1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 1990 Mentat Inc. 27 */ 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 /* 32 * This file contains the interface control functions for IPv6. 33 */ 34 35 #include <sys/types.h> 36 #include <sys/sysmacros.h> 37 #include <sys/stream.h> 38 #include <sys/dlpi.h> 39 #include <sys/stropts.h> 40 #include <sys/ddi.h> 41 #include <sys/cmn_err.h> 42 #include <sys/kstat.h> 43 #include <sys/debug.h> 44 #include <sys/zone.h> 45 46 #include <sys/systm.h> 47 #include <sys/param.h> 48 #include <sys/socket.h> 49 #include <sys/isa_defs.h> 50 #include <net/if.h> 51 #include <net/if_dl.h> 52 #include <net/route.h> 53 #include <netinet/in.h> 54 #include <netinet/igmp_var.h> 55 #include <netinet/ip6.h> 56 #include <netinet/icmp6.h> 57 #include <netinet/in.h> 58 59 #include <inet/common.h> 60 #include <inet/nd.h> 61 #include <inet/mib2.h> 62 #include <inet/ip.h> 63 #include <inet/ip6.h> 64 #include <inet/ip_multi.h> 65 #include <inet/ip_ire.h> 66 #include <inet/ip_rts.h> 67 #include <inet/ip_ndp.h> 68 #include <inet/ip_if.h> 69 #include <inet/ip6_asp.h> 70 #include <inet/tun.h> 71 #include <inet/ipclassifier.h> 72 #include <inet/sctp_ip.h> 73 74 #include <sys/tsol/tndb.h> 75 #include <sys/tsol/tnet.h> 76 77 static in6_addr_t ipv6_ll_template = 78 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 79 80 static ipif_t * 81 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 82 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error); 83 84 /* 85 * ipif_lookup_group_v6 86 */ 87 ipif_t * 88 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid) 89 { 90 ire_t *ire; 91 ipif_t *ipif; 92 93 ire = ire_lookup_multi_v6(group, zoneid); 94 if (ire == NULL) 95 return (NULL); 96 ipif = ire->ire_ipif; 97 ipif_refhold(ipif); 98 ire_refrele(ire); 99 return (ipif); 100 } 101 102 /* 103 * ill_lookup_group_v6 104 */ 105 ill_t * 106 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid) 107 { 108 ire_t *ire; 109 ill_t *ill; 110 111 ire = ire_lookup_multi_v6(group, zoneid); 112 if (ire == NULL) 113 return (NULL); 114 ill = ire->ire_ipif->ipif_ill; 115 ill_refhold(ill); 116 ire_refrele(ire); 117 return (ill); 118 } 119 120 /* 121 * Look for an ipif with the specified interface address and destination. 122 * The destination address is used only for matching point-to-point interfaces. 123 */ 124 static ipif_t * 125 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 126 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error) 127 { 128 ipif_t *ipif; 129 ill_t *ill; 130 ipsq_t *ipsq; 131 ill_walk_context_t ctx; 132 133 if (error != NULL) 134 *error = 0; 135 136 /* 137 * First match all the point-to-point interfaces 138 * before looking at non-point-to-point interfaces. 139 * This is done to avoid returning non-point-to-point 140 * ipif instead of unnumbered point-to-point ipif. 141 */ 142 rw_enter(&ill_g_lock, RW_READER); 143 ill = ILL_START_WALK_V6(&ctx); 144 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 145 GRAB_CONN_LOCK(q); 146 mutex_enter(&ill->ill_lock); 147 for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) { 148 /* Allow the ipif to be down */ 149 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 150 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 151 if_addr)) && 152 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 153 dst))) { 154 if (IPIF_CAN_LOOKUP(ipif)) { 155 ipif_refhold_locked(ipif); 156 mutex_exit(&ill->ill_lock); 157 RELEASE_CONN_LOCK(q); 158 rw_exit(&ill_g_lock); 159 return (ipif); 160 } else if (IPIF_CAN_WAIT(ipif, q)) { 161 ipsq = ill->ill_phyint->phyint_ipsq; 162 mutex_enter(&ipsq->ipsq_lock); 163 mutex_exit(&ill->ill_lock); 164 rw_exit(&ill_g_lock); 165 ipsq_enq(ipsq, q, mp, func, NEW_OP, 166 ill); 167 mutex_exit(&ipsq->ipsq_lock); 168 RELEASE_CONN_LOCK(q); 169 *error = EINPROGRESS; 170 return (NULL); 171 } 172 } 173 } 174 mutex_exit(&ill->ill_lock); 175 RELEASE_CONN_LOCK(q); 176 } 177 rw_exit(&ill_g_lock); 178 /* lookup the ipif based on interface address */ 179 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func, 180 error); 181 ASSERT(ipif == NULL || ipif->ipif_isv6); 182 return (ipif); 183 } 184 185 /* 186 * Look for an ipif with the specified address. For point-point links 187 * we look for matches on either the destination address and the local 188 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 189 * is set. 190 * Matches on a specific ill if match_ill is set. 191 */ 192 /* ARGSUSED */ 193 ipif_t * 194 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 195 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error) 196 { 197 ipif_t *ipif; 198 ill_t *ill; 199 boolean_t ptp = B_FALSE; 200 ipsq_t *ipsq; 201 ill_walk_context_t ctx; 202 203 if (error != NULL) 204 *error = 0; 205 206 rw_enter(&ill_g_lock, RW_READER); 207 /* 208 * Repeat twice, first based on local addresses and 209 * next time for pointopoint. 210 */ 211 repeat: 212 ill = ILL_START_WALK_V6(&ctx); 213 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 214 if (match_ill != NULL && ill != match_ill) { 215 continue; 216 } 217 GRAB_CONN_LOCK(q); 218 mutex_enter(&ill->ill_lock); 219 for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) { 220 if (zoneid != ALL_ZONES && 221 ipif->ipif_zoneid != zoneid && 222 ipif->ipif_zoneid != ALL_ZONES) 223 continue; 224 /* Allow the ipif to be down */ 225 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 226 &ipif->ipif_v6lcl_addr, addr) && 227 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 228 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 229 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 230 addr))) { 231 if (IPIF_CAN_LOOKUP(ipif)) { 232 ipif_refhold_locked(ipif); 233 mutex_exit(&ill->ill_lock); 234 RELEASE_CONN_LOCK(q); 235 rw_exit(&ill_g_lock); 236 return (ipif); 237 } else if (IPIF_CAN_WAIT(ipif, q)) { 238 ipsq = ill->ill_phyint->phyint_ipsq; 239 mutex_enter(&ipsq->ipsq_lock); 240 mutex_exit(&ill->ill_lock); 241 rw_exit(&ill_g_lock); 242 ipsq_enq(ipsq, q, mp, func, NEW_OP, 243 ill); 244 mutex_exit(&ipsq->ipsq_lock); 245 RELEASE_CONN_LOCK(q); 246 *error = EINPROGRESS; 247 return (NULL); 248 } 249 } 250 } 251 mutex_exit(&ill->ill_lock); 252 RELEASE_CONN_LOCK(q); 253 } 254 255 /* Repeat once more if needed */ 256 if (ptp) { 257 rw_exit(&ill_g_lock); 258 if (error != NULL) 259 *error = ENXIO; 260 return (NULL); 261 } 262 ptp = B_TRUE; 263 goto repeat; 264 } 265 266 /* 267 * Perform various checks to verify that an address would make sense as a local 268 * interface address. This is currently only called when an attempt is made 269 * to set a local address. 270 * 271 * Does not allow a v4-mapped address, an address that equals the subnet 272 * anycast address, ... a multicast address, ... 273 */ 274 boolean_t 275 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 276 { 277 in6_addr_t subnet; 278 279 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 280 return (B_TRUE); /* Allow all zeros */ 281 282 /* 283 * Don't allow all zeroes or host part, but allow 284 * all ones netmask. 285 */ 286 V6_MASK_COPY(*addr, *subnet_mask, subnet); 287 if (IN6_IS_ADDR_V4MAPPED(addr) || 288 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 289 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 290 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 291 IN6_IS_ADDR_MULTICAST(addr)) 292 return (B_FALSE); 293 294 return (B_TRUE); 295 } 296 297 /* 298 * Perform various checks to verify that an address would make sense as a 299 * remote/subnet interface address. 300 */ 301 boolean_t 302 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 303 { 304 in6_addr_t subnet; 305 306 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 307 return (B_TRUE); /* Allow all zeros */ 308 309 V6_MASK_COPY(*addr, *subnet_mask, subnet); 310 if (IN6_IS_ADDR_V4MAPPED(addr) || 311 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 312 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 313 IN6_IS_ADDR_MULTICAST(addr) || 314 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 315 return (B_FALSE); 316 317 return (B_TRUE); 318 } 319 320 /* 321 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 322 * ipif_arg is passed in to associate it with the correct interface 323 * (for link-local destinations and gateways). 324 */ 325 /* ARGSUSED1 */ 326 int 327 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 328 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 329 ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func, 330 struct rtsa_s *sp) 331 { 332 ire_t *ire; 333 ire_t *gw_ire = NULL; 334 ipif_t *ipif; 335 boolean_t ipif_refheld = B_FALSE; 336 uint_t type; 337 int match_flags = MATCH_IRE_TYPE; 338 int error; 339 tsol_gc_t *gc = NULL; 340 tsol_gcgrp_t *gcgrp = NULL; 341 boolean_t gcgrp_xtraref = B_FALSE; 342 343 if (ire_arg != NULL) 344 *ire_arg = NULL; 345 346 /* 347 * Prevent routes with a zero gateway from being created (since 348 * interfaces can currently be plumbed and brought up with no assigned 349 * address). 350 */ 351 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 352 return (ENETUNREACH); 353 354 /* 355 * If this is the case of RTF_HOST being set, then we set the netmask 356 * to all ones (regardless if one was supplied). 357 */ 358 if (flags & RTF_HOST) 359 mask = &ipv6_all_ones; 360 361 /* 362 * Get the ipif, if any, corresponding to the gw_addr 363 */ 364 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, 365 &error); 366 if (ipif != NULL) 367 ipif_refheld = B_TRUE; 368 else if (error == EINPROGRESS) { 369 ip1dbg(("ip_rt_add_v6: null and EINPROGRESS")); 370 return (error); 371 } 372 373 /* 374 * GateD will attempt to create routes with a loopback interface 375 * address as the gateway and with RTF_GATEWAY set. We allow 376 * these routes to be added, but create them as interface routes 377 * since the gateway is an interface address. 378 */ 379 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) { 380 flags &= ~RTF_GATEWAY; 381 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) && 382 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) && 383 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) { 384 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 385 ipif, ALL_ZONES, NULL, match_flags); 386 if (ire != NULL) { 387 ire_refrele(ire); 388 if (ipif_refheld) 389 ipif_refrele(ipif); 390 return (EEXIST); 391 } 392 ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x" 393 "for 0x%x\n", (void *)ipif, 394 ipif->ipif_ire_type, 395 ntohl(ipif->ipif_lcl_addr))); 396 ire = ire_create_v6( 397 dst_addr, 398 mask, 399 &ipif->ipif_v6src_addr, 400 NULL, 401 &ipif->ipif_mtu, 402 NULL, 403 NULL, 404 NULL, 405 ipif->ipif_net_type, 406 ipif->ipif_resolver_mp, 407 ipif, 408 NULL, 409 0, 410 0, 411 flags, 412 &ire_uinfo_null, 413 NULL, 414 NULL); 415 if (ire == NULL) { 416 if (ipif_refheld) 417 ipif_refrele(ipif); 418 return (ENOMEM); 419 } 420 error = ire_add(&ire, q, mp, func, B_FALSE); 421 if (error == 0) 422 goto save_ire; 423 /* 424 * In the result of failure, ire_add() will have already 425 * deleted the ire in question, so there is no need to 426 * do that here. 427 */ 428 if (ipif_refheld) 429 ipif_refrele(ipif); 430 return (error); 431 } 432 } 433 434 /* 435 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 436 * and the gateway address provided is one of the system's interface 437 * addresses. By using the routing socket interface and supplying an 438 * RTA_IFP sockaddr with an interface index, an alternate method of 439 * specifying an interface route to be created is available which uses 440 * the interface index that specifies the outgoing interface rather than 441 * the address of an outgoing interface (which may not be able to 442 * uniquely identify an interface). When coupled with the RTF_GATEWAY 443 * flag, routes can be specified which not only specify the next-hop to 444 * be used when routing to a certain prefix, but also which outgoing 445 * interface should be used. 446 * 447 * Previously, interfaces would have unique addresses assigned to them 448 * and so the address assigned to a particular interface could be used 449 * to identify a particular interface. One exception to this was the 450 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 451 * 452 * With the advent of IPv6 and its link-local addresses, this 453 * restriction was relaxed and interfaces could share addresses between 454 * themselves. In fact, typically all of the link-local interfaces on 455 * an IPv6 node or router will have the same link-local address. In 456 * order to differentiate between these interfaces, the use of an 457 * interface index is necessary and this index can be carried inside a 458 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 459 * of using the interface index, however, is that all of the ipif's that 460 * are part of an ill have the same index and so the RTA_IFP sockaddr 461 * cannot be used to differentiate between ipif's (or logical 462 * interfaces) that belong to the same ill (physical interface). 463 * 464 * For example, in the following case involving IPv4 interfaces and 465 * logical interfaces 466 * 467 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 468 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0:1 469 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0:2 470 * 471 * the ipif's corresponding to each of these interface routes can be 472 * uniquely identified by the "gateway" (actually interface address). 473 * 474 * In this case involving multiple IPv6 default routes to a particular 475 * link-local gateway, the use of RTA_IFP is necessary to specify which 476 * default route is of interest: 477 * 478 * default fe80::123:4567:89ab:cdef U if0 479 * default fe80::123:4567:89ab:cdef U if1 480 */ 481 482 /* RTF_GATEWAY not set */ 483 if (!(flags & RTF_GATEWAY)) { 484 queue_t *stq; 485 486 if (sp != NULL) { 487 ip2dbg(("ip_rt_add_v6: gateway security attributes " 488 "cannot be set with interface route\n")); 489 if (ipif_refheld) 490 ipif_refrele(ipif); 491 return (EINVAL); 492 } 493 494 /* 495 * As the interface index specified with the RTA_IFP sockaddr is 496 * the same for all ipif's off of an ill, the matching logic 497 * below uses MATCH_IRE_ILL if such an index was specified. 498 * This means that routes sharing the same prefix when added 499 * using a RTA_IFP sockaddr must have distinct interface 500 * indices (namely, they must be on distinct ill's). 501 * 502 * On the other hand, since the gateway address will usually be 503 * different for each ipif on the system, the matching logic 504 * uses MATCH_IRE_IPIF in the case of a traditional interface 505 * route. This means that interface routes for the same prefix 506 * can be created if they belong to distinct ipif's and if a 507 * RTA_IFP sockaddr is not present. 508 */ 509 if (ipif_arg != NULL) { 510 if (ipif_refheld) { 511 ipif_refrele(ipif); 512 ipif_refheld = B_FALSE; 513 } 514 ipif = ipif_arg; 515 match_flags |= MATCH_IRE_ILL; 516 } else { 517 /* 518 * Check the ipif corresponding to the gw_addr 519 */ 520 if (ipif == NULL) 521 return (ENETUNREACH); 522 match_flags |= MATCH_IRE_IPIF; 523 } 524 525 ASSERT(ipif != NULL); 526 /* 527 * We check for an existing entry at this point. 528 */ 529 match_flags |= MATCH_IRE_MASK; 530 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE, 531 ipif, NULL, ALL_ZONES, 0, NULL, match_flags); 532 if (ire != NULL) { 533 ire_refrele(ire); 534 if (ipif_refheld) 535 ipif_refrele(ipif); 536 return (EEXIST); 537 } 538 539 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 540 ? ipif->ipif_rq : ipif->ipif_wq; 541 542 /* 543 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or 544 * IRE_IF_RESOLVER with the modified address and netmask. 545 */ 546 ire = ire_create_v6( 547 dst_addr, 548 mask, 549 &ipif->ipif_v6src_addr, 550 NULL, 551 &ipif->ipif_mtu, 552 NULL, 553 NULL, 554 stq, 555 ipif->ipif_net_type, 556 ipif->ipif_resolver_mp, 557 ipif, 558 NULL, 559 0, 560 0, 561 flags, 562 &ire_uinfo_null, 563 NULL, 564 NULL); 565 if (ire == NULL) { 566 if (ipif_refheld) 567 ipif_refrele(ipif); 568 return (ENOMEM); 569 } 570 571 /* 572 * Some software (for example, GateD and Sun Cluster) attempts 573 * to create (what amount to) IRE_PREFIX routes with the 574 * loopback address as the gateway. This is primarily done to 575 * set up prefixes with the RTF_REJECT flag set (for example, 576 * when generating aggregate routes.) 577 * 578 * If the IRE type (as defined by ipif->ipif_net_type) is 579 * IRE_LOOPBACK, then we map the request into a 580 * IRE_IF_NORESOLVER. 581 * 582 * Needless to say, the real IRE_LOOPBACK is NOT created by this 583 * routine, but rather using ire_create_v6() directly. 584 */ 585 if (ipif->ipif_net_type == IRE_LOOPBACK) 586 ire->ire_type = IRE_IF_NORESOLVER; 587 error = ire_add(&ire, q, mp, func, B_FALSE); 588 if (error == 0) 589 goto save_ire; 590 /* 591 * In the result of failure, ire_add() will have already 592 * deleted the ire in question, so there is no need to 593 * do that here. 594 */ 595 if (ipif_refheld) 596 ipif_refrele(ipif); 597 return (error); 598 } 599 if (ipif_refheld) { 600 ipif_refrele(ipif); 601 ipif_refheld = B_FALSE; 602 } 603 604 /* 605 * Get an interface IRE for the specified gateway. 606 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 607 * gateway, it is currently unreachable and we fail the request 608 * accordingly. 609 */ 610 ipif = ipif_arg; 611 if (ipif_arg != NULL) 612 match_flags |= MATCH_IRE_ILL; 613 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, 614 NULL, ALL_ZONES, 0, NULL, match_flags); 615 if (gw_ire == NULL) 616 return (ENETUNREACH); 617 618 /* 619 * We create one of three types of IREs as a result of this request 620 * based on the netmask. A netmask of all ones (which is automatically 621 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 622 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 623 * created. Otherwise, an IRE_PREFIX route is created for the 624 * destination prefix. 625 */ 626 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 627 type = IRE_HOST; 628 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 629 type = IRE_DEFAULT; 630 else 631 type = IRE_PREFIX; 632 633 /* check for a duplicate entry */ 634 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg, 635 NULL, ALL_ZONES, 0, NULL, 636 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW); 637 if (ire != NULL) { 638 ire_refrele(gw_ire); 639 ire_refrele(ire); 640 return (EEXIST); 641 } 642 643 /* Security attribute exists */ 644 if (sp != NULL) { 645 tsol_gcgrp_addr_t ga; 646 647 /* find or create the gateway credentials group */ 648 ga.ga_af = AF_INET6; 649 ga.ga_addr = *gw_addr; 650 651 /* we hold reference to it upon success */ 652 gcgrp = gcgrp_lookup(&ga, B_TRUE); 653 if (gcgrp == NULL) { 654 ire_refrele(gw_ire); 655 return (ENOMEM); 656 } 657 658 /* 659 * Create and add the security attribute to the group; a 660 * reference to the group is made upon allocating a new 661 * entry successfully. If it finds an already-existing 662 * entry for the security attribute in the group, it simply 663 * returns it and no new reference is made to the group. 664 */ 665 gc = gc_create(sp, gcgrp, &gcgrp_xtraref); 666 if (gc == NULL) { 667 /* release reference held by gcgrp_lookup */ 668 GCGRP_REFRELE(gcgrp); 669 ire_refrele(gw_ire); 670 return (ENOMEM); 671 } 672 } 673 674 /* Create the IRE. */ 675 ire = ire_create_v6( 676 dst_addr, /* dest address */ 677 mask, /* mask */ 678 /* src address assigned by the caller? */ 679 (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ? 680 src_addr : NULL), 681 gw_addr, /* gateway address */ 682 &gw_ire->ire_max_frag, 683 NULL, /* no Fast Path header */ 684 NULL, /* no recv-from queue */ 685 NULL, /* no send-to queue */ 686 (ushort_t)type, /* IRE type */ 687 NULL, 688 ipif_arg, 689 NULL, 690 0, 691 0, 692 flags, 693 &gw_ire->ire_uinfo, /* Inherit ULP info from gw */ 694 gc, /* security attribute */ 695 NULL); 696 /* 697 * The ire holds a reference to the 'gc' and the 'gc' holds a 698 * reference to the 'gcgrp'. We can now release the extra reference 699 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used. 700 */ 701 if (gcgrp_xtraref) 702 GCGRP_REFRELE(gcgrp); 703 if (ire == NULL) { 704 if (gc != NULL) 705 GC_REFRELE(gc); 706 ire_refrele(gw_ire); 707 return (ENOMEM); 708 } 709 710 /* 711 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 712 * SUN/OS socket stuff does but do we really want to allow ::0 ? 713 */ 714 715 /* Add the new IRE. */ 716 error = ire_add(&ire, q, mp, func, B_FALSE); 717 /* 718 * In the result of failure, ire_add() will have already 719 * deleted the ire in question, so there is no need to 720 * do that here. 721 */ 722 if (error != 0) { 723 ire_refrele(gw_ire); 724 return (error); 725 } 726 727 if (flags & RTF_MULTIRT) { 728 /* 729 * Invoke the CGTP (multirouting) filtering module 730 * to add the dst address in the filtering database. 731 * Replicated inbound packets coming from that address 732 * will be filtered to discard the duplicates. 733 * It is not necessary to call the CGTP filter hook 734 * when the dst address is a multicast, because an 735 * IP source address cannot be a multicast. 736 */ 737 if ((ip_cgtp_filter_ops != NULL) && 738 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 739 int res = ip_cgtp_filter_ops->cfo_add_dest_v6( 740 &ire->ire_addr_v6, 741 &ire->ire_gateway_addr_v6, 742 &ire->ire_src_addr_v6, 743 &gw_ire->ire_src_addr_v6); 744 if (res != 0) { 745 ire_refrele(gw_ire); 746 ire_delete(ire); 747 return (res); 748 } 749 } 750 } 751 752 /* 753 * Now that the prefix IRE entry has been created, delete any 754 * existing gateway IRE cache entries as well as any IRE caches 755 * using the gateway, and force them to be created through 756 * ip_newroute_v6. 757 */ 758 if (gc != NULL) { 759 ASSERT(gcgrp != NULL); 760 ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES); 761 } 762 763 save_ire: 764 if (gw_ire != NULL) { 765 ire_refrele(gw_ire); 766 } 767 if (ipif != NULL) { 768 mblk_t *save_mp; 769 770 /* 771 * Save enough information so that we can recreate the IRE if 772 * the interface goes down and then up. The metrics associated 773 * with the route will be saved as well when rts_setmetrics() is 774 * called after the IRE has been created. In the case where 775 * memory cannot be allocated, none of this information will be 776 * saved. 777 */ 778 save_mp = allocb(sizeof (ifrt_t), BPRI_MED); 779 if (save_mp != NULL) { 780 ifrt_t *ifrt; 781 782 save_mp->b_wptr += sizeof (ifrt_t); 783 ifrt = (ifrt_t *)save_mp->b_rptr; 784 bzero(ifrt, sizeof (ifrt_t)); 785 ifrt->ifrt_type = ire->ire_type; 786 ifrt->ifrt_v6addr = ire->ire_addr_v6; 787 mutex_enter(&ire->ire_lock); 788 ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6; 789 ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6; 790 mutex_exit(&ire->ire_lock); 791 ifrt->ifrt_v6mask = ire->ire_mask_v6; 792 ifrt->ifrt_flags = ire->ire_flags; 793 ifrt->ifrt_max_frag = ire->ire_max_frag; 794 mutex_enter(&ipif->ipif_saved_ire_lock); 795 save_mp->b_cont = ipif->ipif_saved_ire_mp; 796 ipif->ipif_saved_ire_mp = save_mp; 797 ipif->ipif_saved_ire_cnt++; 798 mutex_exit(&ipif->ipif_saved_ire_lock); 799 } 800 } 801 if (ire_arg != NULL) { 802 /* 803 * Store the ire that was successfully added into where ire_arg 804 * points to so that callers don't have to look it up 805 * themselves (but they are responsible for ire_refrele()ing 806 * the ire when they are finished with it). 807 */ 808 *ire_arg = ire; 809 } else { 810 ire_refrele(ire); /* Held in ire_add */ 811 } 812 if (ipif_refheld) 813 ipif_refrele(ipif); 814 return (0); 815 } 816 817 /* 818 * ip_rt_delete_v6 is called to delete an IPv6 route. 819 * ipif_arg is passed in to associate it with the correct interface 820 * (for link-local destinations and gateways). 821 */ 822 /* ARGSUSED4 */ 823 int 824 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 825 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg, 826 queue_t *q, mblk_t *mp, ipsq_func_t func) 827 { 828 ire_t *ire = NULL; 829 ipif_t *ipif; 830 uint_t type; 831 uint_t match_flags = MATCH_IRE_TYPE; 832 int err = 0; 833 boolean_t ipif_refheld = B_FALSE; 834 835 /* 836 * If this is the case of RTF_HOST being set, then we set the netmask 837 * to all ones. Otherwise, we use the netmask if one was supplied. 838 */ 839 if (flags & RTF_HOST) { 840 mask = &ipv6_all_ones; 841 match_flags |= MATCH_IRE_MASK; 842 } else if (rtm_addrs & RTA_NETMASK) { 843 match_flags |= MATCH_IRE_MASK; 844 } 845 846 /* 847 * Note that RTF_GATEWAY is never set on a delete, therefore 848 * we check if the gateway address is one of our interfaces first, 849 * and fall back on RTF_GATEWAY routes. 850 * 851 * This makes it possible to delete an original 852 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 853 * 854 * As the interface index specified with the RTA_IFP sockaddr is the 855 * same for all ipif's off of an ill, the matching logic below uses 856 * MATCH_IRE_ILL if such an index was specified. This means a route 857 * sharing the same prefix and interface index as the the route 858 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr 859 * is specified in the request. 860 * 861 * On the other hand, since the gateway address will usually be 862 * different for each ipif on the system, the matching logic 863 * uses MATCH_IRE_IPIF in the case of a traditional interface 864 * route. This means that interface routes for the same prefix can be 865 * uniquely identified if they belong to distinct ipif's and if a 866 * RTA_IFP sockaddr is not present. 867 * 868 * For more detail on specifying routes by gateway address and by 869 * interface index, see the comments in ip_rt_add_v6(). 870 */ 871 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err); 872 if (ipif != NULL) { 873 ipif_refheld = B_TRUE; 874 if (ipif_arg != NULL) { 875 ipif_refrele(ipif); 876 ipif_refheld = B_FALSE; 877 ipif = ipif_arg; 878 match_flags |= MATCH_IRE_ILL; 879 } else { 880 match_flags |= MATCH_IRE_IPIF; 881 } 882 883 if (ipif->ipif_ire_type == IRE_LOOPBACK) 884 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 885 ipif, ALL_ZONES, NULL, match_flags); 886 if (ire == NULL) 887 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, 888 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL, 889 match_flags); 890 } else if (err == EINPROGRESS) { 891 return (err); 892 } else { 893 err = 0; 894 } 895 if (ire == NULL) { 896 /* 897 * At this point, the gateway address is not one of our own 898 * addresses or a matching interface route was not found. We 899 * set the IRE type to lookup based on whether 900 * this is a host route, a default route or just a prefix. 901 * 902 * If an ipif_arg was passed in, then the lookup is based on an 903 * interface index so MATCH_IRE_ILL is added to match_flags. 904 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is 905 * set as the route being looked up is not a traditional 906 * interface route. 907 */ 908 match_flags &= ~MATCH_IRE_IPIF; 909 match_flags |= MATCH_IRE_GW; 910 if (ipif_arg != NULL) 911 match_flags |= MATCH_IRE_ILL; 912 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 913 type = IRE_HOST; 914 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 915 type = IRE_DEFAULT; 916 else 917 type = IRE_PREFIX; 918 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 919 ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags); 920 if (ire == NULL && type == IRE_HOST) { 921 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, 922 IRE_HOST_REDIRECT, ipif_arg, NULL, ALL_ZONES, 0, 923 NULL, match_flags); 924 } 925 } 926 927 if (ipif_refheld) { 928 ipif_refrele(ipif); 929 ipif_refheld = B_FALSE; 930 } 931 if (ire == NULL) 932 return (ESRCH); 933 934 if (ire->ire_flags & RTF_MULTIRT) { 935 /* 936 * Invoke the CGTP (multirouting) filtering module 937 * to remove the dst address from the filtering database. 938 * Packets coming from that address will no longer be 939 * filtered to remove duplicates. 940 */ 941 if (ip_cgtp_filter_ops != NULL) { 942 err = ip_cgtp_filter_ops->cfo_del_dest_v6( 943 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 944 } 945 } 946 947 ipif = ire->ire_ipif; 948 if (ipif != NULL) { 949 mblk_t **mpp; 950 mblk_t *mp; 951 ifrt_t *ifrt; 952 in6_addr_t gw_addr_v6; 953 954 /* Remove from ipif_saved_ire_mp list if it is there */ 955 mutex_enter(&ire->ire_lock); 956 gw_addr_v6 = ire->ire_gateway_addr_v6; 957 mutex_exit(&ire->ire_lock); 958 mutex_enter(&ipif->ipif_saved_ire_lock); 959 for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL; 960 mpp = &(*mpp)->b_cont) { 961 /* 962 * On a given ipif, the triple of address, gateway and 963 * mask is unique for each saved IRE (in the case of 964 * ordinary interface routes, the gateway address is 965 * all-zeroes). 966 */ 967 mp = *mpp; 968 ifrt = (ifrt_t *)mp->b_rptr; 969 if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr, 970 &ire->ire_addr_v6) && 971 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr, 972 &gw_addr_v6) && 973 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask, 974 &ire->ire_mask_v6)) { 975 *mpp = mp->b_cont; 976 ipif->ipif_saved_ire_cnt--; 977 freeb(mp); 978 break; 979 } 980 } 981 mutex_exit(&ipif->ipif_saved_ire_lock); 982 } 983 ire_delete(ire); 984 ire_refrele(ire); 985 return (err); 986 } 987 988 /* 989 * Derive a token from the link layer address. 990 */ 991 boolean_t 992 ill_setdefaulttoken(ill_t *ill) 993 { 994 int i; 995 in6_addr_t v6addr, v6mask; 996 997 /* 998 * Though we execute on the ipsq, we need to hold the ill_lock 999 * to prevent readers from seeing partially updated values 1000 * while we do the update. 1001 */ 1002 mutex_enter(&ill->ill_lock); 1003 if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length, 1004 ill->ill_phys_addr, &v6addr)) { 1005 mutex_exit(&ill->ill_lock); 1006 return (B_FALSE); 1007 } 1008 1009 (void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask); 1010 1011 for (i = 0; i < 4; i++) 1012 v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^ 1013 (uint32_t)0xffffffff; 1014 1015 V6_MASK_COPY(v6addr, v6mask, ill->ill_token); 1016 ill->ill_token_length = IPV6_TOKEN_LEN; 1017 mutex_exit(&ill->ill_lock); 1018 return (B_TRUE); 1019 } 1020 1021 /* 1022 * Create a link-local address from a token. 1023 */ 1024 static void 1025 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 1026 { 1027 int i; 1028 1029 for (i = 0; i < 4; i++) { 1030 dest->s6_addr32[i] = 1031 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 1032 } 1033 } 1034 1035 /* 1036 * Set a nice default address for either automatic tunnels tsrc/96 or 1037 * 6to4 tunnels 2002:<tsrc>::1/64 1038 */ 1039 static void 1040 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta) 1041 { 1042 sin6_t sin6; 1043 sin_t *sin; 1044 ill_t *ill = ipif->ipif_ill; 1045 tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr; 1046 1047 if (ta->ifta_saddr.ss_family != AF_INET || 1048 (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 || 1049 (ta->ifta_flags & IFTUN_SRC) == 0) 1050 return; 1051 1052 /* 1053 * Check the tunnel type by examining q_next->q_ptr 1054 */ 1055 if (tp->tun_flags & TUN_AUTOMATIC) { 1056 /* this is an automatic tunnel */ 1057 (void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS, 1058 &ipif->ipif_v6net_mask); 1059 bzero(&sin6, sizeof (sin6_t)); 1060 sin = (sin_t *)&ta->ifta_saddr; 1061 V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr; 1062 sin6.sin6_family = AF_INET6; 1063 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1064 NULL, NULL, NULL, NULL); 1065 } else if (tp->tun_flags & TUN_6TO4) { 1066 /* this is a 6to4 tunnel */ 1067 (void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN, 1068 &ipif->ipif_v6net_mask); 1069 sin = (sin_t *)&ta->ifta_saddr; 1070 /* create a 6to4 address from the IPv4 tsrc */ 1071 IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr); 1072 sin6.sin6_family = AF_INET6; 1073 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1074 NULL, NULL, NULL, NULL); 1075 } else { 1076 ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type")); 1077 return; 1078 } 1079 } 1080 1081 /* 1082 * Set link local for ipif_id 0 of a configured tunnel based on the 1083 * tsrc or tdst parameter 1084 * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as 1085 * the token. 1086 * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address 1087 * as the token for the "outer" link. 1088 */ 1089 void 1090 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta) 1091 { 1092 ipif_t *ipif; 1093 sin_t *sin; 1094 in6_addr_t *s6addr; 1095 1096 ASSERT(IAM_WRITER_ILL(ill)); 1097 1098 /* The first ipif must be id zero. */ 1099 ipif = ill->ill_ipif; 1100 ASSERT(ipif->ipif_id == 0); 1101 1102 /* no link local for automatic tunnels */ 1103 if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) { 1104 ipif_set_tun_auto_addr(ipif, ta); 1105 return; 1106 } 1107 1108 if ((ta->ifta_flags & IFTUN_DST) && 1109 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 1110 sin6_t sin6; 1111 1112 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1113 bzero(&sin6, sizeof (sin6_t)); 1114 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1115 sin = (sin_t *)&ta->ifta_daddr; 1116 V4_PART_OF_V6(sin6.sin6_addr) = 1117 sin->sin_addr.s_addr; 1118 } else { 1119 s6addr = 1120 &((sin6_t *)&ta->ifta_daddr)->sin6_addr; 1121 sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3]; 1122 sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2]; 1123 } 1124 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, 1125 &sin6.sin6_addr); 1126 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1127 } 1128 if ((ta->ifta_flags & IFTUN_SRC)) { 1129 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1130 1131 /* Set the token if it isn't already set */ 1132 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) { 1133 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1134 sin = (sin_t *)&ta->ifta_saddr; 1135 V4_PART_OF_V6(ill->ill_token) = 1136 sin->sin_addr.s_addr; 1137 } else { 1138 s6addr = 1139 &((sin6_t *)&ta->ifta_saddr)->sin6_addr; 1140 ill->ill_token.s6_addr32[3] = 1141 s6addr->s6_addr32[3]; 1142 ill->ill_token.s6_addr32[2] = 1143 s6addr->s6_addr32[2]; 1144 } 1145 ill->ill_token_length = IPV6_TOKEN_LEN; 1146 } 1147 /* 1148 * Attempt to set the link local address if it isn't set. 1149 */ 1150 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) 1151 (void) ipif_setlinklocal(ipif); 1152 } 1153 } 1154 1155 /* 1156 * Is it not possible to set the link local address? 1157 * The address can be set if the token is set, and the token 1158 * isn't too long. 1159 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1160 */ 1161 boolean_t 1162 ipif_cant_setlinklocal(ipif_t *ipif) 1163 { 1164 ill_t *ill = ipif->ipif_ill; 1165 1166 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1167 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1168 return (B_TRUE); 1169 1170 return (B_FALSE); 1171 } 1172 1173 /* 1174 * Generate a link-local address from the token. 1175 * Return zero if the address was set, or non-zero if it couldn't be set. 1176 */ 1177 int 1178 ipif_setlinklocal(ipif_t *ipif) 1179 { 1180 ill_t *ill = ipif->ipif_ill; 1181 1182 ASSERT(IAM_WRITER_ILL(ill)); 1183 1184 if (ipif_cant_setlinklocal(ipif)) 1185 return (-1); 1186 1187 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1188 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1189 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1190 ipif->ipif_v6subnet); 1191 1192 if (ipif->ipif_flags & IPIF_NOLOCAL) { 1193 ipif->ipif_v6src_addr = ipv6_all_zeros; 1194 } else { 1195 ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr; 1196 } 1197 return (0); 1198 } 1199 1200 /* 1201 * This function sets up the multicast mappings in NDP. 1202 * Unlike ARP, there are no mapping_mps here. We delete the 1203 * mapping nces and add a new one. 1204 * 1205 * Returns non-zero on error and 0 on success. 1206 */ 1207 int 1208 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce) 1209 { 1210 ill_t *ill = ipif->ipif_ill; 1211 in6_addr_t v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0}; 1212 in6_addr_t v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0}; 1213 in6_addr_t v6_extract_mask; 1214 uchar_t *phys_addr, *bphys_addr, *alloc_phys; 1215 nce_t *mnce = NULL; 1216 int err = 0; 1217 phyint_t *phyi = ill->ill_phyint; 1218 uint32_t hw_extract_start; 1219 dl_unitdata_req_t *dlur; 1220 1221 if (ret_nce != NULL) 1222 *ret_nce = NULL; 1223 /* 1224 * Delete the mapping nce. Normally these should not exist 1225 * as a previous ipif_down -> ipif_ndp_down should have deleted 1226 * all the nces. But they can exist if ip_rput_dlpi_writer 1227 * calls this when PHYI_MULTI_BCAST is set. 1228 */ 1229 mnce = ndp_lookup_v6(ill, &v6_mcast_addr, B_FALSE); 1230 if (mnce != NULL) { 1231 ndp_delete(mnce); 1232 NCE_REFRELE(mnce); 1233 mnce = NULL; 1234 } 1235 1236 /* 1237 * Get media specific v6 mapping information. Note that 1238 * nd_lla_len can be 0 for tunnels. 1239 */ 1240 alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP); 1241 if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0)) 1242 return (ENOMEM); 1243 /* 1244 * Determine the broadcast address. 1245 */ 1246 dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr; 1247 if (ill->ill_sap_length < 0) 1248 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset; 1249 else 1250 bphys_addr = (uchar_t *)dlur + 1251 dlur->dl_dest_addr_offset + ill->ill_sap_length; 1252 1253 /* 1254 * Check PHYI_MULTI_BCAST and possible length of physical 1255 * address to determine if we use the mapping or the 1256 * broadcast address. 1257 */ 1258 if ((phyi->phyint_flags & PHYI_MULTI_BCAST) || 1259 (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len, 1260 bphys_addr, alloc_phys, &hw_extract_start, 1261 &v6_extract_mask))) { 1262 if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) { 1263 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1264 return (E2BIG); 1265 } 1266 /* Use the link-layer broadcast address for MULTI_BCAST */ 1267 phys_addr = bphys_addr; 1268 bzero(&v6_extract_mask, sizeof (v6_extract_mask)); 1269 hw_extract_start = ill->ill_nd_lla_len; 1270 } else { 1271 phys_addr = alloc_phys; 1272 } 1273 if ((ipif->ipif_flags & IPIF_BROADCAST) || 1274 (ill->ill_flags & ILLF_MULTICAST) || 1275 (phyi->phyint_flags & PHYI_MULTI_BCAST)) { 1276 mutex_enter(&ndp6.ndp_g_lock); 1277 err = ndp_add(ill, 1278 phys_addr, 1279 &v6_mcast_addr, /* v6 address */ 1280 &v6_mcast_mask, /* v6 mask */ 1281 &v6_extract_mask, 1282 hw_extract_start, 1283 NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD, 1284 ND_REACHABLE, 1285 &mnce, 1286 NULL, 1287 NULL); 1288 mutex_exit(&ndp6.ndp_g_lock); 1289 if (err == 0) { 1290 if (ret_nce != NULL) { 1291 *ret_nce = mnce; 1292 } else { 1293 NCE_REFRELE(mnce); 1294 } 1295 } 1296 } 1297 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1298 return (err); 1299 } 1300 1301 /* 1302 * Get the resolver set up for a new interface address. (Always called 1303 * as writer.) 1304 */ 1305 int 1306 ipif_ndp_up(ipif_t *ipif, const in6_addr_t *addr, boolean_t macaddr_change) 1307 { 1308 ill_t *ill = ipif->ipif_ill; 1309 int err = 0; 1310 nce_t *nce = NULL; 1311 nce_t *mnce = NULL; 1312 1313 ip1dbg(("ipif_ndp_up(%s:%u)\n", 1314 ipif->ipif_ill->ill_name, ipif->ipif_id)); 1315 1316 /* 1317 * ND not supported on XRESOLV interfaces. If ND support (multicast) 1318 * added later, take out this check. 1319 */ 1320 if ((ill->ill_flags & ILLF_XRESOLV) || 1321 IN6_IS_ADDR_UNSPECIFIED(addr) || 1322 (!(ill->ill_net_type & IRE_INTERFACE))) { 1323 ipif->ipif_addr_ready = 1; 1324 return (0); 1325 } 1326 1327 /* 1328 * Need to setup multicast mapping only when the first 1329 * interface is coming UP. 1330 */ 1331 if (ill->ill_ipif_up_count == 0 && 1332 (ill->ill_flags & ILLF_MULTICAST)) { 1333 /* 1334 * We set the multicast before setting up the mapping for 1335 * local address because ipif_ndp_setup_multicast does 1336 * ndp_walk to delete nces which will delete the mapping 1337 * for local address also if we added the mapping for 1338 * local address first. 1339 */ 1340 err = ipif_ndp_setup_multicast(ipif, &mnce); 1341 if (err != 0) 1342 return (err); 1343 } 1344 1345 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1346 uint16_t flags; 1347 uchar_t *hw_addr = NULL; 1348 1349 /* Permanent entries don't need NUD */ 1350 flags = NCE_F_PERMANENT; 1351 flags |= NCE_F_NONUD; 1352 if (ill->ill_flags & ILLF_ROUTER) 1353 flags |= NCE_F_ISROUTER; 1354 1355 if (ipif->ipif_flags & IPIF_ANYCAST) 1356 flags |= NCE_F_ANYCAST; 1357 1358 if (ill->ill_net_type == IRE_IF_RESOLVER) { 1359 hw_addr = ill->ill_nd_lla; 1360 1361 if (ill->ill_move_in_progress || macaddr_change) { 1362 /* 1363 * Addresses are failing over to this ill. 1364 * Don't wait for NUD to see this change. 1365 * Publish our new link-layer address. 1366 */ 1367 flags |= NCE_F_UNSOL_ADV; 1368 } 1369 } 1370 err = ndp_lookup_then_add(ill, 1371 hw_addr, 1372 addr, 1373 &ipv6_all_ones, 1374 &ipv6_all_zeros, 1375 0, 1376 flags, 1377 ND_PROBE, /* Causes Duplicate Address Detection to run */ 1378 &nce, 1379 NULL, 1380 NULL); 1381 switch (err) { 1382 case 0: 1383 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1384 ill->ill_name)); 1385 ipif->ipif_addr_ready = 1; 1386 break; 1387 case EINPROGRESS: 1388 ip1dbg(("ipif_ndp_up: running DAD now for %s\n", 1389 ill->ill_name)); 1390 break; 1391 case EEXIST: 1392 NCE_REFRELE(nce); 1393 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1394 ill->ill_name)); 1395 if (mnce != NULL) { 1396 ndp_delete(mnce); 1397 NCE_REFRELE(mnce); 1398 } 1399 return (err); 1400 default: 1401 ip1dbg(("ipif_ndp_up: NCE creation failed %s\n", 1402 ill->ill_name)); 1403 if (mnce != NULL) { 1404 ndp_delete(mnce); 1405 NCE_REFRELE(mnce); 1406 } 1407 return (err); 1408 } 1409 } else { 1410 /* No local NCE for this entry */ 1411 ipif->ipif_addr_ready = 1; 1412 } 1413 if (nce != NULL) 1414 NCE_REFRELE(nce); 1415 if (mnce != NULL) 1416 NCE_REFRELE(mnce); 1417 return (0); 1418 } 1419 1420 /* Remove all cache entries for this logical interface */ 1421 void 1422 ipif_ndp_down(ipif_t *ipif) 1423 { 1424 nce_t *nce; 1425 1426 if (ipif->ipif_isv6) { 1427 nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, 1428 B_FALSE); 1429 if (nce != NULL) { 1430 ndp_delete(nce); 1431 NCE_REFRELE(nce); 1432 } 1433 } 1434 /* 1435 * Remove mapping and all other nces dependent on this ill 1436 * when the last ipif is going away. 1437 */ 1438 if (ipif->ipif_ill->ill_ipif_up_count == 0) { 1439 ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill, 1440 (uchar_t *)ipif->ipif_ill); 1441 } 1442 } 1443 1444 /* 1445 * Used when an interface comes up to recreate any extra routes on this 1446 * interface. 1447 */ 1448 static ire_t ** 1449 ipif_recover_ire_v6(ipif_t *ipif) 1450 { 1451 mblk_t *mp; 1452 ire_t **ipif_saved_irep; 1453 ire_t **irep; 1454 1455 ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name, 1456 ipif->ipif_id)); 1457 1458 ASSERT(ipif->ipif_isv6); 1459 1460 mutex_enter(&ipif->ipif_saved_ire_lock); 1461 ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) * 1462 ipif->ipif_saved_ire_cnt, KM_NOSLEEP); 1463 if (ipif_saved_irep == NULL) { 1464 mutex_exit(&ipif->ipif_saved_ire_lock); 1465 return (NULL); 1466 } 1467 1468 irep = ipif_saved_irep; 1469 1470 for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) { 1471 ire_t *ire; 1472 queue_t *rfq; 1473 queue_t *stq; 1474 ifrt_t *ifrt; 1475 in6_addr_t *src_addr; 1476 in6_addr_t *gateway_addr; 1477 mblk_t *resolver_mp; 1478 char buf[INET6_ADDRSTRLEN]; 1479 ushort_t type; 1480 1481 /* 1482 * When the ire was initially created and then added in 1483 * ip_rt_add_v6(), it was created either using 1484 * ipif->ipif_net_type in the case of a traditional interface 1485 * route, or as one of the IRE_OFFSUBNET types (with the 1486 * exception of IRE_HOST_REDIRECT which is created by 1487 * icmp_redirect_v6() and which we don't need to save or 1488 * recover). In the case where ipif->ipif_net_type was 1489 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to 1490 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy 1491 * software like GateD and Sun Cluster which creates routes 1492 * using the the loopback interface's address as a gateway. 1493 * 1494 * As ifrt->ifrt_type reflects the already updated ire_type and 1495 * since ire_create_v6() expects that IRE_IF_NORESOLVER will 1496 * have a valid ire_dlureq_mp field (which doesn't make sense 1497 * for a IRE_LOOPBACK), ire_create_v6() will be called in the 1498 * same way here as in ip_rt_add_v6(), namely using 1499 * ipif->ipif_net_type when the route looks like a traditional 1500 * interface route (where ifrt->ifrt_type & IRE_INTERFACE is 1501 * true) and otherwise using the saved ifrt->ifrt_type. This 1502 * means that in the case where ipif->ipif_net_type is 1503 * IRE_LOOPBACK, the ire created by ire_create_v6() will be an 1504 * IRE_LOOPBACK, it will then be turned into an 1505 * IRE_IF_NORESOLVER and then added by ire_add_v6(). 1506 */ 1507 ifrt = (ifrt_t *)mp->b_rptr; 1508 if (ifrt->ifrt_type & IRE_INTERFACE) { 1509 rfq = NULL; 1510 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 1511 ? ipif->ipif_rq : ipif->ipif_wq; 1512 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1513 ? &ifrt->ifrt_v6src_addr 1514 : &ipif->ipif_v6src_addr; 1515 gateway_addr = NULL; 1516 resolver_mp = ipif->ipif_resolver_mp; 1517 type = ipif->ipif_net_type; 1518 } else { 1519 rfq = NULL; 1520 stq = NULL; 1521 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1522 ? &ifrt->ifrt_v6src_addr : NULL; 1523 gateway_addr = &ifrt->ifrt_v6gateway_addr; 1524 resolver_mp = NULL; 1525 type = ifrt->ifrt_type; 1526 } 1527 1528 /* 1529 * Create a copy of the IRE with the saved address and netmask. 1530 */ 1531 ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n", 1532 ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type, 1533 inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)), 1534 ip_mask_to_plen_v6(&ifrt->ifrt_v6mask))); 1535 ire = ire_create_v6( 1536 &ifrt->ifrt_v6addr, 1537 &ifrt->ifrt_v6mask, 1538 src_addr, 1539 gateway_addr, 1540 &ifrt->ifrt_max_frag, 1541 NULL, 1542 rfq, 1543 stq, 1544 type, 1545 resolver_mp, 1546 ipif, 1547 NULL, 1548 0, 1549 0, 1550 ifrt->ifrt_flags, 1551 &ifrt->ifrt_iulp_info, 1552 NULL, 1553 NULL); 1554 if (ire == NULL) { 1555 mutex_exit(&ipif->ipif_saved_ire_lock); 1556 kmem_free(ipif_saved_irep, 1557 ipif->ipif_saved_ire_cnt * sizeof (ire_t *)); 1558 return (NULL); 1559 } 1560 1561 /* 1562 * Some software (for example, GateD and Sun Cluster) attempts 1563 * to create (what amount to) IRE_PREFIX routes with the 1564 * loopback address as the gateway. This is primarily done to 1565 * set up prefixes with the RTF_REJECT flag set (for example, 1566 * when generating aggregate routes.) 1567 * 1568 * If the IRE type (as defined by ipif->ipif_net_type) is 1569 * IRE_LOOPBACK, then we map the request into a 1570 * IRE_IF_NORESOLVER. 1571 */ 1572 if (ipif->ipif_net_type == IRE_LOOPBACK) 1573 ire->ire_type = IRE_IF_NORESOLVER; 1574 /* 1575 * ire held by ire_add, will be refreled' in ipif_up_done 1576 * towards the end 1577 */ 1578 (void) ire_add(&ire, NULL, NULL, NULL, B_FALSE); 1579 *irep = ire; 1580 irep++; 1581 ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire)); 1582 } 1583 mutex_exit(&ipif->ipif_saved_ire_lock); 1584 return (ipif_saved_irep); 1585 } 1586 1587 /* 1588 * Return the scope of the given IPv6 address. If the address is an 1589 * IPv4 mapped IPv6 address, return the scope of the corresponding 1590 * IPv4 address. 1591 */ 1592 in6addr_scope_t 1593 ip_addr_scope_v6(const in6_addr_t *addr) 1594 { 1595 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1596 1597 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1598 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1599 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1600 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1601 return (IP6_SCOPE_LINKLOCAL); 1602 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1603 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1604 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1605 return (IP6_SCOPE_SITELOCAL); 1606 return (IP6_SCOPE_GLOBAL); 1607 } 1608 1609 if (IN6_IS_ADDR_MULTICAST(addr)) 1610 return (IN6_ADDR_MC_SCOPE(addr)); 1611 1612 /* link-local and loopback addresses are of link-local scope */ 1613 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1614 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1615 return (IP6_SCOPE_LINKLOCAL); 1616 if (IN6_IS_ADDR_SITELOCAL(addr)) 1617 return (IP6_SCOPE_SITELOCAL); 1618 return (IP6_SCOPE_GLOBAL); 1619 } 1620 1621 1622 /* 1623 * Calculates the xor of a1 and a2, and stores the result in res. 1624 */ 1625 static void 1626 ip_addr_xor_v6(const in6_addr_t *a1, const in6_addr_t *a2, in6_addr_t *res) 1627 { 1628 int i; 1629 1630 for (i = 0; i < 4; i++) 1631 res->s6_addr32[i] = a1->s6_addr32[i] ^ a2->s6_addr32[i]; 1632 } 1633 1634 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1635 (((ipif)->ipif_flags & IPIF_UP) && \ 1636 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \ 1637 (ipif)->ipif_addr_ready) 1638 1639 /* source address candidate */ 1640 typedef struct candidate { 1641 ipif_t *cand_ipif; 1642 /* The properties of this candidate */ 1643 boolean_t cand_isdst; 1644 boolean_t cand_isdst_set; 1645 in6addr_scope_t cand_scope; 1646 boolean_t cand_scope_set; 1647 boolean_t cand_isdeprecated; 1648 boolean_t cand_isdeprecated_set; 1649 boolean_t cand_ispreferred; 1650 boolean_t cand_ispreferred_set; 1651 boolean_t cand_matchedinterface; 1652 boolean_t cand_matchedinterface_set; 1653 boolean_t cand_matchedlabel; 1654 boolean_t cand_matchedlabel_set; 1655 boolean_t cand_istmp; 1656 boolean_t cand_istmp_set; 1657 in6_addr_t cand_xor; 1658 boolean_t cand_xor_set; 1659 } cand_t; 1660 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1661 #define cand_flags cand_ipif->ipif_flags 1662 #define cand_ill cand_ipif->ipif_ill 1663 #define cand_zoneid cand_ipif->ipif_zoneid 1664 1665 /* information about the destination for source address selection */ 1666 typedef struct dstinfo { 1667 const in6_addr_t *dst_addr; 1668 ill_t *dst_ill; 1669 uint_t dst_restrict_ill; 1670 boolean_t dst_prefer_src_tmp; 1671 in6addr_scope_t dst_scope; 1672 char *dst_label; 1673 } dstinfo_t; 1674 1675 /* 1676 * The following functions are rules used to select a source address in 1677 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1678 * against the best candidate (bc). Each rule has three possible outcomes; 1679 * the candidate is preferred over the best candidate (CAND_PREFER), the 1680 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1681 * candidate is of equal value as the best candidate (CAND_TIE). 1682 * 1683 * These rules are part of a greater "Default Address Selection for IPv6" 1684 * sheme, which is standards based work coming out of the IETF ipv6 working 1685 * group. The IETF document defines both IPv6 source address selection and 1686 * destination address ordering. The rules defined here implement the IPv6 1687 * source address selection. Destination address ordering is done by 1688 * libnsl, and uses a similar set of rules to implement the sorting. 1689 */ 1690 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1691 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *); 1692 1693 /* Prefer an address if it is equal to the destination address. */ 1694 static rule_res_t 1695 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1696 { 1697 if (!bc->cand_isdst_set) { 1698 bc->cand_isdst = 1699 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1700 bc->cand_isdst_set = B_TRUE; 1701 } 1702 1703 cc->cand_isdst = 1704 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1705 cc->cand_isdst_set = B_TRUE; 1706 1707 if (cc->cand_isdst == bc->cand_isdst) 1708 return (CAND_TIE); 1709 else if (cc->cand_isdst) 1710 return (CAND_PREFER); 1711 else 1712 return (CAND_AVOID); 1713 } 1714 1715 /* 1716 * Prefer addresses that are of closest scope to the destination. Always 1717 * prefer addresses that are of greater scope than the destination over 1718 * those that are of lesser scope than the destination. 1719 */ 1720 static rule_res_t 1721 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1722 { 1723 if (!bc->cand_scope_set) { 1724 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1725 bc->cand_scope_set = B_TRUE; 1726 } 1727 1728 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1729 cc->cand_scope_set = B_TRUE; 1730 1731 if (cc->cand_scope < bc->cand_scope) { 1732 if (cc->cand_scope < dstinfo->dst_scope) 1733 return (CAND_AVOID); 1734 else 1735 return (CAND_PREFER); 1736 } else if (bc->cand_scope < cc->cand_scope) { 1737 if (bc->cand_scope < dstinfo->dst_scope) 1738 return (CAND_PREFER); 1739 else 1740 return (CAND_AVOID); 1741 } else { 1742 return (CAND_TIE); 1743 } 1744 } 1745 1746 /* 1747 * Prefer non-deprecated source addresses. 1748 */ 1749 /* ARGSUSED2 */ 1750 static rule_res_t 1751 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1752 { 1753 if (!bc->cand_isdeprecated_set) { 1754 bc->cand_isdeprecated = 1755 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 1756 bc->cand_isdeprecated_set = B_TRUE; 1757 } 1758 1759 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 1760 cc->cand_isdeprecated_set = B_TRUE; 1761 1762 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 1763 return (CAND_TIE); 1764 else if (cc->cand_isdeprecated) 1765 return (CAND_AVOID); 1766 else 1767 return (CAND_PREFER); 1768 } 1769 1770 /* 1771 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 1772 * rule must be before rule_interface because the flag could be set on any 1773 * interface, not just the interface being used for outgoing packets (for 1774 * example, the IFF_PREFERRED could be set on an address assigned to the 1775 * loopback interface). 1776 */ 1777 /* ARGSUSED2 */ 1778 static rule_res_t 1779 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1780 { 1781 if (!bc->cand_ispreferred_set) { 1782 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 1783 bc->cand_ispreferred_set = B_TRUE; 1784 } 1785 1786 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 1787 cc->cand_ispreferred_set = B_TRUE; 1788 1789 if (bc->cand_ispreferred == cc->cand_ispreferred) 1790 return (CAND_TIE); 1791 else if (cc->cand_ispreferred) 1792 return (CAND_PREFER); 1793 else 1794 return (CAND_AVOID); 1795 } 1796 1797 /* 1798 * Prefer source addresses that are assigned to the outgoing interface, or 1799 * to an interface that is in the same IPMP group as the outgoing 1800 * interface. 1801 */ 1802 static rule_res_t 1803 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1804 { 1805 ill_t *dstill = dstinfo->dst_ill; 1806 1807 /* 1808 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 1809 * since we know all candidates will be on the same link. 1810 */ 1811 if (dstinfo->dst_restrict_ill) 1812 return (CAND_TIE); 1813 1814 if (!bc->cand_matchedinterface_set) { 1815 bc->cand_matchedinterface = (bc->cand_ill == dstill || 1816 (dstill->ill_group != NULL && 1817 dstill->ill_group == bc->cand_ill->ill_group)); 1818 bc->cand_matchedinterface_set = B_TRUE; 1819 } 1820 1821 cc->cand_matchedinterface = (cc->cand_ill == dstill || 1822 (dstill->ill_group != NULL && 1823 dstill->ill_group == cc->cand_ill->ill_group)); 1824 cc->cand_matchedinterface_set = B_TRUE; 1825 1826 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 1827 return (CAND_TIE); 1828 else if (cc->cand_matchedinterface) 1829 return (CAND_PREFER); 1830 else 1831 return (CAND_AVOID); 1832 } 1833 1834 /* 1835 * Prefer source addresses whose label matches the destination's label. 1836 */ 1837 static rule_res_t 1838 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1839 { 1840 char *label; 1841 1842 if (!bc->cand_matchedlabel_set) { 1843 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL); 1844 bc->cand_matchedlabel = 1845 ip6_asp_labelcmp(label, dstinfo->dst_label); 1846 bc->cand_matchedlabel_set = B_TRUE; 1847 } 1848 1849 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL); 1850 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 1851 cc->cand_matchedlabel_set = B_TRUE; 1852 1853 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 1854 return (CAND_TIE); 1855 else if (cc->cand_matchedlabel) 1856 return (CAND_PREFER); 1857 else 1858 return (CAND_AVOID); 1859 } 1860 1861 /* 1862 * Prefer public addresses over temporary ones. An application can reverse 1863 * the logic of this rule and prefer temporary addresses by using the 1864 * IPV6_SRC_PREFERENCES socket option. 1865 */ 1866 static rule_res_t 1867 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1868 { 1869 if (!bc->cand_istmp_set) { 1870 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 1871 bc->cand_istmp_set = B_TRUE; 1872 } 1873 1874 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 1875 cc->cand_istmp_set = B_TRUE; 1876 1877 if (bc->cand_istmp == cc->cand_istmp) 1878 return (CAND_TIE); 1879 1880 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 1881 return (CAND_PREFER); 1882 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 1883 return (CAND_PREFER); 1884 else 1885 return (CAND_AVOID); 1886 } 1887 1888 /* 1889 * Prefer source addresses with longer matching prefix with the 1890 * destination. Since this is the last rule, it must not produce a tie. 1891 * We do the longest matching prefix calculation and the tie break in one 1892 * calculation by doing an xor of both addresses with the destination, and 1893 * pick the address with the smallest xor value. That way, we're both 1894 * picking the address with the longest matching prefix, and breaking the 1895 * tie if they happen to have both have equal mathing prefixes. 1896 */ 1897 static rule_res_t 1898 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1899 { 1900 int i; 1901 1902 if (!bc->cand_xor_set) { 1903 ip_addr_xor_v6(&bc->cand_srcaddr, 1904 dstinfo->dst_addr, &bc->cand_xor); 1905 bc->cand_xor_set = B_TRUE; 1906 } 1907 1908 ip_addr_xor_v6(&cc->cand_srcaddr, dstinfo->dst_addr, &cc->cand_xor); 1909 cc->cand_xor_set = B_TRUE; 1910 1911 for (i = 0; i < 4; i++) { 1912 if (bc->cand_xor.s6_addr32[i] != cc->cand_xor.s6_addr32[i]) 1913 break; 1914 } 1915 1916 if (cc->cand_xor.s6_addr32[i] < bc->cand_xor.s6_addr32[i]) 1917 return (CAND_PREFER); 1918 else 1919 return (CAND_AVOID); 1920 } 1921 1922 /* 1923 * Prefer to use zone-specific addresses when possible instead of all-zones 1924 * addresses. 1925 */ 1926 /* ARGSUSED2 */ 1927 static rule_res_t 1928 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1929 { 1930 if ((bc->cand_zoneid == ALL_ZONES) == 1931 (cc->cand_zoneid == ALL_ZONES)) 1932 return (CAND_TIE); 1933 else if (cc->cand_zoneid == ALL_ZONES) 1934 return (CAND_AVOID); 1935 else 1936 return (CAND_PREFER); 1937 } 1938 1939 /* 1940 * Determine the best source address given a destination address and a 1941 * destination ill. If no suitable source address is found, it returns 1942 * NULL. If there is a usable address pointed to by the usesrc 1943 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 1944 * fine grained (i.e per interface) 1945 * 1946 * This implementation is based on the "Default Address Selection for IPv6" 1947 * specification produced by the IETF IPv6 working group. It has been 1948 * implemented so that the list of addresses is only traversed once (the 1949 * specification's algorithm could traverse the list of addresses once for 1950 * every rule). 1951 * 1952 * The restrict_ill argument restricts the algorithm to chose a source 1953 * address that is assigned to the destination ill or an ill in the same 1954 * IPMP group as the destination ill. This is used when the destination 1955 * address is a link-local or multicast address, and when 1956 * ipv6_strict_dst_multihoming is turned on. 1957 * 1958 * src_prefs is the caller's set of source address preferences. If source 1959 * address selection is being called to determine the source address of a 1960 * connected socket (from ip_bind_connected_v6()), then the preferences are 1961 * taken from conn_src_preferences. These preferences can be set on a 1962 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 1963 * preference currently implemented is for rfc3041 temporary addresses. 1964 */ 1965 ipif_t * 1966 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 1967 uint_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid) 1968 { 1969 dstinfo_t dstinfo; 1970 char dstr[INET6_ADDRSTRLEN]; 1971 char sstr[INET6_ADDRSTRLEN]; 1972 ipif_t *ipif; 1973 ill_t *ill, *usesrc_ill = NULL; 1974 ill_walk_context_t ctx; 1975 cand_t best_c; /* The best candidate */ 1976 cand_t curr_c; /* The current candidate */ 1977 uint_t index; 1978 boolean_t first_candidate = B_TRUE; 1979 rule_res_t rule_result; 1980 tsol_tpc_t *src_rhtp, *dst_rhtp; 1981 1982 /* 1983 * The list of ordering rules. They are applied in the order they 1984 * appear in the list. 1985 * 1986 * XXX rule_mipv6 will need to be implemented (the specification's 1987 * rules 4) if a mobile IPv6 node is ever implemented. 1988 */ 1989 rulef_t rules[] = { 1990 rule_isdst, 1991 rule_scope, 1992 rule_deprecated, 1993 rule_preferred, 1994 rule_interface, 1995 rule_label, 1996 rule_temporary, 1997 rule_prefix, 1998 rule_zone_specific, 1999 NULL 2000 }; 2001 2002 ASSERT(dstill->ill_isv6); 2003 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 2004 2005 /* 2006 * Check if there is a usable src address pointed to by the 2007 * usesrc ifindex. This has higher precedence since it is 2008 * finer grained (i.e per interface) v/s being system wide. 2009 */ 2010 if (dstill->ill_usesrc_ifindex != 0) { 2011 if ((usesrc_ill = 2012 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 2013 NULL, NULL, NULL, NULL)) != NULL) { 2014 dstinfo.dst_ill = usesrc_ill; 2015 } else { 2016 return (NULL); 2017 } 2018 } else { 2019 dstinfo.dst_ill = dstill; 2020 } 2021 2022 /* 2023 * If we're dealing with an unlabeled destination on a labeled system, 2024 * make sure that we ignore source addresses that are incompatible with 2025 * the destination's default label. That destination's default label 2026 * must dominate the minimum label on the source address. 2027 * 2028 * (Note that this has to do with Trusted Solaris. It's not related to 2029 * the labels described by ip6_asp_lookup.) 2030 */ 2031 dst_rhtp = NULL; 2032 if (is_system_labeled()) { 2033 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE); 2034 if (dst_rhtp == NULL) 2035 return (NULL); 2036 if (dst_rhtp->tpc_tp.host_type != UNLABELED) { 2037 TPC_RELE(dst_rhtp); 2038 dst_rhtp = NULL; 2039 } 2040 } 2041 2042 dstinfo.dst_addr = dst; 2043 dstinfo.dst_scope = ip_addr_scope_v6(dst); 2044 dstinfo.dst_label = ip6_asp_lookup(dst, NULL); 2045 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 2046 2047 rw_enter(&ill_g_lock, RW_READER); 2048 /* 2049 * Section three of the I-D states that for multicast and 2050 * link-local destinations, the candidate set must be restricted to 2051 * an interface that is on the same link as the outgoing interface. 2052 * Also, when ipv6_strict_dst_multihoming is turned on, always 2053 * restrict the source address to the destination link as doing 2054 * otherwise will almost certainly cause problems. 2055 */ 2056 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 2057 ipv6_strict_dst_multihoming || usesrc_ill != NULL) { 2058 if (restrict_ill == RESTRICT_TO_NONE) 2059 dstinfo.dst_restrict_ill = RESTRICT_TO_GROUP; 2060 else 2061 dstinfo.dst_restrict_ill = restrict_ill; 2062 } else { 2063 dstinfo.dst_restrict_ill = restrict_ill; 2064 } 2065 2066 bzero(&best_c, sizeof (cand_t)); 2067 2068 /* 2069 * Take a pass through the list of IPv6 interfaces to chose the 2070 * best possible source address. If restrict_ill is true, we only 2071 * iterate through the ill's that are in the same IPMP group as the 2072 * destination's outgoing ill. If restrict_ill is false, we walk 2073 * the entire list of IPv6 ill's. 2074 */ 2075 if (dstinfo.dst_restrict_ill != RESTRICT_TO_NONE) { 2076 if (dstinfo.dst_ill->ill_group != NULL && 2077 dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) { 2078 ill = dstinfo.dst_ill->ill_group->illgrp_ill; 2079 } else { 2080 ill = dstinfo.dst_ill; 2081 } 2082 } else { 2083 ill = ILL_START_WALK_V6(&ctx); 2084 } 2085 2086 while (ill != NULL) { 2087 ASSERT(ill->ill_isv6); 2088 2089 /* 2090 * Avoid FAILED/OFFLINE ills. 2091 * Global and site local addresses will failover and 2092 * will be available on the new ill. 2093 * But link local addresses don't move. 2094 */ 2095 if (dstinfo.dst_restrict_ill != RESTRICT_TO_ILL && 2096 ill->ill_phyint->phyint_flags & 2097 (PHYI_OFFLINE | PHYI_FAILED)) 2098 goto next_ill; 2099 2100 for (ipif = ill->ill_ipif; ipif != NULL; 2101 ipif = ipif->ipif_next) { 2102 2103 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 2104 continue; 2105 2106 if (zoneid != ALL_ZONES && 2107 ipif->ipif_zoneid != zoneid && 2108 ipif->ipif_zoneid != ALL_ZONES) 2109 continue; 2110 2111 /* 2112 * Check compatibility of local address for 2113 * destination's default label if we're on a labeled 2114 * system. Incompatible addresses can't be used at 2115 * all and must be skipped over. 2116 */ 2117 if (dst_rhtp != NULL) { 2118 boolean_t incompat; 2119 2120 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr, 2121 IPV6_VERSION, B_FALSE); 2122 if (src_rhtp == NULL) 2123 continue; 2124 incompat = 2125 src_rhtp->tpc_tp.host_type != SUN_CIPSO || 2126 src_rhtp->tpc_tp.tp_doi != 2127 dst_rhtp->tpc_tp.tp_doi || 2128 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label, 2129 &src_rhtp->tpc_tp.tp_sl_range_cipso) && 2130 !blinlset(&dst_rhtp->tpc_tp.tp_def_label, 2131 src_rhtp->tpc_tp.tp_sl_set_cipso)); 2132 TPC_RELE(src_rhtp); 2133 if (incompat) 2134 continue; 2135 } 2136 2137 if (first_candidate) { 2138 /* 2139 * This is first valid address in the list. 2140 * It is automatically the best candidate 2141 * so far. 2142 */ 2143 best_c.cand_ipif = ipif; 2144 first_candidate = B_FALSE; 2145 continue; 2146 } 2147 2148 bzero(&curr_c, sizeof (cand_t)); 2149 curr_c.cand_ipif = ipif; 2150 2151 /* 2152 * Compare this current candidate (curr_c) with the 2153 * best candidate (best_c) by applying the 2154 * comparison rules in order until one breaks the 2155 * tie. 2156 */ 2157 for (index = 0; rules[index] != NULL; index++) { 2158 /* Apply a comparison rule. */ 2159 rule_result = 2160 (rules[index])(&best_c, &curr_c, &dstinfo); 2161 if (rule_result == CAND_AVOID) { 2162 /* 2163 * The best candidate is still the 2164 * best candidate. Forget about 2165 * this current candidate and go on 2166 * to the next one. 2167 */ 2168 break; 2169 } else if (rule_result == CAND_PREFER) { 2170 /* 2171 * This candidate is prefered. It 2172 * becomes the best candidate so 2173 * far. Go on to the next address. 2174 */ 2175 best_c = curr_c; 2176 break; 2177 } 2178 /* We have a tie, apply the next rule. */ 2179 } 2180 2181 /* 2182 * The last rule must be a tie breaker rule and 2183 * must never produce a tie. At this point, the 2184 * candidate should have either been rejected, or 2185 * have been prefered as the best candidate so far. 2186 */ 2187 ASSERT(rule_result != CAND_TIE); 2188 } 2189 2190 /* 2191 * We may be walking the linked-list of ill's in an 2192 * IPMP group or traversing the IPv6 ill avl tree. If it is a 2193 * usesrc ILL then it can't be part of IPMP group and we 2194 * will exit the while loop. 2195 */ 2196 next_ill: 2197 if (dstinfo.dst_restrict_ill == RESTRICT_TO_ILL) 2198 ill = NULL; 2199 else if (dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) 2200 ill = ill->ill_group_next; 2201 else 2202 ill = ill_next(&ctx, ill); 2203 } 2204 2205 ipif = best_c.cand_ipif; 2206 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2207 dstinfo.dst_ill->ill_name, 2208 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2209 (ipif == NULL ? "NULL" : 2210 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2211 2212 if (usesrc_ill != NULL) 2213 ill_refrele(usesrc_ill); 2214 2215 if (dst_rhtp != NULL) 2216 TPC_RELE(dst_rhtp); 2217 2218 if (ipif == NULL) { 2219 rw_exit(&ill_g_lock); 2220 return (NULL); 2221 } 2222 2223 mutex_enter(&ipif->ipif_ill->ill_lock); 2224 if (IPIF_CAN_LOOKUP(ipif)) { 2225 ipif_refhold_locked(ipif); 2226 mutex_exit(&ipif->ipif_ill->ill_lock); 2227 rw_exit(&ill_g_lock); 2228 return (ipif); 2229 } 2230 mutex_exit(&ipif->ipif_ill->ill_lock); 2231 rw_exit(&ill_g_lock); 2232 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2233 " returning null \n", (void *)ipif)); 2234 2235 return (NULL); 2236 } 2237 2238 /* 2239 * If old_ipif is not NULL, see if ipif was derived from old 2240 * ipif and if so, recreate the interface route by re-doing 2241 * source address selection. This happens when ipif_down -> 2242 * ipif_update_other_ipifs calls us. 2243 * 2244 * If old_ipif is NULL, just redo the source address selection 2245 * if needed. This happens when illgrp_insert or ipif_up_done_v6 2246 * calls us. 2247 */ 2248 void 2249 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif) 2250 { 2251 ire_t *ire; 2252 ire_t *ipif_ire; 2253 queue_t *stq; 2254 ill_t *ill; 2255 ipif_t *nipif = NULL; 2256 boolean_t nipif_refheld = B_FALSE; 2257 boolean_t ip6_asp_table_held = B_FALSE; 2258 2259 ill = ipif->ipif_ill; 2260 2261 if (!(ipif->ipif_flags & 2262 (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) { 2263 /* 2264 * Can't possibly have borrowed the source 2265 * from old_ipif. 2266 */ 2267 return; 2268 } 2269 2270 /* 2271 * Is there any work to be done? No work if the address 2272 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST ( 2273 * ipif_select_source_v6() does not borrow addresses from 2274 * NOLOCAL and ANYCAST interfaces). 2275 */ 2276 if ((old_ipif != NULL) && 2277 ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) || 2278 (old_ipif->ipif_ill->ill_wq == NULL) || 2279 (old_ipif->ipif_flags & 2280 (IPIF_NOLOCAL|IPIF_ANYCAST)))) { 2281 return; 2282 } 2283 2284 /* 2285 * Perform the same checks as when creating the 2286 * IRE_INTERFACE in ipif_up_done_v6. 2287 */ 2288 if (!(ipif->ipif_flags & IPIF_UP)) 2289 return; 2290 2291 if ((ipif->ipif_flags & IPIF_NOXMIT)) 2292 return; 2293 2294 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2295 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask)) 2296 return; 2297 2298 /* 2299 * We know that ipif uses some other source for its 2300 * IRE_INTERFACE. Is it using the source of this 2301 * old_ipif? 2302 */ 2303 ipif_ire = ipif_to_ire_v6(ipif); 2304 if (ipif_ire == NULL) 2305 return; 2306 2307 if (old_ipif != NULL && 2308 !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr, 2309 &ipif_ire->ire_src_addr_v6)) { 2310 ire_refrele(ipif_ire); 2311 return; 2312 } 2313 2314 if (ip_debug > 2) { 2315 /* ip1dbg */ 2316 pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE" 2317 " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6); 2318 } 2319 2320 stq = ipif_ire->ire_stq; 2321 2322 /* 2323 * Can't use our source address. Select a different source address 2324 * for the IRE_INTERFACE. We restrict interface route source 2325 * address selection to ipif's assigned to the same link as the 2326 * interface. 2327 */ 2328 if (ip6_asp_can_lookup()) { 2329 ip6_asp_table_held = B_TRUE; 2330 nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet, 2331 RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT, 2332 ipif->ipif_zoneid); 2333 } 2334 if (nipif == NULL) { 2335 /* Last resort - all ipif's have IPIF_NOLOCAL */ 2336 nipif = ipif; 2337 } else { 2338 nipif_refheld = B_TRUE; 2339 } 2340 2341 ire = ire_create_v6( 2342 &ipif->ipif_v6subnet, /* dest pref */ 2343 &ipif->ipif_v6net_mask, /* mask */ 2344 &nipif->ipif_v6src_addr, /* src addr */ 2345 NULL, /* no gateway */ 2346 &ipif->ipif_mtu, /* max frag */ 2347 NULL, /* no Fast path header */ 2348 NULL, /* no recv from queue */ 2349 stq, /* send-to queue */ 2350 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2351 ill->ill_resolver_mp, /* xmit header */ 2352 ipif, 2353 NULL, 2354 0, 2355 0, 2356 0, 2357 &ire_uinfo_null, 2358 NULL, 2359 NULL); 2360 2361 if (ire != NULL) { 2362 ire_t *ret_ire; 2363 int error; 2364 2365 /* 2366 * We don't need ipif_ire anymore. We need to delete 2367 * before we add so that ire_add does not detect 2368 * duplicates. 2369 */ 2370 ire_delete(ipif_ire); 2371 ret_ire = ire; 2372 error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE); 2373 ASSERT(error == 0); 2374 ASSERT(ret_ire == ire); 2375 if (ret_ire != NULL) { 2376 /* Held in ire_add */ 2377 ire_refrele(ret_ire); 2378 } 2379 } 2380 /* 2381 * Either we are falling through from above or could not 2382 * allocate a replacement. 2383 */ 2384 ire_refrele(ipif_ire); 2385 if (ip6_asp_table_held) 2386 ip6_asp_table_refrele(); 2387 if (nipif_refheld) 2388 ipif_refrele(nipif); 2389 } 2390 2391 /* 2392 * This old_ipif is going away. 2393 * 2394 * Determine if any other ipif's are using our address as 2395 * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or 2396 * IPIF_DEPRECATED). 2397 * Find the IRE_INTERFACE for such ipif's and recreate them 2398 * to use an different source address following the rules in 2399 * ipif_up_done_v6. 2400 * 2401 * This function takes an illgrp as an argument so that illgrp_delete 2402 * can call this to update source address even after deleting the 2403 * old_ipif->ipif_ill from the ill group. 2404 */ 2405 void 2406 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp) 2407 { 2408 ipif_t *ipif; 2409 ill_t *ill; 2410 char buf[INET6_ADDRSTRLEN]; 2411 2412 ASSERT(IAM_WRITER_IPIF(old_ipif)); 2413 2414 ill = old_ipif->ipif_ill; 2415 2416 ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n", 2417 ill->ill_name, 2418 inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr, 2419 buf, sizeof (buf)))); 2420 2421 /* 2422 * If this part of a group, look at all ills as ipif_select_source 2423 * borrows a source address across all the ills in the group. 2424 */ 2425 if (illgrp != NULL) 2426 ill = illgrp->illgrp_ill; 2427 2428 /* Don't need a lock since this is a writer */ 2429 for (; ill != NULL; ill = ill->ill_group_next) { 2430 for (ipif = ill->ill_ipif; ipif != NULL; 2431 ipif = ipif->ipif_next) { 2432 2433 if (ipif == old_ipif) 2434 continue; 2435 2436 ipif_recreate_interface_routes_v6(old_ipif, ipif); 2437 } 2438 } 2439 } 2440 2441 /* 2442 * Perform an attach and bind to get phys addr plus info_req for 2443 * the physical device. 2444 * q and mp represents an ioctl which will be queued waiting for 2445 * completion of the DLPI message exchange. 2446 * MUST be called on an ill queue. Can not set conn_pending_ill for that 2447 * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q. 2448 * 2449 * Returns EINPROGRESS when mp has been consumed by queueing it on 2450 * ill_pending_mp and the ioctl will complete in ip_rput. 2451 */ 2452 int 2453 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2454 { 2455 mblk_t *v6token_mp = NULL; 2456 mblk_t *v6lla_mp = NULL; 2457 mblk_t *phys_mp = NULL; 2458 mblk_t *info_mp = NULL; 2459 mblk_t *attach_mp = NULL; 2460 mblk_t *detach_mp = NULL; 2461 mblk_t *bind_mp = NULL; 2462 mblk_t *unbind_mp = NULL; 2463 mblk_t *notify_mp = NULL; 2464 2465 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2466 ASSERT(ill->ill_dlpi_style_set); 2467 ASSERT(WR(q)->q_next != NULL); 2468 2469 if (ill->ill_isv6) { 2470 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2471 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2472 if (v6token_mp == NULL) 2473 goto bad; 2474 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2475 DL_IPV6_TOKEN; 2476 2477 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2478 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2479 if (v6lla_mp == NULL) 2480 goto bad; 2481 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2482 DL_IPV6_LINK_LAYER_ADDR; 2483 } 2484 2485 /* 2486 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2487 */ 2488 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2489 DL_NOTIFY_REQ); 2490 if (notify_mp == NULL) 2491 goto bad; 2492 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2493 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2494 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG); 2495 2496 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2497 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2498 if (phys_mp == NULL) 2499 goto bad; 2500 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2501 DL_CURR_PHYS_ADDR; 2502 2503 info_mp = ip_dlpi_alloc( 2504 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2505 DL_INFO_REQ); 2506 if (info_mp == NULL) 2507 goto bad; 2508 2509 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2510 DL_BIND_REQ); 2511 if (bind_mp == NULL) 2512 goto bad; 2513 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2514 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2515 2516 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2517 if (unbind_mp == NULL) 2518 goto bad; 2519 2520 /* If we need to attach/detach, pre-alloc and initialize the mblks */ 2521 if (ill->ill_needs_attach) { 2522 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2523 DL_ATTACH_REQ); 2524 if (attach_mp == NULL) 2525 goto bad; 2526 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2527 2528 detach_mp = ip_dlpi_alloc(sizeof (dl_detach_req_t), 2529 DL_DETACH_REQ); 2530 if (detach_mp == NULL) 2531 goto bad; 2532 } 2533 2534 /* 2535 * Here we are going to delay the ioctl ack until after 2536 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2537 * original ioctl message before sending the requests 2538 */ 2539 mutex_enter(&ill->ill_lock); 2540 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2541 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2542 /* 2543 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2544 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2545 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2546 */ 2547 ill->ill_phys_addr_pend = 0; 2548 mutex_exit(&ill->ill_lock); 2549 2550 if (attach_mp != NULL) { 2551 ip1dbg(("ill_dl_phys: attach\n")); 2552 ill_dlpi_send(ill, attach_mp); 2553 } 2554 ill_dlpi_send(ill, bind_mp); 2555 ill_dlpi_send(ill, info_mp); 2556 if (ill->ill_isv6) { 2557 ill_dlpi_send(ill, v6token_mp); 2558 ill_dlpi_send(ill, v6lla_mp); 2559 } 2560 ill_dlpi_send(ill, phys_mp); 2561 ill_dlpi_send(ill, notify_mp); 2562 ill_dlpi_send(ill, unbind_mp); 2563 2564 /* 2565 * Save the DL_DETACH_REQ (if there is one) for use in ill_delete(). 2566 */ 2567 ASSERT(ill->ill_detach_mp == NULL); 2568 ill->ill_detach_mp = detach_mp; 2569 2570 /* 2571 * This operation will complete in ip_rput_dlpi_writer with either 2572 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2573 */ 2574 return (EINPROGRESS); 2575 bad: 2576 if (v6token_mp != NULL) 2577 freemsg(v6token_mp); 2578 if (v6lla_mp != NULL) 2579 freemsg(v6lla_mp); 2580 if (phys_mp != NULL) 2581 freemsg(phys_mp); 2582 if (info_mp != NULL) 2583 freemsg(info_mp); 2584 if (attach_mp != NULL) 2585 freemsg(attach_mp); 2586 if (detach_mp != NULL) 2587 freemsg(detach_mp); 2588 if (bind_mp != NULL) 2589 freemsg(bind_mp); 2590 if (unbind_mp != NULL) 2591 freemsg(unbind_mp); 2592 if (notify_mp != NULL) 2593 freemsg(notify_mp); 2594 return (ENOMEM); 2595 } 2596 2597 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2598 2599 /* 2600 * DLPI is up. 2601 * Create all the IREs associated with an interface bring up multicast. 2602 * Set the interface flag and finish other initialization 2603 * that potentially had to be differed to after DL_BIND_ACK. 2604 */ 2605 int 2606 ipif_up_done_v6(ipif_t *ipif) 2607 { 2608 ire_t *ire_array[20]; 2609 ire_t **irep = ire_array; 2610 ire_t **irep1; 2611 ill_t *ill = ipif->ipif_ill; 2612 queue_t *stq; 2613 in6_addr_t v6addr; 2614 in6_addr_t route_mask; 2615 ipif_t *src_ipif = NULL; 2616 ipif_t *tmp_ipif; 2617 boolean_t flush_ire_cache = B_TRUE; 2618 int err; 2619 char buf[INET6_ADDRSTRLEN]; 2620 phyint_t *phyi; 2621 ire_t **ipif_saved_irep = NULL; 2622 int ipif_saved_ire_cnt; 2623 int cnt; 2624 boolean_t src_ipif_held = B_FALSE; 2625 boolean_t ire_added = B_FALSE; 2626 boolean_t loopback = B_FALSE; 2627 boolean_t ip6_asp_table_held = B_FALSE; 2628 2629 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2630 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2631 2632 /* Check if this is a loopback interface */ 2633 if (ipif->ipif_ill->ill_wq == NULL) 2634 loopback = B_TRUE; 2635 2636 ASSERT(ipif->ipif_isv6); 2637 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2638 2639 /* 2640 * If all other interfaces for this ill are down or DEPRECATED, 2641 * or otherwise unsuitable for source address selection, remove 2642 * any IRE_CACHE entries for this ill to make sure source 2643 * address selection gets to take this new ipif into account. 2644 * No need to hold ill_lock while traversing the ipif list since 2645 * we are writer 2646 */ 2647 for (tmp_ipif = ill->ill_ipif; tmp_ipif; 2648 tmp_ipif = tmp_ipif->ipif_next) { 2649 if (((tmp_ipif->ipif_flags & 2650 (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) || 2651 !(tmp_ipif->ipif_flags & IPIF_UP)) || 2652 (tmp_ipif == ipif)) 2653 continue; 2654 /* first useable pre-existing interface */ 2655 flush_ire_cache = B_FALSE; 2656 break; 2657 } 2658 if (flush_ire_cache) 2659 ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE, 2660 IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill); 2661 2662 /* 2663 * Figure out which way the send-to queue should go. Only 2664 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here. 2665 */ 2666 switch (ill->ill_net_type) { 2667 case IRE_IF_RESOLVER: 2668 stq = ill->ill_rq; 2669 break; 2670 case IRE_IF_NORESOLVER: 2671 case IRE_LOOPBACK: 2672 stq = ill->ill_wq; 2673 break; 2674 default: 2675 return (EINVAL); 2676 } 2677 2678 if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) { 2679 /* 2680 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 2681 * ipif_lookup_on_name(), but in the case of zones we can have 2682 * several loopback addresses on lo0. So all the interfaces with 2683 * loopback addresses need to be marked IRE_LOOPBACK. 2684 */ 2685 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 2686 ipif->ipif_ire_type = IRE_LOOPBACK; 2687 else 2688 ipif->ipif_ire_type = IRE_LOCAL; 2689 } 2690 2691 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) { 2692 /* 2693 * Can't use our source address. Select a different 2694 * source address for the IRE_INTERFACE and IRE_LOCAL 2695 */ 2696 if (ip6_asp_can_lookup()) { 2697 ip6_asp_table_held = B_TRUE; 2698 src_ipif = ipif_select_source_v6(ipif->ipif_ill, 2699 &ipif->ipif_v6subnet, RESTRICT_TO_NONE, 2700 IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid); 2701 } 2702 if (src_ipif == NULL) 2703 src_ipif = ipif; /* Last resort */ 2704 else 2705 src_ipif_held = B_TRUE; 2706 } else { 2707 src_ipif = ipif; 2708 } 2709 2710 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 2711 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 2712 2713 /* 2714 * If we're on a labeled system then make sure that zone- 2715 * private addresses have proper remote host database entries. 2716 */ 2717 if (is_system_labeled() && 2718 ipif->ipif_ire_type != IRE_LOOPBACK) { 2719 if (ip6opt_ls == 0) { 2720 cmn_err(CE_WARN, "IPv6 not enabled " 2721 "via /etc/system"); 2722 return (EINVAL); 2723 } 2724 if (!tsol_check_interface_address(ipif)) 2725 return (EINVAL); 2726 } 2727 2728 /* Register the source address for __sin6_src_id */ 2729 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 2730 ipif->ipif_zoneid); 2731 if (err != 0) { 2732 ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err)); 2733 if (src_ipif_held) 2734 ipif_refrele(src_ipif); 2735 if (ip6_asp_table_held) 2736 ip6_asp_table_refrele(); 2737 return (err); 2738 } 2739 /* 2740 * If the interface address is set, create the LOCAL 2741 * or LOOPBACK IRE. 2742 */ 2743 ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n", 2744 ipif->ipif_ire_type, 2745 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 2746 buf, sizeof (buf)))); 2747 2748 *irep++ = ire_create_v6( 2749 &ipif->ipif_v6lcl_addr, /* dest address */ 2750 &ipv6_all_ones, /* mask */ 2751 &src_ipif->ipif_v6src_addr, /* source address */ 2752 NULL, /* no gateway */ 2753 &ip_loopback_mtu_v6plus, /* max frag size */ 2754 NULL, 2755 ipif->ipif_rq, /* recv-from queue */ 2756 NULL, /* no send-to queue */ 2757 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 2758 NULL, 2759 ipif, /* interface */ 2760 NULL, 2761 0, 2762 0, 2763 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2764 &ire_uinfo_null, 2765 NULL, 2766 NULL); 2767 } 2768 2769 /* 2770 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. 2771 * Note that atun interfaces have an all-zero ipif_v6subnet. 2772 * Thus we allow a zero subnet as long as the mask is non-zero. 2773 */ 2774 if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) && 2775 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2776 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2777 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2778 v6addr = ipif->ipif_v6subnet; 2779 2780 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2781 route_mask = ipv6_all_ones; 2782 } else { 2783 route_mask = ipif->ipif_v6net_mask; 2784 } 2785 2786 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n", 2787 ill->ill_net_type, 2788 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 2789 2790 *irep++ = ire_create_v6( 2791 &v6addr, /* dest pref */ 2792 &route_mask, /* mask */ 2793 &src_ipif->ipif_v6src_addr, /* src addr */ 2794 NULL, /* no gateway */ 2795 &ipif->ipif_mtu, /* max frag */ 2796 NULL, /* no Fast path header */ 2797 NULL, /* no recv from queue */ 2798 stq, /* send-to queue */ 2799 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2800 ill->ill_resolver_mp, /* xmit header */ 2801 ipif, 2802 NULL, 2803 0, 2804 0, 2805 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2806 &ire_uinfo_null, 2807 NULL, 2808 NULL); 2809 } 2810 2811 /* 2812 * Setup 2002::/16 route, if this interface is a 6to4 tunnel 2813 */ 2814 if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) && 2815 (ill->ill_is_6to4tun)) { 2816 /* 2817 * Destination address is 2002::/16 2818 */ 2819 #ifdef _BIG_ENDIAN 2820 const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 }; 2821 const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 }; 2822 #else 2823 const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 }; 2824 const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 }; 2825 #endif /* _BIG_ENDIAN */ 2826 char buf2[INET6_ADDRSTRLEN]; 2827 ire_t *isdup; 2828 in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr; 2829 2830 /* 2831 * check to see if this route has already been added for 2832 * this tunnel interface. 2833 */ 2834 isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0, 2835 IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL, 2836 (MATCH_IRE_SRC | MATCH_IRE_MASK)); 2837 2838 if (isdup == NULL) { 2839 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s", 2840 IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr, 2841 buf2, sizeof (buf2)))); 2842 2843 *irep++ = ire_create_v6( 2844 &prefix_addr, /* 2002:: */ 2845 &prefix_mask, /* ffff:: */ 2846 &ipif->ipif_v6lcl_addr, /* src addr */ 2847 NULL, /* gateway */ 2848 &ipif->ipif_mtu, /* max_frag */ 2849 NULL, /* no Fast Path hdr */ 2850 NULL, /* no rfq */ 2851 ill->ill_wq, /* stq */ 2852 IRE_IF_NORESOLVER, /* type */ 2853 ill->ill_resolver_mp, /* dlureq_mp */ 2854 ipif, /* interface */ 2855 NULL, /* v6cmask */ 2856 0, 2857 0, 2858 RTF_UP, 2859 &ire_uinfo_null, 2860 NULL, 2861 NULL); 2862 } else { 2863 ire_refrele(isdup); 2864 } 2865 } 2866 2867 /* If an earlier ire_create failed, get out now */ 2868 for (irep1 = irep; irep1 > ire_array; ) { 2869 irep1--; 2870 if (*irep1 == NULL) { 2871 ip1dbg(("ipif_up_done_v6: NULL ire found in" 2872 " ire_array\n")); 2873 err = ENOMEM; 2874 goto bad; 2875 } 2876 } 2877 2878 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2879 2880 /* 2881 * Need to atomically check for ip_addr_availablity_check 2882 * now under ill_g_lock, and if it fails got bad, and remove 2883 * from group also 2884 */ 2885 rw_enter(&ill_g_lock, RW_READER); 2886 mutex_enter(&ip_addr_avail_lock); 2887 ill->ill_ipif_up_count++; 2888 ipif->ipif_flags |= IPIF_UP; 2889 err = ip_addr_availability_check(ipif); 2890 mutex_exit(&ip_addr_avail_lock); 2891 rw_exit(&ill_g_lock); 2892 2893 if (err != 0) { 2894 /* 2895 * Our address may already be up on the same ill. In this case, 2896 * the external resolver entry for our ipif replaced the one for 2897 * the other ipif. So we don't want to delete it (otherwise the 2898 * other ipif would be unable to send packets). 2899 * ip_addr_availability_check() identifies this case for us and 2900 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL 2901 * which is the expected error code. 2902 */ 2903 if (err == EADDRINUSE) { 2904 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) { 2905 freemsg(ipif->ipif_arp_del_mp); 2906 ipif->ipif_arp_del_mp = NULL; 2907 } 2908 err = EADDRNOTAVAIL; 2909 } 2910 ill->ill_ipif_up_count--; 2911 ipif->ipif_flags &= ~IPIF_UP; 2912 goto bad; 2913 } 2914 2915 /* 2916 * Add in all newly created IREs. We want to add before 2917 * we call ifgrp_insert which wants to know whether 2918 * IRE_IF_RESOLVER exists or not. 2919 * 2920 * NOTE : We refrele the ire though we may branch to "bad" 2921 * later on where we do ire_delete. This is okay 2922 * because nobody can delete it as we are running 2923 * exclusively. 2924 */ 2925 for (irep1 = irep; irep1 > ire_array; ) { 2926 irep1--; 2927 /* Shouldn't be adding any bcast ire's */ 2928 ASSERT((*irep1)->ire_type != IRE_BROADCAST); 2929 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2930 /* 2931 * refheld by ire_add. refele towards the end of the func 2932 */ 2933 (void) ire_add(irep1, NULL, NULL, NULL, B_FALSE); 2934 } 2935 if (ip6_asp_table_held) { 2936 ip6_asp_table_refrele(); 2937 ip6_asp_table_held = B_FALSE; 2938 } 2939 ire_added = B_TRUE; 2940 2941 /* 2942 * Form groups if possible. 2943 * 2944 * If we are supposed to be in a ill_group with a name, insert it 2945 * now as we know that at least one ipif is UP. Otherwise form 2946 * nameless groups. 2947 * 2948 * If ip_enable_group_ifs is set and ipif address is not ::0, insert 2949 * this ipif into the appropriate interface group, or create a 2950 * new one. If this is already in a nameless group, we try to form 2951 * a bigger group looking at other ills potentially sharing this 2952 * ipif's prefix. 2953 */ 2954 phyi = ill->ill_phyint; 2955 if (phyi->phyint_groupname_len != 0) { 2956 ASSERT(phyi->phyint_groupname != NULL); 2957 if (ill->ill_ipif_up_count == 1) { 2958 ASSERT(ill->ill_group == NULL); 2959 err = illgrp_insert(&illgrp_head_v6, ill, 2960 phyi->phyint_groupname, NULL, B_TRUE); 2961 if (err != 0) { 2962 ip1dbg(("ipif_up_done_v6: illgrp allocation " 2963 "failed, error %d\n", err)); 2964 goto bad; 2965 } 2966 } 2967 ASSERT(ill->ill_group != NULL); 2968 } 2969 2970 /* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */ 2971 ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt; 2972 ipif_saved_irep = ipif_recover_ire_v6(ipif); 2973 2974 if (ipif->ipif_ipif_up_count == 1 && !loopback) { 2975 /* 2976 * Need to recover all multicast memberships in the driver. 2977 * This had to be deferred until we had attached. 2978 */ 2979 ill_recover_multicast(ill); 2980 } 2981 /* Join the allhosts multicast address and the solicited node MC */ 2982 ipif_multicast_up(ipif); 2983 2984 if (!loopback) { 2985 /* 2986 * See whether anybody else would benefit from the 2987 * new ipif that we added. We call this always rather 2988 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST 2989 * ipif for the benefit of illgrp_insert (done above) 2990 * which does not do source address selection as it does 2991 * not want to re-create interface routes that we are 2992 * having reference to it here. 2993 */ 2994 ill_update_source_selection(ill); 2995 } 2996 2997 for (irep1 = irep; irep1 > ire_array; ) { 2998 irep1--; 2999 if (*irep1 != NULL) { 3000 /* was held in ire_add */ 3001 ire_refrele(*irep1); 3002 } 3003 } 3004 3005 cnt = ipif_saved_ire_cnt; 3006 for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) { 3007 if (*irep1 != NULL) { 3008 /* was held in ire_add */ 3009 ire_refrele(*irep1); 3010 } 3011 } 3012 3013 if (ipif->ipif_addr_ready) { 3014 ip_rts_ifmsg(ipif); 3015 ip_rts_newaddrmsg(RTM_ADD, 0, ipif); 3016 sctp_update_ipif(ipif, SCTP_IPIF_UP); 3017 } 3018 3019 if (ipif_saved_irep != NULL) { 3020 kmem_free(ipif_saved_irep, 3021 ipif_saved_ire_cnt * sizeof (ire_t *)); 3022 } 3023 3024 if (src_ipif_held) 3025 ipif_refrele(src_ipif); 3026 return (0); 3027 3028 bad: 3029 if (ip6_asp_table_held) 3030 ip6_asp_table_refrele(); 3031 /* 3032 * We don't have to bother removing from ill groups because 3033 * 3034 * 1) For groups with names, we insert only when the first ipif 3035 * comes up. In that case if it fails, it will not be in any 3036 * group. So, we need not try to remove for that case. 3037 * 3038 * 2) For groups without names, either we tried to insert ipif_ill 3039 * in a group as singleton or found some other group to become 3040 * a bigger group. For the former, if it fails we don't have 3041 * anything to do as ipif_ill is not in the group and for the 3042 * latter, there are no failures in illgrp_insert/illgrp_delete 3043 * (ENOMEM can't occur for this. Check ifgrp_insert). 3044 */ 3045 3046 while (irep > ire_array) { 3047 irep--; 3048 if (*irep != NULL) { 3049 ire_delete(*irep); 3050 if (ire_added) 3051 ire_refrele(*irep); 3052 } 3053 3054 } 3055 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid); 3056 3057 if (ipif_saved_irep != NULL) { 3058 kmem_free(ipif_saved_irep, 3059 ipif_saved_ire_cnt * sizeof (ire_t *)); 3060 } 3061 if (src_ipif_held) 3062 ipif_refrele(src_ipif); 3063 3064 ipif_ndp_down(ipif); 3065 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) 3066 ipif_arp_down(ipif); 3067 3068 return (err); 3069 } 3070 3071 /* 3072 * Delete an ND entry and the corresponding IRE_CACHE entry if it exists. 3073 */ 3074 /* ARGSUSED */ 3075 int 3076 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3077 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3078 { 3079 in6_addr_t addr; 3080 sin6_t *sin6; 3081 nce_t *nce; 3082 struct lifreq *lifr; 3083 lif_nd_req_t *lnr; 3084 mblk_t *mp1; 3085 3086 mp1 = mp->b_cont->b_cont; 3087 lifr = (struct lifreq *)mp1->b_rptr; 3088 lnr = &lifr->lifr_nd; 3089 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3090 if (ipif->ipif_id != 0) 3091 return (EINVAL); 3092 3093 if (!ipif->ipif_isv6) 3094 return (EINVAL); 3095 3096 if (lnr->lnr_addr.ss_family != AF_INET6) 3097 return (EAFNOSUPPORT); 3098 3099 sin6 = (sin6_t *)&lnr->lnr_addr; 3100 addr = sin6->sin6_addr; 3101 nce = ndp_lookup_v6(ipif->ipif_ill, &addr, B_FALSE); 3102 if (nce == NULL) 3103 return (ESRCH); 3104 ndp_delete(nce); 3105 NCE_REFRELE(nce); 3106 return (0); 3107 } 3108 3109 /* 3110 * Return nbr cache info. 3111 */ 3112 /* ARGSUSED */ 3113 int 3114 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3115 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3116 { 3117 ill_t *ill = ipif->ipif_ill; 3118 struct lifreq *lifr; 3119 lif_nd_req_t *lnr; 3120 3121 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3122 lnr = &lifr->lifr_nd; 3123 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3124 if (ipif->ipif_id != 0) 3125 return (EINVAL); 3126 3127 if (!ipif->ipif_isv6) 3128 return (EINVAL); 3129 3130 if (lnr->lnr_addr.ss_family != AF_INET6) 3131 return (EAFNOSUPPORT); 3132 3133 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 3134 return (EINVAL); 3135 3136 return (ndp_query(ill, lnr)); 3137 } 3138 3139 /* 3140 * Perform an update of the nd entry for the specified address. 3141 */ 3142 /* ARGSUSED */ 3143 int 3144 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3145 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3146 { 3147 ill_t *ill = ipif->ipif_ill; 3148 struct lifreq *lifr; 3149 lif_nd_req_t *lnr; 3150 3151 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3152 lnr = &lifr->lifr_nd; 3153 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3154 if (ipif->ipif_id != 0) 3155 return (EINVAL); 3156 3157 if (!ipif->ipif_isv6) 3158 return (EINVAL); 3159 3160 if (lnr->lnr_addr.ss_family != AF_INET6) 3161 return (EAFNOSUPPORT); 3162 3163 return (ndp_sioc_update(ill, lnr)); 3164 } 3165