1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* Copyright (c) 1990 Mentat Inc. */ 26 27 #pragma ident "%Z%%M% %I% %E% SMI" 28 29 30 /* 31 * This file contains routines that manipulate Internet Routing Entries (IREs). 32 */ 33 34 #include <sys/types.h> 35 #include <sys/stream.h> 36 #include <sys/stropts.h> 37 #include <sys/strsun.h> 38 #include <sys/ddi.h> 39 #include <sys/cmn_err.h> 40 #include <sys/policy.h> 41 42 #include <sys/systm.h> 43 #include <sys/kmem.h> 44 #include <sys/param.h> 45 #include <sys/socket.h> 46 #include <net/if.h> 47 #include <net/route.h> 48 #include <netinet/in.h> 49 #include <net/if_dl.h> 50 #include <netinet/ip6.h> 51 #include <netinet/icmp6.h> 52 53 #include <inet/common.h> 54 #include <inet/mi.h> 55 #include <inet/ip.h> 56 #include <inet/ip6.h> 57 #include <inet/ip_ndp.h> 58 #include <inet/arp.h> 59 #include <inet/ip_if.h> 60 #include <inet/ip_ire.h> 61 #include <inet/ip_ftable.h> 62 #include <inet/ip_rts.h> 63 #include <inet/nd.h> 64 65 #include <net/pfkeyv2.h> 66 #include <inet/ipsec_info.h> 67 #include <inet/sadb.h> 68 #include <sys/kmem.h> 69 #include <inet/tcp.h> 70 #include <inet/ipclassifier.h> 71 #include <sys/zone.h> 72 #include <sys/cpuvar.h> 73 74 #include <sys/tsol/label.h> 75 #include <sys/tsol/tnet.h> 76 #include <sys/dlpi.h> 77 78 struct kmem_cache *rt_entry_cache; 79 80 /* 81 * Synchronization notes: 82 * 83 * The fields of the ire_t struct are protected in the following way : 84 * 85 * ire_next/ire_ptpn 86 * 87 * - bucket lock of the respective tables (cache or forwarding tables). 88 * 89 * ire_mp, ire_rfq, ire_stq, ire_u *except* ire_gateway_addr[v6], ire_mask, 90 * ire_type, ire_create_time, ire_masklen, ire_ipversion, ire_flags, ire_ipif, 91 * ire_ihandle, ire_phandle, ire_nce, ire_bucket, ire_in_ill, ire_in_src_addr 92 * 93 * - Set in ire_create_v4/v6 and never changes after that. Thus, 94 * we don't need a lock whenever these fields are accessed. 95 * 96 * - ire_bucket and ire_masklen (also set in ire_create) is set in 97 * ire_add_v4/ire_add_v6 before inserting in the bucket and never 98 * changes after that. Thus we don't need a lock whenever these 99 * fields are accessed. 100 * 101 * ire_gateway_addr_v4[v6] 102 * 103 * - ire_gateway_addr_v4[v6] is set during ire_create and later modified 104 * by rts_setgwr[v6]. As ire_gateway_addr is a uint32_t, updates to 105 * it assumed to be atomic and hence the other parts of the code 106 * does not use any locks. ire_gateway_addr_v6 updates are not atomic 107 * and hence any access to it uses ire_lock to get/set the right value. 108 * 109 * ire_ident, ire_refcnt 110 * 111 * - Updated atomically using atomic_add_32 112 * 113 * ire_ssthresh, ire_rtt_sd, ire_rtt, ire_ib_pkt_count, ire_ob_pkt_count 114 * 115 * - Assumes that 32 bit writes are atomic. No locks. ire_lock is 116 * used to serialize updates to ire_ssthresh, ire_rtt_sd, ire_rtt. 117 * 118 * ire_max_frag, ire_frag_flag 119 * 120 * - ire_lock is used to set/read both of them together. 121 * 122 * ire_tire_mark 123 * 124 * - Set in ire_create and updated in ire_expire, which is called 125 * by only one function namely ip_trash_timer_expire. Thus only 126 * one function updates and examines the value. 127 * 128 * ire_marks 129 * - bucket lock protects this. 130 * 131 * ire_ipsec_overhead/ire_ll_hdr_length 132 * 133 * - Place holder for returning the information to the upper layers 134 * when IRE_DB_REQ comes down. 135 * 136 * 137 * ipv6_ire_default_count is protected by the bucket lock of 138 * ip_forwarding_table_v6[0][0]. 139 * 140 * ipv6_ire_default_index is not protected as it is just a hint 141 * at which default gateway to use. There is nothing 142 * wrong in using the same gateway for two different connections. 143 * 144 * As we always hold the bucket locks in all the places while accessing 145 * the above values, it is natural to use them for protecting them. 146 * 147 * We have a separate cache table and forwarding table for IPv4 and IPv6. 148 * Cache table (ip_cache_table/ip_cache_table_v6) is a pointer to an 149 * array of irb_t structure and forwarding table (ip_forwarding_table/ 150 * ip_forwarding_table_v6) is an array of pointers to array of irb_t 151 * structure. ip_forwarding_table_v6 is allocated dynamically in 152 * ire_add_v6. ire_ft_init_lock is used to serialize multiple threads 153 * initializing the same bucket. Once a bucket is initialized, it is never 154 * de-alloacted. This assumption enables us to access 155 * ip_forwarding_table_v6[i] without any locks. 156 * 157 * Each irb_t - ire bucket structure has a lock to protect 158 * a bucket and the ires residing in the bucket have a back pointer to 159 * the bucket structure. It also has a reference count for the number 160 * of threads walking the bucket - irb_refcnt which is bumped up 161 * using the macro IRB_REFHOLD macro. The flags irb_flags can be 162 * set to IRE_MARK_CONDEMNED indicating that there are some ires 163 * in this bucket that are marked with IRE_MARK_CONDEMNED and the 164 * last thread to leave the bucket should delete the ires. Usually 165 * this is done by the IRB_REFRELE macro which is used to decrement 166 * the reference count on a bucket. 167 * 168 * IRE_REFHOLD/IRE_REFRELE macros operate on the ire which increments/ 169 * decrements the reference count, ire_refcnt, atomically on the ire. 170 * ire_refcnt is modified only using this macro. Operations on the IRE 171 * could be described as follows : 172 * 173 * CREATE an ire with reference count initialized to 1. 174 * 175 * ADDITION of an ire holds the bucket lock, checks for duplicates 176 * and then adds the ire. ire_add_v4/ire_add_v6 returns the ire after 177 * bumping up once more i.e the reference count is 2. This is to avoid 178 * an extra lookup in the functions calling ire_add which wants to 179 * work with the ire after adding. 180 * 181 * LOOKUP of an ire bumps up the reference count using IRE_REFHOLD 182 * macro. It is valid to bump up the referece count of the IRE, 183 * after the lookup has returned an ire. Following are the lookup 184 * functions that return an HELD ire : 185 * 186 * ire_lookup_local[_v6], ire_ctable_lookup[_v6], ire_ftable_lookup[_v6], 187 * ire_cache_lookup[_v6], ire_lookup_multi[_v6], ire_route_lookup[_v6], 188 * ipif_to_ire[_v6], ire_mrtun_lookup, ire_srcif_table_lookup. 189 * 190 * DELETION of an ire holds the bucket lock, removes it from the list 191 * and then decrements the reference count for having removed from the list 192 * by using the IRE_REFRELE macro. If some other thread has looked up 193 * the ire, the reference count would have been bumped up and hence 194 * this ire will not be freed once deleted. It will be freed once the 195 * reference count drops to zero. 196 * 197 * Add and Delete acquires the bucket lock as RW_WRITER, while all the 198 * lookups acquire the bucket lock as RW_READER. 199 * 200 * NOTE : The only functions that does the IRE_REFRELE when an ire is 201 * passed as an argument are : 202 * 203 * 1) ip_wput_ire : This is because it IRE_REFHOLD/RELEs the 204 * broadcast ires it looks up internally within 205 * the function. Currently, for simplicity it does 206 * not differentiate the one that is passed in and 207 * the ones it looks up internally. It always 208 * IRE_REFRELEs. 209 * 2) ire_send 210 * ire_send_v6 : As ire_send calls ip_wput_ire and other functions 211 * that take ire as an argument, it has to selectively 212 * IRE_REFRELE the ire. To maintain symmetry, 213 * ire_send_v6 does the same. 214 * 215 * Otherwise, the general rule is to do the IRE_REFRELE in the function 216 * that is passing the ire as an argument. 217 * 218 * In trying to locate ires the following points are to be noted. 219 * 220 * IRE_MARK_CONDEMNED signifies that the ire has been logically deleted and is 221 * to be ignored when walking the ires using ire_next. 222 * 223 * IRE_MARK_HIDDEN signifies that the ire is a special ire typically for the 224 * benefit of in.mpathd which needs to probe interfaces for failures. Normal 225 * applications should not be seeing this ire and hence this ire is ignored 226 * in most cases in the search using ire_next. 227 * 228 * Zones note: 229 * Walking IREs within a given zone also walks certain ires in other 230 * zones. This is done intentionally. IRE walks with a specified 231 * zoneid are used only when doing informational reports, and 232 * zone users want to see things that they can access. See block 233 * comment in ire_walk_ill_match(). 234 */ 235 236 /* 237 * A per-interface routing table is created ( if not present) 238 * when the first entry is added to this special routing table. 239 * This special routing table is accessed through the ill data structure. 240 * The routing table looks like cache table. For example, currently it 241 * is used by mobile-ip foreign agent to forward data that only comes from 242 * the home agent tunnel for a mobile node. Thus if the outgoing interface 243 * is a RESOLVER interface, IP may need to resolve the hardware address for 244 * the outgoing interface. The routing entries in this table are not updated 245 * in IRE_CACHE. When MCTL msg comes back from ARP, the incoming ill informa- 246 * tion is lost as the write queue is passed to ip_wput. 247 * But, before sending the packet out, the hardware information must be updated 248 * in the special forwarding table. ire_srcif_table_count keeps track of total 249 * number of ires that are in interface based tables. Each interface based 250 * table hangs off of the incoming ill and each ill_t also keeps a refcnt 251 * of ires in that table. 252 */ 253 254 /* 255 * The minimum size of IRE cache table. It will be recalcuated in 256 * ip_ire_init(). 257 * Setable in /etc/system 258 */ 259 uint32_t ip_cache_table_size = IP_CACHE_TABLE_SIZE; 260 uint32_t ip6_cache_table_size = IP6_CACHE_TABLE_SIZE; 261 262 /* 263 * The size of the forwarding table. We will make sure that it is a 264 * power of 2 in ip_ire_init(). 265 * Setable in /etc/system 266 */ 267 uint32_t ip6_ftable_hash_size = IP6_FTABLE_HASH_SIZE; 268 269 struct kmem_cache *ire_cache; 270 static ire_t ire_null; 271 272 /* 273 * The threshold number of IRE in a bucket when the IREs are 274 * cleaned up. This threshold is calculated later in ip_open() 275 * based on the speed of CPU and available memory. This default 276 * value is the maximum. 277 * 278 * We have two kinds of cached IRE, temporary and 279 * non-temporary. Temporary IREs are marked with 280 * IRE_MARK_TEMPORARY. They are IREs created for non 281 * TCP traffic and for forwarding purposes. All others 282 * are non-temporary IREs. We don't mark IRE created for 283 * TCP as temporary because TCP is stateful and there are 284 * info stored in the IRE which can be shared by other TCP 285 * connections to the same destination. For connected 286 * endpoint, we also don't want to mark the IRE used as 287 * temporary because the same IRE will be used frequently, 288 * otherwise, the app should not do a connect(). We change 289 * the marking at ip_bind_connected_*() if necessary. 290 * 291 * We want to keep the cache IRE hash bucket length reasonably 292 * short, otherwise IRE lookup functions will take "forever." 293 * We use the "crude" function that the IRE bucket 294 * length should be based on the CPU speed, which is 1 entry 295 * per x MHz, depending on the shift factor ip_ire_cpu_ratio 296 * (n). This means that with a 750MHz CPU, the max bucket 297 * length can be (750 >> n) entries. 298 * 299 * Note that this threshold is separate for temp and non-temp 300 * IREs. This means that the actual bucket length can be 301 * twice as that. And while we try to keep temporary IRE 302 * length at most at the threshold value, we do not attempt to 303 * make the length for non-temporary IREs fixed, for the 304 * reason stated above. Instead, we start trying to find 305 * "unused" non-temporary IREs when the bucket length reaches 306 * this threshold and clean them up. 307 * 308 * We also want to limit the amount of memory used by 309 * IREs. So if we are allowed to use ~3% of memory (M) 310 * for those IREs, each bucket should not have more than 311 * 312 * M / num of cache bucket / sizeof (ire_t) 313 * 314 * Again the above memory uses are separate for temp and 315 * non-temp cached IREs. 316 * 317 * We may also want the limit to be a function of the number 318 * of interfaces and number of CPUs. Doing the initialization 319 * in ip_open() means that every time an interface is plumbed, 320 * the max is re-calculated. Right now, we don't do anything 321 * different. In future, when we have more experience, we 322 * may want to change this behavior. 323 */ 324 uint32_t ip_ire_max_bucket_cnt = 10; /* Setable in /etc/system */ 325 uint32_t ip6_ire_max_bucket_cnt = 10; 326 327 /* 328 * The minimum of the temporary IRE bucket count. We do not want 329 * the length of each bucket to be too short. This may hurt 330 * performance of some apps as the temporary IREs are removed too 331 * often. 332 */ 333 uint32_t ip_ire_min_bucket_cnt = 3; /* /etc/system - not used */ 334 uint32_t ip6_ire_min_bucket_cnt = 3; 335 336 /* 337 * The ratio of memory consumed by IRE used for temporary to available 338 * memory. This is a shift factor, so 6 means the ratio 1 to 64. This 339 * value can be changed in /etc/system. 6 is a reasonable number. 340 */ 341 uint32_t ip_ire_mem_ratio = 6; /* /etc/system */ 342 /* The shift factor for CPU speed to calculate the max IRE bucket length. */ 343 uint32_t ip_ire_cpu_ratio = 7; /* /etc/system */ 344 345 typedef struct nce_clookup_s { 346 ipaddr_t ncecl_addr; 347 boolean_t ncecl_found; 348 } nce_clookup_t; 349 350 /* 351 * The maximum number of buckets in IRE cache table. In future, we may 352 * want to make it a dynamic hash table. For the moment, we fix the 353 * size and allocate the table in ip_ire_init() when IP is first loaded. 354 * We take into account the amount of memory a system has. 355 */ 356 #define IP_MAX_CACHE_TABLE_SIZE 4096 357 358 /* Setable in /etc/system */ 359 static uint32_t ip_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE; 360 static uint32_t ip6_max_cache_table_size = IP_MAX_CACHE_TABLE_SIZE; 361 362 #define NUM_ILLS 3 /* To build the ILL list to unlock */ 363 364 /* Zero iulp_t for initialization. */ 365 const iulp_t ire_uinfo_null = { 0 }; 366 367 static int ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, 368 ipsq_func_t func, boolean_t); 369 static int ire_add_srcif_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, 370 ipsq_func_t func); 371 static ire_t *ire_update_srcif_v4(ire_t *ire); 372 static void ire_delete_v4(ire_t *ire); 373 static void ire_report_ctable(ire_t *ire, char *mp); 374 static void ire_report_mrtun_table(ire_t *ire, char *mp); 375 static void ire_report_srcif_table(ire_t *ire, char *mp, ip_stack_t *ipst); 376 static void ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, 377 zoneid_t zoneid, ip_stack_t *); 378 static void ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, 379 pfv_t func, void *arg, uchar_t vers, ill_t *ill); 380 static void ire_cache_cleanup(irb_t *irb, uint32_t threshold, int cnt); 381 extern void ill_unlock_ills(ill_t **list, int cnt); 382 static void ip_nce_clookup_and_delete(nce_t *nce, void *arg); 383 extern void th_trace_rrecord(th_trace_t *); 384 #ifdef IRE_DEBUG 385 static void ire_trace_inactive(ire_t *); 386 #endif 387 388 /* 389 * To avoid bloating the code, we call this function instead of 390 * using the macro IRE_REFRELE. Use macro only in performance 391 * critical paths. 392 * 393 * Must not be called while holding any locks. Otherwise if this is 394 * the last reference to be released there is a chance of recursive mutex 395 * panic due to ire_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying 396 * to restart an ioctl. The one exception is when the caller is sure that 397 * this is not the last reference to be released. Eg. if the caller is 398 * sure that the ire has not been deleted and won't be deleted. 399 */ 400 void 401 ire_refrele(ire_t *ire) 402 { 403 IRE_REFRELE(ire); 404 } 405 406 void 407 ire_refrele_notr(ire_t *ire) 408 { 409 IRE_REFRELE_NOTR(ire); 410 } 411 412 /* 413 * kmem_cache_alloc constructor for IRE in kma space. 414 * Note that when ire_mp is set the IRE is stored in that mblk and 415 * not in this cache. 416 */ 417 /* ARGSUSED */ 418 static int 419 ip_ire_constructor(void *buf, void *cdrarg, int kmflags) 420 { 421 ire_t *ire = buf; 422 423 ire->ire_nce = NULL; 424 425 return (0); 426 } 427 428 /* ARGSUSED1 */ 429 static void 430 ip_ire_destructor(void *buf, void *cdrarg) 431 { 432 ire_t *ire = buf; 433 434 ASSERT(ire->ire_nce == NULL); 435 } 436 437 /* 438 * This function is associated with the IP_IOC_IRE_ADVISE_NO_REPLY 439 * IOCTL. It is used by TCP (or other ULPs) to supply revised information 440 * for an existing CACHED IRE. 441 */ 442 /* ARGSUSED */ 443 int 444 ip_ire_advise(queue_t *q, mblk_t *mp, cred_t *ioc_cr) 445 { 446 uchar_t *addr_ucp; 447 ipic_t *ipic; 448 ire_t *ire; 449 ipaddr_t addr; 450 in6_addr_t v6addr; 451 irb_t *irb; 452 zoneid_t zoneid; 453 ip_stack_t *ipst = CONNQ_TO_IPST(q); 454 455 ASSERT(q->q_next == NULL); 456 zoneid = Q_TO_CONN(q)->conn_zoneid; 457 458 /* 459 * Check privilege using the ioctl credential; if it is NULL 460 * then this is a kernel message and therefor privileged. 461 */ 462 if (ioc_cr != NULL && secpolicy_ip_config(ioc_cr, B_FALSE) != 0) 463 return (EPERM); 464 465 ipic = (ipic_t *)mp->b_rptr; 466 if (!(addr_ucp = mi_offset_param(mp, ipic->ipic_addr_offset, 467 ipic->ipic_addr_length))) { 468 return (EINVAL); 469 } 470 if (!OK_32PTR(addr_ucp)) 471 return (EINVAL); 472 switch (ipic->ipic_addr_length) { 473 case IP_ADDR_LEN: { 474 /* Extract the destination address. */ 475 addr = *(ipaddr_t *)addr_ucp; 476 /* Find the corresponding IRE. */ 477 ire = ire_cache_lookup(addr, zoneid, NULL, ipst); 478 break; 479 } 480 case IPV6_ADDR_LEN: { 481 /* Extract the destination address. */ 482 v6addr = *(in6_addr_t *)addr_ucp; 483 /* Find the corresponding IRE. */ 484 ire = ire_cache_lookup_v6(&v6addr, zoneid, NULL, ipst); 485 break; 486 } 487 default: 488 return (EINVAL); 489 } 490 491 if (ire == NULL) 492 return (ENOENT); 493 /* 494 * Update the round trip time estimate and/or the max frag size 495 * and/or the slow start threshold. 496 * 497 * We serialize multiple advises using ire_lock. 498 */ 499 mutex_enter(&ire->ire_lock); 500 if (ipic->ipic_rtt) { 501 /* 502 * If there is no old cached values, initialize them 503 * conservatively. Set them to be (1.5 * new value). 504 */ 505 if (ire->ire_uinfo.iulp_rtt != 0) { 506 ire->ire_uinfo.iulp_rtt = (ire->ire_uinfo.iulp_rtt + 507 ipic->ipic_rtt) >> 1; 508 } else { 509 ire->ire_uinfo.iulp_rtt = ipic->ipic_rtt + 510 (ipic->ipic_rtt >> 1); 511 } 512 if (ire->ire_uinfo.iulp_rtt_sd != 0) { 513 ire->ire_uinfo.iulp_rtt_sd = 514 (ire->ire_uinfo.iulp_rtt_sd + 515 ipic->ipic_rtt_sd) >> 1; 516 } else { 517 ire->ire_uinfo.iulp_rtt_sd = ipic->ipic_rtt_sd + 518 (ipic->ipic_rtt_sd >> 1); 519 } 520 } 521 if (ipic->ipic_max_frag) 522 ire->ire_max_frag = MIN(ipic->ipic_max_frag, IP_MAXPACKET); 523 if (ipic->ipic_ssthresh != 0) { 524 if (ire->ire_uinfo.iulp_ssthresh != 0) 525 ire->ire_uinfo.iulp_ssthresh = 526 (ipic->ipic_ssthresh + 527 ire->ire_uinfo.iulp_ssthresh) >> 1; 528 else 529 ire->ire_uinfo.iulp_ssthresh = ipic->ipic_ssthresh; 530 } 531 /* 532 * Don't need the ire_lock below this. ire_type does not change 533 * after initialization. ire_marks is protected by irb_lock. 534 */ 535 mutex_exit(&ire->ire_lock); 536 537 if (ipic->ipic_ire_marks != 0 && ire->ire_type == IRE_CACHE) { 538 /* 539 * Only increment the temporary IRE count if the original 540 * IRE is not already marked temporary. 541 */ 542 irb = ire->ire_bucket; 543 rw_enter(&irb->irb_lock, RW_WRITER); 544 if ((ipic->ipic_ire_marks & IRE_MARK_TEMPORARY) && 545 !(ire->ire_marks & IRE_MARK_TEMPORARY)) { 546 irb->irb_tmp_ire_cnt++; 547 } 548 ire->ire_marks |= ipic->ipic_ire_marks; 549 rw_exit(&irb->irb_lock); 550 } 551 552 ire_refrele(ire); 553 return (0); 554 } 555 556 /* 557 * This function is associated with the IP_IOC_IRE_DELETE[_NO_REPLY] 558 * IOCTL[s]. The NO_REPLY form is used by TCP to delete a route IRE 559 * for a host that is not responding. This will force an attempt to 560 * establish a new route, if available, and flush out the ARP entry so 561 * it will re-resolve. Management processes may want to use the 562 * version that generates a reply. 563 * 564 * This function does not support IPv6 since Neighbor Unreachability Detection 565 * means that negative advise like this is useless. 566 */ 567 /* ARGSUSED */ 568 int 569 ip_ire_delete(queue_t *q, mblk_t *mp, cred_t *ioc_cr) 570 { 571 uchar_t *addr_ucp; 572 ipaddr_t addr; 573 ire_t *ire; 574 ipid_t *ipid; 575 boolean_t routing_sock_info = B_FALSE; /* Sent info? */ 576 zoneid_t zoneid; 577 ire_t *gire = NULL; 578 ill_t *ill; 579 mblk_t *arp_mp; 580 ip_stack_t *ipst; 581 582 ASSERT(q->q_next == NULL); 583 zoneid = Q_TO_CONN(q)->conn_zoneid; 584 ipst = CONNQ_TO_IPST(q); 585 586 /* 587 * Check privilege using the ioctl credential; if it is NULL 588 * then this is a kernel message and therefor privileged. 589 */ 590 if (ioc_cr != NULL && secpolicy_ip_config(ioc_cr, B_FALSE) != 0) 591 return (EPERM); 592 593 ipid = (ipid_t *)mp->b_rptr; 594 595 /* Only actions on IRE_CACHEs are acceptable at present. */ 596 if (ipid->ipid_ire_type != IRE_CACHE) 597 return (EINVAL); 598 599 addr_ucp = mi_offset_param(mp, ipid->ipid_addr_offset, 600 ipid->ipid_addr_length); 601 if (addr_ucp == NULL || !OK_32PTR(addr_ucp)) 602 return (EINVAL); 603 switch (ipid->ipid_addr_length) { 604 case IP_ADDR_LEN: 605 /* addr_ucp points at IP addr */ 606 break; 607 case sizeof (sin_t): { 608 sin_t *sin; 609 /* 610 * got complete (sockaddr) address - increment addr_ucp to point 611 * at the ip_addr field. 612 */ 613 sin = (sin_t *)addr_ucp; 614 addr_ucp = (uchar_t *)&sin->sin_addr.s_addr; 615 break; 616 } 617 default: 618 return (EINVAL); 619 } 620 /* Extract the destination address. */ 621 bcopy(addr_ucp, &addr, IP_ADDR_LEN); 622 623 /* Try to find the CACHED IRE. */ 624 ire = ire_cache_lookup(addr, zoneid, NULL, ipst); 625 626 /* Nail it. */ 627 if (ire) { 628 /* Allow delete only on CACHE entries */ 629 if (ire->ire_type != IRE_CACHE) { 630 ire_refrele(ire); 631 return (EINVAL); 632 } 633 634 /* 635 * Verify that the IRE has been around for a while. 636 * This is to protect against transport protocols 637 * that are too eager in sending delete messages. 638 */ 639 if (gethrestime_sec() < 640 ire->ire_create_time + ipst->ips_ip_ignore_delete_time) { 641 ire_refrele(ire); 642 return (EINVAL); 643 } 644 /* 645 * Now we have a potentially dead cache entry. We need 646 * to remove it. 647 * If this cache entry is generated from a 648 * default route (i.e., ire_cmask == 0), 649 * search the default list and mark it dead and some 650 * background process will try to activate it. 651 */ 652 if ((ire->ire_gateway_addr != 0) && (ire->ire_cmask == 0)) { 653 /* 654 * Make sure that we pick a different 655 * IRE_DEFAULT next time. 656 */ 657 ire_t *gw_ire; 658 irb_t *irb = NULL; 659 uint_t match_flags; 660 661 match_flags = (MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE); 662 663 gire = ire_ftable_lookup(ire->ire_addr, 664 ire->ire_cmask, 0, 0, 665 ire->ire_ipif, NULL, zoneid, 0, NULL, match_flags, 666 ipst); 667 668 ip3dbg(("ire_ftable_lookup() returned gire %p\n", 669 (void *)gire)); 670 671 if (gire != NULL) { 672 irb = gire->ire_bucket; 673 674 /* 675 * We grab it as writer just to serialize 676 * multiple threads trying to bump up 677 * irb_rr_origin 678 */ 679 rw_enter(&irb->irb_lock, RW_WRITER); 680 if ((gw_ire = irb->irb_rr_origin) == NULL) { 681 rw_exit(&irb->irb_lock); 682 goto done; 683 } 684 685 DTRACE_PROBE1(ip__ire__del__origin, 686 (ire_t *), gw_ire); 687 688 /* Skip past the potentially bad gateway */ 689 if (ire->ire_gateway_addr == 690 gw_ire->ire_gateway_addr) { 691 ire_t *next = gw_ire->ire_next; 692 693 DTRACE_PROBE2(ip__ire__del, 694 (ire_t *), gw_ire, (irb_t *), irb); 695 IRE_FIND_NEXT_ORIGIN(next); 696 irb->irb_rr_origin = next; 697 } 698 rw_exit(&irb->irb_lock); 699 } 700 } 701 done: 702 if (gire != NULL) 703 IRE_REFRELE(gire); 704 /* report the bad route to routing sockets */ 705 ip_rts_change(RTM_LOSING, ire->ire_addr, ire->ire_gateway_addr, 706 ire->ire_mask, ire->ire_src_addr, 0, 0, 0, 707 (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA), ipst); 708 routing_sock_info = B_TRUE; 709 710 /* 711 * TCP is really telling us to start over completely, and it 712 * expects that we'll resend the ARP query. Tell ARP to 713 * discard the entry, if this is a local destination. 714 */ 715 ill = ire->ire_stq->q_ptr; 716 if (ire->ire_gateway_addr == 0 && 717 (arp_mp = ill_ared_alloc(ill, addr)) != NULL) { 718 putnext(ill->ill_rq, arp_mp); 719 } 720 721 ire_delete(ire); 722 ire_refrele(ire); 723 } 724 /* 725 * Also look for an IRE_HOST type redirect ire and 726 * remove it if present. 727 */ 728 ire = ire_route_lookup(addr, 0, 0, IRE_HOST, NULL, NULL, 729 ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 730 731 /* Nail it. */ 732 if (ire != NULL) { 733 if (ire->ire_flags & RTF_DYNAMIC) { 734 if (!routing_sock_info) { 735 ip_rts_change(RTM_LOSING, ire->ire_addr, 736 ire->ire_gateway_addr, ire->ire_mask, 737 ire->ire_src_addr, 0, 0, 0, 738 (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA), 739 ipst); 740 } 741 ire_delete(ire); 742 } 743 ire_refrele(ire); 744 } 745 return (0); 746 } 747 748 /* 749 * Named Dispatch routine to produce a formatted report on all IREs. 750 * This report is accessed by using the ndd utility to "get" ND variable 751 * "ipv4_ire_status". 752 */ 753 /* ARGSUSED */ 754 int 755 ip_ire_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr) 756 { 757 zoneid_t zoneid; 758 ip_stack_t *ipst; 759 760 if (CONN_Q(q)) 761 ipst = CONNQ_TO_IPST(q); 762 else 763 ipst = ILLQ_TO_IPST(q); 764 765 (void) mi_mpprintf(mp, 766 "IRE " MI_COL_HDRPAD_STR 767 /* 01234567[89ABCDEF] */ 768 "rfq " MI_COL_HDRPAD_STR 769 /* 01234567[89ABCDEF] */ 770 "stq " MI_COL_HDRPAD_STR 771 /* 01234567[89ABCDEF] */ 772 " zone " 773 /* 12345 */ 774 "addr mask " 775 /* 123.123.123.123 123.123.123.123 */ 776 "src gateway mxfrg rtt rtt_sd ssthresh ref " 777 /* 123.123.123.123 123.123.123.123 12345 12345 123456 12345678 123 */ 778 "rtomax tstamp_ok wscale_ok ecn_ok pmtud_ok sack sendpipe " 779 /* 123456 123456789 123456789 123456 12345678 1234 12345678 */ 780 "recvpipe in/out/forward type"); 781 /* 12345678 in/out/forward xxxxxxxxxx */ 782 783 /* 784 * Because of the ndd constraint, at most we can have 64K buffer 785 * to put in all IRE info. So to be more efficient, just 786 * allocate a 64K buffer here, assuming we need that large buffer. 787 * This should be OK as only root can do ndd /dev/ip. 788 */ 789 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 790 /* The following may work even if we cannot get a large buf. */ 791 (void) mi_mpprintf(mp, "<< Out of buffer >>\n"); 792 return (0); 793 } 794 795 zoneid = Q_TO_CONN(q)->conn_zoneid; 796 if (zoneid == GLOBAL_ZONEID) 797 zoneid = ALL_ZONES; 798 799 ire_walk_v4(ire_report_ftable, mp->b_cont, zoneid, ipst); 800 ire_walk_v4(ire_report_ctable, mp->b_cont, zoneid, ipst); 801 802 return (0); 803 } 804 805 806 /* ire_walk routine invoked for ip_ire_report for each cached IRE. */ 807 static void 808 ire_report_ctable(ire_t *ire, char *mp) 809 { 810 char buf1[16]; 811 char buf2[16]; 812 char buf3[16]; 813 char buf4[16]; 814 uint_t fo_pkt_count; 815 uint_t ib_pkt_count; 816 int ref; 817 uint_t print_len, buf_len; 818 819 if ((ire->ire_type & IRE_CACHETABLE) == 0) 820 return; 821 buf_len = ((mblk_t *)mp)->b_datap->db_lim - ((mblk_t *)mp)->b_wptr; 822 if (buf_len <= 0) 823 return; 824 825 /* Number of active references of this ire */ 826 ref = ire->ire_refcnt; 827 /* "inbound" to a non local address is a forward */ 828 ib_pkt_count = ire->ire_ib_pkt_count; 829 fo_pkt_count = 0; 830 if (!(ire->ire_type & (IRE_LOCAL|IRE_BROADCAST))) { 831 fo_pkt_count = ib_pkt_count; 832 ib_pkt_count = 0; 833 } 834 print_len = snprintf((char *)((mblk_t *)mp)->b_wptr, buf_len, 835 MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR "%5d " 836 "%s %s %s %s %05d %05ld %06ld %08d %03d %06d %09d %09d %06d %08d " 837 "%04d %08d %08d %d/%d/%d %s\n", 838 (void *)ire, (void *)ire->ire_rfq, (void *)ire->ire_stq, 839 (int)ire->ire_zoneid, 840 ip_dot_addr(ire->ire_addr, buf1), ip_dot_addr(ire->ire_mask, buf2), 841 ip_dot_addr(ire->ire_src_addr, buf3), 842 ip_dot_addr(ire->ire_gateway_addr, buf4), 843 ire->ire_max_frag, ire->ire_uinfo.iulp_rtt, 844 ire->ire_uinfo.iulp_rtt_sd, ire->ire_uinfo.iulp_ssthresh, ref, 845 ire->ire_uinfo.iulp_rtomax, 846 (ire->ire_uinfo.iulp_tstamp_ok ? 1: 0), 847 (ire->ire_uinfo.iulp_wscale_ok ? 1: 0), 848 (ire->ire_uinfo.iulp_ecn_ok ? 1: 0), 849 (ire->ire_uinfo.iulp_pmtud_ok ? 1: 0), 850 ire->ire_uinfo.iulp_sack, 851 ire->ire_uinfo.iulp_spipe, ire->ire_uinfo.iulp_rpipe, 852 ib_pkt_count, ire->ire_ob_pkt_count, fo_pkt_count, 853 ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type)); 854 if (print_len < buf_len) { 855 ((mblk_t *)mp)->b_wptr += print_len; 856 } else { 857 ((mblk_t *)mp)->b_wptr += buf_len; 858 } 859 } 860 861 /* ARGSUSED */ 862 int 863 ip_ire_report_mrtun(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr) 864 { 865 ip_stack_t *ipst; 866 867 if (CONN_Q(q)) 868 ipst = CONNQ_TO_IPST(q); 869 else 870 ipst = ILLQ_TO_IPST(q); 871 872 (void) mi_mpprintf(mp, 873 "IRE " MI_COL_HDRPAD_STR 874 /* 01234567[89ABCDEF] */ 875 "stq " MI_COL_HDRPAD_STR 876 /* 01234567[89ABCDEF] */ 877 "in_ill " MI_COL_HDRPAD_STR 878 /* 01234567[89ABCDEF] */ 879 "in_src_addr " 880 /* 123.123.123.123 */ 881 "max_frag " 882 /* 12345 */ 883 "ref "); 884 /* 123 */ 885 886 ire_walk_ill_mrtun(0, 0, ire_report_mrtun_table, mp, NULL, 887 ipst); 888 return (0); 889 } 890 891 /* mrtun report table - supports ipv4_mrtun_ire_status ndd variable */ 892 893 static void 894 ire_report_mrtun_table(ire_t *ire, char *mp) 895 { 896 char buf1[INET_ADDRSTRLEN]; 897 int ref; 898 899 /* Number of active references of this ire */ 900 ref = ire->ire_refcnt; 901 ASSERT(ire->ire_type == IRE_MIPRTUN); 902 (void) mi_mpprintf((mblk_t *)mp, 903 MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR 904 "%s %05d %03d", 905 (void *)ire, (void *)ire->ire_stq, 906 (void *)ire->ire_in_ill, 907 ip_dot_addr(ire->ire_in_src_addr, buf1), 908 ire->ire_max_frag, ref); 909 } 910 911 /* 912 * Dispatch routine to format ires in interface based routine 913 */ 914 /* ARGSUSED */ 915 int 916 ip_ire_report_srcif(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr) 917 { 918 ip_stack_t *ipst; 919 920 if (CONN_Q(q)) 921 ipst = CONNQ_TO_IPST(q); 922 else 923 ipst = ILLQ_TO_IPST(q); 924 925 /* Report all interface based ires */ 926 927 (void) mi_mpprintf(mp, 928 "IRE " MI_COL_HDRPAD_STR 929 /* 01234567[89ABCDEF] */ 930 "stq " MI_COL_HDRPAD_STR 931 /* 01234567[89ABCDEF] */ 932 "in_ill " MI_COL_HDRPAD_STR 933 /* 01234567[89ABCDEF] */ 934 "addr " 935 /* 123.123.123.123 */ 936 "gateway " 937 /* 123.123.123.123 */ 938 "max_frag " 939 /* 12345 */ 940 "ref " 941 /* 123 */ 942 "type " 943 /* ABCDEFGH */ 944 "in/out/forward"); 945 ire_walk_srcif_table_v4(ire_report_srcif_table, mp, ipst); 946 return (0); 947 } 948 949 /* Reports the interface table ires */ 950 /* ARGSUSED2 */ 951 static void 952 ire_report_srcif_table(ire_t *ire, char *mp, ip_stack_t *ipst) 953 { 954 char buf1[INET_ADDRSTRLEN]; 955 char buf2[INET_ADDRSTRLEN]; 956 int ref; 957 958 ref = ire->ire_refcnt; 959 (void) mi_mpprintf((mblk_t *)mp, 960 MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR 961 "%s %s %05d %03d %s %d", 962 (void *)ire, (void *)ire->ire_stq, 963 (void *)ire->ire_in_ill, 964 ip_dot_addr(ire->ire_addr, buf1), 965 ip_dot_addr(ire->ire_gateway_addr, buf2), 966 ire->ire_max_frag, ref, 967 ip_nv_lookup(ire_nv_tbl, (int)ire->ire_type), 968 ire->ire_ib_pkt_count); 969 970 } 971 /* 972 * ip_ire_req is called by ip_wput when an IRE_DB_REQ_TYPE message is handed 973 * down from the Upper Level Protocol to request a copy of the IRE (to check 974 * its type or to extract information like round-trip time estimates or the 975 * MTU.) 976 * The address is assumed to be in the ire_addr field. If no IRE is found 977 * an IRE is returned with ire_type being zero. 978 * Note that the upper lavel protocol has to check for broadcast 979 * (IRE_BROADCAST) and multicast (CLASSD(addr)). 980 * If there is a b_cont the resulting IRE_DB_TYPE mblk is placed at the 981 * end of the returned message. 982 * 983 * TCP sends down a message of this type with a connection request packet 984 * chained on. UDP and ICMP send it down to verify that a route exists for 985 * the destination address when they get connected. 986 */ 987 void 988 ip_ire_req(queue_t *q, mblk_t *mp) 989 { 990 ire_t *inire; 991 ire_t *ire; 992 mblk_t *mp1; 993 ire_t *sire = NULL; 994 zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid; 995 ip_stack_t *ipst = CONNQ_TO_IPST(q); 996 997 ASSERT(q->q_next == NULL); 998 999 if ((mp->b_wptr - mp->b_rptr) < sizeof (ire_t) || 1000 !OK_32PTR(mp->b_rptr)) { 1001 freemsg(mp); 1002 return; 1003 } 1004 inire = (ire_t *)mp->b_rptr; 1005 /* 1006 * Got it, now take our best shot at an IRE. 1007 */ 1008 if (inire->ire_ipversion == IPV6_VERSION) { 1009 ire = ire_route_lookup_v6(&inire->ire_addr_v6, 0, 0, 0, 1010 NULL, &sire, zoneid, NULL, 1011 (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT), ipst); 1012 } else { 1013 ASSERT(inire->ire_ipversion == IPV4_VERSION); 1014 ire = ire_route_lookup(inire->ire_addr, 0, 0, 0, 1015 NULL, &sire, zoneid, NULL, 1016 (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT), ipst); 1017 } 1018 1019 /* 1020 * We prevent returning IRES with source address INADDR_ANY 1021 * as these were temporarily created for sending packets 1022 * from endpoints that have conn_unspec_src set. 1023 */ 1024 if (ire == NULL || 1025 (ire->ire_ipversion == IPV4_VERSION && 1026 ire->ire_src_addr == INADDR_ANY) || 1027 (ire->ire_ipversion == IPV6_VERSION && 1028 IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6))) { 1029 inire->ire_type = 0; 1030 } else { 1031 bcopy(ire, inire, sizeof (ire_t)); 1032 /* Copy the route metrics from the parent. */ 1033 if (sire != NULL) { 1034 bcopy(&(sire->ire_uinfo), &(inire->ire_uinfo), 1035 sizeof (iulp_t)); 1036 } 1037 1038 /* 1039 * As we don't lookup global policy here, we may not 1040 * pass the right size if per-socket policy is not 1041 * present. For these cases, path mtu discovery will 1042 * do the right thing. 1043 */ 1044 inire->ire_ipsec_overhead = conn_ipsec_length(Q_TO_CONN(q)); 1045 1046 /* Pass the latest setting of the ip_path_mtu_discovery */ 1047 inire->ire_frag_flag |= 1048 (ipst->ips_ip_path_mtu_discovery) ? IPH_DF : 0; 1049 } 1050 if (ire != NULL) 1051 ire_refrele(ire); 1052 if (sire != NULL) 1053 ire_refrele(sire); 1054 mp->b_wptr = &mp->b_rptr[sizeof (ire_t)]; 1055 mp->b_datap->db_type = IRE_DB_TYPE; 1056 1057 /* Put the IRE_DB_TYPE mblk last in the chain */ 1058 mp1 = mp->b_cont; 1059 if (mp1 != NULL) { 1060 mp->b_cont = NULL; 1061 linkb(mp1, mp); 1062 mp = mp1; 1063 } 1064 qreply(q, mp); 1065 } 1066 1067 /* 1068 * Send a packet using the specified IRE. 1069 * If ire_src_addr_v6 is all zero then discard the IRE after 1070 * the packet has been sent. 1071 */ 1072 static void 1073 ire_send(queue_t *q, mblk_t *pkt, ire_t *ire) 1074 { 1075 mblk_t *ipsec_mp; 1076 boolean_t is_secure; 1077 uint_t ifindex; 1078 ill_t *ill; 1079 zoneid_t zoneid = ire->ire_zoneid; 1080 ip_stack_t *ipst = ire->ire_ipst; 1081 1082 ASSERT(ire->ire_ipversion == IPV4_VERSION); 1083 ASSERT(!(ire->ire_type & IRE_LOCAL)); /* Has different ire_zoneid */ 1084 ipsec_mp = pkt; 1085 is_secure = (pkt->b_datap->db_type == M_CTL); 1086 if (is_secure) { 1087 ipsec_out_t *io; 1088 1089 pkt = pkt->b_cont; 1090 io = (ipsec_out_t *)ipsec_mp->b_rptr; 1091 if (io->ipsec_out_type == IPSEC_OUT) 1092 zoneid = io->ipsec_out_zoneid; 1093 } 1094 1095 /* If the packet originated externally then */ 1096 if (pkt->b_prev) { 1097 ire_refrele(ire); 1098 /* 1099 * Extract the ifindex from b_prev (set in ip_rput_noire). 1100 * Look up interface to see if it still exists (it could have 1101 * been unplumbed by the time the reply came back from ARP) 1102 */ 1103 ifindex = (uint_t)(uintptr_t)pkt->b_prev; 1104 ill = ill_lookup_on_ifindex(ifindex, B_FALSE, 1105 NULL, NULL, NULL, NULL, ipst); 1106 if (ill == NULL) { 1107 pkt->b_prev = NULL; 1108 pkt->b_next = NULL; 1109 freemsg(ipsec_mp); 1110 return; 1111 } 1112 q = ill->ill_rq; 1113 pkt->b_prev = NULL; 1114 /* 1115 * This packet has not gone through IPSEC processing 1116 * and hence we should not have any IPSEC message 1117 * prepended. 1118 */ 1119 ASSERT(ipsec_mp == pkt); 1120 put(q, pkt); 1121 ill_refrele(ill); 1122 } else if (pkt->b_next) { 1123 /* Packets from multicast router */ 1124 pkt->b_next = NULL; 1125 /* 1126 * We never get the IPSEC_OUT while forwarding the 1127 * packet for multicast router. 1128 */ 1129 ASSERT(ipsec_mp == pkt); 1130 ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, ipsec_mp, NULL); 1131 ire_refrele(ire); 1132 } else { 1133 /* Locally originated packets */ 1134 boolean_t is_inaddr_any; 1135 ipha_t *ipha = (ipha_t *)pkt->b_rptr; 1136 1137 /* 1138 * We need to do an ire_delete below for which 1139 * we need to make sure that the IRE will be 1140 * around even after calling ip_wput_ire - 1141 * which does ire_refrele. Otherwise somebody 1142 * could potentially delete this ire and hence 1143 * free this ire and we will be calling ire_delete 1144 * on a freed ire below. 1145 */ 1146 is_inaddr_any = (ire->ire_src_addr == INADDR_ANY); 1147 if (is_inaddr_any) { 1148 IRE_REFHOLD(ire); 1149 } 1150 /* 1151 * If we were resolving a router we can not use the 1152 * routers IRE for sending the packet (since it would 1153 * violate the uniqness of the IP idents) thus we 1154 * make another pass through ip_wput to create the IRE_CACHE 1155 * for the destination. 1156 * When IRE_MARK_NOADD is set, ire_add() is not called. 1157 * Thus ip_wput() will never find a ire and result in an 1158 * infinite loop. Thus we check whether IRE_MARK_NOADD is 1159 * is set. This also implies that IRE_MARK_NOADD can only be 1160 * used to send packets to directly connected hosts. 1161 */ 1162 if (ipha->ipha_dst != ire->ire_addr && 1163 !(ire->ire_marks & IRE_MARK_NOADD)) { 1164 ire_refrele(ire); /* Held in ire_add */ 1165 if (CONN_Q(q)) { 1166 (void) ip_output(Q_TO_CONN(q), ipsec_mp, q, 1167 IRE_SEND); 1168 } else { 1169 (void) ip_output((void *)(uintptr_t)zoneid, 1170 ipsec_mp, q, IRE_SEND); 1171 } 1172 } else { 1173 if (is_secure) { 1174 ipsec_out_t *oi; 1175 ipha_t *ipha; 1176 1177 oi = (ipsec_out_t *)ipsec_mp->b_rptr; 1178 ipha = (ipha_t *)ipsec_mp->b_cont->b_rptr; 1179 if (oi->ipsec_out_proc_begin) { 1180 /* 1181 * This is the case where 1182 * ip_wput_ipsec_out could not find 1183 * the IRE and recreated a new one. 1184 * As ip_wput_ipsec_out does ire 1185 * lookups, ire_refrele for the extra 1186 * bump in ire_add. 1187 */ 1188 ire_refrele(ire); 1189 ip_wput_ipsec_out(q, ipsec_mp, ipha, 1190 NULL, NULL); 1191 } else { 1192 /* 1193 * IRE_REFRELE will be done in 1194 * ip_wput_ire. 1195 */ 1196 ip_wput_ire(q, ipsec_mp, ire, NULL, 1197 IRE_SEND, zoneid); 1198 } 1199 } else { 1200 /* 1201 * IRE_REFRELE will be done in ip_wput_ire. 1202 */ 1203 ip_wput_ire(q, ipsec_mp, ire, NULL, 1204 IRE_SEND, zoneid); 1205 } 1206 } 1207 /* 1208 * Special code to support sending a single packet with 1209 * conn_unspec_src using an IRE which has no source address. 1210 * The IRE is deleted here after sending the packet to avoid 1211 * having other code trip on it. But before we delete the 1212 * ire, somebody could have looked up this ire. 1213 * We prevent returning/using this IRE by the upper layers 1214 * by making checks to NULL source address in other places 1215 * like e.g ip_ire_append, ip_ire_req and ip_bind_connected. 1216 * Though, this does not completely prevent other threads 1217 * from using this ire, this should not cause any problems. 1218 * 1219 * NOTE : We use is_inaddr_any instead of using ire_src_addr 1220 * because for the normal case i.e !is_inaddr_any, ire_refrele 1221 * above could have potentially freed the ire. 1222 */ 1223 if (is_inaddr_any) { 1224 /* 1225 * If this IRE has been deleted by another thread, then 1226 * ire_bucket won't be NULL, but ire_ptpn will be NULL. 1227 * Thus, ire_delete will do nothing. This check 1228 * guards against calling ire_delete when the IRE was 1229 * never inserted in the table, which is handled by 1230 * ire_delete as dropping another reference. 1231 */ 1232 if (ire->ire_bucket != NULL) { 1233 ip1dbg(("ire_send: delete IRE\n")); 1234 ire_delete(ire); 1235 } 1236 ire_refrele(ire); /* Held above */ 1237 } 1238 } 1239 } 1240 1241 /* 1242 * Send a packet using the specified IRE. 1243 * If ire_src_addr_v6 is all zero then discard the IRE after 1244 * the packet has been sent. 1245 */ 1246 static void 1247 ire_send_v6(queue_t *q, mblk_t *pkt, ire_t *ire) 1248 { 1249 mblk_t *ipsec_mp; 1250 boolean_t secure; 1251 uint_t ifindex; 1252 zoneid_t zoneid = ire->ire_zoneid; 1253 ip_stack_t *ipst = ire->ire_ipst; 1254 1255 ASSERT(ire->ire_ipversion == IPV6_VERSION); 1256 ASSERT(!(ire->ire_type & IRE_LOCAL)); /* Has different ire_zoneid */ 1257 if (pkt->b_datap->db_type == M_CTL) { 1258 ipsec_out_t *io; 1259 1260 ipsec_mp = pkt; 1261 pkt = pkt->b_cont; 1262 secure = B_TRUE; 1263 io = (ipsec_out_t *)ipsec_mp->b_rptr; 1264 if (io->ipsec_out_type == IPSEC_OUT) 1265 zoneid = io->ipsec_out_zoneid; 1266 } else { 1267 ipsec_mp = pkt; 1268 secure = B_FALSE; 1269 } 1270 1271 /* If the packet originated externally then */ 1272 if (pkt->b_prev) { 1273 ill_t *ill; 1274 /* 1275 * Extract the ifindex from b_prev (set in ip_rput_data_v6). 1276 * Look up interface to see if it still exists (it could have 1277 * been unplumbed by the time the reply came back from the 1278 * resolver). 1279 */ 1280 ifindex = (uint_t)(uintptr_t)pkt->b_prev; 1281 ill = ill_lookup_on_ifindex(ifindex, B_TRUE, 1282 NULL, NULL, NULL, NULL, ipst); 1283 if (ill == NULL) { 1284 pkt->b_prev = NULL; 1285 pkt->b_next = NULL; 1286 freemsg(ipsec_mp); 1287 ire_refrele(ire); /* Held in ire_add */ 1288 return; 1289 } 1290 q = ill->ill_rq; 1291 pkt->b_prev = NULL; 1292 /* 1293 * This packet has not gone through IPSEC processing 1294 * and hence we should not have any IPSEC message 1295 * prepended. 1296 */ 1297 ASSERT(ipsec_mp == pkt); 1298 put(q, pkt); 1299 ill_refrele(ill); 1300 } else if (pkt->b_next) { 1301 /* Packets from multicast router */ 1302 pkt->b_next = NULL; 1303 /* 1304 * We never get the IPSEC_OUT while forwarding the 1305 * packet for multicast router. 1306 */ 1307 ASSERT(ipsec_mp == pkt); 1308 /* 1309 * XXX TODO IPv6. 1310 */ 1311 freemsg(pkt); 1312 #ifdef XXX 1313 ip_rput_forward(ire, (ipha_t *)pkt->b_rptr, pkt, NULL); 1314 #endif 1315 } else { 1316 if (secure) { 1317 ipsec_out_t *oi; 1318 ip6_t *ip6h; 1319 1320 oi = (ipsec_out_t *)ipsec_mp->b_rptr; 1321 ip6h = (ip6_t *)ipsec_mp->b_cont->b_rptr; 1322 if (oi->ipsec_out_proc_begin) { 1323 /* 1324 * This is the case where 1325 * ip_wput_ipsec_out could not find 1326 * the IRE and recreated a new one. 1327 */ 1328 ip_wput_ipsec_out_v6(q, ipsec_mp, ip6h, 1329 NULL, NULL); 1330 } else { 1331 if (CONN_Q(q)) { 1332 (void) ip_output_v6(Q_TO_CONN(q), 1333 ipsec_mp, q, IRE_SEND); 1334 } else { 1335 (void) ip_output_v6( 1336 (void *)(uintptr_t)zoneid, 1337 ipsec_mp, q, IRE_SEND); 1338 } 1339 } 1340 } else { 1341 /* 1342 * Send packets through ip_output_v6 so that any 1343 * ip6_info header can be processed again. 1344 */ 1345 if (CONN_Q(q)) { 1346 (void) ip_output_v6(Q_TO_CONN(q), ipsec_mp, q, 1347 IRE_SEND); 1348 } else { 1349 (void) ip_output_v6((void *)(uintptr_t)zoneid, 1350 ipsec_mp, q, IRE_SEND); 1351 } 1352 } 1353 /* 1354 * Special code to support sending a single packet with 1355 * conn_unspec_src using an IRE which has no source address. 1356 * The IRE is deleted here after sending the packet to avoid 1357 * having other code trip on it. But before we delete the 1358 * ire, somebody could have looked up this ire. 1359 * We prevent returning/using this IRE by the upper layers 1360 * by making checks to NULL source address in other places 1361 * like e.g ip_ire_append_v6, ip_ire_req and 1362 * ip_bind_connected_v6. Though, this does not completely 1363 * prevent other threads from using this ire, this should 1364 * not cause any problems. 1365 */ 1366 if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6)) { 1367 ip1dbg(("ire_send_v6: delete IRE\n")); 1368 ire_delete(ire); 1369 } 1370 } 1371 ire_refrele(ire); /* Held in ire_add */ 1372 } 1373 1374 /* 1375 * Make sure that IRE bucket does not get too long. 1376 * This can cause lock up because ire_cache_lookup() 1377 * may take "forever" to finish. 1378 * 1379 * We just remove cnt IREs each time. This means that 1380 * the bucket length will stay approximately constant, 1381 * depending on cnt. This should be enough to defend 1382 * against DoS attack based on creating temporary IREs 1383 * (for forwarding and non-TCP traffic). 1384 * 1385 * Note that new IRE is normally added at the tail of the 1386 * bucket. This means that we are removing the "oldest" 1387 * temporary IRE added. Only if there are IREs with 1388 * the same ire_addr, do we not add it at the tail. Refer 1389 * to ire_add_v*(). It should be OK for our purpose. 1390 * 1391 * For non-temporary cached IREs, we make sure that they 1392 * have not been used for some time (defined below), they 1393 * are non-local destinations, and there is no one using 1394 * them at the moment (refcnt == 1). 1395 * 1396 * The above means that the IRE bucket length may become 1397 * very long, consisting of mostly non-temporary IREs. 1398 * This can happen when the hash function does a bad job 1399 * so that most TCP connections cluster to a specific bucket. 1400 * This "hopefully" should never happen. It can also 1401 * happen if most TCP connections have very long lives. 1402 * Even with the minimal hash table size of 256, there 1403 * has to be a lot of such connections to make the bucket 1404 * length unreasonably long. This should probably not 1405 * happen either. The third can when this can happen is 1406 * when the machine is under attack, such as SYN flooding. 1407 * TCP should already have the proper mechanism to protect 1408 * that. So we should be safe. 1409 * 1410 * This function is called by ire_add_then_send() after 1411 * a new IRE is added and the packet is sent. 1412 * 1413 * The idle cutoff interval is set to 60s. It can be 1414 * changed using /etc/system. 1415 */ 1416 uint32_t ire_idle_cutoff_interval = 60000; 1417 1418 static void 1419 ire_cache_cleanup(irb_t *irb, uint32_t threshold, int cnt) 1420 { 1421 ire_t *ire; 1422 int tmp_cnt = cnt; 1423 clock_t cut_off = drv_usectohz(ire_idle_cutoff_interval * 1000); 1424 1425 /* 1426 * irb is NULL if the IRE is not added to the hash. This 1427 * happens when IRE_MARK_NOADD is set in ire_add_then_send() 1428 * and when ires are returned from ire_update_srcif_v4() routine. 1429 */ 1430 if (irb == NULL) 1431 return; 1432 1433 IRB_REFHOLD(irb); 1434 if (irb->irb_tmp_ire_cnt > threshold) { 1435 for (ire = irb->irb_ire; ire != NULL && tmp_cnt > 0; 1436 ire = ire->ire_next) { 1437 if (ire->ire_marks & IRE_MARK_CONDEMNED) 1438 continue; 1439 if (ire->ire_marks & IRE_MARK_TEMPORARY) { 1440 ASSERT(ire->ire_type == IRE_CACHE); 1441 ire_delete(ire); 1442 tmp_cnt--; 1443 } 1444 } 1445 } 1446 if (irb->irb_ire_cnt - irb->irb_tmp_ire_cnt > threshold) { 1447 for (ire = irb->irb_ire; ire != NULL && cnt > 0; 1448 ire = ire->ire_next) { 1449 if (ire->ire_marks & IRE_MARK_CONDEMNED) 1450 continue; 1451 if (ire->ire_ipversion == IPV4_VERSION) { 1452 if (ire->ire_gateway_addr == 0) 1453 continue; 1454 } else { 1455 if (IN6_IS_ADDR_UNSPECIFIED( 1456 &ire->ire_gateway_addr_v6)) 1457 continue; 1458 } 1459 if ((ire->ire_type == IRE_CACHE) && 1460 (lbolt - ire->ire_last_used_time > cut_off) && 1461 (ire->ire_refcnt == 1)) { 1462 ire_delete(ire); 1463 cnt--; 1464 } 1465 } 1466 } 1467 IRB_REFRELE(irb); 1468 } 1469 1470 /* 1471 * ire_add_then_send is called when a new IRE has been created in order to 1472 * route an outgoing packet. Typically, it is called from ip_wput when 1473 * a response comes back down from a resolver. We add the IRE, and then 1474 * possibly run the packet through ip_wput or ip_rput, as appropriate. 1475 * However, we do not add the newly created IRE in the cache when 1476 * IRE_MARK_NOADD is set in the IRE. IRE_MARK_NOADD is set at 1477 * ip_newroute_ipif(). The ires with IRE_MARK_NOADD and ires returned 1478 * by ire_update_srcif_v4() are ire_refrele'd by ip_wput_ire() and get 1479 * deleted. 1480 * Multirouting support: the packet is silently discarded when the new IRE 1481 * holds the RTF_MULTIRT flag, but is not the first IRE to be added with the 1482 * RTF_MULTIRT flag for the same destination address. 1483 * In this case, we just want to register this additional ire without 1484 * sending the packet, as it has already been replicated through 1485 * existing multirt routes in ip_wput(). 1486 */ 1487 void 1488 ire_add_then_send(queue_t *q, ire_t *ire, mblk_t *mp) 1489 { 1490 irb_t *irb; 1491 boolean_t drop = B_FALSE; 1492 /* LINTED : set but not used in function */ 1493 boolean_t mctl_present; 1494 mblk_t *first_mp = NULL; 1495 mblk_t *save_mp = NULL; 1496 ire_t *dst_ire; 1497 ipha_t *ipha; 1498 ip6_t *ip6h; 1499 ip_stack_t *ipst = ire->ire_ipst; 1500 1501 if (mp != NULL) { 1502 /* 1503 * We first have to retrieve the destination address carried 1504 * by the packet. 1505 * We can't rely on ire as it can be related to a gateway. 1506 * The destination address will help in determining if 1507 * other RTF_MULTIRT ires are already registered. 1508 * 1509 * We first need to know where we are going : v4 or V6. 1510 * the ire version is enough, as there is no risk that 1511 * we resolve an IPv6 address with an IPv4 ire 1512 * or vice versa. 1513 */ 1514 if (ire->ire_ipversion == IPV4_VERSION) { 1515 EXTRACT_PKT_MP(mp, first_mp, mctl_present); 1516 ipha = (ipha_t *)mp->b_rptr; 1517 save_mp = mp; 1518 mp = first_mp; 1519 1520 dst_ire = ire_cache_lookup(ipha->ipha_dst, 1521 ire->ire_zoneid, MBLK_GETLABEL(mp), ipst); 1522 } else { 1523 ASSERT(ire->ire_ipversion == IPV6_VERSION); 1524 /* 1525 * Get a pointer to the beginning of the IPv6 header. 1526 * Ignore leading IPsec control mblks. 1527 */ 1528 first_mp = mp; 1529 if (mp->b_datap->db_type == M_CTL) { 1530 mp = mp->b_cont; 1531 } 1532 ip6h = (ip6_t *)mp->b_rptr; 1533 save_mp = mp; 1534 mp = first_mp; 1535 dst_ire = ire_cache_lookup_v6(&ip6h->ip6_dst, 1536 ire->ire_zoneid, MBLK_GETLABEL(mp), ipst); 1537 } 1538 if (dst_ire != NULL) { 1539 if (dst_ire->ire_flags & RTF_MULTIRT) { 1540 /* 1541 * At least one resolved multirt route 1542 * already exists for the destination, 1543 * don't sent this packet: either drop it 1544 * or complete the pending resolution, 1545 * depending on the ire. 1546 */ 1547 drop = B_TRUE; 1548 } 1549 ip1dbg(("ire_add_then_send: dst_ire %p " 1550 "[dst %08x, gw %08x], drop %d\n", 1551 (void *)dst_ire, 1552 (dst_ire->ire_ipversion == IPV4_VERSION) ? \ 1553 ntohl(dst_ire->ire_addr) : \ 1554 ntohl(V4_PART_OF_V6(dst_ire->ire_addr_v6)), 1555 (dst_ire->ire_ipversion == IPV4_VERSION) ? \ 1556 ntohl(dst_ire->ire_gateway_addr) : \ 1557 ntohl(V4_PART_OF_V6( 1558 dst_ire->ire_gateway_addr_v6)), 1559 drop)); 1560 ire_refrele(dst_ire); 1561 } 1562 } 1563 1564 if (!(ire->ire_marks & IRE_MARK_NOADD)) { 1565 /* 1566 * Regular packets with cache bound ires and 1567 * the packets from ARP response for ires which 1568 * belong to the ire_srcif_v4 table, are here. 1569 */ 1570 if (ire->ire_in_ill == NULL) { 1571 /* Add the ire */ 1572 (void) ire_add(&ire, NULL, NULL, NULL, B_FALSE); 1573 } else { 1574 /* 1575 * This must be ARP response for ire in interface based 1576 * table. Note that we don't add them in cache table, 1577 * instead we update the existing table with dlureq_mp 1578 * information. The reverse tunnel ires do not come 1579 * here, as reverse tunnel is non-resolver interface. 1580 * XXX- another design alternative was to mark the 1581 * ires in interface based table with a special mark to 1582 * make absolutely sure that we operate in right ires. 1583 * This idea was not implemented as part of code review 1584 * suggestion, as ire_in_ill suffice to distinguish 1585 * between the regular ires and interface based 1586 * ires now and thus we save a bit in the ire_marks. 1587 */ 1588 ire = ire_update_srcif_v4(ire); 1589 } 1590 1591 if (ire == NULL) { 1592 mp->b_prev = NULL; 1593 mp->b_next = NULL; 1594 MULTIRT_DEBUG_UNTAG(mp); 1595 freemsg(mp); 1596 return; 1597 } 1598 if (mp == NULL) { 1599 ire_refrele(ire); /* Held in ire_add_v4/v6 */ 1600 return; 1601 } 1602 } 1603 if (drop) { 1604 /* 1605 * If we're adding an RTF_MULTIRT ire, the resolution 1606 * is over: we just drop the packet. 1607 */ 1608 if (ire->ire_flags & RTF_MULTIRT) { 1609 if (save_mp) { 1610 save_mp->b_prev = NULL; 1611 save_mp->b_next = NULL; 1612 } 1613 MULTIRT_DEBUG_UNTAG(mp); 1614 freemsg(mp); 1615 } else { 1616 /* 1617 * Otherwise, we're adding the ire to a gateway 1618 * for a multirt route. 1619 * Invoke ip_newroute() to complete the resolution 1620 * of the route. We will then come back here and 1621 * finally drop this packet in the above code. 1622 */ 1623 if (ire->ire_ipversion == IPV4_VERSION) { 1624 /* 1625 * TODO: in order for CGTP to work in non-global 1626 * zones, ip_newroute() must create the IRE 1627 * cache in the zone indicated by 1628 * ire->ire_zoneid. 1629 */ 1630 ip_newroute(q, mp, ipha->ipha_dst, 0, 1631 (CONN_Q(q) ? Q_TO_CONN(q) : NULL), 1632 ire->ire_zoneid, ipst); 1633 } else { 1634 ASSERT(ire->ire_ipversion == IPV6_VERSION); 1635 ip_newroute_v6(q, mp, &ip6h->ip6_dst, NULL, 1636 NULL, ire->ire_zoneid, ipst); 1637 } 1638 } 1639 1640 ire_refrele(ire); /* As done by ire_send(). */ 1641 return; 1642 } 1643 /* 1644 * Need to remember ire_bucket here as ire_send*() may delete 1645 * the ire so we cannot reference it after that. 1646 */ 1647 irb = ire->ire_bucket; 1648 if (ire->ire_ipversion == IPV6_VERSION) { 1649 ire_send_v6(q, mp, ire); 1650 /* 1651 * Clean up more than 1 IRE so that the clean up does not 1652 * need to be done every time when a new IRE is added and 1653 * the threshold is reached. 1654 */ 1655 ire_cache_cleanup(irb, ip6_ire_max_bucket_cnt, 2); 1656 } else { 1657 ire_send(q, mp, ire); 1658 ire_cache_cleanup(irb, ip_ire_max_bucket_cnt, 2); 1659 } 1660 } 1661 1662 /* 1663 * Initialize the ire that is specific to IPv4 part and call 1664 * ire_init_common to finish it. 1665 */ 1666 ire_t * 1667 ire_init(ire_t *ire, uchar_t *addr, uchar_t *mask, uchar_t *src_addr, 1668 uchar_t *gateway, uchar_t *in_src_addr, uint_t *max_fragp, mblk_t *fp_mp, 1669 queue_t *rfq, queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, 1670 ill_t *in_ill, ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, 1671 uint32_t flags, const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp, 1672 ip_stack_t *ipst) 1673 { 1674 /* 1675 * Reject IRE security attribute creation/initialization 1676 * if system is not running in Trusted mode. 1677 */ 1678 if ((gc != NULL || gcgrp != NULL) && !is_system_labeled()) 1679 return (NULL); 1680 1681 if (fp_mp != NULL) { 1682 /* 1683 * We can't dupb() here as multiple threads could be 1684 * calling dupb on the same mp which is incorrect. 1685 * First dupb() should be called only by one thread. 1686 */ 1687 fp_mp = copyb(fp_mp); 1688 if (fp_mp == NULL) 1689 return (NULL); 1690 } 1691 1692 if (dlureq_mp != NULL) { 1693 /* 1694 * We can't dupb() here as multiple threads could be 1695 * calling dupb on the same mp which is incorrect. 1696 * First dupb() should be called only by one thread. 1697 */ 1698 dlureq_mp = copyb(dlureq_mp); 1699 if (dlureq_mp == NULL) { 1700 if (fp_mp != NULL) 1701 freeb(fp_mp); 1702 return (NULL); 1703 } 1704 } 1705 1706 /* 1707 * Check that IRE_IF_RESOLVER and IRE_IF_NORESOLVER have a 1708 * dlureq_mp which is the ill_resolver_mp for IRE_IF_RESOLVER 1709 * and DL_UNITDATA_REQ for IRE_IF_NORESOLVER. 1710 */ 1711 if ((type & IRE_INTERFACE) && 1712 dlureq_mp == NULL) { 1713 ASSERT(fp_mp == NULL); 1714 ip0dbg(("ire_init: no dlureq_mp\n")); 1715 return (NULL); 1716 } 1717 1718 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_alloced); 1719 1720 if (addr != NULL) 1721 bcopy(addr, &ire->ire_addr, IP_ADDR_LEN); 1722 if (src_addr != NULL) 1723 bcopy(src_addr, &ire->ire_src_addr, IP_ADDR_LEN); 1724 if (mask != NULL) { 1725 bcopy(mask, &ire->ire_mask, IP_ADDR_LEN); 1726 ire->ire_masklen = ip_mask_to_plen(ire->ire_mask); 1727 } 1728 if (gateway != NULL) { 1729 bcopy(gateway, &ire->ire_gateway_addr, IP_ADDR_LEN); 1730 } 1731 if (in_src_addr != NULL) { 1732 bcopy(in_src_addr, &ire->ire_in_src_addr, IP_ADDR_LEN); 1733 } 1734 1735 if (type == IRE_CACHE) 1736 ire->ire_cmask = cmask; 1737 1738 /* ire_init_common will free the mblks upon encountering any failure */ 1739 if (!ire_init_common(ire, max_fragp, fp_mp, rfq, stq, type, dlureq_mp, 1740 ipif, in_ill, phandle, ihandle, flags, IPV4_VERSION, ulp_info, 1741 gc, gcgrp, ipst)) 1742 return (NULL); 1743 1744 return (ire); 1745 } 1746 1747 /* 1748 * Similar to ire_create except that it is called only when 1749 * we want to allocate ire as an mblk e.g. we have an external 1750 * resolver ARP. 1751 */ 1752 ire_t * 1753 ire_create_mp(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway, 1754 uchar_t *in_src_addr, uint_t max_frag, mblk_t *fp_mp, queue_t *rfq, 1755 queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill, 1756 ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, uint32_t flags, 1757 const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp, 1758 ip_stack_t *ipst) 1759 { 1760 ire_t *ire, *buf; 1761 ire_t *ret_ire; 1762 mblk_t *mp; 1763 size_t bufsize; 1764 frtn_t *frtnp; 1765 ill_t *ill; 1766 1767 bufsize = sizeof (ire_t) + sizeof (frtn_t); 1768 buf = kmem_alloc(bufsize, KM_NOSLEEP); 1769 if (buf == NULL) { 1770 ip1dbg(("ire_create_mp: alloc failed\n")); 1771 return (NULL); 1772 } 1773 frtnp = (frtn_t *)(buf + 1); 1774 frtnp->free_arg = (caddr_t)buf; 1775 frtnp->free_func = ire_freemblk; 1776 1777 /* 1778 * Allocate the new IRE. The ire created will hold a ref on 1779 * an nce_t after ire_nce_init, and this ref must either be 1780 * (a) transferred to the ire_cache entry created when ire_add_v4 1781 * is called after successful arp resolution, or, 1782 * (b) released, when arp resolution fails 1783 * Case (b) is handled in ire_freemblk() which will be called 1784 * when mp is freed as a result of failed arp. 1785 */ 1786 mp = esballoc((unsigned char *)buf, bufsize, BPRI_MED, frtnp); 1787 if (mp == NULL) { 1788 ip1dbg(("ire_create_mp: alloc failed\n")); 1789 kmem_free(buf, bufsize); 1790 return (NULL); 1791 } 1792 ire = (ire_t *)mp->b_rptr; 1793 mp->b_wptr = (uchar_t *)&ire[1]; 1794 1795 /* Start clean. */ 1796 *ire = ire_null; 1797 ire->ire_mp = mp; 1798 mp->b_datap->db_type = IRE_DB_TYPE; 1799 ire->ire_marks |= IRE_MARK_UNCACHED; 1800 1801 ret_ire = ire_init(ire, addr, mask, src_addr, gateway, in_src_addr, 1802 NULL, fp_mp, rfq, stq, type, dlureq_mp, ipif, in_ill, cmask, 1803 phandle, ihandle, flags, ulp_info, gc, gcgrp, ipst); 1804 1805 ill = (ill_t *)(stq->q_ptr); 1806 if (ret_ire == NULL) { 1807 /* ire_freemblk needs these set */ 1808 ire->ire_stq_ifindex = ill->ill_phyint->phyint_ifindex; 1809 ire->ire_ipst = ipst; 1810 freeb(ire->ire_mp); 1811 return (NULL); 1812 } 1813 ret_ire->ire_stq_ifindex = ill->ill_phyint->phyint_ifindex; 1814 ASSERT(ret_ire == ire); 1815 /* 1816 * ire_max_frag is normally zero here and is atomically set 1817 * under the irebucket lock in ire_add_v[46] except for the 1818 * case of IRE_MARK_NOADD. In that event the the ire_max_frag 1819 * is non-zero here. 1820 */ 1821 ire->ire_max_frag = max_frag; 1822 return (ire); 1823 } 1824 1825 /* 1826 * ire_create is called to allocate and initialize a new IRE. 1827 * 1828 * NOTE : This is called as writer sometimes though not required 1829 * by this function. 1830 */ 1831 ire_t * 1832 ire_create(uchar_t *addr, uchar_t *mask, uchar_t *src_addr, uchar_t *gateway, 1833 uchar_t *in_src_addr, uint_t *max_fragp, mblk_t *fp_mp, queue_t *rfq, 1834 queue_t *stq, ushort_t type, mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill, 1835 ipaddr_t cmask, uint32_t phandle, uint32_t ihandle, uint32_t flags, 1836 const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp, 1837 ip_stack_t *ipst) 1838 { 1839 ire_t *ire; 1840 ire_t *ret_ire; 1841 1842 ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP); 1843 if (ire == NULL) { 1844 ip1dbg(("ire_create: alloc failed\n")); 1845 return (NULL); 1846 } 1847 *ire = ire_null; 1848 1849 ret_ire = ire_init(ire, addr, mask, src_addr, gateway, in_src_addr, 1850 max_fragp, fp_mp, rfq, stq, type, dlureq_mp, ipif, in_ill, cmask, 1851 phandle, ihandle, flags, ulp_info, gc, gcgrp, ipst); 1852 1853 if (ret_ire == NULL) { 1854 kmem_cache_free(ire_cache, ire); 1855 return (NULL); 1856 } 1857 ASSERT(ret_ire == ire); 1858 return (ire); 1859 } 1860 1861 1862 /* 1863 * Common to IPv4 and IPv6 1864 */ 1865 boolean_t 1866 ire_init_common(ire_t *ire, uint_t *max_fragp, mblk_t *fp_mp, 1867 queue_t *rfq, queue_t *stq, ushort_t type, 1868 mblk_t *dlureq_mp, ipif_t *ipif, ill_t *in_ill, uint32_t phandle, 1869 uint32_t ihandle, uint32_t flags, uchar_t ipversion, 1870 const iulp_t *ulp_info, tsol_gc_t *gc, tsol_gcgrp_t *gcgrp, 1871 ip_stack_t *ipst) 1872 { 1873 ire->ire_max_fragp = max_fragp; 1874 ire->ire_frag_flag |= (ipst->ips_ip_path_mtu_discovery) ? IPH_DF : 0; 1875 1876 ASSERT(fp_mp == NULL || fp_mp->b_datap->db_type == M_DATA); 1877 #ifdef DEBUG 1878 if (ipif != NULL) { 1879 if (ipif->ipif_isv6) 1880 ASSERT(ipversion == IPV6_VERSION); 1881 else 1882 ASSERT(ipversion == IPV4_VERSION); 1883 } 1884 #endif /* DEBUG */ 1885 1886 /* 1887 * Create/initialize IRE security attribute only in Trusted mode; 1888 * if the passed in gc/gcgrp is non-NULL, we expect that the caller 1889 * has held a reference to it and will release it when this routine 1890 * returns a failure, otherwise we own the reference. We do this 1891 * prior to initializing the rest IRE fields. 1892 * 1893 * Don't allocate ire_gw_secattr for the resolver case to prevent 1894 * memory leak (in case of external resolution failure). We'll 1895 * allocate it after a successful external resolution, in ire_add(). 1896 * Note that ire->ire_mp != NULL here means this ire is headed 1897 * to an external resolver. 1898 */ 1899 if (is_system_labeled()) { 1900 if ((type & (IRE_LOCAL | IRE_LOOPBACK | IRE_BROADCAST | 1901 IRE_INTERFACE)) != 0) { 1902 /* release references on behalf of caller */ 1903 if (gc != NULL) 1904 GC_REFRELE(gc); 1905 if (gcgrp != NULL) 1906 GCGRP_REFRELE(gcgrp); 1907 } else if ((ire->ire_mp == NULL) && 1908 tsol_ire_init_gwattr(ire, ipversion, gc, gcgrp) != 0) { 1909 /* free any caller-allocated mblks upon failure */ 1910 if (fp_mp != NULL) 1911 freeb(fp_mp); 1912 if (dlureq_mp != NULL) 1913 freeb(dlureq_mp); 1914 return (B_FALSE); 1915 } 1916 } 1917 1918 ire->ire_stq = stq; 1919 ire->ire_rfq = rfq; 1920 ire->ire_type = type; 1921 ire->ire_flags = RTF_UP | flags; 1922 ire->ire_ident = TICK_TO_MSEC(lbolt); 1923 bcopy(ulp_info, &ire->ire_uinfo, sizeof (iulp_t)); 1924 1925 ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count; 1926 ire->ire_last_used_time = lbolt; 1927 ire->ire_create_time = (uint32_t)gethrestime_sec(); 1928 1929 /* 1930 * If this IRE is an IRE_CACHE, inherit the handles from the 1931 * parent IREs. For others in the forwarding table, assign appropriate 1932 * new ones. 1933 * 1934 * The mutex protecting ire_handle is because ire_create is not always 1935 * called as a writer. 1936 */ 1937 if (ire->ire_type & IRE_OFFSUBNET) { 1938 mutex_enter(&ipst->ips_ire_handle_lock); 1939 ire->ire_phandle = (uint32_t)ipst->ips_ire_handle++; 1940 mutex_exit(&ipst->ips_ire_handle_lock); 1941 } else if (ire->ire_type & IRE_INTERFACE) { 1942 mutex_enter(&ipst->ips_ire_handle_lock); 1943 ire->ire_ihandle = (uint32_t)ipst->ips_ire_handle++; 1944 mutex_exit(&ipst->ips_ire_handle_lock); 1945 } else if (ire->ire_type == IRE_CACHE) { 1946 ire->ire_phandle = phandle; 1947 ire->ire_ihandle = ihandle; 1948 } 1949 ire->ire_in_ill = in_ill; 1950 ire->ire_ipif = ipif; 1951 if (ipif != NULL) { 1952 ire->ire_ipif_seqid = ipif->ipif_seqid; 1953 ire->ire_zoneid = ipif->ipif_zoneid; 1954 } else { 1955 ire->ire_zoneid = GLOBAL_ZONEID; 1956 } 1957 ire->ire_ipversion = ipversion; 1958 mutex_init(&ire->ire_lock, NULL, MUTEX_DEFAULT, NULL); 1959 if (ipversion == IPV4_VERSION) { 1960 if (ire_nce_init(ire, fp_mp, dlureq_mp) != 0) { 1961 /* some failure occurred. propagate error back */ 1962 return (B_FALSE); 1963 } 1964 } else { 1965 ASSERT(ipversion == IPV6_VERSION); 1966 /* 1967 * IPv6 initializes the ire_nce in ire_add_v6, 1968 * which expects to find the ire_nce to be null when 1969 * when it is called. 1970 */ 1971 if (dlureq_mp) 1972 freemsg(dlureq_mp); 1973 if (fp_mp) 1974 freemsg(fp_mp); 1975 } 1976 ire->ire_refcnt = 1; 1977 ire->ire_ipst = ipst; /* No netstack_hold */ 1978 1979 #ifdef IRE_DEBUG 1980 bzero(ire->ire_trace, sizeof (th_trace_t *) * IP_TR_HASH_MAX); 1981 #endif 1982 1983 return (B_TRUE); 1984 } 1985 1986 /* 1987 * This routine is called repeatedly by ipif_up to create broadcast IREs. 1988 * It is passed a pointer to a slot in an IRE pointer array into which to 1989 * place the pointer to the new IRE, if indeed we create one. If the 1990 * IRE corresponding to the address passed in would be a duplicate of an 1991 * existing one, we don't create the new one. irep is incremented before 1992 * return only if we do create a new IRE. (Always called as writer.) 1993 * 1994 * Note that with the "match_flags" parameter, we can match on either 1995 * a particular logical interface (MATCH_IRE_IPIF) or for all logical 1996 * interfaces for a given physical interface (MATCH_IRE_ILL). Currently, 1997 * we only create broadcast ire's on a per physical interface basis. If 1998 * someone is going to be mucking with logical interfaces, it is important 1999 * to call "ipif_check_bcast_ires()" to make sure that any change to a 2000 * logical interface will not cause critical broadcast IRE's to be deleted. 2001 */ 2002 ire_t ** 2003 ire_check_and_create_bcast(ipif_t *ipif, ipaddr_t addr, ire_t **irep, 2004 int match_flags) 2005 { 2006 ire_t *ire; 2007 uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST; 2008 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 2009 2010 /* 2011 * No broadcast IREs for the LOOPBACK interface 2012 * or others such as point to point and IPIF_NOXMIT. 2013 */ 2014 if (!(ipif->ipif_flags & IPIF_BROADCAST) || 2015 (ipif->ipif_flags & IPIF_NOXMIT)) 2016 return (irep); 2017 2018 /* If this would be a duplicate, don't bother. */ 2019 if ((ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ipif, 2020 ipif->ipif_zoneid, NULL, match_flags, ipst)) != NULL) { 2021 /* 2022 * We look for non-deprecated (and non-anycast, non-nolocal) 2023 * ipifs as the best choice. ipifs with check_flags matching 2024 * (deprecated, etc) are used only if non-deprecated ipifs 2025 * are not available. if the existing ire's ipif is deprecated 2026 * and the new ipif is non-deprecated, switch to the new ipif 2027 */ 2028 if ((!(ire->ire_ipif->ipif_flags & check_flags)) || 2029 (ipif->ipif_flags & check_flags)) { 2030 ire_refrele(ire); 2031 return (irep); 2032 } 2033 /* 2034 * Bcast ires exist in pairs. Both have to be deleted, 2035 * Since we are exclusive we can make the above assertion. 2036 * The 1st has to be refrele'd since it was ctable_lookup'd. 2037 */ 2038 ASSERT(IAM_WRITER_IPIF(ipif)); 2039 ASSERT(ire->ire_next->ire_addr == ire->ire_addr); 2040 ire_delete(ire->ire_next); 2041 ire_delete(ire); 2042 ire_refrele(ire); 2043 } 2044 2045 irep = ire_create_bcast(ipif, addr, irep); 2046 2047 return (irep); 2048 } 2049 2050 uint_t ip_loopback_mtu = IP_LOOPBACK_MTU; 2051 2052 /* 2053 * This routine is called from ipif_check_bcast_ires and ire_check_bcast. 2054 * It leaves all the verifying and deleting to those routines. So it always 2055 * creates 2 bcast ires and chains them into the ire array passed in. 2056 */ 2057 ire_t ** 2058 ire_create_bcast(ipif_t *ipif, ipaddr_t addr, ire_t **irep) 2059 { 2060 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 2061 2062 *irep++ = ire_create( 2063 (uchar_t *)&addr, /* dest addr */ 2064 (uchar_t *)&ip_g_all_ones, /* mask */ 2065 (uchar_t *)&ipif->ipif_src_addr, /* source addr */ 2066 NULL, /* no gateway */ 2067 NULL, /* no in_src_addr */ 2068 &ipif->ipif_mtu, /* max frag */ 2069 NULL, /* fast path header */ 2070 ipif->ipif_rq, /* recv-from queue */ 2071 ipif->ipif_wq, /* send-to queue */ 2072 IRE_BROADCAST, 2073 ipif->ipif_bcast_mp, /* xmit header */ 2074 ipif, 2075 NULL, 2076 0, 2077 0, 2078 0, 2079 0, 2080 &ire_uinfo_null, 2081 NULL, 2082 NULL, 2083 ipst); 2084 2085 *irep++ = ire_create( 2086 (uchar_t *)&addr, /* dest address */ 2087 (uchar_t *)&ip_g_all_ones, /* mask */ 2088 (uchar_t *)&ipif->ipif_src_addr, /* source address */ 2089 NULL, /* no gateway */ 2090 NULL, /* no in_src_addr */ 2091 &ip_loopback_mtu, /* max frag size */ 2092 NULL, /* Fast Path header */ 2093 ipif->ipif_rq, /* recv-from queue */ 2094 NULL, /* no send-to queue */ 2095 IRE_BROADCAST, /* Needed for fanout in wput */ 2096 NULL, 2097 ipif, 2098 NULL, 2099 0, 2100 0, 2101 0, 2102 0, 2103 &ire_uinfo_null, 2104 NULL, 2105 NULL, 2106 ipst); 2107 2108 return (irep); 2109 } 2110 2111 /* 2112 * ire_walk routine to delete or update any IRE_CACHE that might contain 2113 * stale information. 2114 * The flags state which entries to delete or update. 2115 * Garbage collection is done separately using kmem alloc callbacks to 2116 * ip_trash_ire_reclaim. 2117 * Used for both IPv4 and IPv6. However, IPv6 only uses FLUSH_MTU_TIME 2118 * since other stale information is cleaned up using NUD. 2119 */ 2120 void 2121 ire_expire(ire_t *ire, char *arg) 2122 { 2123 ire_expire_arg_t *ieap = (ire_expire_arg_t *)(uintptr_t)arg; 2124 ill_t *stq_ill; 2125 int flush_flags = ieap->iea_flush_flag; 2126 ip_stack_t *ipst = ieap->iea_ipst; 2127 2128 if ((flush_flags & FLUSH_REDIRECT_TIME) && 2129 (ire->ire_flags & RTF_DYNAMIC)) { 2130 /* Make sure we delete the corresponding IRE_CACHE */ 2131 ip1dbg(("ire_expire: all redirects\n")); 2132 ip_rts_rtmsg(RTM_DELETE, ire, 0, ipst); 2133 ire_delete(ire); 2134 atomic_dec_32(&ipst->ips_ip_redirect_cnt); 2135 return; 2136 } 2137 if (ire->ire_type != IRE_CACHE) 2138 return; 2139 2140 if (flush_flags & FLUSH_ARP_TIME) { 2141 /* 2142 * Remove all IRE_CACHE. 2143 * Verify that create time is more than 2144 * ip_ire_arp_interval milliseconds ago. 2145 */ 2146 if (NCE_EXPIRED(ire->ire_nce, ipst)) { 2147 ire_delete(ire); 2148 return; 2149 } 2150 } 2151 2152 if (ipst->ips_ip_path_mtu_discovery && (flush_flags & FLUSH_MTU_TIME) && 2153 (ire->ire_ipif != NULL)) { 2154 /* Increase pmtu if it is less than the interface mtu */ 2155 mutex_enter(&ire->ire_lock); 2156 /* 2157 * If the ipif is a vni (whose mtu is 0, since it's virtual) 2158 * get the mtu from the sending interfaces' ipif 2159 */ 2160 if (IS_VNI(ire->ire_ipif->ipif_ill)) { 2161 stq_ill = ire->ire_stq->q_ptr; 2162 ire->ire_max_frag = MIN(stq_ill->ill_ipif->ipif_mtu, 2163 IP_MAXPACKET); 2164 } else { 2165 ire->ire_max_frag = MIN(ire->ire_ipif->ipif_mtu, 2166 IP_MAXPACKET); 2167 } 2168 ire->ire_frag_flag |= IPH_DF; 2169 mutex_exit(&ire->ire_lock); 2170 } 2171 } 2172 2173 /* 2174 * Return any local address. We use this to target ourselves 2175 * when the src address was specified as 'default'. 2176 * Preference for IRE_LOCAL entries. 2177 */ 2178 ire_t * 2179 ire_lookup_local(zoneid_t zoneid, ip_stack_t *ipst) 2180 { 2181 ire_t *ire; 2182 irb_t *irb; 2183 ire_t *maybe = NULL; 2184 int i; 2185 2186 for (i = 0; i < ipst->ips_ip_cache_table_size; i++) { 2187 irb = &ipst->ips_ip_cache_table[i]; 2188 if (irb->irb_ire == NULL) 2189 continue; 2190 rw_enter(&irb->irb_lock, RW_READER); 2191 for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 2192 if ((ire->ire_marks & IRE_MARK_CONDEMNED) || 2193 (ire->ire_zoneid != zoneid && 2194 ire->ire_zoneid != ALL_ZONES)) 2195 continue; 2196 switch (ire->ire_type) { 2197 case IRE_LOOPBACK: 2198 if (maybe == NULL) { 2199 IRE_REFHOLD(ire); 2200 maybe = ire; 2201 } 2202 break; 2203 case IRE_LOCAL: 2204 if (maybe != NULL) { 2205 ire_refrele(maybe); 2206 } 2207 IRE_REFHOLD(ire); 2208 rw_exit(&irb->irb_lock); 2209 return (ire); 2210 } 2211 } 2212 rw_exit(&irb->irb_lock); 2213 } 2214 return (maybe); 2215 } 2216 2217 /* 2218 * If the specified IRE is associated with a particular ILL, return 2219 * that ILL pointer (May be called as writer.). 2220 * 2221 * NOTE : This is not a generic function that can be used always. 2222 * This function always returns the ill of the outgoing packets 2223 * if this ire is used. 2224 */ 2225 ill_t * 2226 ire_to_ill(const ire_t *ire) 2227 { 2228 ill_t *ill = NULL; 2229 2230 /* 2231 * 1) For an IRE_CACHE, ire_ipif is the one where it obtained 2232 * the source address from. ire_stq is the one where the 2233 * packets will be sent out on. We return that here. 2234 * 2235 * 2) IRE_BROADCAST normally has a loopback and a non-loopback 2236 * copy and they always exist next to each other with loopback 2237 * copy being the first one. If we are called on the non-loopback 2238 * copy, return the one pointed by ire_stq. If it was called on 2239 * a loopback copy, we still return the one pointed by the next 2240 * ire's ire_stq pointer i.e the one pointed by the non-loopback 2241 * copy. We don't want use ire_ipif as it might represent the 2242 * source address (if we borrow source addresses for 2243 * IRE_BROADCASTS in the future). 2244 * However if an interface is currently coming up, the above 2245 * condition may not hold during that period since the ires 2246 * are added one at a time. Thus one of the pair could have been 2247 * added and the other not yet added. 2248 * 3) For many other IREs (e.g., IRE_LOCAL), ire_rfq indicates the ill. 2249 * 4) For all others return the ones pointed by ire_ipif->ipif_ill. 2250 * That handles IRE_LOOPBACK. 2251 */ 2252 2253 if (ire->ire_type == IRE_CACHE) { 2254 ill = (ill_t *)ire->ire_stq->q_ptr; 2255 } else if (ire->ire_type == IRE_BROADCAST) { 2256 if (ire->ire_stq != NULL) { 2257 ill = (ill_t *)ire->ire_stq->q_ptr; 2258 } else { 2259 ire_t *ire_next; 2260 2261 ire_next = ire->ire_next; 2262 if (ire_next != NULL && 2263 ire_next->ire_type == IRE_BROADCAST && 2264 ire_next->ire_addr == ire->ire_addr && 2265 ire_next->ire_ipif == ire->ire_ipif) { 2266 ill = (ill_t *)ire_next->ire_stq->q_ptr; 2267 } 2268 } 2269 } else if (ire->ire_rfq != NULL) { 2270 ill = ire->ire_rfq->q_ptr; 2271 } else if (ire->ire_ipif != NULL) { 2272 ill = ire->ire_ipif->ipif_ill; 2273 } 2274 return (ill); 2275 } 2276 2277 /* Arrange to call the specified function for every IRE in the world. */ 2278 void 2279 ire_walk(pfv_t func, void *arg, ip_stack_t *ipst) 2280 { 2281 ire_walk_ipvers(func, arg, 0, ALL_ZONES, ipst); 2282 } 2283 2284 void 2285 ire_walk_v4(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst) 2286 { 2287 ire_walk_ipvers(func, arg, IPV4_VERSION, zoneid, ipst); 2288 } 2289 2290 void 2291 ire_walk_v6(pfv_t func, void *arg, zoneid_t zoneid, ip_stack_t *ipst) 2292 { 2293 ire_walk_ipvers(func, arg, IPV6_VERSION, zoneid, ipst); 2294 } 2295 2296 /* 2297 * Walk a particular version. version == 0 means both v4 and v6. 2298 */ 2299 static void 2300 ire_walk_ipvers(pfv_t func, void *arg, uchar_t vers, zoneid_t zoneid, 2301 ip_stack_t *ipst) 2302 { 2303 if (vers != IPV6_VERSION) { 2304 /* 2305 * ip_forwarding_table variable doesn't matter for IPv4 since 2306 * ire_walk_ill_tables uses ips_ip_ftable for IPv4. 2307 */ 2308 ire_walk_ill_tables(0, 0, func, arg, IP_MASK_TABLE_SIZE, 2309 0, NULL, 2310 ipst->ips_ip_cache_table_size, ipst->ips_ip_cache_table, 2311 NULL, zoneid, ipst); 2312 } 2313 if (vers != IPV4_VERSION) { 2314 ire_walk_ill_tables(0, 0, func, arg, IP6_MASK_TABLE_SIZE, 2315 ipst->ips_ip6_ftable_hash_size, 2316 ipst->ips_ip_forwarding_table_v6, 2317 ipst->ips_ip6_cache_table_size, 2318 ipst->ips_ip_cache_table_v6, NULL, zoneid, ipst); 2319 } 2320 } 2321 2322 /* 2323 * Arrange to call the specified 2324 * function for every IRE that matches the ill. 2325 */ 2326 void 2327 ire_walk_ill(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg, 2328 ill_t *ill) 2329 { 2330 ire_walk_ill_ipvers(match_flags, ire_type, func, arg, 0, ill); 2331 } 2332 2333 void 2334 ire_walk_ill_v4(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg, 2335 ill_t *ill) 2336 { 2337 ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV4_VERSION, 2338 ill); 2339 } 2340 2341 void 2342 ire_walk_ill_v6(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg, 2343 ill_t *ill) 2344 { 2345 ire_walk_ill_ipvers(match_flags, ire_type, func, arg, IPV6_VERSION, 2346 ill); 2347 } 2348 2349 /* 2350 * Walk a particular ill and version. version == 0 means both v4 and v6. 2351 */ 2352 static void 2353 ire_walk_ill_ipvers(uint_t match_flags, uint_t ire_type, pfv_t func, 2354 void *arg, uchar_t vers, ill_t *ill) 2355 { 2356 ip_stack_t *ipst = ill->ill_ipst; 2357 2358 if (vers != IPV6_VERSION) { 2359 ire_walk_ill_tables(match_flags, ire_type, func, arg, 2360 IP_MASK_TABLE_SIZE, 0, 2361 NULL, ipst->ips_ip_cache_table_size, 2362 ipst->ips_ip_cache_table, ill, ALL_ZONES, ipst); 2363 } 2364 if (vers != IPV4_VERSION) { 2365 ire_walk_ill_tables(match_flags, ire_type, func, arg, 2366 IP6_MASK_TABLE_SIZE, ipst->ips_ip6_ftable_hash_size, 2367 ipst->ips_ip_forwarding_table_v6, 2368 ipst->ips_ip6_cache_table_size, 2369 ipst->ips_ip_cache_table_v6, ill, ALL_ZONES, ipst); 2370 } 2371 } 2372 2373 boolean_t 2374 ire_walk_ill_match(uint_t match_flags, uint_t ire_type, ire_t *ire, 2375 ill_t *ill, zoneid_t zoneid, ip_stack_t *ipst) 2376 { 2377 ill_t *ire_stq_ill = NULL; 2378 ill_t *ire_ipif_ill = NULL; 2379 ill_group_t *ire_ill_group = NULL; 2380 2381 ASSERT(match_flags != 0 || zoneid != ALL_ZONES); 2382 /* 2383 * 1) MATCH_IRE_WQ : Used specifically to match on ire_stq. 2384 * The fast path update uses this to make sure it does not 2385 * update the fast path header of interface X with the fast 2386 * path updates it recieved on interface Y. It is similar 2387 * in handling DL_NOTE_FASTPATH_FLUSH. 2388 * 2389 * 2) MATCH_IRE_ILL/MATCH_IRE_ILL_GROUP : We match both on ill 2390 * pointed by ire_stq and ire_ipif. Only in the case of 2391 * IRE_CACHEs can ire_stq and ire_ipif be pointing to 2392 * different ills. But we want to keep this function generic 2393 * enough for future use. So, we always try to match on both. 2394 * The only caller of this function ire_walk_ill_tables, will 2395 * call "func" after we return from this function. We expect 2396 * "func" to do the right filtering of ires in this case. 2397 * 2398 * NOTE : In the case of MATCH_IRE_ILL_GROUP, groups 2399 * pointed by ire_stq and ire_ipif should always be the same. 2400 * So, we just match on only one of them. 2401 */ 2402 if (match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) { 2403 if (ire->ire_stq != NULL) 2404 ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr; 2405 if (ire->ire_ipif != NULL) 2406 ire_ipif_ill = ire->ire_ipif->ipif_ill; 2407 if (ire_stq_ill != NULL) 2408 ire_ill_group = ire_stq_ill->ill_group; 2409 if ((ire_ill_group == NULL) && (ire_ipif_ill != NULL)) 2410 ire_ill_group = ire_ipif_ill->ill_group; 2411 } 2412 2413 if (zoneid != ALL_ZONES) { 2414 /* 2415 * We're walking the IREs for a specific zone. The only relevant 2416 * IREs are: 2417 * - all IREs with a matching ire_zoneid 2418 * - all IRE_OFFSUBNETs as they're shared across all zones 2419 * - IRE_INTERFACE IREs for interfaces with a usable source addr 2420 * with a matching zone 2421 * - IRE_DEFAULTs with a gateway reachable from the zone 2422 * We should really match on IRE_OFFSUBNETs and IRE_DEFAULTs 2423 * using the same rule; but the above rules are consistent with 2424 * the behavior of ire_ftable_lookup[_v6]() so that all the 2425 * routes that can be matched during lookup are also matched 2426 * here. 2427 */ 2428 if (zoneid != ire->ire_zoneid && ire->ire_zoneid != ALL_ZONES) { 2429 /* 2430 * Note, IRE_INTERFACE can have the stq as NULL. For 2431 * example, if the default multicast route is tied to 2432 * the loopback address. 2433 */ 2434 if ((ire->ire_type & IRE_INTERFACE) && 2435 (ire->ire_stq != NULL)) { 2436 ire_stq_ill = (ill_t *)ire->ire_stq->q_ptr; 2437 if (ire->ire_ipversion == IPV4_VERSION) { 2438 if (!ipif_usesrc_avail(ire_stq_ill, 2439 zoneid)) 2440 /* No usable src addr in zone */ 2441 return (B_FALSE); 2442 } else if (ire_stq_ill->ill_usesrc_ifindex 2443 != 0) { 2444 /* 2445 * For IPv6 use ipif_select_source_v6() 2446 * so the right scope selection is done 2447 */ 2448 ipif_t *src_ipif; 2449 src_ipif = 2450 ipif_select_source_v6(ire_stq_ill, 2451 &ire->ire_addr_v6, RESTRICT_TO_NONE, 2452 IPV6_PREFER_SRC_DEFAULT, 2453 zoneid); 2454 if (src_ipif != NULL) { 2455 ipif_refrele(src_ipif); 2456 } else { 2457 return (B_FALSE); 2458 } 2459 } else { 2460 return (B_FALSE); 2461 } 2462 2463 } else if (!(ire->ire_type & IRE_OFFSUBNET)) { 2464 return (B_FALSE); 2465 } 2466 } 2467 2468 /* 2469 * Match all default routes from the global zone, irrespective 2470 * of reachability. For a non-global zone only match those 2471 * where ire_gateway_addr has a IRE_INTERFACE for the zoneid. 2472 */ 2473 if (ire->ire_type == IRE_DEFAULT && zoneid != GLOBAL_ZONEID) { 2474 int ire_match_flags = 0; 2475 in6_addr_t gw_addr_v6; 2476 ire_t *rire; 2477 2478 ire_match_flags |= MATCH_IRE_TYPE; 2479 if (ire->ire_ipif != NULL) { 2480 ire_match_flags |= MATCH_IRE_ILL_GROUP; 2481 } 2482 if (ire->ire_ipversion == IPV4_VERSION) { 2483 rire = ire_route_lookup(ire->ire_gateway_addr, 2484 0, 0, IRE_INTERFACE, ire->ire_ipif, NULL, 2485 zoneid, NULL, ire_match_flags, ipst); 2486 } else { 2487 ASSERT(ire->ire_ipversion == IPV6_VERSION); 2488 mutex_enter(&ire->ire_lock); 2489 gw_addr_v6 = ire->ire_gateway_addr_v6; 2490 mutex_exit(&ire->ire_lock); 2491 rire = ire_route_lookup_v6(&gw_addr_v6, 2492 NULL, NULL, IRE_INTERFACE, ire->ire_ipif, 2493 NULL, zoneid, NULL, ire_match_flags, ipst); 2494 } 2495 if (rire == NULL) { 2496 return (B_FALSE); 2497 } 2498 ire_refrele(rire); 2499 } 2500 } 2501 2502 if (((!(match_flags & MATCH_IRE_TYPE)) || 2503 (ire->ire_type & ire_type)) && 2504 ((!(match_flags & MATCH_IRE_WQ)) || 2505 (ire->ire_stq == ill->ill_wq)) && 2506 ((!(match_flags & MATCH_IRE_ILL)) || 2507 (ire_stq_ill == ill || ire_ipif_ill == ill)) && 2508 ((!(match_flags & MATCH_IRE_ILL_GROUP)) || 2509 (ire_stq_ill == ill) || (ire_ipif_ill == ill) || 2510 (ire_ill_group != NULL && 2511 ire_ill_group == ill->ill_group))) { 2512 return (B_TRUE); 2513 } 2514 return (B_FALSE); 2515 } 2516 2517 int 2518 rtfunc(struct radix_node *rn, void *arg) 2519 { 2520 struct rtfuncarg *rtf = arg; 2521 struct rt_entry *rt; 2522 irb_t *irb; 2523 ire_t *ire; 2524 boolean_t ret; 2525 2526 rt = (struct rt_entry *)rn; 2527 ASSERT(rt != NULL); 2528 irb = &rt->rt_irb; 2529 for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 2530 if ((rtf->rt_match_flags != 0) || 2531 (rtf->rt_zoneid != ALL_ZONES)) { 2532 ret = ire_walk_ill_match(rtf->rt_match_flags, 2533 rtf->rt_ire_type, ire, 2534 rtf->rt_ill, rtf->rt_zoneid, rtf->rt_ipst); 2535 } else 2536 ret = B_TRUE; 2537 if (ret) 2538 (*rtf->rt_func)(ire, rtf->rt_arg); 2539 } 2540 return (0); 2541 } 2542 2543 /* 2544 * Walk the ftable and the ctable entries that match the ill. 2545 */ 2546 void 2547 ire_walk_ill_tables(uint_t match_flags, uint_t ire_type, pfv_t func, 2548 void *arg, size_t ftbl_sz, size_t htbl_sz, irb_t **ipftbl, 2549 size_t ctbl_sz, irb_t *ipctbl, ill_t *ill, zoneid_t zoneid, 2550 ip_stack_t *ipst) 2551 { 2552 irb_t *irb_ptr; 2553 irb_t *irb; 2554 ire_t *ire; 2555 int i, j; 2556 boolean_t ret; 2557 struct rtfuncarg rtfarg; 2558 2559 ASSERT((!(match_flags & (MATCH_IRE_WQ | MATCH_IRE_ILL | 2560 MATCH_IRE_ILL_GROUP))) || (ill != NULL)); 2561 ASSERT(!(match_flags & MATCH_IRE_TYPE) || (ire_type != 0)); 2562 /* 2563 * Optimize by not looking at the forwarding table if there 2564 * is a MATCH_IRE_TYPE specified with no IRE_FORWARDTABLE 2565 * specified in ire_type. 2566 */ 2567 if (!(match_flags & MATCH_IRE_TYPE) || 2568 ((ire_type & IRE_FORWARDTABLE) != 0)) { 2569 /* knobs such that routine is called only for v6 case */ 2570 if (ipftbl == ipst->ips_ip_forwarding_table_v6) { 2571 for (i = (ftbl_sz - 1); i >= 0; i--) { 2572 if ((irb_ptr = ipftbl[i]) == NULL) 2573 continue; 2574 for (j = 0; j < htbl_sz; j++) { 2575 irb = &irb_ptr[j]; 2576 if (irb->irb_ire == NULL) 2577 continue; 2578 2579 IRB_REFHOLD(irb); 2580 for (ire = irb->irb_ire; ire != NULL; 2581 ire = ire->ire_next) { 2582 if (match_flags == 0 && 2583 zoneid == ALL_ZONES) { 2584 ret = B_TRUE; 2585 } else { 2586 ret = 2587 ire_walk_ill_match( 2588 match_flags, 2589 ire_type, ire, ill, 2590 zoneid, ipst); 2591 } 2592 if (ret) 2593 (*func)(ire, arg); 2594 } 2595 IRB_REFRELE(irb); 2596 } 2597 } 2598 } else { 2599 (void) memset(&rtfarg, 0, sizeof (rtfarg)); 2600 rtfarg.rt_func = func; 2601 rtfarg.rt_arg = arg; 2602 if (match_flags != 0) { 2603 rtfarg.rt_match_flags = match_flags; 2604 } 2605 rtfarg.rt_ire_type = ire_type; 2606 rtfarg.rt_ill = ill; 2607 rtfarg.rt_zoneid = zoneid; 2608 rtfarg.rt_ipst = ipst; /* No netstack_hold */ 2609 (void) ipst->ips_ip_ftable->rnh_walktree_mt( 2610 ipst->ips_ip_ftable, 2611 rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn); 2612 } 2613 } 2614 2615 /* 2616 * Optimize by not looking at the cache table if there 2617 * is a MATCH_IRE_TYPE specified with no IRE_CACHETABLE 2618 * specified in ire_type. 2619 */ 2620 if (!(match_flags & MATCH_IRE_TYPE) || 2621 ((ire_type & IRE_CACHETABLE) != 0)) { 2622 for (i = 0; i < ctbl_sz; i++) { 2623 irb = &ipctbl[i]; 2624 if (irb->irb_ire == NULL) 2625 continue; 2626 IRB_REFHOLD(irb); 2627 for (ire = irb->irb_ire; ire != NULL; 2628 ire = ire->ire_next) { 2629 if (match_flags == 0 && zoneid == ALL_ZONES) { 2630 ret = B_TRUE; 2631 } else { 2632 ret = ire_walk_ill_match( 2633 match_flags, ire_type, 2634 ire, ill, zoneid, ipst); 2635 } 2636 if (ret) 2637 (*func)(ire, arg); 2638 } 2639 IRB_REFRELE(irb); 2640 } 2641 } 2642 } 2643 2644 /* 2645 * This routine walks through the ill chain to find if there is any 2646 * ire linked to the ill's interface based forwarding table 2647 * The arg could be ill or mp. This routine is called when a ill goes 2648 * down/deleted or the 'ipv4_ire_srcif_status' report is printed. 2649 */ 2650 void 2651 ire_walk_srcif_table_v4(pfv_t func, void *arg, ip_stack_t *ipst) 2652 { 2653 irb_t *irb; 2654 ire_t *ire; 2655 ill_t *ill, *next_ill; 2656 int i; 2657 int total_count; 2658 ill_walk_context_t ctx; 2659 2660 /* 2661 * Take care of ire's in other ill's per-interface forwarding 2662 * table. Check if any ire in any of the ill's ill_srcif_table 2663 * is pointing to this ill. 2664 */ 2665 mutex_enter(&ipst->ips_ire_srcif_table_lock); 2666 if (ipst->ips_ire_srcif_table_count == 0) { 2667 mutex_exit(&ipst->ips_ire_srcif_table_lock); 2668 return; 2669 } 2670 mutex_exit(&ipst->ips_ire_srcif_table_lock); 2671 2672 #ifdef DEBUG 2673 /* Keep accounting of all interface based table ires */ 2674 total_count = 0; 2675 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2676 ill = ILL_START_WALK_V4(&ctx, ipst); 2677 while (ill != NULL) { 2678 mutex_enter(&ill->ill_lock); 2679 total_count += ill->ill_srcif_refcnt; 2680 next_ill = ill_next(&ctx, ill); 2681 mutex_exit(&ill->ill_lock); 2682 ill = next_ill; 2683 } 2684 rw_exit(&ipst->ips_ill_g_lock); 2685 2686 /* Hold lock here to make sure ire_srcif_table_count is stable */ 2687 mutex_enter(&ipst->ips_ire_srcif_table_lock); 2688 i = ipst->ips_ire_srcif_table_count; 2689 mutex_exit(&ipst->ips_ire_srcif_table_lock); 2690 ip1dbg(("ire_walk_srcif_v4: ire_srcif_table_count %d " 2691 "total ill_srcif_refcnt %d\n", i, total_count)); 2692 #endif 2693 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2694 ill = ILL_START_WALK_V4(&ctx, ipst); 2695 while (ill != NULL) { 2696 mutex_enter(&ill->ill_lock); 2697 if ((ill->ill_srcif_refcnt == 0) || !ILL_CAN_LOOKUP(ill)) { 2698 next_ill = ill_next(&ctx, ill); 2699 mutex_exit(&ill->ill_lock); 2700 ill = next_ill; 2701 continue; 2702 } 2703 ill_refhold_locked(ill); 2704 mutex_exit(&ill->ill_lock); 2705 rw_exit(&ipst->ips_ill_g_lock); 2706 if (ill->ill_srcif_table != NULL) { 2707 for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) { 2708 irb = &(ill->ill_srcif_table[i]); 2709 if (irb->irb_ire == NULL) 2710 continue; 2711 IRB_REFHOLD(irb); 2712 for (ire = irb->irb_ire; ire != NULL; 2713 ire = ire->ire_next) { 2714 (*func)(ire, arg); 2715 } 2716 IRB_REFRELE(irb); 2717 } 2718 } 2719 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2720 next_ill = ill_next(&ctx, ill); 2721 ill_refrele(ill); 2722 ill = next_ill; 2723 } 2724 rw_exit(&ipst->ips_ill_g_lock); 2725 } 2726 2727 /* 2728 * This function takes a mask and returns 2729 * number of bits set in the mask. If no 2730 * bit is set it returns 0. 2731 * Assumes a contiguous mask. 2732 */ 2733 int 2734 ip_mask_to_plen(ipaddr_t mask) 2735 { 2736 return (mask == 0 ? 0 : IP_ABITS - (ffs(ntohl(mask)) -1)); 2737 } 2738 2739 /* 2740 * Convert length for a mask to the mask. 2741 */ 2742 ipaddr_t 2743 ip_plen_to_mask(uint_t masklen) 2744 { 2745 return (htonl(IP_HOST_MASK << (IP_ABITS - masklen))); 2746 } 2747 2748 void 2749 ire_atomic_end(irb_t *irb_ptr, ire_t *ire) 2750 { 2751 ill_t *ill_list[NUM_ILLS]; 2752 ip_stack_t *ipst = ire->ire_ipst; 2753 2754 ill_list[0] = ire->ire_stq != NULL ? ire->ire_stq->q_ptr : NULL; 2755 ill_list[1] = ire->ire_ipif != NULL ? ire->ire_ipif->ipif_ill : NULL; 2756 ill_list[2] = ire->ire_in_ill; 2757 ill_unlock_ills(ill_list, NUM_ILLS); 2758 rw_exit(&irb_ptr->irb_lock); 2759 rw_exit(&ipst->ips_ill_g_usesrc_lock); 2760 } 2761 2762 /* 2763 * ire_add_v[46] atomically make sure that the ipif or ill associated 2764 * with the new ire being added is stable and not IPIF_CHANGING or ILL_CHANGING 2765 * before adding the ire to the table. This ensures that we don't create 2766 * new IRE_CACHEs with stale values for parameters that are passed to 2767 * ire_create such as ire_max_frag. Note that ire_create() is passed a pointer 2768 * to the ipif_mtu, and not the value. The actual value is derived from the 2769 * parent ire or ipif under the bucket lock. 2770 */ 2771 int 2772 ire_atomic_start(irb_t *irb_ptr, ire_t *ire, queue_t *q, mblk_t *mp, 2773 ipsq_func_t func) 2774 { 2775 ill_t *stq_ill; 2776 ill_t *ipif_ill; 2777 ill_t *in_ill; 2778 ill_t *ill_list[NUM_ILLS]; 2779 int cnt = NUM_ILLS; 2780 int error = 0; 2781 ill_t *ill = NULL; 2782 ip_stack_t *ipst = ire->ire_ipst; 2783 2784 ill_list[0] = stq_ill = ire->ire_stq != 2785 NULL ? ire->ire_stq->q_ptr : NULL; 2786 ill_list[1] = ipif_ill = ire->ire_ipif != 2787 NULL ? ire->ire_ipif->ipif_ill : NULL; 2788 ill_list[2] = in_ill = ire->ire_in_ill; 2789 2790 ASSERT((q != NULL && mp != NULL && func != NULL) || 2791 (q == NULL && mp == NULL && func == NULL)); 2792 rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER); 2793 GRAB_CONN_LOCK(q); 2794 rw_enter(&irb_ptr->irb_lock, RW_WRITER); 2795 ill_lock_ills(ill_list, cnt); 2796 2797 /* 2798 * While the IRE is in the process of being added, a user may have 2799 * invoked the ifconfig usesrc option on the stq_ill to make it a 2800 * usesrc client ILL. Check for this possibility here, if it is true 2801 * then we fail adding the IRE_CACHE. Another check is to make sure 2802 * that an ipif_ill of an IRE_CACHE being added is not part of a usesrc 2803 * group. The ill_g_usesrc_lock is released in ire_atomic_end 2804 */ 2805 if ((ire->ire_type & IRE_CACHE) && 2806 (ire->ire_marks & IRE_MARK_USESRC_CHECK)) { 2807 if (stq_ill->ill_usesrc_ifindex != 0) { 2808 ASSERT(stq_ill->ill_usesrc_grp_next != NULL); 2809 if ((ipif_ill->ill_phyint->phyint_ifindex != 2810 stq_ill->ill_usesrc_ifindex) || 2811 (ipif_ill->ill_usesrc_grp_next == NULL) || 2812 (ipif_ill->ill_usesrc_ifindex != 0)) { 2813 error = EINVAL; 2814 goto done; 2815 } 2816 } else if (ipif_ill->ill_usesrc_grp_next != NULL) { 2817 error = EINVAL; 2818 goto done; 2819 } 2820 } 2821 2822 /* 2823 * IPMP flag settings happen without taking the exclusive route 2824 * in ip_sioctl_flags. So we need to make an atomic check here 2825 * for FAILED/OFFLINE/INACTIVE flags or if it has hit the 2826 * FAILBACK=no case. 2827 */ 2828 if ((stq_ill != NULL) && !IAM_WRITER_ILL(stq_ill)) { 2829 if (stq_ill->ill_state_flags & ILL_CHANGING) { 2830 ill = stq_ill; 2831 error = EAGAIN; 2832 } else if ((stq_ill->ill_phyint->phyint_flags & PHYI_OFFLINE) || 2833 (ill_is_probeonly(stq_ill) && 2834 !(ire->ire_marks & IRE_MARK_HIDDEN))) { 2835 error = EINVAL; 2836 } 2837 goto done; 2838 } 2839 2840 /* 2841 * We don't check for OFFLINE/FAILED in this case because 2842 * the source address selection logic (ipif_select_source) 2843 * may still select a source address from such an ill. The 2844 * assumption is that these addresses will be moved by in.mpathd 2845 * soon. (i.e. this is a race). However link local addresses 2846 * will not move and hence ipif_select_source_v6 tries to avoid 2847 * FAILED ills. Please see ipif_select_source_v6 for more info 2848 */ 2849 if ((ipif_ill != NULL) && !IAM_WRITER_ILL(ipif_ill) && 2850 (ipif_ill->ill_state_flags & ILL_CHANGING)) { 2851 ill = ipif_ill; 2852 error = EAGAIN; 2853 goto done; 2854 } 2855 2856 if ((in_ill != NULL) && !IAM_WRITER_ILL(in_ill) && 2857 (in_ill->ill_state_flags & ILL_CHANGING)) { 2858 ill = in_ill; 2859 error = EAGAIN; 2860 goto done; 2861 } 2862 2863 if ((ire->ire_ipif != NULL) && !IAM_WRITER_IPIF(ire->ire_ipif) && 2864 (ire->ire_ipif->ipif_state_flags & IPIF_CHANGING)) { 2865 ill = ire->ire_ipif->ipif_ill; 2866 ASSERT(ill != NULL); 2867 error = EAGAIN; 2868 goto done; 2869 } 2870 2871 done: 2872 if (error == EAGAIN && ILL_CAN_WAIT(ill, q)) { 2873 ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq; 2874 mutex_enter(&ipsq->ipsq_lock); 2875 ire_atomic_end(irb_ptr, ire); 2876 ipsq_enq(ipsq, q, mp, func, NEW_OP, ill); 2877 mutex_exit(&ipsq->ipsq_lock); 2878 error = EINPROGRESS; 2879 } else if (error != 0) { 2880 ire_atomic_end(irb_ptr, ire); 2881 } 2882 2883 RELEASE_CONN_LOCK(q); 2884 return (error); 2885 } 2886 2887 /* 2888 * Add a fully initialized IRE to an appropriate table based on 2889 * ire_type. 2890 * 2891 * allow_unresolved == B_FALSE indicates a legacy code-path call 2892 * that has prohibited the addition of incomplete ire's. If this 2893 * parameter is set, and we find an nce that is in a state other 2894 * than ND_REACHABLE, we fail the add. Note that nce_state could be 2895 * something other than ND_REACHABLE if the nce had just expired and 2896 * the ire_create preceding the ire_add added a new ND_INITIAL nce. 2897 */ 2898 int 2899 ire_add(ire_t **irep, queue_t *q, mblk_t *mp, ipsq_func_t func, 2900 boolean_t allow_unresolved) 2901 { 2902 ire_t *ire1; 2903 ill_t *stq_ill = NULL; 2904 ill_t *ill; 2905 ipif_t *ipif = NULL; 2906 ill_walk_context_t ctx; 2907 ire_t *ire = *irep; 2908 int error; 2909 boolean_t ire_is_mblk = B_FALSE; 2910 tsol_gcgrp_t *gcgrp = NULL; 2911 tsol_gcgrp_addr_t ga; 2912 ip_stack_t *ipst = ire->ire_ipst; 2913 2914 ASSERT(ire->ire_type != IRE_MIPRTUN); 2915 2916 /* get ready for the day when original ire is not created as mblk */ 2917 if (ire->ire_mp != NULL) { 2918 ire_is_mblk = B_TRUE; 2919 /* Copy the ire to a kmem_alloc'ed area */ 2920 ire1 = kmem_cache_alloc(ire_cache, KM_NOSLEEP); 2921 if (ire1 == NULL) { 2922 ip1dbg(("ire_add: alloc failed\n")); 2923 ire_delete(ire); 2924 *irep = NULL; 2925 return (ENOMEM); 2926 } 2927 ire->ire_marks &= ~IRE_MARK_UNCACHED; 2928 *ire1 = *ire; 2929 ire1->ire_mp = NULL; 2930 ire1->ire_stq_ifindex = 0; 2931 freeb(ire->ire_mp); 2932 ire = ire1; 2933 } 2934 if (ire->ire_stq != NULL) 2935 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 2936 2937 if (ire->ire_type == IRE_CACHE) { 2938 /* 2939 * If this interface is FAILED, or INACTIVE or has hit 2940 * the FAILBACK=no case, we create IRE_CACHES marked 2941 * HIDDEN for some special cases e.g. bind to 2942 * IPIF_NOFAILOVER address etc. So, if this interface 2943 * is FAILED/INACTIVE/hit FAILBACK=no case, and we are 2944 * not creating hidden ires, we should not allow that. 2945 * This happens because the state of the interface 2946 * changed while we were waiting in ARP. If this is the 2947 * daemon sending probes, the next probe will create 2948 * HIDDEN ires and we will create an ire then. This 2949 * cannot happen with NDP currently because IRE is 2950 * never queued in NDP. But it can happen in the 2951 * future when we have external resolvers with IPv6. 2952 * If the interface gets marked with OFFLINE while we 2953 * are waiting in ARP, don't add the ire. 2954 */ 2955 if ((stq_ill->ill_phyint->phyint_flags & PHYI_OFFLINE) || 2956 (ill_is_probeonly(stq_ill) && 2957 !(ire->ire_marks & IRE_MARK_HIDDEN))) { 2958 /* 2959 * We don't know whether it is a valid ipif or not. 2960 * unless we do the check below. So, set it to NULL. 2961 */ 2962 ire->ire_ipif = NULL; 2963 ire_delete(ire); 2964 *irep = NULL; 2965 return (EINVAL); 2966 } 2967 } 2968 2969 if (stq_ill != NULL && ire->ire_type == IRE_CACHE && 2970 stq_ill->ill_net_type == IRE_IF_RESOLVER) { 2971 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2972 ill = ILL_START_WALK_ALL(&ctx, ipst); 2973 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 2974 mutex_enter(&ill->ill_lock); 2975 if (ill->ill_state_flags & ILL_CONDEMNED) { 2976 mutex_exit(&ill->ill_lock); 2977 continue; 2978 } 2979 /* 2980 * We need to make sure that the ipif is a valid one 2981 * before adding the IRE_CACHE. This happens only 2982 * with IRE_CACHE when there is an external resolver. 2983 * 2984 * We can unplumb a logical interface while the 2985 * packet is waiting in ARP with the IRE. Then, 2986 * later on when we feed the IRE back, the ipif 2987 * has to be re-checked. This can't happen with 2988 * NDP currently, as we never queue the IRE with 2989 * the packet. We always try to recreate the IRE 2990 * when the resolution is completed. But, we do 2991 * it for IPv6 also here so that in future if 2992 * we have external resolvers, it will work without 2993 * any change. 2994 */ 2995 ipif = ipif_lookup_seqid(ill, ire->ire_ipif_seqid); 2996 if (ipif != NULL) { 2997 ipif_refhold_locked(ipif); 2998 mutex_exit(&ill->ill_lock); 2999 break; 3000 } 3001 mutex_exit(&ill->ill_lock); 3002 } 3003 rw_exit(&ipst->ips_ill_g_lock); 3004 if (ipif == NULL || 3005 (ipif->ipif_isv6 && 3006 !IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6, 3007 &ipif->ipif_v6src_addr)) || 3008 (!ipif->ipif_isv6 && 3009 ire->ire_src_addr != ipif->ipif_src_addr) || 3010 ire->ire_zoneid != ipif->ipif_zoneid) { 3011 3012 if (ipif != NULL) 3013 ipif_refrele(ipif); 3014 ire->ire_ipif = NULL; 3015 ire_delete(ire); 3016 *irep = NULL; 3017 return (EINVAL); 3018 } 3019 3020 3021 ASSERT(ill != NULL); 3022 /* 3023 * If this group was dismantled while this packets was 3024 * queued in ARP, don't add it here. 3025 */ 3026 if (ire->ire_ipif->ipif_ill->ill_group != ill->ill_group) { 3027 /* We don't want ire_inactive bump stats for this */ 3028 ipif_refrele(ipif); 3029 ire->ire_ipif = NULL; 3030 ire_delete(ire); 3031 *irep = NULL; 3032 return (EINVAL); 3033 } 3034 3035 /* 3036 * Since we didn't attach label security attributes to the 3037 * ire for the resolver case, we need to add it now. (only 3038 * for v4 resolver and v6 xresolv case). 3039 */ 3040 if (is_system_labeled() && ire_is_mblk) { 3041 if (ire->ire_ipversion == IPV4_VERSION) { 3042 ga.ga_af = AF_INET; 3043 IN6_IPADDR_TO_V4MAPPED(ire->ire_gateway_addr != 3044 INADDR_ANY ? ire->ire_gateway_addr : 3045 ire->ire_addr, &ga.ga_addr); 3046 } else { 3047 ga.ga_af = AF_INET6; 3048 ga.ga_addr = IN6_IS_ADDR_UNSPECIFIED( 3049 &ire->ire_gateway_addr_v6) ? 3050 ire->ire_addr_v6 : 3051 ire->ire_gateway_addr_v6; 3052 } 3053 gcgrp = gcgrp_lookup(&ga, B_FALSE); 3054 error = tsol_ire_init_gwattr(ire, ire->ire_ipversion, 3055 NULL, gcgrp); 3056 if (error != 0) { 3057 if (gcgrp != NULL) { 3058 GCGRP_REFRELE(gcgrp); 3059 gcgrp = NULL; 3060 } 3061 ipif_refrele(ipif); 3062 ire->ire_ipif = NULL; 3063 ire_delete(ire); 3064 *irep = NULL; 3065 return (error); 3066 } 3067 } 3068 } 3069 3070 /* 3071 * In case ire was changed 3072 */ 3073 *irep = ire; 3074 if (ire->ire_ipversion == IPV6_VERSION) { 3075 error = ire_add_v6(irep, q, mp, func); 3076 } else { 3077 if (ire->ire_in_ill == NULL) 3078 error = ire_add_v4(irep, q, mp, func, allow_unresolved); 3079 else 3080 error = ire_add_srcif_v4(irep, q, mp, func); 3081 } 3082 if (ipif != NULL) 3083 ipif_refrele(ipif); 3084 return (error); 3085 } 3086 3087 /* 3088 * Add an initialized IRE to an appropriate table based on ire_type. 3089 * 3090 * The forward table contains IRE_PREFIX/IRE_HOST and 3091 * IRE_IF_RESOLVER/IRE_IF_NORESOLVER and IRE_DEFAULT. 3092 * 3093 * The cache table contains IRE_BROADCAST/IRE_LOCAL/IRE_LOOPBACK 3094 * and IRE_CACHE. 3095 * 3096 * NOTE : This function is called as writer though not required 3097 * by this function. 3098 */ 3099 static int 3100 ire_add_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func, 3101 boolean_t allow_unresolved) 3102 { 3103 ire_t *ire1; 3104 irb_t *irb_ptr; 3105 ire_t **irep; 3106 int flags; 3107 ire_t *pire = NULL; 3108 ill_t *stq_ill; 3109 ire_t *ire = *ire_p; 3110 int error; 3111 boolean_t need_refrele = B_FALSE; 3112 nce_t *nce; 3113 ip_stack_t *ipst = ire->ire_ipst; 3114 3115 if (ire->ire_ipif != NULL) 3116 ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock)); 3117 if (ire->ire_stq != NULL) 3118 ASSERT(!MUTEX_HELD( 3119 &((ill_t *)(ire->ire_stq->q_ptr))->ill_lock)); 3120 ASSERT(ire->ire_ipversion == IPV4_VERSION); 3121 ASSERT(ire->ire_mp == NULL); /* Calls should go through ire_add */ 3122 ASSERT(ire->ire_in_ill == NULL); /* No srcif entries */ 3123 3124 /* Find the appropriate list head. */ 3125 switch (ire->ire_type) { 3126 case IRE_HOST: 3127 ire->ire_mask = IP_HOST_MASK; 3128 ire->ire_masklen = IP_ABITS; 3129 if ((ire->ire_flags & RTF_SETSRC) == 0) 3130 ire->ire_src_addr = 0; 3131 break; 3132 case IRE_CACHE: 3133 case IRE_BROADCAST: 3134 case IRE_LOCAL: 3135 case IRE_LOOPBACK: 3136 ire->ire_mask = IP_HOST_MASK; 3137 ire->ire_masklen = IP_ABITS; 3138 break; 3139 case IRE_PREFIX: 3140 if ((ire->ire_flags & RTF_SETSRC) == 0) 3141 ire->ire_src_addr = 0; 3142 break; 3143 case IRE_DEFAULT: 3144 if ((ire->ire_flags & RTF_SETSRC) == 0) 3145 ire->ire_src_addr = 0; 3146 break; 3147 case IRE_IF_RESOLVER: 3148 case IRE_IF_NORESOLVER: 3149 break; 3150 default: 3151 ip0dbg(("ire_add_v4: ire %p has unrecognized IRE type (%d)\n", 3152 (void *)ire, ire->ire_type)); 3153 ire_delete(ire); 3154 *ire_p = NULL; 3155 return (EINVAL); 3156 } 3157 3158 /* Make sure the address is properly masked. */ 3159 ire->ire_addr &= ire->ire_mask; 3160 3161 /* 3162 * ip_newroute/ip_newroute_multi are unable to prevent the deletion 3163 * of the interface route while adding an IRE_CACHE for an on-link 3164 * destination in the IRE_IF_RESOLVER case, since the ire has to 3165 * go to ARP and return. We can't do a REFHOLD on the 3166 * associated interface ire for fear of ARP freeing the message. 3167 * Here we look up the interface ire in the forwarding table and 3168 * make sure that the interface route has not been deleted. 3169 */ 3170 if (ire->ire_type == IRE_CACHE && ire->ire_gateway_addr == 0 && 3171 ((ill_t *)ire->ire_stq->q_ptr)->ill_net_type == IRE_IF_RESOLVER) { 3172 3173 ASSERT(ire->ire_max_fragp == NULL); 3174 if (CLASSD(ire->ire_addr) && !(ire->ire_flags & RTF_SETSRC)) { 3175 /* 3176 * The ihandle that we used in ip_newroute_multi 3177 * comes from the interface route corresponding 3178 * to ire_ipif. Lookup here to see if it exists 3179 * still. 3180 * If the ire has a source address assigned using 3181 * RTF_SETSRC, ire_ipif is the logical interface holding 3182 * this source address, so we can't use it to check for 3183 * the existence of the interface route. Instead we rely 3184 * on the brute force ihandle search in 3185 * ire_ihandle_lookup_onlink() below. 3186 */ 3187 pire = ipif_to_ire(ire->ire_ipif); 3188 if (pire == NULL) { 3189 ire_delete(ire); 3190 *ire_p = NULL; 3191 return (EINVAL); 3192 } else if (pire->ire_ihandle != ire->ire_ihandle) { 3193 ire_refrele(pire); 3194 ire_delete(ire); 3195 *ire_p = NULL; 3196 return (EINVAL); 3197 } 3198 } else { 3199 pire = ire_ihandle_lookup_onlink(ire); 3200 if (pire == NULL) { 3201 ire_delete(ire); 3202 *ire_p = NULL; 3203 return (EINVAL); 3204 } 3205 } 3206 /* Prevent pire from getting deleted */ 3207 IRB_REFHOLD(pire->ire_bucket); 3208 /* Has it been removed already ? */ 3209 if (pire->ire_marks & IRE_MARK_CONDEMNED) { 3210 IRB_REFRELE(pire->ire_bucket); 3211 ire_refrele(pire); 3212 ire_delete(ire); 3213 *ire_p = NULL; 3214 return (EINVAL); 3215 } 3216 } else { 3217 ASSERT(ire->ire_max_fragp != NULL); 3218 } 3219 flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW); 3220 3221 if (ire->ire_ipif != NULL) { 3222 /* 3223 * We use MATCH_IRE_IPIF while adding IRE_CACHES only 3224 * for historic reasons and to maintain symmetry with 3225 * IPv6 code path. Historically this was used by 3226 * multicast code to create multiple IRE_CACHES on 3227 * a single ill with different ipifs. This was used 3228 * so that multicast packets leaving the node had the 3229 * right source address. This is no longer needed as 3230 * ip_wput initializes the address correctly. 3231 */ 3232 flags |= MATCH_IRE_IPIF; 3233 /* 3234 * If we are creating hidden ires, make sure we search on 3235 * this ill (MATCH_IRE_ILL) and a hidden ire, 3236 * while we are searching for duplicates below. Otherwise we 3237 * could potentially find an IRE on some other interface 3238 * and it may not be a IRE marked with IRE_MARK_HIDDEN. We 3239 * shouldn't do this as this will lead to an infinite loop 3240 * (if we get to ip_wput again) eventually we need an hidden 3241 * ire for this packet to go out. MATCH_IRE_ILL is explicitly 3242 * done below. 3243 */ 3244 if (ire->ire_type == IRE_CACHE && 3245 (ire->ire_marks & IRE_MARK_HIDDEN)) 3246 flags |= (MATCH_IRE_MARK_HIDDEN); 3247 } 3248 if ((ire->ire_type & IRE_CACHETABLE) == 0) { 3249 irb_ptr = ire_get_bucket(ire); 3250 need_refrele = B_TRUE; 3251 if (irb_ptr == NULL) { 3252 /* 3253 * This assumes that the ire has not added 3254 * a reference to the ipif. 3255 */ 3256 ire->ire_ipif = NULL; 3257 ire_delete(ire); 3258 if (pire != NULL) { 3259 IRB_REFRELE(pire->ire_bucket); 3260 ire_refrele(pire); 3261 } 3262 *ire_p = NULL; 3263 return (EINVAL); 3264 } 3265 } else { 3266 irb_ptr = &(ipst->ips_ip_cache_table[IRE_ADDR_HASH( 3267 ire->ire_addr, ipst->ips_ip_cache_table_size)]); 3268 } 3269 3270 /* 3271 * Start the atomic add of the ire. Grab the ill locks, 3272 * ill_g_usesrc_lock and the bucket lock. Check for condemned 3273 * 3274 * If ipif or ill is changing ire_atomic_start() may queue the 3275 * request and return EINPROGRESS. 3276 * To avoid lock order problems, get the ndp4->ndp_g_lock. 3277 */ 3278 mutex_enter(&ipst->ips_ndp4->ndp_g_lock); 3279 error = ire_atomic_start(irb_ptr, ire, q, mp, func); 3280 if (error != 0) { 3281 mutex_exit(&ipst->ips_ndp4->ndp_g_lock); 3282 /* 3283 * We don't know whether it is a valid ipif or not. 3284 * So, set it to NULL. This assumes that the ire has not added 3285 * a reference to the ipif. 3286 */ 3287 ire->ire_ipif = NULL; 3288 ire_delete(ire); 3289 if (pire != NULL) { 3290 IRB_REFRELE(pire->ire_bucket); 3291 ire_refrele(pire); 3292 } 3293 *ire_p = NULL; 3294 if (need_refrele) 3295 IRB_REFRELE(irb_ptr); 3296 return (error); 3297 } 3298 /* 3299 * To avoid creating ires having stale values for the ire_max_frag 3300 * we get the latest value atomically here. For more details 3301 * see the block comment in ip_sioctl_mtu and in DL_NOTE_SDU_CHANGE 3302 * in ip_rput_dlpi_writer 3303 */ 3304 if (ire->ire_max_fragp == NULL) { 3305 if (CLASSD(ire->ire_addr)) 3306 ire->ire_max_frag = ire->ire_ipif->ipif_mtu; 3307 else 3308 ire->ire_max_frag = pire->ire_max_frag; 3309 } else { 3310 uint_t max_frag; 3311 3312 max_frag = *ire->ire_max_fragp; 3313 ire->ire_max_fragp = NULL; 3314 ire->ire_max_frag = max_frag; 3315 } 3316 /* 3317 * Atomically check for duplicate and insert in the table. 3318 */ 3319 for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) { 3320 if (ire1->ire_marks & IRE_MARK_CONDEMNED) 3321 continue; 3322 if (ire->ire_ipif != NULL) { 3323 /* 3324 * We do MATCH_IRE_ILL implicitly here for IREs 3325 * with a non-null ire_ipif, including IRE_CACHEs. 3326 * As ire_ipif and ire_stq could point to two 3327 * different ills, we can't pass just ire_ipif to 3328 * ire_match_args and get a match on both ills. 3329 * This is just needed for duplicate checks here and 3330 * so we don't add an extra argument to 3331 * ire_match_args for this. Do it locally. 3332 * 3333 * NOTE : Currently there is no part of the code 3334 * that asks for both MATH_IRE_IPIF and MATCH_IRE_ILL 3335 * match for IRE_CACHEs. Thus we don't want to 3336 * extend the arguments to ire_match_args. 3337 */ 3338 if (ire1->ire_stq != ire->ire_stq) 3339 continue; 3340 /* 3341 * Multiroute IRE_CACHEs for a given destination can 3342 * have the same ire_ipif, typically if their source 3343 * address is forced using RTF_SETSRC, and the same 3344 * send-to queue. We differentiate them using the parent 3345 * handle. 3346 */ 3347 if (ire->ire_type == IRE_CACHE && 3348 (ire1->ire_flags & RTF_MULTIRT) && 3349 (ire->ire_flags & RTF_MULTIRT) && 3350 (ire1->ire_phandle != ire->ire_phandle)) 3351 continue; 3352 } 3353 if (ire1->ire_zoneid != ire->ire_zoneid) 3354 continue; 3355 if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask, 3356 ire->ire_gateway_addr, ire->ire_type, ire->ire_ipif, 3357 ire->ire_zoneid, 0, NULL, flags)) { 3358 /* 3359 * Return the old ire after doing a REFHOLD. 3360 * As most of the callers continue to use the IRE 3361 * after adding, we return a held ire. This will 3362 * avoid a lookup in the caller again. If the callers 3363 * don't want to use it, they need to do a REFRELE. 3364 */ 3365 ip1dbg(("found dup ire existing %p new %p", 3366 (void *)ire1, (void *)ire)); 3367 IRE_REFHOLD(ire1); 3368 ire_atomic_end(irb_ptr, ire); 3369 mutex_exit(&ipst->ips_ndp4->ndp_g_lock); 3370 ire_delete(ire); 3371 if (pire != NULL) { 3372 /* 3373 * Assert that it is not removed from the 3374 * list yet. 3375 */ 3376 ASSERT(pire->ire_ptpn != NULL); 3377 IRB_REFRELE(pire->ire_bucket); 3378 ire_refrele(pire); 3379 } 3380 *ire_p = ire1; 3381 if (need_refrele) 3382 IRB_REFRELE(irb_ptr); 3383 return (0); 3384 } 3385 } 3386 if (ire->ire_type & IRE_CACHE) { 3387 ASSERT(ire->ire_stq != NULL); 3388 nce = ndp_lookup_v4(ire_to_ill(ire), 3389 ((ire->ire_gateway_addr != INADDR_ANY) ? 3390 &ire->ire_gateway_addr : &ire->ire_addr), 3391 B_TRUE); 3392 if (nce != NULL) 3393 mutex_enter(&nce->nce_lock); 3394 /* 3395 * if the nce is NCE_F_CONDEMNED, or if it is not ND_REACHABLE 3396 * and the caller has prohibited the addition of incomplete 3397 * ire's, we fail the add. Note that nce_state could be 3398 * something other than ND_REACHABLE if the nce had 3399 * just expired and the ire_create preceding the 3400 * ire_add added a new ND_INITIAL nce. 3401 */ 3402 if ((nce == NULL) || 3403 (nce->nce_flags & NCE_F_CONDEMNED) || 3404 (!allow_unresolved && 3405 (nce->nce_state != ND_REACHABLE))) { 3406 if (nce != NULL) { 3407 DTRACE_PROBE1(ire__bad__nce, nce_t *, nce); 3408 mutex_exit(&nce->nce_lock); 3409 } 3410 ire_atomic_end(irb_ptr, ire); 3411 mutex_exit(&ipst->ips_ndp4->ndp_g_lock); 3412 if (nce != NULL) 3413 NCE_REFRELE(nce); 3414 DTRACE_PROBE1(ire__no__nce, ire_t *, ire); 3415 ire_delete(ire); 3416 if (pire != NULL) { 3417 IRB_REFRELE(pire->ire_bucket); 3418 ire_refrele(pire); 3419 } 3420 *ire_p = NULL; 3421 if (need_refrele) 3422 IRB_REFRELE(irb_ptr); 3423 return (EINVAL); 3424 } else { 3425 ire->ire_nce = nce; 3426 mutex_exit(&nce->nce_lock); 3427 /* 3428 * We are associating this nce to the ire, so 3429 * change the nce ref taken in ndp_lookup_v4() from 3430 * NCE_REFHOLD to NCE_REFHOLD_NOTR 3431 */ 3432 NCE_REFHOLD_TO_REFHOLD_NOTR(ire->ire_nce); 3433 } 3434 } 3435 /* 3436 * Make it easy for ip_wput_ire() to hit multiple broadcast ires by 3437 * grouping identical addresses together on the hash chain. We also 3438 * don't want to send multiple copies out if there are two ills part 3439 * of the same group. Thus we group the ires with same addr and same 3440 * ill group together so that ip_wput_ire can easily skip all the 3441 * ires with same addr and same group after sending the first copy. 3442 * We do this only for IRE_BROADCASTs as ip_wput_ire is currently 3443 * interested in such groupings only for broadcasts. 3444 * 3445 * NOTE : If the interfaces are brought up first and then grouped, 3446 * illgrp_insert will handle it. We come here when the interfaces 3447 * are already in group and we are bringing them UP. 3448 * 3449 * Find the first entry that matches ire_addr. *irep will be null 3450 * if no match. 3451 */ 3452 irep = (ire_t **)irb_ptr; 3453 while ((ire1 = *irep) != NULL && ire->ire_addr != ire1->ire_addr) 3454 irep = &ire1->ire_next; 3455 if (ire->ire_type == IRE_BROADCAST && *irep != NULL) { 3456 /* 3457 * We found some ire (i.e *irep) with a matching addr. We 3458 * want to group ires with same addr and same ill group 3459 * together. 3460 * 3461 * First get to the entry that matches our address and 3462 * ill group i.e stop as soon as we find the first ire 3463 * matching the ill group and address. If there is only 3464 * an address match, we should walk and look for some 3465 * group match. These are some of the possible scenarios : 3466 * 3467 * 1) There are no groups at all i.e all ire's ill_group 3468 * are NULL. In that case we will essentially group 3469 * all the ires with the same addr together. Same as 3470 * the "else" block of this "if". 3471 * 3472 * 2) There are some groups and this ire's ill_group is 3473 * NULL. In this case, we will first find the group 3474 * that matches the address and a NULL group. Then 3475 * we will insert the ire at the end of that group. 3476 * 3477 * 3) There are some groups and this ires's ill_group is 3478 * non-NULL. In this case we will first find the group 3479 * that matches the address and the ill_group. Then 3480 * we will insert the ire at the end of that group. 3481 */ 3482 /* LINTED : constant in conditional context */ 3483 while (1) { 3484 ire1 = *irep; 3485 if ((ire1->ire_next == NULL) || 3486 (ire1->ire_next->ire_addr != ire->ire_addr) || 3487 (ire1->ire_type != IRE_BROADCAST) || 3488 (ire1->ire_ipif->ipif_ill->ill_group == 3489 ire->ire_ipif->ipif_ill->ill_group)) 3490 break; 3491 irep = &ire1->ire_next; 3492 } 3493 ASSERT(*irep != NULL); 3494 irep = &((*irep)->ire_next); 3495 3496 /* 3497 * Either we have hit the end of the list or the address 3498 * did not match or the group *matched*. If we found 3499 * a match on the group, skip to the end of the group. 3500 */ 3501 while (*irep != NULL) { 3502 ire1 = *irep; 3503 if ((ire1->ire_addr != ire->ire_addr) || 3504 (ire1->ire_type != IRE_BROADCAST) || 3505 (ire1->ire_ipif->ipif_ill->ill_group != 3506 ire->ire_ipif->ipif_ill->ill_group)) 3507 break; 3508 if (ire1->ire_ipif->ipif_ill->ill_group == NULL && 3509 ire1->ire_ipif == ire->ire_ipif) { 3510 irep = &ire1->ire_next; 3511 break; 3512 } 3513 irep = &ire1->ire_next; 3514 } 3515 } else if (*irep != NULL) { 3516 /* 3517 * Find the last ire which matches ire_addr. 3518 * Needed to do tail insertion among entries with the same 3519 * ire_addr. 3520 */ 3521 while (ire->ire_addr == ire1->ire_addr) { 3522 irep = &ire1->ire_next; 3523 ire1 = *irep; 3524 if (ire1 == NULL) 3525 break; 3526 } 3527 } 3528 3529 /* Insert at *irep */ 3530 ire1 = *irep; 3531 if (ire1 != NULL) 3532 ire1->ire_ptpn = &ire->ire_next; 3533 ire->ire_next = ire1; 3534 /* Link the new one in. */ 3535 ire->ire_ptpn = irep; 3536 3537 /* 3538 * ire_walk routines de-reference ire_next without holding 3539 * a lock. Before we point to the new ire, we want to make 3540 * sure the store that sets the ire_next of the new ire 3541 * reaches global visibility, so that ire_walk routines 3542 * don't see a truncated list of ires i.e if the ire_next 3543 * of the new ire gets set after we do "*irep = ire" due 3544 * to re-ordering, the ire_walk thread will see a NULL 3545 * once it accesses the ire_next of the new ire. 3546 * membar_producer() makes sure that the following store 3547 * happens *after* all of the above stores. 3548 */ 3549 membar_producer(); 3550 *irep = ire; 3551 ire->ire_bucket = irb_ptr; 3552 /* 3553 * We return a bumped up IRE above. Keep it symmetrical 3554 * so that the callers will always have to release. This 3555 * helps the callers of this function because they continue 3556 * to use the IRE after adding and hence they don't have to 3557 * lookup again after we return the IRE. 3558 * 3559 * NOTE : We don't have to use atomics as this is appearing 3560 * in the list for the first time and no one else can bump 3561 * up the reference count on this yet. 3562 */ 3563 IRE_REFHOLD_LOCKED(ire); 3564 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_inserted); 3565 3566 irb_ptr->irb_ire_cnt++; 3567 if (irb_ptr->irb_marks & IRB_MARK_FTABLE) 3568 irb_ptr->irb_nire++; 3569 3570 if (ire->ire_marks & IRE_MARK_TEMPORARY) 3571 irb_ptr->irb_tmp_ire_cnt++; 3572 3573 if (ire->ire_ipif != NULL) { 3574 ire->ire_ipif->ipif_ire_cnt++; 3575 if (ire->ire_stq != NULL) { 3576 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 3577 stq_ill->ill_ire_cnt++; 3578 } 3579 } else { 3580 ASSERT(ire->ire_stq == NULL); 3581 } 3582 3583 ire_atomic_end(irb_ptr, ire); 3584 mutex_exit(&ipst->ips_ndp4->ndp_g_lock); 3585 3586 if (pire != NULL) { 3587 /* Assert that it is not removed from the list yet */ 3588 ASSERT(pire->ire_ptpn != NULL); 3589 IRB_REFRELE(pire->ire_bucket); 3590 ire_refrele(pire); 3591 } 3592 3593 if (ire->ire_type != IRE_CACHE) { 3594 /* 3595 * For ire's with host mask see if there is an entry 3596 * in the cache. If there is one flush the whole cache as 3597 * there might be multiple entries due to RTF_MULTIRT (CGTP). 3598 * If no entry is found than there is no need to flush the 3599 * cache. 3600 */ 3601 if (ire->ire_mask == IP_HOST_MASK) { 3602 ire_t *lire; 3603 lire = ire_ctable_lookup(ire->ire_addr, NULL, IRE_CACHE, 3604 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, ipst); 3605 if (lire != NULL) { 3606 ire_refrele(lire); 3607 ire_flush_cache_v4(ire, IRE_FLUSH_ADD); 3608 } 3609 } else { 3610 ire_flush_cache_v4(ire, IRE_FLUSH_ADD); 3611 } 3612 } 3613 /* 3614 * We had to delay the fast path probe until the ire is inserted 3615 * in the list. Otherwise the fast path ack won't find the ire in 3616 * the table. 3617 */ 3618 if (ire->ire_type == IRE_CACHE || 3619 (ire->ire_type == IRE_BROADCAST && ire->ire_stq != NULL)) { 3620 ASSERT(ire->ire_nce != NULL); 3621 nce_fastpath(ire->ire_nce); 3622 } 3623 if (ire->ire_ipif != NULL) 3624 ASSERT(!MUTEX_HELD(&ire->ire_ipif->ipif_ill->ill_lock)); 3625 *ire_p = ire; 3626 if (need_refrele) { 3627 IRB_REFRELE(irb_ptr); 3628 } 3629 return (0); 3630 } 3631 3632 /* 3633 * IRB_REFRELE is the only caller of the function. ire_unlink calls to 3634 * do the final cleanup for this ire. 3635 */ 3636 void 3637 ire_cleanup(ire_t *ire) 3638 { 3639 ire_t *ire_next; 3640 ip_stack_t *ipst = ire->ire_ipst; 3641 3642 ASSERT(ire != NULL); 3643 3644 while (ire != NULL) { 3645 ire_next = ire->ire_next; 3646 if (ire->ire_ipversion == IPV4_VERSION) { 3647 ire_delete_v4(ire); 3648 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, 3649 ire_stats_deleted); 3650 } else { 3651 ASSERT(ire->ire_ipversion == IPV6_VERSION); 3652 ire_delete_v6(ire); 3653 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, 3654 ire_stats_deleted); 3655 } 3656 /* 3657 * Now it's really out of the list. Before doing the 3658 * REFRELE, set ire_next to NULL as ire_inactive asserts 3659 * so. 3660 */ 3661 ire->ire_next = NULL; 3662 IRE_REFRELE_NOTR(ire); 3663 ire = ire_next; 3664 } 3665 } 3666 3667 /* 3668 * IRB_REFRELE is the only caller of the function. It calls to unlink 3669 * all the CONDEMNED ires from this bucket. 3670 */ 3671 ire_t * 3672 ire_unlink(irb_t *irb) 3673 { 3674 ire_t *ire; 3675 ire_t *ire1; 3676 ire_t **ptpn; 3677 ire_t *ire_list = NULL; 3678 3679 ASSERT(RW_WRITE_HELD(&irb->irb_lock)); 3680 ASSERT(((irb->irb_marks & IRB_MARK_FTABLE) && irb->irb_refcnt == 1) || 3681 (irb->irb_refcnt == 0)); 3682 ASSERT(irb->irb_marks & IRB_MARK_CONDEMNED); 3683 ASSERT(irb->irb_ire != NULL); 3684 3685 for (ire = irb->irb_ire; ire != NULL; ire = ire1) { 3686 ip_stack_t *ipst = ire->ire_ipst; 3687 3688 ire1 = ire->ire_next; 3689 if (ire->ire_marks & IRE_MARK_CONDEMNED) { 3690 ptpn = ire->ire_ptpn; 3691 ire1 = ire->ire_next; 3692 if (ire1) 3693 ire1->ire_ptpn = ptpn; 3694 *ptpn = ire1; 3695 ire->ire_ptpn = NULL; 3696 ire->ire_next = NULL; 3697 if (ire->ire_type == IRE_DEFAULT) { 3698 /* 3699 * IRE is out of the list. We need to adjust 3700 * the accounting before the caller drops 3701 * the lock. 3702 */ 3703 if (ire->ire_ipversion == IPV6_VERSION) { 3704 ASSERT(ipst-> 3705 ips_ipv6_ire_default_count != 3706 0); 3707 ipst->ips_ipv6_ire_default_count--; 3708 } 3709 } 3710 /* 3711 * We need to call ire_delete_v4 or ire_delete_v6 3712 * to clean up the cache or the redirects pointing at 3713 * the default gateway. We need to drop the lock 3714 * as ire_flush_cache/ire_delete_host_redircts require 3715 * so. But we can't drop the lock, as ire_unlink needs 3716 * to atomically remove the ires from the list. 3717 * So, create a temporary list of CONDEMNED ires 3718 * for doing ire_delete_v4/ire_delete_v6 operations 3719 * later on. 3720 */ 3721 ire->ire_next = ire_list; 3722 ire_list = ire; 3723 } 3724 } 3725 irb->irb_marks &= ~IRB_MARK_CONDEMNED; 3726 return (ire_list); 3727 } 3728 3729 /* 3730 * Delete all the cache entries with this 'addr'. When IP gets a gratuitous 3731 * ARP message on any of its interface queue, it scans the nce table and 3732 * deletes and calls ndp_delete() for the appropriate nce. This action 3733 * also deletes all the neighbor/ire cache entries for that address. 3734 * This function is called from ip_arp_news in ip.c and also for 3735 * ARP ioctl processing in ip_if.c. ip_ire_clookup_and_delete returns 3736 * true if it finds a nce entry which is used by ip_arp_news to determine if 3737 * it needs to do an ire_walk_v4. The return value is also used for the 3738 * same purpose by ARP IOCTL processing * in ip_if.c when deleting 3739 * ARP entries. For SIOC*IFARP ioctls in addition to the address, 3740 * ip_if->ipif_ill also needs to be matched. 3741 */ 3742 boolean_t 3743 ip_ire_clookup_and_delete(ipaddr_t addr, ipif_t *ipif, ip_stack_t *ipst) 3744 { 3745 ill_t *ill; 3746 nce_t *nce; 3747 3748 ill = (ipif ? ipif->ipif_ill : NULL); 3749 3750 if (ill != NULL) { 3751 /* 3752 * clean up the nce (and any relevant ire's) that matches 3753 * on addr and ill. 3754 */ 3755 nce = ndp_lookup_v4(ill, &addr, B_FALSE); 3756 if (nce != NULL) { 3757 ndp_delete(nce); 3758 return (B_TRUE); 3759 } 3760 } else { 3761 /* 3762 * ill is wildcard. clean up all nce's and 3763 * ire's that match on addr 3764 */ 3765 nce_clookup_t cl; 3766 3767 cl.ncecl_addr = addr; 3768 cl.ncecl_found = B_FALSE; 3769 3770 ndp_walk_common(ipst->ips_ndp4, NULL, 3771 (pfi_t)ip_nce_clookup_and_delete, (uchar_t *)&cl, B_TRUE); 3772 3773 /* 3774 * ncecl_found would be set by ip_nce_clookup_and_delete if 3775 * we found a matching nce. 3776 */ 3777 return (cl.ncecl_found); 3778 } 3779 return (B_FALSE); 3780 3781 } 3782 3783 /* Delete the supplied nce if its nce_addr matches the supplied address */ 3784 static void 3785 ip_nce_clookup_and_delete(nce_t *nce, void *arg) 3786 { 3787 nce_clookup_t *cl = (nce_clookup_t *)arg; 3788 ipaddr_t nce_addr; 3789 3790 IN6_V4MAPPED_TO_IPADDR(&nce->nce_addr, nce_addr); 3791 if (nce_addr == cl->ncecl_addr) { 3792 cl->ncecl_found = B_TRUE; 3793 /* clean up the nce (and any relevant ire's) */ 3794 ndp_delete(nce); 3795 } 3796 } 3797 3798 /* 3799 * Clean up the radix node for this ire. Must be called by IRB_REFRELE 3800 * when there are no ire's left in the bucket. Returns TRUE if the bucket 3801 * is deleted and freed. 3802 */ 3803 boolean_t 3804 irb_inactive(irb_t *irb) 3805 { 3806 struct rt_entry *rt; 3807 struct radix_node *rn; 3808 ip_stack_t *ipst = irb->irb_ipst; 3809 3810 ASSERT(irb->irb_ipst != NULL); 3811 3812 rt = IRB2RT(irb); 3813 rn = (struct radix_node *)rt; 3814 3815 /* first remove it from the radix tree. */ 3816 RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable); 3817 rw_enter(&irb->irb_lock, RW_WRITER); 3818 if (irb->irb_refcnt == 1 && irb->irb_nire == 0) { 3819 rn = ipst->ips_ip_ftable->rnh_deladdr(rn->rn_key, rn->rn_mask, 3820 ipst->ips_ip_ftable); 3821 DTRACE_PROBE1(irb__free, rt_t *, rt); 3822 ASSERT((void *)rn == (void *)rt); 3823 Free(rt, rt_entry_cache); 3824 /* irb_lock is freed */ 3825 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 3826 return (B_TRUE); 3827 } 3828 rw_exit(&irb->irb_lock); 3829 RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); 3830 return (B_FALSE); 3831 } 3832 3833 /* 3834 * Delete the specified IRE. 3835 */ 3836 void 3837 ire_delete(ire_t *ire) 3838 { 3839 ire_t *ire1; 3840 ire_t **ptpn; 3841 irb_t *irb; 3842 ip_stack_t *ipst = ire->ire_ipst; 3843 3844 if ((irb = ire->ire_bucket) == NULL) { 3845 /* 3846 * It was never inserted in the list. Should call REFRELE 3847 * to free this IRE. 3848 */ 3849 IRE_REFRELE_NOTR(ire); 3850 return; 3851 } 3852 3853 rw_enter(&irb->irb_lock, RW_WRITER); 3854 3855 if (irb->irb_rr_origin == ire) { 3856 irb->irb_rr_origin = NULL; 3857 } 3858 3859 /* 3860 * In case of V4 we might still be waiting for fastpath ack. 3861 */ 3862 if (ire->ire_ipversion == IPV4_VERSION && 3863 (ire->ire_type == IRE_CACHE || 3864 (ire->ire_type == IRE_BROADCAST && ire->ire_stq != NULL))) { 3865 ASSERT(ire->ire_nce != NULL); 3866 nce_fastpath_list_delete(ire->ire_nce); 3867 } 3868 3869 if (ire->ire_ptpn == NULL) { 3870 /* 3871 * Some other thread has removed us from the list. 3872 * It should have done the REFRELE for us. 3873 */ 3874 rw_exit(&irb->irb_lock); 3875 return; 3876 } 3877 3878 if (irb->irb_refcnt != 0) { 3879 /* 3880 * The last thread to leave this bucket will 3881 * delete this ire. 3882 */ 3883 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 3884 irb->irb_ire_cnt--; 3885 if (ire->ire_marks & IRE_MARK_TEMPORARY) 3886 irb->irb_tmp_ire_cnt--; 3887 ire->ire_marks |= IRE_MARK_CONDEMNED; 3888 } 3889 irb->irb_marks |= IRB_MARK_CONDEMNED; 3890 rw_exit(&irb->irb_lock); 3891 return; 3892 } 3893 3894 /* 3895 * Normally to delete an ire, we walk the bucket. While we 3896 * walk the bucket, we normally bump up irb_refcnt and hence 3897 * we return from above where we mark CONDEMNED and the ire 3898 * gets deleted from ire_unlink. This case is where somebody 3899 * knows the ire e.g by doing a lookup, and wants to delete the 3900 * IRE. irb_refcnt would be 0 in this case if nobody is walking 3901 * the bucket. 3902 */ 3903 ptpn = ire->ire_ptpn; 3904 ire1 = ire->ire_next; 3905 if (ire1 != NULL) 3906 ire1->ire_ptpn = ptpn; 3907 ASSERT(ptpn != NULL); 3908 *ptpn = ire1; 3909 ire->ire_ptpn = NULL; 3910 ire->ire_next = NULL; 3911 if (ire->ire_ipversion == IPV6_VERSION) { 3912 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_deleted); 3913 } else { 3914 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_deleted); 3915 } 3916 /* 3917 * ip_wput/ip_wput_v6 checks this flag to see whether 3918 * it should still use the cached ire or not. 3919 */ 3920 ire->ire_marks |= IRE_MARK_CONDEMNED; 3921 if (ire->ire_type == IRE_DEFAULT) { 3922 /* 3923 * IRE is out of the list. We need to adjust the 3924 * accounting before we drop the lock. 3925 */ 3926 if (ire->ire_ipversion == IPV6_VERSION) { 3927 ASSERT(ipst->ips_ipv6_ire_default_count != 0); 3928 ipst->ips_ipv6_ire_default_count--; 3929 } 3930 } 3931 irb->irb_ire_cnt--; 3932 3933 if (ire->ire_marks & IRE_MARK_TEMPORARY) 3934 irb->irb_tmp_ire_cnt--; 3935 rw_exit(&irb->irb_lock); 3936 3937 if (ire->ire_ipversion == IPV6_VERSION) { 3938 ire_delete_v6(ire); 3939 } else { 3940 ire_delete_v4(ire); 3941 } 3942 /* 3943 * We removed it from the list. Decrement the 3944 * reference count. 3945 */ 3946 IRE_REFRELE_NOTR(ire); 3947 } 3948 3949 /* 3950 * Delete the specified IRE. 3951 * All calls should use ire_delete(). 3952 * Sometimes called as writer though not required by this function. 3953 * 3954 * NOTE : This function is called only if the ire was added 3955 * in the list. 3956 */ 3957 static void 3958 ire_delete_v4(ire_t *ire) 3959 { 3960 ip_stack_t *ipst = ire->ire_ipst; 3961 3962 ASSERT(ire->ire_refcnt >= 1); 3963 ASSERT(ire->ire_ipversion == IPV4_VERSION); 3964 3965 if (ire->ire_type != IRE_CACHE) 3966 ire_flush_cache_v4(ire, IRE_FLUSH_DELETE); 3967 if (ire->ire_type == IRE_DEFAULT) { 3968 /* 3969 * when a default gateway is going away 3970 * delete all the host redirects pointing at that 3971 * gateway. 3972 */ 3973 ire_delete_host_redirects(ire->ire_gateway_addr, ipst); 3974 } 3975 } 3976 3977 /* 3978 * IRE_REFRELE/ire_refrele are the only caller of the function. It calls 3979 * to free the ire when the reference count goes to zero. 3980 */ 3981 void 3982 ire_inactive(ire_t *ire) 3983 { 3984 nce_t *nce; 3985 ill_t *ill = NULL; 3986 ill_t *stq_ill = NULL; 3987 ill_t *in_ill = NULL; 3988 ipif_t *ipif; 3989 boolean_t need_wakeup = B_FALSE; 3990 irb_t *irb; 3991 ip_stack_t *ipst = ire->ire_ipst; 3992 3993 ASSERT(ire->ire_refcnt == 0); 3994 ASSERT(ire->ire_ptpn == NULL); 3995 ASSERT(ire->ire_next == NULL); 3996 3997 if (ire->ire_gw_secattr != NULL) { 3998 ire_gw_secattr_free(ire->ire_gw_secattr); 3999 ire->ire_gw_secattr = NULL; 4000 } 4001 4002 if (ire->ire_mp != NULL) { 4003 ASSERT(ire->ire_bucket == NULL); 4004 mutex_destroy(&ire->ire_lock); 4005 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_freed); 4006 if (ire->ire_nce != NULL) 4007 NCE_REFRELE_NOTR(ire->ire_nce); 4008 freeb(ire->ire_mp); 4009 return; 4010 } 4011 4012 if ((nce = ire->ire_nce) != NULL) { 4013 NCE_REFRELE_NOTR(nce); 4014 ire->ire_nce = NULL; 4015 } 4016 4017 if (ire->ire_ipif == NULL) 4018 goto end; 4019 4020 ipif = ire->ire_ipif; 4021 ill = ipif->ipif_ill; 4022 4023 if (ire->ire_bucket == NULL) { 4024 /* The ire was never inserted in the table. */ 4025 goto end; 4026 } 4027 4028 /* 4029 * ipif_ire_cnt on this ipif goes down by 1. If the ire_stq is 4030 * non-null ill_ire_count also goes down by 1. If the in_ill is 4031 * non-null either ill_mrtun_refcnt or ill_srcif_refcnt goes down by 1. 4032 * 4033 * The ipif that is associated with an ire is ire->ire_ipif and 4034 * hence when the ire->ire_ipif->ipif_ire_cnt drops to zero we call 4035 * ipif_ill_refrele_tail. Usually stq_ill is null or the same as 4036 * ire->ire_ipif->ipif_ill. So nothing more needs to be done. Only 4037 * in the case of IRE_CACHES when IPMP is used, stq_ill can be 4038 * different. If this is different from ire->ire_ipif->ipif_ill and 4039 * if the ill_ire_cnt on the stq_ill also has dropped to zero, we call 4040 * ipif_ill_refrele_tail on the stq_ill. If mobile ip is in use 4041 * in_ill could be non-null. If it is a reverse tunnel related ire 4042 * ill_mrtun_refcnt is non-zero. If it is forward tunnel related ire 4043 * ill_srcif_refcnt is non-null. 4044 */ 4045 4046 if (ire->ire_stq != NULL) 4047 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 4048 if (ire->ire_in_ill != NULL) 4049 in_ill = ire->ire_in_ill; 4050 4051 if ((stq_ill == NULL || stq_ill == ill) && (in_ill == NULL)) { 4052 /* Optimize the most common case */ 4053 mutex_enter(&ill->ill_lock); 4054 ASSERT(ipif->ipif_ire_cnt != 0); 4055 ipif->ipif_ire_cnt--; 4056 if (ipif->ipif_ire_cnt == 0) 4057 need_wakeup = B_TRUE; 4058 if (stq_ill != NULL) { 4059 ASSERT(stq_ill->ill_ire_cnt != 0); 4060 stq_ill->ill_ire_cnt--; 4061 if (stq_ill->ill_ire_cnt == 0) 4062 need_wakeup = B_TRUE; 4063 } 4064 if (need_wakeup) { 4065 /* Drops the ill lock */ 4066 ipif_ill_refrele_tail(ill); 4067 } else { 4068 mutex_exit(&ill->ill_lock); 4069 } 4070 } else { 4071 /* 4072 * We can't grab all the ill locks at the same time. 4073 * It can lead to recursive lock enter in the call to 4074 * ipif_ill_refrele_tail and later. Instead do it 1 at 4075 * a time. 4076 */ 4077 mutex_enter(&ill->ill_lock); 4078 ASSERT(ipif->ipif_ire_cnt != 0); 4079 ipif->ipif_ire_cnt--; 4080 if (ipif->ipif_ire_cnt == 0) { 4081 /* Drops the lock */ 4082 ipif_ill_refrele_tail(ill); 4083 } else { 4084 mutex_exit(&ill->ill_lock); 4085 } 4086 if (stq_ill != NULL) { 4087 mutex_enter(&stq_ill->ill_lock); 4088 ASSERT(stq_ill->ill_ire_cnt != 0); 4089 stq_ill->ill_ire_cnt--; 4090 if (stq_ill->ill_ire_cnt == 0) { 4091 /* Drops the ill lock */ 4092 ipif_ill_refrele_tail(stq_ill); 4093 } else { 4094 mutex_exit(&stq_ill->ill_lock); 4095 } 4096 } 4097 if (in_ill != NULL) { 4098 mutex_enter(&in_ill->ill_lock); 4099 if (ire->ire_type == IRE_MIPRTUN) { 4100 /* 4101 * Mobile IP reverse tunnel ire. 4102 * Decrement table count and the 4103 * ill reference count. This signifies 4104 * mipagent is deleting reverse tunnel 4105 * route for a particular mobile node. 4106 */ 4107 mutex_enter(&ipst->ips_ire_mrtun_lock); 4108 ipst->ips_ire_mrtun_count--; 4109 mutex_exit(&ipst->ips_ire_mrtun_lock); 4110 ASSERT(in_ill->ill_mrtun_refcnt != 0); 4111 in_ill->ill_mrtun_refcnt--; 4112 if (in_ill->ill_mrtun_refcnt == 0) { 4113 /* Drops the ill lock */ 4114 ipif_ill_refrele_tail(in_ill); 4115 } else { 4116 mutex_exit(&in_ill->ill_lock); 4117 } 4118 } else { 4119 mutex_enter(&ipst->ips_ire_srcif_table_lock); 4120 ipst->ips_ire_srcif_table_count--; 4121 mutex_exit(&ipst->ips_ire_srcif_table_lock); 4122 ASSERT(in_ill->ill_srcif_refcnt != 0); 4123 in_ill->ill_srcif_refcnt--; 4124 if (in_ill->ill_srcif_refcnt == 0) { 4125 /* Drops the ill lock */ 4126 ipif_ill_refrele_tail(in_ill); 4127 } else { 4128 mutex_exit(&in_ill->ill_lock); 4129 } 4130 } 4131 } 4132 } 4133 end: 4134 /* This should be true for both V4 and V6 */ 4135 4136 if ((ire->ire_type & IRE_FORWARDTABLE) && 4137 (ire->ire_ipversion == IPV4_VERSION) && 4138 ((irb = ire->ire_bucket) != NULL)) { 4139 rw_enter(&irb->irb_lock, RW_WRITER); 4140 irb->irb_nire--; 4141 /* 4142 * Instead of examining the conditions for freeing 4143 * the radix node here, we do it by calling 4144 * IRB_REFRELE which is a single point in the code 4145 * that embeds that logic. Bump up the refcnt to 4146 * be able to call IRB_REFRELE 4147 */ 4148 IRB_REFHOLD_LOCKED(irb); 4149 rw_exit(&irb->irb_lock); 4150 IRB_REFRELE(irb); 4151 } 4152 ire->ire_ipif = NULL; 4153 4154 if (ire->ire_in_ill != NULL) { 4155 ire->ire_in_ill = NULL; 4156 } 4157 4158 #ifdef IRE_DEBUG 4159 ire_trace_inactive(ire); 4160 #endif 4161 mutex_destroy(&ire->ire_lock); 4162 if (ire->ire_ipversion == IPV6_VERSION) { 4163 BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_freed); 4164 } else { 4165 BUMP_IRE_STATS(ipst->ips_ire_stats_v4, ire_stats_freed); 4166 } 4167 ASSERT(ire->ire_mp == NULL); 4168 /* Has been allocated out of the cache */ 4169 kmem_cache_free(ire_cache, ire); 4170 } 4171 4172 /* 4173 * ire_walk routine to delete all IRE_CACHE/IRE_HOST types redirect 4174 * entries that have a given gateway address. 4175 */ 4176 void 4177 ire_delete_cache_gw(ire_t *ire, char *cp) 4178 { 4179 ipaddr_t gw_addr; 4180 4181 if (!(ire->ire_type & IRE_CACHE) && 4182 !(ire->ire_flags & RTF_DYNAMIC)) 4183 return; 4184 4185 bcopy(cp, &gw_addr, sizeof (gw_addr)); 4186 if (ire->ire_gateway_addr == gw_addr) { 4187 ip1dbg(("ire_delete_cache_gw: deleted 0x%x type %d to 0x%x\n", 4188 (int)ntohl(ire->ire_addr), ire->ire_type, 4189 (int)ntohl(ire->ire_gateway_addr))); 4190 ire_delete(ire); 4191 } 4192 } 4193 4194 /* 4195 * Remove all IRE_CACHE entries that match the ire specified. 4196 * 4197 * The flag argument indicates if the flush request is due to addition 4198 * of new route (IRE_FLUSH_ADD) or deletion of old route (IRE_FLUSH_DELETE). 4199 * 4200 * This routine takes only the IREs from the forwarding table and flushes 4201 * the corresponding entries from the cache table. 4202 * 4203 * When flushing due to the deletion of an old route, it 4204 * just checks the cache handles (ire_phandle and ire_ihandle) and 4205 * deletes the ones that match. 4206 * 4207 * When flushing due to the creation of a new route, it checks 4208 * if a cache entry's address matches the one in the IRE and 4209 * that the cache entry's parent has a less specific mask than the 4210 * one in IRE. The destination of such a cache entry could be the 4211 * gateway for other cache entries, so we need to flush those as 4212 * well by looking for gateway addresses matching the IRE's address. 4213 */ 4214 void 4215 ire_flush_cache_v4(ire_t *ire, int flag) 4216 { 4217 int i; 4218 ire_t *cire; 4219 irb_t *irb; 4220 ip_stack_t *ipst = ire->ire_ipst; 4221 4222 if (ire->ire_type & IRE_CACHE) 4223 return; 4224 4225 /* 4226 * If a default is just created, there is no point 4227 * in going through the cache, as there will not be any 4228 * cached ires. 4229 */ 4230 if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD) 4231 return; 4232 if (flag == IRE_FLUSH_ADD) { 4233 /* 4234 * This selective flush is due to the addition of 4235 * new IRE. 4236 */ 4237 for (i = 0; i < ipst->ips_ip_cache_table_size; i++) { 4238 irb = &ipst->ips_ip_cache_table[i]; 4239 if ((cire = irb->irb_ire) == NULL) 4240 continue; 4241 IRB_REFHOLD(irb); 4242 for (cire = irb->irb_ire; cire != NULL; 4243 cire = cire->ire_next) { 4244 if (cire->ire_type != IRE_CACHE) 4245 continue; 4246 /* 4247 * If 'cire' belongs to the same subnet 4248 * as the new ire being added, and 'cire' 4249 * is derived from a prefix that is less 4250 * specific than the new ire being added, 4251 * we need to flush 'cire'; for instance, 4252 * when a new interface comes up. 4253 */ 4254 if (((cire->ire_addr & ire->ire_mask) == 4255 (ire->ire_addr & ire->ire_mask)) && 4256 (ip_mask_to_plen(cire->ire_cmask) <= 4257 ire->ire_masklen)) { 4258 ire_delete(cire); 4259 continue; 4260 } 4261 /* 4262 * This is the case when the ire_gateway_addr 4263 * of 'cire' belongs to the same subnet as 4264 * the new ire being added. 4265 * Flushing such ires is sometimes required to 4266 * avoid misrouting: say we have a machine with 4267 * two interfaces (I1 and I2), a default router 4268 * R on the I1 subnet, and a host route to an 4269 * off-link destination D with a gateway G on 4270 * the I2 subnet. 4271 * Under normal operation, we will have an 4272 * on-link cache entry for G and an off-link 4273 * cache entry for D with G as ire_gateway_addr, 4274 * traffic to D will reach its destination 4275 * through gateway G. 4276 * If the administrator does 'ifconfig I2 down', 4277 * the cache entries for D and G will be 4278 * flushed. However, G will now be resolved as 4279 * an off-link destination using R (the default 4280 * router) as gateway. Then D will also be 4281 * resolved as an off-link destination using G 4282 * as gateway - this behavior is due to 4283 * compatibility reasons, see comment in 4284 * ire_ihandle_lookup_offlink(). Traffic to D 4285 * will go to the router R and probably won't 4286 * reach the destination. 4287 * The administrator then does 'ifconfig I2 up'. 4288 * Since G is on the I2 subnet, this routine 4289 * will flush its cache entry. It must also 4290 * flush the cache entry for D, otherwise 4291 * traffic will stay misrouted until the IRE 4292 * times out. 4293 */ 4294 if ((cire->ire_gateway_addr & ire->ire_mask) == 4295 (ire->ire_addr & ire->ire_mask)) { 4296 ire_delete(cire); 4297 continue; 4298 } 4299 } 4300 IRB_REFRELE(irb); 4301 } 4302 } else { 4303 /* 4304 * delete the cache entries based on 4305 * handle in the IRE as this IRE is 4306 * being deleted/changed. 4307 */ 4308 for (i = 0; i < ipst->ips_ip_cache_table_size; i++) { 4309 irb = &ipst->ips_ip_cache_table[i]; 4310 if ((cire = irb->irb_ire) == NULL) 4311 continue; 4312 IRB_REFHOLD(irb); 4313 for (cire = irb->irb_ire; cire != NULL; 4314 cire = cire->ire_next) { 4315 if (cire->ire_type != IRE_CACHE) 4316 continue; 4317 if ((cire->ire_phandle == 0 || 4318 cire->ire_phandle != ire->ire_phandle) && 4319 (cire->ire_ihandle == 0 || 4320 cire->ire_ihandle != ire->ire_ihandle)) 4321 continue; 4322 ire_delete(cire); 4323 } 4324 IRB_REFRELE(irb); 4325 } 4326 } 4327 } 4328 4329 /* 4330 * Matches the arguments passed with the values in the ire. 4331 * 4332 * Note: for match types that match using "ipif" passed in, ipif 4333 * must be checked for non-NULL before calling this routine. 4334 */ 4335 boolean_t 4336 ire_match_args(ire_t *ire, ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 4337 int type, const ipif_t *ipif, zoneid_t zoneid, uint32_t ihandle, 4338 const ts_label_t *tsl, int match_flags) 4339 { 4340 ill_t *ire_ill = NULL, *dst_ill; 4341 ill_t *ipif_ill = NULL; 4342 ill_group_t *ire_ill_group = NULL; 4343 ill_group_t *ipif_ill_group = NULL; 4344 4345 ASSERT(ire->ire_ipversion == IPV4_VERSION); 4346 ASSERT((ire->ire_addr & ~ire->ire_mask) == 0); 4347 ASSERT((!(match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP))) || 4348 (ipif != NULL && !ipif->ipif_isv6)); 4349 ASSERT(!(match_flags & MATCH_IRE_WQ)); 4350 4351 /* 4352 * HIDDEN cache entries have to be looked up specifically with 4353 * MATCH_IRE_MARK_HIDDEN. MATCH_IRE_MARK_HIDDEN is usually set 4354 * when the interface is FAILED or INACTIVE. In that case, 4355 * any IRE_CACHES that exists should be marked with 4356 * IRE_MARK_HIDDEN. So, we don't really need to match below 4357 * for IRE_MARK_HIDDEN. But we do so for consistency. 4358 */ 4359 if (!(match_flags & MATCH_IRE_MARK_HIDDEN) && 4360 (ire->ire_marks & IRE_MARK_HIDDEN)) 4361 return (B_FALSE); 4362 4363 /* 4364 * MATCH_IRE_MARK_PRIVATE_ADDR is set when IP_NEXTHOP option 4365 * is used. In that case the routing table is bypassed and the 4366 * packets are sent directly to the specified nexthop. The 4367 * IRE_CACHE entry representing this route should be marked 4368 * with IRE_MARK_PRIVATE_ADDR. 4369 */ 4370 4371 if (!(match_flags & MATCH_IRE_MARK_PRIVATE_ADDR) && 4372 (ire->ire_marks & IRE_MARK_PRIVATE_ADDR)) 4373 return (B_FALSE); 4374 4375 if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid && 4376 ire->ire_zoneid != ALL_ZONES) { 4377 /* 4378 * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid is 4379 * valid and does not match that of ire_zoneid, a failure to 4380 * match is reported at this point. Otherwise, since some IREs 4381 * that are available in the global zone can be used in local 4382 * zones, additional checks need to be performed: 4383 * 4384 * IRE_BROADCAST, IRE_CACHE and IRE_LOOPBACK 4385 * entries should never be matched in this situation. 4386 * 4387 * IRE entries that have an interface associated with them 4388 * should in general not match unless they are an IRE_LOCAL 4389 * or in the case when MATCH_IRE_DEFAULT has been set in 4390 * the caller. In the case of the former, checking of the 4391 * other fields supplied should take place. 4392 * 4393 * In the case where MATCH_IRE_DEFAULT has been set, 4394 * all of the ipif's associated with the IRE's ill are 4395 * checked to see if there is a matching zoneid. If any 4396 * one ipif has a matching zoneid, this IRE is a 4397 * potential candidate so checking of the other fields 4398 * takes place. 4399 * 4400 * In the case where the IRE_INTERFACE has a usable source 4401 * address (indicated by ill_usesrc_ifindex) in the 4402 * correct zone then it's permitted to return this IRE 4403 */ 4404 if (match_flags & MATCH_IRE_ZONEONLY) 4405 return (B_FALSE); 4406 if (ire->ire_type & (IRE_BROADCAST | IRE_CACHE | IRE_LOOPBACK)) 4407 return (B_FALSE); 4408 /* 4409 * Note, IRE_INTERFACE can have the stq as NULL. For 4410 * example, if the default multicast route is tied to 4411 * the loopback address. 4412 */ 4413 if ((ire->ire_type & IRE_INTERFACE) && 4414 (ire->ire_stq != NULL)) { 4415 dst_ill = (ill_t *)ire->ire_stq->q_ptr; 4416 /* 4417 * If there is a usable source address in the 4418 * zone, then it's ok to return an 4419 * IRE_INTERFACE 4420 */ 4421 if (ipif_usesrc_avail(dst_ill, zoneid)) { 4422 ip3dbg(("ire_match_args: dst_ill %p match %d\n", 4423 (void *)dst_ill, 4424 (ire->ire_addr == (addr & mask)))); 4425 } else { 4426 ip3dbg(("ire_match_args: src_ipif NULL" 4427 " dst_ill %p\n", (void *)dst_ill)); 4428 return (B_FALSE); 4429 } 4430 } 4431 if (ire->ire_ipif != NULL && ire->ire_type != IRE_LOCAL && 4432 !(ire->ire_type & IRE_INTERFACE)) { 4433 ipif_t *tipif; 4434 4435 if ((match_flags & MATCH_IRE_DEFAULT) == 0) { 4436 return (B_FALSE); 4437 } 4438 mutex_enter(&ire->ire_ipif->ipif_ill->ill_lock); 4439 for (tipif = ire->ire_ipif->ipif_ill->ill_ipif; 4440 tipif != NULL; tipif = tipif->ipif_next) { 4441 if (IPIF_CAN_LOOKUP(tipif) && 4442 (tipif->ipif_flags & IPIF_UP) && 4443 (tipif->ipif_zoneid == zoneid || 4444 tipif->ipif_zoneid == ALL_ZONES)) 4445 break; 4446 } 4447 mutex_exit(&ire->ire_ipif->ipif_ill->ill_lock); 4448 if (tipif == NULL) { 4449 return (B_FALSE); 4450 } 4451 } 4452 } 4453 4454 /* 4455 * For IRE_CACHES, MATCH_IRE_ILL/ILL_GROUP really means that 4456 * somebody wants to send out on a particular interface which 4457 * is given by ire_stq and hence use ire_stq to derive the ill 4458 * value. ire_ipif for IRE_CACHES is just the means of getting 4459 * a source address i.e ire_src_addr = ire->ire_ipif->ipif_src_addr. 4460 * ire_to_ill does the right thing for this. 4461 */ 4462 if (match_flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) { 4463 ire_ill = ire_to_ill(ire); 4464 if (ire_ill != NULL) 4465 ire_ill_group = ire_ill->ill_group; 4466 ipif_ill = ipif->ipif_ill; 4467 ipif_ill_group = ipif_ill->ill_group; 4468 } 4469 4470 if ((ire->ire_addr == (addr & mask)) && 4471 ((!(match_flags & MATCH_IRE_GW)) || 4472 (ire->ire_gateway_addr == gateway)) && 4473 ((!(match_flags & MATCH_IRE_TYPE)) || 4474 (ire->ire_type & type)) && 4475 ((!(match_flags & MATCH_IRE_SRC)) || 4476 (ire->ire_src_addr == ipif->ipif_src_addr)) && 4477 ((!(match_flags & MATCH_IRE_IPIF)) || 4478 (ire->ire_ipif == ipif)) && 4479 ((!(match_flags & MATCH_IRE_MARK_HIDDEN)) || 4480 (ire->ire_type != IRE_CACHE || 4481 ire->ire_marks & IRE_MARK_HIDDEN)) && 4482 ((!(match_flags & MATCH_IRE_MARK_PRIVATE_ADDR)) || 4483 (ire->ire_type != IRE_CACHE || 4484 ire->ire_marks & IRE_MARK_PRIVATE_ADDR)) && 4485 ((!(match_flags & MATCH_IRE_ILL)) || 4486 (ire_ill == ipif_ill)) && 4487 ((!(match_flags & MATCH_IRE_IHANDLE)) || 4488 (ire->ire_ihandle == ihandle)) && 4489 ((!(match_flags & MATCH_IRE_MASK)) || 4490 (ire->ire_mask == mask)) && 4491 ((!(match_flags & MATCH_IRE_ILL_GROUP)) || 4492 (ire_ill == ipif_ill) || 4493 (ire_ill_group != NULL && 4494 ire_ill_group == ipif_ill_group)) && 4495 ((!(match_flags & MATCH_IRE_SECATTR)) || 4496 (!is_system_labeled()) || 4497 (tsol_ire_match_gwattr(ire, tsl) == 0))) { 4498 /* We found the matched IRE */ 4499 return (B_TRUE); 4500 } 4501 return (B_FALSE); 4502 } 4503 4504 4505 /* 4506 * Lookup for a route in all the tables 4507 */ 4508 ire_t * 4509 ire_route_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, 4510 int type, const ipif_t *ipif, ire_t **pire, zoneid_t zoneid, 4511 const ts_label_t *tsl, int flags, ip_stack_t *ipst) 4512 { 4513 ire_t *ire = NULL; 4514 4515 /* 4516 * ire_match_args() will dereference ipif MATCH_IRE_SRC or 4517 * MATCH_IRE_ILL is set. 4518 */ 4519 if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) && 4520 (ipif == NULL)) 4521 return (NULL); 4522 4523 /* 4524 * might be asking for a cache lookup, 4525 * This is not best way to lookup cache, 4526 * user should call ire_cache_lookup directly. 4527 * 4528 * If MATCH_IRE_TYPE was set, first lookup in the cache table and then 4529 * in the forwarding table, if the applicable type flags were set. 4530 */ 4531 if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_CACHETABLE) != 0) { 4532 ire = ire_ctable_lookup(addr, gateway, type, ipif, zoneid, 4533 tsl, flags, ipst); 4534 if (ire != NULL) 4535 return (ire); 4536 } 4537 if ((flags & MATCH_IRE_TYPE) == 0 || (type & IRE_FORWARDTABLE) != 0) { 4538 ire = ire_ftable_lookup(addr, mask, gateway, type, ipif, pire, 4539 zoneid, 0, tsl, flags, ipst); 4540 } 4541 return (ire); 4542 } 4543 4544 4545 /* 4546 * Delete the IRE cache for the gateway and all IRE caches whose 4547 * ire_gateway_addr points to this gateway, and allow them to 4548 * be created on demand by ip_newroute. 4549 */ 4550 void 4551 ire_clookup_delete_cache_gw(ipaddr_t addr, zoneid_t zoneid, ip_stack_t *ipst) 4552 { 4553 irb_t *irb; 4554 ire_t *ire; 4555 4556 irb = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(addr, 4557 ipst->ips_ip_cache_table_size)]; 4558 IRB_REFHOLD(irb); 4559 for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { 4560 if (ire->ire_marks & IRE_MARK_CONDEMNED) 4561 continue; 4562 4563 ASSERT(ire->ire_mask == IP_HOST_MASK); 4564 ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL); 4565 if (ire_match_args(ire, addr, ire->ire_mask, 0, IRE_CACHE, 4566 NULL, zoneid, 0, NULL, MATCH_IRE_TYPE)) { 4567 ire_delete(ire); 4568 } 4569 } 4570 IRB_REFRELE(irb); 4571 4572 ire_walk_v4(ire_delete_cache_gw, &addr, zoneid, ipst); 4573 } 4574 4575 /* 4576 * Looks up cache table for a route. 4577 * specific lookup can be indicated by 4578 * passing the MATCH_* flags and the 4579 * necessary parameters. 4580 */ 4581 ire_t * 4582 ire_ctable_lookup(ipaddr_t addr, ipaddr_t gateway, int type, const ipif_t *ipif, 4583 zoneid_t zoneid, const ts_label_t *tsl, int flags, ip_stack_t *ipst) 4584 { 4585 irb_t *irb_ptr; 4586 ire_t *ire; 4587 4588 /* 4589 * ire_match_args() will dereference ipif MATCH_IRE_SRC or 4590 * MATCH_IRE_ILL is set. 4591 */ 4592 if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL | MATCH_IRE_ILL_GROUP)) && 4593 (ipif == NULL)) 4594 return (NULL); 4595 4596 irb_ptr = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(addr, 4597 ipst->ips_ip_cache_table_size)]; 4598 rw_enter(&irb_ptr->irb_lock, RW_READER); 4599 for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 4600 if (ire->ire_marks & IRE_MARK_CONDEMNED) 4601 continue; 4602 ASSERT(ire->ire_mask == IP_HOST_MASK); 4603 ASSERT(ire->ire_type != IRE_MIPRTUN && ire->ire_in_ill == NULL); 4604 if (ire_match_args(ire, addr, ire->ire_mask, gateway, type, 4605 ipif, zoneid, 0, tsl, flags)) { 4606 IRE_REFHOLD(ire); 4607 rw_exit(&irb_ptr->irb_lock); 4608 return (ire); 4609 } 4610 } 4611 rw_exit(&irb_ptr->irb_lock); 4612 return (NULL); 4613 } 4614 4615 /* 4616 * Check whether the IRE_LOCAL and the IRE potentially used to transmit 4617 * (could be an IRE_CACHE, IRE_BROADCAST, or IRE_INTERFACE) are part of 4618 * the same ill group. 4619 */ 4620 boolean_t 4621 ire_local_same_ill_group(ire_t *ire_local, ire_t *xmit_ire) 4622 { 4623 ill_t *recv_ill, *xmit_ill; 4624 ill_group_t *recv_group, *xmit_group; 4625 4626 ASSERT(ire_local->ire_type & (IRE_LOCAL|IRE_LOOPBACK)); 4627 ASSERT(xmit_ire->ire_type & (IRE_CACHETABLE|IRE_INTERFACE)); 4628 4629 recv_ill = ire_to_ill(ire_local); 4630 xmit_ill = ire_to_ill(xmit_ire); 4631 4632 ASSERT(recv_ill != NULL); 4633 ASSERT(xmit_ill != NULL); 4634 4635 if (recv_ill == xmit_ill) 4636 return (B_TRUE); 4637 4638 recv_group = recv_ill->ill_group; 4639 xmit_group = xmit_ill->ill_group; 4640 4641 if (recv_group != NULL && recv_group == xmit_group) 4642 return (B_TRUE); 4643 4644 return (B_FALSE); 4645 } 4646 4647 /* 4648 * Check if the IRE_LOCAL uses the same ill (group) as another route would use. 4649 * If there is no alternate route, or the alternate is a REJECT or BLACKHOLE, 4650 * then we don't allow this IRE_LOCAL to be used. 4651 */ 4652 boolean_t 4653 ire_local_ok_across_zones(ire_t *ire_local, zoneid_t zoneid, void *addr, 4654 const ts_label_t *tsl, ip_stack_t *ipst) 4655 { 4656 ire_t *alt_ire; 4657 boolean_t rval; 4658 4659 if (ire_local->ire_ipversion == IPV4_VERSION) { 4660 alt_ire = ire_ftable_lookup(*((ipaddr_t *)addr), 0, 0, 0, NULL, 4661 NULL, zoneid, 0, tsl, 4662 MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | 4663 MATCH_IRE_RJ_BHOLE, ipst); 4664 } else { 4665 alt_ire = ire_ftable_lookup_v6((in6_addr_t *)addr, NULL, NULL, 4666 0, NULL, NULL, zoneid, 0, tsl, 4667 MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | 4668 MATCH_IRE_RJ_BHOLE, ipst); 4669 } 4670 4671 if (alt_ire == NULL) 4672 return (B_FALSE); 4673 4674 if (alt_ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { 4675 ire_refrele(alt_ire); 4676 return (B_FALSE); 4677 } 4678 rval = ire_local_same_ill_group(ire_local, alt_ire); 4679 4680 ire_refrele(alt_ire); 4681 return (rval); 4682 } 4683 4684 /* 4685 * Lookup cache. Don't return IRE_MARK_HIDDEN entries. Callers 4686 * should use ire_ctable_lookup with MATCH_IRE_MARK_HIDDEN to get 4687 * to the hidden ones. 4688 * 4689 * In general the zoneid has to match (where ALL_ZONES match all of them). 4690 * But for IRE_LOCAL we also need to handle the case where L2 should 4691 * conceptually loop back the packet. This is necessary since neither 4692 * Ethernet drivers nor Ethernet hardware loops back packets sent to their 4693 * own MAC address. This loopback is needed when the normal 4694 * routes (ignoring IREs with different zoneids) would send out the packet on 4695 * the same ill (or ill group) as the ill with which this IRE_LOCAL is 4696 * associated. 4697 * 4698 * Earlier versions of this code always matched an IRE_LOCAL independently of 4699 * the zoneid. We preserve that earlier behavior when 4700 * ip_restrict_interzone_loopback is turned off. 4701 */ 4702 ire_t * 4703 ire_cache_lookup(ipaddr_t addr, zoneid_t zoneid, const ts_label_t *tsl, 4704 ip_stack_t *ipst) 4705 { 4706 irb_t *irb_ptr; 4707 ire_t *ire; 4708 4709 irb_ptr = &ipst->ips_ip_cache_table[IRE_ADDR_HASH(addr, 4710 ipst->ips_ip_cache_table_size)]; 4711 rw_enter(&irb_ptr->irb_lock, RW_READER); 4712 for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 4713 if (ire->ire_marks & (IRE_MARK_CONDEMNED | 4714 IRE_MARK_HIDDEN | IRE_MARK_PRIVATE_ADDR)) { 4715 continue; 4716 } 4717 if (ire->ire_addr == addr) { 4718 /* 4719 * Finally, check if the security policy has any 4720 * restriction on using this route for the specified 4721 * message. 4722 */ 4723 if (tsl != NULL && 4724 ire->ire_gw_secattr != NULL && 4725 tsol_ire_match_gwattr(ire, tsl) != 0) { 4726 continue; 4727 } 4728 4729 if (zoneid == ALL_ZONES || ire->ire_zoneid == zoneid || 4730 ire->ire_zoneid == ALL_ZONES) { 4731 IRE_REFHOLD(ire); 4732 rw_exit(&irb_ptr->irb_lock); 4733 return (ire); 4734 } 4735 4736 if (ire->ire_type == IRE_LOCAL) { 4737 if (ipst->ips_ip_restrict_interzone_loopback && 4738 !ire_local_ok_across_zones(ire, zoneid, 4739 &addr, tsl, ipst)) 4740 continue; 4741 4742 IRE_REFHOLD(ire); 4743 rw_exit(&irb_ptr->irb_lock); 4744 return (ire); 4745 } 4746 } 4747 } 4748 rw_exit(&irb_ptr->irb_lock); 4749 return (NULL); 4750 } 4751 4752 /* 4753 * Locate the interface ire that is tied to the cache ire 'cire' via 4754 * cire->ire_ihandle. 4755 * 4756 * We are trying to create the cache ire for an offlink destn based 4757 * on the cache ire of the gateway in 'cire'. 'pire' is the prefix ire 4758 * as found by ip_newroute(). We are called from ip_newroute() in 4759 * the IRE_CACHE case. 4760 */ 4761 ire_t * 4762 ire_ihandle_lookup_offlink(ire_t *cire, ire_t *pire) 4763 { 4764 ire_t *ire; 4765 int match_flags; 4766 ipaddr_t gw_addr; 4767 ipif_t *gw_ipif; 4768 ip_stack_t *ipst = cire->ire_ipst; 4769 4770 ASSERT(cire != NULL && pire != NULL); 4771 4772 /* 4773 * We don't need to specify the zoneid to ire_ftable_lookup() below 4774 * because the ihandle refers to an ipif which can be in only one zone. 4775 */ 4776 match_flags = MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK; 4777 /* 4778 * ip_newroute calls ire_ftable_lookup with MATCH_IRE_ILL only 4779 * for on-link hosts. We should never be here for onlink. 4780 * Thus, use MATCH_IRE_ILL_GROUP. 4781 */ 4782 if (pire->ire_ipif != NULL) 4783 match_flags |= MATCH_IRE_ILL_GROUP; 4784 /* 4785 * We know that the mask of the interface ire equals cire->ire_cmask. 4786 * (When ip_newroute() created 'cire' for the gateway it set its 4787 * cmask from the interface ire's mask) 4788 */ 4789 ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0, 4790 IRE_INTERFACE, pire->ire_ipif, NULL, ALL_ZONES, cire->ire_ihandle, 4791 NULL, match_flags, ipst); 4792 if (ire != NULL) 4793 return (ire); 4794 /* 4795 * If we didn't find an interface ire above, we can't declare failure. 4796 * For backwards compatibility, we need to support prefix routes 4797 * pointing to next hop gateways that are not on-link. 4798 * 4799 * Assume we are trying to ping some offlink destn, and we have the 4800 * routing table below. 4801 * 4802 * Eg. default - gw1 <--- pire (line 1) 4803 * gw1 - gw2 (line 2) 4804 * gw2 - hme0 (line 3) 4805 * 4806 * If we already have a cache ire for gw1 in 'cire', the 4807 * ire_ftable_lookup above would have failed, since there is no 4808 * interface ire to reach gw1. We will fallthru below. 4809 * 4810 * Here we duplicate the steps that ire_ftable_lookup() did in 4811 * getting 'cire' from 'pire', in the MATCH_IRE_RECURSIVE case. 4812 * The differences are the following 4813 * i. We want the interface ire only, so we call ire_ftable_lookup() 4814 * instead of ire_route_lookup() 4815 * ii. We look for only prefix routes in the 1st call below. 4816 * ii. We want to match on the ihandle in the 2nd call below. 4817 */ 4818 match_flags = MATCH_IRE_TYPE; 4819 if (pire->ire_ipif != NULL) 4820 match_flags |= MATCH_IRE_ILL_GROUP; 4821 ire = ire_ftable_lookup(pire->ire_gateway_addr, 0, 0, IRE_OFFSUBNET, 4822 pire->ire_ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 4823 if (ire == NULL) 4824 return (NULL); 4825 /* 4826 * At this point 'ire' corresponds to the entry shown in line 2. 4827 * gw_addr is 'gw2' in the example above. 4828 */ 4829 gw_addr = ire->ire_gateway_addr; 4830 gw_ipif = ire->ire_ipif; 4831 ire_refrele(ire); 4832 4833 match_flags |= MATCH_IRE_IHANDLE; 4834 ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, 4835 gw_ipif, NULL, ALL_ZONES, cire->ire_ihandle, NULL, match_flags, 4836 ipst); 4837 return (ire); 4838 } 4839 4840 /* 4841 * ire_mrtun_lookup() is called by ip_rput() when packet is to be 4842 * tunneled through reverse tunnel. This is only supported for 4843 * IPv4 packets 4844 */ 4845 4846 ire_t * 4847 ire_mrtun_lookup(ipaddr_t srcaddr, ill_t *ill) 4848 { 4849 irb_t *irb_ptr; 4850 ire_t *ire; 4851 ip_stack_t *ipst = ill->ill_ipst; 4852 4853 ASSERT(ill != NULL); 4854 ASSERT(!(ill->ill_isv6)); 4855 4856 if (ipst->ips_ip_mrtun_table == NULL) 4857 return (NULL); 4858 irb_ptr = &ipst->ips_ip_mrtun_table[IRE_ADDR_HASH(srcaddr, 4859 IP_MRTUN_TABLE_SIZE)]; 4860 rw_enter(&irb_ptr->irb_lock, RW_READER); 4861 for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 4862 if (ire->ire_marks & IRE_MARK_CONDEMNED) 4863 continue; 4864 if ((ire->ire_in_src_addr == srcaddr) && 4865 ire->ire_in_ill == ill) { 4866 IRE_REFHOLD(ire); 4867 rw_exit(&irb_ptr->irb_lock); 4868 return (ire); 4869 } 4870 } 4871 rw_exit(&irb_ptr->irb_lock); 4872 return (NULL); 4873 } 4874 4875 /* 4876 * Return the IRE_LOOPBACK, IRE_IF_RESOLVER or IRE_IF_NORESOLVER 4877 * ire associated with the specified ipif. 4878 * 4879 * This might occasionally be called when IPIF_UP is not set since 4880 * the IP_MULTICAST_IF as well as creating interface routes 4881 * allows specifying a down ipif (ipif_lookup* match ipifs that are down). 4882 * 4883 * Note that if IPIF_NOLOCAL, IPIF_NOXMIT, or IPIF_DEPRECATED is set on 4884 * the ipif, this routine might return NULL. 4885 */ 4886 ire_t * 4887 ipif_to_ire(const ipif_t *ipif) 4888 { 4889 ire_t *ire; 4890 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 4891 4892 ASSERT(!ipif->ipif_isv6); 4893 if (ipif->ipif_ire_type == IRE_LOOPBACK) { 4894 ire = ire_ctable_lookup(ipif->ipif_lcl_addr, 0, IRE_LOOPBACK, 4895 ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF), 4896 ipst); 4897 } else if (ipif->ipif_flags & IPIF_POINTOPOINT) { 4898 /* In this case we need to lookup destination address. */ 4899 ire = ire_ftable_lookup(ipif->ipif_pp_dst_addr, IP_HOST_MASK, 0, 4900 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL, 4901 (MATCH_IRE_TYPE | MATCH_IRE_IPIF | MATCH_IRE_MASK), ipst); 4902 } else { 4903 ire = ire_ftable_lookup(ipif->ipif_subnet, 4904 ipif->ipif_net_mask, 0, IRE_INTERFACE, ipif, NULL, 4905 ALL_ZONES, 0, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF | 4906 MATCH_IRE_MASK), ipst); 4907 } 4908 return (ire); 4909 } 4910 4911 /* 4912 * ire_walk function. 4913 * Count the number of IRE_CACHE entries in different categories. 4914 */ 4915 void 4916 ire_cache_count(ire_t *ire, char *arg) 4917 { 4918 ire_cache_count_t *icc = (ire_cache_count_t *)arg; 4919 4920 if (ire->ire_type != IRE_CACHE) 4921 return; 4922 4923 icc->icc_total++; 4924 4925 if (ire->ire_ipversion == IPV6_VERSION) { 4926 mutex_enter(&ire->ire_lock); 4927 if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) { 4928 mutex_exit(&ire->ire_lock); 4929 icc->icc_onlink++; 4930 return; 4931 } 4932 mutex_exit(&ire->ire_lock); 4933 } else { 4934 if (ire->ire_gateway_addr == 0) { 4935 icc->icc_onlink++; 4936 return; 4937 } 4938 } 4939 4940 ASSERT(ire->ire_ipif != NULL); 4941 if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu) 4942 icc->icc_pmtu++; 4943 else if (ire->ire_tire_mark != ire->ire_ob_pkt_count + 4944 ire->ire_ib_pkt_count) 4945 icc->icc_offlink++; 4946 else 4947 icc->icc_unused++; 4948 } 4949 4950 /* 4951 * ire_walk function called by ip_trash_ire_reclaim(). 4952 * Free a fraction of the IRE_CACHE cache entries. The fractions are 4953 * different for different categories of IRE_CACHE entries. 4954 * A fraction of zero means to not free any in that category. 4955 * Use the hash bucket id plus lbolt as a random number. Thus if the fraction 4956 * is N then every Nth hash bucket chain will be freed. 4957 */ 4958 void 4959 ire_cache_reclaim(ire_t *ire, char *arg) 4960 { 4961 ire_cache_reclaim_t *icr = (ire_cache_reclaim_t *)arg; 4962 uint_t rand; 4963 ip_stack_t *ipst = icr->icr_ipst; 4964 4965 if (ire->ire_type != IRE_CACHE) 4966 return; 4967 4968 if (ire->ire_ipversion == IPV6_VERSION) { 4969 rand = (uint_t)lbolt + 4970 IRE_ADDR_HASH_V6(ire->ire_addr_v6, 4971 ipst->ips_ip6_cache_table_size); 4972 mutex_enter(&ire->ire_lock); 4973 if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6)) { 4974 mutex_exit(&ire->ire_lock); 4975 if (icr->icr_onlink != 0 && 4976 (rand/icr->icr_onlink)*icr->icr_onlink == rand) { 4977 ire_delete(ire); 4978 return; 4979 } 4980 goto done; 4981 } 4982 mutex_exit(&ire->ire_lock); 4983 } else { 4984 rand = (uint_t)lbolt + 4985 IRE_ADDR_HASH(ire->ire_addr, ipst->ips_ip_cache_table_size); 4986 if (ire->ire_gateway_addr == 0) { 4987 if (icr->icr_onlink != 0 && 4988 (rand/icr->icr_onlink)*icr->icr_onlink == rand) { 4989 ire_delete(ire); 4990 return; 4991 } 4992 goto done; 4993 } 4994 } 4995 /* Not onlink IRE */ 4996 ASSERT(ire->ire_ipif != NULL); 4997 if (ire->ire_max_frag < ire->ire_ipif->ipif_mtu) { 4998 /* Use ptmu fraction */ 4999 if (icr->icr_pmtu != 0 && 5000 (rand/icr->icr_pmtu)*icr->icr_pmtu == rand) { 5001 ire_delete(ire); 5002 return; 5003 } 5004 } else if (ire->ire_tire_mark != ire->ire_ob_pkt_count + 5005 ire->ire_ib_pkt_count) { 5006 /* Use offlink fraction */ 5007 if (icr->icr_offlink != 0 && 5008 (rand/icr->icr_offlink)*icr->icr_offlink == rand) { 5009 ire_delete(ire); 5010 return; 5011 } 5012 } else { 5013 /* Use unused fraction */ 5014 if (icr->icr_unused != 0 && 5015 (rand/icr->icr_unused)*icr->icr_unused == rand) { 5016 ire_delete(ire); 5017 return; 5018 } 5019 } 5020 done: 5021 /* 5022 * Update tire_mark so that those that haven't been used since this 5023 * reclaim will be considered unused next time we reclaim. 5024 */ 5025 ire->ire_tire_mark = ire->ire_ob_pkt_count + ire->ire_ib_pkt_count; 5026 } 5027 5028 static void 5029 power2_roundup(uint32_t *value) 5030 { 5031 int i; 5032 5033 for (i = 1; i < 31; i++) { 5034 if (*value <= (1 << i)) 5035 break; 5036 } 5037 *value = (1 << i); 5038 } 5039 5040 /* Global init for all zones */ 5041 void 5042 ip_ire_g_init() 5043 { 5044 /* 5045 * Create ire caches, ire_reclaim() 5046 * will give IRE_CACHE back to system when needed. 5047 * This needs to be done here before anything else, since 5048 * ire_add() expects the cache to be created. 5049 */ 5050 ire_cache = kmem_cache_create("ire_cache", 5051 sizeof (ire_t), 0, ip_ire_constructor, 5052 ip_ire_destructor, ip_trash_ire_reclaim, NULL, NULL, 0); 5053 5054 rt_entry_cache = kmem_cache_create("rt_entry", 5055 sizeof (struct rt_entry), 0, NULL, NULL, NULL, NULL, NULL, 0); 5056 5057 /* 5058 * Have radix code setup kmem caches etc. 5059 */ 5060 rn_init(); 5061 } 5062 5063 void 5064 ip_ire_init(ip_stack_t *ipst) 5065 { 5066 int i; 5067 uint32_t mem_cnt; 5068 uint32_t cpu_cnt; 5069 uint32_t min_cnt; 5070 pgcnt_t mem_avail; 5071 5072 /* 5073 * ip_ire_max_bucket_cnt is sized below based on the memory 5074 * size and the cpu speed of the machine. This is upper 5075 * bounded by the compile time value of ip_ire_max_bucket_cnt 5076 * and is lower bounded by the compile time value of 5077 * ip_ire_min_bucket_cnt. Similar logic applies to 5078 * ip6_ire_max_bucket_cnt. 5079 * 5080 * We calculate this for each IP Instances in order to use 5081 * the kmem_avail and ip_ire_{min,max}_bucket_cnt that are 5082 * in effect when the zone is booted. 5083 */ 5084 mem_avail = kmem_avail(); 5085 mem_cnt = (mem_avail >> ip_ire_mem_ratio) / 5086 ip_cache_table_size / sizeof (ire_t); 5087 cpu_cnt = CPU->cpu_type_info.pi_clock >> ip_ire_cpu_ratio; 5088 5089 min_cnt = MIN(cpu_cnt, mem_cnt); 5090 if (min_cnt < ip_ire_min_bucket_cnt) 5091 min_cnt = ip_ire_min_bucket_cnt; 5092 if (ip_ire_max_bucket_cnt > min_cnt) { 5093 ip_ire_max_bucket_cnt = min_cnt; 5094 } 5095 5096 mem_cnt = (mem_avail >> ip_ire_mem_ratio) / 5097 ip6_cache_table_size / sizeof (ire_t); 5098 min_cnt = MIN(cpu_cnt, mem_cnt); 5099 if (min_cnt < ip6_ire_min_bucket_cnt) 5100 min_cnt = ip6_ire_min_bucket_cnt; 5101 if (ip6_ire_max_bucket_cnt > min_cnt) { 5102 ip6_ire_max_bucket_cnt = min_cnt; 5103 } 5104 5105 mutex_init(&ipst->ips_ire_ft_init_lock, NULL, MUTEX_DEFAULT, 0); 5106 mutex_init(&ipst->ips_ire_handle_lock, NULL, MUTEX_DEFAULT, NULL); 5107 mutex_init(&ipst->ips_ire_mrtun_lock, NULL, MUTEX_DEFAULT, NULL); 5108 mutex_init(&ipst->ips_ire_srcif_table_lock, NULL, MUTEX_DEFAULT, NULL); 5109 5110 (void) rn_inithead((void **)&ipst->ips_ip_ftable, 32); 5111 5112 5113 /* Calculate the IPv4 cache table size. */ 5114 ipst->ips_ip_cache_table_size = MAX(ip_cache_table_size, 5115 ((mem_avail >> ip_ire_mem_ratio) / sizeof (ire_t) / 5116 ip_ire_max_bucket_cnt)); 5117 if (ipst->ips_ip_cache_table_size > ip_max_cache_table_size) 5118 ipst->ips_ip_cache_table_size = ip_max_cache_table_size; 5119 /* 5120 * Make sure that the table size is always a power of 2. The 5121 * hash macro IRE_ADDR_HASH() depends on that. 5122 */ 5123 power2_roundup(&ipst->ips_ip_cache_table_size); 5124 5125 ipst->ips_ip_cache_table = kmem_zalloc(ipst->ips_ip_cache_table_size * 5126 sizeof (irb_t), KM_SLEEP); 5127 5128 for (i = 0; i < ipst->ips_ip_cache_table_size; i++) { 5129 rw_init(&ipst->ips_ip_cache_table[i].irb_lock, NULL, 5130 RW_DEFAULT, NULL); 5131 } 5132 5133 /* Calculate the IPv6 cache table size. */ 5134 ipst->ips_ip6_cache_table_size = MAX(ip6_cache_table_size, 5135 ((mem_avail >> ip_ire_mem_ratio) / sizeof (ire_t) / 5136 ip6_ire_max_bucket_cnt)); 5137 if (ipst->ips_ip6_cache_table_size > ip6_max_cache_table_size) 5138 ipst->ips_ip6_cache_table_size = ip6_max_cache_table_size; 5139 /* 5140 * Make sure that the table size is always a power of 2. The 5141 * hash macro IRE_ADDR_HASH_V6() depends on that. 5142 */ 5143 power2_roundup(&ipst->ips_ip6_cache_table_size); 5144 5145 ipst->ips_ip_cache_table_v6 = kmem_zalloc( 5146 ipst->ips_ip6_cache_table_size * sizeof (irb_t), KM_SLEEP); 5147 5148 for (i = 0; i < ipst->ips_ip6_cache_table_size; i++) { 5149 rw_init(&ipst->ips_ip_cache_table_v6[i].irb_lock, NULL, 5150 RW_DEFAULT, NULL); 5151 } 5152 5153 /* 5154 * Initialize ip_mrtun_table to NULL now, it will be 5155 * populated by ip_rt_add if reverse tunnel is created 5156 */ 5157 ipst->ips_ip_mrtun_table = NULL; 5158 5159 /* 5160 * Make sure that the forwarding table size is a power of 2. 5161 * The IRE*_ADDR_HASH() macroes depend on that. 5162 */ 5163 ipst->ips_ip6_ftable_hash_size = ip6_ftable_hash_size; 5164 power2_roundup(&ipst->ips_ip6_ftable_hash_size); 5165 5166 ipst->ips_ire_handle = 1; 5167 } 5168 5169 void 5170 ip_ire_g_fini(void) 5171 { 5172 kmem_cache_destroy(ire_cache); 5173 kmem_cache_destroy(rt_entry_cache); 5174 5175 rn_fini(); 5176 } 5177 5178 void 5179 ip_ire_fini(ip_stack_t *ipst) 5180 { 5181 int i; 5182 5183 /* 5184 * Delete all IREs - assumes that the ill/ipifs have 5185 * been removed so what remains are just the ftable and IRE_CACHE. 5186 */ 5187 ire_walk_ill_mrtun(0, 0, ire_delete, NULL, NULL, ipst); 5188 ire_walk(ire_delete, NULL, ipst); 5189 5190 rn_freehead(ipst->ips_ip_ftable); 5191 ipst->ips_ip_ftable = NULL; 5192 5193 mutex_destroy(&ipst->ips_ire_ft_init_lock); 5194 mutex_destroy(&ipst->ips_ire_handle_lock); 5195 mutex_destroy(&ipst->ips_ire_mrtun_lock); 5196 mutex_destroy(&ipst->ips_ire_srcif_table_lock); 5197 5198 for (i = 0; i < ipst->ips_ip_cache_table_size; i++) { 5199 ASSERT(ipst->ips_ip_cache_table[i].irb_ire == NULL); 5200 rw_destroy(&ipst->ips_ip_cache_table[i].irb_lock); 5201 } 5202 kmem_free(ipst->ips_ip_cache_table, 5203 ipst->ips_ip_cache_table_size * sizeof (irb_t)); 5204 ipst->ips_ip_cache_table = NULL; 5205 5206 for (i = 0; i < ipst->ips_ip6_cache_table_size; i++) { 5207 ASSERT(ipst->ips_ip_cache_table_v6[i].irb_ire == NULL); 5208 rw_destroy(&ipst->ips_ip_cache_table_v6[i].irb_lock); 5209 } 5210 kmem_free(ipst->ips_ip_cache_table_v6, 5211 ipst->ips_ip6_cache_table_size * sizeof (irb_t)); 5212 ipst->ips_ip_cache_table_v6 = NULL; 5213 5214 if (ipst->ips_ip_mrtun_table != NULL) { 5215 for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) { 5216 ASSERT(ipst->ips_ip_mrtun_table[i].irb_ire == NULL); 5217 rw_destroy(&ipst->ips_ip_mrtun_table[i].irb_lock); 5218 } 5219 kmem_free(ipst->ips_ip_mrtun_table, 5220 IP_MRTUN_TABLE_SIZE * sizeof (irb_t)); 5221 ipst->ips_ip_mrtun_table = NULL; 5222 } 5223 5224 for (i = 0; i < IP6_MASK_TABLE_SIZE; i++) { 5225 irb_t *ptr; 5226 int j; 5227 5228 if ((ptr = ipst->ips_ip_forwarding_table_v6[i]) == NULL) 5229 continue; 5230 5231 for (j = 0; j < ipst->ips_ip6_ftable_hash_size; j++) { 5232 ASSERT(ptr[j].irb_ire == NULL); 5233 rw_destroy(&ptr[j].irb_lock); 5234 } 5235 mi_free(ptr); 5236 ipst->ips_ip_forwarding_table_v6[i] = NULL; 5237 } 5238 } 5239 5240 int 5241 ire_add_mrtun(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func) 5242 { 5243 ire_t *ire1; 5244 irb_t *irb_ptr; 5245 ire_t **irep; 5246 ire_t *ire = *ire_p; 5247 int i; 5248 uint_t max_frag; 5249 ill_t *stq_ill; 5250 int error; 5251 ip_stack_t *ipst = ire->ire_ipst; 5252 5253 ASSERT(ire->ire_ipversion == IPV4_VERSION); 5254 /* Is ip_mrtun_table empty ? */ 5255 5256 if (ipst->ips_ip_mrtun_table == NULL) { 5257 /* create the mrtun table */ 5258 mutex_enter(&ipst->ips_ire_mrtun_lock); 5259 if (ipst->ips_ip_mrtun_table == NULL) { 5260 ipst->ips_ip_mrtun_table = kmem_zalloc( 5261 IP_MRTUN_TABLE_SIZE * sizeof (irb_t), KM_NOSLEEP); 5262 5263 if (ipst->ips_ip_mrtun_table == NULL) { 5264 ip2dbg(("ire_add_mrtun: allocation failure\n")); 5265 mutex_exit(&ipst->ips_ire_mrtun_lock); 5266 ire_refrele(ire); 5267 *ire_p = NULL; 5268 return (ENOMEM); 5269 } 5270 5271 for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) { 5272 rw_init(&ipst->ips_ip_mrtun_table[i].irb_lock, NULL, 5273 RW_DEFAULT, NULL); 5274 } 5275 ip2dbg(("ire_add_mrtun: mrtun table is created\n")); 5276 } 5277 /* some other thread got it and created the table */ 5278 mutex_exit(&ipst->ips_ire_mrtun_lock); 5279 } 5280 5281 /* 5282 * Check for duplicate in the bucket and insert in the table 5283 */ 5284 irb_ptr = &(ipst->ips_ip_mrtun_table[IRE_ADDR_HASH(ire->ire_in_src_addr, 5285 IP_MRTUN_TABLE_SIZE)]); 5286 5287 /* 5288 * Start the atomic add of the ire. Grab the ill locks, 5289 * ill_g_usesrc_lock and the bucket lock. 5290 * 5291 * If ipif or ill is changing ire_atomic_start() may queue the 5292 * request and return EINPROGRESS. 5293 */ 5294 error = ire_atomic_start(irb_ptr, ire, q, mp, func); 5295 if (error != 0) { 5296 /* 5297 * We don't know whether it is a valid ipif or not. 5298 * So, set it to NULL. This assumes that the ire has not added 5299 * a reference to the ipif. 5300 */ 5301 ire->ire_ipif = NULL; 5302 ire_delete(ire); 5303 ip1dbg(("ire_add_mrtun: ire_atomic_start failed\n")); 5304 *ire_p = NULL; 5305 return (error); 5306 } 5307 for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) { 5308 if (ire1->ire_marks & IRE_MARK_CONDEMNED) 5309 continue; 5310 /* has anyone inserted the route in the meanwhile ? */ 5311 if (ire1->ire_in_ill == ire->ire_in_ill && 5312 ire1->ire_in_src_addr == ire->ire_in_src_addr) { 5313 ip1dbg(("ire_add_mrtun: Duplicate entry exists\n")); 5314 IRE_REFHOLD(ire1); 5315 ire_atomic_end(irb_ptr, ire); 5316 ire_delete(ire); 5317 /* Return the old ire */ 5318 *ire_p = ire1; 5319 return (0); 5320 } 5321 } 5322 5323 /* Atomically set the ire_max_frag */ 5324 max_frag = *ire->ire_max_fragp; 5325 ire->ire_max_fragp = NULL; 5326 ire->ire_max_frag = MIN(max_frag, IP_MAXPACKET); 5327 ASSERT(ire->ire_type != IRE_CACHE); 5328 irep = (ire_t **)irb_ptr; 5329 if (*irep != NULL) { 5330 /* Find the last ire which matches ire_in_src_addr */ 5331 ire1 = *irep; 5332 while (ire1->ire_in_src_addr == ire->ire_in_src_addr) { 5333 irep = &ire1->ire_next; 5334 ire1 = *irep; 5335 if (ire1 == NULL) 5336 break; 5337 } 5338 } 5339 ire1 = *irep; 5340 if (ire1 != NULL) 5341 ire1->ire_ptpn = &ire->ire_next; 5342 ire->ire_next = ire1; 5343 /* Link the new one in. */ 5344 ire->ire_ptpn = irep; 5345 membar_producer(); 5346 *irep = ire; 5347 ire->ire_bucket = irb_ptr; 5348 IRE_REFHOLD_LOCKED(ire); 5349 5350 ip2dbg(("ire_add_mrtun: created and linked ire %p\n", (void *)*irep)); 5351 5352 /* 5353 * Protect ire_mrtun_count and ill_mrtun_refcnt from 5354 * another thread trying to add ire in the table 5355 */ 5356 mutex_enter(&ipst->ips_ire_mrtun_lock); 5357 ipst->ips_ire_mrtun_count++; 5358 mutex_exit(&ipst->ips_ire_mrtun_lock); 5359 /* 5360 * ill_mrtun_refcnt is protected by the ill_lock held via 5361 * ire_atomic_start 5362 */ 5363 ire->ire_in_ill->ill_mrtun_refcnt++; 5364 5365 if (ire->ire_ipif != NULL) { 5366 ire->ire_ipif->ipif_ire_cnt++; 5367 if (ire->ire_stq != NULL) { 5368 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 5369 stq_ill->ill_ire_cnt++; 5370 } 5371 } else { 5372 ASSERT(ire->ire_stq == NULL); 5373 } 5374 5375 ire_atomic_end(irb_ptr, ire); 5376 nce_fastpath(ire->ire_nce); 5377 *ire_p = ire; 5378 return (0); 5379 } 5380 5381 5382 /* Walks down the mrtun table */ 5383 5384 void 5385 ire_walk_ill_mrtun(uint_t match_flags, uint_t ire_type, pfv_t func, void *arg, 5386 ill_t *ill, ip_stack_t *ipst) 5387 { 5388 irb_t *irb; 5389 ire_t *ire; 5390 int i; 5391 int ret; 5392 5393 ASSERT((!(match_flags & (MATCH_IRE_WQ | MATCH_IRE_ILL | 5394 MATCH_IRE_ILL_GROUP))) || (ill != NULL)); 5395 ASSERT(match_flags == 0 || ire_type == IRE_MIPRTUN); 5396 5397 mutex_enter(&ipst->ips_ire_mrtun_lock); 5398 if (ipst->ips_ire_mrtun_count == 0) { 5399 mutex_exit(&ipst->ips_ire_mrtun_lock); 5400 return; 5401 } 5402 mutex_exit(&ipst->ips_ire_mrtun_lock); 5403 5404 ip2dbg(("ire_walk_ill_mrtun:walking the reverse tunnel table \n")); 5405 for (i = 0; i < IP_MRTUN_TABLE_SIZE; i++) { 5406 5407 irb = &(ipst->ips_ip_mrtun_table[i]); 5408 if (irb->irb_ire == NULL) 5409 continue; 5410 IRB_REFHOLD(irb); 5411 for (ire = irb->irb_ire; ire != NULL; 5412 ire = ire->ire_next) { 5413 ASSERT(ire->ire_ipversion == IPV4_VERSION); 5414 if (match_flags != 0) { 5415 ret = ire_walk_ill_match( 5416 match_flags, ire_type, 5417 ire, ill, ALL_ZONES, ipst); 5418 } 5419 if (match_flags == 0 || ret) 5420 (*func)(ire, arg); 5421 } 5422 IRB_REFRELE(irb); 5423 } 5424 } 5425 5426 /* 5427 * Source interface based lookup routine (IPV4 only). 5428 * This routine is called only when RTA_SRCIFP bitflag is set 5429 * by routing socket while adding/deleting the route and it is 5430 * also called from ip_rput() when packets arrive from an interface 5431 * for which ill_srcif_ref_cnt is positive. This function is useful 5432 * when a packet coming from one interface must be forwarded to another 5433 * designated interface to reach the correct node. This function is also 5434 * called from ip_newroute when the link-layer address of an ire is resolved. 5435 * We need to make sure that ip_newroute searches for IRE_IF_RESOLVER type 5436 * ires--thus the ire_type parameter is needed. 5437 */ 5438 5439 ire_t * 5440 ire_srcif_table_lookup(ipaddr_t dst_addr, int ire_type, ipif_t *ipif, 5441 ill_t *in_ill, int flags) 5442 { 5443 irb_t *irb_ptr; 5444 ire_t *ire; 5445 irb_t *ire_srcif_table; 5446 5447 ASSERT(in_ill != NULL && !in_ill->ill_isv6); 5448 ASSERT(!(flags & (MATCH_IRE_ILL|MATCH_IRE_ILL_GROUP)) || 5449 (ipif != NULL && !ipif->ipif_isv6)); 5450 5451 /* 5452 * No need to lock the ill since it is refheld by the caller of this 5453 * function 5454 */ 5455 if (in_ill->ill_srcif_table == NULL) { 5456 return (NULL); 5457 } 5458 5459 if (!(flags & MATCH_IRE_TYPE)) { 5460 flags |= MATCH_IRE_TYPE; 5461 ire_type = IRE_INTERFACE; 5462 } 5463 ire_srcif_table = in_ill->ill_srcif_table; 5464 irb_ptr = &ire_srcif_table[IRE_ADDR_HASH(dst_addr, 5465 IP_SRCIF_TABLE_SIZE)]; 5466 rw_enter(&irb_ptr->irb_lock, RW_READER); 5467 for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { 5468 if (ire->ire_marks & IRE_MARK_CONDEMNED) 5469 continue; 5470 if (ire_match_args(ire, dst_addr, ire->ire_mask, 0, 5471 ire_type, ipif, ire->ire_zoneid, 0, NULL, flags)) { 5472 IRE_REFHOLD(ire); 5473 rw_exit(&irb_ptr->irb_lock); 5474 return (ire); 5475 } 5476 } 5477 /* Not Found */ 5478 rw_exit(&irb_ptr->irb_lock); 5479 return (NULL); 5480 } 5481 5482 5483 /* 5484 * Adds the ire into the special routing table which is hanging off of 5485 * the src_ipif->ipif_ill. It also increments the refcnt in the ill. 5486 * The forward table contains only IRE_IF_RESOLVER, IRE_IF_NORESOLVER 5487 * i,e. IRE_INTERFACE entries. Originally the dlureq_mp field is NULL 5488 * for IRE_IF_RESOLVER entry because we do not have the dst_addr's 5489 * link-layer address at the time of addition. 5490 * Upon resolving the address from ARP, dlureq_mp field is updated with 5491 * proper information in ire_update_srcif_v4. 5492 */ 5493 static int 5494 ire_add_srcif_v4(ire_t **ire_p, queue_t *q, mblk_t *mp, ipsq_func_t func) 5495 { 5496 ire_t *ire1; 5497 irb_t *ire_srcifp_table = NULL; 5498 irb_t *irb_ptr = NULL; 5499 ire_t **irep; 5500 ire_t *ire; 5501 int flags; 5502 int i; 5503 ill_t *stq_ill; 5504 uint_t max_frag; 5505 int error = 0; 5506 ip_stack_t *ipst; 5507 5508 ire = *ire_p; 5509 ipst = ire->ire_ipst; 5510 ASSERT(ire->ire_in_ill != NULL); 5511 ASSERT(ire->ire_ipversion == IPV4_VERSION); 5512 ASSERT(ire->ire_type == IRE_IF_NORESOLVER || 5513 ire->ire_type == IRE_IF_RESOLVER); 5514 5515 ire->ire_mask = IP_HOST_MASK; 5516 /* 5517 * Update ire_nce->nce_res_mp with NULL value upon creation; 5518 * first free the default res_mp created by ire_nce_init. 5519 */ 5520 freeb(ire->ire_nce->nce_res_mp); 5521 if (ire->ire_type == IRE_IF_RESOLVER) { 5522 /* 5523 * assign NULL now, it will be updated 5524 * with correct value upon returning from 5525 * ARP 5526 */ 5527 ire->ire_nce->nce_res_mp = NULL; 5528 } else { 5529 ire->ire_nce->nce_res_mp = ill_dlur_gen(NULL, 5530 ire->ire_ipif->ipif_ill->ill_phys_addr_length, 5531 ire->ire_ipif->ipif_ill->ill_sap, 5532 ire->ire_ipif->ipif_ill->ill_sap_length); 5533 } 5534 /* Make sure the address is properly masked. */ 5535 ire->ire_addr &= ire->ire_mask; 5536 5537 ASSERT(ire->ire_max_fragp != NULL); 5538 max_frag = *ire->ire_max_fragp; 5539 ire->ire_max_fragp = NULL; 5540 ire->ire_max_frag = MIN(max_frag, IP_MAXPACKET); 5541 5542 mutex_enter(&ire->ire_in_ill->ill_lock); 5543 if (ire->ire_in_ill->ill_srcif_table == NULL) { 5544 /* create the incoming interface based table */ 5545 ire->ire_in_ill->ill_srcif_table = kmem_zalloc( 5546 IP_SRCIF_TABLE_SIZE * sizeof (irb_t), KM_NOSLEEP); 5547 if (ire->ire_in_ill->ill_srcif_table == NULL) { 5548 ip1dbg(("ire_add_srcif_v4: Allocation fail\n")); 5549 mutex_exit(&ire->ire_in_ill->ill_lock); 5550 ire_delete(ire); 5551 *ire_p = NULL; 5552 return (ENOMEM); 5553 } 5554 ire_srcifp_table = ire->ire_in_ill->ill_srcif_table; 5555 for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) { 5556 rw_init(&ire_srcifp_table[i].irb_lock, NULL, 5557 RW_DEFAULT, NULL); 5558 } 5559 ip2dbg(("ire_add_srcif_v4: table created for ill %p\n", 5560 (void *)ire->ire_in_ill)); 5561 } 5562 /* Check for duplicate and insert */ 5563 ASSERT(ire->ire_in_ill->ill_srcif_table != NULL); 5564 irb_ptr = 5565 &(ire->ire_in_ill->ill_srcif_table[IRE_ADDR_HASH(ire->ire_addr, 5566 IP_SRCIF_TABLE_SIZE)]); 5567 mutex_exit(&ire->ire_in_ill->ill_lock); 5568 flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW); 5569 flags |= MATCH_IRE_IPIF; 5570 5571 /* 5572 * Start the atomic add of the ire. Grab the ill locks, 5573 * ill_g_usesrc_lock and the bucket lock. 5574 * 5575 * If ipif or ill is changing ire_atomic_start() may queue the 5576 * request and return EINPROGRESS. 5577 */ 5578 error = ire_atomic_start(irb_ptr, ire, q, mp, func); 5579 if (error != 0) { 5580 /* 5581 * We don't know whether it is a valid ipif or not. 5582 * So, set it to NULL. This assumes that the ire has not added 5583 * a reference to the ipif. 5584 */ 5585 ire->ire_ipif = NULL; 5586 ire_delete(ire); 5587 ip1dbg(("ire_add_srcif_v4: ire_atomic_start failed\n")); 5588 *ire_p = NULL; 5589 return (error); 5590 } 5591 for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) { 5592 if (ire1->ire_marks & IRE_MARK_CONDEMNED) 5593 continue; 5594 if (ire1->ire_zoneid != ire->ire_zoneid) 5595 continue; 5596 /* Has anyone inserted route in the meanwhile ? */ 5597 if (ire_match_args(ire1, ire->ire_addr, ire->ire_mask, 0, 5598 ire->ire_type, ire->ire_ipif, ire->ire_zoneid, 0, NULL, 5599 flags)) { 5600 ip1dbg(("ire_add_srcif_v4 : Duplicate entry exists\n")); 5601 IRE_REFHOLD(ire1); 5602 ire_atomic_end(irb_ptr, ire); 5603 ire_delete(ire); 5604 /* Return old ire as in ire_add_v4 */ 5605 *ire_p = ire1; 5606 return (0); 5607 } 5608 } 5609 irep = (ire_t **)irb_ptr; 5610 if (*irep != NULL) { 5611 /* Find the last ire which matches ire_addr */ 5612 ire1 = *irep; 5613 while (ire1->ire_addr == ire->ire_addr) { 5614 irep = &ire1->ire_next; 5615 ire1 = *irep; 5616 if (ire1 == NULL) 5617 break; 5618 } 5619 } 5620 ire1 = *irep; 5621 if (ire1 != NULL) 5622 ire1->ire_ptpn = &ire->ire_next; 5623 ire->ire_next = ire1; 5624 /* Link the new one in. */ 5625 ire->ire_ptpn = irep; 5626 membar_producer(); 5627 *irep = ire; 5628 ire->ire_bucket = irb_ptr; 5629 IRE_REFHOLD_LOCKED(ire); 5630 5631 /* 5632 * Protect ire_in_ill->ill_srcif_refcnt and table reference count. 5633 * Note, ire_atomic_start already grabs the ire_in_ill->ill_lock 5634 * so ill_srcif_refcnt is already protected. 5635 */ 5636 ire->ire_in_ill->ill_srcif_refcnt++; 5637 mutex_enter(&ipst->ips_ire_srcif_table_lock); 5638 ipst->ips_ire_srcif_table_count++; 5639 mutex_exit(&ipst->ips_ire_srcif_table_lock); 5640 irb_ptr->irb_ire_cnt++; 5641 if (ire->ire_ipif != NULL) { 5642 ire->ire_ipif->ipif_ire_cnt++; 5643 if (ire->ire_stq != NULL) { 5644 stq_ill = (ill_t *)ire->ire_stq->q_ptr; 5645 stq_ill->ill_ire_cnt++; 5646 } 5647 } else { 5648 ASSERT(ire->ire_stq == NULL); 5649 } 5650 5651 ire_atomic_end(irb_ptr, ire); 5652 *ire_p = ire; 5653 return (0); 5654 } 5655 5656 5657 /* 5658 * This function is called by ire_add_then_send when ARP request comes 5659 * back to ip_wput->ire_add_then_send for resolved ire in the interface 5660 * based routing table. At this point, it only needs to update the resolver 5661 * information for the ire. The passed ire is returned to the caller as it 5662 * is the ire which is created as mblk. 5663 */ 5664 static ire_t * 5665 ire_update_srcif_v4(ire_t *ire) 5666 { 5667 ire_t *ire1; 5668 irb_t *irb; 5669 int error; 5670 5671 ASSERT(ire->ire_type != IRE_MIPRTUN && 5672 ire->ire_ipif->ipif_net_type == IRE_IF_RESOLVER); 5673 ASSERT(ire->ire_ipversion == IPV4_VERSION); 5674 5675 /* 5676 * This ire is from ARP. Update 5677 * ire_nce->nce_res_mp info 5678 */ 5679 ire1 = ire_srcif_table_lookup(ire->ire_addr, 5680 IRE_IF_RESOLVER, ire->ire_ipif, 5681 ire->ire_in_ill, 5682 MATCH_IRE_ILL | MATCH_IRE_TYPE); 5683 if (ire1 == NULL) { 5684 /* Mobile node registration expired ? */ 5685 ire_delete(ire); 5686 return (NULL); 5687 } 5688 irb = ire1->ire_bucket; 5689 ASSERT(irb != NULL); 5690 /* 5691 * Start the atomic add of the ire. Grab the ill locks, 5692 * ill_g_usesrc_lock and the bucket lock. 5693 */ 5694 error = ire_atomic_start(irb, ire1, NULL, NULL, NULL); 5695 if (error != 0) { 5696 /* 5697 * We don't know whether it is a valid ipif or not. 5698 * So, set it to NULL. This assumes that the ire has not added 5699 * a reference to the ipif. 5700 */ 5701 ire->ire_ipif = NULL; 5702 ire_delete(ire); 5703 ip1dbg(("ire_update_srcif_v4: ire_atomic_start failed\n")); 5704 return (NULL); 5705 } 5706 ASSERT(ire->ire_max_fragp == NULL); 5707 ire->ire_max_frag = ire1->ire_max_frag; 5708 /* 5709 * Update resolver information and 5710 * send-to queue. 5711 */ 5712 ASSERT(ire->ire_nce->nce_res_mp != NULL); 5713 ire1->ire_nce->nce_res_mp = copyb(ire->ire_nce->nce_res_mp); 5714 if (ire1->ire_nce->nce_res_mp == NULL) { 5715 ip0dbg(("ire_update_srcif: copyb failed\n")); 5716 ire_refrele(ire1); 5717 ire_refrele(ire); 5718 ire_atomic_end(irb, ire1); 5719 return (NULL); 5720 } 5721 ire1->ire_stq = ire->ire_stq; 5722 5723 ASSERT(ire->ire_nce->nce_fp_mp == NULL); 5724 5725 ire_atomic_end(irb, ire1); 5726 ire_refrele(ire1); 5727 /* Return the passed ire */ 5728 return (ire); /* Update done */ 5729 } 5730 5731 5732 /* 5733 * Check if another multirt route resolution is needed. 5734 * B_TRUE is returned is there remain a resolvable route, 5735 * or if no route for that dst is resolved yet. 5736 * B_FALSE is returned if all routes for that dst are resolved 5737 * or if the remaining unresolved routes are actually not 5738 * resolvable. 5739 * This only works in the global zone. 5740 */ 5741 boolean_t 5742 ire_multirt_need_resolve(ipaddr_t dst, const ts_label_t *tsl, ip_stack_t *ipst) 5743 { 5744 ire_t *first_fire; 5745 ire_t *first_cire; 5746 ire_t *fire; 5747 ire_t *cire; 5748 irb_t *firb; 5749 irb_t *cirb; 5750 int unres_cnt = 0; 5751 boolean_t resolvable = B_FALSE; 5752 5753 /* Retrieve the first IRE_HOST that matches the destination */ 5754 first_fire = ire_ftable_lookup(dst, IP_HOST_MASK, 0, IRE_HOST, NULL, 5755 NULL, ALL_ZONES, 0, tsl, 5756 MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_SECATTR, ipst); 5757 5758 /* No route at all */ 5759 if (first_fire == NULL) { 5760 return (B_TRUE); 5761 } 5762 5763 firb = first_fire->ire_bucket; 5764 ASSERT(firb != NULL); 5765 5766 /* Retrieve the first IRE_CACHE ire for that destination. */ 5767 first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID, tsl, ipst); 5768 5769 /* No resolved route. */ 5770 if (first_cire == NULL) { 5771 ire_refrele(first_fire); 5772 return (B_TRUE); 5773 } 5774 5775 /* 5776 * At least one route is resolved. Here we look through the forward 5777 * and cache tables, to compare the number of declared routes 5778 * with the number of resolved routes. The search for a resolvable 5779 * route is performed only if at least one route remains 5780 * unresolved. 5781 */ 5782 cirb = first_cire->ire_bucket; 5783 ASSERT(cirb != NULL); 5784 5785 /* Count the number of routes to that dest that are declared. */ 5786 IRB_REFHOLD(firb); 5787 for (fire = first_fire; fire != NULL; fire = fire->ire_next) { 5788 if (!(fire->ire_flags & RTF_MULTIRT)) 5789 continue; 5790 if (fire->ire_addr != dst) 5791 continue; 5792 unres_cnt++; 5793 } 5794 IRB_REFRELE(firb); 5795 5796 /* Then subtract the number of routes to that dst that are resolved */ 5797 IRB_REFHOLD(cirb); 5798 for (cire = first_cire; cire != NULL; cire = cire->ire_next) { 5799 if (!(cire->ire_flags & RTF_MULTIRT)) 5800 continue; 5801 if (cire->ire_addr != dst) 5802 continue; 5803 if (cire->ire_marks & (IRE_MARK_CONDEMNED | IRE_MARK_HIDDEN)) 5804 continue; 5805 unres_cnt--; 5806 } 5807 IRB_REFRELE(cirb); 5808 5809 /* At least one route is unresolved; search for a resolvable route. */ 5810 if (unres_cnt > 0) 5811 resolvable = ire_multirt_lookup(&first_cire, &first_fire, 5812 MULTIRT_USESTAMP | MULTIRT_CACHEGW, tsl, ipst); 5813 5814 if (first_fire != NULL) 5815 ire_refrele(first_fire); 5816 5817 if (first_cire != NULL) 5818 ire_refrele(first_cire); 5819 5820 return (resolvable); 5821 } 5822 5823 5824 /* 5825 * Explore a forward_table bucket, starting from fire_arg. 5826 * fire_arg MUST be an IRE_HOST entry. 5827 * 5828 * Return B_TRUE and update *ire_arg and *fire_arg 5829 * if at least one resolvable route is found. *ire_arg 5830 * is the IRE entry for *fire_arg's gateway. 5831 * 5832 * Return B_FALSE otherwise (all routes are resolved or 5833 * the remaining unresolved routes are all unresolvable). 5834 * 5835 * The IRE selection relies on a priority mechanism 5836 * driven by the flags passed in by the caller. 5837 * The caller, such as ip_newroute_ipif(), can get the most 5838 * relevant ire at each stage of a multiple route resolution. 5839 * 5840 * The rules are: 5841 * 5842 * - if MULTIRT_CACHEGW is specified in flags, IRE_CACHETABLE 5843 * ires are preferred for the gateway. This gives the highest 5844 * priority to routes that can be resolved without using 5845 * a resolver. 5846 * 5847 * - if MULTIRT_CACHEGW is not specified, or if MULTIRT_CACHEGW 5848 * is specified but no IRE_CACHETABLE ire entry for the gateway 5849 * is found, the following rules apply. 5850 * 5851 * - if MULTIRT_USESTAMP is specified in flags, IRE_INTERFACE 5852 * ires for the gateway, that have not been tried since 5853 * a configurable amount of time, are preferred. 5854 * This applies when a resolver must be invoked for 5855 * a missing route, but we don't want to use the resolver 5856 * upon each packet emission. If no such resolver is found, 5857 * B_FALSE is returned. 5858 * The MULTIRT_USESTAMP flag can be combined with 5859 * MULTIRT_CACHEGW. 5860 * 5861 * - if MULTIRT_USESTAMP is not specified in flags, the first 5862 * unresolved but resolvable route is selected. 5863 * 5864 * - Otherwise, there is no resolvalble route, and 5865 * B_FALSE is returned. 5866 * 5867 * At last, MULTIRT_SETSTAMP can be specified in flags to 5868 * request the timestamp of unresolvable routes to 5869 * be refreshed. This prevents the useless exploration 5870 * of those routes for a while, when MULTIRT_USESTAMP is used. 5871 * 5872 * This only works in the global zone. 5873 */ 5874 boolean_t 5875 ire_multirt_lookup(ire_t **ire_arg, ire_t **fire_arg, uint32_t flags, 5876 const ts_label_t *tsl, ip_stack_t *ipst) 5877 { 5878 clock_t delta; 5879 ire_t *best_fire = NULL; 5880 ire_t *best_cire = NULL; 5881 ire_t *first_fire; 5882 ire_t *first_cire; 5883 ire_t *fire; 5884 ire_t *cire; 5885 irb_t *firb = NULL; 5886 irb_t *cirb = NULL; 5887 ire_t *gw_ire; 5888 boolean_t already_resolved; 5889 boolean_t res; 5890 ipaddr_t dst; 5891 ipaddr_t gw; 5892 5893 ip2dbg(("ire_multirt_lookup: *ire_arg %p, *fire_arg %p, flags %04x\n", 5894 (void *)*ire_arg, (void *)*fire_arg, flags)); 5895 5896 ASSERT(ire_arg != NULL); 5897 ASSERT(fire_arg != NULL); 5898 5899 /* Not an IRE_HOST ire; give up. */ 5900 if ((*fire_arg == NULL) || ((*fire_arg)->ire_type != IRE_HOST)) { 5901 return (B_FALSE); 5902 } 5903 5904 /* This is the first IRE_HOST ire for that destination. */ 5905 first_fire = *fire_arg; 5906 firb = first_fire->ire_bucket; 5907 ASSERT(firb != NULL); 5908 5909 dst = first_fire->ire_addr; 5910 5911 ip2dbg(("ire_multirt_lookup: dst %08x\n", ntohl(dst))); 5912 5913 /* 5914 * Retrieve the first IRE_CACHE ire for that destination; 5915 * if we don't find one, no route for that dest is 5916 * resolved yet. 5917 */ 5918 first_cire = ire_cache_lookup(dst, GLOBAL_ZONEID, tsl, ipst); 5919 if (first_cire != NULL) { 5920 cirb = first_cire->ire_bucket; 5921 } 5922 5923 ip2dbg(("ire_multirt_lookup: first_cire %p\n", (void *)first_cire)); 5924 5925 /* 5926 * Search for a resolvable route, giving the top priority 5927 * to routes that can be resolved without any call to the resolver. 5928 */ 5929 IRB_REFHOLD(firb); 5930 5931 if (!CLASSD(dst)) { 5932 /* 5933 * For all multiroute IRE_HOST ires for that destination, 5934 * check if the route via the IRE_HOST's gateway is 5935 * resolved yet. 5936 */ 5937 for (fire = first_fire; fire != NULL; fire = fire->ire_next) { 5938 5939 if (!(fire->ire_flags & RTF_MULTIRT)) 5940 continue; 5941 if (fire->ire_addr != dst) 5942 continue; 5943 5944 if (fire->ire_gw_secattr != NULL && 5945 tsol_ire_match_gwattr(fire, tsl) != 0) { 5946 continue; 5947 } 5948 5949 gw = fire->ire_gateway_addr; 5950 5951 ip2dbg(("ire_multirt_lookup: fire %p, " 5952 "ire_addr %08x, ire_gateway_addr %08x\n", 5953 (void *)fire, ntohl(fire->ire_addr), ntohl(gw))); 5954 5955 already_resolved = B_FALSE; 5956 5957 if (first_cire != NULL) { 5958 ASSERT(cirb != NULL); 5959 5960 IRB_REFHOLD(cirb); 5961 /* 5962 * For all IRE_CACHE ires for that 5963 * destination. 5964 */ 5965 for (cire = first_cire; 5966 cire != NULL; 5967 cire = cire->ire_next) { 5968 5969 if (!(cire->ire_flags & RTF_MULTIRT)) 5970 continue; 5971 if (cire->ire_addr != dst) 5972 continue; 5973 if (cire->ire_marks & 5974 (IRE_MARK_CONDEMNED | 5975 IRE_MARK_HIDDEN)) 5976 continue; 5977 5978 if (cire->ire_gw_secattr != NULL && 5979 tsol_ire_match_gwattr(cire, 5980 tsl) != 0) { 5981 continue; 5982 } 5983 5984 /* 5985 * Check if the IRE_CACHE's gateway 5986 * matches the IRE_HOST's gateway. 5987 */ 5988 if (cire->ire_gateway_addr == gw) { 5989 already_resolved = B_TRUE; 5990 break; 5991 } 5992 } 5993 IRB_REFRELE(cirb); 5994 } 5995 5996 /* 5997 * This route is already resolved; 5998 * proceed with next one. 5999 */ 6000 if (already_resolved) { 6001 ip2dbg(("ire_multirt_lookup: found cire %p, " 6002 "already resolved\n", (void *)cire)); 6003 continue; 6004 } 6005 6006 /* 6007 * The route is unresolved; is it actually 6008 * resolvable, i.e. is there a cache or a resolver 6009 * for the gateway? 6010 */ 6011 gw_ire = ire_route_lookup(gw, 0, 0, 0, NULL, NULL, 6012 ALL_ZONES, tsl, 6013 MATCH_IRE_RECURSIVE | MATCH_IRE_SECATTR, ipst); 6014 6015 ip2dbg(("ire_multirt_lookup: looked up gw_ire %p\n", 6016 (void *)gw_ire)); 6017 6018 /* 6019 * If gw_ire is typed IRE_CACHETABLE, 6020 * this route can be resolved without any call to the 6021 * resolver. If the MULTIRT_CACHEGW flag is set, 6022 * give the top priority to this ire and exit the 6023 * loop. 6024 * This is typically the case when an ARP reply 6025 * is processed through ip_wput_nondata(). 6026 */ 6027 if ((flags & MULTIRT_CACHEGW) && 6028 (gw_ire != NULL) && 6029 (gw_ire->ire_type & IRE_CACHETABLE)) { 6030 ASSERT(gw_ire->ire_nce == NULL || 6031 gw_ire->ire_nce->nce_state == ND_REACHABLE); 6032 /* 6033 * Release the resolver associated to the 6034 * previous candidate best ire, if any. 6035 */ 6036 if (best_cire != NULL) { 6037 ire_refrele(best_cire); 6038 ASSERT(best_fire != NULL); 6039 } 6040 6041 best_fire = fire; 6042 best_cire = gw_ire; 6043 6044 ip2dbg(("ire_multirt_lookup: found top prio " 6045 "best_fire %p, best_cire %p\n", 6046 (void *)best_fire, (void *)best_cire)); 6047 break; 6048 } 6049 6050 /* 6051 * Compute the time elapsed since our preceding 6052 * attempt to resolve that route. 6053 * If the MULTIRT_USESTAMP flag is set, we take that 6054 * route into account only if this time interval 6055 * exceeds ip_multirt_resolution_interval; 6056 * this prevents us from attempting to resolve a 6057 * broken route upon each sending of a packet. 6058 */ 6059 delta = lbolt - fire->ire_last_used_time; 6060 delta = TICK_TO_MSEC(delta); 6061 6062 res = (boolean_t)((delta > 6063 ipst->ips_ip_multirt_resolution_interval) || 6064 (!(flags & MULTIRT_USESTAMP))); 6065 6066 ip2dbg(("ire_multirt_lookup: fire %p, delta %lu, " 6067 "res %d\n", 6068 (void *)fire, delta, res)); 6069 6070 if (res) { 6071 /* 6072 * We are here if MULTIRT_USESTAMP flag is set 6073 * and the resolver for fire's gateway 6074 * has not been tried since 6075 * ip_multirt_resolution_interval, or if 6076 * MULTIRT_USESTAMP is not set but gw_ire did 6077 * not fill the conditions for MULTIRT_CACHEGW, 6078 * or if neither MULTIRT_USESTAMP nor 6079 * MULTIRT_CACHEGW are set. 6080 */ 6081 if (gw_ire != NULL) { 6082 if (best_fire == NULL) { 6083 ASSERT(best_cire == NULL); 6084 6085 best_fire = fire; 6086 best_cire = gw_ire; 6087 6088 ip2dbg(("ire_multirt_lookup:" 6089 "found candidate " 6090 "best_fire %p, " 6091 "best_cire %p\n", 6092 (void *)best_fire, 6093 (void *)best_cire)); 6094 6095 /* 6096 * If MULTIRT_CACHEGW is not 6097 * set, we ignore the top 6098 * priority ires that can 6099 * be resolved without any 6100 * call to the resolver; 6101 * In that case, there is 6102 * actually no need 6103 * to continue the loop. 6104 */ 6105 if (!(flags & 6106 MULTIRT_CACHEGW)) { 6107 break; 6108 } 6109 continue; 6110 } 6111 } else { 6112 /* 6113 * No resolver for the gateway: the 6114 * route is not resolvable. 6115 * If the MULTIRT_SETSTAMP flag is 6116 * set, we stamp the IRE_HOST ire, 6117 * so we will not select it again 6118 * during this resolution interval. 6119 */ 6120 if (flags & MULTIRT_SETSTAMP) 6121 fire->ire_last_used_time = 6122 lbolt; 6123 } 6124 } 6125 6126 if (gw_ire != NULL) 6127 ire_refrele(gw_ire); 6128 } 6129 } else { /* CLASSD(dst) */ 6130 6131 for (fire = first_fire; 6132 fire != NULL; 6133 fire = fire->ire_next) { 6134 6135 if (!(fire->ire_flags & RTF_MULTIRT)) 6136 continue; 6137 if (fire->ire_addr != dst) 6138 continue; 6139 6140 if (fire->ire_gw_secattr != NULL && 6141 tsol_ire_match_gwattr(fire, tsl) != 0) { 6142 continue; 6143 } 6144 6145 already_resolved = B_FALSE; 6146 6147 gw = fire->ire_gateway_addr; 6148 6149 gw_ire = ire_ftable_lookup(gw, 0, 0, IRE_INTERFACE, 6150 NULL, NULL, ALL_ZONES, 0, tsl, 6151 MATCH_IRE_RECURSIVE | MATCH_IRE_TYPE | 6152 MATCH_IRE_SECATTR, ipst); 6153 6154 /* No resolver for the gateway; we skip this ire. */ 6155 if (gw_ire == NULL) { 6156 continue; 6157 } 6158 ASSERT(gw_ire->ire_nce == NULL || 6159 gw_ire->ire_nce->nce_state == ND_REACHABLE); 6160 6161 if (first_cire != NULL) { 6162 6163 IRB_REFHOLD(cirb); 6164 /* 6165 * For all IRE_CACHE ires for that 6166 * destination. 6167 */ 6168 for (cire = first_cire; 6169 cire != NULL; 6170 cire = cire->ire_next) { 6171 6172 if (!(cire->ire_flags & RTF_MULTIRT)) 6173 continue; 6174 if (cire->ire_addr != dst) 6175 continue; 6176 if (cire->ire_marks & 6177 (IRE_MARK_CONDEMNED | 6178 IRE_MARK_HIDDEN)) 6179 continue; 6180 6181 if (cire->ire_gw_secattr != NULL && 6182 tsol_ire_match_gwattr(cire, 6183 tsl) != 0) { 6184 continue; 6185 } 6186 6187 /* 6188 * Cache entries are linked to the 6189 * parent routes using the parent handle 6190 * (ire_phandle). If no cache entry has 6191 * the same handle as fire, fire is 6192 * still unresolved. 6193 */ 6194 ASSERT(cire->ire_phandle != 0); 6195 if (cire->ire_phandle == 6196 fire->ire_phandle) { 6197 already_resolved = B_TRUE; 6198 break; 6199 } 6200 } 6201 IRB_REFRELE(cirb); 6202 } 6203 6204 /* 6205 * This route is already resolved; proceed with 6206 * next one. 6207 */ 6208 if (already_resolved) { 6209 ire_refrele(gw_ire); 6210 continue; 6211 } 6212 6213 /* 6214 * Compute the time elapsed since our preceding 6215 * attempt to resolve that route. 6216 * If the MULTIRT_USESTAMP flag is set, we take 6217 * that route into account only if this time 6218 * interval exceeds ip_multirt_resolution_interval; 6219 * this prevents us from attempting to resolve a 6220 * broken route upon each sending of a packet. 6221 */ 6222 delta = lbolt - fire->ire_last_used_time; 6223 delta = TICK_TO_MSEC(delta); 6224 6225 res = (boolean_t)((delta > 6226 ipst->ips_ip_multirt_resolution_interval) || 6227 (!(flags & MULTIRT_USESTAMP))); 6228 6229 ip3dbg(("ire_multirt_lookup: fire %p, delta %lx, " 6230 "flags %04x, res %d\n", 6231 (void *)fire, delta, flags, res)); 6232 6233 if (res) { 6234 if (best_cire != NULL) { 6235 /* 6236 * Release the resolver associated 6237 * to the preceding candidate best 6238 * ire, if any. 6239 */ 6240 ire_refrele(best_cire); 6241 ASSERT(best_fire != NULL); 6242 } 6243 best_fire = fire; 6244 best_cire = gw_ire; 6245 continue; 6246 } 6247 6248 ire_refrele(gw_ire); 6249 } 6250 } 6251 6252 if (best_fire != NULL) { 6253 IRE_REFHOLD(best_fire); 6254 } 6255 IRB_REFRELE(firb); 6256 6257 /* Release the first IRE_CACHE we initially looked up, if any. */ 6258 if (first_cire != NULL) 6259 ire_refrele(first_cire); 6260 6261 /* Found a resolvable route. */ 6262 if (best_fire != NULL) { 6263 ASSERT(best_cire != NULL); 6264 6265 if (*fire_arg != NULL) 6266 ire_refrele(*fire_arg); 6267 if (*ire_arg != NULL) 6268 ire_refrele(*ire_arg); 6269 6270 /* 6271 * Update the passed-in arguments with the 6272 * resolvable multirt route we found. 6273 */ 6274 *fire_arg = best_fire; 6275 *ire_arg = best_cire; 6276 6277 ip2dbg(("ire_multirt_lookup: returning B_TRUE, " 6278 "*fire_arg %p, *ire_arg %p\n", 6279 (void *)best_fire, (void *)best_cire)); 6280 6281 return (B_TRUE); 6282 } 6283 6284 ASSERT(best_cire == NULL); 6285 6286 ip2dbg(("ire_multirt_lookup: returning B_FALSE, *fire_arg %p, " 6287 "*ire_arg %p\n", 6288 (void *)*fire_arg, (void *)*ire_arg)); 6289 6290 /* No resolvable route. */ 6291 return (B_FALSE); 6292 } 6293 6294 /* 6295 * IRE iterator for inbound and loopback broadcast processing. 6296 * Given an IRE_BROADCAST ire, walk the ires with the same destination 6297 * address, but skip over the passed-in ire. Returns the next ire without 6298 * a hold - assumes that the caller holds a reference on the IRE bucket. 6299 */ 6300 ire_t * 6301 ire_get_next_bcast_ire(ire_t *curr, ire_t *ire) 6302 { 6303 ill_t *ill; 6304 6305 if (curr == NULL) { 6306 for (curr = ire->ire_bucket->irb_ire; curr != NULL; 6307 curr = curr->ire_next) { 6308 if (curr->ire_addr == ire->ire_addr) 6309 break; 6310 } 6311 } else { 6312 curr = curr->ire_next; 6313 } 6314 ill = ire_to_ill(ire); 6315 for (; curr != NULL; curr = curr->ire_next) { 6316 if (curr->ire_addr != ire->ire_addr) { 6317 /* 6318 * All the IREs to a given destination are contiguous; 6319 * break out once the address doesn't match. 6320 */ 6321 break; 6322 } 6323 if (curr == ire) { 6324 /* skip over the passed-in ire */ 6325 continue; 6326 } 6327 if ((curr->ire_stq != NULL && ire->ire_stq == NULL) || 6328 (curr->ire_stq == NULL && ire->ire_stq != NULL)) { 6329 /* 6330 * If the passed-in ire is loopback, skip over 6331 * non-loopback ires and vice versa. 6332 */ 6333 continue; 6334 } 6335 if (ire_to_ill(curr) != ill) { 6336 /* skip over IREs going through a different interface */ 6337 continue; 6338 } 6339 if (curr->ire_marks & IRE_MARK_CONDEMNED) { 6340 /* skip over deleted IREs */ 6341 continue; 6342 } 6343 return (curr); 6344 } 6345 return (NULL); 6346 } 6347 6348 #ifdef IRE_DEBUG 6349 th_trace_t * 6350 th_trace_ire_lookup(ire_t *ire) 6351 { 6352 int bucket_id; 6353 th_trace_t *th_trace; 6354 6355 ASSERT(MUTEX_HELD(&ire->ire_lock)); 6356 6357 bucket_id = IP_TR_HASH(curthread); 6358 ASSERT(bucket_id < IP_TR_HASH_MAX); 6359 6360 for (th_trace = ire->ire_trace[bucket_id]; th_trace != NULL; 6361 th_trace = th_trace->th_next) { 6362 if (th_trace->th_id == curthread) 6363 return (th_trace); 6364 } 6365 return (NULL); 6366 } 6367 6368 void 6369 ire_trace_ref(ire_t *ire) 6370 { 6371 int bucket_id; 6372 th_trace_t *th_trace; 6373 6374 /* 6375 * Attempt to locate the trace buffer for the curthread. 6376 * If it does not exist, then allocate a new trace buffer 6377 * and link it in list of trace bufs for this ipif, at the head 6378 */ 6379 mutex_enter(&ire->ire_lock); 6380 if (ire->ire_trace_disable == B_TRUE) { 6381 mutex_exit(&ire->ire_lock); 6382 return; 6383 } 6384 th_trace = th_trace_ire_lookup(ire); 6385 if (th_trace == NULL) { 6386 bucket_id = IP_TR_HASH(curthread); 6387 th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t), 6388 KM_NOSLEEP); 6389 if (th_trace == NULL) { 6390 ire->ire_trace_disable = B_TRUE; 6391 mutex_exit(&ire->ire_lock); 6392 ire_trace_inactive(ire); 6393 return; 6394 } 6395 6396 th_trace->th_id = curthread; 6397 th_trace->th_next = ire->ire_trace[bucket_id]; 6398 th_trace->th_prev = &ire->ire_trace[bucket_id]; 6399 if (th_trace->th_next != NULL) 6400 th_trace->th_next->th_prev = &th_trace->th_next; 6401 ire->ire_trace[bucket_id] = th_trace; 6402 } 6403 ASSERT(th_trace->th_refcnt < TR_BUF_MAX - 1); 6404 th_trace->th_refcnt++; 6405 th_trace_rrecord(th_trace); 6406 mutex_exit(&ire->ire_lock); 6407 } 6408 6409 void 6410 ire_trace_free(th_trace_t *th_trace) 6411 { 6412 /* unlink th_trace and free it */ 6413 *th_trace->th_prev = th_trace->th_next; 6414 if (th_trace->th_next != NULL) 6415 th_trace->th_next->th_prev = th_trace->th_prev; 6416 th_trace->th_next = NULL; 6417 th_trace->th_prev = NULL; 6418 kmem_free(th_trace, sizeof (th_trace_t)); 6419 } 6420 6421 void 6422 ire_untrace_ref(ire_t *ire) 6423 { 6424 th_trace_t *th_trace; 6425 6426 mutex_enter(&ire->ire_lock); 6427 6428 if (ire->ire_trace_disable == B_TRUE) { 6429 mutex_exit(&ire->ire_lock); 6430 return; 6431 } 6432 6433 th_trace = th_trace_ire_lookup(ire); 6434 ASSERT(th_trace != NULL && th_trace->th_refcnt > 0); 6435 th_trace_rrecord(th_trace); 6436 th_trace->th_refcnt--; 6437 6438 if (th_trace->th_refcnt == 0) 6439 ire_trace_free(th_trace); 6440 6441 mutex_exit(&ire->ire_lock); 6442 } 6443 6444 static void 6445 ire_trace_inactive(ire_t *ire) 6446 { 6447 th_trace_t *th_trace; 6448 int i; 6449 6450 mutex_enter(&ire->ire_lock); 6451 for (i = 0; i < IP_TR_HASH_MAX; i++) { 6452 while (ire->ire_trace[i] != NULL) { 6453 th_trace = ire->ire_trace[i]; 6454 6455 /* unlink th_trace and free it */ 6456 ire->ire_trace[i] = th_trace->th_next; 6457 if (th_trace->th_next != NULL) 6458 th_trace->th_next->th_prev = 6459 &ire->ire_trace[i]; 6460 6461 th_trace->th_next = NULL; 6462 th_trace->th_prev = NULL; 6463 kmem_free(th_trace, sizeof (th_trace_t)); 6464 } 6465 } 6466 6467 mutex_exit(&ire->ire_lock); 6468 } 6469 6470 /* ARGSUSED */ 6471 void 6472 ire_thread_exit(ire_t *ire, caddr_t arg) 6473 { 6474 th_trace_t *th_trace; 6475 6476 mutex_enter(&ire->ire_lock); 6477 th_trace = th_trace_ire_lookup(ire); 6478 if (th_trace == NULL) { 6479 mutex_exit(&ire->ire_lock); 6480 return; 6481 } 6482 ASSERT(th_trace->th_refcnt == 0); 6483 6484 ire_trace_free(th_trace); 6485 mutex_exit(&ire->ire_lock); 6486 } 6487 6488 #endif 6489 6490 /* 6491 * Generate a message chain with an arp request to resolve the in_ire. 6492 * It is assumed that in_ire itself is currently in the ire cache table, 6493 * so we create a fake_ire filled with enough information about ire_addr etc. 6494 * to retrieve in_ire when the DL_UNITDATA response from the resolver 6495 * comes back. The fake_ire itself is created by calling esballoc with 6496 * the fr_rtnp (free routine) set to ire_freemblk. This routine will be 6497 * invoked when the mblk containing fake_ire is freed. 6498 */ 6499 void 6500 ire_arpresolve(ire_t *in_ire, ill_t *dst_ill) 6501 { 6502 areq_t *areq; 6503 ipaddr_t *addrp; 6504 mblk_t *ire_mp, *dlureq_mp; 6505 ire_t *ire, *buf; 6506 size_t bufsize; 6507 frtn_t *frtnp; 6508 ill_t *ill; 6509 ip_stack_t *ipst = dst_ill->ill_ipst; 6510 6511 /* 6512 * Construct message chain for the resolver 6513 * of the form: 6514 * ARP_REQ_MBLK-->IRE_MBLK 6515 * 6516 * NOTE : If the response does not 6517 * come back, ARP frees the packet. For this reason, 6518 * we can't REFHOLD the bucket of save_ire to prevent 6519 * deletions. We may not be able to REFRELE the bucket 6520 * if the response never comes back. Thus, before 6521 * adding the ire, ire_add_v4 will make sure that the 6522 * interface route does not get deleted. This is the 6523 * only case unlike ip_newroute_v6, ip_newroute_ipif_v6 6524 * where we can always prevent deletions because of 6525 * the synchronous nature of adding IRES i.e 6526 * ire_add_then_send is called after creating the IRE. 6527 */ 6528 6529 /* 6530 * We use esballoc to allocate the second part(the ire_t size mblk) 6531 * of the message chain depicted above. THis mblk will be freed 6532 * by arp when there is a timeout, and otherwise passed to IP 6533 * and IP will * free it after processing the ARP response. 6534 */ 6535 6536 bufsize = sizeof (ire_t) + sizeof (frtn_t); 6537 buf = kmem_alloc(bufsize, KM_NOSLEEP); 6538 if (buf == NULL) { 6539 ip1dbg(("ire_arpresolver:alloc buffer failed\n ")); 6540 return; 6541 } 6542 frtnp = (frtn_t *)(buf + 1); 6543 frtnp->free_arg = (caddr_t)buf; 6544 frtnp->free_func = ire_freemblk; 6545 6546 ire_mp = esballoc((unsigned char *)buf, bufsize, BPRI_MED, frtnp); 6547 6548 if (ire_mp == NULL) { 6549 ip1dbg(("ire_arpresolve: esballoc failed\n")); 6550 kmem_free(buf, bufsize); 6551 return; 6552 } 6553 ASSERT(in_ire->ire_nce != NULL); 6554 dlureq_mp = copyb(dst_ill->ill_resolver_mp); 6555 if (dlureq_mp == NULL) { 6556 kmem_free(buf, bufsize); 6557 return; 6558 } 6559 6560 ire_mp->b_datap->db_type = IRE_ARPRESOLVE_TYPE; 6561 ire = (ire_t *)buf; 6562 /* 6563 * keep enough info in the fake ire so that we can pull up 6564 * the incomplete ire (in_ire) after result comes back from 6565 * arp and make it complete. 6566 */ 6567 *ire = ire_null; 6568 ire->ire_u = in_ire->ire_u; 6569 ire->ire_ipif_seqid = in_ire->ire_ipif_seqid; 6570 ire->ire_ipif = in_ire->ire_ipif; 6571 ire->ire_stq = in_ire->ire_stq; 6572 ill = ire_to_ill(ire); 6573 ire->ire_stq_ifindex = ill->ill_phyint->phyint_ifindex; 6574 ire->ire_zoneid = in_ire->ire_zoneid; 6575 ire->ire_ipst = ipst; 6576 6577 /* 6578 * ire_freemblk will be called when ire_mp is freed, both for 6579 * successful and failed arp resolution. IRE_MARK_UNCACHED will be set 6580 * when the arp resolution failed. 6581 */ 6582 ire->ire_marks |= IRE_MARK_UNCACHED; 6583 ire->ire_mp = ire_mp; 6584 ire_mp->b_wptr = (uchar_t *)&ire[1]; 6585 ire_mp->b_cont = NULL; 6586 ASSERT(dlureq_mp != NULL); 6587 linkb(dlureq_mp, ire_mp); 6588 6589 /* 6590 * Fill in the source and dest addrs for the resolver. 6591 * NOTE: this depends on memory layouts imposed by 6592 * ill_init(). 6593 */ 6594 areq = (areq_t *)dlureq_mp->b_rptr; 6595 addrp = (ipaddr_t *)((char *)areq + areq->areq_sender_addr_offset); 6596 *addrp = ire->ire_src_addr; 6597 6598 addrp = (ipaddr_t *)((char *)areq + areq->areq_target_addr_offset); 6599 if (ire->ire_gateway_addr != INADDR_ANY) { 6600 *addrp = ire->ire_gateway_addr; 6601 } else { 6602 *addrp = ire->ire_addr; 6603 } 6604 6605 /* Up to the resolver. */ 6606 if (canputnext(dst_ill->ill_rq)) { 6607 putnext(dst_ill->ill_rq, dlureq_mp); 6608 } else { 6609 /* Prepare for cleanup */ 6610 freemsg(dlureq_mp); 6611 } 6612 } 6613 6614 /* 6615 * Esballoc free function for AR_ENTRY_QUERY request to clean up any 6616 * unresolved ire_t and/or nce_t structures when ARP resolution fails. 6617 * 6618 * This function can be called by ARP via free routine for ire_mp or 6619 * by IPv4(both host and forwarding path) via ire_delete 6620 * in case ARP resolution fails. 6621 * NOTE: Since IP is MT, ARP can call into IP but not vice versa 6622 * (for IP to talk to ARP, it still has to send AR* messages). 6623 * 6624 * Note that the ARP/IP merge should replace the functioanlity by providing 6625 * direct function calls to clean up unresolved entries in ire/nce lists. 6626 */ 6627 void 6628 ire_freemblk(ire_t *ire_mp) 6629 { 6630 nce_t *nce = NULL; 6631 ill_t *ill; 6632 ip_stack_t *ipst; 6633 6634 ASSERT(ire_mp != NULL); 6635 6636 if ((ire_mp->ire_addr == NULL) && (ire_mp->ire_gateway_addr == NULL)) { 6637 ip1dbg(("ire_freemblk(0x%p) ire_addr is NULL\n", 6638 (void *)ire_mp)); 6639 goto cleanup; 6640 } 6641 if ((ire_mp->ire_marks & IRE_MARK_UNCACHED) == 0) { 6642 goto cleanup; /* everything succeeded. just free and return */ 6643 } 6644 6645 /* 6646 * the arp information corresponding to this ire_mp was not 6647 * transferred to a ire_cache entry. Need 6648 * to clean up incomplete ire's and nce, if necessary. 6649 */ 6650 ASSERT(ire_mp->ire_stq != NULL); 6651 ASSERT(ire_mp->ire_stq_ifindex != 0); 6652 ASSERT(ire_mp->ire_ipst != NULL); 6653 6654 ipst = ire_mp->ire_ipst; 6655 6656 /* 6657 * Get any nce's corresponding to this ire_mp. We first have to 6658 * make sure that the ill is still around. 6659 */ 6660 ill = ill_lookup_on_ifindex(ire_mp->ire_stq_ifindex, 6661 B_FALSE, NULL, NULL, NULL, NULL, ipst); 6662 if (ill == NULL || (ire_mp->ire_stq != ill->ill_wq) || 6663 (ill->ill_state_flags & ILL_CONDEMNED)) { 6664 /* 6665 * ill went away. no nce to clean up. 6666 * Note that the ill_state_flags could be set to 6667 * ILL_CONDEMNED after this point, but if we know 6668 * that it is CONDEMNED now, we just bail out quickly. 6669 */ 6670 if (ill != NULL) 6671 ill_refrele(ill); 6672 goto cleanup; 6673 } 6674 nce = ndp_lookup_v4(ill, 6675 ((ire_mp->ire_gateway_addr != INADDR_ANY) ? 6676 &ire_mp->ire_gateway_addr : &ire_mp->ire_addr), 6677 B_FALSE); 6678 ill_refrele(ill); 6679 6680 if ((nce != NULL) && (nce->nce_state != ND_REACHABLE)) { 6681 /* 6682 * some incomplete nce was found. 6683 */ 6684 DTRACE_PROBE2(ire__freemblk__arp__resolv__fail, 6685 nce_t *, nce, ire_t *, ire_mp); 6686 /* 6687 * Send the icmp_unreachable messages for the queued mblks in 6688 * ire->ire_nce->nce_qd_mp, since ARP resolution failed 6689 * for this ire 6690 */ 6691 arp_resolv_failed(nce); 6692 /* 6693 * Delete the nce and clean up all ire's pointing at this nce 6694 * in the cachetable 6695 */ 6696 ndp_delete(nce); 6697 } 6698 if (nce != NULL) 6699 NCE_REFRELE(nce); /* release the ref taken by ndp_lookup_v4 */ 6700 6701 cleanup: 6702 /* 6703 * Get rid of the ire buffer 6704 * We call kmem_free here(instead of ire_delete()), since 6705 * this is the freeb's callback. 6706 */ 6707 kmem_free(ire_mp, sizeof (ire_t) + sizeof (frtn_t)); 6708 } 6709 6710 /* 6711 * The mp passed to this function is typically res_mp. 6712 * Note that res_mp field can contain the request (ie AR_ENTRY_QUERY) 6713 * or the response (ie DL_UNITDATA_REQ). So in case of the 6714 * forwarding path, there is a small window of time between the two 6715 * when the forwarding path creates an unresolved nce and the 6716 * ip_newroute path finds this and uses this in the creation of an 6717 * ire cache. To account for this possible race case we we check 6718 * for DL_UNITDATA_REQ to make sure this is indeed the response. 6719 */ 6720 boolean_t 6721 ire_nce_valid_dlureq_mp(mblk_t *mp) 6722 { 6723 dl_unitdata_req_t *dlur; 6724 6725 if (mp == NULL) 6726 return (B_FALSE); 6727 dlur = (dl_unitdata_req_t *)mp->b_rptr; 6728 if ((DB_TYPE(mp) == M_PROTO) && 6729 (dlur->dl_primitive == DL_UNITDATA_REQ)) { 6730 return (B_TRUE); 6731 } else { 6732 return (B_FALSE); 6733 } 6734 } 6735 6736 /* 6737 * create the neighbor cache entry nce_t for IRE_CACHE and 6738 * non-loopback IRE_BROADCAST ire's. Note that IRE_BROADCAST 6739 * (non-loopback) entries have the nce_res_mp set to the 6740 * template passed in (generated from ill_bcast_mp); IRE_CACHE ire's 6741 * contain the information for the nexthop (ire_gateway_addr) in the 6742 * case of indirect routes, and for the dst itself (ire_addr) in the 6743 * case of direct routes, with the nce_res_mp containing a template 6744 * DL_UNITDATA request. 6745 * 6746 * This function always consumes res_mp and fp_mp. 6747 * 6748 * The actual association of the ire_nce to the nce created here is 6749 * typically done in ire_add_v4 for IRE_CACHE entries. Exceptions 6750 * to this rule are SO_DONTROUTE ire's (IRE_MARK_NO_ADD), for which 6751 * the ire_nce assignment is done in ire_add_then_send, and mobile-ip 6752 * where the assignment is done in ire_add_mrtun(). 6753 */ 6754 int 6755 ire_nce_init(ire_t *ire, mblk_t *fp_mp, mblk_t *res_mp) 6756 { 6757 in_addr_t addr4, mask4; 6758 int err; 6759 nce_t *arpce = NULL; 6760 ill_t *ire_ill; 6761 uint16_t nce_state, nce_flags; 6762 ip_stack_t *ipst; 6763 6764 if (ire->ire_stq == NULL) { 6765 if (res_mp) 6766 freemsg(res_mp); 6767 if (fp_mp) 6768 freemsg(fp_mp); 6769 return (0); /* no need to create nce for local/loopback */ 6770 } 6771 6772 mask4 = IP_HOST_MASK; 6773 switch (ire->ire_type) { 6774 case IRE_CACHE: 6775 if (ire->ire_gateway_addr != INADDR_ANY) 6776 addr4 = ire->ire_gateway_addr; /* 'G' route */ 6777 else 6778 addr4 = ire->ire_addr; /* direct route */ 6779 break; 6780 case IRE_BROADCAST: 6781 addr4 = ire->ire_addr; 6782 break; 6783 default: 6784 if (res_mp) 6785 freemsg(res_mp); 6786 if (fp_mp) 6787 freemsg(fp_mp); 6788 return (0); 6789 } 6790 6791 /* 6792 * ire_ipif is picked based on RTF_SETSRC, usesrc etc. 6793 * rules in ire_forward_src_ipif. We want the dlureq_mp 6794 * for the outgoing interface, which we get from the ire_stq. 6795 */ 6796 ire_ill = ire_to_ill(ire); 6797 ipst = ire_ill->ill_ipst; 6798 6799 /* 6800 * if we are creating an nce for the first time, and this is 6801 * a NORESOLVER interface, atomically create the nce in the 6802 * REACHABLE state; else create it in the ND_INITIAL state. 6803 */ 6804 if (ire_ill->ill_net_type == IRE_IF_NORESOLVER) { 6805 nce_state = ND_REACHABLE; 6806 nce_flags = NCE_F_PERMANENT; 6807 } else { 6808 /* Make sure you have the response and not the request. */ 6809 if (ire_nce_valid_dlureq_mp(res_mp)) { 6810 nce_state = ND_REACHABLE; 6811 } else { 6812 nce_state = ND_INITIAL; 6813 ASSERT(fp_mp == NULL); 6814 } 6815 nce_flags = 0; 6816 } 6817 6818 retry_nce: 6819 err = ndp_lookup_then_add(ire_ill, NULL, 6820 &addr4, &mask4, NULL, 0, nce_flags, nce_state, &arpce, 6821 fp_mp, res_mp); 6822 6823 if (err == EEXIST && NCE_EXPIRED(arpce, ipst)) { 6824 /* 6825 * We looked up an expired nce. 6826 * Go back and try to create one again. 6827 * The res_mp should be intact for the EEXIST case, 6828 * i.e., there are no new references to it, and there 6829 * is no need to copyb it. 6830 */ 6831 ndp_delete(arpce); 6832 NCE_REFRELE(arpce); 6833 arpce = NULL; 6834 goto retry_nce; 6835 } 6836 6837 ip1dbg(("ire 0x%p addr 0x%lx mask 0x%lx type 0x%x; " 6838 "found nce 0x%p err %d\n", (void *)ire, (ulong_t)addr4, 6839 (ulong_t)mask4, ire->ire_type, (void *)arpce, err)); 6840 6841 switch (err) { 6842 case 0: 6843 break; 6844 case EEXIST: 6845 /* 6846 * return a pointer to an existing nce_t; 6847 * note that the ire-nce mapping is many-one, i.e., 6848 * multiple ire's could point to the same nce_t; 6849 */ 6850 if (fp_mp != NULL) { 6851 freemsg(fp_mp); 6852 } 6853 if (res_mp != NULL) { 6854 freemsg(res_mp); 6855 } 6856 break; 6857 default: 6858 DTRACE_PROBE2(nce__init__fail, ill_t *, ire_ill, int, err); 6859 if (res_mp) 6860 freemsg(res_mp); 6861 if (fp_mp) 6862 freemsg(fp_mp); 6863 return (EINVAL); 6864 } 6865 #if DEBUG 6866 /* 6867 * If an nce_fp_mp was passed in by ndp_lookup_then_add() 6868 * we should be picking up an existing nce_t in 6869 * the ND_REACHABLE state. 6870 */ 6871 mutex_enter(&arpce->nce_lock); 6872 ASSERT(arpce->nce_fp_mp == NULL || arpce->nce_state == ND_REACHABLE); 6873 mutex_exit(&arpce->nce_lock); 6874 #endif 6875 if (ire->ire_type == IRE_BROADCAST) { 6876 /* 6877 * Two bcast ires are created for each interface; 6878 * 1. loopback copy (which does not have an 6879 * ire_stq, and therefore has no ire_nce), and, 6880 * 2. the non-loopback copy, which has the nce_res_mp 6881 * initialized to a copy of the ill_bcast_mp, and 6882 * is marked as ND_REACHABLE at this point. 6883 * This nce does not undergo any further state changes, 6884 * and exists as long as the interface is plumbed. 6885 * Note: we do the ire_nce assignment here for IRE_BROADCAST 6886 * because some functions like ill_mark_bcast() inline the 6887 * ire_add functionality; 6888 */ 6889 mutex_enter(&arpce->nce_lock); 6890 arpce->nce_state = ND_REACHABLE; 6891 arpce->nce_flags |= (NCE_F_PERMANENT | NCE_F_BCAST); 6892 arpce->nce_last = TICK_TO_MSEC(lbolt64); 6893 ire->ire_nce = arpce; 6894 mutex_exit(&arpce->nce_lock); 6895 /* 6896 * We are associating this nce to the ire, 6897 * so change the nce ref taken in 6898 * ndp_lookup_then_add_v4() from 6899 * NCE_REFHOLD to NCE_REFHOLD_NOTR 6900 */ 6901 NCE_REFHOLD_TO_REFHOLD_NOTR(ire->ire_nce); 6902 } else { 6903 /* 6904 * We are not using this nce_t just yet so release 6905 * the ref taken in ndp_lookup_then_add_v4() 6906 */ 6907 NCE_REFRELE(arpce); 6908 } 6909 return (0); 6910 } 6911