xref: /illumos-gate/usr/src/uts/common/inet/ip/ip6_ire.c (revision 76716eaced8d7659d4594350eb3f343c31fe2806)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 1990 Mentat Inc.
27  */
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 /*
32  * This file contains routines that manipulate Internet Routing Entries (IREs).
33  */
34 #include <sys/types.h>
35 #include <sys/stream.h>
36 #include <sys/stropts.h>
37 #include <sys/ddi.h>
38 #include <sys/cmn_err.h>
39 
40 #include <sys/systm.h>
41 #include <sys/param.h>
42 #include <sys/socket.h>
43 #include <net/if.h>
44 #include <net/route.h>
45 #include <netinet/in.h>
46 #include <net/if_dl.h>
47 #include <netinet/ip6.h>
48 #include <netinet/icmp6.h>
49 
50 #include <inet/common.h>
51 #include <inet/mi.h>
52 #include <inet/ip.h>
53 #include <inet/ip6.h>
54 #include <inet/ip_ndp.h>
55 #include <inet/ip_if.h>
56 #include <inet/ip_ire.h>
57 #include <inet/ipclassifier.h>
58 #include <inet/nd.h>
59 #include <sys/kmem.h>
60 #include <sys/zone.h>
61 
62 #include <sys/tsol/label.h>
63 #include <sys/tsol/tnet.h>
64 
65 irb_t *ip_forwarding_table_v6[IP6_MASK_TABLE_SIZE];
66 /* This is dynamically allocated in ip_ire_init */
67 irb_t *ip_cache_table_v6;
68 static	ire_t	ire_null;
69 
70 /* Defined in ip_ire.c */
71 extern uint32_t ip6_cache_table_size;
72 extern uint32_t ip6_ftable_hash_size;
73 
74 static ire_t	*ire_ihandle_lookup_onlink_v6(ire_t *cire);
75 static	void	ire_report_ftable_v6(ire_t *ire, char *mp);
76 static	void	ire_report_ctable_v6(ire_t *ire, char *mp);
77 static boolean_t ire_match_args_v6(ire_t *ire, const in6_addr_t *addr,
78     const in6_addr_t *mask, const in6_addr_t *gateway, int type,
79     const ipif_t *ipif, zoneid_t zoneid, uint32_t ihandle,
80     const ts_label_t *tsl, int match_flags);
81 
82 /*
83  * Named Dispatch routine to produce a formatted report on all IREs.
84  * This report is accessed by using the ndd utility to "get" ND variable
85  * "ip_ire_status_v6".
86  */
87 /* ARGSUSED */
88 int
89 ip_ire_report_v6(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
90 {
91 	zoneid_t zoneid;
92 
93 	(void) mi_mpprintf(mp,
94 	    "IRE      " MI_COL_HDRPAD_STR
95 	    "rfq      " MI_COL_HDRPAD_STR
96 	    "stq      " MI_COL_HDRPAD_STR
97 	    " zone mxfrg rtt   rtt_sd ssthresh ref "
98 	    "rtomax tstamp_ok wscale_ok ecn_ok pmtud_ok sack sendpipe recvpipe "
99 	    "in/out/forward type    addr         mask         "
100 	    "src             gateway");
101 	/*
102 	 *   01234567 01234567 01234567 12345 12345 12345 12345  12345678 123
103 	 *   123456 123456789 123456789 123456 12345678 1234 12345678 12345678
104 	 *   in/out/forward xxxxxxxxxx
105 	 *   xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
106 	 *   xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
107 	 *   xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
108 	 *   xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
109 	 */
110 
111 	/*
112 	 * Because of the ndd constraint, at most we can have 64K buffer
113 	 * to put in all IRE info.  So to be more efficient, just
114 	 * allocate a 64K buffer here, assuming we need that large buffer.
115 	 * This should be OK as only root can do ndd /dev/ip.
116 	 */
117 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
118 		/* The following may work even if we cannot get a large buf. */
119 		(void) mi_mpprintf(mp, "<< Out of buffer >>\n");
120 		return (0);
121 	}
122 	zoneid = Q_TO_CONN(q)->conn_zoneid;
123 	if (zoneid == GLOBAL_ZONEID)
124 		zoneid = ALL_ZONES;
125 
126 	ire_walk_v6(ire_report_ftable_v6, (char *)mp->b_cont, zoneid);
127 	ire_walk_v6(ire_report_ctable_v6, (char *)mp->b_cont, zoneid);
128 	return (0);
129 }
130 
131 /*
132  * ire_walk routine invoked for ip_ire_report_v6 for each IRE.
133  */
134 static void
135 ire_report_ftable_v6(ire_t *ire, char *mp)
136 {
137 	char	buf1[INET6_ADDRSTRLEN];
138 	char	buf2[INET6_ADDRSTRLEN];
139 	char	buf3[INET6_ADDRSTRLEN];
140 	char	buf4[INET6_ADDRSTRLEN];
141 	uint_t	fo_pkt_count;
142 	uint_t	ib_pkt_count;
143 	int	ref;
144 	in6_addr_t gw_addr_v6;
145 	uint_t	print_len, buf_len;
146 
147 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
148 	if (ire->ire_type & IRE_CACHETABLE)
149 	    return;
150 	buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr;
151 	if (buf_len <= 0)
152 		return;
153 
154 	/* Number of active references of this ire */
155 	ref = ire->ire_refcnt;
156 	/* "inbound" to a non local address is a forward */
157 	ib_pkt_count = ire->ire_ib_pkt_count;
158 	fo_pkt_count = 0;
159 	ASSERT(!(ire->ire_type & IRE_BROADCAST));
160 	if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) {
161 		fo_pkt_count = ib_pkt_count;
162 		ib_pkt_count = 0;
163 	}
164 
165 	mutex_enter(&ire->ire_lock);
166 	gw_addr_v6 = ire->ire_gateway_addr_v6;
167 	mutex_exit(&ire->ire_lock);
168 
169 	print_len = snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len,
170 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d "
171 	    "%05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d "
172 	    "%04d %08d %08d %d/%d/%d %s\n\t%s\n\t%s\n\t%s\n\t%s\n",
173 	    (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq,
174 	    (int)ire->ire_zoneid,
175 	    ire->ire_max_frag, ire->ire_uinfo.iulp_rtt,
176 	    ire->ire_uinfo.iulp_rtt_sd,
177 	    ire->ire_uinfo.iulp_ssthresh, ref,
178 	    ire->ire_uinfo.iulp_rtomax,
179 	    (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0),
180 	    (ire->ire_uinfo.iulp_wscale_ok ? 1: 0),
181 	    (ire->ire_uinfo.iulp_ecn_ok ? 1: 0),
182 	    (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0),
183 	    ire->ire_uinfo.iulp_sack,
184 	    ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe,
185 	    ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count,
186 	    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type),
187 	    inet_ntop(AF_INET6, &ire->ire_addr_v6, buf1, sizeof (buf1)),
188 	    inet_ntop(AF_INET6, &ire->ire_mask_v6, buf2, sizeof (buf2)),
189 	    inet_ntop(AF_INET6, &ire->ire_src_addr_v6, buf3, sizeof (buf3)),
190 	    inet_ntop(AF_INET6, &gw_addr_v6, buf4, sizeof (buf4)));
191 	if (print_len < buf_len) {
192 		((mblk_t *)mp)->b_wptr += print_len;
193 	} else {
194 		((mblk_t *)mp)->b_wptr += buf_len;
195 	}
196 }
197 
198 /* ire_walk routine invoked for ip_ire_report_v6 for each IRE. */
199 static void
200 ire_report_ctable_v6(ire_t *ire, char *mp)
201 {
202 	char	buf1[INET6_ADDRSTRLEN];
203 	char	buf2[INET6_ADDRSTRLEN];
204 	char	buf3[INET6_ADDRSTRLEN];
205 	char	buf4[INET6_ADDRSTRLEN];
206 	uint_t	fo_pkt_count;
207 	uint_t	ib_pkt_count;
208 	int	ref;
209 	in6_addr_t gw_addr_v6;
210 	uint_t	print_len, buf_len;
211 
212 	if ((ire->ire_type & IRE_CACHETABLE) == 0)
213 		return;
214 	buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr;
215 	if (buf_len <= 0)
216 		return;
217 
218 	/* Number of active references of this ire */
219 	ref = ire->ire_refcnt;
220 	/* "inbound" to a non local address is a forward */
221 	ib_pkt_count = ire->ire_ib_pkt_count;
222 	fo_pkt_count = 0;
223 	ASSERT(!(ire->ire_type & IRE_BROADCAST));
224 	if (ire->ire_type & IRE_LOCAL) {
225 		fo_pkt_count = ib_pkt_count;
226 		ib_pkt_count = 0;
227 	}
228 
229 	mutex_enter(&ire->ire_lock);
230 	gw_addr_v6 = ire->ire_gateway_addr_v6;
231 	mutex_exit(&ire->ire_lock);
232 
233 	print_len =  snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len,
234 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d "
235 	    "%05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d "
236 	    "%04d %08d %08d %d/%d/%d %s\n\t%s\n\t%s\n\t%s\n\t%s\n",
237 	    (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq,
238 	    (int)ire->ire_zoneid,
239 	    ire->ire_max_frag, ire->ire_uinfo.iulp_rtt,
240 	    ire->ire_uinfo.iulp_rtt_sd, ire->ire_uinfo.iulp_ssthresh, ref,
241 	    ire->ire_uinfo.iulp_rtomax,
242 	    (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0),
243 	    (ire->ire_uinfo.iulp_wscale_ok ? 1: 0),
244 	    (ire->ire_uinfo.iulp_ecn_ok ? 1: 0),
245 	    (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0),
246 	    ire->ire_uinfo.iulp_sack,
247 	    ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe,
248 	    ib_pkt_count, ire->ire_ob_pkt_count,
249 	    fo_pkt_count, ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type),
250 	    inet_ntop(AF_INET6, &ire->ire_addr_v6, buf1, sizeof (buf1)),
251 	    inet_ntop(AF_INET6, &ire->ire_mask_v6, buf2, sizeof (buf2)),
252 	    inet_ntop(AF_INET6, &ire->ire_src_addr_v6, buf3, sizeof (buf3)),
253 	    inet_ntop(AF_INET6, &gw_addr_v6, buf4, sizeof (buf4)));
254 	if (print_len < buf_len) {
255 		((mblk_t *)mp)->b_wptr += print_len;
256 	} else {
257 		((mblk_t *)mp)->b_wptr += buf_len;
258 	}
259 }
260 
261 
262 /*
263  * Initialize the ire that is specific to IPv6 part and call
264  * ire_init_common to finish it.
265  */
266 ire_t *
267 ire_init_v6(ire_t *ire, const in6_addr_t *v6addr,
268     const in6_addr_t *v6mask, const in6_addr_t *v6src_addr,
269     const in6_addr_t *v6gateway, uint_t *max_fragp,
270     mblk_t *fp_mp, queue_t *rfq, queue_t *stq, ushort_t type,
271     mblk_t *dlureq_mp, ipif_t *ipif, const in6_addr_t *v6cmask,
272     uint32_t phandle, uint32_t ihandle, uint_t flags, const iulp_t *ulp_info,
273     tsol_gc_t *gc, tsol_gcgrp_t *gcgrp)
274 {
275 	/*
276 	 * Reject IRE security attribute creation/initialization
277 	 * if system is not running in Trusted mode.
278 	 */
279 	if ((gc != NULL || gcgrp != NULL) && !is_system_labeled())
280 		return (NULL);
281 
282 	if (fp_mp != NULL) {
283 		/*
284 		 * We can't dupb() here as multiple threads could be
285 		 * calling dupb on the same mp which is incorrect.
286 		 * First dupb() should be called only by one thread.
287 		 */
288 		fp_mp = copyb(fp_mp);
289 		if (fp_mp == NULL)
290 			return (NULL);
291 	}
292 
293 	if (dlureq_mp != NULL) {
294 		/*
295 		 * We can't dupb() here as multiple threads could be
296 		 * calling dupb on the same mp which is incorrect.
297 		 * First dupb() should be called only by one thread.
298 		 */
299 		dlureq_mp = copyb(dlureq_mp);
300 		if (dlureq_mp == NULL) {
301 			if (fp_mp != NULL)
302 				freeb(fp_mp);
303 			return (NULL);
304 		}
305 	}
306 
307 	BUMP_IRE_STATS(ire_stats_v6, ire_stats_alloced);
308 	ire->ire_addr_v6 = *v6addr;
309 
310 	if (v6src_addr != NULL)
311 		ire->ire_src_addr_v6 = *v6src_addr;
312 	if (v6mask != NULL) {
313 		ire->ire_mask_v6 = *v6mask;
314 		ire->ire_masklen = ip_mask_to_plen_v6(&ire->ire_mask_v6);
315 	}
316 	if (v6gateway != NULL)
317 		ire->ire_gateway_addr_v6 = *v6gateway;
318 
319 	if (type == IRE_CACHE && v6cmask != NULL)
320 		ire->ire_cmask_v6 = *v6cmask;
321 
322 	/*
323 	 * Multirouted packets need to have a fragment header added so that
324 	 * the receiver is able to discard duplicates according to their
325 	 * fragment identifier.
326 	 */
327 	if (type == IRE_CACHE && (flags & RTF_MULTIRT)) {
328 		ire->ire_frag_flag = IPH_FRAG_HDR;
329 	}
330 
331 	/* ire_init_common will free the mblks upon encountering any failure */
332 	if (!ire_init_common(ire, max_fragp, fp_mp, rfq, stq, type, dlureq_mp,
333 	    ipif, NULL, phandle, ihandle, flags, IPV6_VERSION, ulp_info,
334 	    gc, gcgrp))
335 		return (NULL);
336 
337 	return (ire);
338 }
339 
340 /*
341  * Similar to ire_create_v6 except that it is called only when
342  * we want to allocate ire as an mblk e.g. we have a external
343  * resolver. Do we need this in IPv6 ?
344  */
345 ire_t *
346 ire_create_mp_v6(const in6_addr_t *v6addr, const in6_addr_t *v6mask,
347     const in6_addr_t *v6src_addr, const in6_addr_t *v6gateway,
348     mblk_t *fp_mp, queue_t *rfq, queue_t *stq, ushort_t type,
349     mblk_t *dlureq_mp, ipif_t *ipif, const in6_addr_t *v6cmask,
350     uint32_t phandle, uint32_t ihandle, uint_t flags, const iulp_t *ulp_info,
351     tsol_gc_t *gc, tsol_gcgrp_t *gcgrp)
352 {
353 	ire_t	*ire;
354 	ire_t	*ret_ire;
355 	mblk_t	*mp;
356 
357 	ASSERT(!IN6_IS_ADDR_V4MAPPED(v6addr));
358 
359 	/* Allocate the new IRE. */
360 	mp = allocb(sizeof (ire_t), BPRI_MED);
361 	if (mp == NULL) {
362 		ip1dbg(("ire_create_mp_v6: alloc failed\n"));
363 		return (NULL);
364 	}
365 
366 	ire = (ire_t *)mp->b_rptr;
367 	mp->b_wptr = (uchar_t *)&ire[1];
368 
369 	/* Start clean. */
370 	*ire = ire_null;
371 	ire->ire_mp = mp;
372 	mp->b_datap->db_type = IRE_DB_TYPE;
373 
374 	ret_ire = ire_init_v6(ire, v6addr, v6mask, v6src_addr, v6gateway,
375 	    NULL, fp_mp, rfq, stq, type, dlureq_mp, ipif, v6cmask, phandle,
376 	    ihandle, flags, ulp_info, gc, gcgrp);
377 
378 	if (ret_ire == NULL) {
379 		freeb(ire->ire_mp);
380 		return (NULL);
381 	}
382 	return (ire);
383 }
384 
385 /*
386  * ire_create_v6 is called to allocate and initialize a new IRE.
387  *
388  * NOTE : This is called as writer sometimes though not required
389  * by this function.
390  */
391 ire_t *
392 ire_create_v6(const in6_addr_t *v6addr, const in6_addr_t *v6mask,
393     const in6_addr_t *v6src_addr, const in6_addr_t *v6gateway,
394     uint_t *max_fragp, mblk_t *fp_mp, queue_t *rfq, queue_t *stq, ushort_t type,
395     mblk_t *dlureq_mp, ipif_t *ipif, const in6_addr_t *v6cmask,
396     uint32_t phandle, uint32_t ihandle, uint_t flags, const iulp_t *ulp_info,
397     tsol_gc_t *gc, tsol_gcgrp_t *gcgrp)
398 {
399 	ire_t	*ire;
400 	ire_t	*ret_ire;
401 
402 	ASSERT(!IN6_IS_ADDR_V4MAPPED(v6addr));
403 
404 	ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
405 	if (ire == NULL) {
406 		ip1dbg(("ire_create_v6: alloc failed\n"));
407 		return (NULL);
408 	}
409 	*ire = ire_null;
410 
411 	ret_ire = ire_init_v6(ire, v6addr, v6mask, v6src_addr, v6gateway,
412 	    max_fragp, fp_mp, rfq, stq, type, dlureq_mp, ipif, v6cmask, phandle,
413 	    ihandle, flags, ulp_info, gc, gcgrp);
414 
415 	if (ret_ire == NULL) {
416 		kmem_cache_free(ire_cache, ire);
417 		return (NULL);
418 	}
419 	ASSERT(ret_ire == ire);
420 	return (ire);
421 }
422 
423 /*
424  * Find an IRE_INTERFACE for the multicast group.
425  * Allows different routes for multicast addresses
426  * in the unicast routing table (akin to FF::0/8 but could be more specific)
427  * which point at different interfaces. This is used when IPV6_MULTICAST_IF
428  * isn't specified (when sending) and when IPV6_JOIN_GROUP doesn't
429  * specify the interface to join on.
430  *
431  * Supports link-local addresses by following the ipif/ill when recursing.
432  */
433 ire_t *
434 ire_lookup_multi_v6(const in6_addr_t *group, zoneid_t zoneid)
435 {
436 	ire_t	*ire;
437 	ipif_t	*ipif = NULL;
438 	int	match_flags = MATCH_IRE_TYPE;
439 	in6_addr_t gw_addr_v6;
440 
441 	ire = ire_ftable_lookup_v6(group, 0, 0, 0, NULL, NULL,
442 	    zoneid, 0, NULL, MATCH_IRE_DEFAULT);
443 
444 	/* We search a resolvable ire in case of multirouting. */
445 	if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) {
446 		ire_t *cire = NULL;
447 		/*
448 		 * If the route is not resolvable, the looked up ire
449 		 * may be changed here. In that case, ire_multirt_lookup()
450 		 * IRE_REFRELE the original ire and change it.
451 		 */
452 		(void) ire_multirt_lookup_v6(&cire, &ire, MULTIRT_CACHEGW,
453 		    NULL);
454 		if (cire != NULL)
455 			ire_refrele(cire);
456 	}
457 	if (ire == NULL)
458 		return (NULL);
459 	/*
460 	 * Make sure we follow ire_ipif.
461 	 *
462 	 * We need to determine the interface route through
463 	 * which the gateway will be reached. We don't really
464 	 * care which interface is picked if the interface is
465 	 * part of a group.
466 	 */
467 	if (ire->ire_ipif != NULL) {
468 		ipif = ire->ire_ipif;
469 		match_flags |= MATCH_IRE_ILL_GROUP;
470 	}
471 
472 	switch (ire->ire_type) {
473 	case IRE_DEFAULT:
474 	case IRE_PREFIX:
475 	case IRE_HOST:
476 		mutex_enter(&ire->ire_lock);
477 		gw_addr_v6 = ire->ire_gateway_addr_v6;
478 		mutex_exit(&ire->ire_lock);
479 		ire_refrele(ire);
480 		ire = ire_ftable_lookup_v6(&gw_addr_v6, 0, 0,
481 		    IRE_INTERFACE, ipif, NULL, zoneid, 0,
482 		    NULL, match_flags);
483 		return (ire);
484 	case IRE_IF_NORESOLVER:
485 	case IRE_IF_RESOLVER:
486 		return (ire);
487 	default:
488 		ire_refrele(ire);
489 		return (NULL);
490 	}
491 }
492 
493 /*
494  * Return any local address.  We use this to target ourselves
495  * when the src address was specified as 'default'.
496  * Preference for IRE_LOCAL entries.
497  */
498 ire_t *
499 ire_lookup_local_v6(zoneid_t zoneid)
500 {
501 	ire_t	*ire;
502 	irb_t	*irb;
503 	ire_t	*maybe = NULL;
504 	int i;
505 
506 	for (i = 0; i < ip6_cache_table_size;  i++) {
507 		irb = &ip_cache_table_v6[i];
508 		if (irb->irb_ire == NULL)
509 			continue;
510 		rw_enter(&irb->irb_lock, RW_READER);
511 		for (ire = irb->irb_ire; ire; ire = ire->ire_next) {
512 			if ((ire->ire_marks & IRE_MARK_CONDEMNED) ||
513 			    ire->ire_zoneid != zoneid &&
514 			    ire->ire_zoneid != ALL_ZONES)
515 				continue;
516 			switch (ire->ire_type) {
517 			case IRE_LOOPBACK:
518 				if (maybe == NULL) {
519 					IRE_REFHOLD(ire);
520 					maybe = ire;
521 				}
522 				break;
523 			case IRE_LOCAL:
524 				if (maybe != NULL) {
525 					ire_refrele(maybe);
526 				}
527 				IRE_REFHOLD(ire);
528 				rw_exit(&irb->irb_lock);
529 				return (ire);
530 			}
531 		}
532 		rw_exit(&irb->irb_lock);
533 	}
534 	return (maybe);
535 }
536 
537 /*
538  * This function takes a mask and returns number of bits set in the
539  * mask (the represented prefix length).  Assumes a contiguous mask.
540  */
541 int
542 ip_mask_to_plen_v6(const in6_addr_t *v6mask)
543 {
544 	int		bits;
545 	int		plen = IPV6_ABITS;
546 	int		i;
547 
548 	for (i = 3; i >= 0; i--) {
549 		if (v6mask->s6_addr32[i] == 0) {
550 			plen -= 32;
551 			continue;
552 		}
553 		bits = ffs(ntohl(v6mask->s6_addr32[i])) - 1;
554 		if (bits == 0)
555 			break;
556 		plen -= bits;
557 	}
558 
559 	return (plen);
560 }
561 
562 /*
563  * Convert a prefix length to the mask for that prefix.
564  * Returns the argument bitmask.
565  */
566 in6_addr_t *
567 ip_plen_to_mask_v6(uint_t plen, in6_addr_t *bitmask)
568 {
569 	uint32_t *ptr;
570 
571 	if (plen < 0 || plen > IPV6_ABITS)
572 		return (NULL);
573 	*bitmask = ipv6_all_zeros;
574 
575 	ptr = (uint32_t *)bitmask;
576 	while (plen > 32) {
577 		*ptr++ = 0xffffffffU;
578 		plen -= 32;
579 	}
580 	*ptr = htonl(0xffffffffU << (32 - plen));
581 	return (bitmask);
582 }
583 
584 /*
585  * Add a fully initialized IRE to an appropriate
586  * table based on ire_type.
587  *
588  * The forward table contains IRE_PREFIX/IRE_HOST/IRE_HOST_REDIRECT
589  * IRE_IF_RESOLVER/IRE_IF_NORESOLVER and IRE_DEFAULT.
590  *
591  * The cache table contains IRE_BROADCAST/IRE_LOCAL/IRE_LOOPBACK
592  * and IRE_CACHE.
593  *
594  * NOTE : This function is called as writer though not required
595  * by this function.
596  */
597 int
598 ire_add_v6(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func)
599 {
600 	ire_t	*ire1;
601 	int	mask_table_index;
602 	irb_t	*irb_ptr;
603 	ire_t	**irep;
604 	int	flags;
605 	ire_t	*pire = NULL;
606 	ill_t	*stq_ill;
607 	boolean_t	ndp_g_lock_held = B_FALSE;
608 	ire_t	*ire = *ire_p;
609 	int	error;
610 
611 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
612 	ASSERT(ire->ire_mp == NULL); /* Calls should go through ire_add */
613 	ASSERT(ire->ire_nce == NULL);
614 
615 	/* Find the appropriate list head. */
616 	switch (ire->ire_type) {
617 	case IRE_HOST:
618 		ire->ire_mask_v6 = ipv6_all_ones;
619 		ire->ire_masklen = IPV6_ABITS;
620 		if ((ire->ire_flags & RTF_SETSRC) == 0)
621 			ire->ire_src_addr_v6 = ipv6_all_zeros;
622 		break;
623 	case IRE_HOST_REDIRECT:
624 		ire->ire_mask_v6 = ipv6_all_ones;
625 		ire->ire_masklen = IPV6_ABITS;
626 		ire->ire_src_addr_v6 = ipv6_all_zeros;
627 		break;
628 	case IRE_CACHE:
629 	case IRE_LOCAL:
630 	case IRE_LOOPBACK:
631 		ire->ire_mask_v6 = ipv6_all_ones;
632 		ire->ire_masklen = IPV6_ABITS;
633 		break;
634 	case IRE_PREFIX:
635 		if ((ire->ire_flags & RTF_SETSRC) == 0)
636 			ire->ire_src_addr_v6 = ipv6_all_zeros;
637 		break;
638 	case IRE_DEFAULT:
639 		if ((ire->ire_flags & RTF_SETSRC) == 0)
640 			ire->ire_src_addr_v6 = ipv6_all_zeros;
641 		break;
642 	case IRE_IF_RESOLVER:
643 	case IRE_IF_NORESOLVER:
644 		break;
645 	default:
646 		printf("ire_add_v6: ire %p has unrecognized IRE type (%d)\n",
647 		    (void *)ire, ire->ire_type);
648 		ire_delete(ire);
649 		*ire_p = NULL;
650 		return (EINVAL);
651 	}
652 
653 	/* Make sure the address is properly masked. */
654 	V6_MASK_COPY(ire->ire_addr_v6, ire->ire_mask_v6, ire->ire_addr_v6);
655 
656 	if ((ire->ire_type & IRE_CACHETABLE) == 0) {
657 		/* IRE goes into Forward Table */
658 		mask_table_index = ip_mask_to_plen_v6(&ire->ire_mask_v6);
659 		if ((ip_forwarding_table_v6[mask_table_index]) == NULL) {
660 			irb_t *ptr;
661 			int i;
662 
663 			ptr = (irb_t *)mi_zalloc((ip6_ftable_hash_size *
664 			    sizeof (irb_t)));
665 			if (ptr == NULL) {
666 				ire_delete(ire);
667 				*ire_p = NULL;
668 				return (ENOMEM);
669 			}
670 			for (i = 0; i < ip6_ftable_hash_size; i++) {
671 				rw_init(&ptr[i].irb_lock, NULL,
672 				    RW_DEFAULT, NULL);
673 			}
674 			mutex_enter(&ire_ft_init_lock);
675 			if (ip_forwarding_table_v6[mask_table_index] == NULL) {
676 				ip_forwarding_table_v6[mask_table_index] = ptr;
677 				mutex_exit(&ire_ft_init_lock);
678 			} else {
679 				/*
680 				 * Some other thread won the race in
681 				 * initializing the forwarding table at the
682 				 * same index.
683 				 */
684 				mutex_exit(&ire_ft_init_lock);
685 				for (i = 0; i < ip6_ftable_hash_size; i++) {
686 					rw_destroy(&ptr[i].irb_lock);
687 				}
688 				mi_free(ptr);
689 			}
690 		}
691 		irb_ptr = &(ip_forwarding_table_v6[mask_table_index][
692 		    IRE_ADDR_MASK_HASH_V6(ire->ire_addr_v6, ire->ire_mask_v6,
693 		    ip6_ftable_hash_size)]);
694 	} else {
695 		irb_ptr = &(ip_cache_table_v6[IRE_ADDR_HASH_V6(
696 		    ire->ire_addr_v6, ip6_cache_table_size)]);
697 	}
698 	/*
699 	 * For xresolv interfaces (v6 interfaces with an external
700 	 * address resolver), ip_newroute_v6/ip_newroute_ipif_v6
701 	 * are unable to prevent the deletion of the interface route
702 	 * while adding an IRE_CACHE for an on-link destination
703 	 * in the IRE_IF_RESOLVER case, since the ire has to go to
704 	 * the external resolver and return. We can't do a REFHOLD on the
705 	 * associated interface ire for fear of the message being freed
706 	 * if the external resolver can't resolve the address.
707 	 * Here we look up the interface ire in the forwarding table
708 	 * and make sure that the interface route has not been deleted.
709 	 */
710 	if (ire->ire_type == IRE_CACHE &&
711 	    IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6) &&
712 	    (((ill_t *)ire->ire_stq->q_ptr)->ill_net_type == IRE_IF_RESOLVER) &&
713 	    (((ill_t *)ire->ire_stq->q_ptr)->ill_flags & ILLF_XRESOLV)) {
714 
715 		pire = ire_ihandle_lookup_onlink_v6(ire);
716 		if (pire == NULL) {
717 			ire_delete(ire);
718 			*ire_p = NULL;
719 			return (EINVAL);
720 		}
721 		/* Prevent pire from getting deleted */
722 		IRB_REFHOLD(pire->ire_bucket);
723 		/* Has it been removed already? */
724 		if (pire->ire_marks & IRE_MARK_CONDEMNED) {
725 			IRB_REFRELE(pire->ire_bucket);
726 			ire_refrele(pire);
727 			ire_delete(ire);
728 			*ire_p = NULL;
729 			return (EINVAL);
730 		}
731 	}
732 
733 	flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW);
734 	/*
735 	 * For IRE_CACHES, MATCH_IRE_IPIF is not enough to check
736 	 * for duplicates because :
737 	 *
738 	 * 1) ire_ipif->ipif_ill and ire_stq->q_ptr could be
739 	 *    pointing at different ills. A real duplicate is
740 	 *    a match on both ire_ipif and ire_stq.
741 	 *
742 	 * 2) We could have multiple packets trying to create
743 	 *    an IRE_CACHE for the same ill.
744 	 *
745 	 * Moreover, IPIF_NOFAILOVER and IPV6_BOUND_PIF endpoints wants
746 	 * to go out on a particular ill. Rather than looking at the
747 	 * packet, we depend on the above for MATCH_IRE_ILL here.
748 	 *
749 	 * Unlike IPv4, MATCH_IRE_IPIF is needed here as we could have
750 	 * multiple IRE_CACHES for an ill for the same destination
751 	 * with various scoped addresses i.e represented by ipifs.
752 	 *
753 	 * MATCH_IRE_ILL is done implicitly below for IRE_CACHES.
754 	 */
755 	if (ire->ire_ipif != NULL)
756 		flags |= MATCH_IRE_IPIF;
757 	/*
758 	 * If we are creating hidden ires, make sure we search on
759 	 * this ill (MATCH_IRE_ILL) and a hidden ire, while we are
760 	 * searching for duplicates below. Otherwise we could
761 	 * potentially find an IRE on some other interface
762 	 * and it may not be a IRE marked with IRE_MARK_HIDDEN. We
763 	 * shouldn't do this as this will lead to an infinite loop as
764 	 * eventually we need an hidden ire for this packet to go
765 	 * out. MATCH_IRE_ILL is already marked above.
766 	 */
767 	if (ire->ire_marks & IRE_MARK_HIDDEN) {
768 		ASSERT(ire->ire_type == IRE_CACHE);
769 		flags |= MATCH_IRE_MARK_HIDDEN;
770 	}
771 
772 	/*
773 	 * Start the atomic add of the ire. Grab the ill locks,
774 	 * ill_g_usesrc_lock and the bucket lock. Check for condemned.
775 	 * To avoid lock order problems, get the ndp_g_lock now itself.
776 	 */
777 	if (ire->ire_type == IRE_CACHE) {
778 		mutex_enter(&ndp_g_lock);
779 		ndp_g_lock_held = B_TRUE;
780 	}
781 
782 	/*
783 	 * If ipif or ill is changing ire_atomic_start() may queue the
784 	 * request and return EINPROGRESS.
785 	 */
786 
787 	error = ire_atomic_start(irb_ptr, ire, q, mp, func);
788 	if (error != 0) {
789 		if (ndp_g_lock_held)
790 			mutex_exit(&ndp_g_lock);
791 		/*
792 		 * We don't know whether it is a valid ipif or not.
793 		 * So, set it to NULL. This assumes that the ire has not added
794 		 * a reference to the ipif.
795 		 */
796 		ire->ire_ipif = NULL;
797 		ire_delete(ire);
798 		if (pire != NULL) {
799 			IRB_REFRELE(pire->ire_bucket);
800 			ire_refrele(pire);
801 		}
802 		*ire_p = NULL;
803 		return (error);
804 	}
805 	/*
806 	 * To avoid creating ires having stale values for the ire_max_frag
807 	 * we get the latest value atomically here. For more details
808 	 * see the block comment in ip_sioctl_mtu and in DL_NOTE_SDU_CHANGE
809 	 * in ip_rput_dlpi_writer
810 	 */
811 	if (ire->ire_max_fragp == NULL) {
812 		if (IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6))
813 			ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
814 		else
815 			ire->ire_max_frag = pire->ire_max_frag;
816 	} else {
817 		uint_t  max_frag;
818 
819 		max_frag = *ire->ire_max_fragp;
820 		ire->ire_max_fragp = NULL;
821 		ire->ire_max_frag = max_frag;
822 	}
823 
824 	/*
825 	 * Atomically check for duplicate and insert in the table.
826 	 */
827 	for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
828 		if (ire1->ire_marks & IRE_MARK_CONDEMNED)
829 			continue;
830 
831 		if (ire->ire_type == IRE_CACHE) {
832 			/*
833 			 * We do MATCH_IRE_ILL implicitly here for IRE_CACHES.
834 			 * As ire_ipif and ire_stq could point to two
835 			 * different ills, we can't pass just ire_ipif to
836 			 * ire_match_args and get a match on both ills.
837 			 * This is just needed for duplicate checks here and
838 			 * so we don't add an extra argument to
839 			 * ire_match_args for this. Do it locally.
840 			 *
841 			 * NOTE : Currently there is no part of the code
842 			 * that asks for both MATH_IRE_IPIF and MATCH_IRE_ILL
843 			 * match for IRE_CACHEs. Thus we don't want to
844 			 * extend the arguments to ire_match_args_v6.
845 			 */
846 			if (ire1->ire_stq != ire->ire_stq)
847 				continue;
848 			/*
849 			 * Multiroute IRE_CACHEs for a given destination can
850 			 * have the same ire_ipif, typically if their source
851 			 * address is forced using RTF_SETSRC, and the same
852 			 * send-to queue. We differentiate them using the parent
853 			 * handle.
854 			 */
855 			if ((ire1->ire_flags & RTF_MULTIRT) &&
856 			    (ire->ire_flags & RTF_MULTIRT) &&
857 			    (ire1->ire_phandle != ire->ire_phandle))
858 				continue;
859 		}
860 		if (ire1->ire_zoneid != ire->ire_zoneid)
861 			continue;
862 		if (ire_match_args_v6(ire1, &ire->ire_addr_v6,
863 		    &ire->ire_mask_v6, &ire->ire_gateway_addr_v6,
864 		    ire->ire_type, ire->ire_ipif, ire->ire_zoneid, 0, NULL,
865 		    flags)) {
866 			/*
867 			 * Return the old ire after doing a REFHOLD.
868 			 * As most of the callers continue to use the IRE
869 			 * after adding, we return a held ire. This will
870 			 * avoid a lookup in the caller again. If the callers
871 			 * don't want to use it, they need to do a REFRELE.
872 			 */
873 			ip1dbg(("found dup ire existing %p new %p",
874 			    (void *)ire1, (void *)ire));
875 			IRE_REFHOLD(ire1);
876 			if (ndp_g_lock_held)
877 				mutex_exit(&ndp_g_lock);
878 			ire_atomic_end(irb_ptr, ire);
879 			ire_delete(ire);
880 			if (pire != NULL) {
881 				/*
882 				 * Assert that it is
883 				 * not yet removed from the list.
884 				 */
885 				ASSERT(pire->ire_ptpn != NULL);
886 				IRB_REFRELE(pire->ire_bucket);
887 				ire_refrele(pire);
888 			}
889 			*ire_p = ire1;
890 			return (0);
891 		}
892 	}
893 	if (ire->ire_type == IRE_CACHE) {
894 		in6_addr_t gw_addr_v6;
895 		ill_t	*ill = ire_to_ill(ire);
896 		char	buf[INET6_ADDRSTRLEN];
897 		nce_t	*nce;
898 
899 		/*
900 		 * All IRE_CACHE types must have a nce.  If this is
901 		 * not the case the entry will not be added. We need
902 		 * to make sure that if somebody deletes the nce
903 		 * after we looked up, they will find this ire and
904 		 * delete the ire. To delete this ire one needs the
905 		 * bucket lock which we are still holding here. So,
906 		 * even if the nce gets deleted after we looked up,
907 		 * this ire  will get deleted.
908 		 *
909 		 * NOTE : Don't need the ire_lock for accessing
910 		 * ire_gateway_addr_v6 as it is appearing first
911 		 * time on the list and rts_setgwr_v6 could not
912 		 * be changing this.
913 		 */
914 		gw_addr_v6 = ire->ire_gateway_addr_v6;
915 		if (IN6_IS_ADDR_UNSPECIFIED(&gw_addr_v6)) {
916 			nce = ndp_lookup(ill, &ire->ire_addr_v6, B_TRUE);
917 		} else {
918 			nce = ndp_lookup(ill, &gw_addr_v6, B_TRUE);
919 		}
920 		if (nce == NULL)
921 			goto failed;
922 
923 		/* Pair of refhold, refrele just to get the tracing right */
924 		NCE_REFHOLD_NOTR(nce);
925 		NCE_REFRELE(nce);
926 		/*
927 		 * Atomically make sure that new IREs don't point
928 		 * to an NCE that is logically deleted (CONDEMNED).
929 		 * ndp_delete() first marks the NCE CONDEMNED.
930 		 * This ensures that the nce_refcnt won't increase
931 		 * due to new nce_lookups or due to addition of new IREs
932 		 * pointing to this NCE. Then ndp_delete() cleans up
933 		 * existing references. If we don't do it atomically here,
934 		 * ndp_delete() -> nce_ire_delete() will not be able to
935 		 * clean up the IRE list completely, and the nce_refcnt
936 		 * won't go down to zero.
937 		 */
938 		mutex_enter(&nce->nce_lock);
939 		if (ill->ill_flags & ILLF_XRESOLV) {
940 			/*
941 			 * If we used an external resolver, we may not
942 			 * have gone through neighbor discovery to get here.
943 			 * Must update the nce_state before the next check.
944 			 */
945 			if (nce->nce_state == ND_INCOMPLETE)
946 				nce->nce_state = ND_REACHABLE;
947 		}
948 		if (nce->nce_state == ND_INCOMPLETE ||
949 		    (nce->nce_flags & NCE_F_CONDEMNED) ||
950 		    (nce->nce_state == ND_UNREACHABLE)) {
951 failed:
952 			if (ndp_g_lock_held)
953 				mutex_exit(&ndp_g_lock);
954 			if (nce != NULL)
955 				mutex_exit(&nce->nce_lock);
956 			ire_atomic_end(irb_ptr, ire);
957 			ip1dbg(("ire_add_v6: No nce for dst %s \n",
958 			    inet_ntop(AF_INET6, &ire->ire_addr_v6,
959 			    buf, sizeof (buf))));
960 			ire_delete(ire);
961 			if (pire != NULL) {
962 				/*
963 				 * Assert that it is
964 				 * not yet removed from the list.
965 				 */
966 				ASSERT(pire->ire_ptpn != NULL);
967 				IRB_REFRELE(pire->ire_bucket);
968 				ire_refrele(pire);
969 			}
970 			if (nce != NULL)
971 				NCE_REFRELE_NOTR(nce);
972 			*ire_p = NULL;
973 			return (EINVAL);
974 		} else {
975 			ire->ire_nce = nce;
976 		}
977 		mutex_exit(&nce->nce_lock);
978 	}
979 	/*
980 	 * Find the first entry that matches ire_addr - provides
981 	 * tail insertion. *irep will be null if no match.
982 	 */
983 	irep = (ire_t **)irb_ptr;
984 	while ((ire1 = *irep) != NULL &&
985 	    !IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, &ire1->ire_addr_v6))
986 		irep = &ire1->ire_next;
987 	ASSERT(!(ire->ire_type & IRE_BROADCAST));
988 
989 	if (*irep != NULL) {
990 		/*
991 		 * Find the last ire which matches ire_addr_v6.
992 		 * Needed to do tail insertion among entries with the same
993 		 * ire_addr_v6.
994 		 */
995 		while (IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6,
996 		    &ire1->ire_addr_v6)) {
997 			irep = &ire1->ire_next;
998 			ire1 = *irep;
999 			if (ire1 == NULL)
1000 				break;
1001 		}
1002 	}
1003 
1004 	if (ire->ire_type == IRE_DEFAULT) {
1005 		/*
1006 		 * We keep a count of default gateways which is used when
1007 		 * assigning them as routes.
1008 		 */
1009 		ipv6_ire_default_count++;
1010 		ASSERT(ipv6_ire_default_count != 0); /* Wraparound */
1011 	}
1012 	/* Insert at *irep */
1013 	ire1 = *irep;
1014 	if (ire1 != NULL)
1015 		ire1->ire_ptpn = &ire->ire_next;
1016 	ire->ire_next = ire1;
1017 	/* Link the new one in. */
1018 	ire->ire_ptpn = irep;
1019 	/*
1020 	 * ire_walk routines de-reference ire_next without holding
1021 	 * a lock. Before we point to the new ire, we want to make
1022 	 * sure the store that sets the ire_next of the new ire
1023 	 * reaches global visibility, so that ire_walk routines
1024 	 * don't see a truncated list of ires i.e if the ire_next
1025 	 * of the new ire gets set after we do "*irep = ire" due
1026 	 * to re-ordering, the ire_walk thread will see a NULL
1027 	 * once it accesses the ire_next of the new ire.
1028 	 * membar_producer() makes sure that the following store
1029 	 * happens *after* all of the above stores.
1030 	 */
1031 	membar_producer();
1032 	*irep = ire;
1033 	ire->ire_bucket = irb_ptr;
1034 	/*
1035 	 * We return a bumped up IRE above. Keep it symmetrical
1036 	 * so that the callers will always have to release. This
1037 	 * helps the callers of this function because they continue
1038 	 * to use the IRE after adding and hence they don't have to
1039 	 * lookup again after we return the IRE.
1040 	 *
1041 	 * NOTE : We don't have to use atomics as this is appearing
1042 	 * in the list for the first time and no one else can bump
1043 	 * up the reference count on this yet.
1044 	 */
1045 	IRE_REFHOLD_LOCKED(ire);
1046 	BUMP_IRE_STATS(ire_stats_v6, ire_stats_inserted);
1047 	irb_ptr->irb_ire_cnt++;
1048 	if (ire->ire_marks & IRE_MARK_TEMPORARY)
1049 		irb_ptr->irb_tmp_ire_cnt++;
1050 
1051 	if (ire->ire_ipif != NULL) {
1052 		ire->ire_ipif->ipif_ire_cnt++;
1053 		if (ire->ire_stq != NULL) {
1054 			stq_ill = (ill_t *)ire->ire_stq->q_ptr;
1055 			stq_ill->ill_ire_cnt++;
1056 		}
1057 	} else {
1058 		ASSERT(ire->ire_stq == NULL);
1059 	}
1060 
1061 	if (ndp_g_lock_held)
1062 		mutex_exit(&ndp_g_lock);
1063 	ire_atomic_end(irb_ptr, ire);
1064 
1065 	if (pire != NULL) {
1066 		/* Assert that it is not removed from the list yet */
1067 		ASSERT(pire->ire_ptpn != NULL);
1068 		IRB_REFRELE(pire->ire_bucket);
1069 		ire_refrele(pire);
1070 	}
1071 
1072 	if (ire->ire_type != IRE_CACHE) {
1073 		/*
1074 		 * For ire's with with host mask see if there is an entry
1075 		 * in the cache. If there is one flush the whole cache as
1076 		 * there might be multiple entries due to RTF_MULTIRT (CGTP).
1077 		 * If no entry is found than there is no need to flush the
1078 		 * cache.
1079 		 */
1080 
1081 		if (ip_mask_to_plen_v6(&ire->ire_mask_v6) == IPV6_ABITS) {
1082 			ire_t *lire;
1083 			lire = ire_ctable_lookup_v6(&ire->ire_addr_v6, NULL,
1084 			    IRE_CACHE, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
1085 			if (lire != NULL) {
1086 				ire_refrele(lire);
1087 				ire_flush_cache_v6(ire, IRE_FLUSH_ADD);
1088 			}
1089 		} else {
1090 			ire_flush_cache_v6(ire, IRE_FLUSH_ADD);
1091 		}
1092 	}
1093 
1094 	*ire_p = ire;
1095 	return (0);
1096 }
1097 
1098 /*
1099  * Search for all HOST REDIRECT routes that are
1100  * pointing at the specified gateway and
1101  * delete them. This routine is called only
1102  * when a default gateway is going away.
1103  */
1104 static void
1105 ire_delete_host_redirects_v6(const in6_addr_t *gateway)
1106 {
1107 	irb_t *irb_ptr;
1108 	irb_t *irb;
1109 	ire_t *ire;
1110 	in6_addr_t gw_addr_v6;
1111 	int i;
1112 
1113 	/* get the hash table for HOST routes */
1114 	irb_ptr = ip_forwarding_table_v6[(IP6_MASK_TABLE_SIZE - 1)];
1115 	if (irb_ptr == NULL)
1116 		return;
1117 	for (i = 0; (i < ip6_ftable_hash_size); i++) {
1118 		irb = &irb_ptr[i];
1119 		IRB_REFHOLD(irb);
1120 		for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
1121 			if (ire->ire_type != IRE_HOST_REDIRECT)
1122 				continue;
1123 			mutex_enter(&ire->ire_lock);
1124 			gw_addr_v6 = ire->ire_gateway_addr_v6;
1125 			mutex_exit(&ire->ire_lock);
1126 			if (IN6_ARE_ADDR_EQUAL(&gw_addr_v6, gateway))
1127 				ire_delete(ire);
1128 		}
1129 		IRB_REFRELE(irb);
1130 	}
1131 }
1132 
1133 /*
1134  * Delete all the cache entries with this 'addr'. This is the IPv6 counterpart
1135  * of ip_ire_clookup_and_delete. The difference being this function does not
1136  * return any value. IPv6 processing of a gratuitous ARP, as it stands, is
1137  * different than IPv4 in that, regardless of the presence of a cache entry
1138  * for this address, an ire_walk_v6 is done. Another difference is that unlike
1139  * in the case of IPv4 this does not take an ipif_t argument, since it is only
1140  * called by ip_arp_news and the match is always only on the address.
1141  */
1142 void
1143 ip_ire_clookup_and_delete_v6(const in6_addr_t *addr)
1144 {
1145 	irb_t		*irb;
1146 	ire_t		*cire;
1147 	boolean_t	found = B_FALSE;
1148 
1149 	irb = &ip_cache_table_v6[IRE_ADDR_HASH_V6(*addr, ip6_cache_table_size)];
1150 	IRB_REFHOLD(irb);
1151 	for (cire = irb->irb_ire; cire != NULL; cire = cire->ire_next) {
1152 		if (cire->ire_marks == IRE_MARK_CONDEMNED)
1153 			continue;
1154 		if (IN6_ARE_ADDR_EQUAL(&cire->ire_addr_v6, addr)) {
1155 
1156 			/* This signifies start of a match */
1157 			if (!found)
1158 				found = B_TRUE;
1159 			if (cire->ire_type == IRE_CACHE) {
1160 				if (cire->ire_nce != NULL)
1161 					ndp_delete(cire->ire_nce);
1162 				ire_delete_v6(cire);
1163 			}
1164 		/* End of the match */
1165 		} else if (found)
1166 			break;
1167 	}
1168 	IRB_REFRELE(irb);
1169 }
1170 
1171 /*
1172  * Delete the specified IRE.
1173  * All calls should use ire_delete().
1174  * Sometimes called as writer though not required by this function.
1175  *
1176  * NOTE : This function is called only if the ire was added
1177  * in the list.
1178  */
1179 void
1180 ire_delete_v6(ire_t *ire)
1181 {
1182 	in6_addr_t gw_addr_v6;
1183 
1184 	ASSERT(ire->ire_refcnt >= 1);
1185 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
1186 
1187 	if (ire->ire_type != IRE_CACHE)
1188 		ire_flush_cache_v6(ire, IRE_FLUSH_DELETE);
1189 	if (ire->ire_type == IRE_DEFAULT) {
1190 		/*
1191 		 * when a default gateway is going away
1192 		 * delete all the host redirects pointing at that
1193 		 * gateway.
1194 		 */
1195 		mutex_enter(&ire->ire_lock);
1196 		gw_addr_v6 = ire->ire_gateway_addr_v6;
1197 		mutex_exit(&ire->ire_lock);
1198 		ire_delete_host_redirects_v6(&gw_addr_v6);
1199 	}
1200 }
1201 
1202 /*
1203  * ire_walk routine to delete all IRE_CACHE and IRE_HOST_REDIRECT
1204  * entries.
1205  */
1206 /*ARGSUSED1*/
1207 void
1208 ire_delete_cache_v6(ire_t *ire, char *arg)
1209 {
1210 	char    addrstr1[INET6_ADDRSTRLEN];
1211 	char    addrstr2[INET6_ADDRSTRLEN];
1212 
1213 	if (ire->ire_type & (IRE_CACHE | IRE_HOST_REDIRECT)) {
1214 		ip1dbg(("ire_delete_cache_v6: deleted %s type %d through %s\n",
1215 		    inet_ntop(AF_INET6, &ire->ire_addr_v6,
1216 			addrstr1, sizeof (addrstr1)),
1217 		    ire->ire_type,
1218 		    inet_ntop(AF_INET6, &ire->ire_gateway_addr_v6,
1219 			addrstr2, sizeof (addrstr2))));
1220 		ire_delete(ire);
1221 	}
1222 
1223 }
1224 
1225 /*
1226  * ire_walk routine to delete all IRE_CACHE/IRE_HOST_REDIRECT entries
1227  * that have a given gateway address.
1228  */
1229 void
1230 ire_delete_cache_gw_v6(ire_t *ire, char *addr)
1231 {
1232 	in6_addr_t	*gw_addr = (in6_addr_t *)addr;
1233 	char		buf1[INET6_ADDRSTRLEN];
1234 	char		buf2[INET6_ADDRSTRLEN];
1235 	in6_addr_t	ire_gw_addr_v6;
1236 
1237 	if (!(ire->ire_type & (IRE_CACHE|IRE_HOST_REDIRECT)))
1238 		return;
1239 
1240 	mutex_enter(&ire->ire_lock);
1241 	ire_gw_addr_v6 = ire->ire_gateway_addr_v6;
1242 	mutex_exit(&ire->ire_lock);
1243 
1244 	if (IN6_ARE_ADDR_EQUAL(&ire_gw_addr_v6, gw_addr)) {
1245 		ip1dbg(("ire_delete_cache_gw_v6: deleted %s type %d to %s\n",
1246 		    inet_ntop(AF_INET6, &ire->ire_src_addr_v6,
1247 		    buf1, sizeof (buf1)),
1248 		    ire->ire_type,
1249 		    inet_ntop(AF_INET6, &ire_gw_addr_v6,
1250 		    buf2, sizeof (buf2))));
1251 		ire_delete(ire);
1252 	}
1253 }
1254 
1255 /*
1256  * Remove all IRE_CACHE entries that match
1257  * the ire specified.  (Sometimes called
1258  * as writer though not required by this function.)
1259  *
1260  * The flag argument indicates if the
1261  * flush request is due to addition
1262  * of new route (IRE_FLUSH_ADD) or deletion of old
1263  * route (IRE_FLUSH_DELETE).
1264  *
1265  * This routine takes only the IREs from the forwarding
1266  * table and flushes the corresponding entries from
1267  * the cache table.
1268  *
1269  * When flushing due to the deletion of an old route, it
1270  * just checks the cache handles (ire_phandle and ire_ihandle) and
1271  * deletes the ones that match.
1272  *
1273  * When flushing due to the creation of a new route, it checks
1274  * if a cache entry's address matches the one in the IRE and
1275  * that the cache entry's parent has a less specific mask than the
1276  * one in IRE. The destination of such a cache entry could be the
1277  * gateway for other cache entries, so we need to flush those as
1278  * well by looking for gateway addresses matching the IRE's address.
1279  */
1280 void
1281 ire_flush_cache_v6(ire_t *ire, int flag)
1282 {
1283 	int i;
1284 	ire_t *cire;
1285 	irb_t *irb;
1286 
1287 	if (ire->ire_type & IRE_CACHE)
1288 	    return;
1289 
1290 	/*
1291 	 * If a default is just created, there is no point
1292 	 * in going through the cache, as there will not be any
1293 	 * cached ires.
1294 	 */
1295 	if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD)
1296 		return;
1297 	if (flag == IRE_FLUSH_ADD) {
1298 		/*
1299 		 * This selective flush is
1300 		 * due to the addition of
1301 		 * new IRE.
1302 		 */
1303 		for (i = 0; i < ip6_cache_table_size; i++) {
1304 			irb = &ip_cache_table_v6[i];
1305 			if ((cire = irb->irb_ire) == NULL)
1306 				continue;
1307 			IRB_REFHOLD(irb);
1308 			for (cire = irb->irb_ire; cire != NULL;
1309 			    cire = cire->ire_next) {
1310 				if (cire->ire_type != IRE_CACHE)
1311 					continue;
1312 				/*
1313 				 * If 'cire' belongs to the same subnet
1314 				 * as the new ire being added, and 'cire'
1315 				 * is derived from a prefix that is less
1316 				 * specific than the new ire being added,
1317 				 * we need to flush 'cire'; for instance,
1318 				 * when a new interface comes up.
1319 				 */
1320 				if ((V6_MASK_EQ_2(cire->ire_addr_v6,
1321 				    ire->ire_mask_v6, ire->ire_addr_v6) &&
1322 				    (ip_mask_to_plen_v6(&cire->ire_cmask_v6) <=
1323 				    ire->ire_masklen))) {
1324 					ire_delete(cire);
1325 					continue;
1326 				}
1327 				/*
1328 				 * This is the case when the ire_gateway_addr
1329 				 * of 'cire' belongs to the same subnet as
1330 				 * the new ire being added.
1331 				 * Flushing such ires is sometimes required to
1332 				 * avoid misrouting: say we have a machine with
1333 				 * two interfaces (I1 and I2), a default router
1334 				 * R on the I1 subnet, and a host route to an
1335 				 * off-link destination D with a gateway G on
1336 				 * the I2 subnet.
1337 				 * Under normal operation, we will have an
1338 				 * on-link cache entry for G and an off-link
1339 				 * cache entry for D with G as ire_gateway_addr,
1340 				 * traffic to D will reach its destination
1341 				 * through gateway G.
1342 				 * If the administrator does 'ifconfig I2 down',
1343 				 * the cache entries for D and G will be
1344 				 * flushed. However, G will now be resolved as
1345 				 * an off-link destination using R (the default
1346 				 * router) as gateway. Then D will also be
1347 				 * resolved as an off-link destination using G
1348 				 * as gateway - this behavior is due to
1349 				 * compatibility reasons, see comment in
1350 				 * ire_ihandle_lookup_offlink(). Traffic to D
1351 				 * will go to the router R and probably won't
1352 				 * reach the destination.
1353 				 * The administrator then does 'ifconfig I2 up'.
1354 				 * Since G is on the I2 subnet, this routine
1355 				 * will flush its cache entry. It must also
1356 				 * flush the cache entry for D, otherwise
1357 				 * traffic will stay misrouted until the IRE
1358 				 * times out.
1359 				 */
1360 				if (V6_MASK_EQ_2(cire->ire_gateway_addr_v6,
1361 				    ire->ire_mask_v6, ire->ire_addr_v6)) {
1362 					ire_delete(cire);
1363 					continue;
1364 				}
1365 			}
1366 			IRB_REFRELE(irb);
1367 		}
1368 	} else {
1369 		/*
1370 		 * delete the cache entries based on
1371 		 * handle in the IRE as this IRE is
1372 		 * being deleted/changed.
1373 		 */
1374 		for (i = 0; i < ip6_cache_table_size; i++) {
1375 			irb = &ip_cache_table_v6[i];
1376 			if ((cire = irb->irb_ire) == NULL)
1377 				continue;
1378 			IRB_REFHOLD(irb);
1379 			for (cire = irb->irb_ire; cire != NULL;
1380 			    cire = cire->ire_next) {
1381 				if (cire->ire_type != IRE_CACHE)
1382 					continue;
1383 				if ((cire->ire_phandle == 0 ||
1384 				    cire->ire_phandle != ire->ire_phandle) &&
1385 				    (cire->ire_ihandle == 0 ||
1386 				    cire->ire_ihandle != ire->ire_ihandle))
1387 					continue;
1388 				ire_delete(cire);
1389 			}
1390 			IRB_REFRELE(irb);
1391 		}
1392 	}
1393 }
1394 
1395 /*
1396  * Matches the arguments passed with the values in the ire.
1397  *
1398  * Note: for match types that match using "ipif" passed in, ipif
1399  * must be checked for non-NULL before calling this routine.
1400  */
1401 static boolean_t
1402 ire_match_args_v6(ire_t *ire, const in6_addr_t *addr, const in6_addr_t *mask,
1403     const in6_addr_t *gateway, int type, const ipif_t *ipif, zoneid_t zoneid,
1404     uint32_t ihandle, const ts_label_t *tsl, int match_flags)
1405 {
1406 	in6_addr_t masked_addr;
1407 	in6_addr_t gw_addr_v6;
1408 	ill_t *ire_ill = NULL, *dst_ill;
1409 	ill_t *ipif_ill = NULL;
1410 	ill_group_t *ire_ill_group = NULL;
1411 	ill_group_t *ipif_ill_group = NULL;
1412 	ipif_t	*src_ipif;
1413 
1414 	ASSERT(ire->ire_ipversion == IPV6_VERSION);
1415 	ASSERT(addr != NULL);
1416 	ASSERT(mask != NULL);
1417 	ASSERT((!(match_flags & MATCH_IRE_GW)) || gateway != NULL);
1418 	ASSERT((!(match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP))) ||
1419 	    (ipif != NULL && ipif->ipif_isv6));
1420 	ASSERT(!(match_flags & MATCH_IRE_WQ));
1421 
1422 	/*
1423 	 * HIDDEN cache entries have to be looked up specifically with
1424 	 * MATCH_IRE_MARK_HIDDEN. MATCH_IRE_MARK_HIDDEN is usually set
1425 	 * when the interface is FAILED or INACTIVE. In that case,
1426 	 * any IRE_CACHES that exists should be marked with
1427 	 * IRE_MARK_HIDDEN. So, we don't really need to match below
1428 	 * for IRE_MARK_HIDDEN. But we do so for consistency.
1429 	 */
1430 	if (!(match_flags & MATCH_IRE_MARK_HIDDEN) &&
1431 	    (ire->ire_marks & IRE_MARK_HIDDEN))
1432 		return (B_FALSE);
1433 
1434 	if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid &&
1435 	    ire->ire_zoneid != ALL_ZONES) {
1436 		/*
1437 		 * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid is
1438 		 * valid and does not match that of ire_zoneid, a failure to
1439 		 * match is reported at this point. Otherwise, since some IREs
1440 		 * that are available in the global zone can be used in local
1441 		 * zones, additional checks need to be performed:
1442 		 *
1443 		 *	IRE_CACHE and IRE_LOOPBACK entries should
1444 		 *	never be matched in this situation.
1445 		 *
1446 		 *	IRE entries that have an interface associated with them
1447 		 *	should in general not match unless they are an IRE_LOCAL
1448 		 *	or in the case when MATCH_IRE_DEFAULT has been set in
1449 		 *	the caller.  In the case of the former, checking of the
1450 		 *	other fields supplied should take place.
1451 		 *
1452 		 *	In the case where MATCH_IRE_DEFAULT has been set,
1453 		 *	all of the ipif's associated with the IRE's ill are
1454 		 *	checked to see if there is a matching zoneid.  If any
1455 		 *	one ipif has a matching zoneid, this IRE is a
1456 		 *	potential candidate so checking of the other fields
1457 		 *	takes place.
1458 		 *
1459 		 *	In the case where the IRE_INTERFACE has a usable source
1460 		 *	address (indicated by ill_usesrc_ifindex) in the
1461 		 *	correct zone then it's permitted to return this IRE
1462 		 */
1463 		if (match_flags & MATCH_IRE_ZONEONLY)
1464 			return (B_FALSE);
1465 		if (ire->ire_type & (IRE_CACHE | IRE_LOOPBACK))
1466 			return (B_FALSE);
1467 		/*
1468 		 * Note, IRE_INTERFACE can have the stq as NULL. For
1469 		 * example, if the default multicast route is tied to
1470 		 * the loopback address.
1471 		 */
1472 		if ((ire->ire_type & IRE_INTERFACE) &&
1473 		    (ire->ire_stq != NULL)) {
1474 			dst_ill = (ill_t *)ire->ire_stq->q_ptr;
1475 			/*
1476 			 * If there is a usable source address in the
1477 			 * zone, then it's ok to return an
1478 			 * IRE_INTERFACE
1479 			 */
1480 			if ((dst_ill->ill_usesrc_ifindex != 0) &&
1481 			    (src_ipif = ipif_select_source_v6(dst_ill, addr,
1482 			    B_FALSE, IPV6_PREFER_SRC_DEFAULT, zoneid))
1483 			    != NULL) {
1484 				ip3dbg(("ire_match_args: src_ipif %p"
1485 				    " dst_ill %p", (void *)src_ipif,
1486 				    (void *)dst_ill));
1487 				ipif_refrele(src_ipif);
1488 			} else {
1489 				ip3dbg(("ire_match_args: src_ipif NULL"
1490 				    " dst_ill %p\n", (void *)dst_ill));
1491 				return (B_FALSE);
1492 			}
1493 		}
1494 		if (ire->ire_ipif != NULL && ire->ire_type != IRE_LOCAL &&
1495 		    !(ire->ire_type & IRE_INTERFACE)) {
1496 			ipif_t	*tipif;
1497 
1498 			if ((match_flags & MATCH_IRE_DEFAULT) == 0)
1499 				return (B_FALSE);
1500 			mutex_enter(&ire->ire_ipif->ipif_ill->ill_lock);
1501 			for (tipif = ire->ire_ipif->ipif_ill->ill_ipif;
1502 			    tipif != NULL; tipif = tipif->ipif_next) {
1503 				if (IPIF_CAN_LOOKUP(tipif) &&
1504 				    (tipif->ipif_flags & IPIF_UP) &&
1505 				    (tipif->ipif_zoneid == zoneid ||
1506 				    tipif->ipif_zoneid == ALL_ZONES))
1507 					break;
1508 			}
1509 			mutex_exit(&ire->ire_ipif->ipif_ill->ill_lock);
1510 			if (tipif == NULL)
1511 				return (B_FALSE);
1512 		}
1513 	}
1514 
1515 	if (match_flags & MATCH_IRE_GW) {
1516 		mutex_enter(&ire->ire_lock);
1517 		gw_addr_v6 = ire->ire_gateway_addr_v6;
1518 		mutex_exit(&ire->ire_lock);
1519 	}
1520 	/*
1521 	 * For IRE_CACHES, MATCH_IRE_ILL/ILL_GROUP really means that
1522 	 * somebody wants to send out on a particular interface which
1523 	 * is given by ire_stq and hence use ire_stq to derive the ill
1524 	 * value. ire_ipif for IRE_CACHES is just the
1525 	 * means of getting a source address i.e ire_src_addr_v6 =
1526 	 * ire->ire_ipif->ipif_src_addr_v6.
1527 	 */
1528 	if (match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) {
1529 		ire_ill = ire_to_ill(ire);
1530 		if (ire_ill != NULL)
1531 			ire_ill_group = ire_ill->ill_group;
1532 		ipif_ill = ipif->ipif_ill;
1533 		ipif_ill_group = ipif_ill->ill_group;
1534 	}
1535 
1536 	/* No ire_addr_v6 bits set past the mask */
1537 	ASSERT(V6_MASK_EQ(ire->ire_addr_v6, ire->ire_mask_v6,
1538 	    ire->ire_addr_v6));
1539 	V6_MASK_COPY(*addr, *mask, masked_addr);
1540 
1541 	if (V6_MASK_EQ(*addr, *mask, ire->ire_addr_v6) &&
1542 	    ((!(match_flags & MATCH_IRE_GW)) ||
1543 		IN6_ARE_ADDR_EQUAL(&gw_addr_v6, gateway)) &&
1544 	    ((!(match_flags & MATCH_IRE_TYPE)) ||
1545 		(ire->ire_type & type)) &&
1546 	    ((!(match_flags & MATCH_IRE_SRC)) ||
1547 		IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
1548 		&ipif->ipif_v6src_addr)) &&
1549 	    ((!(match_flags & MATCH_IRE_IPIF)) ||
1550 		(ire->ire_ipif == ipif)) &&
1551 	    ((!(match_flags & MATCH_IRE_MARK_HIDDEN)) ||
1552 		(ire->ire_type != IRE_CACHE ||
1553 		ire->ire_marks & IRE_MARK_HIDDEN)) &&
1554 	    ((!(match_flags & MATCH_IRE_ILL)) ||
1555 		(ire_ill == ipif_ill)) &&
1556 	    ((!(match_flags & MATCH_IRE_IHANDLE)) ||
1557 		(ire->ire_ihandle == ihandle)) &&
1558 	    ((!(match_flags & MATCH_IRE_ILL_GROUP)) ||
1559 		(ire_ill == ipif_ill) ||
1560 		(ire_ill_group != NULL &&
1561 		ire_ill_group == ipif_ill_group)) &&
1562 	    ((!(match_flags & MATCH_IRE_SECATTR)) ||
1563 		(!is_system_labeled()) ||
1564 		(tsol_ire_match_gwattr(ire, tsl) == 0))) {
1565 		/* We found the matched IRE */
1566 		return (B_TRUE);
1567 	}
1568 	return (B_FALSE);
1569 }
1570 
1571 /*
1572  * Lookup for a route in all the tables
1573  */
1574 ire_t *
1575 ire_route_lookup_v6(const in6_addr_t *addr, const in6_addr_t *mask,
1576     const in6_addr_t *gateway, int type, const ipif_t *ipif, ire_t **pire,
1577     zoneid_t zoneid, const ts_label_t *tsl, int flags)
1578 {
1579 	ire_t *ire = NULL;
1580 
1581 	/*
1582 	 * ire_match_args_v6() will dereference ipif MATCH_IRE_SRC or
1583 	 * MATCH_IRE_ILL is set.
1584 	 */
1585 	if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) &&
1586 	    (ipif == NULL))
1587 		return (NULL);
1588 
1589 	/*
1590 	 * might be asking for a cache lookup,
1591 	 * This is not best way to lookup cache,
1592 	 * user should call ire_cache_lookup directly.
1593 	 *
1594 	 * If MATCH_IRE_TYPE was set, first lookup in the cache table and then
1595 	 * in the forwarding table, if the applicable type flags were set.
1596 	 */
1597 	if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_CACHETABLE) != 0) {
1598 		ire = ire_ctable_lookup_v6(addr, gateway, type, ipif, zoneid,
1599 		    tsl, flags);
1600 		if (ire != NULL)
1601 			return (ire);
1602 	}
1603 	if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_FORWARDTABLE) != 0) {
1604 		ire = ire_ftable_lookup_v6(addr, mask, gateway, type, ipif,
1605 		    pire, zoneid, 0, tsl, flags);
1606 	}
1607 	return (ire);
1608 }
1609 
1610 /*
1611  * Lookup a route in forwarding table.
1612  * specific lookup is indicated by passing the
1613  * required parameters and indicating the
1614  * match required in flag field.
1615  *
1616  * Looking for default route can be done in three ways
1617  * 1) pass mask as ipv6_all_zeros and set MATCH_IRE_MASK in flags field
1618  *    along with other matches.
1619  * 2) pass type as IRE_DEFAULT and set MATCH_IRE_TYPE in flags
1620  *    field along with other matches.
1621  * 3) if the destination and mask are passed as zeros.
1622  *
1623  * A request to return a default route if no route
1624  * is found, can be specified by setting MATCH_IRE_DEFAULT
1625  * in flags.
1626  *
1627  * It does not support recursion more than one level. It
1628  * will do recursive lookup only when the lookup maps to
1629  * a prefix or default route and MATCH_IRE_RECURSIVE flag is passed.
1630  *
1631  * If the routing table is setup to allow more than one level
1632  * of recursion, the cleaning up cache table will not work resulting
1633  * in invalid routing.
1634  *
1635  * Supports link-local addresses by following the ipif/ill when recursing.
1636  *
1637  * NOTE : When this function returns NULL, pire has already been released.
1638  *	  pire is valid only when this function successfully returns an
1639  *	  ire.
1640  */
1641 ire_t *
1642 ire_ftable_lookup_v6(const in6_addr_t *addr, const in6_addr_t *mask,
1643     const in6_addr_t *gateway, int type, const ipif_t *ipif, ire_t **pire,
1644     zoneid_t zoneid, uint32_t ihandle, const ts_label_t *tsl, int flags)
1645 {
1646 	irb_t *irb_ptr;
1647 	ire_t	*rire;
1648 	ire_t *ire = NULL;
1649 	ire_t	*saved_ire;
1650 	nce_t	*nce;
1651 	int i;
1652 	in6_addr_t gw_addr_v6;
1653 
1654 	ASSERT(addr != NULL);
1655 	ASSERT((!(flags & MATCH_IRE_MASK)) || mask != NULL);
1656 	ASSERT((!(flags & MATCH_IRE_GW)) || gateway != NULL);
1657 	ASSERT(ipif == NULL || ipif->ipif_isv6);
1658 	ASSERT(!(flags & MATCH_IRE_WQ));
1659 
1660 	/*
1661 	 * When we return NULL from this function, we should make
1662 	 * sure that *pire is NULL so that the callers will not
1663 	 * wrongly REFRELE the pire.
1664 	 */
1665 	if (pire != NULL)
1666 		*pire = NULL;
1667 	/*
1668 	 * ire_match_args_v6() will dereference ipif MATCH_IRE_SRC or
1669 	 * MATCH_IRE_ILL is set.
1670 	 */
1671 	if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) &&
1672 	    (ipif == NULL))
1673 		return (NULL);
1674 
1675 	/*
1676 	 * If the mask is known, the lookup
1677 	 * is simple, if the mask is not known
1678 	 * we need to search.
1679 	 */
1680 	if (flags & MATCH_IRE_MASK) {
1681 		uint_t masklen;
1682 
1683 		masklen = ip_mask_to_plen_v6(mask);
1684 		if (ip_forwarding_table_v6[masklen] == NULL)
1685 			return (NULL);
1686 		irb_ptr = &(ip_forwarding_table_v6[masklen][
1687 		    IRE_ADDR_MASK_HASH_V6(*addr, *mask, ip6_ftable_hash_size)]);
1688 		rw_enter(&irb_ptr->irb_lock, RW_READER);
1689 		for (ire = irb_ptr->irb_ire; ire != NULL;
1690 		    ire = ire->ire_next) {
1691 			if (ire->ire_marks & IRE_MARK_CONDEMNED)
1692 				continue;
1693 			if (ire_match_args_v6(ire, addr, mask, gateway, type,
1694 			    ipif, zoneid, ihandle, tsl, flags))
1695 				goto found_ire;
1696 		}
1697 		rw_exit(&irb_ptr->irb_lock);
1698 	} else {
1699 		/*
1700 		 * In this case we don't know the mask, we need to
1701 		 * search the table assuming different mask sizes.
1702 		 * we start with 128 bit mask, we don't allow default here.
1703 		 */
1704 		for (i = (IP6_MASK_TABLE_SIZE - 1); i > 0; i--) {
1705 			in6_addr_t tmpmask;
1706 
1707 			if ((ip_forwarding_table_v6[i]) == NULL)
1708 				continue;
1709 			(void) ip_plen_to_mask_v6(i, &tmpmask);
1710 			irb_ptr = &ip_forwarding_table_v6[i][
1711 			    IRE_ADDR_MASK_HASH_V6(*addr, tmpmask,
1712 			    ip6_ftable_hash_size)];
1713 			rw_enter(&irb_ptr->irb_lock, RW_READER);
1714 			for (ire = irb_ptr->irb_ire; ire != NULL;
1715 			    ire = ire->ire_next) {
1716 				if (ire->ire_marks & IRE_MARK_CONDEMNED)
1717 					continue;
1718 				if (ire_match_args_v6(ire, addr,
1719 				    &ire->ire_mask_v6, gateway, type, ipif,
1720 				    zoneid, ihandle, tsl, flags))
1721 					goto found_ire;
1722 			}
1723 			rw_exit(&irb_ptr->irb_lock);
1724 		}
1725 	}
1726 
1727 	/*
1728 	 * We come here if no route has yet been found.
1729 	 *
1730 	 * Handle the case where default route is
1731 	 * requested by specifying type as one of the possible
1732 	 * types for that can have a zero mask (IRE_DEFAULT and IRE_INTERFACE).
1733 	 *
1734 	 * If MATCH_IRE_MASK is specified, then the appropriate default route
1735 	 * would have been found above if it exists so it isn't looked up here.
1736 	 * If MATCH_IRE_DEFAULT was also specified, then a default route will be
1737 	 * searched for later.
1738 	 */
1739 	if ((flags & (MATCH_IRE_TYPE | MATCH_IRE_MASK)) == MATCH_IRE_TYPE &&
1740 	    (type & (IRE_DEFAULT | IRE_INTERFACE))) {
1741 		if (ip_forwarding_table_v6[0] != NULL) {
1742 			/* addr & mask is zero for defaults */
1743 			irb_ptr = &ip_forwarding_table_v6[0][
1744 			    IRE_ADDR_HASH_V6(ipv6_all_zeros,
1745 			    ip6_ftable_hash_size)];
1746 			rw_enter(&irb_ptr->irb_lock, RW_READER);
1747 			for (ire = irb_ptr->irb_ire; ire != NULL;
1748 			    ire = ire->ire_next) {
1749 
1750 				if (ire->ire_marks & IRE_MARK_CONDEMNED)
1751 					continue;
1752 
1753 				if (ire_match_args_v6(ire, addr,
1754 				    &ipv6_all_zeros, gateway, type, ipif,
1755 				    zoneid, ihandle, tsl, flags))
1756 					goto found_ire;
1757 			}
1758 			rw_exit(&irb_ptr->irb_lock);
1759 		}
1760 	}
1761 	/*
1762 	 * We come here only if no route is found.
1763 	 * see if the default route can be used which is allowed
1764 	 * only if the default matching criteria is specified.
1765 	 * The ipv6_ire_default_count tracks the number of IRE_DEFAULT
1766 	 * entries. However, the ip_forwarding_table_v6[0] also contains
1767 	 * interface routes thus the count can be zero.
1768 	 */
1769 	saved_ire = NULL;
1770 	if ((flags & (MATCH_IRE_DEFAULT | MATCH_IRE_MASK)) ==
1771 	    MATCH_IRE_DEFAULT) {
1772 		ire_t	*ire_origin;
1773 		uint_t	g_index;
1774 		uint_t	index;
1775 
1776 		if (ip_forwarding_table_v6[0] == NULL)
1777 			return (NULL);
1778 		irb_ptr = &(ip_forwarding_table_v6[0])[0];
1779 
1780 		/*
1781 		 * Keep a tab on the bucket while looking the IRE_DEFAULT
1782 		 * entries. We need to keep track of a particular IRE
1783 		 * (ire_origin) so this ensures that it will not be unlinked
1784 		 * from the hash list during the recursive lookup below.
1785 		 */
1786 		IRB_REFHOLD(irb_ptr);
1787 		ire = irb_ptr->irb_ire;
1788 		if (ire == NULL) {
1789 			IRB_REFRELE(irb_ptr);
1790 			return (NULL);
1791 		}
1792 
1793 		/*
1794 		 * Get the index first, since it can be changed by other
1795 		 * threads. Then get to the right default route skipping
1796 		 * default interface routes if any. As we hold a reference on
1797 		 * the IRE bucket, ipv6_ire_default_count can only increase so
1798 		 * we can't reach the end of the hash list unexpectedly.
1799 		 */
1800 		if (ipv6_ire_default_count != 0) {
1801 			g_index = ipv6_ire_default_index++;
1802 			index = g_index % ipv6_ire_default_count;
1803 			while (index != 0) {
1804 				if (!(ire->ire_type & IRE_INTERFACE))
1805 					index--;
1806 				ire = ire->ire_next;
1807 			}
1808 			ASSERT(ire != NULL);
1809 		} else {
1810 			/*
1811 			 * No default route, so we only have default interface
1812 			 * routes: don't enter the first loop.
1813 			 */
1814 			ire = NULL;
1815 		}
1816 
1817 		/*
1818 		 * Round-robin the default routers list looking for a neighbor
1819 		 * that matches the passed in parameters and is reachable.  If
1820 		 * none found, just return a route from the default router list
1821 		 * if it exists. If we can't find a default route (IRE_DEFAULT),
1822 		 * look for interface default routes.
1823 		 * We start with the ire we found above and we walk the hash
1824 		 * list until we're back where we started, see
1825 		 * ire_get_next_default_ire(). It doesn't matter if default
1826 		 * routes are added or deleted by other threads - we know this
1827 		 * ire will stay in the list because we hold a reference on the
1828 		 * ire bucket.
1829 		 * NB: if we only have interface default routes, ire is NULL so
1830 		 * we don't even enter this loop (see above).
1831 		 */
1832 		ire_origin = ire;
1833 		for (; ire != NULL;
1834 		    ire = ire_get_next_default_ire(ire, ire_origin)) {
1835 
1836 			if (ire_match_args_v6(ire, addr,
1837 			    &ipv6_all_zeros, gateway, type, ipif,
1838 			    zoneid, ihandle, tsl, flags)) {
1839 				int match_flags;
1840 
1841 				/*
1842 				 * We have something to work with.
1843 				 * If we can find a resolved/reachable
1844 				 * entry, we will use this. Otherwise
1845 				 * we'll try to find an entry that has
1846 				 * a resolved cache entry. We will fallback
1847 				 * on this if we don't find anything else.
1848 				 */
1849 				if (saved_ire == NULL)
1850 					saved_ire = ire;
1851 				mutex_enter(&ire->ire_lock);
1852 				gw_addr_v6 = ire->ire_gateway_addr_v6;
1853 				mutex_exit(&ire->ire_lock);
1854 				match_flags = MATCH_IRE_ILL_GROUP |
1855 				    MATCH_IRE_SECATTR;
1856 				rire = ire_ctable_lookup_v6(&gw_addr_v6, NULL,
1857 				    0, ire->ire_ipif, zoneid, tsl, match_flags);
1858 				if (rire != NULL) {
1859 					nce = rire->ire_nce;
1860 					if (nce != NULL &&
1861 					    NCE_ISREACHABLE(nce) &&
1862 					    nce->nce_flags & NCE_F_ISROUTER) {
1863 						ire_refrele(rire);
1864 						IRE_REFHOLD(ire);
1865 						IRB_REFRELE(irb_ptr);
1866 						goto found_ire_held;
1867 					} else if (nce != NULL &&
1868 					    !(nce->nce_flags &
1869 					    NCE_F_ISROUTER)) {
1870 						/*
1871 						 * Make sure we don't use
1872 						 * this ire
1873 						 */
1874 						if (saved_ire == ire)
1875 							saved_ire = NULL;
1876 					}
1877 					ire_refrele(rire);
1878 				} else if (ipv6_ire_default_count > 1 &&
1879 				    zoneid != ALL_ZONES) {
1880 					/*
1881 					 * When we're in a local zone, we're
1882 					 * only interested in default routers
1883 					 * that are reachable through ipifs
1884 					 * within our zone.
1885 					 * The potentially expensive call to
1886 					 * ire_route_lookup_v6() is avoided when
1887 					 * we have only one default route.
1888 					 */
1889 					rire = ire_route_lookup_v6(&gw_addr_v6,
1890 					    NULL, NULL, 0, ire->ire_ipif, NULL,
1891 					    zoneid, tsl, match_flags);
1892 					if (rire != NULL) {
1893 						ire_refrele(rire);
1894 						saved_ire = ire;
1895 					} else if (saved_ire == ire) {
1896 						/*
1897 						 * Make sure we don't use
1898 						 * this ire
1899 						 */
1900 						saved_ire = NULL;
1901 					}
1902 				}
1903 			}
1904 		}
1905 		if (saved_ire != NULL) {
1906 			ire = saved_ire;
1907 			IRE_REFHOLD(ire);
1908 			IRB_REFRELE(irb_ptr);
1909 			goto found_ire_held;
1910 		} else {
1911 			/*
1912 			 * Look for a interface default route matching the
1913 			 * args passed in. No round robin here. Just pick
1914 			 * the right one.
1915 			 */
1916 			for (ire = irb_ptr->irb_ire; ire != NULL;
1917 			    ire = ire->ire_next) {
1918 
1919 				if (!(ire->ire_type & IRE_INTERFACE))
1920 					continue;
1921 
1922 				if (ire->ire_marks & IRE_MARK_CONDEMNED)
1923 					continue;
1924 
1925 				if (ire_match_args_v6(ire, addr,
1926 				    &ipv6_all_zeros, gateway, type, ipif,
1927 				    zoneid, ihandle, tsl, flags)) {
1928 					IRE_REFHOLD(ire);
1929 					IRB_REFRELE(irb_ptr);
1930 					goto found_ire_held;
1931 				}
1932 			}
1933 			IRB_REFRELE(irb_ptr);
1934 		}
1935 	}
1936 	ASSERT(ire == NULL);
1937 	ip1dbg(("ire_ftable_lookup_v6: returning NULL ire"));
1938 	return (NULL);
1939 found_ire:
1940 	ASSERT((ire->ire_marks & IRE_MARK_CONDEMNED) == 0);
1941 	IRE_REFHOLD(ire);
1942 	rw_exit(&irb_ptr->irb_lock);
1943 
1944 found_ire_held:
1945 	if ((flags & MATCH_IRE_RJ_BHOLE) &&
1946 	    (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) {
1947 		return (ire);
1948 	}
1949 	/*
1950 	 * At this point, IRE that was found must be an IRE_FORWARDTABLE
1951 	 * or IRE_CACHETABLE type.  If this is a recursive lookup and an
1952 	 * IRE_INTERFACE type was found, return that.  If it was some other
1953 	 * IRE_FORWARDTABLE type of IRE (one of the prefix types), then it
1954 	 * is necessary to fill in the  parent IRE pointed to by pire, and
1955 	 * then lookup the gateway address of  the parent.  For backwards
1956 	 * compatiblity, if this lookup returns an
1957 	 * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level
1958 	 * of lookup is done.
1959 	 */
1960 	if (flags & MATCH_IRE_RECURSIVE) {
1961 		const ipif_t *gw_ipif;
1962 		int match_flags = MATCH_IRE_DSTONLY;
1963 
1964 		if (ire->ire_type & IRE_INTERFACE)
1965 			return (ire);
1966 		if (pire != NULL)
1967 			*pire = ire;
1968 		/*
1969 		 * If we can't find an IRE_INTERFACE or the caller has not
1970 		 * asked for pire, we need to REFRELE the saved_ire.
1971 		 */
1972 		saved_ire = ire;
1973 
1974 		/*
1975 		 * Currently MATCH_IRE_ILL is never used with
1976 		 * (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT) while
1977 		 * sending out packets as MATCH_IRE_ILL is used only
1978 		 * for communicating with on-link hosts. We can't assert
1979 		 * that here as RTM_GET calls this function with
1980 		 * MATCH_IRE_ILL | MATCH_IRE_DEFAULT | MATCH_IRE_RECURSIVE.
1981 		 * We have already used the MATCH_IRE_ILL in determining
1982 		 * the right prefix route at this point. To match the
1983 		 * behavior of how we locate routes while sending out
1984 		 * packets, we don't want to use MATCH_IRE_ILL below
1985 		 * while locating the interface route.
1986 		 */
1987 		if (ire->ire_ipif != NULL)
1988 			match_flags |= MATCH_IRE_ILL_GROUP;
1989 
1990 		mutex_enter(&ire->ire_lock);
1991 		gw_addr_v6 = ire->ire_gateway_addr_v6;
1992 		mutex_exit(&ire->ire_lock);
1993 
1994 		ire = ire_route_lookup_v6(&gw_addr_v6, NULL, NULL, 0,
1995 		    ire->ire_ipif, NULL, zoneid, tsl, match_flags);
1996 		if (ire == NULL) {
1997 			/*
1998 			 * In this case we have to deal with the
1999 			 * MATCH_IRE_PARENT flag, which means the
2000 			 * parent has to be returned if ire is NULL.
2001 			 * The aim of this is to have (at least) a starting
2002 			 * ire when we want to look at all of the ires in a
2003 			 * bucket aimed at a single destination (as is the
2004 			 * case in ip_newroute_v6 for the RTF_MULTIRT
2005 			 * flagged routes).
2006 			 */
2007 			if (flags & MATCH_IRE_PARENT) {
2008 				if (pire != NULL) {
2009 					/*
2010 					 * Need an extra REFHOLD, if the
2011 					 * parent ire is returned via both
2012 					 * ire and pire.
2013 					 */
2014 					IRE_REFHOLD(saved_ire);
2015 				}
2016 				ire = saved_ire;
2017 			} else {
2018 				ire_refrele(saved_ire);
2019 				if (pire != NULL)
2020 					*pire = NULL;
2021 			}
2022 			return (ire);
2023 		}
2024 		if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) {
2025 			/*
2026 			 * If the caller did not ask for pire, release
2027 			 * it now.
2028 			 */
2029 			if (pire == NULL) {
2030 				ire_refrele(saved_ire);
2031 			}
2032 			return (ire);
2033 		}
2034 		match_flags |= MATCH_IRE_TYPE;
2035 		mutex_enter(&ire->ire_lock);
2036 		gw_addr_v6 = ire->ire_gateway_addr_v6;
2037 		mutex_exit(&ire->ire_lock);
2038 		gw_ipif = ire->ire_ipif;
2039 		ire_refrele(ire);
2040 		ire = ire_route_lookup_v6(&gw_addr_v6, NULL, NULL,
2041 		    (IRE_CACHETABLE | IRE_INTERFACE), gw_ipif, NULL, zoneid,
2042 		    NULL, match_flags);
2043 		if (ire == NULL) {
2044 			/*
2045 			 * In this case we have to deal with the
2046 			 * MATCH_IRE_PARENT flag, which means the
2047 			 * parent has to be returned if ire is NULL.
2048 			 * The aim of this is to have (at least) a starting
2049 			 * ire when we want to look at all of the ires in a
2050 			 * bucket aimed at a single destination (as is the
2051 			 * case in ip_newroute_v6 for the RTF_MULTIRT
2052 			 * flagged routes).
2053 			 */
2054 			if (flags & MATCH_IRE_PARENT) {
2055 				if (pire != NULL) {
2056 					/*
2057 					 * Need an extra REFHOLD, if the
2058 					 * parent ire is returned via both
2059 					 * ire and pire.
2060 					 */
2061 					IRE_REFHOLD(saved_ire);
2062 				}
2063 				ire = saved_ire;
2064 			} else {
2065 				ire_refrele(saved_ire);
2066 				if (pire != NULL)
2067 					*pire = NULL;
2068 			}
2069 			return (ire);
2070 		} else if (pire == NULL) {
2071 			/*
2072 			 * If the caller did not ask for pire, release
2073 			 * it now.
2074 			 */
2075 			ire_refrele(saved_ire);
2076 		}
2077 		return (ire);
2078 	}
2079 
2080 	ASSERT(pire == NULL || *pire == NULL);
2081 	return (ire);
2082 }
2083 
2084 /*
2085  * Delete the IRE cache for the gateway and all IRE caches whose
2086  * ire_gateway_addr_v6 points to this gateway, and allow them to
2087  * be created on demand by ip_newroute_v6.
2088  */
2089 void
2090 ire_clookup_delete_cache_gw_v6(const in6_addr_t *addr, zoneid_t zoneid)
2091 {
2092 	irb_t *irb;
2093 	ire_t *ire;
2094 
2095 	irb = &ip_cache_table_v6[IRE_ADDR_HASH_V6(*addr, ip6_cache_table_size)];
2096 	IRB_REFHOLD(irb);
2097 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
2098 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
2099 			continue;
2100 
2101 		ASSERT(IN6_ARE_ADDR_EQUAL(&ire->ire_mask_v6, &ipv6_all_ones));
2102 		if (ire_match_args_v6(ire, addr, &ire->ire_mask_v6, 0,
2103 		    IRE_CACHE, NULL, zoneid, 0, NULL, MATCH_IRE_TYPE)) {
2104 			ire_delete(ire);
2105 		}
2106 	}
2107 	IRB_REFRELE(irb);
2108 
2109 	ire_walk_v6(ire_delete_cache_gw_v6, (char *)addr, zoneid);
2110 }
2111 
2112 /*
2113  * Looks up cache table for a route.
2114  * specific lookup can be indicated by
2115  * passing the MATCH_* flags and the
2116  * necessary parameters.
2117  */
2118 ire_t *
2119 ire_ctable_lookup_v6(const in6_addr_t *addr, const in6_addr_t *gateway,
2120     int type, const ipif_t *ipif, zoneid_t zoneid, const ts_label_t *tsl,
2121     int flags)
2122 {
2123 	ire_t *ire;
2124 	irb_t *irb_ptr;
2125 	ASSERT(addr != NULL);
2126 	ASSERT((!(flags & MATCH_IRE_GW)) || gateway != NULL);
2127 
2128 	/*
2129 	 * ire_match_args_v6() will dereference ipif MATCH_IRE_SRC or
2130 	 * MATCH_IRE_ILL is set.
2131 	 */
2132 	if ((flags & (MATCH_IRE_SRC |  MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) &&
2133 	    (ipif == NULL))
2134 		return (NULL);
2135 
2136 	irb_ptr = &ip_cache_table_v6[IRE_ADDR_HASH_V6(*addr,
2137 	    ip6_cache_table_size)];
2138 	rw_enter(&irb_ptr->irb_lock, RW_READER);
2139 	for (ire = irb_ptr->irb_ire; ire; ire = ire->ire_next) {
2140 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
2141 			continue;
2142 
2143 		ASSERT(IN6_ARE_ADDR_EQUAL(&ire->ire_mask_v6, &ipv6_all_ones));
2144 		if (ire_match_args_v6(ire, addr, &ire->ire_mask_v6, gateway,
2145 		    type, ipif, zoneid, 0, tsl, flags)) {
2146 			IRE_REFHOLD(ire);
2147 			rw_exit(&irb_ptr->irb_lock);
2148 			return (ire);
2149 		}
2150 	}
2151 	rw_exit(&irb_ptr->irb_lock);
2152 	return (NULL);
2153 }
2154 
2155 /*
2156  * Lookup cache. Don't return IRE_MARK_HIDDEN entries. Callers
2157  * should use ire_ctable_lookup with MATCH_IRE_MARK_HIDDEN to get
2158  * to the hidden ones.
2159  */
2160 ire_t *
2161 ire_cache_lookup_v6(const in6_addr_t *addr, zoneid_t zoneid,
2162     const ts_label_t *tsl)
2163 {
2164 	irb_t *irb_ptr;
2165 	ire_t *ire;
2166 
2167 	irb_ptr = &ip_cache_table_v6[IRE_ADDR_HASH_V6(*addr,
2168 	    ip6_cache_table_size)];
2169 	rw_enter(&irb_ptr->irb_lock, RW_READER);
2170 	for (ire = irb_ptr->irb_ire; ire; ire = ire->ire_next) {
2171 		if (ire->ire_marks & (IRE_MARK_CONDEMNED|IRE_MARK_HIDDEN))
2172 			continue;
2173 		if (IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, addr)) {
2174 			/*
2175 			 * Finally, check if the security policy has any
2176 			 * restriction on using this route for the specified
2177 			 * message.
2178 			 */
2179 			if (tsl != NULL &&
2180 			    ire->ire_gw_secattr != NULL &&
2181 			    tsol_ire_match_gwattr(ire, tsl) != 0) {
2182 				continue;
2183 			}
2184 
2185 			if (zoneid == ALL_ZONES || ire->ire_zoneid == zoneid ||
2186 			    ire->ire_zoneid == ALL_ZONES ||
2187 			    ire->ire_type == IRE_LOCAL) {
2188 				IRE_REFHOLD(ire);
2189 				rw_exit(&irb_ptr->irb_lock);
2190 				return (ire);
2191 			}
2192 		}
2193 	}
2194 	rw_exit(&irb_ptr->irb_lock);
2195 	return (NULL);
2196 }
2197 
2198 /*
2199  * Locate the interface ire that is tied to the cache ire 'cire' via
2200  * cire->ire_ihandle.
2201  *
2202  * We are trying to create the cache ire for an onlink destn. or
2203  * gateway in 'cire'. We are called from ire_add_v6() in the IRE_IF_RESOLVER
2204  * case for xresolv interfaces, after the ire has come back from
2205  * an external resolver.
2206  */
2207 static ire_t *
2208 ire_ihandle_lookup_onlink_v6(ire_t *cire)
2209 {
2210 	ire_t	*ire;
2211 	int	match_flags;
2212 	int	i;
2213 	int	j;
2214 	irb_t	*irb_ptr;
2215 
2216 	ASSERT(cire != NULL);
2217 
2218 	match_flags =  MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK;
2219 	/*
2220 	 * We know that the mask of the interface ire equals cire->ire_cmask.
2221 	 * (When ip_newroute_v6() created 'cire' for an on-link destn.
2222 	 * it set its cmask from the interface ire's mask)
2223 	 */
2224 	ire = ire_ftable_lookup_v6(&cire->ire_addr_v6, &cire->ire_cmask_v6,
2225 	    NULL, IRE_INTERFACE, NULL, NULL, ALL_ZONES, cire->ire_ihandle,
2226 	    NULL, match_flags);
2227 	if (ire != NULL)
2228 		return (ire);
2229 	/*
2230 	 * If we didn't find an interface ire above, we can't declare failure.
2231 	 * For backwards compatibility, we need to support prefix routes
2232 	 * pointing to next hop gateways that are not on-link.
2233 	 *
2234 	 * In the resolver/noresolver case, ip_newroute_v6() thinks
2235 	 * it is creating the cache ire for an onlink destination in 'cire'.
2236 	 * But 'cire' is not actually onlink, because ire_ftable_lookup_v6()
2237 	 * cheated it, by doing ire_route_lookup_v6() twice and returning an
2238 	 * interface ire.
2239 	 *
2240 	 * Eg. default	-	gw1			(line 1)
2241 	 *	gw1	-	gw2			(line 2)
2242 	 *	gw2	-	hme0			(line 3)
2243 	 *
2244 	 * In the above example, ip_newroute_v6() tried to create the cache ire
2245 	 * 'cire' for gw1, based on the interface route in line 3. The
2246 	 * ire_ftable_lookup_v6() above fails, because there is
2247 	 * no interface route to reach gw1. (it is gw2). We fall thru below.
2248 	 *
2249 	 * Do a brute force search based on the ihandle in a subset of the
2250 	 * forwarding tables, corresponding to cire->ire_cmask_v6. Otherwise
2251 	 * things become very complex, since we don't have 'pire' in this
2252 	 * case. (Also note that this method is not possible in the offlink
2253 	 * case because we don't know the mask)
2254 	 */
2255 	i = ip_mask_to_plen_v6(&cire->ire_cmask_v6);
2256 	if ((ip_forwarding_table_v6[i]) == NULL)
2257 		return (NULL);
2258 	for (j = 0; j < ip6_ftable_hash_size; j++) {
2259 		irb_ptr = &ip_forwarding_table_v6[i][j];
2260 		rw_enter(&irb_ptr->irb_lock, RW_READER);
2261 		for (ire = irb_ptr->irb_ire; ire != NULL;
2262 		    ire = ire->ire_next) {
2263 			if (ire->ire_marks & IRE_MARK_CONDEMNED)
2264 				continue;
2265 			if ((ire->ire_type & IRE_INTERFACE) &&
2266 			    (ire->ire_ihandle == cire->ire_ihandle)) {
2267 				IRE_REFHOLD(ire);
2268 				rw_exit(&irb_ptr->irb_lock);
2269 				return (ire);
2270 			}
2271 		}
2272 		rw_exit(&irb_ptr->irb_lock);
2273 	}
2274 	return (NULL);
2275 }
2276 
2277 
2278 /*
2279  * Locate the interface ire that is tied to the cache ire 'cire' via
2280  * cire->ire_ihandle.
2281  *
2282  * We are trying to create the cache ire for an offlink destn based
2283  * on the cache ire of the gateway in 'cire'. 'pire' is the prefix ire
2284  * as found by ip_newroute_v6(). We are called from ip_newroute_v6() in
2285  * the IRE_CACHE case.
2286  */
2287 ire_t *
2288 ire_ihandle_lookup_offlink_v6(ire_t *cire, ire_t *pire)
2289 {
2290 	ire_t	*ire;
2291 	int	match_flags;
2292 	in6_addr_t	gw_addr;
2293 	ipif_t		*gw_ipif;
2294 
2295 	ASSERT(cire != NULL && pire != NULL);
2296 
2297 	match_flags =  MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK;
2298 	/*
2299 	 * ip_newroute_v6 calls ire_ftable_lookup with MATCH_IRE_ILL only
2300 	 * for on-link hosts. We should never be here for onlink.
2301 	 * Thus, use MATCH_IRE_ILL_GROUP.
2302 	 */
2303 	if (pire->ire_ipif != NULL)
2304 		match_flags |= MATCH_IRE_ILL_GROUP;
2305 	/*
2306 	 * We know that the mask of the interface ire equals cire->ire_cmask.
2307 	 * (When ip_newroute_v6() created 'cire' for an on-link destn. it set
2308 	 * its cmask from the interface ire's mask)
2309 	 */
2310 	ire = ire_ftable_lookup_v6(&cire->ire_addr_v6, &cire->ire_cmask_v6, 0,
2311 	    IRE_INTERFACE, pire->ire_ipif, NULL, ALL_ZONES, cire->ire_ihandle,
2312 	    NULL, match_flags);
2313 	if (ire != NULL)
2314 		return (ire);
2315 	/*
2316 	 * If we didn't find an interface ire above, we can't declare failure.
2317 	 * For backwards compatibility, we need to support prefix routes
2318 	 * pointing to next hop gateways that are not on-link.
2319 	 *
2320 	 * Assume we are trying to ping some offlink destn, and we have the
2321 	 * routing table below.
2322 	 *
2323 	 * Eg.	default	- gw1		<--- pire	(line 1)
2324 	 *	gw1	- gw2				(line 2)
2325 	 *	gw2	- hme0				(line 3)
2326 	 *
2327 	 * If we already have a cache ire for gw1 in 'cire', the
2328 	 * ire_ftable_lookup_v6 above would have failed, since there is no
2329 	 * interface ire to reach gw1. We will fallthru below.
2330 	 *
2331 	 * Here we duplicate the steps that ire_ftable_lookup_v6() did in
2332 	 * getting 'cire' from 'pire', in the MATCH_IRE_RECURSIVE case.
2333 	 * The differences are the following
2334 	 * i.   We want the interface ire only, so we call
2335 	 *	ire_ftable_lookup_v6() instead of ire_route_lookup_v6()
2336 	 * ii.  We look for only prefix routes in the 1st call below.
2337 	 * ii.  We want to match on the ihandle in the 2nd call below.
2338 	 */
2339 	match_flags =  MATCH_IRE_TYPE;
2340 	if (pire->ire_ipif != NULL)
2341 		match_flags |= MATCH_IRE_ILL_GROUP;
2342 
2343 	mutex_enter(&pire->ire_lock);
2344 	gw_addr = pire->ire_gateway_addr_v6;
2345 	mutex_exit(&pire->ire_lock);
2346 	ire = ire_ftable_lookup_v6(&gw_addr, 0, 0, IRE_OFFSUBNET,
2347 	    pire->ire_ipif, NULL, ALL_ZONES, 0, NULL, match_flags);
2348 	if (ire == NULL)
2349 		return (NULL);
2350 	/*
2351 	 * At this point 'ire' corresponds to the entry shown in line 2.
2352 	 * gw_addr is 'gw2' in the example above.
2353 	 */
2354 	mutex_enter(&ire->ire_lock);
2355 	gw_addr = ire->ire_gateway_addr_v6;
2356 	mutex_exit(&ire->ire_lock);
2357 	gw_ipif = ire->ire_ipif;
2358 	ire_refrele(ire);
2359 
2360 	match_flags |= MATCH_IRE_IHANDLE;
2361 	ire = ire_ftable_lookup_v6(&gw_addr, 0, 0, IRE_INTERFACE,
2362 	    gw_ipif, NULL, ALL_ZONES, cire->ire_ihandle,
2363 	    NULL, match_flags);
2364 	return (ire);
2365 }
2366 
2367 /*
2368  * Return the IRE_LOOPBACK, IRE_IF_RESOLVER or IRE_IF_NORESOLVER
2369  * ire associated with the specified ipif.
2370  *
2371  * This might occasionally be called when IPIF_UP is not set since
2372  * the IPV6_MULTICAST_IF as well as creating interface routes
2373  * allows specifying a down ipif (ipif_lookup* match ipifs that are down).
2374  *
2375  * Note that if IPIF_NOLOCAL, IPIF_NOXMIT, or IPIF_DEPRECATED is set on
2376  * the ipif this routine might return NULL.
2377  * (Sometimes called as writer though not required by this function.)
2378  */
2379 ire_t *
2380 ipif_to_ire_v6(const ipif_t *ipif)
2381 {
2382 	ire_t	*ire;
2383 
2384 	ASSERT(ipif->ipif_isv6);
2385 	if (ipif->ipif_ire_type == IRE_LOOPBACK) {
2386 		ire = ire_ctable_lookup_v6(&ipif->ipif_v6lcl_addr, NULL,
2387 		    IRE_LOOPBACK, ipif, ALL_ZONES, NULL,
2388 		    (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
2389 	} else if (ipif->ipif_flags & IPIF_POINTOPOINT) {
2390 		/* In this case we need to lookup destination address. */
2391 		ire = ire_ftable_lookup_v6(&ipif->ipif_v6pp_dst_addr,
2392 		    &ipv6_all_ones, NULL, IRE_INTERFACE, ipif, NULL, ALL_ZONES,
2393 		    0, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF |
2394 		    MATCH_IRE_MASK));
2395 	} else {
2396 		ire = ire_ftable_lookup_v6(&ipif->ipif_v6subnet,
2397 		    &ipif->ipif_v6net_mask, NULL, IRE_INTERFACE, ipif, NULL,
2398 		    ALL_ZONES, 0, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF |
2399 		    MATCH_IRE_MASK));
2400 	}
2401 	return (ire);
2402 }
2403 
2404 /*
2405  * Return B_TRUE if a multirt route is resolvable
2406  * (or if no route is resolved yet), B_FALSE otherwise.
2407  * This only works in the global zone.
2408  */
2409 boolean_t
2410 ire_multirt_need_resolve_v6(const in6_addr_t *v6dstp, const ts_label_t *tsl)
2411 {
2412 	ire_t	*first_fire;
2413 	ire_t	*first_cire;
2414 	ire_t	*fire;
2415 	ire_t	*cire;
2416 	irb_t	*firb;
2417 	irb_t	*cirb;
2418 	int	unres_cnt = 0;
2419 	boolean_t resolvable = B_FALSE;
2420 
2421 	/* Retrieve the first IRE_HOST that matches the destination */
2422 	first_fire = ire_ftable_lookup_v6(v6dstp, &ipv6_all_ones, 0, IRE_HOST,
2423 	    NULL, NULL, ALL_ZONES, 0, tsl, MATCH_IRE_MASK | MATCH_IRE_TYPE |
2424 	    MATCH_IRE_SECATTR);
2425 
2426 	/* No route at all */
2427 	if (first_fire == NULL) {
2428 		return (B_TRUE);
2429 	}
2430 
2431 	firb = first_fire->ire_bucket;
2432 	ASSERT(firb);
2433 
2434 	/* Retrieve the first IRE_CACHE ire for that destination. */
2435 	first_cire = ire_cache_lookup_v6(v6dstp, GLOBAL_ZONEID, tsl);
2436 
2437 	/* No resolved route. */
2438 	if (first_cire == NULL) {
2439 		ire_refrele(first_fire);
2440 		return (B_TRUE);
2441 	}
2442 
2443 	/* At least one route is resolved. */
2444 
2445 	cirb = first_cire->ire_bucket;
2446 	ASSERT(cirb);
2447 
2448 	/* Count the number of routes to that dest that are declared. */
2449 	IRB_REFHOLD(firb);
2450 	for (fire = first_fire; fire != NULL; fire = fire->ire_next) {
2451 		if (!(fire->ire_flags & RTF_MULTIRT))
2452 			continue;
2453 		if (!IN6_ARE_ADDR_EQUAL(&fire->ire_addr_v6, v6dstp))
2454 			continue;
2455 		unres_cnt++;
2456 	}
2457 	IRB_REFRELE(firb);
2458 
2459 
2460 	/* Then subtract the number of routes to that dst that are resolved */
2461 	IRB_REFHOLD(cirb);
2462 	for (cire = first_cire; cire != NULL; cire = cire->ire_next) {
2463 	    if (!(cire->ire_flags & RTF_MULTIRT))
2464 		continue;
2465 	    if (!IN6_ARE_ADDR_EQUAL(&cire->ire_addr_v6, v6dstp))
2466 		continue;
2467 	    if (cire->ire_marks & (IRE_MARK_CONDEMNED|IRE_MARK_HIDDEN))
2468 		continue;
2469 	    unres_cnt--;
2470 	}
2471 	IRB_REFRELE(cirb);
2472 
2473 	/* At least one route is unresolved; search for a resolvable route. */
2474 	if (unres_cnt > 0)
2475 		resolvable = ire_multirt_lookup_v6(&first_cire, &first_fire,
2476 		    MULTIRT_USESTAMP|MULTIRT_CACHEGW, tsl);
2477 
2478 	if (first_fire)
2479 		ire_refrele(first_fire);
2480 
2481 	if (first_cire)
2482 		ire_refrele(first_cire);
2483 
2484 	return (resolvable);
2485 }
2486 
2487 
2488 /*
2489  * Return B_TRUE and update *ire_arg and *fire_arg
2490  * if at least one resolvable route is found.
2491  * Return B_FALSE otherwise (all routes are resolved or
2492  * the remaining unresolved routes are all unresolvable).
2493  * This only works in the global zone.
2494  */
2495 boolean_t
2496 ire_multirt_lookup_v6(ire_t **ire_arg, ire_t **fire_arg, uint32_t flags,
2497     const ts_label_t *tsl)
2498 {
2499 	clock_t	delta;
2500 	ire_t	*best_fire = NULL;
2501 	ire_t	*best_cire = NULL;
2502 	ire_t	*first_fire;
2503 	ire_t	*first_cire;
2504 	ire_t	*fire;
2505 	ire_t	*cire;
2506 	irb_t	*firb = NULL;
2507 	irb_t	*cirb = NULL;
2508 	ire_t	*gw_ire;
2509 	boolean_t	already_resolved;
2510 	boolean_t	res;
2511 	in6_addr_t	v6dst;
2512 	in6_addr_t	v6gw;
2513 
2514 	ip2dbg(("ire_multirt_lookup_v6: *ire_arg %p, *fire_arg %p, "
2515 	    "flags %04x\n", (void *)*ire_arg, (void *)*fire_arg, flags));
2516 
2517 	ASSERT(ire_arg);
2518 	ASSERT(fire_arg);
2519 
2520 	/* Not an IRE_HOST ire; give up. */
2521 	if ((*fire_arg == NULL) ||
2522 	    ((*fire_arg)->ire_type != IRE_HOST)) {
2523 		return (B_FALSE);
2524 	}
2525 
2526 	/* This is the first IRE_HOST ire for that destination. */
2527 	first_fire = *fire_arg;
2528 	firb = first_fire->ire_bucket;
2529 	ASSERT(firb);
2530 
2531 	mutex_enter(&first_fire->ire_lock);
2532 	v6dst = first_fire->ire_addr_v6;
2533 	mutex_exit(&first_fire->ire_lock);
2534 
2535 	ip2dbg(("ire_multirt_lookup_v6: dst %08x\n",
2536 	    ntohl(V4_PART_OF_V6(v6dst))));
2537 
2538 	/*
2539 	 * Retrieve the first IRE_CACHE ire for that destination;
2540 	 * if we don't find one, no route for that dest is
2541 	 * resolved yet.
2542 	 */
2543 	first_cire = ire_cache_lookup_v6(&v6dst, GLOBAL_ZONEID, tsl);
2544 	if (first_cire) {
2545 		cirb = first_cire->ire_bucket;
2546 	}
2547 
2548 	ip2dbg(("ire_multirt_lookup_v6: first_cire %p\n", (void *)first_cire));
2549 
2550 	/*
2551 	 * Search for a resolvable route, giving the top priority
2552 	 * to routes that can be resolved without any call to the resolver.
2553 	 */
2554 	IRB_REFHOLD(firb);
2555 
2556 	if (!IN6_IS_ADDR_MULTICAST(&v6dst)) {
2557 		/*
2558 		 * For all multiroute IRE_HOST ires for that destination,
2559 		 * check if the route via the IRE_HOST's gateway is
2560 		 * resolved yet.
2561 		 */
2562 		for (fire = first_fire; fire != NULL; fire = fire->ire_next) {
2563 
2564 			if (!(fire->ire_flags & RTF_MULTIRT))
2565 				continue;
2566 			if (!IN6_ARE_ADDR_EQUAL(&fire->ire_addr_v6, &v6dst))
2567 				continue;
2568 
2569 			if (fire->ire_gw_secattr != NULL &&
2570 			    tsol_ire_match_gwattr(fire, tsl) != 0) {
2571 				continue;
2572 			}
2573 
2574 			mutex_enter(&fire->ire_lock);
2575 			v6gw = fire->ire_gateway_addr_v6;
2576 			mutex_exit(&fire->ire_lock);
2577 
2578 			ip2dbg(("ire_multirt_lookup_v6: fire %p, "
2579 			    "ire_addr %08x, ire_gateway_addr %08x\n",
2580 			    (void *)fire,
2581 			    ntohl(V4_PART_OF_V6(fire->ire_addr_v6)),
2582 			    ntohl(V4_PART_OF_V6(v6gw))));
2583 
2584 			already_resolved = B_FALSE;
2585 
2586 			if (first_cire) {
2587 				ASSERT(cirb);
2588 
2589 				IRB_REFHOLD(cirb);
2590 				/*
2591 				 * For all IRE_CACHE ires for that
2592 				 * destination.
2593 				 */
2594 				for (cire = first_cire;
2595 				    cire != NULL;
2596 				    cire = cire->ire_next) {
2597 
2598 					if (!(cire->ire_flags & RTF_MULTIRT))
2599 						continue;
2600 					if (!IN6_ARE_ADDR_EQUAL(
2601 					    &cire->ire_addr_v6, &v6dst))
2602 						continue;
2603 					if (cire->ire_marks &
2604 					    (IRE_MARK_CONDEMNED|
2605 						IRE_MARK_HIDDEN))
2606 						continue;
2607 
2608 					if (cire->ire_gw_secattr != NULL &&
2609 					    tsol_ire_match_gwattr(cire,
2610 					    tsl) != 0) {
2611 						continue;
2612 					}
2613 
2614 					/*
2615 					 * Check if the IRE_CACHE's gateway
2616 					 * matches the IRE_HOST's gateway.
2617 					 */
2618 					if (IN6_ARE_ADDR_EQUAL(
2619 					    &cire->ire_gateway_addr_v6,
2620 					    &v6gw)) {
2621 						already_resolved = B_TRUE;
2622 						break;
2623 					}
2624 				}
2625 				IRB_REFRELE(cirb);
2626 			}
2627 
2628 			/*
2629 			 * This route is already resolved;
2630 			 * proceed with next one.
2631 			 */
2632 			if (already_resolved) {
2633 				ip2dbg(("ire_multirt_lookup_v6: found cire %p, "
2634 				    "already resolved\n", (void *)cire));
2635 				continue;
2636 			}
2637 
2638 			/*
2639 			 * The route is unresolved; is it actually
2640 			 * resolvable, i.e. is there a cache or a resolver
2641 			 * for the gateway?
2642 			 */
2643 			gw_ire = ire_route_lookup_v6(&v6gw, 0, 0, 0, NULL, NULL,
2644 			    ALL_ZONES, tsl, MATCH_IRE_RECURSIVE |
2645 			    MATCH_IRE_SECATTR);
2646 
2647 			ip2dbg(("ire_multirt_lookup_v6: looked up gw_ire %p\n",
2648 			    (void *)gw_ire));
2649 
2650 			/*
2651 			 * This route can be resolved without any call to the
2652 			 * resolver; if the MULTIRT_CACHEGW flag is set,
2653 			 * give the top priority to this ire and exit the
2654 			 * loop.
2655 			 * This occurs when an resolver reply is processed
2656 			 * through ip_wput_nondata()
2657 			 */
2658 			if ((flags & MULTIRT_CACHEGW) &&
2659 			    (gw_ire != NULL) &&
2660 			    (gw_ire->ire_type & IRE_CACHETABLE)) {
2661 				/*
2662 				 * Release the resolver associated to the
2663 				 * previous candidate best ire, if any.
2664 				 */
2665 				if (best_cire) {
2666 					ire_refrele(best_cire);
2667 					ASSERT(best_fire);
2668 				}
2669 
2670 				best_fire = fire;
2671 				best_cire = gw_ire;
2672 
2673 				ip2dbg(("ire_multirt_lookup_v6: found top prio "
2674 				    "best_fire %p, best_cire %p\n",
2675 				    (void *)best_fire, (void *)best_cire));
2676 				break;
2677 			}
2678 
2679 			/*
2680 			 * Compute the time elapsed since our preceding
2681 			 * attempt to  resolve that route.
2682 			 * If the MULTIRT_USESTAMP flag is set, we take that
2683 			 * route into account only if this time interval
2684 			 * exceeds ip_multirt_resolution_interval;
2685 			 * this prevents us from attempting to resolve a
2686 			 * broken route upon each sending of a packet.
2687 			 */
2688 			delta = lbolt - fire->ire_last_used_time;
2689 			delta = TICK_TO_MSEC(delta);
2690 
2691 			res = (boolean_t)
2692 			    ((delta > ip_multirt_resolution_interval) ||
2693 				(!(flags & MULTIRT_USESTAMP)));
2694 
2695 			ip2dbg(("ire_multirt_lookup_v6: fire %p, delta %lu, "
2696 			    "res %d\n",
2697 			    (void *)fire, delta, res));
2698 
2699 			if (res) {
2700 				/*
2701 				 * A resolver exists for the gateway: save
2702 				 * the current IRE_HOST ire as a candidate
2703 				 * best ire. If we later discover that a
2704 				 * top priority ire exists (i.e. no need to
2705 				 * call the resolver), then this new ire
2706 				 * will be preferred to the current one.
2707 				 */
2708 				if (gw_ire != NULL) {
2709 					if (best_fire == NULL) {
2710 						ASSERT(best_cire == NULL);
2711 
2712 						best_fire = fire;
2713 						best_cire = gw_ire;
2714 
2715 						ip2dbg(("ire_multirt_lookup_v6:"
2716 						    "found candidate "
2717 						    "best_fire %p, "
2718 						    "best_cire %p\n",
2719 						    (void *)best_fire,
2720 						    (void *)best_cire));
2721 
2722 						/*
2723 						 * If MULTIRT_CACHEGW is not
2724 						 * set, we ignore the top
2725 						 * priority ires that can
2726 						 * be resolved without any
2727 						 * call to the resolver;
2728 						 * In that case, there is
2729 						 * actually no need
2730 						 * to continue the loop.
2731 						 */
2732 						if (!(flags &
2733 						    MULTIRT_CACHEGW)) {
2734 							break;
2735 						}
2736 						continue;
2737 					}
2738 				} else {
2739 					/*
2740 					 * No resolver for the gateway: the
2741 					 * route is not resolvable.
2742 					 * If the MULTIRT_SETSTAMP flag is
2743 					 * set, we stamp the IRE_HOST ire,
2744 					 * so we will not select it again
2745 					 * during this resolution interval.
2746 					 */
2747 					if (flags & MULTIRT_SETSTAMP)
2748 						fire->ire_last_used_time =
2749 						    lbolt;
2750 				}
2751 			}
2752 
2753 			if (gw_ire != NULL)
2754 				ire_refrele(gw_ire);
2755 		}
2756 	} else { /* IN6_IS_ADDR_MULTICAST(&v6dst) */
2757 
2758 		for (fire = first_fire;
2759 		    fire != NULL;
2760 		    fire = fire->ire_next) {
2761 
2762 			if (!(fire->ire_flags & RTF_MULTIRT))
2763 				continue;
2764 			if (!IN6_ARE_ADDR_EQUAL(&fire->ire_addr_v6, &v6dst))
2765 				continue;
2766 
2767 			if (fire->ire_gw_secattr != NULL &&
2768 			    tsol_ire_match_gwattr(fire, tsl) != 0) {
2769 				continue;
2770 			}
2771 
2772 			already_resolved = B_FALSE;
2773 
2774 			mutex_enter(&fire->ire_lock);
2775 			v6gw = fire->ire_gateway_addr_v6;
2776 			mutex_exit(&fire->ire_lock);
2777 
2778 			gw_ire = ire_ftable_lookup_v6(&v6gw, 0, 0,
2779 			    IRE_INTERFACE, NULL, NULL, ALL_ZONES, 0, tsl,
2780 			    MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE |
2781 			    MATCH_IRE_SECATTR);
2782 
2783 			/* No resolver for the gateway; we skip this ire. */
2784 			if (gw_ire == NULL) {
2785 				continue;
2786 			}
2787 
2788 			if (first_cire) {
2789 
2790 				IRB_REFHOLD(cirb);
2791 				/*
2792 				 * For all IRE_CACHE ires for that
2793 				 * destination.
2794 				 */
2795 				for (cire = first_cire;
2796 				    cire != NULL;
2797 				    cire = cire->ire_next) {
2798 
2799 					if (!(cire->ire_flags & RTF_MULTIRT))
2800 						continue;
2801 					if (!IN6_ARE_ADDR_EQUAL(
2802 					    &cire->ire_addr_v6, &v6dst))
2803 						continue;
2804 					if (cire->ire_marks &
2805 					    (IRE_MARK_CONDEMNED|
2806 						IRE_MARK_HIDDEN))
2807 						continue;
2808 
2809 					if (cire->ire_gw_secattr != NULL &&
2810 					    tsol_ire_match_gwattr(cire,
2811 					    tsl) != 0) {
2812 						continue;
2813 					}
2814 
2815 					/*
2816 					 * Cache entries are linked to the
2817 					 * parent routes using the parent handle
2818 					 * (ire_phandle). If no cache entry has
2819 					 * the same handle as fire, fire is
2820 					 * still unresolved.
2821 					 */
2822 					ASSERT(cire->ire_phandle != 0);
2823 					if (cire->ire_phandle ==
2824 					    fire->ire_phandle) {
2825 						already_resolved = B_TRUE;
2826 						break;
2827 					}
2828 				}
2829 				IRB_REFRELE(cirb);
2830 			}
2831 
2832 			/*
2833 			 * This route is already resolved; proceed with
2834 			 * next one.
2835 			 */
2836 			if (already_resolved) {
2837 				ire_refrele(gw_ire);
2838 				continue;
2839 			}
2840 
2841 			/*
2842 			 * Compute the time elapsed since our preceding
2843 			 * attempt to resolve that route.
2844 			 * If the MULTIRT_USESTAMP flag is set, we take
2845 			 * that route into account only if this time
2846 			 * interval exceeds ip_multirt_resolution_interval;
2847 			 * this prevents us from attempting to resolve a
2848 			 * broken route upon each sending of a packet.
2849 			 */
2850 			delta = lbolt - fire->ire_last_used_time;
2851 			delta = TICK_TO_MSEC(delta);
2852 
2853 			res = (boolean_t)
2854 			    ((delta > ip_multirt_resolution_interval) ||
2855 			    (!(flags & MULTIRT_USESTAMP)));
2856 
2857 			ip3dbg(("ire_multirt_lookup_v6: fire %p, delta %lx, "
2858 			    "flags %04x, res %d\n",
2859 			    (void *)fire, delta, flags, res));
2860 
2861 			if (res) {
2862 				if (best_cire) {
2863 					/*
2864 					 * Release the resolver associated
2865 					 * to the preceding candidate best
2866 					 * ire, if any.
2867 					 */
2868 					ire_refrele(best_cire);
2869 					ASSERT(best_fire);
2870 				}
2871 				best_fire = fire;
2872 				best_cire = gw_ire;
2873 				continue;
2874 			}
2875 
2876 			ire_refrele(gw_ire);
2877 		}
2878 	}
2879 
2880 	if (best_fire) {
2881 		IRE_REFHOLD(best_fire);
2882 	}
2883 	IRB_REFRELE(firb);
2884 
2885 	/* Release the first IRE_CACHE we initially looked up, if any. */
2886 	if (first_cire)
2887 		ire_refrele(first_cire);
2888 
2889 	/* Found a resolvable route. */
2890 	if (best_fire) {
2891 		ASSERT(best_cire);
2892 
2893 		if (*fire_arg)
2894 			ire_refrele(*fire_arg);
2895 		if (*ire_arg)
2896 			ire_refrele(*ire_arg);
2897 
2898 		/*
2899 		 * Update the passed arguments with the
2900 		 * resolvable multirt route we found
2901 		 */
2902 		*fire_arg = best_fire;
2903 		*ire_arg = best_cire;
2904 
2905 		ip2dbg(("ire_multirt_lookup_v6: returning B_TRUE, "
2906 		    "*fire_arg %p, *ire_arg %p\n",
2907 		    (void *)best_fire, (void *)best_cire));
2908 
2909 		return (B_TRUE);
2910 	}
2911 
2912 	ASSERT(best_cire == NULL);
2913 
2914 	ip2dbg(("ire_multirt_lookup_v6: returning B_FALSE, *fire_arg %p, "
2915 	    "*ire_arg %p\n",
2916 	    (void *)*fire_arg, (void *)*ire_arg));
2917 
2918 	/* No resolvable route. */
2919 	return (B_FALSE);
2920 }
2921 
2922 
2923 /*
2924  * Find an IRE_OFFSUBNET IRE entry for the multicast address 'v6dstp'
2925  * that goes through 'ipif'. As a fallback, a route that goes through
2926  * ipif->ipif_ill can be returned.
2927  */
2928 ire_t *
2929 ipif_lookup_multi_ire_v6(ipif_t *ipif, const in6_addr_t *v6dstp)
2930 {
2931 	ire_t	*ire;
2932 	ire_t	*save_ire = NULL;
2933 	ire_t   *gw_ire;
2934 	irb_t   *irb;
2935 	in6_addr_t v6gw;
2936 	int	match_flags = MATCH_IRE_TYPE | MATCH_IRE_ILL;
2937 
2938 	ire = ire_ftable_lookup_v6(v6dstp, 0, 0, 0, NULL, NULL, ALL_ZONES, 0,
2939 	    NULL, MATCH_IRE_DEFAULT);
2940 
2941 	if (ire == NULL)
2942 		return (NULL);
2943 
2944 	irb = ire->ire_bucket;
2945 	ASSERT(irb);
2946 
2947 	IRB_REFHOLD(irb);
2948 	ire_refrele(ire);
2949 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
2950 		if (!IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, v6dstp) ||
2951 		    (ipif->ipif_zoneid != ire->ire_zoneid &&
2952 		    ire->ire_zoneid != ALL_ZONES)) {
2953 			continue;
2954 		}
2955 
2956 		switch (ire->ire_type) {
2957 		case IRE_DEFAULT:
2958 		case IRE_PREFIX:
2959 		case IRE_HOST:
2960 			mutex_enter(&ire->ire_lock);
2961 			v6gw = ire->ire_gateway_addr_v6;
2962 			mutex_exit(&ire->ire_lock);
2963 			gw_ire = ire_ftable_lookup_v6(&v6gw, 0, 0,
2964 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
2965 			    NULL, match_flags);
2966 
2967 			if (gw_ire != NULL) {
2968 				if (save_ire != NULL) {
2969 					ire_refrele(save_ire);
2970 				}
2971 				IRE_REFHOLD(ire);
2972 				if (gw_ire->ire_ipif == ipif) {
2973 					ire_refrele(gw_ire);
2974 
2975 					IRB_REFRELE(irb);
2976 					return (ire);
2977 				}
2978 				ire_refrele(gw_ire);
2979 				save_ire = ire;
2980 			}
2981 			break;
2982 		case IRE_IF_NORESOLVER:
2983 		case IRE_IF_RESOLVER:
2984 			if (ire->ire_ipif == ipif) {
2985 				if (save_ire != NULL) {
2986 					ire_refrele(save_ire);
2987 				}
2988 				IRE_REFHOLD(ire);
2989 
2990 				IRB_REFRELE(irb);
2991 				return (ire);
2992 			}
2993 			break;
2994 		}
2995 	}
2996 	IRB_REFRELE(irb);
2997 
2998 	return (save_ire);
2999 }
3000