1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 1990 Mentat Inc. 27 */ 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 /* 32 * This file contains the interface control functions for IPv6. 33 */ 34 35 #include <sys/types.h> 36 #include <sys/sysmacros.h> 37 #include <sys/stream.h> 38 #include <sys/dlpi.h> 39 #include <sys/stropts.h> 40 #include <sys/ddi.h> 41 #include <sys/cmn_err.h> 42 #include <sys/kstat.h> 43 #include <sys/debug.h> 44 #include <sys/zone.h> 45 #include <sys/policy.h> 46 47 #include <sys/systm.h> 48 #include <sys/param.h> 49 #include <sys/socket.h> 50 #include <sys/isa_defs.h> 51 #include <net/if.h> 52 #include <net/if_dl.h> 53 #include <net/route.h> 54 #include <netinet/in.h> 55 #include <netinet/igmp_var.h> 56 #include <netinet/ip6.h> 57 #include <netinet/icmp6.h> 58 #include <netinet/in.h> 59 60 #include <inet/common.h> 61 #include <inet/nd.h> 62 #include <inet/mib2.h> 63 #include <inet/ip.h> 64 #include <inet/ip6.h> 65 #include <inet/ip_multi.h> 66 #include <inet/ip_ire.h> 67 #include <inet/ip_rts.h> 68 #include <inet/ip_ndp.h> 69 #include <inet/ip_if.h> 70 #include <inet/ip6_asp.h> 71 #include <inet/tun.h> 72 #include <inet/ipclassifier.h> 73 #include <inet/sctp_ip.h> 74 75 #include <sys/tsol/tndb.h> 76 #include <sys/tsol/tnet.h> 77 78 static in6_addr_t ipv6_ll_template = 79 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 80 81 static ipif_t * 82 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 83 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst); 84 85 /* 86 * These two functions, ipif_lookup_group_v6() and ill_lookup_group_v6(), 87 * are called when an application does not specify an interface to be 88 * used for multicast traffic. It calls ire_lookup_multi_v6() to look 89 * for an interface route for the specified multicast group. Doing 90 * this allows the administrator to add prefix routes for multicast to 91 * indicate which interface to be used for multicast traffic in the above 92 * scenario. The route could be for all multicast (ff00::/8), for a single 93 * multicast group (a /128 route) or anything in between. If there is no 94 * such multicast route, we just find any multicast capable interface and 95 * return it. 96 */ 97 ipif_t * 98 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst) 99 { 100 ire_t *ire; 101 ipif_t *ipif; 102 103 ire = ire_lookup_multi_v6(group, zoneid, ipst); 104 if (ire != NULL) { 105 ipif = ire->ire_ipif; 106 ipif_refhold(ipif); 107 ire_refrele(ire); 108 return (ipif); 109 } 110 111 return (ipif_lookup_multicast(ipst, zoneid, B_TRUE)); 112 } 113 114 ill_t * 115 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst) 116 { 117 ire_t *ire; 118 ill_t *ill; 119 ipif_t *ipif; 120 121 ire = ire_lookup_multi_v6(group, zoneid, ipst); 122 if (ire != NULL) { 123 ill = ire->ire_ipif->ipif_ill; 124 ill_refhold(ill); 125 ire_refrele(ire); 126 return (ill); 127 } 128 129 ipif = ipif_lookup_multicast(ipst, zoneid, B_TRUE); 130 if (ipif == NULL) 131 return (NULL); 132 133 ill = ipif->ipif_ill; 134 ill_refhold(ill); 135 ipif_refrele(ipif); 136 return (ill); 137 } 138 139 /* 140 * Look for an ipif with the specified interface address and destination. 141 * The destination address is used only for matching point-to-point interfaces. 142 */ 143 static ipif_t * 144 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 145 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst) 146 { 147 ipif_t *ipif; 148 ill_t *ill; 149 ipsq_t *ipsq; 150 ill_walk_context_t ctx; 151 152 if (error != NULL) 153 *error = 0; 154 155 /* 156 * First match all the point-to-point interfaces 157 * before looking at non-point-to-point interfaces. 158 * This is done to avoid returning non-point-to-point 159 * ipif instead of unnumbered point-to-point ipif. 160 */ 161 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 162 ill = ILL_START_WALK_V6(&ctx, ipst); 163 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 164 GRAB_CONN_LOCK(q); 165 mutex_enter(&ill->ill_lock); 166 for (ipif = ill->ill_ipif; ipif != NULL; 167 ipif = ipif->ipif_next) { 168 /* Allow the ipif to be down */ 169 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 170 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 171 if_addr)) && 172 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 173 dst))) { 174 if (IPIF_CAN_LOOKUP(ipif)) { 175 ipif_refhold_locked(ipif); 176 mutex_exit(&ill->ill_lock); 177 RELEASE_CONN_LOCK(q); 178 rw_exit(&ipst->ips_ill_g_lock); 179 return (ipif); 180 } else if (IPIF_CAN_WAIT(ipif, q)) { 181 ipsq = ill->ill_phyint->phyint_ipsq; 182 mutex_enter(&ipsq->ipsq_lock); 183 mutex_exit(&ill->ill_lock); 184 rw_exit(&ipst->ips_ill_g_lock); 185 ipsq_enq(ipsq, q, mp, func, NEW_OP, 186 ill); 187 mutex_exit(&ipsq->ipsq_lock); 188 RELEASE_CONN_LOCK(q); 189 *error = EINPROGRESS; 190 return (NULL); 191 } 192 } 193 } 194 mutex_exit(&ill->ill_lock); 195 RELEASE_CONN_LOCK(q); 196 } 197 rw_exit(&ipst->ips_ill_g_lock); 198 /* lookup the ipif based on interface address */ 199 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func, 200 error, ipst); 201 ASSERT(ipif == NULL || ipif->ipif_isv6); 202 return (ipif); 203 } 204 205 /* 206 * Look for an ipif with the specified address. For point-point links 207 * we look for matches on either the destination address and the local 208 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 209 * is set. 210 * Matches on a specific ill if match_ill is set. 211 */ 212 /* ARGSUSED */ 213 ipif_t * 214 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 215 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst) 216 { 217 ipif_t *ipif; 218 ill_t *ill; 219 boolean_t ptp = B_FALSE; 220 ipsq_t *ipsq; 221 ill_walk_context_t ctx; 222 223 if (error != NULL) 224 *error = 0; 225 226 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 227 /* 228 * Repeat twice, first based on local addresses and 229 * next time for pointopoint. 230 */ 231 repeat: 232 ill = ILL_START_WALK_V6(&ctx, ipst); 233 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 234 if (match_ill != NULL && ill != match_ill) { 235 continue; 236 } 237 GRAB_CONN_LOCK(q); 238 mutex_enter(&ill->ill_lock); 239 for (ipif = ill->ill_ipif; ipif != NULL; 240 ipif = ipif->ipif_next) { 241 if (zoneid != ALL_ZONES && 242 ipif->ipif_zoneid != zoneid && 243 ipif->ipif_zoneid != ALL_ZONES) 244 continue; 245 /* Allow the ipif to be down */ 246 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 247 &ipif->ipif_v6lcl_addr, addr) && 248 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 249 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 250 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 251 addr))) { 252 if (IPIF_CAN_LOOKUP(ipif)) { 253 ipif_refhold_locked(ipif); 254 mutex_exit(&ill->ill_lock); 255 RELEASE_CONN_LOCK(q); 256 rw_exit(&ipst->ips_ill_g_lock); 257 return (ipif); 258 } else if (IPIF_CAN_WAIT(ipif, q)) { 259 ipsq = ill->ill_phyint->phyint_ipsq; 260 mutex_enter(&ipsq->ipsq_lock); 261 mutex_exit(&ill->ill_lock); 262 rw_exit(&ipst->ips_ill_g_lock); 263 ipsq_enq(ipsq, q, mp, func, NEW_OP, 264 ill); 265 mutex_exit(&ipsq->ipsq_lock); 266 RELEASE_CONN_LOCK(q); 267 *error = EINPROGRESS; 268 return (NULL); 269 } 270 } 271 } 272 mutex_exit(&ill->ill_lock); 273 RELEASE_CONN_LOCK(q); 274 } 275 276 /* If we already did the ptp case, then we are done */ 277 if (ptp) { 278 rw_exit(&ipst->ips_ill_g_lock); 279 if (error != NULL) 280 *error = ENXIO; 281 return (NULL); 282 } 283 ptp = B_TRUE; 284 goto repeat; 285 } 286 287 /* 288 * Look for an ipif with the specified address. For point-point links 289 * we look for matches on either the destination address and the local 290 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 291 * is set. 292 * Matches on a specific ill if match_ill is set. 293 * Return the zoneid for the ipif. ALL_ZONES if none found. 294 */ 295 zoneid_t 296 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill, 297 ip_stack_t *ipst) 298 { 299 ipif_t *ipif; 300 ill_t *ill; 301 boolean_t ptp = B_FALSE; 302 ill_walk_context_t ctx; 303 zoneid_t zoneid; 304 305 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 306 /* 307 * Repeat twice, first based on local addresses and 308 * next time for pointopoint. 309 */ 310 repeat: 311 ill = ILL_START_WALK_V6(&ctx, ipst); 312 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 313 if (match_ill != NULL && ill != match_ill) { 314 continue; 315 } 316 mutex_enter(&ill->ill_lock); 317 for (ipif = ill->ill_ipif; ipif != NULL; 318 ipif = ipif->ipif_next) { 319 /* Allow the ipif to be down */ 320 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 321 &ipif->ipif_v6lcl_addr, addr) && 322 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 323 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 324 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 325 addr)) && 326 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) { 327 zoneid = ipif->ipif_zoneid; 328 mutex_exit(&ill->ill_lock); 329 rw_exit(&ipst->ips_ill_g_lock); 330 /* 331 * If ipif_zoneid was ALL_ZONES then we have 332 * a trusted extensions shared IP address. 333 * In that case GLOBAL_ZONEID works to send. 334 */ 335 if (zoneid == ALL_ZONES) 336 zoneid = GLOBAL_ZONEID; 337 return (zoneid); 338 } 339 } 340 mutex_exit(&ill->ill_lock); 341 } 342 343 /* If we already did the ptp case, then we are done */ 344 if (ptp) { 345 rw_exit(&ipst->ips_ill_g_lock); 346 return (ALL_ZONES); 347 } 348 ptp = B_TRUE; 349 goto repeat; 350 } 351 352 /* 353 * Perform various checks to verify that an address would make sense as a local 354 * interface address. This is currently only called when an attempt is made 355 * to set a local address. 356 * 357 * Does not allow a v4-mapped address, an address that equals the subnet 358 * anycast address, ... a multicast address, ... 359 */ 360 boolean_t 361 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 362 { 363 in6_addr_t subnet; 364 365 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 366 return (B_TRUE); /* Allow all zeros */ 367 368 /* 369 * Don't allow all zeroes or host part, but allow 370 * all ones netmask. 371 */ 372 V6_MASK_COPY(*addr, *subnet_mask, subnet); 373 if (IN6_IS_ADDR_V4MAPPED(addr) || 374 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 375 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 376 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 377 IN6_IS_ADDR_MULTICAST(addr)) 378 return (B_FALSE); 379 380 return (B_TRUE); 381 } 382 383 /* 384 * Perform various checks to verify that an address would make sense as a 385 * remote/subnet interface address. 386 */ 387 boolean_t 388 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 389 { 390 in6_addr_t subnet; 391 392 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 393 return (B_TRUE); /* Allow all zeros */ 394 395 V6_MASK_COPY(*addr, *subnet_mask, subnet); 396 if (IN6_IS_ADDR_V4MAPPED(addr) || 397 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 398 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 399 IN6_IS_ADDR_MULTICAST(addr) || 400 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 401 return (B_FALSE); 402 403 return (B_TRUE); 404 } 405 406 /* 407 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 408 * ipif_arg is passed in to associate it with the correct interface 409 * (for link-local destinations and gateways). 410 */ 411 /* ARGSUSED1 */ 412 int 413 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 414 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 415 ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func, 416 struct rtsa_s *sp, ip_stack_t *ipst) 417 { 418 ire_t *ire; 419 ire_t *gw_ire = NULL; 420 ipif_t *ipif; 421 boolean_t ipif_refheld = B_FALSE; 422 uint_t type; 423 int match_flags = MATCH_IRE_TYPE; 424 int error; 425 tsol_gc_t *gc = NULL; 426 tsol_gcgrp_t *gcgrp = NULL; 427 boolean_t gcgrp_xtraref = B_FALSE; 428 429 if (ire_arg != NULL) 430 *ire_arg = NULL; 431 432 /* 433 * Prevent routes with a zero gateway from being created (since 434 * interfaces can currently be plumbed and brought up with no assigned 435 * address). 436 */ 437 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 438 return (ENETUNREACH); 439 440 /* 441 * If this is the case of RTF_HOST being set, then we set the netmask 442 * to all ones (regardless if one was supplied). 443 */ 444 if (flags & RTF_HOST) 445 mask = &ipv6_all_ones; 446 447 /* 448 * Get the ipif, if any, corresponding to the gw_addr 449 */ 450 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, 451 &error, ipst); 452 if (ipif != NULL) 453 ipif_refheld = B_TRUE; 454 else if (error == EINPROGRESS) { 455 ip1dbg(("ip_rt_add_v6: null and EINPROGRESS")); 456 return (error); 457 } 458 459 /* 460 * GateD will attempt to create routes with a loopback interface 461 * address as the gateway and with RTF_GATEWAY set. We allow 462 * these routes to be added, but create them as interface routes 463 * since the gateway is an interface address. 464 */ 465 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) { 466 flags &= ~RTF_GATEWAY; 467 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) && 468 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) && 469 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) { 470 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 471 ipif, ALL_ZONES, NULL, match_flags, ipst); 472 if (ire != NULL) { 473 ire_refrele(ire); 474 if (ipif_refheld) 475 ipif_refrele(ipif); 476 return (EEXIST); 477 } 478 ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x" 479 "for 0x%x\n", (void *)ipif, 480 ipif->ipif_ire_type, 481 ntohl(ipif->ipif_lcl_addr))); 482 ire = ire_create_v6( 483 dst_addr, 484 mask, 485 &ipif->ipif_v6src_addr, 486 NULL, 487 &ipif->ipif_mtu, 488 NULL, 489 NULL, 490 NULL, 491 ipif->ipif_net_type, 492 ipif->ipif_resolver_mp, 493 ipif, 494 NULL, 495 0, 496 0, 497 flags, 498 &ire_uinfo_null, 499 NULL, 500 NULL, 501 ipst); 502 if (ire == NULL) { 503 if (ipif_refheld) 504 ipif_refrele(ipif); 505 return (ENOMEM); 506 } 507 error = ire_add(&ire, q, mp, func, B_FALSE); 508 if (error == 0) 509 goto save_ire; 510 /* 511 * In the result of failure, ire_add() will have already 512 * deleted the ire in question, so there is no need to 513 * do that here. 514 */ 515 if (ipif_refheld) 516 ipif_refrele(ipif); 517 return (error); 518 } 519 } 520 521 /* 522 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 523 * and the gateway address provided is one of the system's interface 524 * addresses. By using the routing socket interface and supplying an 525 * RTA_IFP sockaddr with an interface index, an alternate method of 526 * specifying an interface route to be created is available which uses 527 * the interface index that specifies the outgoing interface rather than 528 * the address of an outgoing interface (which may not be able to 529 * uniquely identify an interface). When coupled with the RTF_GATEWAY 530 * flag, routes can be specified which not only specify the next-hop to 531 * be used when routing to a certain prefix, but also which outgoing 532 * interface should be used. 533 * 534 * Previously, interfaces would have unique addresses assigned to them 535 * and so the address assigned to a particular interface could be used 536 * to identify a particular interface. One exception to this was the 537 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 538 * 539 * With the advent of IPv6 and its link-local addresses, this 540 * restriction was relaxed and interfaces could share addresses between 541 * themselves. In fact, typically all of the link-local interfaces on 542 * an IPv6 node or router will have the same link-local address. In 543 * order to differentiate between these interfaces, the use of an 544 * interface index is necessary and this index can be carried inside a 545 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 546 * of using the interface index, however, is that all of the ipif's that 547 * are part of an ill have the same index and so the RTA_IFP sockaddr 548 * cannot be used to differentiate between ipif's (or logical 549 * interfaces) that belong to the same ill (physical interface). 550 * 551 * For example, in the following case involving IPv4 interfaces and 552 * logical interfaces 553 * 554 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 555 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0:1 556 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0:2 557 * 558 * the ipif's corresponding to each of these interface routes can be 559 * uniquely identified by the "gateway" (actually interface address). 560 * 561 * In this case involving multiple IPv6 default routes to a particular 562 * link-local gateway, the use of RTA_IFP is necessary to specify which 563 * default route is of interest: 564 * 565 * default fe80::123:4567:89ab:cdef U if0 566 * default fe80::123:4567:89ab:cdef U if1 567 */ 568 569 /* RTF_GATEWAY not set */ 570 if (!(flags & RTF_GATEWAY)) { 571 queue_t *stq; 572 573 if (sp != NULL) { 574 ip2dbg(("ip_rt_add_v6: gateway security attributes " 575 "cannot be set with interface route\n")); 576 if (ipif_refheld) 577 ipif_refrele(ipif); 578 return (EINVAL); 579 } 580 581 /* 582 * As the interface index specified with the RTA_IFP sockaddr is 583 * the same for all ipif's off of an ill, the matching logic 584 * below uses MATCH_IRE_ILL if such an index was specified. 585 * This means that routes sharing the same prefix when added 586 * using a RTA_IFP sockaddr must have distinct interface 587 * indices (namely, they must be on distinct ill's). 588 * 589 * On the other hand, since the gateway address will usually be 590 * different for each ipif on the system, the matching logic 591 * uses MATCH_IRE_IPIF in the case of a traditional interface 592 * route. This means that interface routes for the same prefix 593 * can be created if they belong to distinct ipif's and if a 594 * RTA_IFP sockaddr is not present. 595 */ 596 if (ipif_arg != NULL) { 597 if (ipif_refheld) { 598 ipif_refrele(ipif); 599 ipif_refheld = B_FALSE; 600 } 601 ipif = ipif_arg; 602 match_flags |= MATCH_IRE_ILL; 603 } else { 604 /* 605 * Check the ipif corresponding to the gw_addr 606 */ 607 if (ipif == NULL) 608 return (ENETUNREACH); 609 match_flags |= MATCH_IRE_IPIF; 610 } 611 612 ASSERT(ipif != NULL); 613 /* 614 * We check for an existing entry at this point. 615 */ 616 match_flags |= MATCH_IRE_MASK; 617 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE, 618 ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 619 if (ire != NULL) { 620 ire_refrele(ire); 621 if (ipif_refheld) 622 ipif_refrele(ipif); 623 return (EEXIST); 624 } 625 626 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 627 ? ipif->ipif_rq : ipif->ipif_wq; 628 629 /* 630 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or 631 * IRE_IF_RESOLVER with the modified address and netmask. 632 */ 633 ire = ire_create_v6( 634 dst_addr, 635 mask, 636 &ipif->ipif_v6src_addr, 637 NULL, 638 &ipif->ipif_mtu, 639 NULL, 640 NULL, 641 stq, 642 ipif->ipif_net_type, 643 ipif->ipif_resolver_mp, 644 ipif, 645 NULL, 646 0, 647 0, 648 flags, 649 &ire_uinfo_null, 650 NULL, 651 NULL, 652 ipst); 653 if (ire == NULL) { 654 if (ipif_refheld) 655 ipif_refrele(ipif); 656 return (ENOMEM); 657 } 658 659 /* 660 * Some software (for example, GateD and Sun Cluster) attempts 661 * to create (what amount to) IRE_PREFIX routes with the 662 * loopback address as the gateway. This is primarily done to 663 * set up prefixes with the RTF_REJECT flag set (for example, 664 * when generating aggregate routes.) 665 * 666 * If the IRE type (as defined by ipif->ipif_net_type) is 667 * IRE_LOOPBACK, then we map the request into a 668 * IRE_IF_NORESOLVER. 669 * 670 * Needless to say, the real IRE_LOOPBACK is NOT created by this 671 * routine, but rather using ire_create_v6() directly. 672 */ 673 if (ipif->ipif_net_type == IRE_LOOPBACK) 674 ire->ire_type = IRE_IF_NORESOLVER; 675 error = ire_add(&ire, q, mp, func, B_FALSE); 676 if (error == 0) 677 goto save_ire; 678 /* 679 * In the result of failure, ire_add() will have already 680 * deleted the ire in question, so there is no need to 681 * do that here. 682 */ 683 if (ipif_refheld) 684 ipif_refrele(ipif); 685 return (error); 686 } 687 if (ipif_refheld) { 688 ipif_refrele(ipif); 689 ipif_refheld = B_FALSE; 690 } 691 692 /* 693 * Get an interface IRE for the specified gateway. 694 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 695 * gateway, it is currently unreachable and we fail the request 696 * accordingly. 697 */ 698 ipif = ipif_arg; 699 if (ipif_arg != NULL) 700 match_flags |= MATCH_IRE_ILL; 701 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, 702 NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 703 if (gw_ire == NULL) 704 return (ENETUNREACH); 705 706 /* 707 * We create one of three types of IREs as a result of this request 708 * based on the netmask. A netmask of all ones (which is automatically 709 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 710 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 711 * created. Otherwise, an IRE_PREFIX route is created for the 712 * destination prefix. 713 */ 714 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 715 type = IRE_HOST; 716 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 717 type = IRE_DEFAULT; 718 else 719 type = IRE_PREFIX; 720 721 /* check for a duplicate entry */ 722 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg, 723 NULL, ALL_ZONES, 0, NULL, 724 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst); 725 if (ire != NULL) { 726 ire_refrele(gw_ire); 727 ire_refrele(ire); 728 return (EEXIST); 729 } 730 731 /* Security attribute exists */ 732 if (sp != NULL) { 733 tsol_gcgrp_addr_t ga; 734 735 /* find or create the gateway credentials group */ 736 ga.ga_af = AF_INET6; 737 ga.ga_addr = *gw_addr; 738 739 /* we hold reference to it upon success */ 740 gcgrp = gcgrp_lookup(&ga, B_TRUE); 741 if (gcgrp == NULL) { 742 ire_refrele(gw_ire); 743 return (ENOMEM); 744 } 745 746 /* 747 * Create and add the security attribute to the group; a 748 * reference to the group is made upon allocating a new 749 * entry successfully. If it finds an already-existing 750 * entry for the security attribute in the group, it simply 751 * returns it and no new reference is made to the group. 752 */ 753 gc = gc_create(sp, gcgrp, &gcgrp_xtraref); 754 if (gc == NULL) { 755 /* release reference held by gcgrp_lookup */ 756 GCGRP_REFRELE(gcgrp); 757 ire_refrele(gw_ire); 758 return (ENOMEM); 759 } 760 } 761 762 /* Create the IRE. */ 763 ire = ire_create_v6( 764 dst_addr, /* dest address */ 765 mask, /* mask */ 766 /* src address assigned by the caller? */ 767 (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ? 768 src_addr : NULL), 769 gw_addr, /* gateway address */ 770 &gw_ire->ire_max_frag, 771 NULL, /* no Fast Path header */ 772 NULL, /* no recv-from queue */ 773 NULL, /* no send-to queue */ 774 (ushort_t)type, /* IRE type */ 775 NULL, 776 ipif_arg, 777 NULL, 778 0, 779 0, 780 flags, 781 &gw_ire->ire_uinfo, /* Inherit ULP info from gw */ 782 gc, /* security attribute */ 783 NULL, 784 ipst); 785 786 /* 787 * The ire holds a reference to the 'gc' and the 'gc' holds a 788 * reference to the 'gcgrp'. We can now release the extra reference 789 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used. 790 */ 791 if (gcgrp_xtraref) 792 GCGRP_REFRELE(gcgrp); 793 if (ire == NULL) { 794 if (gc != NULL) 795 GC_REFRELE(gc); 796 ire_refrele(gw_ire); 797 return (ENOMEM); 798 } 799 800 /* 801 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 802 * SUN/OS socket stuff does but do we really want to allow ::0 ? 803 */ 804 805 /* Add the new IRE. */ 806 error = ire_add(&ire, q, mp, func, B_FALSE); 807 /* 808 * In the result of failure, ire_add() will have already 809 * deleted the ire in question, so there is no need to 810 * do that here. 811 */ 812 if (error != 0) { 813 ire_refrele(gw_ire); 814 return (error); 815 } 816 817 if (flags & RTF_MULTIRT) { 818 /* 819 * Invoke the CGTP (multirouting) filtering module 820 * to add the dst address in the filtering database. 821 * Replicated inbound packets coming from that address 822 * will be filtered to discard the duplicates. 823 * It is not necessary to call the CGTP filter hook 824 * when the dst address is a multicast, because an 825 * IP source address cannot be a multicast. 826 */ 827 if ((ip_cgtp_filter_ops != NULL) && 828 ipst->ips_netstack->netstack_stackid == GLOBAL_NETSTACKID && 829 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 830 int res = ip_cgtp_filter_ops->cfo_add_dest_v6( 831 &ire->ire_addr_v6, 832 &ire->ire_gateway_addr_v6, 833 &ire->ire_src_addr_v6, 834 &gw_ire->ire_src_addr_v6); 835 if (res != 0) { 836 ire_refrele(gw_ire); 837 ire_delete(ire); 838 return (res); 839 } 840 } 841 } 842 843 /* 844 * Now that the prefix IRE entry has been created, delete any 845 * existing gateway IRE cache entries as well as any IRE caches 846 * using the gateway, and force them to be created through 847 * ip_newroute_v6. 848 */ 849 if (gc != NULL) { 850 ASSERT(gcgrp != NULL); 851 ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES, ipst); 852 } 853 854 save_ire: 855 if (gw_ire != NULL) { 856 ire_refrele(gw_ire); 857 } 858 if (ipif != NULL) { 859 mblk_t *save_mp; 860 861 /* 862 * Save enough information so that we can recreate the IRE if 863 * the interface goes down and then up. The metrics associated 864 * with the route will be saved as well when rts_setmetrics() is 865 * called after the IRE has been created. In the case where 866 * memory cannot be allocated, none of this information will be 867 * saved. 868 */ 869 save_mp = allocb(sizeof (ifrt_t), BPRI_MED); 870 if (save_mp != NULL) { 871 ifrt_t *ifrt; 872 873 save_mp->b_wptr += sizeof (ifrt_t); 874 ifrt = (ifrt_t *)save_mp->b_rptr; 875 bzero(ifrt, sizeof (ifrt_t)); 876 ifrt->ifrt_type = ire->ire_type; 877 ifrt->ifrt_v6addr = ire->ire_addr_v6; 878 mutex_enter(&ire->ire_lock); 879 ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6; 880 ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6; 881 mutex_exit(&ire->ire_lock); 882 ifrt->ifrt_v6mask = ire->ire_mask_v6; 883 ifrt->ifrt_flags = ire->ire_flags; 884 ifrt->ifrt_max_frag = ire->ire_max_frag; 885 mutex_enter(&ipif->ipif_saved_ire_lock); 886 save_mp->b_cont = ipif->ipif_saved_ire_mp; 887 ipif->ipif_saved_ire_mp = save_mp; 888 ipif->ipif_saved_ire_cnt++; 889 mutex_exit(&ipif->ipif_saved_ire_lock); 890 } 891 } 892 if (ire_arg != NULL) { 893 /* 894 * Store the ire that was successfully added into where ire_arg 895 * points to so that callers don't have to look it up 896 * themselves (but they are responsible for ire_refrele()ing 897 * the ire when they are finished with it). 898 */ 899 *ire_arg = ire; 900 } else { 901 ire_refrele(ire); /* Held in ire_add */ 902 } 903 if (ipif_refheld) 904 ipif_refrele(ipif); 905 return (0); 906 } 907 908 /* 909 * ip_rt_delete_v6 is called to delete an IPv6 route. 910 * ipif_arg is passed in to associate it with the correct interface 911 * (for link-local destinations and gateways). 912 */ 913 /* ARGSUSED4 */ 914 int 915 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 916 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg, 917 queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst) 918 { 919 ire_t *ire = NULL; 920 ipif_t *ipif; 921 uint_t type; 922 uint_t match_flags = MATCH_IRE_TYPE; 923 int err = 0; 924 boolean_t ipif_refheld = B_FALSE; 925 926 /* 927 * If this is the case of RTF_HOST being set, then we set the netmask 928 * to all ones. Otherwise, we use the netmask if one was supplied. 929 */ 930 if (flags & RTF_HOST) { 931 mask = &ipv6_all_ones; 932 match_flags |= MATCH_IRE_MASK; 933 } else if (rtm_addrs & RTA_NETMASK) { 934 match_flags |= MATCH_IRE_MASK; 935 } 936 937 /* 938 * Note that RTF_GATEWAY is never set on a delete, therefore 939 * we check if the gateway address is one of our interfaces first, 940 * and fall back on RTF_GATEWAY routes. 941 * 942 * This makes it possible to delete an original 943 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 944 * 945 * As the interface index specified with the RTA_IFP sockaddr is the 946 * same for all ipif's off of an ill, the matching logic below uses 947 * MATCH_IRE_ILL if such an index was specified. This means a route 948 * sharing the same prefix and interface index as the the route 949 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr 950 * is specified in the request. 951 * 952 * On the other hand, since the gateway address will usually be 953 * different for each ipif on the system, the matching logic 954 * uses MATCH_IRE_IPIF in the case of a traditional interface 955 * route. This means that interface routes for the same prefix can be 956 * uniquely identified if they belong to distinct ipif's and if a 957 * RTA_IFP sockaddr is not present. 958 * 959 * For more detail on specifying routes by gateway address and by 960 * interface index, see the comments in ip_rt_add_v6(). 961 */ 962 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err, 963 ipst); 964 if (ipif != NULL) { 965 ipif_refheld = B_TRUE; 966 if (ipif_arg != NULL) { 967 ipif_refrele(ipif); 968 ipif_refheld = B_FALSE; 969 ipif = ipif_arg; 970 match_flags |= MATCH_IRE_ILL; 971 } else { 972 match_flags |= MATCH_IRE_IPIF; 973 } 974 975 if (ipif->ipif_ire_type == IRE_LOOPBACK) 976 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 977 ipif, ALL_ZONES, NULL, match_flags, ipst); 978 if (ire == NULL) 979 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, 980 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL, 981 match_flags, ipst); 982 } else if (err == EINPROGRESS) { 983 return (err); 984 } else { 985 err = 0; 986 } 987 if (ire == NULL) { 988 /* 989 * At this point, the gateway address is not one of our own 990 * addresses or a matching interface route was not found. We 991 * set the IRE type to lookup based on whether 992 * this is a host route, a default route or just a prefix. 993 * 994 * If an ipif_arg was passed in, then the lookup is based on an 995 * interface index so MATCH_IRE_ILL is added to match_flags. 996 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is 997 * set as the route being looked up is not a traditional 998 * interface route. 999 */ 1000 match_flags &= ~MATCH_IRE_IPIF; 1001 match_flags |= MATCH_IRE_GW; 1002 if (ipif_arg != NULL) 1003 match_flags |= MATCH_IRE_ILL; 1004 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 1005 type = IRE_HOST; 1006 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 1007 type = IRE_DEFAULT; 1008 else 1009 type = IRE_PREFIX; 1010 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 1011 ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 1012 } 1013 1014 if (ipif_refheld) { 1015 ipif_refrele(ipif); 1016 ipif_refheld = B_FALSE; 1017 } 1018 if (ire == NULL) 1019 return (ESRCH); 1020 1021 if (ire->ire_flags & RTF_MULTIRT) { 1022 /* 1023 * Invoke the CGTP (multirouting) filtering module 1024 * to remove the dst address from the filtering database. 1025 * Packets coming from that address will no longer be 1026 * filtered to remove duplicates. 1027 */ 1028 if (ip_cgtp_filter_ops != NULL && 1029 ipst->ips_netstack->netstack_stackid == GLOBAL_NETSTACKID) { 1030 err = ip_cgtp_filter_ops->cfo_del_dest_v6( 1031 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 1032 } 1033 } 1034 1035 ipif = ire->ire_ipif; 1036 if (ipif != NULL) { 1037 mblk_t **mpp; 1038 mblk_t *mp; 1039 ifrt_t *ifrt; 1040 in6_addr_t gw_addr_v6; 1041 1042 /* Remove from ipif_saved_ire_mp list if it is there */ 1043 mutex_enter(&ire->ire_lock); 1044 gw_addr_v6 = ire->ire_gateway_addr_v6; 1045 mutex_exit(&ire->ire_lock); 1046 mutex_enter(&ipif->ipif_saved_ire_lock); 1047 for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL; 1048 mpp = &(*mpp)->b_cont) { 1049 /* 1050 * On a given ipif, the triple of address, gateway and 1051 * mask is unique for each saved IRE (in the case of 1052 * ordinary interface routes, the gateway address is 1053 * all-zeroes). 1054 */ 1055 mp = *mpp; 1056 ifrt = (ifrt_t *)mp->b_rptr; 1057 if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr, 1058 &ire->ire_addr_v6) && 1059 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr, 1060 &gw_addr_v6) && 1061 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask, 1062 &ire->ire_mask_v6)) { 1063 *mpp = mp->b_cont; 1064 ipif->ipif_saved_ire_cnt--; 1065 freeb(mp); 1066 break; 1067 } 1068 } 1069 mutex_exit(&ipif->ipif_saved_ire_lock); 1070 } 1071 ire_delete(ire); 1072 ire_refrele(ire); 1073 return (err); 1074 } 1075 1076 /* 1077 * Derive a token from the link layer address. 1078 */ 1079 boolean_t 1080 ill_setdefaulttoken(ill_t *ill) 1081 { 1082 int i; 1083 in6_addr_t v6addr, v6mask; 1084 1085 if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length, 1086 ill->ill_phys_addr, &v6addr)) 1087 return (B_FALSE); 1088 1089 (void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask); 1090 1091 for (i = 0; i < 4; i++) 1092 v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^ 1093 (uint32_t)0xffffffff; 1094 1095 V6_MASK_COPY(v6addr, v6mask, ill->ill_token); 1096 ill->ill_token_length = IPV6_TOKEN_LEN; 1097 return (B_TRUE); 1098 } 1099 1100 /* 1101 * Create a link-local address from a token. 1102 */ 1103 static void 1104 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 1105 { 1106 int i; 1107 1108 for (i = 0; i < 4; i++) { 1109 dest->s6_addr32[i] = 1110 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 1111 } 1112 } 1113 1114 /* 1115 * Set a nice default address for either automatic tunnels tsrc/96 or 1116 * 6to4 tunnels 2002:<tsrc>::1/64 1117 */ 1118 static void 1119 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta) 1120 { 1121 sin6_t sin6; 1122 sin_t *sin; 1123 ill_t *ill = ipif->ipif_ill; 1124 tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr; 1125 1126 if (ta->ifta_saddr.ss_family != AF_INET || 1127 (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 || 1128 (ta->ifta_flags & IFTUN_SRC) == 0) 1129 return; 1130 1131 /* 1132 * Check the tunnel type by examining q_next->q_ptr 1133 */ 1134 if (tp->tun_flags & TUN_AUTOMATIC) { 1135 /* this is an automatic tunnel */ 1136 (void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS, 1137 &ipif->ipif_v6net_mask); 1138 bzero(&sin6, sizeof (sin6_t)); 1139 sin = (sin_t *)&ta->ifta_saddr; 1140 V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr; 1141 sin6.sin6_family = AF_INET6; 1142 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1143 NULL, NULL, NULL, NULL); 1144 } else if (tp->tun_flags & TUN_6TO4) { 1145 /* this is a 6to4 tunnel */ 1146 (void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN, 1147 &ipif->ipif_v6net_mask); 1148 sin = (sin_t *)&ta->ifta_saddr; 1149 /* create a 6to4 address from the IPv4 tsrc */ 1150 IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr); 1151 sin6.sin6_family = AF_INET6; 1152 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1153 NULL, NULL, NULL, NULL); 1154 } else { 1155 ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type")); 1156 return; 1157 } 1158 } 1159 1160 /* 1161 * Set link local for ipif_id 0 of a configured tunnel based on the 1162 * tsrc or tdst parameter 1163 * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as 1164 * the token. 1165 * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address 1166 * as the token for the "outer" link. 1167 */ 1168 void 1169 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta) 1170 { 1171 ipif_t *ipif; 1172 sin_t *sin; 1173 in6_addr_t *s6addr; 1174 1175 ASSERT(IAM_WRITER_ILL(ill)); 1176 1177 /* The first ipif must be id zero. */ 1178 ipif = ill->ill_ipif; 1179 ASSERT(ipif->ipif_id == 0); 1180 1181 /* no link local for automatic tunnels */ 1182 if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) { 1183 ipif_set_tun_auto_addr(ipif, ta); 1184 return; 1185 } 1186 1187 if ((ta->ifta_flags & IFTUN_DST) && 1188 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 1189 sin6_t sin6; 1190 1191 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1192 bzero(&sin6, sizeof (sin6_t)); 1193 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1194 sin = (sin_t *)&ta->ifta_daddr; 1195 V4_PART_OF_V6(sin6.sin6_addr) = 1196 sin->sin_addr.s_addr; 1197 } else { 1198 s6addr = 1199 &((sin6_t *)&ta->ifta_daddr)->sin6_addr; 1200 sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3]; 1201 sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2]; 1202 } 1203 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, 1204 &sin6.sin6_addr); 1205 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1206 } 1207 if ((ta->ifta_flags & IFTUN_SRC)) { 1208 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1209 1210 /* Set the token if it isn't already set */ 1211 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) { 1212 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1213 sin = (sin_t *)&ta->ifta_saddr; 1214 V4_PART_OF_V6(ill->ill_token) = 1215 sin->sin_addr.s_addr; 1216 } else { 1217 s6addr = 1218 &((sin6_t *)&ta->ifta_saddr)->sin6_addr; 1219 ill->ill_token.s6_addr32[3] = 1220 s6addr->s6_addr32[3]; 1221 ill->ill_token.s6_addr32[2] = 1222 s6addr->s6_addr32[2]; 1223 } 1224 ill->ill_token_length = IPV6_TOKEN_LEN; 1225 } 1226 /* 1227 * Attempt to set the link local address if it isn't set. 1228 */ 1229 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) 1230 (void) ipif_setlinklocal(ipif); 1231 } 1232 } 1233 1234 /* 1235 * Is it not possible to set the link local address? 1236 * The address can be set if the token is set, and the token 1237 * isn't too long. 1238 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1239 */ 1240 boolean_t 1241 ipif_cant_setlinklocal(ipif_t *ipif) 1242 { 1243 ill_t *ill = ipif->ipif_ill; 1244 1245 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1246 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1247 return (B_TRUE); 1248 1249 return (B_FALSE); 1250 } 1251 1252 /* 1253 * Generate a link-local address from the token. 1254 * Return zero if the address was set, or non-zero if it couldn't be set. 1255 */ 1256 int 1257 ipif_setlinklocal(ipif_t *ipif) 1258 { 1259 ill_t *ill = ipif->ipif_ill; 1260 in6_addr_t ov6addr; 1261 1262 ASSERT(IAM_WRITER_ILL(ill)); 1263 1264 if (ipif_cant_setlinklocal(ipif)) 1265 return (-1); 1266 1267 ov6addr = ipif->ipif_v6lcl_addr; 1268 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1269 sctp_update_ipif_addr(ipif, ov6addr); 1270 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1271 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1272 ipif->ipif_v6subnet); 1273 1274 if (ipif->ipif_flags & IPIF_NOLOCAL) { 1275 ipif->ipif_v6src_addr = ipv6_all_zeros; 1276 } else { 1277 ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr; 1278 } 1279 return (0); 1280 } 1281 1282 /* 1283 * This function sets up the multicast mappings in NDP. 1284 * Unlike ARP, there are no mapping_mps here. We delete the 1285 * mapping nces and add a new one. 1286 * 1287 * Returns non-zero on error and 0 on success. 1288 */ 1289 int 1290 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce) 1291 { 1292 ill_t *ill = ipif->ipif_ill; 1293 in6_addr_t v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0}; 1294 in6_addr_t v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0}; 1295 in6_addr_t v6_extract_mask; 1296 uchar_t *phys_addr, *bphys_addr, *alloc_phys; 1297 nce_t *mnce = NULL; 1298 int err = 0; 1299 phyint_t *phyi = ill->ill_phyint; 1300 uint32_t hw_extract_start; 1301 dl_unitdata_req_t *dlur; 1302 ip_stack_t *ipst = ill->ill_ipst; 1303 1304 if (ret_nce != NULL) 1305 *ret_nce = NULL; 1306 /* 1307 * Delete the mapping nce. Normally these should not exist 1308 * as a previous ipif_down -> ipif_ndp_down should have deleted 1309 * all the nces. But they can exist if ip_rput_dlpi_writer 1310 * calls this when PHYI_MULTI_BCAST is set. 1311 */ 1312 mnce = ndp_lookup_v6(ill, &v6_mcast_addr, B_FALSE); 1313 if (mnce != NULL) { 1314 ndp_delete(mnce); 1315 NCE_REFRELE(mnce); 1316 mnce = NULL; 1317 } 1318 1319 /* 1320 * Get media specific v6 mapping information. Note that 1321 * nd_lla_len can be 0 for tunnels. 1322 */ 1323 alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP); 1324 if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0)) 1325 return (ENOMEM); 1326 /* 1327 * Determine the broadcast address. 1328 */ 1329 dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr; 1330 if (ill->ill_sap_length < 0) 1331 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset; 1332 else 1333 bphys_addr = (uchar_t *)dlur + 1334 dlur->dl_dest_addr_offset + ill->ill_sap_length; 1335 1336 /* 1337 * Check PHYI_MULTI_BCAST and possible length of physical 1338 * address to determine if we use the mapping or the 1339 * broadcast address. 1340 */ 1341 if ((phyi->phyint_flags & PHYI_MULTI_BCAST) || 1342 (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len, 1343 bphys_addr, alloc_phys, &hw_extract_start, 1344 &v6_extract_mask))) { 1345 if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) { 1346 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1347 return (E2BIG); 1348 } 1349 /* Use the link-layer broadcast address for MULTI_BCAST */ 1350 phys_addr = bphys_addr; 1351 bzero(&v6_extract_mask, sizeof (v6_extract_mask)); 1352 hw_extract_start = ill->ill_nd_lla_len; 1353 } else { 1354 phys_addr = alloc_phys; 1355 } 1356 if ((ipif->ipif_flags & IPIF_BROADCAST) || 1357 (ill->ill_flags & ILLF_MULTICAST) || 1358 (phyi->phyint_flags & PHYI_MULTI_BCAST)) { 1359 mutex_enter(&ipst->ips_ndp6->ndp_g_lock); 1360 err = ndp_add(ill, 1361 phys_addr, 1362 &v6_mcast_addr, /* v6 address */ 1363 &v6_mcast_mask, /* v6 mask */ 1364 &v6_extract_mask, 1365 hw_extract_start, 1366 NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD, 1367 ND_REACHABLE, 1368 &mnce, 1369 NULL, 1370 NULL); 1371 mutex_exit(&ipst->ips_ndp6->ndp_g_lock); 1372 if (err == 0) { 1373 if (ret_nce != NULL) { 1374 *ret_nce = mnce; 1375 } else { 1376 NCE_REFRELE(mnce); 1377 } 1378 } 1379 } 1380 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1381 return (err); 1382 } 1383 1384 /* 1385 * Get the resolver set up for a new interface address. (Always called 1386 * as writer.) 1387 */ 1388 int 1389 ipif_ndp_up(ipif_t *ipif, const in6_addr_t *addr) 1390 { 1391 ill_t *ill = ipif->ipif_ill; 1392 int err = 0; 1393 nce_t *nce = NULL; 1394 nce_t *mnce = NULL; 1395 1396 ip1dbg(("ipif_ndp_up(%s:%u)\n", 1397 ipif->ipif_ill->ill_name, ipif->ipif_id)); 1398 1399 /* 1400 * ND not supported on XRESOLV interfaces. If ND support (multicast) 1401 * added later, take out this check. 1402 */ 1403 if ((ill->ill_flags & ILLF_XRESOLV) || 1404 IN6_IS_ADDR_UNSPECIFIED(addr) || 1405 (!(ill->ill_net_type & IRE_INTERFACE))) { 1406 ipif->ipif_addr_ready = 1; 1407 return (0); 1408 } 1409 1410 /* 1411 * Need to setup multicast mapping only when the first 1412 * interface is coming UP. 1413 */ 1414 if (ill->ill_ipif_up_count == 0 && 1415 (ill->ill_flags & ILLF_MULTICAST)) { 1416 /* 1417 * We set the multicast before setting up the mapping for 1418 * local address because ipif_ndp_setup_multicast does 1419 * ndp_walk to delete nces which will delete the mapping 1420 * for local address also if we added the mapping for 1421 * local address first. 1422 */ 1423 err = ipif_ndp_setup_multicast(ipif, &mnce); 1424 if (err != 0) 1425 return (err); 1426 } 1427 1428 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1429 uint16_t flags; 1430 uchar_t *hw_addr = NULL; 1431 1432 /* Permanent entries don't need NUD */ 1433 flags = NCE_F_PERMANENT | NCE_F_NONUD; 1434 if (ill->ill_flags & ILLF_ROUTER) 1435 flags |= NCE_F_ISROUTER; 1436 1437 if (ipif->ipif_flags & IPIF_ANYCAST) 1438 flags |= NCE_F_ANYCAST; 1439 1440 if (ill->ill_net_type == IRE_IF_RESOLVER) { 1441 hw_addr = ill->ill_nd_lla; 1442 1443 if (ill->ill_move_in_progress) { 1444 /* 1445 * Addresses are failing over to this ill. 1446 * Don't wait for NUD to see this change. 1447 * Publish our new link-layer address. 1448 */ 1449 flags |= NCE_F_UNSOL_ADV; 1450 } 1451 } 1452 err = ndp_lookup_then_add(ill, 1453 hw_addr, 1454 addr, 1455 &ipv6_all_ones, 1456 &ipv6_all_zeros, 1457 0, 1458 flags, 1459 ND_PROBE, /* Causes Duplicate Address Detection to run */ 1460 &nce, 1461 NULL, 1462 NULL); 1463 switch (err) { 1464 case 0: 1465 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1466 ill->ill_name)); 1467 ipif->ipif_addr_ready = 1; 1468 break; 1469 case EINPROGRESS: 1470 ip1dbg(("ipif_ndp_up: running DAD now for %s\n", 1471 ill->ill_name)); 1472 break; 1473 case EEXIST: 1474 NCE_REFRELE(nce); 1475 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1476 ill->ill_name)); 1477 if (mnce != NULL) { 1478 ndp_delete(mnce); 1479 NCE_REFRELE(mnce); 1480 } 1481 return (err); 1482 default: 1483 ip1dbg(("ipif_ndp_up: NCE creation failed %s\n", 1484 ill->ill_name)); 1485 if (mnce != NULL) { 1486 ndp_delete(mnce); 1487 NCE_REFRELE(mnce); 1488 } 1489 return (err); 1490 } 1491 } else { 1492 /* No local NCE for this entry */ 1493 ipif->ipif_addr_ready = 1; 1494 } 1495 if (nce != NULL) 1496 NCE_REFRELE(nce); 1497 if (mnce != NULL) 1498 NCE_REFRELE(mnce); 1499 return (0); 1500 } 1501 1502 /* Remove all cache entries for this logical interface */ 1503 void 1504 ipif_ndp_down(ipif_t *ipif) 1505 { 1506 nce_t *nce; 1507 1508 if (ipif->ipif_isv6) { 1509 nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, 1510 B_FALSE); 1511 if (nce != NULL) { 1512 ndp_delete(nce); 1513 NCE_REFRELE(nce); 1514 } 1515 } 1516 /* 1517 * Remove mapping and all other nces dependent on this ill 1518 * when the last ipif is going away. 1519 */ 1520 if (ipif->ipif_ill->ill_ipif_up_count == 0) { 1521 ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill, 1522 (uchar_t *)ipif->ipif_ill, ipif->ipif_ill->ill_ipst); 1523 } 1524 } 1525 1526 /* 1527 * Used when an interface comes up to recreate any extra routes on this 1528 * interface. 1529 */ 1530 static ire_t ** 1531 ipif_recover_ire_v6(ipif_t *ipif) 1532 { 1533 mblk_t *mp; 1534 ire_t **ipif_saved_irep; 1535 ire_t **irep; 1536 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 1537 1538 ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name, 1539 ipif->ipif_id)); 1540 1541 ASSERT(ipif->ipif_isv6); 1542 1543 mutex_enter(&ipif->ipif_saved_ire_lock); 1544 ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) * 1545 ipif->ipif_saved_ire_cnt, KM_NOSLEEP); 1546 if (ipif_saved_irep == NULL) { 1547 mutex_exit(&ipif->ipif_saved_ire_lock); 1548 return (NULL); 1549 } 1550 1551 irep = ipif_saved_irep; 1552 1553 for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) { 1554 ire_t *ire; 1555 queue_t *rfq; 1556 queue_t *stq; 1557 ifrt_t *ifrt; 1558 in6_addr_t *src_addr; 1559 in6_addr_t *gateway_addr; 1560 mblk_t *resolver_mp; 1561 char buf[INET6_ADDRSTRLEN]; 1562 ushort_t type; 1563 1564 /* 1565 * When the ire was initially created and then added in 1566 * ip_rt_add_v6(), it was created either using 1567 * ipif->ipif_net_type in the case of a traditional interface 1568 * route, or as one of the IRE_OFFSUBNET types (with the 1569 * exception of IRE_HOST type redirect ire which is created by 1570 * icmp_redirect_v6() and which we don't need to save or 1571 * recover). In the case where ipif->ipif_net_type was 1572 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to 1573 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy 1574 * software like GateD and Sun Cluster which creates routes 1575 * using the the loopback interface's address as a gateway. 1576 * 1577 * As ifrt->ifrt_type reflects the already updated ire_type and 1578 * since ire_create_v6() expects that IRE_IF_NORESOLVER will 1579 * have a valid ire_dlureq_mp field (which doesn't make sense 1580 * for a IRE_LOOPBACK), ire_create_v6() will be called in the 1581 * same way here as in ip_rt_add_v6(), namely using 1582 * ipif->ipif_net_type when the route looks like a traditional 1583 * interface route (where ifrt->ifrt_type & IRE_INTERFACE is 1584 * true) and otherwise using the saved ifrt->ifrt_type. This 1585 * means that in the case where ipif->ipif_net_type is 1586 * IRE_LOOPBACK, the ire created by ire_create_v6() will be an 1587 * IRE_LOOPBACK, it will then be turned into an 1588 * IRE_IF_NORESOLVER and then added by ire_add_v6(). 1589 */ 1590 ifrt = (ifrt_t *)mp->b_rptr; 1591 if (ifrt->ifrt_type & IRE_INTERFACE) { 1592 rfq = NULL; 1593 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 1594 ? ipif->ipif_rq : ipif->ipif_wq; 1595 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1596 ? &ifrt->ifrt_v6src_addr 1597 : &ipif->ipif_v6src_addr; 1598 gateway_addr = NULL; 1599 resolver_mp = ipif->ipif_resolver_mp; 1600 type = ipif->ipif_net_type; 1601 } else { 1602 rfq = NULL; 1603 stq = NULL; 1604 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1605 ? &ifrt->ifrt_v6src_addr : NULL; 1606 gateway_addr = &ifrt->ifrt_v6gateway_addr; 1607 resolver_mp = NULL; 1608 type = ifrt->ifrt_type; 1609 } 1610 1611 /* 1612 * Create a copy of the IRE with the saved address and netmask. 1613 */ 1614 ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n", 1615 ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type, 1616 inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)), 1617 ip_mask_to_plen_v6(&ifrt->ifrt_v6mask))); 1618 ire = ire_create_v6( 1619 &ifrt->ifrt_v6addr, 1620 &ifrt->ifrt_v6mask, 1621 src_addr, 1622 gateway_addr, 1623 &ifrt->ifrt_max_frag, 1624 NULL, 1625 rfq, 1626 stq, 1627 type, 1628 resolver_mp, 1629 ipif, 1630 NULL, 1631 0, 1632 0, 1633 ifrt->ifrt_flags, 1634 &ifrt->ifrt_iulp_info, 1635 NULL, 1636 NULL, 1637 ipst); 1638 if (ire == NULL) { 1639 mutex_exit(&ipif->ipif_saved_ire_lock); 1640 kmem_free(ipif_saved_irep, 1641 ipif->ipif_saved_ire_cnt * sizeof (ire_t *)); 1642 return (NULL); 1643 } 1644 1645 /* 1646 * Some software (for example, GateD and Sun Cluster) attempts 1647 * to create (what amount to) IRE_PREFIX routes with the 1648 * loopback address as the gateway. This is primarily done to 1649 * set up prefixes with the RTF_REJECT flag set (for example, 1650 * when generating aggregate routes.) 1651 * 1652 * If the IRE type (as defined by ipif->ipif_net_type) is 1653 * IRE_LOOPBACK, then we map the request into a 1654 * IRE_IF_NORESOLVER. 1655 */ 1656 if (ipif->ipif_net_type == IRE_LOOPBACK) 1657 ire->ire_type = IRE_IF_NORESOLVER; 1658 /* 1659 * ire held by ire_add, will be refreled' in ipif_up_done 1660 * towards the end 1661 */ 1662 (void) ire_add(&ire, NULL, NULL, NULL, B_FALSE); 1663 *irep = ire; 1664 irep++; 1665 ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire)); 1666 } 1667 mutex_exit(&ipif->ipif_saved_ire_lock); 1668 return (ipif_saved_irep); 1669 } 1670 1671 /* 1672 * Return the scope of the given IPv6 address. If the address is an 1673 * IPv4 mapped IPv6 address, return the scope of the corresponding 1674 * IPv4 address. 1675 */ 1676 in6addr_scope_t 1677 ip_addr_scope_v6(const in6_addr_t *addr) 1678 { 1679 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1680 1681 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1682 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1683 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1684 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1685 return (IP6_SCOPE_LINKLOCAL); 1686 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1687 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1688 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1689 return (IP6_SCOPE_SITELOCAL); 1690 return (IP6_SCOPE_GLOBAL); 1691 } 1692 1693 if (IN6_IS_ADDR_MULTICAST(addr)) 1694 return (IN6_ADDR_MC_SCOPE(addr)); 1695 1696 /* link-local and loopback addresses are of link-local scope */ 1697 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1698 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1699 return (IP6_SCOPE_LINKLOCAL); 1700 if (IN6_IS_ADDR_SITELOCAL(addr)) 1701 return (IP6_SCOPE_SITELOCAL); 1702 return (IP6_SCOPE_GLOBAL); 1703 } 1704 1705 1706 /* 1707 * Returns the length of the common prefix of a1 and a2, as per 1708 * CommonPrefixLen() defined in RFC 3484. 1709 */ 1710 static int 1711 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2) 1712 { 1713 int i; 1714 uint32_t a1val, a2val, mask; 1715 1716 for (i = 0; i < 4; i++) { 1717 if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) { 1718 a1val ^= a2val; 1719 i *= 32; 1720 mask = 0x80000000u; 1721 while (!(a1val & mask)) { 1722 mask >>= 1; 1723 i++; 1724 } 1725 return (i); 1726 } 1727 } 1728 return (IPV6_ABITS); 1729 } 1730 1731 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1732 (((ipif)->ipif_flags & IPIF_UP) && \ 1733 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \ 1734 (ipif)->ipif_addr_ready) 1735 1736 /* source address candidate */ 1737 typedef struct candidate { 1738 ipif_t *cand_ipif; 1739 /* The properties of this candidate */ 1740 boolean_t cand_isdst; 1741 boolean_t cand_isdst_set; 1742 in6addr_scope_t cand_scope; 1743 boolean_t cand_scope_set; 1744 boolean_t cand_isdeprecated; 1745 boolean_t cand_isdeprecated_set; 1746 boolean_t cand_ispreferred; 1747 boolean_t cand_ispreferred_set; 1748 boolean_t cand_matchedinterface; 1749 boolean_t cand_matchedinterface_set; 1750 boolean_t cand_matchedlabel; 1751 boolean_t cand_matchedlabel_set; 1752 boolean_t cand_istmp; 1753 boolean_t cand_istmp_set; 1754 int cand_common_pref; 1755 boolean_t cand_common_pref_set; 1756 boolean_t cand_pref_eq; 1757 boolean_t cand_pref_eq_set; 1758 int cand_pref_len; 1759 boolean_t cand_pref_len_set; 1760 } cand_t; 1761 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1762 #define cand_mask cand_ipif->ipif_v6net_mask 1763 #define cand_flags cand_ipif->ipif_flags 1764 #define cand_ill cand_ipif->ipif_ill 1765 #define cand_zoneid cand_ipif->ipif_zoneid 1766 1767 /* information about the destination for source address selection */ 1768 typedef struct dstinfo { 1769 const in6_addr_t *dst_addr; 1770 ill_t *dst_ill; 1771 uint_t dst_restrict_ill; 1772 boolean_t dst_prefer_src_tmp; 1773 in6addr_scope_t dst_scope; 1774 char *dst_label; 1775 } dstinfo_t; 1776 1777 /* 1778 * The following functions are rules used to select a source address in 1779 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1780 * against the best candidate (bc). Each rule has three possible outcomes; 1781 * the candidate is preferred over the best candidate (CAND_PREFER), the 1782 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1783 * candidate is of equal value as the best candidate (CAND_TIE). 1784 * 1785 * These rules are part of a greater "Default Address Selection for IPv6" 1786 * sheme, which is standards based work coming out of the IETF ipv6 working 1787 * group. The IETF document defines both IPv6 source address selection and 1788 * destination address ordering. The rules defined here implement the IPv6 1789 * source address selection. Destination address ordering is done by 1790 * libnsl, and uses a similar set of rules to implement the sorting. 1791 * 1792 * Most of the rules are defined by the RFC and are not typically altered. The 1793 * last rule, number 8, has language that allows for local preferences. In the 1794 * scheme below, this means that new Solaris rules should normally go between 1795 * rule_ifprefix and rule_prefix. 1796 */ 1797 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1798 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *, 1799 ip_stack_t *); 1800 1801 /* Prefer an address if it is equal to the destination address. */ 1802 /* ARGSUSED3 */ 1803 static rule_res_t 1804 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1805 { 1806 if (!bc->cand_isdst_set) { 1807 bc->cand_isdst = 1808 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1809 bc->cand_isdst_set = B_TRUE; 1810 } 1811 1812 cc->cand_isdst = 1813 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1814 cc->cand_isdst_set = B_TRUE; 1815 1816 if (cc->cand_isdst == bc->cand_isdst) 1817 return (CAND_TIE); 1818 else if (cc->cand_isdst) 1819 return (CAND_PREFER); 1820 else 1821 return (CAND_AVOID); 1822 } 1823 1824 /* 1825 * Prefer addresses that are of closest scope to the destination. Always 1826 * prefer addresses that are of greater scope than the destination over 1827 * those that are of lesser scope than the destination. 1828 */ 1829 /* ARGSUSED3 */ 1830 static rule_res_t 1831 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1832 { 1833 if (!bc->cand_scope_set) { 1834 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1835 bc->cand_scope_set = B_TRUE; 1836 } 1837 1838 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1839 cc->cand_scope_set = B_TRUE; 1840 1841 if (cc->cand_scope < bc->cand_scope) { 1842 if (cc->cand_scope < dstinfo->dst_scope) 1843 return (CAND_AVOID); 1844 else 1845 return (CAND_PREFER); 1846 } else if (bc->cand_scope < cc->cand_scope) { 1847 if (bc->cand_scope < dstinfo->dst_scope) 1848 return (CAND_PREFER); 1849 else 1850 return (CAND_AVOID); 1851 } else { 1852 return (CAND_TIE); 1853 } 1854 } 1855 1856 /* 1857 * Prefer non-deprecated source addresses. 1858 */ 1859 /* ARGSUSED2 */ 1860 static rule_res_t 1861 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1862 ip_stack_t *ipst) 1863 { 1864 if (!bc->cand_isdeprecated_set) { 1865 bc->cand_isdeprecated = 1866 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 1867 bc->cand_isdeprecated_set = B_TRUE; 1868 } 1869 1870 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 1871 cc->cand_isdeprecated_set = B_TRUE; 1872 1873 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 1874 return (CAND_TIE); 1875 else if (cc->cand_isdeprecated) 1876 return (CAND_AVOID); 1877 else 1878 return (CAND_PREFER); 1879 } 1880 1881 /* 1882 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 1883 * rule must be before rule_interface because the flag could be set on any 1884 * interface, not just the interface being used for outgoing packets (for 1885 * example, the IFF_PREFERRED could be set on an address assigned to the 1886 * loopback interface). 1887 */ 1888 /* ARGSUSED2 */ 1889 static rule_res_t 1890 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1891 ip_stack_t *ipst) 1892 { 1893 if (!bc->cand_ispreferred_set) { 1894 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 1895 bc->cand_ispreferred_set = B_TRUE; 1896 } 1897 1898 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 1899 cc->cand_ispreferred_set = B_TRUE; 1900 1901 if (bc->cand_ispreferred == cc->cand_ispreferred) 1902 return (CAND_TIE); 1903 else if (cc->cand_ispreferred) 1904 return (CAND_PREFER); 1905 else 1906 return (CAND_AVOID); 1907 } 1908 1909 /* 1910 * Prefer source addresses that are assigned to the outgoing interface, or 1911 * to an interface that is in the same IPMP group as the outgoing 1912 * interface. 1913 */ 1914 /* ARGSUSED3 */ 1915 static rule_res_t 1916 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1917 ip_stack_t *ipst) 1918 { 1919 ill_t *dstill = dstinfo->dst_ill; 1920 1921 /* 1922 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 1923 * since we know all candidates will be on the same link. 1924 */ 1925 if (dstinfo->dst_restrict_ill) 1926 return (CAND_TIE); 1927 1928 if (!bc->cand_matchedinterface_set) { 1929 bc->cand_matchedinterface = (bc->cand_ill == dstill || 1930 (dstill->ill_group != NULL && 1931 dstill->ill_group == bc->cand_ill->ill_group)); 1932 bc->cand_matchedinterface_set = B_TRUE; 1933 } 1934 1935 cc->cand_matchedinterface = (cc->cand_ill == dstill || 1936 (dstill->ill_group != NULL && 1937 dstill->ill_group == cc->cand_ill->ill_group)); 1938 cc->cand_matchedinterface_set = B_TRUE; 1939 1940 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 1941 return (CAND_TIE); 1942 else if (cc->cand_matchedinterface) 1943 return (CAND_PREFER); 1944 else 1945 return (CAND_AVOID); 1946 } 1947 1948 /* 1949 * Prefer source addresses whose label matches the destination's label. 1950 */ 1951 static rule_res_t 1952 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1953 { 1954 char *label; 1955 1956 if (!bc->cand_matchedlabel_set) { 1957 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst); 1958 bc->cand_matchedlabel = 1959 ip6_asp_labelcmp(label, dstinfo->dst_label); 1960 bc->cand_matchedlabel_set = B_TRUE; 1961 } 1962 1963 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst); 1964 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 1965 cc->cand_matchedlabel_set = B_TRUE; 1966 1967 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 1968 return (CAND_TIE); 1969 else if (cc->cand_matchedlabel) 1970 return (CAND_PREFER); 1971 else 1972 return (CAND_AVOID); 1973 } 1974 1975 /* 1976 * Prefer public addresses over temporary ones. An application can reverse 1977 * the logic of this rule and prefer temporary addresses by using the 1978 * IPV6_SRC_PREFERENCES socket option. 1979 */ 1980 /* ARGSUSED3 */ 1981 static rule_res_t 1982 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1983 ip_stack_t *ipst) 1984 { 1985 if (!bc->cand_istmp_set) { 1986 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 1987 bc->cand_istmp_set = B_TRUE; 1988 } 1989 1990 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 1991 cc->cand_istmp_set = B_TRUE; 1992 1993 if (bc->cand_istmp == cc->cand_istmp) 1994 return (CAND_TIE); 1995 1996 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 1997 return (CAND_PREFER); 1998 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 1999 return (CAND_PREFER); 2000 else 2001 return (CAND_AVOID); 2002 } 2003 2004 /* 2005 * Prefer source addresses with longer matching prefix with the destination 2006 * under the interface mask. This gets us on the same subnet before applying 2007 * any Solaris-specific rules. 2008 */ 2009 /* ARGSUSED3 */ 2010 static rule_res_t 2011 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2012 ip_stack_t *ipst) 2013 { 2014 if (!bc->cand_pref_eq_set) { 2015 bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr, 2016 bc->cand_mask, *dstinfo->dst_addr); 2017 bc->cand_pref_eq_set = B_TRUE; 2018 } 2019 2020 cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask, 2021 *dstinfo->dst_addr); 2022 cc->cand_pref_eq_set = B_TRUE; 2023 2024 if (bc->cand_pref_eq) { 2025 if (cc->cand_pref_eq) { 2026 if (!bc->cand_pref_len_set) { 2027 bc->cand_pref_len = 2028 ip_mask_to_plen_v6(&bc->cand_mask); 2029 bc->cand_pref_len_set = B_TRUE; 2030 } 2031 cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask); 2032 cc->cand_pref_len_set = B_TRUE; 2033 if (bc->cand_pref_len == cc->cand_pref_len) 2034 return (CAND_TIE); 2035 else if (bc->cand_pref_len > cc->cand_pref_len) 2036 return (CAND_AVOID); 2037 else 2038 return (CAND_PREFER); 2039 } else { 2040 return (CAND_AVOID); 2041 } 2042 } else { 2043 if (cc->cand_pref_eq) 2044 return (CAND_PREFER); 2045 else 2046 return (CAND_TIE); 2047 } 2048 } 2049 2050 /* 2051 * Prefer to use zone-specific addresses when possible instead of all-zones 2052 * addresses. 2053 */ 2054 /* ARGSUSED2 */ 2055 static rule_res_t 2056 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2057 ip_stack_t *ipst) 2058 { 2059 if ((bc->cand_zoneid == ALL_ZONES) == 2060 (cc->cand_zoneid == ALL_ZONES)) 2061 return (CAND_TIE); 2062 else if (cc->cand_zoneid == ALL_ZONES) 2063 return (CAND_AVOID); 2064 else 2065 return (CAND_PREFER); 2066 } 2067 2068 /* 2069 * Prefer to use DHCPv6 (first) and static addresses (second) when possible 2070 * instead of statelessly autoconfigured addresses. 2071 * 2072 * This is done after trying all other preferences (and before the final tie 2073 * breaker) so that, if all else is equal, we select addresses configured by 2074 * DHCPv6 over other addresses. We presume that DHCPv6 addresses, unlike 2075 * stateless autoconfigured addresses, are deliberately configured by an 2076 * administrator, and thus are correctly set up in DNS and network packet 2077 * filters. 2078 */ 2079 /* ARGSUSED2 */ 2080 static rule_res_t 2081 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2082 ip_stack_t *ipst) 2083 { 2084 #define ATYPE(x) \ 2085 ((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2 2086 int bcval = ATYPE(bc->cand_flags); 2087 int ccval = ATYPE(cc->cand_flags); 2088 #undef ATYPE 2089 2090 if (bcval == ccval) 2091 return (CAND_TIE); 2092 else if (ccval < bcval) 2093 return (CAND_PREFER); 2094 else 2095 return (CAND_AVOID); 2096 } 2097 2098 /* 2099 * Prefer source addresses with longer matching prefix with the destination. 2100 * We do the longest matching prefix calculation by doing an xor of both 2101 * addresses with the destination, and pick the address with the longest string 2102 * of leading zeros, as per CommonPrefixLen() defined in RFC 3484. 2103 */ 2104 /* ARGSUSED3 */ 2105 static rule_res_t 2106 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 2107 { 2108 if (!bc->cand_common_pref_set) { 2109 bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr, 2110 dstinfo->dst_addr); 2111 bc->cand_common_pref_set = B_TRUE; 2112 } 2113 2114 cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr, 2115 dstinfo->dst_addr); 2116 cc->cand_common_pref_set = B_TRUE; 2117 2118 if (bc->cand_common_pref == cc->cand_common_pref) 2119 return (CAND_TIE); 2120 else if (bc->cand_common_pref > cc->cand_common_pref) 2121 return (CAND_AVOID); 2122 else 2123 return (CAND_PREFER); 2124 } 2125 2126 /* 2127 * Last rule: we must pick something, so just prefer the current best 2128 * candidate. 2129 */ 2130 /* ARGSUSED */ 2131 static rule_res_t 2132 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2133 ip_stack_t *ipst) 2134 { 2135 return (CAND_AVOID); 2136 } 2137 2138 /* 2139 * Determine the best source address given a destination address and a 2140 * destination ill. If no suitable source address is found, it returns 2141 * NULL. If there is a usable address pointed to by the usesrc 2142 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 2143 * fine grained (i.e per interface) 2144 * 2145 * This implementation is based on the "Default Address Selection for IPv6" 2146 * specification produced by the IETF IPv6 working group. It has been 2147 * implemented so that the list of addresses is only traversed once (the 2148 * specification's algorithm could traverse the list of addresses once for 2149 * every rule). 2150 * 2151 * The restrict_ill argument restricts the algorithm to chose a source 2152 * address that is assigned to the destination ill or an ill in the same 2153 * IPMP group as the destination ill. This is used when the destination 2154 * address is a link-local or multicast address, and when 2155 * ipv6_strict_dst_multihoming is turned on. 2156 * 2157 * src_prefs is the caller's set of source address preferences. If source 2158 * address selection is being called to determine the source address of a 2159 * connected socket (from ip_bind_connected_v6()), then the preferences are 2160 * taken from conn_src_preferences. These preferences can be set on a 2161 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 2162 * preference currently implemented is for rfc3041 temporary addresses. 2163 */ 2164 ipif_t * 2165 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 2166 uint_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid) 2167 { 2168 dstinfo_t dstinfo; 2169 char dstr[INET6_ADDRSTRLEN]; 2170 char sstr[INET6_ADDRSTRLEN]; 2171 ipif_t *ipif; 2172 ill_t *ill, *usesrc_ill = NULL; 2173 ill_walk_context_t ctx; 2174 cand_t best_c; /* The best candidate */ 2175 cand_t curr_c; /* The current candidate */ 2176 uint_t index; 2177 boolean_t first_candidate = B_TRUE; 2178 rule_res_t rule_result; 2179 tsol_tpc_t *src_rhtp, *dst_rhtp; 2180 ip_stack_t *ipst = dstill->ill_ipst; 2181 2182 /* 2183 * The list of ordering rules. They are applied in the order they 2184 * appear in the list. 2185 * 2186 * Solaris doesn't currently support Mobile IPv6, so there's no 2187 * rule_mipv6 corresponding to rule 4 in the specification. 2188 */ 2189 rulef_t rules[] = { 2190 rule_isdst, 2191 rule_scope, 2192 rule_deprecated, 2193 rule_preferred, 2194 rule_interface, 2195 rule_label, 2196 rule_temporary, 2197 rule_ifprefix, /* local rules after this */ 2198 rule_zone_specific, 2199 rule_addr_type, 2200 rule_prefix, /* local rules before this */ 2201 rule_must_be_last, /* must always be last */ 2202 NULL 2203 }; 2204 2205 ASSERT(dstill->ill_isv6); 2206 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 2207 2208 /* 2209 * Check if there is a usable src address pointed to by the 2210 * usesrc ifindex. This has higher precedence since it is 2211 * finer grained (i.e per interface) v/s being system wide. 2212 */ 2213 if (dstill->ill_usesrc_ifindex != 0) { 2214 if ((usesrc_ill = 2215 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 2216 NULL, NULL, NULL, NULL, ipst)) != NULL) { 2217 dstinfo.dst_ill = usesrc_ill; 2218 } else { 2219 return (NULL); 2220 } 2221 } else { 2222 dstinfo.dst_ill = dstill; 2223 } 2224 2225 /* 2226 * If we're dealing with an unlabeled destination on a labeled system, 2227 * make sure that we ignore source addresses that are incompatible with 2228 * the destination's default label. That destination's default label 2229 * must dominate the minimum label on the source address. 2230 * 2231 * (Note that this has to do with Trusted Solaris. It's not related to 2232 * the labels described by ip6_asp_lookup.) 2233 */ 2234 dst_rhtp = NULL; 2235 if (is_system_labeled()) { 2236 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE); 2237 if (dst_rhtp == NULL) 2238 return (NULL); 2239 if (dst_rhtp->tpc_tp.host_type != UNLABELED) { 2240 TPC_RELE(dst_rhtp); 2241 dst_rhtp = NULL; 2242 } 2243 } 2244 2245 dstinfo.dst_addr = dst; 2246 dstinfo.dst_scope = ip_addr_scope_v6(dst); 2247 dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst); 2248 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 2249 2250 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2251 /* 2252 * Section three of the I-D states that for multicast and 2253 * link-local destinations, the candidate set must be restricted to 2254 * an interface that is on the same link as the outgoing interface. 2255 * Also, when ipv6_strict_dst_multihoming is turned on, always 2256 * restrict the source address to the destination link as doing 2257 * otherwise will almost certainly cause problems. 2258 */ 2259 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 2260 ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) { 2261 if (restrict_ill == RESTRICT_TO_NONE) 2262 dstinfo.dst_restrict_ill = RESTRICT_TO_GROUP; 2263 else 2264 dstinfo.dst_restrict_ill = restrict_ill; 2265 } else { 2266 dstinfo.dst_restrict_ill = restrict_ill; 2267 } 2268 2269 bzero(&best_c, sizeof (cand_t)); 2270 2271 /* 2272 * Take a pass through the list of IPv6 interfaces to chose the 2273 * best possible source address. If restrict_ill is true, we only 2274 * iterate through the ill's that are in the same IPMP group as the 2275 * destination's outgoing ill. If restrict_ill is false, we walk 2276 * the entire list of IPv6 ill's. 2277 */ 2278 if (dstinfo.dst_restrict_ill != RESTRICT_TO_NONE) { 2279 if (dstinfo.dst_ill->ill_group != NULL && 2280 dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) { 2281 ill = dstinfo.dst_ill->ill_group->illgrp_ill; 2282 } else { 2283 ill = dstinfo.dst_ill; 2284 } 2285 } else { 2286 ill = ILL_START_WALK_V6(&ctx, ipst); 2287 } 2288 2289 while (ill != NULL) { 2290 ASSERT(ill->ill_isv6); 2291 2292 /* 2293 * Avoid FAILED/OFFLINE ills. 2294 * Global and site local addresses will failover and 2295 * will be available on the new ill. 2296 * But link local addresses don't move. 2297 */ 2298 if (dstinfo.dst_restrict_ill != RESTRICT_TO_ILL && 2299 ill->ill_phyint->phyint_flags & 2300 (PHYI_OFFLINE | PHYI_FAILED)) 2301 goto next_ill; 2302 2303 for (ipif = ill->ill_ipif; ipif != NULL; 2304 ipif = ipif->ipif_next) { 2305 2306 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 2307 continue; 2308 2309 if (zoneid != ALL_ZONES && 2310 ipif->ipif_zoneid != zoneid && 2311 ipif->ipif_zoneid != ALL_ZONES) 2312 continue; 2313 2314 /* 2315 * Check compatibility of local address for 2316 * destination's default label if we're on a labeled 2317 * system. Incompatible addresses can't be used at 2318 * all and must be skipped over. 2319 */ 2320 if (dst_rhtp != NULL) { 2321 boolean_t incompat; 2322 2323 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr, 2324 IPV6_VERSION, B_FALSE); 2325 if (src_rhtp == NULL) 2326 continue; 2327 incompat = 2328 src_rhtp->tpc_tp.host_type != SUN_CIPSO || 2329 src_rhtp->tpc_tp.tp_doi != 2330 dst_rhtp->tpc_tp.tp_doi || 2331 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label, 2332 &src_rhtp->tpc_tp.tp_sl_range_cipso) && 2333 !blinlset(&dst_rhtp->tpc_tp.tp_def_label, 2334 src_rhtp->tpc_tp.tp_sl_set_cipso)); 2335 TPC_RELE(src_rhtp); 2336 if (incompat) 2337 continue; 2338 } 2339 2340 if (first_candidate) { 2341 /* 2342 * This is first valid address in the list. 2343 * It is automatically the best candidate 2344 * so far. 2345 */ 2346 best_c.cand_ipif = ipif; 2347 first_candidate = B_FALSE; 2348 continue; 2349 } 2350 2351 bzero(&curr_c, sizeof (cand_t)); 2352 curr_c.cand_ipif = ipif; 2353 2354 /* 2355 * Compare this current candidate (curr_c) with the 2356 * best candidate (best_c) by applying the 2357 * comparison rules in order until one breaks the 2358 * tie. 2359 */ 2360 for (index = 0; rules[index] != NULL; index++) { 2361 /* Apply a comparison rule. */ 2362 rule_result = 2363 (rules[index])(&best_c, &curr_c, &dstinfo, 2364 ipst); 2365 if (rule_result == CAND_AVOID) { 2366 /* 2367 * The best candidate is still the 2368 * best candidate. Forget about 2369 * this current candidate and go on 2370 * to the next one. 2371 */ 2372 break; 2373 } else if (rule_result == CAND_PREFER) { 2374 /* 2375 * This candidate is prefered. It 2376 * becomes the best candidate so 2377 * far. Go on to the next address. 2378 */ 2379 best_c = curr_c; 2380 break; 2381 } 2382 /* We have a tie, apply the next rule. */ 2383 } 2384 2385 /* 2386 * The last rule must be a tie breaker rule and 2387 * must never produce a tie. At this point, the 2388 * candidate should have either been rejected, or 2389 * have been prefered as the best candidate so far. 2390 */ 2391 ASSERT(rule_result != CAND_TIE); 2392 } 2393 2394 /* 2395 * We may be walking the linked-list of ill's in an 2396 * IPMP group or traversing the IPv6 ill avl tree. If it is a 2397 * usesrc ILL then it can't be part of IPMP group and we 2398 * will exit the while loop. 2399 */ 2400 next_ill: 2401 if (dstinfo.dst_restrict_ill == RESTRICT_TO_ILL) 2402 ill = NULL; 2403 else if (dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) 2404 ill = ill->ill_group_next; 2405 else 2406 ill = ill_next(&ctx, ill); 2407 } 2408 2409 ipif = best_c.cand_ipif; 2410 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2411 dstinfo.dst_ill->ill_name, 2412 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2413 (ipif == NULL ? "NULL" : 2414 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2415 2416 if (usesrc_ill != NULL) 2417 ill_refrele(usesrc_ill); 2418 2419 if (dst_rhtp != NULL) 2420 TPC_RELE(dst_rhtp); 2421 2422 if (ipif == NULL) { 2423 rw_exit(&ipst->ips_ill_g_lock); 2424 return (NULL); 2425 } 2426 2427 mutex_enter(&ipif->ipif_ill->ill_lock); 2428 if (IPIF_CAN_LOOKUP(ipif)) { 2429 ipif_refhold_locked(ipif); 2430 mutex_exit(&ipif->ipif_ill->ill_lock); 2431 rw_exit(&ipst->ips_ill_g_lock); 2432 return (ipif); 2433 } 2434 mutex_exit(&ipif->ipif_ill->ill_lock); 2435 rw_exit(&ipst->ips_ill_g_lock); 2436 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2437 " returning null \n", (void *)ipif)); 2438 2439 return (NULL); 2440 } 2441 2442 /* 2443 * If old_ipif is not NULL, see if ipif was derived from old 2444 * ipif and if so, recreate the interface route by re-doing 2445 * source address selection. This happens when ipif_down -> 2446 * ipif_update_other_ipifs calls us. 2447 * 2448 * If old_ipif is NULL, just redo the source address selection 2449 * if needed. This happens when illgrp_insert or ipif_up_done_v6 2450 * calls us. 2451 */ 2452 void 2453 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif) 2454 { 2455 ire_t *ire; 2456 ire_t *ipif_ire; 2457 queue_t *stq; 2458 ill_t *ill; 2459 ipif_t *nipif = NULL; 2460 boolean_t nipif_refheld = B_FALSE; 2461 boolean_t ip6_asp_table_held = B_FALSE; 2462 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 2463 2464 ill = ipif->ipif_ill; 2465 2466 if (!(ipif->ipif_flags & 2467 (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) { 2468 /* 2469 * Can't possibly have borrowed the source 2470 * from old_ipif. 2471 */ 2472 return; 2473 } 2474 2475 /* 2476 * Is there any work to be done? No work if the address 2477 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST ( 2478 * ipif_select_source_v6() does not borrow addresses from 2479 * NOLOCAL and ANYCAST interfaces). 2480 */ 2481 if ((old_ipif != NULL) && 2482 ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) || 2483 (old_ipif->ipif_ill->ill_wq == NULL) || 2484 (old_ipif->ipif_flags & 2485 (IPIF_NOLOCAL|IPIF_ANYCAST)))) { 2486 return; 2487 } 2488 2489 /* 2490 * Perform the same checks as when creating the 2491 * IRE_INTERFACE in ipif_up_done_v6. 2492 */ 2493 if (!(ipif->ipif_flags & IPIF_UP)) 2494 return; 2495 2496 if ((ipif->ipif_flags & IPIF_NOXMIT)) 2497 return; 2498 2499 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2500 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask)) 2501 return; 2502 2503 /* 2504 * We know that ipif uses some other source for its 2505 * IRE_INTERFACE. Is it using the source of this 2506 * old_ipif? 2507 */ 2508 ipif_ire = ipif_to_ire_v6(ipif); 2509 if (ipif_ire == NULL) 2510 return; 2511 2512 if (old_ipif != NULL && 2513 !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr, 2514 &ipif_ire->ire_src_addr_v6)) { 2515 ire_refrele(ipif_ire); 2516 return; 2517 } 2518 2519 if (ip_debug > 2) { 2520 /* ip1dbg */ 2521 pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE" 2522 " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6); 2523 } 2524 2525 stq = ipif_ire->ire_stq; 2526 2527 /* 2528 * Can't use our source address. Select a different source address 2529 * for the IRE_INTERFACE. We restrict interface route source 2530 * address selection to ipif's assigned to the same link as the 2531 * interface. 2532 */ 2533 if (ip6_asp_can_lookup(ipst)) { 2534 ip6_asp_table_held = B_TRUE; 2535 nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet, 2536 RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT, 2537 ipif->ipif_zoneid); 2538 } 2539 if (nipif == NULL) { 2540 /* Last resort - all ipif's have IPIF_NOLOCAL */ 2541 nipif = ipif; 2542 } else { 2543 nipif_refheld = B_TRUE; 2544 } 2545 2546 ire = ire_create_v6( 2547 &ipif->ipif_v6subnet, /* dest pref */ 2548 &ipif->ipif_v6net_mask, /* mask */ 2549 &nipif->ipif_v6src_addr, /* src addr */ 2550 NULL, /* no gateway */ 2551 &ipif->ipif_mtu, /* max frag */ 2552 NULL, /* no Fast path header */ 2553 NULL, /* no recv from queue */ 2554 stq, /* send-to queue */ 2555 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2556 ill->ill_resolver_mp, /* xmit header */ 2557 ipif, 2558 NULL, 2559 0, 2560 0, 2561 0, 2562 &ire_uinfo_null, 2563 NULL, 2564 NULL, 2565 ipst); 2566 2567 if (ire != NULL) { 2568 ire_t *ret_ire; 2569 int error; 2570 2571 /* 2572 * We don't need ipif_ire anymore. We need to delete 2573 * before we add so that ire_add does not detect 2574 * duplicates. 2575 */ 2576 ire_delete(ipif_ire); 2577 ret_ire = ire; 2578 error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE); 2579 ASSERT(error == 0); 2580 ASSERT(ret_ire == ire); 2581 if (ret_ire != NULL) { 2582 /* Held in ire_add */ 2583 ire_refrele(ret_ire); 2584 } 2585 } 2586 /* 2587 * Either we are falling through from above or could not 2588 * allocate a replacement. 2589 */ 2590 ire_refrele(ipif_ire); 2591 if (ip6_asp_table_held) 2592 ip6_asp_table_refrele(ipst); 2593 if (nipif_refheld) 2594 ipif_refrele(nipif); 2595 } 2596 2597 /* 2598 * This old_ipif is going away. 2599 * 2600 * Determine if any other ipif's are using our address as 2601 * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or 2602 * IPIF_DEPRECATED). 2603 * Find the IRE_INTERFACE for such ipif's and recreate them 2604 * to use an different source address following the rules in 2605 * ipif_up_done_v6. 2606 * 2607 * This function takes an illgrp as an argument so that illgrp_delete 2608 * can call this to update source address even after deleting the 2609 * old_ipif->ipif_ill from the ill group. 2610 */ 2611 void 2612 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp) 2613 { 2614 ipif_t *ipif; 2615 ill_t *ill; 2616 char buf[INET6_ADDRSTRLEN]; 2617 2618 ASSERT(IAM_WRITER_IPIF(old_ipif)); 2619 2620 ill = old_ipif->ipif_ill; 2621 2622 ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n", 2623 ill->ill_name, 2624 inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr, 2625 buf, sizeof (buf)))); 2626 2627 /* 2628 * If this part of a group, look at all ills as ipif_select_source 2629 * borrows a source address across all the ills in the group. 2630 */ 2631 if (illgrp != NULL) 2632 ill = illgrp->illgrp_ill; 2633 2634 /* Don't need a lock since this is a writer */ 2635 for (; ill != NULL; ill = ill->ill_group_next) { 2636 for (ipif = ill->ill_ipif; ipif != NULL; 2637 ipif = ipif->ipif_next) { 2638 2639 if (ipif == old_ipif) 2640 continue; 2641 2642 ipif_recreate_interface_routes_v6(old_ipif, ipif); 2643 } 2644 } 2645 } 2646 2647 /* 2648 * Perform an attach and bind to get phys addr plus info_req for 2649 * the physical device. 2650 * q and mp represents an ioctl which will be queued waiting for 2651 * completion of the DLPI message exchange. 2652 * MUST be called on an ill queue. Can not set conn_pending_ill for that 2653 * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q. 2654 * 2655 * Returns EINPROGRESS when mp has been consumed by queueing it on 2656 * ill_pending_mp and the ioctl will complete in ip_rput. 2657 */ 2658 int 2659 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2660 { 2661 mblk_t *v6token_mp = NULL; 2662 mblk_t *v6lla_mp = NULL; 2663 mblk_t *phys_mp = NULL; 2664 mblk_t *info_mp = NULL; 2665 mblk_t *attach_mp = NULL; 2666 mblk_t *bind_mp = NULL; 2667 mblk_t *unbind_mp = NULL; 2668 mblk_t *notify_mp = NULL; 2669 2670 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2671 ASSERT(ill->ill_dlpi_style_set); 2672 ASSERT(WR(q)->q_next != NULL); 2673 2674 if (ill->ill_isv6) { 2675 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2676 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2677 if (v6token_mp == NULL) 2678 goto bad; 2679 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2680 DL_IPV6_TOKEN; 2681 2682 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2683 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2684 if (v6lla_mp == NULL) 2685 goto bad; 2686 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2687 DL_IPV6_LINK_LAYER_ADDR; 2688 } 2689 2690 /* 2691 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2692 */ 2693 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2694 DL_NOTIFY_REQ); 2695 if (notify_mp == NULL) 2696 goto bad; 2697 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2698 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2699 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG); 2700 2701 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2702 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2703 if (phys_mp == NULL) 2704 goto bad; 2705 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2706 DL_CURR_PHYS_ADDR; 2707 2708 info_mp = ip_dlpi_alloc( 2709 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2710 DL_INFO_REQ); 2711 if (info_mp == NULL) 2712 goto bad; 2713 2714 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2715 DL_BIND_REQ); 2716 if (bind_mp == NULL) 2717 goto bad; 2718 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2719 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2720 2721 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2722 if (unbind_mp == NULL) 2723 goto bad; 2724 2725 /* If we need to attach, pre-alloc and initialize the mblk */ 2726 if (ill->ill_needs_attach) { 2727 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2728 DL_ATTACH_REQ); 2729 if (attach_mp == NULL) 2730 goto bad; 2731 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2732 } 2733 2734 /* 2735 * Here we are going to delay the ioctl ack until after 2736 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2737 * original ioctl message before sending the requests 2738 */ 2739 mutex_enter(&ill->ill_lock); 2740 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2741 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2742 /* 2743 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2744 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2745 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2746 */ 2747 ill->ill_phys_addr_pend = 0; 2748 mutex_exit(&ill->ill_lock); 2749 2750 if (attach_mp != NULL) { 2751 ip1dbg(("ill_dl_phys: attach\n")); 2752 ill_dlpi_send(ill, attach_mp); 2753 } 2754 ill_dlpi_send(ill, bind_mp); 2755 ill_dlpi_send(ill, info_mp); 2756 if (ill->ill_isv6) { 2757 ill_dlpi_send(ill, v6token_mp); 2758 ill_dlpi_send(ill, v6lla_mp); 2759 } 2760 ill_dlpi_send(ill, phys_mp); 2761 ill_dlpi_send(ill, notify_mp); 2762 ill_dlpi_send(ill, unbind_mp); 2763 2764 /* 2765 * This operation will complete in ip_rput_dlpi_writer with either 2766 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2767 */ 2768 return (EINPROGRESS); 2769 bad: 2770 freemsg(v6token_mp); 2771 freemsg(v6lla_mp); 2772 freemsg(phys_mp); 2773 freemsg(info_mp); 2774 freemsg(attach_mp); 2775 freemsg(bind_mp); 2776 freemsg(unbind_mp); 2777 freemsg(notify_mp); 2778 return (ENOMEM); 2779 } 2780 2781 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2782 2783 /* 2784 * DLPI is up. 2785 * Create all the IREs associated with an interface bring up multicast. 2786 * Set the interface flag and finish other initialization 2787 * that potentially had to be differed to after DL_BIND_ACK. 2788 */ 2789 int 2790 ipif_up_done_v6(ipif_t *ipif) 2791 { 2792 ire_t *ire_array[20]; 2793 ire_t **irep = ire_array; 2794 ire_t **irep1; 2795 ill_t *ill = ipif->ipif_ill; 2796 queue_t *stq; 2797 in6_addr_t v6addr; 2798 in6_addr_t route_mask; 2799 ipif_t *src_ipif = NULL; 2800 ipif_t *tmp_ipif; 2801 boolean_t flush_ire_cache = B_TRUE; 2802 int err; 2803 char buf[INET6_ADDRSTRLEN]; 2804 phyint_t *phyi; 2805 ire_t **ipif_saved_irep = NULL; 2806 int ipif_saved_ire_cnt; 2807 int cnt; 2808 boolean_t src_ipif_held = B_FALSE; 2809 boolean_t ire_added = B_FALSE; 2810 boolean_t loopback = B_FALSE; 2811 boolean_t ip6_asp_table_held = B_FALSE; 2812 ip_stack_t *ipst = ill->ill_ipst; 2813 2814 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2815 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2816 2817 /* Check if this is a loopback interface */ 2818 if (ipif->ipif_ill->ill_wq == NULL) 2819 loopback = B_TRUE; 2820 2821 ASSERT(ipif->ipif_isv6); 2822 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2823 2824 /* 2825 * If all other interfaces for this ill are down or DEPRECATED, 2826 * or otherwise unsuitable for source address selection, remove 2827 * any IRE_CACHE entries for this ill to make sure source 2828 * address selection gets to take this new ipif into account. 2829 * No need to hold ill_lock while traversing the ipif list since 2830 * we are writer 2831 */ 2832 for (tmp_ipif = ill->ill_ipif; tmp_ipif; 2833 tmp_ipif = tmp_ipif->ipif_next) { 2834 if (((tmp_ipif->ipif_flags & 2835 (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) || 2836 !(tmp_ipif->ipif_flags & IPIF_UP)) || 2837 (tmp_ipif == ipif)) 2838 continue; 2839 /* first useable pre-existing interface */ 2840 flush_ire_cache = B_FALSE; 2841 break; 2842 } 2843 if (flush_ire_cache) 2844 ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE, 2845 IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill); 2846 2847 /* 2848 * Figure out which way the send-to queue should go. Only 2849 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here. 2850 */ 2851 switch (ill->ill_net_type) { 2852 case IRE_IF_RESOLVER: 2853 stq = ill->ill_rq; 2854 break; 2855 case IRE_IF_NORESOLVER: 2856 case IRE_LOOPBACK: 2857 stq = ill->ill_wq; 2858 break; 2859 default: 2860 return (EINVAL); 2861 } 2862 2863 if (IS_LOOPBACK(ill)) { 2864 /* 2865 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 2866 * ipif_lookup_on_name(), but in the case of zones we can have 2867 * several loopback addresses on lo0. So all the interfaces with 2868 * loopback addresses need to be marked IRE_LOOPBACK. 2869 */ 2870 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 2871 ipif->ipif_ire_type = IRE_LOOPBACK; 2872 else 2873 ipif->ipif_ire_type = IRE_LOCAL; 2874 } 2875 2876 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) { 2877 /* 2878 * Can't use our source address. Select a different 2879 * source address for the IRE_INTERFACE and IRE_LOCAL 2880 */ 2881 if (ip6_asp_can_lookup(ipst)) { 2882 ip6_asp_table_held = B_TRUE; 2883 src_ipif = ipif_select_source_v6(ipif->ipif_ill, 2884 &ipif->ipif_v6subnet, RESTRICT_TO_NONE, 2885 IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid); 2886 } 2887 if (src_ipif == NULL) 2888 src_ipif = ipif; /* Last resort */ 2889 else 2890 src_ipif_held = B_TRUE; 2891 } else { 2892 src_ipif = ipif; 2893 } 2894 2895 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 2896 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 2897 2898 /* 2899 * If we're on a labeled system then make sure that zone- 2900 * private addresses have proper remote host database entries. 2901 */ 2902 if (is_system_labeled() && 2903 ipif->ipif_ire_type != IRE_LOOPBACK) { 2904 if (ip6opt_ls == 0) { 2905 cmn_err(CE_WARN, "IPv6 not enabled " 2906 "via /etc/system"); 2907 return (EINVAL); 2908 } 2909 if (!tsol_check_interface_address(ipif)) 2910 return (EINVAL); 2911 } 2912 2913 /* Register the source address for __sin6_src_id */ 2914 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 2915 ipif->ipif_zoneid, ipst); 2916 if (err != 0) { 2917 ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err)); 2918 if (src_ipif_held) 2919 ipif_refrele(src_ipif); 2920 if (ip6_asp_table_held) 2921 ip6_asp_table_refrele(ipst); 2922 return (err); 2923 } 2924 /* 2925 * If the interface address is set, create the LOCAL 2926 * or LOOPBACK IRE. 2927 */ 2928 ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n", 2929 ipif->ipif_ire_type, 2930 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 2931 buf, sizeof (buf)))); 2932 2933 *irep++ = ire_create_v6( 2934 &ipif->ipif_v6lcl_addr, /* dest address */ 2935 &ipv6_all_ones, /* mask */ 2936 &src_ipif->ipif_v6src_addr, /* source address */ 2937 NULL, /* no gateway */ 2938 &ip_loopback_mtu_v6plus, /* max frag size */ 2939 NULL, 2940 ipif->ipif_rq, /* recv-from queue */ 2941 NULL, /* no send-to queue */ 2942 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 2943 NULL, 2944 ipif, /* interface */ 2945 NULL, 2946 0, 2947 0, 2948 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2949 &ire_uinfo_null, 2950 NULL, 2951 NULL, 2952 ipst); 2953 } 2954 2955 /* 2956 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. 2957 * Note that atun interfaces have an all-zero ipif_v6subnet. 2958 * Thus we allow a zero subnet as long as the mask is non-zero. 2959 */ 2960 if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) && 2961 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2962 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2963 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2964 v6addr = ipif->ipif_v6subnet; 2965 2966 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2967 route_mask = ipv6_all_ones; 2968 } else { 2969 route_mask = ipif->ipif_v6net_mask; 2970 } 2971 2972 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n", 2973 ill->ill_net_type, 2974 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 2975 2976 *irep++ = ire_create_v6( 2977 &v6addr, /* dest pref */ 2978 &route_mask, /* mask */ 2979 &src_ipif->ipif_v6src_addr, /* src addr */ 2980 NULL, /* no gateway */ 2981 &ipif->ipif_mtu, /* max frag */ 2982 NULL, /* no Fast path header */ 2983 NULL, /* no recv from queue */ 2984 stq, /* send-to queue */ 2985 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2986 ill->ill_resolver_mp, /* xmit header */ 2987 ipif, 2988 NULL, 2989 0, 2990 0, 2991 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2992 &ire_uinfo_null, 2993 NULL, 2994 NULL, 2995 ipst); 2996 } 2997 2998 /* 2999 * Setup 2002::/16 route, if this interface is a 6to4 tunnel 3000 */ 3001 if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) && 3002 (ill->ill_is_6to4tun)) { 3003 /* 3004 * Destination address is 2002::/16 3005 */ 3006 #ifdef _BIG_ENDIAN 3007 const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 }; 3008 const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 }; 3009 #else 3010 const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 }; 3011 const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 }; 3012 #endif /* _BIG_ENDIAN */ 3013 char buf2[INET6_ADDRSTRLEN]; 3014 ire_t *isdup; 3015 in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr; 3016 3017 /* 3018 * check to see if this route has already been added for 3019 * this tunnel interface. 3020 */ 3021 isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0, 3022 IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL, 3023 (MATCH_IRE_SRC | MATCH_IRE_MASK), ipst); 3024 3025 if (isdup == NULL) { 3026 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s", 3027 IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr, 3028 buf2, sizeof (buf2)))); 3029 3030 *irep++ = ire_create_v6( 3031 &prefix_addr, /* 2002:: */ 3032 &prefix_mask, /* ffff:: */ 3033 &ipif->ipif_v6lcl_addr, /* src addr */ 3034 NULL, /* gateway */ 3035 &ipif->ipif_mtu, /* max_frag */ 3036 NULL, /* no Fast Path hdr */ 3037 NULL, /* no rfq */ 3038 ill->ill_wq, /* stq */ 3039 IRE_IF_NORESOLVER, /* type */ 3040 ill->ill_resolver_mp, /* dlureq_mp */ 3041 ipif, /* interface */ 3042 NULL, /* v6cmask */ 3043 0, 3044 0, 3045 RTF_UP, 3046 &ire_uinfo_null, 3047 NULL, 3048 NULL, 3049 ipst); 3050 } else { 3051 ire_refrele(isdup); 3052 } 3053 } 3054 3055 /* If an earlier ire_create failed, get out now */ 3056 for (irep1 = irep; irep1 > ire_array; ) { 3057 irep1--; 3058 if (*irep1 == NULL) { 3059 ip1dbg(("ipif_up_done_v6: NULL ire found in" 3060 " ire_array\n")); 3061 err = ENOMEM; 3062 goto bad; 3063 } 3064 } 3065 3066 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 3067 3068 /* 3069 * Need to atomically check for ip_addr_availablity_check 3070 * now under ill_g_lock, and if it fails got bad, and remove 3071 * from group also 3072 */ 3073 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 3074 mutex_enter(&ipst->ips_ip_addr_avail_lock); 3075 ill->ill_ipif_up_count++; 3076 ipif->ipif_flags |= IPIF_UP; 3077 err = ip_addr_availability_check(ipif); 3078 mutex_exit(&ipst->ips_ip_addr_avail_lock); 3079 rw_exit(&ipst->ips_ill_g_lock); 3080 3081 if (err != 0) { 3082 /* 3083 * Our address may already be up on the same ill. In this case, 3084 * the external resolver entry for our ipif replaced the one for 3085 * the other ipif. So we don't want to delete it (otherwise the 3086 * other ipif would be unable to send packets). 3087 * ip_addr_availability_check() identifies this case for us and 3088 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL 3089 * which is the expected error code. 3090 */ 3091 if (err == EADDRINUSE) { 3092 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) { 3093 freemsg(ipif->ipif_arp_del_mp); 3094 ipif->ipif_arp_del_mp = NULL; 3095 } 3096 err = EADDRNOTAVAIL; 3097 } 3098 ill->ill_ipif_up_count--; 3099 ipif->ipif_flags &= ~IPIF_UP; 3100 goto bad; 3101 } 3102 3103 /* 3104 * Add in all newly created IREs. We want to add before 3105 * we call ifgrp_insert which wants to know whether 3106 * IRE_IF_RESOLVER exists or not. 3107 * 3108 * NOTE : We refrele the ire though we may branch to "bad" 3109 * later on where we do ire_delete. This is okay 3110 * because nobody can delete it as we are running 3111 * exclusively. 3112 */ 3113 for (irep1 = irep; irep1 > ire_array; ) { 3114 irep1--; 3115 /* Shouldn't be adding any bcast ire's */ 3116 ASSERT((*irep1)->ire_type != IRE_BROADCAST); 3117 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 3118 /* 3119 * refheld by ire_add. refele towards the end of the func 3120 */ 3121 (void) ire_add(irep1, NULL, NULL, NULL, B_FALSE); 3122 } 3123 if (ip6_asp_table_held) { 3124 ip6_asp_table_refrele(ipst); 3125 ip6_asp_table_held = B_FALSE; 3126 } 3127 ire_added = B_TRUE; 3128 3129 /* 3130 * Form groups if possible. 3131 * 3132 * If we are supposed to be in a ill_group with a name, insert it 3133 * now as we know that at least one ipif is UP. Otherwise form 3134 * nameless groups. 3135 * 3136 * If ip_enable_group_ifs is set and ipif address is not ::0, insert 3137 * this ipif into the appropriate interface group, or create a 3138 * new one. If this is already in a nameless group, we try to form 3139 * a bigger group looking at other ills potentially sharing this 3140 * ipif's prefix. 3141 */ 3142 phyi = ill->ill_phyint; 3143 if (phyi->phyint_groupname_len != 0) { 3144 ASSERT(phyi->phyint_groupname != NULL); 3145 if (ill->ill_ipif_up_count == 1) { 3146 ASSERT(ill->ill_group == NULL); 3147 err = illgrp_insert(&ipst->ips_illgrp_head_v6, ill, 3148 phyi->phyint_groupname, NULL, B_TRUE); 3149 if (err != 0) { 3150 ip1dbg(("ipif_up_done_v6: illgrp allocation " 3151 "failed, error %d\n", err)); 3152 goto bad; 3153 } 3154 } 3155 ASSERT(ill->ill_group != NULL); 3156 } 3157 3158 /* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */ 3159 ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt; 3160 ipif_saved_irep = ipif_recover_ire_v6(ipif); 3161 3162 if (ipif->ipif_ipif_up_count == 1 && !loopback) { 3163 /* 3164 * Need to recover all multicast memberships in the driver. 3165 * This had to be deferred until we had attached. 3166 */ 3167 ill_recover_multicast(ill); 3168 } 3169 /* Join the allhosts multicast address and the solicited node MC */ 3170 ipif_multicast_up(ipif); 3171 3172 if (!loopback) { 3173 /* 3174 * See whether anybody else would benefit from the 3175 * new ipif that we added. We call this always rather 3176 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST 3177 * ipif for the benefit of illgrp_insert (done above) 3178 * which does not do source address selection as it does 3179 * not want to re-create interface routes that we are 3180 * having reference to it here. 3181 */ 3182 ill_update_source_selection(ill); 3183 } 3184 3185 for (irep1 = irep; irep1 > ire_array; ) { 3186 irep1--; 3187 if (*irep1 != NULL) { 3188 /* was held in ire_add */ 3189 ire_refrele(*irep1); 3190 } 3191 } 3192 3193 cnt = ipif_saved_ire_cnt; 3194 for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) { 3195 if (*irep1 != NULL) { 3196 /* was held in ire_add */ 3197 ire_refrele(*irep1); 3198 } 3199 } 3200 3201 if (ipif->ipif_addr_ready) { 3202 ip_rts_ifmsg(ipif); 3203 ip_rts_newaddrmsg(RTM_ADD, 0, ipif); 3204 sctp_update_ipif(ipif, SCTP_IPIF_UP); 3205 } 3206 3207 if (ipif_saved_irep != NULL) { 3208 kmem_free(ipif_saved_irep, 3209 ipif_saved_ire_cnt * sizeof (ire_t *)); 3210 } 3211 3212 if (src_ipif_held) 3213 ipif_refrele(src_ipif); 3214 return (0); 3215 3216 bad: 3217 if (ip6_asp_table_held) 3218 ip6_asp_table_refrele(ipst); 3219 /* 3220 * We don't have to bother removing from ill groups because 3221 * 3222 * 1) For groups with names, we insert only when the first ipif 3223 * comes up. In that case if it fails, it will not be in any 3224 * group. So, we need not try to remove for that case. 3225 * 3226 * 2) For groups without names, either we tried to insert ipif_ill 3227 * in a group as singleton or found some other group to become 3228 * a bigger group. For the former, if it fails we don't have 3229 * anything to do as ipif_ill is not in the group and for the 3230 * latter, there are no failures in illgrp_insert/illgrp_delete 3231 * (ENOMEM can't occur for this. Check ifgrp_insert). 3232 */ 3233 3234 while (irep > ire_array) { 3235 irep--; 3236 if (*irep != NULL) { 3237 ire_delete(*irep); 3238 if (ire_added) 3239 ire_refrele(*irep); 3240 } 3241 3242 } 3243 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst); 3244 3245 if (ipif_saved_irep != NULL) { 3246 kmem_free(ipif_saved_irep, 3247 ipif_saved_ire_cnt * sizeof (ire_t *)); 3248 } 3249 if (src_ipif_held) 3250 ipif_refrele(src_ipif); 3251 3252 ipif_ndp_down(ipif); 3253 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) 3254 ipif_arp_down(ipif); 3255 3256 return (err); 3257 } 3258 3259 /* 3260 * Delete an ND entry and the corresponding IRE_CACHE entry if it exists. 3261 */ 3262 /* ARGSUSED */ 3263 int 3264 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3265 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3266 { 3267 in6_addr_t addr; 3268 sin6_t *sin6; 3269 nce_t *nce; 3270 struct lifreq *lifr; 3271 lif_nd_req_t *lnr; 3272 mblk_t *mp1; 3273 3274 mp1 = mp->b_cont->b_cont; 3275 lifr = (struct lifreq *)mp1->b_rptr; 3276 lnr = &lifr->lifr_nd; 3277 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3278 if (ipif->ipif_id != 0) 3279 return (EINVAL); 3280 3281 if (!ipif->ipif_isv6) 3282 return (EINVAL); 3283 3284 if (lnr->lnr_addr.ss_family != AF_INET6) 3285 return (EAFNOSUPPORT); 3286 3287 sin6 = (sin6_t *)&lnr->lnr_addr; 3288 addr = sin6->sin6_addr; 3289 nce = ndp_lookup_v6(ipif->ipif_ill, &addr, B_FALSE); 3290 if (nce == NULL) 3291 return (ESRCH); 3292 ndp_delete(nce); 3293 NCE_REFRELE(nce); 3294 return (0); 3295 } 3296 3297 /* 3298 * Return nbr cache info. 3299 */ 3300 /* ARGSUSED */ 3301 int 3302 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3303 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3304 { 3305 ill_t *ill = ipif->ipif_ill; 3306 struct lifreq *lifr; 3307 lif_nd_req_t *lnr; 3308 3309 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3310 lnr = &lifr->lifr_nd; 3311 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3312 if (ipif->ipif_id != 0) 3313 return (EINVAL); 3314 3315 if (!ipif->ipif_isv6) 3316 return (EINVAL); 3317 3318 if (lnr->lnr_addr.ss_family != AF_INET6) 3319 return (EAFNOSUPPORT); 3320 3321 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 3322 return (EINVAL); 3323 3324 return (ndp_query(ill, lnr)); 3325 } 3326 3327 /* 3328 * Perform an update of the nd entry for the specified address. 3329 */ 3330 /* ARGSUSED */ 3331 int 3332 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3333 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3334 { 3335 ill_t *ill = ipif->ipif_ill; 3336 struct lifreq *lifr; 3337 lif_nd_req_t *lnr; 3338 3339 ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL); 3340 3341 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3342 lnr = &lifr->lifr_nd; 3343 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3344 if (ipif->ipif_id != 0) 3345 return (EINVAL); 3346 3347 if (!ipif->ipif_isv6) 3348 return (EINVAL); 3349 3350 if (lnr->lnr_addr.ss_family != AF_INET6) 3351 return (EAFNOSUPPORT); 3352 3353 return (ndp_sioc_update(ill, lnr)); 3354 } 3355