1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 1990 Mentat Inc. 27 */ 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 /* 32 * This file contains the interface control functions for IPv6. 33 */ 34 35 #include <sys/types.h> 36 #include <sys/sysmacros.h> 37 #include <sys/stream.h> 38 #include <sys/dlpi.h> 39 #include <sys/stropts.h> 40 #include <sys/ddi.h> 41 #include <sys/cmn_err.h> 42 #include <sys/kstat.h> 43 #include <sys/debug.h> 44 #include <sys/zone.h> 45 #include <sys/policy.h> 46 47 #include <sys/systm.h> 48 #include <sys/param.h> 49 #include <sys/socket.h> 50 #include <sys/isa_defs.h> 51 #include <net/if.h> 52 #include <net/if_dl.h> 53 #include <net/route.h> 54 #include <netinet/in.h> 55 #include <netinet/igmp_var.h> 56 #include <netinet/ip6.h> 57 #include <netinet/icmp6.h> 58 #include <netinet/in.h> 59 60 #include <inet/common.h> 61 #include <inet/nd.h> 62 #include <inet/mib2.h> 63 #include <inet/ip.h> 64 #include <inet/ip6.h> 65 #include <inet/ip_multi.h> 66 #include <inet/ip_ire.h> 67 #include <inet/ip_rts.h> 68 #include <inet/ip_ndp.h> 69 #include <inet/ip_if.h> 70 #include <inet/ip6_asp.h> 71 #include <inet/tun.h> 72 #include <inet/ipclassifier.h> 73 #include <inet/sctp_ip.h> 74 75 #include <sys/tsol/tndb.h> 76 #include <sys/tsol/tnet.h> 77 78 static in6_addr_t ipv6_ll_template = 79 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 80 81 static ipif_t * 82 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 83 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst); 84 85 /* 86 * ipif_lookup_group_v6 87 */ 88 ipif_t * 89 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst) 90 { 91 ire_t *ire; 92 ipif_t *ipif; 93 94 ire = ire_lookup_multi_v6(group, zoneid, ipst); 95 if (ire == NULL) 96 return (NULL); 97 ipif = ire->ire_ipif; 98 ipif_refhold(ipif); 99 ire_refrele(ire); 100 return (ipif); 101 } 102 103 /* 104 * ill_lookup_group_v6 105 */ 106 ill_t * 107 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst) 108 { 109 ire_t *ire; 110 ill_t *ill; 111 112 ire = ire_lookup_multi_v6(group, zoneid, ipst); 113 if (ire == NULL) 114 return (NULL); 115 ill = ire->ire_ipif->ipif_ill; 116 ill_refhold(ill); 117 ire_refrele(ire); 118 return (ill); 119 } 120 121 /* 122 * Look for an ipif with the specified interface address and destination. 123 * The destination address is used only for matching point-to-point interfaces. 124 */ 125 static ipif_t * 126 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 127 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst) 128 { 129 ipif_t *ipif; 130 ill_t *ill; 131 ipsq_t *ipsq; 132 ill_walk_context_t ctx; 133 134 if (error != NULL) 135 *error = 0; 136 137 /* 138 * First match all the point-to-point interfaces 139 * before looking at non-point-to-point interfaces. 140 * This is done to avoid returning non-point-to-point 141 * ipif instead of unnumbered point-to-point ipif. 142 */ 143 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 144 ill = ILL_START_WALK_V6(&ctx, ipst); 145 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 146 GRAB_CONN_LOCK(q); 147 mutex_enter(&ill->ill_lock); 148 for (ipif = ill->ill_ipif; ipif != NULL; 149 ipif = ipif->ipif_next) { 150 /* Allow the ipif to be down */ 151 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 152 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 153 if_addr)) && 154 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 155 dst))) { 156 if (IPIF_CAN_LOOKUP(ipif)) { 157 ipif_refhold_locked(ipif); 158 mutex_exit(&ill->ill_lock); 159 RELEASE_CONN_LOCK(q); 160 rw_exit(&ipst->ips_ill_g_lock); 161 return (ipif); 162 } else if (IPIF_CAN_WAIT(ipif, q)) { 163 ipsq = ill->ill_phyint->phyint_ipsq; 164 mutex_enter(&ipsq->ipsq_lock); 165 mutex_exit(&ill->ill_lock); 166 rw_exit(&ipst->ips_ill_g_lock); 167 ipsq_enq(ipsq, q, mp, func, NEW_OP, 168 ill); 169 mutex_exit(&ipsq->ipsq_lock); 170 RELEASE_CONN_LOCK(q); 171 *error = EINPROGRESS; 172 return (NULL); 173 } 174 } 175 } 176 mutex_exit(&ill->ill_lock); 177 RELEASE_CONN_LOCK(q); 178 } 179 rw_exit(&ipst->ips_ill_g_lock); 180 /* lookup the ipif based on interface address */ 181 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func, 182 error, ipst); 183 ASSERT(ipif == NULL || ipif->ipif_isv6); 184 return (ipif); 185 } 186 187 /* 188 * Look for an ipif with the specified address. For point-point links 189 * we look for matches on either the destination address and the local 190 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 191 * is set. 192 * Matches on a specific ill if match_ill is set. 193 */ 194 /* ARGSUSED */ 195 ipif_t * 196 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 197 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst) 198 { 199 ipif_t *ipif; 200 ill_t *ill; 201 boolean_t ptp = B_FALSE; 202 ipsq_t *ipsq; 203 ill_walk_context_t ctx; 204 205 if (error != NULL) 206 *error = 0; 207 208 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 209 /* 210 * Repeat twice, first based on local addresses and 211 * next time for pointopoint. 212 */ 213 repeat: 214 ill = ILL_START_WALK_V6(&ctx, ipst); 215 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 216 if (match_ill != NULL && ill != match_ill) { 217 continue; 218 } 219 GRAB_CONN_LOCK(q); 220 mutex_enter(&ill->ill_lock); 221 for (ipif = ill->ill_ipif; ipif != NULL; 222 ipif = ipif->ipif_next) { 223 if (zoneid != ALL_ZONES && 224 ipif->ipif_zoneid != zoneid && 225 ipif->ipif_zoneid != ALL_ZONES) 226 continue; 227 /* Allow the ipif to be down */ 228 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 229 &ipif->ipif_v6lcl_addr, addr) && 230 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 231 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 232 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 233 addr))) { 234 if (IPIF_CAN_LOOKUP(ipif)) { 235 ipif_refhold_locked(ipif); 236 mutex_exit(&ill->ill_lock); 237 RELEASE_CONN_LOCK(q); 238 rw_exit(&ipst->ips_ill_g_lock); 239 return (ipif); 240 } else if (IPIF_CAN_WAIT(ipif, q)) { 241 ipsq = ill->ill_phyint->phyint_ipsq; 242 mutex_enter(&ipsq->ipsq_lock); 243 mutex_exit(&ill->ill_lock); 244 rw_exit(&ipst->ips_ill_g_lock); 245 ipsq_enq(ipsq, q, mp, func, NEW_OP, 246 ill); 247 mutex_exit(&ipsq->ipsq_lock); 248 RELEASE_CONN_LOCK(q); 249 *error = EINPROGRESS; 250 return (NULL); 251 } 252 } 253 } 254 mutex_exit(&ill->ill_lock); 255 RELEASE_CONN_LOCK(q); 256 } 257 258 /* If we already did the ptp case, then we are done */ 259 if (ptp) { 260 rw_exit(&ipst->ips_ill_g_lock); 261 if (error != NULL) 262 *error = ENXIO; 263 return (NULL); 264 } 265 ptp = B_TRUE; 266 goto repeat; 267 } 268 269 /* 270 * Look for an ipif with the specified address. For point-point links 271 * we look for matches on either the destination address and the local 272 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 273 * is set. 274 * Matches on a specific ill if match_ill is set. 275 * Return the zoneid for the ipif. ALL_ZONES if none found. 276 */ 277 zoneid_t 278 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill, 279 ip_stack_t *ipst) 280 { 281 ipif_t *ipif; 282 ill_t *ill; 283 boolean_t ptp = B_FALSE; 284 ill_walk_context_t ctx; 285 zoneid_t zoneid; 286 287 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 288 /* 289 * Repeat twice, first based on local addresses and 290 * next time for pointopoint. 291 */ 292 repeat: 293 ill = ILL_START_WALK_V6(&ctx, ipst); 294 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 295 if (match_ill != NULL && ill != match_ill) { 296 continue; 297 } 298 mutex_enter(&ill->ill_lock); 299 for (ipif = ill->ill_ipif; ipif != NULL; 300 ipif = ipif->ipif_next) { 301 /* Allow the ipif to be down */ 302 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 303 &ipif->ipif_v6lcl_addr, addr) && 304 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 305 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 306 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 307 addr)) && 308 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) { 309 zoneid = ipif->ipif_zoneid; 310 mutex_exit(&ill->ill_lock); 311 rw_exit(&ipst->ips_ill_g_lock); 312 /* 313 * If ipif_zoneid was ALL_ZONES then we have 314 * a trusted extensions shared IP address. 315 * In that case GLOBAL_ZONEID works to send. 316 */ 317 if (zoneid == ALL_ZONES) 318 zoneid = GLOBAL_ZONEID; 319 return (zoneid); 320 } 321 } 322 mutex_exit(&ill->ill_lock); 323 } 324 325 /* If we already did the ptp case, then we are done */ 326 if (ptp) { 327 rw_exit(&ipst->ips_ill_g_lock); 328 return (ALL_ZONES); 329 } 330 ptp = B_TRUE; 331 goto repeat; 332 } 333 334 /* 335 * Perform various checks to verify that an address would make sense as a local 336 * interface address. This is currently only called when an attempt is made 337 * to set a local address. 338 * 339 * Does not allow a v4-mapped address, an address that equals the subnet 340 * anycast address, ... a multicast address, ... 341 */ 342 boolean_t 343 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 344 { 345 in6_addr_t subnet; 346 347 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 348 return (B_TRUE); /* Allow all zeros */ 349 350 /* 351 * Don't allow all zeroes or host part, but allow 352 * all ones netmask. 353 */ 354 V6_MASK_COPY(*addr, *subnet_mask, subnet); 355 if (IN6_IS_ADDR_V4MAPPED(addr) || 356 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 357 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 358 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 359 IN6_IS_ADDR_MULTICAST(addr)) 360 return (B_FALSE); 361 362 return (B_TRUE); 363 } 364 365 /* 366 * Perform various checks to verify that an address would make sense as a 367 * remote/subnet interface address. 368 */ 369 boolean_t 370 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 371 { 372 in6_addr_t subnet; 373 374 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 375 return (B_TRUE); /* Allow all zeros */ 376 377 V6_MASK_COPY(*addr, *subnet_mask, subnet); 378 if (IN6_IS_ADDR_V4MAPPED(addr) || 379 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 380 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 381 IN6_IS_ADDR_MULTICAST(addr) || 382 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 383 return (B_FALSE); 384 385 return (B_TRUE); 386 } 387 388 /* 389 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 390 * ipif_arg is passed in to associate it with the correct interface 391 * (for link-local destinations and gateways). 392 */ 393 /* ARGSUSED1 */ 394 int 395 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 396 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 397 ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func, 398 struct rtsa_s *sp, ip_stack_t *ipst) 399 { 400 ire_t *ire; 401 ire_t *gw_ire = NULL; 402 ipif_t *ipif; 403 boolean_t ipif_refheld = B_FALSE; 404 uint_t type; 405 int match_flags = MATCH_IRE_TYPE; 406 int error; 407 tsol_gc_t *gc = NULL; 408 tsol_gcgrp_t *gcgrp = NULL; 409 boolean_t gcgrp_xtraref = B_FALSE; 410 411 if (ire_arg != NULL) 412 *ire_arg = NULL; 413 414 /* 415 * Prevent routes with a zero gateway from being created (since 416 * interfaces can currently be plumbed and brought up with no assigned 417 * address). 418 */ 419 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 420 return (ENETUNREACH); 421 422 /* 423 * If this is the case of RTF_HOST being set, then we set the netmask 424 * to all ones (regardless if one was supplied). 425 */ 426 if (flags & RTF_HOST) 427 mask = &ipv6_all_ones; 428 429 /* 430 * Get the ipif, if any, corresponding to the gw_addr 431 */ 432 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, 433 &error, ipst); 434 if (ipif != NULL) 435 ipif_refheld = B_TRUE; 436 else if (error == EINPROGRESS) { 437 ip1dbg(("ip_rt_add_v6: null and EINPROGRESS")); 438 return (error); 439 } 440 441 /* 442 * GateD will attempt to create routes with a loopback interface 443 * address as the gateway and with RTF_GATEWAY set. We allow 444 * these routes to be added, but create them as interface routes 445 * since the gateway is an interface address. 446 */ 447 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) { 448 flags &= ~RTF_GATEWAY; 449 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) && 450 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) && 451 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) { 452 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 453 ipif, ALL_ZONES, NULL, match_flags, ipst); 454 if (ire != NULL) { 455 ire_refrele(ire); 456 if (ipif_refheld) 457 ipif_refrele(ipif); 458 return (EEXIST); 459 } 460 ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x" 461 "for 0x%x\n", (void *)ipif, 462 ipif->ipif_ire_type, 463 ntohl(ipif->ipif_lcl_addr))); 464 ire = ire_create_v6( 465 dst_addr, 466 mask, 467 &ipif->ipif_v6src_addr, 468 NULL, 469 &ipif->ipif_mtu, 470 NULL, 471 NULL, 472 NULL, 473 ipif->ipif_net_type, 474 ipif->ipif_resolver_mp, 475 ipif, 476 NULL, 477 0, 478 0, 479 flags, 480 &ire_uinfo_null, 481 NULL, 482 NULL, 483 ipst); 484 if (ire == NULL) { 485 if (ipif_refheld) 486 ipif_refrele(ipif); 487 return (ENOMEM); 488 } 489 error = ire_add(&ire, q, mp, func, B_FALSE); 490 if (error == 0) 491 goto save_ire; 492 /* 493 * In the result of failure, ire_add() will have already 494 * deleted the ire in question, so there is no need to 495 * do that here. 496 */ 497 if (ipif_refheld) 498 ipif_refrele(ipif); 499 return (error); 500 } 501 } 502 503 /* 504 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 505 * and the gateway address provided is one of the system's interface 506 * addresses. By using the routing socket interface and supplying an 507 * RTA_IFP sockaddr with an interface index, an alternate method of 508 * specifying an interface route to be created is available which uses 509 * the interface index that specifies the outgoing interface rather than 510 * the address of an outgoing interface (which may not be able to 511 * uniquely identify an interface). When coupled with the RTF_GATEWAY 512 * flag, routes can be specified which not only specify the next-hop to 513 * be used when routing to a certain prefix, but also which outgoing 514 * interface should be used. 515 * 516 * Previously, interfaces would have unique addresses assigned to them 517 * and so the address assigned to a particular interface could be used 518 * to identify a particular interface. One exception to this was the 519 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 520 * 521 * With the advent of IPv6 and its link-local addresses, this 522 * restriction was relaxed and interfaces could share addresses between 523 * themselves. In fact, typically all of the link-local interfaces on 524 * an IPv6 node or router will have the same link-local address. In 525 * order to differentiate between these interfaces, the use of an 526 * interface index is necessary and this index can be carried inside a 527 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 528 * of using the interface index, however, is that all of the ipif's that 529 * are part of an ill have the same index and so the RTA_IFP sockaddr 530 * cannot be used to differentiate between ipif's (or logical 531 * interfaces) that belong to the same ill (physical interface). 532 * 533 * For example, in the following case involving IPv4 interfaces and 534 * logical interfaces 535 * 536 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 537 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0:1 538 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0:2 539 * 540 * the ipif's corresponding to each of these interface routes can be 541 * uniquely identified by the "gateway" (actually interface address). 542 * 543 * In this case involving multiple IPv6 default routes to a particular 544 * link-local gateway, the use of RTA_IFP is necessary to specify which 545 * default route is of interest: 546 * 547 * default fe80::123:4567:89ab:cdef U if0 548 * default fe80::123:4567:89ab:cdef U if1 549 */ 550 551 /* RTF_GATEWAY not set */ 552 if (!(flags & RTF_GATEWAY)) { 553 queue_t *stq; 554 555 if (sp != NULL) { 556 ip2dbg(("ip_rt_add_v6: gateway security attributes " 557 "cannot be set with interface route\n")); 558 if (ipif_refheld) 559 ipif_refrele(ipif); 560 return (EINVAL); 561 } 562 563 /* 564 * As the interface index specified with the RTA_IFP sockaddr is 565 * the same for all ipif's off of an ill, the matching logic 566 * below uses MATCH_IRE_ILL if such an index was specified. 567 * This means that routes sharing the same prefix when added 568 * using a RTA_IFP sockaddr must have distinct interface 569 * indices (namely, they must be on distinct ill's). 570 * 571 * On the other hand, since the gateway address will usually be 572 * different for each ipif on the system, the matching logic 573 * uses MATCH_IRE_IPIF in the case of a traditional interface 574 * route. This means that interface routes for the same prefix 575 * can be created if they belong to distinct ipif's and if a 576 * RTA_IFP sockaddr is not present. 577 */ 578 if (ipif_arg != NULL) { 579 if (ipif_refheld) { 580 ipif_refrele(ipif); 581 ipif_refheld = B_FALSE; 582 } 583 ipif = ipif_arg; 584 match_flags |= MATCH_IRE_ILL; 585 } else { 586 /* 587 * Check the ipif corresponding to the gw_addr 588 */ 589 if (ipif == NULL) 590 return (ENETUNREACH); 591 match_flags |= MATCH_IRE_IPIF; 592 } 593 594 ASSERT(ipif != NULL); 595 /* 596 * We check for an existing entry at this point. 597 */ 598 match_flags |= MATCH_IRE_MASK; 599 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE, 600 ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 601 if (ire != NULL) { 602 ire_refrele(ire); 603 if (ipif_refheld) 604 ipif_refrele(ipif); 605 return (EEXIST); 606 } 607 608 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 609 ? ipif->ipif_rq : ipif->ipif_wq; 610 611 /* 612 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or 613 * IRE_IF_RESOLVER with the modified address and netmask. 614 */ 615 ire = ire_create_v6( 616 dst_addr, 617 mask, 618 &ipif->ipif_v6src_addr, 619 NULL, 620 &ipif->ipif_mtu, 621 NULL, 622 NULL, 623 stq, 624 ipif->ipif_net_type, 625 ipif->ipif_resolver_mp, 626 ipif, 627 NULL, 628 0, 629 0, 630 flags, 631 &ire_uinfo_null, 632 NULL, 633 NULL, 634 ipst); 635 if (ire == NULL) { 636 if (ipif_refheld) 637 ipif_refrele(ipif); 638 return (ENOMEM); 639 } 640 641 /* 642 * Some software (for example, GateD and Sun Cluster) attempts 643 * to create (what amount to) IRE_PREFIX routes with the 644 * loopback address as the gateway. This is primarily done to 645 * set up prefixes with the RTF_REJECT flag set (for example, 646 * when generating aggregate routes.) 647 * 648 * If the IRE type (as defined by ipif->ipif_net_type) is 649 * IRE_LOOPBACK, then we map the request into a 650 * IRE_IF_NORESOLVER. 651 * 652 * Needless to say, the real IRE_LOOPBACK is NOT created by this 653 * routine, but rather using ire_create_v6() directly. 654 */ 655 if (ipif->ipif_net_type == IRE_LOOPBACK) 656 ire->ire_type = IRE_IF_NORESOLVER; 657 error = ire_add(&ire, q, mp, func, B_FALSE); 658 if (error == 0) 659 goto save_ire; 660 /* 661 * In the result of failure, ire_add() will have already 662 * deleted the ire in question, so there is no need to 663 * do that here. 664 */ 665 if (ipif_refheld) 666 ipif_refrele(ipif); 667 return (error); 668 } 669 if (ipif_refheld) { 670 ipif_refrele(ipif); 671 ipif_refheld = B_FALSE; 672 } 673 674 /* 675 * Get an interface IRE for the specified gateway. 676 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 677 * gateway, it is currently unreachable and we fail the request 678 * accordingly. 679 */ 680 ipif = ipif_arg; 681 if (ipif_arg != NULL) 682 match_flags |= MATCH_IRE_ILL; 683 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, 684 NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 685 if (gw_ire == NULL) 686 return (ENETUNREACH); 687 688 /* 689 * We create one of three types of IREs as a result of this request 690 * based on the netmask. A netmask of all ones (which is automatically 691 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 692 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 693 * created. Otherwise, an IRE_PREFIX route is created for the 694 * destination prefix. 695 */ 696 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 697 type = IRE_HOST; 698 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 699 type = IRE_DEFAULT; 700 else 701 type = IRE_PREFIX; 702 703 /* check for a duplicate entry */ 704 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg, 705 NULL, ALL_ZONES, 0, NULL, 706 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst); 707 if (ire != NULL) { 708 ire_refrele(gw_ire); 709 ire_refrele(ire); 710 return (EEXIST); 711 } 712 713 /* Security attribute exists */ 714 if (sp != NULL) { 715 tsol_gcgrp_addr_t ga; 716 717 /* find or create the gateway credentials group */ 718 ga.ga_af = AF_INET6; 719 ga.ga_addr = *gw_addr; 720 721 /* we hold reference to it upon success */ 722 gcgrp = gcgrp_lookup(&ga, B_TRUE); 723 if (gcgrp == NULL) { 724 ire_refrele(gw_ire); 725 return (ENOMEM); 726 } 727 728 /* 729 * Create and add the security attribute to the group; a 730 * reference to the group is made upon allocating a new 731 * entry successfully. If it finds an already-existing 732 * entry for the security attribute in the group, it simply 733 * returns it and no new reference is made to the group. 734 */ 735 gc = gc_create(sp, gcgrp, &gcgrp_xtraref); 736 if (gc == NULL) { 737 /* release reference held by gcgrp_lookup */ 738 GCGRP_REFRELE(gcgrp); 739 ire_refrele(gw_ire); 740 return (ENOMEM); 741 } 742 } 743 744 /* Create the IRE. */ 745 ire = ire_create_v6( 746 dst_addr, /* dest address */ 747 mask, /* mask */ 748 /* src address assigned by the caller? */ 749 (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ? 750 src_addr : NULL), 751 gw_addr, /* gateway address */ 752 &gw_ire->ire_max_frag, 753 NULL, /* no Fast Path header */ 754 NULL, /* no recv-from queue */ 755 NULL, /* no send-to queue */ 756 (ushort_t)type, /* IRE type */ 757 NULL, 758 ipif_arg, 759 NULL, 760 0, 761 0, 762 flags, 763 &gw_ire->ire_uinfo, /* Inherit ULP info from gw */ 764 gc, /* security attribute */ 765 NULL, 766 ipst); 767 768 /* 769 * The ire holds a reference to the 'gc' and the 'gc' holds a 770 * reference to the 'gcgrp'. We can now release the extra reference 771 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used. 772 */ 773 if (gcgrp_xtraref) 774 GCGRP_REFRELE(gcgrp); 775 if (ire == NULL) { 776 if (gc != NULL) 777 GC_REFRELE(gc); 778 ire_refrele(gw_ire); 779 return (ENOMEM); 780 } 781 782 /* 783 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 784 * SUN/OS socket stuff does but do we really want to allow ::0 ? 785 */ 786 787 /* Add the new IRE. */ 788 error = ire_add(&ire, q, mp, func, B_FALSE); 789 /* 790 * In the result of failure, ire_add() will have already 791 * deleted the ire in question, so there is no need to 792 * do that here. 793 */ 794 if (error != 0) { 795 ire_refrele(gw_ire); 796 return (error); 797 } 798 799 if (flags & RTF_MULTIRT) { 800 /* 801 * Invoke the CGTP (multirouting) filtering module 802 * to add the dst address in the filtering database. 803 * Replicated inbound packets coming from that address 804 * will be filtered to discard the duplicates. 805 * It is not necessary to call the CGTP filter hook 806 * when the dst address is a multicast, because an 807 * IP source address cannot be a multicast. 808 */ 809 if ((ip_cgtp_filter_ops != NULL) && 810 ipst->ips_netstack->netstack_stackid == GLOBAL_NETSTACKID && 811 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 812 int res = ip_cgtp_filter_ops->cfo_add_dest_v6( 813 &ire->ire_addr_v6, 814 &ire->ire_gateway_addr_v6, 815 &ire->ire_src_addr_v6, 816 &gw_ire->ire_src_addr_v6); 817 if (res != 0) { 818 ire_refrele(gw_ire); 819 ire_delete(ire); 820 return (res); 821 } 822 } 823 } 824 825 /* 826 * Now that the prefix IRE entry has been created, delete any 827 * existing gateway IRE cache entries as well as any IRE caches 828 * using the gateway, and force them to be created through 829 * ip_newroute_v6. 830 */ 831 if (gc != NULL) { 832 ASSERT(gcgrp != NULL); 833 ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES, ipst); 834 } 835 836 save_ire: 837 if (gw_ire != NULL) { 838 ire_refrele(gw_ire); 839 } 840 if (ipif != NULL) { 841 mblk_t *save_mp; 842 843 /* 844 * Save enough information so that we can recreate the IRE if 845 * the interface goes down and then up. The metrics associated 846 * with the route will be saved as well when rts_setmetrics() is 847 * called after the IRE has been created. In the case where 848 * memory cannot be allocated, none of this information will be 849 * saved. 850 */ 851 save_mp = allocb(sizeof (ifrt_t), BPRI_MED); 852 if (save_mp != NULL) { 853 ifrt_t *ifrt; 854 855 save_mp->b_wptr += sizeof (ifrt_t); 856 ifrt = (ifrt_t *)save_mp->b_rptr; 857 bzero(ifrt, sizeof (ifrt_t)); 858 ifrt->ifrt_type = ire->ire_type; 859 ifrt->ifrt_v6addr = ire->ire_addr_v6; 860 mutex_enter(&ire->ire_lock); 861 ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6; 862 ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6; 863 mutex_exit(&ire->ire_lock); 864 ifrt->ifrt_v6mask = ire->ire_mask_v6; 865 ifrt->ifrt_flags = ire->ire_flags; 866 ifrt->ifrt_max_frag = ire->ire_max_frag; 867 mutex_enter(&ipif->ipif_saved_ire_lock); 868 save_mp->b_cont = ipif->ipif_saved_ire_mp; 869 ipif->ipif_saved_ire_mp = save_mp; 870 ipif->ipif_saved_ire_cnt++; 871 mutex_exit(&ipif->ipif_saved_ire_lock); 872 } 873 } 874 if (ire_arg != NULL) { 875 /* 876 * Store the ire that was successfully added into where ire_arg 877 * points to so that callers don't have to look it up 878 * themselves (but they are responsible for ire_refrele()ing 879 * the ire when they are finished with it). 880 */ 881 *ire_arg = ire; 882 } else { 883 ire_refrele(ire); /* Held in ire_add */ 884 } 885 if (ipif_refheld) 886 ipif_refrele(ipif); 887 return (0); 888 } 889 890 /* 891 * ip_rt_delete_v6 is called to delete an IPv6 route. 892 * ipif_arg is passed in to associate it with the correct interface 893 * (for link-local destinations and gateways). 894 */ 895 /* ARGSUSED4 */ 896 int 897 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 898 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg, 899 queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst) 900 { 901 ire_t *ire = NULL; 902 ipif_t *ipif; 903 uint_t type; 904 uint_t match_flags = MATCH_IRE_TYPE; 905 int err = 0; 906 boolean_t ipif_refheld = B_FALSE; 907 908 /* 909 * If this is the case of RTF_HOST being set, then we set the netmask 910 * to all ones. Otherwise, we use the netmask if one was supplied. 911 */ 912 if (flags & RTF_HOST) { 913 mask = &ipv6_all_ones; 914 match_flags |= MATCH_IRE_MASK; 915 } else if (rtm_addrs & RTA_NETMASK) { 916 match_flags |= MATCH_IRE_MASK; 917 } 918 919 /* 920 * Note that RTF_GATEWAY is never set on a delete, therefore 921 * we check if the gateway address is one of our interfaces first, 922 * and fall back on RTF_GATEWAY routes. 923 * 924 * This makes it possible to delete an original 925 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 926 * 927 * As the interface index specified with the RTA_IFP sockaddr is the 928 * same for all ipif's off of an ill, the matching logic below uses 929 * MATCH_IRE_ILL if such an index was specified. This means a route 930 * sharing the same prefix and interface index as the the route 931 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr 932 * is specified in the request. 933 * 934 * On the other hand, since the gateway address will usually be 935 * different for each ipif on the system, the matching logic 936 * uses MATCH_IRE_IPIF in the case of a traditional interface 937 * route. This means that interface routes for the same prefix can be 938 * uniquely identified if they belong to distinct ipif's and if a 939 * RTA_IFP sockaddr is not present. 940 * 941 * For more detail on specifying routes by gateway address and by 942 * interface index, see the comments in ip_rt_add_v6(). 943 */ 944 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err, 945 ipst); 946 if (ipif != NULL) { 947 ipif_refheld = B_TRUE; 948 if (ipif_arg != NULL) { 949 ipif_refrele(ipif); 950 ipif_refheld = B_FALSE; 951 ipif = ipif_arg; 952 match_flags |= MATCH_IRE_ILL; 953 } else { 954 match_flags |= MATCH_IRE_IPIF; 955 } 956 957 if (ipif->ipif_ire_type == IRE_LOOPBACK) 958 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 959 ipif, ALL_ZONES, NULL, match_flags, ipst); 960 if (ire == NULL) 961 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, 962 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL, 963 match_flags, ipst); 964 } else if (err == EINPROGRESS) { 965 return (err); 966 } else { 967 err = 0; 968 } 969 if (ire == NULL) { 970 /* 971 * At this point, the gateway address is not one of our own 972 * addresses or a matching interface route was not found. We 973 * set the IRE type to lookup based on whether 974 * this is a host route, a default route or just a prefix. 975 * 976 * If an ipif_arg was passed in, then the lookup is based on an 977 * interface index so MATCH_IRE_ILL is added to match_flags. 978 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is 979 * set as the route being looked up is not a traditional 980 * interface route. 981 */ 982 match_flags &= ~MATCH_IRE_IPIF; 983 match_flags |= MATCH_IRE_GW; 984 if (ipif_arg != NULL) 985 match_flags |= MATCH_IRE_ILL; 986 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 987 type = IRE_HOST; 988 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 989 type = IRE_DEFAULT; 990 else 991 type = IRE_PREFIX; 992 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 993 ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 994 } 995 996 if (ipif_refheld) { 997 ipif_refrele(ipif); 998 ipif_refheld = B_FALSE; 999 } 1000 if (ire == NULL) 1001 return (ESRCH); 1002 1003 if (ire->ire_flags & RTF_MULTIRT) { 1004 /* 1005 * Invoke the CGTP (multirouting) filtering module 1006 * to remove the dst address from the filtering database. 1007 * Packets coming from that address will no longer be 1008 * filtered to remove duplicates. 1009 */ 1010 if (ip_cgtp_filter_ops != NULL && 1011 ipst->ips_netstack->netstack_stackid == GLOBAL_NETSTACKID) { 1012 err = ip_cgtp_filter_ops->cfo_del_dest_v6( 1013 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 1014 } 1015 } 1016 1017 ipif = ire->ire_ipif; 1018 if (ipif != NULL) { 1019 mblk_t **mpp; 1020 mblk_t *mp; 1021 ifrt_t *ifrt; 1022 in6_addr_t gw_addr_v6; 1023 1024 /* Remove from ipif_saved_ire_mp list if it is there */ 1025 mutex_enter(&ire->ire_lock); 1026 gw_addr_v6 = ire->ire_gateway_addr_v6; 1027 mutex_exit(&ire->ire_lock); 1028 mutex_enter(&ipif->ipif_saved_ire_lock); 1029 for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL; 1030 mpp = &(*mpp)->b_cont) { 1031 /* 1032 * On a given ipif, the triple of address, gateway and 1033 * mask is unique for each saved IRE (in the case of 1034 * ordinary interface routes, the gateway address is 1035 * all-zeroes). 1036 */ 1037 mp = *mpp; 1038 ifrt = (ifrt_t *)mp->b_rptr; 1039 if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr, 1040 &ire->ire_addr_v6) && 1041 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr, 1042 &gw_addr_v6) && 1043 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask, 1044 &ire->ire_mask_v6)) { 1045 *mpp = mp->b_cont; 1046 ipif->ipif_saved_ire_cnt--; 1047 freeb(mp); 1048 break; 1049 } 1050 } 1051 mutex_exit(&ipif->ipif_saved_ire_lock); 1052 } 1053 ire_delete(ire); 1054 ire_refrele(ire); 1055 return (err); 1056 } 1057 1058 /* 1059 * Derive a token from the link layer address. 1060 */ 1061 boolean_t 1062 ill_setdefaulttoken(ill_t *ill) 1063 { 1064 int i; 1065 in6_addr_t v6addr, v6mask; 1066 1067 if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length, 1068 ill->ill_phys_addr, &v6addr)) 1069 return (B_FALSE); 1070 1071 (void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask); 1072 1073 for (i = 0; i < 4; i++) 1074 v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^ 1075 (uint32_t)0xffffffff; 1076 1077 V6_MASK_COPY(v6addr, v6mask, ill->ill_token); 1078 ill->ill_token_length = IPV6_TOKEN_LEN; 1079 return (B_TRUE); 1080 } 1081 1082 /* 1083 * Create a link-local address from a token. 1084 */ 1085 static void 1086 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 1087 { 1088 int i; 1089 1090 for (i = 0; i < 4; i++) { 1091 dest->s6_addr32[i] = 1092 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 1093 } 1094 } 1095 1096 /* 1097 * Set a nice default address for either automatic tunnels tsrc/96 or 1098 * 6to4 tunnels 2002:<tsrc>::1/64 1099 */ 1100 static void 1101 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta) 1102 { 1103 sin6_t sin6; 1104 sin_t *sin; 1105 ill_t *ill = ipif->ipif_ill; 1106 tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr; 1107 1108 if (ta->ifta_saddr.ss_family != AF_INET || 1109 (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 || 1110 (ta->ifta_flags & IFTUN_SRC) == 0) 1111 return; 1112 1113 /* 1114 * Check the tunnel type by examining q_next->q_ptr 1115 */ 1116 if (tp->tun_flags & TUN_AUTOMATIC) { 1117 /* this is an automatic tunnel */ 1118 (void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS, 1119 &ipif->ipif_v6net_mask); 1120 bzero(&sin6, sizeof (sin6_t)); 1121 sin = (sin_t *)&ta->ifta_saddr; 1122 V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr; 1123 sin6.sin6_family = AF_INET6; 1124 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1125 NULL, NULL, NULL, NULL); 1126 } else if (tp->tun_flags & TUN_6TO4) { 1127 /* this is a 6to4 tunnel */ 1128 (void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN, 1129 &ipif->ipif_v6net_mask); 1130 sin = (sin_t *)&ta->ifta_saddr; 1131 /* create a 6to4 address from the IPv4 tsrc */ 1132 IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr); 1133 sin6.sin6_family = AF_INET6; 1134 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1135 NULL, NULL, NULL, NULL); 1136 } else { 1137 ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type")); 1138 return; 1139 } 1140 } 1141 1142 /* 1143 * Set link local for ipif_id 0 of a configured tunnel based on the 1144 * tsrc or tdst parameter 1145 * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as 1146 * the token. 1147 * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address 1148 * as the token for the "outer" link. 1149 */ 1150 void 1151 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta) 1152 { 1153 ipif_t *ipif; 1154 sin_t *sin; 1155 in6_addr_t *s6addr; 1156 1157 ASSERT(IAM_WRITER_ILL(ill)); 1158 1159 /* The first ipif must be id zero. */ 1160 ipif = ill->ill_ipif; 1161 ASSERT(ipif->ipif_id == 0); 1162 1163 /* no link local for automatic tunnels */ 1164 if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) { 1165 ipif_set_tun_auto_addr(ipif, ta); 1166 return; 1167 } 1168 1169 if ((ta->ifta_flags & IFTUN_DST) && 1170 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 1171 sin6_t sin6; 1172 1173 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1174 bzero(&sin6, sizeof (sin6_t)); 1175 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1176 sin = (sin_t *)&ta->ifta_daddr; 1177 V4_PART_OF_V6(sin6.sin6_addr) = 1178 sin->sin_addr.s_addr; 1179 } else { 1180 s6addr = 1181 &((sin6_t *)&ta->ifta_daddr)->sin6_addr; 1182 sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3]; 1183 sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2]; 1184 } 1185 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, 1186 &sin6.sin6_addr); 1187 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1188 } 1189 if ((ta->ifta_flags & IFTUN_SRC)) { 1190 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1191 1192 /* Set the token if it isn't already set */ 1193 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) { 1194 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1195 sin = (sin_t *)&ta->ifta_saddr; 1196 V4_PART_OF_V6(ill->ill_token) = 1197 sin->sin_addr.s_addr; 1198 } else { 1199 s6addr = 1200 &((sin6_t *)&ta->ifta_saddr)->sin6_addr; 1201 ill->ill_token.s6_addr32[3] = 1202 s6addr->s6_addr32[3]; 1203 ill->ill_token.s6_addr32[2] = 1204 s6addr->s6_addr32[2]; 1205 } 1206 ill->ill_token_length = IPV6_TOKEN_LEN; 1207 } 1208 /* 1209 * Attempt to set the link local address if it isn't set. 1210 */ 1211 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) 1212 (void) ipif_setlinklocal(ipif); 1213 } 1214 } 1215 1216 /* 1217 * Is it not possible to set the link local address? 1218 * The address can be set if the token is set, and the token 1219 * isn't too long. 1220 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1221 */ 1222 boolean_t 1223 ipif_cant_setlinklocal(ipif_t *ipif) 1224 { 1225 ill_t *ill = ipif->ipif_ill; 1226 1227 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1228 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1229 return (B_TRUE); 1230 1231 return (B_FALSE); 1232 } 1233 1234 /* 1235 * Generate a link-local address from the token. 1236 * Return zero if the address was set, or non-zero if it couldn't be set. 1237 */ 1238 int 1239 ipif_setlinklocal(ipif_t *ipif) 1240 { 1241 ill_t *ill = ipif->ipif_ill; 1242 in6_addr_t ov6addr; 1243 1244 ASSERT(IAM_WRITER_ILL(ill)); 1245 1246 if (ipif_cant_setlinklocal(ipif)) 1247 return (-1); 1248 1249 ov6addr = ipif->ipif_v6lcl_addr; 1250 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1251 sctp_update_ipif_addr(ipif, ov6addr); 1252 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1253 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1254 ipif->ipif_v6subnet); 1255 1256 if (ipif->ipif_flags & IPIF_NOLOCAL) { 1257 ipif->ipif_v6src_addr = ipv6_all_zeros; 1258 } else { 1259 ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr; 1260 } 1261 return (0); 1262 } 1263 1264 /* 1265 * This function sets up the multicast mappings in NDP. 1266 * Unlike ARP, there are no mapping_mps here. We delete the 1267 * mapping nces and add a new one. 1268 * 1269 * Returns non-zero on error and 0 on success. 1270 */ 1271 int 1272 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce) 1273 { 1274 ill_t *ill = ipif->ipif_ill; 1275 in6_addr_t v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0}; 1276 in6_addr_t v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0}; 1277 in6_addr_t v6_extract_mask; 1278 uchar_t *phys_addr, *bphys_addr, *alloc_phys; 1279 nce_t *mnce = NULL; 1280 int err = 0; 1281 phyint_t *phyi = ill->ill_phyint; 1282 uint32_t hw_extract_start; 1283 dl_unitdata_req_t *dlur; 1284 ip_stack_t *ipst = ill->ill_ipst; 1285 1286 if (ret_nce != NULL) 1287 *ret_nce = NULL; 1288 /* 1289 * Delete the mapping nce. Normally these should not exist 1290 * as a previous ipif_down -> ipif_ndp_down should have deleted 1291 * all the nces. But they can exist if ip_rput_dlpi_writer 1292 * calls this when PHYI_MULTI_BCAST is set. 1293 */ 1294 mnce = ndp_lookup_v6(ill, &v6_mcast_addr, B_FALSE); 1295 if (mnce != NULL) { 1296 ndp_delete(mnce); 1297 NCE_REFRELE(mnce); 1298 mnce = NULL; 1299 } 1300 1301 /* 1302 * Get media specific v6 mapping information. Note that 1303 * nd_lla_len can be 0 for tunnels. 1304 */ 1305 alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP); 1306 if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0)) 1307 return (ENOMEM); 1308 /* 1309 * Determine the broadcast address. 1310 */ 1311 dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr; 1312 if (ill->ill_sap_length < 0) 1313 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset; 1314 else 1315 bphys_addr = (uchar_t *)dlur + 1316 dlur->dl_dest_addr_offset + ill->ill_sap_length; 1317 1318 /* 1319 * Check PHYI_MULTI_BCAST and possible length of physical 1320 * address to determine if we use the mapping or the 1321 * broadcast address. 1322 */ 1323 if ((phyi->phyint_flags & PHYI_MULTI_BCAST) || 1324 (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len, 1325 bphys_addr, alloc_phys, &hw_extract_start, 1326 &v6_extract_mask))) { 1327 if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) { 1328 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1329 return (E2BIG); 1330 } 1331 /* Use the link-layer broadcast address for MULTI_BCAST */ 1332 phys_addr = bphys_addr; 1333 bzero(&v6_extract_mask, sizeof (v6_extract_mask)); 1334 hw_extract_start = ill->ill_nd_lla_len; 1335 } else { 1336 phys_addr = alloc_phys; 1337 } 1338 if ((ipif->ipif_flags & IPIF_BROADCAST) || 1339 (ill->ill_flags & ILLF_MULTICAST) || 1340 (phyi->phyint_flags & PHYI_MULTI_BCAST)) { 1341 mutex_enter(&ipst->ips_ndp6->ndp_g_lock); 1342 err = ndp_add(ill, 1343 phys_addr, 1344 &v6_mcast_addr, /* v6 address */ 1345 &v6_mcast_mask, /* v6 mask */ 1346 &v6_extract_mask, 1347 hw_extract_start, 1348 NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD, 1349 ND_REACHABLE, 1350 &mnce, 1351 NULL, 1352 NULL); 1353 mutex_exit(&ipst->ips_ndp6->ndp_g_lock); 1354 if (err == 0) { 1355 if (ret_nce != NULL) { 1356 *ret_nce = mnce; 1357 } else { 1358 NCE_REFRELE(mnce); 1359 } 1360 } 1361 } 1362 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1363 return (err); 1364 } 1365 1366 /* 1367 * Get the resolver set up for a new interface address. (Always called 1368 * as writer.) 1369 */ 1370 int 1371 ipif_ndp_up(ipif_t *ipif, const in6_addr_t *addr) 1372 { 1373 ill_t *ill = ipif->ipif_ill; 1374 int err = 0; 1375 nce_t *nce = NULL; 1376 nce_t *mnce = NULL; 1377 1378 ip1dbg(("ipif_ndp_up(%s:%u)\n", 1379 ipif->ipif_ill->ill_name, ipif->ipif_id)); 1380 1381 /* 1382 * ND not supported on XRESOLV interfaces. If ND support (multicast) 1383 * added later, take out this check. 1384 */ 1385 if ((ill->ill_flags & ILLF_XRESOLV) || 1386 IN6_IS_ADDR_UNSPECIFIED(addr) || 1387 (!(ill->ill_net_type & IRE_INTERFACE))) { 1388 ipif->ipif_addr_ready = 1; 1389 return (0); 1390 } 1391 1392 /* 1393 * Need to setup multicast mapping only when the first 1394 * interface is coming UP. 1395 */ 1396 if (ill->ill_ipif_up_count == 0 && 1397 (ill->ill_flags & ILLF_MULTICAST)) { 1398 /* 1399 * We set the multicast before setting up the mapping for 1400 * local address because ipif_ndp_setup_multicast does 1401 * ndp_walk to delete nces which will delete the mapping 1402 * for local address also if we added the mapping for 1403 * local address first. 1404 */ 1405 err = ipif_ndp_setup_multicast(ipif, &mnce); 1406 if (err != 0) 1407 return (err); 1408 } 1409 1410 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1411 uint16_t flags; 1412 uchar_t *hw_addr = NULL; 1413 1414 /* Permanent entries don't need NUD */ 1415 flags = NCE_F_PERMANENT | NCE_F_NONUD; 1416 if (ill->ill_flags & ILLF_ROUTER) 1417 flags |= NCE_F_ISROUTER; 1418 1419 if (ipif->ipif_flags & IPIF_ANYCAST) 1420 flags |= NCE_F_ANYCAST; 1421 1422 if (ill->ill_net_type == IRE_IF_RESOLVER) { 1423 hw_addr = ill->ill_nd_lla; 1424 1425 if (ill->ill_move_in_progress) { 1426 /* 1427 * Addresses are failing over to this ill. 1428 * Don't wait for NUD to see this change. 1429 * Publish our new link-layer address. 1430 */ 1431 flags |= NCE_F_UNSOL_ADV; 1432 } 1433 } 1434 err = ndp_lookup_then_add(ill, 1435 hw_addr, 1436 addr, 1437 &ipv6_all_ones, 1438 &ipv6_all_zeros, 1439 0, 1440 flags, 1441 ND_PROBE, /* Causes Duplicate Address Detection to run */ 1442 &nce, 1443 NULL, 1444 NULL); 1445 switch (err) { 1446 case 0: 1447 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1448 ill->ill_name)); 1449 ipif->ipif_addr_ready = 1; 1450 break; 1451 case EINPROGRESS: 1452 ip1dbg(("ipif_ndp_up: running DAD now for %s\n", 1453 ill->ill_name)); 1454 break; 1455 case EEXIST: 1456 NCE_REFRELE(nce); 1457 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1458 ill->ill_name)); 1459 if (mnce != NULL) { 1460 ndp_delete(mnce); 1461 NCE_REFRELE(mnce); 1462 } 1463 return (err); 1464 default: 1465 ip1dbg(("ipif_ndp_up: NCE creation failed %s\n", 1466 ill->ill_name)); 1467 if (mnce != NULL) { 1468 ndp_delete(mnce); 1469 NCE_REFRELE(mnce); 1470 } 1471 return (err); 1472 } 1473 } else { 1474 /* No local NCE for this entry */ 1475 ipif->ipif_addr_ready = 1; 1476 } 1477 if (nce != NULL) 1478 NCE_REFRELE(nce); 1479 if (mnce != NULL) 1480 NCE_REFRELE(mnce); 1481 return (0); 1482 } 1483 1484 /* Remove all cache entries for this logical interface */ 1485 void 1486 ipif_ndp_down(ipif_t *ipif) 1487 { 1488 nce_t *nce; 1489 1490 if (ipif->ipif_isv6) { 1491 nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, 1492 B_FALSE); 1493 if (nce != NULL) { 1494 ndp_delete(nce); 1495 NCE_REFRELE(nce); 1496 } 1497 } 1498 /* 1499 * Remove mapping and all other nces dependent on this ill 1500 * when the last ipif is going away. 1501 */ 1502 if (ipif->ipif_ill->ill_ipif_up_count == 0) { 1503 ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill, 1504 (uchar_t *)ipif->ipif_ill, ipif->ipif_ill->ill_ipst); 1505 } 1506 } 1507 1508 /* 1509 * Used when an interface comes up to recreate any extra routes on this 1510 * interface. 1511 */ 1512 static ire_t ** 1513 ipif_recover_ire_v6(ipif_t *ipif) 1514 { 1515 mblk_t *mp; 1516 ire_t **ipif_saved_irep; 1517 ire_t **irep; 1518 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 1519 1520 ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name, 1521 ipif->ipif_id)); 1522 1523 ASSERT(ipif->ipif_isv6); 1524 1525 mutex_enter(&ipif->ipif_saved_ire_lock); 1526 ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) * 1527 ipif->ipif_saved_ire_cnt, KM_NOSLEEP); 1528 if (ipif_saved_irep == NULL) { 1529 mutex_exit(&ipif->ipif_saved_ire_lock); 1530 return (NULL); 1531 } 1532 1533 irep = ipif_saved_irep; 1534 1535 for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) { 1536 ire_t *ire; 1537 queue_t *rfq; 1538 queue_t *stq; 1539 ifrt_t *ifrt; 1540 in6_addr_t *src_addr; 1541 in6_addr_t *gateway_addr; 1542 mblk_t *resolver_mp; 1543 char buf[INET6_ADDRSTRLEN]; 1544 ushort_t type; 1545 1546 /* 1547 * When the ire was initially created and then added in 1548 * ip_rt_add_v6(), it was created either using 1549 * ipif->ipif_net_type in the case of a traditional interface 1550 * route, or as one of the IRE_OFFSUBNET types (with the 1551 * exception of IRE_HOST type redirect ire which is created by 1552 * icmp_redirect_v6() and which we don't need to save or 1553 * recover). In the case where ipif->ipif_net_type was 1554 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to 1555 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy 1556 * software like GateD and Sun Cluster which creates routes 1557 * using the the loopback interface's address as a gateway. 1558 * 1559 * As ifrt->ifrt_type reflects the already updated ire_type and 1560 * since ire_create_v6() expects that IRE_IF_NORESOLVER will 1561 * have a valid ire_dlureq_mp field (which doesn't make sense 1562 * for a IRE_LOOPBACK), ire_create_v6() will be called in the 1563 * same way here as in ip_rt_add_v6(), namely using 1564 * ipif->ipif_net_type when the route looks like a traditional 1565 * interface route (where ifrt->ifrt_type & IRE_INTERFACE is 1566 * true) and otherwise using the saved ifrt->ifrt_type. This 1567 * means that in the case where ipif->ipif_net_type is 1568 * IRE_LOOPBACK, the ire created by ire_create_v6() will be an 1569 * IRE_LOOPBACK, it will then be turned into an 1570 * IRE_IF_NORESOLVER and then added by ire_add_v6(). 1571 */ 1572 ifrt = (ifrt_t *)mp->b_rptr; 1573 if (ifrt->ifrt_type & IRE_INTERFACE) { 1574 rfq = NULL; 1575 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 1576 ? ipif->ipif_rq : ipif->ipif_wq; 1577 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1578 ? &ifrt->ifrt_v6src_addr 1579 : &ipif->ipif_v6src_addr; 1580 gateway_addr = NULL; 1581 resolver_mp = ipif->ipif_resolver_mp; 1582 type = ipif->ipif_net_type; 1583 } else { 1584 rfq = NULL; 1585 stq = NULL; 1586 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1587 ? &ifrt->ifrt_v6src_addr : NULL; 1588 gateway_addr = &ifrt->ifrt_v6gateway_addr; 1589 resolver_mp = NULL; 1590 type = ifrt->ifrt_type; 1591 } 1592 1593 /* 1594 * Create a copy of the IRE with the saved address and netmask. 1595 */ 1596 ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n", 1597 ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type, 1598 inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)), 1599 ip_mask_to_plen_v6(&ifrt->ifrt_v6mask))); 1600 ire = ire_create_v6( 1601 &ifrt->ifrt_v6addr, 1602 &ifrt->ifrt_v6mask, 1603 src_addr, 1604 gateway_addr, 1605 &ifrt->ifrt_max_frag, 1606 NULL, 1607 rfq, 1608 stq, 1609 type, 1610 resolver_mp, 1611 ipif, 1612 NULL, 1613 0, 1614 0, 1615 ifrt->ifrt_flags, 1616 &ifrt->ifrt_iulp_info, 1617 NULL, 1618 NULL, 1619 ipst); 1620 if (ire == NULL) { 1621 mutex_exit(&ipif->ipif_saved_ire_lock); 1622 kmem_free(ipif_saved_irep, 1623 ipif->ipif_saved_ire_cnt * sizeof (ire_t *)); 1624 return (NULL); 1625 } 1626 1627 /* 1628 * Some software (for example, GateD and Sun Cluster) attempts 1629 * to create (what amount to) IRE_PREFIX routes with the 1630 * loopback address as the gateway. This is primarily done to 1631 * set up prefixes with the RTF_REJECT flag set (for example, 1632 * when generating aggregate routes.) 1633 * 1634 * If the IRE type (as defined by ipif->ipif_net_type) is 1635 * IRE_LOOPBACK, then we map the request into a 1636 * IRE_IF_NORESOLVER. 1637 */ 1638 if (ipif->ipif_net_type == IRE_LOOPBACK) 1639 ire->ire_type = IRE_IF_NORESOLVER; 1640 /* 1641 * ire held by ire_add, will be refreled' in ipif_up_done 1642 * towards the end 1643 */ 1644 (void) ire_add(&ire, NULL, NULL, NULL, B_FALSE); 1645 *irep = ire; 1646 irep++; 1647 ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire)); 1648 } 1649 mutex_exit(&ipif->ipif_saved_ire_lock); 1650 return (ipif_saved_irep); 1651 } 1652 1653 /* 1654 * Return the scope of the given IPv6 address. If the address is an 1655 * IPv4 mapped IPv6 address, return the scope of the corresponding 1656 * IPv4 address. 1657 */ 1658 in6addr_scope_t 1659 ip_addr_scope_v6(const in6_addr_t *addr) 1660 { 1661 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1662 1663 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1664 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1665 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1666 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1667 return (IP6_SCOPE_LINKLOCAL); 1668 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1669 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1670 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1671 return (IP6_SCOPE_SITELOCAL); 1672 return (IP6_SCOPE_GLOBAL); 1673 } 1674 1675 if (IN6_IS_ADDR_MULTICAST(addr)) 1676 return (IN6_ADDR_MC_SCOPE(addr)); 1677 1678 /* link-local and loopback addresses are of link-local scope */ 1679 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1680 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1681 return (IP6_SCOPE_LINKLOCAL); 1682 if (IN6_IS_ADDR_SITELOCAL(addr)) 1683 return (IP6_SCOPE_SITELOCAL); 1684 return (IP6_SCOPE_GLOBAL); 1685 } 1686 1687 1688 /* 1689 * Returns the length of the common prefix of a1 and a2, as per 1690 * CommonPrefixLen() defined in RFC 3484. 1691 */ 1692 static int 1693 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2) 1694 { 1695 int i; 1696 uint32_t a1val, a2val, mask; 1697 1698 for (i = 0; i < 4; i++) { 1699 if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) { 1700 a1val ^= a2val; 1701 i *= 32; 1702 mask = 0x80000000u; 1703 while (!(a1val & mask)) { 1704 mask >>= 1; 1705 i++; 1706 } 1707 return (i); 1708 } 1709 } 1710 return (IPV6_ABITS); 1711 } 1712 1713 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1714 (((ipif)->ipif_flags & IPIF_UP) && \ 1715 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \ 1716 (ipif)->ipif_addr_ready) 1717 1718 /* source address candidate */ 1719 typedef struct candidate { 1720 ipif_t *cand_ipif; 1721 /* The properties of this candidate */ 1722 boolean_t cand_isdst; 1723 boolean_t cand_isdst_set; 1724 in6addr_scope_t cand_scope; 1725 boolean_t cand_scope_set; 1726 boolean_t cand_isdeprecated; 1727 boolean_t cand_isdeprecated_set; 1728 boolean_t cand_ispreferred; 1729 boolean_t cand_ispreferred_set; 1730 boolean_t cand_matchedinterface; 1731 boolean_t cand_matchedinterface_set; 1732 boolean_t cand_matchedlabel; 1733 boolean_t cand_matchedlabel_set; 1734 boolean_t cand_istmp; 1735 boolean_t cand_istmp_set; 1736 int cand_common_pref; 1737 boolean_t cand_common_pref_set; 1738 boolean_t cand_pref_eq; 1739 boolean_t cand_pref_eq_set; 1740 int cand_pref_len; 1741 boolean_t cand_pref_len_set; 1742 } cand_t; 1743 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1744 #define cand_mask cand_ipif->ipif_v6net_mask 1745 #define cand_flags cand_ipif->ipif_flags 1746 #define cand_ill cand_ipif->ipif_ill 1747 #define cand_zoneid cand_ipif->ipif_zoneid 1748 1749 /* information about the destination for source address selection */ 1750 typedef struct dstinfo { 1751 const in6_addr_t *dst_addr; 1752 ill_t *dst_ill; 1753 uint_t dst_restrict_ill; 1754 boolean_t dst_prefer_src_tmp; 1755 in6addr_scope_t dst_scope; 1756 char *dst_label; 1757 } dstinfo_t; 1758 1759 /* 1760 * The following functions are rules used to select a source address in 1761 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1762 * against the best candidate (bc). Each rule has three possible outcomes; 1763 * the candidate is preferred over the best candidate (CAND_PREFER), the 1764 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1765 * candidate is of equal value as the best candidate (CAND_TIE). 1766 * 1767 * These rules are part of a greater "Default Address Selection for IPv6" 1768 * sheme, which is standards based work coming out of the IETF ipv6 working 1769 * group. The IETF document defines both IPv6 source address selection and 1770 * destination address ordering. The rules defined here implement the IPv6 1771 * source address selection. Destination address ordering is done by 1772 * libnsl, and uses a similar set of rules to implement the sorting. 1773 * 1774 * Most of the rules are defined by the RFC and are not typically altered. The 1775 * last rule, number 8, has language that allows for local preferences. In the 1776 * scheme below, this means that new Solaris rules should normally go between 1777 * rule_ifprefix and rule_prefix. 1778 */ 1779 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1780 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *, 1781 ip_stack_t *); 1782 1783 /* Prefer an address if it is equal to the destination address. */ 1784 /* ARGSUSED3 */ 1785 static rule_res_t 1786 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1787 { 1788 if (!bc->cand_isdst_set) { 1789 bc->cand_isdst = 1790 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1791 bc->cand_isdst_set = B_TRUE; 1792 } 1793 1794 cc->cand_isdst = 1795 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1796 cc->cand_isdst_set = B_TRUE; 1797 1798 if (cc->cand_isdst == bc->cand_isdst) 1799 return (CAND_TIE); 1800 else if (cc->cand_isdst) 1801 return (CAND_PREFER); 1802 else 1803 return (CAND_AVOID); 1804 } 1805 1806 /* 1807 * Prefer addresses that are of closest scope to the destination. Always 1808 * prefer addresses that are of greater scope than the destination over 1809 * those that are of lesser scope than the destination. 1810 */ 1811 /* ARGSUSED3 */ 1812 static rule_res_t 1813 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1814 { 1815 if (!bc->cand_scope_set) { 1816 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1817 bc->cand_scope_set = B_TRUE; 1818 } 1819 1820 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1821 cc->cand_scope_set = B_TRUE; 1822 1823 if (cc->cand_scope < bc->cand_scope) { 1824 if (cc->cand_scope < dstinfo->dst_scope) 1825 return (CAND_AVOID); 1826 else 1827 return (CAND_PREFER); 1828 } else if (bc->cand_scope < cc->cand_scope) { 1829 if (bc->cand_scope < dstinfo->dst_scope) 1830 return (CAND_PREFER); 1831 else 1832 return (CAND_AVOID); 1833 } else { 1834 return (CAND_TIE); 1835 } 1836 } 1837 1838 /* 1839 * Prefer non-deprecated source addresses. 1840 */ 1841 /* ARGSUSED2 */ 1842 static rule_res_t 1843 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1844 ip_stack_t *ipst) 1845 { 1846 if (!bc->cand_isdeprecated_set) { 1847 bc->cand_isdeprecated = 1848 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 1849 bc->cand_isdeprecated_set = B_TRUE; 1850 } 1851 1852 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 1853 cc->cand_isdeprecated_set = B_TRUE; 1854 1855 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 1856 return (CAND_TIE); 1857 else if (cc->cand_isdeprecated) 1858 return (CAND_AVOID); 1859 else 1860 return (CAND_PREFER); 1861 } 1862 1863 /* 1864 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 1865 * rule must be before rule_interface because the flag could be set on any 1866 * interface, not just the interface being used for outgoing packets (for 1867 * example, the IFF_PREFERRED could be set on an address assigned to the 1868 * loopback interface). 1869 */ 1870 /* ARGSUSED2 */ 1871 static rule_res_t 1872 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1873 ip_stack_t *ipst) 1874 { 1875 if (!bc->cand_ispreferred_set) { 1876 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 1877 bc->cand_ispreferred_set = B_TRUE; 1878 } 1879 1880 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 1881 cc->cand_ispreferred_set = B_TRUE; 1882 1883 if (bc->cand_ispreferred == cc->cand_ispreferred) 1884 return (CAND_TIE); 1885 else if (cc->cand_ispreferred) 1886 return (CAND_PREFER); 1887 else 1888 return (CAND_AVOID); 1889 } 1890 1891 /* 1892 * Prefer source addresses that are assigned to the outgoing interface, or 1893 * to an interface that is in the same IPMP group as the outgoing 1894 * interface. 1895 */ 1896 /* ARGSUSED3 */ 1897 static rule_res_t 1898 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1899 ip_stack_t *ipst) 1900 { 1901 ill_t *dstill = dstinfo->dst_ill; 1902 1903 /* 1904 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 1905 * since we know all candidates will be on the same link. 1906 */ 1907 if (dstinfo->dst_restrict_ill) 1908 return (CAND_TIE); 1909 1910 if (!bc->cand_matchedinterface_set) { 1911 bc->cand_matchedinterface = (bc->cand_ill == dstill || 1912 (dstill->ill_group != NULL && 1913 dstill->ill_group == bc->cand_ill->ill_group)); 1914 bc->cand_matchedinterface_set = B_TRUE; 1915 } 1916 1917 cc->cand_matchedinterface = (cc->cand_ill == dstill || 1918 (dstill->ill_group != NULL && 1919 dstill->ill_group == cc->cand_ill->ill_group)); 1920 cc->cand_matchedinterface_set = B_TRUE; 1921 1922 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 1923 return (CAND_TIE); 1924 else if (cc->cand_matchedinterface) 1925 return (CAND_PREFER); 1926 else 1927 return (CAND_AVOID); 1928 } 1929 1930 /* 1931 * Prefer source addresses whose label matches the destination's label. 1932 */ 1933 static rule_res_t 1934 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1935 { 1936 char *label; 1937 1938 if (!bc->cand_matchedlabel_set) { 1939 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst); 1940 bc->cand_matchedlabel = 1941 ip6_asp_labelcmp(label, dstinfo->dst_label); 1942 bc->cand_matchedlabel_set = B_TRUE; 1943 } 1944 1945 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst); 1946 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 1947 cc->cand_matchedlabel_set = B_TRUE; 1948 1949 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 1950 return (CAND_TIE); 1951 else if (cc->cand_matchedlabel) 1952 return (CAND_PREFER); 1953 else 1954 return (CAND_AVOID); 1955 } 1956 1957 /* 1958 * Prefer public addresses over temporary ones. An application can reverse 1959 * the logic of this rule and prefer temporary addresses by using the 1960 * IPV6_SRC_PREFERENCES socket option. 1961 */ 1962 /* ARGSUSED3 */ 1963 static rule_res_t 1964 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1965 ip_stack_t *ipst) 1966 { 1967 if (!bc->cand_istmp_set) { 1968 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 1969 bc->cand_istmp_set = B_TRUE; 1970 } 1971 1972 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 1973 cc->cand_istmp_set = B_TRUE; 1974 1975 if (bc->cand_istmp == cc->cand_istmp) 1976 return (CAND_TIE); 1977 1978 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 1979 return (CAND_PREFER); 1980 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 1981 return (CAND_PREFER); 1982 else 1983 return (CAND_AVOID); 1984 } 1985 1986 /* 1987 * Prefer source addresses with longer matching prefix with the destination 1988 * under the interface mask. This gets us on the same subnet before applying 1989 * any Solaris-specific rules. 1990 */ 1991 /* ARGSUSED3 */ 1992 static rule_res_t 1993 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1994 ip_stack_t *ipst) 1995 { 1996 if (!bc->cand_pref_eq_set) { 1997 bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr, 1998 bc->cand_mask, *dstinfo->dst_addr); 1999 bc->cand_pref_eq_set = B_TRUE; 2000 } 2001 2002 cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask, 2003 *dstinfo->dst_addr); 2004 cc->cand_pref_eq_set = B_TRUE; 2005 2006 if (bc->cand_pref_eq) { 2007 if (cc->cand_pref_eq) { 2008 if (!bc->cand_pref_len_set) { 2009 bc->cand_pref_len = 2010 ip_mask_to_plen_v6(&bc->cand_mask); 2011 bc->cand_pref_len_set = B_TRUE; 2012 } 2013 cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask); 2014 cc->cand_pref_len_set = B_TRUE; 2015 if (bc->cand_pref_len == cc->cand_pref_len) 2016 return (CAND_TIE); 2017 else if (bc->cand_pref_len > cc->cand_pref_len) 2018 return (CAND_AVOID); 2019 else 2020 return (CAND_PREFER); 2021 } else { 2022 return (CAND_AVOID); 2023 } 2024 } else { 2025 if (cc->cand_pref_eq) 2026 return (CAND_PREFER); 2027 else 2028 return (CAND_TIE); 2029 } 2030 } 2031 2032 /* 2033 * Prefer to use zone-specific addresses when possible instead of all-zones 2034 * addresses. 2035 */ 2036 /* ARGSUSED2 */ 2037 static rule_res_t 2038 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2039 ip_stack_t *ipst) 2040 { 2041 if ((bc->cand_zoneid == ALL_ZONES) == 2042 (cc->cand_zoneid == ALL_ZONES)) 2043 return (CAND_TIE); 2044 else if (cc->cand_zoneid == ALL_ZONES) 2045 return (CAND_AVOID); 2046 else 2047 return (CAND_PREFER); 2048 } 2049 2050 /* 2051 * Prefer to use DHCPv6 (first) and static addresses (second) when possible 2052 * instead of statelessly autoconfigured addresses. 2053 * 2054 * This is done after trying all other preferences (and before the final tie 2055 * breaker) so that, if all else is equal, we select addresses configured by 2056 * DHCPv6 over other addresses. We presume that DHCPv6 addresses, unlike 2057 * stateless autoconfigured addresses, are deliberately configured by an 2058 * administrator, and thus are correctly set up in DNS and network packet 2059 * filters. 2060 */ 2061 /* ARGSUSED2 */ 2062 static rule_res_t 2063 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2064 ip_stack_t *ipst) 2065 { 2066 #define ATYPE(x) \ 2067 ((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2 2068 int bcval = ATYPE(bc->cand_flags); 2069 int ccval = ATYPE(cc->cand_flags); 2070 #undef ATYPE 2071 2072 if (bcval == ccval) 2073 return (CAND_TIE); 2074 else if (ccval < bcval) 2075 return (CAND_PREFER); 2076 else 2077 return (CAND_AVOID); 2078 } 2079 2080 /* 2081 * Prefer source addresses with longer matching prefix with the destination. 2082 * We do the longest matching prefix calculation by doing an xor of both 2083 * addresses with the destination, and pick the address with the longest string 2084 * of leading zeros, as per CommonPrefixLen() defined in RFC 3484. 2085 */ 2086 /* ARGSUSED3 */ 2087 static rule_res_t 2088 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 2089 { 2090 if (!bc->cand_common_pref_set) { 2091 bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr, 2092 dstinfo->dst_addr); 2093 bc->cand_common_pref_set = B_TRUE; 2094 } 2095 2096 cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr, 2097 dstinfo->dst_addr); 2098 cc->cand_common_pref_set = B_TRUE; 2099 2100 if (bc->cand_common_pref == cc->cand_common_pref) 2101 return (CAND_TIE); 2102 else if (bc->cand_common_pref > cc->cand_common_pref) 2103 return (CAND_AVOID); 2104 else 2105 return (CAND_PREFER); 2106 } 2107 2108 /* 2109 * Last rule: we must pick something, so just prefer the current best 2110 * candidate. 2111 */ 2112 /* ARGSUSED */ 2113 static rule_res_t 2114 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2115 ip_stack_t *ipst) 2116 { 2117 return (CAND_AVOID); 2118 } 2119 2120 /* 2121 * Determine the best source address given a destination address and a 2122 * destination ill. If no suitable source address is found, it returns 2123 * NULL. If there is a usable address pointed to by the usesrc 2124 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 2125 * fine grained (i.e per interface) 2126 * 2127 * This implementation is based on the "Default Address Selection for IPv6" 2128 * specification produced by the IETF IPv6 working group. It has been 2129 * implemented so that the list of addresses is only traversed once (the 2130 * specification's algorithm could traverse the list of addresses once for 2131 * every rule). 2132 * 2133 * The restrict_ill argument restricts the algorithm to chose a source 2134 * address that is assigned to the destination ill or an ill in the same 2135 * IPMP group as the destination ill. This is used when the destination 2136 * address is a link-local or multicast address, and when 2137 * ipv6_strict_dst_multihoming is turned on. 2138 * 2139 * src_prefs is the caller's set of source address preferences. If source 2140 * address selection is being called to determine the source address of a 2141 * connected socket (from ip_bind_connected_v6()), then the preferences are 2142 * taken from conn_src_preferences. These preferences can be set on a 2143 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 2144 * preference currently implemented is for rfc3041 temporary addresses. 2145 */ 2146 ipif_t * 2147 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 2148 uint_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid) 2149 { 2150 dstinfo_t dstinfo; 2151 char dstr[INET6_ADDRSTRLEN]; 2152 char sstr[INET6_ADDRSTRLEN]; 2153 ipif_t *ipif; 2154 ill_t *ill, *usesrc_ill = NULL; 2155 ill_walk_context_t ctx; 2156 cand_t best_c; /* The best candidate */ 2157 cand_t curr_c; /* The current candidate */ 2158 uint_t index; 2159 boolean_t first_candidate = B_TRUE; 2160 rule_res_t rule_result; 2161 tsol_tpc_t *src_rhtp, *dst_rhtp; 2162 ip_stack_t *ipst = dstill->ill_ipst; 2163 2164 /* 2165 * The list of ordering rules. They are applied in the order they 2166 * appear in the list. 2167 * 2168 * Solaris doesn't currently support Mobile IPv6, so there's no 2169 * rule_mipv6 corresponding to rule 4 in the specification. 2170 */ 2171 rulef_t rules[] = { 2172 rule_isdst, 2173 rule_scope, 2174 rule_deprecated, 2175 rule_preferred, 2176 rule_interface, 2177 rule_label, 2178 rule_temporary, 2179 rule_ifprefix, /* local rules after this */ 2180 rule_zone_specific, 2181 rule_addr_type, 2182 rule_prefix, /* local rules before this */ 2183 rule_must_be_last, /* must always be last */ 2184 NULL 2185 }; 2186 2187 ASSERT(dstill->ill_isv6); 2188 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 2189 2190 /* 2191 * Check if there is a usable src address pointed to by the 2192 * usesrc ifindex. This has higher precedence since it is 2193 * finer grained (i.e per interface) v/s being system wide. 2194 */ 2195 if (dstill->ill_usesrc_ifindex != 0) { 2196 if ((usesrc_ill = 2197 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 2198 NULL, NULL, NULL, NULL, ipst)) != NULL) { 2199 dstinfo.dst_ill = usesrc_ill; 2200 } else { 2201 return (NULL); 2202 } 2203 } else { 2204 dstinfo.dst_ill = dstill; 2205 } 2206 2207 /* 2208 * If we're dealing with an unlabeled destination on a labeled system, 2209 * make sure that we ignore source addresses that are incompatible with 2210 * the destination's default label. That destination's default label 2211 * must dominate the minimum label on the source address. 2212 * 2213 * (Note that this has to do with Trusted Solaris. It's not related to 2214 * the labels described by ip6_asp_lookup.) 2215 */ 2216 dst_rhtp = NULL; 2217 if (is_system_labeled()) { 2218 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE); 2219 if (dst_rhtp == NULL) 2220 return (NULL); 2221 if (dst_rhtp->tpc_tp.host_type != UNLABELED) { 2222 TPC_RELE(dst_rhtp); 2223 dst_rhtp = NULL; 2224 } 2225 } 2226 2227 dstinfo.dst_addr = dst; 2228 dstinfo.dst_scope = ip_addr_scope_v6(dst); 2229 dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst); 2230 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 2231 2232 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2233 /* 2234 * Section three of the I-D states that for multicast and 2235 * link-local destinations, the candidate set must be restricted to 2236 * an interface that is on the same link as the outgoing interface. 2237 * Also, when ipv6_strict_dst_multihoming is turned on, always 2238 * restrict the source address to the destination link as doing 2239 * otherwise will almost certainly cause problems. 2240 */ 2241 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 2242 ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) { 2243 if (restrict_ill == RESTRICT_TO_NONE) 2244 dstinfo.dst_restrict_ill = RESTRICT_TO_GROUP; 2245 else 2246 dstinfo.dst_restrict_ill = restrict_ill; 2247 } else { 2248 dstinfo.dst_restrict_ill = restrict_ill; 2249 } 2250 2251 bzero(&best_c, sizeof (cand_t)); 2252 2253 /* 2254 * Take a pass through the list of IPv6 interfaces to chose the 2255 * best possible source address. If restrict_ill is true, we only 2256 * iterate through the ill's that are in the same IPMP group as the 2257 * destination's outgoing ill. If restrict_ill is false, we walk 2258 * the entire list of IPv6 ill's. 2259 */ 2260 if (dstinfo.dst_restrict_ill != RESTRICT_TO_NONE) { 2261 if (dstinfo.dst_ill->ill_group != NULL && 2262 dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) { 2263 ill = dstinfo.dst_ill->ill_group->illgrp_ill; 2264 } else { 2265 ill = dstinfo.dst_ill; 2266 } 2267 } else { 2268 ill = ILL_START_WALK_V6(&ctx, ipst); 2269 } 2270 2271 while (ill != NULL) { 2272 ASSERT(ill->ill_isv6); 2273 2274 /* 2275 * Avoid FAILED/OFFLINE ills. 2276 * Global and site local addresses will failover and 2277 * will be available on the new ill. 2278 * But link local addresses don't move. 2279 */ 2280 if (dstinfo.dst_restrict_ill != RESTRICT_TO_ILL && 2281 ill->ill_phyint->phyint_flags & 2282 (PHYI_OFFLINE | PHYI_FAILED)) 2283 goto next_ill; 2284 2285 for (ipif = ill->ill_ipif; ipif != NULL; 2286 ipif = ipif->ipif_next) { 2287 2288 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 2289 continue; 2290 2291 if (zoneid != ALL_ZONES && 2292 ipif->ipif_zoneid != zoneid && 2293 ipif->ipif_zoneid != ALL_ZONES) 2294 continue; 2295 2296 /* 2297 * Check compatibility of local address for 2298 * destination's default label if we're on a labeled 2299 * system. Incompatible addresses can't be used at 2300 * all and must be skipped over. 2301 */ 2302 if (dst_rhtp != NULL) { 2303 boolean_t incompat; 2304 2305 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr, 2306 IPV6_VERSION, B_FALSE); 2307 if (src_rhtp == NULL) 2308 continue; 2309 incompat = 2310 src_rhtp->tpc_tp.host_type != SUN_CIPSO || 2311 src_rhtp->tpc_tp.tp_doi != 2312 dst_rhtp->tpc_tp.tp_doi || 2313 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label, 2314 &src_rhtp->tpc_tp.tp_sl_range_cipso) && 2315 !blinlset(&dst_rhtp->tpc_tp.tp_def_label, 2316 src_rhtp->tpc_tp.tp_sl_set_cipso)); 2317 TPC_RELE(src_rhtp); 2318 if (incompat) 2319 continue; 2320 } 2321 2322 if (first_candidate) { 2323 /* 2324 * This is first valid address in the list. 2325 * It is automatically the best candidate 2326 * so far. 2327 */ 2328 best_c.cand_ipif = ipif; 2329 first_candidate = B_FALSE; 2330 continue; 2331 } 2332 2333 bzero(&curr_c, sizeof (cand_t)); 2334 curr_c.cand_ipif = ipif; 2335 2336 /* 2337 * Compare this current candidate (curr_c) with the 2338 * best candidate (best_c) by applying the 2339 * comparison rules in order until one breaks the 2340 * tie. 2341 */ 2342 for (index = 0; rules[index] != NULL; index++) { 2343 /* Apply a comparison rule. */ 2344 rule_result = 2345 (rules[index])(&best_c, &curr_c, &dstinfo, 2346 ipst); 2347 if (rule_result == CAND_AVOID) { 2348 /* 2349 * The best candidate is still the 2350 * best candidate. Forget about 2351 * this current candidate and go on 2352 * to the next one. 2353 */ 2354 break; 2355 } else if (rule_result == CAND_PREFER) { 2356 /* 2357 * This candidate is prefered. It 2358 * becomes the best candidate so 2359 * far. Go on to the next address. 2360 */ 2361 best_c = curr_c; 2362 break; 2363 } 2364 /* We have a tie, apply the next rule. */ 2365 } 2366 2367 /* 2368 * The last rule must be a tie breaker rule and 2369 * must never produce a tie. At this point, the 2370 * candidate should have either been rejected, or 2371 * have been prefered as the best candidate so far. 2372 */ 2373 ASSERT(rule_result != CAND_TIE); 2374 } 2375 2376 /* 2377 * We may be walking the linked-list of ill's in an 2378 * IPMP group or traversing the IPv6 ill avl tree. If it is a 2379 * usesrc ILL then it can't be part of IPMP group and we 2380 * will exit the while loop. 2381 */ 2382 next_ill: 2383 if (dstinfo.dst_restrict_ill == RESTRICT_TO_ILL) 2384 ill = NULL; 2385 else if (dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) 2386 ill = ill->ill_group_next; 2387 else 2388 ill = ill_next(&ctx, ill); 2389 } 2390 2391 ipif = best_c.cand_ipif; 2392 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2393 dstinfo.dst_ill->ill_name, 2394 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2395 (ipif == NULL ? "NULL" : 2396 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2397 2398 if (usesrc_ill != NULL) 2399 ill_refrele(usesrc_ill); 2400 2401 if (dst_rhtp != NULL) 2402 TPC_RELE(dst_rhtp); 2403 2404 if (ipif == NULL) { 2405 rw_exit(&ipst->ips_ill_g_lock); 2406 return (NULL); 2407 } 2408 2409 mutex_enter(&ipif->ipif_ill->ill_lock); 2410 if (IPIF_CAN_LOOKUP(ipif)) { 2411 ipif_refhold_locked(ipif); 2412 mutex_exit(&ipif->ipif_ill->ill_lock); 2413 rw_exit(&ipst->ips_ill_g_lock); 2414 return (ipif); 2415 } 2416 mutex_exit(&ipif->ipif_ill->ill_lock); 2417 rw_exit(&ipst->ips_ill_g_lock); 2418 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2419 " returning null \n", (void *)ipif)); 2420 2421 return (NULL); 2422 } 2423 2424 /* 2425 * If old_ipif is not NULL, see if ipif was derived from old 2426 * ipif and if so, recreate the interface route by re-doing 2427 * source address selection. This happens when ipif_down -> 2428 * ipif_update_other_ipifs calls us. 2429 * 2430 * If old_ipif is NULL, just redo the source address selection 2431 * if needed. This happens when illgrp_insert or ipif_up_done_v6 2432 * calls us. 2433 */ 2434 void 2435 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif) 2436 { 2437 ire_t *ire; 2438 ire_t *ipif_ire; 2439 queue_t *stq; 2440 ill_t *ill; 2441 ipif_t *nipif = NULL; 2442 boolean_t nipif_refheld = B_FALSE; 2443 boolean_t ip6_asp_table_held = B_FALSE; 2444 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 2445 2446 ill = ipif->ipif_ill; 2447 2448 if (!(ipif->ipif_flags & 2449 (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) { 2450 /* 2451 * Can't possibly have borrowed the source 2452 * from old_ipif. 2453 */ 2454 return; 2455 } 2456 2457 /* 2458 * Is there any work to be done? No work if the address 2459 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST ( 2460 * ipif_select_source_v6() does not borrow addresses from 2461 * NOLOCAL and ANYCAST interfaces). 2462 */ 2463 if ((old_ipif != NULL) && 2464 ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) || 2465 (old_ipif->ipif_ill->ill_wq == NULL) || 2466 (old_ipif->ipif_flags & 2467 (IPIF_NOLOCAL|IPIF_ANYCAST)))) { 2468 return; 2469 } 2470 2471 /* 2472 * Perform the same checks as when creating the 2473 * IRE_INTERFACE in ipif_up_done_v6. 2474 */ 2475 if (!(ipif->ipif_flags & IPIF_UP)) 2476 return; 2477 2478 if ((ipif->ipif_flags & IPIF_NOXMIT)) 2479 return; 2480 2481 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2482 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask)) 2483 return; 2484 2485 /* 2486 * We know that ipif uses some other source for its 2487 * IRE_INTERFACE. Is it using the source of this 2488 * old_ipif? 2489 */ 2490 ipif_ire = ipif_to_ire_v6(ipif); 2491 if (ipif_ire == NULL) 2492 return; 2493 2494 if (old_ipif != NULL && 2495 !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr, 2496 &ipif_ire->ire_src_addr_v6)) { 2497 ire_refrele(ipif_ire); 2498 return; 2499 } 2500 2501 if (ip_debug > 2) { 2502 /* ip1dbg */ 2503 pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE" 2504 " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6); 2505 } 2506 2507 stq = ipif_ire->ire_stq; 2508 2509 /* 2510 * Can't use our source address. Select a different source address 2511 * for the IRE_INTERFACE. We restrict interface route source 2512 * address selection to ipif's assigned to the same link as the 2513 * interface. 2514 */ 2515 if (ip6_asp_can_lookup(ipst)) { 2516 ip6_asp_table_held = B_TRUE; 2517 nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet, 2518 RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT, 2519 ipif->ipif_zoneid); 2520 } 2521 if (nipif == NULL) { 2522 /* Last resort - all ipif's have IPIF_NOLOCAL */ 2523 nipif = ipif; 2524 } else { 2525 nipif_refheld = B_TRUE; 2526 } 2527 2528 ire = ire_create_v6( 2529 &ipif->ipif_v6subnet, /* dest pref */ 2530 &ipif->ipif_v6net_mask, /* mask */ 2531 &nipif->ipif_v6src_addr, /* src addr */ 2532 NULL, /* no gateway */ 2533 &ipif->ipif_mtu, /* max frag */ 2534 NULL, /* no Fast path header */ 2535 NULL, /* no recv from queue */ 2536 stq, /* send-to queue */ 2537 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2538 ill->ill_resolver_mp, /* xmit header */ 2539 ipif, 2540 NULL, 2541 0, 2542 0, 2543 0, 2544 &ire_uinfo_null, 2545 NULL, 2546 NULL, 2547 ipst); 2548 2549 if (ire != NULL) { 2550 ire_t *ret_ire; 2551 int error; 2552 2553 /* 2554 * We don't need ipif_ire anymore. We need to delete 2555 * before we add so that ire_add does not detect 2556 * duplicates. 2557 */ 2558 ire_delete(ipif_ire); 2559 ret_ire = ire; 2560 error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE); 2561 ASSERT(error == 0); 2562 ASSERT(ret_ire == ire); 2563 if (ret_ire != NULL) { 2564 /* Held in ire_add */ 2565 ire_refrele(ret_ire); 2566 } 2567 } 2568 /* 2569 * Either we are falling through from above or could not 2570 * allocate a replacement. 2571 */ 2572 ire_refrele(ipif_ire); 2573 if (ip6_asp_table_held) 2574 ip6_asp_table_refrele(ipst); 2575 if (nipif_refheld) 2576 ipif_refrele(nipif); 2577 } 2578 2579 /* 2580 * This old_ipif is going away. 2581 * 2582 * Determine if any other ipif's are using our address as 2583 * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or 2584 * IPIF_DEPRECATED). 2585 * Find the IRE_INTERFACE for such ipif's and recreate them 2586 * to use an different source address following the rules in 2587 * ipif_up_done_v6. 2588 * 2589 * This function takes an illgrp as an argument so that illgrp_delete 2590 * can call this to update source address even after deleting the 2591 * old_ipif->ipif_ill from the ill group. 2592 */ 2593 void 2594 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp) 2595 { 2596 ipif_t *ipif; 2597 ill_t *ill; 2598 char buf[INET6_ADDRSTRLEN]; 2599 2600 ASSERT(IAM_WRITER_IPIF(old_ipif)); 2601 2602 ill = old_ipif->ipif_ill; 2603 2604 ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n", 2605 ill->ill_name, 2606 inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr, 2607 buf, sizeof (buf)))); 2608 2609 /* 2610 * If this part of a group, look at all ills as ipif_select_source 2611 * borrows a source address across all the ills in the group. 2612 */ 2613 if (illgrp != NULL) 2614 ill = illgrp->illgrp_ill; 2615 2616 /* Don't need a lock since this is a writer */ 2617 for (; ill != NULL; ill = ill->ill_group_next) { 2618 for (ipif = ill->ill_ipif; ipif != NULL; 2619 ipif = ipif->ipif_next) { 2620 2621 if (ipif == old_ipif) 2622 continue; 2623 2624 ipif_recreate_interface_routes_v6(old_ipif, ipif); 2625 } 2626 } 2627 } 2628 2629 /* 2630 * Perform an attach and bind to get phys addr plus info_req for 2631 * the physical device. 2632 * q and mp represents an ioctl which will be queued waiting for 2633 * completion of the DLPI message exchange. 2634 * MUST be called on an ill queue. Can not set conn_pending_ill for that 2635 * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q. 2636 * 2637 * Returns EINPROGRESS when mp has been consumed by queueing it on 2638 * ill_pending_mp and the ioctl will complete in ip_rput. 2639 */ 2640 int 2641 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2642 { 2643 mblk_t *v6token_mp = NULL; 2644 mblk_t *v6lla_mp = NULL; 2645 mblk_t *phys_mp = NULL; 2646 mblk_t *info_mp = NULL; 2647 mblk_t *attach_mp = NULL; 2648 mblk_t *bind_mp = NULL; 2649 mblk_t *unbind_mp = NULL; 2650 mblk_t *notify_mp = NULL; 2651 2652 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2653 ASSERT(ill->ill_dlpi_style_set); 2654 ASSERT(WR(q)->q_next != NULL); 2655 2656 if (ill->ill_isv6) { 2657 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2658 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2659 if (v6token_mp == NULL) 2660 goto bad; 2661 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2662 DL_IPV6_TOKEN; 2663 2664 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2665 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2666 if (v6lla_mp == NULL) 2667 goto bad; 2668 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2669 DL_IPV6_LINK_LAYER_ADDR; 2670 } 2671 2672 /* 2673 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2674 */ 2675 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2676 DL_NOTIFY_REQ); 2677 if (notify_mp == NULL) 2678 goto bad; 2679 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2680 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2681 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG); 2682 2683 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2684 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2685 if (phys_mp == NULL) 2686 goto bad; 2687 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2688 DL_CURR_PHYS_ADDR; 2689 2690 info_mp = ip_dlpi_alloc( 2691 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2692 DL_INFO_REQ); 2693 if (info_mp == NULL) 2694 goto bad; 2695 2696 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2697 DL_BIND_REQ); 2698 if (bind_mp == NULL) 2699 goto bad; 2700 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2701 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2702 2703 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2704 if (unbind_mp == NULL) 2705 goto bad; 2706 2707 /* If we need to attach, pre-alloc and initialize the mblk */ 2708 if (ill->ill_needs_attach) { 2709 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2710 DL_ATTACH_REQ); 2711 if (attach_mp == NULL) 2712 goto bad; 2713 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2714 } 2715 2716 /* 2717 * Here we are going to delay the ioctl ack until after 2718 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2719 * original ioctl message before sending the requests 2720 */ 2721 mutex_enter(&ill->ill_lock); 2722 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2723 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2724 /* 2725 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2726 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2727 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2728 */ 2729 ill->ill_phys_addr_pend = 0; 2730 mutex_exit(&ill->ill_lock); 2731 2732 if (attach_mp != NULL) { 2733 ip1dbg(("ill_dl_phys: attach\n")); 2734 ill_dlpi_send(ill, attach_mp); 2735 } 2736 ill_dlpi_send(ill, bind_mp); 2737 ill_dlpi_send(ill, info_mp); 2738 if (ill->ill_isv6) { 2739 ill_dlpi_send(ill, v6token_mp); 2740 ill_dlpi_send(ill, v6lla_mp); 2741 } 2742 ill_dlpi_send(ill, phys_mp); 2743 ill_dlpi_send(ill, notify_mp); 2744 ill_dlpi_send(ill, unbind_mp); 2745 2746 /* 2747 * This operation will complete in ip_rput_dlpi_writer with either 2748 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2749 */ 2750 return (EINPROGRESS); 2751 bad: 2752 freemsg(v6token_mp); 2753 freemsg(v6lla_mp); 2754 freemsg(phys_mp); 2755 freemsg(info_mp); 2756 freemsg(attach_mp); 2757 freemsg(bind_mp); 2758 freemsg(unbind_mp); 2759 freemsg(notify_mp); 2760 return (ENOMEM); 2761 } 2762 2763 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2764 2765 /* 2766 * DLPI is up. 2767 * Create all the IREs associated with an interface bring up multicast. 2768 * Set the interface flag and finish other initialization 2769 * that potentially had to be differed to after DL_BIND_ACK. 2770 */ 2771 int 2772 ipif_up_done_v6(ipif_t *ipif) 2773 { 2774 ire_t *ire_array[20]; 2775 ire_t **irep = ire_array; 2776 ire_t **irep1; 2777 ill_t *ill = ipif->ipif_ill; 2778 queue_t *stq; 2779 in6_addr_t v6addr; 2780 in6_addr_t route_mask; 2781 ipif_t *src_ipif = NULL; 2782 ipif_t *tmp_ipif; 2783 boolean_t flush_ire_cache = B_TRUE; 2784 int err; 2785 char buf[INET6_ADDRSTRLEN]; 2786 phyint_t *phyi; 2787 ire_t **ipif_saved_irep = NULL; 2788 int ipif_saved_ire_cnt; 2789 int cnt; 2790 boolean_t src_ipif_held = B_FALSE; 2791 boolean_t ire_added = B_FALSE; 2792 boolean_t loopback = B_FALSE; 2793 boolean_t ip6_asp_table_held = B_FALSE; 2794 ip_stack_t *ipst = ill->ill_ipst; 2795 2796 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2797 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2798 2799 /* Check if this is a loopback interface */ 2800 if (ipif->ipif_ill->ill_wq == NULL) 2801 loopback = B_TRUE; 2802 2803 ASSERT(ipif->ipif_isv6); 2804 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2805 2806 /* 2807 * If all other interfaces for this ill are down or DEPRECATED, 2808 * or otherwise unsuitable for source address selection, remove 2809 * any IRE_CACHE entries for this ill to make sure source 2810 * address selection gets to take this new ipif into account. 2811 * No need to hold ill_lock while traversing the ipif list since 2812 * we are writer 2813 */ 2814 for (tmp_ipif = ill->ill_ipif; tmp_ipif; 2815 tmp_ipif = tmp_ipif->ipif_next) { 2816 if (((tmp_ipif->ipif_flags & 2817 (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) || 2818 !(tmp_ipif->ipif_flags & IPIF_UP)) || 2819 (tmp_ipif == ipif)) 2820 continue; 2821 /* first useable pre-existing interface */ 2822 flush_ire_cache = B_FALSE; 2823 break; 2824 } 2825 if (flush_ire_cache) 2826 ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE, 2827 IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill); 2828 2829 /* 2830 * Figure out which way the send-to queue should go. Only 2831 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here. 2832 */ 2833 switch (ill->ill_net_type) { 2834 case IRE_IF_RESOLVER: 2835 stq = ill->ill_rq; 2836 break; 2837 case IRE_IF_NORESOLVER: 2838 case IRE_LOOPBACK: 2839 stq = ill->ill_wq; 2840 break; 2841 default: 2842 return (EINVAL); 2843 } 2844 2845 if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) { 2846 /* 2847 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 2848 * ipif_lookup_on_name(), but in the case of zones we can have 2849 * several loopback addresses on lo0. So all the interfaces with 2850 * loopback addresses need to be marked IRE_LOOPBACK. 2851 */ 2852 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 2853 ipif->ipif_ire_type = IRE_LOOPBACK; 2854 else 2855 ipif->ipif_ire_type = IRE_LOCAL; 2856 } 2857 2858 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) { 2859 /* 2860 * Can't use our source address. Select a different 2861 * source address for the IRE_INTERFACE and IRE_LOCAL 2862 */ 2863 if (ip6_asp_can_lookup(ipst)) { 2864 ip6_asp_table_held = B_TRUE; 2865 src_ipif = ipif_select_source_v6(ipif->ipif_ill, 2866 &ipif->ipif_v6subnet, RESTRICT_TO_NONE, 2867 IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid); 2868 } 2869 if (src_ipif == NULL) 2870 src_ipif = ipif; /* Last resort */ 2871 else 2872 src_ipif_held = B_TRUE; 2873 } else { 2874 src_ipif = ipif; 2875 } 2876 2877 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 2878 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 2879 2880 /* 2881 * If we're on a labeled system then make sure that zone- 2882 * private addresses have proper remote host database entries. 2883 */ 2884 if (is_system_labeled() && 2885 ipif->ipif_ire_type != IRE_LOOPBACK) { 2886 if (ip6opt_ls == 0) { 2887 cmn_err(CE_WARN, "IPv6 not enabled " 2888 "via /etc/system"); 2889 return (EINVAL); 2890 } 2891 if (!tsol_check_interface_address(ipif)) 2892 return (EINVAL); 2893 } 2894 2895 /* Register the source address for __sin6_src_id */ 2896 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 2897 ipif->ipif_zoneid, ipst); 2898 if (err != 0) { 2899 ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err)); 2900 if (src_ipif_held) 2901 ipif_refrele(src_ipif); 2902 if (ip6_asp_table_held) 2903 ip6_asp_table_refrele(ipst); 2904 return (err); 2905 } 2906 /* 2907 * If the interface address is set, create the LOCAL 2908 * or LOOPBACK IRE. 2909 */ 2910 ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n", 2911 ipif->ipif_ire_type, 2912 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 2913 buf, sizeof (buf)))); 2914 2915 *irep++ = ire_create_v6( 2916 &ipif->ipif_v6lcl_addr, /* dest address */ 2917 &ipv6_all_ones, /* mask */ 2918 &src_ipif->ipif_v6src_addr, /* source address */ 2919 NULL, /* no gateway */ 2920 &ip_loopback_mtu_v6plus, /* max frag size */ 2921 NULL, 2922 ipif->ipif_rq, /* recv-from queue */ 2923 NULL, /* no send-to queue */ 2924 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 2925 NULL, 2926 ipif, /* interface */ 2927 NULL, 2928 0, 2929 0, 2930 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2931 &ire_uinfo_null, 2932 NULL, 2933 NULL, 2934 ipst); 2935 } 2936 2937 /* 2938 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. 2939 * Note that atun interfaces have an all-zero ipif_v6subnet. 2940 * Thus we allow a zero subnet as long as the mask is non-zero. 2941 */ 2942 if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) && 2943 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2944 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2945 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2946 v6addr = ipif->ipif_v6subnet; 2947 2948 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2949 route_mask = ipv6_all_ones; 2950 } else { 2951 route_mask = ipif->ipif_v6net_mask; 2952 } 2953 2954 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n", 2955 ill->ill_net_type, 2956 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 2957 2958 *irep++ = ire_create_v6( 2959 &v6addr, /* dest pref */ 2960 &route_mask, /* mask */ 2961 &src_ipif->ipif_v6src_addr, /* src addr */ 2962 NULL, /* no gateway */ 2963 &ipif->ipif_mtu, /* max frag */ 2964 NULL, /* no Fast path header */ 2965 NULL, /* no recv from queue */ 2966 stq, /* send-to queue */ 2967 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2968 ill->ill_resolver_mp, /* xmit header */ 2969 ipif, 2970 NULL, 2971 0, 2972 0, 2973 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2974 &ire_uinfo_null, 2975 NULL, 2976 NULL, 2977 ipst); 2978 } 2979 2980 /* 2981 * Setup 2002::/16 route, if this interface is a 6to4 tunnel 2982 */ 2983 if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) && 2984 (ill->ill_is_6to4tun)) { 2985 /* 2986 * Destination address is 2002::/16 2987 */ 2988 #ifdef _BIG_ENDIAN 2989 const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 }; 2990 const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 }; 2991 #else 2992 const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 }; 2993 const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 }; 2994 #endif /* _BIG_ENDIAN */ 2995 char buf2[INET6_ADDRSTRLEN]; 2996 ire_t *isdup; 2997 in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr; 2998 2999 /* 3000 * check to see if this route has already been added for 3001 * this tunnel interface. 3002 */ 3003 isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0, 3004 IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL, 3005 (MATCH_IRE_SRC | MATCH_IRE_MASK), ipst); 3006 3007 if (isdup == NULL) { 3008 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s", 3009 IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr, 3010 buf2, sizeof (buf2)))); 3011 3012 *irep++ = ire_create_v6( 3013 &prefix_addr, /* 2002:: */ 3014 &prefix_mask, /* ffff:: */ 3015 &ipif->ipif_v6lcl_addr, /* src addr */ 3016 NULL, /* gateway */ 3017 &ipif->ipif_mtu, /* max_frag */ 3018 NULL, /* no Fast Path hdr */ 3019 NULL, /* no rfq */ 3020 ill->ill_wq, /* stq */ 3021 IRE_IF_NORESOLVER, /* type */ 3022 ill->ill_resolver_mp, /* dlureq_mp */ 3023 ipif, /* interface */ 3024 NULL, /* v6cmask */ 3025 0, 3026 0, 3027 RTF_UP, 3028 &ire_uinfo_null, 3029 NULL, 3030 NULL, 3031 ipst); 3032 } else { 3033 ire_refrele(isdup); 3034 } 3035 } 3036 3037 /* If an earlier ire_create failed, get out now */ 3038 for (irep1 = irep; irep1 > ire_array; ) { 3039 irep1--; 3040 if (*irep1 == NULL) { 3041 ip1dbg(("ipif_up_done_v6: NULL ire found in" 3042 " ire_array\n")); 3043 err = ENOMEM; 3044 goto bad; 3045 } 3046 } 3047 3048 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 3049 3050 /* 3051 * Need to atomically check for ip_addr_availablity_check 3052 * now under ill_g_lock, and if it fails got bad, and remove 3053 * from group also 3054 */ 3055 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 3056 mutex_enter(&ipst->ips_ip_addr_avail_lock); 3057 ill->ill_ipif_up_count++; 3058 ipif->ipif_flags |= IPIF_UP; 3059 err = ip_addr_availability_check(ipif); 3060 mutex_exit(&ipst->ips_ip_addr_avail_lock); 3061 rw_exit(&ipst->ips_ill_g_lock); 3062 3063 if (err != 0) { 3064 /* 3065 * Our address may already be up on the same ill. In this case, 3066 * the external resolver entry for our ipif replaced the one for 3067 * the other ipif. So we don't want to delete it (otherwise the 3068 * other ipif would be unable to send packets). 3069 * ip_addr_availability_check() identifies this case for us and 3070 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL 3071 * which is the expected error code. 3072 */ 3073 if (err == EADDRINUSE) { 3074 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) { 3075 freemsg(ipif->ipif_arp_del_mp); 3076 ipif->ipif_arp_del_mp = NULL; 3077 } 3078 err = EADDRNOTAVAIL; 3079 } 3080 ill->ill_ipif_up_count--; 3081 ipif->ipif_flags &= ~IPIF_UP; 3082 goto bad; 3083 } 3084 3085 /* 3086 * Add in all newly created IREs. We want to add before 3087 * we call ifgrp_insert which wants to know whether 3088 * IRE_IF_RESOLVER exists or not. 3089 * 3090 * NOTE : We refrele the ire though we may branch to "bad" 3091 * later on where we do ire_delete. This is okay 3092 * because nobody can delete it as we are running 3093 * exclusively. 3094 */ 3095 for (irep1 = irep; irep1 > ire_array; ) { 3096 irep1--; 3097 /* Shouldn't be adding any bcast ire's */ 3098 ASSERT((*irep1)->ire_type != IRE_BROADCAST); 3099 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 3100 /* 3101 * refheld by ire_add. refele towards the end of the func 3102 */ 3103 (void) ire_add(irep1, NULL, NULL, NULL, B_FALSE); 3104 } 3105 if (ip6_asp_table_held) { 3106 ip6_asp_table_refrele(ipst); 3107 ip6_asp_table_held = B_FALSE; 3108 } 3109 ire_added = B_TRUE; 3110 3111 /* 3112 * Form groups if possible. 3113 * 3114 * If we are supposed to be in a ill_group with a name, insert it 3115 * now as we know that at least one ipif is UP. Otherwise form 3116 * nameless groups. 3117 * 3118 * If ip_enable_group_ifs is set and ipif address is not ::0, insert 3119 * this ipif into the appropriate interface group, or create a 3120 * new one. If this is already in a nameless group, we try to form 3121 * a bigger group looking at other ills potentially sharing this 3122 * ipif's prefix. 3123 */ 3124 phyi = ill->ill_phyint; 3125 if (phyi->phyint_groupname_len != 0) { 3126 ASSERT(phyi->phyint_groupname != NULL); 3127 if (ill->ill_ipif_up_count == 1) { 3128 ASSERT(ill->ill_group == NULL); 3129 err = illgrp_insert(&ipst->ips_illgrp_head_v6, ill, 3130 phyi->phyint_groupname, NULL, B_TRUE); 3131 if (err != 0) { 3132 ip1dbg(("ipif_up_done_v6: illgrp allocation " 3133 "failed, error %d\n", err)); 3134 goto bad; 3135 } 3136 } 3137 ASSERT(ill->ill_group != NULL); 3138 } 3139 3140 /* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */ 3141 ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt; 3142 ipif_saved_irep = ipif_recover_ire_v6(ipif); 3143 3144 if (ipif->ipif_ipif_up_count == 1 && !loopback) { 3145 /* 3146 * Need to recover all multicast memberships in the driver. 3147 * This had to be deferred until we had attached. 3148 */ 3149 ill_recover_multicast(ill); 3150 } 3151 /* Join the allhosts multicast address and the solicited node MC */ 3152 ipif_multicast_up(ipif); 3153 3154 if (!loopback) { 3155 /* 3156 * See whether anybody else would benefit from the 3157 * new ipif that we added. We call this always rather 3158 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST 3159 * ipif for the benefit of illgrp_insert (done above) 3160 * which does not do source address selection as it does 3161 * not want to re-create interface routes that we are 3162 * having reference to it here. 3163 */ 3164 ill_update_source_selection(ill); 3165 } 3166 3167 for (irep1 = irep; irep1 > ire_array; ) { 3168 irep1--; 3169 if (*irep1 != NULL) { 3170 /* was held in ire_add */ 3171 ire_refrele(*irep1); 3172 } 3173 } 3174 3175 cnt = ipif_saved_ire_cnt; 3176 for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) { 3177 if (*irep1 != NULL) { 3178 /* was held in ire_add */ 3179 ire_refrele(*irep1); 3180 } 3181 } 3182 3183 if (ipif->ipif_addr_ready) { 3184 ip_rts_ifmsg(ipif); 3185 ip_rts_newaddrmsg(RTM_ADD, 0, ipif); 3186 sctp_update_ipif(ipif, SCTP_IPIF_UP); 3187 } 3188 3189 if (ipif_saved_irep != NULL) { 3190 kmem_free(ipif_saved_irep, 3191 ipif_saved_ire_cnt * sizeof (ire_t *)); 3192 } 3193 3194 if (src_ipif_held) 3195 ipif_refrele(src_ipif); 3196 return (0); 3197 3198 bad: 3199 if (ip6_asp_table_held) 3200 ip6_asp_table_refrele(ipst); 3201 /* 3202 * We don't have to bother removing from ill groups because 3203 * 3204 * 1) For groups with names, we insert only when the first ipif 3205 * comes up. In that case if it fails, it will not be in any 3206 * group. So, we need not try to remove for that case. 3207 * 3208 * 2) For groups without names, either we tried to insert ipif_ill 3209 * in a group as singleton or found some other group to become 3210 * a bigger group. For the former, if it fails we don't have 3211 * anything to do as ipif_ill is not in the group and for the 3212 * latter, there are no failures in illgrp_insert/illgrp_delete 3213 * (ENOMEM can't occur for this. Check ifgrp_insert). 3214 */ 3215 3216 while (irep > ire_array) { 3217 irep--; 3218 if (*irep != NULL) { 3219 ire_delete(*irep); 3220 if (ire_added) 3221 ire_refrele(*irep); 3222 } 3223 3224 } 3225 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst); 3226 3227 if (ipif_saved_irep != NULL) { 3228 kmem_free(ipif_saved_irep, 3229 ipif_saved_ire_cnt * sizeof (ire_t *)); 3230 } 3231 if (src_ipif_held) 3232 ipif_refrele(src_ipif); 3233 3234 ipif_ndp_down(ipif); 3235 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) 3236 ipif_arp_down(ipif); 3237 3238 return (err); 3239 } 3240 3241 /* 3242 * Delete an ND entry and the corresponding IRE_CACHE entry if it exists. 3243 */ 3244 /* ARGSUSED */ 3245 int 3246 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3247 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3248 { 3249 in6_addr_t addr; 3250 sin6_t *sin6; 3251 nce_t *nce; 3252 struct lifreq *lifr; 3253 lif_nd_req_t *lnr; 3254 mblk_t *mp1; 3255 3256 mp1 = mp->b_cont->b_cont; 3257 lifr = (struct lifreq *)mp1->b_rptr; 3258 lnr = &lifr->lifr_nd; 3259 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3260 if (ipif->ipif_id != 0) 3261 return (EINVAL); 3262 3263 if (!ipif->ipif_isv6) 3264 return (EINVAL); 3265 3266 if (lnr->lnr_addr.ss_family != AF_INET6) 3267 return (EAFNOSUPPORT); 3268 3269 sin6 = (sin6_t *)&lnr->lnr_addr; 3270 addr = sin6->sin6_addr; 3271 nce = ndp_lookup_v6(ipif->ipif_ill, &addr, B_FALSE); 3272 if (nce == NULL) 3273 return (ESRCH); 3274 ndp_delete(nce); 3275 NCE_REFRELE(nce); 3276 return (0); 3277 } 3278 3279 /* 3280 * Return nbr cache info. 3281 */ 3282 /* ARGSUSED */ 3283 int 3284 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3285 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3286 { 3287 ill_t *ill = ipif->ipif_ill; 3288 struct lifreq *lifr; 3289 lif_nd_req_t *lnr; 3290 3291 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3292 lnr = &lifr->lifr_nd; 3293 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3294 if (ipif->ipif_id != 0) 3295 return (EINVAL); 3296 3297 if (!ipif->ipif_isv6) 3298 return (EINVAL); 3299 3300 if (lnr->lnr_addr.ss_family != AF_INET6) 3301 return (EAFNOSUPPORT); 3302 3303 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 3304 return (EINVAL); 3305 3306 return (ndp_query(ill, lnr)); 3307 } 3308 3309 /* 3310 * Perform an update of the nd entry for the specified address. 3311 */ 3312 /* ARGSUSED */ 3313 int 3314 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3315 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3316 { 3317 ill_t *ill = ipif->ipif_ill; 3318 struct lifreq *lifr; 3319 lif_nd_req_t *lnr; 3320 3321 ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL); 3322 3323 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3324 lnr = &lifr->lifr_nd; 3325 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3326 if (ipif->ipif_id != 0) 3327 return (EINVAL); 3328 3329 if (!ipif->ipif_isv6) 3330 return (EINVAL); 3331 3332 if (lnr->lnr_addr.ss_family != AF_INET6) 3333 return (EAFNOSUPPORT); 3334 3335 return (ndp_sioc_update(ill, lnr)); 3336 } 3337