17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 545916cd2Sjpk * Common Development and Distribution License (the "License"). 645916cd2Sjpk * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22e11c3f44Smeem * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate /* Copyright (c) 1990 Mentat Inc. */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate /* 287c478bd9Sstevel@tonic-gate * This file contains routines that manipulate Internet Routing Entries (IREs). 297c478bd9Sstevel@tonic-gate */ 307c478bd9Sstevel@tonic-gate 317c478bd9Sstevel@tonic-gate #include <sys/types.h> 327c478bd9Sstevel@tonic-gate #include <sys/stream.h> 337c478bd9Sstevel@tonic-gate #include <sys/stropts.h> 34e11c3f44Smeem #include <sys/strsun.h> 35de8c4a14SErik Nordmark #include <sys/strsubr.h> 367c478bd9Sstevel@tonic-gate #include <sys/ddi.h> 377c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h> 387c478bd9Sstevel@tonic-gate #include <sys/policy.h> 397c478bd9Sstevel@tonic-gate 407c478bd9Sstevel@tonic-gate #include <sys/systm.h> 417c478bd9Sstevel@tonic-gate #include <sys/kmem.h> 427c478bd9Sstevel@tonic-gate #include <sys/param.h> 437c478bd9Sstevel@tonic-gate #include <sys/socket.h> 447c478bd9Sstevel@tonic-gate #include <net/if.h> 457c478bd9Sstevel@tonic-gate #include <net/route.h> 467c478bd9Sstevel@tonic-gate #include <netinet/in.h> 477c478bd9Sstevel@tonic-gate #include <net/if_dl.h> 487c478bd9Sstevel@tonic-gate #include <netinet/ip6.h> 497c478bd9Sstevel@tonic-gate #include <netinet/icmp6.h> 507c478bd9Sstevel@tonic-gate 517c478bd9Sstevel@tonic-gate #include <inet/common.h> 527c478bd9Sstevel@tonic-gate #include <inet/mi.h> 537c478bd9Sstevel@tonic-gate #include <inet/ip.h> 547c478bd9Sstevel@tonic-gate #include <inet/ip6.h> 557c478bd9Sstevel@tonic-gate #include <inet/ip_ndp.h> 56c793af95Ssangeeta #include <inet/arp.h> 577c478bd9Sstevel@tonic-gate #include <inet/ip_if.h> 587c478bd9Sstevel@tonic-gate #include <inet/ip_ire.h> 59c793af95Ssangeeta #include <inet/ip_ftable.h> 607c478bd9Sstevel@tonic-gate #include <inet/ip_rts.h> 617c478bd9Sstevel@tonic-gate #include <inet/nd.h> 627c478bd9Sstevel@tonic-gate 637c478bd9Sstevel@tonic-gate #include <net/pfkeyv2.h> 647c478bd9Sstevel@tonic-gate #include <inet/ipsec_info.h> 657c478bd9Sstevel@tonic-gate #include <inet/sadb.h> 667c478bd9Sstevel@tonic-gate #include <inet/tcp.h> 677c478bd9Sstevel@tonic-gate #include <inet/ipclassifier.h> 687c478bd9Sstevel@tonic-gate #include <sys/zone.h> 69f4b3ec61Sdh155122 #include <sys/cpuvar.h> 70f4b3ec61Sdh155122 7145916cd2Sjpk #include <sys/tsol/label.h> 7245916cd2Sjpk #include <sys/tsol/tnet.h> 7345916cd2Sjpk 74c793af95Ssangeeta struct kmem_cache *rt_entry_cache; 75c793af95Ssangeeta 767c478bd9Sstevel@tonic-gate /* 777c478bd9Sstevel@tonic-gate * Synchronization notes: 787c478bd9Sstevel@tonic-gate * 797c478bd9Sstevel@tonic-gate * The fields of the ire_t struct are protected in the following way : 807c478bd9Sstevel@tonic-gate * 817c478bd9Sstevel@tonic-gate * ire_next/ire_ptpn 827c478bd9Sstevel@tonic-gate * 837c478bd9Sstevel@tonic-gate * - bucket lock of the respective tables (cache or forwarding tables). 847c478bd9Sstevel@tonic-gate * 857c478bd9Sstevel@tonic-gate * ire_mp, ire_rfq, ire_stq, ire_u *except* ire_gateway_addr[v6], ire_mask, 867c478bd9Sstevel@tonic-gate * ire_type, ire_create_time, ire_masklen, ire_ipversion, ire_flags, ire_ipif, 877c478bd9Sstevel@tonic-gate * ire_ihandle, ire_phandle, ire_nce, ire_bucket, ire_in_ill, ire_in_src_addr 887c478bd9Sstevel@tonic-gate * 897c478bd9Sstevel@tonic-gate * - Set in ire_create_v4/v6 and never changes after that. Thus, 907c478bd9Sstevel@tonic-gate * we don't need a lock whenever these fields are accessed. 917c478bd9Sstevel@tonic-gate * 927c478bd9Sstevel@tonic-gate * - ire_bucket and ire_masklen (also set in ire_create) is set in 937c478bd9Sstevel@tonic-gate * ire_add_v4/ire_add_v6 before inserting in the bucket and never 947c478bd9Sstevel@tonic-gate * changes after that. Thus we don't need a lock whenever these 957c478bd9Sstevel@tonic-gate * fields are accessed. 967c478bd9Sstevel@tonic-gate * 977c478bd9Sstevel@tonic-gate * ire_gateway_addr_v4[v6] 987c478bd9Sstevel@tonic-gate * 997c478bd9Sstevel@tonic-gate * - ire_gateway_addr_v4[v6] is set during ire_create and later modified 1007c478bd9Sstevel@tonic-gate * by rts_setgwr[v6]. As ire_gateway_addr is a uint32_t, updates to 1017c478bd9Sstevel@tonic-gate * it assumed to be atomic and hence the other parts of the code 1027c478bd9Sstevel@tonic-gate * does not use any locks. ire_gateway_addr_v6 updates are not atomic 1037c478bd9Sstevel@tonic-gate * and hence any access to it uses ire_lock to get/set the right value. 1047c478bd9Sstevel@tonic-gate * 1057c478bd9Sstevel@tonic-gate * ire_ident, ire_refcnt 1067c478bd9Sstevel@tonic-gate * 1077c478bd9Sstevel@tonic-gate * - Updated atomically using atomic_add_32 1087c478bd9Sstevel@tonic-gate * 1097c478bd9Sstevel@tonic-gate * ire_ssthresh, ire_rtt_sd, ire_rtt, ire_ib_pkt_count, ire_ob_pkt_count 1107c478bd9Sstevel@tonic-gate * 1117c478bd9Sstevel@tonic-gate * - Assumes that 32 bit writes are atomic. No locks. ire_lock is 1127c478bd9Sstevel@tonic-gate * used to serialize updates to ire_ssthresh, ire_rtt_sd, ire_rtt. 1137c478bd9Sstevel@tonic-gate * 1147c478bd9Sstevel@tonic-gate * ire_max_frag, ire_frag_flag 1157c478bd9Sstevel@tonic-gate * 1167c478bd9Sstevel@tonic-gate * - ire_lock is used to set/read both of them together. 1177c478bd9Sstevel@tonic-gate * 1187c478bd9Sstevel@tonic-gate * ire_tire_mark 1197c478bd9Sstevel@tonic-gate * 1207c478bd9Sstevel@tonic-gate * - Set in ire_create and updated in ire_expire, which is called 1217c478bd9Sstevel@tonic-gate * by only one function namely ip_trash_timer_expire. Thus only 1227c478bd9Sstevel@tonic-gate * one function updates and examines the value. 1237c478bd9Sstevel@tonic-gate * 1247c478bd9Sstevel@tonic-gate * ire_marks 1257c478bd9Sstevel@tonic-gate * - bucket lock protects this. 1267c478bd9Sstevel@tonic-gate * 1277c478bd9Sstevel@tonic-gate * ire_ipsec_overhead/ire_ll_hdr_length 1287c478bd9Sstevel@tonic-gate * 1297c478bd9Sstevel@tonic-gate * - Place holder for returning the information to the upper layers 1307c478bd9Sstevel@tonic-gate * when IRE_DB_REQ comes down. 1317c478bd9Sstevel@tonic-gate * 1327c478bd9Sstevel@tonic-gate * 1337c478bd9Sstevel@tonic-gate * ipv6_ire_default_count is protected by the bucket lock of 1347c478bd9Sstevel@tonic-gate * ip_forwarding_table_v6[0][0]. 1357c478bd9Sstevel@tonic-gate * 136c793af95Ssangeeta * ipv6_ire_default_index is not protected as it is just a hint 137c793af95Ssangeeta * at which default gateway to use. There is nothing 1387c478bd9Sstevel@tonic-gate * wrong in using the same gateway for two different connections. 1397c478bd9Sstevel@tonic-gate * 1407c478bd9Sstevel@tonic-gate * As we always hold the bucket locks in all the places while accessing 1417c478bd9Sstevel@tonic-gate * the above values, it is natural to use them for protecting them. 1427c478bd9Sstevel@tonic-gate * 1437c478bd9Sstevel@tonic-gate * We have a separate cache table and forwarding table for IPv4 and IPv6. 1447c478bd9Sstevel@tonic-gate * Cache table (ip_cache_table/ip_cache_table_v6) is a pointer to an 145219e6466Ssowmini * array of irb_t structures. The IPv6 forwarding table 146219e6466Ssowmini * (ip_forwarding_table_v6) is an array of pointers to arrays of irb_t 147f4b3ec61Sdh155122 * structure. ip_forwarding_table_v6 is allocated dynamically in 148f4b3ec61Sdh155122 * ire_add_v6. ire_ft_init_lock is used to serialize multiple threads 1497c478bd9Sstevel@tonic-gate * initializing the same bucket. Once a bucket is initialized, it is never 150f4b3ec61Sdh155122 * de-alloacted. This assumption enables us to access 151f4b3ec61Sdh155122 * ip_forwarding_table_v6[i] without any locks. 1527c478bd9Sstevel@tonic-gate * 153219e6466Ssowmini * The forwarding table for IPv4 is a radix tree whose leaves 154219e6466Ssowmini * are rt_entry structures containing the irb_t for the rt_dst. The irb_t 155219e6466Ssowmini * for IPv4 is dynamically allocated and freed. 156219e6466Ssowmini * 1577c478bd9Sstevel@tonic-gate * Each irb_t - ire bucket structure has a lock to protect 1587c478bd9Sstevel@tonic-gate * a bucket and the ires residing in the bucket have a back pointer to 1597c478bd9Sstevel@tonic-gate * the bucket structure. It also has a reference count for the number 1607c478bd9Sstevel@tonic-gate * of threads walking the bucket - irb_refcnt which is bumped up 1617c478bd9Sstevel@tonic-gate * using the macro IRB_REFHOLD macro. The flags irb_flags can be 1627c478bd9Sstevel@tonic-gate * set to IRE_MARK_CONDEMNED indicating that there are some ires 1637c478bd9Sstevel@tonic-gate * in this bucket that are marked with IRE_MARK_CONDEMNED and the 1647c478bd9Sstevel@tonic-gate * last thread to leave the bucket should delete the ires. Usually 1657c478bd9Sstevel@tonic-gate * this is done by the IRB_REFRELE macro which is used to decrement 166219e6466Ssowmini * the reference count on a bucket. See comments above irb_t structure 167219e6466Ssowmini * definition in ip.h for further details. 1687c478bd9Sstevel@tonic-gate * 1697c478bd9Sstevel@tonic-gate * IRE_REFHOLD/IRE_REFRELE macros operate on the ire which increments/ 1707c478bd9Sstevel@tonic-gate * decrements the reference count, ire_refcnt, atomically on the ire. 1717c478bd9Sstevel@tonic-gate * ire_refcnt is modified only using this macro. Operations on the IRE 1727c478bd9Sstevel@tonic-gate * could be described as follows : 1737c478bd9Sstevel@tonic-gate * 1747c478bd9Sstevel@tonic-gate * CREATE an ire with reference count initialized to 1. 1757c478bd9Sstevel@tonic-gate * 1767c478bd9Sstevel@tonic-gate * ADDITION of an ire holds the bucket lock, checks for duplicates 1777c478bd9Sstevel@tonic-gate * and then adds the ire. ire_add_v4/ire_add_v6 returns the ire after 1787c478bd9Sstevel@tonic-gate * bumping up once more i.e the reference count is 2. This is to avoid 1797c478bd9Sstevel@tonic-gate * an extra lookup in the functions calling ire_add which wants to 1807c478bd9Sstevel@tonic-gate * work with the ire after adding. 1817c478bd9Sstevel@tonic-gate * 1827c478bd9Sstevel@tonic-gate * LOOKUP of an ire bumps up the reference count using IRE_REFHOLD 1837c478bd9Sstevel@tonic-gate * macro. It is valid to bump up the referece count of the IRE, 1847c478bd9Sstevel@tonic-gate * after the lookup has returned an ire. Following are the lookup 1857c478bd9Sstevel@tonic-gate * functions that return an HELD ire : 1867c478bd9Sstevel@tonic-gate * 1877c478bd9Sstevel@tonic-gate * ire_lookup_local[_v6], ire_ctable_lookup[_v6], ire_ftable_lookup[_v6], 1887c478bd9Sstevel@tonic-gate * ire_cache_lookup[_v6], ire_lookup_multi[_v6], ire_route_lookup[_v6], 1895c0b7edeSseb * ipif_to_ire[_v6]. 1907c478bd9Sstevel@tonic-gate * 1917c478bd9Sstevel@tonic-gate * DELETION of an ire holds the bucket lock, removes it from the list 1927c478bd9Sstevel@tonic-gate * and then decrements the reference count for having removed from the list 1937c478bd9Sstevel@tonic-gate * by using the IRE_REFRELE macro. If some other thread has looked up 1947c478bd9Sstevel@tonic-gate * the ire, the reference count would have been bumped up and hence 1957c478bd9Sstevel@tonic-gate * this ire will not be freed once deleted. It will be freed once the 1967c478bd9Sstevel@tonic-gate * reference count drops to zero. 1977c478bd9Sstevel@tonic-gate * 1987c478bd9Sstevel@tonic-gate * Add and Delete acquires the bucket lock as RW_WRITER, while all the 1997c478bd9Sstevel@tonic-gate * lookups acquire the bucket lock as RW_READER. 2007c478bd9Sstevel@tonic-gate * 2017c478bd9Sstevel@tonic-gate * NOTE : The only functions that does the IRE_REFRELE when an ire is 2027c478bd9Sstevel@tonic-gate * passed as an argument are : 2037c478bd9Sstevel@tonic-gate * 2047c478bd9Sstevel@tonic-gate * 1) ip_wput_ire : This is because it IRE_REFHOLD/RELEs the 2057c478bd9Sstevel@tonic-gate * broadcast ires it looks up internally within 2067c478bd9Sstevel@tonic-gate * the function. Currently, for simplicity it does 2077c478bd9Sstevel@tonic-gate * not differentiate the one that is passed in and 2087c478bd9Sstevel@tonic-gate * the ones it looks up internally. It always 2097c478bd9Sstevel@tonic-gate * IRE_REFRELEs. 2107c478bd9Sstevel@tonic-gate * 2) ire_send 2117c478bd9Sstevel@tonic-gate * ire_send_v6 : As ire_send calls ip_wput_ire and other functions 2127c478bd9Sstevel@tonic-gate * that take ire as an argument, it has to selectively 2137c478bd9Sstevel@tonic-gate * IRE_REFRELE the ire. To maintain symmetry, 2147c478bd9Sstevel@tonic-gate * ire_send_v6 does the same. 2157c478bd9Sstevel@tonic-gate * 2167c478bd9Sstevel@tonic-gate * Otherwise, the general rule is to do the IRE_REFRELE in the function 2177c478bd9Sstevel@tonic-gate * that is passing the ire as an argument. 2187c478bd9Sstevel@tonic-gate * 2197c478bd9Sstevel@tonic-gate * In trying to locate ires the following points are to be noted. 2207c478bd9Sstevel@tonic-gate * 2217c478bd9Sstevel@tonic-gate * IRE_MARK_CONDEMNED signifies that the ire has been logically deleted and is 2227c478bd9Sstevel@tonic-gate * to be ignored when walking the ires using ire_next. 2237c478bd9Sstevel@tonic-gate * 2247c478bd9Sstevel@tonic-gate * Zones note: 2257c478bd9Sstevel@tonic-gate * Walking IREs within a given zone also walks certain ires in other 2267c478bd9Sstevel@tonic-gate * zones. This is done intentionally. IRE walks with a specified 2277c478bd9Sstevel@tonic-gate * zoneid are used only when doing informational reports, and 2287c478bd9Sstevel@tonic-gate * zone users want to see things that they can access. See block 2297c478bd9Sstevel@tonic-gate * comment in ire_walk_ill_match(). 2307c478bd9Sstevel@tonic-gate */ 2317c478bd9Sstevel@tonic-gate 2327c478bd9Sstevel@tonic-gate /* 2337c478bd9Sstevel@tonic-gate * The minimum size of IRE cache table. It will be recalcuated in 2347c478bd9Sstevel@tonic-gate * ip_ire_init(). 235f4b3ec61Sdh155122 * Setable in /etc/system 2367c478bd9Sstevel@tonic-gate */ 2377c478bd9Sstevel@tonic-gate uint32_t ip_cache_table_size = IP_CACHE_TABLE_SIZE; 2387c478bd9Sstevel@tonic-gate uint32_t ip6_cache_table_size = IP6_CACHE_TABLE_SIZE; 2397c478bd9Sstevel@tonic-gate 2407c478bd9Sstevel@tonic-gate /* 2417c478bd9Sstevel@tonic-gate * The size of the forwarding table. We will make sure that it is a 2427c478bd9Sstevel@tonic-gate * power of 2 in ip_ire_init(). 243f4b3ec61Sdh155122 * Setable in /etc/system 2447c478bd9Sstevel@tonic-gate */ 2457c478bd9Sstevel@tonic-gate uint32_t ip6_ftable_hash_size = IP6_FTABLE_HASH_SIZE; 2467c478bd9Sstevel@tonic-gate 2477c478bd9Sstevel@tonic-gate struct kmem_cache *ire_cache; 2487c478bd9Sstevel@tonic-gate static ire_t ire_null; 2497c478bd9Sstevel@tonic-gate 2507c478bd9Sstevel@tonic-gate /* 2517c478bd9Sstevel@tonic-gate * The threshold number of IRE in a bucket when the IREs are 2527c478bd9Sstevel@tonic-gate * cleaned up. This threshold is calculated later in ip_open() 2537c478bd9Sstevel@tonic-gate * based on the speed of CPU and available memory. This default 2547c478bd9Sstevel@tonic-gate * value is the maximum. 2557c478bd9Sstevel@tonic-gate * 2567c478bd9Sstevel@tonic-gate * We have two kinds of cached IRE, temporary and 2577c478bd9Sstevel@tonic-gate * non-temporary. Temporary IREs are marked with 2587c478bd9Sstevel@tonic-gate * IRE_MARK_TEMPORARY. They are IREs created for non 2597c478bd9Sstevel@tonic-gate * TCP traffic and for forwarding purposes. All others 2607c478bd9Sstevel@tonic-gate * are non-temporary IREs. We don't mark IRE created for 2617c478bd9Sstevel@tonic-gate * TCP as temporary because TCP is stateful and there are 2627c478bd9Sstevel@tonic-gate * info stored in the IRE which can be shared by other TCP 2637c478bd9Sstevel@tonic-gate * connections to the same destination. For connected 2647c478bd9Sstevel@tonic-gate * endpoint, we also don't want to mark the IRE used as 2657c478bd9Sstevel@tonic-gate * temporary because the same IRE will be used frequently, 2667c478bd9Sstevel@tonic-gate * otherwise, the app should not do a connect(). We change 2677c478bd9Sstevel@tonic-gate * the marking at ip_bind_connected_*() if necessary. 2687c478bd9Sstevel@tonic-gate * 2697c478bd9Sstevel@tonic-gate * We want to keep the cache IRE hash bucket length reasonably 2707c478bd9Sstevel@tonic-gate * short, otherwise IRE lookup functions will take "forever." 2717c478bd9Sstevel@tonic-gate * We use the "crude" function that the IRE bucket 2727c478bd9Sstevel@tonic-gate * length should be based on the CPU speed, which is 1 entry 2737c478bd9Sstevel@tonic-gate * per x MHz, depending on the shift factor ip_ire_cpu_ratio 2747c478bd9Sstevel@tonic-gate * (n). This means that with a 750MHz CPU, the max bucket 2757c478bd9Sstevel@tonic-gate * length can be (750 >> n) entries. 2767c478bd9Sstevel@tonic-gate * 2777c478bd9Sstevel@tonic-gate * Note that this threshold is separate for temp and non-temp 2787c478bd9Sstevel@tonic-gate * IREs. This means that the actual bucket length can be 2797c478bd9Sstevel@tonic-gate * twice as that. And while we try to keep temporary IRE 2807c478bd9Sstevel@tonic-gate * length at most at the threshold value, we do not attempt to 2817c478bd9Sstevel@tonic-gate * make the length for non-temporary IREs fixed, for the 2827c478bd9Sstevel@tonic-gate * reason stated above. Instead, we start trying to find 2837c478bd9Sstevel@tonic-gate * "unused" non-temporary IREs when the bucket length reaches 2847c478bd9Sstevel@tonic-gate * this threshold and clean them up. 2857c478bd9Sstevel@tonic-gate * 2867c478bd9Sstevel@tonic-gate * We also want to limit the amount of memory used by 2877c478bd9Sstevel@tonic-gate * IREs. So if we are allowed to use ~3% of memory (M) 2887c478bd9Sstevel@tonic-gate * for those IREs, each bucket should not have more than 2897c478bd9Sstevel@tonic-gate * 2907c478bd9Sstevel@tonic-gate * M / num of cache bucket / sizeof (ire_t) 2917c478bd9Sstevel@tonic-gate * 2927c478bd9Sstevel@tonic-gate * Again the above memory uses are separate for temp and 2937c478bd9Sstevel@tonic-gate * non-temp cached IREs. 2947c478bd9Sstevel@tonic-gate * 2957c478bd9Sstevel@tonic-gate * We may also want the limit to be a function of the number 2967c478bd9Sstevel@tonic-gate * of interfaces and number of CPUs. Doing the initialization 2977c478bd9Sstevel@tonic-gate * in ip_open() means that every time an interface is plumbed, 2987c478bd9Sstevel@tonic-gate * the max is re-calculated. Right now, we don't do anything 2997c478bd9Sstevel@tonic-gate * different. In future, when we have more experience, we 3007c478bd9Sstevel@tonic-gate * may want to change this behavior. 3017c478bd9Sstevel@tonic-gate */ 302f4b3ec61Sdh155122 uint32_t ip_ire_max_bucket_cnt = 10; /* Setable in /etc/system */ 3037c478bd9Sstevel@tonic-gate uint32_t ip6_ire_max_bucket_cnt = 10; 3049a09d68dSja97890 uint32_t ip_ire_cleanup_cnt = 2; 3057c478bd9Sstevel@tonic-gate 3067c478bd9Sstevel@tonic-gate /* 3077c478bd9Sstevel@tonic-gate * The minimum of the temporary IRE bucket count. We do not want 3087c478bd9Sstevel@tonic-gate * the length of each bucket to be too short. This may hurt 3097c478bd9Sstevel@tonic-gate * performance of some apps as the temporary IREs are removed too 3107c478bd9Sstevel@tonic-gate * often. 3117c478bd9Sstevel@tonic-gate */ 312f4b3ec61Sdh155122 uint32_t ip_ire_min_bucket_cnt = 3; /* /etc/system - not used */ 3137c478bd9Sstevel@tonic-gate uint32_t ip6_ire_min_bucket_cnt = 3; 3147c478bd9Sstevel@tonic-gate 3157c478bd9Sstevel@tonic-gate /* 3167c478bd9Sstevel@tonic-gate * The ratio of memory consumed by IRE used for temporary to available 3177c478bd9Sstevel@tonic-gate * memory. This is a shift factor, so 6 means the ratio 1 to 64. This 3187c478bd9Sstevel@tonic-gate * value can be changed in /etc/system. 6 is a reasonable number. 3197c478bd9Sstevel@tonic-gate */ 320f4b3ec61Sdh155122 uint32_t ip_ire_mem_ratio = 6; /* /etc/system */ 3217c478bd9Sstevel@tonic-gate /* The shift factor for CPU speed to calculate the max IRE bucket length. */ 322f4b3ec61Sdh155122 uint32_t ip_ire_cpu_ratio = 7; /* /etc/system */ 3237c478bd9Sstevel@tonic-gate 324c793af95Ssangeeta typedef struct nce_clookup_s { 325c793af95Ssangeeta ipaddr_t ncecl_addr; 326c793af95Ssangeeta boolean_t ncecl_found; 327c793af95Ssangeeta } nce_clookup_t; 328c793af95Ssangeeta 3297c478bd9Sstevel@tonic-gate /* 3307c478bd9Sstevel@tonic-gate * The maximum number of buckets in IRE cache table. In future, we may 3317c478bd9Sstevel@tonic-gate * want to make it a dynamic hash table. For the moment, we fix the 3327c478bd9Sstevel@tonic-gate * size and allocate the table in ip_ire_init() when IP is first loaded. 3337c478bd9Sstevel@tonic-gate * We take into account the amount of memory a system has. 3347c478bd9Sstevel@tonic-gate */ 3357c478bd9Sstevel@tonic-gate #define IP_MAX_CACHE_TABLE_SIZE 4096 3367c478bd9Sstevel@tonic-gate 337f4b3ec61Sdh155122 /* Setable in /etc/system */ 3387c478bd9Sstevel@tonic-gate static uint32_t ip_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE; 3397c478bd9Sstevel@tonic-gate static uint32_t ip6_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE; 3407c478bd9Sstevel@tonic-gate 3417c478bd9Sstevel@tonic-gate /* Zero iulp_t for initialization. */ 3427c478bd9Sstevel@tonic-gate const iulp_t ire_uinfo_null = { 0 }; 3437c478bd9Sstevel@tonic-gate 3447c478bd9Sstevel@tonic-gate static int ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, 345c793af95Ssangeeta ipsq_func_t func, boolean_t); 3467c478bd9Sstevel@tonic-gate static void ire_delete_v4(ire_t *ire); 34745916cd2Sjpk static void ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, 348f4b3ec61Sdh155122 zoneid_t zoneid, ip_stack_t *); 3497c478bd9Sstevel@tonic-gate static void ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, 35045916cd2Sjpk pfv_t func, void *arg, uchar_t vers, ill_t *ill); 3519a09d68dSja97890 static void ire_cache_cleanup(irb_t *irb, uint32_t threshold, 3529a09d68dSja97890 ire_t *ref_ire); 353c793af95Ssangeeta static void ip_nce_clookup_and_delete(nce_t *nce, void *arg); 3545b17e9bdSJon Anderson static ire_t *ip4_ctable_lookup_impl(ire_ctable_args_t *margs); 3556a8288c7Scarlsonj #ifdef DEBUG 3566a8288c7Scarlsonj static void ire_trace_cleanup(const ire_t *); 3577c478bd9Sstevel@tonic-gate #endif 3587c478bd9Sstevel@tonic-gate 3597c478bd9Sstevel@tonic-gate /* 3607c478bd9Sstevel@tonic-gate * To avoid bloating the code, we call this function instead of 3617c478bd9Sstevel@tonic-gate * using the macro IRE_REFRELE. Use macro only in performance 3627c478bd9Sstevel@tonic-gate * critical paths. 3637c478bd9Sstevel@tonic-gate * 3647c478bd9Sstevel@tonic-gate * Must not be called while holding any locks. Otherwise if this is 3657c478bd9Sstevel@tonic-gate * the last reference to be released there is a chance of recursive mutex 3667c478bd9Sstevel@tonic-gate * panic due to ire_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying 3677c478bd9Sstevel@tonic-gate * to restart an ioctl. The one exception is when the caller is sure that 3687c478bd9Sstevel@tonic-gate * this is not the last reference to be released. Eg. if the caller is 3697c478bd9Sstevel@tonic-gate * sure that the ire has not been deleted and won't be deleted. 3707c478bd9Sstevel@tonic-gate */ 3717c478bd9Sstevel@tonic-gate void 3727c478bd9Sstevel@tonic-gate ire_refrele(ire_t *ire) 3737c478bd9Sstevel@tonic-gate { 3747c478bd9Sstevel@tonic-gate IRE_REFRELE(ire); 3757c478bd9Sstevel@tonic-gate } 3767c478bd9Sstevel@tonic-gate 3777c478bd9Sstevel@tonic-gate void 3787c478bd9Sstevel@tonic-gate ire_refrele_notr(ire_t *ire) 3797c478bd9Sstevel@tonic-gate { 3807c478bd9Sstevel@tonic-gate IRE_REFRELE_NOTR(ire); 3817c478bd9Sstevel@tonic-gate } 3827c478bd9Sstevel@tonic-gate 3837c478bd9Sstevel@tonic-gate /* 3847c478bd9Sstevel@tonic-gate * kmem_cache_alloc constructor for IRE in kma space. 3857c478bd9Sstevel@tonic-gate * Note that when ire_mp is set the IRE is stored in that mblk and 3867c478bd9Sstevel@tonic-gate * not in this cache. 3877c478bd9Sstevel@tonic-gate */ 3887c478bd9Sstevel@tonic-gate /* ARGSUSED */ 3897c478bd9Sstevel@tonic-gate static int 3907c478bd9Sstevel@tonic-gate ip_ire_constructor(void *buf, void *cdrarg, int kmflags) 3917c478bd9Sstevel@tonic-gate { 3927c478bd9Sstevel@tonic-gate ire_t *ire = buf; 3937c478bd9Sstevel@tonic-gate 394c793af95Ssangeeta ire->ire_nce = NULL; 3957c478bd9Sstevel@tonic-gate 3967c478bd9Sstevel@tonic-gate return (0); 3977c478bd9Sstevel@tonic-gate } 3987c478bd9Sstevel@tonic-gate 3997c478bd9Sstevel@tonic-gate /* ARGSUSED1 */ 4007c478bd9Sstevel@tonic-gate static void 4017c478bd9Sstevel@tonic-gate ip_ire_destructor(void *buf, void *cdrarg) 4027c478bd9Sstevel@tonic-gate { 4037c478bd9Sstevel@tonic-gate ire_t *ire = buf; 4047c478bd9Sstevel@tonic-gate 405c793af95Ssangeeta ASSERT(ire->ire_nce == NULL); 4067c478bd9Sstevel@tonic-gate } 4077c478bd9Sstevel@tonic-gate 4087c478bd9Sstevel@tonic-gate /* 4097c478bd9Sstevel@tonic-gate * This function is associated with the IP_IOC_IRE_ADVISE_NO_REPLY 4107c478bd9Sstevel@tonic-gate * IOCTL. It is used by TCP (or other ULPs) to supply revised information 4117c478bd9Sstevel@tonic-gate * for an existing CACHED IRE. 4127c478bd9Sstevel@tonic-gate */ 4137c478bd9Sstevel@tonic-gate /* ARGSUSED */ 4147c478bd9Sstevel@tonic-gate int 4157c478bd9Sstevel@tonic-gate ip_ire_advise(queue_t *q, mblk_t *mp, cred_t *ioc_cr) 4167c478bd9Sstevel@tonic-gate { 4177c478bd9Sstevel@tonic-gate uchar_t *addr_ucp; 4187c478bd9Sstevel@tonic-gate ipic_t *ipic; 4197c478bd9Sstevel@tonic-gate ire_t *ire; 4207c478bd9Sstevel@tonic-gate ipaddr_t addr; 4217c478bd9Sstevel@tonic-gate in6_addr_t v6addr; 4227c478bd9Sstevel@tonic-gate irb_t *irb; 4237c478bd9Sstevel@tonic-gate zoneid_t zoneid; 424f4b3ec61Sdh155122 ip_stack_t *ipst = CONNQ_TO_IPST(q); 4257c478bd9Sstevel@tonic-gate 4267c478bd9Sstevel@tonic-gate ASSERT(q->q_next == NULL); 4277c478bd9Sstevel@tonic-gate zoneid = Q_TO_CONN(q)->conn_zoneid; 4287c478bd9Sstevel@tonic-gate 4297c478bd9Sstevel@tonic-gate /* 4307c478bd9Sstevel@tonic-gate * Check privilege using the ioctl credential; if it is NULL 4317c478bd9Sstevel@tonic-gate * then this is a kernel message and therefor privileged. 4327c478bd9Sstevel@tonic-gate */ 433f4b3ec61Sdh155122 if (ioc_cr != NULL && secpolicy_ip_config(ioc_cr, B_FALSE) != 0) 4347c478bd9Sstevel@tonic-gate return (EPERM); 4357c478bd9Sstevel@tonic-gate 4367c478bd9Sstevel@tonic-gate ipic = (ipic_t *)mp->b_rptr; 4377c478bd9Sstevel@tonic-gate if (!(addr_ucp = mi_offset_param(mp, ipic->ipic_addr_offset, 4387c478bd9Sstevel@tonic-gate ipic->ipic_addr_length))) { 4397c478bd9Sstevel@tonic-gate return (EINVAL); 4407c478bd9Sstevel@tonic-gate } 4417c478bd9Sstevel@tonic-gate if (!OK_32PTR(addr_ucp)) 4427c478bd9Sstevel@tonic-gate return (EINVAL); 4437c478bd9Sstevel@tonic-gate switch (ipic->ipic_addr_length) { 4447c478bd9Sstevel@tonic-gate case IP_ADDR_LEN: { 4457c478bd9Sstevel@tonic-gate /* Extract the destination address. */ 4467c478bd9Sstevel@tonic-gate addr = *(ipaddr_t *)addr_ucp; 4477c478bd9Sstevel@tonic-gate /* Find the corresponding IRE. */ 448f4b3ec61Sdh155122 ire = ire_cache_lookup(addr, zoneid, NULL, ipst); 4497c478bd9Sstevel@tonic-gate break; 4507c478bd9Sstevel@tonic-gate } 4517c478bd9Sstevel@tonic-gate case IPV6_ADDR_LEN: { 4527c478bd9Sstevel@tonic-gate /* Extract the destination address. */ 4537c478bd9Sstevel@tonic-gate v6addr = *(in6_addr_t *)addr_ucp; 4547c478bd9Sstevel@tonic-gate /* Find the corresponding IRE. */ 455f4b3ec61Sdh155122 ire = ire_cache_lookup_v6(&v6addr, zoneid, NULL, ipst); 4567c478bd9Sstevel@tonic-gate break; 4577c478bd9Sstevel@tonic-gate } 4587c478bd9Sstevel@tonic-gate default: 4597c478bd9Sstevel@tonic-gate return (EINVAL); 4607c478bd9Sstevel@tonic-gate } 4617c478bd9Sstevel@tonic-gate 4627c478bd9Sstevel@tonic-gate if (ire == NULL) 4637c478bd9Sstevel@tonic-gate return (ENOENT); 4647c478bd9Sstevel@tonic-gate /* 4657c478bd9Sstevel@tonic-gate * Update the round trip time estimate and/or the max frag size 4667c478bd9Sstevel@tonic-gate * and/or the slow start threshold. 4677c478bd9Sstevel@tonic-gate * 4687c478bd9Sstevel@tonic-gate * We serialize multiple advises using ire_lock. 4697c478bd9Sstevel@tonic-gate */ 4707c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 4717c478bd9Sstevel@tonic-gate if (ipic->ipic_rtt) { 4727c478bd9Sstevel@tonic-gate /* 4737c478bd9Sstevel@tonic-gate * If there is no old cached values, initialize them 4747c478bd9Sstevel@tonic-gate * conservatively. Set them to be (1.5 * new value). 4757c478bd9Sstevel@tonic-gate */ 4767c478bd9Sstevel@tonic-gate if (ire->ire_uinfo.iulp_rtt != 0) { 4777c478bd9Sstevel@tonic-gate ire->ire_uinfo.iulp_rtt = (ire->ire_uinfo.iulp_rtt + 4787c478bd9Sstevel@tonic-gate ipic->ipic_rtt) >> 1; 4797c478bd9Sstevel@tonic-gate } else { 4807c478bd9Sstevel@tonic-gate ire->ire_uinfo.iulp_rtt = ipic->ipic_rtt + 4817c478bd9Sstevel@tonic-gate (ipic->ipic_rtt >> 1); 4827c478bd9Sstevel@tonic-gate } 4837c478bd9Sstevel@tonic-gate if (ire->ire_uinfo.iulp_rtt_sd != 0) { 4847c478bd9Sstevel@tonic-gate ire->ire_uinfo.iulp_rtt_sd = 4857c478bd9Sstevel@tonic-gate (ire->ire_uinfo.iulp_rtt_sd + 4867c478bd9Sstevel@tonic-gate ipic->ipic_rtt_sd) >> 1; 4877c478bd9Sstevel@tonic-gate } else { 4887c478bd9Sstevel@tonic-gate ire->ire_uinfo.iulp_rtt_sd = ipic->ipic_rtt_sd + 4897c478bd9Sstevel@tonic-gate (ipic->ipic_rtt_sd >> 1); 4907c478bd9Sstevel@tonic-gate } 4917c478bd9Sstevel@tonic-gate } 4927c478bd9Sstevel@tonic-gate if (ipic->ipic_max_frag) 4937c478bd9Sstevel@tonic-gate ire->ire_max_frag = MIN(ipic->ipic_max_frag, IP_MAXPACKET); 4947c478bd9Sstevel@tonic-gate if (ipic->ipic_ssthresh != 0) { 4957c478bd9Sstevel@tonic-gate if (ire->ire_uinfo.iulp_ssthresh != 0) 4967c478bd9Sstevel@tonic-gate ire->ire_uinfo.iulp_ssthresh = 4977c478bd9Sstevel@tonic-gate (ipic->ipic_ssthresh + 4987c478bd9Sstevel@tonic-gate ire->ire_uinfo.iulp_ssthresh) >> 1; 4997c478bd9Sstevel@tonic-gate else 5007c478bd9Sstevel@tonic-gate ire->ire_uinfo.iulp_ssthresh = ipic->ipic_ssthresh; 5017c478bd9Sstevel@tonic-gate } 5027c478bd9Sstevel@tonic-gate /* 5037c478bd9Sstevel@tonic-gate * Don't need the ire_lock below this. ire_type does not change 5047c478bd9Sstevel@tonic-gate * after initialization. ire_marks is protected by irb_lock. 5057c478bd9Sstevel@tonic-gate */ 5067c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 5077c478bd9Sstevel@tonic-gate 5087c478bd9Sstevel@tonic-gate if (ipic->ipic_ire_marks != 0 && ire->ire_type == IRE_CACHE) { 5097c478bd9Sstevel@tonic-gate /* 5107c478bd9Sstevel@tonic-gate * Only increment the temporary IRE count if the original 5117c478bd9Sstevel@tonic-gate * IRE is not already marked temporary. 5127c478bd9Sstevel@tonic-gate */ 5137c478bd9Sstevel@tonic-gate irb = ire->ire_bucket; 5147c478bd9Sstevel@tonic-gate rw_enter(&irb->irb_lock, RW_WRITER); 5157c478bd9Sstevel@tonic-gate if ((ipic->ipic_ire_marks & IRE_MARK_TEMPORARY) && 5167c478bd9Sstevel@tonic-gate !(ire->ire_marks & IRE_MARK_TEMPORARY)) { 5177c478bd9Sstevel@tonic-gate irb->irb_tmp_ire_cnt++; 5187c478bd9Sstevel@tonic-gate } 5197c478bd9Sstevel@tonic-gate ire->ire_marks |= ipic->ipic_ire_marks; 5207c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 5217c478bd9Sstevel@tonic-gate } 5227c478bd9Sstevel@tonic-gate 5237c478bd9Sstevel@tonic-gate ire_refrele(ire); 5247c478bd9Sstevel@tonic-gate return (0); 5257c478bd9Sstevel@tonic-gate } 5267c478bd9Sstevel@tonic-gate 5277c478bd9Sstevel@tonic-gate /* 5287c478bd9Sstevel@tonic-gate * This function is associated with the IP_IOC_IRE_DELETE[_NO_REPLY] 5297c478bd9Sstevel@tonic-gate * IOCTL[s]. The NO_REPLY form is used by TCP to delete a route IRE 5307c478bd9Sstevel@tonic-gate * for a host that is not responding. This will force an attempt to 531dc041e83Scarlsonj * establish a new route, if available, and flush out the ARP entry so 532dc041e83Scarlsonj * it will re-resolve. Management processes may want to use the 533dc041e83Scarlsonj * version that generates a reply. 5347c478bd9Sstevel@tonic-gate * 5357c478bd9Sstevel@tonic-gate * This function does not support IPv6 since Neighbor Unreachability Detection 5367c478bd9Sstevel@tonic-gate * means that negative advise like this is useless. 5377c478bd9Sstevel@tonic-gate */ 5387c478bd9Sstevel@tonic-gate /* ARGSUSED */ 5397c478bd9Sstevel@tonic-gate int 5407c478bd9Sstevel@tonic-gate ip_ire_delete(queue_t *q, mblk_t *mp, cred_t *ioc_cr) 5417c478bd9Sstevel@tonic-gate { 5427c478bd9Sstevel@tonic-gate uchar_t *addr_ucp; 5437c478bd9Sstevel@tonic-gate ipaddr_t addr; 5447c478bd9Sstevel@tonic-gate ire_t *ire; 5457c478bd9Sstevel@tonic-gate ipid_t *ipid; 5467c478bd9Sstevel@tonic-gate boolean_t routing_sock_info = B_FALSE; /* Sent info? */ 5477c478bd9Sstevel@tonic-gate zoneid_t zoneid; 548c793af95Ssangeeta ire_t *gire = NULL; 549dc041e83Scarlsonj ill_t *ill; 550dc041e83Scarlsonj mblk_t *arp_mp; 551f4b3ec61Sdh155122 ip_stack_t *ipst; 5527c478bd9Sstevel@tonic-gate 5537c478bd9Sstevel@tonic-gate ASSERT(q->q_next == NULL); 5547c478bd9Sstevel@tonic-gate zoneid = Q_TO_CONN(q)->conn_zoneid; 555f4b3ec61Sdh155122 ipst = CONNQ_TO_IPST(q); 5567c478bd9Sstevel@tonic-gate 5577c478bd9Sstevel@tonic-gate /* 5587c478bd9Sstevel@tonic-gate * Check privilege using the ioctl credential; if it is NULL 5597c478bd9Sstevel@tonic-gate * then this is a kernel message and therefor privileged. 5607c478bd9Sstevel@tonic-gate */ 561f4b3ec61Sdh155122 if (ioc_cr != NULL && secpolicy_ip_config(ioc_cr, B_FALSE) != 0) 5627c478bd9Sstevel@tonic-gate return (EPERM); 5637c478bd9Sstevel@tonic-gate 5647c478bd9Sstevel@tonic-gate ipid = (ipid_t *)mp->b_rptr; 5657c478bd9Sstevel@tonic-gate 5667c478bd9Sstevel@tonic-gate /* Only actions on IRE_CACHEs are acceptable at present. */ 5677c478bd9Sstevel@tonic-gate if (ipid->ipid_ire_type != IRE_CACHE) 5687c478bd9Sstevel@tonic-gate return (EINVAL); 5697c478bd9Sstevel@tonic-gate 5707c478bd9Sstevel@tonic-gate addr_ucp = mi_offset_param(mp, ipid->ipid_addr_offset, 5717c478bd9Sstevel@tonic-gate ipid->ipid_addr_length); 5727c478bd9Sstevel@tonic-gate if (addr_ucp == NULL || !OK_32PTR(addr_ucp)) 5737c478bd9Sstevel@tonic-gate return (EINVAL); 5747c478bd9Sstevel@tonic-gate switch (ipid->ipid_addr_length) { 5757c478bd9Sstevel@tonic-gate case IP_ADDR_LEN: 5767c478bd9Sstevel@tonic-gate /* addr_ucp points at IP addr */ 5777c478bd9Sstevel@tonic-gate break; 5787c478bd9Sstevel@tonic-gate case sizeof (sin_t): { 5797c478bd9Sstevel@tonic-gate sin_t *sin; 5807c478bd9Sstevel@tonic-gate /* 5817c478bd9Sstevel@tonic-gate * got complete (sockaddr) address - increment addr_ucp to point 5827c478bd9Sstevel@tonic-gate * at the ip_addr field. 5837c478bd9Sstevel@tonic-gate */ 5847c478bd9Sstevel@tonic-gate sin = (sin_t *)addr_ucp; 5857c478bd9Sstevel@tonic-gate addr_ucp = (uchar_t *)&sin->sin_addr.s_addr; 5867c478bd9Sstevel@tonic-gate break; 5877c478bd9Sstevel@tonic-gate } 5887c478bd9Sstevel@tonic-gate default: 5897c478bd9Sstevel@tonic-gate return (EINVAL); 5907c478bd9Sstevel@tonic-gate } 5917c478bd9Sstevel@tonic-gate /* Extract the destination address. */ 5927c478bd9Sstevel@tonic-gate bcopy(addr_ucp, &addr, IP_ADDR_LEN); 5937c478bd9Sstevel@tonic-gate 5947c478bd9Sstevel@tonic-gate /* Try to find the CACHED IRE. */ 595f4b3ec61Sdh155122 ire = ire_cache_lookup(addr, zoneid, NULL, ipst); 5967c478bd9Sstevel@tonic-gate 5977c478bd9Sstevel@tonic-gate /* Nail it. */ 5987c478bd9Sstevel@tonic-gate if (ire) { 5997c478bd9Sstevel@tonic-gate /* Allow delete only on CACHE entries */ 6007c478bd9Sstevel@tonic-gate if (ire->ire_type != IRE_CACHE) { 6017c478bd9Sstevel@tonic-gate ire_refrele(ire); 6027c478bd9Sstevel@tonic-gate return (EINVAL); 6037c478bd9Sstevel@tonic-gate } 6047c478bd9Sstevel@tonic-gate 6057c478bd9Sstevel@tonic-gate /* 6067c478bd9Sstevel@tonic-gate * Verify that the IRE has been around for a while. 6077c478bd9Sstevel@tonic-gate * This is to protect against transport protocols 6087c478bd9Sstevel@tonic-gate * that are too eager in sending delete messages. 6097c478bd9Sstevel@tonic-gate */ 6107c478bd9Sstevel@tonic-gate if (gethrestime_sec() < 611f4b3ec61Sdh155122 ire->ire_create_time + ipst->ips_ip_ignore_delete_time) { 6127c478bd9Sstevel@tonic-gate ire_refrele(ire); 6137c478bd9Sstevel@tonic-gate return (EINVAL); 6147c478bd9Sstevel@tonic-gate } 6157c478bd9Sstevel@tonic-gate /* 6167c478bd9Sstevel@tonic-gate * Now we have a potentially dead cache entry. We need 6177c478bd9Sstevel@tonic-gate * to remove it. 618c793af95Ssangeeta * If this cache entry is generated from a 619c793af95Ssangeeta * default route (i.e., ire_cmask == 0), 6207c478bd9Sstevel@tonic-gate * search the default list and mark it dead and some 6217c478bd9Sstevel@tonic-gate * background process will try to activate it. 6227c478bd9Sstevel@tonic-gate */ 6237c478bd9Sstevel@tonic-gate if ((ire->ire_gateway_addr != 0) && (ire->ire_cmask == 0)) { 6247c478bd9Sstevel@tonic-gate /* 6257c478bd9Sstevel@tonic-gate * Make sure that we pick a different 6267c478bd9Sstevel@tonic-gate * IRE_DEFAULT next time. 6277c478bd9Sstevel@tonic-gate */ 6287c478bd9Sstevel@tonic-gate ire_t *gw_ire; 629c793af95Ssangeeta irb_t *irb = NULL; 630c793af95Ssangeeta uint_t match_flags; 6317c478bd9Sstevel@tonic-gate 632c793af95Ssangeeta match_flags = (MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE); 633c793af95Ssangeeta 634c793af95Ssangeeta gire = ire_ftable_lookup(ire->ire_addr, 635c793af95Ssangeeta ire->ire_cmask, 0, 0, 636f4b3ec61Sdh155122 ire->ire_ipif, NULL, zoneid, 0, NULL, match_flags, 637f4b3ec61Sdh155122 ipst); 638c793af95Ssangeeta 639c793af95Ssangeeta ip3dbg(("ire_ftable_lookup() returned gire %p\n", 640c793af95Ssangeeta (void *)gire)); 641c793af95Ssangeeta 642c793af95Ssangeeta if (gire != NULL) { 643c793af95Ssangeeta irb = gire->ire_bucket; 6447c478bd9Sstevel@tonic-gate 6457c478bd9Sstevel@tonic-gate /* 6467c478bd9Sstevel@tonic-gate * We grab it as writer just to serialize 6477c478bd9Sstevel@tonic-gate * multiple threads trying to bump up 648c793af95Ssangeeta * irb_rr_origin 6497c478bd9Sstevel@tonic-gate */ 6507c478bd9Sstevel@tonic-gate rw_enter(&irb->irb_lock, RW_WRITER); 651c793af95Ssangeeta if ((gw_ire = irb->irb_rr_origin) == NULL) { 6527c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 6537c478bd9Sstevel@tonic-gate goto done; 6547c478bd9Sstevel@tonic-gate } 655c793af95Ssangeeta 6560ad1ccddSsowmini DTRACE_PROBE1(ip__ire__del__origin, 6570ad1ccddSsowmini (ire_t *), gw_ire); 6587c478bd9Sstevel@tonic-gate 6597c478bd9Sstevel@tonic-gate /* Skip past the potentially bad gateway */ 6607c478bd9Sstevel@tonic-gate if (ire->ire_gateway_addr == 6610ad1ccddSsowmini gw_ire->ire_gateway_addr) { 6620ad1ccddSsowmini ire_t *next = gw_ire->ire_next; 6637c478bd9Sstevel@tonic-gate 6640ad1ccddSsowmini DTRACE_PROBE2(ip__ire__del, 6650ad1ccddSsowmini (ire_t *), gw_ire, (irb_t *), irb); 6660ad1ccddSsowmini IRE_FIND_NEXT_ORIGIN(next); 6670ad1ccddSsowmini irb->irb_rr_origin = next; 6680ad1ccddSsowmini } 6697c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 6707c478bd9Sstevel@tonic-gate } 6717c478bd9Sstevel@tonic-gate } 6727c478bd9Sstevel@tonic-gate done: 673c793af95Ssangeeta if (gire != NULL) 674c793af95Ssangeeta IRE_REFRELE(gire); 6757c478bd9Sstevel@tonic-gate /* report the bad route to routing sockets */ 6767c478bd9Sstevel@tonic-gate ip_rts_change(RTM_LOSING, ire->ire_addr, ire->ire_gateway_addr, 6777c478bd9Sstevel@tonic-gate ire->ire_mask, ire->ire_src_addr, 0, 0, 0, 678f4b3ec61Sdh155122 (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA), ipst); 6797c478bd9Sstevel@tonic-gate routing_sock_info = B_TRUE; 680dc041e83Scarlsonj 681dc041e83Scarlsonj /* 682dc041e83Scarlsonj * TCP is really telling us to start over completely, and it 683dc041e83Scarlsonj * expects that we'll resend the ARP query. Tell ARP to 684dc041e83Scarlsonj * discard the entry, if this is a local destination. 685e61a481dSZhi-Jun Robin Fu * 686e61a481dSZhi-Jun Robin Fu * But, if the ARP entry is permanent then it shouldn't be 687e61a481dSZhi-Jun Robin Fu * deleted, so we set ARED_F_PRESERVE_PERM. 688dc041e83Scarlsonj */ 689dc041e83Scarlsonj ill = ire->ire_stq->q_ptr; 690dc041e83Scarlsonj if (ire->ire_gateway_addr == 0 && 691dc041e83Scarlsonj (arp_mp = ill_ared_alloc(ill, addr)) != NULL) { 692e61a481dSZhi-Jun Robin Fu ared_t *ared = (ared_t *)arp_mp->b_rptr; 693e61a481dSZhi-Jun Robin Fu 694e61a481dSZhi-Jun Robin Fu ASSERT(ared->ared_cmd == AR_ENTRY_DELETE); 695e61a481dSZhi-Jun Robin Fu ared->ared_flags |= ARED_F_PRESERVE_PERM; 696dc041e83Scarlsonj putnext(ill->ill_rq, arp_mp); 697dc041e83Scarlsonj } 698dc041e83Scarlsonj 6997c478bd9Sstevel@tonic-gate ire_delete(ire); 7007c478bd9Sstevel@tonic-gate ire_refrele(ire); 7017c478bd9Sstevel@tonic-gate } 7026bdb8e66Sdd193516 /* 7036bdb8e66Sdd193516 * Also look for an IRE_HOST type redirect ire and 7046bdb8e66Sdd193516 * remove it if present. 7056bdb8e66Sdd193516 */ 7066bdb8e66Sdd193516 ire = ire_route_lookup(addr, 0, 0, IRE_HOST, NULL, NULL, 707f4b3ec61Sdh155122 ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 7087c478bd9Sstevel@tonic-gate 7097c478bd9Sstevel@tonic-gate /* Nail it. */ 7106bdb8e66Sdd193516 if (ire != NULL) { 7116bdb8e66Sdd193516 if (ire->ire_flags & RTF_DYNAMIC) { 7127c478bd9Sstevel@tonic-gate if (!routing_sock_info) { 7137c478bd9Sstevel@tonic-gate ip_rts_change(RTM_LOSING, ire->ire_addr, 7147c478bd9Sstevel@tonic-gate ire->ire_gateway_addr, ire->ire_mask, 7157c478bd9Sstevel@tonic-gate ire->ire_src_addr, 0, 0, 0, 71654da8755Ssowmini (RTA_DST | RTA_GATEWAY | 71754da8755Ssowmini RTA_NETMASK | RTA_IFA), 718f4b3ec61Sdh155122 ipst); 7197c478bd9Sstevel@tonic-gate } 7207c478bd9Sstevel@tonic-gate ire_delete(ire); 7216bdb8e66Sdd193516 } 7227c478bd9Sstevel@tonic-gate ire_refrele(ire); 7237c478bd9Sstevel@tonic-gate } 7247c478bd9Sstevel@tonic-gate return (0); 7257c478bd9Sstevel@tonic-gate } 7267c478bd9Sstevel@tonic-gate 7277c478bd9Sstevel@tonic-gate /* 7287c478bd9Sstevel@tonic-gate * ip_ire_req is called by ip_wput when an IRE_DB_REQ_TYPE message is handed 7297c478bd9Sstevel@tonic-gate * down from the Upper Level Protocol to request a copy of the IRE (to check 7307c478bd9Sstevel@tonic-gate * its type or to extract information like round-trip time estimates or the 7317c478bd9Sstevel@tonic-gate * MTU.) 7327c478bd9Sstevel@tonic-gate * The address is assumed to be in the ire_addr field. If no IRE is found 7337c478bd9Sstevel@tonic-gate * an IRE is returned with ire_type being zero. 7347c478bd9Sstevel@tonic-gate * Note that the upper lavel protocol has to check for broadcast 7357c478bd9Sstevel@tonic-gate * (IRE_BROADCAST) and multicast (CLASSD(addr)). 7367c478bd9Sstevel@tonic-gate * If there is a b_cont the resulting IRE_DB_TYPE mblk is placed at the 7377c478bd9Sstevel@tonic-gate * end of the returned message. 7387c478bd9Sstevel@tonic-gate * 7397c478bd9Sstevel@tonic-gate * TCP sends down a message of this type with a connection request packet 7407c478bd9Sstevel@tonic-gate * chained on. UDP and ICMP send it down to verify that a route exists for 7417c478bd9Sstevel@tonic-gate * the destination address when they get connected. 7427c478bd9Sstevel@tonic-gate */ 7437c478bd9Sstevel@tonic-gate void 7447c478bd9Sstevel@tonic-gate ip_ire_req(queue_t *q, mblk_t *mp) 7457c478bd9Sstevel@tonic-gate { 7467c478bd9Sstevel@tonic-gate ire_t *inire; 7477c478bd9Sstevel@tonic-gate ire_t *ire; 7487c478bd9Sstevel@tonic-gate mblk_t *mp1; 7497c478bd9Sstevel@tonic-gate ire_t *sire = NULL; 7507c478bd9Sstevel@tonic-gate zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid; 751f4b3ec61Sdh155122 ip_stack_t *ipst = CONNQ_TO_IPST(q); 752f4b3ec61Sdh155122 753f4b3ec61Sdh155122 ASSERT(q->q_next == NULL); 7547c478bd9Sstevel@tonic-gate 7557c478bd9Sstevel@tonic-gate if ((mp->b_wptr - mp->b_rptr) < sizeof (ire_t) || 7567c478bd9Sstevel@tonic-gate !OK_32PTR(mp->b_rptr)) { 7577c478bd9Sstevel@tonic-gate freemsg(mp); 7587c478bd9Sstevel@tonic-gate return; 7597c478bd9Sstevel@tonic-gate } 7607c478bd9Sstevel@tonic-gate inire = (ire_t *)mp->b_rptr; 7617c478bd9Sstevel@tonic-gate /* 7627c478bd9Sstevel@tonic-gate * Got it, now take our best shot at an IRE. 7637c478bd9Sstevel@tonic-gate */ 7647c478bd9Sstevel@tonic-gate if (inire->ire_ipversion == IPV6_VERSION) { 7657c478bd9Sstevel@tonic-gate ire = ire_route_lookup_v6(&inire->ire_addr_v6, 0, 0, 0, 76645916cd2Sjpk NULL, &sire, zoneid, NULL, 767f4b3ec61Sdh155122 (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT), ipst); 7687c478bd9Sstevel@tonic-gate } else { 7697c478bd9Sstevel@tonic-gate ASSERT(inire->ire_ipversion == IPV4_VERSION); 7707c478bd9Sstevel@tonic-gate ire = ire_route_lookup(inire->ire_addr, 0, 0, 0, 77145916cd2Sjpk NULL, &sire, zoneid, NULL, 772f4b3ec61Sdh155122 (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT), ipst); 7737c478bd9Sstevel@tonic-gate } 7747c478bd9Sstevel@tonic-gate 7757c478bd9Sstevel@tonic-gate /* 7767c478bd9Sstevel@tonic-gate * We prevent returning IRES with source address INADDR_ANY 7777c478bd9Sstevel@tonic-gate * as these were temporarily created for sending packets 7787c478bd9Sstevel@tonic-gate * from endpoints that have conn_unspec_src set. 7797c478bd9Sstevel@tonic-gate */ 7807c478bd9Sstevel@tonic-gate if (ire == NULL || 7817c478bd9Sstevel@tonic-gate (ire->ire_ipversion == IPV4_VERSION && 7827c478bd9Sstevel@tonic-gate ire->ire_src_addr == INADDR_ANY) || 7837c478bd9Sstevel@tonic-gate (ire->ire_ipversion == IPV6_VERSION && 7847c478bd9Sstevel@tonic-gate IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6))) { 7857c478bd9Sstevel@tonic-gate inire->ire_type = 0; 7867c478bd9Sstevel@tonic-gate } else { 7877c478bd9Sstevel@tonic-gate bcopy(ire, inire, sizeof (ire_t)); 7887c478bd9Sstevel@tonic-gate /* Copy the route metrics from the parent. */ 7897c478bd9Sstevel@tonic-gate if (sire != NULL) { 7907c478bd9Sstevel@tonic-gate bcopy(&(sire->ire_uinfo), &(inire->ire_uinfo), 7917c478bd9Sstevel@tonic-gate sizeof (iulp_t)); 7927c478bd9Sstevel@tonic-gate } 7937c478bd9Sstevel@tonic-gate 7947c478bd9Sstevel@tonic-gate /* 7957c478bd9Sstevel@tonic-gate * As we don't lookup global policy here, we may not 7967c478bd9Sstevel@tonic-gate * pass the right size if per-socket policy is not 7977c478bd9Sstevel@tonic-gate * present. For these cases, path mtu discovery will 7987c478bd9Sstevel@tonic-gate * do the right thing. 7997c478bd9Sstevel@tonic-gate */ 8007c478bd9Sstevel@tonic-gate inire->ire_ipsec_overhead = conn_ipsec_length(Q_TO_CONN(q)); 8017c478bd9Sstevel@tonic-gate 8027c478bd9Sstevel@tonic-gate /* Pass the latest setting of the ip_path_mtu_discovery */ 803f4b3ec61Sdh155122 inire->ire_frag_flag |= 804f4b3ec61Sdh155122 (ipst->ips_ip_path_mtu_discovery) ? IPH_DF : 0; 8057c478bd9Sstevel@tonic-gate } 8067c478bd9Sstevel@tonic-gate if (ire != NULL) 8077c478bd9Sstevel@tonic-gate ire_refrele(ire); 8087c478bd9Sstevel@tonic-gate if (sire != NULL) 8097c478bd9Sstevel@tonic-gate ire_refrele(sire); 8107c478bd9Sstevel@tonic-gate mp->b_wptr = &mp->b_rptr[sizeof (ire_t)]; 8117c478bd9Sstevel@tonic-gate mp->b_datap->db_type = IRE_DB_TYPE; 8127c478bd9Sstevel@tonic-gate 8137c478bd9Sstevel@tonic-gate /* Put the IRE_DB_TYPE mblk last in the chain */ 8147c478bd9Sstevel@tonic-gate mp1 = mp->b_cont; 8157c478bd9Sstevel@tonic-gate if (mp1 != NULL) { 8167c478bd9Sstevel@tonic-gate mp->b_cont = NULL; 8177c478bd9Sstevel@tonic-gate linkb(mp1, mp); 8187c478bd9Sstevel@tonic-gate mp = mp1; 8197c478bd9Sstevel@tonic-gate } 8207c478bd9Sstevel@tonic-gate qreply(q, mp); 8217c478bd9Sstevel@tonic-gate } 8227c478bd9Sstevel@tonic-gate 8237c478bd9Sstevel@tonic-gate /* 8247c478bd9Sstevel@tonic-gate * Send a packet using the specified IRE. 8257c478bd9Sstevel@tonic-gate * If ire_src_addr_v6 is all zero then discard the IRE after 8267c478bd9Sstevel@tonic-gate * the packet has been sent. 8277c478bd9Sstevel@tonic-gate */ 8287c478bd9Sstevel@tonic-gate static void 8297c478bd9Sstevel@tonic-gate ire_send(queue_t *q, mblk_t *pkt, ire_t *ire) 8307c478bd9Sstevel@tonic-gate { 8317c478bd9Sstevel@tonic-gate mblk_t *ipsec_mp; 8327c478bd9Sstevel@tonic-gate boolean_t is_secure; 8337c478bd9Sstevel@tonic-gate uint_t ifindex; 8347c478bd9Sstevel@tonic-gate ill_t *ill; 8355597b60aSnordmark zoneid_t zoneid = ire->ire_zoneid; 836f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 8377c478bd9Sstevel@tonic-gate 8387c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV4_VERSION); 8395597b60aSnordmark ASSERT(!(ire->ire_type & IRE_LOCAL)); /* Has different ire_zoneid */ 8407c478bd9Sstevel@tonic-gate ipsec_mp = pkt; 8417c478bd9Sstevel@tonic-gate is_secure = (pkt->b_datap->db_type == M_CTL); 8425597b60aSnordmark if (is_secure) { 8435597b60aSnordmark ipsec_out_t *io; 8445597b60aSnordmark 8457c478bd9Sstevel@tonic-gate pkt = pkt->b_cont; 8465597b60aSnordmark io = (ipsec_out_t *)ipsec_mp->b_rptr; 8475597b60aSnordmark if (io->ipsec_out_type == IPSEC_OUT) 8485597b60aSnordmark zoneid = io->ipsec_out_zoneid; 8495597b60aSnordmark } 8507c478bd9Sstevel@tonic-gate 8517c478bd9Sstevel@tonic-gate /* If the packet originated externally then */ 8527c478bd9Sstevel@tonic-gate if (pkt->b_prev) { 8537c478bd9Sstevel@tonic-gate ire_refrele(ire); 8547c478bd9Sstevel@tonic-gate /* 8557c478bd9Sstevel@tonic-gate * Extract the ifindex from b_prev (set in ip_rput_noire). 8567c478bd9Sstevel@tonic-gate * Look up interface to see if it still exists (it could have 8577c478bd9Sstevel@tonic-gate * been unplumbed by the time the reply came back from ARP) 8587c478bd9Sstevel@tonic-gate */ 8597c478bd9Sstevel@tonic-gate ifindex = (uint_t)(uintptr_t)pkt->b_prev; 8607c478bd9Sstevel@tonic-gate ill = ill_lookup_on_ifindex(ifindex, B_FALSE, 861f4b3ec61Sdh155122 NULL, NULL, NULL, NULL, ipst); 8627c478bd9Sstevel@tonic-gate if (ill == NULL) { 8637c478bd9Sstevel@tonic-gate pkt->b_prev = NULL; 8647c478bd9Sstevel@tonic-gate pkt->b_next = NULL; 8657c478bd9Sstevel@tonic-gate freemsg(ipsec_mp); 8667c478bd9Sstevel@tonic-gate return; 8677c478bd9Sstevel@tonic-gate } 8687c478bd9Sstevel@tonic-gate q = ill->ill_rq; 8697c478bd9Sstevel@tonic-gate pkt->b_prev = NULL; 8707c478bd9Sstevel@tonic-gate /* 8717c478bd9Sstevel@tonic-gate * This packet has not gone through IPSEC processing 8727c478bd9Sstevel@tonic-gate * and hence we should not have any IPSEC message 8737c478bd9Sstevel@tonic-gate * prepended. 8747c478bd9Sstevel@tonic-gate */ 8757c478bd9Sstevel@tonic-gate ASSERT(ipsec_mp == pkt); 876c793af95Ssangeeta put(q, pkt); 8777c478bd9Sstevel@tonic-gate ill_refrele(ill); 8787c478bd9Sstevel@tonic-gate } else if (pkt->b_next) { 8797c478bd9Sstevel@tonic-gate /* Packets from multicast router */ 8807c478bd9Sstevel@tonic-gate pkt->b_next = NULL; 8817c478bd9Sstevel@tonic-gate /* 8827c478bd9Sstevel@tonic-gate * We never get the IPSEC_OUT while forwarding the 8837c478bd9Sstevel@tonic-gate * packet for multicast router. 8847c478bd9Sstevel@tonic-gate */ 8857c478bd9Sstevel@tonic-gate ASSERT(ipsec_mp == pkt); 8867c478bd9Sstevel@tonic-gate ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, ipsec_mp, NULL); 8877c478bd9Sstevel@tonic-gate ire_refrele(ire); 8887c478bd9Sstevel@tonic-gate } else { 8897c478bd9Sstevel@tonic-gate /* Locally originated packets */ 8907924222fSmeem boolean_t delete_ire = B_FALSE; 8917c478bd9Sstevel@tonic-gate ipha_t *ipha = (ipha_t *)pkt->b_rptr; 8927c478bd9Sstevel@tonic-gate 8937c478bd9Sstevel@tonic-gate /* 8947924222fSmeem * If this IRE shouldn't be kept in the table (because its 8957924222fSmeem * source address is unspecified), hold a reference to it so 8967924222fSmeem * we can delete it even after e.g. ip_wput_ire() has dropped 8977924222fSmeem * its reference. 8987c478bd9Sstevel@tonic-gate */ 8997924222fSmeem if (!(ire->ire_marks & IRE_MARK_NOADD) && 9007924222fSmeem ire->ire_src_addr == INADDR_ANY) { 9017924222fSmeem delete_ire = B_TRUE; 9027c478bd9Sstevel@tonic-gate IRE_REFHOLD(ire); 9037c478bd9Sstevel@tonic-gate } 9047924222fSmeem 9057c478bd9Sstevel@tonic-gate /* 9067c478bd9Sstevel@tonic-gate * If we were resolving a router we can not use the 9077c478bd9Sstevel@tonic-gate * routers IRE for sending the packet (since it would 9087c478bd9Sstevel@tonic-gate * violate the uniqness of the IP idents) thus we 9097c478bd9Sstevel@tonic-gate * make another pass through ip_wput to create the IRE_CACHE 9107c478bd9Sstevel@tonic-gate * for the destination. 9117c478bd9Sstevel@tonic-gate * When IRE_MARK_NOADD is set, ire_add() is not called. 9127c478bd9Sstevel@tonic-gate * Thus ip_wput() will never find a ire and result in an 9137c478bd9Sstevel@tonic-gate * infinite loop. Thus we check whether IRE_MARK_NOADD is 9147c478bd9Sstevel@tonic-gate * is set. This also implies that IRE_MARK_NOADD can only be 9157c478bd9Sstevel@tonic-gate * used to send packets to directly connected hosts. 9167c478bd9Sstevel@tonic-gate */ 9177c478bd9Sstevel@tonic-gate if (ipha->ipha_dst != ire->ire_addr && 9187c478bd9Sstevel@tonic-gate !(ire->ire_marks & IRE_MARK_NOADD)) { 9197c478bd9Sstevel@tonic-gate ire_refrele(ire); /* Held in ire_add */ 9205597b60aSnordmark if (CONN_Q(q)) { 9215597b60aSnordmark (void) ip_output(Q_TO_CONN(q), ipsec_mp, q, 9225597b60aSnordmark IRE_SEND); 9235597b60aSnordmark } else { 9245597b60aSnordmark (void) ip_output((void *)(uintptr_t)zoneid, 9255597b60aSnordmark ipsec_mp, q, IRE_SEND); 9265597b60aSnordmark } 9277c478bd9Sstevel@tonic-gate } else { 9287c478bd9Sstevel@tonic-gate if (is_secure) { 9297c478bd9Sstevel@tonic-gate ipsec_out_t *oi; 9307c478bd9Sstevel@tonic-gate ipha_t *ipha; 9317c478bd9Sstevel@tonic-gate 9327c478bd9Sstevel@tonic-gate oi = (ipsec_out_t *)ipsec_mp->b_rptr; 9337c478bd9Sstevel@tonic-gate ipha = (ipha_t *)ipsec_mp->b_cont->b_rptr; 9347c478bd9Sstevel@tonic-gate if (oi->ipsec_out_proc_begin) { 9357c478bd9Sstevel@tonic-gate /* 9367c478bd9Sstevel@tonic-gate * This is the case where 9377c478bd9Sstevel@tonic-gate * ip_wput_ipsec_out could not find 9387c478bd9Sstevel@tonic-gate * the IRE and recreated a new one. 9397c478bd9Sstevel@tonic-gate * As ip_wput_ipsec_out does ire 9407c478bd9Sstevel@tonic-gate * lookups, ire_refrele for the extra 9417c478bd9Sstevel@tonic-gate * bump in ire_add. 9427c478bd9Sstevel@tonic-gate */ 9437c478bd9Sstevel@tonic-gate ire_refrele(ire); 9447c478bd9Sstevel@tonic-gate ip_wput_ipsec_out(q, ipsec_mp, ipha, 9457c478bd9Sstevel@tonic-gate NULL, NULL); 9467c478bd9Sstevel@tonic-gate } else { 9477c478bd9Sstevel@tonic-gate /* 9487c478bd9Sstevel@tonic-gate * IRE_REFRELE will be done in 9497c478bd9Sstevel@tonic-gate * ip_wput_ire. 9507c478bd9Sstevel@tonic-gate */ 9517c478bd9Sstevel@tonic-gate ip_wput_ire(q, ipsec_mp, ire, NULL, 9525597b60aSnordmark IRE_SEND, zoneid); 9537c478bd9Sstevel@tonic-gate } 9547c478bd9Sstevel@tonic-gate } else { 9557c478bd9Sstevel@tonic-gate /* 9567c478bd9Sstevel@tonic-gate * IRE_REFRELE will be done in ip_wput_ire. 9577c478bd9Sstevel@tonic-gate */ 9587c478bd9Sstevel@tonic-gate ip_wput_ire(q, ipsec_mp, ire, NULL, 9595597b60aSnordmark IRE_SEND, zoneid); 9607c478bd9Sstevel@tonic-gate } 9617c478bd9Sstevel@tonic-gate } 9627c478bd9Sstevel@tonic-gate /* 9637c478bd9Sstevel@tonic-gate * Special code to support sending a single packet with 9647c478bd9Sstevel@tonic-gate * conn_unspec_src using an IRE which has no source address. 9657c478bd9Sstevel@tonic-gate * The IRE is deleted here after sending the packet to avoid 9667c478bd9Sstevel@tonic-gate * having other code trip on it. But before we delete the 9677c478bd9Sstevel@tonic-gate * ire, somebody could have looked up this ire. 9687c478bd9Sstevel@tonic-gate * We prevent returning/using this IRE by the upper layers 9697c478bd9Sstevel@tonic-gate * by making checks to NULL source address in other places 9707c478bd9Sstevel@tonic-gate * like e.g ip_ire_append, ip_ire_req and ip_bind_connected. 9717924222fSmeem * Though this does not completely prevent other threads 9727c478bd9Sstevel@tonic-gate * from using this ire, this should not cause any problems. 9737c478bd9Sstevel@tonic-gate */ 9747924222fSmeem if (delete_ire) { 9757c478bd9Sstevel@tonic-gate ip1dbg(("ire_send: delete IRE\n")); 9767c478bd9Sstevel@tonic-gate ire_delete(ire); 9777c478bd9Sstevel@tonic-gate ire_refrele(ire); /* Held above */ 9787c478bd9Sstevel@tonic-gate } 9797c478bd9Sstevel@tonic-gate } 9807c478bd9Sstevel@tonic-gate } 9817c478bd9Sstevel@tonic-gate 9827c478bd9Sstevel@tonic-gate /* 9837c478bd9Sstevel@tonic-gate * Send a packet using the specified IRE. 9847c478bd9Sstevel@tonic-gate * If ire_src_addr_v6 is all zero then discard the IRE after 9857c478bd9Sstevel@tonic-gate * the packet has been sent. 9867c478bd9Sstevel@tonic-gate */ 9877c478bd9Sstevel@tonic-gate static void 9887c478bd9Sstevel@tonic-gate ire_send_v6(queue_t *q, mblk_t *pkt, ire_t *ire) 9897c478bd9Sstevel@tonic-gate { 9907c478bd9Sstevel@tonic-gate mblk_t *ipsec_mp; 9917c478bd9Sstevel@tonic-gate boolean_t secure; 9927c478bd9Sstevel@tonic-gate uint_t ifindex; 9935597b60aSnordmark zoneid_t zoneid = ire->ire_zoneid; 994f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 9957c478bd9Sstevel@tonic-gate 9967c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV6_VERSION); 9975597b60aSnordmark ASSERT(!(ire->ire_type & IRE_LOCAL)); /* Has different ire_zoneid */ 9987c478bd9Sstevel@tonic-gate if (pkt->b_datap->db_type == M_CTL) { 9995597b60aSnordmark ipsec_out_t *io; 10005597b60aSnordmark 10017c478bd9Sstevel@tonic-gate ipsec_mp = pkt; 10027c478bd9Sstevel@tonic-gate pkt = pkt->b_cont; 10037c478bd9Sstevel@tonic-gate secure = B_TRUE; 10045597b60aSnordmark io = (ipsec_out_t *)ipsec_mp->b_rptr; 10055597b60aSnordmark if (io->ipsec_out_type == IPSEC_OUT) 10065597b60aSnordmark zoneid = io->ipsec_out_zoneid; 10077c478bd9Sstevel@tonic-gate } else { 10087c478bd9Sstevel@tonic-gate ipsec_mp = pkt; 10097c478bd9Sstevel@tonic-gate secure = B_FALSE; 10107c478bd9Sstevel@tonic-gate } 10117c478bd9Sstevel@tonic-gate 10127c478bd9Sstevel@tonic-gate /* If the packet originated externally then */ 10137c478bd9Sstevel@tonic-gate if (pkt->b_prev) { 10147c478bd9Sstevel@tonic-gate ill_t *ill; 10157c478bd9Sstevel@tonic-gate /* 10167c478bd9Sstevel@tonic-gate * Extract the ifindex from b_prev (set in ip_rput_data_v6). 10177c478bd9Sstevel@tonic-gate * Look up interface to see if it still exists (it could have 10187c478bd9Sstevel@tonic-gate * been unplumbed by the time the reply came back from the 1019c793af95Ssangeeta * resolver). 10207c478bd9Sstevel@tonic-gate */ 10217c478bd9Sstevel@tonic-gate ifindex = (uint_t)(uintptr_t)pkt->b_prev; 10227c478bd9Sstevel@tonic-gate ill = ill_lookup_on_ifindex(ifindex, B_TRUE, 1023f4b3ec61Sdh155122 NULL, NULL, NULL, NULL, ipst); 10247c478bd9Sstevel@tonic-gate if (ill == NULL) { 10257c478bd9Sstevel@tonic-gate pkt->b_prev = NULL; 10267c478bd9Sstevel@tonic-gate pkt->b_next = NULL; 10277c478bd9Sstevel@tonic-gate freemsg(ipsec_mp); 10287c478bd9Sstevel@tonic-gate ire_refrele(ire); /* Held in ire_add */ 10297c478bd9Sstevel@tonic-gate return; 10307c478bd9Sstevel@tonic-gate } 10317c478bd9Sstevel@tonic-gate q = ill->ill_rq; 10327c478bd9Sstevel@tonic-gate pkt->b_prev = NULL; 10337c478bd9Sstevel@tonic-gate /* 10347c478bd9Sstevel@tonic-gate * This packet has not gone through IPSEC processing 10357c478bd9Sstevel@tonic-gate * and hence we should not have any IPSEC message 10367c478bd9Sstevel@tonic-gate * prepended. 10377c478bd9Sstevel@tonic-gate */ 10387c478bd9Sstevel@tonic-gate ASSERT(ipsec_mp == pkt); 10397c478bd9Sstevel@tonic-gate put(q, pkt); 10407c478bd9Sstevel@tonic-gate ill_refrele(ill); 10417c478bd9Sstevel@tonic-gate } else if (pkt->b_next) { 10427c478bd9Sstevel@tonic-gate /* Packets from multicast router */ 10437c478bd9Sstevel@tonic-gate pkt->b_next = NULL; 10447c478bd9Sstevel@tonic-gate /* 10457c478bd9Sstevel@tonic-gate * We never get the IPSEC_OUT while forwarding the 10467c478bd9Sstevel@tonic-gate * packet for multicast router. 10477c478bd9Sstevel@tonic-gate */ 10487c478bd9Sstevel@tonic-gate ASSERT(ipsec_mp == pkt); 10497c478bd9Sstevel@tonic-gate /* 10507c478bd9Sstevel@tonic-gate * XXX TODO IPv6. 10517c478bd9Sstevel@tonic-gate */ 10527c478bd9Sstevel@tonic-gate freemsg(pkt); 10537c478bd9Sstevel@tonic-gate #ifdef XXX 10547c478bd9Sstevel@tonic-gate ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, pkt, NULL); 10557c478bd9Sstevel@tonic-gate #endif 10567c478bd9Sstevel@tonic-gate } else { 10577c478bd9Sstevel@tonic-gate if (secure) { 10587c478bd9Sstevel@tonic-gate ipsec_out_t *oi; 10597c478bd9Sstevel@tonic-gate ip6_t *ip6h; 10607c478bd9Sstevel@tonic-gate 10617c478bd9Sstevel@tonic-gate oi = (ipsec_out_t *)ipsec_mp->b_rptr; 10627c478bd9Sstevel@tonic-gate ip6h = (ip6_t *)ipsec_mp->b_cont->b_rptr; 10637c478bd9Sstevel@tonic-gate if (oi->ipsec_out_proc_begin) { 10647c478bd9Sstevel@tonic-gate /* 10657c478bd9Sstevel@tonic-gate * This is the case where 10667c478bd9Sstevel@tonic-gate * ip_wput_ipsec_out could not find 10677c478bd9Sstevel@tonic-gate * the IRE and recreated a new one. 10687c478bd9Sstevel@tonic-gate */ 10697c478bd9Sstevel@tonic-gate ip_wput_ipsec_out_v6(q, ipsec_mp, ip6h, 10707c478bd9Sstevel@tonic-gate NULL, NULL); 10717c478bd9Sstevel@tonic-gate } else { 10725597b60aSnordmark if (CONN_Q(q)) { 10735597b60aSnordmark (void) ip_output_v6(Q_TO_CONN(q), 10745597b60aSnordmark ipsec_mp, q, IRE_SEND); 10755597b60aSnordmark } else { 10765597b60aSnordmark (void) ip_output_v6( 10775597b60aSnordmark (void *)(uintptr_t)zoneid, 10785597b60aSnordmark ipsec_mp, q, IRE_SEND); 10795597b60aSnordmark } 10807c478bd9Sstevel@tonic-gate } 10817c478bd9Sstevel@tonic-gate } else { 10827c478bd9Sstevel@tonic-gate /* 10837c478bd9Sstevel@tonic-gate * Send packets through ip_output_v6 so that any 10847c478bd9Sstevel@tonic-gate * ip6_info header can be processed again. 10857c478bd9Sstevel@tonic-gate */ 10865597b60aSnordmark if (CONN_Q(q)) { 10877c478bd9Sstevel@tonic-gate (void) ip_output_v6(Q_TO_CONN(q), ipsec_mp, q, 10887c478bd9Sstevel@tonic-gate IRE_SEND); 10895597b60aSnordmark } else { 10905597b60aSnordmark (void) ip_output_v6((void *)(uintptr_t)zoneid, 10915597b60aSnordmark ipsec_mp, q, IRE_SEND); 10925597b60aSnordmark } 10937c478bd9Sstevel@tonic-gate } 10947c478bd9Sstevel@tonic-gate /* 10957c478bd9Sstevel@tonic-gate * Special code to support sending a single packet with 10967c478bd9Sstevel@tonic-gate * conn_unspec_src using an IRE which has no source address. 10977c478bd9Sstevel@tonic-gate * The IRE is deleted here after sending the packet to avoid 10987c478bd9Sstevel@tonic-gate * having other code trip on it. But before we delete the 10997c478bd9Sstevel@tonic-gate * ire, somebody could have looked up this ire. 11007c478bd9Sstevel@tonic-gate * We prevent returning/using this IRE by the upper layers 11017c478bd9Sstevel@tonic-gate * by making checks to NULL source address in other places 11027c478bd9Sstevel@tonic-gate * like e.g ip_ire_append_v6, ip_ire_req and 11037c478bd9Sstevel@tonic-gate * ip_bind_connected_v6. Though, this does not completely 11047c478bd9Sstevel@tonic-gate * prevent other threads from using this ire, this should 11057c478bd9Sstevel@tonic-gate * not cause any problems. 11067c478bd9Sstevel@tonic-gate */ 11077c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6)) { 11087c478bd9Sstevel@tonic-gate ip1dbg(("ire_send_v6: delete IRE\n")); 11097c478bd9Sstevel@tonic-gate ire_delete(ire); 11107c478bd9Sstevel@tonic-gate } 11117c478bd9Sstevel@tonic-gate } 11127c478bd9Sstevel@tonic-gate ire_refrele(ire); /* Held in ire_add */ 11137c478bd9Sstevel@tonic-gate } 11147c478bd9Sstevel@tonic-gate 11157c478bd9Sstevel@tonic-gate /* 11167c478bd9Sstevel@tonic-gate * Make sure that IRE bucket does not get too long. 11177c478bd9Sstevel@tonic-gate * This can cause lock up because ire_cache_lookup() 11187c478bd9Sstevel@tonic-gate * may take "forever" to finish. 11197c478bd9Sstevel@tonic-gate * 11209a09d68dSja97890 * We only remove a maximum of cnt IREs each time. This 11219a09d68dSja97890 * should keep the bucket length approximately constant, 11227c478bd9Sstevel@tonic-gate * depending on cnt. This should be enough to defend 11237c478bd9Sstevel@tonic-gate * against DoS attack based on creating temporary IREs 11247c478bd9Sstevel@tonic-gate * (for forwarding and non-TCP traffic). 11257c478bd9Sstevel@tonic-gate * 11269a09d68dSja97890 * We also pass in the address of the newly created IRE 11279a09d68dSja97890 * as we do not want to remove this straight after adding 11289a09d68dSja97890 * it. New IREs are normally added at the tail of the 11297c478bd9Sstevel@tonic-gate * bucket. This means that we are removing the "oldest" 11309a09d68dSja97890 * temporary IREs added. Only if there are IREs with 11317c478bd9Sstevel@tonic-gate * the same ire_addr, do we not add it at the tail. Refer 11327c478bd9Sstevel@tonic-gate * to ire_add_v*(). It should be OK for our purpose. 11337c478bd9Sstevel@tonic-gate * 11347c478bd9Sstevel@tonic-gate * For non-temporary cached IREs, we make sure that they 11357c478bd9Sstevel@tonic-gate * have not been used for some time (defined below), they 11367c478bd9Sstevel@tonic-gate * are non-local destinations, and there is no one using 11377c478bd9Sstevel@tonic-gate * them at the moment (refcnt == 1). 11387c478bd9Sstevel@tonic-gate * 11397c478bd9Sstevel@tonic-gate * The above means that the IRE bucket length may become 11407c478bd9Sstevel@tonic-gate * very long, consisting of mostly non-temporary IREs. 11417c478bd9Sstevel@tonic-gate * This can happen when the hash function does a bad job 11427c478bd9Sstevel@tonic-gate * so that most TCP connections cluster to a specific bucket. 11437c478bd9Sstevel@tonic-gate * This "hopefully" should never happen. It can also 11447c478bd9Sstevel@tonic-gate * happen if most TCP connections have very long lives. 11457c478bd9Sstevel@tonic-gate * Even with the minimal hash table size of 256, there 11467c478bd9Sstevel@tonic-gate * has to be a lot of such connections to make the bucket 11477c478bd9Sstevel@tonic-gate * length unreasonably long. This should probably not 11487c478bd9Sstevel@tonic-gate * happen either. The third can when this can happen is 11497c478bd9Sstevel@tonic-gate * when the machine is under attack, such as SYN flooding. 11507c478bd9Sstevel@tonic-gate * TCP should already have the proper mechanism to protect 11517c478bd9Sstevel@tonic-gate * that. So we should be safe. 11527c478bd9Sstevel@tonic-gate * 11537c478bd9Sstevel@tonic-gate * This function is called by ire_add_then_send() after 11547c478bd9Sstevel@tonic-gate * a new IRE is added and the packet is sent. 11557c478bd9Sstevel@tonic-gate * 11567c478bd9Sstevel@tonic-gate * The idle cutoff interval is set to 60s. It can be 11577c478bd9Sstevel@tonic-gate * changed using /etc/system. 11587c478bd9Sstevel@tonic-gate */ 11597c478bd9Sstevel@tonic-gate uint32_t ire_idle_cutoff_interval = 60000; 11607c478bd9Sstevel@tonic-gate 11617c478bd9Sstevel@tonic-gate static void 11629a09d68dSja97890 ire_cache_cleanup(irb_t *irb, uint32_t threshold, ire_t *ref_ire) 11637c478bd9Sstevel@tonic-gate { 11647c478bd9Sstevel@tonic-gate ire_t *ire; 11657c478bd9Sstevel@tonic-gate clock_t cut_off = drv_usectohz(ire_idle_cutoff_interval * 1000); 11669a09d68dSja97890 int cnt = ip_ire_cleanup_cnt; 11677c478bd9Sstevel@tonic-gate 11687c478bd9Sstevel@tonic-gate /* 11699a09d68dSja97890 * Try to remove cnt temporary IREs first. 11707c478bd9Sstevel@tonic-gate */ 11719a09d68dSja97890 for (ire = irb->irb_ire; cnt > 0 && ire != NULL; ire = ire->ire_next) { 11729a09d68dSja97890 if (ire == ref_ire) 11739a09d68dSja97890 continue; 11747c478bd9Sstevel@tonic-gate if (ire->ire_marks & IRE_MARK_CONDEMNED) 11757c478bd9Sstevel@tonic-gate continue; 11767c478bd9Sstevel@tonic-gate if (ire->ire_marks & IRE_MARK_TEMPORARY) { 11777c478bd9Sstevel@tonic-gate ASSERT(ire->ire_type == IRE_CACHE); 11787c478bd9Sstevel@tonic-gate ire_delete(ire); 11799a09d68dSja97890 cnt--; 11807c478bd9Sstevel@tonic-gate } 11817c478bd9Sstevel@tonic-gate } 11829a09d68dSja97890 if (cnt == 0) 11839a09d68dSja97890 return; 11849a09d68dSja97890 11859a09d68dSja97890 /* 11869a09d68dSja97890 * If we didn't satisfy our removal target from temporary IREs 11879a09d68dSja97890 * we see how many non-temporary IREs are currently in the bucket. 11889a09d68dSja97890 * If this quantity is above the threshold then we see if there are any 11899a09d68dSja97890 * candidates for removal. We are still limited to removing a maximum 11909a09d68dSja97890 * of cnt IREs. 11919a09d68dSja97890 */ 11929a09d68dSja97890 if ((irb->irb_ire_cnt - irb->irb_tmp_ire_cnt) > threshold) { 11939a09d68dSja97890 for (ire = irb->irb_ire; cnt > 0 && ire != NULL; 11947c478bd9Sstevel@tonic-gate ire = ire->ire_next) { 11959a09d68dSja97890 if (ire == ref_ire) 11969a09d68dSja97890 continue; 11979a09d68dSja97890 if (ire->ire_type != IRE_CACHE) 11989a09d68dSja97890 continue; 1199f4b3ec61Sdh155122 if (ire->ire_marks & IRE_MARK_CONDEMNED) 1200f4b3ec61Sdh155122 continue; 12019a09d68dSja97890 if ((ire->ire_refcnt == 1) && 12029a09d68dSja97890 (lbolt - ire->ire_last_used_time > cut_off)) { 12037c478bd9Sstevel@tonic-gate ire_delete(ire); 12047c478bd9Sstevel@tonic-gate cnt--; 12057c478bd9Sstevel@tonic-gate } 12067c478bd9Sstevel@tonic-gate } 12077c478bd9Sstevel@tonic-gate } 12087c478bd9Sstevel@tonic-gate } 12097c478bd9Sstevel@tonic-gate 12107c478bd9Sstevel@tonic-gate /* 12117c478bd9Sstevel@tonic-gate * ire_add_then_send is called when a new IRE has been created in order to 12127c478bd9Sstevel@tonic-gate * route an outgoing packet. Typically, it is called from ip_wput when 12137c478bd9Sstevel@tonic-gate * a response comes back down from a resolver. We add the IRE, and then 12147c478bd9Sstevel@tonic-gate * possibly run the packet through ip_wput or ip_rput, as appropriate. 12157c478bd9Sstevel@tonic-gate * However, we do not add the newly created IRE in the cache when 12167c478bd9Sstevel@tonic-gate * IRE_MARK_NOADD is set in the IRE. IRE_MARK_NOADD is set at 12175c0b7edeSseb * ip_newroute_ipif(). The ires with IRE_MARK_NOADD are ire_refrele'd by 12185c0b7edeSseb * ip_wput_ire() and get deleted. 12197c478bd9Sstevel@tonic-gate * Multirouting support: the packet is silently discarded when the new IRE 12207c478bd9Sstevel@tonic-gate * holds the RTF_MULTIRT flag, but is not the first IRE to be added with the 12217c478bd9Sstevel@tonic-gate * RTF_MULTIRT flag for the same destination address. 12227c478bd9Sstevel@tonic-gate * In this case, we just want to register this additional ire without 12237c478bd9Sstevel@tonic-gate * sending the packet, as it has already been replicated through 12247c478bd9Sstevel@tonic-gate * existing multirt routes in ip_wput(). 12257c478bd9Sstevel@tonic-gate */ 12267c478bd9Sstevel@tonic-gate void 12277c478bd9Sstevel@tonic-gate ire_add_then_send(queue_t *q, ire_t *ire, mblk_t *mp) 12287c478bd9Sstevel@tonic-gate { 12297c478bd9Sstevel@tonic-gate irb_t *irb; 12307c478bd9Sstevel@tonic-gate boolean_t drop = B_FALSE; 12317c478bd9Sstevel@tonic-gate boolean_t mctl_present; 12327c478bd9Sstevel@tonic-gate mblk_t *first_mp = NULL; 1233e11c3f44Smeem mblk_t *data_mp = NULL; 12347c478bd9Sstevel@tonic-gate ire_t *dst_ire; 12357c478bd9Sstevel@tonic-gate ipha_t *ipha; 12367c478bd9Sstevel@tonic-gate ip6_t *ip6h; 1237f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 12389a09d68dSja97890 int ire_limit; 12397c478bd9Sstevel@tonic-gate 12407c478bd9Sstevel@tonic-gate if (mp != NULL) { 12417c478bd9Sstevel@tonic-gate /* 12427c478bd9Sstevel@tonic-gate * We first have to retrieve the destination address carried 12437c478bd9Sstevel@tonic-gate * by the packet. 12447c478bd9Sstevel@tonic-gate * We can't rely on ire as it can be related to a gateway. 12457c478bd9Sstevel@tonic-gate * The destination address will help in determining if 12467c478bd9Sstevel@tonic-gate * other RTF_MULTIRT ires are already registered. 12477c478bd9Sstevel@tonic-gate * 12487c478bd9Sstevel@tonic-gate * We first need to know where we are going : v4 or V6. 12497c478bd9Sstevel@tonic-gate * the ire version is enough, as there is no risk that 12507c478bd9Sstevel@tonic-gate * we resolve an IPv6 address with an IPv4 ire 12517c478bd9Sstevel@tonic-gate * or vice versa. 12527c478bd9Sstevel@tonic-gate */ 12537c478bd9Sstevel@tonic-gate EXTRACT_PKT_MP(mp, first_mp, mctl_present); 1254e11c3f44Smeem data_mp = mp; 12557c478bd9Sstevel@tonic-gate mp = first_mp; 1256e11c3f44Smeem if (ire->ire_ipversion == IPV4_VERSION) { 1257e11c3f44Smeem ipha = (ipha_t *)data_mp->b_rptr; 12587c478bd9Sstevel@tonic-gate dst_ire = ire_cache_lookup(ipha->ipha_dst, 1259de8c4a14SErik Nordmark ire->ire_zoneid, msg_getlabel(mp), ipst); 12607c478bd9Sstevel@tonic-gate } else { 1261c793af95Ssangeeta ASSERT(ire->ire_ipversion == IPV6_VERSION); 1262e11c3f44Smeem ip6h = (ip6_t *)data_mp->b_rptr; 12637c478bd9Sstevel@tonic-gate dst_ire = ire_cache_lookup_v6(&ip6h->ip6_dst, 1264de8c4a14SErik Nordmark ire->ire_zoneid, msg_getlabel(mp), ipst); 12657c478bd9Sstevel@tonic-gate } 12667c478bd9Sstevel@tonic-gate if (dst_ire != NULL) { 12677c478bd9Sstevel@tonic-gate if (dst_ire->ire_flags & RTF_MULTIRT) { 12687c478bd9Sstevel@tonic-gate /* 12697c478bd9Sstevel@tonic-gate * At least one resolved multirt route 12707c478bd9Sstevel@tonic-gate * already exists for the destination, 12717c478bd9Sstevel@tonic-gate * don't sent this packet: either drop it 12727c478bd9Sstevel@tonic-gate * or complete the pending resolution, 12737c478bd9Sstevel@tonic-gate * depending on the ire. 12747c478bd9Sstevel@tonic-gate */ 12757c478bd9Sstevel@tonic-gate drop = B_TRUE; 12767c478bd9Sstevel@tonic-gate } 12777c478bd9Sstevel@tonic-gate ip1dbg(("ire_add_then_send: dst_ire %p " 12787c478bd9Sstevel@tonic-gate "[dst %08x, gw %08x], drop %d\n", 12797c478bd9Sstevel@tonic-gate (void *)dst_ire, 12807c478bd9Sstevel@tonic-gate (dst_ire->ire_ipversion == IPV4_VERSION) ? \ 12817c478bd9Sstevel@tonic-gate ntohl(dst_ire->ire_addr) : \ 12827c478bd9Sstevel@tonic-gate ntohl(V4_PART_OF_V6(dst_ire->ire_addr_v6)), 12837c478bd9Sstevel@tonic-gate (dst_ire->ire_ipversion == IPV4_VERSION) ? \ 12847c478bd9Sstevel@tonic-gate ntohl(dst_ire->ire_gateway_addr) : \ 12857c478bd9Sstevel@tonic-gate ntohl(V4_PART_OF_V6( 12867c478bd9Sstevel@tonic-gate dst_ire->ire_gateway_addr_v6)), 12877c478bd9Sstevel@tonic-gate drop)); 12887c478bd9Sstevel@tonic-gate ire_refrele(dst_ire); 12897c478bd9Sstevel@tonic-gate } 12907c478bd9Sstevel@tonic-gate } 12917c478bd9Sstevel@tonic-gate 12927c478bd9Sstevel@tonic-gate if (!(ire->ire_marks & IRE_MARK_NOADD)) { 12935c0b7edeSseb /* Regular packets with cache bound ires are here. */ 1294c793af95Ssangeeta (void) ire_add(&ire, NULL, NULL, NULL, B_FALSE); 12957c478bd9Sstevel@tonic-gate 12967c478bd9Sstevel@tonic-gate if (ire == NULL) { 12977c478bd9Sstevel@tonic-gate mp->b_prev = NULL; 12987c478bd9Sstevel@tonic-gate mp->b_next = NULL; 12997c478bd9Sstevel@tonic-gate MULTIRT_DEBUG_UNTAG(mp); 13007c478bd9Sstevel@tonic-gate freemsg(mp); 13017c478bd9Sstevel@tonic-gate return; 13027c478bd9Sstevel@tonic-gate } 13037c478bd9Sstevel@tonic-gate if (mp == NULL) { 13047c478bd9Sstevel@tonic-gate ire_refrele(ire); /* Held in ire_add_v4/v6 */ 13057c478bd9Sstevel@tonic-gate return; 13067c478bd9Sstevel@tonic-gate } 13077c478bd9Sstevel@tonic-gate } 13087c478bd9Sstevel@tonic-gate if (drop) { 13097c478bd9Sstevel@tonic-gate /* 13107c478bd9Sstevel@tonic-gate * If we're adding an RTF_MULTIRT ire, the resolution 13117c478bd9Sstevel@tonic-gate * is over: we just drop the packet. 13127c478bd9Sstevel@tonic-gate */ 13137c478bd9Sstevel@tonic-gate if (ire->ire_flags & RTF_MULTIRT) { 1314e11c3f44Smeem data_mp->b_prev = NULL; 1315e11c3f44Smeem data_mp->b_next = NULL; 13167c478bd9Sstevel@tonic-gate MULTIRT_DEBUG_UNTAG(mp); 13177c478bd9Sstevel@tonic-gate freemsg(mp); 13187c478bd9Sstevel@tonic-gate } else { 13197c478bd9Sstevel@tonic-gate /* 13207c478bd9Sstevel@tonic-gate * Otherwise, we're adding the ire to a gateway 13217c478bd9Sstevel@tonic-gate * for a multirt route. 13227c478bd9Sstevel@tonic-gate * Invoke ip_newroute() to complete the resolution 13237c478bd9Sstevel@tonic-gate * of the route. We will then come back here and 13247c478bd9Sstevel@tonic-gate * finally drop this packet in the above code. 13257c478bd9Sstevel@tonic-gate */ 13267c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV4_VERSION) { 13277c478bd9Sstevel@tonic-gate /* 13287c478bd9Sstevel@tonic-gate * TODO: in order for CGTP to work in non-global 13297c478bd9Sstevel@tonic-gate * zones, ip_newroute() must create the IRE 13307c478bd9Sstevel@tonic-gate * cache in the zone indicated by 13317c478bd9Sstevel@tonic-gate * ire->ire_zoneid. 13327c478bd9Sstevel@tonic-gate */ 13335c0b7edeSseb ip_newroute(q, mp, ipha->ipha_dst, 13345597b60aSnordmark (CONN_Q(q) ? Q_TO_CONN(q) : NULL), 1335f4b3ec61Sdh155122 ire->ire_zoneid, ipst); 13367c478bd9Sstevel@tonic-gate } else { 1337e11c3f44Smeem int minlen = sizeof (ip6i_t) + IPV6_HDR_LEN; 1338e11c3f44Smeem 1339c793af95Ssangeeta ASSERT(ire->ire_ipversion == IPV6_VERSION); 1340e11c3f44Smeem 1341e11c3f44Smeem /* 1342e11c3f44Smeem * If necessary, skip over the ip6i_t to find 1343e11c3f44Smeem * the header with the actual source address. 1344e11c3f44Smeem */ 1345e11c3f44Smeem if (ip6h->ip6_nxt == IPPROTO_RAW) { 1346e11c3f44Smeem if (MBLKL(data_mp) < minlen && 1347e11c3f44Smeem pullupmsg(data_mp, -1) == 0) { 1348e11c3f44Smeem ip1dbg(("ire_add_then_send: " 1349e11c3f44Smeem "cannot pullupmsg ip6i\n")); 1350e11c3f44Smeem if (mctl_present) 1351e11c3f44Smeem freeb(first_mp); 1352e11c3f44Smeem ire_refrele(ire); 1353e11c3f44Smeem return; 1354e11c3f44Smeem } 1355e11c3f44Smeem ASSERT(MBLKL(data_mp) >= IPV6_HDR_LEN); 1356e11c3f44Smeem ip6h = (ip6_t *)(data_mp->b_rptr + 1357e11c3f44Smeem sizeof (ip6i_t)); 1358e11c3f44Smeem } 1359e11c3f44Smeem ip_newroute_v6(q, mp, &ip6h->ip6_dst, 1360e11c3f44Smeem &ip6h->ip6_src, NULL, ire->ire_zoneid, 1361e11c3f44Smeem ipst); 13627c478bd9Sstevel@tonic-gate } 13637c478bd9Sstevel@tonic-gate } 13647c478bd9Sstevel@tonic-gate 13657c478bd9Sstevel@tonic-gate ire_refrele(ire); /* As done by ire_send(). */ 13667c478bd9Sstevel@tonic-gate return; 13677c478bd9Sstevel@tonic-gate } 13687c478bd9Sstevel@tonic-gate /* 13697c478bd9Sstevel@tonic-gate * Need to remember ire_bucket here as ire_send*() may delete 13707c478bd9Sstevel@tonic-gate * the ire so we cannot reference it after that. 13717c478bd9Sstevel@tonic-gate */ 13727c478bd9Sstevel@tonic-gate irb = ire->ire_bucket; 13739a09d68dSja97890 if (ire->ire_ipversion == IPV4_VERSION) { 13747c478bd9Sstevel@tonic-gate ire_send(q, mp, ire); 13759a09d68dSja97890 ire_limit = ip_ire_max_bucket_cnt; 13769a09d68dSja97890 } else { 13779a09d68dSja97890 ire_send_v6(q, mp, ire); 13789a09d68dSja97890 ire_limit = ip6_ire_max_bucket_cnt; 13799a09d68dSja97890 } 13809a09d68dSja97890 13819a09d68dSja97890 /* 13829a09d68dSja97890 * irb is NULL if the IRE was not added to the hash. This happens 13839a09d68dSja97890 * when IRE_MARK_NOADD is set and when IREs are returned from 13849a09d68dSja97890 * ire_update_srcif_v4(). 13859a09d68dSja97890 */ 13869a09d68dSja97890 if (irb != NULL) { 13879a09d68dSja97890 IRB_REFHOLD(irb); 13889a09d68dSja97890 if (irb->irb_ire_cnt > ire_limit) 13899a09d68dSja97890 ire_cache_cleanup(irb, ire_limit, ire); 13909a09d68dSja97890 IRB_REFRELE(irb); 13917c478bd9Sstevel@tonic-gate } 13927c478bd9Sstevel@tonic-gate } 13937c478bd9Sstevel@tonic-gate 13947c478bd9Sstevel@tonic-gate /* 13957c478bd9Sstevel@tonic-gate * Initialize the ire that is specific to IPv4 part and call 13967c478bd9Sstevel@tonic-gate * ire_init_common to finish it. 13977c478bd9Sstevel@tonic-gate */ 13987c478bd9Sstevel@tonic-gate ire_t * 13997c478bd9Sstevel@tonic-gate ire_init(ire_t *ire, uchar_t *addr, uchar_t *mask, uchar_t *src_addr, 14005c0b7edeSseb uchar_t *gateway, uint_t *max_fragp, nce_t *src_nce, queue_t *rfq, 14015c0b7edeSseb queue_t *stq, ushort_t type, ipif_t *ipif, ipaddr_t cmask, uint32_t phandle, 14025c0b7edeSseb uint32_t ihandle, uint32_t flags, const iulp_t *ulp_info, tsol_gc_t *gc, 14035c0b7edeSseb tsol_gcgrp_t *gcgrp, ip_stack_t *ipst) 14047c478bd9Sstevel@tonic-gate { 140542ee8d71Sja97890 ASSERT(type != IRE_CACHE || stq != NULL); 140645916cd2Sjpk /* 140745916cd2Sjpk * Reject IRE security attribute creation/initialization 140845916cd2Sjpk * if system is not running in Trusted mode. 140945916cd2Sjpk */ 141045916cd2Sjpk if ((gc != NULL || gcgrp != NULL) && !is_system_labeled()) 141145916cd2Sjpk return (NULL); 141245916cd2Sjpk 1413f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_alloced); 14147c478bd9Sstevel@tonic-gate 14157c478bd9Sstevel@tonic-gate if (addr != NULL) 14167c478bd9Sstevel@tonic-gate bcopy(addr, &ire->ire_addr, IP_ADDR_LEN); 14177c478bd9Sstevel@tonic-gate if (src_addr != NULL) 14187c478bd9Sstevel@tonic-gate bcopy(src_addr, &ire->ire_src_addr, IP_ADDR_LEN); 14197c478bd9Sstevel@tonic-gate if (mask != NULL) { 14207c478bd9Sstevel@tonic-gate bcopy(mask, &ire->ire_mask, IP_ADDR_LEN); 14217c478bd9Sstevel@tonic-gate ire->ire_masklen = ip_mask_to_plen(ire->ire_mask); 14227c478bd9Sstevel@tonic-gate } 14237c478bd9Sstevel@tonic-gate if (gateway != NULL) { 14247c478bd9Sstevel@tonic-gate bcopy(gateway, &ire->ire_gateway_addr, IP_ADDR_LEN); 14257c478bd9Sstevel@tonic-gate } 14267c478bd9Sstevel@tonic-gate 14277c478bd9Sstevel@tonic-gate if (type == IRE_CACHE) 14287c478bd9Sstevel@tonic-gate ire->ire_cmask = cmask; 14297c478bd9Sstevel@tonic-gate 143045916cd2Sjpk /* ire_init_common will free the mblks upon encountering any failure */ 14315c0b7edeSseb if (!ire_init_common(ire, max_fragp, src_nce, rfq, stq, type, ipif, 14325c0b7edeSseb phandle, ihandle, flags, IPV4_VERSION, ulp_info, gc, gcgrp, ipst)) 143345916cd2Sjpk return (NULL); 14347c478bd9Sstevel@tonic-gate 14357c478bd9Sstevel@tonic-gate return (ire); 14367c478bd9Sstevel@tonic-gate } 14377c478bd9Sstevel@tonic-gate 14387c478bd9Sstevel@tonic-gate /* 14397c478bd9Sstevel@tonic-gate * Similar to ire_create except that it is called only when 14407c478bd9Sstevel@tonic-gate * we want to allocate ire as an mblk e.g. we have an external 14417c478bd9Sstevel@tonic-gate * resolver ARP. 14427c478bd9Sstevel@tonic-gate */ 14437c478bd9Sstevel@tonic-gate ire_t * 14447c478bd9Sstevel@tonic-gate ire_create_mp(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway, 14455c0b7edeSseb uint_t max_frag, nce_t *src_nce, queue_t *rfq, queue_t *stq, ushort_t type, 14465c0b7edeSseb ipif_t *ipif, ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, 14475c0b7edeSseb uint32_t flags, const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp, 1448f4b3ec61Sdh155122 ip_stack_t *ipst) 14497c478bd9Sstevel@tonic-gate { 1450c793af95Ssangeeta ire_t *ire, *buf; 14517c478bd9Sstevel@tonic-gate ire_t *ret_ire; 14527c478bd9Sstevel@tonic-gate mblk_t *mp; 1453c793af95Ssangeeta size_t bufsize; 1454c793af95Ssangeeta frtn_t *frtnp; 1455c793af95Ssangeeta ill_t *ill; 14567c478bd9Sstevel@tonic-gate 1457c793af95Ssangeeta bufsize = sizeof (ire_t) + sizeof (frtn_t); 1458c793af95Ssangeeta buf = kmem_alloc(bufsize, KM_NOSLEEP); 1459c793af95Ssangeeta if (buf == NULL) { 14607c478bd9Sstevel@tonic-gate ip1dbg(("ire_create_mp: alloc failed\n")); 14617c478bd9Sstevel@tonic-gate return (NULL); 14627c478bd9Sstevel@tonic-gate } 1463c793af95Ssangeeta frtnp = (frtn_t *)(buf + 1); 1464c793af95Ssangeeta frtnp->free_arg = (caddr_t)buf; 1465c793af95Ssangeeta frtnp->free_func = ire_freemblk; 14667c478bd9Sstevel@tonic-gate 1467c793af95Ssangeeta /* 1468c793af95Ssangeeta * Allocate the new IRE. The ire created will hold a ref on 1469c793af95Ssangeeta * an nce_t after ire_nce_init, and this ref must either be 1470c793af95Ssangeeta * (a) transferred to the ire_cache entry created when ire_add_v4 1471c793af95Ssangeeta * is called after successful arp resolution, or, 1472c793af95Ssangeeta * (b) released, when arp resolution fails 1473c793af95Ssangeeta * Case (b) is handled in ire_freemblk() which will be called 1474c793af95Ssangeeta * when mp is freed as a result of failed arp. 1475c793af95Ssangeeta */ 1476c793af95Ssangeeta mp = esballoc((unsigned char *)buf, bufsize, BPRI_MED, frtnp); 1477c793af95Ssangeeta if (mp == NULL) { 1478c793af95Ssangeeta ip1dbg(("ire_create_mp: alloc failed\n")); 1479c793af95Ssangeeta kmem_free(buf, bufsize); 1480c793af95Ssangeeta return (NULL); 1481c793af95Ssangeeta } 14827c478bd9Sstevel@tonic-gate ire = (ire_t *)mp->b_rptr; 14837c478bd9Sstevel@tonic-gate mp->b_wptr = (uchar_t *)&ire[1]; 14847c478bd9Sstevel@tonic-gate 14857c478bd9Sstevel@tonic-gate /* Start clean. */ 14867c478bd9Sstevel@tonic-gate *ire = ire_null; 14877c478bd9Sstevel@tonic-gate ire->ire_mp = mp; 14887c478bd9Sstevel@tonic-gate mp->b_datap->db_type = IRE_DB_TYPE; 1489c793af95Ssangeeta ire->ire_marks |= IRE_MARK_UNCACHED; 14907c478bd9Sstevel@tonic-gate 14915c0b7edeSseb ret_ire = ire_init(ire, addr, mask, src_addr, gateway, NULL, src_nce, 14925c0b7edeSseb rfq, stq, type, ipif, cmask, phandle, ihandle, flags, ulp_info, gc, 14935c0b7edeSseb gcgrp, ipst); 14947c478bd9Sstevel@tonic-gate 149553bec8caSsowmini ill = (ill_t *)(stq->q_ptr); 14967c478bd9Sstevel@tonic-gate if (ret_ire == NULL) { 1497f4b3ec61Sdh155122 /* ire_freemblk needs these set */ 149853bec8caSsowmini ire->ire_stq_ifindex = ill->ill_phyint->phyint_ifindex; 14991bf5e2aeSSowmini Varadhan ire->ire_stackid = ipst->ips_netstack->netstack_stackid; 1500f4b3ec61Sdh155122 ire->ire_ipst = ipst; 15017c478bd9Sstevel@tonic-gate freeb(ire->ire_mp); 15027c478bd9Sstevel@tonic-gate return (NULL); 15037c478bd9Sstevel@tonic-gate } 1504c793af95Ssangeeta ret_ire->ire_stq_ifindex = ill->ill_phyint->phyint_ifindex; 15051bf5e2aeSSowmini Varadhan ret_ire->ire_stackid = ipst->ips_netstack->netstack_stackid; 15067c478bd9Sstevel@tonic-gate ASSERT(ret_ire == ire); 15071bf5e2aeSSowmini Varadhan ASSERT(ret_ire->ire_ipst == ipst); 15087c478bd9Sstevel@tonic-gate /* 15097c478bd9Sstevel@tonic-gate * ire_max_frag is normally zero here and is atomically set 15107c478bd9Sstevel@tonic-gate * under the irebucket lock in ire_add_v[46] except for the 15117c478bd9Sstevel@tonic-gate * case of IRE_MARK_NOADD. In that event the the ire_max_frag 15127c478bd9Sstevel@tonic-gate * is non-zero here. 15137c478bd9Sstevel@tonic-gate */ 15147c478bd9Sstevel@tonic-gate ire->ire_max_frag = max_frag; 15157c478bd9Sstevel@tonic-gate return (ire); 15167c478bd9Sstevel@tonic-gate } 15177c478bd9Sstevel@tonic-gate 15187c478bd9Sstevel@tonic-gate /* 15197c478bd9Sstevel@tonic-gate * ire_create is called to allocate and initialize a new IRE. 15207c478bd9Sstevel@tonic-gate * 15217c478bd9Sstevel@tonic-gate * NOTE : This is called as writer sometimes though not required 15227c478bd9Sstevel@tonic-gate * by this function. 15237c478bd9Sstevel@tonic-gate */ 15247c478bd9Sstevel@tonic-gate ire_t * 15257c478bd9Sstevel@tonic-gate ire_create(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway, 15265c0b7edeSseb uint_t *max_fragp, nce_t *src_nce, queue_t *rfq, queue_t *stq, 15275c0b7edeSseb ushort_t type, ipif_t *ipif, ipaddr_t cmask, uint32_t phandle, 15285c0b7edeSseb uint32_t ihandle, uint32_t flags, const iulp_t *ulp_info, tsol_gc_t *gc, 15295c0b7edeSseb tsol_gcgrp_t *gcgrp, ip_stack_t *ipst) 15307c478bd9Sstevel@tonic-gate { 15317c478bd9Sstevel@tonic-gate ire_t *ire; 15327c478bd9Sstevel@tonic-gate ire_t *ret_ire; 15337c478bd9Sstevel@tonic-gate 15347c478bd9Sstevel@tonic-gate ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP); 15357c478bd9Sstevel@tonic-gate if (ire == NULL) { 15367c478bd9Sstevel@tonic-gate ip1dbg(("ire_create: alloc failed\n")); 15377c478bd9Sstevel@tonic-gate return (NULL); 15387c478bd9Sstevel@tonic-gate } 15397c478bd9Sstevel@tonic-gate *ire = ire_null; 15407c478bd9Sstevel@tonic-gate 15415c0b7edeSseb ret_ire = ire_init(ire, addr, mask, src_addr, gateway, max_fragp, 15425c0b7edeSseb src_nce, rfq, stq, type, ipif, cmask, phandle, ihandle, flags, 15435c0b7edeSseb ulp_info, gc, gcgrp, ipst); 15447c478bd9Sstevel@tonic-gate 15457c478bd9Sstevel@tonic-gate if (ret_ire == NULL) { 15467c478bd9Sstevel@tonic-gate kmem_cache_free(ire_cache, ire); 15477c478bd9Sstevel@tonic-gate return (NULL); 15487c478bd9Sstevel@tonic-gate } 15497c478bd9Sstevel@tonic-gate ASSERT(ret_ire == ire); 15507c478bd9Sstevel@tonic-gate return (ire); 15517c478bd9Sstevel@tonic-gate } 15527c478bd9Sstevel@tonic-gate 15537c478bd9Sstevel@tonic-gate /* 15547c478bd9Sstevel@tonic-gate * Common to IPv4 and IPv6 15557c478bd9Sstevel@tonic-gate */ 155645916cd2Sjpk boolean_t 155754da8755Ssowmini ire_init_common(ire_t *ire, uint_t *max_fragp, nce_t *src_nce, queue_t *rfq, 15585c0b7edeSseb queue_t *stq, ushort_t type, ipif_t *ipif, uint32_t phandle, 155954da8755Ssowmini uint32_t ihandle, uint32_t flags, uchar_t ipversion, const iulp_t *ulp_info, 156054da8755Ssowmini tsol_gc_t *gc, tsol_gcgrp_t *gcgrp, ip_stack_t *ipst) 15617c478bd9Sstevel@tonic-gate { 15627c478bd9Sstevel@tonic-gate ire->ire_max_fragp = max_fragp; 1563f4b3ec61Sdh155122 ire->ire_frag_flag |= (ipst->ips_ip_path_mtu_discovery) ? IPH_DF : 0; 15647c478bd9Sstevel@tonic-gate 156545916cd2Sjpk #ifdef DEBUG 156645916cd2Sjpk if (ipif != NULL) { 15677c478bd9Sstevel@tonic-gate if (ipif->ipif_isv6) 15687c478bd9Sstevel@tonic-gate ASSERT(ipversion == IPV6_VERSION); 15697c478bd9Sstevel@tonic-gate else 15707c478bd9Sstevel@tonic-gate ASSERT(ipversion == IPV4_VERSION); 15717c478bd9Sstevel@tonic-gate } 157245916cd2Sjpk #endif /* DEBUG */ 157345916cd2Sjpk 157445916cd2Sjpk /* 157545916cd2Sjpk * Create/initialize IRE security attribute only in Trusted mode; 157645916cd2Sjpk * if the passed in gc/gcgrp is non-NULL, we expect that the caller 157745916cd2Sjpk * has held a reference to it and will release it when this routine 157845916cd2Sjpk * returns a failure, otherwise we own the reference. We do this 157945916cd2Sjpk * prior to initializing the rest IRE fields. 1580dc3879f9Sjarrett * 1581dc3879f9Sjarrett * Don't allocate ire_gw_secattr for the resolver case to prevent 1582dc3879f9Sjarrett * memory leak (in case of external resolution failure). We'll 1583dc3879f9Sjarrett * allocate it after a successful external resolution, in ire_add(). 1584dc3879f9Sjarrett * Note that ire->ire_mp != NULL here means this ire is headed 1585dc3879f9Sjarrett * to an external resolver. 158645916cd2Sjpk */ 158745916cd2Sjpk if (is_system_labeled()) { 158845916cd2Sjpk if ((type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST | 158945916cd2Sjpk IRE_INTERFACE)) != 0) { 159045916cd2Sjpk /* release references on behalf of caller */ 159145916cd2Sjpk if (gc != NULL) 159245916cd2Sjpk GC_REFRELE(gc); 159345916cd2Sjpk if (gcgrp != NULL) 159445916cd2Sjpk GCGRP_REFRELE(gcgrp); 1595dc3879f9Sjarrett } else if ((ire->ire_mp == NULL) && 1596dc3879f9Sjarrett tsol_ire_init_gwattr(ire, ipversion, gc, gcgrp) != 0) { 159745916cd2Sjpk return (B_FALSE); 159845916cd2Sjpk } 159945916cd2Sjpk } 16007c478bd9Sstevel@tonic-gate 16017c478bd9Sstevel@tonic-gate ire->ire_stq = stq; 16027c478bd9Sstevel@tonic-gate ire->ire_rfq = rfq; 16037c478bd9Sstevel@tonic-gate ire->ire_type = type; 16047c478bd9Sstevel@tonic-gate ire->ire_flags = RTF_UP | flags; 16057c478bd9Sstevel@tonic-gate ire->ire_ident = TICK_TO_MSEC(lbolt); 16067c478bd9Sstevel@tonic-gate bcopy(ulp_info, &ire->ire_uinfo, sizeof (iulp_t)); 16077c478bd9Sstevel@tonic-gate 16087c478bd9Sstevel@tonic-gate ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count; 16097c478bd9Sstevel@tonic-gate ire->ire_last_used_time = lbolt; 16107c478bd9Sstevel@tonic-gate ire->ire_create_time = (uint32_t)gethrestime_sec(); 16117c478bd9Sstevel@tonic-gate 16127c478bd9Sstevel@tonic-gate /* 16137c478bd9Sstevel@tonic-gate * If this IRE is an IRE_CACHE, inherit the handles from the 16147c478bd9Sstevel@tonic-gate * parent IREs. For others in the forwarding table, assign appropriate 16157c478bd9Sstevel@tonic-gate * new ones. 16167c478bd9Sstevel@tonic-gate * 16177c478bd9Sstevel@tonic-gate * The mutex protecting ire_handle is because ire_create is not always 16187c478bd9Sstevel@tonic-gate * called as a writer. 16197c478bd9Sstevel@tonic-gate */ 16207c478bd9Sstevel@tonic-gate if (ire->ire_type & IRE_OFFSUBNET) { 1621f4b3ec61Sdh155122 mutex_enter(&ipst->ips_ire_handle_lock); 1622f4b3ec61Sdh155122 ire->ire_phandle = (uint32_t)ipst->ips_ire_handle++; 1623f4b3ec61Sdh155122 mutex_exit(&ipst->ips_ire_handle_lock); 16247c478bd9Sstevel@tonic-gate } else if (ire->ire_type & IRE_INTERFACE) { 1625f4b3ec61Sdh155122 mutex_enter(&ipst->ips_ire_handle_lock); 1626f4b3ec61Sdh155122 ire->ire_ihandle = (uint32_t)ipst->ips_ire_handle++; 1627f4b3ec61Sdh155122 mutex_exit(&ipst->ips_ire_handle_lock); 16287c478bd9Sstevel@tonic-gate } else if (ire->ire_type == IRE_CACHE) { 16297c478bd9Sstevel@tonic-gate ire->ire_phandle = phandle; 16307c478bd9Sstevel@tonic-gate ire->ire_ihandle = ihandle; 16317c478bd9Sstevel@tonic-gate } 16327c478bd9Sstevel@tonic-gate ire->ire_ipif = ipif; 16337c478bd9Sstevel@tonic-gate if (ipif != NULL) { 16347c478bd9Sstevel@tonic-gate ire->ire_ipif_seqid = ipif->ipif_seqid; 16355b17e9bdSJon Anderson ire->ire_ipif_ifindex = 16365b17e9bdSJon Anderson ipif->ipif_ill->ill_phyint->phyint_ifindex; 16377c478bd9Sstevel@tonic-gate ire->ire_zoneid = ipif->ipif_zoneid; 16387c478bd9Sstevel@tonic-gate } else { 16397c478bd9Sstevel@tonic-gate ire->ire_zoneid = GLOBAL_ZONEID; 16407c478bd9Sstevel@tonic-gate } 16417c478bd9Sstevel@tonic-gate ire->ire_ipversion = ipversion; 16427c478bd9Sstevel@tonic-gate mutex_init(&ire->ire_lock, NULL, MUTEX_DEFAULT, NULL); 1643c793af95Ssangeeta if (ipversion == IPV4_VERSION) { 164454da8755Ssowmini /* 164554da8755Ssowmini * IPv6 initializes the ire_nce in ire_add_v6, which expects 164654da8755Ssowmini * to find the ire_nce to be null when it is called. 164754da8755Ssowmini */ 164854da8755Ssowmini if (ire_nce_init(ire, src_nce) != 0) { 1649c793af95Ssangeeta /* some failure occurred. propagate error back */ 1650c793af95Ssangeeta return (B_FALSE); 1651c793af95Ssangeeta } 1652c793af95Ssangeeta } 1653c793af95Ssangeeta ire->ire_refcnt = 1; 1654f4b3ec61Sdh155122 ire->ire_ipst = ipst; /* No netstack_hold */ 16556a8288c7Scarlsonj ire->ire_trace_disable = B_FALSE; 165645916cd2Sjpk 165745916cd2Sjpk return (B_TRUE); 16587c478bd9Sstevel@tonic-gate } 16597c478bd9Sstevel@tonic-gate 16607c478bd9Sstevel@tonic-gate /* 16617c478bd9Sstevel@tonic-gate * This routine is called repeatedly by ipif_up to create broadcast IREs. 16627c478bd9Sstevel@tonic-gate * It is passed a pointer to a slot in an IRE pointer array into which to 16637c478bd9Sstevel@tonic-gate * place the pointer to the new IRE, if indeed we create one. If the 16647c478bd9Sstevel@tonic-gate * IRE corresponding to the address passed in would be a duplicate of an 16657c478bd9Sstevel@tonic-gate * existing one, we don't create the new one. irep is incremented before 16667c478bd9Sstevel@tonic-gate * return only if we do create a new IRE. (Always called as writer.) 16677c478bd9Sstevel@tonic-gate * 16687c478bd9Sstevel@tonic-gate * Note that with the "match_flags" parameter, we can match on either 16697c478bd9Sstevel@tonic-gate * a particular logical interface (MATCH_IRE_IPIF) or for all logical 16707c478bd9Sstevel@tonic-gate * interfaces for a given physical interface (MATCH_IRE_ILL). Currently, 16717c478bd9Sstevel@tonic-gate * we only create broadcast ire's on a per physical interface basis. If 16727c478bd9Sstevel@tonic-gate * someone is going to be mucking with logical interfaces, it is important 16737c478bd9Sstevel@tonic-gate * to call "ipif_check_bcast_ires()" to make sure that any change to a 16747c478bd9Sstevel@tonic-gate * logical interface will not cause critical broadcast IRE's to be deleted. 16757c478bd9Sstevel@tonic-gate */ 16767c478bd9Sstevel@tonic-gate ire_t ** 16777c478bd9Sstevel@tonic-gate ire_check_and_create_bcast(ipif_t *ipif, ipaddr_t addr, ire_t **irep, 16787c478bd9Sstevel@tonic-gate int match_flags) 16797c478bd9Sstevel@tonic-gate { 16807c478bd9Sstevel@tonic-gate ire_t *ire; 16817c478bd9Sstevel@tonic-gate uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST; 1682e11c3f44Smeem boolean_t prefer; 1683e11c3f44Smeem ill_t *ill = ipif->ipif_ill; 1684e11c3f44Smeem ip_stack_t *ipst = ill->ill_ipst; 16857c478bd9Sstevel@tonic-gate 16867c478bd9Sstevel@tonic-gate /* 16877c478bd9Sstevel@tonic-gate * No broadcast IREs for the LOOPBACK interface 16887c478bd9Sstevel@tonic-gate * or others such as point to point and IPIF_NOXMIT. 16897c478bd9Sstevel@tonic-gate */ 16907c478bd9Sstevel@tonic-gate if (!(ipif->ipif_flags & IPIF_BROADCAST) || 16917c478bd9Sstevel@tonic-gate (ipif->ipif_flags & IPIF_NOXMIT)) 16927c478bd9Sstevel@tonic-gate return (irep); 16937c478bd9Sstevel@tonic-gate 1694e11c3f44Smeem /* 1695e11c3f44Smeem * If this new IRE would be a duplicate, only prefer it if one of 1696e11c3f44Smeem * the following is true: 1697e11c3f44Smeem * 1698e11c3f44Smeem * 1. The existing one has IPIF_DEPRECATED|IPIF_LOCAL|IPIF_ANYCAST 1699e11c3f44Smeem * set and the new one has all of those clear. 1700e11c3f44Smeem * 1701e11c3f44Smeem * 2. The existing one corresponds to an underlying ILL in an IPMP 1702e11c3f44Smeem * group and the new one corresponds to an IPMP group interface. 1703e11c3f44Smeem */ 17047c478bd9Sstevel@tonic-gate if ((ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ipif, 1705f4b3ec61Sdh155122 ipif->ipif_zoneid, NULL, match_flags, ipst)) != NULL) { 1706e11c3f44Smeem prefer = ((ire->ire_ipif->ipif_flags & check_flags) && 1707e11c3f44Smeem !(ipif->ipif_flags & check_flags)) || 1708e11c3f44Smeem (IS_UNDER_IPMP(ire->ire_ipif->ipif_ill) && IS_IPMP(ill)); 1709e11c3f44Smeem if (!prefer) { 17107c478bd9Sstevel@tonic-gate ire_refrele(ire); 17117c478bd9Sstevel@tonic-gate return (irep); 17127c478bd9Sstevel@tonic-gate } 1713e11c3f44Smeem 17147c478bd9Sstevel@tonic-gate /* 17157c478bd9Sstevel@tonic-gate * Bcast ires exist in pairs. Both have to be deleted, 17167c478bd9Sstevel@tonic-gate * Since we are exclusive we can make the above assertion. 17177c478bd9Sstevel@tonic-gate * The 1st has to be refrele'd since it was ctable_lookup'd. 17187c478bd9Sstevel@tonic-gate */ 17197c478bd9Sstevel@tonic-gate ASSERT(IAM_WRITER_IPIF(ipif)); 17207c478bd9Sstevel@tonic-gate ASSERT(ire->ire_next->ire_addr == ire->ire_addr); 17217c478bd9Sstevel@tonic-gate ire_delete(ire->ire_next); 17227c478bd9Sstevel@tonic-gate ire_delete(ire); 17237c478bd9Sstevel@tonic-gate ire_refrele(ire); 17247c478bd9Sstevel@tonic-gate } 1725e11c3f44Smeem return (ire_create_bcast(ipif, addr, irep)); 17267c478bd9Sstevel@tonic-gate } 17277c478bd9Sstevel@tonic-gate 17287c478bd9Sstevel@tonic-gate uint_t ip_loopback_mtu = IP_LOOPBACK_MTU; 17297c478bd9Sstevel@tonic-gate 17307c478bd9Sstevel@tonic-gate /* 17317c478bd9Sstevel@tonic-gate * This routine is called from ipif_check_bcast_ires and ire_check_bcast. 17327c478bd9Sstevel@tonic-gate * It leaves all the verifying and deleting to those routines. So it always 17337c478bd9Sstevel@tonic-gate * creates 2 bcast ires and chains them into the ire array passed in. 17347c478bd9Sstevel@tonic-gate */ 17357c478bd9Sstevel@tonic-gate ire_t ** 17367c478bd9Sstevel@tonic-gate ire_create_bcast(ipif_t *ipif, ipaddr_t addr, ire_t **irep) 17377c478bd9Sstevel@tonic-gate { 1738f4b3ec61Sdh155122 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 1739e11c3f44Smeem ill_t *ill = ipif->ipif_ill; 1740e11c3f44Smeem 1741e11c3f44Smeem ASSERT(IAM_WRITER_IPIF(ipif)); 1742e11c3f44Smeem 1743e11c3f44Smeem if (IS_IPMP(ill)) { 1744e11c3f44Smeem /* 1745e11c3f44Smeem * Broadcast IREs for the IPMP meta-interface use the 1746e11c3f44Smeem * nominated broadcast interface to send and receive packets. 1747e11c3f44Smeem * If there's no nominated interface, send the packets down to 1748e11c3f44Smeem * the IPMP stub driver, which will discard them. If the 1749e11c3f44Smeem * nominated broadcast interface changes, ill_refresh_bcast() 1750e11c3f44Smeem * will refresh the broadcast IREs. 1751e11c3f44Smeem */ 1752e11c3f44Smeem if ((ill = ipmp_illgrp_cast_ill(ill->ill_grp)) == NULL) 1753e11c3f44Smeem ill = ipif->ipif_ill; 1754e11c3f44Smeem } 1755f4b3ec61Sdh155122 17567c478bd9Sstevel@tonic-gate *irep++ = ire_create( 17577c478bd9Sstevel@tonic-gate (uchar_t *)&addr, /* dest addr */ 17587c478bd9Sstevel@tonic-gate (uchar_t *)&ip_g_all_ones, /* mask */ 17597c478bd9Sstevel@tonic-gate (uchar_t *)&ipif->ipif_src_addr, /* source addr */ 17607c478bd9Sstevel@tonic-gate NULL, /* no gateway */ 17617c478bd9Sstevel@tonic-gate &ipif->ipif_mtu, /* max frag */ 176254da8755Ssowmini NULL, /* no src nce */ 1763e11c3f44Smeem ill->ill_rq, /* recv-from queue */ 1764e11c3f44Smeem ill->ill_wq, /* send-to queue */ 17657c478bd9Sstevel@tonic-gate IRE_BROADCAST, 17667c478bd9Sstevel@tonic-gate ipif, 17677c478bd9Sstevel@tonic-gate 0, 17687c478bd9Sstevel@tonic-gate 0, 17697c478bd9Sstevel@tonic-gate 0, 17707c478bd9Sstevel@tonic-gate 0, 177145916cd2Sjpk &ire_uinfo_null, 177245916cd2Sjpk NULL, 1773f4b3ec61Sdh155122 NULL, 1774f4b3ec61Sdh155122 ipst); 17757c478bd9Sstevel@tonic-gate 17767c478bd9Sstevel@tonic-gate *irep++ = ire_create( 17777c478bd9Sstevel@tonic-gate (uchar_t *)&addr, /* dest address */ 17787c478bd9Sstevel@tonic-gate (uchar_t *)&ip_g_all_ones, /* mask */ 17797c478bd9Sstevel@tonic-gate (uchar_t *)&ipif->ipif_src_addr, /* source address */ 17807c478bd9Sstevel@tonic-gate NULL, /* no gateway */ 17817c478bd9Sstevel@tonic-gate &ip_loopback_mtu, /* max frag size */ 178254da8755Ssowmini NULL, /* no src_nce */ 1783e11c3f44Smeem ill->ill_rq, /* recv-from queue */ 17847c478bd9Sstevel@tonic-gate NULL, /* no send-to queue */ 17857c478bd9Sstevel@tonic-gate IRE_BROADCAST, /* Needed for fanout in wput */ 17867c478bd9Sstevel@tonic-gate ipif, 17877c478bd9Sstevel@tonic-gate 0, 17887c478bd9Sstevel@tonic-gate 0, 17897c478bd9Sstevel@tonic-gate 0, 17907c478bd9Sstevel@tonic-gate 0, 179145916cd2Sjpk &ire_uinfo_null, 179245916cd2Sjpk NULL, 1793f4b3ec61Sdh155122 NULL, 1794f4b3ec61Sdh155122 ipst); 17957c478bd9Sstevel@tonic-gate 17967c478bd9Sstevel@tonic-gate return (irep); 17977c478bd9Sstevel@tonic-gate } 17987c478bd9Sstevel@tonic-gate 17997c478bd9Sstevel@tonic-gate /* 18007c478bd9Sstevel@tonic-gate * ire_walk routine to delete or update any IRE_CACHE that might contain 18017c478bd9Sstevel@tonic-gate * stale information. 18027c478bd9Sstevel@tonic-gate * The flags state which entries to delete or update. 18037c478bd9Sstevel@tonic-gate * Garbage collection is done separately using kmem alloc callbacks to 18047c478bd9Sstevel@tonic-gate * ip_trash_ire_reclaim. 18057c478bd9Sstevel@tonic-gate * Used for both IPv4 and IPv6. However, IPv6 only uses FLUSH_MTU_TIME 18067c478bd9Sstevel@tonic-gate * since other stale information is cleaned up using NUD. 18077c478bd9Sstevel@tonic-gate */ 18087c478bd9Sstevel@tonic-gate void 18097c478bd9Sstevel@tonic-gate ire_expire(ire_t *ire, char *arg) 18107c478bd9Sstevel@tonic-gate { 1811f4b3ec61Sdh155122 ire_expire_arg_t *ieap = (ire_expire_arg_t *)(uintptr_t)arg; 18127c478bd9Sstevel@tonic-gate ill_t *stq_ill; 1813f4b3ec61Sdh155122 int flush_flags = ieap->iea_flush_flag; 1814f4b3ec61Sdh155122 ip_stack_t *ipst = ieap->iea_ipst; 18157c478bd9Sstevel@tonic-gate 18167c478bd9Sstevel@tonic-gate if ((flush_flags & FLUSH_REDIRECT_TIME) && 18176bdb8e66Sdd193516 (ire->ire_flags & RTF_DYNAMIC)) { 18187c478bd9Sstevel@tonic-gate /* Make sure we delete the corresponding IRE_CACHE */ 18197c478bd9Sstevel@tonic-gate ip1dbg(("ire_expire: all redirects\n")); 1820f4b3ec61Sdh155122 ip_rts_rtmsg(RTM_DELETE, ire, 0, ipst); 18217c478bd9Sstevel@tonic-gate ire_delete(ire); 1822f4b3ec61Sdh155122 atomic_dec_32(&ipst->ips_ip_redirect_cnt); 18237c478bd9Sstevel@tonic-gate return; 18247c478bd9Sstevel@tonic-gate } 18257c478bd9Sstevel@tonic-gate if (ire->ire_type != IRE_CACHE) 18267c478bd9Sstevel@tonic-gate return; 18277c478bd9Sstevel@tonic-gate 18287c478bd9Sstevel@tonic-gate if (flush_flags & FLUSH_ARP_TIME) { 18297c478bd9Sstevel@tonic-gate /* 1830beef8517Sjprakash * Remove all IRE_CACHE except IPv4 multicast ires. These 1831beef8517Sjprakash * ires will be deleted by ip_trash_ire_reclaim_stack() 1832beef8517Sjprakash * when system runs low in memory. 1833beef8517Sjprakash * Verify that create time is more than ip_ire_arp_interval 1834beef8517Sjprakash * milliseconds ago. 18357c478bd9Sstevel@tonic-gate */ 1836beef8517Sjprakash 1837beef8517Sjprakash if (!(ire->ire_ipversion == IPV4_VERSION && 1838beef8517Sjprakash CLASSD(ire->ire_addr)) && NCE_EXPIRED(ire->ire_nce, ipst)) { 18397c478bd9Sstevel@tonic-gate ire_delete(ire); 18407c478bd9Sstevel@tonic-gate return; 18417c478bd9Sstevel@tonic-gate } 18427c478bd9Sstevel@tonic-gate } 18437c478bd9Sstevel@tonic-gate 1844f4b3ec61Sdh155122 if (ipst->ips_ip_path_mtu_discovery && (flush_flags & FLUSH_MTU_TIME) && 18457c478bd9Sstevel@tonic-gate (ire->ire_ipif != NULL)) { 18467c478bd9Sstevel@tonic-gate /* Increase pmtu if it is less than the interface mtu */ 18477c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 18487c478bd9Sstevel@tonic-gate /* 18497c478bd9Sstevel@tonic-gate * If the ipif is a vni (whose mtu is 0, since it's virtual) 18507c478bd9Sstevel@tonic-gate * get the mtu from the sending interfaces' ipif 18517c478bd9Sstevel@tonic-gate */ 18527c478bd9Sstevel@tonic-gate if (IS_VNI(ire->ire_ipif->ipif_ill)) { 18537c478bd9Sstevel@tonic-gate stq_ill = ire->ire_stq->q_ptr; 18547c478bd9Sstevel@tonic-gate ire->ire_max_frag = MIN(stq_ill->ill_ipif->ipif_mtu, 18557c478bd9Sstevel@tonic-gate IP_MAXPACKET); 18567c478bd9Sstevel@tonic-gate } else { 18577c478bd9Sstevel@tonic-gate ire->ire_max_frag = MIN(ire->ire_ipif->ipif_mtu, 18587c478bd9Sstevel@tonic-gate IP_MAXPACKET); 18597c478bd9Sstevel@tonic-gate } 18607c478bd9Sstevel@tonic-gate ire->ire_frag_flag |= IPH_DF; 18617c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 18627c478bd9Sstevel@tonic-gate } 18637c478bd9Sstevel@tonic-gate } 18647c478bd9Sstevel@tonic-gate 18657c478bd9Sstevel@tonic-gate /* 18667c478bd9Sstevel@tonic-gate * Return any local address. We use this to target ourselves 18677c478bd9Sstevel@tonic-gate * when the src address was specified as 'default'. 18687c478bd9Sstevel@tonic-gate * Preference for IRE_LOCAL entries. 18697c478bd9Sstevel@tonic-gate */ 18707c478bd9Sstevel@tonic-gate ire_t * 1871f4b3ec61Sdh155122 ire_lookup_local(zoneid_t zoneid, ip_stack_t *ipst) 18727c478bd9Sstevel@tonic-gate { 18737c478bd9Sstevel@tonic-gate ire_t *ire; 18747c478bd9Sstevel@tonic-gate irb_t *irb; 18757c478bd9Sstevel@tonic-gate ire_t *maybe = NULL; 18767c478bd9Sstevel@tonic-gate int i; 18777c478bd9Sstevel@tonic-gate 1878f4b3ec61Sdh155122 for (i = 0; i < ipst->ips_ip_cache_table_size; i++) { 1879f4b3ec61Sdh155122 irb = &ipst->ips_ip_cache_table[i]; 18807c478bd9Sstevel@tonic-gate if (irb->irb_ire == NULL) 18817c478bd9Sstevel@tonic-gate continue; 18827c478bd9Sstevel@tonic-gate rw_enter(&irb->irb_lock, RW_READER); 18837c478bd9Sstevel@tonic-gate for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 18847c478bd9Sstevel@tonic-gate if ((ire->ire_marks & IRE_MARK_CONDEMNED) || 188545916cd2Sjpk (ire->ire_zoneid != zoneid && 188645916cd2Sjpk ire->ire_zoneid != ALL_ZONES)) 18877c478bd9Sstevel@tonic-gate continue; 18887c478bd9Sstevel@tonic-gate switch (ire->ire_type) { 18897c478bd9Sstevel@tonic-gate case IRE_LOOPBACK: 18907c478bd9Sstevel@tonic-gate if (maybe == NULL) { 18917c478bd9Sstevel@tonic-gate IRE_REFHOLD(ire); 18927c478bd9Sstevel@tonic-gate maybe = ire; 18937c478bd9Sstevel@tonic-gate } 18947c478bd9Sstevel@tonic-gate break; 18957c478bd9Sstevel@tonic-gate case IRE_LOCAL: 18967c478bd9Sstevel@tonic-gate if (maybe != NULL) { 18977c478bd9Sstevel@tonic-gate ire_refrele(maybe); 18987c478bd9Sstevel@tonic-gate } 18997c478bd9Sstevel@tonic-gate IRE_REFHOLD(ire); 19007c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 19017c478bd9Sstevel@tonic-gate return (ire); 19027c478bd9Sstevel@tonic-gate } 19037c478bd9Sstevel@tonic-gate } 19047c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 19057c478bd9Sstevel@tonic-gate } 19067c478bd9Sstevel@tonic-gate return (maybe); 19077c478bd9Sstevel@tonic-gate } 19087c478bd9Sstevel@tonic-gate 19097c478bd9Sstevel@tonic-gate /* 19107c478bd9Sstevel@tonic-gate * If the specified IRE is associated with a particular ILL, return 19117c478bd9Sstevel@tonic-gate * that ILL pointer (May be called as writer.). 19127c478bd9Sstevel@tonic-gate * 19137c478bd9Sstevel@tonic-gate * NOTE : This is not a generic function that can be used always. 19147c478bd9Sstevel@tonic-gate * This function always returns the ill of the outgoing packets 19157c478bd9Sstevel@tonic-gate * if this ire is used. 19167c478bd9Sstevel@tonic-gate */ 19177c478bd9Sstevel@tonic-gate ill_t * 191845916cd2Sjpk ire_to_ill(const ire_t *ire) 19197c478bd9Sstevel@tonic-gate { 19207c478bd9Sstevel@tonic-gate ill_t *ill = NULL; 19217c478bd9Sstevel@tonic-gate 19227c478bd9Sstevel@tonic-gate /* 19237c478bd9Sstevel@tonic-gate * 1) For an IRE_CACHE, ire_ipif is the one where it obtained 19247c478bd9Sstevel@tonic-gate * the source address from. ire_stq is the one where the 19257c478bd9Sstevel@tonic-gate * packets will be sent out on. We return that here. 19267c478bd9Sstevel@tonic-gate * 19277c478bd9Sstevel@tonic-gate * 2) IRE_BROADCAST normally has a loopback and a non-loopback 19287c478bd9Sstevel@tonic-gate * copy and they always exist next to each other with loopback 19297c478bd9Sstevel@tonic-gate * copy being the first one. If we are called on the non-loopback 19307c478bd9Sstevel@tonic-gate * copy, return the one pointed by ire_stq. If it was called on 19317c478bd9Sstevel@tonic-gate * a loopback copy, we still return the one pointed by the next 19327c478bd9Sstevel@tonic-gate * ire's ire_stq pointer i.e the one pointed by the non-loopback 19337c478bd9Sstevel@tonic-gate * copy. We don't want use ire_ipif as it might represent the 19347c478bd9Sstevel@tonic-gate * source address (if we borrow source addresses for 19357c478bd9Sstevel@tonic-gate * IRE_BROADCASTS in the future). 19367c478bd9Sstevel@tonic-gate * However if an interface is currently coming up, the above 19377c478bd9Sstevel@tonic-gate * condition may not hold during that period since the ires 19387c478bd9Sstevel@tonic-gate * are added one at a time. Thus one of the pair could have been 19397c478bd9Sstevel@tonic-gate * added and the other not yet added. 19402bc4236aSnordmark * 3) For many other IREs (e.g., IRE_LOCAL), ire_rfq indicates the ill. 19412bc4236aSnordmark * 4) For all others return the ones pointed by ire_ipif->ipif_ill. 19422bc4236aSnordmark * That handles IRE_LOOPBACK. 19437c478bd9Sstevel@tonic-gate */ 19447c478bd9Sstevel@tonic-gate 19457c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_CACHE) { 19467c478bd9Sstevel@tonic-gate ill = (ill_t *)ire->ire_stq->q_ptr; 19477c478bd9Sstevel@tonic-gate } else if (ire->ire_type == IRE_BROADCAST) { 19487c478bd9Sstevel@tonic-gate if (ire->ire_stq != NULL) { 19497c478bd9Sstevel@tonic-gate ill = (ill_t *)ire->ire_stq->q_ptr; 19507c478bd9Sstevel@tonic-gate } else { 19517c478bd9Sstevel@tonic-gate ire_t *ire_next; 19527c478bd9Sstevel@tonic-gate 19537c478bd9Sstevel@tonic-gate ire_next = ire->ire_next; 19547c478bd9Sstevel@tonic-gate if (ire_next != NULL && 19557c478bd9Sstevel@tonic-gate ire_next->ire_type == IRE_BROADCAST && 19567c478bd9Sstevel@tonic-gate ire_next->ire_addr == ire->ire_addr && 19577c478bd9Sstevel@tonic-gate ire_next->ire_ipif == ire->ire_ipif) { 19587c478bd9Sstevel@tonic-gate ill = (ill_t *)ire_next->ire_stq->q_ptr; 19597c478bd9Sstevel@tonic-gate } 19607c478bd9Sstevel@tonic-gate } 19612bc4236aSnordmark } else if (ire->ire_rfq != NULL) { 19622bc4236aSnordmark ill = ire->ire_rfq->q_ptr; 19637c478bd9Sstevel@tonic-gate } else if (ire->ire_ipif != NULL) { 19647c478bd9Sstevel@tonic-gate ill = ire->ire_ipif->ipif_ill; 19657c478bd9Sstevel@tonic-gate } 19667c478bd9Sstevel@tonic-gate return (ill); 19677c478bd9Sstevel@tonic-gate } 19687c478bd9Sstevel@tonic-gate 19697c478bd9Sstevel@tonic-gate /* Arrange to call the specified function for every IRE in the world. */ 19707c478bd9Sstevel@tonic-gate void 1971f4b3ec61Sdh155122 ire_walk(pfv_t func, void *arg, ip_stack_t *ipst) 19727c478bd9Sstevel@tonic-gate { 1973f4b3ec61Sdh155122 ire_walk_ipvers(func, arg, 0, ALL_ZONES, ipst); 19747c478bd9Sstevel@tonic-gate } 19757c478bd9Sstevel@tonic-gate 19767c478bd9Sstevel@tonic-gate void 1977f4b3ec61Sdh155122 ire_walk_v4(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst) 19787c478bd9Sstevel@tonic-gate { 1979f4b3ec61Sdh155122 ire_walk_ipvers(func, arg, IPV4_VERSION, zoneid, ipst); 19807c478bd9Sstevel@tonic-gate } 19817c478bd9Sstevel@tonic-gate 19827c478bd9Sstevel@tonic-gate void 1983f4b3ec61Sdh155122 ire_walk_v6(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst) 19847c478bd9Sstevel@tonic-gate { 1985f4b3ec61Sdh155122 ire_walk_ipvers(func, arg, IPV6_VERSION, zoneid, ipst); 19867c478bd9Sstevel@tonic-gate } 19877c478bd9Sstevel@tonic-gate 19887c478bd9Sstevel@tonic-gate /* 19897c478bd9Sstevel@tonic-gate * Walk a particular version. version == 0 means both v4 and v6. 19907c478bd9Sstevel@tonic-gate */ 19917c478bd9Sstevel@tonic-gate static void 1992f4b3ec61Sdh155122 ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, zoneid_t zoneid, 1993f4b3ec61Sdh155122 ip_stack_t *ipst) 19947c478bd9Sstevel@tonic-gate { 19957c478bd9Sstevel@tonic-gate if (vers != IPV6_VERSION) { 1996c793af95Ssangeeta /* 1997c793af95Ssangeeta * ip_forwarding_table variable doesn't matter for IPv4 since 1998f4b3ec61Sdh155122 * ire_walk_ill_tables uses ips_ip_ftable for IPv4. 1999c793af95Ssangeeta */ 20007c478bd9Sstevel@tonic-gate ire_walk_ill_tables(0, 0, func, arg, IP_MASK_TABLE_SIZE, 2001c793af95Ssangeeta 0, NULL, 2002f4b3ec61Sdh155122 ipst->ips_ip_cache_table_size, ipst->ips_ip_cache_table, 2003f4b3ec61Sdh155122 NULL, zoneid, ipst); 20047c478bd9Sstevel@tonic-gate } 20057c478bd9Sstevel@tonic-gate if (vers != IPV4_VERSION) { 20067c478bd9Sstevel@tonic-gate ire_walk_ill_tables(0, 0, func, arg, IP6_MASK_TABLE_SIZE, 2007f4b3ec61Sdh155122 ipst->ips_ip6_ftable_hash_size, 2008f4b3ec61Sdh155122 ipst->ips_ip_forwarding_table_v6, 2009f4b3ec61Sdh155122 ipst->ips_ip6_cache_table_size, 2010f4b3ec61Sdh155122 ipst->ips_ip_cache_table_v6, NULL, zoneid, ipst); 20117c478bd9Sstevel@tonic-gate } 20127c478bd9Sstevel@tonic-gate } 20137c478bd9Sstevel@tonic-gate 20147c478bd9Sstevel@tonic-gate /* 20157924222fSmeem * Arrange to call the specified function for every IRE that matches the ill. 20167c478bd9Sstevel@tonic-gate */ 20177c478bd9Sstevel@tonic-gate void 201845916cd2Sjpk ire_walk_ill(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg, 20197c478bd9Sstevel@tonic-gate ill_t *ill) 20207c478bd9Sstevel@tonic-gate { 20217924222fSmeem uchar_t vers = (ill->ill_isv6 ? IPV6_VERSION : IPV4_VERSION); 20227924222fSmeem 20237924222fSmeem ire_walk_ill_ipvers(match_flags, ire_type, func, arg, vers, ill); 20247c478bd9Sstevel@tonic-gate } 20257c478bd9Sstevel@tonic-gate 20267c478bd9Sstevel@tonic-gate void 202745916cd2Sjpk ire_walk_ill_v4(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg, 20287c478bd9Sstevel@tonic-gate ill_t *ill) 20297c478bd9Sstevel@tonic-gate { 20307c478bd9Sstevel@tonic-gate ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV4_VERSION, 20317c478bd9Sstevel@tonic-gate ill); 20327c478bd9Sstevel@tonic-gate } 20337c478bd9Sstevel@tonic-gate 20347c478bd9Sstevel@tonic-gate void 203545916cd2Sjpk ire_walk_ill_v6(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg, 20367c478bd9Sstevel@tonic-gate ill_t *ill) 20377c478bd9Sstevel@tonic-gate { 20387c478bd9Sstevel@tonic-gate ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV6_VERSION, 20397c478bd9Sstevel@tonic-gate ill); 20407c478bd9Sstevel@tonic-gate } 20417c478bd9Sstevel@tonic-gate 20427c478bd9Sstevel@tonic-gate /* 20437924222fSmeem * Walk a particular ill and version. 20447c478bd9Sstevel@tonic-gate */ 20457c478bd9Sstevel@tonic-gate static void 20467c478bd9Sstevel@tonic-gate ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, pfv_t func, 204745916cd2Sjpk void *arg, uchar_t vers, ill_t *ill) 20487c478bd9Sstevel@tonic-gate { 2049f4b3ec61Sdh155122 ip_stack_t *ipst = ill->ill_ipst; 2050f4b3ec61Sdh155122 20517924222fSmeem if (vers == IPV4_VERSION) { 20527c478bd9Sstevel@tonic-gate ire_walk_ill_tables(match_flags, ire_type, func, arg, 2053c793af95Ssangeeta IP_MASK_TABLE_SIZE, 0, 2054f4b3ec61Sdh155122 NULL, ipst->ips_ip_cache_table_size, 2055f4b3ec61Sdh155122 ipst->ips_ip_cache_table, ill, ALL_ZONES, ipst); 20567924222fSmeem } else if (vers == IPV6_VERSION) { 20577c478bd9Sstevel@tonic-gate ire_walk_ill_tables(match_flags, ire_type, func, arg, 2058f4b3ec61Sdh155122 IP6_MASK_TABLE_SIZE, ipst->ips_ip6_ftable_hash_size, 2059f4b3ec61Sdh155122 ipst->ips_ip_forwarding_table_v6, 2060f4b3ec61Sdh155122 ipst->ips_ip6_cache_table_size, 2061f4b3ec61Sdh155122 ipst->ips_ip_cache_table_v6, ill, ALL_ZONES, ipst); 20627c478bd9Sstevel@tonic-gate } 20637c478bd9Sstevel@tonic-gate } 20647c478bd9Sstevel@tonic-gate 2065c793af95Ssangeeta boolean_t 20667c478bd9Sstevel@tonic-gate ire_walk_ill_match(uint_t match_flags, uint_t ire_type, ire_t *ire, 2067f4b3ec61Sdh155122 ill_t *ill, zoneid_t zoneid, ip_stack_t *ipst) 20687c478bd9Sstevel@tonic-gate { 20697c478bd9Sstevel@tonic-gate ill_t *ire_stq_ill = NULL; 20707c478bd9Sstevel@tonic-gate ill_t *ire_ipif_ill = NULL; 20717c478bd9Sstevel@tonic-gate 20727c478bd9Sstevel@tonic-gate ASSERT(match_flags != 0 || zoneid != ALL_ZONES); 20737c478bd9Sstevel@tonic-gate /* 2074e11c3f44Smeem * MATCH_IRE_ILL: We match both on ill pointed by ire_stq and 2075e11c3f44Smeem * ire_ipif. Only in the case of IRE_CACHEs can ire_stq and 2076e11c3f44Smeem * ire_ipif be pointing to different ills. But we want to keep 2077e11c3f44Smeem * this function generic enough for future use. So, we always 2078e11c3f44Smeem * try to match on both. The only caller of this function 2079e11c3f44Smeem * ire_walk_ill_tables, will call "func" after we return from 2080e11c3f44Smeem * this function. We expect "func" to do the right filtering 2081e11c3f44Smeem * of ires in this case. 20827c478bd9Sstevel@tonic-gate */ 2083e11c3f44Smeem if (match_flags & MATCH_IRE_ILL) { 20847c478bd9Sstevel@tonic-gate if (ire->ire_stq != NULL) 2085e11c3f44Smeem ire_stq_ill = ire->ire_stq->q_ptr; 20867c478bd9Sstevel@tonic-gate if (ire->ire_ipif != NULL) 20877c478bd9Sstevel@tonic-gate ire_ipif_ill = ire->ire_ipif->ipif_ill; 20887c478bd9Sstevel@tonic-gate } 20897c478bd9Sstevel@tonic-gate 20907c478bd9Sstevel@tonic-gate if (zoneid != ALL_ZONES) { 20917c478bd9Sstevel@tonic-gate /* 20927c478bd9Sstevel@tonic-gate * We're walking the IREs for a specific zone. The only relevant 20937c478bd9Sstevel@tonic-gate * IREs are: 20947c478bd9Sstevel@tonic-gate * - all IREs with a matching ire_zoneid 20957c478bd9Sstevel@tonic-gate * - all IRE_OFFSUBNETs as they're shared across all zones 20967c478bd9Sstevel@tonic-gate * - IRE_INTERFACE IREs for interfaces with a usable source addr 20977c478bd9Sstevel@tonic-gate * with a matching zone 20987c478bd9Sstevel@tonic-gate * - IRE_DEFAULTs with a gateway reachable from the zone 20997c478bd9Sstevel@tonic-gate * We should really match on IRE_OFFSUBNETs and IRE_DEFAULTs 21007c478bd9Sstevel@tonic-gate * using the same rule; but the above rules are consistent with 21017c478bd9Sstevel@tonic-gate * the behavior of ire_ftable_lookup[_v6]() so that all the 21027c478bd9Sstevel@tonic-gate * routes that can be matched during lookup are also matched 21037c478bd9Sstevel@tonic-gate * here. 21047c478bd9Sstevel@tonic-gate */ 210545916cd2Sjpk if (zoneid != ire->ire_zoneid && ire->ire_zoneid != ALL_ZONES) { 21067c478bd9Sstevel@tonic-gate /* 21077c478bd9Sstevel@tonic-gate * Note, IRE_INTERFACE can have the stq as NULL. For 21087c478bd9Sstevel@tonic-gate * example, if the default multicast route is tied to 21097c478bd9Sstevel@tonic-gate * the loopback address. 21107c478bd9Sstevel@tonic-gate */ 21117c478bd9Sstevel@tonic-gate if ((ire->ire_type & IRE_INTERFACE) && 21127c478bd9Sstevel@tonic-gate (ire->ire_stq != NULL)) { 21137c478bd9Sstevel@tonic-gate ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr; 21147c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV4_VERSION) { 21157c478bd9Sstevel@tonic-gate if (!ipif_usesrc_avail(ire_stq_ill, 21167c478bd9Sstevel@tonic-gate zoneid)) 21177c478bd9Sstevel@tonic-gate /* No usable src addr in zone */ 21187c478bd9Sstevel@tonic-gate return (B_FALSE); 21197c478bd9Sstevel@tonic-gate } else if (ire_stq_ill->ill_usesrc_ifindex 21207c478bd9Sstevel@tonic-gate != 0) { 21217c478bd9Sstevel@tonic-gate /* 21227c478bd9Sstevel@tonic-gate * For IPv6 use ipif_select_source_v6() 21237c478bd9Sstevel@tonic-gate * so the right scope selection is done 21247c478bd9Sstevel@tonic-gate */ 21257c478bd9Sstevel@tonic-gate ipif_t *src_ipif; 21267c478bd9Sstevel@tonic-gate src_ipif = 21277c478bd9Sstevel@tonic-gate ipif_select_source_v6(ire_stq_ill, 2128e11c3f44Smeem &ire->ire_addr_v6, B_FALSE, 21297c478bd9Sstevel@tonic-gate IPV6_PREFER_SRC_DEFAULT, 21307c478bd9Sstevel@tonic-gate zoneid); 21317c478bd9Sstevel@tonic-gate if (src_ipif != NULL) { 21327c478bd9Sstevel@tonic-gate ipif_refrele(src_ipif); 21337c478bd9Sstevel@tonic-gate } else { 21347c478bd9Sstevel@tonic-gate return (B_FALSE); 21357c478bd9Sstevel@tonic-gate } 21367c478bd9Sstevel@tonic-gate } else { 21377c478bd9Sstevel@tonic-gate return (B_FALSE); 21387c478bd9Sstevel@tonic-gate } 21397c478bd9Sstevel@tonic-gate 21407c478bd9Sstevel@tonic-gate } else if (!(ire->ire_type & IRE_OFFSUBNET)) { 21417c478bd9Sstevel@tonic-gate return (B_FALSE); 21427c478bd9Sstevel@tonic-gate } 21437c478bd9Sstevel@tonic-gate } 21447c478bd9Sstevel@tonic-gate 21457c478bd9Sstevel@tonic-gate /* 21467c478bd9Sstevel@tonic-gate * Match all default routes from the global zone, irrespective 21475597b60aSnordmark * of reachability. For a non-global zone only match those 21485597b60aSnordmark * where ire_gateway_addr has a IRE_INTERFACE for the zoneid. 21497c478bd9Sstevel@tonic-gate */ 21507c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_DEFAULT && zoneid != GLOBAL_ZONEID) { 21517c478bd9Sstevel@tonic-gate int ire_match_flags = 0; 21527c478bd9Sstevel@tonic-gate in6_addr_t gw_addr_v6; 21537c478bd9Sstevel@tonic-gate ire_t *rire; 21547c478bd9Sstevel@tonic-gate 21555597b60aSnordmark ire_match_flags |= MATCH_IRE_TYPE; 2156e11c3f44Smeem if (ire->ire_ipif != NULL) 2157e11c3f44Smeem ire_match_flags |= MATCH_IRE_ILL; 2158e11c3f44Smeem 21597c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV4_VERSION) { 21607c478bd9Sstevel@tonic-gate rire = ire_route_lookup(ire->ire_gateway_addr, 21615597b60aSnordmark 0, 0, IRE_INTERFACE, ire->ire_ipif, NULL, 2162f4b3ec61Sdh155122 zoneid, NULL, ire_match_flags, ipst); 21637c478bd9Sstevel@tonic-gate } else { 21647c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV6_VERSION); 21657c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 21667c478bd9Sstevel@tonic-gate gw_addr_v6 = ire->ire_gateway_addr_v6; 21677c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 21687c478bd9Sstevel@tonic-gate rire = ire_route_lookup_v6(&gw_addr_v6, 21695597b60aSnordmark NULL, NULL, IRE_INTERFACE, ire->ire_ipif, 2170f4b3ec61Sdh155122 NULL, zoneid, NULL, ire_match_flags, ipst); 21717c478bd9Sstevel@tonic-gate } 21727c478bd9Sstevel@tonic-gate if (rire == NULL) { 21737c478bd9Sstevel@tonic-gate return (B_FALSE); 21747c478bd9Sstevel@tonic-gate } 21757c478bd9Sstevel@tonic-gate ire_refrele(rire); 21767c478bd9Sstevel@tonic-gate } 21777c478bd9Sstevel@tonic-gate } 21787c478bd9Sstevel@tonic-gate 21797c478bd9Sstevel@tonic-gate if (((!(match_flags & MATCH_IRE_TYPE)) || 21807c478bd9Sstevel@tonic-gate (ire->ire_type & ire_type)) && 21817c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_ILL)) || 2182e11c3f44Smeem (ire_stq_ill == ill || ire_ipif_ill == ill || 2183e11c3f44Smeem ire_ipif_ill != NULL && IS_IN_SAME_ILLGRP(ire_ipif_ill, ill)))) { 21847c478bd9Sstevel@tonic-gate return (B_TRUE); 21857c478bd9Sstevel@tonic-gate } 21867c478bd9Sstevel@tonic-gate return (B_FALSE); 21877c478bd9Sstevel@tonic-gate } 21887c478bd9Sstevel@tonic-gate 2189c793af95Ssangeeta int 2190c793af95Ssangeeta rtfunc(struct radix_node *rn, void *arg) 2191c793af95Ssangeeta { 2192c793af95Ssangeeta struct rtfuncarg *rtf = arg; 2193c793af95Ssangeeta struct rt_entry *rt; 2194c793af95Ssangeeta irb_t *irb; 2195c793af95Ssangeeta ire_t *ire; 2196c793af95Ssangeeta boolean_t ret; 2197c793af95Ssangeeta 2198c793af95Ssangeeta rt = (struct rt_entry *)rn; 2199c793af95Ssangeeta ASSERT(rt != NULL); 2200c793af95Ssangeeta irb = &rt->rt_irb; 2201c793af95Ssangeeta for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 2202c793af95Ssangeeta if ((rtf->rt_match_flags != 0) || 2203c793af95Ssangeeta (rtf->rt_zoneid != ALL_ZONES)) { 2204c793af95Ssangeeta ret = ire_walk_ill_match(rtf->rt_match_flags, 2205c793af95Ssangeeta rtf->rt_ire_type, ire, 2206f4b3ec61Sdh155122 rtf->rt_ill, rtf->rt_zoneid, rtf->rt_ipst); 2207c793af95Ssangeeta } else 2208c793af95Ssangeeta ret = B_TRUE; 2209c793af95Ssangeeta if (ret) 2210c793af95Ssangeeta (*rtf->rt_func)(ire, rtf->rt_arg); 2211c793af95Ssangeeta } 2212c793af95Ssangeeta return (0); 2213c793af95Ssangeeta } 2214c793af95Ssangeeta 22157c478bd9Sstevel@tonic-gate /* 22167c478bd9Sstevel@tonic-gate * Walk the ftable and the ctable entries that match the ill. 22177c478bd9Sstevel@tonic-gate */ 2218c793af95Ssangeeta void 22197c478bd9Sstevel@tonic-gate ire_walk_ill_tables(uint_t match_flags, uint_t ire_type, pfv_t func, 222045916cd2Sjpk void *arg, size_t ftbl_sz, size_t htbl_sz, irb_t **ipftbl, 2221f4b3ec61Sdh155122 size_t ctbl_sz, irb_t *ipctbl, ill_t *ill, zoneid_t zoneid, 2222f4b3ec61Sdh155122 ip_stack_t *ipst) 22237c478bd9Sstevel@tonic-gate { 22247c478bd9Sstevel@tonic-gate irb_t *irb_ptr; 22257c478bd9Sstevel@tonic-gate irb_t *irb; 22267c478bd9Sstevel@tonic-gate ire_t *ire; 22277c478bd9Sstevel@tonic-gate int i, j; 22287c478bd9Sstevel@tonic-gate boolean_t ret; 2229c793af95Ssangeeta struct rtfuncarg rtfarg; 22307c478bd9Sstevel@tonic-gate 2231e11c3f44Smeem ASSERT((!(match_flags & MATCH_IRE_ILL)) || (ill != NULL)); 22327c478bd9Sstevel@tonic-gate ASSERT(!(match_flags & MATCH_IRE_TYPE) || (ire_type != 0)); 22337c478bd9Sstevel@tonic-gate /* 22347c478bd9Sstevel@tonic-gate * Optimize by not looking at the forwarding table if there 22357c478bd9Sstevel@tonic-gate * is a MATCH_IRE_TYPE specified with no IRE_FORWARDTABLE 22367c478bd9Sstevel@tonic-gate * specified in ire_type. 22377c478bd9Sstevel@tonic-gate */ 22387c478bd9Sstevel@tonic-gate if (!(match_flags & MATCH_IRE_TYPE) || 22397c478bd9Sstevel@tonic-gate ((ire_type & IRE_FORWARDTABLE) != 0)) { 2240c793af95Ssangeeta /* knobs such that routine is called only for v6 case */ 2241f4b3ec61Sdh155122 if (ipftbl == ipst->ips_ip_forwarding_table_v6) { 22427c478bd9Sstevel@tonic-gate for (i = (ftbl_sz - 1); i >= 0; i--) { 22437c478bd9Sstevel@tonic-gate if ((irb_ptr = ipftbl[i]) == NULL) 22447c478bd9Sstevel@tonic-gate continue; 22457c478bd9Sstevel@tonic-gate for (j = 0; j < htbl_sz; j++) { 22467c478bd9Sstevel@tonic-gate irb = &irb_ptr[j]; 22477c478bd9Sstevel@tonic-gate if (irb->irb_ire == NULL) 22487c478bd9Sstevel@tonic-gate continue; 2249c793af95Ssangeeta 22507c478bd9Sstevel@tonic-gate IRB_REFHOLD(irb); 22517c478bd9Sstevel@tonic-gate for (ire = irb->irb_ire; ire != NULL; 22527c478bd9Sstevel@tonic-gate ire = ire->ire_next) { 22537c478bd9Sstevel@tonic-gate if (match_flags == 0 && 22547c478bd9Sstevel@tonic-gate zoneid == ALL_ZONES) { 22557c478bd9Sstevel@tonic-gate ret = B_TRUE; 22567c478bd9Sstevel@tonic-gate } else { 2257c793af95Ssangeeta ret = 2258c793af95Ssangeeta ire_walk_ill_match( 2259c793af95Ssangeeta match_flags, 2260c793af95Ssangeeta ire_type, ire, ill, 2261f4b3ec61Sdh155122 zoneid, ipst); 22627c478bd9Sstevel@tonic-gate } 22637c478bd9Sstevel@tonic-gate if (ret) 22647c478bd9Sstevel@tonic-gate (*func)(ire, arg); 22657c478bd9Sstevel@tonic-gate } 22667c478bd9Sstevel@tonic-gate IRB_REFRELE(irb); 22677c478bd9Sstevel@tonic-gate } 22687c478bd9Sstevel@tonic-gate } 2269c793af95Ssangeeta } else { 2270c793af95Ssangeeta (void) memset(&rtfarg, 0, sizeof (rtfarg)); 2271c793af95Ssangeeta rtfarg.rt_func = func; 2272c793af95Ssangeeta rtfarg.rt_arg = arg; 2273c793af95Ssangeeta if (match_flags != 0) { 2274c793af95Ssangeeta rtfarg.rt_match_flags = match_flags; 2275c793af95Ssangeeta } 2276c793af95Ssangeeta rtfarg.rt_ire_type = ire_type; 2277c793af95Ssangeeta rtfarg.rt_ill = ill; 2278c793af95Ssangeeta rtfarg.rt_zoneid = zoneid; 2279f4b3ec61Sdh155122 rtfarg.rt_ipst = ipst; /* No netstack_hold */ 2280f4b3ec61Sdh155122 (void) ipst->ips_ip_ftable->rnh_walktree_mt( 2281f4b3ec61Sdh155122 ipst->ips_ip_ftable, 2282f4b3ec61Sdh155122 rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn); 2283c793af95Ssangeeta } 22847c478bd9Sstevel@tonic-gate } 22857c478bd9Sstevel@tonic-gate 22867c478bd9Sstevel@tonic-gate /* 22877c478bd9Sstevel@tonic-gate * Optimize by not looking at the cache table if there 22887c478bd9Sstevel@tonic-gate * is a MATCH_IRE_TYPE specified with no IRE_CACHETABLE 22897c478bd9Sstevel@tonic-gate * specified in ire_type. 22907c478bd9Sstevel@tonic-gate */ 22917c478bd9Sstevel@tonic-gate if (!(match_flags & MATCH_IRE_TYPE) || 22927c478bd9Sstevel@tonic-gate ((ire_type & IRE_CACHETABLE) != 0)) { 22937c478bd9Sstevel@tonic-gate for (i = 0; i < ctbl_sz; i++) { 22947c478bd9Sstevel@tonic-gate irb = &ipctbl[i]; 22957c478bd9Sstevel@tonic-gate if (irb->irb_ire == NULL) 22967c478bd9Sstevel@tonic-gate continue; 22977c478bd9Sstevel@tonic-gate IRB_REFHOLD(irb); 22987c478bd9Sstevel@tonic-gate for (ire = irb->irb_ire; ire != NULL; 22997c478bd9Sstevel@tonic-gate ire = ire->ire_next) { 23007c478bd9Sstevel@tonic-gate if (match_flags == 0 && zoneid == ALL_ZONES) { 23017c478bd9Sstevel@tonic-gate ret = B_TRUE; 23027c478bd9Sstevel@tonic-gate } else { 23037c478bd9Sstevel@tonic-gate ret = ire_walk_ill_match( 23047c478bd9Sstevel@tonic-gate match_flags, ire_type, 2305f4b3ec61Sdh155122 ire, ill, zoneid, ipst); 23067c478bd9Sstevel@tonic-gate } 23077c478bd9Sstevel@tonic-gate if (ret) 23087c478bd9Sstevel@tonic-gate (*func)(ire, arg); 23097c478bd9Sstevel@tonic-gate } 23107c478bd9Sstevel@tonic-gate IRB_REFRELE(irb); 23117c478bd9Sstevel@tonic-gate } 23127c478bd9Sstevel@tonic-gate } 23137c478bd9Sstevel@tonic-gate } 23147c478bd9Sstevel@tonic-gate 23157c478bd9Sstevel@tonic-gate /* 23167c478bd9Sstevel@tonic-gate * This function takes a mask and returns 23177c478bd9Sstevel@tonic-gate * number of bits set in the mask. If no 23187c478bd9Sstevel@tonic-gate * bit is set it returns 0. 23197c478bd9Sstevel@tonic-gate * Assumes a contiguous mask. 23207c478bd9Sstevel@tonic-gate */ 23217c478bd9Sstevel@tonic-gate int 23227c478bd9Sstevel@tonic-gate ip_mask_to_plen(ipaddr_t mask) 23237c478bd9Sstevel@tonic-gate { 23247c478bd9Sstevel@tonic-gate return (mask == 0 ? 0 : IP_ABITS - (ffs(ntohl(mask)) -1)); 23257c478bd9Sstevel@tonic-gate } 23267c478bd9Sstevel@tonic-gate 23277c478bd9Sstevel@tonic-gate /* 23287c478bd9Sstevel@tonic-gate * Convert length for a mask to the mask. 23297c478bd9Sstevel@tonic-gate */ 23307c478bd9Sstevel@tonic-gate ipaddr_t 23317c478bd9Sstevel@tonic-gate ip_plen_to_mask(uint_t masklen) 23327c478bd9Sstevel@tonic-gate { 23337c478bd9Sstevel@tonic-gate return (htonl(IP_HOST_MASK << (IP_ABITS - masklen))); 23347c478bd9Sstevel@tonic-gate } 23357c478bd9Sstevel@tonic-gate 23367c478bd9Sstevel@tonic-gate void 23377c478bd9Sstevel@tonic-gate ire_atomic_end(irb_t *irb_ptr, ire_t *ire) 23387c478bd9Sstevel@tonic-gate { 23390bd79941Smeem ill_t *stq_ill, *ipif_ill; 2340f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 23417c478bd9Sstevel@tonic-gate 23420bd79941Smeem stq_ill = ire->ire_stq != NULL ? ire->ire_stq->q_ptr : NULL; 23430bd79941Smeem ipif_ill = ire->ire_ipif != NULL ? ire->ire_ipif->ipif_ill : NULL; 23440bd79941Smeem RELEASE_ILL_LOCKS(ipif_ill, stq_ill); 23457c478bd9Sstevel@tonic-gate rw_exit(&irb_ptr->irb_lock); 2346f4b3ec61Sdh155122 rw_exit(&ipst->ips_ill_g_usesrc_lock); 23477c478bd9Sstevel@tonic-gate } 23487c478bd9Sstevel@tonic-gate 23497c478bd9Sstevel@tonic-gate /* 23507c478bd9Sstevel@tonic-gate * ire_add_v[46] atomically make sure that the ipif or ill associated 23517c478bd9Sstevel@tonic-gate * with the new ire being added is stable and not IPIF_CHANGING or ILL_CHANGING 23527c478bd9Sstevel@tonic-gate * before adding the ire to the table. This ensures that we don't create 23537c478bd9Sstevel@tonic-gate * new IRE_CACHEs with stale values for parameters that are passed to 23547c478bd9Sstevel@tonic-gate * ire_create such as ire_max_frag. Note that ire_create() is passed a pointer 23557c478bd9Sstevel@tonic-gate * to the ipif_mtu, and not the value. The actual value is derived from the 23567c478bd9Sstevel@tonic-gate * parent ire or ipif under the bucket lock. 23577c478bd9Sstevel@tonic-gate */ 23587c478bd9Sstevel@tonic-gate int 23597c478bd9Sstevel@tonic-gate ire_atomic_start(irb_t *irb_ptr, ire_t *ire, queue_t *q, mblk_t *mp, 23607c478bd9Sstevel@tonic-gate ipsq_func_t func) 23617c478bd9Sstevel@tonic-gate { 23627c478bd9Sstevel@tonic-gate ill_t *stq_ill; 23637c478bd9Sstevel@tonic-gate ill_t *ipif_ill; 23647c478bd9Sstevel@tonic-gate int error = 0; 23657c478bd9Sstevel@tonic-gate ill_t *ill = NULL; 2366f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 23677c478bd9Sstevel@tonic-gate 23680bd79941Smeem stq_ill = ire->ire_stq != NULL ? ire->ire_stq->q_ptr : NULL; 23690bd79941Smeem ipif_ill = ire->ire_ipif != NULL ? ire->ire_ipif->ipif_ill : NULL; 23707c478bd9Sstevel@tonic-gate 23717c478bd9Sstevel@tonic-gate ASSERT((q != NULL && mp != NULL && func != NULL) || 23727c478bd9Sstevel@tonic-gate (q == NULL && mp == NULL && func == NULL)); 2373f4b3ec61Sdh155122 rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER); 23747c478bd9Sstevel@tonic-gate GRAB_CONN_LOCK(q); 23757c478bd9Sstevel@tonic-gate rw_enter(&irb_ptr->irb_lock, RW_WRITER); 23760bd79941Smeem GRAB_ILL_LOCKS(ipif_ill, stq_ill); 23777c478bd9Sstevel@tonic-gate 23787c478bd9Sstevel@tonic-gate /* 23797c478bd9Sstevel@tonic-gate * While the IRE is in the process of being added, a user may have 23807c478bd9Sstevel@tonic-gate * invoked the ifconfig usesrc option on the stq_ill to make it a 23817c478bd9Sstevel@tonic-gate * usesrc client ILL. Check for this possibility here, if it is true 23827c478bd9Sstevel@tonic-gate * then we fail adding the IRE_CACHE. Another check is to make sure 23837c478bd9Sstevel@tonic-gate * that an ipif_ill of an IRE_CACHE being added is not part of a usesrc 23847c478bd9Sstevel@tonic-gate * group. The ill_g_usesrc_lock is released in ire_atomic_end 23857c478bd9Sstevel@tonic-gate */ 23867c478bd9Sstevel@tonic-gate if ((ire->ire_type & IRE_CACHE) && 23877c478bd9Sstevel@tonic-gate (ire->ire_marks & IRE_MARK_USESRC_CHECK)) { 23887c478bd9Sstevel@tonic-gate if (stq_ill->ill_usesrc_ifindex != 0) { 23897c478bd9Sstevel@tonic-gate ASSERT(stq_ill->ill_usesrc_grp_next != NULL); 23907c478bd9Sstevel@tonic-gate if ((ipif_ill->ill_phyint->phyint_ifindex != 23917c478bd9Sstevel@tonic-gate stq_ill->ill_usesrc_ifindex) || 23927c478bd9Sstevel@tonic-gate (ipif_ill->ill_usesrc_grp_next == NULL) || 23937c478bd9Sstevel@tonic-gate (ipif_ill->ill_usesrc_ifindex != 0)) { 23947c478bd9Sstevel@tonic-gate error = EINVAL; 23957c478bd9Sstevel@tonic-gate goto done; 23967c478bd9Sstevel@tonic-gate } 23977c478bd9Sstevel@tonic-gate } else if (ipif_ill->ill_usesrc_grp_next != NULL) { 23987c478bd9Sstevel@tonic-gate error = EINVAL; 23997c478bd9Sstevel@tonic-gate goto done; 24007c478bd9Sstevel@tonic-gate } 24017c478bd9Sstevel@tonic-gate } 24027c478bd9Sstevel@tonic-gate 24037c478bd9Sstevel@tonic-gate /* 2404e11c3f44Smeem * Don't allow IRE's to be created on changing ill's. Also, since 2405e11c3f44Smeem * IPMP flags can be set on an ill without quiescing it, if we're not 2406e11c3f44Smeem * a writer on stq_ill, check that the flags still allow IRE creation. 24077c478bd9Sstevel@tonic-gate */ 24087c478bd9Sstevel@tonic-gate if ((stq_ill != NULL) && !IAM_WRITER_ILL(stq_ill)) { 24097c478bd9Sstevel@tonic-gate if (stq_ill->ill_state_flags & ILL_CHANGING) { 24107c478bd9Sstevel@tonic-gate ill = stq_ill; 24117c478bd9Sstevel@tonic-gate error = EAGAIN; 2412e11c3f44Smeem } else if (IS_UNDER_IPMP(stq_ill)) { 2413e11c3f44Smeem mutex_enter(&stq_ill->ill_phyint->phyint_lock); 2414e11c3f44Smeem if (!ipmp_ill_is_active(stq_ill) && 2415e11c3f44Smeem !(ire->ire_marks & IRE_MARK_TESTHIDDEN)) { 24167c478bd9Sstevel@tonic-gate error = EINVAL; 24177c478bd9Sstevel@tonic-gate } 2418e11c3f44Smeem mutex_exit(&stq_ill->ill_phyint->phyint_lock); 2419e11c3f44Smeem } 2420e11c3f44Smeem if (error != 0) 24217c478bd9Sstevel@tonic-gate goto done; 24227c478bd9Sstevel@tonic-gate } 24237c478bd9Sstevel@tonic-gate 24247c478bd9Sstevel@tonic-gate if ((ipif_ill != NULL) && !IAM_WRITER_ILL(ipif_ill) && 24257c478bd9Sstevel@tonic-gate (ipif_ill->ill_state_flags & ILL_CHANGING)) { 24267c478bd9Sstevel@tonic-gate ill = ipif_ill; 24277c478bd9Sstevel@tonic-gate error = EAGAIN; 24287c478bd9Sstevel@tonic-gate goto done; 24297c478bd9Sstevel@tonic-gate } 24307c478bd9Sstevel@tonic-gate 24317c478bd9Sstevel@tonic-gate if ((ire->ire_ipif != NULL) && !IAM_WRITER_IPIF(ire->ire_ipif) && 24327c478bd9Sstevel@tonic-gate (ire->ire_ipif->ipif_state_flags & IPIF_CHANGING)) { 24337c478bd9Sstevel@tonic-gate ill = ire->ire_ipif->ipif_ill; 24347c478bd9Sstevel@tonic-gate ASSERT(ill != NULL); 24357c478bd9Sstevel@tonic-gate error = EAGAIN; 24367c478bd9Sstevel@tonic-gate goto done; 24377c478bd9Sstevel@tonic-gate } 24387c478bd9Sstevel@tonic-gate 24397c478bd9Sstevel@tonic-gate done: 24407c478bd9Sstevel@tonic-gate if (error == EAGAIN && ILL_CAN_WAIT(ill, q)) { 24417c478bd9Sstevel@tonic-gate ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq; 24427c478bd9Sstevel@tonic-gate mutex_enter(&ipsq->ipsq_lock); 2443e11c3f44Smeem mutex_enter(&ipsq->ipsq_xop->ipx_lock); 24447c478bd9Sstevel@tonic-gate ire_atomic_end(irb_ptr, ire); 24457c478bd9Sstevel@tonic-gate ipsq_enq(ipsq, q, mp, func, NEW_OP, ill); 2446e11c3f44Smeem mutex_exit(&ipsq->ipsq_xop->ipx_lock); 24477c478bd9Sstevel@tonic-gate mutex_exit(&ipsq->ipsq_lock); 24487c478bd9Sstevel@tonic-gate error = EINPROGRESS; 24497c478bd9Sstevel@tonic-gate } else if (error != 0) { 24507c478bd9Sstevel@tonic-gate ire_atomic_end(irb_ptr, ire); 24517c478bd9Sstevel@tonic-gate } 24527c478bd9Sstevel@tonic-gate 24537c478bd9Sstevel@tonic-gate RELEASE_CONN_LOCK(q); 24547c478bd9Sstevel@tonic-gate return (error); 24557c478bd9Sstevel@tonic-gate } 24567c478bd9Sstevel@tonic-gate 24577c478bd9Sstevel@tonic-gate /* 24587c478bd9Sstevel@tonic-gate * Add a fully initialized IRE to an appropriate table based on 24597c478bd9Sstevel@tonic-gate * ire_type. 2460c793af95Ssangeeta * 2461c793af95Ssangeeta * allow_unresolved == B_FALSE indicates a legacy code-path call 2462c793af95Ssangeeta * that has prohibited the addition of incomplete ire's. If this 2463c793af95Ssangeeta * parameter is set, and we find an nce that is in a state other 2464c793af95Ssangeeta * than ND_REACHABLE, we fail the add. Note that nce_state could be 2465b9c344b3Ssowmini * something other than ND_REACHABLE if the nce had just expired and 2466b9c344b3Ssowmini * the ire_create preceding the ire_add added a new ND_INITIAL nce. 24677c478bd9Sstevel@tonic-gate */ 24687c478bd9Sstevel@tonic-gate int 2469c793af95Ssangeeta ire_add(ire_t **irep, queue_t *q, mblk_t *mp, ipsq_func_t func, 2470c793af95Ssangeeta boolean_t allow_unresolved) 24717c478bd9Sstevel@tonic-gate { 24727c478bd9Sstevel@tonic-gate ire_t *ire1; 24737c478bd9Sstevel@tonic-gate ill_t *stq_ill = NULL; 24747c478bd9Sstevel@tonic-gate ill_t *ill; 24757c478bd9Sstevel@tonic-gate ipif_t *ipif = NULL; 24767c478bd9Sstevel@tonic-gate ill_walk_context_t ctx; 24777c478bd9Sstevel@tonic-gate ire_t *ire = *irep; 24787c478bd9Sstevel@tonic-gate int error; 2479dc3879f9Sjarrett boolean_t ire_is_mblk = B_FALSE; 2480dc3879f9Sjarrett tsol_gcgrp_t *gcgrp = NULL; 2481dc3879f9Sjarrett tsol_gcgrp_addr_t ga; 2482f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 24837c478bd9Sstevel@tonic-gate 24847c478bd9Sstevel@tonic-gate /* get ready for the day when original ire is not created as mblk */ 24857c478bd9Sstevel@tonic-gate if (ire->ire_mp != NULL) { 2486dc3879f9Sjarrett ire_is_mblk = B_TRUE; 24877c478bd9Sstevel@tonic-gate /* Copy the ire to a kmem_alloc'ed area */ 24887c478bd9Sstevel@tonic-gate ire1 = kmem_cache_alloc(ire_cache, KM_NOSLEEP); 24897c478bd9Sstevel@tonic-gate if (ire1 == NULL) { 24907c478bd9Sstevel@tonic-gate ip1dbg(("ire_add: alloc failed\n")); 24917c478bd9Sstevel@tonic-gate ire_delete(ire); 24927c478bd9Sstevel@tonic-gate *irep = NULL; 24937c478bd9Sstevel@tonic-gate return (ENOMEM); 24947c478bd9Sstevel@tonic-gate } 2495c793af95Ssangeeta ire->ire_marks &= ~IRE_MARK_UNCACHED; 24967c478bd9Sstevel@tonic-gate *ire1 = *ire; 24977c478bd9Sstevel@tonic-gate ire1->ire_mp = NULL; 2498c793af95Ssangeeta ire1->ire_stq_ifindex = 0; 24997c478bd9Sstevel@tonic-gate freeb(ire->ire_mp); 25007c478bd9Sstevel@tonic-gate ire = ire1; 25017c478bd9Sstevel@tonic-gate } 25027c478bd9Sstevel@tonic-gate if (ire->ire_stq != NULL) 2503e11c3f44Smeem stq_ill = ire->ire_stq->q_ptr; 25047c478bd9Sstevel@tonic-gate 25057c478bd9Sstevel@tonic-gate if (stq_ill != NULL && ire->ire_type == IRE_CACHE && 25067c478bd9Sstevel@tonic-gate stq_ill->ill_net_type == IRE_IF_RESOLVER) { 2507f4b3ec61Sdh155122 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2508f4b3ec61Sdh155122 ill = ILL_START_WALK_ALL(&ctx, ipst); 25097c478bd9Sstevel@tonic-gate for (; ill != NULL; ill = ill_next(&ctx, ill)) { 25107c478bd9Sstevel@tonic-gate mutex_enter(&ill->ill_lock); 25117c478bd9Sstevel@tonic-gate if (ill->ill_state_flags & ILL_CONDEMNED) { 25127c478bd9Sstevel@tonic-gate mutex_exit(&ill->ill_lock); 25137c478bd9Sstevel@tonic-gate continue; 25147c478bd9Sstevel@tonic-gate } 25157c478bd9Sstevel@tonic-gate /* 25167c478bd9Sstevel@tonic-gate * We need to make sure that the ipif is a valid one 25177c478bd9Sstevel@tonic-gate * before adding the IRE_CACHE. This happens only 25187c478bd9Sstevel@tonic-gate * with IRE_CACHE when there is an external resolver. 25197c478bd9Sstevel@tonic-gate * 25207c478bd9Sstevel@tonic-gate * We can unplumb a logical interface while the 25217c478bd9Sstevel@tonic-gate * packet is waiting in ARP with the IRE. Then, 25227c478bd9Sstevel@tonic-gate * later on when we feed the IRE back, the ipif 25237c478bd9Sstevel@tonic-gate * has to be re-checked. This can't happen with 25247c478bd9Sstevel@tonic-gate * NDP currently, as we never queue the IRE with 25257c478bd9Sstevel@tonic-gate * the packet. We always try to recreate the IRE 25267c478bd9Sstevel@tonic-gate * when the resolution is completed. But, we do 25277c478bd9Sstevel@tonic-gate * it for IPv6 also here so that in future if 25287c478bd9Sstevel@tonic-gate * we have external resolvers, it will work without 25297c478bd9Sstevel@tonic-gate * any change. 25307c478bd9Sstevel@tonic-gate */ 25317c478bd9Sstevel@tonic-gate ipif = ipif_lookup_seqid(ill, ire->ire_ipif_seqid); 25327c478bd9Sstevel@tonic-gate if (ipif != NULL) { 25337c478bd9Sstevel@tonic-gate ipif_refhold_locked(ipif); 25347c478bd9Sstevel@tonic-gate mutex_exit(&ill->ill_lock); 25357c478bd9Sstevel@tonic-gate break; 25367c478bd9Sstevel@tonic-gate } 25377c478bd9Sstevel@tonic-gate mutex_exit(&ill->ill_lock); 25387c478bd9Sstevel@tonic-gate } 2539f4b3ec61Sdh155122 rw_exit(&ipst->ips_ill_g_lock); 25407c478bd9Sstevel@tonic-gate if (ipif == NULL || 25417c478bd9Sstevel@tonic-gate (ipif->ipif_isv6 && 2542e11c3f44Smeem !IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6) && 25437c478bd9Sstevel@tonic-gate !IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6, 25447c478bd9Sstevel@tonic-gate &ipif->ipif_v6src_addr)) || 25457c478bd9Sstevel@tonic-gate (!ipif->ipif_isv6 && 25467c478bd9Sstevel@tonic-gate ire->ire_src_addr != ipif->ipif_src_addr) || 254745916cd2Sjpk ire->ire_zoneid != ipif->ipif_zoneid) { 25487c478bd9Sstevel@tonic-gate if (ipif != NULL) 25497c478bd9Sstevel@tonic-gate ipif_refrele(ipif); 25507c478bd9Sstevel@tonic-gate ire->ire_ipif = NULL; 25517c478bd9Sstevel@tonic-gate ire_delete(ire); 25527c478bd9Sstevel@tonic-gate *irep = NULL; 25537c478bd9Sstevel@tonic-gate return (EINVAL); 25547c478bd9Sstevel@tonic-gate } 25557c478bd9Sstevel@tonic-gate 25567c478bd9Sstevel@tonic-gate ASSERT(ill != NULL); 2557dc3879f9Sjarrett 2558dc3879f9Sjarrett /* 2559dc3879f9Sjarrett * Since we didn't attach label security attributes to the 2560dc3879f9Sjarrett * ire for the resolver case, we need to add it now. (only 2561dc3879f9Sjarrett * for v4 resolver and v6 xresolv case). 2562dc3879f9Sjarrett */ 2563dc3879f9Sjarrett if (is_system_labeled() && ire_is_mblk) { 2564dc3879f9Sjarrett if (ire->ire_ipversion == IPV4_VERSION) { 2565dc3879f9Sjarrett ga.ga_af = AF_INET; 2566dc3879f9Sjarrett IN6_IPADDR_TO_V4MAPPED(ire->ire_gateway_addr != 2567dc3879f9Sjarrett INADDR_ANY ? ire->ire_gateway_addr : 2568dc3879f9Sjarrett ire->ire_addr, &ga.ga_addr); 2569dc3879f9Sjarrett } else { 2570dc3879f9Sjarrett ga.ga_af = AF_INET6; 2571dc3879f9Sjarrett ga.ga_addr = IN6_IS_ADDR_UNSPECIFIED( 2572dc3879f9Sjarrett &ire->ire_gateway_addr_v6) ? 2573dc3879f9Sjarrett ire->ire_addr_v6 : 2574dc3879f9Sjarrett ire->ire_gateway_addr_v6; 2575dc3879f9Sjarrett } 2576dc3879f9Sjarrett gcgrp = gcgrp_lookup(&ga, B_FALSE); 2577dc3879f9Sjarrett error = tsol_ire_init_gwattr(ire, ire->ire_ipversion, 2578dc3879f9Sjarrett NULL, gcgrp); 2579dc3879f9Sjarrett if (error != 0) { 2580dc3879f9Sjarrett if (gcgrp != NULL) { 2581dc3879f9Sjarrett GCGRP_REFRELE(gcgrp); 2582dc3879f9Sjarrett gcgrp = NULL; 2583dc3879f9Sjarrett } 2584dc3879f9Sjarrett ipif_refrele(ipif); 2585dc3879f9Sjarrett ire->ire_ipif = NULL; 2586dc3879f9Sjarrett ire_delete(ire); 2587dc3879f9Sjarrett *irep = NULL; 2588dc3879f9Sjarrett return (error); 2589dc3879f9Sjarrett } 2590dc3879f9Sjarrett } 25917c478bd9Sstevel@tonic-gate } 25927c478bd9Sstevel@tonic-gate 25937c478bd9Sstevel@tonic-gate /* 25947c478bd9Sstevel@tonic-gate * In case ire was changed 25957c478bd9Sstevel@tonic-gate */ 25967c478bd9Sstevel@tonic-gate *irep = ire; 25975c0b7edeSseb if (ire->ire_ipversion == IPV6_VERSION) 25987c478bd9Sstevel@tonic-gate error = ire_add_v6(irep, q, mp, func); 25997c478bd9Sstevel@tonic-gate else 26005c0b7edeSseb error = ire_add_v4(irep, q, mp, func, allow_unresolved); 26017c478bd9Sstevel@tonic-gate if (ipif != NULL) 26027c478bd9Sstevel@tonic-gate ipif_refrele(ipif); 26037c478bd9Sstevel@tonic-gate return (error); 26047c478bd9Sstevel@tonic-gate } 26057c478bd9Sstevel@tonic-gate 26067c478bd9Sstevel@tonic-gate /* 2607dc3879f9Sjarrett * Add an initialized IRE to an appropriate table based on ire_type. 26087c478bd9Sstevel@tonic-gate * 26096bdb8e66Sdd193516 * The forward table contains IRE_PREFIX/IRE_HOST and 26107c478bd9Sstevel@tonic-gate * IRE_IF_RESOLVER/IRE_IF_NORESOLVER and IRE_DEFAULT. 26117c478bd9Sstevel@tonic-gate * 26127c478bd9Sstevel@tonic-gate * The cache table contains IRE_BROADCAST/IRE_LOCAL/IRE_LOOPBACK 26137c478bd9Sstevel@tonic-gate * and IRE_CACHE. 26147c478bd9Sstevel@tonic-gate * 26157c478bd9Sstevel@tonic-gate * NOTE : This function is called as writer though not required 26167c478bd9Sstevel@tonic-gate * by this function. 26177c478bd9Sstevel@tonic-gate */ 26187c478bd9Sstevel@tonic-gate static int 2619c793af95Ssangeeta ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func, 2620c793af95Ssangeeta boolean_t allow_unresolved) 26217c478bd9Sstevel@tonic-gate { 26227c478bd9Sstevel@tonic-gate ire_t *ire1; 26237c478bd9Sstevel@tonic-gate irb_t *irb_ptr; 26247c478bd9Sstevel@tonic-gate ire_t **irep; 26257c478bd9Sstevel@tonic-gate int flags; 26267c478bd9Sstevel@tonic-gate ire_t *pire = NULL; 26277c478bd9Sstevel@tonic-gate ill_t *stq_ill; 26287c478bd9Sstevel@tonic-gate ire_t *ire = *ire_p; 26297c478bd9Sstevel@tonic-gate int error; 2630c793af95Ssangeeta boolean_t need_refrele = B_FALSE; 2631c793af95Ssangeeta nce_t *nce; 2632f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 2633e11c3f44Smeem uint_t marks = 0; 2634e11c3f44Smeem 2635e11c3f44Smeem /* 2636e11c3f44Smeem * IREs with source addresses hosted on interfaces that are under IPMP 2637e11c3f44Smeem * should be hidden so that applications don't accidentally end up 2638e11c3f44Smeem * sending packets with test addresses as their source addresses, or 2639e11c3f44Smeem * sending out interfaces that are e.g. IFF_INACTIVE. Hide them here. 2640e11c3f44Smeem */ 2641e11c3f44Smeem if (ire->ire_ipif != NULL && IS_UNDER_IPMP(ire->ire_ipif->ipif_ill)) 2642e11c3f44Smeem marks |= IRE_MARK_TESTHIDDEN; 26437c478bd9Sstevel@tonic-gate 26447c478bd9Sstevel@tonic-gate if (ire->ire_ipif != NULL) 26457c478bd9Sstevel@tonic-gate ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock)); 26467c478bd9Sstevel@tonic-gate if (ire->ire_stq != NULL) 26477c478bd9Sstevel@tonic-gate ASSERT(!MUTEX_HELD( 26487c478bd9Sstevel@tonic-gate &((ill_t *)(ire->ire_stq->q_ptr))->ill_lock)); 26497c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV4_VERSION); 26507c478bd9Sstevel@tonic-gate ASSERT(ire->ire_mp == NULL); /* Calls should go through ire_add */ 26517c478bd9Sstevel@tonic-gate 26527c478bd9Sstevel@tonic-gate /* Find the appropriate list head. */ 26537c478bd9Sstevel@tonic-gate switch (ire->ire_type) { 26547c478bd9Sstevel@tonic-gate case IRE_HOST: 26557c478bd9Sstevel@tonic-gate ire->ire_mask = IP_HOST_MASK; 26567c478bd9Sstevel@tonic-gate ire->ire_masklen = IP_ABITS; 2657e11c3f44Smeem ire->ire_marks |= marks; 26587c478bd9Sstevel@tonic-gate if ((ire->ire_flags & RTF_SETSRC) == 0) 26597c478bd9Sstevel@tonic-gate ire->ire_src_addr = 0; 26607c478bd9Sstevel@tonic-gate break; 26617c478bd9Sstevel@tonic-gate case IRE_CACHE: 2662e11c3f44Smeem ire->ire_mask = IP_HOST_MASK; 2663e11c3f44Smeem ire->ire_masklen = IP_ABITS; 2664e11c3f44Smeem ire->ire_marks |= marks; 2665e11c3f44Smeem break; 26667c478bd9Sstevel@tonic-gate case IRE_BROADCAST: 26677c478bd9Sstevel@tonic-gate case IRE_LOCAL: 26687c478bd9Sstevel@tonic-gate case IRE_LOOPBACK: 26697c478bd9Sstevel@tonic-gate ire->ire_mask = IP_HOST_MASK; 26707c478bd9Sstevel@tonic-gate ire->ire_masklen = IP_ABITS; 26717c478bd9Sstevel@tonic-gate break; 26727c478bd9Sstevel@tonic-gate case IRE_PREFIX: 26737c478bd9Sstevel@tonic-gate case IRE_DEFAULT: 2674e11c3f44Smeem ire->ire_marks |= marks; 26757c478bd9Sstevel@tonic-gate if ((ire->ire_flags & RTF_SETSRC) == 0) 26767c478bd9Sstevel@tonic-gate ire->ire_src_addr = 0; 26777c478bd9Sstevel@tonic-gate break; 26787c478bd9Sstevel@tonic-gate case IRE_IF_RESOLVER: 26797c478bd9Sstevel@tonic-gate case IRE_IF_NORESOLVER: 2680e11c3f44Smeem ire->ire_marks |= marks; 26817c478bd9Sstevel@tonic-gate break; 26827c478bd9Sstevel@tonic-gate default: 2683c793af95Ssangeeta ip0dbg(("ire_add_v4: ire %p has unrecognized IRE type (%d)\n", 2684c793af95Ssangeeta (void *)ire, ire->ire_type)); 26857c478bd9Sstevel@tonic-gate ire_delete(ire); 26867c478bd9Sstevel@tonic-gate *ire_p = NULL; 26877c478bd9Sstevel@tonic-gate return (EINVAL); 26887c478bd9Sstevel@tonic-gate } 26897c478bd9Sstevel@tonic-gate 26907c478bd9Sstevel@tonic-gate /* Make sure the address is properly masked. */ 26917c478bd9Sstevel@tonic-gate ire->ire_addr &= ire->ire_mask; 26927c478bd9Sstevel@tonic-gate 26937c478bd9Sstevel@tonic-gate /* 26947c478bd9Sstevel@tonic-gate * ip_newroute/ip_newroute_multi are unable to prevent the deletion 26957c478bd9Sstevel@tonic-gate * of the interface route while adding an IRE_CACHE for an on-link 26967c478bd9Sstevel@tonic-gate * destination in the IRE_IF_RESOLVER case, since the ire has to 26977c478bd9Sstevel@tonic-gate * go to ARP and return. We can't do a REFHOLD on the 26987c478bd9Sstevel@tonic-gate * associated interface ire for fear of ARP freeing the message. 26997c478bd9Sstevel@tonic-gate * Here we look up the interface ire in the forwarding table and 27007c478bd9Sstevel@tonic-gate * make sure that the interface route has not been deleted. 27017c478bd9Sstevel@tonic-gate */ 27027c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_CACHE && ire->ire_gateway_addr == 0 && 27037c478bd9Sstevel@tonic-gate ((ill_t *)ire->ire_stq->q_ptr)->ill_net_type == IRE_IF_RESOLVER) { 2704c793af95Ssangeeta 27057c478bd9Sstevel@tonic-gate ASSERT(ire->ire_max_fragp == NULL); 27067c478bd9Sstevel@tonic-gate if (CLASSD(ire->ire_addr) && !(ire->ire_flags & RTF_SETSRC)) { 27077c478bd9Sstevel@tonic-gate /* 27087c478bd9Sstevel@tonic-gate * The ihandle that we used in ip_newroute_multi 27097c478bd9Sstevel@tonic-gate * comes from the interface route corresponding 27107c478bd9Sstevel@tonic-gate * to ire_ipif. Lookup here to see if it exists 27117c478bd9Sstevel@tonic-gate * still. 27127c478bd9Sstevel@tonic-gate * If the ire has a source address assigned using 27137c478bd9Sstevel@tonic-gate * RTF_SETSRC, ire_ipif is the logical interface holding 27147c478bd9Sstevel@tonic-gate * this source address, so we can't use it to check for 27157c478bd9Sstevel@tonic-gate * the existence of the interface route. Instead we rely 27167c478bd9Sstevel@tonic-gate * on the brute force ihandle search in 27177c478bd9Sstevel@tonic-gate * ire_ihandle_lookup_onlink() below. 27187c478bd9Sstevel@tonic-gate */ 27197c478bd9Sstevel@tonic-gate pire = ipif_to_ire(ire->ire_ipif); 27207c478bd9Sstevel@tonic-gate if (pire == NULL) { 27217c478bd9Sstevel@tonic-gate ire_delete(ire); 27227c478bd9Sstevel@tonic-gate *ire_p = NULL; 27237c478bd9Sstevel@tonic-gate return (EINVAL); 27247c478bd9Sstevel@tonic-gate } else if (pire->ire_ihandle != ire->ire_ihandle) { 27257c478bd9Sstevel@tonic-gate ire_refrele(pire); 27267c478bd9Sstevel@tonic-gate ire_delete(ire); 27277c478bd9Sstevel@tonic-gate *ire_p = NULL; 27287c478bd9Sstevel@tonic-gate return (EINVAL); 27297c478bd9Sstevel@tonic-gate } 27307c478bd9Sstevel@tonic-gate } else { 27317c478bd9Sstevel@tonic-gate pire = ire_ihandle_lookup_onlink(ire); 27327c478bd9Sstevel@tonic-gate if (pire == NULL) { 27337c478bd9Sstevel@tonic-gate ire_delete(ire); 27347c478bd9Sstevel@tonic-gate *ire_p = NULL; 27357c478bd9Sstevel@tonic-gate return (EINVAL); 27367c478bd9Sstevel@tonic-gate } 27377c478bd9Sstevel@tonic-gate } 27387c478bd9Sstevel@tonic-gate /* Prevent pire from getting deleted */ 27397c478bd9Sstevel@tonic-gate IRB_REFHOLD(pire->ire_bucket); 27407c478bd9Sstevel@tonic-gate /* Has it been removed already ? */ 27417c478bd9Sstevel@tonic-gate if (pire->ire_marks & IRE_MARK_CONDEMNED) { 27427c478bd9Sstevel@tonic-gate IRB_REFRELE(pire->ire_bucket); 27437c478bd9Sstevel@tonic-gate ire_refrele(pire); 27447c478bd9Sstevel@tonic-gate ire_delete(ire); 27457c478bd9Sstevel@tonic-gate *ire_p = NULL; 27467c478bd9Sstevel@tonic-gate return (EINVAL); 27477c478bd9Sstevel@tonic-gate } 27487c478bd9Sstevel@tonic-gate } else { 27497c478bd9Sstevel@tonic-gate ASSERT(ire->ire_max_fragp != NULL); 27507c478bd9Sstevel@tonic-gate } 27517c478bd9Sstevel@tonic-gate flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW); 27527c478bd9Sstevel@tonic-gate 27537c478bd9Sstevel@tonic-gate if (ire->ire_ipif != NULL) { 27547c478bd9Sstevel@tonic-gate /* 27557c478bd9Sstevel@tonic-gate * We use MATCH_IRE_IPIF while adding IRE_CACHES only 27567c478bd9Sstevel@tonic-gate * for historic reasons and to maintain symmetry with 27577c478bd9Sstevel@tonic-gate * IPv6 code path. Historically this was used by 27587c478bd9Sstevel@tonic-gate * multicast code to create multiple IRE_CACHES on 27597c478bd9Sstevel@tonic-gate * a single ill with different ipifs. This was used 27607c478bd9Sstevel@tonic-gate * so that multicast packets leaving the node had the 27617c478bd9Sstevel@tonic-gate * right source address. This is no longer needed as 27627c478bd9Sstevel@tonic-gate * ip_wput initializes the address correctly. 27637c478bd9Sstevel@tonic-gate */ 27647c478bd9Sstevel@tonic-gate flags |= MATCH_IRE_IPIF; 27657c478bd9Sstevel@tonic-gate /* 2766e11c3f44Smeem * If we are creating a hidden IRE, make sure we search for 2767e11c3f44Smeem * hidden IREs when searching for duplicates below. 2768e11c3f44Smeem * Otherwise, we might find an IRE on some other interface 2769e11c3f44Smeem * that's not marked hidden. 27707c478bd9Sstevel@tonic-gate */ 2771e11c3f44Smeem if (ire->ire_marks & IRE_MARK_TESTHIDDEN) 2772e11c3f44Smeem flags |= MATCH_IRE_MARK_TESTHIDDEN; 27737c478bd9Sstevel@tonic-gate } 2774c793af95Ssangeeta if ((ire->ire_type & IRE_CACHETABLE) == 0) { 2775c793af95Ssangeeta irb_ptr = ire_get_bucket(ire); 2776c793af95Ssangeeta need_refrele = B_TRUE; 2777c793af95Ssangeeta if (irb_ptr == NULL) { 2778c793af95Ssangeeta /* 2779c793af95Ssangeeta * This assumes that the ire has not added 2780c793af95Ssangeeta * a reference to the ipif. 2781c793af95Ssangeeta */ 2782c793af95Ssangeeta ire->ire_ipif = NULL; 2783c793af95Ssangeeta ire_delete(ire); 2784c793af95Ssangeeta if (pire != NULL) { 2785c793af95Ssangeeta IRB_REFRELE(pire->ire_bucket); 2786c793af95Ssangeeta ire_refrele(pire); 2787c793af95Ssangeeta } 2788c793af95Ssangeeta *ire_p = NULL; 2789c793af95Ssangeeta return (EINVAL); 2790c793af95Ssangeeta } 2791c793af95Ssangeeta } else { 2792f4b3ec61Sdh155122 irb_ptr = &(ipst->ips_ip_cache_table[IRE_ADDR_HASH( 2793f4b3ec61Sdh155122 ire->ire_addr, ipst->ips_ip_cache_table_size)]); 2794c793af95Ssangeeta } 27957c478bd9Sstevel@tonic-gate 27967c478bd9Sstevel@tonic-gate /* 27977c478bd9Sstevel@tonic-gate * Start the atomic add of the ire. Grab the ill locks, 27987c478bd9Sstevel@tonic-gate * ill_g_usesrc_lock and the bucket lock. Check for condemned 27997c478bd9Sstevel@tonic-gate * 28007c478bd9Sstevel@tonic-gate * If ipif or ill is changing ire_atomic_start() may queue the 28017c478bd9Sstevel@tonic-gate * request and return EINPROGRESS. 2802f4b3ec61Sdh155122 * To avoid lock order problems, get the ndp4->ndp_g_lock. 28037c478bd9Sstevel@tonic-gate */ 2804f4b3ec61Sdh155122 mutex_enter(&ipst->ips_ndp4->ndp_g_lock); 28057c478bd9Sstevel@tonic-gate error = ire_atomic_start(irb_ptr, ire, q, mp, func); 28067c478bd9Sstevel@tonic-gate if (error != 0) { 2807f4b3ec61Sdh155122 mutex_exit(&ipst->ips_ndp4->ndp_g_lock); 28087c478bd9Sstevel@tonic-gate /* 28097c478bd9Sstevel@tonic-gate * We don't know whether it is a valid ipif or not. 28107c478bd9Sstevel@tonic-gate * So, set it to NULL. This assumes that the ire has not added 28117c478bd9Sstevel@tonic-gate * a reference to the ipif. 28127c478bd9Sstevel@tonic-gate */ 28137c478bd9Sstevel@tonic-gate ire->ire_ipif = NULL; 28147c478bd9Sstevel@tonic-gate ire_delete(ire); 28157c478bd9Sstevel@tonic-gate if (pire != NULL) { 28167c478bd9Sstevel@tonic-gate IRB_REFRELE(pire->ire_bucket); 28177c478bd9Sstevel@tonic-gate ire_refrele(pire); 28187c478bd9Sstevel@tonic-gate } 28197c478bd9Sstevel@tonic-gate *ire_p = NULL; 2820c793af95Ssangeeta if (need_refrele) 2821c793af95Ssangeeta IRB_REFRELE(irb_ptr); 28227c478bd9Sstevel@tonic-gate return (error); 28237c478bd9Sstevel@tonic-gate } 28247c478bd9Sstevel@tonic-gate /* 28257c478bd9Sstevel@tonic-gate * To avoid creating ires having stale values for the ire_max_frag 28267c478bd9Sstevel@tonic-gate * we get the latest value atomically here. For more details 28277c478bd9Sstevel@tonic-gate * see the block comment in ip_sioctl_mtu and in DL_NOTE_SDU_CHANGE 28287c478bd9Sstevel@tonic-gate * in ip_rput_dlpi_writer 28297c478bd9Sstevel@tonic-gate */ 28307c478bd9Sstevel@tonic-gate if (ire->ire_max_fragp == NULL) { 28317c478bd9Sstevel@tonic-gate if (CLASSD(ire->ire_addr)) 28327c478bd9Sstevel@tonic-gate ire->ire_max_frag = ire->ire_ipif->ipif_mtu; 28337c478bd9Sstevel@tonic-gate else 28347c478bd9Sstevel@tonic-gate ire->ire_max_frag = pire->ire_max_frag; 28357c478bd9Sstevel@tonic-gate } else { 28367c478bd9Sstevel@tonic-gate uint_t max_frag; 28377c478bd9Sstevel@tonic-gate 28387c478bd9Sstevel@tonic-gate max_frag = *ire->ire_max_fragp; 28397c478bd9Sstevel@tonic-gate ire->ire_max_fragp = NULL; 28407c478bd9Sstevel@tonic-gate ire->ire_max_frag = max_frag; 28417c478bd9Sstevel@tonic-gate } 28427c478bd9Sstevel@tonic-gate /* 28437c478bd9Sstevel@tonic-gate * Atomically check for duplicate and insert in the table. 28447c478bd9Sstevel@tonic-gate */ 28457c478bd9Sstevel@tonic-gate for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) { 28467c478bd9Sstevel@tonic-gate if (ire1->ire_marks & IRE_MARK_CONDEMNED) 28477c478bd9Sstevel@tonic-gate continue; 28487c478bd9Sstevel@tonic-gate if (ire->ire_ipif != NULL) { 28497c478bd9Sstevel@tonic-gate /* 28507c478bd9Sstevel@tonic-gate * We do MATCH_IRE_ILL implicitly here for IREs 28517c478bd9Sstevel@tonic-gate * with a non-null ire_ipif, including IRE_CACHEs. 28527c478bd9Sstevel@tonic-gate * As ire_ipif and ire_stq could point to two 28537c478bd9Sstevel@tonic-gate * different ills, we can't pass just ire_ipif to 28547c478bd9Sstevel@tonic-gate * ire_match_args and get a match on both ills. 28557c478bd9Sstevel@tonic-gate * This is just needed for duplicate checks here and 28567c478bd9Sstevel@tonic-gate * so we don't add an extra argument to 28577c478bd9Sstevel@tonic-gate * ire_match_args for this. Do it locally. 28587c478bd9Sstevel@tonic-gate * 28597c478bd9Sstevel@tonic-gate * NOTE : Currently there is no part of the code 28607c478bd9Sstevel@tonic-gate * that asks for both MATH_IRE_IPIF and MATCH_IRE_ILL 28617c478bd9Sstevel@tonic-gate * match for IRE_CACHEs. Thus we don't want to 28627c478bd9Sstevel@tonic-gate * extend the arguments to ire_match_args. 28637c478bd9Sstevel@tonic-gate */ 28647c478bd9Sstevel@tonic-gate if (ire1->ire_stq != ire->ire_stq) 28657c478bd9Sstevel@tonic-gate continue; 28667c478bd9Sstevel@tonic-gate /* 28677c478bd9Sstevel@tonic-gate * Multiroute IRE_CACHEs for a given destination can 28687c478bd9Sstevel@tonic-gate * have the same ire_ipif, typically if their source 28697c478bd9Sstevel@tonic-gate * address is forced using RTF_SETSRC, and the same 28707c478bd9Sstevel@tonic-gate * send-to queue. We differentiate them using the parent 28717c478bd9Sstevel@tonic-gate * handle. 28727c478bd9Sstevel@tonic-gate */ 28737c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_CACHE && 28747c478bd9Sstevel@tonic-gate (ire1->ire_flags & RTF_MULTIRT) && 28757c478bd9Sstevel@tonic-gate (ire->ire_flags & RTF_MULTIRT) && 28767c478bd9Sstevel@tonic-gate (ire1->ire_phandle != ire->ire_phandle)) 28777c478bd9Sstevel@tonic-gate continue; 28787c478bd9Sstevel@tonic-gate } 28797c478bd9Sstevel@tonic-gate if (ire1->ire_zoneid != ire->ire_zoneid) 28807c478bd9Sstevel@tonic-gate continue; 28817c478bd9Sstevel@tonic-gate if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask, 28827c478bd9Sstevel@tonic-gate ire->ire_gateway_addr, ire->ire_type, ire->ire_ipif, 28835b17e9bdSJon Anderson ire->ire_zoneid, 0, NULL, flags, NULL)) { 28847c478bd9Sstevel@tonic-gate /* 28857c478bd9Sstevel@tonic-gate * Return the old ire after doing a REFHOLD. 28867c478bd9Sstevel@tonic-gate * As most of the callers continue to use the IRE 28877c478bd9Sstevel@tonic-gate * after adding, we return a held ire. This will 28887c478bd9Sstevel@tonic-gate * avoid a lookup in the caller again. If the callers 28897c478bd9Sstevel@tonic-gate * don't want to use it, they need to do a REFRELE. 28907c478bd9Sstevel@tonic-gate */ 2891e11c3f44Smeem ip1dbg(("found dup ire existing %p new %p\n", 28927c478bd9Sstevel@tonic-gate (void *)ire1, (void *)ire)); 28937c478bd9Sstevel@tonic-gate IRE_REFHOLD(ire1); 28947c478bd9Sstevel@tonic-gate ire_atomic_end(irb_ptr, ire); 2895f4b3ec61Sdh155122 mutex_exit(&ipst->ips_ndp4->ndp_g_lock); 28967c478bd9Sstevel@tonic-gate ire_delete(ire); 28977c478bd9Sstevel@tonic-gate if (pire != NULL) { 28987c478bd9Sstevel@tonic-gate /* 28997c478bd9Sstevel@tonic-gate * Assert that it is not removed from the 29007c478bd9Sstevel@tonic-gate * list yet. 29017c478bd9Sstevel@tonic-gate */ 29027c478bd9Sstevel@tonic-gate ASSERT(pire->ire_ptpn != NULL); 29037c478bd9Sstevel@tonic-gate IRB_REFRELE(pire->ire_bucket); 29047c478bd9Sstevel@tonic-gate ire_refrele(pire); 29057c478bd9Sstevel@tonic-gate } 29067c478bd9Sstevel@tonic-gate *ire_p = ire1; 2907c793af95Ssangeeta if (need_refrele) 2908c793af95Ssangeeta IRB_REFRELE(irb_ptr); 29097c478bd9Sstevel@tonic-gate return (0); 29107c478bd9Sstevel@tonic-gate } 29117c478bd9Sstevel@tonic-gate } 2912e11c3f44Smeem 2913c793af95Ssangeeta if (ire->ire_type & IRE_CACHE) { 2914c793af95Ssangeeta ASSERT(ire->ire_stq != NULL); 2915c793af95Ssangeeta nce = ndp_lookup_v4(ire_to_ill(ire), 2916c793af95Ssangeeta ((ire->ire_gateway_addr != INADDR_ANY) ? 2917c793af95Ssangeeta &ire->ire_gateway_addr : &ire->ire_addr), 2918c793af95Ssangeeta B_TRUE); 2919c793af95Ssangeeta if (nce != NULL) 2920c793af95Ssangeeta mutex_enter(&nce->nce_lock); 2921c793af95Ssangeeta /* 2922c793af95Ssangeeta * if the nce is NCE_F_CONDEMNED, or if it is not ND_REACHABLE 2923c793af95Ssangeeta * and the caller has prohibited the addition of incomplete 2924c793af95Ssangeeta * ire's, we fail the add. Note that nce_state could be 2925b9c344b3Ssowmini * something other than ND_REACHABLE if the nce had 2926b9c344b3Ssowmini * just expired and the ire_create preceding the 2927b9c344b3Ssowmini * ire_add added a new ND_INITIAL nce. 2928c793af95Ssangeeta */ 2929c793af95Ssangeeta if ((nce == NULL) || 2930c793af95Ssangeeta (nce->nce_flags & NCE_F_CONDEMNED) || 2931c793af95Ssangeeta (!allow_unresolved && 2932107875b0Ssangeeta (nce->nce_state != ND_REACHABLE))) { 2933b9c344b3Ssowmini if (nce != NULL) { 2934b9c344b3Ssowmini DTRACE_PROBE1(ire__bad__nce, nce_t *, nce); 2935c793af95Ssangeeta mutex_exit(&nce->nce_lock); 2936b9c344b3Ssowmini } 2937c793af95Ssangeeta ire_atomic_end(irb_ptr, ire); 2938f4b3ec61Sdh155122 mutex_exit(&ipst->ips_ndp4->ndp_g_lock); 2939c793af95Ssangeeta if (nce != NULL) 2940c793af95Ssangeeta NCE_REFRELE(nce); 2941c793af95Ssangeeta DTRACE_PROBE1(ire__no__nce, ire_t *, ire); 2942c793af95Ssangeeta ire_delete(ire); 2943c793af95Ssangeeta if (pire != NULL) { 2944c793af95Ssangeeta IRB_REFRELE(pire->ire_bucket); 2945c793af95Ssangeeta ire_refrele(pire); 2946c793af95Ssangeeta } 2947c793af95Ssangeeta *ire_p = NULL; 2948c793af95Ssangeeta if (need_refrele) 2949c793af95Ssangeeta IRB_REFRELE(irb_ptr); 2950c793af95Ssangeeta return (EINVAL); 2951c793af95Ssangeeta } else { 2952c793af95Ssangeeta ire->ire_nce = nce; 2953c793af95Ssangeeta mutex_exit(&nce->nce_lock); 2954c793af95Ssangeeta /* 2955c793af95Ssangeeta * We are associating this nce to the ire, so 2956c793af95Ssangeeta * change the nce ref taken in ndp_lookup_v4() from 2957c793af95Ssangeeta * NCE_REFHOLD to NCE_REFHOLD_NOTR 2958c793af95Ssangeeta */ 2959c793af95Ssangeeta NCE_REFHOLD_TO_REFHOLD_NOTR(ire->ire_nce); 2960c793af95Ssangeeta } 2961c793af95Ssangeeta } 29627c478bd9Sstevel@tonic-gate /* 29637c478bd9Sstevel@tonic-gate * Make it easy for ip_wput_ire() to hit multiple broadcast ires by 2964e11c3f44Smeem * grouping identical addresses together on the hash chain. We do 2965e11c3f44Smeem * this only for IRE_BROADCASTs as ip_wput_ire is currently interested 2966e11c3f44Smeem * in such groupings only for broadcasts. 29677c478bd9Sstevel@tonic-gate * 29687c478bd9Sstevel@tonic-gate * Find the first entry that matches ire_addr. *irep will be null 29697c478bd9Sstevel@tonic-gate * if no match. 297001802382Ssowmini * 297101802382Ssowmini * Note: the loopback and non-loopback broadcast entries for an 297201802382Ssowmini * interface MUST be added before any MULTIRT entries. 29737c478bd9Sstevel@tonic-gate */ 29747c478bd9Sstevel@tonic-gate irep = (ire_t **)irb_ptr; 29757c478bd9Sstevel@tonic-gate while ((ire1 = *irep) != NULL && ire->ire_addr != ire1->ire_addr) 29767c478bd9Sstevel@tonic-gate irep = &ire1->ire_next; 29777c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_BROADCAST && *irep != NULL) { 29787c478bd9Sstevel@tonic-gate /* 29797c478bd9Sstevel@tonic-gate * We found some ire (i.e *irep) with a matching addr. We 2980e11c3f44Smeem * want to group ires with same addr. 29817c478bd9Sstevel@tonic-gate */ 298201802382Ssowmini for (;;) { 29837c478bd9Sstevel@tonic-gate ire1 = *irep; 29847c478bd9Sstevel@tonic-gate if ((ire1->ire_next == NULL) || 29857c478bd9Sstevel@tonic-gate (ire1->ire_next->ire_addr != ire->ire_addr) || 29867c478bd9Sstevel@tonic-gate (ire1->ire_type != IRE_BROADCAST) || 298701802382Ssowmini (ire1->ire_flags & RTF_MULTIRT) || 2988e11c3f44Smeem (ire1->ire_ipif->ipif_ill->ill_grp == 2989e11c3f44Smeem ire->ire_ipif->ipif_ill->ill_grp)) 29907c478bd9Sstevel@tonic-gate break; 29917c478bd9Sstevel@tonic-gate irep = &ire1->ire_next; 29927c478bd9Sstevel@tonic-gate } 29937c478bd9Sstevel@tonic-gate ASSERT(*irep != NULL); 299401802382Ssowmini /* 299501802382Ssowmini * The ire will be added before *irep, so 299601802382Ssowmini * if irep is a MULTIRT ire, just break to 299701802382Ssowmini * ire insertion code. 299801802382Ssowmini */ 299901802382Ssowmini if (((*irep)->ire_flags & RTF_MULTIRT) != 0) 300001802382Ssowmini goto insert_ire; 300101802382Ssowmini 30027c478bd9Sstevel@tonic-gate irep = &((*irep)->ire_next); 30037c478bd9Sstevel@tonic-gate 30047c478bd9Sstevel@tonic-gate /* 30057c478bd9Sstevel@tonic-gate * Either we have hit the end of the list or the address 3006e11c3f44Smeem * did not match. 30077c478bd9Sstevel@tonic-gate */ 30087c478bd9Sstevel@tonic-gate while (*irep != NULL) { 30097c478bd9Sstevel@tonic-gate ire1 = *irep; 30107c478bd9Sstevel@tonic-gate if ((ire1->ire_addr != ire->ire_addr) || 3011e11c3f44Smeem (ire1->ire_type != IRE_BROADCAST)) 30127c478bd9Sstevel@tonic-gate break; 3013e11c3f44Smeem if (ire1->ire_ipif == ire->ire_ipif) { 30147c478bd9Sstevel@tonic-gate irep = &ire1->ire_next; 30157c478bd9Sstevel@tonic-gate break; 30167c478bd9Sstevel@tonic-gate } 30177c478bd9Sstevel@tonic-gate irep = &ire1->ire_next; 30187c478bd9Sstevel@tonic-gate } 30197c478bd9Sstevel@tonic-gate } else if (*irep != NULL) { 30207c478bd9Sstevel@tonic-gate /* 30217c478bd9Sstevel@tonic-gate * Find the last ire which matches ire_addr. 30227c478bd9Sstevel@tonic-gate * Needed to do tail insertion among entries with the same 30237c478bd9Sstevel@tonic-gate * ire_addr. 30247c478bd9Sstevel@tonic-gate */ 30257c478bd9Sstevel@tonic-gate while (ire->ire_addr == ire1->ire_addr) { 30267c478bd9Sstevel@tonic-gate irep = &ire1->ire_next; 30277c478bd9Sstevel@tonic-gate ire1 = *irep; 30287c478bd9Sstevel@tonic-gate if (ire1 == NULL) 30297c478bd9Sstevel@tonic-gate break; 30307c478bd9Sstevel@tonic-gate } 30317c478bd9Sstevel@tonic-gate } 30327c478bd9Sstevel@tonic-gate 303301802382Ssowmini insert_ire: 30347c478bd9Sstevel@tonic-gate /* Insert at *irep */ 30357c478bd9Sstevel@tonic-gate ire1 = *irep; 30367c478bd9Sstevel@tonic-gate if (ire1 != NULL) 30377c478bd9Sstevel@tonic-gate ire1->ire_ptpn = &ire->ire_next; 30387c478bd9Sstevel@tonic-gate ire->ire_next = ire1; 30397c478bd9Sstevel@tonic-gate /* Link the new one in. */ 30407c478bd9Sstevel@tonic-gate ire->ire_ptpn = irep; 30417c478bd9Sstevel@tonic-gate 30427c478bd9Sstevel@tonic-gate /* 30437c478bd9Sstevel@tonic-gate * ire_walk routines de-reference ire_next without holding 30447c478bd9Sstevel@tonic-gate * a lock. Before we point to the new ire, we want to make 30457c478bd9Sstevel@tonic-gate * sure the store that sets the ire_next of the new ire 30467c478bd9Sstevel@tonic-gate * reaches global visibility, so that ire_walk routines 30477c478bd9Sstevel@tonic-gate * don't see a truncated list of ires i.e if the ire_next 30487c478bd9Sstevel@tonic-gate * of the new ire gets set after we do "*irep = ire" due 30497c478bd9Sstevel@tonic-gate * to re-ordering, the ire_walk thread will see a NULL 30507c478bd9Sstevel@tonic-gate * once it accesses the ire_next of the new ire. 30517c478bd9Sstevel@tonic-gate * membar_producer() makes sure that the following store 30527c478bd9Sstevel@tonic-gate * happens *after* all of the above stores. 30537c478bd9Sstevel@tonic-gate */ 30547c478bd9Sstevel@tonic-gate membar_producer(); 30557c478bd9Sstevel@tonic-gate *irep = ire; 30567c478bd9Sstevel@tonic-gate ire->ire_bucket = irb_ptr; 30577c478bd9Sstevel@tonic-gate /* 30587c478bd9Sstevel@tonic-gate * We return a bumped up IRE above. Keep it symmetrical 30597c478bd9Sstevel@tonic-gate * so that the callers will always have to release. This 30607c478bd9Sstevel@tonic-gate * helps the callers of this function because they continue 30617c478bd9Sstevel@tonic-gate * to use the IRE after adding and hence they don't have to 30627c478bd9Sstevel@tonic-gate * lookup again after we return the IRE. 30637c478bd9Sstevel@tonic-gate * 30647c478bd9Sstevel@tonic-gate * NOTE : We don't have to use atomics as this is appearing 30657c478bd9Sstevel@tonic-gate * in the list for the first time and no one else can bump 30667c478bd9Sstevel@tonic-gate * up the reference count on this yet. 30677c478bd9Sstevel@tonic-gate */ 30687c478bd9Sstevel@tonic-gate IRE_REFHOLD_LOCKED(ire); 3069f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_inserted); 3070c793af95Ssangeeta 30717c478bd9Sstevel@tonic-gate irb_ptr->irb_ire_cnt++; 3072c793af95Ssangeeta if (irb_ptr->irb_marks & IRB_MARK_FTABLE) 3073c793af95Ssangeeta irb_ptr->irb_nire++; 3074c793af95Ssangeeta 30757c478bd9Sstevel@tonic-gate if (ire->ire_marks & IRE_MARK_TEMPORARY) 30767c478bd9Sstevel@tonic-gate irb_ptr->irb_tmp_ire_cnt++; 30777c478bd9Sstevel@tonic-gate 30787c478bd9Sstevel@tonic-gate if (ire->ire_ipif != NULL) { 3079968d2fd1Ssowmini DTRACE_PROBE3(ipif__incr__cnt, (ipif_t *), ire->ire_ipif, 3080968d2fd1Ssowmini (char *), "ire", (void *), ire); 3081384ad179Ssowmini ire->ire_ipif->ipif_ire_cnt++; 30827c478bd9Sstevel@tonic-gate if (ire->ire_stq != NULL) { 30837c478bd9Sstevel@tonic-gate stq_ill = (ill_t *)ire->ire_stq->q_ptr; 3084968d2fd1Ssowmini DTRACE_PROBE3(ill__incr__cnt, (ill_t *), stq_ill, 3085968d2fd1Ssowmini (char *), "ire", (void *), ire); 3086384ad179Ssowmini stq_ill->ill_ire_cnt++; 30877c478bd9Sstevel@tonic-gate } 30887c478bd9Sstevel@tonic-gate } else { 30897c478bd9Sstevel@tonic-gate ASSERT(ire->ire_stq == NULL); 30907c478bd9Sstevel@tonic-gate } 30917c478bd9Sstevel@tonic-gate 30927c478bd9Sstevel@tonic-gate ire_atomic_end(irb_ptr, ire); 3093f4b3ec61Sdh155122 mutex_exit(&ipst->ips_ndp4->ndp_g_lock); 30947c478bd9Sstevel@tonic-gate 30957c478bd9Sstevel@tonic-gate if (pire != NULL) { 30967c478bd9Sstevel@tonic-gate /* Assert that it is not removed from the list yet */ 30977c478bd9Sstevel@tonic-gate ASSERT(pire->ire_ptpn != NULL); 30987c478bd9Sstevel@tonic-gate IRB_REFRELE(pire->ire_bucket); 30997c478bd9Sstevel@tonic-gate ire_refrele(pire); 31007c478bd9Sstevel@tonic-gate } 31017c478bd9Sstevel@tonic-gate 31027c478bd9Sstevel@tonic-gate if (ire->ire_type != IRE_CACHE) { 31037c478bd9Sstevel@tonic-gate /* 3104c793af95Ssangeeta * For ire's with host mask see if there is an entry 31057c478bd9Sstevel@tonic-gate * in the cache. If there is one flush the whole cache as 31067c478bd9Sstevel@tonic-gate * there might be multiple entries due to RTF_MULTIRT (CGTP). 31077c478bd9Sstevel@tonic-gate * If no entry is found than there is no need to flush the 31087c478bd9Sstevel@tonic-gate * cache. 31097c478bd9Sstevel@tonic-gate */ 31107c478bd9Sstevel@tonic-gate if (ire->ire_mask == IP_HOST_MASK) { 31117c478bd9Sstevel@tonic-gate ire_t *lire; 31127c478bd9Sstevel@tonic-gate lire = ire_ctable_lookup(ire->ire_addr, NULL, IRE_CACHE, 3113f4b3ec61Sdh155122 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 31147c478bd9Sstevel@tonic-gate if (lire != NULL) { 31157c478bd9Sstevel@tonic-gate ire_refrele(lire); 31167c478bd9Sstevel@tonic-gate ire_flush_cache_v4(ire, IRE_FLUSH_ADD); 31177c478bd9Sstevel@tonic-gate } 31187c478bd9Sstevel@tonic-gate } else { 31197c478bd9Sstevel@tonic-gate ire_flush_cache_v4(ire, IRE_FLUSH_ADD); 31207c478bd9Sstevel@tonic-gate } 31217c478bd9Sstevel@tonic-gate } 31227c478bd9Sstevel@tonic-gate /* 31237c478bd9Sstevel@tonic-gate * We had to delay the fast path probe until the ire is inserted 31247c478bd9Sstevel@tonic-gate * in the list. Otherwise the fast path ack won't find the ire in 31257c478bd9Sstevel@tonic-gate * the table. 31267c478bd9Sstevel@tonic-gate */ 3127516bda92Ssowmini if (ire->ire_type == IRE_CACHE || 3128516bda92Ssowmini (ire->ire_type == IRE_BROADCAST && ire->ire_stq != NULL)) { 3129516bda92Ssowmini ASSERT(ire->ire_nce != NULL); 313054da8755Ssowmini if (ire->ire_nce->nce_state == ND_REACHABLE) 3131516bda92Ssowmini nce_fastpath(ire->ire_nce); 3132516bda92Ssowmini } 31337c478bd9Sstevel@tonic-gate if (ire->ire_ipif != NULL) 31347c478bd9Sstevel@tonic-gate ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock)); 31357c478bd9Sstevel@tonic-gate *ire_p = ire; 3136c793af95Ssangeeta if (need_refrele) { 3137c793af95Ssangeeta IRB_REFRELE(irb_ptr); 3138c793af95Ssangeeta } 31397c478bd9Sstevel@tonic-gate return (0); 31407c478bd9Sstevel@tonic-gate } 31417c478bd9Sstevel@tonic-gate 31427c478bd9Sstevel@tonic-gate /* 31437c478bd9Sstevel@tonic-gate * IRB_REFRELE is the only caller of the function. ire_unlink calls to 31447c478bd9Sstevel@tonic-gate * do the final cleanup for this ire. 31457c478bd9Sstevel@tonic-gate */ 31467c478bd9Sstevel@tonic-gate void 31477c478bd9Sstevel@tonic-gate ire_cleanup(ire_t *ire) 31487c478bd9Sstevel@tonic-gate { 31497c478bd9Sstevel@tonic-gate ire_t *ire_next; 3150f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 31517c478bd9Sstevel@tonic-gate 31527c478bd9Sstevel@tonic-gate ASSERT(ire != NULL); 31537c478bd9Sstevel@tonic-gate 31547c478bd9Sstevel@tonic-gate while (ire != NULL) { 31557c478bd9Sstevel@tonic-gate ire_next = ire->ire_next; 31567c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV4_VERSION) { 31577c478bd9Sstevel@tonic-gate ire_delete_v4(ire); 3158f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, 3159f4b3ec61Sdh155122 ire_stats_deleted); 31607c478bd9Sstevel@tonic-gate } else { 31617c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV6_VERSION); 31627c478bd9Sstevel@tonic-gate ire_delete_v6(ire); 3163f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, 3164f4b3ec61Sdh155122 ire_stats_deleted); 31657c478bd9Sstevel@tonic-gate } 31667c478bd9Sstevel@tonic-gate /* 31677c478bd9Sstevel@tonic-gate * Now it's really out of the list. Before doing the 31687c478bd9Sstevel@tonic-gate * REFRELE, set ire_next to NULL as ire_inactive asserts 31697c478bd9Sstevel@tonic-gate * so. 31707c478bd9Sstevel@tonic-gate */ 31717c478bd9Sstevel@tonic-gate ire->ire_next = NULL; 31727c478bd9Sstevel@tonic-gate IRE_REFRELE_NOTR(ire); 31737c478bd9Sstevel@tonic-gate ire = ire_next; 31747c478bd9Sstevel@tonic-gate } 31757c478bd9Sstevel@tonic-gate } 31767c478bd9Sstevel@tonic-gate 31777c478bd9Sstevel@tonic-gate /* 31787c478bd9Sstevel@tonic-gate * IRB_REFRELE is the only caller of the function. It calls to unlink 31797c478bd9Sstevel@tonic-gate * all the CONDEMNED ires from this bucket. 31807c478bd9Sstevel@tonic-gate */ 31817c478bd9Sstevel@tonic-gate ire_t * 31827c478bd9Sstevel@tonic-gate ire_unlink(irb_t *irb) 31837c478bd9Sstevel@tonic-gate { 31847c478bd9Sstevel@tonic-gate ire_t *ire; 31857c478bd9Sstevel@tonic-gate ire_t *ire1; 31867c478bd9Sstevel@tonic-gate ire_t **ptpn; 31877c478bd9Sstevel@tonic-gate ire_t *ire_list = NULL; 31887c478bd9Sstevel@tonic-gate 31897c478bd9Sstevel@tonic-gate ASSERT(RW_WRITE_HELD(&irb->irb_lock)); 3190c793af95Ssangeeta ASSERT(((irb->irb_marks & IRB_MARK_FTABLE) && irb->irb_refcnt == 1) || 3191c793af95Ssangeeta (irb->irb_refcnt == 0)); 3192c793af95Ssangeeta ASSERT(irb->irb_marks & IRB_MARK_CONDEMNED); 31937c478bd9Sstevel@tonic-gate ASSERT(irb->irb_ire != NULL); 31947c478bd9Sstevel@tonic-gate 31957c478bd9Sstevel@tonic-gate for (ire = irb->irb_ire; ire != NULL; ire = ire1) { 3196f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 3197f4b3ec61Sdh155122 31987c478bd9Sstevel@tonic-gate ire1 = ire->ire_next; 31997c478bd9Sstevel@tonic-gate if (ire->ire_marks & IRE_MARK_CONDEMNED) { 32007c478bd9Sstevel@tonic-gate ptpn = ire->ire_ptpn; 32017c478bd9Sstevel@tonic-gate ire1 = ire->ire_next; 32027c478bd9Sstevel@tonic-gate if (ire1) 32037c478bd9Sstevel@tonic-gate ire1->ire_ptpn = ptpn; 32047c478bd9Sstevel@tonic-gate *ptpn = ire1; 32057c478bd9Sstevel@tonic-gate ire->ire_ptpn = NULL; 32067c478bd9Sstevel@tonic-gate ire->ire_next = NULL; 32077c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_DEFAULT) { 32087c478bd9Sstevel@tonic-gate /* 32097c478bd9Sstevel@tonic-gate * IRE is out of the list. We need to adjust 32107c478bd9Sstevel@tonic-gate * the accounting before the caller drops 32117c478bd9Sstevel@tonic-gate * the lock. 32127c478bd9Sstevel@tonic-gate */ 32137c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 3214f4b3ec61Sdh155122 ASSERT(ipst-> 3215f4b3ec61Sdh155122 ips_ipv6_ire_default_count != 3216f4b3ec61Sdh155122 0); 3217f4b3ec61Sdh155122 ipst->ips_ipv6_ire_default_count--; 32187c478bd9Sstevel@tonic-gate } 32197c478bd9Sstevel@tonic-gate } 32207c478bd9Sstevel@tonic-gate /* 32217c478bd9Sstevel@tonic-gate * We need to call ire_delete_v4 or ire_delete_v6 32227c478bd9Sstevel@tonic-gate * to clean up the cache or the redirects pointing at 32237c478bd9Sstevel@tonic-gate * the default gateway. We need to drop the lock 32247c478bd9Sstevel@tonic-gate * as ire_flush_cache/ire_delete_host_redircts require 32257c478bd9Sstevel@tonic-gate * so. But we can't drop the lock, as ire_unlink needs 32267c478bd9Sstevel@tonic-gate * to atomically remove the ires from the list. 32277c478bd9Sstevel@tonic-gate * So, create a temporary list of CONDEMNED ires 32287c478bd9Sstevel@tonic-gate * for doing ire_delete_v4/ire_delete_v6 operations 32297c478bd9Sstevel@tonic-gate * later on. 32307c478bd9Sstevel@tonic-gate */ 32317c478bd9Sstevel@tonic-gate ire->ire_next = ire_list; 32327c478bd9Sstevel@tonic-gate ire_list = ire; 32337c478bd9Sstevel@tonic-gate } 32347c478bd9Sstevel@tonic-gate } 3235c793af95Ssangeeta irb->irb_marks &= ~IRB_MARK_CONDEMNED; 32367c478bd9Sstevel@tonic-gate return (ire_list); 32377c478bd9Sstevel@tonic-gate } 32387c478bd9Sstevel@tonic-gate 32397c478bd9Sstevel@tonic-gate /* 32407c478bd9Sstevel@tonic-gate * Delete all the cache entries with this 'addr'. When IP gets a gratuitous 3241c793af95Ssangeeta * ARP message on any of its interface queue, it scans the nce table and 3242c793af95Ssangeeta * deletes and calls ndp_delete() for the appropriate nce. This action 3243c793af95Ssangeeta * also deletes all the neighbor/ire cache entries for that address. 3244c793af95Ssangeeta * This function is called from ip_arp_news in ip.c and also for 3245c793af95Ssangeeta * ARP ioctl processing in ip_if.c. ip_ire_clookup_and_delete returns 3246c793af95Ssangeeta * true if it finds a nce entry which is used by ip_arp_news to determine if 3247c793af95Ssangeeta * it needs to do an ire_walk_v4. The return value is also used for the 3248c793af95Ssangeeta * same purpose by ARP IOCTL processing * in ip_if.c when deleting 3249c793af95Ssangeeta * ARP entries. For SIOC*IFARP ioctls in addition to the address, 3250c793af95Ssangeeta * ip_if->ipif_ill also needs to be matched. 32517c478bd9Sstevel@tonic-gate */ 32527c478bd9Sstevel@tonic-gate boolean_t 3253f4b3ec61Sdh155122 ip_ire_clookup_and_delete(ipaddr_t addr, ipif_t *ipif, ip_stack_t *ipst) 32547c478bd9Sstevel@tonic-gate { 32557c478bd9Sstevel@tonic-gate ill_t *ill; 3256c793af95Ssangeeta nce_t *nce; 32577c478bd9Sstevel@tonic-gate 3258c793af95Ssangeeta ill = (ipif ? ipif->ipif_ill : NULL); 32597c478bd9Sstevel@tonic-gate 3260c793af95Ssangeeta if (ill != NULL) { 3261c793af95Ssangeeta /* 3262c793af95Ssangeeta * clean up the nce (and any relevant ire's) that matches 3263c793af95Ssangeeta * on addr and ill. 3264c793af95Ssangeeta */ 3265c793af95Ssangeeta nce = ndp_lookup_v4(ill, &addr, B_FALSE); 3266c793af95Ssangeeta if (nce != NULL) { 3267c793af95Ssangeeta ndp_delete(nce); 3268c793af95Ssangeeta return (B_TRUE); 32697c478bd9Sstevel@tonic-gate } 3270c793af95Ssangeeta } else { 3271c793af95Ssangeeta /* 3272c793af95Ssangeeta * ill is wildcard. clean up all nce's and 3273c793af95Ssangeeta * ire's that match on addr 3274c793af95Ssangeeta */ 3275c793af95Ssangeeta nce_clookup_t cl; 32767c478bd9Sstevel@tonic-gate 3277c793af95Ssangeeta cl.ncecl_addr = addr; 3278c793af95Ssangeeta cl.ncecl_found = B_FALSE; 32797c478bd9Sstevel@tonic-gate 3280f4b3ec61Sdh155122 ndp_walk_common(ipst->ips_ndp4, NULL, 3281c793af95Ssangeeta (pfi_t)ip_nce_clookup_and_delete, (uchar_t *)&cl, B_TRUE); 3282c793af95Ssangeeta 3283c793af95Ssangeeta /* 3284c793af95Ssangeeta * ncecl_found would be set by ip_nce_clookup_and_delete if 3285c793af95Ssangeeta * we found a matching nce. 3286c793af95Ssangeeta */ 3287c793af95Ssangeeta return (cl.ncecl_found); 3288c793af95Ssangeeta } 3289c793af95Ssangeeta return (B_FALSE); 3290c793af95Ssangeeta 3291c793af95Ssangeeta } 3292c793af95Ssangeeta 3293c793af95Ssangeeta /* Delete the supplied nce if its nce_addr matches the supplied address */ 3294c793af95Ssangeeta static void 3295c793af95Ssangeeta ip_nce_clookup_and_delete(nce_t *nce, void *arg) 3296c793af95Ssangeeta { 3297c793af95Ssangeeta nce_clookup_t *cl = (nce_clookup_t *)arg; 3298c793af95Ssangeeta ipaddr_t nce_addr; 3299c793af95Ssangeeta 3300c793af95Ssangeeta IN6_V4MAPPED_TO_IPADDR(&nce->nce_addr, nce_addr); 3301c793af95Ssangeeta if (nce_addr == cl->ncecl_addr) { 3302c793af95Ssangeeta cl->ncecl_found = B_TRUE; 3303c793af95Ssangeeta /* clean up the nce (and any relevant ire's) */ 3304c793af95Ssangeeta ndp_delete(nce); 3305c793af95Ssangeeta } 3306c793af95Ssangeeta } 3307c793af95Ssangeeta 3308c793af95Ssangeeta /* 3309c793af95Ssangeeta * Clean up the radix node for this ire. Must be called by IRB_REFRELE 3310c793af95Ssangeeta * when there are no ire's left in the bucket. Returns TRUE if the bucket 3311c793af95Ssangeeta * is deleted and freed. 3312c793af95Ssangeeta */ 3313c793af95Ssangeeta boolean_t 3314c793af95Ssangeeta irb_inactive(irb_t *irb) 3315c793af95Ssangeeta { 3316c793af95Ssangeeta struct rt_entry *rt; 3317c793af95Ssangeeta struct radix_node *rn; 3318f4b3ec61Sdh155122 ip_stack_t *ipst = irb->irb_ipst; 3319f4b3ec61Sdh155122 3320f4b3ec61Sdh155122 ASSERT(irb->irb_ipst != NULL); 3321c793af95Ssangeeta 3322c793af95Ssangeeta rt = IRB2RT(irb); 3323c793af95Ssangeeta rn = (struct radix_node *)rt; 3324c793af95Ssangeeta 3325c793af95Ssangeeta /* first remove it from the radix tree. */ 3326f4b3ec61Sdh155122 RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable); 3327c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 3328c793af95Ssangeeta if (irb->irb_refcnt == 1 && irb->irb_nire == 0) { 3329f4b3ec61Sdh155122 rn = ipst->ips_ip_ftable->rnh_deladdr(rn->rn_key, rn->rn_mask, 3330f4b3ec61Sdh155122 ipst->ips_ip_ftable); 3331c793af95Ssangeeta DTRACE_PROBE1(irb__free, rt_t *, rt); 3332c793af95Ssangeeta ASSERT((void *)rn == (void *)rt); 3333c793af95Ssangeeta Free(rt, rt_entry_cache); 3334c793af95Ssangeeta /* irb_lock is freed */ 3335f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 3336c793af95Ssangeeta return (B_TRUE); 3337c793af95Ssangeeta } 3338c793af95Ssangeeta rw_exit(&irb->irb_lock); 3339f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 3340c793af95Ssangeeta return (B_FALSE); 33417c478bd9Sstevel@tonic-gate } 33427c478bd9Sstevel@tonic-gate 33437c478bd9Sstevel@tonic-gate /* 33447c478bd9Sstevel@tonic-gate * Delete the specified IRE. 33457c478bd9Sstevel@tonic-gate */ 33467c478bd9Sstevel@tonic-gate void 33477c478bd9Sstevel@tonic-gate ire_delete(ire_t *ire) 33487c478bd9Sstevel@tonic-gate { 33497c478bd9Sstevel@tonic-gate ire_t *ire1; 33507c478bd9Sstevel@tonic-gate ire_t **ptpn; 33517c478bd9Sstevel@tonic-gate irb_t *irb; 3352f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 33537c478bd9Sstevel@tonic-gate 3354c793af95Ssangeeta if ((irb = ire->ire_bucket) == NULL) { 33557c478bd9Sstevel@tonic-gate /* 33567c478bd9Sstevel@tonic-gate * It was never inserted in the list. Should call REFRELE 33577c478bd9Sstevel@tonic-gate * to free this IRE. 33587c478bd9Sstevel@tonic-gate */ 33597c478bd9Sstevel@tonic-gate IRE_REFRELE_NOTR(ire); 33607c478bd9Sstevel@tonic-gate return; 33617c478bd9Sstevel@tonic-gate } 33627c478bd9Sstevel@tonic-gate 33637c478bd9Sstevel@tonic-gate rw_enter(&irb->irb_lock, RW_WRITER); 33647c478bd9Sstevel@tonic-gate 3365c793af95Ssangeeta if (irb->irb_rr_origin == ire) { 3366c793af95Ssangeeta irb->irb_rr_origin = NULL; 3367c793af95Ssangeeta } 3368c793af95Ssangeeta 33697c478bd9Sstevel@tonic-gate /* 33707c478bd9Sstevel@tonic-gate * In case of V4 we might still be waiting for fastpath ack. 33717c478bd9Sstevel@tonic-gate */ 3372516bda92Ssowmini if (ire->ire_ipversion == IPV4_VERSION && 3373516bda92Ssowmini (ire->ire_type == IRE_CACHE || 3374516bda92Ssowmini (ire->ire_type == IRE_BROADCAST && ire->ire_stq != NULL))) { 3375516bda92Ssowmini ASSERT(ire->ire_nce != NULL); 3376516bda92Ssowmini nce_fastpath_list_delete(ire->ire_nce); 33777c478bd9Sstevel@tonic-gate } 33787c478bd9Sstevel@tonic-gate 33797c478bd9Sstevel@tonic-gate if (ire->ire_ptpn == NULL) { 33807c478bd9Sstevel@tonic-gate /* 33817c478bd9Sstevel@tonic-gate * Some other thread has removed us from the list. 33827c478bd9Sstevel@tonic-gate * It should have done the REFRELE for us. 33837c478bd9Sstevel@tonic-gate */ 33847c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 33857c478bd9Sstevel@tonic-gate return; 33867c478bd9Sstevel@tonic-gate } 33877c478bd9Sstevel@tonic-gate 33889a09d68dSja97890 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 33899a09d68dSja97890 irb->irb_ire_cnt--; 33909a09d68dSja97890 ire->ire_marks |= IRE_MARK_CONDEMNED; 33919a09d68dSja97890 if (ire->ire_marks & IRE_MARK_TEMPORARY) { 33929a09d68dSja97890 irb->irb_tmp_ire_cnt--; 33939a09d68dSja97890 ire->ire_marks &= ~IRE_MARK_TEMPORARY; 33949a09d68dSja97890 } 33959a09d68dSja97890 } 33969a09d68dSja97890 33977c478bd9Sstevel@tonic-gate if (irb->irb_refcnt != 0) { 33987c478bd9Sstevel@tonic-gate /* 33997c478bd9Sstevel@tonic-gate * The last thread to leave this bucket will 34007c478bd9Sstevel@tonic-gate * delete this ire. 34017c478bd9Sstevel@tonic-gate */ 3402c793af95Ssangeeta irb->irb_marks |= IRB_MARK_CONDEMNED; 34037c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 34047c478bd9Sstevel@tonic-gate return; 34057c478bd9Sstevel@tonic-gate } 34067c478bd9Sstevel@tonic-gate 34077c478bd9Sstevel@tonic-gate /* 34087c478bd9Sstevel@tonic-gate * Normally to delete an ire, we walk the bucket. While we 34097c478bd9Sstevel@tonic-gate * walk the bucket, we normally bump up irb_refcnt and hence 34107c478bd9Sstevel@tonic-gate * we return from above where we mark CONDEMNED and the ire 34117c478bd9Sstevel@tonic-gate * gets deleted from ire_unlink. This case is where somebody 34127c478bd9Sstevel@tonic-gate * knows the ire e.g by doing a lookup, and wants to delete the 34137c478bd9Sstevel@tonic-gate * IRE. irb_refcnt would be 0 in this case if nobody is walking 34147c478bd9Sstevel@tonic-gate * the bucket. 34157c478bd9Sstevel@tonic-gate */ 34167c478bd9Sstevel@tonic-gate ptpn = ire->ire_ptpn; 34177c478bd9Sstevel@tonic-gate ire1 = ire->ire_next; 34187c478bd9Sstevel@tonic-gate if (ire1 != NULL) 34197c478bd9Sstevel@tonic-gate ire1->ire_ptpn = ptpn; 34207c478bd9Sstevel@tonic-gate ASSERT(ptpn != NULL); 34217c478bd9Sstevel@tonic-gate *ptpn = ire1; 34227c478bd9Sstevel@tonic-gate ire->ire_ptpn = NULL; 34237c478bd9Sstevel@tonic-gate ire->ire_next = NULL; 34247c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 3425f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_deleted); 34267c478bd9Sstevel@tonic-gate } else { 3427f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_deleted); 34287c478bd9Sstevel@tonic-gate } 34297c478bd9Sstevel@tonic-gate /* 34307c478bd9Sstevel@tonic-gate * ip_wput/ip_wput_v6 checks this flag to see whether 34317c478bd9Sstevel@tonic-gate * it should still use the cached ire or not. 34327c478bd9Sstevel@tonic-gate */ 34337c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_DEFAULT) { 34347c478bd9Sstevel@tonic-gate /* 34357c478bd9Sstevel@tonic-gate * IRE is out of the list. We need to adjust the 34367c478bd9Sstevel@tonic-gate * accounting before we drop the lock. 34377c478bd9Sstevel@tonic-gate */ 34387c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 3439f4b3ec61Sdh155122 ASSERT(ipst->ips_ipv6_ire_default_count != 0); 3440f4b3ec61Sdh155122 ipst->ips_ipv6_ire_default_count--; 34417c478bd9Sstevel@tonic-gate } 34427c478bd9Sstevel@tonic-gate } 34437c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 34447c478bd9Sstevel@tonic-gate 34457c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 34467c478bd9Sstevel@tonic-gate ire_delete_v6(ire); 34477c478bd9Sstevel@tonic-gate } else { 34487c478bd9Sstevel@tonic-gate ire_delete_v4(ire); 34497c478bd9Sstevel@tonic-gate } 34507c478bd9Sstevel@tonic-gate /* 34517c478bd9Sstevel@tonic-gate * We removed it from the list. Decrement the 34527c478bd9Sstevel@tonic-gate * reference count. 34537c478bd9Sstevel@tonic-gate */ 34547c478bd9Sstevel@tonic-gate IRE_REFRELE_NOTR(ire); 34557c478bd9Sstevel@tonic-gate } 34567c478bd9Sstevel@tonic-gate 34577c478bd9Sstevel@tonic-gate /* 34587c478bd9Sstevel@tonic-gate * Delete the specified IRE. 34597c478bd9Sstevel@tonic-gate * All calls should use ire_delete(). 34607c478bd9Sstevel@tonic-gate * Sometimes called as writer though not required by this function. 34617c478bd9Sstevel@tonic-gate * 34627c478bd9Sstevel@tonic-gate * NOTE : This function is called only if the ire was added 34637c478bd9Sstevel@tonic-gate * in the list. 34647c478bd9Sstevel@tonic-gate */ 34657c478bd9Sstevel@tonic-gate static void 34667c478bd9Sstevel@tonic-gate ire_delete_v4(ire_t *ire) 34677c478bd9Sstevel@tonic-gate { 3468f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 3469f4b3ec61Sdh155122 34707c478bd9Sstevel@tonic-gate ASSERT(ire->ire_refcnt >= 1); 34717c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV4_VERSION); 34727c478bd9Sstevel@tonic-gate 34737c478bd9Sstevel@tonic-gate if (ire->ire_type != IRE_CACHE) 34747c478bd9Sstevel@tonic-gate ire_flush_cache_v4(ire, IRE_FLUSH_DELETE); 34757c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_DEFAULT) { 34767c478bd9Sstevel@tonic-gate /* 34777c478bd9Sstevel@tonic-gate * when a default gateway is going away 34787c478bd9Sstevel@tonic-gate * delete all the host redirects pointing at that 34797c478bd9Sstevel@tonic-gate * gateway. 34807c478bd9Sstevel@tonic-gate */ 3481f4b3ec61Sdh155122 ire_delete_host_redirects(ire->ire_gateway_addr, ipst); 34827c478bd9Sstevel@tonic-gate } 34837c478bd9Sstevel@tonic-gate } 34847c478bd9Sstevel@tonic-gate 34857c478bd9Sstevel@tonic-gate /* 34867c478bd9Sstevel@tonic-gate * IRE_REFRELE/ire_refrele are the only caller of the function. It calls 34877c478bd9Sstevel@tonic-gate * to free the ire when the reference count goes to zero. 34887c478bd9Sstevel@tonic-gate */ 34897c478bd9Sstevel@tonic-gate void 34907c478bd9Sstevel@tonic-gate ire_inactive(ire_t *ire) 34917c478bd9Sstevel@tonic-gate { 34927c478bd9Sstevel@tonic-gate nce_t *nce; 34937c478bd9Sstevel@tonic-gate ill_t *ill = NULL; 34947c478bd9Sstevel@tonic-gate ill_t *stq_ill = NULL; 34957c478bd9Sstevel@tonic-gate ipif_t *ipif; 34967c478bd9Sstevel@tonic-gate boolean_t need_wakeup = B_FALSE; 3497c793af95Ssangeeta irb_t *irb; 3498f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 34997c478bd9Sstevel@tonic-gate 35007c478bd9Sstevel@tonic-gate ASSERT(ire->ire_refcnt == 0); 35017c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ptpn == NULL); 35027c478bd9Sstevel@tonic-gate ASSERT(ire->ire_next == NULL); 35037c478bd9Sstevel@tonic-gate 3504c793af95Ssangeeta if (ire->ire_gw_secattr != NULL) { 3505c793af95Ssangeeta ire_gw_secattr_free(ire->ire_gw_secattr); 3506c793af95Ssangeeta ire->ire_gw_secattr = NULL; 3507c793af95Ssangeeta } 3508c793af95Ssangeeta 3509c793af95Ssangeeta if (ire->ire_mp != NULL) { 3510c793af95Ssangeeta ASSERT(ire->ire_bucket == NULL); 3511c793af95Ssangeeta mutex_destroy(&ire->ire_lock); 3512f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_freed); 3513c793af95Ssangeeta if (ire->ire_nce != NULL) 3514c793af95Ssangeeta NCE_REFRELE_NOTR(ire->ire_nce); 3515c793af95Ssangeeta freeb(ire->ire_mp); 3516c793af95Ssangeeta return; 3517c793af95Ssangeeta } 3518c793af95Ssangeeta 35197c478bd9Sstevel@tonic-gate if ((nce = ire->ire_nce) != NULL) { 35207c478bd9Sstevel@tonic-gate NCE_REFRELE_NOTR(nce); 35217c478bd9Sstevel@tonic-gate ire->ire_nce = NULL; 35227c478bd9Sstevel@tonic-gate } 3523c793af95Ssangeeta 35247c478bd9Sstevel@tonic-gate if (ire->ire_ipif == NULL) 35257c478bd9Sstevel@tonic-gate goto end; 35267c478bd9Sstevel@tonic-gate 35277c478bd9Sstevel@tonic-gate ipif = ire->ire_ipif; 35287c478bd9Sstevel@tonic-gate ill = ipif->ipif_ill; 35297c478bd9Sstevel@tonic-gate 35307c478bd9Sstevel@tonic-gate if (ire->ire_bucket == NULL) { 35317c478bd9Sstevel@tonic-gate /* The ire was never inserted in the table. */ 35327c478bd9Sstevel@tonic-gate goto end; 35337c478bd9Sstevel@tonic-gate } 35347c478bd9Sstevel@tonic-gate 35357c478bd9Sstevel@tonic-gate /* 3536384ad179Ssowmini * ipif_ire_cnt on this ipif goes down by 1. If the ire_stq is 35375c0b7edeSseb * non-null ill_ire_count also goes down by 1. 35387c478bd9Sstevel@tonic-gate * 35397c478bd9Sstevel@tonic-gate * The ipif that is associated with an ire is ire->ire_ipif and 3540384ad179Ssowmini * hence when the ire->ire_ipif->ipif_ire_cnt drops to zero we call 35417c478bd9Sstevel@tonic-gate * ipif_ill_refrele_tail. Usually stq_ill is null or the same as 3542e11c3f44Smeem * ire->ire_ipif->ipif_ill. So nothing more needs to be done. 3543e11c3f44Smeem * However, for VNI or IPMP IRE entries, stq_ill can be different. 3544e11c3f44Smeem * If this is different from ire->ire_ipif->ipif_ill and if the 3545e11c3f44Smeem * ill_ire_cnt on the stq_ill also has dropped to zero, we call 35465c0b7edeSseb * ipif_ill_refrele_tail on the stq_ill. 35477c478bd9Sstevel@tonic-gate */ 35487c478bd9Sstevel@tonic-gate if (ire->ire_stq != NULL) 3549e11c3f44Smeem stq_ill = ire->ire_stq->q_ptr; 35507c478bd9Sstevel@tonic-gate 35515c0b7edeSseb if (stq_ill == NULL || stq_ill == ill) { 35527c478bd9Sstevel@tonic-gate /* Optimize the most common case */ 35537c478bd9Sstevel@tonic-gate mutex_enter(&ill->ill_lock); 3554384ad179Ssowmini ASSERT(ipif->ipif_ire_cnt != 0); 3555968d2fd1Ssowmini DTRACE_PROBE3(ipif__decr__cnt, (ipif_t *), ipif, 3556968d2fd1Ssowmini (char *), "ire", (void *), ire); 3557384ad179Ssowmini ipif->ipif_ire_cnt--; 3558968d2fd1Ssowmini if (IPIF_DOWN_OK(ipif)) 35597c478bd9Sstevel@tonic-gate need_wakeup = B_TRUE; 35607c478bd9Sstevel@tonic-gate if (stq_ill != NULL) { 3561384ad179Ssowmini ASSERT(stq_ill->ill_ire_cnt != 0); 3562968d2fd1Ssowmini DTRACE_PROBE3(ill__decr__cnt, (ill_t *), stq_ill, 3563968d2fd1Ssowmini (char *), "ire", (void *), ire); 3564384ad179Ssowmini stq_ill->ill_ire_cnt--; 3565968d2fd1Ssowmini if (ILL_DOWN_OK(stq_ill)) 35667c478bd9Sstevel@tonic-gate need_wakeup = B_TRUE; 35677c478bd9Sstevel@tonic-gate } 35687c478bd9Sstevel@tonic-gate if (need_wakeup) { 35697c478bd9Sstevel@tonic-gate /* Drops the ill lock */ 35707c478bd9Sstevel@tonic-gate ipif_ill_refrele_tail(ill); 35717c478bd9Sstevel@tonic-gate } else { 35727c478bd9Sstevel@tonic-gate mutex_exit(&ill->ill_lock); 35737c478bd9Sstevel@tonic-gate } 35747c478bd9Sstevel@tonic-gate } else { 35757c478bd9Sstevel@tonic-gate /* 35767c478bd9Sstevel@tonic-gate * We can't grab all the ill locks at the same time. 35777c478bd9Sstevel@tonic-gate * It can lead to recursive lock enter in the call to 35787c478bd9Sstevel@tonic-gate * ipif_ill_refrele_tail and later. Instead do it 1 at 35797c478bd9Sstevel@tonic-gate * a time. 35807c478bd9Sstevel@tonic-gate */ 35817c478bd9Sstevel@tonic-gate mutex_enter(&ill->ill_lock); 3582384ad179Ssowmini ASSERT(ipif->ipif_ire_cnt != 0); 3583968d2fd1Ssowmini DTRACE_PROBE3(ipif__decr__cnt, (ipif_t *), ipif, 3584968d2fd1Ssowmini (char *), "ire", (void *), ire); 3585384ad179Ssowmini ipif->ipif_ire_cnt--; 3586968d2fd1Ssowmini if (IPIF_DOWN_OK(ipif)) { 35877c478bd9Sstevel@tonic-gate /* Drops the lock */ 35887c478bd9Sstevel@tonic-gate ipif_ill_refrele_tail(ill); 35897c478bd9Sstevel@tonic-gate } else { 35907c478bd9Sstevel@tonic-gate mutex_exit(&ill->ill_lock); 35917c478bd9Sstevel@tonic-gate } 35927c478bd9Sstevel@tonic-gate if (stq_ill != NULL) { 35937c478bd9Sstevel@tonic-gate mutex_enter(&stq_ill->ill_lock); 3594384ad179Ssowmini ASSERT(stq_ill->ill_ire_cnt != 0); 3595968d2fd1Ssowmini DTRACE_PROBE3(ill__decr__cnt, (ill_t *), stq_ill, 3596968d2fd1Ssowmini (char *), "ire", (void *), ire); 3597384ad179Ssowmini stq_ill->ill_ire_cnt--; 3598968d2fd1Ssowmini if (ILL_DOWN_OK(stq_ill)) { 35997c478bd9Sstevel@tonic-gate /* Drops the ill lock */ 36007c478bd9Sstevel@tonic-gate ipif_ill_refrele_tail(stq_ill); 36017c478bd9Sstevel@tonic-gate } else { 36027c478bd9Sstevel@tonic-gate mutex_exit(&stq_ill->ill_lock); 36037c478bd9Sstevel@tonic-gate } 36047c478bd9Sstevel@tonic-gate } 36057c478bd9Sstevel@tonic-gate } 36067c478bd9Sstevel@tonic-gate end: 36077c478bd9Sstevel@tonic-gate /* This should be true for both V4 and V6 */ 36087c478bd9Sstevel@tonic-gate 3609c793af95Ssangeeta if ((ire->ire_type & IRE_FORWARDTABLE) && 3610c793af95Ssangeeta (ire->ire_ipversion == IPV4_VERSION) && 3611c793af95Ssangeeta ((irb = ire->ire_bucket) != NULL)) { 3612c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 3613c793af95Ssangeeta irb->irb_nire--; 3614c793af95Ssangeeta /* 3615c793af95Ssangeeta * Instead of examining the conditions for freeing 3616c793af95Ssangeeta * the radix node here, we do it by calling 3617c793af95Ssangeeta * IRB_REFRELE which is a single point in the code 3618c793af95Ssangeeta * that embeds that logic. Bump up the refcnt to 3619c793af95Ssangeeta * be able to call IRB_REFRELE 3620c793af95Ssangeeta */ 3621c793af95Ssangeeta IRB_REFHOLD_LOCKED(irb); 3622c793af95Ssangeeta rw_exit(&irb->irb_lock); 3623c793af95Ssangeeta IRB_REFRELE(irb); 3624c793af95Ssangeeta } 36257c478bd9Sstevel@tonic-gate ire->ire_ipif = NULL; 36267c478bd9Sstevel@tonic-gate 36276a8288c7Scarlsonj #ifdef DEBUG 36286a8288c7Scarlsonj ire_trace_cleanup(ire); 36297c478bd9Sstevel@tonic-gate #endif 36307c478bd9Sstevel@tonic-gate mutex_destroy(&ire->ire_lock); 36317c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 3632f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_freed); 36337c478bd9Sstevel@tonic-gate } else { 3634f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_freed); 36357c478bd9Sstevel@tonic-gate } 3636c793af95Ssangeeta ASSERT(ire->ire_mp == NULL); 36377c478bd9Sstevel@tonic-gate /* Has been allocated out of the cache */ 36387c478bd9Sstevel@tonic-gate kmem_cache_free(ire_cache, ire); 36397c478bd9Sstevel@tonic-gate } 36407c478bd9Sstevel@tonic-gate 36417c478bd9Sstevel@tonic-gate /* 36426bdb8e66Sdd193516 * ire_walk routine to delete all IRE_CACHE/IRE_HOST types redirect 36436bdb8e66Sdd193516 * entries that have a given gateway address. 36447c478bd9Sstevel@tonic-gate */ 36457c478bd9Sstevel@tonic-gate void 36467c478bd9Sstevel@tonic-gate ire_delete_cache_gw(ire_t *ire, char *cp) 36477c478bd9Sstevel@tonic-gate { 36487c478bd9Sstevel@tonic-gate ipaddr_t gw_addr; 36497c478bd9Sstevel@tonic-gate 36506bdb8e66Sdd193516 if (!(ire->ire_type & IRE_CACHE) && 36516bdb8e66Sdd193516 !(ire->ire_flags & RTF_DYNAMIC)) 36527c478bd9Sstevel@tonic-gate return; 36537c478bd9Sstevel@tonic-gate 36547c478bd9Sstevel@tonic-gate bcopy(cp, &gw_addr, sizeof (gw_addr)); 36557c478bd9Sstevel@tonic-gate if (ire->ire_gateway_addr == gw_addr) { 36567c478bd9Sstevel@tonic-gate ip1dbg(("ire_delete_cache_gw: deleted 0x%x type %d to 0x%x\n", 36577c478bd9Sstevel@tonic-gate (int)ntohl(ire->ire_addr), ire->ire_type, 36587c478bd9Sstevel@tonic-gate (int)ntohl(ire->ire_gateway_addr))); 36597c478bd9Sstevel@tonic-gate ire_delete(ire); 36607c478bd9Sstevel@tonic-gate } 36617c478bd9Sstevel@tonic-gate } 36627c478bd9Sstevel@tonic-gate 36637c478bd9Sstevel@tonic-gate /* 36647c478bd9Sstevel@tonic-gate * Remove all IRE_CACHE entries that match the ire specified. 36657c478bd9Sstevel@tonic-gate * 36667c478bd9Sstevel@tonic-gate * The flag argument indicates if the flush request is due to addition 36677c478bd9Sstevel@tonic-gate * of new route (IRE_FLUSH_ADD) or deletion of old route (IRE_FLUSH_DELETE). 36687c478bd9Sstevel@tonic-gate * 36697c478bd9Sstevel@tonic-gate * This routine takes only the IREs from the forwarding table and flushes 36707c478bd9Sstevel@tonic-gate * the corresponding entries from the cache table. 36717c478bd9Sstevel@tonic-gate * 36727c478bd9Sstevel@tonic-gate * When flushing due to the deletion of an old route, it 36737c478bd9Sstevel@tonic-gate * just checks the cache handles (ire_phandle and ire_ihandle) and 36747c478bd9Sstevel@tonic-gate * deletes the ones that match. 36757c478bd9Sstevel@tonic-gate * 36767c478bd9Sstevel@tonic-gate * When flushing due to the creation of a new route, it checks 36777c478bd9Sstevel@tonic-gate * if a cache entry's address matches the one in the IRE and 36787c478bd9Sstevel@tonic-gate * that the cache entry's parent has a less specific mask than the 36797c478bd9Sstevel@tonic-gate * one in IRE. The destination of such a cache entry could be the 36807c478bd9Sstevel@tonic-gate * gateway for other cache entries, so we need to flush those as 36817c478bd9Sstevel@tonic-gate * well by looking for gateway addresses matching the IRE's address. 36827c478bd9Sstevel@tonic-gate */ 36837c478bd9Sstevel@tonic-gate void 36847c478bd9Sstevel@tonic-gate ire_flush_cache_v4(ire_t *ire, int flag) 36857c478bd9Sstevel@tonic-gate { 36867c478bd9Sstevel@tonic-gate int i; 36877c478bd9Sstevel@tonic-gate ire_t *cire; 36887c478bd9Sstevel@tonic-gate irb_t *irb; 3689f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 36907c478bd9Sstevel@tonic-gate 36917c478bd9Sstevel@tonic-gate if (ire->ire_type & IRE_CACHE) 36927c478bd9Sstevel@tonic-gate return; 36937c478bd9Sstevel@tonic-gate 36947c478bd9Sstevel@tonic-gate /* 36957c478bd9Sstevel@tonic-gate * If a default is just created, there is no point 36967c478bd9Sstevel@tonic-gate * in going through the cache, as there will not be any 36977c478bd9Sstevel@tonic-gate * cached ires. 36987c478bd9Sstevel@tonic-gate */ 36997c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD) 37007c478bd9Sstevel@tonic-gate return; 37017c478bd9Sstevel@tonic-gate if (flag == IRE_FLUSH_ADD) { 37027c478bd9Sstevel@tonic-gate /* 37037c478bd9Sstevel@tonic-gate * This selective flush is due to the addition of 37047c478bd9Sstevel@tonic-gate * new IRE. 37057c478bd9Sstevel@tonic-gate */ 3706f4b3ec61Sdh155122 for (i = 0; i < ipst->ips_ip_cache_table_size; i++) { 3707f4b3ec61Sdh155122 irb = &ipst->ips_ip_cache_table[i]; 37087c478bd9Sstevel@tonic-gate if ((cire = irb->irb_ire) == NULL) 37097c478bd9Sstevel@tonic-gate continue; 37107c478bd9Sstevel@tonic-gate IRB_REFHOLD(irb); 37117c478bd9Sstevel@tonic-gate for (cire = irb->irb_ire; cire != NULL; 37127c478bd9Sstevel@tonic-gate cire = cire->ire_next) { 37137c478bd9Sstevel@tonic-gate if (cire->ire_type != IRE_CACHE) 37147c478bd9Sstevel@tonic-gate continue; 37157c478bd9Sstevel@tonic-gate /* 37167c478bd9Sstevel@tonic-gate * If 'cire' belongs to the same subnet 37177c478bd9Sstevel@tonic-gate * as the new ire being added, and 'cire' 37187c478bd9Sstevel@tonic-gate * is derived from a prefix that is less 37197c478bd9Sstevel@tonic-gate * specific than the new ire being added, 37207c478bd9Sstevel@tonic-gate * we need to flush 'cire'; for instance, 37217c478bd9Sstevel@tonic-gate * when a new interface comes up. 37227c478bd9Sstevel@tonic-gate */ 37237c478bd9Sstevel@tonic-gate if (((cire->ire_addr & ire->ire_mask) == 37247c478bd9Sstevel@tonic-gate (ire->ire_addr & ire->ire_mask)) && 37257c478bd9Sstevel@tonic-gate (ip_mask_to_plen(cire->ire_cmask) <= 37267c478bd9Sstevel@tonic-gate ire->ire_masklen)) { 37277c478bd9Sstevel@tonic-gate ire_delete(cire); 37287c478bd9Sstevel@tonic-gate continue; 37297c478bd9Sstevel@tonic-gate } 37307c478bd9Sstevel@tonic-gate /* 37317c478bd9Sstevel@tonic-gate * This is the case when the ire_gateway_addr 37327c478bd9Sstevel@tonic-gate * of 'cire' belongs to the same subnet as 37337c478bd9Sstevel@tonic-gate * the new ire being added. 37347c478bd9Sstevel@tonic-gate * Flushing such ires is sometimes required to 37357c478bd9Sstevel@tonic-gate * avoid misrouting: say we have a machine with 37367c478bd9Sstevel@tonic-gate * two interfaces (I1 and I2), a default router 37377c478bd9Sstevel@tonic-gate * R on the I1 subnet, and a host route to an 37387c478bd9Sstevel@tonic-gate * off-link destination D with a gateway G on 37397c478bd9Sstevel@tonic-gate * the I2 subnet. 37407c478bd9Sstevel@tonic-gate * Under normal operation, we will have an 37417c478bd9Sstevel@tonic-gate * on-link cache entry for G and an off-link 37427c478bd9Sstevel@tonic-gate * cache entry for D with G as ire_gateway_addr, 37437c478bd9Sstevel@tonic-gate * traffic to D will reach its destination 37447c478bd9Sstevel@tonic-gate * through gateway G. 37457c478bd9Sstevel@tonic-gate * If the administrator does 'ifconfig I2 down', 37467c478bd9Sstevel@tonic-gate * the cache entries for D and G will be 37477c478bd9Sstevel@tonic-gate * flushed. However, G will now be resolved as 37487c478bd9Sstevel@tonic-gate * an off-link destination using R (the default 37497c478bd9Sstevel@tonic-gate * router) as gateway. Then D will also be 37507c478bd9Sstevel@tonic-gate * resolved as an off-link destination using G 37517c478bd9Sstevel@tonic-gate * as gateway - this behavior is due to 37527c478bd9Sstevel@tonic-gate * compatibility reasons, see comment in 37537c478bd9Sstevel@tonic-gate * ire_ihandle_lookup_offlink(). Traffic to D 37547c478bd9Sstevel@tonic-gate * will go to the router R and probably won't 37557c478bd9Sstevel@tonic-gate * reach the destination. 37567c478bd9Sstevel@tonic-gate * The administrator then does 'ifconfig I2 up'. 37577c478bd9Sstevel@tonic-gate * Since G is on the I2 subnet, this routine 37587c478bd9Sstevel@tonic-gate * will flush its cache entry. It must also 37597c478bd9Sstevel@tonic-gate * flush the cache entry for D, otherwise 37607c478bd9Sstevel@tonic-gate * traffic will stay misrouted until the IRE 37617c478bd9Sstevel@tonic-gate * times out. 37627c478bd9Sstevel@tonic-gate */ 37637c478bd9Sstevel@tonic-gate if ((cire->ire_gateway_addr & ire->ire_mask) == 37647c478bd9Sstevel@tonic-gate (ire->ire_addr & ire->ire_mask)) { 37657c478bd9Sstevel@tonic-gate ire_delete(cire); 37667c478bd9Sstevel@tonic-gate continue; 37677c478bd9Sstevel@tonic-gate } 37687c478bd9Sstevel@tonic-gate } 37697c478bd9Sstevel@tonic-gate IRB_REFRELE(irb); 37707c478bd9Sstevel@tonic-gate } 37717c478bd9Sstevel@tonic-gate } else { 37727c478bd9Sstevel@tonic-gate /* 37737c478bd9Sstevel@tonic-gate * delete the cache entries based on 37747c478bd9Sstevel@tonic-gate * handle in the IRE as this IRE is 37757c478bd9Sstevel@tonic-gate * being deleted/changed. 37767c478bd9Sstevel@tonic-gate */ 3777f4b3ec61Sdh155122 for (i = 0; i < ipst->ips_ip_cache_table_size; i++) { 3778f4b3ec61Sdh155122 irb = &ipst->ips_ip_cache_table[i]; 37797c478bd9Sstevel@tonic-gate if ((cire = irb->irb_ire) == NULL) 37807c478bd9Sstevel@tonic-gate continue; 37817c478bd9Sstevel@tonic-gate IRB_REFHOLD(irb); 37827c478bd9Sstevel@tonic-gate for (cire = irb->irb_ire; cire != NULL; 37837c478bd9Sstevel@tonic-gate cire = cire->ire_next) { 37847c478bd9Sstevel@tonic-gate if (cire->ire_type != IRE_CACHE) 37857c478bd9Sstevel@tonic-gate continue; 37867c478bd9Sstevel@tonic-gate if ((cire->ire_phandle == 0 || 37877c478bd9Sstevel@tonic-gate cire->ire_phandle != ire->ire_phandle) && 37887c478bd9Sstevel@tonic-gate (cire->ire_ihandle == 0 || 37897c478bd9Sstevel@tonic-gate cire->ire_ihandle != ire->ire_ihandle)) 37907c478bd9Sstevel@tonic-gate continue; 37917c478bd9Sstevel@tonic-gate ire_delete(cire); 37927c478bd9Sstevel@tonic-gate } 37937c478bd9Sstevel@tonic-gate IRB_REFRELE(irb); 37947c478bd9Sstevel@tonic-gate } 37957c478bd9Sstevel@tonic-gate } 37967c478bd9Sstevel@tonic-gate } 37977c478bd9Sstevel@tonic-gate 37987c478bd9Sstevel@tonic-gate /* 37997c478bd9Sstevel@tonic-gate * Matches the arguments passed with the values in the ire. 38007c478bd9Sstevel@tonic-gate * 38017c478bd9Sstevel@tonic-gate * Note: for match types that match using "ipif" passed in, ipif 38027c478bd9Sstevel@tonic-gate * must be checked for non-NULL before calling this routine. 38037c478bd9Sstevel@tonic-gate */ 3804c793af95Ssangeeta boolean_t 38057c478bd9Sstevel@tonic-gate ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 380645916cd2Sjpk int type, const ipif_t *ipif, zoneid_t zoneid, uint32_t ihandle, 38075b17e9bdSJon Anderson const ts_label_t *tsl, int match_flags, queue_t *wq) 38087c478bd9Sstevel@tonic-gate { 38097c478bd9Sstevel@tonic-gate ill_t *ire_ill = NULL, *dst_ill; 38107c478bd9Sstevel@tonic-gate ill_t *ipif_ill = NULL; 38117c478bd9Sstevel@tonic-gate 38127c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV4_VERSION); 38137c478bd9Sstevel@tonic-gate ASSERT((ire->ire_addr & ~ire->ire_mask) == 0); 3814e11c3f44Smeem ASSERT((!(match_flags & MATCH_IRE_ILL)) || 38157c478bd9Sstevel@tonic-gate (ipif != NULL && !ipif->ipif_isv6)); 38165b17e9bdSJon Anderson ASSERT(!(match_flags & MATCH_IRE_WQ) || wq != NULL); 38177c478bd9Sstevel@tonic-gate 38187c478bd9Sstevel@tonic-gate /* 3819e11c3f44Smeem * If MATCH_IRE_MARK_TESTHIDDEN is set, then only return the IRE if it 3820e11c3f44Smeem * is in fact hidden, to ensure the caller gets the right one. One 3821e11c3f44Smeem * exception: if the caller passed MATCH_IRE_IHANDLE, then they 3822e11c3f44Smeem * already know the identity of the given IRE_INTERFACE entry and 3823e11c3f44Smeem * there's no point trying to hide it from them. 38247c478bd9Sstevel@tonic-gate */ 3825e11c3f44Smeem if (ire->ire_marks & IRE_MARK_TESTHIDDEN) { 3826e11c3f44Smeem if (match_flags & MATCH_IRE_IHANDLE) 3827e11c3f44Smeem match_flags |= MATCH_IRE_MARK_TESTHIDDEN; 3828e11c3f44Smeem 3829e11c3f44Smeem if (!(match_flags & MATCH_IRE_MARK_TESTHIDDEN)) 38307c478bd9Sstevel@tonic-gate return (B_FALSE); 3831e11c3f44Smeem } 38327c478bd9Sstevel@tonic-gate 383343d18f1cSpriyanka /* 383443d18f1cSpriyanka * MATCH_IRE_MARK_PRIVATE_ADDR is set when IP_NEXTHOP option 383543d18f1cSpriyanka * is used. In that case the routing table is bypassed and the 383643d18f1cSpriyanka * packets are sent directly to the specified nexthop. The 383743d18f1cSpriyanka * IRE_CACHE entry representing this route should be marked 383843d18f1cSpriyanka * with IRE_MARK_PRIVATE_ADDR. 383943d18f1cSpriyanka */ 384043d18f1cSpriyanka 384143d18f1cSpriyanka if (!(match_flags & MATCH_IRE_MARK_PRIVATE_ADDR) && 384243d18f1cSpriyanka (ire->ire_marks & IRE_MARK_PRIVATE_ADDR)) 384343d18f1cSpriyanka return (B_FALSE); 384443d18f1cSpriyanka 384545916cd2Sjpk if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid && 384645916cd2Sjpk ire->ire_zoneid != ALL_ZONES) { 38477c478bd9Sstevel@tonic-gate /* 38487c478bd9Sstevel@tonic-gate * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid is 38497c478bd9Sstevel@tonic-gate * valid and does not match that of ire_zoneid, a failure to 38507c478bd9Sstevel@tonic-gate * match is reported at this point. Otherwise, since some IREs 38517c478bd9Sstevel@tonic-gate * that are available in the global zone can be used in local 38527c478bd9Sstevel@tonic-gate * zones, additional checks need to be performed: 38537c478bd9Sstevel@tonic-gate * 38547c478bd9Sstevel@tonic-gate * IRE_BROADCAST, IRE_CACHE and IRE_LOOPBACK 38557c478bd9Sstevel@tonic-gate * entries should never be matched in this situation. 38567c478bd9Sstevel@tonic-gate * 38577c478bd9Sstevel@tonic-gate * IRE entries that have an interface associated with them 38587c478bd9Sstevel@tonic-gate * should in general not match unless they are an IRE_LOCAL 38597c478bd9Sstevel@tonic-gate * or in the case when MATCH_IRE_DEFAULT has been set in 38607c478bd9Sstevel@tonic-gate * the caller. In the case of the former, checking of the 38617c478bd9Sstevel@tonic-gate * other fields supplied should take place. 38627c478bd9Sstevel@tonic-gate * 38637c478bd9Sstevel@tonic-gate * In the case where MATCH_IRE_DEFAULT has been set, 38647c478bd9Sstevel@tonic-gate * all of the ipif's associated with the IRE's ill are 38657c478bd9Sstevel@tonic-gate * checked to see if there is a matching zoneid. If any 38667c478bd9Sstevel@tonic-gate * one ipif has a matching zoneid, this IRE is a 38677c478bd9Sstevel@tonic-gate * potential candidate so checking of the other fields 38687c478bd9Sstevel@tonic-gate * takes place. 38697c478bd9Sstevel@tonic-gate * 38707c478bd9Sstevel@tonic-gate * In the case where the IRE_INTERFACE has a usable source 38717c478bd9Sstevel@tonic-gate * address (indicated by ill_usesrc_ifindex) in the 38727c478bd9Sstevel@tonic-gate * correct zone then it's permitted to return this IRE 38737c478bd9Sstevel@tonic-gate */ 38747c478bd9Sstevel@tonic-gate if (match_flags & MATCH_IRE_ZONEONLY) 38757c478bd9Sstevel@tonic-gate return (B_FALSE); 38767c478bd9Sstevel@tonic-gate if (ire->ire_type & (IRE_BROADCAST | IRE_CACHE | IRE_LOOPBACK)) 38777c478bd9Sstevel@tonic-gate return (B_FALSE); 38787c478bd9Sstevel@tonic-gate /* 38797c478bd9Sstevel@tonic-gate * Note, IRE_INTERFACE can have the stq as NULL. For 38807c478bd9Sstevel@tonic-gate * example, if the default multicast route is tied to 38817c478bd9Sstevel@tonic-gate * the loopback address. 38827c478bd9Sstevel@tonic-gate */ 38837c478bd9Sstevel@tonic-gate if ((ire->ire_type & IRE_INTERFACE) && 38847c478bd9Sstevel@tonic-gate (ire->ire_stq != NULL)) { 38857c478bd9Sstevel@tonic-gate dst_ill = (ill_t *)ire->ire_stq->q_ptr; 38867c478bd9Sstevel@tonic-gate /* 38877c478bd9Sstevel@tonic-gate * If there is a usable source address in the 38887c478bd9Sstevel@tonic-gate * zone, then it's ok to return an 38897c478bd9Sstevel@tonic-gate * IRE_INTERFACE 38907c478bd9Sstevel@tonic-gate */ 38917c478bd9Sstevel@tonic-gate if (ipif_usesrc_avail(dst_ill, zoneid)) { 38927c478bd9Sstevel@tonic-gate ip3dbg(("ire_match_args: dst_ill %p match %d\n", 38937c478bd9Sstevel@tonic-gate (void *)dst_ill, 38947c478bd9Sstevel@tonic-gate (ire->ire_addr == (addr & mask)))); 38957c478bd9Sstevel@tonic-gate } else { 38967c478bd9Sstevel@tonic-gate ip3dbg(("ire_match_args: src_ipif NULL" 38977c478bd9Sstevel@tonic-gate " dst_ill %p\n", (void *)dst_ill)); 38987c478bd9Sstevel@tonic-gate return (B_FALSE); 38997c478bd9Sstevel@tonic-gate } 39007c478bd9Sstevel@tonic-gate } 39017c478bd9Sstevel@tonic-gate if (ire->ire_ipif != NULL && ire->ire_type != IRE_LOCAL && 39027c478bd9Sstevel@tonic-gate !(ire->ire_type & IRE_INTERFACE)) { 39037c478bd9Sstevel@tonic-gate ipif_t *tipif; 39047c478bd9Sstevel@tonic-gate 39057c478bd9Sstevel@tonic-gate if ((match_flags & MATCH_IRE_DEFAULT) == 0) { 39067c478bd9Sstevel@tonic-gate return (B_FALSE); 39077c478bd9Sstevel@tonic-gate } 39087c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_ipif->ipif_ill->ill_lock); 39097c478bd9Sstevel@tonic-gate for (tipif = ire->ire_ipif->ipif_ill->ill_ipif; 39107c478bd9Sstevel@tonic-gate tipif != NULL; tipif = tipif->ipif_next) { 39117c478bd9Sstevel@tonic-gate if (IPIF_CAN_LOOKUP(tipif) && 39127c478bd9Sstevel@tonic-gate (tipif->ipif_flags & IPIF_UP) && 391345916cd2Sjpk (tipif->ipif_zoneid == zoneid || 391445916cd2Sjpk tipif->ipif_zoneid == ALL_ZONES)) 39157c478bd9Sstevel@tonic-gate break; 39167c478bd9Sstevel@tonic-gate } 39177c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_ipif->ipif_ill->ill_lock); 39187c478bd9Sstevel@tonic-gate if (tipif == NULL) { 39197c478bd9Sstevel@tonic-gate return (B_FALSE); 39207c478bd9Sstevel@tonic-gate } 39217c478bd9Sstevel@tonic-gate } 39227c478bd9Sstevel@tonic-gate } 39237c478bd9Sstevel@tonic-gate 39247c478bd9Sstevel@tonic-gate /* 3925e11c3f44Smeem * For IRE_CACHE entries, MATCH_IRE_ILL means that somebody wants to 3926e11c3f44Smeem * send out ire_stq (ire_ipif for IRE_CACHE entries is just the means 3927e11c3f44Smeem * of getting a source address -- i.e., ire_src_addr == 3928e11c3f44Smeem * ire->ire_ipif->ipif_src_addr). ire_to_ill() handles this. 3929e11c3f44Smeem * 3930e11c3f44Smeem * NOTE: For IPMP, MATCH_IRE_ILL usually matches any ill in the group. 3931e11c3f44Smeem * However, if MATCH_IRE_MARK_TESTHIDDEN is set (i.e., the IRE is for 3932e11c3f44Smeem * IPMP test traffic), then the ill must match exactly. 39337c478bd9Sstevel@tonic-gate */ 3934e11c3f44Smeem if (match_flags & MATCH_IRE_ILL) { 39357c478bd9Sstevel@tonic-gate ire_ill = ire_to_ill(ire); 39367c478bd9Sstevel@tonic-gate ipif_ill = ipif->ipif_ill; 39377c478bd9Sstevel@tonic-gate } 39387c478bd9Sstevel@tonic-gate 39397c478bd9Sstevel@tonic-gate if ((ire->ire_addr == (addr & mask)) && 39407c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_GW)) || 39417c478bd9Sstevel@tonic-gate (ire->ire_gateway_addr == gateway)) && 39427c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_TYPE)) || 39437c478bd9Sstevel@tonic-gate (ire->ire_type & type)) && 39447c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_SRC)) || 39457c478bd9Sstevel@tonic-gate (ire->ire_src_addr == ipif->ipif_src_addr)) && 39467c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_IPIF)) || 39477c478bd9Sstevel@tonic-gate (ire->ire_ipif == ipif)) && 3948e11c3f44Smeem ((!(match_flags & MATCH_IRE_MARK_TESTHIDDEN)) || 3949e11c3f44Smeem (ire->ire_marks & IRE_MARK_TESTHIDDEN)) && 395043d18f1cSpriyanka ((!(match_flags & MATCH_IRE_MARK_PRIVATE_ADDR)) || 395143d18f1cSpriyanka (ire->ire_type != IRE_CACHE || 395243d18f1cSpriyanka ire->ire_marks & IRE_MARK_PRIVATE_ADDR)) && 39535b17e9bdSJon Anderson ((!(match_flags & MATCH_IRE_WQ)) || 39545b17e9bdSJon Anderson (ire->ire_stq == wq)) && 3955e11c3f44Smeem ((!(match_flags & MATCH_IRE_ILL)) || 3956e11c3f44Smeem (ire_ill == ipif_ill || 3957e11c3f44Smeem (!(match_flags & MATCH_IRE_MARK_TESTHIDDEN) && 3958e11c3f44Smeem ire_ill != NULL && IS_IN_SAME_ILLGRP(ipif_ill, ire_ill)))) && 39597c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_IHANDLE)) || 39607c478bd9Sstevel@tonic-gate (ire->ire_ihandle == ihandle)) && 3961c793af95Ssangeeta ((!(match_flags & MATCH_IRE_MASK)) || 3962c793af95Ssangeeta (ire->ire_mask == mask)) && 396345916cd2Sjpk ((!(match_flags & MATCH_IRE_SECATTR)) || 396445916cd2Sjpk (!is_system_labeled()) || 396545916cd2Sjpk (tsol_ire_match_gwattr(ire, tsl) == 0))) { 39667c478bd9Sstevel@tonic-gate /* We found the matched IRE */ 39677c478bd9Sstevel@tonic-gate return (B_TRUE); 39687c478bd9Sstevel@tonic-gate } 39697c478bd9Sstevel@tonic-gate return (B_FALSE); 39707c478bd9Sstevel@tonic-gate } 39717c478bd9Sstevel@tonic-gate 39727c478bd9Sstevel@tonic-gate /* 39737c478bd9Sstevel@tonic-gate * Lookup for a route in all the tables 39747c478bd9Sstevel@tonic-gate */ 39757c478bd9Sstevel@tonic-gate ire_t * 39767c478bd9Sstevel@tonic-gate ire_route_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 397745916cd2Sjpk int type, const ipif_t *ipif, ire_t **pire, zoneid_t zoneid, 3978f4b3ec61Sdh155122 const ts_label_t *tsl, int flags, ip_stack_t *ipst) 39797c478bd9Sstevel@tonic-gate { 39807c478bd9Sstevel@tonic-gate ire_t *ire = NULL; 39817c478bd9Sstevel@tonic-gate 39827c478bd9Sstevel@tonic-gate /* 39837c478bd9Sstevel@tonic-gate * ire_match_args() will dereference ipif MATCH_IRE_SRC or 39847c478bd9Sstevel@tonic-gate * MATCH_IRE_ILL is set. 39857c478bd9Sstevel@tonic-gate */ 3986e11c3f44Smeem if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL)) && (ipif == NULL)) 39877c478bd9Sstevel@tonic-gate return (NULL); 39887c478bd9Sstevel@tonic-gate 39897c478bd9Sstevel@tonic-gate /* 39907c478bd9Sstevel@tonic-gate * might be asking for a cache lookup, 39917c478bd9Sstevel@tonic-gate * This is not best way to lookup cache, 39927c478bd9Sstevel@tonic-gate * user should call ire_cache_lookup directly. 39937c478bd9Sstevel@tonic-gate * 39947c478bd9Sstevel@tonic-gate * If MATCH_IRE_TYPE was set, first lookup in the cache table and then 39957c478bd9Sstevel@tonic-gate * in the forwarding table, if the applicable type flags were set. 39967c478bd9Sstevel@tonic-gate */ 39977c478bd9Sstevel@tonic-gate if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_CACHETABLE) != 0) { 39987c478bd9Sstevel@tonic-gate ire = ire_ctable_lookup(addr, gateway, type, ipif, zoneid, 3999f4b3ec61Sdh155122 tsl, flags, ipst); 40007c478bd9Sstevel@tonic-gate if (ire != NULL) 40017c478bd9Sstevel@tonic-gate return (ire); 40027c478bd9Sstevel@tonic-gate } 40037c478bd9Sstevel@tonic-gate if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_FORWARDTABLE) != 0) { 40047c478bd9Sstevel@tonic-gate ire = ire_ftable_lookup(addr, mask, gateway, type, ipif, pire, 4005f4b3ec61Sdh155122 zoneid, 0, tsl, flags, ipst); 40067c478bd9Sstevel@tonic-gate } 40077c478bd9Sstevel@tonic-gate return (ire); 40087c478bd9Sstevel@tonic-gate } 40097c478bd9Sstevel@tonic-gate 40107c478bd9Sstevel@tonic-gate /* 401145916cd2Sjpk * Delete the IRE cache for the gateway and all IRE caches whose 401245916cd2Sjpk * ire_gateway_addr points to this gateway, and allow them to 401345916cd2Sjpk * be created on demand by ip_newroute. 401445916cd2Sjpk */ 401545916cd2Sjpk void 4016f4b3ec61Sdh155122 ire_clookup_delete_cache_gw(ipaddr_t addr, zoneid_t zoneid, ip_stack_t *ipst) 401745916cd2Sjpk { 401845916cd2Sjpk irb_t *irb; 401945916cd2Sjpk ire_t *ire; 402045916cd2Sjpk 4021f4b3ec61Sdh155122 irb = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(addr, 4022f4b3ec61Sdh155122 ipst->ips_ip_cache_table_size)]; 402345916cd2Sjpk IRB_REFHOLD(irb); 402445916cd2Sjpk for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 402545916cd2Sjpk if (ire->ire_marks & IRE_MARK_CONDEMNED) 402645916cd2Sjpk continue; 402745916cd2Sjpk 402845916cd2Sjpk ASSERT(ire->ire_mask == IP_HOST_MASK); 402945916cd2Sjpk if (ire_match_args(ire, addr, ire->ire_mask, 0, IRE_CACHE, 40305b17e9bdSJon Anderson NULL, zoneid, 0, NULL, MATCH_IRE_TYPE, NULL)) { 403145916cd2Sjpk ire_delete(ire); 403245916cd2Sjpk } 403345916cd2Sjpk } 403445916cd2Sjpk IRB_REFRELE(irb); 403545916cd2Sjpk 4036f4b3ec61Sdh155122 ire_walk_v4(ire_delete_cache_gw, &addr, zoneid, ipst); 403745916cd2Sjpk } 403845916cd2Sjpk 403945916cd2Sjpk /* 40407c478bd9Sstevel@tonic-gate * Looks up cache table for a route. 40417c478bd9Sstevel@tonic-gate * specific lookup can be indicated by 40427c478bd9Sstevel@tonic-gate * passing the MATCH_* flags and the 40437c478bd9Sstevel@tonic-gate * necessary parameters. 40447c478bd9Sstevel@tonic-gate */ 40457c478bd9Sstevel@tonic-gate ire_t * 404645916cd2Sjpk ire_ctable_lookup(ipaddr_t addr, ipaddr_t gateway, int type, const ipif_t *ipif, 4047f4b3ec61Sdh155122 zoneid_t zoneid, const ts_label_t *tsl, int flags, ip_stack_t *ipst) 40487c478bd9Sstevel@tonic-gate { 40495b17e9bdSJon Anderson ire_ctable_args_t margs; 40507c478bd9Sstevel@tonic-gate 40515b17e9bdSJon Anderson margs.ict_addr = &addr; 40525b17e9bdSJon Anderson margs.ict_gateway = &gateway; 40535b17e9bdSJon Anderson margs.ict_type = type; 40545b17e9bdSJon Anderson margs.ict_ipif = ipif; 40555b17e9bdSJon Anderson margs.ict_zoneid = zoneid; 40565b17e9bdSJon Anderson margs.ict_tsl = tsl; 40575b17e9bdSJon Anderson margs.ict_flags = flags; 40585b17e9bdSJon Anderson margs.ict_ipst = ipst; 40595b17e9bdSJon Anderson margs.ict_wq = NULL; 40607c478bd9Sstevel@tonic-gate 40615b17e9bdSJon Anderson return (ip4_ctable_lookup_impl(&margs)); 40627c478bd9Sstevel@tonic-gate } 40637c478bd9Sstevel@tonic-gate 40647c478bd9Sstevel@tonic-gate /* 40655597b60aSnordmark * Check whether the IRE_LOCAL and the IRE potentially used to transmit 4066e11c3f44Smeem * (could be an IRE_CACHE, IRE_BROADCAST, or IRE_INTERFACE) are identical 4067e11c3f44Smeem * or part of the same illgrp. (In the IPMP case, usually the two IREs 4068e11c3f44Smeem * will both belong to the IPMP ill, but exceptions are possible -- e.g. 4069e11c3f44Smeem * if IPMP test addresses are on their own subnet.) 40705597b60aSnordmark */ 40715597b60aSnordmark boolean_t 4072e11c3f44Smeem ire_local_same_lan(ire_t *ire_local, ire_t *xmit_ire) 40735597b60aSnordmark { 40745597b60aSnordmark ill_t *recv_ill, *xmit_ill; 40755597b60aSnordmark 40762bc4236aSnordmark ASSERT(ire_local->ire_type & (IRE_LOCAL|IRE_LOOPBACK)); 4077aa2eaee6Snordmark ASSERT(xmit_ire->ire_type & (IRE_CACHETABLE|IRE_INTERFACE)); 40785597b60aSnordmark 40792bc4236aSnordmark recv_ill = ire_to_ill(ire_local); 40802bc4236aSnordmark xmit_ill = ire_to_ill(xmit_ire); 40812bc4236aSnordmark 40822bc4236aSnordmark ASSERT(recv_ill != NULL); 40832bc4236aSnordmark ASSERT(xmit_ill != NULL); 40845597b60aSnordmark 4085e11c3f44Smeem return (IS_ON_SAME_LAN(recv_ill, xmit_ill)); 40865597b60aSnordmark } 40875597b60aSnordmark 40885597b60aSnordmark /* 4089e11c3f44Smeem * Check if the IRE_LOCAL uses the same ill as another route would use. 4090aa2eaee6Snordmark * If there is no alternate route, or the alternate is a REJECT or BLACKHOLE, 4091aa2eaee6Snordmark * then we don't allow this IRE_LOCAL to be used. 40925597b60aSnordmark */ 40935597b60aSnordmark boolean_t 40945597b60aSnordmark ire_local_ok_across_zones(ire_t *ire_local, zoneid_t zoneid, void *addr, 4095f4b3ec61Sdh155122 const ts_label_t *tsl, ip_stack_t *ipst) 40965597b60aSnordmark { 40975597b60aSnordmark ire_t *alt_ire; 40985597b60aSnordmark boolean_t rval; 4099e11c3f44Smeem int flags; 4100e11c3f44Smeem 4101e11c3f44Smeem flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE; 41025597b60aSnordmark 41035597b60aSnordmark if (ire_local->ire_ipversion == IPV4_VERSION) { 41045597b60aSnordmark alt_ire = ire_ftable_lookup(*((ipaddr_t *)addr), 0, 0, 0, NULL, 4105e11c3f44Smeem NULL, zoneid, 0, tsl, flags, ipst); 41065597b60aSnordmark } else { 4107e11c3f44Smeem alt_ire = ire_ftable_lookup_v6(addr, NULL, NULL, 0, NULL, 4108e11c3f44Smeem NULL, zoneid, 0, tsl, flags, ipst); 41095597b60aSnordmark } 41105597b60aSnordmark 41115597b60aSnordmark if (alt_ire == NULL) 41125597b60aSnordmark return (B_FALSE); 41135597b60aSnordmark 4114aa2eaee6Snordmark if (alt_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 4115aa2eaee6Snordmark ire_refrele(alt_ire); 4116aa2eaee6Snordmark return (B_FALSE); 4117aa2eaee6Snordmark } 4118e11c3f44Smeem rval = ire_local_same_lan(ire_local, alt_ire); 41195597b60aSnordmark 41205597b60aSnordmark ire_refrele(alt_ire); 41215597b60aSnordmark return (rval); 41225597b60aSnordmark } 41235597b60aSnordmark 41245597b60aSnordmark /* 4125e11c3f44Smeem * Lookup cache 41265597b60aSnordmark * 41275597b60aSnordmark * In general the zoneid has to match (where ALL_ZONES match all of them). 41285597b60aSnordmark * But for IRE_LOCAL we also need to handle the case where L2 should 41295597b60aSnordmark * conceptually loop back the packet. This is necessary since neither 41305597b60aSnordmark * Ethernet drivers nor Ethernet hardware loops back packets sent to their 41315597b60aSnordmark * own MAC address. This loopback is needed when the normal 41325597b60aSnordmark * routes (ignoring IREs with different zoneids) would send out the packet on 4133e11c3f44Smeem * the same ill as the ill with which this IRE_LOCAL is associated. 41345597b60aSnordmark * 41355597b60aSnordmark * Earlier versions of this code always matched an IRE_LOCAL independently of 41365597b60aSnordmark * the zoneid. We preserve that earlier behavior when 41375597b60aSnordmark * ip_restrict_interzone_loopback is turned off. 41387c478bd9Sstevel@tonic-gate */ 41397c478bd9Sstevel@tonic-gate ire_t * 4140f4b3ec61Sdh155122 ire_cache_lookup(ipaddr_t addr, zoneid_t zoneid, const ts_label_t *tsl, 4141f4b3ec61Sdh155122 ip_stack_t *ipst) 41427c478bd9Sstevel@tonic-gate { 41437c478bd9Sstevel@tonic-gate irb_t *irb_ptr; 41447c478bd9Sstevel@tonic-gate ire_t *ire; 41457c478bd9Sstevel@tonic-gate 4146f4b3ec61Sdh155122 irb_ptr = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(addr, 4147f4b3ec61Sdh155122 ipst->ips_ip_cache_table_size)]; 41487c478bd9Sstevel@tonic-gate rw_enter(&irb_ptr->irb_lock, RW_READER); 41497c478bd9Sstevel@tonic-gate for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 415043d18f1cSpriyanka if (ire->ire_marks & (IRE_MARK_CONDEMNED | 4151e11c3f44Smeem IRE_MARK_TESTHIDDEN | IRE_MARK_PRIVATE_ADDR)) { 41527c478bd9Sstevel@tonic-gate continue; 415343d18f1cSpriyanka } 41547c478bd9Sstevel@tonic-gate if (ire->ire_addr == addr) { 415545916cd2Sjpk /* 415645916cd2Sjpk * Finally, check if the security policy has any 415745916cd2Sjpk * restriction on using this route for the specified 415845916cd2Sjpk * message. 415945916cd2Sjpk */ 416045916cd2Sjpk if (tsl != NULL && 416145916cd2Sjpk ire->ire_gw_secattr != NULL && 416245916cd2Sjpk tsol_ire_match_gwattr(ire, tsl) != 0) { 416345916cd2Sjpk continue; 416445916cd2Sjpk } 416545916cd2Sjpk 41667c478bd9Sstevel@tonic-gate if (zoneid == ALL_ZONES || ire->ire_zoneid == zoneid || 41675597b60aSnordmark ire->ire_zoneid == ALL_ZONES) { 41685597b60aSnordmark IRE_REFHOLD(ire); 41695597b60aSnordmark rw_exit(&irb_ptr->irb_lock); 41705597b60aSnordmark return (ire); 41715597b60aSnordmark } 41725597b60aSnordmark 41735597b60aSnordmark if (ire->ire_type == IRE_LOCAL) { 4174f4b3ec61Sdh155122 if (ipst->ips_ip_restrict_interzone_loopback && 41755597b60aSnordmark !ire_local_ok_across_zones(ire, zoneid, 4176f4b3ec61Sdh155122 &addr, tsl, ipst)) 41775597b60aSnordmark continue; 41785597b60aSnordmark 41797c478bd9Sstevel@tonic-gate IRE_REFHOLD(ire); 41807c478bd9Sstevel@tonic-gate rw_exit(&irb_ptr->irb_lock); 41817c478bd9Sstevel@tonic-gate return (ire); 41827c478bd9Sstevel@tonic-gate } 41837c478bd9Sstevel@tonic-gate } 41847c478bd9Sstevel@tonic-gate } 41857c478bd9Sstevel@tonic-gate rw_exit(&irb_ptr->irb_lock); 41867c478bd9Sstevel@tonic-gate return (NULL); 41877c478bd9Sstevel@tonic-gate } 41887c478bd9Sstevel@tonic-gate 4189da14cebeSEric Cheng ire_t * 4190da14cebeSEric Cheng ire_cache_lookup_simple(ipaddr_t dst, ip_stack_t *ipst) 4191da14cebeSEric Cheng { 4192da14cebeSEric Cheng irb_t *irb_ptr; 4193da14cebeSEric Cheng ire_t *ire; 4194da14cebeSEric Cheng 4195da14cebeSEric Cheng /* 4196e11c3f44Smeem * Look for an ire in the cachetable whose 4197da14cebeSEric Cheng * ire_addr matches the destination. 4198da14cebeSEric Cheng * Since we are being called by forwarding fastpath 4199da14cebeSEric Cheng * no need to check for Trusted Solaris label. 4200da14cebeSEric Cheng */ 4201da14cebeSEric Cheng irb_ptr = &ipst->ips_ip_cache_table[IRE_ADDR_HASH( 4202da14cebeSEric Cheng dst, ipst->ips_ip_cache_table_size)]; 4203da14cebeSEric Cheng rw_enter(&irb_ptr->irb_lock, RW_READER); 4204da14cebeSEric Cheng for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 4205e11c3f44Smeem if (ire->ire_marks & (IRE_MARK_CONDEMNED | IRE_MARK_TESTHIDDEN | 4206e11c3f44Smeem IRE_MARK_PRIVATE_ADDR)) { 4207da14cebeSEric Cheng continue; 4208da14cebeSEric Cheng } 4209da14cebeSEric Cheng if (ire->ire_addr == dst) { 4210da14cebeSEric Cheng IRE_REFHOLD(ire); 4211da14cebeSEric Cheng rw_exit(&irb_ptr->irb_lock); 4212da14cebeSEric Cheng return (ire); 4213da14cebeSEric Cheng } 4214da14cebeSEric Cheng } 4215da14cebeSEric Cheng rw_exit(&irb_ptr->irb_lock); 4216da14cebeSEric Cheng return (NULL); 4217da14cebeSEric Cheng } 4218da14cebeSEric Cheng 42197c478bd9Sstevel@tonic-gate /* 42207c478bd9Sstevel@tonic-gate * Locate the interface ire that is tied to the cache ire 'cire' via 42217c478bd9Sstevel@tonic-gate * cire->ire_ihandle. 42227c478bd9Sstevel@tonic-gate * 42237c478bd9Sstevel@tonic-gate * We are trying to create the cache ire for an offlink destn based 42247c478bd9Sstevel@tonic-gate * on the cache ire of the gateway in 'cire'. 'pire' is the prefix ire 42257c478bd9Sstevel@tonic-gate * as found by ip_newroute(). We are called from ip_newroute() in 42267c478bd9Sstevel@tonic-gate * the IRE_CACHE case. 42277c478bd9Sstevel@tonic-gate */ 42287c478bd9Sstevel@tonic-gate ire_t * 42297c478bd9Sstevel@tonic-gate ire_ihandle_lookup_offlink(ire_t *cire, ire_t *pire) 42307c478bd9Sstevel@tonic-gate { 42317c478bd9Sstevel@tonic-gate ire_t *ire; 42327c478bd9Sstevel@tonic-gate int match_flags; 42337c478bd9Sstevel@tonic-gate ipaddr_t gw_addr; 42347c478bd9Sstevel@tonic-gate ipif_t *gw_ipif; 4235f4b3ec61Sdh155122 ip_stack_t *ipst = cire->ire_ipst; 42367c478bd9Sstevel@tonic-gate 42377c478bd9Sstevel@tonic-gate ASSERT(cire != NULL && pire != NULL); 42387c478bd9Sstevel@tonic-gate 42397c478bd9Sstevel@tonic-gate /* 42407c478bd9Sstevel@tonic-gate * We don't need to specify the zoneid to ire_ftable_lookup() below 42417c478bd9Sstevel@tonic-gate * because the ihandle refers to an ipif which can be in only one zone. 42427c478bd9Sstevel@tonic-gate */ 42437c478bd9Sstevel@tonic-gate match_flags = MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK; 42447c478bd9Sstevel@tonic-gate if (pire->ire_ipif != NULL) 4245e11c3f44Smeem match_flags |= MATCH_IRE_ILL; 42467c478bd9Sstevel@tonic-gate /* 42477c478bd9Sstevel@tonic-gate * We know that the mask of the interface ire equals cire->ire_cmask. 42487c478bd9Sstevel@tonic-gate * (When ip_newroute() created 'cire' for the gateway it set its 42497c478bd9Sstevel@tonic-gate * cmask from the interface ire's mask) 42507c478bd9Sstevel@tonic-gate */ 42517c478bd9Sstevel@tonic-gate ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0, 42527c478bd9Sstevel@tonic-gate IRE_INTERFACE, pire->ire_ipif, NULL, ALL_ZONES, cire->ire_ihandle, 4253f4b3ec61Sdh155122 NULL, match_flags, ipst); 42547c478bd9Sstevel@tonic-gate if (ire != NULL) 42557c478bd9Sstevel@tonic-gate return (ire); 42567c478bd9Sstevel@tonic-gate /* 42577c478bd9Sstevel@tonic-gate * If we didn't find an interface ire above, we can't declare failure. 42587c478bd9Sstevel@tonic-gate * For backwards compatibility, we need to support prefix routes 42597c478bd9Sstevel@tonic-gate * pointing to next hop gateways that are not on-link. 42607c478bd9Sstevel@tonic-gate * 42617c478bd9Sstevel@tonic-gate * Assume we are trying to ping some offlink destn, and we have the 42627c478bd9Sstevel@tonic-gate * routing table below. 42637c478bd9Sstevel@tonic-gate * 42647c478bd9Sstevel@tonic-gate * Eg. default - gw1 <--- pire (line 1) 42657c478bd9Sstevel@tonic-gate * gw1 - gw2 (line 2) 42667c478bd9Sstevel@tonic-gate * gw2 - hme0 (line 3) 42677c478bd9Sstevel@tonic-gate * 42687c478bd9Sstevel@tonic-gate * If we already have a cache ire for gw1 in 'cire', the 42697c478bd9Sstevel@tonic-gate * ire_ftable_lookup above would have failed, since there is no 42707c478bd9Sstevel@tonic-gate * interface ire to reach gw1. We will fallthru below. 42717c478bd9Sstevel@tonic-gate * 42727c478bd9Sstevel@tonic-gate * Here we duplicate the steps that ire_ftable_lookup() did in 42737c478bd9Sstevel@tonic-gate * getting 'cire' from 'pire', in the MATCH_IRE_RECURSIVE case. 42747c478bd9Sstevel@tonic-gate * The differences are the following 42757c478bd9Sstevel@tonic-gate * i. We want the interface ire only, so we call ire_ftable_lookup() 42767c478bd9Sstevel@tonic-gate * instead of ire_route_lookup() 42777c478bd9Sstevel@tonic-gate * ii. We look for only prefix routes in the 1st call below. 42787c478bd9Sstevel@tonic-gate * ii. We want to match on the ihandle in the 2nd call below. 42797c478bd9Sstevel@tonic-gate */ 42807c478bd9Sstevel@tonic-gate match_flags = MATCH_IRE_TYPE; 42817c478bd9Sstevel@tonic-gate if (pire->ire_ipif != NULL) 4282e11c3f44Smeem match_flags |= MATCH_IRE_ILL; 42837c478bd9Sstevel@tonic-gate ire = ire_ftable_lookup(pire->ire_gateway_addr, 0, 0, IRE_OFFSUBNET, 4284f4b3ec61Sdh155122 pire->ire_ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 42857c478bd9Sstevel@tonic-gate if (ire == NULL) 42867c478bd9Sstevel@tonic-gate return (NULL); 42877c478bd9Sstevel@tonic-gate /* 42887c478bd9Sstevel@tonic-gate * At this point 'ire' corresponds to the entry shown in line 2. 42897c478bd9Sstevel@tonic-gate * gw_addr is 'gw2' in the example above. 42907c478bd9Sstevel@tonic-gate */ 42917c478bd9Sstevel@tonic-gate gw_addr = ire->ire_gateway_addr; 42927c478bd9Sstevel@tonic-gate gw_ipif = ire->ire_ipif; 42937c478bd9Sstevel@tonic-gate ire_refrele(ire); 42947c478bd9Sstevel@tonic-gate 42957c478bd9Sstevel@tonic-gate match_flags |= MATCH_IRE_IHANDLE; 42967c478bd9Sstevel@tonic-gate ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, 4297f4b3ec61Sdh155122 gw_ipif, NULL, ALL_ZONES, cire->ire_ihandle, NULL, match_flags, 4298f4b3ec61Sdh155122 ipst); 42997c478bd9Sstevel@tonic-gate return (ire); 43007c478bd9Sstevel@tonic-gate } 43017c478bd9Sstevel@tonic-gate 43027c478bd9Sstevel@tonic-gate /* 43037c478bd9Sstevel@tonic-gate * Return the IRE_LOOPBACK, IRE_IF_RESOLVER or IRE_IF_NORESOLVER 43047c478bd9Sstevel@tonic-gate * ire associated with the specified ipif. 43057c478bd9Sstevel@tonic-gate * 43067c478bd9Sstevel@tonic-gate * This might occasionally be called when IPIF_UP is not set since 43077c478bd9Sstevel@tonic-gate * the IP_MULTICAST_IF as well as creating interface routes 43087c478bd9Sstevel@tonic-gate * allows specifying a down ipif (ipif_lookup* match ipifs that are down). 43097c478bd9Sstevel@tonic-gate * 43107c478bd9Sstevel@tonic-gate * Note that if IPIF_NOLOCAL, IPIF_NOXMIT, or IPIF_DEPRECATED is set on 43117c478bd9Sstevel@tonic-gate * the ipif, this routine might return NULL. 43127c478bd9Sstevel@tonic-gate */ 43137c478bd9Sstevel@tonic-gate ire_t * 431445916cd2Sjpk ipif_to_ire(const ipif_t *ipif) 43157c478bd9Sstevel@tonic-gate { 43167c478bd9Sstevel@tonic-gate ire_t *ire; 4317f4b3ec61Sdh155122 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 4318e11c3f44Smeem uint_t match_flags = MATCH_IRE_TYPE | MATCH_IRE_IPIF | MATCH_IRE_MASK; 4319e11c3f44Smeem 4320e11c3f44Smeem /* 4321e11c3f44Smeem * IRE_INTERFACE entries for ills under IPMP are IRE_MARK_TESTHIDDEN 4322e11c3f44Smeem * so that they aren't accidentally returned. However, if the 4323e11c3f44Smeem * caller's ipif is on an ill under IPMP, there's no need to hide 'em. 4324e11c3f44Smeem */ 4325e11c3f44Smeem if (IS_UNDER_IPMP(ipif->ipif_ill)) 4326e11c3f44Smeem match_flags |= MATCH_IRE_MARK_TESTHIDDEN; 43277c478bd9Sstevel@tonic-gate 43287c478bd9Sstevel@tonic-gate ASSERT(!ipif->ipif_isv6); 43297c478bd9Sstevel@tonic-gate if (ipif->ipif_ire_type == IRE_LOOPBACK) { 43307c478bd9Sstevel@tonic-gate ire = ire_ctable_lookup(ipif->ipif_lcl_addr, 0, IRE_LOOPBACK, 4331f4b3ec61Sdh155122 ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF), 4332f4b3ec61Sdh155122 ipst); 43337c478bd9Sstevel@tonic-gate } else if (ipif->ipif_flags & IPIF_POINTOPOINT) { 43347c478bd9Sstevel@tonic-gate /* In this case we need to lookup destination address. */ 43357c478bd9Sstevel@tonic-gate ire = ire_ftable_lookup(ipif->ipif_pp_dst_addr, IP_HOST_MASK, 0, 4336e11c3f44Smeem IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL, match_flags, 4337e11c3f44Smeem ipst); 43387c478bd9Sstevel@tonic-gate } else { 43397c478bd9Sstevel@tonic-gate ire = ire_ftable_lookup(ipif->ipif_subnet, 43407c478bd9Sstevel@tonic-gate ipif->ipif_net_mask, 0, IRE_INTERFACE, ipif, NULL, 4341e11c3f44Smeem ALL_ZONES, 0, NULL, match_flags, ipst); 43427c478bd9Sstevel@tonic-gate } 43437c478bd9Sstevel@tonic-gate return (ire); 43447c478bd9Sstevel@tonic-gate } 43457c478bd9Sstevel@tonic-gate 43467c478bd9Sstevel@tonic-gate /* 43477c478bd9Sstevel@tonic-gate * ire_walk function. 43487c478bd9Sstevel@tonic-gate * Count the number of IRE_CACHE entries in different categories. 43497c478bd9Sstevel@tonic-gate */ 43507c478bd9Sstevel@tonic-gate void 43517c478bd9Sstevel@tonic-gate ire_cache_count(ire_t *ire, char *arg) 43527c478bd9Sstevel@tonic-gate { 43537c478bd9Sstevel@tonic-gate ire_cache_count_t *icc = (ire_cache_count_t *)arg; 43547c478bd9Sstevel@tonic-gate 43557c478bd9Sstevel@tonic-gate if (ire->ire_type != IRE_CACHE) 43567c478bd9Sstevel@tonic-gate return; 43577c478bd9Sstevel@tonic-gate 43587c478bd9Sstevel@tonic-gate icc->icc_total++; 43597c478bd9Sstevel@tonic-gate 43607c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 43617c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 43627c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) { 43637c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 43647c478bd9Sstevel@tonic-gate icc->icc_onlink++; 43657c478bd9Sstevel@tonic-gate return; 43667c478bd9Sstevel@tonic-gate } 43677c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 43687c478bd9Sstevel@tonic-gate } else { 43697c478bd9Sstevel@tonic-gate if (ire->ire_gateway_addr == 0) { 43707c478bd9Sstevel@tonic-gate icc->icc_onlink++; 43717c478bd9Sstevel@tonic-gate return; 43727c478bd9Sstevel@tonic-gate } 43737c478bd9Sstevel@tonic-gate } 43747c478bd9Sstevel@tonic-gate 43757c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipif != NULL); 43767c478bd9Sstevel@tonic-gate if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu) 43777c478bd9Sstevel@tonic-gate icc->icc_pmtu++; 43787c478bd9Sstevel@tonic-gate else if (ire->ire_tire_mark != ire->ire_ob_pkt_count + 43797c478bd9Sstevel@tonic-gate ire->ire_ib_pkt_count) 43807c478bd9Sstevel@tonic-gate icc->icc_offlink++; 43817c478bd9Sstevel@tonic-gate else 43827c478bd9Sstevel@tonic-gate icc->icc_unused++; 43837c478bd9Sstevel@tonic-gate } 43847c478bd9Sstevel@tonic-gate 43857c478bd9Sstevel@tonic-gate /* 43867c478bd9Sstevel@tonic-gate * ire_walk function called by ip_trash_ire_reclaim(). 43877c478bd9Sstevel@tonic-gate * Free a fraction of the IRE_CACHE cache entries. The fractions are 43887c478bd9Sstevel@tonic-gate * different for different categories of IRE_CACHE entries. 43897c478bd9Sstevel@tonic-gate * A fraction of zero means to not free any in that category. 43907c478bd9Sstevel@tonic-gate * Use the hash bucket id plus lbolt as a random number. Thus if the fraction 43917c478bd9Sstevel@tonic-gate * is N then every Nth hash bucket chain will be freed. 43927c478bd9Sstevel@tonic-gate */ 43937c478bd9Sstevel@tonic-gate void 43947c478bd9Sstevel@tonic-gate ire_cache_reclaim(ire_t *ire, char *arg) 43957c478bd9Sstevel@tonic-gate { 43967c478bd9Sstevel@tonic-gate ire_cache_reclaim_t *icr = (ire_cache_reclaim_t *)arg; 43977c478bd9Sstevel@tonic-gate uint_t rand; 4398f4b3ec61Sdh155122 ip_stack_t *ipst = icr->icr_ipst; 43997c478bd9Sstevel@tonic-gate 44007c478bd9Sstevel@tonic-gate if (ire->ire_type != IRE_CACHE) 44017c478bd9Sstevel@tonic-gate return; 44027c478bd9Sstevel@tonic-gate 44037c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 44047c478bd9Sstevel@tonic-gate rand = (uint_t)lbolt + 4405f4b3ec61Sdh155122 IRE_ADDR_HASH_V6(ire->ire_addr_v6, 4406f4b3ec61Sdh155122 ipst->ips_ip6_cache_table_size); 44077c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 44087c478bd9Sstevel@tonic-gate if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) { 44097c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 44107c478bd9Sstevel@tonic-gate if (icr->icr_onlink != 0 && 44117c478bd9Sstevel@tonic-gate (rand/icr->icr_onlink)*icr->icr_onlink == rand) { 44127c478bd9Sstevel@tonic-gate ire_delete(ire); 44137c478bd9Sstevel@tonic-gate return; 44147c478bd9Sstevel@tonic-gate } 44157c478bd9Sstevel@tonic-gate goto done; 44167c478bd9Sstevel@tonic-gate } 44177c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 44187c478bd9Sstevel@tonic-gate } else { 44197c478bd9Sstevel@tonic-gate rand = (uint_t)lbolt + 4420f4b3ec61Sdh155122 IRE_ADDR_HASH(ire->ire_addr, ipst->ips_ip_cache_table_size); 44217c478bd9Sstevel@tonic-gate if (ire->ire_gateway_addr == 0) { 44227c478bd9Sstevel@tonic-gate if (icr->icr_onlink != 0 && 44237c478bd9Sstevel@tonic-gate (rand/icr->icr_onlink)*icr->icr_onlink == rand) { 44247c478bd9Sstevel@tonic-gate ire_delete(ire); 44257c478bd9Sstevel@tonic-gate return; 44267c478bd9Sstevel@tonic-gate } 44277c478bd9Sstevel@tonic-gate goto done; 44287c478bd9Sstevel@tonic-gate } 44297c478bd9Sstevel@tonic-gate } 44307c478bd9Sstevel@tonic-gate /* Not onlink IRE */ 44317c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipif != NULL); 44327c478bd9Sstevel@tonic-gate if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu) { 44337c478bd9Sstevel@tonic-gate /* Use ptmu fraction */ 44347c478bd9Sstevel@tonic-gate if (icr->icr_pmtu != 0 && 44357c478bd9Sstevel@tonic-gate (rand/icr->icr_pmtu)*icr->icr_pmtu == rand) { 44367c478bd9Sstevel@tonic-gate ire_delete(ire); 44377c478bd9Sstevel@tonic-gate return; 44387c478bd9Sstevel@tonic-gate } 44397c478bd9Sstevel@tonic-gate } else if (ire->ire_tire_mark != ire->ire_ob_pkt_count + 44407c478bd9Sstevel@tonic-gate ire->ire_ib_pkt_count) { 44417c478bd9Sstevel@tonic-gate /* Use offlink fraction */ 44427c478bd9Sstevel@tonic-gate if (icr->icr_offlink != 0 && 44437c478bd9Sstevel@tonic-gate (rand/icr->icr_offlink)*icr->icr_offlink == rand) { 44447c478bd9Sstevel@tonic-gate ire_delete(ire); 44457c478bd9Sstevel@tonic-gate return; 44467c478bd9Sstevel@tonic-gate } 44477c478bd9Sstevel@tonic-gate } else { 44487c478bd9Sstevel@tonic-gate /* Use unused fraction */ 44497c478bd9Sstevel@tonic-gate if (icr->icr_unused != 0 && 44507c478bd9Sstevel@tonic-gate (rand/icr->icr_unused)*icr->icr_unused == rand) { 44517c478bd9Sstevel@tonic-gate ire_delete(ire); 44527c478bd9Sstevel@tonic-gate return; 44537c478bd9Sstevel@tonic-gate } 44547c478bd9Sstevel@tonic-gate } 44557c478bd9Sstevel@tonic-gate done: 44567c478bd9Sstevel@tonic-gate /* 44577c478bd9Sstevel@tonic-gate * Update tire_mark so that those that haven't been used since this 44587c478bd9Sstevel@tonic-gate * reclaim will be considered unused next time we reclaim. 44597c478bd9Sstevel@tonic-gate */ 44607c478bd9Sstevel@tonic-gate ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count; 44617c478bd9Sstevel@tonic-gate } 44627c478bd9Sstevel@tonic-gate 44637c478bd9Sstevel@tonic-gate static void 44647c478bd9Sstevel@tonic-gate power2_roundup(uint32_t *value) 44657c478bd9Sstevel@tonic-gate { 44667c478bd9Sstevel@tonic-gate int i; 44677c478bd9Sstevel@tonic-gate 44687c478bd9Sstevel@tonic-gate for (i = 1; i < 31; i++) { 44697c478bd9Sstevel@tonic-gate if (*value <= (1 << i)) 44707c478bd9Sstevel@tonic-gate break; 44717c478bd9Sstevel@tonic-gate } 44727c478bd9Sstevel@tonic-gate *value = (1 << i); 44737c478bd9Sstevel@tonic-gate } 44747c478bd9Sstevel@tonic-gate 4475f4b3ec61Sdh155122 /* Global init for all zones */ 44767c478bd9Sstevel@tonic-gate void 4477f4b3ec61Sdh155122 ip_ire_g_init() 44787c478bd9Sstevel@tonic-gate { 44797c478bd9Sstevel@tonic-gate /* 44807c478bd9Sstevel@tonic-gate * Create ire caches, ire_reclaim() 44817c478bd9Sstevel@tonic-gate * will give IRE_CACHE back to system when needed. 44827c478bd9Sstevel@tonic-gate * This needs to be done here before anything else, since 44837c478bd9Sstevel@tonic-gate * ire_add() expects the cache to be created. 44847c478bd9Sstevel@tonic-gate */ 44857c478bd9Sstevel@tonic-gate ire_cache = kmem_cache_create("ire_cache", 44867c478bd9Sstevel@tonic-gate sizeof (ire_t), 0, ip_ire_constructor, 44877c478bd9Sstevel@tonic-gate ip_ire_destructor, ip_trash_ire_reclaim, NULL, NULL, 0); 44887c478bd9Sstevel@tonic-gate 4489f4b3ec61Sdh155122 rt_entry_cache = kmem_cache_create("rt_entry", 4490f4b3ec61Sdh155122 sizeof (struct rt_entry), 0, NULL, NULL, NULL, NULL, NULL, 0); 4491f4b3ec61Sdh155122 4492f4b3ec61Sdh155122 /* 4493f4b3ec61Sdh155122 * Have radix code setup kmem caches etc. 4494f4b3ec61Sdh155122 */ 4495f4b3ec61Sdh155122 rn_init(); 4496f4b3ec61Sdh155122 } 4497f4b3ec61Sdh155122 4498f4b3ec61Sdh155122 void 4499f4b3ec61Sdh155122 ip_ire_init(ip_stack_t *ipst) 4500f4b3ec61Sdh155122 { 4501f4b3ec61Sdh155122 int i; 4502f4b3ec61Sdh155122 uint32_t mem_cnt; 4503f4b3ec61Sdh155122 uint32_t cpu_cnt; 4504f4b3ec61Sdh155122 uint32_t min_cnt; 4505f4b3ec61Sdh155122 pgcnt_t mem_avail; 4506f4b3ec61Sdh155122 4507f4b3ec61Sdh155122 /* 4508f4b3ec61Sdh155122 * ip_ire_max_bucket_cnt is sized below based on the memory 4509f4b3ec61Sdh155122 * size and the cpu speed of the machine. This is upper 4510f4b3ec61Sdh155122 * bounded by the compile time value of ip_ire_max_bucket_cnt 4511f4b3ec61Sdh155122 * and is lower bounded by the compile time value of 4512f4b3ec61Sdh155122 * ip_ire_min_bucket_cnt. Similar logic applies to 4513f4b3ec61Sdh155122 * ip6_ire_max_bucket_cnt. 4514f4b3ec61Sdh155122 * 4515f4b3ec61Sdh155122 * We calculate this for each IP Instances in order to use 4516f4b3ec61Sdh155122 * the kmem_avail and ip_ire_{min,max}_bucket_cnt that are 4517f4b3ec61Sdh155122 * in effect when the zone is booted. 4518f4b3ec61Sdh155122 */ 4519f4b3ec61Sdh155122 mem_avail = kmem_avail(); 4520f4b3ec61Sdh155122 mem_cnt = (mem_avail >> ip_ire_mem_ratio) / 4521f4b3ec61Sdh155122 ip_cache_table_size / sizeof (ire_t); 4522f4b3ec61Sdh155122 cpu_cnt = CPU->cpu_type_info.pi_clock >> ip_ire_cpu_ratio; 4523f4b3ec61Sdh155122 4524f4b3ec61Sdh155122 min_cnt = MIN(cpu_cnt, mem_cnt); 4525f4b3ec61Sdh155122 if (min_cnt < ip_ire_min_bucket_cnt) 4526f4b3ec61Sdh155122 min_cnt = ip_ire_min_bucket_cnt; 4527f4b3ec61Sdh155122 if (ip_ire_max_bucket_cnt > min_cnt) { 4528f4b3ec61Sdh155122 ip_ire_max_bucket_cnt = min_cnt; 4529f4b3ec61Sdh155122 } 4530f4b3ec61Sdh155122 4531f4b3ec61Sdh155122 mem_cnt = (mem_avail >> ip_ire_mem_ratio) / 4532f4b3ec61Sdh155122 ip6_cache_table_size / sizeof (ire_t); 4533f4b3ec61Sdh155122 min_cnt = MIN(cpu_cnt, mem_cnt); 4534f4b3ec61Sdh155122 if (min_cnt < ip6_ire_min_bucket_cnt) 4535f4b3ec61Sdh155122 min_cnt = ip6_ire_min_bucket_cnt; 4536f4b3ec61Sdh155122 if (ip6_ire_max_bucket_cnt > min_cnt) { 4537f4b3ec61Sdh155122 ip6_ire_max_bucket_cnt = min_cnt; 4538f4b3ec61Sdh155122 } 4539f4b3ec61Sdh155122 4540f4b3ec61Sdh155122 mutex_init(&ipst->ips_ire_ft_init_lock, NULL, MUTEX_DEFAULT, 0); 4541f4b3ec61Sdh155122 mutex_init(&ipst->ips_ire_handle_lock, NULL, MUTEX_DEFAULT, NULL); 4542f4b3ec61Sdh155122 4543f4b3ec61Sdh155122 (void) rn_inithead((void **)&ipst->ips_ip_ftable, 32); 4544f4b3ec61Sdh155122 4545f4b3ec61Sdh155122 /* Calculate the IPv4 cache table size. */ 4546f4b3ec61Sdh155122 ipst->ips_ip_cache_table_size = MAX(ip_cache_table_size, 4547f4b3ec61Sdh155122 ((mem_avail >> ip_ire_mem_ratio) / sizeof (ire_t) / 4548f4b3ec61Sdh155122 ip_ire_max_bucket_cnt)); 4549f4b3ec61Sdh155122 if (ipst->ips_ip_cache_table_size > ip_max_cache_table_size) 4550f4b3ec61Sdh155122 ipst->ips_ip_cache_table_size = ip_max_cache_table_size; 4551f4b3ec61Sdh155122 /* 4552f4b3ec61Sdh155122 * Make sure that the table size is always a power of 2. The 4553f4b3ec61Sdh155122 * hash macro IRE_ADDR_HASH() depends on that. 4554f4b3ec61Sdh155122 */ 4555f4b3ec61Sdh155122 power2_roundup(&ipst->ips_ip_cache_table_size); 4556f4b3ec61Sdh155122 4557f4b3ec61Sdh155122 ipst->ips_ip_cache_table = kmem_zalloc(ipst->ips_ip_cache_table_size * 4558f4b3ec61Sdh155122 sizeof (irb_t), KM_SLEEP); 4559f4b3ec61Sdh155122 4560f4b3ec61Sdh155122 for (i = 0; i < ipst->ips_ip_cache_table_size; i++) { 4561f4b3ec61Sdh155122 rw_init(&ipst->ips_ip_cache_table[i].irb_lock, NULL, 4562f4b3ec61Sdh155122 RW_DEFAULT, NULL); 4563f4b3ec61Sdh155122 } 4564f4b3ec61Sdh155122 4565f4b3ec61Sdh155122 /* Calculate the IPv6 cache table size. */ 4566f4b3ec61Sdh155122 ipst->ips_ip6_cache_table_size = MAX(ip6_cache_table_size, 4567f4b3ec61Sdh155122 ((mem_avail >> ip_ire_mem_ratio) / sizeof (ire_t) / 4568f4b3ec61Sdh155122 ip6_ire_max_bucket_cnt)); 4569f4b3ec61Sdh155122 if (ipst->ips_ip6_cache_table_size > ip6_max_cache_table_size) 4570f4b3ec61Sdh155122 ipst->ips_ip6_cache_table_size = ip6_max_cache_table_size; 4571f4b3ec61Sdh155122 /* 4572f4b3ec61Sdh155122 * Make sure that the table size is always a power of 2. The 4573f4b3ec61Sdh155122 * hash macro IRE_ADDR_HASH_V6() depends on that. 4574f4b3ec61Sdh155122 */ 4575f4b3ec61Sdh155122 power2_roundup(&ipst->ips_ip6_cache_table_size); 4576f4b3ec61Sdh155122 4577f4b3ec61Sdh155122 ipst->ips_ip_cache_table_v6 = kmem_zalloc( 4578f4b3ec61Sdh155122 ipst->ips_ip6_cache_table_size * sizeof (irb_t), KM_SLEEP); 4579f4b3ec61Sdh155122 4580f4b3ec61Sdh155122 for (i = 0; i < ipst->ips_ip6_cache_table_size; i++) { 4581f4b3ec61Sdh155122 rw_init(&ipst->ips_ip_cache_table_v6[i].irb_lock, NULL, 4582f4b3ec61Sdh155122 RW_DEFAULT, NULL); 4583f4b3ec61Sdh155122 } 4584f4b3ec61Sdh155122 45857c478bd9Sstevel@tonic-gate /* 45867c478bd9Sstevel@tonic-gate * Make sure that the forwarding table size is a power of 2. 45877c478bd9Sstevel@tonic-gate * The IRE*_ADDR_HASH() macroes depend on that. 45887c478bd9Sstevel@tonic-gate */ 4589f4b3ec61Sdh155122 ipst->ips_ip6_ftable_hash_size = ip6_ftable_hash_size; 4590f4b3ec61Sdh155122 power2_roundup(&ipst->ips_ip6_ftable_hash_size); 4591f4b3ec61Sdh155122 4592f4b3ec61Sdh155122 ipst->ips_ire_handle = 1; 45937c478bd9Sstevel@tonic-gate } 45947c478bd9Sstevel@tonic-gate 45957c478bd9Sstevel@tonic-gate void 4596f4b3ec61Sdh155122 ip_ire_g_fini(void) 4597f4b3ec61Sdh155122 { 4598f4b3ec61Sdh155122 kmem_cache_destroy(ire_cache); 4599f4b3ec61Sdh155122 kmem_cache_destroy(rt_entry_cache); 4600f4b3ec61Sdh155122 4601f4b3ec61Sdh155122 rn_fini(); 4602f4b3ec61Sdh155122 } 4603f4b3ec61Sdh155122 4604f4b3ec61Sdh155122 void 4605f4b3ec61Sdh155122 ip_ire_fini(ip_stack_t *ipst) 46067c478bd9Sstevel@tonic-gate { 46077c478bd9Sstevel@tonic-gate int i; 46087c478bd9Sstevel@tonic-gate 4609f4b3ec61Sdh155122 /* 4610f4b3ec61Sdh155122 * Delete all IREs - assumes that the ill/ipifs have 4611f4b3ec61Sdh155122 * been removed so what remains are just the ftable and IRE_CACHE. 4612f4b3ec61Sdh155122 */ 4613f4b3ec61Sdh155122 ire_walk(ire_delete, NULL, ipst); 4614c793af95Ssangeeta 4615f4b3ec61Sdh155122 rn_freehead(ipst->ips_ip_ftable); 4616f4b3ec61Sdh155122 ipst->ips_ip_ftable = NULL; 46177c478bd9Sstevel@tonic-gate 4618f4b3ec61Sdh155122 mutex_destroy(&ipst->ips_ire_ft_init_lock); 4619f4b3ec61Sdh155122 mutex_destroy(&ipst->ips_ire_handle_lock); 4620f4b3ec61Sdh155122 4621f4b3ec61Sdh155122 for (i = 0; i < ipst->ips_ip_cache_table_size; i++) { 4622f4b3ec61Sdh155122 ASSERT(ipst->ips_ip_cache_table[i].irb_ire == NULL); 4623f4b3ec61Sdh155122 rw_destroy(&ipst->ips_ip_cache_table[i].irb_lock); 46247c478bd9Sstevel@tonic-gate } 4625f4b3ec61Sdh155122 kmem_free(ipst->ips_ip_cache_table, 4626f4b3ec61Sdh155122 ipst->ips_ip_cache_table_size * sizeof (irb_t)); 4627f4b3ec61Sdh155122 ipst->ips_ip_cache_table = NULL; 46287c478bd9Sstevel@tonic-gate 4629f4b3ec61Sdh155122 for (i = 0; i < ipst->ips_ip6_cache_table_size; i++) { 4630f4b3ec61Sdh155122 ASSERT(ipst->ips_ip_cache_table_v6[i].irb_ire == NULL); 4631f4b3ec61Sdh155122 rw_destroy(&ipst->ips_ip_cache_table_v6[i].irb_lock); 46327c478bd9Sstevel@tonic-gate } 4633f4b3ec61Sdh155122 kmem_free(ipst->ips_ip_cache_table_v6, 4634f4b3ec61Sdh155122 ipst->ips_ip6_cache_table_size * sizeof (irb_t)); 4635f4b3ec61Sdh155122 ipst->ips_ip_cache_table_v6 = NULL; 46367c478bd9Sstevel@tonic-gate 4637f4b3ec61Sdh155122 for (i = 0; i < IP6_MASK_TABLE_SIZE; i++) { 4638f4b3ec61Sdh155122 irb_t *ptr; 4639f4b3ec61Sdh155122 int j; 4640f4b3ec61Sdh155122 4641f4b3ec61Sdh155122 if ((ptr = ipst->ips_ip_forwarding_table_v6[i]) == NULL) 4642f4b3ec61Sdh155122 continue; 4643f4b3ec61Sdh155122 4644f4b3ec61Sdh155122 for (j = 0; j < ipst->ips_ip6_ftable_hash_size; j++) { 4645f4b3ec61Sdh155122 ASSERT(ptr[j].irb_ire == NULL); 4646f4b3ec61Sdh155122 rw_destroy(&ptr[j].irb_lock); 4647f4b3ec61Sdh155122 } 4648f4b3ec61Sdh155122 mi_free(ptr); 4649f4b3ec61Sdh155122 ipst->ips_ip_forwarding_table_v6[i] = NULL; 4650f4b3ec61Sdh155122 } 46517c478bd9Sstevel@tonic-gate } 46527c478bd9Sstevel@tonic-gate 46537c478bd9Sstevel@tonic-gate /* 46547c478bd9Sstevel@tonic-gate * Check if another multirt route resolution is needed. 46557c478bd9Sstevel@tonic-gate * B_TRUE is returned is there remain a resolvable route, 46567c478bd9Sstevel@tonic-gate * or if no route for that dst is resolved yet. 46577c478bd9Sstevel@tonic-gate * B_FALSE is returned if all routes for that dst are resolved 46587c478bd9Sstevel@tonic-gate * or if the remaining unresolved routes are actually not 46597c478bd9Sstevel@tonic-gate * resolvable. 46607c478bd9Sstevel@tonic-gate * This only works in the global zone. 46617c478bd9Sstevel@tonic-gate */ 46627c478bd9Sstevel@tonic-gate boolean_t 4663f4b3ec61Sdh155122 ire_multirt_need_resolve(ipaddr_t dst, const ts_label_t *tsl, ip_stack_t *ipst) 46647c478bd9Sstevel@tonic-gate { 46657c478bd9Sstevel@tonic-gate ire_t *first_fire; 46667c478bd9Sstevel@tonic-gate ire_t *first_cire; 46677c478bd9Sstevel@tonic-gate ire_t *fire; 46687c478bd9Sstevel@tonic-gate ire_t *cire; 46697c478bd9Sstevel@tonic-gate irb_t *firb; 46707c478bd9Sstevel@tonic-gate irb_t *cirb; 46717c478bd9Sstevel@tonic-gate int unres_cnt = 0; 46727c478bd9Sstevel@tonic-gate boolean_t resolvable = B_FALSE; 46737c478bd9Sstevel@tonic-gate 46747c478bd9Sstevel@tonic-gate /* Retrieve the first IRE_HOST that matches the destination */ 46757c478bd9Sstevel@tonic-gate first_fire = ire_ftable_lookup(dst, IP_HOST_MASK, 0, IRE_HOST, NULL, 467645916cd2Sjpk NULL, ALL_ZONES, 0, tsl, 4677f4b3ec61Sdh155122 MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_SECATTR, ipst); 46787c478bd9Sstevel@tonic-gate 46797c478bd9Sstevel@tonic-gate /* No route at all */ 46807c478bd9Sstevel@tonic-gate if (first_fire == NULL) { 46817c478bd9Sstevel@tonic-gate return (B_TRUE); 46827c478bd9Sstevel@tonic-gate } 46837c478bd9Sstevel@tonic-gate 46847c478bd9Sstevel@tonic-gate firb = first_fire->ire_bucket; 46857c478bd9Sstevel@tonic-gate ASSERT(firb != NULL); 46867c478bd9Sstevel@tonic-gate 46877c478bd9Sstevel@tonic-gate /* Retrieve the first IRE_CACHE ire for that destination. */ 4688f4b3ec61Sdh155122 first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID, tsl, ipst); 46897c478bd9Sstevel@tonic-gate 46907c478bd9Sstevel@tonic-gate /* No resolved route. */ 46917c478bd9Sstevel@tonic-gate if (first_cire == NULL) { 46927c478bd9Sstevel@tonic-gate ire_refrele(first_fire); 46937c478bd9Sstevel@tonic-gate return (B_TRUE); 46947c478bd9Sstevel@tonic-gate } 46957c478bd9Sstevel@tonic-gate 46967c478bd9Sstevel@tonic-gate /* 46977c478bd9Sstevel@tonic-gate * At least one route is resolved. Here we look through the forward 46987c478bd9Sstevel@tonic-gate * and cache tables, to compare the number of declared routes 46997c478bd9Sstevel@tonic-gate * with the number of resolved routes. The search for a resolvable 47007c478bd9Sstevel@tonic-gate * route is performed only if at least one route remains 47017c478bd9Sstevel@tonic-gate * unresolved. 47027c478bd9Sstevel@tonic-gate */ 47037c478bd9Sstevel@tonic-gate cirb = first_cire->ire_bucket; 47047c478bd9Sstevel@tonic-gate ASSERT(cirb != NULL); 47057c478bd9Sstevel@tonic-gate 47067c478bd9Sstevel@tonic-gate /* Count the number of routes to that dest that are declared. */ 47077c478bd9Sstevel@tonic-gate IRB_REFHOLD(firb); 47087c478bd9Sstevel@tonic-gate for (fire = first_fire; fire != NULL; fire = fire->ire_next) { 47097c478bd9Sstevel@tonic-gate if (!(fire->ire_flags & RTF_MULTIRT)) 47107c478bd9Sstevel@tonic-gate continue; 47117c478bd9Sstevel@tonic-gate if (fire->ire_addr != dst) 47127c478bd9Sstevel@tonic-gate continue; 47137c478bd9Sstevel@tonic-gate unres_cnt++; 47147c478bd9Sstevel@tonic-gate } 47157c478bd9Sstevel@tonic-gate IRB_REFRELE(firb); 47167c478bd9Sstevel@tonic-gate 47177c478bd9Sstevel@tonic-gate /* Then subtract the number of routes to that dst that are resolved */ 47187c478bd9Sstevel@tonic-gate IRB_REFHOLD(cirb); 47197c478bd9Sstevel@tonic-gate for (cire = first_cire; cire != NULL; cire = cire->ire_next) { 47207c478bd9Sstevel@tonic-gate if (!(cire->ire_flags & RTF_MULTIRT)) 47217c478bd9Sstevel@tonic-gate continue; 47227c478bd9Sstevel@tonic-gate if (cire->ire_addr != dst) 47237c478bd9Sstevel@tonic-gate continue; 4724e11c3f44Smeem if (cire->ire_marks & (IRE_MARK_CONDEMNED|IRE_MARK_TESTHIDDEN)) 47257c478bd9Sstevel@tonic-gate continue; 47267c478bd9Sstevel@tonic-gate unres_cnt--; 47277c478bd9Sstevel@tonic-gate } 47287c478bd9Sstevel@tonic-gate IRB_REFRELE(cirb); 47297c478bd9Sstevel@tonic-gate 47307c478bd9Sstevel@tonic-gate /* At least one route is unresolved; search for a resolvable route. */ 47317c478bd9Sstevel@tonic-gate if (unres_cnt > 0) 47327c478bd9Sstevel@tonic-gate resolvable = ire_multirt_lookup(&first_cire, &first_fire, 4733f4b3ec61Sdh155122 MULTIRT_USESTAMP | MULTIRT_CACHEGW, tsl, ipst); 47347c478bd9Sstevel@tonic-gate 47357c478bd9Sstevel@tonic-gate if (first_fire != NULL) 47367c478bd9Sstevel@tonic-gate ire_refrele(first_fire); 47377c478bd9Sstevel@tonic-gate 47387c478bd9Sstevel@tonic-gate if (first_cire != NULL) 47397c478bd9Sstevel@tonic-gate ire_refrele(first_cire); 47407c478bd9Sstevel@tonic-gate 47417c478bd9Sstevel@tonic-gate return (resolvable); 47427c478bd9Sstevel@tonic-gate } 47437c478bd9Sstevel@tonic-gate 47447c478bd9Sstevel@tonic-gate /* 47457c478bd9Sstevel@tonic-gate * Explore a forward_table bucket, starting from fire_arg. 47467c478bd9Sstevel@tonic-gate * fire_arg MUST be an IRE_HOST entry. 47477c478bd9Sstevel@tonic-gate * 47487c478bd9Sstevel@tonic-gate * Return B_TRUE and update *ire_arg and *fire_arg 47497c478bd9Sstevel@tonic-gate * if at least one resolvable route is found. *ire_arg 47507c478bd9Sstevel@tonic-gate * is the IRE entry for *fire_arg's gateway. 47517c478bd9Sstevel@tonic-gate * 47527c478bd9Sstevel@tonic-gate * Return B_FALSE otherwise (all routes are resolved or 47537c478bd9Sstevel@tonic-gate * the remaining unresolved routes are all unresolvable). 47547c478bd9Sstevel@tonic-gate * 47557c478bd9Sstevel@tonic-gate * The IRE selection relies on a priority mechanism 47567c478bd9Sstevel@tonic-gate * driven by the flags passed in by the caller. 47577c478bd9Sstevel@tonic-gate * The caller, such as ip_newroute_ipif(), can get the most 47587c478bd9Sstevel@tonic-gate * relevant ire at each stage of a multiple route resolution. 47597c478bd9Sstevel@tonic-gate * 47607c478bd9Sstevel@tonic-gate * The rules are: 47617c478bd9Sstevel@tonic-gate * 47627c478bd9Sstevel@tonic-gate * - if MULTIRT_CACHEGW is specified in flags, IRE_CACHETABLE 47637c478bd9Sstevel@tonic-gate * ires are preferred for the gateway. This gives the highest 47647c478bd9Sstevel@tonic-gate * priority to routes that can be resolved without using 47657c478bd9Sstevel@tonic-gate * a resolver. 47667c478bd9Sstevel@tonic-gate * 47677c478bd9Sstevel@tonic-gate * - if MULTIRT_CACHEGW is not specified, or if MULTIRT_CACHEGW 47687c478bd9Sstevel@tonic-gate * is specified but no IRE_CACHETABLE ire entry for the gateway 47697c478bd9Sstevel@tonic-gate * is found, the following rules apply. 47707c478bd9Sstevel@tonic-gate * 47717c478bd9Sstevel@tonic-gate * - if MULTIRT_USESTAMP is specified in flags, IRE_INTERFACE 47727c478bd9Sstevel@tonic-gate * ires for the gateway, that have not been tried since 47737c478bd9Sstevel@tonic-gate * a configurable amount of time, are preferred. 47747c478bd9Sstevel@tonic-gate * This applies when a resolver must be invoked for 47757c478bd9Sstevel@tonic-gate * a missing route, but we don't want to use the resolver 47767c478bd9Sstevel@tonic-gate * upon each packet emission. If no such resolver is found, 47777c478bd9Sstevel@tonic-gate * B_FALSE is returned. 47787c478bd9Sstevel@tonic-gate * The MULTIRT_USESTAMP flag can be combined with 47797c478bd9Sstevel@tonic-gate * MULTIRT_CACHEGW. 47807c478bd9Sstevel@tonic-gate * 47817c478bd9Sstevel@tonic-gate * - if MULTIRT_USESTAMP is not specified in flags, the first 47827c478bd9Sstevel@tonic-gate * unresolved but resolvable route is selected. 47837c478bd9Sstevel@tonic-gate * 47847c478bd9Sstevel@tonic-gate * - Otherwise, there is no resolvalble route, and 47857c478bd9Sstevel@tonic-gate * B_FALSE is returned. 47867c478bd9Sstevel@tonic-gate * 47877c478bd9Sstevel@tonic-gate * At last, MULTIRT_SETSTAMP can be specified in flags to 47887c478bd9Sstevel@tonic-gate * request the timestamp of unresolvable routes to 47897c478bd9Sstevel@tonic-gate * be refreshed. This prevents the useless exploration 47907c478bd9Sstevel@tonic-gate * of those routes for a while, when MULTIRT_USESTAMP is used. 47917c478bd9Sstevel@tonic-gate * 47927c478bd9Sstevel@tonic-gate * This only works in the global zone. 47937c478bd9Sstevel@tonic-gate */ 47947c478bd9Sstevel@tonic-gate boolean_t 479545916cd2Sjpk ire_multirt_lookup(ire_t **ire_arg, ire_t **fire_arg, uint32_t flags, 4796f4b3ec61Sdh155122 const ts_label_t *tsl, ip_stack_t *ipst) 47977c478bd9Sstevel@tonic-gate { 47987c478bd9Sstevel@tonic-gate clock_t delta; 47997c478bd9Sstevel@tonic-gate ire_t *best_fire = NULL; 48007c478bd9Sstevel@tonic-gate ire_t *best_cire = NULL; 48017c478bd9Sstevel@tonic-gate ire_t *first_fire; 48027c478bd9Sstevel@tonic-gate ire_t *first_cire; 48037c478bd9Sstevel@tonic-gate ire_t *fire; 48047c478bd9Sstevel@tonic-gate ire_t *cire; 48057c478bd9Sstevel@tonic-gate irb_t *firb = NULL; 48067c478bd9Sstevel@tonic-gate irb_t *cirb = NULL; 48077c478bd9Sstevel@tonic-gate ire_t *gw_ire; 48087c478bd9Sstevel@tonic-gate boolean_t already_resolved; 48097c478bd9Sstevel@tonic-gate boolean_t res; 48107c478bd9Sstevel@tonic-gate ipaddr_t dst; 48117c478bd9Sstevel@tonic-gate ipaddr_t gw; 48127c478bd9Sstevel@tonic-gate 48137c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup: *ire_arg %p, *fire_arg %p, flags %04x\n", 48147c478bd9Sstevel@tonic-gate (void *)*ire_arg, (void *)*fire_arg, flags)); 48157c478bd9Sstevel@tonic-gate 48167c478bd9Sstevel@tonic-gate ASSERT(ire_arg != NULL); 48177c478bd9Sstevel@tonic-gate ASSERT(fire_arg != NULL); 48187c478bd9Sstevel@tonic-gate 48197c478bd9Sstevel@tonic-gate /* Not an IRE_HOST ire; give up. */ 48207c478bd9Sstevel@tonic-gate if ((*fire_arg == NULL) || ((*fire_arg)->ire_type != IRE_HOST)) { 48217c478bd9Sstevel@tonic-gate return (B_FALSE); 48227c478bd9Sstevel@tonic-gate } 48237c478bd9Sstevel@tonic-gate 48247c478bd9Sstevel@tonic-gate /* This is the first IRE_HOST ire for that destination. */ 48257c478bd9Sstevel@tonic-gate first_fire = *fire_arg; 48267c478bd9Sstevel@tonic-gate firb = first_fire->ire_bucket; 48277c478bd9Sstevel@tonic-gate ASSERT(firb != NULL); 48287c478bd9Sstevel@tonic-gate 48297c478bd9Sstevel@tonic-gate dst = first_fire->ire_addr; 48307c478bd9Sstevel@tonic-gate 48317c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup: dst %08x\n", ntohl(dst))); 48327c478bd9Sstevel@tonic-gate 48337c478bd9Sstevel@tonic-gate /* 48347c478bd9Sstevel@tonic-gate * Retrieve the first IRE_CACHE ire for that destination; 48357c478bd9Sstevel@tonic-gate * if we don't find one, no route for that dest is 48367c478bd9Sstevel@tonic-gate * resolved yet. 48377c478bd9Sstevel@tonic-gate */ 4838f4b3ec61Sdh155122 first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID, tsl, ipst); 48397c478bd9Sstevel@tonic-gate if (first_cire != NULL) { 48407c478bd9Sstevel@tonic-gate cirb = first_cire->ire_bucket; 48417c478bd9Sstevel@tonic-gate } 48427c478bd9Sstevel@tonic-gate 48437c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup: first_cire %p\n", (void *)first_cire)); 48447c478bd9Sstevel@tonic-gate 48457c478bd9Sstevel@tonic-gate /* 48467c478bd9Sstevel@tonic-gate * Search for a resolvable route, giving the top priority 48477c478bd9Sstevel@tonic-gate * to routes that can be resolved without any call to the resolver. 48487c478bd9Sstevel@tonic-gate */ 48497c478bd9Sstevel@tonic-gate IRB_REFHOLD(firb); 48507c478bd9Sstevel@tonic-gate 48517c478bd9Sstevel@tonic-gate if (!CLASSD(dst)) { 48527c478bd9Sstevel@tonic-gate /* 48537c478bd9Sstevel@tonic-gate * For all multiroute IRE_HOST ires for that destination, 48547c478bd9Sstevel@tonic-gate * check if the route via the IRE_HOST's gateway is 48557c478bd9Sstevel@tonic-gate * resolved yet. 48567c478bd9Sstevel@tonic-gate */ 48577c478bd9Sstevel@tonic-gate for (fire = first_fire; fire != NULL; fire = fire->ire_next) { 48587c478bd9Sstevel@tonic-gate 48597c478bd9Sstevel@tonic-gate if (!(fire->ire_flags & RTF_MULTIRT)) 48607c478bd9Sstevel@tonic-gate continue; 48617c478bd9Sstevel@tonic-gate if (fire->ire_addr != dst) 48627c478bd9Sstevel@tonic-gate continue; 48637c478bd9Sstevel@tonic-gate 486445916cd2Sjpk if (fire->ire_gw_secattr != NULL && 486545916cd2Sjpk tsol_ire_match_gwattr(fire, tsl) != 0) { 486645916cd2Sjpk continue; 486745916cd2Sjpk } 486845916cd2Sjpk 48697c478bd9Sstevel@tonic-gate gw = fire->ire_gateway_addr; 48707c478bd9Sstevel@tonic-gate 48717c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup: fire %p, " 48727c478bd9Sstevel@tonic-gate "ire_addr %08x, ire_gateway_addr %08x\n", 48737c478bd9Sstevel@tonic-gate (void *)fire, ntohl(fire->ire_addr), ntohl(gw))); 48747c478bd9Sstevel@tonic-gate 48757c478bd9Sstevel@tonic-gate already_resolved = B_FALSE; 48767c478bd9Sstevel@tonic-gate 48777c478bd9Sstevel@tonic-gate if (first_cire != NULL) { 48787c478bd9Sstevel@tonic-gate ASSERT(cirb != NULL); 48797c478bd9Sstevel@tonic-gate 48807c478bd9Sstevel@tonic-gate IRB_REFHOLD(cirb); 48817c478bd9Sstevel@tonic-gate /* 48827c478bd9Sstevel@tonic-gate * For all IRE_CACHE ires for that 48837c478bd9Sstevel@tonic-gate * destination. 48847c478bd9Sstevel@tonic-gate */ 48857c478bd9Sstevel@tonic-gate for (cire = first_cire; 48867c478bd9Sstevel@tonic-gate cire != NULL; 48877c478bd9Sstevel@tonic-gate cire = cire->ire_next) { 48887c478bd9Sstevel@tonic-gate 48897c478bd9Sstevel@tonic-gate if (!(cire->ire_flags & RTF_MULTIRT)) 48907c478bd9Sstevel@tonic-gate continue; 48917c478bd9Sstevel@tonic-gate if (cire->ire_addr != dst) 48927c478bd9Sstevel@tonic-gate continue; 48937c478bd9Sstevel@tonic-gate if (cire->ire_marks & 48947c478bd9Sstevel@tonic-gate (IRE_MARK_CONDEMNED | 4895e11c3f44Smeem IRE_MARK_TESTHIDDEN)) 48967c478bd9Sstevel@tonic-gate continue; 489745916cd2Sjpk 489845916cd2Sjpk if (cire->ire_gw_secattr != NULL && 489945916cd2Sjpk tsol_ire_match_gwattr(cire, 490045916cd2Sjpk tsl) != 0) { 490145916cd2Sjpk continue; 490245916cd2Sjpk } 490345916cd2Sjpk 49047c478bd9Sstevel@tonic-gate /* 49057c478bd9Sstevel@tonic-gate * Check if the IRE_CACHE's gateway 49067c478bd9Sstevel@tonic-gate * matches the IRE_HOST's gateway. 49077c478bd9Sstevel@tonic-gate */ 49087c478bd9Sstevel@tonic-gate if (cire->ire_gateway_addr == gw) { 49097c478bd9Sstevel@tonic-gate already_resolved = B_TRUE; 49107c478bd9Sstevel@tonic-gate break; 49117c478bd9Sstevel@tonic-gate } 49127c478bd9Sstevel@tonic-gate } 49137c478bd9Sstevel@tonic-gate IRB_REFRELE(cirb); 49147c478bd9Sstevel@tonic-gate } 49157c478bd9Sstevel@tonic-gate 49167c478bd9Sstevel@tonic-gate /* 49177c478bd9Sstevel@tonic-gate * This route is already resolved; 49187c478bd9Sstevel@tonic-gate * proceed with next one. 49197c478bd9Sstevel@tonic-gate */ 49207c478bd9Sstevel@tonic-gate if (already_resolved) { 49217c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup: found cire %p, " 49227c478bd9Sstevel@tonic-gate "already resolved\n", (void *)cire)); 49237c478bd9Sstevel@tonic-gate continue; 49247c478bd9Sstevel@tonic-gate } 49257c478bd9Sstevel@tonic-gate 49267c478bd9Sstevel@tonic-gate /* 49277c478bd9Sstevel@tonic-gate * The route is unresolved; is it actually 49287c478bd9Sstevel@tonic-gate * resolvable, i.e. is there a cache or a resolver 49297c478bd9Sstevel@tonic-gate * for the gateway? 49307c478bd9Sstevel@tonic-gate */ 49317c478bd9Sstevel@tonic-gate gw_ire = ire_route_lookup(gw, 0, 0, 0, NULL, NULL, 493245916cd2Sjpk ALL_ZONES, tsl, 4933f4b3ec61Sdh155122 MATCH_IRE_RECURSIVE | MATCH_IRE_SECATTR, ipst); 49347c478bd9Sstevel@tonic-gate 49357c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup: looked up gw_ire %p\n", 49367c478bd9Sstevel@tonic-gate (void *)gw_ire)); 49377c478bd9Sstevel@tonic-gate 49387c478bd9Sstevel@tonic-gate /* 49397c478bd9Sstevel@tonic-gate * If gw_ire is typed IRE_CACHETABLE, 49407c478bd9Sstevel@tonic-gate * this route can be resolved without any call to the 49417c478bd9Sstevel@tonic-gate * resolver. If the MULTIRT_CACHEGW flag is set, 49427c478bd9Sstevel@tonic-gate * give the top priority to this ire and exit the 49437c478bd9Sstevel@tonic-gate * loop. 49447c478bd9Sstevel@tonic-gate * This is typically the case when an ARP reply 49457c478bd9Sstevel@tonic-gate * is processed through ip_wput_nondata(). 49467c478bd9Sstevel@tonic-gate */ 49477c478bd9Sstevel@tonic-gate if ((flags & MULTIRT_CACHEGW) && 49487c478bd9Sstevel@tonic-gate (gw_ire != NULL) && 49497c478bd9Sstevel@tonic-gate (gw_ire->ire_type & IRE_CACHETABLE)) { 4950c793af95Ssangeeta ASSERT(gw_ire->ire_nce == NULL || 4951c793af95Ssangeeta gw_ire->ire_nce->nce_state == ND_REACHABLE); 49527c478bd9Sstevel@tonic-gate /* 49537c478bd9Sstevel@tonic-gate * Release the resolver associated to the 49547c478bd9Sstevel@tonic-gate * previous candidate best ire, if any. 49557c478bd9Sstevel@tonic-gate */ 49567c478bd9Sstevel@tonic-gate if (best_cire != NULL) { 49577c478bd9Sstevel@tonic-gate ire_refrele(best_cire); 49587c478bd9Sstevel@tonic-gate ASSERT(best_fire != NULL); 49597c478bd9Sstevel@tonic-gate } 49607c478bd9Sstevel@tonic-gate 49617c478bd9Sstevel@tonic-gate best_fire = fire; 49627c478bd9Sstevel@tonic-gate best_cire = gw_ire; 49637c478bd9Sstevel@tonic-gate 49647c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup: found top prio " 49657c478bd9Sstevel@tonic-gate "best_fire %p, best_cire %p\n", 49667c478bd9Sstevel@tonic-gate (void *)best_fire, (void *)best_cire)); 49677c478bd9Sstevel@tonic-gate break; 49687c478bd9Sstevel@tonic-gate } 49697c478bd9Sstevel@tonic-gate 49707c478bd9Sstevel@tonic-gate /* 49717c478bd9Sstevel@tonic-gate * Compute the time elapsed since our preceding 49727c478bd9Sstevel@tonic-gate * attempt to resolve that route. 49737c478bd9Sstevel@tonic-gate * If the MULTIRT_USESTAMP flag is set, we take that 49747c478bd9Sstevel@tonic-gate * route into account only if this time interval 49757c478bd9Sstevel@tonic-gate * exceeds ip_multirt_resolution_interval; 49767c478bd9Sstevel@tonic-gate * this prevents us from attempting to resolve a 49777c478bd9Sstevel@tonic-gate * broken route upon each sending of a packet. 49787c478bd9Sstevel@tonic-gate */ 49797c478bd9Sstevel@tonic-gate delta = lbolt - fire->ire_last_used_time; 49807c478bd9Sstevel@tonic-gate delta = TICK_TO_MSEC(delta); 49817c478bd9Sstevel@tonic-gate 4982f4b3ec61Sdh155122 res = (boolean_t)((delta > 4983f4b3ec61Sdh155122 ipst->ips_ip_multirt_resolution_interval) || 49847c478bd9Sstevel@tonic-gate (!(flags & MULTIRT_USESTAMP))); 49857c478bd9Sstevel@tonic-gate 49867c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup: fire %p, delta %lu, " 49877c478bd9Sstevel@tonic-gate "res %d\n", 49887c478bd9Sstevel@tonic-gate (void *)fire, delta, res)); 49897c478bd9Sstevel@tonic-gate 49907c478bd9Sstevel@tonic-gate if (res) { 49917c478bd9Sstevel@tonic-gate /* 49927c478bd9Sstevel@tonic-gate * We are here if MULTIRT_USESTAMP flag is set 49937c478bd9Sstevel@tonic-gate * and the resolver for fire's gateway 49947c478bd9Sstevel@tonic-gate * has not been tried since 49957c478bd9Sstevel@tonic-gate * ip_multirt_resolution_interval, or if 49967c478bd9Sstevel@tonic-gate * MULTIRT_USESTAMP is not set but gw_ire did 49977c478bd9Sstevel@tonic-gate * not fill the conditions for MULTIRT_CACHEGW, 49987c478bd9Sstevel@tonic-gate * or if neither MULTIRT_USESTAMP nor 49997c478bd9Sstevel@tonic-gate * MULTIRT_CACHEGW are set. 50007c478bd9Sstevel@tonic-gate */ 50017c478bd9Sstevel@tonic-gate if (gw_ire != NULL) { 50027c478bd9Sstevel@tonic-gate if (best_fire == NULL) { 50037c478bd9Sstevel@tonic-gate ASSERT(best_cire == NULL); 50047c478bd9Sstevel@tonic-gate 50057c478bd9Sstevel@tonic-gate best_fire = fire; 50067c478bd9Sstevel@tonic-gate best_cire = gw_ire; 50077c478bd9Sstevel@tonic-gate 50087c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup:" 50097c478bd9Sstevel@tonic-gate "found candidate " 50107c478bd9Sstevel@tonic-gate "best_fire %p, " 50117c478bd9Sstevel@tonic-gate "best_cire %p\n", 50127c478bd9Sstevel@tonic-gate (void *)best_fire, 50137c478bd9Sstevel@tonic-gate (void *)best_cire)); 50147c478bd9Sstevel@tonic-gate 50157c478bd9Sstevel@tonic-gate /* 50167c478bd9Sstevel@tonic-gate * If MULTIRT_CACHEGW is not 50177c478bd9Sstevel@tonic-gate * set, we ignore the top 50187c478bd9Sstevel@tonic-gate * priority ires that can 50197c478bd9Sstevel@tonic-gate * be resolved without any 50207c478bd9Sstevel@tonic-gate * call to the resolver; 50217c478bd9Sstevel@tonic-gate * In that case, there is 50227c478bd9Sstevel@tonic-gate * actually no need 50237c478bd9Sstevel@tonic-gate * to continue the loop. 50247c478bd9Sstevel@tonic-gate */ 50257c478bd9Sstevel@tonic-gate if (!(flags & 50267c478bd9Sstevel@tonic-gate MULTIRT_CACHEGW)) { 50277c478bd9Sstevel@tonic-gate break; 50287c478bd9Sstevel@tonic-gate } 50297c478bd9Sstevel@tonic-gate continue; 50307c478bd9Sstevel@tonic-gate } 50317c478bd9Sstevel@tonic-gate } else { 50327c478bd9Sstevel@tonic-gate /* 50337c478bd9Sstevel@tonic-gate * No resolver for the gateway: the 50347c478bd9Sstevel@tonic-gate * route is not resolvable. 50357c478bd9Sstevel@tonic-gate * If the MULTIRT_SETSTAMP flag is 50367c478bd9Sstevel@tonic-gate * set, we stamp the IRE_HOST ire, 50377c478bd9Sstevel@tonic-gate * so we will not select it again 50387c478bd9Sstevel@tonic-gate * during this resolution interval. 50397c478bd9Sstevel@tonic-gate */ 50407c478bd9Sstevel@tonic-gate if (flags & MULTIRT_SETSTAMP) 50417c478bd9Sstevel@tonic-gate fire->ire_last_used_time = 50427c478bd9Sstevel@tonic-gate lbolt; 50437c478bd9Sstevel@tonic-gate } 50447c478bd9Sstevel@tonic-gate } 50457c478bd9Sstevel@tonic-gate 50467c478bd9Sstevel@tonic-gate if (gw_ire != NULL) 50477c478bd9Sstevel@tonic-gate ire_refrele(gw_ire); 50487c478bd9Sstevel@tonic-gate } 50497c478bd9Sstevel@tonic-gate } else { /* CLASSD(dst) */ 50507c478bd9Sstevel@tonic-gate 50517c478bd9Sstevel@tonic-gate for (fire = first_fire; 50527c478bd9Sstevel@tonic-gate fire != NULL; 50537c478bd9Sstevel@tonic-gate fire = fire->ire_next) { 50547c478bd9Sstevel@tonic-gate 50557c478bd9Sstevel@tonic-gate if (!(fire->ire_flags & RTF_MULTIRT)) 50567c478bd9Sstevel@tonic-gate continue; 50577c478bd9Sstevel@tonic-gate if (fire->ire_addr != dst) 50587c478bd9Sstevel@tonic-gate continue; 50597c478bd9Sstevel@tonic-gate 506045916cd2Sjpk if (fire->ire_gw_secattr != NULL && 506145916cd2Sjpk tsol_ire_match_gwattr(fire, tsl) != 0) { 506245916cd2Sjpk continue; 506345916cd2Sjpk } 506445916cd2Sjpk 50657c478bd9Sstevel@tonic-gate already_resolved = B_FALSE; 50667c478bd9Sstevel@tonic-gate 50677c478bd9Sstevel@tonic-gate gw = fire->ire_gateway_addr; 50687c478bd9Sstevel@tonic-gate 50697c478bd9Sstevel@tonic-gate gw_ire = ire_ftable_lookup(gw, 0, 0, IRE_INTERFACE, 507045916cd2Sjpk NULL, NULL, ALL_ZONES, 0, tsl, 507145916cd2Sjpk MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE | 5072f4b3ec61Sdh155122 MATCH_IRE_SECATTR, ipst); 50737c478bd9Sstevel@tonic-gate 50747c478bd9Sstevel@tonic-gate /* No resolver for the gateway; we skip this ire. */ 50757c478bd9Sstevel@tonic-gate if (gw_ire == NULL) { 50767c478bd9Sstevel@tonic-gate continue; 50777c478bd9Sstevel@tonic-gate } 5078c793af95Ssangeeta ASSERT(gw_ire->ire_nce == NULL || 5079c793af95Ssangeeta gw_ire->ire_nce->nce_state == ND_REACHABLE); 50807c478bd9Sstevel@tonic-gate 50817c478bd9Sstevel@tonic-gate if (first_cire != NULL) { 50827c478bd9Sstevel@tonic-gate 50837c478bd9Sstevel@tonic-gate IRB_REFHOLD(cirb); 50847c478bd9Sstevel@tonic-gate /* 50857c478bd9Sstevel@tonic-gate * For all IRE_CACHE ires for that 50867c478bd9Sstevel@tonic-gate * destination. 50877c478bd9Sstevel@tonic-gate */ 50887c478bd9Sstevel@tonic-gate for (cire = first_cire; 50897c478bd9Sstevel@tonic-gate cire != NULL; 50907c478bd9Sstevel@tonic-gate cire = cire->ire_next) { 50917c478bd9Sstevel@tonic-gate 50927c478bd9Sstevel@tonic-gate if (!(cire->ire_flags & RTF_MULTIRT)) 50937c478bd9Sstevel@tonic-gate continue; 50947c478bd9Sstevel@tonic-gate if (cire->ire_addr != dst) 50957c478bd9Sstevel@tonic-gate continue; 50967c478bd9Sstevel@tonic-gate if (cire->ire_marks & 50977c478bd9Sstevel@tonic-gate (IRE_MARK_CONDEMNED | 5098e11c3f44Smeem IRE_MARK_TESTHIDDEN)) 50997c478bd9Sstevel@tonic-gate continue; 51007c478bd9Sstevel@tonic-gate 510145916cd2Sjpk if (cire->ire_gw_secattr != NULL && 510245916cd2Sjpk tsol_ire_match_gwattr(cire, 510345916cd2Sjpk tsl) != 0) { 510445916cd2Sjpk continue; 510545916cd2Sjpk } 510645916cd2Sjpk 51077c478bd9Sstevel@tonic-gate /* 51087c478bd9Sstevel@tonic-gate * Cache entries are linked to the 51097c478bd9Sstevel@tonic-gate * parent routes using the parent handle 51107c478bd9Sstevel@tonic-gate * (ire_phandle). If no cache entry has 51117c478bd9Sstevel@tonic-gate * the same handle as fire, fire is 51127c478bd9Sstevel@tonic-gate * still unresolved. 51137c478bd9Sstevel@tonic-gate */ 51147c478bd9Sstevel@tonic-gate ASSERT(cire->ire_phandle != 0); 51157c478bd9Sstevel@tonic-gate if (cire->ire_phandle == 51167c478bd9Sstevel@tonic-gate fire->ire_phandle) { 51177c478bd9Sstevel@tonic-gate already_resolved = B_TRUE; 51187c478bd9Sstevel@tonic-gate break; 51197c478bd9Sstevel@tonic-gate } 51207c478bd9Sstevel@tonic-gate } 51217c478bd9Sstevel@tonic-gate IRB_REFRELE(cirb); 51227c478bd9Sstevel@tonic-gate } 51237c478bd9Sstevel@tonic-gate 51247c478bd9Sstevel@tonic-gate /* 51257c478bd9Sstevel@tonic-gate * This route is already resolved; proceed with 51267c478bd9Sstevel@tonic-gate * next one. 51277c478bd9Sstevel@tonic-gate */ 51287c478bd9Sstevel@tonic-gate if (already_resolved) { 51297c478bd9Sstevel@tonic-gate ire_refrele(gw_ire); 51307c478bd9Sstevel@tonic-gate continue; 51317c478bd9Sstevel@tonic-gate } 51327c478bd9Sstevel@tonic-gate 51337c478bd9Sstevel@tonic-gate /* 51347c478bd9Sstevel@tonic-gate * Compute the time elapsed since our preceding 51357c478bd9Sstevel@tonic-gate * attempt to resolve that route. 51367c478bd9Sstevel@tonic-gate * If the MULTIRT_USESTAMP flag is set, we take 51377c478bd9Sstevel@tonic-gate * that route into account only if this time 51387c478bd9Sstevel@tonic-gate * interval exceeds ip_multirt_resolution_interval; 51397c478bd9Sstevel@tonic-gate * this prevents us from attempting to resolve a 51407c478bd9Sstevel@tonic-gate * broken route upon each sending of a packet. 51417c478bd9Sstevel@tonic-gate */ 51427c478bd9Sstevel@tonic-gate delta = lbolt - fire->ire_last_used_time; 51437c478bd9Sstevel@tonic-gate delta = TICK_TO_MSEC(delta); 51447c478bd9Sstevel@tonic-gate 5145f4b3ec61Sdh155122 res = (boolean_t)((delta > 5146f4b3ec61Sdh155122 ipst->ips_ip_multirt_resolution_interval) || 51477c478bd9Sstevel@tonic-gate (!(flags & MULTIRT_USESTAMP))); 51487c478bd9Sstevel@tonic-gate 51497c478bd9Sstevel@tonic-gate ip3dbg(("ire_multirt_lookup: fire %p, delta %lx, " 51507c478bd9Sstevel@tonic-gate "flags %04x, res %d\n", 51517c478bd9Sstevel@tonic-gate (void *)fire, delta, flags, res)); 51527c478bd9Sstevel@tonic-gate 51537c478bd9Sstevel@tonic-gate if (res) { 51547c478bd9Sstevel@tonic-gate if (best_cire != NULL) { 51557c478bd9Sstevel@tonic-gate /* 51567c478bd9Sstevel@tonic-gate * Release the resolver associated 51577c478bd9Sstevel@tonic-gate * to the preceding candidate best 51587c478bd9Sstevel@tonic-gate * ire, if any. 51597c478bd9Sstevel@tonic-gate */ 51607c478bd9Sstevel@tonic-gate ire_refrele(best_cire); 51617c478bd9Sstevel@tonic-gate ASSERT(best_fire != NULL); 51627c478bd9Sstevel@tonic-gate } 51637c478bd9Sstevel@tonic-gate best_fire = fire; 51647c478bd9Sstevel@tonic-gate best_cire = gw_ire; 51657c478bd9Sstevel@tonic-gate continue; 51667c478bd9Sstevel@tonic-gate } 51677c478bd9Sstevel@tonic-gate 51687c478bd9Sstevel@tonic-gate ire_refrele(gw_ire); 51697c478bd9Sstevel@tonic-gate } 51707c478bd9Sstevel@tonic-gate } 51717c478bd9Sstevel@tonic-gate 51727c478bd9Sstevel@tonic-gate if (best_fire != NULL) { 51737c478bd9Sstevel@tonic-gate IRE_REFHOLD(best_fire); 51747c478bd9Sstevel@tonic-gate } 51757c478bd9Sstevel@tonic-gate IRB_REFRELE(firb); 51767c478bd9Sstevel@tonic-gate 51777c478bd9Sstevel@tonic-gate /* Release the first IRE_CACHE we initially looked up, if any. */ 51787c478bd9Sstevel@tonic-gate if (first_cire != NULL) 51797c478bd9Sstevel@tonic-gate ire_refrele(first_cire); 51807c478bd9Sstevel@tonic-gate 51817c478bd9Sstevel@tonic-gate /* Found a resolvable route. */ 51827c478bd9Sstevel@tonic-gate if (best_fire != NULL) { 51837c478bd9Sstevel@tonic-gate ASSERT(best_cire != NULL); 51847c478bd9Sstevel@tonic-gate 51857c478bd9Sstevel@tonic-gate if (*fire_arg != NULL) 51867c478bd9Sstevel@tonic-gate ire_refrele(*fire_arg); 51877c478bd9Sstevel@tonic-gate if (*ire_arg != NULL) 51887c478bd9Sstevel@tonic-gate ire_refrele(*ire_arg); 51897c478bd9Sstevel@tonic-gate 51907c478bd9Sstevel@tonic-gate /* 51917c478bd9Sstevel@tonic-gate * Update the passed-in arguments with the 51927c478bd9Sstevel@tonic-gate * resolvable multirt route we found. 51937c478bd9Sstevel@tonic-gate */ 51947c478bd9Sstevel@tonic-gate *fire_arg = best_fire; 51957c478bd9Sstevel@tonic-gate *ire_arg = best_cire; 51967c478bd9Sstevel@tonic-gate 51977c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup: returning B_TRUE, " 51987c478bd9Sstevel@tonic-gate "*fire_arg %p, *ire_arg %p\n", 51997c478bd9Sstevel@tonic-gate (void *)best_fire, (void *)best_cire)); 52007c478bd9Sstevel@tonic-gate 52017c478bd9Sstevel@tonic-gate return (B_TRUE); 52027c478bd9Sstevel@tonic-gate } 52037c478bd9Sstevel@tonic-gate 52047c478bd9Sstevel@tonic-gate ASSERT(best_cire == NULL); 52057c478bd9Sstevel@tonic-gate 52067c478bd9Sstevel@tonic-gate ip2dbg(("ire_multirt_lookup: returning B_FALSE, *fire_arg %p, " 52077c478bd9Sstevel@tonic-gate "*ire_arg %p\n", 52087c478bd9Sstevel@tonic-gate (void *)*fire_arg, (void *)*ire_arg)); 52097c478bd9Sstevel@tonic-gate 52107c478bd9Sstevel@tonic-gate /* No resolvable route. */ 52117c478bd9Sstevel@tonic-gate return (B_FALSE); 52127c478bd9Sstevel@tonic-gate } 52137c478bd9Sstevel@tonic-gate 52147c478bd9Sstevel@tonic-gate /* 52157c478bd9Sstevel@tonic-gate * IRE iterator for inbound and loopback broadcast processing. 52167c478bd9Sstevel@tonic-gate * Given an IRE_BROADCAST ire, walk the ires with the same destination 52177c478bd9Sstevel@tonic-gate * address, but skip over the passed-in ire. Returns the next ire without 52187c478bd9Sstevel@tonic-gate * a hold - assumes that the caller holds a reference on the IRE bucket. 52197c478bd9Sstevel@tonic-gate */ 52207c478bd9Sstevel@tonic-gate ire_t * 52217c478bd9Sstevel@tonic-gate ire_get_next_bcast_ire(ire_t *curr, ire_t *ire) 52227c478bd9Sstevel@tonic-gate { 52237c478bd9Sstevel@tonic-gate ill_t *ill; 52247c478bd9Sstevel@tonic-gate 52257c478bd9Sstevel@tonic-gate if (curr == NULL) { 52267c478bd9Sstevel@tonic-gate for (curr = ire->ire_bucket->irb_ire; curr != NULL; 52277c478bd9Sstevel@tonic-gate curr = curr->ire_next) { 52287c478bd9Sstevel@tonic-gate if (curr->ire_addr == ire->ire_addr) 52297c478bd9Sstevel@tonic-gate break; 52307c478bd9Sstevel@tonic-gate } 52317c478bd9Sstevel@tonic-gate } else { 52327c478bd9Sstevel@tonic-gate curr = curr->ire_next; 52337c478bd9Sstevel@tonic-gate } 52347c478bd9Sstevel@tonic-gate ill = ire_to_ill(ire); 52357c478bd9Sstevel@tonic-gate for (; curr != NULL; curr = curr->ire_next) { 52367c478bd9Sstevel@tonic-gate if (curr->ire_addr != ire->ire_addr) { 52377c478bd9Sstevel@tonic-gate /* 52387c478bd9Sstevel@tonic-gate * All the IREs to a given destination are contiguous; 52397c478bd9Sstevel@tonic-gate * break out once the address doesn't match. 52407c478bd9Sstevel@tonic-gate */ 52417c478bd9Sstevel@tonic-gate break; 52427c478bd9Sstevel@tonic-gate } 52437c478bd9Sstevel@tonic-gate if (curr == ire) { 52447c478bd9Sstevel@tonic-gate /* skip over the passed-in ire */ 52457c478bd9Sstevel@tonic-gate continue; 52467c478bd9Sstevel@tonic-gate } 52477c478bd9Sstevel@tonic-gate if ((curr->ire_stq != NULL && ire->ire_stq == NULL) || 52487c478bd9Sstevel@tonic-gate (curr->ire_stq == NULL && ire->ire_stq != NULL)) { 52497c478bd9Sstevel@tonic-gate /* 52507c478bd9Sstevel@tonic-gate * If the passed-in ire is loopback, skip over 52517c478bd9Sstevel@tonic-gate * non-loopback ires and vice versa. 52527c478bd9Sstevel@tonic-gate */ 52537c478bd9Sstevel@tonic-gate continue; 52547c478bd9Sstevel@tonic-gate } 52557c478bd9Sstevel@tonic-gate if (ire_to_ill(curr) != ill) { 52567c478bd9Sstevel@tonic-gate /* skip over IREs going through a different interface */ 52577c478bd9Sstevel@tonic-gate continue; 52587c478bd9Sstevel@tonic-gate } 52597c478bd9Sstevel@tonic-gate if (curr->ire_marks & IRE_MARK_CONDEMNED) { 52607c478bd9Sstevel@tonic-gate /* skip over deleted IREs */ 52617c478bd9Sstevel@tonic-gate continue; 52627c478bd9Sstevel@tonic-gate } 52637c478bd9Sstevel@tonic-gate return (curr); 52647c478bd9Sstevel@tonic-gate } 52657c478bd9Sstevel@tonic-gate return (NULL); 52667c478bd9Sstevel@tonic-gate } 52677c478bd9Sstevel@tonic-gate 52686a8288c7Scarlsonj #ifdef DEBUG 52697c478bd9Sstevel@tonic-gate void 52707c478bd9Sstevel@tonic-gate ire_trace_ref(ire_t *ire) 52717c478bd9Sstevel@tonic-gate { 52727c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 52736a8288c7Scarlsonj if (ire->ire_trace_disable) { 52747c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 52757c478bd9Sstevel@tonic-gate return; 52767c478bd9Sstevel@tonic-gate } 52776a8288c7Scarlsonj 52786a8288c7Scarlsonj if (th_trace_ref(ire, ire->ire_ipst)) { 52796a8288c7Scarlsonj mutex_exit(&ire->ire_lock); 52806a8288c7Scarlsonj } else { 52817c478bd9Sstevel@tonic-gate ire->ire_trace_disable = B_TRUE; 52827c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 52836a8288c7Scarlsonj ire_trace_cleanup(ire); 52847c478bd9Sstevel@tonic-gate } 52857c478bd9Sstevel@tonic-gate } 52867c478bd9Sstevel@tonic-gate 52877c478bd9Sstevel@tonic-gate void 52887c478bd9Sstevel@tonic-gate ire_untrace_ref(ire_t *ire) 52897c478bd9Sstevel@tonic-gate { 52907c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 52916a8288c7Scarlsonj if (!ire->ire_trace_disable) 52926a8288c7Scarlsonj th_trace_unref(ire); 52937c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 52947c478bd9Sstevel@tonic-gate } 52957c478bd9Sstevel@tonic-gate 52967c478bd9Sstevel@tonic-gate static void 52976a8288c7Scarlsonj ire_trace_cleanup(const ire_t *ire) 52987c478bd9Sstevel@tonic-gate { 52996a8288c7Scarlsonj th_trace_cleanup(ire, ire->ire_trace_disable); 53007c478bd9Sstevel@tonic-gate } 53016a8288c7Scarlsonj #endif /* DEBUG */ 5302c793af95Ssangeeta 5303c793af95Ssangeeta /* 5304c793af95Ssangeeta * Generate a message chain with an arp request to resolve the in_ire. 5305c793af95Ssangeeta * It is assumed that in_ire itself is currently in the ire cache table, 5306c793af95Ssangeeta * so we create a fake_ire filled with enough information about ire_addr etc. 5307c793af95Ssangeeta * to retrieve in_ire when the DL_UNITDATA response from the resolver 5308c793af95Ssangeeta * comes back. The fake_ire itself is created by calling esballoc with 5309c793af95Ssangeeta * the fr_rtnp (free routine) set to ire_freemblk. This routine will be 5310c793af95Ssangeeta * invoked when the mblk containing fake_ire is freed. 5311c793af95Ssangeeta */ 5312c793af95Ssangeeta void 5313e11c3f44Smeem ire_arpresolve(ire_t *in_ire) 5314c793af95Ssangeeta { 5315c793af95Ssangeeta areq_t *areq; 5316c793af95Ssangeeta ipaddr_t *addrp; 531754da8755Ssowmini mblk_t *ire_mp, *areq_mp; 5318c793af95Ssangeeta ire_t *ire, *buf; 5319c793af95Ssangeeta size_t bufsize; 5320c793af95Ssangeeta frtn_t *frtnp; 5321e11c3f44Smeem ill_t *dst_ill; 5322e11c3f44Smeem ip_stack_t *ipst; 5323e11c3f44Smeem 5324e11c3f44Smeem ASSERT(in_ire->ire_nce != NULL); 5325e11c3f44Smeem 5326e11c3f44Smeem dst_ill = ire_to_ill(in_ire); 5327e11c3f44Smeem ipst = dst_ill->ill_ipst; 5328c793af95Ssangeeta 5329c793af95Ssangeeta /* 5330c793af95Ssangeeta * Construct message chain for the resolver 5331c793af95Ssangeeta * of the form: 5332c793af95Ssangeeta * ARP_REQ_MBLK-->IRE_MBLK 5333c793af95Ssangeeta * 5334c793af95Ssangeeta * NOTE : If the response does not 5335c793af95Ssangeeta * come back, ARP frees the packet. For this reason, 5336c793af95Ssangeeta * we can't REFHOLD the bucket of save_ire to prevent 5337c793af95Ssangeeta * deletions. We may not be able to REFRELE the bucket 5338c793af95Ssangeeta * if the response never comes back. Thus, before 5339c793af95Ssangeeta * adding the ire, ire_add_v4 will make sure that the 5340c793af95Ssangeeta * interface route does not get deleted. This is the 5341c793af95Ssangeeta * only case unlike ip_newroute_v6, ip_newroute_ipif_v6 5342c793af95Ssangeeta * where we can always prevent deletions because of 5343c793af95Ssangeeta * the synchronous nature of adding IRES i.e 5344c793af95Ssangeeta * ire_add_then_send is called after creating the IRE. 5345c793af95Ssangeeta */ 5346c793af95Ssangeeta 5347c793af95Ssangeeta /* 5348e11c3f44Smeem * We use esballoc to allocate the second part (IRE_MBLK) 5349e11c3f44Smeem * of the message chain depicted above. This mblk will be freed 5350c793af95Ssangeeta * by arp when there is a timeout, and otherwise passed to IP 5351e11c3f44Smeem * and IP will free it after processing the ARP response. 5352c793af95Ssangeeta */ 5353c793af95Ssangeeta 5354c793af95Ssangeeta bufsize = sizeof (ire_t) + sizeof (frtn_t); 5355c793af95Ssangeeta buf = kmem_alloc(bufsize, KM_NOSLEEP); 5356c793af95Ssangeeta if (buf == NULL) { 5357e11c3f44Smeem ip1dbg(("ire_arpresolve: alloc buffer failed\n")); 5358c793af95Ssangeeta return; 5359c793af95Ssangeeta } 5360c793af95Ssangeeta frtnp = (frtn_t *)(buf + 1); 5361c793af95Ssangeeta frtnp->free_arg = (caddr_t)buf; 5362c793af95Ssangeeta frtnp->free_func = ire_freemblk; 5363c793af95Ssangeeta 5364c793af95Ssangeeta ire_mp = esballoc((unsigned char *)buf, bufsize, BPRI_MED, frtnp); 5365c793af95Ssangeeta if (ire_mp == NULL) { 5366c793af95Ssangeeta ip1dbg(("ire_arpresolve: esballoc failed\n")); 5367c793af95Ssangeeta kmem_free(buf, bufsize); 5368c793af95Ssangeeta return; 5369c793af95Ssangeeta } 5370e11c3f44Smeem 537154da8755Ssowmini areq_mp = copyb(dst_ill->ill_resolver_mp); 537254da8755Ssowmini if (areq_mp == NULL) { 5373e11c3f44Smeem freemsg(ire_mp); 5374c793af95Ssangeeta return; 5375c793af95Ssangeeta } 5376c793af95Ssangeeta 5377c793af95Ssangeeta ire_mp->b_datap->db_type = IRE_ARPRESOLVE_TYPE; 5378c793af95Ssangeeta ire = (ire_t *)buf; 5379c793af95Ssangeeta /* 5380c793af95Ssangeeta * keep enough info in the fake ire so that we can pull up 5381c793af95Ssangeeta * the incomplete ire (in_ire) after result comes back from 5382c793af95Ssangeeta * arp and make it complete. 5383c793af95Ssangeeta */ 5384c793af95Ssangeeta *ire = ire_null; 5385c793af95Ssangeeta ire->ire_u = in_ire->ire_u; 5386c793af95Ssangeeta ire->ire_ipif_seqid = in_ire->ire_ipif_seqid; 53875b17e9bdSJon Anderson ire->ire_ipif_ifindex = in_ire->ire_ipif_ifindex; 5388c793af95Ssangeeta ire->ire_ipif = in_ire->ire_ipif; 5389e11c3f44Smeem ire->ire_stq = dst_ill->ill_wq; 5390e11c3f44Smeem ire->ire_stq_ifindex = dst_ill->ill_phyint->phyint_ifindex; 5391c793af95Ssangeeta ire->ire_zoneid = in_ire->ire_zoneid; 53921bf5e2aeSSowmini Varadhan ire->ire_stackid = ipst->ips_netstack->netstack_stackid; 5393f4b3ec61Sdh155122 ire->ire_ipst = ipst; 5394f4b3ec61Sdh155122 5395c793af95Ssangeeta /* 5396c793af95Ssangeeta * ire_freemblk will be called when ire_mp is freed, both for 5397c793af95Ssangeeta * successful and failed arp resolution. IRE_MARK_UNCACHED will be set 5398c793af95Ssangeeta * when the arp resolution failed. 5399c793af95Ssangeeta */ 5400c793af95Ssangeeta ire->ire_marks |= IRE_MARK_UNCACHED; 5401c793af95Ssangeeta ire->ire_mp = ire_mp; 5402c793af95Ssangeeta ire_mp->b_wptr = (uchar_t *)&ire[1]; 5403c793af95Ssangeeta ire_mp->b_cont = NULL; 540454da8755Ssowmini linkb(areq_mp, ire_mp); 5405c793af95Ssangeeta 5406c793af95Ssangeeta /* 5407c793af95Ssangeeta * Fill in the source and dest addrs for the resolver. 5408c793af95Ssangeeta * NOTE: this depends on memory layouts imposed by 5409c793af95Ssangeeta * ill_init(). 5410c793af95Ssangeeta */ 541154da8755Ssowmini areq = (areq_t *)areq_mp->b_rptr; 5412c793af95Ssangeeta addrp = (ipaddr_t *)((char *)areq + areq->areq_sender_addr_offset); 5413c793af95Ssangeeta *addrp = ire->ire_src_addr; 5414c793af95Ssangeeta 5415c793af95Ssangeeta addrp = (ipaddr_t *)((char *)areq + areq->areq_target_addr_offset); 5416c793af95Ssangeeta if (ire->ire_gateway_addr != INADDR_ANY) { 5417c793af95Ssangeeta *addrp = ire->ire_gateway_addr; 5418c793af95Ssangeeta } else { 5419c793af95Ssangeeta *addrp = ire->ire_addr; 5420c793af95Ssangeeta } 5421c793af95Ssangeeta 5422c793af95Ssangeeta /* Up to the resolver. */ 5423c793af95Ssangeeta if (canputnext(dst_ill->ill_rq)) { 542454da8755Ssowmini putnext(dst_ill->ill_rq, areq_mp); 5425c793af95Ssangeeta } else { 542654da8755Ssowmini freemsg(areq_mp); 5427c793af95Ssangeeta } 5428c793af95Ssangeeta } 5429c793af95Ssangeeta 5430c793af95Ssangeeta /* 5431c793af95Ssangeeta * Esballoc free function for AR_ENTRY_QUERY request to clean up any 5432c793af95Ssangeeta * unresolved ire_t and/or nce_t structures when ARP resolution fails. 5433c793af95Ssangeeta * 5434c793af95Ssangeeta * This function can be called by ARP via free routine for ire_mp or 5435c793af95Ssangeeta * by IPv4(both host and forwarding path) via ire_delete 5436c793af95Ssangeeta * in case ARP resolution fails. 5437c793af95Ssangeeta * NOTE: Since IP is MT, ARP can call into IP but not vice versa 5438c793af95Ssangeeta * (for IP to talk to ARP, it still has to send AR* messages). 5439c793af95Ssangeeta * 5440c793af95Ssangeeta * Note that the ARP/IP merge should replace the functioanlity by providing 5441c793af95Ssangeeta * direct function calls to clean up unresolved entries in ire/nce lists. 5442c793af95Ssangeeta */ 5443c793af95Ssangeeta void 5444c793af95Ssangeeta ire_freemblk(ire_t *ire_mp) 5445c793af95Ssangeeta { 5446c793af95Ssangeeta nce_t *nce = NULL; 5447c793af95Ssangeeta ill_t *ill; 5448f4b3ec61Sdh155122 ip_stack_t *ipst; 54491bf5e2aeSSowmini Varadhan netstack_t *ns = NULL; 5450c793af95Ssangeeta 5451c793af95Ssangeeta ASSERT(ire_mp != NULL); 5452c793af95Ssangeeta 5453c793af95Ssangeeta if ((ire_mp->ire_addr == NULL) && (ire_mp->ire_gateway_addr == NULL)) { 5454c793af95Ssangeeta ip1dbg(("ire_freemblk(0x%p) ire_addr is NULL\n", 5455c793af95Ssangeeta (void *)ire_mp)); 5456c793af95Ssangeeta goto cleanup; 5457c793af95Ssangeeta } 5458c793af95Ssangeeta if ((ire_mp->ire_marks & IRE_MARK_UNCACHED) == 0) { 5459c793af95Ssangeeta goto cleanup; /* everything succeeded. just free and return */ 5460c793af95Ssangeeta } 5461c793af95Ssangeeta 5462c793af95Ssangeeta /* 5463c793af95Ssangeeta * the arp information corresponding to this ire_mp was not 54641bf5e2aeSSowmini Varadhan * transferred to an ire_cache entry. Need 5465c793af95Ssangeeta * to clean up incomplete ire's and nce, if necessary. 5466c793af95Ssangeeta */ 5467c793af95Ssangeeta ASSERT(ire_mp->ire_stq != NULL); 5468c793af95Ssangeeta ASSERT(ire_mp->ire_stq_ifindex != 0); 5469f4b3ec61Sdh155122 ASSERT(ire_mp->ire_ipst != NULL); 5470f4b3ec61Sdh155122 54711bf5e2aeSSowmini Varadhan ns = netstack_find_by_stackid(ire_mp->ire_stackid); 54721bf5e2aeSSowmini Varadhan ipst = (ns ? ns->netstack_ip : NULL); 54731bf5e2aeSSowmini Varadhan if (ipst == NULL || ipst != ire_mp->ire_ipst) /* Disapeared on us */ 54741bf5e2aeSSowmini Varadhan goto cleanup; 5475f4b3ec61Sdh155122 5476c793af95Ssangeeta /* 5477c793af95Ssangeeta * Get any nce's corresponding to this ire_mp. We first have to 5478c793af95Ssangeeta * make sure that the ill is still around. 5479c793af95Ssangeeta */ 5480f4b3ec61Sdh155122 ill = ill_lookup_on_ifindex(ire_mp->ire_stq_ifindex, 5481f4b3ec61Sdh155122 B_FALSE, NULL, NULL, NULL, NULL, ipst); 5482c793af95Ssangeeta if (ill == NULL || (ire_mp->ire_stq != ill->ill_wq) || 5483c793af95Ssangeeta (ill->ill_state_flags & ILL_CONDEMNED)) { 5484c793af95Ssangeeta /* 5485c793af95Ssangeeta * ill went away. no nce to clean up. 5486c793af95Ssangeeta * Note that the ill_state_flags could be set to 5487c793af95Ssangeeta * ILL_CONDEMNED after this point, but if we know 5488c793af95Ssangeeta * that it is CONDEMNED now, we just bail out quickly. 5489c793af95Ssangeeta */ 5490c793af95Ssangeeta if (ill != NULL) 5491c793af95Ssangeeta ill_refrele(ill); 5492c793af95Ssangeeta goto cleanup; 5493c793af95Ssangeeta } 5494c793af95Ssangeeta nce = ndp_lookup_v4(ill, 5495c793af95Ssangeeta ((ire_mp->ire_gateway_addr != INADDR_ANY) ? 5496c793af95Ssangeeta &ire_mp->ire_gateway_addr : &ire_mp->ire_addr), 5497c793af95Ssangeeta B_FALSE); 5498c793af95Ssangeeta ill_refrele(ill); 5499c793af95Ssangeeta 5500c793af95Ssangeeta if ((nce != NULL) && (nce->nce_state != ND_REACHABLE)) { 5501c793af95Ssangeeta /* 5502c793af95Ssangeeta * some incomplete nce was found. 5503c793af95Ssangeeta */ 5504c793af95Ssangeeta DTRACE_PROBE2(ire__freemblk__arp__resolv__fail, 5505c793af95Ssangeeta nce_t *, nce, ire_t *, ire_mp); 5506c793af95Ssangeeta /* 5507c793af95Ssangeeta * Send the icmp_unreachable messages for the queued mblks in 5508c793af95Ssangeeta * ire->ire_nce->nce_qd_mp, since ARP resolution failed 5509c793af95Ssangeeta * for this ire 5510c793af95Ssangeeta */ 5511c793af95Ssangeeta arp_resolv_failed(nce); 5512c793af95Ssangeeta /* 5513c793af95Ssangeeta * Delete the nce and clean up all ire's pointing at this nce 5514c793af95Ssangeeta * in the cachetable 5515c793af95Ssangeeta */ 5516c793af95Ssangeeta ndp_delete(nce); 5517c793af95Ssangeeta } 5518c793af95Ssangeeta if (nce != NULL) 5519c793af95Ssangeeta NCE_REFRELE(nce); /* release the ref taken by ndp_lookup_v4 */ 5520c793af95Ssangeeta 5521c793af95Ssangeeta cleanup: 55221bf5e2aeSSowmini Varadhan if (ns != NULL) 55231bf5e2aeSSowmini Varadhan netstack_rele(ns); 5524c793af95Ssangeeta /* 5525c793af95Ssangeeta * Get rid of the ire buffer 5526c793af95Ssangeeta * We call kmem_free here(instead of ire_delete()), since 5527c793af95Ssangeeta * this is the freeb's callback. 5528c793af95Ssangeeta */ 5529c793af95Ssangeeta kmem_free(ire_mp, sizeof (ire_t) + sizeof (frtn_t)); 5530c793af95Ssangeeta } 5531c793af95Ssangeeta 5532c0861880Ssangeeta /* 553354da8755Ssowmini * find, or create if needed, a neighbor cache entry nce_t for IRE_CACHE and 553454da8755Ssowmini * non-loopback IRE_BROADCAST ire's. 553554da8755Ssowmini * 553654da8755Ssowmini * If a neighbor-cache entry has to be created (i.e., one does not already 553754da8755Ssowmini * exist in the nce list) the nce_res_mp and nce_state of the neighbor cache 553854da8755Ssowmini * entry are initialized in ndp_add_v4(). These values are picked from 553954da8755Ssowmini * the src_nce, if one is passed in. Otherwise (if src_nce == NULL) the 554054da8755Ssowmini * ire->ire_type and the outgoing interface (ire_to_ill(ire)) values 554154da8755Ssowmini * determine the {nce_state, nce_res_mp} of the nce_t created. All 554254da8755Ssowmini * IRE_BROADCAST entries have nce_state = ND_REACHABLE, and the nce_res_mp 554354da8755Ssowmini * is set to the ill_bcast_mp of the outgoing inerface. For unicast ire 554454da8755Ssowmini * entries, 554554da8755Ssowmini * - if the outgoing interface is of type IRE_IF_RESOLVER, a newly created 554654da8755Ssowmini * nce_t will have a null nce_res_mp, and will be in the ND_INITIAL state. 554754da8755Ssowmini * - if the outgoing interface is a IRE_IF_NORESOLVER interface, no link 554854da8755Ssowmini * layer resolution is necessary, so that the nce_t will be in the 554954da8755Ssowmini * ND_REACHABLE state and the nce_res_mp will have a copy of the 555054da8755Ssowmini * ill_resolver_mp of the outgoing interface. 555154da8755Ssowmini * 555254da8755Ssowmini * The link layer information needed for broadcast addresses, and for 555354da8755Ssowmini * packets sent on IRE_IF_NORESOLVER interfaces is a constant mapping that 555454da8755Ssowmini * never needs re-verification for the lifetime of the nce_t. These are 555554da8755Ssowmini * therefore marked NCE_F_PERMANENT, and never allowed to expire via 555654da8755Ssowmini * NCE_EXPIRED. 555754da8755Ssowmini * 555854da8755Ssowmini * IRE_CACHE ire's contain the information for the nexthop (ire_gateway_addr) 555954da8755Ssowmini * in the case of indirect routes, and for the dst itself (ire_addr) in the 5560c793af95Ssangeeta * case of direct routes, with the nce_res_mp containing a template 5561c793af95Ssangeeta * DL_UNITDATA request. 5562c793af95Ssangeeta * 5563c793af95Ssangeeta * The actual association of the ire_nce to the nce created here is 5564c793af95Ssangeeta * typically done in ire_add_v4 for IRE_CACHE entries. Exceptions 5565c793af95Ssangeeta * to this rule are SO_DONTROUTE ire's (IRE_MARK_NO_ADD), for which 55665c0b7edeSseb * the ire_nce assignment is done in ire_add_then_send. 5567c793af95Ssangeeta */ 5568c793af95Ssangeeta int 556954da8755Ssowmini ire_nce_init(ire_t *ire, nce_t *src_nce) 5570c793af95Ssangeeta { 557154da8755Ssowmini in_addr_t addr4; 5572c793af95Ssangeeta int err; 557354da8755Ssowmini nce_t *nce = NULL; 5574c793af95Ssangeeta ill_t *ire_ill; 557554da8755Ssowmini uint16_t nce_flags = 0; 5576f4b3ec61Sdh155122 ip_stack_t *ipst; 5577c793af95Ssangeeta 557854da8755Ssowmini if (ire->ire_stq == NULL) 5579c793af95Ssangeeta return (0); /* no need to create nce for local/loopback */ 5580c793af95Ssangeeta 5581c793af95Ssangeeta switch (ire->ire_type) { 5582c793af95Ssangeeta case IRE_CACHE: 5583c793af95Ssangeeta if (ire->ire_gateway_addr != INADDR_ANY) 5584c793af95Ssangeeta addr4 = ire->ire_gateway_addr; /* 'G' route */ 5585c793af95Ssangeeta else 5586c793af95Ssangeeta addr4 = ire->ire_addr; /* direct route */ 5587c793af95Ssangeeta break; 5588c793af95Ssangeeta case IRE_BROADCAST: 5589c793af95Ssangeeta addr4 = ire->ire_addr; 559054da8755Ssowmini nce_flags |= (NCE_F_PERMANENT|NCE_F_BCAST); 5591c793af95Ssangeeta break; 5592c793af95Ssangeeta default: 5593c793af95Ssangeeta return (0); 5594c793af95Ssangeeta } 5595c793af95Ssangeeta 5596c793af95Ssangeeta /* 5597c793af95Ssangeeta * ire_ipif is picked based on RTF_SETSRC, usesrc etc. 5598c793af95Ssangeeta * rules in ire_forward_src_ipif. We want the dlureq_mp 5599c793af95Ssangeeta * for the outgoing interface, which we get from the ire_stq. 5600c793af95Ssangeeta */ 5601c793af95Ssangeeta ire_ill = ire_to_ill(ire); 5602f4b3ec61Sdh155122 ipst = ire_ill->ill_ipst; 5603c793af95Ssangeeta 5604c793af95Ssangeeta /* 560554da8755Ssowmini * IRE_IF_NORESOLVER entries never need re-verification and 560654da8755Ssowmini * do not expire, so we mark them as NCE_F_PERMANENT. 5607c793af95Ssangeeta */ 560854da8755Ssowmini if (ire_ill->ill_net_type == IRE_IF_NORESOLVER) 560954da8755Ssowmini nce_flags |= NCE_F_PERMANENT; 5610c793af95Ssangeeta 5611b9c344b3Ssowmini retry_nce: 561254da8755Ssowmini err = ndp_lookup_then_add_v4(ire_ill, &addr4, nce_flags, 561354da8755Ssowmini &nce, src_nce); 5614c793af95Ssangeeta 561554da8755Ssowmini if (err == EEXIST && NCE_EXPIRED(nce, ipst)) { 5616b9c344b3Ssowmini /* 5617b9c344b3Ssowmini * We looked up an expired nce. 5618b9c344b3Ssowmini * Go back and try to create one again. 5619b9c344b3Ssowmini */ 562054da8755Ssowmini ndp_delete(nce); 562154da8755Ssowmini NCE_REFRELE(nce); 562254da8755Ssowmini nce = NULL; 5623b9c344b3Ssowmini goto retry_nce; 5624b9c344b3Ssowmini } 5625b9c344b3Ssowmini 562654da8755Ssowmini ip1dbg(("ire 0x%p addr 0x%lx type 0x%x; found nce 0x%p err %d\n", 562754da8755Ssowmini (void *)ire, (ulong_t)addr4, ire->ire_type, (void *)nce, err)); 5628c793af95Ssangeeta 5629c793af95Ssangeeta switch (err) { 5630c793af95Ssangeeta case 0: 5631c793af95Ssangeeta case EEXIST: 5632c793af95Ssangeeta /* 563354da8755Ssowmini * return a pointer to a newly created or existing nce_t; 5634c793af95Ssangeeta * note that the ire-nce mapping is many-one, i.e., 563554da8755Ssowmini * multiple ire's could point to the same nce_t. 5636c793af95Ssangeeta */ 5637c793af95Ssangeeta break; 5638c793af95Ssangeeta default: 5639c793af95Ssangeeta DTRACE_PROBE2(nce__init__fail, ill_t *, ire_ill, int, err); 5640c793af95Ssangeeta return (EINVAL); 5641c793af95Ssangeeta } 5642*9294ad19SSowmini Varadhan /* 5643*9294ad19SSowmini Varadhan * IRE_BROADCAST ire's must be linked to NCE_F_BCAST nce's and 5644*9294ad19SSowmini Varadhan * vice-versa (IRE_CACHE <-> unicast nce entries). We may have found an 5645*9294ad19SSowmini Varadhan * existing unicast (or bcast) nce when trying to add a BROADCAST (or 5646*9294ad19SSowmini Varadhan * unicast) ire, e.g., when address/netmask modifications were in 5647*9294ad19SSowmini Varadhan * progress, and the ipif_ndp_down() call to quiesce existing state 5648*9294ad19SSowmini Varadhan * during the addr/mask modification may have skipped the ndp_delete() 5649*9294ad19SSowmini Varadhan * because the ipif being affected was not the last one on the ill. We 5650*9294ad19SSowmini Varadhan * recover from the missed ndp_delete() now, by deleting the old nce and 5651*9294ad19SSowmini Varadhan * adding a new one with the correct NCE_F_BCAST state. 5652*9294ad19SSowmini Varadhan */ 5653c793af95Ssangeeta if (ire->ire_type == IRE_BROADCAST) { 5654*9294ad19SSowmini Varadhan if ((nce->nce_flags & NCE_F_BCAST) == 0) { 5655*9294ad19SSowmini Varadhan /* IRE_BROADCAST needs NCE_F_BCAST */ 5656*9294ad19SSowmini Varadhan ndp_delete(nce); 5657*9294ad19SSowmini Varadhan NCE_REFRELE(nce); 5658*9294ad19SSowmini Varadhan goto retry_nce; 5659*9294ad19SSowmini Varadhan } 5660c793af95Ssangeeta /* 5661c793af95Ssangeeta * Two bcast ires are created for each interface; 5662c793af95Ssangeeta * 1. loopback copy (which does not have an 5663c793af95Ssangeeta * ire_stq, and therefore has no ire_nce), and, 5664c793af95Ssangeeta * 2. the non-loopback copy, which has the nce_res_mp 5665c793af95Ssangeeta * initialized to a copy of the ill_bcast_mp, and 5666c793af95Ssangeeta * is marked as ND_REACHABLE at this point. 5667c793af95Ssangeeta * This nce does not undergo any further state changes, 5668c793af95Ssangeeta * and exists as long as the interface is plumbed. 5669e11c3f44Smeem * Note: the assignment of ire_nce here is a historical 5670e11c3f44Smeem * artifact of old code that used to inline ire_add(). 5671c793af95Ssangeeta */ 567254da8755Ssowmini ire->ire_nce = nce; 5673c793af95Ssangeeta /* 5674c793af95Ssangeeta * We are associating this nce to the ire, 5675c793af95Ssangeeta * so change the nce ref taken in 5676c793af95Ssangeeta * ndp_lookup_then_add_v4() from 5677c793af95Ssangeeta * NCE_REFHOLD to NCE_REFHOLD_NOTR 5678c793af95Ssangeeta */ 5679c793af95Ssangeeta NCE_REFHOLD_TO_REFHOLD_NOTR(ire->ire_nce); 5680c793af95Ssangeeta } else { 5681*9294ad19SSowmini Varadhan if ((nce->nce_flags & NCE_F_BCAST) != 0) { 5682*9294ad19SSowmini Varadhan /* IRE_CACHE needs unicast nce */ 5683*9294ad19SSowmini Varadhan ndp_delete(nce); 5684*9294ad19SSowmini Varadhan NCE_REFRELE(nce); 5685*9294ad19SSowmini Varadhan goto retry_nce; 5686*9294ad19SSowmini Varadhan } 5687c793af95Ssangeeta /* 5688c793af95Ssangeeta * We are not using this nce_t just yet so release 5689c793af95Ssangeeta * the ref taken in ndp_lookup_then_add_v4() 5690c793af95Ssangeeta */ 569154da8755Ssowmini NCE_REFRELE(nce); 5692c793af95Ssangeeta } 5693c793af95Ssangeeta return (0); 5694c793af95Ssangeeta } 56955b17e9bdSJon Anderson 56965b17e9bdSJon Anderson /* 56975b17e9bdSJon Anderson * This is the implementation of the IPv4 IRE cache lookup procedure. 56985b17e9bdSJon Anderson * Separating the interface from the implementation allows additional 56995b17e9bdSJon Anderson * flexibility when specifying search criteria. 57005b17e9bdSJon Anderson */ 57015b17e9bdSJon Anderson static ire_t * 57025b17e9bdSJon Anderson ip4_ctable_lookup_impl(ire_ctable_args_t *margs) 57035b17e9bdSJon Anderson { 57045b17e9bdSJon Anderson irb_t *irb_ptr; 57055b17e9bdSJon Anderson ire_t *ire; 57065b17e9bdSJon Anderson ip_stack_t *ipst = margs->ict_ipst; 57075b17e9bdSJon Anderson 5708e11c3f44Smeem if ((margs->ict_flags & (MATCH_IRE_SRC | MATCH_IRE_ILL)) && 57095b17e9bdSJon Anderson (margs->ict_ipif == NULL)) { 57105b17e9bdSJon Anderson return (NULL); 57115b17e9bdSJon Anderson } 57125b17e9bdSJon Anderson 57135b17e9bdSJon Anderson irb_ptr = &ipst->ips_ip_cache_table[IRE_ADDR_HASH( 57145b17e9bdSJon Anderson *((ipaddr_t *)margs->ict_addr), ipst->ips_ip_cache_table_size)]; 57155b17e9bdSJon Anderson rw_enter(&irb_ptr->irb_lock, RW_READER); 57165b17e9bdSJon Anderson for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 57175b17e9bdSJon Anderson if (ire->ire_marks & IRE_MARK_CONDEMNED) 57185b17e9bdSJon Anderson continue; 57195b17e9bdSJon Anderson ASSERT(ire->ire_mask == IP_HOST_MASK); 57205b17e9bdSJon Anderson if (ire_match_args(ire, *((ipaddr_t *)margs->ict_addr), 57215b17e9bdSJon Anderson ire->ire_mask, *((ipaddr_t *)margs->ict_gateway), 57225b17e9bdSJon Anderson margs->ict_type, margs->ict_ipif, margs->ict_zoneid, 0, 57235b17e9bdSJon Anderson margs->ict_tsl, margs->ict_flags, margs->ict_wq)) { 57245b17e9bdSJon Anderson IRE_REFHOLD(ire); 57255b17e9bdSJon Anderson rw_exit(&irb_ptr->irb_lock); 57265b17e9bdSJon Anderson return (ire); 57275b17e9bdSJon Anderson } 57285b17e9bdSJon Anderson } 57295b17e9bdSJon Anderson 57305b17e9bdSJon Anderson rw_exit(&irb_ptr->irb_lock); 57315b17e9bdSJon Anderson return (NULL); 57325b17e9bdSJon Anderson } 57335b17e9bdSJon Anderson 57345b17e9bdSJon Anderson /* 57355b17e9bdSJon Anderson * This function locates IRE_CACHE entries which were added by the 57365b17e9bdSJon Anderson * ire_forward() path. We can fully specify the IRE we are looking for by 5737e11c3f44Smeem * providing the ipif (MATCH_IRE_IPIF) *and* the stq (MATCH_IRE_WQ). 57385b17e9bdSJon Anderson */ 57395b17e9bdSJon Anderson ire_t * 57405b17e9bdSJon Anderson ire_arpresolve_lookup(ipaddr_t addr, ipaddr_t gw, ipif_t *ipif, 57415b17e9bdSJon Anderson zoneid_t zoneid, ip_stack_t *ipst, queue_t *wq) 57425b17e9bdSJon Anderson { 57435b17e9bdSJon Anderson ire_ctable_args_t margs; 57445b17e9bdSJon Anderson 57455b17e9bdSJon Anderson margs.ict_addr = &addr; 57465b17e9bdSJon Anderson margs.ict_gateway = &gw; 57475b17e9bdSJon Anderson margs.ict_type = IRE_CACHE; 57485b17e9bdSJon Anderson margs.ict_ipif = ipif; 57495b17e9bdSJon Anderson margs.ict_zoneid = zoneid; 57505b17e9bdSJon Anderson margs.ict_tsl = NULL; 57515b17e9bdSJon Anderson margs.ict_flags = MATCH_IRE_GW | MATCH_IRE_IPIF | MATCH_IRE_ZONEONLY | 57525b17e9bdSJon Anderson MATCH_IRE_TYPE | MATCH_IRE_WQ; 57535b17e9bdSJon Anderson margs.ict_ipst = ipst; 57545b17e9bdSJon Anderson margs.ict_wq = wq; 57555b17e9bdSJon Anderson 57565b17e9bdSJon Anderson return (ip4_ctable_lookup_impl(&margs)); 57575b17e9bdSJon Anderson } 5758