17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 545916cd2Sjpk * Common Development and Distribution License (the "License"). 645916cd2Sjpk * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 221f19738eSmeem * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved. 231f19738eSmeem * Copyright (c) 1990 Mentat Inc. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate /* 277c478bd9Sstevel@tonic-gate * This file contains routines that manipulate Internet Routing Entries (IREs). 287c478bd9Sstevel@tonic-gate */ 297c478bd9Sstevel@tonic-gate 307c478bd9Sstevel@tonic-gate #include <sys/types.h> 317c478bd9Sstevel@tonic-gate #include <sys/stream.h> 327c478bd9Sstevel@tonic-gate #include <sys/stropts.h> 33e11c3f44Smeem #include <sys/strsun.h> 34de8c4a14SErik Nordmark #include <sys/strsubr.h> 357c478bd9Sstevel@tonic-gate #include <sys/ddi.h> 367c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h> 377c478bd9Sstevel@tonic-gate #include <sys/policy.h> 387c478bd9Sstevel@tonic-gate 397c478bd9Sstevel@tonic-gate #include <sys/systm.h> 407c478bd9Sstevel@tonic-gate #include <sys/kmem.h> 417c478bd9Sstevel@tonic-gate #include <sys/param.h> 427c478bd9Sstevel@tonic-gate #include <sys/socket.h> 437c478bd9Sstevel@tonic-gate #include <net/if.h> 447c478bd9Sstevel@tonic-gate #include <net/route.h> 457c478bd9Sstevel@tonic-gate #include <netinet/in.h> 467c478bd9Sstevel@tonic-gate #include <net/if_dl.h> 477c478bd9Sstevel@tonic-gate #include <netinet/ip6.h> 487c478bd9Sstevel@tonic-gate #include <netinet/icmp6.h> 497c478bd9Sstevel@tonic-gate 507c478bd9Sstevel@tonic-gate #include <inet/common.h> 517c478bd9Sstevel@tonic-gate #include <inet/mi.h> 527c478bd9Sstevel@tonic-gate #include <inet/ip.h> 537c478bd9Sstevel@tonic-gate #include <inet/ip6.h> 547c478bd9Sstevel@tonic-gate #include <inet/ip_ndp.h> 55c793af95Ssangeeta #include <inet/arp.h> 567c478bd9Sstevel@tonic-gate #include <inet/ip_if.h> 577c478bd9Sstevel@tonic-gate #include <inet/ip_ire.h> 58c793af95Ssangeeta #include <inet/ip_ftable.h> 597c478bd9Sstevel@tonic-gate #include <inet/ip_rts.h> 607c478bd9Sstevel@tonic-gate #include <inet/nd.h> 616e91bba0SGirish Moodalbail #include <inet/tunables.h> 627c478bd9Sstevel@tonic-gate 637c478bd9Sstevel@tonic-gate #include <inet/tcp.h> 647c478bd9Sstevel@tonic-gate #include <inet/ipclassifier.h> 657c478bd9Sstevel@tonic-gate #include <sys/zone.h> 66f4b3ec61Sdh155122 #include <sys/cpuvar.h> 67f4b3ec61Sdh155122 6845916cd2Sjpk #include <sys/tsol/label.h> 6945916cd2Sjpk #include <sys/tsol/tnet.h> 7045916cd2Sjpk 71c793af95Ssangeeta struct kmem_cache *rt_entry_cache; 72c793af95Ssangeeta 73bd670b35SErik Nordmark typedef struct nce_clookup_s { 74bd670b35SErik Nordmark ipaddr_t ncecl_addr; 75bd670b35SErik Nordmark boolean_t ncecl_found; 76bd670b35SErik Nordmark } nce_clookup_t; 77bd670b35SErik Nordmark 787c478bd9Sstevel@tonic-gate /* 797c478bd9Sstevel@tonic-gate * Synchronization notes: 807c478bd9Sstevel@tonic-gate * 817c478bd9Sstevel@tonic-gate * The fields of the ire_t struct are protected in the following way : 827c478bd9Sstevel@tonic-gate * 837c478bd9Sstevel@tonic-gate * ire_next/ire_ptpn 847c478bd9Sstevel@tonic-gate * 85bd670b35SErik Nordmark * - bucket lock of the forwarding table in which is ire stored. 867c478bd9Sstevel@tonic-gate * 87bd670b35SErik Nordmark * ire_ill, ire_u *except* ire_gateway_addr[v6], ire_mask, 88bd670b35SErik Nordmark * ire_type, ire_create_time, ire_masklen, ire_ipversion, ire_flags, 89bd670b35SErik Nordmark * ire_bucket 907c478bd9Sstevel@tonic-gate * 917c478bd9Sstevel@tonic-gate * - Set in ire_create_v4/v6 and never changes after that. Thus, 927c478bd9Sstevel@tonic-gate * we don't need a lock whenever these fields are accessed. 937c478bd9Sstevel@tonic-gate * 947c478bd9Sstevel@tonic-gate * - ire_bucket and ire_masklen (also set in ire_create) is set in 95bd670b35SErik Nordmark * ire_add before inserting in the bucket and never 967c478bd9Sstevel@tonic-gate * changes after that. Thus we don't need a lock whenever these 977c478bd9Sstevel@tonic-gate * fields are accessed. 987c478bd9Sstevel@tonic-gate * 997c478bd9Sstevel@tonic-gate * ire_gateway_addr_v4[v6] 1007c478bd9Sstevel@tonic-gate * 1017c478bd9Sstevel@tonic-gate * - ire_gateway_addr_v4[v6] is set during ire_create and later modified 1027c478bd9Sstevel@tonic-gate * by rts_setgwr[v6]. As ire_gateway_addr is a uint32_t, updates to 1037c478bd9Sstevel@tonic-gate * it assumed to be atomic and hence the other parts of the code 1047c478bd9Sstevel@tonic-gate * does not use any locks. ire_gateway_addr_v6 updates are not atomic 1057c478bd9Sstevel@tonic-gate * and hence any access to it uses ire_lock to get/set the right value. 1067c478bd9Sstevel@tonic-gate * 107bd670b35SErik Nordmark * ire_refcnt, ire_identical_ref 1087c478bd9Sstevel@tonic-gate * 1097c478bd9Sstevel@tonic-gate * - Updated atomically using atomic_add_32 1107c478bd9Sstevel@tonic-gate * 1117c478bd9Sstevel@tonic-gate * ire_ssthresh, ire_rtt_sd, ire_rtt, ire_ib_pkt_count, ire_ob_pkt_count 1127c478bd9Sstevel@tonic-gate * 1137c478bd9Sstevel@tonic-gate * - Assumes that 32 bit writes are atomic. No locks. ire_lock is 1147c478bd9Sstevel@tonic-gate * used to serialize updates to ire_ssthresh, ire_rtt_sd, ire_rtt. 1157c478bd9Sstevel@tonic-gate * 116bd670b35SErik Nordmark * ire_generation 117bd670b35SErik Nordmark * - Under ire_lock 1187c478bd9Sstevel@tonic-gate * 119bd670b35SErik Nordmark * ire_nce_cache 120bd670b35SErik Nordmark * - Under ire_lock 1217c478bd9Sstevel@tonic-gate * 122bd670b35SErik Nordmark * ire_dep_parent (To next IRE in recursive lookup chain) 123bd670b35SErik Nordmark * - Under ips_ire_dep_lock. Write held when modifying. Read held when 124bd670b35SErik Nordmark * walking. We also hold ire_lock when modifying to allow the data path 125bd670b35SErik Nordmark * to only acquire ire_lock. 1267c478bd9Sstevel@tonic-gate * 127bd670b35SErik Nordmark * ire_dep_parent_generation (Generation number from ire_dep_parent) 128bd670b35SErik Nordmark * - Under ips_ire_dep_lock and/or ire_lock. (A read claim on the dep_lock 129bd670b35SErik Nordmark * and ire_lock held when modifying) 1307c478bd9Sstevel@tonic-gate * 131bd670b35SErik Nordmark * ire_dep_children (From parent to first child) 132bd670b35SErik Nordmark * ire_dep_sib_next (linked list of siblings) 133bd670b35SErik Nordmark * ire_dep_sib_ptpn (linked list of siblings) 134bd670b35SErik Nordmark * - Under ips_ire_dep_lock. Write held when modifying. Read held when 135bd670b35SErik Nordmark * walking. 1367c478bd9Sstevel@tonic-gate * 1377c478bd9Sstevel@tonic-gate * As we always hold the bucket locks in all the places while accessing 1387c478bd9Sstevel@tonic-gate * the above values, it is natural to use them for protecting them. 1397c478bd9Sstevel@tonic-gate * 140bd670b35SErik Nordmark * We have a forwarding table for IPv4 and IPv6. The IPv6 forwarding table 141219e6466Ssowmini * (ip_forwarding_table_v6) is an array of pointers to arrays of irb_t 142bd670b35SErik Nordmark * structures. ip_forwarding_table_v6 is allocated dynamically in 143f4b3ec61Sdh155122 * ire_add_v6. ire_ft_init_lock is used to serialize multiple threads 1447c478bd9Sstevel@tonic-gate * initializing the same bucket. Once a bucket is initialized, it is never 145f4b3ec61Sdh155122 * de-alloacted. This assumption enables us to access 146f4b3ec61Sdh155122 * ip_forwarding_table_v6[i] without any locks. 1477c478bd9Sstevel@tonic-gate * 148219e6466Ssowmini * The forwarding table for IPv4 is a radix tree whose leaves 149219e6466Ssowmini * are rt_entry structures containing the irb_t for the rt_dst. The irb_t 150219e6466Ssowmini * for IPv4 is dynamically allocated and freed. 151219e6466Ssowmini * 1527c478bd9Sstevel@tonic-gate * Each irb_t - ire bucket structure has a lock to protect 1537c478bd9Sstevel@tonic-gate * a bucket and the ires residing in the bucket have a back pointer to 1547c478bd9Sstevel@tonic-gate * the bucket structure. It also has a reference count for the number 1557c478bd9Sstevel@tonic-gate * of threads walking the bucket - irb_refcnt which is bumped up 156bd670b35SErik Nordmark * using the irb_refhold function. The flags irb_marks can be 157bd670b35SErik Nordmark * set to IRB_MARK_CONDEMNED indicating that there are some ires 158bd670b35SErik Nordmark * in this bucket that are IRE_IS_CONDEMNED and the 1597c478bd9Sstevel@tonic-gate * last thread to leave the bucket should delete the ires. Usually 160bd670b35SErik Nordmark * this is done by the irb_refrele function which is used to decrement 161219e6466Ssowmini * the reference count on a bucket. See comments above irb_t structure 162219e6466Ssowmini * definition in ip.h for further details. 1637c478bd9Sstevel@tonic-gate * 164bd670b35SErik Nordmark * The ire_refhold/ire_refrele functions operate on the ire which increments/ 1657c478bd9Sstevel@tonic-gate * decrements the reference count, ire_refcnt, atomically on the ire. 166bd670b35SErik Nordmark * ire_refcnt is modified only using those functions. Operations on the IRE 1677c478bd9Sstevel@tonic-gate * could be described as follows : 1687c478bd9Sstevel@tonic-gate * 1697c478bd9Sstevel@tonic-gate * CREATE an ire with reference count initialized to 1. 1707c478bd9Sstevel@tonic-gate * 1717c478bd9Sstevel@tonic-gate * ADDITION of an ire holds the bucket lock, checks for duplicates 172bd670b35SErik Nordmark * and then adds the ire. ire_add returns the ire after 1737c478bd9Sstevel@tonic-gate * bumping up once more i.e the reference count is 2. This is to avoid 1747c478bd9Sstevel@tonic-gate * an extra lookup in the functions calling ire_add which wants to 1757c478bd9Sstevel@tonic-gate * work with the ire after adding. 1767c478bd9Sstevel@tonic-gate * 177bd670b35SErik Nordmark * LOOKUP of an ire bumps up the reference count using ire_refhold 178bd670b35SErik Nordmark * function. It is valid to bump up the referece count of the IRE, 1797c478bd9Sstevel@tonic-gate * after the lookup has returned an ire. Following are the lookup 1807c478bd9Sstevel@tonic-gate * functions that return an HELD ire : 1817c478bd9Sstevel@tonic-gate * 182bd670b35SErik Nordmark * ire_ftable_lookup[_v6], ire_lookup_multi_ill[_v6] 1837c478bd9Sstevel@tonic-gate * 1847c478bd9Sstevel@tonic-gate * DELETION of an ire holds the bucket lock, removes it from the list 1857c478bd9Sstevel@tonic-gate * and then decrements the reference count for having removed from the list 186bd670b35SErik Nordmark * by using the ire_refrele function. If some other thread has looked up 1877c478bd9Sstevel@tonic-gate * the ire, the reference count would have been bumped up and hence 1887c478bd9Sstevel@tonic-gate * this ire will not be freed once deleted. It will be freed once the 1897c478bd9Sstevel@tonic-gate * reference count drops to zero. 1907c478bd9Sstevel@tonic-gate * 1917c478bd9Sstevel@tonic-gate * Add and Delete acquires the bucket lock as RW_WRITER, while all the 1927c478bd9Sstevel@tonic-gate * lookups acquire the bucket lock as RW_READER. 1937c478bd9Sstevel@tonic-gate * 194bd670b35SErik Nordmark * The general rule is to do the ire_refrele in the function 1957c478bd9Sstevel@tonic-gate * that is passing the ire as an argument. 1967c478bd9Sstevel@tonic-gate * 1977c478bd9Sstevel@tonic-gate * In trying to locate ires the following points are to be noted. 1987c478bd9Sstevel@tonic-gate * 199bd670b35SErik Nordmark * IRE_IS_CONDEMNED signifies that the ire has been logically deleted and is 2007c478bd9Sstevel@tonic-gate * to be ignored when walking the ires using ire_next. 2017c478bd9Sstevel@tonic-gate * 2027c478bd9Sstevel@tonic-gate * Zones note: 2037c478bd9Sstevel@tonic-gate * Walking IREs within a given zone also walks certain ires in other 2047c478bd9Sstevel@tonic-gate * zones. This is done intentionally. IRE walks with a specified 2057c478bd9Sstevel@tonic-gate * zoneid are used only when doing informational reports, and 2067c478bd9Sstevel@tonic-gate * zone users want to see things that they can access. See block 2077c478bd9Sstevel@tonic-gate * comment in ire_walk_ill_match(). 2087c478bd9Sstevel@tonic-gate */ 2097c478bd9Sstevel@tonic-gate 2107c478bd9Sstevel@tonic-gate /* 2117c478bd9Sstevel@tonic-gate * The size of the forwarding table. We will make sure that it is a 2127c478bd9Sstevel@tonic-gate * power of 2 in ip_ire_init(). 213f4b3ec61Sdh155122 * Setable in /etc/system 2147c478bd9Sstevel@tonic-gate */ 2157c478bd9Sstevel@tonic-gate uint32_t ip6_ftable_hash_size = IP6_FTABLE_HASH_SIZE; 2167c478bd9Sstevel@tonic-gate 2177c478bd9Sstevel@tonic-gate struct kmem_cache *ire_cache; 218bd670b35SErik Nordmark struct kmem_cache *ncec_cache; 219bd670b35SErik Nordmark struct kmem_cache *nce_cache; 220bd670b35SErik Nordmark 2217c478bd9Sstevel@tonic-gate static ire_t ire_null; 2227c478bd9Sstevel@tonic-gate 223bd670b35SErik Nordmark static ire_t *ire_add_v4(ire_t *ire); 2247c478bd9Sstevel@tonic-gate static void ire_delete_v4(ire_t *ire); 225bd670b35SErik Nordmark static void ire_dep_invalidate_children(ire_t *child); 22645916cd2Sjpk static void ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, 227f4b3ec61Sdh155122 zoneid_t zoneid, ip_stack_t *); 2287c478bd9Sstevel@tonic-gate static void ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, 22945916cd2Sjpk pfv_t func, void *arg, uchar_t vers, ill_t *ill); 2306a8288c7Scarlsonj #ifdef DEBUG 2316a8288c7Scarlsonj static void ire_trace_cleanup(const ire_t *); 2327c478bd9Sstevel@tonic-gate #endif 233f1c454b4SSowmini Varadhan static void ire_dep_incr_generation_locked(ire_t *); 2347c478bd9Sstevel@tonic-gate 2357c478bd9Sstevel@tonic-gate /* 236bd670b35SErik Nordmark * Following are the functions to increment/decrement the reference 237bd670b35SErik Nordmark * count of the IREs and IRBs (ire bucket). 238bd670b35SErik Nordmark * 239bd670b35SErik Nordmark * 1) We bump up the reference count of an IRE to make sure that 240bd670b35SErik Nordmark * it does not get deleted and freed while we are using it. 241bd670b35SErik Nordmark * Typically all the lookup functions hold the bucket lock, 242bd670b35SErik Nordmark * and look for the IRE. If it finds an IRE, it bumps up the 243bd670b35SErik Nordmark * reference count before dropping the lock. Sometimes we *may* want 244bd670b35SErik Nordmark * to bump up the reference count after we *looked* up i.e without 245bd670b35SErik Nordmark * holding the bucket lock. So, the ire_refhold function does not assert 246bd670b35SErik Nordmark * on the bucket lock being held. Any thread trying to delete from 247bd670b35SErik Nordmark * the hash bucket can still do so but cannot free the IRE if 248bd670b35SErik Nordmark * ire_refcnt is not 0. 249bd670b35SErik Nordmark * 250bd670b35SErik Nordmark * 2) We bump up the reference count on the bucket where the IRE resides 251bd670b35SErik Nordmark * (IRB), when we want to prevent the IREs getting deleted from a given 252bd670b35SErik Nordmark * hash bucket. This makes life easier for ire_walk type functions which 253bd670b35SErik Nordmark * wants to walk the IRE list, call a function, but needs to drop 254bd670b35SErik Nordmark * the bucket lock to prevent recursive rw_enters. While the 255bd670b35SErik Nordmark * lock is dropped, the list could be changed by other threads or 256bd670b35SErik Nordmark * the same thread could end up deleting the ire or the ire pointed by 257bd670b35SErik Nordmark * ire_next. ire_refholding the ire or ire_next is not sufficient as 258bd670b35SErik Nordmark * a delete will still remove the ire from the bucket while we have 259bd670b35SErik Nordmark * dropped the lock and hence the ire_next would be NULL. Thus, we 260bd670b35SErik Nordmark * need a mechanism to prevent deletions from a given bucket. 261bd670b35SErik Nordmark * 262bd670b35SErik Nordmark * To prevent deletions, we bump up the reference count on the 263bd670b35SErik Nordmark * bucket. If the bucket is held, ire_delete just marks both 264bd670b35SErik Nordmark * the ire and irb as CONDEMNED. When the 265bd670b35SErik Nordmark * reference count on the bucket drops to zero, all the CONDEMNED ires 266bd670b35SErik Nordmark * are deleted. We don't have to bump up the reference count on the 267bd670b35SErik Nordmark * bucket if we are walking the bucket and never have to drop the bucket 268bd670b35SErik Nordmark * lock. Note that irb_refhold does not prevent addition of new ires 269bd670b35SErik Nordmark * in the list. It is okay because addition of new ires will not cause 270bd670b35SErik Nordmark * ire_next to point to freed memory. We do irb_refhold only when 271bd670b35SErik Nordmark * all of the 3 conditions are true : 272bd670b35SErik Nordmark * 273bd670b35SErik Nordmark * 1) The code needs to walk the IRE bucket from start to end. 274bd670b35SErik Nordmark * 2) It may have to drop the bucket lock sometimes while doing (1) 275bd670b35SErik Nordmark * 3) It does not want any ires to be deleted meanwhile. 276bd670b35SErik Nordmark */ 277bd670b35SErik Nordmark 278bd670b35SErik Nordmark /* 279bd670b35SErik Nordmark * Bump up the reference count on the hash bucket - IRB to 280bd670b35SErik Nordmark * prevent ires from being deleted in this bucket. 281bd670b35SErik Nordmark */ 282bd670b35SErik Nordmark void 283bd670b35SErik Nordmark irb_refhold(irb_t *irb) 284bd670b35SErik Nordmark { 285bd670b35SErik Nordmark rw_enter(&irb->irb_lock, RW_WRITER); 286bd670b35SErik Nordmark irb->irb_refcnt++; 287bd670b35SErik Nordmark ASSERT(irb->irb_refcnt != 0); 288bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 289bd670b35SErik Nordmark } 290bd670b35SErik Nordmark 291bd670b35SErik Nordmark void 292bd670b35SErik Nordmark irb_refhold_locked(irb_t *irb) 293bd670b35SErik Nordmark { 294bd670b35SErik Nordmark ASSERT(RW_WRITE_HELD(&irb->irb_lock)); 295bd670b35SErik Nordmark irb->irb_refcnt++; 296bd670b35SErik Nordmark ASSERT(irb->irb_refcnt != 0); 297bd670b35SErik Nordmark } 298bd670b35SErik Nordmark 299bd670b35SErik Nordmark /* 300bd670b35SErik Nordmark * Note: when IRB_MARK_DYNAMIC is not set the irb_t 301bd670b35SErik Nordmark * is statically allocated, so that when the irb_refcnt goes to 0, 302bd670b35SErik Nordmark * we simply clean up the ire list and continue. 303bd670b35SErik Nordmark */ 304bd670b35SErik Nordmark void 305bd670b35SErik Nordmark irb_refrele(irb_t *irb) 306bd670b35SErik Nordmark { 307bd670b35SErik Nordmark if (irb->irb_marks & IRB_MARK_DYNAMIC) { 308bd670b35SErik Nordmark irb_refrele_ftable(irb); 309bd670b35SErik Nordmark } else { 310bd670b35SErik Nordmark rw_enter(&irb->irb_lock, RW_WRITER); 311bd670b35SErik Nordmark ASSERT(irb->irb_refcnt != 0); 312bd670b35SErik Nordmark if (--irb->irb_refcnt == 0 && 313bd670b35SErik Nordmark (irb->irb_marks & IRB_MARK_CONDEMNED)) { 314bd670b35SErik Nordmark ire_t *ire_list; 315bd670b35SErik Nordmark 316bd670b35SErik Nordmark ire_list = ire_unlink(irb); 317bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 318bd670b35SErik Nordmark ASSERT(ire_list != NULL); 319bd670b35SErik Nordmark ire_cleanup(ire_list); 320bd670b35SErik Nordmark } else { 321bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 322bd670b35SErik Nordmark } 323bd670b35SErik Nordmark } 324bd670b35SErik Nordmark } 325bd670b35SErik Nordmark 326bd670b35SErik Nordmark 327bd670b35SErik Nordmark /* 328bd670b35SErik Nordmark * Bump up the reference count on the IRE. We cannot assert that the 329bd670b35SErik Nordmark * bucket lock is being held as it is legal to bump up the reference 330bd670b35SErik Nordmark * count after the first lookup has returned the IRE without 331bd670b35SErik Nordmark * holding the lock. 332bd670b35SErik Nordmark */ 333bd670b35SErik Nordmark void 334bd670b35SErik Nordmark ire_refhold(ire_t *ire) 335bd670b35SErik Nordmark { 336bd670b35SErik Nordmark atomic_add_32(&(ire)->ire_refcnt, 1); 337bd670b35SErik Nordmark ASSERT((ire)->ire_refcnt != 0); 338bd670b35SErik Nordmark #ifdef DEBUG 339bd670b35SErik Nordmark ire_trace_ref(ire); 340bd670b35SErik Nordmark #endif 341bd670b35SErik Nordmark } 342bd670b35SErik Nordmark 343bd670b35SErik Nordmark void 344bd670b35SErik Nordmark ire_refhold_notr(ire_t *ire) 345bd670b35SErik Nordmark { 346bd670b35SErik Nordmark atomic_add_32(&(ire)->ire_refcnt, 1); 347bd670b35SErik Nordmark ASSERT((ire)->ire_refcnt != 0); 348bd670b35SErik Nordmark } 349bd670b35SErik Nordmark 350bd670b35SErik Nordmark void 351bd670b35SErik Nordmark ire_refhold_locked(ire_t *ire) 352bd670b35SErik Nordmark { 353bd670b35SErik Nordmark #ifdef DEBUG 354bd670b35SErik Nordmark ire_trace_ref(ire); 355bd670b35SErik Nordmark #endif 356bd670b35SErik Nordmark ire->ire_refcnt++; 357bd670b35SErik Nordmark } 358bd670b35SErik Nordmark 359bd670b35SErik Nordmark /* 360bd670b35SErik Nordmark * Release a ref on an IRE. 3617c478bd9Sstevel@tonic-gate * 3627c478bd9Sstevel@tonic-gate * Must not be called while holding any locks. Otherwise if this is 3637c478bd9Sstevel@tonic-gate * the last reference to be released there is a chance of recursive mutex 3647c478bd9Sstevel@tonic-gate * panic due to ire_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying 3657c478bd9Sstevel@tonic-gate * to restart an ioctl. The one exception is when the caller is sure that 3667c478bd9Sstevel@tonic-gate * this is not the last reference to be released. Eg. if the caller is 3677c478bd9Sstevel@tonic-gate * sure that the ire has not been deleted and won't be deleted. 368bd670b35SErik Nordmark * 369bd670b35SErik Nordmark * In architectures e.g sun4u, where atomic_add_32_nv is just 370bd670b35SErik Nordmark * a cas, we need to maintain the right memory barrier semantics 371bd670b35SErik Nordmark * as that of mutex_exit i.e all the loads and stores should complete 372bd670b35SErik Nordmark * before the cas is executed. membar_exit() does that here. 3737c478bd9Sstevel@tonic-gate */ 3747c478bd9Sstevel@tonic-gate void 3757c478bd9Sstevel@tonic-gate ire_refrele(ire_t *ire) 3767c478bd9Sstevel@tonic-gate { 377bd670b35SErik Nordmark #ifdef DEBUG 378bd670b35SErik Nordmark ire_untrace_ref(ire); 379bd670b35SErik Nordmark #endif 380bd670b35SErik Nordmark ASSERT((ire)->ire_refcnt != 0); 381bd670b35SErik Nordmark membar_exit(); 382bd670b35SErik Nordmark if (atomic_add_32_nv(&(ire)->ire_refcnt, -1) == 0) 383bd670b35SErik Nordmark ire_inactive(ire); 3847c478bd9Sstevel@tonic-gate } 3857c478bd9Sstevel@tonic-gate 3867c478bd9Sstevel@tonic-gate void 3877c478bd9Sstevel@tonic-gate ire_refrele_notr(ire_t *ire) 3887c478bd9Sstevel@tonic-gate { 389bd670b35SErik Nordmark ASSERT((ire)->ire_refcnt != 0); 390bd670b35SErik Nordmark membar_exit(); 391bd670b35SErik Nordmark if (atomic_add_32_nv(&(ire)->ire_refcnt, -1) == 0) 392bd670b35SErik Nordmark ire_inactive(ire); 3937c478bd9Sstevel@tonic-gate } 3947c478bd9Sstevel@tonic-gate 3957c478bd9Sstevel@tonic-gate /* 3967c478bd9Sstevel@tonic-gate * This function is associated with the IP_IOC_IRE_DELETE[_NO_REPLY] 397bd670b35SErik Nordmark * IOCTL[s]. The NO_REPLY form is used by TCP to tell IP that it is 398bd670b35SErik Nordmark * having problems reaching a particular destination. 399bd670b35SErik Nordmark * This will make IP consider alternate routes (e.g., when there are 400bd670b35SErik Nordmark * muliple default routes), and it will also make IP discard any (potentially) 401bd670b35SErik Nordmark * stale redirect. 402bd670b35SErik Nordmark * Management processes may want to use the version that generates a reply. 4037c478bd9Sstevel@tonic-gate * 404bd670b35SErik Nordmark * With the use of NUD like behavior for IPv4/ARP in addition to IPv6 405bd670b35SErik Nordmark * this function shouldn't be necessary for IP to recover from a bad redirect, 406bd670b35SErik Nordmark * a bad default router (when there are multiple default routers), or 407bd670b35SErik Nordmark * a stale ND/ARP entry. But we retain it in any case. 408bd670b35SErik Nordmark * For instance, this is helpful when TCP suspects a failure before NUD does. 4097c478bd9Sstevel@tonic-gate */ 4107c478bd9Sstevel@tonic-gate int 4117c478bd9Sstevel@tonic-gate ip_ire_delete(queue_t *q, mblk_t *mp, cred_t *ioc_cr) 4127c478bd9Sstevel@tonic-gate { 4137c478bd9Sstevel@tonic-gate uchar_t *addr_ucp; 414bd670b35SErik Nordmark uint_t ipversion; 415bd670b35SErik Nordmark sin_t *sin; 416bd670b35SErik Nordmark sin6_t *sin6; 417bd670b35SErik Nordmark ipaddr_t v4addr; 418bd670b35SErik Nordmark in6_addr_t v6addr; 4197c478bd9Sstevel@tonic-gate ire_t *ire; 4207c478bd9Sstevel@tonic-gate ipid_t *ipid; 4217c478bd9Sstevel@tonic-gate zoneid_t zoneid; 422f4b3ec61Sdh155122 ip_stack_t *ipst; 4237c478bd9Sstevel@tonic-gate 4247c478bd9Sstevel@tonic-gate ASSERT(q->q_next == NULL); 425bd670b35SErik Nordmark zoneid = IPCL_ZONEID(Q_TO_CONN(q)); 426f4b3ec61Sdh155122 ipst = CONNQ_TO_IPST(q); 4277c478bd9Sstevel@tonic-gate 4287c478bd9Sstevel@tonic-gate /* 4297c478bd9Sstevel@tonic-gate * Check privilege using the ioctl credential; if it is NULL 4307c478bd9Sstevel@tonic-gate * then this is a kernel message and therefor privileged. 4317c478bd9Sstevel@tonic-gate */ 432f4b3ec61Sdh155122 if (ioc_cr != NULL && secpolicy_ip_config(ioc_cr, B_FALSE) != 0) 4337c478bd9Sstevel@tonic-gate return (EPERM); 4347c478bd9Sstevel@tonic-gate 4357c478bd9Sstevel@tonic-gate ipid = (ipid_t *)mp->b_rptr; 4367c478bd9Sstevel@tonic-gate 4377c478bd9Sstevel@tonic-gate addr_ucp = mi_offset_param(mp, ipid->ipid_addr_offset, 4387c478bd9Sstevel@tonic-gate ipid->ipid_addr_length); 4397c478bd9Sstevel@tonic-gate if (addr_ucp == NULL || !OK_32PTR(addr_ucp)) 4407c478bd9Sstevel@tonic-gate return (EINVAL); 4417c478bd9Sstevel@tonic-gate switch (ipid->ipid_addr_length) { 442bd670b35SErik Nordmark case sizeof (sin_t): 4437c478bd9Sstevel@tonic-gate /* 4447c478bd9Sstevel@tonic-gate * got complete (sockaddr) address - increment addr_ucp to point 4457c478bd9Sstevel@tonic-gate * at the ip_addr field. 4467c478bd9Sstevel@tonic-gate */ 4477c478bd9Sstevel@tonic-gate sin = (sin_t *)addr_ucp; 4487c478bd9Sstevel@tonic-gate addr_ucp = (uchar_t *)&sin->sin_addr.s_addr; 449bd670b35SErik Nordmark ipversion = IPV4_VERSION; 4507c478bd9Sstevel@tonic-gate break; 451bd670b35SErik Nordmark case sizeof (sin6_t): 452bd670b35SErik Nordmark /* 453bd670b35SErik Nordmark * got complete (sockaddr) address - increment addr_ucp to point 454bd670b35SErik Nordmark * at the ip_addr field. 455bd670b35SErik Nordmark */ 456bd670b35SErik Nordmark sin6 = (sin6_t *)addr_ucp; 457bd670b35SErik Nordmark addr_ucp = (uchar_t *)&sin6->sin6_addr; 458bd670b35SErik Nordmark ipversion = IPV6_VERSION; 459bd670b35SErik Nordmark break; 4607c478bd9Sstevel@tonic-gate default: 4617c478bd9Sstevel@tonic-gate return (EINVAL); 4627c478bd9Sstevel@tonic-gate } 463bd670b35SErik Nordmark if (ipversion == IPV4_VERSION) { 4647c478bd9Sstevel@tonic-gate /* Extract the destination address. */ 465bd670b35SErik Nordmark bcopy(addr_ucp, &v4addr, IP_ADDR_LEN); 4667c478bd9Sstevel@tonic-gate 467bd670b35SErik Nordmark ire = ire_ftable_lookup_v4(v4addr, 0, 0, 0, NULL, 468bd670b35SErik Nordmark zoneid, NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL); 469bd670b35SErik Nordmark } else { 470bd670b35SErik Nordmark /* Extract the destination address. */ 471bd670b35SErik Nordmark bcopy(addr_ucp, &v6addr, IPV6_ADDR_LEN); 4727c478bd9Sstevel@tonic-gate 473bd670b35SErik Nordmark ire = ire_ftable_lookup_v6(&v6addr, NULL, NULL, 0, NULL, 474bd670b35SErik Nordmark zoneid, NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL); 4757c478bd9Sstevel@tonic-gate } 4766bdb8e66Sdd193516 if (ire != NULL) { 477bd670b35SErik Nordmark if (ipversion == IPV4_VERSION) { 4787c478bd9Sstevel@tonic-gate ip_rts_change(RTM_LOSING, ire->ire_addr, 4797c478bd9Sstevel@tonic-gate ire->ire_gateway_addr, ire->ire_mask, 480bd670b35SErik Nordmark (Q_TO_CONN(q))->conn_laddr_v4, 0, 0, 0, 481bd670b35SErik Nordmark (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA), 482bd670b35SErik Nordmark ire->ire_ipst); 4837c478bd9Sstevel@tonic-gate } 484bd670b35SErik Nordmark (void) ire_no_good(ire); 4857c478bd9Sstevel@tonic-gate ire_refrele(ire); 4867c478bd9Sstevel@tonic-gate } 4877c478bd9Sstevel@tonic-gate return (0); 4887c478bd9Sstevel@tonic-gate } 4897c478bd9Sstevel@tonic-gate 4907c478bd9Sstevel@tonic-gate /* 4917c478bd9Sstevel@tonic-gate * Initialize the ire that is specific to IPv4 part and call 4927c478bd9Sstevel@tonic-gate * ire_init_common to finish it. 493bd670b35SErik Nordmark * Returns zero or errno. 4947c478bd9Sstevel@tonic-gate */ 495bd670b35SErik Nordmark int 496bd670b35SErik Nordmark ire_init_v4(ire_t *ire, uchar_t *addr, uchar_t *mask, uchar_t *gateway, 497bd670b35SErik Nordmark ushort_t type, ill_t *ill, zoneid_t zoneid, uint_t flags, 498bd670b35SErik Nordmark tsol_gc_t *gc, ip_stack_t *ipst) 4997c478bd9Sstevel@tonic-gate { 500bd670b35SErik Nordmark int error; 501bd670b35SErik Nordmark 50245916cd2Sjpk /* 50345916cd2Sjpk * Reject IRE security attribute creation/initialization 50445916cd2Sjpk * if system is not running in Trusted mode. 50545916cd2Sjpk */ 506bd670b35SErik Nordmark if (gc != NULL && !is_system_labeled()) 507bd670b35SErik Nordmark return (EINVAL); 50845916cd2Sjpk 509f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_alloced); 5107c478bd9Sstevel@tonic-gate 5117c478bd9Sstevel@tonic-gate if (addr != NULL) 5127c478bd9Sstevel@tonic-gate bcopy(addr, &ire->ire_addr, IP_ADDR_LEN); 513bd670b35SErik Nordmark if (gateway != NULL) 514bd670b35SErik Nordmark bcopy(gateway, &ire->ire_gateway_addr, IP_ADDR_LEN); 515bd670b35SErik Nordmark 516bd670b35SErik Nordmark /* Make sure we don't have stray values in some fields */ 517bd670b35SErik Nordmark switch (type) { 518bd670b35SErik Nordmark case IRE_LOOPBACK: 519bd670b35SErik Nordmark case IRE_HOST: 520bd670b35SErik Nordmark case IRE_BROADCAST: 521bd670b35SErik Nordmark case IRE_LOCAL: 522bd670b35SErik Nordmark case IRE_IF_CLONE: 523bd670b35SErik Nordmark ire->ire_mask = IP_HOST_MASK; 524bd670b35SErik Nordmark ire->ire_masklen = IPV4_ABITS; 525bd670b35SErik Nordmark break; 526bd670b35SErik Nordmark case IRE_PREFIX: 527bd670b35SErik Nordmark case IRE_DEFAULT: 528bd670b35SErik Nordmark case IRE_IF_RESOLVER: 529bd670b35SErik Nordmark case IRE_IF_NORESOLVER: 5307c478bd9Sstevel@tonic-gate if (mask != NULL) { 5317c478bd9Sstevel@tonic-gate bcopy(mask, &ire->ire_mask, IP_ADDR_LEN); 5327c478bd9Sstevel@tonic-gate ire->ire_masklen = ip_mask_to_plen(ire->ire_mask); 5337c478bd9Sstevel@tonic-gate } 534bd670b35SErik Nordmark break; 535bd670b35SErik Nordmark case IRE_MULTICAST: 536bd670b35SErik Nordmark case IRE_NOROUTE: 537bd670b35SErik Nordmark ASSERT(mask == NULL); 538bd670b35SErik Nordmark break; 539bd670b35SErik Nordmark default: 540bd670b35SErik Nordmark ASSERT(0); 541bd670b35SErik Nordmark return (EINVAL); 5427c478bd9Sstevel@tonic-gate } 5437c478bd9Sstevel@tonic-gate 544bd670b35SErik Nordmark error = ire_init_common(ire, type, ill, zoneid, flags, IPV4_VERSION, 545bd670b35SErik Nordmark gc, ipst); 546bd670b35SErik Nordmark if (error != NULL) 547bd670b35SErik Nordmark return (error); 5487c478bd9Sstevel@tonic-gate 549bd670b35SErik Nordmark /* Determine which function pointers to use */ 550bd670b35SErik Nordmark ire->ire_postfragfn = ip_xmit; /* Common case */ 5517c478bd9Sstevel@tonic-gate 552bd670b35SErik Nordmark switch (ire->ire_type) { 553bd670b35SErik Nordmark case IRE_LOCAL: 554bd670b35SErik Nordmark ire->ire_sendfn = ire_send_local_v4; 555bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_local_v4; 556bd670b35SErik Nordmark ASSERT(ire->ire_ill != NULL); 5571cb875aeSCathy Zhou if (ire->ire_ill->ill_flags & ILLF_NOACCEPT) 558bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_noaccept_v6; 559bd670b35SErik Nordmark break; 560bd670b35SErik Nordmark case IRE_LOOPBACK: 561bd670b35SErik Nordmark ire->ire_sendfn = ire_send_local_v4; 562bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_loopback_v4; 563bd670b35SErik Nordmark break; 564bd670b35SErik Nordmark case IRE_BROADCAST: 565bd670b35SErik Nordmark ire->ire_postfragfn = ip_postfrag_loopcheck; 566bd670b35SErik Nordmark ire->ire_sendfn = ire_send_broadcast_v4; 567bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_broadcast_v4; 568bd670b35SErik Nordmark break; 569bd670b35SErik Nordmark case IRE_MULTICAST: 570bd670b35SErik Nordmark ire->ire_postfragfn = ip_postfrag_loopcheck; 571bd670b35SErik Nordmark ire->ire_sendfn = ire_send_multicast_v4; 572bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_multicast_v4; 573bd670b35SErik Nordmark break; 574bd670b35SErik Nordmark default: 575bd670b35SErik Nordmark /* 576bd670b35SErik Nordmark * For IRE_IF_ALL and IRE_OFFLINK we forward received 577bd670b35SErik Nordmark * packets by default. 578bd670b35SErik Nordmark */ 579bd670b35SErik Nordmark ire->ire_sendfn = ire_send_wire_v4; 580bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_forward_v4; 581bd670b35SErik Nordmark break; 582bd670b35SErik Nordmark } 583bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 584bd670b35SErik Nordmark ire->ire_sendfn = ire_send_noroute_v4; 585bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_noroute_v4; 586bd670b35SErik Nordmark } else if (ire->ire_flags & RTF_MULTIRT) { 587bd670b35SErik Nordmark ire->ire_postfragfn = ip_postfrag_multirt_v4; 588bd670b35SErik Nordmark ire->ire_sendfn = ire_send_multirt_v4; 589bd670b35SErik Nordmark /* Multirt receive of broadcast uses ire_recv_broadcast_v4 */ 590bd670b35SErik Nordmark if (ire->ire_type != IRE_BROADCAST) 591bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_multirt_v4; 592bd670b35SErik Nordmark } 593bd670b35SErik Nordmark ire->ire_nce_capable = ire_determine_nce_capable(ire); 594bd670b35SErik Nordmark return (0); 5957c478bd9Sstevel@tonic-gate } 5967c478bd9Sstevel@tonic-gate 5977c478bd9Sstevel@tonic-gate /* 598bd670b35SErik Nordmark * Determine ire_nce_capable 5997c478bd9Sstevel@tonic-gate */ 600bd670b35SErik Nordmark boolean_t 601bd670b35SErik Nordmark ire_determine_nce_capable(ire_t *ire) 6027c478bd9Sstevel@tonic-gate { 603bd670b35SErik Nordmark int max_masklen; 6047c478bd9Sstevel@tonic-gate 605bd670b35SErik Nordmark if ((ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) || 606bd670b35SErik Nordmark (ire->ire_type & IRE_MULTICAST)) 607bd670b35SErik Nordmark return (B_TRUE); 6087c478bd9Sstevel@tonic-gate 609bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) 610bd670b35SErik Nordmark max_masklen = IPV4_ABITS; 611bd670b35SErik Nordmark else 612bd670b35SErik Nordmark max_masklen = IPV6_ABITS; 6137c478bd9Sstevel@tonic-gate 614bd670b35SErik Nordmark if ((ire->ire_type & IRE_ONLINK) && ire->ire_masklen == max_masklen) 615bd670b35SErik Nordmark return (B_TRUE); 616bd670b35SErik Nordmark return (B_FALSE); 6177c478bd9Sstevel@tonic-gate } 6187c478bd9Sstevel@tonic-gate 6197c478bd9Sstevel@tonic-gate /* 6207c478bd9Sstevel@tonic-gate * ire_create is called to allocate and initialize a new IRE. 6217c478bd9Sstevel@tonic-gate * 6227c478bd9Sstevel@tonic-gate * NOTE : This is called as writer sometimes though not required 6237c478bd9Sstevel@tonic-gate * by this function. 6247c478bd9Sstevel@tonic-gate */ 6257c478bd9Sstevel@tonic-gate ire_t * 626bd670b35SErik Nordmark ire_create(uchar_t *addr, uchar_t *mask, uchar_t *gateway, 627bd670b35SErik Nordmark ushort_t type, ill_t *ill, zoneid_t zoneid, uint_t flags, tsol_gc_t *gc, 628bd670b35SErik Nordmark ip_stack_t *ipst) 6297c478bd9Sstevel@tonic-gate { 6307c478bd9Sstevel@tonic-gate ire_t *ire; 631bd670b35SErik Nordmark int error; 6327c478bd9Sstevel@tonic-gate 6337c478bd9Sstevel@tonic-gate ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP); 6347c478bd9Sstevel@tonic-gate if (ire == NULL) { 635bd670b35SErik Nordmark DTRACE_PROBE(kmem__cache__alloc); 6367c478bd9Sstevel@tonic-gate return (NULL); 6377c478bd9Sstevel@tonic-gate } 6387c478bd9Sstevel@tonic-gate *ire = ire_null; 6397c478bd9Sstevel@tonic-gate 640bd670b35SErik Nordmark error = ire_init_v4(ire, addr, mask, gateway, type, ill, zoneid, flags, 641bd670b35SErik Nordmark gc, ipst); 642bd670b35SErik Nordmark if (error != 0) { 643bd670b35SErik Nordmark DTRACE_PROBE2(ire__init, ire_t *, ire, int, error); 6447c478bd9Sstevel@tonic-gate kmem_cache_free(ire_cache, ire); 6457c478bd9Sstevel@tonic-gate return (NULL); 6467c478bd9Sstevel@tonic-gate } 6477c478bd9Sstevel@tonic-gate return (ire); 6487c478bd9Sstevel@tonic-gate } 6497c478bd9Sstevel@tonic-gate 6507c478bd9Sstevel@tonic-gate /* 6517c478bd9Sstevel@tonic-gate * Common to IPv4 and IPv6 652bd670b35SErik Nordmark * Returns zero or errno. 6537c478bd9Sstevel@tonic-gate */ 654bd670b35SErik Nordmark int 655bd670b35SErik Nordmark ire_init_common(ire_t *ire, ushort_t type, ill_t *ill, zoneid_t zoneid, 656bd670b35SErik Nordmark uint_t flags, uchar_t ipversion, tsol_gc_t *gc, ip_stack_t *ipst) 6577c478bd9Sstevel@tonic-gate { 658bd670b35SErik Nordmark int error; 6597c478bd9Sstevel@tonic-gate 66045916cd2Sjpk #ifdef DEBUG 661bd670b35SErik Nordmark if (ill != NULL) { 662bd670b35SErik Nordmark if (ill->ill_isv6) 6637c478bd9Sstevel@tonic-gate ASSERT(ipversion == IPV6_VERSION); 6647c478bd9Sstevel@tonic-gate else 6657c478bd9Sstevel@tonic-gate ASSERT(ipversion == IPV4_VERSION); 6667c478bd9Sstevel@tonic-gate } 66745916cd2Sjpk #endif /* DEBUG */ 66845916cd2Sjpk 66945916cd2Sjpk /* 67045916cd2Sjpk * Create/initialize IRE security attribute only in Trusted mode; 671bd670b35SErik Nordmark * if the passed in gc is non-NULL, we expect that the caller 67245916cd2Sjpk * has held a reference to it and will release it when this routine 67345916cd2Sjpk * returns a failure, otherwise we own the reference. We do this 67445916cd2Sjpk * prior to initializing the rest IRE fields. 67545916cd2Sjpk */ 67645916cd2Sjpk if (is_system_labeled()) { 67745916cd2Sjpk if ((type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST | 678bd670b35SErik Nordmark IRE_IF_ALL | IRE_MULTICAST | IRE_NOROUTE)) != 0) { 67945916cd2Sjpk /* release references on behalf of caller */ 68045916cd2Sjpk if (gc != NULL) 68145916cd2Sjpk GC_REFRELE(gc); 682bd670b35SErik Nordmark } else { 683bd670b35SErik Nordmark error = tsol_ire_init_gwattr(ire, ipversion, gc); 684bd670b35SErik Nordmark if (error != 0) 685bd670b35SErik Nordmark return (error); 68645916cd2Sjpk } 68745916cd2Sjpk } 6887c478bd9Sstevel@tonic-gate 6897c478bd9Sstevel@tonic-gate ire->ire_type = type; 6907c478bd9Sstevel@tonic-gate ire->ire_flags = RTF_UP | flags; 6917c478bd9Sstevel@tonic-gate ire->ire_create_time = (uint32_t)gethrestime_sec(); 692bd670b35SErik Nordmark ire->ire_generation = IRE_GENERATION_INITIAL; 6937c478bd9Sstevel@tonic-gate 6947c478bd9Sstevel@tonic-gate /* 695bd670b35SErik Nordmark * The ill_ire_cnt isn't increased until 696bd670b35SErik Nordmark * the IRE is added to ensure that a walker will find 697bd670b35SErik Nordmark * all IREs that hold a reference on an ill. 6987c478bd9Sstevel@tonic-gate * 699bd670b35SErik Nordmark * Note that ill_ire_multicast doesn't hold a ref on the ill since 700bd670b35SErik Nordmark * ire_add() is not called for the IRE_MULTICAST. 7017c478bd9Sstevel@tonic-gate */ 702bd670b35SErik Nordmark ire->ire_ill = ill; 703bd670b35SErik Nordmark ire->ire_zoneid = zoneid; 7047c478bd9Sstevel@tonic-gate ire->ire_ipversion = ipversion; 705bd670b35SErik Nordmark 7067c478bd9Sstevel@tonic-gate mutex_init(&ire->ire_lock, NULL, MUTEX_DEFAULT, NULL); 707c793af95Ssangeeta ire->ire_refcnt = 1; 708bd670b35SErik Nordmark ire->ire_identical_ref = 1; /* Number of ire_delete's needed */ 709f4b3ec61Sdh155122 ire->ire_ipst = ipst; /* No netstack_hold */ 7106a8288c7Scarlsonj ire->ire_trace_disable = B_FALSE; 71145916cd2Sjpk 712bd670b35SErik Nordmark return (0); 7137c478bd9Sstevel@tonic-gate } 7147c478bd9Sstevel@tonic-gate 7157c478bd9Sstevel@tonic-gate /* 716bd670b35SErik Nordmark * This creates an IRE_BROADCAST based on the arguments. 717bd670b35SErik Nordmark * A mirror is ire_lookup_bcast(). 7187c478bd9Sstevel@tonic-gate * 719bd670b35SErik Nordmark * Any supression of unneeded ones is done in ire_add_v4. 720bd670b35SErik Nordmark * We add one IRE_BROADCAST per address. ire_send_broadcast_v4() 721bd670b35SErik Nordmark * takes care of generating a loopback copy of the packet. 7227c478bd9Sstevel@tonic-gate */ 7237c478bd9Sstevel@tonic-gate ire_t ** 724bd670b35SErik Nordmark ire_create_bcast(ill_t *ill, ipaddr_t addr, zoneid_t zoneid, ire_t **irep) 7257c478bd9Sstevel@tonic-gate { 726e11c3f44Smeem ip_stack_t *ipst = ill->ill_ipst; 7277c478bd9Sstevel@tonic-gate 728bd670b35SErik Nordmark ASSERT(IAM_WRITER_ILL(ill)); 729f4b3ec61Sdh155122 7307c478bd9Sstevel@tonic-gate *irep++ = ire_create( 7317c478bd9Sstevel@tonic-gate (uchar_t *)&addr, /* dest addr */ 7327c478bd9Sstevel@tonic-gate (uchar_t *)&ip_g_all_ones, /* mask */ 7337c478bd9Sstevel@tonic-gate NULL, /* no gateway */ 7347c478bd9Sstevel@tonic-gate IRE_BROADCAST, 735bd670b35SErik Nordmark ill, 736bd670b35SErik Nordmark zoneid, 737bd670b35SErik Nordmark RTF_KERNEL, 738f4b3ec61Sdh155122 NULL, 739f4b3ec61Sdh155122 ipst); 7407c478bd9Sstevel@tonic-gate 7417c478bd9Sstevel@tonic-gate return (irep); 7427c478bd9Sstevel@tonic-gate } 7437c478bd9Sstevel@tonic-gate 7447c478bd9Sstevel@tonic-gate /* 745bd670b35SErik Nordmark * This looks up an IRE_BROADCAST based on the arguments. 746bd670b35SErik Nordmark * Mirrors ire_create_bcast(). 7477c478bd9Sstevel@tonic-gate */ 7487c478bd9Sstevel@tonic-gate ire_t * 749bd670b35SErik Nordmark ire_lookup_bcast(ill_t *ill, ipaddr_t addr, zoneid_t zoneid) 7507c478bd9Sstevel@tonic-gate { 7517c478bd9Sstevel@tonic-gate ire_t *ire; 752bd670b35SErik Nordmark int match_args; 7537c478bd9Sstevel@tonic-gate 754bd670b35SErik Nordmark match_args = MATCH_IRE_TYPE | MATCH_IRE_ILL | MATCH_IRE_GW | 755bd670b35SErik Nordmark MATCH_IRE_MASK | MATCH_IRE_ZONEONLY; 756bd670b35SErik Nordmark 757bd670b35SErik Nordmark if (IS_UNDER_IPMP(ill)) 758bd670b35SErik Nordmark match_args |= MATCH_IRE_TESTHIDDEN; 759bd670b35SErik Nordmark 760bd670b35SErik Nordmark ire = ire_ftable_lookup_v4( 761bd670b35SErik Nordmark addr, /* dest addr */ 762bd670b35SErik Nordmark ip_g_all_ones, /* mask */ 763bd670b35SErik Nordmark 0, /* no gateway */ 764bd670b35SErik Nordmark IRE_BROADCAST, 765bd670b35SErik Nordmark ill, 766bd670b35SErik Nordmark zoneid, 767bd670b35SErik Nordmark NULL, 768bd670b35SErik Nordmark match_args, 769bd670b35SErik Nordmark 0, 770bd670b35SErik Nordmark ill->ill_ipst, 771bd670b35SErik Nordmark NULL); 7727c478bd9Sstevel@tonic-gate return (ire); 7737c478bd9Sstevel@tonic-gate } 7747c478bd9Sstevel@tonic-gate 7757c478bd9Sstevel@tonic-gate /* Arrange to call the specified function for every IRE in the world. */ 7767c478bd9Sstevel@tonic-gate void 777f4b3ec61Sdh155122 ire_walk(pfv_t func, void *arg, ip_stack_t *ipst) 7787c478bd9Sstevel@tonic-gate { 779f4b3ec61Sdh155122 ire_walk_ipvers(func, arg, 0, ALL_ZONES, ipst); 7807c478bd9Sstevel@tonic-gate } 7817c478bd9Sstevel@tonic-gate 7827c478bd9Sstevel@tonic-gate void 783f4b3ec61Sdh155122 ire_walk_v4(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst) 7847c478bd9Sstevel@tonic-gate { 785f4b3ec61Sdh155122 ire_walk_ipvers(func, arg, IPV4_VERSION, zoneid, ipst); 7867c478bd9Sstevel@tonic-gate } 7877c478bd9Sstevel@tonic-gate 7887c478bd9Sstevel@tonic-gate void 789f4b3ec61Sdh155122 ire_walk_v6(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst) 7907c478bd9Sstevel@tonic-gate { 791f4b3ec61Sdh155122 ire_walk_ipvers(func, arg, IPV6_VERSION, zoneid, ipst); 7927c478bd9Sstevel@tonic-gate } 7937c478bd9Sstevel@tonic-gate 7947c478bd9Sstevel@tonic-gate /* 7957c478bd9Sstevel@tonic-gate * Walk a particular version. version == 0 means both v4 and v6. 7967c478bd9Sstevel@tonic-gate */ 7977c478bd9Sstevel@tonic-gate static void 798f4b3ec61Sdh155122 ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, zoneid_t zoneid, 799f4b3ec61Sdh155122 ip_stack_t *ipst) 8007c478bd9Sstevel@tonic-gate { 8017c478bd9Sstevel@tonic-gate if (vers != IPV6_VERSION) { 802c793af95Ssangeeta /* 803c793af95Ssangeeta * ip_forwarding_table variable doesn't matter for IPv4 since 804f4b3ec61Sdh155122 * ire_walk_ill_tables uses ips_ip_ftable for IPv4. 805c793af95Ssangeeta */ 8067c478bd9Sstevel@tonic-gate ire_walk_ill_tables(0, 0, func, arg, IP_MASK_TABLE_SIZE, 807c793af95Ssangeeta 0, NULL, 808f4b3ec61Sdh155122 NULL, zoneid, ipst); 8097c478bd9Sstevel@tonic-gate } 8107c478bd9Sstevel@tonic-gate if (vers != IPV4_VERSION) { 8117c478bd9Sstevel@tonic-gate ire_walk_ill_tables(0, 0, func, arg, IP6_MASK_TABLE_SIZE, 812f4b3ec61Sdh155122 ipst->ips_ip6_ftable_hash_size, 813f4b3ec61Sdh155122 ipst->ips_ip_forwarding_table_v6, 814bd670b35SErik Nordmark NULL, zoneid, ipst); 8157c478bd9Sstevel@tonic-gate } 8167c478bd9Sstevel@tonic-gate } 8177c478bd9Sstevel@tonic-gate 8187c478bd9Sstevel@tonic-gate /* 8197924222fSmeem * Arrange to call the specified function for every IRE that matches the ill. 8207c478bd9Sstevel@tonic-gate */ 8217c478bd9Sstevel@tonic-gate void 82245916cd2Sjpk ire_walk_ill(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg, 8237c478bd9Sstevel@tonic-gate ill_t *ill) 8247c478bd9Sstevel@tonic-gate { 8257924222fSmeem uchar_t vers = (ill->ill_isv6 ? IPV6_VERSION : IPV4_VERSION); 8267924222fSmeem 8277924222fSmeem ire_walk_ill_ipvers(match_flags, ire_type, func, arg, vers, ill); 8287c478bd9Sstevel@tonic-gate } 8297c478bd9Sstevel@tonic-gate 8307c478bd9Sstevel@tonic-gate /* 8317924222fSmeem * Walk a particular ill and version. 8327c478bd9Sstevel@tonic-gate */ 8337c478bd9Sstevel@tonic-gate static void 8347c478bd9Sstevel@tonic-gate ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, pfv_t func, 83545916cd2Sjpk void *arg, uchar_t vers, ill_t *ill) 8367c478bd9Sstevel@tonic-gate { 837f4b3ec61Sdh155122 ip_stack_t *ipst = ill->ill_ipst; 838f4b3ec61Sdh155122 8397924222fSmeem if (vers == IPV4_VERSION) { 8407c478bd9Sstevel@tonic-gate ire_walk_ill_tables(match_flags, ire_type, func, arg, 841bd670b35SErik Nordmark IP_MASK_TABLE_SIZE, 842bd670b35SErik Nordmark 0, NULL, 843bd670b35SErik Nordmark ill, ALL_ZONES, ipst); 844bd670b35SErik Nordmark } 845bd670b35SErik Nordmark if (vers != IPV4_VERSION) { 8467c478bd9Sstevel@tonic-gate ire_walk_ill_tables(match_flags, ire_type, func, arg, 847f4b3ec61Sdh155122 IP6_MASK_TABLE_SIZE, ipst->ips_ip6_ftable_hash_size, 848f4b3ec61Sdh155122 ipst->ips_ip_forwarding_table_v6, 849bd670b35SErik Nordmark ill, ALL_ZONES, ipst); 8507c478bd9Sstevel@tonic-gate } 8517c478bd9Sstevel@tonic-gate } 8527c478bd9Sstevel@tonic-gate 853bd670b35SErik Nordmark /* 854bd670b35SErik Nordmark * Do the specific matching of IREs to shared-IP zones. 855bd670b35SErik Nordmark * 856bd670b35SErik Nordmark * We have the same logic as in ire_match_args but implemented slightly 857bd670b35SErik Nordmark * differently. 858bd670b35SErik Nordmark */ 859c793af95Ssangeeta boolean_t 8607c478bd9Sstevel@tonic-gate ire_walk_ill_match(uint_t match_flags, uint_t ire_type, ire_t *ire, 861f4b3ec61Sdh155122 ill_t *ill, zoneid_t zoneid, ip_stack_t *ipst) 8627c478bd9Sstevel@tonic-gate { 863188e1664SErik Nordmark ill_t *dst_ill = ire->ire_ill; 8647c478bd9Sstevel@tonic-gate 8657c478bd9Sstevel@tonic-gate ASSERT(match_flags != 0 || zoneid != ALL_ZONES); 8667c478bd9Sstevel@tonic-gate 867bd670b35SErik Nordmark if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid && 868bd670b35SErik Nordmark ire->ire_zoneid != ALL_ZONES) { 8697c478bd9Sstevel@tonic-gate /* 8707c478bd9Sstevel@tonic-gate * We're walking the IREs for a specific zone. The only relevant 8717c478bd9Sstevel@tonic-gate * IREs are: 8727c478bd9Sstevel@tonic-gate * - all IREs with a matching ire_zoneid 873bd670b35SErik Nordmark * - IRE_IF_ALL IREs for interfaces with a usable source addr 8747c478bd9Sstevel@tonic-gate * with a matching zone 875bd670b35SErik Nordmark * - IRE_OFFLINK with a gateway reachable from the zone 876bd670b35SErik Nordmark * Note that ealier we only did the IRE_OFFLINK check for 877bd670b35SErik Nordmark * IRE_DEFAULT (and only when we had multiple IRE_DEFAULTs). 8787c478bd9Sstevel@tonic-gate */ 879bd670b35SErik Nordmark if (ire->ire_type & IRE_ONLINK) { 880bd670b35SErik Nordmark uint_t ifindex; 881bd670b35SErik Nordmark 8827c478bd9Sstevel@tonic-gate /* 883bd670b35SErik Nordmark * Note there is no IRE_INTERFACE on vniN thus 884bd670b35SErik Nordmark * can't do an IRE lookup for a matching route. 8857c478bd9Sstevel@tonic-gate */ 886bd670b35SErik Nordmark ifindex = dst_ill->ill_usesrc_ifindex; 887bd670b35SErik Nordmark if (ifindex == 0) 8887c478bd9Sstevel@tonic-gate return (B_FALSE); 889bd670b35SErik Nordmark 8907c478bd9Sstevel@tonic-gate /* 891bd670b35SErik Nordmark * If there is a usable source address in the 892bd670b35SErik Nordmark * zone, then it's ok to return an 893bd670b35SErik Nordmark * IRE_INTERFACE 8947c478bd9Sstevel@tonic-gate */ 895bd670b35SErik Nordmark if (!ipif_zone_avail(ifindex, dst_ill->ill_isv6, 896bd670b35SErik Nordmark zoneid, ipst)) { 8977c478bd9Sstevel@tonic-gate return (B_FALSE); 8987c478bd9Sstevel@tonic-gate } 8997c478bd9Sstevel@tonic-gate } 900bd670b35SErik Nordmark if (dst_ill != NULL && (ire->ire_type & IRE_OFFLINK)) { 901bd670b35SErik Nordmark ipif_t *tipif; 902bd670b35SErik Nordmark 903bd670b35SErik Nordmark mutex_enter(&dst_ill->ill_lock); 904bd670b35SErik Nordmark for (tipif = dst_ill->ill_ipif; 905bd670b35SErik Nordmark tipif != NULL; tipif = tipif->ipif_next) { 906bd670b35SErik Nordmark if (!IPIF_IS_CONDEMNED(tipif) && 907bd670b35SErik Nordmark (tipif->ipif_flags & IPIF_UP) && 908bd670b35SErik Nordmark (tipif->ipif_zoneid == zoneid || 909bd670b35SErik Nordmark tipif->ipif_zoneid == ALL_ZONES)) 910bd670b35SErik Nordmark break; 911bd670b35SErik Nordmark } 912bd670b35SErik Nordmark mutex_exit(&dst_ill->ill_lock); 913bd670b35SErik Nordmark if (tipif == NULL) { 9147c478bd9Sstevel@tonic-gate return (B_FALSE); 9157c478bd9Sstevel@tonic-gate } 9167c478bd9Sstevel@tonic-gate } 917188e1664SErik Nordmark } 9187c478bd9Sstevel@tonic-gate /* 919188e1664SErik Nordmark * Except for ALL_ZONES, we only match the offlink routes 920bd670b35SErik Nordmark * where ire_gateway_addr has an IRE_INTERFACE for the zoneid. 9219e3469d3SErik Nordmark * Since we can have leftover routes after the IP addresses have 9229e3469d3SErik Nordmark * changed, the global zone will also match offlink routes where the 9239e3469d3SErik Nordmark * gateway is unreachable from any zone. 9247c478bd9Sstevel@tonic-gate */ 925188e1664SErik Nordmark if ((ire->ire_type & IRE_OFFLINK) && zoneid != ALL_ZONES) { 9267c478bd9Sstevel@tonic-gate in6_addr_t gw_addr_v6; 9279e3469d3SErik Nordmark boolean_t reach; 928e11c3f44Smeem 9297c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV4_VERSION) { 9309e3469d3SErik Nordmark reach = ire_gateway_ok_zone_v4(ire->ire_gateway_addr, 9319e3469d3SErik Nordmark zoneid, dst_ill, NULL, ipst, B_FALSE); 9327c478bd9Sstevel@tonic-gate } else { 9337c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV6_VERSION); 9347c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 9357c478bd9Sstevel@tonic-gate gw_addr_v6 = ire->ire_gateway_addr_v6; 9367c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 937bd670b35SErik Nordmark 9389e3469d3SErik Nordmark reach = ire_gateway_ok_zone_v6(&gw_addr_v6, zoneid, 9399e3469d3SErik Nordmark dst_ill, NULL, ipst, B_FALSE); 9409e3469d3SErik Nordmark } 9419e3469d3SErik Nordmark if (!reach) { 9429e3469d3SErik Nordmark if (zoneid != GLOBAL_ZONEID) 9437c478bd9Sstevel@tonic-gate return (B_FALSE); 9449e3469d3SErik Nordmark 9459e3469d3SErik Nordmark /* 9469e3469d3SErik Nordmark * Check if ALL_ZONES reachable - if not then let the 9479e3469d3SErik Nordmark * global zone see it. 9489e3469d3SErik Nordmark */ 9499e3469d3SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 9509e3469d3SErik Nordmark reach = ire_gateway_ok_zone_v4( 9519e3469d3SErik Nordmark ire->ire_gateway_addr, ALL_ZONES, 9529e3469d3SErik Nordmark dst_ill, NULL, ipst, B_FALSE); 9539e3469d3SErik Nordmark } else { 9549e3469d3SErik Nordmark reach = ire_gateway_ok_zone_v6(&gw_addr_v6, 9559e3469d3SErik Nordmark ALL_ZONES, dst_ill, NULL, ipst, B_FALSE); 9569e3469d3SErik Nordmark } 9579e3469d3SErik Nordmark if (reach) { 9589e3469d3SErik Nordmark /* 9599e3469d3SErik Nordmark * Some other zone could see it, hence hide it 9609e3469d3SErik Nordmark * in the global zone. 9619e3469d3SErik Nordmark */ 9629e3469d3SErik Nordmark return (B_FALSE); 9639e3469d3SErik Nordmark } 9647c478bd9Sstevel@tonic-gate } 9657c478bd9Sstevel@tonic-gate } 9667c478bd9Sstevel@tonic-gate 9677c478bd9Sstevel@tonic-gate if (((!(match_flags & MATCH_IRE_TYPE)) || 9687c478bd9Sstevel@tonic-gate (ire->ire_type & ire_type)) && 9697c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_ILL)) || 970bd670b35SErik Nordmark (dst_ill == ill || 971bd670b35SErik Nordmark dst_ill != NULL && IS_IN_SAME_ILLGRP(dst_ill, ill)))) { 9727c478bd9Sstevel@tonic-gate return (B_TRUE); 9737c478bd9Sstevel@tonic-gate } 9747c478bd9Sstevel@tonic-gate return (B_FALSE); 9757c478bd9Sstevel@tonic-gate } 9767c478bd9Sstevel@tonic-gate 977c793af95Ssangeeta int 978c793af95Ssangeeta rtfunc(struct radix_node *rn, void *arg) 979c793af95Ssangeeta { 980c793af95Ssangeeta struct rtfuncarg *rtf = arg; 981c793af95Ssangeeta struct rt_entry *rt; 982c793af95Ssangeeta irb_t *irb; 983c793af95Ssangeeta ire_t *ire; 984c793af95Ssangeeta boolean_t ret; 985c793af95Ssangeeta 986c793af95Ssangeeta rt = (struct rt_entry *)rn; 987c793af95Ssangeeta ASSERT(rt != NULL); 988c793af95Ssangeeta irb = &rt->rt_irb; 989c793af95Ssangeeta for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 990c793af95Ssangeeta if ((rtf->rt_match_flags != 0) || 991c793af95Ssangeeta (rtf->rt_zoneid != ALL_ZONES)) { 992c793af95Ssangeeta ret = ire_walk_ill_match(rtf->rt_match_flags, 993c793af95Ssangeeta rtf->rt_ire_type, ire, 994f4b3ec61Sdh155122 rtf->rt_ill, rtf->rt_zoneid, rtf->rt_ipst); 995bd670b35SErik Nordmark } else { 996c793af95Ssangeeta ret = B_TRUE; 997bd670b35SErik Nordmark } 998c793af95Ssangeeta if (ret) 999c793af95Ssangeeta (*rtf->rt_func)(ire, rtf->rt_arg); 1000c793af95Ssangeeta } 1001c793af95Ssangeeta return (0); 1002c793af95Ssangeeta } 1003c793af95Ssangeeta 10047c478bd9Sstevel@tonic-gate /* 1005bd670b35SErik Nordmark * Walk the ftable entries that match the ill. 10067c478bd9Sstevel@tonic-gate */ 1007c793af95Ssangeeta void 10087c478bd9Sstevel@tonic-gate ire_walk_ill_tables(uint_t match_flags, uint_t ire_type, pfv_t func, 100945916cd2Sjpk void *arg, size_t ftbl_sz, size_t htbl_sz, irb_t **ipftbl, 1010bd670b35SErik Nordmark ill_t *ill, zoneid_t zoneid, 1011f4b3ec61Sdh155122 ip_stack_t *ipst) 10127c478bd9Sstevel@tonic-gate { 10137c478bd9Sstevel@tonic-gate irb_t *irb_ptr; 10147c478bd9Sstevel@tonic-gate irb_t *irb; 10157c478bd9Sstevel@tonic-gate ire_t *ire; 10167c478bd9Sstevel@tonic-gate int i, j; 10177c478bd9Sstevel@tonic-gate boolean_t ret; 1018c793af95Ssangeeta struct rtfuncarg rtfarg; 10197c478bd9Sstevel@tonic-gate 1020e11c3f44Smeem ASSERT((!(match_flags & MATCH_IRE_ILL)) || (ill != NULL)); 10217c478bd9Sstevel@tonic-gate ASSERT(!(match_flags & MATCH_IRE_TYPE) || (ire_type != 0)); 1022bd670b35SErik Nordmark 1023c793af95Ssangeeta /* knobs such that routine is called only for v6 case */ 1024f4b3ec61Sdh155122 if (ipftbl == ipst->ips_ip_forwarding_table_v6) { 10257c478bd9Sstevel@tonic-gate for (i = (ftbl_sz - 1); i >= 0; i--) { 10267c478bd9Sstevel@tonic-gate if ((irb_ptr = ipftbl[i]) == NULL) 10277c478bd9Sstevel@tonic-gate continue; 10287c478bd9Sstevel@tonic-gate for (j = 0; j < htbl_sz; j++) { 10297c478bd9Sstevel@tonic-gate irb = &irb_ptr[j]; 10307c478bd9Sstevel@tonic-gate if (irb->irb_ire == NULL) 10317c478bd9Sstevel@tonic-gate continue; 1032c793af95Ssangeeta 1033bd670b35SErik Nordmark irb_refhold(irb); 10347c478bd9Sstevel@tonic-gate for (ire = irb->irb_ire; ire != NULL; 10357c478bd9Sstevel@tonic-gate ire = ire->ire_next) { 10367c478bd9Sstevel@tonic-gate if (match_flags == 0 && 10377c478bd9Sstevel@tonic-gate zoneid == ALL_ZONES) { 10387c478bd9Sstevel@tonic-gate ret = B_TRUE; 10397c478bd9Sstevel@tonic-gate } else { 1040c793af95Ssangeeta ret = 1041c793af95Ssangeeta ire_walk_ill_match( 1042c793af95Ssangeeta match_flags, 1043c793af95Ssangeeta ire_type, ire, ill, 1044f4b3ec61Sdh155122 zoneid, ipst); 10457c478bd9Sstevel@tonic-gate } 10467c478bd9Sstevel@tonic-gate if (ret) 10477c478bd9Sstevel@tonic-gate (*func)(ire, arg); 10487c478bd9Sstevel@tonic-gate } 1049bd670b35SErik Nordmark irb_refrele(irb); 10507c478bd9Sstevel@tonic-gate } 10517c478bd9Sstevel@tonic-gate } 1052c793af95Ssangeeta } else { 1053188e1664SErik Nordmark bzero(&rtfarg, sizeof (rtfarg)); 1054c793af95Ssangeeta rtfarg.rt_func = func; 1055c793af95Ssangeeta rtfarg.rt_arg = arg; 1056c793af95Ssangeeta if (match_flags != 0) { 1057c793af95Ssangeeta rtfarg.rt_match_flags = match_flags; 1058c793af95Ssangeeta } 1059c793af95Ssangeeta rtfarg.rt_ire_type = ire_type; 1060c793af95Ssangeeta rtfarg.rt_ill = ill; 1061c793af95Ssangeeta rtfarg.rt_zoneid = zoneid; 1062f4b3ec61Sdh155122 rtfarg.rt_ipst = ipst; /* No netstack_hold */ 1063f4b3ec61Sdh155122 (void) ipst->ips_ip_ftable->rnh_walktree_mt( 1064f4b3ec61Sdh155122 ipst->ips_ip_ftable, 1065f4b3ec61Sdh155122 rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn); 1066c793af95Ssangeeta } 10677c478bd9Sstevel@tonic-gate } 10687c478bd9Sstevel@tonic-gate 10697c478bd9Sstevel@tonic-gate /* 10707c478bd9Sstevel@tonic-gate * This function takes a mask and returns 10717c478bd9Sstevel@tonic-gate * number of bits set in the mask. If no 10727c478bd9Sstevel@tonic-gate * bit is set it returns 0. 10737c478bd9Sstevel@tonic-gate * Assumes a contiguous mask. 10747c478bd9Sstevel@tonic-gate */ 10757c478bd9Sstevel@tonic-gate int 10767c478bd9Sstevel@tonic-gate ip_mask_to_plen(ipaddr_t mask) 10777c478bd9Sstevel@tonic-gate { 10787c478bd9Sstevel@tonic-gate return (mask == 0 ? 0 : IP_ABITS - (ffs(ntohl(mask)) -1)); 10797c478bd9Sstevel@tonic-gate } 10807c478bd9Sstevel@tonic-gate 10817c478bd9Sstevel@tonic-gate /* 10827c478bd9Sstevel@tonic-gate * Convert length for a mask to the mask. 10837c478bd9Sstevel@tonic-gate */ 10847c478bd9Sstevel@tonic-gate ipaddr_t 10857c478bd9Sstevel@tonic-gate ip_plen_to_mask(uint_t masklen) 10867c478bd9Sstevel@tonic-gate { 1087bd670b35SErik Nordmark if (masklen == 0) 1088bd670b35SErik Nordmark return (0); 1089bd670b35SErik Nordmark 10907c478bd9Sstevel@tonic-gate return (htonl(IP_HOST_MASK << (IP_ABITS - masklen))); 10917c478bd9Sstevel@tonic-gate } 10927c478bd9Sstevel@tonic-gate 10937c478bd9Sstevel@tonic-gate void 10947c478bd9Sstevel@tonic-gate ire_atomic_end(irb_t *irb_ptr, ire_t *ire) 10957c478bd9Sstevel@tonic-gate { 10967c478bd9Sstevel@tonic-gate ill_t *ill; 10977c478bd9Sstevel@tonic-gate 1098bd670b35SErik Nordmark ill = ire->ire_ill; 1099bd670b35SErik Nordmark if (ill != NULL) 1100bd670b35SErik Nordmark mutex_exit(&ill->ill_lock); 1101bd670b35SErik Nordmark rw_exit(&irb_ptr->irb_lock); 11027c478bd9Sstevel@tonic-gate } 11037c478bd9Sstevel@tonic-gate 1104bd670b35SErik Nordmark /* 1105bd670b35SErik Nordmark * ire_add_v[46] atomically make sure that the ill associated 1106bd670b35SErik Nordmark * with the new ire is not going away i.e., we check ILL_CONDEMNED. 1107bd670b35SErik Nordmark */ 1108bd670b35SErik Nordmark int 1109bd670b35SErik Nordmark ire_atomic_start(irb_t *irb_ptr, ire_t *ire) 1110bd670b35SErik Nordmark { 1111bd670b35SErik Nordmark ill_t *ill; 1112bd670b35SErik Nordmark 1113bd670b35SErik Nordmark ill = ire->ire_ill; 1114bd670b35SErik Nordmark 1115bd670b35SErik Nordmark rw_enter(&irb_ptr->irb_lock, RW_WRITER); 1116bd670b35SErik Nordmark if (ill != NULL) { 11177c478bd9Sstevel@tonic-gate mutex_enter(&ill->ill_lock); 1118bd670b35SErik Nordmark 1119bd670b35SErik Nordmark /* 1120bd670b35SErik Nordmark * Don't allow IRE's to be created on dying ills. 1121bd670b35SErik Nordmark */ 11227c478bd9Sstevel@tonic-gate if (ill->ill_state_flags & ILL_CONDEMNED) { 1123bd670b35SErik Nordmark ire_atomic_end(irb_ptr, ire); 1124bd670b35SErik Nordmark return (ENXIO); 11257c478bd9Sstevel@tonic-gate } 11267c478bd9Sstevel@tonic-gate 1127bd670b35SErik Nordmark if (IS_UNDER_IPMP(ill)) { 1128bd670b35SErik Nordmark int error = 0; 1129bd670b35SErik Nordmark mutex_enter(&ill->ill_phyint->phyint_lock); 1130bd670b35SErik Nordmark if (!ipmp_ill_is_active(ill) && 1131bd670b35SErik Nordmark IRE_HIDDEN_TYPE(ire->ire_type) && 1132bd670b35SErik Nordmark !ire->ire_testhidden) { 1133bd670b35SErik Nordmark error = EINVAL; 1134dc3879f9Sjarrett } 1135bd670b35SErik Nordmark mutex_exit(&ill->ill_phyint->phyint_lock); 1136dc3879f9Sjarrett if (error != 0) { 1137bd670b35SErik Nordmark ire_atomic_end(irb_ptr, ire); 1138dc3879f9Sjarrett return (error); 1139dc3879f9Sjarrett } 1140dc3879f9Sjarrett } 1141bd670b35SErik Nordmark 1142bd670b35SErik Nordmark } 1143bd670b35SErik Nordmark return (0); 11447c478bd9Sstevel@tonic-gate } 11457c478bd9Sstevel@tonic-gate 11467c478bd9Sstevel@tonic-gate /* 1147bd670b35SErik Nordmark * Add a fully initialized IRE to the forwarding table. 1148bd670b35SErik Nordmark * This returns NULL on failure, or a held IRE on success. 1149bd670b35SErik Nordmark * Normally the returned IRE is the same as the argument. But a different 1150bd670b35SErik Nordmark * IRE will be returned if the added IRE is deemed identical to an existing 1151bd670b35SErik Nordmark * one. In that case ire_identical_ref will be increased. 1152bd670b35SErik Nordmark * The caller always needs to do an ire_refrele() on the returned IRE. 11537c478bd9Sstevel@tonic-gate */ 1154bd670b35SErik Nordmark ire_t * 1155bd670b35SErik Nordmark ire_add(ire_t *ire) 1156bd670b35SErik Nordmark { 1157bd670b35SErik Nordmark if (IRE_HIDDEN_TYPE(ire->ire_type) && 1158bd670b35SErik Nordmark ire->ire_ill != NULL && IS_UNDER_IPMP(ire->ire_ill)) { 1159bd670b35SErik Nordmark /* 1160bd670b35SErik Nordmark * IREs hosted on interfaces that are under IPMP 1161bd670b35SErik Nordmark * should be hidden so that applications don't 1162bd670b35SErik Nordmark * accidentally end up sending packets with test 1163bd670b35SErik Nordmark * addresses as their source addresses, or 1164bd670b35SErik Nordmark * sending out interfaces that are e.g. IFF_INACTIVE. 1165bd670b35SErik Nordmark * Hide them here. 1166bd670b35SErik Nordmark */ 1167bd670b35SErik Nordmark ire->ire_testhidden = B_TRUE; 1168bd670b35SErik Nordmark } 1169bd670b35SErik Nordmark 11705c0b7edeSseb if (ire->ire_ipversion == IPV6_VERSION) 1171bd670b35SErik Nordmark return (ire_add_v6(ire)); 11727c478bd9Sstevel@tonic-gate else 1173bd670b35SErik Nordmark return (ire_add_v4(ire)); 11747c478bd9Sstevel@tonic-gate } 11757c478bd9Sstevel@tonic-gate 11767c478bd9Sstevel@tonic-gate /* 1177bd670b35SErik Nordmark * Add a fully initialized IPv4 IRE to the forwarding table. 1178bd670b35SErik Nordmark * This returns NULL on failure, or a held IRE on success. 1179bd670b35SErik Nordmark * Normally the returned IRE is the same as the argument. But a different 1180bd670b35SErik Nordmark * IRE will be returned if the added IRE is deemed identical to an existing 1181bd670b35SErik Nordmark * one. In that case ire_identical_ref will be increased. 1182bd670b35SErik Nordmark * The caller always needs to do an ire_refrele() on the returned IRE. 11837c478bd9Sstevel@tonic-gate */ 1184bd670b35SErik Nordmark static ire_t * 1185bd670b35SErik Nordmark ire_add_v4(ire_t *ire) 11867c478bd9Sstevel@tonic-gate { 11877c478bd9Sstevel@tonic-gate ire_t *ire1; 11887c478bd9Sstevel@tonic-gate irb_t *irb_ptr; 11897c478bd9Sstevel@tonic-gate ire_t **irep; 1190bd670b35SErik Nordmark int match_flags; 11917c478bd9Sstevel@tonic-gate int error; 1192f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 1193e11c3f44Smeem 1194bd670b35SErik Nordmark if (ire->ire_ill != NULL) 1195bd670b35SErik Nordmark ASSERT(!MUTEX_HELD(&ire->ire_ill->ill_lock)); 11967c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV4_VERSION); 11977c478bd9Sstevel@tonic-gate 11987c478bd9Sstevel@tonic-gate /* Make sure the address is properly masked. */ 11997c478bd9Sstevel@tonic-gate ire->ire_addr &= ire->ire_mask; 12007c478bd9Sstevel@tonic-gate 1201bd670b35SErik Nordmark match_flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW); 1202c793af95Ssangeeta 1203bd670b35SErik Nordmark if (ire->ire_ill != NULL) { 1204bd670b35SErik Nordmark match_flags |= MATCH_IRE_ILL; 1205bd670b35SErik Nordmark } 1206bd670b35SErik Nordmark irb_ptr = ire_get_bucket(ire); 1207bd670b35SErik Nordmark if (irb_ptr == NULL) { 1208bd670b35SErik Nordmark printf("no bucket for %p\n", (void *)ire); 12097c478bd9Sstevel@tonic-gate ire_delete(ire); 1210bd670b35SErik Nordmark return (NULL); 12117c478bd9Sstevel@tonic-gate } 12127c478bd9Sstevel@tonic-gate 12137c478bd9Sstevel@tonic-gate /* 1214bd670b35SErik Nordmark * Start the atomic add of the ire. Grab the ill lock, 1215bd670b35SErik Nordmark * the bucket lock. Check for condemned. 12167c478bd9Sstevel@tonic-gate */ 1217bd670b35SErik Nordmark error = ire_atomic_start(irb_ptr, ire); 1218bd670b35SErik Nordmark if (error != 0) { 1219bd670b35SErik Nordmark printf("no ire_atomic_start for %p\n", (void *)ire); 1220bd670b35SErik Nordmark ire_delete(ire); 1221bd670b35SErik Nordmark irb_refrele(irb_ptr); 1222bd670b35SErik Nordmark return (NULL); 1223bd670b35SErik Nordmark } 12247c478bd9Sstevel@tonic-gate /* 1225e11c3f44Smeem * If we are creating a hidden IRE, make sure we search for 1226e11c3f44Smeem * hidden IREs when searching for duplicates below. 1227e11c3f44Smeem * Otherwise, we might find an IRE on some other interface 1228e11c3f44Smeem * that's not marked hidden. 12297c478bd9Sstevel@tonic-gate */ 1230bd670b35SErik Nordmark if (ire->ire_testhidden) 1231bd670b35SErik Nordmark match_flags |= MATCH_IRE_TESTHIDDEN; 12327c478bd9Sstevel@tonic-gate 12337c478bd9Sstevel@tonic-gate /* 12347c478bd9Sstevel@tonic-gate * Atomically check for duplicate and insert in the table. 12357c478bd9Sstevel@tonic-gate */ 12367c478bd9Sstevel@tonic-gate for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) { 1237bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire1)) 12387c478bd9Sstevel@tonic-gate continue; 12397c478bd9Sstevel@tonic-gate /* 1240bd670b35SErik Nordmark * Here we need an exact match on zoneid, i.e., 1241bd670b35SErik Nordmark * ire_match_args doesn't fit. 12427c478bd9Sstevel@tonic-gate */ 12437c478bd9Sstevel@tonic-gate if (ire1->ire_zoneid != ire->ire_zoneid) 12447c478bd9Sstevel@tonic-gate continue; 1245bd670b35SErik Nordmark 1246bd670b35SErik Nordmark if (ire1->ire_type != ire->ire_type) 1247bd670b35SErik Nordmark continue; 1248bd670b35SErik Nordmark 1249bd670b35SErik Nordmark /* 1250bd670b35SErik Nordmark * Note: We do not allow multiple routes that differ only 1251bd670b35SErik Nordmark * in the gateway security attributes; such routes are 1252bd670b35SErik Nordmark * considered duplicates. 1253bd670b35SErik Nordmark * To change that we explicitly have to treat them as 1254bd670b35SErik Nordmark * different here. 1255bd670b35SErik Nordmark */ 12567c478bd9Sstevel@tonic-gate if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask, 1257bd670b35SErik Nordmark ire->ire_gateway_addr, ire->ire_type, ire->ire_ill, 1258bd670b35SErik Nordmark ire->ire_zoneid, NULL, match_flags)) { 12597c478bd9Sstevel@tonic-gate /* 12607c478bd9Sstevel@tonic-gate * Return the old ire after doing a REFHOLD. 12617c478bd9Sstevel@tonic-gate * As most of the callers continue to use the IRE 12627c478bd9Sstevel@tonic-gate * after adding, we return a held ire. This will 12637c478bd9Sstevel@tonic-gate * avoid a lookup in the caller again. If the callers 12647c478bd9Sstevel@tonic-gate * don't want to use it, they need to do a REFRELE. 1265*53287767SSowmini Varadhan * 1266*53287767SSowmini Varadhan * We only allow exactly one IRE_IF_CLONE for any dst, 1267*53287767SSowmini Varadhan * so, if the is an IF_CLONE, return the ire without 1268*53287767SSowmini Varadhan * an identical_ref, but with an ire_ref held. 12697c478bd9Sstevel@tonic-gate */ 1270*53287767SSowmini Varadhan if (ire->ire_type != IRE_IF_CLONE) { 1271bd670b35SErik Nordmark atomic_add_32(&ire1->ire_identical_ref, 1); 1272bd670b35SErik Nordmark DTRACE_PROBE2(ire__add__exist, ire_t *, ire1, 1273bd670b35SErik Nordmark ire_t *, ire); 1274*53287767SSowmini Varadhan } 1275bd670b35SErik Nordmark ire_refhold(ire1); 12767c478bd9Sstevel@tonic-gate ire_atomic_end(irb_ptr, ire); 12777c478bd9Sstevel@tonic-gate ire_delete(ire); 1278bd670b35SErik Nordmark irb_refrele(irb_ptr); 1279bd670b35SErik Nordmark return (ire1); 12807c478bd9Sstevel@tonic-gate } 12817c478bd9Sstevel@tonic-gate } 1282e11c3f44Smeem 1283c793af95Ssangeeta /* 1284bd670b35SErik Nordmark * Normally we do head insertion since most things do not care about 1285bd670b35SErik Nordmark * the order of the IREs in the bucket. Note that ip_cgtp_bcast_add 1286bd670b35SErik Nordmark * assumes we at least do head insertion so that its IRE_BROADCAST 1287bd670b35SErik Nordmark * arrive ahead of existing IRE_HOST for the same address. 1288bd670b35SErik Nordmark * However, due to shared-IP zones (and restrict_interzone_loopback) 1289bd670b35SErik Nordmark * we can have an IRE_LOCAL as well as IRE_IF_CLONE for the same 1290bd670b35SErik Nordmark * address. For that reason we do tail insertion for IRE_IF_CLONE. 1291bd670b35SErik Nordmark * Due to the IRE_BROADCAST on cgtp0, which must be last in the bucket, 1292bd670b35SErik Nordmark * we do tail insertion of IRE_BROADCASTs that do not have RTF_MULTIRT 1293bd670b35SErik Nordmark * set. 12947c478bd9Sstevel@tonic-gate */ 12957c478bd9Sstevel@tonic-gate irep = (ire_t **)irb_ptr; 1296bd670b35SErik Nordmark if ((ire->ire_type & IRE_IF_CLONE) || 1297bd670b35SErik Nordmark ((ire->ire_type & IRE_BROADCAST) && 1298bd670b35SErik Nordmark !(ire->ire_flags & RTF_MULTIRT))) { 1299bd670b35SErik Nordmark while ((ire1 = *irep) != NULL) 13007c478bd9Sstevel@tonic-gate irep = &ire1->ire_next; 13017c478bd9Sstevel@tonic-gate } 13027c478bd9Sstevel@tonic-gate /* Insert at *irep */ 13037c478bd9Sstevel@tonic-gate ire1 = *irep; 13047c478bd9Sstevel@tonic-gate if (ire1 != NULL) 13057c478bd9Sstevel@tonic-gate ire1->ire_ptpn = &ire->ire_next; 13067c478bd9Sstevel@tonic-gate ire->ire_next = ire1; 13077c478bd9Sstevel@tonic-gate /* Link the new one in. */ 13087c478bd9Sstevel@tonic-gate ire->ire_ptpn = irep; 13097c478bd9Sstevel@tonic-gate 13107c478bd9Sstevel@tonic-gate /* 13117c478bd9Sstevel@tonic-gate * ire_walk routines de-reference ire_next without holding 13127c478bd9Sstevel@tonic-gate * a lock. Before we point to the new ire, we want to make 13137c478bd9Sstevel@tonic-gate * sure the store that sets the ire_next of the new ire 13147c478bd9Sstevel@tonic-gate * reaches global visibility, so that ire_walk routines 13157c478bd9Sstevel@tonic-gate * don't see a truncated list of ires i.e if the ire_next 13167c478bd9Sstevel@tonic-gate * of the new ire gets set after we do "*irep = ire" due 13177c478bd9Sstevel@tonic-gate * to re-ordering, the ire_walk thread will see a NULL 13187c478bd9Sstevel@tonic-gate * once it accesses the ire_next of the new ire. 13197c478bd9Sstevel@tonic-gate * membar_producer() makes sure that the following store 13207c478bd9Sstevel@tonic-gate * happens *after* all of the above stores. 13217c478bd9Sstevel@tonic-gate */ 13227c478bd9Sstevel@tonic-gate membar_producer(); 13237c478bd9Sstevel@tonic-gate *irep = ire; 13247c478bd9Sstevel@tonic-gate ire->ire_bucket = irb_ptr; 13257c478bd9Sstevel@tonic-gate /* 13267c478bd9Sstevel@tonic-gate * We return a bumped up IRE above. Keep it symmetrical 13277c478bd9Sstevel@tonic-gate * so that the callers will always have to release. This 13287c478bd9Sstevel@tonic-gate * helps the callers of this function because they continue 13297c478bd9Sstevel@tonic-gate * to use the IRE after adding and hence they don't have to 13307c478bd9Sstevel@tonic-gate * lookup again after we return the IRE. 13317c478bd9Sstevel@tonic-gate * 13327c478bd9Sstevel@tonic-gate * NOTE : We don't have to use atomics as this is appearing 13337c478bd9Sstevel@tonic-gate * in the list for the first time and no one else can bump 13347c478bd9Sstevel@tonic-gate * up the reference count on this yet. 13357c478bd9Sstevel@tonic-gate */ 1336bd670b35SErik Nordmark ire_refhold_locked(ire); 1337f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_inserted); 1338c793af95Ssangeeta 13397c478bd9Sstevel@tonic-gate irb_ptr->irb_ire_cnt++; 1340bd670b35SErik Nordmark if (irb_ptr->irb_marks & IRB_MARK_DYNAMIC) 1341c793af95Ssangeeta irb_ptr->irb_nire++; 1342c793af95Ssangeeta 1343bd670b35SErik Nordmark if (ire->ire_ill != NULL) { 1344bd670b35SErik Nordmark ire->ire_ill->ill_ire_cnt++; 1345bd670b35SErik Nordmark ASSERT(ire->ire_ill->ill_ire_cnt != 0); /* Wraparound */ 13467c478bd9Sstevel@tonic-gate } 13477c478bd9Sstevel@tonic-gate 13487c478bd9Sstevel@tonic-gate ire_atomic_end(irb_ptr, ire); 13497c478bd9Sstevel@tonic-gate 1350bd670b35SErik Nordmark /* Make any caching of the IREs be notified or updated */ 13517c478bd9Sstevel@tonic-gate ire_flush_cache_v4(ire, IRE_FLUSH_ADD); 1352bd670b35SErik Nordmark 1353bd670b35SErik Nordmark if (ire->ire_ill != NULL) 1354bd670b35SErik Nordmark ASSERT(!MUTEX_HELD(&ire->ire_ill->ill_lock)); 1355bd670b35SErik Nordmark irb_refrele(irb_ptr); 1356bd670b35SErik Nordmark return (ire); 13577c478bd9Sstevel@tonic-gate } 13587c478bd9Sstevel@tonic-gate 13597c478bd9Sstevel@tonic-gate /* 1360bd670b35SErik Nordmark * irb_refrele is the only caller of the function. ire_unlink calls to 13617c478bd9Sstevel@tonic-gate * do the final cleanup for this ire. 13627c478bd9Sstevel@tonic-gate */ 13637c478bd9Sstevel@tonic-gate void 13647c478bd9Sstevel@tonic-gate ire_cleanup(ire_t *ire) 13657c478bd9Sstevel@tonic-gate { 13667c478bd9Sstevel@tonic-gate ire_t *ire_next; 1367f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 13687c478bd9Sstevel@tonic-gate 13697c478bd9Sstevel@tonic-gate ASSERT(ire != NULL); 13707c478bd9Sstevel@tonic-gate 13717c478bd9Sstevel@tonic-gate while (ire != NULL) { 13727c478bd9Sstevel@tonic-gate ire_next = ire->ire_next; 13737c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV4_VERSION) { 13747c478bd9Sstevel@tonic-gate ire_delete_v4(ire); 1375f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, 1376f4b3ec61Sdh155122 ire_stats_deleted); 13777c478bd9Sstevel@tonic-gate } else { 13787c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV6_VERSION); 13797c478bd9Sstevel@tonic-gate ire_delete_v6(ire); 1380f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, 1381f4b3ec61Sdh155122 ire_stats_deleted); 13827c478bd9Sstevel@tonic-gate } 13837c478bd9Sstevel@tonic-gate /* 13847c478bd9Sstevel@tonic-gate * Now it's really out of the list. Before doing the 13857c478bd9Sstevel@tonic-gate * REFRELE, set ire_next to NULL as ire_inactive asserts 13867c478bd9Sstevel@tonic-gate * so. 13877c478bd9Sstevel@tonic-gate */ 13887c478bd9Sstevel@tonic-gate ire->ire_next = NULL; 1389bd670b35SErik Nordmark ire_refrele_notr(ire); 13907c478bd9Sstevel@tonic-gate ire = ire_next; 13917c478bd9Sstevel@tonic-gate } 13927c478bd9Sstevel@tonic-gate } 13937c478bd9Sstevel@tonic-gate 13947c478bd9Sstevel@tonic-gate /* 1395bd670b35SErik Nordmark * irb_refrele is the only caller of the function. It calls to unlink 13967c478bd9Sstevel@tonic-gate * all the CONDEMNED ires from this bucket. 13977c478bd9Sstevel@tonic-gate */ 13987c478bd9Sstevel@tonic-gate ire_t * 13997c478bd9Sstevel@tonic-gate ire_unlink(irb_t *irb) 14007c478bd9Sstevel@tonic-gate { 14017c478bd9Sstevel@tonic-gate ire_t *ire; 14027c478bd9Sstevel@tonic-gate ire_t *ire1; 14037c478bd9Sstevel@tonic-gate ire_t **ptpn; 14047c478bd9Sstevel@tonic-gate ire_t *ire_list = NULL; 14057c478bd9Sstevel@tonic-gate 14067c478bd9Sstevel@tonic-gate ASSERT(RW_WRITE_HELD(&irb->irb_lock)); 1407bd670b35SErik Nordmark ASSERT(((irb->irb_marks & IRB_MARK_DYNAMIC) && irb->irb_refcnt == 1) || 1408c793af95Ssangeeta (irb->irb_refcnt == 0)); 1409c793af95Ssangeeta ASSERT(irb->irb_marks & IRB_MARK_CONDEMNED); 14107c478bd9Sstevel@tonic-gate ASSERT(irb->irb_ire != NULL); 14117c478bd9Sstevel@tonic-gate 14127c478bd9Sstevel@tonic-gate for (ire = irb->irb_ire; ire != NULL; ire = ire1) { 14137c478bd9Sstevel@tonic-gate ire1 = ire->ire_next; 1414bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire)) { 14157c478bd9Sstevel@tonic-gate ptpn = ire->ire_ptpn; 14167c478bd9Sstevel@tonic-gate ire1 = ire->ire_next; 14177c478bd9Sstevel@tonic-gate if (ire1) 14187c478bd9Sstevel@tonic-gate ire1->ire_ptpn = ptpn; 14197c478bd9Sstevel@tonic-gate *ptpn = ire1; 14207c478bd9Sstevel@tonic-gate ire->ire_ptpn = NULL; 14217c478bd9Sstevel@tonic-gate ire->ire_next = NULL; 1422bd670b35SErik Nordmark 14237c478bd9Sstevel@tonic-gate /* 1424bd670b35SErik Nordmark * We need to call ire_delete_v4 or ire_delete_v6 to 1425bd670b35SErik Nordmark * clean up dependents and the redirects pointing at 14267c478bd9Sstevel@tonic-gate * the default gateway. We need to drop the lock 14277c478bd9Sstevel@tonic-gate * as ire_flush_cache/ire_delete_host_redircts require 14287c478bd9Sstevel@tonic-gate * so. But we can't drop the lock, as ire_unlink needs 14297c478bd9Sstevel@tonic-gate * to atomically remove the ires from the list. 14307c478bd9Sstevel@tonic-gate * So, create a temporary list of CONDEMNED ires 14317c478bd9Sstevel@tonic-gate * for doing ire_delete_v4/ire_delete_v6 operations 14327c478bd9Sstevel@tonic-gate * later on. 14337c478bd9Sstevel@tonic-gate */ 14347c478bd9Sstevel@tonic-gate ire->ire_next = ire_list; 14357c478bd9Sstevel@tonic-gate ire_list = ire; 14367c478bd9Sstevel@tonic-gate } 14377c478bd9Sstevel@tonic-gate } 1438c793af95Ssangeeta irb->irb_marks &= ~IRB_MARK_CONDEMNED; 14397c478bd9Sstevel@tonic-gate return (ire_list); 14407c478bd9Sstevel@tonic-gate } 14417c478bd9Sstevel@tonic-gate 14427c478bd9Sstevel@tonic-gate /* 1443bd670b35SErik Nordmark * Clean up the radix node for this ire. Must be called by irb_refrele 1444c793af95Ssangeeta * when there are no ire's left in the bucket. Returns TRUE if the bucket 1445c793af95Ssangeeta * is deleted and freed. 1446c793af95Ssangeeta */ 1447c793af95Ssangeeta boolean_t 1448c793af95Ssangeeta irb_inactive(irb_t *irb) 1449c793af95Ssangeeta { 1450c793af95Ssangeeta struct rt_entry *rt; 1451c793af95Ssangeeta struct radix_node *rn; 1452f4b3ec61Sdh155122 ip_stack_t *ipst = irb->irb_ipst; 1453f4b3ec61Sdh155122 1454f4b3ec61Sdh155122 ASSERT(irb->irb_ipst != NULL); 1455c793af95Ssangeeta 1456c793af95Ssangeeta rt = IRB2RT(irb); 1457c793af95Ssangeeta rn = (struct radix_node *)rt; 1458c793af95Ssangeeta 1459c793af95Ssangeeta /* first remove it from the radix tree. */ 1460f4b3ec61Sdh155122 RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable); 1461c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 1462c793af95Ssangeeta if (irb->irb_refcnt == 1 && irb->irb_nire == 0) { 1463f4b3ec61Sdh155122 rn = ipst->ips_ip_ftable->rnh_deladdr(rn->rn_key, rn->rn_mask, 1464f4b3ec61Sdh155122 ipst->ips_ip_ftable); 1465c793af95Ssangeeta DTRACE_PROBE1(irb__free, rt_t *, rt); 1466c793af95Ssangeeta ASSERT((void *)rn == (void *)rt); 1467c793af95Ssangeeta Free(rt, rt_entry_cache); 1468c793af95Ssangeeta /* irb_lock is freed */ 1469f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 1470c793af95Ssangeeta return (B_TRUE); 1471c793af95Ssangeeta } 1472c793af95Ssangeeta rw_exit(&irb->irb_lock); 1473f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 1474c793af95Ssangeeta return (B_FALSE); 14757c478bd9Sstevel@tonic-gate } 14767c478bd9Sstevel@tonic-gate 14777c478bd9Sstevel@tonic-gate /* 14787c478bd9Sstevel@tonic-gate * Delete the specified IRE. 1479bd670b35SErik Nordmark * We assume that if ire_bucket is not set then ire_ill->ill_ire_cnt was 1480bd670b35SErik Nordmark * not incremented i.e., that the insertion in the bucket and the increment 1481bd670b35SErik Nordmark * of that counter is done atomically. 14827c478bd9Sstevel@tonic-gate */ 14837c478bd9Sstevel@tonic-gate void 14847c478bd9Sstevel@tonic-gate ire_delete(ire_t *ire) 14857c478bd9Sstevel@tonic-gate { 14867c478bd9Sstevel@tonic-gate ire_t *ire1; 14877c478bd9Sstevel@tonic-gate ire_t **ptpn; 14887c478bd9Sstevel@tonic-gate irb_t *irb; 1489f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 14907c478bd9Sstevel@tonic-gate 1491c793af95Ssangeeta if ((irb = ire->ire_bucket) == NULL) { 14927c478bd9Sstevel@tonic-gate /* 14937c478bd9Sstevel@tonic-gate * It was never inserted in the list. Should call REFRELE 14947c478bd9Sstevel@tonic-gate * to free this IRE. 14957c478bd9Sstevel@tonic-gate */ 1496f1c454b4SSowmini Varadhan ire_make_condemned(ire); 1497bd670b35SErik Nordmark ire_refrele_notr(ire); 14987c478bd9Sstevel@tonic-gate return; 14997c478bd9Sstevel@tonic-gate } 15007c478bd9Sstevel@tonic-gate 15017c478bd9Sstevel@tonic-gate /* 1502bd670b35SErik Nordmark * Move the use counts from an IRE_IF_CLONE to its parent 1503bd670b35SErik Nordmark * IRE_INTERFACE. 1504bd670b35SErik Nordmark * We need to do this before acquiring irb_lock. 15057c478bd9Sstevel@tonic-gate */ 1506bd670b35SErik Nordmark if (ire->ire_type & IRE_IF_CLONE) { 1507bd670b35SErik Nordmark ire_t *parent; 1508bd670b35SErik Nordmark 1509bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 1510bd670b35SErik Nordmark if ((parent = ire->ire_dep_parent) != NULL) { 1511bd670b35SErik Nordmark parent->ire_ob_pkt_count += ire->ire_ob_pkt_count; 1512bd670b35SErik Nordmark parent->ire_ib_pkt_count += ire->ire_ib_pkt_count; 1513bd670b35SErik Nordmark ire->ire_ob_pkt_count = 0; 1514bd670b35SErik Nordmark ire->ire_ib_pkt_count = 0; 1515bd670b35SErik Nordmark } 1516bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 15177c478bd9Sstevel@tonic-gate } 15187c478bd9Sstevel@tonic-gate 1519bd670b35SErik Nordmark rw_enter(&irb->irb_lock, RW_WRITER); 15207c478bd9Sstevel@tonic-gate if (ire->ire_ptpn == NULL) { 15217c478bd9Sstevel@tonic-gate /* 15227c478bd9Sstevel@tonic-gate * Some other thread has removed us from the list. 15237c478bd9Sstevel@tonic-gate * It should have done the REFRELE for us. 15247c478bd9Sstevel@tonic-gate */ 15257c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 15267c478bd9Sstevel@tonic-gate return; 15277c478bd9Sstevel@tonic-gate } 15287c478bd9Sstevel@tonic-gate 1529bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(ire)) { 1530bd670b35SErik Nordmark /* Is this an IRE representing multiple duplicate entries? */ 1531bd670b35SErik Nordmark ASSERT(ire->ire_identical_ref >= 1); 1532bd670b35SErik Nordmark if (atomic_add_32_nv(&ire->ire_identical_ref, -1) != 0) { 1533bd670b35SErik Nordmark /* Removed one of the identical parties */ 1534bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 1535bd670b35SErik Nordmark return; 15369a09d68dSja97890 } 1537bd670b35SErik Nordmark 1538bd670b35SErik Nordmark irb->irb_ire_cnt--; 1539bd670b35SErik Nordmark ire_make_condemned(ire); 15409a09d68dSja97890 } 15419a09d68dSja97890 15427c478bd9Sstevel@tonic-gate if (irb->irb_refcnt != 0) { 15437c478bd9Sstevel@tonic-gate /* 15447c478bd9Sstevel@tonic-gate * The last thread to leave this bucket will 15457c478bd9Sstevel@tonic-gate * delete this ire. 15467c478bd9Sstevel@tonic-gate */ 1547c793af95Ssangeeta irb->irb_marks |= IRB_MARK_CONDEMNED; 15487c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 15497c478bd9Sstevel@tonic-gate return; 15507c478bd9Sstevel@tonic-gate } 15517c478bd9Sstevel@tonic-gate 15527c478bd9Sstevel@tonic-gate /* 15537c478bd9Sstevel@tonic-gate * Normally to delete an ire, we walk the bucket. While we 15547c478bd9Sstevel@tonic-gate * walk the bucket, we normally bump up irb_refcnt and hence 15557c478bd9Sstevel@tonic-gate * we return from above where we mark CONDEMNED and the ire 15567c478bd9Sstevel@tonic-gate * gets deleted from ire_unlink. This case is where somebody 15577c478bd9Sstevel@tonic-gate * knows the ire e.g by doing a lookup, and wants to delete the 15587c478bd9Sstevel@tonic-gate * IRE. irb_refcnt would be 0 in this case if nobody is walking 15597c478bd9Sstevel@tonic-gate * the bucket. 15607c478bd9Sstevel@tonic-gate */ 15617c478bd9Sstevel@tonic-gate ptpn = ire->ire_ptpn; 15627c478bd9Sstevel@tonic-gate ire1 = ire->ire_next; 15637c478bd9Sstevel@tonic-gate if (ire1 != NULL) 15647c478bd9Sstevel@tonic-gate ire1->ire_ptpn = ptpn; 15657c478bd9Sstevel@tonic-gate ASSERT(ptpn != NULL); 15667c478bd9Sstevel@tonic-gate *ptpn = ire1; 15677c478bd9Sstevel@tonic-gate ire->ire_ptpn = NULL; 15687c478bd9Sstevel@tonic-gate ire->ire_next = NULL; 15697c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 1570f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_deleted); 15717c478bd9Sstevel@tonic-gate } else { 1572f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_deleted); 15737c478bd9Sstevel@tonic-gate } 15747c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 15757c478bd9Sstevel@tonic-gate 1576bd670b35SErik Nordmark /* Cleanup dependents and related stuff */ 15777c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 15787c478bd9Sstevel@tonic-gate ire_delete_v6(ire); 15797c478bd9Sstevel@tonic-gate } else { 15807c478bd9Sstevel@tonic-gate ire_delete_v4(ire); 15817c478bd9Sstevel@tonic-gate } 15827c478bd9Sstevel@tonic-gate /* 15837c478bd9Sstevel@tonic-gate * We removed it from the list. Decrement the 15847c478bd9Sstevel@tonic-gate * reference count. 15857c478bd9Sstevel@tonic-gate */ 1586bd670b35SErik Nordmark ire_refrele_notr(ire); 15877c478bd9Sstevel@tonic-gate } 15887c478bd9Sstevel@tonic-gate 15897c478bd9Sstevel@tonic-gate /* 15907c478bd9Sstevel@tonic-gate * Delete the specified IRE. 15917c478bd9Sstevel@tonic-gate * All calls should use ire_delete(). 15927c478bd9Sstevel@tonic-gate * Sometimes called as writer though not required by this function. 15937c478bd9Sstevel@tonic-gate * 15947c478bd9Sstevel@tonic-gate * NOTE : This function is called only if the ire was added 15957c478bd9Sstevel@tonic-gate * in the list. 15967c478bd9Sstevel@tonic-gate */ 15977c478bd9Sstevel@tonic-gate static void 15987c478bd9Sstevel@tonic-gate ire_delete_v4(ire_t *ire) 15997c478bd9Sstevel@tonic-gate { 1600f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 1601f4b3ec61Sdh155122 16027c478bd9Sstevel@tonic-gate ASSERT(ire->ire_refcnt >= 1); 16037c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV4_VERSION); 16047c478bd9Sstevel@tonic-gate 16057c478bd9Sstevel@tonic-gate ire_flush_cache_v4(ire, IRE_FLUSH_DELETE); 16067c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_DEFAULT) { 16077c478bd9Sstevel@tonic-gate /* 16087c478bd9Sstevel@tonic-gate * when a default gateway is going away 16097c478bd9Sstevel@tonic-gate * delete all the host redirects pointing at that 16107c478bd9Sstevel@tonic-gate * gateway. 16117c478bd9Sstevel@tonic-gate */ 1612f4b3ec61Sdh155122 ire_delete_host_redirects(ire->ire_gateway_addr, ipst); 16137c478bd9Sstevel@tonic-gate } 1614bd670b35SErik Nordmark 1615bd670b35SErik Nordmark /* 1616bd670b35SErik Nordmark * If we are deleting an IRE_INTERFACE then we make sure we also 1617bd670b35SErik Nordmark * delete any IRE_IF_CLONE that has been created from it. 1618bd670b35SErik Nordmark * Those are always in ire_dep_children. 1619bd670b35SErik Nordmark */ 1620bd670b35SErik Nordmark if ((ire->ire_type & IRE_INTERFACE) && ire->ire_dep_children != NULL) 1621bd670b35SErik Nordmark ire_dep_delete_if_clone(ire); 1622bd670b35SErik Nordmark 1623bd670b35SErik Nordmark /* Remove from parent dependencies and child */ 1624bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_WRITER); 1625bd670b35SErik Nordmark if (ire->ire_dep_parent != NULL) 1626bd670b35SErik Nordmark ire_dep_remove(ire); 1627bd670b35SErik Nordmark 1628bd670b35SErik Nordmark while (ire->ire_dep_children != NULL) 1629bd670b35SErik Nordmark ire_dep_remove(ire->ire_dep_children); 1630bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 16317c478bd9Sstevel@tonic-gate } 16327c478bd9Sstevel@tonic-gate 16337c478bd9Sstevel@tonic-gate /* 1634bd670b35SErik Nordmark * ire_refrele is the only caller of the function. It calls 16357c478bd9Sstevel@tonic-gate * to free the ire when the reference count goes to zero. 16367c478bd9Sstevel@tonic-gate */ 16377c478bd9Sstevel@tonic-gate void 16387c478bd9Sstevel@tonic-gate ire_inactive(ire_t *ire) 16397c478bd9Sstevel@tonic-gate { 1640bd670b35SErik Nordmark ill_t *ill; 1641c793af95Ssangeeta irb_t *irb; 1642f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 16437c478bd9Sstevel@tonic-gate 16447c478bd9Sstevel@tonic-gate ASSERT(ire->ire_refcnt == 0); 16457c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ptpn == NULL); 16467c478bd9Sstevel@tonic-gate ASSERT(ire->ire_next == NULL); 16477c478bd9Sstevel@tonic-gate 1648bd670b35SErik Nordmark /* Count how many condemned ires for kmem_cache callback */ 1649f1c454b4SSowmini Varadhan ASSERT(IRE_IS_CONDEMNED(ire)); 1650bd670b35SErik Nordmark atomic_add_32(&ipst->ips_num_ire_condemned, -1); 1651bd670b35SErik Nordmark 1652c793af95Ssangeeta if (ire->ire_gw_secattr != NULL) { 1653c793af95Ssangeeta ire_gw_secattr_free(ire->ire_gw_secattr); 1654c793af95Ssangeeta ire->ire_gw_secattr = NULL; 1655c793af95Ssangeeta } 1656c793af95Ssangeeta 1657bd670b35SErik Nordmark /* 1658bd670b35SErik Nordmark * ire_nce_cache is cleared in ire_delete, and we make sure we don't 1659bd670b35SErik Nordmark * set it once the ire is marked condemned. 1660bd670b35SErik Nordmark */ 1661bd670b35SErik Nordmark ASSERT(ire->ire_nce_cache == NULL); 16627c478bd9Sstevel@tonic-gate 16637c478bd9Sstevel@tonic-gate /* 1664bd670b35SErik Nordmark * Since any parent would have a refhold on us they would already 1665bd670b35SErik Nordmark * have been removed. 16667c478bd9Sstevel@tonic-gate */ 1667bd670b35SErik Nordmark ASSERT(ire->ire_dep_parent == NULL); 1668bd670b35SErik Nordmark ASSERT(ire->ire_dep_sib_next == NULL); 1669bd670b35SErik Nordmark ASSERT(ire->ire_dep_sib_ptpn == NULL); 16707c478bd9Sstevel@tonic-gate 1671bd670b35SErik Nordmark /* 1672bd670b35SErik Nordmark * Since any children would have a refhold on us they should have 1673bd670b35SErik Nordmark * already been removed. 1674bd670b35SErik Nordmark */ 1675bd670b35SErik Nordmark ASSERT(ire->ire_dep_children == NULL); 1676bd670b35SErik Nordmark 1677bd670b35SErik Nordmark /* 1678bd670b35SErik Nordmark * ill_ire_ref is increased when the IRE is inserted in the 1679bd670b35SErik Nordmark * bucket - not when the IRE is created. 1680bd670b35SErik Nordmark */ 1681bd670b35SErik Nordmark irb = ire->ire_bucket; 1682bd670b35SErik Nordmark ill = ire->ire_ill; 1683bd670b35SErik Nordmark if (irb != NULL && ill != NULL) { 16847c478bd9Sstevel@tonic-gate mutex_enter(&ill->ill_lock); 1685bd670b35SErik Nordmark ASSERT(ill->ill_ire_cnt != 0); 1686bd670b35SErik Nordmark DTRACE_PROBE3(ill__decr__cnt, (ill_t *), ill, 1687968d2fd1Ssowmini (char *), "ire", (void *), ire); 1688bd670b35SErik Nordmark ill->ill_ire_cnt--; 1689bd670b35SErik Nordmark if (ILL_DOWN_OK(ill)) { 16907c478bd9Sstevel@tonic-gate /* Drops the ill lock */ 16917c478bd9Sstevel@tonic-gate ipif_ill_refrele_tail(ill); 16927c478bd9Sstevel@tonic-gate } else { 16937c478bd9Sstevel@tonic-gate mutex_exit(&ill->ill_lock); 16947c478bd9Sstevel@tonic-gate } 16957c478bd9Sstevel@tonic-gate } 1696bd670b35SErik Nordmark ire->ire_ill = NULL; 1697bd670b35SErik Nordmark 16987c478bd9Sstevel@tonic-gate /* This should be true for both V4 and V6 */ 1699bd670b35SErik Nordmark if (irb != NULL && (irb->irb_marks & IRB_MARK_DYNAMIC)) { 1700c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 1701c793af95Ssangeeta irb->irb_nire--; 1702c793af95Ssangeeta /* 1703c793af95Ssangeeta * Instead of examining the conditions for freeing 1704c793af95Ssangeeta * the radix node here, we do it by calling 1705bd670b35SErik Nordmark * irb_refrele which is a single point in the code 1706c793af95Ssangeeta * that embeds that logic. Bump up the refcnt to 1707bd670b35SErik Nordmark * be able to call irb_refrele 1708c793af95Ssangeeta */ 1709bd670b35SErik Nordmark irb_refhold_locked(irb); 1710c793af95Ssangeeta rw_exit(&irb->irb_lock); 1711bd670b35SErik Nordmark irb_refrele(irb); 1712c793af95Ssangeeta } 17137c478bd9Sstevel@tonic-gate 17146a8288c7Scarlsonj #ifdef DEBUG 17156a8288c7Scarlsonj ire_trace_cleanup(ire); 17167c478bd9Sstevel@tonic-gate #endif 17177c478bd9Sstevel@tonic-gate mutex_destroy(&ire->ire_lock); 17187c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 1719f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_freed); 17207c478bd9Sstevel@tonic-gate } else { 1721f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_freed); 17227c478bd9Sstevel@tonic-gate } 17237c478bd9Sstevel@tonic-gate kmem_cache_free(ire_cache, ire); 17247c478bd9Sstevel@tonic-gate } 17257c478bd9Sstevel@tonic-gate 17267c478bd9Sstevel@tonic-gate /* 1727bd670b35SErik Nordmark * ire_update_generation is the callback function provided by 1728bd670b35SErik Nordmark * ire_get_bucket() to update the generation number of any 1729bd670b35SErik Nordmark * matching shorter route when a new route is added. 1730bd670b35SErik Nordmark * 1731bd670b35SErik Nordmark * This fucntion always returns a failure return (B_FALSE) 1732bd670b35SErik Nordmark * to force the caller (rn_matchaddr_args) 1733bd670b35SErik Nordmark * to back-track up the tree looking for shorter matches. 17347c478bd9Sstevel@tonic-gate */ 1735bd670b35SErik Nordmark /* ARGSUSED */ 1736bd670b35SErik Nordmark static boolean_t 1737bd670b35SErik Nordmark ire_update_generation(struct radix_node *rn, void *arg) 17387c478bd9Sstevel@tonic-gate { 1739bd670b35SErik Nordmark struct rt_entry *rt = (struct rt_entry *)rn; 17407c478bd9Sstevel@tonic-gate 1741bd670b35SErik Nordmark /* We need to handle all in the same bucket */ 1742bd670b35SErik Nordmark irb_increment_generation(&rt->rt_irb); 1743bd670b35SErik Nordmark return (B_FALSE); 17447c478bd9Sstevel@tonic-gate } 17457c478bd9Sstevel@tonic-gate 17467c478bd9Sstevel@tonic-gate /* 1747bd670b35SErik Nordmark * Take care of all the generation numbers in the bucket. 1748bd670b35SErik Nordmark */ 1749bd670b35SErik Nordmark void 1750bd670b35SErik Nordmark irb_increment_generation(irb_t *irb) 1751bd670b35SErik Nordmark { 1752bd670b35SErik Nordmark ire_t *ire; 1753f1c454b4SSowmini Varadhan ip_stack_t *ipst; 1754bd670b35SErik Nordmark 1755bd670b35SErik Nordmark if (irb == NULL || irb->irb_ire_cnt == 0) 1756bd670b35SErik Nordmark return; 1757bd670b35SErik Nordmark 1758f1c454b4SSowmini Varadhan ipst = irb->irb_ipst; 1759f1c454b4SSowmini Varadhan /* 1760f1c454b4SSowmini Varadhan * we cannot do an irb_refhold/irb_refrele here as the caller 1761f1c454b4SSowmini Varadhan * already has the global RADIX_NODE_HEAD_WLOCK, and the irb_refrele 1762f1c454b4SSowmini Varadhan * may result in an attempt to free the irb_t, which also needs 1763f1c454b4SSowmini Varadhan * the RADIX_NODE_HEAD lock. However, since we want to traverse the 1764f1c454b4SSowmini Varadhan * irb_ire list without fear of having a condemned ire removed from 1765f1c454b4SSowmini Varadhan * the list, we acquire the irb_lock as WRITER. Moreover, since 1766f1c454b4SSowmini Varadhan * the ire_generation increments are done under the ire_dep_lock, 1767f1c454b4SSowmini Varadhan * acquire the locks in the prescribed lock order first. 1768f1c454b4SSowmini Varadhan */ 1769f1c454b4SSowmini Varadhan rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 1770f1c454b4SSowmini Varadhan rw_enter(&irb->irb_lock, RW_WRITER); 1771bd670b35SErik Nordmark for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 1772bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(ire)) 1773bd670b35SErik Nordmark ire_increment_generation(ire); /* Ourselves */ 1774f1c454b4SSowmini Varadhan ire_dep_incr_generation_locked(ire); /* Dependants */ 1775bd670b35SErik Nordmark } 1776f1c454b4SSowmini Varadhan rw_exit(&irb->irb_lock); 1777f1c454b4SSowmini Varadhan rw_exit(&ipst->ips_ire_dep_lock); 1778bd670b35SErik Nordmark } 1779bd670b35SErik Nordmark 1780bd670b35SErik Nordmark /* 1781bd670b35SErik Nordmark * When an IRE is added or deleted this routine is called to make sure 1782bd670b35SErik Nordmark * any caching of IRE information is notified or updated. 17837c478bd9Sstevel@tonic-gate * 17847c478bd9Sstevel@tonic-gate * The flag argument indicates if the flush request is due to addition 1785bd670b35SErik Nordmark * of new route (IRE_FLUSH_ADD), deletion of old route (IRE_FLUSH_DELETE), 1786bd670b35SErik Nordmark * or a change to ire_gateway_addr (IRE_FLUSH_GWCHANGE). 17877c478bd9Sstevel@tonic-gate */ 17887c478bd9Sstevel@tonic-gate void 17897c478bd9Sstevel@tonic-gate ire_flush_cache_v4(ire_t *ire, int flag) 17907c478bd9Sstevel@tonic-gate { 1791bd670b35SErik Nordmark irb_t *irb = ire->ire_bucket; 1792bd670b35SErik Nordmark struct rt_entry *rt = IRB2RT(irb); 1793f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 17947c478bd9Sstevel@tonic-gate 1795bd670b35SErik Nordmark /* 1796bd670b35SErik Nordmark * IRE_IF_CLONE ire's don't provide any new information 1797bd670b35SErik Nordmark * than the parent from which they are cloned, so don't 1798bd670b35SErik Nordmark * perturb the generation numbers. 1799bd670b35SErik Nordmark */ 1800bd670b35SErik Nordmark if (ire->ire_type & IRE_IF_CLONE) 18017c478bd9Sstevel@tonic-gate return; 18027c478bd9Sstevel@tonic-gate 18037c478bd9Sstevel@tonic-gate /* 1804bd670b35SErik Nordmark * Ensure that an ire_add during a lookup serializes the updates of the 1805bd670b35SErik Nordmark * generation numbers under the radix head lock so that the lookup gets 1806bd670b35SErik Nordmark * either the old ire and old generation number, or a new ire and new 1807bd670b35SErik Nordmark * generation number. 18087c478bd9Sstevel@tonic-gate */ 1809bd670b35SErik Nordmark RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable); 1810bd670b35SErik Nordmark 1811bd670b35SErik Nordmark /* 1812bd670b35SErik Nordmark * If a route was just added, we need to notify everybody that 1813bd670b35SErik Nordmark * has cached an IRE_NOROUTE since there might now be a better 1814bd670b35SErik Nordmark * route for them. 1815bd670b35SErik Nordmark */ 18167c478bd9Sstevel@tonic-gate if (flag == IRE_FLUSH_ADD) { 1817bd670b35SErik Nordmark ire_increment_generation(ipst->ips_ire_reject_v4); 1818bd670b35SErik Nordmark ire_increment_generation(ipst->ips_ire_blackhole_v4); 1819bd670b35SErik Nordmark } 1820bd670b35SErik Nordmark 1821bd670b35SErik Nordmark /* Adding a default can't otherwise provide a better route */ 1822bd670b35SErik Nordmark if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD) { 1823bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 1824bd670b35SErik Nordmark return; 1825bd670b35SErik Nordmark } 1826bd670b35SErik Nordmark 1827bd670b35SErik Nordmark switch (flag) { 1828bd670b35SErik Nordmark case IRE_FLUSH_DELETE: 1829bd670b35SErik Nordmark case IRE_FLUSH_GWCHANGE: 18307c478bd9Sstevel@tonic-gate /* 1831bd670b35SErik Nordmark * Update ire_generation for all ire_dep_children chains 1832bd670b35SErik Nordmark * starting with this IRE 18337c478bd9Sstevel@tonic-gate */ 1834bd670b35SErik Nordmark ire_dep_incr_generation(ire); 1835bd670b35SErik Nordmark break; 1836bd670b35SErik Nordmark case IRE_FLUSH_ADD: 18377c478bd9Sstevel@tonic-gate /* 1838bd670b35SErik Nordmark * Update the generation numbers of all shorter matching routes. 1839bd670b35SErik Nordmark * ire_update_generation takes care of the dependants by 1840bd670b35SErik Nordmark * using ire_dep_incr_generation. 18417c478bd9Sstevel@tonic-gate */ 1842bd670b35SErik Nordmark (void) ipst->ips_ip_ftable->rnh_matchaddr_args(&rt->rt_dst, 1843bd670b35SErik Nordmark ipst->ips_ip_ftable, ire_update_generation, NULL); 1844bd670b35SErik Nordmark break; 18457c478bd9Sstevel@tonic-gate } 1846bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 18477c478bd9Sstevel@tonic-gate } 18487c478bd9Sstevel@tonic-gate 18497c478bd9Sstevel@tonic-gate /* 18507c478bd9Sstevel@tonic-gate * Matches the arguments passed with the values in the ire. 18517c478bd9Sstevel@tonic-gate * 1852bd670b35SErik Nordmark * Note: for match types that match using "ill" passed in, ill 18537c478bd9Sstevel@tonic-gate * must be checked for non-NULL before calling this routine. 18547c478bd9Sstevel@tonic-gate */ 1855c793af95Ssangeeta boolean_t 18567c478bd9Sstevel@tonic-gate ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 1857bd670b35SErik Nordmark int type, const ill_t *ill, zoneid_t zoneid, 1858bd670b35SErik Nordmark const ts_label_t *tsl, int match_flags) 18597c478bd9Sstevel@tonic-gate { 18607c478bd9Sstevel@tonic-gate ill_t *ire_ill = NULL, *dst_ill; 1861bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 18627c478bd9Sstevel@tonic-gate 18637c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV4_VERSION); 18647c478bd9Sstevel@tonic-gate ASSERT((ire->ire_addr & ~ire->ire_mask) == 0); 186544b099c4SSowmini Varadhan ASSERT((!(match_flags & (MATCH_IRE_ILL|MATCH_IRE_SRC_ILL))) || 1866bd670b35SErik Nordmark (ill != NULL && !ill->ill_isv6)); 18677c478bd9Sstevel@tonic-gate 18687c478bd9Sstevel@tonic-gate /* 1869bd670b35SErik Nordmark * If MATCH_IRE_TESTHIDDEN is set, then only return the IRE if it is 1870bd670b35SErik Nordmark * in fact hidden, to ensure the caller gets the right one. 18717c478bd9Sstevel@tonic-gate */ 1872bd670b35SErik Nordmark if (ire->ire_testhidden) { 1873bd670b35SErik Nordmark if (!(match_flags & MATCH_IRE_TESTHIDDEN)) 18747c478bd9Sstevel@tonic-gate return (B_FALSE); 1875e11c3f44Smeem } 18767c478bd9Sstevel@tonic-gate 187745916cd2Sjpk if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid && 187845916cd2Sjpk ire->ire_zoneid != ALL_ZONES) { 18797c478bd9Sstevel@tonic-gate /* 1880bd670b35SErik Nordmark * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid 1881bd670b35SErik Nordmark * does not match that of ire_zoneid, a failure to 18827c478bd9Sstevel@tonic-gate * match is reported at this point. Otherwise, since some IREs 18837c478bd9Sstevel@tonic-gate * that are available in the global zone can be used in local 18847c478bd9Sstevel@tonic-gate * zones, additional checks need to be performed: 18857c478bd9Sstevel@tonic-gate * 1886bd670b35SErik Nordmark * IRE_LOOPBACK 18877c478bd9Sstevel@tonic-gate * entries should never be matched in this situation. 1888bd670b35SErik Nordmark * Each zone has its own IRE_LOOPBACK. 18897c478bd9Sstevel@tonic-gate * 1890bd670b35SErik Nordmark * IRE_LOCAL 1891bd670b35SErik Nordmark * We allow them for any zoneid. ire_route_recursive 1892bd670b35SErik Nordmark * does additional checks when 1893bd670b35SErik Nordmark * ip_restrict_interzone_loopback is set. 18947c478bd9Sstevel@tonic-gate * 1895bd670b35SErik Nordmark * If ill_usesrc_ifindex is set 1896bd670b35SErik Nordmark * Then we check if the zone has a valid source address 1897bd670b35SErik Nordmark * on the usesrc ill. 18987c478bd9Sstevel@tonic-gate * 1899bd670b35SErik Nordmark * If ire_ill is set, then check that the zone has an ipif 1900bd670b35SErik Nordmark * on that ill. 1901bd670b35SErik Nordmark * 1902bd670b35SErik Nordmark * Outside of this function (in ire_round_robin) we check 1903bd670b35SErik Nordmark * that any IRE_OFFLINK has a gateway that reachable from the 1904bd670b35SErik Nordmark * zone when we have multiple choices (ECMP). 19057c478bd9Sstevel@tonic-gate */ 19067c478bd9Sstevel@tonic-gate if (match_flags & MATCH_IRE_ZONEONLY) 19077c478bd9Sstevel@tonic-gate return (B_FALSE); 1908bd670b35SErik Nordmark if (ire->ire_type & IRE_LOOPBACK) 19097c478bd9Sstevel@tonic-gate return (B_FALSE); 1910bd670b35SErik Nordmark 1911bd670b35SErik Nordmark if (ire->ire_type & IRE_LOCAL) 1912bd670b35SErik Nordmark goto matchit; 1913bd670b35SErik Nordmark 19147c478bd9Sstevel@tonic-gate /* 1915bd670b35SErik Nordmark * The normal case of IRE_ONLINK has a matching zoneid. 1916bd670b35SErik Nordmark * Here we handle the case when shared-IP zones have been 1917bd670b35SErik Nordmark * configured with IP addresses on vniN. In that case it 1918bd670b35SErik Nordmark * is ok for traffic from a zone to use IRE_ONLINK routes 1919bd670b35SErik Nordmark * if the ill has a usesrc pointing at vniN 19207c478bd9Sstevel@tonic-gate */ 1921bd670b35SErik Nordmark dst_ill = ire->ire_ill; 1922bd670b35SErik Nordmark if (ire->ire_type & IRE_ONLINK) { 1923bd670b35SErik Nordmark uint_t ifindex; 1924bd670b35SErik Nordmark 1925bd670b35SErik Nordmark /* 1926bd670b35SErik Nordmark * Note there is no IRE_INTERFACE on vniN thus 1927bd670b35SErik Nordmark * can't do an IRE lookup for a matching route. 1928bd670b35SErik Nordmark */ 1929bd670b35SErik Nordmark ifindex = dst_ill->ill_usesrc_ifindex; 1930bd670b35SErik Nordmark if (ifindex == 0) 1931bd670b35SErik Nordmark return (B_FALSE); 1932bd670b35SErik Nordmark 19337c478bd9Sstevel@tonic-gate /* 19347c478bd9Sstevel@tonic-gate * If there is a usable source address in the 1935bd670b35SErik Nordmark * zone, then it's ok to return this IRE_INTERFACE 19367c478bd9Sstevel@tonic-gate */ 1937bd670b35SErik Nordmark if (!ipif_zone_avail(ifindex, dst_ill->ill_isv6, 1938bd670b35SErik Nordmark zoneid, ipst)) { 1939bd670b35SErik Nordmark ip3dbg(("ire_match_args: no usrsrc for zone" 19407c478bd9Sstevel@tonic-gate " dst_ill %p\n", (void *)dst_ill)); 19417c478bd9Sstevel@tonic-gate return (B_FALSE); 19427c478bd9Sstevel@tonic-gate } 19437c478bd9Sstevel@tonic-gate } 1944bd670b35SErik Nordmark /* 194544b099c4SSowmini Varadhan * For example, with 1946bd670b35SErik Nordmark * route add 11.0.0.0 gw1 -ifp bge0 1947bd670b35SErik Nordmark * route add 11.0.0.0 gw2 -ifp bge1 1948bd670b35SErik Nordmark * this code would differentiate based on 1949bd670b35SErik Nordmark * where the sending zone has addresses. 1950bd670b35SErik Nordmark * Only if the zone has an address on bge0 can it use the first 1951bd670b35SErik Nordmark * route. It isn't clear if this behavior is documented 1952bd670b35SErik Nordmark * anywhere. 1953bd670b35SErik Nordmark */ 1954bd670b35SErik Nordmark if (dst_ill != NULL && (ire->ire_type & IRE_OFFLINK)) { 19557c478bd9Sstevel@tonic-gate ipif_t *tipif; 19567c478bd9Sstevel@tonic-gate 1957bd670b35SErik Nordmark mutex_enter(&dst_ill->ill_lock); 1958bd670b35SErik Nordmark for (tipif = dst_ill->ill_ipif; 19597c478bd9Sstevel@tonic-gate tipif != NULL; tipif = tipif->ipif_next) { 1960bd670b35SErik Nordmark if (!IPIF_IS_CONDEMNED(tipif) && 19617c478bd9Sstevel@tonic-gate (tipif->ipif_flags & IPIF_UP) && 196245916cd2Sjpk (tipif->ipif_zoneid == zoneid || 196345916cd2Sjpk tipif->ipif_zoneid == ALL_ZONES)) 19647c478bd9Sstevel@tonic-gate break; 19657c478bd9Sstevel@tonic-gate } 1966bd670b35SErik Nordmark mutex_exit(&dst_ill->ill_lock); 19677c478bd9Sstevel@tonic-gate if (tipif == NULL) { 19687c478bd9Sstevel@tonic-gate return (B_FALSE); 19697c478bd9Sstevel@tonic-gate } 19707c478bd9Sstevel@tonic-gate } 19717c478bd9Sstevel@tonic-gate } 19727c478bd9Sstevel@tonic-gate 1973bd670b35SErik Nordmark matchit: 1974bd670b35SErik Nordmark ire_ill = ire->ire_ill; 197544b099c4SSowmini Varadhan if (match_flags & MATCH_IRE_ILL) { 1976bd670b35SErik Nordmark 1977bd670b35SErik Nordmark /* 1978bd670b35SErik Nordmark * If asked to match an ill, we *must* match 1979bd670b35SErik Nordmark * on the ire_ill for ipmp test addresses, or 1980bd670b35SErik Nordmark * any of the ill in the group for data addresses. 1981bd670b35SErik Nordmark * If we don't, we may as well fail. 1982bd670b35SErik Nordmark * However, we need an exception for IRE_LOCALs to ensure 1983bd670b35SErik Nordmark * we loopback packets even sent to test addresses on different 1984bd670b35SErik Nordmark * interfaces in the group. 1985bd670b35SErik Nordmark */ 1986bd670b35SErik Nordmark if ((match_flags & MATCH_IRE_TESTHIDDEN) && 1987bd670b35SErik Nordmark !(ire->ire_type & IRE_LOCAL)) { 1988bd670b35SErik Nordmark if (ire->ire_ill != ill) 1989bd670b35SErik Nordmark return (B_FALSE); 1990bd670b35SErik Nordmark } else { 1991bd670b35SErik Nordmark match_flags &= ~MATCH_IRE_TESTHIDDEN; 1992bd670b35SErik Nordmark /* 1993bd670b35SErik Nordmark * We know that ill is not NULL, but ire_ill could be 1994bd670b35SErik Nordmark * NULL 1995bd670b35SErik Nordmark */ 1996bd670b35SErik Nordmark if (ire_ill == NULL || !IS_ON_SAME_LAN(ill, ire_ill)) 1997bd670b35SErik Nordmark return (B_FALSE); 1998bd670b35SErik Nordmark } 19997c478bd9Sstevel@tonic-gate } 200044b099c4SSowmini Varadhan if (match_flags & MATCH_IRE_SRC_ILL) { 200144b099c4SSowmini Varadhan if (ire_ill == NULL) 200244b099c4SSowmini Varadhan return (B_FALSE); 200344b099c4SSowmini Varadhan if (!IS_ON_SAME_LAN(ill, ire_ill)) { 200444b099c4SSowmini Varadhan if (ire_ill->ill_usesrc_ifindex == 0 || 200544b099c4SSowmini Varadhan (ire_ill->ill_usesrc_ifindex != 200644b099c4SSowmini Varadhan ill->ill_phyint->phyint_ifindex)) 200744b099c4SSowmini Varadhan return (B_FALSE); 200844b099c4SSowmini Varadhan } 200944b099c4SSowmini Varadhan } 20107c478bd9Sstevel@tonic-gate 20117c478bd9Sstevel@tonic-gate if ((ire->ire_addr == (addr & mask)) && 20127c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_GW)) || 20137c478bd9Sstevel@tonic-gate (ire->ire_gateway_addr == gateway)) && 201401685f97SSowmini Varadhan ((!(match_flags & MATCH_IRE_DIRECT)) || 201501685f97SSowmini Varadhan !(ire->ire_flags & RTF_INDIRECT)) && 2016bd670b35SErik Nordmark ((!(match_flags & MATCH_IRE_TYPE)) || (ire->ire_type & type)) && 2017bd670b35SErik Nordmark ((!(match_flags & MATCH_IRE_TESTHIDDEN)) || ire->ire_testhidden) && 2018bd670b35SErik Nordmark ((!(match_flags & MATCH_IRE_MASK)) || (ire->ire_mask == mask)) && 201945916cd2Sjpk ((!(match_flags & MATCH_IRE_SECATTR)) || 202045916cd2Sjpk (!is_system_labeled()) || 202145916cd2Sjpk (tsol_ire_match_gwattr(ire, tsl) == 0))) { 20227c478bd9Sstevel@tonic-gate /* We found the matched IRE */ 20237c478bd9Sstevel@tonic-gate return (B_TRUE); 20247c478bd9Sstevel@tonic-gate } 20257c478bd9Sstevel@tonic-gate return (B_FALSE); 20267c478bd9Sstevel@tonic-gate } 20277c478bd9Sstevel@tonic-gate 20287c478bd9Sstevel@tonic-gate /* 2029e11c3f44Smeem * Check if the IRE_LOCAL uses the same ill as another route would use. 2030aa2eaee6Snordmark * If there is no alternate route, or the alternate is a REJECT or BLACKHOLE, 2031aa2eaee6Snordmark * then we don't allow this IRE_LOCAL to be used. 2032bd670b35SErik Nordmark * We always return an IRE; will be RTF_REJECT if no route available. 2033bd670b35SErik Nordmark */ 2034bd670b35SErik Nordmark ire_t * 2035bd670b35SErik Nordmark ire_alt_local(ire_t *ire, zoneid_t zoneid, const ts_label_t *tsl, 2036bd670b35SErik Nordmark const ill_t *ill, uint_t *generationp) 2037bd670b35SErik Nordmark { 2038bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 2039bd670b35SErik Nordmark ire_t *alt_ire; 2040bd670b35SErik Nordmark uint_t ire_type; 2041bd670b35SErik Nordmark uint_t generation; 2042bd670b35SErik Nordmark uint_t match_flags; 2043bd670b35SErik Nordmark 2044bd670b35SErik Nordmark ASSERT(ire->ire_type & IRE_LOCAL); 2045bd670b35SErik Nordmark ASSERT(ire->ire_ill != NULL); 2046bd670b35SErik Nordmark 2047bd670b35SErik Nordmark /* 2048bd670b35SErik Nordmark * Need to match on everything but local. 2049bd670b35SErik Nordmark * This might result in the creation of a IRE_IF_CLONE for the 2050bd670b35SErik Nordmark * same address as the IRE_LOCAL when restrict_interzone_loopback is 2051bd670b35SErik Nordmark * set. ire_add_*() ensures that the IRE_IF_CLONE are tail inserted 2052bd670b35SErik Nordmark * to make sure the IRE_LOCAL is always found first. 2053bd670b35SErik Nordmark */ 2054bd670b35SErik Nordmark ire_type = (IRE_ONLINK | IRE_OFFLINK) & ~(IRE_LOCAL|IRE_LOOPBACK); 2055bd670b35SErik Nordmark match_flags = MATCH_IRE_TYPE | MATCH_IRE_SECATTR; 2056bd670b35SErik Nordmark if (ill != NULL) 2057bd670b35SErik Nordmark match_flags |= MATCH_IRE_ILL; 2058bd670b35SErik Nordmark 2059bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 2060bd670b35SErik Nordmark alt_ire = ire_route_recursive_v4(ire->ire_addr, ire_type, 20619e3469d3SErik Nordmark ill, zoneid, tsl, match_flags, IRR_ALLOCATE, 0, ipst, NULL, 20629e3469d3SErik Nordmark NULL, &generation); 2063bd670b35SErik Nordmark } else { 2064bd670b35SErik Nordmark alt_ire = ire_route_recursive_v6(&ire->ire_addr_v6, ire_type, 20659e3469d3SErik Nordmark ill, zoneid, tsl, match_flags, IRR_ALLOCATE, 0, ipst, NULL, 20669e3469d3SErik Nordmark NULL, &generation); 2067bd670b35SErik Nordmark } 2068bd670b35SErik Nordmark ASSERT(alt_ire != NULL); 2069bd670b35SErik Nordmark 2070bd670b35SErik Nordmark if (alt_ire->ire_ill == ire->ire_ill) { 2071bd670b35SErik Nordmark /* Going out the same ILL - ok to send to IRE_LOCAL */ 2072bd670b35SErik Nordmark ire_refrele(alt_ire); 2073bd670b35SErik Nordmark } else { 2074bd670b35SErik Nordmark /* Different ill - ignore IRE_LOCAL */ 2075bd670b35SErik Nordmark ire_refrele(ire); 2076bd670b35SErik Nordmark ire = alt_ire; 2077bd670b35SErik Nordmark if (generationp != NULL) 2078bd670b35SErik Nordmark *generationp = generation; 2079bd670b35SErik Nordmark } 2080bd670b35SErik Nordmark return (ire); 2081bd670b35SErik Nordmark } 2082bd670b35SErik Nordmark 2083bd670b35SErik Nordmark boolean_t 2084bd670b35SErik Nordmark ire_find_zoneid(struct radix_node *rn, void *arg) 2085bd670b35SErik Nordmark { 2086bd670b35SErik Nordmark struct rt_entry *rt = (struct rt_entry *)rn; 2087bd670b35SErik Nordmark irb_t *irb; 2088bd670b35SErik Nordmark ire_t *ire; 2089bd670b35SErik Nordmark ire_ftable_args_t *margs = arg; 2090bd670b35SErik Nordmark 2091bd670b35SErik Nordmark ASSERT(rt != NULL); 2092bd670b35SErik Nordmark 2093bd670b35SErik Nordmark irb = &rt->rt_irb; 2094bd670b35SErik Nordmark 2095bd670b35SErik Nordmark if (irb->irb_ire_cnt == 0) 2096bd670b35SErik Nordmark return (B_FALSE); 2097bd670b35SErik Nordmark 2098bd670b35SErik Nordmark rw_enter(&irb->irb_lock, RW_READER); 2099bd670b35SErik Nordmark for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 2100bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire)) 2101bd670b35SErik Nordmark continue; 2102bd670b35SErik Nordmark 2103188e1664SErik Nordmark if (!(ire->ire_type & IRE_INTERFACE)) 2104188e1664SErik Nordmark continue; 2105188e1664SErik Nordmark 2106bd670b35SErik Nordmark if (ire->ire_zoneid != ALL_ZONES && 2107bd670b35SErik Nordmark ire->ire_zoneid != margs->ift_zoneid) 2108bd670b35SErik Nordmark continue; 2109bd670b35SErik Nordmark 2110bd670b35SErik Nordmark if (margs->ift_ill != NULL && margs->ift_ill != ire->ire_ill) 2111bd670b35SErik Nordmark continue; 2112bd670b35SErik Nordmark 2113bd670b35SErik Nordmark if (is_system_labeled() && 2114bd670b35SErik Nordmark tsol_ire_match_gwattr(ire, margs->ift_tsl) != 0) 2115bd670b35SErik Nordmark continue; 2116bd670b35SErik Nordmark 2117bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 2118bd670b35SErik Nordmark return (B_TRUE); 2119bd670b35SErik Nordmark } 2120bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 2121bd670b35SErik Nordmark return (B_FALSE); 2122bd670b35SErik Nordmark } 2123bd670b35SErik Nordmark 2124bd670b35SErik Nordmark /* 2125bd670b35SErik Nordmark * Check if the zoneid (not ALL_ZONES) has an IRE_INTERFACE for the specified 2126bd670b35SErik Nordmark * gateway address. If ill is non-NULL we also match on it. 2127bd670b35SErik Nordmark * The caller must hold a read lock on RADIX_NODE_HEAD if lock_held is set. 21285597b60aSnordmark */ 21295597b60aSnordmark boolean_t 2130bd670b35SErik Nordmark ire_gateway_ok_zone_v4(ipaddr_t gateway, zoneid_t zoneid, ill_t *ill, 2131bd670b35SErik Nordmark const ts_label_t *tsl, ip_stack_t *ipst, boolean_t lock_held) 21325597b60aSnordmark { 2133bd670b35SErik Nordmark struct rt_sockaddr rdst; 2134bd670b35SErik Nordmark struct rt_entry *rt; 2135bd670b35SErik Nordmark ire_ftable_args_t margs; 2136e11c3f44Smeem 2137bd670b35SErik Nordmark ASSERT(ill == NULL || !ill->ill_isv6); 2138bd670b35SErik Nordmark if (lock_held) 2139bd670b35SErik Nordmark ASSERT(RW_READ_HELD(&ipst->ips_ip_ftable->rnh_lock)); 21407c478bd9Sstevel@tonic-gate else 2141bd670b35SErik Nordmark RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 2142bd670b35SErik Nordmark 2143188e1664SErik Nordmark bzero(&rdst, sizeof (rdst)); 2144bd670b35SErik Nordmark rdst.rt_sin_len = sizeof (rdst); 2145bd670b35SErik Nordmark rdst.rt_sin_family = AF_INET; 2146bd670b35SErik Nordmark rdst.rt_sin_addr.s_addr = gateway; 2147bd670b35SErik Nordmark 2148bd670b35SErik Nordmark /* 2149bd670b35SErik Nordmark * We only use margs for ill, zoneid, and tsl matching in 2150bd670b35SErik Nordmark * ire_find_zoneid 2151bd670b35SErik Nordmark */ 2152188e1664SErik Nordmark bzero(&margs, sizeof (margs)); 2153bd670b35SErik Nordmark margs.ift_ill = ill; 2154bd670b35SErik Nordmark margs.ift_zoneid = zoneid; 2155bd670b35SErik Nordmark margs.ift_tsl = tsl; 2156bd670b35SErik Nordmark rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst, 2157bd670b35SErik Nordmark ipst->ips_ip_ftable, ire_find_zoneid, (void *)&margs); 2158bd670b35SErik Nordmark 2159bd670b35SErik Nordmark if (!lock_held) 2160bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 2161bd670b35SErik Nordmark 2162bd670b35SErik Nordmark return (rt != NULL); 21637c478bd9Sstevel@tonic-gate } 21647c478bd9Sstevel@tonic-gate 21657c478bd9Sstevel@tonic-gate /* 2166bd670b35SErik Nordmark * ire_walk routine to delete a fraction of redirect IREs and IRE_CLONE_IF IREs. 2167bd670b35SErik Nordmark * The fraction argument tells us what fraction of the IREs to delete. 2168bd670b35SErik Nordmark * Common for IPv4 and IPv6. 2169bd670b35SErik Nordmark * Used when memory backpressure. 21707c478bd9Sstevel@tonic-gate */ 2171bd670b35SErik Nordmark static void 2172bd670b35SErik Nordmark ire_delete_reclaim(ire_t *ire, char *arg) 21737c478bd9Sstevel@tonic-gate { 2174bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 2175bd670b35SErik Nordmark uint_t fraction = *(uint_t *)arg; 21767c478bd9Sstevel@tonic-gate uint_t rand; 21777c478bd9Sstevel@tonic-gate 2178bd670b35SErik Nordmark if ((ire->ire_flags & RTF_DYNAMIC) || 2179bd670b35SErik Nordmark (ire->ire_type & IRE_IF_CLONE)) { 21807c478bd9Sstevel@tonic-gate 2181bd670b35SErik Nordmark /* Pick a random number */ 2182d3d50737SRafael Vanoni rand = (uint_t)ddi_get_lbolt() + 2183bd670b35SErik Nordmark IRE_ADDR_HASH_V6(ire->ire_addr_v6, 256); 2184bd670b35SErik Nordmark 2185bd670b35SErik Nordmark /* Use truncation */ 2186bd670b35SErik Nordmark if ((rand/fraction)*fraction == rand) { 2187bd670b35SErik Nordmark IP_STAT(ipst, ip_ire_reclaim_deleted); 21887c478bd9Sstevel@tonic-gate ire_delete(ire); 21897c478bd9Sstevel@tonic-gate } 21907c478bd9Sstevel@tonic-gate } 2191bd670b35SErik Nordmark 21927c478bd9Sstevel@tonic-gate } 2193bd670b35SErik Nordmark 21947c478bd9Sstevel@tonic-gate /* 2195bd670b35SErik Nordmark * kmem_cache callback to free up memory. 2196bd670b35SErik Nordmark * 2197bd670b35SErik Nordmark * Free a fraction (ips_ip_ire_reclaim_fraction) of things IP added dynamically 2198bd670b35SErik Nordmark * (RTF_DYNAMIC and IRE_IF_CLONE). 21997c478bd9Sstevel@tonic-gate */ 2200bd670b35SErik Nordmark static void 2201bd670b35SErik Nordmark ip_ire_reclaim_stack(ip_stack_t *ipst) 2202bd670b35SErik Nordmark { 2203bd670b35SErik Nordmark uint_t fraction = ipst->ips_ip_ire_reclaim_fraction; 2204bd670b35SErik Nordmark 2205bd670b35SErik Nordmark IP_STAT(ipst, ip_ire_reclaim_calls); 2206bd670b35SErik Nordmark 2207bd670b35SErik Nordmark ire_walk(ire_delete_reclaim, &fraction, ipst); 2208bd670b35SErik Nordmark 2209bd670b35SErik Nordmark /* 2210bd670b35SErik Nordmark * Walk all CONNs that can have a reference on an ire, nce or dce. 2211bd670b35SErik Nordmark * Get them to update any stale references to drop any refholds they 2212bd670b35SErik Nordmark * have. 2213bd670b35SErik Nordmark */ 2214bd670b35SErik Nordmark ipcl_walk(conn_ixa_cleanup, (void *)B_FALSE, ipst); 2215bd670b35SErik Nordmark } 2216bd670b35SErik Nordmark 2217bd670b35SErik Nordmark /* 2218bd670b35SErik Nordmark * Called by the memory allocator subsystem directly, when the system 2219bd670b35SErik Nordmark * is running low on memory. 2220bd670b35SErik Nordmark */ 2221bd670b35SErik Nordmark /* ARGSUSED */ 2222bd670b35SErik Nordmark void 2223bd670b35SErik Nordmark ip_ire_reclaim(void *args) 2224bd670b35SErik Nordmark { 2225bd670b35SErik Nordmark netstack_handle_t nh; 2226bd670b35SErik Nordmark netstack_t *ns; 22274ba231ceSKacheong Poon ip_stack_t *ipst; 2228bd670b35SErik Nordmark 2229bd670b35SErik Nordmark netstack_next_init(&nh); 2230bd670b35SErik Nordmark while ((ns = netstack_next(&nh)) != NULL) { 22314ba231ceSKacheong Poon /* 22324ba231ceSKacheong Poon * netstack_next() can return a netstack_t with a NULL 22334ba231ceSKacheong Poon * netstack_ip at boot time. 22344ba231ceSKacheong Poon */ 22354ba231ceSKacheong Poon if ((ipst = ns->netstack_ip) == NULL) { 22364ba231ceSKacheong Poon netstack_rele(ns); 22374ba231ceSKacheong Poon continue; 22384ba231ceSKacheong Poon } 22394ba231ceSKacheong Poon ip_ire_reclaim_stack(ipst); 2240bd670b35SErik Nordmark netstack_rele(ns); 2241bd670b35SErik Nordmark } 2242bd670b35SErik Nordmark netstack_next_fini(&nh); 22437c478bd9Sstevel@tonic-gate } 22447c478bd9Sstevel@tonic-gate 22457c478bd9Sstevel@tonic-gate static void 22467c478bd9Sstevel@tonic-gate power2_roundup(uint32_t *value) 22477c478bd9Sstevel@tonic-gate { 22487c478bd9Sstevel@tonic-gate int i; 22497c478bd9Sstevel@tonic-gate 22507c478bd9Sstevel@tonic-gate for (i = 1; i < 31; i++) { 22517c478bd9Sstevel@tonic-gate if (*value <= (1 << i)) 22527c478bd9Sstevel@tonic-gate break; 22537c478bd9Sstevel@tonic-gate } 22547c478bd9Sstevel@tonic-gate *value = (1 << i); 22557c478bd9Sstevel@tonic-gate } 22567c478bd9Sstevel@tonic-gate 2257f4b3ec61Sdh155122 /* Global init for all zones */ 22587c478bd9Sstevel@tonic-gate void 2259f4b3ec61Sdh155122 ip_ire_g_init() 22607c478bd9Sstevel@tonic-gate { 22617c478bd9Sstevel@tonic-gate /* 2262bd670b35SErik Nordmark * Create kmem_caches. ip_ire_reclaim() and ip_nce_reclaim() 2263bd670b35SErik Nordmark * will give disposable IREs back to system when needed. 22647c478bd9Sstevel@tonic-gate * This needs to be done here before anything else, since 22657c478bd9Sstevel@tonic-gate * ire_add() expects the cache to be created. 22667c478bd9Sstevel@tonic-gate */ 22677c478bd9Sstevel@tonic-gate ire_cache = kmem_cache_create("ire_cache", 2268bd670b35SErik Nordmark sizeof (ire_t), 0, NULL, NULL, 2269bd670b35SErik Nordmark ip_ire_reclaim, NULL, NULL, 0); 2270bd670b35SErik Nordmark 2271bd670b35SErik Nordmark ncec_cache = kmem_cache_create("ncec_cache", 2272bd670b35SErik Nordmark sizeof (ncec_t), 0, NULL, NULL, 2273bd670b35SErik Nordmark ip_nce_reclaim, NULL, NULL, 0); 2274bd670b35SErik Nordmark nce_cache = kmem_cache_create("nce_cache", 2275bd670b35SErik Nordmark sizeof (nce_t), 0, NULL, NULL, 2276bd670b35SErik Nordmark NULL, NULL, NULL, 0); 22777c478bd9Sstevel@tonic-gate 2278f4b3ec61Sdh155122 rt_entry_cache = kmem_cache_create("rt_entry", 2279f4b3ec61Sdh155122 sizeof (struct rt_entry), 0, NULL, NULL, NULL, NULL, NULL, 0); 2280f4b3ec61Sdh155122 2281f4b3ec61Sdh155122 /* 2282f4b3ec61Sdh155122 * Have radix code setup kmem caches etc. 2283f4b3ec61Sdh155122 */ 2284f4b3ec61Sdh155122 rn_init(); 2285f4b3ec61Sdh155122 } 2286f4b3ec61Sdh155122 2287f4b3ec61Sdh155122 void 2288f4b3ec61Sdh155122 ip_ire_init(ip_stack_t *ipst) 2289f4b3ec61Sdh155122 { 2290bd670b35SErik Nordmark ire_t *ire; 2291bd670b35SErik Nordmark int error; 2292f4b3ec61Sdh155122 2293f4b3ec61Sdh155122 mutex_init(&ipst->ips_ire_ft_init_lock, NULL, MUTEX_DEFAULT, 0); 2294f4b3ec61Sdh155122 2295f4b3ec61Sdh155122 (void) rn_inithead((void **)&ipst->ips_ip_ftable, 32); 2296f4b3ec61Sdh155122 22977c478bd9Sstevel@tonic-gate /* 22987c478bd9Sstevel@tonic-gate * Make sure that the forwarding table size is a power of 2. 22997c478bd9Sstevel@tonic-gate * The IRE*_ADDR_HASH() macroes depend on that. 23007c478bd9Sstevel@tonic-gate */ 2301f4b3ec61Sdh155122 ipst->ips_ip6_ftable_hash_size = ip6_ftable_hash_size; 2302f4b3ec61Sdh155122 power2_roundup(&ipst->ips_ip6_ftable_hash_size); 2303f4b3ec61Sdh155122 2304bd670b35SErik Nordmark /* 2305bd670b35SErik Nordmark * Allocate/initialize a pair of IRE_NOROUTEs for each of IPv4 and IPv6. 2306bd670b35SErik Nordmark * The ire_reject_v* has RTF_REJECT set, and the ire_blackhole_v* has 2307bd670b35SErik Nordmark * RTF_BLACKHOLE set. We use the latter for transient errors such 2308bd670b35SErik Nordmark * as memory allocation failures and tripping on IRE_IS_CONDEMNED 2309bd670b35SErik Nordmark * entries. 2310bd670b35SErik Nordmark */ 2311bd670b35SErik Nordmark ire = kmem_cache_alloc(ire_cache, KM_SLEEP); 2312bd670b35SErik Nordmark *ire = ire_null; 2313bd670b35SErik Nordmark error = ire_init_v4(ire, 0, 0, 0, IRE_NOROUTE, NULL, ALL_ZONES, 2314bd670b35SErik Nordmark RTF_REJECT|RTF_UP, NULL, ipst); 2315bd670b35SErik Nordmark ASSERT(error == 0); 2316bd670b35SErik Nordmark ipst->ips_ire_reject_v4 = ire; 2317bd670b35SErik Nordmark 2318bd670b35SErik Nordmark ire = kmem_cache_alloc(ire_cache, KM_SLEEP); 2319bd670b35SErik Nordmark *ire = ire_null; 2320bd670b35SErik Nordmark error = ire_init_v6(ire, 0, 0, 0, IRE_NOROUTE, NULL, ALL_ZONES, 2321bd670b35SErik Nordmark RTF_REJECT|RTF_UP, NULL, ipst); 2322bd670b35SErik Nordmark ASSERT(error == 0); 2323bd670b35SErik Nordmark ipst->ips_ire_reject_v6 = ire; 2324bd670b35SErik Nordmark 2325bd670b35SErik Nordmark ire = kmem_cache_alloc(ire_cache, KM_SLEEP); 2326bd670b35SErik Nordmark *ire = ire_null; 2327bd670b35SErik Nordmark error = ire_init_v4(ire, 0, 0, 0, IRE_NOROUTE, NULL, ALL_ZONES, 2328bd670b35SErik Nordmark RTF_BLACKHOLE|RTF_UP, NULL, ipst); 2329bd670b35SErik Nordmark ASSERT(error == 0); 2330bd670b35SErik Nordmark ipst->ips_ire_blackhole_v4 = ire; 2331bd670b35SErik Nordmark 2332bd670b35SErik Nordmark ire = kmem_cache_alloc(ire_cache, KM_SLEEP); 2333bd670b35SErik Nordmark *ire = ire_null; 2334bd670b35SErik Nordmark error = ire_init_v6(ire, 0, 0, 0, IRE_NOROUTE, NULL, ALL_ZONES, 2335bd670b35SErik Nordmark RTF_BLACKHOLE|RTF_UP, NULL, ipst); 2336bd670b35SErik Nordmark ASSERT(error == 0); 2337bd670b35SErik Nordmark ipst->ips_ire_blackhole_v6 = ire; 2338bd670b35SErik Nordmark 2339bd670b35SErik Nordmark rw_init(&ipst->ips_ip6_ire_head_lock, NULL, RW_DEFAULT, NULL); 2340bd670b35SErik Nordmark rw_init(&ipst->ips_ire_dep_lock, NULL, RW_DEFAULT, NULL); 23417c478bd9Sstevel@tonic-gate } 23427c478bd9Sstevel@tonic-gate 23437c478bd9Sstevel@tonic-gate void 2344f4b3ec61Sdh155122 ip_ire_g_fini(void) 2345f4b3ec61Sdh155122 { 2346f4b3ec61Sdh155122 kmem_cache_destroy(ire_cache); 2347bd670b35SErik Nordmark kmem_cache_destroy(ncec_cache); 2348bd670b35SErik Nordmark kmem_cache_destroy(nce_cache); 2349f4b3ec61Sdh155122 kmem_cache_destroy(rt_entry_cache); 2350f4b3ec61Sdh155122 2351f4b3ec61Sdh155122 rn_fini(); 2352f4b3ec61Sdh155122 } 2353f4b3ec61Sdh155122 2354f4b3ec61Sdh155122 void 2355f4b3ec61Sdh155122 ip_ire_fini(ip_stack_t *ipst) 23567c478bd9Sstevel@tonic-gate { 23577c478bd9Sstevel@tonic-gate int i; 23587c478bd9Sstevel@tonic-gate 2359bd670b35SErik Nordmark rw_destroy(&ipst->ips_ire_dep_lock); 2360bd670b35SErik Nordmark rw_destroy(&ipst->ips_ip6_ire_head_lock); 2361bd670b35SErik Nordmark 2362b8d97ac6SThirumalai Srinivasan ire_make_condemned(ipst->ips_ire_reject_v6); 2363bd670b35SErik Nordmark ire_refrele_notr(ipst->ips_ire_reject_v6); 2364bd670b35SErik Nordmark ipst->ips_ire_reject_v6 = NULL; 2365b8d97ac6SThirumalai Srinivasan 2366b8d97ac6SThirumalai Srinivasan ire_make_condemned(ipst->ips_ire_reject_v4); 2367bd670b35SErik Nordmark ire_refrele_notr(ipst->ips_ire_reject_v4); 2368bd670b35SErik Nordmark ipst->ips_ire_reject_v4 = NULL; 2369b8d97ac6SThirumalai Srinivasan 2370b8d97ac6SThirumalai Srinivasan ire_make_condemned(ipst->ips_ire_blackhole_v6); 2371bd670b35SErik Nordmark ire_refrele_notr(ipst->ips_ire_blackhole_v6); 2372bd670b35SErik Nordmark ipst->ips_ire_blackhole_v6 = NULL; 2373b8d97ac6SThirumalai Srinivasan 2374b8d97ac6SThirumalai Srinivasan ire_make_condemned(ipst->ips_ire_blackhole_v4); 2375bd670b35SErik Nordmark ire_refrele_notr(ipst->ips_ire_blackhole_v4); 2376bd670b35SErik Nordmark ipst->ips_ire_blackhole_v4 = NULL; 2377bd670b35SErik Nordmark 2378f4b3ec61Sdh155122 /* 2379f4b3ec61Sdh155122 * Delete all IREs - assumes that the ill/ipifs have 2380bd670b35SErik Nordmark * been removed so what remains are just the ftable to handle. 2381f4b3ec61Sdh155122 */ 2382f4b3ec61Sdh155122 ire_walk(ire_delete, NULL, ipst); 2383c793af95Ssangeeta 2384f4b3ec61Sdh155122 rn_freehead(ipst->ips_ip_ftable); 2385f4b3ec61Sdh155122 ipst->ips_ip_ftable = NULL; 23867c478bd9Sstevel@tonic-gate 2387f4b3ec61Sdh155122 mutex_destroy(&ipst->ips_ire_ft_init_lock); 23887c478bd9Sstevel@tonic-gate 2389f4b3ec61Sdh155122 for (i = 0; i < IP6_MASK_TABLE_SIZE; i++) { 2390f4b3ec61Sdh155122 irb_t *ptr; 2391f4b3ec61Sdh155122 int j; 2392f4b3ec61Sdh155122 2393f4b3ec61Sdh155122 if ((ptr = ipst->ips_ip_forwarding_table_v6[i]) == NULL) 2394f4b3ec61Sdh155122 continue; 2395f4b3ec61Sdh155122 2396f4b3ec61Sdh155122 for (j = 0; j < ipst->ips_ip6_ftable_hash_size; j++) { 2397f4b3ec61Sdh155122 ASSERT(ptr[j].irb_ire == NULL); 2398f4b3ec61Sdh155122 rw_destroy(&ptr[j].irb_lock); 2399f4b3ec61Sdh155122 } 2400f4b3ec61Sdh155122 mi_free(ptr); 2401f4b3ec61Sdh155122 ipst->ips_ip_forwarding_table_v6[i] = NULL; 2402f4b3ec61Sdh155122 } 24037c478bd9Sstevel@tonic-gate } 24047c478bd9Sstevel@tonic-gate 24056a8288c7Scarlsonj #ifdef DEBUG 24067c478bd9Sstevel@tonic-gate void 24077c478bd9Sstevel@tonic-gate ire_trace_ref(ire_t *ire) 24087c478bd9Sstevel@tonic-gate { 24097c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 24106a8288c7Scarlsonj if (ire->ire_trace_disable) { 24117c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 24127c478bd9Sstevel@tonic-gate return; 24137c478bd9Sstevel@tonic-gate } 24146a8288c7Scarlsonj 24156a8288c7Scarlsonj if (th_trace_ref(ire, ire->ire_ipst)) { 24166a8288c7Scarlsonj mutex_exit(&ire->ire_lock); 24176a8288c7Scarlsonj } else { 24187c478bd9Sstevel@tonic-gate ire->ire_trace_disable = B_TRUE; 24197c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 24206a8288c7Scarlsonj ire_trace_cleanup(ire); 24217c478bd9Sstevel@tonic-gate } 24227c478bd9Sstevel@tonic-gate } 24237c478bd9Sstevel@tonic-gate 24247c478bd9Sstevel@tonic-gate void 24257c478bd9Sstevel@tonic-gate ire_untrace_ref(ire_t *ire) 24267c478bd9Sstevel@tonic-gate { 24277c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 24286a8288c7Scarlsonj if (!ire->ire_trace_disable) 24296a8288c7Scarlsonj th_trace_unref(ire); 24307c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 24317c478bd9Sstevel@tonic-gate } 24327c478bd9Sstevel@tonic-gate 24337c478bd9Sstevel@tonic-gate static void 24346a8288c7Scarlsonj ire_trace_cleanup(const ire_t *ire) 24357c478bd9Sstevel@tonic-gate { 24366a8288c7Scarlsonj th_trace_cleanup(ire, ire->ire_trace_disable); 24377c478bd9Sstevel@tonic-gate } 24386a8288c7Scarlsonj #endif /* DEBUG */ 2439c793af95Ssangeeta 2440c793af95Ssangeeta /* 2441bd670b35SErik Nordmark * Find, or create if needed, the nce_t pointer to the neighbor cache 2442bd670b35SErik Nordmark * entry ncec_t for an IPv4 address. The nce_t will be created on the ill_t 2443bd670b35SErik Nordmark * in the non-IPMP case, or on the cast-ill in the IPMP bcast/mcast case, or 2444bd670b35SErik Nordmark * on the next available under-ill (selected by the IPMP rotor) in the 2445bd670b35SErik Nordmark * unicast IPMP case. 244654da8755Ssowmini * 244754da8755Ssowmini * If a neighbor-cache entry has to be created (i.e., one does not already 2448bd670b35SErik Nordmark * exist in the nce list) the ncec_lladdr and ncec_state of the neighbor cache 2449bd670b35SErik Nordmark * entry are initialized in nce_add_v4(). The broadcast, multicast, and 2450bd670b35SErik Nordmark * link-layer type determine the contents of {ncec_state, ncec_lladdr} of 2451bd670b35SErik Nordmark * the ncec_t created. The ncec_lladdr is non-null for all link types with 2452bd670b35SErik Nordmark * non-zero ill_phys_addr_length, though the contents may be zero in cases 2453bd670b35SErik Nordmark * where the link-layer type is not known at the time of creation 2454bd670b35SErik Nordmark * (e.g., IRE_IFRESOLVER links) 2455bd670b35SErik Nordmark * 2456bd670b35SErik Nordmark * All IRE_BROADCAST entries have ncec_state = ND_REACHABLE, and the nce_lladr 2457bd670b35SErik Nordmark * has the physical broadcast address of the outgoing interface. 2458bd670b35SErik Nordmark * For unicast ire entries, 245954da8755Ssowmini * - if the outgoing interface is of type IRE_IF_RESOLVER, a newly created 2460bd670b35SErik Nordmark * ncec_t with 0 nce_lladr contents, and will be in the ND_INITIAL state. 246154da8755Ssowmini * - if the outgoing interface is a IRE_IF_NORESOLVER interface, no link 2462bd670b35SErik Nordmark * layer resolution is necessary, so that the ncec_t will be in the 2463bd670b35SErik Nordmark * ND_REACHABLE state 246454da8755Ssowmini * 246554da8755Ssowmini * The link layer information needed for broadcast addresses, and for 246654da8755Ssowmini * packets sent on IRE_IF_NORESOLVER interfaces is a constant mapping that 2467bd670b35SErik Nordmark * never needs re-verification for the lifetime of the ncec_t. These are 2468bd670b35SErik Nordmark * therefore marked NCE_F_NONUD. 246954da8755Ssowmini * 2470bd670b35SErik Nordmark * The nce returned will be created such that the nce_ill == ill that 2471bd670b35SErik Nordmark * is passed in. Note that the nce itself may not have ncec_ill == ill 2472bd670b35SErik Nordmark * where IPMP links are involved. 2473c793af95Ssangeeta */ 2474bd670b35SErik Nordmark static nce_t * 2475bd670b35SErik Nordmark ire_nce_init(ill_t *ill, const void *addr, int ire_type) 2476c793af95Ssangeeta { 2477c793af95Ssangeeta int err; 247854da8755Ssowmini nce_t *nce = NULL; 2479bd670b35SErik Nordmark uint16_t ncec_flags; 2480bd670b35SErik Nordmark uchar_t *hwaddr; 2481bd670b35SErik Nordmark boolean_t need_refrele = B_FALSE; 2482bd670b35SErik Nordmark ill_t *in_ill = ill; 2483bd670b35SErik Nordmark boolean_t is_unicast; 2484bd670b35SErik Nordmark uint_t hwaddr_len; 2485c793af95Ssangeeta 2486bd670b35SErik Nordmark is_unicast = ((ire_type & (IRE_MULTICAST|IRE_BROADCAST)) == 0); 2487bd670b35SErik Nordmark if (IS_IPMP(ill) || 2488bd670b35SErik Nordmark ((ire_type & IRE_BROADCAST) && IS_UNDER_IPMP(ill))) { 24891f19738eSmeem if ((ill = ipmp_ill_hold_xmit_ill(ill, is_unicast)) == NULL) 2490bd670b35SErik Nordmark return (NULL); 2491bd670b35SErik Nordmark need_refrele = B_TRUE; 2492bd670b35SErik Nordmark } 2493bd670b35SErik Nordmark ncec_flags = (ill->ill_flags & ILLF_NONUD) ? NCE_F_NONUD : 0; 2494c793af95Ssangeeta 2495bd670b35SErik Nordmark switch (ire_type) { 2496c793af95Ssangeeta case IRE_BROADCAST: 2497bd670b35SErik Nordmark ASSERT(!ill->ill_isv6); 2498bd670b35SErik Nordmark ncec_flags |= (NCE_F_BCAST|NCE_F_NONUD); 2499c793af95Ssangeeta break; 2500bd670b35SErik Nordmark case IRE_MULTICAST: 2501bd670b35SErik Nordmark ncec_flags |= (NCE_F_MCAST|NCE_F_NONUD); 2502bd670b35SErik Nordmark break; 2503c793af95Ssangeeta } 2504c793af95Ssangeeta 2505bd670b35SErik Nordmark if (ill->ill_net_type == IRE_IF_NORESOLVER && is_unicast) { 2506bd670b35SErik Nordmark hwaddr = ill->ill_dest_addr; 2507bd670b35SErik Nordmark } else { 2508bd670b35SErik Nordmark hwaddr = NULL; 2509b9c344b3Ssowmini } 2510bd670b35SErik Nordmark hwaddr_len = ill->ill_phys_addr_length; 2511b9c344b3Ssowmini 2512bd670b35SErik Nordmark retry: 2513bd670b35SErik Nordmark /* nce_state will be computed by nce_add_common() */ 2514bd670b35SErik Nordmark if (!ill->ill_isv6) { 2515bd670b35SErik Nordmark err = nce_lookup_then_add_v4(ill, hwaddr, hwaddr_len, addr, 2516bd670b35SErik Nordmark ncec_flags, ND_UNCHANGED, &nce); 2517bd670b35SErik Nordmark } else { 2518bd670b35SErik Nordmark err = nce_lookup_then_add_v6(ill, hwaddr, hwaddr_len, addr, 2519bd670b35SErik Nordmark ncec_flags, ND_UNCHANGED, &nce); 2520bd670b35SErik Nordmark } 2521c793af95Ssangeeta 2522c793af95Ssangeeta switch (err) { 2523c793af95Ssangeeta case 0: 2524bd670b35SErik Nordmark break; 2525c793af95Ssangeeta case EEXIST: 2526c793af95Ssangeeta /* 2527bd670b35SErik Nordmark * When subnets change or partially overlap what was once 2528bd670b35SErik Nordmark * a broadcast address could now be a unicast, or vice versa. 2529c793af95Ssangeeta */ 2530bd670b35SErik Nordmark if (((ncec_flags ^ nce->nce_common->ncec_flags) & 2531bd670b35SErik Nordmark NCE_F_BCAST) != 0) { 2532bd670b35SErik Nordmark ASSERT(!ill->ill_isv6); 2533bd670b35SErik Nordmark ncec_delete(nce->nce_common); 2534bd670b35SErik Nordmark nce_refrele(nce); 2535bd670b35SErik Nordmark goto retry; 2536bd670b35SErik Nordmark } 2537c793af95Ssangeeta break; 2538c793af95Ssangeeta default: 2539bd670b35SErik Nordmark DTRACE_PROBE2(nce__init__fail, ill_t *, ill, int, err); 2540bd670b35SErik Nordmark if (need_refrele) 2541bd670b35SErik Nordmark ill_refrele(ill); 2542bd670b35SErik Nordmark return (NULL); 2543c793af95Ssangeeta } 25449294ad19SSowmini Varadhan /* 2545bd670b35SErik Nordmark * If the ill was an under-ill of an IPMP group, we need to verify 2546bd670b35SErik Nordmark * that it is still active so that we select an active interface in 2547bd670b35SErik Nordmark * the group. However, since ipmp_ill_is_active ASSERTs for 2548bd670b35SErik Nordmark * IS_UNDER_IPMP(), we first need to verify that the ill is an 2549bd670b35SErik Nordmark * under-ill, and since this is being done in the data path, the 2550bd670b35SErik Nordmark * only way to ascertain this is by holding the ill_g_lock. 25519294ad19SSowmini Varadhan */ 2552bd670b35SErik Nordmark rw_enter(&ill->ill_ipst->ips_ill_g_lock, RW_READER); 2553bd670b35SErik Nordmark mutex_enter(&ill->ill_lock); 2554bd670b35SErik Nordmark mutex_enter(&ill->ill_phyint->phyint_lock); 2555bd670b35SErik Nordmark if (need_refrele && IS_UNDER_IPMP(ill) && !ipmp_ill_is_active(ill)) { 2556c793af95Ssangeeta /* 2557bd670b35SErik Nordmark * need_refrele implies that the under ill was selected by 25581f19738eSmeem * ipmp_ill_hold_xmit_ill() because either the in_ill was an 25591f19738eSmeem * ipmp_ill, or we are sending a non-unicast packet on an 25601f19738eSmeem * under_ill. However, when we get here, the ill selected by 25611f19738eSmeem * ipmp_ill_hold_xmit_ill was pulled out of the active set 25621f19738eSmeem * (for unicast) or cast_ill nomination (for !unicast) after 25631f19738eSmeem * it was picked as the outgoing ill. We have to pick an 25641f19738eSmeem * active interface and/or cast_ill in the group. 2565c793af95Ssangeeta */ 2566bd670b35SErik Nordmark mutex_exit(&ill->ill_phyint->phyint_lock); 2567bd670b35SErik Nordmark nce_delete(nce); 2568bd670b35SErik Nordmark mutex_exit(&ill->ill_lock); 2569bd670b35SErik Nordmark rw_exit(&ill->ill_ipst->ips_ill_g_lock); 2570bd670b35SErik Nordmark nce_refrele(nce); 2571bd670b35SErik Nordmark ill_refrele(ill); 25721f19738eSmeem if ((ill = ipmp_ill_hold_xmit_ill(in_ill, is_unicast)) == NULL) 2573bd670b35SErik Nordmark return (NULL); 2574bd670b35SErik Nordmark goto retry; 2575c793af95Ssangeeta } else { 2576bd670b35SErik Nordmark mutex_exit(&ill->ill_phyint->phyint_lock); 2577bd670b35SErik Nordmark mutex_exit(&ill->ill_lock); 2578bd670b35SErik Nordmark rw_exit(&ill->ill_ipst->ips_ill_g_lock); 2579bd670b35SErik Nordmark } 2580bd670b35SErik Nordmark done: 2581bd670b35SErik Nordmark ASSERT(nce->nce_ill == ill); 2582bd670b35SErik Nordmark if (need_refrele) 2583bd670b35SErik Nordmark ill_refrele(ill); 2584bd670b35SErik Nordmark return (nce); 2585bd670b35SErik Nordmark } 2586bd670b35SErik Nordmark 2587bd670b35SErik Nordmark nce_t * 2588bd670b35SErik Nordmark arp_nce_init(ill_t *ill, in_addr_t addr4, int ire_type) 2589bd670b35SErik Nordmark { 2590bd670b35SErik Nordmark return (ire_nce_init(ill, &addr4, ire_type)); 2591bd670b35SErik Nordmark } 2592bd670b35SErik Nordmark 2593bd670b35SErik Nordmark nce_t * 2594bd670b35SErik Nordmark ndp_nce_init(ill_t *ill, const in6_addr_t *addr6, int ire_type) 2595bd670b35SErik Nordmark { 2596bd670b35SErik Nordmark ASSERT((ire_type & IRE_BROADCAST) == 0); 2597bd670b35SErik Nordmark return (ire_nce_init(ill, addr6, ire_type)); 2598bd670b35SErik Nordmark } 2599bd670b35SErik Nordmark 2600bd670b35SErik Nordmark /* 2601bd670b35SErik Nordmark * The caller should hold irb_lock as a writer if the ire is in a bucket. 2602f1c454b4SSowmini Varadhan * This routine will clear ire_nce_cache, and we make sure that we can never 2603f1c454b4SSowmini Varadhan * set ire_nce_cache after the ire is marked condemned. 2604bd670b35SErik Nordmark */ 2605bd670b35SErik Nordmark void 2606bd670b35SErik Nordmark ire_make_condemned(ire_t *ire) 2607bd670b35SErik Nordmark { 2608bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 2609f1c454b4SSowmini Varadhan nce_t *nce; 2610bd670b35SErik Nordmark 2611bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 2612bd670b35SErik Nordmark ASSERT(ire->ire_bucket == NULL || 2613bd670b35SErik Nordmark RW_WRITE_HELD(&ire->ire_bucket->irb_lock)); 2614bd670b35SErik Nordmark ASSERT(!IRE_IS_CONDEMNED(ire)); 2615bd670b35SErik Nordmark ire->ire_generation = IRE_GENERATION_CONDEMNED; 2616bd670b35SErik Nordmark /* Count how many condemned ires for kmem_cache callback */ 2617bd670b35SErik Nordmark atomic_add_32(&ipst->ips_num_ire_condemned, 1); 2618f1c454b4SSowmini Varadhan nce = ire->ire_nce_cache; 2619f1c454b4SSowmini Varadhan ire->ire_nce_cache = NULL; 2620bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 2621f1c454b4SSowmini Varadhan if (nce != NULL) 2622f1c454b4SSowmini Varadhan nce_refrele(nce); 2623bd670b35SErik Nordmark } 2624bd670b35SErik Nordmark 2625bd670b35SErik Nordmark /* 2626bd670b35SErik Nordmark * Increment the generation avoiding the special condemned value 2627bd670b35SErik Nordmark */ 2628bd670b35SErik Nordmark void 2629bd670b35SErik Nordmark ire_increment_generation(ire_t *ire) 2630bd670b35SErik Nordmark { 2631bd670b35SErik Nordmark uint_t generation; 2632bd670b35SErik Nordmark 2633bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 2634bd670b35SErik Nordmark /* 2635bd670b35SErik Nordmark * Even though the caller has a hold it can't prevent a concurrent 2636bd670b35SErik Nordmark * ire_delete marking the IRE condemned 2637bd670b35SErik Nordmark */ 2638bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(ire)) { 2639bd670b35SErik Nordmark generation = ire->ire_generation + 1; 2640bd670b35SErik Nordmark if (generation == IRE_GENERATION_CONDEMNED) 2641bd670b35SErik Nordmark generation = IRE_GENERATION_INITIAL; 2642bd670b35SErik Nordmark ASSERT(generation != IRE_GENERATION_VERIFY); 2643bd670b35SErik Nordmark ire->ire_generation = generation; 2644bd670b35SErik Nordmark } 2645bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 2646bd670b35SErik Nordmark } 2647bd670b35SErik Nordmark 2648bd670b35SErik Nordmark /* 2649bd670b35SErik Nordmark * Increment ire_generation on all the IRE_MULTICASTs 2650bd670b35SErik Nordmark * Used when the default multicast interface (as determined by 2651bd670b35SErik Nordmark * ill_lookup_multicast) might have changed. 2652bd670b35SErik Nordmark * 2653bd670b35SErik Nordmark * That includes the zoneid, IFF_ flags, the IPv6 scope of the address, and 2654bd670b35SErik Nordmark * ill unplumb. 2655bd670b35SErik Nordmark */ 2656bd670b35SErik Nordmark void 2657bd670b35SErik Nordmark ire_increment_multicast_generation(ip_stack_t *ipst, boolean_t isv6) 2658bd670b35SErik Nordmark { 2659bd670b35SErik Nordmark ill_t *ill; 2660bd670b35SErik Nordmark ill_walk_context_t ctx; 2661bd670b35SErik Nordmark 2662bd670b35SErik Nordmark rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2663bd670b35SErik Nordmark if (isv6) 2664bd670b35SErik Nordmark ill = ILL_START_WALK_V6(&ctx, ipst); 2665bd670b35SErik Nordmark else 2666bd670b35SErik Nordmark ill = ILL_START_WALK_V4(&ctx, ipst); 2667bd670b35SErik Nordmark for (; ill != NULL; ill = ill_next(&ctx, ill)) { 2668bd670b35SErik Nordmark if (ILL_IS_CONDEMNED(ill)) 2669bd670b35SErik Nordmark continue; 2670bd670b35SErik Nordmark if (ill->ill_ire_multicast != NULL) 2671bd670b35SErik Nordmark ire_increment_generation(ill->ill_ire_multicast); 2672bd670b35SErik Nordmark } 2673bd670b35SErik Nordmark rw_exit(&ipst->ips_ill_g_lock); 2674bd670b35SErik Nordmark } 2675bd670b35SErik Nordmark 2676bd670b35SErik Nordmark /* 2677bd670b35SErik Nordmark * Return a held IRE_NOROUTE with RTF_REJECT set 2678bd670b35SErik Nordmark */ 2679bd670b35SErik Nordmark ire_t * 2680bd670b35SErik Nordmark ire_reject(ip_stack_t *ipst, boolean_t isv6) 2681bd670b35SErik Nordmark { 2682bd670b35SErik Nordmark ire_t *ire; 2683bd670b35SErik Nordmark 2684bd670b35SErik Nordmark if (isv6) 2685bd670b35SErik Nordmark ire = ipst->ips_ire_reject_v6; 2686bd670b35SErik Nordmark else 2687bd670b35SErik Nordmark ire = ipst->ips_ire_reject_v4; 2688bd670b35SErik Nordmark 2689bd670b35SErik Nordmark ASSERT(ire->ire_generation != IRE_GENERATION_CONDEMNED); 2690bd670b35SErik Nordmark ire_refhold(ire); 2691bd670b35SErik Nordmark return (ire); 2692bd670b35SErik Nordmark } 2693bd670b35SErik Nordmark 2694bd670b35SErik Nordmark /* 2695bd670b35SErik Nordmark * Return a held IRE_NOROUTE with RTF_BLACKHOLE set 2696bd670b35SErik Nordmark */ 2697bd670b35SErik Nordmark ire_t * 2698bd670b35SErik Nordmark ire_blackhole(ip_stack_t *ipst, boolean_t isv6) 2699bd670b35SErik Nordmark { 2700bd670b35SErik Nordmark ire_t *ire; 2701bd670b35SErik Nordmark 2702bd670b35SErik Nordmark if (isv6) 2703bd670b35SErik Nordmark ire = ipst->ips_ire_blackhole_v6; 2704bd670b35SErik Nordmark else 2705bd670b35SErik Nordmark ire = ipst->ips_ire_blackhole_v4; 2706bd670b35SErik Nordmark 2707bd670b35SErik Nordmark ASSERT(ire->ire_generation != IRE_GENERATION_CONDEMNED); 2708bd670b35SErik Nordmark ire_refhold(ire); 2709bd670b35SErik Nordmark return (ire); 2710bd670b35SErik Nordmark } 2711bd670b35SErik Nordmark 2712bd670b35SErik Nordmark /* 2713bd670b35SErik Nordmark * Return a held IRE_MULTICAST. 2714bd670b35SErik Nordmark */ 2715bd670b35SErik Nordmark ire_t * 2716bd670b35SErik Nordmark ire_multicast(ill_t *ill) 2717bd670b35SErik Nordmark { 2718bd670b35SErik Nordmark ire_t *ire = ill->ill_ire_multicast; 2719bd670b35SErik Nordmark 2720bd670b35SErik Nordmark ASSERT(ire == NULL || ire->ire_generation != IRE_GENERATION_CONDEMNED); 2721bd670b35SErik Nordmark if (ire == NULL) 2722bd670b35SErik Nordmark ire = ire_blackhole(ill->ill_ipst, ill->ill_isv6); 2723bd670b35SErik Nordmark else 2724bd670b35SErik Nordmark ire_refhold(ire); 2725bd670b35SErik Nordmark return (ire); 2726bd670b35SErik Nordmark } 2727bd670b35SErik Nordmark 2728bd670b35SErik Nordmark /* 2729bd670b35SErik Nordmark * Given an IRE return its nexthop IRE. The nexthop IRE is an IRE_ONLINK 2730bd670b35SErik Nordmark * that is an exact match (i.e., a /32 for IPv4 and /128 for IPv6). 2731bd670b35SErik Nordmark * This can return an RTF_REJECT|RTF_BLACKHOLE. 2732bd670b35SErik Nordmark * The returned IRE is held. 2733bd670b35SErik Nordmark * The assumption is that ip_select_route() has been called and returned the 2734bd670b35SErik Nordmark * IRE (thus ip_select_route would have set up the ire_dep* information.) 2735bd670b35SErik Nordmark * If some IRE is deleteted then ire_dep_remove() will have been called and 2736bd670b35SErik Nordmark * we might not find a nexthop IRE, in which case we return NULL. 2737bd670b35SErik Nordmark */ 2738bd670b35SErik Nordmark ire_t * 2739bd670b35SErik Nordmark ire_nexthop(ire_t *ire) 2740bd670b35SErik Nordmark { 2741bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 2742bd670b35SErik Nordmark 2743bd670b35SErik Nordmark /* Acquire lock to walk ire_dep_parent */ 2744bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 2745bd670b35SErik Nordmark while (ire != NULL) { 2746bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 2747bd670b35SErik Nordmark goto done; 27489294ad19SSowmini Varadhan } 2749c793af95Ssangeeta /* 2750bd670b35SErik Nordmark * If we find an IRE_ONLINK we are done. This includes 2751bd670b35SErik Nordmark * the case of IRE_MULTICAST. 2752bd670b35SErik Nordmark * Note that in order to send packets we need a host-specific 2753bd670b35SErik Nordmark * IRE_IF_ALL first in the ire_dep_parent chain. Normally this 2754bd670b35SErik Nordmark * is done by inserting an IRE_IF_CLONE if the IRE_INTERFACE 2755bd670b35SErik Nordmark * was not host specific. 2756bd670b35SErik Nordmark * However, ip_rts_request doesn't want to send packets 2757bd670b35SErik Nordmark * hence doesn't want to allocate an IRE_IF_CLONE. Yet 2758bd670b35SErik Nordmark * it needs an IRE_IF_ALL to get to the ill. Thus 2759bd670b35SErik Nordmark * we return IRE_IF_ALL that are not host specific here. 2760c793af95Ssangeeta */ 2761bd670b35SErik Nordmark if (ire->ire_type & IRE_ONLINK) 2762bd670b35SErik Nordmark goto done; 2763bd670b35SErik Nordmark ire = ire->ire_dep_parent; 2764c793af95Ssangeeta } 2765bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 2766bd670b35SErik Nordmark return (NULL); 2767bd670b35SErik Nordmark 2768bd670b35SErik Nordmark done: 2769bd670b35SErik Nordmark ire_refhold(ire); 2770bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 2771bd670b35SErik Nordmark return (ire); 2772bd670b35SErik Nordmark } 2773bd670b35SErik Nordmark 2774bd670b35SErik Nordmark /* 2775bd670b35SErik Nordmark * Find the ill used to send packets. This will be NULL in case 2776bd670b35SErik Nordmark * of a reject or blackhole. 2777bd670b35SErik Nordmark * The returned ill is held; caller needs to do ill_refrele when done. 2778bd670b35SErik Nordmark */ 2779bd670b35SErik Nordmark ill_t * 2780bd670b35SErik Nordmark ire_nexthop_ill(ire_t *ire) 2781bd670b35SErik Nordmark { 2782bd670b35SErik Nordmark ill_t *ill; 2783bd670b35SErik Nordmark 2784bd670b35SErik Nordmark ire = ire_nexthop(ire); 2785bd670b35SErik Nordmark if (ire == NULL) 2786bd670b35SErik Nordmark return (NULL); 2787bd670b35SErik Nordmark 2788bd670b35SErik Nordmark /* ire_ill can not change for an existing ire */ 2789bd670b35SErik Nordmark ill = ire->ire_ill; 2790bd670b35SErik Nordmark if (ill != NULL) 2791bd670b35SErik Nordmark ill_refhold(ill); 2792bd670b35SErik Nordmark ire_refrele(ire); 2793bd670b35SErik Nordmark return (ill); 2794bd670b35SErik Nordmark } 2795bd670b35SErik Nordmark 2796bd670b35SErik Nordmark #ifdef DEBUG 2797bd670b35SErik Nordmark static boolean_t 2798bd670b35SErik Nordmark parent_has_child(ire_t *parent, ire_t *child) 2799bd670b35SErik Nordmark { 2800bd670b35SErik Nordmark ire_t *ire; 2801bd670b35SErik Nordmark ire_t *prev; 2802bd670b35SErik Nordmark 2803bd670b35SErik Nordmark ire = parent->ire_dep_children; 2804bd670b35SErik Nordmark prev = NULL; 2805bd670b35SErik Nordmark while (ire != NULL) { 2806bd670b35SErik Nordmark if (prev == NULL) { 2807bd670b35SErik Nordmark ASSERT(ire->ire_dep_sib_ptpn == 2808bd670b35SErik Nordmark &(parent->ire_dep_children)); 2809bd670b35SErik Nordmark } else { 2810bd670b35SErik Nordmark ASSERT(ire->ire_dep_sib_ptpn == 2811bd670b35SErik Nordmark &(prev->ire_dep_sib_next)); 2812bd670b35SErik Nordmark } 2813bd670b35SErik Nordmark if (ire == child) 2814bd670b35SErik Nordmark return (B_TRUE); 2815bd670b35SErik Nordmark prev = ire; 2816bd670b35SErik Nordmark ire = ire->ire_dep_sib_next; 2817bd670b35SErik Nordmark } 2818bd670b35SErik Nordmark return (B_FALSE); 2819bd670b35SErik Nordmark } 2820bd670b35SErik Nordmark 2821bd670b35SErik Nordmark static void 2822bd670b35SErik Nordmark ire_dep_verify(ire_t *ire) 2823bd670b35SErik Nordmark { 2824bd670b35SErik Nordmark ire_t *parent = ire->ire_dep_parent; 2825bd670b35SErik Nordmark ire_t *child = ire->ire_dep_children; 2826bd670b35SErik Nordmark 2827bd670b35SErik Nordmark ASSERT(ire->ire_ipversion == IPV4_VERSION || 2828bd670b35SErik Nordmark ire->ire_ipversion == IPV6_VERSION); 2829bd670b35SErik Nordmark if (parent != NULL) { 2830bd670b35SErik Nordmark ASSERT(parent->ire_ipversion == IPV4_VERSION || 2831bd670b35SErik Nordmark parent->ire_ipversion == IPV6_VERSION); 2832bd670b35SErik Nordmark ASSERT(parent->ire_refcnt >= 1); 2833bd670b35SErik Nordmark ASSERT(parent_has_child(parent, ire)); 2834bd670b35SErik Nordmark } 2835bd670b35SErik Nordmark if (child != NULL) { 2836bd670b35SErik Nordmark ASSERT(child->ire_ipversion == IPV4_VERSION || 2837bd670b35SErik Nordmark child->ire_ipversion == IPV6_VERSION); 2838bd670b35SErik Nordmark ASSERT(child->ire_dep_parent == ire); 2839bd670b35SErik Nordmark ASSERT(child->ire_dep_sib_ptpn != NULL); 2840bd670b35SErik Nordmark ASSERT(parent_has_child(ire, child)); 2841bd670b35SErik Nordmark } 2842bd670b35SErik Nordmark } 2843bd670b35SErik Nordmark #endif /* DEBUG */ 2844bd670b35SErik Nordmark 2845bd670b35SErik Nordmark /* 2846bd670b35SErik Nordmark * Assumes ire_dep_parent is set. Remove this child from its parent's linkage. 2847bd670b35SErik Nordmark */ 2848bd670b35SErik Nordmark void 2849bd670b35SErik Nordmark ire_dep_remove(ire_t *ire) 2850bd670b35SErik Nordmark { 2851bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 2852bd670b35SErik Nordmark ire_t *parent = ire->ire_dep_parent; 2853bd670b35SErik Nordmark ire_t *next; 2854bd670b35SErik Nordmark nce_t *nce; 2855bd670b35SErik Nordmark 2856bd670b35SErik Nordmark ASSERT(RW_WRITE_HELD(&ipst->ips_ire_dep_lock)); 2857bd670b35SErik Nordmark ASSERT(ire->ire_dep_parent != NULL); 2858bd670b35SErik Nordmark ASSERT(ire->ire_dep_sib_ptpn != NULL); 2859bd670b35SErik Nordmark 2860bd670b35SErik Nordmark #ifdef DEBUG 2861bd670b35SErik Nordmark ire_dep_verify(ire); 2862bd670b35SErik Nordmark ire_dep_verify(parent); 2863bd670b35SErik Nordmark #endif 2864bd670b35SErik Nordmark 2865bd670b35SErik Nordmark next = ire->ire_dep_sib_next; 2866bd670b35SErik Nordmark if (next != NULL) 2867bd670b35SErik Nordmark next->ire_dep_sib_ptpn = ire->ire_dep_sib_ptpn; 2868bd670b35SErik Nordmark 2869bd670b35SErik Nordmark ASSERT(*(ire->ire_dep_sib_ptpn) == ire); 2870bd670b35SErik Nordmark *(ire->ire_dep_sib_ptpn) = ire->ire_dep_sib_next; 2871bd670b35SErik Nordmark 2872bd670b35SErik Nordmark ire->ire_dep_sib_ptpn = NULL; 2873bd670b35SErik Nordmark ire->ire_dep_sib_next = NULL; 2874bd670b35SErik Nordmark 2875bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 2876bd670b35SErik Nordmark parent = ire->ire_dep_parent; 2877bd670b35SErik Nordmark ire->ire_dep_parent = NULL; 2878bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 2879bd670b35SErik Nordmark 2880bd670b35SErik Nordmark /* 2881bd670b35SErik Nordmark * Make sure all our children, grandchildren, etc set 2882bd670b35SErik Nordmark * ire_dep_parent_generation to IRE_GENERATION_VERIFY since 2883bd670b35SErik Nordmark * we can no longer guarantee than the children have a current 2884bd670b35SErik Nordmark * ire_nce_cache and ire_nexthop_ill(). 2885bd670b35SErik Nordmark */ 2886bd670b35SErik Nordmark if (ire->ire_dep_children != NULL) 2887bd670b35SErik Nordmark ire_dep_invalidate_children(ire->ire_dep_children); 2888bd670b35SErik Nordmark 2889bd670b35SErik Nordmark /* 2890bd670b35SErik Nordmark * Since the parent is gone we make sure we clear ire_nce_cache. 2891bd670b35SErik Nordmark * We can clear it under ire_lock even if the IRE is used 2892bd670b35SErik Nordmark */ 2893bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 2894bd670b35SErik Nordmark nce = ire->ire_nce_cache; 2895bd670b35SErik Nordmark ire->ire_nce_cache = NULL; 2896bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 2897bd670b35SErik Nordmark if (nce != NULL) 2898bd670b35SErik Nordmark nce_refrele(nce); 2899bd670b35SErik Nordmark 2900bd670b35SErik Nordmark #ifdef DEBUG 2901bd670b35SErik Nordmark ire_dep_verify(ire); 2902bd670b35SErik Nordmark ire_dep_verify(parent); 2903bd670b35SErik Nordmark #endif 2904bd670b35SErik Nordmark 2905bd670b35SErik Nordmark ire_refrele_notr(parent); 2906bd670b35SErik Nordmark ire_refrele_notr(ire); 2907bd670b35SErik Nordmark } 2908bd670b35SErik Nordmark 2909bd670b35SErik Nordmark /* 2910bd670b35SErik Nordmark * Insert the child in the linkage of the parent 2911bd670b35SErik Nordmark */ 2912bd670b35SErik Nordmark static void 2913bd670b35SErik Nordmark ire_dep_parent_insert(ire_t *child, ire_t *parent) 2914bd670b35SErik Nordmark { 2915bd670b35SErik Nordmark ip_stack_t *ipst = child->ire_ipst; 2916bd670b35SErik Nordmark ire_t *next; 2917bd670b35SErik Nordmark 2918bd670b35SErik Nordmark ASSERT(RW_WRITE_HELD(&ipst->ips_ire_dep_lock)); 2919bd670b35SErik Nordmark ASSERT(child->ire_dep_parent == NULL); 2920bd670b35SErik Nordmark 2921bd670b35SErik Nordmark #ifdef DEBUG 2922bd670b35SErik Nordmark ire_dep_verify(child); 2923bd670b35SErik Nordmark ire_dep_verify(parent); 2924bd670b35SErik Nordmark #endif 2925bd670b35SErik Nordmark /* No parents => no siblings */ 2926bd670b35SErik Nordmark ASSERT(child->ire_dep_sib_ptpn == NULL); 2927bd670b35SErik Nordmark ASSERT(child->ire_dep_sib_next == NULL); 2928bd670b35SErik Nordmark 2929bd670b35SErik Nordmark ire_refhold_notr(parent); 2930bd670b35SErik Nordmark ire_refhold_notr(child); 2931bd670b35SErik Nordmark 2932bd670b35SErik Nordmark /* Head insertion */ 2933bd670b35SErik Nordmark next = parent->ire_dep_children; 2934bd670b35SErik Nordmark if (next != NULL) { 2935bd670b35SErik Nordmark ASSERT(next->ire_dep_sib_ptpn == &(parent->ire_dep_children)); 2936bd670b35SErik Nordmark child->ire_dep_sib_next = next; 2937bd670b35SErik Nordmark next->ire_dep_sib_ptpn = &(child->ire_dep_sib_next); 2938bd670b35SErik Nordmark } 2939bd670b35SErik Nordmark parent->ire_dep_children = child; 2940bd670b35SErik Nordmark child->ire_dep_sib_ptpn = &(parent->ire_dep_children); 2941bd670b35SErik Nordmark 2942bd670b35SErik Nordmark mutex_enter(&child->ire_lock); 2943bd670b35SErik Nordmark child->ire_dep_parent = parent; 2944bd670b35SErik Nordmark mutex_exit(&child->ire_lock); 2945bd670b35SErik Nordmark 2946bd670b35SErik Nordmark #ifdef DEBUG 2947bd670b35SErik Nordmark ire_dep_verify(child); 2948bd670b35SErik Nordmark ire_dep_verify(parent); 2949bd670b35SErik Nordmark #endif 2950bd670b35SErik Nordmark } 2951bd670b35SErik Nordmark 2952bd670b35SErik Nordmark 2953bd670b35SErik Nordmark /* 2954bd670b35SErik Nordmark * Given count worth of ires and generations, build ire_dep_* relationships 2955bd670b35SErik Nordmark * from ires[0] to ires[count-1]. Record generations[i+1] in 2956bd670b35SErik Nordmark * ire_dep_parent_generation for ires[i]. 2957bd670b35SErik Nordmark * We graft onto an existing parent chain by making sure that we don't 2958bd670b35SErik Nordmark * touch ire_dep_parent for ires[count-1]. 2959bd670b35SErik Nordmark * 2960bd670b35SErik Nordmark * We check for any condemned ire_generation count and return B_FALSE in 2961bd670b35SErik Nordmark * that case so that the caller can tear it apart. 2962bd670b35SErik Nordmark * 2963bd670b35SErik Nordmark * Note that generations[0] is not used. Caller handles that. 2964bd670b35SErik Nordmark */ 2965bd670b35SErik Nordmark boolean_t 2966bd670b35SErik Nordmark ire_dep_build(ire_t *ires[], uint_t generations[], uint_t count) 2967bd670b35SErik Nordmark { 2968bd670b35SErik Nordmark ire_t *ire = ires[0]; 2969bd670b35SErik Nordmark ip_stack_t *ipst; 2970bd670b35SErik Nordmark uint_t i; 2971bd670b35SErik Nordmark 2972bd670b35SErik Nordmark ASSERT(count > 0); 2973bd670b35SErik Nordmark if (count == 1) { 2974bd670b35SErik Nordmark /* No work to do */ 2975bd670b35SErik Nordmark return (B_TRUE); 2976bd670b35SErik Nordmark } 2977bd670b35SErik Nordmark ipst = ire->ire_ipst; 2978bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_WRITER); 2979bd670b35SErik Nordmark /* 2980bd670b35SErik Nordmark * Do not remove the linkage for any existing parent chain i.e., 2981bd670b35SErik Nordmark * ires[count-1] is left alone. 2982bd670b35SErik Nordmark */ 2983bd670b35SErik Nordmark for (i = 0; i < count-1; i++) { 2984bd670b35SErik Nordmark /* Remove existing parent if we need to change it */ 2985bd670b35SErik Nordmark if (ires[i]->ire_dep_parent != NULL && 2986bd670b35SErik Nordmark ires[i]->ire_dep_parent != ires[i+1]) 2987bd670b35SErik Nordmark ire_dep_remove(ires[i]); 2988bd670b35SErik Nordmark } 2989bd670b35SErik Nordmark 2990bd670b35SErik Nordmark for (i = 0; i < count - 1; i++) { 2991bd670b35SErik Nordmark ASSERT(ires[i]->ire_ipversion == IPV4_VERSION || 2992bd670b35SErik Nordmark ires[i]->ire_ipversion == IPV6_VERSION); 2993bd670b35SErik Nordmark /* Does it need to change? */ 2994bd670b35SErik Nordmark if (ires[i]->ire_dep_parent != ires[i+1]) 2995bd670b35SErik Nordmark ire_dep_parent_insert(ires[i], ires[i+1]); 2996bd670b35SErik Nordmark 2997bd670b35SErik Nordmark mutex_enter(&ires[i+1]->ire_lock); 2998bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ires[i+1])) { 2999bd670b35SErik Nordmark mutex_exit(&ires[i+1]->ire_lock); 3000bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3001bd670b35SErik Nordmark return (B_FALSE); 3002bd670b35SErik Nordmark } 3003bd670b35SErik Nordmark mutex_exit(&ires[i+1]->ire_lock); 3004bd670b35SErik Nordmark 3005bd670b35SErik Nordmark mutex_enter(&ires[i]->ire_lock); 3006bd670b35SErik Nordmark ires[i]->ire_dep_parent_generation = generations[i+1]; 3007bd670b35SErik Nordmark mutex_exit(&ires[i]->ire_lock); 3008bd670b35SErik Nordmark } 3009bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3010bd670b35SErik Nordmark return (B_TRUE); 3011bd670b35SErik Nordmark } 3012bd670b35SErik Nordmark 3013bd670b35SErik Nordmark /* 3014bd670b35SErik Nordmark * Given count worth of ires, unbuild ire_dep_* relationships 3015bd670b35SErik Nordmark * from ires[0] to ires[count-1]. 3016bd670b35SErik Nordmark */ 3017bd670b35SErik Nordmark void 3018bd670b35SErik Nordmark ire_dep_unbuild(ire_t *ires[], uint_t count) 3019bd670b35SErik Nordmark { 3020bd670b35SErik Nordmark ip_stack_t *ipst; 3021bd670b35SErik Nordmark uint_t i; 3022bd670b35SErik Nordmark 3023bd670b35SErik Nordmark if (count == 0) { 3024bd670b35SErik Nordmark /* No work to do */ 3025bd670b35SErik Nordmark return; 3026bd670b35SErik Nordmark } 3027bd670b35SErik Nordmark ipst = ires[0]->ire_ipst; 3028bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_WRITER); 3029bd670b35SErik Nordmark for (i = 0; i < count; i++) { 3030bd670b35SErik Nordmark ASSERT(ires[i]->ire_ipversion == IPV4_VERSION || 3031bd670b35SErik Nordmark ires[i]->ire_ipversion == IPV6_VERSION); 3032bd670b35SErik Nordmark if (ires[i]->ire_dep_parent != NULL) 3033bd670b35SErik Nordmark ire_dep_remove(ires[i]); 3034bd670b35SErik Nordmark mutex_enter(&ires[i]->ire_lock); 3035bd670b35SErik Nordmark ires[i]->ire_dep_parent_generation = IRE_GENERATION_VERIFY; 3036bd670b35SErik Nordmark mutex_exit(&ires[i]->ire_lock); 3037bd670b35SErik Nordmark } 3038bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3039bd670b35SErik Nordmark } 3040bd670b35SErik Nordmark 3041bd670b35SErik Nordmark /* 3042bd670b35SErik Nordmark * Both the forwarding and the outbound code paths can trip on 3043bd670b35SErik Nordmark * a condemned NCE, in which case we call this function. 3044bd670b35SErik Nordmark * We have two different behaviors: if the NCE was UNREACHABLE 3045bd670b35SErik Nordmark * it is an indication that something failed. In that case 3046bd670b35SErik Nordmark * we see if we should look for a different IRE (for example, 3047bd670b35SErik Nordmark * delete any matching redirect IRE, or try a different 3048bd670b35SErik Nordmark * IRE_DEFAULT (ECMP)). We mark the ire as bad so a hopefully 3049bd670b35SErik Nordmark * different IRE will be picked next time we send/forward. 3050bd670b35SErik Nordmark * 3051bd670b35SErik Nordmark * If we are called by the output path then fail_if_better is set 3052bd670b35SErik Nordmark * and we return NULL if there could be a better IRE. This is because the 3053bd670b35SErik Nordmark * output path retries the IRE lookup. (The input/forward path can not retry.) 3054bd670b35SErik Nordmark * 3055bd670b35SErik Nordmark * If the NCE was not unreachable then we pick/allocate a 3056bd670b35SErik Nordmark * new (most likely ND_INITIAL) NCE and proceed with it. 3057bd670b35SErik Nordmark * 3058bd670b35SErik Nordmark * ipha/ip6h are needed for multicast packets; ipha needs to be 3059bd670b35SErik Nordmark * set for IPv4 and ip6h needs to be set for IPv6 packets. 3060bd670b35SErik Nordmark */ 3061bd670b35SErik Nordmark nce_t * 3062bd670b35SErik Nordmark ire_handle_condemned_nce(nce_t *nce, ire_t *ire, ipha_t *ipha, ip6_t *ip6h, 3063bd670b35SErik Nordmark boolean_t fail_if_better) 3064bd670b35SErik Nordmark { 3065bd670b35SErik Nordmark if (nce->nce_common->ncec_state == ND_UNREACHABLE) { 3066bd670b35SErik Nordmark if (ire_no_good(ire) && fail_if_better) { 3067bd670b35SErik Nordmark /* 3068bd670b35SErik Nordmark * Did some changes, or ECMP likely to exist. 3069bd670b35SErik Nordmark * Make ip_output look for a different IRE 3070bd670b35SErik Nordmark */ 3071bd670b35SErik Nordmark return (NULL); 3072bd670b35SErik Nordmark } 3073bd670b35SErik Nordmark } 3074bd670b35SErik Nordmark if (ire_revalidate_nce(ire) == ENETUNREACH) { 3075bd670b35SErik Nordmark /* The ire_dep_parent chain went bad, or no memory? */ 3076bd670b35SErik Nordmark (void) ire_no_good(ire); 3077bd670b35SErik Nordmark return (NULL); 3078bd670b35SErik Nordmark } 3079bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 3080bd670b35SErik Nordmark ASSERT(ipha != NULL); 3081bd670b35SErik Nordmark nce = ire_to_nce(ire, ipha->ipha_dst, NULL); 3082bd670b35SErik Nordmark } else { 3083bd670b35SErik Nordmark ASSERT(ip6h != NULL); 3084bd670b35SErik Nordmark nce = ire_to_nce(ire, INADDR_ANY, &ip6h->ip6_dst); 3085bd670b35SErik Nordmark } 3086bd670b35SErik Nordmark 3087bd670b35SErik Nordmark if (nce == NULL) 3088bd670b35SErik Nordmark return (NULL); 3089bd670b35SErik Nordmark if (nce->nce_is_condemned) { 3090bd670b35SErik Nordmark nce_refrele(nce); 3091bd670b35SErik Nordmark return (NULL); 3092bd670b35SErik Nordmark } 3093bd670b35SErik Nordmark return (nce); 3094bd670b35SErik Nordmark } 3095bd670b35SErik Nordmark 3096bd670b35SErik Nordmark /* 3097bd670b35SErik Nordmark * The caller has found that the ire is bad, either due to a reference to an NCE 3098bd670b35SErik Nordmark * in ND_UNREACHABLE state, or a MULTIRT route whose gateway can't be resolved. 3099bd670b35SErik Nordmark * We update things so a subsequent attempt to send to the destination 3100bd670b35SErik Nordmark * is likely to find different IRE, or that a new NCE would be created. 3101bd670b35SErik Nordmark * 3102bd670b35SErik Nordmark * Returns B_TRUE if it is likely that a subsequent ire_ftable_lookup would 3103bd670b35SErik Nordmark * find a different route (either due to having deleted a redirect, or there 3104bd670b35SErik Nordmark * being ECMP routes.) 3105bd670b35SErik Nordmark * 3106bd670b35SErik Nordmark * If we have a redirect (RTF_DYNAMIC) we delete it. 3107bd670b35SErik Nordmark * Otherwise we increment ire_badcnt and increment the generation number so 3108bd670b35SErik Nordmark * that a cached ixa_ire will redo the route selection. ire_badcnt is taken 3109bd670b35SErik Nordmark * into account in the route selection when we have multiple choices (multiple 3110bd670b35SErik Nordmark * default routes or ECMP in general). 3111bd670b35SErik Nordmark * Any time ip_select_route find an ire with a condemned ire_nce_cache 3112bd670b35SErik Nordmark * (e.g., if no equal cost route to the bad one) ip_select_route will make 3113bd670b35SErik Nordmark * sure the NCE is revalidated to avoid getting stuck on a 3114bd670b35SErik Nordmark * NCE_F_CONDMNED ncec that caused ire_no_good to be called. 3115bd670b35SErik Nordmark */ 3116bd670b35SErik Nordmark boolean_t 3117bd670b35SErik Nordmark ire_no_good(ire_t *ire) 3118bd670b35SErik Nordmark { 3119bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 3120bd670b35SErik Nordmark ire_t *ire2; 3121bd670b35SErik Nordmark nce_t *nce; 3122bd670b35SErik Nordmark 3123bd670b35SErik Nordmark if (ire->ire_flags & RTF_DYNAMIC) { 3124bd670b35SErik Nordmark ire_delete(ire); 3125bd670b35SErik Nordmark return (B_TRUE); 3126bd670b35SErik Nordmark } 3127bd670b35SErik Nordmark if (ire->ire_flags & RTF_INDIRECT) { 3128bd670b35SErik Nordmark /* Check if next IRE is a redirect */ 3129bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 3130bd670b35SErik Nordmark if (ire->ire_dep_parent != NULL && 3131bd670b35SErik Nordmark (ire->ire_dep_parent->ire_flags & RTF_DYNAMIC)) { 3132bd670b35SErik Nordmark ire2 = ire->ire_dep_parent; 3133bd670b35SErik Nordmark ire_refhold(ire2); 3134bd670b35SErik Nordmark } else { 3135bd670b35SErik Nordmark ire2 = NULL; 3136bd670b35SErik Nordmark } 3137bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3138bd670b35SErik Nordmark if (ire2 != NULL) { 3139bd670b35SErik Nordmark ire_delete(ire2); 3140bd670b35SErik Nordmark ire_refrele(ire2); 3141bd670b35SErik Nordmark return (B_TRUE); 3142bd670b35SErik Nordmark } 3143bd670b35SErik Nordmark } 3144bd670b35SErik Nordmark /* 3145bd670b35SErik Nordmark * No redirect involved. Increment badcnt so that if we have ECMP 3146bd670b35SErik Nordmark * routes we are likely to pick a different one for the next packet. 3147bd670b35SErik Nordmark * 3148bd670b35SErik Nordmark * If the NCE is unreachable and condemned we should drop the reference 3149bd670b35SErik Nordmark * to it so that a new NCE can be created. 3150bd670b35SErik Nordmark * 3151bd670b35SErik Nordmark * Finally we increment the generation number so that any ixa_ire 3152bd670b35SErik Nordmark * cache will be revalidated. 3153bd670b35SErik Nordmark */ 3154bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 3155bd670b35SErik Nordmark ire->ire_badcnt++; 3156d3d50737SRafael Vanoni ire->ire_last_badcnt = TICK_TO_SEC(ddi_get_lbolt64()); 3157bd670b35SErik Nordmark nce = ire->ire_nce_cache; 3158bd670b35SErik Nordmark if (nce != NULL && nce->nce_is_condemned && 3159bd670b35SErik Nordmark nce->nce_common->ncec_state == ND_UNREACHABLE) 3160bd670b35SErik Nordmark ire->ire_nce_cache = NULL; 3161bd670b35SErik Nordmark else 3162bd670b35SErik Nordmark nce = NULL; 3163bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3164bd670b35SErik Nordmark if (nce != NULL) 3165bd670b35SErik Nordmark nce_refrele(nce); 3166bd670b35SErik Nordmark 3167bd670b35SErik Nordmark ire_increment_generation(ire); 3168bd670b35SErik Nordmark ire_dep_incr_generation(ire); 3169bd670b35SErik Nordmark 3170bd670b35SErik Nordmark return (ire->ire_bucket->irb_ire_cnt > 1); 3171bd670b35SErik Nordmark } 3172bd670b35SErik Nordmark 3173bd670b35SErik Nordmark /* 3174bd670b35SErik Nordmark * Walk ire_dep_parent chain and validate that ire_dep_parent->ire_generation == 3175bd670b35SErik Nordmark * ire_dep_parent_generation. 3176bd670b35SErik Nordmark * If they all match we just return ire_generation from the topmost IRE. 3177bd670b35SErik Nordmark * Otherwise we propagate the mismatch by setting all ire_dep_parent_generation 3178bd670b35SErik Nordmark * above the mismatch to IRE_GENERATION_VERIFY and also returning 3179bd670b35SErik Nordmark * IRE_GENERATION_VERIFY. 3180bd670b35SErik Nordmark */ 3181bd670b35SErik Nordmark uint_t 3182bd670b35SErik Nordmark ire_dep_validate_generations(ire_t *ire) 3183bd670b35SErik Nordmark { 3184bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 3185bd670b35SErik Nordmark uint_t generation; 3186bd670b35SErik Nordmark ire_t *ire1; 3187bd670b35SErik Nordmark 3188bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 3189bd670b35SErik Nordmark generation = ire->ire_generation; /* Assuming things match */ 3190bd670b35SErik Nordmark for (ire1 = ire; ire1 != NULL; ire1 = ire1->ire_dep_parent) { 3191bd670b35SErik Nordmark ASSERT(ire1->ire_ipversion == IPV4_VERSION || 3192bd670b35SErik Nordmark ire1->ire_ipversion == IPV6_VERSION); 3193bd670b35SErik Nordmark if (ire1->ire_dep_parent == NULL) 3194bd670b35SErik Nordmark break; 3195bd670b35SErik Nordmark if (ire1->ire_dep_parent_generation != 3196bd670b35SErik Nordmark ire1->ire_dep_parent->ire_generation) 3197bd670b35SErik Nordmark goto mismatch; 3198bd670b35SErik Nordmark } 3199bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3200bd670b35SErik Nordmark return (generation); 3201bd670b35SErik Nordmark 3202bd670b35SErik Nordmark mismatch: 3203bd670b35SErik Nordmark generation = IRE_GENERATION_VERIFY; 3204bd670b35SErik Nordmark /* Fill from top down to the mismatch with _VERIFY */ 3205bd670b35SErik Nordmark while (ire != ire1) { 3206bd670b35SErik Nordmark ASSERT(ire->ire_ipversion == IPV4_VERSION || 3207bd670b35SErik Nordmark ire->ire_ipversion == IPV6_VERSION); 3208bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 3209bd670b35SErik Nordmark ire->ire_dep_parent_generation = IRE_GENERATION_VERIFY; 3210bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3211bd670b35SErik Nordmark ire = ire->ire_dep_parent; 3212bd670b35SErik Nordmark } 3213bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3214bd670b35SErik Nordmark return (generation); 3215bd670b35SErik Nordmark } 3216bd670b35SErik Nordmark 3217bd670b35SErik Nordmark /* 3218bd670b35SErik Nordmark * Used when we need to return an ire with ire_dep_parent, but we 3219bd670b35SErik Nordmark * know the chain is invalid for instance we didn't create an IRE_IF_CLONE 3220bd670b35SErik Nordmark * Using IRE_GENERATION_VERIFY means that next time we'll redo the 3221bd670b35SErik Nordmark * recursive lookup. 3222bd670b35SErik Nordmark */ 3223bd670b35SErik Nordmark void 3224bd670b35SErik Nordmark ire_dep_invalidate_generations(ire_t *ire) 3225bd670b35SErik Nordmark { 3226bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 3227bd670b35SErik Nordmark 3228bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 3229bd670b35SErik Nordmark while (ire != NULL) { 3230bd670b35SErik Nordmark ASSERT(ire->ire_ipversion == IPV4_VERSION || 3231bd670b35SErik Nordmark ire->ire_ipversion == IPV6_VERSION); 3232bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 3233bd670b35SErik Nordmark ire->ire_dep_parent_generation = IRE_GENERATION_VERIFY; 3234bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3235bd670b35SErik Nordmark ire = ire->ire_dep_parent; 3236bd670b35SErik Nordmark } 3237bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3238bd670b35SErik Nordmark } 3239bd670b35SErik Nordmark 3240bd670b35SErik Nordmark /* Set _VERIFY ire_dep_parent_generation for all children recursively */ 3241bd670b35SErik Nordmark static void 3242bd670b35SErik Nordmark ire_dep_invalidate_children(ire_t *child) 3243bd670b35SErik Nordmark { 3244bd670b35SErik Nordmark ip_stack_t *ipst = child->ire_ipst; 3245bd670b35SErik Nordmark 3246bd670b35SErik Nordmark ASSERT(RW_WRITE_HELD(&ipst->ips_ire_dep_lock)); 3247bd670b35SErik Nordmark /* Depth first */ 3248bd670b35SErik Nordmark if (child->ire_dep_children != NULL) 3249bd670b35SErik Nordmark ire_dep_invalidate_children(child->ire_dep_children); 3250bd670b35SErik Nordmark 3251bd670b35SErik Nordmark while (child != NULL) { 3252bd670b35SErik Nordmark mutex_enter(&child->ire_lock); 3253bd670b35SErik Nordmark child->ire_dep_parent_generation = IRE_GENERATION_VERIFY; 3254bd670b35SErik Nordmark mutex_exit(&child->ire_lock); 3255bd670b35SErik Nordmark child = child->ire_dep_sib_next; 3256bd670b35SErik Nordmark } 3257bd670b35SErik Nordmark } 3258bd670b35SErik Nordmark 3259bd670b35SErik Nordmark static void 3260bd670b35SErik Nordmark ire_dep_increment_children(ire_t *child) 3261bd670b35SErik Nordmark { 3262bd670b35SErik Nordmark ip_stack_t *ipst = child->ire_ipst; 3263bd670b35SErik Nordmark 3264bd670b35SErik Nordmark ASSERT(RW_READ_HELD(&ipst->ips_ire_dep_lock)); 3265bd670b35SErik Nordmark /* Depth first */ 3266bd670b35SErik Nordmark if (child->ire_dep_children != NULL) 3267bd670b35SErik Nordmark ire_dep_increment_children(child->ire_dep_children); 3268bd670b35SErik Nordmark 3269bd670b35SErik Nordmark while (child != NULL) { 3270bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(child)) 3271bd670b35SErik Nordmark ire_increment_generation(child); 3272bd670b35SErik Nordmark child = child->ire_dep_sib_next; 3273bd670b35SErik Nordmark } 3274bd670b35SErik Nordmark } 3275bd670b35SErik Nordmark 3276bd670b35SErik Nordmark /* 3277bd670b35SErik Nordmark * Walk all the children of this ire recursively and increment their 3278bd670b35SErik Nordmark * generation number. 3279bd670b35SErik Nordmark */ 3280f1c454b4SSowmini Varadhan static void 3281f1c454b4SSowmini Varadhan ire_dep_incr_generation_locked(ire_t *parent) 3282f1c454b4SSowmini Varadhan { 3283f1c454b4SSowmini Varadhan ASSERT(RW_READ_HELD(&parent->ire_ipst->ips_ire_dep_lock)); 3284f1c454b4SSowmini Varadhan if (parent->ire_dep_children != NULL) 3285f1c454b4SSowmini Varadhan ire_dep_increment_children(parent->ire_dep_children); 3286f1c454b4SSowmini Varadhan } 3287f1c454b4SSowmini Varadhan 3288bd670b35SErik Nordmark void 3289bd670b35SErik Nordmark ire_dep_incr_generation(ire_t *parent) 3290bd670b35SErik Nordmark { 3291bd670b35SErik Nordmark ip_stack_t *ipst = parent->ire_ipst; 3292bd670b35SErik Nordmark 3293bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 3294f1c454b4SSowmini Varadhan ire_dep_incr_generation_locked(parent); 3295bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3296bd670b35SErik Nordmark } 3297bd670b35SErik Nordmark 3298bd670b35SErik Nordmark /* 3299bd670b35SErik Nordmark * Get a new ire_nce_cache for this IRE as well as its nexthop. 3300bd670b35SErik Nordmark * Returns zero if it succeeds. Can fail due to lack of memory or when 3301bd670b35SErik Nordmark * the route has become unreachable. Returns ENOMEM and ENETUNREACH in those 3302bd670b35SErik Nordmark * cases. 3303bd670b35SErik Nordmark * 3304bd670b35SErik Nordmark * In the in.mpathd case, the ire will have ire_testhidden 3305bd670b35SErik Nordmark * set; so we should create the ncec for the underlying ill. 3306bd670b35SErik Nordmark * 3307bd670b35SErik Nordmark * Note that the error returned by ire_revalidate_nce() is ignored by most 3308bd670b35SErik Nordmark * callers except ire_handle_condemned_nce(), which handles the ENETUNREACH 3309bd670b35SErik Nordmark * error to mark potentially bad ire's. For all the other callers, an 3310bd670b35SErik Nordmark * error return could indicate a transient condition like ENOMEM, or could 3311bd670b35SErik Nordmark * be the result of an interface that is going down/unplumbing. In the former 3312bd670b35SErik Nordmark * case (transient error), we would leave the old stale ire/ire_nce_cache 3313bd670b35SErik Nordmark * in place, and possibly use incorrect link-layer information to send packets 3314bd670b35SErik Nordmark * but would eventually recover. In the latter case (ill down/replumb), 3315bd670b35SErik Nordmark * ire_revalidate_nce() might return a condemned nce back, but we would then 3316bd670b35SErik Nordmark * recover in the packet output path. 3317bd670b35SErik Nordmark */ 3318bd670b35SErik Nordmark int 3319bd670b35SErik Nordmark ire_revalidate_nce(ire_t *ire) 3320bd670b35SErik Nordmark { 3321bd670b35SErik Nordmark nce_t *nce, *old_nce; 3322bd670b35SErik Nordmark ire_t *nexthop; 3323bd670b35SErik Nordmark 3324bd670b35SErik Nordmark /* 3325bd670b35SErik Nordmark * For multicast we conceptually have an NCE but we don't store it 3326bd670b35SErik Nordmark * in ire_nce_cache; when ire_to_nce is called we allocate the nce. 3327bd670b35SErik Nordmark */ 3328bd670b35SErik Nordmark if (ire->ire_type & IRE_MULTICAST) 3329bd670b35SErik Nordmark return (0); 3330bd670b35SErik Nordmark 3331bd670b35SErik Nordmark /* ire_testhidden should only be set on under-interfaces */ 3332bd670b35SErik Nordmark ASSERT(!ire->ire_testhidden || !IS_IPMP(ire->ire_ill)); 3333bd670b35SErik Nordmark 3334bd670b35SErik Nordmark nexthop = ire_nexthop(ire); 3335bd670b35SErik Nordmark if (nexthop == NULL) { 3336bd670b35SErik Nordmark /* The route is potentially bad */ 3337bd670b35SErik Nordmark (void) ire_no_good(ire); 3338bd670b35SErik Nordmark return (ENETUNREACH); 3339bd670b35SErik Nordmark } 3340bd670b35SErik Nordmark if (ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) { 3341bd670b35SErik Nordmark ASSERT(ire->ire_ill != NULL); 3342bd670b35SErik Nordmark 3343bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) 3344bd670b35SErik Nordmark nce = nce_lookup_v4(ire->ire_ill, &ire->ire_addr); 3345bd670b35SErik Nordmark else 3346bd670b35SErik Nordmark nce = nce_lookup_v6(ire->ire_ill, &ire->ire_addr_v6); 3347bd670b35SErik Nordmark } else { 3348bd670b35SErik Nordmark ASSERT(nexthop->ire_type & IRE_ONLINK); 3349bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 3350bd670b35SErik Nordmark nce = arp_nce_init(nexthop->ire_ill, nexthop->ire_addr, 3351bd670b35SErik Nordmark nexthop->ire_type); 3352bd670b35SErik Nordmark } else { 3353bd670b35SErik Nordmark nce = ndp_nce_init(nexthop->ire_ill, 3354bd670b35SErik Nordmark &nexthop->ire_addr_v6, nexthop->ire_type); 3355bd670b35SErik Nordmark } 3356bd670b35SErik Nordmark } 3357bd670b35SErik Nordmark if (nce == NULL) { 3358bd670b35SErik Nordmark /* 3359bd670b35SErik Nordmark * Leave the old stale one in place to avoid a NULL 3360bd670b35SErik Nordmark * ire_nce_cache. 3361bd670b35SErik Nordmark */ 3362bd670b35SErik Nordmark ire_refrele(nexthop); 3363bd670b35SErik Nordmark return (ENOMEM); 3364bd670b35SErik Nordmark } 3365bd670b35SErik Nordmark 3366bd670b35SErik Nordmark if (nexthop != ire) { 3367bd670b35SErik Nordmark /* Update the nexthop ire */ 3368bd670b35SErik Nordmark mutex_enter(&nexthop->ire_lock); 3369bd670b35SErik Nordmark old_nce = nexthop->ire_nce_cache; 3370bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(nexthop)) { 3371bd670b35SErik Nordmark nce_refhold(nce); 3372bd670b35SErik Nordmark nexthop->ire_nce_cache = nce; 3373bd670b35SErik Nordmark } else { 3374bd670b35SErik Nordmark nexthop->ire_nce_cache = NULL; 3375bd670b35SErik Nordmark } 3376bd670b35SErik Nordmark mutex_exit(&nexthop->ire_lock); 3377bd670b35SErik Nordmark if (old_nce != NULL) 3378bd670b35SErik Nordmark nce_refrele(old_nce); 3379bd670b35SErik Nordmark } 3380bd670b35SErik Nordmark ire_refrele(nexthop); 3381bd670b35SErik Nordmark 3382bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 3383bd670b35SErik Nordmark old_nce = ire->ire_nce_cache; 3384bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(ire)) { 3385bd670b35SErik Nordmark nce_refhold(nce); 3386bd670b35SErik Nordmark ire->ire_nce_cache = nce; 3387bd670b35SErik Nordmark } else { 3388bd670b35SErik Nordmark ire->ire_nce_cache = NULL; 3389bd670b35SErik Nordmark } 3390bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3391bd670b35SErik Nordmark if (old_nce != NULL) 3392bd670b35SErik Nordmark nce_refrele(old_nce); 3393bd670b35SErik Nordmark 3394bd670b35SErik Nordmark nce_refrele(nce); 3395c793af95Ssangeeta return (0); 3396c793af95Ssangeeta } 33975b17e9bdSJon Anderson 33985b17e9bdSJon Anderson /* 3399bd670b35SErik Nordmark * Get a held nce for a given ire. 3400bd670b35SErik Nordmark * In the common case this is just from ire_nce_cache. 3401bd670b35SErik Nordmark * For IRE_MULTICAST this needs to do an explicit lookup since we do not 3402bd670b35SErik Nordmark * have an IRE_MULTICAST per address. 3403bd670b35SErik Nordmark * Note that this explicitly returns CONDEMNED NCEs. The caller needs those 3404bd670b35SErik Nordmark * so they can check whether the NCE went unreachable (as opposed to was 3405bd670b35SErik Nordmark * condemned for some other reason). 34065b17e9bdSJon Anderson */ 3407bd670b35SErik Nordmark nce_t * 3408bd670b35SErik Nordmark ire_to_nce(ire_t *ire, ipaddr_t v4nexthop, const in6_addr_t *v6nexthop) 34095b17e9bdSJon Anderson { 3410bd670b35SErik Nordmark nce_t *nce; 34115b17e9bdSJon Anderson 3412bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) 3413bd670b35SErik Nordmark return (NULL); 3414bd670b35SErik Nordmark 3415bd670b35SErik Nordmark /* ire_testhidden should only be set on under-interfaces */ 3416bd670b35SErik Nordmark ASSERT(!ire->ire_testhidden || !IS_IPMP(ire->ire_ill)); 3417bd670b35SErik Nordmark 3418bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 3419bd670b35SErik Nordmark nce = ire->ire_nce_cache; 3420bd670b35SErik Nordmark if (nce != NULL) { 3421bd670b35SErik Nordmark nce_refhold(nce); 3422bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3423bd670b35SErik Nordmark return (nce); 3424bd670b35SErik Nordmark } 3425bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3426bd670b35SErik Nordmark 3427bd670b35SErik Nordmark if (ire->ire_type & IRE_MULTICAST) { 3428bd670b35SErik Nordmark ASSERT(ire->ire_ill != NULL); 3429bd670b35SErik Nordmark 3430bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 3431bd670b35SErik Nordmark ASSERT(v6nexthop == NULL); 3432bd670b35SErik Nordmark 3433bd670b35SErik Nordmark nce = arp_nce_init(ire->ire_ill, v4nexthop, 3434bd670b35SErik Nordmark ire->ire_type); 3435bd670b35SErik Nordmark } else { 3436bd670b35SErik Nordmark ASSERT(v6nexthop != NULL); 3437bd670b35SErik Nordmark ASSERT(v4nexthop == 0); 3438bd670b35SErik Nordmark nce = ndp_nce_init(ire->ire_ill, v6nexthop, 3439bd670b35SErik Nordmark ire->ire_type); 3440bd670b35SErik Nordmark } 3441bd670b35SErik Nordmark return (nce); 3442bd670b35SErik Nordmark } 34435b17e9bdSJon Anderson return (NULL); 34445b17e9bdSJon Anderson } 34455b17e9bdSJon Anderson 3446bd670b35SErik Nordmark nce_t * 3447bd670b35SErik Nordmark ire_to_nce_pkt(ire_t *ire, mblk_t *mp) 3448bd670b35SErik Nordmark { 3449bd670b35SErik Nordmark ipha_t *ipha; 3450bd670b35SErik Nordmark ip6_t *ip6h; 34515b17e9bdSJon Anderson 3452bd670b35SErik Nordmark if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 3453bd670b35SErik Nordmark ipha = (ipha_t *)mp->b_rptr; 3454bd670b35SErik Nordmark return (ire_to_nce(ire, ipha->ipha_dst, NULL)); 3455bd670b35SErik Nordmark } else { 3456bd670b35SErik Nordmark ip6h = (ip6_t *)mp->b_rptr; 3457bd670b35SErik Nordmark return (ire_to_nce(ire, INADDR_ANY, &ip6h->ip6_dst)); 3458bd670b35SErik Nordmark } 34595b17e9bdSJon Anderson } 34605b17e9bdSJon Anderson 34615b17e9bdSJon Anderson /* 3462bd670b35SErik Nordmark * Given an IRE_INTERFACE (that matches more than one address) create 3463bd670b35SErik Nordmark * and return an IRE_IF_CLONE for the specific address. 3464bd670b35SErik Nordmark * Return the generation number. 3465bd670b35SErik Nordmark * Returns NULL is no memory for the IRE. 3466bd670b35SErik Nordmark * Handles both IPv4 and IPv6. 3467*53287767SSowmini Varadhan * 3468*53287767SSowmini Varadhan * IRE_IF_CLONE entries may only be created adn added by calling 3469*53287767SSowmini Varadhan * ire_create_if_clone(), and we depend on the fact that ire_add will 3470*53287767SSowmini Varadhan * atomically ensure that attempts to add multiple identical IRE_IF_CLONE 3471*53287767SSowmini Varadhan * entries will not result in duplicate (i.e., ire_identical_ref > 1) 3472*53287767SSowmini Varadhan * CLONE entries, so that a single ire_delete is sufficient to remove the 3473*53287767SSowmini Varadhan * CLONE. 34745b17e9bdSJon Anderson */ 34755b17e9bdSJon Anderson ire_t * 3476bd670b35SErik Nordmark ire_create_if_clone(ire_t *ire_if, const in6_addr_t *addr, uint_t *generationp) 34775b17e9bdSJon Anderson { 3478bd670b35SErik Nordmark ire_t *ire; 3479bd670b35SErik Nordmark ire_t *nire; 34805b17e9bdSJon Anderson 3481bd670b35SErik Nordmark if (ire_if->ire_ipversion == IPV4_VERSION) { 3482bd670b35SErik Nordmark ipaddr_t v4addr; 3483bd670b35SErik Nordmark ipaddr_t mask = IP_HOST_MASK; 34845b17e9bdSJon Anderson 3485bd670b35SErik Nordmark ASSERT(IN6_IS_ADDR_V4MAPPED(addr)); 3486bd670b35SErik Nordmark IN6_V4MAPPED_TO_IPADDR(addr, v4addr); 3487bd670b35SErik Nordmark 3488bd670b35SErik Nordmark ire = ire_create( 3489bd670b35SErik Nordmark (uchar_t *)&v4addr, /* dest address */ 3490bd670b35SErik Nordmark (uchar_t *)&mask, /* mask */ 3491bd670b35SErik Nordmark (uchar_t *)&ire_if->ire_gateway_addr, 3492bd670b35SErik Nordmark IRE_IF_CLONE, /* IRE type */ 3493bd670b35SErik Nordmark ire_if->ire_ill, 3494bd670b35SErik Nordmark ire_if->ire_zoneid, 3495bd670b35SErik Nordmark ire_if->ire_flags | RTF_HOST, 3496bd670b35SErik Nordmark NULL, /* No security attr for IRE_IF_ALL */ 3497bd670b35SErik Nordmark ire_if->ire_ipst); 3498bd670b35SErik Nordmark } else { 3499bd670b35SErik Nordmark ASSERT(!IN6_IS_ADDR_V4MAPPED(addr)); 3500bd670b35SErik Nordmark ire = ire_create_v6( 3501bd670b35SErik Nordmark addr, /* dest address */ 3502bd670b35SErik Nordmark &ipv6_all_ones, /* mask */ 3503bd670b35SErik Nordmark &ire_if->ire_gateway_addr_v6, /* gateway addr */ 3504bd670b35SErik Nordmark IRE_IF_CLONE, /* IRE type */ 3505bd670b35SErik Nordmark ire_if->ire_ill, 3506bd670b35SErik Nordmark ire_if->ire_zoneid, 3507bd670b35SErik Nordmark ire_if->ire_flags | RTF_HOST, 3508bd670b35SErik Nordmark NULL, /* No security attr for IRE_IF_ALL */ 3509bd670b35SErik Nordmark ire_if->ire_ipst); 3510bd670b35SErik Nordmark } 3511bd670b35SErik Nordmark if (ire == NULL) 3512bd670b35SErik Nordmark return (NULL); 3513bd670b35SErik Nordmark 3514bd670b35SErik Nordmark /* Take the metrics, in particular the mtu, from the IRE_IF */ 3515bd670b35SErik Nordmark ire->ire_metrics = ire_if->ire_metrics; 3516bd670b35SErik Nordmark 3517bd670b35SErik Nordmark nire = ire_add(ire); 3518bd670b35SErik Nordmark if (nire == NULL) /* Some failure */ 3519bd670b35SErik Nordmark return (NULL); 3520bd670b35SErik Nordmark 3521bd670b35SErik Nordmark if (generationp != NULL) 3522bd670b35SErik Nordmark *generationp = nire->ire_generation; 3523bd670b35SErik Nordmark 3524bd670b35SErik Nordmark return (nire); 3525bd670b35SErik Nordmark } 3526bd670b35SErik Nordmark 3527bd670b35SErik Nordmark /* 3528bd670b35SErik Nordmark * The argument is an IRE_INTERFACE. Delete all of IRE_IF_CLONE in the 3529bd670b35SErik Nordmark * ire_dep_children (just walk the ire_dep_sib_next since they are all 3530bd670b35SErik Nordmark * immediate children.) 3531bd670b35SErik Nordmark * Since we hold a lock while we remove them we need to defer the actual 3532bd670b35SErik Nordmark * calls to ire_delete() until we have dropped the lock. This makes things 3533bd670b35SErik Nordmark * less efficient since we restart at the top after dropping the lock. But 3534bd670b35SErik Nordmark * we only run when an IRE_INTERFACE is deleted which is infrquent. 3535bd670b35SErik Nordmark * 3536bd670b35SErik Nordmark * Note that ire_dep_children can be any mixture of offlink routes and 3537bd670b35SErik Nordmark * IRE_IF_CLONE entries. 3538bd670b35SErik Nordmark */ 3539bd670b35SErik Nordmark void 3540bd670b35SErik Nordmark ire_dep_delete_if_clone(ire_t *parent) 3541bd670b35SErik Nordmark { 3542bd670b35SErik Nordmark ip_stack_t *ipst = parent->ire_ipst; 3543bd670b35SErik Nordmark ire_t *child, *next; 3544bd670b35SErik Nordmark 3545bd670b35SErik Nordmark restart: 3546bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 3547bd670b35SErik Nordmark if (parent->ire_dep_children == NULL) { 3548bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3549bd670b35SErik Nordmark return; 3550bd670b35SErik Nordmark } 3551bd670b35SErik Nordmark child = parent->ire_dep_children; 3552bd670b35SErik Nordmark while (child != NULL) { 3553bd670b35SErik Nordmark next = child->ire_dep_sib_next; 3554bd670b35SErik Nordmark if ((child->ire_type & IRE_IF_CLONE) && 3555bd670b35SErik Nordmark !IRE_IS_CONDEMNED(child)) { 3556bd670b35SErik Nordmark ire_refhold(child); 3557bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3558bd670b35SErik Nordmark ire_delete(child); 3559bd670b35SErik Nordmark ASSERT(IRE_IS_CONDEMNED(child)); 3560bd670b35SErik Nordmark ire_refrele(child); 3561bd670b35SErik Nordmark goto restart; 3562bd670b35SErik Nordmark } 3563bd670b35SErik Nordmark child = next; 3564bd670b35SErik Nordmark } 3565bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3566bd670b35SErik Nordmark } 3567bd670b35SErik Nordmark 3568bd670b35SErik Nordmark /* 356944b099c4SSowmini Varadhan * In the preferred/strict src multihoming modes, unbound routes (i.e., 357044b099c4SSowmini Varadhan * ire_t entries with ire_unbound set to B_TRUE) are bound to an interface 357144b099c4SSowmini Varadhan * by selecting the first available interface that has an interface route for 357244b099c4SSowmini Varadhan * the ire_gateway. If that interface is subsequently brought down, ill_downi() 357344b099c4SSowmini Varadhan * will call ire_rebind() so that the unbound route can be bound to some other 357444b099c4SSowmini Varadhan * matching interface thereby preserving the intended reachability information 357544b099c4SSowmini Varadhan * from the original unbound route. 357644b099c4SSowmini Varadhan */ 357744b099c4SSowmini Varadhan void 357844b099c4SSowmini Varadhan ire_rebind(ire_t *ire) 357944b099c4SSowmini Varadhan { 358044b099c4SSowmini Varadhan ire_t *gw_ire, *new_ire; 358144b099c4SSowmini Varadhan int match_flags = MATCH_IRE_TYPE; 358244b099c4SSowmini Varadhan ill_t *gw_ill; 358344b099c4SSowmini Varadhan boolean_t isv6 = (ire->ire_ipversion == IPV6_VERSION); 358444b099c4SSowmini Varadhan ip_stack_t *ipst = ire->ire_ipst; 358544b099c4SSowmini Varadhan 358644b099c4SSowmini Varadhan ASSERT(ire->ire_unbound); 358744b099c4SSowmini Varadhan again: 358844b099c4SSowmini Varadhan if (isv6) { 358944b099c4SSowmini Varadhan gw_ire = ire_ftable_lookup_v6(&ire->ire_gateway_addr_v6, 0, 0, 359044b099c4SSowmini Varadhan IRE_INTERFACE, NULL, ALL_ZONES, NULL, match_flags, 0, 359144b099c4SSowmini Varadhan ipst, NULL); 359244b099c4SSowmini Varadhan } else { 359344b099c4SSowmini Varadhan gw_ire = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0, 359444b099c4SSowmini Varadhan IRE_INTERFACE, NULL, ALL_ZONES, NULL, match_flags, 0, 359544b099c4SSowmini Varadhan ipst, NULL); 359644b099c4SSowmini Varadhan } 359744b099c4SSowmini Varadhan if (gw_ire == NULL) { 359844b099c4SSowmini Varadhan /* see comments in ip_rt_add[_v6]() for IPMP */ 359944b099c4SSowmini Varadhan if (match_flags & MATCH_IRE_TESTHIDDEN) 360044b099c4SSowmini Varadhan return; 360144b099c4SSowmini Varadhan 360244b099c4SSowmini Varadhan match_flags |= MATCH_IRE_TESTHIDDEN; 360344b099c4SSowmini Varadhan goto again; 360444b099c4SSowmini Varadhan } 360544b099c4SSowmini Varadhan gw_ill = gw_ire->ire_ill; 360644b099c4SSowmini Varadhan if (isv6) { 360744b099c4SSowmini Varadhan new_ire = ire_create_v6(&ire->ire_addr_v6, &ire->ire_mask_v6, 360844b099c4SSowmini Varadhan &ire->ire_gateway_addr_v6, ire->ire_type, gw_ill, 360944b099c4SSowmini Varadhan ire->ire_zoneid, ire->ire_flags, NULL, ipst); 361044b099c4SSowmini Varadhan } else { 361144b099c4SSowmini Varadhan new_ire = ire_create((uchar_t *)&ire->ire_addr, 361244b099c4SSowmini Varadhan (uchar_t *)&ire->ire_mask, 361344b099c4SSowmini Varadhan (uchar_t *)&ire->ire_gateway_addr, ire->ire_type, gw_ill, 361444b099c4SSowmini Varadhan ire->ire_zoneid, ire->ire_flags, NULL, ipst); 361544b099c4SSowmini Varadhan } 361644b099c4SSowmini Varadhan ire_refrele(gw_ire); 361744b099c4SSowmini Varadhan if (new_ire == NULL) 361844b099c4SSowmini Varadhan return; 361944b099c4SSowmini Varadhan new_ire->ire_unbound = B_TRUE; 362044b099c4SSowmini Varadhan new_ire = ire_add(new_ire); 362144b099c4SSowmini Varadhan if (new_ire != NULL) 362244b099c4SSowmini Varadhan ire_refrele(new_ire); 362344b099c4SSowmini Varadhan } 3624