17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 545916cd2Sjpk * Common Development and Distribution License (the "License"). 645916cd2Sjpk * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22e11c3f44Smeem * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate /* Copyright (c) 1990 Mentat Inc. */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate /* 287c478bd9Sstevel@tonic-gate * This file contains routines that manipulate Internet Routing Entries (IREs). 297c478bd9Sstevel@tonic-gate */ 307c478bd9Sstevel@tonic-gate 317c478bd9Sstevel@tonic-gate #include <sys/types.h> 327c478bd9Sstevel@tonic-gate #include <sys/stream.h> 337c478bd9Sstevel@tonic-gate #include <sys/stropts.h> 34e11c3f44Smeem #include <sys/strsun.h> 35de8c4a14SErik Nordmark #include <sys/strsubr.h> 367c478bd9Sstevel@tonic-gate #include <sys/ddi.h> 377c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h> 387c478bd9Sstevel@tonic-gate #include <sys/policy.h> 397c478bd9Sstevel@tonic-gate 407c478bd9Sstevel@tonic-gate #include <sys/systm.h> 417c478bd9Sstevel@tonic-gate #include <sys/kmem.h> 427c478bd9Sstevel@tonic-gate #include <sys/param.h> 437c478bd9Sstevel@tonic-gate #include <sys/socket.h> 447c478bd9Sstevel@tonic-gate #include <net/if.h> 457c478bd9Sstevel@tonic-gate #include <net/route.h> 467c478bd9Sstevel@tonic-gate #include <netinet/in.h> 477c478bd9Sstevel@tonic-gate #include <net/if_dl.h> 487c478bd9Sstevel@tonic-gate #include <netinet/ip6.h> 497c478bd9Sstevel@tonic-gate #include <netinet/icmp6.h> 507c478bd9Sstevel@tonic-gate 517c478bd9Sstevel@tonic-gate #include <inet/common.h> 527c478bd9Sstevel@tonic-gate #include <inet/mi.h> 537c478bd9Sstevel@tonic-gate #include <inet/ip.h> 547c478bd9Sstevel@tonic-gate #include <inet/ip6.h> 557c478bd9Sstevel@tonic-gate #include <inet/ip_ndp.h> 56c793af95Ssangeeta #include <inet/arp.h> 577c478bd9Sstevel@tonic-gate #include <inet/ip_if.h> 587c478bd9Sstevel@tonic-gate #include <inet/ip_ire.h> 59c793af95Ssangeeta #include <inet/ip_ftable.h> 607c478bd9Sstevel@tonic-gate #include <inet/ip_rts.h> 617c478bd9Sstevel@tonic-gate #include <inet/nd.h> 627c478bd9Sstevel@tonic-gate 637c478bd9Sstevel@tonic-gate #include <inet/tcp.h> 647c478bd9Sstevel@tonic-gate #include <inet/ipclassifier.h> 657c478bd9Sstevel@tonic-gate #include <sys/zone.h> 66f4b3ec61Sdh155122 #include <sys/cpuvar.h> 67f4b3ec61Sdh155122 6845916cd2Sjpk #include <sys/tsol/label.h> 6945916cd2Sjpk #include <sys/tsol/tnet.h> 7045916cd2Sjpk 71c793af95Ssangeeta struct kmem_cache *rt_entry_cache; 72c793af95Ssangeeta 73*bd670b35SErik Nordmark typedef struct nce_clookup_s { 74*bd670b35SErik Nordmark ipaddr_t ncecl_addr; 75*bd670b35SErik Nordmark boolean_t ncecl_found; 76*bd670b35SErik Nordmark } nce_clookup_t; 77*bd670b35SErik Nordmark 787c478bd9Sstevel@tonic-gate /* 797c478bd9Sstevel@tonic-gate * Synchronization notes: 807c478bd9Sstevel@tonic-gate * 817c478bd9Sstevel@tonic-gate * The fields of the ire_t struct are protected in the following way : 827c478bd9Sstevel@tonic-gate * 837c478bd9Sstevel@tonic-gate * ire_next/ire_ptpn 847c478bd9Sstevel@tonic-gate * 85*bd670b35SErik Nordmark * - bucket lock of the forwarding table in which is ire stored. 867c478bd9Sstevel@tonic-gate * 87*bd670b35SErik Nordmark * ire_ill, ire_u *except* ire_gateway_addr[v6], ire_mask, 88*bd670b35SErik Nordmark * ire_type, ire_create_time, ire_masklen, ire_ipversion, ire_flags, 89*bd670b35SErik Nordmark * ire_bucket 907c478bd9Sstevel@tonic-gate * 917c478bd9Sstevel@tonic-gate * - Set in ire_create_v4/v6 and never changes after that. Thus, 927c478bd9Sstevel@tonic-gate * we don't need a lock whenever these fields are accessed. 937c478bd9Sstevel@tonic-gate * 947c478bd9Sstevel@tonic-gate * - ire_bucket and ire_masklen (also set in ire_create) is set in 95*bd670b35SErik Nordmark * ire_add before inserting in the bucket and never 967c478bd9Sstevel@tonic-gate * changes after that. Thus we don't need a lock whenever these 977c478bd9Sstevel@tonic-gate * fields are accessed. 987c478bd9Sstevel@tonic-gate * 997c478bd9Sstevel@tonic-gate * ire_gateway_addr_v4[v6] 1007c478bd9Sstevel@tonic-gate * 1017c478bd9Sstevel@tonic-gate * - ire_gateway_addr_v4[v6] is set during ire_create and later modified 1027c478bd9Sstevel@tonic-gate * by rts_setgwr[v6]. As ire_gateway_addr is a uint32_t, updates to 1037c478bd9Sstevel@tonic-gate * it assumed to be atomic and hence the other parts of the code 1047c478bd9Sstevel@tonic-gate * does not use any locks. ire_gateway_addr_v6 updates are not atomic 1057c478bd9Sstevel@tonic-gate * and hence any access to it uses ire_lock to get/set the right value. 1067c478bd9Sstevel@tonic-gate * 107*bd670b35SErik Nordmark * ire_refcnt, ire_identical_ref 1087c478bd9Sstevel@tonic-gate * 1097c478bd9Sstevel@tonic-gate * - Updated atomically using atomic_add_32 1107c478bd9Sstevel@tonic-gate * 1117c478bd9Sstevel@tonic-gate * ire_ssthresh, ire_rtt_sd, ire_rtt, ire_ib_pkt_count, ire_ob_pkt_count 1127c478bd9Sstevel@tonic-gate * 1137c478bd9Sstevel@tonic-gate * - Assumes that 32 bit writes are atomic. No locks. ire_lock is 1147c478bd9Sstevel@tonic-gate * used to serialize updates to ire_ssthresh, ire_rtt_sd, ire_rtt. 1157c478bd9Sstevel@tonic-gate * 116*bd670b35SErik Nordmark * ire_generation 117*bd670b35SErik Nordmark * - Under ire_lock 1187c478bd9Sstevel@tonic-gate * 119*bd670b35SErik Nordmark * ire_nce_cache 120*bd670b35SErik Nordmark * - Under ire_lock 1217c478bd9Sstevel@tonic-gate * 122*bd670b35SErik Nordmark * ire_dep_parent (To next IRE in recursive lookup chain) 123*bd670b35SErik Nordmark * - Under ips_ire_dep_lock. Write held when modifying. Read held when 124*bd670b35SErik Nordmark * walking. We also hold ire_lock when modifying to allow the data path 125*bd670b35SErik Nordmark * to only acquire ire_lock. 1267c478bd9Sstevel@tonic-gate * 127*bd670b35SErik Nordmark * ire_dep_parent_generation (Generation number from ire_dep_parent) 128*bd670b35SErik Nordmark * - Under ips_ire_dep_lock and/or ire_lock. (A read claim on the dep_lock 129*bd670b35SErik Nordmark * and ire_lock held when modifying) 1307c478bd9Sstevel@tonic-gate * 131*bd670b35SErik Nordmark * ire_dep_children (From parent to first child) 132*bd670b35SErik Nordmark * ire_dep_sib_next (linked list of siblings) 133*bd670b35SErik Nordmark * ire_dep_sib_ptpn (linked list of siblings) 134*bd670b35SErik Nordmark * - Under ips_ire_dep_lock. Write held when modifying. Read held when 135*bd670b35SErik Nordmark * walking. 1367c478bd9Sstevel@tonic-gate * 1377c478bd9Sstevel@tonic-gate * As we always hold the bucket locks in all the places while accessing 1387c478bd9Sstevel@tonic-gate * the above values, it is natural to use them for protecting them. 1397c478bd9Sstevel@tonic-gate * 140*bd670b35SErik Nordmark * We have a forwarding table for IPv4 and IPv6. The IPv6 forwarding table 141219e6466Ssowmini * (ip_forwarding_table_v6) is an array of pointers to arrays of irb_t 142*bd670b35SErik Nordmark * structures. ip_forwarding_table_v6 is allocated dynamically in 143f4b3ec61Sdh155122 * ire_add_v6. ire_ft_init_lock is used to serialize multiple threads 1447c478bd9Sstevel@tonic-gate * initializing the same bucket. Once a bucket is initialized, it is never 145f4b3ec61Sdh155122 * de-alloacted. This assumption enables us to access 146f4b3ec61Sdh155122 * ip_forwarding_table_v6[i] without any locks. 1477c478bd9Sstevel@tonic-gate * 148219e6466Ssowmini * The forwarding table for IPv4 is a radix tree whose leaves 149219e6466Ssowmini * are rt_entry structures containing the irb_t for the rt_dst. The irb_t 150219e6466Ssowmini * for IPv4 is dynamically allocated and freed. 151219e6466Ssowmini * 1527c478bd9Sstevel@tonic-gate * Each irb_t - ire bucket structure has a lock to protect 1537c478bd9Sstevel@tonic-gate * a bucket and the ires residing in the bucket have a back pointer to 1547c478bd9Sstevel@tonic-gate * the bucket structure. It also has a reference count for the number 1557c478bd9Sstevel@tonic-gate * of threads walking the bucket - irb_refcnt which is bumped up 156*bd670b35SErik Nordmark * using the irb_refhold function. The flags irb_marks can be 157*bd670b35SErik Nordmark * set to IRB_MARK_CONDEMNED indicating that there are some ires 158*bd670b35SErik Nordmark * in this bucket that are IRE_IS_CONDEMNED and the 1597c478bd9Sstevel@tonic-gate * last thread to leave the bucket should delete the ires. Usually 160*bd670b35SErik Nordmark * this is done by the irb_refrele function which is used to decrement 161219e6466Ssowmini * the reference count on a bucket. See comments above irb_t structure 162219e6466Ssowmini * definition in ip.h for further details. 1637c478bd9Sstevel@tonic-gate * 164*bd670b35SErik Nordmark * The ire_refhold/ire_refrele functions operate on the ire which increments/ 1657c478bd9Sstevel@tonic-gate * decrements the reference count, ire_refcnt, atomically on the ire. 166*bd670b35SErik Nordmark * ire_refcnt is modified only using those functions. Operations on the IRE 1677c478bd9Sstevel@tonic-gate * could be described as follows : 1687c478bd9Sstevel@tonic-gate * 1697c478bd9Sstevel@tonic-gate * CREATE an ire with reference count initialized to 1. 1707c478bd9Sstevel@tonic-gate * 1717c478bd9Sstevel@tonic-gate * ADDITION of an ire holds the bucket lock, checks for duplicates 172*bd670b35SErik Nordmark * and then adds the ire. ire_add returns the ire after 1737c478bd9Sstevel@tonic-gate * bumping up once more i.e the reference count is 2. This is to avoid 1747c478bd9Sstevel@tonic-gate * an extra lookup in the functions calling ire_add which wants to 1757c478bd9Sstevel@tonic-gate * work with the ire after adding. 1767c478bd9Sstevel@tonic-gate * 177*bd670b35SErik Nordmark * LOOKUP of an ire bumps up the reference count using ire_refhold 178*bd670b35SErik Nordmark * function. It is valid to bump up the referece count of the IRE, 1797c478bd9Sstevel@tonic-gate * after the lookup has returned an ire. Following are the lookup 1807c478bd9Sstevel@tonic-gate * functions that return an HELD ire : 1817c478bd9Sstevel@tonic-gate * 182*bd670b35SErik Nordmark * ire_ftable_lookup[_v6], ire_lookup_multi_ill[_v6] 1837c478bd9Sstevel@tonic-gate * 1847c478bd9Sstevel@tonic-gate * DELETION of an ire holds the bucket lock, removes it from the list 1857c478bd9Sstevel@tonic-gate * and then decrements the reference count for having removed from the list 186*bd670b35SErik Nordmark * by using the ire_refrele function. If some other thread has looked up 1877c478bd9Sstevel@tonic-gate * the ire, the reference count would have been bumped up and hence 1887c478bd9Sstevel@tonic-gate * this ire will not be freed once deleted. It will be freed once the 1897c478bd9Sstevel@tonic-gate * reference count drops to zero. 1907c478bd9Sstevel@tonic-gate * 1917c478bd9Sstevel@tonic-gate * Add and Delete acquires the bucket lock as RW_WRITER, while all the 1927c478bd9Sstevel@tonic-gate * lookups acquire the bucket lock as RW_READER. 1937c478bd9Sstevel@tonic-gate * 194*bd670b35SErik Nordmark * The general rule is to do the ire_refrele in the function 1957c478bd9Sstevel@tonic-gate * that is passing the ire as an argument. 1967c478bd9Sstevel@tonic-gate * 1977c478bd9Sstevel@tonic-gate * In trying to locate ires the following points are to be noted. 1987c478bd9Sstevel@tonic-gate * 199*bd670b35SErik Nordmark * IRE_IS_CONDEMNED signifies that the ire has been logically deleted and is 2007c478bd9Sstevel@tonic-gate * to be ignored when walking the ires using ire_next. 2017c478bd9Sstevel@tonic-gate * 2027c478bd9Sstevel@tonic-gate * Zones note: 2037c478bd9Sstevel@tonic-gate * Walking IREs within a given zone also walks certain ires in other 2047c478bd9Sstevel@tonic-gate * zones. This is done intentionally. IRE walks with a specified 2057c478bd9Sstevel@tonic-gate * zoneid are used only when doing informational reports, and 2067c478bd9Sstevel@tonic-gate * zone users want to see things that they can access. See block 2077c478bd9Sstevel@tonic-gate * comment in ire_walk_ill_match(). 2087c478bd9Sstevel@tonic-gate */ 2097c478bd9Sstevel@tonic-gate 2107c478bd9Sstevel@tonic-gate /* 2117c478bd9Sstevel@tonic-gate * The size of the forwarding table. We will make sure that it is a 2127c478bd9Sstevel@tonic-gate * power of 2 in ip_ire_init(). 213f4b3ec61Sdh155122 * Setable in /etc/system 2147c478bd9Sstevel@tonic-gate */ 2157c478bd9Sstevel@tonic-gate uint32_t ip6_ftable_hash_size = IP6_FTABLE_HASH_SIZE; 2167c478bd9Sstevel@tonic-gate 2177c478bd9Sstevel@tonic-gate struct kmem_cache *ire_cache; 218*bd670b35SErik Nordmark struct kmem_cache *ncec_cache; 219*bd670b35SErik Nordmark struct kmem_cache *nce_cache; 220*bd670b35SErik Nordmark 2217c478bd9Sstevel@tonic-gate static ire_t ire_null; 2227c478bd9Sstevel@tonic-gate 223*bd670b35SErik Nordmark static ire_t *ire_add_v4(ire_t *ire); 2247c478bd9Sstevel@tonic-gate static void ire_delete_v4(ire_t *ire); 225*bd670b35SErik Nordmark static void ire_dep_invalidate_children(ire_t *child); 22645916cd2Sjpk static void ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, 227f4b3ec61Sdh155122 zoneid_t zoneid, ip_stack_t *); 2287c478bd9Sstevel@tonic-gate static void ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, 22945916cd2Sjpk pfv_t func, void *arg, uchar_t vers, ill_t *ill); 2306a8288c7Scarlsonj #ifdef DEBUG 2316a8288c7Scarlsonj static void ire_trace_cleanup(const ire_t *); 2327c478bd9Sstevel@tonic-gate #endif 2337c478bd9Sstevel@tonic-gate 2347c478bd9Sstevel@tonic-gate /* 235*bd670b35SErik Nordmark * Following are the functions to increment/decrement the reference 236*bd670b35SErik Nordmark * count of the IREs and IRBs (ire bucket). 237*bd670b35SErik Nordmark * 238*bd670b35SErik Nordmark * 1) We bump up the reference count of an IRE to make sure that 239*bd670b35SErik Nordmark * it does not get deleted and freed while we are using it. 240*bd670b35SErik Nordmark * Typically all the lookup functions hold the bucket lock, 241*bd670b35SErik Nordmark * and look for the IRE. If it finds an IRE, it bumps up the 242*bd670b35SErik Nordmark * reference count before dropping the lock. Sometimes we *may* want 243*bd670b35SErik Nordmark * to bump up the reference count after we *looked* up i.e without 244*bd670b35SErik Nordmark * holding the bucket lock. So, the ire_refhold function does not assert 245*bd670b35SErik Nordmark * on the bucket lock being held. Any thread trying to delete from 246*bd670b35SErik Nordmark * the hash bucket can still do so but cannot free the IRE if 247*bd670b35SErik Nordmark * ire_refcnt is not 0. 248*bd670b35SErik Nordmark * 249*bd670b35SErik Nordmark * 2) We bump up the reference count on the bucket where the IRE resides 250*bd670b35SErik Nordmark * (IRB), when we want to prevent the IREs getting deleted from a given 251*bd670b35SErik Nordmark * hash bucket. This makes life easier for ire_walk type functions which 252*bd670b35SErik Nordmark * wants to walk the IRE list, call a function, but needs to drop 253*bd670b35SErik Nordmark * the bucket lock to prevent recursive rw_enters. While the 254*bd670b35SErik Nordmark * lock is dropped, the list could be changed by other threads or 255*bd670b35SErik Nordmark * the same thread could end up deleting the ire or the ire pointed by 256*bd670b35SErik Nordmark * ire_next. ire_refholding the ire or ire_next is not sufficient as 257*bd670b35SErik Nordmark * a delete will still remove the ire from the bucket while we have 258*bd670b35SErik Nordmark * dropped the lock and hence the ire_next would be NULL. Thus, we 259*bd670b35SErik Nordmark * need a mechanism to prevent deletions from a given bucket. 260*bd670b35SErik Nordmark * 261*bd670b35SErik Nordmark * To prevent deletions, we bump up the reference count on the 262*bd670b35SErik Nordmark * bucket. If the bucket is held, ire_delete just marks both 263*bd670b35SErik Nordmark * the ire and irb as CONDEMNED. When the 264*bd670b35SErik Nordmark * reference count on the bucket drops to zero, all the CONDEMNED ires 265*bd670b35SErik Nordmark * are deleted. We don't have to bump up the reference count on the 266*bd670b35SErik Nordmark * bucket if we are walking the bucket and never have to drop the bucket 267*bd670b35SErik Nordmark * lock. Note that irb_refhold does not prevent addition of new ires 268*bd670b35SErik Nordmark * in the list. It is okay because addition of new ires will not cause 269*bd670b35SErik Nordmark * ire_next to point to freed memory. We do irb_refhold only when 270*bd670b35SErik Nordmark * all of the 3 conditions are true : 271*bd670b35SErik Nordmark * 272*bd670b35SErik Nordmark * 1) The code needs to walk the IRE bucket from start to end. 273*bd670b35SErik Nordmark * 2) It may have to drop the bucket lock sometimes while doing (1) 274*bd670b35SErik Nordmark * 3) It does not want any ires to be deleted meanwhile. 275*bd670b35SErik Nordmark */ 276*bd670b35SErik Nordmark 277*bd670b35SErik Nordmark /* 278*bd670b35SErik Nordmark * Bump up the reference count on the hash bucket - IRB to 279*bd670b35SErik Nordmark * prevent ires from being deleted in this bucket. 280*bd670b35SErik Nordmark */ 281*bd670b35SErik Nordmark void 282*bd670b35SErik Nordmark irb_refhold(irb_t *irb) 283*bd670b35SErik Nordmark { 284*bd670b35SErik Nordmark rw_enter(&irb->irb_lock, RW_WRITER); 285*bd670b35SErik Nordmark irb->irb_refcnt++; 286*bd670b35SErik Nordmark ASSERT(irb->irb_refcnt != 0); 287*bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 288*bd670b35SErik Nordmark } 289*bd670b35SErik Nordmark 290*bd670b35SErik Nordmark void 291*bd670b35SErik Nordmark irb_refhold_locked(irb_t *irb) 292*bd670b35SErik Nordmark { 293*bd670b35SErik Nordmark ASSERT(RW_WRITE_HELD(&irb->irb_lock)); 294*bd670b35SErik Nordmark irb->irb_refcnt++; 295*bd670b35SErik Nordmark ASSERT(irb->irb_refcnt != 0); 296*bd670b35SErik Nordmark } 297*bd670b35SErik Nordmark 298*bd670b35SErik Nordmark /* 299*bd670b35SErik Nordmark * Note: when IRB_MARK_DYNAMIC is not set the irb_t 300*bd670b35SErik Nordmark * is statically allocated, so that when the irb_refcnt goes to 0, 301*bd670b35SErik Nordmark * we simply clean up the ire list and continue. 302*bd670b35SErik Nordmark */ 303*bd670b35SErik Nordmark void 304*bd670b35SErik Nordmark irb_refrele(irb_t *irb) 305*bd670b35SErik Nordmark { 306*bd670b35SErik Nordmark if (irb->irb_marks & IRB_MARK_DYNAMIC) { 307*bd670b35SErik Nordmark irb_refrele_ftable(irb); 308*bd670b35SErik Nordmark } else { 309*bd670b35SErik Nordmark rw_enter(&irb->irb_lock, RW_WRITER); 310*bd670b35SErik Nordmark ASSERT(irb->irb_refcnt != 0); 311*bd670b35SErik Nordmark if (--irb->irb_refcnt == 0 && 312*bd670b35SErik Nordmark (irb->irb_marks & IRB_MARK_CONDEMNED)) { 313*bd670b35SErik Nordmark ire_t *ire_list; 314*bd670b35SErik Nordmark 315*bd670b35SErik Nordmark ire_list = ire_unlink(irb); 316*bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 317*bd670b35SErik Nordmark ASSERT(ire_list != NULL); 318*bd670b35SErik Nordmark ire_cleanup(ire_list); 319*bd670b35SErik Nordmark } else { 320*bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 321*bd670b35SErik Nordmark } 322*bd670b35SErik Nordmark } 323*bd670b35SErik Nordmark } 324*bd670b35SErik Nordmark 325*bd670b35SErik Nordmark 326*bd670b35SErik Nordmark /* 327*bd670b35SErik Nordmark * Bump up the reference count on the IRE. We cannot assert that the 328*bd670b35SErik Nordmark * bucket lock is being held as it is legal to bump up the reference 329*bd670b35SErik Nordmark * count after the first lookup has returned the IRE without 330*bd670b35SErik Nordmark * holding the lock. 331*bd670b35SErik Nordmark */ 332*bd670b35SErik Nordmark void 333*bd670b35SErik Nordmark ire_refhold(ire_t *ire) 334*bd670b35SErik Nordmark { 335*bd670b35SErik Nordmark atomic_add_32(&(ire)->ire_refcnt, 1); 336*bd670b35SErik Nordmark ASSERT((ire)->ire_refcnt != 0); 337*bd670b35SErik Nordmark #ifdef DEBUG 338*bd670b35SErik Nordmark ire_trace_ref(ire); 339*bd670b35SErik Nordmark #endif 340*bd670b35SErik Nordmark } 341*bd670b35SErik Nordmark 342*bd670b35SErik Nordmark void 343*bd670b35SErik Nordmark ire_refhold_notr(ire_t *ire) 344*bd670b35SErik Nordmark { 345*bd670b35SErik Nordmark atomic_add_32(&(ire)->ire_refcnt, 1); 346*bd670b35SErik Nordmark ASSERT((ire)->ire_refcnt != 0); 347*bd670b35SErik Nordmark } 348*bd670b35SErik Nordmark 349*bd670b35SErik Nordmark void 350*bd670b35SErik Nordmark ire_refhold_locked(ire_t *ire) 351*bd670b35SErik Nordmark { 352*bd670b35SErik Nordmark #ifdef DEBUG 353*bd670b35SErik Nordmark ire_trace_ref(ire); 354*bd670b35SErik Nordmark #endif 355*bd670b35SErik Nordmark ire->ire_refcnt++; 356*bd670b35SErik Nordmark } 357*bd670b35SErik Nordmark 358*bd670b35SErik Nordmark /* 359*bd670b35SErik Nordmark * Release a ref on an IRE. 3607c478bd9Sstevel@tonic-gate * 3617c478bd9Sstevel@tonic-gate * Must not be called while holding any locks. Otherwise if this is 3627c478bd9Sstevel@tonic-gate * the last reference to be released there is a chance of recursive mutex 3637c478bd9Sstevel@tonic-gate * panic due to ire_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying 3647c478bd9Sstevel@tonic-gate * to restart an ioctl. The one exception is when the caller is sure that 3657c478bd9Sstevel@tonic-gate * this is not the last reference to be released. Eg. if the caller is 3667c478bd9Sstevel@tonic-gate * sure that the ire has not been deleted and won't be deleted. 367*bd670b35SErik Nordmark * 368*bd670b35SErik Nordmark * In architectures e.g sun4u, where atomic_add_32_nv is just 369*bd670b35SErik Nordmark * a cas, we need to maintain the right memory barrier semantics 370*bd670b35SErik Nordmark * as that of mutex_exit i.e all the loads and stores should complete 371*bd670b35SErik Nordmark * before the cas is executed. membar_exit() does that here. 3727c478bd9Sstevel@tonic-gate */ 3737c478bd9Sstevel@tonic-gate void 3747c478bd9Sstevel@tonic-gate ire_refrele(ire_t *ire) 3757c478bd9Sstevel@tonic-gate { 376*bd670b35SErik Nordmark #ifdef DEBUG 377*bd670b35SErik Nordmark ire_untrace_ref(ire); 378*bd670b35SErik Nordmark #endif 379*bd670b35SErik Nordmark ASSERT((ire)->ire_refcnt != 0); 380*bd670b35SErik Nordmark membar_exit(); 381*bd670b35SErik Nordmark if (atomic_add_32_nv(&(ire)->ire_refcnt, -1) == 0) 382*bd670b35SErik Nordmark ire_inactive(ire); 3837c478bd9Sstevel@tonic-gate } 3847c478bd9Sstevel@tonic-gate 3857c478bd9Sstevel@tonic-gate void 3867c478bd9Sstevel@tonic-gate ire_refrele_notr(ire_t *ire) 3877c478bd9Sstevel@tonic-gate { 388*bd670b35SErik Nordmark ASSERT((ire)->ire_refcnt != 0); 389*bd670b35SErik Nordmark membar_exit(); 390*bd670b35SErik Nordmark if (atomic_add_32_nv(&(ire)->ire_refcnt, -1) == 0) 391*bd670b35SErik Nordmark ire_inactive(ire); 3927c478bd9Sstevel@tonic-gate } 3937c478bd9Sstevel@tonic-gate 3947c478bd9Sstevel@tonic-gate /* 3957c478bd9Sstevel@tonic-gate * This function is associated with the IP_IOC_IRE_DELETE[_NO_REPLY] 396*bd670b35SErik Nordmark * IOCTL[s]. The NO_REPLY form is used by TCP to tell IP that it is 397*bd670b35SErik Nordmark * having problems reaching a particular destination. 398*bd670b35SErik Nordmark * This will make IP consider alternate routes (e.g., when there are 399*bd670b35SErik Nordmark * muliple default routes), and it will also make IP discard any (potentially) 400*bd670b35SErik Nordmark * stale redirect. 401*bd670b35SErik Nordmark * Management processes may want to use the version that generates a reply. 4027c478bd9Sstevel@tonic-gate * 403*bd670b35SErik Nordmark * With the use of NUD like behavior for IPv4/ARP in addition to IPv6 404*bd670b35SErik Nordmark * this function shouldn't be necessary for IP to recover from a bad redirect, 405*bd670b35SErik Nordmark * a bad default router (when there are multiple default routers), or 406*bd670b35SErik Nordmark * a stale ND/ARP entry. But we retain it in any case. 407*bd670b35SErik Nordmark * For instance, this is helpful when TCP suspects a failure before NUD does. 4087c478bd9Sstevel@tonic-gate */ 4097c478bd9Sstevel@tonic-gate int 4107c478bd9Sstevel@tonic-gate ip_ire_delete(queue_t *q, mblk_t *mp, cred_t *ioc_cr) 4117c478bd9Sstevel@tonic-gate { 4127c478bd9Sstevel@tonic-gate uchar_t *addr_ucp; 413*bd670b35SErik Nordmark uint_t ipversion; 414*bd670b35SErik Nordmark sin_t *sin; 415*bd670b35SErik Nordmark sin6_t *sin6; 416*bd670b35SErik Nordmark ipaddr_t v4addr; 417*bd670b35SErik Nordmark in6_addr_t v6addr; 4187c478bd9Sstevel@tonic-gate ire_t *ire; 4197c478bd9Sstevel@tonic-gate ipid_t *ipid; 4207c478bd9Sstevel@tonic-gate zoneid_t zoneid; 421f4b3ec61Sdh155122 ip_stack_t *ipst; 4227c478bd9Sstevel@tonic-gate 4237c478bd9Sstevel@tonic-gate ASSERT(q->q_next == NULL); 424*bd670b35SErik Nordmark zoneid = IPCL_ZONEID(Q_TO_CONN(q)); 425f4b3ec61Sdh155122 ipst = CONNQ_TO_IPST(q); 4267c478bd9Sstevel@tonic-gate 4277c478bd9Sstevel@tonic-gate /* 4287c478bd9Sstevel@tonic-gate * Check privilege using the ioctl credential; if it is NULL 4297c478bd9Sstevel@tonic-gate * then this is a kernel message and therefor privileged. 4307c478bd9Sstevel@tonic-gate */ 431f4b3ec61Sdh155122 if (ioc_cr != NULL && secpolicy_ip_config(ioc_cr, B_FALSE) != 0) 4327c478bd9Sstevel@tonic-gate return (EPERM); 4337c478bd9Sstevel@tonic-gate 4347c478bd9Sstevel@tonic-gate ipid = (ipid_t *)mp->b_rptr; 4357c478bd9Sstevel@tonic-gate 4367c478bd9Sstevel@tonic-gate addr_ucp = mi_offset_param(mp, ipid->ipid_addr_offset, 4377c478bd9Sstevel@tonic-gate ipid->ipid_addr_length); 4387c478bd9Sstevel@tonic-gate if (addr_ucp == NULL || !OK_32PTR(addr_ucp)) 4397c478bd9Sstevel@tonic-gate return (EINVAL); 4407c478bd9Sstevel@tonic-gate switch (ipid->ipid_addr_length) { 441*bd670b35SErik Nordmark case sizeof (sin_t): 4427c478bd9Sstevel@tonic-gate /* 4437c478bd9Sstevel@tonic-gate * got complete (sockaddr) address - increment addr_ucp to point 4447c478bd9Sstevel@tonic-gate * at the ip_addr field. 4457c478bd9Sstevel@tonic-gate */ 4467c478bd9Sstevel@tonic-gate sin = (sin_t *)addr_ucp; 4477c478bd9Sstevel@tonic-gate addr_ucp = (uchar_t *)&sin->sin_addr.s_addr; 448*bd670b35SErik Nordmark ipversion = IPV4_VERSION; 4497c478bd9Sstevel@tonic-gate break; 450*bd670b35SErik Nordmark case sizeof (sin6_t): 451*bd670b35SErik Nordmark /* 452*bd670b35SErik Nordmark * got complete (sockaddr) address - increment addr_ucp to point 453*bd670b35SErik Nordmark * at the ip_addr field. 454*bd670b35SErik Nordmark */ 455*bd670b35SErik Nordmark sin6 = (sin6_t *)addr_ucp; 456*bd670b35SErik Nordmark addr_ucp = (uchar_t *)&sin6->sin6_addr; 457*bd670b35SErik Nordmark ipversion = IPV6_VERSION; 458*bd670b35SErik Nordmark break; 4597c478bd9Sstevel@tonic-gate default: 4607c478bd9Sstevel@tonic-gate return (EINVAL); 4617c478bd9Sstevel@tonic-gate } 462*bd670b35SErik Nordmark if (ipversion == IPV4_VERSION) { 4637c478bd9Sstevel@tonic-gate /* Extract the destination address. */ 464*bd670b35SErik Nordmark bcopy(addr_ucp, &v4addr, IP_ADDR_LEN); 4657c478bd9Sstevel@tonic-gate 466*bd670b35SErik Nordmark ire = ire_ftable_lookup_v4(v4addr, 0, 0, 0, NULL, 467*bd670b35SErik Nordmark zoneid, NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL); 468*bd670b35SErik Nordmark } else { 469*bd670b35SErik Nordmark /* Extract the destination address. */ 470*bd670b35SErik Nordmark bcopy(addr_ucp, &v6addr, IPV6_ADDR_LEN); 4717c478bd9Sstevel@tonic-gate 472*bd670b35SErik Nordmark ire = ire_ftable_lookup_v6(&v6addr, NULL, NULL, 0, NULL, 473*bd670b35SErik Nordmark zoneid, NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL); 4747c478bd9Sstevel@tonic-gate } 4756bdb8e66Sdd193516 if (ire != NULL) { 476*bd670b35SErik Nordmark if (ipversion == IPV4_VERSION) { 4777c478bd9Sstevel@tonic-gate ip_rts_change(RTM_LOSING, ire->ire_addr, 4787c478bd9Sstevel@tonic-gate ire->ire_gateway_addr, ire->ire_mask, 479*bd670b35SErik Nordmark (Q_TO_CONN(q))->conn_laddr_v4, 0, 0, 0, 480*bd670b35SErik Nordmark (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA), 481*bd670b35SErik Nordmark ire->ire_ipst); 4827c478bd9Sstevel@tonic-gate } 483*bd670b35SErik Nordmark (void) ire_no_good(ire); 4847c478bd9Sstevel@tonic-gate ire_refrele(ire); 4857c478bd9Sstevel@tonic-gate } 4867c478bd9Sstevel@tonic-gate return (0); 4877c478bd9Sstevel@tonic-gate } 4887c478bd9Sstevel@tonic-gate 4897c478bd9Sstevel@tonic-gate /* 4907c478bd9Sstevel@tonic-gate * Initialize the ire that is specific to IPv4 part and call 4917c478bd9Sstevel@tonic-gate * ire_init_common to finish it. 492*bd670b35SErik Nordmark * Returns zero or errno. 4937c478bd9Sstevel@tonic-gate */ 494*bd670b35SErik Nordmark int 495*bd670b35SErik Nordmark ire_init_v4(ire_t *ire, uchar_t *addr, uchar_t *mask, uchar_t *gateway, 496*bd670b35SErik Nordmark ushort_t type, ill_t *ill, zoneid_t zoneid, uint_t flags, 497*bd670b35SErik Nordmark tsol_gc_t *gc, ip_stack_t *ipst) 4987c478bd9Sstevel@tonic-gate { 499*bd670b35SErik Nordmark int error; 500*bd670b35SErik Nordmark 50145916cd2Sjpk /* 50245916cd2Sjpk * Reject IRE security attribute creation/initialization 50345916cd2Sjpk * if system is not running in Trusted mode. 50445916cd2Sjpk */ 505*bd670b35SErik Nordmark if (gc != NULL && !is_system_labeled()) 506*bd670b35SErik Nordmark return (EINVAL); 50745916cd2Sjpk 508f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_alloced); 5097c478bd9Sstevel@tonic-gate 5107c478bd9Sstevel@tonic-gate if (addr != NULL) 5117c478bd9Sstevel@tonic-gate bcopy(addr, &ire->ire_addr, IP_ADDR_LEN); 512*bd670b35SErik Nordmark if (gateway != NULL) 513*bd670b35SErik Nordmark bcopy(gateway, &ire->ire_gateway_addr, IP_ADDR_LEN); 514*bd670b35SErik Nordmark 515*bd670b35SErik Nordmark /* Make sure we don't have stray values in some fields */ 516*bd670b35SErik Nordmark switch (type) { 517*bd670b35SErik Nordmark case IRE_LOOPBACK: 518*bd670b35SErik Nordmark bcopy(&ire->ire_addr, &ire->ire_gateway_addr, IP_ADDR_LEN); 519*bd670b35SErik Nordmark /* FALLTHRU */ 520*bd670b35SErik Nordmark case IRE_HOST: 521*bd670b35SErik Nordmark case IRE_BROADCAST: 522*bd670b35SErik Nordmark case IRE_LOCAL: 523*bd670b35SErik Nordmark case IRE_IF_CLONE: 524*bd670b35SErik Nordmark ire->ire_mask = IP_HOST_MASK; 525*bd670b35SErik Nordmark ire->ire_masklen = IPV4_ABITS; 526*bd670b35SErik Nordmark break; 527*bd670b35SErik Nordmark case IRE_PREFIX: 528*bd670b35SErik Nordmark case IRE_DEFAULT: 529*bd670b35SErik Nordmark case IRE_IF_RESOLVER: 530*bd670b35SErik Nordmark case IRE_IF_NORESOLVER: 5317c478bd9Sstevel@tonic-gate if (mask != NULL) { 5327c478bd9Sstevel@tonic-gate bcopy(mask, &ire->ire_mask, IP_ADDR_LEN); 5337c478bd9Sstevel@tonic-gate ire->ire_masklen = ip_mask_to_plen(ire->ire_mask); 5347c478bd9Sstevel@tonic-gate } 535*bd670b35SErik Nordmark break; 536*bd670b35SErik Nordmark case IRE_MULTICAST: 537*bd670b35SErik Nordmark case IRE_NOROUTE: 538*bd670b35SErik Nordmark ASSERT(mask == NULL); 539*bd670b35SErik Nordmark break; 540*bd670b35SErik Nordmark default: 541*bd670b35SErik Nordmark ASSERT(0); 542*bd670b35SErik Nordmark return (EINVAL); 5437c478bd9Sstevel@tonic-gate } 5447c478bd9Sstevel@tonic-gate 545*bd670b35SErik Nordmark error = ire_init_common(ire, type, ill, zoneid, flags, IPV4_VERSION, 546*bd670b35SErik Nordmark gc, ipst); 547*bd670b35SErik Nordmark if (error != NULL) 548*bd670b35SErik Nordmark return (error); 5497c478bd9Sstevel@tonic-gate 550*bd670b35SErik Nordmark /* Determine which function pointers to use */ 551*bd670b35SErik Nordmark ire->ire_postfragfn = ip_xmit; /* Common case */ 5527c478bd9Sstevel@tonic-gate 553*bd670b35SErik Nordmark switch (ire->ire_type) { 554*bd670b35SErik Nordmark case IRE_LOCAL: 555*bd670b35SErik Nordmark ire->ire_sendfn = ire_send_local_v4; 556*bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_local_v4; 557*bd670b35SErik Nordmark #ifdef SO_VRRP 558*bd670b35SErik Nordmark ASSERT(ire->ire_ill != NULL); 559*bd670b35SErik Nordmark if (ire->ire_ill->ill_flags & ILLF_NOACCEPT) { 560*bd670b35SErik Nordmark ire->ire_noaccept = B_TRUE; 561*bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_noaccept_v6; 562*bd670b35SErik Nordmark } 563*bd670b35SErik Nordmark #endif 564*bd670b35SErik Nordmark break; 565*bd670b35SErik Nordmark case IRE_LOOPBACK: 566*bd670b35SErik Nordmark ire->ire_sendfn = ire_send_local_v4; 567*bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_loopback_v4; 568*bd670b35SErik Nordmark break; 569*bd670b35SErik Nordmark case IRE_BROADCAST: 570*bd670b35SErik Nordmark ire->ire_postfragfn = ip_postfrag_loopcheck; 571*bd670b35SErik Nordmark ire->ire_sendfn = ire_send_broadcast_v4; 572*bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_broadcast_v4; 573*bd670b35SErik Nordmark break; 574*bd670b35SErik Nordmark case IRE_MULTICAST: 575*bd670b35SErik Nordmark ire->ire_postfragfn = ip_postfrag_loopcheck; 576*bd670b35SErik Nordmark ire->ire_sendfn = ire_send_multicast_v4; 577*bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_multicast_v4; 578*bd670b35SErik Nordmark break; 579*bd670b35SErik Nordmark default: 580*bd670b35SErik Nordmark /* 581*bd670b35SErik Nordmark * For IRE_IF_ALL and IRE_OFFLINK we forward received 582*bd670b35SErik Nordmark * packets by default. 583*bd670b35SErik Nordmark */ 584*bd670b35SErik Nordmark ire->ire_sendfn = ire_send_wire_v4; 585*bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_forward_v4; 586*bd670b35SErik Nordmark break; 587*bd670b35SErik Nordmark } 588*bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 589*bd670b35SErik Nordmark ire->ire_sendfn = ire_send_noroute_v4; 590*bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_noroute_v4; 591*bd670b35SErik Nordmark } else if (ire->ire_flags & RTF_MULTIRT) { 592*bd670b35SErik Nordmark ire->ire_postfragfn = ip_postfrag_multirt_v4; 593*bd670b35SErik Nordmark ire->ire_sendfn = ire_send_multirt_v4; 594*bd670b35SErik Nordmark /* Multirt receive of broadcast uses ire_recv_broadcast_v4 */ 595*bd670b35SErik Nordmark if (ire->ire_type != IRE_BROADCAST) 596*bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_multirt_v4; 597*bd670b35SErik Nordmark } 598*bd670b35SErik Nordmark ire->ire_nce_capable = ire_determine_nce_capable(ire); 599*bd670b35SErik Nordmark return (0); 6007c478bd9Sstevel@tonic-gate } 6017c478bd9Sstevel@tonic-gate 6027c478bd9Sstevel@tonic-gate /* 603*bd670b35SErik Nordmark * Determine ire_nce_capable 6047c478bd9Sstevel@tonic-gate */ 605*bd670b35SErik Nordmark boolean_t 606*bd670b35SErik Nordmark ire_determine_nce_capable(ire_t *ire) 6077c478bd9Sstevel@tonic-gate { 608*bd670b35SErik Nordmark int max_masklen; 6097c478bd9Sstevel@tonic-gate 610*bd670b35SErik Nordmark if ((ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) || 611*bd670b35SErik Nordmark (ire->ire_type & IRE_MULTICAST)) 612*bd670b35SErik Nordmark return (B_TRUE); 6137c478bd9Sstevel@tonic-gate 614*bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) 615*bd670b35SErik Nordmark max_masklen = IPV4_ABITS; 616*bd670b35SErik Nordmark else 617*bd670b35SErik Nordmark max_masklen = IPV6_ABITS; 6187c478bd9Sstevel@tonic-gate 619*bd670b35SErik Nordmark if ((ire->ire_type & IRE_ONLINK) && ire->ire_masklen == max_masklen) 620*bd670b35SErik Nordmark return (B_TRUE); 621*bd670b35SErik Nordmark return (B_FALSE); 6227c478bd9Sstevel@tonic-gate } 6237c478bd9Sstevel@tonic-gate 6247c478bd9Sstevel@tonic-gate /* 6257c478bd9Sstevel@tonic-gate * ire_create is called to allocate and initialize a new IRE. 6267c478bd9Sstevel@tonic-gate * 6277c478bd9Sstevel@tonic-gate * NOTE : This is called as writer sometimes though not required 6287c478bd9Sstevel@tonic-gate * by this function. 6297c478bd9Sstevel@tonic-gate */ 6307c478bd9Sstevel@tonic-gate ire_t * 631*bd670b35SErik Nordmark ire_create(uchar_t *addr, uchar_t *mask, uchar_t *gateway, 632*bd670b35SErik Nordmark ushort_t type, ill_t *ill, zoneid_t zoneid, uint_t flags, tsol_gc_t *gc, 633*bd670b35SErik Nordmark ip_stack_t *ipst) 6347c478bd9Sstevel@tonic-gate { 6357c478bd9Sstevel@tonic-gate ire_t *ire; 636*bd670b35SErik Nordmark int error; 6377c478bd9Sstevel@tonic-gate 6387c478bd9Sstevel@tonic-gate ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP); 6397c478bd9Sstevel@tonic-gate if (ire == NULL) { 640*bd670b35SErik Nordmark DTRACE_PROBE(kmem__cache__alloc); 6417c478bd9Sstevel@tonic-gate return (NULL); 6427c478bd9Sstevel@tonic-gate } 6437c478bd9Sstevel@tonic-gate *ire = ire_null; 6447c478bd9Sstevel@tonic-gate 645*bd670b35SErik Nordmark error = ire_init_v4(ire, addr, mask, gateway, type, ill, zoneid, flags, 646*bd670b35SErik Nordmark gc, ipst); 647*bd670b35SErik Nordmark if (error != 0) { 648*bd670b35SErik Nordmark DTRACE_PROBE2(ire__init, ire_t *, ire, int, error); 6497c478bd9Sstevel@tonic-gate kmem_cache_free(ire_cache, ire); 6507c478bd9Sstevel@tonic-gate return (NULL); 6517c478bd9Sstevel@tonic-gate } 6527c478bd9Sstevel@tonic-gate return (ire); 6537c478bd9Sstevel@tonic-gate } 6547c478bd9Sstevel@tonic-gate 6557c478bd9Sstevel@tonic-gate /* 6567c478bd9Sstevel@tonic-gate * Common to IPv4 and IPv6 657*bd670b35SErik Nordmark * Returns zero or errno. 6587c478bd9Sstevel@tonic-gate */ 659*bd670b35SErik Nordmark int 660*bd670b35SErik Nordmark ire_init_common(ire_t *ire, ushort_t type, ill_t *ill, zoneid_t zoneid, 661*bd670b35SErik Nordmark uint_t flags, uchar_t ipversion, tsol_gc_t *gc, ip_stack_t *ipst) 6627c478bd9Sstevel@tonic-gate { 663*bd670b35SErik Nordmark int error; 6647c478bd9Sstevel@tonic-gate 66545916cd2Sjpk #ifdef DEBUG 666*bd670b35SErik Nordmark if (ill != NULL) { 667*bd670b35SErik Nordmark if (ill->ill_isv6) 6687c478bd9Sstevel@tonic-gate ASSERT(ipversion == IPV6_VERSION); 6697c478bd9Sstevel@tonic-gate else 6707c478bd9Sstevel@tonic-gate ASSERT(ipversion == IPV4_VERSION); 6717c478bd9Sstevel@tonic-gate } 67245916cd2Sjpk #endif /* DEBUG */ 67345916cd2Sjpk 67445916cd2Sjpk /* 67545916cd2Sjpk * Create/initialize IRE security attribute only in Trusted mode; 676*bd670b35SErik Nordmark * if the passed in gc is non-NULL, we expect that the caller 67745916cd2Sjpk * has held a reference to it and will release it when this routine 67845916cd2Sjpk * returns a failure, otherwise we own the reference. We do this 67945916cd2Sjpk * prior to initializing the rest IRE fields. 68045916cd2Sjpk */ 68145916cd2Sjpk if (is_system_labeled()) { 68245916cd2Sjpk if ((type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST | 683*bd670b35SErik Nordmark IRE_IF_ALL | IRE_MULTICAST | IRE_NOROUTE)) != 0) { 68445916cd2Sjpk /* release references on behalf of caller */ 68545916cd2Sjpk if (gc != NULL) 68645916cd2Sjpk GC_REFRELE(gc); 687*bd670b35SErik Nordmark } else { 688*bd670b35SErik Nordmark error = tsol_ire_init_gwattr(ire, ipversion, gc); 689*bd670b35SErik Nordmark if (error != 0) 690*bd670b35SErik Nordmark return (error); 69145916cd2Sjpk } 69245916cd2Sjpk } 6937c478bd9Sstevel@tonic-gate 6947c478bd9Sstevel@tonic-gate ire->ire_type = type; 6957c478bd9Sstevel@tonic-gate ire->ire_flags = RTF_UP | flags; 6967c478bd9Sstevel@tonic-gate ire->ire_create_time = (uint32_t)gethrestime_sec(); 697*bd670b35SErik Nordmark ire->ire_generation = IRE_GENERATION_INITIAL; 6987c478bd9Sstevel@tonic-gate 6997c478bd9Sstevel@tonic-gate /* 700*bd670b35SErik Nordmark * The ill_ire_cnt isn't increased until 701*bd670b35SErik Nordmark * the IRE is added to ensure that a walker will find 702*bd670b35SErik Nordmark * all IREs that hold a reference on an ill. 7037c478bd9Sstevel@tonic-gate * 704*bd670b35SErik Nordmark * Note that ill_ire_multicast doesn't hold a ref on the ill since 705*bd670b35SErik Nordmark * ire_add() is not called for the IRE_MULTICAST. 7067c478bd9Sstevel@tonic-gate */ 707*bd670b35SErik Nordmark ire->ire_ill = ill; 708*bd670b35SErik Nordmark ire->ire_zoneid = zoneid; 7097c478bd9Sstevel@tonic-gate ire->ire_ipversion = ipversion; 710*bd670b35SErik Nordmark 7117c478bd9Sstevel@tonic-gate mutex_init(&ire->ire_lock, NULL, MUTEX_DEFAULT, NULL); 712c793af95Ssangeeta ire->ire_refcnt = 1; 713*bd670b35SErik Nordmark ire->ire_identical_ref = 1; /* Number of ire_delete's needed */ 714f4b3ec61Sdh155122 ire->ire_ipst = ipst; /* No netstack_hold */ 7156a8288c7Scarlsonj ire->ire_trace_disable = B_FALSE; 71645916cd2Sjpk 717*bd670b35SErik Nordmark return (0); 7187c478bd9Sstevel@tonic-gate } 7197c478bd9Sstevel@tonic-gate 7207c478bd9Sstevel@tonic-gate /* 721*bd670b35SErik Nordmark * This creates an IRE_BROADCAST based on the arguments. 722*bd670b35SErik Nordmark * A mirror is ire_lookup_bcast(). 7237c478bd9Sstevel@tonic-gate * 724*bd670b35SErik Nordmark * Any supression of unneeded ones is done in ire_add_v4. 725*bd670b35SErik Nordmark * We add one IRE_BROADCAST per address. ire_send_broadcast_v4() 726*bd670b35SErik Nordmark * takes care of generating a loopback copy of the packet. 7277c478bd9Sstevel@tonic-gate */ 7287c478bd9Sstevel@tonic-gate ire_t ** 729*bd670b35SErik Nordmark ire_create_bcast(ill_t *ill, ipaddr_t addr, zoneid_t zoneid, ire_t **irep) 7307c478bd9Sstevel@tonic-gate { 731e11c3f44Smeem ip_stack_t *ipst = ill->ill_ipst; 7327c478bd9Sstevel@tonic-gate 733*bd670b35SErik Nordmark ASSERT(IAM_WRITER_ILL(ill)); 734f4b3ec61Sdh155122 7357c478bd9Sstevel@tonic-gate *irep++ = ire_create( 7367c478bd9Sstevel@tonic-gate (uchar_t *)&addr, /* dest addr */ 7377c478bd9Sstevel@tonic-gate (uchar_t *)&ip_g_all_ones, /* mask */ 7387c478bd9Sstevel@tonic-gate NULL, /* no gateway */ 7397c478bd9Sstevel@tonic-gate IRE_BROADCAST, 740*bd670b35SErik Nordmark ill, 741*bd670b35SErik Nordmark zoneid, 742*bd670b35SErik Nordmark RTF_KERNEL, 743f4b3ec61Sdh155122 NULL, 744f4b3ec61Sdh155122 ipst); 7457c478bd9Sstevel@tonic-gate 7467c478bd9Sstevel@tonic-gate return (irep); 7477c478bd9Sstevel@tonic-gate } 7487c478bd9Sstevel@tonic-gate 7497c478bd9Sstevel@tonic-gate /* 750*bd670b35SErik Nordmark * This looks up an IRE_BROADCAST based on the arguments. 751*bd670b35SErik Nordmark * Mirrors ire_create_bcast(). 7527c478bd9Sstevel@tonic-gate */ 7537c478bd9Sstevel@tonic-gate ire_t * 754*bd670b35SErik Nordmark ire_lookup_bcast(ill_t *ill, ipaddr_t addr, zoneid_t zoneid) 7557c478bd9Sstevel@tonic-gate { 7567c478bd9Sstevel@tonic-gate ire_t *ire; 757*bd670b35SErik Nordmark int match_args; 7587c478bd9Sstevel@tonic-gate 759*bd670b35SErik Nordmark match_args = MATCH_IRE_TYPE | MATCH_IRE_ILL | MATCH_IRE_GW | 760*bd670b35SErik Nordmark MATCH_IRE_MASK | MATCH_IRE_ZONEONLY; 761*bd670b35SErik Nordmark 762*bd670b35SErik Nordmark if (IS_UNDER_IPMP(ill)) 763*bd670b35SErik Nordmark match_args |= MATCH_IRE_TESTHIDDEN; 764*bd670b35SErik Nordmark 765*bd670b35SErik Nordmark ire = ire_ftable_lookup_v4( 766*bd670b35SErik Nordmark addr, /* dest addr */ 767*bd670b35SErik Nordmark ip_g_all_ones, /* mask */ 768*bd670b35SErik Nordmark 0, /* no gateway */ 769*bd670b35SErik Nordmark IRE_BROADCAST, 770*bd670b35SErik Nordmark ill, 771*bd670b35SErik Nordmark zoneid, 772*bd670b35SErik Nordmark NULL, 773*bd670b35SErik Nordmark match_args, 774*bd670b35SErik Nordmark 0, 775*bd670b35SErik Nordmark ill->ill_ipst, 776*bd670b35SErik Nordmark NULL); 7777c478bd9Sstevel@tonic-gate return (ire); 7787c478bd9Sstevel@tonic-gate } 7797c478bd9Sstevel@tonic-gate 7807c478bd9Sstevel@tonic-gate /* Arrange to call the specified function for every IRE in the world. */ 7817c478bd9Sstevel@tonic-gate void 782f4b3ec61Sdh155122 ire_walk(pfv_t func, void *arg, ip_stack_t *ipst) 7837c478bd9Sstevel@tonic-gate { 784f4b3ec61Sdh155122 ire_walk_ipvers(func, arg, 0, ALL_ZONES, ipst); 7857c478bd9Sstevel@tonic-gate } 7867c478bd9Sstevel@tonic-gate 7877c478bd9Sstevel@tonic-gate void 788f4b3ec61Sdh155122 ire_walk_v4(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst) 7897c478bd9Sstevel@tonic-gate { 790f4b3ec61Sdh155122 ire_walk_ipvers(func, arg, IPV4_VERSION, zoneid, ipst); 7917c478bd9Sstevel@tonic-gate } 7927c478bd9Sstevel@tonic-gate 7937c478bd9Sstevel@tonic-gate void 794f4b3ec61Sdh155122 ire_walk_v6(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst) 7957c478bd9Sstevel@tonic-gate { 796f4b3ec61Sdh155122 ire_walk_ipvers(func, arg, IPV6_VERSION, zoneid, ipst); 7977c478bd9Sstevel@tonic-gate } 7987c478bd9Sstevel@tonic-gate 7997c478bd9Sstevel@tonic-gate /* 8007c478bd9Sstevel@tonic-gate * Walk a particular version. version == 0 means both v4 and v6. 8017c478bd9Sstevel@tonic-gate */ 8027c478bd9Sstevel@tonic-gate static void 803f4b3ec61Sdh155122 ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, zoneid_t zoneid, 804f4b3ec61Sdh155122 ip_stack_t *ipst) 8057c478bd9Sstevel@tonic-gate { 8067c478bd9Sstevel@tonic-gate if (vers != IPV6_VERSION) { 807c793af95Ssangeeta /* 808c793af95Ssangeeta * ip_forwarding_table variable doesn't matter for IPv4 since 809f4b3ec61Sdh155122 * ire_walk_ill_tables uses ips_ip_ftable for IPv4. 810c793af95Ssangeeta */ 8117c478bd9Sstevel@tonic-gate ire_walk_ill_tables(0, 0, func, arg, IP_MASK_TABLE_SIZE, 812c793af95Ssangeeta 0, NULL, 813f4b3ec61Sdh155122 NULL, zoneid, ipst); 8147c478bd9Sstevel@tonic-gate } 8157c478bd9Sstevel@tonic-gate if (vers != IPV4_VERSION) { 8167c478bd9Sstevel@tonic-gate ire_walk_ill_tables(0, 0, func, arg, IP6_MASK_TABLE_SIZE, 817f4b3ec61Sdh155122 ipst->ips_ip6_ftable_hash_size, 818f4b3ec61Sdh155122 ipst->ips_ip_forwarding_table_v6, 819*bd670b35SErik Nordmark NULL, zoneid, ipst); 8207c478bd9Sstevel@tonic-gate } 8217c478bd9Sstevel@tonic-gate } 8227c478bd9Sstevel@tonic-gate 8237c478bd9Sstevel@tonic-gate /* 8247924222fSmeem * Arrange to call the specified function for every IRE that matches the ill. 8257c478bd9Sstevel@tonic-gate */ 8267c478bd9Sstevel@tonic-gate void 82745916cd2Sjpk ire_walk_ill(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg, 8287c478bd9Sstevel@tonic-gate ill_t *ill) 8297c478bd9Sstevel@tonic-gate { 8307924222fSmeem uchar_t vers = (ill->ill_isv6 ? IPV6_VERSION : IPV4_VERSION); 8317924222fSmeem 8327924222fSmeem ire_walk_ill_ipvers(match_flags, ire_type, func, arg, vers, ill); 8337c478bd9Sstevel@tonic-gate } 8347c478bd9Sstevel@tonic-gate 8357c478bd9Sstevel@tonic-gate /* 8367924222fSmeem * Walk a particular ill and version. 8377c478bd9Sstevel@tonic-gate */ 8387c478bd9Sstevel@tonic-gate static void 8397c478bd9Sstevel@tonic-gate ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, pfv_t func, 84045916cd2Sjpk void *arg, uchar_t vers, ill_t *ill) 8417c478bd9Sstevel@tonic-gate { 842f4b3ec61Sdh155122 ip_stack_t *ipst = ill->ill_ipst; 843f4b3ec61Sdh155122 8447924222fSmeem if (vers == IPV4_VERSION) { 8457c478bd9Sstevel@tonic-gate ire_walk_ill_tables(match_flags, ire_type, func, arg, 846*bd670b35SErik Nordmark IP_MASK_TABLE_SIZE, 847*bd670b35SErik Nordmark 0, NULL, 848*bd670b35SErik Nordmark ill, ALL_ZONES, ipst); 849*bd670b35SErik Nordmark } 850*bd670b35SErik Nordmark if (vers != IPV4_VERSION) { 8517c478bd9Sstevel@tonic-gate ire_walk_ill_tables(match_flags, ire_type, func, arg, 852f4b3ec61Sdh155122 IP6_MASK_TABLE_SIZE, ipst->ips_ip6_ftable_hash_size, 853f4b3ec61Sdh155122 ipst->ips_ip_forwarding_table_v6, 854*bd670b35SErik Nordmark ill, ALL_ZONES, ipst); 8557c478bd9Sstevel@tonic-gate } 8567c478bd9Sstevel@tonic-gate } 8577c478bd9Sstevel@tonic-gate 858*bd670b35SErik Nordmark /* 859*bd670b35SErik Nordmark * Do the specific matching of IREs to shared-IP zones. 860*bd670b35SErik Nordmark * 861*bd670b35SErik Nordmark * We have the same logic as in ire_match_args but implemented slightly 862*bd670b35SErik Nordmark * differently. 863*bd670b35SErik Nordmark */ 864c793af95Ssangeeta boolean_t 8657c478bd9Sstevel@tonic-gate ire_walk_ill_match(uint_t match_flags, uint_t ire_type, ire_t *ire, 866f4b3ec61Sdh155122 ill_t *ill, zoneid_t zoneid, ip_stack_t *ipst) 8677c478bd9Sstevel@tonic-gate { 868*bd670b35SErik Nordmark ill_t *dst_ill = NULL; 8697c478bd9Sstevel@tonic-gate 8707c478bd9Sstevel@tonic-gate ASSERT(match_flags != 0 || zoneid != ALL_ZONES); 871e11c3f44Smeem if (match_flags & MATCH_IRE_ILL) { 872*bd670b35SErik Nordmark dst_ill = ire->ire_ill; 8737c478bd9Sstevel@tonic-gate } 8747c478bd9Sstevel@tonic-gate 875*bd670b35SErik Nordmark if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid && 876*bd670b35SErik Nordmark ire->ire_zoneid != ALL_ZONES) { 8777c478bd9Sstevel@tonic-gate /* 8787c478bd9Sstevel@tonic-gate * We're walking the IREs for a specific zone. The only relevant 8797c478bd9Sstevel@tonic-gate * IREs are: 8807c478bd9Sstevel@tonic-gate * - all IREs with a matching ire_zoneid 881*bd670b35SErik Nordmark * - IRE_IF_ALL IREs for interfaces with a usable source addr 8827c478bd9Sstevel@tonic-gate * with a matching zone 883*bd670b35SErik Nordmark * - IRE_OFFLINK with a gateway reachable from the zone 884*bd670b35SErik Nordmark * Note that ealier we only did the IRE_OFFLINK check for 885*bd670b35SErik Nordmark * IRE_DEFAULT (and only when we had multiple IRE_DEFAULTs). 8867c478bd9Sstevel@tonic-gate */ 887*bd670b35SErik Nordmark dst_ill = ire->ire_ill; 888*bd670b35SErik Nordmark 889*bd670b35SErik Nordmark if (ire->ire_type & IRE_ONLINK) { 890*bd670b35SErik Nordmark uint_t ifindex; 891*bd670b35SErik Nordmark 8927c478bd9Sstevel@tonic-gate /* 893*bd670b35SErik Nordmark * Note there is no IRE_INTERFACE on vniN thus 894*bd670b35SErik Nordmark * can't do an IRE lookup for a matching route. 8957c478bd9Sstevel@tonic-gate */ 896*bd670b35SErik Nordmark ifindex = dst_ill->ill_usesrc_ifindex; 897*bd670b35SErik Nordmark if (ifindex == 0) 8987c478bd9Sstevel@tonic-gate return (B_FALSE); 899*bd670b35SErik Nordmark 9007c478bd9Sstevel@tonic-gate /* 901*bd670b35SErik Nordmark * If there is a usable source address in the 902*bd670b35SErik Nordmark * zone, then it's ok to return an 903*bd670b35SErik Nordmark * IRE_INTERFACE 9047c478bd9Sstevel@tonic-gate */ 905*bd670b35SErik Nordmark if (!ipif_zone_avail(ifindex, dst_ill->ill_isv6, 906*bd670b35SErik Nordmark zoneid, ipst)) { 9077c478bd9Sstevel@tonic-gate return (B_FALSE); 9087c478bd9Sstevel@tonic-gate } 9097c478bd9Sstevel@tonic-gate } 9107c478bd9Sstevel@tonic-gate 911*bd670b35SErik Nordmark if (dst_ill != NULL && (ire->ire_type & IRE_OFFLINK)) { 912*bd670b35SErik Nordmark ipif_t *tipif; 913*bd670b35SErik Nordmark 914*bd670b35SErik Nordmark mutex_enter(&dst_ill->ill_lock); 915*bd670b35SErik Nordmark for (tipif = dst_ill->ill_ipif; 916*bd670b35SErik Nordmark tipif != NULL; tipif = tipif->ipif_next) { 917*bd670b35SErik Nordmark if (!IPIF_IS_CONDEMNED(tipif) && 918*bd670b35SErik Nordmark (tipif->ipif_flags & IPIF_UP) && 919*bd670b35SErik Nordmark (tipif->ipif_zoneid == zoneid || 920*bd670b35SErik Nordmark tipif->ipif_zoneid == ALL_ZONES)) 921*bd670b35SErik Nordmark break; 922*bd670b35SErik Nordmark } 923*bd670b35SErik Nordmark mutex_exit(&dst_ill->ill_lock); 924*bd670b35SErik Nordmark if (tipif == NULL) { 9257c478bd9Sstevel@tonic-gate return (B_FALSE); 9267c478bd9Sstevel@tonic-gate } 9277c478bd9Sstevel@tonic-gate } 9287c478bd9Sstevel@tonic-gate 9297c478bd9Sstevel@tonic-gate /* 930*bd670b35SErik Nordmark * Match all offlink routes from the global zone, irrespective 9315597b60aSnordmark * of reachability. For a non-global zone only match those 932*bd670b35SErik Nordmark * where ire_gateway_addr has an IRE_INTERFACE for the zoneid. 9337c478bd9Sstevel@tonic-gate */ 934*bd670b35SErik Nordmark if ((ire->ire_type & IRE_OFFLINK) && zoneid != GLOBAL_ZONEID && 935*bd670b35SErik Nordmark zoneid != ALL_ZONES) { 9367c478bd9Sstevel@tonic-gate in6_addr_t gw_addr_v6; 937e11c3f44Smeem 9387c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV4_VERSION) { 939*bd670b35SErik Nordmark if (!ire_gateway_ok_zone_v4( 940*bd670b35SErik Nordmark ire->ire_gateway_addr, zoneid, 941*bd670b35SErik Nordmark dst_ill, NULL, ipst, B_FALSE)) 942*bd670b35SErik Nordmark return (B_FALSE); 9437c478bd9Sstevel@tonic-gate } else { 9447c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV6_VERSION); 9457c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 9467c478bd9Sstevel@tonic-gate gw_addr_v6 = ire->ire_gateway_addr_v6; 9477c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 948*bd670b35SErik Nordmark 949*bd670b35SErik Nordmark if (!ire_gateway_ok_zone_v6(&gw_addr_v6, zoneid, 950*bd670b35SErik Nordmark dst_ill, NULL, ipst, B_FALSE)) 9517c478bd9Sstevel@tonic-gate return (B_FALSE); 9527c478bd9Sstevel@tonic-gate } 9537c478bd9Sstevel@tonic-gate } 9547c478bd9Sstevel@tonic-gate } 9557c478bd9Sstevel@tonic-gate 9567c478bd9Sstevel@tonic-gate if (((!(match_flags & MATCH_IRE_TYPE)) || 9577c478bd9Sstevel@tonic-gate (ire->ire_type & ire_type)) && 9587c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_ILL)) || 959*bd670b35SErik Nordmark (dst_ill == ill || 960*bd670b35SErik Nordmark dst_ill != NULL && IS_IN_SAME_ILLGRP(dst_ill, ill)))) { 9617c478bd9Sstevel@tonic-gate return (B_TRUE); 9627c478bd9Sstevel@tonic-gate } 9637c478bd9Sstevel@tonic-gate return (B_FALSE); 9647c478bd9Sstevel@tonic-gate } 9657c478bd9Sstevel@tonic-gate 966c793af95Ssangeeta int 967c793af95Ssangeeta rtfunc(struct radix_node *rn, void *arg) 968c793af95Ssangeeta { 969c793af95Ssangeeta struct rtfuncarg *rtf = arg; 970c793af95Ssangeeta struct rt_entry *rt; 971c793af95Ssangeeta irb_t *irb; 972c793af95Ssangeeta ire_t *ire; 973c793af95Ssangeeta boolean_t ret; 974c793af95Ssangeeta 975c793af95Ssangeeta rt = (struct rt_entry *)rn; 976c793af95Ssangeeta ASSERT(rt != NULL); 977c793af95Ssangeeta irb = &rt->rt_irb; 978c793af95Ssangeeta for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 979c793af95Ssangeeta if ((rtf->rt_match_flags != 0) || 980c793af95Ssangeeta (rtf->rt_zoneid != ALL_ZONES)) { 981c793af95Ssangeeta ret = ire_walk_ill_match(rtf->rt_match_flags, 982c793af95Ssangeeta rtf->rt_ire_type, ire, 983f4b3ec61Sdh155122 rtf->rt_ill, rtf->rt_zoneid, rtf->rt_ipst); 984*bd670b35SErik Nordmark } else { 985c793af95Ssangeeta ret = B_TRUE; 986*bd670b35SErik Nordmark } 987c793af95Ssangeeta if (ret) 988c793af95Ssangeeta (*rtf->rt_func)(ire, rtf->rt_arg); 989c793af95Ssangeeta } 990c793af95Ssangeeta return (0); 991c793af95Ssangeeta } 992c793af95Ssangeeta 9937c478bd9Sstevel@tonic-gate /* 994*bd670b35SErik Nordmark * Walk the ftable entries that match the ill. 9957c478bd9Sstevel@tonic-gate */ 996c793af95Ssangeeta void 9977c478bd9Sstevel@tonic-gate ire_walk_ill_tables(uint_t match_flags, uint_t ire_type, pfv_t func, 99845916cd2Sjpk void *arg, size_t ftbl_sz, size_t htbl_sz, irb_t **ipftbl, 999*bd670b35SErik Nordmark ill_t *ill, zoneid_t zoneid, 1000f4b3ec61Sdh155122 ip_stack_t *ipst) 10017c478bd9Sstevel@tonic-gate { 10027c478bd9Sstevel@tonic-gate irb_t *irb_ptr; 10037c478bd9Sstevel@tonic-gate irb_t *irb; 10047c478bd9Sstevel@tonic-gate ire_t *ire; 10057c478bd9Sstevel@tonic-gate int i, j; 10067c478bd9Sstevel@tonic-gate boolean_t ret; 1007c793af95Ssangeeta struct rtfuncarg rtfarg; 10087c478bd9Sstevel@tonic-gate 1009e11c3f44Smeem ASSERT((!(match_flags & MATCH_IRE_ILL)) || (ill != NULL)); 10107c478bd9Sstevel@tonic-gate ASSERT(!(match_flags & MATCH_IRE_TYPE) || (ire_type != 0)); 1011*bd670b35SErik Nordmark 1012c793af95Ssangeeta /* knobs such that routine is called only for v6 case */ 1013f4b3ec61Sdh155122 if (ipftbl == ipst->ips_ip_forwarding_table_v6) { 10147c478bd9Sstevel@tonic-gate for (i = (ftbl_sz - 1); i >= 0; i--) { 10157c478bd9Sstevel@tonic-gate if ((irb_ptr = ipftbl[i]) == NULL) 10167c478bd9Sstevel@tonic-gate continue; 10177c478bd9Sstevel@tonic-gate for (j = 0; j < htbl_sz; j++) { 10187c478bd9Sstevel@tonic-gate irb = &irb_ptr[j]; 10197c478bd9Sstevel@tonic-gate if (irb->irb_ire == NULL) 10207c478bd9Sstevel@tonic-gate continue; 1021c793af95Ssangeeta 1022*bd670b35SErik Nordmark irb_refhold(irb); 10237c478bd9Sstevel@tonic-gate for (ire = irb->irb_ire; ire != NULL; 10247c478bd9Sstevel@tonic-gate ire = ire->ire_next) { 10257c478bd9Sstevel@tonic-gate if (match_flags == 0 && 10267c478bd9Sstevel@tonic-gate zoneid == ALL_ZONES) { 10277c478bd9Sstevel@tonic-gate ret = B_TRUE; 10287c478bd9Sstevel@tonic-gate } else { 1029c793af95Ssangeeta ret = 1030c793af95Ssangeeta ire_walk_ill_match( 1031c793af95Ssangeeta match_flags, 1032c793af95Ssangeeta ire_type, ire, ill, 1033f4b3ec61Sdh155122 zoneid, ipst); 10347c478bd9Sstevel@tonic-gate } 10357c478bd9Sstevel@tonic-gate if (ret) 10367c478bd9Sstevel@tonic-gate (*func)(ire, arg); 10377c478bd9Sstevel@tonic-gate } 1038*bd670b35SErik Nordmark irb_refrele(irb); 10397c478bd9Sstevel@tonic-gate } 10407c478bd9Sstevel@tonic-gate } 1041c793af95Ssangeeta } else { 1042c793af95Ssangeeta (void) memset(&rtfarg, 0, sizeof (rtfarg)); 1043c793af95Ssangeeta rtfarg.rt_func = func; 1044c793af95Ssangeeta rtfarg.rt_arg = arg; 1045c793af95Ssangeeta if (match_flags != 0) { 1046c793af95Ssangeeta rtfarg.rt_match_flags = match_flags; 1047c793af95Ssangeeta } 1048c793af95Ssangeeta rtfarg.rt_ire_type = ire_type; 1049c793af95Ssangeeta rtfarg.rt_ill = ill; 1050c793af95Ssangeeta rtfarg.rt_zoneid = zoneid; 1051f4b3ec61Sdh155122 rtfarg.rt_ipst = ipst; /* No netstack_hold */ 1052f4b3ec61Sdh155122 (void) ipst->ips_ip_ftable->rnh_walktree_mt( 1053f4b3ec61Sdh155122 ipst->ips_ip_ftable, 1054f4b3ec61Sdh155122 rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn); 1055c793af95Ssangeeta } 10567c478bd9Sstevel@tonic-gate } 10577c478bd9Sstevel@tonic-gate 10587c478bd9Sstevel@tonic-gate /* 10597c478bd9Sstevel@tonic-gate * This function takes a mask and returns 10607c478bd9Sstevel@tonic-gate * number of bits set in the mask. If no 10617c478bd9Sstevel@tonic-gate * bit is set it returns 0. 10627c478bd9Sstevel@tonic-gate * Assumes a contiguous mask. 10637c478bd9Sstevel@tonic-gate */ 10647c478bd9Sstevel@tonic-gate int 10657c478bd9Sstevel@tonic-gate ip_mask_to_plen(ipaddr_t mask) 10667c478bd9Sstevel@tonic-gate { 10677c478bd9Sstevel@tonic-gate return (mask == 0 ? 0 : IP_ABITS - (ffs(ntohl(mask)) -1)); 10687c478bd9Sstevel@tonic-gate } 10697c478bd9Sstevel@tonic-gate 10707c478bd9Sstevel@tonic-gate /* 10717c478bd9Sstevel@tonic-gate * Convert length for a mask to the mask. 10727c478bd9Sstevel@tonic-gate */ 10737c478bd9Sstevel@tonic-gate ipaddr_t 10747c478bd9Sstevel@tonic-gate ip_plen_to_mask(uint_t masklen) 10757c478bd9Sstevel@tonic-gate { 1076*bd670b35SErik Nordmark if (masklen == 0) 1077*bd670b35SErik Nordmark return (0); 1078*bd670b35SErik Nordmark 10797c478bd9Sstevel@tonic-gate return (htonl(IP_HOST_MASK << (IP_ABITS - masklen))); 10807c478bd9Sstevel@tonic-gate } 10817c478bd9Sstevel@tonic-gate 10827c478bd9Sstevel@tonic-gate void 10837c478bd9Sstevel@tonic-gate ire_atomic_end(irb_t *irb_ptr, ire_t *ire) 10847c478bd9Sstevel@tonic-gate { 10857c478bd9Sstevel@tonic-gate ill_t *ill; 10867c478bd9Sstevel@tonic-gate 1087*bd670b35SErik Nordmark ill = ire->ire_ill; 1088*bd670b35SErik Nordmark if (ill != NULL) 1089*bd670b35SErik Nordmark mutex_exit(&ill->ill_lock); 1090*bd670b35SErik Nordmark rw_exit(&irb_ptr->irb_lock); 10917c478bd9Sstevel@tonic-gate } 10927c478bd9Sstevel@tonic-gate 1093*bd670b35SErik Nordmark /* 1094*bd670b35SErik Nordmark * ire_add_v[46] atomically make sure that the ill associated 1095*bd670b35SErik Nordmark * with the new ire is not going away i.e., we check ILL_CONDEMNED. 1096*bd670b35SErik Nordmark */ 1097*bd670b35SErik Nordmark int 1098*bd670b35SErik Nordmark ire_atomic_start(irb_t *irb_ptr, ire_t *ire) 1099*bd670b35SErik Nordmark { 1100*bd670b35SErik Nordmark ill_t *ill; 1101*bd670b35SErik Nordmark 1102*bd670b35SErik Nordmark ill = ire->ire_ill; 1103*bd670b35SErik Nordmark 1104*bd670b35SErik Nordmark rw_enter(&irb_ptr->irb_lock, RW_WRITER); 1105*bd670b35SErik Nordmark if (ill != NULL) { 11067c478bd9Sstevel@tonic-gate mutex_enter(&ill->ill_lock); 1107*bd670b35SErik Nordmark 1108*bd670b35SErik Nordmark /* 1109*bd670b35SErik Nordmark * Don't allow IRE's to be created on dying ills. 1110*bd670b35SErik Nordmark */ 11117c478bd9Sstevel@tonic-gate if (ill->ill_state_flags & ILL_CONDEMNED) { 1112*bd670b35SErik Nordmark ire_atomic_end(irb_ptr, ire); 1113*bd670b35SErik Nordmark return (ENXIO); 11147c478bd9Sstevel@tonic-gate } 11157c478bd9Sstevel@tonic-gate 1116*bd670b35SErik Nordmark if (IS_UNDER_IPMP(ill)) { 1117*bd670b35SErik Nordmark int error = 0; 1118*bd670b35SErik Nordmark mutex_enter(&ill->ill_phyint->phyint_lock); 1119*bd670b35SErik Nordmark if (!ipmp_ill_is_active(ill) && 1120*bd670b35SErik Nordmark IRE_HIDDEN_TYPE(ire->ire_type) && 1121*bd670b35SErik Nordmark !ire->ire_testhidden) { 1122*bd670b35SErik Nordmark error = EINVAL; 1123dc3879f9Sjarrett } 1124*bd670b35SErik Nordmark mutex_exit(&ill->ill_phyint->phyint_lock); 1125dc3879f9Sjarrett if (error != 0) { 1126*bd670b35SErik Nordmark ire_atomic_end(irb_ptr, ire); 1127dc3879f9Sjarrett return (error); 1128dc3879f9Sjarrett } 1129dc3879f9Sjarrett } 1130*bd670b35SErik Nordmark 1131*bd670b35SErik Nordmark } 1132*bd670b35SErik Nordmark return (0); 11337c478bd9Sstevel@tonic-gate } 11347c478bd9Sstevel@tonic-gate 11357c478bd9Sstevel@tonic-gate /* 1136*bd670b35SErik Nordmark * Add a fully initialized IRE to the forwarding table. 1137*bd670b35SErik Nordmark * This returns NULL on failure, or a held IRE on success. 1138*bd670b35SErik Nordmark * Normally the returned IRE is the same as the argument. But a different 1139*bd670b35SErik Nordmark * IRE will be returned if the added IRE is deemed identical to an existing 1140*bd670b35SErik Nordmark * one. In that case ire_identical_ref will be increased. 1141*bd670b35SErik Nordmark * The caller always needs to do an ire_refrele() on the returned IRE. 11427c478bd9Sstevel@tonic-gate */ 1143*bd670b35SErik Nordmark ire_t * 1144*bd670b35SErik Nordmark ire_add(ire_t *ire) 1145*bd670b35SErik Nordmark { 1146*bd670b35SErik Nordmark if (IRE_HIDDEN_TYPE(ire->ire_type) && 1147*bd670b35SErik Nordmark ire->ire_ill != NULL && IS_UNDER_IPMP(ire->ire_ill)) { 1148*bd670b35SErik Nordmark /* 1149*bd670b35SErik Nordmark * IREs hosted on interfaces that are under IPMP 1150*bd670b35SErik Nordmark * should be hidden so that applications don't 1151*bd670b35SErik Nordmark * accidentally end up sending packets with test 1152*bd670b35SErik Nordmark * addresses as their source addresses, or 1153*bd670b35SErik Nordmark * sending out interfaces that are e.g. IFF_INACTIVE. 1154*bd670b35SErik Nordmark * Hide them here. 1155*bd670b35SErik Nordmark */ 1156*bd670b35SErik Nordmark ire->ire_testhidden = B_TRUE; 1157*bd670b35SErik Nordmark } 1158*bd670b35SErik Nordmark 11595c0b7edeSseb if (ire->ire_ipversion == IPV6_VERSION) 1160*bd670b35SErik Nordmark return (ire_add_v6(ire)); 11617c478bd9Sstevel@tonic-gate else 1162*bd670b35SErik Nordmark return (ire_add_v4(ire)); 11637c478bd9Sstevel@tonic-gate } 11647c478bd9Sstevel@tonic-gate 11657c478bd9Sstevel@tonic-gate /* 1166*bd670b35SErik Nordmark * Add a fully initialized IPv4 IRE to the forwarding table. 1167*bd670b35SErik Nordmark * This returns NULL on failure, or a held IRE on success. 1168*bd670b35SErik Nordmark * Normally the returned IRE is the same as the argument. But a different 1169*bd670b35SErik Nordmark * IRE will be returned if the added IRE is deemed identical to an existing 1170*bd670b35SErik Nordmark * one. In that case ire_identical_ref will be increased. 1171*bd670b35SErik Nordmark * The caller always needs to do an ire_refrele() on the returned IRE. 11727c478bd9Sstevel@tonic-gate */ 1173*bd670b35SErik Nordmark static ire_t * 1174*bd670b35SErik Nordmark ire_add_v4(ire_t *ire) 11757c478bd9Sstevel@tonic-gate { 11767c478bd9Sstevel@tonic-gate ire_t *ire1; 11777c478bd9Sstevel@tonic-gate irb_t *irb_ptr; 11787c478bd9Sstevel@tonic-gate ire_t **irep; 1179*bd670b35SErik Nordmark int match_flags; 11807c478bd9Sstevel@tonic-gate int error; 1181f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 1182e11c3f44Smeem 1183*bd670b35SErik Nordmark if (ire->ire_ill != NULL) 1184*bd670b35SErik Nordmark ASSERT(!MUTEX_HELD(&ire->ire_ill->ill_lock)); 11857c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV4_VERSION); 11867c478bd9Sstevel@tonic-gate 11877c478bd9Sstevel@tonic-gate /* Make sure the address is properly masked. */ 11887c478bd9Sstevel@tonic-gate ire->ire_addr &= ire->ire_mask; 11897c478bd9Sstevel@tonic-gate 1190*bd670b35SErik Nordmark match_flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW); 1191c793af95Ssangeeta 1192*bd670b35SErik Nordmark if (ire->ire_ill != NULL) { 1193*bd670b35SErik Nordmark match_flags |= MATCH_IRE_ILL; 1194*bd670b35SErik Nordmark } 1195*bd670b35SErik Nordmark irb_ptr = ire_get_bucket(ire); 1196*bd670b35SErik Nordmark if (irb_ptr == NULL) { 1197*bd670b35SErik Nordmark printf("no bucket for %p\n", (void *)ire); 11987c478bd9Sstevel@tonic-gate ire_delete(ire); 1199*bd670b35SErik Nordmark return (NULL); 12007c478bd9Sstevel@tonic-gate } 12017c478bd9Sstevel@tonic-gate 12027c478bd9Sstevel@tonic-gate /* 1203*bd670b35SErik Nordmark * Start the atomic add of the ire. Grab the ill lock, 1204*bd670b35SErik Nordmark * the bucket lock. Check for condemned. 12057c478bd9Sstevel@tonic-gate */ 1206*bd670b35SErik Nordmark error = ire_atomic_start(irb_ptr, ire); 1207*bd670b35SErik Nordmark if (error != 0) { 1208*bd670b35SErik Nordmark printf("no ire_atomic_start for %p\n", (void *)ire); 1209*bd670b35SErik Nordmark ire_delete(ire); 1210*bd670b35SErik Nordmark irb_refrele(irb_ptr); 1211*bd670b35SErik Nordmark return (NULL); 1212*bd670b35SErik Nordmark } 12137c478bd9Sstevel@tonic-gate /* 1214e11c3f44Smeem * If we are creating a hidden IRE, make sure we search for 1215e11c3f44Smeem * hidden IREs when searching for duplicates below. 1216e11c3f44Smeem * Otherwise, we might find an IRE on some other interface 1217e11c3f44Smeem * that's not marked hidden. 12187c478bd9Sstevel@tonic-gate */ 1219*bd670b35SErik Nordmark if (ire->ire_testhidden) 1220*bd670b35SErik Nordmark match_flags |= MATCH_IRE_TESTHIDDEN; 12217c478bd9Sstevel@tonic-gate 12227c478bd9Sstevel@tonic-gate /* 12237c478bd9Sstevel@tonic-gate * Atomically check for duplicate and insert in the table. 12247c478bd9Sstevel@tonic-gate */ 12257c478bd9Sstevel@tonic-gate for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) { 1226*bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire1)) 12277c478bd9Sstevel@tonic-gate continue; 12287c478bd9Sstevel@tonic-gate /* 1229*bd670b35SErik Nordmark * Here we need an exact match on zoneid, i.e., 1230*bd670b35SErik Nordmark * ire_match_args doesn't fit. 12317c478bd9Sstevel@tonic-gate */ 12327c478bd9Sstevel@tonic-gate if (ire1->ire_zoneid != ire->ire_zoneid) 12337c478bd9Sstevel@tonic-gate continue; 1234*bd670b35SErik Nordmark 1235*bd670b35SErik Nordmark if (ire1->ire_type != ire->ire_type) 1236*bd670b35SErik Nordmark continue; 1237*bd670b35SErik Nordmark 1238*bd670b35SErik Nordmark /* 1239*bd670b35SErik Nordmark * Note: We do not allow multiple routes that differ only 1240*bd670b35SErik Nordmark * in the gateway security attributes; such routes are 1241*bd670b35SErik Nordmark * considered duplicates. 1242*bd670b35SErik Nordmark * To change that we explicitly have to treat them as 1243*bd670b35SErik Nordmark * different here. 1244*bd670b35SErik Nordmark */ 12457c478bd9Sstevel@tonic-gate if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask, 1246*bd670b35SErik Nordmark ire->ire_gateway_addr, ire->ire_type, ire->ire_ill, 1247*bd670b35SErik Nordmark ire->ire_zoneid, NULL, match_flags)) { 12487c478bd9Sstevel@tonic-gate /* 12497c478bd9Sstevel@tonic-gate * Return the old ire after doing a REFHOLD. 12507c478bd9Sstevel@tonic-gate * As most of the callers continue to use the IRE 12517c478bd9Sstevel@tonic-gate * after adding, we return a held ire. This will 12527c478bd9Sstevel@tonic-gate * avoid a lookup in the caller again. If the callers 12537c478bd9Sstevel@tonic-gate * don't want to use it, they need to do a REFRELE. 12547c478bd9Sstevel@tonic-gate */ 1255*bd670b35SErik Nordmark atomic_add_32(&ire1->ire_identical_ref, 1); 1256*bd670b35SErik Nordmark DTRACE_PROBE2(ire__add__exist, ire_t *, ire1, 1257*bd670b35SErik Nordmark ire_t *, ire); 1258*bd670b35SErik Nordmark ire_refhold(ire1); 12597c478bd9Sstevel@tonic-gate ire_atomic_end(irb_ptr, ire); 12607c478bd9Sstevel@tonic-gate ire_delete(ire); 1261*bd670b35SErik Nordmark irb_refrele(irb_ptr); 1262*bd670b35SErik Nordmark return (ire1); 12637c478bd9Sstevel@tonic-gate } 12647c478bd9Sstevel@tonic-gate } 1265e11c3f44Smeem 1266c793af95Ssangeeta /* 1267*bd670b35SErik Nordmark * Normally we do head insertion since most things do not care about 1268*bd670b35SErik Nordmark * the order of the IREs in the bucket. Note that ip_cgtp_bcast_add 1269*bd670b35SErik Nordmark * assumes we at least do head insertion so that its IRE_BROADCAST 1270*bd670b35SErik Nordmark * arrive ahead of existing IRE_HOST for the same address. 1271*bd670b35SErik Nordmark * However, due to shared-IP zones (and restrict_interzone_loopback) 1272*bd670b35SErik Nordmark * we can have an IRE_LOCAL as well as IRE_IF_CLONE for the same 1273*bd670b35SErik Nordmark * address. For that reason we do tail insertion for IRE_IF_CLONE. 1274*bd670b35SErik Nordmark * Due to the IRE_BROADCAST on cgtp0, which must be last in the bucket, 1275*bd670b35SErik Nordmark * we do tail insertion of IRE_BROADCASTs that do not have RTF_MULTIRT 1276*bd670b35SErik Nordmark * set. 12777c478bd9Sstevel@tonic-gate */ 12787c478bd9Sstevel@tonic-gate irep = (ire_t **)irb_ptr; 1279*bd670b35SErik Nordmark if ((ire->ire_type & IRE_IF_CLONE) || 1280*bd670b35SErik Nordmark ((ire->ire_type & IRE_BROADCAST) && 1281*bd670b35SErik Nordmark !(ire->ire_flags & RTF_MULTIRT))) { 1282*bd670b35SErik Nordmark while ((ire1 = *irep) != NULL) 12837c478bd9Sstevel@tonic-gate irep = &ire1->ire_next; 12847c478bd9Sstevel@tonic-gate } 12857c478bd9Sstevel@tonic-gate /* Insert at *irep */ 12867c478bd9Sstevel@tonic-gate ire1 = *irep; 12877c478bd9Sstevel@tonic-gate if (ire1 != NULL) 12887c478bd9Sstevel@tonic-gate ire1->ire_ptpn = &ire->ire_next; 12897c478bd9Sstevel@tonic-gate ire->ire_next = ire1; 12907c478bd9Sstevel@tonic-gate /* Link the new one in. */ 12917c478bd9Sstevel@tonic-gate ire->ire_ptpn = irep; 12927c478bd9Sstevel@tonic-gate 12937c478bd9Sstevel@tonic-gate /* 12947c478bd9Sstevel@tonic-gate * ire_walk routines de-reference ire_next without holding 12957c478bd9Sstevel@tonic-gate * a lock. Before we point to the new ire, we want to make 12967c478bd9Sstevel@tonic-gate * sure the store that sets the ire_next of the new ire 12977c478bd9Sstevel@tonic-gate * reaches global visibility, so that ire_walk routines 12987c478bd9Sstevel@tonic-gate * don't see a truncated list of ires i.e if the ire_next 12997c478bd9Sstevel@tonic-gate * of the new ire gets set after we do "*irep = ire" due 13007c478bd9Sstevel@tonic-gate * to re-ordering, the ire_walk thread will see a NULL 13017c478bd9Sstevel@tonic-gate * once it accesses the ire_next of the new ire. 13027c478bd9Sstevel@tonic-gate * membar_producer() makes sure that the following store 13037c478bd9Sstevel@tonic-gate * happens *after* all of the above stores. 13047c478bd9Sstevel@tonic-gate */ 13057c478bd9Sstevel@tonic-gate membar_producer(); 13067c478bd9Sstevel@tonic-gate *irep = ire; 13077c478bd9Sstevel@tonic-gate ire->ire_bucket = irb_ptr; 13087c478bd9Sstevel@tonic-gate /* 13097c478bd9Sstevel@tonic-gate * We return a bumped up IRE above. Keep it symmetrical 13107c478bd9Sstevel@tonic-gate * so that the callers will always have to release. This 13117c478bd9Sstevel@tonic-gate * helps the callers of this function because they continue 13127c478bd9Sstevel@tonic-gate * to use the IRE after adding and hence they don't have to 13137c478bd9Sstevel@tonic-gate * lookup again after we return the IRE. 13147c478bd9Sstevel@tonic-gate * 13157c478bd9Sstevel@tonic-gate * NOTE : We don't have to use atomics as this is appearing 13167c478bd9Sstevel@tonic-gate * in the list for the first time and no one else can bump 13177c478bd9Sstevel@tonic-gate * up the reference count on this yet. 13187c478bd9Sstevel@tonic-gate */ 1319*bd670b35SErik Nordmark ire_refhold_locked(ire); 1320f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_inserted); 1321c793af95Ssangeeta 13227c478bd9Sstevel@tonic-gate irb_ptr->irb_ire_cnt++; 1323*bd670b35SErik Nordmark if (irb_ptr->irb_marks & IRB_MARK_DYNAMIC) 1324c793af95Ssangeeta irb_ptr->irb_nire++; 1325c793af95Ssangeeta 1326*bd670b35SErik Nordmark if (ire->ire_ill != NULL) { 1327*bd670b35SErik Nordmark ire->ire_ill->ill_ire_cnt++; 1328*bd670b35SErik Nordmark ASSERT(ire->ire_ill->ill_ire_cnt != 0); /* Wraparound */ 13297c478bd9Sstevel@tonic-gate } 13307c478bd9Sstevel@tonic-gate 13317c478bd9Sstevel@tonic-gate ire_atomic_end(irb_ptr, ire); 13327c478bd9Sstevel@tonic-gate 1333*bd670b35SErik Nordmark /* Make any caching of the IREs be notified or updated */ 13347c478bd9Sstevel@tonic-gate ire_flush_cache_v4(ire, IRE_FLUSH_ADD); 1335*bd670b35SErik Nordmark 1336*bd670b35SErik Nordmark if (ire->ire_ill != NULL) 1337*bd670b35SErik Nordmark ASSERT(!MUTEX_HELD(&ire->ire_ill->ill_lock)); 1338*bd670b35SErik Nordmark irb_refrele(irb_ptr); 1339*bd670b35SErik Nordmark return (ire); 13407c478bd9Sstevel@tonic-gate } 13417c478bd9Sstevel@tonic-gate 13427c478bd9Sstevel@tonic-gate /* 1343*bd670b35SErik Nordmark * irb_refrele is the only caller of the function. ire_unlink calls to 13447c478bd9Sstevel@tonic-gate * do the final cleanup for this ire. 13457c478bd9Sstevel@tonic-gate */ 13467c478bd9Sstevel@tonic-gate void 13477c478bd9Sstevel@tonic-gate ire_cleanup(ire_t *ire) 13487c478bd9Sstevel@tonic-gate { 13497c478bd9Sstevel@tonic-gate ire_t *ire_next; 1350f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 13517c478bd9Sstevel@tonic-gate 13527c478bd9Sstevel@tonic-gate ASSERT(ire != NULL); 13537c478bd9Sstevel@tonic-gate 13547c478bd9Sstevel@tonic-gate while (ire != NULL) { 13557c478bd9Sstevel@tonic-gate ire_next = ire->ire_next; 13567c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV4_VERSION) { 13577c478bd9Sstevel@tonic-gate ire_delete_v4(ire); 1358f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, 1359f4b3ec61Sdh155122 ire_stats_deleted); 13607c478bd9Sstevel@tonic-gate } else { 13617c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV6_VERSION); 13627c478bd9Sstevel@tonic-gate ire_delete_v6(ire); 1363f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, 1364f4b3ec61Sdh155122 ire_stats_deleted); 13657c478bd9Sstevel@tonic-gate } 13667c478bd9Sstevel@tonic-gate /* 13677c478bd9Sstevel@tonic-gate * Now it's really out of the list. Before doing the 13687c478bd9Sstevel@tonic-gate * REFRELE, set ire_next to NULL as ire_inactive asserts 13697c478bd9Sstevel@tonic-gate * so. 13707c478bd9Sstevel@tonic-gate */ 13717c478bd9Sstevel@tonic-gate ire->ire_next = NULL; 1372*bd670b35SErik Nordmark ire_refrele_notr(ire); 13737c478bd9Sstevel@tonic-gate ire = ire_next; 13747c478bd9Sstevel@tonic-gate } 13757c478bd9Sstevel@tonic-gate } 13767c478bd9Sstevel@tonic-gate 13777c478bd9Sstevel@tonic-gate /* 1378*bd670b35SErik Nordmark * irb_refrele is the only caller of the function. It calls to unlink 13797c478bd9Sstevel@tonic-gate * all the CONDEMNED ires from this bucket. 13807c478bd9Sstevel@tonic-gate */ 13817c478bd9Sstevel@tonic-gate ire_t * 13827c478bd9Sstevel@tonic-gate ire_unlink(irb_t *irb) 13837c478bd9Sstevel@tonic-gate { 13847c478bd9Sstevel@tonic-gate ire_t *ire; 13857c478bd9Sstevel@tonic-gate ire_t *ire1; 13867c478bd9Sstevel@tonic-gate ire_t **ptpn; 13877c478bd9Sstevel@tonic-gate ire_t *ire_list = NULL; 13887c478bd9Sstevel@tonic-gate 13897c478bd9Sstevel@tonic-gate ASSERT(RW_WRITE_HELD(&irb->irb_lock)); 1390*bd670b35SErik Nordmark ASSERT(((irb->irb_marks & IRB_MARK_DYNAMIC) && irb->irb_refcnt == 1) || 1391c793af95Ssangeeta (irb->irb_refcnt == 0)); 1392c793af95Ssangeeta ASSERT(irb->irb_marks & IRB_MARK_CONDEMNED); 13937c478bd9Sstevel@tonic-gate ASSERT(irb->irb_ire != NULL); 13947c478bd9Sstevel@tonic-gate 13957c478bd9Sstevel@tonic-gate for (ire = irb->irb_ire; ire != NULL; ire = ire1) { 13967c478bd9Sstevel@tonic-gate ire1 = ire->ire_next; 1397*bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire)) { 13987c478bd9Sstevel@tonic-gate ptpn = ire->ire_ptpn; 13997c478bd9Sstevel@tonic-gate ire1 = ire->ire_next; 14007c478bd9Sstevel@tonic-gate if (ire1) 14017c478bd9Sstevel@tonic-gate ire1->ire_ptpn = ptpn; 14027c478bd9Sstevel@tonic-gate *ptpn = ire1; 14037c478bd9Sstevel@tonic-gate ire->ire_ptpn = NULL; 14047c478bd9Sstevel@tonic-gate ire->ire_next = NULL; 1405*bd670b35SErik Nordmark 14067c478bd9Sstevel@tonic-gate /* 1407*bd670b35SErik Nordmark * We need to call ire_delete_v4 or ire_delete_v6 to 1408*bd670b35SErik Nordmark * clean up dependents and the redirects pointing at 14097c478bd9Sstevel@tonic-gate * the default gateway. We need to drop the lock 14107c478bd9Sstevel@tonic-gate * as ire_flush_cache/ire_delete_host_redircts require 14117c478bd9Sstevel@tonic-gate * so. But we can't drop the lock, as ire_unlink needs 14127c478bd9Sstevel@tonic-gate * to atomically remove the ires from the list. 14137c478bd9Sstevel@tonic-gate * So, create a temporary list of CONDEMNED ires 14147c478bd9Sstevel@tonic-gate * for doing ire_delete_v4/ire_delete_v6 operations 14157c478bd9Sstevel@tonic-gate * later on. 14167c478bd9Sstevel@tonic-gate */ 14177c478bd9Sstevel@tonic-gate ire->ire_next = ire_list; 14187c478bd9Sstevel@tonic-gate ire_list = ire; 14197c478bd9Sstevel@tonic-gate } 14207c478bd9Sstevel@tonic-gate } 1421c793af95Ssangeeta irb->irb_marks &= ~IRB_MARK_CONDEMNED; 14227c478bd9Sstevel@tonic-gate return (ire_list); 14237c478bd9Sstevel@tonic-gate } 14247c478bd9Sstevel@tonic-gate 14257c478bd9Sstevel@tonic-gate /* 1426*bd670b35SErik Nordmark * Clean up the radix node for this ire. Must be called by irb_refrele 1427c793af95Ssangeeta * when there are no ire's left in the bucket. Returns TRUE if the bucket 1428c793af95Ssangeeta * is deleted and freed. 1429c793af95Ssangeeta */ 1430c793af95Ssangeeta boolean_t 1431c793af95Ssangeeta irb_inactive(irb_t *irb) 1432c793af95Ssangeeta { 1433c793af95Ssangeeta struct rt_entry *rt; 1434c793af95Ssangeeta struct radix_node *rn; 1435f4b3ec61Sdh155122 ip_stack_t *ipst = irb->irb_ipst; 1436f4b3ec61Sdh155122 1437f4b3ec61Sdh155122 ASSERT(irb->irb_ipst != NULL); 1438c793af95Ssangeeta 1439c793af95Ssangeeta rt = IRB2RT(irb); 1440c793af95Ssangeeta rn = (struct radix_node *)rt; 1441c793af95Ssangeeta 1442c793af95Ssangeeta /* first remove it from the radix tree. */ 1443f4b3ec61Sdh155122 RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable); 1444c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 1445c793af95Ssangeeta if (irb->irb_refcnt == 1 && irb->irb_nire == 0) { 1446f4b3ec61Sdh155122 rn = ipst->ips_ip_ftable->rnh_deladdr(rn->rn_key, rn->rn_mask, 1447f4b3ec61Sdh155122 ipst->ips_ip_ftable); 1448c793af95Ssangeeta DTRACE_PROBE1(irb__free, rt_t *, rt); 1449c793af95Ssangeeta ASSERT((void *)rn == (void *)rt); 1450c793af95Ssangeeta Free(rt, rt_entry_cache); 1451c793af95Ssangeeta /* irb_lock is freed */ 1452f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 1453c793af95Ssangeeta return (B_TRUE); 1454c793af95Ssangeeta } 1455c793af95Ssangeeta rw_exit(&irb->irb_lock); 1456f4b3ec61Sdh155122 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 1457c793af95Ssangeeta return (B_FALSE); 14587c478bd9Sstevel@tonic-gate } 14597c478bd9Sstevel@tonic-gate 14607c478bd9Sstevel@tonic-gate /* 14617c478bd9Sstevel@tonic-gate * Delete the specified IRE. 1462*bd670b35SErik Nordmark * We assume that if ire_bucket is not set then ire_ill->ill_ire_cnt was 1463*bd670b35SErik Nordmark * not incremented i.e., that the insertion in the bucket and the increment 1464*bd670b35SErik Nordmark * of that counter is done atomically. 14657c478bd9Sstevel@tonic-gate */ 14667c478bd9Sstevel@tonic-gate void 14677c478bd9Sstevel@tonic-gate ire_delete(ire_t *ire) 14687c478bd9Sstevel@tonic-gate { 14697c478bd9Sstevel@tonic-gate ire_t *ire1; 14707c478bd9Sstevel@tonic-gate ire_t **ptpn; 14717c478bd9Sstevel@tonic-gate irb_t *irb; 1472*bd670b35SErik Nordmark nce_t *nce; 1473f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 14747c478bd9Sstevel@tonic-gate 1475*bd670b35SErik Nordmark /* We can clear ire_nce_cache under ire_lock even if the IRE is used */ 1476*bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 1477*bd670b35SErik Nordmark nce = ire->ire_nce_cache; 1478*bd670b35SErik Nordmark ire->ire_nce_cache = NULL; 1479*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 1480*bd670b35SErik Nordmark if (nce != NULL) 1481*bd670b35SErik Nordmark nce_refrele(nce); 1482*bd670b35SErik Nordmark 1483c793af95Ssangeeta if ((irb = ire->ire_bucket) == NULL) { 14847c478bd9Sstevel@tonic-gate /* 14857c478bd9Sstevel@tonic-gate * It was never inserted in the list. Should call REFRELE 14867c478bd9Sstevel@tonic-gate * to free this IRE. 14877c478bd9Sstevel@tonic-gate */ 1488*bd670b35SErik Nordmark ire_refrele_notr(ire); 14897c478bd9Sstevel@tonic-gate return; 14907c478bd9Sstevel@tonic-gate } 14917c478bd9Sstevel@tonic-gate 14927c478bd9Sstevel@tonic-gate /* 1493*bd670b35SErik Nordmark * Move the use counts from an IRE_IF_CLONE to its parent 1494*bd670b35SErik Nordmark * IRE_INTERFACE. 1495*bd670b35SErik Nordmark * We need to do this before acquiring irb_lock. 14967c478bd9Sstevel@tonic-gate */ 1497*bd670b35SErik Nordmark if (ire->ire_type & IRE_IF_CLONE) { 1498*bd670b35SErik Nordmark ire_t *parent; 1499*bd670b35SErik Nordmark 1500*bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 1501*bd670b35SErik Nordmark if ((parent = ire->ire_dep_parent) != NULL) { 1502*bd670b35SErik Nordmark parent->ire_ob_pkt_count += ire->ire_ob_pkt_count; 1503*bd670b35SErik Nordmark parent->ire_ib_pkt_count += ire->ire_ib_pkt_count; 1504*bd670b35SErik Nordmark ire->ire_ob_pkt_count = 0; 1505*bd670b35SErik Nordmark ire->ire_ib_pkt_count = 0; 1506*bd670b35SErik Nordmark } 1507*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 15087c478bd9Sstevel@tonic-gate } 15097c478bd9Sstevel@tonic-gate 1510*bd670b35SErik Nordmark rw_enter(&irb->irb_lock, RW_WRITER); 15117c478bd9Sstevel@tonic-gate if (ire->ire_ptpn == NULL) { 15127c478bd9Sstevel@tonic-gate /* 15137c478bd9Sstevel@tonic-gate * Some other thread has removed us from the list. 15147c478bd9Sstevel@tonic-gate * It should have done the REFRELE for us. 15157c478bd9Sstevel@tonic-gate */ 15167c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 15177c478bd9Sstevel@tonic-gate return; 15187c478bd9Sstevel@tonic-gate } 15197c478bd9Sstevel@tonic-gate 1520*bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(ire)) { 1521*bd670b35SErik Nordmark /* Is this an IRE representing multiple duplicate entries? */ 1522*bd670b35SErik Nordmark ASSERT(ire->ire_identical_ref >= 1); 1523*bd670b35SErik Nordmark if (atomic_add_32_nv(&ire->ire_identical_ref, -1) != 0) { 1524*bd670b35SErik Nordmark /* Removed one of the identical parties */ 1525*bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 1526*bd670b35SErik Nordmark return; 15279a09d68dSja97890 } 1528*bd670b35SErik Nordmark 1529*bd670b35SErik Nordmark irb->irb_ire_cnt--; 1530*bd670b35SErik Nordmark ire_make_condemned(ire); 15319a09d68dSja97890 } 15329a09d68dSja97890 15337c478bd9Sstevel@tonic-gate if (irb->irb_refcnt != 0) { 15347c478bd9Sstevel@tonic-gate /* 15357c478bd9Sstevel@tonic-gate * The last thread to leave this bucket will 15367c478bd9Sstevel@tonic-gate * delete this ire. 15377c478bd9Sstevel@tonic-gate */ 1538c793af95Ssangeeta irb->irb_marks |= IRB_MARK_CONDEMNED; 15397c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 15407c478bd9Sstevel@tonic-gate return; 15417c478bd9Sstevel@tonic-gate } 15427c478bd9Sstevel@tonic-gate 15437c478bd9Sstevel@tonic-gate /* 15447c478bd9Sstevel@tonic-gate * Normally to delete an ire, we walk the bucket. While we 15457c478bd9Sstevel@tonic-gate * walk the bucket, we normally bump up irb_refcnt and hence 15467c478bd9Sstevel@tonic-gate * we return from above where we mark CONDEMNED and the ire 15477c478bd9Sstevel@tonic-gate * gets deleted from ire_unlink. This case is where somebody 15487c478bd9Sstevel@tonic-gate * knows the ire e.g by doing a lookup, and wants to delete the 15497c478bd9Sstevel@tonic-gate * IRE. irb_refcnt would be 0 in this case if nobody is walking 15507c478bd9Sstevel@tonic-gate * the bucket. 15517c478bd9Sstevel@tonic-gate */ 15527c478bd9Sstevel@tonic-gate ptpn = ire->ire_ptpn; 15537c478bd9Sstevel@tonic-gate ire1 = ire->ire_next; 15547c478bd9Sstevel@tonic-gate if (ire1 != NULL) 15557c478bd9Sstevel@tonic-gate ire1->ire_ptpn = ptpn; 15567c478bd9Sstevel@tonic-gate ASSERT(ptpn != NULL); 15577c478bd9Sstevel@tonic-gate *ptpn = ire1; 15587c478bd9Sstevel@tonic-gate ire->ire_ptpn = NULL; 15597c478bd9Sstevel@tonic-gate ire->ire_next = NULL; 15607c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 1561f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_deleted); 15627c478bd9Sstevel@tonic-gate } else { 1563f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_deleted); 15647c478bd9Sstevel@tonic-gate } 15657c478bd9Sstevel@tonic-gate rw_exit(&irb->irb_lock); 15667c478bd9Sstevel@tonic-gate 1567*bd670b35SErik Nordmark /* Cleanup dependents and related stuff */ 15687c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 15697c478bd9Sstevel@tonic-gate ire_delete_v6(ire); 15707c478bd9Sstevel@tonic-gate } else { 15717c478bd9Sstevel@tonic-gate ire_delete_v4(ire); 15727c478bd9Sstevel@tonic-gate } 15737c478bd9Sstevel@tonic-gate /* 15747c478bd9Sstevel@tonic-gate * We removed it from the list. Decrement the 15757c478bd9Sstevel@tonic-gate * reference count. 15767c478bd9Sstevel@tonic-gate */ 1577*bd670b35SErik Nordmark ire_refrele_notr(ire); 15787c478bd9Sstevel@tonic-gate } 15797c478bd9Sstevel@tonic-gate 15807c478bd9Sstevel@tonic-gate /* 15817c478bd9Sstevel@tonic-gate * Delete the specified IRE. 15827c478bd9Sstevel@tonic-gate * All calls should use ire_delete(). 15837c478bd9Sstevel@tonic-gate * Sometimes called as writer though not required by this function. 15847c478bd9Sstevel@tonic-gate * 15857c478bd9Sstevel@tonic-gate * NOTE : This function is called only if the ire was added 15867c478bd9Sstevel@tonic-gate * in the list. 15877c478bd9Sstevel@tonic-gate */ 15887c478bd9Sstevel@tonic-gate static void 15897c478bd9Sstevel@tonic-gate ire_delete_v4(ire_t *ire) 15907c478bd9Sstevel@tonic-gate { 1591f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 1592f4b3ec61Sdh155122 15937c478bd9Sstevel@tonic-gate ASSERT(ire->ire_refcnt >= 1); 15947c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV4_VERSION); 15957c478bd9Sstevel@tonic-gate 15967c478bd9Sstevel@tonic-gate ire_flush_cache_v4(ire, IRE_FLUSH_DELETE); 15977c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_DEFAULT) { 15987c478bd9Sstevel@tonic-gate /* 15997c478bd9Sstevel@tonic-gate * when a default gateway is going away 16007c478bd9Sstevel@tonic-gate * delete all the host redirects pointing at that 16017c478bd9Sstevel@tonic-gate * gateway. 16027c478bd9Sstevel@tonic-gate */ 1603f4b3ec61Sdh155122 ire_delete_host_redirects(ire->ire_gateway_addr, ipst); 16047c478bd9Sstevel@tonic-gate } 1605*bd670b35SErik Nordmark 1606*bd670b35SErik Nordmark /* 1607*bd670b35SErik Nordmark * If we are deleting an IRE_INTERFACE then we make sure we also 1608*bd670b35SErik Nordmark * delete any IRE_IF_CLONE that has been created from it. 1609*bd670b35SErik Nordmark * Those are always in ire_dep_children. 1610*bd670b35SErik Nordmark */ 1611*bd670b35SErik Nordmark if ((ire->ire_type & IRE_INTERFACE) && ire->ire_dep_children != NULL) 1612*bd670b35SErik Nordmark ire_dep_delete_if_clone(ire); 1613*bd670b35SErik Nordmark 1614*bd670b35SErik Nordmark /* Remove from parent dependencies and child */ 1615*bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_WRITER); 1616*bd670b35SErik Nordmark if (ire->ire_dep_parent != NULL) 1617*bd670b35SErik Nordmark ire_dep_remove(ire); 1618*bd670b35SErik Nordmark 1619*bd670b35SErik Nordmark while (ire->ire_dep_children != NULL) 1620*bd670b35SErik Nordmark ire_dep_remove(ire->ire_dep_children); 1621*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 16227c478bd9Sstevel@tonic-gate } 16237c478bd9Sstevel@tonic-gate 16247c478bd9Sstevel@tonic-gate /* 1625*bd670b35SErik Nordmark * ire_refrele is the only caller of the function. It calls 16267c478bd9Sstevel@tonic-gate * to free the ire when the reference count goes to zero. 16277c478bd9Sstevel@tonic-gate */ 16287c478bd9Sstevel@tonic-gate void 16297c478bd9Sstevel@tonic-gate ire_inactive(ire_t *ire) 16307c478bd9Sstevel@tonic-gate { 1631*bd670b35SErik Nordmark ill_t *ill; 1632c793af95Ssangeeta irb_t *irb; 1633f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 16347c478bd9Sstevel@tonic-gate 16357c478bd9Sstevel@tonic-gate ASSERT(ire->ire_refcnt == 0); 16367c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ptpn == NULL); 16377c478bd9Sstevel@tonic-gate ASSERT(ire->ire_next == NULL); 16387c478bd9Sstevel@tonic-gate 1639*bd670b35SErik Nordmark /* Count how many condemned ires for kmem_cache callback */ 1640*bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire)) 1641*bd670b35SErik Nordmark atomic_add_32(&ipst->ips_num_ire_condemned, -1); 1642*bd670b35SErik Nordmark 1643c793af95Ssangeeta if (ire->ire_gw_secattr != NULL) { 1644c793af95Ssangeeta ire_gw_secattr_free(ire->ire_gw_secattr); 1645c793af95Ssangeeta ire->ire_gw_secattr = NULL; 1646c793af95Ssangeeta } 1647c793af95Ssangeeta 1648*bd670b35SErik Nordmark /* 1649*bd670b35SErik Nordmark * ire_nce_cache is cleared in ire_delete, and we make sure we don't 1650*bd670b35SErik Nordmark * set it once the ire is marked condemned. 1651*bd670b35SErik Nordmark */ 1652*bd670b35SErik Nordmark ASSERT(ire->ire_nce_cache == NULL); 16537c478bd9Sstevel@tonic-gate 16547c478bd9Sstevel@tonic-gate /* 1655*bd670b35SErik Nordmark * Since any parent would have a refhold on us they would already 1656*bd670b35SErik Nordmark * have been removed. 16577c478bd9Sstevel@tonic-gate */ 1658*bd670b35SErik Nordmark ASSERT(ire->ire_dep_parent == NULL); 1659*bd670b35SErik Nordmark ASSERT(ire->ire_dep_sib_next == NULL); 1660*bd670b35SErik Nordmark ASSERT(ire->ire_dep_sib_ptpn == NULL); 16617c478bd9Sstevel@tonic-gate 1662*bd670b35SErik Nordmark /* 1663*bd670b35SErik Nordmark * Since any children would have a refhold on us they should have 1664*bd670b35SErik Nordmark * already been removed. 1665*bd670b35SErik Nordmark */ 1666*bd670b35SErik Nordmark ASSERT(ire->ire_dep_children == NULL); 1667*bd670b35SErik Nordmark 1668*bd670b35SErik Nordmark /* 1669*bd670b35SErik Nordmark * ill_ire_ref is increased when the IRE is inserted in the 1670*bd670b35SErik Nordmark * bucket - not when the IRE is created. 1671*bd670b35SErik Nordmark */ 1672*bd670b35SErik Nordmark irb = ire->ire_bucket; 1673*bd670b35SErik Nordmark ill = ire->ire_ill; 1674*bd670b35SErik Nordmark if (irb != NULL && ill != NULL) { 16757c478bd9Sstevel@tonic-gate mutex_enter(&ill->ill_lock); 1676*bd670b35SErik Nordmark ASSERT(ill->ill_ire_cnt != 0); 1677*bd670b35SErik Nordmark DTRACE_PROBE3(ill__decr__cnt, (ill_t *), ill, 1678968d2fd1Ssowmini (char *), "ire", (void *), ire); 1679*bd670b35SErik Nordmark ill->ill_ire_cnt--; 1680*bd670b35SErik Nordmark if (ILL_DOWN_OK(ill)) { 16817c478bd9Sstevel@tonic-gate /* Drops the ill lock */ 16827c478bd9Sstevel@tonic-gate ipif_ill_refrele_tail(ill); 16837c478bd9Sstevel@tonic-gate } else { 16847c478bd9Sstevel@tonic-gate mutex_exit(&ill->ill_lock); 16857c478bd9Sstevel@tonic-gate } 16867c478bd9Sstevel@tonic-gate } 1687*bd670b35SErik Nordmark ire->ire_ill = NULL; 1688*bd670b35SErik Nordmark 16897c478bd9Sstevel@tonic-gate /* This should be true for both V4 and V6 */ 1690*bd670b35SErik Nordmark if (irb != NULL && (irb->irb_marks & IRB_MARK_DYNAMIC)) { 1691c793af95Ssangeeta rw_enter(&irb->irb_lock, RW_WRITER); 1692c793af95Ssangeeta irb->irb_nire--; 1693c793af95Ssangeeta /* 1694c793af95Ssangeeta * Instead of examining the conditions for freeing 1695c793af95Ssangeeta * the radix node here, we do it by calling 1696*bd670b35SErik Nordmark * irb_refrele which is a single point in the code 1697c793af95Ssangeeta * that embeds that logic. Bump up the refcnt to 1698*bd670b35SErik Nordmark * be able to call irb_refrele 1699c793af95Ssangeeta */ 1700*bd670b35SErik Nordmark irb_refhold_locked(irb); 1701c793af95Ssangeeta rw_exit(&irb->irb_lock); 1702*bd670b35SErik Nordmark irb_refrele(irb); 1703c793af95Ssangeeta } 17047c478bd9Sstevel@tonic-gate 17056a8288c7Scarlsonj #ifdef DEBUG 17066a8288c7Scarlsonj ire_trace_cleanup(ire); 17077c478bd9Sstevel@tonic-gate #endif 17087c478bd9Sstevel@tonic-gate mutex_destroy(&ire->ire_lock); 17097c478bd9Sstevel@tonic-gate if (ire->ire_ipversion == IPV6_VERSION) { 1710f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_freed); 17117c478bd9Sstevel@tonic-gate } else { 1712f4b3ec61Sdh155122 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_freed); 17137c478bd9Sstevel@tonic-gate } 17147c478bd9Sstevel@tonic-gate kmem_cache_free(ire_cache, ire); 17157c478bd9Sstevel@tonic-gate } 17167c478bd9Sstevel@tonic-gate 17177c478bd9Sstevel@tonic-gate /* 1718*bd670b35SErik Nordmark * ire_update_generation is the callback function provided by 1719*bd670b35SErik Nordmark * ire_get_bucket() to update the generation number of any 1720*bd670b35SErik Nordmark * matching shorter route when a new route is added. 1721*bd670b35SErik Nordmark * 1722*bd670b35SErik Nordmark * This fucntion always returns a failure return (B_FALSE) 1723*bd670b35SErik Nordmark * to force the caller (rn_matchaddr_args) 1724*bd670b35SErik Nordmark * to back-track up the tree looking for shorter matches. 17257c478bd9Sstevel@tonic-gate */ 1726*bd670b35SErik Nordmark /* ARGSUSED */ 1727*bd670b35SErik Nordmark static boolean_t 1728*bd670b35SErik Nordmark ire_update_generation(struct radix_node *rn, void *arg) 17297c478bd9Sstevel@tonic-gate { 1730*bd670b35SErik Nordmark struct rt_entry *rt = (struct rt_entry *)rn; 17317c478bd9Sstevel@tonic-gate 1732*bd670b35SErik Nordmark /* We need to handle all in the same bucket */ 1733*bd670b35SErik Nordmark irb_increment_generation(&rt->rt_irb); 1734*bd670b35SErik Nordmark return (B_FALSE); 17357c478bd9Sstevel@tonic-gate } 17367c478bd9Sstevel@tonic-gate 17377c478bd9Sstevel@tonic-gate /* 1738*bd670b35SErik Nordmark * Take care of all the generation numbers in the bucket. 1739*bd670b35SErik Nordmark */ 1740*bd670b35SErik Nordmark void 1741*bd670b35SErik Nordmark irb_increment_generation(irb_t *irb) 1742*bd670b35SErik Nordmark { 1743*bd670b35SErik Nordmark ire_t *ire; 1744*bd670b35SErik Nordmark 1745*bd670b35SErik Nordmark if (irb == NULL || irb->irb_ire_cnt == 0) 1746*bd670b35SErik Nordmark return; 1747*bd670b35SErik Nordmark 1748*bd670b35SErik Nordmark irb_refhold(irb); 1749*bd670b35SErik Nordmark for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 1750*bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(ire)) 1751*bd670b35SErik Nordmark ire_increment_generation(ire); /* Ourselves */ 1752*bd670b35SErik Nordmark ire_dep_incr_generation(ire); /* Dependants */ 1753*bd670b35SErik Nordmark } 1754*bd670b35SErik Nordmark irb_refrele(irb); 1755*bd670b35SErik Nordmark } 1756*bd670b35SErik Nordmark 1757*bd670b35SErik Nordmark /* 1758*bd670b35SErik Nordmark * When an IRE is added or deleted this routine is called to make sure 1759*bd670b35SErik Nordmark * any caching of IRE information is notified or updated. 17607c478bd9Sstevel@tonic-gate * 17617c478bd9Sstevel@tonic-gate * The flag argument indicates if the flush request is due to addition 1762*bd670b35SErik Nordmark * of new route (IRE_FLUSH_ADD), deletion of old route (IRE_FLUSH_DELETE), 1763*bd670b35SErik Nordmark * or a change to ire_gateway_addr (IRE_FLUSH_GWCHANGE). 17647c478bd9Sstevel@tonic-gate */ 17657c478bd9Sstevel@tonic-gate void 17667c478bd9Sstevel@tonic-gate ire_flush_cache_v4(ire_t *ire, int flag) 17677c478bd9Sstevel@tonic-gate { 1768*bd670b35SErik Nordmark irb_t *irb = ire->ire_bucket; 1769*bd670b35SErik Nordmark struct rt_entry *rt = IRB2RT(irb); 1770f4b3ec61Sdh155122 ip_stack_t *ipst = ire->ire_ipst; 17717c478bd9Sstevel@tonic-gate 1772*bd670b35SErik Nordmark /* 1773*bd670b35SErik Nordmark * IRE_IF_CLONE ire's don't provide any new information 1774*bd670b35SErik Nordmark * than the parent from which they are cloned, so don't 1775*bd670b35SErik Nordmark * perturb the generation numbers. 1776*bd670b35SErik Nordmark */ 1777*bd670b35SErik Nordmark if (ire->ire_type & IRE_IF_CLONE) 17787c478bd9Sstevel@tonic-gate return; 17797c478bd9Sstevel@tonic-gate 17807c478bd9Sstevel@tonic-gate /* 1781*bd670b35SErik Nordmark * Ensure that an ire_add during a lookup serializes the updates of the 1782*bd670b35SErik Nordmark * generation numbers under the radix head lock so that the lookup gets 1783*bd670b35SErik Nordmark * either the old ire and old generation number, or a new ire and new 1784*bd670b35SErik Nordmark * generation number. 17857c478bd9Sstevel@tonic-gate */ 1786*bd670b35SErik Nordmark RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable); 1787*bd670b35SErik Nordmark 1788*bd670b35SErik Nordmark /* 1789*bd670b35SErik Nordmark * If a route was just added, we need to notify everybody that 1790*bd670b35SErik Nordmark * has cached an IRE_NOROUTE since there might now be a better 1791*bd670b35SErik Nordmark * route for them. 1792*bd670b35SErik Nordmark */ 17937c478bd9Sstevel@tonic-gate if (flag == IRE_FLUSH_ADD) { 1794*bd670b35SErik Nordmark ire_increment_generation(ipst->ips_ire_reject_v4); 1795*bd670b35SErik Nordmark ire_increment_generation(ipst->ips_ire_blackhole_v4); 1796*bd670b35SErik Nordmark } 1797*bd670b35SErik Nordmark 1798*bd670b35SErik Nordmark /* Adding a default can't otherwise provide a better route */ 1799*bd670b35SErik Nordmark if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD) { 1800*bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 1801*bd670b35SErik Nordmark return; 1802*bd670b35SErik Nordmark } 1803*bd670b35SErik Nordmark 1804*bd670b35SErik Nordmark switch (flag) { 1805*bd670b35SErik Nordmark case IRE_FLUSH_DELETE: 1806*bd670b35SErik Nordmark case IRE_FLUSH_GWCHANGE: 18077c478bd9Sstevel@tonic-gate /* 1808*bd670b35SErik Nordmark * Update ire_generation for all ire_dep_children chains 1809*bd670b35SErik Nordmark * starting with this IRE 18107c478bd9Sstevel@tonic-gate */ 1811*bd670b35SErik Nordmark ire_dep_incr_generation(ire); 1812*bd670b35SErik Nordmark break; 1813*bd670b35SErik Nordmark case IRE_FLUSH_ADD: 18147c478bd9Sstevel@tonic-gate /* 1815*bd670b35SErik Nordmark * Update the generation numbers of all shorter matching routes. 1816*bd670b35SErik Nordmark * ire_update_generation takes care of the dependants by 1817*bd670b35SErik Nordmark * using ire_dep_incr_generation. 18187c478bd9Sstevel@tonic-gate */ 1819*bd670b35SErik Nordmark (void) ipst->ips_ip_ftable->rnh_matchaddr_args(&rt->rt_dst, 1820*bd670b35SErik Nordmark ipst->ips_ip_ftable, ire_update_generation, NULL); 1821*bd670b35SErik Nordmark break; 18227c478bd9Sstevel@tonic-gate } 1823*bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 18247c478bd9Sstevel@tonic-gate } 18257c478bd9Sstevel@tonic-gate 18267c478bd9Sstevel@tonic-gate /* 18277c478bd9Sstevel@tonic-gate * Matches the arguments passed with the values in the ire. 18287c478bd9Sstevel@tonic-gate * 1829*bd670b35SErik Nordmark * Note: for match types that match using "ill" passed in, ill 18307c478bd9Sstevel@tonic-gate * must be checked for non-NULL before calling this routine. 18317c478bd9Sstevel@tonic-gate */ 1832c793af95Ssangeeta boolean_t 18337c478bd9Sstevel@tonic-gate ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 1834*bd670b35SErik Nordmark int type, const ill_t *ill, zoneid_t zoneid, 1835*bd670b35SErik Nordmark const ts_label_t *tsl, int match_flags) 18367c478bd9Sstevel@tonic-gate { 18377c478bd9Sstevel@tonic-gate ill_t *ire_ill = NULL, *dst_ill; 1838*bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 18397c478bd9Sstevel@tonic-gate 18407c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV4_VERSION); 18417c478bd9Sstevel@tonic-gate ASSERT((ire->ire_addr & ~ire->ire_mask) == 0); 1842e11c3f44Smeem ASSERT((!(match_flags & MATCH_IRE_ILL)) || 1843*bd670b35SErik Nordmark (ill != NULL && !ill->ill_isv6)); 18447c478bd9Sstevel@tonic-gate 18457c478bd9Sstevel@tonic-gate /* 1846*bd670b35SErik Nordmark * If MATCH_IRE_TESTHIDDEN is set, then only return the IRE if it is 1847*bd670b35SErik Nordmark * in fact hidden, to ensure the caller gets the right one. 18487c478bd9Sstevel@tonic-gate */ 1849*bd670b35SErik Nordmark if (ire->ire_testhidden) { 1850*bd670b35SErik Nordmark if (!(match_flags & MATCH_IRE_TESTHIDDEN)) 18517c478bd9Sstevel@tonic-gate return (B_FALSE); 1852e11c3f44Smeem } 18537c478bd9Sstevel@tonic-gate 185445916cd2Sjpk if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid && 185545916cd2Sjpk ire->ire_zoneid != ALL_ZONES) { 18567c478bd9Sstevel@tonic-gate /* 1857*bd670b35SErik Nordmark * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid 1858*bd670b35SErik Nordmark * does not match that of ire_zoneid, a failure to 18597c478bd9Sstevel@tonic-gate * match is reported at this point. Otherwise, since some IREs 18607c478bd9Sstevel@tonic-gate * that are available in the global zone can be used in local 18617c478bd9Sstevel@tonic-gate * zones, additional checks need to be performed: 18627c478bd9Sstevel@tonic-gate * 1863*bd670b35SErik Nordmark * IRE_LOOPBACK 18647c478bd9Sstevel@tonic-gate * entries should never be matched in this situation. 1865*bd670b35SErik Nordmark * Each zone has its own IRE_LOOPBACK. 18667c478bd9Sstevel@tonic-gate * 1867*bd670b35SErik Nordmark * IRE_LOCAL 1868*bd670b35SErik Nordmark * We allow them for any zoneid. ire_route_recursive 1869*bd670b35SErik Nordmark * does additional checks when 1870*bd670b35SErik Nordmark * ip_restrict_interzone_loopback is set. 18717c478bd9Sstevel@tonic-gate * 1872*bd670b35SErik Nordmark * If ill_usesrc_ifindex is set 1873*bd670b35SErik Nordmark * Then we check if the zone has a valid source address 1874*bd670b35SErik Nordmark * on the usesrc ill. 18757c478bd9Sstevel@tonic-gate * 1876*bd670b35SErik Nordmark * If ire_ill is set, then check that the zone has an ipif 1877*bd670b35SErik Nordmark * on that ill. 1878*bd670b35SErik Nordmark * 1879*bd670b35SErik Nordmark * Outside of this function (in ire_round_robin) we check 1880*bd670b35SErik Nordmark * that any IRE_OFFLINK has a gateway that reachable from the 1881*bd670b35SErik Nordmark * zone when we have multiple choices (ECMP). 18827c478bd9Sstevel@tonic-gate */ 18837c478bd9Sstevel@tonic-gate if (match_flags & MATCH_IRE_ZONEONLY) 18847c478bd9Sstevel@tonic-gate return (B_FALSE); 1885*bd670b35SErik Nordmark if (ire->ire_type & IRE_LOOPBACK) 18867c478bd9Sstevel@tonic-gate return (B_FALSE); 1887*bd670b35SErik Nordmark 1888*bd670b35SErik Nordmark if (ire->ire_type & IRE_LOCAL) 1889*bd670b35SErik Nordmark goto matchit; 1890*bd670b35SErik Nordmark 18917c478bd9Sstevel@tonic-gate /* 1892*bd670b35SErik Nordmark * The normal case of IRE_ONLINK has a matching zoneid. 1893*bd670b35SErik Nordmark * Here we handle the case when shared-IP zones have been 1894*bd670b35SErik Nordmark * configured with IP addresses on vniN. In that case it 1895*bd670b35SErik Nordmark * is ok for traffic from a zone to use IRE_ONLINK routes 1896*bd670b35SErik Nordmark * if the ill has a usesrc pointing at vniN 18977c478bd9Sstevel@tonic-gate */ 1898*bd670b35SErik Nordmark dst_ill = ire->ire_ill; 1899*bd670b35SErik Nordmark if (ire->ire_type & IRE_ONLINK) { 1900*bd670b35SErik Nordmark uint_t ifindex; 1901*bd670b35SErik Nordmark 1902*bd670b35SErik Nordmark /* 1903*bd670b35SErik Nordmark * Note there is no IRE_INTERFACE on vniN thus 1904*bd670b35SErik Nordmark * can't do an IRE lookup for a matching route. 1905*bd670b35SErik Nordmark */ 1906*bd670b35SErik Nordmark ifindex = dst_ill->ill_usesrc_ifindex; 1907*bd670b35SErik Nordmark if (ifindex == 0) 1908*bd670b35SErik Nordmark return (B_FALSE); 1909*bd670b35SErik Nordmark 19107c478bd9Sstevel@tonic-gate /* 19117c478bd9Sstevel@tonic-gate * If there is a usable source address in the 1912*bd670b35SErik Nordmark * zone, then it's ok to return this IRE_INTERFACE 19137c478bd9Sstevel@tonic-gate */ 1914*bd670b35SErik Nordmark if (!ipif_zone_avail(ifindex, dst_ill->ill_isv6, 1915*bd670b35SErik Nordmark zoneid, ipst)) { 1916*bd670b35SErik Nordmark ip3dbg(("ire_match_args: no usrsrc for zone" 19177c478bd9Sstevel@tonic-gate " dst_ill %p\n", (void *)dst_ill)); 19187c478bd9Sstevel@tonic-gate return (B_FALSE); 19197c478bd9Sstevel@tonic-gate } 19207c478bd9Sstevel@tonic-gate } 1921*bd670b35SErik Nordmark /* 1922*bd670b35SErik Nordmark * For exampe, with 1923*bd670b35SErik Nordmark * route add 11.0.0.0 gw1 -ifp bge0 1924*bd670b35SErik Nordmark * route add 11.0.0.0 gw2 -ifp bge1 1925*bd670b35SErik Nordmark * this code would differentiate based on 1926*bd670b35SErik Nordmark * where the sending zone has addresses. 1927*bd670b35SErik Nordmark * Only if the zone has an address on bge0 can it use the first 1928*bd670b35SErik Nordmark * route. It isn't clear if this behavior is documented 1929*bd670b35SErik Nordmark * anywhere. 1930*bd670b35SErik Nordmark */ 1931*bd670b35SErik Nordmark if (dst_ill != NULL && (ire->ire_type & IRE_OFFLINK)) { 19327c478bd9Sstevel@tonic-gate ipif_t *tipif; 19337c478bd9Sstevel@tonic-gate 1934*bd670b35SErik Nordmark mutex_enter(&dst_ill->ill_lock); 1935*bd670b35SErik Nordmark for (tipif = dst_ill->ill_ipif; 19367c478bd9Sstevel@tonic-gate tipif != NULL; tipif = tipif->ipif_next) { 1937*bd670b35SErik Nordmark if (!IPIF_IS_CONDEMNED(tipif) && 19387c478bd9Sstevel@tonic-gate (tipif->ipif_flags & IPIF_UP) && 193945916cd2Sjpk (tipif->ipif_zoneid == zoneid || 194045916cd2Sjpk tipif->ipif_zoneid == ALL_ZONES)) 19417c478bd9Sstevel@tonic-gate break; 19427c478bd9Sstevel@tonic-gate } 1943*bd670b35SErik Nordmark mutex_exit(&dst_ill->ill_lock); 19447c478bd9Sstevel@tonic-gate if (tipif == NULL) { 19457c478bd9Sstevel@tonic-gate return (B_FALSE); 19467c478bd9Sstevel@tonic-gate } 19477c478bd9Sstevel@tonic-gate } 19487c478bd9Sstevel@tonic-gate } 19497c478bd9Sstevel@tonic-gate 1950*bd670b35SErik Nordmark matchit: 1951e11c3f44Smeem if (match_flags & MATCH_IRE_ILL) { 1952*bd670b35SErik Nordmark ire_ill = ire->ire_ill; 1953*bd670b35SErik Nordmark 1954*bd670b35SErik Nordmark /* 1955*bd670b35SErik Nordmark * If asked to match an ill, we *must* match 1956*bd670b35SErik Nordmark * on the ire_ill for ipmp test addresses, or 1957*bd670b35SErik Nordmark * any of the ill in the group for data addresses. 1958*bd670b35SErik Nordmark * If we don't, we may as well fail. 1959*bd670b35SErik Nordmark * However, we need an exception for IRE_LOCALs to ensure 1960*bd670b35SErik Nordmark * we loopback packets even sent to test addresses on different 1961*bd670b35SErik Nordmark * interfaces in the group. 1962*bd670b35SErik Nordmark */ 1963*bd670b35SErik Nordmark if ((match_flags & MATCH_IRE_TESTHIDDEN) && 1964*bd670b35SErik Nordmark !(ire->ire_type & IRE_LOCAL)) { 1965*bd670b35SErik Nordmark if (ire->ire_ill != ill) 1966*bd670b35SErik Nordmark return (B_FALSE); 1967*bd670b35SErik Nordmark } else { 1968*bd670b35SErik Nordmark match_flags &= ~MATCH_IRE_TESTHIDDEN; 1969*bd670b35SErik Nordmark /* 1970*bd670b35SErik Nordmark * We know that ill is not NULL, but ire_ill could be 1971*bd670b35SErik Nordmark * NULL 1972*bd670b35SErik Nordmark */ 1973*bd670b35SErik Nordmark if (ire_ill == NULL || !IS_ON_SAME_LAN(ill, ire_ill)) 1974*bd670b35SErik Nordmark return (B_FALSE); 1975*bd670b35SErik Nordmark } 19767c478bd9Sstevel@tonic-gate } 19777c478bd9Sstevel@tonic-gate 19787c478bd9Sstevel@tonic-gate if ((ire->ire_addr == (addr & mask)) && 19797c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_GW)) || 19807c478bd9Sstevel@tonic-gate (ire->ire_gateway_addr == gateway)) && 1981*bd670b35SErik Nordmark ((!(match_flags & MATCH_IRE_TYPE)) || (ire->ire_type & type)) && 1982*bd670b35SErik Nordmark ((!(match_flags & MATCH_IRE_TESTHIDDEN)) || ire->ire_testhidden) && 1983*bd670b35SErik Nordmark ((!(match_flags & MATCH_IRE_MASK)) || (ire->ire_mask == mask)) && 198445916cd2Sjpk ((!(match_flags & MATCH_IRE_SECATTR)) || 198545916cd2Sjpk (!is_system_labeled()) || 198645916cd2Sjpk (tsol_ire_match_gwattr(ire, tsl) == 0))) { 19877c478bd9Sstevel@tonic-gate /* We found the matched IRE */ 19887c478bd9Sstevel@tonic-gate return (B_TRUE); 19897c478bd9Sstevel@tonic-gate } 19907c478bd9Sstevel@tonic-gate return (B_FALSE); 19917c478bd9Sstevel@tonic-gate } 19927c478bd9Sstevel@tonic-gate 19937c478bd9Sstevel@tonic-gate /* 1994e11c3f44Smeem * Check if the IRE_LOCAL uses the same ill as another route would use. 1995aa2eaee6Snordmark * If there is no alternate route, or the alternate is a REJECT or BLACKHOLE, 1996aa2eaee6Snordmark * then we don't allow this IRE_LOCAL to be used. 1997*bd670b35SErik Nordmark * We always return an IRE; will be RTF_REJECT if no route available. 1998*bd670b35SErik Nordmark */ 1999*bd670b35SErik Nordmark ire_t * 2000*bd670b35SErik Nordmark ire_alt_local(ire_t *ire, zoneid_t zoneid, const ts_label_t *tsl, 2001*bd670b35SErik Nordmark const ill_t *ill, uint_t *generationp) 2002*bd670b35SErik Nordmark { 2003*bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 2004*bd670b35SErik Nordmark ire_t *alt_ire; 2005*bd670b35SErik Nordmark uint_t ire_type; 2006*bd670b35SErik Nordmark uint_t generation; 2007*bd670b35SErik Nordmark uint_t match_flags; 2008*bd670b35SErik Nordmark 2009*bd670b35SErik Nordmark ASSERT(ire->ire_type & IRE_LOCAL); 2010*bd670b35SErik Nordmark ASSERT(ire->ire_ill != NULL); 2011*bd670b35SErik Nordmark 2012*bd670b35SErik Nordmark /* 2013*bd670b35SErik Nordmark * Need to match on everything but local. 2014*bd670b35SErik Nordmark * This might result in the creation of a IRE_IF_CLONE for the 2015*bd670b35SErik Nordmark * same address as the IRE_LOCAL when restrict_interzone_loopback is 2016*bd670b35SErik Nordmark * set. ire_add_*() ensures that the IRE_IF_CLONE are tail inserted 2017*bd670b35SErik Nordmark * to make sure the IRE_LOCAL is always found first. 2018*bd670b35SErik Nordmark */ 2019*bd670b35SErik Nordmark ire_type = (IRE_ONLINK | IRE_OFFLINK) & ~(IRE_LOCAL|IRE_LOOPBACK); 2020*bd670b35SErik Nordmark match_flags = MATCH_IRE_TYPE | MATCH_IRE_SECATTR; 2021*bd670b35SErik Nordmark if (ill != NULL) 2022*bd670b35SErik Nordmark match_flags |= MATCH_IRE_ILL; 2023*bd670b35SErik Nordmark 2024*bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 2025*bd670b35SErik Nordmark alt_ire = ire_route_recursive_v4(ire->ire_addr, ire_type, 2026*bd670b35SErik Nordmark ill, zoneid, tsl, match_flags, B_TRUE, 0, ipst, NULL, NULL, 2027*bd670b35SErik Nordmark &generation); 2028*bd670b35SErik Nordmark } else { 2029*bd670b35SErik Nordmark alt_ire = ire_route_recursive_v6(&ire->ire_addr_v6, ire_type, 2030*bd670b35SErik Nordmark ill, zoneid, tsl, match_flags, B_TRUE, 0, ipst, NULL, NULL, 2031*bd670b35SErik Nordmark &generation); 2032*bd670b35SErik Nordmark } 2033*bd670b35SErik Nordmark ASSERT(alt_ire != NULL); 2034*bd670b35SErik Nordmark 2035*bd670b35SErik Nordmark if (alt_ire->ire_ill == ire->ire_ill) { 2036*bd670b35SErik Nordmark /* Going out the same ILL - ok to send to IRE_LOCAL */ 2037*bd670b35SErik Nordmark ire_refrele(alt_ire); 2038*bd670b35SErik Nordmark } else { 2039*bd670b35SErik Nordmark /* Different ill - ignore IRE_LOCAL */ 2040*bd670b35SErik Nordmark ire_refrele(ire); 2041*bd670b35SErik Nordmark ire = alt_ire; 2042*bd670b35SErik Nordmark if (generationp != NULL) 2043*bd670b35SErik Nordmark *generationp = generation; 2044*bd670b35SErik Nordmark } 2045*bd670b35SErik Nordmark return (ire); 2046*bd670b35SErik Nordmark } 2047*bd670b35SErik Nordmark 2048*bd670b35SErik Nordmark boolean_t 2049*bd670b35SErik Nordmark ire_find_zoneid(struct radix_node *rn, void *arg) 2050*bd670b35SErik Nordmark { 2051*bd670b35SErik Nordmark struct rt_entry *rt = (struct rt_entry *)rn; 2052*bd670b35SErik Nordmark irb_t *irb; 2053*bd670b35SErik Nordmark ire_t *ire; 2054*bd670b35SErik Nordmark ire_ftable_args_t *margs = arg; 2055*bd670b35SErik Nordmark 2056*bd670b35SErik Nordmark ASSERT(rt != NULL); 2057*bd670b35SErik Nordmark 2058*bd670b35SErik Nordmark irb = &rt->rt_irb; 2059*bd670b35SErik Nordmark 2060*bd670b35SErik Nordmark if (irb->irb_ire_cnt == 0) 2061*bd670b35SErik Nordmark return (B_FALSE); 2062*bd670b35SErik Nordmark 2063*bd670b35SErik Nordmark rw_enter(&irb->irb_lock, RW_READER); 2064*bd670b35SErik Nordmark for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 2065*bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire)) 2066*bd670b35SErik Nordmark continue; 2067*bd670b35SErik Nordmark 2068*bd670b35SErik Nordmark if (ire->ire_zoneid != ALL_ZONES && 2069*bd670b35SErik Nordmark ire->ire_zoneid != margs->ift_zoneid) 2070*bd670b35SErik Nordmark continue; 2071*bd670b35SErik Nordmark 2072*bd670b35SErik Nordmark if (margs->ift_ill != NULL && margs->ift_ill != ire->ire_ill) 2073*bd670b35SErik Nordmark continue; 2074*bd670b35SErik Nordmark 2075*bd670b35SErik Nordmark if (is_system_labeled() && 2076*bd670b35SErik Nordmark tsol_ire_match_gwattr(ire, margs->ift_tsl) != 0) 2077*bd670b35SErik Nordmark continue; 2078*bd670b35SErik Nordmark 2079*bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 2080*bd670b35SErik Nordmark return (B_TRUE); 2081*bd670b35SErik Nordmark } 2082*bd670b35SErik Nordmark rw_exit(&irb->irb_lock); 2083*bd670b35SErik Nordmark return (B_FALSE); 2084*bd670b35SErik Nordmark } 2085*bd670b35SErik Nordmark 2086*bd670b35SErik Nordmark /* 2087*bd670b35SErik Nordmark * Check if the zoneid (not ALL_ZONES) has an IRE_INTERFACE for the specified 2088*bd670b35SErik Nordmark * gateway address. If ill is non-NULL we also match on it. 2089*bd670b35SErik Nordmark * The caller must hold a read lock on RADIX_NODE_HEAD if lock_held is set. 20905597b60aSnordmark */ 20915597b60aSnordmark boolean_t 2092*bd670b35SErik Nordmark ire_gateway_ok_zone_v4(ipaddr_t gateway, zoneid_t zoneid, ill_t *ill, 2093*bd670b35SErik Nordmark const ts_label_t *tsl, ip_stack_t *ipst, boolean_t lock_held) 20945597b60aSnordmark { 2095*bd670b35SErik Nordmark struct rt_sockaddr rdst; 2096*bd670b35SErik Nordmark struct rt_entry *rt; 2097*bd670b35SErik Nordmark ire_ftable_args_t margs; 2098e11c3f44Smeem 2099*bd670b35SErik Nordmark ASSERT(ill == NULL || !ill->ill_isv6); 2100*bd670b35SErik Nordmark if (lock_held) 2101*bd670b35SErik Nordmark ASSERT(RW_READ_HELD(&ipst->ips_ip_ftable->rnh_lock)); 21027c478bd9Sstevel@tonic-gate else 2103*bd670b35SErik Nordmark RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); 2104*bd670b35SErik Nordmark 2105*bd670b35SErik Nordmark rdst.rt_sin_len = sizeof (rdst); 2106*bd670b35SErik Nordmark rdst.rt_sin_family = AF_INET; 2107*bd670b35SErik Nordmark rdst.rt_sin_addr.s_addr = gateway; 2108*bd670b35SErik Nordmark 2109*bd670b35SErik Nordmark /* 2110*bd670b35SErik Nordmark * We only use margs for ill, zoneid, and tsl matching in 2111*bd670b35SErik Nordmark * ire_find_zoneid 2112*bd670b35SErik Nordmark */ 2113*bd670b35SErik Nordmark (void) memset(&margs, 0, sizeof (margs)); 2114*bd670b35SErik Nordmark margs.ift_ill = ill; 2115*bd670b35SErik Nordmark margs.ift_zoneid = zoneid; 2116*bd670b35SErik Nordmark margs.ift_tsl = tsl; 2117*bd670b35SErik Nordmark rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst, 2118*bd670b35SErik Nordmark ipst->ips_ip_ftable, ire_find_zoneid, (void *)&margs); 2119*bd670b35SErik Nordmark 2120*bd670b35SErik Nordmark if (!lock_held) 2121*bd670b35SErik Nordmark RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 2122*bd670b35SErik Nordmark 2123*bd670b35SErik Nordmark return (rt != NULL); 21247c478bd9Sstevel@tonic-gate } 21257c478bd9Sstevel@tonic-gate 21267c478bd9Sstevel@tonic-gate /* 2127*bd670b35SErik Nordmark * ire_walk routine to delete a fraction of redirect IREs and IRE_CLONE_IF IREs. 2128*bd670b35SErik Nordmark * The fraction argument tells us what fraction of the IREs to delete. 2129*bd670b35SErik Nordmark * Common for IPv4 and IPv6. 2130*bd670b35SErik Nordmark * Used when memory backpressure. 21317c478bd9Sstevel@tonic-gate */ 2132*bd670b35SErik Nordmark static void 2133*bd670b35SErik Nordmark ire_delete_reclaim(ire_t *ire, char *arg) 21347c478bd9Sstevel@tonic-gate { 2135*bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 2136*bd670b35SErik Nordmark uint_t fraction = *(uint_t *)arg; 21377c478bd9Sstevel@tonic-gate uint_t rand; 21387c478bd9Sstevel@tonic-gate 2139*bd670b35SErik Nordmark if ((ire->ire_flags & RTF_DYNAMIC) || 2140*bd670b35SErik Nordmark (ire->ire_type & IRE_IF_CLONE)) { 21417c478bd9Sstevel@tonic-gate 2142*bd670b35SErik Nordmark /* Pick a random number */ 21437c478bd9Sstevel@tonic-gate rand = (uint_t)lbolt + 2144*bd670b35SErik Nordmark IRE_ADDR_HASH_V6(ire->ire_addr_v6, 256); 2145*bd670b35SErik Nordmark 2146*bd670b35SErik Nordmark /* Use truncation */ 2147*bd670b35SErik Nordmark if ((rand/fraction)*fraction == rand) { 2148*bd670b35SErik Nordmark IP_STAT(ipst, ip_ire_reclaim_deleted); 21497c478bd9Sstevel@tonic-gate ire_delete(ire); 21507c478bd9Sstevel@tonic-gate } 21517c478bd9Sstevel@tonic-gate } 2152*bd670b35SErik Nordmark 21537c478bd9Sstevel@tonic-gate } 2154*bd670b35SErik Nordmark 21557c478bd9Sstevel@tonic-gate /* 2156*bd670b35SErik Nordmark * kmem_cache callback to free up memory. 2157*bd670b35SErik Nordmark * 2158*bd670b35SErik Nordmark * Free a fraction (ips_ip_ire_reclaim_fraction) of things IP added dynamically 2159*bd670b35SErik Nordmark * (RTF_DYNAMIC and IRE_IF_CLONE). 21607c478bd9Sstevel@tonic-gate */ 2161*bd670b35SErik Nordmark static void 2162*bd670b35SErik Nordmark ip_ire_reclaim_stack(ip_stack_t *ipst) 2163*bd670b35SErik Nordmark { 2164*bd670b35SErik Nordmark uint_t fraction = ipst->ips_ip_ire_reclaim_fraction; 2165*bd670b35SErik Nordmark 2166*bd670b35SErik Nordmark IP_STAT(ipst, ip_ire_reclaim_calls); 2167*bd670b35SErik Nordmark 2168*bd670b35SErik Nordmark ire_walk(ire_delete_reclaim, &fraction, ipst); 2169*bd670b35SErik Nordmark 2170*bd670b35SErik Nordmark /* 2171*bd670b35SErik Nordmark * Walk all CONNs that can have a reference on an ire, nce or dce. 2172*bd670b35SErik Nordmark * Get them to update any stale references to drop any refholds they 2173*bd670b35SErik Nordmark * have. 2174*bd670b35SErik Nordmark */ 2175*bd670b35SErik Nordmark ipcl_walk(conn_ixa_cleanup, (void *)B_FALSE, ipst); 2176*bd670b35SErik Nordmark } 2177*bd670b35SErik Nordmark 2178*bd670b35SErik Nordmark /* 2179*bd670b35SErik Nordmark * Called by the memory allocator subsystem directly, when the system 2180*bd670b35SErik Nordmark * is running low on memory. 2181*bd670b35SErik Nordmark */ 2182*bd670b35SErik Nordmark /* ARGSUSED */ 2183*bd670b35SErik Nordmark void 2184*bd670b35SErik Nordmark ip_ire_reclaim(void *args) 2185*bd670b35SErik Nordmark { 2186*bd670b35SErik Nordmark netstack_handle_t nh; 2187*bd670b35SErik Nordmark netstack_t *ns; 2188*bd670b35SErik Nordmark 2189*bd670b35SErik Nordmark netstack_next_init(&nh); 2190*bd670b35SErik Nordmark while ((ns = netstack_next(&nh)) != NULL) { 2191*bd670b35SErik Nordmark ip_ire_reclaim_stack(ns->netstack_ip); 2192*bd670b35SErik Nordmark netstack_rele(ns); 2193*bd670b35SErik Nordmark } 2194*bd670b35SErik Nordmark netstack_next_fini(&nh); 21957c478bd9Sstevel@tonic-gate } 21967c478bd9Sstevel@tonic-gate 21977c478bd9Sstevel@tonic-gate static void 21987c478bd9Sstevel@tonic-gate power2_roundup(uint32_t *value) 21997c478bd9Sstevel@tonic-gate { 22007c478bd9Sstevel@tonic-gate int i; 22017c478bd9Sstevel@tonic-gate 22027c478bd9Sstevel@tonic-gate for (i = 1; i < 31; i++) { 22037c478bd9Sstevel@tonic-gate if (*value <= (1 << i)) 22047c478bd9Sstevel@tonic-gate break; 22057c478bd9Sstevel@tonic-gate } 22067c478bd9Sstevel@tonic-gate *value = (1 << i); 22077c478bd9Sstevel@tonic-gate } 22087c478bd9Sstevel@tonic-gate 2209f4b3ec61Sdh155122 /* Global init for all zones */ 22107c478bd9Sstevel@tonic-gate void 2211f4b3ec61Sdh155122 ip_ire_g_init() 22127c478bd9Sstevel@tonic-gate { 22137c478bd9Sstevel@tonic-gate /* 2214*bd670b35SErik Nordmark * Create kmem_caches. ip_ire_reclaim() and ip_nce_reclaim() 2215*bd670b35SErik Nordmark * will give disposable IREs back to system when needed. 22167c478bd9Sstevel@tonic-gate * This needs to be done here before anything else, since 22177c478bd9Sstevel@tonic-gate * ire_add() expects the cache to be created. 22187c478bd9Sstevel@tonic-gate */ 22197c478bd9Sstevel@tonic-gate ire_cache = kmem_cache_create("ire_cache", 2220*bd670b35SErik Nordmark sizeof (ire_t), 0, NULL, NULL, 2221*bd670b35SErik Nordmark ip_ire_reclaim, NULL, NULL, 0); 2222*bd670b35SErik Nordmark 2223*bd670b35SErik Nordmark ncec_cache = kmem_cache_create("ncec_cache", 2224*bd670b35SErik Nordmark sizeof (ncec_t), 0, NULL, NULL, 2225*bd670b35SErik Nordmark ip_nce_reclaim, NULL, NULL, 0); 2226*bd670b35SErik Nordmark nce_cache = kmem_cache_create("nce_cache", 2227*bd670b35SErik Nordmark sizeof (nce_t), 0, NULL, NULL, 2228*bd670b35SErik Nordmark NULL, NULL, NULL, 0); 22297c478bd9Sstevel@tonic-gate 2230f4b3ec61Sdh155122 rt_entry_cache = kmem_cache_create("rt_entry", 2231f4b3ec61Sdh155122 sizeof (struct rt_entry), 0, NULL, NULL, NULL, NULL, NULL, 0); 2232f4b3ec61Sdh155122 2233f4b3ec61Sdh155122 /* 2234f4b3ec61Sdh155122 * Have radix code setup kmem caches etc. 2235f4b3ec61Sdh155122 */ 2236f4b3ec61Sdh155122 rn_init(); 2237f4b3ec61Sdh155122 } 2238f4b3ec61Sdh155122 2239f4b3ec61Sdh155122 void 2240f4b3ec61Sdh155122 ip_ire_init(ip_stack_t *ipst) 2241f4b3ec61Sdh155122 { 2242*bd670b35SErik Nordmark ire_t *ire; 2243*bd670b35SErik Nordmark int error; 2244f4b3ec61Sdh155122 2245f4b3ec61Sdh155122 mutex_init(&ipst->ips_ire_ft_init_lock, NULL, MUTEX_DEFAULT, 0); 2246f4b3ec61Sdh155122 2247f4b3ec61Sdh155122 (void) rn_inithead((void **)&ipst->ips_ip_ftable, 32); 2248f4b3ec61Sdh155122 22497c478bd9Sstevel@tonic-gate /* 22507c478bd9Sstevel@tonic-gate * Make sure that the forwarding table size is a power of 2. 22517c478bd9Sstevel@tonic-gate * The IRE*_ADDR_HASH() macroes depend on that. 22527c478bd9Sstevel@tonic-gate */ 2253f4b3ec61Sdh155122 ipst->ips_ip6_ftable_hash_size = ip6_ftable_hash_size; 2254f4b3ec61Sdh155122 power2_roundup(&ipst->ips_ip6_ftable_hash_size); 2255f4b3ec61Sdh155122 2256*bd670b35SErik Nordmark /* 2257*bd670b35SErik Nordmark * Allocate/initialize a pair of IRE_NOROUTEs for each of IPv4 and IPv6. 2258*bd670b35SErik Nordmark * The ire_reject_v* has RTF_REJECT set, and the ire_blackhole_v* has 2259*bd670b35SErik Nordmark * RTF_BLACKHOLE set. We use the latter for transient errors such 2260*bd670b35SErik Nordmark * as memory allocation failures and tripping on IRE_IS_CONDEMNED 2261*bd670b35SErik Nordmark * entries. 2262*bd670b35SErik Nordmark */ 2263*bd670b35SErik Nordmark ire = kmem_cache_alloc(ire_cache, KM_SLEEP); 2264*bd670b35SErik Nordmark *ire = ire_null; 2265*bd670b35SErik Nordmark error = ire_init_v4(ire, 0, 0, 0, IRE_NOROUTE, NULL, ALL_ZONES, 2266*bd670b35SErik Nordmark RTF_REJECT|RTF_UP, NULL, ipst); 2267*bd670b35SErik Nordmark ASSERT(error == 0); 2268*bd670b35SErik Nordmark ipst->ips_ire_reject_v4 = ire; 2269*bd670b35SErik Nordmark 2270*bd670b35SErik Nordmark ire = kmem_cache_alloc(ire_cache, KM_SLEEP); 2271*bd670b35SErik Nordmark *ire = ire_null; 2272*bd670b35SErik Nordmark error = ire_init_v6(ire, 0, 0, 0, IRE_NOROUTE, NULL, ALL_ZONES, 2273*bd670b35SErik Nordmark RTF_REJECT|RTF_UP, NULL, ipst); 2274*bd670b35SErik Nordmark ASSERT(error == 0); 2275*bd670b35SErik Nordmark ipst->ips_ire_reject_v6 = ire; 2276*bd670b35SErik Nordmark 2277*bd670b35SErik Nordmark ire = kmem_cache_alloc(ire_cache, KM_SLEEP); 2278*bd670b35SErik Nordmark *ire = ire_null; 2279*bd670b35SErik Nordmark error = ire_init_v4(ire, 0, 0, 0, IRE_NOROUTE, NULL, ALL_ZONES, 2280*bd670b35SErik Nordmark RTF_BLACKHOLE|RTF_UP, NULL, ipst); 2281*bd670b35SErik Nordmark ASSERT(error == 0); 2282*bd670b35SErik Nordmark ipst->ips_ire_blackhole_v4 = ire; 2283*bd670b35SErik Nordmark 2284*bd670b35SErik Nordmark ire = kmem_cache_alloc(ire_cache, KM_SLEEP); 2285*bd670b35SErik Nordmark *ire = ire_null; 2286*bd670b35SErik Nordmark error = ire_init_v6(ire, 0, 0, 0, IRE_NOROUTE, NULL, ALL_ZONES, 2287*bd670b35SErik Nordmark RTF_BLACKHOLE|RTF_UP, NULL, ipst); 2288*bd670b35SErik Nordmark ASSERT(error == 0); 2289*bd670b35SErik Nordmark ipst->ips_ire_blackhole_v6 = ire; 2290*bd670b35SErik Nordmark 2291*bd670b35SErik Nordmark rw_init(&ipst->ips_ip6_ire_head_lock, NULL, RW_DEFAULT, NULL); 2292*bd670b35SErik Nordmark rw_init(&ipst->ips_ire_dep_lock, NULL, RW_DEFAULT, NULL); 22937c478bd9Sstevel@tonic-gate } 22947c478bd9Sstevel@tonic-gate 22957c478bd9Sstevel@tonic-gate void 2296f4b3ec61Sdh155122 ip_ire_g_fini(void) 2297f4b3ec61Sdh155122 { 2298f4b3ec61Sdh155122 kmem_cache_destroy(ire_cache); 2299*bd670b35SErik Nordmark kmem_cache_destroy(ncec_cache); 2300*bd670b35SErik Nordmark kmem_cache_destroy(nce_cache); 2301f4b3ec61Sdh155122 kmem_cache_destroy(rt_entry_cache); 2302f4b3ec61Sdh155122 2303f4b3ec61Sdh155122 rn_fini(); 2304f4b3ec61Sdh155122 } 2305f4b3ec61Sdh155122 2306f4b3ec61Sdh155122 void 2307f4b3ec61Sdh155122 ip_ire_fini(ip_stack_t *ipst) 23087c478bd9Sstevel@tonic-gate { 23097c478bd9Sstevel@tonic-gate int i; 23107c478bd9Sstevel@tonic-gate 2311*bd670b35SErik Nordmark rw_destroy(&ipst->ips_ire_dep_lock); 2312*bd670b35SErik Nordmark rw_destroy(&ipst->ips_ip6_ire_head_lock); 2313*bd670b35SErik Nordmark 2314*bd670b35SErik Nordmark ire_refrele_notr(ipst->ips_ire_reject_v6); 2315*bd670b35SErik Nordmark ipst->ips_ire_reject_v6 = NULL; 2316*bd670b35SErik Nordmark ire_refrele_notr(ipst->ips_ire_reject_v4); 2317*bd670b35SErik Nordmark ipst->ips_ire_reject_v4 = NULL; 2318*bd670b35SErik Nordmark ire_refrele_notr(ipst->ips_ire_blackhole_v6); 2319*bd670b35SErik Nordmark ipst->ips_ire_blackhole_v6 = NULL; 2320*bd670b35SErik Nordmark ire_refrele_notr(ipst->ips_ire_blackhole_v4); 2321*bd670b35SErik Nordmark ipst->ips_ire_blackhole_v4 = NULL; 2322*bd670b35SErik Nordmark 2323f4b3ec61Sdh155122 /* 2324f4b3ec61Sdh155122 * Delete all IREs - assumes that the ill/ipifs have 2325*bd670b35SErik Nordmark * been removed so what remains are just the ftable to handle. 2326f4b3ec61Sdh155122 */ 2327f4b3ec61Sdh155122 ire_walk(ire_delete, NULL, ipst); 2328c793af95Ssangeeta 2329f4b3ec61Sdh155122 rn_freehead(ipst->ips_ip_ftable); 2330f4b3ec61Sdh155122 ipst->ips_ip_ftable = NULL; 23317c478bd9Sstevel@tonic-gate 2332f4b3ec61Sdh155122 mutex_destroy(&ipst->ips_ire_ft_init_lock); 23337c478bd9Sstevel@tonic-gate 2334f4b3ec61Sdh155122 for (i = 0; i < IP6_MASK_TABLE_SIZE; i++) { 2335f4b3ec61Sdh155122 irb_t *ptr; 2336f4b3ec61Sdh155122 int j; 2337f4b3ec61Sdh155122 2338f4b3ec61Sdh155122 if ((ptr = ipst->ips_ip_forwarding_table_v6[i]) == NULL) 2339f4b3ec61Sdh155122 continue; 2340f4b3ec61Sdh155122 2341f4b3ec61Sdh155122 for (j = 0; j < ipst->ips_ip6_ftable_hash_size; j++) { 2342f4b3ec61Sdh155122 ASSERT(ptr[j].irb_ire == NULL); 2343f4b3ec61Sdh155122 rw_destroy(&ptr[j].irb_lock); 2344f4b3ec61Sdh155122 } 2345f4b3ec61Sdh155122 mi_free(ptr); 2346f4b3ec61Sdh155122 ipst->ips_ip_forwarding_table_v6[i] = NULL; 2347f4b3ec61Sdh155122 } 23487c478bd9Sstevel@tonic-gate } 23497c478bd9Sstevel@tonic-gate 23506a8288c7Scarlsonj #ifdef DEBUG 23517c478bd9Sstevel@tonic-gate void 23527c478bd9Sstevel@tonic-gate ire_trace_ref(ire_t *ire) 23537c478bd9Sstevel@tonic-gate { 23547c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 23556a8288c7Scarlsonj if (ire->ire_trace_disable) { 23567c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 23577c478bd9Sstevel@tonic-gate return; 23587c478bd9Sstevel@tonic-gate } 23596a8288c7Scarlsonj 23606a8288c7Scarlsonj if (th_trace_ref(ire, ire->ire_ipst)) { 23616a8288c7Scarlsonj mutex_exit(&ire->ire_lock); 23626a8288c7Scarlsonj } else { 23637c478bd9Sstevel@tonic-gate ire->ire_trace_disable = B_TRUE; 23647c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 23656a8288c7Scarlsonj ire_trace_cleanup(ire); 23667c478bd9Sstevel@tonic-gate } 23677c478bd9Sstevel@tonic-gate } 23687c478bd9Sstevel@tonic-gate 23697c478bd9Sstevel@tonic-gate void 23707c478bd9Sstevel@tonic-gate ire_untrace_ref(ire_t *ire) 23717c478bd9Sstevel@tonic-gate { 23727c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock); 23736a8288c7Scarlsonj if (!ire->ire_trace_disable) 23746a8288c7Scarlsonj th_trace_unref(ire); 23757c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock); 23767c478bd9Sstevel@tonic-gate } 23777c478bd9Sstevel@tonic-gate 23787c478bd9Sstevel@tonic-gate static void 23796a8288c7Scarlsonj ire_trace_cleanup(const ire_t *ire) 23807c478bd9Sstevel@tonic-gate { 23816a8288c7Scarlsonj th_trace_cleanup(ire, ire->ire_trace_disable); 23827c478bd9Sstevel@tonic-gate } 23836a8288c7Scarlsonj #endif /* DEBUG */ 2384c793af95Ssangeeta 2385c793af95Ssangeeta /* 2386*bd670b35SErik Nordmark * Find, or create if needed, the nce_t pointer to the neighbor cache 2387*bd670b35SErik Nordmark * entry ncec_t for an IPv4 address. The nce_t will be created on the ill_t 2388*bd670b35SErik Nordmark * in the non-IPMP case, or on the cast-ill in the IPMP bcast/mcast case, or 2389*bd670b35SErik Nordmark * on the next available under-ill (selected by the IPMP rotor) in the 2390*bd670b35SErik Nordmark * unicast IPMP case. 239154da8755Ssowmini * 239254da8755Ssowmini * If a neighbor-cache entry has to be created (i.e., one does not already 2393*bd670b35SErik Nordmark * exist in the nce list) the ncec_lladdr and ncec_state of the neighbor cache 2394*bd670b35SErik Nordmark * entry are initialized in nce_add_v4(). The broadcast, multicast, and 2395*bd670b35SErik Nordmark * link-layer type determine the contents of {ncec_state, ncec_lladdr} of 2396*bd670b35SErik Nordmark * the ncec_t created. The ncec_lladdr is non-null for all link types with 2397*bd670b35SErik Nordmark * non-zero ill_phys_addr_length, though the contents may be zero in cases 2398*bd670b35SErik Nordmark * where the link-layer type is not known at the time of creation 2399*bd670b35SErik Nordmark * (e.g., IRE_IFRESOLVER links) 2400*bd670b35SErik Nordmark * 2401*bd670b35SErik Nordmark * All IRE_BROADCAST entries have ncec_state = ND_REACHABLE, and the nce_lladr 2402*bd670b35SErik Nordmark * has the physical broadcast address of the outgoing interface. 2403*bd670b35SErik Nordmark * For unicast ire entries, 240454da8755Ssowmini * - if the outgoing interface is of type IRE_IF_RESOLVER, a newly created 2405*bd670b35SErik Nordmark * ncec_t with 0 nce_lladr contents, and will be in the ND_INITIAL state. 240654da8755Ssowmini * - if the outgoing interface is a IRE_IF_NORESOLVER interface, no link 2407*bd670b35SErik Nordmark * layer resolution is necessary, so that the ncec_t will be in the 2408*bd670b35SErik Nordmark * ND_REACHABLE state 240954da8755Ssowmini * 241054da8755Ssowmini * The link layer information needed for broadcast addresses, and for 241154da8755Ssowmini * packets sent on IRE_IF_NORESOLVER interfaces is a constant mapping that 2412*bd670b35SErik Nordmark * never needs re-verification for the lifetime of the ncec_t. These are 2413*bd670b35SErik Nordmark * therefore marked NCE_F_NONUD. 241454da8755Ssowmini * 2415*bd670b35SErik Nordmark * The nce returned will be created such that the nce_ill == ill that 2416*bd670b35SErik Nordmark * is passed in. Note that the nce itself may not have ncec_ill == ill 2417*bd670b35SErik Nordmark * where IPMP links are involved. 2418c793af95Ssangeeta */ 2419*bd670b35SErik Nordmark static nce_t * 2420*bd670b35SErik Nordmark ire_nce_init(ill_t *ill, const void *addr, int ire_type) 2421c793af95Ssangeeta { 2422c793af95Ssangeeta int err; 242354da8755Ssowmini nce_t *nce = NULL; 2424*bd670b35SErik Nordmark uint16_t ncec_flags; 2425*bd670b35SErik Nordmark uchar_t *hwaddr; 2426*bd670b35SErik Nordmark boolean_t need_refrele = B_FALSE; 2427*bd670b35SErik Nordmark ill_t *in_ill = ill; 2428*bd670b35SErik Nordmark boolean_t is_unicast; 2429*bd670b35SErik Nordmark uint_t hwaddr_len; 2430c793af95Ssangeeta 2431*bd670b35SErik Nordmark is_unicast = ((ire_type & (IRE_MULTICAST|IRE_BROADCAST)) == 0); 2432*bd670b35SErik Nordmark if (IS_IPMP(ill) || 2433*bd670b35SErik Nordmark ((ire_type & IRE_BROADCAST) && IS_UNDER_IPMP(ill))) { 2434*bd670b35SErik Nordmark if ((ill = ipmp_ill_get_xmit_ill(ill, is_unicast)) == NULL) 2435*bd670b35SErik Nordmark return (NULL); 2436*bd670b35SErik Nordmark need_refrele = B_TRUE; 2437*bd670b35SErik Nordmark } 2438*bd670b35SErik Nordmark ncec_flags = (ill->ill_flags & ILLF_NONUD) ? NCE_F_NONUD : 0; 2439c793af95Ssangeeta 2440*bd670b35SErik Nordmark switch (ire_type) { 2441c793af95Ssangeeta case IRE_BROADCAST: 2442*bd670b35SErik Nordmark ASSERT(!ill->ill_isv6); 2443*bd670b35SErik Nordmark ncec_flags |= (NCE_F_BCAST|NCE_F_NONUD); 2444c793af95Ssangeeta break; 2445*bd670b35SErik Nordmark case IRE_MULTICAST: 2446*bd670b35SErik Nordmark ncec_flags |= (NCE_F_MCAST|NCE_F_NONUD); 2447*bd670b35SErik Nordmark break; 2448c793af95Ssangeeta } 2449c793af95Ssangeeta 2450*bd670b35SErik Nordmark if (ill->ill_net_type == IRE_IF_NORESOLVER && is_unicast) { 2451*bd670b35SErik Nordmark hwaddr = ill->ill_dest_addr; 2452*bd670b35SErik Nordmark } else { 2453*bd670b35SErik Nordmark hwaddr = NULL; 2454b9c344b3Ssowmini } 2455*bd670b35SErik Nordmark hwaddr_len = ill->ill_phys_addr_length; 2456b9c344b3Ssowmini 2457*bd670b35SErik Nordmark retry: 2458*bd670b35SErik Nordmark /* nce_state will be computed by nce_add_common() */ 2459*bd670b35SErik Nordmark if (!ill->ill_isv6) { 2460*bd670b35SErik Nordmark err = nce_lookup_then_add_v4(ill, hwaddr, hwaddr_len, addr, 2461*bd670b35SErik Nordmark ncec_flags, ND_UNCHANGED, &nce); 2462*bd670b35SErik Nordmark } else { 2463*bd670b35SErik Nordmark err = nce_lookup_then_add_v6(ill, hwaddr, hwaddr_len, addr, 2464*bd670b35SErik Nordmark ncec_flags, ND_UNCHANGED, &nce); 2465*bd670b35SErik Nordmark } 2466c793af95Ssangeeta 2467c793af95Ssangeeta switch (err) { 2468c793af95Ssangeeta case 0: 2469*bd670b35SErik Nordmark break; 2470c793af95Ssangeeta case EEXIST: 2471c793af95Ssangeeta /* 2472*bd670b35SErik Nordmark * When subnets change or partially overlap what was once 2473*bd670b35SErik Nordmark * a broadcast address could now be a unicast, or vice versa. 2474c793af95Ssangeeta */ 2475*bd670b35SErik Nordmark if (((ncec_flags ^ nce->nce_common->ncec_flags) & 2476*bd670b35SErik Nordmark NCE_F_BCAST) != 0) { 2477*bd670b35SErik Nordmark ASSERT(!ill->ill_isv6); 2478*bd670b35SErik Nordmark ncec_delete(nce->nce_common); 2479*bd670b35SErik Nordmark nce_refrele(nce); 2480*bd670b35SErik Nordmark goto retry; 2481*bd670b35SErik Nordmark } 2482c793af95Ssangeeta break; 2483c793af95Ssangeeta default: 2484*bd670b35SErik Nordmark DTRACE_PROBE2(nce__init__fail, ill_t *, ill, int, err); 2485*bd670b35SErik Nordmark if (need_refrele) 2486*bd670b35SErik Nordmark ill_refrele(ill); 2487*bd670b35SErik Nordmark return (NULL); 2488c793af95Ssangeeta } 24899294ad19SSowmini Varadhan /* 2490*bd670b35SErik Nordmark * If the ill was an under-ill of an IPMP group, we need to verify 2491*bd670b35SErik Nordmark * that it is still active so that we select an active interface in 2492*bd670b35SErik Nordmark * the group. However, since ipmp_ill_is_active ASSERTs for 2493*bd670b35SErik Nordmark * IS_UNDER_IPMP(), we first need to verify that the ill is an 2494*bd670b35SErik Nordmark * under-ill, and since this is being done in the data path, the 2495*bd670b35SErik Nordmark * only way to ascertain this is by holding the ill_g_lock. 24969294ad19SSowmini Varadhan */ 2497*bd670b35SErik Nordmark rw_enter(&ill->ill_ipst->ips_ill_g_lock, RW_READER); 2498*bd670b35SErik Nordmark mutex_enter(&ill->ill_lock); 2499*bd670b35SErik Nordmark mutex_enter(&ill->ill_phyint->phyint_lock); 2500*bd670b35SErik Nordmark if (need_refrele && IS_UNDER_IPMP(ill) && !ipmp_ill_is_active(ill)) { 2501c793af95Ssangeeta /* 2502*bd670b35SErik Nordmark * need_refrele implies that the under ill was selected by 2503*bd670b35SErik Nordmark * ipmp_ill_get_xmit_ill() because either the in_ill was an 2504*bd670b35SErik Nordmark * ipmp_ill, or we are sending a non-unicast packet on 2505*bd670b35SErik Nordmark * an under_ill. However, when we get here, the ill selected by 2506*bd670b35SErik Nordmark * ipmp_ill_get_xmit_ill was pulled out of the active set 2507*bd670b35SErik Nordmark * (for unicast) or cast_ill nomination (for 2508*bd670b35SErik Nordmark * !unicast) after it was picked as the outgoing ill. 2509*bd670b35SErik Nordmark * We have to pick an active interface and/or cast_ill in the 2510*bd670b35SErik Nordmark * group. 2511c793af95Ssangeeta */ 2512*bd670b35SErik Nordmark mutex_exit(&ill->ill_phyint->phyint_lock); 2513*bd670b35SErik Nordmark nce_delete(nce); 2514*bd670b35SErik Nordmark mutex_exit(&ill->ill_lock); 2515*bd670b35SErik Nordmark rw_exit(&ill->ill_ipst->ips_ill_g_lock); 2516*bd670b35SErik Nordmark nce_refrele(nce); 2517*bd670b35SErik Nordmark ill_refrele(ill); 2518*bd670b35SErik Nordmark if ((ill = ipmp_ill_get_xmit_ill(in_ill, is_unicast)) == NULL) 2519*bd670b35SErik Nordmark return (NULL); 2520*bd670b35SErik Nordmark goto retry; 2521c793af95Ssangeeta } else { 2522*bd670b35SErik Nordmark mutex_exit(&ill->ill_phyint->phyint_lock); 2523*bd670b35SErik Nordmark mutex_exit(&ill->ill_lock); 2524*bd670b35SErik Nordmark rw_exit(&ill->ill_ipst->ips_ill_g_lock); 2525*bd670b35SErik Nordmark } 2526*bd670b35SErik Nordmark done: 2527*bd670b35SErik Nordmark ASSERT(nce->nce_ill == ill); 2528*bd670b35SErik Nordmark if (need_refrele) 2529*bd670b35SErik Nordmark ill_refrele(ill); 2530*bd670b35SErik Nordmark return (nce); 2531*bd670b35SErik Nordmark } 2532*bd670b35SErik Nordmark 2533*bd670b35SErik Nordmark nce_t * 2534*bd670b35SErik Nordmark arp_nce_init(ill_t *ill, in_addr_t addr4, int ire_type) 2535*bd670b35SErik Nordmark { 2536*bd670b35SErik Nordmark return (ire_nce_init(ill, &addr4, ire_type)); 2537*bd670b35SErik Nordmark } 2538*bd670b35SErik Nordmark 2539*bd670b35SErik Nordmark nce_t * 2540*bd670b35SErik Nordmark ndp_nce_init(ill_t *ill, const in6_addr_t *addr6, int ire_type) 2541*bd670b35SErik Nordmark { 2542*bd670b35SErik Nordmark ASSERT((ire_type & IRE_BROADCAST) == 0); 2543*bd670b35SErik Nordmark return (ire_nce_init(ill, addr6, ire_type)); 2544*bd670b35SErik Nordmark } 2545*bd670b35SErik Nordmark 2546*bd670b35SErik Nordmark /* 2547*bd670b35SErik Nordmark * The caller should hold irb_lock as a writer if the ire is in a bucket. 2548*bd670b35SErik Nordmark */ 2549*bd670b35SErik Nordmark void 2550*bd670b35SErik Nordmark ire_make_condemned(ire_t *ire) 2551*bd670b35SErik Nordmark { 2552*bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 2553*bd670b35SErik Nordmark 2554*bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 2555*bd670b35SErik Nordmark ASSERT(ire->ire_bucket == NULL || 2556*bd670b35SErik Nordmark RW_WRITE_HELD(&ire->ire_bucket->irb_lock)); 2557*bd670b35SErik Nordmark ASSERT(!IRE_IS_CONDEMNED(ire)); 2558*bd670b35SErik Nordmark ire->ire_generation = IRE_GENERATION_CONDEMNED; 2559*bd670b35SErik Nordmark /* Count how many condemned ires for kmem_cache callback */ 2560*bd670b35SErik Nordmark atomic_add_32(&ipst->ips_num_ire_condemned, 1); 2561*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 2562*bd670b35SErik Nordmark } 2563*bd670b35SErik Nordmark 2564*bd670b35SErik Nordmark /* 2565*bd670b35SErik Nordmark * Increment the generation avoiding the special condemned value 2566*bd670b35SErik Nordmark */ 2567*bd670b35SErik Nordmark void 2568*bd670b35SErik Nordmark ire_increment_generation(ire_t *ire) 2569*bd670b35SErik Nordmark { 2570*bd670b35SErik Nordmark uint_t generation; 2571*bd670b35SErik Nordmark 2572*bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 2573*bd670b35SErik Nordmark /* 2574*bd670b35SErik Nordmark * Even though the caller has a hold it can't prevent a concurrent 2575*bd670b35SErik Nordmark * ire_delete marking the IRE condemned 2576*bd670b35SErik Nordmark */ 2577*bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(ire)) { 2578*bd670b35SErik Nordmark generation = ire->ire_generation + 1; 2579*bd670b35SErik Nordmark if (generation == IRE_GENERATION_CONDEMNED) 2580*bd670b35SErik Nordmark generation = IRE_GENERATION_INITIAL; 2581*bd670b35SErik Nordmark ASSERT(generation != IRE_GENERATION_VERIFY); 2582*bd670b35SErik Nordmark ire->ire_generation = generation; 2583*bd670b35SErik Nordmark } 2584*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 2585*bd670b35SErik Nordmark } 2586*bd670b35SErik Nordmark 2587*bd670b35SErik Nordmark /* 2588*bd670b35SErik Nordmark * Increment ire_generation on all the IRE_MULTICASTs 2589*bd670b35SErik Nordmark * Used when the default multicast interface (as determined by 2590*bd670b35SErik Nordmark * ill_lookup_multicast) might have changed. 2591*bd670b35SErik Nordmark * 2592*bd670b35SErik Nordmark * That includes the zoneid, IFF_ flags, the IPv6 scope of the address, and 2593*bd670b35SErik Nordmark * ill unplumb. 2594*bd670b35SErik Nordmark */ 2595*bd670b35SErik Nordmark void 2596*bd670b35SErik Nordmark ire_increment_multicast_generation(ip_stack_t *ipst, boolean_t isv6) 2597*bd670b35SErik Nordmark { 2598*bd670b35SErik Nordmark ill_t *ill; 2599*bd670b35SErik Nordmark ill_walk_context_t ctx; 2600*bd670b35SErik Nordmark 2601*bd670b35SErik Nordmark rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2602*bd670b35SErik Nordmark if (isv6) 2603*bd670b35SErik Nordmark ill = ILL_START_WALK_V6(&ctx, ipst); 2604*bd670b35SErik Nordmark else 2605*bd670b35SErik Nordmark ill = ILL_START_WALK_V4(&ctx, ipst); 2606*bd670b35SErik Nordmark for (; ill != NULL; ill = ill_next(&ctx, ill)) { 2607*bd670b35SErik Nordmark if (ILL_IS_CONDEMNED(ill)) 2608*bd670b35SErik Nordmark continue; 2609*bd670b35SErik Nordmark if (ill->ill_ire_multicast != NULL) 2610*bd670b35SErik Nordmark ire_increment_generation(ill->ill_ire_multicast); 2611*bd670b35SErik Nordmark } 2612*bd670b35SErik Nordmark rw_exit(&ipst->ips_ill_g_lock); 2613*bd670b35SErik Nordmark } 2614*bd670b35SErik Nordmark 2615*bd670b35SErik Nordmark /* 2616*bd670b35SErik Nordmark * Return a held IRE_NOROUTE with RTF_REJECT set 2617*bd670b35SErik Nordmark */ 2618*bd670b35SErik Nordmark ire_t * 2619*bd670b35SErik Nordmark ire_reject(ip_stack_t *ipst, boolean_t isv6) 2620*bd670b35SErik Nordmark { 2621*bd670b35SErik Nordmark ire_t *ire; 2622*bd670b35SErik Nordmark 2623*bd670b35SErik Nordmark if (isv6) 2624*bd670b35SErik Nordmark ire = ipst->ips_ire_reject_v6; 2625*bd670b35SErik Nordmark else 2626*bd670b35SErik Nordmark ire = ipst->ips_ire_reject_v4; 2627*bd670b35SErik Nordmark 2628*bd670b35SErik Nordmark ASSERT(ire->ire_generation != IRE_GENERATION_CONDEMNED); 2629*bd670b35SErik Nordmark ire_refhold(ire); 2630*bd670b35SErik Nordmark return (ire); 2631*bd670b35SErik Nordmark } 2632*bd670b35SErik Nordmark 2633*bd670b35SErik Nordmark /* 2634*bd670b35SErik Nordmark * Return a held IRE_NOROUTE with RTF_BLACKHOLE set 2635*bd670b35SErik Nordmark */ 2636*bd670b35SErik Nordmark ire_t * 2637*bd670b35SErik Nordmark ire_blackhole(ip_stack_t *ipst, boolean_t isv6) 2638*bd670b35SErik Nordmark { 2639*bd670b35SErik Nordmark ire_t *ire; 2640*bd670b35SErik Nordmark 2641*bd670b35SErik Nordmark if (isv6) 2642*bd670b35SErik Nordmark ire = ipst->ips_ire_blackhole_v6; 2643*bd670b35SErik Nordmark else 2644*bd670b35SErik Nordmark ire = ipst->ips_ire_blackhole_v4; 2645*bd670b35SErik Nordmark 2646*bd670b35SErik Nordmark ASSERT(ire->ire_generation != IRE_GENERATION_CONDEMNED); 2647*bd670b35SErik Nordmark ire_refhold(ire); 2648*bd670b35SErik Nordmark return (ire); 2649*bd670b35SErik Nordmark } 2650*bd670b35SErik Nordmark 2651*bd670b35SErik Nordmark /* 2652*bd670b35SErik Nordmark * Return a held IRE_MULTICAST. 2653*bd670b35SErik Nordmark */ 2654*bd670b35SErik Nordmark ire_t * 2655*bd670b35SErik Nordmark ire_multicast(ill_t *ill) 2656*bd670b35SErik Nordmark { 2657*bd670b35SErik Nordmark ire_t *ire = ill->ill_ire_multicast; 2658*bd670b35SErik Nordmark 2659*bd670b35SErik Nordmark ASSERT(ire == NULL || ire->ire_generation != IRE_GENERATION_CONDEMNED); 2660*bd670b35SErik Nordmark if (ire == NULL) 2661*bd670b35SErik Nordmark ire = ire_blackhole(ill->ill_ipst, ill->ill_isv6); 2662*bd670b35SErik Nordmark else 2663*bd670b35SErik Nordmark ire_refhold(ire); 2664*bd670b35SErik Nordmark return (ire); 2665*bd670b35SErik Nordmark } 2666*bd670b35SErik Nordmark 2667*bd670b35SErik Nordmark /* 2668*bd670b35SErik Nordmark * Given an IRE return its nexthop IRE. The nexthop IRE is an IRE_ONLINK 2669*bd670b35SErik Nordmark * that is an exact match (i.e., a /32 for IPv4 and /128 for IPv6). 2670*bd670b35SErik Nordmark * This can return an RTF_REJECT|RTF_BLACKHOLE. 2671*bd670b35SErik Nordmark * The returned IRE is held. 2672*bd670b35SErik Nordmark * The assumption is that ip_select_route() has been called and returned the 2673*bd670b35SErik Nordmark * IRE (thus ip_select_route would have set up the ire_dep* information.) 2674*bd670b35SErik Nordmark * If some IRE is deleteted then ire_dep_remove() will have been called and 2675*bd670b35SErik Nordmark * we might not find a nexthop IRE, in which case we return NULL. 2676*bd670b35SErik Nordmark */ 2677*bd670b35SErik Nordmark ire_t * 2678*bd670b35SErik Nordmark ire_nexthop(ire_t *ire) 2679*bd670b35SErik Nordmark { 2680*bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 2681*bd670b35SErik Nordmark 2682*bd670b35SErik Nordmark /* Acquire lock to walk ire_dep_parent */ 2683*bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 2684*bd670b35SErik Nordmark while (ire != NULL) { 2685*bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 2686*bd670b35SErik Nordmark goto done; 26879294ad19SSowmini Varadhan } 2688c793af95Ssangeeta /* 2689*bd670b35SErik Nordmark * If we find an IRE_ONLINK we are done. This includes 2690*bd670b35SErik Nordmark * the case of IRE_MULTICAST. 2691*bd670b35SErik Nordmark * Note that in order to send packets we need a host-specific 2692*bd670b35SErik Nordmark * IRE_IF_ALL first in the ire_dep_parent chain. Normally this 2693*bd670b35SErik Nordmark * is done by inserting an IRE_IF_CLONE if the IRE_INTERFACE 2694*bd670b35SErik Nordmark * was not host specific. 2695*bd670b35SErik Nordmark * However, ip_rts_request doesn't want to send packets 2696*bd670b35SErik Nordmark * hence doesn't want to allocate an IRE_IF_CLONE. Yet 2697*bd670b35SErik Nordmark * it needs an IRE_IF_ALL to get to the ill. Thus 2698*bd670b35SErik Nordmark * we return IRE_IF_ALL that are not host specific here. 2699c793af95Ssangeeta */ 2700*bd670b35SErik Nordmark if (ire->ire_type & IRE_ONLINK) 2701*bd670b35SErik Nordmark goto done; 2702*bd670b35SErik Nordmark ire = ire->ire_dep_parent; 2703c793af95Ssangeeta } 2704*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 2705*bd670b35SErik Nordmark return (NULL); 2706*bd670b35SErik Nordmark 2707*bd670b35SErik Nordmark done: 2708*bd670b35SErik Nordmark ire_refhold(ire); 2709*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 2710*bd670b35SErik Nordmark return (ire); 2711*bd670b35SErik Nordmark } 2712*bd670b35SErik Nordmark 2713*bd670b35SErik Nordmark /* 2714*bd670b35SErik Nordmark * Find the ill used to send packets. This will be NULL in case 2715*bd670b35SErik Nordmark * of a reject or blackhole. 2716*bd670b35SErik Nordmark * The returned ill is held; caller needs to do ill_refrele when done. 2717*bd670b35SErik Nordmark */ 2718*bd670b35SErik Nordmark ill_t * 2719*bd670b35SErik Nordmark ire_nexthop_ill(ire_t *ire) 2720*bd670b35SErik Nordmark { 2721*bd670b35SErik Nordmark ill_t *ill; 2722*bd670b35SErik Nordmark 2723*bd670b35SErik Nordmark ire = ire_nexthop(ire); 2724*bd670b35SErik Nordmark if (ire == NULL) 2725*bd670b35SErik Nordmark return (NULL); 2726*bd670b35SErik Nordmark 2727*bd670b35SErik Nordmark /* ire_ill can not change for an existing ire */ 2728*bd670b35SErik Nordmark ill = ire->ire_ill; 2729*bd670b35SErik Nordmark if (ill != NULL) 2730*bd670b35SErik Nordmark ill_refhold(ill); 2731*bd670b35SErik Nordmark ire_refrele(ire); 2732*bd670b35SErik Nordmark return (ill); 2733*bd670b35SErik Nordmark } 2734*bd670b35SErik Nordmark 2735*bd670b35SErik Nordmark #ifdef DEBUG 2736*bd670b35SErik Nordmark static boolean_t 2737*bd670b35SErik Nordmark parent_has_child(ire_t *parent, ire_t *child) 2738*bd670b35SErik Nordmark { 2739*bd670b35SErik Nordmark ire_t *ire; 2740*bd670b35SErik Nordmark ire_t *prev; 2741*bd670b35SErik Nordmark 2742*bd670b35SErik Nordmark ire = parent->ire_dep_children; 2743*bd670b35SErik Nordmark prev = NULL; 2744*bd670b35SErik Nordmark while (ire != NULL) { 2745*bd670b35SErik Nordmark if (prev == NULL) { 2746*bd670b35SErik Nordmark ASSERT(ire->ire_dep_sib_ptpn == 2747*bd670b35SErik Nordmark &(parent->ire_dep_children)); 2748*bd670b35SErik Nordmark } else { 2749*bd670b35SErik Nordmark ASSERT(ire->ire_dep_sib_ptpn == 2750*bd670b35SErik Nordmark &(prev->ire_dep_sib_next)); 2751*bd670b35SErik Nordmark } 2752*bd670b35SErik Nordmark if (ire == child) 2753*bd670b35SErik Nordmark return (B_TRUE); 2754*bd670b35SErik Nordmark prev = ire; 2755*bd670b35SErik Nordmark ire = ire->ire_dep_sib_next; 2756*bd670b35SErik Nordmark } 2757*bd670b35SErik Nordmark return (B_FALSE); 2758*bd670b35SErik Nordmark } 2759*bd670b35SErik Nordmark 2760*bd670b35SErik Nordmark static void 2761*bd670b35SErik Nordmark ire_dep_verify(ire_t *ire) 2762*bd670b35SErik Nordmark { 2763*bd670b35SErik Nordmark ire_t *parent = ire->ire_dep_parent; 2764*bd670b35SErik Nordmark ire_t *child = ire->ire_dep_children; 2765*bd670b35SErik Nordmark 2766*bd670b35SErik Nordmark ASSERT(ire->ire_ipversion == IPV4_VERSION || 2767*bd670b35SErik Nordmark ire->ire_ipversion == IPV6_VERSION); 2768*bd670b35SErik Nordmark if (parent != NULL) { 2769*bd670b35SErik Nordmark ASSERT(parent->ire_ipversion == IPV4_VERSION || 2770*bd670b35SErik Nordmark parent->ire_ipversion == IPV6_VERSION); 2771*bd670b35SErik Nordmark ASSERT(parent->ire_refcnt >= 1); 2772*bd670b35SErik Nordmark ASSERT(parent_has_child(parent, ire)); 2773*bd670b35SErik Nordmark } 2774*bd670b35SErik Nordmark if (child != NULL) { 2775*bd670b35SErik Nordmark ASSERT(child->ire_ipversion == IPV4_VERSION || 2776*bd670b35SErik Nordmark child->ire_ipversion == IPV6_VERSION); 2777*bd670b35SErik Nordmark ASSERT(child->ire_dep_parent == ire); 2778*bd670b35SErik Nordmark ASSERT(child->ire_dep_sib_ptpn != NULL); 2779*bd670b35SErik Nordmark ASSERT(parent_has_child(ire, child)); 2780*bd670b35SErik Nordmark } 2781*bd670b35SErik Nordmark } 2782*bd670b35SErik Nordmark #endif /* DEBUG */ 2783*bd670b35SErik Nordmark 2784*bd670b35SErik Nordmark /* 2785*bd670b35SErik Nordmark * Assumes ire_dep_parent is set. Remove this child from its parent's linkage. 2786*bd670b35SErik Nordmark */ 2787*bd670b35SErik Nordmark void 2788*bd670b35SErik Nordmark ire_dep_remove(ire_t *ire) 2789*bd670b35SErik Nordmark { 2790*bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 2791*bd670b35SErik Nordmark ire_t *parent = ire->ire_dep_parent; 2792*bd670b35SErik Nordmark ire_t *next; 2793*bd670b35SErik Nordmark nce_t *nce; 2794*bd670b35SErik Nordmark 2795*bd670b35SErik Nordmark ASSERT(RW_WRITE_HELD(&ipst->ips_ire_dep_lock)); 2796*bd670b35SErik Nordmark ASSERT(ire->ire_dep_parent != NULL); 2797*bd670b35SErik Nordmark ASSERT(ire->ire_dep_sib_ptpn != NULL); 2798*bd670b35SErik Nordmark 2799*bd670b35SErik Nordmark #ifdef DEBUG 2800*bd670b35SErik Nordmark ire_dep_verify(ire); 2801*bd670b35SErik Nordmark ire_dep_verify(parent); 2802*bd670b35SErik Nordmark #endif 2803*bd670b35SErik Nordmark 2804*bd670b35SErik Nordmark next = ire->ire_dep_sib_next; 2805*bd670b35SErik Nordmark if (next != NULL) 2806*bd670b35SErik Nordmark next->ire_dep_sib_ptpn = ire->ire_dep_sib_ptpn; 2807*bd670b35SErik Nordmark 2808*bd670b35SErik Nordmark ASSERT(*(ire->ire_dep_sib_ptpn) == ire); 2809*bd670b35SErik Nordmark *(ire->ire_dep_sib_ptpn) = ire->ire_dep_sib_next; 2810*bd670b35SErik Nordmark 2811*bd670b35SErik Nordmark ire->ire_dep_sib_ptpn = NULL; 2812*bd670b35SErik Nordmark ire->ire_dep_sib_next = NULL; 2813*bd670b35SErik Nordmark 2814*bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 2815*bd670b35SErik Nordmark parent = ire->ire_dep_parent; 2816*bd670b35SErik Nordmark ire->ire_dep_parent = NULL; 2817*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 2818*bd670b35SErik Nordmark 2819*bd670b35SErik Nordmark /* 2820*bd670b35SErik Nordmark * Make sure all our children, grandchildren, etc set 2821*bd670b35SErik Nordmark * ire_dep_parent_generation to IRE_GENERATION_VERIFY since 2822*bd670b35SErik Nordmark * we can no longer guarantee than the children have a current 2823*bd670b35SErik Nordmark * ire_nce_cache and ire_nexthop_ill(). 2824*bd670b35SErik Nordmark */ 2825*bd670b35SErik Nordmark if (ire->ire_dep_children != NULL) 2826*bd670b35SErik Nordmark ire_dep_invalidate_children(ire->ire_dep_children); 2827*bd670b35SErik Nordmark 2828*bd670b35SErik Nordmark /* 2829*bd670b35SErik Nordmark * Since the parent is gone we make sure we clear ire_nce_cache. 2830*bd670b35SErik Nordmark * We can clear it under ire_lock even if the IRE is used 2831*bd670b35SErik Nordmark */ 2832*bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 2833*bd670b35SErik Nordmark nce = ire->ire_nce_cache; 2834*bd670b35SErik Nordmark ire->ire_nce_cache = NULL; 2835*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 2836*bd670b35SErik Nordmark if (nce != NULL) 2837*bd670b35SErik Nordmark nce_refrele(nce); 2838*bd670b35SErik Nordmark 2839*bd670b35SErik Nordmark #ifdef DEBUG 2840*bd670b35SErik Nordmark ire_dep_verify(ire); 2841*bd670b35SErik Nordmark ire_dep_verify(parent); 2842*bd670b35SErik Nordmark #endif 2843*bd670b35SErik Nordmark 2844*bd670b35SErik Nordmark ire_refrele_notr(parent); 2845*bd670b35SErik Nordmark ire_refrele_notr(ire); 2846*bd670b35SErik Nordmark } 2847*bd670b35SErik Nordmark 2848*bd670b35SErik Nordmark /* 2849*bd670b35SErik Nordmark * Insert the child in the linkage of the parent 2850*bd670b35SErik Nordmark */ 2851*bd670b35SErik Nordmark static void 2852*bd670b35SErik Nordmark ire_dep_parent_insert(ire_t *child, ire_t *parent) 2853*bd670b35SErik Nordmark { 2854*bd670b35SErik Nordmark ip_stack_t *ipst = child->ire_ipst; 2855*bd670b35SErik Nordmark ire_t *next; 2856*bd670b35SErik Nordmark 2857*bd670b35SErik Nordmark ASSERT(RW_WRITE_HELD(&ipst->ips_ire_dep_lock)); 2858*bd670b35SErik Nordmark ASSERT(child->ire_dep_parent == NULL); 2859*bd670b35SErik Nordmark 2860*bd670b35SErik Nordmark #ifdef DEBUG 2861*bd670b35SErik Nordmark ire_dep_verify(child); 2862*bd670b35SErik Nordmark ire_dep_verify(parent); 2863*bd670b35SErik Nordmark #endif 2864*bd670b35SErik Nordmark /* No parents => no siblings */ 2865*bd670b35SErik Nordmark ASSERT(child->ire_dep_sib_ptpn == NULL); 2866*bd670b35SErik Nordmark ASSERT(child->ire_dep_sib_next == NULL); 2867*bd670b35SErik Nordmark 2868*bd670b35SErik Nordmark ire_refhold_notr(parent); 2869*bd670b35SErik Nordmark ire_refhold_notr(child); 2870*bd670b35SErik Nordmark 2871*bd670b35SErik Nordmark /* Head insertion */ 2872*bd670b35SErik Nordmark next = parent->ire_dep_children; 2873*bd670b35SErik Nordmark if (next != NULL) { 2874*bd670b35SErik Nordmark ASSERT(next->ire_dep_sib_ptpn == &(parent->ire_dep_children)); 2875*bd670b35SErik Nordmark child->ire_dep_sib_next = next; 2876*bd670b35SErik Nordmark next->ire_dep_sib_ptpn = &(child->ire_dep_sib_next); 2877*bd670b35SErik Nordmark } 2878*bd670b35SErik Nordmark parent->ire_dep_children = child; 2879*bd670b35SErik Nordmark child->ire_dep_sib_ptpn = &(parent->ire_dep_children); 2880*bd670b35SErik Nordmark 2881*bd670b35SErik Nordmark mutex_enter(&child->ire_lock); 2882*bd670b35SErik Nordmark child->ire_dep_parent = parent; 2883*bd670b35SErik Nordmark mutex_exit(&child->ire_lock); 2884*bd670b35SErik Nordmark 2885*bd670b35SErik Nordmark #ifdef DEBUG 2886*bd670b35SErik Nordmark ire_dep_verify(child); 2887*bd670b35SErik Nordmark ire_dep_verify(parent); 2888*bd670b35SErik Nordmark #endif 2889*bd670b35SErik Nordmark } 2890*bd670b35SErik Nordmark 2891*bd670b35SErik Nordmark 2892*bd670b35SErik Nordmark /* 2893*bd670b35SErik Nordmark * Given count worth of ires and generations, build ire_dep_* relationships 2894*bd670b35SErik Nordmark * from ires[0] to ires[count-1]. Record generations[i+1] in 2895*bd670b35SErik Nordmark * ire_dep_parent_generation for ires[i]. 2896*bd670b35SErik Nordmark * We graft onto an existing parent chain by making sure that we don't 2897*bd670b35SErik Nordmark * touch ire_dep_parent for ires[count-1]. 2898*bd670b35SErik Nordmark * 2899*bd670b35SErik Nordmark * We check for any condemned ire_generation count and return B_FALSE in 2900*bd670b35SErik Nordmark * that case so that the caller can tear it apart. 2901*bd670b35SErik Nordmark * 2902*bd670b35SErik Nordmark * Note that generations[0] is not used. Caller handles that. 2903*bd670b35SErik Nordmark */ 2904*bd670b35SErik Nordmark boolean_t 2905*bd670b35SErik Nordmark ire_dep_build(ire_t *ires[], uint_t generations[], uint_t count) 2906*bd670b35SErik Nordmark { 2907*bd670b35SErik Nordmark ire_t *ire = ires[0]; 2908*bd670b35SErik Nordmark ip_stack_t *ipst; 2909*bd670b35SErik Nordmark uint_t i; 2910*bd670b35SErik Nordmark 2911*bd670b35SErik Nordmark ASSERT(count > 0); 2912*bd670b35SErik Nordmark if (count == 1) { 2913*bd670b35SErik Nordmark /* No work to do */ 2914*bd670b35SErik Nordmark return (B_TRUE); 2915*bd670b35SErik Nordmark } 2916*bd670b35SErik Nordmark ipst = ire->ire_ipst; 2917*bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_WRITER); 2918*bd670b35SErik Nordmark /* 2919*bd670b35SErik Nordmark * Do not remove the linkage for any existing parent chain i.e., 2920*bd670b35SErik Nordmark * ires[count-1] is left alone. 2921*bd670b35SErik Nordmark */ 2922*bd670b35SErik Nordmark for (i = 0; i < count-1; i++) { 2923*bd670b35SErik Nordmark /* Remove existing parent if we need to change it */ 2924*bd670b35SErik Nordmark if (ires[i]->ire_dep_parent != NULL && 2925*bd670b35SErik Nordmark ires[i]->ire_dep_parent != ires[i+1]) 2926*bd670b35SErik Nordmark ire_dep_remove(ires[i]); 2927*bd670b35SErik Nordmark } 2928*bd670b35SErik Nordmark 2929*bd670b35SErik Nordmark for (i = 0; i < count - 1; i++) { 2930*bd670b35SErik Nordmark ASSERT(ires[i]->ire_ipversion == IPV4_VERSION || 2931*bd670b35SErik Nordmark ires[i]->ire_ipversion == IPV6_VERSION); 2932*bd670b35SErik Nordmark /* Does it need to change? */ 2933*bd670b35SErik Nordmark if (ires[i]->ire_dep_parent != ires[i+1]) 2934*bd670b35SErik Nordmark ire_dep_parent_insert(ires[i], ires[i+1]); 2935*bd670b35SErik Nordmark 2936*bd670b35SErik Nordmark mutex_enter(&ires[i+1]->ire_lock); 2937*bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ires[i+1])) { 2938*bd670b35SErik Nordmark mutex_exit(&ires[i+1]->ire_lock); 2939*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 2940*bd670b35SErik Nordmark return (B_FALSE); 2941*bd670b35SErik Nordmark } 2942*bd670b35SErik Nordmark mutex_exit(&ires[i+1]->ire_lock); 2943*bd670b35SErik Nordmark 2944*bd670b35SErik Nordmark mutex_enter(&ires[i]->ire_lock); 2945*bd670b35SErik Nordmark ires[i]->ire_dep_parent_generation = generations[i+1]; 2946*bd670b35SErik Nordmark mutex_exit(&ires[i]->ire_lock); 2947*bd670b35SErik Nordmark } 2948*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 2949*bd670b35SErik Nordmark return (B_TRUE); 2950*bd670b35SErik Nordmark } 2951*bd670b35SErik Nordmark 2952*bd670b35SErik Nordmark /* 2953*bd670b35SErik Nordmark * Given count worth of ires, unbuild ire_dep_* relationships 2954*bd670b35SErik Nordmark * from ires[0] to ires[count-1]. 2955*bd670b35SErik Nordmark */ 2956*bd670b35SErik Nordmark void 2957*bd670b35SErik Nordmark ire_dep_unbuild(ire_t *ires[], uint_t count) 2958*bd670b35SErik Nordmark { 2959*bd670b35SErik Nordmark ip_stack_t *ipst; 2960*bd670b35SErik Nordmark uint_t i; 2961*bd670b35SErik Nordmark 2962*bd670b35SErik Nordmark if (count == 0) { 2963*bd670b35SErik Nordmark /* No work to do */ 2964*bd670b35SErik Nordmark return; 2965*bd670b35SErik Nordmark } 2966*bd670b35SErik Nordmark ipst = ires[0]->ire_ipst; 2967*bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_WRITER); 2968*bd670b35SErik Nordmark for (i = 0; i < count; i++) { 2969*bd670b35SErik Nordmark ASSERT(ires[i]->ire_ipversion == IPV4_VERSION || 2970*bd670b35SErik Nordmark ires[i]->ire_ipversion == IPV6_VERSION); 2971*bd670b35SErik Nordmark if (ires[i]->ire_dep_parent != NULL) 2972*bd670b35SErik Nordmark ire_dep_remove(ires[i]); 2973*bd670b35SErik Nordmark mutex_enter(&ires[i]->ire_lock); 2974*bd670b35SErik Nordmark ires[i]->ire_dep_parent_generation = IRE_GENERATION_VERIFY; 2975*bd670b35SErik Nordmark mutex_exit(&ires[i]->ire_lock); 2976*bd670b35SErik Nordmark } 2977*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 2978*bd670b35SErik Nordmark } 2979*bd670b35SErik Nordmark 2980*bd670b35SErik Nordmark /* 2981*bd670b35SErik Nordmark * Both the forwarding and the outbound code paths can trip on 2982*bd670b35SErik Nordmark * a condemned NCE, in which case we call this function. 2983*bd670b35SErik Nordmark * We have two different behaviors: if the NCE was UNREACHABLE 2984*bd670b35SErik Nordmark * it is an indication that something failed. In that case 2985*bd670b35SErik Nordmark * we see if we should look for a different IRE (for example, 2986*bd670b35SErik Nordmark * delete any matching redirect IRE, or try a different 2987*bd670b35SErik Nordmark * IRE_DEFAULT (ECMP)). We mark the ire as bad so a hopefully 2988*bd670b35SErik Nordmark * different IRE will be picked next time we send/forward. 2989*bd670b35SErik Nordmark * 2990*bd670b35SErik Nordmark * If we are called by the output path then fail_if_better is set 2991*bd670b35SErik Nordmark * and we return NULL if there could be a better IRE. This is because the 2992*bd670b35SErik Nordmark * output path retries the IRE lookup. (The input/forward path can not retry.) 2993*bd670b35SErik Nordmark * 2994*bd670b35SErik Nordmark * If the NCE was not unreachable then we pick/allocate a 2995*bd670b35SErik Nordmark * new (most likely ND_INITIAL) NCE and proceed with it. 2996*bd670b35SErik Nordmark * 2997*bd670b35SErik Nordmark * ipha/ip6h are needed for multicast packets; ipha needs to be 2998*bd670b35SErik Nordmark * set for IPv4 and ip6h needs to be set for IPv6 packets. 2999*bd670b35SErik Nordmark */ 3000*bd670b35SErik Nordmark nce_t * 3001*bd670b35SErik Nordmark ire_handle_condemned_nce(nce_t *nce, ire_t *ire, ipha_t *ipha, ip6_t *ip6h, 3002*bd670b35SErik Nordmark boolean_t fail_if_better) 3003*bd670b35SErik Nordmark { 3004*bd670b35SErik Nordmark if (nce->nce_common->ncec_state == ND_UNREACHABLE) { 3005*bd670b35SErik Nordmark if (ire_no_good(ire) && fail_if_better) { 3006*bd670b35SErik Nordmark /* 3007*bd670b35SErik Nordmark * Did some changes, or ECMP likely to exist. 3008*bd670b35SErik Nordmark * Make ip_output look for a different IRE 3009*bd670b35SErik Nordmark */ 3010*bd670b35SErik Nordmark return (NULL); 3011*bd670b35SErik Nordmark } 3012*bd670b35SErik Nordmark } 3013*bd670b35SErik Nordmark if (ire_revalidate_nce(ire) == ENETUNREACH) { 3014*bd670b35SErik Nordmark /* The ire_dep_parent chain went bad, or no memory? */ 3015*bd670b35SErik Nordmark (void) ire_no_good(ire); 3016*bd670b35SErik Nordmark return (NULL); 3017*bd670b35SErik Nordmark } 3018*bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 3019*bd670b35SErik Nordmark ASSERT(ipha != NULL); 3020*bd670b35SErik Nordmark nce = ire_to_nce(ire, ipha->ipha_dst, NULL); 3021*bd670b35SErik Nordmark } else { 3022*bd670b35SErik Nordmark ASSERT(ip6h != NULL); 3023*bd670b35SErik Nordmark nce = ire_to_nce(ire, INADDR_ANY, &ip6h->ip6_dst); 3024*bd670b35SErik Nordmark } 3025*bd670b35SErik Nordmark 3026*bd670b35SErik Nordmark if (nce == NULL) 3027*bd670b35SErik Nordmark return (NULL); 3028*bd670b35SErik Nordmark if (nce->nce_is_condemned) { 3029*bd670b35SErik Nordmark nce_refrele(nce); 3030*bd670b35SErik Nordmark return (NULL); 3031*bd670b35SErik Nordmark } 3032*bd670b35SErik Nordmark return (nce); 3033*bd670b35SErik Nordmark } 3034*bd670b35SErik Nordmark 3035*bd670b35SErik Nordmark /* 3036*bd670b35SErik Nordmark * The caller has found that the ire is bad, either due to a reference to an NCE 3037*bd670b35SErik Nordmark * in ND_UNREACHABLE state, or a MULTIRT route whose gateway can't be resolved. 3038*bd670b35SErik Nordmark * We update things so a subsequent attempt to send to the destination 3039*bd670b35SErik Nordmark * is likely to find different IRE, or that a new NCE would be created. 3040*bd670b35SErik Nordmark * 3041*bd670b35SErik Nordmark * Returns B_TRUE if it is likely that a subsequent ire_ftable_lookup would 3042*bd670b35SErik Nordmark * find a different route (either due to having deleted a redirect, or there 3043*bd670b35SErik Nordmark * being ECMP routes.) 3044*bd670b35SErik Nordmark * 3045*bd670b35SErik Nordmark * If we have a redirect (RTF_DYNAMIC) we delete it. 3046*bd670b35SErik Nordmark * Otherwise we increment ire_badcnt and increment the generation number so 3047*bd670b35SErik Nordmark * that a cached ixa_ire will redo the route selection. ire_badcnt is taken 3048*bd670b35SErik Nordmark * into account in the route selection when we have multiple choices (multiple 3049*bd670b35SErik Nordmark * default routes or ECMP in general). 3050*bd670b35SErik Nordmark * Any time ip_select_route find an ire with a condemned ire_nce_cache 3051*bd670b35SErik Nordmark * (e.g., if no equal cost route to the bad one) ip_select_route will make 3052*bd670b35SErik Nordmark * sure the NCE is revalidated to avoid getting stuck on a 3053*bd670b35SErik Nordmark * NCE_F_CONDMNED ncec that caused ire_no_good to be called. 3054*bd670b35SErik Nordmark */ 3055*bd670b35SErik Nordmark boolean_t 3056*bd670b35SErik Nordmark ire_no_good(ire_t *ire) 3057*bd670b35SErik Nordmark { 3058*bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 3059*bd670b35SErik Nordmark ire_t *ire2; 3060*bd670b35SErik Nordmark nce_t *nce; 3061*bd670b35SErik Nordmark 3062*bd670b35SErik Nordmark if (ire->ire_flags & RTF_DYNAMIC) { 3063*bd670b35SErik Nordmark ire_delete(ire); 3064*bd670b35SErik Nordmark return (B_TRUE); 3065*bd670b35SErik Nordmark } 3066*bd670b35SErik Nordmark if (ire->ire_flags & RTF_INDIRECT) { 3067*bd670b35SErik Nordmark /* Check if next IRE is a redirect */ 3068*bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 3069*bd670b35SErik Nordmark if (ire->ire_dep_parent != NULL && 3070*bd670b35SErik Nordmark (ire->ire_dep_parent->ire_flags & RTF_DYNAMIC)) { 3071*bd670b35SErik Nordmark ire2 = ire->ire_dep_parent; 3072*bd670b35SErik Nordmark ire_refhold(ire2); 3073*bd670b35SErik Nordmark } else { 3074*bd670b35SErik Nordmark ire2 = NULL; 3075*bd670b35SErik Nordmark } 3076*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3077*bd670b35SErik Nordmark if (ire2 != NULL) { 3078*bd670b35SErik Nordmark ire_delete(ire2); 3079*bd670b35SErik Nordmark ire_refrele(ire2); 3080*bd670b35SErik Nordmark return (B_TRUE); 3081*bd670b35SErik Nordmark } 3082*bd670b35SErik Nordmark } 3083*bd670b35SErik Nordmark /* 3084*bd670b35SErik Nordmark * No redirect involved. Increment badcnt so that if we have ECMP 3085*bd670b35SErik Nordmark * routes we are likely to pick a different one for the next packet. 3086*bd670b35SErik Nordmark * 3087*bd670b35SErik Nordmark * If the NCE is unreachable and condemned we should drop the reference 3088*bd670b35SErik Nordmark * to it so that a new NCE can be created. 3089*bd670b35SErik Nordmark * 3090*bd670b35SErik Nordmark * Finally we increment the generation number so that any ixa_ire 3091*bd670b35SErik Nordmark * cache will be revalidated. 3092*bd670b35SErik Nordmark */ 3093*bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 3094*bd670b35SErik Nordmark ire->ire_badcnt++; 3095*bd670b35SErik Nordmark ire->ire_last_badcnt = TICK_TO_SEC(lbolt64); 3096*bd670b35SErik Nordmark nce = ire->ire_nce_cache; 3097*bd670b35SErik Nordmark if (nce != NULL && nce->nce_is_condemned && 3098*bd670b35SErik Nordmark nce->nce_common->ncec_state == ND_UNREACHABLE) 3099*bd670b35SErik Nordmark ire->ire_nce_cache = NULL; 3100*bd670b35SErik Nordmark else 3101*bd670b35SErik Nordmark nce = NULL; 3102*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3103*bd670b35SErik Nordmark if (nce != NULL) 3104*bd670b35SErik Nordmark nce_refrele(nce); 3105*bd670b35SErik Nordmark 3106*bd670b35SErik Nordmark ire_increment_generation(ire); 3107*bd670b35SErik Nordmark ire_dep_incr_generation(ire); 3108*bd670b35SErik Nordmark 3109*bd670b35SErik Nordmark return (ire->ire_bucket->irb_ire_cnt > 1); 3110*bd670b35SErik Nordmark } 3111*bd670b35SErik Nordmark 3112*bd670b35SErik Nordmark /* 3113*bd670b35SErik Nordmark * Walk ire_dep_parent chain and validate that ire_dep_parent->ire_generation == 3114*bd670b35SErik Nordmark * ire_dep_parent_generation. 3115*bd670b35SErik Nordmark * If they all match we just return ire_generation from the topmost IRE. 3116*bd670b35SErik Nordmark * Otherwise we propagate the mismatch by setting all ire_dep_parent_generation 3117*bd670b35SErik Nordmark * above the mismatch to IRE_GENERATION_VERIFY and also returning 3118*bd670b35SErik Nordmark * IRE_GENERATION_VERIFY. 3119*bd670b35SErik Nordmark */ 3120*bd670b35SErik Nordmark uint_t 3121*bd670b35SErik Nordmark ire_dep_validate_generations(ire_t *ire) 3122*bd670b35SErik Nordmark { 3123*bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 3124*bd670b35SErik Nordmark uint_t generation; 3125*bd670b35SErik Nordmark ire_t *ire1; 3126*bd670b35SErik Nordmark 3127*bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 3128*bd670b35SErik Nordmark generation = ire->ire_generation; /* Assuming things match */ 3129*bd670b35SErik Nordmark for (ire1 = ire; ire1 != NULL; ire1 = ire1->ire_dep_parent) { 3130*bd670b35SErik Nordmark ASSERT(ire1->ire_ipversion == IPV4_VERSION || 3131*bd670b35SErik Nordmark ire1->ire_ipversion == IPV6_VERSION); 3132*bd670b35SErik Nordmark if (ire1->ire_dep_parent == NULL) 3133*bd670b35SErik Nordmark break; 3134*bd670b35SErik Nordmark if (ire1->ire_dep_parent_generation != 3135*bd670b35SErik Nordmark ire1->ire_dep_parent->ire_generation) 3136*bd670b35SErik Nordmark goto mismatch; 3137*bd670b35SErik Nordmark } 3138*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3139*bd670b35SErik Nordmark return (generation); 3140*bd670b35SErik Nordmark 3141*bd670b35SErik Nordmark mismatch: 3142*bd670b35SErik Nordmark generation = IRE_GENERATION_VERIFY; 3143*bd670b35SErik Nordmark /* Fill from top down to the mismatch with _VERIFY */ 3144*bd670b35SErik Nordmark while (ire != ire1) { 3145*bd670b35SErik Nordmark ASSERT(ire->ire_ipversion == IPV4_VERSION || 3146*bd670b35SErik Nordmark ire->ire_ipversion == IPV6_VERSION); 3147*bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 3148*bd670b35SErik Nordmark ire->ire_dep_parent_generation = IRE_GENERATION_VERIFY; 3149*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3150*bd670b35SErik Nordmark ire = ire->ire_dep_parent; 3151*bd670b35SErik Nordmark } 3152*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3153*bd670b35SErik Nordmark return (generation); 3154*bd670b35SErik Nordmark } 3155*bd670b35SErik Nordmark 3156*bd670b35SErik Nordmark /* 3157*bd670b35SErik Nordmark * Used when we need to return an ire with ire_dep_parent, but we 3158*bd670b35SErik Nordmark * know the chain is invalid for instance we didn't create an IRE_IF_CLONE 3159*bd670b35SErik Nordmark * Using IRE_GENERATION_VERIFY means that next time we'll redo the 3160*bd670b35SErik Nordmark * recursive lookup. 3161*bd670b35SErik Nordmark */ 3162*bd670b35SErik Nordmark void 3163*bd670b35SErik Nordmark ire_dep_invalidate_generations(ire_t *ire) 3164*bd670b35SErik Nordmark { 3165*bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst; 3166*bd670b35SErik Nordmark 3167*bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 3168*bd670b35SErik Nordmark while (ire != NULL) { 3169*bd670b35SErik Nordmark ASSERT(ire->ire_ipversion == IPV4_VERSION || 3170*bd670b35SErik Nordmark ire->ire_ipversion == IPV6_VERSION); 3171*bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 3172*bd670b35SErik Nordmark ire->ire_dep_parent_generation = IRE_GENERATION_VERIFY; 3173*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3174*bd670b35SErik Nordmark ire = ire->ire_dep_parent; 3175*bd670b35SErik Nordmark } 3176*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3177*bd670b35SErik Nordmark } 3178*bd670b35SErik Nordmark 3179*bd670b35SErik Nordmark /* Set _VERIFY ire_dep_parent_generation for all children recursively */ 3180*bd670b35SErik Nordmark static void 3181*bd670b35SErik Nordmark ire_dep_invalidate_children(ire_t *child) 3182*bd670b35SErik Nordmark { 3183*bd670b35SErik Nordmark ip_stack_t *ipst = child->ire_ipst; 3184*bd670b35SErik Nordmark 3185*bd670b35SErik Nordmark ASSERT(RW_WRITE_HELD(&ipst->ips_ire_dep_lock)); 3186*bd670b35SErik Nordmark /* Depth first */ 3187*bd670b35SErik Nordmark if (child->ire_dep_children != NULL) 3188*bd670b35SErik Nordmark ire_dep_invalidate_children(child->ire_dep_children); 3189*bd670b35SErik Nordmark 3190*bd670b35SErik Nordmark while (child != NULL) { 3191*bd670b35SErik Nordmark mutex_enter(&child->ire_lock); 3192*bd670b35SErik Nordmark child->ire_dep_parent_generation = IRE_GENERATION_VERIFY; 3193*bd670b35SErik Nordmark mutex_exit(&child->ire_lock); 3194*bd670b35SErik Nordmark child = child->ire_dep_sib_next; 3195*bd670b35SErik Nordmark } 3196*bd670b35SErik Nordmark } 3197*bd670b35SErik Nordmark 3198*bd670b35SErik Nordmark static void 3199*bd670b35SErik Nordmark ire_dep_increment_children(ire_t *child) 3200*bd670b35SErik Nordmark { 3201*bd670b35SErik Nordmark ip_stack_t *ipst = child->ire_ipst; 3202*bd670b35SErik Nordmark 3203*bd670b35SErik Nordmark ASSERT(RW_READ_HELD(&ipst->ips_ire_dep_lock)); 3204*bd670b35SErik Nordmark /* Depth first */ 3205*bd670b35SErik Nordmark if (child->ire_dep_children != NULL) 3206*bd670b35SErik Nordmark ire_dep_increment_children(child->ire_dep_children); 3207*bd670b35SErik Nordmark 3208*bd670b35SErik Nordmark while (child != NULL) { 3209*bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(child)) 3210*bd670b35SErik Nordmark ire_increment_generation(child); 3211*bd670b35SErik Nordmark child = child->ire_dep_sib_next; 3212*bd670b35SErik Nordmark } 3213*bd670b35SErik Nordmark } 3214*bd670b35SErik Nordmark 3215*bd670b35SErik Nordmark /* 3216*bd670b35SErik Nordmark * Walk all the children of this ire recursively and increment their 3217*bd670b35SErik Nordmark * generation number. 3218*bd670b35SErik Nordmark */ 3219*bd670b35SErik Nordmark void 3220*bd670b35SErik Nordmark ire_dep_incr_generation(ire_t *parent) 3221*bd670b35SErik Nordmark { 3222*bd670b35SErik Nordmark ip_stack_t *ipst = parent->ire_ipst; 3223*bd670b35SErik Nordmark 3224*bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 3225*bd670b35SErik Nordmark if (parent->ire_dep_children != NULL) 3226*bd670b35SErik Nordmark ire_dep_increment_children(parent->ire_dep_children); 3227*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3228*bd670b35SErik Nordmark } 3229*bd670b35SErik Nordmark 3230*bd670b35SErik Nordmark /* 3231*bd670b35SErik Nordmark * Get a new ire_nce_cache for this IRE as well as its nexthop. 3232*bd670b35SErik Nordmark * Returns zero if it succeeds. Can fail due to lack of memory or when 3233*bd670b35SErik Nordmark * the route has become unreachable. Returns ENOMEM and ENETUNREACH in those 3234*bd670b35SErik Nordmark * cases. 3235*bd670b35SErik Nordmark * 3236*bd670b35SErik Nordmark * In the in.mpathd case, the ire will have ire_testhidden 3237*bd670b35SErik Nordmark * set; so we should create the ncec for the underlying ill. 3238*bd670b35SErik Nordmark * 3239*bd670b35SErik Nordmark * Note that the error returned by ire_revalidate_nce() is ignored by most 3240*bd670b35SErik Nordmark * callers except ire_handle_condemned_nce(), which handles the ENETUNREACH 3241*bd670b35SErik Nordmark * error to mark potentially bad ire's. For all the other callers, an 3242*bd670b35SErik Nordmark * error return could indicate a transient condition like ENOMEM, or could 3243*bd670b35SErik Nordmark * be the result of an interface that is going down/unplumbing. In the former 3244*bd670b35SErik Nordmark * case (transient error), we would leave the old stale ire/ire_nce_cache 3245*bd670b35SErik Nordmark * in place, and possibly use incorrect link-layer information to send packets 3246*bd670b35SErik Nordmark * but would eventually recover. In the latter case (ill down/replumb), 3247*bd670b35SErik Nordmark * ire_revalidate_nce() might return a condemned nce back, but we would then 3248*bd670b35SErik Nordmark * recover in the packet output path. 3249*bd670b35SErik Nordmark */ 3250*bd670b35SErik Nordmark int 3251*bd670b35SErik Nordmark ire_revalidate_nce(ire_t *ire) 3252*bd670b35SErik Nordmark { 3253*bd670b35SErik Nordmark nce_t *nce, *old_nce; 3254*bd670b35SErik Nordmark ire_t *nexthop; 3255*bd670b35SErik Nordmark 3256*bd670b35SErik Nordmark /* 3257*bd670b35SErik Nordmark * For multicast we conceptually have an NCE but we don't store it 3258*bd670b35SErik Nordmark * in ire_nce_cache; when ire_to_nce is called we allocate the nce. 3259*bd670b35SErik Nordmark */ 3260*bd670b35SErik Nordmark if (ire->ire_type & IRE_MULTICAST) 3261*bd670b35SErik Nordmark return (0); 3262*bd670b35SErik Nordmark 3263*bd670b35SErik Nordmark /* ire_testhidden should only be set on under-interfaces */ 3264*bd670b35SErik Nordmark ASSERT(!ire->ire_testhidden || !IS_IPMP(ire->ire_ill)); 3265*bd670b35SErik Nordmark 3266*bd670b35SErik Nordmark nexthop = ire_nexthop(ire); 3267*bd670b35SErik Nordmark if (nexthop == NULL) { 3268*bd670b35SErik Nordmark /* The route is potentially bad */ 3269*bd670b35SErik Nordmark (void) ire_no_good(ire); 3270*bd670b35SErik Nordmark return (ENETUNREACH); 3271*bd670b35SErik Nordmark } 3272*bd670b35SErik Nordmark if (ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) { 3273*bd670b35SErik Nordmark ASSERT(ire->ire_ill != NULL); 3274*bd670b35SErik Nordmark 3275*bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) 3276*bd670b35SErik Nordmark nce = nce_lookup_v4(ire->ire_ill, &ire->ire_addr); 3277*bd670b35SErik Nordmark else 3278*bd670b35SErik Nordmark nce = nce_lookup_v6(ire->ire_ill, &ire->ire_addr_v6); 3279*bd670b35SErik Nordmark } else { 3280*bd670b35SErik Nordmark ASSERT(nexthop->ire_type & IRE_ONLINK); 3281*bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 3282*bd670b35SErik Nordmark nce = arp_nce_init(nexthop->ire_ill, nexthop->ire_addr, 3283*bd670b35SErik Nordmark nexthop->ire_type); 3284*bd670b35SErik Nordmark } else { 3285*bd670b35SErik Nordmark nce = ndp_nce_init(nexthop->ire_ill, 3286*bd670b35SErik Nordmark &nexthop->ire_addr_v6, nexthop->ire_type); 3287*bd670b35SErik Nordmark } 3288*bd670b35SErik Nordmark } 3289*bd670b35SErik Nordmark if (nce == NULL) { 3290*bd670b35SErik Nordmark /* 3291*bd670b35SErik Nordmark * Leave the old stale one in place to avoid a NULL 3292*bd670b35SErik Nordmark * ire_nce_cache. 3293*bd670b35SErik Nordmark */ 3294*bd670b35SErik Nordmark ire_refrele(nexthop); 3295*bd670b35SErik Nordmark return (ENOMEM); 3296*bd670b35SErik Nordmark } 3297*bd670b35SErik Nordmark 3298*bd670b35SErik Nordmark if (nexthop != ire) { 3299*bd670b35SErik Nordmark /* Update the nexthop ire */ 3300*bd670b35SErik Nordmark mutex_enter(&nexthop->ire_lock); 3301*bd670b35SErik Nordmark old_nce = nexthop->ire_nce_cache; 3302*bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(nexthop)) { 3303*bd670b35SErik Nordmark nce_refhold(nce); 3304*bd670b35SErik Nordmark nexthop->ire_nce_cache = nce; 3305*bd670b35SErik Nordmark } else { 3306*bd670b35SErik Nordmark nexthop->ire_nce_cache = NULL; 3307*bd670b35SErik Nordmark } 3308*bd670b35SErik Nordmark mutex_exit(&nexthop->ire_lock); 3309*bd670b35SErik Nordmark if (old_nce != NULL) 3310*bd670b35SErik Nordmark nce_refrele(old_nce); 3311*bd670b35SErik Nordmark } 3312*bd670b35SErik Nordmark ire_refrele(nexthop); 3313*bd670b35SErik Nordmark 3314*bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 3315*bd670b35SErik Nordmark old_nce = ire->ire_nce_cache; 3316*bd670b35SErik Nordmark if (!IRE_IS_CONDEMNED(ire)) { 3317*bd670b35SErik Nordmark nce_refhold(nce); 3318*bd670b35SErik Nordmark ire->ire_nce_cache = nce; 3319*bd670b35SErik Nordmark } else { 3320*bd670b35SErik Nordmark ire->ire_nce_cache = NULL; 3321*bd670b35SErik Nordmark } 3322*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3323*bd670b35SErik Nordmark if (old_nce != NULL) 3324*bd670b35SErik Nordmark nce_refrele(old_nce); 3325*bd670b35SErik Nordmark 3326*bd670b35SErik Nordmark nce_refrele(nce); 3327c793af95Ssangeeta return (0); 3328c793af95Ssangeeta } 33295b17e9bdSJon Anderson 33305b17e9bdSJon Anderson /* 3331*bd670b35SErik Nordmark * Get a held nce for a given ire. 3332*bd670b35SErik Nordmark * In the common case this is just from ire_nce_cache. 3333*bd670b35SErik Nordmark * For IRE_MULTICAST this needs to do an explicit lookup since we do not 3334*bd670b35SErik Nordmark * have an IRE_MULTICAST per address. 3335*bd670b35SErik Nordmark * Note that this explicitly returns CONDEMNED NCEs. The caller needs those 3336*bd670b35SErik Nordmark * so they can check whether the NCE went unreachable (as opposed to was 3337*bd670b35SErik Nordmark * condemned for some other reason). 33385b17e9bdSJon Anderson */ 3339*bd670b35SErik Nordmark nce_t * 3340*bd670b35SErik Nordmark ire_to_nce(ire_t *ire, ipaddr_t v4nexthop, const in6_addr_t *v6nexthop) 33415b17e9bdSJon Anderson { 3342*bd670b35SErik Nordmark nce_t *nce; 33435b17e9bdSJon Anderson 3344*bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) 3345*bd670b35SErik Nordmark return (NULL); 3346*bd670b35SErik Nordmark 3347*bd670b35SErik Nordmark /* ire_testhidden should only be set on under-interfaces */ 3348*bd670b35SErik Nordmark ASSERT(!ire->ire_testhidden || !IS_IPMP(ire->ire_ill)); 3349*bd670b35SErik Nordmark 3350*bd670b35SErik Nordmark mutex_enter(&ire->ire_lock); 3351*bd670b35SErik Nordmark nce = ire->ire_nce_cache; 3352*bd670b35SErik Nordmark if (nce != NULL) { 3353*bd670b35SErik Nordmark nce_refhold(nce); 3354*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3355*bd670b35SErik Nordmark return (nce); 3356*bd670b35SErik Nordmark } 3357*bd670b35SErik Nordmark mutex_exit(&ire->ire_lock); 3358*bd670b35SErik Nordmark 3359*bd670b35SErik Nordmark if (ire->ire_type & IRE_MULTICAST) { 3360*bd670b35SErik Nordmark ASSERT(ire->ire_ill != NULL); 3361*bd670b35SErik Nordmark 3362*bd670b35SErik Nordmark if (ire->ire_ipversion == IPV4_VERSION) { 3363*bd670b35SErik Nordmark ASSERT(v6nexthop == NULL); 3364*bd670b35SErik Nordmark 3365*bd670b35SErik Nordmark nce = arp_nce_init(ire->ire_ill, v4nexthop, 3366*bd670b35SErik Nordmark ire->ire_type); 3367*bd670b35SErik Nordmark } else { 3368*bd670b35SErik Nordmark ASSERT(v6nexthop != NULL); 3369*bd670b35SErik Nordmark ASSERT(v4nexthop == 0); 3370*bd670b35SErik Nordmark nce = ndp_nce_init(ire->ire_ill, v6nexthop, 3371*bd670b35SErik Nordmark ire->ire_type); 3372*bd670b35SErik Nordmark } 3373*bd670b35SErik Nordmark return (nce); 3374*bd670b35SErik Nordmark } 33755b17e9bdSJon Anderson return (NULL); 33765b17e9bdSJon Anderson } 33775b17e9bdSJon Anderson 3378*bd670b35SErik Nordmark nce_t * 3379*bd670b35SErik Nordmark ire_to_nce_pkt(ire_t *ire, mblk_t *mp) 3380*bd670b35SErik Nordmark { 3381*bd670b35SErik Nordmark ipha_t *ipha; 3382*bd670b35SErik Nordmark ip6_t *ip6h; 33835b17e9bdSJon Anderson 3384*bd670b35SErik Nordmark if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 3385*bd670b35SErik Nordmark ipha = (ipha_t *)mp->b_rptr; 3386*bd670b35SErik Nordmark return (ire_to_nce(ire, ipha->ipha_dst, NULL)); 3387*bd670b35SErik Nordmark } else { 3388*bd670b35SErik Nordmark ip6h = (ip6_t *)mp->b_rptr; 3389*bd670b35SErik Nordmark return (ire_to_nce(ire, INADDR_ANY, &ip6h->ip6_dst)); 3390*bd670b35SErik Nordmark } 33915b17e9bdSJon Anderson } 33925b17e9bdSJon Anderson 33935b17e9bdSJon Anderson /* 3394*bd670b35SErik Nordmark * Given an IRE_INTERFACE (that matches more than one address) create 3395*bd670b35SErik Nordmark * and return an IRE_IF_CLONE for the specific address. 3396*bd670b35SErik Nordmark * Return the generation number. 3397*bd670b35SErik Nordmark * Returns NULL is no memory for the IRE. 3398*bd670b35SErik Nordmark * Handles both IPv4 and IPv6. 33995b17e9bdSJon Anderson */ 34005b17e9bdSJon Anderson ire_t * 3401*bd670b35SErik Nordmark ire_create_if_clone(ire_t *ire_if, const in6_addr_t *addr, uint_t *generationp) 34025b17e9bdSJon Anderson { 3403*bd670b35SErik Nordmark ire_t *ire; 3404*bd670b35SErik Nordmark ire_t *nire; 34055b17e9bdSJon Anderson 3406*bd670b35SErik Nordmark if (ire_if->ire_ipversion == IPV4_VERSION) { 3407*bd670b35SErik Nordmark ipaddr_t v4addr; 3408*bd670b35SErik Nordmark ipaddr_t mask = IP_HOST_MASK; 34095b17e9bdSJon Anderson 3410*bd670b35SErik Nordmark ASSERT(IN6_IS_ADDR_V4MAPPED(addr)); 3411*bd670b35SErik Nordmark IN6_V4MAPPED_TO_IPADDR(addr, v4addr); 3412*bd670b35SErik Nordmark 3413*bd670b35SErik Nordmark ire = ire_create( 3414*bd670b35SErik Nordmark (uchar_t *)&v4addr, /* dest address */ 3415*bd670b35SErik Nordmark (uchar_t *)&mask, /* mask */ 3416*bd670b35SErik Nordmark (uchar_t *)&ire_if->ire_gateway_addr, 3417*bd670b35SErik Nordmark IRE_IF_CLONE, /* IRE type */ 3418*bd670b35SErik Nordmark ire_if->ire_ill, 3419*bd670b35SErik Nordmark ire_if->ire_zoneid, 3420*bd670b35SErik Nordmark ire_if->ire_flags | RTF_HOST, 3421*bd670b35SErik Nordmark NULL, /* No security attr for IRE_IF_ALL */ 3422*bd670b35SErik Nordmark ire_if->ire_ipst); 3423*bd670b35SErik Nordmark } else { 3424*bd670b35SErik Nordmark ASSERT(!IN6_IS_ADDR_V4MAPPED(addr)); 3425*bd670b35SErik Nordmark ire = ire_create_v6( 3426*bd670b35SErik Nordmark addr, /* dest address */ 3427*bd670b35SErik Nordmark &ipv6_all_ones, /* mask */ 3428*bd670b35SErik Nordmark &ire_if->ire_gateway_addr_v6, /* gateway addr */ 3429*bd670b35SErik Nordmark IRE_IF_CLONE, /* IRE type */ 3430*bd670b35SErik Nordmark ire_if->ire_ill, 3431*bd670b35SErik Nordmark ire_if->ire_zoneid, 3432*bd670b35SErik Nordmark ire_if->ire_flags | RTF_HOST, 3433*bd670b35SErik Nordmark NULL, /* No security attr for IRE_IF_ALL */ 3434*bd670b35SErik Nordmark ire_if->ire_ipst); 3435*bd670b35SErik Nordmark } 3436*bd670b35SErik Nordmark if (ire == NULL) 3437*bd670b35SErik Nordmark return (NULL); 3438*bd670b35SErik Nordmark 3439*bd670b35SErik Nordmark /* Take the metrics, in particular the mtu, from the IRE_IF */ 3440*bd670b35SErik Nordmark ire->ire_metrics = ire_if->ire_metrics; 3441*bd670b35SErik Nordmark 3442*bd670b35SErik Nordmark nire = ire_add(ire); 3443*bd670b35SErik Nordmark if (nire == NULL) /* Some failure */ 3444*bd670b35SErik Nordmark return (NULL); 3445*bd670b35SErik Nordmark 3446*bd670b35SErik Nordmark if (generationp != NULL) 3447*bd670b35SErik Nordmark *generationp = nire->ire_generation; 3448*bd670b35SErik Nordmark 3449*bd670b35SErik Nordmark /* 3450*bd670b35SErik Nordmark * Make sure races don't add a duplicate by 3451*bd670b35SErik Nordmark * catching the case when an identical was returned. 3452*bd670b35SErik Nordmark */ 3453*bd670b35SErik Nordmark if (nire != ire) { 3454*bd670b35SErik Nordmark ASSERT(nire->ire_identical_ref > 1); 3455*bd670b35SErik Nordmark ire_delete(nire); 3456*bd670b35SErik Nordmark } 3457*bd670b35SErik Nordmark return (nire); 3458*bd670b35SErik Nordmark } 3459*bd670b35SErik Nordmark 3460*bd670b35SErik Nordmark /* 3461*bd670b35SErik Nordmark * The argument is an IRE_INTERFACE. Delete all of IRE_IF_CLONE in the 3462*bd670b35SErik Nordmark * ire_dep_children (just walk the ire_dep_sib_next since they are all 3463*bd670b35SErik Nordmark * immediate children.) 3464*bd670b35SErik Nordmark * Since we hold a lock while we remove them we need to defer the actual 3465*bd670b35SErik Nordmark * calls to ire_delete() until we have dropped the lock. This makes things 3466*bd670b35SErik Nordmark * less efficient since we restart at the top after dropping the lock. But 3467*bd670b35SErik Nordmark * we only run when an IRE_INTERFACE is deleted which is infrquent. 3468*bd670b35SErik Nordmark * 3469*bd670b35SErik Nordmark * Note that ire_dep_children can be any mixture of offlink routes and 3470*bd670b35SErik Nordmark * IRE_IF_CLONE entries. 3471*bd670b35SErik Nordmark */ 3472*bd670b35SErik Nordmark void 3473*bd670b35SErik Nordmark ire_dep_delete_if_clone(ire_t *parent) 3474*bd670b35SErik Nordmark { 3475*bd670b35SErik Nordmark ip_stack_t *ipst = parent->ire_ipst; 3476*bd670b35SErik Nordmark ire_t *child, *next; 3477*bd670b35SErik Nordmark 3478*bd670b35SErik Nordmark restart: 3479*bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_READER); 3480*bd670b35SErik Nordmark if (parent->ire_dep_children == NULL) { 3481*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3482*bd670b35SErik Nordmark return; 3483*bd670b35SErik Nordmark } 3484*bd670b35SErik Nordmark child = parent->ire_dep_children; 3485*bd670b35SErik Nordmark while (child != NULL) { 3486*bd670b35SErik Nordmark next = child->ire_dep_sib_next; 3487*bd670b35SErik Nordmark if ((child->ire_type & IRE_IF_CLONE) && 3488*bd670b35SErik Nordmark !IRE_IS_CONDEMNED(child)) { 3489*bd670b35SErik Nordmark ire_refhold(child); 3490*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3491*bd670b35SErik Nordmark ire_delete(child); 3492*bd670b35SErik Nordmark ASSERT(IRE_IS_CONDEMNED(child)); 3493*bd670b35SErik Nordmark ire_refrele(child); 3494*bd670b35SErik Nordmark goto restart; 3495*bd670b35SErik Nordmark } 3496*bd670b35SErik Nordmark child = next; 3497*bd670b35SErik Nordmark } 3498*bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock); 3499*bd670b35SErik Nordmark } 3500*bd670b35SErik Nordmark 3501*bd670b35SErik Nordmark /* 3502*bd670b35SErik Nordmark * ire_pref() is used in recursive route-resolution for a destination to 3503*bd670b35SErik Nordmark * determine the preference of an ire, where "preference" is determined 3504*bd670b35SErik Nordmark * based on the level of indirection to the destination of the ire. 3505*bd670b35SErik Nordmark * A higher preference indicates that fewer lookups are needed to complete 3506*bd670b35SErik Nordmark * recursive route lookup. Thus 3507*bd670b35SErik Nordmark * ire_pref(RTF_INDIRECT) < ire_pref(IRE_IF_RESOLVER) < ire_pref(IRE_PREF_CLONE) 3508*bd670b35SErik Nordmark */ 3509*bd670b35SErik Nordmark int 3510*bd670b35SErik Nordmark ire_pref(ire_t *ire) 3511*bd670b35SErik Nordmark { 3512*bd670b35SErik Nordmark if (ire->ire_flags & RTF_INDIRECT) 3513*bd670b35SErik Nordmark return (1); 3514*bd670b35SErik Nordmark if (ire->ire_type & IRE_OFFLINK) 3515*bd670b35SErik Nordmark return (2); 3516*bd670b35SErik Nordmark if (ire->ire_type & (IRE_IF_RESOLVER|IRE_IF_NORESOLVER)) 3517*bd670b35SErik Nordmark return (3); 3518*bd670b35SErik Nordmark if (ire->ire_type & IRE_IF_CLONE) 3519*bd670b35SErik Nordmark return (4); 3520*bd670b35SErik Nordmark if (ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK|IRE_BROADCAST)) 3521*bd670b35SErik Nordmark return (5); 3522*bd670b35SErik Nordmark return (-1); /* unknown ire_type */ 35235b17e9bdSJon Anderson } 3524