xref: /titanic_51/usr/src/uts/common/inet/ip/ip_ftable.c (revision 25540de2e9a31b620c68d87ce2f3bbe8a196ad93)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * This file contains consumer routines of the IPv4 forwarding engine
28  */
29 
30 #include <sys/types.h>
31 #include <sys/stream.h>
32 #include <sys/stropts.h>
33 #include <sys/strlog.h>
34 #include <sys/dlpi.h>
35 #include <sys/ddi.h>
36 #include <sys/cmn_err.h>
37 #include <sys/policy.h>
38 
39 #include <sys/systm.h>
40 #include <sys/strsun.h>
41 #include <sys/kmem.h>
42 #include <sys/param.h>
43 #include <sys/socket.h>
44 #include <sys/strsubr.h>
45 #include <sys/pattr.h>
46 #include <net/if.h>
47 #include <net/route.h>
48 #include <netinet/in.h>
49 #include <net/if_dl.h>
50 #include <netinet/ip6.h>
51 #include <netinet/icmp6.h>
52 
53 #include <inet/common.h>
54 #include <inet/mi.h>
55 #include <inet/mib2.h>
56 #include <inet/ip.h>
57 #include <inet/ip_impl.h>
58 #include <inet/ip6.h>
59 #include <inet/ip_ndp.h>
60 #include <inet/arp.h>
61 #include <inet/ip_if.h>
62 #include <inet/ip_ire.h>
63 #include <inet/ip_ftable.h>
64 #include <inet/ip_rts.h>
65 #include <inet/nd.h>
66 
67 #include <net/pfkeyv2.h>
68 #include <inet/ipsec_info.h>
69 #include <inet/sadb.h>
70 #include <inet/tcp.h>
71 #include <inet/ipclassifier.h>
72 #include <sys/zone.h>
73 #include <net/radix.h>
74 #include <sys/tsol/label.h>
75 #include <sys/tsol/tnet.h>
76 
77 #define	IS_DEFAULT_ROUTE(ire)	\
78 	(((ire)->ire_type & IRE_DEFAULT) || \
79 	    (((ire)->ire_type & IRE_INTERFACE) && ((ire)->ire_addr == 0)))
80 
81 /*
82  * structure for passing args between ire_ftable_lookup and ire_find_best_route
83  */
84 typedef struct ire_ftable_args_s {
85 	ipaddr_t	ift_addr;
86 	ipaddr_t	ift_mask;
87 	ipaddr_t	ift_gateway;
88 	int		ift_type;
89 	const ipif_t		*ift_ipif;
90 	zoneid_t	ift_zoneid;
91 	uint32_t	ift_ihandle;
92 	const ts_label_t	*ift_tsl;
93 	int		ift_flags;
94 	ire_t		*ift_best_ire;
95 } ire_ftable_args_t;
96 
97 static ire_t	*route_to_dst(const struct sockaddr *, zoneid_t, ip_stack_t *);
98 static ire_t   	*ire_round_robin(irb_t *, zoneid_t, ire_ftable_args_t *,
99     ip_stack_t *);
100 static void		ire_del_host_redir(ire_t *, char *);
101 static boolean_t	ire_find_best_route(struct radix_node *, void *);
102 static int	ip_send_align_hcksum_flags(mblk_t *, ill_t *);
103 static ire_t	*ire_ftable_lookup_simple(ipaddr_t,
104 	ire_t **, zoneid_t,  int, ip_stack_t *);
105 
106 /*
107  * Lookup a route in forwarding table. A specific lookup is indicated by
108  * passing the required parameters and indicating the match required in the
109  * flag field.
110  *
111  * Looking for default route can be done in three ways
112  * 1) pass mask as 0 and set MATCH_IRE_MASK in flags field
113  *    along with other matches.
114  * 2) pass type as IRE_DEFAULT and set MATCH_IRE_TYPE in flags
115  *    field along with other matches.
116  * 3) if the destination and mask are passed as zeros.
117  *
118  * A request to return a default route if no route
119  * is found, can be specified by setting MATCH_IRE_DEFAULT
120  * in flags.
121  *
122  * It does not support recursion more than one level. It
123  * will do recursive lookup only when the lookup maps to
124  * a prefix or default route and MATCH_IRE_RECURSIVE flag is passed.
125  *
126  * If the routing table is setup to allow more than one level
127  * of recursion, the cleaning up cache table will not work resulting
128  * in invalid routing.
129  *
130  * Supports IP_BOUND_IF by following the ipif/ill when recursing.
131  *
132  * NOTE : When this function returns NULL, pire has already been released.
133  *	  pire is valid only when this function successfully returns an
134  *	  ire.
135  */
136 ire_t *
137 ire_ftable_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway,
138     int type, const ipif_t *ipif, ire_t **pire, zoneid_t zoneid,
139     uint32_t ihandle, const ts_label_t *tsl, int flags, ip_stack_t *ipst)
140 {
141 	ire_t *ire = NULL;
142 	ipaddr_t gw_addr;
143 	struct rt_sockaddr rdst, rmask;
144 	struct rt_entry *rt;
145 	ire_ftable_args_t margs;
146 	boolean_t found_incomplete = B_FALSE;
147 
148 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
149 
150 	/*
151 	 * When we return NULL from this function, we should make
152 	 * sure that *pire is NULL so that the callers will not
153 	 * wrongly REFRELE the pire.
154 	 */
155 	if (pire != NULL)
156 		*pire = NULL;
157 	/*
158 	 * ire_match_args() will dereference ipif MATCH_IRE_SRC or
159 	 * MATCH_IRE_ILL is set.
160 	 */
161 	if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL)) && (ipif == NULL))
162 		return (NULL);
163 
164 	(void) memset(&rdst, 0, sizeof (rdst));
165 	rdst.rt_sin_len = sizeof (rdst);
166 	rdst.rt_sin_family = AF_INET;
167 	rdst.rt_sin_addr.s_addr = addr;
168 
169 	(void) memset(&rmask, 0, sizeof (rmask));
170 	rmask.rt_sin_len = sizeof (rmask);
171 	rmask.rt_sin_family = AF_INET;
172 	rmask.rt_sin_addr.s_addr = mask;
173 
174 	(void) memset(&margs, 0, sizeof (margs));
175 	margs.ift_addr = addr;
176 	margs.ift_mask = mask;
177 	margs.ift_gateway = gateway;
178 	margs.ift_type = type;
179 	margs.ift_ipif = ipif;
180 	margs.ift_zoneid = zoneid;
181 	margs.ift_ihandle = ihandle;
182 	margs.ift_tsl = tsl;
183 	margs.ift_flags = flags;
184 
185 	/*
186 	 * The flags argument passed to ire_ftable_lookup may cause the
187 	 * search to return, not the longest matching prefix, but the
188 	 * "best matching prefix", i.e., the longest prefix that also
189 	 * satisfies constraints imposed via the permutation of flags
190 	 * passed in. To achieve this, we invoke ire_match_args() on
191 	 * each matching leaf in the  radix tree. ire_match_args is
192 	 * invoked by the callback function ire_find_best_route()
193 	 * We hold the global tree lock in read mode when calling
194 	 * rn_match_args.Before dropping the global tree lock, ensure
195 	 * that the radix node can't be deleted by incrementing ire_refcnt.
196 	 */
197 	RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable);
198 	rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst,
199 	    ipst->ips_ip_ftable, ire_find_best_route, &margs);
200 	ire = margs.ift_best_ire;
201 	RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
202 
203 	if (rt == NULL) {
204 		return (NULL);
205 	} else {
206 		ASSERT(ire != NULL);
207 	}
208 
209 	DTRACE_PROBE2(ire__found, ire_ftable_args_t *, &margs, ire_t *, ire);
210 
211 	if (!IS_DEFAULT_ROUTE(ire))
212 		goto found_ire_held;
213 	/*
214 	 * If default route is found, see if default matching criteria
215 	 * are satisfied.
216 	 */
217 	if (flags & MATCH_IRE_MASK) {
218 		/*
219 		 * we were asked to match a 0 mask, and came back with
220 		 * a default route. Ok to return it.
221 		 */
222 		goto found_default_ire;
223 	}
224 	if ((flags & MATCH_IRE_TYPE) &&
225 	    (type & (IRE_DEFAULT | IRE_INTERFACE))) {
226 		/*
227 		 * we were asked to match a default ire type. Ok to return it.
228 		 */
229 		goto found_default_ire;
230 	}
231 	if (flags & MATCH_IRE_DEFAULT) {
232 		goto found_default_ire;
233 	}
234 	/*
235 	 * we found a default route, but default matching criteria
236 	 * are not specified and we are not explicitly looking for
237 	 * default.
238 	 */
239 	IRE_REFRELE(ire);
240 	return (NULL);
241 found_default_ire:
242 	/*
243 	 * round-robin only if we have more than one route in the bucket.
244 	 */
245 	if ((ire->ire_bucket->irb_ire_cnt > 1) &&
246 	    IS_DEFAULT_ROUTE(ire) &&
247 	    ((flags & (MATCH_IRE_DEFAULT | MATCH_IRE_MASK)) ==
248 	    MATCH_IRE_DEFAULT)) {
249 		ire_t *next_ire;
250 
251 		next_ire = ire_round_robin(ire->ire_bucket, zoneid, &margs,
252 		    ipst);
253 		IRE_REFRELE(ire);
254 		if (next_ire != NULL) {
255 			ire = next_ire;
256 		} else {
257 			/* no route */
258 			return (NULL);
259 		}
260 	}
261 found_ire_held:
262 	if ((flags & MATCH_IRE_RJ_BHOLE) &&
263 	    (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) {
264 		return (ire);
265 	}
266 	/*
267 	 * At this point, IRE that was found must be an IRE_FORWARDTABLE
268 	 * type.  If this is a recursive lookup and an IRE_INTERFACE type was
269 	 * found, return that.  If it was some other IRE_FORWARDTABLE type of
270 	 * IRE (one of the prefix types), then it is necessary to fill in the
271 	 * parent IRE pointed to by pire, and then lookup the gateway address of
272 	 * the parent.  For backwards compatiblity, if this lookup returns an
273 	 * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level
274 	 * of lookup is done.
275 	 */
276 	if (flags & MATCH_IRE_RECURSIVE) {
277 		ipif_t	*gw_ipif;
278 		int match_flags = MATCH_IRE_DSTONLY;
279 		ire_t *save_ire;
280 
281 		if (ire->ire_type & IRE_INTERFACE)
282 			return (ire);
283 		if (pire != NULL)
284 			*pire = ire;
285 		/*
286 		 * If we can't find an IRE_INTERFACE or the caller has not
287 		 * asked for pire, we need to REFRELE the save_ire.
288 		 */
289 		save_ire = ire;
290 
291 		if (ire->ire_ipif != NULL)
292 			match_flags |= MATCH_IRE_ILL;
293 
294 		/*
295 		 * ire_ftable_lookup may end up with an incomplete IRE_CACHE
296 		 * entry for the gateway (i.e., one for which the
297 		 * ire_nce->nce_state is not yet ND_REACHABLE). If the caller
298 		 * has specified MATCH_IRE_COMPLETE, such entries will not
299 		 * be returned; instead, we return the IF_RESOLVER ire.
300 		 */
301 		ire = ire_route_lookup(ire->ire_gateway_addr, 0, 0, 0,
302 		    ire->ire_ipif, NULL, zoneid, tsl, match_flags, ipst);
303 		DTRACE_PROBE2(ftable__route__lookup1, (ire_t *), ire,
304 		    (ire_t *), save_ire);
305 		if (ire == NULL ||
306 		    ((ire->ire_type & IRE_CACHE) && ire->ire_nce &&
307 		    ire->ire_nce->nce_state != ND_REACHABLE &&
308 		    (flags & MATCH_IRE_COMPLETE))) {
309 			/*
310 			 * Do not release the parent ire if MATCH_IRE_PARENT
311 			 * is set. Also return it via ire.
312 			 */
313 			if (ire != NULL) {
314 				ire_refrele(ire);
315 				ire = NULL;
316 				found_incomplete = B_TRUE;
317 			}
318 			if (flags & MATCH_IRE_PARENT) {
319 				if (pire != NULL) {
320 					/*
321 					 * Need an extra REFHOLD, if the parent
322 					 * ire is returned via both ire and
323 					 * pire.
324 					 */
325 					IRE_REFHOLD(save_ire);
326 				}
327 				ire = save_ire;
328 			} else {
329 				ire_refrele(save_ire);
330 				if (pire != NULL)
331 					*pire = NULL;
332 			}
333 			if (!found_incomplete)
334 				return (ire);
335 		}
336 		if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) {
337 			/*
338 			 * If the caller did not ask for pire, release
339 			 * it now.
340 			 */
341 			if (pire == NULL) {
342 				ire_refrele(save_ire);
343 			}
344 			return (ire);
345 		}
346 		match_flags |= MATCH_IRE_TYPE;
347 		gw_addr = ire->ire_gateway_addr;
348 		gw_ipif = ire->ire_ipif;
349 		ire_refrele(ire);
350 		ire = ire_route_lookup(gw_addr, 0, 0,
351 		    (found_incomplete? IRE_INTERFACE :
352 		    (IRE_CACHETABLE | IRE_INTERFACE)),
353 		    gw_ipif, NULL, zoneid, tsl, match_flags, ipst);
354 		DTRACE_PROBE2(ftable__route__lookup2, (ire_t *), ire,
355 		    (ire_t *), save_ire);
356 		if (ire == NULL ||
357 		    ((ire->ire_type & IRE_CACHE) && ire->ire_nce &&
358 		    ire->ire_nce->nce_state != ND_REACHABLE &&
359 		    (flags & MATCH_IRE_COMPLETE))) {
360 			/*
361 			 * Do not release the parent ire if MATCH_IRE_PARENT
362 			 * is set. Also return it via ire.
363 			 */
364 			if (ire != NULL) {
365 				ire_refrele(ire);
366 				ire = NULL;
367 			}
368 			if (flags & MATCH_IRE_PARENT) {
369 				if (pire != NULL) {
370 					/*
371 					 * Need an extra REFHOLD, if the
372 					 * parent ire is returned via both
373 					 * ire and pire.
374 					 */
375 					IRE_REFHOLD(save_ire);
376 				}
377 				ire = save_ire;
378 			} else {
379 				ire_refrele(save_ire);
380 				if (pire != NULL)
381 					*pire = NULL;
382 			}
383 			return (ire);
384 		} else if (pire == NULL) {
385 			/*
386 			 * If the caller did not ask for pire, release
387 			 * it now.
388 			 */
389 			ire_refrele(save_ire);
390 		}
391 		return (ire);
392 	}
393 	ASSERT(pire == NULL || *pire == NULL);
394 	return (ire);
395 }
396 
397 /*
398  * This function is called by
399  * ip_fast_forward->ire_forward_simple
400  * The optimizations of this function over ire_ftable_lookup are:
401  *	o removing unnecessary flag matching
402  *	o doing longest prefix match instead of overloading it further
403  *	  with the unnecessary "best_prefix_match"
404  *	o Does not do round robin of default route for every packet
405  *	o inlines code of ire_ctable_lookup to look for nexthop cache
406  *	  entry before calling ire_route_lookup
407  */
408 static ire_t *
409 ire_ftable_lookup_simple(ipaddr_t addr,
410     ire_t **pire, zoneid_t zoneid, int flags,
411     ip_stack_t *ipst)
412 {
413 	ire_t *ire = NULL;
414 	ire_t *tmp_ire = NULL;
415 	struct rt_sockaddr rdst;
416 	struct rt_entry *rt;
417 	irb_t *irb_ptr;
418 	ire_t *save_ire;
419 	int match_flags;
420 
421 	rdst.rt_sin_len = sizeof (rdst);
422 	rdst.rt_sin_family = AF_INET;
423 	rdst.rt_sin_addr.s_addr = addr;
424 
425 	/*
426 	 * This is basically inlining  a simpler version of ire_match_args
427 	 */
428 	RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable);
429 
430 	rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst,
431 	    ipst->ips_ip_ftable, NULL, NULL);
432 
433 	if (rt == NULL) {
434 		RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
435 		return (NULL);
436 	}
437 	irb_ptr = &rt->rt_irb;
438 	if (irb_ptr == NULL || irb_ptr->irb_ire_cnt == 0) {
439 		RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
440 		return (NULL);
441 	}
442 
443 	rw_enter(&irb_ptr->irb_lock, RW_READER);
444 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
445 		if (ire->ire_zoneid == zoneid)
446 			break;
447 	}
448 
449 	if (ire == NULL || (ire->ire_marks & IRE_MARK_CONDEMNED)) {
450 		rw_exit(&irb_ptr->irb_lock);
451 		RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
452 		return (NULL);
453 	}
454 	/* we have a ire that matches */
455 	if (ire != NULL)
456 		IRE_REFHOLD(ire);
457 	rw_exit(&irb_ptr->irb_lock);
458 	RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
459 
460 	if ((flags & MATCH_IRE_RJ_BHOLE) &&
461 	    (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) {
462 		return (ire);
463 	}
464 	/*
465 	 * At this point, IRE that was found must be an IRE_FORWARDTABLE
466 	 * type.  If this is a recursive lookup and an IRE_INTERFACE type was
467 	 * found, return that.  If it was some other IRE_FORWARDTABLE type of
468 	 * IRE (one of the prefix types), then it is necessary to fill in the
469 	 * parent IRE pointed to by pire, and then lookup the gateway address of
470 	 * the parent.  For backwards compatiblity, if this lookup returns an
471 	 * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level
472 	 * of lookup is done.
473 	 */
474 	match_flags = MATCH_IRE_DSTONLY;
475 
476 	if (ire->ire_type & IRE_INTERFACE)
477 		return (ire);
478 	*pire = ire;
479 	/*
480 	 * If we can't find an IRE_INTERFACE or the caller has not
481 	 * asked for pire, we need to REFRELE the save_ire.
482 	 */
483 	save_ire = ire;
484 
485 	/*
486 	 * Currently MATCH_IRE_ILL is never used with
487 	 * (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT) while
488 	 * sending out packets as MATCH_IRE_ILL is used only
489 	 * for communicating with on-link hosts. We can't assert
490 	 * that here as RTM_GET calls this function with
491 	 * MATCH_IRE_ILL | MATCH_IRE_DEFAULT | MATCH_IRE_RECURSIVE.
492 	 * We have already used the MATCH_IRE_ILL in determining
493 	 * the right prefix route at this point. To match the
494 	 * behavior of how we locate routes while sending out
495 	 * packets, we don't want to use MATCH_IRE_ILL below
496 	 * while locating the interface route.
497 	 *
498 	 * ire_ftable_lookup may end up with an incomplete IRE_CACHE
499 	 * entry for the gateway (i.e., one for which the
500 	 * ire_nce->nce_state is not yet ND_REACHABLE). If the caller
501 	 * has specified MATCH_IRE_COMPLETE, such entries will not
502 	 * be returned; instead, we return the IF_RESOLVER ire.
503 	 */
504 
505 	if (ire->ire_ipif == NULL) {
506 		tmp_ire = ire;
507 		/*
508 		 * Look to see if the nexthop entry is in the
509 		 * cachetable (I am inlining a simpler ire_cache_lookup
510 		 * here).
511 		 */
512 		ire = ire_cache_lookup_simple(ire->ire_gateway_addr, ipst);
513 		if (ire == NULL) {
514 			/* Try ire_route_lookup */
515 			ire = tmp_ire;
516 		} else {
517 			goto solved;
518 		}
519 	}
520 	if (ire->ire_ipif != NULL)
521 		match_flags |= MATCH_IRE_ILL;
522 
523 	ire = ire_route_lookup(ire->ire_gateway_addr, 0,
524 	    0, 0, ire->ire_ipif, NULL, zoneid, NULL, match_flags, ipst);
525 solved:
526 	DTRACE_PROBE2(ftable__route__lookup1, (ire_t *), ire,
527 	    (ire_t *), save_ire);
528 	if (ire == NULL) {
529 		/*
530 		 * Do not release the parent ire if MATCH_IRE_PARENT
531 		 * is set. Also return it via ire.
532 		 */
533 		ire_refrele(save_ire);
534 		*pire = NULL;
535 		return (ire);
536 	}
537 	if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) {
538 		/*
539 		 * If the caller did not ask for pire, release
540 		 * it now.
541 		 */
542 		if (pire == NULL) {
543 			ire_refrele(save_ire);
544 		}
545 	}
546 	return (ire);
547 }
548 
549 /*
550  * Find an IRE_OFFSUBNET IRE entry for the multicast address 'group'
551  * that goes through 'ipif'. As a fallback, a route that goes through
552  * ipif->ipif_ill can be returned.
553  */
554 ire_t *
555 ipif_lookup_multi_ire(ipif_t *ipif, ipaddr_t group)
556 {
557 	ire_t	*ire;
558 	ire_t	*save_ire = NULL;
559 	ire_t   *gw_ire;
560 	irb_t   *irb;
561 	ipaddr_t gw_addr;
562 	int	match_flags = MATCH_IRE_TYPE | MATCH_IRE_ILL;
563 	ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
564 
565 	ASSERT(CLASSD(group));
566 
567 	ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, ALL_ZONES, 0,
568 	    NULL, MATCH_IRE_DEFAULT, ipst);
569 
570 	if (ire == NULL)
571 		return (NULL);
572 
573 	irb = ire->ire_bucket;
574 	ASSERT(irb);
575 
576 	IRB_REFHOLD(irb);
577 	ire_refrele(ire);
578 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
579 		if (ire->ire_addr != group ||
580 		    ipif->ipif_zoneid != ire->ire_zoneid &&
581 		    ire->ire_zoneid != ALL_ZONES) {
582 			continue;
583 		}
584 
585 		switch (ire->ire_type) {
586 		case IRE_DEFAULT:
587 		case IRE_PREFIX:
588 		case IRE_HOST:
589 			gw_addr = ire->ire_gateway_addr;
590 			gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE,
591 			    ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst);
592 
593 			if (gw_ire != NULL) {
594 				if (save_ire != NULL) {
595 					ire_refrele(save_ire);
596 				}
597 				IRE_REFHOLD(ire);
598 				if (gw_ire->ire_ipif == ipif) {
599 					ire_refrele(gw_ire);
600 
601 					IRB_REFRELE(irb);
602 					return (ire);
603 				}
604 				ire_refrele(gw_ire);
605 				save_ire = ire;
606 			}
607 			break;
608 		case IRE_IF_NORESOLVER:
609 		case IRE_IF_RESOLVER:
610 			if (ire->ire_ipif == ipif) {
611 				if (save_ire != NULL) {
612 					ire_refrele(save_ire);
613 				}
614 				IRE_REFHOLD(ire);
615 
616 				IRB_REFRELE(irb);
617 				return (ire);
618 			}
619 			break;
620 		}
621 	}
622 	IRB_REFRELE(irb);
623 
624 	return (save_ire);
625 }
626 
627 /*
628  * Find an IRE_INTERFACE for the multicast group.
629  * Allows different routes for multicast addresses
630  * in the unicast routing table (akin to 224.0.0.0 but could be more specific)
631  * which point at different interfaces. This is used when IP_MULTICAST_IF
632  * isn't specified (when sending) and when IP_ADD_MEMBERSHIP doesn't
633  * specify the interface to join on.
634  *
635  * Supports IP_BOUND_IF by following the ipif/ill when recursing.
636  */
637 ire_t *
638 ire_lookup_multi(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst)
639 {
640 	ire_t	*ire;
641 	ipif_t	*ipif = NULL;
642 	int	match_flags = MATCH_IRE_TYPE;
643 	ipaddr_t gw_addr;
644 
645 	ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, zoneid,
646 	    0, NULL, MATCH_IRE_DEFAULT, ipst);
647 
648 	/* We search a resolvable ire in case of multirouting. */
649 	if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) {
650 		ire_t *cire = NULL;
651 		/*
652 		 * If the route is not resolvable, the looked up ire
653 		 * may be changed here. In that case, ire_multirt_lookup()
654 		 * IRE_REFRELE the original ire and change it.
655 		 */
656 		(void) ire_multirt_lookup(&cire, &ire, MULTIRT_CACHEGW,
657 		    NULL, ipst);
658 		if (cire != NULL)
659 			ire_refrele(cire);
660 	}
661 	if (ire == NULL)
662 		return (NULL);
663 	/*
664 	 * Make sure we follow ire_ipif.
665 	 *
666 	 * We need to determine the interface route through
667 	 * which the gateway will be reached.
668 	 */
669 	if (ire->ire_ipif != NULL) {
670 		ipif = ire->ire_ipif;
671 		match_flags |= MATCH_IRE_ILL;
672 	}
673 
674 	switch (ire->ire_type) {
675 	case IRE_DEFAULT:
676 	case IRE_PREFIX:
677 	case IRE_HOST:
678 		gw_addr = ire->ire_gateway_addr;
679 		ire_refrele(ire);
680 		ire = ire_ftable_lookup(gw_addr, 0, 0,
681 		    IRE_INTERFACE, ipif, NULL, zoneid, 0,
682 		    NULL, match_flags, ipst);
683 		return (ire);
684 	case IRE_IF_NORESOLVER:
685 	case IRE_IF_RESOLVER:
686 		return (ire);
687 	default:
688 		ire_refrele(ire);
689 		return (NULL);
690 	}
691 }
692 
693 /*
694  * Delete the passed in ire if the gateway addr matches
695  */
696 void
697 ire_del_host_redir(ire_t *ire, char *gateway)
698 {
699 	if ((ire->ire_flags & RTF_DYNAMIC) &&
700 	    (ire->ire_gateway_addr == *(ipaddr_t *)gateway))
701 		ire_delete(ire);
702 }
703 
704 /*
705  * Search for all HOST REDIRECT routes that are
706  * pointing at the specified gateway and
707  * delete them. This routine is called only
708  * when a default gateway is going away.
709  */
710 void
711 ire_delete_host_redirects(ipaddr_t gateway, ip_stack_t *ipst)
712 {
713 	struct rtfuncarg rtfarg;
714 
715 	(void) memset(&rtfarg, 0, sizeof (rtfarg));
716 	rtfarg.rt_func = ire_del_host_redir;
717 	rtfarg.rt_arg = (void *)&gateway;
718 	(void) ipst->ips_ip_ftable->rnh_walktree_mt(ipst->ips_ip_ftable,
719 	    rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn);
720 }
721 
722 struct ihandle_arg {
723 	uint32_t ihandle;
724 	ire_t	 *ire;
725 };
726 
727 static int
728 ire_ihandle_onlink_match(struct radix_node *rn, void *arg)
729 {
730 	struct rt_entry *rt;
731 	irb_t *irb;
732 	ire_t *ire;
733 	struct ihandle_arg *ih = arg;
734 
735 	rt = (struct rt_entry *)rn;
736 	ASSERT(rt != NULL);
737 	irb = &rt->rt_irb;
738 	for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
739 		if ((ire->ire_type & IRE_INTERFACE) &&
740 		    (ire->ire_ihandle == ih->ihandle)) {
741 			ih->ire = ire;
742 			IRE_REFHOLD(ire);
743 			return (1);
744 		}
745 	}
746 	return (0);
747 }
748 
749 /*
750  * Locate the interface ire that is tied to the cache ire 'cire' via
751  * cire->ire_ihandle.
752  *
753  * We are trying to create the cache ire for an onlink destn. or
754  * gateway in 'cire'. We are called from ire_add_v4() in the IRE_IF_RESOLVER
755  * case, after the ire has come back from ARP.
756  */
757 ire_t *
758 ire_ihandle_lookup_onlink(ire_t *cire)
759 {
760 	ire_t	*ire;
761 	int	match_flags;
762 	struct ihandle_arg ih;
763 	ip_stack_t *ipst;
764 
765 	ASSERT(cire != NULL);
766 	ipst = cire->ire_ipst;
767 
768 	/*
769 	 * We don't need to specify the zoneid to ire_ftable_lookup() below
770 	 * because the ihandle refers to an ipif which can be in only one zone.
771 	 */
772 	match_flags =  MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK;
773 	/*
774 	 * We know that the mask of the interface ire equals cire->ire_cmask.
775 	 * (When ip_newroute() created 'cire' for an on-link destn. it set its
776 	 * cmask from the interface ire's mask)
777 	 */
778 	ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0,
779 	    IRE_INTERFACE, NULL, NULL, ALL_ZONES, cire->ire_ihandle,
780 	    NULL, match_flags, ipst);
781 	if (ire != NULL)
782 		return (ire);
783 	/*
784 	 * If we didn't find an interface ire above, we can't declare failure.
785 	 * For backwards compatibility, we need to support prefix routes
786 	 * pointing to next hop gateways that are not on-link.
787 	 *
788 	 * In the resolver/noresolver case, ip_newroute() thinks it is creating
789 	 * the cache ire for an onlink destination in 'cire'. But 'cire' is
790 	 * not actually onlink, because ire_ftable_lookup() cheated it, by
791 	 * doing ire_route_lookup() twice and returning an interface ire.
792 	 *
793 	 * Eg. default	-	gw1			(line 1)
794 	 *	gw1	-	gw2			(line 2)
795 	 *	gw2	-	hme0			(line 3)
796 	 *
797 	 * In the above example, ip_newroute() tried to create the cache ire
798 	 * 'cire' for gw1, based on the interface route in line 3. The
799 	 * ire_ftable_lookup() above fails, because there is no interface route
800 	 * to reach gw1. (it is gw2). We fall thru below.
801 	 *
802 	 * Do a brute force search based on the ihandle in a subset of the
803 	 * forwarding tables, corresponding to cire->ire_cmask. Otherwise
804 	 * things become very complex, since we don't have 'pire' in this
805 	 * case. (Also note that this method is not possible in the offlink
806 	 * case because we don't know the mask)
807 	 */
808 	(void) memset(&ih, 0, sizeof (ih));
809 	ih.ihandle = cire->ire_ihandle;
810 	(void) ipst->ips_ip_ftable->rnh_walktree_mt(ipst->ips_ip_ftable,
811 	    ire_ihandle_onlink_match, &ih, irb_refhold_rn, irb_refrele_rn);
812 	return (ih.ire);
813 }
814 
815 /*
816  * IRE iterator used by ire_ftable_lookup[_v6]() to process multiple default
817  * routes. Given a starting point in the hash list (ire_origin), walk the IREs
818  * in the bucket skipping default interface routes and deleted entries.
819  * Returns the next IRE (unheld), or NULL when we're back to the starting point.
820  * Assumes that the caller holds a reference on the IRE bucket.
821  */
822 ire_t *
823 ire_get_next_default_ire(ire_t *ire, ire_t *ire_origin)
824 {
825 	ASSERT(ire_origin->ire_bucket != NULL);
826 	ASSERT(ire != NULL);
827 
828 	do {
829 		ire = ire->ire_next;
830 		if (ire == NULL)
831 			ire = ire_origin->ire_bucket->irb_ire;
832 		if (ire == ire_origin)
833 			return (NULL);
834 	} while ((ire->ire_type & IRE_INTERFACE) ||
835 	    (ire->ire_marks & IRE_MARK_CONDEMNED));
836 	ASSERT(ire != NULL);
837 	return (ire);
838 }
839 
840 static ipif_t *
841 ire_forward_src_ipif(ipaddr_t dst, ire_t *sire, ire_t *ire,
842     int zoneid, ushort_t *marks)
843 {
844 	ipif_t *src_ipif;
845 	ill_t *ill = ire->ire_ipif->ipif_ill;
846 	ip_stack_t *ipst = ill->ill_ipst;
847 
848 	/*
849 	 * Pick the best source address from ill.
850 	 *
851 	 * 1) Try to pick the source address from the destination
852 	 *    route. Clustering assumes that when we have multiple
853 	 *    prefixes hosted on an interface, the prefix of the
854 	 *    source address matches the prefix of the destination
855 	 *    route. We do this only if the address is not
856 	 *    DEPRECATED.
857 	 *
858 	 * 2) If the conn is in a different zone than the ire, we
859 	 *    need to pick a source address from the right zone.
860 	 */
861 	if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) {
862 		/*
863 		 * The RTF_SETSRC flag is set in the parent ire (sire).
864 		 * Check that the ipif matching the requested source
865 		 * address still exists.
866 		 */
867 		src_ipif = ipif_lookup_addr(sire->ire_src_addr, NULL,
868 		    zoneid, NULL, NULL, NULL, NULL, ipst);
869 		return (src_ipif);
870 	}
871 	*marks |= IRE_MARK_USESRC_CHECK;
872 	if (IS_IPMP(ill) ||
873 	    (ire->ire_ipif->ipif_flags & IPIF_DEPRECATED) ||
874 	    (ill->ill_usesrc_ifindex != 0)) {
875 		src_ipif = ipif_select_source(ill, dst, zoneid);
876 	} else {
877 		src_ipif = ire->ire_ipif;
878 		ASSERT(src_ipif != NULL);
879 		/* hold src_ipif for uniformity */
880 		ipif_refhold(src_ipif);
881 	}
882 	return (src_ipif);
883 }
884 
885 /*
886  * This function is called by ip_rput_noire() and ip_fast_forward()
887  * to resolve the route of incoming packet that needs to be forwarded.
888  * If the ire of the nexthop is not already in the cachetable, this
889  * routine will insert it to the table, but won't trigger ARP resolution yet.
890  * Thus unlike ip_newroute, this function adds incomplete ires to
891  * the cachetable. ARP resolution for these ires are  delayed until
892  * after all of the packet processing is completed and its ready to
893  * be sent out on the wire, Eventually, the packet transmit routine
894  * ip_xmit_v4() attempts to send a packet  to the driver. If it finds
895  * that there is no link layer information, it will do the arp
896  * resolution and queue the packet in ire->ire_nce->nce_qd_mp and
897  * then send it out once the arp resolution is over
898  * (see ip_xmit_v4()->ire_arpresolve()). This scheme is similar to
899  * the model of BSD/SunOS 4
900  *
901  * In future, the insertion of incomplete ires in the cachetable should
902  * be implemented in hostpath as well, as doing so will greatly reduce
903  * the existing complexity for code paths that depend on the context of
904  * the sender (such as IPsec).
905  *
906  * Thus this scheme of adding incomplete ires in cachetable in forwarding
907  * path can be used as a template for simplifying the hostpath.
908  */
909 
910 ire_t *
911 ire_forward(ipaddr_t dst, enum ire_forward_action *ret_action,
912     ire_t *supplied_ire, ire_t *supplied_sire, const struct ts_label_s *tsl,
913     ip_stack_t *ipst)
914 {
915 	ipaddr_t gw = 0;
916 	ire_t	*ire = NULL;
917 	ire_t   *sire = NULL, *save_ire;
918 	ill_t *dst_ill = NULL;
919 	int error;
920 	zoneid_t zoneid;
921 	ipif_t *src_ipif = NULL;
922 	mblk_t *res_mp;
923 	ushort_t ire_marks = 0;
924 	tsol_gcgrp_t *gcgrp = NULL;
925 	tsol_gcgrp_addr_t ga;
926 
927 	zoneid = GLOBAL_ZONEID;
928 
929 	if (supplied_ire != NULL) {
930 		/* We have arrived here from ipfil_sendpkt */
931 		ire = supplied_ire;
932 		sire = supplied_sire;
933 		goto create_irecache;
934 	}
935 
936 	ire = ire_ftable_lookup(dst, 0, 0, 0, NULL, &sire, zoneid, 0,
937 	    tsl, MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
938 	    MATCH_IRE_RJ_BHOLE | MATCH_IRE_PARENT|MATCH_IRE_SECATTR, ipst);
939 
940 	if (ire == NULL) {
941 		ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0, RTA_DST, ipst);
942 		goto icmp_err_ret;
943 	}
944 
945 	/*
946 	 * If we encounter CGTP, we should  have the caller use
947 	 * ip_newroute to resolve multirt instead of this function.
948 	 * CGTP specs explicitly state that it can't be used with routers.
949 	 * This essentially prevents insertion of incomplete RTF_MULTIRT
950 	 * ires in cachetable.
951 	 */
952 	if (ipst->ips_ip_cgtp_filter &&
953 	    ((ire->ire_flags & RTF_MULTIRT) ||
954 	    ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) {
955 		ip3dbg(("ire_forward: packet is to be multirouted- "
956 		    "handing it to ip_newroute\n"));
957 		if (sire != NULL)
958 			ire_refrele(sire);
959 		ire_refrele(ire);
960 		/*
961 		 * Inform caller about encountering of multirt so that
962 		 * ip_newroute() can be called.
963 		 */
964 		*ret_action = Forward_check_multirt;
965 		return (NULL);
966 	}
967 
968 	/*
969 	 * Verify that the returned IRE does not have either
970 	 * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is
971 	 * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER.
972 	 */
973 	if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) ||
974 	    (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0) {
975 		ip3dbg(("ire 0x%p is not cache/resolver/noresolver\n",
976 		    (void *)ire));
977 		goto icmp_err_ret;
978 	}
979 
980 	/*
981 	 * If we already have a fully resolved IRE CACHE of the
982 	 * nexthop router, just hand over the cache entry
983 	 * and we are done.
984 	 */
985 
986 	if (ire->ire_type & IRE_CACHE) {
987 
988 		/*
989 		 * If we are using this ire cache entry as a
990 		 * gateway to forward packets, chances are we
991 		 * will be using it again. So turn off
992 		 * the temporary flag, thus reducing its
993 		 * chances of getting deleted frequently.
994 		 */
995 		if (ire->ire_marks & IRE_MARK_TEMPORARY) {
996 			irb_t *irb = ire->ire_bucket;
997 			rw_enter(&irb->irb_lock, RW_WRITER);
998 			/*
999 			 * We need to recheck for IRE_MARK_TEMPORARY after
1000 			 * acquiring the lock in order to guarantee
1001 			 * irb_tmp_ire_cnt
1002 			 */
1003 			if (ire->ire_marks & IRE_MARK_TEMPORARY) {
1004 				ire->ire_marks &= ~IRE_MARK_TEMPORARY;
1005 				irb->irb_tmp_ire_cnt--;
1006 			}
1007 			rw_exit(&irb->irb_lock);
1008 		}
1009 
1010 		if (sire != NULL) {
1011 			UPDATE_OB_PKT_COUNT(sire);
1012 			sire->ire_last_used_time = lbolt;
1013 			ire_refrele(sire);
1014 		}
1015 		*ret_action = Forward_ok;
1016 		return (ire);
1017 	}
1018 create_irecache:
1019 	/*
1020 	 * Increment the ire_ob_pkt_count field for ire if it is an
1021 	 * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and
1022 	 * increment the same for the parent IRE, sire, if it is some
1023 	 * sort of prefix IRE (which includes DEFAULT, PREFIX, and HOST).
1024 	 */
1025 	if ((ire->ire_type & IRE_INTERFACE) != 0) {
1026 		UPDATE_OB_PKT_COUNT(ire);
1027 		ire->ire_last_used_time = lbolt;
1028 	}
1029 
1030 	/*
1031 	 * sire must be either IRE_CACHETABLE OR IRE_INTERFACE type
1032 	 */
1033 	if (sire != NULL) {
1034 		gw = sire->ire_gateway_addr;
1035 		ASSERT((sire->ire_type &
1036 		    (IRE_CACHETABLE | IRE_INTERFACE)) == 0);
1037 		UPDATE_OB_PKT_COUNT(sire);
1038 		sire->ire_last_used_time = lbolt;
1039 	}
1040 
1041 	dst_ill = ire->ire_ipif->ipif_ill;
1042 	if (IS_IPMP(dst_ill))
1043 		dst_ill = ipmp_illgrp_hold_next_ill(dst_ill->ill_grp);
1044 	else
1045 		ill_refhold(dst_ill);
1046 
1047 	if (dst_ill == NULL) {
1048 		ip2dbg(("ire_forward no dst ill; ire 0x%p\n", (void *)ire));
1049 		goto icmp_err_ret;
1050 	}
1051 
1052 	ASSERT(src_ipif == NULL);
1053 	/* Now obtain the src_ipif */
1054 	src_ipif = ire_forward_src_ipif(dst, sire, ire, zoneid, &ire_marks);
1055 	if (src_ipif == NULL)
1056 		goto icmp_err_ret;
1057 
1058 	switch (ire->ire_type) {
1059 	case IRE_IF_NORESOLVER:
1060 		/* create ire_cache for ire_addr endpoint */
1061 		if (dst_ill->ill_phys_addr_length != IP_ADDR_LEN &&
1062 		    dst_ill->ill_resolver_mp == NULL) {
1063 			ip1dbg(("ire_forward: dst_ill %p "
1064 			    "for IRE_IF_NORESOLVER ire %p has "
1065 			    "no ill_resolver_mp\n",
1066 			    (void *)dst_ill, (void *)ire));
1067 			goto icmp_err_ret;
1068 		}
1069 		/* FALLTHRU */
1070 	case IRE_IF_RESOLVER:
1071 		/*
1072 		 * We have the IRE_IF_RESOLVER of the nexthop gateway
1073 		 * and now need to build a IRE_CACHE for it.
1074 		 * In this case, we have the following :
1075 		 *
1076 		 * 1) src_ipif - used for getting a source address.
1077 		 *
1078 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
1079 		 *    means packets using the IRE_CACHE that we will build
1080 		 *    here will go out on dst_ill.
1081 		 *
1082 		 * 3) sire may or may not be NULL. But, the IRE_CACHE that is
1083 		 *    to be created will only be tied to the IRE_INTERFACE
1084 		 *    that was derived from the ire_ihandle field.
1085 		 *
1086 		 *    If sire is non-NULL, it means the destination is
1087 		 *    off-link and we will first create the IRE_CACHE for the
1088 		 *    gateway.
1089 		 */
1090 		res_mp = dst_ill->ill_resolver_mp;
1091 		if (ire->ire_type == IRE_IF_RESOLVER &&
1092 		    (!OK_RESOLVER_MP(res_mp))) {
1093 			goto icmp_err_ret;
1094 		}
1095 		/*
1096 		 * To be at this point in the code with a non-zero gw
1097 		 * means that dst is reachable through a gateway that
1098 		 * we have never resolved.  By changing dst to the gw
1099 		 * addr we resolve the gateway first.
1100 		 */
1101 		if (gw != INADDR_ANY) {
1102 			/*
1103 			 * The source ipif that was determined above was
1104 			 * relative to the destination address, not the
1105 			 * gateway's. If src_ipif was not taken out of
1106 			 * the IRE_IF_RESOLVER entry, we'll need to call
1107 			 * ipif_select_source() again.
1108 			 */
1109 			if (src_ipif != ire->ire_ipif) {
1110 				ipif_refrele(src_ipif);
1111 				src_ipif = ipif_select_source(dst_ill,
1112 				    gw, zoneid);
1113 				if (src_ipif == NULL)
1114 					goto icmp_err_ret;
1115 			}
1116 			dst = gw;
1117 			gw = INADDR_ANY;
1118 		}
1119 		/*
1120 		 * dst has been set to the address of the nexthop.
1121 		 *
1122 		 * TSol note: get security attributes of the nexthop;
1123 		 * Note that the nexthop may either be a gateway, or the
1124 		 * packet destination itself; Detailed explanation of
1125 		 * issues involved is  provided in the  IRE_IF_NORESOLVER
1126 		 * logic in ip_newroute().
1127 		 */
1128 		ga.ga_af = AF_INET;
1129 		IN6_IPADDR_TO_V4MAPPED(dst, &ga.ga_addr);
1130 		gcgrp = gcgrp_lookup(&ga, B_FALSE);
1131 
1132 		if (ire->ire_type == IRE_IF_NORESOLVER)
1133 			dst = ire->ire_addr; /* ire_cache for tunnel endpoint */
1134 
1135 		save_ire = ire;
1136 		/*
1137 		 * create an incomplete IRE_CACHE.
1138 		 * An areq_mp will be generated in ire_arpresolve() for
1139 		 * RESOLVER interfaces.
1140 		 */
1141 		ire = ire_create(
1142 		    (uchar_t *)&dst,		/* dest address */
1143 		    (uchar_t *)&ip_g_all_ones,	/* mask */
1144 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
1145 		    (uchar_t *)&gw,		/* gateway address */
1146 		    (save_ire->ire_type == IRE_IF_RESOLVER ?  NULL:
1147 		    &save_ire->ire_max_frag),
1148 		    NULL,
1149 		    dst_ill->ill_rq,		/* recv-from queue */
1150 		    dst_ill->ill_wq,		/* send-to queue */
1151 		    IRE_CACHE,			/* IRE type */
1152 		    src_ipif,
1153 		    ire->ire_mask,		/* Parent mask */
1154 		    0,
1155 		    ire->ire_ihandle,	/* Interface handle */
1156 		    0,
1157 		    &(ire->ire_uinfo),
1158 		    NULL,
1159 		    gcgrp,
1160 		    ipst);
1161 		ip1dbg(("incomplete ire_cache 0x%p\n", (void *)ire));
1162 		if (ire != NULL) {
1163 			gcgrp = NULL; /* reference now held by IRE */
1164 			ire->ire_marks |= ire_marks;
1165 			/* add the incomplete ire: */
1166 			error = ire_add(&ire, NULL, NULL, NULL, B_TRUE);
1167 			if (error == 0 && ire != NULL) {
1168 				ire->ire_max_frag = save_ire->ire_max_frag;
1169 				ip1dbg(("setting max_frag to %d in ire 0x%p\n",
1170 				    ire->ire_max_frag, (void *)ire));
1171 			} else {
1172 				ire_refrele(save_ire);
1173 				goto icmp_err_ret;
1174 			}
1175 		} else {
1176 			if (gcgrp != NULL) {
1177 				GCGRP_REFRELE(gcgrp);
1178 				gcgrp = NULL;
1179 			}
1180 		}
1181 
1182 		ire_refrele(save_ire);
1183 		break;
1184 	default:
1185 		break;
1186 	}
1187 
1188 	*ret_action = Forward_ok;
1189 	if (sire != NULL)
1190 		ire_refrele(sire);
1191 	if (dst_ill != NULL)
1192 		ill_refrele(dst_ill);
1193 	if (src_ipif != NULL)
1194 		ipif_refrele(src_ipif);
1195 	return (ire);
1196 icmp_err_ret:
1197 	*ret_action = Forward_ret_icmp_err;
1198 	if (sire != NULL)
1199 		ire_refrele(sire);
1200 	if (dst_ill != NULL)
1201 		ill_refrele(dst_ill);
1202 	if (src_ipif != NULL)
1203 		ipif_refrele(src_ipif);
1204 	if (ire != NULL) {
1205 		if (ire->ire_flags & RTF_BLACKHOLE)
1206 			*ret_action = Forward_blackhole;
1207 		ire_refrele(ire);
1208 	}
1209 	return (NULL);
1210 }
1211 
1212 /*
1213  * Since caller is ip_fast_forward, there is no CGTP or Tsol test
1214  * Also we dont call ftable lookup with MATCH_IRE_PARENT
1215  */
1216 
1217 ire_t *
1218 ire_forward_simple(ipaddr_t dst, enum ire_forward_action *ret_action,
1219     ip_stack_t *ipst)
1220 {
1221 	ipaddr_t gw = 0;
1222 	ire_t	*ire = NULL;
1223 	ire_t   *sire = NULL, *save_ire;
1224 	ill_t *dst_ill = NULL;
1225 	int error;
1226 	zoneid_t zoneid = GLOBAL_ZONEID;
1227 	ipif_t *src_ipif = NULL;
1228 	mblk_t *res_mp;
1229 	ushort_t ire_marks = 0;
1230 
1231 	ire = ire_ftable_lookup_simple(dst, &sire, zoneid,
1232 	    MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE, ipst);
1233 	if (ire == NULL) {
1234 		ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0, RTA_DST, ipst);
1235 		goto icmp_err_ret;
1236 	}
1237 
1238 	/*
1239 	 * Verify that the returned IRE does not have either
1240 	 * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is
1241 	 * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER.
1242 	 */
1243 	if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE))) {
1244 		ASSERT(ire->ire_type & (IRE_CACHE | IRE_INTERFACE));
1245 		ip3dbg(("ire 0x%p is not cache/resolver/noresolver\n",
1246 		    (void *)ire));
1247 		goto icmp_err_ret;
1248 	}
1249 
1250 	/*
1251 	 * If we already have a fully resolved IRE CACHE of the
1252 	 * nexthop router, just hand over the cache entry
1253 	 * and we are done.
1254 	 */
1255 	if (ire->ire_type & IRE_CACHE) {
1256 		/*
1257 		 * If we are using this ire cache entry as a
1258 		 * gateway to forward packets, chances are we
1259 		 * will be using it again. So turn off
1260 		 * the temporary flag, thus reducing its
1261 		 * chances of getting deleted frequently.
1262 		 */
1263 		if (ire->ire_marks & IRE_MARK_TEMPORARY) {
1264 			irb_t *irb = ire->ire_bucket;
1265 			rw_enter(&irb->irb_lock, RW_WRITER);
1266 			ire->ire_marks &= ~IRE_MARK_TEMPORARY;
1267 			irb->irb_tmp_ire_cnt--;
1268 			rw_exit(&irb->irb_lock);
1269 		}
1270 
1271 		if (sire != NULL) {
1272 			UPDATE_OB_PKT_COUNT(sire);
1273 			ire_refrele(sire);
1274 		}
1275 		*ret_action = Forward_ok;
1276 		return (ire);
1277 	}
1278 	/*
1279 	 * Increment the ire_ob_pkt_count field for ire if it is an
1280 	 * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and
1281 	 * increment the same for the parent IRE, sire, if it is some
1282 	 * sort of prefix IRE (which includes DEFAULT, PREFIX, and HOST).
1283 	 */
1284 	if ((ire->ire_type & IRE_INTERFACE) != 0) {
1285 		UPDATE_OB_PKT_COUNT(ire);
1286 		ire->ire_last_used_time = lbolt;
1287 	}
1288 
1289 	/*
1290 	 * sire must be either IRE_CACHETABLE OR IRE_INTERFACE type
1291 	 */
1292 	if (sire != NULL) {
1293 		gw = sire->ire_gateway_addr;
1294 		ASSERT((sire->ire_type &
1295 		    (IRE_CACHETABLE | IRE_INTERFACE)) == 0);
1296 		UPDATE_OB_PKT_COUNT(sire);
1297 	}
1298 
1299 	dst_ill = ire->ire_ipif->ipif_ill;
1300 	if (IS_IPMP(dst_ill))
1301 		dst_ill = ipmp_illgrp_hold_next_ill(dst_ill->ill_grp);
1302 	else
1303 		ill_refhold(dst_ill);	/* for symmetry */
1304 
1305 	if (dst_ill == NULL) {
1306 		ip2dbg(("ire_forward_simple: no dst ill; ire 0x%p\n",
1307 		    (void *)ire));
1308 		goto icmp_err_ret;
1309 	}
1310 
1311 	ASSERT(src_ipif == NULL);
1312 	/* Now obtain the src_ipif */
1313 	src_ipif = ire_forward_src_ipif(dst, sire, ire, zoneid, &ire_marks);
1314 	if (src_ipif == NULL)
1315 		goto icmp_err_ret;
1316 
1317 	switch (ire->ire_type) {
1318 	case IRE_IF_NORESOLVER:
1319 		/* create ire_cache for ire_addr endpoint */
1320 	case IRE_IF_RESOLVER:
1321 		/*
1322 		 * We have the IRE_IF_RESOLVER of the nexthop gateway
1323 		 * and now need to build a IRE_CACHE for it.
1324 		 * In this case, we have the following :
1325 		 *
1326 		 * 1) src_ipif - used for getting a source address.
1327 		 *
1328 		 * 2) dst_ill - from which we derive ire_stq/ire_rfq. This
1329 		 *    means packets using the IRE_CACHE that we will build
1330 		 *    here will go out on dst_ill.
1331 		 *
1332 		 * 3) sire may or may not be NULL. But, the IRE_CACHE that is
1333 		 *    to be created will only be tied to the IRE_INTERFACE
1334 		 *    that was derived from the ire_ihandle field.
1335 		 *
1336 		 *    If sire is non-NULL, it means the destination is
1337 		 *    off-link and we will first create the IRE_CACHE for the
1338 		 *    gateway.
1339 		 */
1340 		res_mp = dst_ill->ill_resolver_mp;
1341 		if (ire->ire_type == IRE_IF_RESOLVER &&
1342 		    (!OK_RESOLVER_MP(res_mp))) {
1343 			ire_refrele(ire);
1344 			ire = NULL;
1345 			goto out;
1346 		}
1347 		/*
1348 		 * To be at this point in the code with a non-zero gw
1349 		 * means that dst is reachable through a gateway that
1350 		 * we have never resolved.  By changing dst to the gw
1351 		 * addr we resolve the gateway first.
1352 		 */
1353 		if (gw != INADDR_ANY) {
1354 			/*
1355 			 * The source ipif that was determined above was
1356 			 * relative to the destination address, not the
1357 			 * gateway's. If src_ipif was not taken out of
1358 			 * the IRE_IF_RESOLVER entry, we'll need to call
1359 			 * ipif_select_source() again.
1360 			 */
1361 			if (src_ipif != ire->ire_ipif) {
1362 				ipif_refrele(src_ipif);
1363 				src_ipif = ipif_select_source(dst_ill,
1364 				    gw, zoneid);
1365 				if (src_ipif == NULL)
1366 					goto icmp_err_ret;
1367 			}
1368 			dst = gw;
1369 			gw = INADDR_ANY;
1370 		}
1371 
1372 		if (ire->ire_type == IRE_IF_NORESOLVER)
1373 			dst = ire->ire_addr; /* ire_cache for tunnel endpoint */
1374 
1375 		save_ire = ire;
1376 		/*
1377 		 * create an incomplete IRE_CACHE.
1378 		 * An areq_mp will be generated in ire_arpresolve() for
1379 		 * RESOLVER interfaces.
1380 		 */
1381 		ire = ire_create(
1382 		    (uchar_t *)&dst,		/* dest address */
1383 		    (uchar_t *)&ip_g_all_ones,	/* mask */
1384 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
1385 		    (uchar_t *)&gw,		/* gateway address */
1386 		    (save_ire->ire_type == IRE_IF_RESOLVER ?  NULL:
1387 		    &save_ire->ire_max_frag),
1388 		    NULL,
1389 		    dst_ill->ill_rq,		/* recv-from queue */
1390 		    dst_ill->ill_wq,		/* send-to queue */
1391 		    IRE_CACHE,			/* IRE type */
1392 		    src_ipif,
1393 		    ire->ire_mask,		/* Parent mask */
1394 		    0,
1395 		    ire->ire_ihandle,	/* Interface handle */
1396 		    0,
1397 		    &(ire->ire_uinfo),
1398 		    NULL,
1399 		    NULL,
1400 		    ipst);
1401 		ip1dbg(("incomplete ire_cache 0x%p\n", (void *)ire));
1402 		if (ire != NULL) {
1403 			ire->ire_marks |= ire_marks;
1404 			/* add the incomplete ire: */
1405 			error = ire_add(&ire, NULL, NULL, NULL, B_TRUE);
1406 			if (error == 0 && ire != NULL) {
1407 				ire->ire_max_frag = save_ire->ire_max_frag;
1408 				ip1dbg(("setting max_frag to %d in ire 0x%p\n",
1409 				    ire->ire_max_frag, (void *)ire));
1410 			} else {
1411 				ire_refrele(save_ire);
1412 				goto icmp_err_ret;
1413 			}
1414 		}
1415 
1416 		ire_refrele(save_ire);
1417 		break;
1418 	default:
1419 		break;
1420 	}
1421 
1422 out:
1423 	*ret_action = Forward_ok;
1424 	if (sire != NULL)
1425 		ire_refrele(sire);
1426 	if (dst_ill != NULL)
1427 		ill_refrele(dst_ill);
1428 	if (src_ipif != NULL)
1429 		ipif_refrele(src_ipif);
1430 	return (ire);
1431 icmp_err_ret:
1432 	*ret_action = Forward_ret_icmp_err;
1433 	if (src_ipif != NULL)
1434 		ipif_refrele(src_ipif);
1435 	if (dst_ill != NULL)
1436 		ill_refrele(dst_ill);
1437 	if (sire != NULL)
1438 		ire_refrele(sire);
1439 	if (ire != NULL) {
1440 		if (ire->ire_flags & RTF_BLACKHOLE)
1441 			*ret_action = Forward_blackhole;
1442 		ire_refrele(ire);
1443 	}
1444 	/* caller needs to send icmp error message */
1445 	return (NULL);
1446 
1447 }
1448 
1449 /*
1450  * Obtain the rt_entry and rt_irb for the route to be added to
1451  * the ips_ip_ftable.
1452  * First attempt to add a node to the radix tree via rn_addroute. If the
1453  * route already exists, return the bucket for the existing route.
1454  *
1455  * Locking notes: Need to hold the global radix tree lock in write mode to
1456  * add a radix node. To prevent the node from being deleted, ire_get_bucket()
1457  * returns with a ref'ed irb_t. The ire itself is added in ire_add_v4()
1458  * while holding the irb_lock, but not the radix tree lock.
1459  */
1460 irb_t *
1461 ire_get_bucket(ire_t *ire)
1462 {
1463 	struct radix_node *rn;
1464 	struct rt_entry *rt;
1465 	struct rt_sockaddr rmask, rdst;
1466 	irb_t *irb = NULL;
1467 	ip_stack_t *ipst = ire->ire_ipst;
1468 
1469 	ASSERT(ipst->ips_ip_ftable != NULL);
1470 
1471 	/* first try to see if route exists (based on rtalloc1) */
1472 	(void) memset(&rdst, 0, sizeof (rdst));
1473 	rdst.rt_sin_len = sizeof (rdst);
1474 	rdst.rt_sin_family = AF_INET;
1475 	rdst.rt_sin_addr.s_addr = ire->ire_addr;
1476 
1477 	(void) memset(&rmask, 0, sizeof (rmask));
1478 	rmask.rt_sin_len = sizeof (rmask);
1479 	rmask.rt_sin_family = AF_INET;
1480 	rmask.rt_sin_addr.s_addr = ire->ire_mask;
1481 
1482 	/*
1483 	 * add the route. based on BSD's rtrequest1(RTM_ADD)
1484 	 */
1485 	R_Malloc(rt, rt_entry_cache,  sizeof (*rt));
1486 	/* kmem_alloc failed */
1487 	if (rt == NULL)
1488 		return (NULL);
1489 
1490 	(void) memset(rt, 0, sizeof (*rt));
1491 	rt->rt_nodes->rn_key = (char *)&rt->rt_dst;
1492 	rt->rt_dst = rdst;
1493 	irb = &rt->rt_irb;
1494 	irb->irb_marks |= IRB_MARK_FTABLE; /* dynamically allocated/freed */
1495 	irb->irb_ipst = ipst;
1496 	rw_init(&irb->irb_lock, NULL, RW_DEFAULT, NULL);
1497 	RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable);
1498 	rn = ipst->ips_ip_ftable->rnh_addaddr(&rt->rt_dst, &rmask,
1499 	    ipst->ips_ip_ftable, (struct radix_node *)rt);
1500 	if (rn == NULL) {
1501 		RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
1502 		Free(rt, rt_entry_cache);
1503 		rt = NULL;
1504 		irb = NULL;
1505 		RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable);
1506 		rn = ipst->ips_ip_ftable->rnh_lookup(&rdst, &rmask,
1507 		    ipst->ips_ip_ftable);
1508 		if (rn != NULL && ((rn->rn_flags & RNF_ROOT) == 0)) {
1509 			/* found a non-root match */
1510 			rt = (struct rt_entry *)rn;
1511 		}
1512 	}
1513 	if (rt != NULL) {
1514 		irb = &rt->rt_irb;
1515 		IRB_REFHOLD(irb);
1516 	}
1517 	RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable);
1518 	return (irb);
1519 }
1520 
1521 /*
1522  * This function is used when the caller wants to know the outbound
1523  * interface for a packet given only the address.
1524  * If this is a offlink IP address and there are multiple
1525  * routes to this destination, this routine will utilise the
1526  * first route it finds to IP address
1527  * Return values:
1528  * 	0	- FAILURE
1529  *	nonzero	- ifindex
1530  */
1531 uint_t
1532 ifindex_lookup(const struct sockaddr *ipaddr, zoneid_t zoneid)
1533 {
1534 	uint_t ifindex = 0;
1535 	ire_t *ire;
1536 	ill_t *ill;
1537 	netstack_t *ns;
1538 	ip_stack_t *ipst;
1539 
1540 	if (zoneid == ALL_ZONES)
1541 		ns = netstack_find_by_zoneid(GLOBAL_ZONEID);
1542 	else
1543 		ns = netstack_find_by_zoneid(zoneid);
1544 	ASSERT(ns != NULL);
1545 
1546 	/*
1547 	 * For exclusive stacks we set the zoneid to zero
1548 	 * since IP uses the global zoneid in the exclusive stacks.
1549 	 */
1550 	if (ns->netstack_stackid != GLOBAL_NETSTACKID)
1551 		zoneid = GLOBAL_ZONEID;
1552 	ipst = ns->netstack_ip;
1553 
1554 	ASSERT(ipaddr->sa_family == AF_INET || ipaddr->sa_family == AF_INET6);
1555 
1556 	if ((ire =  route_to_dst(ipaddr, zoneid, ipst)) != NULL) {
1557 		ill = ire_to_ill(ire);
1558 		if (ill != NULL)
1559 			ifindex = ill->ill_phyint->phyint_ifindex;
1560 		ire_refrele(ire);
1561 	}
1562 	netstack_rele(ns);
1563 	return (ifindex);
1564 }
1565 
1566 /*
1567  * Routine to find the route to a destination. If a ifindex is supplied
1568  * it tries to match the the route to the corresponding ipif for the ifindex
1569  */
1570 static	ire_t *
1571 route_to_dst(const struct sockaddr *dst_addr, zoneid_t zoneid, ip_stack_t *ipst)
1572 {
1573 	ire_t *ire = NULL;
1574 	int match_flags;
1575 
1576 	match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT |
1577 	    MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE);
1578 
1579 	/* XXX pass NULL tsl for now */
1580 
1581 	if (dst_addr->sa_family == AF_INET) {
1582 		ire = ire_route_lookup(
1583 		    ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr,
1584 		    0, 0, 0, NULL, NULL, zoneid, NULL, match_flags, ipst);
1585 	} else {
1586 		ire = ire_route_lookup_v6(
1587 		    &((struct sockaddr_in6 *)dst_addr)->sin6_addr,
1588 		    0, 0, 0, NULL, NULL, zoneid, NULL, match_flags, ipst);
1589 	}
1590 	return (ire);
1591 }
1592 
1593 /*
1594  * This routine is called by IP Filter to send a packet out on the wire
1595  * to a specified V4 dst (which may be onlink or offlink). The ifindex may or
1596  * may not be 0. A non-null ifindex indicates IP Filter has stipulated
1597  * an outgoing interface and requires the nexthop to be on that interface.
1598  * IP WILL NOT DO the following to the data packet before sending it out:
1599  *	a. manipulate ttl
1600  *	b. ipsec work
1601  *	c. fragmentation
1602  *
1603  * If the packet has been prepared for hardware checksum then it will be
1604  * passed off to ip_send_align_cksum() to check that the flags set on the
1605  * packet are in alignment with the capabilities of the new outgoing NIC.
1606  *
1607  * Return values:
1608  *	0:		IP was able to send of the data pkt
1609  *	ECOMM:		Could not send packet
1610  *	ENONET		No route to dst. It is up to the caller
1611  *			to send icmp unreachable error message,
1612  *	EINPROGRESS	The macaddr of the onlink dst or that
1613  *			of the offlink dst's nexthop needs to get
1614  *			resolved before packet can be sent to dst.
1615  *			Thus transmission is not guaranteed.
1616  *
1617  */
1618 
1619 int
1620 ipfil_sendpkt(const struct sockaddr *dst_addr, mblk_t *mp, uint_t ifindex,
1621     zoneid_t zoneid)
1622 {
1623 	ire_t *ire = NULL, *sire = NULL;
1624 	ire_t *ire_cache = NULL;
1625 	int value;
1626 	int match_flags;
1627 	ipaddr_t dst;
1628 	netstack_t *ns;
1629 	ip_stack_t *ipst;
1630 	enum ire_forward_action ret_action;
1631 
1632 	ASSERT(mp != NULL);
1633 
1634 	if (zoneid == ALL_ZONES)
1635 		ns = netstack_find_by_zoneid(GLOBAL_ZONEID);
1636 	else
1637 		ns = netstack_find_by_zoneid(zoneid);
1638 	ASSERT(ns != NULL);
1639 
1640 	/*
1641 	 * For exclusive stacks we set the zoneid to zero
1642 	 * since IP uses the global zoneid in the exclusive stacks.
1643 	 */
1644 	if (ns->netstack_stackid != GLOBAL_NETSTACKID)
1645 		zoneid = GLOBAL_ZONEID;
1646 	ipst = ns->netstack_ip;
1647 
1648 	ASSERT(dst_addr->sa_family == AF_INET ||
1649 	    dst_addr->sa_family == AF_INET6);
1650 
1651 	if (dst_addr->sa_family == AF_INET) {
1652 		dst = ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr;
1653 	} else {
1654 		/*
1655 		 * We dont have support for V6 yet. It will be provided
1656 		 * once RFE  6399103  has been delivered.
1657 		 * Until then, for V6 dsts, IP Filter will not call
1658 		 * this function. Instead the netinfo framework provides
1659 		 * its own code path, in ip_inject_impl(), to achieve
1660 		 * what it needs to do, for the time being.
1661 		 */
1662 		ip1dbg(("ipfil_sendpkt: no V6 support \n"));
1663 		value = ECOMM;
1664 		freemsg(mp);
1665 		goto discard;
1666 	}
1667 
1668 	/*
1669 	 * Lets get the ire. We might get the ire cache entry,
1670 	 * or the ire,sire pair needed to create the cache entry.
1671 	 * XXX pass NULL tsl for now.
1672 	 */
1673 
1674 	if (ifindex == 0) {
1675 		/* There is no supplied index. So use the FIB info */
1676 
1677 		match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT |
1678 		    MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE);
1679 		ire = ire_route_lookup(dst,
1680 		    0, 0, 0, NULL, &sire, zoneid, MBLK_GETLABEL(mp),
1681 		    match_flags, ipst);
1682 	} else {
1683 		ipif_t *supplied_ipif;
1684 		ill_t *ill;
1685 
1686 		match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT |
1687 		    MATCH_IRE_RECURSIVE| MATCH_IRE_RJ_BHOLE|
1688 		    MATCH_IRE_SECATTR | MATCH_IRE_ILL);
1689 
1690 		/*
1691 		 * If supplied ifindex is non-null, the only valid
1692 		 * nexthop is one off of the interface corresponding
1693 		 * to the specified ifindex.
1694 		 */
1695 		ill = ill_lookup_on_ifindex(ifindex, B_FALSE,
1696 		    NULL, NULL, NULL, NULL, ipst);
1697 		if (ill != NULL) {
1698 			supplied_ipif = ipif_get_next_ipif(NULL, ill);
1699 		} else {
1700 			ip1dbg(("ipfil_sendpkt: Could not find"
1701 			    " route to dst\n"));
1702 			value = ECOMM;
1703 			freemsg(mp);
1704 			goto discard;
1705 		}
1706 
1707 		ire = ire_route_lookup(dst, 0, 0, 0, supplied_ipif,
1708 		    &sire, zoneid, MBLK_GETLABEL(mp), match_flags, ipst);
1709 		ipif_refrele(supplied_ipif);
1710 		ill_refrele(ill);
1711 	}
1712 
1713 	/*
1714 	 * Verify that the returned IRE is non-null and does
1715 	 * not have either the RTF_REJECT or RTF_BLACKHOLE
1716 	 * flags set and that the IRE is  either an IRE_CACHE,
1717 	 * IRE_IF_NORESOLVER or IRE_IF_RESOLVER.
1718 	 */
1719 	if (ire == NULL ||
1720 	    ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) ||
1721 	    (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0)) {
1722 		/*
1723 		 * Either ire could not be found or we got
1724 		 * an invalid one
1725 		 */
1726 		ip1dbg(("ipfil_sendpkt: Could not find route to dst\n"));
1727 		value = ENONET;
1728 		freemsg(mp);
1729 		goto discard;
1730 	}
1731 
1732 	/* IP Filter and CGTP dont mix. So bail out if CGTP is on */
1733 	if (ipst->ips_ip_cgtp_filter &&
1734 	    ((ire->ire_flags & RTF_MULTIRT) ||
1735 	    ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) {
1736 		ip1dbg(("ipfil_sendpkt: IPFilter does not work with CGTP\n"));
1737 		value = ECOMM;
1738 		freemsg(mp);
1739 		goto discard;
1740 	}
1741 
1742 	ASSERT(ire->ire_type != IRE_CACHE || ire->ire_nce != NULL);
1743 
1744 	/*
1745 	 * If needed, we will create the ire cache entry for the
1746 	 * nexthop, resolve its link-layer address and then send
1747 	 * the packet out without ttl or IPSec processing.
1748 	 */
1749 	switch (ire->ire_type) {
1750 	case IRE_CACHE:
1751 		if (sire != NULL) {
1752 			UPDATE_OB_PKT_COUNT(sire);
1753 			sire->ire_last_used_time = lbolt;
1754 			ire_refrele(sire);
1755 		}
1756 		ire_cache = ire;
1757 		break;
1758 	case IRE_IF_NORESOLVER:
1759 	case IRE_IF_RESOLVER:
1760 		/*
1761 		 * Call ire_forward(). This function
1762 		 * will, create the ire cache entry of the
1763 		 * the nexthop and adds this incomplete ire
1764 		 * to the ire cache table
1765 		 */
1766 		ire_cache = ire_forward(dst, &ret_action, ire, sire,
1767 		    MBLK_GETLABEL(mp), ipst);
1768 		if (ire_cache == NULL) {
1769 			ip1dbg(("ipfil_sendpkt: failed to create the"
1770 			    " ire cache entry \n"));
1771 			value = ENONET;
1772 			freemsg(mp);
1773 			sire = NULL;
1774 			ire = NULL;
1775 			goto discard;
1776 		}
1777 		break;
1778 	}
1779 
1780 	if (DB_CKSUMFLAGS(mp)) {
1781 		if (ip_send_align_hcksum_flags(mp, ire_to_ill(ire_cache)))
1782 			goto cleanup;
1783 	}
1784 
1785 	/*
1786 	 * Now that we have the ire cache entry of the nexthop, call
1787 	 * ip_xmit_v4() to trigger mac addr resolution
1788 	 * if necessary and send it once ready.
1789 	 */
1790 
1791 	value = ip_xmit_v4(mp, ire_cache, NULL, B_FALSE, NULL);
1792 cleanup:
1793 	ire_refrele(ire_cache);
1794 	/*
1795 	 * At this point, the reference for these have already been
1796 	 * released within ire_forward() and/or ip_xmit_v4(). So we set
1797 	 * them to NULL to make sure we dont drop the references
1798 	 * again in case ip_xmit_v4() returns with either SEND_FAILED
1799 	 * or LLHDR_RESLV_FAILED
1800 	 */
1801 	sire = NULL;
1802 	ire = NULL;
1803 
1804 	switch (value) {
1805 	case SEND_FAILED:
1806 		ip1dbg(("ipfil_sendpkt: Send failed\n"));
1807 		value = ECOMM;
1808 		break;
1809 	case LLHDR_RESLV_FAILED:
1810 		ip1dbg(("ipfil_sendpkt: Link-layer resolution"
1811 		    "  failed\n"));
1812 		value = ECOMM;
1813 		break;
1814 	case LOOKUP_IN_PROGRESS:
1815 		netstack_rele(ns);
1816 		return (EINPROGRESS);
1817 	case SEND_PASSED:
1818 		netstack_rele(ns);
1819 		return (0);
1820 	}
1821 discard:
1822 	if (dst_addr->sa_family == AF_INET) {
1823 		BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards);
1824 	} else {
1825 		BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards);
1826 	}
1827 	if (ire != NULL)
1828 		ire_refrele(ire);
1829 	if (sire != NULL)
1830 		ire_refrele(sire);
1831 	netstack_rele(ns);
1832 	return (value);
1833 }
1834 
1835 
1836 /*
1837  * We don't check for dohwcksum in here because it should be being used
1838  * elsewhere to control what flags are being set on the mblk.  That is,
1839  * if DB_CKSUMFLAGS() is non-zero then we assume dohwcksum to be true
1840  * for this packet.
1841  *
1842  * This function assumes that it is *only* being called for TCP or UDP
1843  * packets and nothing else.
1844  */
1845 static int
1846 ip_send_align_hcksum_flags(mblk_t *mp, ill_t *ill)
1847 {
1848 	int illhckflags;
1849 	int mbhckflags;
1850 	uint16_t *up;
1851 	uint32_t cksum;
1852 	ipha_t *ipha;
1853 	ip6_t *ip6;
1854 	int proto;
1855 	int ipversion;
1856 	int length;
1857 	int start;
1858 	ip6_pkt_t ipp;
1859 
1860 	mbhckflags = DB_CKSUMFLAGS(mp);
1861 	ASSERT(mbhckflags != 0);
1862 	ASSERT(mp->b_datap->db_type == M_DATA);
1863 	/*
1864 	 * Since this function only knows how to manage the hardware checksum
1865 	 * issue, reject and packets that have flags set on the aside from
1866 	 * checksum related attributes as we cannot necessarily safely map
1867 	 * that packet onto the new NIC.  Packets that can be potentially
1868 	 * dropped here include those marked for LSO.
1869 	 */
1870 	if ((mbhckflags &
1871 	    ~(HCK_FULLCKSUM|HCK_PARTIALCKSUM|HCK_IPV4_HDRCKSUM)) != 0) {
1872 		DTRACE_PROBE2(pbr__incapable, (mblk_t *), mp, (ill_t *), ill);
1873 		freemsg(mp);
1874 		return (-1);
1875 	}
1876 
1877 	ipha = (ipha_t *)mp->b_rptr;
1878 
1879 	/*
1880 	 * Find out what the new NIC is capable of, if anything, and
1881 	 * only allow it to be used with M_DATA mblks being sent out.
1882 	 */
1883 	if (ILL_HCKSUM_CAPABLE(ill)) {
1884 		illhckflags = ill->ill_hcksum_capab->ill_hcksum_txflags;
1885 	} else {
1886 		/*
1887 		 * No capabilities, so turn off everything.
1888 		 */
1889 		illhckflags = 0;
1890 		(void) hcksum_assoc(mp, NULL, NULL, 0, 0, 0, 0, 0, 0);
1891 		mp->b_datap->db_struioflag &= ~STRUIO_IP;
1892 	}
1893 
1894 	DTRACE_PROBE4(pbr__info__a, (mblk_t *), mp, (ill_t *), ill,
1895 	    uint32_t, illhckflags, uint32_t, mbhckflags);
1896 	/*
1897 	 * This block of code that looks for the position of the TCP/UDP
1898 	 * checksum is early in this function because we need to know
1899 	 * what needs to be blanked out for the hardware checksum case.
1900 	 *
1901 	 * That we're in this function implies that the packet is either
1902 	 * TCP or UDP on Solaris, so checks are made for one protocol and
1903 	 * if that fails, the other is therefore implied.
1904 	 */
1905 	ipversion = IPH_HDR_VERSION(ipha);
1906 
1907 	if (ipversion == IPV4_VERSION) {
1908 		proto = ipha->ipha_protocol;
1909 		if (proto == IPPROTO_TCP) {
1910 			up = IPH_TCPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH);
1911 		} else {
1912 			up = IPH_UDPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH);
1913 		}
1914 	} else {
1915 		uint8_t lasthdr;
1916 
1917 		/*
1918 		 * Nothing I've seen indicates that IPv6 checksum'ing
1919 		 * precludes the presence of extension headers, so we
1920 		 * can't just look at the next header value in the IPv6
1921 		 * packet header to see if it is TCP/UDP.
1922 		 */
1923 		ip6 = (ip6_t *)ipha;
1924 		(void) memset(&ipp, 0, sizeof (ipp));
1925 		start = ip_find_hdr_v6(mp, ip6, &ipp, &lasthdr);
1926 		proto = lasthdr;
1927 
1928 		if (proto == IPPROTO_TCP) {
1929 			up = IPH_TCPH_CHECKSUMP(ipha, start);
1930 		} else {
1931 			up = IPH_UDPH_CHECKSUMP(ipha, start);
1932 		}
1933 	}
1934 
1935 	/*
1936 	 * The first case here is easiest:
1937 	 * mblk hasn't asked for full checksum, but the card supports it.
1938 	 *
1939 	 * In addition, check for IPv4 header capability.  Note that only
1940 	 * the mblk flag is checked and not ipversion.
1941 	 */
1942 	if ((((illhckflags & HCKSUM_INET_FULL_V4) && (ipversion == 4)) ||
1943 	    (((illhckflags & HCKSUM_INET_FULL_V6) && (ipversion == 6)))) &&
1944 	    ((mbhckflags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) != 0)) {
1945 		int newflags = HCK_FULLCKSUM;
1946 
1947 		if ((mbhckflags & HCK_IPV4_HDRCKSUM) != 0) {
1948 			if ((illhckflags & HCKSUM_IPHDRCKSUM) != 0) {
1949 				newflags |= HCK_IPV4_HDRCKSUM;
1950 			} else {
1951 				/*
1952 				 * Rather than call a function, just inline
1953 				 * the computation of the basic IPv4 header.
1954 				 */
1955 				cksum = (ipha->ipha_dst >> 16) +
1956 				    (ipha->ipha_dst & 0xFFFF) +
1957 				    (ipha->ipha_src >> 16) +
1958 				    (ipha->ipha_src & 0xFFFF);
1959 				IP_HDR_CKSUM(ipha, cksum,
1960 				    ((uint32_t *)ipha)[0],
1961 				    ((uint16_t *)ipha)[4]);
1962 			}
1963 		}
1964 
1965 		*up = 0;
1966 		(void) hcksum_assoc(mp, NULL, NULL, 0, 0, 0, 0,
1967 		    newflags, 0);
1968 		return (0);
1969 	}
1970 
1971 	DTRACE_PROBE2(pbr__info__b, int, ipversion, int, proto);
1972 
1973 	/*
1974 	 * Start calculating the pseudo checksum over the IP packet header.
1975 	 * Although the final pseudo checksum used by TCP/UDP consists of
1976 	 * more than just the address fields, we can use the result of
1977 	 * adding those together a little bit further down for IPv4.
1978 	 */
1979 	if (ipversion == IPV4_VERSION) {
1980 		cksum = (ipha->ipha_dst >> 16) + (ipha->ipha_dst & 0xFFFF) +
1981 		    (ipha->ipha_src >> 16) + (ipha->ipha_src & 0xFFFF);
1982 		start = IP_SIMPLE_HDR_LENGTH;
1983 		length = ntohs(ipha->ipha_length);
1984 		DTRACE_PROBE3(pbr__info__e, uint32_t, ipha->ipha_src,
1985 		    uint32_t, ipha->ipha_dst, int, cksum);
1986 	} else {
1987 		uint16_t *pseudo;
1988 
1989 		pseudo = (uint16_t *)&ip6->ip6_src;
1990 
1991 		/* calculate pseudo-header checksum */
1992 		cksum = pseudo[0] + pseudo[1] + pseudo[2] + pseudo[3] +
1993 		    pseudo[4] + pseudo[5] + pseudo[6] + pseudo[7] +
1994 		    pseudo[8] + pseudo[9] + pseudo[10] + pseudo[11] +
1995 		    pseudo[12] + pseudo[13] + pseudo[14] + pseudo[15];
1996 
1997 		length = ntohs(ip6->ip6_plen) + sizeof (ip6_t);
1998 	}
1999 
2000 	/* Fold the initial sum */
2001 	cksum = (cksum & 0xffff) + (cksum >> 16);
2002 
2003 	/*
2004 	 * If the packet was asking for an IPv4 header checksum to be
2005 	 * calculated but the interface doesn't support that, fill it in
2006 	 * using our pseudo checksum as a starting point.
2007 	 */
2008 	if (((mbhckflags & HCK_IPV4_HDRCKSUM) != 0) &&
2009 	    ((illhckflags & HCKSUM_IPHDRCKSUM) == 0)) {
2010 		/*
2011 		 * IP_HDR_CKSUM uses the 2rd arg to the macro in a destructive
2012 		 * way so pass in a copy of the checksum calculated thus far.
2013 		 */
2014 		uint32_t ipsum = cksum;
2015 
2016 		DB_CKSUMFLAGS(mp) &= ~HCK_IPV4_HDRCKSUM;
2017 
2018 		IP_HDR_CKSUM(ipha, ipsum, ((uint32_t *)ipha)[0],
2019 		    ((uint16_t *)ipha)[4]);
2020 	}
2021 
2022 	DTRACE_PROBE3(pbr__info__c, int, start, int, length, int, cksum);
2023 
2024 	if (proto == IPPROTO_TCP) {
2025 		cksum += IP_TCP_CSUM_COMP;
2026 	} else {
2027 		cksum += IP_UDP_CSUM_COMP;
2028 	}
2029 	cksum += htons(length - start);
2030 	cksum = (cksum & 0xffff) + (cksum >> 16);
2031 
2032 	/*
2033 	 * For TCP/UDP, we either want to setup the packet for partial
2034 	 * checksum or we want to do it all ourselves because the NIC
2035 	 * offers no support for either partial or full checksum.
2036 	 */
2037 	if ((illhckflags & HCKSUM_INET_PARTIAL) != 0) {
2038 		/*
2039 		 * The only case we care about here is if the mblk was
2040 		 * previously set for full checksum offload.  If it was
2041 		 * marked for partial (and the NIC does partial), then
2042 		 * we have nothing to do.  Similarly if the packet was
2043 		 * not set for partial or full, we do nothing as this
2044 		 * is cheaper than more work to set something up.
2045 		 */
2046 		if ((mbhckflags & HCK_FULLCKSUM) != 0) {
2047 			uint32_t offset;
2048 
2049 			if (proto == IPPROTO_TCP) {
2050 				offset = TCP_CHECKSUM_OFFSET;
2051 			} else {
2052 				offset = UDP_CHECKSUM_OFFSET;
2053 			}
2054 			*up = cksum;
2055 
2056 			DTRACE_PROBE3(pbr__info__f, int, length - start, int,
2057 			    cksum, int, offset);
2058 
2059 			(void) hcksum_assoc(mp, NULL, NULL, start,
2060 			    start + offset, length, 0,
2061 			    DB_CKSUMFLAGS(mp) | HCK_PARTIALCKSUM, 0);
2062 		}
2063 
2064 	} else if (mbhckflags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) {
2065 		DB_CKSUMFLAGS(mp) &= ~(HCK_PARTIALCKSUM|HCK_FULLCKSUM);
2066 
2067 		*up = 0;
2068 		*up = IP_CSUM(mp, start, cksum);
2069 	}
2070 
2071 	DTRACE_PROBE4(pbr__info__d, (mblk_t *), mp, (ipha_t *), ipha,
2072 	    (uint16_t *), up, int, cksum);
2073 	return (0);
2074 }
2075 
2076 /*
2077  * callback function provided by ire_ftable_lookup when calling
2078  * rn_match_args(). Invoke ire_match_args on each matching leaf node in
2079  * the radix tree.
2080  */
2081 boolean_t
2082 ire_find_best_route(struct radix_node *rn, void *arg)
2083 {
2084 	struct rt_entry *rt = (struct rt_entry *)rn;
2085 	irb_t *irb_ptr;
2086 	ire_t *ire;
2087 	ire_ftable_args_t *margs = arg;
2088 	ipaddr_t match_mask;
2089 
2090 	ASSERT(rt != NULL);
2091 
2092 	irb_ptr = &rt->rt_irb;
2093 
2094 	if (irb_ptr->irb_ire_cnt == 0)
2095 		return (B_FALSE);
2096 
2097 	rw_enter(&irb_ptr->irb_lock, RW_READER);
2098 	for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) {
2099 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
2100 			continue;
2101 		if (margs->ift_flags & MATCH_IRE_MASK)
2102 			match_mask = margs->ift_mask;
2103 		else
2104 			match_mask = ire->ire_mask;
2105 
2106 		if (ire_match_args(ire, margs->ift_addr, match_mask,
2107 		    margs->ift_gateway, margs->ift_type, margs->ift_ipif,
2108 		    margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl,
2109 		    margs->ift_flags, NULL)) {
2110 			IRE_REFHOLD(ire);
2111 			rw_exit(&irb_ptr->irb_lock);
2112 			margs->ift_best_ire = ire;
2113 			return (B_TRUE);
2114 		}
2115 	}
2116 	rw_exit(&irb_ptr->irb_lock);
2117 	return (B_FALSE);
2118 }
2119 
2120 /*
2121  * ftable irb_t structures are dynamically allocated, and we need to
2122  * check if the irb_t (and associated ftable tree attachment) needs to
2123  * be cleaned up when the irb_refcnt goes to 0. The conditions that need
2124  * be verified are:
2125  * - no other walkers of the irebucket, i.e., quiescent irb_refcnt,
2126  * - no other threads holding references to ire's in the bucket,
2127  *   i.e., irb_nire == 0
2128  * - no active ire's in the bucket, i.e., irb_ire_cnt == 0
2129  * - need to hold the global tree lock and irb_lock in write mode.
2130  */
2131 void
2132 irb_refrele_ftable(irb_t *irb)
2133 {
2134 	for (;;) {
2135 		rw_enter(&irb->irb_lock, RW_WRITER);
2136 		ASSERT(irb->irb_refcnt != 0);
2137 		if (irb->irb_refcnt != 1) {
2138 			/*
2139 			 * Someone has a reference to this radix node
2140 			 * or there is some bucket walker.
2141 			 */
2142 			irb->irb_refcnt--;
2143 			rw_exit(&irb->irb_lock);
2144 			return;
2145 		} else {
2146 			/*
2147 			 * There is no other walker, nor is there any
2148 			 * other thread that holds a direct ref to this
2149 			 * radix node. Do the clean up if needed. Call
2150 			 * to ire_unlink will clear the IRB_MARK_CONDEMNED flag
2151 			 */
2152 			if (irb->irb_marks & IRB_MARK_CONDEMNED)  {
2153 				ire_t *ire_list;
2154 
2155 				ire_list = ire_unlink(irb);
2156 				rw_exit(&irb->irb_lock);
2157 
2158 				if (ire_list != NULL)
2159 					ire_cleanup(ire_list);
2160 				/*
2161 				 * more CONDEMNED entries could have
2162 				 * been added while we dropped the lock,
2163 				 * so we have to re-check.
2164 				 */
2165 				continue;
2166 			}
2167 
2168 			/*
2169 			 * Now check if there are still any ires
2170 			 * associated with this radix node.
2171 			 */
2172 			if (irb->irb_nire != 0) {
2173 				/*
2174 				 * someone is still holding on
2175 				 * to ires in this bucket
2176 				 */
2177 				irb->irb_refcnt--;
2178 				rw_exit(&irb->irb_lock);
2179 				return;
2180 			} else {
2181 				/*
2182 				 * Everything is clear. Zero walkers,
2183 				 * Zero threads with a ref to this
2184 				 * radix node, Zero ires associated with
2185 				 * this radix node. Due to lock order,
2186 				 * check the above conditions again
2187 				 * after grabbing all locks in the right order
2188 				 */
2189 				rw_exit(&irb->irb_lock);
2190 				if (irb_inactive(irb))
2191 					return;
2192 				/*
2193 				 * irb_inactive could not free the irb.
2194 				 * See if there are any walkers, if not
2195 				 * try to clean up again.
2196 				 */
2197 			}
2198 		}
2199 	}
2200 }
2201 
2202 /*
2203  * IRE iterator used by ire_ftable_lookup() to process multiple default
2204  * routes. Given a starting point in the hash list (ire_origin), walk the IREs
2205  * in the bucket skipping default interface routes and deleted entries.
2206  * Returns the next IRE (unheld), or NULL when we're back to the starting point.
2207  * Assumes that the caller holds a reference on the IRE bucket.
2208  *
2209  * In the absence of good IRE_DEFAULT routes, this function will return
2210  * the first IRE_INTERFACE route found (if any).
2211  */
2212 ire_t *
2213 ire_round_robin(irb_t *irb_ptr, zoneid_t zoneid, ire_ftable_args_t *margs,
2214 	ip_stack_t *ipst)
2215 {
2216 	ire_t	*ire_origin;
2217 	ire_t	*ire, *maybe_ire = NULL;
2218 
2219 	rw_enter(&irb_ptr->irb_lock, RW_WRITER);
2220 	ire_origin = irb_ptr->irb_rr_origin;
2221 	if (ire_origin != NULL) {
2222 		ire_origin = ire_origin->ire_next;
2223 		IRE_FIND_NEXT_ORIGIN(ire_origin);
2224 	}
2225 
2226 	if (ire_origin == NULL) {
2227 		/*
2228 		 * first time through routine, or we dropped off the end
2229 		 * of list.
2230 		 */
2231 		ire_origin = irb_ptr->irb_ire;
2232 		IRE_FIND_NEXT_ORIGIN(ire_origin);
2233 	}
2234 	irb_ptr->irb_rr_origin = ire_origin;
2235 	IRB_REFHOLD_LOCKED(irb_ptr);
2236 	rw_exit(&irb_ptr->irb_lock);
2237 
2238 	DTRACE_PROBE2(ire__rr__origin, (irb_t *), irb_ptr,
2239 	    (ire_t *), ire_origin);
2240 
2241 	/*
2242 	 * Round-robin the routers list looking for a route that
2243 	 * matches the passed in parameters.
2244 	 * We start with the ire we found above and we walk the hash
2245 	 * list until we're back where we started. It doesn't matter if
2246 	 * routes are added or deleted by other threads - we know this
2247 	 * ire will stay in the list because we hold a reference on the
2248 	 * ire bucket.
2249 	 */
2250 	ire = ire_origin;
2251 	while (ire != NULL) {
2252 		int match_flags = MATCH_IRE_TYPE | MATCH_IRE_SECATTR;
2253 		ire_t *rire;
2254 
2255 		if (ire->ire_marks & IRE_MARK_CONDEMNED)
2256 			goto next_ire;
2257 
2258 		if (!ire_match_args(ire, margs->ift_addr, (ipaddr_t)0,
2259 		    margs->ift_gateway, margs->ift_type, margs->ift_ipif,
2260 		    margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl,
2261 		    margs->ift_flags, NULL))
2262 			goto next_ire;
2263 
2264 		if (ire->ire_type & IRE_INTERFACE) {
2265 			/*
2266 			 * keep looking to see if there is a non-interface
2267 			 * default ire, but save this one as a last resort.
2268 			 */
2269 			if (maybe_ire == NULL)
2270 				maybe_ire = ire;
2271 			goto next_ire;
2272 		}
2273 
2274 		if (zoneid == ALL_ZONES) {
2275 			IRE_REFHOLD(ire);
2276 			IRB_REFRELE(irb_ptr);
2277 			return (ire);
2278 		}
2279 		/*
2280 		 * When we're in a non-global zone, we're only
2281 		 * interested in routers that are
2282 		 * reachable through ipifs within our zone.
2283 		 */
2284 		if (ire->ire_ipif != NULL)
2285 			match_flags |= MATCH_IRE_ILL;
2286 
2287 		rire = ire_route_lookup(ire->ire_gateway_addr, 0, 0,
2288 		    IRE_INTERFACE, ire->ire_ipif, NULL, zoneid, margs->ift_tsl,
2289 		    match_flags, ipst);
2290 		if (rire != NULL) {
2291 			ire_refrele(rire);
2292 			IRE_REFHOLD(ire);
2293 			IRB_REFRELE(irb_ptr);
2294 			return (ire);
2295 		}
2296 next_ire:
2297 		ire = (ire->ire_next ?  ire->ire_next : irb_ptr->irb_ire);
2298 		if (ire == ire_origin)
2299 			break;
2300 	}
2301 	if (maybe_ire != NULL)
2302 		IRE_REFHOLD(maybe_ire);
2303 	IRB_REFRELE(irb_ptr);
2304 	return (maybe_ire);
2305 }
2306 
2307 void
2308 irb_refhold_rn(struct radix_node *rn)
2309 {
2310 	if ((rn->rn_flags & RNF_ROOT) == 0)
2311 		IRB_REFHOLD(&((rt_t *)(rn))->rt_irb);
2312 }
2313 
2314 void
2315 irb_refrele_rn(struct radix_node *rn)
2316 {
2317 	if ((rn->rn_flags & RNF_ROOT) == 0)
2318 		irb_refrele_ftable(&((rt_t *)(rn))->rt_irb);
2319 }
2320