1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 1990 Mentat Inc. 27 */ 28 29 /* 30 * This file contains the interface control functions for IPv6. 31 */ 32 33 #include <sys/types.h> 34 #include <sys/sysmacros.h> 35 #include <sys/stream.h> 36 #include <sys/dlpi.h> 37 #include <sys/stropts.h> 38 #include <sys/ddi.h> 39 #include <sys/cmn_err.h> 40 #include <sys/kstat.h> 41 #include <sys/debug.h> 42 #include <sys/zone.h> 43 #include <sys/policy.h> 44 45 #include <sys/systm.h> 46 #include <sys/param.h> 47 #include <sys/socket.h> 48 #include <sys/isa_defs.h> 49 #include <net/if.h> 50 #include <net/if_dl.h> 51 #include <net/route.h> 52 #include <netinet/in.h> 53 #include <netinet/igmp_var.h> 54 #include <netinet/ip6.h> 55 #include <netinet/icmp6.h> 56 57 #include <inet/common.h> 58 #include <inet/nd.h> 59 #include <inet/mib2.h> 60 #include <inet/ip.h> 61 #include <inet/ip6.h> 62 #include <inet/ip_multi.h> 63 #include <inet/ip_ire.h> 64 #include <inet/ip_rts.h> 65 #include <inet/ip_ndp.h> 66 #include <inet/ip_if.h> 67 #include <inet/ip6_asp.h> 68 #include <inet/ipclassifier.h> 69 #include <inet/sctp_ip.h> 70 71 #include <sys/tsol/tndb.h> 72 #include <sys/tsol/tnet.h> 73 74 static in6_addr_t ipv6_ll_template = 75 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 76 77 static ipif_t * 78 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 79 ip_stack_t *ipst); 80 81 static int ipif_add_ires_v6(ipif_t *, boolean_t); 82 83 /* 84 * This function is called when an application does not specify an interface 85 * to be used for multicast traffic. It calls ire_lookup_multi_v6() to look 86 * for an interface route for the specified multicast group. Doing 87 * this allows the administrator to add prefix routes for multicast to 88 * indicate which interface to be used for multicast traffic in the above 89 * scenario. The route could be for all multicast (ff00::/8), for a single 90 * multicast group (a /128 route) or anything in between. If there is no 91 * such multicast route, we just find any multicast capable interface and 92 * return it. 93 * 94 * We support MULTIRT and RTF_SETSRC on the multicast routes added to the 95 * unicast table. This is used by CGTP. 96 */ 97 ill_t * 98 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst, 99 boolean_t *multirtp, in6_addr_t *setsrcp) 100 { 101 ill_t *ill; 102 103 ill = ire_lookup_multi_ill_v6(group, zoneid, ipst, multirtp, setsrcp); 104 if (ill != NULL) 105 return (ill); 106 107 return (ill_lookup_multicast(ipst, zoneid, B_TRUE)); 108 } 109 110 /* 111 * Look for an ipif with the specified interface address and destination. 112 * The destination address is used only for matching point-to-point interfaces. 113 */ 114 static ipif_t * 115 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 116 ip_stack_t *ipst) 117 { 118 ipif_t *ipif; 119 ill_t *ill; 120 ill_walk_context_t ctx; 121 122 /* 123 * First match all the point-to-point interfaces 124 * before looking at non-point-to-point interfaces. 125 * This is done to avoid returning non-point-to-point 126 * ipif instead of unnumbered point-to-point ipif. 127 */ 128 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 129 ill = ILL_START_WALK_V6(&ctx, ipst); 130 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 131 mutex_enter(&ill->ill_lock); 132 for (ipif = ill->ill_ipif; ipif != NULL; 133 ipif = ipif->ipif_next) { 134 /* Allow the ipif to be down */ 135 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 136 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 137 if_addr)) && 138 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 139 dst))) { 140 if (!IPIF_IS_CONDEMNED(ipif)) { 141 ipif_refhold_locked(ipif); 142 mutex_exit(&ill->ill_lock); 143 rw_exit(&ipst->ips_ill_g_lock); 144 return (ipif); 145 } 146 } 147 } 148 mutex_exit(&ill->ill_lock); 149 } 150 rw_exit(&ipst->ips_ill_g_lock); 151 /* lookup the ipif based on interface address */ 152 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, ipst); 153 ASSERT(ipif == NULL || ipif->ipif_isv6); 154 return (ipif); 155 } 156 157 /* 158 * Common function for ipif_lookup_addr_v6() and ipif_lookup_addr_exact_v6(). 159 */ 160 static ipif_t * 161 ipif_lookup_addr_common_v6(const in6_addr_t *addr, ill_t *match_ill, 162 uint32_t match_flags, zoneid_t zoneid, ip_stack_t *ipst) 163 { 164 ipif_t *ipif; 165 ill_t *ill; 166 boolean_t ptp = B_FALSE; 167 ill_walk_context_t ctx; 168 boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP); 169 boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP); 170 171 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 172 /* 173 * Repeat twice, first based on local addresses and 174 * next time for pointopoint. 175 */ 176 repeat: 177 ill = ILL_START_WALK_V6(&ctx, ipst); 178 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 179 if (match_ill != NULL && ill != match_ill && 180 (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) { 181 continue; 182 } 183 mutex_enter(&ill->ill_lock); 184 for (ipif = ill->ill_ipif; ipif != NULL; 185 ipif = ipif->ipif_next) { 186 if (zoneid != ALL_ZONES && 187 ipif->ipif_zoneid != zoneid && 188 ipif->ipif_zoneid != ALL_ZONES) 189 continue; 190 191 if (no_duplicate && 192 !(ipif->ipif_flags & IPIF_UP)) { 193 continue; 194 } 195 196 /* Allow the ipif to be down */ 197 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 198 &ipif->ipif_v6lcl_addr, addr) && 199 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 200 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 201 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 202 addr))) { 203 if (!IPIF_IS_CONDEMNED(ipif)) { 204 ipif_refhold_locked(ipif); 205 mutex_exit(&ill->ill_lock); 206 rw_exit(&ipst->ips_ill_g_lock); 207 return (ipif); 208 } 209 } 210 } 211 mutex_exit(&ill->ill_lock); 212 } 213 214 /* If we already did the ptp case, then we are done */ 215 if (ptp) { 216 rw_exit(&ipst->ips_ill_g_lock); 217 return (NULL); 218 } 219 ptp = B_TRUE; 220 goto repeat; 221 } 222 223 /* 224 * Lookup an ipif with the specified address. For point-to-point links we 225 * look for matches on either the destination address or the local address, 226 * but we skip the local address check if IPIF_UNNUMBERED is set. If the 227 * `match_ill' argument is non-NULL, the lookup is restricted to that ill 228 * (or illgrp if `match_ill' is in an IPMP group). 229 */ 230 ipif_t * 231 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 232 ip_stack_t *ipst) 233 { 234 return (ipif_lookup_addr_common_v6(addr, match_ill, IPIF_MATCH_ILLGRP, 235 zoneid, ipst)); 236 } 237 238 /* 239 * Lookup an ipif with the specified address. Similar to ipif_lookup_addr, 240 * except that we will only return an address if it is not marked as 241 * IPIF_DUPLICATE 242 */ 243 ipif_t * 244 ipif_lookup_addr_nondup_v6(const in6_addr_t *addr, ill_t *match_ill, 245 zoneid_t zoneid, ip_stack_t *ipst) 246 { 247 return (ipif_lookup_addr_common_v6(addr, match_ill, 248 (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP), zoneid, 249 ipst)); 250 } 251 252 /* 253 * Special abbreviated version of ipif_lookup_addr_v6() that doesn't match 254 * `match_ill' across the IPMP group. This function is only needed in some 255 * corner-cases; almost everything should use ipif_lookup_addr_v6(). 256 */ 257 ipif_t * 258 ipif_lookup_addr_exact_v6(const in6_addr_t *addr, ill_t *match_ill, 259 ip_stack_t *ipst) 260 { 261 ASSERT(match_ill != NULL); 262 return (ipif_lookup_addr_common_v6(addr, match_ill, 0, ALL_ZONES, 263 ipst)); 264 } 265 266 /* 267 * Look for an ipif with the specified address. For point-point links 268 * we look for matches on either the destination address and the local 269 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 270 * is set. 271 * If the `match_ill' argument is non-NULL, the lookup is restricted to that 272 * ill (or illgrp if `match_ill' is in an IPMP group). 273 * Return the zoneid for the ipif. ALL_ZONES if none found. 274 */ 275 zoneid_t 276 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill, 277 ip_stack_t *ipst) 278 { 279 ipif_t *ipif; 280 ill_t *ill; 281 boolean_t ptp = B_FALSE; 282 ill_walk_context_t ctx; 283 zoneid_t zoneid; 284 285 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 286 /* 287 * Repeat twice, first based on local addresses and 288 * next time for pointopoint. 289 */ 290 repeat: 291 ill = ILL_START_WALK_V6(&ctx, ipst); 292 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 293 if (match_ill != NULL && ill != match_ill && 294 !IS_IN_SAME_ILLGRP(ill, match_ill)) { 295 continue; 296 } 297 mutex_enter(&ill->ill_lock); 298 for (ipif = ill->ill_ipif; ipif != NULL; 299 ipif = ipif->ipif_next) { 300 /* Allow the ipif to be down */ 301 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 302 &ipif->ipif_v6lcl_addr, addr) && 303 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 304 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 305 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 306 addr)) && 307 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) { 308 zoneid = ipif->ipif_zoneid; 309 mutex_exit(&ill->ill_lock); 310 rw_exit(&ipst->ips_ill_g_lock); 311 /* 312 * If ipif_zoneid was ALL_ZONES then we have 313 * a trusted extensions shared IP address. 314 * In that case GLOBAL_ZONEID works to send. 315 */ 316 if (zoneid == ALL_ZONES) 317 zoneid = GLOBAL_ZONEID; 318 return (zoneid); 319 } 320 } 321 mutex_exit(&ill->ill_lock); 322 } 323 324 /* If we already did the ptp case, then we are done */ 325 if (ptp) { 326 rw_exit(&ipst->ips_ill_g_lock); 327 return (ALL_ZONES); 328 } 329 ptp = B_TRUE; 330 goto repeat; 331 } 332 333 /* 334 * Perform various checks to verify that an address would make sense as a local 335 * interface address. This is currently only called when an attempt is made 336 * to set a local address. 337 * 338 * Does not allow a v4-mapped address, an address that equals the subnet 339 * anycast address, ... a multicast address, ... 340 */ 341 boolean_t 342 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 343 { 344 in6_addr_t subnet; 345 346 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 347 return (B_TRUE); /* Allow all zeros */ 348 349 /* 350 * Don't allow all zeroes or host part, but allow 351 * all ones netmask. 352 */ 353 V6_MASK_COPY(*addr, *subnet_mask, subnet); 354 if (IN6_IS_ADDR_V4MAPPED(addr) || 355 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 356 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 357 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 358 IN6_IS_ADDR_MULTICAST(addr)) 359 return (B_FALSE); 360 361 return (B_TRUE); 362 } 363 364 /* 365 * Perform various checks to verify that an address would make sense as a 366 * remote/subnet interface address. 367 */ 368 boolean_t 369 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 370 { 371 in6_addr_t subnet; 372 373 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 374 return (B_TRUE); /* Allow all zeros */ 375 376 V6_MASK_COPY(*addr, *subnet_mask, subnet); 377 if (IN6_IS_ADDR_V4MAPPED(addr) || 378 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 379 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 380 IN6_IS_ADDR_MULTICAST(addr) || 381 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 382 return (B_FALSE); 383 384 return (B_TRUE); 385 } 386 387 /* 388 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 389 * ill is passed in to associate it with the correct interface 390 * (for link-local destinations and gateways). 391 * If ire_arg is set, then we return the held IRE in that location. 392 */ 393 /* ARGSUSED1 */ 394 int 395 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 396 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 397 ill_t *ill, ire_t **ire_arg, struct rtsa_s *sp, ip_stack_t *ipst, 398 zoneid_t zoneid) 399 { 400 ire_t *ire, *nire; 401 ire_t *gw_ire = NULL; 402 ipif_t *ipif; 403 uint_t type; 404 int match_flags = MATCH_IRE_TYPE; 405 tsol_gc_t *gc = NULL; 406 tsol_gcgrp_t *gcgrp = NULL; 407 boolean_t gcgrp_xtraref = B_FALSE; 408 409 if (ire_arg != NULL) 410 *ire_arg = NULL; 411 412 /* 413 * Prevent routes with a zero gateway from being created (since 414 * interfaces can currently be plumbed and brought up with no assigned 415 * address). 416 */ 417 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 418 return (ENETUNREACH); 419 420 /* 421 * If this is the case of RTF_HOST being set, then we set the netmask 422 * to all ones (regardless if one was supplied). 423 */ 424 if (flags & RTF_HOST) 425 mask = &ipv6_all_ones; 426 427 /* 428 * Get the ipif, if any, corresponding to the gw_addr 429 * If -ifp was specified we restrict ourselves to the ill, otherwise 430 * we match on the gatway and destination to handle unnumbered pt-pt 431 * interfaces. 432 */ 433 if (ill != NULL) 434 ipif = ipif_lookup_addr_v6(gw_addr, ill, ALL_ZONES, ipst); 435 else 436 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst); 437 if (ipif != NULL) { 438 if (IS_VNI(ipif->ipif_ill)) { 439 ipif_refrele(ipif); 440 return (EINVAL); 441 } 442 } 443 444 /* 445 * GateD will attempt to create routes with a loopback interface 446 * address as the gateway and with RTF_GATEWAY set. We allow 447 * these routes to be added, but create them as interface routes 448 * since the gateway is an interface address. 449 */ 450 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) { 451 flags &= ~RTF_GATEWAY; 452 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) && 453 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) && 454 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) { 455 ire = ire_ftable_lookup_v6(dst_addr, 0, 0, IRE_LOOPBACK, 456 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst, 457 NULL); 458 if (ire != NULL) { 459 ire_refrele(ire); 460 ipif_refrele(ipif); 461 return (EEXIST); 462 } 463 ip1dbg(("ip_rt_add_v6: 0x%p creating IRE 0x%x" 464 "for 0x%x\n", (void *)ipif, 465 ipif->ipif_ire_type, 466 ntohl(ipif->ipif_lcl_addr))); 467 ire = ire_create_v6( 468 dst_addr, 469 mask, 470 NULL, 471 ipif->ipif_ire_type, /* LOOPBACK */ 472 ipif->ipif_ill, 473 zoneid, 474 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 475 NULL, 476 ipst); 477 478 if (ire == NULL) { 479 ipif_refrele(ipif); 480 return (ENOMEM); 481 } 482 /* src address assigned by the caller? */ 483 if ((flags & RTF_SETSRC) && 484 !IN6_IS_ADDR_UNSPECIFIED(src_addr)) 485 ire->ire_setsrc_addr_v6 = *src_addr; 486 487 nire = ire_add(ire); 488 if (nire == NULL) { 489 /* 490 * In the result of failure, ire_add() will have 491 * already deleted the ire in question, so there 492 * is no need to do that here. 493 */ 494 ipif_refrele(ipif); 495 return (ENOMEM); 496 } 497 /* 498 * Check if it was a duplicate entry. This handles 499 * the case of two racing route adds for the same route 500 */ 501 if (nire != ire) { 502 ASSERT(nire->ire_identical_ref > 1); 503 ire_delete(nire); 504 ire_refrele(nire); 505 ipif_refrele(ipif); 506 return (EEXIST); 507 } 508 ire = nire; 509 goto save_ire; 510 } 511 } 512 513 /* 514 * The routes for multicast with CGTP are quite special in that 515 * the gateway is the local interface address, yet RTF_GATEWAY 516 * is set. We turn off RTF_GATEWAY to provide compatibility with 517 * this undocumented and unusual use of multicast routes. 518 */ 519 if ((flags & RTF_MULTIRT) && ipif != NULL) 520 flags &= ~RTF_GATEWAY; 521 522 /* 523 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 524 * and the gateway address provided is one of the system's interface 525 * addresses. By using the routing socket interface and supplying an 526 * RTA_IFP sockaddr with an interface index, an alternate method of 527 * specifying an interface route to be created is available which uses 528 * the interface index that specifies the outgoing interface rather than 529 * the address of an outgoing interface (which may not be able to 530 * uniquely identify an interface). When coupled with the RTF_GATEWAY 531 * flag, routes can be specified which not only specify the next-hop to 532 * be used when routing to a certain prefix, but also which outgoing 533 * interface should be used. 534 * 535 * Previously, interfaces would have unique addresses assigned to them 536 * and so the address assigned to a particular interface could be used 537 * to identify a particular interface. One exception to this was the 538 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 539 * 540 * With the advent of IPv6 and its link-local addresses, this 541 * restriction was relaxed and interfaces could share addresses between 542 * themselves. In fact, typically all of the link-local interfaces on 543 * an IPv6 node or router will have the same link-local address. In 544 * order to differentiate between these interfaces, the use of an 545 * interface index is necessary and this index can be carried inside a 546 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 547 * of using the interface index, however, is that all of the ipif's that 548 * are part of an ill have the same index and so the RTA_IFP sockaddr 549 * cannot be used to differentiate between ipif's (or logical 550 * interfaces) that belong to the same ill (physical interface). 551 * 552 * For example, in the following case involving IPv4 interfaces and 553 * logical interfaces 554 * 555 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 556 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0 557 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0 558 * 559 * the ipif's corresponding to each of these interface routes can be 560 * uniquely identified by the "gateway" (actually interface address). 561 * 562 * In this case involving multiple IPv6 default routes to a particular 563 * link-local gateway, the use of RTA_IFP is necessary to specify which 564 * default route is of interest: 565 * 566 * default fe80::123:4567:89ab:cdef U if0 567 * default fe80::123:4567:89ab:cdef U if1 568 */ 569 570 /* RTF_GATEWAY not set */ 571 if (!(flags & RTF_GATEWAY)) { 572 if (sp != NULL) { 573 ip2dbg(("ip_rt_add_v6: gateway security attributes " 574 "cannot be set with interface route\n")); 575 if (ipif != NULL) 576 ipif_refrele(ipif); 577 return (EINVAL); 578 } 579 580 /* 581 * Whether or not ill (RTA_IFP) is set, we require that 582 * the gateway is one of our local addresses. 583 */ 584 if (ipif == NULL) 585 return (ENETUNREACH); 586 587 /* 588 * We use MATCH_IRE_ILL here. If the caller specified an 589 * interface (from the RTA_IFP sockaddr) we use it, otherwise 590 * we use the ill derived from the gateway address. 591 * We can always match the gateway address since we record it 592 * in ire_gateway_addr. 593 * We don't allow RTA_IFP to specify a different ill than the 594 * one matching the ipif to make sure we can delete the route. 595 */ 596 match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL; 597 if (ill == NULL) { 598 ill = ipif->ipif_ill; 599 } else if (ill != ipif->ipif_ill) { 600 ipif_refrele(ipif); 601 return (EINVAL); 602 } 603 604 /* 605 * We check for an existing entry at this point. 606 */ 607 match_flags |= MATCH_IRE_MASK; 608 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, 609 IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst, 610 NULL); 611 if (ire != NULL) { 612 ire_refrele(ire); 613 ipif_refrele(ipif); 614 return (EEXIST); 615 } 616 617 /* 618 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or 619 * IRE_IF_RESOLVER with the modified address, netmask, and 620 * gateway. 621 */ 622 ire = ire_create_v6( 623 dst_addr, 624 mask, 625 gw_addr, 626 ill->ill_net_type, 627 ill, 628 zoneid, 629 flags, 630 NULL, 631 ipst); 632 if (ire == NULL) { 633 ipif_refrele(ipif); 634 return (ENOMEM); 635 } 636 637 /* 638 * Some software (for example, GateD and Sun Cluster) attempts 639 * to create (what amount to) IRE_PREFIX routes with the 640 * loopback address as the gateway. This is primarily done to 641 * set up prefixes with the RTF_REJECT flag set (for example, 642 * when generating aggregate routes). We also OR in the 643 * RTF_BLACKHOLE flag as these interface routes, by 644 * definition, can only be that. 645 * 646 * If the IRE type (as defined by ill->ill_net_type) is 647 * IRE_LOOPBACK, then we map the request into a 648 * IRE_IF_NORESOLVER. 649 * 650 * Needless to say, the real IRE_LOOPBACK is NOT created by this 651 * routine, but rather using ire_create_v6() directly. 652 */ 653 if (ill->ill_net_type == IRE_LOOPBACK) { 654 ire->ire_type = IRE_IF_NORESOLVER; 655 ire->ire_flags |= RTF_BLACKHOLE; 656 } 657 /* src address assigned by the caller? */ 658 if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) 659 ire->ire_setsrc_addr_v6 = *src_addr; 660 661 nire = ire_add(ire); 662 if (nire == NULL) { 663 /* 664 * In the result of failure, ire_add() will have 665 * already deleted the ire in question, so there 666 * is no need to do that here. 667 */ 668 ipif_refrele(ipif); 669 return (ENOMEM); 670 } 671 /* 672 * Check if it was a duplicate entry. This handles 673 * the case of two racing route adds for the same route 674 */ 675 if (nire != ire) { 676 ASSERT(nire->ire_identical_ref > 1); 677 ire_delete(nire); 678 ire_refrele(nire); 679 ipif_refrele(ipif); 680 return (EEXIST); 681 } 682 ire = nire; 683 goto save_ire; 684 } 685 686 /* 687 * Get an interface IRE for the specified gateway. 688 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 689 * gateway, it is currently unreachable and we fail the request 690 * accordingly. 691 * If RTA_IFP was specified we look on that particular ill. 692 */ 693 if (ill != NULL) 694 match_flags |= MATCH_IRE_ILL; 695 696 /* Check whether the gateway is reachable. */ 697 type = IRE_INTERFACE; 698 if (flags & RTF_INDIRECT) 699 type |= IRE_OFFLINK; 700 701 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, type, ill, 702 ALL_ZONES, NULL, match_flags, 0, ipst, NULL); 703 if (gw_ire == NULL) { 704 if (ipif != NULL) 705 ipif_refrele(ipif); 706 return (ENETUNREACH); 707 } 708 709 /* 710 * We create one of three types of IREs as a result of this request 711 * based on the netmask. A netmask of all ones (which is automatically 712 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 713 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 714 * created. Otherwise, an IRE_PREFIX route is created for the 715 * destination prefix. 716 */ 717 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 718 type = IRE_HOST; 719 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 720 type = IRE_DEFAULT; 721 else 722 type = IRE_PREFIX; 723 724 /* check for a duplicate entry */ 725 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ill, 726 ALL_ZONES, NULL, 727 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, 0, ipst, NULL); 728 if (ire != NULL) { 729 if (ipif != NULL) 730 ipif_refrele(ipif); 731 ire_refrele(gw_ire); 732 ire_refrele(ire); 733 return (EEXIST); 734 } 735 736 /* Security attribute exists */ 737 if (sp != NULL) { 738 tsol_gcgrp_addr_t ga; 739 740 /* find or create the gateway credentials group */ 741 ga.ga_af = AF_INET6; 742 ga.ga_addr = *gw_addr; 743 744 /* we hold reference to it upon success */ 745 gcgrp = gcgrp_lookup(&ga, B_TRUE); 746 if (gcgrp == NULL) { 747 if (ipif != NULL) 748 ipif_refrele(ipif); 749 ire_refrele(gw_ire); 750 return (ENOMEM); 751 } 752 753 /* 754 * Create and add the security attribute to the group; a 755 * reference to the group is made upon allocating a new 756 * entry successfully. If it finds an already-existing 757 * entry for the security attribute in the group, it simply 758 * returns it and no new reference is made to the group. 759 */ 760 gc = gc_create(sp, gcgrp, &gcgrp_xtraref); 761 if (gc == NULL) { 762 /* release reference held by gcgrp_lookup */ 763 GCGRP_REFRELE(gcgrp); 764 if (ipif != NULL) 765 ipif_refrele(ipif); 766 ire_refrele(gw_ire); 767 return (ENOMEM); 768 } 769 } 770 771 /* Create the IRE. */ 772 ire = ire_create_v6( 773 dst_addr, /* dest address */ 774 mask, /* mask */ 775 gw_addr, /* gateway address */ 776 (ushort_t)type, /* IRE type */ 777 ill, 778 zoneid, 779 flags, 780 gc, /* security attribute */ 781 ipst); 782 783 /* 784 * The ire holds a reference to the 'gc' and the 'gc' holds a 785 * reference to the 'gcgrp'. We can now release the extra reference 786 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used. 787 */ 788 if (gcgrp_xtraref) 789 GCGRP_REFRELE(gcgrp); 790 if (ire == NULL) { 791 if (gc != NULL) 792 GC_REFRELE(gc); 793 if (ipif != NULL) 794 ipif_refrele(ipif); 795 ire_refrele(gw_ire); 796 return (ENOMEM); 797 } 798 799 /* src address assigned by the caller? */ 800 if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) 801 ire->ire_setsrc_addr_v6 = *src_addr; 802 803 /* 804 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 805 * SUN/OS socket stuff does but do we really want to allow ::0 ? 806 */ 807 808 /* Add the new IRE. */ 809 nire = ire_add(ire); 810 if (nire == NULL) { 811 /* 812 * In the result of failure, ire_add() will have 813 * already deleted the ire in question, so there 814 * is no need to do that here. 815 */ 816 if (ipif != NULL) 817 ipif_refrele(ipif); 818 ire_refrele(gw_ire); 819 return (ENOMEM); 820 } 821 /* 822 * Check if it was a duplicate entry. This handles 823 * the case of two racing route adds for the same route 824 */ 825 if (nire != ire) { 826 ASSERT(nire->ire_identical_ref > 1); 827 ire_delete(nire); 828 ire_refrele(nire); 829 if (ipif != NULL) 830 ipif_refrele(ipif); 831 ire_refrele(gw_ire); 832 return (EEXIST); 833 } 834 ire = nire; 835 836 if (flags & RTF_MULTIRT) { 837 /* 838 * Invoke the CGTP (multirouting) filtering module 839 * to add the dst address in the filtering database. 840 * Replicated inbound packets coming from that address 841 * will be filtered to discard the duplicates. 842 * It is not necessary to call the CGTP filter hook 843 * when the dst address is a multicast, because an 844 * IP source address cannot be a multicast. 845 */ 846 if (ipst->ips_ip_cgtp_filter_ops != NULL && 847 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 848 int res; 849 ipif_t *src_ipif; 850 851 /* Find the source address corresponding to gw_ire */ 852 src_ipif = ipif_lookup_addr_v6( 853 &gw_ire->ire_gateway_addr_v6, NULL, zoneid, ipst); 854 if (src_ipif != NULL) { 855 res = ipst->ips_ip_cgtp_filter_ops-> 856 cfo_add_dest_v6( 857 ipst->ips_netstack->netstack_stackid, 858 &ire->ire_addr_v6, 859 &ire->ire_gateway_addr_v6, 860 &ire->ire_setsrc_addr_v6, 861 &src_ipif->ipif_v6lcl_addr); 862 ipif_refrele(src_ipif); 863 } else { 864 res = EADDRNOTAVAIL; 865 } 866 if (res != 0) { 867 if (ipif != NULL) 868 ipif_refrele(ipif); 869 ire_refrele(gw_ire); 870 ire_delete(ire); 871 ire_refrele(ire); /* Held in ire_add */ 872 return (res); 873 } 874 } 875 } 876 877 save_ire: 878 if (gw_ire != NULL) { 879 ire_refrele(gw_ire); 880 gw_ire = NULL; 881 } 882 if (ire->ire_ill != NULL) { 883 /* 884 * Save enough information so that we can recreate the IRE if 885 * the ILL goes down and then up. The metrics associated 886 * with the route will be saved as well when rts_setmetrics() is 887 * called after the IRE has been created. In the case where 888 * memory cannot be allocated, none of this information will be 889 * saved. 890 */ 891 ill_save_ire(ire->ire_ill, ire); 892 } 893 894 if (ire_arg != NULL) { 895 /* 896 * Store the ire that was successfully added into where ire_arg 897 * points to so that callers don't have to look it up 898 * themselves (but they are responsible for ire_refrele()ing 899 * the ire when they are finished with it). 900 */ 901 *ire_arg = ire; 902 } else { 903 ire_refrele(ire); /* Held in ire_add */ 904 } 905 if (ipif != NULL) 906 ipif_refrele(ipif); 907 return (0); 908 } 909 910 /* 911 * ip_rt_delete_v6 is called to delete an IPv6 route. 912 * ill is passed in to associate it with the correct interface. 913 * (for link-local destinations and gateways). 914 */ 915 /* ARGSUSED4 */ 916 int 917 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 918 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ill_t *ill, 919 ip_stack_t *ipst, zoneid_t zoneid) 920 { 921 ire_t *ire = NULL; 922 ipif_t *ipif; 923 uint_t type; 924 uint_t match_flags = MATCH_IRE_TYPE; 925 int err = 0; 926 927 /* 928 * If this is the case of RTF_HOST being set, then we set the netmask 929 * to all ones. Otherwise, we use the netmask if one was supplied. 930 */ 931 if (flags & RTF_HOST) { 932 mask = &ipv6_all_ones; 933 match_flags |= MATCH_IRE_MASK; 934 } else if (rtm_addrs & RTA_NETMASK) { 935 match_flags |= MATCH_IRE_MASK; 936 } 937 938 /* 939 * Note that RTF_GATEWAY is never set on a delete, therefore 940 * we check if the gateway address is one of our interfaces first, 941 * and fall back on RTF_GATEWAY routes. 942 * 943 * This makes it possible to delete an original 944 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 945 * However, we have RTF_KERNEL set on the ones created by ipif_up 946 * and those can not be deleted here. 947 * 948 * We use MATCH_IRE_ILL if we know the interface. If the caller 949 * specified an interface (from the RTA_IFP sockaddr) we use it, 950 * otherwise we use the ill derived from the gateway address. 951 * We can always match the gateway address since we record it 952 * in ire_gateway_addr. 953 * 954 * For more detail on specifying routes by gateway address and by 955 * interface index, see the comments in ip_rt_add_v6(). 956 */ 957 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst); 958 if (ipif != NULL) { 959 ill_t *ill_match; 960 961 if (ill != NULL) 962 ill_match = ill; 963 else 964 ill_match = ipif->ipif_ill; 965 966 match_flags |= MATCH_IRE_ILL; 967 if (ipif->ipif_ire_type == IRE_LOOPBACK) { 968 ire = ire_ftable_lookup_v6(dst_addr, 0, 0, IRE_LOOPBACK, 969 ill_match, ALL_ZONES, NULL, match_flags, 0, ipst, 970 NULL); 971 } 972 if (ire == NULL) { 973 match_flags |= MATCH_IRE_GW; 974 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, 975 IRE_INTERFACE, ill_match, ALL_ZONES, NULL, 976 match_flags, 0, ipst, NULL); 977 } 978 /* Avoid deleting routes created by kernel from an ipif */ 979 if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) { 980 ire_refrele(ire); 981 ire = NULL; 982 } 983 984 /* Restore in case we didn't find a match */ 985 match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL); 986 } 987 988 if (ire == NULL) { 989 /* 990 * At this point, the gateway address is not one of our own 991 * addresses or a matching interface route was not found. We 992 * set the IRE type to lookup based on whether 993 * this is a host route, a default route or just a prefix. 994 * 995 * If an ill was passed in, then the lookup is based on an 996 * interface index so MATCH_IRE_ILL is added to match_flags. 997 */ 998 match_flags |= MATCH_IRE_GW; 999 if (ill != NULL) 1000 match_flags |= MATCH_IRE_ILL; 1001 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 1002 type = IRE_HOST; 1003 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 1004 type = IRE_DEFAULT; 1005 else 1006 type = IRE_PREFIX; 1007 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 1008 ill, ALL_ZONES, NULL, match_flags, 0, ipst, NULL); 1009 } 1010 1011 if (ipif != NULL) { 1012 ipif_refrele(ipif); 1013 ipif = NULL; 1014 } 1015 if (ire == NULL) 1016 return (ESRCH); 1017 1018 if (ire->ire_flags & RTF_MULTIRT) { 1019 /* 1020 * Invoke the CGTP (multirouting) filtering module 1021 * to remove the dst address from the filtering database. 1022 * Packets coming from that address will no longer be 1023 * filtered to remove duplicates. 1024 */ 1025 if (ipst->ips_ip_cgtp_filter_ops != NULL) { 1026 err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v6( 1027 ipst->ips_netstack->netstack_stackid, 1028 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 1029 } 1030 } 1031 1032 ill = ire->ire_ill; 1033 if (ill != NULL) 1034 ill_remove_saved_ire(ill, ire); 1035 ire_delete(ire); 1036 ire_refrele(ire); 1037 return (err); 1038 } 1039 1040 /* 1041 * Derive an interface id from the link layer address. 1042 */ 1043 void 1044 ill_setdefaulttoken(ill_t *ill) 1045 { 1046 if (!ill->ill_manual_token) { 1047 bzero(&ill->ill_token, sizeof (ill->ill_token)); 1048 MEDIA_V6INTFID(ill->ill_media, ill, &ill->ill_token); 1049 ill->ill_token_length = IPV6_TOKEN_LEN; 1050 } 1051 } 1052 1053 void 1054 ill_setdesttoken(ill_t *ill) 1055 { 1056 bzero(&ill->ill_dest_token, sizeof (ill->ill_dest_token)); 1057 MEDIA_V6DESTINTFID(ill->ill_media, ill, &ill->ill_dest_token); 1058 } 1059 1060 /* 1061 * Create a link-local address from a token. 1062 */ 1063 static void 1064 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 1065 { 1066 int i; 1067 1068 for (i = 0; i < 4; i++) { 1069 dest->s6_addr32[i] = 1070 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 1071 } 1072 } 1073 1074 /* 1075 * Set a default IPv6 address for a 6to4 tunnel interface 2002:<tsrc>::1/16 1076 */ 1077 static void 1078 ipif_set6to4addr(ipif_t *ipif) 1079 { 1080 ill_t *ill = ipif->ipif_ill; 1081 struct in_addr v4phys; 1082 1083 ASSERT(ill->ill_mactype == DL_6TO4); 1084 ASSERT(ill->ill_phys_addr_length == sizeof (struct in_addr)); 1085 ASSERT(ipif->ipif_isv6); 1086 1087 if (ipif->ipif_flags & IPIF_UP) 1088 return; 1089 1090 (void) ip_plen_to_mask_v6(16, &ipif->ipif_v6net_mask); 1091 bcopy(ill->ill_phys_addr, &v4phys, sizeof (struct in_addr)); 1092 IN6_V4ADDR_TO_6TO4(&v4phys, &ipif->ipif_v6lcl_addr); 1093 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1094 ipif->ipif_v6subnet); 1095 } 1096 1097 /* 1098 * Is it not possible to set the link local address? 1099 * The address can be set if the token is set, and the token 1100 * isn't too long. 1101 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1102 */ 1103 boolean_t 1104 ipif_cant_setlinklocal(ipif_t *ipif) 1105 { 1106 ill_t *ill = ipif->ipif_ill; 1107 1108 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1109 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1110 return (B_TRUE); 1111 1112 return (B_FALSE); 1113 } 1114 1115 /* 1116 * Generate a link-local address from the token. 1117 */ 1118 void 1119 ipif_setlinklocal(ipif_t *ipif) 1120 { 1121 ill_t *ill = ipif->ipif_ill; 1122 in6_addr_t ov6addr; 1123 1124 ASSERT(IAM_WRITER_ILL(ill)); 1125 1126 /* 1127 * ill_manual_linklocal is set when the link-local address was 1128 * manually configured. 1129 */ 1130 if (ill->ill_manual_linklocal) 1131 return; 1132 1133 /* 1134 * IPv6 interfaces over 6to4 tunnels are special. They do not have 1135 * link-local addresses, but instead have a single automatically 1136 * generated global address. 1137 */ 1138 if (ill->ill_mactype == DL_6TO4) { 1139 ipif_set6to4addr(ipif); 1140 return; 1141 } 1142 1143 if (ipif_cant_setlinklocal(ipif)) 1144 return; 1145 1146 ov6addr = ipif->ipif_v6lcl_addr; 1147 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1148 sctp_update_ipif_addr(ipif, ov6addr); 1149 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1150 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 1151 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1152 ipif->ipif_v6subnet); 1153 } 1154 1155 } 1156 1157 /* 1158 * Set the destination link-local address for a point-to-point IPv6 1159 * interface with a destination interface id (IP tunnels are such 1160 * interfaces). 1161 */ 1162 void 1163 ipif_setdestlinklocal(ipif_t *ipif) 1164 { 1165 ill_t *ill = ipif->ipif_ill; 1166 1167 ASSERT(IAM_WRITER_ILL(ill)); 1168 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_dest_token)) 1169 return; 1170 /* Skip if we've already set the pp_dst_addr */ 1171 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) 1172 return; 1173 1174 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, &ill->ill_dest_token); 1175 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1176 } 1177 1178 /* 1179 * Get the resolver set up for a new ipif. (Always called as writer.) 1180 */ 1181 int 1182 ipif_ndp_up(ipif_t *ipif, boolean_t initial) 1183 { 1184 ill_t *ill = ipif->ipif_ill; 1185 int err = 0; 1186 nce_t *nce = NULL; 1187 boolean_t added_ipif = B_FALSE; 1188 1189 DTRACE_PROBE3(ipif__downup, char *, "ipif_ndp_up", 1190 ill_t *, ill, ipif_t *, ipif); 1191 ip1dbg(("ipif_ndp_up(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 1192 1193 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) || 1194 (!(ill->ill_net_type & IRE_INTERFACE))) { 1195 ipif->ipif_addr_ready = 1; 1196 return (0); 1197 } 1198 1199 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1200 uint16_t flags; 1201 uint16_t state; 1202 uchar_t *hw_addr; 1203 ill_t *bound_ill; 1204 ipmp_illgrp_t *illg = ill->ill_grp; 1205 uint_t hw_addr_len; 1206 1207 flags = NCE_F_MYADDR | NCE_F_NONUD | NCE_F_PUBLISH | 1208 NCE_F_AUTHORITY; 1209 if (ill->ill_flags & ILLF_ROUTER) 1210 flags |= NCE_F_ISROUTER; 1211 1212 if (ipif->ipif_flags & IPIF_ANYCAST) 1213 flags |= NCE_F_ANYCAST; 1214 1215 if (IS_IPMP(ill)) { 1216 ASSERT(ill->ill_net_type == IRE_IF_RESOLVER); 1217 /* 1218 * If we're here via ipif_up(), then the ipif won't be 1219 * bound yet -- add it to the group, which will bind 1220 * it if possible. (We would add it in ipif_up(), but 1221 * deleting on failure there is gruesome.) If we're 1222 * here via ipmp_ill_bind_ipif(), then the ipif has 1223 * already been added to the group and we just need to 1224 * use the binding. 1225 */ 1226 if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) { 1227 bound_ill = ipmp_illgrp_add_ipif(illg, ipif); 1228 if (bound_ill == NULL) { 1229 /* 1230 * We couldn't bind the ipif to an ill 1231 * yet, so we have nothing to publish. 1232 * Set ipif_addr_ready so that this 1233 * address can be used locally for now. 1234 * The routing socket message will be 1235 * sent from ipif_up_done_v6(). 1236 */ 1237 ipif->ipif_addr_ready = 1; 1238 return (0); 1239 } 1240 added_ipif = B_TRUE; 1241 } 1242 hw_addr = bound_ill->ill_nd_lla; 1243 hw_addr_len = bound_ill->ill_phys_addr_length; 1244 } else { 1245 bound_ill = ill; 1246 if (ill->ill_net_type == IRE_IF_RESOLVER) { 1247 hw_addr = ill->ill_nd_lla; 1248 hw_addr_len = ill->ill_phys_addr_length; 1249 } else { 1250 hw_addr = NULL; 1251 hw_addr_len = 0; 1252 } 1253 } 1254 1255 /* 1256 * If this is an initial bring-up (or the ipif was never 1257 * completely brought up), do DAD. Otherwise, we're here 1258 * because IPMP has rebound an address to this ill: send 1259 * unsolicited advertisements to inform others. 1260 */ 1261 if (initial || !ipif->ipif_addr_ready) { 1262 /* Causes Duplicate Address Detection to run */ 1263 state = ND_PROBE; 1264 } else { 1265 state = ND_REACHABLE; 1266 flags |= NCE_F_UNSOL_ADV; 1267 } 1268 1269 retry: 1270 err = nce_lookup_then_add_v6(ill, hw_addr, hw_addr_len, 1271 &ipif->ipif_v6lcl_addr, flags, state, &nce); 1272 switch (err) { 1273 case 0: 1274 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1275 ill->ill_name)); 1276 ipif->ipif_addr_ready = 1; 1277 ipif->ipif_added_nce = 1; 1278 nce->nce_ipif_cnt++; 1279 break; 1280 case EINPROGRESS: 1281 ip1dbg(("ipif_ndp_up: running DAD now for %s\n", 1282 ill->ill_name)); 1283 ipif->ipif_added_nce = 1; 1284 nce->nce_ipif_cnt++; 1285 break; 1286 case EEXIST: 1287 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1288 ill->ill_name)); 1289 if (!NCE_MYADDR(nce->nce_common)) { 1290 /* 1291 * A leftover nce from before this address 1292 * existed 1293 */ 1294 ncec_delete(nce->nce_common); 1295 nce_refrele(nce); 1296 nce = NULL; 1297 goto retry; 1298 } 1299 if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) { 1300 nce_refrele(nce); 1301 nce = NULL; 1302 ip1dbg(("ipif_ndp_up: NCE already exists " 1303 "for %s\n", ill->ill_name)); 1304 goto fail; 1305 } 1306 /* 1307 * Duplicate local addresses are permissible for 1308 * IPIF_POINTOPOINT interfaces which will get marked 1309 * IPIF_UNNUMBERED later in 1310 * ip_addr_availability_check(). 1311 * 1312 * The nce_ipif_cnt field tracks the number of 1313 * ipifs that have nce_addr as their local address. 1314 */ 1315 ipif->ipif_addr_ready = 1; 1316 ipif->ipif_added_nce = 1; 1317 nce->nce_ipif_cnt++; 1318 err = 0; 1319 break; 1320 default: 1321 ip1dbg(("ipif_ndp_up: NCE creation failed for %s\n", 1322 ill->ill_name)); 1323 goto fail; 1324 } 1325 } else { 1326 /* No local NCE for this entry */ 1327 ipif->ipif_addr_ready = 1; 1328 } 1329 if (nce != NULL) 1330 nce_refrele(nce); 1331 return (0); 1332 fail: 1333 if (added_ipif) 1334 ipmp_illgrp_del_ipif(ill->ill_grp, ipif); 1335 1336 return (err); 1337 } 1338 1339 /* Remove all cache entries for this logical interface */ 1340 void 1341 ipif_ndp_down(ipif_t *ipif) 1342 { 1343 ipif_nce_down(ipif); 1344 } 1345 1346 /* 1347 * Return the scope of the given IPv6 address. If the address is an 1348 * IPv4 mapped IPv6 address, return the scope of the corresponding 1349 * IPv4 address. 1350 */ 1351 in6addr_scope_t 1352 ip_addr_scope_v6(const in6_addr_t *addr) 1353 { 1354 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1355 1356 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1357 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1358 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1359 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1360 return (IP6_SCOPE_LINKLOCAL); 1361 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1362 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1363 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1364 return (IP6_SCOPE_SITELOCAL); 1365 return (IP6_SCOPE_GLOBAL); 1366 } 1367 1368 if (IN6_IS_ADDR_MULTICAST(addr)) 1369 return (IN6_ADDR_MC_SCOPE(addr)); 1370 1371 /* link-local and loopback addresses are of link-local scope */ 1372 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1373 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1374 return (IP6_SCOPE_LINKLOCAL); 1375 if (IN6_IS_ADDR_SITELOCAL(addr)) 1376 return (IP6_SCOPE_SITELOCAL); 1377 return (IP6_SCOPE_GLOBAL); 1378 } 1379 1380 1381 /* 1382 * Returns the length of the common prefix of a1 and a2, as per 1383 * CommonPrefixLen() defined in RFC 3484. 1384 */ 1385 static int 1386 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2) 1387 { 1388 int i; 1389 uint32_t a1val, a2val, mask; 1390 1391 for (i = 0; i < 4; i++) { 1392 if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) { 1393 a1val ^= a2val; 1394 i *= 32; 1395 mask = 0x80000000u; 1396 while (!(a1val & mask)) { 1397 mask >>= 1; 1398 i++; 1399 } 1400 return (i); 1401 } 1402 } 1403 return (IPV6_ABITS); 1404 } 1405 1406 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1407 (((ipif)->ipif_flags & IPIF_UP) && \ 1408 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))) 1409 1410 /* source address candidate */ 1411 typedef struct candidate { 1412 ipif_t *cand_ipif; 1413 /* The properties of this candidate */ 1414 boolean_t cand_isdst; 1415 boolean_t cand_isdst_set; 1416 in6addr_scope_t cand_scope; 1417 boolean_t cand_scope_set; 1418 boolean_t cand_isdeprecated; 1419 boolean_t cand_isdeprecated_set; 1420 boolean_t cand_ispreferred; 1421 boolean_t cand_ispreferred_set; 1422 boolean_t cand_matchedinterface; 1423 boolean_t cand_matchedinterface_set; 1424 boolean_t cand_matchedlabel; 1425 boolean_t cand_matchedlabel_set; 1426 boolean_t cand_istmp; 1427 boolean_t cand_istmp_set; 1428 int cand_common_pref; 1429 boolean_t cand_common_pref_set; 1430 boolean_t cand_pref_eq; 1431 boolean_t cand_pref_eq_set; 1432 int cand_pref_len; 1433 boolean_t cand_pref_len_set; 1434 } cand_t; 1435 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1436 #define cand_mask cand_ipif->ipif_v6net_mask 1437 #define cand_flags cand_ipif->ipif_flags 1438 #define cand_ill cand_ipif->ipif_ill 1439 #define cand_zoneid cand_ipif->ipif_zoneid 1440 1441 /* information about the destination for source address selection */ 1442 typedef struct dstinfo { 1443 const in6_addr_t *dst_addr; 1444 ill_t *dst_ill; 1445 uint_t dst_restrict_ill; 1446 boolean_t dst_prefer_src_tmp; 1447 in6addr_scope_t dst_scope; 1448 char *dst_label; 1449 } dstinfo_t; 1450 1451 /* 1452 * The following functions are rules used to select a source address in 1453 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1454 * against the best candidate (bc). Each rule has three possible outcomes; 1455 * the candidate is preferred over the best candidate (CAND_PREFER), the 1456 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1457 * candidate is of equal value as the best candidate (CAND_TIE). 1458 * 1459 * These rules are part of a greater "Default Address Selection for IPv6" 1460 * sheme, which is standards based work coming out of the IETF ipv6 working 1461 * group. The IETF document defines both IPv6 source address selection and 1462 * destination address ordering. The rules defined here implement the IPv6 1463 * source address selection. Destination address ordering is done by 1464 * libnsl, and uses a similar set of rules to implement the sorting. 1465 * 1466 * Most of the rules are defined by the RFC and are not typically altered. The 1467 * last rule, number 8, has language that allows for local preferences. In the 1468 * scheme below, this means that new Solaris rules should normally go between 1469 * rule_ifprefix and rule_prefix. 1470 */ 1471 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1472 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *, 1473 ip_stack_t *); 1474 1475 /* Prefer an address if it is equal to the destination address. */ 1476 /* ARGSUSED3 */ 1477 static rule_res_t 1478 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1479 { 1480 if (!bc->cand_isdst_set) { 1481 bc->cand_isdst = 1482 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1483 bc->cand_isdst_set = B_TRUE; 1484 } 1485 1486 cc->cand_isdst = 1487 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1488 cc->cand_isdst_set = B_TRUE; 1489 1490 if (cc->cand_isdst == bc->cand_isdst) 1491 return (CAND_TIE); 1492 else if (cc->cand_isdst) 1493 return (CAND_PREFER); 1494 else 1495 return (CAND_AVOID); 1496 } 1497 1498 /* 1499 * Prefer addresses that are of closest scope to the destination. Always 1500 * prefer addresses that are of greater scope than the destination over 1501 * those that are of lesser scope than the destination. 1502 */ 1503 /* ARGSUSED3 */ 1504 static rule_res_t 1505 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1506 { 1507 if (!bc->cand_scope_set) { 1508 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1509 bc->cand_scope_set = B_TRUE; 1510 } 1511 1512 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1513 cc->cand_scope_set = B_TRUE; 1514 1515 if (cc->cand_scope < bc->cand_scope) { 1516 if (cc->cand_scope < dstinfo->dst_scope) 1517 return (CAND_AVOID); 1518 else 1519 return (CAND_PREFER); 1520 } else if (bc->cand_scope < cc->cand_scope) { 1521 if (bc->cand_scope < dstinfo->dst_scope) 1522 return (CAND_PREFER); 1523 else 1524 return (CAND_AVOID); 1525 } else { 1526 return (CAND_TIE); 1527 } 1528 } 1529 1530 /* 1531 * Prefer non-deprecated source addresses. 1532 */ 1533 /* ARGSUSED2 */ 1534 static rule_res_t 1535 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1536 ip_stack_t *ipst) 1537 { 1538 if (!bc->cand_isdeprecated_set) { 1539 bc->cand_isdeprecated = 1540 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 1541 bc->cand_isdeprecated_set = B_TRUE; 1542 } 1543 1544 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 1545 cc->cand_isdeprecated_set = B_TRUE; 1546 1547 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 1548 return (CAND_TIE); 1549 else if (cc->cand_isdeprecated) 1550 return (CAND_AVOID); 1551 else 1552 return (CAND_PREFER); 1553 } 1554 1555 /* 1556 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 1557 * rule must be before rule_interface because the flag could be set on any 1558 * interface, not just the interface being used for outgoing packets (for 1559 * example, the IFF_PREFERRED could be set on an address assigned to the 1560 * loopback interface). 1561 */ 1562 /* ARGSUSED2 */ 1563 static rule_res_t 1564 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1565 ip_stack_t *ipst) 1566 { 1567 if (!bc->cand_ispreferred_set) { 1568 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 1569 bc->cand_ispreferred_set = B_TRUE; 1570 } 1571 1572 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 1573 cc->cand_ispreferred_set = B_TRUE; 1574 1575 if (bc->cand_ispreferred == cc->cand_ispreferred) 1576 return (CAND_TIE); 1577 else if (cc->cand_ispreferred) 1578 return (CAND_PREFER); 1579 else 1580 return (CAND_AVOID); 1581 } 1582 1583 /* 1584 * Prefer source addresses that are assigned to the outgoing interface. 1585 */ 1586 /* ARGSUSED3 */ 1587 static rule_res_t 1588 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1589 ip_stack_t *ipst) 1590 { 1591 ill_t *dstill = dstinfo->dst_ill; 1592 1593 /* 1594 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 1595 * since we know all candidates will be on the same link. 1596 */ 1597 if (dstinfo->dst_restrict_ill) 1598 return (CAND_TIE); 1599 1600 if (!bc->cand_matchedinterface_set) { 1601 bc->cand_matchedinterface = bc->cand_ill == dstill; 1602 bc->cand_matchedinterface_set = B_TRUE; 1603 } 1604 1605 cc->cand_matchedinterface = cc->cand_ill == dstill; 1606 cc->cand_matchedinterface_set = B_TRUE; 1607 1608 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 1609 return (CAND_TIE); 1610 else if (cc->cand_matchedinterface) 1611 return (CAND_PREFER); 1612 else 1613 return (CAND_AVOID); 1614 } 1615 1616 /* 1617 * Prefer source addresses whose label matches the destination's label. 1618 */ 1619 static rule_res_t 1620 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1621 { 1622 char *label; 1623 1624 if (!bc->cand_matchedlabel_set) { 1625 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst); 1626 bc->cand_matchedlabel = 1627 ip6_asp_labelcmp(label, dstinfo->dst_label); 1628 bc->cand_matchedlabel_set = B_TRUE; 1629 } 1630 1631 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst); 1632 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 1633 cc->cand_matchedlabel_set = B_TRUE; 1634 1635 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 1636 return (CAND_TIE); 1637 else if (cc->cand_matchedlabel) 1638 return (CAND_PREFER); 1639 else 1640 return (CAND_AVOID); 1641 } 1642 1643 /* 1644 * Prefer public addresses over temporary ones. An application can reverse 1645 * the logic of this rule and prefer temporary addresses by using the 1646 * IPV6_SRC_PREFERENCES socket option. 1647 */ 1648 /* ARGSUSED3 */ 1649 static rule_res_t 1650 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1651 ip_stack_t *ipst) 1652 { 1653 if (!bc->cand_istmp_set) { 1654 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 1655 bc->cand_istmp_set = B_TRUE; 1656 } 1657 1658 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 1659 cc->cand_istmp_set = B_TRUE; 1660 1661 if (bc->cand_istmp == cc->cand_istmp) 1662 return (CAND_TIE); 1663 1664 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 1665 return (CAND_PREFER); 1666 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 1667 return (CAND_PREFER); 1668 else 1669 return (CAND_AVOID); 1670 } 1671 1672 /* 1673 * Prefer source addresses with longer matching prefix with the destination 1674 * under the interface mask. This gets us on the same subnet before applying 1675 * any Solaris-specific rules. 1676 */ 1677 /* ARGSUSED3 */ 1678 static rule_res_t 1679 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1680 ip_stack_t *ipst) 1681 { 1682 if (!bc->cand_pref_eq_set) { 1683 bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr, 1684 bc->cand_mask, *dstinfo->dst_addr); 1685 bc->cand_pref_eq_set = B_TRUE; 1686 } 1687 1688 cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask, 1689 *dstinfo->dst_addr); 1690 cc->cand_pref_eq_set = B_TRUE; 1691 1692 if (bc->cand_pref_eq) { 1693 if (cc->cand_pref_eq) { 1694 if (!bc->cand_pref_len_set) { 1695 bc->cand_pref_len = 1696 ip_mask_to_plen_v6(&bc->cand_mask); 1697 bc->cand_pref_len_set = B_TRUE; 1698 } 1699 cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask); 1700 cc->cand_pref_len_set = B_TRUE; 1701 if (bc->cand_pref_len == cc->cand_pref_len) 1702 return (CAND_TIE); 1703 else if (bc->cand_pref_len > cc->cand_pref_len) 1704 return (CAND_AVOID); 1705 else 1706 return (CAND_PREFER); 1707 } else { 1708 return (CAND_AVOID); 1709 } 1710 } else { 1711 if (cc->cand_pref_eq) 1712 return (CAND_PREFER); 1713 else 1714 return (CAND_TIE); 1715 } 1716 } 1717 1718 /* 1719 * Prefer to use zone-specific addresses when possible instead of all-zones 1720 * addresses. 1721 */ 1722 /* ARGSUSED2 */ 1723 static rule_res_t 1724 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1725 ip_stack_t *ipst) 1726 { 1727 if ((bc->cand_zoneid == ALL_ZONES) == 1728 (cc->cand_zoneid == ALL_ZONES)) 1729 return (CAND_TIE); 1730 else if (cc->cand_zoneid == ALL_ZONES) 1731 return (CAND_AVOID); 1732 else 1733 return (CAND_PREFER); 1734 } 1735 1736 /* 1737 * Prefer to use DHCPv6 (first) and static addresses (second) when possible 1738 * instead of statelessly autoconfigured addresses. 1739 * 1740 * This is done after trying all other preferences (and before the final tie 1741 * breaker) so that, if all else is equal, we select addresses configured by 1742 * DHCPv6 over other addresses. We presume that DHCPv6 addresses, unlike 1743 * stateless autoconfigured addresses, are deliberately configured by an 1744 * administrator, and thus are correctly set up in DNS and network packet 1745 * filters. 1746 */ 1747 /* ARGSUSED2 */ 1748 static rule_res_t 1749 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1750 ip_stack_t *ipst) 1751 { 1752 #define ATYPE(x) \ 1753 ((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2 1754 int bcval = ATYPE(bc->cand_flags); 1755 int ccval = ATYPE(cc->cand_flags); 1756 #undef ATYPE 1757 1758 if (bcval == ccval) 1759 return (CAND_TIE); 1760 else if (ccval < bcval) 1761 return (CAND_PREFER); 1762 else 1763 return (CAND_AVOID); 1764 } 1765 1766 /* 1767 * Prefer source addresses with longer matching prefix with the destination. 1768 * We do the longest matching prefix calculation by doing an xor of both 1769 * addresses with the destination, and pick the address with the longest string 1770 * of leading zeros, as per CommonPrefixLen() defined in RFC 3484. 1771 */ 1772 /* ARGSUSED3 */ 1773 static rule_res_t 1774 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1775 { 1776 if (!bc->cand_common_pref_set) { 1777 bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr, 1778 dstinfo->dst_addr); 1779 bc->cand_common_pref_set = B_TRUE; 1780 } 1781 1782 cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr, 1783 dstinfo->dst_addr); 1784 cc->cand_common_pref_set = B_TRUE; 1785 1786 if (bc->cand_common_pref == cc->cand_common_pref) 1787 return (CAND_TIE); 1788 else if (bc->cand_common_pref > cc->cand_common_pref) 1789 return (CAND_AVOID); 1790 else 1791 return (CAND_PREFER); 1792 } 1793 1794 /* 1795 * Last rule: we must pick something, so just prefer the current best 1796 * candidate. 1797 */ 1798 /* ARGSUSED */ 1799 static rule_res_t 1800 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1801 ip_stack_t *ipst) 1802 { 1803 return (CAND_AVOID); 1804 } 1805 1806 /* 1807 * Determine the best source address given a destination address and a 1808 * destination ill. If no suitable source address is found, it returns 1809 * NULL. If there is a usable address pointed to by the usesrc 1810 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 1811 * fine grained (i.e per interface) 1812 * 1813 * This implementation is based on the "Default Address Selection for IPv6" 1814 * specification produced by the IETF IPv6 working group. It has been 1815 * implemented so that the list of addresses is only traversed once (the 1816 * specification's algorithm could traverse the list of addresses once for 1817 * every rule). 1818 * 1819 * The restrict_ill argument restricts the algorithm to choose a source 1820 * address that is assigned to the destination ill. This is used when 1821 * the destination address is a link-local or multicast address, and when 1822 * ipv6_strict_dst_multihoming is turned on. 1823 * 1824 * src_prefs is the caller's set of source address preferences. If source 1825 * address selection is being called to determine the source address of a 1826 * connected socket (from ip_set_destination_v6()), then the preferences are 1827 * taken from conn_ixa->ixa_src_preferences. These preferences can be set on a 1828 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 1829 * preference currently implemented is for rfc3041 temporary addresses. 1830 */ 1831 ipif_t * 1832 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 1833 boolean_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid, 1834 boolean_t allow_usesrc, boolean_t *notreadyp) 1835 { 1836 dstinfo_t dstinfo; 1837 char dstr[INET6_ADDRSTRLEN]; 1838 char sstr[INET6_ADDRSTRLEN]; 1839 ipif_t *ipif, *start_ipif, *next_ipif; 1840 ill_t *ill, *usesrc_ill = NULL, *ipmp_ill = NULL; 1841 ill_walk_context_t ctx; 1842 cand_t best_c; /* The best candidate */ 1843 cand_t curr_c; /* The current candidate */ 1844 uint_t index; 1845 boolean_t first_candidate = B_TRUE; 1846 rule_res_t rule_result; 1847 tsol_tpc_t *src_rhtp, *dst_rhtp; 1848 ip_stack_t *ipst = dstill->ill_ipst; 1849 1850 /* 1851 * The list of ordering rules. They are applied in the order they 1852 * appear in the list. 1853 * 1854 * Solaris doesn't currently support Mobile IPv6, so there's no 1855 * rule_mipv6 corresponding to rule 4 in the specification. 1856 */ 1857 rulef_t rules[] = { 1858 rule_isdst, 1859 rule_scope, 1860 rule_deprecated, 1861 rule_preferred, 1862 rule_interface, 1863 rule_label, 1864 rule_temporary, 1865 rule_ifprefix, /* local rules after this */ 1866 rule_zone_specific, 1867 rule_addr_type, 1868 rule_prefix, /* local rules before this */ 1869 rule_must_be_last, /* must always be last */ 1870 NULL 1871 }; 1872 1873 ASSERT(dstill->ill_isv6); 1874 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 1875 1876 /* 1877 * Check if there is a usable src address pointed to by the 1878 * usesrc ifindex. This has higher precedence since it is 1879 * finer grained (i.e per interface) v/s being system wide. 1880 */ 1881 if (dstill->ill_usesrc_ifindex != 0 && allow_usesrc) { 1882 if ((usesrc_ill = 1883 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 1884 ipst)) != NULL) { 1885 dstinfo.dst_ill = usesrc_ill; 1886 } else { 1887 return (NULL); 1888 } 1889 } else if (IS_UNDER_IPMP(dstill)) { 1890 /* 1891 * Test addresses should never be used for source address 1892 * selection, so if we were passed an underlying ill, switch 1893 * to the IPMP meta-interface. 1894 */ 1895 if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(dstill)) != NULL) 1896 dstinfo.dst_ill = ipmp_ill; 1897 else 1898 return (NULL); 1899 } else { 1900 dstinfo.dst_ill = dstill; 1901 } 1902 1903 /* 1904 * If we're dealing with an unlabeled destination on a labeled system, 1905 * make sure that we ignore source addresses that are incompatible with 1906 * the destination's default label. That destination's default label 1907 * must dominate the minimum label on the source address. 1908 * 1909 * (Note that this has to do with Trusted Solaris. It's not related to 1910 * the labels described by ip6_asp_lookup.) 1911 */ 1912 dst_rhtp = NULL; 1913 if (is_system_labeled()) { 1914 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE); 1915 if (dst_rhtp == NULL) 1916 return (NULL); 1917 if (dst_rhtp->tpc_tp.host_type != UNLABELED) { 1918 TPC_RELE(dst_rhtp); 1919 dst_rhtp = NULL; 1920 } 1921 } 1922 1923 dstinfo.dst_addr = dst; 1924 dstinfo.dst_scope = ip_addr_scope_v6(dst); 1925 dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst); 1926 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 1927 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 1928 /* 1929 * Section three of the I-D states that for multicast and 1930 * link-local destinations, the candidate set must be restricted to 1931 * an interface that is on the same link as the outgoing interface. 1932 * Also, when ipv6_strict_dst_multihoming is turned on, always 1933 * restrict the source address to the destination link as doing 1934 * otherwise will almost certainly cause problems. 1935 */ 1936 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 1937 ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) { 1938 dstinfo.dst_restrict_ill = B_TRUE; 1939 } else { 1940 dstinfo.dst_restrict_ill = restrict_ill; 1941 } 1942 1943 bzero(&best_c, sizeof (cand_t)); 1944 1945 /* 1946 * Take a pass through the list of IPv6 interfaces to choose the best 1947 * possible source address. If restrict_ill is set, just use dst_ill. 1948 */ 1949 if (dstinfo.dst_restrict_ill) 1950 ill = dstinfo.dst_ill; 1951 else 1952 ill = ILL_START_WALK_V6(&ctx, ipst); 1953 1954 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 1955 ASSERT(ill->ill_isv6); 1956 1957 /* 1958 * Test addresses should never be used for source address 1959 * selection, so ignore underlying ills. 1960 */ 1961 if (IS_UNDER_IPMP(ill)) 1962 continue; 1963 1964 if (ill->ill_ipif == NULL) 1965 continue; 1966 /* 1967 * For source address selection, we treat the ipif list as 1968 * circular and continue until we get back to where we 1969 * started. This allows IPMP to vary source address selection 1970 * (which improves inbound load spreading) by caching its last 1971 * ending point and starting from there. NOTE: we don't have 1972 * to worry about ill_src_ipif changing ills since that can't 1973 * happen on the IPMP ill. 1974 */ 1975 start_ipif = ill->ill_ipif; 1976 if (IS_IPMP(ill) && ill->ill_src_ipif != NULL) 1977 start_ipif = ill->ill_src_ipif; 1978 1979 ipif = start_ipif; 1980 do { 1981 if ((next_ipif = ipif->ipif_next) == NULL) 1982 next_ipif = ill->ill_ipif; 1983 1984 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 1985 continue; 1986 1987 if (!ipif->ipif_addr_ready) { 1988 if (notreadyp != NULL) 1989 *notreadyp = B_TRUE; 1990 continue; 1991 } 1992 1993 if (zoneid != ALL_ZONES && 1994 ipif->ipif_zoneid != zoneid && 1995 ipif->ipif_zoneid != ALL_ZONES) 1996 continue; 1997 1998 /* 1999 * Check compatibility of local address for 2000 * destination's default label if we're on a labeled 2001 * system. Incompatible addresses can't be used at 2002 * all and must be skipped over. 2003 */ 2004 if (dst_rhtp != NULL) { 2005 boolean_t incompat; 2006 2007 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr, 2008 IPV6_VERSION, B_FALSE); 2009 if (src_rhtp == NULL) 2010 continue; 2011 incompat = 2012 src_rhtp->tpc_tp.host_type != SUN_CIPSO || 2013 src_rhtp->tpc_tp.tp_doi != 2014 dst_rhtp->tpc_tp.tp_doi || 2015 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label, 2016 &src_rhtp->tpc_tp.tp_sl_range_cipso) && 2017 !blinlset(&dst_rhtp->tpc_tp.tp_def_label, 2018 src_rhtp->tpc_tp.tp_sl_set_cipso)); 2019 TPC_RELE(src_rhtp); 2020 if (incompat) 2021 continue; 2022 } 2023 2024 if (first_candidate) { 2025 /* 2026 * This is first valid address in the list. 2027 * It is automatically the best candidate 2028 * so far. 2029 */ 2030 best_c.cand_ipif = ipif; 2031 first_candidate = B_FALSE; 2032 continue; 2033 } 2034 2035 bzero(&curr_c, sizeof (cand_t)); 2036 curr_c.cand_ipif = ipif; 2037 2038 /* 2039 * Compare this current candidate (curr_c) with the 2040 * best candidate (best_c) by applying the 2041 * comparison rules in order until one breaks the 2042 * tie. 2043 */ 2044 for (index = 0; rules[index] != NULL; index++) { 2045 /* Apply a comparison rule. */ 2046 rule_result = (rules[index])(&best_c, &curr_c, 2047 &dstinfo, ipst); 2048 if (rule_result == CAND_AVOID) { 2049 /* 2050 * The best candidate is still the 2051 * best candidate. Forget about 2052 * this current candidate and go on 2053 * to the next one. 2054 */ 2055 break; 2056 } else if (rule_result == CAND_PREFER) { 2057 /* 2058 * This candidate is prefered. It 2059 * becomes the best candidate so 2060 * far. Go on to the next address. 2061 */ 2062 best_c = curr_c; 2063 break; 2064 } 2065 /* We have a tie, apply the next rule. */ 2066 } 2067 2068 /* 2069 * The last rule must be a tie breaker rule and 2070 * must never produce a tie. At this point, the 2071 * candidate should have either been rejected, or 2072 * have been prefered as the best candidate so far. 2073 */ 2074 ASSERT(rule_result != CAND_TIE); 2075 } while ((ipif = next_ipif) != start_ipif); 2076 2077 /* 2078 * For IPMP, update the source ipif rotor to the next ipif, 2079 * provided we can look it up. (We must not use it if it's 2080 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after 2081 * ipif_free() checked ill_src_ipif.) 2082 */ 2083 if (IS_IPMP(ill) && ipif != NULL) { 2084 mutex_enter(&ipif->ipif_ill->ill_lock); 2085 next_ipif = ipif->ipif_next; 2086 if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif)) 2087 ill->ill_src_ipif = next_ipif; 2088 else 2089 ill->ill_src_ipif = NULL; 2090 mutex_exit(&ipif->ipif_ill->ill_lock); 2091 } 2092 2093 /* 2094 * Only one ill to consider if dst_restrict_ill is set. 2095 */ 2096 if (dstinfo.dst_restrict_ill) 2097 break; 2098 } 2099 2100 ipif = best_c.cand_ipif; 2101 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2102 dstinfo.dst_ill->ill_name, 2103 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2104 (ipif == NULL ? "NULL" : 2105 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2106 2107 if (usesrc_ill != NULL) 2108 ill_refrele(usesrc_ill); 2109 2110 if (ipmp_ill != NULL) 2111 ill_refrele(ipmp_ill); 2112 2113 if (dst_rhtp != NULL) 2114 TPC_RELE(dst_rhtp); 2115 2116 if (ipif == NULL) { 2117 rw_exit(&ipst->ips_ill_g_lock); 2118 return (NULL); 2119 } 2120 2121 mutex_enter(&ipif->ipif_ill->ill_lock); 2122 if (!IPIF_IS_CONDEMNED(ipif)) { 2123 ipif_refhold_locked(ipif); 2124 mutex_exit(&ipif->ipif_ill->ill_lock); 2125 rw_exit(&ipst->ips_ill_g_lock); 2126 return (ipif); 2127 } 2128 mutex_exit(&ipif->ipif_ill->ill_lock); 2129 rw_exit(&ipst->ips_ill_g_lock); 2130 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2131 " returning null \n", (void *)ipif)); 2132 2133 return (NULL); 2134 } 2135 2136 /* 2137 * Pick a source address based on the destination ill and an optional setsrc 2138 * address. 2139 * The result is stored in srcp. If generation is set, then put the source 2140 * generation number there before we look for the source address (to avoid 2141 * missing changes in the set of source addresses. 2142 * If flagsp is set, then us it to pass back ipif_flags. 2143 * 2144 * If the caller wants to cache the returned source address and detect when 2145 * that might be stale, the caller should pass in a generation argument, 2146 * which the caller can later compare against ips_src_generation 2147 * 2148 * The precedence order for selecting an IPv6 source address is: 2149 * - RTF_SETSRC on the first ire in the recursive lookup always wins. 2150 * - If usrsrc is set, swap the ill to be the usesrc one. 2151 * - If IPMP is used on the ill, select a random address from the most 2152 * preferred ones below: 2153 * That is followed by the long list of IPv6 source address selection rules 2154 * starting with rule_isdst(), rule_scope(), etc. 2155 * 2156 * We have lower preference for ALL_ZONES IP addresses, 2157 * as they pose problems with unlabeled destinations. 2158 * 2159 * Note that when multiple IP addresses match e.g., with rule_scope() we pick 2160 * the first one if IPMP is not in use. With IPMP we randomize. 2161 */ 2162 int 2163 ip_select_source_v6(ill_t *ill, const in6_addr_t *setsrc, const in6_addr_t *dst, 2164 zoneid_t zoneid, ip_stack_t *ipst, uint_t restrict_ill, uint32_t src_prefs, 2165 in6_addr_t *srcp, uint32_t *generation, uint64_t *flagsp) 2166 { 2167 ipif_t *ipif; 2168 boolean_t notready = B_FALSE; /* Set if !ipif_addr_ready found */ 2169 2170 if (flagsp != NULL) 2171 *flagsp = 0; 2172 2173 /* 2174 * Need to grab the generation number before we check to 2175 * avoid a race with a change to the set of local addresses. 2176 * No lock needed since the thread which updates the set of local 2177 * addresses use ipif/ill locks and exit those (hence a store memory 2178 * barrier) before doing the atomic increase of ips_src_generation. 2179 */ 2180 if (generation != NULL) { 2181 *generation = ipst->ips_src_generation; 2182 } 2183 2184 /* Was RTF_SETSRC set on the first IRE in the recursive lookup? */ 2185 if (setsrc != NULL && !IN6_IS_ADDR_UNSPECIFIED(setsrc)) { 2186 *srcp = *setsrc; 2187 return (0); 2188 } 2189 2190 ipif = ipif_select_source_v6(ill, dst, restrict_ill, src_prefs, zoneid, 2191 B_TRUE, ¬ready); 2192 if (ipif == NULL) { 2193 if (notready) 2194 return (ENETDOWN); 2195 else 2196 return (EADDRNOTAVAIL); 2197 } 2198 *srcp = ipif->ipif_v6lcl_addr; 2199 if (flagsp != NULL) 2200 *flagsp = ipif->ipif_flags; 2201 ipif_refrele(ipif); 2202 return (0); 2203 } 2204 2205 /* 2206 * Perform an attach and bind to get phys addr plus info_req for 2207 * the physical device. 2208 * q and mp represents an ioctl which will be queued waiting for 2209 * completion of the DLPI message exchange. 2210 * MUST be called on an ill queue. 2211 * 2212 * Returns EINPROGRESS when mp has been consumed by queueing it. 2213 * The ioctl will complete in ip_rput. 2214 */ 2215 int 2216 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2217 { 2218 mblk_t *v6token_mp = NULL; 2219 mblk_t *v6lla_mp = NULL; 2220 mblk_t *dest_mp = NULL; 2221 mblk_t *phys_mp = NULL; 2222 mblk_t *info_mp = NULL; 2223 mblk_t *attach_mp = NULL; 2224 mblk_t *bind_mp = NULL; 2225 mblk_t *unbind_mp = NULL; 2226 mblk_t *notify_mp = NULL; 2227 2228 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2229 ASSERT(ill->ill_dlpi_style_set); 2230 ASSERT(WR(q)->q_next != NULL); 2231 2232 if (ill->ill_isv6) { 2233 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2234 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2235 if (v6token_mp == NULL) 2236 goto bad; 2237 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2238 DL_IPV6_TOKEN; 2239 2240 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2241 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2242 if (v6lla_mp == NULL) 2243 goto bad; 2244 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2245 DL_IPV6_LINK_LAYER_ADDR; 2246 } 2247 2248 if (ill->ill_mactype == DL_IPV4 || ill->ill_mactype == DL_IPV6) { 2249 dest_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2250 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2251 if (dest_mp == NULL) 2252 goto bad; 2253 ((dl_phys_addr_req_t *)dest_mp->b_rptr)->dl_addr_type = 2254 DL_CURR_DEST_ADDR; 2255 } 2256 2257 /* 2258 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2259 */ 2260 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2261 DL_NOTIFY_REQ); 2262 if (notify_mp == NULL) 2263 goto bad; 2264 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2265 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2266 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG | 2267 DL_NOTE_PROMISC_ON_PHYS | DL_NOTE_PROMISC_OFF_PHYS | 2268 DL_NOTE_REPLUMB); 2269 2270 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2271 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2272 if (phys_mp == NULL) 2273 goto bad; 2274 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2275 DL_CURR_PHYS_ADDR; 2276 2277 info_mp = ip_dlpi_alloc( 2278 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2279 DL_INFO_REQ); 2280 if (info_mp == NULL) 2281 goto bad; 2282 2283 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2284 DL_BIND_REQ); 2285 if (bind_mp == NULL) 2286 goto bad; 2287 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2288 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2289 2290 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2291 if (unbind_mp == NULL) 2292 goto bad; 2293 2294 /* If we need to attach, pre-alloc and initialize the mblk */ 2295 if (ill->ill_needs_attach) { 2296 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2297 DL_ATTACH_REQ); 2298 if (attach_mp == NULL) 2299 goto bad; 2300 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2301 } 2302 2303 /* 2304 * Here we are going to delay the ioctl ack until after 2305 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2306 * original ioctl message before sending the requests 2307 */ 2308 mutex_enter(&ill->ill_lock); 2309 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2310 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2311 /* 2312 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2313 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2314 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2315 */ 2316 ill->ill_phys_addr_pend = 0; 2317 mutex_exit(&ill->ill_lock); 2318 2319 if (attach_mp != NULL) { 2320 ip1dbg(("ill_dl_phys: attach\n")); 2321 ill_dlpi_send(ill, attach_mp); 2322 } 2323 ill_dlpi_send(ill, bind_mp); 2324 ill_dlpi_send(ill, info_mp); 2325 if (v6token_mp != NULL) 2326 ill_dlpi_send(ill, v6token_mp); 2327 if (v6lla_mp != NULL) 2328 ill_dlpi_send(ill, v6lla_mp); 2329 if (dest_mp != NULL) 2330 ill_dlpi_send(ill, dest_mp); 2331 ill_dlpi_send(ill, phys_mp); 2332 ill_dlpi_send(ill, notify_mp); 2333 ill_dlpi_send(ill, unbind_mp); 2334 2335 /* 2336 * This operation will complete in ip_rput_dlpi_writer with either 2337 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2338 */ 2339 return (EINPROGRESS); 2340 bad: 2341 freemsg(v6token_mp); 2342 freemsg(v6lla_mp); 2343 freemsg(dest_mp); 2344 freemsg(phys_mp); 2345 freemsg(info_mp); 2346 freemsg(attach_mp); 2347 freemsg(bind_mp); 2348 freemsg(unbind_mp); 2349 freemsg(notify_mp); 2350 return (ENOMEM); 2351 } 2352 2353 /* Add room for tcp+ip headers */ 2354 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2355 2356 /* 2357 * DLPI is up. 2358 * Create all the IREs associated with an interface bring up multicast. 2359 * Set the interface flag and finish other initialization 2360 * that potentially had to be differed to after DL_BIND_ACK. 2361 */ 2362 int 2363 ipif_up_done_v6(ipif_t *ipif) 2364 { 2365 ill_t *ill = ipif->ipif_ill; 2366 int err; 2367 boolean_t loopback = B_FALSE; 2368 2369 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2370 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2371 DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done_v6", 2372 ill_t *, ill, ipif_t *, ipif); 2373 2374 /* Check if this is a loopback interface */ 2375 if (ipif->ipif_ill->ill_wq == NULL) 2376 loopback = B_TRUE; 2377 2378 ASSERT(ipif->ipif_isv6); 2379 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2380 2381 if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) { 2382 nce_t *loop_nce = NULL; 2383 uint16_t flags = (NCE_F_MYADDR | NCE_F_NONUD | NCE_F_AUTHORITY); 2384 2385 /* 2386 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 2387 * ipif_lookup_on_name(), but in the case of zones we can have 2388 * several loopback addresses on lo0. So all the interfaces with 2389 * loopback addresses need to be marked IRE_LOOPBACK. 2390 */ 2391 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 2392 ipif->ipif_ire_type = IRE_LOOPBACK; 2393 else 2394 ipif->ipif_ire_type = IRE_LOCAL; 2395 if (ill->ill_net_type != IRE_LOOPBACK) 2396 flags |= NCE_F_PUBLISH; 2397 err = nce_lookup_then_add_v6(ill, NULL, 2398 ill->ill_phys_addr_length, 2399 &ipif->ipif_v6lcl_addr, flags, ND_REACHABLE, &loop_nce); 2400 2401 /* A shared-IP zone sees EEXIST for lo0:N */ 2402 if (err == 0 || err == EEXIST) { 2403 ipif->ipif_added_nce = 1; 2404 loop_nce->nce_ipif_cnt++; 2405 nce_refrele(loop_nce); 2406 err = 0; 2407 } else { 2408 ASSERT(loop_nce == NULL); 2409 return (err); 2410 } 2411 } 2412 2413 err = ipif_add_ires_v6(ipif, loopback); 2414 if (err != 0) { 2415 /* 2416 * See comments about return value from 2417 * ipif_addr_availability_check() in ipif_add_ires_v6(). 2418 */ 2419 if (err != EADDRINUSE) { 2420 ipif_ndp_down(ipif); 2421 } else { 2422 /* 2423 * Make IPMP aware of the deleted ipif so that 2424 * the needed ipmp cleanup (e.g., of ipif_bound_ill) 2425 * can be completed. Note that we do not want to 2426 * destroy the nce that was created on the ipmp_ill 2427 * for the active copy of the duplicate address in 2428 * use. 2429 */ 2430 if (IS_IPMP(ill)) 2431 ipmp_illgrp_del_ipif(ill->ill_grp, ipif); 2432 err = EADDRNOTAVAIL; 2433 } 2434 return (err); 2435 } 2436 2437 if (ill->ill_ipif_up_count == 1 && !loopback) { 2438 /* Recover any additional IREs entries for this ill */ 2439 (void) ill_recover_saved_ire(ill); 2440 } 2441 2442 if (ill->ill_need_recover_multicast) { 2443 /* 2444 * Need to recover all multicast memberships in the driver. 2445 * This had to be deferred until we had attached. 2446 */ 2447 ill_recover_multicast(ill); 2448 } 2449 2450 if (ill->ill_ipif_up_count == 1) { 2451 /* 2452 * Since the interface is now up, it may now be active. 2453 */ 2454 if (IS_UNDER_IPMP(ill)) 2455 ipmp_ill_refresh_active(ill); 2456 } 2457 2458 /* Join the allhosts multicast address and the solicited node MC */ 2459 ipif_multicast_up(ipif); 2460 2461 /* Perhaps ilgs should use this ill */ 2462 update_conn_ill(NULL, ill->ill_ipst); 2463 2464 if (ipif->ipif_addr_ready) 2465 ipif_up_notify(ipif); 2466 2467 return (0); 2468 } 2469 2470 /* 2471 * Add the IREs associated with the ipif. 2472 * Those MUST be explicitly removed in ipif_delete_ires_v6. 2473 */ 2474 static int 2475 ipif_add_ires_v6(ipif_t *ipif, boolean_t loopback) 2476 { 2477 ill_t *ill = ipif->ipif_ill; 2478 ip_stack_t *ipst = ill->ill_ipst; 2479 ire_t *ire_array[20]; 2480 ire_t **irep = ire_array; 2481 ire_t **irep1; 2482 in6_addr_t v6addr; 2483 in6_addr_t route_mask; 2484 int err; 2485 char buf[INET6_ADDRSTRLEN]; 2486 ire_t *ire_local = NULL; /* LOCAL or LOOPBACK */ 2487 2488 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 2489 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 2490 2491 /* 2492 * If we're on a labeled system then make sure that zone- 2493 * private addresses have proper remote host database entries. 2494 */ 2495 if (is_system_labeled() && 2496 ipif->ipif_ire_type != IRE_LOOPBACK) { 2497 if (ip6opt_ls == 0) { 2498 cmn_err(CE_WARN, "IPv6 not enabled " 2499 "via /etc/system"); 2500 return (EINVAL); 2501 } 2502 if (!tsol_check_interface_address(ipif)) 2503 return (EINVAL); 2504 } 2505 2506 /* Register the source address for __sin6_src_id */ 2507 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 2508 ipif->ipif_zoneid, ipst); 2509 if (err != 0) { 2510 ip0dbg(("ipif_add_ires_v6: srcid_insert %d\n", err)); 2511 return (err); 2512 } 2513 /* 2514 * If the interface address is set, create the LOCAL 2515 * or LOOPBACK IRE. 2516 */ 2517 ip1dbg(("ipif_add_ires_v6: creating IRE %d for %s\n", 2518 ipif->ipif_ire_type, 2519 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 2520 buf, sizeof (buf)))); 2521 2522 ire_local = ire_create_v6( 2523 &ipif->ipif_v6lcl_addr, /* dest address */ 2524 &ipv6_all_ones, /* mask */ 2525 NULL, /* no gateway */ 2526 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 2527 ipif->ipif_ill, /* interface */ 2528 ipif->ipif_zoneid, 2529 ((ipif->ipif_flags & IPIF_PRIVATE) ? 2530 RTF_PRIVATE : 0) | RTF_KERNEL, 2531 NULL, 2532 ipst); 2533 if (ire_local == NULL) { 2534 ip1dbg(("ipif_up_done_v6: NULL ire_local\n")); 2535 err = ENOMEM; 2536 goto bad; 2537 } 2538 } 2539 2540 /* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */ 2541 if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) && 2542 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2543 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2544 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2545 v6addr = ipif->ipif_v6subnet; 2546 2547 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2548 route_mask = ipv6_all_ones; 2549 } else { 2550 route_mask = ipif->ipif_v6net_mask; 2551 } 2552 2553 ip1dbg(("ipif_add_ires_v6: creating if IRE %d for %s\n", 2554 ill->ill_net_type, 2555 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 2556 2557 *irep++ = ire_create_v6( 2558 &v6addr, /* dest pref */ 2559 &route_mask, /* mask */ 2560 &ipif->ipif_v6lcl_addr, /* gateway */ 2561 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2562 ipif->ipif_ill, 2563 ipif->ipif_zoneid, 2564 ((ipif->ipif_flags & IPIF_PRIVATE) ? 2565 RTF_PRIVATE : 0) | RTF_KERNEL, 2566 NULL, 2567 ipst); 2568 } 2569 2570 /* If an earlier ire_create failed, get out now */ 2571 for (irep1 = irep; irep1 > ire_array; ) { 2572 irep1--; 2573 if (*irep1 == NULL) { 2574 ip1dbg(("ipif_add_ires_v6: NULL ire found in" 2575 " ire_array\n")); 2576 err = ENOMEM; 2577 goto bad; 2578 } 2579 } 2580 2581 /* 2582 * Need to atomically check for IP address availability under 2583 * ip_addr_avail_lock. ill_g_lock is held as reader to ensure no new 2584 * ills or new ipifs can be added while we are checking availability. 2585 */ 2586 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2587 mutex_enter(&ipst->ips_ip_addr_avail_lock); 2588 ill->ill_ipif_up_count++; 2589 ipif->ipif_flags |= IPIF_UP; 2590 err = ip_addr_availability_check(ipif); 2591 mutex_exit(&ipst->ips_ip_addr_avail_lock); 2592 rw_exit(&ipst->ips_ill_g_lock); 2593 2594 if (err != 0) { 2595 /* 2596 * Our address may already be up on the same ill. In this case, 2597 * the external resolver entry for our ipif replaced the one for 2598 * the other ipif. So we don't want to delete it (otherwise the 2599 * other ipif would be unable to send packets). 2600 * ip_addr_availability_check() identifies this case for us and 2601 * returns EADDRINUSE; Caller must turn it into EADDRNOTAVAIL 2602 * which is the expected error code. 2603 * 2604 * Note that ipif_ndp_down() will only delete the nce in the 2605 * case when the nce_ipif_cnt drops to 0. 2606 */ 2607 ill->ill_ipif_up_count--; 2608 ipif->ipif_flags &= ~IPIF_UP; 2609 goto bad; 2610 } 2611 2612 /* 2613 * Add in all newly created IREs. 2614 */ 2615 if (ire_local != NULL) { 2616 ire_local = ire_add(ire_local); 2617 #ifdef DEBUG 2618 if (ire_local != NULL) { 2619 ire_refhold_notr(ire_local); 2620 ire_refrele(ire_local); 2621 } 2622 #endif 2623 } 2624 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER); 2625 if (ire_local != NULL) 2626 ipif->ipif_ire_local = ire_local; 2627 rw_exit(&ipst->ips_ill_g_lock); 2628 ire_local = NULL; 2629 2630 for (irep1 = irep; irep1 > ire_array; ) { 2631 irep1--; 2632 /* Shouldn't be adding any bcast ire's */ 2633 ASSERT((*irep1)->ire_type != IRE_BROADCAST); 2634 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2635 /* refheld by ire_add */ 2636 *irep1 = ire_add(*irep1); 2637 if (*irep1 != NULL) { 2638 ire_refrele(*irep1); 2639 *irep1 = NULL; 2640 } 2641 } 2642 2643 if (ipif->ipif_addr_ready) 2644 ipif_up_notify(ipif); 2645 return (0); 2646 2647 bad: 2648 if (ire_local != NULL) 2649 ire_delete(ire_local); 2650 while (irep > ire_array) { 2651 irep--; 2652 if (*irep != NULL) 2653 ire_delete(*irep); 2654 } 2655 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst); 2656 2657 return (err); 2658 } 2659 2660 /* Remove all the IREs created by ipif_add_ires_v6 */ 2661 void 2662 ipif_delete_ires_v6(ipif_t *ipif) 2663 { 2664 ill_t *ill = ipif->ipif_ill; 2665 ip_stack_t *ipst = ill->ill_ipst; 2666 in6_addr_t v6addr; 2667 in6_addr_t route_mask; 2668 ire_t *ire; 2669 int match_args; 2670 boolean_t loopback; 2671 2672 /* Check if this is a loopback interface */ 2673 loopback = (ipif->ipif_ill->ill_wq == NULL); 2674 2675 match_args = MATCH_IRE_TYPE | MATCH_IRE_ILL | MATCH_IRE_MASK | 2676 MATCH_IRE_ZONEONLY; 2677 2678 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER); 2679 if ((ire = ipif->ipif_ire_local) != NULL) { 2680 ipif->ipif_ire_local = NULL; 2681 rw_exit(&ipst->ips_ill_g_lock); 2682 /* 2683 * Move count to ipif so we don't loose the count due to 2684 * a down/up dance. 2685 */ 2686 atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count); 2687 2688 ire_delete(ire); 2689 ire_refrele_notr(ire); 2690 } else { 2691 rw_exit(&ipst->ips_ill_g_lock); 2692 } 2693 2694 match_args |= MATCH_IRE_GW; 2695 2696 /* 2697 * Delete the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. 2698 * Note that atun interfaces have an all-zero ipif_v6subnet. 2699 * Thus we allow a zero subnet as long as the mask is non-zero. 2700 */ 2701 if (IS_UNDER_IPMP(ill)) 2702 match_args |= MATCH_IRE_TESTHIDDEN; 2703 2704 if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) && 2705 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2706 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2707 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2708 v6addr = ipif->ipif_v6subnet; 2709 2710 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2711 route_mask = ipv6_all_ones; 2712 } else { 2713 route_mask = ipif->ipif_v6net_mask; 2714 } 2715 2716 ire = ire_ftable_lookup_v6( 2717 &v6addr, /* dest pref */ 2718 &route_mask, /* mask */ 2719 &ipif->ipif_v6lcl_addr, /* gateway */ 2720 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2721 ipif->ipif_ill, 2722 ipif->ipif_zoneid, 2723 NULL, 2724 match_args, 2725 0, 2726 ipst, 2727 NULL); 2728 ASSERT(ire != NULL); 2729 ire_delete(ire); 2730 ire_refrele(ire); 2731 } 2732 } 2733 2734 /* 2735 * Delete an ND entry if it exists. 2736 */ 2737 /* ARGSUSED */ 2738 int 2739 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2740 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2741 { 2742 sin6_t *sin6; 2743 struct lifreq *lifr; 2744 lif_nd_req_t *lnr; 2745 ill_t *ill = ipif->ipif_ill; 2746 nce_t *nce; 2747 2748 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2749 lnr = &lifr->lifr_nd; 2750 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2751 if (ipif->ipif_id != 0) 2752 return (EINVAL); 2753 2754 if (!ipif->ipif_isv6) 2755 return (EINVAL); 2756 2757 if (lnr->lnr_addr.ss_family != AF_INET6) 2758 return (EAFNOSUPPORT); 2759 2760 sin6 = (sin6_t *)&lnr->lnr_addr; 2761 2762 /* 2763 * Since ND mappings must be consistent across an IPMP group, prohibit 2764 * deleting ND mappings on underlying interfaces. 2765 * Don't allow deletion of mappings for local addresses. 2766 */ 2767 if (IS_UNDER_IPMP(ill)) 2768 return (EPERM); 2769 2770 nce = nce_lookup_v6(ill, &sin6->sin6_addr); 2771 if (nce == NULL) 2772 return (ESRCH); 2773 2774 if (NCE_MYADDR(nce->nce_common)) { 2775 nce_refrele(nce); 2776 return (EPERM); 2777 } 2778 2779 /* 2780 * delete the nce_common which will also delete the nces on any 2781 * under_ill in the case of ipmp. 2782 */ 2783 ncec_delete(nce->nce_common); 2784 nce_refrele(nce); 2785 return (0); 2786 } 2787 2788 /* 2789 * Return nbr cache info. 2790 */ 2791 /* ARGSUSED */ 2792 int 2793 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2794 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2795 { 2796 ill_t *ill = ipif->ipif_ill; 2797 struct lifreq *lifr; 2798 lif_nd_req_t *lnr; 2799 2800 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2801 lnr = &lifr->lifr_nd; 2802 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2803 if (ipif->ipif_id != 0) 2804 return (EINVAL); 2805 2806 if (!ipif->ipif_isv6) 2807 return (EINVAL); 2808 2809 if (lnr->lnr_addr.ss_family != AF_INET6) 2810 return (EAFNOSUPPORT); 2811 2812 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 2813 return (EINVAL); 2814 2815 return (ndp_query(ill, lnr)); 2816 } 2817 2818 /* 2819 * Perform an update of the nd entry for the specified address. 2820 */ 2821 /* ARGSUSED */ 2822 int 2823 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2824 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2825 { 2826 sin6_t *sin6; 2827 ill_t *ill = ipif->ipif_ill; 2828 struct lifreq *lifr; 2829 lif_nd_req_t *lnr; 2830 ire_t *ire; 2831 2832 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2833 lnr = &lifr->lifr_nd; 2834 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2835 if (ipif->ipif_id != 0) 2836 return (EINVAL); 2837 2838 if (!ipif->ipif_isv6) 2839 return (EINVAL); 2840 2841 if (lnr->lnr_addr.ss_family != AF_INET6) 2842 return (EAFNOSUPPORT); 2843 2844 sin6 = (sin6_t *)&lnr->lnr_addr; 2845 2846 /* 2847 * Since ND mappings must be consistent across an IPMP group, prohibit 2848 * updating ND mappings on underlying interfaces. Also, since ND 2849 * mappings for IPMP data addresses are owned by IP itself, prohibit 2850 * updating them. 2851 */ 2852 if (IS_UNDER_IPMP(ill)) 2853 return (EPERM); 2854 2855 if (IS_IPMP(ill)) { 2856 ire = ire_ftable_lookup_v6(&sin6->sin6_addr, NULL, NULL, 2857 IRE_LOCAL, ill, ALL_ZONES, NULL, 2858 MATCH_IRE_TYPE | MATCH_IRE_ILL, 0, ill->ill_ipst, NULL); 2859 if (ire != NULL) { 2860 ire_refrele(ire); 2861 return (EPERM); 2862 } 2863 } 2864 2865 return (ndp_sioc_update(ill, lnr)); 2866 } 2867