1*c793af95Ssangeeta /* 2*c793af95Ssangeeta * CDDL HEADER START 3*c793af95Ssangeeta * 4*c793af95Ssangeeta * The contents of this file are subject to the terms of the 5*c793af95Ssangeeta * Common Development and Distribution License (the "License"). 6*c793af95Ssangeeta * You may not use this file except in compliance with the License. 7*c793af95Ssangeeta * 8*c793af95Ssangeeta * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9*c793af95Ssangeeta * or http://www.opensolaris.org/os/licensing. 10*c793af95Ssangeeta * See the License for the specific language governing permissions 11*c793af95Ssangeeta * and limitations under the License. 12*c793af95Ssangeeta * 13*c793af95Ssangeeta * When distributing Covered Code, include this CDDL HEADER in each 14*c793af95Ssangeeta * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15*c793af95Ssangeeta * If applicable, add the following below this CDDL HEADER, with the 16*c793af95Ssangeeta * fields enclosed by brackets "[]" replaced with your own identifying 17*c793af95Ssangeeta * information: Portions Copyright [yyyy] [name of copyright owner] 18*c793af95Ssangeeta * 19*c793af95Ssangeeta * CDDL HEADER END 20*c793af95Ssangeeta */ 21*c793af95Ssangeeta /* 22*c793af95Ssangeeta * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 23*c793af95Ssangeeta * Use is subject to license terms. 24*c793af95Ssangeeta */ 25*c793af95Ssangeeta 26*c793af95Ssangeeta #pragma ident "%Z%%M% %I% %E% SMI" 27*c793af95Ssangeeta 28*c793af95Ssangeeta /* 29*c793af95Ssangeeta * This file contains consumer routines of the IPv4 forwarding engine 30*c793af95Ssangeeta */ 31*c793af95Ssangeeta 32*c793af95Ssangeeta #include <sys/types.h> 33*c793af95Ssangeeta #include <sys/stream.h> 34*c793af95Ssangeeta #include <sys/stropts.h> 35*c793af95Ssangeeta #include <sys/strlog.h> 36*c793af95Ssangeeta #include <sys/dlpi.h> 37*c793af95Ssangeeta #include <sys/ddi.h> 38*c793af95Ssangeeta #include <sys/cmn_err.h> 39*c793af95Ssangeeta #include <sys/policy.h> 40*c793af95Ssangeeta 41*c793af95Ssangeeta #include <sys/systm.h> 42*c793af95Ssangeeta #include <sys/strsun.h> 43*c793af95Ssangeeta #include <sys/kmem.h> 44*c793af95Ssangeeta #include <sys/param.h> 45*c793af95Ssangeeta #include <sys/socket.h> 46*c793af95Ssangeeta #include <net/if.h> 47*c793af95Ssangeeta #include <net/route.h> 48*c793af95Ssangeeta #include <netinet/in.h> 49*c793af95Ssangeeta #include <net/if_dl.h> 50*c793af95Ssangeeta #include <netinet/ip6.h> 51*c793af95Ssangeeta #include <netinet/icmp6.h> 52*c793af95Ssangeeta 53*c793af95Ssangeeta #include <inet/common.h> 54*c793af95Ssangeeta #include <inet/mi.h> 55*c793af95Ssangeeta #include <inet/mib2.h> 56*c793af95Ssangeeta #include <inet/ip.h> 57*c793af95Ssangeeta #include <inet/ip6.h> 58*c793af95Ssangeeta #include <inet/ip_ndp.h> 59*c793af95Ssangeeta #include <inet/arp.h> 60*c793af95Ssangeeta #include <inet/ip_if.h> 61*c793af95Ssangeeta #include <inet/ip_ire.h> 62*c793af95Ssangeeta #include <inet/ip_ftable.h> 63*c793af95Ssangeeta #include <inet/ip_rts.h> 64*c793af95Ssangeeta #include <inet/nd.h> 65*c793af95Ssangeeta 66*c793af95Ssangeeta #include <net/pfkeyv2.h> 67*c793af95Ssangeeta #include <inet/ipsec_info.h> 68*c793af95Ssangeeta #include <inet/sadb.h> 69*c793af95Ssangeeta #include <sys/kmem.h> 70*c793af95Ssangeeta #include <inet/tcp.h> 71*c793af95Ssangeeta #include <inet/ipclassifier.h> 72*c793af95Ssangeeta #include <sys/zone.h> 73*c793af95Ssangeeta #include <net/radix.h> 74*c793af95Ssangeeta #include <sys/tsol/label.h> 75*c793af95Ssangeeta #include <sys/tsol/tnet.h> 76*c793af95Ssangeeta 77*c793af95Ssangeeta #define IS_DEFAULT_ROUTE(ire) \ 78*c793af95Ssangeeta (((ire)->ire_type & IRE_DEFAULT) || \ 79*c793af95Ssangeeta (((ire)->ire_type & IRE_INTERFACE) && ((ire)->ire_addr == 0))) 80*c793af95Ssangeeta 81*c793af95Ssangeeta /* 82*c793af95Ssangeeta * structure for passing args between ire_ftable_lookup and ire_find_best_route 83*c793af95Ssangeeta */ 84*c793af95Ssangeeta typedef struct ire_ftable_args_s { 85*c793af95Ssangeeta ipaddr_t ift_addr; 86*c793af95Ssangeeta ipaddr_t ift_mask; 87*c793af95Ssangeeta ipaddr_t ift_gateway; 88*c793af95Ssangeeta int ift_type; 89*c793af95Ssangeeta const ipif_t *ift_ipif; 90*c793af95Ssangeeta zoneid_t ift_zoneid; 91*c793af95Ssangeeta uint32_t ift_ihandle; 92*c793af95Ssangeeta const ts_label_t *ift_tsl; 93*c793af95Ssangeeta int ift_flags; 94*c793af95Ssangeeta ire_t *ift_best_ire; 95*c793af95Ssangeeta } ire_ftable_args_t; 96*c793af95Ssangeeta 97*c793af95Ssangeeta struct radix_node_head *ip_ftable; 98*c793af95Ssangeeta static ire_t *route_to_dst(const struct sockaddr *, zoneid_t); 99*c793af95Ssangeeta static ire_t *ire_round_robin(irb_t *, zoneid_t, ire_ftable_args_t *); 100*c793af95Ssangeeta static void ire_del_host_redir(ire_t *, char *); 101*c793af95Ssangeeta static boolean_t ire_find_best_route(struct radix_node *, void *); 102*c793af95Ssangeeta 103*c793af95Ssangeeta /* 104*c793af95Ssangeeta * Lookup a route in forwarding table. A specific lookup is indicated by 105*c793af95Ssangeeta * passing the required parameters and indicating the match required in the 106*c793af95Ssangeeta * flag field. 107*c793af95Ssangeeta * 108*c793af95Ssangeeta * Looking for default route can be done in three ways 109*c793af95Ssangeeta * 1) pass mask as 0 and set MATCH_IRE_MASK in flags field 110*c793af95Ssangeeta * along with other matches. 111*c793af95Ssangeeta * 2) pass type as IRE_DEFAULT and set MATCH_IRE_TYPE in flags 112*c793af95Ssangeeta * field along with other matches. 113*c793af95Ssangeeta * 3) if the destination and mask are passed as zeros. 114*c793af95Ssangeeta * 115*c793af95Ssangeeta * A request to return a default route if no route 116*c793af95Ssangeeta * is found, can be specified by setting MATCH_IRE_DEFAULT 117*c793af95Ssangeeta * in flags. 118*c793af95Ssangeeta * 119*c793af95Ssangeeta * It does not support recursion more than one level. It 120*c793af95Ssangeeta * will do recursive lookup only when the lookup maps to 121*c793af95Ssangeeta * a prefix or default route and MATCH_IRE_RECURSIVE flag is passed. 122*c793af95Ssangeeta * 123*c793af95Ssangeeta * If the routing table is setup to allow more than one level 124*c793af95Ssangeeta * of recursion, the cleaning up cache table will not work resulting 125*c793af95Ssangeeta * in invalid routing. 126*c793af95Ssangeeta * 127*c793af95Ssangeeta * Supports IP_BOUND_IF by following the ipif/ill when recursing. 128*c793af95Ssangeeta * 129*c793af95Ssangeeta * NOTE : When this function returns NULL, pire has already been released. 130*c793af95Ssangeeta * pire is valid only when this function successfully returns an 131*c793af95Ssangeeta * ire. 132*c793af95Ssangeeta */ 133*c793af95Ssangeeta ire_t * 134*c793af95Ssangeeta ire_ftable_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 135*c793af95Ssangeeta int type, const ipif_t *ipif, ire_t **pire, zoneid_t zoneid, 136*c793af95Ssangeeta uint32_t ihandle, const ts_label_t *tsl, int flags) 137*c793af95Ssangeeta { 138*c793af95Ssangeeta ire_t *ire = NULL; 139*c793af95Ssangeeta ipaddr_t gw_addr; 140*c793af95Ssangeeta struct rt_sockaddr rdst, rmask; 141*c793af95Ssangeeta struct rt_entry *rt; 142*c793af95Ssangeeta ire_ftable_args_t margs; 143*c793af95Ssangeeta boolean_t found_incomplete = B_FALSE; 144*c793af95Ssangeeta 145*c793af95Ssangeeta ASSERT(ipif == NULL || !ipif->ipif_isv6); 146*c793af95Ssangeeta ASSERT(!(flags & MATCH_IRE_WQ)); 147*c793af95Ssangeeta 148*c793af95Ssangeeta /* 149*c793af95Ssangeeta * When we return NULL from this function, we should make 150*c793af95Ssangeeta * sure that *pire is NULL so that the callers will not 151*c793af95Ssangeeta * wrongly REFRELE the pire. 152*c793af95Ssangeeta */ 153*c793af95Ssangeeta if (pire != NULL) 154*c793af95Ssangeeta *pire = NULL; 155*c793af95Ssangeeta /* 156*c793af95Ssangeeta * ire_match_args() will dereference ipif MATCH_IRE_SRC or 157*c793af95Ssangeeta * MATCH_IRE_ILL is set. 158*c793af95Ssangeeta */ 159*c793af95Ssangeeta if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) && 160*c793af95Ssangeeta (ipif == NULL)) 161*c793af95Ssangeeta return (NULL); 162*c793af95Ssangeeta 163*c793af95Ssangeeta (void) memset(&rdst, 0, sizeof (rdst)); 164*c793af95Ssangeeta rdst.rt_sin_len = sizeof (rdst); 165*c793af95Ssangeeta rdst.rt_sin_family = AF_INET; 166*c793af95Ssangeeta rdst.rt_sin_addr.s_addr = addr; 167*c793af95Ssangeeta 168*c793af95Ssangeeta (void) memset(&rmask, 0, sizeof (rmask)); 169*c793af95Ssangeeta rmask.rt_sin_len = sizeof (rmask); 170*c793af95Ssangeeta rmask.rt_sin_family = AF_INET; 171*c793af95Ssangeeta rmask.rt_sin_addr.s_addr = mask; 172*c793af95Ssangeeta 173*c793af95Ssangeeta (void) memset(&margs, 0, sizeof (margs)); 174*c793af95Ssangeeta margs.ift_addr = addr; 175*c793af95Ssangeeta margs.ift_mask = mask; 176*c793af95Ssangeeta margs.ift_gateway = gateway; 177*c793af95Ssangeeta margs.ift_type = type; 178*c793af95Ssangeeta margs.ift_ipif = ipif; 179*c793af95Ssangeeta margs.ift_zoneid = zoneid; 180*c793af95Ssangeeta margs.ift_ihandle = ihandle; 181*c793af95Ssangeeta margs.ift_tsl = tsl; 182*c793af95Ssangeeta margs.ift_flags = flags; 183*c793af95Ssangeeta 184*c793af95Ssangeeta /* 185*c793af95Ssangeeta * The flags argument passed to ire_ftable_lookup may cause the 186*c793af95Ssangeeta * search to return, not the longest matching prefix, but the 187*c793af95Ssangeeta * "best matching prefix", i.e., the longest prefix that also 188*c793af95Ssangeeta * satisfies constraints imposed via the permutation of flags 189*c793af95Ssangeeta * passed in. To achieve this, we invoke ire_match_args() on 190*c793af95Ssangeeta * each matching leaf in the radix tree. ire_match_args is 191*c793af95Ssangeeta * invoked by the callback function ire_find_best_route() 192*c793af95Ssangeeta * We hold the global tree lock in read mode when calling 193*c793af95Ssangeeta * rn_match_args.Before dropping the global tree lock, ensure 194*c793af95Ssangeeta * that the radix node can't be deleted by incrementing ire_refcnt. 195*c793af95Ssangeeta */ 196*c793af95Ssangeeta RADIX_NODE_HEAD_RLOCK(ip_ftable); 197*c793af95Ssangeeta rt = (struct rt_entry *)ip_ftable->rnh_matchaddr_args(&rdst, ip_ftable, 198*c793af95Ssangeeta ire_find_best_route, &margs); 199*c793af95Ssangeeta ire = margs.ift_best_ire; 200*c793af95Ssangeeta RADIX_NODE_HEAD_UNLOCK(ip_ftable); 201*c793af95Ssangeeta 202*c793af95Ssangeeta if (rt == NULL) { 203*c793af95Ssangeeta return (NULL); 204*c793af95Ssangeeta } else { 205*c793af95Ssangeeta ASSERT(ire != NULL); 206*c793af95Ssangeeta } 207*c793af95Ssangeeta 208*c793af95Ssangeeta DTRACE_PROBE2(ire__found, ire_ftable_args_t *, &margs, ire_t *, ire); 209*c793af95Ssangeeta 210*c793af95Ssangeeta if (!IS_DEFAULT_ROUTE(ire)) 211*c793af95Ssangeeta goto found_ire_held; 212*c793af95Ssangeeta /* 213*c793af95Ssangeeta * If default route is found, see if default matching criteria 214*c793af95Ssangeeta * are satisfied. 215*c793af95Ssangeeta */ 216*c793af95Ssangeeta if (flags & MATCH_IRE_MASK) { 217*c793af95Ssangeeta /* 218*c793af95Ssangeeta * we were asked to match a 0 mask, and came back with 219*c793af95Ssangeeta * a default route. Ok to return it. 220*c793af95Ssangeeta */ 221*c793af95Ssangeeta goto found_default_ire; 222*c793af95Ssangeeta } 223*c793af95Ssangeeta if ((flags & MATCH_IRE_TYPE) && 224*c793af95Ssangeeta (type & (IRE_DEFAULT | IRE_INTERFACE))) { 225*c793af95Ssangeeta /* 226*c793af95Ssangeeta * we were asked to match a default ire type. Ok to return it. 227*c793af95Ssangeeta */ 228*c793af95Ssangeeta goto found_default_ire; 229*c793af95Ssangeeta } 230*c793af95Ssangeeta if (flags & MATCH_IRE_DEFAULT) { 231*c793af95Ssangeeta goto found_default_ire; 232*c793af95Ssangeeta } 233*c793af95Ssangeeta /* 234*c793af95Ssangeeta * we found a default route, but default matching criteria 235*c793af95Ssangeeta * are not specified and we are not explicitly looking for 236*c793af95Ssangeeta * default. 237*c793af95Ssangeeta */ 238*c793af95Ssangeeta IRE_REFRELE(ire); 239*c793af95Ssangeeta return (NULL); 240*c793af95Ssangeeta found_default_ire: 241*c793af95Ssangeeta /* 242*c793af95Ssangeeta * round-robin only if we have more than one route in the bucket. 243*c793af95Ssangeeta */ 244*c793af95Ssangeeta if ((ire->ire_bucket->irb_ire_cnt > 1) && 245*c793af95Ssangeeta IS_DEFAULT_ROUTE(ire) && 246*c793af95Ssangeeta ((flags & (MATCH_IRE_DEFAULT | MATCH_IRE_MASK)) == 247*c793af95Ssangeeta MATCH_IRE_DEFAULT)) { 248*c793af95Ssangeeta ire_t *next_ire; 249*c793af95Ssangeeta 250*c793af95Ssangeeta next_ire = ire_round_robin(ire->ire_bucket, zoneid, &margs); 251*c793af95Ssangeeta IRE_REFRELE(ire); 252*c793af95Ssangeeta if (next_ire != NULL) { 253*c793af95Ssangeeta ire = next_ire; 254*c793af95Ssangeeta } else { 255*c793af95Ssangeeta /* no route */ 256*c793af95Ssangeeta return (NULL); 257*c793af95Ssangeeta } 258*c793af95Ssangeeta } 259*c793af95Ssangeeta found_ire_held: 260*c793af95Ssangeeta ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL); 261*c793af95Ssangeeta if ((flags & MATCH_IRE_RJ_BHOLE) && 262*c793af95Ssangeeta (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) { 263*c793af95Ssangeeta return (ire); 264*c793af95Ssangeeta } 265*c793af95Ssangeeta /* 266*c793af95Ssangeeta * At this point, IRE that was found must be an IRE_FORWARDTABLE 267*c793af95Ssangeeta * type. If this is a recursive lookup and an IRE_INTERFACE type was 268*c793af95Ssangeeta * found, return that. If it was some other IRE_FORWARDTABLE type of 269*c793af95Ssangeeta * IRE (one of the prefix types), then it is necessary to fill in the 270*c793af95Ssangeeta * parent IRE pointed to by pire, and then lookup the gateway address of 271*c793af95Ssangeeta * the parent. For backwards compatiblity, if this lookup returns an 272*c793af95Ssangeeta * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level 273*c793af95Ssangeeta * of lookup is done. 274*c793af95Ssangeeta */ 275*c793af95Ssangeeta if (flags & MATCH_IRE_RECURSIVE) { 276*c793af95Ssangeeta ipif_t *gw_ipif; 277*c793af95Ssangeeta int match_flags = MATCH_IRE_DSTONLY; 278*c793af95Ssangeeta ire_t *save_ire; 279*c793af95Ssangeeta 280*c793af95Ssangeeta if (ire->ire_type & IRE_INTERFACE) 281*c793af95Ssangeeta return (ire); 282*c793af95Ssangeeta if (pire != NULL) 283*c793af95Ssangeeta *pire = ire; 284*c793af95Ssangeeta /* 285*c793af95Ssangeeta * If we can't find an IRE_INTERFACE or the caller has not 286*c793af95Ssangeeta * asked for pire, we need to REFRELE the save_ire. 287*c793af95Ssangeeta */ 288*c793af95Ssangeeta save_ire = ire; 289*c793af95Ssangeeta 290*c793af95Ssangeeta /* 291*c793af95Ssangeeta * Currently MATCH_IRE_ILL is never used with 292*c793af95Ssangeeta * (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT) while 293*c793af95Ssangeeta * sending out packets as MATCH_IRE_ILL is used only 294*c793af95Ssangeeta * for communicating with on-link hosts. We can't assert 295*c793af95Ssangeeta * that here as RTM_GET calls this function with 296*c793af95Ssangeeta * MATCH_IRE_ILL | MATCH_IRE_DEFAULT | MATCH_IRE_RECURSIVE. 297*c793af95Ssangeeta * We have already used the MATCH_IRE_ILL in determining 298*c793af95Ssangeeta * the right prefix route at this point. To match the 299*c793af95Ssangeeta * behavior of how we locate routes while sending out 300*c793af95Ssangeeta * packets, we don't want to use MATCH_IRE_ILL below 301*c793af95Ssangeeta * while locating the interface route. 302*c793af95Ssangeeta * 303*c793af95Ssangeeta * ire_ftable_lookup may end up with an incomplete IRE_CACHE 304*c793af95Ssangeeta * entry for the gateway (i.e., one for which the 305*c793af95Ssangeeta * ire_nce->nce_state is not yet ND_REACHABLE). If the caller 306*c793af95Ssangeeta * has specified MATCH_IRE_COMPLETE, such entries will not 307*c793af95Ssangeeta * be returned; instead, we return the IF_RESOLVER ire. 308*c793af95Ssangeeta */ 309*c793af95Ssangeeta if (ire->ire_ipif != NULL) 310*c793af95Ssangeeta match_flags |= MATCH_IRE_ILL_GROUP; 311*c793af95Ssangeeta 312*c793af95Ssangeeta ire = ire_route_lookup(ire->ire_gateway_addr, 0, 0, 0, 313*c793af95Ssangeeta ire->ire_ipif, NULL, zoneid, tsl, match_flags); 314*c793af95Ssangeeta DTRACE_PROBE2(ftable__route__lookup1, (ire_t *), ire, 315*c793af95Ssangeeta (ire_t *), save_ire); 316*c793af95Ssangeeta if (ire == NULL || 317*c793af95Ssangeeta ((ire->ire_type & IRE_CACHE) && ire->ire_nce && 318*c793af95Ssangeeta ire->ire_nce->nce_state != ND_REACHABLE && 319*c793af95Ssangeeta (flags & MATCH_IRE_COMPLETE))) { 320*c793af95Ssangeeta /* 321*c793af95Ssangeeta * Do not release the parent ire if MATCH_IRE_PARENT 322*c793af95Ssangeeta * is set. Also return it via ire. 323*c793af95Ssangeeta */ 324*c793af95Ssangeeta if (ire != NULL) { 325*c793af95Ssangeeta ire_refrele(ire); 326*c793af95Ssangeeta ire = NULL; 327*c793af95Ssangeeta found_incomplete = B_TRUE; 328*c793af95Ssangeeta } 329*c793af95Ssangeeta if (flags & MATCH_IRE_PARENT) { 330*c793af95Ssangeeta if (pire != NULL) { 331*c793af95Ssangeeta /* 332*c793af95Ssangeeta * Need an extra REFHOLD, if the parent 333*c793af95Ssangeeta * ire is returned via both ire and 334*c793af95Ssangeeta * pire. 335*c793af95Ssangeeta */ 336*c793af95Ssangeeta IRE_REFHOLD(save_ire); 337*c793af95Ssangeeta } 338*c793af95Ssangeeta ire = save_ire; 339*c793af95Ssangeeta } else { 340*c793af95Ssangeeta ire_refrele(save_ire); 341*c793af95Ssangeeta if (pire != NULL) 342*c793af95Ssangeeta *pire = NULL; 343*c793af95Ssangeeta } 344*c793af95Ssangeeta if (!found_incomplete) 345*c793af95Ssangeeta return (ire); 346*c793af95Ssangeeta } 347*c793af95Ssangeeta if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) { 348*c793af95Ssangeeta /* 349*c793af95Ssangeeta * If the caller did not ask for pire, release 350*c793af95Ssangeeta * it now. 351*c793af95Ssangeeta */ 352*c793af95Ssangeeta if (pire == NULL) { 353*c793af95Ssangeeta ire_refrele(save_ire); 354*c793af95Ssangeeta } 355*c793af95Ssangeeta return (ire); 356*c793af95Ssangeeta } 357*c793af95Ssangeeta match_flags |= MATCH_IRE_TYPE; 358*c793af95Ssangeeta gw_addr = ire->ire_gateway_addr; 359*c793af95Ssangeeta gw_ipif = ire->ire_ipif; 360*c793af95Ssangeeta ire_refrele(ire); 361*c793af95Ssangeeta ire = ire_route_lookup(gw_addr, 0, 0, 362*c793af95Ssangeeta (found_incomplete? IRE_INTERFACE : 363*c793af95Ssangeeta (IRE_CACHETABLE | IRE_INTERFACE)), 364*c793af95Ssangeeta gw_ipif, NULL, zoneid, tsl, match_flags); 365*c793af95Ssangeeta DTRACE_PROBE2(ftable__route__lookup2, (ire_t *), ire, 366*c793af95Ssangeeta (ire_t *), save_ire); 367*c793af95Ssangeeta if (ire == NULL || 368*c793af95Ssangeeta ((ire->ire_type & IRE_CACHE) && ire->ire_nce && 369*c793af95Ssangeeta ire->ire_nce->nce_state != ND_REACHABLE && 370*c793af95Ssangeeta (flags & MATCH_IRE_COMPLETE))) { 371*c793af95Ssangeeta /* 372*c793af95Ssangeeta * Do not release the parent ire if MATCH_IRE_PARENT 373*c793af95Ssangeeta * is set. Also return it via ire. 374*c793af95Ssangeeta */ 375*c793af95Ssangeeta if (ire != NULL) { 376*c793af95Ssangeeta ire_refrele(ire); 377*c793af95Ssangeeta ire = NULL; 378*c793af95Ssangeeta } 379*c793af95Ssangeeta if (flags & MATCH_IRE_PARENT) { 380*c793af95Ssangeeta if (pire != NULL) { 381*c793af95Ssangeeta /* 382*c793af95Ssangeeta * Need an extra REFHOLD, if the 383*c793af95Ssangeeta * parent ire is returned via both 384*c793af95Ssangeeta * ire and pire. 385*c793af95Ssangeeta */ 386*c793af95Ssangeeta IRE_REFHOLD(save_ire); 387*c793af95Ssangeeta } 388*c793af95Ssangeeta ire = save_ire; 389*c793af95Ssangeeta } else { 390*c793af95Ssangeeta ire_refrele(save_ire); 391*c793af95Ssangeeta if (pire != NULL) 392*c793af95Ssangeeta *pire = NULL; 393*c793af95Ssangeeta } 394*c793af95Ssangeeta return (ire); 395*c793af95Ssangeeta } else if (pire == NULL) { 396*c793af95Ssangeeta /* 397*c793af95Ssangeeta * If the caller did not ask for pire, release 398*c793af95Ssangeeta * it now. 399*c793af95Ssangeeta */ 400*c793af95Ssangeeta ire_refrele(save_ire); 401*c793af95Ssangeeta } 402*c793af95Ssangeeta return (ire); 403*c793af95Ssangeeta } 404*c793af95Ssangeeta ASSERT(pire == NULL || *pire == NULL); 405*c793af95Ssangeeta return (ire); 406*c793af95Ssangeeta } 407*c793af95Ssangeeta 408*c793af95Ssangeeta 409*c793af95Ssangeeta /* 410*c793af95Ssangeeta * Find an IRE_OFFSUBNET IRE entry for the multicast address 'group' 411*c793af95Ssangeeta * that goes through 'ipif'. As a fallback, a route that goes through 412*c793af95Ssangeeta * ipif->ipif_ill can be returned. 413*c793af95Ssangeeta */ 414*c793af95Ssangeeta ire_t * 415*c793af95Ssangeeta ipif_lookup_multi_ire(ipif_t *ipif, ipaddr_t group) 416*c793af95Ssangeeta { 417*c793af95Ssangeeta ire_t *ire; 418*c793af95Ssangeeta ire_t *save_ire = NULL; 419*c793af95Ssangeeta ire_t *gw_ire; 420*c793af95Ssangeeta irb_t *irb; 421*c793af95Ssangeeta ipaddr_t gw_addr; 422*c793af95Ssangeeta int match_flags = MATCH_IRE_TYPE | MATCH_IRE_ILL; 423*c793af95Ssangeeta 424*c793af95Ssangeeta ASSERT(CLASSD(group)); 425*c793af95Ssangeeta 426*c793af95Ssangeeta ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, ALL_ZONES, 0, 427*c793af95Ssangeeta NULL, MATCH_IRE_DEFAULT); 428*c793af95Ssangeeta 429*c793af95Ssangeeta if (ire == NULL) 430*c793af95Ssangeeta return (NULL); 431*c793af95Ssangeeta 432*c793af95Ssangeeta irb = ire->ire_bucket; 433*c793af95Ssangeeta ASSERT(irb); 434*c793af95Ssangeeta 435*c793af95Ssangeeta IRB_REFHOLD(irb); 436*c793af95Ssangeeta ire_refrele(ire); 437*c793af95Ssangeeta for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 438*c793af95Ssangeeta if (ire->ire_addr != group || 439*c793af95Ssangeeta ipif->ipif_zoneid != ire->ire_zoneid && 440*c793af95Ssangeeta ire->ire_zoneid != ALL_ZONES) { 441*c793af95Ssangeeta continue; 442*c793af95Ssangeeta } 443*c793af95Ssangeeta 444*c793af95Ssangeeta switch (ire->ire_type) { 445*c793af95Ssangeeta case IRE_DEFAULT: 446*c793af95Ssangeeta case IRE_PREFIX: 447*c793af95Ssangeeta case IRE_HOST: 448*c793af95Ssangeeta gw_addr = ire->ire_gateway_addr; 449*c793af95Ssangeeta gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, 450*c793af95Ssangeeta ipif, NULL, ALL_ZONES, 0, NULL, match_flags); 451*c793af95Ssangeeta 452*c793af95Ssangeeta if (gw_ire != NULL) { 453*c793af95Ssangeeta if (save_ire != NULL) { 454*c793af95Ssangeeta ire_refrele(save_ire); 455*c793af95Ssangeeta } 456*c793af95Ssangeeta IRE_REFHOLD(ire); 457*c793af95Ssangeeta if (gw_ire->ire_ipif == ipif) { 458*c793af95Ssangeeta ire_refrele(gw_ire); 459*c793af95Ssangeeta 460*c793af95Ssangeeta IRB_REFRELE(irb); 461*c793af95Ssangeeta return (ire); 462*c793af95Ssangeeta } 463*c793af95Ssangeeta ire_refrele(gw_ire); 464*c793af95Ssangeeta save_ire = ire; 465*c793af95Ssangeeta } 466*c793af95Ssangeeta break; 467*c793af95Ssangeeta case IRE_IF_NORESOLVER: 468*c793af95Ssangeeta case IRE_IF_RESOLVER: 469*c793af95Ssangeeta if (ire->ire_ipif == ipif) { 470*c793af95Ssangeeta if (save_ire != NULL) { 471*c793af95Ssangeeta ire_refrele(save_ire); 472*c793af95Ssangeeta } 473*c793af95Ssangeeta IRE_REFHOLD(ire); 474*c793af95Ssangeeta 475*c793af95Ssangeeta IRB_REFRELE(irb); 476*c793af95Ssangeeta return (ire); 477*c793af95Ssangeeta } 478*c793af95Ssangeeta break; 479*c793af95Ssangeeta } 480*c793af95Ssangeeta } 481*c793af95Ssangeeta IRB_REFRELE(irb); 482*c793af95Ssangeeta 483*c793af95Ssangeeta return (save_ire); 484*c793af95Ssangeeta } 485*c793af95Ssangeeta 486*c793af95Ssangeeta /* 487*c793af95Ssangeeta * Find an IRE_INTERFACE for the multicast group. 488*c793af95Ssangeeta * Allows different routes for multicast addresses 489*c793af95Ssangeeta * in the unicast routing table (akin to 224.0.0.0 but could be more specific) 490*c793af95Ssangeeta * which point at different interfaces. This is used when IP_MULTICAST_IF 491*c793af95Ssangeeta * isn't specified (when sending) and when IP_ADD_MEMBERSHIP doesn't 492*c793af95Ssangeeta * specify the interface to join on. 493*c793af95Ssangeeta * 494*c793af95Ssangeeta * Supports IP_BOUND_IF by following the ipif/ill when recursing. 495*c793af95Ssangeeta */ 496*c793af95Ssangeeta ire_t * 497*c793af95Ssangeeta ire_lookup_multi(ipaddr_t group, zoneid_t zoneid) 498*c793af95Ssangeeta { 499*c793af95Ssangeeta ire_t *ire; 500*c793af95Ssangeeta ipif_t *ipif = NULL; 501*c793af95Ssangeeta int match_flags = MATCH_IRE_TYPE; 502*c793af95Ssangeeta ipaddr_t gw_addr; 503*c793af95Ssangeeta 504*c793af95Ssangeeta ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, zoneid, 505*c793af95Ssangeeta 0, NULL, MATCH_IRE_DEFAULT); 506*c793af95Ssangeeta 507*c793af95Ssangeeta /* We search a resolvable ire in case of multirouting. */ 508*c793af95Ssangeeta if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) { 509*c793af95Ssangeeta ire_t *cire = NULL; 510*c793af95Ssangeeta /* 511*c793af95Ssangeeta * If the route is not resolvable, the looked up ire 512*c793af95Ssangeeta * may be changed here. In that case, ire_multirt_lookup() 513*c793af95Ssangeeta * IRE_REFRELE the original ire and change it. 514*c793af95Ssangeeta */ 515*c793af95Ssangeeta (void) ire_multirt_lookup(&cire, &ire, MULTIRT_CACHEGW, NULL); 516*c793af95Ssangeeta if (cire != NULL) 517*c793af95Ssangeeta ire_refrele(cire); 518*c793af95Ssangeeta } 519*c793af95Ssangeeta if (ire == NULL) 520*c793af95Ssangeeta return (NULL); 521*c793af95Ssangeeta /* 522*c793af95Ssangeeta * Make sure we follow ire_ipif. 523*c793af95Ssangeeta * 524*c793af95Ssangeeta * We need to determine the interface route through 525*c793af95Ssangeeta * which the gateway will be reached. We don't really 526*c793af95Ssangeeta * care which interface is picked if the interface is 527*c793af95Ssangeeta * part of a group. 528*c793af95Ssangeeta */ 529*c793af95Ssangeeta if (ire->ire_ipif != NULL) { 530*c793af95Ssangeeta ipif = ire->ire_ipif; 531*c793af95Ssangeeta match_flags |= MATCH_IRE_ILL_GROUP; 532*c793af95Ssangeeta } 533*c793af95Ssangeeta 534*c793af95Ssangeeta switch (ire->ire_type) { 535*c793af95Ssangeeta case IRE_DEFAULT: 536*c793af95Ssangeeta case IRE_PREFIX: 537*c793af95Ssangeeta case IRE_HOST: 538*c793af95Ssangeeta gw_addr = ire->ire_gateway_addr; 539*c793af95Ssangeeta ire_refrele(ire); 540*c793af95Ssangeeta ire = ire_ftable_lookup(gw_addr, 0, 0, 541*c793af95Ssangeeta IRE_INTERFACE, ipif, NULL, zoneid, 0, 542*c793af95Ssangeeta NULL, match_flags); 543*c793af95Ssangeeta return (ire); 544*c793af95Ssangeeta case IRE_IF_NORESOLVER: 545*c793af95Ssangeeta case IRE_IF_RESOLVER: 546*c793af95Ssangeeta return (ire); 547*c793af95Ssangeeta default: 548*c793af95Ssangeeta ire_refrele(ire); 549*c793af95Ssangeeta return (NULL); 550*c793af95Ssangeeta } 551*c793af95Ssangeeta } 552*c793af95Ssangeeta 553*c793af95Ssangeeta /* 554*c793af95Ssangeeta * Delete the passed in ire if the gateway addr matches 555*c793af95Ssangeeta */ 556*c793af95Ssangeeta void 557*c793af95Ssangeeta ire_del_host_redir(ire_t *ire, char *gateway) 558*c793af95Ssangeeta { 559*c793af95Ssangeeta if ((ire->ire_type & IRE_HOST_REDIRECT) && 560*c793af95Ssangeeta (ire->ire_gateway_addr == *(ipaddr_t *)gateway)) 561*c793af95Ssangeeta ire_delete(ire); 562*c793af95Ssangeeta } 563*c793af95Ssangeeta 564*c793af95Ssangeeta /* 565*c793af95Ssangeeta * Search for all HOST REDIRECT routes that are 566*c793af95Ssangeeta * pointing at the specified gateway and 567*c793af95Ssangeeta * delete them. This routine is called only 568*c793af95Ssangeeta * when a default gateway is going away. 569*c793af95Ssangeeta */ 570*c793af95Ssangeeta void 571*c793af95Ssangeeta ire_delete_host_redirects(ipaddr_t gateway) 572*c793af95Ssangeeta { 573*c793af95Ssangeeta struct rtfuncarg rtfarg; 574*c793af95Ssangeeta 575*c793af95Ssangeeta (void) memset(&rtfarg, 0, sizeof (rtfarg)); 576*c793af95Ssangeeta rtfarg.rt_func = ire_del_host_redir; 577*c793af95Ssangeeta rtfarg.rt_arg = (void *)&gateway; 578*c793af95Ssangeeta (void) ip_ftable->rnh_walktree(ip_ftable, rtfunc, &rtfarg); 579*c793af95Ssangeeta } 580*c793af95Ssangeeta 581*c793af95Ssangeeta struct ihandle_arg { 582*c793af95Ssangeeta uint32_t ihandle; 583*c793af95Ssangeeta ire_t *ire; 584*c793af95Ssangeeta }; 585*c793af95Ssangeeta 586*c793af95Ssangeeta static int 587*c793af95Ssangeeta ire_ihandle_onlink_match(struct radix_node *rn, void *arg) 588*c793af95Ssangeeta { 589*c793af95Ssangeeta struct rt_entry *rt; 590*c793af95Ssangeeta irb_t *irb; 591*c793af95Ssangeeta ire_t *ire; 592*c793af95Ssangeeta struct ihandle_arg *ih = arg; 593*c793af95Ssangeeta 594*c793af95Ssangeeta rt = (struct rt_entry *)rn; 595*c793af95Ssangeeta ASSERT(rt != NULL); 596*c793af95Ssangeeta irb = &rt->rt_irb; 597*c793af95Ssangeeta for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 598*c793af95Ssangeeta if ((ire->ire_type & IRE_INTERFACE) && 599*c793af95Ssangeeta (ire->ire_ihandle == ih->ihandle)) { 600*c793af95Ssangeeta ih->ire = ire; 601*c793af95Ssangeeta IRE_REFHOLD(ire); 602*c793af95Ssangeeta return (1); 603*c793af95Ssangeeta } 604*c793af95Ssangeeta } 605*c793af95Ssangeeta return (0); 606*c793af95Ssangeeta } 607*c793af95Ssangeeta 608*c793af95Ssangeeta /* 609*c793af95Ssangeeta * Locate the interface ire that is tied to the cache ire 'cire' via 610*c793af95Ssangeeta * cire->ire_ihandle. 611*c793af95Ssangeeta * 612*c793af95Ssangeeta * We are trying to create the cache ire for an onlink destn. or 613*c793af95Ssangeeta * gateway in 'cire'. We are called from ire_add_v4() in the IRE_IF_RESOLVER 614*c793af95Ssangeeta * case, after the ire has come back from ARP. 615*c793af95Ssangeeta */ 616*c793af95Ssangeeta ire_t * 617*c793af95Ssangeeta ire_ihandle_lookup_onlink(ire_t *cire) 618*c793af95Ssangeeta { 619*c793af95Ssangeeta ire_t *ire; 620*c793af95Ssangeeta int match_flags; 621*c793af95Ssangeeta struct ihandle_arg ih; 622*c793af95Ssangeeta 623*c793af95Ssangeeta ASSERT(cire != NULL); 624*c793af95Ssangeeta 625*c793af95Ssangeeta /* 626*c793af95Ssangeeta * We don't need to specify the zoneid to ire_ftable_lookup() below 627*c793af95Ssangeeta * because the ihandle refers to an ipif which can be in only one zone. 628*c793af95Ssangeeta */ 629*c793af95Ssangeeta match_flags = MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK; 630*c793af95Ssangeeta /* 631*c793af95Ssangeeta * We know that the mask of the interface ire equals cire->ire_cmask. 632*c793af95Ssangeeta * (When ip_newroute() created 'cire' for an on-link destn. it set its 633*c793af95Ssangeeta * cmask from the interface ire's mask) 634*c793af95Ssangeeta */ 635*c793af95Ssangeeta ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0, 636*c793af95Ssangeeta IRE_INTERFACE, NULL, NULL, ALL_ZONES, cire->ire_ihandle, 637*c793af95Ssangeeta NULL, match_flags); 638*c793af95Ssangeeta if (ire != NULL) 639*c793af95Ssangeeta return (ire); 640*c793af95Ssangeeta /* 641*c793af95Ssangeeta * If we didn't find an interface ire above, we can't declare failure. 642*c793af95Ssangeeta * For backwards compatibility, we need to support prefix routes 643*c793af95Ssangeeta * pointing to next hop gateways that are not on-link. 644*c793af95Ssangeeta * 645*c793af95Ssangeeta * In the resolver/noresolver case, ip_newroute() thinks it is creating 646*c793af95Ssangeeta * the cache ire for an onlink destination in 'cire'. But 'cire' is 647*c793af95Ssangeeta * not actually onlink, because ire_ftable_lookup() cheated it, by 648*c793af95Ssangeeta * doing ire_route_lookup() twice and returning an interface ire. 649*c793af95Ssangeeta * 650*c793af95Ssangeeta * Eg. default - gw1 (line 1) 651*c793af95Ssangeeta * gw1 - gw2 (line 2) 652*c793af95Ssangeeta * gw2 - hme0 (line 3) 653*c793af95Ssangeeta * 654*c793af95Ssangeeta * In the above example, ip_newroute() tried to create the cache ire 655*c793af95Ssangeeta * 'cire' for gw1, based on the interface route in line 3. The 656*c793af95Ssangeeta * ire_ftable_lookup() above fails, because there is no interface route 657*c793af95Ssangeeta * to reach gw1. (it is gw2). We fall thru below. 658*c793af95Ssangeeta * 659*c793af95Ssangeeta * Do a brute force search based on the ihandle in a subset of the 660*c793af95Ssangeeta * forwarding tables, corresponding to cire->ire_cmask. Otherwise 661*c793af95Ssangeeta * things become very complex, since we don't have 'pire' in this 662*c793af95Ssangeeta * case. (Also note that this method is not possible in the offlink 663*c793af95Ssangeeta * case because we don't know the mask) 664*c793af95Ssangeeta */ 665*c793af95Ssangeeta (void) memset(&ih, 0, sizeof (ih)); 666*c793af95Ssangeeta ih.ihandle = cire->ire_ihandle; 667*c793af95Ssangeeta (void) ip_ftable->rnh_walktree(ip_ftable, 668*c793af95Ssangeeta ire_ihandle_onlink_match, &ih); 669*c793af95Ssangeeta return (ih.ire); 670*c793af95Ssangeeta } 671*c793af95Ssangeeta 672*c793af95Ssangeeta /* 673*c793af95Ssangeeta * IRE iterator used by ire_ftable_lookup[_v6]() to process multiple default 674*c793af95Ssangeeta * routes. Given a starting point in the hash list (ire_origin), walk the IREs 675*c793af95Ssangeeta * in the bucket skipping default interface routes and deleted entries. 676*c793af95Ssangeeta * Returns the next IRE (unheld), or NULL when we're back to the starting point. 677*c793af95Ssangeeta * Assumes that the caller holds a reference on the IRE bucket. 678*c793af95Ssangeeta */ 679*c793af95Ssangeeta ire_t * 680*c793af95Ssangeeta ire_get_next_default_ire(ire_t *ire, ire_t *ire_origin) 681*c793af95Ssangeeta { 682*c793af95Ssangeeta ASSERT(ire_origin->ire_bucket != NULL); 683*c793af95Ssangeeta ASSERT(ire != NULL); 684*c793af95Ssangeeta 685*c793af95Ssangeeta do { 686*c793af95Ssangeeta ire = ire->ire_next; 687*c793af95Ssangeeta if (ire == NULL) 688*c793af95Ssangeeta ire = ire_origin->ire_bucket->irb_ire; 689*c793af95Ssangeeta if (ire == ire_origin) 690*c793af95Ssangeeta return (NULL); 691*c793af95Ssangeeta } while ((ire->ire_type & IRE_INTERFACE) || 692*c793af95Ssangeeta (ire->ire_marks & IRE_MARK_CONDEMNED)); 693*c793af95Ssangeeta ASSERT(ire != NULL); 694*c793af95Ssangeeta return (ire); 695*c793af95Ssangeeta } 696*c793af95Ssangeeta 697*c793af95Ssangeeta static ipif_t * 698*c793af95Ssangeeta ire_forward_src_ipif(ipaddr_t dst, ire_t *sire, ire_t *ire, ill_t *dst_ill, 699*c793af95Ssangeeta int zoneid, ushort_t *marks) 700*c793af95Ssangeeta { 701*c793af95Ssangeeta ipif_t *src_ipif; 702*c793af95Ssangeeta 703*c793af95Ssangeeta /* 704*c793af95Ssangeeta * Pick the best source address from dst_ill. 705*c793af95Ssangeeta * 706*c793af95Ssangeeta * 1) If it is part of a multipathing group, we would 707*c793af95Ssangeeta * like to spread the inbound packets across different 708*c793af95Ssangeeta * interfaces. ipif_select_source picks a random source 709*c793af95Ssangeeta * across the different ills in the group. 710*c793af95Ssangeeta * 711*c793af95Ssangeeta * 2) If it is not part of a multipathing group, we try 712*c793af95Ssangeeta * to pick the source address from the destination 713*c793af95Ssangeeta * route. Clustering assumes that when we have multiple 714*c793af95Ssangeeta * prefixes hosted on an interface, the prefix of the 715*c793af95Ssangeeta * source address matches the prefix of the destination 716*c793af95Ssangeeta * route. We do this only if the address is not 717*c793af95Ssangeeta * DEPRECATED. 718*c793af95Ssangeeta * 719*c793af95Ssangeeta * 3) If the conn is in a different zone than the ire, we 720*c793af95Ssangeeta * need to pick a source address from the right zone. 721*c793af95Ssangeeta * 722*c793af95Ssangeeta * NOTE : If we hit case (1) above, the prefix of the source 723*c793af95Ssangeeta * address picked may not match the prefix of the 724*c793af95Ssangeeta * destination routes prefix as ipif_select_source 725*c793af95Ssangeeta * does not look at "dst" while picking a source 726*c793af95Ssangeeta * address. 727*c793af95Ssangeeta * If we want the same behavior as (2), we will need 728*c793af95Ssangeeta * to change the behavior of ipif_select_source. 729*c793af95Ssangeeta */ 730*c793af95Ssangeeta 731*c793af95Ssangeeta if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) { 732*c793af95Ssangeeta /* 733*c793af95Ssangeeta * The RTF_SETSRC flag is set in the parent ire (sire). 734*c793af95Ssangeeta * Check that the ipif matching the requested source 735*c793af95Ssangeeta * address still exists. 736*c793af95Ssangeeta */ 737*c793af95Ssangeeta src_ipif = ipif_lookup_addr(sire->ire_src_addr, NULL, 738*c793af95Ssangeeta zoneid, NULL, NULL, NULL, NULL); 739*c793af95Ssangeeta return (src_ipif); 740*c793af95Ssangeeta } 741*c793af95Ssangeeta *marks |= IRE_MARK_USESRC_CHECK; 742*c793af95Ssangeeta if ((dst_ill->ill_group != NULL) || 743*c793af95Ssangeeta (ire->ire_ipif->ipif_flags & IPIF_DEPRECATED) || 744*c793af95Ssangeeta (dst_ill->ill_usesrc_ifindex != 0)) { 745*c793af95Ssangeeta src_ipif = ipif_select_source(dst_ill, dst, zoneid); 746*c793af95Ssangeeta if (src_ipif == NULL) 747*c793af95Ssangeeta return (NULL); 748*c793af95Ssangeeta 749*c793af95Ssangeeta } else { 750*c793af95Ssangeeta src_ipif = ire->ire_ipif; 751*c793af95Ssangeeta ASSERT(src_ipif != NULL); 752*c793af95Ssangeeta /* hold src_ipif for uniformity */ 753*c793af95Ssangeeta ipif_refhold(src_ipif); 754*c793af95Ssangeeta } 755*c793af95Ssangeeta return (src_ipif); 756*c793af95Ssangeeta } 757*c793af95Ssangeeta 758*c793af95Ssangeeta /* Added to root cause a bug - should be removed later */ 759*c793af95Ssangeeta ire_t *ire_gw_cache = NULL; 760*c793af95Ssangeeta 761*c793af95Ssangeeta /* 762*c793af95Ssangeeta * This function is called by ip_rput_noire() and ip_fast_forward() 763*c793af95Ssangeeta * to resolve the route of incoming packet that needs to be forwarded. 764*c793af95Ssangeeta * If the ire of the nexthop is not already in the cachetable, this 765*c793af95Ssangeeta * routine will insert it to the table, but won't trigger ARP resolution yet. 766*c793af95Ssangeeta * Thus unlike ip_newroute, this function adds incomplete ires to 767*c793af95Ssangeeta * the cachetable. ARP resolution for these ires are delayed until 768*c793af95Ssangeeta * after all of the packet processing is completed and its ready to 769*c793af95Ssangeeta * be sent out on the wire, Eventually, the packet transmit routine 770*c793af95Ssangeeta * ip_xmit_v4() attempts to send a packet to the driver. If it finds 771*c793af95Ssangeeta * that there is no link layer information, it will do the arp 772*c793af95Ssangeeta * resolution and queue the packet in ire->ire_nce->nce_qd_mp and 773*c793af95Ssangeeta * then send it out once the arp resolution is over 774*c793af95Ssangeeta * (see ip_xmit_v4()->ire_arpresolve()). This scheme is similar to 775*c793af95Ssangeeta * the model of BSD/SunOS 4 776*c793af95Ssangeeta * 777*c793af95Ssangeeta * In future, the insertion of incomplete ires in the cachetable should 778*c793af95Ssangeeta * be implemented in hostpath as well, as doing so will greatly reduce 779*c793af95Ssangeeta * the existing complexity for code paths that depend on the context of 780*c793af95Ssangeeta * the sender (such as IPsec). 781*c793af95Ssangeeta * 782*c793af95Ssangeeta * Thus this scheme of adding incomplete ires in cachetable in forwarding 783*c793af95Ssangeeta * path can be used as a template for simplifying the hostpath. 784*c793af95Ssangeeta */ 785*c793af95Ssangeeta 786*c793af95Ssangeeta ire_t * 787*c793af95Ssangeeta ire_forward(ipaddr_t dst, boolean_t *check_multirt, ire_t *supplied_ire, 788*c793af95Ssangeeta ire_t *supplied_sire, const struct ts_label_s *tsl) 789*c793af95Ssangeeta { 790*c793af95Ssangeeta ipaddr_t gw = 0; 791*c793af95Ssangeeta ire_t *ire = NULL; 792*c793af95Ssangeeta ire_t *sire = NULL, *save_ire; 793*c793af95Ssangeeta ill_t *dst_ill = NULL; 794*c793af95Ssangeeta int error; 795*c793af95Ssangeeta zoneid_t zoneid; 796*c793af95Ssangeeta ipif_t *src_ipif = NULL; 797*c793af95Ssangeeta mblk_t *res_mp; 798*c793af95Ssangeeta ushort_t ire_marks = 0; 799*c793af95Ssangeeta tsol_gcgrp_t *gcgrp = NULL; 800*c793af95Ssangeeta tsol_gcgrp_addr_t ga; 801*c793af95Ssangeeta 802*c793af95Ssangeeta zoneid = GLOBAL_ZONEID; 803*c793af95Ssangeeta 804*c793af95Ssangeeta if (supplied_ire != NULL) { 805*c793af95Ssangeeta /* We have arrived here from ipfil_sendpkt */ 806*c793af95Ssangeeta ire = supplied_ire; 807*c793af95Ssangeeta sire = supplied_sire; 808*c793af95Ssangeeta goto create_irecache; 809*c793af95Ssangeeta } 810*c793af95Ssangeeta 811*c793af95Ssangeeta ire = ire_ftable_lookup(dst, 0, 0, 0, NULL, &sire, zoneid, 0, 812*c793af95Ssangeeta tsl, MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | 813*c793af95Ssangeeta MATCH_IRE_RJ_BHOLE | MATCH_IRE_PARENT|MATCH_IRE_SECATTR); 814*c793af95Ssangeeta 815*c793af95Ssangeeta if (ire == NULL) { 816*c793af95Ssangeeta ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0, RTA_DST); 817*c793af95Ssangeeta goto icmp_err_ret; 818*c793af95Ssangeeta } 819*c793af95Ssangeeta 820*c793af95Ssangeeta /* 821*c793af95Ssangeeta * If we encounter CGTP, we should have the caller use 822*c793af95Ssangeeta * ip_newroute to resolve multirt instead of this function. 823*c793af95Ssangeeta * CGTP specs explicitly state that it can't be used with routers. 824*c793af95Ssangeeta * This essentially prevents insertion of incomplete RTF_MULTIRT 825*c793af95Ssangeeta * ires in cachetable. 826*c793af95Ssangeeta */ 827*c793af95Ssangeeta if (ip_cgtp_filter && 828*c793af95Ssangeeta ((ire->ire_flags & RTF_MULTIRT) || 829*c793af95Ssangeeta ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) { 830*c793af95Ssangeeta ip3dbg(("ire_forward: packet is to be multirouted- " 831*c793af95Ssangeeta "handing it to ip_newroute\n")); 832*c793af95Ssangeeta if (sire != NULL) 833*c793af95Ssangeeta ire_refrele(sire); 834*c793af95Ssangeeta ire_refrele(ire); 835*c793af95Ssangeeta /* 836*c793af95Ssangeeta * Inform caller about encountering of multirt so that 837*c793af95Ssangeeta * ip_newroute() can be called. 838*c793af95Ssangeeta */ 839*c793af95Ssangeeta *check_multirt = B_TRUE; 840*c793af95Ssangeeta return (NULL); 841*c793af95Ssangeeta } 842*c793af95Ssangeeta 843*c793af95Ssangeeta *check_multirt = B_FALSE; 844*c793af95Ssangeeta 845*c793af95Ssangeeta /* 846*c793af95Ssangeeta * Verify that the returned IRE does not have either 847*c793af95Ssangeeta * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is 848*c793af95Ssangeeta * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER. 849*c793af95Ssangeeta */ 850*c793af95Ssangeeta if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) || 851*c793af95Ssangeeta (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0) { 852*c793af95Ssangeeta ip3dbg(("ire 0x%p is not cache/resolver/noresolver\n", 853*c793af95Ssangeeta (void *)ire)); 854*c793af95Ssangeeta goto icmp_err_ret; 855*c793af95Ssangeeta } 856*c793af95Ssangeeta 857*c793af95Ssangeeta /* 858*c793af95Ssangeeta * If we already have a fully resolved IRE CACHE of the 859*c793af95Ssangeeta * nexthop router, just hand over the cache entry 860*c793af95Ssangeeta * and we are done. 861*c793af95Ssangeeta */ 862*c793af95Ssangeeta 863*c793af95Ssangeeta if (ire->ire_type & IRE_CACHE) { 864*c793af95Ssangeeta 865*c793af95Ssangeeta /* 866*c793af95Ssangeeta * If we are using this ire cache entry as a 867*c793af95Ssangeeta * gateway to forward packets, chances are we 868*c793af95Ssangeeta * will be using it again. So turn off 869*c793af95Ssangeeta * the temporary flag, thus reducing its 870*c793af95Ssangeeta * chances of getting deleted frequently. 871*c793af95Ssangeeta */ 872*c793af95Ssangeeta if (ire->ire_marks & IRE_MARK_TEMPORARY) { 873*c793af95Ssangeeta irb_t *irb = ire->ire_bucket; 874*c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 875*c793af95Ssangeeta ire->ire_marks &= ~IRE_MARK_TEMPORARY; 876*c793af95Ssangeeta irb->irb_tmp_ire_cnt--; 877*c793af95Ssangeeta rw_exit(&irb->irb_lock); 878*c793af95Ssangeeta } 879*c793af95Ssangeeta 880*c793af95Ssangeeta if (sire != NULL) { 881*c793af95Ssangeeta UPDATE_OB_PKT_COUNT(sire); 882*c793af95Ssangeeta sire->ire_last_used_time = lbolt; 883*c793af95Ssangeeta ire_refrele(sire); 884*c793af95Ssangeeta } 885*c793af95Ssangeeta return (ire); 886*c793af95Ssangeeta } 887*c793af95Ssangeeta create_irecache: 888*c793af95Ssangeeta /* 889*c793af95Ssangeeta * Increment the ire_ob_pkt_count field for ire if it is an 890*c793af95Ssangeeta * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and 891*c793af95Ssangeeta * increment the same for the parent IRE, sire, if it is some 892*c793af95Ssangeeta * sort of prefix IRE (which includes DEFAULT, PREFIX, HOST 893*c793af95Ssangeeta * and HOST_REDIRECT). 894*c793af95Ssangeeta */ 895*c793af95Ssangeeta if ((ire->ire_type & IRE_INTERFACE) != 0) { 896*c793af95Ssangeeta UPDATE_OB_PKT_COUNT(ire); 897*c793af95Ssangeeta ire->ire_last_used_time = lbolt; 898*c793af95Ssangeeta } 899*c793af95Ssangeeta 900*c793af95Ssangeeta /* 901*c793af95Ssangeeta * sire must be either IRE_CACHETABLE OR IRE_INTERFACE type 902*c793af95Ssangeeta */ 903*c793af95Ssangeeta if (sire != NULL) { 904*c793af95Ssangeeta gw = sire->ire_gateway_addr; 905*c793af95Ssangeeta ASSERT((sire->ire_type & 906*c793af95Ssangeeta (IRE_CACHETABLE | IRE_INTERFACE)) == 0); 907*c793af95Ssangeeta UPDATE_OB_PKT_COUNT(sire); 908*c793af95Ssangeeta sire->ire_last_used_time = lbolt; 909*c793af95Ssangeeta } 910*c793af95Ssangeeta 911*c793af95Ssangeeta /* Obtain dst_ill */ 912*c793af95Ssangeeta dst_ill = ip_newroute_get_dst_ill(ire->ire_ipif->ipif_ill); 913*c793af95Ssangeeta if (dst_ill == NULL) { 914*c793af95Ssangeeta ip2dbg(("ire_forward no dst ill; ire 0x%p\n", 915*c793af95Ssangeeta (void *)ire)); 916*c793af95Ssangeeta goto icmp_err_ret; 917*c793af95Ssangeeta } 918*c793af95Ssangeeta 919*c793af95Ssangeeta ASSERT(src_ipif == NULL); 920*c793af95Ssangeeta /* Now obtain the src_ipif */ 921*c793af95Ssangeeta src_ipif = ire_forward_src_ipif(dst, sire, ire, dst_ill, 922*c793af95Ssangeeta zoneid, &ire_marks); 923*c793af95Ssangeeta if (src_ipif == NULL) 924*c793af95Ssangeeta goto icmp_err_ret; 925*c793af95Ssangeeta 926*c793af95Ssangeeta switch (ire->ire_type) { 927*c793af95Ssangeeta case IRE_IF_NORESOLVER: 928*c793af95Ssangeeta /* create ire_cache for ire_addr endpoint */ 929*c793af95Ssangeeta case IRE_IF_RESOLVER: 930*c793af95Ssangeeta /* 931*c793af95Ssangeeta * We have the IRE_IF_RESOLVER of the nexthop gateway 932*c793af95Ssangeeta * and now need to build a IRE_CACHE for it. 933*c793af95Ssangeeta * In this case, we have the following : 934*c793af95Ssangeeta * 935*c793af95Ssangeeta * 1) src_ipif - used for getting a source address. 936*c793af95Ssangeeta * 937*c793af95Ssangeeta * 2) dst_ill - from which we derive ire_stq/ire_rfq. This 938*c793af95Ssangeeta * means packets using the IRE_CACHE that we will build 939*c793af95Ssangeeta * here will go out on dst_ill. 940*c793af95Ssangeeta * 941*c793af95Ssangeeta * 3) sire may or may not be NULL. But, the IRE_CACHE that is 942*c793af95Ssangeeta * to be created will only be tied to the IRE_INTERFACE 943*c793af95Ssangeeta * that was derived from the ire_ihandle field. 944*c793af95Ssangeeta * 945*c793af95Ssangeeta * If sire is non-NULL, it means the destination is 946*c793af95Ssangeeta * off-link and we will first create the IRE_CACHE for the 947*c793af95Ssangeeta * gateway. 948*c793af95Ssangeeta */ 949*c793af95Ssangeeta res_mp = dst_ill->ill_resolver_mp; 950*c793af95Ssangeeta if (ire->ire_type == IRE_IF_RESOLVER && 951*c793af95Ssangeeta (!OK_RESOLVER_MP(res_mp))) { 952*c793af95Ssangeeta ire_refrele(ire); 953*c793af95Ssangeeta ire = NULL; 954*c793af95Ssangeeta goto out; 955*c793af95Ssangeeta } 956*c793af95Ssangeeta /* 957*c793af95Ssangeeta * To be at this point in the code with a non-zero gw 958*c793af95Ssangeeta * means that dst is reachable through a gateway that 959*c793af95Ssangeeta * we have never resolved. By changing dst to the gw 960*c793af95Ssangeeta * addr we resolve the gateway first. 961*c793af95Ssangeeta */ 962*c793af95Ssangeeta if (gw != INADDR_ANY) { 963*c793af95Ssangeeta /* 964*c793af95Ssangeeta * The source ipif that was determined above was 965*c793af95Ssangeeta * relative to the destination address, not the 966*c793af95Ssangeeta * gateway's. If src_ipif was not taken out of 967*c793af95Ssangeeta * the IRE_IF_RESOLVER entry, we'll need to call 968*c793af95Ssangeeta * ipif_select_source() again. 969*c793af95Ssangeeta */ 970*c793af95Ssangeeta if (src_ipif != ire->ire_ipif) { 971*c793af95Ssangeeta ipif_refrele(src_ipif); 972*c793af95Ssangeeta src_ipif = ipif_select_source(dst_ill, 973*c793af95Ssangeeta gw, zoneid); 974*c793af95Ssangeeta if (src_ipif == NULL) 975*c793af95Ssangeeta goto icmp_err_ret; 976*c793af95Ssangeeta } 977*c793af95Ssangeeta dst = gw; 978*c793af95Ssangeeta gw = INADDR_ANY; 979*c793af95Ssangeeta } 980*c793af95Ssangeeta /* 981*c793af95Ssangeeta * dst has been set to the address of the nexthop. 982*c793af95Ssangeeta * 983*c793af95Ssangeeta * TSol note: get security attributes of the nexthop; 984*c793af95Ssangeeta * Note that the nexthop may either be a gateway, or the 985*c793af95Ssangeeta * packet destination itself; Detailed explanation of 986*c793af95Ssangeeta * issues involved is provided in the IRE_IF_NORESOLVER 987*c793af95Ssangeeta * logic in ip_newroute(). 988*c793af95Ssangeeta */ 989*c793af95Ssangeeta ga.ga_af = AF_INET; 990*c793af95Ssangeeta IN6_IPADDR_TO_V4MAPPED(dst, &ga.ga_addr); 991*c793af95Ssangeeta gcgrp = gcgrp_lookup(&ga, B_FALSE); 992*c793af95Ssangeeta 993*c793af95Ssangeeta if (ire->ire_type == IRE_IF_NORESOLVER) 994*c793af95Ssangeeta dst = ire->ire_addr; /* ire_cache for tunnel endpoint */ 995*c793af95Ssangeeta 996*c793af95Ssangeeta save_ire = ire; 997*c793af95Ssangeeta /* 998*c793af95Ssangeeta * create an incomplete ire-cache with a null dlureq_mp. 999*c793af95Ssangeeta * The dlureq_mp will be created in ire_arpresolve. 1000*c793af95Ssangeeta */ 1001*c793af95Ssangeeta ire = ire_create( 1002*c793af95Ssangeeta (uchar_t *)&dst, /* dest address */ 1003*c793af95Ssangeeta (uchar_t *)&ip_g_all_ones, /* mask */ 1004*c793af95Ssangeeta (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ 1005*c793af95Ssangeeta (uchar_t *)&gw, /* gateway address */ 1006*c793af95Ssangeeta NULL, 1007*c793af95Ssangeeta (save_ire->ire_type == IRE_IF_RESOLVER ? NULL: 1008*c793af95Ssangeeta &save_ire->ire_max_frag), 1009*c793af95Ssangeeta NULL, 1010*c793af95Ssangeeta dst_ill->ill_rq, /* recv-from queue */ 1011*c793af95Ssangeeta dst_ill->ill_wq, /* send-to queue */ 1012*c793af95Ssangeeta IRE_CACHE, /* IRE type */ 1013*c793af95Ssangeeta NULL, 1014*c793af95Ssangeeta src_ipif, 1015*c793af95Ssangeeta NULL, 1016*c793af95Ssangeeta ire->ire_mask, /* Parent mask */ 1017*c793af95Ssangeeta 0, 1018*c793af95Ssangeeta ire->ire_ihandle, /* Interface handle */ 1019*c793af95Ssangeeta 0, 1020*c793af95Ssangeeta &(ire->ire_uinfo), 1021*c793af95Ssangeeta NULL, 1022*c793af95Ssangeeta gcgrp); 1023*c793af95Ssangeeta ip1dbg(("incomplete ire_cache 0x%p\n", (void *)ire)); 1024*c793af95Ssangeeta if (ire != NULL) { 1025*c793af95Ssangeeta gcgrp = NULL; /* reference now held by IRE */ 1026*c793af95Ssangeeta ire->ire_marks |= ire_marks; 1027*c793af95Ssangeeta /* add the incomplete ire: */ 1028*c793af95Ssangeeta error = ire_add(&ire, NULL, NULL, NULL, B_TRUE); 1029*c793af95Ssangeeta if (error == 0 && ire != NULL) { 1030*c793af95Ssangeeta ire->ire_max_frag = save_ire->ire_max_frag; 1031*c793af95Ssangeeta ip1dbg(("setting max_frag to %d in ire 0x%p\n", 1032*c793af95Ssangeeta ire->ire_max_frag, (void *)ire)); 1033*c793af95Ssangeeta } else { 1034*c793af95Ssangeeta ire_refrele(save_ire); 1035*c793af95Ssangeeta goto icmp_err_ret; 1036*c793af95Ssangeeta } 1037*c793af95Ssangeeta } else { 1038*c793af95Ssangeeta if (gcgrp != NULL) { 1039*c793af95Ssangeeta GCGRP_REFRELE(gcgrp); 1040*c793af95Ssangeeta gcgrp = NULL; 1041*c793af95Ssangeeta } 1042*c793af95Ssangeeta } 1043*c793af95Ssangeeta 1044*c793af95Ssangeeta ire_refrele(save_ire); 1045*c793af95Ssangeeta break; 1046*c793af95Ssangeeta default: 1047*c793af95Ssangeeta break; 1048*c793af95Ssangeeta } 1049*c793af95Ssangeeta 1050*c793af95Ssangeeta out: 1051*c793af95Ssangeeta if (sire != NULL) 1052*c793af95Ssangeeta ire_refrele(sire); 1053*c793af95Ssangeeta if (dst_ill != NULL) 1054*c793af95Ssangeeta ill_refrele(dst_ill); 1055*c793af95Ssangeeta if (src_ipif != NULL) 1056*c793af95Ssangeeta ipif_refrele(src_ipif); 1057*c793af95Ssangeeta return (ire); 1058*c793af95Ssangeeta icmp_err_ret: 1059*c793af95Ssangeeta if (src_ipif != NULL) 1060*c793af95Ssangeeta ipif_refrele(src_ipif); 1061*c793af95Ssangeeta if (dst_ill != NULL) 1062*c793af95Ssangeeta ill_refrele(dst_ill); 1063*c793af95Ssangeeta if (sire != NULL) 1064*c793af95Ssangeeta ire_refrele(sire); 1065*c793af95Ssangeeta if (ire != NULL) { 1066*c793af95Ssangeeta ire_refrele(ire); 1067*c793af95Ssangeeta } 1068*c793af95Ssangeeta /* caller needs to send icmp error message */ 1069*c793af95Ssangeeta return (NULL); 1070*c793af95Ssangeeta 1071*c793af95Ssangeeta } 1072*c793af95Ssangeeta 1073*c793af95Ssangeeta /* 1074*c793af95Ssangeeta * Obtain the rt_entry and rt_irb for the route to be added to the ip_ftable. 1075*c793af95Ssangeeta * First attempt to add a node to the radix tree via rn_addroute. If the 1076*c793af95Ssangeeta * route already exists, return the bucket for the existing route. 1077*c793af95Ssangeeta * 1078*c793af95Ssangeeta * Locking notes: Need to hold the global radix tree lock in write mode to 1079*c793af95Ssangeeta * add a radix node. To prevent the node from being deleted, ire_get_bucket() 1080*c793af95Ssangeeta * returns with a ref'ed irb_t. The ire itself is added in ire_add_v4() 1081*c793af95Ssangeeta * while holding the irb_lock, but not the radix tree lock. 1082*c793af95Ssangeeta */ 1083*c793af95Ssangeeta irb_t * 1084*c793af95Ssangeeta ire_get_bucket(ire_t *ire) 1085*c793af95Ssangeeta { 1086*c793af95Ssangeeta struct radix_node *rn; 1087*c793af95Ssangeeta struct rt_entry *rt; 1088*c793af95Ssangeeta struct rt_sockaddr rmask, rdst; 1089*c793af95Ssangeeta irb_t *irb = NULL; 1090*c793af95Ssangeeta 1091*c793af95Ssangeeta ASSERT(ip_ftable != NULL); 1092*c793af95Ssangeeta 1093*c793af95Ssangeeta /* first try to see if route exists (based on rtalloc1) */ 1094*c793af95Ssangeeta (void) memset(&rdst, 0, sizeof (rdst)); 1095*c793af95Ssangeeta rdst.rt_sin_len = sizeof (rdst); 1096*c793af95Ssangeeta rdst.rt_sin_family = AF_INET; 1097*c793af95Ssangeeta rdst.rt_sin_addr.s_addr = ire->ire_addr; 1098*c793af95Ssangeeta 1099*c793af95Ssangeeta (void) memset(&rmask, 0, sizeof (rmask)); 1100*c793af95Ssangeeta rmask.rt_sin_len = sizeof (rmask); 1101*c793af95Ssangeeta rmask.rt_sin_family = AF_INET; 1102*c793af95Ssangeeta rmask.rt_sin_addr.s_addr = ire->ire_mask; 1103*c793af95Ssangeeta 1104*c793af95Ssangeeta /* 1105*c793af95Ssangeeta * add the route. based on BSD's rtrequest1(RTM_ADD) 1106*c793af95Ssangeeta */ 1107*c793af95Ssangeeta R_Malloc(rt, rt_entry_cache, sizeof (*rt)); 1108*c793af95Ssangeeta (void) memset(rt, 0, sizeof (*rt)); 1109*c793af95Ssangeeta rt->rt_nodes->rn_key = (char *)&rt->rt_dst; 1110*c793af95Ssangeeta rt->rt_dst = rdst; 1111*c793af95Ssangeeta irb = &rt->rt_irb; 1112*c793af95Ssangeeta irb->irb_marks |= IRB_MARK_FTABLE; /* dynamically allocated/freed */ 1113*c793af95Ssangeeta rw_init(&irb->irb_lock, NULL, RW_DEFAULT, NULL); 1114*c793af95Ssangeeta RADIX_NODE_HEAD_WLOCK(ip_ftable); 1115*c793af95Ssangeeta rn = ip_ftable->rnh_addaddr(&rt->rt_dst, &rmask, ip_ftable, 1116*c793af95Ssangeeta (struct radix_node *)rt); 1117*c793af95Ssangeeta if (rn == NULL) { 1118*c793af95Ssangeeta RADIX_NODE_HEAD_UNLOCK(ip_ftable); 1119*c793af95Ssangeeta Free(rt, rt_entry_cache); 1120*c793af95Ssangeeta rt = NULL; 1121*c793af95Ssangeeta irb = NULL; 1122*c793af95Ssangeeta RADIX_NODE_HEAD_RLOCK(ip_ftable); 1123*c793af95Ssangeeta if ((rn = ip_ftable->rnh_lookup(&rdst, &rmask, ip_ftable)) != 1124*c793af95Ssangeeta NULL && ((rn->rn_flags & RNF_ROOT) == 0)) { 1125*c793af95Ssangeeta /* found a non-root match */ 1126*c793af95Ssangeeta rt = (struct rt_entry *)rn; 1127*c793af95Ssangeeta } 1128*c793af95Ssangeeta } 1129*c793af95Ssangeeta if (rt != NULL) { 1130*c793af95Ssangeeta irb = &rt->rt_irb; 1131*c793af95Ssangeeta IRB_REFHOLD(irb); 1132*c793af95Ssangeeta } 1133*c793af95Ssangeeta RADIX_NODE_HEAD_UNLOCK(ip_ftable); 1134*c793af95Ssangeeta return (irb); 1135*c793af95Ssangeeta } 1136*c793af95Ssangeeta 1137*c793af95Ssangeeta /* 1138*c793af95Ssangeeta * This function is used when the caller wants to know the outbound 1139*c793af95Ssangeeta * interface for a packet given only the address. 1140*c793af95Ssangeeta * If this is a offlink IP address and there are multiple 1141*c793af95Ssangeeta * routes to this destination, this routine will utilise the 1142*c793af95Ssangeeta * first route it finds to IP address 1143*c793af95Ssangeeta * Return values: 1144*c793af95Ssangeeta * 0 - FAILURE 1145*c793af95Ssangeeta * nonzero - ifindex 1146*c793af95Ssangeeta */ 1147*c793af95Ssangeeta uint_t 1148*c793af95Ssangeeta ifindex_lookup(const struct sockaddr *ipaddr, zoneid_t zoneid) 1149*c793af95Ssangeeta { 1150*c793af95Ssangeeta uint_t ifindex = 0; 1151*c793af95Ssangeeta ire_t *ire; 1152*c793af95Ssangeeta ill_t *ill; 1153*c793af95Ssangeeta 1154*c793af95Ssangeeta /* zoneid is a placeholder for future routing table per-zone project */ 1155*c793af95Ssangeeta ASSERT(zoneid == ALL_ZONES); 1156*c793af95Ssangeeta 1157*c793af95Ssangeeta ASSERT(ipaddr->sa_family == AF_INET || ipaddr->sa_family == AF_INET6); 1158*c793af95Ssangeeta 1159*c793af95Ssangeeta if ((ire = route_to_dst(ipaddr, zoneid)) != NULL) { 1160*c793af95Ssangeeta ill = ire_to_ill(ire); 1161*c793af95Ssangeeta if (ill != NULL) 1162*c793af95Ssangeeta ifindex = ill->ill_phyint->phyint_ifindex; 1163*c793af95Ssangeeta ire_refrele(ire); 1164*c793af95Ssangeeta } 1165*c793af95Ssangeeta return (ifindex); 1166*c793af95Ssangeeta } 1167*c793af95Ssangeeta 1168*c793af95Ssangeeta /* 1169*c793af95Ssangeeta * Routine to find the route to a destination. If a ifindex is supplied 1170*c793af95Ssangeeta * it tries to match the the route to the corresponding ipif for the ifindex 1171*c793af95Ssangeeta */ 1172*c793af95Ssangeeta static ire_t * 1173*c793af95Ssangeeta route_to_dst(const struct sockaddr *dst_addr, zoneid_t zoneid) 1174*c793af95Ssangeeta { 1175*c793af95Ssangeeta ire_t *ire = NULL; 1176*c793af95Ssangeeta int match_flags; 1177*c793af95Ssangeeta 1178*c793af95Ssangeeta match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | 1179*c793af95Ssangeeta MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE); 1180*c793af95Ssangeeta 1181*c793af95Ssangeeta /* XXX pass NULL tsl for now */ 1182*c793af95Ssangeeta 1183*c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 1184*c793af95Ssangeeta ire = ire_route_lookup( 1185*c793af95Ssangeeta ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr, 1186*c793af95Ssangeeta 0, 0, 0, NULL, NULL, zoneid, NULL, match_flags); 1187*c793af95Ssangeeta } else { 1188*c793af95Ssangeeta ire = ire_route_lookup_v6( 1189*c793af95Ssangeeta &((struct sockaddr_in6 *)dst_addr)->sin6_addr, 1190*c793af95Ssangeeta 0, 0, 0, NULL, NULL, zoneid, NULL, match_flags); 1191*c793af95Ssangeeta } 1192*c793af95Ssangeeta return (ire); 1193*c793af95Ssangeeta } 1194*c793af95Ssangeeta 1195*c793af95Ssangeeta /* 1196*c793af95Ssangeeta * This routine is called by IP Filter to send a packet out on the wire 1197*c793af95Ssangeeta * to a specified V4 dst (which may be onlink or offlink). The ifindex may or 1198*c793af95Ssangeeta * may not be 0. A non-null ifindex indicates IP Filter has stipulated 1199*c793af95Ssangeeta * an outgoing interface and requires the nexthop to be on that interface. 1200*c793af95Ssangeeta * IP WILL NOT DO the following to the data packet before sending it out: 1201*c793af95Ssangeeta * a. manipulate ttl 1202*c793af95Ssangeeta * b. checksuming 1203*c793af95Ssangeeta * c. ipsec work 1204*c793af95Ssangeeta * d. fragmentation 1205*c793af95Ssangeeta * 1206*c793af95Ssangeeta * Return values: 1207*c793af95Ssangeeta * 0: IP was able to send of the data pkt 1208*c793af95Ssangeeta * ECOMM: Could not send packet 1209*c793af95Ssangeeta * ENONET No route to dst. It is up to the caller 1210*c793af95Ssangeeta * to send icmp unreachable error message, 1211*c793af95Ssangeeta * EINPROGRESS The macaddr of the onlink dst or that 1212*c793af95Ssangeeta * of the offlink dst's nexthop needs to get 1213*c793af95Ssangeeta * resolved before packet can be sent to dst. 1214*c793af95Ssangeeta * Thus transmission is not guaranteed. 1215*c793af95Ssangeeta * 1216*c793af95Ssangeeta */ 1217*c793af95Ssangeeta 1218*c793af95Ssangeeta int 1219*c793af95Ssangeeta ipfil_sendpkt(const struct sockaddr *dst_addr, mblk_t *mp, uint_t ifindex, 1220*c793af95Ssangeeta zoneid_t zoneid) 1221*c793af95Ssangeeta { 1222*c793af95Ssangeeta ire_t *ire = NULL, *sire = NULL; 1223*c793af95Ssangeeta ire_t *ire_cache = NULL; 1224*c793af95Ssangeeta boolean_t check_multirt = B_FALSE; 1225*c793af95Ssangeeta int value; 1226*c793af95Ssangeeta int match_flags; 1227*c793af95Ssangeeta ipaddr_t dst; 1228*c793af95Ssangeeta 1229*c793af95Ssangeeta ASSERT(mp != NULL); 1230*c793af95Ssangeeta 1231*c793af95Ssangeeta ASSERT(dst_addr->sa_family == AF_INET || 1232*c793af95Ssangeeta dst_addr->sa_family == AF_INET6); 1233*c793af95Ssangeeta 1234*c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 1235*c793af95Ssangeeta dst = ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr; 1236*c793af95Ssangeeta } else { 1237*c793af95Ssangeeta /* 1238*c793af95Ssangeeta * We dont have support for V6 yet. It will be provided 1239*c793af95Ssangeeta * once RFE 6399103 has been delivered. 1240*c793af95Ssangeeta * Until then, for V6 dsts, IP Filter will not call 1241*c793af95Ssangeeta * this function. Instead, IP Filter will continue to do what 1242*c793af95Ssangeeta * has been done since S10, namely it will use 1243*c793af95Ssangeeta * ip_nexthop(),ip_nexthop_route() to obtain the 1244*c793af95Ssangeeta * link-layer address of a V6 dst and then process the 1245*c793af95Ssangeeta * packet and send it out on the wire on its own. 1246*c793af95Ssangeeta */ 1247*c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: no V6 support \n")); 1248*c793af95Ssangeeta value = ECOMM; 1249*c793af95Ssangeeta freemsg(mp); 1250*c793af95Ssangeeta goto discard; 1251*c793af95Ssangeeta } 1252*c793af95Ssangeeta 1253*c793af95Ssangeeta /* 1254*c793af95Ssangeeta * Lets get the ire. We might get the ire cache entry, 1255*c793af95Ssangeeta * or the ire,sire pair needed to create the cache entry. 1256*c793af95Ssangeeta * XXX pass NULL tsl for now. 1257*c793af95Ssangeeta */ 1258*c793af95Ssangeeta 1259*c793af95Ssangeeta if (ifindex == 0) { 1260*c793af95Ssangeeta /* There is no supplied index. So use the FIB info */ 1261*c793af95Ssangeeta 1262*c793af95Ssangeeta match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | 1263*c793af95Ssangeeta MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE); 1264*c793af95Ssangeeta ire = ire_route_lookup(dst, 1265*c793af95Ssangeeta 0, 0, 0, NULL, &sire, zoneid, MBLK_GETLABEL(mp), 1266*c793af95Ssangeeta match_flags); 1267*c793af95Ssangeeta } else { 1268*c793af95Ssangeeta ipif_t *supplied_ipif; 1269*c793af95Ssangeeta ill_t *ill; 1270*c793af95Ssangeeta 1271*c793af95Ssangeeta /* 1272*c793af95Ssangeeta * If supplied ifindex is non-null, the only valid 1273*c793af95Ssangeeta * nexthop is one off of the interface corresponding 1274*c793af95Ssangeeta * to the specified ifindex. 1275*c793af95Ssangeeta */ 1276*c793af95Ssangeeta 1277*c793af95Ssangeeta ill = ill_lookup_on_ifindex(ifindex, B_FALSE, 1278*c793af95Ssangeeta NULL, NULL, NULL, NULL); 1279*c793af95Ssangeeta if (ill != NULL) { 1280*c793af95Ssangeeta supplied_ipif = ipif_get_next_ipif(NULL, ill); 1281*c793af95Ssangeeta } else { 1282*c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Could not find" 1283*c793af95Ssangeeta " route to dst\n")); 1284*c793af95Ssangeeta value = ECOMM; 1285*c793af95Ssangeeta freemsg(mp); 1286*c793af95Ssangeeta goto discard; 1287*c793af95Ssangeeta } 1288*c793af95Ssangeeta 1289*c793af95Ssangeeta match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | 1290*c793af95Ssangeeta MATCH_IRE_IPIF | MATCH_IRE_RECURSIVE| MATCH_IRE_RJ_BHOLE| 1291*c793af95Ssangeeta MATCH_IRE_SECATTR); 1292*c793af95Ssangeeta 1293*c793af95Ssangeeta ire = ire_route_lookup(dst, 0, 0, 0, supplied_ipif, 1294*c793af95Ssangeeta &sire, zoneid, MBLK_GETLABEL(mp), match_flags); 1295*c793af95Ssangeeta ill_refrele(ill); 1296*c793af95Ssangeeta } 1297*c793af95Ssangeeta 1298*c793af95Ssangeeta /* 1299*c793af95Ssangeeta * Verify that the returned IRE is non-null and does 1300*c793af95Ssangeeta * not have either the RTF_REJECT or RTF_BLACKHOLE 1301*c793af95Ssangeeta * flags set and that the IRE is either an IRE_CACHE, 1302*c793af95Ssangeeta * IRE_IF_NORESOLVER or IRE_IF_RESOLVER. 1303*c793af95Ssangeeta */ 1304*c793af95Ssangeeta if (ire == NULL || 1305*c793af95Ssangeeta ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) || 1306*c793af95Ssangeeta (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0)) { 1307*c793af95Ssangeeta /* 1308*c793af95Ssangeeta * Either ire could not be found or we got 1309*c793af95Ssangeeta * an invalid one 1310*c793af95Ssangeeta */ 1311*c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Could not find route to dst\n")); 1312*c793af95Ssangeeta value = ENONET; 1313*c793af95Ssangeeta freemsg(mp); 1314*c793af95Ssangeeta goto discard; 1315*c793af95Ssangeeta } 1316*c793af95Ssangeeta 1317*c793af95Ssangeeta /* IP Filter and CGTP dont mix. So bail out if CGTP is on */ 1318*c793af95Ssangeeta if (ip_cgtp_filter && 1319*c793af95Ssangeeta ((ire->ire_flags & RTF_MULTIRT) || 1320*c793af95Ssangeeta ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) { 1321*c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: IPFilter does not work with CGTP\n")); 1322*c793af95Ssangeeta value = ECOMM; 1323*c793af95Ssangeeta freemsg(mp); 1324*c793af95Ssangeeta goto discard; 1325*c793af95Ssangeeta } 1326*c793af95Ssangeeta 1327*c793af95Ssangeeta ASSERT(ire->ire_nce != NULL); 1328*c793af95Ssangeeta /* 1329*c793af95Ssangeeta * If needed, we will create the ire cache entry for the 1330*c793af95Ssangeeta * nexthop, resolve its link-layer address and then send 1331*c793af95Ssangeeta * the packet out without ttl, checksumming, IPSec processing. 1332*c793af95Ssangeeta */ 1333*c793af95Ssangeeta 1334*c793af95Ssangeeta switch (ire->ire_type) { 1335*c793af95Ssangeeta case IRE_IF_NORESOLVER: 1336*c793af95Ssangeeta case IRE_CACHE: 1337*c793af95Ssangeeta if (sire != NULL) { 1338*c793af95Ssangeeta UPDATE_OB_PKT_COUNT(sire); 1339*c793af95Ssangeeta sire->ire_last_used_time = lbolt; 1340*c793af95Ssangeeta ire_refrele(sire); 1341*c793af95Ssangeeta } 1342*c793af95Ssangeeta ire_cache = ire; 1343*c793af95Ssangeeta break; 1344*c793af95Ssangeeta case IRE_IF_RESOLVER: 1345*c793af95Ssangeeta /* 1346*c793af95Ssangeeta * Call ire_forward(). This function 1347*c793af95Ssangeeta * will, create the ire cache entry of the 1348*c793af95Ssangeeta * the nexthop and adds this incomplete ire 1349*c793af95Ssangeeta * to the ire cache table 1350*c793af95Ssangeeta */ 1351*c793af95Ssangeeta ire_cache = ire_forward(dst, &check_multirt, ire, sire, 1352*c793af95Ssangeeta MBLK_GETLABEL(mp)); 1353*c793af95Ssangeeta if (ire_cache == NULL) { 1354*c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: failed to create the" 1355*c793af95Ssangeeta " ire cache entry \n")); 1356*c793af95Ssangeeta value = ENONET; 1357*c793af95Ssangeeta freemsg(mp); 1358*c793af95Ssangeeta sire = NULL; 1359*c793af95Ssangeeta ire = NULL; 1360*c793af95Ssangeeta goto discard; 1361*c793af95Ssangeeta } 1362*c793af95Ssangeeta break; 1363*c793af95Ssangeeta } 1364*c793af95Ssangeeta /* 1365*c793af95Ssangeeta * Now that we have the ire cache entry of the nexthop, call 1366*c793af95Ssangeeta * ip_xmit_v4() to trigger mac addr resolution 1367*c793af95Ssangeeta * if necessary and send it once ready. 1368*c793af95Ssangeeta */ 1369*c793af95Ssangeeta 1370*c793af95Ssangeeta value = ip_xmit_v4(mp, ire_cache, NULL, B_FALSE); 1371*c793af95Ssangeeta ire_refrele(ire_cache); 1372*c793af95Ssangeeta /* 1373*c793af95Ssangeeta * At this point, the reference for these have already been 1374*c793af95Ssangeeta * released within ire_forward() and/or ip_xmit_v4(). So we set 1375*c793af95Ssangeeta * them to NULL to make sure we dont drop the references 1376*c793af95Ssangeeta * again in case ip_xmit_v4() returns with either SEND_FAILED 1377*c793af95Ssangeeta * or LLHDR_RESLV_FAILED 1378*c793af95Ssangeeta */ 1379*c793af95Ssangeeta sire = NULL; 1380*c793af95Ssangeeta ire = NULL; 1381*c793af95Ssangeeta 1382*c793af95Ssangeeta switch (value) { 1383*c793af95Ssangeeta case SEND_FAILED: 1384*c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Send failed\n")); 1385*c793af95Ssangeeta value = ECOMM; 1386*c793af95Ssangeeta break; 1387*c793af95Ssangeeta case LLHDR_RESLV_FAILED: 1388*c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Link-layer resolution" 1389*c793af95Ssangeeta " failed\n")); 1390*c793af95Ssangeeta value = ECOMM; 1391*c793af95Ssangeeta break; 1392*c793af95Ssangeeta case LOOKUP_IN_PROGRESS: 1393*c793af95Ssangeeta return (EINPROGRESS); 1394*c793af95Ssangeeta case SEND_PASSED: 1395*c793af95Ssangeeta return (0); 1396*c793af95Ssangeeta } 1397*c793af95Ssangeeta discard: 1398*c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 1399*c793af95Ssangeeta BUMP_MIB(&ip_mib, ipOutDiscards); 1400*c793af95Ssangeeta } else { 1401*c793af95Ssangeeta BUMP_MIB(&ip6_mib, ipv6OutDiscards); 1402*c793af95Ssangeeta } 1403*c793af95Ssangeeta if (ire != NULL) 1404*c793af95Ssangeeta ire_refrele(ire); 1405*c793af95Ssangeeta if (sire != NULL) 1406*c793af95Ssangeeta ire_refrele(sire); 1407*c793af95Ssangeeta return (value); 1408*c793af95Ssangeeta } 1409*c793af95Ssangeeta 1410*c793af95Ssangeeta /* ire_walk routine invoked for ip_ire_report for each IRE. */ 1411*c793af95Ssangeeta void 1412*c793af95Ssangeeta ire_report_ftable(ire_t *ire, char *m) 1413*c793af95Ssangeeta { 1414*c793af95Ssangeeta char buf1[16]; 1415*c793af95Ssangeeta char buf2[16]; 1416*c793af95Ssangeeta char buf3[16]; 1417*c793af95Ssangeeta char buf4[16]; 1418*c793af95Ssangeeta uint_t fo_pkt_count; 1419*c793af95Ssangeeta uint_t ib_pkt_count; 1420*c793af95Ssangeeta int ref; 1421*c793af95Ssangeeta uint_t print_len, buf_len; 1422*c793af95Ssangeeta mblk_t *mp = (mblk_t *)m; 1423*c793af95Ssangeeta 1424*c793af95Ssangeeta if (ire->ire_type & IRE_CACHETABLE) 1425*c793af95Ssangeeta return; 1426*c793af95Ssangeeta buf_len = mp->b_datap->db_lim - mp->b_wptr; 1427*c793af95Ssangeeta if (buf_len <= 0) 1428*c793af95Ssangeeta return; 1429*c793af95Ssangeeta 1430*c793af95Ssangeeta /* Number of active references of this ire */ 1431*c793af95Ssangeeta ref = ire->ire_refcnt; 1432*c793af95Ssangeeta /* "inbound" to a non local address is a forward */ 1433*c793af95Ssangeeta ib_pkt_count = ire->ire_ib_pkt_count; 1434*c793af95Ssangeeta fo_pkt_count = 0; 1435*c793af95Ssangeeta if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) { 1436*c793af95Ssangeeta fo_pkt_count = ib_pkt_count; 1437*c793af95Ssangeeta ib_pkt_count = 0; 1438*c793af95Ssangeeta } 1439*c793af95Ssangeeta print_len = snprintf((char *)mp->b_wptr, buf_len, 1440*c793af95Ssangeeta MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d " 1441*c793af95Ssangeeta "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d " 1442*c793af95Ssangeeta "%04d %08d %08d %d/%d/%d %s\n", 1443*c793af95Ssangeeta (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq, 1444*c793af95Ssangeeta (int)ire->ire_zoneid, 1445*c793af95Ssangeeta ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2), 1446*c793af95Ssangeeta ip_dot_addr(ire->ire_src_addr, buf3), 1447*c793af95Ssangeeta ip_dot_addr(ire->ire_gateway_addr, buf4), 1448*c793af95Ssangeeta ire->ire_max_frag, ire->ire_uinfo.iulp_rtt, 1449*c793af95Ssangeeta ire->ire_uinfo.iulp_rtt_sd, 1450*c793af95Ssangeeta ire->ire_uinfo.iulp_ssthresh, ref, 1451*c793af95Ssangeeta ire->ire_uinfo.iulp_rtomax, 1452*c793af95Ssangeeta (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0), 1453*c793af95Ssangeeta (ire->ire_uinfo.iulp_wscale_ok ? 1: 0), 1454*c793af95Ssangeeta (ire->ire_uinfo.iulp_ecn_ok ? 1: 0), 1455*c793af95Ssangeeta (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0), 1456*c793af95Ssangeeta ire->ire_uinfo.iulp_sack, 1457*c793af95Ssangeeta ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe, 1458*c793af95Ssangeeta ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count, 1459*c793af95Ssangeeta ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type)); 1460*c793af95Ssangeeta if (print_len < buf_len) { 1461*c793af95Ssangeeta mp->b_wptr += print_len; 1462*c793af95Ssangeeta } else { 1463*c793af95Ssangeeta mp->b_wptr += buf_len; 1464*c793af95Ssangeeta } 1465*c793af95Ssangeeta } 1466*c793af95Ssangeeta 1467*c793af95Ssangeeta /* 1468*c793af95Ssangeeta * callback function provided by ire_ftable_lookup when calling 1469*c793af95Ssangeeta * rn_match_args(). Invoke ire_match_args on each matching leaf node in 1470*c793af95Ssangeeta * the radix tree. 1471*c793af95Ssangeeta */ 1472*c793af95Ssangeeta boolean_t 1473*c793af95Ssangeeta ire_find_best_route(struct radix_node *rn, void *arg) 1474*c793af95Ssangeeta { 1475*c793af95Ssangeeta struct rt_entry *rt = (struct rt_entry *)rn; 1476*c793af95Ssangeeta irb_t *irb_ptr; 1477*c793af95Ssangeeta ire_t *ire; 1478*c793af95Ssangeeta ire_ftable_args_t *margs = arg; 1479*c793af95Ssangeeta ipaddr_t match_mask; 1480*c793af95Ssangeeta 1481*c793af95Ssangeeta ASSERT(rt != NULL); 1482*c793af95Ssangeeta 1483*c793af95Ssangeeta irb_ptr = &rt->rt_irb; 1484*c793af95Ssangeeta 1485*c793af95Ssangeeta if (irb_ptr->irb_ire_cnt == 0) 1486*c793af95Ssangeeta return (B_FALSE); 1487*c793af95Ssangeeta 1488*c793af95Ssangeeta rw_enter(&irb_ptr->irb_lock, RW_READER); 1489*c793af95Ssangeeta for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 1490*c793af95Ssangeeta if (ire->ire_marks & IRE_MARK_CONDEMNED) 1491*c793af95Ssangeeta continue; 1492*c793af95Ssangeeta if (margs->ift_flags & MATCH_IRE_MASK) 1493*c793af95Ssangeeta match_mask = margs->ift_mask; 1494*c793af95Ssangeeta else 1495*c793af95Ssangeeta match_mask = ire->ire_mask; 1496*c793af95Ssangeeta 1497*c793af95Ssangeeta if (ire_match_args(ire, margs->ift_addr, match_mask, 1498*c793af95Ssangeeta margs->ift_gateway, margs->ift_type, margs->ift_ipif, 1499*c793af95Ssangeeta margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl, 1500*c793af95Ssangeeta margs->ift_flags)) { 1501*c793af95Ssangeeta IRE_REFHOLD(ire); 1502*c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 1503*c793af95Ssangeeta margs->ift_best_ire = ire; 1504*c793af95Ssangeeta return (B_TRUE); 1505*c793af95Ssangeeta } 1506*c793af95Ssangeeta } 1507*c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 1508*c793af95Ssangeeta return (B_FALSE); 1509*c793af95Ssangeeta } 1510*c793af95Ssangeeta 1511*c793af95Ssangeeta /* 1512*c793af95Ssangeeta * ftable irb_t structures are dynamically allocated, and we need to 1513*c793af95Ssangeeta * check if the irb_t (and associated ftable tree attachment) needs to 1514*c793af95Ssangeeta * be cleaned up when the irb_refcnt goes to 0. The conditions that need 1515*c793af95Ssangeeta * be verified are: 1516*c793af95Ssangeeta * - no other walkers of the irebucket, i.e., quiescent irb_refcnt, 1517*c793af95Ssangeeta * - no other threads holding references to ire's in the bucket, 1518*c793af95Ssangeeta * i.e., irb_nire == 0 1519*c793af95Ssangeeta * - no active ire's in the bucket, i.e., irb_ire_cnt == 0 1520*c793af95Ssangeeta * - need to hold the global tree lock and irb_lock in write mode. 1521*c793af95Ssangeeta */ 1522*c793af95Ssangeeta void 1523*c793af95Ssangeeta irb_refrele_ftable(irb_t *irb) 1524*c793af95Ssangeeta { 1525*c793af95Ssangeeta for (;;) { 1526*c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 1527*c793af95Ssangeeta ASSERT(irb->irb_refcnt != 0); 1528*c793af95Ssangeeta if (irb->irb_refcnt != 1) { 1529*c793af95Ssangeeta /* 1530*c793af95Ssangeeta * Someone has a reference to this radix node 1531*c793af95Ssangeeta * or there is some bucket walker. 1532*c793af95Ssangeeta */ 1533*c793af95Ssangeeta irb->irb_refcnt--; 1534*c793af95Ssangeeta rw_exit(&irb->irb_lock); 1535*c793af95Ssangeeta return; 1536*c793af95Ssangeeta } else { 1537*c793af95Ssangeeta /* 1538*c793af95Ssangeeta * There is no other walker, nor is there any 1539*c793af95Ssangeeta * other thread that holds a direct ref to this 1540*c793af95Ssangeeta * radix node. Do the clean up if needed. Call 1541*c793af95Ssangeeta * to ire_unlink will clear the IRB_MARK_CONDEMNED flag 1542*c793af95Ssangeeta */ 1543*c793af95Ssangeeta if (irb->irb_marks & IRB_MARK_CONDEMNED) { 1544*c793af95Ssangeeta ire_t *ire_list; 1545*c793af95Ssangeeta 1546*c793af95Ssangeeta ire_list = ire_unlink(irb); 1547*c793af95Ssangeeta rw_exit(&irb->irb_lock); 1548*c793af95Ssangeeta 1549*c793af95Ssangeeta if (ire_list != NULL) 1550*c793af95Ssangeeta ire_cleanup(ire_list); 1551*c793af95Ssangeeta /* 1552*c793af95Ssangeeta * more CONDEMNED entries could have 1553*c793af95Ssangeeta * been added while we dropped the lock, 1554*c793af95Ssangeeta * so we have to re-check. 1555*c793af95Ssangeeta */ 1556*c793af95Ssangeeta continue; 1557*c793af95Ssangeeta } 1558*c793af95Ssangeeta 1559*c793af95Ssangeeta /* 1560*c793af95Ssangeeta * Now check if there are still any ires 1561*c793af95Ssangeeta * associated with this radix node. 1562*c793af95Ssangeeta */ 1563*c793af95Ssangeeta if (irb->irb_nire != 0) { 1564*c793af95Ssangeeta /* 1565*c793af95Ssangeeta * someone is still holding on 1566*c793af95Ssangeeta * to ires in this bucket 1567*c793af95Ssangeeta */ 1568*c793af95Ssangeeta irb->irb_refcnt--; 1569*c793af95Ssangeeta rw_exit(&irb->irb_lock); 1570*c793af95Ssangeeta return; 1571*c793af95Ssangeeta } else { 1572*c793af95Ssangeeta /* 1573*c793af95Ssangeeta * Everything is clear. Zero walkers, 1574*c793af95Ssangeeta * Zero threads with a ref to this 1575*c793af95Ssangeeta * radix node, Zero ires associated with 1576*c793af95Ssangeeta * this radix node. Due to lock order, 1577*c793af95Ssangeeta * check the above conditions again 1578*c793af95Ssangeeta * after grabbing all locks in the right order 1579*c793af95Ssangeeta */ 1580*c793af95Ssangeeta rw_exit(&irb->irb_lock); 1581*c793af95Ssangeeta if (irb_inactive(irb)) 1582*c793af95Ssangeeta return; 1583*c793af95Ssangeeta /* 1584*c793af95Ssangeeta * irb_inactive could not free the irb. 1585*c793af95Ssangeeta * See if there are any walkers, if not 1586*c793af95Ssangeeta * try to clean up again. 1587*c793af95Ssangeeta */ 1588*c793af95Ssangeeta } 1589*c793af95Ssangeeta } 1590*c793af95Ssangeeta } 1591*c793af95Ssangeeta } 1592*c793af95Ssangeeta 1593*c793af95Ssangeeta /* 1594*c793af95Ssangeeta * IRE iterator used by ire_ftable_lookup() to process multiple default 1595*c793af95Ssangeeta * routes. Given a starting point in the hash list (ire_origin), walk the IREs 1596*c793af95Ssangeeta * in the bucket skipping default interface routes and deleted entries. 1597*c793af95Ssangeeta * Returns the next IRE (unheld), or NULL when we're back to the starting point. 1598*c793af95Ssangeeta * Assumes that the caller holds a reference on the IRE bucket. 1599*c793af95Ssangeeta * 1600*c793af95Ssangeeta * In the absence of good IRE_DEFAULT routes, this function will return 1601*c793af95Ssangeeta * the first IRE_INTERFACE route found (if any). 1602*c793af95Ssangeeta */ 1603*c793af95Ssangeeta ire_t * 1604*c793af95Ssangeeta ire_round_robin(irb_t *irb_ptr, zoneid_t zoneid, ire_ftable_args_t *margs) 1605*c793af95Ssangeeta { 1606*c793af95Ssangeeta ire_t *ire_origin; 1607*c793af95Ssangeeta ire_t *ire, *maybe_ire = NULL; 1608*c793af95Ssangeeta 1609*c793af95Ssangeeta rw_enter(&irb_ptr->irb_lock, RW_WRITER); 1610*c793af95Ssangeeta ire_origin = irb_ptr->irb_rr_origin; 1611*c793af95Ssangeeta if (ire_origin != NULL) 1612*c793af95Ssangeeta ire_origin = ire_origin->ire_next; 1613*c793af95Ssangeeta 1614*c793af95Ssangeeta if (ire_origin == NULL) { 1615*c793af95Ssangeeta /* 1616*c793af95Ssangeeta * first time through routine, or we dropped off the end 1617*c793af95Ssangeeta * of list. 1618*c793af95Ssangeeta */ 1619*c793af95Ssangeeta ire_origin = irb_ptr->irb_ire; 1620*c793af95Ssangeeta } 1621*c793af95Ssangeeta irb_ptr->irb_rr_origin = ire_origin; 1622*c793af95Ssangeeta IRB_REFHOLD_LOCKED(irb_ptr); 1623*c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 1624*c793af95Ssangeeta 1625*c793af95Ssangeeta /* 1626*c793af95Ssangeeta * Round-robin the routers list looking for a route that 1627*c793af95Ssangeeta * matches the passed in parameters. 1628*c793af95Ssangeeta * We start with the ire we found above and we walk the hash 1629*c793af95Ssangeeta * list until we're back where we started. It doesn't matter if 1630*c793af95Ssangeeta * routes are added or deleted by other threads - we know this 1631*c793af95Ssangeeta * ire will stay in the list because we hold a reference on the 1632*c793af95Ssangeeta * ire bucket. 1633*c793af95Ssangeeta */ 1634*c793af95Ssangeeta ire = ire_origin; 1635*c793af95Ssangeeta while (ire != NULL) { 1636*c793af95Ssangeeta int match_flags = 0; 1637*c793af95Ssangeeta ire_t *rire; 1638*c793af95Ssangeeta 1639*c793af95Ssangeeta if (ire->ire_marks & IRE_MARK_CONDEMNED) 1640*c793af95Ssangeeta goto next_ire; 1641*c793af95Ssangeeta 1642*c793af95Ssangeeta if (!ire_match_args(ire, margs->ift_addr, (ipaddr_t)0, 1643*c793af95Ssangeeta margs->ift_gateway, margs->ift_type, margs->ift_ipif, 1644*c793af95Ssangeeta margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl, 1645*c793af95Ssangeeta margs->ift_flags)) 1646*c793af95Ssangeeta goto next_ire; 1647*c793af95Ssangeeta 1648*c793af95Ssangeeta if (ire->ire_type & IRE_INTERFACE) { 1649*c793af95Ssangeeta /* 1650*c793af95Ssangeeta * keep looking to see if there is a non-interface 1651*c793af95Ssangeeta * default ire, but save this one as a last resort. 1652*c793af95Ssangeeta */ 1653*c793af95Ssangeeta if (maybe_ire == NULL) 1654*c793af95Ssangeeta maybe_ire = ire; 1655*c793af95Ssangeeta goto next_ire; 1656*c793af95Ssangeeta } 1657*c793af95Ssangeeta 1658*c793af95Ssangeeta if (zoneid == ALL_ZONES) { 1659*c793af95Ssangeeta IRE_REFHOLD(ire); 1660*c793af95Ssangeeta IRB_REFRELE(irb_ptr); 1661*c793af95Ssangeeta return (ire); 1662*c793af95Ssangeeta } 1663*c793af95Ssangeeta /* 1664*c793af95Ssangeeta * When we're in a local zone, we're only 1665*c793af95Ssangeeta * interested in routers that are 1666*c793af95Ssangeeta * reachable through ipifs within our zone. 1667*c793af95Ssangeeta */ 1668*c793af95Ssangeeta if (ire->ire_ipif != NULL) { 1669*c793af95Ssangeeta match_flags |= MATCH_IRE_ILL_GROUP; 1670*c793af95Ssangeeta } 1671*c793af95Ssangeeta rire = ire_route_lookup(ire->ire_gateway_addr, 1672*c793af95Ssangeeta 0, 0, 0, ire->ire_ipif, NULL, zoneid, margs->ift_tsl, 1673*c793af95Ssangeeta match_flags); 1674*c793af95Ssangeeta if (rire != NULL) { 1675*c793af95Ssangeeta ire_refrele(rire); 1676*c793af95Ssangeeta IRE_REFHOLD(ire); 1677*c793af95Ssangeeta IRB_REFRELE(irb_ptr); 1678*c793af95Ssangeeta return (ire); 1679*c793af95Ssangeeta } 1680*c793af95Ssangeeta next_ire: 1681*c793af95Ssangeeta ire = (ire->ire_next ? ire->ire_next : irb_ptr->irb_ire); 1682*c793af95Ssangeeta if (ire == ire_origin) 1683*c793af95Ssangeeta break; 1684*c793af95Ssangeeta } 1685*c793af95Ssangeeta if (maybe_ire != NULL) 1686*c793af95Ssangeeta IRE_REFHOLD(maybe_ire); 1687*c793af95Ssangeeta IRB_REFRELE(irb_ptr); 1688*c793af95Ssangeeta return (maybe_ire); 1689*c793af95Ssangeeta } 1690