1c793af95Ssangeeta /* 2c793af95Ssangeeta * CDDL HEADER START 3c793af95Ssangeeta * 4c793af95Ssangeeta * The contents of this file are subject to the terms of the 5c793af95Ssangeeta * Common Development and Distribution License (the "License"). 6c793af95Ssangeeta * You may not use this file except in compliance with the License. 7c793af95Ssangeeta * 8c793af95Ssangeeta * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c793af95Ssangeeta * or http://www.opensolaris.org/os/licensing. 10c793af95Ssangeeta * See the License for the specific language governing permissions 11c793af95Ssangeeta * and limitations under the License. 12c793af95Ssangeeta * 13c793af95Ssangeeta * When distributing Covered Code, include this CDDL HEADER in each 14c793af95Ssangeeta * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c793af95Ssangeeta * If applicable, add the following below this CDDL HEADER, with the 16c793af95Ssangeeta * fields enclosed by brackets "[]" replaced with your own identifying 17c793af95Ssangeeta * information: Portions Copyright [yyyy] [name of copyright owner] 18c793af95Ssangeeta * 19c793af95Ssangeeta * CDDL HEADER END 20c793af95Ssangeeta */ 21c793af95Ssangeeta /* 229e3469d3SErik Nordmark * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23c793af95Ssangeeta * Use is subject to license terms. 24c793af95Ssangeeta */ 25c793af95Ssangeeta 26c793af95Ssangeeta /* 27c793af95Ssangeeta * This file contains consumer routines of the IPv4 forwarding engine 28c793af95Ssangeeta */ 29c793af95Ssangeeta 30c793af95Ssangeeta #include <sys/types.h> 31c793af95Ssangeeta #include <sys/stream.h> 32c793af95Ssangeeta #include <sys/stropts.h> 33c793af95Ssangeeta #include <sys/strlog.h> 34c793af95Ssangeeta #include <sys/dlpi.h> 35c793af95Ssangeeta #include <sys/ddi.h> 36c793af95Ssangeeta #include <sys/cmn_err.h> 37c793af95Ssangeeta #include <sys/policy.h> 38c793af95Ssangeeta 39c793af95Ssangeeta #include <sys/systm.h> 40c793af95Ssangeeta #include <sys/strsun.h> 41c793af95Ssangeeta #include <sys/kmem.h> 42c793af95Ssangeeta #include <sys/param.h> 43c793af95Ssangeeta #include <sys/socket.h> 44edd26dc5Sdr146992 #include <sys/strsubr.h> 45c793af95Ssangeeta #include <net/if.h> 46c793af95Ssangeeta #include <net/route.h> 47c793af95Ssangeeta #include <netinet/in.h> 48c793af95Ssangeeta #include <net/if_dl.h> 49c793af95Ssangeeta #include <netinet/ip6.h> 50c793af95Ssangeeta #include <netinet/icmp6.h> 51c793af95Ssangeeta 52bd670b35SErik Nordmark #include <inet/ipsec_impl.h> 53c793af95Ssangeeta #include <inet/common.h> 54c793af95Ssangeeta #include <inet/mi.h> 55c793af95Ssangeeta #include <inet/mib2.h> 56c793af95Ssangeeta #include <inet/ip.h> 57edd26dc5Sdr146992 #include <inet/ip_impl.h> 58c793af95Ssangeeta #include <inet/ip6.h> 59c793af95Ssangeeta #include <inet/ip_ndp.h> 60c793af95Ssangeeta #include <inet/arp.h> 61c793af95Ssangeeta #include <inet/ip_if.h> 62c793af95Ssangeeta #include <inet/ip_ire.h> 63c793af95Ssangeeta #include <inet/ip_ftable.h> 64c793af95Ssangeeta #include <inet/ip_rts.h> 65c793af95Ssangeeta #include <inet/nd.h> 66c793af95Ssangeeta 67c793af95Ssangeeta #include <net/pfkeyv2.h> 68c793af95Ssangeeta #include <inet/sadb.h> 69c793af95Ssangeeta #include <inet/tcp.h> 70c793af95Ssangeeta #include <inet/ipclassifier.h> 71c793af95Ssangeeta #include <sys/zone.h> 72c793af95Ssangeeta #include <net/radix.h> 73c793af95Ssangeeta #include <sys/tsol/label.h> 74c793af95Ssangeeta #include <sys/tsol/tnet.h> 75c793af95Ssangeeta 76c793af95Ssangeeta #define IS_DEFAULT_ROUTE(ire) \ 77c793af95Ssangeeta (((ire)->ire_type & IRE_DEFAULT) || \ 78c793af95Ssangeeta (((ire)->ire_type & IRE_INTERFACE) && ((ire)->ire_addr == 0))) 79c793af95Ssangeeta 8044b099c4SSowmini Varadhan #define IP_SRC_MULTIHOMING(isv6, ipst) \ 8144b099c4SSowmini Varadhan (isv6 ? ipst->ips_ipv6_strict_src_multihoming : \ 8244b099c4SSowmini Varadhan ipst->ips_ip_strict_src_multihoming) 8344b099c4SSowmini Varadhan 84f4b3ec61Sdh155122 static ire_t *route_to_dst(const struct sockaddr *, zoneid_t, ip_stack_t *); 85c793af95Ssangeeta static void ire_del_host_redir(ire_t *, char *); 86c793af95Ssangeeta static boolean_t ire_find_best_route(struct radix_node *, void *); 87c793af95Ssangeeta 88c793af95Ssangeeta /* 89c793af95Ssangeeta * Lookup a route in forwarding table. A specific lookup is indicated by 90c793af95Ssangeeta * passing the required parameters and indicating the match required in the 91c793af95Ssangeeta * flag field. 92c793af95Ssangeeta * 93c793af95Ssangeeta * Supports IP_BOUND_IF by following the ipif/ill when recursing. 94c793af95Ssangeeta */ 95c793af95Ssangeeta ire_t * 96bd670b35SErik Nordmark ire_ftable_lookup_v4(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 97bd670b35SErik Nordmark int type, const ill_t *ill, zoneid_t zoneid, const ts_label_t *tsl, 98bd670b35SErik Nordmark int flags, uint32_t xmit_hint, ip_stack_t *ipst, uint_t *generationp) 99c793af95Ssangeeta { 100bd670b35SErik Nordmark ire_t *ire; 101c793af95Ssangeeta struct rt_sockaddr rdst, rmask; 102c793af95Ssangeeta struct rt_entry *rt; 103c793af95Ssangeeta ire_ftable_args_t margs; 104c793af95Ssangeeta 105bd670b35SErik Nordmark ASSERT(ill == NULL || !ill->ill_isv6); 106c793af95Ssangeeta 107c793af95Ssangeeta /* 108bd670b35SErik Nordmark * ire_match_args() will dereference ill if MATCH_IRE_ILL 109bd670b35SErik Nordmark * is set. 110c793af95Ssangeeta */ 11144b099c4SSowmini Varadhan if ((flags & (MATCH_IRE_ILL|MATCH_IRE_SRC_ILL)) && (ill == NULL)) 112c793af95Ssangeeta return (NULL); 113c793af95Ssangeeta 114188e1664SErik Nordmark bzero(&rdst, sizeof (rdst)); 115c793af95Ssangeeta rdst.rt_sin_len = sizeof (rdst); 116c793af95Ssangeeta rdst.rt_sin_family = AF_INET; 117c793af95Ssangeeta rdst.rt_sin_addr.s_addr = addr; 118c793af95Ssangeeta 119188e1664SErik Nordmark bzero(&rmask, sizeof (rmask)); 120c793af95Ssangeeta rmask.rt_sin_len = sizeof (rmask); 121c793af95Ssangeeta rmask.rt_sin_family = AF_INET; 122c793af95Ssangeeta rmask.rt_sin_addr.s_addr = mask; 123c793af95Ssangeeta 124188e1664SErik Nordmark bzero(&margs, sizeof (margs)); 125c793af95Ssangeeta margs.ift_addr = addr; 126c793af95Ssangeeta margs.ift_mask = mask; 127c793af95Ssangeeta margs.ift_gateway = gateway; 128c793af95Ssangeeta margs.ift_type = type; 129bd670b35SErik Nordmark margs.ift_ill = ill; 130c793af95Ssangeeta margs.ift_zoneid = zoneid; 131c793af95Ssangeeta margs.ift_tsl = tsl; 132c793af95Ssangeeta margs.ift_flags = flags; 133c793af95Ssangeeta 134c793af95Ssangeeta /* 135c793af95Ssangeeta * The flags argument passed to ire_ftable_lookup may cause the 136c793af95Ssangeeta * search to return, not the longest matching prefix, but the 137c793af95Ssangeeta * "best matching prefix", i.e., the longest prefix that also 138c793af95Ssangeeta * satisfies constraints imposed via the permutation of flags 139c793af95Ssangeeta * passed in. To achieve this, we invoke ire_match_args() on 140c793af95Ssangeeta * each matching leaf in the radix tree. ire_match_args is 141c793af95Ssangeeta * invoked by the callback function ire_find_best_route() 142c793af95Ssangeeta * We hold the global tree lock in read mode when calling 143c793af95Ssangeeta * rn_match_args. Before dropping the global tree lock, ensure 144c793af95Ssangeeta * that the radix node can't be deleted by incrementing ire_refcnt. 145c793af95Ssangeeta */ 146f4b3ec61Sdh155122 RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 147f4b3ec61Sdh155122 rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst, 148f4b3ec61Sdh155122 ipst->ips_ip_ftable, ire_find_best_route, &margs); 149c793af95Ssangeeta ire = margs.ift_best_ire; 150c793af95Ssangeeta if (rt == NULL) { 151bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 152c793af95Ssangeeta return (NULL); 153c793af95Ssangeeta } 154bd670b35SErik Nordmark ASSERT(ire != NULL); 155c793af95Ssangeeta 156c793af95Ssangeeta DTRACE_PROBE2(ire__found, ire_ftable_args_t *, &margs, ire_t *, ire); 157c793af95Ssangeeta 158c793af95Ssangeeta /* 159c793af95Ssangeeta * round-robin only if we have more than one route in the bucket. 160bd670b35SErik Nordmark * ips_ip_ecmp_behavior controls when we do ECMP 161bd670b35SErik Nordmark * 2: always 162bd670b35SErik Nordmark * 1: for IRE_DEFAULT and /0 IRE_INTERFACE 163bd670b35SErik Nordmark * 0: never 164c793af95Ssangeeta */ 165bd670b35SErik Nordmark if (ire->ire_bucket->irb_ire_cnt > 1 && !(flags & MATCH_IRE_GW)) { 166bd670b35SErik Nordmark if (ipst->ips_ip_ecmp_behavior == 2 || 167bd670b35SErik Nordmark (ipst->ips_ip_ecmp_behavior == 1 && 168bd670b35SErik Nordmark IS_DEFAULT_ROUTE(ire))) { 169c793af95Ssangeeta ire_t *next_ire; 170c793af95Ssangeeta 171bd670b35SErik Nordmark margs.ift_best_ire = NULL; 172bd670b35SErik Nordmark next_ire = ire_round_robin(ire->ire_bucket, &margs, 173bd670b35SErik Nordmark xmit_hint, ire, ipst); 174bd670b35SErik Nordmark if (next_ire == NULL) { 175bd670b35SErik Nordmark /* keep ire if next_ire is null */ 176bd670b35SErik Nordmark goto done; 177bd670b35SErik Nordmark } 178bd670b35SErik Nordmark ire_refrele(ire); 179c793af95Ssangeeta ire = next_ire; 180c793af95Ssangeeta } 181c793af95Ssangeeta } 182c793af95Ssangeeta 183bd670b35SErik Nordmark done: 184bd670b35SErik Nordmark /* Return generation before dropping lock */ 185bd670b35SErik Nordmark if (generationp != NULL) 186bd670b35SErik Nordmark *generationp = ire->ire_generation; 187c793af95Ssangeeta 188bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 189e11c3f44Smeem 190c793af95Ssangeeta /* 191bd670b35SErik Nordmark * For shared-IP zones we need additional checks to what was 192bd670b35SErik Nordmark * done in ire_match_args to make sure IRE_LOCALs are handled. 193bd670b35SErik Nordmark * 194bd670b35SErik Nordmark * When ip_restrict_interzone_loopback is set, then 195bd670b35SErik Nordmark * we ensure that IRE_LOCAL are only used for loopback 196bd670b35SErik Nordmark * between zones when the logical "Ethernet" would 197bd670b35SErik Nordmark * have looped them back. That is, if in the absense of 198bd670b35SErik Nordmark * the IRE_LOCAL we would have sent to packet out the 199bd670b35SErik Nordmark * same ill. 200c793af95Ssangeeta */ 201bd670b35SErik Nordmark if ((ire->ire_type & IRE_LOCAL) && zoneid != ALL_ZONES && 202bd670b35SErik Nordmark ire->ire_zoneid != zoneid && ire->ire_zoneid != ALL_ZONES && 203bd670b35SErik Nordmark ipst->ips_ip_restrict_interzone_loopback) { 204bd670b35SErik Nordmark ire = ire_alt_local(ire, zoneid, tsl, ill, generationp); 205bd670b35SErik Nordmark ASSERT(ire != NULL); 206c793af95Ssangeeta } 207c793af95Ssangeeta return (ire); 208c793af95Ssangeeta } 209c793af95Ssangeeta 210da14cebeSEric Cheng /* 211da14cebeSEric Cheng * This function is called by 212bd670b35SErik Nordmark * ip_input/ire_route_recursive when doing a route lookup on only the 213bd670b35SErik Nordmark * destination address. 214bd670b35SErik Nordmark * 215da14cebeSEric Cheng * The optimizations of this function over ire_ftable_lookup are: 216da14cebeSEric Cheng * o removing unnecessary flag matching 217da14cebeSEric Cheng * o doing longest prefix match instead of overloading it further 218da14cebeSEric Cheng * with the unnecessary "best_prefix_match" 219bd670b35SErik Nordmark * 220bd670b35SErik Nordmark * If no route is found we return IRE_NOROUTE. 221da14cebeSEric Cheng */ 222bd670b35SErik Nordmark ire_t * 223bd670b35SErik Nordmark ire_ftable_lookup_simple_v4(ipaddr_t addr, uint32_t xmit_hint, ip_stack_t *ipst, 224bd670b35SErik Nordmark uint_t *generationp) 225da14cebeSEric Cheng { 226bd670b35SErik Nordmark ire_t *ire; 227da14cebeSEric Cheng struct rt_sockaddr rdst; 228da14cebeSEric Cheng struct rt_entry *rt; 229bd670b35SErik Nordmark irb_t *irb; 230da14cebeSEric Cheng 231da14cebeSEric Cheng rdst.rt_sin_len = sizeof (rdst); 232da14cebeSEric Cheng rdst.rt_sin_family = AF_INET; 233da14cebeSEric Cheng rdst.rt_sin_addr.s_addr = addr; 234da14cebeSEric Cheng 235da14cebeSEric Cheng /* 236da14cebeSEric Cheng * This is basically inlining a simpler version of ire_match_args 237da14cebeSEric Cheng */ 238da14cebeSEric Cheng RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 239da14cebeSEric Cheng 240da14cebeSEric Cheng rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst, 241da14cebeSEric Cheng ipst->ips_ip_ftable, NULL, NULL); 242da14cebeSEric Cheng 243bd670b35SErik Nordmark if (rt == NULL) 244bd670b35SErik Nordmark goto bad; 245bd670b35SErik Nordmark 246bd670b35SErik Nordmark irb = &rt->rt_irb; 247bd670b35SErik Nordmark if (irb->irb_ire_cnt == 0) 248bd670b35SErik Nordmark goto bad; 249bd670b35SErik Nordmark 250bd670b35SErik Nordmark rw_enter(&irb->irb_lock, RW_READER); 251bd670b35SErik Nordmark ire = irb->irb_ire; 252bd670b35SErik Nordmark if (ire == NULL) { 253bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 254bd670b35SErik Nordmark goto bad; 255da14cebeSEric Cheng } 256bd670b35SErik Nordmark while (IRE_IS_CONDEMNED(ire)) { 257bd670b35SErik Nordmark ire = ire->ire_next; 258bd670b35SErik Nordmark if (ire == NULL) { 259bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 260bd670b35SErik Nordmark goto bad; 261bd670b35SErik Nordmark } 262da14cebeSEric Cheng } 263da14cebeSEric Cheng 264da14cebeSEric Cheng /* we have a ire that matches */ 265bd670b35SErik Nordmark ire_refhold(ire); 266bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 267bd670b35SErik Nordmark 268bd670b35SErik Nordmark /* 269bd670b35SErik Nordmark * round-robin only if we have more than one route in the bucket. 270bd670b35SErik Nordmark * ips_ip_ecmp_behavior controls when we do ECMP 271bd670b35SErik Nordmark * 2: always 272bd670b35SErik Nordmark * 1: for IRE_DEFAULT and /0 IRE_INTERFACE 273bd670b35SErik Nordmark * 0: never 274bd670b35SErik Nordmark * 275bd670b35SErik Nordmark * Note: if we found an IRE_IF_CLONE we won't look at the bucket with 276bd670b35SErik Nordmark * other ECMP IRE_INTERFACEs since the IRE_IF_CLONE is a /128 match 277bd670b35SErik Nordmark * and the IRE_INTERFACESs are likely to be shorter matches. 278bd670b35SErik Nordmark */ 279bd670b35SErik Nordmark if (ire->ire_bucket->irb_ire_cnt > 1) { 280bd670b35SErik Nordmark if (ipst->ips_ip_ecmp_behavior == 2 || 281bd670b35SErik Nordmark (ipst->ips_ip_ecmp_behavior == 1 && 282bd670b35SErik Nordmark IS_DEFAULT_ROUTE(ire))) { 283bd670b35SErik Nordmark ire_t *next_ire; 284bd670b35SErik Nordmark ire_ftable_args_t margs; 285bd670b35SErik Nordmark 286188e1664SErik Nordmark bzero(&margs, sizeof (margs)); 287bd670b35SErik Nordmark margs.ift_addr = addr; 288bd670b35SErik Nordmark margs.ift_zoneid = ALL_ZONES; 289bd670b35SErik Nordmark 290bd670b35SErik Nordmark next_ire = ire_round_robin(ire->ire_bucket, &margs, 291bd670b35SErik Nordmark xmit_hint, ire, ipst); 292bd670b35SErik Nordmark if (next_ire == NULL) { 293bd670b35SErik Nordmark /* keep ire if next_ire is null */ 294bd670b35SErik Nordmark if (generationp != NULL) 295bd670b35SErik Nordmark *generationp = ire->ire_generation; 296bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 297bd670b35SErik Nordmark return (ire); 298bd670b35SErik Nordmark } 299bd670b35SErik Nordmark ire_refrele(ire); 300bd670b35SErik Nordmark ire = next_ire; 301bd670b35SErik Nordmark } 302bd670b35SErik Nordmark } 303bd670b35SErik Nordmark /* Return generation before dropping lock */ 304bd670b35SErik Nordmark if (generationp != NULL) 305bd670b35SErik Nordmark *generationp = ire->ire_generation; 306bd670b35SErik Nordmark 307da14cebeSEric Cheng RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 308da14cebeSEric Cheng 309bd670b35SErik Nordmark /* 310bd670b35SErik Nordmark * Since we only did ALL_ZONES matches there is no special handling 311bd670b35SErik Nordmark * of IRE_LOCALs needed here. ire_ftable_lookup_v4 has to handle that. 312bd670b35SErik Nordmark */ 313da14cebeSEric Cheng return (ire); 314da14cebeSEric Cheng 315bd670b35SErik Nordmark bad: 316bd670b35SErik Nordmark if (generationp != NULL) 317bd670b35SErik Nordmark *generationp = IRE_GENERATION_VERIFY; 318da14cebeSEric Cheng 319bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 320bd670b35SErik Nordmark return (ire_reject(ipst, B_FALSE)); 321da14cebeSEric Cheng } 322c793af95Ssangeeta 323c793af95Ssangeeta /* 324bd670b35SErik Nordmark * Find the ill matching a multicast group. 325c793af95Ssangeeta * Allows different routes for multicast addresses 326c793af95Ssangeeta * in the unicast routing table (akin to 224.0.0.0 but could be more specific) 327c793af95Ssangeeta * which point at different interfaces. This is used when IP_MULTICAST_IF 328c793af95Ssangeeta * isn't specified (when sending) and when IP_ADD_MEMBERSHIP doesn't 329c793af95Ssangeeta * specify the interface to join on. 330c793af95Ssangeeta * 331bd670b35SErik Nordmark * Supports link-local addresses by using ire_route_recursive which follows 332bd670b35SErik Nordmark * the ill when recursing. 333bd670b35SErik Nordmark * 334bd670b35SErik Nordmark * To handle CGTP, since we don't have a separate IRE_MULTICAST for each group 335bd670b35SErik Nordmark * and the MULTIRT property can be different for different groups, we 336bd670b35SErik Nordmark * extract RTF_MULTIRT from the special unicast route added for a group 337bd670b35SErik Nordmark * with CGTP and pass that back in the multirtp argument. 338bd670b35SErik Nordmark * This is used in ip_set_destination etc to set ixa_postfragfn for multicast. 339bd670b35SErik Nordmark * We have a setsrcp argument for the same reason. 340c793af95Ssangeeta */ 341bd670b35SErik Nordmark ill_t * 342bd670b35SErik Nordmark ire_lookup_multi_ill_v4(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst, 343bd670b35SErik Nordmark boolean_t *multirtp, ipaddr_t *setsrcp) 344c793af95Ssangeeta { 345c793af95Ssangeeta ire_t *ire; 346bd670b35SErik Nordmark ill_t *ill; 347c793af95Ssangeeta 348bd670b35SErik Nordmark ire = ire_route_recursive_v4(group, 0, NULL, zoneid, NULL, 3499e3469d3SErik Nordmark MATCH_IRE_DSTONLY, IRR_NONE, 0, ipst, setsrcp, NULL, NULL); 350bd670b35SErik Nordmark ASSERT(ire != NULL); 351bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 352c793af95Ssangeeta ire_refrele(ire); 353c793af95Ssangeeta return (NULL); 354c793af95Ssangeeta } 355bd670b35SErik Nordmark 356bd670b35SErik Nordmark if (multirtp != NULL) 357bd670b35SErik Nordmark *multirtp = (ire->ire_flags & RTF_MULTIRT) != 0; 358bd670b35SErik Nordmark 359bd670b35SErik Nordmark ill = ire_nexthop_ill(ire); 360bd670b35SErik Nordmark ire_refrele(ire); 361bd670b35SErik Nordmark return (ill); 362c793af95Ssangeeta } 363c793af95Ssangeeta 364c793af95Ssangeeta /* 365c793af95Ssangeeta * Delete the passed in ire if the gateway addr matches 366c793af95Ssangeeta */ 367c793af95Ssangeeta void 368c793af95Ssangeeta ire_del_host_redir(ire_t *ire, char *gateway) 369c793af95Ssangeeta { 3706bdb8e66Sdd193516 if ((ire->ire_flags & RTF_DYNAMIC) && 371c793af95Ssangeeta (ire->ire_gateway_addr == *(ipaddr_t *)gateway)) 372c793af95Ssangeeta ire_delete(ire); 373c793af95Ssangeeta } 374c793af95Ssangeeta 375c793af95Ssangeeta /* 376bd670b35SErik Nordmark * Search for all IRE_HOST RTF_DYNAMIC (aka redirect) routes that are 377c793af95Ssangeeta * pointing at the specified gateway and 378c793af95Ssangeeta * delete them. This routine is called only 379c793af95Ssangeeta * when a default gateway is going away. 380c793af95Ssangeeta */ 381c793af95Ssangeeta void 382f4b3ec61Sdh155122 ire_delete_host_redirects(ipaddr_t gateway, ip_stack_t *ipst) 383c793af95Ssangeeta { 384c793af95Ssangeeta struct rtfuncarg rtfarg; 385c793af95Ssangeeta 386188e1664SErik Nordmark bzero(&rtfarg, sizeof (rtfarg)); 387c793af95Ssangeeta rtfarg.rt_func = ire_del_host_redir; 388c793af95Ssangeeta rtfarg.rt_arg = (void *)&gateway; 389188e1664SErik Nordmark rtfarg.rt_zoneid = ALL_ZONES; 390188e1664SErik Nordmark rtfarg.rt_ipst = ipst; 391f4b3ec61Sdh155122 (void) ipst->ips_ip_ftable->rnh_walktree_mt(ipst->ips_ip_ftable, 392f4b3ec61Sdh155122 rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn); 393c793af95Ssangeeta } 394c793af95Ssangeeta 395c793af95Ssangeeta /* 396f4b3ec61Sdh155122 * Obtain the rt_entry and rt_irb for the route to be added to 397f4b3ec61Sdh155122 * the ips_ip_ftable. 398c793af95Ssangeeta * First attempt to add a node to the radix tree via rn_addroute. If the 399c793af95Ssangeeta * route already exists, return the bucket for the existing route. 400c793af95Ssangeeta * 401c793af95Ssangeeta * Locking notes: Need to hold the global radix tree lock in write mode to 402c793af95Ssangeeta * add a radix node. To prevent the node from being deleted, ire_get_bucket() 403c793af95Ssangeeta * returns with a ref'ed irb_t. The ire itself is added in ire_add_v4() 404c793af95Ssangeeta * while holding the irb_lock, but not the radix tree lock. 405c793af95Ssangeeta */ 406c793af95Ssangeeta irb_t * 407c793af95Ssangeeta ire_get_bucket(ire_t *ire) 408c793af95Ssangeeta { 409c793af95Ssangeeta struct radix_node *rn; 410c793af95Ssangeeta struct rt_entry *rt; 411c793af95Ssangeeta struct rt_sockaddr rmask, rdst; 412c793af95Ssangeeta irb_t *irb = NULL; 413f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 414c793af95Ssangeeta 415f4b3ec61Sdh155122 ASSERT(ipst->ips_ip_ftable != NULL); 416c793af95Ssangeeta 417c793af95Ssangeeta /* first try to see if route exists (based on rtalloc1) */ 418188e1664SErik Nordmark bzero(&rdst, sizeof (rdst)); 419c793af95Ssangeeta rdst.rt_sin_len = sizeof (rdst); 420c793af95Ssangeeta rdst.rt_sin_family = AF_INET; 421c793af95Ssangeeta rdst.rt_sin_addr.s_addr = ire->ire_addr; 422c793af95Ssangeeta 423188e1664SErik Nordmark bzero(&rmask, sizeof (rmask)); 424c793af95Ssangeeta rmask.rt_sin_len = sizeof (rmask); 425c793af95Ssangeeta rmask.rt_sin_family = AF_INET; 426c793af95Ssangeeta rmask.rt_sin_addr.s_addr = ire->ire_mask; 427c793af95Ssangeeta 428c793af95Ssangeeta /* 429c793af95Ssangeeta * add the route. based on BSD's rtrequest1(RTM_ADD) 430c793af95Ssangeeta */ 431c793af95Ssangeeta R_Malloc(rt, rt_entry_cache, sizeof (*rt)); 43229bc4795Ssangeeta /* kmem_alloc failed */ 43329bc4795Ssangeeta if (rt == NULL) 43429bc4795Ssangeeta return (NULL); 43529bc4795Ssangeeta 436188e1664SErik Nordmark bzero(rt, sizeof (*rt)); 437c793af95Ssangeeta rt->rt_nodes->rn_key = (char *)&rt->rt_dst; 438c793af95Ssangeeta rt->rt_dst = rdst; 439c793af95Ssangeeta irb = &rt->rt_irb; 440bd670b35SErik Nordmark irb->irb_marks |= IRB_MARK_DYNAMIC; /* dynamically allocated/freed */ 441f4b3ec61Sdh155122 irb->irb_ipst = ipst; 442c793af95Ssangeeta rw_init(&irb->irb_lock, NULL, RW_DEFAULT, NULL); 443f4b3ec61Sdh155122 RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable); 444f4b3ec61Sdh155122 rn = ipst->ips_ip_ftable->rnh_addaddr(&rt->rt_dst, &rmask, 445f4b3ec61Sdh155122 ipst->ips_ip_ftable, (struct radix_node *)rt); 446c793af95Ssangeeta if (rn == NULL) { 447f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 448c793af95Ssangeeta Free(rt, rt_entry_cache); 449c793af95Ssangeeta rt = NULL; 450c793af95Ssangeeta irb = NULL; 451f4b3ec61Sdh155122 RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 452f4b3ec61Sdh155122 rn = ipst->ips_ip_ftable->rnh_lookup(&rdst, &rmask, 453f4b3ec61Sdh155122 ipst->ips_ip_ftable); 454f4b3ec61Sdh155122 if (rn != NULL && ((rn->rn_flags & RNF_ROOT) == 0)) { 455c793af95Ssangeeta /* found a non-root match */ 456c793af95Ssangeeta rt = (struct rt_entry *)rn; 457c793af95Ssangeeta } 458c793af95Ssangeeta } 459c793af95Ssangeeta if (rt != NULL) { 460c793af95Ssangeeta irb = &rt->rt_irb; 461bd670b35SErik Nordmark irb_refhold(irb); 462c793af95Ssangeeta } 463f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 464c793af95Ssangeeta return (irb); 465c793af95Ssangeeta } 466c793af95Ssangeeta 467c793af95Ssangeeta /* 468c793af95Ssangeeta * This function is used when the caller wants to know the outbound 469c793af95Ssangeeta * interface for a packet given only the address. 470c793af95Ssangeeta * If this is a offlink IP address and there are multiple 471c793af95Ssangeeta * routes to this destination, this routine will utilise the 472c793af95Ssangeeta * first route it finds to IP address 473c793af95Ssangeeta * Return values: 474c793af95Ssangeeta * 0 - FAILURE 475c793af95Ssangeeta * nonzero - ifindex 476c793af95Ssangeeta */ 477c793af95Ssangeeta uint_t 478c793af95Ssangeeta ifindex_lookup(const struct sockaddr *ipaddr, zoneid_t zoneid) 479c793af95Ssangeeta { 480c793af95Ssangeeta uint_t ifindex = 0; 481c793af95Ssangeeta ire_t *ire; 482c793af95Ssangeeta ill_t *ill; 483f4b3ec61Sdh155122 netstack_t *ns; 484f4b3ec61Sdh155122 ip_stack_t *ipst; 485c793af95Ssangeeta 486f4b3ec61Sdh155122 if (zoneid == ALL_ZONES) 487f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(GLOBAL_ZONEID); 488f4b3ec61Sdh155122 else 489f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(zoneid); 490f4b3ec61Sdh155122 ASSERT(ns != NULL); 491f4b3ec61Sdh155122 492f4b3ec61Sdh155122 /* 493f4b3ec61Sdh155122 * For exclusive stacks we set the zoneid to zero 494f4b3ec61Sdh155122 * since IP uses the global zoneid in the exclusive stacks. 495f4b3ec61Sdh155122 */ 496f4b3ec61Sdh155122 if (ns->netstack_stackid != GLOBAL_NETSTACKID) 497f4b3ec61Sdh155122 zoneid = GLOBAL_ZONEID; 498f4b3ec61Sdh155122 ipst = ns->netstack_ip; 499c793af95Ssangeeta 500c793af95Ssangeeta ASSERT(ipaddr->sa_family == AF_INET || ipaddr->sa_family == AF_INET6); 501c793af95Ssangeeta 502f4b3ec61Sdh155122 if ((ire = route_to_dst(ipaddr, zoneid, ipst)) != NULL) { 503bd670b35SErik Nordmark ill = ire_nexthop_ill(ire); 504bd670b35SErik Nordmark if (ill != NULL) { 505c793af95Ssangeeta ifindex = ill->ill_phyint->phyint_ifindex; 506bd670b35SErik Nordmark ill_refrele(ill); 507bd670b35SErik Nordmark } 508c793af95Ssangeeta ire_refrele(ire); 509c793af95Ssangeeta } 510f4b3ec61Sdh155122 netstack_rele(ns); 511c793af95Ssangeeta return (ifindex); 512c793af95Ssangeeta } 513c793af95Ssangeeta 514c793af95Ssangeeta /* 515c793af95Ssangeeta * Routine to find the route to a destination. If a ifindex is supplied 516bd670b35SErik Nordmark * it tries to match the route to the corresponding ipif for the ifindex 517c793af95Ssangeeta */ 518c793af95Ssangeeta static ire_t * 519f4b3ec61Sdh155122 route_to_dst(const struct sockaddr *dst_addr, zoneid_t zoneid, ip_stack_t *ipst) 520c793af95Ssangeeta { 521c793af95Ssangeeta ire_t *ire = NULL; 522c793af95Ssangeeta int match_flags; 523c793af95Ssangeeta 524bd670b35SErik Nordmark match_flags = MATCH_IRE_DSTONLY; 525c793af95Ssangeeta 526c793af95Ssangeeta /* XXX pass NULL tsl for now */ 527c793af95Ssangeeta 528c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 529bd670b35SErik Nordmark ire = ire_route_recursive_v4( 530bd670b35SErik Nordmark ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr, 0, NULL, 5319e3469d3SErik Nordmark zoneid, NULL, match_flags, IRR_ALLOCATE, 0, ipst, NULL, 5329e3469d3SErik Nordmark NULL, NULL); 533c793af95Ssangeeta } else { 534bd670b35SErik Nordmark ire = ire_route_recursive_v6( 535bd670b35SErik Nordmark &((struct sockaddr_in6 *)dst_addr)->sin6_addr, 0, NULL, 5369e3469d3SErik Nordmark zoneid, NULL, match_flags, IRR_ALLOCATE, 0, ipst, NULL, 5379e3469d3SErik Nordmark NULL, NULL); 538bd670b35SErik Nordmark } 539bd670b35SErik Nordmark ASSERT(ire != NULL); 540bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 541bd670b35SErik Nordmark ire_refrele(ire); 542bd670b35SErik Nordmark return (NULL); 543c793af95Ssangeeta } 544c793af95Ssangeeta return (ire); 545c793af95Ssangeeta } 546c793af95Ssangeeta 547c793af95Ssangeeta /* 548c793af95Ssangeeta * This routine is called by IP Filter to send a packet out on the wire 549bd670b35SErik Nordmark * to a specified dstination (which may be onlink or offlink). The ifindex may 550bd670b35SErik Nordmark * or may not be 0. A non-null ifindex indicates IP Filter has stipulated 551c793af95Ssangeeta * an outgoing interface and requires the nexthop to be on that interface. 552c793af95Ssangeeta * IP WILL NOT DO the following to the data packet before sending it out: 553c793af95Ssangeeta * a. manipulate ttl 554edd26dc5Sdr146992 * b. ipsec work 555edd26dc5Sdr146992 * c. fragmentation 556edd26dc5Sdr146992 * 557edd26dc5Sdr146992 * If the packet has been prepared for hardware checksum then it will be 558edd26dc5Sdr146992 * passed off to ip_send_align_cksum() to check that the flags set on the 559edd26dc5Sdr146992 * packet are in alignment with the capabilities of the new outgoing NIC. 560c793af95Ssangeeta * 561c793af95Ssangeeta * Return values: 562c793af95Ssangeeta * 0: IP was able to send of the data pkt 563c793af95Ssangeeta * ECOMM: Could not send packet 564c793af95Ssangeeta * ENONET No route to dst. It is up to the caller 565c793af95Ssangeeta * to send icmp unreachable error message, 566c793af95Ssangeeta * EINPROGRESS The macaddr of the onlink dst or that 567c793af95Ssangeeta * of the offlink dst's nexthop needs to get 568c793af95Ssangeeta * resolved before packet can be sent to dst. 569c793af95Ssangeeta * Thus transmission is not guaranteed. 570bd670b35SErik Nordmark * Note: No longer have visibility to the ARP queue 571bd670b35SErik Nordmark * hence no EINPROGRESS. 572c793af95Ssangeeta */ 573c793af95Ssangeeta int 574c793af95Ssangeeta ipfil_sendpkt(const struct sockaddr *dst_addr, mblk_t *mp, uint_t ifindex, 575c793af95Ssangeeta zoneid_t zoneid) 576c793af95Ssangeeta { 577bd670b35SErik Nordmark ipaddr_t nexthop; 578f4b3ec61Sdh155122 netstack_t *ns; 579f4b3ec61Sdh155122 ip_stack_t *ipst; 580bd670b35SErik Nordmark ip_xmit_attr_t ixas; 581bd670b35SErik Nordmark int error; 582c793af95Ssangeeta 583c793af95Ssangeeta ASSERT(mp != NULL); 584c793af95Ssangeeta 585f4b3ec61Sdh155122 if (zoneid == ALL_ZONES) 586f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(GLOBAL_ZONEID); 587f4b3ec61Sdh155122 else 588f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(zoneid); 589f4b3ec61Sdh155122 ASSERT(ns != NULL); 590f4b3ec61Sdh155122 591f4b3ec61Sdh155122 /* 592f4b3ec61Sdh155122 * For exclusive stacks we set the zoneid to zero 593f4b3ec61Sdh155122 * since IP uses the global zoneid in the exclusive stacks. 594f4b3ec61Sdh155122 */ 595f4b3ec61Sdh155122 if (ns->netstack_stackid != GLOBAL_NETSTACKID) 596f4b3ec61Sdh155122 zoneid = GLOBAL_ZONEID; 597f4b3ec61Sdh155122 ipst = ns->netstack_ip; 598f4b3ec61Sdh155122 599c793af95Ssangeeta ASSERT(dst_addr->sa_family == AF_INET || 600c793af95Ssangeeta dst_addr->sa_family == AF_INET6); 601c793af95Ssangeeta 602bd670b35SErik Nordmark bzero(&ixas, sizeof (ixas)); 603bd670b35SErik Nordmark /* 604bd670b35SErik Nordmark * No IPsec, no fragmentation, and don't let any hooks see 605bd670b35SErik Nordmark * the packet. 606bd670b35SErik Nordmark */ 607bd670b35SErik Nordmark ixas.ixa_flags = IXAF_NO_IPSEC | IXAF_DONTFRAG | IXAF_NO_PFHOOK; 608bd670b35SErik Nordmark ixas.ixa_cred = kcred; 609bd670b35SErik Nordmark ixas.ixa_cpid = NOPID; 610bd670b35SErik Nordmark ixas.ixa_tsl = NULL; 611bd670b35SErik Nordmark ixas.ixa_ipst = ipst; 612bd670b35SErik Nordmark ixas.ixa_ifindex = ifindex; 613bd670b35SErik Nordmark 614c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 615bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)mp->b_rptr; 616bd670b35SErik Nordmark 617bd670b35SErik Nordmark ixas.ixa_flags |= IXAF_IS_IPV4; 618bd670b35SErik Nordmark nexthop = ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr; 619bd670b35SErik Nordmark if (nexthop != ipha->ipha_dst) { 620bd670b35SErik Nordmark ixas.ixa_flags |= IXAF_NEXTHOP_SET; 621bd670b35SErik Nordmark ixas.ixa_nexthop_v4 = nexthop; 622bd670b35SErik Nordmark } 623bd670b35SErik Nordmark ixas.ixa_multicast_ttl = ipha->ipha_ttl; 624c793af95Ssangeeta } else { 625bd670b35SErik Nordmark ip6_t *ip6h = (ip6_t *)mp->b_rptr; 626bd670b35SErik Nordmark in6_addr_t *nexthop6; 627bd670b35SErik Nordmark 628bd670b35SErik Nordmark nexthop6 = &((struct sockaddr_in6 *)dst_addr)->sin6_addr; 629bd670b35SErik Nordmark if (!IN6_ARE_ADDR_EQUAL(nexthop6, &ip6h->ip6_dst)) { 630bd670b35SErik Nordmark ixas.ixa_flags |= IXAF_NEXTHOP_SET; 631bd670b35SErik Nordmark ixas.ixa_nexthop_v6 = *nexthop6; 632c793af95Ssangeeta } 633bd670b35SErik Nordmark ixas.ixa_multicast_ttl = ip6h->ip6_hops; 634c793af95Ssangeeta } 635bd670b35SErik Nordmark error = ip_output_simple(mp, &ixas); 636bd670b35SErik Nordmark ixa_cleanup(&ixas); 637c793af95Ssangeeta 638f4b3ec61Sdh155122 netstack_rele(ns); 639bd670b35SErik Nordmark switch (error) { 640bd670b35SErik Nordmark case 0: 641bd670b35SErik Nordmark break; 642bd670b35SErik Nordmark 643bd670b35SErik Nordmark case EHOSTUNREACH: 644bd670b35SErik Nordmark case ENETUNREACH: 645bd670b35SErik Nordmark error = ENONET; 646bd670b35SErik Nordmark break; 647bd670b35SErik Nordmark 648bd670b35SErik Nordmark default: 649bd670b35SErik Nordmark error = ECOMM; 650bd670b35SErik Nordmark break; 651c793af95Ssangeeta } 652bd670b35SErik Nordmark return (error); 653edd26dc5Sdr146992 } 654edd26dc5Sdr146992 655c793af95Ssangeeta /* 656c793af95Ssangeeta * callback function provided by ire_ftable_lookup when calling 657c793af95Ssangeeta * rn_match_args(). Invoke ire_match_args on each matching leaf node in 658c793af95Ssangeeta * the radix tree. 659c793af95Ssangeeta */ 660c793af95Ssangeeta boolean_t 661c793af95Ssangeeta ire_find_best_route(struct radix_node *rn, void *arg) 662c793af95Ssangeeta { 663c793af95Ssangeeta struct rt_entry *rt = (struct rt_entry *)rn; 664c793af95Ssangeeta irb_t *irb_ptr; 665c793af95Ssangeeta ire_t *ire; 666c793af95Ssangeeta ire_ftable_args_t *margs = arg; 667c793af95Ssangeeta ipaddr_t match_mask; 668c793af95Ssangeeta 669c793af95Ssangeeta ASSERT(rt != NULL); 670c793af95Ssangeeta 671c793af95Ssangeeta irb_ptr = &rt->rt_irb; 672c793af95Ssangeeta 673c793af95Ssangeeta if (irb_ptr->irb_ire_cnt == 0) 674c793af95Ssangeeta return (B_FALSE); 675c793af95Ssangeeta 676c793af95Ssangeeta rw_enter(&irb_ptr->irb_lock, RW_READER); 677c793af95Ssangeeta for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 678bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire)) 679c793af95Ssangeeta continue; 68044b099c4SSowmini Varadhan ASSERT((margs->ift_flags & MATCH_IRE_SHORTERMASK) == 0); 68144b099c4SSowmini Varadhan if (margs->ift_flags & MATCH_IRE_MASK) 682c793af95Ssangeeta match_mask = margs->ift_mask; 683c793af95Ssangeeta else 684c793af95Ssangeeta match_mask = ire->ire_mask; 685c793af95Ssangeeta 686c793af95Ssangeeta if (ire_match_args(ire, margs->ift_addr, match_mask, 687bd670b35SErik Nordmark margs->ift_gateway, margs->ift_type, margs->ift_ill, 688bd670b35SErik Nordmark margs->ift_zoneid, margs->ift_tsl, 689bd670b35SErik Nordmark margs->ift_flags)) { 690bd670b35SErik Nordmark ire_refhold(ire); 691c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 692c793af95Ssangeeta margs->ift_best_ire = ire; 693c793af95Ssangeeta return (B_TRUE); 694c793af95Ssangeeta } 695c793af95Ssangeeta } 696c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 697c793af95Ssangeeta return (B_FALSE); 698c793af95Ssangeeta } 699c793af95Ssangeeta 700c793af95Ssangeeta /* 701c793af95Ssangeeta * ftable irb_t structures are dynamically allocated, and we need to 702c793af95Ssangeeta * check if the irb_t (and associated ftable tree attachment) needs to 703c793af95Ssangeeta * be cleaned up when the irb_refcnt goes to 0. The conditions that need 704c793af95Ssangeeta * be verified are: 705c793af95Ssangeeta * - no other walkers of the irebucket, i.e., quiescent irb_refcnt, 706c793af95Ssangeeta * - no other threads holding references to ire's in the bucket, 707c793af95Ssangeeta * i.e., irb_nire == 0 708c793af95Ssangeeta * - no active ire's in the bucket, i.e., irb_ire_cnt == 0 709c793af95Ssangeeta * - need to hold the global tree lock and irb_lock in write mode. 710c793af95Ssangeeta */ 711c793af95Ssangeeta void 712c793af95Ssangeeta irb_refrele_ftable(irb_t *irb) 713c793af95Ssangeeta { 714c793af95Ssangeeta for (;;) { 715c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 716c793af95Ssangeeta ASSERT(irb->irb_refcnt != 0); 717c793af95Ssangeeta if (irb->irb_refcnt != 1) { 718c793af95Ssangeeta /* 719c793af95Ssangeeta * Someone has a reference to this radix node 720c793af95Ssangeeta * or there is some bucket walker. 721c793af95Ssangeeta */ 722c793af95Ssangeeta irb->irb_refcnt--; 723c793af95Ssangeeta rw_exit(&irb->irb_lock); 724c793af95Ssangeeta return; 725c793af95Ssangeeta } else { 726c793af95Ssangeeta /* 727c793af95Ssangeeta * There is no other walker, nor is there any 728c793af95Ssangeeta * other thread that holds a direct ref to this 729c793af95Ssangeeta * radix node. Do the clean up if needed. Call 730c793af95Ssangeeta * to ire_unlink will clear the IRB_MARK_CONDEMNED flag 731c793af95Ssangeeta */ 732c793af95Ssangeeta if (irb->irb_marks & IRB_MARK_CONDEMNED) { 733c793af95Ssangeeta ire_t *ire_list; 734c793af95Ssangeeta 735c793af95Ssangeeta ire_list = ire_unlink(irb); 736c793af95Ssangeeta rw_exit(&irb->irb_lock); 737c793af95Ssangeeta 738c793af95Ssangeeta if (ire_list != NULL) 739c793af95Ssangeeta ire_cleanup(ire_list); 740c793af95Ssangeeta /* 741c793af95Ssangeeta * more CONDEMNED entries could have 742c793af95Ssangeeta * been added while we dropped the lock, 743c793af95Ssangeeta * so we have to re-check. 744c793af95Ssangeeta */ 745c793af95Ssangeeta continue; 746c793af95Ssangeeta } 747c793af95Ssangeeta 748c793af95Ssangeeta /* 749c793af95Ssangeeta * Now check if there are still any ires 750c793af95Ssangeeta * associated with this radix node. 751c793af95Ssangeeta */ 752c793af95Ssangeeta if (irb->irb_nire != 0) { 753c793af95Ssangeeta /* 754c793af95Ssangeeta * someone is still holding on 755c793af95Ssangeeta * to ires in this bucket 756c793af95Ssangeeta */ 757c793af95Ssangeeta irb->irb_refcnt--; 758c793af95Ssangeeta rw_exit(&irb->irb_lock); 759c793af95Ssangeeta return; 760c793af95Ssangeeta } else { 761c793af95Ssangeeta /* 762c793af95Ssangeeta * Everything is clear. Zero walkers, 763c793af95Ssangeeta * Zero threads with a ref to this 764c793af95Ssangeeta * radix node, Zero ires associated with 765c793af95Ssangeeta * this radix node. Due to lock order, 766c793af95Ssangeeta * check the above conditions again 767c793af95Ssangeeta * after grabbing all locks in the right order 768c793af95Ssangeeta */ 769c793af95Ssangeeta rw_exit(&irb->irb_lock); 770c793af95Ssangeeta if (irb_inactive(irb)) 771c793af95Ssangeeta return; 772c793af95Ssangeeta /* 773c793af95Ssangeeta * irb_inactive could not free the irb. 774c793af95Ssangeeta * See if there are any walkers, if not 775c793af95Ssangeeta * try to clean up again. 776c793af95Ssangeeta */ 777c793af95Ssangeeta } 778c793af95Ssangeeta } 779c793af95Ssangeeta } 780c793af95Ssangeeta } 781c793af95Ssangeeta 782c793af95Ssangeeta /* 783bd670b35SErik Nordmark * IRE iterator used by ire_ftable_lookup to process multiple equal 784bd670b35SErik Nordmark * routes. Given a starting point in the hash list (hash), walk the IREs 785bd670b35SErik Nordmark * in the bucket skipping deleted entries. We treat the bucket as a circular 786bd670b35SErik Nordmark * list for the purposes of walking it. 787bd670b35SErik Nordmark * Returns the IRE (held) that corresponds to the hash value. If that IRE is 788bd670b35SErik Nordmark * not applicable (ire_match_args failed) then it returns a subsequent one. 789bd670b35SErik Nordmark * If we fail to find an IRE we return NULL. 790c793af95Ssangeeta * 791bd670b35SErik Nordmark * Assumes that the caller holds a reference on the IRE bucket and a read lock 792bd670b35SErik Nordmark * on the radix_node_head (for IPv4) or the ip6_ire_head (for IPv6). 793bd670b35SErik Nordmark * 794bd670b35SErik Nordmark * Applies to IPv4 and IPv6. 795bd670b35SErik Nordmark * 796bd670b35SErik Nordmark * For CGTP, where an IRE_BROADCAST and IRE_HOST can exist for the same 797bd670b35SErik Nordmark * address and bucket, we compare against ire_type for the orig_ire. We also 798bd670b35SErik Nordmark * have IRE_BROADCASTs with and without RTF_MULTIRT, with the former being 799188e1664SErik Nordmark * first in the bucket. Thus we compare that RTF_MULTIRT match the orig_ire. 800bd670b35SErik Nordmark * 801bd670b35SErik Nordmark * Due to shared-IP zones we check that an IRE_OFFLINK has a gateway that is 802bd670b35SErik Nordmark * reachable from the zone i.e., that the ire_gateway_addr is in a subnet 803bd670b35SErik Nordmark * in which the zone has an IP address. We check this for the global zone 804bd670b35SErik Nordmark * even if no shared-IP zones are configured. 805c793af95Ssangeeta */ 806c793af95Ssangeeta ire_t * 807bd670b35SErik Nordmark ire_round_robin(irb_t *irb_ptr, ire_ftable_args_t *margs, uint_t hash, 808bd670b35SErik Nordmark ire_t *orig_ire, ip_stack_t *ipst) 809c793af95Ssangeeta { 810c793af95Ssangeeta ire_t *ire, *maybe_ire = NULL; 811bd670b35SErik Nordmark uint_t maybe_badcnt; 812bd670b35SErik Nordmark uint_t maxwalk; 813bd670b35SErik Nordmark 814bd670b35SErik Nordmark /* Fold in more bits from the hint/hash */ 815bd670b35SErik Nordmark hash = hash ^ (hash >> 8) ^ (hash >> 16); 816c793af95Ssangeeta 817c793af95Ssangeeta rw_enter(&irb_ptr->irb_lock, RW_WRITER); 818bd670b35SErik Nordmark maxwalk = irb_ptr->irb_ire_cnt; /* Excludes condemned */ 819bd670b35SErik Nordmark hash %= maxwalk; 820bd670b35SErik Nordmark irb_refhold_locked(irb_ptr); 821c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 822c793af95Ssangeeta 823c793af95Ssangeeta /* 824c793af95Ssangeeta * Round-robin the routers list looking for a route that 825c793af95Ssangeeta * matches the passed in parameters. 826bd670b35SErik Nordmark * First we skip "hash" number of non-condemned IREs. 827bd670b35SErik Nordmark * Then we match the IRE. 828bd670b35SErik Nordmark * If we find an ire which has a non-zero ire_badcnt then we remember 829bd670b35SErik Nordmark * it and keep on looking for a lower ire_badcnt. 830bd670b35SErik Nordmark * If we come to the end of the list we continue (treat the 831bd670b35SErik Nordmark * bucket list as a circular list) but we match less than "max" 832bd670b35SErik Nordmark * entries. 833c793af95Ssangeeta */ 834bd670b35SErik Nordmark ire = irb_ptr->irb_ire; 835bd670b35SErik Nordmark while (maxwalk > 0) { 836bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire)) 837bd670b35SErik Nordmark goto next_ire_skip; 838c793af95Ssangeeta 839bd670b35SErik Nordmark /* Skip the first "hash" entries to do ECMP */ 840bd670b35SErik Nordmark if (hash != 0) { 841bd670b35SErik Nordmark hash--; 842bd670b35SErik Nordmark goto next_ire_skip; 843bd670b35SErik Nordmark } 844bd670b35SErik Nordmark 845bd670b35SErik Nordmark /* See CGTP comment above */ 846bd670b35SErik Nordmark if (ire->ire_type != orig_ire->ire_type || 847188e1664SErik Nordmark ((ire->ire_flags ^ orig_ire->ire_flags) & RTF_MULTIRT) != 0) 848c793af95Ssangeeta goto next_ire; 849c793af95Ssangeeta 850c793af95Ssangeeta /* 851bd670b35SErik Nordmark * Note: Since IPv6 has hash buckets instead of radix 852bd670b35SErik Nordmark * buckers we need to explicitly compare the addresses. 853bd670b35SErik Nordmark * That makes this less efficient since we will be called 854bd670b35SErik Nordmark * even if there is no alternatives just because the 855bd670b35SErik Nordmark * bucket has multiple IREs for different addresses. 856c793af95Ssangeeta */ 857bd670b35SErik Nordmark if (ire->ire_ipversion == IPV6_VERSION) { 858bd670b35SErik Nordmark if (!IN6_ARE_ADDR_EQUAL(&orig_ire->ire_addr_v6, 859bd670b35SErik Nordmark &ire->ire_addr_v6)) 860c793af95Ssangeeta goto next_ire; 861c793af95Ssangeeta } 862c793af95Ssangeeta 863c793af95Ssangeeta /* 864bd670b35SErik Nordmark * For some reason find_best_route uses ire_mask. We do 865bd670b35SErik Nordmark * the same. 866bd670b35SErik Nordmark */ 867bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION ? 868bd670b35SErik Nordmark !ire_match_args(ire, margs->ift_addr, 869bd670b35SErik Nordmark ire->ire_mask, margs->ift_gateway, 870bd670b35SErik Nordmark margs->ift_type, margs->ift_ill, margs->ift_zoneid, 871bd670b35SErik Nordmark margs->ift_tsl, margs->ift_flags) : 872bd670b35SErik Nordmark !ire_match_args_v6(ire, &margs->ift_addr_v6, 873bd670b35SErik Nordmark &ire->ire_mask_v6, &margs->ift_gateway_v6, 874bd670b35SErik Nordmark margs->ift_type, margs->ift_ill, margs->ift_zoneid, 875bd670b35SErik Nordmark margs->ift_tsl, margs->ift_flags)) 876bd670b35SErik Nordmark goto next_ire; 877bd670b35SErik Nordmark 878bd670b35SErik Nordmark if (margs->ift_zoneid != ALL_ZONES && 879bd670b35SErik Nordmark (ire->ire_type & IRE_OFFLINK)) { 880bd670b35SErik Nordmark /* 881bd670b35SErik Nordmark * When we're in a zone, we're only 882c793af95Ssangeeta * interested in routers that are 883c793af95Ssangeeta * reachable through ipifs within our zone. 884c793af95Ssangeeta */ 885bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 886bd670b35SErik Nordmark if (!ire_gateway_ok_zone_v4( 887bd670b35SErik Nordmark ire->ire_gateway_addr, margs->ift_zoneid, 888bd670b35SErik Nordmark ire->ire_ill, margs->ift_tsl, ipst, 889bd670b35SErik Nordmark B_TRUE)) 890bd670b35SErik Nordmark goto next_ire; 891bd670b35SErik Nordmark } else { 892bd670b35SErik Nordmark if (!ire_gateway_ok_zone_v6( 893bd670b35SErik Nordmark &ire->ire_gateway_addr_v6, 894bd670b35SErik Nordmark margs->ift_zoneid, ire->ire_ill, 895bd670b35SErik Nordmark margs->ift_tsl, ipst, B_TRUE)) 896bd670b35SErik Nordmark goto next_ire; 897bd670b35SErik Nordmark } 898bd670b35SErik Nordmark } 899bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 900bd670b35SErik Nordmark /* Look for stale ire_badcnt and clear */ 901bd670b35SErik Nordmark if (ire->ire_badcnt != 0 && 902d3d50737SRafael Vanoni (TICK_TO_SEC(ddi_get_lbolt64()) - ire->ire_last_badcnt > 903bd670b35SErik Nordmark ipst->ips_ip_ire_badcnt_lifetime)) 904bd670b35SErik Nordmark ire->ire_badcnt = 0; 905bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 906e11c3f44Smeem 907bd670b35SErik Nordmark if (ire->ire_badcnt == 0) { 908bd670b35SErik Nordmark /* We found one with a zero badcnt; done */ 909bd670b35SErik Nordmark ire_refhold(ire); 910bd670b35SErik Nordmark /* 911bd670b35SErik Nordmark * Care needed since irb_refrele grabs WLOCK to free 912bd670b35SErik Nordmark * the irb_t. 913bd670b35SErik Nordmark */ 914bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 915bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 916bd670b35SErik Nordmark irb_refrele(irb_ptr); 917bd670b35SErik Nordmark RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 918bd670b35SErik Nordmark } else { 919bd670b35SErik Nordmark rw_exit(&ipst->ips_ip6_ire_head_lock); 920bd670b35SErik Nordmark irb_refrele(irb_ptr); 921bd670b35SErik Nordmark rw_enter(&ipst->ips_ip6_ire_head_lock, 922bd670b35SErik Nordmark RW_READER); 923bd670b35SErik Nordmark } 924c793af95Ssangeeta return (ire); 925c793af95Ssangeeta } 926bd670b35SErik Nordmark /* 927bd670b35SErik Nordmark * keep looking to see if there is a better (lower 928bd670b35SErik Nordmark * badcnt) matching IRE, but save this one as a last resort. 929bd670b35SErik Nordmark * If we find a lower badcnt pick that one as the last* resort. 930bd670b35SErik Nordmark */ 931bd670b35SErik Nordmark if (maybe_ire == NULL) { 932bd670b35SErik Nordmark maybe_ire = ire; 933bd670b35SErik Nordmark maybe_badcnt = ire->ire_badcnt; 934bd670b35SErik Nordmark } else if (ire->ire_badcnt < maybe_badcnt) { 935bd670b35SErik Nordmark maybe_ire = ire; 936bd670b35SErik Nordmark maybe_badcnt = ire->ire_badcnt; 937bd670b35SErik Nordmark } 938bd670b35SErik Nordmark 939c793af95Ssangeeta next_ire: 940bd670b35SErik Nordmark maxwalk--; 941bd670b35SErik Nordmark next_ire_skip: 942bd670b35SErik Nordmark ire = ire->ire_next; 943bd670b35SErik Nordmark if (ire == NULL) 944bd670b35SErik Nordmark ire = irb_ptr->irb_ire; 945c793af95Ssangeeta } 946c793af95Ssangeeta if (maybe_ire != NULL) 947bd670b35SErik Nordmark ire_refhold(maybe_ire); 948bd670b35SErik Nordmark 949bd670b35SErik Nordmark /* Care needed since irb_refrele grabs WLOCK to free the irb_t. */ 950bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 951bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 952bd670b35SErik Nordmark irb_refrele(irb_ptr); 953bd670b35SErik Nordmark RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 954bd670b35SErik Nordmark } else { 955bd670b35SErik Nordmark rw_exit(&ipst->ips_ip6_ire_head_lock); 956bd670b35SErik Nordmark irb_refrele(irb_ptr); 957bd670b35SErik Nordmark rw_enter(&ipst->ips_ip6_ire_head_lock, RW_READER); 958bd670b35SErik Nordmark } 959c793af95Ssangeeta return (maybe_ire); 960c793af95Ssangeeta } 9612679e103Ssowmini 9622679e103Ssowmini void 9632679e103Ssowmini irb_refhold_rn(struct radix_node *rn) 9642679e103Ssowmini { 9652679e103Ssowmini if ((rn->rn_flags & RNF_ROOT) == 0) 966bd670b35SErik Nordmark irb_refhold(&((rt_t *)(rn))->rt_irb); 9672679e103Ssowmini } 9682679e103Ssowmini 9692679e103Ssowmini void 9702679e103Ssowmini irb_refrele_rn(struct radix_node *rn) 9712679e103Ssowmini { 9722679e103Ssowmini if ((rn->rn_flags & RNF_ROOT) == 0) 9732679e103Ssowmini irb_refrele_ftable(&((rt_t *)(rn))->rt_irb); 9742679e103Ssowmini } 975bd670b35SErik Nordmark 97644b099c4SSowmini Varadhan 97744b099c4SSowmini Varadhan /* 97844b099c4SSowmini Varadhan * ip_select_src_ill() is used by ip_select_route() to find the src_ill 97944b099c4SSowmini Varadhan * to be used for source-aware routing table lookup. This function will 98044b099c4SSowmini Varadhan * ignore IPIF_UNNUMBERED interface addresses, and will only return a 98144b099c4SSowmini Varadhan * numbered interface (ipif_lookup_addr_nondup() will ignore UNNUMBERED 98244b099c4SSowmini Varadhan * interfaces). 98344b099c4SSowmini Varadhan */ 98444b099c4SSowmini Varadhan static ill_t * 98544b099c4SSowmini Varadhan ip_select_src_ill(const in6_addr_t *v6src, zoneid_t zoneid, ip_stack_t *ipst) 98644b099c4SSowmini Varadhan { 98744b099c4SSowmini Varadhan ipif_t *ipif; 98844b099c4SSowmini Varadhan ill_t *ill; 98944b099c4SSowmini Varadhan boolean_t isv6 = !IN6_IS_ADDR_V4MAPPED(v6src); 99044b099c4SSowmini Varadhan ipaddr_t v4src; 99144b099c4SSowmini Varadhan 99244b099c4SSowmini Varadhan if (isv6) { 99344b099c4SSowmini Varadhan ipif = ipif_lookup_addr_nondup_v6(v6src, NULL, zoneid, ipst); 99444b099c4SSowmini Varadhan } else { 99544b099c4SSowmini Varadhan IN6_V4MAPPED_TO_IPADDR(v6src, v4src); 99644b099c4SSowmini Varadhan ipif = ipif_lookup_addr_nondup(v4src, NULL, zoneid, ipst); 99744b099c4SSowmini Varadhan } 99844b099c4SSowmini Varadhan if (ipif == NULL) 99944b099c4SSowmini Varadhan return (NULL); 100044b099c4SSowmini Varadhan ill = ipif->ipif_ill; 100144b099c4SSowmini Varadhan ill_refhold(ill); 100244b099c4SSowmini Varadhan ipif_refrele(ipif); 100344b099c4SSowmini Varadhan return (ill); 100444b099c4SSowmini Varadhan } 100544b099c4SSowmini Varadhan 100644b099c4SSowmini Varadhan /* 100744b099c4SSowmini Varadhan * verify that v6src is configured on ill 100844b099c4SSowmini Varadhan */ 100944b099c4SSowmini Varadhan static boolean_t 101044b099c4SSowmini Varadhan ip_verify_src_on_ill(const in6_addr_t v6src, ill_t *ill, zoneid_t zoneid) 101144b099c4SSowmini Varadhan { 101244b099c4SSowmini Varadhan ipif_t *ipif; 101344b099c4SSowmini Varadhan ip_stack_t *ipst; 101444b099c4SSowmini Varadhan ipaddr_t v4src; 101544b099c4SSowmini Varadhan 101644b099c4SSowmini Varadhan if (ill == NULL) 101744b099c4SSowmini Varadhan return (B_FALSE); 101844b099c4SSowmini Varadhan ipst = ill->ill_ipst; 101944b099c4SSowmini Varadhan 102044b099c4SSowmini Varadhan if (ill->ill_isv6) { 102144b099c4SSowmini Varadhan ipif = ipif_lookup_addr_nondup_v6(&v6src, ill, zoneid, ipst); 102244b099c4SSowmini Varadhan } else { 102344b099c4SSowmini Varadhan IN6_V4MAPPED_TO_IPADDR(&v6src, v4src); 102444b099c4SSowmini Varadhan ipif = ipif_lookup_addr_nondup(v4src, ill, zoneid, ipst); 102544b099c4SSowmini Varadhan } 102644b099c4SSowmini Varadhan 102744b099c4SSowmini Varadhan if (ipif != NULL) { 102844b099c4SSowmini Varadhan ipif_refrele(ipif); 102944b099c4SSowmini Varadhan return (B_TRUE); 103044b099c4SSowmini Varadhan } else { 103144b099c4SSowmini Varadhan return (B_FALSE); 103244b099c4SSowmini Varadhan } 103344b099c4SSowmini Varadhan } 103444b099c4SSowmini Varadhan 1035bd670b35SErik Nordmark /* 1036bd670b35SErik Nordmark * Select a route for IPv4 and IPv6. Except for multicast, loopback and reject 1037bd670b35SErik Nordmark * routes this routine sets up a ire_nce_cache as well. The caller needs to 1038bd670b35SErik Nordmark * lookup an nce for the multicast case. 103944b099c4SSowmini Varadhan * 104044b099c4SSowmini Varadhan * When src_multihoming is set to 2 (strict src multihoming) we use the source 104144b099c4SSowmini Varadhan * address to select the interface and route. If IP_BOUND_IF etc are 104244b099c4SSowmini Varadhan * specified, we require that they specify an interface on which the 104344b099c4SSowmini Varadhan * source address is assigned. 104444b099c4SSowmini Varadhan * 104544b099c4SSowmini Varadhan * When src_multihoming is set to 1 (preferred src aware route 104644b099c4SSowmini Varadhan * selection) the unicast lookup prefers a matching source 104744b099c4SSowmini Varadhan * (i.e., that the route points out an ill on which the source is assigned), but 104844b099c4SSowmini Varadhan * if no such route is found we fallback to not considering the source in the 104944b099c4SSowmini Varadhan * route lookup. 105044b099c4SSowmini Varadhan * 105144b099c4SSowmini Varadhan * We skip the src_multihoming check when the source isn't (yet) set, and 105244b099c4SSowmini Varadhan * when IXAF_VERIFY_SOURCE is not set. The latter allows RAW sockets to send 105344b099c4SSowmini Varadhan * with bogus source addresses as allowed by IP_HDRINCL and IPV6_PKTINFO 105444b099c4SSowmini Varadhan * when secpolicy_net_rawaccess(). 1055bd670b35SErik Nordmark */ 1056bd670b35SErik Nordmark ire_t * 105744b099c4SSowmini Varadhan ip_select_route(const in6_addr_t *v6dst, const in6_addr_t v6src, 105844b099c4SSowmini Varadhan ip_xmit_attr_t *ixa, uint_t *generationp, in6_addr_t *setsrcp, 105944b099c4SSowmini Varadhan int *errorp, boolean_t *multirtp) 1060bd670b35SErik Nordmark { 1061bd670b35SErik Nordmark uint_t match_args; 1062bd670b35SErik Nordmark uint_t ire_type; 106344b099c4SSowmini Varadhan ill_t *ill = NULL; 1064bd670b35SErik Nordmark ire_t *ire; 1065bd670b35SErik Nordmark ip_stack_t *ipst = ixa->ixa_ipst; 1066bd670b35SErik Nordmark ipaddr_t v4dst; 1067bd670b35SErik Nordmark in6_addr_t v6nexthop; 1068bd670b35SErik Nordmark iaflags_t ixaflags = ixa->ixa_flags; 1069bd670b35SErik Nordmark nce_t *nce; 107044b099c4SSowmini Varadhan boolean_t preferred_src_aware = B_FALSE; 107144b099c4SSowmini Varadhan boolean_t verify_src; 107244b099c4SSowmini Varadhan boolean_t isv6 = !(ixa->ixa_flags & IXAF_IS_IPV4); 107344b099c4SSowmini Varadhan int src_multihoming = IP_SRC_MULTIHOMING(isv6, ipst); 107444b099c4SSowmini Varadhan 107544b099c4SSowmini Varadhan /* 107644b099c4SSowmini Varadhan * We only verify that the src has been configured on a selected 107744b099c4SSowmini Varadhan * interface if the src is not :: or INADDR_ANY, and if the 107844b099c4SSowmini Varadhan * IXAF_VERIFY_SOURCE flag is set. 107944b099c4SSowmini Varadhan */ 108044b099c4SSowmini Varadhan verify_src = (!V6_OR_V4_INADDR_ANY(v6src) && 108144b099c4SSowmini Varadhan (ixa->ixa_flags & IXAF_VERIFY_SOURCE)); 1082bd670b35SErik Nordmark 1083bd670b35SErik Nordmark match_args = MATCH_IRE_SECATTR; 1084bd670b35SErik Nordmark IN6_V4MAPPED_TO_IPADDR(v6dst, v4dst); 1085bd670b35SErik Nordmark if (setsrcp != NULL) 1086bd670b35SErik Nordmark ASSERT(IN6_IS_ADDR_UNSPECIFIED(setsrcp)); 1087bd670b35SErik Nordmark if (errorp != NULL) 1088bd670b35SErik Nordmark ASSERT(*errorp == 0); 1089bd670b35SErik Nordmark 1090bd670b35SErik Nordmark /* 1091bd670b35SErik Nordmark * The content of the ixa will be different if IP_NEXTHOP, 1092bd670b35SErik Nordmark * SO_DONTROUTE, IP_BOUND_IF, IP_PKTINFO etc are set 1093bd670b35SErik Nordmark */ 1094bd670b35SErik Nordmark 109544b099c4SSowmini Varadhan if (isv6 ? IN6_IS_ADDR_MULTICAST(v6dst) : CLASSD(v4dst)) { 1096bd670b35SErik Nordmark /* Pick up the IRE_MULTICAST for the ill */ 1097bd670b35SErik Nordmark if (ixa->ixa_multicast_ifindex != 0) { 1098bd670b35SErik Nordmark ill = ill_lookup_on_ifindex(ixa->ixa_multicast_ifindex, 109944b099c4SSowmini Varadhan isv6, ipst); 1100bd670b35SErik Nordmark } else if (ixaflags & IXAF_SCOPEID_SET) { 1101bd670b35SErik Nordmark /* sin6_scope_id takes precedence over ixa_ifindex */ 1102bd670b35SErik Nordmark ASSERT(ixa->ixa_scopeid != 0); 1103bd670b35SErik Nordmark ill = ill_lookup_on_ifindex(ixa->ixa_scopeid, 110444b099c4SSowmini Varadhan isv6, ipst); 1105bd670b35SErik Nordmark } else if (ixa->ixa_ifindex != 0) { 1106bd670b35SErik Nordmark /* 1107bd670b35SErik Nordmark * In the ipmp case, the ixa_ifindex is set to 1108bd670b35SErik Nordmark * point at an under_ill and we would return the 1109bd670b35SErik Nordmark * ire_multicast() corresponding to that under_ill. 1110bd670b35SErik Nordmark */ 1111bd670b35SErik Nordmark ill = ill_lookup_on_ifindex(ixa->ixa_ifindex, 111244b099c4SSowmini Varadhan isv6, ipst); 111344b099c4SSowmini Varadhan } else if (src_multihoming != 0 && verify_src) { 111444b099c4SSowmini Varadhan /* Look up the ill based on the source address */ 111544b099c4SSowmini Varadhan ill = ip_select_src_ill(&v6src, ixa->ixa_zoneid, ipst); 111644b099c4SSowmini Varadhan /* 111744b099c4SSowmini Varadhan * Since we looked up the ill from the source there 111844b099c4SSowmini Varadhan * is no need to verify that the source is on the ill 111944b099c4SSowmini Varadhan * below. 112044b099c4SSowmini Varadhan */ 112144b099c4SSowmini Varadhan verify_src = B_FALSE; 112244b099c4SSowmini Varadhan if (ill != NULL && IS_VNI(ill)) { 112344b099c4SSowmini Varadhan ill_t *usesrc = ill; 112444b099c4SSowmini Varadhan 112544b099c4SSowmini Varadhan ill = ill_lookup_usesrc(usesrc); 112644b099c4SSowmini Varadhan ill_refrele(usesrc); 112744b099c4SSowmini Varadhan } 112844b099c4SSowmini Varadhan } else if (!isv6) { 1129bd670b35SErik Nordmark ipaddr_t v4setsrc = INADDR_ANY; 1130bd670b35SErik Nordmark 113144b099c4SSowmini Varadhan ill = ill_lookup_group_v4(v4dst, ixa->ixa_zoneid, 113244b099c4SSowmini Varadhan ipst, multirtp, &v4setsrc); 1133bd670b35SErik Nordmark if (setsrcp != NULL) 1134bd670b35SErik Nordmark IN6_IPADDR_TO_V4MAPPED(v4setsrc, setsrcp); 1135bd670b35SErik Nordmark } else { 113644b099c4SSowmini Varadhan ill = ill_lookup_group_v6(v6dst, ixa->ixa_zoneid, 113744b099c4SSowmini Varadhan ipst, multirtp, setsrcp); 1138bd670b35SErik Nordmark } 1139bd670b35SErik Nordmark if (ill != NULL && IS_VNI(ill)) { 1140bd670b35SErik Nordmark ill_refrele(ill); 1141bd670b35SErik Nordmark ill = NULL; 1142bd670b35SErik Nordmark } 1143bd670b35SErik Nordmark if (ill == NULL) { 1144bd670b35SErik Nordmark if (errorp != NULL) 1145bd670b35SErik Nordmark *errorp = ENXIO; 1146bd670b35SErik Nordmark /* Get a hold on the IRE_NOROUTE */ 114744b099c4SSowmini Varadhan ire = ire_reject(ipst, isv6); 1148bd670b35SErik Nordmark return (ire); 1149bd670b35SErik Nordmark } 1150bd670b35SErik Nordmark if (!(ill->ill_flags & ILLF_MULTICAST)) { 1151bd670b35SErik Nordmark ill_refrele(ill); 1152bd670b35SErik Nordmark if (errorp != NULL) 1153bd670b35SErik Nordmark *errorp = EHOSTUNREACH; 1154bd670b35SErik Nordmark /* Get a hold on the IRE_NOROUTE */ 115544b099c4SSowmini Varadhan ire = ire_reject(ipst, isv6); 115644b099c4SSowmini Varadhan return (ire); 115744b099c4SSowmini Varadhan } 115844b099c4SSowmini Varadhan /* 115944b099c4SSowmini Varadhan * If we are doing the strictest src_multihoming, then 116044b099c4SSowmini Varadhan * we check that IP_MULTICAST_IF, IP_BOUND_IF, etc specify 116144b099c4SSowmini Varadhan * an interface that is consistent with the source address. 116244b099c4SSowmini Varadhan */ 116344b099c4SSowmini Varadhan if (verify_src && src_multihoming == 2 && 116444b099c4SSowmini Varadhan !ip_verify_src_on_ill(v6src, ill, ixa->ixa_zoneid)) { 116544b099c4SSowmini Varadhan if (errorp != NULL) 116644b099c4SSowmini Varadhan *errorp = EADDRNOTAVAIL; 116744b099c4SSowmini Varadhan ill_refrele(ill); 116844b099c4SSowmini Varadhan /* Get a hold on the IRE_NOROUTE */ 116944b099c4SSowmini Varadhan ire = ire_reject(ipst, isv6); 1170bd670b35SErik Nordmark return (ire); 1171bd670b35SErik Nordmark } 1172bd670b35SErik Nordmark /* Get a refcnt on the single IRE_MULTICAST per ill */ 1173bd670b35SErik Nordmark ire = ire_multicast(ill); 1174bd670b35SErik Nordmark ill_refrele(ill); 1175bd670b35SErik Nordmark if (generationp != NULL) 1176bd670b35SErik Nordmark *generationp = ire->ire_generation; 1177bd670b35SErik Nordmark if (errorp != NULL && 1178bd670b35SErik Nordmark (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))) { 1179bd670b35SErik Nordmark *errorp = EHOSTUNREACH; 1180bd670b35SErik Nordmark } 1181bd670b35SErik Nordmark return (ire); 1182bd670b35SErik Nordmark } 1183bd670b35SErik Nordmark 118444b099c4SSowmini Varadhan /* Now for unicast */ 1185bd670b35SErik Nordmark if (ixa->ixa_ifindex != 0 || (ixaflags & IXAF_SCOPEID_SET)) { 1186bd670b35SErik Nordmark if (ixaflags & IXAF_SCOPEID_SET) { 1187bd670b35SErik Nordmark /* sin6_scope_id takes precedence over ixa_ifindex */ 1188bd670b35SErik Nordmark ASSERT(ixa->ixa_scopeid != 0); 1189bd670b35SErik Nordmark ill = ill_lookup_on_ifindex(ixa->ixa_scopeid, 119044b099c4SSowmini Varadhan isv6, ipst); 1191bd670b35SErik Nordmark } else { 1192bd670b35SErik Nordmark ASSERT(ixa->ixa_ifindex != 0); 1193bd670b35SErik Nordmark ill = ill_lookup_on_ifindex(ixa->ixa_ifindex, 119444b099c4SSowmini Varadhan isv6, ipst); 1195bd670b35SErik Nordmark } 1196bd670b35SErik Nordmark if (ill != NULL && IS_VNI(ill)) { 1197bd670b35SErik Nordmark ill_refrele(ill); 1198bd670b35SErik Nordmark ill = NULL; 1199bd670b35SErik Nordmark } 1200bd670b35SErik Nordmark if (ill == NULL) { 1201bd670b35SErik Nordmark if (errorp != NULL) 1202bd670b35SErik Nordmark *errorp = ENXIO; 1203bd670b35SErik Nordmark /* Get a hold on the IRE_NOROUTE */ 120444b099c4SSowmini Varadhan ire = ire_reject(ipst, isv6); 1205bd670b35SErik Nordmark return (ire); 1206bd670b35SErik Nordmark } 120744b099c4SSowmini Varadhan 120844b099c4SSowmini Varadhan match_args |= MATCH_IRE_ILL; 120944b099c4SSowmini Varadhan 1210bd670b35SErik Nordmark /* 1211bd670b35SErik Nordmark * icmp_send_reply_v6 uses scopeid, and mpathd sets IP*_BOUND_IF 1212bd670b35SErik Nordmark * so for both of them we need to be able look for an under 1213bd670b35SErik Nordmark * interface. 1214bd670b35SErik Nordmark */ 1215bd670b35SErik Nordmark if (IS_UNDER_IPMP(ill)) 1216bd670b35SErik Nordmark match_args |= MATCH_IRE_TESTHIDDEN; 121744b099c4SSowmini Varadhan 121844b099c4SSowmini Varadhan /* 121944b099c4SSowmini Varadhan * If we are doing the strictest src_multihoming, then 122044b099c4SSowmini Varadhan * we check that IP_BOUND_IF, IP_PKTINFO, etc specify 122144b099c4SSowmini Varadhan * an interface that is consistent with the source address. 122244b099c4SSowmini Varadhan */ 122344b099c4SSowmini Varadhan if (src_multihoming == 2 && 122444b099c4SSowmini Varadhan !ip_verify_src_on_ill(v6src, ill, ixa->ixa_zoneid)) { 122544b099c4SSowmini Varadhan if (errorp != NULL) 122644b099c4SSowmini Varadhan *errorp = EADDRNOTAVAIL; 122744b099c4SSowmini Varadhan ill_refrele(ill); 122844b099c4SSowmini Varadhan /* Get a hold on the IRE_NOROUTE */ 122944b099c4SSowmini Varadhan ire = ire_reject(ipst, isv6); 123044b099c4SSowmini Varadhan return (ire); 123144b099c4SSowmini Varadhan } 123244b099c4SSowmini Varadhan } else if (src_multihoming != 0 && verify_src) { 123344b099c4SSowmini Varadhan /* Look up the ill based on the source address */ 123444b099c4SSowmini Varadhan ill = ip_select_src_ill(&v6src, ixa->ixa_zoneid, ipst); 123544b099c4SSowmini Varadhan if (ill == NULL) { 123644b099c4SSowmini Varadhan char addrbuf[INET6_ADDRSTRLEN]; 123744b099c4SSowmini Varadhan 123844b099c4SSowmini Varadhan ip3dbg(("%s not a valid src for unicast", 123944b099c4SSowmini Varadhan inet_ntop(AF_INET6, &v6src, addrbuf, 124044b099c4SSowmini Varadhan sizeof (addrbuf)))); 124144b099c4SSowmini Varadhan if (errorp != NULL) 124244b099c4SSowmini Varadhan *errorp = EADDRNOTAVAIL; 124344b099c4SSowmini Varadhan /* Get a hold on the IRE_NOROUTE */ 124444b099c4SSowmini Varadhan ire = ire_reject(ipst, isv6); 124544b099c4SSowmini Varadhan return (ire); 124644b099c4SSowmini Varadhan } 124744b099c4SSowmini Varadhan match_args |= MATCH_IRE_SRC_ILL; 124844b099c4SSowmini Varadhan preferred_src_aware = (src_multihoming == 1); 1249bd670b35SErik Nordmark } 1250bd670b35SErik Nordmark 1251bd670b35SErik Nordmark if (ixaflags & IXAF_NEXTHOP_SET) { 1252bd670b35SErik Nordmark /* IP_NEXTHOP was set */ 1253bd670b35SErik Nordmark v6nexthop = ixa->ixa_nexthop_v6; 1254bd670b35SErik Nordmark } else { 1255bd670b35SErik Nordmark v6nexthop = *v6dst; 1256bd670b35SErik Nordmark } 1257bd670b35SErik Nordmark 1258bd670b35SErik Nordmark ire_type = 0; 1259bd670b35SErik Nordmark 1260bd670b35SErik Nordmark /* 1261bd670b35SErik Nordmark * If SO_DONTROUTE is set or if IP_NEXTHOP is set, then 1262bd670b35SErik Nordmark * we only look for an onlink IRE. 1263bd670b35SErik Nordmark */ 1264bd670b35SErik Nordmark if (ixaflags & (IXAF_DONTROUTE|IXAF_NEXTHOP_SET)) { 1265bd670b35SErik Nordmark match_args |= MATCH_IRE_TYPE; 1266bd670b35SErik Nordmark ire_type = IRE_ONLINK; 1267bd670b35SErik Nordmark } 1268bd670b35SErik Nordmark 126944b099c4SSowmini Varadhan retry: 127044b099c4SSowmini Varadhan if (!isv6) { 1271bd670b35SErik Nordmark ipaddr_t v4nexthop; 1272bd670b35SErik Nordmark ipaddr_t v4setsrc = INADDR_ANY; 1273bd670b35SErik Nordmark 1274bd670b35SErik Nordmark IN6_V4MAPPED_TO_IPADDR(&v6nexthop, v4nexthop); 1275bd670b35SErik Nordmark ire = ire_route_recursive_v4(v4nexthop, ire_type, ill, 12769e3469d3SErik Nordmark ixa->ixa_zoneid, ixa->ixa_tsl, match_args, IRR_ALLOCATE, 1277bd670b35SErik Nordmark ixa->ixa_xmit_hint, ipst, &v4setsrc, NULL, generationp); 1278bd670b35SErik Nordmark if (setsrcp != NULL) 1279bd670b35SErik Nordmark IN6_IPADDR_TO_V4MAPPED(v4setsrc, setsrcp); 1280bd670b35SErik Nordmark } else { 1281bd670b35SErik Nordmark ire = ire_route_recursive_v6(&v6nexthop, ire_type, ill, 12829e3469d3SErik Nordmark ixa->ixa_zoneid, ixa->ixa_tsl, match_args, IRR_ALLOCATE, 1283bd670b35SErik Nordmark ixa->ixa_xmit_hint, ipst, setsrcp, NULL, generationp); 1284bd670b35SErik Nordmark } 1285bd670b35SErik Nordmark 1286bd670b35SErik Nordmark #ifdef DEBUG 1287bd670b35SErik Nordmark if (match_args & MATCH_IRE_TESTHIDDEN) { 1288bd670b35SErik Nordmark ip3dbg(("looking for hidden; dst %x ire %p\n", 1289bd670b35SErik Nordmark v4dst, (void *)ire)); 1290bd670b35SErik Nordmark } 1291bd670b35SErik Nordmark #endif 129244b099c4SSowmini Varadhan if (ill != NULL) { 1293bd670b35SErik Nordmark ill_refrele(ill); 129444b099c4SSowmini Varadhan ill = NULL; 129544b099c4SSowmini Varadhan } 1296bd670b35SErik Nordmark if ((ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) || 1297bd670b35SErik Nordmark (ire->ire_type & IRE_MULTICAST)) { 129844b099c4SSowmini Varadhan if (preferred_src_aware) { 129944b099c4SSowmini Varadhan /* 130044b099c4SSowmini Varadhan * "Preferred Source Aware" send mode. If we cannot 130144b099c4SSowmini Varadhan * find an ire whose ire_ill had the desired source 130244b099c4SSowmini Varadhan * address retry after relaxing the ill matching 130344b099c4SSowmini Varadhan * constraint. 130444b099c4SSowmini Varadhan */ 130544b099c4SSowmini Varadhan ire_refrele(ire); 130644b099c4SSowmini Varadhan preferred_src_aware = B_FALSE; 130744b099c4SSowmini Varadhan match_args &= ~MATCH_IRE_SRC_ILL; 130844b099c4SSowmini Varadhan goto retry; 130944b099c4SSowmini Varadhan } 1310bd670b35SErik Nordmark /* No ire_nce_cache */ 1311bd670b35SErik Nordmark return (ire); 1312bd670b35SErik Nordmark } 1313bd670b35SErik Nordmark 1314bd670b35SErik Nordmark /* Setup ire_nce_cache if it doesn't exist or is condemned. */ 1315bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 1316bd670b35SErik Nordmark nce = ire->ire_nce_cache; 1317bd670b35SErik Nordmark if (nce == NULL || nce->nce_is_condemned) { 1318bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 1319bd670b35SErik Nordmark (void) ire_revalidate_nce(ire); 1320bd670b35SErik Nordmark } else { 1321bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 1322bd670b35SErik Nordmark } 1323bd670b35SErik Nordmark return (ire); 1324bd670b35SErik Nordmark } 1325bd670b35SErik Nordmark 1326bd670b35SErik Nordmark /* 1327bd670b35SErik Nordmark * Find a route given some xmit attributes and a packet. 1328bd670b35SErik Nordmark * Generic for IPv4 and IPv6 1329bd670b35SErik Nordmark * 1330bd670b35SErik Nordmark * This never returns NULL. But when it returns the IRE_NOROUTE 1331bd670b35SErik Nordmark * it might set errorp. 1332bd670b35SErik Nordmark */ 1333bd670b35SErik Nordmark ire_t * 1334bd670b35SErik Nordmark ip_select_route_pkt(mblk_t *mp, ip_xmit_attr_t *ixa, uint_t *generationp, 1335bd670b35SErik Nordmark int *errorp, boolean_t *multirtp) 1336bd670b35SErik Nordmark { 1337bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_IS_IPV4) { 1338bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)mp->b_rptr; 133944b099c4SSowmini Varadhan in6_addr_t v6dst, v6src; 1340bd670b35SErik Nordmark 1341bd670b35SErik Nordmark IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst); 134244b099c4SSowmini Varadhan IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &v6src); 1343bd670b35SErik Nordmark 134444b099c4SSowmini Varadhan return (ip_select_route(&v6dst, v6src, ixa, generationp, 1345bd670b35SErik Nordmark NULL, errorp, multirtp)); 1346bd670b35SErik Nordmark } else { 1347bd670b35SErik Nordmark ip6_t *ip6h = (ip6_t *)mp->b_rptr; 1348bd670b35SErik Nordmark 134944b099c4SSowmini Varadhan return (ip_select_route(&ip6h->ip6_dst, ip6h->ip6_src, 135044b099c4SSowmini Varadhan ixa, generationp, NULL, errorp, multirtp)); 1351bd670b35SErik Nordmark } 1352bd670b35SErik Nordmark } 1353bd670b35SErik Nordmark 1354bd670b35SErik Nordmark ire_t * 135544b099c4SSowmini Varadhan ip_select_route_v4(ipaddr_t dst, ipaddr_t src, ip_xmit_attr_t *ixa, 135644b099c4SSowmini Varadhan uint_t *generationp, ipaddr_t *v4setsrcp, int *errorp, boolean_t *multirtp) 1357bd670b35SErik Nordmark { 135844b099c4SSowmini Varadhan in6_addr_t v6dst, v6src; 1359bd670b35SErik Nordmark ire_t *ire; 1360bd670b35SErik Nordmark in6_addr_t setsrc; 1361bd670b35SErik Nordmark 1362bd670b35SErik Nordmark ASSERT(ixa->ixa_flags & IXAF_IS_IPV4); 1363bd670b35SErik Nordmark 1364bd670b35SErik Nordmark IN6_IPADDR_TO_V4MAPPED(dst, &v6dst); 136544b099c4SSowmini Varadhan IN6_IPADDR_TO_V4MAPPED(src, &v6src); 1366bd670b35SErik Nordmark 1367bd670b35SErik Nordmark setsrc = ipv6_all_zeros; 136844b099c4SSowmini Varadhan ire = ip_select_route(&v6dst, v6src, ixa, generationp, &setsrc, errorp, 1369bd670b35SErik Nordmark multirtp); 1370bd670b35SErik Nordmark if (v4setsrcp != NULL) 1371bd670b35SErik Nordmark IN6_V4MAPPED_TO_IPADDR(&setsrc, *v4setsrcp); 1372bd670b35SErik Nordmark return (ire); 1373bd670b35SErik Nordmark } 1374bd670b35SErik Nordmark 1375bd670b35SErik Nordmark /* 1376bd670b35SErik Nordmark * Recursively look for a route to the destination. Can also match on 1377bd670b35SErik Nordmark * the zoneid, ill, and label. Used for the data paths. See also 1378bd670b35SErik Nordmark * ire_route_recursive. 1379bd670b35SErik Nordmark * 13809e3469d3SErik Nordmark * If IRR_ALLOCATE is not set then we will only inspect the existing IREs; never 13819e3469d3SErik Nordmark * create an IRE_IF_CLONE. This is used on the receive side when we are not 13829e3469d3SErik Nordmark * forwarding. 13839e3469d3SErik Nordmark * If IRR_INCOMPLETE is set then we return the IRE even if we can't correctly 13849e3469d3SErik Nordmark * resolve the gateway. 13859e3469d3SErik Nordmark * 1386bd670b35SErik Nordmark * Note that this function never returns NULL. It returns an IRE_NOROUTE 1387bd670b35SErik Nordmark * instead. 1388bd670b35SErik Nordmark * 1389bd670b35SErik Nordmark * If we find any IRE_LOCAL|BROADCAST etc past the first iteration it 1390bd670b35SErik Nordmark * is an error. 1391bd670b35SErik Nordmark * Allow at most one RTF_INDIRECT. 1392bd670b35SErik Nordmark */ 1393bd670b35SErik Nordmark ire_t * 1394bd670b35SErik Nordmark ire_route_recursive_impl_v4(ire_t *ire, 1395bd670b35SErik Nordmark ipaddr_t nexthop, uint_t ire_type, const ill_t *ill_arg, 1396bd670b35SErik Nordmark zoneid_t zoneid, const ts_label_t *tsl, uint_t match_args, 13979e3469d3SErik Nordmark uint_t irr_flags, uint32_t xmit_hint, ip_stack_t *ipst, ipaddr_t *setsrcp, 1398bd670b35SErik Nordmark tsol_ire_gw_secattr_t **gwattrp, uint_t *generationp) 1399bd670b35SErik Nordmark { 1400bd670b35SErik Nordmark int i, j; 1401bd670b35SErik Nordmark ire_t *ires[MAX_IRE_RECURSION]; 1402bd670b35SErik Nordmark uint_t generation; 1403bd670b35SErik Nordmark uint_t generations[MAX_IRE_RECURSION]; 1404bd670b35SErik Nordmark boolean_t need_refrele = B_FALSE; 1405bd670b35SErik Nordmark boolean_t invalidate = B_FALSE; 1406bd670b35SErik Nordmark ill_t *ill = NULL; 1407*01685f97SSowmini Varadhan uint_t maskoff = (IRE_LOCAL|IRE_LOOPBACK|IRE_BROADCAST); 1408bd670b35SErik Nordmark 1409bd670b35SErik Nordmark if (setsrcp != NULL) 1410bd670b35SErik Nordmark ASSERT(*setsrcp == INADDR_ANY); 1411bd670b35SErik Nordmark if (gwattrp != NULL) 1412bd670b35SErik Nordmark ASSERT(*gwattrp == NULL); 1413bd670b35SErik Nordmark 1414bd670b35SErik Nordmark /* 1415bd670b35SErik Nordmark * We iterate up to three times to resolve a route, even though 1416bd670b35SErik Nordmark * we have four slots in the array. The extra slot is for an 1417bd670b35SErik Nordmark * IRE_IF_CLONE we might need to create. 1418bd670b35SErik Nordmark */ 1419bd670b35SErik Nordmark i = 0; 1420bd670b35SErik Nordmark while (i < MAX_IRE_RECURSION - 1) { 1421bd670b35SErik Nordmark /* ire_ftable_lookup handles round-robin/ECMP */ 1422bd670b35SErik Nordmark if (ire == NULL) { 1423bd670b35SErik Nordmark ire = ire_ftable_lookup_v4(nexthop, 0, 0, ire_type, 142444b099c4SSowmini Varadhan (ill != NULL? ill : ill_arg), zoneid, tsl, 1425bd670b35SErik Nordmark match_args, xmit_hint, ipst, &generation); 1426bd670b35SErik Nordmark } else { 1427bd670b35SErik Nordmark /* Caller passed it; extra hold since we will rele */ 1428bd670b35SErik Nordmark ire_refhold(ire); 1429bd670b35SErik Nordmark if (generationp != NULL) 1430bd670b35SErik Nordmark generation = *generationp; 1431bd670b35SErik Nordmark else 1432bd670b35SErik Nordmark generation = IRE_GENERATION_VERIFY; 1433bd670b35SErik Nordmark } 1434*01685f97SSowmini Varadhan if (ire == NULL) { 1435*01685f97SSowmini Varadhan if (i > 0 && (irr_flags & IRR_INCOMPLETE)) { 14369e3469d3SErik Nordmark ire = ires[0]; 14379e3469d3SErik Nordmark ire_refhold(ire); 14389e3469d3SErik Nordmark } else { 1439bd670b35SErik Nordmark ire = ire_reject(ipst, B_FALSE); 14409e3469d3SErik Nordmark } 1441bd670b35SErik Nordmark goto error; 1442bd670b35SErik Nordmark } 1443*01685f97SSowmini Varadhan 1444*01685f97SSowmini Varadhan /* Need to return the ire with RTF_REJECT|BLACKHOLE */ 1445*01685f97SSowmini Varadhan if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) 1446*01685f97SSowmini Varadhan goto error; 1447*01685f97SSowmini Varadhan 1448*01685f97SSowmini Varadhan ASSERT(!(ire->ire_type & IRE_MULTICAST)); /* Not in ftable */ 1449*01685f97SSowmini Varadhan 1450*01685f97SSowmini Varadhan /* 1451*01685f97SSowmini Varadhan * Don't allow anything unusual past the first iteration. 1452*01685f97SSowmini Varadhan * After the first lookup, we should no longer look for 1453*01685f97SSowmini Varadhan * (IRE_LOCAL|IRE_LOOPBACK|IRE_BROADCAST) or RTF_INDIRECT 1454*01685f97SSowmini Varadhan * routes. 1455*01685f97SSowmini Varadhan * 1456*01685f97SSowmini Varadhan * In addition, after we have found a direct IRE_OFFLINK, 1457*01685f97SSowmini Varadhan * we should only look for interface or clone routes. 1458*01685f97SSowmini Varadhan */ 1459*01685f97SSowmini Varadhan match_args |= MATCH_IRE_DIRECT; /* no more RTF_INDIRECTs */ 1460*01685f97SSowmini Varadhan 1461*01685f97SSowmini Varadhan if ((ire->ire_type & IRE_OFFLINK) && 1462*01685f97SSowmini Varadhan !(ire->ire_flags & RTF_INDIRECT)) { 1463*01685f97SSowmini Varadhan ire_type = IRE_IF_ALL; 1464*01685f97SSowmini Varadhan } else { 1465*01685f97SSowmini Varadhan /* 1466*01685f97SSowmini Varadhan * no more local, loopback, broadcast routes 1467*01685f97SSowmini Varadhan */ 1468*01685f97SSowmini Varadhan if (!(match_args & MATCH_IRE_TYPE)) 1469*01685f97SSowmini Varadhan ire_type = (IRE_OFFLINK|IRE_ONLINK); 1470*01685f97SSowmini Varadhan ire_type &= ~maskoff; 1471bd670b35SErik Nordmark } 1472*01685f97SSowmini Varadhan match_args |= MATCH_IRE_TYPE; 1473*01685f97SSowmini Varadhan 1474bd670b35SErik Nordmark /* We have a usable IRE */ 1475bd670b35SErik Nordmark ires[i] = ire; 1476bd670b35SErik Nordmark generations[i] = generation; 1477bd670b35SErik Nordmark i++; 1478bd670b35SErik Nordmark 1479bd670b35SErik Nordmark /* The first RTF_SETSRC address is passed back if setsrcp */ 1480bd670b35SErik Nordmark if ((ire->ire_flags & RTF_SETSRC) && 1481bd670b35SErik Nordmark setsrcp != NULL && *setsrcp == INADDR_ANY) { 1482bd670b35SErik Nordmark ASSERT(ire->ire_setsrc_addr != INADDR_ANY); 1483bd670b35SErik Nordmark *setsrcp = ire->ire_setsrc_addr; 1484bd670b35SErik Nordmark } 1485bd670b35SErik Nordmark 1486bd670b35SErik Nordmark /* The first ire_gw_secattr is passed back if gwattrp */ 1487bd670b35SErik Nordmark if (ire->ire_gw_secattr != NULL && 1488bd670b35SErik Nordmark gwattrp != NULL && *gwattrp == NULL) 1489bd670b35SErik Nordmark *gwattrp = ire->ire_gw_secattr; 1490bd670b35SErik Nordmark 1491bd670b35SErik Nordmark /* 1492bd670b35SErik Nordmark * Check if we have a short-cut pointer to an IRE for this 1493bd670b35SErik Nordmark * destination, and that the cached dependency isn't stale. 1494bd670b35SErik Nordmark * In that case we've rejoined an existing tree towards a 1495bd670b35SErik Nordmark * parent, thus we don't need to continue the loop to 1496bd670b35SErik Nordmark * discover the rest of the tree. 1497bd670b35SErik Nordmark */ 1498bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 1499bd670b35SErik Nordmark if (ire->ire_dep_parent != NULL && 1500bd670b35SErik Nordmark ire->ire_dep_parent->ire_generation == 1501bd670b35SErik Nordmark ire->ire_dep_parent_generation) { 1502bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 1503bd670b35SErik Nordmark ire = NULL; 1504bd670b35SErik Nordmark goto done; 1505bd670b35SErik Nordmark } 1506bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 1507bd670b35SErik Nordmark 1508bd670b35SErik Nordmark /* 1509bd670b35SErik Nordmark * If this type should have an ire_nce_cache (even if it 1510bd670b35SErik Nordmark * doesn't yet have one) then we are done. Includes 1511bd670b35SErik Nordmark * IRE_INTERFACE with a full 32 bit mask. 1512bd670b35SErik Nordmark */ 1513bd670b35SErik Nordmark if (ire->ire_nce_capable) { 1514bd670b35SErik Nordmark ire = NULL; 1515bd670b35SErik Nordmark goto done; 1516bd670b35SErik Nordmark } 1517bd670b35SErik Nordmark ASSERT(!(ire->ire_type & IRE_IF_CLONE)); 1518bd670b35SErik Nordmark /* 1519bd670b35SErik Nordmark * For an IRE_INTERFACE we create an IRE_IF_CLONE for this 1520bd670b35SErik Nordmark * particular destination 1521bd670b35SErik Nordmark */ 1522bd670b35SErik Nordmark if (ire->ire_type & IRE_INTERFACE) { 1523bd670b35SErik Nordmark in6_addr_t v6nexthop; 1524bd670b35SErik Nordmark ire_t *clone; 1525bd670b35SErik Nordmark 1526bd670b35SErik Nordmark ASSERT(ire->ire_masklen != IPV4_ABITS); 1527bd670b35SErik Nordmark 1528bd670b35SErik Nordmark /* 1529bd670b35SErik Nordmark * In the case of ip_input and ILLF_FORWARDING not 15309e3469d3SErik Nordmark * being set, and in the case of RTM_GET, there is 15319e3469d3SErik Nordmark * no point in allocating an IRE_IF_CLONE. We return 15329e3469d3SErik Nordmark * the IRE_INTERFACE. Note that !IRR_ALLOCATE can 15339e3469d3SErik Nordmark * result in a ire_dep_parent which is IRE_IF_* 15349e3469d3SErik Nordmark * without an IRE_IF_CLONE. 1535bd670b35SErik Nordmark * We recover from that when we need to send packets 1536bd670b35SErik Nordmark * by ensuring that the generations become 1537bd670b35SErik Nordmark * IRE_GENERATION_VERIFY in this case. 1538bd670b35SErik Nordmark */ 15399e3469d3SErik Nordmark if (!(irr_flags & IRR_ALLOCATE)) { 1540bd670b35SErik Nordmark invalidate = B_TRUE; 1541bd670b35SErik Nordmark ire = NULL; 1542bd670b35SErik Nordmark goto done; 1543bd670b35SErik Nordmark } 1544bd670b35SErik Nordmark 1545bd670b35SErik Nordmark IN6_IPADDR_TO_V4MAPPED(nexthop, &v6nexthop); 1546bd670b35SErik Nordmark 1547bd670b35SErik Nordmark clone = ire_create_if_clone(ire, &v6nexthop, 1548bd670b35SErik Nordmark &generation); 1549bd670b35SErik Nordmark if (clone == NULL) { 1550bd670b35SErik Nordmark /* 1551bd670b35SErik Nordmark * Temporary failure - no memory. 1552bd670b35SErik Nordmark * Don't want caller to cache IRE_NOROUTE. 1553bd670b35SErik Nordmark */ 1554bd670b35SErik Nordmark invalidate = B_TRUE; 1555bd670b35SErik Nordmark ire = ire_blackhole(ipst, B_FALSE); 1556bd670b35SErik Nordmark goto error; 1557bd670b35SErik Nordmark } 1558bd670b35SErik Nordmark /* 1559bd670b35SErik Nordmark * Make clone next to last entry and the 1560bd670b35SErik Nordmark * IRE_INTERFACE the last in the dependency 1561bd670b35SErik Nordmark * chain since the clone depends on the 1562bd670b35SErik Nordmark * IRE_INTERFACE. 1563bd670b35SErik Nordmark */ 1564bd670b35SErik Nordmark ASSERT(i >= 1); 1565bd670b35SErik Nordmark ASSERT(i < MAX_IRE_RECURSION); 1566bd670b35SErik Nordmark 1567bd670b35SErik Nordmark ires[i] = ires[i-1]; 1568bd670b35SErik Nordmark generations[i] = generations[i-1]; 1569bd670b35SErik Nordmark ires[i-1] = clone; 1570bd670b35SErik Nordmark generations[i-1] = generation; 1571bd670b35SErik Nordmark i++; 1572bd670b35SErik Nordmark 1573bd670b35SErik Nordmark ire = NULL; 1574bd670b35SErik Nordmark goto done; 1575bd670b35SErik Nordmark } 1576bd670b35SErik Nordmark 1577bd670b35SErik Nordmark /* 1578bd670b35SErik Nordmark * We only match on the type and optionally ILL when 1579bd670b35SErik Nordmark * recursing. The type match is used by some callers 1580bd670b35SErik Nordmark * to exclude certain types (such as IRE_IF_CLONE or 1581bd670b35SErik Nordmark * IRE_LOCAL|IRE_LOOPBACK). 158244b099c4SSowmini Varadhan * 158344b099c4SSowmini Varadhan * In the MATCH_IRE_SRC_ILL case, ill_arg may be the 'srcof' 158444b099c4SSowmini Varadhan * ire->ire_ill, and we want to find the IRE_INTERFACE for 158544b099c4SSowmini Varadhan * ire_ill, so we set ill to the ire_ill; 1586bd670b35SErik Nordmark */ 1587*01685f97SSowmini Varadhan match_args &= (MATCH_IRE_TYPE | MATCH_IRE_DIRECT); 1588bd670b35SErik Nordmark nexthop = ire->ire_gateway_addr; 1589bd670b35SErik Nordmark if (ill == NULL && ire->ire_ill != NULL) { 1590bd670b35SErik Nordmark ill = ire->ire_ill; 1591bd670b35SErik Nordmark need_refrele = B_TRUE; 1592bd670b35SErik Nordmark ill_refhold(ill); 1593bd670b35SErik Nordmark match_args |= MATCH_IRE_ILL; 1594bd670b35SErik Nordmark } 1595bd670b35SErik Nordmark ire = NULL; 1596bd670b35SErik Nordmark } 1597bd670b35SErik Nordmark ASSERT(ire == NULL); 1598bd670b35SErik Nordmark ire = ire_reject(ipst, B_FALSE); 1599bd670b35SErik Nordmark 1600bd670b35SErik Nordmark error: 1601bd670b35SErik Nordmark ASSERT(ire != NULL); 1602bd670b35SErik Nordmark if (need_refrele) 1603bd670b35SErik Nordmark ill_refrele(ill); 1604bd670b35SErik Nordmark 1605bd670b35SErik Nordmark /* 1606bd670b35SErik Nordmark * In the case of MULTIRT we want to try a different IRE the next 1607bd670b35SErik Nordmark * time. We let the next packet retry in that case. 1608bd670b35SErik Nordmark */ 1609bd670b35SErik Nordmark if (i > 0 && (ires[0]->ire_flags & RTF_MULTIRT)) 1610bd670b35SErik Nordmark (void) ire_no_good(ires[0]); 1611bd670b35SErik Nordmark 1612bd670b35SErik Nordmark cleanup: 1613bd670b35SErik Nordmark /* cleanup ires[i] */ 1614bd670b35SErik Nordmark ire_dep_unbuild(ires, i); 1615bd670b35SErik Nordmark for (j = 0; j < i; j++) 1616bd670b35SErik Nordmark ire_refrele(ires[j]); 1617bd670b35SErik Nordmark 16189e3469d3SErik Nordmark ASSERT((ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) || 16199e3469d3SErik Nordmark (irr_flags & IRR_INCOMPLETE)); 1620bd670b35SErik Nordmark /* 1621bd670b35SErik Nordmark * Use IRE_GENERATION_VERIFY to ensure that ip_output will redo the 1622bd670b35SErik Nordmark * ip_select_route since the reject or lack of memory might be gone. 1623bd670b35SErik Nordmark */ 1624bd670b35SErik Nordmark if (generationp != NULL) 1625bd670b35SErik Nordmark *generationp = IRE_GENERATION_VERIFY; 1626bd670b35SErik Nordmark return (ire); 1627bd670b35SErik Nordmark 1628bd670b35SErik Nordmark done: 1629bd670b35SErik Nordmark ASSERT(ire == NULL); 1630bd670b35SErik Nordmark if (need_refrele) { 1631bd670b35SErik Nordmark ill_refrele(ill); 1632bd670b35SErik Nordmark ill = NULL; 1633bd670b35SErik Nordmark } 1634bd670b35SErik Nordmark 1635bd670b35SErik Nordmark /* Build dependencies */ 1636188e1664SErik Nordmark if (i > 1 && !ire_dep_build(ires, generations, i)) { 1637bd670b35SErik Nordmark /* Something in chain was condemned; tear it apart */ 1638bd670b35SErik Nordmark ire = ire_reject(ipst, B_FALSE); 1639bd670b35SErik Nordmark goto cleanup; 1640bd670b35SErik Nordmark } 1641bd670b35SErik Nordmark 1642bd670b35SErik Nordmark /* 1643bd670b35SErik Nordmark * Release all refholds except the one for ires[0] that we 1644bd670b35SErik Nordmark * will return to the caller. 1645bd670b35SErik Nordmark */ 1646bd670b35SErik Nordmark for (j = 1; j < i; j++) 1647bd670b35SErik Nordmark ire_refrele(ires[j]); 1648bd670b35SErik Nordmark 1649bd670b35SErik Nordmark if (invalidate) { 1650bd670b35SErik Nordmark /* 1651bd670b35SErik Nordmark * Since we needed to allocate but couldn't we need to make 1652bd670b35SErik Nordmark * sure that the dependency chain is rebuilt the next time. 1653bd670b35SErik Nordmark */ 1654bd670b35SErik Nordmark ire_dep_invalidate_generations(ires[0]); 1655bd670b35SErik Nordmark generation = IRE_GENERATION_VERIFY; 1656bd670b35SErik Nordmark } else { 1657bd670b35SErik Nordmark /* 1658bd670b35SErik Nordmark * IREs can have been added or deleted while we did the 1659bd670b35SErik Nordmark * recursive lookup and we can't catch those until we've built 1660bd670b35SErik Nordmark * the dependencies. We verify the stored 1661bd670b35SErik Nordmark * ire_dep_parent_generation to catch any such changes and 1662bd670b35SErik Nordmark * return IRE_GENERATION_VERIFY (which will cause 1663bd670b35SErik Nordmark * ip_select_route to be called again so we can redo the 1664bd670b35SErik Nordmark * recursive lookup next time we send a packet. 1665bd670b35SErik Nordmark */ 1666188e1664SErik Nordmark if (ires[0]->ire_dep_parent == NULL) 1667188e1664SErik Nordmark generation = ires[0]->ire_generation; 1668188e1664SErik Nordmark else 1669bd670b35SErik Nordmark generation = ire_dep_validate_generations(ires[0]); 1670bd670b35SErik Nordmark if (generations[0] != ires[0]->ire_generation) { 1671bd670b35SErik Nordmark /* Something changed at the top */ 1672bd670b35SErik Nordmark generation = IRE_GENERATION_VERIFY; 1673bd670b35SErik Nordmark } 1674bd670b35SErik Nordmark } 1675bd670b35SErik Nordmark if (generationp != NULL) 1676bd670b35SErik Nordmark *generationp = generation; 1677bd670b35SErik Nordmark 1678bd670b35SErik Nordmark return (ires[0]); 1679bd670b35SErik Nordmark } 1680bd670b35SErik Nordmark 1681bd670b35SErik Nordmark ire_t * 1682bd670b35SErik Nordmark ire_route_recursive_v4(ipaddr_t nexthop, uint_t ire_type, const ill_t *ill, 1683bd670b35SErik Nordmark zoneid_t zoneid, const ts_label_t *tsl, uint_t match_args, 16849e3469d3SErik Nordmark uint_t irr_flags, uint32_t xmit_hint, ip_stack_t *ipst, ipaddr_t *setsrcp, 1685bd670b35SErik Nordmark tsol_ire_gw_secattr_t **gwattrp, uint_t *generationp) 1686bd670b35SErik Nordmark { 1687bd670b35SErik Nordmark return (ire_route_recursive_impl_v4(NULL, nexthop, ire_type, ill, 16889e3469d3SErik Nordmark zoneid, tsl, match_args, irr_flags, xmit_hint, ipst, setsrcp, 1689bd670b35SErik Nordmark gwattrp, generationp)); 1690bd670b35SErik Nordmark } 1691bd670b35SErik Nordmark 1692bd670b35SErik Nordmark /* 1693bd670b35SErik Nordmark * Recursively look for a route to the destination. 1694bd670b35SErik Nordmark * We only handle a destination match here, yet we have the same arguments 1695bd670b35SErik Nordmark * as the full match to allow function pointers to select between the two. 1696bd670b35SErik Nordmark * 1697bd670b35SErik Nordmark * Note that this function never returns NULL. It returns an IRE_NOROUTE 1698bd670b35SErik Nordmark * instead. 1699bd670b35SErik Nordmark * 1700bd670b35SErik Nordmark * If we find any IRE_LOCAL|BROADCAST etc past the first iteration it 1701bd670b35SErik Nordmark * is an error. 1702bd670b35SErik Nordmark * Allow at most one RTF_INDIRECT. 1703bd670b35SErik Nordmark */ 1704bd670b35SErik Nordmark ire_t * 17059e3469d3SErik Nordmark ire_route_recursive_dstonly_v4(ipaddr_t nexthop, uint_t irr_flags, 1706bd670b35SErik Nordmark uint32_t xmit_hint, ip_stack_t *ipst) 1707bd670b35SErik Nordmark { 1708bd670b35SErik Nordmark ire_t *ire; 1709bd670b35SErik Nordmark ire_t *ire1; 1710bd670b35SErik Nordmark uint_t generation; 1711bd670b35SErik Nordmark 1712bd670b35SErik Nordmark /* ire_ftable_lookup handles round-robin/ECMP */ 1713bd670b35SErik Nordmark ire = ire_ftable_lookup_simple_v4(nexthop, xmit_hint, ipst, 1714bd670b35SErik Nordmark &generation); 1715bd670b35SErik Nordmark ASSERT(ire != NULL); 1716bd670b35SErik Nordmark 1717bd670b35SErik Nordmark /* 1718bd670b35SErik Nordmark * If this type should have an ire_nce_cache (even if it 1719bd670b35SErik Nordmark * doesn't yet have one) then we are done. Includes 1720bd670b35SErik Nordmark * IRE_INTERFACE with a full 32 bit mask. 1721bd670b35SErik Nordmark */ 1722bd670b35SErik Nordmark if (ire->ire_nce_capable) 1723bd670b35SErik Nordmark return (ire); 1724bd670b35SErik Nordmark 1725bd670b35SErik Nordmark /* 1726bd670b35SErik Nordmark * If the IRE has a current cached parent we know that the whole 1727bd670b35SErik Nordmark * parent chain is current, hence we don't need to discover and 1728bd670b35SErik Nordmark * build any dependencies by doing a recursive lookup. 1729bd670b35SErik Nordmark */ 1730bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 1731bd670b35SErik Nordmark if (ire->ire_dep_parent != NULL && 1732bd670b35SErik Nordmark ire->ire_dep_parent->ire_generation == 1733bd670b35SErik Nordmark ire->ire_dep_parent_generation) { 1734bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 1735bd670b35SErik Nordmark return (ire); 1736bd670b35SErik Nordmark } 1737bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 1738bd670b35SErik Nordmark 1739bd670b35SErik Nordmark /* 1740bd670b35SErik Nordmark * Fallback to loop in the normal code starting with the ire 1741bd670b35SErik Nordmark * we found. Normally this would return the same ire. 1742bd670b35SErik Nordmark */ 1743bd670b35SErik Nordmark ire1 = ire_route_recursive_impl_v4(ire, nexthop, 0, NULL, ALL_ZONES, 17449e3469d3SErik Nordmark NULL, MATCH_IRE_DSTONLY, irr_flags, xmit_hint, ipst, NULL, NULL, 1745bd670b35SErik Nordmark &generation); 1746bd670b35SErik Nordmark ire_refrele(ire); 1747bd670b35SErik Nordmark return (ire1); 1748bd670b35SErik Nordmark } 1749