1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 1990 Mentat Inc. 27 */ 28 29 /* 30 * This file contains the interface control functions for IPv6. 31 */ 32 33 #include <sys/types.h> 34 #include <sys/sysmacros.h> 35 #include <sys/stream.h> 36 #include <sys/dlpi.h> 37 #include <sys/stropts.h> 38 #include <sys/ddi.h> 39 #include <sys/cmn_err.h> 40 #include <sys/kstat.h> 41 #include <sys/debug.h> 42 #include <sys/zone.h> 43 #include <sys/policy.h> 44 45 #include <sys/systm.h> 46 #include <sys/param.h> 47 #include <sys/socket.h> 48 #include <sys/isa_defs.h> 49 #include <net/if.h> 50 #include <net/if_dl.h> 51 #include <net/route.h> 52 #include <netinet/in.h> 53 #include <netinet/igmp_var.h> 54 #include <netinet/ip6.h> 55 #include <netinet/icmp6.h> 56 57 #include <inet/common.h> 58 #include <inet/nd.h> 59 #include <inet/mib2.h> 60 #include <inet/ip.h> 61 #include <inet/ip6.h> 62 #include <inet/ip_multi.h> 63 #include <inet/ip_ire.h> 64 #include <inet/ip_rts.h> 65 #include <inet/ip_ndp.h> 66 #include <inet/ip_if.h> 67 #include <inet/ip6_asp.h> 68 #include <inet/ipclassifier.h> 69 #include <inet/sctp_ip.h> 70 71 #include <sys/tsol/tndb.h> 72 #include <sys/tsol/tnet.h> 73 74 static in6_addr_t ipv6_ll_template = 75 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 76 77 static ipif_t * 78 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 79 ip_stack_t *ipst); 80 81 static int ipif_add_ires_v6(ipif_t *, boolean_t); 82 83 /* 84 * This function is called when an application does not specify an interface 85 * to be used for multicast traffic. It calls ire_lookup_multi_v6() to look 86 * for an interface route for the specified multicast group. Doing 87 * this allows the administrator to add prefix routes for multicast to 88 * indicate which interface to be used for multicast traffic in the above 89 * scenario. The route could be for all multicast (ff00::/8), for a single 90 * multicast group (a /128 route) or anything in between. If there is no 91 * such multicast route, we just find any multicast capable interface and 92 * return it. 93 * 94 * We support MULTIRT and RTF_SETSRC on the multicast routes added to the 95 * unicast table. This is used by CGTP. 96 */ 97 ill_t * 98 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst, 99 boolean_t *multirtp, in6_addr_t *setsrcp) 100 { 101 ill_t *ill; 102 103 ill = ire_lookup_multi_ill_v6(group, zoneid, ipst, multirtp, setsrcp); 104 if (ill != NULL) 105 return (ill); 106 107 return (ill_lookup_multicast(ipst, zoneid, B_TRUE)); 108 } 109 110 /* 111 * Look for an ipif with the specified interface address and destination. 112 * The destination address is used only for matching point-to-point interfaces. 113 */ 114 static ipif_t * 115 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 116 ip_stack_t *ipst) 117 { 118 ipif_t *ipif; 119 ill_t *ill; 120 ill_walk_context_t ctx; 121 122 /* 123 * First match all the point-to-point interfaces 124 * before looking at non-point-to-point interfaces. 125 * This is done to avoid returning non-point-to-point 126 * ipif instead of unnumbered point-to-point ipif. 127 */ 128 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 129 ill = ILL_START_WALK_V6(&ctx, ipst); 130 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 131 mutex_enter(&ill->ill_lock); 132 for (ipif = ill->ill_ipif; ipif != NULL; 133 ipif = ipif->ipif_next) { 134 /* Allow the ipif to be down */ 135 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 136 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 137 if_addr)) && 138 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 139 dst))) { 140 if (!IPIF_IS_CONDEMNED(ipif)) { 141 ipif_refhold_locked(ipif); 142 mutex_exit(&ill->ill_lock); 143 rw_exit(&ipst->ips_ill_g_lock); 144 return (ipif); 145 } 146 } 147 } 148 mutex_exit(&ill->ill_lock); 149 } 150 rw_exit(&ipst->ips_ill_g_lock); 151 /* lookup the ipif based on interface address */ 152 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, ipst); 153 ASSERT(ipif == NULL || ipif->ipif_isv6); 154 return (ipif); 155 } 156 157 /* 158 * Common function for ipif_lookup_addr_v6() and ipif_lookup_addr_exact_v6(). 159 */ 160 static ipif_t * 161 ipif_lookup_addr_common_v6(const in6_addr_t *addr, ill_t *match_ill, 162 uint32_t match_flags, zoneid_t zoneid, ip_stack_t *ipst) 163 { 164 ipif_t *ipif; 165 ill_t *ill; 166 boolean_t ptp = B_FALSE; 167 ill_walk_context_t ctx; 168 boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP); 169 boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP); 170 171 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 172 /* 173 * Repeat twice, first based on local addresses and 174 * next time for pointopoint. 175 */ 176 repeat: 177 ill = ILL_START_WALK_V6(&ctx, ipst); 178 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 179 if (match_ill != NULL && ill != match_ill && 180 (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) { 181 continue; 182 } 183 mutex_enter(&ill->ill_lock); 184 for (ipif = ill->ill_ipif; ipif != NULL; 185 ipif = ipif->ipif_next) { 186 if (zoneid != ALL_ZONES && 187 ipif->ipif_zoneid != zoneid && 188 ipif->ipif_zoneid != ALL_ZONES) 189 continue; 190 191 if (no_duplicate && 192 !(ipif->ipif_flags & IPIF_UP)) { 193 continue; 194 } 195 196 /* Allow the ipif to be down */ 197 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 198 &ipif->ipif_v6lcl_addr, addr) && 199 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 200 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 201 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 202 addr))) { 203 if (!IPIF_IS_CONDEMNED(ipif)) { 204 ipif_refhold_locked(ipif); 205 mutex_exit(&ill->ill_lock); 206 rw_exit(&ipst->ips_ill_g_lock); 207 return (ipif); 208 } 209 } 210 } 211 mutex_exit(&ill->ill_lock); 212 } 213 214 /* If we already did the ptp case, then we are done */ 215 if (ptp) { 216 rw_exit(&ipst->ips_ill_g_lock); 217 return (NULL); 218 } 219 ptp = B_TRUE; 220 goto repeat; 221 } 222 223 /* 224 * Lookup an ipif with the specified address. For point-to-point links we 225 * look for matches on either the destination address or the local address, 226 * but we skip the local address check if IPIF_UNNUMBERED is set. If the 227 * `match_ill' argument is non-NULL, the lookup is restricted to that ill 228 * (or illgrp if `match_ill' is in an IPMP group). 229 */ 230 ipif_t * 231 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 232 ip_stack_t *ipst) 233 { 234 return (ipif_lookup_addr_common_v6(addr, match_ill, IPIF_MATCH_ILLGRP, 235 zoneid, ipst)); 236 } 237 238 /* 239 * Lookup an ipif with the specified address. Similar to ipif_lookup_addr, 240 * except that we will only return an address if it is not marked as 241 * IPIF_DUPLICATE 242 */ 243 ipif_t * 244 ipif_lookup_addr_nondup_v6(const in6_addr_t *addr, ill_t *match_ill, 245 zoneid_t zoneid, ip_stack_t *ipst) 246 { 247 return (ipif_lookup_addr_common_v6(addr, match_ill, 248 (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP), zoneid, 249 ipst)); 250 } 251 252 /* 253 * Special abbreviated version of ipif_lookup_addr_v6() that doesn't match 254 * `match_ill' across the IPMP group. This function is only needed in some 255 * corner-cases; almost everything should use ipif_lookup_addr_v6(). 256 */ 257 ipif_t * 258 ipif_lookup_addr_exact_v6(const in6_addr_t *addr, ill_t *match_ill, 259 ip_stack_t *ipst) 260 { 261 ASSERT(match_ill != NULL); 262 return (ipif_lookup_addr_common_v6(addr, match_ill, 0, ALL_ZONES, 263 ipst)); 264 } 265 266 /* 267 * Look for an ipif with the specified address. For point-point links 268 * we look for matches on either the destination address and the local 269 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 270 * is set. 271 * If the `match_ill' argument is non-NULL, the lookup is restricted to that 272 * ill (or illgrp if `match_ill' is in an IPMP group). 273 * Return the zoneid for the ipif. ALL_ZONES if none found. 274 */ 275 zoneid_t 276 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill, 277 ip_stack_t *ipst) 278 { 279 ipif_t *ipif; 280 ill_t *ill; 281 boolean_t ptp = B_FALSE; 282 ill_walk_context_t ctx; 283 zoneid_t zoneid; 284 285 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 286 /* 287 * Repeat twice, first based on local addresses and 288 * next time for pointopoint. 289 */ 290 repeat: 291 ill = ILL_START_WALK_V6(&ctx, ipst); 292 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 293 if (match_ill != NULL && ill != match_ill && 294 !IS_IN_SAME_ILLGRP(ill, match_ill)) { 295 continue; 296 } 297 mutex_enter(&ill->ill_lock); 298 for (ipif = ill->ill_ipif; ipif != NULL; 299 ipif = ipif->ipif_next) { 300 /* Allow the ipif to be down */ 301 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 302 &ipif->ipif_v6lcl_addr, addr) && 303 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 304 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 305 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 306 addr)) && 307 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) { 308 zoneid = ipif->ipif_zoneid; 309 mutex_exit(&ill->ill_lock); 310 rw_exit(&ipst->ips_ill_g_lock); 311 /* 312 * If ipif_zoneid was ALL_ZONES then we have 313 * a trusted extensions shared IP address. 314 * In that case GLOBAL_ZONEID works to send. 315 */ 316 if (zoneid == ALL_ZONES) 317 zoneid = GLOBAL_ZONEID; 318 return (zoneid); 319 } 320 } 321 mutex_exit(&ill->ill_lock); 322 } 323 324 /* If we already did the ptp case, then we are done */ 325 if (ptp) { 326 rw_exit(&ipst->ips_ill_g_lock); 327 return (ALL_ZONES); 328 } 329 ptp = B_TRUE; 330 goto repeat; 331 } 332 333 /* 334 * Perform various checks to verify that an address would make sense as a local 335 * interface address. This is currently only called when an attempt is made 336 * to set a local address. 337 * 338 * Does not allow a v4-mapped address, an address that equals the subnet 339 * anycast address, ... a multicast address, ... 340 */ 341 boolean_t 342 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 343 { 344 in6_addr_t subnet; 345 346 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 347 return (B_TRUE); /* Allow all zeros */ 348 349 /* 350 * Don't allow all zeroes or host part, but allow 351 * all ones netmask. 352 */ 353 V6_MASK_COPY(*addr, *subnet_mask, subnet); 354 if (IN6_IS_ADDR_V4MAPPED(addr) || 355 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 356 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 357 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 358 IN6_IS_ADDR_MULTICAST(addr)) 359 return (B_FALSE); 360 361 return (B_TRUE); 362 } 363 364 /* 365 * Perform various checks to verify that an address would make sense as a 366 * remote/subnet interface address. 367 */ 368 boolean_t 369 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 370 { 371 in6_addr_t subnet; 372 373 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 374 return (B_TRUE); /* Allow all zeros */ 375 376 V6_MASK_COPY(*addr, *subnet_mask, subnet); 377 if (IN6_IS_ADDR_V4MAPPED(addr) || 378 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 379 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 380 IN6_IS_ADDR_MULTICAST(addr) || 381 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 382 return (B_FALSE); 383 384 return (B_TRUE); 385 } 386 387 /* 388 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 389 * ill is passed in to associate it with the correct interface 390 * (for link-local destinations and gateways). 391 * If ire_arg is set, then we return the held IRE in that location. 392 */ 393 /* ARGSUSED1 */ 394 int 395 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 396 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 397 ill_t *ill, ire_t **ire_arg, struct rtsa_s *sp, ip_stack_t *ipst, 398 zoneid_t zoneid) 399 { 400 ire_t *ire, *nire; 401 ire_t *gw_ire = NULL; 402 ipif_t *ipif; 403 uint_t type; 404 int match_flags = MATCH_IRE_TYPE; 405 tsol_gc_t *gc = NULL; 406 tsol_gcgrp_t *gcgrp = NULL; 407 boolean_t gcgrp_xtraref = B_FALSE; 408 409 if (ire_arg != NULL) 410 *ire_arg = NULL; 411 412 /* 413 * Prevent routes with a zero gateway from being created (since 414 * interfaces can currently be plumbed and brought up with no assigned 415 * address). 416 */ 417 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 418 return (ENETUNREACH); 419 420 /* 421 * If this is the case of RTF_HOST being set, then we set the netmask 422 * to all ones (regardless if one was supplied). 423 */ 424 if (flags & RTF_HOST) 425 mask = &ipv6_all_ones; 426 427 /* 428 * Get the ipif, if any, corresponding to the gw_addr 429 * If -ifp was specified we restrict ourselves to the ill, otherwise 430 * we match on the gatway and destination to handle unnumbered pt-pt 431 * interfaces. 432 */ 433 if (ill != NULL) 434 ipif = ipif_lookup_addr_v6(gw_addr, ill, ALL_ZONES, ipst); 435 else 436 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst); 437 if (ipif != NULL) { 438 if (IS_VNI(ipif->ipif_ill)) { 439 ipif_refrele(ipif); 440 return (EINVAL); 441 } 442 } 443 444 /* 445 * GateD will attempt to create routes with a loopback interface 446 * address as the gateway and with RTF_GATEWAY set. We allow 447 * these routes to be added, but create them as interface routes 448 * since the gateway is an interface address. 449 */ 450 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) { 451 flags &= ~RTF_GATEWAY; 452 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) && 453 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) && 454 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) { 455 ire = ire_ftable_lookup_v6(dst_addr, 0, 0, IRE_LOOPBACK, 456 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst, 457 NULL); 458 if (ire != NULL) { 459 ire_refrele(ire); 460 ipif_refrele(ipif); 461 return (EEXIST); 462 } 463 ip1dbg(("ip_rt_add_v6: 0x%p creating IRE 0x%x" 464 "for 0x%x\n", (void *)ipif, 465 ipif->ipif_ire_type, 466 ntohl(ipif->ipif_lcl_addr))); 467 ire = ire_create_v6( 468 dst_addr, 469 mask, 470 NULL, 471 ipif->ipif_ire_type, /* LOOPBACK */ 472 ipif->ipif_ill, 473 zoneid, 474 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 475 NULL, 476 ipst); 477 478 if (ire == NULL) { 479 ipif_refrele(ipif); 480 return (ENOMEM); 481 } 482 /* src address assigned by the caller? */ 483 if ((flags & RTF_SETSRC) && 484 !IN6_IS_ADDR_UNSPECIFIED(src_addr)) 485 ire->ire_setsrc_addr_v6 = *src_addr; 486 487 nire = ire_add(ire); 488 if (nire == NULL) { 489 /* 490 * In the result of failure, ire_add() will have 491 * already deleted the ire in question, so there 492 * is no need to do that here. 493 */ 494 ipif_refrele(ipif); 495 return (ENOMEM); 496 } 497 /* 498 * Check if it was a duplicate entry. This handles 499 * the case of two racing route adds for the same route 500 */ 501 if (nire != ire) { 502 ASSERT(nire->ire_identical_ref > 1); 503 ire_delete(nire); 504 ire_refrele(nire); 505 ipif_refrele(ipif); 506 return (EEXIST); 507 } 508 ire = nire; 509 goto save_ire; 510 } 511 } 512 513 /* 514 * The routes for multicast with CGTP are quite special in that 515 * the gateway is the local interface address, yet RTF_GATEWAY 516 * is set. We turn off RTF_GATEWAY to provide compatibility with 517 * this undocumented and unusual use of multicast routes. 518 */ 519 if ((flags & RTF_MULTIRT) && ipif != NULL) 520 flags &= ~RTF_GATEWAY; 521 522 /* 523 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 524 * and the gateway address provided is one of the system's interface 525 * addresses. By using the routing socket interface and supplying an 526 * RTA_IFP sockaddr with an interface index, an alternate method of 527 * specifying an interface route to be created is available which uses 528 * the interface index that specifies the outgoing interface rather than 529 * the address of an outgoing interface (which may not be able to 530 * uniquely identify an interface). When coupled with the RTF_GATEWAY 531 * flag, routes can be specified which not only specify the next-hop to 532 * be used when routing to a certain prefix, but also which outgoing 533 * interface should be used. 534 * 535 * Previously, interfaces would have unique addresses assigned to them 536 * and so the address assigned to a particular interface could be used 537 * to identify a particular interface. One exception to this was the 538 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 539 * 540 * With the advent of IPv6 and its link-local addresses, this 541 * restriction was relaxed and interfaces could share addresses between 542 * themselves. In fact, typically all of the link-local interfaces on 543 * an IPv6 node or router will have the same link-local address. In 544 * order to differentiate between these interfaces, the use of an 545 * interface index is necessary and this index can be carried inside a 546 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 547 * of using the interface index, however, is that all of the ipif's that 548 * are part of an ill have the same index and so the RTA_IFP sockaddr 549 * cannot be used to differentiate between ipif's (or logical 550 * interfaces) that belong to the same ill (physical interface). 551 * 552 * For example, in the following case involving IPv4 interfaces and 553 * logical interfaces 554 * 555 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 556 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0 557 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0 558 * 559 * the ipif's corresponding to each of these interface routes can be 560 * uniquely identified by the "gateway" (actually interface address). 561 * 562 * In this case involving multiple IPv6 default routes to a particular 563 * link-local gateway, the use of RTA_IFP is necessary to specify which 564 * default route is of interest: 565 * 566 * default fe80::123:4567:89ab:cdef U if0 567 * default fe80::123:4567:89ab:cdef U if1 568 */ 569 570 /* RTF_GATEWAY not set */ 571 if (!(flags & RTF_GATEWAY)) { 572 if (sp != NULL) { 573 ip2dbg(("ip_rt_add_v6: gateway security attributes " 574 "cannot be set with interface route\n")); 575 if (ipif != NULL) 576 ipif_refrele(ipif); 577 return (EINVAL); 578 } 579 580 /* 581 * Whether or not ill (RTA_IFP) is set, we require that 582 * the gateway is one of our local addresses. 583 */ 584 if (ipif == NULL) 585 return (ENETUNREACH); 586 587 /* 588 * We use MATCH_IRE_ILL here. If the caller specified an 589 * interface (from the RTA_IFP sockaddr) we use it, otherwise 590 * we use the ill derived from the gateway address. 591 * We can always match the gateway address since we record it 592 * in ire_gateway_addr. 593 * We don't allow RTA_IFP to specify a different ill than the 594 * one matching the ipif to make sure we can delete the route. 595 */ 596 match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL; 597 if (ill == NULL) { 598 ill = ipif->ipif_ill; 599 } else if (ill != ipif->ipif_ill) { 600 ipif_refrele(ipif); 601 return (EINVAL); 602 } 603 604 /* 605 * We check for an existing entry at this point. 606 */ 607 match_flags |= MATCH_IRE_MASK; 608 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, 609 IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst, 610 NULL); 611 if (ire != NULL) { 612 ire_refrele(ire); 613 ipif_refrele(ipif); 614 return (EEXIST); 615 } 616 617 /* 618 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or 619 * IRE_IF_RESOLVER with the modified address, netmask, and 620 * gateway. 621 */ 622 ire = ire_create_v6( 623 dst_addr, 624 mask, 625 gw_addr, 626 ill->ill_net_type, 627 ill, 628 zoneid, 629 flags, 630 NULL, 631 ipst); 632 if (ire == NULL) { 633 ipif_refrele(ipif); 634 return (ENOMEM); 635 } 636 637 /* 638 * Some software (for example, GateD and Sun Cluster) attempts 639 * to create (what amount to) IRE_PREFIX routes with the 640 * loopback address as the gateway. This is primarily done to 641 * set up prefixes with the RTF_REJECT flag set (for example, 642 * when generating aggregate routes). We also OR in the 643 * RTF_BLACKHOLE flag as these interface routes, by 644 * definition, can only be that. 645 * 646 * If the IRE type (as defined by ill->ill_net_type) is 647 * IRE_LOOPBACK, then we map the request into a 648 * IRE_IF_NORESOLVER. 649 * 650 * Needless to say, the real IRE_LOOPBACK is NOT created by this 651 * routine, but rather using ire_create_v6() directly. 652 */ 653 if (ill->ill_net_type == IRE_LOOPBACK) { 654 ire->ire_type = IRE_IF_NORESOLVER; 655 ire->ire_flags |= RTF_BLACKHOLE; 656 } 657 /* src address assigned by the caller? */ 658 if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) 659 ire->ire_setsrc_addr_v6 = *src_addr; 660 661 nire = ire_add(ire); 662 if (nire == NULL) { 663 /* 664 * In the result of failure, ire_add() will have 665 * already deleted the ire in question, so there 666 * is no need to do that here. 667 */ 668 ipif_refrele(ipif); 669 return (ENOMEM); 670 } 671 /* 672 * Check if it was a duplicate entry. This handles 673 * the case of two racing route adds for the same route 674 */ 675 if (nire != ire) { 676 ASSERT(nire->ire_identical_ref > 1); 677 ire_delete(nire); 678 ire_refrele(nire); 679 ipif_refrele(ipif); 680 return (EEXIST); 681 } 682 ire = nire; 683 goto save_ire; 684 } 685 686 /* 687 * Get an interface IRE for the specified gateway. 688 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 689 * gateway, it is currently unreachable and we fail the request 690 * accordingly. 691 * If RTA_IFP was specified we look on that particular ill. 692 */ 693 if (ill != NULL) 694 match_flags |= MATCH_IRE_ILL; 695 696 /* Check whether the gateway is reachable. */ 697 type = IRE_INTERFACE; 698 if (flags & RTF_INDIRECT) 699 type |= IRE_OFFLINK; 700 701 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, type, ill, 702 ALL_ZONES, NULL, match_flags, 0, ipst, NULL); 703 if (gw_ire == NULL) { 704 if (ipif != NULL) 705 ipif_refrele(ipif); 706 return (ENETUNREACH); 707 } 708 709 /* 710 * We create one of three types of IREs as a result of this request 711 * based on the netmask. A netmask of all ones (which is automatically 712 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 713 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 714 * created. Otherwise, an IRE_PREFIX route is created for the 715 * destination prefix. 716 */ 717 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 718 type = IRE_HOST; 719 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 720 type = IRE_DEFAULT; 721 else 722 type = IRE_PREFIX; 723 724 /* check for a duplicate entry */ 725 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ill, 726 ALL_ZONES, NULL, 727 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, 0, ipst, NULL); 728 if (ire != NULL) { 729 if (ipif != NULL) 730 ipif_refrele(ipif); 731 ire_refrele(gw_ire); 732 ire_refrele(ire); 733 return (EEXIST); 734 } 735 736 /* Security attribute exists */ 737 if (sp != NULL) { 738 tsol_gcgrp_addr_t ga; 739 740 /* find or create the gateway credentials group */ 741 ga.ga_af = AF_INET6; 742 ga.ga_addr = *gw_addr; 743 744 /* we hold reference to it upon success */ 745 gcgrp = gcgrp_lookup(&ga, B_TRUE); 746 if (gcgrp == NULL) { 747 if (ipif != NULL) 748 ipif_refrele(ipif); 749 ire_refrele(gw_ire); 750 return (ENOMEM); 751 } 752 753 /* 754 * Create and add the security attribute to the group; a 755 * reference to the group is made upon allocating a new 756 * entry successfully. If it finds an already-existing 757 * entry for the security attribute in the group, it simply 758 * returns it and no new reference is made to the group. 759 */ 760 gc = gc_create(sp, gcgrp, &gcgrp_xtraref); 761 if (gc == NULL) { 762 /* release reference held by gcgrp_lookup */ 763 GCGRP_REFRELE(gcgrp); 764 if (ipif != NULL) 765 ipif_refrele(ipif); 766 ire_refrele(gw_ire); 767 return (ENOMEM); 768 } 769 } 770 771 /* Create the IRE. */ 772 ire = ire_create_v6( 773 dst_addr, /* dest address */ 774 mask, /* mask */ 775 gw_addr, /* gateway address */ 776 (ushort_t)type, /* IRE type */ 777 ill, 778 zoneid, 779 flags, 780 gc, /* security attribute */ 781 ipst); 782 783 /* 784 * The ire holds a reference to the 'gc' and the 'gc' holds a 785 * reference to the 'gcgrp'. We can now release the extra reference 786 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used. 787 */ 788 if (gcgrp_xtraref) 789 GCGRP_REFRELE(gcgrp); 790 if (ire == NULL) { 791 if (gc != NULL) 792 GC_REFRELE(gc); 793 if (ipif != NULL) 794 ipif_refrele(ipif); 795 ire_refrele(gw_ire); 796 return (ENOMEM); 797 } 798 799 /* src address assigned by the caller? */ 800 if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) 801 ire->ire_setsrc_addr_v6 = *src_addr; 802 803 /* 804 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 805 * SUN/OS socket stuff does but do we really want to allow ::0 ? 806 */ 807 808 /* Add the new IRE. */ 809 nire = ire_add(ire); 810 if (nire == NULL) { 811 /* 812 * In the result of failure, ire_add() will have 813 * already deleted the ire in question, so there 814 * is no need to do that here. 815 */ 816 if (ipif != NULL) 817 ipif_refrele(ipif); 818 ire_refrele(gw_ire); 819 return (ENOMEM); 820 } 821 /* 822 * Check if it was a duplicate entry. This handles 823 * the case of two racing route adds for the same route 824 */ 825 if (nire != ire) { 826 ASSERT(nire->ire_identical_ref > 1); 827 ire_delete(nire); 828 ire_refrele(nire); 829 if (ipif != NULL) 830 ipif_refrele(ipif); 831 ire_refrele(gw_ire); 832 return (EEXIST); 833 } 834 ire = nire; 835 836 if (flags & RTF_MULTIRT) { 837 /* 838 * Invoke the CGTP (multirouting) filtering module 839 * to add the dst address in the filtering database. 840 * Replicated inbound packets coming from that address 841 * will be filtered to discard the duplicates. 842 * It is not necessary to call the CGTP filter hook 843 * when the dst address is a multicast, because an 844 * IP source address cannot be a multicast. 845 */ 846 if (ipst->ips_ip_cgtp_filter_ops != NULL && 847 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 848 int res; 849 ipif_t *src_ipif; 850 851 /* Find the source address corresponding to gw_ire */ 852 src_ipif = ipif_lookup_addr_v6( 853 &gw_ire->ire_gateway_addr_v6, NULL, zoneid, ipst); 854 if (src_ipif != NULL) { 855 res = ipst->ips_ip_cgtp_filter_ops-> 856 cfo_add_dest_v6( 857 ipst->ips_netstack->netstack_stackid, 858 &ire->ire_addr_v6, 859 &ire->ire_gateway_addr_v6, 860 &ire->ire_setsrc_addr_v6, 861 &src_ipif->ipif_v6lcl_addr); 862 ipif_refrele(src_ipif); 863 } else { 864 res = EADDRNOTAVAIL; 865 } 866 if (res != 0) { 867 if (ipif != NULL) 868 ipif_refrele(ipif); 869 ire_refrele(gw_ire); 870 ire_delete(ire); 871 ire_refrele(ire); /* Held in ire_add */ 872 return (res); 873 } 874 } 875 } 876 877 save_ire: 878 if (gw_ire != NULL) { 879 ire_refrele(gw_ire); 880 gw_ire = NULL; 881 } 882 if (ire->ire_ill != NULL) { 883 /* 884 * Save enough information so that we can recreate the IRE if 885 * the ILL goes down and then up. The metrics associated 886 * with the route will be saved as well when rts_setmetrics() is 887 * called after the IRE has been created. In the case where 888 * memory cannot be allocated, none of this information will be 889 * saved. 890 */ 891 ill_save_ire(ire->ire_ill, ire); 892 } 893 894 if (ire_arg != NULL) { 895 /* 896 * Store the ire that was successfully added into where ire_arg 897 * points to so that callers don't have to look it up 898 * themselves (but they are responsible for ire_refrele()ing 899 * the ire when they are finished with it). 900 */ 901 *ire_arg = ire; 902 } else { 903 ire_refrele(ire); /* Held in ire_add */ 904 } 905 if (ipif != NULL) 906 ipif_refrele(ipif); 907 return (0); 908 } 909 910 /* 911 * ip_rt_delete_v6 is called to delete an IPv6 route. 912 * ill is passed in to associate it with the correct interface. 913 * (for link-local destinations and gateways). 914 */ 915 /* ARGSUSED4 */ 916 int 917 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 918 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ill_t *ill, 919 ip_stack_t *ipst, zoneid_t zoneid) 920 { 921 ire_t *ire = NULL; 922 ipif_t *ipif; 923 uint_t type; 924 uint_t match_flags = MATCH_IRE_TYPE; 925 int err = 0; 926 927 /* 928 * If this is the case of RTF_HOST being set, then we set the netmask 929 * to all ones. Otherwise, we use the netmask if one was supplied. 930 */ 931 if (flags & RTF_HOST) { 932 mask = &ipv6_all_ones; 933 match_flags |= MATCH_IRE_MASK; 934 } else if (rtm_addrs & RTA_NETMASK) { 935 match_flags |= MATCH_IRE_MASK; 936 } 937 938 /* 939 * Note that RTF_GATEWAY is never set on a delete, therefore 940 * we check if the gateway address is one of our interfaces first, 941 * and fall back on RTF_GATEWAY routes. 942 * 943 * This makes it possible to delete an original 944 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 945 * However, we have RTF_KERNEL set on the ones created by ipif_up 946 * and those can not be deleted here. 947 * 948 * We use MATCH_IRE_ILL if we know the interface. If the caller 949 * specified an interface (from the RTA_IFP sockaddr) we use it, 950 * otherwise we use the ill derived from the gateway address. 951 * We can always match the gateway address since we record it 952 * in ire_gateway_addr. 953 * 954 * For more detail on specifying routes by gateway address and by 955 * interface index, see the comments in ip_rt_add_v6(). 956 */ 957 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst); 958 if (ipif != NULL) { 959 ill_t *ill_match; 960 961 if (ill != NULL) 962 ill_match = ill; 963 else 964 ill_match = ipif->ipif_ill; 965 966 match_flags |= MATCH_IRE_ILL; 967 if (ipif->ipif_ire_type == IRE_LOOPBACK) { 968 ire = ire_ftable_lookup_v6(dst_addr, 0, 0, IRE_LOOPBACK, 969 ill_match, ALL_ZONES, NULL, match_flags, 0, ipst, 970 NULL); 971 } 972 if (ire == NULL) { 973 match_flags |= MATCH_IRE_GW; 974 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, 975 IRE_INTERFACE, ill_match, ALL_ZONES, NULL, 976 match_flags, 0, ipst, NULL); 977 } 978 /* Avoid deleting routes created by kernel from an ipif */ 979 if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) { 980 ire_refrele(ire); 981 ire = NULL; 982 } 983 984 /* Restore in case we didn't find a match */ 985 match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL); 986 } 987 988 if (ire == NULL) { 989 /* 990 * At this point, the gateway address is not one of our own 991 * addresses or a matching interface route was not found. We 992 * set the IRE type to lookup based on whether 993 * this is a host route, a default route or just a prefix. 994 * 995 * If an ill was passed in, then the lookup is based on an 996 * interface index so MATCH_IRE_ILL is added to match_flags. 997 */ 998 match_flags |= MATCH_IRE_GW; 999 if (ill != NULL) 1000 match_flags |= MATCH_IRE_ILL; 1001 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 1002 type = IRE_HOST; 1003 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 1004 type = IRE_DEFAULT; 1005 else 1006 type = IRE_PREFIX; 1007 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 1008 ill, ALL_ZONES, NULL, match_flags, 0, ipst, NULL); 1009 } 1010 1011 if (ipif != NULL) { 1012 ipif_refrele(ipif); 1013 ipif = NULL; 1014 } 1015 if (ire == NULL) 1016 return (ESRCH); 1017 1018 if (ire->ire_flags & RTF_MULTIRT) { 1019 /* 1020 * Invoke the CGTP (multirouting) filtering module 1021 * to remove the dst address from the filtering database. 1022 * Packets coming from that address will no longer be 1023 * filtered to remove duplicates. 1024 */ 1025 if (ipst->ips_ip_cgtp_filter_ops != NULL) { 1026 err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v6( 1027 ipst->ips_netstack->netstack_stackid, 1028 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 1029 } 1030 } 1031 1032 ill = ire->ire_ill; 1033 if (ill != NULL) 1034 ill_remove_saved_ire(ill, ire); 1035 ire_delete(ire); 1036 ire_refrele(ire); 1037 return (err); 1038 } 1039 1040 /* 1041 * Derive an interface id from the link layer address. 1042 */ 1043 void 1044 ill_setdefaulttoken(ill_t *ill) 1045 { 1046 if (!ill->ill_manual_token) { 1047 bzero(&ill->ill_token, sizeof (ill->ill_token)); 1048 MEDIA_V6INTFID(ill->ill_media, ill, &ill->ill_token); 1049 ill->ill_token_length = IPV6_TOKEN_LEN; 1050 } 1051 } 1052 1053 void 1054 ill_setdesttoken(ill_t *ill) 1055 { 1056 bzero(&ill->ill_dest_token, sizeof (ill->ill_dest_token)); 1057 MEDIA_V6DESTINTFID(ill->ill_media, ill, &ill->ill_dest_token); 1058 } 1059 1060 /* 1061 * Create a link-local address from a token. 1062 */ 1063 static void 1064 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 1065 { 1066 int i; 1067 1068 for (i = 0; i < 4; i++) { 1069 dest->s6_addr32[i] = 1070 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 1071 } 1072 } 1073 1074 /* 1075 * Set a default IPv6 address for a 6to4 tunnel interface 2002:<tsrc>::1/16 1076 */ 1077 static void 1078 ipif_set6to4addr(ipif_t *ipif) 1079 { 1080 ill_t *ill = ipif->ipif_ill; 1081 struct in_addr v4phys; 1082 1083 ASSERT(ill->ill_mactype == DL_6TO4); 1084 ASSERT(ill->ill_phys_addr_length == sizeof (struct in_addr)); 1085 ASSERT(ipif->ipif_isv6); 1086 1087 if (ipif->ipif_flags & IPIF_UP) 1088 return; 1089 1090 (void) ip_plen_to_mask_v6(16, &ipif->ipif_v6net_mask); 1091 bcopy(ill->ill_phys_addr, &v4phys, sizeof (struct in_addr)); 1092 IN6_V4ADDR_TO_6TO4(&v4phys, &ipif->ipif_v6lcl_addr); 1093 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1094 ipif->ipif_v6subnet); 1095 } 1096 1097 /* 1098 * Is it not possible to set the link local address? 1099 * The address can be set if the token is set, and the token 1100 * isn't too long. 1101 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1102 */ 1103 boolean_t 1104 ipif_cant_setlinklocal(ipif_t *ipif) 1105 { 1106 ill_t *ill = ipif->ipif_ill; 1107 1108 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1109 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1110 return (B_TRUE); 1111 1112 return (B_FALSE); 1113 } 1114 1115 /* 1116 * Generate a link-local address from the token. 1117 */ 1118 void 1119 ipif_setlinklocal(ipif_t *ipif) 1120 { 1121 ill_t *ill = ipif->ipif_ill; 1122 in6_addr_t ov6addr; 1123 1124 ASSERT(IAM_WRITER_ILL(ill)); 1125 1126 /* 1127 * ill_manual_linklocal is set when the link-local address was 1128 * manually configured. 1129 */ 1130 if (ill->ill_manual_linklocal) 1131 return; 1132 1133 /* 1134 * IPv6 interfaces over 6to4 tunnels are special. They do not have 1135 * link-local addresses, but instead have a single automatically 1136 * generated global address. 1137 */ 1138 if (ill->ill_mactype == DL_6TO4) { 1139 ipif_set6to4addr(ipif); 1140 return; 1141 } 1142 1143 if (ipif_cant_setlinklocal(ipif)) 1144 return; 1145 1146 ov6addr = ipif->ipif_v6lcl_addr; 1147 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1148 sctp_update_ipif_addr(ipif, ov6addr); 1149 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1150 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 1151 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1152 ipif->ipif_v6subnet); 1153 } 1154 1155 ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT); 1156 } 1157 1158 /* 1159 * Set the destination link-local address for a point-to-point IPv6 1160 * interface with a destination interface id (IP tunnels are such 1161 * interfaces). 1162 */ 1163 void 1164 ipif_setdestlinklocal(ipif_t *ipif) 1165 { 1166 ill_t *ill = ipif->ipif_ill; 1167 1168 ASSERT(IAM_WRITER_ILL(ill)); 1169 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_dest_token)) 1170 return; 1171 /* Skip if we've already set the pp_dst_addr */ 1172 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) 1173 return; 1174 1175 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, &ill->ill_dest_token); 1176 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1177 } 1178 1179 /* 1180 * Get the resolver set up for a new ipif. (Always called as writer.) 1181 */ 1182 int 1183 ipif_ndp_up(ipif_t *ipif, boolean_t initial) 1184 { 1185 ill_t *ill = ipif->ipif_ill; 1186 int err = 0; 1187 nce_t *nce = NULL; 1188 boolean_t added_ipif = B_FALSE; 1189 1190 DTRACE_PROBE3(ipif__downup, char *, "ipif_ndp_up", 1191 ill_t *, ill, ipif_t *, ipif); 1192 ip1dbg(("ipif_ndp_up(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 1193 1194 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) || 1195 (!(ill->ill_net_type & IRE_INTERFACE))) { 1196 ipif->ipif_addr_ready = 1; 1197 return (0); 1198 } 1199 1200 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1201 uint16_t flags; 1202 uint16_t state; 1203 uchar_t *hw_addr; 1204 ill_t *bound_ill; 1205 ipmp_illgrp_t *illg = ill->ill_grp; 1206 uint_t hw_addr_len; 1207 1208 flags = NCE_F_MYADDR | NCE_F_NONUD | NCE_F_PUBLISH | 1209 NCE_F_AUTHORITY; 1210 if (ill->ill_flags & ILLF_ROUTER) 1211 flags |= NCE_F_ISROUTER; 1212 1213 if (ipif->ipif_flags & IPIF_ANYCAST) 1214 flags |= NCE_F_ANYCAST; 1215 1216 if (IS_IPMP(ill)) { 1217 ASSERT(ill->ill_net_type == IRE_IF_RESOLVER); 1218 /* 1219 * If we're here via ipif_up(), then the ipif won't be 1220 * bound yet -- add it to the group, which will bind 1221 * it if possible. (We would add it in ipif_up(), but 1222 * deleting on failure there is gruesome.) If we're 1223 * here via ipmp_ill_bind_ipif(), then the ipif has 1224 * already been added to the group and we just need to 1225 * use the binding. 1226 */ 1227 if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) { 1228 bound_ill = ipmp_illgrp_add_ipif(illg, ipif); 1229 if (bound_ill == NULL) { 1230 /* 1231 * We couldn't bind the ipif to an ill 1232 * yet, so we have nothing to publish. 1233 * Set ipif_addr_ready so that this 1234 * address can be used locally for now. 1235 * The routing socket message will be 1236 * sent from ipif_up_done_v6(). 1237 */ 1238 ipif->ipif_addr_ready = 1; 1239 return (0); 1240 } 1241 added_ipif = B_TRUE; 1242 } 1243 hw_addr = bound_ill->ill_nd_lla; 1244 hw_addr_len = bound_ill->ill_phys_addr_length; 1245 } else { 1246 bound_ill = ill; 1247 if (ill->ill_net_type == IRE_IF_RESOLVER) { 1248 hw_addr = ill->ill_nd_lla; 1249 hw_addr_len = ill->ill_phys_addr_length; 1250 } else { 1251 hw_addr = NULL; 1252 hw_addr_len = 0; 1253 } 1254 } 1255 1256 /* 1257 * If this is an initial bring-up (or the ipif was never 1258 * completely brought up), do DAD. Otherwise, we're here 1259 * because IPMP has rebound an address to this ill: send 1260 * unsolicited advertisements to inform others. 1261 */ 1262 if (initial || !ipif->ipif_addr_ready) { 1263 /* Causes Duplicate Address Detection to run */ 1264 state = ND_PROBE; 1265 } else { 1266 state = ND_REACHABLE; 1267 flags |= NCE_F_UNSOL_ADV; 1268 } 1269 1270 retry: 1271 err = nce_lookup_then_add_v6(ill, hw_addr, hw_addr_len, 1272 &ipif->ipif_v6lcl_addr, flags, state, &nce); 1273 switch (err) { 1274 case 0: 1275 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1276 ill->ill_name)); 1277 ipif->ipif_addr_ready = 1; 1278 ipif->ipif_added_nce = 1; 1279 nce->nce_ipif_cnt++; 1280 break; 1281 case EINPROGRESS: 1282 ip1dbg(("ipif_ndp_up: running DAD now for %s\n", 1283 ill->ill_name)); 1284 ipif->ipif_added_nce = 1; 1285 nce->nce_ipif_cnt++; 1286 break; 1287 case EEXIST: 1288 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1289 ill->ill_name)); 1290 if (!NCE_MYADDR(nce->nce_common)) { 1291 /* 1292 * A leftover nce from before this address 1293 * existed 1294 */ 1295 ncec_delete(nce->nce_common); 1296 nce_refrele(nce); 1297 nce = NULL; 1298 goto retry; 1299 } 1300 if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) { 1301 nce_refrele(nce); 1302 nce = NULL; 1303 ip1dbg(("ipif_ndp_up: NCE already exists " 1304 "for %s\n", ill->ill_name)); 1305 goto fail; 1306 } 1307 /* 1308 * Duplicate local addresses are permissible for 1309 * IPIF_POINTOPOINT interfaces which will get marked 1310 * IPIF_UNNUMBERED later in 1311 * ip_addr_availability_check(). 1312 * 1313 * The nce_ipif_cnt field tracks the number of 1314 * ipifs that have nce_addr as their local address. 1315 */ 1316 ipif->ipif_addr_ready = 1; 1317 ipif->ipif_added_nce = 1; 1318 nce->nce_ipif_cnt++; 1319 err = 0; 1320 break; 1321 default: 1322 ip1dbg(("ipif_ndp_up: NCE creation failed for %s\n", 1323 ill->ill_name)); 1324 goto fail; 1325 } 1326 } else { 1327 /* No local NCE for this entry */ 1328 ipif->ipif_addr_ready = 1; 1329 } 1330 if (nce != NULL) 1331 nce_refrele(nce); 1332 return (0); 1333 fail: 1334 if (added_ipif) 1335 ipmp_illgrp_del_ipif(ill->ill_grp, ipif); 1336 1337 return (err); 1338 } 1339 1340 /* Remove all cache entries for this logical interface */ 1341 void 1342 ipif_ndp_down(ipif_t *ipif) 1343 { 1344 ipif_nce_down(ipif); 1345 } 1346 1347 /* 1348 * Return the scope of the given IPv6 address. If the address is an 1349 * IPv4 mapped IPv6 address, return the scope of the corresponding 1350 * IPv4 address. 1351 */ 1352 in6addr_scope_t 1353 ip_addr_scope_v6(const in6_addr_t *addr) 1354 { 1355 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1356 1357 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1358 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1359 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1360 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1361 return (IP6_SCOPE_LINKLOCAL); 1362 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1363 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1364 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1365 return (IP6_SCOPE_SITELOCAL); 1366 return (IP6_SCOPE_GLOBAL); 1367 } 1368 1369 if (IN6_IS_ADDR_MULTICAST(addr)) 1370 return (IN6_ADDR_MC_SCOPE(addr)); 1371 1372 /* link-local and loopback addresses are of link-local scope */ 1373 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1374 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1375 return (IP6_SCOPE_LINKLOCAL); 1376 if (IN6_IS_ADDR_SITELOCAL(addr)) 1377 return (IP6_SCOPE_SITELOCAL); 1378 return (IP6_SCOPE_GLOBAL); 1379 } 1380 1381 1382 /* 1383 * Returns the length of the common prefix of a1 and a2, as per 1384 * CommonPrefixLen() defined in RFC 3484. 1385 */ 1386 static int 1387 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2) 1388 { 1389 int i; 1390 uint32_t a1val, a2val, mask; 1391 1392 for (i = 0; i < 4; i++) { 1393 if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) { 1394 a1val ^= a2val; 1395 i *= 32; 1396 mask = 0x80000000u; 1397 while (!(a1val & mask)) { 1398 mask >>= 1; 1399 i++; 1400 } 1401 return (i); 1402 } 1403 } 1404 return (IPV6_ABITS); 1405 } 1406 1407 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1408 (((ipif)->ipif_flags & IPIF_UP) && \ 1409 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \ 1410 !((ipif)->ipif_ill->ill_flags & ILLF_NOACCEPT)) 1411 1412 /* source address candidate */ 1413 typedef struct candidate { 1414 ipif_t *cand_ipif; 1415 /* The properties of this candidate */ 1416 boolean_t cand_isdst; 1417 boolean_t cand_isdst_set; 1418 in6addr_scope_t cand_scope; 1419 boolean_t cand_scope_set; 1420 boolean_t cand_isdeprecated; 1421 boolean_t cand_isdeprecated_set; 1422 boolean_t cand_ispreferred; 1423 boolean_t cand_ispreferred_set; 1424 boolean_t cand_matchedinterface; 1425 boolean_t cand_matchedinterface_set; 1426 boolean_t cand_matchedlabel; 1427 boolean_t cand_matchedlabel_set; 1428 boolean_t cand_istmp; 1429 boolean_t cand_istmp_set; 1430 int cand_common_pref; 1431 boolean_t cand_common_pref_set; 1432 boolean_t cand_pref_eq; 1433 boolean_t cand_pref_eq_set; 1434 int cand_pref_len; 1435 boolean_t cand_pref_len_set; 1436 } cand_t; 1437 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1438 #define cand_mask cand_ipif->ipif_v6net_mask 1439 #define cand_flags cand_ipif->ipif_flags 1440 #define cand_ill cand_ipif->ipif_ill 1441 #define cand_zoneid cand_ipif->ipif_zoneid 1442 1443 /* information about the destination for source address selection */ 1444 typedef struct dstinfo { 1445 const in6_addr_t *dst_addr; 1446 ill_t *dst_ill; 1447 uint_t dst_restrict_ill; 1448 boolean_t dst_prefer_src_tmp; 1449 in6addr_scope_t dst_scope; 1450 char *dst_label; 1451 } dstinfo_t; 1452 1453 /* 1454 * The following functions are rules used to select a source address in 1455 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1456 * against the best candidate (bc). Each rule has three possible outcomes; 1457 * the candidate is preferred over the best candidate (CAND_PREFER), the 1458 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1459 * candidate is of equal value as the best candidate (CAND_TIE). 1460 * 1461 * These rules are part of a greater "Default Address Selection for IPv6" 1462 * sheme, which is standards based work coming out of the IETF ipv6 working 1463 * group. The IETF document defines both IPv6 source address selection and 1464 * destination address ordering. The rules defined here implement the IPv6 1465 * source address selection. Destination address ordering is done by 1466 * libnsl, and uses a similar set of rules to implement the sorting. 1467 * 1468 * Most of the rules are defined by the RFC and are not typically altered. The 1469 * last rule, number 8, has language that allows for local preferences. In the 1470 * scheme below, this means that new Solaris rules should normally go between 1471 * rule_ifprefix and rule_prefix. 1472 */ 1473 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1474 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *, 1475 ip_stack_t *); 1476 1477 /* Prefer an address if it is equal to the destination address. */ 1478 /* ARGSUSED3 */ 1479 static rule_res_t 1480 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1481 { 1482 if (!bc->cand_isdst_set) { 1483 bc->cand_isdst = 1484 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1485 bc->cand_isdst_set = B_TRUE; 1486 } 1487 1488 cc->cand_isdst = 1489 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1490 cc->cand_isdst_set = B_TRUE; 1491 1492 if (cc->cand_isdst == bc->cand_isdst) 1493 return (CAND_TIE); 1494 else if (cc->cand_isdst) 1495 return (CAND_PREFER); 1496 else 1497 return (CAND_AVOID); 1498 } 1499 1500 /* 1501 * Prefer addresses that are of closest scope to the destination. Always 1502 * prefer addresses that are of greater scope than the destination over 1503 * those that are of lesser scope than the destination. 1504 */ 1505 /* ARGSUSED3 */ 1506 static rule_res_t 1507 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1508 { 1509 if (!bc->cand_scope_set) { 1510 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1511 bc->cand_scope_set = B_TRUE; 1512 } 1513 1514 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1515 cc->cand_scope_set = B_TRUE; 1516 1517 if (cc->cand_scope < bc->cand_scope) { 1518 if (cc->cand_scope < dstinfo->dst_scope) 1519 return (CAND_AVOID); 1520 else 1521 return (CAND_PREFER); 1522 } else if (bc->cand_scope < cc->cand_scope) { 1523 if (bc->cand_scope < dstinfo->dst_scope) 1524 return (CAND_PREFER); 1525 else 1526 return (CAND_AVOID); 1527 } else { 1528 return (CAND_TIE); 1529 } 1530 } 1531 1532 /* 1533 * Prefer non-deprecated source addresses. 1534 */ 1535 /* ARGSUSED2 */ 1536 static rule_res_t 1537 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1538 ip_stack_t *ipst) 1539 { 1540 if (!bc->cand_isdeprecated_set) { 1541 bc->cand_isdeprecated = 1542 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 1543 bc->cand_isdeprecated_set = B_TRUE; 1544 } 1545 1546 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 1547 cc->cand_isdeprecated_set = B_TRUE; 1548 1549 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 1550 return (CAND_TIE); 1551 else if (cc->cand_isdeprecated) 1552 return (CAND_AVOID); 1553 else 1554 return (CAND_PREFER); 1555 } 1556 1557 /* 1558 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 1559 * rule must be before rule_interface because the flag could be set on any 1560 * interface, not just the interface being used for outgoing packets (for 1561 * example, the IFF_PREFERRED could be set on an address assigned to the 1562 * loopback interface). 1563 */ 1564 /* ARGSUSED2 */ 1565 static rule_res_t 1566 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1567 ip_stack_t *ipst) 1568 { 1569 if (!bc->cand_ispreferred_set) { 1570 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 1571 bc->cand_ispreferred_set = B_TRUE; 1572 } 1573 1574 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 1575 cc->cand_ispreferred_set = B_TRUE; 1576 1577 if (bc->cand_ispreferred == cc->cand_ispreferred) 1578 return (CAND_TIE); 1579 else if (cc->cand_ispreferred) 1580 return (CAND_PREFER); 1581 else 1582 return (CAND_AVOID); 1583 } 1584 1585 /* 1586 * Prefer source addresses that are assigned to the outgoing interface. 1587 */ 1588 /* ARGSUSED3 */ 1589 static rule_res_t 1590 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1591 ip_stack_t *ipst) 1592 { 1593 ill_t *dstill = dstinfo->dst_ill; 1594 1595 /* 1596 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 1597 * since we know all candidates will be on the same link. 1598 */ 1599 if (dstinfo->dst_restrict_ill) 1600 return (CAND_TIE); 1601 1602 if (!bc->cand_matchedinterface_set) { 1603 bc->cand_matchedinterface = bc->cand_ill == dstill; 1604 bc->cand_matchedinterface_set = B_TRUE; 1605 } 1606 1607 cc->cand_matchedinterface = cc->cand_ill == dstill; 1608 cc->cand_matchedinterface_set = B_TRUE; 1609 1610 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 1611 return (CAND_TIE); 1612 else if (cc->cand_matchedinterface) 1613 return (CAND_PREFER); 1614 else 1615 return (CAND_AVOID); 1616 } 1617 1618 /* 1619 * Prefer source addresses whose label matches the destination's label. 1620 */ 1621 static rule_res_t 1622 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1623 { 1624 char *label; 1625 1626 if (!bc->cand_matchedlabel_set) { 1627 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst); 1628 bc->cand_matchedlabel = 1629 ip6_asp_labelcmp(label, dstinfo->dst_label); 1630 bc->cand_matchedlabel_set = B_TRUE; 1631 } 1632 1633 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst); 1634 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 1635 cc->cand_matchedlabel_set = B_TRUE; 1636 1637 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 1638 return (CAND_TIE); 1639 else if (cc->cand_matchedlabel) 1640 return (CAND_PREFER); 1641 else 1642 return (CAND_AVOID); 1643 } 1644 1645 /* 1646 * Prefer public addresses over temporary ones. An application can reverse 1647 * the logic of this rule and prefer temporary addresses by using the 1648 * IPV6_SRC_PREFERENCES socket option. 1649 */ 1650 /* ARGSUSED3 */ 1651 static rule_res_t 1652 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1653 ip_stack_t *ipst) 1654 { 1655 if (!bc->cand_istmp_set) { 1656 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 1657 bc->cand_istmp_set = B_TRUE; 1658 } 1659 1660 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 1661 cc->cand_istmp_set = B_TRUE; 1662 1663 if (bc->cand_istmp == cc->cand_istmp) 1664 return (CAND_TIE); 1665 1666 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 1667 return (CAND_PREFER); 1668 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 1669 return (CAND_PREFER); 1670 else 1671 return (CAND_AVOID); 1672 } 1673 1674 /* 1675 * Prefer source addresses with longer matching prefix with the destination 1676 * under the interface mask. This gets us on the same subnet before applying 1677 * any Solaris-specific rules. 1678 */ 1679 /* ARGSUSED3 */ 1680 static rule_res_t 1681 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1682 ip_stack_t *ipst) 1683 { 1684 if (!bc->cand_pref_eq_set) { 1685 bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr, 1686 bc->cand_mask, *dstinfo->dst_addr); 1687 bc->cand_pref_eq_set = B_TRUE; 1688 } 1689 1690 cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask, 1691 *dstinfo->dst_addr); 1692 cc->cand_pref_eq_set = B_TRUE; 1693 1694 if (bc->cand_pref_eq) { 1695 if (cc->cand_pref_eq) { 1696 if (!bc->cand_pref_len_set) { 1697 bc->cand_pref_len = 1698 ip_mask_to_plen_v6(&bc->cand_mask); 1699 bc->cand_pref_len_set = B_TRUE; 1700 } 1701 cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask); 1702 cc->cand_pref_len_set = B_TRUE; 1703 if (bc->cand_pref_len == cc->cand_pref_len) 1704 return (CAND_TIE); 1705 else if (bc->cand_pref_len > cc->cand_pref_len) 1706 return (CAND_AVOID); 1707 else 1708 return (CAND_PREFER); 1709 } else { 1710 return (CAND_AVOID); 1711 } 1712 } else { 1713 if (cc->cand_pref_eq) 1714 return (CAND_PREFER); 1715 else 1716 return (CAND_TIE); 1717 } 1718 } 1719 1720 /* 1721 * Prefer to use zone-specific addresses when possible instead of all-zones 1722 * addresses. 1723 */ 1724 /* ARGSUSED2 */ 1725 static rule_res_t 1726 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1727 ip_stack_t *ipst) 1728 { 1729 if ((bc->cand_zoneid == ALL_ZONES) == 1730 (cc->cand_zoneid == ALL_ZONES)) 1731 return (CAND_TIE); 1732 else if (cc->cand_zoneid == ALL_ZONES) 1733 return (CAND_AVOID); 1734 else 1735 return (CAND_PREFER); 1736 } 1737 1738 /* 1739 * Prefer to use DHCPv6 (first) and static addresses (second) when possible 1740 * instead of statelessly autoconfigured addresses. 1741 * 1742 * This is done after trying all other preferences (and before the final tie 1743 * breaker) so that, if all else is equal, we select addresses configured by 1744 * DHCPv6 over other addresses. We presume that DHCPv6 addresses, unlike 1745 * stateless autoconfigured addresses, are deliberately configured by an 1746 * administrator, and thus are correctly set up in DNS and network packet 1747 * filters. 1748 */ 1749 /* ARGSUSED2 */ 1750 static rule_res_t 1751 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1752 ip_stack_t *ipst) 1753 { 1754 #define ATYPE(x) \ 1755 ((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2 1756 int bcval = ATYPE(bc->cand_flags); 1757 int ccval = ATYPE(cc->cand_flags); 1758 #undef ATYPE 1759 1760 if (bcval == ccval) 1761 return (CAND_TIE); 1762 else if (ccval < bcval) 1763 return (CAND_PREFER); 1764 else 1765 return (CAND_AVOID); 1766 } 1767 1768 /* 1769 * Prefer source addresses with longer matching prefix with the destination. 1770 * We do the longest matching prefix calculation by doing an xor of both 1771 * addresses with the destination, and pick the address with the longest string 1772 * of leading zeros, as per CommonPrefixLen() defined in RFC 3484. 1773 */ 1774 /* ARGSUSED3 */ 1775 static rule_res_t 1776 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1777 { 1778 if (!bc->cand_common_pref_set) { 1779 bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr, 1780 dstinfo->dst_addr); 1781 bc->cand_common_pref_set = B_TRUE; 1782 } 1783 1784 cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr, 1785 dstinfo->dst_addr); 1786 cc->cand_common_pref_set = B_TRUE; 1787 1788 if (bc->cand_common_pref == cc->cand_common_pref) 1789 return (CAND_TIE); 1790 else if (bc->cand_common_pref > cc->cand_common_pref) 1791 return (CAND_AVOID); 1792 else 1793 return (CAND_PREFER); 1794 } 1795 1796 /* 1797 * Last rule: we must pick something, so just prefer the current best 1798 * candidate. 1799 */ 1800 /* ARGSUSED */ 1801 static rule_res_t 1802 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1803 ip_stack_t *ipst) 1804 { 1805 return (CAND_AVOID); 1806 } 1807 1808 /* 1809 * Determine the best source address given a destination address and a 1810 * destination ill. If no suitable source address is found, it returns 1811 * NULL. If there is a usable address pointed to by the usesrc 1812 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 1813 * fine grained (i.e per interface) 1814 * 1815 * This implementation is based on the "Default Address Selection for IPv6" 1816 * specification produced by the IETF IPv6 working group. It has been 1817 * implemented so that the list of addresses is only traversed once (the 1818 * specification's algorithm could traverse the list of addresses once for 1819 * every rule). 1820 * 1821 * The restrict_ill argument restricts the algorithm to choose a source 1822 * address that is assigned to the destination ill. This is used when 1823 * the destination address is a link-local or multicast address, and when 1824 * ipv6_strict_dst_multihoming is turned on. 1825 * 1826 * src_prefs is the caller's set of source address preferences. If source 1827 * address selection is being called to determine the source address of a 1828 * connected socket (from ip_set_destination_v6()), then the preferences are 1829 * taken from conn_ixa->ixa_src_preferences. These preferences can be set on a 1830 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 1831 * preference currently implemented is for rfc3041 temporary addresses. 1832 */ 1833 ipif_t * 1834 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 1835 boolean_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid, 1836 boolean_t allow_usesrc, boolean_t *notreadyp) 1837 { 1838 dstinfo_t dstinfo; 1839 char dstr[INET6_ADDRSTRLEN]; 1840 char sstr[INET6_ADDRSTRLEN]; 1841 ipif_t *ipif, *start_ipif, *next_ipif; 1842 ill_t *ill, *usesrc_ill = NULL, *ipmp_ill = NULL; 1843 ill_walk_context_t ctx; 1844 cand_t best_c; /* The best candidate */ 1845 cand_t curr_c; /* The current candidate */ 1846 uint_t index; 1847 boolean_t first_candidate = B_TRUE; 1848 rule_res_t rule_result; 1849 tsol_tpc_t *src_rhtp, *dst_rhtp; 1850 ip_stack_t *ipst = dstill->ill_ipst; 1851 1852 /* 1853 * The list of ordering rules. They are applied in the order they 1854 * appear in the list. 1855 * 1856 * Solaris doesn't currently support Mobile IPv6, so there's no 1857 * rule_mipv6 corresponding to rule 4 in the specification. 1858 */ 1859 rulef_t rules[] = { 1860 rule_isdst, 1861 rule_scope, 1862 rule_deprecated, 1863 rule_preferred, 1864 rule_interface, 1865 rule_label, 1866 rule_temporary, 1867 rule_ifprefix, /* local rules after this */ 1868 rule_zone_specific, 1869 rule_addr_type, 1870 rule_prefix, /* local rules before this */ 1871 rule_must_be_last, /* must always be last */ 1872 NULL 1873 }; 1874 1875 ASSERT(dstill->ill_isv6); 1876 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 1877 1878 /* 1879 * Check if there is a usable src address pointed to by the 1880 * usesrc ifindex. This has higher precedence since it is 1881 * finer grained (i.e per interface) v/s being system wide. 1882 */ 1883 if (dstill->ill_usesrc_ifindex != 0 && allow_usesrc) { 1884 if ((usesrc_ill = 1885 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 1886 ipst)) != NULL) { 1887 dstinfo.dst_ill = usesrc_ill; 1888 } else { 1889 return (NULL); 1890 } 1891 } else if (IS_UNDER_IPMP(dstill)) { 1892 /* 1893 * Test addresses should never be used for source address 1894 * selection, so if we were passed an underlying ill, switch 1895 * to the IPMP meta-interface. 1896 */ 1897 if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(dstill)) != NULL) 1898 dstinfo.dst_ill = ipmp_ill; 1899 else 1900 return (NULL); 1901 } else { 1902 dstinfo.dst_ill = dstill; 1903 } 1904 1905 /* 1906 * If we're dealing with an unlabeled destination on a labeled system, 1907 * make sure that we ignore source addresses that are incompatible with 1908 * the destination's default label. That destination's default label 1909 * must dominate the minimum label on the source address. 1910 * 1911 * (Note that this has to do with Trusted Solaris. It's not related to 1912 * the labels described by ip6_asp_lookup.) 1913 */ 1914 dst_rhtp = NULL; 1915 if (is_system_labeled()) { 1916 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE); 1917 if (dst_rhtp == NULL) 1918 return (NULL); 1919 if (dst_rhtp->tpc_tp.host_type != UNLABELED) { 1920 TPC_RELE(dst_rhtp); 1921 dst_rhtp = NULL; 1922 } 1923 } 1924 1925 dstinfo.dst_addr = dst; 1926 dstinfo.dst_scope = ip_addr_scope_v6(dst); 1927 dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst); 1928 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 1929 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 1930 /* 1931 * Section three of the I-D states that for multicast and 1932 * link-local destinations, the candidate set must be restricted to 1933 * an interface that is on the same link as the outgoing interface. 1934 * Also, when ipv6_strict_dst_multihoming is turned on, always 1935 * restrict the source address to the destination link as doing 1936 * otherwise will almost certainly cause problems. 1937 */ 1938 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 1939 ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) { 1940 dstinfo.dst_restrict_ill = B_TRUE; 1941 } else { 1942 dstinfo.dst_restrict_ill = restrict_ill; 1943 } 1944 1945 bzero(&best_c, sizeof (cand_t)); 1946 1947 /* 1948 * Take a pass through the list of IPv6 interfaces to choose the best 1949 * possible source address. If restrict_ill is set, just use dst_ill. 1950 */ 1951 if (dstinfo.dst_restrict_ill) 1952 ill = dstinfo.dst_ill; 1953 else 1954 ill = ILL_START_WALK_V6(&ctx, ipst); 1955 1956 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 1957 ASSERT(ill->ill_isv6); 1958 1959 /* 1960 * Test addresses should never be used for source address 1961 * selection, so ignore underlying ills. 1962 */ 1963 if (IS_UNDER_IPMP(ill)) 1964 continue; 1965 1966 if (ill->ill_ipif == NULL) 1967 continue; 1968 /* 1969 * For source address selection, we treat the ipif list as 1970 * circular and continue until we get back to where we 1971 * started. This allows IPMP to vary source address selection 1972 * (which improves inbound load spreading) by caching its last 1973 * ending point and starting from there. NOTE: we don't have 1974 * to worry about ill_src_ipif changing ills since that can't 1975 * happen on the IPMP ill. 1976 */ 1977 start_ipif = ill->ill_ipif; 1978 if (IS_IPMP(ill) && ill->ill_src_ipif != NULL) 1979 start_ipif = ill->ill_src_ipif; 1980 1981 ipif = start_ipif; 1982 do { 1983 if ((next_ipif = ipif->ipif_next) == NULL) 1984 next_ipif = ill->ill_ipif; 1985 1986 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 1987 continue; 1988 1989 if (!ipif->ipif_addr_ready) { 1990 if (notreadyp != NULL) 1991 *notreadyp = B_TRUE; 1992 continue; 1993 } 1994 1995 if (zoneid != ALL_ZONES && 1996 ipif->ipif_zoneid != zoneid && 1997 ipif->ipif_zoneid != ALL_ZONES) 1998 continue; 1999 2000 /* 2001 * Check compatibility of local address for 2002 * destination's default label if we're on a labeled 2003 * system. Incompatible addresses can't be used at 2004 * all and must be skipped over. 2005 */ 2006 if (dst_rhtp != NULL) { 2007 boolean_t incompat; 2008 2009 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr, 2010 IPV6_VERSION, B_FALSE); 2011 if (src_rhtp == NULL) 2012 continue; 2013 incompat = 2014 src_rhtp->tpc_tp.host_type != SUN_CIPSO || 2015 src_rhtp->tpc_tp.tp_doi != 2016 dst_rhtp->tpc_tp.tp_doi || 2017 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label, 2018 &src_rhtp->tpc_tp.tp_sl_range_cipso) && 2019 !blinlset(&dst_rhtp->tpc_tp.tp_def_label, 2020 src_rhtp->tpc_tp.tp_sl_set_cipso)); 2021 TPC_RELE(src_rhtp); 2022 if (incompat) 2023 continue; 2024 } 2025 2026 if (first_candidate) { 2027 /* 2028 * This is first valid address in the list. 2029 * It is automatically the best candidate 2030 * so far. 2031 */ 2032 best_c.cand_ipif = ipif; 2033 first_candidate = B_FALSE; 2034 continue; 2035 } 2036 2037 bzero(&curr_c, sizeof (cand_t)); 2038 curr_c.cand_ipif = ipif; 2039 2040 /* 2041 * Compare this current candidate (curr_c) with the 2042 * best candidate (best_c) by applying the 2043 * comparison rules in order until one breaks the 2044 * tie. 2045 */ 2046 for (index = 0; rules[index] != NULL; index++) { 2047 /* Apply a comparison rule. */ 2048 rule_result = (rules[index])(&best_c, &curr_c, 2049 &dstinfo, ipst); 2050 if (rule_result == CAND_AVOID) { 2051 /* 2052 * The best candidate is still the 2053 * best candidate. Forget about 2054 * this current candidate and go on 2055 * to the next one. 2056 */ 2057 break; 2058 } else if (rule_result == CAND_PREFER) { 2059 /* 2060 * This candidate is prefered. It 2061 * becomes the best candidate so 2062 * far. Go on to the next address. 2063 */ 2064 best_c = curr_c; 2065 break; 2066 } 2067 /* We have a tie, apply the next rule. */ 2068 } 2069 2070 /* 2071 * The last rule must be a tie breaker rule and 2072 * must never produce a tie. At this point, the 2073 * candidate should have either been rejected, or 2074 * have been prefered as the best candidate so far. 2075 */ 2076 ASSERT(rule_result != CAND_TIE); 2077 } while ((ipif = next_ipif) != start_ipif); 2078 2079 /* 2080 * For IPMP, update the source ipif rotor to the next ipif, 2081 * provided we can look it up. (We must not use it if it's 2082 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after 2083 * ipif_free() checked ill_src_ipif.) 2084 */ 2085 if (IS_IPMP(ill) && ipif != NULL) { 2086 mutex_enter(&ipif->ipif_ill->ill_lock); 2087 next_ipif = ipif->ipif_next; 2088 if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif)) 2089 ill->ill_src_ipif = next_ipif; 2090 else 2091 ill->ill_src_ipif = NULL; 2092 mutex_exit(&ipif->ipif_ill->ill_lock); 2093 } 2094 2095 /* 2096 * Only one ill to consider if dst_restrict_ill is set. 2097 */ 2098 if (dstinfo.dst_restrict_ill) 2099 break; 2100 } 2101 2102 ipif = best_c.cand_ipif; 2103 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2104 dstinfo.dst_ill->ill_name, 2105 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2106 (ipif == NULL ? "NULL" : 2107 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2108 2109 if (usesrc_ill != NULL) 2110 ill_refrele(usesrc_ill); 2111 2112 if (ipmp_ill != NULL) 2113 ill_refrele(ipmp_ill); 2114 2115 if (dst_rhtp != NULL) 2116 TPC_RELE(dst_rhtp); 2117 2118 if (ipif == NULL) { 2119 rw_exit(&ipst->ips_ill_g_lock); 2120 return (NULL); 2121 } 2122 2123 mutex_enter(&ipif->ipif_ill->ill_lock); 2124 if (!IPIF_IS_CONDEMNED(ipif)) { 2125 ipif_refhold_locked(ipif); 2126 mutex_exit(&ipif->ipif_ill->ill_lock); 2127 rw_exit(&ipst->ips_ill_g_lock); 2128 return (ipif); 2129 } 2130 mutex_exit(&ipif->ipif_ill->ill_lock); 2131 rw_exit(&ipst->ips_ill_g_lock); 2132 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2133 " returning null \n", (void *)ipif)); 2134 2135 return (NULL); 2136 } 2137 2138 /* 2139 * Pick a source address based on the destination ill and an optional setsrc 2140 * address. 2141 * The result is stored in srcp. If generation is set, then put the source 2142 * generation number there before we look for the source address (to avoid 2143 * missing changes in the set of source addresses. 2144 * If flagsp is set, then us it to pass back ipif_flags. 2145 * 2146 * If the caller wants to cache the returned source address and detect when 2147 * that might be stale, the caller should pass in a generation argument, 2148 * which the caller can later compare against ips_src_generation 2149 * 2150 * The precedence order for selecting an IPv6 source address is: 2151 * - RTF_SETSRC on the first ire in the recursive lookup always wins. 2152 * - If usrsrc is set, swap the ill to be the usesrc one. 2153 * - If IPMP is used on the ill, select a random address from the most 2154 * preferred ones below: 2155 * That is followed by the long list of IPv6 source address selection rules 2156 * starting with rule_isdst(), rule_scope(), etc. 2157 * 2158 * We have lower preference for ALL_ZONES IP addresses, 2159 * as they pose problems with unlabeled destinations. 2160 * 2161 * Note that when multiple IP addresses match e.g., with rule_scope() we pick 2162 * the first one if IPMP is not in use. With IPMP we randomize. 2163 */ 2164 int 2165 ip_select_source_v6(ill_t *ill, const in6_addr_t *setsrc, const in6_addr_t *dst, 2166 zoneid_t zoneid, ip_stack_t *ipst, uint_t restrict_ill, uint32_t src_prefs, 2167 in6_addr_t *srcp, uint32_t *generation, uint64_t *flagsp) 2168 { 2169 ipif_t *ipif; 2170 boolean_t notready = B_FALSE; /* Set if !ipif_addr_ready found */ 2171 2172 if (flagsp != NULL) 2173 *flagsp = 0; 2174 2175 /* 2176 * Need to grab the generation number before we check to 2177 * avoid a race with a change to the set of local addresses. 2178 * No lock needed since the thread which updates the set of local 2179 * addresses use ipif/ill locks and exit those (hence a store memory 2180 * barrier) before doing the atomic increase of ips_src_generation. 2181 */ 2182 if (generation != NULL) { 2183 *generation = ipst->ips_src_generation; 2184 } 2185 2186 /* Was RTF_SETSRC set on the first IRE in the recursive lookup? */ 2187 if (setsrc != NULL && !IN6_IS_ADDR_UNSPECIFIED(setsrc)) { 2188 *srcp = *setsrc; 2189 return (0); 2190 } 2191 2192 ipif = ipif_select_source_v6(ill, dst, restrict_ill, src_prefs, zoneid, 2193 B_TRUE, ¬ready); 2194 if (ipif == NULL) { 2195 if (notready) 2196 return (ENETDOWN); 2197 else 2198 return (EADDRNOTAVAIL); 2199 } 2200 *srcp = ipif->ipif_v6lcl_addr; 2201 if (flagsp != NULL) 2202 *flagsp = ipif->ipif_flags; 2203 ipif_refrele(ipif); 2204 return (0); 2205 } 2206 2207 /* 2208 * Perform an attach and bind to get phys addr plus info_req for 2209 * the physical device. 2210 * q and mp represents an ioctl which will be queued waiting for 2211 * completion of the DLPI message exchange. 2212 * MUST be called on an ill queue. 2213 * 2214 * Returns EINPROGRESS when mp has been consumed by queueing it. 2215 * The ioctl will complete in ip_rput. 2216 */ 2217 int 2218 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2219 { 2220 mblk_t *v6token_mp = NULL; 2221 mblk_t *v6lla_mp = NULL; 2222 mblk_t *dest_mp = NULL; 2223 mblk_t *phys_mp = NULL; 2224 mblk_t *info_mp = NULL; 2225 mblk_t *attach_mp = NULL; 2226 mblk_t *bind_mp = NULL; 2227 mblk_t *unbind_mp = NULL; 2228 mblk_t *notify_mp = NULL; 2229 mblk_t *capab_mp = NULL; 2230 2231 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2232 ASSERT(ill->ill_dlpi_style_set); 2233 ASSERT(WR(q)->q_next != NULL); 2234 2235 if (ill->ill_isv6) { 2236 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2237 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2238 if (v6token_mp == NULL) 2239 goto bad; 2240 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2241 DL_IPV6_TOKEN; 2242 2243 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2244 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2245 if (v6lla_mp == NULL) 2246 goto bad; 2247 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2248 DL_IPV6_LINK_LAYER_ADDR; 2249 } 2250 2251 if (ill->ill_mactype == DL_IPV4 || ill->ill_mactype == DL_IPV6) { 2252 dest_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2253 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2254 if (dest_mp == NULL) 2255 goto bad; 2256 ((dl_phys_addr_req_t *)dest_mp->b_rptr)->dl_addr_type = 2257 DL_CURR_DEST_ADDR; 2258 } 2259 2260 /* 2261 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2262 */ 2263 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2264 DL_NOTIFY_REQ); 2265 if (notify_mp == NULL) 2266 goto bad; 2267 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2268 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2269 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG | 2270 DL_NOTE_PROMISC_ON_PHYS | DL_NOTE_PROMISC_OFF_PHYS | 2271 DL_NOTE_REPLUMB); 2272 2273 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2274 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2275 if (phys_mp == NULL) 2276 goto bad; 2277 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2278 DL_CURR_PHYS_ADDR; 2279 2280 info_mp = ip_dlpi_alloc( 2281 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2282 DL_INFO_REQ); 2283 if (info_mp == NULL) 2284 goto bad; 2285 2286 ASSERT(ill->ill_dlpi_capab_state == IDCS_UNKNOWN); 2287 capab_mp = ip_dlpi_alloc(sizeof (dl_capability_req_t), 2288 DL_CAPABILITY_REQ); 2289 if (capab_mp == NULL) 2290 goto bad; 2291 2292 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2293 DL_BIND_REQ); 2294 if (bind_mp == NULL) 2295 goto bad; 2296 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2297 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2298 2299 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2300 if (unbind_mp == NULL) 2301 goto bad; 2302 2303 /* If we need to attach, pre-alloc and initialize the mblk */ 2304 if (ill->ill_needs_attach) { 2305 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2306 DL_ATTACH_REQ); 2307 if (attach_mp == NULL) 2308 goto bad; 2309 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2310 } 2311 2312 /* 2313 * Here we are going to delay the ioctl ack until after 2314 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2315 * original ioctl message before sending the requests 2316 */ 2317 mutex_enter(&ill->ill_lock); 2318 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2319 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2320 /* 2321 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2322 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2323 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2324 */ 2325 ill->ill_phys_addr_pend = 0; 2326 mutex_exit(&ill->ill_lock); 2327 2328 if (attach_mp != NULL) { 2329 ip1dbg(("ill_dl_phys: attach\n")); 2330 ill_dlpi_send(ill, attach_mp); 2331 } 2332 ill_dlpi_send(ill, bind_mp); 2333 ill_dlpi_send(ill, info_mp); 2334 2335 /* 2336 * Send the capability request to get the VRRP capability information. 2337 */ 2338 ill_capability_send(ill, capab_mp); 2339 2340 if (v6token_mp != NULL) 2341 ill_dlpi_send(ill, v6token_mp); 2342 if (v6lla_mp != NULL) 2343 ill_dlpi_send(ill, v6lla_mp); 2344 if (dest_mp != NULL) 2345 ill_dlpi_send(ill, dest_mp); 2346 ill_dlpi_send(ill, phys_mp); 2347 ill_dlpi_send(ill, notify_mp); 2348 ill_dlpi_send(ill, unbind_mp); 2349 2350 /* 2351 * This operation will complete in ip_rput_dlpi_writer with either 2352 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2353 */ 2354 return (EINPROGRESS); 2355 bad: 2356 freemsg(v6token_mp); 2357 freemsg(v6lla_mp); 2358 freemsg(dest_mp); 2359 freemsg(phys_mp); 2360 freemsg(info_mp); 2361 freemsg(attach_mp); 2362 freemsg(bind_mp); 2363 freemsg(capab_mp); 2364 freemsg(unbind_mp); 2365 freemsg(notify_mp); 2366 return (ENOMEM); 2367 } 2368 2369 /* Add room for tcp+ip headers */ 2370 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2371 2372 /* 2373 * DLPI is up. 2374 * Create all the IREs associated with an interface bring up multicast. 2375 * Set the interface flag and finish other initialization 2376 * that potentially had to be differed to after DL_BIND_ACK. 2377 */ 2378 int 2379 ipif_up_done_v6(ipif_t *ipif) 2380 { 2381 ill_t *ill = ipif->ipif_ill; 2382 int err; 2383 boolean_t loopback = B_FALSE; 2384 2385 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2386 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2387 DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done_v6", 2388 ill_t *, ill, ipif_t *, ipif); 2389 2390 /* Check if this is a loopback interface */ 2391 if (ipif->ipif_ill->ill_wq == NULL) 2392 loopback = B_TRUE; 2393 2394 ASSERT(ipif->ipif_isv6); 2395 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2396 2397 if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) { 2398 nce_t *loop_nce = NULL; 2399 uint16_t flags = (NCE_F_MYADDR | NCE_F_NONUD | NCE_F_AUTHORITY); 2400 2401 /* 2402 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 2403 * ipif_lookup_on_name(), but in the case of zones we can have 2404 * several loopback addresses on lo0. So all the interfaces with 2405 * loopback addresses need to be marked IRE_LOOPBACK. 2406 */ 2407 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 2408 ipif->ipif_ire_type = IRE_LOOPBACK; 2409 else 2410 ipif->ipif_ire_type = IRE_LOCAL; 2411 if (ill->ill_net_type != IRE_LOOPBACK) 2412 flags |= NCE_F_PUBLISH; 2413 err = nce_lookup_then_add_v6(ill, NULL, 2414 ill->ill_phys_addr_length, 2415 &ipif->ipif_v6lcl_addr, flags, ND_REACHABLE, &loop_nce); 2416 2417 /* A shared-IP zone sees EEXIST for lo0:N */ 2418 if (err == 0 || err == EEXIST) { 2419 ipif->ipif_added_nce = 1; 2420 loop_nce->nce_ipif_cnt++; 2421 nce_refrele(loop_nce); 2422 err = 0; 2423 } else { 2424 ASSERT(loop_nce == NULL); 2425 return (err); 2426 } 2427 } 2428 2429 err = ipif_add_ires_v6(ipif, loopback); 2430 if (err != 0) { 2431 /* 2432 * See comments about return value from 2433 * ipif_addr_availability_check() in ipif_add_ires_v6(). 2434 */ 2435 if (err != EADDRINUSE) { 2436 ipif_ndp_down(ipif); 2437 } else { 2438 /* 2439 * Make IPMP aware of the deleted ipif so that 2440 * the needed ipmp cleanup (e.g., of ipif_bound_ill) 2441 * can be completed. Note that we do not want to 2442 * destroy the nce that was created on the ipmp_ill 2443 * for the active copy of the duplicate address in 2444 * use. 2445 */ 2446 if (IS_IPMP(ill)) 2447 ipmp_illgrp_del_ipif(ill->ill_grp, ipif); 2448 err = EADDRNOTAVAIL; 2449 } 2450 return (err); 2451 } 2452 2453 if (ill->ill_ipif_up_count == 1 && !loopback) { 2454 /* Recover any additional IREs entries for this ill */ 2455 (void) ill_recover_saved_ire(ill); 2456 } 2457 2458 if (ill->ill_need_recover_multicast) { 2459 /* 2460 * Need to recover all multicast memberships in the driver. 2461 * This had to be deferred until we had attached. 2462 */ 2463 ill_recover_multicast(ill); 2464 } 2465 2466 if (ill->ill_ipif_up_count == 1) { 2467 /* 2468 * Since the interface is now up, it may now be active. 2469 */ 2470 if (IS_UNDER_IPMP(ill)) 2471 ipmp_ill_refresh_active(ill); 2472 } 2473 2474 /* Join the allhosts multicast address and the solicited node MC */ 2475 ipif_multicast_up(ipif); 2476 2477 /* Perhaps ilgs should use this ill */ 2478 update_conn_ill(NULL, ill->ill_ipst); 2479 2480 if (ipif->ipif_addr_ready) 2481 ipif_up_notify(ipif); 2482 2483 return (0); 2484 } 2485 2486 /* 2487 * Add the IREs associated with the ipif. 2488 * Those MUST be explicitly removed in ipif_delete_ires_v6. 2489 */ 2490 static int 2491 ipif_add_ires_v6(ipif_t *ipif, boolean_t loopback) 2492 { 2493 ill_t *ill = ipif->ipif_ill; 2494 ip_stack_t *ipst = ill->ill_ipst; 2495 ire_t *ire_array[20]; 2496 ire_t **irep = ire_array; 2497 ire_t **irep1; 2498 in6_addr_t v6addr; 2499 in6_addr_t route_mask; 2500 int err; 2501 char buf[INET6_ADDRSTRLEN]; 2502 ire_t *ire_local = NULL; /* LOCAL or LOOPBACK */ 2503 2504 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 2505 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 2506 2507 /* 2508 * If we're on a labeled system then make sure that zone- 2509 * private addresses have proper remote host database entries. 2510 */ 2511 if (is_system_labeled() && 2512 ipif->ipif_ire_type != IRE_LOOPBACK) { 2513 if (ip6opt_ls == 0) { 2514 cmn_err(CE_WARN, "IPv6 not enabled " 2515 "via /etc/system"); 2516 return (EINVAL); 2517 } 2518 if (!tsol_check_interface_address(ipif)) 2519 return (EINVAL); 2520 } 2521 2522 /* Register the source address for __sin6_src_id */ 2523 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 2524 ipif->ipif_zoneid, ipst); 2525 if (err != 0) { 2526 ip0dbg(("ipif_add_ires_v6: srcid_insert %d\n", err)); 2527 return (err); 2528 } 2529 /* 2530 * If the interface address is set, create the LOCAL 2531 * or LOOPBACK IRE. 2532 */ 2533 ip1dbg(("ipif_add_ires_v6: creating IRE %d for %s\n", 2534 ipif->ipif_ire_type, 2535 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 2536 buf, sizeof (buf)))); 2537 2538 ire_local = ire_create_v6( 2539 &ipif->ipif_v6lcl_addr, /* dest address */ 2540 &ipv6_all_ones, /* mask */ 2541 NULL, /* no gateway */ 2542 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 2543 ipif->ipif_ill, /* interface */ 2544 ipif->ipif_zoneid, 2545 ((ipif->ipif_flags & IPIF_PRIVATE) ? 2546 RTF_PRIVATE : 0) | RTF_KERNEL, 2547 NULL, 2548 ipst); 2549 if (ire_local == NULL) { 2550 ip1dbg(("ipif_up_done_v6: NULL ire_local\n")); 2551 err = ENOMEM; 2552 goto bad; 2553 } 2554 } 2555 2556 /* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */ 2557 if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) && 2558 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2559 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2560 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2561 v6addr = ipif->ipif_v6subnet; 2562 2563 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2564 route_mask = ipv6_all_ones; 2565 } else { 2566 route_mask = ipif->ipif_v6net_mask; 2567 } 2568 2569 ip1dbg(("ipif_add_ires_v6: creating if IRE %d for %s\n", 2570 ill->ill_net_type, 2571 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 2572 2573 *irep++ = ire_create_v6( 2574 &v6addr, /* dest pref */ 2575 &route_mask, /* mask */ 2576 &ipif->ipif_v6lcl_addr, /* gateway */ 2577 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2578 ipif->ipif_ill, 2579 ipif->ipif_zoneid, 2580 ((ipif->ipif_flags & IPIF_PRIVATE) ? 2581 RTF_PRIVATE : 0) | RTF_KERNEL, 2582 NULL, 2583 ipst); 2584 } 2585 2586 /* If an earlier ire_create failed, get out now */ 2587 for (irep1 = irep; irep1 > ire_array; ) { 2588 irep1--; 2589 if (*irep1 == NULL) { 2590 ip1dbg(("ipif_add_ires_v6: NULL ire found in" 2591 " ire_array\n")); 2592 err = ENOMEM; 2593 goto bad; 2594 } 2595 } 2596 2597 /* 2598 * Need to atomically check for IP address availability under 2599 * ip_addr_avail_lock. ill_g_lock is held as reader to ensure no new 2600 * ills or new ipifs can be added while we are checking availability. 2601 */ 2602 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2603 mutex_enter(&ipst->ips_ip_addr_avail_lock); 2604 ill->ill_ipif_up_count++; 2605 ipif->ipif_flags |= IPIF_UP; 2606 err = ip_addr_availability_check(ipif); 2607 mutex_exit(&ipst->ips_ip_addr_avail_lock); 2608 rw_exit(&ipst->ips_ill_g_lock); 2609 2610 if (err != 0) { 2611 /* 2612 * Our address may already be up on the same ill. In this case, 2613 * the external resolver entry for our ipif replaced the one for 2614 * the other ipif. So we don't want to delete it (otherwise the 2615 * other ipif would be unable to send packets). 2616 * ip_addr_availability_check() identifies this case for us and 2617 * returns EADDRINUSE; Caller must turn it into EADDRNOTAVAIL 2618 * which is the expected error code. 2619 * 2620 * Note that ipif_ndp_down() will only delete the nce in the 2621 * case when the nce_ipif_cnt drops to 0. 2622 */ 2623 ill->ill_ipif_up_count--; 2624 ipif->ipif_flags &= ~IPIF_UP; 2625 goto bad; 2626 } 2627 2628 /* 2629 * Add in all newly created IREs. 2630 */ 2631 if (ire_local != NULL) { 2632 ire_local = ire_add(ire_local); 2633 #ifdef DEBUG 2634 if (ire_local != NULL) { 2635 ire_refhold_notr(ire_local); 2636 ire_refrele(ire_local); 2637 } 2638 #endif 2639 } 2640 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER); 2641 if (ire_local != NULL) 2642 ipif->ipif_ire_local = ire_local; 2643 rw_exit(&ipst->ips_ill_g_lock); 2644 ire_local = NULL; 2645 2646 for (irep1 = irep; irep1 > ire_array; ) { 2647 irep1--; 2648 /* Shouldn't be adding any bcast ire's */ 2649 ASSERT((*irep1)->ire_type != IRE_BROADCAST); 2650 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2651 /* refheld by ire_add */ 2652 *irep1 = ire_add(*irep1); 2653 if (*irep1 != NULL) { 2654 ire_refrele(*irep1); 2655 *irep1 = NULL; 2656 } 2657 } 2658 2659 if (ipif->ipif_addr_ready) 2660 ipif_up_notify(ipif); 2661 return (0); 2662 2663 bad: 2664 if (ire_local != NULL) 2665 ire_delete(ire_local); 2666 while (irep > ire_array) { 2667 irep--; 2668 if (*irep != NULL) 2669 ire_delete(*irep); 2670 } 2671 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst); 2672 2673 return (err); 2674 } 2675 2676 /* Remove all the IREs created by ipif_add_ires_v6 */ 2677 void 2678 ipif_delete_ires_v6(ipif_t *ipif) 2679 { 2680 ill_t *ill = ipif->ipif_ill; 2681 ip_stack_t *ipst = ill->ill_ipst; 2682 in6_addr_t v6addr; 2683 in6_addr_t route_mask; 2684 ire_t *ire; 2685 int match_args; 2686 boolean_t loopback; 2687 2688 /* Check if this is a loopback interface */ 2689 loopback = (ipif->ipif_ill->ill_wq == NULL); 2690 2691 match_args = MATCH_IRE_TYPE | MATCH_IRE_ILL | MATCH_IRE_MASK | 2692 MATCH_IRE_ZONEONLY; 2693 2694 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER); 2695 if ((ire = ipif->ipif_ire_local) != NULL) { 2696 ipif->ipif_ire_local = NULL; 2697 rw_exit(&ipst->ips_ill_g_lock); 2698 /* 2699 * Move count to ipif so we don't loose the count due to 2700 * a down/up dance. 2701 */ 2702 atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count); 2703 2704 ire_delete(ire); 2705 ire_refrele_notr(ire); 2706 } else { 2707 rw_exit(&ipst->ips_ill_g_lock); 2708 } 2709 2710 match_args |= MATCH_IRE_GW; 2711 2712 /* 2713 * Delete the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. 2714 * Note that atun interfaces have an all-zero ipif_v6subnet. 2715 * Thus we allow a zero subnet as long as the mask is non-zero. 2716 */ 2717 if (IS_UNDER_IPMP(ill)) 2718 match_args |= MATCH_IRE_TESTHIDDEN; 2719 2720 if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) && 2721 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2722 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2723 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2724 v6addr = ipif->ipif_v6subnet; 2725 2726 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2727 route_mask = ipv6_all_ones; 2728 } else { 2729 route_mask = ipif->ipif_v6net_mask; 2730 } 2731 2732 ire = ire_ftable_lookup_v6( 2733 &v6addr, /* dest pref */ 2734 &route_mask, /* mask */ 2735 &ipif->ipif_v6lcl_addr, /* gateway */ 2736 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2737 ipif->ipif_ill, 2738 ipif->ipif_zoneid, 2739 NULL, 2740 match_args, 2741 0, 2742 ipst, 2743 NULL); 2744 ASSERT(ire != NULL); 2745 ire_delete(ire); 2746 ire_refrele(ire); 2747 } 2748 } 2749 2750 /* 2751 * Delete an ND entry if it exists. 2752 */ 2753 /* ARGSUSED */ 2754 int 2755 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2756 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2757 { 2758 sin6_t *sin6; 2759 struct lifreq *lifr; 2760 lif_nd_req_t *lnr; 2761 ill_t *ill = ipif->ipif_ill; 2762 nce_t *nce; 2763 2764 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2765 lnr = &lifr->lifr_nd; 2766 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2767 if (ipif->ipif_id != 0) 2768 return (EINVAL); 2769 2770 if (!ipif->ipif_isv6) 2771 return (EINVAL); 2772 2773 if (lnr->lnr_addr.ss_family != AF_INET6) 2774 return (EAFNOSUPPORT); 2775 2776 sin6 = (sin6_t *)&lnr->lnr_addr; 2777 2778 /* 2779 * Since ND mappings must be consistent across an IPMP group, prohibit 2780 * deleting ND mappings on underlying interfaces. 2781 * Don't allow deletion of mappings for local addresses. 2782 */ 2783 if (IS_UNDER_IPMP(ill)) 2784 return (EPERM); 2785 2786 nce = nce_lookup_v6(ill, &sin6->sin6_addr); 2787 if (nce == NULL) 2788 return (ESRCH); 2789 2790 if (NCE_MYADDR(nce->nce_common)) { 2791 nce_refrele(nce); 2792 return (EPERM); 2793 } 2794 2795 /* 2796 * delete the nce_common which will also delete the nces on any 2797 * under_ill in the case of ipmp. 2798 */ 2799 ncec_delete(nce->nce_common); 2800 nce_refrele(nce); 2801 return (0); 2802 } 2803 2804 /* 2805 * Return nbr cache info. 2806 */ 2807 /* ARGSUSED */ 2808 int 2809 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2810 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2811 { 2812 ill_t *ill = ipif->ipif_ill; 2813 struct lifreq *lifr; 2814 lif_nd_req_t *lnr; 2815 2816 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2817 lnr = &lifr->lifr_nd; 2818 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2819 if (ipif->ipif_id != 0) 2820 return (EINVAL); 2821 2822 if (!ipif->ipif_isv6) 2823 return (EINVAL); 2824 2825 if (lnr->lnr_addr.ss_family != AF_INET6) 2826 return (EAFNOSUPPORT); 2827 2828 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 2829 return (EINVAL); 2830 2831 return (ndp_query(ill, lnr)); 2832 } 2833 2834 /* 2835 * Perform an update of the nd entry for the specified address. 2836 */ 2837 /* ARGSUSED */ 2838 int 2839 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2840 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2841 { 2842 sin6_t *sin6; 2843 ill_t *ill = ipif->ipif_ill; 2844 struct lifreq *lifr; 2845 lif_nd_req_t *lnr; 2846 ire_t *ire; 2847 2848 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2849 lnr = &lifr->lifr_nd; 2850 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2851 if (ipif->ipif_id != 0) 2852 return (EINVAL); 2853 2854 if (!ipif->ipif_isv6) 2855 return (EINVAL); 2856 2857 if (lnr->lnr_addr.ss_family != AF_INET6) 2858 return (EAFNOSUPPORT); 2859 2860 sin6 = (sin6_t *)&lnr->lnr_addr; 2861 2862 /* 2863 * Since ND mappings must be consistent across an IPMP group, prohibit 2864 * updating ND mappings on underlying interfaces. Also, since ND 2865 * mappings for IPMP data addresses are owned by IP itself, prohibit 2866 * updating them. 2867 */ 2868 if (IS_UNDER_IPMP(ill)) 2869 return (EPERM); 2870 2871 if (IS_IPMP(ill)) { 2872 ire = ire_ftable_lookup_v6(&sin6->sin6_addr, NULL, NULL, 2873 IRE_LOCAL, ill, ALL_ZONES, NULL, 2874 MATCH_IRE_TYPE | MATCH_IRE_ILL, 0, ill->ill_ipst, NULL); 2875 if (ire != NULL) { 2876 ire_refrele(ire); 2877 return (EPERM); 2878 } 2879 } 2880 2881 return (ndp_sioc_update(ill, lnr)); 2882 } 2883