1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 1990 Mentat Inc. 27 */ 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 /* 32 * This file contains the interface control functions for IPv6. 33 */ 34 35 #include <sys/types.h> 36 #include <sys/sysmacros.h> 37 #include <sys/stream.h> 38 #include <sys/dlpi.h> 39 #include <sys/stropts.h> 40 #include <sys/ddi.h> 41 #include <sys/cmn_err.h> 42 #include <sys/kstat.h> 43 #include <sys/debug.h> 44 #include <sys/zone.h> 45 46 #include <sys/systm.h> 47 #include <sys/param.h> 48 #include <sys/socket.h> 49 #include <sys/isa_defs.h> 50 #include <net/if.h> 51 #include <net/if_dl.h> 52 #include <net/route.h> 53 #include <netinet/in.h> 54 #include <netinet/igmp_var.h> 55 #include <netinet/ip6.h> 56 #include <netinet/icmp6.h> 57 #include <netinet/in.h> 58 59 #include <inet/common.h> 60 #include <inet/nd.h> 61 #include <inet/mib2.h> 62 #include <inet/ip.h> 63 #include <inet/ip6.h> 64 #include <inet/ip_multi.h> 65 #include <inet/ip_ire.h> 66 #include <inet/ip_rts.h> 67 #include <inet/ip_ndp.h> 68 #include <inet/ip_if.h> 69 #include <inet/ip6_asp.h> 70 #include <inet/tun.h> 71 #include <inet/ipclassifier.h> 72 #include <inet/sctp_ip.h> 73 74 #include <sys/tsol/tndb.h> 75 #include <sys/tsol/tnet.h> 76 77 static in6_addr_t ipv6_ll_template = 78 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 79 80 static ipif_t * 81 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 82 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error); 83 84 /* 85 * ipif_lookup_group_v6 86 */ 87 ipif_t * 88 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid) 89 { 90 ire_t *ire; 91 ipif_t *ipif; 92 93 ire = ire_lookup_multi_v6(group, zoneid); 94 if (ire == NULL) 95 return (NULL); 96 ipif = ire->ire_ipif; 97 ipif_refhold(ipif); 98 ire_refrele(ire); 99 return (ipif); 100 } 101 102 /* 103 * ill_lookup_group_v6 104 */ 105 ill_t * 106 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid) 107 { 108 ire_t *ire; 109 ill_t *ill; 110 111 ire = ire_lookup_multi_v6(group, zoneid); 112 if (ire == NULL) 113 return (NULL); 114 ill = ire->ire_ipif->ipif_ill; 115 ill_refhold(ill); 116 ire_refrele(ire); 117 return (ill); 118 } 119 120 /* 121 * Look for an ipif with the specified interface address and destination. 122 * The destination address is used only for matching point-to-point interfaces. 123 */ 124 static ipif_t * 125 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 126 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error) 127 { 128 ipif_t *ipif; 129 ill_t *ill; 130 ipsq_t *ipsq; 131 ill_walk_context_t ctx; 132 133 if (error != NULL) 134 *error = 0; 135 136 /* 137 * First match all the point-to-point interfaces 138 * before looking at non-point-to-point interfaces. 139 * This is done to avoid returning non-point-to-point 140 * ipif instead of unnumbered point-to-point ipif. 141 */ 142 rw_enter(&ill_g_lock, RW_READER); 143 ill = ILL_START_WALK_V6(&ctx); 144 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 145 GRAB_CONN_LOCK(q); 146 mutex_enter(&ill->ill_lock); 147 for (ipif = ill->ill_ipif; ipif != NULL; 148 ipif = ipif->ipif_next) { 149 /* Allow the ipif to be down */ 150 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 151 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 152 if_addr)) && 153 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 154 dst))) { 155 if (IPIF_CAN_LOOKUP(ipif)) { 156 ipif_refhold_locked(ipif); 157 mutex_exit(&ill->ill_lock); 158 RELEASE_CONN_LOCK(q); 159 rw_exit(&ill_g_lock); 160 return (ipif); 161 } else if (IPIF_CAN_WAIT(ipif, q)) { 162 ipsq = ill->ill_phyint->phyint_ipsq; 163 mutex_enter(&ipsq->ipsq_lock); 164 mutex_exit(&ill->ill_lock); 165 rw_exit(&ill_g_lock); 166 ipsq_enq(ipsq, q, mp, func, NEW_OP, 167 ill); 168 mutex_exit(&ipsq->ipsq_lock); 169 RELEASE_CONN_LOCK(q); 170 *error = EINPROGRESS; 171 return (NULL); 172 } 173 } 174 } 175 mutex_exit(&ill->ill_lock); 176 RELEASE_CONN_LOCK(q); 177 } 178 rw_exit(&ill_g_lock); 179 /* lookup the ipif based on interface address */ 180 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func, 181 error); 182 ASSERT(ipif == NULL || ipif->ipif_isv6); 183 return (ipif); 184 } 185 186 /* 187 * Look for an ipif with the specified address. For point-point links 188 * we look for matches on either the destination address and the local 189 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 190 * is set. 191 * Matches on a specific ill if match_ill is set. 192 */ 193 /* ARGSUSED */ 194 ipif_t * 195 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 196 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error) 197 { 198 ipif_t *ipif; 199 ill_t *ill; 200 boolean_t ptp = B_FALSE; 201 ipsq_t *ipsq; 202 ill_walk_context_t ctx; 203 204 if (error != NULL) 205 *error = 0; 206 207 rw_enter(&ill_g_lock, RW_READER); 208 /* 209 * Repeat twice, first based on local addresses and 210 * next time for pointopoint. 211 */ 212 repeat: 213 ill = ILL_START_WALK_V6(&ctx); 214 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 215 if (match_ill != NULL && ill != match_ill) { 216 continue; 217 } 218 GRAB_CONN_LOCK(q); 219 mutex_enter(&ill->ill_lock); 220 for (ipif = ill->ill_ipif; ipif != NULL; 221 ipif = ipif->ipif_next) { 222 if (zoneid != ALL_ZONES && 223 ipif->ipif_zoneid != zoneid && 224 ipif->ipif_zoneid != ALL_ZONES) 225 continue; 226 /* Allow the ipif to be down */ 227 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 228 &ipif->ipif_v6lcl_addr, addr) && 229 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 230 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 231 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 232 addr))) { 233 if (IPIF_CAN_LOOKUP(ipif)) { 234 ipif_refhold_locked(ipif); 235 mutex_exit(&ill->ill_lock); 236 RELEASE_CONN_LOCK(q); 237 rw_exit(&ill_g_lock); 238 return (ipif); 239 } else if (IPIF_CAN_WAIT(ipif, q)) { 240 ipsq = ill->ill_phyint->phyint_ipsq; 241 mutex_enter(&ipsq->ipsq_lock); 242 mutex_exit(&ill->ill_lock); 243 rw_exit(&ill_g_lock); 244 ipsq_enq(ipsq, q, mp, func, NEW_OP, 245 ill); 246 mutex_exit(&ipsq->ipsq_lock); 247 RELEASE_CONN_LOCK(q); 248 *error = EINPROGRESS; 249 return (NULL); 250 } 251 } 252 } 253 mutex_exit(&ill->ill_lock); 254 RELEASE_CONN_LOCK(q); 255 } 256 257 /* If we already did the ptp case, then we are done */ 258 if (ptp) { 259 rw_exit(&ill_g_lock); 260 if (error != NULL) 261 *error = ENXIO; 262 return (NULL); 263 } 264 ptp = B_TRUE; 265 goto repeat; 266 } 267 268 /* 269 * Look for an ipif with the specified address. For point-point links 270 * we look for matches on either the destination address and the local 271 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 272 * is set. 273 * Matches on a specific ill if match_ill is set. 274 * Return the zoneid for the ipif. ALL_ZONES if none found. 275 */ 276 zoneid_t 277 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill) 278 { 279 ipif_t *ipif; 280 ill_t *ill; 281 boolean_t ptp = B_FALSE; 282 ill_walk_context_t ctx; 283 zoneid_t zoneid; 284 285 rw_enter(&ill_g_lock, RW_READER); 286 /* 287 * Repeat twice, first based on local addresses and 288 * next time for pointopoint. 289 */ 290 repeat: 291 ill = ILL_START_WALK_V6(&ctx); 292 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 293 if (match_ill != NULL && ill != match_ill) { 294 continue; 295 } 296 mutex_enter(&ill->ill_lock); 297 for (ipif = ill->ill_ipif; ipif != NULL; 298 ipif = ipif->ipif_next) { 299 /* Allow the ipif to be down */ 300 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 301 &ipif->ipif_v6lcl_addr, addr) && 302 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 303 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 304 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 305 addr)) && 306 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) { 307 zoneid = ipif->ipif_zoneid; 308 mutex_exit(&ill->ill_lock); 309 rw_exit(&ill_g_lock); 310 /* 311 * If ipif_zoneid was ALL_ZONES then we have 312 * a trusted extensions shared IP address. 313 * In that case GLOBAL_ZONEID works to send. 314 */ 315 if (zoneid == ALL_ZONES) 316 zoneid = GLOBAL_ZONEID; 317 return (zoneid); 318 } 319 } 320 mutex_exit(&ill->ill_lock); 321 } 322 323 /* If we already did the ptp case, then we are done */ 324 if (ptp) { 325 rw_exit(&ill_g_lock); 326 return (ALL_ZONES); 327 } 328 ptp = B_TRUE; 329 goto repeat; 330 } 331 332 /* 333 * Perform various checks to verify that an address would make sense as a local 334 * interface address. This is currently only called when an attempt is made 335 * to set a local address. 336 * 337 * Does not allow a v4-mapped address, an address that equals the subnet 338 * anycast address, ... a multicast address, ... 339 */ 340 boolean_t 341 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 342 { 343 in6_addr_t subnet; 344 345 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 346 return (B_TRUE); /* Allow all zeros */ 347 348 /* 349 * Don't allow all zeroes or host part, but allow 350 * all ones netmask. 351 */ 352 V6_MASK_COPY(*addr, *subnet_mask, subnet); 353 if (IN6_IS_ADDR_V4MAPPED(addr) || 354 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 355 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 356 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 357 IN6_IS_ADDR_MULTICAST(addr)) 358 return (B_FALSE); 359 360 return (B_TRUE); 361 } 362 363 /* 364 * Perform various checks to verify that an address would make sense as a 365 * remote/subnet interface address. 366 */ 367 boolean_t 368 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 369 { 370 in6_addr_t subnet; 371 372 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 373 return (B_TRUE); /* Allow all zeros */ 374 375 V6_MASK_COPY(*addr, *subnet_mask, subnet); 376 if (IN6_IS_ADDR_V4MAPPED(addr) || 377 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 378 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 379 IN6_IS_ADDR_MULTICAST(addr) || 380 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 381 return (B_FALSE); 382 383 return (B_TRUE); 384 } 385 386 /* 387 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 388 * ipif_arg is passed in to associate it with the correct interface 389 * (for link-local destinations and gateways). 390 */ 391 /* ARGSUSED1 */ 392 int 393 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 394 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 395 ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func, 396 struct rtsa_s *sp) 397 { 398 ire_t *ire; 399 ire_t *gw_ire = NULL; 400 ipif_t *ipif; 401 boolean_t ipif_refheld = B_FALSE; 402 uint_t type; 403 int match_flags = MATCH_IRE_TYPE; 404 int error; 405 tsol_gc_t *gc = NULL; 406 tsol_gcgrp_t *gcgrp = NULL; 407 boolean_t gcgrp_xtraref = B_FALSE; 408 409 if (ire_arg != NULL) 410 *ire_arg = NULL; 411 412 /* 413 * Prevent routes with a zero gateway from being created (since 414 * interfaces can currently be plumbed and brought up with no assigned 415 * address). 416 */ 417 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 418 return (ENETUNREACH); 419 420 /* 421 * If this is the case of RTF_HOST being set, then we set the netmask 422 * to all ones (regardless if one was supplied). 423 */ 424 if (flags & RTF_HOST) 425 mask = &ipv6_all_ones; 426 427 /* 428 * Get the ipif, if any, corresponding to the gw_addr 429 */ 430 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, 431 &error); 432 if (ipif != NULL) 433 ipif_refheld = B_TRUE; 434 else if (error == EINPROGRESS) { 435 ip1dbg(("ip_rt_add_v6: null and EINPROGRESS")); 436 return (error); 437 } 438 439 /* 440 * GateD will attempt to create routes with a loopback interface 441 * address as the gateway and with RTF_GATEWAY set. We allow 442 * these routes to be added, but create them as interface routes 443 * since the gateway is an interface address. 444 */ 445 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) { 446 flags &= ~RTF_GATEWAY; 447 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) && 448 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) && 449 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) { 450 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 451 ipif, ALL_ZONES, NULL, match_flags); 452 if (ire != NULL) { 453 ire_refrele(ire); 454 if (ipif_refheld) 455 ipif_refrele(ipif); 456 return (EEXIST); 457 } 458 ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x" 459 "for 0x%x\n", (void *)ipif, 460 ipif->ipif_ire_type, 461 ntohl(ipif->ipif_lcl_addr))); 462 ire = ire_create_v6( 463 dst_addr, 464 mask, 465 &ipif->ipif_v6src_addr, 466 NULL, 467 &ipif->ipif_mtu, 468 NULL, 469 NULL, 470 NULL, 471 ipif->ipif_net_type, 472 ipif->ipif_resolver_mp, 473 ipif, 474 NULL, 475 0, 476 0, 477 flags, 478 &ire_uinfo_null, 479 NULL, 480 NULL); 481 if (ire == NULL) { 482 if (ipif_refheld) 483 ipif_refrele(ipif); 484 return (ENOMEM); 485 } 486 error = ire_add(&ire, q, mp, func, B_FALSE); 487 if (error == 0) 488 goto save_ire; 489 /* 490 * In the result of failure, ire_add() will have already 491 * deleted the ire in question, so there is no need to 492 * do that here. 493 */ 494 if (ipif_refheld) 495 ipif_refrele(ipif); 496 return (error); 497 } 498 } 499 500 /* 501 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 502 * and the gateway address provided is one of the system's interface 503 * addresses. By using the routing socket interface and supplying an 504 * RTA_IFP sockaddr with an interface index, an alternate method of 505 * specifying an interface route to be created is available which uses 506 * the interface index that specifies the outgoing interface rather than 507 * the address of an outgoing interface (which may not be able to 508 * uniquely identify an interface). When coupled with the RTF_GATEWAY 509 * flag, routes can be specified which not only specify the next-hop to 510 * be used when routing to a certain prefix, but also which outgoing 511 * interface should be used. 512 * 513 * Previously, interfaces would have unique addresses assigned to them 514 * and so the address assigned to a particular interface could be used 515 * to identify a particular interface. One exception to this was the 516 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 517 * 518 * With the advent of IPv6 and its link-local addresses, this 519 * restriction was relaxed and interfaces could share addresses between 520 * themselves. In fact, typically all of the link-local interfaces on 521 * an IPv6 node or router will have the same link-local address. In 522 * order to differentiate between these interfaces, the use of an 523 * interface index is necessary and this index can be carried inside a 524 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 525 * of using the interface index, however, is that all of the ipif's that 526 * are part of an ill have the same index and so the RTA_IFP sockaddr 527 * cannot be used to differentiate between ipif's (or logical 528 * interfaces) that belong to the same ill (physical interface). 529 * 530 * For example, in the following case involving IPv4 interfaces and 531 * logical interfaces 532 * 533 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 534 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0:1 535 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0:2 536 * 537 * the ipif's corresponding to each of these interface routes can be 538 * uniquely identified by the "gateway" (actually interface address). 539 * 540 * In this case involving multiple IPv6 default routes to a particular 541 * link-local gateway, the use of RTA_IFP is necessary to specify which 542 * default route is of interest: 543 * 544 * default fe80::123:4567:89ab:cdef U if0 545 * default fe80::123:4567:89ab:cdef U if1 546 */ 547 548 /* RTF_GATEWAY not set */ 549 if (!(flags & RTF_GATEWAY)) { 550 queue_t *stq; 551 552 if (sp != NULL) { 553 ip2dbg(("ip_rt_add_v6: gateway security attributes " 554 "cannot be set with interface route\n")); 555 if (ipif_refheld) 556 ipif_refrele(ipif); 557 return (EINVAL); 558 } 559 560 /* 561 * As the interface index specified with the RTA_IFP sockaddr is 562 * the same for all ipif's off of an ill, the matching logic 563 * below uses MATCH_IRE_ILL if such an index was specified. 564 * This means that routes sharing the same prefix when added 565 * using a RTA_IFP sockaddr must have distinct interface 566 * indices (namely, they must be on distinct ill's). 567 * 568 * On the other hand, since the gateway address will usually be 569 * different for each ipif on the system, the matching logic 570 * uses MATCH_IRE_IPIF in the case of a traditional interface 571 * route. This means that interface routes for the same prefix 572 * can be created if they belong to distinct ipif's and if a 573 * RTA_IFP sockaddr is not present. 574 */ 575 if (ipif_arg != NULL) { 576 if (ipif_refheld) { 577 ipif_refrele(ipif); 578 ipif_refheld = B_FALSE; 579 } 580 ipif = ipif_arg; 581 match_flags |= MATCH_IRE_ILL; 582 } else { 583 /* 584 * Check the ipif corresponding to the gw_addr 585 */ 586 if (ipif == NULL) 587 return (ENETUNREACH); 588 match_flags |= MATCH_IRE_IPIF; 589 } 590 591 ASSERT(ipif != NULL); 592 /* 593 * We check for an existing entry at this point. 594 */ 595 match_flags |= MATCH_IRE_MASK; 596 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE, 597 ipif, NULL, ALL_ZONES, 0, NULL, match_flags); 598 if (ire != NULL) { 599 ire_refrele(ire); 600 if (ipif_refheld) 601 ipif_refrele(ipif); 602 return (EEXIST); 603 } 604 605 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 606 ? ipif->ipif_rq : ipif->ipif_wq; 607 608 /* 609 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or 610 * IRE_IF_RESOLVER with the modified address and netmask. 611 */ 612 ire = ire_create_v6( 613 dst_addr, 614 mask, 615 &ipif->ipif_v6src_addr, 616 NULL, 617 &ipif->ipif_mtu, 618 NULL, 619 NULL, 620 stq, 621 ipif->ipif_net_type, 622 ipif->ipif_resolver_mp, 623 ipif, 624 NULL, 625 0, 626 0, 627 flags, 628 &ire_uinfo_null, 629 NULL, 630 NULL); 631 if (ire == NULL) { 632 if (ipif_refheld) 633 ipif_refrele(ipif); 634 return (ENOMEM); 635 } 636 637 /* 638 * Some software (for example, GateD and Sun Cluster) attempts 639 * to create (what amount to) IRE_PREFIX routes with the 640 * loopback address as the gateway. This is primarily done to 641 * set up prefixes with the RTF_REJECT flag set (for example, 642 * when generating aggregate routes.) 643 * 644 * If the IRE type (as defined by ipif->ipif_net_type) is 645 * IRE_LOOPBACK, then we map the request into a 646 * IRE_IF_NORESOLVER. 647 * 648 * Needless to say, the real IRE_LOOPBACK is NOT created by this 649 * routine, but rather using ire_create_v6() directly. 650 */ 651 if (ipif->ipif_net_type == IRE_LOOPBACK) 652 ire->ire_type = IRE_IF_NORESOLVER; 653 error = ire_add(&ire, q, mp, func, B_FALSE); 654 if (error == 0) 655 goto save_ire; 656 /* 657 * In the result of failure, ire_add() will have already 658 * deleted the ire in question, so there is no need to 659 * do that here. 660 */ 661 if (ipif_refheld) 662 ipif_refrele(ipif); 663 return (error); 664 } 665 if (ipif_refheld) { 666 ipif_refrele(ipif); 667 ipif_refheld = B_FALSE; 668 } 669 670 /* 671 * Get an interface IRE for the specified gateway. 672 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 673 * gateway, it is currently unreachable and we fail the request 674 * accordingly. 675 */ 676 ipif = ipif_arg; 677 if (ipif_arg != NULL) 678 match_flags |= MATCH_IRE_ILL; 679 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, 680 NULL, ALL_ZONES, 0, NULL, match_flags); 681 if (gw_ire == NULL) 682 return (ENETUNREACH); 683 684 /* 685 * We create one of three types of IREs as a result of this request 686 * based on the netmask. A netmask of all ones (which is automatically 687 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 688 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 689 * created. Otherwise, an IRE_PREFIX route is created for the 690 * destination prefix. 691 */ 692 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 693 type = IRE_HOST; 694 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 695 type = IRE_DEFAULT; 696 else 697 type = IRE_PREFIX; 698 699 /* check for a duplicate entry */ 700 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg, 701 NULL, ALL_ZONES, 0, NULL, 702 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW); 703 if (ire != NULL) { 704 ire_refrele(gw_ire); 705 ire_refrele(ire); 706 return (EEXIST); 707 } 708 709 /* Security attribute exists */ 710 if (sp != NULL) { 711 tsol_gcgrp_addr_t ga; 712 713 /* find or create the gateway credentials group */ 714 ga.ga_af = AF_INET6; 715 ga.ga_addr = *gw_addr; 716 717 /* we hold reference to it upon success */ 718 gcgrp = gcgrp_lookup(&ga, B_TRUE); 719 if (gcgrp == NULL) { 720 ire_refrele(gw_ire); 721 return (ENOMEM); 722 } 723 724 /* 725 * Create and add the security attribute to the group; a 726 * reference to the group is made upon allocating a new 727 * entry successfully. If it finds an already-existing 728 * entry for the security attribute in the group, it simply 729 * returns it and no new reference is made to the group. 730 */ 731 gc = gc_create(sp, gcgrp, &gcgrp_xtraref); 732 if (gc == NULL) { 733 /* release reference held by gcgrp_lookup */ 734 GCGRP_REFRELE(gcgrp); 735 ire_refrele(gw_ire); 736 return (ENOMEM); 737 } 738 } 739 740 /* Create the IRE. */ 741 ire = ire_create_v6( 742 dst_addr, /* dest address */ 743 mask, /* mask */ 744 /* src address assigned by the caller? */ 745 (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ? 746 src_addr : NULL), 747 gw_addr, /* gateway address */ 748 &gw_ire->ire_max_frag, 749 NULL, /* no Fast Path header */ 750 NULL, /* no recv-from queue */ 751 NULL, /* no send-to queue */ 752 (ushort_t)type, /* IRE type */ 753 NULL, 754 ipif_arg, 755 NULL, 756 0, 757 0, 758 flags, 759 &gw_ire->ire_uinfo, /* Inherit ULP info from gw */ 760 gc, /* security attribute */ 761 NULL); 762 /* 763 * The ire holds a reference to the 'gc' and the 'gc' holds a 764 * reference to the 'gcgrp'. We can now release the extra reference 765 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used. 766 */ 767 if (gcgrp_xtraref) 768 GCGRP_REFRELE(gcgrp); 769 if (ire == NULL) { 770 if (gc != NULL) 771 GC_REFRELE(gc); 772 ire_refrele(gw_ire); 773 return (ENOMEM); 774 } 775 776 /* 777 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 778 * SUN/OS socket stuff does but do we really want to allow ::0 ? 779 */ 780 781 /* Add the new IRE. */ 782 error = ire_add(&ire, q, mp, func, B_FALSE); 783 /* 784 * In the result of failure, ire_add() will have already 785 * deleted the ire in question, so there is no need to 786 * do that here. 787 */ 788 if (error != 0) { 789 ire_refrele(gw_ire); 790 return (error); 791 } 792 793 if (flags & RTF_MULTIRT) { 794 /* 795 * Invoke the CGTP (multirouting) filtering module 796 * to add the dst address in the filtering database. 797 * Replicated inbound packets coming from that address 798 * will be filtered to discard the duplicates. 799 * It is not necessary to call the CGTP filter hook 800 * when the dst address is a multicast, because an 801 * IP source address cannot be a multicast. 802 */ 803 if ((ip_cgtp_filter_ops != NULL) && 804 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 805 int res = ip_cgtp_filter_ops->cfo_add_dest_v6( 806 &ire->ire_addr_v6, 807 &ire->ire_gateway_addr_v6, 808 &ire->ire_src_addr_v6, 809 &gw_ire->ire_src_addr_v6); 810 if (res != 0) { 811 ire_refrele(gw_ire); 812 ire_delete(ire); 813 return (res); 814 } 815 } 816 } 817 818 /* 819 * Now that the prefix IRE entry has been created, delete any 820 * existing gateway IRE cache entries as well as any IRE caches 821 * using the gateway, and force them to be created through 822 * ip_newroute_v6. 823 */ 824 if (gc != NULL) { 825 ASSERT(gcgrp != NULL); 826 ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES); 827 } 828 829 save_ire: 830 if (gw_ire != NULL) { 831 ire_refrele(gw_ire); 832 } 833 if (ipif != NULL) { 834 mblk_t *save_mp; 835 836 /* 837 * Save enough information so that we can recreate the IRE if 838 * the interface goes down and then up. The metrics associated 839 * with the route will be saved as well when rts_setmetrics() is 840 * called after the IRE has been created. In the case where 841 * memory cannot be allocated, none of this information will be 842 * saved. 843 */ 844 save_mp = allocb(sizeof (ifrt_t), BPRI_MED); 845 if (save_mp != NULL) { 846 ifrt_t *ifrt; 847 848 save_mp->b_wptr += sizeof (ifrt_t); 849 ifrt = (ifrt_t *)save_mp->b_rptr; 850 bzero(ifrt, sizeof (ifrt_t)); 851 ifrt->ifrt_type = ire->ire_type; 852 ifrt->ifrt_v6addr = ire->ire_addr_v6; 853 mutex_enter(&ire->ire_lock); 854 ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6; 855 ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6; 856 mutex_exit(&ire->ire_lock); 857 ifrt->ifrt_v6mask = ire->ire_mask_v6; 858 ifrt->ifrt_flags = ire->ire_flags; 859 ifrt->ifrt_max_frag = ire->ire_max_frag; 860 mutex_enter(&ipif->ipif_saved_ire_lock); 861 save_mp->b_cont = ipif->ipif_saved_ire_mp; 862 ipif->ipif_saved_ire_mp = save_mp; 863 ipif->ipif_saved_ire_cnt++; 864 mutex_exit(&ipif->ipif_saved_ire_lock); 865 } 866 } 867 if (ire_arg != NULL) { 868 /* 869 * Store the ire that was successfully added into where ire_arg 870 * points to so that callers don't have to look it up 871 * themselves (but they are responsible for ire_refrele()ing 872 * the ire when they are finished with it). 873 */ 874 *ire_arg = ire; 875 } else { 876 ire_refrele(ire); /* Held in ire_add */ 877 } 878 if (ipif_refheld) 879 ipif_refrele(ipif); 880 return (0); 881 } 882 883 /* 884 * ip_rt_delete_v6 is called to delete an IPv6 route. 885 * ipif_arg is passed in to associate it with the correct interface 886 * (for link-local destinations and gateways). 887 */ 888 /* ARGSUSED4 */ 889 int 890 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 891 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg, 892 queue_t *q, mblk_t *mp, ipsq_func_t func) 893 { 894 ire_t *ire = NULL; 895 ipif_t *ipif; 896 uint_t type; 897 uint_t match_flags = MATCH_IRE_TYPE; 898 int err = 0; 899 boolean_t ipif_refheld = B_FALSE; 900 901 /* 902 * If this is the case of RTF_HOST being set, then we set the netmask 903 * to all ones. Otherwise, we use the netmask if one was supplied. 904 */ 905 if (flags & RTF_HOST) { 906 mask = &ipv6_all_ones; 907 match_flags |= MATCH_IRE_MASK; 908 } else if (rtm_addrs & RTA_NETMASK) { 909 match_flags |= MATCH_IRE_MASK; 910 } 911 912 /* 913 * Note that RTF_GATEWAY is never set on a delete, therefore 914 * we check if the gateway address is one of our interfaces first, 915 * and fall back on RTF_GATEWAY routes. 916 * 917 * This makes it possible to delete an original 918 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 919 * 920 * As the interface index specified with the RTA_IFP sockaddr is the 921 * same for all ipif's off of an ill, the matching logic below uses 922 * MATCH_IRE_ILL if such an index was specified. This means a route 923 * sharing the same prefix and interface index as the the route 924 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr 925 * is specified in the request. 926 * 927 * On the other hand, since the gateway address will usually be 928 * different for each ipif on the system, the matching logic 929 * uses MATCH_IRE_IPIF in the case of a traditional interface 930 * route. This means that interface routes for the same prefix can be 931 * uniquely identified if they belong to distinct ipif's and if a 932 * RTA_IFP sockaddr is not present. 933 * 934 * For more detail on specifying routes by gateway address and by 935 * interface index, see the comments in ip_rt_add_v6(). 936 */ 937 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err); 938 if (ipif != NULL) { 939 ipif_refheld = B_TRUE; 940 if (ipif_arg != NULL) { 941 ipif_refrele(ipif); 942 ipif_refheld = B_FALSE; 943 ipif = ipif_arg; 944 match_flags |= MATCH_IRE_ILL; 945 } else { 946 match_flags |= MATCH_IRE_IPIF; 947 } 948 949 if (ipif->ipif_ire_type == IRE_LOOPBACK) 950 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 951 ipif, ALL_ZONES, NULL, match_flags); 952 if (ire == NULL) 953 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, 954 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL, 955 match_flags); 956 } else if (err == EINPROGRESS) { 957 return (err); 958 } else { 959 err = 0; 960 } 961 if (ire == NULL) { 962 /* 963 * At this point, the gateway address is not one of our own 964 * addresses or a matching interface route was not found. We 965 * set the IRE type to lookup based on whether 966 * this is a host route, a default route or just a prefix. 967 * 968 * If an ipif_arg was passed in, then the lookup is based on an 969 * interface index so MATCH_IRE_ILL is added to match_flags. 970 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is 971 * set as the route being looked up is not a traditional 972 * interface route. 973 */ 974 match_flags &= ~MATCH_IRE_IPIF; 975 match_flags |= MATCH_IRE_GW; 976 if (ipif_arg != NULL) 977 match_flags |= MATCH_IRE_ILL; 978 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 979 type = IRE_HOST; 980 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 981 type = IRE_DEFAULT; 982 else 983 type = IRE_PREFIX; 984 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 985 ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags); 986 if (ire == NULL && type == IRE_HOST) { 987 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, 988 IRE_HOST_REDIRECT, ipif_arg, NULL, ALL_ZONES, 0, 989 NULL, match_flags); 990 } 991 } 992 993 if (ipif_refheld) { 994 ipif_refrele(ipif); 995 ipif_refheld = B_FALSE; 996 } 997 if (ire == NULL) 998 return (ESRCH); 999 1000 if (ire->ire_flags & RTF_MULTIRT) { 1001 /* 1002 * Invoke the CGTP (multirouting) filtering module 1003 * to remove the dst address from the filtering database. 1004 * Packets coming from that address will no longer be 1005 * filtered to remove duplicates. 1006 */ 1007 if (ip_cgtp_filter_ops != NULL) { 1008 err = ip_cgtp_filter_ops->cfo_del_dest_v6( 1009 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 1010 } 1011 } 1012 1013 ipif = ire->ire_ipif; 1014 if (ipif != NULL) { 1015 mblk_t **mpp; 1016 mblk_t *mp; 1017 ifrt_t *ifrt; 1018 in6_addr_t gw_addr_v6; 1019 1020 /* Remove from ipif_saved_ire_mp list if it is there */ 1021 mutex_enter(&ire->ire_lock); 1022 gw_addr_v6 = ire->ire_gateway_addr_v6; 1023 mutex_exit(&ire->ire_lock); 1024 mutex_enter(&ipif->ipif_saved_ire_lock); 1025 for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL; 1026 mpp = &(*mpp)->b_cont) { 1027 /* 1028 * On a given ipif, the triple of address, gateway and 1029 * mask is unique for each saved IRE (in the case of 1030 * ordinary interface routes, the gateway address is 1031 * all-zeroes). 1032 */ 1033 mp = *mpp; 1034 ifrt = (ifrt_t *)mp->b_rptr; 1035 if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr, 1036 &ire->ire_addr_v6) && 1037 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr, 1038 &gw_addr_v6) && 1039 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask, 1040 &ire->ire_mask_v6)) { 1041 *mpp = mp->b_cont; 1042 ipif->ipif_saved_ire_cnt--; 1043 freeb(mp); 1044 break; 1045 } 1046 } 1047 mutex_exit(&ipif->ipif_saved_ire_lock); 1048 } 1049 ire_delete(ire); 1050 ire_refrele(ire); 1051 return (err); 1052 } 1053 1054 /* 1055 * Derive a token from the link layer address. 1056 */ 1057 boolean_t 1058 ill_setdefaulttoken(ill_t *ill) 1059 { 1060 int i; 1061 in6_addr_t v6addr, v6mask; 1062 1063 /* 1064 * Though we execute on the ipsq, we need to hold the ill_lock 1065 * to prevent readers from seeing partially updated values 1066 * while we do the update. 1067 */ 1068 mutex_enter(&ill->ill_lock); 1069 if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length, 1070 ill->ill_phys_addr, &v6addr)) { 1071 mutex_exit(&ill->ill_lock); 1072 return (B_FALSE); 1073 } 1074 1075 (void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask); 1076 1077 for (i = 0; i < 4; i++) 1078 v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^ 1079 (uint32_t)0xffffffff; 1080 1081 V6_MASK_COPY(v6addr, v6mask, ill->ill_token); 1082 ill->ill_token_length = IPV6_TOKEN_LEN; 1083 mutex_exit(&ill->ill_lock); 1084 return (B_TRUE); 1085 } 1086 1087 /* 1088 * Create a link-local address from a token. 1089 */ 1090 static void 1091 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 1092 { 1093 int i; 1094 1095 for (i = 0; i < 4; i++) { 1096 dest->s6_addr32[i] = 1097 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 1098 } 1099 } 1100 1101 /* 1102 * Set a nice default address for either automatic tunnels tsrc/96 or 1103 * 6to4 tunnels 2002:<tsrc>::1/64 1104 */ 1105 static void 1106 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta) 1107 { 1108 sin6_t sin6; 1109 sin_t *sin; 1110 ill_t *ill = ipif->ipif_ill; 1111 tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr; 1112 1113 if (ta->ifta_saddr.ss_family != AF_INET || 1114 (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 || 1115 (ta->ifta_flags & IFTUN_SRC) == 0) 1116 return; 1117 1118 /* 1119 * Check the tunnel type by examining q_next->q_ptr 1120 */ 1121 if (tp->tun_flags & TUN_AUTOMATIC) { 1122 /* this is an automatic tunnel */ 1123 (void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS, 1124 &ipif->ipif_v6net_mask); 1125 bzero(&sin6, sizeof (sin6_t)); 1126 sin = (sin_t *)&ta->ifta_saddr; 1127 V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr; 1128 sin6.sin6_family = AF_INET6; 1129 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1130 NULL, NULL, NULL, NULL); 1131 } else if (tp->tun_flags & TUN_6TO4) { 1132 /* this is a 6to4 tunnel */ 1133 (void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN, 1134 &ipif->ipif_v6net_mask); 1135 sin = (sin_t *)&ta->ifta_saddr; 1136 /* create a 6to4 address from the IPv4 tsrc */ 1137 IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr); 1138 sin6.sin6_family = AF_INET6; 1139 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1140 NULL, NULL, NULL, NULL); 1141 } else { 1142 ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type")); 1143 return; 1144 } 1145 } 1146 1147 /* 1148 * Set link local for ipif_id 0 of a configured tunnel based on the 1149 * tsrc or tdst parameter 1150 * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as 1151 * the token. 1152 * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address 1153 * as the token for the "outer" link. 1154 */ 1155 void 1156 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta) 1157 { 1158 ipif_t *ipif; 1159 sin_t *sin; 1160 in6_addr_t *s6addr; 1161 1162 ASSERT(IAM_WRITER_ILL(ill)); 1163 1164 /* The first ipif must be id zero. */ 1165 ipif = ill->ill_ipif; 1166 ASSERT(ipif->ipif_id == 0); 1167 1168 /* no link local for automatic tunnels */ 1169 if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) { 1170 ipif_set_tun_auto_addr(ipif, ta); 1171 return; 1172 } 1173 1174 if ((ta->ifta_flags & IFTUN_DST) && 1175 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 1176 sin6_t sin6; 1177 1178 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1179 bzero(&sin6, sizeof (sin6_t)); 1180 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1181 sin = (sin_t *)&ta->ifta_daddr; 1182 V4_PART_OF_V6(sin6.sin6_addr) = 1183 sin->sin_addr.s_addr; 1184 } else { 1185 s6addr = 1186 &((sin6_t *)&ta->ifta_daddr)->sin6_addr; 1187 sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3]; 1188 sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2]; 1189 } 1190 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, 1191 &sin6.sin6_addr); 1192 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1193 } 1194 if ((ta->ifta_flags & IFTUN_SRC)) { 1195 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1196 1197 /* Set the token if it isn't already set */ 1198 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) { 1199 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1200 sin = (sin_t *)&ta->ifta_saddr; 1201 V4_PART_OF_V6(ill->ill_token) = 1202 sin->sin_addr.s_addr; 1203 } else { 1204 s6addr = 1205 &((sin6_t *)&ta->ifta_saddr)->sin6_addr; 1206 ill->ill_token.s6_addr32[3] = 1207 s6addr->s6_addr32[3]; 1208 ill->ill_token.s6_addr32[2] = 1209 s6addr->s6_addr32[2]; 1210 } 1211 ill->ill_token_length = IPV6_TOKEN_LEN; 1212 } 1213 /* 1214 * Attempt to set the link local address if it isn't set. 1215 */ 1216 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) 1217 (void) ipif_setlinklocal(ipif); 1218 } 1219 } 1220 1221 /* 1222 * Is it not possible to set the link local address? 1223 * The address can be set if the token is set, and the token 1224 * isn't too long. 1225 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1226 */ 1227 boolean_t 1228 ipif_cant_setlinklocal(ipif_t *ipif) 1229 { 1230 ill_t *ill = ipif->ipif_ill; 1231 1232 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1233 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1234 return (B_TRUE); 1235 1236 return (B_FALSE); 1237 } 1238 1239 /* 1240 * Generate a link-local address from the token. 1241 * Return zero if the address was set, or non-zero if it couldn't be set. 1242 */ 1243 int 1244 ipif_setlinklocal(ipif_t *ipif) 1245 { 1246 ill_t *ill = ipif->ipif_ill; 1247 1248 ASSERT(IAM_WRITER_ILL(ill)); 1249 1250 if (ipif_cant_setlinklocal(ipif)) 1251 return (-1); 1252 1253 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1254 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1255 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1256 ipif->ipif_v6subnet); 1257 1258 if (ipif->ipif_flags & IPIF_NOLOCAL) { 1259 ipif->ipif_v6src_addr = ipv6_all_zeros; 1260 } else { 1261 ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr; 1262 } 1263 return (0); 1264 } 1265 1266 /* 1267 * This function sets up the multicast mappings in NDP. 1268 * Unlike ARP, there are no mapping_mps here. We delete the 1269 * mapping nces and add a new one. 1270 * 1271 * Returns non-zero on error and 0 on success. 1272 */ 1273 int 1274 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce) 1275 { 1276 ill_t *ill = ipif->ipif_ill; 1277 in6_addr_t v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0}; 1278 in6_addr_t v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0}; 1279 in6_addr_t v6_extract_mask; 1280 uchar_t *phys_addr, *bphys_addr, *alloc_phys; 1281 nce_t *mnce = NULL; 1282 int err = 0; 1283 phyint_t *phyi = ill->ill_phyint; 1284 uint32_t hw_extract_start; 1285 dl_unitdata_req_t *dlur; 1286 1287 if (ret_nce != NULL) 1288 *ret_nce = NULL; 1289 /* 1290 * Delete the mapping nce. Normally these should not exist 1291 * as a previous ipif_down -> ipif_ndp_down should have deleted 1292 * all the nces. But they can exist if ip_rput_dlpi_writer 1293 * calls this when PHYI_MULTI_BCAST is set. 1294 */ 1295 mnce = ndp_lookup_v6(ill, &v6_mcast_addr, B_FALSE); 1296 if (mnce != NULL) { 1297 ndp_delete(mnce); 1298 NCE_REFRELE(mnce); 1299 mnce = NULL; 1300 } 1301 1302 /* 1303 * Get media specific v6 mapping information. Note that 1304 * nd_lla_len can be 0 for tunnels. 1305 */ 1306 alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP); 1307 if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0)) 1308 return (ENOMEM); 1309 /* 1310 * Determine the broadcast address. 1311 */ 1312 dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr; 1313 if (ill->ill_sap_length < 0) 1314 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset; 1315 else 1316 bphys_addr = (uchar_t *)dlur + 1317 dlur->dl_dest_addr_offset + ill->ill_sap_length; 1318 1319 /* 1320 * Check PHYI_MULTI_BCAST and possible length of physical 1321 * address to determine if we use the mapping or the 1322 * broadcast address. 1323 */ 1324 if ((phyi->phyint_flags & PHYI_MULTI_BCAST) || 1325 (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len, 1326 bphys_addr, alloc_phys, &hw_extract_start, 1327 &v6_extract_mask))) { 1328 if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) { 1329 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1330 return (E2BIG); 1331 } 1332 /* Use the link-layer broadcast address for MULTI_BCAST */ 1333 phys_addr = bphys_addr; 1334 bzero(&v6_extract_mask, sizeof (v6_extract_mask)); 1335 hw_extract_start = ill->ill_nd_lla_len; 1336 } else { 1337 phys_addr = alloc_phys; 1338 } 1339 if ((ipif->ipif_flags & IPIF_BROADCAST) || 1340 (ill->ill_flags & ILLF_MULTICAST) || 1341 (phyi->phyint_flags & PHYI_MULTI_BCAST)) { 1342 mutex_enter(&ndp6.ndp_g_lock); 1343 err = ndp_add(ill, 1344 phys_addr, 1345 &v6_mcast_addr, /* v6 address */ 1346 &v6_mcast_mask, /* v6 mask */ 1347 &v6_extract_mask, 1348 hw_extract_start, 1349 NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD, 1350 ND_REACHABLE, 1351 &mnce, 1352 NULL, 1353 NULL); 1354 mutex_exit(&ndp6.ndp_g_lock); 1355 if (err == 0) { 1356 if (ret_nce != NULL) { 1357 *ret_nce = mnce; 1358 } else { 1359 NCE_REFRELE(mnce); 1360 } 1361 } 1362 } 1363 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1364 return (err); 1365 } 1366 1367 /* 1368 * Get the resolver set up for a new interface address. (Always called 1369 * as writer.) 1370 */ 1371 int 1372 ipif_ndp_up(ipif_t *ipif, const in6_addr_t *addr, boolean_t macaddr_change) 1373 { 1374 ill_t *ill = ipif->ipif_ill; 1375 int err = 0; 1376 nce_t *nce = NULL; 1377 nce_t *mnce = NULL; 1378 1379 ip1dbg(("ipif_ndp_up(%s:%u)\n", 1380 ipif->ipif_ill->ill_name, ipif->ipif_id)); 1381 1382 /* 1383 * ND not supported on XRESOLV interfaces. If ND support (multicast) 1384 * added later, take out this check. 1385 */ 1386 if ((ill->ill_flags & ILLF_XRESOLV) || 1387 IN6_IS_ADDR_UNSPECIFIED(addr) || 1388 (!(ill->ill_net_type & IRE_INTERFACE))) { 1389 ipif->ipif_addr_ready = 1; 1390 return (0); 1391 } 1392 1393 /* 1394 * Need to setup multicast mapping only when the first 1395 * interface is coming UP. 1396 */ 1397 if (ill->ill_ipif_up_count == 0 && 1398 (ill->ill_flags & ILLF_MULTICAST)) { 1399 /* 1400 * We set the multicast before setting up the mapping for 1401 * local address because ipif_ndp_setup_multicast does 1402 * ndp_walk to delete nces which will delete the mapping 1403 * for local address also if we added the mapping for 1404 * local address first. 1405 */ 1406 err = ipif_ndp_setup_multicast(ipif, &mnce); 1407 if (err != 0) 1408 return (err); 1409 } 1410 1411 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1412 uint16_t flags; 1413 uchar_t *hw_addr = NULL; 1414 1415 /* Permanent entries don't need NUD */ 1416 flags = NCE_F_PERMANENT; 1417 flags |= NCE_F_NONUD; 1418 if (ill->ill_flags & ILLF_ROUTER) 1419 flags |= NCE_F_ISROUTER; 1420 1421 if (ipif->ipif_flags & IPIF_ANYCAST) 1422 flags |= NCE_F_ANYCAST; 1423 1424 if (ill->ill_net_type == IRE_IF_RESOLVER) { 1425 hw_addr = ill->ill_nd_lla; 1426 1427 if (ill->ill_move_in_progress || macaddr_change) { 1428 /* 1429 * Addresses are failing over to this ill. 1430 * Don't wait for NUD to see this change. 1431 * Publish our new link-layer address. 1432 */ 1433 flags |= NCE_F_UNSOL_ADV; 1434 } 1435 } 1436 err = ndp_lookup_then_add(ill, 1437 hw_addr, 1438 addr, 1439 &ipv6_all_ones, 1440 &ipv6_all_zeros, 1441 0, 1442 flags, 1443 ND_PROBE, /* Causes Duplicate Address Detection to run */ 1444 &nce, 1445 NULL, 1446 NULL); 1447 switch (err) { 1448 case 0: 1449 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1450 ill->ill_name)); 1451 ipif->ipif_addr_ready = 1; 1452 break; 1453 case EINPROGRESS: 1454 ip1dbg(("ipif_ndp_up: running DAD now for %s\n", 1455 ill->ill_name)); 1456 break; 1457 case EEXIST: 1458 NCE_REFRELE(nce); 1459 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1460 ill->ill_name)); 1461 if (mnce != NULL) { 1462 ndp_delete(mnce); 1463 NCE_REFRELE(mnce); 1464 } 1465 return (err); 1466 default: 1467 ip1dbg(("ipif_ndp_up: NCE creation failed %s\n", 1468 ill->ill_name)); 1469 if (mnce != NULL) { 1470 ndp_delete(mnce); 1471 NCE_REFRELE(mnce); 1472 } 1473 return (err); 1474 } 1475 } else { 1476 /* No local NCE for this entry */ 1477 ipif->ipif_addr_ready = 1; 1478 } 1479 if (nce != NULL) 1480 NCE_REFRELE(nce); 1481 if (mnce != NULL) 1482 NCE_REFRELE(mnce); 1483 return (0); 1484 } 1485 1486 /* Remove all cache entries for this logical interface */ 1487 void 1488 ipif_ndp_down(ipif_t *ipif) 1489 { 1490 nce_t *nce; 1491 1492 if (ipif->ipif_isv6) { 1493 nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, 1494 B_FALSE); 1495 if (nce != NULL) { 1496 ndp_delete(nce); 1497 NCE_REFRELE(nce); 1498 } 1499 } 1500 /* 1501 * Remove mapping and all other nces dependent on this ill 1502 * when the last ipif is going away. 1503 */ 1504 if (ipif->ipif_ill->ill_ipif_up_count == 0) { 1505 ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill, 1506 (uchar_t *)ipif->ipif_ill); 1507 } 1508 } 1509 1510 /* 1511 * Used when an interface comes up to recreate any extra routes on this 1512 * interface. 1513 */ 1514 static ire_t ** 1515 ipif_recover_ire_v6(ipif_t *ipif) 1516 { 1517 mblk_t *mp; 1518 ire_t **ipif_saved_irep; 1519 ire_t **irep; 1520 1521 ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name, 1522 ipif->ipif_id)); 1523 1524 ASSERT(ipif->ipif_isv6); 1525 1526 mutex_enter(&ipif->ipif_saved_ire_lock); 1527 ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) * 1528 ipif->ipif_saved_ire_cnt, KM_NOSLEEP); 1529 if (ipif_saved_irep == NULL) { 1530 mutex_exit(&ipif->ipif_saved_ire_lock); 1531 return (NULL); 1532 } 1533 1534 irep = ipif_saved_irep; 1535 1536 for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) { 1537 ire_t *ire; 1538 queue_t *rfq; 1539 queue_t *stq; 1540 ifrt_t *ifrt; 1541 in6_addr_t *src_addr; 1542 in6_addr_t *gateway_addr; 1543 mblk_t *resolver_mp; 1544 char buf[INET6_ADDRSTRLEN]; 1545 ushort_t type; 1546 1547 /* 1548 * When the ire was initially created and then added in 1549 * ip_rt_add_v6(), it was created either using 1550 * ipif->ipif_net_type in the case of a traditional interface 1551 * route, or as one of the IRE_OFFSUBNET types (with the 1552 * exception of IRE_HOST_REDIRECT which is created by 1553 * icmp_redirect_v6() and which we don't need to save or 1554 * recover). In the case where ipif->ipif_net_type was 1555 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to 1556 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy 1557 * software like GateD and Sun Cluster which creates routes 1558 * using the the loopback interface's address as a gateway. 1559 * 1560 * As ifrt->ifrt_type reflects the already updated ire_type and 1561 * since ire_create_v6() expects that IRE_IF_NORESOLVER will 1562 * have a valid ire_dlureq_mp field (which doesn't make sense 1563 * for a IRE_LOOPBACK), ire_create_v6() will be called in the 1564 * same way here as in ip_rt_add_v6(), namely using 1565 * ipif->ipif_net_type when the route looks like a traditional 1566 * interface route (where ifrt->ifrt_type & IRE_INTERFACE is 1567 * true) and otherwise using the saved ifrt->ifrt_type. This 1568 * means that in the case where ipif->ipif_net_type is 1569 * IRE_LOOPBACK, the ire created by ire_create_v6() will be an 1570 * IRE_LOOPBACK, it will then be turned into an 1571 * IRE_IF_NORESOLVER and then added by ire_add_v6(). 1572 */ 1573 ifrt = (ifrt_t *)mp->b_rptr; 1574 if (ifrt->ifrt_type & IRE_INTERFACE) { 1575 rfq = NULL; 1576 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 1577 ? ipif->ipif_rq : ipif->ipif_wq; 1578 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1579 ? &ifrt->ifrt_v6src_addr 1580 : &ipif->ipif_v6src_addr; 1581 gateway_addr = NULL; 1582 resolver_mp = ipif->ipif_resolver_mp; 1583 type = ipif->ipif_net_type; 1584 } else { 1585 rfq = NULL; 1586 stq = NULL; 1587 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1588 ? &ifrt->ifrt_v6src_addr : NULL; 1589 gateway_addr = &ifrt->ifrt_v6gateway_addr; 1590 resolver_mp = NULL; 1591 type = ifrt->ifrt_type; 1592 } 1593 1594 /* 1595 * Create a copy of the IRE with the saved address and netmask. 1596 */ 1597 ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n", 1598 ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type, 1599 inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)), 1600 ip_mask_to_plen_v6(&ifrt->ifrt_v6mask))); 1601 ire = ire_create_v6( 1602 &ifrt->ifrt_v6addr, 1603 &ifrt->ifrt_v6mask, 1604 src_addr, 1605 gateway_addr, 1606 &ifrt->ifrt_max_frag, 1607 NULL, 1608 rfq, 1609 stq, 1610 type, 1611 resolver_mp, 1612 ipif, 1613 NULL, 1614 0, 1615 0, 1616 ifrt->ifrt_flags, 1617 &ifrt->ifrt_iulp_info, 1618 NULL, 1619 NULL); 1620 if (ire == NULL) { 1621 mutex_exit(&ipif->ipif_saved_ire_lock); 1622 kmem_free(ipif_saved_irep, 1623 ipif->ipif_saved_ire_cnt * sizeof (ire_t *)); 1624 return (NULL); 1625 } 1626 1627 /* 1628 * Some software (for example, GateD and Sun Cluster) attempts 1629 * to create (what amount to) IRE_PREFIX routes with the 1630 * loopback address as the gateway. This is primarily done to 1631 * set up prefixes with the RTF_REJECT flag set (for example, 1632 * when generating aggregate routes.) 1633 * 1634 * If the IRE type (as defined by ipif->ipif_net_type) is 1635 * IRE_LOOPBACK, then we map the request into a 1636 * IRE_IF_NORESOLVER. 1637 */ 1638 if (ipif->ipif_net_type == IRE_LOOPBACK) 1639 ire->ire_type = IRE_IF_NORESOLVER; 1640 /* 1641 * ire held by ire_add, will be refreled' in ipif_up_done 1642 * towards the end 1643 */ 1644 (void) ire_add(&ire, NULL, NULL, NULL, B_FALSE); 1645 *irep = ire; 1646 irep++; 1647 ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire)); 1648 } 1649 mutex_exit(&ipif->ipif_saved_ire_lock); 1650 return (ipif_saved_irep); 1651 } 1652 1653 /* 1654 * Return the scope of the given IPv6 address. If the address is an 1655 * IPv4 mapped IPv6 address, return the scope of the corresponding 1656 * IPv4 address. 1657 */ 1658 in6addr_scope_t 1659 ip_addr_scope_v6(const in6_addr_t *addr) 1660 { 1661 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1662 1663 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1664 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1665 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1666 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1667 return (IP6_SCOPE_LINKLOCAL); 1668 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1669 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1670 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1671 return (IP6_SCOPE_SITELOCAL); 1672 return (IP6_SCOPE_GLOBAL); 1673 } 1674 1675 if (IN6_IS_ADDR_MULTICAST(addr)) 1676 return (IN6_ADDR_MC_SCOPE(addr)); 1677 1678 /* link-local and loopback addresses are of link-local scope */ 1679 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1680 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1681 return (IP6_SCOPE_LINKLOCAL); 1682 if (IN6_IS_ADDR_SITELOCAL(addr)) 1683 return (IP6_SCOPE_SITELOCAL); 1684 return (IP6_SCOPE_GLOBAL); 1685 } 1686 1687 1688 /* 1689 * Calculates the xor of a1 and a2, and stores the result in res. 1690 */ 1691 static void 1692 ip_addr_xor_v6(const in6_addr_t *a1, const in6_addr_t *a2, in6_addr_t *res) 1693 { 1694 int i; 1695 1696 for (i = 0; i < 4; i++) 1697 res->s6_addr32[i] = a1->s6_addr32[i] ^ a2->s6_addr32[i]; 1698 } 1699 1700 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1701 (((ipif)->ipif_flags & IPIF_UP) && \ 1702 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \ 1703 (ipif)->ipif_addr_ready) 1704 1705 /* source address candidate */ 1706 typedef struct candidate { 1707 ipif_t *cand_ipif; 1708 /* The properties of this candidate */ 1709 boolean_t cand_isdst; 1710 boolean_t cand_isdst_set; 1711 in6addr_scope_t cand_scope; 1712 boolean_t cand_scope_set; 1713 boolean_t cand_isdeprecated; 1714 boolean_t cand_isdeprecated_set; 1715 boolean_t cand_ispreferred; 1716 boolean_t cand_ispreferred_set; 1717 boolean_t cand_matchedinterface; 1718 boolean_t cand_matchedinterface_set; 1719 boolean_t cand_matchedlabel; 1720 boolean_t cand_matchedlabel_set; 1721 boolean_t cand_istmp; 1722 boolean_t cand_istmp_set; 1723 in6_addr_t cand_xor; 1724 boolean_t cand_xor_set; 1725 } cand_t; 1726 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1727 #define cand_flags cand_ipif->ipif_flags 1728 #define cand_ill cand_ipif->ipif_ill 1729 #define cand_zoneid cand_ipif->ipif_zoneid 1730 1731 /* information about the destination for source address selection */ 1732 typedef struct dstinfo { 1733 const in6_addr_t *dst_addr; 1734 ill_t *dst_ill; 1735 uint_t dst_restrict_ill; 1736 boolean_t dst_prefer_src_tmp; 1737 in6addr_scope_t dst_scope; 1738 char *dst_label; 1739 } dstinfo_t; 1740 1741 /* 1742 * The following functions are rules used to select a source address in 1743 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1744 * against the best candidate (bc). Each rule has three possible outcomes; 1745 * the candidate is preferred over the best candidate (CAND_PREFER), the 1746 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1747 * candidate is of equal value as the best candidate (CAND_TIE). 1748 * 1749 * These rules are part of a greater "Default Address Selection for IPv6" 1750 * sheme, which is standards based work coming out of the IETF ipv6 working 1751 * group. The IETF document defines both IPv6 source address selection and 1752 * destination address ordering. The rules defined here implement the IPv6 1753 * source address selection. Destination address ordering is done by 1754 * libnsl, and uses a similar set of rules to implement the sorting. 1755 */ 1756 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1757 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *); 1758 1759 /* Prefer an address if it is equal to the destination address. */ 1760 static rule_res_t 1761 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1762 { 1763 if (!bc->cand_isdst_set) { 1764 bc->cand_isdst = 1765 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1766 bc->cand_isdst_set = B_TRUE; 1767 } 1768 1769 cc->cand_isdst = 1770 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1771 cc->cand_isdst_set = B_TRUE; 1772 1773 if (cc->cand_isdst == bc->cand_isdst) 1774 return (CAND_TIE); 1775 else if (cc->cand_isdst) 1776 return (CAND_PREFER); 1777 else 1778 return (CAND_AVOID); 1779 } 1780 1781 /* 1782 * Prefer addresses that are of closest scope to the destination. Always 1783 * prefer addresses that are of greater scope than the destination over 1784 * those that are of lesser scope than the destination. 1785 */ 1786 static rule_res_t 1787 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1788 { 1789 if (!bc->cand_scope_set) { 1790 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1791 bc->cand_scope_set = B_TRUE; 1792 } 1793 1794 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1795 cc->cand_scope_set = B_TRUE; 1796 1797 if (cc->cand_scope < bc->cand_scope) { 1798 if (cc->cand_scope < dstinfo->dst_scope) 1799 return (CAND_AVOID); 1800 else 1801 return (CAND_PREFER); 1802 } else if (bc->cand_scope < cc->cand_scope) { 1803 if (bc->cand_scope < dstinfo->dst_scope) 1804 return (CAND_PREFER); 1805 else 1806 return (CAND_AVOID); 1807 } else { 1808 return (CAND_TIE); 1809 } 1810 } 1811 1812 /* 1813 * Prefer non-deprecated source addresses. 1814 */ 1815 /* ARGSUSED2 */ 1816 static rule_res_t 1817 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1818 { 1819 if (!bc->cand_isdeprecated_set) { 1820 bc->cand_isdeprecated = 1821 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 1822 bc->cand_isdeprecated_set = B_TRUE; 1823 } 1824 1825 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 1826 cc->cand_isdeprecated_set = B_TRUE; 1827 1828 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 1829 return (CAND_TIE); 1830 else if (cc->cand_isdeprecated) 1831 return (CAND_AVOID); 1832 else 1833 return (CAND_PREFER); 1834 } 1835 1836 /* 1837 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 1838 * rule must be before rule_interface because the flag could be set on any 1839 * interface, not just the interface being used for outgoing packets (for 1840 * example, the IFF_PREFERRED could be set on an address assigned to the 1841 * loopback interface). 1842 */ 1843 /* ARGSUSED2 */ 1844 static rule_res_t 1845 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1846 { 1847 if (!bc->cand_ispreferred_set) { 1848 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 1849 bc->cand_ispreferred_set = B_TRUE; 1850 } 1851 1852 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 1853 cc->cand_ispreferred_set = B_TRUE; 1854 1855 if (bc->cand_ispreferred == cc->cand_ispreferred) 1856 return (CAND_TIE); 1857 else if (cc->cand_ispreferred) 1858 return (CAND_PREFER); 1859 else 1860 return (CAND_AVOID); 1861 } 1862 1863 /* 1864 * Prefer source addresses that are assigned to the outgoing interface, or 1865 * to an interface that is in the same IPMP group as the outgoing 1866 * interface. 1867 */ 1868 static rule_res_t 1869 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1870 { 1871 ill_t *dstill = dstinfo->dst_ill; 1872 1873 /* 1874 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 1875 * since we know all candidates will be on the same link. 1876 */ 1877 if (dstinfo->dst_restrict_ill) 1878 return (CAND_TIE); 1879 1880 if (!bc->cand_matchedinterface_set) { 1881 bc->cand_matchedinterface = (bc->cand_ill == dstill || 1882 (dstill->ill_group != NULL && 1883 dstill->ill_group == bc->cand_ill->ill_group)); 1884 bc->cand_matchedinterface_set = B_TRUE; 1885 } 1886 1887 cc->cand_matchedinterface = (cc->cand_ill == dstill || 1888 (dstill->ill_group != NULL && 1889 dstill->ill_group == cc->cand_ill->ill_group)); 1890 cc->cand_matchedinterface_set = B_TRUE; 1891 1892 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 1893 return (CAND_TIE); 1894 else if (cc->cand_matchedinterface) 1895 return (CAND_PREFER); 1896 else 1897 return (CAND_AVOID); 1898 } 1899 1900 /* 1901 * Prefer source addresses whose label matches the destination's label. 1902 */ 1903 static rule_res_t 1904 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1905 { 1906 char *label; 1907 1908 if (!bc->cand_matchedlabel_set) { 1909 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL); 1910 bc->cand_matchedlabel = 1911 ip6_asp_labelcmp(label, dstinfo->dst_label); 1912 bc->cand_matchedlabel_set = B_TRUE; 1913 } 1914 1915 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL); 1916 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 1917 cc->cand_matchedlabel_set = B_TRUE; 1918 1919 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 1920 return (CAND_TIE); 1921 else if (cc->cand_matchedlabel) 1922 return (CAND_PREFER); 1923 else 1924 return (CAND_AVOID); 1925 } 1926 1927 /* 1928 * Prefer public addresses over temporary ones. An application can reverse 1929 * the logic of this rule and prefer temporary addresses by using the 1930 * IPV6_SRC_PREFERENCES socket option. 1931 */ 1932 static rule_res_t 1933 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1934 { 1935 if (!bc->cand_istmp_set) { 1936 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 1937 bc->cand_istmp_set = B_TRUE; 1938 } 1939 1940 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 1941 cc->cand_istmp_set = B_TRUE; 1942 1943 if (bc->cand_istmp == cc->cand_istmp) 1944 return (CAND_TIE); 1945 1946 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 1947 return (CAND_PREFER); 1948 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 1949 return (CAND_PREFER); 1950 else 1951 return (CAND_AVOID); 1952 } 1953 1954 /* 1955 * Prefer source addresses with longer matching prefix with the 1956 * destination. Since this is the last rule, it must not produce a tie. 1957 * We do the longest matching prefix calculation and the tie break in one 1958 * calculation by doing an xor of both addresses with the destination, and 1959 * pick the address with the smallest xor value. That way, we're both 1960 * picking the address with the longest matching prefix, and breaking the 1961 * tie if they happen to have both have equal mathing prefixes. 1962 */ 1963 static rule_res_t 1964 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1965 { 1966 int i; 1967 1968 if (!bc->cand_xor_set) { 1969 ip_addr_xor_v6(&bc->cand_srcaddr, 1970 dstinfo->dst_addr, &bc->cand_xor); 1971 bc->cand_xor_set = B_TRUE; 1972 } 1973 1974 ip_addr_xor_v6(&cc->cand_srcaddr, dstinfo->dst_addr, &cc->cand_xor); 1975 cc->cand_xor_set = B_TRUE; 1976 1977 for (i = 0; i < 4; i++) { 1978 if (bc->cand_xor.s6_addr32[i] != cc->cand_xor.s6_addr32[i]) 1979 break; 1980 } 1981 1982 if (cc->cand_xor.s6_addr32[i] < bc->cand_xor.s6_addr32[i]) 1983 return (CAND_PREFER); 1984 else 1985 return (CAND_AVOID); 1986 } 1987 1988 /* 1989 * Prefer to use zone-specific addresses when possible instead of all-zones 1990 * addresses. 1991 */ 1992 /* ARGSUSED2 */ 1993 static rule_res_t 1994 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1995 { 1996 if ((bc->cand_zoneid == ALL_ZONES) == 1997 (cc->cand_zoneid == ALL_ZONES)) 1998 return (CAND_TIE); 1999 else if (cc->cand_zoneid == ALL_ZONES) 2000 return (CAND_AVOID); 2001 else 2002 return (CAND_PREFER); 2003 } 2004 2005 /* 2006 * Determine the best source address given a destination address and a 2007 * destination ill. If no suitable source address is found, it returns 2008 * NULL. If there is a usable address pointed to by the usesrc 2009 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 2010 * fine grained (i.e per interface) 2011 * 2012 * This implementation is based on the "Default Address Selection for IPv6" 2013 * specification produced by the IETF IPv6 working group. It has been 2014 * implemented so that the list of addresses is only traversed once (the 2015 * specification's algorithm could traverse the list of addresses once for 2016 * every rule). 2017 * 2018 * The restrict_ill argument restricts the algorithm to chose a source 2019 * address that is assigned to the destination ill or an ill in the same 2020 * IPMP group as the destination ill. This is used when the destination 2021 * address is a link-local or multicast address, and when 2022 * ipv6_strict_dst_multihoming is turned on. 2023 * 2024 * src_prefs is the caller's set of source address preferences. If source 2025 * address selection is being called to determine the source address of a 2026 * connected socket (from ip_bind_connected_v6()), then the preferences are 2027 * taken from conn_src_preferences. These preferences can be set on a 2028 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 2029 * preference currently implemented is for rfc3041 temporary addresses. 2030 */ 2031 ipif_t * 2032 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 2033 uint_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid) 2034 { 2035 dstinfo_t dstinfo; 2036 char dstr[INET6_ADDRSTRLEN]; 2037 char sstr[INET6_ADDRSTRLEN]; 2038 ipif_t *ipif; 2039 ill_t *ill, *usesrc_ill = NULL; 2040 ill_walk_context_t ctx; 2041 cand_t best_c; /* The best candidate */ 2042 cand_t curr_c; /* The current candidate */ 2043 uint_t index; 2044 boolean_t first_candidate = B_TRUE; 2045 rule_res_t rule_result; 2046 tsol_tpc_t *src_rhtp, *dst_rhtp; 2047 2048 /* 2049 * The list of ordering rules. They are applied in the order they 2050 * appear in the list. 2051 * 2052 * XXX rule_mipv6 will need to be implemented (the specification's 2053 * rules 4) if a mobile IPv6 node is ever implemented. 2054 */ 2055 rulef_t rules[] = { 2056 rule_isdst, 2057 rule_scope, 2058 rule_deprecated, 2059 rule_preferred, 2060 rule_interface, 2061 rule_label, 2062 rule_temporary, 2063 rule_prefix, 2064 rule_zone_specific, 2065 NULL 2066 }; 2067 2068 ASSERT(dstill->ill_isv6); 2069 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 2070 2071 /* 2072 * Check if there is a usable src address pointed to by the 2073 * usesrc ifindex. This has higher precedence since it is 2074 * finer grained (i.e per interface) v/s being system wide. 2075 */ 2076 if (dstill->ill_usesrc_ifindex != 0) { 2077 if ((usesrc_ill = 2078 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 2079 NULL, NULL, NULL, NULL)) != NULL) { 2080 dstinfo.dst_ill = usesrc_ill; 2081 } else { 2082 return (NULL); 2083 } 2084 } else { 2085 dstinfo.dst_ill = dstill; 2086 } 2087 2088 /* 2089 * If we're dealing with an unlabeled destination on a labeled system, 2090 * make sure that we ignore source addresses that are incompatible with 2091 * the destination's default label. That destination's default label 2092 * must dominate the minimum label on the source address. 2093 * 2094 * (Note that this has to do with Trusted Solaris. It's not related to 2095 * the labels described by ip6_asp_lookup.) 2096 */ 2097 dst_rhtp = NULL; 2098 if (is_system_labeled()) { 2099 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE); 2100 if (dst_rhtp == NULL) 2101 return (NULL); 2102 if (dst_rhtp->tpc_tp.host_type != UNLABELED) { 2103 TPC_RELE(dst_rhtp); 2104 dst_rhtp = NULL; 2105 } 2106 } 2107 2108 dstinfo.dst_addr = dst; 2109 dstinfo.dst_scope = ip_addr_scope_v6(dst); 2110 dstinfo.dst_label = ip6_asp_lookup(dst, NULL); 2111 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 2112 2113 rw_enter(&ill_g_lock, RW_READER); 2114 /* 2115 * Section three of the I-D states that for multicast and 2116 * link-local destinations, the candidate set must be restricted to 2117 * an interface that is on the same link as the outgoing interface. 2118 * Also, when ipv6_strict_dst_multihoming is turned on, always 2119 * restrict the source address to the destination link as doing 2120 * otherwise will almost certainly cause problems. 2121 */ 2122 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 2123 ipv6_strict_dst_multihoming || usesrc_ill != NULL) { 2124 if (restrict_ill == RESTRICT_TO_NONE) 2125 dstinfo.dst_restrict_ill = RESTRICT_TO_GROUP; 2126 else 2127 dstinfo.dst_restrict_ill = restrict_ill; 2128 } else { 2129 dstinfo.dst_restrict_ill = restrict_ill; 2130 } 2131 2132 bzero(&best_c, sizeof (cand_t)); 2133 2134 /* 2135 * Take a pass through the list of IPv6 interfaces to chose the 2136 * best possible source address. If restrict_ill is true, we only 2137 * iterate through the ill's that are in the same IPMP group as the 2138 * destination's outgoing ill. If restrict_ill is false, we walk 2139 * the entire list of IPv6 ill's. 2140 */ 2141 if (dstinfo.dst_restrict_ill != RESTRICT_TO_NONE) { 2142 if (dstinfo.dst_ill->ill_group != NULL && 2143 dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) { 2144 ill = dstinfo.dst_ill->ill_group->illgrp_ill; 2145 } else { 2146 ill = dstinfo.dst_ill; 2147 } 2148 } else { 2149 ill = ILL_START_WALK_V6(&ctx); 2150 } 2151 2152 while (ill != NULL) { 2153 ASSERT(ill->ill_isv6); 2154 2155 /* 2156 * Avoid FAILED/OFFLINE ills. 2157 * Global and site local addresses will failover and 2158 * will be available on the new ill. 2159 * But link local addresses don't move. 2160 */ 2161 if (dstinfo.dst_restrict_ill != RESTRICT_TO_ILL && 2162 ill->ill_phyint->phyint_flags & 2163 (PHYI_OFFLINE | PHYI_FAILED)) 2164 goto next_ill; 2165 2166 for (ipif = ill->ill_ipif; ipif != NULL; 2167 ipif = ipif->ipif_next) { 2168 2169 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 2170 continue; 2171 2172 if (zoneid != ALL_ZONES && 2173 ipif->ipif_zoneid != zoneid && 2174 ipif->ipif_zoneid != ALL_ZONES) 2175 continue; 2176 2177 /* 2178 * Check compatibility of local address for 2179 * destination's default label if we're on a labeled 2180 * system. Incompatible addresses can't be used at 2181 * all and must be skipped over. 2182 */ 2183 if (dst_rhtp != NULL) { 2184 boolean_t incompat; 2185 2186 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr, 2187 IPV6_VERSION, B_FALSE); 2188 if (src_rhtp == NULL) 2189 continue; 2190 incompat = 2191 src_rhtp->tpc_tp.host_type != SUN_CIPSO || 2192 src_rhtp->tpc_tp.tp_doi != 2193 dst_rhtp->tpc_tp.tp_doi || 2194 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label, 2195 &src_rhtp->tpc_tp.tp_sl_range_cipso) && 2196 !blinlset(&dst_rhtp->tpc_tp.tp_def_label, 2197 src_rhtp->tpc_tp.tp_sl_set_cipso)); 2198 TPC_RELE(src_rhtp); 2199 if (incompat) 2200 continue; 2201 } 2202 2203 if (first_candidate) { 2204 /* 2205 * This is first valid address in the list. 2206 * It is automatically the best candidate 2207 * so far. 2208 */ 2209 best_c.cand_ipif = ipif; 2210 first_candidate = B_FALSE; 2211 continue; 2212 } 2213 2214 bzero(&curr_c, sizeof (cand_t)); 2215 curr_c.cand_ipif = ipif; 2216 2217 /* 2218 * Compare this current candidate (curr_c) with the 2219 * best candidate (best_c) by applying the 2220 * comparison rules in order until one breaks the 2221 * tie. 2222 */ 2223 for (index = 0; rules[index] != NULL; index++) { 2224 /* Apply a comparison rule. */ 2225 rule_result = 2226 (rules[index])(&best_c, &curr_c, &dstinfo); 2227 if (rule_result == CAND_AVOID) { 2228 /* 2229 * The best candidate is still the 2230 * best candidate. Forget about 2231 * this current candidate and go on 2232 * to the next one. 2233 */ 2234 break; 2235 } else if (rule_result == CAND_PREFER) { 2236 /* 2237 * This candidate is prefered. It 2238 * becomes the best candidate so 2239 * far. Go on to the next address. 2240 */ 2241 best_c = curr_c; 2242 break; 2243 } 2244 /* We have a tie, apply the next rule. */ 2245 } 2246 2247 /* 2248 * The last rule must be a tie breaker rule and 2249 * must never produce a tie. At this point, the 2250 * candidate should have either been rejected, or 2251 * have been prefered as the best candidate so far. 2252 */ 2253 ASSERT(rule_result != CAND_TIE); 2254 } 2255 2256 /* 2257 * We may be walking the linked-list of ill's in an 2258 * IPMP group or traversing the IPv6 ill avl tree. If it is a 2259 * usesrc ILL then it can't be part of IPMP group and we 2260 * will exit the while loop. 2261 */ 2262 next_ill: 2263 if (dstinfo.dst_restrict_ill == RESTRICT_TO_ILL) 2264 ill = NULL; 2265 else if (dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) 2266 ill = ill->ill_group_next; 2267 else 2268 ill = ill_next(&ctx, ill); 2269 } 2270 2271 ipif = best_c.cand_ipif; 2272 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2273 dstinfo.dst_ill->ill_name, 2274 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2275 (ipif == NULL ? "NULL" : 2276 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2277 2278 if (usesrc_ill != NULL) 2279 ill_refrele(usesrc_ill); 2280 2281 if (dst_rhtp != NULL) 2282 TPC_RELE(dst_rhtp); 2283 2284 if (ipif == NULL) { 2285 rw_exit(&ill_g_lock); 2286 return (NULL); 2287 } 2288 2289 mutex_enter(&ipif->ipif_ill->ill_lock); 2290 if (IPIF_CAN_LOOKUP(ipif)) { 2291 ipif_refhold_locked(ipif); 2292 mutex_exit(&ipif->ipif_ill->ill_lock); 2293 rw_exit(&ill_g_lock); 2294 return (ipif); 2295 } 2296 mutex_exit(&ipif->ipif_ill->ill_lock); 2297 rw_exit(&ill_g_lock); 2298 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2299 " returning null \n", (void *)ipif)); 2300 2301 return (NULL); 2302 } 2303 2304 /* 2305 * If old_ipif is not NULL, see if ipif was derived from old 2306 * ipif and if so, recreate the interface route by re-doing 2307 * source address selection. This happens when ipif_down -> 2308 * ipif_update_other_ipifs calls us. 2309 * 2310 * If old_ipif is NULL, just redo the source address selection 2311 * if needed. This happens when illgrp_insert or ipif_up_done_v6 2312 * calls us. 2313 */ 2314 void 2315 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif) 2316 { 2317 ire_t *ire; 2318 ire_t *ipif_ire; 2319 queue_t *stq; 2320 ill_t *ill; 2321 ipif_t *nipif = NULL; 2322 boolean_t nipif_refheld = B_FALSE; 2323 boolean_t ip6_asp_table_held = B_FALSE; 2324 2325 ill = ipif->ipif_ill; 2326 2327 if (!(ipif->ipif_flags & 2328 (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) { 2329 /* 2330 * Can't possibly have borrowed the source 2331 * from old_ipif. 2332 */ 2333 return; 2334 } 2335 2336 /* 2337 * Is there any work to be done? No work if the address 2338 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST ( 2339 * ipif_select_source_v6() does not borrow addresses from 2340 * NOLOCAL and ANYCAST interfaces). 2341 */ 2342 if ((old_ipif != NULL) && 2343 ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) || 2344 (old_ipif->ipif_ill->ill_wq == NULL) || 2345 (old_ipif->ipif_flags & 2346 (IPIF_NOLOCAL|IPIF_ANYCAST)))) { 2347 return; 2348 } 2349 2350 /* 2351 * Perform the same checks as when creating the 2352 * IRE_INTERFACE in ipif_up_done_v6. 2353 */ 2354 if (!(ipif->ipif_flags & IPIF_UP)) 2355 return; 2356 2357 if ((ipif->ipif_flags & IPIF_NOXMIT)) 2358 return; 2359 2360 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2361 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask)) 2362 return; 2363 2364 /* 2365 * We know that ipif uses some other source for its 2366 * IRE_INTERFACE. Is it using the source of this 2367 * old_ipif? 2368 */ 2369 ipif_ire = ipif_to_ire_v6(ipif); 2370 if (ipif_ire == NULL) 2371 return; 2372 2373 if (old_ipif != NULL && 2374 !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr, 2375 &ipif_ire->ire_src_addr_v6)) { 2376 ire_refrele(ipif_ire); 2377 return; 2378 } 2379 2380 if (ip_debug > 2) { 2381 /* ip1dbg */ 2382 pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE" 2383 " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6); 2384 } 2385 2386 stq = ipif_ire->ire_stq; 2387 2388 /* 2389 * Can't use our source address. Select a different source address 2390 * for the IRE_INTERFACE. We restrict interface route source 2391 * address selection to ipif's assigned to the same link as the 2392 * interface. 2393 */ 2394 if (ip6_asp_can_lookup()) { 2395 ip6_asp_table_held = B_TRUE; 2396 nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet, 2397 RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT, 2398 ipif->ipif_zoneid); 2399 } 2400 if (nipif == NULL) { 2401 /* Last resort - all ipif's have IPIF_NOLOCAL */ 2402 nipif = ipif; 2403 } else { 2404 nipif_refheld = B_TRUE; 2405 } 2406 2407 ire = ire_create_v6( 2408 &ipif->ipif_v6subnet, /* dest pref */ 2409 &ipif->ipif_v6net_mask, /* mask */ 2410 &nipif->ipif_v6src_addr, /* src addr */ 2411 NULL, /* no gateway */ 2412 &ipif->ipif_mtu, /* max frag */ 2413 NULL, /* no Fast path header */ 2414 NULL, /* no recv from queue */ 2415 stq, /* send-to queue */ 2416 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2417 ill->ill_resolver_mp, /* xmit header */ 2418 ipif, 2419 NULL, 2420 0, 2421 0, 2422 0, 2423 &ire_uinfo_null, 2424 NULL, 2425 NULL); 2426 2427 if (ire != NULL) { 2428 ire_t *ret_ire; 2429 int error; 2430 2431 /* 2432 * We don't need ipif_ire anymore. We need to delete 2433 * before we add so that ire_add does not detect 2434 * duplicates. 2435 */ 2436 ire_delete(ipif_ire); 2437 ret_ire = ire; 2438 error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE); 2439 ASSERT(error == 0); 2440 ASSERT(ret_ire == ire); 2441 if (ret_ire != NULL) { 2442 /* Held in ire_add */ 2443 ire_refrele(ret_ire); 2444 } 2445 } 2446 /* 2447 * Either we are falling through from above or could not 2448 * allocate a replacement. 2449 */ 2450 ire_refrele(ipif_ire); 2451 if (ip6_asp_table_held) 2452 ip6_asp_table_refrele(); 2453 if (nipif_refheld) 2454 ipif_refrele(nipif); 2455 } 2456 2457 /* 2458 * This old_ipif is going away. 2459 * 2460 * Determine if any other ipif's are using our address as 2461 * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or 2462 * IPIF_DEPRECATED). 2463 * Find the IRE_INTERFACE for such ipif's and recreate them 2464 * to use an different source address following the rules in 2465 * ipif_up_done_v6. 2466 * 2467 * This function takes an illgrp as an argument so that illgrp_delete 2468 * can call this to update source address even after deleting the 2469 * old_ipif->ipif_ill from the ill group. 2470 */ 2471 void 2472 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp) 2473 { 2474 ipif_t *ipif; 2475 ill_t *ill; 2476 char buf[INET6_ADDRSTRLEN]; 2477 2478 ASSERT(IAM_WRITER_IPIF(old_ipif)); 2479 2480 ill = old_ipif->ipif_ill; 2481 2482 ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n", 2483 ill->ill_name, 2484 inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr, 2485 buf, sizeof (buf)))); 2486 2487 /* 2488 * If this part of a group, look at all ills as ipif_select_source 2489 * borrows a source address across all the ills in the group. 2490 */ 2491 if (illgrp != NULL) 2492 ill = illgrp->illgrp_ill; 2493 2494 /* Don't need a lock since this is a writer */ 2495 for (; ill != NULL; ill = ill->ill_group_next) { 2496 for (ipif = ill->ill_ipif; ipif != NULL; 2497 ipif = ipif->ipif_next) { 2498 2499 if (ipif == old_ipif) 2500 continue; 2501 2502 ipif_recreate_interface_routes_v6(old_ipif, ipif); 2503 } 2504 } 2505 } 2506 2507 /* 2508 * Perform an attach and bind to get phys addr plus info_req for 2509 * the physical device. 2510 * q and mp represents an ioctl which will be queued waiting for 2511 * completion of the DLPI message exchange. 2512 * MUST be called on an ill queue. Can not set conn_pending_ill for that 2513 * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q. 2514 * 2515 * Returns EINPROGRESS when mp has been consumed by queueing it on 2516 * ill_pending_mp and the ioctl will complete in ip_rput. 2517 */ 2518 int 2519 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2520 { 2521 mblk_t *v6token_mp = NULL; 2522 mblk_t *v6lla_mp = NULL; 2523 mblk_t *phys_mp = NULL; 2524 mblk_t *info_mp = NULL; 2525 mblk_t *attach_mp = NULL; 2526 mblk_t *detach_mp = NULL; 2527 mblk_t *bind_mp = NULL; 2528 mblk_t *unbind_mp = NULL; 2529 mblk_t *notify_mp = NULL; 2530 2531 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2532 ASSERT(ill->ill_dlpi_style_set); 2533 ASSERT(WR(q)->q_next != NULL); 2534 2535 if (ill->ill_isv6) { 2536 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2537 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2538 if (v6token_mp == NULL) 2539 goto bad; 2540 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2541 DL_IPV6_TOKEN; 2542 2543 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2544 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2545 if (v6lla_mp == NULL) 2546 goto bad; 2547 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2548 DL_IPV6_LINK_LAYER_ADDR; 2549 } 2550 2551 /* 2552 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2553 */ 2554 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2555 DL_NOTIFY_REQ); 2556 if (notify_mp == NULL) 2557 goto bad; 2558 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2559 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2560 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG); 2561 2562 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2563 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2564 if (phys_mp == NULL) 2565 goto bad; 2566 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2567 DL_CURR_PHYS_ADDR; 2568 2569 info_mp = ip_dlpi_alloc( 2570 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2571 DL_INFO_REQ); 2572 if (info_mp == NULL) 2573 goto bad; 2574 2575 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2576 DL_BIND_REQ); 2577 if (bind_mp == NULL) 2578 goto bad; 2579 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2580 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2581 2582 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2583 if (unbind_mp == NULL) 2584 goto bad; 2585 2586 /* If we need to attach/detach, pre-alloc and initialize the mblks */ 2587 if (ill->ill_needs_attach) { 2588 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2589 DL_ATTACH_REQ); 2590 if (attach_mp == NULL) 2591 goto bad; 2592 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2593 2594 detach_mp = ip_dlpi_alloc(sizeof (dl_detach_req_t), 2595 DL_DETACH_REQ); 2596 if (detach_mp == NULL) 2597 goto bad; 2598 } 2599 2600 /* 2601 * Here we are going to delay the ioctl ack until after 2602 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2603 * original ioctl message before sending the requests 2604 */ 2605 mutex_enter(&ill->ill_lock); 2606 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2607 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2608 /* 2609 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2610 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2611 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2612 */ 2613 ill->ill_phys_addr_pend = 0; 2614 mutex_exit(&ill->ill_lock); 2615 2616 if (attach_mp != NULL) { 2617 ip1dbg(("ill_dl_phys: attach\n")); 2618 ill_dlpi_send(ill, attach_mp); 2619 } 2620 ill_dlpi_send(ill, bind_mp); 2621 ill_dlpi_send(ill, info_mp); 2622 if (ill->ill_isv6) { 2623 ill_dlpi_send(ill, v6token_mp); 2624 ill_dlpi_send(ill, v6lla_mp); 2625 } 2626 ill_dlpi_send(ill, phys_mp); 2627 ill_dlpi_send(ill, notify_mp); 2628 ill_dlpi_send(ill, unbind_mp); 2629 2630 /* 2631 * Save the DL_DETACH_REQ (if there is one) for use in ill_delete(). 2632 */ 2633 ASSERT(ill->ill_detach_mp == NULL); 2634 ill->ill_detach_mp = detach_mp; 2635 2636 /* 2637 * This operation will complete in ip_rput_dlpi_writer with either 2638 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2639 */ 2640 return (EINPROGRESS); 2641 bad: 2642 if (v6token_mp != NULL) 2643 freemsg(v6token_mp); 2644 if (v6lla_mp != NULL) 2645 freemsg(v6lla_mp); 2646 if (phys_mp != NULL) 2647 freemsg(phys_mp); 2648 if (info_mp != NULL) 2649 freemsg(info_mp); 2650 if (attach_mp != NULL) 2651 freemsg(attach_mp); 2652 if (detach_mp != NULL) 2653 freemsg(detach_mp); 2654 if (bind_mp != NULL) 2655 freemsg(bind_mp); 2656 if (unbind_mp != NULL) 2657 freemsg(unbind_mp); 2658 if (notify_mp != NULL) 2659 freemsg(notify_mp); 2660 return (ENOMEM); 2661 } 2662 2663 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2664 2665 /* 2666 * DLPI is up. 2667 * Create all the IREs associated with an interface bring up multicast. 2668 * Set the interface flag and finish other initialization 2669 * that potentially had to be differed to after DL_BIND_ACK. 2670 */ 2671 int 2672 ipif_up_done_v6(ipif_t *ipif) 2673 { 2674 ire_t *ire_array[20]; 2675 ire_t **irep = ire_array; 2676 ire_t **irep1; 2677 ill_t *ill = ipif->ipif_ill; 2678 queue_t *stq; 2679 in6_addr_t v6addr; 2680 in6_addr_t route_mask; 2681 ipif_t *src_ipif = NULL; 2682 ipif_t *tmp_ipif; 2683 boolean_t flush_ire_cache = B_TRUE; 2684 int err; 2685 char buf[INET6_ADDRSTRLEN]; 2686 phyint_t *phyi; 2687 ire_t **ipif_saved_irep = NULL; 2688 int ipif_saved_ire_cnt; 2689 int cnt; 2690 boolean_t src_ipif_held = B_FALSE; 2691 boolean_t ire_added = B_FALSE; 2692 boolean_t loopback = B_FALSE; 2693 boolean_t ip6_asp_table_held = B_FALSE; 2694 2695 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2696 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2697 2698 /* Check if this is a loopback interface */ 2699 if (ipif->ipif_ill->ill_wq == NULL) 2700 loopback = B_TRUE; 2701 2702 ASSERT(ipif->ipif_isv6); 2703 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2704 2705 /* 2706 * If all other interfaces for this ill are down or DEPRECATED, 2707 * or otherwise unsuitable for source address selection, remove 2708 * any IRE_CACHE entries for this ill to make sure source 2709 * address selection gets to take this new ipif into account. 2710 * No need to hold ill_lock while traversing the ipif list since 2711 * we are writer 2712 */ 2713 for (tmp_ipif = ill->ill_ipif; tmp_ipif; 2714 tmp_ipif = tmp_ipif->ipif_next) { 2715 if (((tmp_ipif->ipif_flags & 2716 (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) || 2717 !(tmp_ipif->ipif_flags & IPIF_UP)) || 2718 (tmp_ipif == ipif)) 2719 continue; 2720 /* first useable pre-existing interface */ 2721 flush_ire_cache = B_FALSE; 2722 break; 2723 } 2724 if (flush_ire_cache) 2725 ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE, 2726 IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill); 2727 2728 /* 2729 * Figure out which way the send-to queue should go. Only 2730 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here. 2731 */ 2732 switch (ill->ill_net_type) { 2733 case IRE_IF_RESOLVER: 2734 stq = ill->ill_rq; 2735 break; 2736 case IRE_IF_NORESOLVER: 2737 case IRE_LOOPBACK: 2738 stq = ill->ill_wq; 2739 break; 2740 default: 2741 return (EINVAL); 2742 } 2743 2744 if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) { 2745 /* 2746 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 2747 * ipif_lookup_on_name(), but in the case of zones we can have 2748 * several loopback addresses on lo0. So all the interfaces with 2749 * loopback addresses need to be marked IRE_LOOPBACK. 2750 */ 2751 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 2752 ipif->ipif_ire_type = IRE_LOOPBACK; 2753 else 2754 ipif->ipif_ire_type = IRE_LOCAL; 2755 } 2756 2757 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) { 2758 /* 2759 * Can't use our source address. Select a different 2760 * source address for the IRE_INTERFACE and IRE_LOCAL 2761 */ 2762 if (ip6_asp_can_lookup()) { 2763 ip6_asp_table_held = B_TRUE; 2764 src_ipif = ipif_select_source_v6(ipif->ipif_ill, 2765 &ipif->ipif_v6subnet, RESTRICT_TO_NONE, 2766 IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid); 2767 } 2768 if (src_ipif == NULL) 2769 src_ipif = ipif; /* Last resort */ 2770 else 2771 src_ipif_held = B_TRUE; 2772 } else { 2773 src_ipif = ipif; 2774 } 2775 2776 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 2777 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 2778 2779 /* 2780 * If we're on a labeled system then make sure that zone- 2781 * private addresses have proper remote host database entries. 2782 */ 2783 if (is_system_labeled() && 2784 ipif->ipif_ire_type != IRE_LOOPBACK) { 2785 if (ip6opt_ls == 0) { 2786 cmn_err(CE_WARN, "IPv6 not enabled " 2787 "via /etc/system"); 2788 return (EINVAL); 2789 } 2790 if (!tsol_check_interface_address(ipif)) 2791 return (EINVAL); 2792 } 2793 2794 /* Register the source address for __sin6_src_id */ 2795 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 2796 ipif->ipif_zoneid); 2797 if (err != 0) { 2798 ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err)); 2799 if (src_ipif_held) 2800 ipif_refrele(src_ipif); 2801 if (ip6_asp_table_held) 2802 ip6_asp_table_refrele(); 2803 return (err); 2804 } 2805 /* 2806 * If the interface address is set, create the LOCAL 2807 * or LOOPBACK IRE. 2808 */ 2809 ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n", 2810 ipif->ipif_ire_type, 2811 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 2812 buf, sizeof (buf)))); 2813 2814 *irep++ = ire_create_v6( 2815 &ipif->ipif_v6lcl_addr, /* dest address */ 2816 &ipv6_all_ones, /* mask */ 2817 &src_ipif->ipif_v6src_addr, /* source address */ 2818 NULL, /* no gateway */ 2819 &ip_loopback_mtu_v6plus, /* max frag size */ 2820 NULL, 2821 ipif->ipif_rq, /* recv-from queue */ 2822 NULL, /* no send-to queue */ 2823 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 2824 NULL, 2825 ipif, /* interface */ 2826 NULL, 2827 0, 2828 0, 2829 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2830 &ire_uinfo_null, 2831 NULL, 2832 NULL); 2833 } 2834 2835 /* 2836 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. 2837 * Note that atun interfaces have an all-zero ipif_v6subnet. 2838 * Thus we allow a zero subnet as long as the mask is non-zero. 2839 */ 2840 if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) && 2841 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2842 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2843 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2844 v6addr = ipif->ipif_v6subnet; 2845 2846 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2847 route_mask = ipv6_all_ones; 2848 } else { 2849 route_mask = ipif->ipif_v6net_mask; 2850 } 2851 2852 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n", 2853 ill->ill_net_type, 2854 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 2855 2856 *irep++ = ire_create_v6( 2857 &v6addr, /* dest pref */ 2858 &route_mask, /* mask */ 2859 &src_ipif->ipif_v6src_addr, /* src addr */ 2860 NULL, /* no gateway */ 2861 &ipif->ipif_mtu, /* max frag */ 2862 NULL, /* no Fast path header */ 2863 NULL, /* no recv from queue */ 2864 stq, /* send-to queue */ 2865 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2866 ill->ill_resolver_mp, /* xmit header */ 2867 ipif, 2868 NULL, 2869 0, 2870 0, 2871 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2872 &ire_uinfo_null, 2873 NULL, 2874 NULL); 2875 } 2876 2877 /* 2878 * Setup 2002::/16 route, if this interface is a 6to4 tunnel 2879 */ 2880 if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) && 2881 (ill->ill_is_6to4tun)) { 2882 /* 2883 * Destination address is 2002::/16 2884 */ 2885 #ifdef _BIG_ENDIAN 2886 const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 }; 2887 const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 }; 2888 #else 2889 const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 }; 2890 const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 }; 2891 #endif /* _BIG_ENDIAN */ 2892 char buf2[INET6_ADDRSTRLEN]; 2893 ire_t *isdup; 2894 in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr; 2895 2896 /* 2897 * check to see if this route has already been added for 2898 * this tunnel interface. 2899 */ 2900 isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0, 2901 IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL, 2902 (MATCH_IRE_SRC | MATCH_IRE_MASK)); 2903 2904 if (isdup == NULL) { 2905 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s", 2906 IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr, 2907 buf2, sizeof (buf2)))); 2908 2909 *irep++ = ire_create_v6( 2910 &prefix_addr, /* 2002:: */ 2911 &prefix_mask, /* ffff:: */ 2912 &ipif->ipif_v6lcl_addr, /* src addr */ 2913 NULL, /* gateway */ 2914 &ipif->ipif_mtu, /* max_frag */ 2915 NULL, /* no Fast Path hdr */ 2916 NULL, /* no rfq */ 2917 ill->ill_wq, /* stq */ 2918 IRE_IF_NORESOLVER, /* type */ 2919 ill->ill_resolver_mp, /* dlureq_mp */ 2920 ipif, /* interface */ 2921 NULL, /* v6cmask */ 2922 0, 2923 0, 2924 RTF_UP, 2925 &ire_uinfo_null, 2926 NULL, 2927 NULL); 2928 } else { 2929 ire_refrele(isdup); 2930 } 2931 } 2932 2933 /* If an earlier ire_create failed, get out now */ 2934 for (irep1 = irep; irep1 > ire_array; ) { 2935 irep1--; 2936 if (*irep1 == NULL) { 2937 ip1dbg(("ipif_up_done_v6: NULL ire found in" 2938 " ire_array\n")); 2939 err = ENOMEM; 2940 goto bad; 2941 } 2942 } 2943 2944 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2945 2946 /* 2947 * Need to atomically check for ip_addr_availablity_check 2948 * now under ill_g_lock, and if it fails got bad, and remove 2949 * from group also 2950 */ 2951 rw_enter(&ill_g_lock, RW_READER); 2952 mutex_enter(&ip_addr_avail_lock); 2953 ill->ill_ipif_up_count++; 2954 ipif->ipif_flags |= IPIF_UP; 2955 err = ip_addr_availability_check(ipif); 2956 mutex_exit(&ip_addr_avail_lock); 2957 rw_exit(&ill_g_lock); 2958 2959 if (err != 0) { 2960 /* 2961 * Our address may already be up on the same ill. In this case, 2962 * the external resolver entry for our ipif replaced the one for 2963 * the other ipif. So we don't want to delete it (otherwise the 2964 * other ipif would be unable to send packets). 2965 * ip_addr_availability_check() identifies this case for us and 2966 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL 2967 * which is the expected error code. 2968 */ 2969 if (err == EADDRINUSE) { 2970 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) { 2971 freemsg(ipif->ipif_arp_del_mp); 2972 ipif->ipif_arp_del_mp = NULL; 2973 } 2974 err = EADDRNOTAVAIL; 2975 } 2976 ill->ill_ipif_up_count--; 2977 ipif->ipif_flags &= ~IPIF_UP; 2978 goto bad; 2979 } 2980 2981 /* 2982 * Add in all newly created IREs. We want to add before 2983 * we call ifgrp_insert which wants to know whether 2984 * IRE_IF_RESOLVER exists or not. 2985 * 2986 * NOTE : We refrele the ire though we may branch to "bad" 2987 * later on where we do ire_delete. This is okay 2988 * because nobody can delete it as we are running 2989 * exclusively. 2990 */ 2991 for (irep1 = irep; irep1 > ire_array; ) { 2992 irep1--; 2993 /* Shouldn't be adding any bcast ire's */ 2994 ASSERT((*irep1)->ire_type != IRE_BROADCAST); 2995 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2996 /* 2997 * refheld by ire_add. refele towards the end of the func 2998 */ 2999 (void) ire_add(irep1, NULL, NULL, NULL, B_FALSE); 3000 } 3001 if (ip6_asp_table_held) { 3002 ip6_asp_table_refrele(); 3003 ip6_asp_table_held = B_FALSE; 3004 } 3005 ire_added = B_TRUE; 3006 3007 /* 3008 * Form groups if possible. 3009 * 3010 * If we are supposed to be in a ill_group with a name, insert it 3011 * now as we know that at least one ipif is UP. Otherwise form 3012 * nameless groups. 3013 * 3014 * If ip_enable_group_ifs is set and ipif address is not ::0, insert 3015 * this ipif into the appropriate interface group, or create a 3016 * new one. If this is already in a nameless group, we try to form 3017 * a bigger group looking at other ills potentially sharing this 3018 * ipif's prefix. 3019 */ 3020 phyi = ill->ill_phyint; 3021 if (phyi->phyint_groupname_len != 0) { 3022 ASSERT(phyi->phyint_groupname != NULL); 3023 if (ill->ill_ipif_up_count == 1) { 3024 ASSERT(ill->ill_group == NULL); 3025 err = illgrp_insert(&illgrp_head_v6, ill, 3026 phyi->phyint_groupname, NULL, B_TRUE); 3027 if (err != 0) { 3028 ip1dbg(("ipif_up_done_v6: illgrp allocation " 3029 "failed, error %d\n", err)); 3030 goto bad; 3031 } 3032 } 3033 ASSERT(ill->ill_group != NULL); 3034 } 3035 3036 /* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */ 3037 ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt; 3038 ipif_saved_irep = ipif_recover_ire_v6(ipif); 3039 3040 if (ipif->ipif_ipif_up_count == 1 && !loopback) { 3041 /* 3042 * Need to recover all multicast memberships in the driver. 3043 * This had to be deferred until we had attached. 3044 */ 3045 ill_recover_multicast(ill); 3046 } 3047 /* Join the allhosts multicast address and the solicited node MC */ 3048 ipif_multicast_up(ipif); 3049 3050 if (!loopback) { 3051 /* 3052 * See whether anybody else would benefit from the 3053 * new ipif that we added. We call this always rather 3054 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST 3055 * ipif for the benefit of illgrp_insert (done above) 3056 * which does not do source address selection as it does 3057 * not want to re-create interface routes that we are 3058 * having reference to it here. 3059 */ 3060 ill_update_source_selection(ill); 3061 } 3062 3063 for (irep1 = irep; irep1 > ire_array; ) { 3064 irep1--; 3065 if (*irep1 != NULL) { 3066 /* was held in ire_add */ 3067 ire_refrele(*irep1); 3068 } 3069 } 3070 3071 cnt = ipif_saved_ire_cnt; 3072 for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) { 3073 if (*irep1 != NULL) { 3074 /* was held in ire_add */ 3075 ire_refrele(*irep1); 3076 } 3077 } 3078 3079 if (ipif->ipif_addr_ready) { 3080 ip_rts_ifmsg(ipif); 3081 ip_rts_newaddrmsg(RTM_ADD, 0, ipif); 3082 sctp_update_ipif(ipif, SCTP_IPIF_UP); 3083 } 3084 3085 if (ipif_saved_irep != NULL) { 3086 kmem_free(ipif_saved_irep, 3087 ipif_saved_ire_cnt * sizeof (ire_t *)); 3088 } 3089 3090 if (src_ipif_held) 3091 ipif_refrele(src_ipif); 3092 return (0); 3093 3094 bad: 3095 if (ip6_asp_table_held) 3096 ip6_asp_table_refrele(); 3097 /* 3098 * We don't have to bother removing from ill groups because 3099 * 3100 * 1) For groups with names, we insert only when the first ipif 3101 * comes up. In that case if it fails, it will not be in any 3102 * group. So, we need not try to remove for that case. 3103 * 3104 * 2) For groups without names, either we tried to insert ipif_ill 3105 * in a group as singleton or found some other group to become 3106 * a bigger group. For the former, if it fails we don't have 3107 * anything to do as ipif_ill is not in the group and for the 3108 * latter, there are no failures in illgrp_insert/illgrp_delete 3109 * (ENOMEM can't occur for this. Check ifgrp_insert). 3110 */ 3111 3112 while (irep > ire_array) { 3113 irep--; 3114 if (*irep != NULL) { 3115 ire_delete(*irep); 3116 if (ire_added) 3117 ire_refrele(*irep); 3118 } 3119 3120 } 3121 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid); 3122 3123 if (ipif_saved_irep != NULL) { 3124 kmem_free(ipif_saved_irep, 3125 ipif_saved_ire_cnt * sizeof (ire_t *)); 3126 } 3127 if (src_ipif_held) 3128 ipif_refrele(src_ipif); 3129 3130 ipif_ndp_down(ipif); 3131 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) 3132 ipif_arp_down(ipif); 3133 3134 return (err); 3135 } 3136 3137 /* 3138 * Delete an ND entry and the corresponding IRE_CACHE entry if it exists. 3139 */ 3140 /* ARGSUSED */ 3141 int 3142 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3143 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3144 { 3145 in6_addr_t addr; 3146 sin6_t *sin6; 3147 nce_t *nce; 3148 struct lifreq *lifr; 3149 lif_nd_req_t *lnr; 3150 mblk_t *mp1; 3151 3152 mp1 = mp->b_cont->b_cont; 3153 lifr = (struct lifreq *)mp1->b_rptr; 3154 lnr = &lifr->lifr_nd; 3155 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3156 if (ipif->ipif_id != 0) 3157 return (EINVAL); 3158 3159 if (!ipif->ipif_isv6) 3160 return (EINVAL); 3161 3162 if (lnr->lnr_addr.ss_family != AF_INET6) 3163 return (EAFNOSUPPORT); 3164 3165 sin6 = (sin6_t *)&lnr->lnr_addr; 3166 addr = sin6->sin6_addr; 3167 nce = ndp_lookup_v6(ipif->ipif_ill, &addr, B_FALSE); 3168 if (nce == NULL) 3169 return (ESRCH); 3170 ndp_delete(nce); 3171 NCE_REFRELE(nce); 3172 return (0); 3173 } 3174 3175 /* 3176 * Return nbr cache info. 3177 */ 3178 /* ARGSUSED */ 3179 int 3180 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3181 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3182 { 3183 ill_t *ill = ipif->ipif_ill; 3184 struct lifreq *lifr; 3185 lif_nd_req_t *lnr; 3186 3187 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3188 lnr = &lifr->lifr_nd; 3189 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3190 if (ipif->ipif_id != 0) 3191 return (EINVAL); 3192 3193 if (!ipif->ipif_isv6) 3194 return (EINVAL); 3195 3196 if (lnr->lnr_addr.ss_family != AF_INET6) 3197 return (EAFNOSUPPORT); 3198 3199 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 3200 return (EINVAL); 3201 3202 return (ndp_query(ill, lnr)); 3203 } 3204 3205 /* 3206 * Perform an update of the nd entry for the specified address. 3207 */ 3208 /* ARGSUSED */ 3209 int 3210 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3211 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3212 { 3213 ill_t *ill = ipif->ipif_ill; 3214 struct lifreq *lifr; 3215 lif_nd_req_t *lnr; 3216 3217 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3218 lnr = &lifr->lifr_nd; 3219 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3220 if (ipif->ipif_id != 0) 3221 return (EINVAL); 3222 3223 if (!ipif->ipif_isv6) 3224 return (EINVAL); 3225 3226 if (lnr->lnr_addr.ss_family != AF_INET6) 3227 return (EAFNOSUPPORT); 3228 3229 return (ndp_sioc_update(ill, lnr)); 3230 } 3231