1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 1990 Mentat Inc. 27 */ 28 29 /* 30 * This file contains the interface control functions for IPv6. 31 */ 32 33 #include <sys/types.h> 34 #include <sys/sysmacros.h> 35 #include <sys/stream.h> 36 #include <sys/dlpi.h> 37 #include <sys/stropts.h> 38 #include <sys/ddi.h> 39 #include <sys/cmn_err.h> 40 #include <sys/kstat.h> 41 #include <sys/debug.h> 42 #include <sys/zone.h> 43 #include <sys/policy.h> 44 45 #include <sys/systm.h> 46 #include <sys/param.h> 47 #include <sys/socket.h> 48 #include <sys/isa_defs.h> 49 #include <net/if.h> 50 #include <net/if_dl.h> 51 #include <net/route.h> 52 #include <netinet/in.h> 53 #include <netinet/igmp_var.h> 54 #include <netinet/ip6.h> 55 #include <netinet/icmp6.h> 56 #include <netinet/in.h> 57 58 #include <inet/common.h> 59 #include <inet/nd.h> 60 #include <inet/mib2.h> 61 #include <inet/ip.h> 62 #include <inet/ip6.h> 63 #include <inet/ip_multi.h> 64 #include <inet/ip_ire.h> 65 #include <inet/ip_rts.h> 66 #include <inet/ip_ndp.h> 67 #include <inet/ip_if.h> 68 #include <inet/ip6_asp.h> 69 #include <inet/tun.h> 70 #include <inet/ipclassifier.h> 71 #include <inet/sctp_ip.h> 72 73 #include <sys/tsol/tndb.h> 74 #include <sys/tsol/tnet.h> 75 76 static in6_addr_t ipv6_ll_template = 77 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 78 79 static ipif_t * 80 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 81 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst); 82 83 /* 84 * These two functions, ipif_lookup_group_v6() and ill_lookup_group_v6(), 85 * are called when an application does not specify an interface to be 86 * used for multicast traffic. It calls ire_lookup_multi_v6() to look 87 * for an interface route for the specified multicast group. Doing 88 * this allows the administrator to add prefix routes for multicast to 89 * indicate which interface to be used for multicast traffic in the above 90 * scenario. The route could be for all multicast (ff00::/8), for a single 91 * multicast group (a /128 route) or anything in between. If there is no 92 * such multicast route, we just find any multicast capable interface and 93 * return it. 94 */ 95 ipif_t * 96 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst) 97 { 98 ire_t *ire; 99 ipif_t *ipif; 100 101 ire = ire_lookup_multi_v6(group, zoneid, ipst); 102 if (ire != NULL) { 103 ipif = ire->ire_ipif; 104 ipif_refhold(ipif); 105 ire_refrele(ire); 106 return (ipif); 107 } 108 109 return (ipif_lookup_multicast(ipst, zoneid, B_TRUE)); 110 } 111 112 ill_t * 113 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst) 114 { 115 ire_t *ire; 116 ill_t *ill; 117 ipif_t *ipif; 118 119 ire = ire_lookup_multi_v6(group, zoneid, ipst); 120 if (ire != NULL) { 121 ill = ire->ire_ipif->ipif_ill; 122 ill_refhold(ill); 123 ire_refrele(ire); 124 return (ill); 125 } 126 127 ipif = ipif_lookup_multicast(ipst, zoneid, B_TRUE); 128 if (ipif == NULL) 129 return (NULL); 130 131 ill = ipif->ipif_ill; 132 ill_refhold(ill); 133 ipif_refrele(ipif); 134 return (ill); 135 } 136 137 /* 138 * Look for an ipif with the specified interface address and destination. 139 * The destination address is used only for matching point-to-point interfaces. 140 */ 141 static ipif_t * 142 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 143 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst) 144 { 145 ipif_t *ipif; 146 ill_t *ill; 147 ipsq_t *ipsq; 148 ill_walk_context_t ctx; 149 150 if (error != NULL) 151 *error = 0; 152 153 /* 154 * First match all the point-to-point interfaces 155 * before looking at non-point-to-point interfaces. 156 * This is done to avoid returning non-point-to-point 157 * ipif instead of unnumbered point-to-point ipif. 158 */ 159 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 160 ill = ILL_START_WALK_V6(&ctx, ipst); 161 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 162 GRAB_CONN_LOCK(q); 163 mutex_enter(&ill->ill_lock); 164 for (ipif = ill->ill_ipif; ipif != NULL; 165 ipif = ipif->ipif_next) { 166 /* Allow the ipif to be down */ 167 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 168 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 169 if_addr)) && 170 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 171 dst))) { 172 if (IPIF_CAN_LOOKUP(ipif)) { 173 ipif_refhold_locked(ipif); 174 mutex_exit(&ill->ill_lock); 175 RELEASE_CONN_LOCK(q); 176 rw_exit(&ipst->ips_ill_g_lock); 177 return (ipif); 178 } else if (IPIF_CAN_WAIT(ipif, q)) { 179 ipsq = ill->ill_phyint->phyint_ipsq; 180 mutex_enter(&ipsq->ipsq_lock); 181 mutex_exit(&ill->ill_lock); 182 rw_exit(&ipst->ips_ill_g_lock); 183 ipsq_enq(ipsq, q, mp, func, NEW_OP, 184 ill); 185 mutex_exit(&ipsq->ipsq_lock); 186 RELEASE_CONN_LOCK(q); 187 if (error != NULL) 188 *error = EINPROGRESS; 189 return (NULL); 190 } 191 } 192 } 193 mutex_exit(&ill->ill_lock); 194 RELEASE_CONN_LOCK(q); 195 } 196 rw_exit(&ipst->ips_ill_g_lock); 197 /* lookup the ipif based on interface address */ 198 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func, 199 error, ipst); 200 ASSERT(ipif == NULL || ipif->ipif_isv6); 201 return (ipif); 202 } 203 204 /* 205 * Look for an ipif with the specified address. For point-point links 206 * we look for matches on either the destination address and the local 207 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 208 * is set. 209 * Matches on a specific ill if match_ill is set. 210 */ 211 /* ARGSUSED */ 212 ipif_t * 213 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 214 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst) 215 { 216 ipif_t *ipif; 217 ill_t *ill; 218 boolean_t ptp = B_FALSE; 219 ipsq_t *ipsq; 220 ill_walk_context_t ctx; 221 222 if (error != NULL) 223 *error = 0; 224 225 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 226 /* 227 * Repeat twice, first based on local addresses and 228 * next time for pointopoint. 229 */ 230 repeat: 231 ill = ILL_START_WALK_V6(&ctx, ipst); 232 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 233 if (match_ill != NULL && ill != match_ill) { 234 continue; 235 } 236 GRAB_CONN_LOCK(q); 237 mutex_enter(&ill->ill_lock); 238 for (ipif = ill->ill_ipif; ipif != NULL; 239 ipif = ipif->ipif_next) { 240 if (zoneid != ALL_ZONES && 241 ipif->ipif_zoneid != zoneid && 242 ipif->ipif_zoneid != ALL_ZONES) 243 continue; 244 /* Allow the ipif to be down */ 245 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 246 &ipif->ipif_v6lcl_addr, addr) && 247 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 248 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 249 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 250 addr))) { 251 if (IPIF_CAN_LOOKUP(ipif)) { 252 ipif_refhold_locked(ipif); 253 mutex_exit(&ill->ill_lock); 254 RELEASE_CONN_LOCK(q); 255 rw_exit(&ipst->ips_ill_g_lock); 256 return (ipif); 257 } else if (IPIF_CAN_WAIT(ipif, q)) { 258 ipsq = ill->ill_phyint->phyint_ipsq; 259 mutex_enter(&ipsq->ipsq_lock); 260 mutex_exit(&ill->ill_lock); 261 rw_exit(&ipst->ips_ill_g_lock); 262 ipsq_enq(ipsq, q, mp, func, NEW_OP, 263 ill); 264 mutex_exit(&ipsq->ipsq_lock); 265 RELEASE_CONN_LOCK(q); 266 if (error != NULL) 267 *error = EINPROGRESS; 268 return (NULL); 269 } 270 } 271 } 272 mutex_exit(&ill->ill_lock); 273 RELEASE_CONN_LOCK(q); 274 } 275 276 /* If we already did the ptp case, then we are done */ 277 if (ptp) { 278 rw_exit(&ipst->ips_ill_g_lock); 279 if (error != NULL) 280 *error = ENXIO; 281 return (NULL); 282 } 283 ptp = B_TRUE; 284 goto repeat; 285 } 286 287 /* 288 * Look for an ipif with the specified address. For point-point links 289 * we look for matches on either the destination address and the local 290 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 291 * is set. 292 * Matches on a specific ill if match_ill is set. 293 * Return the zoneid for the ipif. ALL_ZONES if none found. 294 */ 295 zoneid_t 296 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill, 297 ip_stack_t *ipst) 298 { 299 ipif_t *ipif; 300 ill_t *ill; 301 boolean_t ptp = B_FALSE; 302 ill_walk_context_t ctx; 303 zoneid_t zoneid; 304 305 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 306 /* 307 * Repeat twice, first based on local addresses and 308 * next time for pointopoint. 309 */ 310 repeat: 311 ill = ILL_START_WALK_V6(&ctx, ipst); 312 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 313 if (match_ill != NULL && ill != match_ill) { 314 continue; 315 } 316 mutex_enter(&ill->ill_lock); 317 for (ipif = ill->ill_ipif; ipif != NULL; 318 ipif = ipif->ipif_next) { 319 /* Allow the ipif to be down */ 320 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 321 &ipif->ipif_v6lcl_addr, addr) && 322 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 323 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 324 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 325 addr)) && 326 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) { 327 zoneid = ipif->ipif_zoneid; 328 mutex_exit(&ill->ill_lock); 329 rw_exit(&ipst->ips_ill_g_lock); 330 /* 331 * If ipif_zoneid was ALL_ZONES then we have 332 * a trusted extensions shared IP address. 333 * In that case GLOBAL_ZONEID works to send. 334 */ 335 if (zoneid == ALL_ZONES) 336 zoneid = GLOBAL_ZONEID; 337 return (zoneid); 338 } 339 } 340 mutex_exit(&ill->ill_lock); 341 } 342 343 /* If we already did the ptp case, then we are done */ 344 if (ptp) { 345 rw_exit(&ipst->ips_ill_g_lock); 346 return (ALL_ZONES); 347 } 348 ptp = B_TRUE; 349 goto repeat; 350 } 351 352 /* 353 * Perform various checks to verify that an address would make sense as a local 354 * interface address. This is currently only called when an attempt is made 355 * to set a local address. 356 * 357 * Does not allow a v4-mapped address, an address that equals the subnet 358 * anycast address, ... a multicast address, ... 359 */ 360 boolean_t 361 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 362 { 363 in6_addr_t subnet; 364 365 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 366 return (B_TRUE); /* Allow all zeros */ 367 368 /* 369 * Don't allow all zeroes or host part, but allow 370 * all ones netmask. 371 */ 372 V6_MASK_COPY(*addr, *subnet_mask, subnet); 373 if (IN6_IS_ADDR_V4MAPPED(addr) || 374 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 375 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 376 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 377 IN6_IS_ADDR_MULTICAST(addr)) 378 return (B_FALSE); 379 380 return (B_TRUE); 381 } 382 383 /* 384 * Perform various checks to verify that an address would make sense as a 385 * remote/subnet interface address. 386 */ 387 boolean_t 388 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 389 { 390 in6_addr_t subnet; 391 392 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 393 return (B_TRUE); /* Allow all zeros */ 394 395 V6_MASK_COPY(*addr, *subnet_mask, subnet); 396 if (IN6_IS_ADDR_V4MAPPED(addr) || 397 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 398 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 399 IN6_IS_ADDR_MULTICAST(addr) || 400 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 401 return (B_FALSE); 402 403 return (B_TRUE); 404 } 405 406 /* 407 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 408 * ipif_arg is passed in to associate it with the correct interface 409 * (for link-local destinations and gateways). 410 */ 411 /* ARGSUSED1 */ 412 int 413 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 414 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 415 ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func, 416 struct rtsa_s *sp, ip_stack_t *ipst) 417 { 418 ire_t *ire; 419 ire_t *gw_ire = NULL; 420 ipif_t *ipif; 421 boolean_t ipif_refheld = B_FALSE; 422 uint_t type; 423 int match_flags = MATCH_IRE_TYPE; 424 int error; 425 tsol_gc_t *gc = NULL; 426 tsol_gcgrp_t *gcgrp = NULL; 427 boolean_t gcgrp_xtraref = B_FALSE; 428 429 if (ire_arg != NULL) 430 *ire_arg = NULL; 431 432 /* 433 * Prevent routes with a zero gateway from being created (since 434 * interfaces can currently be plumbed and brought up with no assigned 435 * address). 436 */ 437 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 438 return (ENETUNREACH); 439 440 /* 441 * If this is the case of RTF_HOST being set, then we set the netmask 442 * to all ones (regardless if one was supplied). 443 */ 444 if (flags & RTF_HOST) 445 mask = &ipv6_all_ones; 446 447 /* 448 * Get the ipif, if any, corresponding to the gw_addr 449 */ 450 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, 451 &error, ipst); 452 if (ipif != NULL) 453 ipif_refheld = B_TRUE; 454 else if (error == EINPROGRESS) { 455 ip1dbg(("ip_rt_add_v6: null and EINPROGRESS")); 456 return (error); 457 } 458 459 /* 460 * GateD will attempt to create routes with a loopback interface 461 * address as the gateway and with RTF_GATEWAY set. We allow 462 * these routes to be added, but create them as interface routes 463 * since the gateway is an interface address. 464 */ 465 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) { 466 flags &= ~RTF_GATEWAY; 467 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) && 468 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) && 469 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) { 470 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 471 ipif, ALL_ZONES, NULL, match_flags, ipst); 472 if (ire != NULL) { 473 ire_refrele(ire); 474 if (ipif_refheld) 475 ipif_refrele(ipif); 476 return (EEXIST); 477 } 478 ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x" 479 "for 0x%x\n", (void *)ipif, 480 ipif->ipif_ire_type, 481 ntohl(ipif->ipif_lcl_addr))); 482 ire = ire_create_v6( 483 dst_addr, 484 mask, 485 &ipif->ipif_v6src_addr, 486 NULL, 487 &ipif->ipif_mtu, 488 NULL, 489 NULL, 490 NULL, 491 ipif->ipif_net_type, 492 ipif, 493 NULL, 494 0, 495 0, 496 flags, 497 &ire_uinfo_null, 498 NULL, 499 NULL, 500 ipst); 501 if (ire == NULL) { 502 if (ipif_refheld) 503 ipif_refrele(ipif); 504 return (ENOMEM); 505 } 506 error = ire_add(&ire, q, mp, func, B_FALSE); 507 if (error == 0) 508 goto save_ire; 509 /* 510 * In the result of failure, ire_add() will have already 511 * deleted the ire in question, so there is no need to 512 * do that here. 513 */ 514 if (ipif_refheld) 515 ipif_refrele(ipif); 516 return (error); 517 } 518 } 519 520 /* 521 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 522 * and the gateway address provided is one of the system's interface 523 * addresses. By using the routing socket interface and supplying an 524 * RTA_IFP sockaddr with an interface index, an alternate method of 525 * specifying an interface route to be created is available which uses 526 * the interface index that specifies the outgoing interface rather than 527 * the address of an outgoing interface (which may not be able to 528 * uniquely identify an interface). When coupled with the RTF_GATEWAY 529 * flag, routes can be specified which not only specify the next-hop to 530 * be used when routing to a certain prefix, but also which outgoing 531 * interface should be used. 532 * 533 * Previously, interfaces would have unique addresses assigned to them 534 * and so the address assigned to a particular interface could be used 535 * to identify a particular interface. One exception to this was the 536 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 537 * 538 * With the advent of IPv6 and its link-local addresses, this 539 * restriction was relaxed and interfaces could share addresses between 540 * themselves. In fact, typically all of the link-local interfaces on 541 * an IPv6 node or router will have the same link-local address. In 542 * order to differentiate between these interfaces, the use of an 543 * interface index is necessary and this index can be carried inside a 544 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 545 * of using the interface index, however, is that all of the ipif's that 546 * are part of an ill have the same index and so the RTA_IFP sockaddr 547 * cannot be used to differentiate between ipif's (or logical 548 * interfaces) that belong to the same ill (physical interface). 549 * 550 * For example, in the following case involving IPv4 interfaces and 551 * logical interfaces 552 * 553 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 554 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0:1 555 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0:2 556 * 557 * the ipif's corresponding to each of these interface routes can be 558 * uniquely identified by the "gateway" (actually interface address). 559 * 560 * In this case involving multiple IPv6 default routes to a particular 561 * link-local gateway, the use of RTA_IFP is necessary to specify which 562 * default route is of interest: 563 * 564 * default fe80::123:4567:89ab:cdef U if0 565 * default fe80::123:4567:89ab:cdef U if1 566 */ 567 568 /* RTF_GATEWAY not set */ 569 if (!(flags & RTF_GATEWAY)) { 570 queue_t *stq; 571 572 if (sp != NULL) { 573 ip2dbg(("ip_rt_add_v6: gateway security attributes " 574 "cannot be set with interface route\n")); 575 if (ipif_refheld) 576 ipif_refrele(ipif); 577 return (EINVAL); 578 } 579 580 /* 581 * As the interface index specified with the RTA_IFP sockaddr is 582 * the same for all ipif's off of an ill, the matching logic 583 * below uses MATCH_IRE_ILL if such an index was specified. 584 * This means that routes sharing the same prefix when added 585 * using a RTA_IFP sockaddr must have distinct interface 586 * indices (namely, they must be on distinct ill's). 587 * 588 * On the other hand, since the gateway address will usually be 589 * different for each ipif on the system, the matching logic 590 * uses MATCH_IRE_IPIF in the case of a traditional interface 591 * route. This means that interface routes for the same prefix 592 * can be created if they belong to distinct ipif's and if a 593 * RTA_IFP sockaddr is not present. 594 */ 595 if (ipif_arg != NULL) { 596 if (ipif_refheld) { 597 ipif_refrele(ipif); 598 ipif_refheld = B_FALSE; 599 } 600 ipif = ipif_arg; 601 match_flags |= MATCH_IRE_ILL; 602 } else { 603 /* 604 * Check the ipif corresponding to the gw_addr 605 */ 606 if (ipif == NULL) 607 return (ENETUNREACH); 608 match_flags |= MATCH_IRE_IPIF; 609 } 610 611 ASSERT(ipif != NULL); 612 /* 613 * We check for an existing entry at this point. 614 */ 615 match_flags |= MATCH_IRE_MASK; 616 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE, 617 ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 618 if (ire != NULL) { 619 ire_refrele(ire); 620 if (ipif_refheld) 621 ipif_refrele(ipif); 622 return (EEXIST); 623 } 624 625 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 626 ? ipif->ipif_rq : ipif->ipif_wq; 627 628 /* 629 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or 630 * IRE_IF_RESOLVER with the modified address and netmask. 631 */ 632 ire = ire_create_v6( 633 dst_addr, 634 mask, 635 &ipif->ipif_v6src_addr, 636 NULL, 637 &ipif->ipif_mtu, 638 NULL, 639 NULL, 640 stq, 641 ipif->ipif_net_type, 642 ipif, 643 NULL, 644 0, 645 0, 646 flags, 647 &ire_uinfo_null, 648 NULL, 649 NULL, 650 ipst); 651 if (ire == NULL) { 652 if (ipif_refheld) 653 ipif_refrele(ipif); 654 return (ENOMEM); 655 } 656 657 /* 658 * Some software (for example, GateD and Sun Cluster) attempts 659 * to create (what amount to) IRE_PREFIX routes with the 660 * loopback address as the gateway. This is primarily done to 661 * set up prefixes with the RTF_REJECT flag set (for example, 662 * when generating aggregate routes). We also OR in the 663 * RTF_BLACKHOLE flag as these interface routes, by 664 * definition, can only be that. 665 * 666 * If the IRE type (as defined by ipif->ipif_net_type) is 667 * IRE_LOOPBACK, then we map the request into a 668 * IRE_IF_NORESOLVER. 669 * 670 * Needless to say, the real IRE_LOOPBACK is NOT created by this 671 * routine, but rather using ire_create_v6() directly. 672 */ 673 if (ipif->ipif_net_type == IRE_LOOPBACK) { 674 ire->ire_type = IRE_IF_NORESOLVER; 675 ire->ire_flags |= RTF_BLACKHOLE; 676 } 677 error = ire_add(&ire, q, mp, func, B_FALSE); 678 if (error == 0) 679 goto save_ire; 680 /* 681 * In the result of failure, ire_add() will have already 682 * deleted the ire in question, so there is no need to 683 * do that here. 684 */ 685 if (ipif_refheld) 686 ipif_refrele(ipif); 687 return (error); 688 } 689 if (ipif_refheld) { 690 ipif_refrele(ipif); 691 ipif_refheld = B_FALSE; 692 } 693 694 /* 695 * Get an interface IRE for the specified gateway. 696 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 697 * gateway, it is currently unreachable and we fail the request 698 * accordingly. 699 */ 700 ipif = ipif_arg; 701 if (ipif_arg != NULL) 702 match_flags |= MATCH_IRE_ILL; 703 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, 704 NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 705 if (gw_ire == NULL) 706 return (ENETUNREACH); 707 708 /* 709 * We create one of three types of IREs as a result of this request 710 * based on the netmask. A netmask of all ones (which is automatically 711 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 712 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 713 * created. Otherwise, an IRE_PREFIX route is created for the 714 * destination prefix. 715 */ 716 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 717 type = IRE_HOST; 718 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 719 type = IRE_DEFAULT; 720 else 721 type = IRE_PREFIX; 722 723 /* check for a duplicate entry */ 724 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg, 725 NULL, ALL_ZONES, 0, NULL, 726 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst); 727 if (ire != NULL) { 728 ire_refrele(gw_ire); 729 ire_refrele(ire); 730 return (EEXIST); 731 } 732 733 /* Security attribute exists */ 734 if (sp != NULL) { 735 tsol_gcgrp_addr_t ga; 736 737 /* find or create the gateway credentials group */ 738 ga.ga_af = AF_INET6; 739 ga.ga_addr = *gw_addr; 740 741 /* we hold reference to it upon success */ 742 gcgrp = gcgrp_lookup(&ga, B_TRUE); 743 if (gcgrp == NULL) { 744 ire_refrele(gw_ire); 745 return (ENOMEM); 746 } 747 748 /* 749 * Create and add the security attribute to the group; a 750 * reference to the group is made upon allocating a new 751 * entry successfully. If it finds an already-existing 752 * entry for the security attribute in the group, it simply 753 * returns it and no new reference is made to the group. 754 */ 755 gc = gc_create(sp, gcgrp, &gcgrp_xtraref); 756 if (gc == NULL) { 757 /* release reference held by gcgrp_lookup */ 758 GCGRP_REFRELE(gcgrp); 759 ire_refrele(gw_ire); 760 return (ENOMEM); 761 } 762 } 763 764 /* Create the IRE. */ 765 ire = ire_create_v6( 766 dst_addr, /* dest address */ 767 mask, /* mask */ 768 /* src address assigned by the caller? */ 769 (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ? 770 src_addr : NULL), 771 gw_addr, /* gateway address */ 772 &gw_ire->ire_max_frag, 773 NULL, /* no src nce */ 774 NULL, /* no recv-from queue */ 775 NULL, /* no send-to queue */ 776 (ushort_t)type, /* IRE type */ 777 ipif_arg, 778 NULL, 779 0, 780 0, 781 flags, 782 &gw_ire->ire_uinfo, /* Inherit ULP info from gw */ 783 gc, /* security attribute */ 784 NULL, 785 ipst); 786 787 /* 788 * The ire holds a reference to the 'gc' and the 'gc' holds a 789 * reference to the 'gcgrp'. We can now release the extra reference 790 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used. 791 */ 792 if (gcgrp_xtraref) 793 GCGRP_REFRELE(gcgrp); 794 if (ire == NULL) { 795 if (gc != NULL) 796 GC_REFRELE(gc); 797 ire_refrele(gw_ire); 798 return (ENOMEM); 799 } 800 801 /* 802 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 803 * SUN/OS socket stuff does but do we really want to allow ::0 ? 804 */ 805 806 /* Add the new IRE. */ 807 error = ire_add(&ire, q, mp, func, B_FALSE); 808 /* 809 * In the result of failure, ire_add() will have already 810 * deleted the ire in question, so there is no need to 811 * do that here. 812 */ 813 if (error != 0) { 814 ire_refrele(gw_ire); 815 return (error); 816 } 817 818 if (flags & RTF_MULTIRT) { 819 /* 820 * Invoke the CGTP (multirouting) filtering module 821 * to add the dst address in the filtering database. 822 * Replicated inbound packets coming from that address 823 * will be filtered to discard the duplicates. 824 * It is not necessary to call the CGTP filter hook 825 * when the dst address is a multicast, because an 826 * IP source address cannot be a multicast. 827 */ 828 if (ipst->ips_ip_cgtp_filter_ops != NULL && 829 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 830 int res; 831 832 res = ipst->ips_ip_cgtp_filter_ops->cfo_add_dest_v6( 833 ipst->ips_netstack->netstack_stackid, 834 &ire->ire_addr_v6, 835 &ire->ire_gateway_addr_v6, 836 &ire->ire_src_addr_v6, 837 &gw_ire->ire_src_addr_v6); 838 if (res != 0) { 839 ire_refrele(gw_ire); 840 ire_delete(ire); 841 return (res); 842 } 843 } 844 } 845 846 /* 847 * Now that the prefix IRE entry has been created, delete any 848 * existing gateway IRE cache entries as well as any IRE caches 849 * using the gateway, and force them to be created through 850 * ip_newroute_v6. 851 */ 852 if (gc != NULL) { 853 ASSERT(gcgrp != NULL); 854 ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES, ipst); 855 } 856 857 save_ire: 858 if (gw_ire != NULL) { 859 ire_refrele(gw_ire); 860 } 861 if (ipif != NULL) { 862 mblk_t *save_mp; 863 864 /* 865 * Save enough information so that we can recreate the IRE if 866 * the interface goes down and then up. The metrics associated 867 * with the route will be saved as well when rts_setmetrics() is 868 * called after the IRE has been created. In the case where 869 * memory cannot be allocated, none of this information will be 870 * saved. 871 */ 872 save_mp = allocb(sizeof (ifrt_t), BPRI_MED); 873 if (save_mp != NULL) { 874 ifrt_t *ifrt; 875 876 save_mp->b_wptr += sizeof (ifrt_t); 877 ifrt = (ifrt_t *)save_mp->b_rptr; 878 bzero(ifrt, sizeof (ifrt_t)); 879 ifrt->ifrt_type = ire->ire_type; 880 ifrt->ifrt_v6addr = ire->ire_addr_v6; 881 mutex_enter(&ire->ire_lock); 882 ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6; 883 ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6; 884 mutex_exit(&ire->ire_lock); 885 ifrt->ifrt_v6mask = ire->ire_mask_v6; 886 ifrt->ifrt_flags = ire->ire_flags; 887 ifrt->ifrt_max_frag = ire->ire_max_frag; 888 mutex_enter(&ipif->ipif_saved_ire_lock); 889 save_mp->b_cont = ipif->ipif_saved_ire_mp; 890 ipif->ipif_saved_ire_mp = save_mp; 891 ipif->ipif_saved_ire_cnt++; 892 mutex_exit(&ipif->ipif_saved_ire_lock); 893 } 894 } 895 if (ire_arg != NULL) { 896 /* 897 * Store the ire that was successfully added into where ire_arg 898 * points to so that callers don't have to look it up 899 * themselves (but they are responsible for ire_refrele()ing 900 * the ire when they are finished with it). 901 */ 902 *ire_arg = ire; 903 } else { 904 ire_refrele(ire); /* Held in ire_add */ 905 } 906 if (ipif_refheld) 907 ipif_refrele(ipif); 908 return (0); 909 } 910 911 /* 912 * ip_rt_delete_v6 is called to delete an IPv6 route. 913 * ipif_arg is passed in to associate it with the correct interface 914 * (for link-local destinations and gateways). 915 */ 916 /* ARGSUSED4 */ 917 int 918 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 919 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg, 920 queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst) 921 { 922 ire_t *ire = NULL; 923 ipif_t *ipif; 924 uint_t type; 925 uint_t match_flags = MATCH_IRE_TYPE; 926 int err = 0; 927 boolean_t ipif_refheld = B_FALSE; 928 929 /* 930 * If this is the case of RTF_HOST being set, then we set the netmask 931 * to all ones. Otherwise, we use the netmask if one was supplied. 932 */ 933 if (flags & RTF_HOST) { 934 mask = &ipv6_all_ones; 935 match_flags |= MATCH_IRE_MASK; 936 } else if (rtm_addrs & RTA_NETMASK) { 937 match_flags |= MATCH_IRE_MASK; 938 } 939 940 /* 941 * Note that RTF_GATEWAY is never set on a delete, therefore 942 * we check if the gateway address is one of our interfaces first, 943 * and fall back on RTF_GATEWAY routes. 944 * 945 * This makes it possible to delete an original 946 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 947 * 948 * As the interface index specified with the RTA_IFP sockaddr is the 949 * same for all ipif's off of an ill, the matching logic below uses 950 * MATCH_IRE_ILL if such an index was specified. This means a route 951 * sharing the same prefix and interface index as the the route 952 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr 953 * is specified in the request. 954 * 955 * On the other hand, since the gateway address will usually be 956 * different for each ipif on the system, the matching logic 957 * uses MATCH_IRE_IPIF in the case of a traditional interface 958 * route. This means that interface routes for the same prefix can be 959 * uniquely identified if they belong to distinct ipif's and if a 960 * RTA_IFP sockaddr is not present. 961 * 962 * For more detail on specifying routes by gateway address and by 963 * interface index, see the comments in ip_rt_add_v6(). 964 */ 965 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err, 966 ipst); 967 if (ipif != NULL) { 968 ipif_refheld = B_TRUE; 969 if (ipif_arg != NULL) { 970 ipif_refrele(ipif); 971 ipif_refheld = B_FALSE; 972 ipif = ipif_arg; 973 match_flags |= MATCH_IRE_ILL; 974 } else { 975 match_flags |= MATCH_IRE_IPIF; 976 } 977 978 if (ipif->ipif_ire_type == IRE_LOOPBACK) 979 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 980 ipif, ALL_ZONES, NULL, match_flags, ipst); 981 if (ire == NULL) 982 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, 983 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL, 984 match_flags, ipst); 985 } else if (err == EINPROGRESS) { 986 return (err); 987 } else { 988 err = 0; 989 } 990 if (ire == NULL) { 991 /* 992 * At this point, the gateway address is not one of our own 993 * addresses or a matching interface route was not found. We 994 * set the IRE type to lookup based on whether 995 * this is a host route, a default route or just a prefix. 996 * 997 * If an ipif_arg was passed in, then the lookup is based on an 998 * interface index so MATCH_IRE_ILL is added to match_flags. 999 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is 1000 * set as the route being looked up is not a traditional 1001 * interface route. 1002 */ 1003 match_flags &= ~MATCH_IRE_IPIF; 1004 match_flags |= MATCH_IRE_GW; 1005 if (ipif_arg != NULL) 1006 match_flags |= MATCH_IRE_ILL; 1007 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 1008 type = IRE_HOST; 1009 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 1010 type = IRE_DEFAULT; 1011 else 1012 type = IRE_PREFIX; 1013 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 1014 ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 1015 } 1016 1017 if (ipif_refheld) { 1018 ipif_refrele(ipif); 1019 ipif_refheld = B_FALSE; 1020 } 1021 if (ire == NULL) 1022 return (ESRCH); 1023 1024 if (ire->ire_flags & RTF_MULTIRT) { 1025 /* 1026 * Invoke the CGTP (multirouting) filtering module 1027 * to remove the dst address from the filtering database. 1028 * Packets coming from that address will no longer be 1029 * filtered to remove duplicates. 1030 */ 1031 if (ipst->ips_ip_cgtp_filter_ops != NULL) { 1032 err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v6( 1033 ipst->ips_netstack->netstack_stackid, 1034 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 1035 } 1036 } 1037 1038 ipif = ire->ire_ipif; 1039 if (ipif != NULL) { 1040 mblk_t **mpp; 1041 mblk_t *mp; 1042 ifrt_t *ifrt; 1043 in6_addr_t gw_addr_v6; 1044 1045 /* Remove from ipif_saved_ire_mp list if it is there */ 1046 mutex_enter(&ire->ire_lock); 1047 gw_addr_v6 = ire->ire_gateway_addr_v6; 1048 mutex_exit(&ire->ire_lock); 1049 mutex_enter(&ipif->ipif_saved_ire_lock); 1050 for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL; 1051 mpp = &(*mpp)->b_cont) { 1052 /* 1053 * On a given ipif, the triple of address, gateway and 1054 * mask is unique for each saved IRE (in the case of 1055 * ordinary interface routes, the gateway address is 1056 * all-zeroes). 1057 */ 1058 mp = *mpp; 1059 ifrt = (ifrt_t *)mp->b_rptr; 1060 if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr, 1061 &ire->ire_addr_v6) && 1062 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr, 1063 &gw_addr_v6) && 1064 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask, 1065 &ire->ire_mask_v6)) { 1066 *mpp = mp->b_cont; 1067 ipif->ipif_saved_ire_cnt--; 1068 freeb(mp); 1069 break; 1070 } 1071 } 1072 mutex_exit(&ipif->ipif_saved_ire_lock); 1073 } 1074 ire_delete(ire); 1075 ire_refrele(ire); 1076 return (err); 1077 } 1078 1079 /* 1080 * Derive a token from the link layer address. 1081 */ 1082 boolean_t 1083 ill_setdefaulttoken(ill_t *ill) 1084 { 1085 int i; 1086 in6_addr_t v6addr, v6mask; 1087 1088 if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length, 1089 ill->ill_phys_addr, &v6addr)) 1090 return (B_FALSE); 1091 1092 (void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask); 1093 1094 for (i = 0; i < 4; i++) 1095 v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^ 1096 (uint32_t)0xffffffff; 1097 1098 V6_MASK_COPY(v6addr, v6mask, ill->ill_token); 1099 ill->ill_token_length = IPV6_TOKEN_LEN; 1100 return (B_TRUE); 1101 } 1102 1103 /* 1104 * Create a link-local address from a token. 1105 */ 1106 static void 1107 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 1108 { 1109 int i; 1110 1111 for (i = 0; i < 4; i++) { 1112 dest->s6_addr32[i] = 1113 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 1114 } 1115 } 1116 1117 /* 1118 * Set a nice default address for either automatic tunnels tsrc/96 or 1119 * 6to4 tunnels 2002:<tsrc>::1/64 1120 */ 1121 static void 1122 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta) 1123 { 1124 sin6_t sin6; 1125 sin_t *sin; 1126 ill_t *ill = ipif->ipif_ill; 1127 tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr; 1128 1129 if (ta->ifta_saddr.ss_family != AF_INET || 1130 (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 || 1131 (ta->ifta_flags & IFTUN_SRC) == 0) 1132 return; 1133 1134 /* 1135 * Check the tunnel type by examining q_next->q_ptr 1136 */ 1137 if (tp->tun_flags & TUN_AUTOMATIC) { 1138 /* this is an automatic tunnel */ 1139 (void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS, 1140 &ipif->ipif_v6net_mask); 1141 bzero(&sin6, sizeof (sin6_t)); 1142 sin = (sin_t *)&ta->ifta_saddr; 1143 V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr; 1144 sin6.sin6_family = AF_INET6; 1145 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1146 NULL, NULL, NULL, NULL); 1147 } else if (tp->tun_flags & TUN_6TO4) { 1148 /* this is a 6to4 tunnel */ 1149 (void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN, 1150 &ipif->ipif_v6net_mask); 1151 sin = (sin_t *)&ta->ifta_saddr; 1152 /* create a 6to4 address from the IPv4 tsrc */ 1153 IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr); 1154 sin6.sin6_family = AF_INET6; 1155 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1156 NULL, NULL, NULL, NULL); 1157 } else { 1158 ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type")); 1159 return; 1160 } 1161 } 1162 1163 /* 1164 * Set link local for ipif_id 0 of a configured tunnel based on the 1165 * tsrc or tdst parameter 1166 * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as 1167 * the token. 1168 * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address 1169 * as the token for the "outer" link. 1170 */ 1171 void 1172 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta) 1173 { 1174 ipif_t *ipif; 1175 sin_t *sin; 1176 in6_addr_t *s6addr; 1177 1178 ASSERT(IAM_WRITER_ILL(ill)); 1179 1180 /* The first ipif must be id zero. */ 1181 ipif = ill->ill_ipif; 1182 ASSERT(ipif->ipif_id == 0); 1183 1184 /* no link local for automatic tunnels */ 1185 if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) { 1186 ipif_set_tun_auto_addr(ipif, ta); 1187 return; 1188 } 1189 1190 if ((ta->ifta_flags & IFTUN_DST) && 1191 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 1192 sin6_t sin6; 1193 1194 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1195 bzero(&sin6, sizeof (sin6_t)); 1196 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1197 sin = (sin_t *)&ta->ifta_daddr; 1198 V4_PART_OF_V6(sin6.sin6_addr) = 1199 sin->sin_addr.s_addr; 1200 } else { 1201 s6addr = 1202 &((sin6_t *)&ta->ifta_daddr)->sin6_addr; 1203 sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3]; 1204 sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2]; 1205 } 1206 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, 1207 &sin6.sin6_addr); 1208 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1209 } 1210 if ((ta->ifta_flags & IFTUN_SRC)) { 1211 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1212 1213 /* Set the token if it isn't already set */ 1214 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) { 1215 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1216 sin = (sin_t *)&ta->ifta_saddr; 1217 V4_PART_OF_V6(ill->ill_token) = 1218 sin->sin_addr.s_addr; 1219 } else { 1220 s6addr = 1221 &((sin6_t *)&ta->ifta_saddr)->sin6_addr; 1222 ill->ill_token.s6_addr32[3] = 1223 s6addr->s6_addr32[3]; 1224 ill->ill_token.s6_addr32[2] = 1225 s6addr->s6_addr32[2]; 1226 } 1227 ill->ill_token_length = IPV6_TOKEN_LEN; 1228 } 1229 /* 1230 * Attempt to set the link local address if it isn't set. 1231 */ 1232 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) 1233 (void) ipif_setlinklocal(ipif); 1234 } 1235 } 1236 1237 /* 1238 * Is it not possible to set the link local address? 1239 * The address can be set if the token is set, and the token 1240 * isn't too long. 1241 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1242 */ 1243 boolean_t 1244 ipif_cant_setlinklocal(ipif_t *ipif) 1245 { 1246 ill_t *ill = ipif->ipif_ill; 1247 1248 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1249 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1250 return (B_TRUE); 1251 1252 return (B_FALSE); 1253 } 1254 1255 /* 1256 * Generate a link-local address from the token. 1257 * Return zero if the address was set, or non-zero if it couldn't be set. 1258 */ 1259 int 1260 ipif_setlinklocal(ipif_t *ipif) 1261 { 1262 ill_t *ill = ipif->ipif_ill; 1263 in6_addr_t ov6addr; 1264 1265 ASSERT(IAM_WRITER_ILL(ill)); 1266 1267 if (ipif_cant_setlinklocal(ipif)) 1268 return (-1); 1269 1270 ov6addr = ipif->ipif_v6lcl_addr; 1271 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1272 sctp_update_ipif_addr(ipif, ov6addr); 1273 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1274 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1275 ipif->ipif_v6subnet); 1276 1277 if (ipif->ipif_flags & IPIF_NOLOCAL) { 1278 ipif->ipif_v6src_addr = ipv6_all_zeros; 1279 } else { 1280 ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr; 1281 } 1282 return (0); 1283 } 1284 1285 /* 1286 * This function sets up the multicast mappings in NDP. 1287 * Unlike ARP, there are no mapping_mps here. We delete the 1288 * mapping nces and add a new one. 1289 * 1290 * Returns non-zero on error and 0 on success. 1291 */ 1292 int 1293 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce) 1294 { 1295 ill_t *ill = ipif->ipif_ill; 1296 in6_addr_t v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0}; 1297 in6_addr_t v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0}; 1298 in6_addr_t v6_extract_mask; 1299 uchar_t *phys_addr, *bphys_addr, *alloc_phys; 1300 nce_t *mnce = NULL; 1301 int err = 0; 1302 phyint_t *phyi = ill->ill_phyint; 1303 uint32_t hw_extract_start; 1304 dl_unitdata_req_t *dlur; 1305 ip_stack_t *ipst = ill->ill_ipst; 1306 1307 if (ret_nce != NULL) 1308 *ret_nce = NULL; 1309 /* 1310 * Delete the mapping nce. Normally these should not exist 1311 * as a previous ipif_down -> ipif_ndp_down should have deleted 1312 * all the nces. But they can exist if ip_rput_dlpi_writer 1313 * calls this when PHYI_MULTI_BCAST is set. 1314 */ 1315 mnce = ndp_lookup_v6(ill, &v6_mcast_addr, B_FALSE); 1316 if (mnce != NULL) { 1317 ndp_delete(mnce); 1318 NCE_REFRELE(mnce); 1319 mnce = NULL; 1320 } 1321 1322 /* 1323 * Get media specific v6 mapping information. Note that 1324 * nd_lla_len can be 0 for tunnels. 1325 */ 1326 alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP); 1327 if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0)) 1328 return (ENOMEM); 1329 /* 1330 * Determine the broadcast address. 1331 */ 1332 dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr; 1333 if (ill->ill_sap_length < 0) 1334 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset; 1335 else 1336 bphys_addr = (uchar_t *)dlur + 1337 dlur->dl_dest_addr_offset + ill->ill_sap_length; 1338 1339 /* 1340 * Check PHYI_MULTI_BCAST and possible length of physical 1341 * address to determine if we use the mapping or the 1342 * broadcast address. 1343 */ 1344 if ((phyi->phyint_flags & PHYI_MULTI_BCAST) || 1345 (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len, 1346 bphys_addr, alloc_phys, &hw_extract_start, 1347 &v6_extract_mask))) { 1348 if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) { 1349 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1350 return (E2BIG); 1351 } 1352 /* Use the link-layer broadcast address for MULTI_BCAST */ 1353 phys_addr = bphys_addr; 1354 bzero(&v6_extract_mask, sizeof (v6_extract_mask)); 1355 hw_extract_start = ill->ill_nd_lla_len; 1356 } else { 1357 phys_addr = alloc_phys; 1358 } 1359 if ((ipif->ipif_flags & IPIF_BROADCAST) || 1360 (ill->ill_flags & ILLF_MULTICAST) || 1361 (phyi->phyint_flags & PHYI_MULTI_BCAST)) { 1362 mutex_enter(&ipst->ips_ndp6->ndp_g_lock); 1363 err = ndp_add_v6(ill, 1364 phys_addr, 1365 &v6_mcast_addr, /* v6 address */ 1366 &v6_mcast_mask, /* v6 mask */ 1367 &v6_extract_mask, 1368 hw_extract_start, 1369 NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD, 1370 ND_REACHABLE, 1371 &mnce); 1372 mutex_exit(&ipst->ips_ndp6->ndp_g_lock); 1373 if (err == 0) { 1374 if (ret_nce != NULL) { 1375 *ret_nce = mnce; 1376 } else { 1377 NCE_REFRELE(mnce); 1378 } 1379 } 1380 } 1381 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1382 return (err); 1383 } 1384 1385 /* 1386 * Get the resolver set up for a new ipif. (Always called as writer.) 1387 */ 1388 int 1389 ipif_ndp_up(ipif_t *ipif) 1390 { 1391 ill_t *ill = ipif->ipif_ill; 1392 int err = 0; 1393 nce_t *nce = NULL; 1394 nce_t *mnce = NULL; 1395 1396 ip1dbg(("ipif_ndp_up(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 1397 1398 /* 1399 * ND not supported on XRESOLV interfaces. If ND support (multicast) 1400 * added later, take out this check. 1401 */ 1402 if ((ill->ill_flags & ILLF_XRESOLV) || 1403 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) || 1404 (!(ill->ill_net_type & IRE_INTERFACE))) { 1405 ipif->ipif_addr_ready = 1; 1406 return (0); 1407 } 1408 1409 /* 1410 * Need to setup multicast mapping only when the first 1411 * interface is coming UP. 1412 */ 1413 if (ill->ill_ipif_up_count == 0 && 1414 (ill->ill_flags & ILLF_MULTICAST)) { 1415 /* 1416 * We set the multicast before setting up the mapping for 1417 * local address because ipif_ndp_setup_multicast does 1418 * ndp_walk to delete nces which will delete the mapping 1419 * for local address also if we added the mapping for 1420 * local address first. 1421 */ 1422 err = ipif_ndp_setup_multicast(ipif, &mnce); 1423 if (err != 0) 1424 return (err); 1425 } 1426 1427 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1428 uint16_t flags; 1429 uchar_t *hw_addr = NULL; 1430 1431 /* Permanent entries don't need NUD */ 1432 flags = NCE_F_PERMANENT | NCE_F_NONUD; 1433 if (ill->ill_flags & ILLF_ROUTER) 1434 flags |= NCE_F_ISROUTER; 1435 1436 if (ipif->ipif_flags & IPIF_ANYCAST) 1437 flags |= NCE_F_ANYCAST; 1438 1439 if (ill->ill_net_type == IRE_IF_RESOLVER) { 1440 hw_addr = ill->ill_nd_lla; 1441 1442 if (ill->ill_move_in_progress) { 1443 /* 1444 * Addresses are failing over to this ill. 1445 * Don't wait for NUD to see this change. 1446 * Publish our new link-layer address. 1447 */ 1448 flags |= NCE_F_UNSOL_ADV; 1449 } 1450 } 1451 err = ndp_lookup_then_add_v6(ill, 1452 hw_addr, 1453 &ipif->ipif_v6lcl_addr, 1454 &ipv6_all_ones, 1455 &ipv6_all_zeros, 1456 0, 1457 flags, 1458 ND_PROBE, /* Causes Duplicate Address Detection to run */ 1459 &nce); 1460 switch (err) { 1461 case 0: 1462 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1463 ill->ill_name)); 1464 ipif->ipif_addr_ready = 1; 1465 break; 1466 case EINPROGRESS: 1467 ip1dbg(("ipif_ndp_up: running DAD now for %s\n", 1468 ill->ill_name)); 1469 break; 1470 case EEXIST: 1471 NCE_REFRELE(nce); 1472 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1473 ill->ill_name)); 1474 if (mnce != NULL) { 1475 ndp_delete(mnce); 1476 NCE_REFRELE(mnce); 1477 } 1478 return (err); 1479 default: 1480 ip1dbg(("ipif_ndp_up: NCE creation failed %s\n", 1481 ill->ill_name)); 1482 if (mnce != NULL) { 1483 ndp_delete(mnce); 1484 NCE_REFRELE(mnce); 1485 } 1486 return (err); 1487 } 1488 } else { 1489 /* No local NCE for this entry */ 1490 ipif->ipif_addr_ready = 1; 1491 } 1492 if (nce != NULL) 1493 NCE_REFRELE(nce); 1494 if (mnce != NULL) 1495 NCE_REFRELE(mnce); 1496 return (0); 1497 } 1498 1499 /* Remove all cache entries for this logical interface */ 1500 void 1501 ipif_ndp_down(ipif_t *ipif) 1502 { 1503 nce_t *nce; 1504 1505 if (ipif->ipif_isv6) { 1506 nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, 1507 B_FALSE); 1508 if (nce != NULL) { 1509 ndp_delete(nce); 1510 NCE_REFRELE(nce); 1511 } 1512 } 1513 /* 1514 * Remove mapping and all other nces dependent on this ill 1515 * when the last ipif is going away. 1516 */ 1517 if (ipif->ipif_ill->ill_ipif_up_count == 0) { 1518 ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill, 1519 (uchar_t *)ipif->ipif_ill, ipif->ipif_ill->ill_ipst); 1520 } 1521 } 1522 1523 /* 1524 * Used when an interface comes up to recreate any extra routes on this 1525 * interface. 1526 */ 1527 static ire_t ** 1528 ipif_recover_ire_v6(ipif_t *ipif) 1529 { 1530 mblk_t *mp; 1531 ire_t **ipif_saved_irep; 1532 ire_t **irep; 1533 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 1534 1535 ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name, 1536 ipif->ipif_id)); 1537 1538 ASSERT(ipif->ipif_isv6); 1539 1540 mutex_enter(&ipif->ipif_saved_ire_lock); 1541 ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) * 1542 ipif->ipif_saved_ire_cnt, KM_NOSLEEP); 1543 if (ipif_saved_irep == NULL) { 1544 mutex_exit(&ipif->ipif_saved_ire_lock); 1545 return (NULL); 1546 } 1547 1548 irep = ipif_saved_irep; 1549 1550 for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) { 1551 ire_t *ire; 1552 queue_t *rfq; 1553 queue_t *stq; 1554 ifrt_t *ifrt; 1555 in6_addr_t *src_addr; 1556 in6_addr_t *gateway_addr; 1557 char buf[INET6_ADDRSTRLEN]; 1558 ushort_t type; 1559 1560 /* 1561 * When the ire was initially created and then added in 1562 * ip_rt_add_v6(), it was created either using 1563 * ipif->ipif_net_type in the case of a traditional interface 1564 * route, or as one of the IRE_OFFSUBNET types (with the 1565 * exception of IRE_HOST type redirect ire which is created by 1566 * icmp_redirect_v6() and which we don't need to save or 1567 * recover). In the case where ipif->ipif_net_type was 1568 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to 1569 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy 1570 * software like GateD and Sun Cluster which creates routes 1571 * using the the loopback interface's address as a gateway. 1572 * 1573 * As ifrt->ifrt_type reflects the already updated ire_type, 1574 * ire_create_v6() will be called in the same way here as in 1575 * ip_rt_add_v6(), namely using ipif->ipif_net_type when the 1576 * route looks like a traditional interface route (where 1577 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise 1578 * using the saved ifrt->ifrt_type. This means that in 1579 * the case where ipif->ipif_net_type is IRE_LOOPBACK, 1580 * the ire created by ire_create_v6() will be an IRE_LOOPBACK, 1581 * it will then be turned into an IRE_IF_NORESOLVER and then 1582 * added by ire_add_v6(). 1583 */ 1584 ifrt = (ifrt_t *)mp->b_rptr; 1585 if (ifrt->ifrt_type & IRE_INTERFACE) { 1586 rfq = NULL; 1587 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 1588 ? ipif->ipif_rq : ipif->ipif_wq; 1589 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1590 ? &ifrt->ifrt_v6src_addr 1591 : &ipif->ipif_v6src_addr; 1592 gateway_addr = NULL; 1593 type = ipif->ipif_net_type; 1594 } else { 1595 rfq = NULL; 1596 stq = NULL; 1597 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1598 ? &ifrt->ifrt_v6src_addr : NULL; 1599 gateway_addr = &ifrt->ifrt_v6gateway_addr; 1600 type = ifrt->ifrt_type; 1601 } 1602 1603 /* 1604 * Create a copy of the IRE with the saved address and netmask. 1605 */ 1606 ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n", 1607 ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type, 1608 inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)), 1609 ip_mask_to_plen_v6(&ifrt->ifrt_v6mask))); 1610 ire = ire_create_v6( 1611 &ifrt->ifrt_v6addr, 1612 &ifrt->ifrt_v6mask, 1613 src_addr, 1614 gateway_addr, 1615 &ifrt->ifrt_max_frag, 1616 NULL, 1617 rfq, 1618 stq, 1619 type, 1620 ipif, 1621 NULL, 1622 0, 1623 0, 1624 ifrt->ifrt_flags, 1625 &ifrt->ifrt_iulp_info, 1626 NULL, 1627 NULL, 1628 ipst); 1629 if (ire == NULL) { 1630 mutex_exit(&ipif->ipif_saved_ire_lock); 1631 kmem_free(ipif_saved_irep, 1632 ipif->ipif_saved_ire_cnt * sizeof (ire_t *)); 1633 return (NULL); 1634 } 1635 1636 /* 1637 * Some software (for example, GateD and Sun Cluster) attempts 1638 * to create (what amount to) IRE_PREFIX routes with the 1639 * loopback address as the gateway. This is primarily done to 1640 * set up prefixes with the RTF_REJECT flag set (for example, 1641 * when generating aggregate routes.) 1642 * 1643 * If the IRE type (as defined by ipif->ipif_net_type) is 1644 * IRE_LOOPBACK, then we map the request into a 1645 * IRE_IF_NORESOLVER. 1646 */ 1647 if (ipif->ipif_net_type == IRE_LOOPBACK) 1648 ire->ire_type = IRE_IF_NORESOLVER; 1649 /* 1650 * ire held by ire_add, will be refreled' in ipif_up_done 1651 * towards the end 1652 */ 1653 (void) ire_add(&ire, NULL, NULL, NULL, B_FALSE); 1654 *irep = ire; 1655 irep++; 1656 ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire)); 1657 } 1658 mutex_exit(&ipif->ipif_saved_ire_lock); 1659 return (ipif_saved_irep); 1660 } 1661 1662 /* 1663 * Return the scope of the given IPv6 address. If the address is an 1664 * IPv4 mapped IPv6 address, return the scope of the corresponding 1665 * IPv4 address. 1666 */ 1667 in6addr_scope_t 1668 ip_addr_scope_v6(const in6_addr_t *addr) 1669 { 1670 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1671 1672 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1673 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1674 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1675 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1676 return (IP6_SCOPE_LINKLOCAL); 1677 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1678 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1679 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1680 return (IP6_SCOPE_SITELOCAL); 1681 return (IP6_SCOPE_GLOBAL); 1682 } 1683 1684 if (IN6_IS_ADDR_MULTICAST(addr)) 1685 return (IN6_ADDR_MC_SCOPE(addr)); 1686 1687 /* link-local and loopback addresses are of link-local scope */ 1688 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1689 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1690 return (IP6_SCOPE_LINKLOCAL); 1691 if (IN6_IS_ADDR_SITELOCAL(addr)) 1692 return (IP6_SCOPE_SITELOCAL); 1693 return (IP6_SCOPE_GLOBAL); 1694 } 1695 1696 1697 /* 1698 * Returns the length of the common prefix of a1 and a2, as per 1699 * CommonPrefixLen() defined in RFC 3484. 1700 */ 1701 static int 1702 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2) 1703 { 1704 int i; 1705 uint32_t a1val, a2val, mask; 1706 1707 for (i = 0; i < 4; i++) { 1708 if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) { 1709 a1val ^= a2val; 1710 i *= 32; 1711 mask = 0x80000000u; 1712 while (!(a1val & mask)) { 1713 mask >>= 1; 1714 i++; 1715 } 1716 return (i); 1717 } 1718 } 1719 return (IPV6_ABITS); 1720 } 1721 1722 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1723 (((ipif)->ipif_flags & IPIF_UP) && \ 1724 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \ 1725 (ipif)->ipif_addr_ready) 1726 1727 /* source address candidate */ 1728 typedef struct candidate { 1729 ipif_t *cand_ipif; 1730 /* The properties of this candidate */ 1731 boolean_t cand_isdst; 1732 boolean_t cand_isdst_set; 1733 in6addr_scope_t cand_scope; 1734 boolean_t cand_scope_set; 1735 boolean_t cand_isdeprecated; 1736 boolean_t cand_isdeprecated_set; 1737 boolean_t cand_ispreferred; 1738 boolean_t cand_ispreferred_set; 1739 boolean_t cand_matchedinterface; 1740 boolean_t cand_matchedinterface_set; 1741 boolean_t cand_matchedlabel; 1742 boolean_t cand_matchedlabel_set; 1743 boolean_t cand_istmp; 1744 boolean_t cand_istmp_set; 1745 int cand_common_pref; 1746 boolean_t cand_common_pref_set; 1747 boolean_t cand_pref_eq; 1748 boolean_t cand_pref_eq_set; 1749 int cand_pref_len; 1750 boolean_t cand_pref_len_set; 1751 } cand_t; 1752 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1753 #define cand_mask cand_ipif->ipif_v6net_mask 1754 #define cand_flags cand_ipif->ipif_flags 1755 #define cand_ill cand_ipif->ipif_ill 1756 #define cand_zoneid cand_ipif->ipif_zoneid 1757 1758 /* information about the destination for source address selection */ 1759 typedef struct dstinfo { 1760 const in6_addr_t *dst_addr; 1761 ill_t *dst_ill; 1762 uint_t dst_restrict_ill; 1763 boolean_t dst_prefer_src_tmp; 1764 in6addr_scope_t dst_scope; 1765 char *dst_label; 1766 } dstinfo_t; 1767 1768 /* 1769 * The following functions are rules used to select a source address in 1770 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1771 * against the best candidate (bc). Each rule has three possible outcomes; 1772 * the candidate is preferred over the best candidate (CAND_PREFER), the 1773 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1774 * candidate is of equal value as the best candidate (CAND_TIE). 1775 * 1776 * These rules are part of a greater "Default Address Selection for IPv6" 1777 * sheme, which is standards based work coming out of the IETF ipv6 working 1778 * group. The IETF document defines both IPv6 source address selection and 1779 * destination address ordering. The rules defined here implement the IPv6 1780 * source address selection. Destination address ordering is done by 1781 * libnsl, and uses a similar set of rules to implement the sorting. 1782 * 1783 * Most of the rules are defined by the RFC and are not typically altered. The 1784 * last rule, number 8, has language that allows for local preferences. In the 1785 * scheme below, this means that new Solaris rules should normally go between 1786 * rule_ifprefix and rule_prefix. 1787 */ 1788 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1789 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *, 1790 ip_stack_t *); 1791 1792 /* Prefer an address if it is equal to the destination address. */ 1793 /* ARGSUSED3 */ 1794 static rule_res_t 1795 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1796 { 1797 if (!bc->cand_isdst_set) { 1798 bc->cand_isdst = 1799 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1800 bc->cand_isdst_set = B_TRUE; 1801 } 1802 1803 cc->cand_isdst = 1804 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1805 cc->cand_isdst_set = B_TRUE; 1806 1807 if (cc->cand_isdst == bc->cand_isdst) 1808 return (CAND_TIE); 1809 else if (cc->cand_isdst) 1810 return (CAND_PREFER); 1811 else 1812 return (CAND_AVOID); 1813 } 1814 1815 /* 1816 * Prefer addresses that are of closest scope to the destination. Always 1817 * prefer addresses that are of greater scope than the destination over 1818 * those that are of lesser scope than the destination. 1819 */ 1820 /* ARGSUSED3 */ 1821 static rule_res_t 1822 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1823 { 1824 if (!bc->cand_scope_set) { 1825 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1826 bc->cand_scope_set = B_TRUE; 1827 } 1828 1829 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1830 cc->cand_scope_set = B_TRUE; 1831 1832 if (cc->cand_scope < bc->cand_scope) { 1833 if (cc->cand_scope < dstinfo->dst_scope) 1834 return (CAND_AVOID); 1835 else 1836 return (CAND_PREFER); 1837 } else if (bc->cand_scope < cc->cand_scope) { 1838 if (bc->cand_scope < dstinfo->dst_scope) 1839 return (CAND_PREFER); 1840 else 1841 return (CAND_AVOID); 1842 } else { 1843 return (CAND_TIE); 1844 } 1845 } 1846 1847 /* 1848 * Prefer non-deprecated source addresses. 1849 */ 1850 /* ARGSUSED2 */ 1851 static rule_res_t 1852 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1853 ip_stack_t *ipst) 1854 { 1855 if (!bc->cand_isdeprecated_set) { 1856 bc->cand_isdeprecated = 1857 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 1858 bc->cand_isdeprecated_set = B_TRUE; 1859 } 1860 1861 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 1862 cc->cand_isdeprecated_set = B_TRUE; 1863 1864 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 1865 return (CAND_TIE); 1866 else if (cc->cand_isdeprecated) 1867 return (CAND_AVOID); 1868 else 1869 return (CAND_PREFER); 1870 } 1871 1872 /* 1873 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 1874 * rule must be before rule_interface because the flag could be set on any 1875 * interface, not just the interface being used for outgoing packets (for 1876 * example, the IFF_PREFERRED could be set on an address assigned to the 1877 * loopback interface). 1878 */ 1879 /* ARGSUSED2 */ 1880 static rule_res_t 1881 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1882 ip_stack_t *ipst) 1883 { 1884 if (!bc->cand_ispreferred_set) { 1885 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 1886 bc->cand_ispreferred_set = B_TRUE; 1887 } 1888 1889 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 1890 cc->cand_ispreferred_set = B_TRUE; 1891 1892 if (bc->cand_ispreferred == cc->cand_ispreferred) 1893 return (CAND_TIE); 1894 else if (cc->cand_ispreferred) 1895 return (CAND_PREFER); 1896 else 1897 return (CAND_AVOID); 1898 } 1899 1900 /* 1901 * Prefer source addresses that are assigned to the outgoing interface, or 1902 * to an interface that is in the same IPMP group as the outgoing 1903 * interface. 1904 */ 1905 /* ARGSUSED3 */ 1906 static rule_res_t 1907 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1908 ip_stack_t *ipst) 1909 { 1910 ill_t *dstill = dstinfo->dst_ill; 1911 1912 /* 1913 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 1914 * since we know all candidates will be on the same link. 1915 */ 1916 if (dstinfo->dst_restrict_ill) 1917 return (CAND_TIE); 1918 1919 if (!bc->cand_matchedinterface_set) { 1920 bc->cand_matchedinterface = (bc->cand_ill == dstill || 1921 (dstill->ill_group != NULL && 1922 dstill->ill_group == bc->cand_ill->ill_group)); 1923 bc->cand_matchedinterface_set = B_TRUE; 1924 } 1925 1926 cc->cand_matchedinterface = (cc->cand_ill == dstill || 1927 (dstill->ill_group != NULL && 1928 dstill->ill_group == cc->cand_ill->ill_group)); 1929 cc->cand_matchedinterface_set = B_TRUE; 1930 1931 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 1932 return (CAND_TIE); 1933 else if (cc->cand_matchedinterface) 1934 return (CAND_PREFER); 1935 else 1936 return (CAND_AVOID); 1937 } 1938 1939 /* 1940 * Prefer source addresses whose label matches the destination's label. 1941 */ 1942 static rule_res_t 1943 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1944 { 1945 char *label; 1946 1947 if (!bc->cand_matchedlabel_set) { 1948 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst); 1949 bc->cand_matchedlabel = 1950 ip6_asp_labelcmp(label, dstinfo->dst_label); 1951 bc->cand_matchedlabel_set = B_TRUE; 1952 } 1953 1954 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst); 1955 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 1956 cc->cand_matchedlabel_set = B_TRUE; 1957 1958 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 1959 return (CAND_TIE); 1960 else if (cc->cand_matchedlabel) 1961 return (CAND_PREFER); 1962 else 1963 return (CAND_AVOID); 1964 } 1965 1966 /* 1967 * Prefer public addresses over temporary ones. An application can reverse 1968 * the logic of this rule and prefer temporary addresses by using the 1969 * IPV6_SRC_PREFERENCES socket option. 1970 */ 1971 /* ARGSUSED3 */ 1972 static rule_res_t 1973 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1974 ip_stack_t *ipst) 1975 { 1976 if (!bc->cand_istmp_set) { 1977 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 1978 bc->cand_istmp_set = B_TRUE; 1979 } 1980 1981 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 1982 cc->cand_istmp_set = B_TRUE; 1983 1984 if (bc->cand_istmp == cc->cand_istmp) 1985 return (CAND_TIE); 1986 1987 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 1988 return (CAND_PREFER); 1989 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 1990 return (CAND_PREFER); 1991 else 1992 return (CAND_AVOID); 1993 } 1994 1995 /* 1996 * Prefer source addresses with longer matching prefix with the destination 1997 * under the interface mask. This gets us on the same subnet before applying 1998 * any Solaris-specific rules. 1999 */ 2000 /* ARGSUSED3 */ 2001 static rule_res_t 2002 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2003 ip_stack_t *ipst) 2004 { 2005 if (!bc->cand_pref_eq_set) { 2006 bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr, 2007 bc->cand_mask, *dstinfo->dst_addr); 2008 bc->cand_pref_eq_set = B_TRUE; 2009 } 2010 2011 cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask, 2012 *dstinfo->dst_addr); 2013 cc->cand_pref_eq_set = B_TRUE; 2014 2015 if (bc->cand_pref_eq) { 2016 if (cc->cand_pref_eq) { 2017 if (!bc->cand_pref_len_set) { 2018 bc->cand_pref_len = 2019 ip_mask_to_plen_v6(&bc->cand_mask); 2020 bc->cand_pref_len_set = B_TRUE; 2021 } 2022 cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask); 2023 cc->cand_pref_len_set = B_TRUE; 2024 if (bc->cand_pref_len == cc->cand_pref_len) 2025 return (CAND_TIE); 2026 else if (bc->cand_pref_len > cc->cand_pref_len) 2027 return (CAND_AVOID); 2028 else 2029 return (CAND_PREFER); 2030 } else { 2031 return (CAND_AVOID); 2032 } 2033 } else { 2034 if (cc->cand_pref_eq) 2035 return (CAND_PREFER); 2036 else 2037 return (CAND_TIE); 2038 } 2039 } 2040 2041 /* 2042 * Prefer to use zone-specific addresses when possible instead of all-zones 2043 * addresses. 2044 */ 2045 /* ARGSUSED2 */ 2046 static rule_res_t 2047 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2048 ip_stack_t *ipst) 2049 { 2050 if ((bc->cand_zoneid == ALL_ZONES) == 2051 (cc->cand_zoneid == ALL_ZONES)) 2052 return (CAND_TIE); 2053 else if (cc->cand_zoneid == ALL_ZONES) 2054 return (CAND_AVOID); 2055 else 2056 return (CAND_PREFER); 2057 } 2058 2059 /* 2060 * Prefer to use DHCPv6 (first) and static addresses (second) when possible 2061 * instead of statelessly autoconfigured addresses. 2062 * 2063 * This is done after trying all other preferences (and before the final tie 2064 * breaker) so that, if all else is equal, we select addresses configured by 2065 * DHCPv6 over other addresses. We presume that DHCPv6 addresses, unlike 2066 * stateless autoconfigured addresses, are deliberately configured by an 2067 * administrator, and thus are correctly set up in DNS and network packet 2068 * filters. 2069 */ 2070 /* ARGSUSED2 */ 2071 static rule_res_t 2072 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2073 ip_stack_t *ipst) 2074 { 2075 #define ATYPE(x) \ 2076 ((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2 2077 int bcval = ATYPE(bc->cand_flags); 2078 int ccval = ATYPE(cc->cand_flags); 2079 #undef ATYPE 2080 2081 if (bcval == ccval) 2082 return (CAND_TIE); 2083 else if (ccval < bcval) 2084 return (CAND_PREFER); 2085 else 2086 return (CAND_AVOID); 2087 } 2088 2089 /* 2090 * Prefer source addresses with longer matching prefix with the destination. 2091 * We do the longest matching prefix calculation by doing an xor of both 2092 * addresses with the destination, and pick the address with the longest string 2093 * of leading zeros, as per CommonPrefixLen() defined in RFC 3484. 2094 */ 2095 /* ARGSUSED3 */ 2096 static rule_res_t 2097 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 2098 { 2099 if (!bc->cand_common_pref_set) { 2100 bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr, 2101 dstinfo->dst_addr); 2102 bc->cand_common_pref_set = B_TRUE; 2103 } 2104 2105 cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr, 2106 dstinfo->dst_addr); 2107 cc->cand_common_pref_set = B_TRUE; 2108 2109 if (bc->cand_common_pref == cc->cand_common_pref) 2110 return (CAND_TIE); 2111 else if (bc->cand_common_pref > cc->cand_common_pref) 2112 return (CAND_AVOID); 2113 else 2114 return (CAND_PREFER); 2115 } 2116 2117 /* 2118 * Last rule: we must pick something, so just prefer the current best 2119 * candidate. 2120 */ 2121 /* ARGSUSED */ 2122 static rule_res_t 2123 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2124 ip_stack_t *ipst) 2125 { 2126 return (CAND_AVOID); 2127 } 2128 2129 /* 2130 * Determine the best source address given a destination address and a 2131 * destination ill. If no suitable source address is found, it returns 2132 * NULL. If there is a usable address pointed to by the usesrc 2133 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 2134 * fine grained (i.e per interface) 2135 * 2136 * This implementation is based on the "Default Address Selection for IPv6" 2137 * specification produced by the IETF IPv6 working group. It has been 2138 * implemented so that the list of addresses is only traversed once (the 2139 * specification's algorithm could traverse the list of addresses once for 2140 * every rule). 2141 * 2142 * The restrict_ill argument restricts the algorithm to chose a source 2143 * address that is assigned to the destination ill or an ill in the same 2144 * IPMP group as the destination ill. This is used when the destination 2145 * address is a link-local or multicast address, and when 2146 * ipv6_strict_dst_multihoming is turned on. 2147 * 2148 * src_prefs is the caller's set of source address preferences. If source 2149 * address selection is being called to determine the source address of a 2150 * connected socket (from ip_bind_connected_v6()), then the preferences are 2151 * taken from conn_src_preferences. These preferences can be set on a 2152 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 2153 * preference currently implemented is for rfc3041 temporary addresses. 2154 */ 2155 ipif_t * 2156 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 2157 uint_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid) 2158 { 2159 dstinfo_t dstinfo; 2160 char dstr[INET6_ADDRSTRLEN]; 2161 char sstr[INET6_ADDRSTRLEN]; 2162 ipif_t *ipif; 2163 ill_t *ill, *usesrc_ill = NULL; 2164 ill_walk_context_t ctx; 2165 cand_t best_c; /* The best candidate */ 2166 cand_t curr_c; /* The current candidate */ 2167 uint_t index; 2168 boolean_t first_candidate = B_TRUE; 2169 rule_res_t rule_result; 2170 tsol_tpc_t *src_rhtp, *dst_rhtp; 2171 ip_stack_t *ipst = dstill->ill_ipst; 2172 2173 /* 2174 * The list of ordering rules. They are applied in the order they 2175 * appear in the list. 2176 * 2177 * Solaris doesn't currently support Mobile IPv6, so there's no 2178 * rule_mipv6 corresponding to rule 4 in the specification. 2179 */ 2180 rulef_t rules[] = { 2181 rule_isdst, 2182 rule_scope, 2183 rule_deprecated, 2184 rule_preferred, 2185 rule_interface, 2186 rule_label, 2187 rule_temporary, 2188 rule_ifprefix, /* local rules after this */ 2189 rule_zone_specific, 2190 rule_addr_type, 2191 rule_prefix, /* local rules before this */ 2192 rule_must_be_last, /* must always be last */ 2193 NULL 2194 }; 2195 2196 ASSERT(dstill->ill_isv6); 2197 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 2198 2199 /* 2200 * Check if there is a usable src address pointed to by the 2201 * usesrc ifindex. This has higher precedence since it is 2202 * finer grained (i.e per interface) v/s being system wide. 2203 */ 2204 if (dstill->ill_usesrc_ifindex != 0) { 2205 if ((usesrc_ill = 2206 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 2207 NULL, NULL, NULL, NULL, ipst)) != NULL) { 2208 dstinfo.dst_ill = usesrc_ill; 2209 } else { 2210 return (NULL); 2211 } 2212 } else { 2213 dstinfo.dst_ill = dstill; 2214 } 2215 2216 /* 2217 * If we're dealing with an unlabeled destination on a labeled system, 2218 * make sure that we ignore source addresses that are incompatible with 2219 * the destination's default label. That destination's default label 2220 * must dominate the minimum label on the source address. 2221 * 2222 * (Note that this has to do with Trusted Solaris. It's not related to 2223 * the labels described by ip6_asp_lookup.) 2224 */ 2225 dst_rhtp = NULL; 2226 if (is_system_labeled()) { 2227 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE); 2228 if (dst_rhtp == NULL) 2229 return (NULL); 2230 if (dst_rhtp->tpc_tp.host_type != UNLABELED) { 2231 TPC_RELE(dst_rhtp); 2232 dst_rhtp = NULL; 2233 } 2234 } 2235 2236 dstinfo.dst_addr = dst; 2237 dstinfo.dst_scope = ip_addr_scope_v6(dst); 2238 dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst); 2239 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 2240 2241 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2242 /* 2243 * Section three of the I-D states that for multicast and 2244 * link-local destinations, the candidate set must be restricted to 2245 * an interface that is on the same link as the outgoing interface. 2246 * Also, when ipv6_strict_dst_multihoming is turned on, always 2247 * restrict the source address to the destination link as doing 2248 * otherwise will almost certainly cause problems. 2249 */ 2250 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 2251 ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) { 2252 if (restrict_ill == RESTRICT_TO_NONE) 2253 dstinfo.dst_restrict_ill = RESTRICT_TO_GROUP; 2254 else 2255 dstinfo.dst_restrict_ill = restrict_ill; 2256 } else { 2257 dstinfo.dst_restrict_ill = restrict_ill; 2258 } 2259 2260 bzero(&best_c, sizeof (cand_t)); 2261 2262 /* 2263 * Take a pass through the list of IPv6 interfaces to chose the 2264 * best possible source address. If restrict_ill is true, we only 2265 * iterate through the ill's that are in the same IPMP group as the 2266 * destination's outgoing ill. If restrict_ill is false, we walk 2267 * the entire list of IPv6 ill's. 2268 */ 2269 if (dstinfo.dst_restrict_ill != RESTRICT_TO_NONE) { 2270 if (dstinfo.dst_ill->ill_group != NULL && 2271 dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) { 2272 ill = dstinfo.dst_ill->ill_group->illgrp_ill; 2273 } else { 2274 ill = dstinfo.dst_ill; 2275 } 2276 } else { 2277 ill = ILL_START_WALK_V6(&ctx, ipst); 2278 } 2279 2280 while (ill != NULL) { 2281 ASSERT(ill->ill_isv6); 2282 2283 /* 2284 * Avoid FAILED/OFFLINE ills. 2285 * Global and site local addresses will failover and 2286 * will be available on the new ill. 2287 * But link local addresses don't move. 2288 */ 2289 if (dstinfo.dst_restrict_ill != RESTRICT_TO_ILL && 2290 ill->ill_phyint->phyint_flags & 2291 (PHYI_OFFLINE | PHYI_FAILED)) 2292 goto next_ill; 2293 2294 for (ipif = ill->ill_ipif; ipif != NULL; 2295 ipif = ipif->ipif_next) { 2296 2297 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 2298 continue; 2299 2300 if (zoneid != ALL_ZONES && 2301 ipif->ipif_zoneid != zoneid && 2302 ipif->ipif_zoneid != ALL_ZONES) 2303 continue; 2304 2305 /* 2306 * Check compatibility of local address for 2307 * destination's default label if we're on a labeled 2308 * system. Incompatible addresses can't be used at 2309 * all and must be skipped over. 2310 */ 2311 if (dst_rhtp != NULL) { 2312 boolean_t incompat; 2313 2314 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr, 2315 IPV6_VERSION, B_FALSE); 2316 if (src_rhtp == NULL) 2317 continue; 2318 incompat = 2319 src_rhtp->tpc_tp.host_type != SUN_CIPSO || 2320 src_rhtp->tpc_tp.tp_doi != 2321 dst_rhtp->tpc_tp.tp_doi || 2322 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label, 2323 &src_rhtp->tpc_tp.tp_sl_range_cipso) && 2324 !blinlset(&dst_rhtp->tpc_tp.tp_def_label, 2325 src_rhtp->tpc_tp.tp_sl_set_cipso)); 2326 TPC_RELE(src_rhtp); 2327 if (incompat) 2328 continue; 2329 } 2330 2331 if (first_candidate) { 2332 /* 2333 * This is first valid address in the list. 2334 * It is automatically the best candidate 2335 * so far. 2336 */ 2337 best_c.cand_ipif = ipif; 2338 first_candidate = B_FALSE; 2339 continue; 2340 } 2341 2342 bzero(&curr_c, sizeof (cand_t)); 2343 curr_c.cand_ipif = ipif; 2344 2345 /* 2346 * Compare this current candidate (curr_c) with the 2347 * best candidate (best_c) by applying the 2348 * comparison rules in order until one breaks the 2349 * tie. 2350 */ 2351 for (index = 0; rules[index] != NULL; index++) { 2352 /* Apply a comparison rule. */ 2353 rule_result = 2354 (rules[index])(&best_c, &curr_c, &dstinfo, 2355 ipst); 2356 if (rule_result == CAND_AVOID) { 2357 /* 2358 * The best candidate is still the 2359 * best candidate. Forget about 2360 * this current candidate and go on 2361 * to the next one. 2362 */ 2363 break; 2364 } else if (rule_result == CAND_PREFER) { 2365 /* 2366 * This candidate is prefered. It 2367 * becomes the best candidate so 2368 * far. Go on to the next address. 2369 */ 2370 best_c = curr_c; 2371 break; 2372 } 2373 /* We have a tie, apply the next rule. */ 2374 } 2375 2376 /* 2377 * The last rule must be a tie breaker rule and 2378 * must never produce a tie. At this point, the 2379 * candidate should have either been rejected, or 2380 * have been prefered as the best candidate so far. 2381 */ 2382 ASSERT(rule_result != CAND_TIE); 2383 } 2384 2385 /* 2386 * We may be walking the linked-list of ill's in an 2387 * IPMP group or traversing the IPv6 ill avl tree. If it is a 2388 * usesrc ILL then it can't be part of IPMP group and we 2389 * will exit the while loop. 2390 */ 2391 next_ill: 2392 if (dstinfo.dst_restrict_ill == RESTRICT_TO_ILL) 2393 ill = NULL; 2394 else if (dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) 2395 ill = ill->ill_group_next; 2396 else 2397 ill = ill_next(&ctx, ill); 2398 } 2399 2400 ipif = best_c.cand_ipif; 2401 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2402 dstinfo.dst_ill->ill_name, 2403 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2404 (ipif == NULL ? "NULL" : 2405 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2406 2407 if (usesrc_ill != NULL) 2408 ill_refrele(usesrc_ill); 2409 2410 if (dst_rhtp != NULL) 2411 TPC_RELE(dst_rhtp); 2412 2413 if (ipif == NULL) { 2414 rw_exit(&ipst->ips_ill_g_lock); 2415 return (NULL); 2416 } 2417 2418 mutex_enter(&ipif->ipif_ill->ill_lock); 2419 if (IPIF_CAN_LOOKUP(ipif)) { 2420 ipif_refhold_locked(ipif); 2421 mutex_exit(&ipif->ipif_ill->ill_lock); 2422 rw_exit(&ipst->ips_ill_g_lock); 2423 return (ipif); 2424 } 2425 mutex_exit(&ipif->ipif_ill->ill_lock); 2426 rw_exit(&ipst->ips_ill_g_lock); 2427 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2428 " returning null \n", (void *)ipif)); 2429 2430 return (NULL); 2431 } 2432 2433 /* 2434 * If old_ipif is not NULL, see if ipif was derived from old 2435 * ipif and if so, recreate the interface route by re-doing 2436 * source address selection. This happens when ipif_down -> 2437 * ipif_update_other_ipifs calls us. 2438 * 2439 * If old_ipif is NULL, just redo the source address selection 2440 * if needed. This happens when illgrp_insert or ipif_up_done_v6 2441 * calls us. 2442 */ 2443 void 2444 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif) 2445 { 2446 ire_t *ire; 2447 ire_t *ipif_ire; 2448 queue_t *stq; 2449 ill_t *ill; 2450 ipif_t *nipif = NULL; 2451 boolean_t nipif_refheld = B_FALSE; 2452 boolean_t ip6_asp_table_held = B_FALSE; 2453 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 2454 2455 ill = ipif->ipif_ill; 2456 2457 if (!(ipif->ipif_flags & 2458 (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) { 2459 /* 2460 * Can't possibly have borrowed the source 2461 * from old_ipif. 2462 */ 2463 return; 2464 } 2465 2466 /* 2467 * Is there any work to be done? No work if the address 2468 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST ( 2469 * ipif_select_source_v6() does not borrow addresses from 2470 * NOLOCAL and ANYCAST interfaces). 2471 */ 2472 if ((old_ipif != NULL) && 2473 ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) || 2474 (old_ipif->ipif_ill->ill_wq == NULL) || 2475 (old_ipif->ipif_flags & 2476 (IPIF_NOLOCAL|IPIF_ANYCAST)))) { 2477 return; 2478 } 2479 2480 /* 2481 * Perform the same checks as when creating the 2482 * IRE_INTERFACE in ipif_up_done_v6. 2483 */ 2484 if (!(ipif->ipif_flags & IPIF_UP)) 2485 return; 2486 2487 if ((ipif->ipif_flags & IPIF_NOXMIT)) 2488 return; 2489 2490 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2491 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask)) 2492 return; 2493 2494 /* 2495 * We know that ipif uses some other source for its 2496 * IRE_INTERFACE. Is it using the source of this 2497 * old_ipif? 2498 */ 2499 ipif_ire = ipif_to_ire_v6(ipif); 2500 if (ipif_ire == NULL) 2501 return; 2502 2503 if (old_ipif != NULL && 2504 !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr, 2505 &ipif_ire->ire_src_addr_v6)) { 2506 ire_refrele(ipif_ire); 2507 return; 2508 } 2509 2510 if (ip_debug > 2) { 2511 /* ip1dbg */ 2512 pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE" 2513 " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6); 2514 } 2515 2516 stq = ipif_ire->ire_stq; 2517 2518 /* 2519 * Can't use our source address. Select a different source address 2520 * for the IRE_INTERFACE. We restrict interface route source 2521 * address selection to ipif's assigned to the same link as the 2522 * interface. 2523 */ 2524 if (ip6_asp_can_lookup(ipst)) { 2525 ip6_asp_table_held = B_TRUE; 2526 nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet, 2527 RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT, 2528 ipif->ipif_zoneid); 2529 } 2530 if (nipif == NULL) { 2531 /* Last resort - all ipif's have IPIF_NOLOCAL */ 2532 nipif = ipif; 2533 } else { 2534 nipif_refheld = B_TRUE; 2535 } 2536 2537 ire = ire_create_v6( 2538 &ipif->ipif_v6subnet, /* dest pref */ 2539 &ipif->ipif_v6net_mask, /* mask */ 2540 &nipif->ipif_v6src_addr, /* src addr */ 2541 NULL, /* no gateway */ 2542 &ipif->ipif_mtu, /* max frag */ 2543 NULL, /* no src nce */ 2544 NULL, /* no recv from queue */ 2545 stq, /* send-to queue */ 2546 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2547 ipif, 2548 NULL, 2549 0, 2550 0, 2551 0, 2552 &ire_uinfo_null, 2553 NULL, 2554 NULL, 2555 ipst); 2556 2557 if (ire != NULL) { 2558 ire_t *ret_ire; 2559 int error; 2560 2561 /* 2562 * We don't need ipif_ire anymore. We need to delete 2563 * before we add so that ire_add does not detect 2564 * duplicates. 2565 */ 2566 ire_delete(ipif_ire); 2567 ret_ire = ire; 2568 error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE); 2569 ASSERT(error == 0); 2570 ASSERT(ret_ire == ire); 2571 if (ret_ire != NULL) { 2572 /* Held in ire_add */ 2573 ire_refrele(ret_ire); 2574 } 2575 } 2576 /* 2577 * Either we are falling through from above or could not 2578 * allocate a replacement. 2579 */ 2580 ire_refrele(ipif_ire); 2581 if (ip6_asp_table_held) 2582 ip6_asp_table_refrele(ipst); 2583 if (nipif_refheld) 2584 ipif_refrele(nipif); 2585 } 2586 2587 /* 2588 * This old_ipif is going away. 2589 * 2590 * Determine if any other ipif's are using our address as 2591 * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or 2592 * IPIF_DEPRECATED). 2593 * Find the IRE_INTERFACE for such ipif's and recreate them 2594 * to use an different source address following the rules in 2595 * ipif_up_done_v6. 2596 * 2597 * This function takes an illgrp as an argument so that illgrp_delete 2598 * can call this to update source address even after deleting the 2599 * old_ipif->ipif_ill from the ill group. 2600 */ 2601 void 2602 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp) 2603 { 2604 ipif_t *ipif; 2605 ill_t *ill; 2606 char buf[INET6_ADDRSTRLEN]; 2607 2608 ASSERT(IAM_WRITER_IPIF(old_ipif)); 2609 2610 ill = old_ipif->ipif_ill; 2611 2612 ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n", 2613 ill->ill_name, 2614 inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr, 2615 buf, sizeof (buf)))); 2616 2617 /* 2618 * If this part of a group, look at all ills as ipif_select_source 2619 * borrows a source address across all the ills in the group. 2620 */ 2621 if (illgrp != NULL) 2622 ill = illgrp->illgrp_ill; 2623 2624 /* Don't need a lock since this is a writer */ 2625 for (; ill != NULL; ill = ill->ill_group_next) { 2626 for (ipif = ill->ill_ipif; ipif != NULL; 2627 ipif = ipif->ipif_next) { 2628 2629 if (ipif == old_ipif) 2630 continue; 2631 2632 ipif_recreate_interface_routes_v6(old_ipif, ipif); 2633 } 2634 } 2635 } 2636 2637 /* 2638 * Perform an attach and bind to get phys addr plus info_req for 2639 * the physical device. 2640 * q and mp represents an ioctl which will be queued waiting for 2641 * completion of the DLPI message exchange. 2642 * MUST be called on an ill queue. Can not set conn_pending_ill for that 2643 * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q. 2644 * 2645 * Returns EINPROGRESS when mp has been consumed by queueing it on 2646 * ill_pending_mp and the ioctl will complete in ip_rput. 2647 */ 2648 int 2649 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2650 { 2651 mblk_t *v6token_mp = NULL; 2652 mblk_t *v6lla_mp = NULL; 2653 mblk_t *phys_mp = NULL; 2654 mblk_t *info_mp = NULL; 2655 mblk_t *attach_mp = NULL; 2656 mblk_t *bind_mp = NULL; 2657 mblk_t *unbind_mp = NULL; 2658 mblk_t *notify_mp = NULL; 2659 2660 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2661 ASSERT(ill->ill_dlpi_style_set); 2662 ASSERT(WR(q)->q_next != NULL); 2663 2664 if (ill->ill_isv6) { 2665 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2666 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2667 if (v6token_mp == NULL) 2668 goto bad; 2669 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2670 DL_IPV6_TOKEN; 2671 2672 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2673 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2674 if (v6lla_mp == NULL) 2675 goto bad; 2676 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2677 DL_IPV6_LINK_LAYER_ADDR; 2678 } 2679 2680 /* 2681 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2682 */ 2683 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2684 DL_NOTIFY_REQ); 2685 if (notify_mp == NULL) 2686 goto bad; 2687 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2688 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2689 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG); 2690 2691 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2692 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2693 if (phys_mp == NULL) 2694 goto bad; 2695 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2696 DL_CURR_PHYS_ADDR; 2697 2698 info_mp = ip_dlpi_alloc( 2699 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2700 DL_INFO_REQ); 2701 if (info_mp == NULL) 2702 goto bad; 2703 2704 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2705 DL_BIND_REQ); 2706 if (bind_mp == NULL) 2707 goto bad; 2708 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2709 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2710 2711 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2712 if (unbind_mp == NULL) 2713 goto bad; 2714 2715 /* If we need to attach, pre-alloc and initialize the mblk */ 2716 if (ill->ill_needs_attach) { 2717 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2718 DL_ATTACH_REQ); 2719 if (attach_mp == NULL) 2720 goto bad; 2721 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2722 } 2723 2724 /* 2725 * Here we are going to delay the ioctl ack until after 2726 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2727 * original ioctl message before sending the requests 2728 */ 2729 mutex_enter(&ill->ill_lock); 2730 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2731 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2732 /* 2733 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2734 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2735 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2736 */ 2737 ill->ill_phys_addr_pend = 0; 2738 mutex_exit(&ill->ill_lock); 2739 2740 if (attach_mp != NULL) { 2741 ip1dbg(("ill_dl_phys: attach\n")); 2742 ill_dlpi_send(ill, attach_mp); 2743 } 2744 ill_dlpi_send(ill, bind_mp); 2745 ill_dlpi_send(ill, info_mp); 2746 if (ill->ill_isv6) { 2747 ill_dlpi_send(ill, v6token_mp); 2748 ill_dlpi_send(ill, v6lla_mp); 2749 } 2750 ill_dlpi_send(ill, phys_mp); 2751 ill_dlpi_send(ill, notify_mp); 2752 ill_dlpi_send(ill, unbind_mp); 2753 2754 /* 2755 * This operation will complete in ip_rput_dlpi_writer with either 2756 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2757 */ 2758 return (EINPROGRESS); 2759 bad: 2760 freemsg(v6token_mp); 2761 freemsg(v6lla_mp); 2762 freemsg(phys_mp); 2763 freemsg(info_mp); 2764 freemsg(attach_mp); 2765 freemsg(bind_mp); 2766 freemsg(unbind_mp); 2767 freemsg(notify_mp); 2768 return (ENOMEM); 2769 } 2770 2771 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2772 2773 /* 2774 * DLPI is up. 2775 * Create all the IREs associated with an interface bring up multicast. 2776 * Set the interface flag and finish other initialization 2777 * that potentially had to be differed to after DL_BIND_ACK. 2778 */ 2779 int 2780 ipif_up_done_v6(ipif_t *ipif) 2781 { 2782 ire_t *ire_array[20]; 2783 ire_t **irep = ire_array; 2784 ire_t **irep1; 2785 ill_t *ill = ipif->ipif_ill; 2786 queue_t *stq; 2787 in6_addr_t v6addr; 2788 in6_addr_t route_mask; 2789 ipif_t *src_ipif = NULL; 2790 ipif_t *tmp_ipif; 2791 boolean_t flush_ire_cache = B_TRUE; 2792 int err; 2793 char buf[INET6_ADDRSTRLEN]; 2794 phyint_t *phyi; 2795 ire_t **ipif_saved_irep = NULL; 2796 int ipif_saved_ire_cnt; 2797 int cnt; 2798 boolean_t src_ipif_held = B_FALSE; 2799 boolean_t ire_added = B_FALSE; 2800 boolean_t loopback = B_FALSE; 2801 boolean_t ip6_asp_table_held = B_FALSE; 2802 ip_stack_t *ipst = ill->ill_ipst; 2803 2804 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2805 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2806 2807 /* Check if this is a loopback interface */ 2808 if (ipif->ipif_ill->ill_wq == NULL) 2809 loopback = B_TRUE; 2810 2811 ASSERT(ipif->ipif_isv6); 2812 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2813 2814 /* 2815 * If all other interfaces for this ill are down or DEPRECATED, 2816 * or otherwise unsuitable for source address selection, remove 2817 * any IRE_CACHE entries for this ill to make sure source 2818 * address selection gets to take this new ipif into account. 2819 * No need to hold ill_lock while traversing the ipif list since 2820 * we are writer 2821 */ 2822 for (tmp_ipif = ill->ill_ipif; tmp_ipif; 2823 tmp_ipif = tmp_ipif->ipif_next) { 2824 if (((tmp_ipif->ipif_flags & 2825 (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) || 2826 !(tmp_ipif->ipif_flags & IPIF_UP)) || 2827 (tmp_ipif == ipif)) 2828 continue; 2829 /* first useable pre-existing interface */ 2830 flush_ire_cache = B_FALSE; 2831 break; 2832 } 2833 if (flush_ire_cache) 2834 ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE, 2835 IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill); 2836 2837 /* 2838 * Figure out which way the send-to queue should go. Only 2839 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here. 2840 */ 2841 switch (ill->ill_net_type) { 2842 case IRE_IF_RESOLVER: 2843 stq = ill->ill_rq; 2844 break; 2845 case IRE_IF_NORESOLVER: 2846 case IRE_LOOPBACK: 2847 stq = ill->ill_wq; 2848 break; 2849 default: 2850 return (EINVAL); 2851 } 2852 2853 if (IS_LOOPBACK(ill)) { 2854 /* 2855 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 2856 * ipif_lookup_on_name(), but in the case of zones we can have 2857 * several loopback addresses on lo0. So all the interfaces with 2858 * loopback addresses need to be marked IRE_LOOPBACK. 2859 */ 2860 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 2861 ipif->ipif_ire_type = IRE_LOOPBACK; 2862 else 2863 ipif->ipif_ire_type = IRE_LOCAL; 2864 } 2865 2866 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) { 2867 /* 2868 * Can't use our source address. Select a different 2869 * source address for the IRE_INTERFACE and IRE_LOCAL 2870 */ 2871 if (ip6_asp_can_lookup(ipst)) { 2872 ip6_asp_table_held = B_TRUE; 2873 src_ipif = ipif_select_source_v6(ipif->ipif_ill, 2874 &ipif->ipif_v6subnet, RESTRICT_TO_NONE, 2875 IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid); 2876 } 2877 if (src_ipif == NULL) 2878 src_ipif = ipif; /* Last resort */ 2879 else 2880 src_ipif_held = B_TRUE; 2881 } else { 2882 src_ipif = ipif; 2883 } 2884 2885 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 2886 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 2887 2888 /* 2889 * If we're on a labeled system then make sure that zone- 2890 * private addresses have proper remote host database entries. 2891 */ 2892 if (is_system_labeled() && 2893 ipif->ipif_ire_type != IRE_LOOPBACK) { 2894 if (ip6opt_ls == 0) { 2895 cmn_err(CE_WARN, "IPv6 not enabled " 2896 "via /etc/system"); 2897 return (EINVAL); 2898 } 2899 if (!tsol_check_interface_address(ipif)) 2900 return (EINVAL); 2901 } 2902 2903 /* Register the source address for __sin6_src_id */ 2904 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 2905 ipif->ipif_zoneid, ipst); 2906 if (err != 0) { 2907 ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err)); 2908 if (src_ipif_held) 2909 ipif_refrele(src_ipif); 2910 if (ip6_asp_table_held) 2911 ip6_asp_table_refrele(ipst); 2912 return (err); 2913 } 2914 /* 2915 * If the interface address is set, create the LOCAL 2916 * or LOOPBACK IRE. 2917 */ 2918 ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n", 2919 ipif->ipif_ire_type, 2920 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 2921 buf, sizeof (buf)))); 2922 2923 *irep++ = ire_create_v6( 2924 &ipif->ipif_v6lcl_addr, /* dest address */ 2925 &ipv6_all_ones, /* mask */ 2926 &src_ipif->ipif_v6src_addr, /* source address */ 2927 NULL, /* no gateway */ 2928 &ip_loopback_mtu_v6plus, /* max frag size */ 2929 NULL, 2930 ipif->ipif_rq, /* recv-from queue */ 2931 NULL, /* no send-to queue */ 2932 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 2933 ipif, /* interface */ 2934 NULL, 2935 0, 2936 0, 2937 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2938 &ire_uinfo_null, 2939 NULL, 2940 NULL, 2941 ipst); 2942 } 2943 2944 /* 2945 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. 2946 * Note that atun interfaces have an all-zero ipif_v6subnet. 2947 * Thus we allow a zero subnet as long as the mask is non-zero. 2948 */ 2949 if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) && 2950 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2951 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2952 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2953 v6addr = ipif->ipif_v6subnet; 2954 2955 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2956 route_mask = ipv6_all_ones; 2957 } else { 2958 route_mask = ipif->ipif_v6net_mask; 2959 } 2960 2961 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n", 2962 ill->ill_net_type, 2963 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 2964 2965 *irep++ = ire_create_v6( 2966 &v6addr, /* dest pref */ 2967 &route_mask, /* mask */ 2968 &src_ipif->ipif_v6src_addr, /* src addr */ 2969 NULL, /* no gateway */ 2970 &ipif->ipif_mtu, /* max frag */ 2971 NULL, /* no src nce */ 2972 NULL, /* no recv from queue */ 2973 stq, /* send-to queue */ 2974 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2975 ipif, 2976 NULL, 2977 0, 2978 0, 2979 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2980 &ire_uinfo_null, 2981 NULL, 2982 NULL, 2983 ipst); 2984 } 2985 2986 /* 2987 * Setup 2002::/16 route, if this interface is a 6to4 tunnel 2988 */ 2989 if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) && 2990 (ill->ill_is_6to4tun)) { 2991 /* 2992 * Destination address is 2002::/16 2993 */ 2994 #ifdef _BIG_ENDIAN 2995 const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 }; 2996 const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 }; 2997 #else 2998 const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 }; 2999 const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 }; 3000 #endif /* _BIG_ENDIAN */ 3001 char buf2[INET6_ADDRSTRLEN]; 3002 ire_t *isdup; 3003 in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr; 3004 3005 /* 3006 * check to see if this route has already been added for 3007 * this tunnel interface. 3008 */ 3009 isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0, 3010 IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL, 3011 (MATCH_IRE_SRC | MATCH_IRE_MASK), ipst); 3012 3013 if (isdup == NULL) { 3014 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s", 3015 IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr, 3016 buf2, sizeof (buf2)))); 3017 3018 *irep++ = ire_create_v6( 3019 &prefix_addr, /* 2002:: */ 3020 &prefix_mask, /* ffff:: */ 3021 &ipif->ipif_v6lcl_addr, /* src addr */ 3022 NULL, /* gateway */ 3023 &ipif->ipif_mtu, /* max_frag */ 3024 NULL, /* no src nce */ 3025 NULL, /* no rfq */ 3026 ill->ill_wq, /* stq */ 3027 IRE_IF_NORESOLVER, /* type */ 3028 ipif, /* interface */ 3029 NULL, /* v6cmask */ 3030 0, 3031 0, 3032 RTF_UP, 3033 &ire_uinfo_null, 3034 NULL, 3035 NULL, 3036 ipst); 3037 } else { 3038 ire_refrele(isdup); 3039 } 3040 } 3041 3042 /* If an earlier ire_create failed, get out now */ 3043 for (irep1 = irep; irep1 > ire_array; ) { 3044 irep1--; 3045 if (*irep1 == NULL) { 3046 ip1dbg(("ipif_up_done_v6: NULL ire found in" 3047 " ire_array\n")); 3048 err = ENOMEM; 3049 goto bad; 3050 } 3051 } 3052 3053 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 3054 3055 /* 3056 * Need to atomically check for ip_addr_availablity_check 3057 * now under ill_g_lock, and if it fails got bad, and remove 3058 * from group also 3059 */ 3060 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 3061 mutex_enter(&ipst->ips_ip_addr_avail_lock); 3062 ill->ill_ipif_up_count++; 3063 ipif->ipif_flags |= IPIF_UP; 3064 err = ip_addr_availability_check(ipif); 3065 mutex_exit(&ipst->ips_ip_addr_avail_lock); 3066 rw_exit(&ipst->ips_ill_g_lock); 3067 3068 if (err != 0) { 3069 /* 3070 * Our address may already be up on the same ill. In this case, 3071 * the external resolver entry for our ipif replaced the one for 3072 * the other ipif. So we don't want to delete it (otherwise the 3073 * other ipif would be unable to send packets). 3074 * ip_addr_availability_check() identifies this case for us and 3075 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL 3076 * which is the expected error code. 3077 */ 3078 if (err == EADDRINUSE) { 3079 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) { 3080 freemsg(ipif->ipif_arp_del_mp); 3081 ipif->ipif_arp_del_mp = NULL; 3082 } 3083 err = EADDRNOTAVAIL; 3084 } 3085 ill->ill_ipif_up_count--; 3086 ipif->ipif_flags &= ~IPIF_UP; 3087 goto bad; 3088 } 3089 3090 /* 3091 * Add in all newly created IREs. We want to add before 3092 * we call ifgrp_insert which wants to know whether 3093 * IRE_IF_RESOLVER exists or not. 3094 * 3095 * NOTE : We refrele the ire though we may branch to "bad" 3096 * later on where we do ire_delete. This is okay 3097 * because nobody can delete it as we are running 3098 * exclusively. 3099 */ 3100 for (irep1 = irep; irep1 > ire_array; ) { 3101 irep1--; 3102 /* Shouldn't be adding any bcast ire's */ 3103 ASSERT((*irep1)->ire_type != IRE_BROADCAST); 3104 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 3105 /* 3106 * refheld by ire_add. refele towards the end of the func 3107 */ 3108 (void) ire_add(irep1, NULL, NULL, NULL, B_FALSE); 3109 } 3110 if (ip6_asp_table_held) { 3111 ip6_asp_table_refrele(ipst); 3112 ip6_asp_table_held = B_FALSE; 3113 } 3114 ire_added = B_TRUE; 3115 3116 /* 3117 * Form groups if possible. 3118 * 3119 * If we are supposed to be in a ill_group with a name, insert it 3120 * now as we know that at least one ipif is UP. Otherwise form 3121 * nameless groups. 3122 * 3123 * If ip_enable_group_ifs is set and ipif address is not ::0, insert 3124 * this ipif into the appropriate interface group, or create a 3125 * new one. If this is already in a nameless group, we try to form 3126 * a bigger group looking at other ills potentially sharing this 3127 * ipif's prefix. 3128 */ 3129 phyi = ill->ill_phyint; 3130 if (phyi->phyint_groupname_len != 0) { 3131 ASSERT(phyi->phyint_groupname != NULL); 3132 if (ill->ill_ipif_up_count == 1) { 3133 ASSERT(ill->ill_group == NULL); 3134 err = illgrp_insert(&ipst->ips_illgrp_head_v6, ill, 3135 phyi->phyint_groupname, NULL, B_TRUE); 3136 if (err != 0) { 3137 ip1dbg(("ipif_up_done_v6: illgrp allocation " 3138 "failed, error %d\n", err)); 3139 goto bad; 3140 } 3141 } 3142 ASSERT(ill->ill_group != NULL); 3143 } 3144 3145 /* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */ 3146 ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt; 3147 ipif_saved_irep = ipif_recover_ire_v6(ipif); 3148 3149 if (ill->ill_need_recover_multicast) { 3150 /* 3151 * Need to recover all multicast memberships in the driver. 3152 * This had to be deferred until we had attached. 3153 */ 3154 ill_recover_multicast(ill); 3155 } 3156 /* Join the allhosts multicast address and the solicited node MC */ 3157 ipif_multicast_up(ipif); 3158 3159 if (!loopback) { 3160 /* 3161 * See whether anybody else would benefit from the 3162 * new ipif that we added. We call this always rather 3163 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST 3164 * ipif for the benefit of illgrp_insert (done above) 3165 * which does not do source address selection as it does 3166 * not want to re-create interface routes that we are 3167 * having reference to it here. 3168 */ 3169 ill_update_source_selection(ill); 3170 } 3171 3172 for (irep1 = irep; irep1 > ire_array; ) { 3173 irep1--; 3174 if (*irep1 != NULL) { 3175 /* was held in ire_add */ 3176 ire_refrele(*irep1); 3177 } 3178 } 3179 3180 cnt = ipif_saved_ire_cnt; 3181 for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) { 3182 if (*irep1 != NULL) { 3183 /* was held in ire_add */ 3184 ire_refrele(*irep1); 3185 } 3186 } 3187 3188 if (ipif->ipif_addr_ready) 3189 ipif_up_notify(ipif); 3190 3191 if (ipif_saved_irep != NULL) { 3192 kmem_free(ipif_saved_irep, 3193 ipif_saved_ire_cnt * sizeof (ire_t *)); 3194 } 3195 3196 if (src_ipif_held) 3197 ipif_refrele(src_ipif); 3198 3199 return (0); 3200 3201 bad: 3202 if (ip6_asp_table_held) 3203 ip6_asp_table_refrele(ipst); 3204 /* 3205 * We don't have to bother removing from ill groups because 3206 * 3207 * 1) For groups with names, we insert only when the first ipif 3208 * comes up. In that case if it fails, it will not be in any 3209 * group. So, we need not try to remove for that case. 3210 * 3211 * 2) For groups without names, either we tried to insert ipif_ill 3212 * in a group as singleton or found some other group to become 3213 * a bigger group. For the former, if it fails we don't have 3214 * anything to do as ipif_ill is not in the group and for the 3215 * latter, there are no failures in illgrp_insert/illgrp_delete 3216 * (ENOMEM can't occur for this. Check ifgrp_insert). 3217 */ 3218 3219 while (irep > ire_array) { 3220 irep--; 3221 if (*irep != NULL) { 3222 ire_delete(*irep); 3223 if (ire_added) 3224 ire_refrele(*irep); 3225 } 3226 3227 } 3228 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst); 3229 3230 if (ipif_saved_irep != NULL) { 3231 kmem_free(ipif_saved_irep, 3232 ipif_saved_ire_cnt * sizeof (ire_t *)); 3233 } 3234 if (src_ipif_held) 3235 ipif_refrele(src_ipif); 3236 3237 ipif_ndp_down(ipif); 3238 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) 3239 ipif_arp_down(ipif); 3240 3241 return (err); 3242 } 3243 3244 /* 3245 * Delete an ND entry and the corresponding IRE_CACHE entry if it exists. 3246 */ 3247 /* ARGSUSED */ 3248 int 3249 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3250 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3251 { 3252 in6_addr_t addr; 3253 sin6_t *sin6; 3254 nce_t *nce; 3255 struct lifreq *lifr; 3256 lif_nd_req_t *lnr; 3257 mblk_t *mp1; 3258 3259 mp1 = mp->b_cont->b_cont; 3260 lifr = (struct lifreq *)mp1->b_rptr; 3261 lnr = &lifr->lifr_nd; 3262 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3263 if (ipif->ipif_id != 0) 3264 return (EINVAL); 3265 3266 if (!ipif->ipif_isv6) 3267 return (EINVAL); 3268 3269 if (lnr->lnr_addr.ss_family != AF_INET6) 3270 return (EAFNOSUPPORT); 3271 3272 sin6 = (sin6_t *)&lnr->lnr_addr; 3273 addr = sin6->sin6_addr; 3274 nce = ndp_lookup_v6(ipif->ipif_ill, &addr, B_FALSE); 3275 if (nce == NULL) 3276 return (ESRCH); 3277 ndp_delete(nce); 3278 NCE_REFRELE(nce); 3279 return (0); 3280 } 3281 3282 /* 3283 * Return nbr cache info. 3284 */ 3285 /* ARGSUSED */ 3286 int 3287 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3288 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3289 { 3290 ill_t *ill = ipif->ipif_ill; 3291 struct lifreq *lifr; 3292 lif_nd_req_t *lnr; 3293 3294 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3295 lnr = &lifr->lifr_nd; 3296 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3297 if (ipif->ipif_id != 0) 3298 return (EINVAL); 3299 3300 if (!ipif->ipif_isv6) 3301 return (EINVAL); 3302 3303 if (lnr->lnr_addr.ss_family != AF_INET6) 3304 return (EAFNOSUPPORT); 3305 3306 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 3307 return (EINVAL); 3308 3309 return (ndp_query(ill, lnr)); 3310 } 3311 3312 /* 3313 * Perform an update of the nd entry for the specified address. 3314 */ 3315 /* ARGSUSED */ 3316 int 3317 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3318 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3319 { 3320 ill_t *ill = ipif->ipif_ill; 3321 struct lifreq *lifr; 3322 lif_nd_req_t *lnr; 3323 3324 ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL); 3325 3326 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3327 lnr = &lifr->lifr_nd; 3328 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3329 if (ipif->ipif_id != 0) 3330 return (EINVAL); 3331 3332 if (!ipif->ipif_isv6) 3333 return (EINVAL); 3334 3335 if (lnr->lnr_addr.ss_family != AF_INET6) 3336 return (EAFNOSUPPORT); 3337 3338 return (ndp_sioc_update(ill, lnr)); 3339 } 3340