_length
;
1874 uchar_t
*haddr
= NULL
;
1877 ncec_t
*dst_ncec
= NULL
;
1879 nd_opt_hdr_t
*opt
= NULL
;
1881 ip_stack_t
*ipst
= ill
->ill_ipst
;
1882 mib2_ipv6IfIcmpEntry_t
*mib
= ill
->ill_icmp6_mib
;
1884 ip6h
= (ip6_t
*)mp
->b_rptr
;
1885 icmp_nd
= (icmp6_t
*)(mp
->b_rptr
+ IPV6_HDR_LEN
);
1886 len
= mp
->b_wptr
- mp
->b_rptr
- IPV6_HDR_LEN
;
1887 na
= (nd_neighbor_advert_t
*)icmp_nd
;
1889 if (IN6_IS_ADDR_MULTICAST(&ip6h
->ip6_dst
) &&
1890 (na
->nd_na_flags_reserved
& ND_NA_FLAG_SOLICITED
)) {
1891 ip1dbg(("ndp_input_advert: Target is multicast but the "
1892 "solicited flag is not zero\n"));
1893 BUMP_MIB(mib
, ipv6IfIcmpInBadNeighborAdvertisements
);
1896 target
= na
->nd_na_target
;
1897 if (IN6_IS_ADDR_MULTICAST(&target
) || IN6_IS_ADDR_V4MAPPED(&target
) ||
1898 IN6_IS_ADDR_LOOPBACK(&target
)) {
1901 pr_addr_dbg("ndp_input_solicit: Martian Target %s\n",
1904 BUMP_MIB(mib
, ipv6IfIcmpInBadNeighborAdvertisements
);
1907 if (len
> sizeof (nd_neighbor_advert_t
)) {
1908 opt
= (nd_opt_hdr_t
*)&na
[1];
1909 if (!ndp_verify_optlen(opt
,
1910 len
- sizeof (nd_neighbor_advert_t
))) {
1911 ip1dbg(("ndp_input_advert: cannot verify SLLA\n"));
1912 BUMP_MIB(mib
, ipv6IfIcmpInBadNeighborAdvertisements
);
1915 /* At this point we have a verified NA per spec */
1916 len
-= sizeof (nd_neighbor_advert_t
);
1917 opt
= ndp_get_option(opt
, len
, ND_OPT_TARGET_LINKADDR
);
1919 haddr
= (uchar_t
*)&opt
[1];
1920 if (hlen
> opt
->nd_opt_len
* 8 - sizeof (*opt
) ||
1922 ip1dbg(("ndp_input_advert: bad SLLA\n"));
1924 ipv6IfIcmpInBadNeighborAdvertisements
);
1931 * NOTE: we match across the illgrp since we need to do DAD for all of
1932 * our local addresses, and those are spread across all the active
1933 * ills in the group.
1935 if ((dst_ncec
= ncec_lookup_illgrp_v6(ill
, &target
)) == NULL
)
1938 if (NCE_PUBLISH(dst_ncec
)) {
1940 * Someone just advertised an addresses that we publish. First,
1941 * check it it was us -- if so, we can safely ignore it.
1942 * We don't get the haddr from the ira_l2src because, in the
1943 * case that the packet originated from us, on an IPMP group,
1944 * the ira_l2src may would be the link-layer address of the
1945 * cast_ill used to send the packet, which may not be the same
1946 * as the dst_ncec->ncec_lladdr of the address.
1948 if (haddr
!= NULL
) {
1949 if (ira
->ira_flags
& IRAF_L2SRC_LOOPBACK
)
1952 if (!nce_cmp_ll_addr(dst_ncec
, haddr
, hlen
))
1953 goto out
; /* from us -- no conflict */
1956 * If we're in an IPMP group, check if this is an echo
1957 * from another ill in the group. Use the double-
1958 * checked locking pattern to avoid grabbing
1959 * ill_g_lock in the non-IPMP case.
1961 if (IS_UNDER_IPMP(ill
)) {
1962 rw_enter(&ipst
->ips_ill_g_lock
, RW_READER
);
1963 if (IS_UNDER_IPMP(ill
) && ipmp_illgrp_find_ill(
1964 ill
->ill_grp
, haddr
, hlen
) != NULL
) {
1965 rw_exit(&ipst
->ips_ill_g_lock
);
1968 rw_exit(&ipst
->ips_ill_g_lock
);
1973 * This appears to be a real conflict. If we're trying to
1974 * configure this NCE (ND_PROBE), then shut it down.
1975 * Otherwise, handle the discovered conflict.
1977 if (dst_ncec
->ncec_state
== ND_PROBE
) {
1978 ndp_failure(mp
, ira
);
1980 if (ip_nce_conflict(mp
, ira
, dst_ncec
)) {
1981 char hbuf
[MAC_STR_LEN
];
1982 char sbuf
[INET6_ADDRSTRLEN
];
1985 "node '%s' is using %s on %s",
1986 inet_ntop(AF_INET6
, &target
, sbuf
,
1988 haddr
== NULL
? "<none>" :
1989 mac_colon_addr(haddr
, hlen
, hbuf
,
1990 sizeof (hbuf
)), ill
->ill_name
);
1992 * RFC 4862, Section 5.4.4 does not mandate
1993 * any specific behavior when an NA matches
1994 * a non-tentative address assigned to the
1995 * receiver. We make the choice of defending
1996 * our address, based on the assumption that
1997 * the sender has not detected the Duplicate.
1999 * ncec_last_time_defended has been adjusted
2000 * in ip_nce_conflict()
2002 (void) ndp_announce(dst_ncec
);
2006 if (na
->nd_na_flags_reserved
& ND_NA_FLAG_ROUTER
)
2007 dst_ncec
->ncec_flags
|= NCE_F_ISROUTER
;
2009 /* B_TRUE indicates this an advertisement */
2010 nce_process(dst_ncec
, haddr
, na
->nd_na_flags_reserved
, B_TRUE
);
2013 ncec_refrele(dst_ncec
);
2017 * Process NDP neighbor solicitation/advertisement messages.
2018 * The checksum has already checked o.k before reaching here.
2019 * Information about the datalink header is contained in ira_l2src, but
2020 * that should be ignored for loopback packets.
2023 ndp_input(mblk_t
*mp
, ip_recv_attr_t
*ira
)
2025 ill_t
*ill
= ira
->ira_rill
;
2029 mib2_ipv6IfIcmpEntry_t
*mib
= ill
->ill_icmp6_mib
;
2030 ill_t
*orig_ill
= NULL
;
2033 * Since ira_ill is where the IRE_LOCAL was hosted we use ira_rill
2034 * and make it be the IPMP upper so avoid being confused by a packet
2035 * addressed to a unicast address on a different ill.
2037 if (IS_UNDER_IPMP(ill
)) {
2039 ill
= ipmp_ill_hold_ipmp_ill(orig_ill
);
2042 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2043 ip_drop_input("ipIfStatsInDiscards - IPMP ill",
2048 ASSERT(ill
!= orig_ill
);
2049 orig_ill
= ira
->ira_ill
;
2051 mib
= ill
->ill_icmp6_mib
;
2053 if (!pullupmsg(mp
, -1)) {
2054 ip1dbg(("ndp_input: pullupmsg failed\n"));
2055 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsInDiscards
);
2056 ip_drop_input("ipIfStatsInDiscards - pullupmsg", mp
, ill
);
2059 ip6h
= (ip6_t
*)mp
->b_rptr
;
2060 if (ip6h
->ip6_hops
!= IPV6_MAX_HOPS
) {
2061 ip1dbg(("ndp_input: hoplimit != IPV6_MAX_HOPS\n"));
2062 ip_drop_input("ipv6IfIcmpBadHoplimit", mp
, ill
);
2063 BUMP_MIB(mib
, ipv6IfIcmpBadHoplimit
);
2067 * NDP does not accept any extension headers between the
2068 * IP header and the ICMP header since e.g. a routing
2069 * header could be dangerous.
2070 * This assumes that any AH or ESP headers are removed
2071 * by ip prior to passing the packet to ndp_input.
2073 if (ip6h
->ip6_nxt
!= IPPROTO_ICMPV6
) {
2074 ip1dbg(("ndp_input: Wrong next header 0x%x\n",
2076 ip_drop_input("Wrong next header", mp
, ill
);
2077 BUMP_MIB(mib
, ipv6IfIcmpInErrors
);
2080 icmp_nd
= (icmp6_t
*)(mp
->b_rptr
+ IPV6_HDR_LEN
);
2081 ASSERT(icmp_nd
->icmp6_type
== ND_NEIGHBOR_SOLICIT
||
2082 icmp_nd
->icmp6_type
== ND_NEIGHBOR_ADVERT
);
2083 if (icmp_nd
->icmp6_code
!= 0) {
2084 ip1dbg(("ndp_input: icmp6 code != 0 \n"));
2085 ip_drop_input("code non-zero", mp
, ill
);
2086 BUMP_MIB(mib
, ipv6IfIcmpInErrors
);
2089 len
= mp
->b_wptr
- mp
->b_rptr
- IPV6_HDR_LEN
;
2091 * Make sure packet length is large enough for either
2092 * a NS or a NA icmp packet.
2094 if (len
< sizeof (struct icmp6_hdr
) + sizeof (struct in6_addr
)) {
2095 ip1dbg(("ndp_input: packet too short\n"));
2096 ip_drop_input("packet too short", mp
, ill
);
2097 BUMP_MIB(mib
, ipv6IfIcmpInErrors
);
2100 if (icmp_nd
->icmp6_type
== ND_NEIGHBOR_SOLICIT
) {
2101 ndp_input_solicit(mp
, ira
);
2103 ndp_input_advert(mp
, ira
);
2107 if (orig_ill
!= NULL
) {
2109 ira
->ira_ill
= orig_ill
;
2114 * ndp_xmit is called to form and transmit a ND solicitation or
2115 * advertisement ICMP packet.
2117 * If the source address is unspecified and this isn't a probe (used for
2118 * duplicate address detection), an appropriate source address and link layer
2119 * address will be chosen here. The link layer address option is included if
2120 * the source is specified (i.e., all non-probe packets), and omitted (per the
2121 * specification) otherwise.
2123 * It returns B_FALSE only if it does a successful put() to the
2124 * corresponding ill's ill_wq otherwise returns B_TRUE.
2127 ndp_xmit(ill_t
*ill
, uint32_t operation
, uint8_t *hw_addr
, uint_t hw_addr_len
,
2128 const in6_addr_t
*sender
, const in6_addr_t
*target
, int flag
)
2136 zoneid_t zoneid
= GLOBAL_ZONEID
;
2137 ill_t
*hwaddr_ill
= ill
;
2138 ip_xmit_attr_t ixas
;
2139 ip_stack_t
*ipst
= ill
->ill_ipst
;
2140 boolean_t need_refrele
= B_FALSE
;
2141 boolean_t probe
= B_FALSE
;
2143 if (IS_UNDER_IPMP(ill
)) {
2144 probe
= ipif_lookup_testaddr_v6(ill
, sender
, NULL
);
2146 * We send non-probe packets on the upper IPMP interface.
2147 * ip_output_simple() will use cast_ill for sending any
2148 * multicast packets. Note that we can't follow the same
2149 * logic for probe packets because all interfaces in the ipmp
2150 * group may have failed, so that we really want to only try
2151 * to send the ND packet on the ill corresponding to the src
2155 ill
= ipmp_ill_hold_ipmp_ill(ill
);
2157 need_refrele
= B_TRUE
;
2164 * If we have a unspecified source(sender) address, select a
2165 * proper source address for the solicitation here itself so
2166 * that we can initialize the h/w address correctly.
2168 * If the sender is specified then we use this address in order
2169 * to lookup the zoneid before calling ip_output_v6(). This is to
2170 * enable unicast ND_NEIGHBOR_ADVERT packets to be routed correctly
2171 * by IP (we cannot guarantee that the global zone has an interface
2172 * route to the destination).
2174 * Note that the NA never comes here with the unspecified source
2179 * Probes will have unspec src at this point.
2181 if (!(IN6_IS_ADDR_UNSPECIFIED(sender
))) {
2182 zoneid
= ipif_lookup_addr_zoneid_v6(sender
, ill
, ipst
);
2184 * It's possible for ipif_lookup_addr_zoneid_v6() to return
2185 * ALL_ZONES if it cannot find a matching ipif for the address
2186 * we are trying to use. In this case we err on the side of
2187 * trying to send the packet by defaulting to the GLOBAL_ZONEID.
2189 if (zoneid
== ALL_ZONES
)
2190 zoneid
= GLOBAL_ZONEID
;
2193 plen
= (sizeof (nd_opt_hdr_t
) + hw_addr_len
+ 7) / 8;
2194 len
= IPV6_HDR_LEN
+ sizeof (nd_neighbor_advert_t
) + plen
* 8;
2195 mp
= allocb(len
, BPRI_LO
);
2202 bzero((char *)mp
->b_rptr
, len
);
2203 mp
->b_wptr
= mp
->b_rptr
+ len
;
2205 bzero(&ixas
, sizeof (ixas
));
2206 ixas
.ixa_flags
= IXAF_SET_ULP_CKSUM
| IXAF_NO_HW_CKSUM
;
2208 ixas
.ixa_ifindex
= ill
->ill_phyint
->phyint_ifindex
;
2209 ixas
.ixa_ipst
= ipst
;
2210 ixas
.ixa_cred
= kcred
;
2211 ixas
.ixa_cpid
= NOPID
;
2212 ixas
.ixa_zoneid
= zoneid
;
2214 ip6h
= (ip6_t
*)mp
->b_rptr
;
2215 ip6h
->ip6_vcf
= IPV6_DEFAULT_VERS_AND_FLOW
;
2216 ip6h
->ip6_plen
= htons(len
- IPV6_HDR_LEN
);
2217 ip6h
->ip6_nxt
= IPPROTO_ICMPV6
;
2218 ip6h
->ip6_hops
= IPV6_MAX_HOPS
;
2219 ixas
.ixa_multicast_ttl
= ip6h
->ip6_hops
;
2220 ip6h
->ip6_dst
= *target
;
2221 icmp6
= (icmp6_t
*)&ip6h
[1];
2223 if (hw_addr_len
!= 0) {
2224 opt
= (nd_opt_hdr_t
*)((uint8_t *)ip6h
+ IPV6_HDR_LEN
+
2225 sizeof (nd_neighbor_advert_t
));
2229 if (operation
== ND_NEIGHBOR_SOLICIT
) {
2230 nd_neighbor_solicit_t
*ns
= (nd_neighbor_solicit_t
*)icmp6
;
2232 if (opt
!= NULL
&& !(flag
& NDP_PROBE
)) {
2234 * Note that we don't send out SLLA for ND probes
2235 * per RFC 4862, even though we do send out the src
2236 * haddr for IPv4 DAD probes, even though both IPv4
2237 * and IPv6 go out with the unspecified/INADDR_ANY
2240 opt
->nd_opt_type
= ND_OPT_SOURCE_LINKADDR
;
2242 ip6h
->ip6_src
= *sender
;
2243 ns
->nd_ns_target
= *target
;
2244 if (!(flag
& NDP_UNICAST
)) {
2245 /* Form multicast address of the target */
2246 ip6h
->ip6_dst
= ipv6_solicited_node_mcast
;
2247 ip6h
->ip6_dst
.s6_addr32
[3] |=
2248 ns
->nd_ns_target
.s6_addr32
[3];
2251 nd_neighbor_advert_t
*na
= (nd_neighbor_advert_t
*)icmp6
;
2253 ASSERT(!(flag
& NDP_PROBE
));
2255 opt
->nd_opt_type
= ND_OPT_TARGET_LINKADDR
;
2256 ip6h
->ip6_src
= *sender
;
2257 na
->nd_na_target
= *sender
;
2258 if (flag
& NDP_ISROUTER
)
2259 na
->nd_na_flags_reserved
|= ND_NA_FLAG_ROUTER
;
2260 if (flag
& NDP_SOLICITED
)
2261 na
->nd_na_flags_reserved
|= ND_NA_FLAG_SOLICITED
;
2262 if (flag
& NDP_ORIDE
)
2263 na
->nd_na_flags_reserved
|= ND_NA_FLAG_OVERRIDE
;
2266 if (!(flag
& NDP_PROBE
)) {
2267 if (hw_addr
!= NULL
&& opt
!= NULL
) {
2268 /* Fill in link layer address and option len */
2269 opt
->nd_opt_len
= (uint8_t)plen
;
2270 bcopy(hw_addr
, &opt
[1], hw_addr_len
);
2273 if (opt
!= NULL
&& opt
->nd_opt_type
== 0) {
2274 /* If there's no link layer address option, then strip it. */
2276 mp
->b_wptr
= mp
->b_rptr
+ len
;
2277 ip6h
->ip6_plen
= htons(len
- IPV6_HDR_LEN
);
2280 icmp6
->icmp6_type
= (uint8_t)operation
;
2281 icmp6
->icmp6_code
= 0;
2283 * Prepare for checksum by putting icmp length in the icmp
2284 * checksum field. The checksum is calculated in ip_output.c.
2286 icmp6
->icmp6_cksum
= ip6h
->ip6_plen
;
2288 (void) ip_output_simple(mp
, &ixas
);
2296 * Used to set ND_UNREACHBLE before ncec_delete sets it NCE_F_CONDEMNED.
2297 * The datapath uses this as an indication that there
2298 * is a problem (as opposed to a NCE that was just
2299 * reclaimed due to lack of memory.
2300 * Note that static ARP entries never become unreachable.
2303 nce_make_unreachable(ncec_t
*ncec
)
2305 mutex_enter(&ncec
->ncec_lock
);
2306 ncec
->ncec_state
= ND_UNREACHABLE
;
2307 mutex_exit(&ncec
->ncec_lock
);
2311 * NCE retransmit timer. Common to IPv4 and IPv6.
2312 * This timer goes off when:
2313 * a. It is time to retransmit a resolution for resolver.
2314 * b. It is time to send reachability probes.
2317 nce_timer(void *arg
)
2320 ill_t
*ill
= ncec
->ncec_ill
, *src_ill
;
2321 char addrbuf
[INET6_ADDRSTRLEN
];
2322 boolean_t dropped
= B_FALSE
;
2323 ip_stack_t
*ipst
= ncec
->ncec_ipst
;
2324 boolean_t isv6
= (ncec
->ncec_ipversion
== IPV6_VERSION
);
2325 in_addr_t sender4
= INADDR_ANY
;
2326 in6_addr_t sender6
= ipv6_all_zeros
;
2329 * The timer has to be cancelled by ncec_delete before doing the final
2330 * refrele. So the NCE is guaranteed to exist when the timer runs
2331 * until it clears the timeout_id. Before clearing the timeout_id
2332 * bump up the refcnt so that we can continue to use the ncec
2334 ASSERT(ncec
!= NULL
);
2335 mutex_enter(&ncec
->ncec_lock
);
2336 ncec_refhold_locked(ncec
);
2337 ncec
->ncec_timeout_id
= 0;
2338 mutex_exit(&ncec
->ncec_lock
);
2340 src_ill
= nce_resolve_src(ncec
, &sender6
);
2341 /* if we could not find a sender address, return */
2342 if (src_ill
== NULL
) {
2344 IN6_V4MAPPED_TO_IPADDR(&ncec
->ncec_addr
, sender4
);
2345 ip1dbg(("no src ill for %s\n", inet_ntop(AF_INET
,
2346 &sender4
, addrbuf
, sizeof (addrbuf
))));
2348 ip1dbg(("no src ill for %s\n", inet_ntop(AF_INET6
,
2349 &ncec
->ncec_addr
, addrbuf
, sizeof (addrbuf
))));
2351 nce_restart_timer(ncec
, ill
->ill_reachable_retrans_time
);
2356 IN6_V4MAPPED_TO_IPADDR(&sender6
, sender4
);
2358 mutex_enter(&ncec
->ncec_lock
);
2360 * Check the reachability state.
2362 switch (ncec
->ncec_state
) {
2364 ASSERT(ncec
->ncec_lladdr
!= NULL
);
2365 ncec
->ncec_state
= ND_PROBE
;
2366 ncec
->ncec_pcnt
= ND_MAX_UNICAST_SOLICIT
;
2368 mutex_exit(&ncec
->ncec_lock
);
2369 dropped
= ndp_xmit(src_ill
, ND_NEIGHBOR_SOLICIT
,
2370 src_ill
->ill_phys_addr
,
2371 src_ill
->ill_phys_addr_length
,
2372 &sender6
, &ncec
->ncec_addr
,
2375 dropped
= (arp_request(ncec
, sender4
, src_ill
) == 0);
2376 mutex_exit(&ncec
->ncec_lock
);
2379 mutex_enter(&ncec
->ncec_lock
);
2381 mutex_exit(&ncec
->ncec_lock
);
2385 pr_addr_dbg("nce_timer: state for %s changed "
2386 "to PROBE\n", AF_INET6
, &ncec
->ncec_addr
);
2388 nce_restart_timer(ncec
, ill
->ill_reachable_retrans_time
);
2391 /* must be retransmit timer */
2392 ASSERT(ncec
->ncec_pcnt
>= -1);
2393 if (ncec
->ncec_pcnt
> 0) {
2395 * As per RFC2461, the ncec gets deleted after
2396 * MAX_UNICAST_SOLICIT unsuccessful re-transmissions.
2397 * Note that the first unicast solicitation is sent
2398 * during the DELAY state.
2400 ip2dbg(("nce_timer: pcount=%x dst %s\n",
2402 inet_ntop((isv6
? AF_INET6
: AF_INET
),
2403 &ncec
->ncec_addr
, addrbuf
, sizeof (addrbuf
))));
2404 if (NCE_PUBLISH(ncec
)) {
2405 mutex_exit(&ncec
->ncec_lock
);
2407 * send out a probe; note that src_ill
2408 * is ignored by nce_dad() for all
2409 * DAD message types other than IPv6
2412 nce_dad(ncec
, src_ill
, B_TRUE
);
2414 ASSERT(src_ill
!= NULL
);
2416 mutex_exit(&ncec
->ncec_lock
);
2417 dropped
= ndp_xmit(src_ill
,
2418 ND_NEIGHBOR_SOLICIT
,
2419 src_ill
->ill_phys_addr
,
2420 src_ill
->ill_phys_addr_length
,
2421 &sender6
, &ncec
->ncec_addr
,
2425 * since the nce is REACHABLE,
2426 * the ARP request will be sent out
2427 * as a link-layer unicast.
2429 dropped
= (arp_request(ncec
, sender4
,
2431 mutex_exit(&ncec
->ncec_lock
);
2434 mutex_enter(&ncec
->ncec_lock
);
2436 mutex_exit(&ncec
->ncec_lock
);
2438 nce_restart_timer(ncec
,
2439 ill
->ill_reachable_retrans_time
);
2441 } else if (ncec
->ncec_pcnt
< 0) {
2442 /* No hope, delete the ncec */
2443 /* Tell datapath it went bad */
2444 ncec
->ncec_state
= ND_UNREACHABLE
;
2445 mutex_exit(&ncec
->ncec_lock
);
2448 pr_addr_dbg("nce_timer: Delete NCE for"
2449 " dst %s\n", (isv6
? AF_INET6
: AF_INET
),
2452 /* if static ARP can't delete. */
2453 if ((ncec
->ncec_flags
& NCE_F_STATIC
) == 0)
2456 } else if (!NCE_PUBLISH(ncec
)) {
2458 * Probe count is 0 for a dynamic entry (one that we
2459 * ourselves are not publishing). We should never get
2460 * here if NONUD was requested, hence the ASSERT below.
2462 ASSERT((ncec
->ncec_flags
& NCE_F_NONUD
) == 0);
2463 ip2dbg(("nce_timer: pcount=%x dst %s\n",
2464 ncec
->ncec_pcnt
, inet_ntop(AF_INET6
,
2465 &ncec
->ncec_addr
, addrbuf
, sizeof (addrbuf
))));
2467 mutex_exit(&ncec
->ncec_lock
);
2468 /* Wait one interval before killing */
2469 nce_restart_timer(ncec
,
2470 ill
->ill_reachable_retrans_time
);
2471 } else if (ill
->ill_phyint
->phyint_flags
& PHYI_RUNNING
) {
2476 * We're done probing, and we can now declare this
2477 * address to be usable. Let IP know that it's ok to
2480 ncec
->ncec_state
= ND_REACHABLE
;
2481 ncec
->ncec_flags
&= ~NCE_F_UNVERIFIED
;
2482 mutex_exit(&ncec
->ncec_lock
);
2484 ipif
= ipif_lookup_addr_exact_v6(
2485 &ncec
->ncec_addr
, ill
, ipst
);
2487 IN6_V4MAPPED_TO_IPADDR(&ncec
->ncec_addr
,
2489 ipif
= ipif_lookup_addr_exact(ncec_addr
, ill
,
2493 if (ipif
->ipif_was_dup
) {
2494 char ibuf
[LIFNAMSIZ
];
2495 char sbuf
[INET6_ADDRSTRLEN
];
2497 ipif
->ipif_was_dup
= B_FALSE
;
2498 (void) inet_ntop(AF_INET6
,
2499 &ipif
->ipif_v6lcl_addr
,
2500 sbuf
, sizeof (sbuf
));
2501 ipif_get_name(ipif
, ibuf
,
2503 cmn_err(CE_NOTE
, "recovered address "
2504 "%s on %s", sbuf
, ibuf
);
2506 if ((ipif
->ipif_flags
& IPIF_UP
) &&
2507 !ipif
->ipif_addr_ready
)
2508 ipif_up_notify(ipif
);
2509 ipif
->ipif_addr_ready
= 1;
2512 if (!isv6
&& arp_no_defense
)
2514 /* Begin defending our new address */
2515 if (ncec
->ncec_unsolicit_count
> 0) {
2516 ncec
->ncec_unsolicit_count
--;
2518 dropped
= ndp_announce(ncec
);
2520 dropped
= arp_announce(ncec
);
2524 ncec
->ncec_unsolicit_count
++;
2526 ncec
->ncec_last_time_defended
=
2529 if (ncec
->ncec_unsolicit_count
> 0) {
2530 nce_restart_timer(ncec
,
2531 ANNOUNCE_INTERVAL(isv6
));
2532 } else if (DEFENSE_INTERVAL(isv6
) != 0) {
2533 nce_restart_timer(ncec
, DEFENSE_INTERVAL(isv6
));
2537 * This is an address we're probing to be our own, but
2538 * the ill is down. Wait until it comes back before
2539 * doing anything, but switch to reachable state so
2540 * that the restart will work.
2542 ncec
->ncec_state
= ND_REACHABLE
;
2543 mutex_exit(&ncec
->ncec_lock
);
2546 case ND_INCOMPLETE
: {
2547 mblk_t
*mp
, *nextmp
;
2551 * Per case (2) in the nce_queue_mp() comments, scan ncec_qd_mp
2552 * for any IPMP probe packets, and toss them. IPMP probe
2553 * packets will always be at the head of ncec_qd_mp, so that
2554 * we can stop at the first queued ND packet that is
2555 * not a probe packet.
2557 prevmpp
= &ncec
->ncec_qd_mp
;
2558 for (mp
= ncec
->ncec_qd_mp
; mp
!= NULL
; mp
= nextmp
) {
2559 nextmp
= mp
->b_next
;
2561 if (IS_UNDER_IPMP(ill
) && ncec
->ncec_nprobes
> 0) {
2563 ncec
->ncec_nprobes
--;
2566 prevmpp
= &mp
->b_next
;
2571 * Must be resolver's retransmit timer.
2573 mutex_exit(&ncec
->ncec_lock
);
2574 ip_ndp_resolve(ncec
);
2578 if (((ncec
->ncec_flags
& NCE_F_UNSOL_ADV
) &&
2579 ncec
->ncec_unsolicit_count
!= 0) ||
2580 (NCE_PUBLISH(ncec
) && DEFENSE_INTERVAL(isv6
) != 0)) {
2581 if (ncec
->ncec_unsolicit_count
> 0) {
2582 ncec
->ncec_unsolicit_count
--;
2583 mutex_exit(&ncec
->ncec_lock
);
2585 * When we get to zero announcements left,
2586 * switch to address defense
2589 boolean_t rate_limit
;
2591 mutex_exit(&ncec
->ncec_lock
);
2592 rate_limit
= ill_defend_rate_limit(ill
, ncec
);
2594 nce_restart_timer(ncec
,
2595 DEFENSE_INTERVAL(isv6
));
2600 dropped
= ndp_announce(ncec
);
2602 dropped
= arp_announce(ncec
);
2604 mutex_enter(&ncec
->ncec_lock
);
2606 ncec
->ncec_unsolicit_count
++;
2608 ncec
->ncec_last_time_defended
=
2611 mutex_exit(&ncec
->ncec_lock
);
2612 if (ncec
->ncec_unsolicit_count
!= 0) {
2613 nce_restart_timer(ncec
,
2614 ANNOUNCE_INTERVAL(isv6
));
2616 nce_restart_timer(ncec
, DEFENSE_INTERVAL(isv6
));
2619 mutex_exit(&ncec
->ncec_lock
);
2623 mutex_exit(&ncec
->ncec_lock
);
2628 ill_refrele(src_ill
);
2632 * Set a link layer address from the ll_addr passed in.
2633 * Copy SAP from ill.
2636 nce_set_ll(ncec_t
*ncec
, uchar_t
*ll_addr
)
2638 ill_t
*ill
= ncec
->ncec_ill
;
2640 ASSERT(ll_addr
!= NULL
);
2641 if (ill
->ill_phys_addr_length
> 0) {
2643 * The bcopy() below used to be called for the physical address
2644 * length rather than the link layer address length. For
2645 * ethernet and many other media, the phys_addr and lla are
2648 * The phys_addr and lla may not be the same for devices that
2649 * support DL_IPV6_LINK_LAYER_ADDR, though there are currently
2650 * no known instances of these.
2652 * For PPP or other interfaces with a zero length
2653 * physical address, don't do anything here.
2654 * The bcopy() with a zero phys_addr length was previously
2655 * a no-op for interfaces with a zero-length physical address.
2656 * Using the lla for them would change the way they operate.
2657 * Doing nothing in such cases preserves expected behavior.
2659 bcopy(ll_addr
, ncec
->ncec_lladdr
, ill
->ill_nd_lla_len
);
2664 nce_cmp_ll_addr(const ncec_t
*ncec
, const uchar_t
*ll_addr
,
2665 uint32_t ll_addr_len
)
2667 ASSERT(ncec
->ncec_lladdr
!= NULL
);
2668 if (ll_addr
== NULL
)
2670 if (bcmp(ll_addr
, ncec
->ncec_lladdr
, ll_addr_len
) != 0)
2676 * Updates the link layer address or the reachability state of
2677 * a cache entry. Reset probe counter if needed.
2680 nce_update(ncec_t
*ncec
, uint16_t new_state
, uchar_t
*new_ll_addr
)
2682 ill_t
*ill
= ncec
->ncec_ill
;
2683 boolean_t need_stop_timer
= B_FALSE
;
2684 boolean_t need_fastpath_update
= B_FALSE
;
2688 ASSERT(MUTEX_HELD(&ncec
->ncec_lock
));
2690 * If this interface does not do NUD, there is no point
2691 * in allowing an update to the cache entry. Although
2692 * we will respond to NS.
2693 * The only time we accept an update for a resolver when
2694 * NUD is turned off is when it has just been created.
2695 * Non-Resolvers will always be created as REACHABLE.
2697 if (new_state
!= ND_UNCHANGED
) {
2698 if ((ncec
->ncec_flags
& NCE_F_NONUD
) &&
2699 (ncec
->ncec_state
!= ND_INCOMPLETE
))
2701 ASSERT((int16_t)new_state
>= ND_STATE_VALID_MIN
);
2702 ASSERT((int16_t)new_state
<= ND_STATE_VALID_MAX
);
2703 need_stop_timer
= B_TRUE
;
2704 if (new_state
== ND_REACHABLE
)
2705 ncec
->ncec_last
= TICK_TO_MSEC(ddi_get_lbolt64());
2707 /* We force NUD in this case */
2708 ncec
->ncec_last
= 0;
2710 ncec
->ncec_state
= new_state
;
2711 ncec
->ncec_pcnt
= ND_MAX_UNICAST_SOLICIT
;
2712 ASSERT(ncec
->ncec_lladdr
!= NULL
|| new_state
== ND_INITIAL
||
2713 new_state
== ND_INCOMPLETE
);
2715 if (need_stop_timer
|| (ncec
->ncec_flags
& NCE_F_STATIC
)) {
2716 tid
= ncec
->ncec_timeout_id
;
2717 ncec
->ncec_timeout_id
= 0;
2720 * Re-trigger fastpath probe and
2721 * overwrite the DL_UNITDATA_REQ data, noting we'll lose
2722 * whatever packets that happens to be transmitting at the time.
2724 if (new_ll_addr
!= NULL
) {
2725 bcopy(new_ll_addr
, ncec
->ncec_lladdr
,
2726 ill
->ill_phys_addr_length
);
2727 need_fastpath_update
= B_TRUE
;
2729 mutex_exit(&ncec
->ncec_lock
);
2730 if (need_stop_timer
|| (ncec
->ncec_flags
& NCE_F_STATIC
)) {
2732 (void) untimeout(tid
);
2734 if (need_fastpath_update
) {
2736 * Delete any existing existing dlur_mp and fp_mp information.
2737 * For IPMP interfaces, all underlying ill's must be checked
2740 nce_fastpath_list_delete(ncec
->ncec_ill
, ncec
, NULL
);
2742 * add the new dlur_mp and fp_mp
2744 nce
= nce_fastpath(ncec
, B_TRUE
, NULL
);
2748 mutex_enter(&ncec
->ncec_lock
);
2752 nce_queue_mp_common(ncec_t
*ncec
, mblk_t
*mp
, boolean_t head_insert
)
2757 ASSERT(MUTEX_HELD(&ncec
->ncec_lock
));
2759 for (mpp
= &ncec
->ncec_qd_mp
; *mpp
!= NULL
; mpp
= &(*mpp
)->b_next
) {
2760 if (++count
> ncec
->ncec_ill
->ill_max_buf
) {
2761 tmp
= ncec
->ncec_qd_mp
->b_next
;
2762 ncec
->ncec_qd_mp
->b_next
= NULL
;
2764 * if we never create data addrs on the under_ill
2767 BUMP_MIB(ncec
->ncec_ill
->ill_ip_mib
,
2768 ipIfStatsOutDiscards
);
2769 ip_drop_output("ipIfStatsOutDiscards", ncec
->ncec_qd_mp
,
2771 freemsg(ncec
->ncec_qd_mp
);
2772 ncec
->ncec_qd_mp
= tmp
;
2777 ncec
->ncec_nprobes
++;
2778 mp
->b_next
= ncec
->ncec_qd_mp
;
2779 ncec
->ncec_qd_mp
= mp
;
2786 * nce_queue_mp will queue the packet into the ncec_qd_mp. The packet will be
2787 * queued at the head or tail of the queue based on the input argument
2788 * 'head_insert'. The caller should specify this argument as B_TRUE if this
2789 * packet is an IPMP probe packet, in which case the following happens:
2791 * 1. Insert it at the head of the ncec_qd_mp list. Consider the normal
2792 * (non-ipmp_probe) load-speading case where the source address of the ND
2793 * packet is not tied to ncec_ill. If the ill bound to the source address
2794 * cannot receive, the response to the ND packet will not be received.
2795 * However, if ND packets for ncec_ill's probes are queued behind that ND
2796 * packet, those probes will also fail to be sent, and thus in.mpathd will
2797 * erroneously conclude that ncec_ill has also failed.
2799 * 2. Drop the ipmp_probe packet in ndp_timer() if the ND did not succeed on
2800 * the first attempt. This ensures that ND problems do not manifest as
2803 * We achieve this by inserting ipmp_probe() packets at the head of the
2806 * The ncec for the probe target is created with ncec_ill set to the ipmp_ill,
2807 * but the caller needs to set head_insert to B_TRUE if this is a probe packet.
2810 nce_queue_mp(ncec_t
*ncec
, mblk_t
*mp
, boolean_t head_insert
)
2812 ASSERT(MUTEX_HELD(&ncec
->ncec_lock
));
2813 nce_queue_mp_common(ncec
, mp
, head_insert
);
2817 * Called when address resolution failed due to a timeout.
2818 * Send an ICMP unreachable in response to all queued packets.
2821 ndp_resolv_failed(ncec_t
*ncec
)
2823 mblk_t
*mp
, *nxt_mp
;
2824 char buf
[INET6_ADDRSTRLEN
];
2825 ill_t
*ill
= ncec
->ncec_ill
;
2826 ip_recv_attr_t iras
;
2828 bzero(&iras
, sizeof (iras
));
2831 * we are setting the ira_rill to the ipmp_ill (instead of
2832 * the actual ill on which the packet was received), but this
2833 * is ok because we don't actually need the real ira_rill.
2834 * to send the icmp unreachable to the sender.
2836 iras
.ira_ill
= iras
.ira_rill
= ill
;
2837 iras
.ira_ruifindex
= ill
->ill_phyint
->phyint_ifindex
;
2838 iras
.ira_rifindex
= iras
.ira_ruifindex
;
2840 ip1dbg(("ndp_resolv_failed: dst %s\n",
2841 inet_ntop(AF_INET6
, (char *)&ncec
->ncec_addr
, buf
, sizeof (buf
))));
2842 mutex_enter(&ncec
->ncec_lock
);
2843 mp
= ncec
->ncec_qd_mp
;
2844 ncec
->ncec_qd_mp
= NULL
;
2845 ncec
->ncec_nprobes
= 0;
2846 mutex_exit(&ncec
->ncec_lock
);
2847 while (mp
!= NULL
) {
2848 nxt_mp
= mp
->b_next
;
2851 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsOutDiscards
);
2852 ip_drop_output("ipIfStatsOutDiscards - address unreachable",
2854 icmp_unreachable_v6(mp
,
2855 ICMP6_DST_UNREACH_ADDR
, B_FALSE
, &iras
);
2856 ASSERT(!(iras
.ira_flags
& IRAF_IPSEC_SECURE
));
2859 ncec_cb_dispatch(ncec
); /* finish off waiting callbacks */
2863 * Handle the completion of NDP and ARP resolution.
2866 nce_resolv_ok(ncec_t
*ncec
)
2870 iaflags_t ixaflags
= IXAF_NO_TRACE
;
2872 ill_t
*ill
= ncec
->ncec_ill
;
2873 boolean_t isv6
= (ncec
->ncec_ipversion
== IPV6_VERSION
);
2874 ip_stack_t
*ipst
= ill
->ill_ipst
;
2876 if (IS_IPMP(ncec
->ncec_ill
)) {
2877 nce_resolv_ipmp_ok(ncec
);
2882 mutex_enter(&ncec
->ncec_lock
);
2883 ASSERT(ncec
->ncec_nprobes
== 0);
2884 mp
= ncec
->ncec_qd_mp
;
2885 ncec
->ncec_qd_mp
= NULL
;
2886 mutex_exit(&ncec
->ncec_lock
);
2888 while (mp
!= NULL
) {
2891 if (ill
->ill_isv6
) {
2892 ip6_t
*ip6h
= (ip6_t
*)mp
->b_rptr
;
2894 pkt_len
= ntohs(ip6h
->ip6_plen
) + IPV6_HDR_LEN
;
2896 ipha_t
*ipha
= (ipha_t
*)mp
->b_rptr
;
2898 ixaflags
|= IXAF_IS_IPV4
;
2899 pkt_len
= ntohs(ipha
->ipha_length
);
2901 nxt_mp
= mp
->b_next
;
2904 * IXAF_NO_DEV_FLOW_CTL information for TCP packets is no
2905 * longer available, but it's ok to drop this flag because TCP
2906 * has its own flow-control in effect, so TCP packets
2907 * are not likely to get here when flow-control is in effect.
2909 mutex_enter(&ill
->ill_lock
);
2910 nce
= nce_lookup(ill
, &ncec
->ncec_addr
);
2911 mutex_exit(&ill
->ill_lock
);
2915 BUMP_MIB(&ipst
->ips_ip6_mib
,
2916 ipIfStatsOutDiscards
);
2918 BUMP_MIB(&ipst
->ips_ip_mib
,
2919 ipIfStatsOutDiscards
);
2921 ip_drop_output("ipIfStatsOutDiscards - no nce",
2926 * We don't know the zoneid, but
2927 * ip_xmit does not care since IXAF_NO_TRACE
2928 * is set. (We traced the packet the first
2929 * time through ip_xmit.)
2931 (void) ip_xmit(mp
, nce
, ixaflags
, pkt_len
, 0,
2932 ALL_ZONES
, 0, NULL
);
2938 ncec_cb_dispatch(ncec
); /* complete callbacks */
2942 * Called by SIOCSNDP* ioctl to add/change an ncec entry
2943 * and the corresponding attributes.
2944 * Disallow states other than ND_REACHABLE or ND_STALE.
2947 ndp_sioc_update(ill_t
*ill
, lif_nd_req_t
*lnr
)
2954 uint16_t new_flags
= 0;
2955 uint16_t old_flags
= 0;
2956 int inflags
= lnr
->lnr_flags
;
2957 ip_stack_t
*ipst
= ill
->ill_ipst
;
2958 boolean_t do_postprocess
= B_FALSE
;
2960 ASSERT(ill
->ill_isv6
);
2961 if ((lnr
->lnr_state_create
!= ND_REACHABLE
) &&
2962 (lnr
->lnr_state_create
!= ND_STALE
))
2965 sin6
= (sin6_t
*)&lnr
->lnr_addr
;
2966 addr
= &sin6
->sin6_addr
;
2968 mutex_enter(&ipst
->ips_ndp6
->ndp_g_lock
);
2969 ASSERT(!IS_UNDER_IPMP(ill
));
2970 nce
= nce_lookup_addr(ill
, addr
);
2972 new_flags
= nce
->nce_common
->ncec_flags
;
2974 switch (inflags
& (NDF_ISROUTER_ON
|NDF_ISROUTER_OFF
)) {
2975 case NDF_ISROUTER_ON
:
2976 new_flags
|= NCE_F_ISROUTER
;
2978 case NDF_ISROUTER_OFF
:
2979 new_flags
&= ~NCE_F_ISROUTER
;
2981 case (NDF_ISROUTER_OFF
|NDF_ISROUTER_ON
):
2982 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
2987 if (inflags
& NDF_STATIC
)
2988 new_flags
|= NCE_F_STATIC
;
2990 switch (inflags
& (NDF_ANYCAST_ON
|NDF_ANYCAST_OFF
)) {
2991 case NDF_ANYCAST_ON
:
2992 new_flags
|= NCE_F_ANYCAST
;
2994 case NDF_ANYCAST_OFF
:
2995 new_flags
&= ~NCE_F_ANYCAST
;
2997 case (NDF_ANYCAST_OFF
|NDF_ANYCAST_ON
):
2998 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
3005 err
= nce_add_v6(ill
,
3006 (uchar_t
*)lnr
->lnr_hdw_addr
,
3007 ill
->ill_phys_addr_length
,
3010 lnr
->lnr_state_create
,
3013 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
3014 ip1dbg(("ndp_sioc_update: Can't create NCE %d\n", err
));
3017 do_postprocess
= B_TRUE
;
3020 ncec
= nce
->nce_common
;
3021 old_flags
= ncec
->ncec_flags
;
3022 if (old_flags
& NCE_F_ISROUTER
&& !(new_flags
& NCE_F_ISROUTER
)) {
3023 ncec_router_to_host(ncec
);
3024 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
3026 err
= nce_add_v6_postprocess(nce
);
3030 mutex_exit(&ipst
->ips_ndp6
->ndp_g_lock
);
3033 err
= nce_add_v6_postprocess(nce
);
3035 * err cannot be anything other than 0 because we don't support
3036 * proxy arp of static addresses.
3040 mutex_enter(&ncec
->ncec_lock
);
3041 ncec
->ncec_flags
= new_flags
;
3042 mutex_exit(&ncec
->ncec_lock
);
3044 * Note that we ignore the state at this point, which
3045 * should be either STALE or REACHABLE. Instead we let
3046 * the link layer address passed in to determine the state
3047 * much like incoming packets.
3049 nce_process(ncec
, (uchar_t
*)lnr
->lnr_hdw_addr
, 0, B_FALSE
);
3055 * Create an nce_t structure for ill using the ncec->ncec_lladdr to set up
3056 * the nce_dlur_mp. If ill != ncec->ncec_ill, then the ips_ill_g_lock must
3057 * be held to ensure that they are in the same group.
3060 nce_fastpath_create(ill_t
*ill
, ncec_t
*ncec
)
3065 nce
= nce_ill_lookup_then_add(ill
, ncec
);
3067 if (nce
== NULL
|| IS_LOOPBACK(nce
->nce_ill
) || IS_VNI(nce
->nce_ill
))
3071 * hold the ncec_lock to synchronize with nce_update() so that,
3072 * at the end of this function, the contents of nce_dlur_mp are
3073 * consistent with ncec->ncec_lladdr, even though some intermediate
3074 * packet may have been sent out with a mangled address, which would
3075 * only be a transient condition.
3077 mutex_enter(&ncec
->ncec_lock
);
3078 if (ncec
->ncec_lladdr
!= NULL
) {
3079 bcopy(ncec
->ncec_lladdr
, nce
->nce_dlur_mp
->b_rptr
+
3080 NCE_LL_ADDR_OFFSET(ill
), ill
->ill_phys_addr_length
);
3082 nce
->nce_dlur_mp
= ill_dlur_gen(NULL
, 0, ill
->ill_sap
,
3083 ill
->ill_sap_length
);
3085 mutex_exit(&ncec
->ncec_lock
);
3090 * we make nce_fp_mp to have an M_DATA prepend.
3091 * The caller ensures there is hold on ncec for this function.
3092 * Note that since ill_fastpath_probe() copies the mblk there is
3093 * no need to hold the nce or ncec beyond this function.
3095 * If the caller has passed in a non-null ncec_nce to nce_fastpath() that
3096 * ncec_nce must correspond to the nce for ncec with nce_ill == ncec->ncec_ill
3097 * and will be returned back by this function, so that no extra nce_refrele
3098 * is required for the caller. The calls from nce_add_common() use this
3099 * method. All other callers (that pass in NULL ncec_nce) will have to do a
3100 * nce_refrele of the returned nce (when it is non-null).
3103 nce_fastpath(ncec_t
*ncec
, boolean_t trigger_fp_req
, nce_t
*ncec_nce
)
3106 ill_t
*ill
= ncec
->ncec_ill
;
3108 ASSERT(ill
!= NULL
);
3110 if (IS_IPMP(ill
) && trigger_fp_req
) {
3111 trigger_fp_req
= B_FALSE
;
3112 ipmp_ncec_refresh_nce(ncec
);
3116 * If the caller already has the nce corresponding to the ill, use
3117 * that one. Otherwise we have to lookup/add the nce. Calls from
3118 * nce_add_common() fall in the former category, and have just done
3119 * the nce lookup/add that can be reused.
3121 if (ncec_nce
== NULL
)
3122 nce
= nce_fastpath_create(ill
, ncec
);
3126 if (nce
== NULL
|| IS_LOOPBACK(nce
->nce_ill
) || IS_VNI(nce
->nce_ill
))
3130 nce_fastpath_trigger(nce
);
3135 * Trigger fastpath on nce. No locks may be held.
3138 nce_fastpath_trigger(nce_t
*nce
)
3141 ill_t
*ill
= nce
->nce_ill
;
3142 ncec_t
*ncec
= nce
->nce_common
;
3144 res
= ill_fastpath_probe(ill
, nce
->nce_dlur_mp
);
3146 * EAGAIN is an indication of a transient error
3147 * i.e. allocation failure etc. leave the ncec in the list it
3148 * will be updated when another probe happens for another ire
3149 * if not it will be taken out of the list when the ire is
3152 if (res
!= 0 && res
!= EAGAIN
&& res
!= ENOTSUP
)
3153 nce_fastpath_list_delete(ill
, ncec
, NULL
);
3157 * Add ncec to the nce fastpath list on ill.
3160 nce_ill_lookup_then_add_locked(ill_t
*ill
, ncec_t
*ncec
)
3164 ASSERT(MUTEX_HELD(&ill
->ill_lock
));
3166 * Atomically ensure that the ill is not CONDEMNED and is not going
3167 * down, before adding the NCE.
3169 if (ill
->ill_state_flags
& ILL_CONDEMNED
)
3171 mutex_enter(&ncec
->ncec_lock
);
3173 * if ncec has not been deleted and
3174 * is not already in the list add it.
3176 if (!NCE_ISCONDEMNED(ncec
)) {
3177 nce
= nce_lookup(ill
, &ncec
->ncec_addr
);
3180 nce
= nce_add(ill
, ncec
);
3183 mutex_exit(&ncec
->ncec_lock
);
3188 nce_ill_lookup_then_add(ill_t
*ill
, ncec_t
*ncec
)
3192 mutex_enter(&ill
->ill_lock
);
3193 nce
= nce_ill_lookup_then_add_locked(ill
, ncec
);
3194 mutex_exit(&ill
->ill_lock
);
3200 * remove ncec from the ill_nce list. If 'dead' is non-null, the deleted
3201 * nce is added to the 'dead' list, and the caller must nce_refrele() the
3202 * entry after all locks have been dropped.
3205 nce_fastpath_list_delete(ill_t
*ill
, ncec_t
*ncec
, list_t
*dead
)
3209 ASSERT(ill
!= NULL
);
3211 /* delete any nces referencing the ncec from underlying ills */
3213 ipmp_ncec_delete_nce(ncec
);
3215 /* now the ill itself */
3216 mutex_enter(&ill
->ill_lock
);
3217 for (nce
= list_head(&ill
->ill_nce
); nce
!= NULL
;
3218 nce
= list_next(&ill
->ill_nce
, nce
)) {
3219 if (nce
->nce_common
== ncec
) {
3225 mutex_exit(&ill
->ill_lock
);
3230 list_insert_tail(dead
, nce
);
3235 * when the fastpath response does not fit in the datab
3236 * associated with the existing nce_fp_mp, we delete and
3237 * add the nce to retrigger fastpath based on the information
3241 nce_delete_then_add(nce_t
*nce
)
3243 ill_t
*ill
= nce
->nce_ill
;
3244 nce_t
*newnce
= NULL
;
3246 ip0dbg(("nce_delete_then_add nce %p ill %s\n",
3247 (void *)nce
, ill
->ill_name
));
3248 mutex_enter(&ill
->ill_lock
);
3249 mutex_enter(&nce
->nce_common
->ncec_lock
);
3252 * Make sure that ncec is not condemned before adding. We hold the
3253 * ill_lock and ncec_lock to synchronize with ncec_delete() and
3254 * ipmp_ncec_delete_nce()
3256 if (!NCE_ISCONDEMNED(nce
->nce_common
))
3257 newnce
= nce_add(ill
, nce
->nce_common
);
3258 mutex_exit(&nce
->nce_common
->ncec_lock
);
3259 mutex_exit(&ill
->ill_lock
);
3261 return (newnce
); /* could be null if nomem */
3264 typedef struct nce_fp_match_s
{
3265 nce_t
*nce_fp_match_res
;
3266 mblk_t
*nce_fp_match_ack_mp
;
3271 nce_fastpath_match_dlur(ill_t
*ill
, nce_t
*nce
, void *arg
)
3273 nce_fp_match_t
*nce_fp_marg
= arg
;
3274 ncec_t
*ncec
= nce
->nce_common
;
3275 mblk_t
*mp
= nce_fp_marg
->nce_fp_match_ack_mp
;
3276 uchar_t
*mp_rptr
, *ud_mp_rptr
;
3277 mblk_t
*ud_mp
= nce
->nce_dlur_mp
;
3281 * mp is the mp associated with the fastpath ack.
3282 * ud_mp is the outstanding DL_UNITDATA_REQ on the nce_t
3283 * under consideration. If the contents match, then the
3284 * fastpath ack is used to update the nce.
3288 mp_rptr
= mp
->b_rptr
;
3289 cmplen
= mp
->b_wptr
- mp_rptr
;
3290 ASSERT(cmplen
>= 0);
3292 ud_mp_rptr
= ud_mp
->b_rptr
;
3294 * The ncec is locked here to prevent any other threads from accessing
3295 * and changing nce_dlur_mp when the address becomes resolved to an
3296 * lla while we're in the middle of looking at and comparing the
3297 * hardware address (lla). It is also locked to prevent multiple
3298 * threads in nce_fastpath() from examining nce_dlur_mp at the same
3301 mutex_enter(&ncec
->ncec_lock
);
3302 if (ud_mp
->b_wptr
- ud_mp_rptr
!= cmplen
||
3303 bcmp((char *)mp_rptr
, (char *)ud_mp_rptr
, cmplen
) == 0) {
3304 nce_fp_marg
->nce_fp_match_res
= nce
;
3305 mutex_exit(&ncec
->ncec_lock
);
3309 mutex_exit(&ncec
->ncec_lock
);
3314 * Update all NCE's that are not in fastpath mode and
3315 * have an nce_fp_mp that matches mp. mp->b_cont contains
3316 * the fastpath header.
3318 * Returns TRUE if entry should be dequeued, or FALSE otherwise.
3321 nce_fastpath_update(ill_t
*ill
, mblk_t
*mp
)
3323 nce_fp_match_t nce_fp_marg
;
3325 mblk_t
*nce_fp_mp
, *fp_mp
;
3327 nce_fp_marg
.nce_fp_match_res
= NULL
;
3328 nce_fp_marg
.nce_fp_match_ack_mp
= mp
;
3330 nce_walk(ill
, nce_fastpath_match_dlur
, &nce_fp_marg
);
3332 if ((nce
= nce_fp_marg
.nce_fp_match_res
) == NULL
)
3335 mutex_enter(&nce
->nce_lock
);
3336 nce_fp_mp
= nce
->nce_fp_mp
;
3338 if (nce_fp_mp
!= NULL
) {
3340 if (nce_fp_mp
->b_rptr
+ MBLKL(fp_mp
) >
3341 nce_fp_mp
->b_datap
->db_lim
) {
3342 mutex_exit(&nce
->nce_lock
);
3343 nce
= nce_delete_then_add(nce
);
3347 mutex_enter(&nce
->nce_lock
);
3348 nce_fp_mp
= nce
->nce_fp_mp
;
3352 /* Matched - install mp as the fastpath mp */
3353 if (nce_fp_mp
== NULL
) {
3354 fp_mp
= dupb(mp
->b_cont
);
3355 nce
->nce_fp_mp
= fp_mp
;
3358 bcopy(fp_mp
->b_rptr
, nce_fp_mp
->b_rptr
, MBLKL(fp_mp
));
3359 nce
->nce_fp_mp
->b_wptr
= nce
->nce_fp_mp
->b_rptr
3362 mutex_exit(&nce
->nce_lock
);
3367 * Return a pointer to a given option in the packet.
3368 * Assumes that option part of the packet have already been validated.
3371 ndp_get_option(nd_opt_hdr_t
*opt
, int optlen
, int opt_type
)
3373 while (optlen
> 0) {
3374 if (opt
->nd_opt_type
== opt_type
)
3376 optlen
-= 8 * opt
->nd_opt_len
;
3377 opt
= (struct nd_opt_hdr
*)((char *)opt
+ 8 * opt
->nd_opt_len
);
3383 * Verify all option lengths present are > 0, also check to see
3384 * if the option lengths and packet length are consistent.
3387 ndp_verify_optlen(nd_opt_hdr_t
*opt
, int optlen
)
3389 ASSERT(opt
!= NULL
);
3390 while (optlen
> 0) {
3391 if (opt
->nd_opt_len
== 0)
3393 optlen
-= 8 * opt
->nd_opt_len
;
3396 opt
= (struct nd_opt_hdr
*)((char *)opt
+ 8 * opt
->nd_opt_len
);
3402 * ncec_walk function.
3403 * Free a fraction of the NCE cache entries.
3405 * A possible optimization here would be to use ncec_last where possible, and
3406 * delete the least-frequently used entry, which would require more complex
3407 * computation as we walk through the ncec's (e.g., track ncec entries by
3408 * order of ncec_last and/or maintain state)
3411 ncec_cache_reclaim(ncec_t
*ncec
, void *arg
)
3413 ip_stack_t
*ipst
= ncec
->ncec_ipst
;
3414 uint_t fraction
= *(uint_t
*)arg
;
3417 if ((ncec
->ncec_flags
&
3418 (NCE_F_MYADDR
| NCE_F_STATIC
| NCE_F_BCAST
)) != 0) {
3422 rand
= (uint_t
)ddi_get_lbolt() +
3423 NCE_ADDR_HASH_V6(ncec
->ncec_addr
, NCE_TABLE_SIZE
);
3424 if ((rand
/fraction
)*fraction
== rand
) {
3425 IP_STAT(ipst
, ip_nce_reclaim_deleted
);
3431 * kmem_cache callback to free up memory.
3433 * For now we just delete a fixed fraction.
3436 ip_nce_reclaim_stack(ip_stack_t
*ipst
)
3438 uint_t fraction
= ipst
->ips_ip_nce_reclaim_fraction
;
3440 IP_STAT(ipst
, ip_nce_reclaim_calls
);
3442 ncec_walk(NULL
, ncec_cache_reclaim
, &fraction
, ipst
);
3445 * Walk all CONNs that can have a reference on an ire, ncec or dce.
3446 * Get them to update any stale references to drop any refholds they
3449 ipcl_walk(conn_ixa_cleanup
, (void *)B_FALSE
, ipst
);
3453 * Called by the memory allocator subsystem directly, when the system
3454 * is running low on memory.
3458 ip_nce_reclaim(void *args
)
3460 netstack_handle_t nh
;
3464 netstack_next_init(&nh
);
3465 while ((ns
= netstack_next(&nh
)) != NULL
) {
3467 * netstack_next() can return a netstack_t with a NULL
3468 * netstack_ip at boot time.
3470 if ((ipst
= ns
->netstack_ip
) == NULL
) {
3474 ip_nce_reclaim_stack(ipst
);
3477 netstack_next_fini(&nh
);
3482 ncec_trace_ref(ncec_t
*ncec
)
3484 ASSERT(MUTEX_HELD(&ncec
->ncec_lock
));
3486 if (ncec
->ncec_trace_disable
)
3489 if (!th_trace_ref(ncec
, ncec
->ncec_ipst
)) {
3490 ncec
->ncec_trace_disable
= B_TRUE
;
3491 ncec_trace_cleanup(ncec
);
3496 ncec_untrace_ref(ncec_t
*ncec
)
3498 ASSERT(MUTEX_HELD(&ncec
->ncec_lock
));
3500 if (!ncec
->ncec_trace_disable
)
3501 th_trace_unref(ncec
);
3505 ncec_trace_cleanup(const ncec_t
*ncec
)
3507 th_trace_cleanup(ncec
, ncec
->ncec_trace_disable
);
3512 * Called when address resolution fails due to a timeout.
3513 * Send an ICMP unreachable in response to all queued packets.
3516 arp_resolv_failed(ncec_t
*ncec
)
3518 mblk_t
*mp
, *nxt_mp
;
3519 char buf
[INET6_ADDRSTRLEN
];
3520 struct in_addr ipv4addr
;
3521 ill_t
*ill
= ncec
->ncec_ill
;
3522 ip_stack_t
*ipst
= ncec
->ncec_ipst
;
3523 ip_recv_attr_t iras
;
3525 bzero(&iras
, sizeof (iras
));
3526 iras
.ira_flags
= IRAF_IS_IPV4
;
3528 * we are setting the ira_rill to the ipmp_ill (instead of
3529 * the actual ill on which the packet was received), but this
3530 * is ok because we don't actually need the real ira_rill.
3531 * to send the icmp unreachable to the sender.
3533 iras
.ira_ill
= iras
.ira_rill
= ill
;
3534 iras
.ira_ruifindex
= ill
->ill_phyint
->phyint_ifindex
;
3535 iras
.ira_rifindex
= iras
.ira_ruifindex
;
3537 IN6_V4MAPPED_TO_INADDR(&ncec
->ncec_addr
, &ipv4addr
);
3538 ip3dbg(("arp_resolv_failed: dst %s\n",
3539 inet_ntop(AF_INET
, &ipv4addr
, buf
, sizeof (buf
))));
3540 mutex_enter(&ncec
->ncec_lock
);
3541 mp
= ncec
->ncec_qd_mp
;
3542 ncec
->ncec_qd_mp
= NULL
;
3543 ncec
->ncec_nprobes
= 0;
3544 mutex_exit(&ncec
->ncec_lock
);
3545 while (mp
!= NULL
) {
3546 nxt_mp
= mp
->b_next
;
3549 BUMP_MIB(ill
->ill_ip_mib
, ipIfStatsOutDiscards
);
3550 ip_drop_output("ipIfStatsOutDiscards - address unreachable",
3552 if (ipst
->ips_ip_arp_icmp_error
) {
3553 ip3dbg(("arp_resolv_failed: "
3554 "Calling icmp_unreachable\n"));
3555 icmp_unreachable(mp
, ICMP_HOST_UNREACHABLE
, &iras
);
3559 ASSERT(!(iras
.ira_flags
& IRAF_IPSEC_SECURE
));
3562 ncec_cb_dispatch(ncec
); /* finish off waiting callbacks */
3566 * if ill is an under_ill, translate it to the ipmp_ill and add the
3567 * nce on the ipmp_ill. Two nce_t entries (one on the ipmp_ill, and
3568 * one on the underlying in_ill) will be created for the
3569 * ncec_t in this case. The ncec_t itself will be created on the ipmp_ill.
3572 nce_lookup_then_add_v4(ill_t
*ill
, uchar_t
*hw_addr
, uint_t hw_addr_len
,
3573 const in_addr_t
*addr
, uint16_t flags
, uint16_t state
, nce_t
**newnce
)
3577 ip_stack_t
*ipst
= ill
->ill_ipst
;
3578 nce_t
*nce
, *upper_nce
= NULL
;
3579 ill_t
*in_ill
= ill
, *under
= NULL
;
3580 boolean_t need_ill_refrele
= B_FALSE
;
3582 if (flags
& NCE_F_MCAST
) {
3584 * hw_addr will be figured out in nce_set_multicast_v4;
3585 * caller needs to pass in the cast_ill for ipmp
3587 ASSERT(hw_addr
== NULL
);
3588 ASSERT(!IS_IPMP(ill
));
3589 err
= nce_set_multicast_v4(ill
, addr
, flags
, newnce
);
3593 if (IS_UNDER_IPMP(ill
) && !(flags
& NCE_F_MYADDR
)) {
3594 ill
= ipmp_ill_hold_ipmp_ill(ill
);
3597 need_ill_refrele
= B_TRUE
;
3599 if ((flags
& NCE_F_BCAST
) != 0) {
3601 * IPv4 broadcast ncec: compute the hwaddr.
3604 under
= ipmp_ill_hold_xmit_ill(ill
, B_FALSE
);
3605 if (under
== NULL
) {
3606 if (need_ill_refrele
)
3610 hw_addr
= under
->ill_bcast_mp
->b_rptr
+
3611 NCE_LL_ADDR_OFFSET(under
);
3612 hw_addr_len
= under
->ill_phys_addr_length
;
3614 hw_addr
= ill
->ill_bcast_mp
->b_rptr
+
3615 NCE_LL_ADDR_OFFSET(ill
),
3616 hw_addr_len
= ill
->ill_phys_addr_length
;
3620 mutex_enter(&ipst
->ips_ndp4
->ndp_g_lock
);
3621 IN6_IPADDR_TO_V4MAPPED(*addr
, &addr6
);
3622 nce
= nce_lookup_addr(ill
, &addr6
);
3624 err
= nce_add_v4(ill
, hw_addr
, hw_addr_len
, addr
, flags
,
3629 mutex_exit(&ipst
->ips_ndp4
->ndp_g_lock
);
3631 err
= nce_add_v4_postprocess(nce
);
3633 if (in_ill
!= ill
&& nce
!= NULL
) {
3634 nce_t
*under_nce
= NULL
;
3637 * in_ill was the under_ill. Try to create the under_nce.
3638 * Hold the ill_g_lock to prevent changes to group membership
3639 * until we are done.
3641 rw_enter(&ipst
->ips_ill_g_lock
, RW_READER
);
3642 if (!IS_IN_SAME_ILLGRP(in_ill
, ill
)) {
3643 DTRACE_PROBE2(ill__not__in__group
, nce_t
*, nce
,
3645 rw_exit(&ipst
->ips_ill_g_lock
);
3651 under_nce
= nce_fastpath_create(in_ill
, nce
->nce_common
);
3652 if (under_nce
== NULL
) {
3653 rw_exit(&ipst
->ips_ill_g_lock
);
3659 rw_exit(&ipst
->ips_ill_g_lock
);
3661 nce
= under_nce
; /* will be returned to caller */
3662 if (NCE_ISREACHABLE(nce
->nce_common
))
3663 nce_fastpath_trigger(under_nce
);
3674 if (upper_nce
!= NULL
)
3675 nce_refrele(upper_nce
);
3676 if (need_ill_refrele
)
3683 * NDP Cache Entry creation routine for IPv4.
3684 * This routine must always be called with ndp4->ndp_g_lock held.
3685 * Prior to return, ncec_refcnt is incremented.
3687 * IPMP notes: the ncec for non-local (i.e., !NCE_MYADDR(ncec) addresses
3688 * are always added pointing at the ipmp_ill. Thus, when the ill passed
3689 * to nce_add_v4 is an under_ill (i.e., IS_UNDER_IPMP(ill)) two nce_t
3690 * entries will be created, both pointing at the same ncec_t. The nce_t
3691 * entries will have their nce_ill set to the ipmp_ill and the under_ill
3692 * respectively, with the ncec_t having its ncec_ill pointing at the ipmp_ill.
3693 * Local addresses are always created on the ill passed to nce_add_v4.
3696 nce_add_v4(ill_t
*ill
, uchar_t
*hw_addr
, uint_t hw_addr_len
,
3697 const in_addr_t
*addr
, uint16_t flags
, uint16_t state
, nce_t
**newnce
)
3700 boolean_t is_multicast
= (flags
& NCE_F_MCAST
);
3701 struct in6_addr addr6
;
3704 ASSERT(MUTEX_HELD(&ill
->ill_ipst
->ips_ndp4
->ndp_g_lock
));
3705 ASSERT(!ill
->ill_isv6
);
3706 ASSERT(!IN_MULTICAST(htonl(*addr
)) || is_multicast
);
3708 IN6_IPADDR_TO_V4MAPPED(*addr
, &addr6
);
3709 err
= nce_add_common(ill
, hw_addr
, hw_addr_len
, &addr6
, flags
, state
,
3711 ASSERT(newnce
!= NULL
);
3717 * Post-processing routine to be executed after nce_add_v4(). This function
3718 * triggers fastpath (if appropriate) and DAD on the newly added nce entry
3719 * and must be called without any locks held.
3721 * Always returns 0, but we return an int to keep this symmetric with the
3722 * IPv6 counter-part.
3725 nce_add_v4_postprocess(nce_t
*nce
)
3727 ncec_t
*ncec
= nce
->nce_common
;
3728 uint16_t flags
= ncec
->ncec_flags
;
3729 boolean_t ndp_need_dad
= B_FALSE
;
3732 ip_stack_t
*ipst
= ncec
->ncec_ill
->ill_ipst
;
3733 uchar_t
*hw_addr
= ncec
->ncec_lladdr
;
3734 boolean_t trigger_fastpath
= B_TRUE
;
3737 * If the hw_addr is NULL, typically for ND_INCOMPLETE nces, then
3738 * we call nce_fastpath as soon as the ncec is resolved in nce_process.
3739 * We call nce_fastpath from nce_update if the link layer address of
3740 * the peer changes from nce_update
3742 if (NCE_PUBLISH(ncec
) || !NCE_ISREACHABLE(ncec
) || (hw_addr
== NULL
&&
3743 ncec
->ncec_ill
->ill_net_type
!= IRE_IF_NORESOLVER
))
3744 trigger_fastpath
= B_FALSE
;
3746 if (trigger_fastpath
)
3747 nce_fastpath_trigger(nce
);
3749 if (NCE_PUBLISH(ncec
) && ncec
->ncec_state
== ND_PROBE
) {
3751 * Either the caller (by passing in ND_PROBE)
3752 * or nce_add_common() (by the internally computed state
3753 * based on ncec_addr and ill_net_type) has determined
3754 * that this unicast entry needs DAD. Trigger DAD.
3756 ndp_need_dad
= B_TRUE
;
3757 } else if (flags
& NCE_F_UNSOL_ADV
) {
3759 * We account for the transmit below by assigning one
3760 * less than the ndd variable. Subsequent decrements
3761 * are done in nce_timer.
3763 mutex_enter(&ncec
->ncec_lock
);
3764 ncec
->ncec_unsolicit_count
=
3765 ipst
->ips_ip_arp_publish_count
- 1;
3766 mutex_exit(&ncec
->ncec_lock
);
3767 dropped
= arp_announce(ncec
);
3768 mutex_enter(&ncec
->ncec_lock
);
3770 ncec
->ncec_unsolicit_count
++;
3772 ncec
->ncec_last_time_defended
= ddi_get_lbolt();
3773 if (ncec
->ncec_unsolicit_count
!= 0) {
3774 nce_start_timer(ncec
,
3775 ipst
->ips_ip_arp_publish_interval
);
3777 mutex_exit(&ncec
->ncec_lock
);
3781 * If ncec_xmit_interval is 0, user has configured us to send the first
3782 * probe right away. Do so, and set up for the subsequent probes.
3785 mutex_enter(&ncec
->ncec_lock
);
3786 if (ncec
->ncec_pcnt
== 0) {
3788 * DAD probes and announce can be
3789 * administratively disabled by setting the
3790 * probe_count to zero. Restart the timer in
3791 * this case to mark the ipif as ready.
3793 ncec
->ncec_unsolicit_count
= 0;
3794 mutex_exit(&ncec
->ncec_lock
);
3795 nce_restart_timer(ncec
, 0);
3797 mutex_exit(&ncec
->ncec_lock
);
3798 delay
= ((ncec
->ncec_flags
& NCE_F_FAST
) ?
3799 ipst
->ips_arp_probe_delay
:
3800 ipst
->ips_arp_fastprobe_delay
);
3801 nce_dad(ncec
, NULL
, (delay
== 0 ? B_TRUE
: B_FALSE
));
3808 * ncec_walk routine to update all entries that have a given destination or
3809 * gateway address and cached link layer (MAC) address. This is used when ARP
3810 * informs us that a network-to-link-layer mapping may have changed.
3813 nce_update_hw_changed(ncec_t
*ncec
, void *arg
)
3815 nce_hw_map_t
*hwm
= arg
;
3818 if (ncec
->ncec_state
!= ND_REACHABLE
)
3821 IN6_V4MAPPED_TO_IPADDR(&ncec
->ncec_addr
, ncec_addr
);
3822 if (ncec_addr
!= hwm
->hwm_addr
)
3825 mutex_enter(&ncec
->ncec_lock
);
3826 if (hwm
->hwm_flags
!= 0)
3827 ncec
->ncec_flags
= hwm
->hwm_flags
;
3828 nce_update(ncec
, ND_STALE
, hwm
->hwm_hwaddr
);
3829 mutex_exit(&ncec
->ncec_lock
);
3833 ncec_refhold(ncec_t
*ncec
)
3835 mutex_enter(&(ncec
)->ncec_lock
);
3836 (ncec
)->ncec_refcnt
++;
3837 ASSERT((ncec
)->ncec_refcnt
!= 0);
3839 ncec_trace_ref(ncec
);
3841 mutex_exit(&(ncec
)->ncec_lock
);
3845 ncec_refhold_notr(ncec_t
*ncec
)
3847 mutex_enter(&(ncec
)->ncec_lock
);
3848 (ncec
)->ncec_refcnt
++;
3849 ASSERT((ncec
)->ncec_refcnt
!= 0);
3850 mutex_exit(&(ncec
)->ncec_lock
);
3854 ncec_refhold_locked(ncec_t
*ncec
)
3856 ASSERT(MUTEX_HELD(&(ncec
)->ncec_lock
));
3857 (ncec
)->ncec_refcnt
++;
3859 ncec_trace_ref(ncec
);
3863 /* ncec_inactive destroys the mutex thus no mutex_exit is needed */
3865 ncec_refrele(ncec_t
*ncec
)
3867 mutex_enter(&(ncec
)->ncec_lock
);
3869 ncec_untrace_ref(ncec
);
3871 ASSERT((ncec
)->ncec_refcnt
!= 0);
3872 if (--(ncec
)->ncec_refcnt
== 0) {
3873 ncec_inactive(ncec
);
3875 mutex_exit(&(ncec
)->ncec_lock
);
3880 ncec_refrele_notr(ncec_t
*ncec
)
3882 mutex_enter(&(ncec
)->ncec_lock
);
3883 ASSERT((ncec
)->ncec_refcnt
!= 0);
3884 if (--(ncec
)->ncec_refcnt
== 0) {
3885 ncec_inactive(ncec
);
3887 mutex_exit(&(ncec
)->ncec_lock
);
3892 * Common to IPv4 and IPv6.
3895 nce_restart_timer(ncec_t
*ncec
, uint_t ms
)
3899 ASSERT(!MUTEX_HELD(&(ncec
)->ncec_lock
));
3901 /* First cancel any running timer */
3902 mutex_enter(&ncec
->ncec_lock
);
3903 tid
= ncec
->ncec_timeout_id
;
3904 ncec
->ncec_timeout_id
= 0;
3906 mutex_exit(&ncec
->ncec_lock
);
3907 (void) untimeout(tid
);
3908 mutex_enter(&ncec
->ncec_lock
);
3912 nce_start_timer(ncec
, ms
);
3913 mutex_exit(&ncec
->ncec_lock
);
3917 nce_start_timer(ncec_t
*ncec
, uint_t ms
)
3919 ASSERT(MUTEX_HELD(&ncec
->ncec_lock
));
3921 * Don't start the timer if the ncec has been deleted, or if the timer
3922 * is already running
3924 if (!NCE_ISCONDEMNED(ncec
) && ncec
->ncec_timeout_id
== 0) {
3925 ncec
->ncec_timeout_id
= timeout(nce_timer
, ncec
,
3926 MSEC_TO_TICK(ms
) == 0 ? 1 : MSEC_TO_TICK(ms
));
3931 nce_set_multicast_v4(ill_t
*ill
, const in_addr_t
*dst
,
3932 uint16_t flags
, nce_t
**newnce
)
3936 ip_stack_t
*ipst
= ill
->ill_ipst
;
3940 ASSERT(!ill
->ill_isv6
);
3942 IN6_IPADDR_TO_V4MAPPED(*dst
, &dst6
);
3943 mutex_enter(&ipst
->ips_ndp4
->ndp_g_lock
);
3944 if ((nce
= nce_lookup_addr(ill
, &dst6
)) != NULL
) {
3945 mutex_exit(&ipst
->ips_ndp4
->ndp_g_lock
);
3948 if (ill
->ill_net_type
== IRE_IF_RESOLVER
) {
3950 * For IRE_IF_RESOLVER a hardware mapping can be
3951 * generated, for IRE_IF_NORESOLVER, resolution cookie
3952 * in the ill is copied in nce_add_v4().
3954 hw_addr
= kmem_alloc(ill
->ill_phys_addr_length
, KM_NOSLEEP
);
3955 if (hw_addr
== NULL
) {
3956 mutex_exit(&ipst
->ips_ndp4
->ndp_g_lock
);
3959 ip_mcast_mapping(ill
, (uchar_t
*)dst
, hw_addr
);
3962 * IRE_IF_NORESOLVER type simply copies the resolution
3963 * cookie passed in. So no hw_addr is needed.
3967 ASSERT(flags
& NCE_F_MCAST
);
3968 ASSERT(flags
& NCE_F_NONUD
);
3969 /* nce_state will be computed by nce_add_common() */
3970 err
= nce_add_v4(ill
, hw_addr
, ill
->ill_phys_addr_length
, dst
, flags
,
3971 ND_UNCHANGED
, &nce
);
3972 mutex_exit(&ipst
->ips_ndp4
->ndp_g_lock
);
3974 err
= nce_add_v4_postprocess(nce
);
3975 if (hw_addr
!= NULL
)
3976 kmem_free(hw_addr
, ill
->ill_phys_addr_length
);
3978 ip1dbg(("nce_set_multicast_v4: create failed" "%d\n", err
));
3990 * This is used when scanning for "old" (least recently broadcast) NCEs. We
3991 * don't want to have to walk the list for every single one, so we gather up
3992 * batches at a time.
3994 #define NCE_RESCHED_LIST_LEN 8
3999 ncec_t
*ncert_nces
[NCE_RESCHED_LIST_LEN
];
4003 * Pick the longest waiting NCEs for defense.
4007 ncec_reschedule(ill_t
*ill
, nce_t
*nce
, void *arg
)
4009 nce_resched_t
*ncert
= arg
;
4013 ncec_t
*ncec
= nce
->nce_common
;
4015 ASSERT(ncec
->ncec_ill
== ncert
->ncert_ill
);
4017 * Only reachable entries that are ready for announcement are eligible.
4019 if (!NCE_MYADDR(ncec
) || ncec
->ncec_state
!= ND_REACHABLE
)
4021 if (ncert
->ncert_num
< NCE_RESCHED_LIST_LEN
) {
4023 ncert
->ncert_nces
[ncert
->ncert_num
++] = ncec
;
4025 ncecs
= ncert
->ncert_nces
;
4026 ncec_max
= ncecs
+ NCE_RESCHED_LIST_LEN
;
4028 for (; ncecs
< ncec_max
; ncecs
++) {
4029 ASSERT(ncec
!= NULL
);
4030 if ((*ncecs
)->ncec_last_time_defended
>
4031 ncec
->ncec_last_time_defended
) {
4043 * Reschedule the ARP defense of any long-waiting NCEs. It's assumed that this
4044 * doesn't happen very often (if at all), and thus it needn't be highly
4045 * optimized. (Note, though, that it's actually O(N) complexity, because the
4046 * outer loop is bounded by a constant rather than by the length of the list.)
4049 nce_ill_reschedule(ill_t
*ill
, nce_resched_t
*ncert
)
4052 ip_stack_t
*ipst
= ill
->ill_ipst
;
4053 uint_t i
, defend_rate
;
4055 i
= ill
->ill_defend_count
;
4056 ill
->ill_defend_count
= 0;
4058 defend_rate
= ipst
->ips_ndp_defend_rate
;
4060 defend_rate
= ipst
->ips_arp_defend_rate
;
4061 /* If none could be sitting around, then don't reschedule */
4062 if (i
< defend_rate
) {
4063 DTRACE_PROBE1(reschedule_none
, ill_t
*, ill
);
4066 ncert
->ncert_ill
= ill
;
4067 while (ill
->ill_defend_count
< defend_rate
) {
4068 nce_walk_common(ill
, ncec_reschedule
, ncert
);
4069 for (i
= 0; i
< ncert
->ncert_num
; i
++) {
4071 ncec
= ncert
->ncert_nces
[i
];
4072 mutex_enter(&ncec
->ncec_lock
);
4073 ncec
->ncec_flags
|= NCE_F_DELAYED
;
4074 mutex_exit(&ncec
->ncec_lock
);
4076 * we plan to schedule this ncec, so incr the
4077 * defend_count in anticipation.
4079 if (++ill
->ill_defend_count
>= defend_rate
)
4082 if (ncert
->ncert_num
< NCE_RESCHED_LIST_LEN
)
4088 * Check if the current rate-limiting parameters permit the sending
4089 * of another address defense announcement for both IPv4 and IPv6.
4090 * Returns B_TRUE if rate-limiting is in effect (i.e., send is not
4091 * permitted), and B_FALSE otherwise. The `defend_rate' parameter
4092 * determines how many address defense announcements are permitted
4093 * in any `defense_perio' interval.
4096 ill_defend_rate_limit(ill_t
*ill
, ncec_t
*ncec
)
4098 clock_t now
= ddi_get_lbolt();
4099 ip_stack_t
*ipst
= ill
->ill_ipst
;
4100 clock_t start
= ill
->ill_defend_start
;
4101 uint32_t elapsed
, defend_period
, defend_rate
;
4102 nce_resched_t ncert
;
4106 if (ill
->ill_isv6
) {
4107 defend_period
= ipst
->ips_ndp_defend_period
;
4108 defend_rate
= ipst
->ips_ndp_defend_rate
;
4110 defend_period
= ipst
->ips_arp_defend_period
;
4111 defend_rate
= ipst
->ips_arp_defend_rate
;
4113 if (defend_rate
== 0)
4115 bzero(&ncert
, sizeof (ncert
));
4116 mutex_enter(&ill
->ill_lock
);
4118 elapsed
= now
- start
;
4119 if (elapsed
> SEC_TO_TICK(defend_period
)) {
4120 ill
->ill_defend_start
= now
;
4122 * nce_ill_reschedule will attempt to
4123 * prevent starvation by reschduling the
4124 * oldest entries, which are marked with
4125 * the NCE_F_DELAYED flag.
4127 nce_ill_reschedule(ill
, &ncert
);
4130 ill
->ill_defend_start
= now
;
4132 ASSERT(ill
->ill_defend_count
<= defend_rate
);
4133 mutex_enter(&ncec
->ncec_lock
);
4134 if (ncec
->ncec_flags
& NCE_F_DELAYED
) {
4136 * This ncec was rescheduled as one of the really old
4137 * entries needing on-going defense. The
4138 * ill_defend_count was already incremented in
4139 * nce_ill_reschedule. Go ahead and send the announce.
4141 ncec
->ncec_flags
&= ~NCE_F_DELAYED
;
4142 mutex_exit(&ncec
->ncec_lock
);
4146 mutex_exit(&ncec
->ncec_lock
);
4147 if (ill
->ill_defend_count
< defend_rate
)
4148 ill
->ill_defend_count
++;
4149 if (ill
->ill_defend_count
== defend_rate
) {
4151 * we are no longer allowed to send unbidden defense
4152 * messages. Wait for rescheduling.
4159 mutex_exit(&ill
->ill_lock
);
4161 * After all the locks have been dropped we can restart nce timer,
4162 * and refrele the delayed ncecs
4164 for (i
= 0; i
< ncert
.ncert_num
; i
++) {
4165 clock_t xmit_interval
;
4168 tmp
= ncert
.ncert_nces
[i
];
4169 xmit_interval
= nce_fuzz_interval(tmp
->ncec_xmit_interval
,
4171 nce_restart_timer(tmp
, xmit_interval
);
4178 ndp_announce(ncec_t
*ncec
)
4180 return (ndp_xmit(ncec
->ncec_ill
, ND_NEIGHBOR_ADVERT
, ncec
->ncec_lladdr
,
4181 ncec
->ncec_lladdr_length
, &ncec
->ncec_addr
, &ipv6_all_hosts_mcast
,
4182 nce_advert_flags(ncec
)));
4186 nce_resolve_src(ncec_t
*ncec
, in6_addr_t
*src
)
4191 ill_t
*ill
= ncec
->ncec_ill
;
4192 ill_t
*src_ill
= NULL
;
4193 ipif_t
*ipif
= NULL
;
4194 boolean_t is_myaddr
= NCE_MYADDR(ncec
);
4195 boolean_t isv6
= (ncec
->ncec_ipversion
== IPV6_VERSION
);
4197 ASSERT(src
!= NULL
);
4198 ASSERT(IN6_IS_ADDR_UNSPECIFIED(src
));
4201 src6
= ncec
->ncec_addr
;
4203 IN6_V4MAPPED_TO_IPADDR(&ncec
->ncec_addr
, src4
);
4206 * try to find one from the outgoing packet.
4208 mutex_enter(&ncec
->ncec_lock
);
4209 mp
= ncec
->ncec_qd_mp
;
4212 ip6_t
*ip6h
= (ip6_t
*)mp
->b_rptr
;
4214 src6
= ip6h
->ip6_src
;
4216 ipha_t
*ipha
= (ipha_t
*)mp
->b_rptr
;
4218 src4
= ipha
->ipha_src
;
4219 IN6_IPADDR_TO_V4MAPPED(src4
, &src6
);
4222 mutex_exit(&ncec
->ncec_lock
);
4226 * For outgoing packets, if the src of outgoing packet is one
4227 * of the assigned interface addresses use it, otherwise we
4228 * will pick the source address below.
4229 * For local addresses (is_myaddr) doing DAD, NDP announce
4230 * messages are mcast. So we use the (IPMP) cast_ill or the
4231 * (non-IPMP) ncec_ill for these message types. The only case
4232 * of unicast DAD messages are for IPv6 ND probes, for which
4233 * we find the ipif_bound_ill corresponding to the ncec_addr.
4235 if (!IN6_IS_ADDR_UNSPECIFIED(&src6
) || is_myaddr
) {
4237 ipif
= ipif_lookup_addr_nondup_v6(&src6
, ill
, ALL_ZONES
,
4240 ipif
= ipif_lookup_addr_nondup(src4
, ill
, ALL_ZONES
,
4245 * If no relevant ipif can be found, then it's not one of our
4246 * addresses. Reset to :: and try to find a src for the NS or
4247 * ARP request using ipif_select_source_v[4,6] below.
4248 * If an ipif can be found, but it's not yet done with
4249 * DAD verification, and we are not being invoked for
4250 * DAD (i.e., !is_myaddr), then just postpone this
4251 * transmission until later.
4254 src6
= ipv6_all_zeros
;
4256 } else if (!ipif
->ipif_addr_ready
&& !is_myaddr
) {
4257 DTRACE_PROBE2(nce__resolve__ipif__not__ready
,
4258 ncec_t
*, ncec
, ipif_t
*, ipif
);
4264 if (IN6_IS_ADDR_UNSPECIFIED(&src6
) && !is_myaddr
) {
4266 * Pick a source address for this solicitation, but
4267 * restrict the selection to addresses assigned to the
4268 * output interface. We do this because the destination will
4269 * create a neighbor cache entry for the source address of
4270 * this packet, so the source address had better be a valid
4274 ipif
= ipif_select_source_v6(ill
, &ncec
->ncec_addr
,
4275 B_TRUE
, IPV6_PREFER_SRC_DEFAULT
, ALL_ZONES
,
4280 IN6_V4MAPPED_TO_IPADDR(&ncec
->ncec_addr
, nce_addr
);
4281 ipif
= ipif_select_source_v4(ill
, nce_addr
, ALL_ZONES
,
4284 if (ipif
== NULL
&& IS_IPMP(ill
)) {
4285 ill_t
*send_ill
= ipmp_ill_hold_xmit_ill(ill
, B_TRUE
);
4287 if (send_ill
!= NULL
) {
4289 ipif
= ipif_select_source_v6(send_ill
,
4290 &ncec
->ncec_addr
, B_TRUE
,
4291 IPV6_PREFER_SRC_DEFAULT
, ALL_ZONES
,
4294 IN6_V4MAPPED_TO_IPADDR(&ncec
->ncec_addr
,
4296 ipif
= ipif_select_source_v4(send_ill
,
4297 src4
, ALL_ZONES
, B_TRUE
, NULL
);
4299 ill_refrele(send_ill
);
4304 char buf
[INET6_ADDRSTRLEN
];
4306 ip1dbg(("nce_resolve_src: No source ipif for dst %s\n",
4307 inet_ntop((isv6
? AF_INET6
: AF_INET
),
4308 (char *)&ncec
->ncec_addr
, buf
, sizeof (buf
))));
4309 DTRACE_PROBE1(nce__resolve__no__ipif
, ncec_t
*, ncec
);
4312 src6
= ipif
->ipif_v6lcl_addr
;
4316 src_ill
= ipif
->ipif_ill
;
4317 if (IS_IPMP(src_ill
))
4318 src_ill
= ipmp_ipif_hold_bound_ill(ipif
);
4320 ill_refhold(src_ill
);
4322 DTRACE_PROBE2(nce__resolve__src__ill
, ncec_t
*, ncec
,
4329 ip_nce_lookup_and_update(ipaddr_t
*addr
, ipif_t
*ipif
, ip_stack_t
*ipst
,
4330 uchar_t
*hwaddr
, int hwaddr_len
, int flags
)
4337 ill
= (ipif
? ipif
->ipif_ill
: NULL
);
4340 * only one ncec is possible
4342 nce
= nce_lookup_v4(ill
, addr
);
4344 ncec
= nce
->nce_common
;
4345 mutex_enter(&ncec
->ncec_lock
);
4346 if (NCE_ISREACHABLE(ncec
))
4347 new_state
= ND_UNCHANGED
;
4349 new_state
= ND_STALE
;
4350 ncec
->ncec_flags
= flags
;
4351 nce_update(ncec
, new_state
, hwaddr
);
4352 mutex_exit(&ncec
->ncec_lock
);
4358 * ill is wildcard; clean up all ncec's and ire's
4359 * that match on addr.
4363 hwm
.hwm_addr
= *addr
;
4364 hwm
.hwm_hwlen
= hwaddr_len
;
4365 hwm
.hwm_hwaddr
= hwaddr
;
4366 hwm
.hwm_flags
= flags
;
4368 ncec_walk_common(ipst
->ips_ndp4
, NULL
,
4369 nce_update_hw_changed
, &hwm
, B_TRUE
);
4374 * Common function to add ncec entries.
4375 * we always add the ncec with ncec_ill == ill, and always create
4376 * nce_t on ncec_ill. A dlpi fastpath message may be triggered if the
4377 * ncec is !reachable.
4379 * When the caller passes in an nce_state of ND_UNCHANGED,
4380 * nce_add_common() will determine the state of the created nce based
4381 * on the ill_net_type and nce_flags used. Otherwise, the nce will
4382 * be created with state set to the passed in nce_state.
4385 nce_add_common(ill_t
*ill
, uchar_t
*hw_addr
, uint_t hw_addr_len
,
4386 const in6_addr_t
*addr
, uint16_t flags
, uint16_t nce_state
, nce_t
**retnce
)
4388 static ncec_t nce_nil
;
4389 uchar_t
*template = NULL
;
4393 ip_stack_t
*ipst
= ill
->ill_ipst
;
4395 boolean_t fastprobe
= B_FALSE
;
4396 struct ndp_g_s
*ndp
;
4398 mblk_t
*dlur_mp
= NULL
;
4401 ndp
= ill
->ill_ipst
->ips_ndp6
;
4403 ndp
= ill
->ill_ipst
->ips_ndp4
;
4407 ASSERT(MUTEX_HELD(&ndp
->ndp_g_lock
));
4409 if (IN6_IS_ADDR_UNSPECIFIED(addr
)) {
4410 ip0dbg(("nce_add_common: no addr\n"));
4413 if ((flags
& ~NCE_EXTERNAL_FLAGS_MASK
)) {
4414 ip0dbg(("nce_add_common: flags = %x\n", (int)flags
));
4418 if (ill
->ill_isv6
) {
4419 ncep
= ((ncec_t
**)NCE_HASH_PTR_V6(ipst
, *addr
));
4423 IN6_V4MAPPED_TO_IPADDR(addr
, v4addr
);
4424 ncep
= ((ncec_t
**)NCE_HASH_PTR_V4(ipst
, v4addr
));
4428 * The caller has ensured that there is no nce on ill, but there could
4429 * still be an nce_common_t for the address, so that we find exisiting
4430 * ncec_t strucutures first, and atomically add a new nce_t if
4431 * one is found. The ndp_g_lock ensures that we don't cross threads
4432 * with an ncec_delete(). Unlike ncec_lookup_illgrp() we do not
4433 * compare for matches across the illgrp because this function is
4434 * called via nce_lookup_then_add_v* -> nce_add_v* -> nce_add_common,
4435 * with the nce_lookup_then_add_v* passing in the ipmp_ill where
4439 for (; ncec
!= NULL
; ncec
= ncec
->ncec_next
) {
4440 if (ncec
->ncec_ill
== ill
) {
4441 if (IN6_ARE_ADDR_EQUAL(&ncec
->ncec_addr
, addr
)) {
4443 * We should never find *retnce to be
4444 * MYADDR, since the caller may then
4445 * incorrectly restart a DAD timer that's
4446 * already running. However, if we are in
4447 * forwarding mode, and the interface is
4448 * moving in/out of groups, the data
4449 * path ire lookup (e.g., ire_revalidate_nce)
4450 * may have determined that some destination
4451 * is offlink while the control path is adding
4452 * that address as a local address.
4453 * Recover from this case by failing the
4456 if (NCE_MYADDR(ncec
))
4458 *retnce
= nce_ill_lookup_then_add(ill
, ncec
);
4459 if (*retnce
!= NULL
)
4464 if (*retnce
!= NULL
) /* caller must trigger fastpath on nce */
4467 ncec
= kmem_cache_alloc(ncec_cache
, KM_NOSLEEP
);
4471 ncec
->ncec_ill
= ill
;
4472 ncec
->ncec_ipversion
= (ill
->ill_isv6
? IPV6_VERSION
: IPV4_VERSION
);
4473 ncec
->ncec_flags
= flags
;
4474 ncec
->ncec_ipst
= ipst
; /* No netstack_hold */
4476 if (!ill
->ill_isv6
) {
4480 * DAD probe interval and probe count are set based on
4481 * fast/slow probe settings. If the underlying link doesn't
4482 * have reliably up/down notifications or if we're working
4483 * with IPv4 169.254.0.0/16 Link Local Address space, then
4484 * don't use the fast timers. Otherwise, use them.
4486 ASSERT(IN6_IS_ADDR_V4MAPPED(addr
));
4487 IN6_V4MAPPED_TO_IPADDR(addr
, addr4
);
4488 if (ill
->ill_note_link
&& !IS_IPV4_LL_SPACE(&addr4
)) {
4490 } else if (IS_IPMP(ill
) && NCE_PUBLISH(ncec
) &&
4491 !IS_IPV4_LL_SPACE(&addr4
)) {
4494 hwaddr_ill
= ipmp_illgrp_find_ill(ill
->ill_grp
, hw_addr
,
4496 if (hwaddr_ill
!= NULL
&& hwaddr_ill
->ill_note_link
)
4500 ncec
->ncec_xmit_interval
=
4501 ipst
->ips_arp_fastprobe_interval
;
4503 ipst
->ips_arp_fastprobe_count
;
4504 ncec
->ncec_flags
|= NCE_F_FAST
;
4506 ncec
->ncec_xmit_interval
=
4507 ipst
->ips_arp_probe_interval
;
4509 ipst
->ips_arp_probe_count
;
4511 if (NCE_PUBLISH(ncec
)) {
4512 ncec
->ncec_unsolicit_count
=
4513 ipst
->ips_ip_arp_publish_count
;
4517 * probe interval is constant: ILL_PROBE_INTERVAL
4518 * probe count is constant: ND_MAX_UNICAST_SOLICIT
4520 ncec
->ncec_pcnt
= ND_MAX_UNICAST_SOLICIT
;
4521 if (NCE_PUBLISH(ncec
)) {
4522 ncec
->ncec_unsolicit_count
=
4523 ipst
->ips_ip_ndp_unsolicit_count
;
4526 ncec
->ncec_rcnt
= ill
->ill_xmit_count
;
4527 ncec
->ncec_addr
= *addr
;
4528 ncec
->ncec_qd_mp
= NULL
;
4529 ncec
->ncec_refcnt
= 1; /* for ncec getting created */
4530 mutex_init(&ncec
->ncec_lock
, NULL
, MUTEX_DEFAULT
, NULL
);
4531 ncec
->ncec_trace_disable
= B_FALSE
;
4534 * ncec_lladdr holds link layer address
4536 if (hw_addr_len
> 0) {
4537 template = kmem_alloc(hw_addr_len
, KM_NOSLEEP
);
4538 if (template == NULL
) {
4542 ncec
->ncec_lladdr
= template;
4543 ncec
->ncec_lladdr_length
= hw_addr_len
;
4544 bzero(ncec
->ncec_lladdr
, hw_addr_len
);
4546 if ((flags
& NCE_F_BCAST
) != 0) {
4547 state
= ND_REACHABLE
;
4548 ASSERT(hw_addr_len
> 0);
4549 } else if (ill
->ill_net_type
== IRE_IF_RESOLVER
) {
4551 } else if (ill
->ill_net_type
== IRE_IF_NORESOLVER
) {
4553 * NORESOLVER entries are always created in the REACHABLE
4556 state
= ND_REACHABLE
;
4557 if (ill
->ill_phys_addr_length
== IP_ADDR_LEN
&&
4558 ill
->ill_mactype
!= DL_IPV4
&&
4559 ill
->ill_mactype
!= DL_6TO4
) {
4561 * We create a nce_res_mp with the IP nexthop address
4562 * as the destination address if the physical length
4563 * is exactly 4 bytes for point-to-multipoint links
4564 * that do their own resolution from IP to link-layer
4565 * address (e.g. IP over X.25).
4567 bcopy((uchar_t
*)addr
,
4568 ncec
->ncec_lladdr
, ill
->ill_phys_addr_length
);
4570 if (ill
->ill_phys_addr_length
== IPV6_ADDR_LEN
&&
4571 ill
->ill_mactype
!= DL_IPV6
) {
4573 * We create a nce_res_mp with the IP nexthop address
4574 * as the destination address if the physical legnth
4575 * is exactly 16 bytes for point-to-multipoint links
4576 * that do their own resolution from IP to link-layer
4579 bcopy((uchar_t
*)addr
,
4580 ncec
->ncec_lladdr
, ill
->ill_phys_addr_length
);
4583 * Since NUD is not part of the base IPv4 protocol definition,
4584 * IPv4 neighbor entries on NORESOLVER interfaces will never
4585 * age, and are marked NCE_F_NONUD.
4588 ncec
->ncec_flags
|= NCE_F_NONUD
;
4589 } else if (ill
->ill_net_type
== IRE_LOOPBACK
) {
4590 state
= ND_REACHABLE
;
4593 if (hw_addr
!= NULL
|| ill
->ill_net_type
== IRE_IF_NORESOLVER
) {
4595 * We are adding an ncec with a deterministic hw_addr,
4596 * so the state can only be one of {REACHABLE, STALE, PROBE}.
4598 * if we are adding a unicast ncec for the local address
4599 * it would be REACHABLE; we would be adding a ND_STALE entry
4600 * for the requestor of an ARP_REQUEST/ND_SOLICIT. Our own
4601 * addresses are added in PROBE to trigger DAD.
4603 if ((flags
& (NCE_F_MCAST
|NCE_F_BCAST
)) ||
4604 ill
->ill_net_type
== IRE_IF_NORESOLVER
)
4605 state
= ND_REACHABLE
;
4606 else if (!NCE_PUBLISH(ncec
))
4610 if (hw_addr
!= NULL
)
4611 nce_set_ll(ncec
, hw_addr
);
4613 /* caller overrides internally computed state */
4614 if (nce_state
!= ND_UNCHANGED
)
4617 if (state
== ND_PROBE
)
4618 ncec
->ncec_flags
|= NCE_F_UNVERIFIED
;
4620 ncec
->ncec_state
= state
;
4622 if (state
== ND_REACHABLE
) {
4623 ncec
->ncec_last
= ncec
->ncec_init_time
=
4624 TICK_TO_MSEC(ddi_get_lbolt64());
4626 ncec
->ncec_last
= 0;
4627 if (state
== ND_INITIAL
)
4628 ncec
->ncec_init_time
= TICK_TO_MSEC(ddi_get_lbolt64());
4630 list_create(&ncec
->ncec_cb
, sizeof (ncec_cb_t
),
4631 offsetof(ncec_cb_t
, ncec_cb_node
));
4633 * have all the memory allocations out of the way before taking locks
4634 * and adding the nce.
4636 nce
= kmem_cache_alloc(nce_cache
, KM_NOSLEEP
);
4641 if (ncec
->ncec_lladdr
!= NULL
||
4642 ill
->ill_net_type
== IRE_IF_NORESOLVER
) {
4643 dlur_mp
= ill_dlur_gen(ncec
->ncec_lladdr
,
4644 ill
->ill_phys_addr_length
, ill
->ill_sap
,
4645 ill
->ill_sap_length
);
4646 if (dlur_mp
== NULL
) {
4653 * Atomically ensure that the ill is not CONDEMNED, before
4656 mutex_enter(&ill
->ill_lock
);
4657 if (ill
->ill_state_flags
& ILL_CONDEMNED
) {
4658 mutex_exit(&ill
->ill_lock
);
4662 if (!NCE_MYADDR(ncec
) &&
4663 (ill
->ill_state_flags
& ILL_DOWN_IN_PROGRESS
)) {
4664 mutex_exit(&ill
->ill_lock
);
4665 DTRACE_PROBE1(nce__add__on__down__ill
, ncec_t
*, ncec
);
4670 * Acquire the ncec_lock even before adding the ncec to the list
4671 * so that it cannot get deleted after the ncec is added, but
4672 * before we add the nce.
4674 mutex_enter(&ncec
->ncec_lock
);
4675 if ((ncec
->ncec_next
= *ncep
) != NULL
)
4676 ncec
->ncec_next
->ncec_ptpn
= &ncec
->ncec_next
;
4678 ncec
->ncec_ptpn
= ncep
;
4680 /* Bump up the number of ncec's referencing this ill */
4681 DTRACE_PROBE3(ill__incr__cnt
, (ill_t
*), ill
,
4682 (char *), "ncec", (void *), ncec
);
4683 ill
->ill_ncec_cnt
++;
4685 * Since we hold the ncec_lock at this time, the ncec cannot be
4686 * condemned, and we can safely add the nce.
4688 *retnce
= nce_add_impl(ill
, ncec
, nce
, dlur_mp
);
4689 mutex_exit(&ncec
->ncec_lock
);
4690 mutex_exit(&ill
->ill_lock
);
4692 /* caller must trigger fastpath on *retnce */
4697 kmem_cache_free(ncec_cache
, ncec
);
4699 kmem_cache_free(nce_cache
, nce
);
4701 if (template != NULL
)
4702 kmem_free(template, ill
->ill_phys_addr_length
);
4707 * take a ref on the nce
4710 nce_refhold(nce_t
*nce
)
4712 mutex_enter(&nce
->nce_lock
);
4714 ASSERT((nce
)->nce_refcnt
!= 0);
4715 mutex_exit(&nce
->nce_lock
);
4719 * release a ref on the nce; In general, this
4720 * cannot be called with locks held because nce_inactive
4721 * may result in nce_inactive which will take the ill_lock,
4722 * do ipif_ill_refrele_tail etc. Thus the one exception
4723 * where this can be called with locks held is when the caller
4724 * is certain that the nce_refcnt is sufficient to prevent
4725 * the invocation of nce_inactive.
4728 nce_refrele(nce_t
*nce
)
4730 ASSERT((nce
)->nce_refcnt
!= 0);
4731 mutex_enter(&nce
->nce_lock
);
4732 if (--nce
->nce_refcnt
== 0)
4733 nce_inactive(nce
); /* destroys the mutex */
4735 mutex_exit(&nce
->nce_lock
);
4739 * free the nce after all refs have gone away.
4742 nce_inactive(nce_t
*nce
)
4744 ill_t
*ill
= nce
->nce_ill
;
4746 ASSERT(nce
->nce_refcnt
== 0);
4748 ncec_refrele_notr(nce
->nce_common
);
4749 nce
->nce_common
= NULL
;
4750 freemsg(nce
->nce_fp_mp
);
4751 freemsg(nce
->nce_dlur_mp
);
4753 mutex_enter(&ill
->ill_lock
);
4754 DTRACE_PROBE3(ill__decr__cnt
, (ill_t
*), ill
,
4755 (char *), "nce", (void *), nce
);
4757 nce
->nce_ill
= NULL
;
4759 * If the number of ncec's associated with this ill have dropped
4760 * to zero, check whether we need to restart any operation that
4761 * is waiting for this to happen.
4763 if (ILL_DOWN_OK(ill
)) {
4764 /* ipif_ill_refrele_tail drops the ill_lock */
4765 ipif_ill_refrele_tail(ill
);
4767 mutex_exit(&ill
->ill_lock
);
4770 mutex_destroy(&nce
->nce_lock
);
4771 kmem_cache_free(nce_cache
, nce
);
4775 * Add an nce to the ill_nce list.
4778 nce_add_impl(ill_t
*ill
, ncec_t
*ncec
, nce_t
*nce
, mblk_t
*dlur_mp
)
4780 bzero(nce
, sizeof (*nce
));
4781 mutex_init(&nce
->nce_lock
, NULL
, MUTEX_DEFAULT
, NULL
);
4782 nce
->nce_common
= ncec
;
4783 nce
->nce_addr
= ncec
->ncec_addr
;
4785 DTRACE_PROBE3(ill__incr__cnt
, (ill_t
*), ill
,
4786 (char *), "nce", (void *), nce
);
4789 nce
->nce_refcnt
= 1; /* for the thread */
4790 ncec
->ncec_refcnt
++; /* want ncec_refhold_locked_notr(ncec) */
4791 nce
->nce_dlur_mp
= dlur_mp
;
4793 /* add nce to the ill's fastpath list. */
4794 nce
->nce_refcnt
++; /* for the list */
4795 list_insert_head(&ill
->ill_nce
, nce
);
4800 nce_add(ill_t
*ill
, ncec_t
*ncec
)
4803 mblk_t
*dlur_mp
= NULL
;
4805 ASSERT(MUTEX_HELD(&ill
->ill_lock
));
4806 ASSERT(MUTEX_HELD(&ncec
->ncec_lock
));
4808 nce
= kmem_cache_alloc(nce_cache
, KM_NOSLEEP
);
4811 if (ncec
->ncec_lladdr
!= NULL
||
4812 ill
->ill_net_type
== IRE_IF_NORESOLVER
) {
4813 dlur_mp
= ill_dlur_gen(ncec
->ncec_lladdr
,
4814 ill
->ill_phys_addr_length
, ill
->ill_sap
,
4815 ill
->ill_sap_length
);
4816 if (dlur_mp
== NULL
) {
4817 kmem_cache_free(nce_cache
, nce
);
4821 return (nce_add_impl(ill
, ncec
, nce
, dlur_mp
));
4825 * remove the nce from the ill_faspath list
4828 nce_delete(nce_t
*nce
)
4830 ill_t
*ill
= nce
->nce_ill
;
4832 ASSERT(MUTEX_HELD(&ill
->ill_lock
));
4834 mutex_enter(&nce
->nce_lock
);
4835 if (nce
->nce_is_condemned
) {
4837 * some other thread has removed this nce from the ill_nce list
4839 mutex_exit(&nce
->nce_lock
);
4842 nce
->nce_is_condemned
= B_TRUE
;
4843 mutex_exit(&nce
->nce_lock
);
4845 list_remove(&ill
->ill_nce
, nce
);
4847 * even though we are holding the ill_lock, it is ok to
4848 * call nce_refrele here because we know that we should have
4849 * at least 2 refs on the nce: one for the thread, and one
4850 * for the list. The refrele below will release the one for
4857 nce_lookup(ill_t
*ill
, const in6_addr_t
*addr
)
4861 ASSERT(ill
!= NULL
);
4862 ASSERT(MUTEX_HELD(&ill
->ill_lock
));
4864 for (nce
= list_head(&ill
->ill_nce
); nce
!= NULL
;
4865 nce
= list_next(&ill
->ill_nce
, nce
)) {
4866 if (IN6_ARE_ADDR_EQUAL(&nce
->nce_addr
, addr
))
4871 * if we found the nce on the ill_nce list while holding
4872 * the ill_lock, then it cannot be condemned yet.
4875 ASSERT(!nce
->nce_is_condemned
);
4882 * Walk the ill_nce list on ill. The callback function func() cannot perform
4883 * any destructive actions.
4886 nce_walk_common(ill_t
*ill
, pfi_t func
, void *arg
)
4888 nce_t
*nce
= NULL
, *nce_next
;
4890 ASSERT(MUTEX_HELD(&ill
->ill_lock
));
4891 for (nce
= list_head(&ill
->ill_nce
); nce
!= NULL
; ) {
4892 nce_next
= list_next(&ill
->ill_nce
, nce
);
4893 if (func(ill
, nce
, arg
) != 0)
4900 nce_walk(ill_t
*ill
, pfi_t func
, void *arg
)
4902 mutex_enter(&ill
->ill_lock
);
4903 nce_walk_common(ill
, func
, arg
);
4904 mutex_exit(&ill
->ill_lock
);
4908 nce_flush(ill_t
*ill
, boolean_t flushall
)
4910 nce_t
*nce
, *nce_next
;
4913 list_create(&dead
, sizeof (nce_t
), offsetof(nce_t
, nce_node
));
4914 mutex_enter(&ill
->ill_lock
);
4915 for (nce
= list_head(&ill
->ill_nce
); nce
!= NULL
; ) {
4916 nce_next
= list_next(&ill
->ill_nce
, nce
);
4917 if (!flushall
&& NCE_PUBLISH(nce
->nce_common
)) {
4922 * nce_delete requires that the caller should either not
4923 * be holding locks, or should hold a ref to ensure that
4924 * we wont hit ncec_inactive. So take a ref and clean up
4925 * after the list is flushed.
4929 list_insert_tail(&dead
, nce
);
4932 mutex_exit(&ill
->ill_lock
);
4933 while ((nce
= list_head(&dead
)) != NULL
) {
4934 list_remove(&dead
, nce
);
4937 ASSERT(list_is_empty(&dead
));
4938 list_destroy(&dead
);
4941 /* Return an interval that is anywhere in the [1 .. intv] range */
4943 nce_fuzz_interval(clock_t intv
, boolean_t initial_time
)
4947 (void) random_get_pseudo_bytes((uint8_t *)&rnd
, sizeof (rnd
));
4948 /* Note that clock_t is signed; must chop off bits */
4949 rnd
&= (1ul << (NBBY
* sizeof (rnd
) - 1)) - 1;
4954 intv
= (rnd
% intv
) + 1;
4956 /* Compute 'frac' as 20% of the configured interval */
4957 if ((frac
= intv
/ 5) <= 1)
4959 /* Set intv randomly in the range [intv-frac .. intv+frac] */
4960 if ((intv
= intv
- frac
+ rnd
% (2 * frac
+ 1)) <= 0)
4967 nce_resolv_ipmp_ok(ncec_t
*ncec
)
4971 iaflags_t ixaflags
= IXAF_NO_TRACE
;
4973 ill_t
*ill
= ncec
->ncec_ill
;
4974 boolean_t isv6
= (ncec
->ncec_ipversion
== IPV6_VERSION
);
4975 ipif_t
*src_ipif
= NULL
;
4976 ip_stack_t
*ipst
= ill
->ill_ipst
;
4980 ASSERT(IS_IPMP(ill
));
4982 mutex_enter(&ncec
->ncec_lock
);
4983 nprobes
= ncec
->ncec_nprobes
;
4984 mp
= ncec
->ncec_qd_mp
;
4985 ncec
->ncec_qd_mp
= NULL
;
4986 ncec
->ncec_nprobes
= 0;
4987 mutex_exit(&ncec
->ncec_lock
);
4989 while (mp
!= NULL
) {
4992 nxt_mp
= mp
->b_next
;
4995 ip6_t
*ip6h
= (ip6_t
*)mp
->b_rptr
;
4997 pkt_len
= ntohs(ip6h
->ip6_plen
) + IPV6_HDR_LEN
;
4998 src_ipif
= ipif_lookup_addr_nondup_v6(&ip6h
->ip6_src
,
4999 ill
, ALL_ZONES
, ipst
);
5001 ipha_t
*ipha
= (ipha_t
*)mp
->b_rptr
;
5003 ixaflags
|= IXAF_IS_IPV4
;
5004 pkt_len
= ntohs(ipha
->ipha_length
);
5005 src_ipif
= ipif_lookup_addr_nondup(ipha
->ipha_src
,
5006 ill
, ALL_ZONES
, ipst
);
5010 * find a new nce based on an under_ill. The first IPMP probe
5011 * packet gets queued, so we could still find a src_ipif that
5012 * matches an IPMP test address.
5014 if (src_ipif
== NULL
|| IS_IPMP(src_ipif
->ipif_ill
)) {
5016 * if src_ipif is null, this could be either a
5017 * forwarded packet or a probe whose src got deleted.
5018 * We identify the former case by looking for the
5019 * ncec_nprobes: the first ncec_nprobes packets are
5022 if (src_ipif
== NULL
&& nprobes
> 0)
5026 * For forwarded packets, we use the ipmp rotor
5029 send_ill
= ipmp_ill_hold_xmit_ill(ncec
->ncec_ill
,
5032 send_ill
= src_ipif
->ipif_ill
;
5033 ill_refhold(send_ill
);
5036 DTRACE_PROBE4(nce__resolve__ipmp
, (mblk_t
*), mp
,
5037 (ncec_t
*), ncec
, (ipif_t
*),
5038 src_ipif
, (ill_t
*), send_ill
);
5040 if (send_ill
== NULL
) {
5041 if (src_ipif
!= NULL
)
5042 ipif_refrele(src_ipif
);
5045 /* create an under_nce on send_ill */
5046 rw_enter(&ipst
->ips_ill_g_lock
, RW_READER
);
5047 if (IS_IN_SAME_ILLGRP(send_ill
, ncec
->ncec_ill
))
5048 under_nce
= nce_fastpath_create(send_ill
, ncec
);
5051 rw_exit(&ipst
->ips_ill_g_lock
);
5052 if (under_nce
!= NULL
&& NCE_ISREACHABLE(ncec
))
5053 nce_fastpath_trigger(under_nce
);
5055 ill_refrele(send_ill
);
5056 if (src_ipif
!= NULL
)
5057 ipif_refrele(src_ipif
);
5059 if (under_nce
!= NULL
) {
5060 (void) ip_xmit(mp
, under_nce
, ixaflags
, pkt_len
, 0,
5061 ALL_ZONES
, 0, NULL
);
5062 nce_refrele(under_nce
);
5070 BUMP_MIB(&ipst
->ips_ip6_mib
, ipIfStatsOutDiscards
);
5072 BUMP_MIB(&ipst
->ips_ip_mib
, ipIfStatsOutDiscards
);
5074 ip_drop_output("ipIfStatsOutDiscards - no under_ill", mp
, NULL
);
5080 ncec_cb_dispatch(ncec
); /* complete callbacks */