1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 /* Copyright (c) 1990 Mentat Inc. */ 27 28 #pragma ident "%Z%%M% %I% %E% SMI" 29 30 31 /* 32 * This file contains routines that manipulate Internet Routing Entries (IREs). 33 */ 34 35 #include <sys/types.h> 36 #include <sys/stream.h> 37 #include <sys/stropts.h> 38 #include <sys/strlog.h> 39 #include <sys/dlpi.h> 40 #include <sys/ddi.h> 41 #include <sys/cmn_err.h> 42 #include <sys/policy.h> 43 44 #include <sys/systm.h> 45 #include <sys/kmem.h> 46 #include <sys/param.h> 47 #include <sys/socket.h> 48 #include <net/if.h> 49 #include <net/route.h> 50 #include <netinet/in.h> 51 #include <net/if_dl.h> 52 #include <netinet/ip6.h> 53 #include <netinet/icmp6.h> 54 55 #include <inet/common.h> 56 #include <inet/mi.h> 57 #include <inet/ip.h> 58 #include <inet/ip6.h> 59 #include <inet/ip_ndp.h> 60 #include <inet/arp.h> 61 #include <inet/ip_if.h> 62 #include <inet/ip_ire.h> 63 #include <inet/ip_rts.h> 64 #include <inet/nd.h> 65 66 #include <net/pfkeyv2.h> 67 #include <inet/ipsec_info.h> 68 #include <inet/sadb.h> 69 #include <sys/kmem.h> 70 #include <inet/tcp.h> 71 #include <inet/ipclassifier.h> 72 #include <sys/zone.h> 73 74 /* 75 * Synchronization notes: 76 * 77 * The fields of the ire_t struct are protected in the following way : 78 * 79 * ire_next/ire_ptpn 80 * 81 * - bucket lock of the respective tables (cache or forwarding tables). 82 * 83 * ire_fp_mp 84 * ire_dlureq_mp 85 * 86 * - ire_lock protects multiple threads updating ire_fp_mp 87 * simultaneously. Otherwise no locks are used while accessing 88 * (both read/write) both the fields. 89 * 90 * ire_mp, ire_rfq, ire_stq, ire_u *except* ire_gateway_addr[v6], ire_mask, 91 * ire_type, ire_create_time, ire_masklen, ire_ipversion, ire_flags, ire_ipif, 92 * ire_ihandle, ire_phandle, ire_nce, ire_bucket, ire_in_ill, ire_in_src_addr 93 * 94 * - Set in ire_create_v4/v6 and never changes after that. Thus, 95 * we don't need a lock whenever these fields are accessed. 96 * 97 * - ire_bucket and ire_masklen (also set in ire_create) is set in 98 * ire_add_v4/ire_add_v6 before inserting in the bucket and never 99 * changes after that. Thus we don't need a lock whenever these 100 * fields are accessed. 101 * 102 * ire_gateway_addr_v4[v6] 103 * 104 * - ire_gateway_addr_v4[v6] is set during ire_create and later modified 105 * by rts_setgwr[v6]. As ire_gateway_addr is a uint32_t, updates to 106 * it assumed to be atomic and hence the other parts of the code 107 * does not use any locks. ire_gateway_addr_v6 updates are not atomic 108 * and hence any access to it uses ire_lock to get/set the right value. 109 * 110 * ire_ident, ire_refcnt 111 * 112 * - Updated atomically using atomic_add_32 113 * 114 * ire_ssthresh, ire_rtt_sd, ire_rtt, ire_ib_pkt_count, ire_ob_pkt_count 115 * 116 * - Assumes that 32 bit writes are atomic. No locks. ire_lock is 117 * used to serialize updates to ire_ssthresh, ire_rtt_sd, ire_rtt. 118 * 119 * ire_max_frag, ire_frag_flag 120 * 121 * - ire_lock is used to set/read both of them together. 122 * 123 * ire_tire_mark 124 * 125 * - Set in ire_create and updated in ire_expire, which is called 126 * by only one function namely ip_trash_timer_expire. Thus only 127 * one function updates and examines the value. 128 * 129 * ire_marks 130 * - bucket lock protects this. 131 * 132 * ire_ipsec_overhead/ire_ll_hdr_length 133 * 134 * - Place holder for returning the information to the upper layers 135 * when IRE_DB_REQ comes down. 136 * 137 * ip_ire_default_count protected by the bucket lock of 138 * ip_forwarding_table[0][0]. 139 * 140 * ipv6_ire_default_count is protected by the bucket lock of 141 * ip_forwarding_table_v6[0][0]. 142 * 143 * ip_ire_default_index/ipv6_ire_default_index is not protected as it 144 * is just a hint at which default gateway to use. There is nothing 145 * wrong in using the same gateway for two different connections. 146 * 147 * As we always hold the bucket locks in all the places while accessing 148 * the above values, it is natural to use them for protecting them. 149 * 150 * We have a separate cache table and forwarding table for IPv4 and IPv6. 151 * Cache table (ip_cache_table/ip_cache_table_v6) is a pointer to an 152 * array of irb_t structure and forwarding table (ip_forwarding_table/ 153 * ip_forwarding_table_v6) is an array of pointers to array of irb_t 154 * structure. ip_forwarding_table[_v6] is allocated dynamically in 155 * ire_add_v4/v6. ire_ft_init_lock is used to serialize multiple threads 156 * initializing the same bucket. Once a bucket is initialized, it is never 157 * de-alloacted. This assumption enables us to access ip_forwarding_table[i] 158 * or ip_forwarding_table_v6[i] without any locks. 159 * 160 * Each irb_t - ire bucket structure has a lock to protect 161 * a bucket and the ires residing in the bucket have a back pointer to 162 * the bucket structure. It also has a reference count for the number 163 * of threads walking the bucket - irb_refcnt which is bumped up 164 * using the macro IRB_REFHOLD macro. The flags irb_flags can be 165 * set to IRE_MARK_CONDEMNED indicating that there are some ires 166 * in this bucket that are marked with IRE_MARK_CONDEMNED and the 167 * last thread to leave the bucket should delete the ires. Usually 168 * this is done by the IRB_REFRELE macro which is used to decrement 169 * the reference count on a bucket. 170 * 171 * IRE_REFHOLD/IRE_REFRELE macros operate on the ire which increments/ 172 * decrements the reference count, ire_refcnt, atomically on the ire. 173 * ire_refcnt is modified only using this macro. Operations on the IRE 174 * could be described as follows : 175 * 176 * CREATE an ire with reference count initialized to 1. 177 * 178 * ADDITION of an ire holds the bucket lock, checks for duplicates 179 * and then adds the ire. ire_add_v4/ire_add_v6 returns the ire after 180 * bumping up once more i.e the reference count is 2. This is to avoid 181 * an extra lookup in the functions calling ire_add which wants to 182 * work with the ire after adding. 183 * 184 * LOOKUP of an ire bumps up the reference count using IRE_REFHOLD 185 * macro. It is valid to bump up the referece count of the IRE, 186 * after the lookup has returned an ire. Following are the lookup 187 * functions that return an HELD ire : 188 * 189 * ire_lookup_local[_v6], ire_ctable_lookup[_v6], ire_ftable_lookup[_v6], 190 * ire_cache_lookup[_v6], ire_lookup_multi[_v6], ire_route_lookup[_v6], 191 * ipif_to_ire[_v6], ire_mrtun_lookup, ire_srcif_table_lookup. 192 * 193 * DELETION of an ire holds the bucket lock, removes it from the list 194 * and then decrements the reference count for having removed from the list 195 * by using the IRE_REFRELE macro. If some other thread has looked up 196 * the ire, the reference count would have been bumped up and hence 197 * this ire will not be freed once deleted. It will be freed once the 198 * reference count drops to zero. 199 * 200 * Add and Delete acquires the bucket lock as RW_WRITER, while all the 201 * lookups acquire the bucket lock as RW_READER. 202 * 203 * NOTE : The only functions that does the IRE_REFRELE when an ire is 204 * passed as an argument are : 205 * 206 * 1) ip_wput_ire : This is because it IRE_REFHOLD/RELEs the 207 * broadcast ires it looks up internally within 208 * the function. Currently, for simplicity it does 209 * not differentiate the one that is passed in and 210 * the ones it looks up internally. It always 211 * IRE_REFRELEs. 212 * 2) ire_send 213 * ire_send_v6 : As ire_send calls ip_wput_ire and other functions 214 * that take ire as an argument, it has to selectively 215 * IRE_REFRELE the ire. To maintain symmetry, 216 * ire_send_v6 does the same. 217 * 218 * Otherwise, the general rule is to do the IRE_REFRELE in the function 219 * that is passing the ire as an argument. 220 * 221 * In trying to locate ires the following points are to be noted. 222 * 223 * IRE_MARK_CONDEMNED signifies that the ire has been logically deleted and is 224 * to be ignored when walking the ires using ire_next. 225 * 226 * IRE_MARK_HIDDEN signifies that the ire is a special ire typically for the 227 * benefit of in.mpathd which needs to probe interfaces for failures. Normal 228 * applications should not be seeing this ire and hence this ire is ignored 229 * in most cases in the search using ire_next. 230 * 231 * Zones note: 232 * Walking IREs within a given zone also walks certain ires in other 233 * zones. This is done intentionally. IRE walks with a specified 234 * zoneid are used only when doing informational reports, and 235 * zone users want to see things that they can access. See block 236 * comment in ire_walk_ill_match(). 237 */ 238 239 static irb_t *ip_forwarding_table[IP_MASK_TABLE_SIZE]; 240 /* This is dynamically allocated in ip_ire_init */ 241 static irb_t *ip_cache_table; 242 /* This is dynamically allocated in ire_add_mrtun */ 243 irb_t *ip_mrtun_table; 244 245 uint32_t ire_handle = 1; 246 /* 247 * ire_ft_init_lock is used while initializing ip_forwarding_table 248 * dynamically in ire_add. 249 */ 250 kmutex_t ire_ft_init_lock; 251 kmutex_t ire_mrtun_lock; /* Protects creation of table and it's count */ 252 kmutex_t ire_srcif_table_lock; /* Same as above */ 253 /* 254 * The following counts are used to determine whether a walk is 255 * needed through the reverse tunnel table or through ills 256 */ 257 kmutex_t ire_handle_lock; /* Protects ire_handle */ 258 uint_t ire_mrtun_count; /* Number of ires in reverse tun table */ 259 260 /* 261 * A per-interface routing table is created ( if not present) 262 * when the first entry is added to this special routing table. 263 * This special routing table is accessed through the ill data structure. 264 * The routing table looks like cache table. For example, currently it 265 * is used by mobile-ip foreign agent to forward data that only comes from 266 * the home agent tunnel for a mobile node. Thus if the outgoing interface 267 * is a RESOLVER interface, IP may need to resolve the hardware address for 268 * the outgoing interface. The routing entries in this table are not updated 269 * in IRE_CACHE. When MCTL msg comes back from ARP, the incoming ill informa- 270 * tion is lost as the write queue is passed to ip_wput. 271 * But, before sending the packet out, the hardware information must be updated 272 * in the special forwarding table. ire_srcif_table_count keeps track of total 273 * number of ires that are in interface based tables. Each interface based 274 * table hangs off of the incoming ill and each ill_t also keeps a refcnt 275 * of ires in that table. 276 */ 277 278 uint_t ire_srcif_table_count; /* Number of ires in all srcif tables */ 279 280 /* 281 * The minimum size of IRE cache table. It will be recalcuated in 282 * ip_ire_init(). 283 */ 284 uint32_t ip_cache_table_size = IP_CACHE_TABLE_SIZE; 285 uint32_t ip6_cache_table_size = IP6_CACHE_TABLE_SIZE; 286 287 /* 288 * The size of the forwarding table. We will make sure that it is a 289 * power of 2 in ip_ire_init(). 290 */ 291 uint32_t ip_ftable_hash_size = IP_FTABLE_HASH_SIZE; 292 uint32_t ip6_ftable_hash_size = IP6_FTABLE_HASH_SIZE; 293 294 struct kmem_cache *ire_cache; 295 static ire_t ire_null; 296 297 ire_stats_t ire_stats_v4; /* IPv4 ire statistics */ 298 ire_stats_t ire_stats_v6; /* IPv6 ire statistics */ 299 300 /* 301 * The threshold number of IRE in a bucket when the IREs are 302 * cleaned up. This threshold is calculated later in ip_open() 303 * based on the speed of CPU and available memory. This default 304 * value is the maximum. 305 * 306 * We have two kinds of cached IRE, temporary and 307 * non-temporary. Temporary IREs are marked with 308 * IRE_MARK_TEMPORARY. They are IREs created for non 309 * TCP traffic and for forwarding purposes. All others 310 * are non-temporary IREs. We don't mark IRE created for 311 * TCP as temporary because TCP is stateful and there are 312 * info stored in the IRE which can be shared by other TCP 313 * connections to the same destination. For connected 314 * endpoint, we also don't want to mark the IRE used as 315 * temporary because the same IRE will be used frequently, 316 * otherwise, the app should not do a connect(). We change 317 * the marking at ip_bind_connected_*() if necessary. 318 * 319 * We want to keep the cache IRE hash bucket length reasonably 320 * short, otherwise IRE lookup functions will take "forever." 321 * We use the "crude" function that the IRE bucket 322 * length should be based on the CPU speed, which is 1 entry 323 * per x MHz, depending on the shift factor ip_ire_cpu_ratio 324 * (n). This means that with a 750MHz CPU, the max bucket 325 * length can be (750 >> n) entries. 326 * 327 * Note that this threshold is separate for temp and non-temp 328 * IREs. This means that the actual bucket length can be 329 * twice as that. And while we try to keep temporary IRE 330 * length at most at the threshold value, we do not attempt to 331 * make the length for non-temporary IREs fixed, for the 332 * reason stated above. Instead, we start trying to find 333 * "unused" non-temporary IREs when the bucket length reaches 334 * this threshold and clean them up. 335 * 336 * We also want to limit the amount of memory used by 337 * IREs. So if we are allowed to use ~3% of memory (M) 338 * for those IREs, each bucket should not have more than 339 * 340 * M / num of cache bucket / sizeof (ire_t) 341 * 342 * Again the above memory uses are separate for temp and 343 * non-temp cached IREs. 344 * 345 * We may also want the limit to be a function of the number 346 * of interfaces and number of CPUs. Doing the initialization 347 * in ip_open() means that every time an interface is plumbed, 348 * the max is re-calculated. Right now, we don't do anything 349 * different. In future, when we have more experience, we 350 * may want to change this behavior. 351 */ 352 uint32_t ip_ire_max_bucket_cnt = 10; 353 uint32_t ip6_ire_max_bucket_cnt = 10; 354 355 /* 356 * The minimum of the temporary IRE bucket count. We do not want 357 * the length of each bucket to be too short. This may hurt 358 * performance of some apps as the temporary IREs are removed too 359 * often. 360 */ 361 uint32_t ip_ire_min_bucket_cnt = 3; 362 uint32_t ip6_ire_min_bucket_cnt = 3; 363 364 /* 365 * The ratio of memory consumed by IRE used for temporary to available 366 * memory. This is a shift factor, so 6 means the ratio 1 to 64. This 367 * value can be changed in /etc/system. 6 is a reasonable number. 368 */ 369 uint32_t ip_ire_mem_ratio = 6; 370 /* The shift factor for CPU speed to calculate the max IRE bucket length. */ 371 uint32_t ip_ire_cpu_ratio = 7; 372 373 /* 374 * The maximum number of buckets in IRE cache table. In future, we may 375 * want to make it a dynamic hash table. For the moment, we fix the 376 * size and allocate the table in ip_ire_init() when IP is first loaded. 377 * We take into account the amount of memory a system has. 378 */ 379 #define IP_MAX_CACHE_TABLE_SIZE 4096 380 381 static uint32_t ip_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE; 382 static uint32_t ip6_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE; 383 384 #define NUM_ILLS 3 /* To build the ILL list to unlock */ 385 386 /* Zero iulp_t for initialization. */ 387 const iulp_t ire_uinfo_null = { 0 }; 388 389 static int ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, 390 ipsq_func_t func); 391 static int ire_add_srcif_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, 392 ipsq_func_t func); 393 static ire_t *ire_update_srcif_v4(ire_t *ire); 394 static void ire_delete_v4(ire_t *ire); 395 static void ire_report_ftable(ire_t *ire, char *mp); 396 static void ire_report_ctable(ire_t *ire, char *mp); 397 static void ire_report_mrtun_table(ire_t *ire, char *mp); 398 static void ire_report_srcif_table(ire_t *ire, char *mp); 399 static void ire_walk_ipvers(pfv_t func, char *arg, uchar_t vers, 400 zoneid_t zoneid); 401 static void ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, 402 pfv_t func, char *arg, uchar_t vers, ill_t *ill); 403 static void ire_walk_ill_tables(uint_t match_flags, uint_t ire_type, 404 pfv_t func, char *arg, size_t ftbl_sz, size_t htbl_sz, 405 irb_t **ipftbl, size_t ctbl_sz, irb_t *ipctbl, ill_t *ill, 406 zoneid_t zoneid); 407 static void ire_delete_host_redirects(ipaddr_t gateway); 408 static boolean_t ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask, 409 ipaddr_t gateway, int type, ipif_t *ipif, zoneid_t zoneid, 410 uint32_t ihandle, int match_flags); 411 static void ire_cache_cleanup(irb_t *irb, uint32_t threshold, int cnt); 412 extern void ill_unlock_ills(ill_t **list, int cnt); 413 static void ire_fastpath_list_add(ill_t *ill, ire_t *ire); 414 extern void th_trace_rrecord(th_trace_t *); 415 #ifdef IRE_DEBUG 416 static void ire_trace_inactive(ire_t *); 417 #endif 418 419 /* 420 * To avoid bloating the code, we call this function instead of 421 * using the macro IRE_REFRELE. Use macro only in performance 422 * critical paths. 423 * 424 * Must not be called while holding any locks. Otherwise if this is 425 * the last reference to be released there is a chance of recursive mutex 426 * panic due to ire_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying 427 * to restart an ioctl. The one exception is when the caller is sure that 428 * this is not the last reference to be released. Eg. if the caller is 429 * sure that the ire has not been deleted and won't be deleted. 430 */ 431 void 432 ire_refrele(ire_t *ire) 433 { 434 IRE_REFRELE(ire); 435 } 436 437 void 438 ire_refrele_notr(ire_t *ire) 439 { 440 IRE_REFRELE_NOTR(ire); 441 } 442 443 /* 444 * kmem_cache_alloc constructor for IRE in kma space. 445 * Note that when ire_mp is set the IRE is stored in that mblk and 446 * not in this cache. 447 */ 448 /* ARGSUSED */ 449 static int 450 ip_ire_constructor(void *buf, void *cdrarg, int kmflags) 451 { 452 ire_t *ire = buf; 453 454 ire->ire_fp_mp = NULL; 455 ire->ire_dlureq_mp = NULL; 456 457 return (0); 458 } 459 460 /* ARGSUSED1 */ 461 static void 462 ip_ire_destructor(void *buf, void *cdrarg) 463 { 464 ire_t *ire = buf; 465 466 ASSERT(ire->ire_fp_mp == NULL); 467 ASSERT(ire->ire_dlureq_mp == NULL); 468 } 469 470 /* 471 * This function is associated with the IP_IOC_IRE_ADVISE_NO_REPLY 472 * IOCTL. It is used by TCP (or other ULPs) to supply revised information 473 * for an existing CACHED IRE. 474 */ 475 /* ARGSUSED */ 476 int 477 ip_ire_advise(queue_t *q, mblk_t *mp, cred_t *ioc_cr) 478 { 479 uchar_t *addr_ucp; 480 ipic_t *ipic; 481 ire_t *ire; 482 ipaddr_t addr; 483 in6_addr_t v6addr; 484 irb_t *irb; 485 zoneid_t zoneid; 486 487 ASSERT(q->q_next == NULL); 488 zoneid = Q_TO_CONN(q)->conn_zoneid; 489 490 /* 491 * Check privilege using the ioctl credential; if it is NULL 492 * then this is a kernel message and therefor privileged. 493 */ 494 if (ioc_cr != NULL && secpolicy_net_config(ioc_cr, B_FALSE) != 0) 495 return (EPERM); 496 497 ipic = (ipic_t *)mp->b_rptr; 498 if (!(addr_ucp = mi_offset_param(mp, ipic->ipic_addr_offset, 499 ipic->ipic_addr_length))) { 500 return (EINVAL); 501 } 502 if (!OK_32PTR(addr_ucp)) 503 return (EINVAL); 504 switch (ipic->ipic_addr_length) { 505 case IP_ADDR_LEN: { 506 /* Extract the destination address. */ 507 addr = *(ipaddr_t *)addr_ucp; 508 /* Find the corresponding IRE. */ 509 ire = ire_cache_lookup(addr, zoneid); 510 break; 511 } 512 case IPV6_ADDR_LEN: { 513 /* Extract the destination address. */ 514 v6addr = *(in6_addr_t *)addr_ucp; 515 /* Find the corresponding IRE. */ 516 ire = ire_cache_lookup_v6(&v6addr, zoneid); 517 break; 518 } 519 default: 520 return (EINVAL); 521 } 522 523 if (ire == NULL) 524 return (ENOENT); 525 /* 526 * Update the round trip time estimate and/or the max frag size 527 * and/or the slow start threshold. 528 * 529 * We serialize multiple advises using ire_lock. 530 */ 531 mutex_enter(&ire->ire_lock); 532 if (ipic->ipic_rtt) { 533 /* 534 * If there is no old cached values, initialize them 535 * conservatively. Set them to be (1.5 * new value). 536 */ 537 if (ire->ire_uinfo.iulp_rtt != 0) { 538 ire->ire_uinfo.iulp_rtt = (ire->ire_uinfo.iulp_rtt + 539 ipic->ipic_rtt) >> 1; 540 } else { 541 ire->ire_uinfo.iulp_rtt = ipic->ipic_rtt + 542 (ipic->ipic_rtt >> 1); 543 } 544 if (ire->ire_uinfo.iulp_rtt_sd != 0) { 545 ire->ire_uinfo.iulp_rtt_sd = 546 (ire->ire_uinfo.iulp_rtt_sd + 547 ipic->ipic_rtt_sd) >> 1; 548 } else { 549 ire->ire_uinfo.iulp_rtt_sd = ipic->ipic_rtt_sd + 550 (ipic->ipic_rtt_sd >> 1); 551 } 552 } 553 if (ipic->ipic_max_frag) 554 ire->ire_max_frag = MIN(ipic->ipic_max_frag, IP_MAXPACKET); 555 if (ipic->ipic_ssthresh != 0) { 556 if (ire->ire_uinfo.iulp_ssthresh != 0) 557 ire->ire_uinfo.iulp_ssthresh = 558 (ipic->ipic_ssthresh + 559 ire->ire_uinfo.iulp_ssthresh) >> 1; 560 else 561 ire->ire_uinfo.iulp_ssthresh = ipic->ipic_ssthresh; 562 } 563 /* 564 * Don't need the ire_lock below this. ire_type does not change 565 * after initialization. ire_marks is protected by irb_lock. 566 */ 567 mutex_exit(&ire->ire_lock); 568 569 if (ipic->ipic_ire_marks != 0 && ire->ire_type == IRE_CACHE) { 570 /* 571 * Only increment the temporary IRE count if the original 572 * IRE is not already marked temporary. 573 */ 574 irb = ire->ire_bucket; 575 rw_enter(&irb->irb_lock, RW_WRITER); 576 if ((ipic->ipic_ire_marks & IRE_MARK_TEMPORARY) && 577 !(ire->ire_marks & IRE_MARK_TEMPORARY)) { 578 irb->irb_tmp_ire_cnt++; 579 } 580 ire->ire_marks |= ipic->ipic_ire_marks; 581 rw_exit(&irb->irb_lock); 582 } 583 584 ire_refrele(ire); 585 return (0); 586 } 587 588 /* 589 * This function is associated with the IP_IOC_IRE_DELETE[_NO_REPLY] 590 * IOCTL[s]. The NO_REPLY form is used by TCP to delete a route IRE 591 * for a host that is not responding. This will force an attempt to 592 * establish a new route, if available. Management processes may want 593 * to use the version that generates a reply. 594 * 595 * This function does not support IPv6 since Neighbor Unreachability Detection 596 * means that negative advise like this is useless. 597 */ 598 /* ARGSUSED */ 599 int 600 ip_ire_delete(queue_t *q, mblk_t *mp, cred_t *ioc_cr) 601 { 602 uchar_t *addr_ucp; 603 ipaddr_t addr; 604 ire_t *ire; 605 ipid_t *ipid; 606 boolean_t routing_sock_info = B_FALSE; /* Sent info? */ 607 zoneid_t zoneid; 608 609 ASSERT(q->q_next == NULL); 610 zoneid = Q_TO_CONN(q)->conn_zoneid; 611 612 /* 613 * Check privilege using the ioctl credential; if it is NULL 614 * then this is a kernel message and therefor privileged. 615 */ 616 if (ioc_cr != NULL && secpolicy_net_config(ioc_cr, B_FALSE) != 0) 617 return (EPERM); 618 619 ipid = (ipid_t *)mp->b_rptr; 620 621 /* Only actions on IRE_CACHEs are acceptable at present. */ 622 if (ipid->ipid_ire_type != IRE_CACHE) 623 return (EINVAL); 624 625 addr_ucp = mi_offset_param(mp, ipid->ipid_addr_offset, 626 ipid->ipid_addr_length); 627 if (addr_ucp == NULL || !OK_32PTR(addr_ucp)) 628 return (EINVAL); 629 switch (ipid->ipid_addr_length) { 630 case IP_ADDR_LEN: 631 /* addr_ucp points at IP addr */ 632 break; 633 case sizeof (sin_t): { 634 sin_t *sin; 635 /* 636 * got complete (sockaddr) address - increment addr_ucp to point 637 * at the ip_addr field. 638 */ 639 sin = (sin_t *)addr_ucp; 640 addr_ucp = (uchar_t *)&sin->sin_addr.s_addr; 641 break; 642 } 643 default: 644 return (EINVAL); 645 } 646 /* Extract the destination address. */ 647 bcopy(addr_ucp, &addr, IP_ADDR_LEN); 648 649 /* Try to find the CACHED IRE. */ 650 ire = ire_cache_lookup(addr, zoneid); 651 652 /* Nail it. */ 653 if (ire) { 654 /* Allow delete only on CACHE entries */ 655 if (ire->ire_type != IRE_CACHE) { 656 ire_refrele(ire); 657 return (EINVAL); 658 } 659 660 /* 661 * Verify that the IRE has been around for a while. 662 * This is to protect against transport protocols 663 * that are too eager in sending delete messages. 664 */ 665 if (gethrestime_sec() < 666 ire->ire_create_time + ip_ignore_delete_time) { 667 ire_refrele(ire); 668 return (EINVAL); 669 } 670 /* 671 * Now we have a potentially dead cache entry. We need 672 * to remove it. 673 * If this cache entry is generated from a default route, 674 * search the default list and mark it dead and some 675 * background process will try to activate it. 676 */ 677 if ((ire->ire_gateway_addr != 0) && (ire->ire_cmask == 0)) { 678 /* 679 * Make sure that we pick a different 680 * IRE_DEFAULT next time. 681 * The ip_ire_default_count tracks the number of 682 * IRE_DEFAULT entries. However, the 683 * ip_forwarding_table[0] also contains 684 * interface routes thus the count can be zero. 685 */ 686 ire_t *gw_ire; 687 irb_t *irb_ptr; 688 irb_t *irb; 689 690 if (((irb_ptr = ip_forwarding_table[0]) != NULL) && 691 (irb = &irb_ptr[0])->irb_ire != NULL && 692 ip_ire_default_count != 0) { 693 uint_t index; 694 695 /* 696 * We grab it as writer just to serialize 697 * multiple threads trying to bump up 698 * ip_ire_default_index. 699 */ 700 rw_enter(&irb->irb_lock, RW_WRITER); 701 if ((gw_ire = irb->irb_ire) == NULL) { 702 rw_exit(&irb->irb_lock); 703 goto done; 704 } 705 index = ip_ire_default_index % 706 ip_ire_default_count; 707 while (index-- && gw_ire->ire_next != NULL) 708 gw_ire = gw_ire->ire_next; 709 710 /* Skip past the potentially bad gateway */ 711 if (ire->ire_gateway_addr == 712 gw_ire->ire_gateway_addr) 713 ip_ire_default_index++; 714 715 rw_exit(&irb->irb_lock); 716 } 717 } 718 done: 719 /* report the bad route to routing sockets */ 720 ip_rts_change(RTM_LOSING, ire->ire_addr, ire->ire_gateway_addr, 721 ire->ire_mask, ire->ire_src_addr, 0, 0, 0, 722 (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA)); 723 routing_sock_info = B_TRUE; 724 ire_delete(ire); 725 ire_refrele(ire); 726 } 727 /* Also look for an IRE_HOST_REDIRECT and remove it if present */ 728 ire = ire_route_lookup(addr, 0, 0, IRE_HOST_REDIRECT, NULL, NULL, 729 ALL_ZONES, MATCH_IRE_TYPE); 730 731 /* Nail it. */ 732 if (ire) { 733 if (!routing_sock_info) { 734 ip_rts_change(RTM_LOSING, ire->ire_addr, 735 ire->ire_gateway_addr, ire->ire_mask, 736 ire->ire_src_addr, 0, 0, 0, 737 (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA)); 738 } 739 ire_delete(ire); 740 ire_refrele(ire); 741 } 742 return (0); 743 } 744 745 /* 746 * Named Dispatch routine to produce a formatted report on all IREs. 747 * This report is accessed by using the ndd utility to "get" ND variable 748 * "ipv4_ire_status". 749 */ 750 /* ARGSUSED */ 751 int 752 ip_ire_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr) 753 { 754 zoneid_t zoneid; 755 756 (void) mi_mpprintf(mp, 757 "IRE " MI_COL_HDRPAD_STR 758 /* 01234567[89ABCDEF] */ 759 "rfq " MI_COL_HDRPAD_STR 760 /* 01234567[89ABCDEF] */ 761 "stq " MI_COL_HDRPAD_STR 762 /* 01234567[89ABCDEF] */ 763 " zone " 764 /* 12345 */ 765 "addr mask " 766 /* 123.123.123.123 123.123.123.123 */ 767 "src gateway mxfrg rtt rtt_sd ssthresh ref " 768 /* 123.123.123.123 123.123.123.123 12345 12345 123456 12345678 123 */ 769 "rtomax tstamp_ok wscale_ok ecn_ok pmtud_ok sack sendpipe " 770 /* 123456 123456789 123456789 123456 12345678 1234 12345678 */ 771 "recvpipe in/out/forward type"); 772 /* 12345678 in/out/forward xxxxxxxxxx */ 773 774 /* 775 * Because of the ndd constraint, at most we can have 64K buffer 776 * to put in all IRE info. So to be more efficient, just 777 * allocate a 64K buffer here, assuming we need that large buffer. 778 * This should be OK as only root can do ndd /dev/ip. 779 */ 780 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 781 /* The following may work even if we cannot get a large buf. */ 782 (void) mi_mpprintf(mp, "<< Out of buffer >>\n"); 783 return (0); 784 } 785 786 zoneid = Q_TO_CONN(q)->conn_zoneid; 787 if (zoneid == GLOBAL_ZONEID) 788 zoneid = ALL_ZONES; 789 790 ire_walk_v4(ire_report_ftable, (char *)mp->b_cont, zoneid); 791 ire_walk_v4(ire_report_ctable, (char *)mp->b_cont, zoneid); 792 793 return (0); 794 } 795 796 /* ire_walk routine invoked for ip_ire_report for each IRE. */ 797 static void 798 ire_report_ftable(ire_t *ire, char *mp) 799 { 800 char buf1[16]; 801 char buf2[16]; 802 char buf3[16]; 803 char buf4[16]; 804 uint_t fo_pkt_count; 805 uint_t ib_pkt_count; 806 int ref; 807 uint_t print_len, buf_len; 808 809 if (ire->ire_type & IRE_CACHETABLE) 810 return; 811 buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr; 812 if (buf_len <= 0) 813 return; 814 815 /* Number of active references of this ire */ 816 ref = ire->ire_refcnt; 817 /* "inbound" to a non local address is a forward */ 818 ib_pkt_count = ire->ire_ib_pkt_count; 819 fo_pkt_count = 0; 820 if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) { 821 fo_pkt_count = ib_pkt_count; 822 ib_pkt_count = 0; 823 } 824 print_len = snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len, 825 MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d " 826 "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d " 827 "%04d %08d %08d %d/%d/%d %s\n", 828 (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq, 829 (int)ire->ire_zoneid, 830 ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2), 831 ip_dot_addr(ire->ire_src_addr, buf3), 832 ip_dot_addr(ire->ire_gateway_addr, buf4), 833 ire->ire_max_frag, ire->ire_uinfo.iulp_rtt, 834 ire->ire_uinfo.iulp_rtt_sd, 835 ire->ire_uinfo.iulp_ssthresh, ref, 836 ire->ire_uinfo.iulp_rtomax, 837 (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0), 838 (ire->ire_uinfo.iulp_wscale_ok ? 1: 0), 839 (ire->ire_uinfo.iulp_ecn_ok ? 1: 0), 840 (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0), 841 ire->ire_uinfo.iulp_sack, 842 ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe, 843 ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count, 844 ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type)); 845 if (print_len < buf_len) { 846 ((mblk_t *)mp)->b_wptr += print_len; 847 } else { 848 ((mblk_t *)mp)->b_wptr += buf_len; 849 } 850 } 851 852 /* ire_walk routine invoked for ip_ire_report for each cached IRE. */ 853 static void 854 ire_report_ctable(ire_t *ire, char *mp) 855 { 856 char buf1[16]; 857 char buf2[16]; 858 char buf3[16]; 859 char buf4[16]; 860 uint_t fo_pkt_count; 861 uint_t ib_pkt_count; 862 int ref; 863 uint_t print_len, buf_len; 864 865 if ((ire->ire_type & IRE_CACHETABLE) == 0) 866 return; 867 buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr; 868 if (buf_len <= 0) 869 return; 870 871 /* Number of active references of this ire */ 872 ref = ire->ire_refcnt; 873 /* "inbound" to a non local address is a forward */ 874 ib_pkt_count = ire->ire_ib_pkt_count; 875 fo_pkt_count = 0; 876 if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) { 877 fo_pkt_count = ib_pkt_count; 878 ib_pkt_count = 0; 879 } 880 print_len = snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len, 881 MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d " 882 "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d " 883 "%04d %08d %08d %d/%d/%d %s\n", 884 (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq, 885 (int)ire->ire_zoneid, 886 ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2), 887 ip_dot_addr(ire->ire_src_addr, buf3), 888 ip_dot_addr(ire->ire_gateway_addr, buf4), 889 ire->ire_max_frag, ire->ire_uinfo.iulp_rtt, 890 ire->ire_uinfo.iulp_rtt_sd, ire->ire_uinfo.iulp_ssthresh, ref, 891 ire->ire_uinfo.iulp_rtomax, 892 (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0), 893 (ire->ire_uinfo.iulp_wscale_ok ? 1: 0), 894 (ire->ire_uinfo.iulp_ecn_ok ? 1: 0), 895 (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0), 896 ire->ire_uinfo.iulp_sack, 897 ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe, 898 ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count, 899 ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type)); 900 if (print_len < buf_len) { 901 ((mblk_t *)mp)->b_wptr += print_len; 902 } else { 903 ((mblk_t *)mp)->b_wptr += buf_len; 904 } 905 } 906 907 /* ARGSUSED */ 908 int 909 ip_ire_report_mrtun(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr) 910 { 911 (void) mi_mpprintf(mp, 912 "IRE " MI_COL_HDRPAD_STR 913 /* 01234567[89ABCDEF] */ 914 "stq " MI_COL_HDRPAD_STR 915 /* 01234567[89ABCDEF] */ 916 "in_ill " MI_COL_HDRPAD_STR 917 /* 01234567[89ABCDEF] */ 918 "in_src_addr " 919 /* 123.123.123.123 */ 920 "max_frag " 921 /* 12345 */ 922 "ref "); 923 /* 123 */ 924 925 ire_walk_ill_mrtun(0, 0, ire_report_mrtun_table, (char *)mp, NULL); 926 return (0); 927 } 928 929 /* mrtun report table - supports ipv4_mrtun_ire_status ndd variable */ 930 931 static void 932 ire_report_mrtun_table(ire_t *ire, char *mp) 933 { 934 char buf1[INET_ADDRSTRLEN]; 935 int ref; 936 937 /* Number of active references of this ire */ 938 ref = ire->ire_refcnt; 939 ASSERT(ire->ire_type == IRE_MIPRTUN); 940 (void) mi_mpprintf((mblk_t *)mp, 941 MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR 942 "%s %05d %03d", 943 (void *)ire, (void *)ire->ire_stq, 944 (void *)ire->ire_in_ill, 945 ip_dot_addr(ire->ire_in_src_addr, buf1), 946 ire->ire_max_frag, ref); 947 } 948 949 /* 950 * Dispatch routine to format ires in interface based routine 951 */ 952 /* ARGSUSED */ 953 int 954 ip_ire_report_srcif(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr) 955 { 956 957 /* Report all interface based ires */ 958 959 (void) mi_mpprintf(mp, 960 "IRE " MI_COL_HDRPAD_STR 961 /* 01234567[89ABCDEF] */ 962 "stq " MI_COL_HDRPAD_STR 963 /* 01234567[89ABCDEF] */ 964 "in_ill " MI_COL_HDRPAD_STR 965 /* 01234567[89ABCDEF] */ 966 "addr " 967 /* 123.123.123.123 */ 968 "gateway " 969 /* 123.123.123.123 */ 970 "max_frag " 971 /* 12345 */ 972 "ref " 973 /* 123 */ 974 "type " 975 /* ABCDEFGH */ 976 "in/out/forward"); 977 ire_walk_srcif_table_v4(ire_report_srcif_table, (char *)mp); 978 return (0); 979 } 980 981 /* Reports the interface table ires */ 982 static void 983 ire_report_srcif_table(ire_t *ire, char *mp) 984 { 985 char buf1[INET_ADDRSTRLEN]; 986 char buf2[INET_ADDRSTRLEN]; 987 int ref; 988 989 ref = ire->ire_refcnt; 990 (void) mi_mpprintf((mblk_t *)mp, 991 MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR 992 "%s %s %05d %03d %s %d", 993 (void *)ire, (void *)ire->ire_stq, 994 (void *)ire->ire_in_ill, 995 ip_dot_addr(ire->ire_addr, buf1), 996 ip_dot_addr(ire->ire_gateway_addr, buf2), 997 ire->ire_max_frag, ref, 998 ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type), 999 ire->ire_ib_pkt_count); 1000 1001 } 1002 /* 1003 * ip_ire_req is called by ip_wput when an IRE_DB_REQ_TYPE message is handed 1004 * down from the Upper Level Protocol to request a copy of the IRE (to check 1005 * its type or to extract information like round-trip time estimates or the 1006 * MTU.) 1007 * The address is assumed to be in the ire_addr field. If no IRE is found 1008 * an IRE is returned with ire_type being zero. 1009 * Note that the upper lavel protocol has to check for broadcast 1010 * (IRE_BROADCAST) and multicast (CLASSD(addr)). 1011 * If there is a b_cont the resulting IRE_DB_TYPE mblk is placed at the 1012 * end of the returned message. 1013 * 1014 * TCP sends down a message of this type with a connection request packet 1015 * chained on. UDP and ICMP send it down to verify that a route exists for 1016 * the destination address when they get connected. 1017 */ 1018 void 1019 ip_ire_req(queue_t *q, mblk_t *mp) 1020 { 1021 ire_t *inire; 1022 ire_t *ire; 1023 mblk_t *mp1; 1024 ire_t *sire = NULL; 1025 zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid; 1026 1027 if ((mp->b_wptr - mp->b_rptr) < sizeof (ire_t) || 1028 !OK_32PTR(mp->b_rptr)) { 1029 freemsg(mp); 1030 return; 1031 } 1032 inire = (ire_t *)mp->b_rptr; 1033 /* 1034 * Got it, now take our best shot at an IRE. 1035 */ 1036 if (inire->ire_ipversion == IPV6_VERSION) { 1037 ire = ire_route_lookup_v6(&inire->ire_addr_v6, 0, 0, 0, 1038 NULL, &sire, zoneid, 1039 (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT)); 1040 } else { 1041 ASSERT(inire->ire_ipversion == IPV4_VERSION); 1042 ire = ire_route_lookup(inire->ire_addr, 0, 0, 0, 1043 NULL, &sire, zoneid, 1044 (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT)); 1045 } 1046 1047 /* 1048 * We prevent returning IRES with source address INADDR_ANY 1049 * as these were temporarily created for sending packets 1050 * from endpoints that have conn_unspec_src set. 1051 */ 1052 if (ire == NULL || 1053 (ire->ire_ipversion == IPV4_VERSION && 1054 ire->ire_src_addr == INADDR_ANY) || 1055 (ire->ire_ipversion == IPV6_VERSION && 1056 IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6))) { 1057 inire->ire_type = 0; 1058 } else { 1059 bcopy(ire, inire, sizeof (ire_t)); 1060 /* Copy the route metrics from the parent. */ 1061 if (sire != NULL) { 1062 bcopy(&(sire->ire_uinfo), &(inire->ire_uinfo), 1063 sizeof (iulp_t)); 1064 } 1065 1066 /* 1067 * As we don't lookup global policy here, we may not 1068 * pass the right size if per-socket policy is not 1069 * present. For these cases, path mtu discovery will 1070 * do the right thing. 1071 */ 1072 inire->ire_ipsec_overhead = conn_ipsec_length(Q_TO_CONN(q)); 1073 1074 /* Pass the latest setting of the ip_path_mtu_discovery */ 1075 inire->ire_frag_flag |= (ip_path_mtu_discovery) ? IPH_DF : 0; 1076 } 1077 if (ire != NULL) 1078 ire_refrele(ire); 1079 if (sire != NULL) 1080 ire_refrele(sire); 1081 mp->b_wptr = &mp->b_rptr[sizeof (ire_t)]; 1082 mp->b_datap->db_type = IRE_DB_TYPE; 1083 1084 /* Put the IRE_DB_TYPE mblk last in the chain */ 1085 mp1 = mp->b_cont; 1086 if (mp1 != NULL) { 1087 mp->b_cont = NULL; 1088 linkb(mp1, mp); 1089 mp = mp1; 1090 } 1091 qreply(q, mp); 1092 } 1093 1094 /* 1095 * Send a packet using the specified IRE. 1096 * If ire_src_addr_v6 is all zero then discard the IRE after 1097 * the packet has been sent. 1098 */ 1099 static void 1100 ire_send(queue_t *q, mblk_t *pkt, ire_t *ire) 1101 { 1102 mblk_t *mp; 1103 mblk_t *ipsec_mp; 1104 boolean_t is_secure; 1105 uint_t ifindex; 1106 ill_t *ill; 1107 1108 ASSERT(ire->ire_ipversion == IPV4_VERSION); 1109 ipsec_mp = pkt; 1110 is_secure = (pkt->b_datap->db_type == M_CTL); 1111 if (is_secure) 1112 pkt = pkt->b_cont; 1113 1114 /* If the packet originated externally then */ 1115 if (pkt->b_prev) { 1116 ire_refrele(ire); 1117 /* 1118 * Extract the ifindex from b_prev (set in ip_rput_noire). 1119 * Look up interface to see if it still exists (it could have 1120 * been unplumbed by the time the reply came back from ARP) 1121 */ 1122 ifindex = (uint_t)(uintptr_t)pkt->b_prev; 1123 ill = ill_lookup_on_ifindex(ifindex, B_FALSE, 1124 NULL, NULL, NULL, NULL); 1125 if (ill == NULL) { 1126 pkt->b_prev = NULL; 1127 pkt->b_next = NULL; 1128 freemsg(ipsec_mp); 1129 return; 1130 } 1131 q = ill->ill_rq; 1132 pkt->b_prev = NULL; 1133 mp = allocb(0, BPRI_HI); 1134 if (mp == NULL) { 1135 ill_refrele(ill); 1136 pkt->b_next = NULL; 1137 freemsg(ipsec_mp); 1138 return; 1139 } 1140 mp->b_datap->db_type = M_BREAK; 1141 /* 1142 * This packet has not gone through IPSEC processing 1143 * and hence we should not have any IPSEC message 1144 * prepended. 1145 */ 1146 ASSERT(ipsec_mp == pkt); 1147 mp->b_cont = ipsec_mp; 1148 put(q, mp); 1149 ill_refrele(ill); 1150 } else if (pkt->b_next) { 1151 /* Packets from multicast router */ 1152 pkt->b_next = NULL; 1153 /* 1154 * We never get the IPSEC_OUT while forwarding the 1155 * packet for multicast router. 1156 */ 1157 ASSERT(ipsec_mp == pkt); 1158 ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, ipsec_mp, NULL); 1159 ire_refrele(ire); 1160 } else { 1161 /* Locally originated packets */ 1162 boolean_t is_inaddr_any; 1163 ipha_t *ipha = (ipha_t *)pkt->b_rptr; 1164 1165 /* 1166 * We need to do an ire_delete below for which 1167 * we need to make sure that the IRE will be 1168 * around even after calling ip_wput_ire - 1169 * which does ire_refrele. Otherwise somebody 1170 * could potentially delete this ire and hence 1171 * free this ire and we will be calling ire_delete 1172 * on a freed ire below. 1173 */ 1174 is_inaddr_any = (ire->ire_src_addr == INADDR_ANY); 1175 if (is_inaddr_any) { 1176 IRE_REFHOLD(ire); 1177 } 1178 /* 1179 * If we were resolving a router we can not use the 1180 * routers IRE for sending the packet (since it would 1181 * violate the uniqness of the IP idents) thus we 1182 * make another pass through ip_wput to create the IRE_CACHE 1183 * for the destination. 1184 * When IRE_MARK_NOADD is set, ire_add() is not called. 1185 * Thus ip_wput() will never find a ire and result in an 1186 * infinite loop. Thus we check whether IRE_MARK_NOADD is 1187 * is set. This also implies that IRE_MARK_NOADD can only be 1188 * used to send packets to directly connected hosts. 1189 */ 1190 if (ipha->ipha_dst != ire->ire_addr && 1191 !(ire->ire_marks & IRE_MARK_NOADD)) { 1192 ire_refrele(ire); /* Held in ire_add */ 1193 (void) ip_output(Q_TO_CONN(q), ipsec_mp, q, IRE_SEND); 1194 } else { 1195 if (is_secure) { 1196 ipsec_out_t *oi; 1197 ipha_t *ipha; 1198 1199 oi = (ipsec_out_t *)ipsec_mp->b_rptr; 1200 ipha = (ipha_t *)ipsec_mp->b_cont->b_rptr; 1201 if (oi->ipsec_out_proc_begin) { 1202 /* 1203 * This is the case where 1204 * ip_wput_ipsec_out could not find 1205 * the IRE and recreated a new one. 1206 * As ip_wput_ipsec_out does ire 1207 * lookups, ire_refrele for the extra 1208 * bump in ire_add. 1209 */ 1210 ire_refrele(ire); 1211 ip_wput_ipsec_out(q, ipsec_mp, ipha, 1212 NULL, NULL); 1213 } else { 1214 /* 1215 * IRE_REFRELE will be done in 1216 * ip_wput_ire. 1217 */ 1218 ip_wput_ire(q, ipsec_mp, ire, NULL, 1219 IRE_SEND); 1220 } 1221 } else { 1222 /* 1223 * IRE_REFRELE will be done in ip_wput_ire. 1224 */ 1225 ip_wput_ire(q, ipsec_mp, ire, NULL, 1226 IRE_SEND); 1227 } 1228 } 1229 /* 1230 * Special code to support sending a single packet with 1231 * conn_unspec_src using an IRE which has no source address. 1232 * The IRE is deleted here after sending the packet to avoid 1233 * having other code trip on it. But before we delete the 1234 * ire, somebody could have looked up this ire. 1235 * We prevent returning/using this IRE by the upper layers 1236 * by making checks to NULL source address in other places 1237 * like e.g ip_ire_append, ip_ire_req and ip_bind_connected. 1238 * Though, this does not completely prevent other threads 1239 * from using this ire, this should not cause any problems. 1240 * 1241 * NOTE : We use is_inaddr_any instead of using ire_src_addr 1242 * because for the normal case i.e !is_inaddr_any, ire_refrele 1243 * above could have potentially freed the ire. 1244 */ 1245 if (is_inaddr_any) { 1246 /* 1247 * If this IRE has been deleted by another thread, then 1248 * ire_bucket won't be NULL, but ire_ptpn will be NULL. 1249 * Thus, ire_delete will do nothing. This check 1250 * guards against calling ire_delete when the IRE was 1251 * never inserted in the table, which is handled by 1252 * ire_delete as dropping another reference. 1253 */ 1254 if (ire->ire_bucket != NULL) { 1255 ip1dbg(("ire_send: delete IRE\n")); 1256 ire_delete(ire); 1257 } 1258 ire_refrele(ire); /* Held above */ 1259 } 1260 } 1261 } 1262 1263 /* 1264 * Send a packet using the specified IRE. 1265 * If ire_src_addr_v6 is all zero then discard the IRE after 1266 * the packet has been sent. 1267 */ 1268 static void 1269 ire_send_v6(queue_t *q, mblk_t *pkt, ire_t *ire) 1270 { 1271 mblk_t *ipsec_mp; 1272 boolean_t secure; 1273 uint_t ifindex; 1274 1275 ASSERT(ire->ire_ipversion == IPV6_VERSION); 1276 if (pkt->b_datap->db_type == M_CTL) { 1277 ipsec_mp = pkt; 1278 pkt = pkt->b_cont; 1279 secure = B_TRUE; 1280 } else { 1281 ipsec_mp = pkt; 1282 secure = B_FALSE; 1283 } 1284 1285 /* If the packet originated externally then */ 1286 if (pkt->b_prev) { 1287 ill_t *ill; 1288 /* 1289 * Extract the ifindex from b_prev (set in ip_rput_data_v6). 1290 * Look up interface to see if it still exists (it could have 1291 * been unplumbed by the time the reply came back from the 1292 * resolver). Unlike IPv4 there is no need for a prepended 1293 * M_BREAK since ip_rput_data_v6 does not process options 1294 * before finding an IRE. 1295 */ 1296 ifindex = (uint_t)(uintptr_t)pkt->b_prev; 1297 ill = ill_lookup_on_ifindex(ifindex, B_TRUE, 1298 NULL, NULL, NULL, NULL); 1299 if (ill == NULL) { 1300 pkt->b_prev = NULL; 1301 pkt->b_next = NULL; 1302 freemsg(ipsec_mp); 1303 ire_refrele(ire); /* Held in ire_add */ 1304 return; 1305 } 1306 q = ill->ill_rq; 1307 pkt->b_prev = NULL; 1308 /* 1309 * This packet has not gone through IPSEC processing 1310 * and hence we should not have any IPSEC message 1311 * prepended. 1312 */ 1313 ASSERT(ipsec_mp == pkt); 1314 put(q, pkt); 1315 ill_refrele(ill); 1316 } else if (pkt->b_next) { 1317 /* Packets from multicast router */ 1318 pkt->b_next = NULL; 1319 /* 1320 * We never get the IPSEC_OUT while forwarding the 1321 * packet for multicast router. 1322 */ 1323 ASSERT(ipsec_mp == pkt); 1324 /* 1325 * XXX TODO IPv6. 1326 */ 1327 freemsg(pkt); 1328 #ifdef XXX 1329 ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, pkt, NULL); 1330 #endif 1331 } else { 1332 if (secure) { 1333 ipsec_out_t *oi; 1334 ip6_t *ip6h; 1335 1336 oi = (ipsec_out_t *)ipsec_mp->b_rptr; 1337 ip6h = (ip6_t *)ipsec_mp->b_cont->b_rptr; 1338 if (oi->ipsec_out_proc_begin) { 1339 /* 1340 * This is the case where 1341 * ip_wput_ipsec_out could not find 1342 * the IRE and recreated a new one. 1343 */ 1344 ip_wput_ipsec_out_v6(q, ipsec_mp, ip6h, 1345 NULL, NULL); 1346 } else { 1347 (void) ip_output_v6(Q_TO_CONN(q), ipsec_mp, 1348 q, IRE_SEND); 1349 } 1350 } else { 1351 /* 1352 * Send packets through ip_output_v6 so that any 1353 * ip6_info header can be processed again. 1354 */ 1355 (void) ip_output_v6(Q_TO_CONN(q), ipsec_mp, q, 1356 IRE_SEND); 1357 } 1358 /* 1359 * Special code to support sending a single packet with 1360 * conn_unspec_src using an IRE which has no source address. 1361 * The IRE is deleted here after sending the packet to avoid 1362 * having other code trip on it. But before we delete the 1363 * ire, somebody could have looked up this ire. 1364 * We prevent returning/using this IRE by the upper layers 1365 * by making checks to NULL source address in other places 1366 * like e.g ip_ire_append_v6, ip_ire_req and 1367 * ip_bind_connected_v6. Though, this does not completely 1368 * prevent other threads from using this ire, this should 1369 * not cause any problems. 1370 */ 1371 if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6)) { 1372 ip1dbg(("ire_send_v6: delete IRE\n")); 1373 ire_delete(ire); 1374 } 1375 } 1376 ire_refrele(ire); /* Held in ire_add */ 1377 } 1378 1379 /* 1380 * Make sure that IRE bucket does not get too long. 1381 * This can cause lock up because ire_cache_lookup() 1382 * may take "forever" to finish. 1383 * 1384 * We just remove cnt IREs each time. This means that 1385 * the bucket length will stay approximately constant, 1386 * depending on cnt. This should be enough to defend 1387 * against DoS attack based on creating temporary IREs 1388 * (for forwarding and non-TCP traffic). 1389 * 1390 * Note that new IRE is normally added at the tail of the 1391 * bucket. This means that we are removing the "oldest" 1392 * temporary IRE added. Only if there are IREs with 1393 * the same ire_addr, do we not add it at the tail. Refer 1394 * to ire_add_v*(). It should be OK for our purpose. 1395 * 1396 * For non-temporary cached IREs, we make sure that they 1397 * have not been used for some time (defined below), they 1398 * are non-local destinations, and there is no one using 1399 * them at the moment (refcnt == 1). 1400 * 1401 * The above means that the IRE bucket length may become 1402 * very long, consisting of mostly non-temporary IREs. 1403 * This can happen when the hash function does a bad job 1404 * so that most TCP connections cluster to a specific bucket. 1405 * This "hopefully" should never happen. It can also 1406 * happen if most TCP connections have very long lives. 1407 * Even with the minimal hash table size of 256, there 1408 * has to be a lot of such connections to make the bucket 1409 * length unreasonably long. This should probably not 1410 * happen either. The third can when this can happen is 1411 * when the machine is under attack, such as SYN flooding. 1412 * TCP should already have the proper mechanism to protect 1413 * that. So we should be safe. 1414 * 1415 * This function is called by ire_add_then_send() after 1416 * a new IRE is added and the packet is sent. 1417 * 1418 * The idle cutoff interval is set to 60s. It can be 1419 * changed using /etc/system. 1420 */ 1421 uint32_t ire_idle_cutoff_interval = 60000; 1422 1423 static void 1424 ire_cache_cleanup(irb_t *irb, uint32_t threshold, int cnt) 1425 { 1426 ire_t *ire; 1427 int tmp_cnt = cnt; 1428 clock_t cut_off = drv_usectohz(ire_idle_cutoff_interval * 1000); 1429 1430 /* 1431 * irb is NULL if the IRE is not added to the hash. This 1432 * happens when IRE_MARK_NOADD is set in ire_add_then_send() 1433 * and when ires are returned from ire_update_srcif_v4() routine. 1434 */ 1435 if (irb == NULL) 1436 return; 1437 1438 IRB_REFHOLD(irb); 1439 if (irb->irb_tmp_ire_cnt > threshold) { 1440 for (ire = irb->irb_ire; ire != NULL && tmp_cnt > 0; 1441 ire = ire->ire_next) { 1442 if (ire->ire_marks & IRE_MARK_CONDEMNED) 1443 continue; 1444 if (ire->ire_marks & IRE_MARK_TEMPORARY) { 1445 ASSERT(ire->ire_type == IRE_CACHE); 1446 ire_delete(ire); 1447 tmp_cnt--; 1448 } 1449 } 1450 } 1451 if (irb->irb_ire_cnt - irb->irb_tmp_ire_cnt > threshold) { 1452 for (ire = irb->irb_ire; ire != NULL && cnt > 0; 1453 ire = ire->ire_next) { 1454 if (ire->ire_marks & IRE_MARK_CONDEMNED || 1455 ire->ire_gateway_addr == 0) { 1456 continue; 1457 } 1458 if ((ire->ire_type == IRE_CACHE) && 1459 (lbolt - ire->ire_last_used_time > cut_off) && 1460 (ire->ire_refcnt == 1)) { 1461 ire_delete(ire); 1462 cnt--; 1463 } 1464 } 1465 } 1466 IRB_REFRELE(irb); 1467 } 1468 1469 /* 1470 * ire_add_then_send is called when a new IRE has been created in order to 1471 * route an outgoing packet. Typically, it is called from ip_wput when 1472 * a response comes back down from a resolver. We add the IRE, and then 1473 * possibly run the packet through ip_wput or ip_rput, as appropriate. 1474 * However, we do not add the newly created IRE in the cache when 1475 * IRE_MARK_NOADD is set in the IRE. IRE_MARK_NOADD is set at 1476 * ip_newroute_ipif(). The ires with IRE_MARK_NOADD and ires returned 1477 * by ire_update_srcif_v4() are ire_refrele'd by ip_wput_ire() and get 1478 * deleted. 1479 * Multirouting support: the packet is silently discarded when the new IRE 1480 * holds the RTF_MULTIRT flag, but is not the first IRE to be added with the 1481 * RTF_MULTIRT flag for the same destination address. 1482 * In this case, we just want to register this additional ire without 1483 * sending the packet, as it has already been replicated through 1484 * existing multirt routes in ip_wput(). 1485 */ 1486 void 1487 ire_add_then_send(queue_t *q, ire_t *ire, mblk_t *mp) 1488 { 1489 irb_t *irb; 1490 boolean_t drop = B_FALSE; 1491 /* LINTED : set but not used in function */ 1492 boolean_t mctl_present; 1493 mblk_t *first_mp = NULL; 1494 mblk_t *save_mp = NULL; 1495 ire_t *dst_ire; 1496 ipha_t *ipha; 1497 ip6_t *ip6h; 1498 1499 if (mp != NULL) { 1500 /* 1501 * We first have to retrieve the destination address carried 1502 * by the packet. 1503 * We can't rely on ire as it can be related to a gateway. 1504 * The destination address will help in determining if 1505 * other RTF_MULTIRT ires are already registered. 1506 * 1507 * We first need to know where we are going : v4 or V6. 1508 * the ire version is enough, as there is no risk that 1509 * we resolve an IPv6 address with an IPv4 ire 1510 * or vice versa. 1511 */ 1512 if (ire->ire_ipversion == IPV4_VERSION) { 1513 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 1514 ipha = (ipha_t *)mp->b_rptr; 1515 save_mp = mp; 1516 mp = first_mp; 1517 1518 dst_ire = ire_cache_lookup(ipha->ipha_dst, 1519 ire->ire_zoneid); 1520 } else { 1521 /* 1522 * Get a pointer to the beginning of the IPv6 header. 1523 * Ignore leading IPsec control mblks. 1524 */ 1525 first_mp = mp; 1526 if (mp->b_datap->db_type == M_CTL) { 1527 mp = mp->b_cont; 1528 } 1529 ip6h = (ip6_t *)mp->b_rptr; 1530 save_mp = mp; 1531 mp = first_mp; 1532 dst_ire = ire_cache_lookup_v6(&ip6h->ip6_dst, 1533 ire->ire_zoneid); 1534 } 1535 if (dst_ire != NULL) { 1536 if (dst_ire->ire_flags & RTF_MULTIRT) { 1537 /* 1538 * At least one resolved multirt route 1539 * already exists for the destination, 1540 * don't sent this packet: either drop it 1541 * or complete the pending resolution, 1542 * depending on the ire. 1543 */ 1544 drop = B_TRUE; 1545 } 1546 ip1dbg(("ire_add_then_send: dst_ire %p " 1547 "[dst %08x, gw %08x], drop %d\n", 1548 (void *)dst_ire, 1549 (dst_ire->ire_ipversion == IPV4_VERSION) ? \ 1550 ntohl(dst_ire->ire_addr) : \ 1551 ntohl(V4_PART_OF_V6(dst_ire->ire_addr_v6)), 1552 (dst_ire->ire_ipversion == IPV4_VERSION) ? \ 1553 ntohl(dst_ire->ire_gateway_addr) : \ 1554 ntohl(V4_PART_OF_V6( 1555 dst_ire->ire_gateway_addr_v6)), 1556 drop)); 1557 ire_refrele(dst_ire); 1558 } 1559 } 1560 1561 if (!(ire->ire_marks & IRE_MARK_NOADD)) { 1562 /* 1563 * Regular packets with cache bound ires and 1564 * the packets from ARP response for ires which 1565 * belong to the ire_srcif_v4 table, are here. 1566 */ 1567 if (ire->ire_in_ill == NULL) { 1568 /* Add the ire */ 1569 (void) ire_add(&ire, NULL, NULL, NULL); 1570 } else { 1571 /* 1572 * This must be ARP response for ire in interface based 1573 * table. Note that we don't add them in cache table, 1574 * instead we update the existing table with dlureq_mp 1575 * information. The reverse tunnel ires do not come 1576 * here, as reverse tunnel is non-resolver interface. 1577 * XXX- another design alternative was to mark the 1578 * ires in interface based table with a special mark to 1579 * make absolutely sure that we operate in right ires. 1580 * This idea was not implemented as part of code review 1581 * suggestion, as ire_in_ill suffice to distinguish 1582 * between the regular ires and interface based 1583 * ires now and thus we save a bit in the ire_marks. 1584 */ 1585 ire = ire_update_srcif_v4(ire); 1586 } 1587 1588 if (ire == NULL) { 1589 mp->b_prev = NULL; 1590 mp->b_next = NULL; 1591 MULTIRT_DEBUG_UNTAG(mp); 1592 freemsg(mp); 1593 return; 1594 } 1595 if (mp == NULL) { 1596 ire_refrele(ire); /* Held in ire_add_v4/v6 */ 1597 return; 1598 } 1599 } 1600 if (drop) { 1601 /* 1602 * If we're adding an RTF_MULTIRT ire, the resolution 1603 * is over: we just drop the packet. 1604 */ 1605 if (ire->ire_flags & RTF_MULTIRT) { 1606 if (save_mp) { 1607 save_mp->b_prev = NULL; 1608 save_mp->b_next = NULL; 1609 } 1610 MULTIRT_DEBUG_UNTAG(mp); 1611 freemsg(mp); 1612 } else { 1613 /* 1614 * Otherwise, we're adding the ire to a gateway 1615 * for a multirt route. 1616 * Invoke ip_newroute() to complete the resolution 1617 * of the route. We will then come back here and 1618 * finally drop this packet in the above code. 1619 */ 1620 if (ire->ire_ipversion == IPV4_VERSION) { 1621 /* 1622 * TODO: in order for CGTP to work in non-global 1623 * zones, ip_newroute() must create the IRE 1624 * cache in the zone indicated by 1625 * ire->ire_zoneid. 1626 */ 1627 ip_newroute(q, mp, ipha->ipha_dst, 0, 1628 (CONN_Q(q) ? Q_TO_CONN(q) : NULL)); 1629 } else { 1630 ip_newroute_v6(q, mp, &ip6h->ip6_dst, NULL, 1631 NULL, ire->ire_zoneid); 1632 } 1633 } 1634 1635 ire_refrele(ire); /* As done by ire_send(). */ 1636 return; 1637 } 1638 /* 1639 * Need to remember ire_bucket here as ire_send*() may delete 1640 * the ire so we cannot reference it after that. 1641 */ 1642 irb = ire->ire_bucket; 1643 if (ire->ire_ipversion == IPV6_VERSION) { 1644 ire_send_v6(q, mp, ire); 1645 /* 1646 * Clean up more than 1 IRE so that the clean up does not 1647 * need to be done every time when a new IRE is added and 1648 * the threshold is reached. 1649 */ 1650 ire_cache_cleanup(irb, ip6_ire_max_bucket_cnt, 2); 1651 } else { 1652 ire_send(q, mp, ire); 1653 ire_cache_cleanup(irb, ip_ire_max_bucket_cnt, 2); 1654 } 1655 } 1656 1657 /* 1658 * Initialize the ire that is specific to IPv4 part and call 1659 * ire_init_common to finish it. 1660 */ 1661 ire_t * 1662 ire_init(ire_t *ire, uchar_t *addr, uchar_t *mask, uchar_t *src_addr, 1663 uchar_t *gateway, uchar_t *in_src_addr, uint_t *max_fragp, mblk_t *fp_mp, 1664 queue_t *rfq, queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, 1665 ill_t *in_ill, ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, 1666 uint32_t flags, const iulp_t *ulp_info) 1667 { 1668 if (fp_mp != NULL) { 1669 /* 1670 * We can't dupb() here as multiple threads could be 1671 * calling dupb on the same mp which is incorrect. 1672 * First dupb() should be called only by one thread. 1673 */ 1674 fp_mp = copyb(fp_mp); 1675 if (fp_mp == NULL) 1676 return (NULL); 1677 } 1678 1679 if (dlureq_mp != NULL) { 1680 /* 1681 * We can't dupb() here as multiple threads could be 1682 * calling dupb on the same mp which is incorrect. 1683 * First dupb() should be called only by one thread. 1684 */ 1685 dlureq_mp = copyb(dlureq_mp); 1686 if (dlureq_mp == NULL) { 1687 if (fp_mp != NULL) 1688 freeb(fp_mp); 1689 return (NULL); 1690 } 1691 } 1692 1693 /* 1694 * Check that IRE_IF_RESOLVER and IRE_IF_NORESOLVER have a 1695 * dlureq_mp which is the ill_resolver_mp for IRE_IF_RESOLVER 1696 * and DL_UNITDATA_REQ for IRE_IF_NORESOLVER. 1697 */ 1698 if ((type & IRE_INTERFACE) && 1699 dlureq_mp == NULL) { 1700 ASSERT(fp_mp == NULL); 1701 ip0dbg(("ire_init: no dlureq_mp\n")); 1702 return (NULL); 1703 } 1704 1705 BUMP_IRE_STATS(ire_stats_v4, ire_stats_alloced); 1706 1707 if (addr != NULL) 1708 bcopy(addr, &ire->ire_addr, IP_ADDR_LEN); 1709 if (src_addr != NULL) 1710 bcopy(src_addr, &ire->ire_src_addr, IP_ADDR_LEN); 1711 if (mask != NULL) { 1712 bcopy(mask, &ire->ire_mask, IP_ADDR_LEN); 1713 ire->ire_masklen = ip_mask_to_plen(ire->ire_mask); 1714 } 1715 if (gateway != NULL) { 1716 bcopy(gateway, &ire->ire_gateway_addr, IP_ADDR_LEN); 1717 } 1718 if (in_src_addr != NULL) { 1719 bcopy(in_src_addr, &ire->ire_in_src_addr, IP_ADDR_LEN); 1720 } 1721 1722 if (type == IRE_CACHE) 1723 ire->ire_cmask = cmask; 1724 1725 ire_init_common(ire, max_fragp, fp_mp, rfq, stq, type, dlureq_mp, 1726 ipif, in_ill, phandle, ihandle, flags, IPV4_VERSION, ulp_info); 1727 1728 return (ire); 1729 } 1730 1731 /* 1732 * Similar to ire_create except that it is called only when 1733 * we want to allocate ire as an mblk e.g. we have an external 1734 * resolver ARP. 1735 */ 1736 ire_t * 1737 ire_create_mp(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway, 1738 uchar_t *in_src_addr, uint_t max_frag, mblk_t *fp_mp, queue_t *rfq, 1739 queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill, 1740 ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, uint32_t flags, 1741 const iulp_t *ulp_info) 1742 { 1743 ire_t *ire; 1744 ire_t *ret_ire; 1745 mblk_t *mp; 1746 1747 /* Allocate the new IRE. */ 1748 mp = allocb(sizeof (ire_t), BPRI_MED); 1749 if (mp == NULL) { 1750 ip1dbg(("ire_create_mp: alloc failed\n")); 1751 return (NULL); 1752 } 1753 1754 ire = (ire_t *)mp->b_rptr; 1755 mp->b_wptr = (uchar_t *)&ire[1]; 1756 1757 /* Start clean. */ 1758 *ire = ire_null; 1759 ire->ire_mp = mp; 1760 mp->b_datap->db_type = IRE_DB_TYPE; 1761 1762 ret_ire = ire_init(ire, addr, mask, src_addr, gateway, in_src_addr, 1763 NULL, fp_mp, rfq, stq, type, dlureq_mp, ipif, in_ill, cmask, 1764 phandle, ihandle, flags, ulp_info); 1765 1766 if (ret_ire == NULL) { 1767 freeb(ire->ire_mp); 1768 return (NULL); 1769 } 1770 ASSERT(ret_ire == ire); 1771 /* 1772 * ire_max_frag is normally zero here and is atomically set 1773 * under the irebucket lock in ire_add_v[46] except for the 1774 * case of IRE_MARK_NOADD. In that event the the ire_max_frag 1775 * is non-zero here. 1776 */ 1777 ire->ire_max_frag = max_frag; 1778 return (ire); 1779 } 1780 1781 /* 1782 * ire_create is called to allocate and initialize a new IRE. 1783 * 1784 * NOTE : This is called as writer sometimes though not required 1785 * by this function. 1786 */ 1787 ire_t * 1788 ire_create(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway, 1789 uchar_t *in_src_addr, uint_t *max_fragp, mblk_t *fp_mp, queue_t *rfq, 1790 queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill, 1791 ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, uint32_t flags, 1792 const iulp_t *ulp_info) 1793 { 1794 ire_t *ire; 1795 ire_t *ret_ire; 1796 1797 ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP); 1798 if (ire == NULL) { 1799 ip1dbg(("ire_create: alloc failed\n")); 1800 return (NULL); 1801 } 1802 *ire = ire_null; 1803 1804 ret_ire = ire_init(ire, addr, mask, src_addr, gateway, in_src_addr, 1805 max_fragp, fp_mp, rfq, stq, type, dlureq_mp, ipif, in_ill, cmask, 1806 phandle, ihandle, flags, ulp_info); 1807 1808 if (ret_ire == NULL) { 1809 kmem_cache_free(ire_cache, ire); 1810 return (NULL); 1811 } 1812 ASSERT(ret_ire == ire); 1813 return (ire); 1814 } 1815 1816 1817 /* 1818 * Common to IPv4 and IPv6 1819 */ 1820 void 1821 ire_init_common(ire_t *ire, uint_t *max_fragp, mblk_t *fp_mp, 1822 queue_t *rfq, queue_t *stq, ushort_t type, 1823 mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill, uint32_t phandle, 1824 uint32_t ihandle, uint32_t flags, uchar_t ipversion, 1825 const iulp_t *ulp_info) 1826 { 1827 ire->ire_max_fragp = max_fragp; 1828 ire->ire_frag_flag |= (ip_path_mtu_discovery) ? IPH_DF : 0; 1829 1830 ASSERT(fp_mp == NULL || fp_mp->b_datap->db_type == M_DATA); 1831 if (ipif) { 1832 if (ipif->ipif_isv6) 1833 ASSERT(ipversion == IPV6_VERSION); 1834 else 1835 ASSERT(ipversion == IPV4_VERSION); 1836 } 1837 1838 ire->ire_fp_mp = fp_mp; 1839 ire->ire_dlureq_mp = dlureq_mp; 1840 ire->ire_stq = stq; 1841 ire->ire_rfq = rfq; 1842 ire->ire_type = type; 1843 ire->ire_flags = RTF_UP | flags; 1844 ire->ire_ident = TICK_TO_MSEC(lbolt); 1845 bcopy(ulp_info, &ire->ire_uinfo, sizeof (iulp_t)); 1846 1847 ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count; 1848 ire->ire_last_used_time = lbolt; 1849 ire->ire_create_time = (uint32_t)gethrestime_sec(); 1850 1851 /* 1852 * If this IRE is an IRE_CACHE, inherit the handles from the 1853 * parent IREs. For others in the forwarding table, assign appropriate 1854 * new ones. 1855 * 1856 * The mutex protecting ire_handle is because ire_create is not always 1857 * called as a writer. 1858 */ 1859 if (ire->ire_type & IRE_OFFSUBNET) { 1860 mutex_enter(&ire_handle_lock); 1861 ire->ire_phandle = (uint32_t)ire_handle++; 1862 mutex_exit(&ire_handle_lock); 1863 } else if (ire->ire_type & IRE_INTERFACE) { 1864 mutex_enter(&ire_handle_lock); 1865 ire->ire_ihandle = (uint32_t)ire_handle++; 1866 mutex_exit(&ire_handle_lock); 1867 } else if (ire->ire_type == IRE_CACHE) { 1868 ire->ire_phandle = phandle; 1869 ire->ire_ihandle = ihandle; 1870 } 1871 ire->ire_in_ill = in_ill; 1872 ire->ire_ipif = ipif; 1873 if (ipif != NULL) { 1874 ire->ire_ipif_seqid = ipif->ipif_seqid; 1875 ire->ire_zoneid = ipif->ipif_zoneid; 1876 } else { 1877 ire->ire_zoneid = GLOBAL_ZONEID; 1878 } 1879 ire->ire_ipversion = ipversion; 1880 ire->ire_refcnt = 1; 1881 mutex_init(&ire->ire_lock, NULL, MUTEX_DEFAULT, NULL); 1882 1883 #ifdef IRE_DEBUG 1884 bzero(ire->ire_trace, sizeof (th_trace_t *) * IP_TR_HASH_MAX); 1885 #endif 1886 } 1887 1888 /* 1889 * This routine is called repeatedly by ipif_up to create broadcast IREs. 1890 * It is passed a pointer to a slot in an IRE pointer array into which to 1891 * place the pointer to the new IRE, if indeed we create one. If the 1892 * IRE corresponding to the address passed in would be a duplicate of an 1893 * existing one, we don't create the new one. irep is incremented before 1894 * return only if we do create a new IRE. (Always called as writer.) 1895 * 1896 * Note that with the "match_flags" parameter, we can match on either 1897 * a particular logical interface (MATCH_IRE_IPIF) or for all logical 1898 * interfaces for a given physical interface (MATCH_IRE_ILL). Currently, 1899 * we only create broadcast ire's on a per physical interface basis. If 1900 * someone is going to be mucking with logical interfaces, it is important 1901 * to call "ipif_check_bcast_ires()" to make sure that any change to a 1902 * logical interface will not cause critical broadcast IRE's to be deleted. 1903 */ 1904 ire_t ** 1905 ire_check_and_create_bcast(ipif_t *ipif, ipaddr_t addr, ire_t **irep, 1906 int match_flags) 1907 { 1908 ire_t *ire; 1909 uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST; 1910 1911 /* 1912 * No broadcast IREs for the LOOPBACK interface 1913 * or others such as point to point and IPIF_NOXMIT. 1914 */ 1915 if (!(ipif->ipif_flags & IPIF_BROADCAST) || 1916 (ipif->ipif_flags & IPIF_NOXMIT)) 1917 return (irep); 1918 1919 /* If this would be a duplicate, don't bother. */ 1920 if ((ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ipif, 1921 ipif->ipif_zoneid, match_flags)) != NULL) { 1922 /* 1923 * We look for non-deprecated (and non-anycast, non-nolocal) 1924 * ipifs as the best choice. ipifs with check_flags matching 1925 * (deprecated, etc) are used only if non-deprecated ipifs 1926 * are not available. if the existing ire's ipif is deprecated 1927 * and the new ipif is non-deprecated, switch to the new ipif 1928 */ 1929 if ((!(ire->ire_ipif->ipif_flags & check_flags)) || 1930 (ipif->ipif_flags & check_flags)) { 1931 ire_refrele(ire); 1932 return (irep); 1933 } 1934 /* 1935 * Bcast ires exist in pairs. Both have to be deleted, 1936 * Since we are exclusive we can make the above assertion. 1937 * The 1st has to be refrele'd since it was ctable_lookup'd. 1938 */ 1939 ASSERT(IAM_WRITER_IPIF(ipif)); 1940 ASSERT(ire->ire_next->ire_addr == ire->ire_addr); 1941 ire_delete(ire->ire_next); 1942 ire_delete(ire); 1943 ire_refrele(ire); 1944 } 1945 1946 irep = ire_create_bcast(ipif, addr, irep); 1947 1948 return (irep); 1949 } 1950 1951 uint_t ip_loopback_mtu = IP_LOOPBACK_MTU; 1952 1953 /* 1954 * This routine is called from ipif_check_bcast_ires and ire_check_bcast. 1955 * It leaves all the verifying and deleting to those routines. So it always 1956 * creates 2 bcast ires and chains them into the ire array passed in. 1957 */ 1958 ire_t ** 1959 ire_create_bcast(ipif_t *ipif, ipaddr_t addr, ire_t **irep) 1960 { 1961 *irep++ = ire_create( 1962 (uchar_t *)&addr, /* dest addr */ 1963 (uchar_t *)&ip_g_all_ones, /* mask */ 1964 (uchar_t *)&ipif->ipif_src_addr, /* source addr */ 1965 NULL, /* no gateway */ 1966 NULL, /* no in_src_addr */ 1967 &ipif->ipif_mtu, /* max frag */ 1968 NULL, /* fast path header */ 1969 ipif->ipif_rq, /* recv-from queue */ 1970 ipif->ipif_wq, /* send-to queue */ 1971 IRE_BROADCAST, 1972 ipif->ipif_bcast_mp, /* xmit header */ 1973 ipif, 1974 NULL, 1975 0, 1976 0, 1977 0, 1978 0, 1979 &ire_uinfo_null); 1980 1981 *irep++ = ire_create( 1982 (uchar_t *)&addr, /* dest address */ 1983 (uchar_t *)&ip_g_all_ones, /* mask */ 1984 (uchar_t *)&ipif->ipif_src_addr, /* source address */ 1985 NULL, /* no gateway */ 1986 NULL, /* no in_src_addr */ 1987 &ip_loopback_mtu, /* max frag size */ 1988 NULL, /* Fast Path header */ 1989 ipif->ipif_rq, /* recv-from queue */ 1990 NULL, /* no send-to queue */ 1991 IRE_BROADCAST, /* Needed for fanout in wput */ 1992 NULL, 1993 ipif, 1994 NULL, 1995 0, 1996 0, 1997 0, 1998 0, 1999 &ire_uinfo_null); 2000 2001 return (irep); 2002 } 2003 2004 /* 2005 * ire_walk routine to delete or update any IRE_CACHE that might contain 2006 * stale information. 2007 * The flags state which entries to delete or update. 2008 * Garbage collection is done separately using kmem alloc callbacks to 2009 * ip_trash_ire_reclaim. 2010 * Used for both IPv4 and IPv6. However, IPv6 only uses FLUSH_MTU_TIME 2011 * since other stale information is cleaned up using NUD. 2012 */ 2013 void 2014 ire_expire(ire_t *ire, char *arg) 2015 { 2016 int flush_flags = (int)(uintptr_t)arg; 2017 ill_t *stq_ill; 2018 2019 if ((flush_flags & FLUSH_REDIRECT_TIME) && 2020 ire->ire_type == IRE_HOST_REDIRECT) { 2021 /* Make sure we delete the corresponding IRE_CACHE */ 2022 ip1dbg(("ire_expire: all redirects\n")); 2023 ip_rts_rtmsg(RTM_DELETE, ire, 0); 2024 ire_delete(ire); 2025 return; 2026 } 2027 if (ire->ire_type != IRE_CACHE) 2028 return; 2029 2030 if (flush_flags & FLUSH_ARP_TIME) { 2031 /* 2032 * Remove all IRE_CACHE. 2033 * Verify that create time is more than 2034 * ip_ire_arp_interval milliseconds ago. 2035 */ 2036 if (((uint32_t)gethrestime_sec() - ire->ire_create_time) * 2037 MILLISEC > ip_ire_arp_interval) { 2038 ip1dbg(("ire_expire: all IRE_CACHE\n")); 2039 ire_delete(ire); 2040 return; 2041 } 2042 } 2043 2044 if (ip_path_mtu_discovery && (flush_flags & FLUSH_MTU_TIME) && 2045 (ire->ire_ipif != NULL)) { 2046 /* Increase pmtu if it is less than the interface mtu */ 2047 mutex_enter(&ire->ire_lock); 2048 /* 2049 * If the ipif is a vni (whose mtu is 0, since it's virtual) 2050 * get the mtu from the sending interfaces' ipif 2051 */ 2052 if (IS_VNI(ire->ire_ipif->ipif_ill)) { 2053 stq_ill = ire->ire_stq->q_ptr; 2054 ire->ire_max_frag = MIN(stq_ill->ill_ipif->ipif_mtu, 2055 IP_MAXPACKET); 2056 } else { 2057 ire->ire_max_frag = MIN(ire->ire_ipif->ipif_mtu, 2058 IP_MAXPACKET); 2059 } 2060 ire->ire_frag_flag |= IPH_DF; 2061 mutex_exit(&ire->ire_lock); 2062 } 2063 } 2064 2065 /* 2066 * Do fast path probing if necessary. 2067 */ 2068 static void 2069 ire_fastpath(ire_t *ire) 2070 { 2071 ill_t *ill; 2072 int res; 2073 2074 if (ire->ire_fp_mp != NULL || ire->ire_dlureq_mp == NULL || 2075 (ire->ire_stq == NULL)) { 2076 /* 2077 * Already contains fastpath info or 2078 * doesn't have DL_UNITDATA_REQ header 2079 * or is a loopback broadcast ire i.e. no stq. 2080 */ 2081 return; 2082 } 2083 ill = ire_to_ill(ire); 2084 if (ill == NULL) 2085 return; 2086 ire_fastpath_list_add(ill, ire); 2087 res = ill_fastpath_probe(ill, ire->ire_dlureq_mp); 2088 /* 2089 * EAGAIN is an indication of a transient error 2090 * i.e. allocation failure etc. leave the ire in the list it will 2091 * be updated when another probe happens for another ire if not 2092 * it will be taken out of the list when the ire is deleted. 2093 */ 2094 if (res != 0 && res != EAGAIN) 2095 ire_fastpath_list_delete(ill, ire); 2096 } 2097 2098 /* 2099 * Update all IRE's that are not in fastpath mode and 2100 * have an dlureq_mp that matches mp. mp->b_cont contains 2101 * the fastpath header. 2102 * 2103 * Returns TRUE if entry should be dequeued, or FALSE otherwise. 2104 */ 2105 boolean_t 2106 ire_fastpath_update(ire_t *ire, void *arg) 2107 { 2108 mblk_t *mp, *fp_mp; 2109 uchar_t *up, *up2; 2110 ptrdiff_t cmplen; 2111 2112 ASSERT((ire->ire_type & (IRE_CACHE | IRE_BROADCAST | 2113 IRE_MIPRTUN)) != 0); 2114 2115 /* 2116 * Already contains fastpath info or doesn't have 2117 * DL_UNITDATA_REQ header. 2118 */ 2119 if (ire->ire_fp_mp != NULL || ire->ire_dlureq_mp == NULL) 2120 return (B_TRUE); 2121 2122 ip2dbg(("ire_fastpath_update: trying\n")); 2123 mp = arg; 2124 up = mp->b_rptr; 2125 cmplen = mp->b_wptr - up; 2126 /* Serialize multiple fast path updates */ 2127 mutex_enter(&ire->ire_lock); 2128 up2 = ire->ire_dlureq_mp->b_rptr; 2129 ASSERT(cmplen >= 0); 2130 if (ire->ire_dlureq_mp->b_wptr - up2 != cmplen || 2131 bcmp(up, up2, cmplen) != 0) { 2132 mutex_exit(&ire->ire_lock); 2133 /* 2134 * Don't take the ire off the fastpath list yet, 2135 * since the response may come later. 2136 */ 2137 return (B_FALSE); 2138 } 2139 /* Matched - install mp as the ire_fp_mp */ 2140 ip1dbg(("ire_fastpath_update: match\n")); 2141 fp_mp = dupb(mp->b_cont); 2142 if (fp_mp) { 2143 /* 2144 * We checked ire_fp_mp above. Check it again with the 2145 * lock. Update fp_mp only if it has not been done 2146 * already. 2147 */ 2148 if (ire->ire_fp_mp == NULL) { 2149 /* 2150 * ire_ll_hdr_length is just an optimization to 2151 * store the length. It is used to return the 2152 * fast path header length to the upper layers. 2153 */ 2154 ire->ire_fp_mp = fp_mp; 2155 ire->ire_ll_hdr_length = 2156 (uint_t)(fp_mp->b_wptr - fp_mp->b_rptr); 2157 } else { 2158 freeb(fp_mp); 2159 } 2160 } 2161 mutex_exit(&ire->ire_lock); 2162 return (B_TRUE); 2163 } 2164 2165 /* 2166 * This function handles the DL_NOTE_FASTPATH_FLUSH notification from the 2167 * driver. 2168 */ 2169 /* ARGSUSED */ 2170 void 2171 ire_fastpath_flush(ire_t *ire, void *arg) 2172 { 2173 ill_t *ill; 2174 int res; 2175 2176 /* No fastpath info? */ 2177 if (ire->ire_fp_mp == NULL || ire->ire_dlureq_mp == NULL) 2178 return; 2179 2180 /* 2181 * Just remove the IRE if it is for non-broadcast dest. Then 2182 * we will create another one which will have the correct 2183 * fastpath info. 2184 */ 2185 switch (ire->ire_type) { 2186 case IRE_CACHE: 2187 ire_delete(ire); 2188 break; 2189 case IRE_MIPRTUN: 2190 case IRE_BROADCAST: 2191 /* 2192 * We can't delete the ire since it is difficult to 2193 * recreate these ire's without going through the 2194 * ipif down/up dance. The ire_fp_mp is protected by the 2195 * ire_lock in the case of IRE_MIPRTUN and IRE_BROADCAST. 2196 * All access to ire_fp_mp in the case of these 2 ire types 2197 * is protected by ire_lock. 2198 */ 2199 mutex_enter(&ire->ire_lock); 2200 if (ire->ire_fp_mp != NULL) { 2201 freeb(ire->ire_fp_mp); 2202 ire->ire_fp_mp = NULL; 2203 mutex_exit(&ire->ire_lock); 2204 /* 2205 * No fastpath probe if there is no stq i.e. 2206 * i.e. the case of loopback broadcast ire. 2207 */ 2208 if (ire->ire_stq == NULL) 2209 break; 2210 ill = (ill_t *)((ire->ire_stq)->q_ptr); 2211 ire_fastpath_list_add(ill, ire); 2212 res = ill_fastpath_probe(ill, ire->ire_dlureq_mp); 2213 /* 2214 * EAGAIN is an indication of a transient error 2215 * i.e. allocation failure etc. leave the ire in the 2216 * list it will be updated when another probe happens 2217 * for another ire if not it will be taken out of the 2218 * list when the ire is deleted. 2219 */ 2220 if (res != 0 && res != EAGAIN) 2221 ire_fastpath_list_delete(ill, ire); 2222 } else { 2223 mutex_exit(&ire->ire_lock); 2224 } 2225 break; 2226 default: 2227 /* This should not happen! */ 2228 ip0dbg(("ire_fastpath_flush: Wrong ire type %s\n", 2229 ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type))); 2230 break; 2231 } 2232 } 2233 2234 /* 2235 * Drain the list of ire's waiting for fastpath response. 2236 */ 2237 void 2238 ire_fastpath_list_dispatch(ill_t *ill, boolean_t (*func)(ire_t *, void *), 2239 void *arg) 2240 { 2241 ire_t *next_ire; 2242 ire_t *current_ire; 2243 ire_t *first_ire; 2244 ire_t *prev_ire = NULL; 2245 2246 ASSERT(ill != NULL); 2247 2248 mutex_enter(&ill->ill_lock); 2249 first_ire = current_ire = (ire_t *)ill->ill_fastpath_list; 2250 while (current_ire != (ire_t *)&ill->ill_fastpath_list) { 2251 next_ire = current_ire->ire_fastpath; 2252 /* 2253 * Take it off the list if we're flushing, or if the callback 2254 * routine tells us to do so. Otherwise, leave the ire in the 2255 * fastpath list to handle any pending response from the lower 2256 * layer. We can't drain the list when the callback routine 2257 * comparison failed, because the response is asynchronous in 2258 * nature, and may not arrive in the same order as the list 2259 * insertion. 2260 */ 2261 if (func == NULL || func(current_ire, arg)) { 2262 current_ire->ire_fastpath = NULL; 2263 if (current_ire == first_ire) 2264 ill->ill_fastpath_list = first_ire = next_ire; 2265 else 2266 prev_ire->ire_fastpath = next_ire; 2267 } else { 2268 /* previous element that is still in the list */ 2269 prev_ire = current_ire; 2270 } 2271 current_ire = next_ire; 2272 } 2273 mutex_exit(&ill->ill_lock); 2274 } 2275 2276 /* 2277 * Add ire to the ire fastpath list. 2278 */ 2279 static void 2280 ire_fastpath_list_add(ill_t *ill, ire_t *ire) 2281 { 2282 ASSERT(ill != NULL); 2283 ASSERT(ire->ire_stq != NULL); 2284 2285 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 2286 mutex_enter(&ill->ill_lock); 2287 2288 /* 2289 * if ire has not been deleted and 2290 * is not already in the list add it. 2291 */ 2292 if (((ire->ire_marks & IRE_MARK_CONDEMNED) == 0) && 2293 (ire->ire_fastpath == NULL)) { 2294 ire->ire_fastpath = (ire_t *)ill->ill_fastpath_list; 2295 ill->ill_fastpath_list = ire; 2296 } 2297 2298 mutex_exit(&ill->ill_lock); 2299 rw_exit(&ire->ire_bucket->irb_lock); 2300 } 2301 2302 /* 2303 * remove ire from the ire fastpath list. 2304 */ 2305 void 2306 ire_fastpath_list_delete(ill_t *ill, ire_t *ire) 2307 { 2308 ire_t *ire_ptr; 2309 2310 ASSERT(ire->ire_stq != NULL && ill != NULL); 2311 2312 mutex_enter(&ill->ill_lock); 2313 if (ire->ire_fastpath == NULL) 2314 goto done; 2315 2316 ASSERT(ill->ill_fastpath_list != &ill->ill_fastpath_list); 2317 2318 if (ill->ill_fastpath_list == ire) { 2319 ill->ill_fastpath_list = ire->ire_fastpath; 2320 } else { 2321 ire_ptr = ill->ill_fastpath_list; 2322 while (ire_ptr != (ire_t *)&ill->ill_fastpath_list) { 2323 if (ire_ptr->ire_fastpath == ire) { 2324 ire_ptr->ire_fastpath = ire->ire_fastpath; 2325 break; 2326 } 2327 ire_ptr = ire_ptr->ire_fastpath; 2328 } 2329 } 2330 ire->ire_fastpath = NULL; 2331 done: 2332 mutex_exit(&ill->ill_lock); 2333 } 2334 2335 2336 /* 2337 * Find an IRE_INTERFACE for the multicast group. 2338 * Allows different routes for multicast addresses 2339 * in the unicast routing table (akin to 224.0.0.0 but could be more specific) 2340 * which point at different interfaces. This is used when IP_MULTICAST_IF 2341 * isn't specified (when sending) and when IP_ADD_MEMBERSHIP doesn't 2342 * specify the interface to join on. 2343 * 2344 * Supports IP_BOUND_IF by following the ipif/ill when recursing. 2345 */ 2346 ire_t * 2347 ire_lookup_multi(ipaddr_t group, zoneid_t zoneid) 2348 { 2349 ire_t *ire; 2350 ipif_t *ipif = NULL; 2351 int match_flags = MATCH_IRE_TYPE; 2352 ipaddr_t gw_addr; 2353 2354 ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, zoneid, 2355 0, MATCH_IRE_DEFAULT); 2356 2357 /* We search a resolvable ire in case of multirouting. */ 2358 if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) { 2359 ire_t *cire = NULL; 2360 /* 2361 * If the route is not resolvable, the looked up ire 2362 * may be changed here. In that case, ire_multirt_lookup() 2363 * IRE_REFRELE the original ire and change it. 2364 */ 2365 (void) ire_multirt_lookup(&cire, &ire, MULTIRT_CACHEGW); 2366 if (cire != NULL) 2367 ire_refrele(cire); 2368 } 2369 if (ire == NULL) 2370 return (NULL); 2371 /* 2372 * Make sure we follow ire_ipif. 2373 * 2374 * We need to determine the interface route through 2375 * which the gateway will be reached. We don't really 2376 * care which interface is picked if the interface is 2377 * part of a group. 2378 */ 2379 if (ire->ire_ipif != NULL) { 2380 ipif = ire->ire_ipif; 2381 match_flags |= MATCH_IRE_ILL_GROUP; 2382 } 2383 2384 switch (ire->ire_type) { 2385 case IRE_DEFAULT: 2386 case IRE_PREFIX: 2387 case IRE_HOST: 2388 gw_addr = ire->ire_gateway_addr; 2389 ire_refrele(ire); 2390 ire = ire_ftable_lookup(gw_addr, 0, 0, 2391 IRE_INTERFACE, ipif, NULL, zoneid, 0, 2392 match_flags); 2393 return (ire); 2394 case IRE_IF_NORESOLVER: 2395 case IRE_IF_RESOLVER: 2396 return (ire); 2397 default: 2398 ire_refrele(ire); 2399 return (NULL); 2400 } 2401 } 2402 2403 /* 2404 * Return any local address. We use this to target ourselves 2405 * when the src address was specified as 'default'. 2406 * Preference for IRE_LOCAL entries. 2407 */ 2408 ire_t * 2409 ire_lookup_local(zoneid_t zoneid) 2410 { 2411 ire_t *ire; 2412 irb_t *irb; 2413 ire_t *maybe = NULL; 2414 int i; 2415 2416 for (i = 0; i < ip_cache_table_size; i++) { 2417 irb = &ip_cache_table[i]; 2418 if (irb->irb_ire == NULL) 2419 continue; 2420 rw_enter(&irb->irb_lock, RW_READER); 2421 for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 2422 if ((ire->ire_marks & IRE_MARK_CONDEMNED) || 2423 ire->ire_zoneid != zoneid) 2424 continue; 2425 switch (ire->ire_type) { 2426 case IRE_LOOPBACK: 2427 if (maybe == NULL) { 2428 IRE_REFHOLD(ire); 2429 maybe = ire; 2430 } 2431 break; 2432 case IRE_LOCAL: 2433 if (maybe != NULL) { 2434 ire_refrele(maybe); 2435 } 2436 IRE_REFHOLD(ire); 2437 rw_exit(&irb->irb_lock); 2438 return (ire); 2439 } 2440 } 2441 rw_exit(&irb->irb_lock); 2442 } 2443 return (maybe); 2444 } 2445 2446 /* 2447 * If the specified IRE is associated with a particular ILL, return 2448 * that ILL pointer (May be called as writer.). 2449 * 2450 * NOTE : This is not a generic function that can be used always. 2451 * This function always returns the ill of the outgoing packets 2452 * if this ire is used. 2453 */ 2454 ill_t * 2455 ire_to_ill(ire_t *ire) 2456 { 2457 ill_t *ill = NULL; 2458 2459 /* 2460 * 1) For an IRE_CACHE, ire_ipif is the one where it obtained 2461 * the source address from. ire_stq is the one where the 2462 * packets will be sent out on. We return that here. 2463 * 2464 * 2) IRE_BROADCAST normally has a loopback and a non-loopback 2465 * copy and they always exist next to each other with loopback 2466 * copy being the first one. If we are called on the non-loopback 2467 * copy, return the one pointed by ire_stq. If it was called on 2468 * a loopback copy, we still return the one pointed by the next 2469 * ire's ire_stq pointer i.e the one pointed by the non-loopback 2470 * copy. We don't want use ire_ipif as it might represent the 2471 * source address (if we borrow source addresses for 2472 * IRE_BROADCASTS in the future). 2473 * However if an interface is currently coming up, the above 2474 * condition may not hold during that period since the ires 2475 * are added one at a time. Thus one of the pair could have been 2476 * added and the other not yet added. 2477 * 3) For all others return the ones pointed by ire_ipif->ipif_ill. 2478 */ 2479 2480 if (ire->ire_type == IRE_CACHE) { 2481 ill = (ill_t *)ire->ire_stq->q_ptr; 2482 } else if (ire->ire_type == IRE_BROADCAST) { 2483 if (ire->ire_stq != NULL) { 2484 ill = (ill_t *)ire->ire_stq->q_ptr; 2485 } else { 2486 ire_t *ire_next; 2487 2488 ire_next = ire->ire_next; 2489 if (ire_next != NULL && 2490 ire_next->ire_type == IRE_BROADCAST && 2491 ire_next->ire_addr == ire->ire_addr && 2492 ire_next->ire_ipif == ire->ire_ipif) { 2493 ill = (ill_t *)ire_next->ire_stq->q_ptr; 2494 } 2495 } 2496 } else if (ire->ire_ipif != NULL) { 2497 ill = ire->ire_ipif->ipif_ill; 2498 } 2499 return (ill); 2500 } 2501 2502 /* Arrange to call the specified function for every IRE in the world. */ 2503 void 2504 ire_walk(pfv_t func, char *arg) 2505 { 2506 ire_walk_ipvers(func, arg, 0, ALL_ZONES); 2507 } 2508 2509 void 2510 ire_walk_v4(pfv_t func, char *arg, zoneid_t zoneid) 2511 { 2512 ire_walk_ipvers(func, arg, IPV4_VERSION, zoneid); 2513 } 2514 2515 void 2516 ire_walk_v6(pfv_t func, char *arg, zoneid_t zoneid) 2517 { 2518 ire_walk_ipvers(func, arg, IPV6_VERSION, zoneid); 2519 } 2520 2521 /* 2522 * Walk a particular version. version == 0 means both v4 and v6. 2523 */ 2524 static void 2525 ire_walk_ipvers(pfv_t func, char *arg, uchar_t vers, zoneid_t zoneid) 2526 { 2527 if (vers != IPV6_VERSION) { 2528 ire_walk_ill_tables(0, 0, func, arg, IP_MASK_TABLE_SIZE, 2529 ip_ftable_hash_size, ip_forwarding_table, 2530 ip_cache_table_size, ip_cache_table, NULL, zoneid); 2531 } 2532 if (vers != IPV4_VERSION) { 2533 ire_walk_ill_tables(0, 0, func, arg, IP6_MASK_TABLE_SIZE, 2534 ip6_ftable_hash_size, ip_forwarding_table_v6, 2535 ip6_cache_table_size, ip_cache_table_v6, NULL, zoneid); 2536 } 2537 } 2538 2539 /* 2540 * Arrange to call the specified 2541 * function for every IRE that matches the ill. 2542 */ 2543 void 2544 ire_walk_ill(uint_t match_flags, uint_t ire_type, pfv_t func, char *arg, 2545 ill_t *ill) 2546 { 2547 ire_walk_ill_ipvers(match_flags, ire_type, func, arg, 0, ill); 2548 } 2549 2550 void 2551 ire_walk_ill_v4(uint_t match_flags, uint_t ire_type, pfv_t func, char *arg, 2552 ill_t *ill) 2553 { 2554 ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV4_VERSION, 2555 ill); 2556 } 2557 2558 void 2559 ire_walk_ill_v6(uint_t match_flags, uint_t ire_type, pfv_t func, char *arg, 2560 ill_t *ill) 2561 { 2562 ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV6_VERSION, 2563 ill); 2564 } 2565 2566 /* 2567 * Walk a particular ill and version. version == 0 means both v4 and v6. 2568 */ 2569 static void 2570 ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, pfv_t func, 2571 char *arg, uchar_t vers, ill_t *ill) 2572 { 2573 if (vers != IPV6_VERSION) { 2574 ire_walk_ill_tables(match_flags, ire_type, func, arg, 2575 IP_MASK_TABLE_SIZE, ip_ftable_hash_size, 2576 ip_forwarding_table, ip_cache_table_size, 2577 ip_cache_table, ill, ALL_ZONES); 2578 } 2579 if (vers != IPV4_VERSION) { 2580 ire_walk_ill_tables(match_flags, ire_type, func, arg, 2581 IP6_MASK_TABLE_SIZE, ip6_ftable_hash_size, 2582 ip_forwarding_table_v6, ip6_cache_table_size, 2583 ip_cache_table_v6, ill, ALL_ZONES); 2584 } 2585 } 2586 2587 static boolean_t 2588 ire_walk_ill_match(uint_t match_flags, uint_t ire_type, ire_t *ire, 2589 ill_t *ill, zoneid_t zoneid) 2590 { 2591 ill_t *ire_stq_ill = NULL; 2592 ill_t *ire_ipif_ill = NULL; 2593 ill_group_t *ire_ill_group = NULL; 2594 2595 ASSERT(match_flags != 0 || zoneid != ALL_ZONES); 2596 /* 2597 * 1) MATCH_IRE_WQ : Used specifically to match on ire_stq. 2598 * The fast path update uses this to make sure it does not 2599 * update the fast path header of interface X with the fast 2600 * path updates it recieved on interface Y. It is similar 2601 * in handling DL_NOTE_FASTPATH_FLUSH. 2602 * 2603 * 2) MATCH_IRE_ILL/MATCH_IRE_ILL_GROUP : We match both on ill 2604 * pointed by ire_stq and ire_ipif. Only in the case of 2605 * IRE_CACHEs can ire_stq and ire_ipif be pointing to 2606 * different ills. But we want to keep this function generic 2607 * enough for future use. So, we always try to match on both. 2608 * The only caller of this function ire_walk_ill_tables, will 2609 * call "func" after we return from this function. We expect 2610 * "func" to do the right filtering of ires in this case. 2611 * 2612 * NOTE : In the case of MATCH_IRE_ILL_GROUP, groups 2613 * pointed by ire_stq and ire_ipif should always be the same. 2614 * So, we just match on only one of them. 2615 */ 2616 if (match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) { 2617 if (ire->ire_stq != NULL) 2618 ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr; 2619 if (ire->ire_ipif != NULL) 2620 ire_ipif_ill = ire->ire_ipif->ipif_ill; 2621 if (ire_stq_ill != NULL) 2622 ire_ill_group = ire_stq_ill->ill_group; 2623 if ((ire_ill_group == NULL) && (ire_ipif_ill != NULL)) 2624 ire_ill_group = ire_ipif_ill->ill_group; 2625 } 2626 2627 if (zoneid != ALL_ZONES) { 2628 /* 2629 * We're walking the IREs for a specific zone. The only relevant 2630 * IREs are: 2631 * - all IREs with a matching ire_zoneid 2632 * - all IRE_OFFSUBNETs as they're shared across all zones 2633 * - IRE_INTERFACE IREs for interfaces with a usable source addr 2634 * with a matching zone 2635 * - IRE_DEFAULTs with a gateway reachable from the zone 2636 * We should really match on IRE_OFFSUBNETs and IRE_DEFAULTs 2637 * using the same rule; but the above rules are consistent with 2638 * the behavior of ire_ftable_lookup[_v6]() so that all the 2639 * routes that can be matched during lookup are also matched 2640 * here. 2641 */ 2642 if (zoneid != ire->ire_zoneid) { 2643 /* 2644 * Note, IRE_INTERFACE can have the stq as NULL. For 2645 * example, if the default multicast route is tied to 2646 * the loopback address. 2647 */ 2648 if ((ire->ire_type & IRE_INTERFACE) && 2649 (ire->ire_stq != NULL)) { 2650 ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr; 2651 if (ire->ire_ipversion == IPV4_VERSION) { 2652 if (!ipif_usesrc_avail(ire_stq_ill, 2653 zoneid)) 2654 /* No usable src addr in zone */ 2655 return (B_FALSE); 2656 } else if (ire_stq_ill->ill_usesrc_ifindex 2657 != 0) { 2658 /* 2659 * For IPv6 use ipif_select_source_v6() 2660 * so the right scope selection is done 2661 */ 2662 ipif_t *src_ipif; 2663 src_ipif = 2664 ipif_select_source_v6(ire_stq_ill, 2665 &ire->ire_addr_v6, B_FALSE, 2666 IPV6_PREFER_SRC_DEFAULT, 2667 zoneid); 2668 if (src_ipif != NULL) { 2669 ipif_refrele(src_ipif); 2670 } else { 2671 return (B_FALSE); 2672 } 2673 } else { 2674 return (B_FALSE); 2675 } 2676 2677 } else if (!(ire->ire_type & IRE_OFFSUBNET)) { 2678 return (B_FALSE); 2679 } 2680 } 2681 2682 /* 2683 * Match all default routes from the global zone, irrespective 2684 * of reachability. 2685 */ 2686 if (ire->ire_type == IRE_DEFAULT && zoneid != GLOBAL_ZONEID) { 2687 int ire_match_flags = 0; 2688 in6_addr_t gw_addr_v6; 2689 ire_t *rire; 2690 2691 if (ire->ire_ipif != NULL) { 2692 ire_match_flags |= MATCH_IRE_ILL_GROUP; 2693 } 2694 if (ire->ire_ipversion == IPV4_VERSION) { 2695 rire = ire_route_lookup(ire->ire_gateway_addr, 2696 0, 0, 0, ire->ire_ipif, NULL, zoneid, 2697 ire_match_flags); 2698 } else { 2699 ASSERT(ire->ire_ipversion == IPV6_VERSION); 2700 mutex_enter(&ire->ire_lock); 2701 gw_addr_v6 = ire->ire_gateway_addr_v6; 2702 mutex_exit(&ire->ire_lock); 2703 rire = ire_route_lookup_v6(&gw_addr_v6, 2704 NULL, NULL, 0, ire->ire_ipif, NULL, zoneid, 2705 ire_match_flags); 2706 } 2707 if (rire == NULL) { 2708 return (B_FALSE); 2709 } 2710 ire_refrele(rire); 2711 } 2712 } 2713 2714 if (((!(match_flags & MATCH_IRE_TYPE)) || 2715 (ire->ire_type & ire_type)) && 2716 ((!(match_flags & MATCH_IRE_WQ)) || 2717 (ire->ire_stq == ill->ill_wq)) && 2718 ((!(match_flags & MATCH_IRE_ILL)) || 2719 (ire_stq_ill == ill || ire_ipif_ill == ill)) && 2720 ((!(match_flags & MATCH_IRE_ILL_GROUP)) || 2721 (ire_stq_ill == ill) || (ire_ipif_ill == ill) || 2722 (ire_ill_group != NULL && 2723 ire_ill_group == ill->ill_group))) { 2724 return (B_TRUE); 2725 } 2726 return (B_FALSE); 2727 } 2728 2729 /* 2730 * Walk the ftable and the ctable entries that match the ill. 2731 */ 2732 static void 2733 ire_walk_ill_tables(uint_t match_flags, uint_t ire_type, pfv_t func, 2734 char *arg, size_t ftbl_sz, size_t htbl_sz, irb_t **ipftbl, 2735 size_t ctbl_sz, irb_t *ipctbl, ill_t *ill, zoneid_t zoneid) 2736 { 2737 irb_t *irb_ptr; 2738 irb_t *irb; 2739 ire_t *ire; 2740 int i, j; 2741 boolean_t ret; 2742 2743 ASSERT((!(match_flags & (MATCH_IRE_WQ | MATCH_IRE_ILL | 2744 MATCH_IRE_ILL_GROUP))) || (ill != NULL)); 2745 ASSERT(!(match_flags & MATCH_IRE_TYPE) || (ire_type != 0)); 2746 /* 2747 * Optimize by not looking at the forwarding table if there 2748 * is a MATCH_IRE_TYPE specified with no IRE_FORWARDTABLE 2749 * specified in ire_type. 2750 */ 2751 if (!(match_flags & MATCH_IRE_TYPE) || 2752 ((ire_type & IRE_FORWARDTABLE) != 0)) { 2753 for (i = (ftbl_sz - 1); i >= 0; i--) { 2754 if ((irb_ptr = ipftbl[i]) == NULL) 2755 continue; 2756 for (j = 0; j < htbl_sz; j++) { 2757 irb = &irb_ptr[j]; 2758 if (irb->irb_ire == NULL) 2759 continue; 2760 IRB_REFHOLD(irb); 2761 for (ire = irb->irb_ire; ire != NULL; 2762 ire = ire->ire_next) { 2763 if (match_flags == 0 && 2764 zoneid == ALL_ZONES) { 2765 ret = B_TRUE; 2766 } else { 2767 ret = ire_walk_ill_match( 2768 match_flags, ire_type, 2769 ire, ill, zoneid); 2770 } 2771 if (ret) 2772 (*func)(ire, arg); 2773 } 2774 IRB_REFRELE(irb); 2775 } 2776 } 2777 } 2778 2779 /* 2780 * Optimize by not looking at the cache table if there 2781 * is a MATCH_IRE_TYPE specified with no IRE_CACHETABLE 2782 * specified in ire_type. 2783 */ 2784 if (!(match_flags & MATCH_IRE_TYPE) || 2785 ((ire_type & IRE_CACHETABLE) != 0)) { 2786 for (i = 0; i < ctbl_sz; i++) { 2787 irb = &ipctbl[i]; 2788 if (irb->irb_ire == NULL) 2789 continue; 2790 IRB_REFHOLD(irb); 2791 for (ire = irb->irb_ire; ire != NULL; 2792 ire = ire->ire_next) { 2793 if (match_flags == 0 && zoneid == ALL_ZONES) { 2794 ret = B_TRUE; 2795 } else { 2796 ret = ire_walk_ill_match( 2797 match_flags, ire_type, 2798 ire, ill, zoneid); 2799 } 2800 if (ret) 2801 (*func)(ire, arg); 2802 } 2803 IRB_REFRELE(irb); 2804 } 2805 } 2806 } 2807 2808 /* 2809 * This routine walks through the ill chain to find if there is any 2810 * ire linked to the ill's interface based forwarding table 2811 * The arg could be ill or mp. This routine is called when a ill goes 2812 * down/deleted or the 'ipv4_ire_srcif_status' report is printed. 2813 */ 2814 void 2815 ire_walk_srcif_table_v4(pfv_t func, char *arg) 2816 { 2817 irb_t *irb; 2818 ire_t *ire; 2819 ill_t *ill, *next_ill; 2820 int i; 2821 int total_count; 2822 ill_walk_context_t ctx; 2823 2824 /* 2825 * Take care of ire's in other ill's per-interface forwarding 2826 * table. Check if any ire in any of the ill's ill_srcif_table 2827 * is pointing to this ill. 2828 */ 2829 mutex_enter(&ire_srcif_table_lock); 2830 if (ire_srcif_table_count == 0) { 2831 mutex_exit(&ire_srcif_table_lock); 2832 return; 2833 } 2834 mutex_exit(&ire_srcif_table_lock); 2835 2836 #ifdef DEBUG 2837 /* Keep accounting of all interface based table ires */ 2838 total_count = 0; 2839 rw_enter(&ill_g_lock, RW_READER); 2840 ill = ILL_START_WALK_V4(&ctx); 2841 while (ill != NULL) { 2842 mutex_enter(&ill->ill_lock); 2843 total_count += ill->ill_srcif_refcnt; 2844 next_ill = ill_next(&ctx, ill); 2845 mutex_exit(&ill->ill_lock); 2846 ill = next_ill; 2847 } 2848 rw_exit(&ill_g_lock); 2849 2850 /* Hold lock here to make sure ire_srcif_table_count is stable */ 2851 mutex_enter(&ire_srcif_table_lock); 2852 i = ire_srcif_table_count; 2853 mutex_exit(&ire_srcif_table_lock); 2854 ip1dbg(("ire_walk_srcif_v4: ire_srcif_table_count %d " 2855 "total ill_srcif_refcnt %d\n", i, total_count)); 2856 #endif 2857 rw_enter(&ill_g_lock, RW_READER); 2858 ill = ILL_START_WALK_V4(&ctx); 2859 while (ill != NULL) { 2860 mutex_enter(&ill->ill_lock); 2861 if ((ill->ill_srcif_refcnt == 0) || !ILL_CAN_LOOKUP(ill)) { 2862 next_ill = ill_next(&ctx, ill); 2863 mutex_exit(&ill->ill_lock); 2864 ill = next_ill; 2865 continue; 2866 } 2867 ill_refhold_locked(ill); 2868 mutex_exit(&ill->ill_lock); 2869 rw_exit(&ill_g_lock); 2870 if (ill->ill_srcif_table != NULL) { 2871 for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) { 2872 irb = &(ill->ill_srcif_table[i]); 2873 if (irb->irb_ire == NULL) 2874 continue; 2875 IRB_REFHOLD(irb); 2876 for (ire = irb->irb_ire; ire != NULL; 2877 ire = ire->ire_next) { 2878 (*func)(ire, arg); 2879 } 2880 IRB_REFRELE(irb); 2881 } 2882 } 2883 rw_enter(&ill_g_lock, RW_READER); 2884 next_ill = ill_next(&ctx, ill); 2885 ill_refrele(ill); 2886 ill = next_ill; 2887 } 2888 rw_exit(&ill_g_lock); 2889 } 2890 2891 /* 2892 * This function takes a mask and returns 2893 * number of bits set in the mask. If no 2894 * bit is set it returns 0. 2895 * Assumes a contiguous mask. 2896 */ 2897 int 2898 ip_mask_to_plen(ipaddr_t mask) 2899 { 2900 return (mask == 0 ? 0 : IP_ABITS - (ffs(ntohl(mask)) -1)); 2901 } 2902 2903 /* 2904 * Convert length for a mask to the mask. 2905 */ 2906 ipaddr_t 2907 ip_plen_to_mask(uint_t masklen) 2908 { 2909 return (htonl(IP_HOST_MASK << (IP_ABITS - masklen))); 2910 } 2911 2912 void 2913 ire_atomic_end(irb_t *irb_ptr, ire_t *ire) 2914 { 2915 ill_t *ill_list[NUM_ILLS]; 2916 2917 ill_list[0] = ire->ire_stq != NULL ? ire->ire_stq->q_ptr : NULL; 2918 ill_list[1] = ire->ire_ipif != NULL ? ire->ire_ipif->ipif_ill : NULL; 2919 ill_list[2] = ire->ire_in_ill; 2920 ill_unlock_ills(ill_list, NUM_ILLS); 2921 rw_exit(&irb_ptr->irb_lock); 2922 rw_exit(&ill_g_usesrc_lock); 2923 } 2924 2925 /* 2926 * ire_add_v[46] atomically make sure that the ipif or ill associated 2927 * with the new ire being added is stable and not IPIF_CHANGING or ILL_CHANGING 2928 * before adding the ire to the table. This ensures that we don't create 2929 * new IRE_CACHEs with stale values for parameters that are passed to 2930 * ire_create such as ire_max_frag. Note that ire_create() is passed a pointer 2931 * to the ipif_mtu, and not the value. The actual value is derived from the 2932 * parent ire or ipif under the bucket lock. 2933 */ 2934 int 2935 ire_atomic_start(irb_t *irb_ptr, ire_t *ire, queue_t *q, mblk_t *mp, 2936 ipsq_func_t func) 2937 { 2938 ill_t *stq_ill; 2939 ill_t *ipif_ill; 2940 ill_t *in_ill; 2941 ill_t *ill_list[NUM_ILLS]; 2942 int cnt = NUM_ILLS; 2943 int error = 0; 2944 ill_t *ill = NULL; 2945 2946 ill_list[0] = stq_ill = ire->ire_stq != 2947 NULL ? ire->ire_stq->q_ptr : NULL; 2948 ill_list[1] = ipif_ill = ire->ire_ipif != 2949 NULL ? ire->ire_ipif->ipif_ill : NULL; 2950 ill_list[2] = in_ill = ire->ire_in_ill; 2951 2952 ASSERT((q != NULL && mp != NULL && func != NULL) || 2953 (q == NULL && mp == NULL && func == NULL)); 2954 rw_enter(&ill_g_usesrc_lock, RW_READER); 2955 GRAB_CONN_LOCK(q); 2956 rw_enter(&irb_ptr->irb_lock, RW_WRITER); 2957 ill_lock_ills(ill_list, cnt); 2958 2959 /* 2960 * While the IRE is in the process of being added, a user may have 2961 * invoked the ifconfig usesrc option on the stq_ill to make it a 2962 * usesrc client ILL. Check for this possibility here, if it is true 2963 * then we fail adding the IRE_CACHE. Another check is to make sure 2964 * that an ipif_ill of an IRE_CACHE being added is not part of a usesrc 2965 * group. The ill_g_usesrc_lock is released in ire_atomic_end 2966 */ 2967 if ((ire->ire_type & IRE_CACHE) && 2968 (ire->ire_marks & IRE_MARK_USESRC_CHECK)) { 2969 if (stq_ill->ill_usesrc_ifindex != 0) { 2970 ASSERT(stq_ill->ill_usesrc_grp_next != NULL); 2971 if ((ipif_ill->ill_phyint->phyint_ifindex != 2972 stq_ill->ill_usesrc_ifindex) || 2973 (ipif_ill->ill_usesrc_grp_next == NULL) || 2974 (ipif_ill->ill_usesrc_ifindex != 0)) { 2975 error = EINVAL; 2976 goto done; 2977 } 2978 } else if (ipif_ill->ill_usesrc_grp_next != NULL) { 2979 error = EINVAL; 2980 goto done; 2981 } 2982 } 2983 2984 /* 2985 * IPMP flag settings happen without taking the exclusive route 2986 * in ip_sioctl_flags. So we need to make an atomic check here 2987 * for FAILED/OFFLINE/INACTIVE flags or if it has hit the 2988 * FAILBACK=no case. 2989 */ 2990 if ((stq_ill != NULL) && !IAM_WRITER_ILL(stq_ill)) { 2991 if (stq_ill->ill_state_flags & ILL_CHANGING) { 2992 ill = stq_ill; 2993 error = EAGAIN; 2994 } else if ((stq_ill->ill_phyint->phyint_flags & PHYI_OFFLINE) || 2995 (ill_is_probeonly(stq_ill) && 2996 !(ire->ire_marks & IRE_MARK_HIDDEN))) { 2997 error = EINVAL; 2998 } 2999 goto done; 3000 } 3001 3002 /* 3003 * We don't check for OFFLINE/FAILED in this case because 3004 * the source address selection logic (ipif_select_source) 3005 * may still select a source address from such an ill. The 3006 * assumption is that these addresses will be moved by in.mpathd 3007 * soon. (i.e. this is a race). However link local addresses 3008 * will not move and hence ipif_select_source_v6 tries to avoid 3009 * FAILED ills. Please see ipif_select_source_v6 for more info 3010 */ 3011 if ((ipif_ill != NULL) && !IAM_WRITER_ILL(ipif_ill) && 3012 (ipif_ill->ill_state_flags & ILL_CHANGING)) { 3013 ill = ipif_ill; 3014 error = EAGAIN; 3015 goto done; 3016 } 3017 3018 if ((in_ill != NULL) && !IAM_WRITER_ILL(in_ill) && 3019 (in_ill->ill_state_flags & ILL_CHANGING)) { 3020 ill = in_ill; 3021 error = EAGAIN; 3022 goto done; 3023 } 3024 3025 if ((ire->ire_ipif != NULL) && !IAM_WRITER_IPIF(ire->ire_ipif) && 3026 (ire->ire_ipif->ipif_state_flags & IPIF_CHANGING)) { 3027 ill = ire->ire_ipif->ipif_ill; 3028 ASSERT(ill != NULL); 3029 error = EAGAIN; 3030 goto done; 3031 } 3032 3033 done: 3034 if (error == EAGAIN && ILL_CAN_WAIT(ill, q)) { 3035 ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq; 3036 mutex_enter(&ipsq->ipsq_lock); 3037 ire_atomic_end(irb_ptr, ire); 3038 ipsq_enq(ipsq, q, mp, func, NEW_OP, ill); 3039 mutex_exit(&ipsq->ipsq_lock); 3040 error = EINPROGRESS; 3041 } else if (error != 0) { 3042 ire_atomic_end(irb_ptr, ire); 3043 } 3044 3045 RELEASE_CONN_LOCK(q); 3046 return (error); 3047 } 3048 3049 /* 3050 * Add a fully initialized IRE to an appropriate table based on 3051 * ire_type. 3052 */ 3053 int 3054 ire_add(ire_t **irep, queue_t *q, mblk_t *mp, ipsq_func_t func) 3055 { 3056 ire_t *ire1; 3057 ill_t *stq_ill = NULL; 3058 ill_t *ill; 3059 ipif_t *ipif = NULL; 3060 ill_walk_context_t ctx; 3061 ire_t *ire = *irep; 3062 int error; 3063 3064 ASSERT(ire->ire_type != IRE_MIPRTUN); 3065 3066 /* get ready for the day when original ire is not created as mblk */ 3067 if (ire->ire_mp != NULL) { 3068 /* Copy the ire to a kmem_alloc'ed area */ 3069 ire1 = kmem_cache_alloc(ire_cache, KM_NOSLEEP); 3070 if (ire1 == NULL) { 3071 ip1dbg(("ire_add: alloc failed\n")); 3072 ire_delete(ire); 3073 *irep = NULL; 3074 return (ENOMEM); 3075 } 3076 *ire1 = *ire; 3077 ire1->ire_mp = NULL; 3078 freeb(ire->ire_mp); 3079 ire = ire1; 3080 } 3081 if (ire->ire_stq != NULL) 3082 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 3083 3084 if (ire->ire_type == IRE_CACHE) { 3085 /* 3086 * If this interface is FAILED, or INACTIVE or has hit 3087 * the FAILBACK=no case, we create IRE_CACHES marked 3088 * HIDDEN for some special cases e.g. bind to 3089 * IPIF_NOFAILOVER address etc. So, if this interface 3090 * is FAILED/INACTIVE/hit FAILBACK=no case, and we are 3091 * not creating hidden ires, we should not allow that. 3092 * This happens because the state of the interface 3093 * changed while we were waiting in ARP. If this is the 3094 * daemon sending probes, the next probe will create 3095 * HIDDEN ires and we will create an ire then. This 3096 * cannot happen with NDP currently because IRE is 3097 * never queued in NDP. But it can happen in the 3098 * future when we have external resolvers with IPv6. 3099 * If the interface gets marked with OFFLINE while we 3100 * are waiting in ARP, don't add the ire. 3101 */ 3102 if ((stq_ill->ill_phyint->phyint_flags & PHYI_OFFLINE) || 3103 (ill_is_probeonly(stq_ill) && 3104 !(ire->ire_marks & IRE_MARK_HIDDEN))) { 3105 /* 3106 * We don't know whether it is a valid ipif or not. 3107 * unless we do the check below. So, set it to NULL. 3108 */ 3109 ire->ire_ipif = NULL; 3110 ire_delete(ire); 3111 *irep = NULL; 3112 return (EINVAL); 3113 } 3114 } 3115 3116 if (stq_ill != NULL && ire->ire_type == IRE_CACHE && 3117 stq_ill->ill_net_type == IRE_IF_RESOLVER) { 3118 rw_enter(&ill_g_lock, RW_READER); 3119 ill = ILL_START_WALK_ALL(&ctx); 3120 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 3121 mutex_enter(&ill->ill_lock); 3122 if (ill->ill_state_flags & ILL_CONDEMNED) { 3123 mutex_exit(&ill->ill_lock); 3124 continue; 3125 } 3126 /* 3127 * We need to make sure that the ipif is a valid one 3128 * before adding the IRE_CACHE. This happens only 3129 * with IRE_CACHE when there is an external resolver. 3130 * 3131 * We can unplumb a logical interface while the 3132 * packet is waiting in ARP with the IRE. Then, 3133 * later on when we feed the IRE back, the ipif 3134 * has to be re-checked. This can't happen with 3135 * NDP currently, as we never queue the IRE with 3136 * the packet. We always try to recreate the IRE 3137 * when the resolution is completed. But, we do 3138 * it for IPv6 also here so that in future if 3139 * we have external resolvers, it will work without 3140 * any change. 3141 */ 3142 ipif = ipif_lookup_seqid(ill, ire->ire_ipif_seqid); 3143 if (ipif != NULL) { 3144 ipif_refhold_locked(ipif); 3145 mutex_exit(&ill->ill_lock); 3146 break; 3147 } 3148 mutex_exit(&ill->ill_lock); 3149 } 3150 rw_exit(&ill_g_lock); 3151 if (ipif == NULL || 3152 (ipif->ipif_isv6 && 3153 !IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6, 3154 &ipif->ipif_v6src_addr)) || 3155 (!ipif->ipif_isv6 && 3156 ire->ire_src_addr != ipif->ipif_src_addr) || 3157 (ire->ire_zoneid != ipif->ipif_zoneid)) { 3158 3159 if (ipif != NULL) 3160 ipif_refrele(ipif); 3161 ire->ire_ipif = NULL; 3162 ire_delete(ire); 3163 *irep = NULL; 3164 return (EINVAL); 3165 } 3166 3167 3168 ASSERT(ill != NULL); 3169 /* 3170 * If this group was dismantled while this packets was 3171 * queued in ARP, don't add it here. 3172 */ 3173 if (ire->ire_ipif->ipif_ill->ill_group != ill->ill_group) { 3174 /* We don't want ire_inactive bump stats for this */ 3175 ipif_refrele(ipif); 3176 ire->ire_ipif = NULL; 3177 ire_delete(ire); 3178 *irep = NULL; 3179 return (EINVAL); 3180 } 3181 } 3182 3183 /* 3184 * In case ire was changed 3185 */ 3186 *irep = ire; 3187 if (ire->ire_ipversion == IPV6_VERSION) { 3188 error = ire_add_v6(irep, q, mp, func); 3189 } else { 3190 if (ire->ire_in_ill == NULL) 3191 error = ire_add_v4(irep, q, mp, func); 3192 else 3193 error = ire_add_srcif_v4(irep, q, mp, func); 3194 } 3195 if (ipif != NULL) 3196 ipif_refrele(ipif); 3197 return (error); 3198 } 3199 3200 /* 3201 * Add a fully initialized IRE to an appropriate 3202 * table based on ire_type. 3203 * 3204 * The forward table contains IRE_PREFIX/IRE_HOST/IRE_HOST_REDIRECT 3205 * IRE_IF_RESOLVER/IRE_IF_NORESOLVER and IRE_DEFAULT. 3206 * 3207 * The cache table contains IRE_BROADCAST/IRE_LOCAL/IRE_LOOPBACK 3208 * and IRE_CACHE. 3209 * 3210 * NOTE : This function is called as writer though not required 3211 * by this function. 3212 */ 3213 static int 3214 ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func) 3215 { 3216 ire_t *ire1; 3217 int mask_table_index; 3218 irb_t *irb_ptr; 3219 ire_t **irep; 3220 int flags; 3221 ire_t *pire = NULL; 3222 ill_t *stq_ill; 3223 ire_t *ire = *ire_p; 3224 int error; 3225 3226 if (ire->ire_ipif != NULL) 3227 ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock)); 3228 if (ire->ire_stq != NULL) 3229 ASSERT(!MUTEX_HELD( 3230 &((ill_t *)(ire->ire_stq->q_ptr))->ill_lock)); 3231 ASSERT(ire->ire_ipversion == IPV4_VERSION); 3232 ASSERT(ire->ire_mp == NULL); /* Calls should go through ire_add */ 3233 ASSERT(ire->ire_in_ill == NULL); /* No srcif entries */ 3234 3235 /* Find the appropriate list head. */ 3236 switch (ire->ire_type) { 3237 case IRE_HOST: 3238 ire->ire_mask = IP_HOST_MASK; 3239 ire->ire_masklen = IP_ABITS; 3240 if ((ire->ire_flags & RTF_SETSRC) == 0) 3241 ire->ire_src_addr = 0; 3242 break; 3243 case IRE_HOST_REDIRECT: 3244 ire->ire_mask = IP_HOST_MASK; 3245 ire->ire_masklen = IP_ABITS; 3246 ire->ire_src_addr = 0; 3247 break; 3248 case IRE_CACHE: 3249 case IRE_BROADCAST: 3250 case IRE_LOCAL: 3251 case IRE_LOOPBACK: 3252 ire->ire_mask = IP_HOST_MASK; 3253 ire->ire_masklen = IP_ABITS; 3254 break; 3255 case IRE_PREFIX: 3256 if ((ire->ire_flags & RTF_SETSRC) == 0) 3257 ire->ire_src_addr = 0; 3258 break; 3259 case IRE_DEFAULT: 3260 if ((ire->ire_flags & RTF_SETSRC) == 0) 3261 ire->ire_src_addr = 0; 3262 break; 3263 case IRE_IF_RESOLVER: 3264 case IRE_IF_NORESOLVER: 3265 break; 3266 default: 3267 printf("ire_add_v4: ire %p has unrecognized IRE type (%d)\n", 3268 (void *)ire, ire->ire_type); 3269 ire_delete(ire); 3270 *ire_p = NULL; 3271 return (EINVAL); 3272 } 3273 3274 /* Make sure the address is properly masked. */ 3275 ire->ire_addr &= ire->ire_mask; 3276 3277 if ((ire->ire_type & IRE_CACHETABLE) == 0) { 3278 /* IRE goes into Forward Table */ 3279 mask_table_index = ire->ire_masklen; 3280 if ((ip_forwarding_table[mask_table_index]) == NULL) { 3281 irb_t *ptr; 3282 int i; 3283 3284 ptr = (irb_t *)mi_zalloc((ip_ftable_hash_size * 3285 sizeof (irb_t))); 3286 if (ptr == NULL) { 3287 ire_delete(ire); 3288 *ire_p = NULL; 3289 return (ENOMEM); 3290 } 3291 for (i = 0; i < ip_ftable_hash_size; i++) { 3292 rw_init(&ptr[i].irb_lock, NULL, 3293 RW_DEFAULT, NULL); 3294 } 3295 mutex_enter(&ire_ft_init_lock); 3296 if (ip_forwarding_table[mask_table_index] == NULL) { 3297 ip_forwarding_table[mask_table_index] = ptr; 3298 mutex_exit(&ire_ft_init_lock); 3299 } else { 3300 /* 3301 * Some other thread won the race in 3302 * initializing the forwarding table at the 3303 * same index. 3304 */ 3305 mutex_exit(&ire_ft_init_lock); 3306 for (i = 0; i < ip_ftable_hash_size; i++) { 3307 rw_destroy(&ptr[i].irb_lock); 3308 } 3309 mi_free(ptr); 3310 } 3311 } 3312 irb_ptr = &(ip_forwarding_table[mask_table_index][ 3313 IRE_ADDR_HASH(ire->ire_addr, ip_ftable_hash_size)]); 3314 } else { 3315 irb_ptr = &(ip_cache_table[IRE_ADDR_HASH(ire->ire_addr, 3316 ip_cache_table_size)]); 3317 } 3318 /* 3319 * ip_newroute/ip_newroute_multi are unable to prevent the deletion 3320 * of the interface route while adding an IRE_CACHE for an on-link 3321 * destination in the IRE_IF_RESOLVER case, since the ire has to 3322 * go to ARP and return. We can't do a REFHOLD on the 3323 * associated interface ire for fear of ARP freeing the message. 3324 * Here we look up the interface ire in the forwarding table and 3325 * make sure that the interface route has not been deleted. 3326 */ 3327 if (ire->ire_type == IRE_CACHE && ire->ire_gateway_addr == 0 && 3328 ((ill_t *)ire->ire_stq->q_ptr)->ill_net_type == IRE_IF_RESOLVER) { 3329 ASSERT(ire->ire_max_fragp == NULL); 3330 if (CLASSD(ire->ire_addr) && !(ire->ire_flags & RTF_SETSRC)) { 3331 /* 3332 * The ihandle that we used in ip_newroute_multi 3333 * comes from the interface route corresponding 3334 * to ire_ipif. Lookup here to see if it exists 3335 * still. 3336 * If the ire has a source address assigned using 3337 * RTF_SETSRC, ire_ipif is the logical interface holding 3338 * this source address, so we can't use it to check for 3339 * the existence of the interface route. Instead we rely 3340 * on the brute force ihandle search in 3341 * ire_ihandle_lookup_onlink() below. 3342 */ 3343 pire = ipif_to_ire(ire->ire_ipif); 3344 if (pire == NULL) { 3345 ire_delete(ire); 3346 *ire_p = NULL; 3347 return (EINVAL); 3348 } else if (pire->ire_ihandle != ire->ire_ihandle) { 3349 ire_refrele(pire); 3350 ire_delete(ire); 3351 *ire_p = NULL; 3352 return (EINVAL); 3353 } 3354 } else { 3355 pire = ire_ihandle_lookup_onlink(ire); 3356 if (pire == NULL) { 3357 ire_delete(ire); 3358 *ire_p = NULL; 3359 return (EINVAL); 3360 } 3361 } 3362 /* Prevent pire from getting deleted */ 3363 IRB_REFHOLD(pire->ire_bucket); 3364 /* Has it been removed already ? */ 3365 if (pire->ire_marks & IRE_MARK_CONDEMNED) { 3366 IRB_REFRELE(pire->ire_bucket); 3367 ire_refrele(pire); 3368 ire_delete(ire); 3369 *ire_p = NULL; 3370 return (EINVAL); 3371 } 3372 } else { 3373 ASSERT(ire->ire_max_fragp != NULL); 3374 } 3375 flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW); 3376 3377 if (ire->ire_ipif != NULL) { 3378 /* 3379 * We use MATCH_IRE_IPIF while adding IRE_CACHES only 3380 * for historic reasons and to maintain symmetry with 3381 * IPv6 code path. Historically this was used by 3382 * multicast code to create multiple IRE_CACHES on 3383 * a single ill with different ipifs. This was used 3384 * so that multicast packets leaving the node had the 3385 * right source address. This is no longer needed as 3386 * ip_wput initializes the address correctly. 3387 */ 3388 flags |= MATCH_IRE_IPIF; 3389 /* 3390 * If we are creating hidden ires, make sure we search on 3391 * this ill (MATCH_IRE_ILL) and a hidden ire, 3392 * while we are searching for duplicates below. Otherwise we 3393 * could potentially find an IRE on some other interface 3394 * and it may not be a IRE marked with IRE_MARK_HIDDEN. We 3395 * shouldn't do this as this will lead to an infinite loop 3396 * (if we get to ip_wput again) eventually we need an hidden 3397 * ire for this packet to go out. MATCH_IRE_ILL is explicitly 3398 * done below. 3399 */ 3400 if (ire->ire_type == IRE_CACHE && 3401 (ire->ire_marks & IRE_MARK_HIDDEN)) 3402 flags |= (MATCH_IRE_MARK_HIDDEN); 3403 } 3404 3405 /* 3406 * Start the atomic add of the ire. Grab the ill locks, 3407 * ill_g_usesrc_lock and the bucket lock. Check for condemned 3408 * 3409 * If ipif or ill is changing ire_atomic_start() may queue the 3410 * request and return EINPROGRESS. 3411 */ 3412 error = ire_atomic_start(irb_ptr, ire, q, mp, func); 3413 if (error != 0) { 3414 /* 3415 * We don't know whether it is a valid ipif or not. 3416 * So, set it to NULL. This assumes that the ire has not added 3417 * a reference to the ipif. 3418 */ 3419 ire->ire_ipif = NULL; 3420 ire_delete(ire); 3421 if (pire != NULL) { 3422 IRB_REFRELE(pire->ire_bucket); 3423 ire_refrele(pire); 3424 } 3425 *ire_p = NULL; 3426 return (error); 3427 } 3428 /* 3429 * To avoid creating ires having stale values for the ire_max_frag 3430 * we get the latest value atomically here. For more details 3431 * see the block comment in ip_sioctl_mtu and in DL_NOTE_SDU_CHANGE 3432 * in ip_rput_dlpi_writer 3433 */ 3434 if (ire->ire_max_fragp == NULL) { 3435 if (CLASSD(ire->ire_addr)) 3436 ire->ire_max_frag = ire->ire_ipif->ipif_mtu; 3437 else 3438 ire->ire_max_frag = pire->ire_max_frag; 3439 } else { 3440 uint_t max_frag; 3441 3442 max_frag = *ire->ire_max_fragp; 3443 ire->ire_max_fragp = NULL; 3444 ire->ire_max_frag = max_frag; 3445 } 3446 /* 3447 * Atomically check for duplicate and insert in the table. 3448 */ 3449 for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) { 3450 if (ire1->ire_marks & IRE_MARK_CONDEMNED) 3451 continue; 3452 if (ire->ire_ipif != NULL) { 3453 /* 3454 * We do MATCH_IRE_ILL implicitly here for IREs 3455 * with a non-null ire_ipif, including IRE_CACHEs. 3456 * As ire_ipif and ire_stq could point to two 3457 * different ills, we can't pass just ire_ipif to 3458 * ire_match_args and get a match on both ills. 3459 * This is just needed for duplicate checks here and 3460 * so we don't add an extra argument to 3461 * ire_match_args for this. Do it locally. 3462 * 3463 * NOTE : Currently there is no part of the code 3464 * that asks for both MATH_IRE_IPIF and MATCH_IRE_ILL 3465 * match for IRE_CACHEs. Thus we don't want to 3466 * extend the arguments to ire_match_args. 3467 */ 3468 if (ire1->ire_stq != ire->ire_stq) 3469 continue; 3470 /* 3471 * Multiroute IRE_CACHEs for a given destination can 3472 * have the same ire_ipif, typically if their source 3473 * address is forced using RTF_SETSRC, and the same 3474 * send-to queue. We differentiate them using the parent 3475 * handle. 3476 */ 3477 if (ire->ire_type == IRE_CACHE && 3478 (ire1->ire_flags & RTF_MULTIRT) && 3479 (ire->ire_flags & RTF_MULTIRT) && 3480 (ire1->ire_phandle != ire->ire_phandle)) 3481 continue; 3482 } 3483 if (ire1->ire_zoneid != ire->ire_zoneid) 3484 continue; 3485 if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask, 3486 ire->ire_gateway_addr, ire->ire_type, ire->ire_ipif, 3487 ire->ire_zoneid, 0, flags)) { 3488 /* 3489 * Return the old ire after doing a REFHOLD. 3490 * As most of the callers continue to use the IRE 3491 * after adding, we return a held ire. This will 3492 * avoid a lookup in the caller again. If the callers 3493 * don't want to use it, they need to do a REFRELE. 3494 */ 3495 ip1dbg(("found dup ire existing %p new %p", 3496 (void *)ire1, (void *)ire)); 3497 IRE_REFHOLD(ire1); 3498 ire_atomic_end(irb_ptr, ire); 3499 ire_delete(ire); 3500 if (pire != NULL) { 3501 /* 3502 * Assert that it is not removed from the 3503 * list yet. 3504 */ 3505 ASSERT(pire->ire_ptpn != NULL); 3506 IRB_REFRELE(pire->ire_bucket); 3507 ire_refrele(pire); 3508 } 3509 *ire_p = ire1; 3510 return (0); 3511 } 3512 } 3513 3514 /* 3515 * Make it easy for ip_wput_ire() to hit multiple broadcast ires by 3516 * grouping identical addresses together on the hash chain. We also 3517 * don't want to send multiple copies out if there are two ills part 3518 * of the same group. Thus we group the ires with same addr and same 3519 * ill group together so that ip_wput_ire can easily skip all the 3520 * ires with same addr and same group after sending the first copy. 3521 * We do this only for IRE_BROADCASTs as ip_wput_ire is currently 3522 * interested in such groupings only for broadcasts. 3523 * 3524 * NOTE : If the interfaces are brought up first and then grouped, 3525 * illgrp_insert will handle it. We come here when the interfaces 3526 * are already in group and we are bringing them UP. 3527 * 3528 * Find the first entry that matches ire_addr. *irep will be null 3529 * if no match. 3530 */ 3531 irep = (ire_t **)irb_ptr; 3532 while ((ire1 = *irep) != NULL && ire->ire_addr != ire1->ire_addr) 3533 irep = &ire1->ire_next; 3534 if (ire->ire_type == IRE_BROADCAST && *irep != NULL) { 3535 /* 3536 * We found some ire (i.e *irep) with a matching addr. We 3537 * want to group ires with same addr and same ill group 3538 * together. 3539 * 3540 * First get to the entry that matches our address and 3541 * ill group i.e stop as soon as we find the first ire 3542 * matching the ill group and address. If there is only 3543 * an address match, we should walk and look for some 3544 * group match. These are some of the possible scenarios : 3545 * 3546 * 1) There are no groups at all i.e all ire's ill_group 3547 * are NULL. In that case we will essentially group 3548 * all the ires with the same addr together. Same as 3549 * the "else" block of this "if". 3550 * 3551 * 2) There are some groups and this ire's ill_group is 3552 * NULL. In this case, we will first find the group 3553 * that matches the address and a NULL group. Then 3554 * we will insert the ire at the end of that group. 3555 * 3556 * 3) There are some groups and this ires's ill_group is 3557 * non-NULL. In this case we will first find the group 3558 * that matches the address and the ill_group. Then 3559 * we will insert the ire at the end of that group. 3560 */ 3561 /* LINTED : constant in conditional context */ 3562 while (1) { 3563 ire1 = *irep; 3564 if ((ire1->ire_next == NULL) || 3565 (ire1->ire_next->ire_addr != ire->ire_addr) || 3566 (ire1->ire_type != IRE_BROADCAST) || 3567 (ire1->ire_ipif->ipif_ill->ill_group == 3568 ire->ire_ipif->ipif_ill->ill_group)) 3569 break; 3570 irep = &ire1->ire_next; 3571 } 3572 ASSERT(*irep != NULL); 3573 irep = &((*irep)->ire_next); 3574 3575 /* 3576 * Either we have hit the end of the list or the address 3577 * did not match or the group *matched*. If we found 3578 * a match on the group, skip to the end of the group. 3579 */ 3580 while (*irep != NULL) { 3581 ire1 = *irep; 3582 if ((ire1->ire_addr != ire->ire_addr) || 3583 (ire1->ire_type != IRE_BROADCAST) || 3584 (ire1->ire_ipif->ipif_ill->ill_group != 3585 ire->ire_ipif->ipif_ill->ill_group)) 3586 break; 3587 if (ire1->ire_ipif->ipif_ill->ill_group == NULL && 3588 ire1->ire_ipif == ire->ire_ipif) { 3589 irep = &ire1->ire_next; 3590 break; 3591 } 3592 irep = &ire1->ire_next; 3593 } 3594 } else if (*irep != NULL) { 3595 /* 3596 * Find the last ire which matches ire_addr. 3597 * Needed to do tail insertion among entries with the same 3598 * ire_addr. 3599 */ 3600 while (ire->ire_addr == ire1->ire_addr) { 3601 irep = &ire1->ire_next; 3602 ire1 = *irep; 3603 if (ire1 == NULL) 3604 break; 3605 } 3606 } 3607 3608 if (ire->ire_type == IRE_DEFAULT) { 3609 /* 3610 * We keep a count of default gateways which is used when 3611 * assigning them as routes. 3612 */ 3613 ip_ire_default_count++; 3614 ASSERT(ip_ire_default_count != 0); /* Wraparound */ 3615 } 3616 /* Insert at *irep */ 3617 ire1 = *irep; 3618 if (ire1 != NULL) 3619 ire1->ire_ptpn = &ire->ire_next; 3620 ire->ire_next = ire1; 3621 /* Link the new one in. */ 3622 ire->ire_ptpn = irep; 3623 3624 /* 3625 * ire_walk routines de-reference ire_next without holding 3626 * a lock. Before we point to the new ire, we want to make 3627 * sure the store that sets the ire_next of the new ire 3628 * reaches global visibility, so that ire_walk routines 3629 * don't see a truncated list of ires i.e if the ire_next 3630 * of the new ire gets set after we do "*irep = ire" due 3631 * to re-ordering, the ire_walk thread will see a NULL 3632 * once it accesses the ire_next of the new ire. 3633 * membar_producer() makes sure that the following store 3634 * happens *after* all of the above stores. 3635 */ 3636 membar_producer(); 3637 *irep = ire; 3638 ire->ire_bucket = irb_ptr; 3639 /* 3640 * We return a bumped up IRE above. Keep it symmetrical 3641 * so that the callers will always have to release. This 3642 * helps the callers of this function because they continue 3643 * to use the IRE after adding and hence they don't have to 3644 * lookup again after we return the IRE. 3645 * 3646 * NOTE : We don't have to use atomics as this is appearing 3647 * in the list for the first time and no one else can bump 3648 * up the reference count on this yet. 3649 */ 3650 IRE_REFHOLD_LOCKED(ire); 3651 BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted); 3652 irb_ptr->irb_ire_cnt++; 3653 if (ire->ire_marks & IRE_MARK_TEMPORARY) 3654 irb_ptr->irb_tmp_ire_cnt++; 3655 3656 if (ire->ire_ipif != NULL) { 3657 ire->ire_ipif->ipif_ire_cnt++; 3658 if (ire->ire_stq != NULL) { 3659 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 3660 stq_ill->ill_ire_cnt++; 3661 } 3662 } else { 3663 ASSERT(ire->ire_stq == NULL); 3664 } 3665 3666 ire_atomic_end(irb_ptr, ire); 3667 3668 if (pire != NULL) { 3669 /* Assert that it is not removed from the list yet */ 3670 ASSERT(pire->ire_ptpn != NULL); 3671 IRB_REFRELE(pire->ire_bucket); 3672 ire_refrele(pire); 3673 } 3674 3675 if (ire->ire_type != IRE_CACHE) { 3676 /* 3677 * For ire's with with host mask see if there is an entry 3678 * in the cache. If there is one flush the whole cache as 3679 * there might be multiple entries due to RTF_MULTIRT (CGTP). 3680 * If no entry is found than there is no need to flush the 3681 * cache. 3682 */ 3683 if (ire->ire_mask == IP_HOST_MASK) { 3684 ire_t *lire; 3685 lire = ire_ctable_lookup(ire->ire_addr, NULL, IRE_CACHE, 3686 NULL, ALL_ZONES, MATCH_IRE_TYPE); 3687 if (lire != NULL) { 3688 ire_refrele(lire); 3689 ire_flush_cache_v4(ire, IRE_FLUSH_ADD); 3690 } 3691 } else { 3692 ire_flush_cache_v4(ire, IRE_FLUSH_ADD); 3693 } 3694 } 3695 /* 3696 * We had to delay the fast path probe until the ire is inserted 3697 * in the list. Otherwise the fast path ack won't find the ire in 3698 * the table. 3699 */ 3700 if (ire->ire_type == IRE_CACHE || ire->ire_type == IRE_BROADCAST) 3701 ire_fastpath(ire); 3702 if (ire->ire_ipif != NULL) 3703 ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock)); 3704 *ire_p = ire; 3705 return (0); 3706 } 3707 3708 /* 3709 * Search for all HOST REDIRECT routes that are 3710 * pointing at the specified gateway and 3711 * delete them. This routine is called only 3712 * when a default gateway is going away. 3713 */ 3714 static void 3715 ire_delete_host_redirects(ipaddr_t gateway) 3716 { 3717 irb_t *irb_ptr; 3718 irb_t *irb; 3719 ire_t *ire; 3720 int i; 3721 3722 /* get the hash table for HOST routes */ 3723 irb_ptr = ip_forwarding_table[(IP_MASK_TABLE_SIZE - 1)]; 3724 if (irb_ptr == NULL) 3725 return; 3726 for (i = 0; (i < ip_ftable_hash_size); i++) { 3727 irb = &irb_ptr[i]; 3728 IRB_REFHOLD(irb); 3729 for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 3730 if (ire->ire_type != IRE_HOST_REDIRECT) 3731 continue; 3732 if (ire->ire_gateway_addr == gateway) { 3733 ire_delete(ire); 3734 } 3735 } 3736 IRB_REFRELE(irb); 3737 } 3738 } 3739 3740 /* 3741 * IRB_REFRELE is the only caller of the function. ire_unlink calls to 3742 * do the final cleanup for this ire. 3743 */ 3744 void 3745 ire_cleanup(ire_t *ire) 3746 { 3747 ire_t *ire_next; 3748 3749 ASSERT(ire != NULL); 3750 3751 while (ire != NULL) { 3752 ire_next = ire->ire_next; 3753 if (ire->ire_ipversion == IPV4_VERSION) { 3754 ire_delete_v4(ire); 3755 BUMP_IRE_STATS(ire_stats_v4, ire_stats_deleted); 3756 } else { 3757 ASSERT(ire->ire_ipversion == IPV6_VERSION); 3758 ire_delete_v6(ire); 3759 BUMP_IRE_STATS(ire_stats_v6, ire_stats_deleted); 3760 } 3761 /* 3762 * Now it's really out of the list. Before doing the 3763 * REFRELE, set ire_next to NULL as ire_inactive asserts 3764 * so. 3765 */ 3766 ire->ire_next = NULL; 3767 IRE_REFRELE_NOTR(ire); 3768 ire = ire_next; 3769 } 3770 } 3771 3772 /* 3773 * IRB_REFRELE is the only caller of the function. It calls to unlink 3774 * all the CONDEMNED ires from this bucket. 3775 */ 3776 ire_t * 3777 ire_unlink(irb_t *irb) 3778 { 3779 ire_t *ire; 3780 ire_t *ire1; 3781 ire_t **ptpn; 3782 ire_t *ire_list = NULL; 3783 3784 ASSERT(RW_WRITE_HELD(&irb->irb_lock)); 3785 ASSERT(irb->irb_refcnt == 0); 3786 ASSERT(irb->irb_marks & IRE_MARK_CONDEMNED); 3787 ASSERT(irb->irb_ire != NULL); 3788 3789 for (ire = irb->irb_ire; ire != NULL; ire = ire1) { 3790 ire1 = ire->ire_next; 3791 if (ire->ire_marks & IRE_MARK_CONDEMNED) { 3792 ptpn = ire->ire_ptpn; 3793 ire1 = ire->ire_next; 3794 if (ire1) 3795 ire1->ire_ptpn = ptpn; 3796 *ptpn = ire1; 3797 ire->ire_ptpn = NULL; 3798 ire->ire_next = NULL; 3799 if (ire->ire_type == IRE_DEFAULT) { 3800 /* 3801 * IRE is out of the list. We need to adjust 3802 * the accounting before the caller drops 3803 * the lock. 3804 */ 3805 if (ire->ire_ipversion == IPV6_VERSION) { 3806 ASSERT(ipv6_ire_default_count != 0); 3807 ipv6_ire_default_count--; 3808 } else { 3809 ASSERT(ip_ire_default_count != 0); 3810 ip_ire_default_count--; 3811 } 3812 } 3813 /* 3814 * We need to call ire_delete_v4 or ire_delete_v6 3815 * to clean up the cache or the redirects pointing at 3816 * the default gateway. We need to drop the lock 3817 * as ire_flush_cache/ire_delete_host_redircts require 3818 * so. But we can't drop the lock, as ire_unlink needs 3819 * to atomically remove the ires from the list. 3820 * So, create a temporary list of CONDEMNED ires 3821 * for doing ire_delete_v4/ire_delete_v6 operations 3822 * later on. 3823 */ 3824 ire->ire_next = ire_list; 3825 ire_list = ire; 3826 } 3827 } 3828 ASSERT(irb->irb_refcnt == 0); 3829 irb->irb_marks &= ~IRE_MARK_CONDEMNED; 3830 ASSERT(ire_list != NULL); 3831 return (ire_list); 3832 } 3833 3834 /* 3835 * Delete all the cache entries with this 'addr'. When IP gets a gratuitous 3836 * ARP message on any of its interface queue, it scans the cache table and 3837 * deletes all the cache entries for that address. This function is called 3838 * from ip_arp_news in ip.c and also for ARP ioctl processing in ip_if.c. 3839 * ip_ire_clookup_and_delete returns true if it finds at least one cache entry 3840 * which is used by ip_arp_news to determine if it needs to do an ire_walk_v4. 3841 * The return value is also used for the same purpose by ARP IOCTL processing 3842 * in ip_if.c when deleting ARP entries. For SIOC*IFARP ioctls in addition to 3843 * the address, ip_if->ipif_ill also needs to be matched. 3844 */ 3845 boolean_t 3846 ip_ire_clookup_and_delete(ipaddr_t addr, ipif_t *ipif) 3847 { 3848 irb_t *irb; 3849 ire_t *cire; 3850 ill_t *ill; 3851 boolean_t found = B_FALSE, loop_end = B_FALSE; 3852 3853 irb = &ip_cache_table[IRE_ADDR_HASH(addr, ip_cache_table_size)]; 3854 IRB_REFHOLD(irb); 3855 for (cire = irb->irb_ire; cire != NULL; cire = cire->ire_next) { 3856 if (cire->ire_marks & IRE_MARK_CONDEMNED) 3857 continue; 3858 if (cire->ire_addr == addr) { 3859 3860 /* This signifies start of an address match */ 3861 if (!loop_end) 3862 loop_end = B_TRUE; 3863 3864 /* We are interested only in IRE_CACHEs */ 3865 if (cire->ire_type == IRE_CACHE) { 3866 /* If we want a match with the ILL */ 3867 if (ipif != NULL && 3868 ((ill = ire_to_ill(cire)) == NULL || 3869 ill != ipif->ipif_ill)) { 3870 continue; 3871 } 3872 if (!found) 3873 found = B_TRUE; 3874 ire_delete(cire); 3875 } 3876 /* End of the match */ 3877 } else if (loop_end) 3878 break; 3879 } 3880 IRB_REFRELE(irb); 3881 3882 return (found); 3883 3884 } 3885 3886 /* 3887 * Delete the specified IRE. 3888 */ 3889 void 3890 ire_delete(ire_t *ire) 3891 { 3892 ire_t *ire1; 3893 ire_t **ptpn; 3894 irb_t *irb; 3895 3896 /* 3897 * It was never inserted in the list. Should call REFRELE 3898 * to free this IRE. 3899 */ 3900 if ((irb = ire->ire_bucket) == NULL) { 3901 IRE_REFRELE_NOTR(ire); 3902 return; 3903 } 3904 3905 rw_enter(&irb->irb_lock, RW_WRITER); 3906 3907 /* 3908 * In case of V4 we might still be waiting for fastpath ack. 3909 */ 3910 if (ire->ire_nce == NULL && ire->ire_stq != NULL) { 3911 ill_t *ill; 3912 3913 ill = ire_to_ill(ire); 3914 if (ill != NULL) 3915 ire_fastpath_list_delete(ill, ire); 3916 } 3917 3918 if (ire->ire_ptpn == NULL) { 3919 /* 3920 * Some other thread has removed us from the list. 3921 * It should have done the REFRELE for us. 3922 */ 3923 rw_exit(&irb->irb_lock); 3924 return; 3925 } 3926 3927 if (irb->irb_refcnt != 0) { 3928 /* 3929 * The last thread to leave this bucket will 3930 * delete this ire. 3931 */ 3932 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 3933 irb->irb_ire_cnt--; 3934 if (ire->ire_marks & IRE_MARK_TEMPORARY) 3935 irb->irb_tmp_ire_cnt--; 3936 ire->ire_marks |= IRE_MARK_CONDEMNED; 3937 } 3938 irb->irb_marks |= IRE_MARK_CONDEMNED; 3939 rw_exit(&irb->irb_lock); 3940 return; 3941 } 3942 3943 /* 3944 * Normally to delete an ire, we walk the bucket. While we 3945 * walk the bucket, we normally bump up irb_refcnt and hence 3946 * we return from above where we mark CONDEMNED and the ire 3947 * gets deleted from ire_unlink. This case is where somebody 3948 * knows the ire e.g by doing a lookup, and wants to delete the 3949 * IRE. irb_refcnt would be 0 in this case if nobody is walking 3950 * the bucket. 3951 */ 3952 ptpn = ire->ire_ptpn; 3953 ire1 = ire->ire_next; 3954 if (ire1 != NULL) 3955 ire1->ire_ptpn = ptpn; 3956 ASSERT(ptpn != NULL); 3957 *ptpn = ire1; 3958 ire->ire_ptpn = NULL; 3959 ire->ire_next = NULL; 3960 if (ire->ire_ipversion == IPV6_VERSION) { 3961 BUMP_IRE_STATS(ire_stats_v6, ire_stats_deleted); 3962 } else { 3963 BUMP_IRE_STATS(ire_stats_v4, ire_stats_deleted); 3964 } 3965 /* 3966 * ip_wput/ip_wput_v6 checks this flag to see whether 3967 * it should still use the cached ire or not. 3968 */ 3969 ire->ire_marks |= IRE_MARK_CONDEMNED; 3970 if (ire->ire_type == IRE_DEFAULT) { 3971 /* 3972 * IRE is out of the list. We need to adjust the 3973 * accounting before we drop the lock. 3974 */ 3975 if (ire->ire_ipversion == IPV6_VERSION) { 3976 ASSERT(ipv6_ire_default_count != 0); 3977 ipv6_ire_default_count--; 3978 } else { 3979 ASSERT(ip_ire_default_count != 0); 3980 ip_ire_default_count--; 3981 } 3982 } 3983 irb->irb_ire_cnt--; 3984 if (ire->ire_marks & IRE_MARK_TEMPORARY) 3985 irb->irb_tmp_ire_cnt--; 3986 rw_exit(&irb->irb_lock); 3987 3988 if (ire->ire_ipversion == IPV6_VERSION) { 3989 ire_delete_v6(ire); 3990 } else { 3991 ire_delete_v4(ire); 3992 } 3993 /* 3994 * We removed it from the list. Decrement the 3995 * reference count. 3996 */ 3997 IRE_REFRELE_NOTR(ire); 3998 } 3999 4000 /* 4001 * Delete the specified IRE. 4002 * All calls should use ire_delete(). 4003 * Sometimes called as writer though not required by this function. 4004 * 4005 * NOTE : This function is called only if the ire was added 4006 * in the list. 4007 */ 4008 static void 4009 ire_delete_v4(ire_t *ire) 4010 { 4011 ASSERT(ire->ire_refcnt >= 1); 4012 ASSERT(ire->ire_ipversion == IPV4_VERSION); 4013 4014 if (ire->ire_type != IRE_CACHE) 4015 ire_flush_cache_v4(ire, IRE_FLUSH_DELETE); 4016 if (ire->ire_type == IRE_DEFAULT) { 4017 /* 4018 * when a default gateway is going away 4019 * delete all the host redirects pointing at that 4020 * gateway. 4021 */ 4022 ire_delete_host_redirects(ire->ire_gateway_addr); 4023 } 4024 } 4025 4026 /* 4027 * IRE_REFRELE/ire_refrele are the only caller of the function. It calls 4028 * to free the ire when the reference count goes to zero. 4029 */ 4030 void 4031 ire_inactive(ire_t *ire) 4032 { 4033 mblk_t *mp; 4034 nce_t *nce; 4035 ill_t *ill = NULL; 4036 ill_t *stq_ill = NULL; 4037 ill_t *in_ill = NULL; 4038 ipif_t *ipif; 4039 boolean_t need_wakeup = B_FALSE; 4040 4041 ASSERT(ire->ire_refcnt == 0); 4042 ASSERT(ire->ire_ptpn == NULL); 4043 ASSERT(ire->ire_next == NULL); 4044 4045 if ((nce = ire->ire_nce) != NULL) { 4046 /* Only IPv6 IRE_CACHE type has an nce */ 4047 ASSERT(ire->ire_type == IRE_CACHE); 4048 ASSERT(ire->ire_ipversion == IPV6_VERSION); 4049 NCE_REFRELE_NOTR(nce); 4050 ire->ire_nce = NULL; 4051 } 4052 if (ire->ire_ipif == NULL) 4053 goto end; 4054 4055 ipif = ire->ire_ipif; 4056 ill = ipif->ipif_ill; 4057 4058 if (ire->ire_bucket == NULL) { 4059 /* The ire was never inserted in the table. */ 4060 goto end; 4061 } 4062 4063 /* 4064 * ipif_ire_cnt on this ipif goes down by 1. If the ire_stq is 4065 * non-null ill_ire_count also goes down by 1. If the in_ill is 4066 * non-null either ill_mrtun_refcnt or ill_srcif_refcnt goes down by 1. 4067 * 4068 * The ipif that is associated with an ire is ire->ire_ipif and 4069 * hence when the ire->ire_ipif->ipif_ire_cnt drops to zero we call 4070 * ipif_ill_refrele_tail. Usually stq_ill is null or the same as 4071 * ire->ire_ipif->ipif_ill. So nothing more needs to be done. Only 4072 * in the case of IRE_CACHES when IPMP is used, stq_ill can be 4073 * different. If this is different from ire->ire_ipif->ipif_ill and 4074 * if the ill_ire_cnt on the stq_ill also has dropped to zero, we call 4075 * ipif_ill_refrele_tail on the stq_ill. If mobile ip is in use 4076 * in_ill could be non-null. If it is a reverse tunnel related ire 4077 * ill_mrtun_refcnt is non-zero. If it is forward tunnel related ire 4078 * ill_srcif_refcnt is non-null. 4079 */ 4080 4081 if (ire->ire_stq != NULL) 4082 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 4083 if (ire->ire_in_ill != NULL) 4084 in_ill = ire->ire_in_ill; 4085 4086 if ((stq_ill == NULL || stq_ill == ill) && (in_ill == NULL)) { 4087 /* Optimize the most common case */ 4088 mutex_enter(&ill->ill_lock); 4089 ASSERT(ipif->ipif_ire_cnt != 0); 4090 ipif->ipif_ire_cnt--; 4091 if (ipif->ipif_ire_cnt == 0) 4092 need_wakeup = B_TRUE; 4093 if (stq_ill != NULL) { 4094 ASSERT(stq_ill->ill_ire_cnt != 0); 4095 stq_ill->ill_ire_cnt--; 4096 if (stq_ill->ill_ire_cnt == 0) 4097 need_wakeup = B_TRUE; 4098 } 4099 if (need_wakeup) { 4100 /* Drops the ill lock */ 4101 ipif_ill_refrele_tail(ill); 4102 } else { 4103 mutex_exit(&ill->ill_lock); 4104 } 4105 } else { 4106 /* 4107 * We can't grab all the ill locks at the same time. 4108 * It can lead to recursive lock enter in the call to 4109 * ipif_ill_refrele_tail and later. Instead do it 1 at 4110 * a time. 4111 */ 4112 mutex_enter(&ill->ill_lock); 4113 ASSERT(ipif->ipif_ire_cnt != 0); 4114 ipif->ipif_ire_cnt--; 4115 if (ipif->ipif_ire_cnt == 0) { 4116 /* Drops the lock */ 4117 ipif_ill_refrele_tail(ill); 4118 } else { 4119 mutex_exit(&ill->ill_lock); 4120 } 4121 if (stq_ill != NULL) { 4122 mutex_enter(&stq_ill->ill_lock); 4123 ASSERT(stq_ill->ill_ire_cnt != 0); 4124 stq_ill->ill_ire_cnt--; 4125 if (stq_ill->ill_ire_cnt == 0) { 4126 /* Drops the ill lock */ 4127 ipif_ill_refrele_tail(stq_ill); 4128 } else { 4129 mutex_exit(&stq_ill->ill_lock); 4130 } 4131 } 4132 if (in_ill != NULL) { 4133 mutex_enter(&in_ill->ill_lock); 4134 if (ire->ire_type == IRE_MIPRTUN) { 4135 /* 4136 * Mobile IP reverse tunnel ire. 4137 * Decrement table count and the 4138 * ill reference count. This signifies 4139 * mipagent is deleting reverse tunnel 4140 * route for a particular mobile node. 4141 */ 4142 mutex_enter(&ire_mrtun_lock); 4143 ire_mrtun_count--; 4144 mutex_exit(&ire_mrtun_lock); 4145 ASSERT(in_ill->ill_mrtun_refcnt != 0); 4146 in_ill->ill_mrtun_refcnt--; 4147 if (in_ill->ill_mrtun_refcnt == 0) { 4148 /* Drops the ill lock */ 4149 ipif_ill_refrele_tail(in_ill); 4150 } else { 4151 mutex_exit(&in_ill->ill_lock); 4152 } 4153 } else { 4154 mutex_enter(&ire_srcif_table_lock); 4155 ire_srcif_table_count--; 4156 mutex_exit(&ire_srcif_table_lock); 4157 ASSERT(in_ill->ill_srcif_refcnt != 0); 4158 in_ill->ill_srcif_refcnt--; 4159 if (in_ill->ill_srcif_refcnt == 0) { 4160 /* Drops the ill lock */ 4161 ipif_ill_refrele_tail(in_ill); 4162 } else { 4163 mutex_exit(&in_ill->ill_lock); 4164 } 4165 } 4166 } 4167 } 4168 end: 4169 /* This should be true for both V4 and V6 */ 4170 ASSERT(ire->ire_fastpath == NULL); 4171 4172 4173 ire->ire_ipif = NULL; 4174 4175 /* Free the xmit header, and the IRE itself. */ 4176 if ((mp = ire->ire_dlureq_mp) != NULL) { 4177 freeb(mp); 4178 ire->ire_dlureq_mp = NULL; 4179 } 4180 4181 if ((mp = ire->ire_fp_mp) != NULL) { 4182 freeb(mp); 4183 ire->ire_fp_mp = NULL; 4184 } 4185 4186 if (ire->ire_in_ill != NULL) { 4187 ire->ire_in_ill = NULL; 4188 } 4189 4190 #ifdef IRE_DEBUG 4191 ire_trace_inactive(ire); 4192 #endif 4193 mutex_destroy(&ire->ire_lock); 4194 if (ire->ire_ipversion == IPV6_VERSION) { 4195 BUMP_IRE_STATS(ire_stats_v6, ire_stats_freed); 4196 } else { 4197 BUMP_IRE_STATS(ire_stats_v4, ire_stats_freed); 4198 } 4199 if (ire->ire_mp != NULL) { 4200 /* Still in an mblk */ 4201 freeb(ire->ire_mp); 4202 } else { 4203 /* Has been allocated out of the cache */ 4204 kmem_cache_free(ire_cache, ire); 4205 } 4206 } 4207 4208 /* 4209 * ire_walk routine to delete all IRE_CACHE/IRE_HOST_REDIRECT entries 4210 * that have a given gateway address. 4211 */ 4212 void 4213 ire_delete_cache_gw(ire_t *ire, char *cp) 4214 { 4215 ipaddr_t gw_addr; 4216 4217 if (!(ire->ire_type & (IRE_CACHE|IRE_HOST_REDIRECT))) 4218 return; 4219 4220 bcopy(cp, &gw_addr, sizeof (gw_addr)); 4221 if (ire->ire_gateway_addr == gw_addr) { 4222 ip1dbg(("ire_delete_cache_gw: deleted 0x%x type %d to 0x%x\n", 4223 (int)ntohl(ire->ire_addr), ire->ire_type, 4224 (int)ntohl(ire->ire_gateway_addr))); 4225 ire_delete(ire); 4226 } 4227 } 4228 4229 /* 4230 * Remove all IRE_CACHE entries that match the ire specified. 4231 * 4232 * The flag argument indicates if the flush request is due to addition 4233 * of new route (IRE_FLUSH_ADD) or deletion of old route (IRE_FLUSH_DELETE). 4234 * 4235 * This routine takes only the IREs from the forwarding table and flushes 4236 * the corresponding entries from the cache table. 4237 * 4238 * When flushing due to the deletion of an old route, it 4239 * just checks the cache handles (ire_phandle and ire_ihandle) and 4240 * deletes the ones that match. 4241 * 4242 * When flushing due to the creation of a new route, it checks 4243 * if a cache entry's address matches the one in the IRE and 4244 * that the cache entry's parent has a less specific mask than the 4245 * one in IRE. The destination of such a cache entry could be the 4246 * gateway for other cache entries, so we need to flush those as 4247 * well by looking for gateway addresses matching the IRE's address. 4248 */ 4249 void 4250 ire_flush_cache_v4(ire_t *ire, int flag) 4251 { 4252 int i; 4253 ire_t *cire; 4254 irb_t *irb; 4255 4256 if (ire->ire_type & IRE_CACHE) 4257 return; 4258 4259 /* 4260 * If a default is just created, there is no point 4261 * in going through the cache, as there will not be any 4262 * cached ires. 4263 */ 4264 if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD) 4265 return; 4266 if (flag == IRE_FLUSH_ADD) { 4267 /* 4268 * This selective flush is due to the addition of 4269 * new IRE. 4270 */ 4271 for (i = 0; i < ip_cache_table_size; i++) { 4272 irb = &ip_cache_table[i]; 4273 if ((cire = irb->irb_ire) == NULL) 4274 continue; 4275 IRB_REFHOLD(irb); 4276 for (cire = irb->irb_ire; cire != NULL; 4277 cire = cire->ire_next) { 4278 if (cire->ire_type != IRE_CACHE) 4279 continue; 4280 /* 4281 * If 'cire' belongs to the same subnet 4282 * as the new ire being added, and 'cire' 4283 * is derived from a prefix that is less 4284 * specific than the new ire being added, 4285 * we need to flush 'cire'; for instance, 4286 * when a new interface comes up. 4287 */ 4288 if (((cire->ire_addr & ire->ire_mask) == 4289 (ire->ire_addr & ire->ire_mask)) && 4290 (ip_mask_to_plen(cire->ire_cmask) <= 4291 ire->ire_masklen)) { 4292 ire_delete(cire); 4293 continue; 4294 } 4295 /* 4296 * This is the case when the ire_gateway_addr 4297 * of 'cire' belongs to the same subnet as 4298 * the new ire being added. 4299 * Flushing such ires is sometimes required to 4300 * avoid misrouting: say we have a machine with 4301 * two interfaces (I1 and I2), a default router 4302 * R on the I1 subnet, and a host route to an 4303 * off-link destination D with a gateway G on 4304 * the I2 subnet. 4305 * Under normal operation, we will have an 4306 * on-link cache entry for G and an off-link 4307 * cache entry for D with G as ire_gateway_addr, 4308 * traffic to D will reach its destination 4309 * through gateway G. 4310 * If the administrator does 'ifconfig I2 down', 4311 * the cache entries for D and G will be 4312 * flushed. However, G will now be resolved as 4313 * an off-link destination using R (the default 4314 * router) as gateway. Then D will also be 4315 * resolved as an off-link destination using G 4316 * as gateway - this behavior is due to 4317 * compatibility reasons, see comment in 4318 * ire_ihandle_lookup_offlink(). Traffic to D 4319 * will go to the router R and probably won't 4320 * reach the destination. 4321 * The administrator then does 'ifconfig I2 up'. 4322 * Since G is on the I2 subnet, this routine 4323 * will flush its cache entry. It must also 4324 * flush the cache entry for D, otherwise 4325 * traffic will stay misrouted until the IRE 4326 * times out. 4327 */ 4328 if ((cire->ire_gateway_addr & ire->ire_mask) == 4329 (ire->ire_addr & ire->ire_mask)) { 4330 ire_delete(cire); 4331 continue; 4332 } 4333 } 4334 IRB_REFRELE(irb); 4335 } 4336 } else { 4337 /* 4338 * delete the cache entries based on 4339 * handle in the IRE as this IRE is 4340 * being deleted/changed. 4341 */ 4342 for (i = 0; i < ip_cache_table_size; i++) { 4343 irb = &ip_cache_table[i]; 4344 if ((cire = irb->irb_ire) == NULL) 4345 continue; 4346 IRB_REFHOLD(irb); 4347 for (cire = irb->irb_ire; cire != NULL; 4348 cire = cire->ire_next) { 4349 if (cire->ire_type != IRE_CACHE) 4350 continue; 4351 if ((cire->ire_phandle == 0 || 4352 cire->ire_phandle != ire->ire_phandle) && 4353 (cire->ire_ihandle == 0 || 4354 cire->ire_ihandle != ire->ire_ihandle)) 4355 continue; 4356 ire_delete(cire); 4357 } 4358 IRB_REFRELE(irb); 4359 } 4360 } 4361 } 4362 4363 /* 4364 * Matches the arguments passed with the values in the ire. 4365 * 4366 * Note: for match types that match using "ipif" passed in, ipif 4367 * must be checked for non-NULL before calling this routine. 4368 */ 4369 static boolean_t 4370 ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 4371 int type, ipif_t *ipif, zoneid_t zoneid, uint32_t ihandle, int match_flags) 4372 { 4373 ill_t *ire_ill = NULL, *dst_ill; 4374 ill_t *ipif_ill = NULL; 4375 ill_group_t *ire_ill_group = NULL; 4376 ill_group_t *ipif_ill_group = NULL; 4377 4378 ASSERT(ire->ire_ipversion == IPV4_VERSION); 4379 ASSERT((ire->ire_addr & ~ire->ire_mask) == 0); 4380 ASSERT((!(match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP))) || 4381 (ipif != NULL && !ipif->ipif_isv6)); 4382 ASSERT(!(match_flags & MATCH_IRE_WQ)); 4383 4384 /* 4385 * HIDDEN cache entries have to be looked up specifically with 4386 * MATCH_IRE_MARK_HIDDEN. MATCH_IRE_MARK_HIDDEN is usually set 4387 * when the interface is FAILED or INACTIVE. In that case, 4388 * any IRE_CACHES that exists should be marked with 4389 * IRE_MARK_HIDDEN. So, we don't really need to match below 4390 * for IRE_MARK_HIDDEN. But we do so for consistency. 4391 */ 4392 if (!(match_flags & MATCH_IRE_MARK_HIDDEN) && 4393 (ire->ire_marks & IRE_MARK_HIDDEN)) 4394 return (B_FALSE); 4395 4396 if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid) { 4397 /* 4398 * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid is 4399 * valid and does not match that of ire_zoneid, a failure to 4400 * match is reported at this point. Otherwise, since some IREs 4401 * that are available in the global zone can be used in local 4402 * zones, additional checks need to be performed: 4403 * 4404 * IRE_BROADCAST, IRE_CACHE and IRE_LOOPBACK 4405 * entries should never be matched in this situation. 4406 * 4407 * IRE entries that have an interface associated with them 4408 * should in general not match unless they are an IRE_LOCAL 4409 * or in the case when MATCH_IRE_DEFAULT has been set in 4410 * the caller. In the case of the former, checking of the 4411 * other fields supplied should take place. 4412 * 4413 * In the case where MATCH_IRE_DEFAULT has been set, 4414 * all of the ipif's associated with the IRE's ill are 4415 * checked to see if there is a matching zoneid. If any 4416 * one ipif has a matching zoneid, this IRE is a 4417 * potential candidate so checking of the other fields 4418 * takes place. 4419 * 4420 * In the case where the IRE_INTERFACE has a usable source 4421 * address (indicated by ill_usesrc_ifindex) in the 4422 * correct zone then it's permitted to return this IRE 4423 */ 4424 if (match_flags & MATCH_IRE_ZONEONLY) 4425 return (B_FALSE); 4426 if (ire->ire_type & (IRE_BROADCAST | IRE_CACHE | IRE_LOOPBACK)) 4427 return (B_FALSE); 4428 /* 4429 * Note, IRE_INTERFACE can have the stq as NULL. For 4430 * example, if the default multicast route is tied to 4431 * the loopback address. 4432 */ 4433 if ((ire->ire_type & IRE_INTERFACE) && 4434 (ire->ire_stq != NULL)) { 4435 dst_ill = (ill_t *)ire->ire_stq->q_ptr; 4436 /* 4437 * If there is a usable source address in the 4438 * zone, then it's ok to return an 4439 * IRE_INTERFACE 4440 */ 4441 if (ipif_usesrc_avail(dst_ill, zoneid)) { 4442 ip3dbg(("ire_match_args: dst_ill %p match %d\n", 4443 (void *)dst_ill, 4444 (ire->ire_addr == (addr & mask)))); 4445 } else { 4446 ip3dbg(("ire_match_args: src_ipif NULL" 4447 " dst_ill %p\n", (void *)dst_ill)); 4448 return (B_FALSE); 4449 } 4450 } 4451 if (ire->ire_ipif != NULL && ire->ire_type != IRE_LOCAL && 4452 !(ire->ire_type & IRE_INTERFACE)) { 4453 ipif_t *tipif; 4454 4455 if ((match_flags & MATCH_IRE_DEFAULT) == 0) { 4456 return (B_FALSE); 4457 } 4458 mutex_enter(&ire->ire_ipif->ipif_ill->ill_lock); 4459 for (tipif = ire->ire_ipif->ipif_ill->ill_ipif; 4460 tipif != NULL; tipif = tipif->ipif_next) { 4461 if (IPIF_CAN_LOOKUP(tipif) && 4462 (tipif->ipif_flags & IPIF_UP) && 4463 (tipif->ipif_zoneid == zoneid)) 4464 break; 4465 } 4466 mutex_exit(&ire->ire_ipif->ipif_ill->ill_lock); 4467 if (tipif == NULL) { 4468 return (B_FALSE); 4469 } 4470 } 4471 } 4472 4473 /* 4474 * For IRE_CACHES, MATCH_IRE_ILL/ILL_GROUP really means that 4475 * somebody wants to send out on a particular interface which 4476 * is given by ire_stq and hence use ire_stq to derive the ill 4477 * value. ire_ipif for IRE_CACHES is just the means of getting 4478 * a source address i.e ire_src_addr = ire->ire_ipif->ipif_src_addr. 4479 * ire_to_ill does the right thing for this. 4480 */ 4481 if (match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) { 4482 ire_ill = ire_to_ill(ire); 4483 if (ire_ill != NULL) 4484 ire_ill_group = ire_ill->ill_group; 4485 ipif_ill = ipif->ipif_ill; 4486 ipif_ill_group = ipif_ill->ill_group; 4487 } 4488 4489 if ((ire->ire_addr == (addr & mask)) && 4490 ((!(match_flags & MATCH_IRE_GW)) || 4491 (ire->ire_gateway_addr == gateway)) && 4492 ((!(match_flags & MATCH_IRE_TYPE)) || 4493 (ire->ire_type & type)) && 4494 ((!(match_flags & MATCH_IRE_SRC)) || 4495 (ire->ire_src_addr == ipif->ipif_src_addr)) && 4496 ((!(match_flags & MATCH_IRE_IPIF)) || 4497 (ire->ire_ipif == ipif)) && 4498 ((!(match_flags & MATCH_IRE_MARK_HIDDEN)) || 4499 (ire->ire_type != IRE_CACHE || 4500 ire->ire_marks & IRE_MARK_HIDDEN)) && 4501 ((!(match_flags & MATCH_IRE_ILL)) || 4502 (ire_ill == ipif_ill)) && 4503 ((!(match_flags & MATCH_IRE_IHANDLE)) || 4504 (ire->ire_ihandle == ihandle)) && 4505 ((!(match_flags & MATCH_IRE_ILL_GROUP)) || 4506 (ire_ill == ipif_ill) || 4507 (ire_ill_group != NULL && 4508 ire_ill_group == ipif_ill_group))) { 4509 /* We found the matched IRE */ 4510 return (B_TRUE); 4511 } 4512 return (B_FALSE); 4513 } 4514 4515 4516 /* 4517 * Lookup for a route in all the tables 4518 */ 4519 ire_t * 4520 ire_route_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 4521 int type, ipif_t *ipif, ire_t **pire, zoneid_t zoneid, int flags) 4522 { 4523 ire_t *ire = NULL; 4524 4525 /* 4526 * ire_match_args() will dereference ipif MATCH_IRE_SRC or 4527 * MATCH_IRE_ILL is set. 4528 */ 4529 if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) && 4530 (ipif == NULL)) 4531 return (NULL); 4532 4533 /* 4534 * might be asking for a cache lookup, 4535 * This is not best way to lookup cache, 4536 * user should call ire_cache_lookup directly. 4537 * 4538 * If MATCH_IRE_TYPE was set, first lookup in the cache table and then 4539 * in the forwarding table, if the applicable type flags were set. 4540 */ 4541 if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_CACHETABLE) != 0) { 4542 ire = ire_ctable_lookup(addr, gateway, type, ipif, zoneid, 4543 flags); 4544 if (ire != NULL) 4545 return (ire); 4546 } 4547 if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_FORWARDTABLE) != 0) { 4548 ire = ire_ftable_lookup(addr, mask, gateway, type, ipif, pire, 4549 zoneid, 0, flags); 4550 } 4551 return (ire); 4552 } 4553 4554 /* 4555 * Lookup a route in forwarding table. 4556 * specific lookup is indicated by passing the 4557 * required parameters and indicating the 4558 * match required in flag field. 4559 * 4560 * Looking for default route can be done in three ways 4561 * 1) pass mask as 0 and set MATCH_IRE_MASK in flags field 4562 * along with other matches. 4563 * 2) pass type as IRE_DEFAULT and set MATCH_IRE_TYPE in flags 4564 * field along with other matches. 4565 * 3) if the destination and mask are passed as zeros. 4566 * 4567 * A request to return a default route if no route 4568 * is found, can be specified by setting MATCH_IRE_DEFAULT 4569 * in flags. 4570 * 4571 * It does not support recursion more than one level. It 4572 * will do recursive lookup only when the lookup maps to 4573 * a prefix or default route and MATCH_IRE_RECURSIVE flag is passed. 4574 * 4575 * If the routing table is setup to allow more than one level 4576 * of recursion, the cleaning up cache table will not work resulting 4577 * in invalid routing. 4578 * 4579 * Supports IP_BOUND_IF by following the ipif/ill when recursing. 4580 * 4581 * NOTE : When this function returns NULL, pire has already been released. 4582 * pire is valid only when this function successfully returns an 4583 * ire. 4584 */ 4585 ire_t * 4586 ire_ftable_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 4587 int type, ipif_t *ipif, ire_t **pire, zoneid_t zoneid, uint32_t ihandle, 4588 int flags) 4589 { 4590 irb_t *irb_ptr; 4591 ire_t *ire = NULL; 4592 int i; 4593 ipaddr_t gw_addr; 4594 4595 ASSERT(ipif == NULL || !ipif->ipif_isv6); 4596 ASSERT(!(flags & MATCH_IRE_WQ)); 4597 4598 /* 4599 * When we return NULL from this function, we should make 4600 * sure that *pire is NULL so that the callers will not 4601 * wrongly REFRELE the pire. 4602 */ 4603 if (pire != NULL) 4604 *pire = NULL; 4605 /* 4606 * ire_match_args() will dereference ipif MATCH_IRE_SRC or 4607 * MATCH_IRE_ILL is set. 4608 */ 4609 if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) && 4610 (ipif == NULL)) 4611 return (NULL); 4612 4613 /* 4614 * If the mask is known, the lookup 4615 * is simple, if the mask is not known 4616 * we need to search. 4617 */ 4618 if (flags & MATCH_IRE_MASK) { 4619 uint_t masklen; 4620 4621 masklen = ip_mask_to_plen(mask); 4622 if (ip_forwarding_table[masklen] == NULL) 4623 return (NULL); 4624 irb_ptr = &(ip_forwarding_table[masklen][ 4625 IRE_ADDR_HASH(addr & mask, ip_ftable_hash_size)]); 4626 rw_enter(&irb_ptr->irb_lock, RW_READER); 4627 for (ire = irb_ptr->irb_ire; ire != NULL; 4628 ire = ire->ire_next) { 4629 if (ire->ire_marks & IRE_MARK_CONDEMNED) 4630 continue; 4631 if (ire_match_args(ire, addr, mask, gateway, type, ipif, 4632 zoneid, ihandle, flags)) 4633 goto found_ire; 4634 } 4635 rw_exit(&irb_ptr->irb_lock); 4636 } else { 4637 /* 4638 * In this case we don't know the mask, we need to 4639 * search the table assuming different mask sizes. 4640 * we start with 32 bit mask, we don't allow default here. 4641 */ 4642 for (i = (IP_MASK_TABLE_SIZE - 1); i > 0; i--) { 4643 ipaddr_t tmpmask; 4644 4645 if ((ip_forwarding_table[i]) == NULL) 4646 continue; 4647 tmpmask = ip_plen_to_mask(i); 4648 irb_ptr = &ip_forwarding_table[i][ 4649 IRE_ADDR_HASH(addr & tmpmask, 4650 ip_ftable_hash_size)]; 4651 rw_enter(&irb_ptr->irb_lock, RW_READER); 4652 for (ire = irb_ptr->irb_ire; ire != NULL; 4653 ire = ire->ire_next) { 4654 if (ire->ire_marks & IRE_MARK_CONDEMNED) 4655 continue; 4656 if (ire_match_args(ire, addr, ire->ire_mask, 4657 gateway, type, ipif, zoneid, ihandle, 4658 flags)) 4659 goto found_ire; 4660 } 4661 rw_exit(&irb_ptr->irb_lock); 4662 } 4663 } 4664 /* 4665 * We come here if no route has yet been found. 4666 * 4667 * Handle the case where default route is 4668 * requested by specifying type as one of the possible 4669 * types for that can have a zero mask (IRE_DEFAULT and IRE_INTERFACE). 4670 * 4671 * If MATCH_IRE_MASK is specified, then the appropriate default route 4672 * would have been found above if it exists so it isn't looked up here. 4673 * If MATCH_IRE_DEFAULT was also specified, then a default route will be 4674 * searched for later. 4675 */ 4676 if ((flags & (MATCH_IRE_TYPE | MATCH_IRE_MASK)) == MATCH_IRE_TYPE && 4677 (type & (IRE_DEFAULT | IRE_INTERFACE))) { 4678 if ((ip_forwarding_table[0])) { 4679 /* addr & mask is zero for defaults */ 4680 irb_ptr = &ip_forwarding_table[0][ 4681 IRE_ADDR_HASH(0, ip_ftable_hash_size)]; 4682 rw_enter(&irb_ptr->irb_lock, RW_READER); 4683 for (ire = irb_ptr->irb_ire; ire != NULL; 4684 ire = ire->ire_next) { 4685 if (ire->ire_marks & IRE_MARK_CONDEMNED) 4686 continue; 4687 if (ire_match_args(ire, addr, (ipaddr_t)0, 4688 gateway, type, ipif, zoneid, ihandle, 4689 flags)) 4690 goto found_ire; 4691 } 4692 rw_exit(&irb_ptr->irb_lock); 4693 } 4694 } 4695 /* 4696 * we come here only if no route is found. 4697 * see if the default route can be used which is allowed 4698 * only if the default matching criteria is specified. 4699 * The ip_ire_default_count tracks the number of IRE_DEFAULT 4700 * entries. However, the ip_forwarding_table[0] also contains 4701 * interface routes thus the count can be zero. 4702 */ 4703 if ((flags & (MATCH_IRE_DEFAULT | MATCH_IRE_MASK)) == 4704 MATCH_IRE_DEFAULT) { 4705 ire_t *ire_origin; 4706 uint_t g_index; 4707 uint_t index; 4708 4709 if (ip_forwarding_table[0] == NULL) 4710 return (NULL); 4711 irb_ptr = &(ip_forwarding_table[0])[0]; 4712 4713 /* 4714 * Keep a tab on the bucket while looking the IRE_DEFAULT 4715 * entries. We need to keep track of a particular IRE 4716 * (ire_origin) so this ensures that it will not be unlinked 4717 * from the hash list during the recursive lookup below. 4718 */ 4719 IRB_REFHOLD(irb_ptr); 4720 ire = irb_ptr->irb_ire; 4721 if (ire == NULL) { 4722 IRB_REFRELE(irb_ptr); 4723 return (NULL); 4724 } 4725 4726 /* 4727 * Get the index first, since it can be changed by other 4728 * threads. Then get to the right default route skipping 4729 * default interface routes if any. As we hold a reference on 4730 * the IRE bucket, ip_ire_default_count can only increase so we 4731 * can't reach the end of the hash list unexpectedly. 4732 */ 4733 if (ip_ire_default_count != 0) { 4734 g_index = ip_ire_default_index++; 4735 index = g_index % ip_ire_default_count; 4736 while (index != 0) { 4737 if (!(ire->ire_type & IRE_INTERFACE)) 4738 index--; 4739 ire = ire->ire_next; 4740 } 4741 ASSERT(ire != NULL); 4742 } else { 4743 /* 4744 * No default routes, so we only have default interface 4745 * routes: don't enter the first loop. 4746 */ 4747 ire = NULL; 4748 } 4749 4750 /* 4751 * Round-robin the default routers list looking for a route that 4752 * matches the passed in parameters. If we can't find a default 4753 * route (IRE_DEFAULT), look for interface default routes. 4754 * We start with the ire we found above and we walk the hash 4755 * list until we're back where we started, see 4756 * ire_get_next_default_ire(). It doesn't matter if default 4757 * routes are added or deleted by other threads - we know this 4758 * ire will stay in the list because we hold a reference on the 4759 * ire bucket. 4760 * NB: if we only have interface default routes, ire is NULL so 4761 * we don't even enter this loop (see above). 4762 */ 4763 ire_origin = ire; 4764 for (; ire != NULL; 4765 ire = ire_get_next_default_ire(ire, ire_origin)) { 4766 4767 if (ire_match_args(ire, addr, (ipaddr_t)0, 4768 gateway, type, ipif, zoneid, ihandle, flags)) { 4769 int match_flags = 0; 4770 ire_t *rire; 4771 4772 /* 4773 * The potentially expensive call to 4774 * ire_route_lookup() is avoided when we have 4775 * only one default route. 4776 */ 4777 if (ip_ire_default_count == 1 || 4778 zoneid == ALL_ZONES) { 4779 IRE_REFHOLD(ire); 4780 IRB_REFRELE(irb_ptr); 4781 goto found_ire_held; 4782 } 4783 /* 4784 * When we're in a local zone, we're only 4785 * interested in default routers that are 4786 * reachable through ipifs within our zone. 4787 */ 4788 if (ire->ire_ipif != NULL) { 4789 match_flags |= MATCH_IRE_ILL_GROUP; 4790 } 4791 rire = ire_route_lookup(ire->ire_gateway_addr, 4792 0, 0, 0, ire->ire_ipif, NULL, zoneid, 4793 match_flags); 4794 if (rire != NULL) { 4795 ire_refrele(rire); 4796 IRE_REFHOLD(ire); 4797 IRB_REFRELE(irb_ptr); 4798 goto found_ire_held; 4799 } 4800 } 4801 } 4802 /* 4803 * Either there are no default routes or we could not 4804 * find a default route. Look for a interface default 4805 * route matching the args passed in. No round robin 4806 * here. Just pick the right one. 4807 */ 4808 for (ire = irb_ptr->irb_ire; ire != NULL; 4809 ire = ire->ire_next) { 4810 4811 if (!(ire->ire_type & IRE_INTERFACE)) 4812 continue; 4813 4814 if (ire->ire_marks & IRE_MARK_CONDEMNED) 4815 continue; 4816 4817 if (ire_match_args(ire, addr, (ipaddr_t)0, 4818 gateway, type, ipif, zoneid, ihandle, flags)) { 4819 IRE_REFHOLD(ire); 4820 IRB_REFRELE(irb_ptr); 4821 goto found_ire_held; 4822 } 4823 } 4824 IRB_REFRELE(irb_ptr); 4825 } 4826 ASSERT(ire == NULL); 4827 return (NULL); 4828 found_ire: 4829 ASSERT((ire->ire_marks & IRE_MARK_CONDEMNED) == 0); 4830 IRE_REFHOLD(ire); 4831 rw_exit(&irb_ptr->irb_lock); 4832 4833 found_ire_held: 4834 ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL); 4835 if ((flags & MATCH_IRE_RJ_BHOLE) && 4836 (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) { 4837 return (ire); 4838 } 4839 /* 4840 * At this point, IRE that was found must be an IRE_FORWARDTABLE 4841 * type. If this is a recursive lookup and an IRE_INTERFACE type was 4842 * found, return that. If it was some other IRE_FORWARDTABLE type of 4843 * IRE (one of the prefix types), then it is necessary to fill in the 4844 * parent IRE pointed to by pire, and then lookup the gateway address of 4845 * the parent. For backwards compatiblity, if this lookup returns an 4846 * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level 4847 * of lookup is done. 4848 */ 4849 if (flags & MATCH_IRE_RECURSIVE) { 4850 ipif_t *gw_ipif; 4851 int match_flags = MATCH_IRE_DSTONLY; 4852 ire_t *save_ire; 4853 4854 if (ire->ire_type & IRE_INTERFACE) 4855 return (ire); 4856 if (pire != NULL) 4857 *pire = ire; 4858 /* 4859 * If we can't find an IRE_INTERFACE or the caller has not 4860 * asked for pire, we need to REFRELE the save_ire. 4861 */ 4862 save_ire = ire; 4863 4864 /* 4865 * Currently MATCH_IRE_ILL is never used with 4866 * (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT) while 4867 * sending out packets as MATCH_IRE_ILL is used only 4868 * for communicating with on-link hosts. We can't assert 4869 * that here as RTM_GET calls this function with 4870 * MATCH_IRE_ILL | MATCH_IRE_DEFAULT | MATCH_IRE_RECURSIVE. 4871 * We have already used the MATCH_IRE_ILL in determining 4872 * the right prefix route at this point. To match the 4873 * behavior of how we locate routes while sending out 4874 * packets, we don't want to use MATCH_IRE_ILL below 4875 * while locating the interface route. 4876 */ 4877 if (ire->ire_ipif != NULL) 4878 match_flags |= MATCH_IRE_ILL_GROUP; 4879 4880 ire = ire_route_lookup(ire->ire_gateway_addr, 0, 0, 0, 4881 ire->ire_ipif, NULL, zoneid, match_flags); 4882 if (ire == NULL) { 4883 /* 4884 * Do not release the parent ire if MATCH_IRE_PARENT 4885 * is set. Also return it via ire. 4886 */ 4887 if (flags & MATCH_IRE_PARENT) { 4888 if (pire != NULL) { 4889 /* 4890 * Need an extra REFHOLD, if the parent 4891 * ire is returned via both ire and 4892 * pire. 4893 */ 4894 IRE_REFHOLD(save_ire); 4895 } 4896 ire = save_ire; 4897 } else { 4898 ire_refrele(save_ire); 4899 if (pire != NULL) 4900 *pire = NULL; 4901 } 4902 return (ire); 4903 } 4904 if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) { 4905 /* 4906 * If the caller did not ask for pire, release 4907 * it now. 4908 */ 4909 if (pire == NULL) { 4910 ire_refrele(save_ire); 4911 } 4912 return (ire); 4913 } 4914 match_flags |= MATCH_IRE_TYPE; 4915 gw_addr = ire->ire_gateway_addr; 4916 gw_ipif = ire->ire_ipif; 4917 ire_refrele(ire); 4918 ire = ire_route_lookup(gw_addr, 0, 0, 4919 (IRE_CACHETABLE | IRE_INTERFACE), gw_ipif, NULL, zoneid, 4920 match_flags); 4921 if (ire == NULL) { 4922 /* 4923 * Do not release the parent ire if MATCH_IRE_PARENT 4924 * is set. Also return it via ire. 4925 */ 4926 if (flags & MATCH_IRE_PARENT) { 4927 if (pire != NULL) { 4928 /* 4929 * Need an extra REFHOLD, if the 4930 * parent ire is returned via both 4931 * ire and pire. 4932 */ 4933 IRE_REFHOLD(save_ire); 4934 } 4935 ire = save_ire; 4936 } else { 4937 ire_refrele(save_ire); 4938 if (pire != NULL) 4939 *pire = NULL; 4940 } 4941 return (ire); 4942 } else if (pire == NULL) { 4943 /* 4944 * If the caller did not ask for pire, release 4945 * it now. 4946 */ 4947 ire_refrele(save_ire); 4948 } 4949 return (ire); 4950 } 4951 ASSERT(pire == NULL || *pire == NULL); 4952 return (ire); 4953 } 4954 4955 /* 4956 * Looks up cache table for a route. 4957 * specific lookup can be indicated by 4958 * passing the MATCH_* flags and the 4959 * necessary parameters. 4960 */ 4961 ire_t * 4962 ire_ctable_lookup(ipaddr_t addr, ipaddr_t gateway, int type, ipif_t *ipif, 4963 zoneid_t zoneid, int flags) 4964 { 4965 irb_t *irb_ptr; 4966 ire_t *ire; 4967 4968 /* 4969 * ire_match_args() will dereference ipif MATCH_IRE_SRC or 4970 * MATCH_IRE_ILL is set. 4971 */ 4972 if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) && 4973 (ipif == NULL)) 4974 return (NULL); 4975 4976 irb_ptr = &ip_cache_table[IRE_ADDR_HASH(addr, ip_cache_table_size)]; 4977 rw_enter(&irb_ptr->irb_lock, RW_READER); 4978 for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 4979 if (ire->ire_marks & IRE_MARK_CONDEMNED) 4980 continue; 4981 ASSERT(ire->ire_mask == IP_HOST_MASK); 4982 ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL); 4983 if (ire_match_args(ire, addr, ire->ire_mask, gateway, type, 4984 ipif, zoneid, 0, flags)) { 4985 IRE_REFHOLD(ire); 4986 rw_exit(&irb_ptr->irb_lock); 4987 return (ire); 4988 } 4989 } 4990 rw_exit(&irb_ptr->irb_lock); 4991 return (NULL); 4992 } 4993 4994 /* 4995 * Lookup cache. Don't return IRE_MARK_HIDDEN entries. Callers 4996 * should use ire_ctable_lookup with MATCH_IRE_MARK_HIDDEN to get 4997 * to the hidden ones. 4998 */ 4999 ire_t * 5000 ire_cache_lookup(ipaddr_t addr, zoneid_t zoneid) 5001 { 5002 irb_t *irb_ptr; 5003 ire_t *ire; 5004 5005 irb_ptr = &ip_cache_table[IRE_ADDR_HASH(addr, ip_cache_table_size)]; 5006 rw_enter(&irb_ptr->irb_lock, RW_READER); 5007 for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 5008 if (ire->ire_marks & (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)) 5009 continue; 5010 if (ire->ire_addr == addr) { 5011 if (zoneid == ALL_ZONES || ire->ire_zoneid == zoneid || 5012 ire->ire_type == IRE_LOCAL) { 5013 IRE_REFHOLD(ire); 5014 rw_exit(&irb_ptr->irb_lock); 5015 return (ire); 5016 } 5017 } 5018 } 5019 rw_exit(&irb_ptr->irb_lock); 5020 return (NULL); 5021 } 5022 5023 /* 5024 * Locate the interface ire that is tied to the cache ire 'cire' via 5025 * cire->ire_ihandle. 5026 * 5027 * We are trying to create the cache ire for an offlink destn based 5028 * on the cache ire of the gateway in 'cire'. 'pire' is the prefix ire 5029 * as found by ip_newroute(). We are called from ip_newroute() in 5030 * the IRE_CACHE case. 5031 */ 5032 ire_t * 5033 ire_ihandle_lookup_offlink(ire_t *cire, ire_t *pire) 5034 { 5035 ire_t *ire; 5036 int match_flags; 5037 ipaddr_t gw_addr; 5038 ipif_t *gw_ipif; 5039 5040 ASSERT(cire != NULL && pire != NULL); 5041 5042 /* 5043 * We don't need to specify the zoneid to ire_ftable_lookup() below 5044 * because the ihandle refers to an ipif which can be in only one zone. 5045 */ 5046 match_flags = MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK; 5047 /* 5048 * ip_newroute calls ire_ftable_lookup with MATCH_IRE_ILL only 5049 * for on-link hosts. We should never be here for onlink. 5050 * Thus, use MATCH_IRE_ILL_GROUP. 5051 */ 5052 if (pire->ire_ipif != NULL) 5053 match_flags |= MATCH_IRE_ILL_GROUP; 5054 /* 5055 * We know that the mask of the interface ire equals cire->ire_cmask. 5056 * (When ip_newroute() created 'cire' for the gateway it set its 5057 * cmask from the interface ire's mask) 5058 */ 5059 ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0, 5060 IRE_INTERFACE, pire->ire_ipif, NULL, ALL_ZONES, cire->ire_ihandle, 5061 match_flags); 5062 if (ire != NULL) 5063 return (ire); 5064 /* 5065 * If we didn't find an interface ire above, we can't declare failure. 5066 * For backwards compatibility, we need to support prefix routes 5067 * pointing to next hop gateways that are not on-link. 5068 * 5069 * Assume we are trying to ping some offlink destn, and we have the 5070 * routing table below. 5071 * 5072 * Eg. default - gw1 <--- pire (line 1) 5073 * gw1 - gw2 (line 2) 5074 * gw2 - hme0 (line 3) 5075 * 5076 * If we already have a cache ire for gw1 in 'cire', the 5077 * ire_ftable_lookup above would have failed, since there is no 5078 * interface ire to reach gw1. We will fallthru below. 5079 * 5080 * Here we duplicate the steps that ire_ftable_lookup() did in 5081 * getting 'cire' from 'pire', in the MATCH_IRE_RECURSIVE case. 5082 * The differences are the following 5083 * i. We want the interface ire only, so we call ire_ftable_lookup() 5084 * instead of ire_route_lookup() 5085 * ii. We look for only prefix routes in the 1st call below. 5086 * ii. We want to match on the ihandle in the 2nd call below. 5087 */ 5088 match_flags = MATCH_IRE_TYPE; 5089 if (pire->ire_ipif != NULL) 5090 match_flags |= MATCH_IRE_ILL_GROUP; 5091 ire = ire_ftable_lookup(pire->ire_gateway_addr, 0, 0, IRE_OFFSUBNET, 5092 pire->ire_ipif, NULL, ALL_ZONES, 0, match_flags); 5093 if (ire == NULL) 5094 return (NULL); 5095 /* 5096 * At this point 'ire' corresponds to the entry shown in line 2. 5097 * gw_addr is 'gw2' in the example above. 5098 */ 5099 gw_addr = ire->ire_gateway_addr; 5100 gw_ipif = ire->ire_ipif; 5101 ire_refrele(ire); 5102 5103 match_flags |= MATCH_IRE_IHANDLE; 5104 ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, 5105 gw_ipif, NULL, ALL_ZONES, cire->ire_ihandle, match_flags); 5106 return (ire); 5107 } 5108 5109 /* 5110 * Locate the interface ire that is tied to the cache ire 'cire' via 5111 * cire->ire_ihandle. 5112 * 5113 * We are trying to create the cache ire for an onlink destn. or 5114 * gateway in 'cire'. We are called from ire_add_v4() in the IRE_IF_RESOLVER 5115 * case, after the ire has come back from ARP. 5116 */ 5117 ire_t * 5118 ire_ihandle_lookup_onlink(ire_t *cire) 5119 { 5120 ire_t *ire; 5121 int match_flags; 5122 int i; 5123 int j; 5124 irb_t *irb_ptr; 5125 5126 ASSERT(cire != NULL); 5127 5128 /* 5129 * We don't need to specify the zoneid to ire_ftable_lookup() below 5130 * because the ihandle refers to an ipif which can be in only one zone. 5131 */ 5132 match_flags = MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK; 5133 /* 5134 * We know that the mask of the interface ire equals cire->ire_cmask. 5135 * (When ip_newroute() created 'cire' for an on-link destn. it set its 5136 * cmask from the interface ire's mask) 5137 */ 5138 ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0, 5139 IRE_INTERFACE, NULL, NULL, ALL_ZONES, cire->ire_ihandle, 5140 match_flags); 5141 if (ire != NULL) 5142 return (ire); 5143 /* 5144 * If we didn't find an interface ire above, we can't declare failure. 5145 * For backwards compatibility, we need to support prefix routes 5146 * pointing to next hop gateways that are not on-link. 5147 * 5148 * In the resolver/noresolver case, ip_newroute() thinks it is creating 5149 * the cache ire for an onlink destination in 'cire'. But 'cire' is 5150 * not actually onlink, because ire_ftable_lookup() cheated it, by 5151 * doing ire_route_lookup() twice and returning an interface ire. 5152 * 5153 * Eg. default - gw1 (line 1) 5154 * gw1 - gw2 (line 2) 5155 * gw2 - hme0 (line 3) 5156 * 5157 * In the above example, ip_newroute() tried to create the cache ire 5158 * 'cire' for gw1, based on the interface route in line 3. The 5159 * ire_ftable_lookup() above fails, because there is no interface route 5160 * to reach gw1. (it is gw2). We fall thru below. 5161 * 5162 * Do a brute force search based on the ihandle in a subset of the 5163 * forwarding tables, corresponding to cire->ire_cmask. Otherwise 5164 * things become very complex, since we don't have 'pire' in this 5165 * case. (Also note that this method is not possible in the offlink 5166 * case because we don't know the mask) 5167 */ 5168 i = ip_mask_to_plen(cire->ire_cmask); 5169 if ((ip_forwarding_table[i]) == NULL) 5170 return (NULL); 5171 for (j = 0; j < ip_ftable_hash_size; j++) { 5172 irb_ptr = &ip_forwarding_table[i][j]; 5173 rw_enter(&irb_ptr->irb_lock, RW_READER); 5174 for (ire = irb_ptr->irb_ire; ire != NULL; 5175 ire = ire->ire_next) { 5176 if (ire->ire_marks & IRE_MARK_CONDEMNED) 5177 continue; 5178 if ((ire->ire_type & IRE_INTERFACE) && 5179 (ire->ire_ihandle == cire->ire_ihandle)) { 5180 IRE_REFHOLD(ire); 5181 rw_exit(&irb_ptr->irb_lock); 5182 return (ire); 5183 } 5184 } 5185 rw_exit(&irb_ptr->irb_lock); 5186 } 5187 return (NULL); 5188 } 5189 5190 /* 5191 * ire_mrtun_lookup() is called by ip_rput() when packet is to be 5192 * tunneled through reverse tunnel. This is only supported for 5193 * IPv4 packets 5194 */ 5195 5196 ire_t * 5197 ire_mrtun_lookup(ipaddr_t srcaddr, ill_t *ill) 5198 { 5199 irb_t *irb_ptr; 5200 ire_t *ire; 5201 5202 ASSERT(ill != NULL); 5203 ASSERT(!(ill->ill_isv6)); 5204 5205 if (ip_mrtun_table == NULL) 5206 return (NULL); 5207 irb_ptr = &ip_mrtun_table[IRE_ADDR_HASH(srcaddr, IP_MRTUN_TABLE_SIZE)]; 5208 rw_enter(&irb_ptr->irb_lock, RW_READER); 5209 for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 5210 if (ire->ire_marks & IRE_MARK_CONDEMNED) 5211 continue; 5212 if ((ire->ire_in_src_addr == srcaddr) && 5213 ire->ire_in_ill == ill) { 5214 IRE_REFHOLD(ire); 5215 rw_exit(&irb_ptr->irb_lock); 5216 return (ire); 5217 } 5218 } 5219 rw_exit(&irb_ptr->irb_lock); 5220 return (NULL); 5221 } 5222 5223 /* 5224 * Return the IRE_LOOPBACK, IRE_IF_RESOLVER or IRE_IF_NORESOLVER 5225 * ire associated with the specified ipif. 5226 * 5227 * This might occasionally be called when IPIF_UP is not set since 5228 * the IP_MULTICAST_IF as well as creating interface routes 5229 * allows specifying a down ipif (ipif_lookup* match ipifs that are down). 5230 * 5231 * Note that if IPIF_NOLOCAL, IPIF_NOXMIT, or IPIF_DEPRECATED is set on 5232 * the ipif, this routine might return NULL. 5233 */ 5234 ire_t * 5235 ipif_to_ire(ipif_t *ipif) 5236 { 5237 ire_t *ire; 5238 5239 ASSERT(!ipif->ipif_isv6); 5240 if (ipif->ipif_ire_type == IRE_LOOPBACK) { 5241 ire = ire_ctable_lookup(ipif->ipif_lcl_addr, 0, IRE_LOOPBACK, 5242 ipif, ALL_ZONES, (MATCH_IRE_TYPE | MATCH_IRE_IPIF)); 5243 } else if (ipif->ipif_flags & IPIF_POINTOPOINT) { 5244 /* In this case we need to lookup destination address. */ 5245 ire = ire_ftable_lookup(ipif->ipif_pp_dst_addr, IP_HOST_MASK, 0, 5246 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, 5247 (MATCH_IRE_TYPE | MATCH_IRE_IPIF | MATCH_IRE_MASK)); 5248 } else { 5249 ire = ire_ftable_lookup(ipif->ipif_subnet, 5250 ipif->ipif_net_mask, 0, IRE_INTERFACE, ipif, NULL, 5251 ALL_ZONES, 0, (MATCH_IRE_TYPE | MATCH_IRE_IPIF | 5252 MATCH_IRE_MASK)); 5253 } 5254 return (ire); 5255 } 5256 5257 /* 5258 * ire_walk function. 5259 * Count the number of IRE_CACHE entries in different categories. 5260 */ 5261 void 5262 ire_cache_count(ire_t *ire, char *arg) 5263 { 5264 ire_cache_count_t *icc = (ire_cache_count_t *)arg; 5265 5266 if (ire->ire_type != IRE_CACHE) 5267 return; 5268 5269 icc->icc_total++; 5270 5271 if (ire->ire_ipversion == IPV6_VERSION) { 5272 mutex_enter(&ire->ire_lock); 5273 if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) { 5274 mutex_exit(&ire->ire_lock); 5275 icc->icc_onlink++; 5276 return; 5277 } 5278 mutex_exit(&ire->ire_lock); 5279 } else { 5280 if (ire->ire_gateway_addr == 0) { 5281 icc->icc_onlink++; 5282 return; 5283 } 5284 } 5285 5286 ASSERT(ire->ire_ipif != NULL); 5287 if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu) 5288 icc->icc_pmtu++; 5289 else if (ire->ire_tire_mark != ire->ire_ob_pkt_count + 5290 ire->ire_ib_pkt_count) 5291 icc->icc_offlink++; 5292 else 5293 icc->icc_unused++; 5294 } 5295 5296 /* 5297 * ire_walk function called by ip_trash_ire_reclaim(). 5298 * Free a fraction of the IRE_CACHE cache entries. The fractions are 5299 * different for different categories of IRE_CACHE entries. 5300 * A fraction of zero means to not free any in that category. 5301 * Use the hash bucket id plus lbolt as a random number. Thus if the fraction 5302 * is N then every Nth hash bucket chain will be freed. 5303 */ 5304 void 5305 ire_cache_reclaim(ire_t *ire, char *arg) 5306 { 5307 ire_cache_reclaim_t *icr = (ire_cache_reclaim_t *)arg; 5308 uint_t rand; 5309 5310 if (ire->ire_type != IRE_CACHE) 5311 return; 5312 5313 if (ire->ire_ipversion == IPV6_VERSION) { 5314 rand = (uint_t)lbolt + 5315 IRE_ADDR_HASH_V6(ire->ire_addr_v6, ip6_cache_table_size); 5316 mutex_enter(&ire->ire_lock); 5317 if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) { 5318 mutex_exit(&ire->ire_lock); 5319 if (icr->icr_onlink != 0 && 5320 (rand/icr->icr_onlink)*icr->icr_onlink == rand) { 5321 ire_delete(ire); 5322 return; 5323 } 5324 goto done; 5325 } 5326 mutex_exit(&ire->ire_lock); 5327 } else { 5328 rand = (uint_t)lbolt + 5329 IRE_ADDR_HASH(ire->ire_addr, ip_cache_table_size); 5330 if (ire->ire_gateway_addr == 0) { 5331 if (icr->icr_onlink != 0 && 5332 (rand/icr->icr_onlink)*icr->icr_onlink == rand) { 5333 ire_delete(ire); 5334 return; 5335 } 5336 goto done; 5337 } 5338 } 5339 /* Not onlink IRE */ 5340 ASSERT(ire->ire_ipif != NULL); 5341 if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu) { 5342 /* Use ptmu fraction */ 5343 if (icr->icr_pmtu != 0 && 5344 (rand/icr->icr_pmtu)*icr->icr_pmtu == rand) { 5345 ire_delete(ire); 5346 return; 5347 } 5348 } else if (ire->ire_tire_mark != ire->ire_ob_pkt_count + 5349 ire->ire_ib_pkt_count) { 5350 /* Use offlink fraction */ 5351 if (icr->icr_offlink != 0 && 5352 (rand/icr->icr_offlink)*icr->icr_offlink == rand) { 5353 ire_delete(ire); 5354 return; 5355 } 5356 } else { 5357 /* Use unused fraction */ 5358 if (icr->icr_unused != 0 && 5359 (rand/icr->icr_unused)*icr->icr_unused == rand) { 5360 ire_delete(ire); 5361 return; 5362 } 5363 } 5364 done: 5365 /* 5366 * Update tire_mark so that those that haven't been used since this 5367 * reclaim will be considered unused next time we reclaim. 5368 */ 5369 ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count; 5370 } 5371 5372 static void 5373 power2_roundup(uint32_t *value) 5374 { 5375 int i; 5376 5377 for (i = 1; i < 31; i++) { 5378 if (*value <= (1 << i)) 5379 break; 5380 } 5381 *value = (1 << i); 5382 } 5383 5384 void 5385 ip_ire_init() 5386 { 5387 int i; 5388 5389 mutex_init(&ire_ft_init_lock, NULL, MUTEX_DEFAULT, 0); 5390 mutex_init(&ire_handle_lock, NULL, MUTEX_DEFAULT, NULL); 5391 mutex_init(&ire_mrtun_lock, NULL, MUTEX_DEFAULT, NULL); 5392 mutex_init(&ire_srcif_table_lock, NULL, MUTEX_DEFAULT, NULL); 5393 5394 /* Calculate the IPv4 cache table size. */ 5395 ip_cache_table_size = MAX(ip_cache_table_size, 5396 ((kmem_avail() >> ip_ire_mem_ratio) / sizeof (ire_t) / 5397 ip_ire_max_bucket_cnt)); 5398 if (ip_cache_table_size > ip_max_cache_table_size) 5399 ip_cache_table_size = ip_max_cache_table_size; 5400 /* 5401 * Make sure that the table size is always a power of 2. The 5402 * hash macro IRE_ADDR_HASH() depends on that. 5403 */ 5404 power2_roundup(&ip_cache_table_size); 5405 5406 ip_cache_table = (irb_t *)kmem_zalloc(ip_cache_table_size * 5407 sizeof (irb_t), KM_SLEEP); 5408 5409 for (i = 0; i < ip_cache_table_size; i++) { 5410 rw_init(&ip_cache_table[i].irb_lock, NULL, 5411 RW_DEFAULT, NULL); 5412 } 5413 5414 /* Calculate the IPv6 cache table size. */ 5415 ip6_cache_table_size = MAX(ip6_cache_table_size, 5416 ((kmem_avail() >> ip_ire_mem_ratio) / sizeof (ire_t) / 5417 ip6_ire_max_bucket_cnt)); 5418 if (ip6_cache_table_size > ip6_max_cache_table_size) 5419 ip6_cache_table_size = ip6_max_cache_table_size; 5420 /* 5421 * Make sure that the table size is always a power of 2. The 5422 * hash macro IRE_ADDR_HASH_V6() depends on that. 5423 */ 5424 power2_roundup(&ip6_cache_table_size); 5425 5426 ip_cache_table_v6 = (irb_t *)kmem_zalloc(ip6_cache_table_size * 5427 sizeof (irb_t), KM_SLEEP); 5428 5429 for (i = 0; i < ip6_cache_table_size; i++) { 5430 rw_init(&ip_cache_table_v6[i].irb_lock, NULL, 5431 RW_DEFAULT, NULL); 5432 } 5433 /* 5434 * Create ire caches, ire_reclaim() 5435 * will give IRE_CACHE back to system when needed. 5436 * This needs to be done here before anything else, since 5437 * ire_add() expects the cache to be created. 5438 */ 5439 ire_cache = kmem_cache_create("ire_cache", 5440 sizeof (ire_t), 0, ip_ire_constructor, 5441 ip_ire_destructor, ip_trash_ire_reclaim, NULL, NULL, 0); 5442 5443 /* 5444 * Initialize ip_mrtun_table to NULL now, it will be 5445 * populated by ip_rt_add if reverse tunnel is created 5446 */ 5447 ip_mrtun_table = NULL; 5448 5449 /* 5450 * Make sure that the forwarding table size is a power of 2. 5451 * The IRE*_ADDR_HASH() macroes depend on that. 5452 */ 5453 power2_roundup(&ip_ftable_hash_size); 5454 power2_roundup(&ip6_ftable_hash_size); 5455 } 5456 5457 void 5458 ip_ire_fini() 5459 { 5460 int i; 5461 5462 mutex_destroy(&ire_ft_init_lock); 5463 mutex_destroy(&ire_handle_lock); 5464 5465 for (i = 0; i < ip_cache_table_size; i++) { 5466 rw_destroy(&ip_cache_table[i].irb_lock); 5467 } 5468 kmem_free(ip_cache_table, ip_cache_table_size * sizeof (irb_t)); 5469 5470 for (i = 0; i < ip6_cache_table_size; i++) { 5471 rw_destroy(&ip_cache_table_v6[i].irb_lock); 5472 } 5473 kmem_free(ip_cache_table_v6, ip6_cache_table_size * sizeof (irb_t)); 5474 5475 if (ip_mrtun_table != NULL) { 5476 for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) { 5477 rw_destroy(&ip_mrtun_table[i].irb_lock); 5478 } 5479 kmem_free(ip_mrtun_table, IP_MRTUN_TABLE_SIZE * sizeof (irb_t)); 5480 } 5481 kmem_cache_destroy(ire_cache); 5482 } 5483 5484 int 5485 ire_add_mrtun(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func) 5486 { 5487 ire_t *ire1; 5488 irb_t *irb_ptr; 5489 ire_t **irep; 5490 ire_t *ire; 5491 int i; 5492 uint_t max_frag; 5493 ill_t *stq_ill; 5494 int error; 5495 5496 ire = *ire_p; 5497 ASSERT(ire->ire_ipversion == IPV4_VERSION); 5498 /* Is ip_mrtun_table empty ? */ 5499 5500 if (ip_mrtun_table == NULL) { 5501 /* create the mrtun table */ 5502 mutex_enter(&ire_mrtun_lock); 5503 if (ip_mrtun_table == NULL) { 5504 ip_mrtun_table = 5505 (irb_t *)kmem_zalloc(IP_MRTUN_TABLE_SIZE * 5506 sizeof (irb_t), KM_NOSLEEP); 5507 5508 if (ip_mrtun_table == NULL) { 5509 ip2dbg(("ire_add_mrtun: allocation failure\n")); 5510 mutex_exit(&ire_mrtun_lock); 5511 ire_refrele(ire); 5512 *ire_p = NULL; 5513 return (ENOMEM); 5514 } 5515 5516 for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) { 5517 rw_init(&ip_mrtun_table[i].irb_lock, NULL, 5518 RW_DEFAULT, NULL); 5519 } 5520 ip2dbg(("ire_add_mrtun: mrtun table is created\n")); 5521 } 5522 /* some other thread got it and created the table */ 5523 mutex_exit(&ire_mrtun_lock); 5524 } 5525 5526 /* 5527 * Check for duplicate in the bucket and insert in the table 5528 */ 5529 irb_ptr = &(ip_mrtun_table[IRE_ADDR_HASH(ire->ire_in_src_addr, 5530 IP_MRTUN_TABLE_SIZE)]); 5531 5532 /* 5533 * Start the atomic add of the ire. Grab the ill locks, 5534 * ill_g_usesrc_lock and the bucket lock. 5535 * 5536 * If ipif or ill is changing ire_atomic_start() may queue the 5537 * request and return EINPROGRESS. 5538 */ 5539 error = ire_atomic_start(irb_ptr, ire, q, mp, func); 5540 if (error != 0) { 5541 /* 5542 * We don't know whether it is a valid ipif or not. 5543 * So, set it to NULL. This assumes that the ire has not added 5544 * a reference to the ipif. 5545 */ 5546 ire->ire_ipif = NULL; 5547 ire_delete(ire); 5548 ip1dbg(("ire_add_mrtun: ire_atomic_start failed\n")); 5549 *ire_p = NULL; 5550 return (error); 5551 } 5552 for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) { 5553 if (ire1->ire_marks & IRE_MARK_CONDEMNED) 5554 continue; 5555 /* has anyone inserted the route in the meanwhile ? */ 5556 if (ire1->ire_in_ill == ire->ire_in_ill && 5557 ire1->ire_in_src_addr == ire->ire_in_src_addr) { 5558 ip1dbg(("ire_add_mrtun: Duplicate entry exists\n")); 5559 IRE_REFHOLD(ire1); 5560 ire_atomic_end(irb_ptr, ire); 5561 ire_delete(ire); 5562 /* Return the old ire */ 5563 *ire_p = ire1; 5564 return (0); 5565 } 5566 } 5567 5568 /* Atomically set the ire_max_frag */ 5569 max_frag = *ire->ire_max_fragp; 5570 ire->ire_max_fragp = NULL; 5571 ire->ire_max_frag = MIN(max_frag, IP_MAXPACKET); 5572 5573 irep = (ire_t **)irb_ptr; 5574 if (*irep != NULL) { 5575 /* Find the last ire which matches ire_in_src_addr */ 5576 ire1 = *irep; 5577 while (ire1->ire_in_src_addr == ire->ire_in_src_addr) { 5578 irep = &ire1->ire_next; 5579 ire1 = *irep; 5580 if (ire1 == NULL) 5581 break; 5582 } 5583 } 5584 ire1 = *irep; 5585 if (ire1 != NULL) 5586 ire1->ire_ptpn = &ire->ire_next; 5587 ire->ire_next = ire1; 5588 /* Link the new one in. */ 5589 ire->ire_ptpn = irep; 5590 membar_producer(); 5591 *irep = ire; 5592 ire->ire_bucket = irb_ptr; 5593 IRE_REFHOLD_LOCKED(ire); 5594 5595 ip2dbg(("ire_add_mrtun: created and linked ire %p\n", (void *)*irep)); 5596 5597 /* 5598 * Protect ire_mrtun_count and ill_mrtun_refcnt from 5599 * another thread trying to add ire in the table 5600 */ 5601 mutex_enter(&ire_mrtun_lock); 5602 ire_mrtun_count++; 5603 mutex_exit(&ire_mrtun_lock); 5604 /* 5605 * ill_mrtun_refcnt is protected by the ill_lock held via 5606 * ire_atomic_start 5607 */ 5608 ire->ire_in_ill->ill_mrtun_refcnt++; 5609 5610 if (ire->ire_ipif != NULL) { 5611 ire->ire_ipif->ipif_ire_cnt++; 5612 if (ire->ire_stq != NULL) { 5613 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 5614 stq_ill->ill_ire_cnt++; 5615 } 5616 } else { 5617 ASSERT(ire->ire_stq == NULL); 5618 } 5619 5620 ire_atomic_end(irb_ptr, ire); 5621 ire_fastpath(ire); 5622 *ire_p = ire; 5623 return (0); 5624 } 5625 5626 5627 /* Walks down the mrtun table */ 5628 5629 void 5630 ire_walk_ill_mrtun(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg, 5631 ill_t *ill) 5632 { 5633 irb_t *irb; 5634 ire_t *ire; 5635 int i; 5636 int ret; 5637 5638 ASSERT((!(match_flags & (MATCH_IRE_WQ | MATCH_IRE_ILL | 5639 MATCH_IRE_ILL_GROUP))) || (ill != NULL)); 5640 ASSERT(match_flags == 0 || ire_type == IRE_MIPRTUN); 5641 5642 mutex_enter(&ire_mrtun_lock); 5643 if (ire_mrtun_count == 0) { 5644 mutex_exit(&ire_mrtun_lock); 5645 return; 5646 } 5647 mutex_exit(&ire_mrtun_lock); 5648 5649 ip2dbg(("ire_walk_ill_mrtun:walking the reverse tunnel table \n")); 5650 for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) { 5651 5652 irb = &(ip_mrtun_table[i]); 5653 if (irb->irb_ire == NULL) 5654 continue; 5655 IRB_REFHOLD(irb); 5656 for (ire = irb->irb_ire; ire != NULL; 5657 ire = ire->ire_next) { 5658 ASSERT(ire->ire_ipversion == IPV4_VERSION); 5659 if (match_flags != 0) { 5660 ret = ire_walk_ill_match( 5661 match_flags, ire_type, 5662 ire, ill, ALL_ZONES); 5663 } 5664 if (match_flags == 0 || ret) 5665 (*func)(ire, arg); 5666 } 5667 IRB_REFRELE(irb); 5668 } 5669 } 5670 5671 /* 5672 * Source interface based lookup routine (IPV4 only). 5673 * This routine is called only when RTA_SRCIFP bitflag is set 5674 * by routing socket while adding/deleting the route and it is 5675 * also called from ip_rput() when packets arrive from an interface 5676 * for which ill_srcif_ref_cnt is positive. This function is useful 5677 * when a packet coming from one interface must be forwarded to another 5678 * designated interface to reach the correct node. This function is also 5679 * called from ip_newroute when the link-layer address of an ire is resolved. 5680 * We need to make sure that ip_newroute searches for IRE_IF_RESOLVER type 5681 * ires--thus the ire_type parameter is needed. 5682 */ 5683 5684 ire_t * 5685 ire_srcif_table_lookup(ipaddr_t dst_addr, int ire_type, ipif_t *ipif, 5686 ill_t *in_ill, int flags) 5687 { 5688 irb_t *irb_ptr; 5689 ire_t *ire; 5690 irb_t *ire_srcif_table; 5691 5692 ASSERT(in_ill != NULL && !in_ill->ill_isv6); 5693 ASSERT(!(flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) || 5694 (ipif != NULL && !ipif->ipif_isv6)); 5695 5696 /* 5697 * No need to lock the ill since it is refheld by the caller of this 5698 * function 5699 */ 5700 if (in_ill->ill_srcif_table == NULL) { 5701 return (NULL); 5702 } 5703 5704 if (!(flags & MATCH_IRE_TYPE)) { 5705 flags |= MATCH_IRE_TYPE; 5706 ire_type = IRE_INTERFACE; 5707 } 5708 ire_srcif_table = in_ill->ill_srcif_table; 5709 irb_ptr = &ire_srcif_table[IRE_ADDR_HASH(dst_addr, 5710 IP_SRCIF_TABLE_SIZE)]; 5711 rw_enter(&irb_ptr->irb_lock, RW_READER); 5712 for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 5713 if (ire->ire_marks & IRE_MARK_CONDEMNED) 5714 continue; 5715 if (ire_match_args(ire, dst_addr, ire->ire_mask, 0, 5716 ire_type, ipif, ire->ire_zoneid, 0, flags)) { 5717 IRE_REFHOLD(ire); 5718 rw_exit(&irb_ptr->irb_lock); 5719 return (ire); 5720 } 5721 } 5722 /* Not Found */ 5723 rw_exit(&irb_ptr->irb_lock); 5724 return (NULL); 5725 } 5726 5727 5728 /* 5729 * Adds the ire into the special routing table which is hanging off of 5730 * the src_ipif->ipif_ill. It also increments the refcnt in the ill. 5731 * The forward table contains only IRE_IF_RESOLVER, IRE_IF_NORESOLVER 5732 * i,e. IRE_INTERFACE entries. Originally the dlureq_mp field is NULL 5733 * for IRE_IF_RESOLVER entry because we do not have the dst_addr's 5734 * link-layer address at the time of addition. 5735 * Upon resolving the address from ARP, dlureq_mp field is updated with 5736 * proper information in ire_update_srcif_v4. 5737 */ 5738 static int 5739 ire_add_srcif_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func) 5740 { 5741 ire_t *ire1; 5742 irb_t *ire_srcifp_table = NULL; 5743 irb_t *irb_ptr = NULL; 5744 ire_t **irep; 5745 ire_t *ire; 5746 int flags; 5747 int i; 5748 ill_t *stq_ill; 5749 uint_t max_frag; 5750 int error = 0; 5751 5752 ire = *ire_p; 5753 ASSERT(ire->ire_in_ill != NULL); 5754 ASSERT(ire->ire_ipversion == IPV4_VERSION); 5755 ASSERT(ire->ire_type == IRE_IF_NORESOLVER || 5756 ire->ire_type == IRE_IF_RESOLVER); 5757 5758 ire->ire_mask = IP_HOST_MASK; 5759 /* Update ire_dlureq_mp with NULL value upon creation */ 5760 if (ire->ire_type == IRE_IF_RESOLVER) { 5761 /* 5762 * assign NULL now, it will be updated 5763 * with correct value upon returning from 5764 * ARP 5765 */ 5766 ire->ire_dlureq_mp = NULL; 5767 } else { 5768 ire->ire_dlureq_mp = ill_dlur_gen(NULL, 5769 ire->ire_ipif->ipif_ill->ill_phys_addr_length, 5770 ire->ire_ipif->ipif_ill->ill_sap, 5771 ire->ire_ipif->ipif_ill->ill_sap_length); 5772 } 5773 /* Make sure the address is properly masked. */ 5774 ire->ire_addr &= ire->ire_mask; 5775 5776 ASSERT(ire->ire_max_fragp != NULL); 5777 max_frag = *ire->ire_max_fragp; 5778 ire->ire_max_fragp = NULL; 5779 ire->ire_max_frag = MIN(max_frag, IP_MAXPACKET); 5780 5781 mutex_enter(&ire->ire_in_ill->ill_lock); 5782 if (ire->ire_in_ill->ill_srcif_table == NULL) { 5783 /* create the incoming interface based table */ 5784 ire->ire_in_ill->ill_srcif_table = 5785 (irb_t *)kmem_zalloc(IP_SRCIF_TABLE_SIZE * 5786 sizeof (irb_t), KM_NOSLEEP); 5787 if (ire->ire_in_ill->ill_srcif_table == NULL) { 5788 ip1dbg(("ire_add_srcif_v4: Allocation fail\n")); 5789 mutex_exit(&ire->ire_in_ill->ill_lock); 5790 ire_delete(ire); 5791 *ire_p = NULL; 5792 return (ENOMEM); 5793 } 5794 ire_srcifp_table = ire->ire_in_ill->ill_srcif_table; 5795 for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) { 5796 rw_init(&ire_srcifp_table[i].irb_lock, NULL, 5797 RW_DEFAULT, NULL); 5798 } 5799 ip2dbg(("ire_add_srcif_v4: table created for ill %p\n", 5800 (void *)ire->ire_in_ill)); 5801 } 5802 /* Check for duplicate and insert */ 5803 ASSERT(ire->ire_in_ill->ill_srcif_table != NULL); 5804 irb_ptr = 5805 &(ire->ire_in_ill->ill_srcif_table[IRE_ADDR_HASH(ire->ire_addr, 5806 IP_SRCIF_TABLE_SIZE)]); 5807 mutex_exit(&ire->ire_in_ill->ill_lock); 5808 flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW); 5809 flags |= MATCH_IRE_IPIF; 5810 5811 /* 5812 * Start the atomic add of the ire. Grab the ill locks, 5813 * ill_g_usesrc_lock and the bucket lock. 5814 * 5815 * If ipif or ill is changing ire_atomic_start() may queue the 5816 * request and return EINPROGRESS. 5817 */ 5818 error = ire_atomic_start(irb_ptr, ire, q, mp, func); 5819 if (error != 0) { 5820 /* 5821 * We don't know whether it is a valid ipif or not. 5822 * So, set it to NULL. This assumes that the ire has not added 5823 * a reference to the ipif. 5824 */ 5825 ire->ire_ipif = NULL; 5826 ire_delete(ire); 5827 ip1dbg(("ire_add_srcif_v4: ire_atomic_start failed\n")); 5828 *ire_p = NULL; 5829 return (error); 5830 } 5831 for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) { 5832 if (ire1->ire_marks & IRE_MARK_CONDEMNED) 5833 continue; 5834 if (ire1->ire_zoneid != ire->ire_zoneid) 5835 continue; 5836 /* Has anyone inserted route in the meanwhile ? */ 5837 if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask, 0, 5838 ire->ire_type, ire->ire_ipif, ire->ire_zoneid, 0, flags)) { 5839 ip1dbg(("ire_add_srcif_v4 : Duplicate entry exists\n")); 5840 IRE_REFHOLD(ire1); 5841 ire_atomic_end(irb_ptr, ire); 5842 ire_delete(ire); 5843 /* Return old ire as in ire_add_v4 */ 5844 *ire_p = ire1; 5845 return (0); 5846 } 5847 } 5848 irep = (ire_t **)irb_ptr; 5849 if (*irep != NULL) { 5850 /* Find the last ire which matches ire_addr */ 5851 ire1 = *irep; 5852 while (ire1->ire_addr == ire->ire_addr) { 5853 irep = &ire1->ire_next; 5854 ire1 = *irep; 5855 if (ire1 == NULL) 5856 break; 5857 } 5858 } 5859 ire1 = *irep; 5860 if (ire1 != NULL) 5861 ire1->ire_ptpn = &ire->ire_next; 5862 ire->ire_next = ire1; 5863 /* Link the new one in. */ 5864 ire->ire_ptpn = irep; 5865 membar_producer(); 5866 *irep = ire; 5867 ire->ire_bucket = irb_ptr; 5868 IRE_REFHOLD_LOCKED(ire); 5869 5870 /* 5871 * Protect ire_in_ill->ill_srcif_refcnt and table reference count. 5872 * Note, ire_atomic_start already grabs the ire_in_ill->ill_lock 5873 * so ill_srcif_refcnt is already protected. 5874 */ 5875 ire->ire_in_ill->ill_srcif_refcnt++; 5876 mutex_enter(&ire_srcif_table_lock); 5877 ire_srcif_table_count++; 5878 mutex_exit(&ire_srcif_table_lock); 5879 irb_ptr->irb_ire_cnt++; 5880 if (ire->ire_ipif != NULL) { 5881 ire->ire_ipif->ipif_ire_cnt++; 5882 if (ire->ire_stq != NULL) { 5883 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 5884 stq_ill->ill_ire_cnt++; 5885 } 5886 } else { 5887 ASSERT(ire->ire_stq == NULL); 5888 } 5889 5890 ire_atomic_end(irb_ptr, ire); 5891 *ire_p = ire; 5892 return (0); 5893 } 5894 5895 5896 /* 5897 * This function is called by ire_add_then_send when ARP request comes 5898 * back to ip_wput->ire_add_then_send for resolved ire in the interface 5899 * based routing table. At this point, it only needs to update the resolver 5900 * information for the ire. The passed ire is returned to the caller as it 5901 * is the ire which is created as mblk. 5902 */ 5903 5904 static ire_t * 5905 ire_update_srcif_v4(ire_t *ire) 5906 { 5907 ire_t *ire1; 5908 irb_t *irb; 5909 int error; 5910 5911 ASSERT(ire->ire_type != IRE_MIPRTUN && 5912 ire->ire_ipif->ipif_net_type == IRE_IF_RESOLVER); 5913 ASSERT(ire->ire_ipversion == IPV4_VERSION); 5914 5915 /* 5916 * This ire is from ARP. Update 5917 * ire_dlureq_mp info 5918 */ 5919 ire1 = ire_srcif_table_lookup(ire->ire_addr, 5920 IRE_IF_RESOLVER, ire->ire_ipif, 5921 ire->ire_in_ill, 5922 MATCH_IRE_ILL | MATCH_IRE_TYPE); 5923 if (ire1 == NULL) { 5924 /* Mobile node registration expired ? */ 5925 ire_delete(ire); 5926 return (NULL); 5927 } 5928 irb = ire1->ire_bucket; 5929 ASSERT(irb != NULL); 5930 /* 5931 * Start the atomic add of the ire. Grab the ill locks, 5932 * ill_g_usesrc_lock and the bucket lock. 5933 */ 5934 error = ire_atomic_start(irb, ire1, NULL, NULL, NULL); 5935 if (error != 0) { 5936 /* 5937 * We don't know whether it is a valid ipif or not. 5938 * So, set it to NULL. This assumes that the ire has not added 5939 * a reference to the ipif. 5940 */ 5941 ire->ire_ipif = NULL; 5942 ire_delete(ire); 5943 ip1dbg(("ire_update_srcif_v4: ire_atomic_start failed\n")); 5944 return (NULL); 5945 } 5946 ASSERT(ire->ire_max_fragp == NULL); 5947 ire->ire_max_frag = ire1->ire_max_frag; 5948 /* 5949 * Update resolver information and 5950 * send-to queue. 5951 */ 5952 ASSERT(ire->ire_dlureq_mp != NULL); 5953 ire1->ire_dlureq_mp = copyb(ire->ire_dlureq_mp); 5954 if (ire1->ire_dlureq_mp == NULL) { 5955 ip0dbg(("ire_update_srcif: copyb failed\n")); 5956 ire_refrele(ire1); 5957 ire_refrele(ire); 5958 ire_atomic_end(irb, ire1); 5959 return (NULL); 5960 } 5961 ire1->ire_stq = ire->ire_stq; 5962 5963 ASSERT(ire->ire_fp_mp == NULL); 5964 5965 ire_atomic_end(irb, ire1); 5966 ire_refrele(ire1); 5967 /* Return the passed ire */ 5968 return (ire); /* Update done */ 5969 } 5970 5971 5972 /* 5973 * Check if another multirt route resolution is needed. 5974 * B_TRUE is returned is there remain a resolvable route, 5975 * or if no route for that dst is resolved yet. 5976 * B_FALSE is returned if all routes for that dst are resolved 5977 * or if the remaining unresolved routes are actually not 5978 * resolvable. 5979 * This only works in the global zone. 5980 */ 5981 boolean_t 5982 ire_multirt_need_resolve(ipaddr_t dst) 5983 { 5984 ire_t *first_fire; 5985 ire_t *first_cire; 5986 ire_t *fire; 5987 ire_t *cire; 5988 irb_t *firb; 5989 irb_t *cirb; 5990 int unres_cnt = 0; 5991 boolean_t resolvable = B_FALSE; 5992 5993 /* Retrieve the first IRE_HOST that matches the destination */ 5994 first_fire = ire_ftable_lookup(dst, IP_HOST_MASK, 0, IRE_HOST, NULL, 5995 NULL, ALL_ZONES, 0, MATCH_IRE_MASK | MATCH_IRE_TYPE); 5996 5997 /* No route at all */ 5998 if (first_fire == NULL) { 5999 return (B_TRUE); 6000 } 6001 6002 firb = first_fire->ire_bucket; 6003 ASSERT(firb != NULL); 6004 6005 /* Retrieve the first IRE_CACHE ire for that destination. */ 6006 first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID); 6007 6008 /* No resolved route. */ 6009 if (first_cire == NULL) { 6010 ire_refrele(first_fire); 6011 return (B_TRUE); 6012 } 6013 6014 /* 6015 * At least one route is resolved. Here we look through the forward 6016 * and cache tables, to compare the number of declared routes 6017 * with the number of resolved routes. The search for a resolvable 6018 * route is performed only if at least one route remains 6019 * unresolved. 6020 */ 6021 cirb = first_cire->ire_bucket; 6022 ASSERT(cirb != NULL); 6023 6024 /* Count the number of routes to that dest that are declared. */ 6025 IRB_REFHOLD(firb); 6026 for (fire = first_fire; fire != NULL; fire = fire->ire_next) { 6027 if (!(fire->ire_flags & RTF_MULTIRT)) 6028 continue; 6029 if (fire->ire_addr != dst) 6030 continue; 6031 unres_cnt++; 6032 } 6033 IRB_REFRELE(firb); 6034 6035 /* Then subtract the number of routes to that dst that are resolved */ 6036 IRB_REFHOLD(cirb); 6037 for (cire = first_cire; cire != NULL; cire = cire->ire_next) { 6038 if (!(cire->ire_flags & RTF_MULTIRT)) 6039 continue; 6040 if (cire->ire_addr != dst) 6041 continue; 6042 if (cire->ire_marks & (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)) 6043 continue; 6044 unres_cnt--; 6045 } 6046 IRB_REFRELE(cirb); 6047 6048 /* At least one route is unresolved; search for a resolvable route. */ 6049 if (unres_cnt > 0) 6050 resolvable = ire_multirt_lookup(&first_cire, &first_fire, 6051 MULTIRT_USESTAMP | MULTIRT_CACHEGW); 6052 6053 if (first_fire != NULL) 6054 ire_refrele(first_fire); 6055 6056 if (first_cire != NULL) 6057 ire_refrele(first_cire); 6058 6059 return (resolvable); 6060 } 6061 6062 6063 /* 6064 * Explore a forward_table bucket, starting from fire_arg. 6065 * fire_arg MUST be an IRE_HOST entry. 6066 * 6067 * Return B_TRUE and update *ire_arg and *fire_arg 6068 * if at least one resolvable route is found. *ire_arg 6069 * is the IRE entry for *fire_arg's gateway. 6070 * 6071 * Return B_FALSE otherwise (all routes are resolved or 6072 * the remaining unresolved routes are all unresolvable). 6073 * 6074 * The IRE selection relies on a priority mechanism 6075 * driven by the flags passed in by the caller. 6076 * The caller, such as ip_newroute_ipif(), can get the most 6077 * relevant ire at each stage of a multiple route resolution. 6078 * 6079 * The rules are: 6080 * 6081 * - if MULTIRT_CACHEGW is specified in flags, IRE_CACHETABLE 6082 * ires are preferred for the gateway. This gives the highest 6083 * priority to routes that can be resolved without using 6084 * a resolver. 6085 * 6086 * - if MULTIRT_CACHEGW is not specified, or if MULTIRT_CACHEGW 6087 * is specified but no IRE_CACHETABLE ire entry for the gateway 6088 * is found, the following rules apply. 6089 * 6090 * - if MULTIRT_USESTAMP is specified in flags, IRE_INTERFACE 6091 * ires for the gateway, that have not been tried since 6092 * a configurable amount of time, are preferred. 6093 * This applies when a resolver must be invoked for 6094 * a missing route, but we don't want to use the resolver 6095 * upon each packet emission. If no such resolver is found, 6096 * B_FALSE is returned. 6097 * The MULTIRT_USESTAMP flag can be combined with 6098 * MULTIRT_CACHEGW. 6099 * 6100 * - if MULTIRT_USESTAMP is not specified in flags, the first 6101 * unresolved but resolvable route is selected. 6102 * 6103 * - Otherwise, there is no resolvalble route, and 6104 * B_FALSE is returned. 6105 * 6106 * At last, MULTIRT_SETSTAMP can be specified in flags to 6107 * request the timestamp of unresolvable routes to 6108 * be refreshed. This prevents the useless exploration 6109 * of those routes for a while, when MULTIRT_USESTAMP is used. 6110 * 6111 * This only works in the global zone. 6112 */ 6113 boolean_t 6114 ire_multirt_lookup(ire_t **ire_arg, ire_t **fire_arg, uint32_t flags) 6115 { 6116 clock_t delta; 6117 ire_t *best_fire = NULL; 6118 ire_t *best_cire = NULL; 6119 ire_t *first_fire; 6120 ire_t *first_cire; 6121 ire_t *fire; 6122 ire_t *cire; 6123 irb_t *firb = NULL; 6124 irb_t *cirb = NULL; 6125 ire_t *gw_ire; 6126 boolean_t already_resolved; 6127 boolean_t res; 6128 ipaddr_t dst; 6129 ipaddr_t gw; 6130 6131 ip2dbg(("ire_multirt_lookup: *ire_arg %p, *fire_arg %p, flags %04x\n", 6132 (void *)*ire_arg, (void *)*fire_arg, flags)); 6133 6134 ASSERT(ire_arg != NULL); 6135 ASSERT(fire_arg != NULL); 6136 6137 /* Not an IRE_HOST ire; give up. */ 6138 if ((*fire_arg == NULL) || ((*fire_arg)->ire_type != IRE_HOST)) { 6139 return (B_FALSE); 6140 } 6141 6142 /* This is the first IRE_HOST ire for that destination. */ 6143 first_fire = *fire_arg; 6144 firb = first_fire->ire_bucket; 6145 ASSERT(firb != NULL); 6146 6147 dst = first_fire->ire_addr; 6148 6149 ip2dbg(("ire_multirt_lookup: dst %08x\n", ntohl(dst))); 6150 6151 /* 6152 * Retrieve the first IRE_CACHE ire for that destination; 6153 * if we don't find one, no route for that dest is 6154 * resolved yet. 6155 */ 6156 first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID); 6157 if (first_cire != NULL) { 6158 cirb = first_cire->ire_bucket; 6159 } 6160 6161 ip2dbg(("ire_multirt_lookup: first_cire %p\n", (void *)first_cire)); 6162 6163 /* 6164 * Search for a resolvable route, giving the top priority 6165 * to routes that can be resolved without any call to the resolver. 6166 */ 6167 IRB_REFHOLD(firb); 6168 6169 if (!CLASSD(dst)) { 6170 /* 6171 * For all multiroute IRE_HOST ires for that destination, 6172 * check if the route via the IRE_HOST's gateway is 6173 * resolved yet. 6174 */ 6175 for (fire = first_fire; fire != NULL; fire = fire->ire_next) { 6176 6177 if (!(fire->ire_flags & RTF_MULTIRT)) 6178 continue; 6179 if (fire->ire_addr != dst) 6180 continue; 6181 6182 gw = fire->ire_gateway_addr; 6183 6184 ip2dbg(("ire_multirt_lookup: fire %p, " 6185 "ire_addr %08x, ire_gateway_addr %08x\n", 6186 (void *)fire, ntohl(fire->ire_addr), ntohl(gw))); 6187 6188 already_resolved = B_FALSE; 6189 6190 if (first_cire != NULL) { 6191 ASSERT(cirb != NULL); 6192 6193 IRB_REFHOLD(cirb); 6194 /* 6195 * For all IRE_CACHE ires for that 6196 * destination. 6197 */ 6198 for (cire = first_cire; 6199 cire != NULL; 6200 cire = cire->ire_next) { 6201 6202 if (!(cire->ire_flags & RTF_MULTIRT)) 6203 continue; 6204 if (cire->ire_addr != dst) 6205 continue; 6206 if (cire->ire_marks & 6207 (IRE_MARK_CONDEMNED | 6208 IRE_MARK_HIDDEN)) 6209 continue; 6210 /* 6211 * Check if the IRE_CACHE's gateway 6212 * matches the IRE_HOST's gateway. 6213 */ 6214 if (cire->ire_gateway_addr == gw) { 6215 already_resolved = B_TRUE; 6216 break; 6217 } 6218 } 6219 IRB_REFRELE(cirb); 6220 } 6221 6222 /* 6223 * This route is already resolved; 6224 * proceed with next one. 6225 */ 6226 if (already_resolved) { 6227 ip2dbg(("ire_multirt_lookup: found cire %p, " 6228 "already resolved\n", (void *)cire)); 6229 continue; 6230 } 6231 6232 /* 6233 * The route is unresolved; is it actually 6234 * resolvable, i.e. is there a cache or a resolver 6235 * for the gateway? 6236 */ 6237 gw_ire = ire_route_lookup(gw, 0, 0, 0, NULL, NULL, 6238 ALL_ZONES, MATCH_IRE_RECURSIVE); 6239 6240 ip2dbg(("ire_multirt_lookup: looked up gw_ire %p\n", 6241 (void *)gw_ire)); 6242 6243 /* 6244 * If gw_ire is typed IRE_CACHETABLE, 6245 * this route can be resolved without any call to the 6246 * resolver. If the MULTIRT_CACHEGW flag is set, 6247 * give the top priority to this ire and exit the 6248 * loop. 6249 * This is typically the case when an ARP reply 6250 * is processed through ip_wput_nondata(). 6251 */ 6252 if ((flags & MULTIRT_CACHEGW) && 6253 (gw_ire != NULL) && 6254 (gw_ire->ire_type & IRE_CACHETABLE)) { 6255 /* 6256 * Release the resolver associated to the 6257 * previous candidate best ire, if any. 6258 */ 6259 if (best_cire != NULL) { 6260 ire_refrele(best_cire); 6261 ASSERT(best_fire != NULL); 6262 } 6263 6264 best_fire = fire; 6265 best_cire = gw_ire; 6266 6267 ip2dbg(("ire_multirt_lookup: found top prio " 6268 "best_fire %p, best_cire %p\n", 6269 (void *)best_fire, (void *)best_cire)); 6270 break; 6271 } 6272 6273 /* 6274 * Compute the time elapsed since our preceding 6275 * attempt to resolve that route. 6276 * If the MULTIRT_USESTAMP flag is set, we take that 6277 * route into account only if this time interval 6278 * exceeds ip_multirt_resolution_interval; 6279 * this prevents us from attempting to resolve a 6280 * broken route upon each sending of a packet. 6281 */ 6282 delta = lbolt - fire->ire_last_used_time; 6283 delta = TICK_TO_MSEC(delta); 6284 6285 res = (boolean_t) 6286 ((delta > ip_multirt_resolution_interval) || 6287 (!(flags & MULTIRT_USESTAMP))); 6288 6289 ip2dbg(("ire_multirt_lookup: fire %p, delta %lu, " 6290 "res %d\n", 6291 (void *)fire, delta, res)); 6292 6293 if (res) { 6294 /* 6295 * We are here if MULTIRT_USESTAMP flag is set 6296 * and the resolver for fire's gateway 6297 * has not been tried since 6298 * ip_multirt_resolution_interval, or if 6299 * MULTIRT_USESTAMP is not set but gw_ire did 6300 * not fill the conditions for MULTIRT_CACHEGW, 6301 * or if neither MULTIRT_USESTAMP nor 6302 * MULTIRT_CACHEGW are set. 6303 */ 6304 if (gw_ire != NULL) { 6305 if (best_fire == NULL) { 6306 ASSERT(best_cire == NULL); 6307 6308 best_fire = fire; 6309 best_cire = gw_ire; 6310 6311 ip2dbg(("ire_multirt_lookup:" 6312 "found candidate " 6313 "best_fire %p, " 6314 "best_cire %p\n", 6315 (void *)best_fire, 6316 (void *)best_cire)); 6317 6318 /* 6319 * If MULTIRT_CACHEGW is not 6320 * set, we ignore the top 6321 * priority ires that can 6322 * be resolved without any 6323 * call to the resolver; 6324 * In that case, there is 6325 * actually no need 6326 * to continue the loop. 6327 */ 6328 if (!(flags & 6329 MULTIRT_CACHEGW)) { 6330 break; 6331 } 6332 continue; 6333 } 6334 } else { 6335 /* 6336 * No resolver for the gateway: the 6337 * route is not resolvable. 6338 * If the MULTIRT_SETSTAMP flag is 6339 * set, we stamp the IRE_HOST ire, 6340 * so we will not select it again 6341 * during this resolution interval. 6342 */ 6343 if (flags & MULTIRT_SETSTAMP) 6344 fire->ire_last_used_time = 6345 lbolt; 6346 } 6347 } 6348 6349 if (gw_ire != NULL) 6350 ire_refrele(gw_ire); 6351 } 6352 } else { /* CLASSD(dst) */ 6353 6354 for (fire = first_fire; 6355 fire != NULL; 6356 fire = fire->ire_next) { 6357 6358 if (!(fire->ire_flags & RTF_MULTIRT)) 6359 continue; 6360 if (fire->ire_addr != dst) 6361 continue; 6362 6363 already_resolved = B_FALSE; 6364 6365 gw = fire->ire_gateway_addr; 6366 6367 gw_ire = ire_ftable_lookup(gw, 0, 0, IRE_INTERFACE, 6368 NULL, NULL, ALL_ZONES, 0, 6369 MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE); 6370 6371 /* No resolver for the gateway; we skip this ire. */ 6372 if (gw_ire == NULL) { 6373 continue; 6374 } 6375 6376 if (first_cire != NULL) { 6377 6378 IRB_REFHOLD(cirb); 6379 /* 6380 * For all IRE_CACHE ires for that 6381 * destination. 6382 */ 6383 for (cire = first_cire; 6384 cire != NULL; 6385 cire = cire->ire_next) { 6386 6387 if (!(cire->ire_flags & RTF_MULTIRT)) 6388 continue; 6389 if (cire->ire_addr != dst) 6390 continue; 6391 if (cire->ire_marks & 6392 (IRE_MARK_CONDEMNED | 6393 IRE_MARK_HIDDEN)) 6394 continue; 6395 6396 /* 6397 * Cache entries are linked to the 6398 * parent routes using the parent handle 6399 * (ire_phandle). If no cache entry has 6400 * the same handle as fire, fire is 6401 * still unresolved. 6402 */ 6403 ASSERT(cire->ire_phandle != 0); 6404 if (cire->ire_phandle == 6405 fire->ire_phandle) { 6406 already_resolved = B_TRUE; 6407 break; 6408 } 6409 } 6410 IRB_REFRELE(cirb); 6411 } 6412 6413 /* 6414 * This route is already resolved; proceed with 6415 * next one. 6416 */ 6417 if (already_resolved) { 6418 ire_refrele(gw_ire); 6419 continue; 6420 } 6421 6422 /* 6423 * Compute the time elapsed since our preceding 6424 * attempt to resolve that route. 6425 * If the MULTIRT_USESTAMP flag is set, we take 6426 * that route into account only if this time 6427 * interval exceeds ip_multirt_resolution_interval; 6428 * this prevents us from attempting to resolve a 6429 * broken route upon each sending of a packet. 6430 */ 6431 delta = lbolt - fire->ire_last_used_time; 6432 delta = TICK_TO_MSEC(delta); 6433 6434 res = (boolean_t) 6435 ((delta > ip_multirt_resolution_interval) || 6436 (!(flags & MULTIRT_USESTAMP))); 6437 6438 ip3dbg(("ire_multirt_lookup: fire %p, delta %lx, " 6439 "flags %04x, res %d\n", 6440 (void *)fire, delta, flags, res)); 6441 6442 if (res) { 6443 if (best_cire != NULL) { 6444 /* 6445 * Release the resolver associated 6446 * to the preceding candidate best 6447 * ire, if any. 6448 */ 6449 ire_refrele(best_cire); 6450 ASSERT(best_fire != NULL); 6451 } 6452 best_fire = fire; 6453 best_cire = gw_ire; 6454 continue; 6455 } 6456 6457 ire_refrele(gw_ire); 6458 } 6459 } 6460 6461 if (best_fire != NULL) { 6462 IRE_REFHOLD(best_fire); 6463 } 6464 IRB_REFRELE(firb); 6465 6466 /* Release the first IRE_CACHE we initially looked up, if any. */ 6467 if (first_cire != NULL) 6468 ire_refrele(first_cire); 6469 6470 /* Found a resolvable route. */ 6471 if (best_fire != NULL) { 6472 ASSERT(best_cire != NULL); 6473 6474 if (*fire_arg != NULL) 6475 ire_refrele(*fire_arg); 6476 if (*ire_arg != NULL) 6477 ire_refrele(*ire_arg); 6478 6479 /* 6480 * Update the passed-in arguments with the 6481 * resolvable multirt route we found. 6482 */ 6483 *fire_arg = best_fire; 6484 *ire_arg = best_cire; 6485 6486 ip2dbg(("ire_multirt_lookup: returning B_TRUE, " 6487 "*fire_arg %p, *ire_arg %p\n", 6488 (void *)best_fire, (void *)best_cire)); 6489 6490 return (B_TRUE); 6491 } 6492 6493 ASSERT(best_cire == NULL); 6494 6495 ip2dbg(("ire_multirt_lookup: returning B_FALSE, *fire_arg %p, " 6496 "*ire_arg %p\n", 6497 (void *)*fire_arg, (void *)*ire_arg)); 6498 6499 /* No resolvable route. */ 6500 return (B_FALSE); 6501 } 6502 6503 /* 6504 * Find an IRE_OFFSUBNET IRE entry for the multicast address 'group' 6505 * that goes through 'ipif'. As a fallback, a route that goes through 6506 * ipif->ipif_ill can be returned. 6507 */ 6508 ire_t * 6509 ipif_lookup_multi_ire(ipif_t *ipif, ipaddr_t group) 6510 { 6511 ire_t *ire; 6512 ire_t *save_ire = NULL; 6513 ire_t *gw_ire; 6514 irb_t *irb; 6515 ipaddr_t gw_addr; 6516 int match_flags = MATCH_IRE_TYPE | MATCH_IRE_ILL; 6517 6518 ASSERT(CLASSD(group)); 6519 6520 ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, ALL_ZONES, 0, 6521 MATCH_IRE_DEFAULT); 6522 6523 if (ire == NULL) 6524 return (NULL); 6525 6526 irb = ire->ire_bucket; 6527 ASSERT(irb); 6528 6529 IRB_REFHOLD(irb); 6530 ire_refrele(ire); 6531 for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 6532 if (ire->ire_addr != group || 6533 ipif->ipif_zoneid != ire->ire_zoneid) { 6534 continue; 6535 } 6536 6537 switch (ire->ire_type) { 6538 case IRE_DEFAULT: 6539 case IRE_PREFIX: 6540 case IRE_HOST: 6541 gw_addr = ire->ire_gateway_addr; 6542 gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, 6543 ipif, NULL, ALL_ZONES, 0, match_flags); 6544 6545 if (gw_ire != NULL) { 6546 if (save_ire != NULL) { 6547 ire_refrele(save_ire); 6548 } 6549 IRE_REFHOLD(ire); 6550 if (gw_ire->ire_ipif == ipif) { 6551 ire_refrele(gw_ire); 6552 6553 IRB_REFRELE(irb); 6554 return (ire); 6555 } 6556 ire_refrele(gw_ire); 6557 save_ire = ire; 6558 } 6559 break; 6560 case IRE_IF_NORESOLVER: 6561 case IRE_IF_RESOLVER: 6562 if (ire->ire_ipif == ipif) { 6563 if (save_ire != NULL) { 6564 ire_refrele(save_ire); 6565 } 6566 IRE_REFHOLD(ire); 6567 6568 IRB_REFRELE(irb); 6569 return (ire); 6570 } 6571 break; 6572 } 6573 } 6574 IRB_REFRELE(irb); 6575 6576 return (save_ire); 6577 } 6578 6579 /* 6580 * The purpose of the next two functions is to provide some external access to 6581 * routing/l2 lookup functionality while hiding the implementation of routing 6582 * and interface data structures (IRE/ILL). Thus, interfaces are passed/ 6583 * returned by name instead of by ILL reference. These functions are used by 6584 * IP Filter. 6585 * Return a link layer header suitable for an IP packet being sent to the 6586 * dst_addr IP address. The interface associated with the route is put into 6587 * ifname, which must be a buffer of LIFNAMSIZ bytes. The dst_addr is the 6588 * packet's ultimate destination address, not a router address. 6589 * 6590 * This function is used when the caller wants to know the outbound interface 6591 * and MAC header for a packet given only the address. 6592 */ 6593 mblk_t * 6594 ip_nexthop_route(const struct sockaddr *target, char *ifname) 6595 { 6596 struct nce_s *nce; 6597 ire_t *dir, *gw; 6598 ill_t *ill; 6599 mblk_t *mp; 6600 6601 /* parameter sanity */ 6602 if (ifname == NULL || target == NULL) 6603 return (NULL); 6604 6605 gw = NULL; 6606 6607 /* Find the route entry, if it exists. */ 6608 switch (target->sa_family) { 6609 case AF_INET: 6610 dir = ire_route_lookup( 6611 ((struct sockaddr_in *)target)->sin_addr.s_addr, 6612 0xffffffff, 6613 0, 0, NULL, &gw, ALL_ZONES, 6614 MATCH_IRE_DSTONLY|MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE); 6615 break; 6616 case AF_INET6: 6617 dir = ire_route_lookup_v6( 6618 &((struct sockaddr_in6 *)target)->sin6_addr, 6619 NULL, 6620 0, 0, NULL, &gw, ALL_ZONES, 6621 MATCH_IRE_DSTONLY|MATCH_IRE_DEFAULT|MATCH_IRE_RECURSIVE); 6622 if ((dir != NULL) && (dir->ire_nce == NULL)) { 6623 ire_refrele(dir); 6624 dir = NULL; 6625 } 6626 break; 6627 default: 6628 dir = NULL; 6629 break; 6630 } 6631 6632 6633 if (dir == NULL) 6634 return (NULL); 6635 6636 /* Map the IRE to an ILL so we can fill in ifname. */ 6637 ill = ire_to_ill(dir); 6638 if (ill == NULL) { 6639 ire_refrele(dir); 6640 return (NULL); 6641 } 6642 (void) strncpy(ifname, ill->ill_name, LIFNAMSIZ); 6643 6644 /* Return a copy of the header to the caller. */ 6645 switch (target->sa_family) { 6646 case AF_INET : 6647 if (dir->ire_fp_mp != NULL) { 6648 if ((mp = dupb(dir->ire_fp_mp)) == NULL) 6649 mp = copyb(dir->ire_fp_mp); 6650 } else if (dir->ire_dlureq_mp != NULL) { 6651 if ((mp = dupb(dir->ire_dlureq_mp)) == NULL) 6652 mp = copyb(dir->ire_dlureq_mp); 6653 } else { 6654 mp = NULL; 6655 } 6656 break; 6657 case AF_INET6 : 6658 nce = dir->ire_nce; 6659 if (nce->nce_fp_mp != NULL) { 6660 if ((mp = dupb(nce->nce_fp_mp)) == NULL) 6661 mp = copyb(nce->nce_fp_mp); 6662 } else if (nce->nce_res_mp != NULL) { 6663 if ((mp = dupb(nce->nce_res_mp)) == NULL) 6664 mp = copyb(nce->nce_res_mp); 6665 } else { 6666 mp = NULL; 6667 } 6668 break; 6669 } 6670 6671 ire_refrele(dir); 6672 return (mp); 6673 } 6674 6675 6676 /* 6677 * Return a link layer header suitable for an IP packet being sent to the 6678 * dst_addr IP address on the specified output interface. The dst_addr 6679 * may be the packet's ultimate destination or a predetermined next hop 6680 * router's address. 6681 * ifname must be nul-terminated. 6682 * 6683 * This function is used when the caller knows the outbound interface (usually 6684 * because it was specified by policy) and only needs the MAC header for a 6685 * packet. 6686 */ 6687 mblk_t * 6688 ip_nexthop(const struct sockaddr *target, const char *ifname) 6689 { 6690 struct nce_s *nce; 6691 ill_walk_context_t ctx; 6692 t_uscalar_t sap; 6693 ire_t *dir, *gw; 6694 ill_t *ill; 6695 mblk_t *mp; 6696 6697 /* parameter sanity */ 6698 if (ifname == NULL || target == NULL) 6699 return (NULL); 6700 6701 switch (target->sa_family) { 6702 case AF_INET : 6703 sap = IP_DL_SAP; 6704 break; 6705 case AF_INET6 : 6706 sap = IP6_DL_SAP; 6707 break; 6708 default: 6709 return (NULL); 6710 } 6711 6712 /* Lock ill_g_lock before walking through the list */ 6713 rw_enter(&ill_g_lock, RW_READER); 6714 /* 6715 * Can we find the interface name among those currently configured? 6716 */ 6717 for (ill = ILL_START_WALK_ALL(&ctx); ill != NULL; 6718 ill = ill_next(&ctx, ill)) { 6719 if ((strcmp(ifname, ill->ill_name) == 0) && 6720 (ill->ill_sap == sap)) 6721 break; 6722 } 6723 if (ill == NULL || ill->ill_ipif == NULL) { 6724 rw_exit(&ill_g_lock); 6725 return (NULL); 6726 } 6727 6728 mutex_enter(&ill->ill_lock); 6729 if (!ILL_CAN_LOOKUP(ill)) { 6730 mutex_exit(&ill->ill_lock); 6731 rw_exit(&ill_g_lock); 6732 return (NULL); 6733 } 6734 ill_refhold_locked(ill); 6735 mutex_exit(&ill->ill_lock); 6736 rw_exit(&ill_g_lock); 6737 6738 gw = NULL; 6739 /* Find the resolver entry, if it exists. */ 6740 switch (target->sa_family) { 6741 case AF_INET: 6742 dir = ire_route_lookup( 6743 ((struct sockaddr_in *)target)->sin_addr.s_addr, 6744 0xffffffff, 6745 0, 0, ill->ill_ipif, &gw, ALL_ZONES, 6746 MATCH_IRE_DSTONLY|MATCH_IRE_DEFAULT| 6747 MATCH_IRE_RECURSIVE|MATCH_IRE_IPIF); 6748 break; 6749 case AF_INET6: 6750 dir = ire_route_lookup_v6( 6751 &((struct sockaddr_in6 *)target)->sin6_addr, NULL, 6752 0, 0, ill->ill_ipif, &gw, ALL_ZONES, 6753 MATCH_IRE_DSTONLY|MATCH_IRE_DEFAULT| 6754 MATCH_IRE_RECURSIVE|MATCH_IRE_IPIF); 6755 if ((dir != NULL) && (dir->ire_nce == NULL)) { 6756 ire_refrele(dir); 6757 dir = NULL; 6758 } 6759 break; 6760 default: 6761 dir = NULL; 6762 break; 6763 } 6764 6765 ill_refrele(ill); 6766 6767 if (dir == NULL) 6768 return (NULL); 6769 6770 /* Return a copy of the header to the caller. */ 6771 switch (target->sa_family) { 6772 case AF_INET : 6773 if (dir->ire_fp_mp != NULL) { 6774 if ((mp = dupb(dir->ire_fp_mp)) == NULL) 6775 mp = copyb(dir->ire_fp_mp); 6776 } else if (dir->ire_dlureq_mp != NULL) { 6777 if ((mp = dupb(dir->ire_dlureq_mp)) == NULL) 6778 mp = copyb(dir->ire_dlureq_mp); 6779 } else { 6780 mp = NULL; 6781 } 6782 break; 6783 case AF_INET6 : 6784 nce = dir->ire_nce; 6785 if (nce->nce_fp_mp != NULL) { 6786 if ((mp = dupb(nce->nce_fp_mp)) == NULL) 6787 mp = copyb(nce->nce_fp_mp); 6788 } else if (nce->nce_res_mp != NULL) { 6789 if ((mp = dupb(nce->nce_res_mp)) == NULL) 6790 mp = copyb(nce->nce_res_mp); 6791 } else { 6792 mp = NULL; 6793 } 6794 break; 6795 } 6796 6797 ire_refrele(dir); 6798 return (mp); 6799 } 6800 6801 /* 6802 * IRE iterator for inbound and loopback broadcast processing. 6803 * Given an IRE_BROADCAST ire, walk the ires with the same destination 6804 * address, but skip over the passed-in ire. Returns the next ire without 6805 * a hold - assumes that the caller holds a reference on the IRE bucket. 6806 */ 6807 ire_t * 6808 ire_get_next_bcast_ire(ire_t *curr, ire_t *ire) 6809 { 6810 ill_t *ill; 6811 6812 if (curr == NULL) { 6813 for (curr = ire->ire_bucket->irb_ire; curr != NULL; 6814 curr = curr->ire_next) { 6815 if (curr->ire_addr == ire->ire_addr) 6816 break; 6817 } 6818 } else { 6819 curr = curr->ire_next; 6820 } 6821 ill = ire_to_ill(ire); 6822 for (; curr != NULL; curr = curr->ire_next) { 6823 if (curr->ire_addr != ire->ire_addr) { 6824 /* 6825 * All the IREs to a given destination are contiguous; 6826 * break out once the address doesn't match. 6827 */ 6828 break; 6829 } 6830 if (curr == ire) { 6831 /* skip over the passed-in ire */ 6832 continue; 6833 } 6834 if ((curr->ire_stq != NULL && ire->ire_stq == NULL) || 6835 (curr->ire_stq == NULL && ire->ire_stq != NULL)) { 6836 /* 6837 * If the passed-in ire is loopback, skip over 6838 * non-loopback ires and vice versa. 6839 */ 6840 continue; 6841 } 6842 if (ire_to_ill(curr) != ill) { 6843 /* skip over IREs going through a different interface */ 6844 continue; 6845 } 6846 if (curr->ire_marks & IRE_MARK_CONDEMNED) { 6847 /* skip over deleted IREs */ 6848 continue; 6849 } 6850 return (curr); 6851 } 6852 return (NULL); 6853 } 6854 6855 /* 6856 * IRE iterator used by ire_ftable_lookup[_v6]() to process multiple default 6857 * routes. Given a starting point in the hash list (ire_origin), walk the IREs 6858 * in the bucket skipping default interface routes and deleted entries. 6859 * Returns the next IRE (unheld), or NULL when we're back to the starting point. 6860 * Assumes that the caller holds a reference on the IRE bucket. 6861 */ 6862 ire_t * 6863 ire_get_next_default_ire(ire_t *ire, ire_t *ire_origin) 6864 { 6865 ASSERT(ire_origin->ire_bucket != NULL); 6866 ASSERT(ire != NULL); 6867 6868 do { 6869 ire = ire->ire_next; 6870 if (ire == NULL) 6871 ire = ire_origin->ire_bucket->irb_ire; 6872 if (ire == ire_origin) 6873 return (NULL); 6874 } while ((ire->ire_type & IRE_INTERFACE) || 6875 (ire->ire_marks & IRE_MARK_CONDEMNED)); 6876 ASSERT(ire != NULL); 6877 return (ire); 6878 } 6879 6880 #ifdef IRE_DEBUG 6881 th_trace_t * 6882 th_trace_ire_lookup(ire_t *ire) 6883 { 6884 int bucket_id; 6885 th_trace_t *th_trace; 6886 6887 ASSERT(MUTEX_HELD(&ire->ire_lock)); 6888 6889 bucket_id = IP_TR_HASH(curthread); 6890 ASSERT(bucket_id < IP_TR_HASH_MAX); 6891 6892 for (th_trace = ire->ire_trace[bucket_id]; th_trace != NULL; 6893 th_trace = th_trace->th_next) { 6894 if (th_trace->th_id == curthread) 6895 return (th_trace); 6896 } 6897 return (NULL); 6898 } 6899 6900 void 6901 ire_trace_ref(ire_t *ire) 6902 { 6903 int bucket_id; 6904 th_trace_t *th_trace; 6905 6906 /* 6907 * Attempt to locate the trace buffer for the curthread. 6908 * If it does not exist, then allocate a new trace buffer 6909 * and link it in list of trace bufs for this ipif, at the head 6910 */ 6911 mutex_enter(&ire->ire_lock); 6912 if (ire->ire_trace_disable == B_TRUE) { 6913 mutex_exit(&ire->ire_lock); 6914 return; 6915 } 6916 th_trace = th_trace_ire_lookup(ire); 6917 if (th_trace == NULL) { 6918 bucket_id = IP_TR_HASH(curthread); 6919 th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t), 6920 KM_NOSLEEP); 6921 if (th_trace == NULL) { 6922 ire->ire_trace_disable = B_TRUE; 6923 mutex_exit(&ire->ire_lock); 6924 ire_trace_inactive(ire); 6925 return; 6926 } 6927 6928 th_trace->th_id = curthread; 6929 th_trace->th_next = ire->ire_trace[bucket_id]; 6930 th_trace->th_prev = &ire->ire_trace[bucket_id]; 6931 if (th_trace->th_next != NULL) 6932 th_trace->th_next->th_prev = &th_trace->th_next; 6933 ire->ire_trace[bucket_id] = th_trace; 6934 } 6935 ASSERT(th_trace->th_refcnt < TR_BUF_MAX - 1); 6936 th_trace->th_refcnt++; 6937 th_trace_rrecord(th_trace); 6938 mutex_exit(&ire->ire_lock); 6939 } 6940 6941 void 6942 ire_trace_free(th_trace_t *th_trace) 6943 { 6944 /* unlink th_trace and free it */ 6945 *th_trace->th_prev = th_trace->th_next; 6946 if (th_trace->th_next != NULL) 6947 th_trace->th_next->th_prev = th_trace->th_prev; 6948 th_trace->th_next = NULL; 6949 th_trace->th_prev = NULL; 6950 kmem_free(th_trace, sizeof (th_trace_t)); 6951 } 6952 6953 void 6954 ire_untrace_ref(ire_t *ire) 6955 { 6956 th_trace_t *th_trace; 6957 6958 mutex_enter(&ire->ire_lock); 6959 6960 if (ire->ire_trace_disable == B_TRUE) { 6961 mutex_exit(&ire->ire_lock); 6962 return; 6963 } 6964 6965 th_trace = th_trace_ire_lookup(ire); 6966 ASSERT(th_trace != NULL && th_trace->th_refcnt > 0); 6967 th_trace_rrecord(th_trace); 6968 th_trace->th_refcnt--; 6969 6970 if (th_trace->th_refcnt == 0) 6971 ire_trace_free(th_trace); 6972 6973 mutex_exit(&ire->ire_lock); 6974 } 6975 6976 static void 6977 ire_trace_inactive(ire_t *ire) 6978 { 6979 th_trace_t *th_trace; 6980 int i; 6981 6982 mutex_enter(&ire->ire_lock); 6983 for (i = 0; i < IP_TR_HASH_MAX; i++) { 6984 while (ire->ire_trace[i] != NULL) { 6985 th_trace = ire->ire_trace[i]; 6986 6987 /* unlink th_trace and free it */ 6988 ire->ire_trace[i] = th_trace->th_next; 6989 if (th_trace->th_next != NULL) 6990 th_trace->th_next->th_prev = 6991 &ire->ire_trace[i]; 6992 6993 th_trace->th_next = NULL; 6994 th_trace->th_prev = NULL; 6995 kmem_free(th_trace, sizeof (th_trace_t)); 6996 } 6997 } 6998 6999 mutex_exit(&ire->ire_lock); 7000 } 7001 7002 /* ARGSUSED */ 7003 void 7004 ire_thread_exit(ire_t *ire, caddr_t arg) 7005 { 7006 th_trace_t *th_trace; 7007 7008 mutex_enter(&ire->ire_lock); 7009 th_trace = th_trace_ire_lookup(ire); 7010 if (th_trace == NULL) { 7011 mutex_exit(&ire->ire_lock); 7012 return; 7013 } 7014 ASSERT(th_trace->th_refcnt == 0); 7015 7016 ire_trace_free(th_trace); 7017 mutex_exit(&ire->ire_lock); 7018 } 7019 7020 #endif 7021