1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 1990 Mentat Inc. 27 */ 28 29 /* 30 * This file contains the interface control functions for IPv6. 31 */ 32 33 #include <sys/types.h> 34 #include <sys/sysmacros.h> 35 #include <sys/stream.h> 36 #include <sys/dlpi.h> 37 #include <sys/stropts.h> 38 #include <sys/ddi.h> 39 #include <sys/cmn_err.h> 40 #include <sys/kstat.h> 41 #include <sys/debug.h> 42 #include <sys/zone.h> 43 #include <sys/policy.h> 44 45 #include <sys/systm.h> 46 #include <sys/param.h> 47 #include <sys/socket.h> 48 #include <sys/isa_defs.h> 49 #include <net/if.h> 50 #include <net/if_dl.h> 51 #include <net/route.h> 52 #include <netinet/in.h> 53 #include <netinet/igmp_var.h> 54 #include <netinet/ip6.h> 55 #include <netinet/icmp6.h> 56 57 #include <inet/common.h> 58 #include <inet/nd.h> 59 #include <inet/mib2.h> 60 #include <inet/ip.h> 61 #include <inet/ip6.h> 62 #include <inet/ip_multi.h> 63 #include <inet/ip_ire.h> 64 #include <inet/ip_rts.h> 65 #include <inet/ip_ndp.h> 66 #include <inet/ip_if.h> 67 #include <inet/ip6_asp.h> 68 #include <inet/tun.h> 69 #include <inet/ipclassifier.h> 70 #include <inet/sctp_ip.h> 71 72 #include <sys/tsol/tndb.h> 73 #include <sys/tsol/tnet.h> 74 75 static in6_addr_t ipv6_ll_template = 76 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 77 78 static ipif_t * 79 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 80 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst); 81 82 /* 83 * These two functions, ipif_lookup_group_v6() and ill_lookup_group_v6(), 84 * are called when an application does not specify an interface to be 85 * used for multicast traffic. It calls ire_lookup_multi_v6() to look 86 * for an interface route for the specified multicast group. Doing 87 * this allows the administrator to add prefix routes for multicast to 88 * indicate which interface to be used for multicast traffic in the above 89 * scenario. The route could be for all multicast (ff00::/8), for a single 90 * multicast group (a /128 route) or anything in between. If there is no 91 * such multicast route, we just find any multicast capable interface and 92 * return it. 93 */ 94 ipif_t * 95 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst) 96 { 97 ire_t *ire; 98 ipif_t *ipif; 99 100 ire = ire_lookup_multi_v6(group, zoneid, ipst); 101 if (ire != NULL) { 102 ipif = ire->ire_ipif; 103 ipif_refhold(ipif); 104 ire_refrele(ire); 105 return (ipif); 106 } 107 108 return (ipif_lookup_multicast(ipst, zoneid, B_TRUE)); 109 } 110 111 ill_t * 112 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst) 113 { 114 ire_t *ire; 115 ill_t *ill; 116 ipif_t *ipif; 117 118 ire = ire_lookup_multi_v6(group, zoneid, ipst); 119 if (ire != NULL) { 120 ill = ire->ire_ipif->ipif_ill; 121 ill_refhold(ill); 122 ire_refrele(ire); 123 return (ill); 124 } 125 126 ipif = ipif_lookup_multicast(ipst, zoneid, B_TRUE); 127 if (ipif == NULL) 128 return (NULL); 129 130 ill = ipif->ipif_ill; 131 ill_refhold(ill); 132 ipif_refrele(ipif); 133 return (ill); 134 } 135 136 /* 137 * Look for an ipif with the specified interface address and destination. 138 * The destination address is used only for matching point-to-point interfaces. 139 */ 140 static ipif_t * 141 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 142 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst) 143 { 144 ipif_t *ipif; 145 ill_t *ill; 146 ipsq_t *ipsq; 147 ill_walk_context_t ctx; 148 149 if (error != NULL) 150 *error = 0; 151 152 /* 153 * First match all the point-to-point interfaces 154 * before looking at non-point-to-point interfaces. 155 * This is done to avoid returning non-point-to-point 156 * ipif instead of unnumbered point-to-point ipif. 157 */ 158 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 159 ill = ILL_START_WALK_V6(&ctx, ipst); 160 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 161 GRAB_CONN_LOCK(q); 162 mutex_enter(&ill->ill_lock); 163 for (ipif = ill->ill_ipif; ipif != NULL; 164 ipif = ipif->ipif_next) { 165 /* Allow the ipif to be down */ 166 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 167 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 168 if_addr)) && 169 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 170 dst))) { 171 if (IPIF_CAN_LOOKUP(ipif)) { 172 ipif_refhold_locked(ipif); 173 mutex_exit(&ill->ill_lock); 174 RELEASE_CONN_LOCK(q); 175 rw_exit(&ipst->ips_ill_g_lock); 176 return (ipif); 177 } else if (IPIF_CAN_WAIT(ipif, q)) { 178 ipsq = ill->ill_phyint->phyint_ipsq; 179 mutex_enter(&ipsq->ipsq_lock); 180 mutex_enter(&ipsq->ipsq_xop->ipx_lock); 181 mutex_exit(&ill->ill_lock); 182 rw_exit(&ipst->ips_ill_g_lock); 183 ipsq_enq(ipsq, q, mp, func, NEW_OP, 184 ill); 185 mutex_exit(&ipsq->ipsq_xop->ipx_lock); 186 mutex_exit(&ipsq->ipsq_lock); 187 RELEASE_CONN_LOCK(q); 188 if (error != NULL) 189 *error = EINPROGRESS; 190 return (NULL); 191 } 192 } 193 } 194 mutex_exit(&ill->ill_lock); 195 RELEASE_CONN_LOCK(q); 196 } 197 rw_exit(&ipst->ips_ill_g_lock); 198 /* lookup the ipif based on interface address */ 199 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func, 200 error, ipst); 201 ASSERT(ipif == NULL || ipif->ipif_isv6); 202 return (ipif); 203 } 204 205 /* 206 * Common function for ipif_lookup_addr_v6() and ipif_lookup_addr_exact_v6(). 207 */ 208 static ipif_t * 209 ipif_lookup_addr_common_v6(const in6_addr_t *addr, ill_t *match_ill, 210 boolean_t match_illgrp, zoneid_t zoneid, queue_t *q, mblk_t *mp, 211 ipsq_func_t func, int *error, ip_stack_t *ipst) 212 { 213 ipif_t *ipif; 214 ill_t *ill; 215 boolean_t ptp = B_FALSE; 216 ipsq_t *ipsq; 217 ill_walk_context_t ctx; 218 219 if (error != NULL) 220 *error = 0; 221 222 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 223 /* 224 * Repeat twice, first based on local addresses and 225 * next time for pointopoint. 226 */ 227 repeat: 228 ill = ILL_START_WALK_V6(&ctx, ipst); 229 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 230 if (match_ill != NULL && ill != match_ill && 231 (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) { 232 continue; 233 } 234 GRAB_CONN_LOCK(q); 235 mutex_enter(&ill->ill_lock); 236 for (ipif = ill->ill_ipif; ipif != NULL; 237 ipif = ipif->ipif_next) { 238 if (zoneid != ALL_ZONES && 239 ipif->ipif_zoneid != zoneid && 240 ipif->ipif_zoneid != ALL_ZONES) 241 continue; 242 /* Allow the ipif to be down */ 243 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 244 &ipif->ipif_v6lcl_addr, addr) && 245 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 246 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 247 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 248 addr))) { 249 if (IPIF_CAN_LOOKUP(ipif)) { 250 ipif_refhold_locked(ipif); 251 mutex_exit(&ill->ill_lock); 252 RELEASE_CONN_LOCK(q); 253 rw_exit(&ipst->ips_ill_g_lock); 254 return (ipif); 255 } else if (IPIF_CAN_WAIT(ipif, q)) { 256 ipsq = ill->ill_phyint->phyint_ipsq; 257 mutex_enter(&ipsq->ipsq_lock); 258 mutex_enter(&ipsq->ipsq_xop->ipx_lock); 259 mutex_exit(&ill->ill_lock); 260 rw_exit(&ipst->ips_ill_g_lock); 261 ipsq_enq(ipsq, q, mp, func, NEW_OP, 262 ill); 263 mutex_exit(&ipsq->ipsq_xop->ipx_lock); 264 mutex_exit(&ipsq->ipsq_lock); 265 RELEASE_CONN_LOCK(q); 266 if (error != NULL) 267 *error = EINPROGRESS; 268 return (NULL); 269 } 270 } 271 } 272 mutex_exit(&ill->ill_lock); 273 RELEASE_CONN_LOCK(q); 274 } 275 276 /* If we already did the ptp case, then we are done */ 277 if (ptp) { 278 rw_exit(&ipst->ips_ill_g_lock); 279 if (error != NULL) 280 *error = ENXIO; 281 return (NULL); 282 } 283 ptp = B_TRUE; 284 goto repeat; 285 } 286 287 boolean_t 288 ip_addr_exists_v6(const in6_addr_t *addr, zoneid_t zoneid, 289 ip_stack_t *ipst) 290 { 291 ipif_t *ipif; 292 ill_t *ill; 293 ill_walk_context_t ctx; 294 295 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 296 297 ill = ILL_START_WALK_V6(&ctx, ipst); 298 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 299 mutex_enter(&ill->ill_lock); 300 for (ipif = ill->ill_ipif; ipif != NULL; 301 ipif = ipif->ipif_next) { 302 if (zoneid != ALL_ZONES && 303 ipif->ipif_zoneid != zoneid && 304 ipif->ipif_zoneid != ALL_ZONES) 305 continue; 306 /* Allow the ipif to be down */ 307 if (((IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 308 addr) && 309 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 310 ((ipif->ipif_flags & IPIF_POINTOPOINT) && 311 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 312 addr))) { 313 mutex_exit(&ill->ill_lock); 314 rw_exit(&ipst->ips_ill_g_lock); 315 return (B_TRUE); 316 } 317 } 318 mutex_exit(&ill->ill_lock); 319 } 320 321 rw_exit(&ipst->ips_ill_g_lock); 322 return (B_FALSE); 323 } 324 325 /* 326 * Lookup an ipif with the specified address. For point-to-point links we 327 * look for matches on either the destination address or the local address, 328 * but we skip the local address check if IPIF_UNNUMBERED is set. If the 329 * `match_ill' argument is non-NULL, the lookup is restricted to that ill 330 * (or illgrp if `match_ill' is in an IPMP group). 331 */ 332 ipif_t * 333 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 334 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst) 335 { 336 return (ipif_lookup_addr_common_v6(addr, match_ill, B_TRUE, zoneid, q, 337 mp, func, error, ipst)); 338 } 339 340 /* 341 * Special abbreviated version of ipif_lookup_addr_v6() that doesn't match 342 * `match_ill' across the IPMP group. This function is only needed in some 343 * corner-cases; almost everything should use ipif_lookup_addr_v6(). 344 */ 345 ipif_t * 346 ipif_lookup_addr_exact_v6(const in6_addr_t *addr, ill_t *match_ill, 347 ip_stack_t *ipst) 348 { 349 ASSERT(match_ill != NULL); 350 return (ipif_lookup_addr_common_v6(addr, match_ill, B_FALSE, ALL_ZONES, 351 NULL, NULL, NULL, NULL, ipst)); 352 } 353 354 /* 355 * Look for an ipif with the specified address. For point-point links 356 * we look for matches on either the destination address and the local 357 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 358 * is set. 359 * If the `match_ill' argument is non-NULL, the lookup is restricted to that 360 * ill (or illgrp if `match_ill' is in an IPMP group). 361 * Return the zoneid for the ipif. ALL_ZONES if none found. 362 */ 363 zoneid_t 364 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill, 365 ip_stack_t *ipst) 366 { 367 ipif_t *ipif; 368 ill_t *ill; 369 boolean_t ptp = B_FALSE; 370 ill_walk_context_t ctx; 371 zoneid_t zoneid; 372 373 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 374 /* 375 * Repeat twice, first based on local addresses and 376 * next time for pointopoint. 377 */ 378 repeat: 379 ill = ILL_START_WALK_V6(&ctx, ipst); 380 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 381 if (match_ill != NULL && ill != match_ill && 382 !IS_IN_SAME_ILLGRP(ill, match_ill)) { 383 continue; 384 } 385 mutex_enter(&ill->ill_lock); 386 for (ipif = ill->ill_ipif; ipif != NULL; 387 ipif = ipif->ipif_next) { 388 /* Allow the ipif to be down */ 389 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 390 &ipif->ipif_v6lcl_addr, addr) && 391 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 392 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 393 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 394 addr)) && 395 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) { 396 zoneid = ipif->ipif_zoneid; 397 mutex_exit(&ill->ill_lock); 398 rw_exit(&ipst->ips_ill_g_lock); 399 /* 400 * If ipif_zoneid was ALL_ZONES then we have 401 * a trusted extensions shared IP address. 402 * In that case GLOBAL_ZONEID works to send. 403 */ 404 if (zoneid == ALL_ZONES) 405 zoneid = GLOBAL_ZONEID; 406 return (zoneid); 407 } 408 } 409 mutex_exit(&ill->ill_lock); 410 } 411 412 /* If we already did the ptp case, then we are done */ 413 if (ptp) { 414 rw_exit(&ipst->ips_ill_g_lock); 415 return (ALL_ZONES); 416 } 417 ptp = B_TRUE; 418 goto repeat; 419 } 420 421 /* 422 * Perform various checks to verify that an address would make sense as a local 423 * interface address. This is currently only called when an attempt is made 424 * to set a local address. 425 * 426 * Does not allow a v4-mapped address, an address that equals the subnet 427 * anycast address, ... a multicast address, ... 428 */ 429 boolean_t 430 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 431 { 432 in6_addr_t subnet; 433 434 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 435 return (B_TRUE); /* Allow all zeros */ 436 437 /* 438 * Don't allow all zeroes or host part, but allow 439 * all ones netmask. 440 */ 441 V6_MASK_COPY(*addr, *subnet_mask, subnet); 442 if (IN6_IS_ADDR_V4MAPPED(addr) || 443 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 444 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 445 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 446 IN6_IS_ADDR_MULTICAST(addr)) 447 return (B_FALSE); 448 449 return (B_TRUE); 450 } 451 452 /* 453 * Perform various checks to verify that an address would make sense as a 454 * remote/subnet interface address. 455 */ 456 boolean_t 457 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 458 { 459 in6_addr_t subnet; 460 461 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 462 return (B_TRUE); /* Allow all zeros */ 463 464 V6_MASK_COPY(*addr, *subnet_mask, subnet); 465 if (IN6_IS_ADDR_V4MAPPED(addr) || 466 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 467 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 468 IN6_IS_ADDR_MULTICAST(addr) || 469 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 470 return (B_FALSE); 471 472 return (B_TRUE); 473 } 474 475 /* 476 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 477 * ipif_arg is passed in to associate it with the correct interface 478 * (for link-local destinations and gateways). 479 */ 480 /* ARGSUSED1 */ 481 int 482 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 483 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 484 ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func, 485 struct rtsa_s *sp, ip_stack_t *ipst) 486 { 487 ire_t *ire; 488 ire_t *gw_ire = NULL; 489 ipif_t *ipif; 490 boolean_t ipif_refheld = B_FALSE; 491 uint_t type; 492 int match_flags = MATCH_IRE_TYPE; 493 int error; 494 tsol_gc_t *gc = NULL; 495 tsol_gcgrp_t *gcgrp = NULL; 496 boolean_t gcgrp_xtraref = B_FALSE; 497 498 if (ire_arg != NULL) 499 *ire_arg = NULL; 500 501 /* 502 * Prevent routes with a zero gateway from being created (since 503 * interfaces can currently be plumbed and brought up with no assigned 504 * address). 505 */ 506 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 507 return (ENETUNREACH); 508 509 /* 510 * If this is the case of RTF_HOST being set, then we set the netmask 511 * to all ones (regardless if one was supplied). 512 */ 513 if (flags & RTF_HOST) 514 mask = &ipv6_all_ones; 515 516 /* 517 * Get the ipif, if any, corresponding to the gw_addr 518 */ 519 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, 520 &error, ipst); 521 if (ipif != NULL) 522 ipif_refheld = B_TRUE; 523 else if (error == EINPROGRESS) { 524 ip1dbg(("ip_rt_add_v6: null and EINPROGRESS")); 525 return (error); 526 } 527 528 /* 529 * GateD will attempt to create routes with a loopback interface 530 * address as the gateway and with RTF_GATEWAY set. We allow 531 * these routes to be added, but create them as interface routes 532 * since the gateway is an interface address. 533 */ 534 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) { 535 flags &= ~RTF_GATEWAY; 536 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) && 537 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) && 538 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) { 539 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 540 ipif, ALL_ZONES, NULL, match_flags, ipst); 541 if (ire != NULL) { 542 ire_refrele(ire); 543 if (ipif_refheld) 544 ipif_refrele(ipif); 545 return (EEXIST); 546 } 547 ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x" 548 "for 0x%x\n", (void *)ipif, 549 ipif->ipif_ire_type, 550 ntohl(ipif->ipif_lcl_addr))); 551 ire = ire_create_v6( 552 dst_addr, 553 mask, 554 &ipif->ipif_v6src_addr, 555 NULL, 556 &ipif->ipif_mtu, 557 NULL, 558 NULL, 559 NULL, 560 ipif->ipif_net_type, 561 ipif, 562 NULL, 563 0, 564 0, 565 flags, 566 &ire_uinfo_null, 567 NULL, 568 NULL, 569 ipst); 570 if (ire == NULL) { 571 if (ipif_refheld) 572 ipif_refrele(ipif); 573 return (ENOMEM); 574 } 575 error = ire_add(&ire, q, mp, func, B_FALSE); 576 if (error == 0) 577 goto save_ire; 578 /* 579 * In the result of failure, ire_add() will have already 580 * deleted the ire in question, so there is no need to 581 * do that here. 582 */ 583 if (ipif_refheld) 584 ipif_refrele(ipif); 585 return (error); 586 } 587 } 588 589 /* 590 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 591 * and the gateway address provided is one of the system's interface 592 * addresses. By using the routing socket interface and supplying an 593 * RTA_IFP sockaddr with an interface index, an alternate method of 594 * specifying an interface route to be created is available which uses 595 * the interface index that specifies the outgoing interface rather than 596 * the address of an outgoing interface (which may not be able to 597 * uniquely identify an interface). When coupled with the RTF_GATEWAY 598 * flag, routes can be specified which not only specify the next-hop to 599 * be used when routing to a certain prefix, but also which outgoing 600 * interface should be used. 601 * 602 * Previously, interfaces would have unique addresses assigned to them 603 * and so the address assigned to a particular interface could be used 604 * to identify a particular interface. One exception to this was the 605 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 606 * 607 * With the advent of IPv6 and its link-local addresses, this 608 * restriction was relaxed and interfaces could share addresses between 609 * themselves. In fact, typically all of the link-local interfaces on 610 * an IPv6 node or router will have the same link-local address. In 611 * order to differentiate between these interfaces, the use of an 612 * interface index is necessary and this index can be carried inside a 613 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 614 * of using the interface index, however, is that all of the ipif's that 615 * are part of an ill have the same index and so the RTA_IFP sockaddr 616 * cannot be used to differentiate between ipif's (or logical 617 * interfaces) that belong to the same ill (physical interface). 618 * 619 * For example, in the following case involving IPv4 interfaces and 620 * logical interfaces 621 * 622 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 623 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0:1 624 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0:2 625 * 626 * the ipif's corresponding to each of these interface routes can be 627 * uniquely identified by the "gateway" (actually interface address). 628 * 629 * In this case involving multiple IPv6 default routes to a particular 630 * link-local gateway, the use of RTA_IFP is necessary to specify which 631 * default route is of interest: 632 * 633 * default fe80::123:4567:89ab:cdef U if0 634 * default fe80::123:4567:89ab:cdef U if1 635 */ 636 637 /* RTF_GATEWAY not set */ 638 if (!(flags & RTF_GATEWAY)) { 639 queue_t *stq; 640 641 if (sp != NULL) { 642 ip2dbg(("ip_rt_add_v6: gateway security attributes " 643 "cannot be set with interface route\n")); 644 if (ipif_refheld) 645 ipif_refrele(ipif); 646 return (EINVAL); 647 } 648 649 /* 650 * As the interface index specified with the RTA_IFP sockaddr is 651 * the same for all ipif's off of an ill, the matching logic 652 * below uses MATCH_IRE_ILL if such an index was specified. 653 * This means that routes sharing the same prefix when added 654 * using a RTA_IFP sockaddr must have distinct interface 655 * indices (namely, they must be on distinct ill's). 656 * 657 * On the other hand, since the gateway address will usually be 658 * different for each ipif on the system, the matching logic 659 * uses MATCH_IRE_IPIF in the case of a traditional interface 660 * route. This means that interface routes for the same prefix 661 * can be created if they belong to distinct ipif's and if a 662 * RTA_IFP sockaddr is not present. 663 */ 664 if (ipif_arg != NULL) { 665 if (ipif_refheld) { 666 ipif_refrele(ipif); 667 ipif_refheld = B_FALSE; 668 } 669 ipif = ipif_arg; 670 match_flags |= MATCH_IRE_ILL; 671 } else { 672 /* 673 * Check the ipif corresponding to the gw_addr 674 */ 675 if (ipif == NULL) 676 return (ENETUNREACH); 677 match_flags |= MATCH_IRE_IPIF; 678 } 679 680 ASSERT(ipif != NULL); 681 /* 682 * We check for an existing entry at this point. 683 */ 684 match_flags |= MATCH_IRE_MASK; 685 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE, 686 ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 687 if (ire != NULL) { 688 ire_refrele(ire); 689 if (ipif_refheld) 690 ipif_refrele(ipif); 691 return (EEXIST); 692 } 693 694 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 695 ? ipif->ipif_rq : ipif->ipif_wq; 696 697 /* 698 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or 699 * IRE_IF_RESOLVER with the modified address and netmask. 700 */ 701 ire = ire_create_v6( 702 dst_addr, 703 mask, 704 &ipif->ipif_v6src_addr, 705 NULL, 706 &ipif->ipif_mtu, 707 NULL, 708 NULL, 709 stq, 710 ipif->ipif_net_type, 711 ipif, 712 NULL, 713 0, 714 0, 715 flags, 716 &ire_uinfo_null, 717 NULL, 718 NULL, 719 ipst); 720 if (ire == NULL) { 721 if (ipif_refheld) 722 ipif_refrele(ipif); 723 return (ENOMEM); 724 } 725 726 /* 727 * Some software (for example, GateD and Sun Cluster) attempts 728 * to create (what amount to) IRE_PREFIX routes with the 729 * loopback address as the gateway. This is primarily done to 730 * set up prefixes with the RTF_REJECT flag set (for example, 731 * when generating aggregate routes). We also OR in the 732 * RTF_BLACKHOLE flag as these interface routes, by 733 * definition, can only be that. 734 * 735 * If the IRE type (as defined by ipif->ipif_net_type) is 736 * IRE_LOOPBACK, then we map the request into a 737 * IRE_IF_NORESOLVER. 738 * 739 * Needless to say, the real IRE_LOOPBACK is NOT created by this 740 * routine, but rather using ire_create_v6() directly. 741 */ 742 if (ipif->ipif_net_type == IRE_LOOPBACK) { 743 ire->ire_type = IRE_IF_NORESOLVER; 744 ire->ire_flags |= RTF_BLACKHOLE; 745 } 746 error = ire_add(&ire, q, mp, func, B_FALSE); 747 if (error == 0) 748 goto save_ire; 749 /* 750 * In the result of failure, ire_add() will have already 751 * deleted the ire in question, so there is no need to 752 * do that here. 753 */ 754 if (ipif_refheld) 755 ipif_refrele(ipif); 756 return (error); 757 } 758 if (ipif_refheld) { 759 ipif_refrele(ipif); 760 ipif_refheld = B_FALSE; 761 } 762 763 /* 764 * Get an interface IRE for the specified gateway. 765 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 766 * gateway, it is currently unreachable and we fail the request 767 * accordingly. 768 */ 769 ipif = ipif_arg; 770 if (ipif_arg != NULL) 771 match_flags |= MATCH_IRE_ILL; 772 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, 773 NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 774 if (gw_ire == NULL) 775 return (ENETUNREACH); 776 777 /* 778 * We create one of three types of IREs as a result of this request 779 * based on the netmask. A netmask of all ones (which is automatically 780 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 781 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 782 * created. Otherwise, an IRE_PREFIX route is created for the 783 * destination prefix. 784 */ 785 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 786 type = IRE_HOST; 787 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 788 type = IRE_DEFAULT; 789 else 790 type = IRE_PREFIX; 791 792 /* check for a duplicate entry */ 793 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg, 794 NULL, ALL_ZONES, 0, NULL, 795 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst); 796 if (ire != NULL) { 797 ire_refrele(gw_ire); 798 ire_refrele(ire); 799 return (EEXIST); 800 } 801 802 /* Security attribute exists */ 803 if (sp != NULL) { 804 tsol_gcgrp_addr_t ga; 805 806 /* find or create the gateway credentials group */ 807 ga.ga_af = AF_INET6; 808 ga.ga_addr = *gw_addr; 809 810 /* we hold reference to it upon success */ 811 gcgrp = gcgrp_lookup(&ga, B_TRUE); 812 if (gcgrp == NULL) { 813 ire_refrele(gw_ire); 814 return (ENOMEM); 815 } 816 817 /* 818 * Create and add the security attribute to the group; a 819 * reference to the group is made upon allocating a new 820 * entry successfully. If it finds an already-existing 821 * entry for the security attribute in the group, it simply 822 * returns it and no new reference is made to the group. 823 */ 824 gc = gc_create(sp, gcgrp, &gcgrp_xtraref); 825 if (gc == NULL) { 826 /* release reference held by gcgrp_lookup */ 827 GCGRP_REFRELE(gcgrp); 828 ire_refrele(gw_ire); 829 return (ENOMEM); 830 } 831 } 832 833 /* Create the IRE. */ 834 ire = ire_create_v6( 835 dst_addr, /* dest address */ 836 mask, /* mask */ 837 /* src address assigned by the caller? */ 838 (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ? 839 src_addr : NULL), 840 gw_addr, /* gateway address */ 841 &gw_ire->ire_max_frag, 842 NULL, /* no src nce */ 843 NULL, /* no recv-from queue */ 844 NULL, /* no send-to queue */ 845 (ushort_t)type, /* IRE type */ 846 ipif_arg, 847 NULL, 848 0, 849 0, 850 flags, 851 &gw_ire->ire_uinfo, /* Inherit ULP info from gw */ 852 gc, /* security attribute */ 853 NULL, 854 ipst); 855 856 /* 857 * The ire holds a reference to the 'gc' and the 'gc' holds a 858 * reference to the 'gcgrp'. We can now release the extra reference 859 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used. 860 */ 861 if (gcgrp_xtraref) 862 GCGRP_REFRELE(gcgrp); 863 if (ire == NULL) { 864 if (gc != NULL) 865 GC_REFRELE(gc); 866 ire_refrele(gw_ire); 867 return (ENOMEM); 868 } 869 870 /* 871 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 872 * SUN/OS socket stuff does but do we really want to allow ::0 ? 873 */ 874 875 /* Add the new IRE. */ 876 error = ire_add(&ire, q, mp, func, B_FALSE); 877 /* 878 * In the result of failure, ire_add() will have already 879 * deleted the ire in question, so there is no need to 880 * do that here. 881 */ 882 if (error != 0) { 883 ire_refrele(gw_ire); 884 return (error); 885 } 886 887 if (flags & RTF_MULTIRT) { 888 /* 889 * Invoke the CGTP (multirouting) filtering module 890 * to add the dst address in the filtering database. 891 * Replicated inbound packets coming from that address 892 * will be filtered to discard the duplicates. 893 * It is not necessary to call the CGTP filter hook 894 * when the dst address is a multicast, because an 895 * IP source address cannot be a multicast. 896 */ 897 if (ipst->ips_ip_cgtp_filter_ops != NULL && 898 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 899 int res; 900 901 res = ipst->ips_ip_cgtp_filter_ops->cfo_add_dest_v6( 902 ipst->ips_netstack->netstack_stackid, 903 &ire->ire_addr_v6, 904 &ire->ire_gateway_addr_v6, 905 &ire->ire_src_addr_v6, 906 &gw_ire->ire_src_addr_v6); 907 if (res != 0) { 908 ire_refrele(gw_ire); 909 ire_delete(ire); 910 return (res); 911 } 912 } 913 } 914 915 /* 916 * Now that the prefix IRE entry has been created, delete any 917 * existing gateway IRE cache entries as well as any IRE caches 918 * using the gateway, and force them to be created through 919 * ip_newroute_v6. 920 */ 921 if (gc != NULL) { 922 ASSERT(gcgrp != NULL); 923 ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES, ipst); 924 } 925 926 save_ire: 927 if (gw_ire != NULL) { 928 ire_refrele(gw_ire); 929 } 930 if (ipif != NULL) { 931 mblk_t *save_mp; 932 933 /* 934 * Save enough information so that we can recreate the IRE if 935 * the interface goes down and then up. The metrics associated 936 * with the route will be saved as well when rts_setmetrics() is 937 * called after the IRE has been created. In the case where 938 * memory cannot be allocated, none of this information will be 939 * saved. 940 */ 941 save_mp = allocb(sizeof (ifrt_t), BPRI_MED); 942 if (save_mp != NULL) { 943 ifrt_t *ifrt; 944 945 save_mp->b_wptr += sizeof (ifrt_t); 946 ifrt = (ifrt_t *)save_mp->b_rptr; 947 bzero(ifrt, sizeof (ifrt_t)); 948 ifrt->ifrt_type = ire->ire_type; 949 ifrt->ifrt_v6addr = ire->ire_addr_v6; 950 mutex_enter(&ire->ire_lock); 951 ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6; 952 ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6; 953 mutex_exit(&ire->ire_lock); 954 ifrt->ifrt_v6mask = ire->ire_mask_v6; 955 ifrt->ifrt_flags = ire->ire_flags; 956 ifrt->ifrt_max_frag = ire->ire_max_frag; 957 mutex_enter(&ipif->ipif_saved_ire_lock); 958 save_mp->b_cont = ipif->ipif_saved_ire_mp; 959 ipif->ipif_saved_ire_mp = save_mp; 960 ipif->ipif_saved_ire_cnt++; 961 mutex_exit(&ipif->ipif_saved_ire_lock); 962 } 963 } 964 if (ire_arg != NULL) { 965 /* 966 * Store the ire that was successfully added into where ire_arg 967 * points to so that callers don't have to look it up 968 * themselves (but they are responsible for ire_refrele()ing 969 * the ire when they are finished with it). 970 */ 971 *ire_arg = ire; 972 } else { 973 ire_refrele(ire); /* Held in ire_add */ 974 } 975 if (ipif_refheld) 976 ipif_refrele(ipif); 977 return (0); 978 } 979 980 /* 981 * ip_rt_delete_v6 is called to delete an IPv6 route. 982 * ipif_arg is passed in to associate it with the correct interface 983 * (for link-local destinations and gateways). 984 */ 985 /* ARGSUSED4 */ 986 int 987 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 988 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg, 989 queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst) 990 { 991 ire_t *ire = NULL; 992 ipif_t *ipif; 993 uint_t type; 994 uint_t match_flags = MATCH_IRE_TYPE; 995 int err = 0; 996 boolean_t ipif_refheld = B_FALSE; 997 998 /* 999 * If this is the case of RTF_HOST being set, then we set the netmask 1000 * to all ones. Otherwise, we use the netmask if one was supplied. 1001 */ 1002 if (flags & RTF_HOST) { 1003 mask = &ipv6_all_ones; 1004 match_flags |= MATCH_IRE_MASK; 1005 } else if (rtm_addrs & RTA_NETMASK) { 1006 match_flags |= MATCH_IRE_MASK; 1007 } 1008 1009 /* 1010 * Note that RTF_GATEWAY is never set on a delete, therefore 1011 * we check if the gateway address is one of our interfaces first, 1012 * and fall back on RTF_GATEWAY routes. 1013 * 1014 * This makes it possible to delete an original 1015 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 1016 * 1017 * As the interface index specified with the RTA_IFP sockaddr is the 1018 * same for all ipif's off of an ill, the matching logic below uses 1019 * MATCH_IRE_ILL if such an index was specified. This means a route 1020 * sharing the same prefix and interface index as the the route 1021 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr 1022 * is specified in the request. 1023 * 1024 * On the other hand, since the gateway address will usually be 1025 * different for each ipif on the system, the matching logic 1026 * uses MATCH_IRE_IPIF in the case of a traditional interface 1027 * route. This means that interface routes for the same prefix can be 1028 * uniquely identified if they belong to distinct ipif's and if a 1029 * RTA_IFP sockaddr is not present. 1030 * 1031 * For more detail on specifying routes by gateway address and by 1032 * interface index, see the comments in ip_rt_add_v6(). 1033 */ 1034 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err, 1035 ipst); 1036 if (ipif != NULL) { 1037 ipif_refheld = B_TRUE; 1038 if (ipif_arg != NULL) { 1039 ipif_refrele(ipif); 1040 ipif_refheld = B_FALSE; 1041 ipif = ipif_arg; 1042 match_flags |= MATCH_IRE_ILL; 1043 } else { 1044 match_flags |= MATCH_IRE_IPIF; 1045 } 1046 1047 if (ipif->ipif_ire_type == IRE_LOOPBACK) 1048 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 1049 ipif, ALL_ZONES, NULL, match_flags, ipst); 1050 if (ire == NULL) 1051 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, 1052 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL, 1053 match_flags, ipst); 1054 } else if (err == EINPROGRESS) { 1055 return (err); 1056 } else { 1057 err = 0; 1058 } 1059 if (ire == NULL) { 1060 /* 1061 * At this point, the gateway address is not one of our own 1062 * addresses or a matching interface route was not found. We 1063 * set the IRE type to lookup based on whether 1064 * this is a host route, a default route or just a prefix. 1065 * 1066 * If an ipif_arg was passed in, then the lookup is based on an 1067 * interface index so MATCH_IRE_ILL is added to match_flags. 1068 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is 1069 * set as the route being looked up is not a traditional 1070 * interface route. 1071 */ 1072 match_flags &= ~MATCH_IRE_IPIF; 1073 match_flags |= MATCH_IRE_GW; 1074 if (ipif_arg != NULL) 1075 match_flags |= MATCH_IRE_ILL; 1076 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 1077 type = IRE_HOST; 1078 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 1079 type = IRE_DEFAULT; 1080 else 1081 type = IRE_PREFIX; 1082 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 1083 ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 1084 } 1085 1086 if (ipif_refheld) { 1087 ipif_refrele(ipif); 1088 ipif_refheld = B_FALSE; 1089 } 1090 if (ire == NULL) 1091 return (ESRCH); 1092 1093 if (ire->ire_flags & RTF_MULTIRT) { 1094 /* 1095 * Invoke the CGTP (multirouting) filtering module 1096 * to remove the dst address from the filtering database. 1097 * Packets coming from that address will no longer be 1098 * filtered to remove duplicates. 1099 */ 1100 if (ipst->ips_ip_cgtp_filter_ops != NULL) { 1101 err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v6( 1102 ipst->ips_netstack->netstack_stackid, 1103 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 1104 } 1105 } 1106 1107 ipif = ire->ire_ipif; 1108 if (ipif != NULL) { 1109 mblk_t **mpp; 1110 mblk_t *mp; 1111 ifrt_t *ifrt; 1112 in6_addr_t gw_addr_v6; 1113 1114 /* Remove from ipif_saved_ire_mp list if it is there */ 1115 mutex_enter(&ire->ire_lock); 1116 gw_addr_v6 = ire->ire_gateway_addr_v6; 1117 mutex_exit(&ire->ire_lock); 1118 mutex_enter(&ipif->ipif_saved_ire_lock); 1119 for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL; 1120 mpp = &(*mpp)->b_cont) { 1121 /* 1122 * On a given ipif, the triple of address, gateway and 1123 * mask is unique for each saved IRE (in the case of 1124 * ordinary interface routes, the gateway address is 1125 * all-zeroes). 1126 */ 1127 mp = *mpp; 1128 ifrt = (ifrt_t *)mp->b_rptr; 1129 if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr, 1130 &ire->ire_addr_v6) && 1131 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr, 1132 &gw_addr_v6) && 1133 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask, 1134 &ire->ire_mask_v6)) { 1135 *mpp = mp->b_cont; 1136 ipif->ipif_saved_ire_cnt--; 1137 freeb(mp); 1138 break; 1139 } 1140 } 1141 mutex_exit(&ipif->ipif_saved_ire_lock); 1142 } 1143 ire_delete(ire); 1144 ire_refrele(ire); 1145 return (err); 1146 } 1147 1148 /* 1149 * Derive a token from the link layer address. 1150 */ 1151 boolean_t 1152 ill_setdefaulttoken(ill_t *ill) 1153 { 1154 int i; 1155 in6_addr_t v6addr, v6mask; 1156 1157 if (!MEDIA_V6INTFID(ill->ill_media, ill, &v6addr)) 1158 return (B_FALSE); 1159 1160 (void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask); 1161 1162 for (i = 0; i < 4; i++) 1163 v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^ 1164 (uint32_t)0xffffffff; 1165 1166 V6_MASK_COPY(v6addr, v6mask, ill->ill_token); 1167 ill->ill_token_length = IPV6_TOKEN_LEN; 1168 return (B_TRUE); 1169 } 1170 1171 /* 1172 * Create a link-local address from a token. 1173 */ 1174 static void 1175 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 1176 { 1177 int i; 1178 1179 for (i = 0; i < 4; i++) { 1180 dest->s6_addr32[i] = 1181 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 1182 } 1183 } 1184 1185 /* 1186 * Set a nice default address for either automatic tunnels tsrc/96 or 1187 * 6to4 tunnels 2002:<tsrc>::1/64 1188 */ 1189 static void 1190 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta) 1191 { 1192 sin6_t sin6; 1193 sin_t *sin; 1194 ill_t *ill = ipif->ipif_ill; 1195 tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr; 1196 1197 if (ta->ifta_saddr.ss_family != AF_INET || 1198 (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 || 1199 (ta->ifta_flags & IFTUN_SRC) == 0) 1200 return; 1201 1202 /* 1203 * Check the tunnel type by examining q_next->q_ptr 1204 */ 1205 if (tp->tun_flags & TUN_AUTOMATIC) { 1206 /* this is an automatic tunnel */ 1207 (void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS, 1208 &ipif->ipif_v6net_mask); 1209 bzero(&sin6, sizeof (sin6_t)); 1210 sin = (sin_t *)&ta->ifta_saddr; 1211 V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr; 1212 sin6.sin6_family = AF_INET6; 1213 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1214 NULL, NULL, NULL, NULL); 1215 } else if (tp->tun_flags & TUN_6TO4) { 1216 /* this is a 6to4 tunnel */ 1217 (void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN, 1218 &ipif->ipif_v6net_mask); 1219 sin = (sin_t *)&ta->ifta_saddr; 1220 /* create a 6to4 address from the IPv4 tsrc */ 1221 IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr); 1222 sin6.sin6_family = AF_INET6; 1223 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1224 NULL, NULL, NULL, NULL); 1225 } else { 1226 ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type")); 1227 return; 1228 } 1229 } 1230 1231 /* 1232 * Set link local for ipif_id 0 of a configured tunnel based on the 1233 * tsrc or tdst parameter 1234 * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as 1235 * the token. 1236 * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address 1237 * as the token for the "outer" link. 1238 */ 1239 void 1240 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta) 1241 { 1242 ipif_t *ipif; 1243 sin_t *sin; 1244 in6_addr_t *s6addr; 1245 1246 ASSERT(IAM_WRITER_ILL(ill)); 1247 1248 /* The first ipif must be id zero. */ 1249 ipif = ill->ill_ipif; 1250 ASSERT(ipif->ipif_id == 0); 1251 1252 /* no link local for automatic tunnels */ 1253 if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) { 1254 ipif_set_tun_auto_addr(ipif, ta); 1255 return; 1256 } 1257 1258 if ((ta->ifta_flags & IFTUN_DST) && 1259 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 1260 sin6_t sin6; 1261 1262 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1263 bzero(&sin6, sizeof (sin6_t)); 1264 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1265 sin = (sin_t *)&ta->ifta_daddr; 1266 V4_PART_OF_V6(sin6.sin6_addr) = 1267 sin->sin_addr.s_addr; 1268 } else { 1269 s6addr = 1270 &((sin6_t *)&ta->ifta_daddr)->sin6_addr; 1271 sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3]; 1272 sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2]; 1273 } 1274 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, 1275 &sin6.sin6_addr); 1276 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1277 } 1278 if ((ta->ifta_flags & IFTUN_SRC)) { 1279 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1280 1281 /* Set the token if it isn't already set */ 1282 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) { 1283 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1284 sin = (sin_t *)&ta->ifta_saddr; 1285 V4_PART_OF_V6(ill->ill_token) = 1286 sin->sin_addr.s_addr; 1287 } else { 1288 s6addr = 1289 &((sin6_t *)&ta->ifta_saddr)->sin6_addr; 1290 ill->ill_token.s6_addr32[3] = 1291 s6addr->s6_addr32[3]; 1292 ill->ill_token.s6_addr32[2] = 1293 s6addr->s6_addr32[2]; 1294 } 1295 ill->ill_token_length = IPV6_TOKEN_LEN; 1296 } 1297 /* 1298 * Attempt to set the link local address if it isn't set. 1299 */ 1300 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) 1301 (void) ipif_setlinklocal(ipif); 1302 } 1303 } 1304 1305 /* 1306 * Is it not possible to set the link local address? 1307 * The address can be set if the token is set, and the token 1308 * isn't too long. 1309 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1310 */ 1311 boolean_t 1312 ipif_cant_setlinklocal(ipif_t *ipif) 1313 { 1314 ill_t *ill = ipif->ipif_ill; 1315 1316 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1317 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1318 return (B_TRUE); 1319 1320 return (B_FALSE); 1321 } 1322 1323 /* 1324 * Generate a link-local address from the token. 1325 * Return zero if the address was set, or non-zero if it couldn't be set. 1326 */ 1327 int 1328 ipif_setlinklocal(ipif_t *ipif) 1329 { 1330 ill_t *ill = ipif->ipif_ill; 1331 in6_addr_t ov6addr; 1332 1333 ASSERT(IAM_WRITER_ILL(ill)); 1334 1335 if (ipif_cant_setlinklocal(ipif)) 1336 return (-1); 1337 1338 ov6addr = ipif->ipif_v6lcl_addr; 1339 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1340 sctp_update_ipif_addr(ipif, ov6addr); 1341 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1342 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1343 ipif->ipif_v6subnet); 1344 1345 if (ipif->ipif_flags & IPIF_NOLOCAL) { 1346 ipif->ipif_v6src_addr = ipv6_all_zeros; 1347 } else { 1348 ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr; 1349 } 1350 return (0); 1351 } 1352 1353 /* 1354 * This function sets up the multicast mappings in NDP. 1355 * Unlike ARP, there are no mapping_mps here. We delete the 1356 * mapping nces and add a new one. 1357 * 1358 * Returns non-zero on error and 0 on success. 1359 */ 1360 int 1361 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce) 1362 { 1363 ill_t *ill = ipif->ipif_ill; 1364 in6_addr_t v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0}; 1365 in6_addr_t v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0}; 1366 in6_addr_t v6_extract_mask; 1367 uchar_t *phys_addr, *bphys_addr, *alloc_phys; 1368 nce_t *mnce = NULL; 1369 int err = 0; 1370 phyint_t *phyi = ill->ill_phyint; 1371 uint32_t hw_extract_start; 1372 dl_unitdata_req_t *dlur; 1373 ip_stack_t *ipst = ill->ill_ipst; 1374 1375 if (ret_nce != NULL) 1376 *ret_nce = NULL; 1377 1378 /* 1379 * IPMP meta-interfaces don't have any inherent multicast mappings, 1380 * and instead use the ones on the underlying interfaces. 1381 */ 1382 if (IS_IPMP(ill)) 1383 return (0); 1384 1385 /* 1386 * Delete the mapping nce. Normally these should not exist 1387 * as a previous ipif_down -> ipif_ndp_down should have deleted 1388 * all the nces. But they can exist if ip_rput_dlpi_writer 1389 * calls this when PHYI_MULTI_BCAST is set. Mappings are always 1390 * tied to the underlying ill, so don't match across the illgrp. 1391 */ 1392 mnce = ndp_lookup_v6(ill, B_FALSE, &v6_mcast_addr, B_FALSE); 1393 if (mnce != NULL) { 1394 ndp_delete(mnce); 1395 NCE_REFRELE(mnce); 1396 mnce = NULL; 1397 } 1398 1399 /* 1400 * Get media specific v6 mapping information. Note that 1401 * nd_lla_len can be 0 for tunnels. 1402 */ 1403 alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP); 1404 if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0)) 1405 return (ENOMEM); 1406 /* 1407 * Determine the broadcast address. 1408 */ 1409 dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr; 1410 if (ill->ill_sap_length < 0) 1411 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset; 1412 else 1413 bphys_addr = (uchar_t *)dlur + 1414 dlur->dl_dest_addr_offset + ill->ill_sap_length; 1415 1416 /* 1417 * Check PHYI_MULTI_BCAST and possible length of physical 1418 * address to determine if we use the mapping or the 1419 * broadcast address. 1420 */ 1421 if ((phyi->phyint_flags & PHYI_MULTI_BCAST) || 1422 (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len, 1423 bphys_addr, alloc_phys, &hw_extract_start, 1424 &v6_extract_mask))) { 1425 if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) { 1426 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1427 return (E2BIG); 1428 } 1429 /* Use the link-layer broadcast address for MULTI_BCAST */ 1430 phys_addr = bphys_addr; 1431 bzero(&v6_extract_mask, sizeof (v6_extract_mask)); 1432 hw_extract_start = ill->ill_nd_lla_len; 1433 } else { 1434 phys_addr = alloc_phys; 1435 } 1436 if ((ipif->ipif_flags & IPIF_BROADCAST) || 1437 (ill->ill_flags & ILLF_MULTICAST) || 1438 (phyi->phyint_flags & PHYI_MULTI_BCAST)) { 1439 mutex_enter(&ipst->ips_ndp6->ndp_g_lock); 1440 err = ndp_add_v6(ill, 1441 phys_addr, 1442 &v6_mcast_addr, /* v6 address */ 1443 &v6_mcast_mask, /* v6 mask */ 1444 &v6_extract_mask, 1445 hw_extract_start, 1446 NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD, 1447 ND_REACHABLE, 1448 &mnce); 1449 mutex_exit(&ipst->ips_ndp6->ndp_g_lock); 1450 if (err == 0) { 1451 if (ret_nce != NULL) { 1452 *ret_nce = mnce; 1453 } else { 1454 NCE_REFRELE(mnce); 1455 } 1456 } 1457 } 1458 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1459 return (err); 1460 } 1461 1462 /* 1463 * Get the resolver set up for a new ipif. (Always called as writer.) 1464 */ 1465 int 1466 ipif_ndp_up(ipif_t *ipif, boolean_t initial) 1467 { 1468 ill_t *ill = ipif->ipif_ill; 1469 int err = 0; 1470 nce_t *nce = NULL; 1471 nce_t *mnce = NULL; 1472 boolean_t added_ipif = B_FALSE; 1473 1474 ASSERT(IAM_WRITER_ILL(ill)); 1475 ip1dbg(("ipif_ndp_up(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 1476 1477 /* 1478 * ND not supported on XRESOLV interfaces. If ND support (multicast) 1479 * added later, take out this check. 1480 */ 1481 if ((ill->ill_flags & ILLF_XRESOLV) || 1482 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) || 1483 (!(ill->ill_net_type & IRE_INTERFACE))) { 1484 ipif->ipif_addr_ready = 1; 1485 return (0); 1486 } 1487 1488 /* 1489 * Need to setup multicast mapping only when the first 1490 * interface is coming UP. 1491 */ 1492 if (ill->ill_ipif_up_count == 0 && 1493 (ill->ill_flags & ILLF_MULTICAST)) { 1494 /* 1495 * We set the multicast before setting up the mapping for 1496 * local address because ipif_ndp_setup_multicast does 1497 * ndp_walk to delete nces which will delete the mapping 1498 * for local address also if we added the mapping for 1499 * local address first. 1500 */ 1501 err = ipif_ndp_setup_multicast(ipif, &mnce); 1502 if (err != 0) 1503 return (err); 1504 } 1505 1506 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1507 uint16_t flags; 1508 uint16_t state; 1509 uchar_t *hw_addr = NULL; 1510 ill_t *bound_ill; 1511 ipmp_illgrp_t *illg = ill->ill_grp; 1512 1513 /* Permanent entries don't need NUD */ 1514 flags = NCE_F_PERMANENT | NCE_F_NONUD; 1515 if (ill->ill_flags & ILLF_ROUTER) 1516 flags |= NCE_F_ISROUTER; 1517 1518 if (ipif->ipif_flags & IPIF_ANYCAST) 1519 flags |= NCE_F_ANYCAST; 1520 1521 if (IS_IPMP(ill)) { 1522 ASSERT(ill->ill_net_type == IRE_IF_RESOLVER); 1523 /* 1524 * If we're here via ipif_up(), then the ipif won't be 1525 * bound yet -- add it to the group, which will bind 1526 * it if possible. (We would add it in ipif_up(), but 1527 * deleting on failure there is gruesome.) If we're 1528 * here via ipmp_ill_bind_ipif(), then the ipif has 1529 * already been added to the group and we just need to 1530 * use the binding. 1531 */ 1532 if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) { 1533 bound_ill = ipmp_illgrp_add_ipif(illg, ipif); 1534 if (bound_ill == NULL) { 1535 /* 1536 * We couldn't bind the ipif to an ill 1537 * yet, so we have nothing to publish. 1538 * Set ipif_addr_ready so that this 1539 * address can be used locally for now. 1540 * The routing socket message will be 1541 * sent from ipif_up_done_v6(). 1542 */ 1543 ipif->ipif_addr_ready = 1; 1544 return (0); 1545 } 1546 added_ipif = B_TRUE; 1547 } 1548 hw_addr = bound_ill->ill_nd_lla; 1549 } else { 1550 bound_ill = ill; 1551 if (ill->ill_net_type == IRE_IF_RESOLVER) 1552 hw_addr = ill->ill_nd_lla; 1553 } 1554 1555 /* 1556 * If this is an initial bring-up (or the ipif was never 1557 * completely brought up), do DAD. Otherwise, we're here 1558 * because IPMP has rebound an address to this ill: send 1559 * unsolicited advertisements to inform others. 1560 */ 1561 if (initial || !ipif->ipif_addr_ready) { 1562 state = ND_PROBE; 1563 } else { 1564 state = ND_REACHABLE; 1565 flags |= NCE_F_UNSOL_ADV; 1566 } 1567 retry: 1568 /* 1569 * Create an nce for the local address. We pass a match_illgrp 1570 * of B_TRUE because the local address must be unique across 1571 * the illgrp, and the existence of an nce with nce_ill set 1572 * to any ill in the group is indicative of a duplicate address 1573 */ 1574 err = ndp_lookup_then_add_v6(bound_ill, 1575 B_TRUE, 1576 hw_addr, 1577 &ipif->ipif_v6lcl_addr, 1578 &ipv6_all_ones, 1579 &ipv6_all_zeros, 1580 0, 1581 flags, 1582 state, 1583 &nce); 1584 switch (err) { 1585 case 0: 1586 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1587 ill->ill_name)); 1588 ipif->ipif_addr_ready = 1; 1589 ipif->ipif_added_nce = 1; 1590 nce->nce_ipif_cnt++; 1591 break; 1592 case EINPROGRESS: 1593 ip1dbg(("ipif_ndp_up: running DAD now for %s\n", 1594 ill->ill_name)); 1595 ipif->ipif_added_nce = 1; 1596 nce->nce_ipif_cnt++; 1597 break; 1598 case EEXIST: 1599 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1600 ill->ill_name)); 1601 if (!(nce->nce_flags & NCE_F_PERMANENT)) { 1602 ndp_delete(nce); 1603 NCE_REFRELE(nce); 1604 nce = NULL; 1605 goto retry; 1606 } 1607 if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) { 1608 NCE_REFRELE(nce); 1609 goto fail; 1610 } 1611 /* 1612 * Duplicate local addresses are permissible for 1613 * IPIF_POINTOPOINT interfaces which will get marked 1614 * IPIF_UNNUMBERED later in 1615 * ip_addr_availability_check(). 1616 * 1617 * The nce_ipif_cnt field tracks the number of 1618 * ipifs that have nce_addr as their local address. 1619 */ 1620 ipif->ipif_addr_ready = 1; 1621 ipif->ipif_added_nce = 1; 1622 nce->nce_ipif_cnt++; 1623 break; 1624 default: 1625 ip1dbg(("ipif_ndp_up: NCE creation failed for %s\n", 1626 ill->ill_name)); 1627 goto fail; 1628 } 1629 } else { 1630 /* No local NCE for this entry */ 1631 ipif->ipif_addr_ready = 1; 1632 } 1633 if (nce != NULL) 1634 NCE_REFRELE(nce); 1635 if (mnce != NULL) 1636 NCE_REFRELE(mnce); 1637 return (0); 1638 fail: 1639 if (mnce != NULL) { 1640 ndp_delete(mnce); 1641 NCE_REFRELE(mnce); 1642 } 1643 if (added_ipif) 1644 ipmp_illgrp_del_ipif(ill->ill_grp, ipif); 1645 1646 return (err); 1647 } 1648 1649 /* Remove all cache entries for this logical interface */ 1650 void 1651 ipif_ndp_down(ipif_t *ipif) 1652 { 1653 nce_t *nce; 1654 ill_t *ill = ipif->ipif_ill; 1655 1656 ASSERT(IAM_WRITER_ILL(ill)); 1657 1658 if (ipif->ipif_isv6) { 1659 if (ipif->ipif_added_nce) { 1660 /* 1661 * For IPMP, `ill' can be the IPMP ill but the NCE will 1662 * always be tied to an underlying IP interface, so we 1663 * match across the illgrp. This is safe since we 1664 * ensure uniqueness across the group in ipif_ndp_up(). 1665 */ 1666 nce = ndp_lookup_v6(ill, B_TRUE, &ipif->ipif_v6lcl_addr, 1667 B_FALSE); 1668 if (nce != NULL) { 1669 if (--nce->nce_ipif_cnt == 0) 1670 ndp_delete(nce); /* last ipif for nce */ 1671 NCE_REFRELE(nce); 1672 } 1673 ipif->ipif_added_nce = 0; 1674 } 1675 1676 /* 1677 * Make IPMP aware of the deleted data address. 1678 */ 1679 if (IS_IPMP(ill)) 1680 ipmp_illgrp_del_ipif(ill->ill_grp, ipif); 1681 } 1682 1683 /* 1684 * Remove mapping and all other nces dependent on this ill 1685 * when the last ipif is going away. 1686 */ 1687 if (ill->ill_ipif_up_count == 0) 1688 ndp_walk(ill, (pfi_t)ndp_delete_per_ill, ill, ill->ill_ipst); 1689 } 1690 1691 /* 1692 * Used when an interface comes up to recreate any extra routes on this 1693 * interface. 1694 */ 1695 static ire_t ** 1696 ipif_recover_ire_v6(ipif_t *ipif) 1697 { 1698 mblk_t *mp; 1699 ire_t **ipif_saved_irep; 1700 ire_t **irep; 1701 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 1702 1703 ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name, 1704 ipif->ipif_id)); 1705 1706 ASSERT(ipif->ipif_isv6); 1707 1708 mutex_enter(&ipif->ipif_saved_ire_lock); 1709 ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) * 1710 ipif->ipif_saved_ire_cnt, KM_NOSLEEP); 1711 if (ipif_saved_irep == NULL) { 1712 mutex_exit(&ipif->ipif_saved_ire_lock); 1713 return (NULL); 1714 } 1715 1716 irep = ipif_saved_irep; 1717 1718 for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) { 1719 ire_t *ire; 1720 queue_t *rfq; 1721 queue_t *stq; 1722 ifrt_t *ifrt; 1723 in6_addr_t *src_addr; 1724 in6_addr_t *gateway_addr; 1725 char buf[INET6_ADDRSTRLEN]; 1726 ushort_t type; 1727 1728 /* 1729 * When the ire was initially created and then added in 1730 * ip_rt_add_v6(), it was created either using 1731 * ipif->ipif_net_type in the case of a traditional interface 1732 * route, or as one of the IRE_OFFSUBNET types (with the 1733 * exception of IRE_HOST type redirect ire which is created by 1734 * icmp_redirect_v6() and which we don't need to save or 1735 * recover). In the case where ipif->ipif_net_type was 1736 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to 1737 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy 1738 * software like GateD and Sun Cluster which creates routes 1739 * using the the loopback interface's address as a gateway. 1740 * 1741 * As ifrt->ifrt_type reflects the already updated ire_type, 1742 * ire_create_v6() will be called in the same way here as in 1743 * ip_rt_add_v6(), namely using ipif->ipif_net_type when the 1744 * route looks like a traditional interface route (where 1745 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise 1746 * using the saved ifrt->ifrt_type. This means that in 1747 * the case where ipif->ipif_net_type is IRE_LOOPBACK, 1748 * the ire created by ire_create_v6() will be an IRE_LOOPBACK, 1749 * it will then be turned into an IRE_IF_NORESOLVER and then 1750 * added by ire_add_v6(). 1751 */ 1752 ifrt = (ifrt_t *)mp->b_rptr; 1753 if (ifrt->ifrt_type & IRE_INTERFACE) { 1754 rfq = NULL; 1755 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 1756 ? ipif->ipif_rq : ipif->ipif_wq; 1757 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1758 ? &ifrt->ifrt_v6src_addr 1759 : &ipif->ipif_v6src_addr; 1760 gateway_addr = NULL; 1761 type = ipif->ipif_net_type; 1762 } else { 1763 rfq = NULL; 1764 stq = NULL; 1765 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1766 ? &ifrt->ifrt_v6src_addr : NULL; 1767 gateway_addr = &ifrt->ifrt_v6gateway_addr; 1768 type = ifrt->ifrt_type; 1769 } 1770 1771 /* 1772 * Create a copy of the IRE with the saved address and netmask. 1773 */ 1774 ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n", 1775 ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type, 1776 inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)), 1777 ip_mask_to_plen_v6(&ifrt->ifrt_v6mask))); 1778 ire = ire_create_v6( 1779 &ifrt->ifrt_v6addr, 1780 &ifrt->ifrt_v6mask, 1781 src_addr, 1782 gateway_addr, 1783 &ifrt->ifrt_max_frag, 1784 NULL, 1785 rfq, 1786 stq, 1787 type, 1788 ipif, 1789 NULL, 1790 0, 1791 0, 1792 ifrt->ifrt_flags, 1793 &ifrt->ifrt_iulp_info, 1794 NULL, 1795 NULL, 1796 ipst); 1797 if (ire == NULL) { 1798 mutex_exit(&ipif->ipif_saved_ire_lock); 1799 kmem_free(ipif_saved_irep, 1800 ipif->ipif_saved_ire_cnt * sizeof (ire_t *)); 1801 return (NULL); 1802 } 1803 1804 /* 1805 * Some software (for example, GateD and Sun Cluster) attempts 1806 * to create (what amount to) IRE_PREFIX routes with the 1807 * loopback address as the gateway. This is primarily done to 1808 * set up prefixes with the RTF_REJECT flag set (for example, 1809 * when generating aggregate routes.) 1810 * 1811 * If the IRE type (as defined by ipif->ipif_net_type) is 1812 * IRE_LOOPBACK, then we map the request into a 1813 * IRE_IF_NORESOLVER. 1814 */ 1815 if (ipif->ipif_net_type == IRE_LOOPBACK) 1816 ire->ire_type = IRE_IF_NORESOLVER; 1817 /* 1818 * ire held by ire_add, will be refreled' in ipif_up_done 1819 * towards the end 1820 */ 1821 (void) ire_add(&ire, NULL, NULL, NULL, B_FALSE); 1822 *irep = ire; 1823 irep++; 1824 ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire)); 1825 } 1826 mutex_exit(&ipif->ipif_saved_ire_lock); 1827 return (ipif_saved_irep); 1828 } 1829 1830 /* 1831 * Return the scope of the given IPv6 address. If the address is an 1832 * IPv4 mapped IPv6 address, return the scope of the corresponding 1833 * IPv4 address. 1834 */ 1835 in6addr_scope_t 1836 ip_addr_scope_v6(const in6_addr_t *addr) 1837 { 1838 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1839 1840 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1841 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1842 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1843 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1844 return (IP6_SCOPE_LINKLOCAL); 1845 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1846 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1847 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1848 return (IP6_SCOPE_SITELOCAL); 1849 return (IP6_SCOPE_GLOBAL); 1850 } 1851 1852 if (IN6_IS_ADDR_MULTICAST(addr)) 1853 return (IN6_ADDR_MC_SCOPE(addr)); 1854 1855 /* link-local and loopback addresses are of link-local scope */ 1856 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1857 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1858 return (IP6_SCOPE_LINKLOCAL); 1859 if (IN6_IS_ADDR_SITELOCAL(addr)) 1860 return (IP6_SCOPE_SITELOCAL); 1861 return (IP6_SCOPE_GLOBAL); 1862 } 1863 1864 1865 /* 1866 * Returns the length of the common prefix of a1 and a2, as per 1867 * CommonPrefixLen() defined in RFC 3484. 1868 */ 1869 static int 1870 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2) 1871 { 1872 int i; 1873 uint32_t a1val, a2val, mask; 1874 1875 for (i = 0; i < 4; i++) { 1876 if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) { 1877 a1val ^= a2val; 1878 i *= 32; 1879 mask = 0x80000000u; 1880 while (!(a1val & mask)) { 1881 mask >>= 1; 1882 i++; 1883 } 1884 return (i); 1885 } 1886 } 1887 return (IPV6_ABITS); 1888 } 1889 1890 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1891 (((ipif)->ipif_flags & IPIF_UP) && \ 1892 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \ 1893 (ipif)->ipif_addr_ready) 1894 1895 /* source address candidate */ 1896 typedef struct candidate { 1897 ipif_t *cand_ipif; 1898 /* The properties of this candidate */ 1899 boolean_t cand_isdst; 1900 boolean_t cand_isdst_set; 1901 in6addr_scope_t cand_scope; 1902 boolean_t cand_scope_set; 1903 boolean_t cand_isdeprecated; 1904 boolean_t cand_isdeprecated_set; 1905 boolean_t cand_ispreferred; 1906 boolean_t cand_ispreferred_set; 1907 boolean_t cand_matchedinterface; 1908 boolean_t cand_matchedinterface_set; 1909 boolean_t cand_matchedlabel; 1910 boolean_t cand_matchedlabel_set; 1911 boolean_t cand_istmp; 1912 boolean_t cand_istmp_set; 1913 int cand_common_pref; 1914 boolean_t cand_common_pref_set; 1915 boolean_t cand_pref_eq; 1916 boolean_t cand_pref_eq_set; 1917 int cand_pref_len; 1918 boolean_t cand_pref_len_set; 1919 } cand_t; 1920 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1921 #define cand_mask cand_ipif->ipif_v6net_mask 1922 #define cand_flags cand_ipif->ipif_flags 1923 #define cand_ill cand_ipif->ipif_ill 1924 #define cand_zoneid cand_ipif->ipif_zoneid 1925 1926 /* information about the destination for source address selection */ 1927 typedef struct dstinfo { 1928 const in6_addr_t *dst_addr; 1929 ill_t *dst_ill; 1930 uint_t dst_restrict_ill; 1931 boolean_t dst_prefer_src_tmp; 1932 in6addr_scope_t dst_scope; 1933 char *dst_label; 1934 } dstinfo_t; 1935 1936 /* 1937 * The following functions are rules used to select a source address in 1938 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1939 * against the best candidate (bc). Each rule has three possible outcomes; 1940 * the candidate is preferred over the best candidate (CAND_PREFER), the 1941 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1942 * candidate is of equal value as the best candidate (CAND_TIE). 1943 * 1944 * These rules are part of a greater "Default Address Selection for IPv6" 1945 * sheme, which is standards based work coming out of the IETF ipv6 working 1946 * group. The IETF document defines both IPv6 source address selection and 1947 * destination address ordering. The rules defined here implement the IPv6 1948 * source address selection. Destination address ordering is done by 1949 * libnsl, and uses a similar set of rules to implement the sorting. 1950 * 1951 * Most of the rules are defined by the RFC and are not typically altered. The 1952 * last rule, number 8, has language that allows for local preferences. In the 1953 * scheme below, this means that new Solaris rules should normally go between 1954 * rule_ifprefix and rule_prefix. 1955 */ 1956 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1957 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *, 1958 ip_stack_t *); 1959 1960 /* Prefer an address if it is equal to the destination address. */ 1961 /* ARGSUSED3 */ 1962 static rule_res_t 1963 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1964 { 1965 if (!bc->cand_isdst_set) { 1966 bc->cand_isdst = 1967 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1968 bc->cand_isdst_set = B_TRUE; 1969 } 1970 1971 cc->cand_isdst = 1972 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1973 cc->cand_isdst_set = B_TRUE; 1974 1975 if (cc->cand_isdst == bc->cand_isdst) 1976 return (CAND_TIE); 1977 else if (cc->cand_isdst) 1978 return (CAND_PREFER); 1979 else 1980 return (CAND_AVOID); 1981 } 1982 1983 /* 1984 * Prefer addresses that are of closest scope to the destination. Always 1985 * prefer addresses that are of greater scope than the destination over 1986 * those that are of lesser scope than the destination. 1987 */ 1988 /* ARGSUSED3 */ 1989 static rule_res_t 1990 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1991 { 1992 if (!bc->cand_scope_set) { 1993 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1994 bc->cand_scope_set = B_TRUE; 1995 } 1996 1997 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1998 cc->cand_scope_set = B_TRUE; 1999 2000 if (cc->cand_scope < bc->cand_scope) { 2001 if (cc->cand_scope < dstinfo->dst_scope) 2002 return (CAND_AVOID); 2003 else 2004 return (CAND_PREFER); 2005 } else if (bc->cand_scope < cc->cand_scope) { 2006 if (bc->cand_scope < dstinfo->dst_scope) 2007 return (CAND_PREFER); 2008 else 2009 return (CAND_AVOID); 2010 } else { 2011 return (CAND_TIE); 2012 } 2013 } 2014 2015 /* 2016 * Prefer non-deprecated source addresses. 2017 */ 2018 /* ARGSUSED2 */ 2019 static rule_res_t 2020 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2021 ip_stack_t *ipst) 2022 { 2023 if (!bc->cand_isdeprecated_set) { 2024 bc->cand_isdeprecated = 2025 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 2026 bc->cand_isdeprecated_set = B_TRUE; 2027 } 2028 2029 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 2030 cc->cand_isdeprecated_set = B_TRUE; 2031 2032 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 2033 return (CAND_TIE); 2034 else if (cc->cand_isdeprecated) 2035 return (CAND_AVOID); 2036 else 2037 return (CAND_PREFER); 2038 } 2039 2040 /* 2041 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 2042 * rule must be before rule_interface because the flag could be set on any 2043 * interface, not just the interface being used for outgoing packets (for 2044 * example, the IFF_PREFERRED could be set on an address assigned to the 2045 * loopback interface). 2046 */ 2047 /* ARGSUSED2 */ 2048 static rule_res_t 2049 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2050 ip_stack_t *ipst) 2051 { 2052 if (!bc->cand_ispreferred_set) { 2053 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 2054 bc->cand_ispreferred_set = B_TRUE; 2055 } 2056 2057 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 2058 cc->cand_ispreferred_set = B_TRUE; 2059 2060 if (bc->cand_ispreferred == cc->cand_ispreferred) 2061 return (CAND_TIE); 2062 else if (cc->cand_ispreferred) 2063 return (CAND_PREFER); 2064 else 2065 return (CAND_AVOID); 2066 } 2067 2068 /* 2069 * Prefer source addresses that are assigned to the outgoing interface. 2070 */ 2071 /* ARGSUSED3 */ 2072 static rule_res_t 2073 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2074 ip_stack_t *ipst) 2075 { 2076 ill_t *dstill = dstinfo->dst_ill; 2077 2078 /* 2079 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 2080 * since we know all candidates will be on the same link. 2081 */ 2082 if (dstinfo->dst_restrict_ill) 2083 return (CAND_TIE); 2084 2085 if (!bc->cand_matchedinterface_set) { 2086 bc->cand_matchedinterface = bc->cand_ill == dstill; 2087 bc->cand_matchedinterface_set = B_TRUE; 2088 } 2089 2090 cc->cand_matchedinterface = cc->cand_ill == dstill; 2091 cc->cand_matchedinterface_set = B_TRUE; 2092 2093 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 2094 return (CAND_TIE); 2095 else if (cc->cand_matchedinterface) 2096 return (CAND_PREFER); 2097 else 2098 return (CAND_AVOID); 2099 } 2100 2101 /* 2102 * Prefer source addresses whose label matches the destination's label. 2103 */ 2104 static rule_res_t 2105 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 2106 { 2107 char *label; 2108 2109 if (!bc->cand_matchedlabel_set) { 2110 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst); 2111 bc->cand_matchedlabel = 2112 ip6_asp_labelcmp(label, dstinfo->dst_label); 2113 bc->cand_matchedlabel_set = B_TRUE; 2114 } 2115 2116 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst); 2117 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 2118 cc->cand_matchedlabel_set = B_TRUE; 2119 2120 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 2121 return (CAND_TIE); 2122 else if (cc->cand_matchedlabel) 2123 return (CAND_PREFER); 2124 else 2125 return (CAND_AVOID); 2126 } 2127 2128 /* 2129 * Prefer public addresses over temporary ones. An application can reverse 2130 * the logic of this rule and prefer temporary addresses by using the 2131 * IPV6_SRC_PREFERENCES socket option. 2132 */ 2133 /* ARGSUSED3 */ 2134 static rule_res_t 2135 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2136 ip_stack_t *ipst) 2137 { 2138 if (!bc->cand_istmp_set) { 2139 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 2140 bc->cand_istmp_set = B_TRUE; 2141 } 2142 2143 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 2144 cc->cand_istmp_set = B_TRUE; 2145 2146 if (bc->cand_istmp == cc->cand_istmp) 2147 return (CAND_TIE); 2148 2149 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 2150 return (CAND_PREFER); 2151 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 2152 return (CAND_PREFER); 2153 else 2154 return (CAND_AVOID); 2155 } 2156 2157 /* 2158 * Prefer source addresses with longer matching prefix with the destination 2159 * under the interface mask. This gets us on the same subnet before applying 2160 * any Solaris-specific rules. 2161 */ 2162 /* ARGSUSED3 */ 2163 static rule_res_t 2164 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2165 ip_stack_t *ipst) 2166 { 2167 if (!bc->cand_pref_eq_set) { 2168 bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr, 2169 bc->cand_mask, *dstinfo->dst_addr); 2170 bc->cand_pref_eq_set = B_TRUE; 2171 } 2172 2173 cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask, 2174 *dstinfo->dst_addr); 2175 cc->cand_pref_eq_set = B_TRUE; 2176 2177 if (bc->cand_pref_eq) { 2178 if (cc->cand_pref_eq) { 2179 if (!bc->cand_pref_len_set) { 2180 bc->cand_pref_len = 2181 ip_mask_to_plen_v6(&bc->cand_mask); 2182 bc->cand_pref_len_set = B_TRUE; 2183 } 2184 cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask); 2185 cc->cand_pref_len_set = B_TRUE; 2186 if (bc->cand_pref_len == cc->cand_pref_len) 2187 return (CAND_TIE); 2188 else if (bc->cand_pref_len > cc->cand_pref_len) 2189 return (CAND_AVOID); 2190 else 2191 return (CAND_PREFER); 2192 } else { 2193 return (CAND_AVOID); 2194 } 2195 } else { 2196 if (cc->cand_pref_eq) 2197 return (CAND_PREFER); 2198 else 2199 return (CAND_TIE); 2200 } 2201 } 2202 2203 /* 2204 * Prefer to use zone-specific addresses when possible instead of all-zones 2205 * addresses. 2206 */ 2207 /* ARGSUSED2 */ 2208 static rule_res_t 2209 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2210 ip_stack_t *ipst) 2211 { 2212 if ((bc->cand_zoneid == ALL_ZONES) == 2213 (cc->cand_zoneid == ALL_ZONES)) 2214 return (CAND_TIE); 2215 else if (cc->cand_zoneid == ALL_ZONES) 2216 return (CAND_AVOID); 2217 else 2218 return (CAND_PREFER); 2219 } 2220 2221 /* 2222 * Prefer to use DHCPv6 (first) and static addresses (second) when possible 2223 * instead of statelessly autoconfigured addresses. 2224 * 2225 * This is done after trying all other preferences (and before the final tie 2226 * breaker) so that, if all else is equal, we select addresses configured by 2227 * DHCPv6 over other addresses. We presume that DHCPv6 addresses, unlike 2228 * stateless autoconfigured addresses, are deliberately configured by an 2229 * administrator, and thus are correctly set up in DNS and network packet 2230 * filters. 2231 */ 2232 /* ARGSUSED2 */ 2233 static rule_res_t 2234 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2235 ip_stack_t *ipst) 2236 { 2237 #define ATYPE(x) \ 2238 ((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2 2239 int bcval = ATYPE(bc->cand_flags); 2240 int ccval = ATYPE(cc->cand_flags); 2241 #undef ATYPE 2242 2243 if (bcval == ccval) 2244 return (CAND_TIE); 2245 else if (ccval < bcval) 2246 return (CAND_PREFER); 2247 else 2248 return (CAND_AVOID); 2249 } 2250 2251 /* 2252 * Prefer source addresses with longer matching prefix with the destination. 2253 * We do the longest matching prefix calculation by doing an xor of both 2254 * addresses with the destination, and pick the address with the longest string 2255 * of leading zeros, as per CommonPrefixLen() defined in RFC 3484. 2256 */ 2257 /* ARGSUSED3 */ 2258 static rule_res_t 2259 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 2260 { 2261 /* 2262 * For IPMP, we always want to choose a random source address from 2263 * among any equally usable addresses, so always report a tie. 2264 */ 2265 if (IS_IPMP(dstinfo->dst_ill)) 2266 return (CAND_TIE); 2267 2268 if (!bc->cand_common_pref_set) { 2269 bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr, 2270 dstinfo->dst_addr); 2271 bc->cand_common_pref_set = B_TRUE; 2272 } 2273 2274 cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr, 2275 dstinfo->dst_addr); 2276 cc->cand_common_pref_set = B_TRUE; 2277 2278 if (bc->cand_common_pref == cc->cand_common_pref) 2279 return (CAND_TIE); 2280 else if (bc->cand_common_pref > cc->cand_common_pref) 2281 return (CAND_AVOID); 2282 else 2283 return (CAND_PREFER); 2284 } 2285 2286 /* 2287 * Last rule: we must pick something, so just prefer the current best 2288 * candidate. 2289 */ 2290 /* ARGSUSED */ 2291 static rule_res_t 2292 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2293 ip_stack_t *ipst) 2294 { 2295 return (CAND_AVOID); 2296 } 2297 2298 /* 2299 * Determine the best source address given a destination address and a 2300 * destination ill. If no suitable source address is found, it returns 2301 * NULL. If there is a usable address pointed to by the usesrc 2302 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 2303 * fine grained (i.e per interface) 2304 * 2305 * This implementation is based on the "Default Address Selection for IPv6" 2306 * specification produced by the IETF IPv6 working group. It has been 2307 * implemented so that the list of addresses is only traversed once (the 2308 * specification's algorithm could traverse the list of addresses once for 2309 * every rule). 2310 * 2311 * The restrict_ill argument restricts the algorithm to choose a source 2312 * address that is assigned to the destination ill. This is used when 2313 * the destination address is a link-local or multicast address, and when 2314 * ipv6_strict_dst_multihoming is turned on. 2315 * 2316 * src_prefs is the caller's set of source address preferences. If source 2317 * address selection is being called to determine the source address of a 2318 * connected socket (from ip_bind_connected_v6()), then the preferences are 2319 * taken from conn_src_preferences. These preferences can be set on a 2320 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 2321 * preference currently implemented is for rfc3041 temporary addresses. 2322 */ 2323 ipif_t * 2324 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 2325 boolean_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid) 2326 { 2327 dstinfo_t dstinfo; 2328 char dstr[INET6_ADDRSTRLEN]; 2329 char sstr[INET6_ADDRSTRLEN]; 2330 ipif_t *ipif, *start_ipif, *next_ipif; 2331 ill_t *ill, *usesrc_ill = NULL, *ipmp_ill = NULL; 2332 ill_walk_context_t ctx; 2333 cand_t best_c; /* The best candidate */ 2334 cand_t curr_c; /* The current candidate */ 2335 uint_t index; 2336 boolean_t first_candidate = B_TRUE; 2337 rule_res_t rule_result; 2338 tsol_tpc_t *src_rhtp, *dst_rhtp; 2339 ip_stack_t *ipst = dstill->ill_ipst; 2340 2341 /* 2342 * The list of ordering rules. They are applied in the order they 2343 * appear in the list. 2344 * 2345 * Solaris doesn't currently support Mobile IPv6, so there's no 2346 * rule_mipv6 corresponding to rule 4 in the specification. 2347 */ 2348 rulef_t rules[] = { 2349 rule_isdst, 2350 rule_scope, 2351 rule_deprecated, 2352 rule_preferred, 2353 rule_interface, 2354 rule_label, 2355 rule_temporary, 2356 rule_ifprefix, /* local rules after this */ 2357 rule_zone_specific, 2358 rule_addr_type, 2359 rule_prefix, /* local rules before this */ 2360 rule_must_be_last, /* must always be last */ 2361 NULL 2362 }; 2363 2364 ASSERT(dstill->ill_isv6); 2365 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 2366 2367 /* 2368 * Check if there is a usable src address pointed to by the 2369 * usesrc ifindex. This has higher precedence since it is 2370 * finer grained (i.e per interface) v/s being system wide. 2371 */ 2372 if (dstill->ill_usesrc_ifindex != 0) { 2373 if ((usesrc_ill = 2374 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 2375 NULL, NULL, NULL, NULL, ipst)) != NULL) { 2376 dstinfo.dst_ill = usesrc_ill; 2377 } else { 2378 return (NULL); 2379 } 2380 } else if (IS_UNDER_IPMP(dstill)) { 2381 /* 2382 * Test addresses should never be used for source address 2383 * selection, so if we were passed an underlying ill, switch 2384 * to the IPMP meta-interface. 2385 */ 2386 if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(dstill)) != NULL) 2387 dstinfo.dst_ill = ipmp_ill; 2388 else 2389 return (NULL); 2390 } else { 2391 dstinfo.dst_ill = dstill; 2392 } 2393 2394 /* 2395 * If we're dealing with an unlabeled destination on a labeled system, 2396 * make sure that we ignore source addresses that are incompatible with 2397 * the destination's default label. That destination's default label 2398 * must dominate the minimum label on the source address. 2399 * 2400 * (Note that this has to do with Trusted Solaris. It's not related to 2401 * the labels described by ip6_asp_lookup.) 2402 */ 2403 dst_rhtp = NULL; 2404 if (is_system_labeled()) { 2405 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE); 2406 if (dst_rhtp == NULL) 2407 return (NULL); 2408 if (dst_rhtp->tpc_tp.host_type != UNLABELED) { 2409 TPC_RELE(dst_rhtp); 2410 dst_rhtp = NULL; 2411 } 2412 } 2413 2414 dstinfo.dst_addr = dst; 2415 dstinfo.dst_scope = ip_addr_scope_v6(dst); 2416 dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst); 2417 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 2418 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2419 /* 2420 * Section three of the I-D states that for multicast and 2421 * link-local destinations, the candidate set must be restricted to 2422 * an interface that is on the same link as the outgoing interface. 2423 * Also, when ipv6_strict_dst_multihoming is turned on, always 2424 * restrict the source address to the destination link as doing 2425 * otherwise will almost certainly cause problems. 2426 */ 2427 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 2428 ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) { 2429 dstinfo.dst_restrict_ill = B_TRUE; 2430 } else { 2431 dstinfo.dst_restrict_ill = restrict_ill; 2432 } 2433 2434 bzero(&best_c, sizeof (cand_t)); 2435 2436 /* 2437 * Take a pass through the list of IPv6 interfaces to choose the best 2438 * possible source address. If restrict_ill is set, just use dst_ill. 2439 */ 2440 if (dstinfo.dst_restrict_ill) 2441 ill = dstinfo.dst_ill; 2442 else 2443 ill = ILL_START_WALK_V6(&ctx, ipst); 2444 2445 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 2446 ASSERT(ill->ill_isv6); 2447 2448 /* 2449 * Test addresses should never be used for source address 2450 * selection, so ignore underlying ills. 2451 */ 2452 if (IS_UNDER_IPMP(ill)) 2453 continue; 2454 2455 if (ill->ill_ipif == NULL) 2456 continue; 2457 /* 2458 * For source address selection, we treat the ipif list as 2459 * circular and continue until we get back to where we 2460 * started. This allows IPMP to vary source address selection 2461 * (which improves inbound load spreading) by caching its last 2462 * ending point and starting from there. NOTE: we don't have 2463 * to worry about ill_src_ipif changing ills since that can't 2464 * happen on the IPMP ill. 2465 */ 2466 start_ipif = ill->ill_ipif; 2467 if (IS_IPMP(ill) && ill->ill_src_ipif != NULL) 2468 start_ipif = ill->ill_src_ipif; 2469 2470 ipif = start_ipif; 2471 do { 2472 if ((next_ipif = ipif->ipif_next) == NULL) 2473 next_ipif = ill->ill_ipif; 2474 2475 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 2476 continue; 2477 2478 if (zoneid != ALL_ZONES && 2479 ipif->ipif_zoneid != zoneid && 2480 ipif->ipif_zoneid != ALL_ZONES) 2481 continue; 2482 2483 /* 2484 * Check compatibility of local address for 2485 * destination's default label if we're on a labeled 2486 * system. Incompatible addresses can't be used at 2487 * all and must be skipped over. 2488 */ 2489 if (dst_rhtp != NULL) { 2490 boolean_t incompat; 2491 2492 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr, 2493 IPV6_VERSION, B_FALSE); 2494 if (src_rhtp == NULL) 2495 continue; 2496 incompat = 2497 src_rhtp->tpc_tp.host_type != SUN_CIPSO || 2498 src_rhtp->tpc_tp.tp_doi != 2499 dst_rhtp->tpc_tp.tp_doi || 2500 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label, 2501 &src_rhtp->tpc_tp.tp_sl_range_cipso) && 2502 !blinlset(&dst_rhtp->tpc_tp.tp_def_label, 2503 src_rhtp->tpc_tp.tp_sl_set_cipso)); 2504 TPC_RELE(src_rhtp); 2505 if (incompat) 2506 continue; 2507 } 2508 2509 if (first_candidate) { 2510 /* 2511 * This is first valid address in the list. 2512 * It is automatically the best candidate 2513 * so far. 2514 */ 2515 best_c.cand_ipif = ipif; 2516 first_candidate = B_FALSE; 2517 continue; 2518 } 2519 2520 bzero(&curr_c, sizeof (cand_t)); 2521 curr_c.cand_ipif = ipif; 2522 2523 /* 2524 * Compare this current candidate (curr_c) with the 2525 * best candidate (best_c) by applying the 2526 * comparison rules in order until one breaks the 2527 * tie. 2528 */ 2529 for (index = 0; rules[index] != NULL; index++) { 2530 /* Apply a comparison rule. */ 2531 rule_result = (rules[index])(&best_c, &curr_c, 2532 &dstinfo, ipst); 2533 if (rule_result == CAND_AVOID) { 2534 /* 2535 * The best candidate is still the 2536 * best candidate. Forget about 2537 * this current candidate and go on 2538 * to the next one. 2539 */ 2540 break; 2541 } else if (rule_result == CAND_PREFER) { 2542 /* 2543 * This candidate is prefered. It 2544 * becomes the best candidate so 2545 * far. Go on to the next address. 2546 */ 2547 best_c = curr_c; 2548 break; 2549 } 2550 /* We have a tie, apply the next rule. */ 2551 } 2552 2553 /* 2554 * The last rule must be a tie breaker rule and 2555 * must never produce a tie. At this point, the 2556 * candidate should have either been rejected, or 2557 * have been prefered as the best candidate so far. 2558 */ 2559 ASSERT(rule_result != CAND_TIE); 2560 } while ((ipif = next_ipif) != start_ipif); 2561 2562 /* 2563 * For IPMP, update the source ipif rotor to the next ipif, 2564 * provided we can look it up. (We must not use it if it's 2565 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after 2566 * ipif_free() checked ill_src_ipif.) 2567 */ 2568 if (IS_IPMP(ill) && ipif != NULL) { 2569 mutex_enter(&ipif->ipif_ill->ill_lock); 2570 next_ipif = ipif->ipif_next; 2571 if (next_ipif != NULL && IPIF_CAN_LOOKUP(next_ipif)) 2572 ill->ill_src_ipif = next_ipif; 2573 else 2574 ill->ill_src_ipif = NULL; 2575 mutex_exit(&ipif->ipif_ill->ill_lock); 2576 } 2577 2578 /* 2579 * Only one ill to consider if dst_restrict_ill is set. 2580 */ 2581 if (dstinfo.dst_restrict_ill) 2582 break; 2583 } 2584 2585 ipif = best_c.cand_ipif; 2586 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2587 dstinfo.dst_ill->ill_name, 2588 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2589 (ipif == NULL ? "NULL" : 2590 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2591 2592 if (usesrc_ill != NULL) 2593 ill_refrele(usesrc_ill); 2594 2595 if (ipmp_ill != NULL) 2596 ill_refrele(ipmp_ill); 2597 2598 if (dst_rhtp != NULL) 2599 TPC_RELE(dst_rhtp); 2600 2601 if (ipif == NULL) { 2602 rw_exit(&ipst->ips_ill_g_lock); 2603 return (NULL); 2604 } 2605 2606 mutex_enter(&ipif->ipif_ill->ill_lock); 2607 if (IPIF_CAN_LOOKUP(ipif)) { 2608 ipif_refhold_locked(ipif); 2609 mutex_exit(&ipif->ipif_ill->ill_lock); 2610 rw_exit(&ipst->ips_ill_g_lock); 2611 return (ipif); 2612 } 2613 mutex_exit(&ipif->ipif_ill->ill_lock); 2614 rw_exit(&ipst->ips_ill_g_lock); 2615 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2616 " returning null \n", (void *)ipif)); 2617 2618 return (NULL); 2619 } 2620 2621 /* 2622 * If old_ipif is not NULL, see if ipif was derived from old 2623 * ipif and if so, recreate the interface route by re-doing 2624 * source address selection. This happens when ipif_down -> 2625 * ipif_update_other_ipifs calls us. 2626 * 2627 * If old_ipif is NULL, just redo the source address selection 2628 * if needed. This happens when ipif_up_done_v6 calls us. 2629 */ 2630 void 2631 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif) 2632 { 2633 ire_t *ire; 2634 ire_t *ipif_ire; 2635 queue_t *stq; 2636 ill_t *ill; 2637 ipif_t *nipif = NULL; 2638 boolean_t nipif_refheld = B_FALSE; 2639 boolean_t ip6_asp_table_held = B_FALSE; 2640 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 2641 2642 ill = ipif->ipif_ill; 2643 2644 if (!(ipif->ipif_flags & 2645 (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) { 2646 /* 2647 * Can't possibly have borrowed the source 2648 * from old_ipif. 2649 */ 2650 return; 2651 } 2652 2653 /* 2654 * Is there any work to be done? No work if the address 2655 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST ( 2656 * ipif_select_source_v6() does not borrow addresses from 2657 * NOLOCAL and ANYCAST interfaces). 2658 */ 2659 if ((old_ipif != NULL) && 2660 ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) || 2661 (old_ipif->ipif_ill->ill_wq == NULL) || 2662 (old_ipif->ipif_flags & 2663 (IPIF_NOLOCAL|IPIF_ANYCAST)))) { 2664 return; 2665 } 2666 2667 /* 2668 * Perform the same checks as when creating the 2669 * IRE_INTERFACE in ipif_up_done_v6. 2670 */ 2671 if (!(ipif->ipif_flags & IPIF_UP)) 2672 return; 2673 2674 if ((ipif->ipif_flags & IPIF_NOXMIT)) 2675 return; 2676 2677 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2678 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask)) 2679 return; 2680 2681 /* 2682 * We know that ipif uses some other source for its 2683 * IRE_INTERFACE. Is it using the source of this 2684 * old_ipif? 2685 */ 2686 ipif_ire = ipif_to_ire_v6(ipif); 2687 if (ipif_ire == NULL) 2688 return; 2689 2690 if (old_ipif != NULL && 2691 !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr, 2692 &ipif_ire->ire_src_addr_v6)) { 2693 ire_refrele(ipif_ire); 2694 return; 2695 } 2696 2697 if (ip_debug > 2) { 2698 /* ip1dbg */ 2699 pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE" 2700 " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6); 2701 } 2702 2703 stq = ipif_ire->ire_stq; 2704 2705 /* 2706 * Can't use our source address. Select a different source address 2707 * for the IRE_INTERFACE. We restrict interface route source 2708 * address selection to ipif's assigned to the same link as the 2709 * interface. 2710 */ 2711 if (ip6_asp_can_lookup(ipst)) { 2712 ip6_asp_table_held = B_TRUE; 2713 nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet, 2714 B_TRUE, IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid); 2715 } 2716 if (nipif == NULL) { 2717 /* Last resort - all ipif's have IPIF_NOLOCAL */ 2718 nipif = ipif; 2719 } else { 2720 nipif_refheld = B_TRUE; 2721 } 2722 2723 ire = ire_create_v6( 2724 &ipif->ipif_v6subnet, /* dest pref */ 2725 &ipif->ipif_v6net_mask, /* mask */ 2726 &nipif->ipif_v6src_addr, /* src addr */ 2727 NULL, /* no gateway */ 2728 &ipif->ipif_mtu, /* max frag */ 2729 NULL, /* no src nce */ 2730 NULL, /* no recv from queue */ 2731 stq, /* send-to queue */ 2732 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2733 ipif, 2734 NULL, 2735 0, 2736 0, 2737 0, 2738 &ire_uinfo_null, 2739 NULL, 2740 NULL, 2741 ipst); 2742 2743 if (ire != NULL) { 2744 ire_t *ret_ire; 2745 int error; 2746 2747 /* 2748 * We don't need ipif_ire anymore. We need to delete 2749 * before we add so that ire_add does not detect 2750 * duplicates. 2751 */ 2752 ire_delete(ipif_ire); 2753 ret_ire = ire; 2754 error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE); 2755 ASSERT(error == 0); 2756 ASSERT(ret_ire == ire); 2757 if (ret_ire != NULL) { 2758 /* Held in ire_add */ 2759 ire_refrele(ret_ire); 2760 } 2761 } 2762 /* 2763 * Either we are falling through from above or could not 2764 * allocate a replacement. 2765 */ 2766 ire_refrele(ipif_ire); 2767 if (ip6_asp_table_held) 2768 ip6_asp_table_refrele(ipst); 2769 if (nipif_refheld) 2770 ipif_refrele(nipif); 2771 } 2772 2773 /* 2774 * This old_ipif is going away. 2775 * 2776 * Determine if any other ipif's are using our address as 2777 * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or 2778 * IPIF_DEPRECATED). 2779 * Find the IRE_INTERFACE for such ipif's and recreate them 2780 * to use an different source address following the rules in 2781 * ipif_up_done_v6. 2782 */ 2783 void 2784 ipif_update_other_ipifs_v6(ipif_t *old_ipif) 2785 { 2786 ipif_t *ipif; 2787 ill_t *ill; 2788 char buf[INET6_ADDRSTRLEN]; 2789 2790 ASSERT(IAM_WRITER_IPIF(old_ipif)); 2791 2792 ill = old_ipif->ipif_ill; 2793 2794 ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n", 2795 ill->ill_name, 2796 inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr, 2797 buf, sizeof (buf)))); 2798 2799 for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) { 2800 if (ipif != old_ipif) 2801 ipif_recreate_interface_routes_v6(old_ipif, ipif); 2802 } 2803 } 2804 2805 /* 2806 * Perform an attach and bind to get phys addr plus info_req for 2807 * the physical device. 2808 * q and mp represents an ioctl which will be queued waiting for 2809 * completion of the DLPI message exchange. 2810 * MUST be called on an ill queue. Can not set conn_pending_ill for that 2811 * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q. 2812 * 2813 * Returns EINPROGRESS when mp has been consumed by queueing it on 2814 * ill_pending_mp and the ioctl will complete in ip_rput. 2815 */ 2816 int 2817 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2818 { 2819 mblk_t *v6token_mp = NULL; 2820 mblk_t *v6lla_mp = NULL; 2821 mblk_t *phys_mp = NULL; 2822 mblk_t *info_mp = NULL; 2823 mblk_t *attach_mp = NULL; 2824 mblk_t *bind_mp = NULL; 2825 mblk_t *unbind_mp = NULL; 2826 mblk_t *notify_mp = NULL; 2827 2828 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2829 ASSERT(ill->ill_dlpi_style_set); 2830 ASSERT(WR(q)->q_next != NULL); 2831 2832 if (ill->ill_isv6) { 2833 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2834 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2835 if (v6token_mp == NULL) 2836 goto bad; 2837 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2838 DL_IPV6_TOKEN; 2839 2840 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2841 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2842 if (v6lla_mp == NULL) 2843 goto bad; 2844 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2845 DL_IPV6_LINK_LAYER_ADDR; 2846 } 2847 2848 /* 2849 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2850 */ 2851 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2852 DL_NOTIFY_REQ); 2853 if (notify_mp == NULL) 2854 goto bad; 2855 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2856 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2857 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG | 2858 DL_NOTE_PROMISC_ON_PHYS | DL_NOTE_PROMISC_OFF_PHYS | 2859 DL_NOTE_REPLUMB); 2860 2861 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2862 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2863 if (phys_mp == NULL) 2864 goto bad; 2865 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2866 DL_CURR_PHYS_ADDR; 2867 2868 info_mp = ip_dlpi_alloc( 2869 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2870 DL_INFO_REQ); 2871 if (info_mp == NULL) 2872 goto bad; 2873 2874 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2875 DL_BIND_REQ); 2876 if (bind_mp == NULL) 2877 goto bad; 2878 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2879 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2880 2881 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2882 if (unbind_mp == NULL) 2883 goto bad; 2884 2885 /* If we need to attach, pre-alloc and initialize the mblk */ 2886 if (ill->ill_needs_attach) { 2887 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2888 DL_ATTACH_REQ); 2889 if (attach_mp == NULL) 2890 goto bad; 2891 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2892 } 2893 2894 /* 2895 * Here we are going to delay the ioctl ack until after 2896 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2897 * original ioctl message before sending the requests 2898 */ 2899 mutex_enter(&ill->ill_lock); 2900 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2901 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2902 /* 2903 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2904 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2905 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2906 */ 2907 ill->ill_phys_addr_pend = 0; 2908 mutex_exit(&ill->ill_lock); 2909 2910 if (attach_mp != NULL) { 2911 ip1dbg(("ill_dl_phys: attach\n")); 2912 ill_dlpi_send(ill, attach_mp); 2913 } 2914 ill_dlpi_send(ill, bind_mp); 2915 ill_dlpi_send(ill, info_mp); 2916 if (ill->ill_isv6) { 2917 ill_dlpi_send(ill, v6token_mp); 2918 ill_dlpi_send(ill, v6lla_mp); 2919 } 2920 ill_dlpi_send(ill, phys_mp); 2921 ill_dlpi_send(ill, notify_mp); 2922 ill_dlpi_send(ill, unbind_mp); 2923 2924 /* 2925 * This operation will complete in ip_rput_dlpi_writer with either 2926 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2927 */ 2928 return (EINPROGRESS); 2929 bad: 2930 freemsg(v6token_mp); 2931 freemsg(v6lla_mp); 2932 freemsg(phys_mp); 2933 freemsg(info_mp); 2934 freemsg(attach_mp); 2935 freemsg(bind_mp); 2936 freemsg(unbind_mp); 2937 freemsg(notify_mp); 2938 return (ENOMEM); 2939 } 2940 2941 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2942 2943 /* 2944 * DLPI is up. 2945 * Create all the IREs associated with an interface bring up multicast. 2946 * Set the interface flag and finish other initialization 2947 * that potentially had to be differed to after DL_BIND_ACK. 2948 */ 2949 int 2950 ipif_up_done_v6(ipif_t *ipif) 2951 { 2952 ire_t *ire_array[20]; 2953 ire_t **irep = ire_array; 2954 ire_t **irep1; 2955 ill_t *ill = ipif->ipif_ill; 2956 queue_t *stq; 2957 in6_addr_t v6addr; 2958 in6_addr_t route_mask; 2959 ipif_t *src_ipif = NULL; 2960 ipif_t *tmp_ipif; 2961 boolean_t flush_ire_cache = B_TRUE; 2962 int err; 2963 char buf[INET6_ADDRSTRLEN]; 2964 ire_t **ipif_saved_irep = NULL; 2965 int ipif_saved_ire_cnt; 2966 int cnt; 2967 boolean_t src_ipif_held = B_FALSE; 2968 boolean_t loopback = B_FALSE; 2969 boolean_t ip6_asp_table_held = B_FALSE; 2970 ip_stack_t *ipst = ill->ill_ipst; 2971 2972 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2973 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2974 2975 /* Check if this is a loopback interface */ 2976 if (ipif->ipif_ill->ill_wq == NULL) 2977 loopback = B_TRUE; 2978 2979 ASSERT(ipif->ipif_isv6); 2980 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2981 2982 /* 2983 * If all other interfaces for this ill are down or DEPRECATED, 2984 * or otherwise unsuitable for source address selection, remove 2985 * any IRE_CACHE entries for this ill to make sure source 2986 * address selection gets to take this new ipif into account. 2987 * No need to hold ill_lock while traversing the ipif list since 2988 * we are writer 2989 */ 2990 for (tmp_ipif = ill->ill_ipif; tmp_ipif; 2991 tmp_ipif = tmp_ipif->ipif_next) { 2992 if (((tmp_ipif->ipif_flags & 2993 (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) || 2994 !(tmp_ipif->ipif_flags & IPIF_UP)) || 2995 (tmp_ipif == ipif)) 2996 continue; 2997 /* first useable pre-existing interface */ 2998 flush_ire_cache = B_FALSE; 2999 break; 3000 } 3001 if (flush_ire_cache) 3002 ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE, 3003 IRE_CACHE, ill_ipif_cache_delete, ill, ill); 3004 3005 /* 3006 * Figure out which way the send-to queue should go. Only 3007 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here. 3008 */ 3009 switch (ill->ill_net_type) { 3010 case IRE_IF_RESOLVER: 3011 stq = ill->ill_rq; 3012 break; 3013 case IRE_IF_NORESOLVER: 3014 case IRE_LOOPBACK: 3015 stq = ill->ill_wq; 3016 break; 3017 default: 3018 return (EINVAL); 3019 } 3020 3021 if (IS_LOOPBACK(ill)) { 3022 /* 3023 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 3024 * ipif_lookup_on_name(), but in the case of zones we can have 3025 * several loopback addresses on lo0. So all the interfaces with 3026 * loopback addresses need to be marked IRE_LOOPBACK. 3027 */ 3028 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 3029 ipif->ipif_ire_type = IRE_LOOPBACK; 3030 else 3031 ipif->ipif_ire_type = IRE_LOCAL; 3032 } 3033 3034 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST) || 3035 ((ipif->ipif_flags & IPIF_DEPRECATED) && 3036 !(ipif->ipif_flags & IPIF_NOFAILOVER))) { 3037 /* 3038 * Can't use our source address. Select a different 3039 * source address for the IRE_INTERFACE and IRE_LOCAL 3040 */ 3041 if (ip6_asp_can_lookup(ipst)) { 3042 ip6_asp_table_held = B_TRUE; 3043 src_ipif = ipif_select_source_v6(ipif->ipif_ill, 3044 &ipif->ipif_v6subnet, B_FALSE, 3045 IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid); 3046 } 3047 if (src_ipif == NULL) 3048 src_ipif = ipif; /* Last resort */ 3049 else 3050 src_ipif_held = B_TRUE; 3051 } else { 3052 src_ipif = ipif; 3053 } 3054 3055 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 3056 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 3057 3058 /* 3059 * If we're on a labeled system then make sure that zone- 3060 * private addresses have proper remote host database entries. 3061 */ 3062 if (is_system_labeled() && 3063 ipif->ipif_ire_type != IRE_LOOPBACK) { 3064 if (ip6opt_ls == 0) { 3065 cmn_err(CE_WARN, "IPv6 not enabled " 3066 "via /etc/system"); 3067 return (EINVAL); 3068 } 3069 if (!tsol_check_interface_address(ipif)) 3070 return (EINVAL); 3071 } 3072 3073 /* Register the source address for __sin6_src_id */ 3074 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 3075 ipif->ipif_zoneid, ipst); 3076 if (err != 0) { 3077 ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err)); 3078 if (src_ipif_held) 3079 ipif_refrele(src_ipif); 3080 if (ip6_asp_table_held) 3081 ip6_asp_table_refrele(ipst); 3082 return (err); 3083 } 3084 /* 3085 * If the interface address is set, create the LOCAL 3086 * or LOOPBACK IRE. 3087 */ 3088 ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n", 3089 ipif->ipif_ire_type, 3090 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 3091 buf, sizeof (buf)))); 3092 3093 *irep++ = ire_create_v6( 3094 &ipif->ipif_v6lcl_addr, /* dest address */ 3095 &ipv6_all_ones, /* mask */ 3096 &src_ipif->ipif_v6src_addr, /* source address */ 3097 NULL, /* no gateway */ 3098 &ip_loopback_mtu_v6plus, /* max frag size */ 3099 NULL, 3100 ipif->ipif_rq, /* recv-from queue */ 3101 NULL, /* no send-to queue */ 3102 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 3103 ipif, /* interface */ 3104 NULL, 3105 0, 3106 0, 3107 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 3108 &ire_uinfo_null, 3109 NULL, 3110 NULL, 3111 ipst); 3112 } 3113 3114 /* 3115 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. 3116 * Note that atun interfaces have an all-zero ipif_v6subnet. 3117 * Thus we allow a zero subnet as long as the mask is non-zero. 3118 */ 3119 if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) && 3120 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 3121 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 3122 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 3123 v6addr = ipif->ipif_v6subnet; 3124 3125 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 3126 route_mask = ipv6_all_ones; 3127 } else { 3128 route_mask = ipif->ipif_v6net_mask; 3129 } 3130 3131 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n", 3132 ill->ill_net_type, 3133 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 3134 3135 *irep++ = ire_create_v6( 3136 &v6addr, /* dest pref */ 3137 &route_mask, /* mask */ 3138 &src_ipif->ipif_v6src_addr, /* src addr */ 3139 NULL, /* no gateway */ 3140 &ipif->ipif_mtu, /* max frag */ 3141 NULL, /* no src nce */ 3142 NULL, /* no recv from queue */ 3143 stq, /* send-to queue */ 3144 ill->ill_net_type, /* IF_[NO]RESOLVER */ 3145 ipif, 3146 NULL, 3147 0, 3148 0, 3149 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 3150 &ire_uinfo_null, 3151 NULL, 3152 NULL, 3153 ipst); 3154 } 3155 3156 /* 3157 * Setup 2002::/16 route, if this interface is a 6to4 tunnel 3158 */ 3159 if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) && 3160 (ill->ill_is_6to4tun)) { 3161 /* 3162 * Destination address is 2002::/16 3163 */ 3164 #ifdef _BIG_ENDIAN 3165 const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 }; 3166 const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 }; 3167 #else 3168 const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 }; 3169 const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 }; 3170 #endif /* _BIG_ENDIAN */ 3171 char buf2[INET6_ADDRSTRLEN]; 3172 ire_t *isdup; 3173 in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr; 3174 3175 /* 3176 * check to see if this route has already been added for 3177 * this tunnel interface. 3178 */ 3179 isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0, 3180 IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL, 3181 (MATCH_IRE_SRC | MATCH_IRE_MASK), ipst); 3182 3183 if (isdup == NULL) { 3184 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s", 3185 IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr, 3186 buf2, sizeof (buf2)))); 3187 3188 *irep++ = ire_create_v6( 3189 &prefix_addr, /* 2002:: */ 3190 &prefix_mask, /* ffff:: */ 3191 &ipif->ipif_v6lcl_addr, /* src addr */ 3192 NULL, /* gateway */ 3193 &ipif->ipif_mtu, /* max_frag */ 3194 NULL, /* no src nce */ 3195 NULL, /* no rfq */ 3196 ill->ill_wq, /* stq */ 3197 IRE_IF_NORESOLVER, /* type */ 3198 ipif, /* interface */ 3199 NULL, /* v6cmask */ 3200 0, 3201 0, 3202 RTF_UP, 3203 &ire_uinfo_null, 3204 NULL, 3205 NULL, 3206 ipst); 3207 } else { 3208 ire_refrele(isdup); 3209 } 3210 } 3211 3212 /* If an earlier ire_create failed, get out now */ 3213 for (irep1 = irep; irep1 > ire_array; ) { 3214 irep1--; 3215 if (*irep1 == NULL) { 3216 ip1dbg(("ipif_up_done_v6: NULL ire found in" 3217 " ire_array\n")); 3218 err = ENOMEM; 3219 goto bad; 3220 } 3221 } 3222 3223 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 3224 3225 /* 3226 * Need to atomically check for IP address availability under 3227 * ip_addr_avail_lock. ill_g_lock is held as reader to ensure no new 3228 * ills or new ipifs can be added while we are checking availability. 3229 */ 3230 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 3231 mutex_enter(&ipst->ips_ip_addr_avail_lock); 3232 ill->ill_ipif_up_count++; 3233 ipif->ipif_flags |= IPIF_UP; 3234 err = ip_addr_availability_check(ipif); 3235 mutex_exit(&ipst->ips_ip_addr_avail_lock); 3236 rw_exit(&ipst->ips_ill_g_lock); 3237 3238 if (err != 0) { 3239 /* 3240 * Our address may already be up on the same ill. In this case, 3241 * the external resolver entry for our ipif replaced the one for 3242 * the other ipif. So we don't want to delete it (otherwise the 3243 * other ipif would be unable to send packets). 3244 * ip_addr_availability_check() identifies this case for us and 3245 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL 3246 * which is the expected error code. 3247 * 3248 * Note that, for the non-XRESOLV case, ipif_ndp_down() will 3249 * only delete the nce in the case when the nce_ipif_cnt drops 3250 * to 0. 3251 */ 3252 if (err == EADDRINUSE) { 3253 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) { 3254 freemsg(ipif->ipif_arp_del_mp); 3255 ipif->ipif_arp_del_mp = NULL; 3256 } 3257 err = EADDRNOTAVAIL; 3258 } 3259 ill->ill_ipif_up_count--; 3260 ipif->ipif_flags &= ~IPIF_UP; 3261 goto bad; 3262 } 3263 3264 /* 3265 * Add in all newly created IREs. 3266 * 3267 * NOTE : We refrele the ire though we may branch to "bad" 3268 * later on where we do ire_delete. This is okay 3269 * because nobody can delete it as we are running 3270 * exclusively. 3271 */ 3272 for (irep1 = irep; irep1 > ire_array; ) { 3273 irep1--; 3274 /* Shouldn't be adding any bcast ire's */ 3275 ASSERT((*irep1)->ire_type != IRE_BROADCAST); 3276 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 3277 /* 3278 * refheld by ire_add. refele towards the end of the func 3279 */ 3280 (void) ire_add(irep1, NULL, NULL, NULL, B_FALSE); 3281 } 3282 if (ip6_asp_table_held) { 3283 ip6_asp_table_refrele(ipst); 3284 ip6_asp_table_held = B_FALSE; 3285 } 3286 3287 /* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */ 3288 ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt; 3289 ipif_saved_irep = ipif_recover_ire_v6(ipif); 3290 3291 if (ill->ill_need_recover_multicast) { 3292 /* 3293 * Need to recover all multicast memberships in the driver. 3294 * This had to be deferred until we had attached. 3295 */ 3296 ill_recover_multicast(ill); 3297 } 3298 3299 if (ill->ill_ipif_up_count == 1) { 3300 /* 3301 * Since the interface is now up, it may now be active. 3302 */ 3303 if (IS_UNDER_IPMP(ill)) 3304 ipmp_ill_refresh_active(ill); 3305 } 3306 3307 /* Join the allhosts multicast address and the solicited node MC */ 3308 ipif_multicast_up(ipif); 3309 3310 /* 3311 * See if anybody else would benefit from our new ipif. 3312 */ 3313 if (!loopback && 3314 !(ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) { 3315 ill_update_source_selection(ill); 3316 } 3317 3318 for (irep1 = irep; irep1 > ire_array; ) { 3319 irep1--; 3320 if (*irep1 != NULL) { 3321 /* was held in ire_add */ 3322 ire_refrele(*irep1); 3323 } 3324 } 3325 3326 cnt = ipif_saved_ire_cnt; 3327 for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) { 3328 if (*irep1 != NULL) { 3329 /* was held in ire_add */ 3330 ire_refrele(*irep1); 3331 } 3332 } 3333 3334 if (ipif->ipif_addr_ready) 3335 ipif_up_notify(ipif); 3336 3337 if (ipif_saved_irep != NULL) { 3338 kmem_free(ipif_saved_irep, 3339 ipif_saved_ire_cnt * sizeof (ire_t *)); 3340 } 3341 3342 if (src_ipif_held) 3343 ipif_refrele(src_ipif); 3344 3345 return (0); 3346 3347 bad: 3348 if (ip6_asp_table_held) 3349 ip6_asp_table_refrele(ipst); 3350 3351 while (irep > ire_array) { 3352 irep--; 3353 if (*irep != NULL) 3354 ire_delete(*irep); 3355 } 3356 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst); 3357 3358 if (ipif_saved_irep != NULL) { 3359 kmem_free(ipif_saved_irep, 3360 ipif_saved_ire_cnt * sizeof (ire_t *)); 3361 } 3362 if (src_ipif_held) 3363 ipif_refrele(src_ipif); 3364 3365 ipif_ndp_down(ipif); 3366 ipif_resolver_down(ipif); 3367 3368 return (err); 3369 } 3370 3371 /* 3372 * Delete an ND entry and the corresponding IRE_CACHE entry if it exists. 3373 */ 3374 /* ARGSUSED */ 3375 int 3376 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3377 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3378 { 3379 sin6_t *sin6; 3380 nce_t *nce; 3381 struct lifreq *lifr; 3382 lif_nd_req_t *lnr; 3383 ill_t *ill = ipif->ipif_ill; 3384 ire_t *ire; 3385 3386 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3387 lnr = &lifr->lifr_nd; 3388 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3389 if (ipif->ipif_id != 0) 3390 return (EINVAL); 3391 3392 if (!ipif->ipif_isv6) 3393 return (EINVAL); 3394 3395 if (lnr->lnr_addr.ss_family != AF_INET6) 3396 return (EAFNOSUPPORT); 3397 3398 sin6 = (sin6_t *)&lnr->lnr_addr; 3399 3400 /* 3401 * Since ND mappings must be consistent across an IPMP group, prohibit 3402 * deleting ND mappings on underlying interfaces. Also, since ND 3403 * mappings for IPMP data addresses are owned by IP itself, prohibit 3404 * deleting them. 3405 */ 3406 if (IS_UNDER_IPMP(ill)) 3407 return (EPERM); 3408 3409 if (IS_IPMP(ill)) { 3410 ire = ire_ctable_lookup_v6(&sin6->sin6_addr, NULL, IRE_LOCAL, 3411 ipif, ALL_ZONES, NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL, 3412 ill->ill_ipst); 3413 if (ire != NULL) { 3414 ire_refrele(ire); 3415 return (EPERM); 3416 } 3417 } 3418 3419 /* See comment in ndp_query() regarding IS_IPMP(ill) usage */ 3420 nce = ndp_lookup_v6(ill, IS_IPMP(ill), &sin6->sin6_addr, B_FALSE); 3421 if (nce == NULL) 3422 return (ESRCH); 3423 ndp_delete(nce); 3424 NCE_REFRELE(nce); 3425 return (0); 3426 } 3427 3428 /* 3429 * Return nbr cache info. 3430 */ 3431 /* ARGSUSED */ 3432 int 3433 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3434 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3435 { 3436 ill_t *ill = ipif->ipif_ill; 3437 struct lifreq *lifr; 3438 lif_nd_req_t *lnr; 3439 3440 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3441 lnr = &lifr->lifr_nd; 3442 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3443 if (ipif->ipif_id != 0) 3444 return (EINVAL); 3445 3446 if (!ipif->ipif_isv6) 3447 return (EINVAL); 3448 3449 if (lnr->lnr_addr.ss_family != AF_INET6) 3450 return (EAFNOSUPPORT); 3451 3452 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 3453 return (EINVAL); 3454 3455 return (ndp_query(ill, lnr)); 3456 } 3457 3458 /* 3459 * Perform an update of the nd entry for the specified address. 3460 */ 3461 /* ARGSUSED */ 3462 int 3463 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3464 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3465 { 3466 sin6_t *sin6; 3467 ill_t *ill = ipif->ipif_ill; 3468 struct lifreq *lifr; 3469 lif_nd_req_t *lnr; 3470 ire_t *ire; 3471 3472 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3473 lnr = &lifr->lifr_nd; 3474 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3475 if (ipif->ipif_id != 0) 3476 return (EINVAL); 3477 3478 if (!ipif->ipif_isv6) 3479 return (EINVAL); 3480 3481 if (lnr->lnr_addr.ss_family != AF_INET6) 3482 return (EAFNOSUPPORT); 3483 3484 sin6 = (sin6_t *)&lnr->lnr_addr; 3485 3486 /* 3487 * Since ND mappings must be consistent across an IPMP group, prohibit 3488 * updating ND mappings on underlying interfaces. Also, since ND 3489 * mappings for IPMP data addresses are owned by IP itself, prohibit 3490 * updating them. 3491 */ 3492 if (IS_UNDER_IPMP(ill)) 3493 return (EPERM); 3494 3495 if (IS_IPMP(ill)) { 3496 ire = ire_ctable_lookup_v6(&sin6->sin6_addr, NULL, IRE_LOCAL, 3497 ipif, ALL_ZONES, NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL, 3498 ill->ill_ipst); 3499 if (ire != NULL) { 3500 ire_refrele(ire); 3501 return (EPERM); 3502 } 3503 } 3504 3505 return (ndp_sioc_update(ill, lnr)); 3506 } 3507