1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 1990 Mentat Inc. 27 */ 28 29 /* 30 * This file contains the interface control functions for IPv6. 31 */ 32 33 #include <sys/types.h> 34 #include <sys/sysmacros.h> 35 #include <sys/stream.h> 36 #include <sys/dlpi.h> 37 #include <sys/stropts.h> 38 #include <sys/ddi.h> 39 #include <sys/cmn_err.h> 40 #include <sys/kstat.h> 41 #include <sys/debug.h> 42 #include <sys/zone.h> 43 #include <sys/policy.h> 44 45 #include <sys/systm.h> 46 #include <sys/param.h> 47 #include <sys/socket.h> 48 #include <sys/isa_defs.h> 49 #include <net/if.h> 50 #include <net/if_dl.h> 51 #include <net/route.h> 52 #include <netinet/in.h> 53 #include <netinet/igmp_var.h> 54 #include <netinet/ip6.h> 55 #include <netinet/icmp6.h> 56 57 #include <inet/common.h> 58 #include <inet/nd.h> 59 #include <inet/mib2.h> 60 #include <inet/ip.h> 61 #include <inet/ip6.h> 62 #include <inet/ip_multi.h> 63 #include <inet/ip_ire.h> 64 #include <inet/ip_rts.h> 65 #include <inet/ip_ndp.h> 66 #include <inet/ip_if.h> 67 #include <inet/ip6_asp.h> 68 #include <inet/ipclassifier.h> 69 #include <inet/sctp_ip.h> 70 71 #include <sys/tsol/tndb.h> 72 #include <sys/tsol/tnet.h> 73 74 static in6_addr_t ipv6_ll_template = 75 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 76 77 static ipif_t * 78 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 79 ip_stack_t *ipst); 80 81 static int ipif_add_ires_v6(ipif_t *, boolean_t); 82 83 /* 84 * This function is called when an application does not specify an interface 85 * to be used for multicast traffic. It calls ire_lookup_multi_v6() to look 86 * for an interface route for the specified multicast group. Doing 87 * this allows the administrator to add prefix routes for multicast to 88 * indicate which interface to be used for multicast traffic in the above 89 * scenario. The route could be for all multicast (ff00::/8), for a single 90 * multicast group (a /128 route) or anything in between. If there is no 91 * such multicast route, we just find any multicast capable interface and 92 * return it. 93 * 94 * We support MULTIRT and RTF_SETSRC on the multicast routes added to the 95 * unicast table. This is used by CGTP. 96 */ 97 ill_t * 98 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst, 99 boolean_t *multirtp, in6_addr_t *setsrcp) 100 { 101 ill_t *ill; 102 103 ill = ire_lookup_multi_ill_v6(group, zoneid, ipst, multirtp, setsrcp); 104 if (ill != NULL) 105 return (ill); 106 107 return (ill_lookup_multicast(ipst, zoneid, B_TRUE)); 108 } 109 110 /* 111 * Look for an ipif with the specified interface address and destination. 112 * The destination address is used only for matching point-to-point interfaces. 113 */ 114 static ipif_t * 115 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 116 ip_stack_t *ipst) 117 { 118 ipif_t *ipif; 119 ill_t *ill; 120 ill_walk_context_t ctx; 121 122 /* 123 * First match all the point-to-point interfaces 124 * before looking at non-point-to-point interfaces. 125 * This is done to avoid returning non-point-to-point 126 * ipif instead of unnumbered point-to-point ipif. 127 */ 128 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 129 ill = ILL_START_WALK_V6(&ctx, ipst); 130 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 131 mutex_enter(&ill->ill_lock); 132 for (ipif = ill->ill_ipif; ipif != NULL; 133 ipif = ipif->ipif_next) { 134 /* Allow the ipif to be down */ 135 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 136 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 137 if_addr)) && 138 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 139 dst))) { 140 if (!IPIF_IS_CONDEMNED(ipif)) { 141 ipif_refhold_locked(ipif); 142 mutex_exit(&ill->ill_lock); 143 rw_exit(&ipst->ips_ill_g_lock); 144 return (ipif); 145 } 146 } 147 } 148 mutex_exit(&ill->ill_lock); 149 } 150 rw_exit(&ipst->ips_ill_g_lock); 151 /* lookup the ipif based on interface address */ 152 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, ipst); 153 ASSERT(ipif == NULL || ipif->ipif_isv6); 154 return (ipif); 155 } 156 157 /* 158 * Common function for ipif_lookup_addr_v6() and ipif_lookup_addr_exact_v6(). 159 */ 160 static ipif_t * 161 ipif_lookup_addr_common_v6(const in6_addr_t *addr, ill_t *match_ill, 162 uint32_t match_flags, zoneid_t zoneid, ip_stack_t *ipst) 163 { 164 ipif_t *ipif; 165 ill_t *ill; 166 boolean_t ptp = B_FALSE; 167 ill_walk_context_t ctx; 168 boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP); 169 boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP); 170 171 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 172 /* 173 * Repeat twice, first based on local addresses and 174 * next time for pointopoint. 175 */ 176 repeat: 177 ill = ILL_START_WALK_V6(&ctx, ipst); 178 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 179 if (match_ill != NULL && ill != match_ill && 180 (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) { 181 continue; 182 } 183 mutex_enter(&ill->ill_lock); 184 for (ipif = ill->ill_ipif; ipif != NULL; 185 ipif = ipif->ipif_next) { 186 if (zoneid != ALL_ZONES && 187 ipif->ipif_zoneid != zoneid && 188 ipif->ipif_zoneid != ALL_ZONES) 189 continue; 190 191 if (no_duplicate && 192 !(ipif->ipif_flags & IPIF_UP)) { 193 continue; 194 } 195 196 /* Allow the ipif to be down */ 197 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 198 &ipif->ipif_v6lcl_addr, addr) && 199 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 200 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 201 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 202 addr))) { 203 if (!IPIF_IS_CONDEMNED(ipif)) { 204 ipif_refhold_locked(ipif); 205 mutex_exit(&ill->ill_lock); 206 rw_exit(&ipst->ips_ill_g_lock); 207 return (ipif); 208 } 209 } 210 } 211 mutex_exit(&ill->ill_lock); 212 } 213 214 /* If we already did the ptp case, then we are done */ 215 if (ptp) { 216 rw_exit(&ipst->ips_ill_g_lock); 217 return (NULL); 218 } 219 ptp = B_TRUE; 220 goto repeat; 221 } 222 223 /* 224 * Lookup an ipif with the specified address. For point-to-point links we 225 * look for matches on either the destination address or the local address, 226 * but we skip the local address check if IPIF_UNNUMBERED is set. If the 227 * `match_ill' argument is non-NULL, the lookup is restricted to that ill 228 * (or illgrp if `match_ill' is in an IPMP group). 229 */ 230 ipif_t * 231 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 232 ip_stack_t *ipst) 233 { 234 return (ipif_lookup_addr_common_v6(addr, match_ill, IPIF_MATCH_ILLGRP, 235 zoneid, ipst)); 236 } 237 238 /* 239 * Lookup an ipif with the specified address. Similar to ipif_lookup_addr, 240 * except that we will only return an address if it is not marked as 241 * IPIF_DUPLICATE 242 */ 243 ipif_t * 244 ipif_lookup_addr_nondup_v6(const in6_addr_t *addr, ill_t *match_ill, 245 zoneid_t zoneid, ip_stack_t *ipst) 246 { 247 return (ipif_lookup_addr_common_v6(addr, match_ill, 248 (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP), zoneid, 249 ipst)); 250 } 251 252 /* 253 * Special abbreviated version of ipif_lookup_addr_v6() that doesn't match 254 * `match_ill' across the IPMP group. This function is only needed in some 255 * corner-cases; almost everything should use ipif_lookup_addr_v6(). 256 */ 257 ipif_t * 258 ipif_lookup_addr_exact_v6(const in6_addr_t *addr, ill_t *match_ill, 259 ip_stack_t *ipst) 260 { 261 ASSERT(match_ill != NULL); 262 return (ipif_lookup_addr_common_v6(addr, match_ill, 0, ALL_ZONES, 263 ipst)); 264 } 265 266 /* 267 * Look for an ipif with the specified address. For point-point links 268 * we look for matches on either the destination address and the local 269 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 270 * is set. 271 * If the `match_ill' argument is non-NULL, the lookup is restricted to that 272 * ill (or illgrp if `match_ill' is in an IPMP group). 273 * Return the zoneid for the ipif. ALL_ZONES if none found. 274 */ 275 zoneid_t 276 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill, 277 ip_stack_t *ipst) 278 { 279 ipif_t *ipif; 280 ill_t *ill; 281 boolean_t ptp = B_FALSE; 282 ill_walk_context_t ctx; 283 zoneid_t zoneid; 284 285 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 286 /* 287 * Repeat twice, first based on local addresses and 288 * next time for pointopoint. 289 */ 290 repeat: 291 ill = ILL_START_WALK_V6(&ctx, ipst); 292 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 293 if (match_ill != NULL && ill != match_ill && 294 !IS_IN_SAME_ILLGRP(ill, match_ill)) { 295 continue; 296 } 297 mutex_enter(&ill->ill_lock); 298 for (ipif = ill->ill_ipif; ipif != NULL; 299 ipif = ipif->ipif_next) { 300 /* Allow the ipif to be down */ 301 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 302 &ipif->ipif_v6lcl_addr, addr) && 303 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 304 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 305 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 306 addr)) && 307 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) { 308 zoneid = ipif->ipif_zoneid; 309 mutex_exit(&ill->ill_lock); 310 rw_exit(&ipst->ips_ill_g_lock); 311 /* 312 * If ipif_zoneid was ALL_ZONES then we have 313 * a trusted extensions shared IP address. 314 * In that case GLOBAL_ZONEID works to send. 315 */ 316 if (zoneid == ALL_ZONES) 317 zoneid = GLOBAL_ZONEID; 318 return (zoneid); 319 } 320 } 321 mutex_exit(&ill->ill_lock); 322 } 323 324 /* If we already did the ptp case, then we are done */ 325 if (ptp) { 326 rw_exit(&ipst->ips_ill_g_lock); 327 return (ALL_ZONES); 328 } 329 ptp = B_TRUE; 330 goto repeat; 331 } 332 333 /* 334 * Perform various checks to verify that an address would make sense as a local 335 * interface address. This is currently only called when an attempt is made 336 * to set a local address. 337 * 338 * Does not allow a v4-mapped address, an address that equals the subnet 339 * anycast address, ... a multicast address, ... 340 */ 341 boolean_t 342 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 343 { 344 in6_addr_t subnet; 345 346 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 347 return (B_TRUE); /* Allow all zeros */ 348 349 /* 350 * Don't allow all zeroes or host part, but allow 351 * all ones netmask. 352 */ 353 V6_MASK_COPY(*addr, *subnet_mask, subnet); 354 if (IN6_IS_ADDR_V4MAPPED(addr) || 355 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 356 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 357 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 358 IN6_IS_ADDR_MULTICAST(addr)) 359 return (B_FALSE); 360 361 return (B_TRUE); 362 } 363 364 /* 365 * Perform various checks to verify that an address would make sense as a 366 * remote/subnet interface address. 367 */ 368 boolean_t 369 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 370 { 371 in6_addr_t subnet; 372 373 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 374 return (B_TRUE); /* Allow all zeros */ 375 376 V6_MASK_COPY(*addr, *subnet_mask, subnet); 377 if (IN6_IS_ADDR_V4MAPPED(addr) || 378 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 379 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 380 IN6_IS_ADDR_MULTICAST(addr) || 381 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 382 return (B_FALSE); 383 384 return (B_TRUE); 385 } 386 387 /* 388 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 389 * ill is passed in to associate it with the correct interface 390 * (for link-local destinations and gateways). 391 * If ire_arg is set, then we return the held IRE in that location. 392 */ 393 /* ARGSUSED1 */ 394 int 395 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 396 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 397 ill_t *ill, ire_t **ire_arg, struct rtsa_s *sp, ip_stack_t *ipst, 398 zoneid_t zoneid) 399 { 400 ire_t *ire, *nire; 401 ire_t *gw_ire = NULL; 402 ipif_t *ipif; 403 uint_t type; 404 int match_flags = MATCH_IRE_TYPE; 405 tsol_gc_t *gc = NULL; 406 tsol_gcgrp_t *gcgrp = NULL; 407 boolean_t gcgrp_xtraref = B_FALSE; 408 boolean_t unbound = B_FALSE; 409 410 if (ire_arg != NULL) 411 *ire_arg = NULL; 412 413 /* 414 * Prevent routes with a zero gateway from being created (since 415 * interfaces can currently be plumbed and brought up with no assigned 416 * address). 417 */ 418 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 419 return (ENETUNREACH); 420 421 /* 422 * If this is the case of RTF_HOST being set, then we set the netmask 423 * to all ones (regardless if one was supplied). 424 */ 425 if (flags & RTF_HOST) 426 mask = &ipv6_all_ones; 427 428 /* 429 * Get the ipif, if any, corresponding to the gw_addr 430 * If -ifp was specified we restrict ourselves to the ill, otherwise 431 * we match on the gatway and destination to handle unnumbered pt-pt 432 * interfaces. 433 */ 434 if (ill != NULL) 435 ipif = ipif_lookup_addr_v6(gw_addr, ill, ALL_ZONES, ipst); 436 else 437 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst); 438 if (ipif != NULL) { 439 if (IS_VNI(ipif->ipif_ill)) { 440 ipif_refrele(ipif); 441 return (EINVAL); 442 } 443 } 444 445 /* 446 * GateD will attempt to create routes with a loopback interface 447 * address as the gateway and with RTF_GATEWAY set. We allow 448 * these routes to be added, but create them as interface routes 449 * since the gateway is an interface address. 450 */ 451 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) { 452 flags &= ~RTF_GATEWAY; 453 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) && 454 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) && 455 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) { 456 ire = ire_ftable_lookup_v6(dst_addr, 0, 0, IRE_LOOPBACK, 457 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst, 458 NULL); 459 if (ire != NULL) { 460 ire_refrele(ire); 461 ipif_refrele(ipif); 462 return (EEXIST); 463 } 464 ip1dbg(("ip_rt_add_v6: 0x%p creating IRE 0x%x" 465 "for 0x%x\n", (void *)ipif, 466 ipif->ipif_ire_type, 467 ntohl(ipif->ipif_lcl_addr))); 468 ire = ire_create_v6( 469 dst_addr, 470 mask, 471 NULL, 472 ipif->ipif_ire_type, /* LOOPBACK */ 473 ipif->ipif_ill, 474 zoneid, 475 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 476 NULL, 477 ipst); 478 479 if (ire == NULL) { 480 ipif_refrele(ipif); 481 return (ENOMEM); 482 } 483 /* src address assigned by the caller? */ 484 if ((flags & RTF_SETSRC) && 485 !IN6_IS_ADDR_UNSPECIFIED(src_addr)) 486 ire->ire_setsrc_addr_v6 = *src_addr; 487 488 nire = ire_add(ire); 489 if (nire == NULL) { 490 /* 491 * In the result of failure, ire_add() will have 492 * already deleted the ire in question, so there 493 * is no need to do that here. 494 */ 495 ipif_refrele(ipif); 496 return (ENOMEM); 497 } 498 /* 499 * Check if it was a duplicate entry. This handles 500 * the case of two racing route adds for the same route 501 */ 502 if (nire != ire) { 503 ASSERT(nire->ire_identical_ref > 1); 504 ire_delete(nire); 505 ire_refrele(nire); 506 ipif_refrele(ipif); 507 return (EEXIST); 508 } 509 ire = nire; 510 goto save_ire; 511 } 512 } 513 514 /* 515 * The routes for multicast with CGTP are quite special in that 516 * the gateway is the local interface address, yet RTF_GATEWAY 517 * is set. We turn off RTF_GATEWAY to provide compatibility with 518 * this undocumented and unusual use of multicast routes. 519 */ 520 if ((flags & RTF_MULTIRT) && ipif != NULL) 521 flags &= ~RTF_GATEWAY; 522 523 /* 524 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 525 * and the gateway address provided is one of the system's interface 526 * addresses. By using the routing socket interface and supplying an 527 * RTA_IFP sockaddr with an interface index, an alternate method of 528 * specifying an interface route to be created is available which uses 529 * the interface index that specifies the outgoing interface rather than 530 * the address of an outgoing interface (which may not be able to 531 * uniquely identify an interface). When coupled with the RTF_GATEWAY 532 * flag, routes can be specified which not only specify the next-hop to 533 * be used when routing to a certain prefix, but also which outgoing 534 * interface should be used. 535 * 536 * Previously, interfaces would have unique addresses assigned to them 537 * and so the address assigned to a particular interface could be used 538 * to identify a particular interface. One exception to this was the 539 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 540 * 541 * With the advent of IPv6 and its link-local addresses, this 542 * restriction was relaxed and interfaces could share addresses between 543 * themselves. In fact, typically all of the link-local interfaces on 544 * an IPv6 node or router will have the same link-local address. In 545 * order to differentiate between these interfaces, the use of an 546 * interface index is necessary and this index can be carried inside a 547 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 548 * of using the interface index, however, is that all of the ipif's that 549 * are part of an ill have the same index and so the RTA_IFP sockaddr 550 * cannot be used to differentiate between ipif's (or logical 551 * interfaces) that belong to the same ill (physical interface). 552 * 553 * For example, in the following case involving IPv4 interfaces and 554 * logical interfaces 555 * 556 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 557 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0 558 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0 559 * 560 * the ipif's corresponding to each of these interface routes can be 561 * uniquely identified by the "gateway" (actually interface address). 562 * 563 * In this case involving multiple IPv6 default routes to a particular 564 * link-local gateway, the use of RTA_IFP is necessary to specify which 565 * default route is of interest: 566 * 567 * default fe80::123:4567:89ab:cdef U if0 568 * default fe80::123:4567:89ab:cdef U if1 569 */ 570 571 /* RTF_GATEWAY not set */ 572 if (!(flags & RTF_GATEWAY)) { 573 if (sp != NULL) { 574 ip2dbg(("ip_rt_add_v6: gateway security attributes " 575 "cannot be set with interface route\n")); 576 if (ipif != NULL) 577 ipif_refrele(ipif); 578 return (EINVAL); 579 } 580 581 /* 582 * Whether or not ill (RTA_IFP) is set, we require that 583 * the gateway is one of our local addresses. 584 */ 585 if (ipif == NULL) 586 return (ENETUNREACH); 587 588 /* 589 * We use MATCH_IRE_ILL here. If the caller specified an 590 * interface (from the RTA_IFP sockaddr) we use it, otherwise 591 * we use the ill derived from the gateway address. 592 * We can always match the gateway address since we record it 593 * in ire_gateway_addr. 594 * We don't allow RTA_IFP to specify a different ill than the 595 * one matching the ipif to make sure we can delete the route. 596 */ 597 match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL; 598 if (ill == NULL) { 599 ill = ipif->ipif_ill; 600 } else if (ill != ipif->ipif_ill) { 601 ipif_refrele(ipif); 602 return (EINVAL); 603 } 604 605 /* 606 * We check for an existing entry at this point. 607 */ 608 match_flags |= MATCH_IRE_MASK; 609 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, 610 IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst, 611 NULL); 612 if (ire != NULL) { 613 ire_refrele(ire); 614 ipif_refrele(ipif); 615 return (EEXIST); 616 } 617 618 /* 619 * Some software (for example, GateD and Sun Cluster) attempts 620 * to create (what amount to) IRE_PREFIX routes with the 621 * loopback address as the gateway. This is primarily done to 622 * set up prefixes with the RTF_REJECT flag set (for example, 623 * when generating aggregate routes). We also OR in the 624 * RTF_BLACKHOLE flag as these interface routes, by 625 * definition, can only be that. 626 * 627 * If the IRE type (as defined by ill->ill_net_type) would be 628 * IRE_LOOPBACK, then we map the request into a 629 * IRE_IF_NORESOLVER. 630 * 631 * Needless to say, the real IRE_LOOPBACK is NOT created by this 632 * routine, but rather using ire_create_v6() directly. 633 */ 634 type = ill->ill_net_type; 635 if (type == IRE_LOOPBACK) { 636 type = IRE_IF_NORESOLVER; 637 flags |= RTF_BLACKHOLE; 638 } 639 640 /* 641 * Create a copy of the IRE_IF_NORESOLVER or 642 * IRE_IF_RESOLVER with the modified address, netmask, and 643 * gateway. 644 */ 645 ire = ire_create_v6( 646 dst_addr, 647 mask, 648 gw_addr, 649 type, 650 ill, 651 zoneid, 652 flags, 653 NULL, 654 ipst); 655 if (ire == NULL) { 656 ipif_refrele(ipif); 657 return (ENOMEM); 658 } 659 660 /* src address assigned by the caller? */ 661 if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) 662 ire->ire_setsrc_addr_v6 = *src_addr; 663 664 nire = ire_add(ire); 665 if (nire == NULL) { 666 /* 667 * In the result of failure, ire_add() will have 668 * already deleted the ire in question, so there 669 * is no need to do that here. 670 */ 671 ipif_refrele(ipif); 672 return (ENOMEM); 673 } 674 /* 675 * Check if it was a duplicate entry. This handles 676 * the case of two racing route adds for the same route 677 */ 678 if (nire != ire) { 679 ASSERT(nire->ire_identical_ref > 1); 680 ire_delete(nire); 681 ire_refrele(nire); 682 ipif_refrele(ipif); 683 return (EEXIST); 684 } 685 ire = nire; 686 goto save_ire; 687 } 688 689 /* 690 * Get an interface IRE for the specified gateway. 691 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 692 * gateway, it is currently unreachable and we fail the request 693 * accordingly. We reject any RTF_GATEWAY routes where the gateway 694 * is an IRE_LOCAL or IRE_LOOPBACK. 695 * If RTA_IFP was specified we look on that particular ill. 696 */ 697 if (ill != NULL) 698 match_flags |= MATCH_IRE_ILL; 699 700 /* Check whether the gateway is reachable. */ 701 again: 702 type = IRE_INTERFACE | IRE_LOCAL | IRE_LOOPBACK; 703 if (flags & RTF_INDIRECT) 704 type |= IRE_OFFLINK; 705 706 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, type, ill, 707 ALL_ZONES, NULL, match_flags, 0, ipst, NULL); 708 if (gw_ire == NULL) { 709 /* 710 * With IPMP, we allow host routes to influence in.mpathd's 711 * target selection. However, if the test addresses are on 712 * their own network, the above lookup will fail since the 713 * underlying IRE_INTERFACEs are marked hidden. So allow 714 * hidden test IREs to be found and try again. 715 */ 716 if (!(match_flags & MATCH_IRE_TESTHIDDEN)) { 717 match_flags |= MATCH_IRE_TESTHIDDEN; 718 goto again; 719 } 720 if (ipif != NULL) 721 ipif_refrele(ipif); 722 return (ENETUNREACH); 723 } 724 if (gw_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) { 725 ire_refrele(gw_ire); 726 if (ipif != NULL) 727 ipif_refrele(ipif); 728 return (ENETUNREACH); 729 } 730 if (ill == NULL && !(flags & RTF_INDIRECT)) { 731 unbound = B_TRUE; 732 if (ipst->ips_ipv6_strict_src_multihoming > 0) 733 ill = gw_ire->ire_ill; 734 } 735 736 /* 737 * We create one of three types of IREs as a result of this request 738 * based on the netmask. A netmask of all ones (which is automatically 739 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 740 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 741 * created. Otherwise, an IRE_PREFIX route is created for the 742 * destination prefix. 743 */ 744 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 745 type = IRE_HOST; 746 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 747 type = IRE_DEFAULT; 748 else 749 type = IRE_PREFIX; 750 751 /* check for a duplicate entry */ 752 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ill, 753 ALL_ZONES, NULL, 754 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, 0, ipst, NULL); 755 if (ire != NULL) { 756 if (ipif != NULL) 757 ipif_refrele(ipif); 758 ire_refrele(gw_ire); 759 ire_refrele(ire); 760 return (EEXIST); 761 } 762 763 /* Security attribute exists */ 764 if (sp != NULL) { 765 tsol_gcgrp_addr_t ga; 766 767 /* find or create the gateway credentials group */ 768 ga.ga_af = AF_INET6; 769 ga.ga_addr = *gw_addr; 770 771 /* we hold reference to it upon success */ 772 gcgrp = gcgrp_lookup(&ga, B_TRUE); 773 if (gcgrp == NULL) { 774 if (ipif != NULL) 775 ipif_refrele(ipif); 776 ire_refrele(gw_ire); 777 return (ENOMEM); 778 } 779 780 /* 781 * Create and add the security attribute to the group; a 782 * reference to the group is made upon allocating a new 783 * entry successfully. If it finds an already-existing 784 * entry for the security attribute in the group, it simply 785 * returns it and no new reference is made to the group. 786 */ 787 gc = gc_create(sp, gcgrp, &gcgrp_xtraref); 788 if (gc == NULL) { 789 /* release reference held by gcgrp_lookup */ 790 GCGRP_REFRELE(gcgrp); 791 if (ipif != NULL) 792 ipif_refrele(ipif); 793 ire_refrele(gw_ire); 794 return (ENOMEM); 795 } 796 } 797 798 /* Create the IRE. */ 799 ire = ire_create_v6( 800 dst_addr, /* dest address */ 801 mask, /* mask */ 802 gw_addr, /* gateway address */ 803 (ushort_t)type, /* IRE type */ 804 ill, 805 zoneid, 806 flags, 807 gc, /* security attribute */ 808 ipst); 809 810 /* 811 * The ire holds a reference to the 'gc' and the 'gc' holds a 812 * reference to the 'gcgrp'. We can now release the extra reference 813 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used. 814 */ 815 if (gcgrp_xtraref) 816 GCGRP_REFRELE(gcgrp); 817 if (ire == NULL) { 818 if (gc != NULL) 819 GC_REFRELE(gc); 820 if (ipif != NULL) 821 ipif_refrele(ipif); 822 ire_refrele(gw_ire); 823 return (ENOMEM); 824 } 825 826 /* src address assigned by the caller? */ 827 if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) 828 ire->ire_setsrc_addr_v6 = *src_addr; 829 830 ire->ire_unbound = unbound; 831 832 /* 833 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 834 * SUN/OS socket stuff does but do we really want to allow ::0 ? 835 */ 836 837 /* Add the new IRE. */ 838 nire = ire_add(ire); 839 if (nire == NULL) { 840 /* 841 * In the result of failure, ire_add() will have 842 * already deleted the ire in question, so there 843 * is no need to do that here. 844 */ 845 if (ipif != NULL) 846 ipif_refrele(ipif); 847 ire_refrele(gw_ire); 848 return (ENOMEM); 849 } 850 /* 851 * Check if it was a duplicate entry. This handles 852 * the case of two racing route adds for the same route 853 */ 854 if (nire != ire) { 855 ASSERT(nire->ire_identical_ref > 1); 856 ire_delete(nire); 857 ire_refrele(nire); 858 if (ipif != NULL) 859 ipif_refrele(ipif); 860 ire_refrele(gw_ire); 861 return (EEXIST); 862 } 863 ire = nire; 864 865 if (flags & RTF_MULTIRT) { 866 /* 867 * Invoke the CGTP (multirouting) filtering module 868 * to add the dst address in the filtering database. 869 * Replicated inbound packets coming from that address 870 * will be filtered to discard the duplicates. 871 * It is not necessary to call the CGTP filter hook 872 * when the dst address is a multicast, because an 873 * IP source address cannot be a multicast. 874 */ 875 if (ipst->ips_ip_cgtp_filter_ops != NULL && 876 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 877 int res; 878 ipif_t *src_ipif; 879 880 /* Find the source address corresponding to gw_ire */ 881 src_ipif = ipif_lookup_addr_v6( 882 &gw_ire->ire_gateway_addr_v6, NULL, zoneid, ipst); 883 if (src_ipif != NULL) { 884 res = ipst->ips_ip_cgtp_filter_ops-> 885 cfo_add_dest_v6( 886 ipst->ips_netstack->netstack_stackid, 887 &ire->ire_addr_v6, 888 &ire->ire_gateway_addr_v6, 889 &ire->ire_setsrc_addr_v6, 890 &src_ipif->ipif_v6lcl_addr); 891 ipif_refrele(src_ipif); 892 } else { 893 res = EADDRNOTAVAIL; 894 } 895 if (res != 0) { 896 if (ipif != NULL) 897 ipif_refrele(ipif); 898 ire_refrele(gw_ire); 899 ire_delete(ire); 900 ire_refrele(ire); /* Held in ire_add */ 901 return (res); 902 } 903 } 904 } 905 906 save_ire: 907 if (gw_ire != NULL) { 908 ire_refrele(gw_ire); 909 gw_ire = NULL; 910 } 911 if (ire->ire_ill != NULL) { 912 /* 913 * Save enough information so that we can recreate the IRE if 914 * the ILL goes down and then up. The metrics associated 915 * with the route will be saved as well when rts_setmetrics() is 916 * called after the IRE has been created. In the case where 917 * memory cannot be allocated, none of this information will be 918 * saved. 919 */ 920 ill_save_ire(ire->ire_ill, ire); 921 } 922 923 if (ire_arg != NULL) { 924 /* 925 * Store the ire that was successfully added into where ire_arg 926 * points to so that callers don't have to look it up 927 * themselves (but they are responsible for ire_refrele()ing 928 * the ire when they are finished with it). 929 */ 930 *ire_arg = ire; 931 } else { 932 ire_refrele(ire); /* Held in ire_add */ 933 } 934 if (ipif != NULL) 935 ipif_refrele(ipif); 936 return (0); 937 } 938 939 /* 940 * ip_rt_delete_v6 is called to delete an IPv6 route. 941 * ill is passed in to associate it with the correct interface. 942 * (for link-local destinations and gateways). 943 */ 944 /* ARGSUSED4 */ 945 int 946 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 947 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ill_t *ill, 948 ip_stack_t *ipst, zoneid_t zoneid) 949 { 950 ire_t *ire = NULL; 951 ipif_t *ipif; 952 uint_t type; 953 uint_t match_flags = MATCH_IRE_TYPE; 954 int err = 0; 955 956 /* 957 * If this is the case of RTF_HOST being set, then we set the netmask 958 * to all ones. Otherwise, we use the netmask if one was supplied. 959 */ 960 if (flags & RTF_HOST) { 961 mask = &ipv6_all_ones; 962 match_flags |= MATCH_IRE_MASK; 963 } else if (rtm_addrs & RTA_NETMASK) { 964 match_flags |= MATCH_IRE_MASK; 965 } 966 967 /* 968 * Note that RTF_GATEWAY is never set on a delete, therefore 969 * we check if the gateway address is one of our interfaces first, 970 * and fall back on RTF_GATEWAY routes. 971 * 972 * This makes it possible to delete an original 973 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 974 * However, we have RTF_KERNEL set on the ones created by ipif_up 975 * and those can not be deleted here. 976 * 977 * We use MATCH_IRE_ILL if we know the interface. If the caller 978 * specified an interface (from the RTA_IFP sockaddr) we use it, 979 * otherwise we use the ill derived from the gateway address. 980 * We can always match the gateway address since we record it 981 * in ire_gateway_addr. 982 * 983 * For more detail on specifying routes by gateway address and by 984 * interface index, see the comments in ip_rt_add_v6(). 985 */ 986 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst); 987 if (ipif != NULL) { 988 ill_t *ill_match; 989 990 if (ill != NULL) 991 ill_match = ill; 992 else 993 ill_match = ipif->ipif_ill; 994 995 match_flags |= MATCH_IRE_ILL; 996 if (ipif->ipif_ire_type == IRE_LOOPBACK) { 997 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, 998 IRE_LOOPBACK, ill_match, ALL_ZONES, NULL, 999 match_flags, 0, ipst, NULL); 1000 } 1001 if (ire == NULL) { 1002 match_flags |= MATCH_IRE_GW; 1003 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, 1004 IRE_INTERFACE, ill_match, ALL_ZONES, NULL, 1005 match_flags, 0, ipst, NULL); 1006 } 1007 /* Avoid deleting routes created by kernel from an ipif */ 1008 if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) { 1009 ire_refrele(ire); 1010 ire = NULL; 1011 } 1012 1013 /* Restore in case we didn't find a match */ 1014 match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL); 1015 } 1016 1017 if (ire == NULL) { 1018 /* 1019 * At this point, the gateway address is not one of our own 1020 * addresses or a matching interface route was not found. We 1021 * set the IRE type to lookup based on whether 1022 * this is a host route, a default route or just a prefix. 1023 * 1024 * If an ill was passed in, then the lookup is based on an 1025 * interface index so MATCH_IRE_ILL is added to match_flags. 1026 */ 1027 match_flags |= MATCH_IRE_GW; 1028 if (ill != NULL) 1029 match_flags |= MATCH_IRE_ILL; 1030 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 1031 type = IRE_HOST; 1032 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 1033 type = IRE_DEFAULT; 1034 else 1035 type = IRE_PREFIX; 1036 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 1037 ill, ALL_ZONES, NULL, match_flags, 0, ipst, NULL); 1038 } 1039 1040 if (ipif != NULL) { 1041 ipif_refrele(ipif); 1042 ipif = NULL; 1043 } 1044 if (ire == NULL) 1045 return (ESRCH); 1046 1047 if (ire->ire_flags & RTF_MULTIRT) { 1048 /* 1049 * Invoke the CGTP (multirouting) filtering module 1050 * to remove the dst address from the filtering database. 1051 * Packets coming from that address will no longer be 1052 * filtered to remove duplicates. 1053 */ 1054 if (ipst->ips_ip_cgtp_filter_ops != NULL) { 1055 err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v6( 1056 ipst->ips_netstack->netstack_stackid, 1057 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 1058 } 1059 } 1060 1061 ill = ire->ire_ill; 1062 if (ill != NULL) 1063 ill_remove_saved_ire(ill, ire); 1064 ire_delete(ire); 1065 ire_refrele(ire); 1066 return (err); 1067 } 1068 1069 /* 1070 * Derive an interface id from the link layer address. 1071 */ 1072 void 1073 ill_setdefaulttoken(ill_t *ill) 1074 { 1075 if (!ill->ill_manual_token) { 1076 bzero(&ill->ill_token, sizeof (ill->ill_token)); 1077 MEDIA_V6INTFID(ill->ill_media, ill, &ill->ill_token); 1078 ill->ill_token_length = IPV6_TOKEN_LEN; 1079 } 1080 } 1081 1082 void 1083 ill_setdesttoken(ill_t *ill) 1084 { 1085 bzero(&ill->ill_dest_token, sizeof (ill->ill_dest_token)); 1086 MEDIA_V6DESTINTFID(ill->ill_media, ill, &ill->ill_dest_token); 1087 } 1088 1089 /* 1090 * Create a link-local address from a token. 1091 */ 1092 static void 1093 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 1094 { 1095 int i; 1096 1097 for (i = 0; i < 4; i++) { 1098 dest->s6_addr32[i] = 1099 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 1100 } 1101 } 1102 1103 /* 1104 * Set a default IPv6 address for a 6to4 tunnel interface 2002:<tsrc>::1/16 1105 */ 1106 static void 1107 ipif_set6to4addr(ipif_t *ipif) 1108 { 1109 ill_t *ill = ipif->ipif_ill; 1110 struct in_addr v4phys; 1111 1112 ASSERT(ill->ill_mactype == DL_6TO4); 1113 ASSERT(ill->ill_phys_addr_length == sizeof (struct in_addr)); 1114 ASSERT(ipif->ipif_isv6); 1115 1116 if (ipif->ipif_flags & IPIF_UP) 1117 return; 1118 1119 (void) ip_plen_to_mask_v6(16, &ipif->ipif_v6net_mask); 1120 bcopy(ill->ill_phys_addr, &v4phys, sizeof (struct in_addr)); 1121 IN6_V4ADDR_TO_6TO4(&v4phys, &ipif->ipif_v6lcl_addr); 1122 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1123 ipif->ipif_v6subnet); 1124 } 1125 1126 /* 1127 * Is it not possible to set the link local address? 1128 * The address can be set if the token is set, and the token 1129 * isn't too long. 1130 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1131 */ 1132 boolean_t 1133 ipif_cant_setlinklocal(ipif_t *ipif) 1134 { 1135 ill_t *ill = ipif->ipif_ill; 1136 1137 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1138 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1139 return (B_TRUE); 1140 1141 return (B_FALSE); 1142 } 1143 1144 /* 1145 * Generate a link-local address from the token. 1146 */ 1147 void 1148 ipif_setlinklocal(ipif_t *ipif) 1149 { 1150 ill_t *ill = ipif->ipif_ill; 1151 in6_addr_t ov6addr; 1152 1153 ASSERT(IAM_WRITER_ILL(ill)); 1154 1155 /* 1156 * ill_manual_linklocal is set when the link-local address was 1157 * manually configured. 1158 */ 1159 if (ill->ill_manual_linklocal) 1160 return; 1161 1162 /* 1163 * IPv6 interfaces over 6to4 tunnels are special. They do not have 1164 * link-local addresses, but instead have a single automatically 1165 * generated global address. 1166 */ 1167 if (ill->ill_mactype == DL_6TO4) { 1168 ipif_set6to4addr(ipif); 1169 return; 1170 } 1171 1172 if (ipif_cant_setlinklocal(ipif)) 1173 return; 1174 1175 ov6addr = ipif->ipif_v6lcl_addr; 1176 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1177 sctp_update_ipif_addr(ipif, ov6addr); 1178 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1179 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 1180 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1181 ipif->ipif_v6subnet); 1182 } 1183 1184 ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT); 1185 } 1186 1187 /* 1188 * Generate a destination link-local address for a point-to-point IPv6 1189 * interface with a destination interface id (IP tunnels are such interfaces) 1190 * based on the destination token. 1191 */ 1192 void 1193 ipif_setdestlinklocal(ipif_t *ipif) 1194 { 1195 ill_t *ill = ipif->ipif_ill; 1196 1197 ASSERT(IAM_WRITER_ILL(ill)); 1198 1199 if (ill->ill_manual_dst_linklocal) 1200 return; 1201 1202 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_dest_token)) 1203 return; 1204 1205 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, &ill->ill_dest_token); 1206 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1207 } 1208 1209 /* 1210 * Get the resolver set up for a new ipif. (Always called as writer.) 1211 */ 1212 int 1213 ipif_ndp_up(ipif_t *ipif, boolean_t initial) 1214 { 1215 ill_t *ill = ipif->ipif_ill; 1216 int err = 0; 1217 nce_t *nce = NULL; 1218 boolean_t added_ipif = B_FALSE; 1219 1220 DTRACE_PROBE3(ipif__downup, char *, "ipif_ndp_up", 1221 ill_t *, ill, ipif_t *, ipif); 1222 ip1dbg(("ipif_ndp_up(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 1223 1224 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) || 1225 (!(ill->ill_net_type & IRE_INTERFACE))) { 1226 ipif->ipif_addr_ready = 1; 1227 return (0); 1228 } 1229 1230 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1231 uint16_t flags; 1232 uint16_t state; 1233 uchar_t *hw_addr; 1234 ill_t *bound_ill; 1235 ipmp_illgrp_t *illg = ill->ill_grp; 1236 uint_t hw_addr_len; 1237 1238 flags = NCE_F_MYADDR | NCE_F_NONUD | NCE_F_PUBLISH | 1239 NCE_F_AUTHORITY; 1240 if (ill->ill_flags & ILLF_ROUTER) 1241 flags |= NCE_F_ISROUTER; 1242 1243 if (ipif->ipif_flags & IPIF_ANYCAST) 1244 flags |= NCE_F_ANYCAST; 1245 1246 if (IS_IPMP(ill)) { 1247 ASSERT(ill->ill_net_type == IRE_IF_RESOLVER); 1248 /* 1249 * If we're here via ipif_up(), then the ipif won't be 1250 * bound yet -- add it to the group, which will bind 1251 * it if possible. (We would add it in ipif_up(), but 1252 * deleting on failure there is gruesome.) If we're 1253 * here via ipmp_ill_bind_ipif(), then the ipif has 1254 * already been added to the group and we just need to 1255 * use the binding. 1256 */ 1257 if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) { 1258 bound_ill = ipmp_illgrp_add_ipif(illg, ipif); 1259 if (bound_ill == NULL) { 1260 /* 1261 * We couldn't bind the ipif to an ill 1262 * yet, so we have nothing to publish. 1263 * Set ipif_addr_ready so that this 1264 * address can be used locally for now. 1265 * The routing socket message will be 1266 * sent from ipif_up_done_v6(). 1267 */ 1268 ipif->ipif_addr_ready = 1; 1269 return (0); 1270 } 1271 added_ipif = B_TRUE; 1272 } 1273 hw_addr = bound_ill->ill_nd_lla; 1274 hw_addr_len = bound_ill->ill_phys_addr_length; 1275 } else { 1276 bound_ill = ill; 1277 hw_addr = ill->ill_nd_lla; 1278 hw_addr_len = ill->ill_phys_addr_length; 1279 } 1280 1281 /* 1282 * If this is an initial bring-up (or the ipif was never 1283 * completely brought up), do DAD. Otherwise, we're here 1284 * because IPMP has rebound an address to this ill: send 1285 * unsolicited advertisements to inform others. 1286 */ 1287 if (initial || !ipif->ipif_addr_ready) { 1288 /* Causes Duplicate Address Detection to run */ 1289 state = ND_PROBE; 1290 } else { 1291 state = ND_REACHABLE; 1292 flags |= NCE_F_UNSOL_ADV; 1293 } 1294 1295 retry: 1296 err = nce_lookup_then_add_v6(ill, hw_addr, hw_addr_len, 1297 &ipif->ipif_v6lcl_addr, flags, state, &nce); 1298 switch (err) { 1299 case 0: 1300 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1301 ill->ill_name)); 1302 ipif->ipif_addr_ready = 1; 1303 ipif->ipif_added_nce = 1; 1304 nce->nce_ipif_cnt++; 1305 break; 1306 case EINPROGRESS: 1307 ip1dbg(("ipif_ndp_up: running DAD now for %s\n", 1308 ill->ill_name)); 1309 ipif->ipif_added_nce = 1; 1310 nce->nce_ipif_cnt++; 1311 break; 1312 case EEXIST: 1313 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1314 ill->ill_name)); 1315 if (!NCE_MYADDR(nce->nce_common)) { 1316 /* 1317 * A leftover nce from before this address 1318 * existed 1319 */ 1320 ncec_delete(nce->nce_common); 1321 nce_refrele(nce); 1322 nce = NULL; 1323 goto retry; 1324 } 1325 if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) { 1326 nce_refrele(nce); 1327 nce = NULL; 1328 ip1dbg(("ipif_ndp_up: NCE already exists " 1329 "for %s\n", ill->ill_name)); 1330 goto fail; 1331 } 1332 /* 1333 * Duplicate local addresses are permissible for 1334 * IPIF_POINTOPOINT interfaces which will get marked 1335 * IPIF_UNNUMBERED later in 1336 * ip_addr_availability_check(). 1337 * 1338 * The nce_ipif_cnt field tracks the number of 1339 * ipifs that have nce_addr as their local address. 1340 */ 1341 ipif->ipif_addr_ready = 1; 1342 ipif->ipif_added_nce = 1; 1343 nce->nce_ipif_cnt++; 1344 err = 0; 1345 break; 1346 default: 1347 ip1dbg(("ipif_ndp_up: NCE creation failed for %s\n", 1348 ill->ill_name)); 1349 goto fail; 1350 } 1351 } else { 1352 /* No local NCE for this entry */ 1353 ipif->ipif_addr_ready = 1; 1354 } 1355 if (nce != NULL) 1356 nce_refrele(nce); 1357 return (0); 1358 fail: 1359 if (added_ipif) 1360 ipmp_illgrp_del_ipif(ill->ill_grp, ipif); 1361 1362 return (err); 1363 } 1364 1365 /* Remove all cache entries for this logical interface */ 1366 void 1367 ipif_ndp_down(ipif_t *ipif) 1368 { 1369 ipif_nce_down(ipif); 1370 } 1371 1372 /* 1373 * Return the scope of the given IPv6 address. If the address is an 1374 * IPv4 mapped IPv6 address, return the scope of the corresponding 1375 * IPv4 address. 1376 */ 1377 in6addr_scope_t 1378 ip_addr_scope_v6(const in6_addr_t *addr) 1379 { 1380 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1381 1382 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1383 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1384 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1385 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1386 return (IP6_SCOPE_LINKLOCAL); 1387 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1388 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1389 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1390 return (IP6_SCOPE_SITELOCAL); 1391 return (IP6_SCOPE_GLOBAL); 1392 } 1393 1394 if (IN6_IS_ADDR_MULTICAST(addr)) 1395 return (IN6_ADDR_MC_SCOPE(addr)); 1396 1397 /* link-local and loopback addresses are of link-local scope */ 1398 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1399 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1400 return (IP6_SCOPE_LINKLOCAL); 1401 if (IN6_IS_ADDR_SITELOCAL(addr)) 1402 return (IP6_SCOPE_SITELOCAL); 1403 return (IP6_SCOPE_GLOBAL); 1404 } 1405 1406 1407 /* 1408 * Returns the length of the common prefix of a1 and a2, as per 1409 * CommonPrefixLen() defined in RFC 3484. 1410 */ 1411 static int 1412 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2) 1413 { 1414 int i; 1415 uint32_t a1val, a2val, mask; 1416 1417 for (i = 0; i < 4; i++) { 1418 if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) { 1419 a1val ^= a2val; 1420 i *= 32; 1421 mask = 0x80000000u; 1422 while (!(a1val & mask)) { 1423 mask >>= 1; 1424 i++; 1425 } 1426 return (i); 1427 } 1428 } 1429 return (IPV6_ABITS); 1430 } 1431 1432 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1433 (((ipif)->ipif_flags & IPIF_UP) && \ 1434 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \ 1435 !((ipif)->ipif_ill->ill_flags & ILLF_NOACCEPT)) 1436 1437 /* source address candidate */ 1438 typedef struct candidate { 1439 ipif_t *cand_ipif; 1440 /* The properties of this candidate */ 1441 boolean_t cand_isdst; 1442 boolean_t cand_isdst_set; 1443 in6addr_scope_t cand_scope; 1444 boolean_t cand_scope_set; 1445 boolean_t cand_isdeprecated; 1446 boolean_t cand_isdeprecated_set; 1447 boolean_t cand_ispreferred; 1448 boolean_t cand_ispreferred_set; 1449 boolean_t cand_matchedinterface; 1450 boolean_t cand_matchedinterface_set; 1451 boolean_t cand_matchedlabel; 1452 boolean_t cand_matchedlabel_set; 1453 boolean_t cand_istmp; 1454 boolean_t cand_istmp_set; 1455 int cand_common_pref; 1456 boolean_t cand_common_pref_set; 1457 boolean_t cand_pref_eq; 1458 boolean_t cand_pref_eq_set; 1459 int cand_pref_len; 1460 boolean_t cand_pref_len_set; 1461 } cand_t; 1462 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1463 #define cand_mask cand_ipif->ipif_v6net_mask 1464 #define cand_flags cand_ipif->ipif_flags 1465 #define cand_ill cand_ipif->ipif_ill 1466 #define cand_zoneid cand_ipif->ipif_zoneid 1467 1468 /* information about the destination for source address selection */ 1469 typedef struct dstinfo { 1470 const in6_addr_t *dst_addr; 1471 ill_t *dst_ill; 1472 uint_t dst_restrict_ill; 1473 boolean_t dst_prefer_src_tmp; 1474 in6addr_scope_t dst_scope; 1475 char *dst_label; 1476 } dstinfo_t; 1477 1478 /* 1479 * The following functions are rules used to select a source address in 1480 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1481 * against the best candidate (bc). Each rule has three possible outcomes; 1482 * the candidate is preferred over the best candidate (CAND_PREFER), the 1483 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1484 * candidate is of equal value as the best candidate (CAND_TIE). 1485 * 1486 * These rules are part of a greater "Default Address Selection for IPv6" 1487 * sheme, which is standards based work coming out of the IETF ipv6 working 1488 * group. The IETF document defines both IPv6 source address selection and 1489 * destination address ordering. The rules defined here implement the IPv6 1490 * source address selection. Destination address ordering is done by 1491 * libnsl, and uses a similar set of rules to implement the sorting. 1492 * 1493 * Most of the rules are defined by the RFC and are not typically altered. The 1494 * last rule, number 8, has language that allows for local preferences. In the 1495 * scheme below, this means that new Solaris rules should normally go between 1496 * rule_ifprefix and rule_prefix. 1497 */ 1498 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1499 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *, 1500 ip_stack_t *); 1501 1502 /* Prefer an address if it is equal to the destination address. */ 1503 /* ARGSUSED3 */ 1504 static rule_res_t 1505 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1506 { 1507 if (!bc->cand_isdst_set) { 1508 bc->cand_isdst = 1509 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1510 bc->cand_isdst_set = B_TRUE; 1511 } 1512 1513 cc->cand_isdst = 1514 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1515 cc->cand_isdst_set = B_TRUE; 1516 1517 if (cc->cand_isdst == bc->cand_isdst) 1518 return (CAND_TIE); 1519 else if (cc->cand_isdst) 1520 return (CAND_PREFER); 1521 else 1522 return (CAND_AVOID); 1523 } 1524 1525 /* 1526 * Prefer addresses that are of closest scope to the destination. Always 1527 * prefer addresses that are of greater scope than the destination over 1528 * those that are of lesser scope than the destination. 1529 */ 1530 /* ARGSUSED3 */ 1531 static rule_res_t 1532 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1533 { 1534 if (!bc->cand_scope_set) { 1535 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1536 bc->cand_scope_set = B_TRUE; 1537 } 1538 1539 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1540 cc->cand_scope_set = B_TRUE; 1541 1542 if (cc->cand_scope < bc->cand_scope) { 1543 if (cc->cand_scope < dstinfo->dst_scope) 1544 return (CAND_AVOID); 1545 else 1546 return (CAND_PREFER); 1547 } else if (bc->cand_scope < cc->cand_scope) { 1548 if (bc->cand_scope < dstinfo->dst_scope) 1549 return (CAND_PREFER); 1550 else 1551 return (CAND_AVOID); 1552 } else { 1553 return (CAND_TIE); 1554 } 1555 } 1556 1557 /* 1558 * Prefer non-deprecated source addresses. 1559 */ 1560 /* ARGSUSED2 */ 1561 static rule_res_t 1562 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1563 ip_stack_t *ipst) 1564 { 1565 if (!bc->cand_isdeprecated_set) { 1566 bc->cand_isdeprecated = 1567 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 1568 bc->cand_isdeprecated_set = B_TRUE; 1569 } 1570 1571 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 1572 cc->cand_isdeprecated_set = B_TRUE; 1573 1574 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 1575 return (CAND_TIE); 1576 else if (cc->cand_isdeprecated) 1577 return (CAND_AVOID); 1578 else 1579 return (CAND_PREFER); 1580 } 1581 1582 /* 1583 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 1584 * rule must be before rule_interface because the flag could be set on any 1585 * interface, not just the interface being used for outgoing packets (for 1586 * example, the IFF_PREFERRED could be set on an address assigned to the 1587 * loopback interface). 1588 */ 1589 /* ARGSUSED2 */ 1590 static rule_res_t 1591 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1592 ip_stack_t *ipst) 1593 { 1594 if (!bc->cand_ispreferred_set) { 1595 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 1596 bc->cand_ispreferred_set = B_TRUE; 1597 } 1598 1599 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 1600 cc->cand_ispreferred_set = B_TRUE; 1601 1602 if (bc->cand_ispreferred == cc->cand_ispreferred) 1603 return (CAND_TIE); 1604 else if (cc->cand_ispreferred) 1605 return (CAND_PREFER); 1606 else 1607 return (CAND_AVOID); 1608 } 1609 1610 /* 1611 * Prefer source addresses that are assigned to the outgoing interface. 1612 */ 1613 /* ARGSUSED3 */ 1614 static rule_res_t 1615 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1616 ip_stack_t *ipst) 1617 { 1618 ill_t *dstill = dstinfo->dst_ill; 1619 1620 /* 1621 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 1622 * since we know all candidates will be on the same link. 1623 */ 1624 if (dstinfo->dst_restrict_ill) 1625 return (CAND_TIE); 1626 1627 if (!bc->cand_matchedinterface_set) { 1628 bc->cand_matchedinterface = bc->cand_ill == dstill; 1629 bc->cand_matchedinterface_set = B_TRUE; 1630 } 1631 1632 cc->cand_matchedinterface = cc->cand_ill == dstill; 1633 cc->cand_matchedinterface_set = B_TRUE; 1634 1635 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 1636 return (CAND_TIE); 1637 else if (cc->cand_matchedinterface) 1638 return (CAND_PREFER); 1639 else 1640 return (CAND_AVOID); 1641 } 1642 1643 /* 1644 * Prefer source addresses whose label matches the destination's label. 1645 */ 1646 static rule_res_t 1647 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1648 { 1649 char *label; 1650 1651 if (!bc->cand_matchedlabel_set) { 1652 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst); 1653 bc->cand_matchedlabel = 1654 ip6_asp_labelcmp(label, dstinfo->dst_label); 1655 bc->cand_matchedlabel_set = B_TRUE; 1656 } 1657 1658 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst); 1659 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 1660 cc->cand_matchedlabel_set = B_TRUE; 1661 1662 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 1663 return (CAND_TIE); 1664 else if (cc->cand_matchedlabel) 1665 return (CAND_PREFER); 1666 else 1667 return (CAND_AVOID); 1668 } 1669 1670 /* 1671 * Prefer public addresses over temporary ones. An application can reverse 1672 * the logic of this rule and prefer temporary addresses by using the 1673 * IPV6_SRC_PREFERENCES socket option. 1674 */ 1675 /* ARGSUSED3 */ 1676 static rule_res_t 1677 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1678 ip_stack_t *ipst) 1679 { 1680 if (!bc->cand_istmp_set) { 1681 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 1682 bc->cand_istmp_set = B_TRUE; 1683 } 1684 1685 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 1686 cc->cand_istmp_set = B_TRUE; 1687 1688 if (bc->cand_istmp == cc->cand_istmp) 1689 return (CAND_TIE); 1690 1691 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 1692 return (CAND_PREFER); 1693 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 1694 return (CAND_PREFER); 1695 else 1696 return (CAND_AVOID); 1697 } 1698 1699 /* 1700 * Prefer source addresses with longer matching prefix with the destination 1701 * under the interface mask. This gets us on the same subnet before applying 1702 * any Solaris-specific rules. 1703 */ 1704 /* ARGSUSED3 */ 1705 static rule_res_t 1706 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1707 ip_stack_t *ipst) 1708 { 1709 if (!bc->cand_pref_eq_set) { 1710 bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr, 1711 bc->cand_mask, *dstinfo->dst_addr); 1712 bc->cand_pref_eq_set = B_TRUE; 1713 } 1714 1715 cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask, 1716 *dstinfo->dst_addr); 1717 cc->cand_pref_eq_set = B_TRUE; 1718 1719 if (bc->cand_pref_eq) { 1720 if (cc->cand_pref_eq) { 1721 if (!bc->cand_pref_len_set) { 1722 bc->cand_pref_len = 1723 ip_mask_to_plen_v6(&bc->cand_mask); 1724 bc->cand_pref_len_set = B_TRUE; 1725 } 1726 cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask); 1727 cc->cand_pref_len_set = B_TRUE; 1728 if (bc->cand_pref_len == cc->cand_pref_len) 1729 return (CAND_TIE); 1730 else if (bc->cand_pref_len > cc->cand_pref_len) 1731 return (CAND_AVOID); 1732 else 1733 return (CAND_PREFER); 1734 } else { 1735 return (CAND_AVOID); 1736 } 1737 } else { 1738 if (cc->cand_pref_eq) 1739 return (CAND_PREFER); 1740 else 1741 return (CAND_TIE); 1742 } 1743 } 1744 1745 /* 1746 * Prefer to use zone-specific addresses when possible instead of all-zones 1747 * addresses. 1748 */ 1749 /* ARGSUSED2 */ 1750 static rule_res_t 1751 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1752 ip_stack_t *ipst) 1753 { 1754 if ((bc->cand_zoneid == ALL_ZONES) == 1755 (cc->cand_zoneid == ALL_ZONES)) 1756 return (CAND_TIE); 1757 else if (cc->cand_zoneid == ALL_ZONES) 1758 return (CAND_AVOID); 1759 else 1760 return (CAND_PREFER); 1761 } 1762 1763 /* 1764 * Prefer to use DHCPv6 (first) and static addresses (second) when possible 1765 * instead of statelessly autoconfigured addresses. 1766 * 1767 * This is done after trying all other preferences (and before the final tie 1768 * breaker) so that, if all else is equal, we select addresses configured by 1769 * DHCPv6 over other addresses. We presume that DHCPv6 addresses, unlike 1770 * stateless autoconfigured addresses, are deliberately configured by an 1771 * administrator, and thus are correctly set up in DNS and network packet 1772 * filters. 1773 */ 1774 /* ARGSUSED2 */ 1775 static rule_res_t 1776 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1777 ip_stack_t *ipst) 1778 { 1779 #define ATYPE(x) \ 1780 ((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2 1781 int bcval = ATYPE(bc->cand_flags); 1782 int ccval = ATYPE(cc->cand_flags); 1783 #undef ATYPE 1784 1785 if (bcval == ccval) 1786 return (CAND_TIE); 1787 else if (ccval < bcval) 1788 return (CAND_PREFER); 1789 else 1790 return (CAND_AVOID); 1791 } 1792 1793 /* 1794 * Prefer source addresses with longer matching prefix with the destination. 1795 * We do the longest matching prefix calculation by doing an xor of both 1796 * addresses with the destination, and pick the address with the longest string 1797 * of leading zeros, as per CommonPrefixLen() defined in RFC 3484. 1798 */ 1799 /* ARGSUSED3 */ 1800 static rule_res_t 1801 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1802 { 1803 if (!bc->cand_common_pref_set) { 1804 bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr, 1805 dstinfo->dst_addr); 1806 bc->cand_common_pref_set = B_TRUE; 1807 } 1808 1809 cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr, 1810 dstinfo->dst_addr); 1811 cc->cand_common_pref_set = B_TRUE; 1812 1813 if (bc->cand_common_pref == cc->cand_common_pref) 1814 return (CAND_TIE); 1815 else if (bc->cand_common_pref > cc->cand_common_pref) 1816 return (CAND_AVOID); 1817 else 1818 return (CAND_PREFER); 1819 } 1820 1821 /* 1822 * Last rule: we must pick something, so just prefer the current best 1823 * candidate. 1824 */ 1825 /* ARGSUSED */ 1826 static rule_res_t 1827 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1828 ip_stack_t *ipst) 1829 { 1830 return (CAND_AVOID); 1831 } 1832 1833 /* 1834 * Determine the best source address given a destination address and a 1835 * destination ill. If no suitable source address is found, it returns 1836 * NULL. If there is a usable address pointed to by the usesrc 1837 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 1838 * fine grained (i.e per interface) 1839 * 1840 * This implementation is based on the "Default Address Selection for IPv6" 1841 * specification produced by the IETF IPv6 working group. It has been 1842 * implemented so that the list of addresses is only traversed once (the 1843 * specification's algorithm could traverse the list of addresses once for 1844 * every rule). 1845 * 1846 * The restrict_ill argument restricts the algorithm to choose a source 1847 * address that is assigned to the destination ill. This is used when 1848 * the destination address is a link-local or multicast address, and when 1849 * ipv6_strict_dst_multihoming is turned on. 1850 * 1851 * src_prefs is the caller's set of source address preferences. If source 1852 * address selection is being called to determine the source address of a 1853 * connected socket (from ip_set_destination_v6()), then the preferences are 1854 * taken from conn_ixa->ixa_src_preferences. These preferences can be set on a 1855 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 1856 * preference currently implemented is for rfc3041 temporary addresses. 1857 */ 1858 ipif_t * 1859 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 1860 boolean_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid, 1861 boolean_t allow_usesrc, boolean_t *notreadyp) 1862 { 1863 dstinfo_t dstinfo; 1864 char dstr[INET6_ADDRSTRLEN]; 1865 char sstr[INET6_ADDRSTRLEN]; 1866 ipif_t *ipif, *start_ipif, *next_ipif; 1867 ill_t *ill, *usesrc_ill = NULL, *ipmp_ill = NULL; 1868 ill_walk_context_t ctx; 1869 cand_t best_c; /* The best candidate */ 1870 cand_t curr_c; /* The current candidate */ 1871 uint_t index; 1872 boolean_t first_candidate = B_TRUE; 1873 rule_res_t rule_result; 1874 tsol_tpc_t *src_rhtp, *dst_rhtp; 1875 ip_stack_t *ipst = dstill->ill_ipst; 1876 1877 /* 1878 * The list of ordering rules. They are applied in the order they 1879 * appear in the list. 1880 * 1881 * Solaris doesn't currently support Mobile IPv6, so there's no 1882 * rule_mipv6 corresponding to rule 4 in the specification. 1883 */ 1884 rulef_t rules[] = { 1885 rule_isdst, 1886 rule_scope, 1887 rule_deprecated, 1888 rule_preferred, 1889 rule_interface, 1890 rule_label, 1891 rule_temporary, 1892 rule_ifprefix, /* local rules after this */ 1893 rule_zone_specific, 1894 rule_addr_type, 1895 rule_prefix, /* local rules before this */ 1896 rule_must_be_last, /* must always be last */ 1897 NULL 1898 }; 1899 1900 ASSERT(dstill->ill_isv6); 1901 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 1902 1903 /* 1904 * Check if there is a usable src address pointed to by the 1905 * usesrc ifindex. This has higher precedence since it is 1906 * finer grained (i.e per interface) v/s being system wide. 1907 */ 1908 if (dstill->ill_usesrc_ifindex != 0 && allow_usesrc) { 1909 if ((usesrc_ill = 1910 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 1911 ipst)) != NULL) { 1912 dstinfo.dst_ill = usesrc_ill; 1913 } else { 1914 return (NULL); 1915 } 1916 } else if (IS_UNDER_IPMP(dstill)) { 1917 /* 1918 * Test addresses should never be used for source address 1919 * selection, so if we were passed an underlying ill, switch 1920 * to the IPMP meta-interface. 1921 */ 1922 if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(dstill)) != NULL) 1923 dstinfo.dst_ill = ipmp_ill; 1924 else 1925 return (NULL); 1926 } else { 1927 dstinfo.dst_ill = dstill; 1928 } 1929 1930 /* 1931 * If we're dealing with an unlabeled destination on a labeled system, 1932 * make sure that we ignore source addresses that are incompatible with 1933 * the destination's default label. That destination's default label 1934 * must dominate the minimum label on the source address. 1935 * 1936 * (Note that this has to do with Trusted Solaris. It's not related to 1937 * the labels described by ip6_asp_lookup.) 1938 */ 1939 dst_rhtp = NULL; 1940 if (is_system_labeled()) { 1941 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE); 1942 if (dst_rhtp == NULL) 1943 return (NULL); 1944 if (dst_rhtp->tpc_tp.host_type != UNLABELED) { 1945 TPC_RELE(dst_rhtp); 1946 dst_rhtp = NULL; 1947 } 1948 } 1949 1950 dstinfo.dst_addr = dst; 1951 dstinfo.dst_scope = ip_addr_scope_v6(dst); 1952 dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst); 1953 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 1954 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 1955 /* 1956 * Section three of the I-D states that for multicast and 1957 * link-local destinations, the candidate set must be restricted to 1958 * an interface that is on the same link as the outgoing interface. 1959 * Also, when ipv6_strict_dst_multihoming is turned on, always 1960 * restrict the source address to the destination link as doing 1961 * otherwise will almost certainly cause problems. 1962 */ 1963 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 1964 ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) { 1965 dstinfo.dst_restrict_ill = B_TRUE; 1966 } else { 1967 dstinfo.dst_restrict_ill = restrict_ill; 1968 } 1969 1970 bzero(&best_c, sizeof (cand_t)); 1971 1972 /* 1973 * Take a pass through the list of IPv6 interfaces to choose the best 1974 * possible source address. If restrict_ill is set, just use dst_ill. 1975 */ 1976 if (dstinfo.dst_restrict_ill) 1977 ill = dstinfo.dst_ill; 1978 else 1979 ill = ILL_START_WALK_V6(&ctx, ipst); 1980 1981 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 1982 ASSERT(ill->ill_isv6); 1983 1984 /* 1985 * Test addresses should never be used for source address 1986 * selection, so ignore underlying ills. 1987 */ 1988 if (IS_UNDER_IPMP(ill)) 1989 continue; 1990 1991 if (ill->ill_ipif == NULL) 1992 continue; 1993 /* 1994 * For source address selection, we treat the ipif list as 1995 * circular and continue until we get back to where we 1996 * started. This allows IPMP to vary source address selection 1997 * (which improves inbound load spreading) by caching its last 1998 * ending point and starting from there. NOTE: we don't have 1999 * to worry about ill_src_ipif changing ills since that can't 2000 * happen on the IPMP ill. 2001 */ 2002 start_ipif = ill->ill_ipif; 2003 if (IS_IPMP(ill) && ill->ill_src_ipif != NULL) 2004 start_ipif = ill->ill_src_ipif; 2005 2006 ipif = start_ipif; 2007 do { 2008 if ((next_ipif = ipif->ipif_next) == NULL) 2009 next_ipif = ill->ill_ipif; 2010 2011 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 2012 continue; 2013 2014 if (!ipif->ipif_addr_ready) { 2015 if (notreadyp != NULL) 2016 *notreadyp = B_TRUE; 2017 continue; 2018 } 2019 2020 if (zoneid != ALL_ZONES && 2021 ipif->ipif_zoneid != zoneid && 2022 ipif->ipif_zoneid != ALL_ZONES) 2023 continue; 2024 2025 /* 2026 * Check compatibility of local address for 2027 * destination's default label if we're on a labeled 2028 * system. Incompatible addresses can't be used at 2029 * all and must be skipped over. 2030 */ 2031 if (dst_rhtp != NULL) { 2032 boolean_t incompat; 2033 2034 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr, 2035 IPV6_VERSION, B_FALSE); 2036 if (src_rhtp == NULL) 2037 continue; 2038 incompat = 2039 src_rhtp->tpc_tp.host_type != SUN_CIPSO || 2040 src_rhtp->tpc_tp.tp_doi != 2041 dst_rhtp->tpc_tp.tp_doi || 2042 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label, 2043 &src_rhtp->tpc_tp.tp_sl_range_cipso) && 2044 !blinlset(&dst_rhtp->tpc_tp.tp_def_label, 2045 src_rhtp->tpc_tp.tp_sl_set_cipso)); 2046 TPC_RELE(src_rhtp); 2047 if (incompat) 2048 continue; 2049 } 2050 2051 if (first_candidate) { 2052 /* 2053 * This is first valid address in the list. 2054 * It is automatically the best candidate 2055 * so far. 2056 */ 2057 best_c.cand_ipif = ipif; 2058 first_candidate = B_FALSE; 2059 continue; 2060 } 2061 2062 bzero(&curr_c, sizeof (cand_t)); 2063 curr_c.cand_ipif = ipif; 2064 2065 /* 2066 * Compare this current candidate (curr_c) with the 2067 * best candidate (best_c) by applying the 2068 * comparison rules in order until one breaks the 2069 * tie. 2070 */ 2071 for (index = 0; rules[index] != NULL; index++) { 2072 /* Apply a comparison rule. */ 2073 rule_result = (rules[index])(&best_c, &curr_c, 2074 &dstinfo, ipst); 2075 if (rule_result == CAND_AVOID) { 2076 /* 2077 * The best candidate is still the 2078 * best candidate. Forget about 2079 * this current candidate and go on 2080 * to the next one. 2081 */ 2082 break; 2083 } else if (rule_result == CAND_PREFER) { 2084 /* 2085 * This candidate is prefered. It 2086 * becomes the best candidate so 2087 * far. Go on to the next address. 2088 */ 2089 best_c = curr_c; 2090 break; 2091 } 2092 /* We have a tie, apply the next rule. */ 2093 } 2094 2095 /* 2096 * The last rule must be a tie breaker rule and 2097 * must never produce a tie. At this point, the 2098 * candidate should have either been rejected, or 2099 * have been prefered as the best candidate so far. 2100 */ 2101 ASSERT(rule_result != CAND_TIE); 2102 } while ((ipif = next_ipif) != start_ipif); 2103 2104 /* 2105 * For IPMP, update the source ipif rotor to the next ipif, 2106 * provided we can look it up. (We must not use it if it's 2107 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after 2108 * ipif_free() checked ill_src_ipif.) 2109 */ 2110 if (IS_IPMP(ill) && ipif != NULL) { 2111 mutex_enter(&ipif->ipif_ill->ill_lock); 2112 next_ipif = ipif->ipif_next; 2113 if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif)) 2114 ill->ill_src_ipif = next_ipif; 2115 else 2116 ill->ill_src_ipif = NULL; 2117 mutex_exit(&ipif->ipif_ill->ill_lock); 2118 } 2119 2120 /* 2121 * Only one ill to consider if dst_restrict_ill is set. 2122 */ 2123 if (dstinfo.dst_restrict_ill) 2124 break; 2125 } 2126 2127 ipif = best_c.cand_ipif; 2128 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2129 dstinfo.dst_ill->ill_name, 2130 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2131 (ipif == NULL ? "NULL" : 2132 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2133 2134 if (usesrc_ill != NULL) 2135 ill_refrele(usesrc_ill); 2136 2137 if (ipmp_ill != NULL) 2138 ill_refrele(ipmp_ill); 2139 2140 if (dst_rhtp != NULL) 2141 TPC_RELE(dst_rhtp); 2142 2143 if (ipif == NULL) { 2144 rw_exit(&ipst->ips_ill_g_lock); 2145 return (NULL); 2146 } 2147 2148 mutex_enter(&ipif->ipif_ill->ill_lock); 2149 if (!IPIF_IS_CONDEMNED(ipif)) { 2150 ipif_refhold_locked(ipif); 2151 mutex_exit(&ipif->ipif_ill->ill_lock); 2152 rw_exit(&ipst->ips_ill_g_lock); 2153 return (ipif); 2154 } 2155 mutex_exit(&ipif->ipif_ill->ill_lock); 2156 rw_exit(&ipst->ips_ill_g_lock); 2157 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2158 " returning null \n", (void *)ipif)); 2159 2160 return (NULL); 2161 } 2162 2163 /* 2164 * Pick a source address based on the destination ill and an optional setsrc 2165 * address. 2166 * The result is stored in srcp. If generation is set, then put the source 2167 * generation number there before we look for the source address (to avoid 2168 * missing changes in the set of source addresses. 2169 * If flagsp is set, then us it to pass back ipif_flags. 2170 * 2171 * If the caller wants to cache the returned source address and detect when 2172 * that might be stale, the caller should pass in a generation argument, 2173 * which the caller can later compare against ips_src_generation 2174 * 2175 * The precedence order for selecting an IPv6 source address is: 2176 * - RTF_SETSRC on the first ire in the recursive lookup always wins. 2177 * - If usrsrc is set, swap the ill to be the usesrc one. 2178 * - If IPMP is used on the ill, select a random address from the most 2179 * preferred ones below: 2180 * That is followed by the long list of IPv6 source address selection rules 2181 * starting with rule_isdst(), rule_scope(), etc. 2182 * 2183 * We have lower preference for ALL_ZONES IP addresses, 2184 * as they pose problems with unlabeled destinations. 2185 * 2186 * Note that when multiple IP addresses match e.g., with rule_scope() we pick 2187 * the first one if IPMP is not in use. With IPMP we randomize. 2188 */ 2189 int 2190 ip_select_source_v6(ill_t *ill, const in6_addr_t *setsrc, const in6_addr_t *dst, 2191 zoneid_t zoneid, ip_stack_t *ipst, uint_t restrict_ill, uint32_t src_prefs, 2192 in6_addr_t *srcp, uint32_t *generation, uint64_t *flagsp) 2193 { 2194 ipif_t *ipif; 2195 boolean_t notready = B_FALSE; /* Set if !ipif_addr_ready found */ 2196 2197 if (flagsp != NULL) 2198 *flagsp = 0; 2199 2200 /* 2201 * Need to grab the generation number before we check to 2202 * avoid a race with a change to the set of local addresses. 2203 * No lock needed since the thread which updates the set of local 2204 * addresses use ipif/ill locks and exit those (hence a store memory 2205 * barrier) before doing the atomic increase of ips_src_generation. 2206 */ 2207 if (generation != NULL) { 2208 *generation = ipst->ips_src_generation; 2209 } 2210 2211 /* Was RTF_SETSRC set on the first IRE in the recursive lookup? */ 2212 if (setsrc != NULL && !IN6_IS_ADDR_UNSPECIFIED(setsrc)) { 2213 *srcp = *setsrc; 2214 return (0); 2215 } 2216 2217 ipif = ipif_select_source_v6(ill, dst, restrict_ill, src_prefs, zoneid, 2218 B_TRUE, ¬ready); 2219 if (ipif == NULL) { 2220 if (notready) 2221 return (ENETDOWN); 2222 else 2223 return (EADDRNOTAVAIL); 2224 } 2225 *srcp = ipif->ipif_v6lcl_addr; 2226 if (flagsp != NULL) 2227 *flagsp = ipif->ipif_flags; 2228 ipif_refrele(ipif); 2229 return (0); 2230 } 2231 2232 /* 2233 * Perform an attach and bind to get phys addr plus info_req for 2234 * the physical device. 2235 * q and mp represents an ioctl which will be queued waiting for 2236 * completion of the DLPI message exchange. 2237 * MUST be called on an ill queue. 2238 * 2239 * Returns EINPROGRESS when mp has been consumed by queueing it. 2240 * The ioctl will complete in ip_rput. 2241 */ 2242 int 2243 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2244 { 2245 mblk_t *v6token_mp = NULL; 2246 mblk_t *v6lla_mp = NULL; 2247 mblk_t *dest_mp = NULL; 2248 mblk_t *phys_mp = NULL; 2249 mblk_t *info_mp = NULL; 2250 mblk_t *attach_mp = NULL; 2251 mblk_t *bind_mp = NULL; 2252 mblk_t *unbind_mp = NULL; 2253 mblk_t *notify_mp = NULL; 2254 mblk_t *capab_mp = NULL; 2255 2256 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2257 ASSERT(ill->ill_dlpi_style_set); 2258 ASSERT(WR(q)->q_next != NULL); 2259 2260 if (ill->ill_isv6) { 2261 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2262 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2263 if (v6token_mp == NULL) 2264 goto bad; 2265 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2266 DL_IPV6_TOKEN; 2267 2268 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2269 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2270 if (v6lla_mp == NULL) 2271 goto bad; 2272 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2273 DL_IPV6_LINK_LAYER_ADDR; 2274 } 2275 2276 if (ill->ill_mactype == DL_IPV4 || ill->ill_mactype == DL_IPV6) { 2277 dest_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2278 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2279 if (dest_mp == NULL) 2280 goto bad; 2281 ((dl_phys_addr_req_t *)dest_mp->b_rptr)->dl_addr_type = 2282 DL_CURR_DEST_ADDR; 2283 } 2284 2285 /* 2286 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2287 */ 2288 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2289 DL_NOTIFY_REQ); 2290 if (notify_mp == NULL) 2291 goto bad; 2292 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2293 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2294 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG | 2295 DL_NOTE_PROMISC_ON_PHYS | DL_NOTE_PROMISC_OFF_PHYS | 2296 DL_NOTE_REPLUMB); 2297 2298 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2299 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2300 if (phys_mp == NULL) 2301 goto bad; 2302 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2303 DL_CURR_PHYS_ADDR; 2304 2305 info_mp = ip_dlpi_alloc( 2306 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2307 DL_INFO_REQ); 2308 if (info_mp == NULL) 2309 goto bad; 2310 2311 ASSERT(ill->ill_dlpi_capab_state == IDCS_UNKNOWN); 2312 capab_mp = ip_dlpi_alloc(sizeof (dl_capability_req_t), 2313 DL_CAPABILITY_REQ); 2314 if (capab_mp == NULL) 2315 goto bad; 2316 2317 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2318 DL_BIND_REQ); 2319 if (bind_mp == NULL) 2320 goto bad; 2321 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2322 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2323 2324 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2325 if (unbind_mp == NULL) 2326 goto bad; 2327 2328 /* If we need to attach, pre-alloc and initialize the mblk */ 2329 if (ill->ill_needs_attach) { 2330 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2331 DL_ATTACH_REQ); 2332 if (attach_mp == NULL) 2333 goto bad; 2334 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2335 } 2336 2337 /* 2338 * Here we are going to delay the ioctl ack until after 2339 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2340 * original ioctl message before sending the requests 2341 */ 2342 mutex_enter(&ill->ill_lock); 2343 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2344 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2345 /* 2346 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2347 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2348 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2349 */ 2350 ill->ill_phys_addr_pend = 0; 2351 mutex_exit(&ill->ill_lock); 2352 2353 if (attach_mp != NULL) { 2354 ip1dbg(("ill_dl_phys: attach\n")); 2355 ill_dlpi_send(ill, attach_mp); 2356 } 2357 ill_dlpi_send(ill, bind_mp); 2358 ill_dlpi_send(ill, info_mp); 2359 2360 /* 2361 * Send the capability request to get the VRRP capability information. 2362 */ 2363 ill_capability_send(ill, capab_mp); 2364 2365 if (v6token_mp != NULL) 2366 ill_dlpi_send(ill, v6token_mp); 2367 if (v6lla_mp != NULL) 2368 ill_dlpi_send(ill, v6lla_mp); 2369 if (dest_mp != NULL) 2370 ill_dlpi_send(ill, dest_mp); 2371 ill_dlpi_send(ill, phys_mp); 2372 ill_dlpi_send(ill, notify_mp); 2373 ill_dlpi_send(ill, unbind_mp); 2374 2375 /* 2376 * This operation will complete in ip_rput_dlpi_writer with either 2377 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2378 */ 2379 return (EINPROGRESS); 2380 bad: 2381 freemsg(v6token_mp); 2382 freemsg(v6lla_mp); 2383 freemsg(dest_mp); 2384 freemsg(phys_mp); 2385 freemsg(info_mp); 2386 freemsg(attach_mp); 2387 freemsg(bind_mp); 2388 freemsg(capab_mp); 2389 freemsg(unbind_mp); 2390 freemsg(notify_mp); 2391 return (ENOMEM); 2392 } 2393 2394 /* Add room for tcp+ip headers */ 2395 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2396 2397 /* 2398 * DLPI is up. 2399 * Create all the IREs associated with an interface bring up multicast. 2400 * Set the interface flag and finish other initialization 2401 * that potentially had to be differed to after DL_BIND_ACK. 2402 */ 2403 int 2404 ipif_up_done_v6(ipif_t *ipif) 2405 { 2406 ill_t *ill = ipif->ipif_ill; 2407 int err; 2408 boolean_t loopback = B_FALSE; 2409 2410 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2411 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2412 DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done_v6", 2413 ill_t *, ill, ipif_t *, ipif); 2414 2415 /* Check if this is a loopback interface */ 2416 if (ipif->ipif_ill->ill_wq == NULL) 2417 loopback = B_TRUE; 2418 2419 ASSERT(ipif->ipif_isv6); 2420 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2421 2422 if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) { 2423 nce_t *loop_nce = NULL; 2424 uint16_t flags = (NCE_F_MYADDR | NCE_F_NONUD | NCE_F_AUTHORITY); 2425 2426 /* 2427 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 2428 * ipif_lookup_on_name(), but in the case of zones we can have 2429 * several loopback addresses on lo0. So all the interfaces with 2430 * loopback addresses need to be marked IRE_LOOPBACK. 2431 */ 2432 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 2433 ipif->ipif_ire_type = IRE_LOOPBACK; 2434 else 2435 ipif->ipif_ire_type = IRE_LOCAL; 2436 if (ill->ill_net_type != IRE_LOOPBACK) 2437 flags |= NCE_F_PUBLISH; 2438 err = nce_lookup_then_add_v6(ill, NULL, 2439 ill->ill_phys_addr_length, 2440 &ipif->ipif_v6lcl_addr, flags, ND_REACHABLE, &loop_nce); 2441 2442 /* A shared-IP zone sees EEXIST for lo0:N */ 2443 if (err == 0 || err == EEXIST) { 2444 ipif->ipif_added_nce = 1; 2445 loop_nce->nce_ipif_cnt++; 2446 nce_refrele(loop_nce); 2447 err = 0; 2448 } else { 2449 ASSERT(loop_nce == NULL); 2450 return (err); 2451 } 2452 } 2453 2454 err = ipif_add_ires_v6(ipif, loopback); 2455 if (err != 0) { 2456 /* 2457 * See comments about return value from 2458 * ipif_addr_availability_check() in ipif_add_ires_v6(). 2459 */ 2460 if (err != EADDRINUSE) { 2461 ipif_ndp_down(ipif); 2462 } else { 2463 /* 2464 * Make IPMP aware of the deleted ipif so that 2465 * the needed ipmp cleanup (e.g., of ipif_bound_ill) 2466 * can be completed. Note that we do not want to 2467 * destroy the nce that was created on the ipmp_ill 2468 * for the active copy of the duplicate address in 2469 * use. 2470 */ 2471 if (IS_IPMP(ill)) 2472 ipmp_illgrp_del_ipif(ill->ill_grp, ipif); 2473 err = EADDRNOTAVAIL; 2474 } 2475 return (err); 2476 } 2477 2478 if (ill->ill_ipif_up_count == 1 && !loopback) { 2479 /* Recover any additional IREs entries for this ill */ 2480 (void) ill_recover_saved_ire(ill); 2481 } 2482 2483 if (ill->ill_need_recover_multicast) { 2484 /* 2485 * Need to recover all multicast memberships in the driver. 2486 * This had to be deferred until we had attached. 2487 */ 2488 ill_recover_multicast(ill); 2489 } 2490 2491 if (ill->ill_ipif_up_count == 1) { 2492 /* 2493 * Since the interface is now up, it may now be active. 2494 */ 2495 if (IS_UNDER_IPMP(ill)) 2496 ipmp_ill_refresh_active(ill); 2497 } 2498 2499 /* Join the allhosts multicast address and the solicited node MC */ 2500 ipif_multicast_up(ipif); 2501 2502 /* Perhaps ilgs should use this ill */ 2503 update_conn_ill(NULL, ill->ill_ipst); 2504 2505 if (ipif->ipif_addr_ready) 2506 ipif_up_notify(ipif); 2507 2508 return (0); 2509 } 2510 2511 /* 2512 * Add the IREs associated with the ipif. 2513 * Those MUST be explicitly removed in ipif_delete_ires_v6. 2514 */ 2515 static int 2516 ipif_add_ires_v6(ipif_t *ipif, boolean_t loopback) 2517 { 2518 ill_t *ill = ipif->ipif_ill; 2519 ip_stack_t *ipst = ill->ill_ipst; 2520 in6_addr_t v6addr; 2521 in6_addr_t route_mask; 2522 int err; 2523 char buf[INET6_ADDRSTRLEN]; 2524 ire_t *ire_local = NULL; /* LOCAL or LOOPBACK */ 2525 ire_t *ire_if = NULL; 2526 in6_addr_t *gw; 2527 2528 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 2529 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 2530 2531 /* 2532 * If we're on a labeled system then make sure that zone- 2533 * private addresses have proper remote host database entries. 2534 */ 2535 if (is_system_labeled() && 2536 ipif->ipif_ire_type != IRE_LOOPBACK) { 2537 if (ip6opt_ls == 0) { 2538 cmn_err(CE_WARN, "IPv6 not enabled " 2539 "via /etc/system"); 2540 return (EINVAL); 2541 } 2542 if (!tsol_check_interface_address(ipif)) 2543 return (EINVAL); 2544 } 2545 2546 if (loopback) 2547 gw = &ipif->ipif_v6lcl_addr; 2548 else 2549 gw = NULL; 2550 2551 /* Register the source address for __sin6_src_id */ 2552 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 2553 ipif->ipif_zoneid, ipst); 2554 if (err != 0) { 2555 ip0dbg(("ipif_add_ires_v6: srcid_insert %d\n", err)); 2556 return (err); 2557 } 2558 /* 2559 * If the interface address is set, create the LOCAL 2560 * or LOOPBACK IRE. 2561 */ 2562 ip1dbg(("ipif_add_ires_v6: creating IRE %d for %s\n", 2563 ipif->ipif_ire_type, 2564 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 2565 buf, sizeof (buf)))); 2566 2567 ire_local = ire_create_v6( 2568 &ipif->ipif_v6lcl_addr, /* dest address */ 2569 &ipv6_all_ones, /* mask */ 2570 gw, /* gateway */ 2571 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 2572 ipif->ipif_ill, /* interface */ 2573 ipif->ipif_zoneid, 2574 ((ipif->ipif_flags & IPIF_PRIVATE) ? 2575 RTF_PRIVATE : 0) | RTF_KERNEL, 2576 NULL, 2577 ipst); 2578 if (ire_local == NULL) { 2579 ip1dbg(("ipif_up_done_v6: NULL ire_local\n")); 2580 err = ENOMEM; 2581 goto bad; 2582 } 2583 } 2584 2585 /* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */ 2586 if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) && 2587 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2588 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2589 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2590 v6addr = ipif->ipif_v6subnet; 2591 2592 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2593 route_mask = ipv6_all_ones; 2594 } else { 2595 route_mask = ipif->ipif_v6net_mask; 2596 } 2597 2598 ip1dbg(("ipif_add_ires_v6: creating if IRE %d for %s\n", 2599 ill->ill_net_type, 2600 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 2601 2602 ire_if = ire_create_v6( 2603 &v6addr, /* dest pref */ 2604 &route_mask, /* mask */ 2605 &ipif->ipif_v6lcl_addr, /* gateway */ 2606 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2607 ipif->ipif_ill, 2608 ipif->ipif_zoneid, 2609 ((ipif->ipif_flags & IPIF_PRIVATE) ? 2610 RTF_PRIVATE : 0) | RTF_KERNEL, 2611 NULL, 2612 ipst); 2613 if (ire_if == NULL) { 2614 ip1dbg(("ipif_up_done: NULL ire_if\n")); 2615 err = ENOMEM; 2616 goto bad; 2617 } 2618 } 2619 2620 /* 2621 * Need to atomically check for IP address availability under 2622 * ip_addr_avail_lock. ill_g_lock is held as reader to ensure no new 2623 * ills or new ipifs can be added while we are checking availability. 2624 */ 2625 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2626 mutex_enter(&ipst->ips_ip_addr_avail_lock); 2627 ill->ill_ipif_up_count++; 2628 ipif->ipif_flags |= IPIF_UP; 2629 err = ip_addr_availability_check(ipif); 2630 mutex_exit(&ipst->ips_ip_addr_avail_lock); 2631 rw_exit(&ipst->ips_ill_g_lock); 2632 2633 if (err != 0) { 2634 /* 2635 * Our address may already be up on the same ill. In this case, 2636 * the external resolver entry for our ipif replaced the one for 2637 * the other ipif. So we don't want to delete it (otherwise the 2638 * other ipif would be unable to send packets). 2639 * ip_addr_availability_check() identifies this case for us and 2640 * returns EADDRINUSE; Caller must turn it into EADDRNOTAVAIL 2641 * which is the expected error code. 2642 * 2643 * Note that ipif_ndp_down() will only delete the nce in the 2644 * case when the nce_ipif_cnt drops to 0. 2645 */ 2646 ill->ill_ipif_up_count--; 2647 ipif->ipif_flags &= ~IPIF_UP; 2648 goto bad; 2649 } 2650 2651 /* 2652 * Add in all newly created IREs. 2653 * We add the IRE_INTERFACE before the IRE_LOCAL to ensure 2654 * that lookups find the IRE_LOCAL even if the IRE_INTERFACE is 2655 * a /128 route. 2656 */ 2657 if (ire_if != NULL) { 2658 ire_if = ire_add(ire_if); 2659 if (ire_if == NULL) { 2660 err = ENOMEM; 2661 goto bad2; 2662 } 2663 #ifdef DEBUG 2664 ire_refhold_notr(ire_if); 2665 ire_refrele(ire_if); 2666 #endif 2667 } 2668 if (ire_local != NULL) { 2669 ire_local = ire_add(ire_local); 2670 if (ire_local == NULL) { 2671 err = ENOMEM; 2672 goto bad2; 2673 } 2674 #ifdef DEBUG 2675 ire_refhold_notr(ire_local); 2676 ire_refrele(ire_local); 2677 #endif 2678 } 2679 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER); 2680 if (ire_local != NULL) 2681 ipif->ipif_ire_local = ire_local; 2682 if (ire_if != NULL) 2683 ipif->ipif_ire_if = ire_if; 2684 rw_exit(&ipst->ips_ill_g_lock); 2685 ire_local = NULL; 2686 ire_if = NULL; 2687 2688 if (ipif->ipif_addr_ready) 2689 ipif_up_notify(ipif); 2690 return (0); 2691 2692 bad2: 2693 ill->ill_ipif_up_count--; 2694 ipif->ipif_flags &= ~IPIF_UP; 2695 2696 bad: 2697 if (ire_local != NULL) 2698 ire_delete(ire_local); 2699 if (ire_if != NULL) 2700 ire_delete(ire_if); 2701 2702 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER); 2703 ire_local = ipif->ipif_ire_local; 2704 ipif->ipif_ire_local = NULL; 2705 ire_if = ipif->ipif_ire_if; 2706 ipif->ipif_ire_if = NULL; 2707 rw_exit(&ipst->ips_ill_g_lock); 2708 if (ire_local != NULL) { 2709 ire_delete(ire_local); 2710 ire_refrele_notr(ire_local); 2711 } 2712 if (ire_if != NULL) { 2713 ire_delete(ire_if); 2714 ire_refrele_notr(ire_if); 2715 } 2716 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst); 2717 2718 return (err); 2719 } 2720 2721 /* Remove all the IREs created by ipif_add_ires_v6 */ 2722 void 2723 ipif_delete_ires_v6(ipif_t *ipif) 2724 { 2725 ill_t *ill = ipif->ipif_ill; 2726 ip_stack_t *ipst = ill->ill_ipst; 2727 ire_t *ire; 2728 2729 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER); 2730 ire = ipif->ipif_ire_local; 2731 ipif->ipif_ire_local = NULL; 2732 rw_exit(&ipst->ips_ill_g_lock); 2733 if (ire != NULL) { 2734 /* 2735 * Move count to ipif so we don't loose the count due to 2736 * a down/up dance. 2737 */ 2738 atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count); 2739 2740 ire_delete(ire); 2741 ire_refrele_notr(ire); 2742 } 2743 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER); 2744 ire = ipif->ipif_ire_if; 2745 ipif->ipif_ire_if = NULL; 2746 rw_exit(&ipst->ips_ill_g_lock); 2747 if (ire != NULL) { 2748 ire_delete(ire); 2749 ire_refrele_notr(ire); 2750 } 2751 } 2752 2753 /* 2754 * Delete an ND entry if it exists. 2755 */ 2756 /* ARGSUSED */ 2757 int 2758 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2759 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2760 { 2761 sin6_t *sin6; 2762 struct lifreq *lifr; 2763 lif_nd_req_t *lnr; 2764 ill_t *ill = ipif->ipif_ill; 2765 nce_t *nce; 2766 2767 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2768 lnr = &lifr->lifr_nd; 2769 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2770 if (ipif->ipif_id != 0) 2771 return (EINVAL); 2772 2773 if (!ipif->ipif_isv6) 2774 return (EINVAL); 2775 2776 if (lnr->lnr_addr.ss_family != AF_INET6) 2777 return (EAFNOSUPPORT); 2778 2779 sin6 = (sin6_t *)&lnr->lnr_addr; 2780 2781 /* 2782 * Since ND mappings must be consistent across an IPMP group, prohibit 2783 * deleting ND mappings on underlying interfaces. 2784 * Don't allow deletion of mappings for local addresses. 2785 */ 2786 if (IS_UNDER_IPMP(ill)) 2787 return (EPERM); 2788 2789 nce = nce_lookup_v6(ill, &sin6->sin6_addr); 2790 if (nce == NULL) 2791 return (ESRCH); 2792 2793 if (NCE_MYADDR(nce->nce_common)) { 2794 nce_refrele(nce); 2795 return (EPERM); 2796 } 2797 2798 /* 2799 * delete the nce_common which will also delete the nces on any 2800 * under_ill in the case of ipmp. 2801 */ 2802 ncec_delete(nce->nce_common); 2803 nce_refrele(nce); 2804 return (0); 2805 } 2806 2807 /* 2808 * Return nbr cache info. 2809 */ 2810 /* ARGSUSED */ 2811 int 2812 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2813 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2814 { 2815 ill_t *ill = ipif->ipif_ill; 2816 struct lifreq *lifr; 2817 lif_nd_req_t *lnr; 2818 2819 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2820 lnr = &lifr->lifr_nd; 2821 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2822 if (ipif->ipif_id != 0) 2823 return (EINVAL); 2824 2825 if (!ipif->ipif_isv6) 2826 return (EINVAL); 2827 2828 if (lnr->lnr_addr.ss_family != AF_INET6) 2829 return (EAFNOSUPPORT); 2830 2831 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 2832 return (EINVAL); 2833 2834 return (ndp_query(ill, lnr)); 2835 } 2836 2837 /* 2838 * Perform an update of the nd entry for the specified address. 2839 */ 2840 /* ARGSUSED */ 2841 int 2842 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2843 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2844 { 2845 sin6_t *sin6; 2846 ill_t *ill = ipif->ipif_ill; 2847 struct lifreq *lifr; 2848 lif_nd_req_t *lnr; 2849 ire_t *ire; 2850 2851 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2852 lnr = &lifr->lifr_nd; 2853 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2854 if (ipif->ipif_id != 0) 2855 return (EINVAL); 2856 2857 if (!ipif->ipif_isv6) 2858 return (EINVAL); 2859 2860 if (lnr->lnr_addr.ss_family != AF_INET6) 2861 return (EAFNOSUPPORT); 2862 2863 sin6 = (sin6_t *)&lnr->lnr_addr; 2864 2865 /* 2866 * Since ND mappings must be consistent across an IPMP group, prohibit 2867 * updating ND mappings on underlying interfaces. Also, since ND 2868 * mappings for IPMP data addresses are owned by IP itself, prohibit 2869 * updating them. 2870 */ 2871 if (IS_UNDER_IPMP(ill)) 2872 return (EPERM); 2873 2874 if (IS_IPMP(ill)) { 2875 ire = ire_ftable_lookup_v6(&sin6->sin6_addr, NULL, NULL, 2876 IRE_LOCAL, ill, ALL_ZONES, NULL, 2877 MATCH_IRE_TYPE | MATCH_IRE_ILL, 0, ill->ill_ipst, NULL); 2878 if (ire != NULL) { 2879 ire_refrele(ire); 2880 return (EPERM); 2881 } 2882 } 2883 2884 return (ndp_sioc_update(ill, lnr)); 2885 } 2886