1c793af95Ssangeeta /* 2c793af95Ssangeeta * CDDL HEADER START 3c793af95Ssangeeta * 4c793af95Ssangeeta * The contents of this file are subject to the terms of the 5c793af95Ssangeeta * Common Development and Distribution License (the "License"). 6c793af95Ssangeeta * You may not use this file except in compliance with the License. 7c793af95Ssangeeta * 8c793af95Ssangeeta * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c793af95Ssangeeta * or http://www.opensolaris.org/os/licensing. 10c793af95Ssangeeta * See the License for the specific language governing permissions 11c793af95Ssangeeta * and limitations under the License. 12c793af95Ssangeeta * 13c793af95Ssangeeta * When distributing Covered Code, include this CDDL HEADER in each 14c793af95Ssangeeta * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c793af95Ssangeeta * If applicable, add the following below this CDDL HEADER, with the 16c793af95Ssangeeta * fields enclosed by brackets "[]" replaced with your own identifying 17c793af95Ssangeeta * information: Portions Copyright [yyyy] [name of copyright owner] 18c793af95Ssangeeta * 19c793af95Ssangeeta * CDDL HEADER END 20c793af95Ssangeeta */ 21c793af95Ssangeeta /* 2242ee8d71Sja97890 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23c793af95Ssangeeta * Use is subject to license terms. 24c793af95Ssangeeta */ 25c793af95Ssangeeta 26c793af95Ssangeeta /* 27c793af95Ssangeeta * This file contains consumer routines of the IPv4 forwarding engine 28c793af95Ssangeeta */ 29c793af95Ssangeeta 30c793af95Ssangeeta #include <sys/types.h> 31c793af95Ssangeeta #include <sys/stream.h> 32c793af95Ssangeeta #include <sys/stropts.h> 33c793af95Ssangeeta #include <sys/strlog.h> 34c793af95Ssangeeta #include <sys/dlpi.h> 35c793af95Ssangeeta #include <sys/ddi.h> 36c793af95Ssangeeta #include <sys/cmn_err.h> 37c793af95Ssangeeta #include <sys/policy.h> 38c793af95Ssangeeta 39c793af95Ssangeeta #include <sys/systm.h> 40c793af95Ssangeeta #include <sys/strsun.h> 41c793af95Ssangeeta #include <sys/kmem.h> 42c793af95Ssangeeta #include <sys/param.h> 43c793af95Ssangeeta #include <sys/socket.h> 44edd26dc5Sdr146992 #include <sys/strsubr.h> 45edd26dc5Sdr146992 #include <sys/pattr.h> 46c793af95Ssangeeta #include <net/if.h> 47c793af95Ssangeeta #include <net/route.h> 48c793af95Ssangeeta #include <netinet/in.h> 49c793af95Ssangeeta #include <net/if_dl.h> 50c793af95Ssangeeta #include <netinet/ip6.h> 51c793af95Ssangeeta #include <netinet/icmp6.h> 52c793af95Ssangeeta 53c793af95Ssangeeta #include <inet/common.h> 54c793af95Ssangeeta #include <inet/mi.h> 55c793af95Ssangeeta #include <inet/mib2.h> 56c793af95Ssangeeta #include <inet/ip.h> 57edd26dc5Sdr146992 #include <inet/ip_impl.h> 58c793af95Ssangeeta #include <inet/ip6.h> 59c793af95Ssangeeta #include <inet/ip_ndp.h> 60c793af95Ssangeeta #include <inet/arp.h> 61c793af95Ssangeeta #include <inet/ip_if.h> 62c793af95Ssangeeta #include <inet/ip_ire.h> 63c793af95Ssangeeta #include <inet/ip_ftable.h> 64c793af95Ssangeeta #include <inet/ip_rts.h> 65c793af95Ssangeeta #include <inet/nd.h> 66c793af95Ssangeeta 67c793af95Ssangeeta #include <net/pfkeyv2.h> 68c793af95Ssangeeta #include <inet/ipsec_info.h> 69c793af95Ssangeeta #include <inet/sadb.h> 70c793af95Ssangeeta #include <sys/kmem.h> 71c793af95Ssangeeta #include <inet/tcp.h> 72c793af95Ssangeeta #include <inet/ipclassifier.h> 73c793af95Ssangeeta #include <sys/zone.h> 74c793af95Ssangeeta #include <net/radix.h> 75c793af95Ssangeeta #include <sys/tsol/label.h> 76c793af95Ssangeeta #include <sys/tsol/tnet.h> 77c793af95Ssangeeta 78c793af95Ssangeeta #define IS_DEFAULT_ROUTE(ire) \ 79c793af95Ssangeeta (((ire)->ire_type & IRE_DEFAULT) || \ 80c793af95Ssangeeta (((ire)->ire_type & IRE_INTERFACE) && ((ire)->ire_addr == 0))) 81c793af95Ssangeeta 82c793af95Ssangeeta /* 83c793af95Ssangeeta * structure for passing args between ire_ftable_lookup and ire_find_best_route 84c793af95Ssangeeta */ 85c793af95Ssangeeta typedef struct ire_ftable_args_s { 86c793af95Ssangeeta ipaddr_t ift_addr; 87c793af95Ssangeeta ipaddr_t ift_mask; 88c793af95Ssangeeta ipaddr_t ift_gateway; 89c793af95Ssangeeta int ift_type; 90c793af95Ssangeeta const ipif_t *ift_ipif; 91c793af95Ssangeeta zoneid_t ift_zoneid; 92c793af95Ssangeeta uint32_t ift_ihandle; 93c793af95Ssangeeta const ts_label_t *ift_tsl; 94c793af95Ssangeeta int ift_flags; 95c793af95Ssangeeta ire_t *ift_best_ire; 96c793af95Ssangeeta } ire_ftable_args_t; 97c793af95Ssangeeta 98f4b3ec61Sdh155122 static ire_t *route_to_dst(const struct sockaddr *, zoneid_t, ip_stack_t *); 99f4b3ec61Sdh155122 static ire_t *ire_round_robin(irb_t *, zoneid_t, ire_ftable_args_t *, 100f4b3ec61Sdh155122 ip_stack_t *); 101c793af95Ssangeeta static void ire_del_host_redir(ire_t *, char *); 102c793af95Ssangeeta static boolean_t ire_find_best_route(struct radix_node *, void *); 103edd26dc5Sdr146992 static int ip_send_align_hcksum_flags(mblk_t *, ill_t *); 104*da14cebeSEric Cheng static ire_t *ire_ftable_lookup_simple(ipaddr_t, 105*da14cebeSEric Cheng ire_t **, zoneid_t, int, ip_stack_t *); 106c793af95Ssangeeta 107c793af95Ssangeeta /* 108c793af95Ssangeeta * Lookup a route in forwarding table. A specific lookup is indicated by 109c793af95Ssangeeta * passing the required parameters and indicating the match required in the 110c793af95Ssangeeta * flag field. 111c793af95Ssangeeta * 112c793af95Ssangeeta * Looking for default route can be done in three ways 113c793af95Ssangeeta * 1) pass mask as 0 and set MATCH_IRE_MASK in flags field 114c793af95Ssangeeta * along with other matches. 115c793af95Ssangeeta * 2) pass type as IRE_DEFAULT and set MATCH_IRE_TYPE in flags 116c793af95Ssangeeta * field along with other matches. 117c793af95Ssangeeta * 3) if the destination and mask are passed as zeros. 118c793af95Ssangeeta * 119c793af95Ssangeeta * A request to return a default route if no route 120c793af95Ssangeeta * is found, can be specified by setting MATCH_IRE_DEFAULT 121c793af95Ssangeeta * in flags. 122c793af95Ssangeeta * 123c793af95Ssangeeta * It does not support recursion more than one level. It 124c793af95Ssangeeta * will do recursive lookup only when the lookup maps to 125c793af95Ssangeeta * a prefix or default route and MATCH_IRE_RECURSIVE flag is passed. 126c793af95Ssangeeta * 127c793af95Ssangeeta * If the routing table is setup to allow more than one level 128c793af95Ssangeeta * of recursion, the cleaning up cache table will not work resulting 129c793af95Ssangeeta * in invalid routing. 130c793af95Ssangeeta * 131c793af95Ssangeeta * Supports IP_BOUND_IF by following the ipif/ill when recursing. 132c793af95Ssangeeta * 133c793af95Ssangeeta * NOTE : When this function returns NULL, pire has already been released. 134c793af95Ssangeeta * pire is valid only when this function successfully returns an 135c793af95Ssangeeta * ire. 136c793af95Ssangeeta */ 137c793af95Ssangeeta ire_t * 138c793af95Ssangeeta ire_ftable_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 139c793af95Ssangeeta int type, const ipif_t *ipif, ire_t **pire, zoneid_t zoneid, 140f4b3ec61Sdh155122 uint32_t ihandle, const ts_label_t *tsl, int flags, ip_stack_t *ipst) 141c793af95Ssangeeta { 142c793af95Ssangeeta ire_t *ire = NULL; 143c793af95Ssangeeta ipaddr_t gw_addr; 144c793af95Ssangeeta struct rt_sockaddr rdst, rmask; 145c793af95Ssangeeta struct rt_entry *rt; 146c793af95Ssangeeta ire_ftable_args_t margs; 147c793af95Ssangeeta boolean_t found_incomplete = B_FALSE; 148c793af95Ssangeeta 149c793af95Ssangeeta ASSERT(ipif == NULL || !ipif->ipif_isv6); 150c793af95Ssangeeta 151c793af95Ssangeeta /* 152c793af95Ssangeeta * When we return NULL from this function, we should make 153c793af95Ssangeeta * sure that *pire is NULL so that the callers will not 154c793af95Ssangeeta * wrongly REFRELE the pire. 155c793af95Ssangeeta */ 156c793af95Ssangeeta if (pire != NULL) 157c793af95Ssangeeta *pire = NULL; 158c793af95Ssangeeta /* 159c793af95Ssangeeta * ire_match_args() will dereference ipif MATCH_IRE_SRC or 160c793af95Ssangeeta * MATCH_IRE_ILL is set. 161c793af95Ssangeeta */ 162c793af95Ssangeeta if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) && 163c793af95Ssangeeta (ipif == NULL)) 164c793af95Ssangeeta return (NULL); 165c793af95Ssangeeta 166c793af95Ssangeeta (void) memset(&rdst, 0, sizeof (rdst)); 167c793af95Ssangeeta rdst.rt_sin_len = sizeof (rdst); 168c793af95Ssangeeta rdst.rt_sin_family = AF_INET; 169c793af95Ssangeeta rdst.rt_sin_addr.s_addr = addr; 170c793af95Ssangeeta 171c793af95Ssangeeta (void) memset(&rmask, 0, sizeof (rmask)); 172c793af95Ssangeeta rmask.rt_sin_len = sizeof (rmask); 173c793af95Ssangeeta rmask.rt_sin_family = AF_INET; 174c793af95Ssangeeta rmask.rt_sin_addr.s_addr = mask; 175c793af95Ssangeeta 176c793af95Ssangeeta (void) memset(&margs, 0, sizeof (margs)); 177c793af95Ssangeeta margs.ift_addr = addr; 178c793af95Ssangeeta margs.ift_mask = mask; 179c793af95Ssangeeta margs.ift_gateway = gateway; 180c793af95Ssangeeta margs.ift_type = type; 181c793af95Ssangeeta margs.ift_ipif = ipif; 182c793af95Ssangeeta margs.ift_zoneid = zoneid; 183c793af95Ssangeeta margs.ift_ihandle = ihandle; 184c793af95Ssangeeta margs.ift_tsl = tsl; 185c793af95Ssangeeta margs.ift_flags = flags; 186c793af95Ssangeeta 187c793af95Ssangeeta /* 188c793af95Ssangeeta * The flags argument passed to ire_ftable_lookup may cause the 189c793af95Ssangeeta * search to return, not the longest matching prefix, but the 190c793af95Ssangeeta * "best matching prefix", i.e., the longest prefix that also 191c793af95Ssangeeta * satisfies constraints imposed via the permutation of flags 192c793af95Ssangeeta * passed in. To achieve this, we invoke ire_match_args() on 193c793af95Ssangeeta * each matching leaf in the radix tree. ire_match_args is 194c793af95Ssangeeta * invoked by the callback function ire_find_best_route() 195c793af95Ssangeeta * We hold the global tree lock in read mode when calling 196c793af95Ssangeeta * rn_match_args.Before dropping the global tree lock, ensure 197c793af95Ssangeeta * that the radix node can't be deleted by incrementing ire_refcnt. 198c793af95Ssangeeta */ 199f4b3ec61Sdh155122 RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 200f4b3ec61Sdh155122 rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst, 201f4b3ec61Sdh155122 ipst->ips_ip_ftable, ire_find_best_route, &margs); 202c793af95Ssangeeta ire = margs.ift_best_ire; 203f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 204c793af95Ssangeeta 205c793af95Ssangeeta if (rt == NULL) { 206c793af95Ssangeeta return (NULL); 207c793af95Ssangeeta } else { 208c793af95Ssangeeta ASSERT(ire != NULL); 209c793af95Ssangeeta } 210c793af95Ssangeeta 211c793af95Ssangeeta DTRACE_PROBE2(ire__found, ire_ftable_args_t *, &margs, ire_t *, ire); 212c793af95Ssangeeta 213c793af95Ssangeeta if (!IS_DEFAULT_ROUTE(ire)) 214c793af95Ssangeeta goto found_ire_held; 215c793af95Ssangeeta /* 216c793af95Ssangeeta * If default route is found, see if default matching criteria 217c793af95Ssangeeta * are satisfied. 218c793af95Ssangeeta */ 219c793af95Ssangeeta if (flags & MATCH_IRE_MASK) { 220c793af95Ssangeeta /* 221c793af95Ssangeeta * we were asked to match a 0 mask, and came back with 222c793af95Ssangeeta * a default route. Ok to return it. 223c793af95Ssangeeta */ 224c793af95Ssangeeta goto found_default_ire; 225c793af95Ssangeeta } 226c793af95Ssangeeta if ((flags & MATCH_IRE_TYPE) && 227c793af95Ssangeeta (type & (IRE_DEFAULT | IRE_INTERFACE))) { 228c793af95Ssangeeta /* 229c793af95Ssangeeta * we were asked to match a default ire type. Ok to return it. 230c793af95Ssangeeta */ 231c793af95Ssangeeta goto found_default_ire; 232c793af95Ssangeeta } 233c793af95Ssangeeta if (flags & MATCH_IRE_DEFAULT) { 234c793af95Ssangeeta goto found_default_ire; 235c793af95Ssangeeta } 236c793af95Ssangeeta /* 237c793af95Ssangeeta * we found a default route, but default matching criteria 238c793af95Ssangeeta * are not specified and we are not explicitly looking for 239c793af95Ssangeeta * default. 240c793af95Ssangeeta */ 241c793af95Ssangeeta IRE_REFRELE(ire); 242c793af95Ssangeeta return (NULL); 243c793af95Ssangeeta found_default_ire: 244c793af95Ssangeeta /* 245c793af95Ssangeeta * round-robin only if we have more than one route in the bucket. 246c793af95Ssangeeta */ 247c793af95Ssangeeta if ((ire->ire_bucket->irb_ire_cnt > 1) && 248c793af95Ssangeeta IS_DEFAULT_ROUTE(ire) && 249c793af95Ssangeeta ((flags & (MATCH_IRE_DEFAULT | MATCH_IRE_MASK)) == 250c793af95Ssangeeta MATCH_IRE_DEFAULT)) { 251c793af95Ssangeeta ire_t *next_ire; 252c793af95Ssangeeta 253f4b3ec61Sdh155122 next_ire = ire_round_robin(ire->ire_bucket, zoneid, &margs, 254f4b3ec61Sdh155122 ipst); 255c793af95Ssangeeta IRE_REFRELE(ire); 256c793af95Ssangeeta if (next_ire != NULL) { 257c793af95Ssangeeta ire = next_ire; 258c793af95Ssangeeta } else { 259c793af95Ssangeeta /* no route */ 260c793af95Ssangeeta return (NULL); 261c793af95Ssangeeta } 262c793af95Ssangeeta } 263c793af95Ssangeeta found_ire_held: 264c793af95Ssangeeta if ((flags & MATCH_IRE_RJ_BHOLE) && 265c793af95Ssangeeta (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) { 266c793af95Ssangeeta return (ire); 267c793af95Ssangeeta } 268c793af95Ssangeeta /* 269c793af95Ssangeeta * At this point, IRE that was found must be an IRE_FORWARDTABLE 270c793af95Ssangeeta * type. If this is a recursive lookup and an IRE_INTERFACE type was 271c793af95Ssangeeta * found, return that. If it was some other IRE_FORWARDTABLE type of 272c793af95Ssangeeta * IRE (one of the prefix types), then it is necessary to fill in the 273c793af95Ssangeeta * parent IRE pointed to by pire, and then lookup the gateway address of 274c793af95Ssangeeta * the parent. For backwards compatiblity, if this lookup returns an 275c793af95Ssangeeta * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level 276c793af95Ssangeeta * of lookup is done. 277c793af95Ssangeeta */ 278c793af95Ssangeeta if (flags & MATCH_IRE_RECURSIVE) { 279c793af95Ssangeeta ipif_t *gw_ipif; 280c793af95Ssangeeta int match_flags = MATCH_IRE_DSTONLY; 281c793af95Ssangeeta ire_t *save_ire; 282c793af95Ssangeeta 283c793af95Ssangeeta if (ire->ire_type & IRE_INTERFACE) 284c793af95Ssangeeta return (ire); 285c793af95Ssangeeta if (pire != NULL) 286c793af95Ssangeeta *pire = ire; 287c793af95Ssangeeta /* 288c793af95Ssangeeta * If we can't find an IRE_INTERFACE or the caller has not 289c793af95Ssangeeta * asked for pire, we need to REFRELE the save_ire. 290c793af95Ssangeeta */ 291c793af95Ssangeeta save_ire = ire; 292c793af95Ssangeeta 293c793af95Ssangeeta /* 294c793af95Ssangeeta * Currently MATCH_IRE_ILL is never used with 295c793af95Ssangeeta * (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT) while 296c793af95Ssangeeta * sending out packets as MATCH_IRE_ILL is used only 297c793af95Ssangeeta * for communicating with on-link hosts. We can't assert 298c793af95Ssangeeta * that here as RTM_GET calls this function with 299c793af95Ssangeeta * MATCH_IRE_ILL | MATCH_IRE_DEFAULT | MATCH_IRE_RECURSIVE. 300c793af95Ssangeeta * We have already used the MATCH_IRE_ILL in determining 301c793af95Ssangeeta * the right prefix route at this point. To match the 302c793af95Ssangeeta * behavior of how we locate routes while sending out 303c793af95Ssangeeta * packets, we don't want to use MATCH_IRE_ILL below 304c793af95Ssangeeta * while locating the interface route. 305c793af95Ssangeeta * 306c793af95Ssangeeta * ire_ftable_lookup may end up with an incomplete IRE_CACHE 307c793af95Ssangeeta * entry for the gateway (i.e., one for which the 308c793af95Ssangeeta * ire_nce->nce_state is not yet ND_REACHABLE). If the caller 309c793af95Ssangeeta * has specified MATCH_IRE_COMPLETE, such entries will not 310c793af95Ssangeeta * be returned; instead, we return the IF_RESOLVER ire. 311c793af95Ssangeeta */ 312c793af95Ssangeeta if (ire->ire_ipif != NULL) 313c793af95Ssangeeta match_flags |= MATCH_IRE_ILL_GROUP; 314c793af95Ssangeeta 315c793af95Ssangeeta ire = ire_route_lookup(ire->ire_gateway_addr, 0, 0, 0, 316f4b3ec61Sdh155122 ire->ire_ipif, NULL, zoneid, tsl, match_flags, ipst); 317c793af95Ssangeeta DTRACE_PROBE2(ftable__route__lookup1, (ire_t *), ire, 318c793af95Ssangeeta (ire_t *), save_ire); 319c793af95Ssangeeta if (ire == NULL || 320c793af95Ssangeeta ((ire->ire_type & IRE_CACHE) && ire->ire_nce && 321c793af95Ssangeeta ire->ire_nce->nce_state != ND_REACHABLE && 322c793af95Ssangeeta (flags & MATCH_IRE_COMPLETE))) { 323c793af95Ssangeeta /* 324c793af95Ssangeeta * Do not release the parent ire if MATCH_IRE_PARENT 325c793af95Ssangeeta * is set. Also return it via ire. 326c793af95Ssangeeta */ 327c793af95Ssangeeta if (ire != NULL) { 328c793af95Ssangeeta ire_refrele(ire); 329c793af95Ssangeeta ire = NULL; 330c793af95Ssangeeta found_incomplete = B_TRUE; 331c793af95Ssangeeta } 332c793af95Ssangeeta if (flags & MATCH_IRE_PARENT) { 333c793af95Ssangeeta if (pire != NULL) { 334c793af95Ssangeeta /* 335c793af95Ssangeeta * Need an extra REFHOLD, if the parent 336c793af95Ssangeeta * ire is returned via both ire and 337c793af95Ssangeeta * pire. 338c793af95Ssangeeta */ 339c793af95Ssangeeta IRE_REFHOLD(save_ire); 340c793af95Ssangeeta } 341c793af95Ssangeeta ire = save_ire; 342c793af95Ssangeeta } else { 343c793af95Ssangeeta ire_refrele(save_ire); 344c793af95Ssangeeta if (pire != NULL) 345c793af95Ssangeeta *pire = NULL; 346c793af95Ssangeeta } 347c793af95Ssangeeta if (!found_incomplete) 348c793af95Ssangeeta return (ire); 349c793af95Ssangeeta } 350c793af95Ssangeeta if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) { 351c793af95Ssangeeta /* 352c793af95Ssangeeta * If the caller did not ask for pire, release 353c793af95Ssangeeta * it now. 354c793af95Ssangeeta */ 355c793af95Ssangeeta if (pire == NULL) { 356c793af95Ssangeeta ire_refrele(save_ire); 357c793af95Ssangeeta } 358c793af95Ssangeeta return (ire); 359c793af95Ssangeeta } 360c793af95Ssangeeta match_flags |= MATCH_IRE_TYPE; 361c793af95Ssangeeta gw_addr = ire->ire_gateway_addr; 362c793af95Ssangeeta gw_ipif = ire->ire_ipif; 363c793af95Ssangeeta ire_refrele(ire); 364c793af95Ssangeeta ire = ire_route_lookup(gw_addr, 0, 0, 365c793af95Ssangeeta (found_incomplete? IRE_INTERFACE : 366c793af95Ssangeeta (IRE_CACHETABLE | IRE_INTERFACE)), 367f4b3ec61Sdh155122 gw_ipif, NULL, zoneid, tsl, match_flags, ipst); 368c793af95Ssangeeta DTRACE_PROBE2(ftable__route__lookup2, (ire_t *), ire, 369c793af95Ssangeeta (ire_t *), save_ire); 370c793af95Ssangeeta if (ire == NULL || 371c793af95Ssangeeta ((ire->ire_type & IRE_CACHE) && ire->ire_nce && 372c793af95Ssangeeta ire->ire_nce->nce_state != ND_REACHABLE && 373c793af95Ssangeeta (flags & MATCH_IRE_COMPLETE))) { 374c793af95Ssangeeta /* 375c793af95Ssangeeta * Do not release the parent ire if MATCH_IRE_PARENT 376c793af95Ssangeeta * is set. Also return it via ire. 377c793af95Ssangeeta */ 378c793af95Ssangeeta if (ire != NULL) { 379c793af95Ssangeeta ire_refrele(ire); 380c793af95Ssangeeta ire = NULL; 381c793af95Ssangeeta } 382c793af95Ssangeeta if (flags & MATCH_IRE_PARENT) { 383c793af95Ssangeeta if (pire != NULL) { 384c793af95Ssangeeta /* 385c793af95Ssangeeta * Need an extra REFHOLD, if the 386c793af95Ssangeeta * parent ire is returned via both 387c793af95Ssangeeta * ire and pire. 388c793af95Ssangeeta */ 389c793af95Ssangeeta IRE_REFHOLD(save_ire); 390c793af95Ssangeeta } 391c793af95Ssangeeta ire = save_ire; 392c793af95Ssangeeta } else { 393c793af95Ssangeeta ire_refrele(save_ire); 394c793af95Ssangeeta if (pire != NULL) 395c793af95Ssangeeta *pire = NULL; 396c793af95Ssangeeta } 397c793af95Ssangeeta return (ire); 398c793af95Ssangeeta } else if (pire == NULL) { 399c793af95Ssangeeta /* 400c793af95Ssangeeta * If the caller did not ask for pire, release 401c793af95Ssangeeta * it now. 402c793af95Ssangeeta */ 403c793af95Ssangeeta ire_refrele(save_ire); 404c793af95Ssangeeta } 405c793af95Ssangeeta return (ire); 406c793af95Ssangeeta } 407c793af95Ssangeeta ASSERT(pire == NULL || *pire == NULL); 408c793af95Ssangeeta return (ire); 409c793af95Ssangeeta } 410c793af95Ssangeeta 411*da14cebeSEric Cheng /* 412*da14cebeSEric Cheng * This function is called by 413*da14cebeSEric Cheng * ip_fast_forward->ire_forward_simple 414*da14cebeSEric Cheng * The optimizations of this function over ire_ftable_lookup are: 415*da14cebeSEric Cheng * o removing unnecessary flag matching 416*da14cebeSEric Cheng * o doing longest prefix match instead of overloading it further 417*da14cebeSEric Cheng * with the unnecessary "best_prefix_match" 418*da14cebeSEric Cheng * o Does not do round robin of default route for every packet 419*da14cebeSEric Cheng * o inlines code of ire_ctable_lookup to look for nexthop cache 420*da14cebeSEric Cheng * entry before calling ire_route_lookup 421*da14cebeSEric Cheng */ 422*da14cebeSEric Cheng static ire_t * 423*da14cebeSEric Cheng ire_ftable_lookup_simple(ipaddr_t addr, 424*da14cebeSEric Cheng ire_t **pire, zoneid_t zoneid, int flags, 425*da14cebeSEric Cheng ip_stack_t *ipst) 426*da14cebeSEric Cheng { 427*da14cebeSEric Cheng ire_t *ire = NULL; 428*da14cebeSEric Cheng ire_t *tmp_ire = NULL; 429*da14cebeSEric Cheng struct rt_sockaddr rdst; 430*da14cebeSEric Cheng struct rt_entry *rt; 431*da14cebeSEric Cheng irb_t *irb_ptr; 432*da14cebeSEric Cheng ire_t *save_ire; 433*da14cebeSEric Cheng int match_flags; 434*da14cebeSEric Cheng 435*da14cebeSEric Cheng rdst.rt_sin_len = sizeof (rdst); 436*da14cebeSEric Cheng rdst.rt_sin_family = AF_INET; 437*da14cebeSEric Cheng rdst.rt_sin_addr.s_addr = addr; 438*da14cebeSEric Cheng 439*da14cebeSEric Cheng /* 440*da14cebeSEric Cheng * This is basically inlining a simpler version of ire_match_args 441*da14cebeSEric Cheng */ 442*da14cebeSEric Cheng RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 443*da14cebeSEric Cheng 444*da14cebeSEric Cheng rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst, 445*da14cebeSEric Cheng ipst->ips_ip_ftable, NULL, NULL); 446*da14cebeSEric Cheng 447*da14cebeSEric Cheng if (rt == NULL) { 448*da14cebeSEric Cheng RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 449*da14cebeSEric Cheng return (NULL); 450*da14cebeSEric Cheng } 451*da14cebeSEric Cheng irb_ptr = &rt->rt_irb; 452*da14cebeSEric Cheng if (irb_ptr == NULL || irb_ptr->irb_ire_cnt == 0) { 453*da14cebeSEric Cheng RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 454*da14cebeSEric Cheng return (NULL); 455*da14cebeSEric Cheng } 456*da14cebeSEric Cheng 457*da14cebeSEric Cheng rw_enter(&irb_ptr->irb_lock, RW_READER); 458*da14cebeSEric Cheng for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 459*da14cebeSEric Cheng if (ire->ire_zoneid == zoneid) 460*da14cebeSEric Cheng break; 461*da14cebeSEric Cheng } 462*da14cebeSEric Cheng 463*da14cebeSEric Cheng if (ire == NULL || (ire->ire_marks & IRE_MARK_CONDEMNED)) { 464*da14cebeSEric Cheng rw_exit(&irb_ptr->irb_lock); 465*da14cebeSEric Cheng RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 466*da14cebeSEric Cheng return (NULL); 467*da14cebeSEric Cheng } 468*da14cebeSEric Cheng /* we have a ire that matches */ 469*da14cebeSEric Cheng if (ire != NULL) 470*da14cebeSEric Cheng IRE_REFHOLD(ire); 471*da14cebeSEric Cheng rw_exit(&irb_ptr->irb_lock); 472*da14cebeSEric Cheng RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 473*da14cebeSEric Cheng 474*da14cebeSEric Cheng if ((flags & MATCH_IRE_RJ_BHOLE) && 475*da14cebeSEric Cheng (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) { 476*da14cebeSEric Cheng return (ire); 477*da14cebeSEric Cheng } 478*da14cebeSEric Cheng /* 479*da14cebeSEric Cheng * At this point, IRE that was found must be an IRE_FORWARDTABLE 480*da14cebeSEric Cheng * type. If this is a recursive lookup and an IRE_INTERFACE type was 481*da14cebeSEric Cheng * found, return that. If it was some other IRE_FORWARDTABLE type of 482*da14cebeSEric Cheng * IRE (one of the prefix types), then it is necessary to fill in the 483*da14cebeSEric Cheng * parent IRE pointed to by pire, and then lookup the gateway address of 484*da14cebeSEric Cheng * the parent. For backwards compatiblity, if this lookup returns an 485*da14cebeSEric Cheng * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level 486*da14cebeSEric Cheng * of lookup is done. 487*da14cebeSEric Cheng */ 488*da14cebeSEric Cheng match_flags = MATCH_IRE_DSTONLY; 489*da14cebeSEric Cheng 490*da14cebeSEric Cheng if (ire->ire_type & IRE_INTERFACE) 491*da14cebeSEric Cheng return (ire); 492*da14cebeSEric Cheng *pire = ire; 493*da14cebeSEric Cheng /* 494*da14cebeSEric Cheng * If we can't find an IRE_INTERFACE or the caller has not 495*da14cebeSEric Cheng * asked for pire, we need to REFRELE the save_ire. 496*da14cebeSEric Cheng */ 497*da14cebeSEric Cheng save_ire = ire; 498*da14cebeSEric Cheng 499*da14cebeSEric Cheng /* 500*da14cebeSEric Cheng * Currently MATCH_IRE_ILL is never used with 501*da14cebeSEric Cheng * (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT) while 502*da14cebeSEric Cheng * sending out packets as MATCH_IRE_ILL is used only 503*da14cebeSEric Cheng * for communicating with on-link hosts. We can't assert 504*da14cebeSEric Cheng * that here as RTM_GET calls this function with 505*da14cebeSEric Cheng * MATCH_IRE_ILL | MATCH_IRE_DEFAULT | MATCH_IRE_RECURSIVE. 506*da14cebeSEric Cheng * We have already used the MATCH_IRE_ILL in determining 507*da14cebeSEric Cheng * the right prefix route at this point. To match the 508*da14cebeSEric Cheng * behavior of how we locate routes while sending out 509*da14cebeSEric Cheng * packets, we don't want to use MATCH_IRE_ILL below 510*da14cebeSEric Cheng * while locating the interface route. 511*da14cebeSEric Cheng * 512*da14cebeSEric Cheng * ire_ftable_lookup may end up with an incomplete IRE_CACHE 513*da14cebeSEric Cheng * entry for the gateway (i.e., one for which the 514*da14cebeSEric Cheng * ire_nce->nce_state is not yet ND_REACHABLE). If the caller 515*da14cebeSEric Cheng * has specified MATCH_IRE_COMPLETE, such entries will not 516*da14cebeSEric Cheng * be returned; instead, we return the IF_RESOLVER ire. 517*da14cebeSEric Cheng */ 518*da14cebeSEric Cheng 519*da14cebeSEric Cheng if (ire->ire_ipif == NULL) { 520*da14cebeSEric Cheng tmp_ire = ire; 521*da14cebeSEric Cheng /* 522*da14cebeSEric Cheng * Look to see if the nexthop entry is in the 523*da14cebeSEric Cheng * cachetable (I am inlining a simpler ire_cache_lookup 524*da14cebeSEric Cheng * here). 525*da14cebeSEric Cheng */ 526*da14cebeSEric Cheng ire = ire_cache_lookup_simple(ire->ire_gateway_addr, ipst); 527*da14cebeSEric Cheng if (ire == NULL) { 528*da14cebeSEric Cheng /* Try ire_route_lookup */ 529*da14cebeSEric Cheng ire = tmp_ire; 530*da14cebeSEric Cheng } else { 531*da14cebeSEric Cheng goto solved; 532*da14cebeSEric Cheng } 533*da14cebeSEric Cheng } 534*da14cebeSEric Cheng if (ire->ire_ipif != NULL) 535*da14cebeSEric Cheng match_flags |= MATCH_IRE_ILL_GROUP; 536*da14cebeSEric Cheng 537*da14cebeSEric Cheng ire = ire_route_lookup(ire->ire_gateway_addr, 0, 538*da14cebeSEric Cheng 0, 0, ire->ire_ipif, NULL, zoneid, NULL, match_flags, ipst); 539*da14cebeSEric Cheng solved: 540*da14cebeSEric Cheng DTRACE_PROBE2(ftable__route__lookup1, (ire_t *), ire, 541*da14cebeSEric Cheng (ire_t *), save_ire); 542*da14cebeSEric Cheng if (ire == NULL) { 543*da14cebeSEric Cheng /* 544*da14cebeSEric Cheng * Do not release the parent ire if MATCH_IRE_PARENT 545*da14cebeSEric Cheng * is set. Also return it via ire. 546*da14cebeSEric Cheng */ 547*da14cebeSEric Cheng ire_refrele(save_ire); 548*da14cebeSEric Cheng *pire = NULL; 549*da14cebeSEric Cheng return (ire); 550*da14cebeSEric Cheng } 551*da14cebeSEric Cheng if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) { 552*da14cebeSEric Cheng /* 553*da14cebeSEric Cheng * If the caller did not ask for pire, release 554*da14cebeSEric Cheng * it now. 555*da14cebeSEric Cheng */ 556*da14cebeSEric Cheng if (pire == NULL) { 557*da14cebeSEric Cheng ire_refrele(save_ire); 558*da14cebeSEric Cheng } 559*da14cebeSEric Cheng } 560*da14cebeSEric Cheng return (ire); 561*da14cebeSEric Cheng } 562c793af95Ssangeeta 563c793af95Ssangeeta /* 564c793af95Ssangeeta * Find an IRE_OFFSUBNET IRE entry for the multicast address 'group' 565c793af95Ssangeeta * that goes through 'ipif'. As a fallback, a route that goes through 566c793af95Ssangeeta * ipif->ipif_ill can be returned. 567c793af95Ssangeeta */ 568c793af95Ssangeeta ire_t * 569c793af95Ssangeeta ipif_lookup_multi_ire(ipif_t *ipif, ipaddr_t group) 570c793af95Ssangeeta { 571c793af95Ssangeeta ire_t *ire; 572c793af95Ssangeeta ire_t *save_ire = NULL; 573c793af95Ssangeeta ire_t *gw_ire; 574c793af95Ssangeeta irb_t *irb; 575c793af95Ssangeeta ipaddr_t gw_addr; 576c793af95Ssangeeta int match_flags = MATCH_IRE_TYPE | MATCH_IRE_ILL; 577f4b3ec61Sdh155122 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 578c793af95Ssangeeta 579c793af95Ssangeeta ASSERT(CLASSD(group)); 580c793af95Ssangeeta 581c793af95Ssangeeta ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, ALL_ZONES, 0, 582f4b3ec61Sdh155122 NULL, MATCH_IRE_DEFAULT, ipst); 583c793af95Ssangeeta 584c793af95Ssangeeta if (ire == NULL) 585c793af95Ssangeeta return (NULL); 586c793af95Ssangeeta 587c793af95Ssangeeta irb = ire->ire_bucket; 588c793af95Ssangeeta ASSERT(irb); 589c793af95Ssangeeta 590c793af95Ssangeeta IRB_REFHOLD(irb); 591c793af95Ssangeeta ire_refrele(ire); 592c793af95Ssangeeta for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 593c793af95Ssangeeta if (ire->ire_addr != group || 594c793af95Ssangeeta ipif->ipif_zoneid != ire->ire_zoneid && 595c793af95Ssangeeta ire->ire_zoneid != ALL_ZONES) { 596c793af95Ssangeeta continue; 597c793af95Ssangeeta } 598c793af95Ssangeeta 599c793af95Ssangeeta switch (ire->ire_type) { 600c793af95Ssangeeta case IRE_DEFAULT: 601c793af95Ssangeeta case IRE_PREFIX: 602c793af95Ssangeeta case IRE_HOST: 603c793af95Ssangeeta gw_addr = ire->ire_gateway_addr; 604c793af95Ssangeeta gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, 605f4b3ec61Sdh155122 ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 606c793af95Ssangeeta 607c793af95Ssangeeta if (gw_ire != NULL) { 608c793af95Ssangeeta if (save_ire != NULL) { 609c793af95Ssangeeta ire_refrele(save_ire); 610c793af95Ssangeeta } 611c793af95Ssangeeta IRE_REFHOLD(ire); 612c793af95Ssangeeta if (gw_ire->ire_ipif == ipif) { 613c793af95Ssangeeta ire_refrele(gw_ire); 614c793af95Ssangeeta 615c793af95Ssangeeta IRB_REFRELE(irb); 616c793af95Ssangeeta return (ire); 617c793af95Ssangeeta } 618c793af95Ssangeeta ire_refrele(gw_ire); 619c793af95Ssangeeta save_ire = ire; 620c793af95Ssangeeta } 621c793af95Ssangeeta break; 622c793af95Ssangeeta case IRE_IF_NORESOLVER: 623c793af95Ssangeeta case IRE_IF_RESOLVER: 624c793af95Ssangeeta if (ire->ire_ipif == ipif) { 625c793af95Ssangeeta if (save_ire != NULL) { 626c793af95Ssangeeta ire_refrele(save_ire); 627c793af95Ssangeeta } 628c793af95Ssangeeta IRE_REFHOLD(ire); 629c793af95Ssangeeta 630c793af95Ssangeeta IRB_REFRELE(irb); 631c793af95Ssangeeta return (ire); 632c793af95Ssangeeta } 633c793af95Ssangeeta break; 634c793af95Ssangeeta } 635c793af95Ssangeeta } 636c793af95Ssangeeta IRB_REFRELE(irb); 637c793af95Ssangeeta 638c793af95Ssangeeta return (save_ire); 639c793af95Ssangeeta } 640c793af95Ssangeeta 641c793af95Ssangeeta /* 642c793af95Ssangeeta * Find an IRE_INTERFACE for the multicast group. 643c793af95Ssangeeta * Allows different routes for multicast addresses 644c793af95Ssangeeta * in the unicast routing table (akin to 224.0.0.0 but could be more specific) 645c793af95Ssangeeta * which point at different interfaces. This is used when IP_MULTICAST_IF 646c793af95Ssangeeta * isn't specified (when sending) and when IP_ADD_MEMBERSHIP doesn't 647c793af95Ssangeeta * specify the interface to join on. 648c793af95Ssangeeta * 649c793af95Ssangeeta * Supports IP_BOUND_IF by following the ipif/ill when recursing. 650c793af95Ssangeeta */ 651c793af95Ssangeeta ire_t * 652f4b3ec61Sdh155122 ire_lookup_multi(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst) 653c793af95Ssangeeta { 654c793af95Ssangeeta ire_t *ire; 655c793af95Ssangeeta ipif_t *ipif = NULL; 656c793af95Ssangeeta int match_flags = MATCH_IRE_TYPE; 657c793af95Ssangeeta ipaddr_t gw_addr; 658c793af95Ssangeeta 659c793af95Ssangeeta ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, zoneid, 660f4b3ec61Sdh155122 0, NULL, MATCH_IRE_DEFAULT, ipst); 661c793af95Ssangeeta 662c793af95Ssangeeta /* We search a resolvable ire in case of multirouting. */ 663c793af95Ssangeeta if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) { 664c793af95Ssangeeta ire_t *cire = NULL; 665c793af95Ssangeeta /* 666c793af95Ssangeeta * If the route is not resolvable, the looked up ire 667c793af95Ssangeeta * may be changed here. In that case, ire_multirt_lookup() 668c793af95Ssangeeta * IRE_REFRELE the original ire and change it. 669c793af95Ssangeeta */ 670f4b3ec61Sdh155122 (void) ire_multirt_lookup(&cire, &ire, MULTIRT_CACHEGW, 671f4b3ec61Sdh155122 NULL, ipst); 672c793af95Ssangeeta if (cire != NULL) 673c793af95Ssangeeta ire_refrele(cire); 674c793af95Ssangeeta } 675c793af95Ssangeeta if (ire == NULL) 676c793af95Ssangeeta return (NULL); 677c793af95Ssangeeta /* 678c793af95Ssangeeta * Make sure we follow ire_ipif. 679c793af95Ssangeeta * 680c793af95Ssangeeta * We need to determine the interface route through 681c793af95Ssangeeta * which the gateway will be reached. We don't really 682c793af95Ssangeeta * care which interface is picked if the interface is 683c793af95Ssangeeta * part of a group. 684c793af95Ssangeeta */ 685c793af95Ssangeeta if (ire->ire_ipif != NULL) { 686c793af95Ssangeeta ipif = ire->ire_ipif; 687c793af95Ssangeeta match_flags |= MATCH_IRE_ILL_GROUP; 688c793af95Ssangeeta } 689c793af95Ssangeeta 690c793af95Ssangeeta switch (ire->ire_type) { 691c793af95Ssangeeta case IRE_DEFAULT: 692c793af95Ssangeeta case IRE_PREFIX: 693c793af95Ssangeeta case IRE_HOST: 694c793af95Ssangeeta gw_addr = ire->ire_gateway_addr; 695c793af95Ssangeeta ire_refrele(ire); 696c793af95Ssangeeta ire = ire_ftable_lookup(gw_addr, 0, 0, 697c793af95Ssangeeta IRE_INTERFACE, ipif, NULL, zoneid, 0, 698f4b3ec61Sdh155122 NULL, match_flags, ipst); 699c793af95Ssangeeta return (ire); 700c793af95Ssangeeta case IRE_IF_NORESOLVER: 701c793af95Ssangeeta case IRE_IF_RESOLVER: 702c793af95Ssangeeta return (ire); 703c793af95Ssangeeta default: 704c793af95Ssangeeta ire_refrele(ire); 705c793af95Ssangeeta return (NULL); 706c793af95Ssangeeta } 707c793af95Ssangeeta } 708c793af95Ssangeeta 709c793af95Ssangeeta /* 710c793af95Ssangeeta * Delete the passed in ire if the gateway addr matches 711c793af95Ssangeeta */ 712c793af95Ssangeeta void 713c793af95Ssangeeta ire_del_host_redir(ire_t *ire, char *gateway) 714c793af95Ssangeeta { 7156bdb8e66Sdd193516 if ((ire->ire_flags & RTF_DYNAMIC) && 716c793af95Ssangeeta (ire->ire_gateway_addr == *(ipaddr_t *)gateway)) 717c793af95Ssangeeta ire_delete(ire); 718c793af95Ssangeeta } 719c793af95Ssangeeta 720c793af95Ssangeeta /* 721c793af95Ssangeeta * Search for all HOST REDIRECT routes that are 722c793af95Ssangeeta * pointing at the specified gateway and 723c793af95Ssangeeta * delete them. This routine is called only 724c793af95Ssangeeta * when a default gateway is going away. 725c793af95Ssangeeta */ 726c793af95Ssangeeta void 727f4b3ec61Sdh155122 ire_delete_host_redirects(ipaddr_t gateway, ip_stack_t *ipst) 728c793af95Ssangeeta { 729c793af95Ssangeeta struct rtfuncarg rtfarg; 730c793af95Ssangeeta 731c793af95Ssangeeta (void) memset(&rtfarg, 0, sizeof (rtfarg)); 732c793af95Ssangeeta rtfarg.rt_func = ire_del_host_redir; 733c793af95Ssangeeta rtfarg.rt_arg = (void *)&gateway; 734f4b3ec61Sdh155122 (void) ipst->ips_ip_ftable->rnh_walktree_mt(ipst->ips_ip_ftable, 735f4b3ec61Sdh155122 rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn); 736c793af95Ssangeeta } 737c793af95Ssangeeta 738c793af95Ssangeeta struct ihandle_arg { 739c793af95Ssangeeta uint32_t ihandle; 740c793af95Ssangeeta ire_t *ire; 741c793af95Ssangeeta }; 742c793af95Ssangeeta 743c793af95Ssangeeta static int 744c793af95Ssangeeta ire_ihandle_onlink_match(struct radix_node *rn, void *arg) 745c793af95Ssangeeta { 746c793af95Ssangeeta struct rt_entry *rt; 747c793af95Ssangeeta irb_t *irb; 748c793af95Ssangeeta ire_t *ire; 749c793af95Ssangeeta struct ihandle_arg *ih = arg; 750c793af95Ssangeeta 751c793af95Ssangeeta rt = (struct rt_entry *)rn; 752c793af95Ssangeeta ASSERT(rt != NULL); 753c793af95Ssangeeta irb = &rt->rt_irb; 754c793af95Ssangeeta for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 755c793af95Ssangeeta if ((ire->ire_type & IRE_INTERFACE) && 756c793af95Ssangeeta (ire->ire_ihandle == ih->ihandle)) { 757c793af95Ssangeeta ih->ire = ire; 758c793af95Ssangeeta IRE_REFHOLD(ire); 759c793af95Ssangeeta return (1); 760c793af95Ssangeeta } 761c793af95Ssangeeta } 762c793af95Ssangeeta return (0); 763c793af95Ssangeeta } 764c793af95Ssangeeta 765c793af95Ssangeeta /* 766c793af95Ssangeeta * Locate the interface ire that is tied to the cache ire 'cire' via 767c793af95Ssangeeta * cire->ire_ihandle. 768c793af95Ssangeeta * 769c793af95Ssangeeta * We are trying to create the cache ire for an onlink destn. or 770c793af95Ssangeeta * gateway in 'cire'. We are called from ire_add_v4() in the IRE_IF_RESOLVER 771c793af95Ssangeeta * case, after the ire has come back from ARP. 772c793af95Ssangeeta */ 773c793af95Ssangeeta ire_t * 774c793af95Ssangeeta ire_ihandle_lookup_onlink(ire_t *cire) 775c793af95Ssangeeta { 776c793af95Ssangeeta ire_t *ire; 777c793af95Ssangeeta int match_flags; 778c793af95Ssangeeta struct ihandle_arg ih; 779f4b3ec61Sdh155122 ip_stack_t *ipst; 780c793af95Ssangeeta 781c793af95Ssangeeta ASSERT(cire != NULL); 782f4b3ec61Sdh155122 ipst = cire->ire_ipst; 783c793af95Ssangeeta 784c793af95Ssangeeta /* 785c793af95Ssangeeta * We don't need to specify the zoneid to ire_ftable_lookup() below 786c793af95Ssangeeta * because the ihandle refers to an ipif which can be in only one zone. 787c793af95Ssangeeta */ 788c793af95Ssangeeta match_flags = MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK; 789c793af95Ssangeeta /* 790c793af95Ssangeeta * We know that the mask of the interface ire equals cire->ire_cmask. 791c793af95Ssangeeta * (When ip_newroute() created 'cire' for an on-link destn. it set its 792c793af95Ssangeeta * cmask from the interface ire's mask) 793c793af95Ssangeeta */ 794c793af95Ssangeeta ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0, 795c793af95Ssangeeta IRE_INTERFACE, NULL, NULL, ALL_ZONES, cire->ire_ihandle, 796f4b3ec61Sdh155122 NULL, match_flags, ipst); 797c793af95Ssangeeta if (ire != NULL) 798c793af95Ssangeeta return (ire); 799c793af95Ssangeeta /* 800c793af95Ssangeeta * If we didn't find an interface ire above, we can't declare failure. 801c793af95Ssangeeta * For backwards compatibility, we need to support prefix routes 802c793af95Ssangeeta * pointing to next hop gateways that are not on-link. 803c793af95Ssangeeta * 804c793af95Ssangeeta * In the resolver/noresolver case, ip_newroute() thinks it is creating 805c793af95Ssangeeta * the cache ire for an onlink destination in 'cire'. But 'cire' is 806c793af95Ssangeeta * not actually onlink, because ire_ftable_lookup() cheated it, by 807c793af95Ssangeeta * doing ire_route_lookup() twice and returning an interface ire. 808c793af95Ssangeeta * 809c793af95Ssangeeta * Eg. default - gw1 (line 1) 810c793af95Ssangeeta * gw1 - gw2 (line 2) 811c793af95Ssangeeta * gw2 - hme0 (line 3) 812c793af95Ssangeeta * 813c793af95Ssangeeta * In the above example, ip_newroute() tried to create the cache ire 814c793af95Ssangeeta * 'cire' for gw1, based on the interface route in line 3. The 815c793af95Ssangeeta * ire_ftable_lookup() above fails, because there is no interface route 816c793af95Ssangeeta * to reach gw1. (it is gw2). We fall thru below. 817c793af95Ssangeeta * 818c793af95Ssangeeta * Do a brute force search based on the ihandle in a subset of the 819c793af95Ssangeeta * forwarding tables, corresponding to cire->ire_cmask. Otherwise 820c793af95Ssangeeta * things become very complex, since we don't have 'pire' in this 821c793af95Ssangeeta * case. (Also note that this method is not possible in the offlink 822c793af95Ssangeeta * case because we don't know the mask) 823c793af95Ssangeeta */ 824c793af95Ssangeeta (void) memset(&ih, 0, sizeof (ih)); 825c793af95Ssangeeta ih.ihandle = cire->ire_ihandle; 826f4b3ec61Sdh155122 (void) ipst->ips_ip_ftable->rnh_walktree_mt(ipst->ips_ip_ftable, 827f4b3ec61Sdh155122 ire_ihandle_onlink_match, &ih, irb_refhold_rn, irb_refrele_rn); 828c793af95Ssangeeta return (ih.ire); 829c793af95Ssangeeta } 830c793af95Ssangeeta 831c793af95Ssangeeta /* 832c793af95Ssangeeta * IRE iterator used by ire_ftable_lookup[_v6]() to process multiple default 833c793af95Ssangeeta * routes. Given a starting point in the hash list (ire_origin), walk the IREs 834c793af95Ssangeeta * in the bucket skipping default interface routes and deleted entries. 835c793af95Ssangeeta * Returns the next IRE (unheld), or NULL when we're back to the starting point. 836c793af95Ssangeeta * Assumes that the caller holds a reference on the IRE bucket. 837c793af95Ssangeeta */ 838c793af95Ssangeeta ire_t * 839c793af95Ssangeeta ire_get_next_default_ire(ire_t *ire, ire_t *ire_origin) 840c793af95Ssangeeta { 841c793af95Ssangeeta ASSERT(ire_origin->ire_bucket != NULL); 842c793af95Ssangeeta ASSERT(ire != NULL); 843c793af95Ssangeeta 844c793af95Ssangeeta do { 845c793af95Ssangeeta ire = ire->ire_next; 846c793af95Ssangeeta if (ire == NULL) 847c793af95Ssangeeta ire = ire_origin->ire_bucket->irb_ire; 848c793af95Ssangeeta if (ire == ire_origin) 849c793af95Ssangeeta return (NULL); 850c793af95Ssangeeta } while ((ire->ire_type & IRE_INTERFACE) || 851c793af95Ssangeeta (ire->ire_marks & IRE_MARK_CONDEMNED)); 852c793af95Ssangeeta ASSERT(ire != NULL); 853c793af95Ssangeeta return (ire); 854c793af95Ssangeeta } 855c793af95Ssangeeta 856c793af95Ssangeeta static ipif_t * 857c793af95Ssangeeta ire_forward_src_ipif(ipaddr_t dst, ire_t *sire, ire_t *ire, ill_t *dst_ill, 858c793af95Ssangeeta int zoneid, ushort_t *marks) 859c793af95Ssangeeta { 860c793af95Ssangeeta ipif_t *src_ipif; 861f4b3ec61Sdh155122 ip_stack_t *ipst = dst_ill->ill_ipst; 862c793af95Ssangeeta 863c793af95Ssangeeta /* 864c793af95Ssangeeta * Pick the best source address from dst_ill. 865c793af95Ssangeeta * 866c793af95Ssangeeta * 1) If it is part of a multipathing group, we would 867c793af95Ssangeeta * like to spread the inbound packets across different 868c793af95Ssangeeta * interfaces. ipif_select_source picks a random source 869c793af95Ssangeeta * across the different ills in the group. 870c793af95Ssangeeta * 871c793af95Ssangeeta * 2) If it is not part of a multipathing group, we try 872c793af95Ssangeeta * to pick the source address from the destination 873c793af95Ssangeeta * route. Clustering assumes that when we have multiple 874c793af95Ssangeeta * prefixes hosted on an interface, the prefix of the 875c793af95Ssangeeta * source address matches the prefix of the destination 876c793af95Ssangeeta * route. We do this only if the address is not 877c793af95Ssangeeta * DEPRECATED. 878c793af95Ssangeeta * 879c793af95Ssangeeta * 3) If the conn is in a different zone than the ire, we 880c793af95Ssangeeta * need to pick a source address from the right zone. 881c793af95Ssangeeta * 882c793af95Ssangeeta * NOTE : If we hit case (1) above, the prefix of the source 883c793af95Ssangeeta * address picked may not match the prefix of the 884c793af95Ssangeeta * destination routes prefix as ipif_select_source 885c793af95Ssangeeta * does not look at "dst" while picking a source 886c793af95Ssangeeta * address. 887c793af95Ssangeeta * If we want the same behavior as (2), we will need 888c793af95Ssangeeta * to change the behavior of ipif_select_source. 889c793af95Ssangeeta */ 890c793af95Ssangeeta 891c793af95Ssangeeta if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) { 892c793af95Ssangeeta /* 893c793af95Ssangeeta * The RTF_SETSRC flag is set in the parent ire (sire). 894c793af95Ssangeeta * Check that the ipif matching the requested source 895c793af95Ssangeeta * address still exists. 896c793af95Ssangeeta */ 897c793af95Ssangeeta src_ipif = ipif_lookup_addr(sire->ire_src_addr, NULL, 898f4b3ec61Sdh155122 zoneid, NULL, NULL, NULL, NULL, ipst); 899c793af95Ssangeeta return (src_ipif); 900c793af95Ssangeeta } 901c793af95Ssangeeta *marks |= IRE_MARK_USESRC_CHECK; 902c793af95Ssangeeta if ((dst_ill->ill_group != NULL) || 903c793af95Ssangeeta (ire->ire_ipif->ipif_flags & IPIF_DEPRECATED) || 904c793af95Ssangeeta (dst_ill->ill_usesrc_ifindex != 0)) { 905c793af95Ssangeeta src_ipif = ipif_select_source(dst_ill, dst, zoneid); 906c793af95Ssangeeta if (src_ipif == NULL) 907c793af95Ssangeeta return (NULL); 908c793af95Ssangeeta 909c793af95Ssangeeta } else { 910c793af95Ssangeeta src_ipif = ire->ire_ipif; 911c793af95Ssangeeta ASSERT(src_ipif != NULL); 912c793af95Ssangeeta /* hold src_ipif for uniformity */ 913c793af95Ssangeeta ipif_refhold(src_ipif); 914c793af95Ssangeeta } 915c793af95Ssangeeta return (src_ipif); 916c793af95Ssangeeta } 917c793af95Ssangeeta 918c793af95Ssangeeta /* 919c793af95Ssangeeta * This function is called by ip_rput_noire() and ip_fast_forward() 920c793af95Ssangeeta * to resolve the route of incoming packet that needs to be forwarded. 921c793af95Ssangeeta * If the ire of the nexthop is not already in the cachetable, this 922c793af95Ssangeeta * routine will insert it to the table, but won't trigger ARP resolution yet. 923c793af95Ssangeeta * Thus unlike ip_newroute, this function adds incomplete ires to 924c793af95Ssangeeta * the cachetable. ARP resolution for these ires are delayed until 925c793af95Ssangeeta * after all of the packet processing is completed and its ready to 926c793af95Ssangeeta * be sent out on the wire, Eventually, the packet transmit routine 927c793af95Ssangeeta * ip_xmit_v4() attempts to send a packet to the driver. If it finds 928c793af95Ssangeeta * that there is no link layer information, it will do the arp 929c793af95Ssangeeta * resolution and queue the packet in ire->ire_nce->nce_qd_mp and 930c793af95Ssangeeta * then send it out once the arp resolution is over 931c793af95Ssangeeta * (see ip_xmit_v4()->ire_arpresolve()). This scheme is similar to 932c793af95Ssangeeta * the model of BSD/SunOS 4 933c793af95Ssangeeta * 934c793af95Ssangeeta * In future, the insertion of incomplete ires in the cachetable should 935c793af95Ssangeeta * be implemented in hostpath as well, as doing so will greatly reduce 936c793af95Ssangeeta * the existing complexity for code paths that depend on the context of 937c793af95Ssangeeta * the sender (such as IPsec). 938c793af95Ssangeeta * 939c793af95Ssangeeta * Thus this scheme of adding incomplete ires in cachetable in forwarding 940c793af95Ssangeeta * path can be used as a template for simplifying the hostpath. 941c793af95Ssangeeta */ 942c793af95Ssangeeta 943c793af95Ssangeeta ire_t * 94442ee8d71Sja97890 ire_forward(ipaddr_t dst, enum ire_forward_action *ret_action, 94542ee8d71Sja97890 ire_t *supplied_ire, ire_t *supplied_sire, const struct ts_label_s *tsl, 94642ee8d71Sja97890 ip_stack_t *ipst) 947c793af95Ssangeeta { 948c793af95Ssangeeta ipaddr_t gw = 0; 949c793af95Ssangeeta ire_t *ire = NULL; 950c793af95Ssangeeta ire_t *sire = NULL, *save_ire; 951c793af95Ssangeeta ill_t *dst_ill = NULL; 952c793af95Ssangeeta int error; 953c793af95Ssangeeta zoneid_t zoneid; 954c793af95Ssangeeta ipif_t *src_ipif = NULL; 955c793af95Ssangeeta mblk_t *res_mp; 956c793af95Ssangeeta ushort_t ire_marks = 0; 957c793af95Ssangeeta tsol_gcgrp_t *gcgrp = NULL; 958c793af95Ssangeeta tsol_gcgrp_addr_t ga; 959c793af95Ssangeeta 960c793af95Ssangeeta zoneid = GLOBAL_ZONEID; 961c793af95Ssangeeta 962c793af95Ssangeeta if (supplied_ire != NULL) { 963c793af95Ssangeeta /* We have arrived here from ipfil_sendpkt */ 964c793af95Ssangeeta ire = supplied_ire; 965c793af95Ssangeeta sire = supplied_sire; 966c793af95Ssangeeta goto create_irecache; 967c793af95Ssangeeta } 968c793af95Ssangeeta 969c793af95Ssangeeta ire = ire_ftable_lookup(dst, 0, 0, 0, NULL, &sire, zoneid, 0, 970c793af95Ssangeeta tsl, MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | 971f4b3ec61Sdh155122 MATCH_IRE_RJ_BHOLE | MATCH_IRE_PARENT|MATCH_IRE_SECATTR, ipst); 972c793af95Ssangeeta 973c793af95Ssangeeta if (ire == NULL) { 974f4b3ec61Sdh155122 ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0, RTA_DST, ipst); 975c793af95Ssangeeta goto icmp_err_ret; 976c793af95Ssangeeta } 977c793af95Ssangeeta 978c793af95Ssangeeta /* 979c793af95Ssangeeta * If we encounter CGTP, we should have the caller use 980c793af95Ssangeeta * ip_newroute to resolve multirt instead of this function. 981c793af95Ssangeeta * CGTP specs explicitly state that it can't be used with routers. 982c793af95Ssangeeta * This essentially prevents insertion of incomplete RTF_MULTIRT 983c793af95Ssangeeta * ires in cachetable. 984c793af95Ssangeeta */ 985655a42e2Snordmark if (ipst->ips_ip_cgtp_filter && 986c793af95Ssangeeta ((ire->ire_flags & RTF_MULTIRT) || 987c793af95Ssangeeta ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) { 988c793af95Ssangeeta ip3dbg(("ire_forward: packet is to be multirouted- " 989c793af95Ssangeeta "handing it to ip_newroute\n")); 990c793af95Ssangeeta if (sire != NULL) 991c793af95Ssangeeta ire_refrele(sire); 992c793af95Ssangeeta ire_refrele(ire); 993c793af95Ssangeeta /* 994c793af95Ssangeeta * Inform caller about encountering of multirt so that 995c793af95Ssangeeta * ip_newroute() can be called. 996c793af95Ssangeeta */ 99742ee8d71Sja97890 *ret_action = Forward_check_multirt; 998c793af95Ssangeeta return (NULL); 999c793af95Ssangeeta } 1000c793af95Ssangeeta 1001c793af95Ssangeeta /* 1002c793af95Ssangeeta * Verify that the returned IRE does not have either 1003c793af95Ssangeeta * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is 1004c793af95Ssangeeta * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER. 1005c793af95Ssangeeta */ 1006c793af95Ssangeeta if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) || 1007c793af95Ssangeeta (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0) { 1008c793af95Ssangeeta ip3dbg(("ire 0x%p is not cache/resolver/noresolver\n", 1009c793af95Ssangeeta (void *)ire)); 1010c793af95Ssangeeta goto icmp_err_ret; 1011c793af95Ssangeeta } 1012c793af95Ssangeeta 1013c793af95Ssangeeta /* 1014c793af95Ssangeeta * If we already have a fully resolved IRE CACHE of the 1015c793af95Ssangeeta * nexthop router, just hand over the cache entry 1016c793af95Ssangeeta * and we are done. 1017c793af95Ssangeeta */ 1018c793af95Ssangeeta 1019c793af95Ssangeeta if (ire->ire_type & IRE_CACHE) { 1020c793af95Ssangeeta 1021c793af95Ssangeeta /* 1022c793af95Ssangeeta * If we are using this ire cache entry as a 1023c793af95Ssangeeta * gateway to forward packets, chances are we 1024c793af95Ssangeeta * will be using it again. So turn off 1025c793af95Ssangeeta * the temporary flag, thus reducing its 1026c793af95Ssangeeta * chances of getting deleted frequently. 1027c793af95Ssangeeta */ 1028c793af95Ssangeeta if (ire->ire_marks & IRE_MARK_TEMPORARY) { 1029c793af95Ssangeeta irb_t *irb = ire->ire_bucket; 1030c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 10319a09d68dSja97890 /* 10329a09d68dSja97890 * We need to recheck for IRE_MARK_TEMPORARY after 10339a09d68dSja97890 * acquiring the lock in order to guarantee 10349a09d68dSja97890 * irb_tmp_ire_cnt 10359a09d68dSja97890 */ 10369a09d68dSja97890 if (ire->ire_marks & IRE_MARK_TEMPORARY) { 1037c793af95Ssangeeta ire->ire_marks &= ~IRE_MARK_TEMPORARY; 1038c793af95Ssangeeta irb->irb_tmp_ire_cnt--; 10399a09d68dSja97890 } 1040c793af95Ssangeeta rw_exit(&irb->irb_lock); 1041c793af95Ssangeeta } 1042c793af95Ssangeeta 1043c793af95Ssangeeta if (sire != NULL) { 1044c793af95Ssangeeta UPDATE_OB_PKT_COUNT(sire); 1045c793af95Ssangeeta sire->ire_last_used_time = lbolt; 1046c793af95Ssangeeta ire_refrele(sire); 1047c793af95Ssangeeta } 10489689d5ffSja97890 *ret_action = Forward_ok; 1049c793af95Ssangeeta return (ire); 1050c793af95Ssangeeta } 1051c793af95Ssangeeta create_irecache: 1052c793af95Ssangeeta /* 1053c793af95Ssangeeta * Increment the ire_ob_pkt_count field for ire if it is an 1054c793af95Ssangeeta * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and 1055c793af95Ssangeeta * increment the same for the parent IRE, sire, if it is some 105627c48ed9Snordmark * sort of prefix IRE (which includes DEFAULT, PREFIX, and HOST). 1057c793af95Ssangeeta */ 1058c793af95Ssangeeta if ((ire->ire_type & IRE_INTERFACE) != 0) { 1059c793af95Ssangeeta UPDATE_OB_PKT_COUNT(ire); 1060c793af95Ssangeeta ire->ire_last_used_time = lbolt; 1061c793af95Ssangeeta } 1062c793af95Ssangeeta 1063c793af95Ssangeeta /* 1064c793af95Ssangeeta * sire must be either IRE_CACHETABLE OR IRE_INTERFACE type 1065c793af95Ssangeeta */ 1066c793af95Ssangeeta if (sire != NULL) { 1067c793af95Ssangeeta gw = sire->ire_gateway_addr; 1068c793af95Ssangeeta ASSERT((sire->ire_type & 1069c793af95Ssangeeta (IRE_CACHETABLE | IRE_INTERFACE)) == 0); 1070c793af95Ssangeeta UPDATE_OB_PKT_COUNT(sire); 1071c793af95Ssangeeta sire->ire_last_used_time = lbolt; 1072c793af95Ssangeeta } 1073c793af95Ssangeeta 1074c793af95Ssangeeta /* Obtain dst_ill */ 1075c793af95Ssangeeta dst_ill = ip_newroute_get_dst_ill(ire->ire_ipif->ipif_ill); 1076c793af95Ssangeeta if (dst_ill == NULL) { 107729bc4795Ssangeeta ip2dbg(("ire_forward no dst ill; ire 0x%p\n", 107829bc4795Ssangeeta (void *)ire)); 1079c793af95Ssangeeta goto icmp_err_ret; 1080c793af95Ssangeeta } 1081c793af95Ssangeeta 1082c793af95Ssangeeta ASSERT(src_ipif == NULL); 1083c793af95Ssangeeta /* Now obtain the src_ipif */ 1084c793af95Ssangeeta src_ipif = ire_forward_src_ipif(dst, sire, ire, dst_ill, 1085c793af95Ssangeeta zoneid, &ire_marks); 1086c793af95Ssangeeta if (src_ipif == NULL) 1087c793af95Ssangeeta goto icmp_err_ret; 1088c793af95Ssangeeta 1089c793af95Ssangeeta switch (ire->ire_type) { 1090c793af95Ssangeeta case IRE_IF_NORESOLVER: 1091c793af95Ssangeeta /* create ire_cache for ire_addr endpoint */ 109242ee8d71Sja97890 if (dst_ill->ill_phys_addr_length != IP_ADDR_LEN && 109342ee8d71Sja97890 dst_ill->ill_resolver_mp == NULL) { 109442ee8d71Sja97890 ip1dbg(("ire_forward: dst_ill %p " 109542ee8d71Sja97890 "for IRE_IF_NORESOLVER ire %p has " 109642ee8d71Sja97890 "no ill_resolver_mp\n", 109742ee8d71Sja97890 (void *)dst_ill, (void *)ire)); 109842ee8d71Sja97890 goto icmp_err_ret; 109942ee8d71Sja97890 } 110042ee8d71Sja97890 /* FALLTHRU */ 1101c793af95Ssangeeta case IRE_IF_RESOLVER: 1102c793af95Ssangeeta /* 1103c793af95Ssangeeta * We have the IRE_IF_RESOLVER of the nexthop gateway 1104c793af95Ssangeeta * and now need to build a IRE_CACHE for it. 1105c793af95Ssangeeta * In this case, we have the following : 1106c793af95Ssangeeta * 1107c793af95Ssangeeta * 1) src_ipif - used for getting a source address. 1108c793af95Ssangeeta * 1109c793af95Ssangeeta * 2) dst_ill - from which we derive ire_stq/ire_rfq. This 1110c793af95Ssangeeta * means packets using the IRE_CACHE that we will build 1111c793af95Ssangeeta * here will go out on dst_ill. 1112c793af95Ssangeeta * 1113c793af95Ssangeeta * 3) sire may or may not be NULL. But, the IRE_CACHE that is 1114c793af95Ssangeeta * to be created will only be tied to the IRE_INTERFACE 1115c793af95Ssangeeta * that was derived from the ire_ihandle field. 1116c793af95Ssangeeta * 1117c793af95Ssangeeta * If sire is non-NULL, it means the destination is 1118c793af95Ssangeeta * off-link and we will first create the IRE_CACHE for the 1119c793af95Ssangeeta * gateway. 1120c793af95Ssangeeta */ 1121c793af95Ssangeeta res_mp = dst_ill->ill_resolver_mp; 1122c793af95Ssangeeta if (ire->ire_type == IRE_IF_RESOLVER && 1123c793af95Ssangeeta (!OK_RESOLVER_MP(res_mp))) { 112442ee8d71Sja97890 goto icmp_err_ret; 1125c793af95Ssangeeta } 1126c793af95Ssangeeta /* 1127c793af95Ssangeeta * To be at this point in the code with a non-zero gw 1128c793af95Ssangeeta * means that dst is reachable through a gateway that 1129c793af95Ssangeeta * we have never resolved. By changing dst to the gw 1130c793af95Ssangeeta * addr we resolve the gateway first. 1131c793af95Ssangeeta */ 1132c793af95Ssangeeta if (gw != INADDR_ANY) { 1133c793af95Ssangeeta /* 1134c793af95Ssangeeta * The source ipif that was determined above was 1135c793af95Ssangeeta * relative to the destination address, not the 1136c793af95Ssangeeta * gateway's. If src_ipif was not taken out of 1137c793af95Ssangeeta * the IRE_IF_RESOLVER entry, we'll need to call 1138c793af95Ssangeeta * ipif_select_source() again. 1139c793af95Ssangeeta */ 1140c793af95Ssangeeta if (src_ipif != ire->ire_ipif) { 1141c793af95Ssangeeta ipif_refrele(src_ipif); 1142c793af95Ssangeeta src_ipif = ipif_select_source(dst_ill, 1143c793af95Ssangeeta gw, zoneid); 1144c793af95Ssangeeta if (src_ipif == NULL) 1145c793af95Ssangeeta goto icmp_err_ret; 1146c793af95Ssangeeta } 1147c793af95Ssangeeta dst = gw; 1148c793af95Ssangeeta gw = INADDR_ANY; 1149c793af95Ssangeeta } 1150c793af95Ssangeeta /* 1151c793af95Ssangeeta * dst has been set to the address of the nexthop. 1152c793af95Ssangeeta * 1153c793af95Ssangeeta * TSol note: get security attributes of the nexthop; 1154c793af95Ssangeeta * Note that the nexthop may either be a gateway, or the 1155c793af95Ssangeeta * packet destination itself; Detailed explanation of 1156c793af95Ssangeeta * issues involved is provided in the IRE_IF_NORESOLVER 1157c793af95Ssangeeta * logic in ip_newroute(). 1158c793af95Ssangeeta */ 1159c793af95Ssangeeta ga.ga_af = AF_INET; 1160c793af95Ssangeeta IN6_IPADDR_TO_V4MAPPED(dst, &ga.ga_addr); 1161c793af95Ssangeeta gcgrp = gcgrp_lookup(&ga, B_FALSE); 1162c793af95Ssangeeta 1163c793af95Ssangeeta if (ire->ire_type == IRE_IF_NORESOLVER) 1164c793af95Ssangeeta dst = ire->ire_addr; /* ire_cache for tunnel endpoint */ 1165c793af95Ssangeeta 1166c793af95Ssangeeta save_ire = ire; 1167c793af95Ssangeeta /* 116854da8755Ssowmini * create an incomplete IRE_CACHE. 116954da8755Ssowmini * An areq_mp will be generated in ire_arpresolve() for 117054da8755Ssowmini * RESOLVER interfaces. 1171c793af95Ssangeeta */ 1172c793af95Ssangeeta ire = ire_create( 1173c793af95Ssangeeta (uchar_t *)&dst, /* dest address */ 1174c793af95Ssangeeta (uchar_t *)&ip_g_all_ones, /* mask */ 1175c793af95Ssangeeta (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ 1176c793af95Ssangeeta (uchar_t *)&gw, /* gateway address */ 1177c793af95Ssangeeta (save_ire->ire_type == IRE_IF_RESOLVER ? NULL: 1178c793af95Ssangeeta &save_ire->ire_max_frag), 1179c793af95Ssangeeta NULL, 1180c793af95Ssangeeta dst_ill->ill_rq, /* recv-from queue */ 1181c793af95Ssangeeta dst_ill->ill_wq, /* send-to queue */ 1182c793af95Ssangeeta IRE_CACHE, /* IRE type */ 1183c793af95Ssangeeta src_ipif, 1184c793af95Ssangeeta ire->ire_mask, /* Parent mask */ 1185c793af95Ssangeeta 0, 1186c793af95Ssangeeta ire->ire_ihandle, /* Interface handle */ 1187c793af95Ssangeeta 0, 1188c793af95Ssangeeta &(ire->ire_uinfo), 1189c793af95Ssangeeta NULL, 1190f4b3ec61Sdh155122 gcgrp, 1191f4b3ec61Sdh155122 ipst); 1192c793af95Ssangeeta ip1dbg(("incomplete ire_cache 0x%p\n", (void *)ire)); 1193c793af95Ssangeeta if (ire != NULL) { 1194c793af95Ssangeeta gcgrp = NULL; /* reference now held by IRE */ 1195c793af95Ssangeeta ire->ire_marks |= ire_marks; 1196c793af95Ssangeeta /* add the incomplete ire: */ 1197c793af95Ssangeeta error = ire_add(&ire, NULL, NULL, NULL, B_TRUE); 1198c793af95Ssangeeta if (error == 0 && ire != NULL) { 1199c793af95Ssangeeta ire->ire_max_frag = save_ire->ire_max_frag; 1200c793af95Ssangeeta ip1dbg(("setting max_frag to %d in ire 0x%p\n", 1201c793af95Ssangeeta ire->ire_max_frag, (void *)ire)); 1202c793af95Ssangeeta } else { 1203c793af95Ssangeeta ire_refrele(save_ire); 1204c793af95Ssangeeta goto icmp_err_ret; 1205c793af95Ssangeeta } 1206c793af95Ssangeeta } else { 1207c793af95Ssangeeta if (gcgrp != NULL) { 1208c793af95Ssangeeta GCGRP_REFRELE(gcgrp); 1209c793af95Ssangeeta gcgrp = NULL; 1210c793af95Ssangeeta } 1211c793af95Ssangeeta } 1212c793af95Ssangeeta 1213c793af95Ssangeeta ire_refrele(save_ire); 1214c793af95Ssangeeta break; 1215c793af95Ssangeeta default: 1216c793af95Ssangeeta break; 1217c793af95Ssangeeta } 1218c793af95Ssangeeta 121942ee8d71Sja97890 *ret_action = Forward_ok; 1220c793af95Ssangeeta if (sire != NULL) 1221c793af95Ssangeeta ire_refrele(sire); 1222c793af95Ssangeeta if (dst_ill != NULL) 1223c793af95Ssangeeta ill_refrele(dst_ill); 1224c793af95Ssangeeta if (src_ipif != NULL) 1225c793af95Ssangeeta ipif_refrele(src_ipif); 1226c793af95Ssangeeta return (ire); 1227c793af95Ssangeeta icmp_err_ret: 122842ee8d71Sja97890 *ret_action = Forward_ret_icmp_err; 1229c793af95Ssangeeta if (sire != NULL) 1230c793af95Ssangeeta ire_refrele(sire); 123142ee8d71Sja97890 if (dst_ill != NULL) 123242ee8d71Sja97890 ill_refrele(dst_ill); 123342ee8d71Sja97890 if (src_ipif != NULL) 123442ee8d71Sja97890 ipif_refrele(src_ipif); 1235c793af95Ssangeeta if (ire != NULL) { 123642ee8d71Sja97890 if (ire->ire_flags & RTF_BLACKHOLE) 123742ee8d71Sja97890 *ret_action = Forward_blackhole; 1238c793af95Ssangeeta ire_refrele(ire); 1239c793af95Ssangeeta } 1240c793af95Ssangeeta return (NULL); 1241*da14cebeSEric Cheng } 1242*da14cebeSEric Cheng 1243*da14cebeSEric Cheng /* 1244*da14cebeSEric Cheng * Since caller is ip_fast_forward, there is no CGTP or Tsol test 1245*da14cebeSEric Cheng * Also we dont call ftable lookup with MATCH_IRE_PARENT 1246*da14cebeSEric Cheng */ 1247*da14cebeSEric Cheng 1248*da14cebeSEric Cheng ire_t * 1249*da14cebeSEric Cheng ire_forward_simple(ipaddr_t dst, enum ire_forward_action *ret_action, 1250*da14cebeSEric Cheng ip_stack_t *ipst) 1251*da14cebeSEric Cheng { 1252*da14cebeSEric Cheng ipaddr_t gw = 0; 1253*da14cebeSEric Cheng ire_t *ire = NULL; 1254*da14cebeSEric Cheng ire_t *sire = NULL, *save_ire; 1255*da14cebeSEric Cheng ill_t *dst_ill = NULL; 1256*da14cebeSEric Cheng int error; 1257*da14cebeSEric Cheng zoneid_t zoneid; 1258*da14cebeSEric Cheng ipif_t *src_ipif = NULL; 1259*da14cebeSEric Cheng mblk_t *res_mp; 1260*da14cebeSEric Cheng ushort_t ire_marks = 0; 1261*da14cebeSEric Cheng 1262*da14cebeSEric Cheng zoneid = GLOBAL_ZONEID; 1263*da14cebeSEric Cheng 1264*da14cebeSEric Cheng 1265*da14cebeSEric Cheng ire = ire_ftable_lookup_simple(dst, &sire, zoneid, 1266*da14cebeSEric Cheng MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | 1267*da14cebeSEric Cheng MATCH_IRE_RJ_BHOLE, ipst); 1268*da14cebeSEric Cheng 1269*da14cebeSEric Cheng if (ire == NULL) { 1270*da14cebeSEric Cheng ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0, RTA_DST, ipst); 1271*da14cebeSEric Cheng goto icmp_err_ret; 1272*da14cebeSEric Cheng } 1273*da14cebeSEric Cheng 1274*da14cebeSEric Cheng /* 1275*da14cebeSEric Cheng * Verify that the returned IRE does not have either 1276*da14cebeSEric Cheng * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is 1277*da14cebeSEric Cheng * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER. 1278*da14cebeSEric Cheng */ 1279*da14cebeSEric Cheng if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))) { 1280*da14cebeSEric Cheng ASSERT(ire->ire_type & (IRE_CACHE | IRE_INTERFACE)); 1281*da14cebeSEric Cheng ip3dbg(("ire 0x%p is not cache/resolver/noresolver\n", 1282*da14cebeSEric Cheng (void *)ire)); 1283*da14cebeSEric Cheng goto icmp_err_ret; 1284*da14cebeSEric Cheng } 1285*da14cebeSEric Cheng 1286*da14cebeSEric Cheng /* 1287*da14cebeSEric Cheng * If we already have a fully resolved IRE CACHE of the 1288*da14cebeSEric Cheng * nexthop router, just hand over the cache entry 1289*da14cebeSEric Cheng * and we are done. 1290*da14cebeSEric Cheng */ 1291*da14cebeSEric Cheng 1292*da14cebeSEric Cheng if (ire->ire_type & IRE_CACHE) { 1293*da14cebeSEric Cheng 1294*da14cebeSEric Cheng /* 1295*da14cebeSEric Cheng * If we are using this ire cache entry as a 1296*da14cebeSEric Cheng * gateway to forward packets, chances are we 1297*da14cebeSEric Cheng * will be using it again. So turn off 1298*da14cebeSEric Cheng * the temporary flag, thus reducing its 1299*da14cebeSEric Cheng * chances of getting deleted frequently. 1300*da14cebeSEric Cheng */ 1301*da14cebeSEric Cheng if (ire->ire_marks & IRE_MARK_TEMPORARY) { 1302*da14cebeSEric Cheng irb_t *irb = ire->ire_bucket; 1303*da14cebeSEric Cheng rw_enter(&irb->irb_lock, RW_WRITER); 1304*da14cebeSEric Cheng ire->ire_marks &= ~IRE_MARK_TEMPORARY; 1305*da14cebeSEric Cheng irb->irb_tmp_ire_cnt--; 1306*da14cebeSEric Cheng rw_exit(&irb->irb_lock); 1307*da14cebeSEric Cheng } 1308*da14cebeSEric Cheng 1309*da14cebeSEric Cheng if (sire != NULL) { 1310*da14cebeSEric Cheng UPDATE_OB_PKT_COUNT(sire); 1311*da14cebeSEric Cheng ire_refrele(sire); 1312*da14cebeSEric Cheng } 1313*da14cebeSEric Cheng *ret_action = Forward_ok; 1314*da14cebeSEric Cheng return (ire); 1315*da14cebeSEric Cheng } 1316*da14cebeSEric Cheng /* 1317*da14cebeSEric Cheng * Increment the ire_ob_pkt_count field for ire if it is an 1318*da14cebeSEric Cheng * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and 1319*da14cebeSEric Cheng * increment the same for the parent IRE, sire, if it is some 1320*da14cebeSEric Cheng * sort of prefix IRE (which includes DEFAULT, PREFIX, and HOST). 1321*da14cebeSEric Cheng */ 1322*da14cebeSEric Cheng if ((ire->ire_type & IRE_INTERFACE) != 0) { 1323*da14cebeSEric Cheng UPDATE_OB_PKT_COUNT(ire); 1324*da14cebeSEric Cheng ire->ire_last_used_time = lbolt; 1325*da14cebeSEric Cheng } 1326*da14cebeSEric Cheng 1327*da14cebeSEric Cheng /* 1328*da14cebeSEric Cheng * sire must be either IRE_CACHETABLE OR IRE_INTERFACE type 1329*da14cebeSEric Cheng */ 1330*da14cebeSEric Cheng if (sire != NULL) { 1331*da14cebeSEric Cheng gw = sire->ire_gateway_addr; 1332*da14cebeSEric Cheng ASSERT((sire->ire_type & 1333*da14cebeSEric Cheng (IRE_CACHETABLE | IRE_INTERFACE)) == 0); 1334*da14cebeSEric Cheng UPDATE_OB_PKT_COUNT(sire); 1335*da14cebeSEric Cheng } 1336*da14cebeSEric Cheng 1337*da14cebeSEric Cheng /* Obtain dst_ill */ 1338*da14cebeSEric Cheng dst_ill = ip_newroute_get_dst_ill(ire->ire_ipif->ipif_ill); 1339*da14cebeSEric Cheng if (dst_ill == NULL) { 1340*da14cebeSEric Cheng ip2dbg(("ire_forward no dst ill; ire 0x%p\n", 1341*da14cebeSEric Cheng (void *)ire)); 1342*da14cebeSEric Cheng goto icmp_err_ret; 1343*da14cebeSEric Cheng } 1344*da14cebeSEric Cheng 1345*da14cebeSEric Cheng ASSERT(src_ipif == NULL); 1346*da14cebeSEric Cheng /* Now obtain the src_ipif */ 1347*da14cebeSEric Cheng src_ipif = ire_forward_src_ipif(dst, sire, ire, dst_ill, 1348*da14cebeSEric Cheng zoneid, &ire_marks); 1349*da14cebeSEric Cheng if (src_ipif == NULL) 1350*da14cebeSEric Cheng goto icmp_err_ret; 1351*da14cebeSEric Cheng 1352*da14cebeSEric Cheng switch (ire->ire_type) { 1353*da14cebeSEric Cheng case IRE_IF_NORESOLVER: 1354*da14cebeSEric Cheng /* create ire_cache for ire_addr endpoint */ 1355*da14cebeSEric Cheng case IRE_IF_RESOLVER: 1356*da14cebeSEric Cheng /* 1357*da14cebeSEric Cheng * We have the IRE_IF_RESOLVER of the nexthop gateway 1358*da14cebeSEric Cheng * and now need to build a IRE_CACHE for it. 1359*da14cebeSEric Cheng * In this case, we have the following : 1360*da14cebeSEric Cheng * 1361*da14cebeSEric Cheng * 1) src_ipif - used for getting a source address. 1362*da14cebeSEric Cheng * 1363*da14cebeSEric Cheng * 2) dst_ill - from which we derive ire_stq/ire_rfq. This 1364*da14cebeSEric Cheng * means packets using the IRE_CACHE that we will build 1365*da14cebeSEric Cheng * here will go out on dst_ill. 1366*da14cebeSEric Cheng * 1367*da14cebeSEric Cheng * 3) sire may or may not be NULL. But, the IRE_CACHE that is 1368*da14cebeSEric Cheng * to be created will only be tied to the IRE_INTERFACE 1369*da14cebeSEric Cheng * that was derived from the ire_ihandle field. 1370*da14cebeSEric Cheng * 1371*da14cebeSEric Cheng * If sire is non-NULL, it means the destination is 1372*da14cebeSEric Cheng * off-link and we will first create the IRE_CACHE for the 1373*da14cebeSEric Cheng * gateway. 1374*da14cebeSEric Cheng */ 1375*da14cebeSEric Cheng res_mp = dst_ill->ill_resolver_mp; 1376*da14cebeSEric Cheng if (ire->ire_type == IRE_IF_RESOLVER && 1377*da14cebeSEric Cheng (!OK_RESOLVER_MP(res_mp))) { 1378*da14cebeSEric Cheng ire_refrele(ire); 1379*da14cebeSEric Cheng ire = NULL; 1380*da14cebeSEric Cheng goto out; 1381*da14cebeSEric Cheng } 1382*da14cebeSEric Cheng /* 1383*da14cebeSEric Cheng * To be at this point in the code with a non-zero gw 1384*da14cebeSEric Cheng * means that dst is reachable through a gateway that 1385*da14cebeSEric Cheng * we have never resolved. By changing dst to the gw 1386*da14cebeSEric Cheng * addr we resolve the gateway first. 1387*da14cebeSEric Cheng */ 1388*da14cebeSEric Cheng if (gw != INADDR_ANY) { 1389*da14cebeSEric Cheng /* 1390*da14cebeSEric Cheng * The source ipif that was determined above was 1391*da14cebeSEric Cheng * relative to the destination address, not the 1392*da14cebeSEric Cheng * gateway's. If src_ipif was not taken out of 1393*da14cebeSEric Cheng * the IRE_IF_RESOLVER entry, we'll need to call 1394*da14cebeSEric Cheng * ipif_select_source() again. 1395*da14cebeSEric Cheng */ 1396*da14cebeSEric Cheng if (src_ipif != ire->ire_ipif) { 1397*da14cebeSEric Cheng ipif_refrele(src_ipif); 1398*da14cebeSEric Cheng src_ipif = ipif_select_source(dst_ill, 1399*da14cebeSEric Cheng gw, zoneid); 1400*da14cebeSEric Cheng if (src_ipif == NULL) 1401*da14cebeSEric Cheng goto icmp_err_ret; 1402*da14cebeSEric Cheng } 1403*da14cebeSEric Cheng dst = gw; 1404*da14cebeSEric Cheng gw = INADDR_ANY; 1405*da14cebeSEric Cheng } 1406*da14cebeSEric Cheng 1407*da14cebeSEric Cheng if (ire->ire_type == IRE_IF_NORESOLVER) 1408*da14cebeSEric Cheng dst = ire->ire_addr; /* ire_cache for tunnel endpoint */ 1409*da14cebeSEric Cheng 1410*da14cebeSEric Cheng save_ire = ire; 1411*da14cebeSEric Cheng /* 1412*da14cebeSEric Cheng * create an incomplete IRE_CACHE. 1413*da14cebeSEric Cheng * An areq_mp will be generated in ire_arpresolve() for 1414*da14cebeSEric Cheng * RESOLVER interfaces. 1415*da14cebeSEric Cheng */ 1416*da14cebeSEric Cheng ire = ire_create( 1417*da14cebeSEric Cheng (uchar_t *)&dst, /* dest address */ 1418*da14cebeSEric Cheng (uchar_t *)&ip_g_all_ones, /* mask */ 1419*da14cebeSEric Cheng (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ 1420*da14cebeSEric Cheng (uchar_t *)&gw, /* gateway address */ 1421*da14cebeSEric Cheng (save_ire->ire_type == IRE_IF_RESOLVER ? NULL: 1422*da14cebeSEric Cheng &save_ire->ire_max_frag), 1423*da14cebeSEric Cheng NULL, 1424*da14cebeSEric Cheng dst_ill->ill_rq, /* recv-from queue */ 1425*da14cebeSEric Cheng dst_ill->ill_wq, /* send-to queue */ 1426*da14cebeSEric Cheng IRE_CACHE, /* IRE type */ 1427*da14cebeSEric Cheng src_ipif, 1428*da14cebeSEric Cheng ire->ire_mask, /* Parent mask */ 1429*da14cebeSEric Cheng 0, 1430*da14cebeSEric Cheng ire->ire_ihandle, /* Interface handle */ 1431*da14cebeSEric Cheng 0, 1432*da14cebeSEric Cheng &(ire->ire_uinfo), 1433*da14cebeSEric Cheng NULL, 1434*da14cebeSEric Cheng NULL, 1435*da14cebeSEric Cheng ipst); 1436*da14cebeSEric Cheng ip1dbg(("incomplete ire_cache 0x%p\n", (void *)ire)); 1437*da14cebeSEric Cheng if (ire != NULL) { 1438*da14cebeSEric Cheng ire->ire_marks |= ire_marks; 1439*da14cebeSEric Cheng /* add the incomplete ire: */ 1440*da14cebeSEric Cheng error = ire_add(&ire, NULL, NULL, NULL, B_TRUE); 1441*da14cebeSEric Cheng if (error == 0 && ire != NULL) { 1442*da14cebeSEric Cheng ire->ire_max_frag = save_ire->ire_max_frag; 1443*da14cebeSEric Cheng ip1dbg(("setting max_frag to %d in ire 0x%p\n", 1444*da14cebeSEric Cheng ire->ire_max_frag, (void *)ire)); 1445*da14cebeSEric Cheng } else { 1446*da14cebeSEric Cheng ire_refrele(save_ire); 1447*da14cebeSEric Cheng goto icmp_err_ret; 1448*da14cebeSEric Cheng } 1449*da14cebeSEric Cheng } 1450*da14cebeSEric Cheng 1451*da14cebeSEric Cheng ire_refrele(save_ire); 1452*da14cebeSEric Cheng break; 1453*da14cebeSEric Cheng default: 1454*da14cebeSEric Cheng break; 1455*da14cebeSEric Cheng } 1456*da14cebeSEric Cheng 1457*da14cebeSEric Cheng out: 1458*da14cebeSEric Cheng *ret_action = Forward_ok; 1459*da14cebeSEric Cheng if (sire != NULL) 1460*da14cebeSEric Cheng ire_refrele(sire); 1461*da14cebeSEric Cheng if (dst_ill != NULL) 1462*da14cebeSEric Cheng ill_refrele(dst_ill); 1463*da14cebeSEric Cheng if (src_ipif != NULL) 1464*da14cebeSEric Cheng ipif_refrele(src_ipif); 1465*da14cebeSEric Cheng return (ire); 1466*da14cebeSEric Cheng icmp_err_ret: 1467*da14cebeSEric Cheng *ret_action = Forward_ret_icmp_err; 1468*da14cebeSEric Cheng if (src_ipif != NULL) 1469*da14cebeSEric Cheng ipif_refrele(src_ipif); 1470*da14cebeSEric Cheng if (dst_ill != NULL) 1471*da14cebeSEric Cheng ill_refrele(dst_ill); 1472*da14cebeSEric Cheng if (sire != NULL) 1473*da14cebeSEric Cheng ire_refrele(sire); 1474*da14cebeSEric Cheng if (ire != NULL) { 1475*da14cebeSEric Cheng if (ire->ire_flags & RTF_BLACKHOLE) 1476*da14cebeSEric Cheng *ret_action = Forward_blackhole; 1477*da14cebeSEric Cheng ire_refrele(ire); 1478*da14cebeSEric Cheng } 1479*da14cebeSEric Cheng /* caller needs to send icmp error message */ 1480*da14cebeSEric Cheng return (NULL); 1481c793af95Ssangeeta 1482c793af95Ssangeeta } 1483c793af95Ssangeeta 1484c793af95Ssangeeta /* 1485f4b3ec61Sdh155122 * Obtain the rt_entry and rt_irb for the route to be added to 1486f4b3ec61Sdh155122 * the ips_ip_ftable. 1487c793af95Ssangeeta * First attempt to add a node to the radix tree via rn_addroute. If the 1488c793af95Ssangeeta * route already exists, return the bucket for the existing route. 1489c793af95Ssangeeta * 1490c793af95Ssangeeta * Locking notes: Need to hold the global radix tree lock in write mode to 1491c793af95Ssangeeta * add a radix node. To prevent the node from being deleted, ire_get_bucket() 1492c793af95Ssangeeta * returns with a ref'ed irb_t. The ire itself is added in ire_add_v4() 1493c793af95Ssangeeta * while holding the irb_lock, but not the radix tree lock. 1494c793af95Ssangeeta */ 1495c793af95Ssangeeta irb_t * 1496c793af95Ssangeeta ire_get_bucket(ire_t *ire) 1497c793af95Ssangeeta { 1498c793af95Ssangeeta struct radix_node *rn; 1499c793af95Ssangeeta struct rt_entry *rt; 1500c793af95Ssangeeta struct rt_sockaddr rmask, rdst; 1501c793af95Ssangeeta irb_t *irb = NULL; 1502f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 1503c793af95Ssangeeta 1504f4b3ec61Sdh155122 ASSERT(ipst->ips_ip_ftable != NULL); 1505c793af95Ssangeeta 1506c793af95Ssangeeta /* first try to see if route exists (based on rtalloc1) */ 1507c793af95Ssangeeta (void) memset(&rdst, 0, sizeof (rdst)); 1508c793af95Ssangeeta rdst.rt_sin_len = sizeof (rdst); 1509c793af95Ssangeeta rdst.rt_sin_family = AF_INET; 1510c793af95Ssangeeta rdst.rt_sin_addr.s_addr = ire->ire_addr; 1511c793af95Ssangeeta 1512c793af95Ssangeeta (void) memset(&rmask, 0, sizeof (rmask)); 1513c793af95Ssangeeta rmask.rt_sin_len = sizeof (rmask); 1514c793af95Ssangeeta rmask.rt_sin_family = AF_INET; 1515c793af95Ssangeeta rmask.rt_sin_addr.s_addr = ire->ire_mask; 1516c793af95Ssangeeta 1517c793af95Ssangeeta /* 1518c793af95Ssangeeta * add the route. based on BSD's rtrequest1(RTM_ADD) 1519c793af95Ssangeeta */ 1520c793af95Ssangeeta R_Malloc(rt, rt_entry_cache, sizeof (*rt)); 152129bc4795Ssangeeta /* kmem_alloc failed */ 152229bc4795Ssangeeta if (rt == NULL) 152329bc4795Ssangeeta return (NULL); 152429bc4795Ssangeeta 1525c793af95Ssangeeta (void) memset(rt, 0, sizeof (*rt)); 1526c793af95Ssangeeta rt->rt_nodes->rn_key = (char *)&rt->rt_dst; 1527c793af95Ssangeeta rt->rt_dst = rdst; 1528c793af95Ssangeeta irb = &rt->rt_irb; 1529c793af95Ssangeeta irb->irb_marks |= IRB_MARK_FTABLE; /* dynamically allocated/freed */ 1530f4b3ec61Sdh155122 irb->irb_ipst = ipst; 1531c793af95Ssangeeta rw_init(&irb->irb_lock, NULL, RW_DEFAULT, NULL); 1532f4b3ec61Sdh155122 RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable); 1533f4b3ec61Sdh155122 rn = ipst->ips_ip_ftable->rnh_addaddr(&rt->rt_dst, &rmask, 1534f4b3ec61Sdh155122 ipst->ips_ip_ftable, (struct radix_node *)rt); 1535c793af95Ssangeeta if (rn == NULL) { 1536f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 1537c793af95Ssangeeta Free(rt, rt_entry_cache); 1538c793af95Ssangeeta rt = NULL; 1539c793af95Ssangeeta irb = NULL; 1540f4b3ec61Sdh155122 RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 1541f4b3ec61Sdh155122 rn = ipst->ips_ip_ftable->rnh_lookup(&rdst, &rmask, 1542f4b3ec61Sdh155122 ipst->ips_ip_ftable); 1543f4b3ec61Sdh155122 if (rn != NULL && ((rn->rn_flags & RNF_ROOT) == 0)) { 1544c793af95Ssangeeta /* found a non-root match */ 1545c793af95Ssangeeta rt = (struct rt_entry *)rn; 1546c793af95Ssangeeta } 1547c793af95Ssangeeta } 1548c793af95Ssangeeta if (rt != NULL) { 1549c793af95Ssangeeta irb = &rt->rt_irb; 1550c793af95Ssangeeta IRB_REFHOLD(irb); 1551c793af95Ssangeeta } 1552f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 1553c793af95Ssangeeta return (irb); 1554c793af95Ssangeeta } 1555c793af95Ssangeeta 1556c793af95Ssangeeta /* 1557c793af95Ssangeeta * This function is used when the caller wants to know the outbound 1558c793af95Ssangeeta * interface for a packet given only the address. 1559c793af95Ssangeeta * If this is a offlink IP address and there are multiple 1560c793af95Ssangeeta * routes to this destination, this routine will utilise the 1561c793af95Ssangeeta * first route it finds to IP address 1562c793af95Ssangeeta * Return values: 1563c793af95Ssangeeta * 0 - FAILURE 1564c793af95Ssangeeta * nonzero - ifindex 1565c793af95Ssangeeta */ 1566c793af95Ssangeeta uint_t 1567c793af95Ssangeeta ifindex_lookup(const struct sockaddr *ipaddr, zoneid_t zoneid) 1568c793af95Ssangeeta { 1569c793af95Ssangeeta uint_t ifindex = 0; 1570c793af95Ssangeeta ire_t *ire; 1571c793af95Ssangeeta ill_t *ill; 1572f4b3ec61Sdh155122 netstack_t *ns; 1573f4b3ec61Sdh155122 ip_stack_t *ipst; 1574c793af95Ssangeeta 1575f4b3ec61Sdh155122 if (zoneid == ALL_ZONES) 1576f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(GLOBAL_ZONEID); 1577f4b3ec61Sdh155122 else 1578f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(zoneid); 1579f4b3ec61Sdh155122 ASSERT(ns != NULL); 1580f4b3ec61Sdh155122 1581f4b3ec61Sdh155122 /* 1582f4b3ec61Sdh155122 * For exclusive stacks we set the zoneid to zero 1583f4b3ec61Sdh155122 * since IP uses the global zoneid in the exclusive stacks. 1584f4b3ec61Sdh155122 */ 1585f4b3ec61Sdh155122 if (ns->netstack_stackid != GLOBAL_NETSTACKID) 1586f4b3ec61Sdh155122 zoneid = GLOBAL_ZONEID; 1587f4b3ec61Sdh155122 ipst = ns->netstack_ip; 1588c793af95Ssangeeta 1589c793af95Ssangeeta ASSERT(ipaddr->sa_family == AF_INET || ipaddr->sa_family == AF_INET6); 1590c793af95Ssangeeta 1591f4b3ec61Sdh155122 if ((ire = route_to_dst(ipaddr, zoneid, ipst)) != NULL) { 1592c793af95Ssangeeta ill = ire_to_ill(ire); 1593c793af95Ssangeeta if (ill != NULL) 1594c793af95Ssangeeta ifindex = ill->ill_phyint->phyint_ifindex; 1595c793af95Ssangeeta ire_refrele(ire); 1596c793af95Ssangeeta } 1597f4b3ec61Sdh155122 netstack_rele(ns); 1598c793af95Ssangeeta return (ifindex); 1599c793af95Ssangeeta } 1600c793af95Ssangeeta 1601c793af95Ssangeeta /* 1602c793af95Ssangeeta * Routine to find the route to a destination. If a ifindex is supplied 1603c793af95Ssangeeta * it tries to match the the route to the corresponding ipif for the ifindex 1604c793af95Ssangeeta */ 1605c793af95Ssangeeta static ire_t * 1606f4b3ec61Sdh155122 route_to_dst(const struct sockaddr *dst_addr, zoneid_t zoneid, ip_stack_t *ipst) 1607c793af95Ssangeeta { 1608c793af95Ssangeeta ire_t *ire = NULL; 1609c793af95Ssangeeta int match_flags; 1610c793af95Ssangeeta 1611c793af95Ssangeeta match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | 1612c793af95Ssangeeta MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE); 1613c793af95Ssangeeta 1614c793af95Ssangeeta /* XXX pass NULL tsl for now */ 1615c793af95Ssangeeta 1616c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 1617c793af95Ssangeeta ire = ire_route_lookup( 1618c793af95Ssangeeta ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr, 1619f4b3ec61Sdh155122 0, 0, 0, NULL, NULL, zoneid, NULL, match_flags, ipst); 1620c793af95Ssangeeta } else { 1621c793af95Ssangeeta ire = ire_route_lookup_v6( 1622c793af95Ssangeeta &((struct sockaddr_in6 *)dst_addr)->sin6_addr, 1623f4b3ec61Sdh155122 0, 0, 0, NULL, NULL, zoneid, NULL, match_flags, ipst); 1624c793af95Ssangeeta } 1625c793af95Ssangeeta return (ire); 1626c793af95Ssangeeta } 1627c793af95Ssangeeta 1628c793af95Ssangeeta /* 1629c793af95Ssangeeta * This routine is called by IP Filter to send a packet out on the wire 1630c793af95Ssangeeta * to a specified V4 dst (which may be onlink or offlink). The ifindex may or 1631c793af95Ssangeeta * may not be 0. A non-null ifindex indicates IP Filter has stipulated 1632c793af95Ssangeeta * an outgoing interface and requires the nexthop to be on that interface. 1633c793af95Ssangeeta * IP WILL NOT DO the following to the data packet before sending it out: 1634c793af95Ssangeeta * a. manipulate ttl 1635edd26dc5Sdr146992 * b. ipsec work 1636edd26dc5Sdr146992 * c. fragmentation 1637edd26dc5Sdr146992 * 1638edd26dc5Sdr146992 * If the packet has been prepared for hardware checksum then it will be 1639edd26dc5Sdr146992 * passed off to ip_send_align_cksum() to check that the flags set on the 1640edd26dc5Sdr146992 * packet are in alignment with the capabilities of the new outgoing NIC. 1641c793af95Ssangeeta * 1642c793af95Ssangeeta * Return values: 1643c793af95Ssangeeta * 0: IP was able to send of the data pkt 1644c793af95Ssangeeta * ECOMM: Could not send packet 1645c793af95Ssangeeta * ENONET No route to dst. It is up to the caller 1646c793af95Ssangeeta * to send icmp unreachable error message, 1647c793af95Ssangeeta * EINPROGRESS The macaddr of the onlink dst or that 1648c793af95Ssangeeta * of the offlink dst's nexthop needs to get 1649c793af95Ssangeeta * resolved before packet can be sent to dst. 1650c793af95Ssangeeta * Thus transmission is not guaranteed. 1651c793af95Ssangeeta * 1652c793af95Ssangeeta */ 1653c793af95Ssangeeta 1654c793af95Ssangeeta int 1655c793af95Ssangeeta ipfil_sendpkt(const struct sockaddr *dst_addr, mblk_t *mp, uint_t ifindex, 1656c793af95Ssangeeta zoneid_t zoneid) 1657c793af95Ssangeeta { 1658c793af95Ssangeeta ire_t *ire = NULL, *sire = NULL; 1659c793af95Ssangeeta ire_t *ire_cache = NULL; 1660c793af95Ssangeeta int value; 1661c793af95Ssangeeta int match_flags; 1662c793af95Ssangeeta ipaddr_t dst; 1663f4b3ec61Sdh155122 netstack_t *ns; 1664f4b3ec61Sdh155122 ip_stack_t *ipst; 166542ee8d71Sja97890 enum ire_forward_action ret_action; 1666c793af95Ssangeeta 1667c793af95Ssangeeta ASSERT(mp != NULL); 1668c793af95Ssangeeta 1669f4b3ec61Sdh155122 if (zoneid == ALL_ZONES) 1670f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(GLOBAL_ZONEID); 1671f4b3ec61Sdh155122 else 1672f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(zoneid); 1673f4b3ec61Sdh155122 ASSERT(ns != NULL); 1674f4b3ec61Sdh155122 1675f4b3ec61Sdh155122 /* 1676f4b3ec61Sdh155122 * For exclusive stacks we set the zoneid to zero 1677f4b3ec61Sdh155122 * since IP uses the global zoneid in the exclusive stacks. 1678f4b3ec61Sdh155122 */ 1679f4b3ec61Sdh155122 if (ns->netstack_stackid != GLOBAL_NETSTACKID) 1680f4b3ec61Sdh155122 zoneid = GLOBAL_ZONEID; 1681f4b3ec61Sdh155122 ipst = ns->netstack_ip; 1682f4b3ec61Sdh155122 1683c793af95Ssangeeta ASSERT(dst_addr->sa_family == AF_INET || 1684c793af95Ssangeeta dst_addr->sa_family == AF_INET6); 1685c793af95Ssangeeta 1686c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 1687c793af95Ssangeeta dst = ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr; 1688c793af95Ssangeeta } else { 1689c793af95Ssangeeta /* 1690c793af95Ssangeeta * We dont have support for V6 yet. It will be provided 1691c793af95Ssangeeta * once RFE 6399103 has been delivered. 1692c793af95Ssangeeta * Until then, for V6 dsts, IP Filter will not call 1693a9a89b0dSdr146992 * this function. Instead the netinfo framework provides 1694a9a89b0dSdr146992 * its own code path, in ip_inject_impl(), to achieve 1695a9a89b0dSdr146992 * what it needs to do, for the time being. 1696c793af95Ssangeeta */ 1697c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: no V6 support \n")); 1698c793af95Ssangeeta value = ECOMM; 1699c793af95Ssangeeta freemsg(mp); 1700c793af95Ssangeeta goto discard; 1701c793af95Ssangeeta } 1702c793af95Ssangeeta 1703c793af95Ssangeeta /* 1704c793af95Ssangeeta * Lets get the ire. We might get the ire cache entry, 1705c793af95Ssangeeta * or the ire,sire pair needed to create the cache entry. 1706c793af95Ssangeeta * XXX pass NULL tsl for now. 1707c793af95Ssangeeta */ 1708c793af95Ssangeeta 1709c793af95Ssangeeta if (ifindex == 0) { 1710c793af95Ssangeeta /* There is no supplied index. So use the FIB info */ 1711c793af95Ssangeeta 1712c793af95Ssangeeta match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | 1713c793af95Ssangeeta MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE); 1714c793af95Ssangeeta ire = ire_route_lookup(dst, 1715c793af95Ssangeeta 0, 0, 0, NULL, &sire, zoneid, MBLK_GETLABEL(mp), 1716f4b3ec61Sdh155122 match_flags, ipst); 1717c793af95Ssangeeta } else { 1718c793af95Ssangeeta ipif_t *supplied_ipif; 1719c793af95Ssangeeta ill_t *ill; 1720c793af95Ssangeeta 172167c1caeeSnordmark match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | 172267c1caeeSnordmark MATCH_IRE_RECURSIVE| MATCH_IRE_RJ_BHOLE| 172367c1caeeSnordmark MATCH_IRE_SECATTR); 172467c1caeeSnordmark 1725c793af95Ssangeeta /* 1726c793af95Ssangeeta * If supplied ifindex is non-null, the only valid 172767c1caeeSnordmark * nexthop is one off of the interface or group corresponding 1728c793af95Ssangeeta * to the specified ifindex. 1729c793af95Ssangeeta */ 1730c793af95Ssangeeta ill = ill_lookup_on_ifindex(ifindex, B_FALSE, 1731f4b3ec61Sdh155122 NULL, NULL, NULL, NULL, ipst); 1732c793af95Ssangeeta if (ill != NULL) { 173367c1caeeSnordmark match_flags |= MATCH_IRE_ILL; 1734c793af95Ssangeeta } else { 173567c1caeeSnordmark /* Fallback to group names if hook_emulation set */ 173667c1caeeSnordmark if (ipst->ips_ipmp_hook_emulation) { 173767c1caeeSnordmark ill = ill_group_lookup_on_ifindex(ifindex, 173867c1caeeSnordmark B_FALSE, ipst); 173967c1caeeSnordmark } 174067c1caeeSnordmark if (ill == NULL) { 1741c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Could not find" 1742c793af95Ssangeeta " route to dst\n")); 1743c793af95Ssangeeta value = ECOMM; 1744c793af95Ssangeeta freemsg(mp); 1745c793af95Ssangeeta goto discard; 1746c793af95Ssangeeta } 174767c1caeeSnordmark match_flags |= MATCH_IRE_ILL_GROUP; 174867c1caeeSnordmark } 174967c1caeeSnordmark supplied_ipif = ipif_get_next_ipif(NULL, ill); 1750c793af95Ssangeeta 1751c793af95Ssangeeta ire = ire_route_lookup(dst, 0, 0, 0, supplied_ipif, 1752f4b3ec61Sdh155122 &sire, zoneid, MBLK_GETLABEL(mp), match_flags, ipst); 1753381a2a9aSdr146992 ipif_refrele(supplied_ipif); 1754c793af95Ssangeeta ill_refrele(ill); 1755c793af95Ssangeeta } 1756c793af95Ssangeeta 1757c793af95Ssangeeta /* 1758c793af95Ssangeeta * Verify that the returned IRE is non-null and does 1759c793af95Ssangeeta * not have either the RTF_REJECT or RTF_BLACKHOLE 1760c793af95Ssangeeta * flags set and that the IRE is either an IRE_CACHE, 1761c793af95Ssangeeta * IRE_IF_NORESOLVER or IRE_IF_RESOLVER. 1762c793af95Ssangeeta */ 1763c793af95Ssangeeta if (ire == NULL || 1764c793af95Ssangeeta ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) || 1765c793af95Ssangeeta (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0)) { 1766c793af95Ssangeeta /* 1767c793af95Ssangeeta * Either ire could not be found or we got 1768c793af95Ssangeeta * an invalid one 1769c793af95Ssangeeta */ 1770c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Could not find route to dst\n")); 1771c793af95Ssangeeta value = ENONET; 1772c793af95Ssangeeta freemsg(mp); 1773c793af95Ssangeeta goto discard; 1774c793af95Ssangeeta } 1775c793af95Ssangeeta 1776c793af95Ssangeeta /* IP Filter and CGTP dont mix. So bail out if CGTP is on */ 1777655a42e2Snordmark if (ipst->ips_ip_cgtp_filter && 1778c793af95Ssangeeta ((ire->ire_flags & RTF_MULTIRT) || 1779c793af95Ssangeeta ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) { 1780c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: IPFilter does not work with CGTP\n")); 1781c793af95Ssangeeta value = ECOMM; 1782c793af95Ssangeeta freemsg(mp); 1783c793af95Ssangeeta goto discard; 1784c793af95Ssangeeta } 1785c793af95Ssangeeta 1786381a2a9aSdr146992 ASSERT(ire->ire_type != IRE_CACHE || ire->ire_nce != NULL); 1787edd26dc5Sdr146992 1788c793af95Ssangeeta /* 1789c793af95Ssangeeta * If needed, we will create the ire cache entry for the 1790c793af95Ssangeeta * nexthop, resolve its link-layer address and then send 1791edd26dc5Sdr146992 * the packet out without ttl or IPSec processing. 1792c793af95Ssangeeta */ 1793c793af95Ssangeeta switch (ire->ire_type) { 1794c793af95Ssangeeta case IRE_CACHE: 1795c793af95Ssangeeta if (sire != NULL) { 1796c793af95Ssangeeta UPDATE_OB_PKT_COUNT(sire); 1797c793af95Ssangeeta sire->ire_last_used_time = lbolt; 1798c793af95Ssangeeta ire_refrele(sire); 1799c793af95Ssangeeta } 1800c793af95Ssangeeta ire_cache = ire; 1801c793af95Ssangeeta break; 18027a4afe69Ssangeeta case IRE_IF_NORESOLVER: 1803c793af95Ssangeeta case IRE_IF_RESOLVER: 1804c793af95Ssangeeta /* 1805c793af95Ssangeeta * Call ire_forward(). This function 1806c793af95Ssangeeta * will, create the ire cache entry of the 1807c793af95Ssangeeta * the nexthop and adds this incomplete ire 1808c793af95Ssangeeta * to the ire cache table 1809c793af95Ssangeeta */ 181042ee8d71Sja97890 ire_cache = ire_forward(dst, &ret_action, ire, sire, 1811f4b3ec61Sdh155122 MBLK_GETLABEL(mp), ipst); 1812c793af95Ssangeeta if (ire_cache == NULL) { 1813c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: failed to create the" 1814c793af95Ssangeeta " ire cache entry \n")); 1815c793af95Ssangeeta value = ENONET; 1816c793af95Ssangeeta freemsg(mp); 1817c793af95Ssangeeta sire = NULL; 1818c793af95Ssangeeta ire = NULL; 1819c793af95Ssangeeta goto discard; 1820c793af95Ssangeeta } 1821c793af95Ssangeeta break; 1822c793af95Ssangeeta } 1823edd26dc5Sdr146992 1824edd26dc5Sdr146992 if (DB_CKSUMFLAGS(mp)) { 1825edd26dc5Sdr146992 if (ip_send_align_hcksum_flags(mp, ire_to_ill(ire_cache))) 1826edd26dc5Sdr146992 goto cleanup; 1827edd26dc5Sdr146992 } 1828edd26dc5Sdr146992 1829c793af95Ssangeeta /* 1830c793af95Ssangeeta * Now that we have the ire cache entry of the nexthop, call 1831c793af95Ssangeeta * ip_xmit_v4() to trigger mac addr resolution 1832c793af95Ssangeeta * if necessary and send it once ready. 1833c793af95Ssangeeta */ 1834c793af95Ssangeeta 1835*da14cebeSEric Cheng value = ip_xmit_v4(mp, ire_cache, NULL, B_FALSE, NULL); 1836edd26dc5Sdr146992 cleanup: 1837c793af95Ssangeeta ire_refrele(ire_cache); 1838c793af95Ssangeeta /* 1839c793af95Ssangeeta * At this point, the reference for these have already been 1840c793af95Ssangeeta * released within ire_forward() and/or ip_xmit_v4(). So we set 1841c793af95Ssangeeta * them to NULL to make sure we dont drop the references 1842c793af95Ssangeeta * again in case ip_xmit_v4() returns with either SEND_FAILED 1843c793af95Ssangeeta * or LLHDR_RESLV_FAILED 1844c793af95Ssangeeta */ 1845c793af95Ssangeeta sire = NULL; 1846c793af95Ssangeeta ire = NULL; 1847c793af95Ssangeeta 1848c793af95Ssangeeta switch (value) { 1849c793af95Ssangeeta case SEND_FAILED: 1850c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Send failed\n")); 1851c793af95Ssangeeta value = ECOMM; 1852c793af95Ssangeeta break; 1853c793af95Ssangeeta case LLHDR_RESLV_FAILED: 1854c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Link-layer resolution" 1855c793af95Ssangeeta " failed\n")); 1856c793af95Ssangeeta value = ECOMM; 1857c793af95Ssangeeta break; 1858c793af95Ssangeeta case LOOKUP_IN_PROGRESS: 1859f4b3ec61Sdh155122 netstack_rele(ns); 1860c793af95Ssangeeta return (EINPROGRESS); 1861c793af95Ssangeeta case SEND_PASSED: 1862f4b3ec61Sdh155122 netstack_rele(ns); 1863c793af95Ssangeeta return (0); 1864c793af95Ssangeeta } 1865c793af95Ssangeeta discard: 1866c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 1867f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 1868c793af95Ssangeeta } else { 1869f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards); 1870c793af95Ssangeeta } 1871c793af95Ssangeeta if (ire != NULL) 1872c793af95Ssangeeta ire_refrele(ire); 1873c793af95Ssangeeta if (sire != NULL) 1874c793af95Ssangeeta ire_refrele(sire); 1875f4b3ec61Sdh155122 netstack_rele(ns); 1876c793af95Ssangeeta return (value); 1877c793af95Ssangeeta } 1878c793af95Ssangeeta 1879edd26dc5Sdr146992 1880edd26dc5Sdr146992 /* 1881edd26dc5Sdr146992 * We don't check for dohwcksum in here because it should be being used 1882edd26dc5Sdr146992 * elsewhere to control what flags are being set on the mblk. That is, 1883edd26dc5Sdr146992 * if DB_CKSUMFLAGS() is non-zero then we assume dohwcksum to be true 1884edd26dc5Sdr146992 * for this packet. 1885edd26dc5Sdr146992 * 1886edd26dc5Sdr146992 * This function assumes that it is *only* being called for TCP or UDP 1887edd26dc5Sdr146992 * packets and nothing else. 1888edd26dc5Sdr146992 */ 1889edd26dc5Sdr146992 static int 1890edd26dc5Sdr146992 ip_send_align_hcksum_flags(mblk_t *mp, ill_t *ill) 1891edd26dc5Sdr146992 { 1892edd26dc5Sdr146992 int illhckflags; 1893edd26dc5Sdr146992 int mbhckflags; 1894edd26dc5Sdr146992 uint16_t *up; 1895edd26dc5Sdr146992 uint32_t cksum; 1896edd26dc5Sdr146992 ipha_t *ipha; 1897edd26dc5Sdr146992 ip6_t *ip6; 1898edd26dc5Sdr146992 int proto; 1899edd26dc5Sdr146992 int ipversion; 1900edd26dc5Sdr146992 int length; 1901edd26dc5Sdr146992 int start; 1902edd26dc5Sdr146992 ip6_pkt_t ipp; 1903edd26dc5Sdr146992 1904edd26dc5Sdr146992 mbhckflags = DB_CKSUMFLAGS(mp); 1905edd26dc5Sdr146992 ASSERT(mbhckflags != 0); 1906edd26dc5Sdr146992 ASSERT(mp->b_datap->db_type == M_DATA); 1907edd26dc5Sdr146992 /* 1908edd26dc5Sdr146992 * Since this function only knows how to manage the hardware checksum 1909edd26dc5Sdr146992 * issue, reject and packets that have flags set on the aside from 1910edd26dc5Sdr146992 * checksum related attributes as we cannot necessarily safely map 1911edd26dc5Sdr146992 * that packet onto the new NIC. Packets that can be potentially 1912edd26dc5Sdr146992 * dropped here include those marked for LSO. 1913edd26dc5Sdr146992 */ 1914edd26dc5Sdr146992 if ((mbhckflags & 1915edd26dc5Sdr146992 ~(HCK_FULLCKSUM|HCK_PARTIALCKSUM|HCK_IPV4_HDRCKSUM)) != 0) { 1916edd26dc5Sdr146992 DTRACE_PROBE2(pbr__incapable, (mblk_t *), mp, (ill_t *), ill); 1917edd26dc5Sdr146992 freemsg(mp); 1918edd26dc5Sdr146992 return (-1); 1919edd26dc5Sdr146992 } 1920edd26dc5Sdr146992 1921edd26dc5Sdr146992 ipha = (ipha_t *)mp->b_rptr; 1922edd26dc5Sdr146992 1923edd26dc5Sdr146992 /* 1924edd26dc5Sdr146992 * Find out what the new NIC is capable of, if anything, and 1925edd26dc5Sdr146992 * only allow it to be used with M_DATA mblks being sent out. 1926edd26dc5Sdr146992 */ 1927edd26dc5Sdr146992 if (ILL_HCKSUM_CAPABLE(ill)) { 1928edd26dc5Sdr146992 illhckflags = ill->ill_hcksum_capab->ill_hcksum_txflags; 1929edd26dc5Sdr146992 } else { 1930edd26dc5Sdr146992 /* 1931edd26dc5Sdr146992 * No capabilities, so turn off everything. 1932edd26dc5Sdr146992 */ 1933edd26dc5Sdr146992 illhckflags = 0; 1934edd26dc5Sdr146992 (void) hcksum_assoc(mp, NULL, NULL, 0, 0, 0, 0, 0, 0); 1935edd26dc5Sdr146992 mp->b_datap->db_struioflag &= ~STRUIO_IP; 1936edd26dc5Sdr146992 } 1937edd26dc5Sdr146992 1938edd26dc5Sdr146992 DTRACE_PROBE4(pbr__info__a, (mblk_t *), mp, (ill_t *), ill, 1939edd26dc5Sdr146992 uint32_t, illhckflags, uint32_t, mbhckflags); 1940edd26dc5Sdr146992 /* 1941edd26dc5Sdr146992 * This block of code that looks for the position of the TCP/UDP 1942edd26dc5Sdr146992 * checksum is early in this function because we need to know 1943edd26dc5Sdr146992 * what needs to be blanked out for the hardware checksum case. 1944edd26dc5Sdr146992 * 1945edd26dc5Sdr146992 * That we're in this function implies that the packet is either 1946edd26dc5Sdr146992 * TCP or UDP on Solaris, so checks are made for one protocol and 1947edd26dc5Sdr146992 * if that fails, the other is therefore implied. 1948edd26dc5Sdr146992 */ 1949edd26dc5Sdr146992 ipversion = IPH_HDR_VERSION(ipha); 1950edd26dc5Sdr146992 1951edd26dc5Sdr146992 if (ipversion == IPV4_VERSION) { 1952edd26dc5Sdr146992 proto = ipha->ipha_protocol; 1953edd26dc5Sdr146992 if (proto == IPPROTO_TCP) { 1954edd26dc5Sdr146992 up = IPH_TCPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH); 1955edd26dc5Sdr146992 } else { 1956edd26dc5Sdr146992 up = IPH_UDPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH); 1957edd26dc5Sdr146992 } 1958edd26dc5Sdr146992 } else { 1959edd26dc5Sdr146992 uint8_t lasthdr; 1960edd26dc5Sdr146992 1961edd26dc5Sdr146992 /* 1962edd26dc5Sdr146992 * Nothing I've seen indicates that IPv6 checksum'ing 1963edd26dc5Sdr146992 * precludes the presence of extension headers, so we 1964edd26dc5Sdr146992 * can't just look at the next header value in the IPv6 1965edd26dc5Sdr146992 * packet header to see if it is TCP/UDP. 1966edd26dc5Sdr146992 */ 1967edd26dc5Sdr146992 ip6 = (ip6_t *)ipha; 1968edd26dc5Sdr146992 (void) memset(&ipp, 0, sizeof (ipp)); 1969edd26dc5Sdr146992 start = ip_find_hdr_v6(mp, ip6, &ipp, &lasthdr); 1970edd26dc5Sdr146992 proto = lasthdr; 1971edd26dc5Sdr146992 1972edd26dc5Sdr146992 if (proto == IPPROTO_TCP) { 1973edd26dc5Sdr146992 up = IPH_TCPH_CHECKSUMP(ipha, start); 1974edd26dc5Sdr146992 } else { 1975edd26dc5Sdr146992 up = IPH_UDPH_CHECKSUMP(ipha, start); 1976edd26dc5Sdr146992 } 1977edd26dc5Sdr146992 } 1978edd26dc5Sdr146992 1979edd26dc5Sdr146992 /* 1980edd26dc5Sdr146992 * The first case here is easiest: 1981edd26dc5Sdr146992 * mblk hasn't asked for full checksum, but the card supports it. 1982edd26dc5Sdr146992 * 1983edd26dc5Sdr146992 * In addition, check for IPv4 header capability. Note that only 1984edd26dc5Sdr146992 * the mblk flag is checked and not ipversion. 1985edd26dc5Sdr146992 */ 1986edd26dc5Sdr146992 if ((((illhckflags & HCKSUM_INET_FULL_V4) && (ipversion == 4)) || 1987edd26dc5Sdr146992 (((illhckflags & HCKSUM_INET_FULL_V6) && (ipversion == 6)))) && 1988edd26dc5Sdr146992 ((mbhckflags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) != 0)) { 1989edd26dc5Sdr146992 int newflags = HCK_FULLCKSUM; 1990edd26dc5Sdr146992 1991edd26dc5Sdr146992 if ((mbhckflags & HCK_IPV4_HDRCKSUM) != 0) { 1992edd26dc5Sdr146992 if ((illhckflags & HCKSUM_IPHDRCKSUM) != 0) { 1993edd26dc5Sdr146992 newflags |= HCK_IPV4_HDRCKSUM; 1994edd26dc5Sdr146992 } else { 1995edd26dc5Sdr146992 /* 1996edd26dc5Sdr146992 * Rather than call a function, just inline 1997edd26dc5Sdr146992 * the computation of the basic IPv4 header. 1998edd26dc5Sdr146992 */ 1999edd26dc5Sdr146992 cksum = (ipha->ipha_dst >> 16) + 2000edd26dc5Sdr146992 (ipha->ipha_dst & 0xFFFF) + 2001edd26dc5Sdr146992 (ipha->ipha_src >> 16) + 2002edd26dc5Sdr146992 (ipha->ipha_src & 0xFFFF); 2003edd26dc5Sdr146992 IP_HDR_CKSUM(ipha, cksum, 2004edd26dc5Sdr146992 ((uint32_t *)ipha)[0], 2005edd26dc5Sdr146992 ((uint16_t *)ipha)[4]); 2006edd26dc5Sdr146992 } 2007edd26dc5Sdr146992 } 2008edd26dc5Sdr146992 2009edd26dc5Sdr146992 *up = 0; 2010edd26dc5Sdr146992 (void) hcksum_assoc(mp, NULL, NULL, 0, 0, 0, 0, 2011edd26dc5Sdr146992 newflags, 0); 2012edd26dc5Sdr146992 return (0); 2013edd26dc5Sdr146992 } 2014edd26dc5Sdr146992 2015edd26dc5Sdr146992 DTRACE_PROBE2(pbr__info__b, int, ipversion, int, proto); 2016edd26dc5Sdr146992 2017edd26dc5Sdr146992 /* 2018edd26dc5Sdr146992 * Start calculating the pseudo checksum over the IP packet header. 2019edd26dc5Sdr146992 * Although the final pseudo checksum used by TCP/UDP consists of 2020edd26dc5Sdr146992 * more than just the address fields, we can use the result of 2021edd26dc5Sdr146992 * adding those together a little bit further down for IPv4. 2022edd26dc5Sdr146992 */ 2023edd26dc5Sdr146992 if (ipversion == IPV4_VERSION) { 2024edd26dc5Sdr146992 cksum = (ipha->ipha_dst >> 16) + (ipha->ipha_dst & 0xFFFF) + 2025edd26dc5Sdr146992 (ipha->ipha_src >> 16) + (ipha->ipha_src & 0xFFFF); 2026edd26dc5Sdr146992 start = IP_SIMPLE_HDR_LENGTH; 2027edd26dc5Sdr146992 length = ntohs(ipha->ipha_length); 2028edd26dc5Sdr146992 DTRACE_PROBE3(pbr__info__e, uint32_t, ipha->ipha_src, 2029edd26dc5Sdr146992 uint32_t, ipha->ipha_dst, int, cksum); 2030edd26dc5Sdr146992 } else { 2031edd26dc5Sdr146992 uint16_t *pseudo; 2032edd26dc5Sdr146992 2033edd26dc5Sdr146992 pseudo = (uint16_t *)&ip6->ip6_src; 2034edd26dc5Sdr146992 2035edd26dc5Sdr146992 /* calculate pseudo-header checksum */ 2036edd26dc5Sdr146992 cksum = pseudo[0] + pseudo[1] + pseudo[2] + pseudo[3] + 2037edd26dc5Sdr146992 pseudo[4] + pseudo[5] + pseudo[6] + pseudo[7] + 2038edd26dc5Sdr146992 pseudo[8] + pseudo[9] + pseudo[10] + pseudo[11] + 2039edd26dc5Sdr146992 pseudo[12] + pseudo[13] + pseudo[14] + pseudo[15]; 2040edd26dc5Sdr146992 2041edd26dc5Sdr146992 length = ntohs(ip6->ip6_plen) + sizeof (ip6_t); 2042edd26dc5Sdr146992 } 2043edd26dc5Sdr146992 2044edd26dc5Sdr146992 /* Fold the initial sum */ 2045edd26dc5Sdr146992 cksum = (cksum & 0xffff) + (cksum >> 16); 2046edd26dc5Sdr146992 2047edd26dc5Sdr146992 /* 2048edd26dc5Sdr146992 * If the packet was asking for an IPv4 header checksum to be 2049edd26dc5Sdr146992 * calculated but the interface doesn't support that, fill it in 2050edd26dc5Sdr146992 * using our pseudo checksum as a starting point. 2051edd26dc5Sdr146992 */ 2052edd26dc5Sdr146992 if (((mbhckflags & HCK_IPV4_HDRCKSUM) != 0) && 2053edd26dc5Sdr146992 ((illhckflags & HCKSUM_IPHDRCKSUM) == 0)) { 2054edd26dc5Sdr146992 /* 2055edd26dc5Sdr146992 * IP_HDR_CKSUM uses the 2rd arg to the macro in a destructive 2056edd26dc5Sdr146992 * way so pass in a copy of the checksum calculated thus far. 2057edd26dc5Sdr146992 */ 2058edd26dc5Sdr146992 uint32_t ipsum = cksum; 2059edd26dc5Sdr146992 2060edd26dc5Sdr146992 DB_CKSUMFLAGS(mp) &= ~HCK_IPV4_HDRCKSUM; 2061edd26dc5Sdr146992 2062edd26dc5Sdr146992 IP_HDR_CKSUM(ipha, ipsum, ((uint32_t *)ipha)[0], 2063edd26dc5Sdr146992 ((uint16_t *)ipha)[4]); 2064edd26dc5Sdr146992 } 2065edd26dc5Sdr146992 2066edd26dc5Sdr146992 DTRACE_PROBE3(pbr__info__c, int, start, int, length, int, cksum); 2067edd26dc5Sdr146992 2068edd26dc5Sdr146992 if (proto == IPPROTO_TCP) { 2069edd26dc5Sdr146992 cksum += IP_TCP_CSUM_COMP; 2070edd26dc5Sdr146992 } else { 2071edd26dc5Sdr146992 cksum += IP_UDP_CSUM_COMP; 2072edd26dc5Sdr146992 } 2073edd26dc5Sdr146992 cksum += htons(length - start); 2074edd26dc5Sdr146992 cksum = (cksum & 0xffff) + (cksum >> 16); 2075edd26dc5Sdr146992 2076edd26dc5Sdr146992 /* 2077edd26dc5Sdr146992 * For TCP/UDP, we either want to setup the packet for partial 2078edd26dc5Sdr146992 * checksum or we want to do it all ourselves because the NIC 2079edd26dc5Sdr146992 * offers no support for either partial or full checksum. 2080edd26dc5Sdr146992 */ 2081edd26dc5Sdr146992 if ((illhckflags & HCKSUM_INET_PARTIAL) != 0) { 2082edd26dc5Sdr146992 /* 2083edd26dc5Sdr146992 * The only case we care about here is if the mblk was 2084edd26dc5Sdr146992 * previously set for full checksum offload. If it was 2085edd26dc5Sdr146992 * marked for partial (and the NIC does partial), then 2086edd26dc5Sdr146992 * we have nothing to do. Similarly if the packet was 2087edd26dc5Sdr146992 * not set for partial or full, we do nothing as this 2088edd26dc5Sdr146992 * is cheaper than more work to set something up. 2089edd26dc5Sdr146992 */ 2090edd26dc5Sdr146992 if ((mbhckflags & HCK_FULLCKSUM) != 0) { 2091edd26dc5Sdr146992 uint32_t offset; 2092edd26dc5Sdr146992 2093edd26dc5Sdr146992 if (proto == IPPROTO_TCP) { 2094edd26dc5Sdr146992 offset = TCP_CHECKSUM_OFFSET; 2095edd26dc5Sdr146992 } else { 2096edd26dc5Sdr146992 offset = UDP_CHECKSUM_OFFSET; 2097edd26dc5Sdr146992 } 2098edd26dc5Sdr146992 *up = cksum; 2099edd26dc5Sdr146992 2100edd26dc5Sdr146992 DTRACE_PROBE3(pbr__info__f, int, length - start, int, 2101edd26dc5Sdr146992 cksum, int, offset); 2102edd26dc5Sdr146992 2103edd26dc5Sdr146992 (void) hcksum_assoc(mp, NULL, NULL, start, 2104edd26dc5Sdr146992 start + offset, length, 0, 2105edd26dc5Sdr146992 DB_CKSUMFLAGS(mp) | HCK_PARTIALCKSUM, 0); 2106edd26dc5Sdr146992 } 2107edd26dc5Sdr146992 2108edd26dc5Sdr146992 } else if (mbhckflags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) { 2109edd26dc5Sdr146992 DB_CKSUMFLAGS(mp) &= ~(HCK_PARTIALCKSUM|HCK_FULLCKSUM); 2110edd26dc5Sdr146992 2111edd26dc5Sdr146992 *up = 0; 2112edd26dc5Sdr146992 *up = IP_CSUM(mp, start, cksum); 2113edd26dc5Sdr146992 } 2114edd26dc5Sdr146992 2115edd26dc5Sdr146992 DTRACE_PROBE4(pbr__info__d, (mblk_t *), mp, (ipha_t *), ipha, 2116edd26dc5Sdr146992 (uint16_t *), up, int, cksum); 2117edd26dc5Sdr146992 return (0); 2118edd26dc5Sdr146992 } 2119edd26dc5Sdr146992 2120c793af95Ssangeeta /* 2121c793af95Ssangeeta * callback function provided by ire_ftable_lookup when calling 2122c793af95Ssangeeta * rn_match_args(). Invoke ire_match_args on each matching leaf node in 2123c793af95Ssangeeta * the radix tree. 2124c793af95Ssangeeta */ 2125c793af95Ssangeeta boolean_t 2126c793af95Ssangeeta ire_find_best_route(struct radix_node *rn, void *arg) 2127c793af95Ssangeeta { 2128c793af95Ssangeeta struct rt_entry *rt = (struct rt_entry *)rn; 2129c793af95Ssangeeta irb_t *irb_ptr; 2130c793af95Ssangeeta ire_t *ire; 2131c793af95Ssangeeta ire_ftable_args_t *margs = arg; 2132c793af95Ssangeeta ipaddr_t match_mask; 2133c793af95Ssangeeta 2134c793af95Ssangeeta ASSERT(rt != NULL); 2135c793af95Ssangeeta 2136c793af95Ssangeeta irb_ptr = &rt->rt_irb; 2137c793af95Ssangeeta 2138c793af95Ssangeeta if (irb_ptr->irb_ire_cnt == 0) 2139c793af95Ssangeeta return (B_FALSE); 2140c793af95Ssangeeta 2141c793af95Ssangeeta rw_enter(&irb_ptr->irb_lock, RW_READER); 2142c793af95Ssangeeta for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 2143c793af95Ssangeeta if (ire->ire_marks & IRE_MARK_CONDEMNED) 2144c793af95Ssangeeta continue; 2145c793af95Ssangeeta if (margs->ift_flags & MATCH_IRE_MASK) 2146c793af95Ssangeeta match_mask = margs->ift_mask; 2147c793af95Ssangeeta else 2148c793af95Ssangeeta match_mask = ire->ire_mask; 2149c793af95Ssangeeta 2150c793af95Ssangeeta if (ire_match_args(ire, margs->ift_addr, match_mask, 2151c793af95Ssangeeta margs->ift_gateway, margs->ift_type, margs->ift_ipif, 2152c793af95Ssangeeta margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl, 21535b17e9bdSJon Anderson margs->ift_flags, NULL)) { 2154c793af95Ssangeeta IRE_REFHOLD(ire); 2155c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 2156c793af95Ssangeeta margs->ift_best_ire = ire; 2157c793af95Ssangeeta return (B_TRUE); 2158c793af95Ssangeeta } 2159c793af95Ssangeeta } 2160c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 2161c793af95Ssangeeta return (B_FALSE); 2162c793af95Ssangeeta } 2163c793af95Ssangeeta 2164c793af95Ssangeeta /* 2165c793af95Ssangeeta * ftable irb_t structures are dynamically allocated, and we need to 2166c793af95Ssangeeta * check if the irb_t (and associated ftable tree attachment) needs to 2167c793af95Ssangeeta * be cleaned up when the irb_refcnt goes to 0. The conditions that need 2168c793af95Ssangeeta * be verified are: 2169c793af95Ssangeeta * - no other walkers of the irebucket, i.e., quiescent irb_refcnt, 2170c793af95Ssangeeta * - no other threads holding references to ire's in the bucket, 2171c793af95Ssangeeta * i.e., irb_nire == 0 2172c793af95Ssangeeta * - no active ire's in the bucket, i.e., irb_ire_cnt == 0 2173c793af95Ssangeeta * - need to hold the global tree lock and irb_lock in write mode. 2174c793af95Ssangeeta */ 2175c793af95Ssangeeta void 2176c793af95Ssangeeta irb_refrele_ftable(irb_t *irb) 2177c793af95Ssangeeta { 2178c793af95Ssangeeta for (;;) { 2179c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 2180c793af95Ssangeeta ASSERT(irb->irb_refcnt != 0); 2181c793af95Ssangeeta if (irb->irb_refcnt != 1) { 2182c793af95Ssangeeta /* 2183c793af95Ssangeeta * Someone has a reference to this radix node 2184c793af95Ssangeeta * or there is some bucket walker. 2185c793af95Ssangeeta */ 2186c793af95Ssangeeta irb->irb_refcnt--; 2187c793af95Ssangeeta rw_exit(&irb->irb_lock); 2188c793af95Ssangeeta return; 2189c793af95Ssangeeta } else { 2190c793af95Ssangeeta /* 2191c793af95Ssangeeta * There is no other walker, nor is there any 2192c793af95Ssangeeta * other thread that holds a direct ref to this 2193c793af95Ssangeeta * radix node. Do the clean up if needed. Call 2194c793af95Ssangeeta * to ire_unlink will clear the IRB_MARK_CONDEMNED flag 2195c793af95Ssangeeta */ 2196c793af95Ssangeeta if (irb->irb_marks & IRB_MARK_CONDEMNED) { 2197c793af95Ssangeeta ire_t *ire_list; 2198c793af95Ssangeeta 2199c793af95Ssangeeta ire_list = ire_unlink(irb); 2200c793af95Ssangeeta rw_exit(&irb->irb_lock); 2201c793af95Ssangeeta 2202c793af95Ssangeeta if (ire_list != NULL) 2203c793af95Ssangeeta ire_cleanup(ire_list); 2204c793af95Ssangeeta /* 2205c793af95Ssangeeta * more CONDEMNED entries could have 2206c793af95Ssangeeta * been added while we dropped the lock, 2207c793af95Ssangeeta * so we have to re-check. 2208c793af95Ssangeeta */ 2209c793af95Ssangeeta continue; 2210c793af95Ssangeeta } 2211c793af95Ssangeeta 2212c793af95Ssangeeta /* 2213c793af95Ssangeeta * Now check if there are still any ires 2214c793af95Ssangeeta * associated with this radix node. 2215c793af95Ssangeeta */ 2216c793af95Ssangeeta if (irb->irb_nire != 0) { 2217c793af95Ssangeeta /* 2218c793af95Ssangeeta * someone is still holding on 2219c793af95Ssangeeta * to ires in this bucket 2220c793af95Ssangeeta */ 2221c793af95Ssangeeta irb->irb_refcnt--; 2222c793af95Ssangeeta rw_exit(&irb->irb_lock); 2223c793af95Ssangeeta return; 2224c793af95Ssangeeta } else { 2225c793af95Ssangeeta /* 2226c793af95Ssangeeta * Everything is clear. Zero walkers, 2227c793af95Ssangeeta * Zero threads with a ref to this 2228c793af95Ssangeeta * radix node, Zero ires associated with 2229c793af95Ssangeeta * this radix node. Due to lock order, 2230c793af95Ssangeeta * check the above conditions again 2231c793af95Ssangeeta * after grabbing all locks in the right order 2232c793af95Ssangeeta */ 2233c793af95Ssangeeta rw_exit(&irb->irb_lock); 2234c793af95Ssangeeta if (irb_inactive(irb)) 2235c793af95Ssangeeta return; 2236c793af95Ssangeeta /* 2237c793af95Ssangeeta * irb_inactive could not free the irb. 2238c793af95Ssangeeta * See if there are any walkers, if not 2239c793af95Ssangeeta * try to clean up again. 2240c793af95Ssangeeta */ 2241c793af95Ssangeeta } 2242c793af95Ssangeeta } 2243c793af95Ssangeeta } 2244c793af95Ssangeeta } 2245c793af95Ssangeeta 2246c793af95Ssangeeta /* 2247c793af95Ssangeeta * IRE iterator used by ire_ftable_lookup() to process multiple default 2248c793af95Ssangeeta * routes. Given a starting point in the hash list (ire_origin), walk the IREs 2249c793af95Ssangeeta * in the bucket skipping default interface routes and deleted entries. 2250c793af95Ssangeeta * Returns the next IRE (unheld), or NULL when we're back to the starting point. 2251c793af95Ssangeeta * Assumes that the caller holds a reference on the IRE bucket. 2252c793af95Ssangeeta * 2253c793af95Ssangeeta * In the absence of good IRE_DEFAULT routes, this function will return 2254c793af95Ssangeeta * the first IRE_INTERFACE route found (if any). 2255c793af95Ssangeeta */ 2256c793af95Ssangeeta ire_t * 2257f4b3ec61Sdh155122 ire_round_robin(irb_t *irb_ptr, zoneid_t zoneid, ire_ftable_args_t *margs, 2258f4b3ec61Sdh155122 ip_stack_t *ipst) 2259c793af95Ssangeeta { 2260c793af95Ssangeeta ire_t *ire_origin; 2261c793af95Ssangeeta ire_t *ire, *maybe_ire = NULL; 2262c793af95Ssangeeta 2263c793af95Ssangeeta rw_enter(&irb_ptr->irb_lock, RW_WRITER); 2264c793af95Ssangeeta ire_origin = irb_ptr->irb_rr_origin; 22650ad1ccddSsowmini if (ire_origin != NULL) { 2266c793af95Ssangeeta ire_origin = ire_origin->ire_next; 22670ad1ccddSsowmini IRE_FIND_NEXT_ORIGIN(ire_origin); 22680ad1ccddSsowmini } 2269c793af95Ssangeeta 2270c793af95Ssangeeta if (ire_origin == NULL) { 2271c793af95Ssangeeta /* 2272c793af95Ssangeeta * first time through routine, or we dropped off the end 2273c793af95Ssangeeta * of list. 2274c793af95Ssangeeta */ 2275c793af95Ssangeeta ire_origin = irb_ptr->irb_ire; 22760ad1ccddSsowmini IRE_FIND_NEXT_ORIGIN(ire_origin); 2277c793af95Ssangeeta } 2278c793af95Ssangeeta irb_ptr->irb_rr_origin = ire_origin; 2279c793af95Ssangeeta IRB_REFHOLD_LOCKED(irb_ptr); 2280c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 2281c793af95Ssangeeta 22820ad1ccddSsowmini DTRACE_PROBE2(ire__rr__origin, (irb_t *), irb_ptr, 22830ad1ccddSsowmini (ire_t *), ire_origin); 22840ad1ccddSsowmini 2285c793af95Ssangeeta /* 2286c793af95Ssangeeta * Round-robin the routers list looking for a route that 2287c793af95Ssangeeta * matches the passed in parameters. 2288c793af95Ssangeeta * We start with the ire we found above and we walk the hash 2289c793af95Ssangeeta * list until we're back where we started. It doesn't matter if 2290c793af95Ssangeeta * routes are added or deleted by other threads - we know this 2291c793af95Ssangeeta * ire will stay in the list because we hold a reference on the 2292c793af95Ssangeeta * ire bucket. 2293c793af95Ssangeeta */ 2294c793af95Ssangeeta ire = ire_origin; 2295c793af95Ssangeeta while (ire != NULL) { 229627c48ed9Snordmark int match_flags = MATCH_IRE_TYPE | MATCH_IRE_SECATTR; 2297c793af95Ssangeeta ire_t *rire; 2298c793af95Ssangeeta 2299c793af95Ssangeeta if (ire->ire_marks & IRE_MARK_CONDEMNED) 2300c793af95Ssangeeta goto next_ire; 2301c793af95Ssangeeta 2302c793af95Ssangeeta if (!ire_match_args(ire, margs->ift_addr, (ipaddr_t)0, 2303c793af95Ssangeeta margs->ift_gateway, margs->ift_type, margs->ift_ipif, 2304c793af95Ssangeeta margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl, 23055b17e9bdSJon Anderson margs->ift_flags, NULL)) 2306c793af95Ssangeeta goto next_ire; 2307c793af95Ssangeeta 2308c793af95Ssangeeta if (ire->ire_type & IRE_INTERFACE) { 2309c793af95Ssangeeta /* 2310c793af95Ssangeeta * keep looking to see if there is a non-interface 2311c793af95Ssangeeta * default ire, but save this one as a last resort. 2312c793af95Ssangeeta */ 2313c793af95Ssangeeta if (maybe_ire == NULL) 2314c793af95Ssangeeta maybe_ire = ire; 2315c793af95Ssangeeta goto next_ire; 2316c793af95Ssangeeta } 2317c793af95Ssangeeta 2318c793af95Ssangeeta if (zoneid == ALL_ZONES) { 2319c793af95Ssangeeta IRE_REFHOLD(ire); 2320c793af95Ssangeeta IRB_REFRELE(irb_ptr); 2321c793af95Ssangeeta return (ire); 2322c793af95Ssangeeta } 2323c793af95Ssangeeta /* 232427c48ed9Snordmark * When we're in a non-global zone, we're only 2325c793af95Ssangeeta * interested in routers that are 2326c793af95Ssangeeta * reachable through ipifs within our zone. 2327c793af95Ssangeeta */ 2328c793af95Ssangeeta if (ire->ire_ipif != NULL) { 2329c793af95Ssangeeta match_flags |= MATCH_IRE_ILL_GROUP; 2330c793af95Ssangeeta } 233127c48ed9Snordmark rire = ire_route_lookup(ire->ire_gateway_addr, 0, 0, 233227c48ed9Snordmark IRE_INTERFACE, ire->ire_ipif, NULL, zoneid, margs->ift_tsl, 2333f4b3ec61Sdh155122 match_flags, ipst); 2334c793af95Ssangeeta if (rire != NULL) { 2335c793af95Ssangeeta ire_refrele(rire); 2336c793af95Ssangeeta IRE_REFHOLD(ire); 2337c793af95Ssangeeta IRB_REFRELE(irb_ptr); 2338c793af95Ssangeeta return (ire); 2339c793af95Ssangeeta } 2340c793af95Ssangeeta next_ire: 2341c793af95Ssangeeta ire = (ire->ire_next ? ire->ire_next : irb_ptr->irb_ire); 2342c793af95Ssangeeta if (ire == ire_origin) 2343c793af95Ssangeeta break; 2344c793af95Ssangeeta } 2345c793af95Ssangeeta if (maybe_ire != NULL) 2346c793af95Ssangeeta IRE_REFHOLD(maybe_ire); 2347c793af95Ssangeeta IRB_REFRELE(irb_ptr); 2348c793af95Ssangeeta return (maybe_ire); 2349c793af95Ssangeeta } 23502679e103Ssowmini 23512679e103Ssowmini void 23522679e103Ssowmini irb_refhold_rn(struct radix_node *rn) 23532679e103Ssowmini { 23542679e103Ssowmini if ((rn->rn_flags & RNF_ROOT) == 0) 23552679e103Ssowmini IRB_REFHOLD(&((rt_t *)(rn))->rt_irb); 23562679e103Ssowmini } 23572679e103Ssowmini 23582679e103Ssowmini void 23592679e103Ssowmini irb_refrele_rn(struct radix_node *rn) 23602679e103Ssowmini { 23612679e103Ssowmini if ((rn->rn_flags & RNF_ROOT) == 0) 23622679e103Ssowmini irb_refrele_ftable(&((rt_t *)(rn))->rt_irb); 23632679e103Ssowmini } 2364