1c793af95Ssangeeta /* 2c793af95Ssangeeta * CDDL HEADER START 3c793af95Ssangeeta * 4c793af95Ssangeeta * The contents of this file are subject to the terms of the 5c793af95Ssangeeta * Common Development and Distribution License (the "License"). 6c793af95Ssangeeta * You may not use this file except in compliance with the License. 7c793af95Ssangeeta * 8c793af95Ssangeeta * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c793af95Ssangeeta * or http://www.opensolaris.org/os/licensing. 10c793af95Ssangeeta * See the License for the specific language governing permissions 11c793af95Ssangeeta * and limitations under the License. 12c793af95Ssangeeta * 13c793af95Ssangeeta * When distributing Covered Code, include this CDDL HEADER in each 14c793af95Ssangeeta * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c793af95Ssangeeta * If applicable, add the following below this CDDL HEADER, with the 16c793af95Ssangeeta * fields enclosed by brackets "[]" replaced with your own identifying 17c793af95Ssangeeta * information: Portions Copyright [yyyy] [name of copyright owner] 18c793af95Ssangeeta * 19c793af95Ssangeeta * CDDL HEADER END 20c793af95Ssangeeta */ 21c793af95Ssangeeta /* 22*f4b3ec61Sdh155122 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23c793af95Ssangeeta * Use is subject to license terms. 24c793af95Ssangeeta */ 25c793af95Ssangeeta 26c793af95Ssangeeta #pragma ident "%Z%%M% %I% %E% SMI" 27c793af95Ssangeeta 28c793af95Ssangeeta /* 29c793af95Ssangeeta * This file contains consumer routines of the IPv4 forwarding engine 30c793af95Ssangeeta */ 31c793af95Ssangeeta 32c793af95Ssangeeta #include <sys/types.h> 33c793af95Ssangeeta #include <sys/stream.h> 34c793af95Ssangeeta #include <sys/stropts.h> 35c793af95Ssangeeta #include <sys/strlog.h> 36c793af95Ssangeeta #include <sys/dlpi.h> 37c793af95Ssangeeta #include <sys/ddi.h> 38c793af95Ssangeeta #include <sys/cmn_err.h> 39c793af95Ssangeeta #include <sys/policy.h> 40c793af95Ssangeeta 41c793af95Ssangeeta #include <sys/systm.h> 42c793af95Ssangeeta #include <sys/strsun.h> 43c793af95Ssangeeta #include <sys/kmem.h> 44c793af95Ssangeeta #include <sys/param.h> 45c793af95Ssangeeta #include <sys/socket.h> 46c793af95Ssangeeta #include <net/if.h> 47c793af95Ssangeeta #include <net/route.h> 48c793af95Ssangeeta #include <netinet/in.h> 49c793af95Ssangeeta #include <net/if_dl.h> 50c793af95Ssangeeta #include <netinet/ip6.h> 51c793af95Ssangeeta #include <netinet/icmp6.h> 52c793af95Ssangeeta 53c793af95Ssangeeta #include <inet/common.h> 54c793af95Ssangeeta #include <inet/mi.h> 55c793af95Ssangeeta #include <inet/mib2.h> 56c793af95Ssangeeta #include <inet/ip.h> 57c793af95Ssangeeta #include <inet/ip6.h> 58c793af95Ssangeeta #include <inet/ip_ndp.h> 59c793af95Ssangeeta #include <inet/arp.h> 60c793af95Ssangeeta #include <inet/ip_if.h> 61c793af95Ssangeeta #include <inet/ip_ire.h> 62c793af95Ssangeeta #include <inet/ip_ftable.h> 63c793af95Ssangeeta #include <inet/ip_rts.h> 64c793af95Ssangeeta #include <inet/nd.h> 65c793af95Ssangeeta 66c793af95Ssangeeta #include <net/pfkeyv2.h> 67c793af95Ssangeeta #include <inet/ipsec_info.h> 68c793af95Ssangeeta #include <inet/sadb.h> 69c793af95Ssangeeta #include <sys/kmem.h> 70c793af95Ssangeeta #include <inet/tcp.h> 71c793af95Ssangeeta #include <inet/ipclassifier.h> 72c793af95Ssangeeta #include <sys/zone.h> 73c793af95Ssangeeta #include <net/radix.h> 74c793af95Ssangeeta #include <sys/tsol/label.h> 75c793af95Ssangeeta #include <sys/tsol/tnet.h> 76c793af95Ssangeeta 77c793af95Ssangeeta #define IS_DEFAULT_ROUTE(ire) \ 78c793af95Ssangeeta (((ire)->ire_type & IRE_DEFAULT) || \ 79c793af95Ssangeeta (((ire)->ire_type & IRE_INTERFACE) && ((ire)->ire_addr == 0))) 80c793af95Ssangeeta 81c793af95Ssangeeta /* 82c793af95Ssangeeta * structure for passing args between ire_ftable_lookup and ire_find_best_route 83c793af95Ssangeeta */ 84c793af95Ssangeeta typedef struct ire_ftable_args_s { 85c793af95Ssangeeta ipaddr_t ift_addr; 86c793af95Ssangeeta ipaddr_t ift_mask; 87c793af95Ssangeeta ipaddr_t ift_gateway; 88c793af95Ssangeeta int ift_type; 89c793af95Ssangeeta const ipif_t *ift_ipif; 90c793af95Ssangeeta zoneid_t ift_zoneid; 91c793af95Ssangeeta uint32_t ift_ihandle; 92c793af95Ssangeeta const ts_label_t *ift_tsl; 93c793af95Ssangeeta int ift_flags; 94c793af95Ssangeeta ire_t *ift_best_ire; 95c793af95Ssangeeta } ire_ftable_args_t; 96c793af95Ssangeeta 97*f4b3ec61Sdh155122 static ire_t *route_to_dst(const struct sockaddr *, zoneid_t, ip_stack_t *); 98*f4b3ec61Sdh155122 static ire_t *ire_round_robin(irb_t *, zoneid_t, ire_ftable_args_t *, 99*f4b3ec61Sdh155122 ip_stack_t *); 100c793af95Ssangeeta static void ire_del_host_redir(ire_t *, char *); 101c793af95Ssangeeta static boolean_t ire_find_best_route(struct radix_node *, void *); 102c793af95Ssangeeta 103c793af95Ssangeeta /* 104c793af95Ssangeeta * Lookup a route in forwarding table. A specific lookup is indicated by 105c793af95Ssangeeta * passing the required parameters and indicating the match required in the 106c793af95Ssangeeta * flag field. 107c793af95Ssangeeta * 108c793af95Ssangeeta * Looking for default route can be done in three ways 109c793af95Ssangeeta * 1) pass mask as 0 and set MATCH_IRE_MASK in flags field 110c793af95Ssangeeta * along with other matches. 111c793af95Ssangeeta * 2) pass type as IRE_DEFAULT and set MATCH_IRE_TYPE in flags 112c793af95Ssangeeta * field along with other matches. 113c793af95Ssangeeta * 3) if the destination and mask are passed as zeros. 114c793af95Ssangeeta * 115c793af95Ssangeeta * A request to return a default route if no route 116c793af95Ssangeeta * is found, can be specified by setting MATCH_IRE_DEFAULT 117c793af95Ssangeeta * in flags. 118c793af95Ssangeeta * 119c793af95Ssangeeta * It does not support recursion more than one level. It 120c793af95Ssangeeta * will do recursive lookup only when the lookup maps to 121c793af95Ssangeeta * a prefix or default route and MATCH_IRE_RECURSIVE flag is passed. 122c793af95Ssangeeta * 123c793af95Ssangeeta * If the routing table is setup to allow more than one level 124c793af95Ssangeeta * of recursion, the cleaning up cache table will not work resulting 125c793af95Ssangeeta * in invalid routing. 126c793af95Ssangeeta * 127c793af95Ssangeeta * Supports IP_BOUND_IF by following the ipif/ill when recursing. 128c793af95Ssangeeta * 129c793af95Ssangeeta * NOTE : When this function returns NULL, pire has already been released. 130c793af95Ssangeeta * pire is valid only when this function successfully returns an 131c793af95Ssangeeta * ire. 132c793af95Ssangeeta */ 133c793af95Ssangeeta ire_t * 134c793af95Ssangeeta ire_ftable_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 135c793af95Ssangeeta int type, const ipif_t *ipif, ire_t **pire, zoneid_t zoneid, 136*f4b3ec61Sdh155122 uint32_t ihandle, const ts_label_t *tsl, int flags, ip_stack_t *ipst) 137c793af95Ssangeeta { 138c793af95Ssangeeta ire_t *ire = NULL; 139c793af95Ssangeeta ipaddr_t gw_addr; 140c793af95Ssangeeta struct rt_sockaddr rdst, rmask; 141c793af95Ssangeeta struct rt_entry *rt; 142c793af95Ssangeeta ire_ftable_args_t margs; 143c793af95Ssangeeta boolean_t found_incomplete = B_FALSE; 144c793af95Ssangeeta 145c793af95Ssangeeta ASSERT(ipif == NULL || !ipif->ipif_isv6); 146c793af95Ssangeeta ASSERT(!(flags & MATCH_IRE_WQ)); 147c793af95Ssangeeta 148c793af95Ssangeeta /* 149c793af95Ssangeeta * When we return NULL from this function, we should make 150c793af95Ssangeeta * sure that *pire is NULL so that the callers will not 151c793af95Ssangeeta * wrongly REFRELE the pire. 152c793af95Ssangeeta */ 153c793af95Ssangeeta if (pire != NULL) 154c793af95Ssangeeta *pire = NULL; 155c793af95Ssangeeta /* 156c793af95Ssangeeta * ire_match_args() will dereference ipif MATCH_IRE_SRC or 157c793af95Ssangeeta * MATCH_IRE_ILL is set. 158c793af95Ssangeeta */ 159c793af95Ssangeeta if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) && 160c793af95Ssangeeta (ipif == NULL)) 161c793af95Ssangeeta return (NULL); 162c793af95Ssangeeta 163c793af95Ssangeeta (void) memset(&rdst, 0, sizeof (rdst)); 164c793af95Ssangeeta rdst.rt_sin_len = sizeof (rdst); 165c793af95Ssangeeta rdst.rt_sin_family = AF_INET; 166c793af95Ssangeeta rdst.rt_sin_addr.s_addr = addr; 167c793af95Ssangeeta 168c793af95Ssangeeta (void) memset(&rmask, 0, sizeof (rmask)); 169c793af95Ssangeeta rmask.rt_sin_len = sizeof (rmask); 170c793af95Ssangeeta rmask.rt_sin_family = AF_INET; 171c793af95Ssangeeta rmask.rt_sin_addr.s_addr = mask; 172c793af95Ssangeeta 173c793af95Ssangeeta (void) memset(&margs, 0, sizeof (margs)); 174c793af95Ssangeeta margs.ift_addr = addr; 175c793af95Ssangeeta margs.ift_mask = mask; 176c793af95Ssangeeta margs.ift_gateway = gateway; 177c793af95Ssangeeta margs.ift_type = type; 178c793af95Ssangeeta margs.ift_ipif = ipif; 179c793af95Ssangeeta margs.ift_zoneid = zoneid; 180c793af95Ssangeeta margs.ift_ihandle = ihandle; 181c793af95Ssangeeta margs.ift_tsl = tsl; 182c793af95Ssangeeta margs.ift_flags = flags; 183c793af95Ssangeeta 184c793af95Ssangeeta /* 185c793af95Ssangeeta * The flags argument passed to ire_ftable_lookup may cause the 186c793af95Ssangeeta * search to return, not the longest matching prefix, but the 187c793af95Ssangeeta * "best matching prefix", i.e., the longest prefix that also 188c793af95Ssangeeta * satisfies constraints imposed via the permutation of flags 189c793af95Ssangeeta * passed in. To achieve this, we invoke ire_match_args() on 190c793af95Ssangeeta * each matching leaf in the radix tree. ire_match_args is 191c793af95Ssangeeta * invoked by the callback function ire_find_best_route() 192c793af95Ssangeeta * We hold the global tree lock in read mode when calling 193c793af95Ssangeeta * rn_match_args.Before dropping the global tree lock, ensure 194c793af95Ssangeeta * that the radix node can't be deleted by incrementing ire_refcnt. 195c793af95Ssangeeta */ 196*f4b3ec61Sdh155122 RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 197*f4b3ec61Sdh155122 rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst, 198*f4b3ec61Sdh155122 ipst->ips_ip_ftable, ire_find_best_route, &margs); 199c793af95Ssangeeta ire = margs.ift_best_ire; 200*f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 201c793af95Ssangeeta 202c793af95Ssangeeta if (rt == NULL) { 203c793af95Ssangeeta return (NULL); 204c793af95Ssangeeta } else { 205c793af95Ssangeeta ASSERT(ire != NULL); 206c793af95Ssangeeta } 207c793af95Ssangeeta 208c793af95Ssangeeta DTRACE_PROBE2(ire__found, ire_ftable_args_t *, &margs, ire_t *, ire); 209c793af95Ssangeeta 210c793af95Ssangeeta if (!IS_DEFAULT_ROUTE(ire)) 211c793af95Ssangeeta goto found_ire_held; 212c793af95Ssangeeta /* 213c793af95Ssangeeta * If default route is found, see if default matching criteria 214c793af95Ssangeeta * are satisfied. 215c793af95Ssangeeta */ 216c793af95Ssangeeta if (flags & MATCH_IRE_MASK) { 217c793af95Ssangeeta /* 218c793af95Ssangeeta * we were asked to match a 0 mask, and came back with 219c793af95Ssangeeta * a default route. Ok to return it. 220c793af95Ssangeeta */ 221c793af95Ssangeeta goto found_default_ire; 222c793af95Ssangeeta } 223c793af95Ssangeeta if ((flags & MATCH_IRE_TYPE) && 224c793af95Ssangeeta (type & (IRE_DEFAULT | IRE_INTERFACE))) { 225c793af95Ssangeeta /* 226c793af95Ssangeeta * we were asked to match a default ire type. Ok to return it. 227c793af95Ssangeeta */ 228c793af95Ssangeeta goto found_default_ire; 229c793af95Ssangeeta } 230c793af95Ssangeeta if (flags & MATCH_IRE_DEFAULT) { 231c793af95Ssangeeta goto found_default_ire; 232c793af95Ssangeeta } 233c793af95Ssangeeta /* 234c793af95Ssangeeta * we found a default route, but default matching criteria 235c793af95Ssangeeta * are not specified and we are not explicitly looking for 236c793af95Ssangeeta * default. 237c793af95Ssangeeta */ 238c793af95Ssangeeta IRE_REFRELE(ire); 239c793af95Ssangeeta return (NULL); 240c793af95Ssangeeta found_default_ire: 241c793af95Ssangeeta /* 242c793af95Ssangeeta * round-robin only if we have more than one route in the bucket. 243c793af95Ssangeeta */ 244c793af95Ssangeeta if ((ire->ire_bucket->irb_ire_cnt > 1) && 245c793af95Ssangeeta IS_DEFAULT_ROUTE(ire) && 246c793af95Ssangeeta ((flags & (MATCH_IRE_DEFAULT | MATCH_IRE_MASK)) == 247c793af95Ssangeeta MATCH_IRE_DEFAULT)) { 248c793af95Ssangeeta ire_t *next_ire; 249c793af95Ssangeeta 250*f4b3ec61Sdh155122 next_ire = ire_round_robin(ire->ire_bucket, zoneid, &margs, 251*f4b3ec61Sdh155122 ipst); 252c793af95Ssangeeta IRE_REFRELE(ire); 253c793af95Ssangeeta if (next_ire != NULL) { 254c793af95Ssangeeta ire = next_ire; 255c793af95Ssangeeta } else { 256c793af95Ssangeeta /* no route */ 257c793af95Ssangeeta return (NULL); 258c793af95Ssangeeta } 259c793af95Ssangeeta } 260c793af95Ssangeeta found_ire_held: 261c793af95Ssangeeta ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL); 262c793af95Ssangeeta if ((flags & MATCH_IRE_RJ_BHOLE) && 263c793af95Ssangeeta (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) { 264c793af95Ssangeeta return (ire); 265c793af95Ssangeeta } 266c793af95Ssangeeta /* 267c793af95Ssangeeta * At this point, IRE that was found must be an IRE_FORWARDTABLE 268c793af95Ssangeeta * type. If this is a recursive lookup and an IRE_INTERFACE type was 269c793af95Ssangeeta * found, return that. If it was some other IRE_FORWARDTABLE type of 270c793af95Ssangeeta * IRE (one of the prefix types), then it is necessary to fill in the 271c793af95Ssangeeta * parent IRE pointed to by pire, and then lookup the gateway address of 272c793af95Ssangeeta * the parent. For backwards compatiblity, if this lookup returns an 273c793af95Ssangeeta * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level 274c793af95Ssangeeta * of lookup is done. 275c793af95Ssangeeta */ 276c793af95Ssangeeta if (flags & MATCH_IRE_RECURSIVE) { 277c793af95Ssangeeta ipif_t *gw_ipif; 278c793af95Ssangeeta int match_flags = MATCH_IRE_DSTONLY; 279c793af95Ssangeeta ire_t *save_ire; 280c793af95Ssangeeta 281c793af95Ssangeeta if (ire->ire_type & IRE_INTERFACE) 282c793af95Ssangeeta return (ire); 283c793af95Ssangeeta if (pire != NULL) 284c793af95Ssangeeta *pire = ire; 285c793af95Ssangeeta /* 286c793af95Ssangeeta * If we can't find an IRE_INTERFACE or the caller has not 287c793af95Ssangeeta * asked for pire, we need to REFRELE the save_ire. 288c793af95Ssangeeta */ 289c793af95Ssangeeta save_ire = ire; 290c793af95Ssangeeta 291c793af95Ssangeeta /* 292c793af95Ssangeeta * Currently MATCH_IRE_ILL is never used with 293c793af95Ssangeeta * (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT) while 294c793af95Ssangeeta * sending out packets as MATCH_IRE_ILL is used only 295c793af95Ssangeeta * for communicating with on-link hosts. We can't assert 296c793af95Ssangeeta * that here as RTM_GET calls this function with 297c793af95Ssangeeta * MATCH_IRE_ILL | MATCH_IRE_DEFAULT | MATCH_IRE_RECURSIVE. 298c793af95Ssangeeta * We have already used the MATCH_IRE_ILL in determining 299c793af95Ssangeeta * the right prefix route at this point. To match the 300c793af95Ssangeeta * behavior of how we locate routes while sending out 301c793af95Ssangeeta * packets, we don't want to use MATCH_IRE_ILL below 302c793af95Ssangeeta * while locating the interface route. 303c793af95Ssangeeta * 304c793af95Ssangeeta * ire_ftable_lookup may end up with an incomplete IRE_CACHE 305c793af95Ssangeeta * entry for the gateway (i.e., one for which the 306c793af95Ssangeeta * ire_nce->nce_state is not yet ND_REACHABLE). If the caller 307c793af95Ssangeeta * has specified MATCH_IRE_COMPLETE, such entries will not 308c793af95Ssangeeta * be returned; instead, we return the IF_RESOLVER ire. 309c793af95Ssangeeta */ 310c793af95Ssangeeta if (ire->ire_ipif != NULL) 311c793af95Ssangeeta match_flags |= MATCH_IRE_ILL_GROUP; 312c793af95Ssangeeta 313c793af95Ssangeeta ire = ire_route_lookup(ire->ire_gateway_addr, 0, 0, 0, 314*f4b3ec61Sdh155122 ire->ire_ipif, NULL, zoneid, tsl, match_flags, ipst); 315c793af95Ssangeeta DTRACE_PROBE2(ftable__route__lookup1, (ire_t *), ire, 316c793af95Ssangeeta (ire_t *), save_ire); 317c793af95Ssangeeta if (ire == NULL || 318c793af95Ssangeeta ((ire->ire_type & IRE_CACHE) && ire->ire_nce && 319c793af95Ssangeeta ire->ire_nce->nce_state != ND_REACHABLE && 320c793af95Ssangeeta (flags & MATCH_IRE_COMPLETE))) { 321c793af95Ssangeeta /* 322c793af95Ssangeeta * Do not release the parent ire if MATCH_IRE_PARENT 323c793af95Ssangeeta * is set. Also return it via ire. 324c793af95Ssangeeta */ 325c793af95Ssangeeta if (ire != NULL) { 326c793af95Ssangeeta ire_refrele(ire); 327c793af95Ssangeeta ire = NULL; 328c793af95Ssangeeta found_incomplete = B_TRUE; 329c793af95Ssangeeta } 330c793af95Ssangeeta if (flags & MATCH_IRE_PARENT) { 331c793af95Ssangeeta if (pire != NULL) { 332c793af95Ssangeeta /* 333c793af95Ssangeeta * Need an extra REFHOLD, if the parent 334c793af95Ssangeeta * ire is returned via both ire and 335c793af95Ssangeeta * pire. 336c793af95Ssangeeta */ 337c793af95Ssangeeta IRE_REFHOLD(save_ire); 338c793af95Ssangeeta } 339c793af95Ssangeeta ire = save_ire; 340c793af95Ssangeeta } else { 341c793af95Ssangeeta ire_refrele(save_ire); 342c793af95Ssangeeta if (pire != NULL) 343c793af95Ssangeeta *pire = NULL; 344c793af95Ssangeeta } 345c793af95Ssangeeta if (!found_incomplete) 346c793af95Ssangeeta return (ire); 347c793af95Ssangeeta } 348c793af95Ssangeeta if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) { 349c793af95Ssangeeta /* 350c793af95Ssangeeta * If the caller did not ask for pire, release 351c793af95Ssangeeta * it now. 352c793af95Ssangeeta */ 353c793af95Ssangeeta if (pire == NULL) { 354c793af95Ssangeeta ire_refrele(save_ire); 355c793af95Ssangeeta } 356c793af95Ssangeeta return (ire); 357c793af95Ssangeeta } 358c793af95Ssangeeta match_flags |= MATCH_IRE_TYPE; 359c793af95Ssangeeta gw_addr = ire->ire_gateway_addr; 360c793af95Ssangeeta gw_ipif = ire->ire_ipif; 361c793af95Ssangeeta ire_refrele(ire); 362c793af95Ssangeeta ire = ire_route_lookup(gw_addr, 0, 0, 363c793af95Ssangeeta (found_incomplete? IRE_INTERFACE : 364c793af95Ssangeeta (IRE_CACHETABLE | IRE_INTERFACE)), 365*f4b3ec61Sdh155122 gw_ipif, NULL, zoneid, tsl, match_flags, ipst); 366c793af95Ssangeeta DTRACE_PROBE2(ftable__route__lookup2, (ire_t *), ire, 367c793af95Ssangeeta (ire_t *), save_ire); 368c793af95Ssangeeta if (ire == NULL || 369c793af95Ssangeeta ((ire->ire_type & IRE_CACHE) && ire->ire_nce && 370c793af95Ssangeeta ire->ire_nce->nce_state != ND_REACHABLE && 371c793af95Ssangeeta (flags & MATCH_IRE_COMPLETE))) { 372c793af95Ssangeeta /* 373c793af95Ssangeeta * Do not release the parent ire if MATCH_IRE_PARENT 374c793af95Ssangeeta * is set. Also return it via ire. 375c793af95Ssangeeta */ 376c793af95Ssangeeta if (ire != NULL) { 377c793af95Ssangeeta ire_refrele(ire); 378c793af95Ssangeeta ire = NULL; 379c793af95Ssangeeta } 380c793af95Ssangeeta if (flags & MATCH_IRE_PARENT) { 381c793af95Ssangeeta if (pire != NULL) { 382c793af95Ssangeeta /* 383c793af95Ssangeeta * Need an extra REFHOLD, if the 384c793af95Ssangeeta * parent ire is returned via both 385c793af95Ssangeeta * ire and pire. 386c793af95Ssangeeta */ 387c793af95Ssangeeta IRE_REFHOLD(save_ire); 388c793af95Ssangeeta } 389c793af95Ssangeeta ire = save_ire; 390c793af95Ssangeeta } else { 391c793af95Ssangeeta ire_refrele(save_ire); 392c793af95Ssangeeta if (pire != NULL) 393c793af95Ssangeeta *pire = NULL; 394c793af95Ssangeeta } 395c793af95Ssangeeta return (ire); 396c793af95Ssangeeta } else if (pire == NULL) { 397c793af95Ssangeeta /* 398c793af95Ssangeeta * If the caller did not ask for pire, release 399c793af95Ssangeeta * it now. 400c793af95Ssangeeta */ 401c793af95Ssangeeta ire_refrele(save_ire); 402c793af95Ssangeeta } 403c793af95Ssangeeta return (ire); 404c793af95Ssangeeta } 405c793af95Ssangeeta ASSERT(pire == NULL || *pire == NULL); 406c793af95Ssangeeta return (ire); 407c793af95Ssangeeta } 408c793af95Ssangeeta 409c793af95Ssangeeta 410c793af95Ssangeeta /* 411c793af95Ssangeeta * Find an IRE_OFFSUBNET IRE entry for the multicast address 'group' 412c793af95Ssangeeta * that goes through 'ipif'. As a fallback, a route that goes through 413c793af95Ssangeeta * ipif->ipif_ill can be returned. 414c793af95Ssangeeta */ 415c793af95Ssangeeta ire_t * 416c793af95Ssangeeta ipif_lookup_multi_ire(ipif_t *ipif, ipaddr_t group) 417c793af95Ssangeeta { 418c793af95Ssangeeta ire_t *ire; 419c793af95Ssangeeta ire_t *save_ire = NULL; 420c793af95Ssangeeta ire_t *gw_ire; 421c793af95Ssangeeta irb_t *irb; 422c793af95Ssangeeta ipaddr_t gw_addr; 423c793af95Ssangeeta int match_flags = MATCH_IRE_TYPE | MATCH_IRE_ILL; 424*f4b3ec61Sdh155122 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 425c793af95Ssangeeta 426c793af95Ssangeeta ASSERT(CLASSD(group)); 427c793af95Ssangeeta 428c793af95Ssangeeta ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, ALL_ZONES, 0, 429*f4b3ec61Sdh155122 NULL, MATCH_IRE_DEFAULT, ipst); 430c793af95Ssangeeta 431c793af95Ssangeeta if (ire == NULL) 432c793af95Ssangeeta return (NULL); 433c793af95Ssangeeta 434c793af95Ssangeeta irb = ire->ire_bucket; 435c793af95Ssangeeta ASSERT(irb); 436c793af95Ssangeeta 437c793af95Ssangeeta IRB_REFHOLD(irb); 438c793af95Ssangeeta ire_refrele(ire); 439c793af95Ssangeeta for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 440c793af95Ssangeeta if (ire->ire_addr != group || 441c793af95Ssangeeta ipif->ipif_zoneid != ire->ire_zoneid && 442c793af95Ssangeeta ire->ire_zoneid != ALL_ZONES) { 443c793af95Ssangeeta continue; 444c793af95Ssangeeta } 445c793af95Ssangeeta 446c793af95Ssangeeta switch (ire->ire_type) { 447c793af95Ssangeeta case IRE_DEFAULT: 448c793af95Ssangeeta case IRE_PREFIX: 449c793af95Ssangeeta case IRE_HOST: 450c793af95Ssangeeta gw_addr = ire->ire_gateway_addr; 451c793af95Ssangeeta gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, 452*f4b3ec61Sdh155122 ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 453c793af95Ssangeeta 454c793af95Ssangeeta if (gw_ire != NULL) { 455c793af95Ssangeeta if (save_ire != NULL) { 456c793af95Ssangeeta ire_refrele(save_ire); 457c793af95Ssangeeta } 458c793af95Ssangeeta IRE_REFHOLD(ire); 459c793af95Ssangeeta if (gw_ire->ire_ipif == ipif) { 460c793af95Ssangeeta ire_refrele(gw_ire); 461c793af95Ssangeeta 462c793af95Ssangeeta IRB_REFRELE(irb); 463c793af95Ssangeeta return (ire); 464c793af95Ssangeeta } 465c793af95Ssangeeta ire_refrele(gw_ire); 466c793af95Ssangeeta save_ire = ire; 467c793af95Ssangeeta } 468c793af95Ssangeeta break; 469c793af95Ssangeeta case IRE_IF_NORESOLVER: 470c793af95Ssangeeta case IRE_IF_RESOLVER: 471c793af95Ssangeeta if (ire->ire_ipif == ipif) { 472c793af95Ssangeeta if (save_ire != NULL) { 473c793af95Ssangeeta ire_refrele(save_ire); 474c793af95Ssangeeta } 475c793af95Ssangeeta IRE_REFHOLD(ire); 476c793af95Ssangeeta 477c793af95Ssangeeta IRB_REFRELE(irb); 478c793af95Ssangeeta return (ire); 479c793af95Ssangeeta } 480c793af95Ssangeeta break; 481c793af95Ssangeeta } 482c793af95Ssangeeta } 483c793af95Ssangeeta IRB_REFRELE(irb); 484c793af95Ssangeeta 485c793af95Ssangeeta return (save_ire); 486c793af95Ssangeeta } 487c793af95Ssangeeta 488c793af95Ssangeeta /* 489c793af95Ssangeeta * Find an IRE_INTERFACE for the multicast group. 490c793af95Ssangeeta * Allows different routes for multicast addresses 491c793af95Ssangeeta * in the unicast routing table (akin to 224.0.0.0 but could be more specific) 492c793af95Ssangeeta * which point at different interfaces. This is used when IP_MULTICAST_IF 493c793af95Ssangeeta * isn't specified (when sending) and when IP_ADD_MEMBERSHIP doesn't 494c793af95Ssangeeta * specify the interface to join on. 495c793af95Ssangeeta * 496c793af95Ssangeeta * Supports IP_BOUND_IF by following the ipif/ill when recursing. 497c793af95Ssangeeta */ 498c793af95Ssangeeta ire_t * 499*f4b3ec61Sdh155122 ire_lookup_multi(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst) 500c793af95Ssangeeta { 501c793af95Ssangeeta ire_t *ire; 502c793af95Ssangeeta ipif_t *ipif = NULL; 503c793af95Ssangeeta int match_flags = MATCH_IRE_TYPE; 504c793af95Ssangeeta ipaddr_t gw_addr; 505c793af95Ssangeeta 506c793af95Ssangeeta ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, zoneid, 507*f4b3ec61Sdh155122 0, NULL, MATCH_IRE_DEFAULT, ipst); 508c793af95Ssangeeta 509c793af95Ssangeeta /* We search a resolvable ire in case of multirouting. */ 510c793af95Ssangeeta if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) { 511c793af95Ssangeeta ire_t *cire = NULL; 512c793af95Ssangeeta /* 513c793af95Ssangeeta * If the route is not resolvable, the looked up ire 514c793af95Ssangeeta * may be changed here. In that case, ire_multirt_lookup() 515c793af95Ssangeeta * IRE_REFRELE the original ire and change it. 516c793af95Ssangeeta */ 517*f4b3ec61Sdh155122 (void) ire_multirt_lookup(&cire, &ire, MULTIRT_CACHEGW, 518*f4b3ec61Sdh155122 NULL, ipst); 519c793af95Ssangeeta if (cire != NULL) 520c793af95Ssangeeta ire_refrele(cire); 521c793af95Ssangeeta } 522c793af95Ssangeeta if (ire == NULL) 523c793af95Ssangeeta return (NULL); 524c793af95Ssangeeta /* 525c793af95Ssangeeta * Make sure we follow ire_ipif. 526c793af95Ssangeeta * 527c793af95Ssangeeta * We need to determine the interface route through 528c793af95Ssangeeta * which the gateway will be reached. We don't really 529c793af95Ssangeeta * care which interface is picked if the interface is 530c793af95Ssangeeta * part of a group. 531c793af95Ssangeeta */ 532c793af95Ssangeeta if (ire->ire_ipif != NULL) { 533c793af95Ssangeeta ipif = ire->ire_ipif; 534c793af95Ssangeeta match_flags |= MATCH_IRE_ILL_GROUP; 535c793af95Ssangeeta } 536c793af95Ssangeeta 537c793af95Ssangeeta switch (ire->ire_type) { 538c793af95Ssangeeta case IRE_DEFAULT: 539c793af95Ssangeeta case IRE_PREFIX: 540c793af95Ssangeeta case IRE_HOST: 541c793af95Ssangeeta gw_addr = ire->ire_gateway_addr; 542c793af95Ssangeeta ire_refrele(ire); 543c793af95Ssangeeta ire = ire_ftable_lookup(gw_addr, 0, 0, 544c793af95Ssangeeta IRE_INTERFACE, ipif, NULL, zoneid, 0, 545*f4b3ec61Sdh155122 NULL, match_flags, ipst); 546c793af95Ssangeeta return (ire); 547c793af95Ssangeeta case IRE_IF_NORESOLVER: 548c793af95Ssangeeta case IRE_IF_RESOLVER: 549c793af95Ssangeeta return (ire); 550c793af95Ssangeeta default: 551c793af95Ssangeeta ire_refrele(ire); 552c793af95Ssangeeta return (NULL); 553c793af95Ssangeeta } 554c793af95Ssangeeta } 555c793af95Ssangeeta 556c793af95Ssangeeta /* 557c793af95Ssangeeta * Delete the passed in ire if the gateway addr matches 558c793af95Ssangeeta */ 559c793af95Ssangeeta void 560c793af95Ssangeeta ire_del_host_redir(ire_t *ire, char *gateway) 561c793af95Ssangeeta { 5626bdb8e66Sdd193516 if ((ire->ire_flags & RTF_DYNAMIC) && 563c793af95Ssangeeta (ire->ire_gateway_addr == *(ipaddr_t *)gateway)) 564c793af95Ssangeeta ire_delete(ire); 565c793af95Ssangeeta } 566c793af95Ssangeeta 567c793af95Ssangeeta /* 568c793af95Ssangeeta * Search for all HOST REDIRECT routes that are 569c793af95Ssangeeta * pointing at the specified gateway and 570c793af95Ssangeeta * delete them. This routine is called only 571c793af95Ssangeeta * when a default gateway is going away. 572c793af95Ssangeeta */ 573c793af95Ssangeeta void 574*f4b3ec61Sdh155122 ire_delete_host_redirects(ipaddr_t gateway, ip_stack_t *ipst) 575c793af95Ssangeeta { 576c793af95Ssangeeta struct rtfuncarg rtfarg; 577c793af95Ssangeeta 578c793af95Ssangeeta (void) memset(&rtfarg, 0, sizeof (rtfarg)); 579c793af95Ssangeeta rtfarg.rt_func = ire_del_host_redir; 580c793af95Ssangeeta rtfarg.rt_arg = (void *)&gateway; 581*f4b3ec61Sdh155122 (void) ipst->ips_ip_ftable->rnh_walktree_mt(ipst->ips_ip_ftable, 582*f4b3ec61Sdh155122 rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn); 583c793af95Ssangeeta } 584c793af95Ssangeeta 585c793af95Ssangeeta struct ihandle_arg { 586c793af95Ssangeeta uint32_t ihandle; 587c793af95Ssangeeta ire_t *ire; 588c793af95Ssangeeta }; 589c793af95Ssangeeta 590c793af95Ssangeeta static int 591c793af95Ssangeeta ire_ihandle_onlink_match(struct radix_node *rn, void *arg) 592c793af95Ssangeeta { 593c793af95Ssangeeta struct rt_entry *rt; 594c793af95Ssangeeta irb_t *irb; 595c793af95Ssangeeta ire_t *ire; 596c793af95Ssangeeta struct ihandle_arg *ih = arg; 597c793af95Ssangeeta 598c793af95Ssangeeta rt = (struct rt_entry *)rn; 599c793af95Ssangeeta ASSERT(rt != NULL); 600c793af95Ssangeeta irb = &rt->rt_irb; 601c793af95Ssangeeta for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 602c793af95Ssangeeta if ((ire->ire_type & IRE_INTERFACE) && 603c793af95Ssangeeta (ire->ire_ihandle == ih->ihandle)) { 604c793af95Ssangeeta ih->ire = ire; 605c793af95Ssangeeta IRE_REFHOLD(ire); 606c793af95Ssangeeta return (1); 607c793af95Ssangeeta } 608c793af95Ssangeeta } 609c793af95Ssangeeta return (0); 610c793af95Ssangeeta } 611c793af95Ssangeeta 612c793af95Ssangeeta /* 613c793af95Ssangeeta * Locate the interface ire that is tied to the cache ire 'cire' via 614c793af95Ssangeeta * cire->ire_ihandle. 615c793af95Ssangeeta * 616c793af95Ssangeeta * We are trying to create the cache ire for an onlink destn. or 617c793af95Ssangeeta * gateway in 'cire'. We are called from ire_add_v4() in the IRE_IF_RESOLVER 618c793af95Ssangeeta * case, after the ire has come back from ARP. 619c793af95Ssangeeta */ 620c793af95Ssangeeta ire_t * 621c793af95Ssangeeta ire_ihandle_lookup_onlink(ire_t *cire) 622c793af95Ssangeeta { 623c793af95Ssangeeta ire_t *ire; 624c793af95Ssangeeta int match_flags; 625c793af95Ssangeeta struct ihandle_arg ih; 626*f4b3ec61Sdh155122 ip_stack_t *ipst; 627c793af95Ssangeeta 628c793af95Ssangeeta ASSERT(cire != NULL); 629*f4b3ec61Sdh155122 ipst = cire->ire_ipst; 630c793af95Ssangeeta 631c793af95Ssangeeta /* 632c793af95Ssangeeta * We don't need to specify the zoneid to ire_ftable_lookup() below 633c793af95Ssangeeta * because the ihandle refers to an ipif which can be in only one zone. 634c793af95Ssangeeta */ 635c793af95Ssangeeta match_flags = MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK; 636c793af95Ssangeeta /* 637c793af95Ssangeeta * We know that the mask of the interface ire equals cire->ire_cmask. 638c793af95Ssangeeta * (When ip_newroute() created 'cire' for an on-link destn. it set its 639c793af95Ssangeeta * cmask from the interface ire's mask) 640c793af95Ssangeeta */ 641c793af95Ssangeeta ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0, 642c793af95Ssangeeta IRE_INTERFACE, NULL, NULL, ALL_ZONES, cire->ire_ihandle, 643*f4b3ec61Sdh155122 NULL, match_flags, ipst); 644c793af95Ssangeeta if (ire != NULL) 645c793af95Ssangeeta return (ire); 646c793af95Ssangeeta /* 647c793af95Ssangeeta * If we didn't find an interface ire above, we can't declare failure. 648c793af95Ssangeeta * For backwards compatibility, we need to support prefix routes 649c793af95Ssangeeta * pointing to next hop gateways that are not on-link. 650c793af95Ssangeeta * 651c793af95Ssangeeta * In the resolver/noresolver case, ip_newroute() thinks it is creating 652c793af95Ssangeeta * the cache ire for an onlink destination in 'cire'. But 'cire' is 653c793af95Ssangeeta * not actually onlink, because ire_ftable_lookup() cheated it, by 654c793af95Ssangeeta * doing ire_route_lookup() twice and returning an interface ire. 655c793af95Ssangeeta * 656c793af95Ssangeeta * Eg. default - gw1 (line 1) 657c793af95Ssangeeta * gw1 - gw2 (line 2) 658c793af95Ssangeeta * gw2 - hme0 (line 3) 659c793af95Ssangeeta * 660c793af95Ssangeeta * In the above example, ip_newroute() tried to create the cache ire 661c793af95Ssangeeta * 'cire' for gw1, based on the interface route in line 3. The 662c793af95Ssangeeta * ire_ftable_lookup() above fails, because there is no interface route 663c793af95Ssangeeta * to reach gw1. (it is gw2). We fall thru below. 664c793af95Ssangeeta * 665c793af95Ssangeeta * Do a brute force search based on the ihandle in a subset of the 666c793af95Ssangeeta * forwarding tables, corresponding to cire->ire_cmask. Otherwise 667c793af95Ssangeeta * things become very complex, since we don't have 'pire' in this 668c793af95Ssangeeta * case. (Also note that this method is not possible in the offlink 669c793af95Ssangeeta * case because we don't know the mask) 670c793af95Ssangeeta */ 671c793af95Ssangeeta (void) memset(&ih, 0, sizeof (ih)); 672c793af95Ssangeeta ih.ihandle = cire->ire_ihandle; 673*f4b3ec61Sdh155122 (void) ipst->ips_ip_ftable->rnh_walktree_mt(ipst->ips_ip_ftable, 674*f4b3ec61Sdh155122 ire_ihandle_onlink_match, &ih, irb_refhold_rn, irb_refrele_rn); 675c793af95Ssangeeta return (ih.ire); 676c793af95Ssangeeta } 677c793af95Ssangeeta 678c793af95Ssangeeta /* 679c793af95Ssangeeta * IRE iterator used by ire_ftable_lookup[_v6]() to process multiple default 680c793af95Ssangeeta * routes. Given a starting point in the hash list (ire_origin), walk the IREs 681c793af95Ssangeeta * in the bucket skipping default interface routes and deleted entries. 682c793af95Ssangeeta * Returns the next IRE (unheld), or NULL when we're back to the starting point. 683c793af95Ssangeeta * Assumes that the caller holds a reference on the IRE bucket. 684c793af95Ssangeeta */ 685c793af95Ssangeeta ire_t * 686c793af95Ssangeeta ire_get_next_default_ire(ire_t *ire, ire_t *ire_origin) 687c793af95Ssangeeta { 688c793af95Ssangeeta ASSERT(ire_origin->ire_bucket != NULL); 689c793af95Ssangeeta ASSERT(ire != NULL); 690c793af95Ssangeeta 691c793af95Ssangeeta do { 692c793af95Ssangeeta ire = ire->ire_next; 693c793af95Ssangeeta if (ire == NULL) 694c793af95Ssangeeta ire = ire_origin->ire_bucket->irb_ire; 695c793af95Ssangeeta if (ire == ire_origin) 696c793af95Ssangeeta return (NULL); 697c793af95Ssangeeta } while ((ire->ire_type & IRE_INTERFACE) || 698c793af95Ssangeeta (ire->ire_marks & IRE_MARK_CONDEMNED)); 699c793af95Ssangeeta ASSERT(ire != NULL); 700c793af95Ssangeeta return (ire); 701c793af95Ssangeeta } 702c793af95Ssangeeta 703c793af95Ssangeeta static ipif_t * 704c793af95Ssangeeta ire_forward_src_ipif(ipaddr_t dst, ire_t *sire, ire_t *ire, ill_t *dst_ill, 705c793af95Ssangeeta int zoneid, ushort_t *marks) 706c793af95Ssangeeta { 707c793af95Ssangeeta ipif_t *src_ipif; 708*f4b3ec61Sdh155122 ip_stack_t *ipst = dst_ill->ill_ipst; 709c793af95Ssangeeta 710c793af95Ssangeeta /* 711c793af95Ssangeeta * Pick the best source address from dst_ill. 712c793af95Ssangeeta * 713c793af95Ssangeeta * 1) If it is part of a multipathing group, we would 714c793af95Ssangeeta * like to spread the inbound packets across different 715c793af95Ssangeeta * interfaces. ipif_select_source picks a random source 716c793af95Ssangeeta * across the different ills in the group. 717c793af95Ssangeeta * 718c793af95Ssangeeta * 2) If it is not part of a multipathing group, we try 719c793af95Ssangeeta * to pick the source address from the destination 720c793af95Ssangeeta * route. Clustering assumes that when we have multiple 721c793af95Ssangeeta * prefixes hosted on an interface, the prefix of the 722c793af95Ssangeeta * source address matches the prefix of the destination 723c793af95Ssangeeta * route. We do this only if the address is not 724c793af95Ssangeeta * DEPRECATED. 725c793af95Ssangeeta * 726c793af95Ssangeeta * 3) If the conn is in a different zone than the ire, we 727c793af95Ssangeeta * need to pick a source address from the right zone. 728c793af95Ssangeeta * 729c793af95Ssangeeta * NOTE : If we hit case (1) above, the prefix of the source 730c793af95Ssangeeta * address picked may not match the prefix of the 731c793af95Ssangeeta * destination routes prefix as ipif_select_source 732c793af95Ssangeeta * does not look at "dst" while picking a source 733c793af95Ssangeeta * address. 734c793af95Ssangeeta * If we want the same behavior as (2), we will need 735c793af95Ssangeeta * to change the behavior of ipif_select_source. 736c793af95Ssangeeta */ 737c793af95Ssangeeta 738c793af95Ssangeeta if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) { 739c793af95Ssangeeta /* 740c793af95Ssangeeta * The RTF_SETSRC flag is set in the parent ire (sire). 741c793af95Ssangeeta * Check that the ipif matching the requested source 742c793af95Ssangeeta * address still exists. 743c793af95Ssangeeta */ 744c793af95Ssangeeta src_ipif = ipif_lookup_addr(sire->ire_src_addr, NULL, 745*f4b3ec61Sdh155122 zoneid, NULL, NULL, NULL, NULL, ipst); 746c793af95Ssangeeta return (src_ipif); 747c793af95Ssangeeta } 748c793af95Ssangeeta *marks |= IRE_MARK_USESRC_CHECK; 749c793af95Ssangeeta if ((dst_ill->ill_group != NULL) || 750c793af95Ssangeeta (ire->ire_ipif->ipif_flags & IPIF_DEPRECATED) || 751c793af95Ssangeeta (dst_ill->ill_usesrc_ifindex != 0)) { 752c793af95Ssangeeta src_ipif = ipif_select_source(dst_ill, dst, zoneid); 753c793af95Ssangeeta if (src_ipif == NULL) 754c793af95Ssangeeta return (NULL); 755c793af95Ssangeeta 756c793af95Ssangeeta } else { 757c793af95Ssangeeta src_ipif = ire->ire_ipif; 758c793af95Ssangeeta ASSERT(src_ipif != NULL); 759c793af95Ssangeeta /* hold src_ipif for uniformity */ 760c793af95Ssangeeta ipif_refhold(src_ipif); 761c793af95Ssangeeta } 762c793af95Ssangeeta return (src_ipif); 763c793af95Ssangeeta } 764c793af95Ssangeeta 765c793af95Ssangeeta /* 766c793af95Ssangeeta * This function is called by ip_rput_noire() and ip_fast_forward() 767c793af95Ssangeeta * to resolve the route of incoming packet that needs to be forwarded. 768c793af95Ssangeeta * If the ire of the nexthop is not already in the cachetable, this 769c793af95Ssangeeta * routine will insert it to the table, but won't trigger ARP resolution yet. 770c793af95Ssangeeta * Thus unlike ip_newroute, this function adds incomplete ires to 771c793af95Ssangeeta * the cachetable. ARP resolution for these ires are delayed until 772c793af95Ssangeeta * after all of the packet processing is completed and its ready to 773c793af95Ssangeeta * be sent out on the wire, Eventually, the packet transmit routine 774c793af95Ssangeeta * ip_xmit_v4() attempts to send a packet to the driver. If it finds 775c793af95Ssangeeta * that there is no link layer information, it will do the arp 776c793af95Ssangeeta * resolution and queue the packet in ire->ire_nce->nce_qd_mp and 777c793af95Ssangeeta * then send it out once the arp resolution is over 778c793af95Ssangeeta * (see ip_xmit_v4()->ire_arpresolve()). This scheme is similar to 779c793af95Ssangeeta * the model of BSD/SunOS 4 780c793af95Ssangeeta * 781c793af95Ssangeeta * In future, the insertion of incomplete ires in the cachetable should 782c793af95Ssangeeta * be implemented in hostpath as well, as doing so will greatly reduce 783c793af95Ssangeeta * the existing complexity for code paths that depend on the context of 784c793af95Ssangeeta * the sender (such as IPsec). 785c793af95Ssangeeta * 786c793af95Ssangeeta * Thus this scheme of adding incomplete ires in cachetable in forwarding 787c793af95Ssangeeta * path can be used as a template for simplifying the hostpath. 788c793af95Ssangeeta */ 789c793af95Ssangeeta 790c793af95Ssangeeta ire_t * 791c793af95Ssangeeta ire_forward(ipaddr_t dst, boolean_t *check_multirt, ire_t *supplied_ire, 792*f4b3ec61Sdh155122 ire_t *supplied_sire, const struct ts_label_s *tsl, ip_stack_t *ipst) 793c793af95Ssangeeta { 794c793af95Ssangeeta ipaddr_t gw = 0; 795c793af95Ssangeeta ire_t *ire = NULL; 796c793af95Ssangeeta ire_t *sire = NULL, *save_ire; 797c793af95Ssangeeta ill_t *dst_ill = NULL; 798c793af95Ssangeeta int error; 799c793af95Ssangeeta zoneid_t zoneid; 800c793af95Ssangeeta ipif_t *src_ipif = NULL; 801c793af95Ssangeeta mblk_t *res_mp; 802c793af95Ssangeeta ushort_t ire_marks = 0; 803c793af95Ssangeeta tsol_gcgrp_t *gcgrp = NULL; 804c793af95Ssangeeta tsol_gcgrp_addr_t ga; 805c793af95Ssangeeta 806c793af95Ssangeeta zoneid = GLOBAL_ZONEID; 807c793af95Ssangeeta 808c793af95Ssangeeta if (supplied_ire != NULL) { 809c793af95Ssangeeta /* We have arrived here from ipfil_sendpkt */ 810c793af95Ssangeeta ire = supplied_ire; 811c793af95Ssangeeta sire = supplied_sire; 812c793af95Ssangeeta goto create_irecache; 813c793af95Ssangeeta } 814c793af95Ssangeeta 815c793af95Ssangeeta ire = ire_ftable_lookup(dst, 0, 0, 0, NULL, &sire, zoneid, 0, 816c793af95Ssangeeta tsl, MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | 817*f4b3ec61Sdh155122 MATCH_IRE_RJ_BHOLE | MATCH_IRE_PARENT|MATCH_IRE_SECATTR, ipst); 818c793af95Ssangeeta 819c793af95Ssangeeta if (ire == NULL) { 820*f4b3ec61Sdh155122 ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0, RTA_DST, ipst); 821c793af95Ssangeeta goto icmp_err_ret; 822c793af95Ssangeeta } 823c793af95Ssangeeta 824c793af95Ssangeeta /* 825c793af95Ssangeeta * If we encounter CGTP, we should have the caller use 826c793af95Ssangeeta * ip_newroute to resolve multirt instead of this function. 827c793af95Ssangeeta * CGTP specs explicitly state that it can't be used with routers. 828c793af95Ssangeeta * This essentially prevents insertion of incomplete RTF_MULTIRT 829c793af95Ssangeeta * ires in cachetable. 830c793af95Ssangeeta */ 831c793af95Ssangeeta if (ip_cgtp_filter && 832c793af95Ssangeeta ((ire->ire_flags & RTF_MULTIRT) || 833c793af95Ssangeeta ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) { 834c793af95Ssangeeta ip3dbg(("ire_forward: packet is to be multirouted- " 835c793af95Ssangeeta "handing it to ip_newroute\n")); 836c793af95Ssangeeta if (sire != NULL) 837c793af95Ssangeeta ire_refrele(sire); 838c793af95Ssangeeta ire_refrele(ire); 839c793af95Ssangeeta /* 840c793af95Ssangeeta * Inform caller about encountering of multirt so that 841c793af95Ssangeeta * ip_newroute() can be called. 842c793af95Ssangeeta */ 843c793af95Ssangeeta *check_multirt = B_TRUE; 844c793af95Ssangeeta return (NULL); 845c793af95Ssangeeta } 846c793af95Ssangeeta 847c793af95Ssangeeta *check_multirt = B_FALSE; 848c793af95Ssangeeta 849c793af95Ssangeeta /* 850c793af95Ssangeeta * Verify that the returned IRE does not have either 851c793af95Ssangeeta * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is 852c793af95Ssangeeta * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER. 853c793af95Ssangeeta */ 854c793af95Ssangeeta if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) || 855c793af95Ssangeeta (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0) { 856c793af95Ssangeeta ip3dbg(("ire 0x%p is not cache/resolver/noresolver\n", 857c793af95Ssangeeta (void *)ire)); 858c793af95Ssangeeta goto icmp_err_ret; 859c793af95Ssangeeta } 860c793af95Ssangeeta 861c793af95Ssangeeta /* 862c793af95Ssangeeta * If we already have a fully resolved IRE CACHE of the 863c793af95Ssangeeta * nexthop router, just hand over the cache entry 864c793af95Ssangeeta * and we are done. 865c793af95Ssangeeta */ 866c793af95Ssangeeta 867c793af95Ssangeeta if (ire->ire_type & IRE_CACHE) { 868c793af95Ssangeeta 869c793af95Ssangeeta /* 870c793af95Ssangeeta * If we are using this ire cache entry as a 871c793af95Ssangeeta * gateway to forward packets, chances are we 872c793af95Ssangeeta * will be using it again. So turn off 873c793af95Ssangeeta * the temporary flag, thus reducing its 874c793af95Ssangeeta * chances of getting deleted frequently. 875c793af95Ssangeeta */ 876c793af95Ssangeeta if (ire->ire_marks & IRE_MARK_TEMPORARY) { 877c793af95Ssangeeta irb_t *irb = ire->ire_bucket; 878c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 879c793af95Ssangeeta ire->ire_marks &= ~IRE_MARK_TEMPORARY; 880c793af95Ssangeeta irb->irb_tmp_ire_cnt--; 881c793af95Ssangeeta rw_exit(&irb->irb_lock); 882c793af95Ssangeeta } 883c793af95Ssangeeta 884c793af95Ssangeeta if (sire != NULL) { 885c793af95Ssangeeta UPDATE_OB_PKT_COUNT(sire); 886c793af95Ssangeeta sire->ire_last_used_time = lbolt; 887c793af95Ssangeeta ire_refrele(sire); 888c793af95Ssangeeta } 889c793af95Ssangeeta return (ire); 890c793af95Ssangeeta } 891c793af95Ssangeeta create_irecache: 892c793af95Ssangeeta /* 893c793af95Ssangeeta * Increment the ire_ob_pkt_count field for ire if it is an 894c793af95Ssangeeta * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and 895c793af95Ssangeeta * increment the same for the parent IRE, sire, if it is some 896c793af95Ssangeeta * sort of prefix IRE (which includes DEFAULT, PREFIX, HOST 897c793af95Ssangeeta * and HOST_REDIRECT). 898c793af95Ssangeeta */ 899c793af95Ssangeeta if ((ire->ire_type & IRE_INTERFACE) != 0) { 900c793af95Ssangeeta UPDATE_OB_PKT_COUNT(ire); 901c793af95Ssangeeta ire->ire_last_used_time = lbolt; 902c793af95Ssangeeta } 903c793af95Ssangeeta 904c793af95Ssangeeta /* 905c793af95Ssangeeta * sire must be either IRE_CACHETABLE OR IRE_INTERFACE type 906c793af95Ssangeeta */ 907c793af95Ssangeeta if (sire != NULL) { 908c793af95Ssangeeta gw = sire->ire_gateway_addr; 909c793af95Ssangeeta ASSERT((sire->ire_type & 910c793af95Ssangeeta (IRE_CACHETABLE | IRE_INTERFACE)) == 0); 911c793af95Ssangeeta UPDATE_OB_PKT_COUNT(sire); 912c793af95Ssangeeta sire->ire_last_used_time = lbolt; 913c793af95Ssangeeta } 914c793af95Ssangeeta 915c793af95Ssangeeta /* Obtain dst_ill */ 916c793af95Ssangeeta dst_ill = ip_newroute_get_dst_ill(ire->ire_ipif->ipif_ill); 917c793af95Ssangeeta if (dst_ill == NULL) { 918c793af95Ssangeeta ip2dbg(("ire_forward no dst ill; ire 0x%p\n", 919c793af95Ssangeeta (void *)ire)); 920c793af95Ssangeeta goto icmp_err_ret; 921c793af95Ssangeeta } 922c793af95Ssangeeta 923c793af95Ssangeeta ASSERT(src_ipif == NULL); 924c793af95Ssangeeta /* Now obtain the src_ipif */ 925c793af95Ssangeeta src_ipif = ire_forward_src_ipif(dst, sire, ire, dst_ill, 926c793af95Ssangeeta zoneid, &ire_marks); 927c793af95Ssangeeta if (src_ipif == NULL) 928c793af95Ssangeeta goto icmp_err_ret; 929c793af95Ssangeeta 930c793af95Ssangeeta switch (ire->ire_type) { 931c793af95Ssangeeta case IRE_IF_NORESOLVER: 932c793af95Ssangeeta /* create ire_cache for ire_addr endpoint */ 933c793af95Ssangeeta case IRE_IF_RESOLVER: 934c793af95Ssangeeta /* 935c793af95Ssangeeta * We have the IRE_IF_RESOLVER of the nexthop gateway 936c793af95Ssangeeta * and now need to build a IRE_CACHE for it. 937c793af95Ssangeeta * In this case, we have the following : 938c793af95Ssangeeta * 939c793af95Ssangeeta * 1) src_ipif - used for getting a source address. 940c793af95Ssangeeta * 941c793af95Ssangeeta * 2) dst_ill - from which we derive ire_stq/ire_rfq. This 942c793af95Ssangeeta * means packets using the IRE_CACHE that we will build 943c793af95Ssangeeta * here will go out on dst_ill. 944c793af95Ssangeeta * 945c793af95Ssangeeta * 3) sire may or may not be NULL. But, the IRE_CACHE that is 946c793af95Ssangeeta * to be created will only be tied to the IRE_INTERFACE 947c793af95Ssangeeta * that was derived from the ire_ihandle field. 948c793af95Ssangeeta * 949c793af95Ssangeeta * If sire is non-NULL, it means the destination is 950c793af95Ssangeeta * off-link and we will first create the IRE_CACHE for the 951c793af95Ssangeeta * gateway. 952c793af95Ssangeeta */ 953c793af95Ssangeeta res_mp = dst_ill->ill_resolver_mp; 954c793af95Ssangeeta if (ire->ire_type == IRE_IF_RESOLVER && 955c793af95Ssangeeta (!OK_RESOLVER_MP(res_mp))) { 956c793af95Ssangeeta ire_refrele(ire); 957c793af95Ssangeeta ire = NULL; 958c793af95Ssangeeta goto out; 959c793af95Ssangeeta } 960c793af95Ssangeeta /* 961c793af95Ssangeeta * To be at this point in the code with a non-zero gw 962c793af95Ssangeeta * means that dst is reachable through a gateway that 963c793af95Ssangeeta * we have never resolved. By changing dst to the gw 964c793af95Ssangeeta * addr we resolve the gateway first. 965c793af95Ssangeeta */ 966c793af95Ssangeeta if (gw != INADDR_ANY) { 967c793af95Ssangeeta /* 968c793af95Ssangeeta * The source ipif that was determined above was 969c793af95Ssangeeta * relative to the destination address, not the 970c793af95Ssangeeta * gateway's. If src_ipif was not taken out of 971c793af95Ssangeeta * the IRE_IF_RESOLVER entry, we'll need to call 972c793af95Ssangeeta * ipif_select_source() again. 973c793af95Ssangeeta */ 974c793af95Ssangeeta if (src_ipif != ire->ire_ipif) { 975c793af95Ssangeeta ipif_refrele(src_ipif); 976c793af95Ssangeeta src_ipif = ipif_select_source(dst_ill, 977c793af95Ssangeeta gw, zoneid); 978c793af95Ssangeeta if (src_ipif == NULL) 979c793af95Ssangeeta goto icmp_err_ret; 980c793af95Ssangeeta } 981c793af95Ssangeeta dst = gw; 982c793af95Ssangeeta gw = INADDR_ANY; 983c793af95Ssangeeta } 984c793af95Ssangeeta /* 985c793af95Ssangeeta * dst has been set to the address of the nexthop. 986c793af95Ssangeeta * 987c793af95Ssangeeta * TSol note: get security attributes of the nexthop; 988c793af95Ssangeeta * Note that the nexthop may either be a gateway, or the 989c793af95Ssangeeta * packet destination itself; Detailed explanation of 990c793af95Ssangeeta * issues involved is provided in the IRE_IF_NORESOLVER 991c793af95Ssangeeta * logic in ip_newroute(). 992c793af95Ssangeeta */ 993c793af95Ssangeeta ga.ga_af = AF_INET; 994c793af95Ssangeeta IN6_IPADDR_TO_V4MAPPED(dst, &ga.ga_addr); 995c793af95Ssangeeta gcgrp = gcgrp_lookup(&ga, B_FALSE); 996c793af95Ssangeeta 997c793af95Ssangeeta if (ire->ire_type == IRE_IF_NORESOLVER) 998c793af95Ssangeeta dst = ire->ire_addr; /* ire_cache for tunnel endpoint */ 999c793af95Ssangeeta 1000c793af95Ssangeeta save_ire = ire; 1001c793af95Ssangeeta /* 1002c793af95Ssangeeta * create an incomplete ire-cache with a null dlureq_mp. 1003c793af95Ssangeeta * The dlureq_mp will be created in ire_arpresolve. 1004c793af95Ssangeeta */ 1005c793af95Ssangeeta ire = ire_create( 1006c793af95Ssangeeta (uchar_t *)&dst, /* dest address */ 1007c793af95Ssangeeta (uchar_t *)&ip_g_all_ones, /* mask */ 1008c793af95Ssangeeta (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ 1009c793af95Ssangeeta (uchar_t *)&gw, /* gateway address */ 1010c793af95Ssangeeta NULL, 1011c793af95Ssangeeta (save_ire->ire_type == IRE_IF_RESOLVER ? NULL: 1012c793af95Ssangeeta &save_ire->ire_max_frag), 1013c793af95Ssangeeta NULL, 1014c793af95Ssangeeta dst_ill->ill_rq, /* recv-from queue */ 1015c793af95Ssangeeta dst_ill->ill_wq, /* send-to queue */ 1016c793af95Ssangeeta IRE_CACHE, /* IRE type */ 1017c793af95Ssangeeta NULL, 1018c793af95Ssangeeta src_ipif, 1019c793af95Ssangeeta NULL, 1020c793af95Ssangeeta ire->ire_mask, /* Parent mask */ 1021c793af95Ssangeeta 0, 1022c793af95Ssangeeta ire->ire_ihandle, /* Interface handle */ 1023c793af95Ssangeeta 0, 1024c793af95Ssangeeta &(ire->ire_uinfo), 1025c793af95Ssangeeta NULL, 1026*f4b3ec61Sdh155122 gcgrp, 1027*f4b3ec61Sdh155122 ipst); 1028c793af95Ssangeeta ip1dbg(("incomplete ire_cache 0x%p\n", (void *)ire)); 1029c793af95Ssangeeta if (ire != NULL) { 1030c793af95Ssangeeta gcgrp = NULL; /* reference now held by IRE */ 1031c793af95Ssangeeta ire->ire_marks |= ire_marks; 1032c793af95Ssangeeta /* add the incomplete ire: */ 1033c793af95Ssangeeta error = ire_add(&ire, NULL, NULL, NULL, B_TRUE); 1034c793af95Ssangeeta if (error == 0 && ire != NULL) { 1035c793af95Ssangeeta ire->ire_max_frag = save_ire->ire_max_frag; 1036c793af95Ssangeeta ip1dbg(("setting max_frag to %d in ire 0x%p\n", 1037c793af95Ssangeeta ire->ire_max_frag, (void *)ire)); 1038c793af95Ssangeeta } else { 1039c793af95Ssangeeta ire_refrele(save_ire); 1040c793af95Ssangeeta goto icmp_err_ret; 1041c793af95Ssangeeta } 1042c793af95Ssangeeta } else { 1043c793af95Ssangeeta if (gcgrp != NULL) { 1044c793af95Ssangeeta GCGRP_REFRELE(gcgrp); 1045c793af95Ssangeeta gcgrp = NULL; 1046c793af95Ssangeeta } 1047c793af95Ssangeeta } 1048c793af95Ssangeeta 1049c793af95Ssangeeta ire_refrele(save_ire); 1050c793af95Ssangeeta break; 1051c793af95Ssangeeta default: 1052c793af95Ssangeeta break; 1053c793af95Ssangeeta } 1054c793af95Ssangeeta 1055c793af95Ssangeeta out: 1056c793af95Ssangeeta if (sire != NULL) 1057c793af95Ssangeeta ire_refrele(sire); 1058c793af95Ssangeeta if (dst_ill != NULL) 1059c793af95Ssangeeta ill_refrele(dst_ill); 1060c793af95Ssangeeta if (src_ipif != NULL) 1061c793af95Ssangeeta ipif_refrele(src_ipif); 1062c793af95Ssangeeta return (ire); 1063c793af95Ssangeeta icmp_err_ret: 1064c793af95Ssangeeta if (src_ipif != NULL) 1065c793af95Ssangeeta ipif_refrele(src_ipif); 1066c793af95Ssangeeta if (dst_ill != NULL) 1067c793af95Ssangeeta ill_refrele(dst_ill); 1068c793af95Ssangeeta if (sire != NULL) 1069c793af95Ssangeeta ire_refrele(sire); 1070c793af95Ssangeeta if (ire != NULL) { 1071c793af95Ssangeeta ire_refrele(ire); 1072c793af95Ssangeeta } 1073c793af95Ssangeeta /* caller needs to send icmp error message */ 1074c793af95Ssangeeta return (NULL); 1075c793af95Ssangeeta 1076c793af95Ssangeeta } 1077c793af95Ssangeeta 1078c793af95Ssangeeta /* 1079*f4b3ec61Sdh155122 * Obtain the rt_entry and rt_irb for the route to be added to 1080*f4b3ec61Sdh155122 * the ips_ip_ftable. 1081c793af95Ssangeeta * First attempt to add a node to the radix tree via rn_addroute. If the 1082c793af95Ssangeeta * route already exists, return the bucket for the existing route. 1083c793af95Ssangeeta * 1084c793af95Ssangeeta * Locking notes: Need to hold the global radix tree lock in write mode to 1085c793af95Ssangeeta * add a radix node. To prevent the node from being deleted, ire_get_bucket() 1086c793af95Ssangeeta * returns with a ref'ed irb_t. The ire itself is added in ire_add_v4() 1087c793af95Ssangeeta * while holding the irb_lock, but not the radix tree lock. 1088c793af95Ssangeeta */ 1089c793af95Ssangeeta irb_t * 1090c793af95Ssangeeta ire_get_bucket(ire_t *ire) 1091c793af95Ssangeeta { 1092c793af95Ssangeeta struct radix_node *rn; 1093c793af95Ssangeeta struct rt_entry *rt; 1094c793af95Ssangeeta struct rt_sockaddr rmask, rdst; 1095c793af95Ssangeeta irb_t *irb = NULL; 1096*f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 1097c793af95Ssangeeta 1098*f4b3ec61Sdh155122 ASSERT(ipst->ips_ip_ftable != NULL); 1099c793af95Ssangeeta 1100c793af95Ssangeeta /* first try to see if route exists (based on rtalloc1) */ 1101c793af95Ssangeeta (void) memset(&rdst, 0, sizeof (rdst)); 1102c793af95Ssangeeta rdst.rt_sin_len = sizeof (rdst); 1103c793af95Ssangeeta rdst.rt_sin_family = AF_INET; 1104c793af95Ssangeeta rdst.rt_sin_addr.s_addr = ire->ire_addr; 1105c793af95Ssangeeta 1106c793af95Ssangeeta (void) memset(&rmask, 0, sizeof (rmask)); 1107c793af95Ssangeeta rmask.rt_sin_len = sizeof (rmask); 1108c793af95Ssangeeta rmask.rt_sin_family = AF_INET; 1109c793af95Ssangeeta rmask.rt_sin_addr.s_addr = ire->ire_mask; 1110c793af95Ssangeeta 1111c793af95Ssangeeta /* 1112c793af95Ssangeeta * add the route. based on BSD's rtrequest1(RTM_ADD) 1113c793af95Ssangeeta */ 1114c793af95Ssangeeta R_Malloc(rt, rt_entry_cache, sizeof (*rt)); 1115c793af95Ssangeeta (void) memset(rt, 0, sizeof (*rt)); 1116c793af95Ssangeeta rt->rt_nodes->rn_key = (char *)&rt->rt_dst; 1117c793af95Ssangeeta rt->rt_dst = rdst; 1118c793af95Ssangeeta irb = &rt->rt_irb; 1119c793af95Ssangeeta irb->irb_marks |= IRB_MARK_FTABLE; /* dynamically allocated/freed */ 1120*f4b3ec61Sdh155122 irb->irb_ipst = ipst; 1121c793af95Ssangeeta rw_init(&irb->irb_lock, NULL, RW_DEFAULT, NULL); 1122*f4b3ec61Sdh155122 RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable); 1123*f4b3ec61Sdh155122 rn = ipst->ips_ip_ftable->rnh_addaddr(&rt->rt_dst, &rmask, 1124*f4b3ec61Sdh155122 ipst->ips_ip_ftable, (struct radix_node *)rt); 1125c793af95Ssangeeta if (rn == NULL) { 1126*f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 1127c793af95Ssangeeta Free(rt, rt_entry_cache); 1128c793af95Ssangeeta rt = NULL; 1129c793af95Ssangeeta irb = NULL; 1130*f4b3ec61Sdh155122 RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 1131*f4b3ec61Sdh155122 rn = ipst->ips_ip_ftable->rnh_lookup(&rdst, &rmask, 1132*f4b3ec61Sdh155122 ipst->ips_ip_ftable); 1133*f4b3ec61Sdh155122 if (rn != NULL && ((rn->rn_flags & RNF_ROOT) == 0)) { 1134c793af95Ssangeeta /* found a non-root match */ 1135c793af95Ssangeeta rt = (struct rt_entry *)rn; 1136c793af95Ssangeeta } 1137c793af95Ssangeeta } 1138c793af95Ssangeeta if (rt != NULL) { 1139c793af95Ssangeeta irb = &rt->rt_irb; 1140c793af95Ssangeeta IRB_REFHOLD(irb); 1141c793af95Ssangeeta } 1142*f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 1143c793af95Ssangeeta return (irb); 1144c793af95Ssangeeta } 1145c793af95Ssangeeta 1146c793af95Ssangeeta /* 1147c793af95Ssangeeta * This function is used when the caller wants to know the outbound 1148c793af95Ssangeeta * interface for a packet given only the address. 1149c793af95Ssangeeta * If this is a offlink IP address and there are multiple 1150c793af95Ssangeeta * routes to this destination, this routine will utilise the 1151c793af95Ssangeeta * first route it finds to IP address 1152c793af95Ssangeeta * Return values: 1153c793af95Ssangeeta * 0 - FAILURE 1154c793af95Ssangeeta * nonzero - ifindex 1155c793af95Ssangeeta */ 1156c793af95Ssangeeta uint_t 1157c793af95Ssangeeta ifindex_lookup(const struct sockaddr *ipaddr, zoneid_t zoneid) 1158c793af95Ssangeeta { 1159c793af95Ssangeeta uint_t ifindex = 0; 1160c793af95Ssangeeta ire_t *ire; 1161c793af95Ssangeeta ill_t *ill; 1162*f4b3ec61Sdh155122 netstack_t *ns; 1163*f4b3ec61Sdh155122 ip_stack_t *ipst; 1164c793af95Ssangeeta 1165*f4b3ec61Sdh155122 if (zoneid == ALL_ZONES) 1166*f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(GLOBAL_ZONEID); 1167*f4b3ec61Sdh155122 else 1168*f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(zoneid); 1169*f4b3ec61Sdh155122 ASSERT(ns != NULL); 1170*f4b3ec61Sdh155122 1171*f4b3ec61Sdh155122 /* 1172*f4b3ec61Sdh155122 * For exclusive stacks we set the zoneid to zero 1173*f4b3ec61Sdh155122 * since IP uses the global zoneid in the exclusive stacks. 1174*f4b3ec61Sdh155122 */ 1175*f4b3ec61Sdh155122 if (ns->netstack_stackid != GLOBAL_NETSTACKID) 1176*f4b3ec61Sdh155122 zoneid = GLOBAL_ZONEID; 1177*f4b3ec61Sdh155122 ipst = ns->netstack_ip; 1178c793af95Ssangeeta 1179c793af95Ssangeeta ASSERT(ipaddr->sa_family == AF_INET || ipaddr->sa_family == AF_INET6); 1180c793af95Ssangeeta 1181*f4b3ec61Sdh155122 if ((ire = route_to_dst(ipaddr, zoneid, ipst)) != NULL) { 1182c793af95Ssangeeta ill = ire_to_ill(ire); 1183c793af95Ssangeeta if (ill != NULL) 1184c793af95Ssangeeta ifindex = ill->ill_phyint->phyint_ifindex; 1185c793af95Ssangeeta ire_refrele(ire); 1186c793af95Ssangeeta } 1187*f4b3ec61Sdh155122 netstack_rele(ns); 1188c793af95Ssangeeta return (ifindex); 1189c793af95Ssangeeta } 1190c793af95Ssangeeta 1191c793af95Ssangeeta /* 1192c793af95Ssangeeta * Routine to find the route to a destination. If a ifindex is supplied 1193c793af95Ssangeeta * it tries to match the the route to the corresponding ipif for the ifindex 1194c793af95Ssangeeta */ 1195c793af95Ssangeeta static ire_t * 1196*f4b3ec61Sdh155122 route_to_dst(const struct sockaddr *dst_addr, zoneid_t zoneid, ip_stack_t *ipst) 1197c793af95Ssangeeta { 1198c793af95Ssangeeta ire_t *ire = NULL; 1199c793af95Ssangeeta int match_flags; 1200c793af95Ssangeeta 1201c793af95Ssangeeta match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | 1202c793af95Ssangeeta MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE); 1203c793af95Ssangeeta 1204c793af95Ssangeeta /* XXX pass NULL tsl for now */ 1205c793af95Ssangeeta 1206c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 1207c793af95Ssangeeta ire = ire_route_lookup( 1208c793af95Ssangeeta ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr, 1209*f4b3ec61Sdh155122 0, 0, 0, NULL, NULL, zoneid, NULL, match_flags, ipst); 1210c793af95Ssangeeta } else { 1211c793af95Ssangeeta ire = ire_route_lookup_v6( 1212c793af95Ssangeeta &((struct sockaddr_in6 *)dst_addr)->sin6_addr, 1213*f4b3ec61Sdh155122 0, 0, 0, NULL, NULL, zoneid, NULL, match_flags, ipst); 1214c793af95Ssangeeta } 1215c793af95Ssangeeta return (ire); 1216c793af95Ssangeeta } 1217c793af95Ssangeeta 1218c793af95Ssangeeta /* 1219c793af95Ssangeeta * This routine is called by IP Filter to send a packet out on the wire 1220c793af95Ssangeeta * to a specified V4 dst (which may be onlink or offlink). The ifindex may or 1221c793af95Ssangeeta * may not be 0. A non-null ifindex indicates IP Filter has stipulated 1222c793af95Ssangeeta * an outgoing interface and requires the nexthop to be on that interface. 1223c793af95Ssangeeta * IP WILL NOT DO the following to the data packet before sending it out: 1224c793af95Ssangeeta * a. manipulate ttl 1225c793af95Ssangeeta * b. checksuming 1226c793af95Ssangeeta * c. ipsec work 1227c793af95Ssangeeta * d. fragmentation 1228c793af95Ssangeeta * 1229c793af95Ssangeeta * Return values: 1230c793af95Ssangeeta * 0: IP was able to send of the data pkt 1231c793af95Ssangeeta * ECOMM: Could not send packet 1232c793af95Ssangeeta * ENONET No route to dst. It is up to the caller 1233c793af95Ssangeeta * to send icmp unreachable error message, 1234c793af95Ssangeeta * EINPROGRESS The macaddr of the onlink dst or that 1235c793af95Ssangeeta * of the offlink dst's nexthop needs to get 1236c793af95Ssangeeta * resolved before packet can be sent to dst. 1237c793af95Ssangeeta * Thus transmission is not guaranteed. 1238c793af95Ssangeeta * 1239c793af95Ssangeeta */ 1240c793af95Ssangeeta 1241c793af95Ssangeeta int 1242c793af95Ssangeeta ipfil_sendpkt(const struct sockaddr *dst_addr, mblk_t *mp, uint_t ifindex, 1243c793af95Ssangeeta zoneid_t zoneid) 1244c793af95Ssangeeta { 1245c793af95Ssangeeta ire_t *ire = NULL, *sire = NULL; 1246c793af95Ssangeeta ire_t *ire_cache = NULL; 1247c793af95Ssangeeta boolean_t check_multirt = B_FALSE; 1248c793af95Ssangeeta int value; 1249c793af95Ssangeeta int match_flags; 1250c793af95Ssangeeta ipaddr_t dst; 1251*f4b3ec61Sdh155122 netstack_t *ns; 1252*f4b3ec61Sdh155122 ip_stack_t *ipst; 1253c793af95Ssangeeta 1254c793af95Ssangeeta ASSERT(mp != NULL); 1255c793af95Ssangeeta 1256*f4b3ec61Sdh155122 if (zoneid == ALL_ZONES) 1257*f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(GLOBAL_ZONEID); 1258*f4b3ec61Sdh155122 else 1259*f4b3ec61Sdh155122 ns = netstack_find_by_zoneid(zoneid); 1260*f4b3ec61Sdh155122 ASSERT(ns != NULL); 1261*f4b3ec61Sdh155122 1262*f4b3ec61Sdh155122 /* 1263*f4b3ec61Sdh155122 * For exclusive stacks we set the zoneid to zero 1264*f4b3ec61Sdh155122 * since IP uses the global zoneid in the exclusive stacks. 1265*f4b3ec61Sdh155122 */ 1266*f4b3ec61Sdh155122 if (ns->netstack_stackid != GLOBAL_NETSTACKID) 1267*f4b3ec61Sdh155122 zoneid = GLOBAL_ZONEID; 1268*f4b3ec61Sdh155122 ipst = ns->netstack_ip; 1269*f4b3ec61Sdh155122 1270c793af95Ssangeeta ASSERT(dst_addr->sa_family == AF_INET || 1271c793af95Ssangeeta dst_addr->sa_family == AF_INET6); 1272c793af95Ssangeeta 1273c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 1274c793af95Ssangeeta dst = ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr; 1275c793af95Ssangeeta } else { 1276c793af95Ssangeeta /* 1277c793af95Ssangeeta * We dont have support for V6 yet. It will be provided 1278c793af95Ssangeeta * once RFE 6399103 has been delivered. 1279c793af95Ssangeeta * Until then, for V6 dsts, IP Filter will not call 1280a9a89b0dSdr146992 * this function. Instead the netinfo framework provides 1281a9a89b0dSdr146992 * its own code path, in ip_inject_impl(), to achieve 1282a9a89b0dSdr146992 * what it needs to do, for the time being. 1283c793af95Ssangeeta */ 1284c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: no V6 support \n")); 1285c793af95Ssangeeta value = ECOMM; 1286c793af95Ssangeeta freemsg(mp); 1287c793af95Ssangeeta goto discard; 1288c793af95Ssangeeta } 1289c793af95Ssangeeta 1290c793af95Ssangeeta /* 1291c793af95Ssangeeta * Lets get the ire. We might get the ire cache entry, 1292c793af95Ssangeeta * or the ire,sire pair needed to create the cache entry. 1293c793af95Ssangeeta * XXX pass NULL tsl for now. 1294c793af95Ssangeeta */ 1295c793af95Ssangeeta 1296c793af95Ssangeeta if (ifindex == 0) { 1297c793af95Ssangeeta /* There is no supplied index. So use the FIB info */ 1298c793af95Ssangeeta 1299c793af95Ssangeeta match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | 1300c793af95Ssangeeta MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE); 1301c793af95Ssangeeta ire = ire_route_lookup(dst, 1302c793af95Ssangeeta 0, 0, 0, NULL, &sire, zoneid, MBLK_GETLABEL(mp), 1303*f4b3ec61Sdh155122 match_flags, ipst); 1304c793af95Ssangeeta } else { 1305c793af95Ssangeeta ipif_t *supplied_ipif; 1306c793af95Ssangeeta ill_t *ill; 1307c793af95Ssangeeta 1308c793af95Ssangeeta /* 1309c793af95Ssangeeta * If supplied ifindex is non-null, the only valid 1310c793af95Ssangeeta * nexthop is one off of the interface corresponding 1311c793af95Ssangeeta * to the specified ifindex. 1312c793af95Ssangeeta */ 1313c793af95Ssangeeta 1314c793af95Ssangeeta ill = ill_lookup_on_ifindex(ifindex, B_FALSE, 1315*f4b3ec61Sdh155122 NULL, NULL, NULL, NULL, ipst); 1316c793af95Ssangeeta if (ill != NULL) { 1317c793af95Ssangeeta supplied_ipif = ipif_get_next_ipif(NULL, ill); 1318c793af95Ssangeeta } else { 1319c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Could not find" 1320c793af95Ssangeeta " route to dst\n")); 1321c793af95Ssangeeta value = ECOMM; 1322c793af95Ssangeeta freemsg(mp); 1323c793af95Ssangeeta goto discard; 1324c793af95Ssangeeta } 1325c793af95Ssangeeta 1326c793af95Ssangeeta match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | 1327c793af95Ssangeeta MATCH_IRE_IPIF | MATCH_IRE_RECURSIVE| MATCH_IRE_RJ_BHOLE| 1328c793af95Ssangeeta MATCH_IRE_SECATTR); 1329c793af95Ssangeeta 1330c793af95Ssangeeta ire = ire_route_lookup(dst, 0, 0, 0, supplied_ipif, 1331*f4b3ec61Sdh155122 &sire, zoneid, MBLK_GETLABEL(mp), match_flags, ipst); 1332381a2a9aSdr146992 ipif_refrele(supplied_ipif); 1333c793af95Ssangeeta ill_refrele(ill); 1334c793af95Ssangeeta } 1335c793af95Ssangeeta 1336c793af95Ssangeeta /* 1337c793af95Ssangeeta * Verify that the returned IRE is non-null and does 1338c793af95Ssangeeta * not have either the RTF_REJECT or RTF_BLACKHOLE 1339c793af95Ssangeeta * flags set and that the IRE is either an IRE_CACHE, 1340c793af95Ssangeeta * IRE_IF_NORESOLVER or IRE_IF_RESOLVER. 1341c793af95Ssangeeta */ 1342c793af95Ssangeeta if (ire == NULL || 1343c793af95Ssangeeta ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) || 1344c793af95Ssangeeta (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0)) { 1345c793af95Ssangeeta /* 1346c793af95Ssangeeta * Either ire could not be found or we got 1347c793af95Ssangeeta * an invalid one 1348c793af95Ssangeeta */ 1349c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Could not find route to dst\n")); 1350c793af95Ssangeeta value = ENONET; 1351c793af95Ssangeeta freemsg(mp); 1352c793af95Ssangeeta goto discard; 1353c793af95Ssangeeta } 1354c793af95Ssangeeta 1355c793af95Ssangeeta /* IP Filter and CGTP dont mix. So bail out if CGTP is on */ 1356c793af95Ssangeeta if (ip_cgtp_filter && 1357c793af95Ssangeeta ((ire->ire_flags & RTF_MULTIRT) || 1358c793af95Ssangeeta ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) { 1359c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: IPFilter does not work with CGTP\n")); 1360c793af95Ssangeeta value = ECOMM; 1361c793af95Ssangeeta freemsg(mp); 1362c793af95Ssangeeta goto discard; 1363c793af95Ssangeeta } 1364c793af95Ssangeeta 1365381a2a9aSdr146992 ASSERT(ire->ire_type != IRE_CACHE || ire->ire_nce != NULL); 1366c793af95Ssangeeta /* 1367c793af95Ssangeeta * If needed, we will create the ire cache entry for the 1368c793af95Ssangeeta * nexthop, resolve its link-layer address and then send 1369c793af95Ssangeeta * the packet out without ttl, checksumming, IPSec processing. 1370c793af95Ssangeeta */ 1371c793af95Ssangeeta 1372c793af95Ssangeeta switch (ire->ire_type) { 1373c793af95Ssangeeta case IRE_IF_NORESOLVER: 1374c793af95Ssangeeta case IRE_CACHE: 1375c793af95Ssangeeta if (sire != NULL) { 1376c793af95Ssangeeta UPDATE_OB_PKT_COUNT(sire); 1377c793af95Ssangeeta sire->ire_last_used_time = lbolt; 1378c793af95Ssangeeta ire_refrele(sire); 1379c793af95Ssangeeta } 1380c793af95Ssangeeta ire_cache = ire; 1381c793af95Ssangeeta break; 1382c793af95Ssangeeta case IRE_IF_RESOLVER: 1383c793af95Ssangeeta /* 1384c793af95Ssangeeta * Call ire_forward(). This function 1385c793af95Ssangeeta * will, create the ire cache entry of the 1386c793af95Ssangeeta * the nexthop and adds this incomplete ire 1387c793af95Ssangeeta * to the ire cache table 1388c793af95Ssangeeta */ 1389c793af95Ssangeeta ire_cache = ire_forward(dst, &check_multirt, ire, sire, 1390*f4b3ec61Sdh155122 MBLK_GETLABEL(mp), ipst); 1391c793af95Ssangeeta if (ire_cache == NULL) { 1392c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: failed to create the" 1393c793af95Ssangeeta " ire cache entry \n")); 1394c793af95Ssangeeta value = ENONET; 1395c793af95Ssangeeta freemsg(mp); 1396c793af95Ssangeeta sire = NULL; 1397c793af95Ssangeeta ire = NULL; 1398c793af95Ssangeeta goto discard; 1399c793af95Ssangeeta } 1400c793af95Ssangeeta break; 1401c793af95Ssangeeta } 1402c793af95Ssangeeta /* 1403c793af95Ssangeeta * Now that we have the ire cache entry of the nexthop, call 1404c793af95Ssangeeta * ip_xmit_v4() to trigger mac addr resolution 1405c793af95Ssangeeta * if necessary and send it once ready. 1406c793af95Ssangeeta */ 1407c793af95Ssangeeta 1408c793af95Ssangeeta value = ip_xmit_v4(mp, ire_cache, NULL, B_FALSE); 1409c793af95Ssangeeta ire_refrele(ire_cache); 1410c793af95Ssangeeta /* 1411c793af95Ssangeeta * At this point, the reference for these have already been 1412c793af95Ssangeeta * released within ire_forward() and/or ip_xmit_v4(). So we set 1413c793af95Ssangeeta * them to NULL to make sure we dont drop the references 1414c793af95Ssangeeta * again in case ip_xmit_v4() returns with either SEND_FAILED 1415c793af95Ssangeeta * or LLHDR_RESLV_FAILED 1416c793af95Ssangeeta */ 1417c793af95Ssangeeta sire = NULL; 1418c793af95Ssangeeta ire = NULL; 1419c793af95Ssangeeta 1420c793af95Ssangeeta switch (value) { 1421c793af95Ssangeeta case SEND_FAILED: 1422c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Send failed\n")); 1423c793af95Ssangeeta value = ECOMM; 1424c793af95Ssangeeta break; 1425c793af95Ssangeeta case LLHDR_RESLV_FAILED: 1426c793af95Ssangeeta ip1dbg(("ipfil_sendpkt: Link-layer resolution" 1427c793af95Ssangeeta " failed\n")); 1428c793af95Ssangeeta value = ECOMM; 1429c793af95Ssangeeta break; 1430c793af95Ssangeeta case LOOKUP_IN_PROGRESS: 1431*f4b3ec61Sdh155122 netstack_rele(ns); 1432c793af95Ssangeeta return (EINPROGRESS); 1433c793af95Ssangeeta case SEND_PASSED: 1434*f4b3ec61Sdh155122 netstack_rele(ns); 1435c793af95Ssangeeta return (0); 1436c793af95Ssangeeta } 1437c793af95Ssangeeta discard: 1438c793af95Ssangeeta if (dst_addr->sa_family == AF_INET) { 1439*f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 1440c793af95Ssangeeta } else { 1441*f4b3ec61Sdh155122 BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards); 1442c793af95Ssangeeta } 1443c793af95Ssangeeta if (ire != NULL) 1444c793af95Ssangeeta ire_refrele(ire); 1445c793af95Ssangeeta if (sire != NULL) 1446c793af95Ssangeeta ire_refrele(sire); 1447*f4b3ec61Sdh155122 netstack_rele(ns); 1448c793af95Ssangeeta return (value); 1449c793af95Ssangeeta } 1450c793af95Ssangeeta 1451c793af95Ssangeeta /* ire_walk routine invoked for ip_ire_report for each IRE. */ 1452c793af95Ssangeeta void 1453c793af95Ssangeeta ire_report_ftable(ire_t *ire, char *m) 1454c793af95Ssangeeta { 1455c793af95Ssangeeta char buf1[16]; 1456c793af95Ssangeeta char buf2[16]; 1457c793af95Ssangeeta char buf3[16]; 1458c793af95Ssangeeta char buf4[16]; 1459c793af95Ssangeeta uint_t fo_pkt_count; 1460c793af95Ssangeeta uint_t ib_pkt_count; 1461c793af95Ssangeeta int ref; 1462c793af95Ssangeeta uint_t print_len, buf_len; 1463c793af95Ssangeeta mblk_t *mp = (mblk_t *)m; 1464c793af95Ssangeeta 1465c793af95Ssangeeta if (ire->ire_type & IRE_CACHETABLE) 1466c793af95Ssangeeta return; 1467c793af95Ssangeeta buf_len = mp->b_datap->db_lim - mp->b_wptr; 1468c793af95Ssangeeta if (buf_len <= 0) 1469c793af95Ssangeeta return; 1470c793af95Ssangeeta 1471c793af95Ssangeeta /* Number of active references of this ire */ 1472c793af95Ssangeeta ref = ire->ire_refcnt; 1473c793af95Ssangeeta /* "inbound" to a non local address is a forward */ 1474c793af95Ssangeeta ib_pkt_count = ire->ire_ib_pkt_count; 1475c793af95Ssangeeta fo_pkt_count = 0; 1476c793af95Ssangeeta if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) { 1477c793af95Ssangeeta fo_pkt_count = ib_pkt_count; 1478c793af95Ssangeeta ib_pkt_count = 0; 1479c793af95Ssangeeta } 1480c793af95Ssangeeta print_len = snprintf((char *)mp->b_wptr, buf_len, 1481c793af95Ssangeeta MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d " 1482c793af95Ssangeeta "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d " 1483c793af95Ssangeeta "%04d %08d %08d %d/%d/%d %s\n", 1484c793af95Ssangeeta (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq, 1485c793af95Ssangeeta (int)ire->ire_zoneid, 1486c793af95Ssangeeta ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2), 1487c793af95Ssangeeta ip_dot_addr(ire->ire_src_addr, buf3), 1488c793af95Ssangeeta ip_dot_addr(ire->ire_gateway_addr, buf4), 1489c793af95Ssangeeta ire->ire_max_frag, ire->ire_uinfo.iulp_rtt, 1490c793af95Ssangeeta ire->ire_uinfo.iulp_rtt_sd, 1491c793af95Ssangeeta ire->ire_uinfo.iulp_ssthresh, ref, 1492c793af95Ssangeeta ire->ire_uinfo.iulp_rtomax, 1493c793af95Ssangeeta (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0), 1494c793af95Ssangeeta (ire->ire_uinfo.iulp_wscale_ok ? 1: 0), 1495c793af95Ssangeeta (ire->ire_uinfo.iulp_ecn_ok ? 1: 0), 1496c793af95Ssangeeta (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0), 1497c793af95Ssangeeta ire->ire_uinfo.iulp_sack, 1498c793af95Ssangeeta ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe, 1499c793af95Ssangeeta ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count, 1500c793af95Ssangeeta ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type)); 1501c793af95Ssangeeta if (print_len < buf_len) { 1502c793af95Ssangeeta mp->b_wptr += print_len; 1503c793af95Ssangeeta } else { 1504c793af95Ssangeeta mp->b_wptr += buf_len; 1505c793af95Ssangeeta } 1506c793af95Ssangeeta } 1507c793af95Ssangeeta 1508c793af95Ssangeeta /* 1509c793af95Ssangeeta * callback function provided by ire_ftable_lookup when calling 1510c793af95Ssangeeta * rn_match_args(). Invoke ire_match_args on each matching leaf node in 1511c793af95Ssangeeta * the radix tree. 1512c793af95Ssangeeta */ 1513c793af95Ssangeeta boolean_t 1514c793af95Ssangeeta ire_find_best_route(struct radix_node *rn, void *arg) 1515c793af95Ssangeeta { 1516c793af95Ssangeeta struct rt_entry *rt = (struct rt_entry *)rn; 1517c793af95Ssangeeta irb_t *irb_ptr; 1518c793af95Ssangeeta ire_t *ire; 1519c793af95Ssangeeta ire_ftable_args_t *margs = arg; 1520c793af95Ssangeeta ipaddr_t match_mask; 1521c793af95Ssangeeta 1522c793af95Ssangeeta ASSERT(rt != NULL); 1523c793af95Ssangeeta 1524c793af95Ssangeeta irb_ptr = &rt->rt_irb; 1525c793af95Ssangeeta 1526c793af95Ssangeeta if (irb_ptr->irb_ire_cnt == 0) 1527c793af95Ssangeeta return (B_FALSE); 1528c793af95Ssangeeta 1529c793af95Ssangeeta rw_enter(&irb_ptr->irb_lock, RW_READER); 1530c793af95Ssangeeta for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 1531c793af95Ssangeeta if (ire->ire_marks & IRE_MARK_CONDEMNED) 1532c793af95Ssangeeta continue; 1533c793af95Ssangeeta if (margs->ift_flags & MATCH_IRE_MASK) 1534c793af95Ssangeeta match_mask = margs->ift_mask; 1535c793af95Ssangeeta else 1536c793af95Ssangeeta match_mask = ire->ire_mask; 1537c793af95Ssangeeta 1538c793af95Ssangeeta if (ire_match_args(ire, margs->ift_addr, match_mask, 1539c793af95Ssangeeta margs->ift_gateway, margs->ift_type, margs->ift_ipif, 1540c793af95Ssangeeta margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl, 1541c793af95Ssangeeta margs->ift_flags)) { 1542c793af95Ssangeeta IRE_REFHOLD(ire); 1543c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 1544c793af95Ssangeeta margs->ift_best_ire = ire; 1545c793af95Ssangeeta return (B_TRUE); 1546c793af95Ssangeeta } 1547c793af95Ssangeeta } 1548c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 1549c793af95Ssangeeta return (B_FALSE); 1550c793af95Ssangeeta } 1551c793af95Ssangeeta 1552c793af95Ssangeeta /* 1553c793af95Ssangeeta * ftable irb_t structures are dynamically allocated, and we need to 1554c793af95Ssangeeta * check if the irb_t (and associated ftable tree attachment) needs to 1555c793af95Ssangeeta * be cleaned up when the irb_refcnt goes to 0. The conditions that need 1556c793af95Ssangeeta * be verified are: 1557c793af95Ssangeeta * - no other walkers of the irebucket, i.e., quiescent irb_refcnt, 1558c793af95Ssangeeta * - no other threads holding references to ire's in the bucket, 1559c793af95Ssangeeta * i.e., irb_nire == 0 1560c793af95Ssangeeta * - no active ire's in the bucket, i.e., irb_ire_cnt == 0 1561c793af95Ssangeeta * - need to hold the global tree lock and irb_lock in write mode. 1562c793af95Ssangeeta */ 1563c793af95Ssangeeta void 1564c793af95Ssangeeta irb_refrele_ftable(irb_t *irb) 1565c793af95Ssangeeta { 1566c793af95Ssangeeta for (;;) { 1567c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 1568c793af95Ssangeeta ASSERT(irb->irb_refcnt != 0); 1569c793af95Ssangeeta if (irb->irb_refcnt != 1) { 1570c793af95Ssangeeta /* 1571c793af95Ssangeeta * Someone has a reference to this radix node 1572c793af95Ssangeeta * or there is some bucket walker. 1573c793af95Ssangeeta */ 1574c793af95Ssangeeta irb->irb_refcnt--; 1575c793af95Ssangeeta rw_exit(&irb->irb_lock); 1576c793af95Ssangeeta return; 1577c793af95Ssangeeta } else { 1578c793af95Ssangeeta /* 1579c793af95Ssangeeta * There is no other walker, nor is there any 1580c793af95Ssangeeta * other thread that holds a direct ref to this 1581c793af95Ssangeeta * radix node. Do the clean up if needed. Call 1582c793af95Ssangeeta * to ire_unlink will clear the IRB_MARK_CONDEMNED flag 1583c793af95Ssangeeta */ 1584c793af95Ssangeeta if (irb->irb_marks & IRB_MARK_CONDEMNED) { 1585c793af95Ssangeeta ire_t *ire_list; 1586c793af95Ssangeeta 1587c793af95Ssangeeta ire_list = ire_unlink(irb); 1588c793af95Ssangeeta rw_exit(&irb->irb_lock); 1589c793af95Ssangeeta 1590c793af95Ssangeeta if (ire_list != NULL) 1591c793af95Ssangeeta ire_cleanup(ire_list); 1592c793af95Ssangeeta /* 1593c793af95Ssangeeta * more CONDEMNED entries could have 1594c793af95Ssangeeta * been added while we dropped the lock, 1595c793af95Ssangeeta * so we have to re-check. 1596c793af95Ssangeeta */ 1597c793af95Ssangeeta continue; 1598c793af95Ssangeeta } 1599c793af95Ssangeeta 1600c793af95Ssangeeta /* 1601c793af95Ssangeeta * Now check if there are still any ires 1602c793af95Ssangeeta * associated with this radix node. 1603c793af95Ssangeeta */ 1604c793af95Ssangeeta if (irb->irb_nire != 0) { 1605c793af95Ssangeeta /* 1606c793af95Ssangeeta * someone is still holding on 1607c793af95Ssangeeta * to ires in this bucket 1608c793af95Ssangeeta */ 1609c793af95Ssangeeta irb->irb_refcnt--; 1610c793af95Ssangeeta rw_exit(&irb->irb_lock); 1611c793af95Ssangeeta return; 1612c793af95Ssangeeta } else { 1613c793af95Ssangeeta /* 1614c793af95Ssangeeta * Everything is clear. Zero walkers, 1615c793af95Ssangeeta * Zero threads with a ref to this 1616c793af95Ssangeeta * radix node, Zero ires associated with 1617c793af95Ssangeeta * this radix node. Due to lock order, 1618c793af95Ssangeeta * check the above conditions again 1619c793af95Ssangeeta * after grabbing all locks in the right order 1620c793af95Ssangeeta */ 1621c793af95Ssangeeta rw_exit(&irb->irb_lock); 1622c793af95Ssangeeta if (irb_inactive(irb)) 1623c793af95Ssangeeta return; 1624c793af95Ssangeeta /* 1625c793af95Ssangeeta * irb_inactive could not free the irb. 1626c793af95Ssangeeta * See if there are any walkers, if not 1627c793af95Ssangeeta * try to clean up again. 1628c793af95Ssangeeta */ 1629c793af95Ssangeeta } 1630c793af95Ssangeeta } 1631c793af95Ssangeeta } 1632c793af95Ssangeeta } 1633c793af95Ssangeeta 1634c793af95Ssangeeta /* 1635c793af95Ssangeeta * IRE iterator used by ire_ftable_lookup() to process multiple default 1636c793af95Ssangeeta * routes. Given a starting point in the hash list (ire_origin), walk the IREs 1637c793af95Ssangeeta * in the bucket skipping default interface routes and deleted entries. 1638c793af95Ssangeeta * Returns the next IRE (unheld), or NULL when we're back to the starting point. 1639c793af95Ssangeeta * Assumes that the caller holds a reference on the IRE bucket. 1640c793af95Ssangeeta * 1641c793af95Ssangeeta * In the absence of good IRE_DEFAULT routes, this function will return 1642c793af95Ssangeeta * the first IRE_INTERFACE route found (if any). 1643c793af95Ssangeeta */ 1644c793af95Ssangeeta ire_t * 1645*f4b3ec61Sdh155122 ire_round_robin(irb_t *irb_ptr, zoneid_t zoneid, ire_ftable_args_t *margs, 1646*f4b3ec61Sdh155122 ip_stack_t *ipst) 1647c793af95Ssangeeta { 1648c793af95Ssangeeta ire_t *ire_origin; 1649c793af95Ssangeeta ire_t *ire, *maybe_ire = NULL; 1650c793af95Ssangeeta 1651c793af95Ssangeeta rw_enter(&irb_ptr->irb_lock, RW_WRITER); 1652c793af95Ssangeeta ire_origin = irb_ptr->irb_rr_origin; 16530ad1ccddSsowmini if (ire_origin != NULL) { 1654c793af95Ssangeeta ire_origin = ire_origin->ire_next; 16550ad1ccddSsowmini IRE_FIND_NEXT_ORIGIN(ire_origin); 16560ad1ccddSsowmini } 1657c793af95Ssangeeta 1658c793af95Ssangeeta if (ire_origin == NULL) { 1659c793af95Ssangeeta /* 1660c793af95Ssangeeta * first time through routine, or we dropped off the end 1661c793af95Ssangeeta * of list. 1662c793af95Ssangeeta */ 1663c793af95Ssangeeta ire_origin = irb_ptr->irb_ire; 16640ad1ccddSsowmini IRE_FIND_NEXT_ORIGIN(ire_origin); 1665c793af95Ssangeeta } 1666c793af95Ssangeeta irb_ptr->irb_rr_origin = ire_origin; 1667c793af95Ssangeeta IRB_REFHOLD_LOCKED(irb_ptr); 1668c793af95Ssangeeta rw_exit(&irb_ptr->irb_lock); 1669c793af95Ssangeeta 16700ad1ccddSsowmini DTRACE_PROBE2(ire__rr__origin, (irb_t *), irb_ptr, 16710ad1ccddSsowmini (ire_t *), ire_origin); 16720ad1ccddSsowmini 1673c793af95Ssangeeta /* 1674c793af95Ssangeeta * Round-robin the routers list looking for a route that 1675c793af95Ssangeeta * matches the passed in parameters. 1676c793af95Ssangeeta * We start with the ire we found above and we walk the hash 1677c793af95Ssangeeta * list until we're back where we started. It doesn't matter if 1678c793af95Ssangeeta * routes are added or deleted by other threads - we know this 1679c793af95Ssangeeta * ire will stay in the list because we hold a reference on the 1680c793af95Ssangeeta * ire bucket. 1681c793af95Ssangeeta */ 1682c793af95Ssangeeta ire = ire_origin; 1683c793af95Ssangeeta while (ire != NULL) { 1684c793af95Ssangeeta int match_flags = 0; 1685c793af95Ssangeeta ire_t *rire; 1686c793af95Ssangeeta 1687c793af95Ssangeeta if (ire->ire_marks & IRE_MARK_CONDEMNED) 1688c793af95Ssangeeta goto next_ire; 1689c793af95Ssangeeta 1690c793af95Ssangeeta if (!ire_match_args(ire, margs->ift_addr, (ipaddr_t)0, 1691c793af95Ssangeeta margs->ift_gateway, margs->ift_type, margs->ift_ipif, 1692c793af95Ssangeeta margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl, 1693c793af95Ssangeeta margs->ift_flags)) 1694c793af95Ssangeeta goto next_ire; 1695c793af95Ssangeeta 1696c793af95Ssangeeta if (ire->ire_type & IRE_INTERFACE) { 1697c793af95Ssangeeta /* 1698c793af95Ssangeeta * keep looking to see if there is a non-interface 1699c793af95Ssangeeta * default ire, but save this one as a last resort. 1700c793af95Ssangeeta */ 1701c793af95Ssangeeta if (maybe_ire == NULL) 1702c793af95Ssangeeta maybe_ire = ire; 1703c793af95Ssangeeta goto next_ire; 1704c793af95Ssangeeta } 1705c793af95Ssangeeta 1706c793af95Ssangeeta if (zoneid == ALL_ZONES) { 1707c793af95Ssangeeta IRE_REFHOLD(ire); 1708c793af95Ssangeeta IRB_REFRELE(irb_ptr); 1709c793af95Ssangeeta return (ire); 1710c793af95Ssangeeta } 1711c793af95Ssangeeta /* 1712c793af95Ssangeeta * When we're in a local zone, we're only 1713c793af95Ssangeeta * interested in routers that are 1714c793af95Ssangeeta * reachable through ipifs within our zone. 1715c793af95Ssangeeta */ 1716c793af95Ssangeeta if (ire->ire_ipif != NULL) { 1717c793af95Ssangeeta match_flags |= MATCH_IRE_ILL_GROUP; 1718c793af95Ssangeeta } 1719c793af95Ssangeeta rire = ire_route_lookup(ire->ire_gateway_addr, 1720c793af95Ssangeeta 0, 0, 0, ire->ire_ipif, NULL, zoneid, margs->ift_tsl, 1721*f4b3ec61Sdh155122 match_flags, ipst); 1722c793af95Ssangeeta if (rire != NULL) { 1723c793af95Ssangeeta ire_refrele(rire); 1724c793af95Ssangeeta IRE_REFHOLD(ire); 1725c793af95Ssangeeta IRB_REFRELE(irb_ptr); 1726c793af95Ssangeeta return (ire); 1727c793af95Ssangeeta } 1728c793af95Ssangeeta next_ire: 1729c793af95Ssangeeta ire = (ire->ire_next ? ire->ire_next : irb_ptr->irb_ire); 1730c793af95Ssangeeta if (ire == ire_origin) 1731c793af95Ssangeeta break; 1732c793af95Ssangeeta } 1733c793af95Ssangeeta if (maybe_ire != NULL) 1734c793af95Ssangeeta IRE_REFHOLD(maybe_ire); 1735c793af95Ssangeeta IRB_REFRELE(irb_ptr); 1736c793af95Ssangeeta return (maybe_ire); 1737c793af95Ssangeeta } 17382679e103Ssowmini 17392679e103Ssowmini void 17402679e103Ssowmini irb_refhold_rn(struct radix_node *rn) 17412679e103Ssowmini { 17422679e103Ssowmini if ((rn->rn_flags & RNF_ROOT) == 0) 17432679e103Ssowmini IRB_REFHOLD(&((rt_t *)(rn))->rt_irb); 17442679e103Ssowmini } 17452679e103Ssowmini 17462679e103Ssowmini void 17472679e103Ssowmini irb_refrele_rn(struct radix_node *rn) 17482679e103Ssowmini { 17492679e103Ssowmini if ((rn->rn_flags & RNF_ROOT) == 0) 17502679e103Ssowmini irb_refrele_ftable(&((rt_t *)(rn))->rt_irb); 17512679e103Ssowmini } 1752