xref: /illumos-gate/usr/src/uts/common/inet/ip/ip_ftable.c (revision bcd524b5c10222cf2a1ef37ac7ea8bf1baa3a2ee)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 /*
29  * This file contains consumer routines of the IPv4 forwarding engine
30  */
31 
32 #include <sys/types.h>
33 #include <sys/stream.h>
34 #include <sys/stropts.h>
35 #include <sys/strlog.h>
36 #include <sys/dlpi.h>
37 #include <sys/ddi.h>
38 #include <sys/cmn_err.h>
39 #include <sys/policy.h>
40 
41 #include <sys/systm.h>
42 #include <sys/strsun.h>
43 #include <sys/kmem.h>
44 #include <sys/param.h>
45 #include <sys/socket.h>
46 #include <net/if.h>
47 #include <net/route.h>
48 #include <netinet/in.h>
49 #include <net/if_dl.h>
50 #include <netinet/ip6.h>
51 #include <netinet/icmp6.h>
52 
53 #include <inet/common.h>
54 #include <inet/mi.h>
55 #include <inet/mib2.h>
56 #include <inet/ip.h>
57 #include <inet/ip6.h>
58 #include <inet/ip_ndp.h>
59 #include <inet/arp.h>
60 #include <inet/ip_if.h>
61 #include <inet/ip_ire.h>
62 #include <inet/ip_ftable.h>
63 #include <inet/ip_rts.h>
64 #include <inet/nd.h>
65 
66 #include <net/pfkeyv2.h>
67 #include <inet/ipsec_info.h>
68 #include <inet/sadb.h>
69 #include <sys/kmem.h>
70 #include <inet/tcp.h>
71 #include <inet/ipclassifier.h>
72 #include <sys/zone.h>
73 #include <net/radix.h>
74 #include <sys/tsol/label.h>
75 #include <sys/tsol/tnet.h>
76 
77 #define	IS_DEFAULT_ROUTE(ire)	\
78 	(((ire)->ire_type & IRE_DEFAULT) || \
79 	    (((ire)->ire_type & IRE_INTERFACE) && ((ire)->ire_addr == 0)))
80 
81 /*
82  * structure for passing args between ire_ftable_lookup and ire_find_best_route
83  */
84 typedef struct ire_ftable_args_s {
85 	ipaddr_t	ift_addr;
86 	ipaddr_t	ift_mask;
87 	ipaddr_t	ift_gateway;
88 	int		ift_type;
89 	const ipif_t		*ift_ipif;
90 	zoneid_t	ift_zoneid;
91 	uint32_t	ift_ihandle;
92 	const ts_label_t	*ift_tsl;
93 	int		ift_flags;
94 	ire_t		*ift_best_ire;
95 } ire_ftable_args_t;
96 
97 static ire_t	*route_to_dst(const struct sockaddr *, zoneid_t, ip_stack_t *);
98 static ire_t   	*ire_round_robin(irb_t *, zoneid_t, ire_ftable_args_t *,
99     ip_stack_t *);
100 static void		ire_del_host_redir(ire_t *, char *);
101 static boolean_t	ire_find_best_route(struct radix_node *, void *);
102 
103 /*
104  * Lookup a route in forwarding table. A specific lookup is indicated by
105  * passing the required parameters and indicating the match required in the
106  * flag field.
107  *
108  * Looking for default route can be done in three ways
109  * 1) pass mask as 0 and set MATCH_IRE_MASK in flags field
110  *    along with other matches.
111  * 2) pass type as IRE_DEFAULT and set MATCH_IRE_TYPE in flags
112  *    field along with other matches.
113  * 3) if the destination and mask are passed as zeros.
114  *
115  * A request to return a default route if no route
116  * is found, can be specified by setting MATCH_IRE_DEFAULT
117  * in flags.
118  *
119  * It does not support recursion more than one level. It
120  * will do recursive lookup only when the lookup maps to
121  * a prefix or default route and MATCH_IRE_RECURSIVE flag is passed.
122  *
123  * If the routing table is setup to allow more than one level
124  * of recursion, the cleaning up cache table will not work resulting
125  * in invalid routing.
126  *
127  * Supports IP_BOUND_IF by following the ipif/ill when recursing.
128  *
129  * NOTE : When this function returns NULL, pire has already been released.
130  *	  pire is valid only when this function successfully returns an
131  *	  ire.
132  */
133 ire_t *
134 ire_ftable_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway,
135     int type, const ipif_t *ipif, ire_t **pire, zoneid_t zoneid,
136     uint32_t ihandle, const ts_label_t *tsl, int flags, ip_stack_t *ipst)
137 {
138 	ire_t *ire = NULL;
139 	ipaddr_t gw_addr;
140 	struct rt_sockaddr rdst, rmask;
141 	struct rt_entry *rt;
142 	ire_ftable_args_t margs;
143 	boolean_t found_incomplete = B_FALSE;
144 
145 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
146 	ASSERT(!(flags & MATCH_IRE_WQ));
147 
148 	/*
149 	 * When we return NULL from this function, we should make
150 	 * sure that *pire is NULL so that the callers will not
151 	 * wrongly REFRELE the pire.
152 	 */
153 	if (pire != NULL)
154 		*pire = NULL;
155 	/*
156 	 * ire_match_args() will dereference ipif MATCH_IRE_SRC or
157 	 * MATCH_IRE_ILL is set.
158 	 */
159 	if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) &&
160 	    (ipif == NULL))
161 		return (NULL);
162 
163 	(void) memset(&rdst, 0, sizeof (rdst));
164 	rdst.rt_sin_len = sizeof (rdst);
165 	rdst.rt_sin_family = AF_INET;
166 	rdst.rt_sin_addr.s_addr = addr;
167 
168 	(void) memset(&rmask, 0, sizeof (rmask));
169 	rmask.rt_sin_len = sizeof (rmask);
170 	rmask.rt_sin_family = AF_INET;
171 	rmask.rt_sin_addr.s_addr = mask;
172 
173 	(void) memset(&margs, 0, sizeof (margs));
174 	margs.ift_addr = addr;
175 	margs.ift_mask = mask;
176 	margs.ift_gateway = gateway;
177 	margs.ift_type = type;
178 	margs.ift_ipif = ipif;
179 	margs.ift_zoneid = zoneid;
180 	margs.ift_ihandle = ihandle;
181 	margs.ift_tsl = tsl;
182 	margs.ift_flags = flags;
183 
184 	/*
185 	 * The flags argument passed to ire_ftable_lookup may cause the
186 	 * search to return, not the longest matching prefix, but the
187 	 * "best matching prefix", i.e., the longest prefix that also
188 	 * satisfies constraints imposed via the permutation of flags
189 	 * passed in. To achieve this, we invoke ire_match_args() on
190 	 * each matching leaf in the  radix tree. ire_match_args is
191 	 * invoked by the callback function ire_find_best_route()
192 	 * We hold the global tree lock in read mode when calling
193 	 * rn_match_args.Before dropping the global tree lock, ensure
194 	 * that the radix node can't be deleted by incrementing ire_refcnt.
195 	 */
196 	RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable);
197 	rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst,
198 	    ipst->ips_ip_ftable, ire_find_best_route, &margs);
199 	ire = margs.ift_best_ire;
200 	RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
201 
202 	if (rt == NULL) {
203 		return (NULL);
204 	} else {
205 		ASSERT(ire != NULL);
206 	}
207 
208 	DTRACE_PROBE2(ire__found, ire_ftable_args_t *, &margs, ire_t *, ire);
209 
210 	if (!IS_DEFAULT_ROUTE(ire))
211 		goto found_ire_held;
212 	/*
213 	 * If default route is found, see if default matching criteria
214 	 * are satisfied.
215 	 */
216 	if (flags & MATCH_IRE_MASK) {
217 		/*
218 		 * we were asked to match a 0 mask, and came back with
219 		 * a default route. Ok to return it.
220 		 */
221 		goto found_default_ire;
222 	}
223 	if ((flags & MATCH_IRE_TYPE) &&
224 	    (type & (IRE_DEFAULT | IRE_INTERFACE))) {
225 		/*
226 		 * we were asked to match a default ire type. Ok to return it.
227 		 */
228 		goto found_default_ire;
229 	}
230 	if (flags & MATCH_IRE_DEFAULT) {
231 		goto found_default_ire;
232 	}
233 	/*
234 	 * we found a default route, but default matching criteria
235 	 * are not specified and we are not explicitly looking for
236 	 * default.
237 	 */
238 	IRE_REFRELE(ire);
239 	return (NULL);
240 found_default_ire:
241 	/*
242 	 * round-robin only if we have more than one route in the bucket.
243 	 */
244 	if ((ire->ire_bucket->irb_ire_cnt > 1) &&
245 	    IS_DEFAULT_ROUTE(ire) &&
246 	    ((flags & (MATCH_IRE_DEFAULT | MATCH_IRE_MASK)) ==
247 	    MATCH_IRE_DEFAULT)) {
248 		ire_t *next_ire;
249 
250 		next_ire = ire_round_robin(ire->ire_bucket, zoneid, &margs,
251 		    ipst);
252 		IRE_REFRELE(ire);
253 		if (next_ire != NULL) {
254 			ire = next_ire;
255 		} else {
256 			/* no route */
257 			return (NULL);
258 		}
259 	}
260 found_ire_held:
261 	ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL);
262 	if ((flags & MATCH_IRE_RJ_BHOLE) &&
263 	    (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) {
264 		return (ire);
265 	}
266 	/*
267 	 * At this point, IRE that was found must be an IRE_FORWARDTABLE
268 	 * type.  If this is a recursive lookup and an IRE_INTERFACE type was
269 	 * found, return that.  If it was some other IRE_FORWARDTABLE type of
270 	 * IRE (one of the prefix types), then it is necessary to fill in the
271 	 * parent IRE pointed to by pire, and then lookup the gateway address of
272 	 * the parent.  For backwards compatiblity, if this lookup returns an
273 	 * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level
274 	 * of lookup is done.
275 	 */
276 	if (flags & MATCH_IRE_RECURSIVE) {
277 		ipif_t	*gw_ipif;
278 		int match_flags = MATCH_IRE_DSTONLY;
279 		ire_t *save_ire;
280 
281 		if (ire->ire_type & IRE_INTERFACE)
282 			return (ire);
283 		if (pire != NULL)
284 			*pire = ire;
285 		/*
286 		 * If we can't find an IRE_INTERFACE or the caller has not
287 		 * asked for pire, we need to REFRELE the save_ire.
288 		 */
289 		save_ire = ire;
290 
291 		/*
292 		 * Currently MATCH_IRE_ILL is never used with
293 		 * (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT) while
294 		 * sending out packets as MATCH_IRE_ILL is used only
295 		 * for communicating with on-link hosts. We can't assert
296 		 * that here as RTM_GET calls this function with
297 		 * MATCH_IRE_ILL | MATCH_IRE_DEFAULT | MATCH_IRE_RECURSIVE.
298 		 * We have already used the MATCH_IRE_ILL in determining
299 		 * the right prefix route at this point. To match the
300 		 * behavior of how we locate routes while sending out
301 		 * packets, we don't want to use MATCH_IRE_ILL below
302 		 * while locating the interface route.
303 		 *
304 		 * ire_ftable_lookup may end up with an incomplete IRE_CACHE
305 		 * entry for the gateway (i.e., one for which the
306 		 * ire_nce->nce_state is not yet ND_REACHABLE). If the caller
307 		 * has specified MATCH_IRE_COMPLETE, such entries will not
308 		 * be returned; instead, we return the IF_RESOLVER ire.
309 		 */
310 		if (ire->ire_ipif != NULL)
311 			match_flags |= MATCH_IRE_ILL_GROUP;
312 
313 		ire = ire_route_lookup(ire->ire_gateway_addr, 0, 0, 0,
314 		    ire->ire_ipif, NULL, zoneid, tsl, match_flags, ipst);
315 		DTRACE_PROBE2(ftable__route__lookup1, (ire_t *), ire,
316 		    (ire_t *), save_ire);
317 		if (ire == NULL ||
318 		    ((ire->ire_type & IRE_CACHE) && ire->ire_nce &&
319 		    ire->ire_nce->nce_state != ND_REACHABLE &&
320 		    (flags & MATCH_IRE_COMPLETE))) {
321 			/*
322 			 * Do not release the parent ire if MATCH_IRE_PARENT
323 			 * is set. Also return it via ire.
324 			 */
325 			if (ire != NULL) {
326 				ire_refrele(ire);
327 				ire = NULL;
328 				found_incomplete = B_TRUE;
329 			}
330 			if (flags & MATCH_IRE_PARENT) {
331 				if (pire != NULL) {
332 					/*
333 					 * Need an extra REFHOLD, if the parent
334 					 * ire is returned via both ire and
335 					 * pire.
336 					 */
337 					IRE_REFHOLD(save_ire);
338 				}
339 				ire = save_ire;
340 			} else {
341 				ire_refrele(save_ire);
342 				if (pire != NULL)
343 					*pire = NULL;
344 			}
345 			if (!found_incomplete)
346 				return (ire);
347 		}
348 		if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) {
349 			/*
350 			 * If the caller did not ask for pire, release
351 			 * it now.
352 			 */
353 			if (pire == NULL) {
354 				ire_refrele(save_ire);
355 			}
356 			return (ire);
357 		}
358 		match_flags |= MATCH_IRE_TYPE;
359 		gw_addr = ire->ire_gateway_addr;
360 		gw_ipif = ire->ire_ipif;
361 		ire_refrele(ire);
362 		ire = ire_route_lookup(gw_addr, 0, 0,
363 		    (found_incomplete? IRE_INTERFACE :
364 		    (IRE_CACHETABLE | IRE_INTERFACE)),
365 		    gw_ipif, NULL, zoneid, tsl, match_flags, ipst);
366 		DTRACE_PROBE2(ftable__route__lookup2, (ire_t *), ire,
367 		    (ire_t *), save_ire);
368 		if (ire == NULL ||
369 		    ((ire->ire_type & IRE_CACHE) && ire->ire_nce &&
370 		    ire->ire_nce->nce_state != ND_REACHABLE &&
371 		    (flags & MATCH_IRE_COMPLETE))) {
372 			/*
373 			 * Do not release the parent ire if MATCH_IRE_PARENT
374 			 * is set. Also return it via ire.
375 			 */
376 			if (ire != NULL) {
377 				ire_refrele(ire);
378 				ire = NULL;
379 			}
380 			if (flags & MATCH_IRE_PARENT) {
381 				if (pire != NULL) {
382 					/*
383 					 * Need an extra REFHOLD, if the
384 					 * parent ire is returned via both
385 					 * ire and pire.
386 					 */
387 					IRE_REFHOLD(save_ire);
388 				}
389 				ire = save_ire;
390 			} else {
391 				ire_refrele(save_ire);
392 				if (pire != NULL)
393 					*pire = NULL;
394 			}
395 			return (ire);
396 		} else if (pire == NULL) {
397 			/*
398 			 * If the caller did not ask for pire, release
399 			 * it now.
400 			 */
401 			ire_refrele(save_ire);
402 		}
403 		return (ire);
404 	}
405 	ASSERT(pire == NULL || *pire == NULL);
406 	return (ire);
407 }
408 
409 
410 /*
411  * Find an IRE_OFFSUBNET IRE entry for the multicast address 'group'
412  * that goes through 'ipif'. As a fallback, a route that goes through
413  * ipif->ipif_ill can be returned.
414  */
415 ire_t *
416 ipif_lookup_multi_ire(ipif_t *ipif, ipaddr_t group)
417 {
418 	ire_t	*ire;
419 	ire_t	*save_ire = NULL;
420 	ire_t   *gw_ire;
421 	irb_t   *irb;
422 	ipaddr_t gw_addr;
423 	int	match_flags = MATCH_IRE_TYPE | MATCH_IRE_ILL;
424 	ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
425 
426 	ASSERT(CLASSD(group));
427 
428 	ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, ALL_ZONES, 0,
429 	    NULL, MATCH_IRE_DEFAULT, ipst);
430 
431 	if (ire == NULL)
432 		return (NULL);
433 
434 	irb = ire->ire_bucket;
435 	ASSERT(irb);
436 
437 	IRB_REFHOLD(irb);
438 	ire_refrele(ire);
439 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
440 		if (ire->ire_addr != group ||
441 		    ipif->ipif_zoneid != ire->ire_zoneid &&
442 		    ire->ire_zoneid != ALL_ZONES) {
443 			continue;
444 		}
445 
446 		switch (ire->ire_type) {
447 		case IRE_DEFAULT:
448 		case IRE_PREFIX:
449 		case IRE_HOST:
450 			gw_addr = ire->ire_gateway_addr;
451 			gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE,
452 			    ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
453 
454 			if (gw_ire != NULL) {
455 				if (save_ire != NULL) {
456 					ire_refrele(save_ire);
457 				}
458 				IRE_REFHOLD(ire);
459 				if (gw_ire->ire_ipif == ipif) {
460 					ire_refrele(gw_ire);
461 
462 					IRB_REFRELE(irb);
463 					return (ire);
464 				}
465 				ire_refrele(gw_ire);
466 				save_ire = ire;
467 			}
468 			break;
469 		case IRE_IF_NORESOLVER:
470 		case IRE_IF_RESOLVER:
471 			if (ire->ire_ipif == ipif) {
472 				if (save_ire != NULL) {
473 					ire_refrele(save_ire);
474 				}
475 				IRE_REFHOLD(ire);
476 
477 				IRB_REFRELE(irb);
478 				return (ire);
479 			}
480 			break;
481 		}
482 	}
483 	IRB_REFRELE(irb);
484 
485 	return (save_ire);
486 }
487 
488 /*
489  * Find an IRE_INTERFACE for the multicast group.
490  * Allows different routes for multicast addresses
491  * in the unicast routing table (akin to 224.0.0.0 but could be more specific)
492  * which point at different interfaces. This is used when IP_MULTICAST_IF
493  * isn't specified (when sending) and when IP_ADD_MEMBERSHIP doesn't
494  * specify the interface to join on.
495  *
496  * Supports IP_BOUND_IF by following the ipif/ill when recursing.
497  */
498 ire_t *
499 ire_lookup_multi(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst)
500 {
501 	ire_t	*ire;
502 	ipif_t	*ipif = NULL;
503 	int	match_flags = MATCH_IRE_TYPE;
504 	ipaddr_t gw_addr;
505 
506 	ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, zoneid,
507 	    0, NULL, MATCH_IRE_DEFAULT, ipst);
508 
509 	/* We search a resolvable ire in case of multirouting. */
510 	if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) {
511 		ire_t *cire = NULL;
512 		/*
513 		 * If the route is not resolvable, the looked up ire
514 		 * may be changed here. In that case, ire_multirt_lookup()
515 		 * IRE_REFRELE the original ire and change it.
516 		 */
517 		(void) ire_multirt_lookup(&cire, &ire, MULTIRT_CACHEGW,
518 		    NULL, ipst);
519 		if (cire != NULL)
520 			ire_refrele(cire);
521 	}
522 	if (ire == NULL)
523 		return (NULL);
524 	/*
525 	 * Make sure we follow ire_ipif.
526 	 *
527 	 * We need to determine the interface route through
528 	 * which the gateway will be reached. We don't really
529 	 * care which interface is picked if the interface is
530 	 * part of a group.
531 	 */
532 	if (ire->ire_ipif != NULL) {
533 		ipif = ire->ire_ipif;
534 		match_flags |= MATCH_IRE_ILL_GROUP;
535 	}
536 
537 	switch (ire->ire_type) {
538 	case IRE_DEFAULT:
539 	case IRE_PREFIX:
540 	case IRE_HOST:
541 		gw_addr = ire->ire_gateway_addr;
542 		ire_refrele(ire);
543 		ire = ire_ftable_lookup(gw_addr, 0, 0,
544 		    IRE_INTERFACE, ipif, NULL, zoneid, 0,
545 		    NULL, match_flags, ipst);
546 		return (ire);
547 	case IRE_IF_NORESOLVER:
548 	case IRE_IF_RESOLVER:
549 		return (ire);
550 	default:
551 		ire_refrele(ire);
552 		return (NULL);
553 	}
554 }
555 
556 /*
557  * Delete the passed in ire if the gateway addr matches
558  */
559 void
560 ire_del_host_redir(ire_t *ire, char *gateway)
561 {
562 	if ((ire->ire_flags & RTF_DYNAMIC) &&
563 	    (ire->ire_gateway_addr == *(ipaddr_t *)gateway))
564 		ire_delete(ire);
565 }
566 
567 /*
568  * Search for all HOST REDIRECT routes that are
569  * pointing at the specified gateway and
570  * delete them. This routine is called only
571  * when a default gateway is going away.
572  */
573 void
574 ire_delete_host_redirects(ipaddr_t gateway, ip_stack_t *ipst)
575 {
576 	struct rtfuncarg rtfarg;
577 
578 	(void) memset(&rtfarg, 0, sizeof (rtfarg));
579 	rtfarg.rt_func = ire_del_host_redir;
580 	rtfarg.rt_arg = (void *)&gateway;
581 	(void) ipst->ips_ip_ftable->rnh_walktree_mt(ipst->ips_ip_ftable,
582 	    rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn);
583 }
584 
585 struct ihandle_arg {
586 	uint32_t ihandle;
587 	ire_t	 *ire;
588 };
589 
590 static int
591 ire_ihandle_onlink_match(struct radix_node *rn, void *arg)
592 {
593 	struct rt_entry *rt;
594 	irb_t *irb;
595 	ire_t *ire;
596 	struct ihandle_arg *ih = arg;
597 
598 	rt = (struct rt_entry *)rn;
599 	ASSERT(rt != NULL);
600 	irb = &rt->rt_irb;
601 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
602 		if ((ire->ire_type & IRE_INTERFACE) &&
603 		    (ire->ire_ihandle == ih->ihandle)) {
604 			ih->ire = ire;
605 			IRE_REFHOLD(ire);
606 			return (1);
607 		}
608 	}
609 	return (0);
610 }
611 
612 /*
613  * Locate the interface ire that is tied to the cache ire 'cire' via
614  * cire->ire_ihandle.
615  *
616  * We are trying to create the cache ire for an onlink destn. or
617  * gateway in 'cire'. We are called from ire_add_v4() in the IRE_IF_RESOLVER
618  * case, after the ire has come back from ARP.
619  */
620 ire_t *
621 ire_ihandle_lookup_onlink(ire_t *cire)
622 {
623 	ire_t	*ire;
624 	int	match_flags;
625 	struct ihandle_arg ih;
626 	ip_stack_t *ipst;
627 
628 	ASSERT(cire != NULL);
629 	ipst = cire->ire_ipst;
630 
631 	/*
632 	 * We don't need to specify the zoneid to ire_ftable_lookup() below
633 	 * because the ihandle refers to an ipif which can be in only one zone.
634 	 */
635 	match_flags =  MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK;
636 	/*
637 	 * We know that the mask of the interface ire equals cire->ire_cmask.
638 	 * (When ip_newroute() created 'cire' for an on-link destn. it set its
639 	 * cmask from the interface ire's mask)
640 	 */
641 	ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0,
642 	    IRE_INTERFACE, NULL, NULL, ALL_ZONES, cire->ire_ihandle,
643 	    NULL, match_flags, ipst);
644 	if (ire != NULL)
645 		return (ire);
646 	/*
647 	 * If we didn't find an interface ire above, we can't declare failure.
648 	 * For backwards compatibility, we need to support prefix routes
649 	 * pointing to next hop gateways that are not on-link.
650 	 *
651 	 * In the resolver/noresolver case, ip_newroute() thinks it is creating
652 	 * the cache ire for an onlink destination in 'cire'. But 'cire' is
653 	 * not actually onlink, because ire_ftable_lookup() cheated it, by
654 	 * doing ire_route_lookup() twice and returning an interface ire.
655 	 *
656 	 * Eg. default	-	gw1			(line 1)
657 	 *	gw1	-	gw2			(line 2)
658 	 *	gw2	-	hme0			(line 3)
659 	 *
660 	 * In the above example, ip_newroute() tried to create the cache ire
661 	 * 'cire' for gw1, based on the interface route in line 3. The
662 	 * ire_ftable_lookup() above fails, because there is no interface route
663 	 * to reach gw1. (it is gw2). We fall thru below.
664 	 *
665 	 * Do a brute force search based on the ihandle in a subset of the
666 	 * forwarding tables, corresponding to cire->ire_cmask. Otherwise
667 	 * things become very complex, since we don't have 'pire' in this
668 	 * case. (Also note that this method is not possible in the offlink
669 	 * case because we don't know the mask)
670 	 */
671 	(void) memset(&ih, 0, sizeof (ih));
672 	ih.ihandle = cire->ire_ihandle;
673 	(void) ipst->ips_ip_ftable->rnh_walktree_mt(ipst->ips_ip_ftable,
674 	    ire_ihandle_onlink_match, &ih, irb_refhold_rn, irb_refrele_rn);
675 	return (ih.ire);
676 }
677 
678 /*
679  * IRE iterator used by ire_ftable_lookup[_v6]() to process multiple default
680  * routes. Given a starting point in the hash list (ire_origin), walk the IREs
681  * in the bucket skipping default interface routes and deleted entries.
682  * Returns the next IRE (unheld), or NULL when we're back to the starting point.
683  * Assumes that the caller holds a reference on the IRE bucket.
684  */
685 ire_t *
686 ire_get_next_default_ire(ire_t *ire, ire_t *ire_origin)
687 {
688 	ASSERT(ire_origin->ire_bucket != NULL);
689 	ASSERT(ire != NULL);
690 
691 	do {
692 		ire = ire->ire_next;
693 		if (ire == NULL)
694 			ire = ire_origin->ire_bucket->irb_ire;
695 		if (ire == ire_origin)
696 			return (NULL);
697 	} while ((ire->ire_type & IRE_INTERFACE) ||
698 	    (ire->ire_marks & IRE_MARK_CONDEMNED));
699 	ASSERT(ire != NULL);
700 	return (ire);
701 }
702 
703 static ipif_t *
704 ire_forward_src_ipif(ipaddr_t dst, ire_t *sire, ire_t *ire, ill_t *dst_ill,
705     int zoneid, ushort_t *marks)
706 {
707 	ipif_t *src_ipif;
708 	ip_stack_t *ipst = dst_ill->ill_ipst;
709 
710 	/*
711 	 * Pick the best source address from dst_ill.
712 	 *
713 	 * 1) If it is part of a multipathing group, we would
714 	 *    like to spread the inbound packets across different
715 	 *    interfaces. ipif_select_source picks a random source
716 	 *    across the different ills in the group.
717 	 *
718 	 * 2) If it is not part of a multipathing group, we try
719 	 *    to pick the source address from the destination
720 	 *    route. Clustering assumes that when we have multiple
721 	 *    prefixes hosted on an interface, the prefix of the
722 	 *    source address matches the prefix of the destination
723 	 *    route. We do this only if the address is not
724 	 *    DEPRECATED.
725 	 *
726 	 * 3) If the conn is in a different zone than the ire, we
727 	 *    need to pick a source address from the right zone.
728 	 *
729 	 * NOTE : If we hit case (1) above, the prefix of the source
730 	 *	  address picked may not match the prefix of the
731 	 *	  destination routes prefix as ipif_select_source
732 	 *	  does not look at "dst" while picking a source
733 	 *	  address.
734 	 *	  If we want the same behavior as (2), we will need
735 	 *	  to change the behavior of ipif_select_source.
736 	 */
737 
738 	if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) {
739 		/*
740 		 * The RTF_SETSRC flag is set in the parent ire (sire).
741 		 * Check that the ipif matching the requested source
742 		 * address still exists.
743 		 */
744 		src_ipif = ipif_lookup_addr(sire->ire_src_addr, NULL,
745 		    zoneid, NULL, NULL, NULL, NULL, ipst);
746 		return (src_ipif);
747 	}
748 	*marks |= IRE_MARK_USESRC_CHECK;
749 	if ((dst_ill->ill_group != NULL) ||
750 	    (ire->ire_ipif->ipif_flags & IPIF_DEPRECATED) ||
751 	    (dst_ill->ill_usesrc_ifindex != 0)) {
752 		src_ipif = ipif_select_source(dst_ill, dst, zoneid);
753 		if (src_ipif == NULL)
754 			return (NULL);
755 
756 	} else {
757 		src_ipif = ire->ire_ipif;
758 		ASSERT(src_ipif != NULL);
759 		/* hold src_ipif for uniformity */
760 		ipif_refhold(src_ipif);
761 	}
762 	return (src_ipif);
763 }
764 
765 /*
766  * This function is called by ip_rput_noire() and ip_fast_forward()
767  * to resolve the route of incoming packet that needs to be forwarded.
768  * If the ire of the nexthop is not already in the cachetable, this
769  * routine will insert it to the table, but won't trigger ARP resolution yet.
770  * Thus unlike ip_newroute, this function adds incomplete ires to
771  * the cachetable. ARP resolution for these ires are  delayed until
772  * after all of the packet processing is completed and its ready to
773  * be sent out on the wire, Eventually, the packet transmit routine
774  * ip_xmit_v4() attempts to send a packet  to the driver. If it finds
775  * that there is no link layer information, it will do the arp
776  * resolution and queue the packet in ire->ire_nce->nce_qd_mp and
777  * then send it out once the arp resolution is over
778  * (see ip_xmit_v4()->ire_arpresolve()). This scheme is similar to
779  * the model of BSD/SunOS 4
780  *
781  * In future, the insertion of incomplete ires in the cachetable should
782  * be implemented in hostpath as well, as doing so will greatly reduce
783  * the existing complexity for code paths that depend on the context of
784  * the sender (such as IPsec).
785  *
786  * Thus this scheme of adding incomplete ires in cachetable in forwarding
787  * path can be used as a template for simplifying the hostpath.
788  */
789 
790 ire_t *
791 ire_forward(ipaddr_t dst, boolean_t *check_multirt, ire_t *supplied_ire,
792     ire_t *supplied_sire, const struct ts_label_s *tsl, ip_stack_t *ipst)
793 {
794 	ipaddr_t gw = 0;
795 	ire_t	*ire = NULL;
796 	ire_t   *sire = NULL, *save_ire;
797 	ill_t *dst_ill = NULL;
798 	int error;
799 	zoneid_t zoneid;
800 	ipif_t *src_ipif = NULL;
801 	mblk_t *res_mp;
802 	ushort_t ire_marks = 0;
803 	tsol_gcgrp_t *gcgrp = NULL;
804 	tsol_gcgrp_addr_t ga;
805 
806 	zoneid = GLOBAL_ZONEID;
807 
808 	if (supplied_ire != NULL) {
809 		/* We have arrived here from ipfil_sendpkt */
810 		ire = supplied_ire;
811 		sire = supplied_sire;
812 		goto create_irecache;
813 	}
814 
815 	ire = ire_ftable_lookup(dst, 0, 0, 0, NULL, &sire, zoneid, 0,
816 	    tsl, MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
817 	    MATCH_IRE_RJ_BHOLE | MATCH_IRE_PARENT|MATCH_IRE_SECATTR, ipst);
818 
819 	if (ire == NULL) {
820 		ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0, RTA_DST, ipst);
821 		goto icmp_err_ret;
822 	}
823 
824 	/*
825 	 * If we encounter CGTP, we should  have the caller use
826 	 * ip_newroute to resolve multirt instead of this function.
827 	 * CGTP specs explicitly state that it can't be used with routers.
828 	 * This essentially prevents insertion of incomplete RTF_MULTIRT
829 	 * ires in cachetable.
830 	 */
831 	if (ip_cgtp_filter &&
832 	    ((ire->ire_flags & RTF_MULTIRT) ||
833 	    ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) {
834 		ip3dbg(("ire_forward: packet is to be multirouted- "
835 		    "handing it to ip_newroute\n"));
836 		if (sire != NULL)
837 			ire_refrele(sire);
838 		ire_refrele(ire);
839 		/*
840 		 * Inform caller about encountering of multirt so that
841 		 * ip_newroute() can be called.
842 		 */
843 		*check_multirt = B_TRUE;
844 		return (NULL);
845 	}
846 
847 	*check_multirt = B_FALSE;
848 
849 	/*
850 	 * Verify that the returned IRE does not have either
851 	 * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is
852 	 * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER.
853 	 */
854 	if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) ||
855 	    (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0) {
856 		ip3dbg(("ire 0x%p is not cache/resolver/noresolver\n",
857 		    (void *)ire));
858 		goto icmp_err_ret;
859 	}
860 
861 	/*
862 	 * If we already have a fully resolved IRE CACHE of the
863 	 * nexthop router, just hand over the cache entry
864 	 * and we are done.
865 	 */
866 
867 	if (ire->ire_type & IRE_CACHE) {
868 
869 		/*
870 		 * If we are using this ire cache entry as a
871 		 * gateway to forward packets, chances are we
872 		 * will be using it again. So turn off
873 		 * the temporary flag, thus reducing its
874 		 * chances of getting deleted frequently.
875 		 */
876 		if (ire->ire_marks & IRE_MARK_TEMPORARY) {
877 			irb_t *irb = ire->ire_bucket;
878 			rw_enter(&irb->irb_lock, RW_WRITER);
879 			ire->ire_marks &= ~IRE_MARK_TEMPORARY;
880 			irb->irb_tmp_ire_cnt--;
881 			rw_exit(&irb->irb_lock);
882 		}
883 
884 		if (sire != NULL) {
885 			UPDATE_OB_PKT_COUNT(sire);
886 			sire->ire_last_used_time = lbolt;
887 			ire_refrele(sire);
888 		}
889 		return (ire);
890 	}
891 create_irecache:
892 	/*
893 	 * Increment the ire_ob_pkt_count field for ire if it is an
894 	 * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and
895 	 * increment the same for the parent IRE, sire, if it is some
896 	 * sort of prefix IRE (which includes DEFAULT, PREFIX, HOST
897 	 * and HOST_REDIRECT).
898 	 */
899 	if ((ire->ire_type & IRE_INTERFACE) != 0) {
900 		UPDATE_OB_PKT_COUNT(ire);
901 		ire->ire_last_used_time = lbolt;
902 	}
903 
904 	/*
905 	 * sire must be either IRE_CACHETABLE OR IRE_INTERFACE type
906 	 */
907 	if (sire != NULL) {
908 		gw = sire->ire_gateway_addr;
909 		ASSERT((sire->ire_type &
910 		    (IRE_CACHETABLE | IRE_INTERFACE)) == 0);
911 		UPDATE_OB_PKT_COUNT(sire);
912 		sire->ire_last_used_time = lbolt;
913 	}
914 
915 	/* Obtain dst_ill */
916 	dst_ill = ip_newroute_get_dst_ill(ire->ire_ipif->ipif_ill);
917 	if (dst_ill == NULL) {
918 		ip2dbg(("ire_forward no dst ill; ire 0x%p\n",
919 			(void *)ire));
920 		goto icmp_err_ret;
921 	}
922 
923 	ASSERT(src_ipif == NULL);
924 	/* Now obtain the src_ipif */
925 	src_ipif = ire_forward_src_ipif(dst, sire, ire, dst_ill,
926 	    zoneid, &ire_marks);
927 	if (src_ipif == NULL)
928 		goto icmp_err_ret;
929 
930 	switch (ire->ire_type) {
931 	case IRE_IF_NORESOLVER:
932 		/* create ire_cache for ire_addr endpoint */
933 	case IRE_IF_RESOLVER:
934 		/*
935 		 * We have the IRE_IF_RESOLVER of the nexthop gateway
936 		 * and now need to build a IRE_CACHE for it.
937 		 * In this case, we have the following :
938 		 *
939 		 * 1) src_ipif - used for getting a source address.
940 		 *
941 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
942 		 *    means packets using the IRE_CACHE that we will build
943 		 *    here will go out on dst_ill.
944 		 *
945 		 * 3) sire may or may not be NULL. But, the IRE_CACHE that is
946 		 *    to be created will only be tied to the IRE_INTERFACE
947 		 *    that was derived from the ire_ihandle field.
948 		 *
949 		 *    If sire is non-NULL, it means the destination is
950 		 *    off-link and we will first create the IRE_CACHE for the
951 		 *    gateway.
952 		 */
953 		res_mp = dst_ill->ill_resolver_mp;
954 		if (ire->ire_type == IRE_IF_RESOLVER &&
955 		    (!OK_RESOLVER_MP(res_mp))) {
956 			ire_refrele(ire);
957 			ire = NULL;
958 			goto out;
959 		}
960 		/*
961 		 * To be at this point in the code with a non-zero gw
962 		 * means that dst is reachable through a gateway that
963 		 * we have never resolved.  By changing dst to the gw
964 		 * addr we resolve the gateway first.
965 		 */
966 		if (gw != INADDR_ANY) {
967 			/*
968 			 * The source ipif that was determined above was
969 			 * relative to the destination address, not the
970 			 * gateway's. If src_ipif was not taken out of
971 			 * the IRE_IF_RESOLVER entry, we'll need to call
972 			 * ipif_select_source() again.
973 			 */
974 			if (src_ipif != ire->ire_ipif) {
975 				ipif_refrele(src_ipif);
976 				src_ipif = ipif_select_source(dst_ill,
977 				    gw, zoneid);
978 				if (src_ipif == NULL)
979 					goto icmp_err_ret;
980 			}
981 			dst = gw;
982 			gw = INADDR_ANY;
983 		}
984 		/*
985 		 * dst has been set to the address of the nexthop.
986 		 *
987 		 * TSol note: get security attributes of the nexthop;
988 		 * Note that the nexthop may either be a gateway, or the
989 		 * packet destination itself; Detailed explanation of
990 		 * issues involved is  provided in the  IRE_IF_NORESOLVER
991 		 * logic in ip_newroute().
992 		 */
993 		ga.ga_af = AF_INET;
994 		IN6_IPADDR_TO_V4MAPPED(dst, &ga.ga_addr);
995 		gcgrp = gcgrp_lookup(&ga, B_FALSE);
996 
997 		if (ire->ire_type == IRE_IF_NORESOLVER)
998 			dst = ire->ire_addr; /* ire_cache for tunnel endpoint */
999 
1000 		save_ire = ire;
1001 		/*
1002 		 * create an incomplete ire-cache with a null dlureq_mp.
1003 		 * The dlureq_mp will be created in ire_arpresolve.
1004 		 */
1005 		ire = ire_create(
1006 			(uchar_t *)&dst,		/* dest address */
1007 		    (uchar_t *)&ip_g_all_ones,	/* mask */
1008 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
1009 		    (uchar_t *)&gw,		/* gateway address */
1010 		    NULL,
1011 		    (save_ire->ire_type == IRE_IF_RESOLVER ?  NULL:
1012 		    &save_ire->ire_max_frag),
1013 		    NULL,
1014 		    dst_ill->ill_rq,		/* recv-from queue */
1015 		    dst_ill->ill_wq,		/* send-to queue */
1016 		    IRE_CACHE,			/* IRE type */
1017 		    NULL,
1018 		    src_ipif,
1019 		    NULL,
1020 		    ire->ire_mask,		/* Parent mask */
1021 		    0,
1022 		    ire->ire_ihandle,	/* Interface handle */
1023 		    0,
1024 		    &(ire->ire_uinfo),
1025 		    NULL,
1026 		    gcgrp,
1027 		    ipst);
1028 		ip1dbg(("incomplete ire_cache 0x%p\n", (void *)ire));
1029 		if (ire != NULL) {
1030 			gcgrp = NULL; /* reference now held by IRE */
1031 			ire->ire_marks |= ire_marks;
1032 			/* add the incomplete ire: */
1033 			error = ire_add(&ire, NULL, NULL, NULL, B_TRUE);
1034 			if (error == 0 && ire != NULL) {
1035 				ire->ire_max_frag = save_ire->ire_max_frag;
1036 				ip1dbg(("setting max_frag to %d in ire 0x%p\n",
1037 				    ire->ire_max_frag, (void *)ire));
1038 			} else {
1039 				ire_refrele(save_ire);
1040 				goto icmp_err_ret;
1041 			}
1042 		} else {
1043 			if (gcgrp != NULL) {
1044 				GCGRP_REFRELE(gcgrp);
1045 				gcgrp = NULL;
1046 			}
1047 		}
1048 
1049 		ire_refrele(save_ire);
1050 		break;
1051 	default:
1052 		break;
1053 	}
1054 
1055 out:
1056 	if (sire != NULL)
1057 		ire_refrele(sire);
1058 	if (dst_ill != NULL)
1059 		ill_refrele(dst_ill);
1060 	if (src_ipif != NULL)
1061 		ipif_refrele(src_ipif);
1062 	return (ire);
1063 icmp_err_ret:
1064 	if (src_ipif != NULL)
1065 		ipif_refrele(src_ipif);
1066 	if (dst_ill != NULL)
1067 		ill_refrele(dst_ill);
1068 	if (sire != NULL)
1069 		ire_refrele(sire);
1070 	if (ire != NULL) {
1071 		ire_refrele(ire);
1072 	}
1073 	/* caller needs to send icmp error message */
1074 	return (NULL);
1075 
1076 }
1077 
1078 /*
1079  * Obtain the rt_entry and rt_irb for the route to be added to
1080  * the ips_ip_ftable.
1081  * First attempt to add a node to the radix tree via rn_addroute. If the
1082  * route already exists, return the bucket for the existing route.
1083  *
1084  * Locking notes: Need to hold the global radix tree lock in write mode to
1085  * add a radix node. To prevent the node from being deleted, ire_get_bucket()
1086  * returns with a ref'ed irb_t. The ire itself is added in ire_add_v4()
1087  * while holding the irb_lock, but not the radix tree lock.
1088  */
1089 irb_t *
1090 ire_get_bucket(ire_t *ire)
1091 {
1092 	struct radix_node *rn;
1093 	struct rt_entry *rt;
1094 	struct rt_sockaddr rmask, rdst;
1095 	irb_t *irb = NULL;
1096 	ip_stack_t *ipst = ire->ire_ipst;
1097 
1098 	ASSERT(ipst->ips_ip_ftable != NULL);
1099 
1100 	/* first try to see if route exists (based on rtalloc1) */
1101 	(void) memset(&rdst, 0, sizeof (rdst));
1102 	rdst.rt_sin_len = sizeof (rdst);
1103 	rdst.rt_sin_family = AF_INET;
1104 	rdst.rt_sin_addr.s_addr = ire->ire_addr;
1105 
1106 	(void) memset(&rmask, 0, sizeof (rmask));
1107 	rmask.rt_sin_len = sizeof (rmask);
1108 	rmask.rt_sin_family = AF_INET;
1109 	rmask.rt_sin_addr.s_addr = ire->ire_mask;
1110 
1111 	/*
1112 	 * add the route. based on BSD's rtrequest1(RTM_ADD)
1113 	 */
1114 	R_Malloc(rt, rt_entry_cache,  sizeof (*rt));
1115 	(void) memset(rt, 0, sizeof (*rt));
1116 	rt->rt_nodes->rn_key = (char *)&rt->rt_dst;
1117 	rt->rt_dst = rdst;
1118 	irb = &rt->rt_irb;
1119 	irb->irb_marks |= IRB_MARK_FTABLE; /* dynamically allocated/freed */
1120 	irb->irb_ipst = ipst;
1121 	rw_init(&irb->irb_lock, NULL, RW_DEFAULT, NULL);
1122 	RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable);
1123 	rn = ipst->ips_ip_ftable->rnh_addaddr(&rt->rt_dst, &rmask,
1124 	    ipst->ips_ip_ftable, (struct radix_node *)rt);
1125 	if (rn == NULL) {
1126 		RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
1127 		Free(rt, rt_entry_cache);
1128 		rt = NULL;
1129 		irb = NULL;
1130 		RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable);
1131 		rn = ipst->ips_ip_ftable->rnh_lookup(&rdst, &rmask,
1132 		    ipst->ips_ip_ftable);
1133 		if (rn != NULL && ((rn->rn_flags & RNF_ROOT) == 0)) {
1134 			/* found a non-root match */
1135 			rt = (struct rt_entry *)rn;
1136 		}
1137 	}
1138 	if (rt != NULL) {
1139 		irb = &rt->rt_irb;
1140 		IRB_REFHOLD(irb);
1141 	}
1142 	RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
1143 	return (irb);
1144 }
1145 
1146 /*
1147  * This function is used when the caller wants to know the outbound
1148  * interface for a packet given only the address.
1149  * If this is a offlink IP address and there are multiple
1150  * routes to this destination, this routine will utilise the
1151  * first route it finds to IP address
1152  * Return values:
1153  * 	0	- FAILURE
1154  *	nonzero	- ifindex
1155  */
1156 uint_t
1157 ifindex_lookup(const struct sockaddr *ipaddr, zoneid_t zoneid)
1158 {
1159 	uint_t ifindex = 0;
1160 	ire_t *ire;
1161 	ill_t *ill;
1162 	netstack_t *ns;
1163 	ip_stack_t *ipst;
1164 
1165 	if (zoneid == ALL_ZONES)
1166 		ns = netstack_find_by_zoneid(GLOBAL_ZONEID);
1167 	else
1168 		ns = netstack_find_by_zoneid(zoneid);
1169 	ASSERT(ns != NULL);
1170 
1171 	/*
1172 	 * For exclusive stacks we set the zoneid to zero
1173 	 * since IP uses the global zoneid in the exclusive stacks.
1174 	 */
1175 	if (ns->netstack_stackid != GLOBAL_NETSTACKID)
1176 		zoneid = GLOBAL_ZONEID;
1177 	ipst = ns->netstack_ip;
1178 
1179 	ASSERT(ipaddr->sa_family == AF_INET || ipaddr->sa_family == AF_INET6);
1180 
1181 	if ((ire =  route_to_dst(ipaddr, zoneid, ipst)) != NULL) {
1182 		ill = ire_to_ill(ire);
1183 		if (ill != NULL)
1184 			ifindex = ill->ill_phyint->phyint_ifindex;
1185 		ire_refrele(ire);
1186 	}
1187 	netstack_rele(ns);
1188 	return (ifindex);
1189 }
1190 
1191 /*
1192  * Routine to find the route to a destination. If a ifindex is supplied
1193  * it tries to match the the route to the corresponding ipif for the ifindex
1194  */
1195 static	ire_t *
1196 route_to_dst(const struct sockaddr *dst_addr, zoneid_t zoneid, ip_stack_t *ipst)
1197 {
1198 	ire_t *ire = NULL;
1199 	int match_flags;
1200 
1201 	match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT |
1202 	    MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE);
1203 
1204 	/* XXX pass NULL tsl for now */
1205 
1206 	if (dst_addr->sa_family == AF_INET) {
1207 		ire = ire_route_lookup(
1208 		    ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr,
1209 			0, 0, 0, NULL, NULL, zoneid, NULL, match_flags, ipst);
1210 	} else {
1211 		ire = ire_route_lookup_v6(
1212 		    &((struct sockaddr_in6 *)dst_addr)->sin6_addr,
1213 		    0, 0, 0, NULL, NULL, zoneid, NULL, match_flags, ipst);
1214 	}
1215 	return (ire);
1216 }
1217 
1218 /*
1219  * This routine is called by IP Filter to send a packet out on the wire
1220  * to a specified V4 dst (which may be onlink or offlink). The ifindex may or
1221  * may not be 0. A non-null ifindex indicates IP Filter has stipulated
1222  * an outgoing interface and requires the nexthop to be on that interface.
1223  * IP WILL NOT DO  the following to the data packet before sending it out:
1224  *	a. manipulate ttl
1225  *	b. checksuming
1226  *	c. ipsec work
1227  *	d. fragmentation
1228  *
1229  * Return values:
1230  *	0:		IP was able to send of the data pkt
1231  *	ECOMM:		Could not send packet
1232  *	ENONET		No route to dst. It is up to the caller
1233  *			to send icmp unreachable error message,
1234  *	EINPROGRESS	The macaddr of the onlink dst or that
1235  *			of the offlink dst's nexthop needs to get
1236  *			resolved before packet can be sent to dst.
1237  *			Thus transmission is not guaranteed.
1238  *
1239  */
1240 
1241 int
1242 ipfil_sendpkt(const struct sockaddr *dst_addr, mblk_t *mp, uint_t ifindex,
1243     zoneid_t zoneid)
1244 {
1245 	ire_t *ire = NULL, *sire = NULL;
1246 	ire_t *ire_cache = NULL;
1247 	boolean_t   check_multirt = B_FALSE;
1248 	int value;
1249 	int match_flags;
1250 	ipaddr_t dst;
1251 	netstack_t *ns;
1252 	ip_stack_t *ipst;
1253 
1254 	ASSERT(mp != NULL);
1255 
1256 	if (zoneid == ALL_ZONES)
1257 		ns = netstack_find_by_zoneid(GLOBAL_ZONEID);
1258 	else
1259 		ns = netstack_find_by_zoneid(zoneid);
1260 	ASSERT(ns != NULL);
1261 
1262 	/*
1263 	 * For exclusive stacks we set the zoneid to zero
1264 	 * since IP uses the global zoneid in the exclusive stacks.
1265 	 */
1266 	if (ns->netstack_stackid != GLOBAL_NETSTACKID)
1267 		zoneid = GLOBAL_ZONEID;
1268 	ipst = ns->netstack_ip;
1269 
1270 	ASSERT(dst_addr->sa_family == AF_INET ||
1271 	    dst_addr->sa_family == AF_INET6);
1272 
1273 	if (dst_addr->sa_family == AF_INET) {
1274 		dst = ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr;
1275 	} else {
1276 		/*
1277 		 * We dont have support for V6 yet. It will be provided
1278 		 * once RFE  6399103  has been delivered.
1279 		 * Until then, for V6 dsts, IP Filter will not call
1280 		 * this function. Instead the netinfo framework provides
1281 		 * its own code path, in ip_inject_impl(), to achieve
1282 		 * what it needs to do, for the time being.
1283 		 */
1284 		ip1dbg(("ipfil_sendpkt: no V6 support \n"));
1285 		value = ECOMM;
1286 		freemsg(mp);
1287 		goto discard;
1288 	}
1289 
1290 	/*
1291 	 * Lets get the ire. We might get the ire cache entry,
1292 	 * or the ire,sire pair needed to create the cache entry.
1293 	 * XXX pass NULL tsl for now.
1294 	 */
1295 
1296 	if (ifindex == 0) {
1297 		/* There is no supplied index. So use the FIB info */
1298 
1299 		match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT |
1300 		    MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE);
1301 		ire = ire_route_lookup(dst,
1302 		    0, 0, 0, NULL, &sire, zoneid, MBLK_GETLABEL(mp),
1303 		    match_flags, ipst);
1304 	} else {
1305 		ipif_t *supplied_ipif;
1306 		ill_t *ill;
1307 
1308 		/*
1309 		 * If supplied ifindex is non-null, the only valid
1310 		 * nexthop is one off of the interface corresponding
1311 		 * to the specified ifindex.
1312 		 */
1313 
1314 		ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
1315 		    NULL, NULL, NULL, NULL, ipst);
1316 		if (ill != NULL) {
1317 			supplied_ipif = ipif_get_next_ipif(NULL, ill);
1318 		} else {
1319 			ip1dbg(("ipfil_sendpkt: Could not find"
1320 			    " route to dst\n"));
1321 			value = ECOMM;
1322 			freemsg(mp);
1323 			goto discard;
1324 		}
1325 
1326 		match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT |
1327 		    MATCH_IRE_IPIF | MATCH_IRE_RECURSIVE| MATCH_IRE_RJ_BHOLE|
1328 		    MATCH_IRE_SECATTR);
1329 
1330 		ire = ire_route_lookup(dst, 0, 0, 0, supplied_ipif,
1331 		    &sire, zoneid, MBLK_GETLABEL(mp), match_flags, ipst);
1332 		ipif_refrele(supplied_ipif);
1333 		ill_refrele(ill);
1334 	}
1335 
1336 	/*
1337 	 * Verify that the returned IRE is non-null and does
1338 	 * not have either the RTF_REJECT or RTF_BLACKHOLE
1339 	 * flags set and that the IRE is  either an IRE_CACHE,
1340 	 * IRE_IF_NORESOLVER or IRE_IF_RESOLVER.
1341 	 */
1342 	if (ire == NULL ||
1343 	    ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) ||
1344 	    (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0)) {
1345 		/*
1346 		 * Either ire could not be found or we got
1347 		 * an invalid one
1348 		 */
1349 		ip1dbg(("ipfil_sendpkt: Could not find route to dst\n"));
1350 		value = ENONET;
1351 		freemsg(mp);
1352 		goto discard;
1353 	}
1354 
1355 	/* IP Filter and CGTP dont mix. So bail out if CGTP is on */
1356 	if (ip_cgtp_filter &&
1357 	    ((ire->ire_flags & RTF_MULTIRT) ||
1358 	    ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) {
1359 		ip1dbg(("ipfil_sendpkt: IPFilter does not work with CGTP\n"));
1360 		value = ECOMM;
1361 		freemsg(mp);
1362 		goto discard;
1363 	}
1364 
1365 	ASSERT(ire->ire_type != IRE_CACHE || ire->ire_nce != NULL);
1366 	/*
1367 	 * If needed, we will create the ire cache entry for the
1368 	 * nexthop, resolve its link-layer address and then send
1369 	 * the packet out without ttl, checksumming, IPSec processing.
1370 	 */
1371 
1372 	switch (ire->ire_type) {
1373 	case IRE_IF_NORESOLVER:
1374 	case IRE_CACHE:
1375 		if (sire != NULL) {
1376 			UPDATE_OB_PKT_COUNT(sire);
1377 			sire->ire_last_used_time = lbolt;
1378 			ire_refrele(sire);
1379 		}
1380 		ire_cache = ire;
1381 		break;
1382 	case IRE_IF_RESOLVER:
1383 		/*
1384 		 * Call ire_forward(). This function
1385 		 * will, create the ire cache entry of the
1386 		 * the nexthop and adds this incomplete ire
1387 		 * to the ire cache table
1388 		 */
1389 		ire_cache = ire_forward(dst, &check_multirt, ire, sire,
1390 		    MBLK_GETLABEL(mp), ipst);
1391 		if (ire_cache == NULL) {
1392 			ip1dbg(("ipfil_sendpkt: failed to create the"
1393 			    " ire cache entry \n"));
1394 			value = ENONET;
1395 			freemsg(mp);
1396 			sire = NULL;
1397 			ire = NULL;
1398 			goto discard;
1399 		}
1400 		break;
1401 	}
1402 	/*
1403 	 * Now that we have the ire cache entry of the nexthop, call
1404 	 * ip_xmit_v4() to trigger mac addr resolution
1405 	 * if necessary and send it once ready.
1406 	 */
1407 
1408 	value = ip_xmit_v4(mp, ire_cache, NULL, B_FALSE);
1409 	ire_refrele(ire_cache);
1410 	/*
1411 	 * At this point, the reference for these have already been
1412 	 * released within ire_forward() and/or ip_xmit_v4(). So we set
1413 	 * them to NULL to make sure we dont drop the references
1414 	 * again in case ip_xmit_v4() returns with either SEND_FAILED
1415 	 * or LLHDR_RESLV_FAILED
1416 	 */
1417 	sire = NULL;
1418 	ire = NULL;
1419 
1420 	switch (value) {
1421 	case SEND_FAILED:
1422 		ip1dbg(("ipfil_sendpkt: Send failed\n"));
1423 		value = ECOMM;
1424 		break;
1425 	case LLHDR_RESLV_FAILED:
1426 		ip1dbg(("ipfil_sendpkt: Link-layer resolution"
1427 		    "  failed\n"));
1428 		value = ECOMM;
1429 		break;
1430 	case LOOKUP_IN_PROGRESS:
1431 		netstack_rele(ns);
1432 		return (EINPROGRESS);
1433 	case SEND_PASSED:
1434 		netstack_rele(ns);
1435 		return (0);
1436 	}
1437 discard:
1438 	if (dst_addr->sa_family == AF_INET) {
1439 		BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
1440 	} else {
1441 		BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards);
1442 	}
1443 	if (ire != NULL)
1444 		ire_refrele(ire);
1445 	if (sire != NULL)
1446 		ire_refrele(sire);
1447 	netstack_rele(ns);
1448 	return (value);
1449 }
1450 
1451 /* ire_walk routine invoked for ip_ire_report for each IRE. */
1452 void
1453 ire_report_ftable(ire_t *ire, char *m)
1454 {
1455 	char	buf1[16];
1456 	char	buf2[16];
1457 	char	buf3[16];
1458 	char	buf4[16];
1459 	uint_t	fo_pkt_count;
1460 	uint_t	ib_pkt_count;
1461 	int	ref;
1462 	uint_t	print_len, buf_len;
1463 	mblk_t 	*mp = (mblk_t *)m;
1464 
1465 	if (ire->ire_type & IRE_CACHETABLE)
1466 		return;
1467 	buf_len = mp->b_datap->db_lim - mp->b_wptr;
1468 	if (buf_len <= 0)
1469 		return;
1470 
1471 	/* Number of active references of this ire */
1472 	ref = ire->ire_refcnt;
1473 	/* "inbound" to a non local address is a forward */
1474 	ib_pkt_count = ire->ire_ib_pkt_count;
1475 	fo_pkt_count = 0;
1476 	if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) {
1477 		fo_pkt_count = ib_pkt_count;
1478 		ib_pkt_count = 0;
1479 	}
1480 	print_len = snprintf((char *)mp->b_wptr, buf_len,
1481 	    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d "
1482 	    "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d "
1483 	    "%04d %08d %08d %d/%d/%d %s\n",
1484 	    (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq,
1485 	    (int)ire->ire_zoneid,
1486 	    ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2),
1487 	    ip_dot_addr(ire->ire_src_addr, buf3),
1488 	    ip_dot_addr(ire->ire_gateway_addr, buf4),
1489 	    ire->ire_max_frag, ire->ire_uinfo.iulp_rtt,
1490 	    ire->ire_uinfo.iulp_rtt_sd,
1491 	    ire->ire_uinfo.iulp_ssthresh, ref,
1492 	    ire->ire_uinfo.iulp_rtomax,
1493 	    (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0),
1494 	    (ire->ire_uinfo.iulp_wscale_ok ? 1: 0),
1495 	    (ire->ire_uinfo.iulp_ecn_ok ? 1: 0),
1496 	    (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0),
1497 	    ire->ire_uinfo.iulp_sack,
1498 	    ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe,
1499 	    ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count,
1500 	    ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type));
1501 	if (print_len < buf_len) {
1502 		mp->b_wptr += print_len;
1503 	} else {
1504 		mp->b_wptr += buf_len;
1505 	}
1506 }
1507 
1508 /*
1509  * callback function provided by ire_ftable_lookup when calling
1510  * rn_match_args(). Invoke ire_match_args on each matching leaf node in
1511  * the radix tree.
1512  */
1513 boolean_t
1514 ire_find_best_route(struct radix_node *rn, void *arg)
1515 {
1516 	struct rt_entry *rt = (struct rt_entry *)rn;
1517 	irb_t *irb_ptr;
1518 	ire_t *ire;
1519 	ire_ftable_args_t *margs = arg;
1520 	ipaddr_t match_mask;
1521 
1522 	ASSERT(rt != NULL);
1523 
1524 	irb_ptr = &rt->rt_irb;
1525 
1526 	if (irb_ptr->irb_ire_cnt == 0)
1527 		return (B_FALSE);
1528 
1529 	rw_enter(&irb_ptr->irb_lock, RW_READER);
1530 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
1531 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
1532 			continue;
1533 		if (margs->ift_flags & MATCH_IRE_MASK)
1534 			match_mask = margs->ift_mask;
1535 		else
1536 			match_mask = ire->ire_mask;
1537 
1538 		if (ire_match_args(ire, margs->ift_addr, match_mask,
1539 		    margs->ift_gateway, margs->ift_type, margs->ift_ipif,
1540 		    margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl,
1541 		    margs->ift_flags)) {
1542 			IRE_REFHOLD(ire);
1543 			rw_exit(&irb_ptr->irb_lock);
1544 			margs->ift_best_ire = ire;
1545 			return (B_TRUE);
1546 		}
1547 	}
1548 	rw_exit(&irb_ptr->irb_lock);
1549 	return (B_FALSE);
1550 }
1551 
1552 /*
1553  * ftable irb_t structures are dynamically allocated, and we need to
1554  * check if the irb_t (and associated ftable tree attachment) needs to
1555  * be cleaned up when the irb_refcnt goes to 0. The conditions that need
1556  * be verified are:
1557  * - no other walkers of the irebucket, i.e., quiescent irb_refcnt,
1558  * - no other threads holding references to ire's in the bucket,
1559  *   i.e., irb_nire == 0
1560  * - no active ire's in the bucket, i.e., irb_ire_cnt == 0
1561  * - need to hold the global tree lock and irb_lock in write mode.
1562  */
1563 void
1564 irb_refrele_ftable(irb_t *irb)
1565 {
1566 	for (;;) {
1567 		rw_enter(&irb->irb_lock, RW_WRITER);
1568 		ASSERT(irb->irb_refcnt != 0);
1569 		if (irb->irb_refcnt != 1) {
1570 			/*
1571 			 * Someone has a reference to this radix node
1572 			 * or there is some bucket walker.
1573 			 */
1574 			irb->irb_refcnt--;
1575 			rw_exit(&irb->irb_lock);
1576 			return;
1577 		} else {
1578 			/*
1579 			 * There is no other walker, nor is there any
1580 			 * other thread that holds a direct ref to this
1581 			 * radix node. Do the clean up if needed. Call
1582 			 * to ire_unlink will clear the IRB_MARK_CONDEMNED flag
1583 			 */
1584 			if (irb->irb_marks & IRB_MARK_CONDEMNED)  {
1585 				ire_t *ire_list;
1586 
1587 				ire_list = ire_unlink(irb);
1588 				rw_exit(&irb->irb_lock);
1589 
1590 				if (ire_list != NULL)
1591 					ire_cleanup(ire_list);
1592 				/*
1593 				 * more CONDEMNED entries could have
1594 				 * been added while we dropped the lock,
1595 				 * so we have to re-check.
1596 				 */
1597 				continue;
1598 			}
1599 
1600 			/*
1601 			 * Now check if there are still any ires
1602 			 * associated with this radix node.
1603 			 */
1604 			if (irb->irb_nire != 0) {
1605 				/*
1606 				 * someone is still holding on
1607 				 * to ires in this bucket
1608 				 */
1609 				irb->irb_refcnt--;
1610 				rw_exit(&irb->irb_lock);
1611 				return;
1612 			} else {
1613 				/*
1614 				 * Everything is clear. Zero walkers,
1615 				 * Zero threads with a ref to this
1616 				 * radix node, Zero ires associated with
1617 				 * this radix node. Due to lock order,
1618 				 * check the above conditions again
1619 				 * after grabbing all locks in the right order
1620 				 */
1621 				rw_exit(&irb->irb_lock);
1622 				if (irb_inactive(irb))
1623 					return;
1624 				/*
1625 				 * irb_inactive could not free the irb.
1626 				 * See if there are any walkers, if not
1627 				 * try to clean up again.
1628 				 */
1629 			}
1630 		}
1631 	}
1632 }
1633 
1634 /*
1635  * IRE iterator used by ire_ftable_lookup() to process multiple default
1636  * routes. Given a starting point in the hash list (ire_origin), walk the IREs
1637  * in the bucket skipping default interface routes and deleted entries.
1638  * Returns the next IRE (unheld), or NULL when we're back to the starting point.
1639  * Assumes that the caller holds a reference on the IRE bucket.
1640  *
1641  * In the absence of good IRE_DEFAULT routes, this function will return
1642  * the first IRE_INTERFACE route found (if any).
1643  */
1644 ire_t *
1645 ire_round_robin(irb_t *irb_ptr, zoneid_t zoneid, ire_ftable_args_t *margs,
1646 	ip_stack_t *ipst)
1647 {
1648 	ire_t	*ire_origin;
1649 	ire_t	*ire, *maybe_ire = NULL;
1650 
1651 	rw_enter(&irb_ptr->irb_lock, RW_WRITER);
1652 	ire_origin = irb_ptr->irb_rr_origin;
1653 	if (ire_origin != NULL) {
1654 		ire_origin = ire_origin->ire_next;
1655 		IRE_FIND_NEXT_ORIGIN(ire_origin);
1656 	}
1657 
1658 	if (ire_origin == NULL) {
1659 		/*
1660 		 * first time through routine, or we dropped off the end
1661 		 * of list.
1662 		 */
1663 		ire_origin = irb_ptr->irb_ire;
1664 		IRE_FIND_NEXT_ORIGIN(ire_origin);
1665 	}
1666 	irb_ptr->irb_rr_origin = ire_origin;
1667 	IRB_REFHOLD_LOCKED(irb_ptr);
1668 	rw_exit(&irb_ptr->irb_lock);
1669 
1670 	DTRACE_PROBE2(ire__rr__origin, (irb_t *), irb_ptr,
1671 	    (ire_t *), ire_origin);
1672 
1673 	/*
1674 	 * Round-robin the routers list looking for a route that
1675 	 * matches the passed in parameters.
1676 	 * We start with the ire we found above and we walk the hash
1677 	 * list until we're back where we started. It doesn't matter if
1678 	 * routes are added or deleted by other threads - we know this
1679 	 * ire will stay in the list because we hold a reference on the
1680 	 * ire bucket.
1681 	 */
1682 	ire = ire_origin;
1683 	while (ire != NULL) {
1684 		int match_flags = 0;
1685 		ire_t *rire;
1686 
1687 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
1688 			goto next_ire;
1689 
1690 		if (!ire_match_args(ire, margs->ift_addr, (ipaddr_t)0,
1691 		    margs->ift_gateway, margs->ift_type, margs->ift_ipif,
1692 		    margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl,
1693 		    margs->ift_flags))
1694 			goto next_ire;
1695 
1696 		if (ire->ire_type & IRE_INTERFACE) {
1697 			/*
1698 			 * keep looking to see if there is a non-interface
1699 			 * default ire, but save this one as a last resort.
1700 			 */
1701 			if (maybe_ire == NULL)
1702 				maybe_ire = ire;
1703 			goto next_ire;
1704 		}
1705 
1706 		if (zoneid == ALL_ZONES) {
1707 			IRE_REFHOLD(ire);
1708 			IRB_REFRELE(irb_ptr);
1709 			return (ire);
1710 		}
1711 		/*
1712 		 * When we're in a local zone, we're only
1713 		 * interested in routers that are
1714 		 * reachable through ipifs within our zone.
1715 		 */
1716 		if (ire->ire_ipif != NULL) {
1717 			match_flags |= MATCH_IRE_ILL_GROUP;
1718 		}
1719 		rire = ire_route_lookup(ire->ire_gateway_addr,
1720 		    0, 0, 0, ire->ire_ipif, NULL, zoneid, margs->ift_tsl,
1721 		    match_flags, ipst);
1722 		if (rire != NULL) {
1723 			ire_refrele(rire);
1724 			IRE_REFHOLD(ire);
1725 			IRB_REFRELE(irb_ptr);
1726 			return (ire);
1727 		}
1728 next_ire:
1729 		ire = (ire->ire_next ?  ire->ire_next : irb_ptr->irb_ire);
1730 		if (ire == ire_origin)
1731 			break;
1732 	}
1733 	if (maybe_ire != NULL)
1734 		IRE_REFHOLD(maybe_ire);
1735 	IRB_REFRELE(irb_ptr);
1736 	return (maybe_ire);
1737 }
1738 
1739 void
1740 irb_refhold_rn(struct radix_node *rn)
1741 {
1742 	if ((rn->rn_flags & RNF_ROOT) == 0)
1743 		IRB_REFHOLD(&((rt_t *)(rn))->rt_irb);
1744 }
1745 
1746 void
1747 irb_refrele_rn(struct radix_node *rn)
1748 {
1749 	if ((rn->rn_flags & RNF_ROOT) == 0)
1750 		irb_refrele_ftable(&((rt_t *)(rn))->rt_irb);
1751 }
1752