1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 1990 Mentat Inc. 27 */ 28 29 #pragma ident "%Z%%M% %I% %E% SMI" 30 31 /* 32 * This file contains the interface control functions for IPv6. 33 */ 34 35 #include <sys/types.h> 36 #include <sys/sysmacros.h> 37 #include <sys/stream.h> 38 #include <sys/dlpi.h> 39 #include <sys/stropts.h> 40 #include <sys/ddi.h> 41 #include <sys/cmn_err.h> 42 #include <sys/kstat.h> 43 #include <sys/debug.h> 44 #include <sys/zone.h> 45 #include <sys/policy.h> 46 47 #include <sys/systm.h> 48 #include <sys/param.h> 49 #include <sys/socket.h> 50 #include <sys/isa_defs.h> 51 #include <net/if.h> 52 #include <net/if_dl.h> 53 #include <net/route.h> 54 #include <netinet/in.h> 55 #include <netinet/igmp_var.h> 56 #include <netinet/ip6.h> 57 #include <netinet/icmp6.h> 58 #include <netinet/in.h> 59 60 #include <inet/common.h> 61 #include <inet/nd.h> 62 #include <inet/mib2.h> 63 #include <inet/ip.h> 64 #include <inet/ip6.h> 65 #include <inet/ip_multi.h> 66 #include <inet/ip_ire.h> 67 #include <inet/ip_rts.h> 68 #include <inet/ip_ndp.h> 69 #include <inet/ip_if.h> 70 #include <inet/ip6_asp.h> 71 #include <inet/tun.h> 72 #include <inet/ipclassifier.h> 73 #include <inet/sctp_ip.h> 74 75 #include <sys/tsol/tndb.h> 76 #include <sys/tsol/tnet.h> 77 78 static in6_addr_t ipv6_ll_template = 79 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 80 81 static ipif_t * 82 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 83 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst); 84 85 /* 86 * These two functions, ipif_lookup_group_v6() and ill_lookup_group_v6(), 87 * are called when an application does not specify an interface to be 88 * used for multicast traffic. It calls ire_lookup_multi_v6() to look 89 * for an interface route for the specified multicast group. Doing 90 * this allows the administrator to add prefix routes for multicast to 91 * indicate which interface to be used for multicast traffic in the above 92 * scenario. The route could be for all multicast (ff00::/8), for a single 93 * multicast group (a /128 route) or anything in between. If there is no 94 * such multicast route, we just find any multicast capable interface and 95 * return it. 96 */ 97 ipif_t * 98 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst) 99 { 100 ire_t *ire; 101 ipif_t *ipif; 102 103 ire = ire_lookup_multi_v6(group, zoneid, ipst); 104 if (ire != NULL) { 105 ipif = ire->ire_ipif; 106 ipif_refhold(ipif); 107 ire_refrele(ire); 108 return (ipif); 109 } 110 111 return (ipif_lookup_multicast(ipst, zoneid, B_TRUE)); 112 } 113 114 ill_t * 115 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst) 116 { 117 ire_t *ire; 118 ill_t *ill; 119 ipif_t *ipif; 120 121 ire = ire_lookup_multi_v6(group, zoneid, ipst); 122 if (ire != NULL) { 123 ill = ire->ire_ipif->ipif_ill; 124 ill_refhold(ill); 125 ire_refrele(ire); 126 return (ill); 127 } 128 129 ipif = ipif_lookup_multicast(ipst, zoneid, B_TRUE); 130 if (ipif == NULL) 131 return (NULL); 132 133 ill = ipif->ipif_ill; 134 ill_refhold(ill); 135 ipif_refrele(ipif); 136 return (ill); 137 } 138 139 /* 140 * Look for an ipif with the specified interface address and destination. 141 * The destination address is used only for matching point-to-point interfaces. 142 */ 143 static ipif_t * 144 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 145 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst) 146 { 147 ipif_t *ipif; 148 ill_t *ill; 149 ipsq_t *ipsq; 150 ill_walk_context_t ctx; 151 152 if (error != NULL) 153 *error = 0; 154 155 /* 156 * First match all the point-to-point interfaces 157 * before looking at non-point-to-point interfaces. 158 * This is done to avoid returning non-point-to-point 159 * ipif instead of unnumbered point-to-point ipif. 160 */ 161 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 162 ill = ILL_START_WALK_V6(&ctx, ipst); 163 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 164 GRAB_CONN_LOCK(q); 165 mutex_enter(&ill->ill_lock); 166 for (ipif = ill->ill_ipif; ipif != NULL; 167 ipif = ipif->ipif_next) { 168 /* Allow the ipif to be down */ 169 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 170 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 171 if_addr)) && 172 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 173 dst))) { 174 if (IPIF_CAN_LOOKUP(ipif)) { 175 ipif_refhold_locked(ipif); 176 mutex_exit(&ill->ill_lock); 177 RELEASE_CONN_LOCK(q); 178 rw_exit(&ipst->ips_ill_g_lock); 179 return (ipif); 180 } else if (IPIF_CAN_WAIT(ipif, q)) { 181 ipsq = ill->ill_phyint->phyint_ipsq; 182 mutex_enter(&ipsq->ipsq_lock); 183 mutex_exit(&ill->ill_lock); 184 rw_exit(&ipst->ips_ill_g_lock); 185 ipsq_enq(ipsq, q, mp, func, NEW_OP, 186 ill); 187 mutex_exit(&ipsq->ipsq_lock); 188 RELEASE_CONN_LOCK(q); 189 if (error != NULL) 190 *error = EINPROGRESS; 191 return (NULL); 192 } 193 } 194 } 195 mutex_exit(&ill->ill_lock); 196 RELEASE_CONN_LOCK(q); 197 } 198 rw_exit(&ipst->ips_ill_g_lock); 199 /* lookup the ipif based on interface address */ 200 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func, 201 error, ipst); 202 ASSERT(ipif == NULL || ipif->ipif_isv6); 203 return (ipif); 204 } 205 206 /* 207 * Look for an ipif with the specified address. For point-point links 208 * we look for matches on either the destination address and the local 209 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 210 * is set. 211 * Matches on a specific ill if match_ill is set. 212 */ 213 /* ARGSUSED */ 214 ipif_t * 215 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 216 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, ip_stack_t *ipst) 217 { 218 ipif_t *ipif; 219 ill_t *ill; 220 boolean_t ptp = B_FALSE; 221 ipsq_t *ipsq; 222 ill_walk_context_t ctx; 223 224 if (error != NULL) 225 *error = 0; 226 227 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 228 /* 229 * Repeat twice, first based on local addresses and 230 * next time for pointopoint. 231 */ 232 repeat: 233 ill = ILL_START_WALK_V6(&ctx, ipst); 234 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 235 if (match_ill != NULL && ill != match_ill) { 236 continue; 237 } 238 GRAB_CONN_LOCK(q); 239 mutex_enter(&ill->ill_lock); 240 for (ipif = ill->ill_ipif; ipif != NULL; 241 ipif = ipif->ipif_next) { 242 if (zoneid != ALL_ZONES && 243 ipif->ipif_zoneid != zoneid && 244 ipif->ipif_zoneid != ALL_ZONES) 245 continue; 246 /* Allow the ipif to be down */ 247 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 248 &ipif->ipif_v6lcl_addr, addr) && 249 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 250 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 251 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 252 addr))) { 253 if (IPIF_CAN_LOOKUP(ipif)) { 254 ipif_refhold_locked(ipif); 255 mutex_exit(&ill->ill_lock); 256 RELEASE_CONN_LOCK(q); 257 rw_exit(&ipst->ips_ill_g_lock); 258 return (ipif); 259 } else if (IPIF_CAN_WAIT(ipif, q)) { 260 ipsq = ill->ill_phyint->phyint_ipsq; 261 mutex_enter(&ipsq->ipsq_lock); 262 mutex_exit(&ill->ill_lock); 263 rw_exit(&ipst->ips_ill_g_lock); 264 ipsq_enq(ipsq, q, mp, func, NEW_OP, 265 ill); 266 mutex_exit(&ipsq->ipsq_lock); 267 RELEASE_CONN_LOCK(q); 268 if (error != NULL) 269 *error = EINPROGRESS; 270 return (NULL); 271 } 272 } 273 } 274 mutex_exit(&ill->ill_lock); 275 RELEASE_CONN_LOCK(q); 276 } 277 278 /* If we already did the ptp case, then we are done */ 279 if (ptp) { 280 rw_exit(&ipst->ips_ill_g_lock); 281 if (error != NULL) 282 *error = ENXIO; 283 return (NULL); 284 } 285 ptp = B_TRUE; 286 goto repeat; 287 } 288 289 /* 290 * Look for an ipif with the specified address. For point-point links 291 * we look for matches on either the destination address and the local 292 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 293 * is set. 294 * Matches on a specific ill if match_ill is set. 295 * Return the zoneid for the ipif. ALL_ZONES if none found. 296 */ 297 zoneid_t 298 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill, 299 ip_stack_t *ipst) 300 { 301 ipif_t *ipif; 302 ill_t *ill; 303 boolean_t ptp = B_FALSE; 304 ill_walk_context_t ctx; 305 zoneid_t zoneid; 306 307 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 308 /* 309 * Repeat twice, first based on local addresses and 310 * next time for pointopoint. 311 */ 312 repeat: 313 ill = ILL_START_WALK_V6(&ctx, ipst); 314 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 315 if (match_ill != NULL && ill != match_ill) { 316 continue; 317 } 318 mutex_enter(&ill->ill_lock); 319 for (ipif = ill->ill_ipif; ipif != NULL; 320 ipif = ipif->ipif_next) { 321 /* Allow the ipif to be down */ 322 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 323 &ipif->ipif_v6lcl_addr, addr) && 324 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 325 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 326 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 327 addr)) && 328 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) { 329 zoneid = ipif->ipif_zoneid; 330 mutex_exit(&ill->ill_lock); 331 rw_exit(&ipst->ips_ill_g_lock); 332 /* 333 * If ipif_zoneid was ALL_ZONES then we have 334 * a trusted extensions shared IP address. 335 * In that case GLOBAL_ZONEID works to send. 336 */ 337 if (zoneid == ALL_ZONES) 338 zoneid = GLOBAL_ZONEID; 339 return (zoneid); 340 } 341 } 342 mutex_exit(&ill->ill_lock); 343 } 344 345 /* If we already did the ptp case, then we are done */ 346 if (ptp) { 347 rw_exit(&ipst->ips_ill_g_lock); 348 return (ALL_ZONES); 349 } 350 ptp = B_TRUE; 351 goto repeat; 352 } 353 354 /* 355 * Perform various checks to verify that an address would make sense as a local 356 * interface address. This is currently only called when an attempt is made 357 * to set a local address. 358 * 359 * Does not allow a v4-mapped address, an address that equals the subnet 360 * anycast address, ... a multicast address, ... 361 */ 362 boolean_t 363 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 364 { 365 in6_addr_t subnet; 366 367 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 368 return (B_TRUE); /* Allow all zeros */ 369 370 /* 371 * Don't allow all zeroes or host part, but allow 372 * all ones netmask. 373 */ 374 V6_MASK_COPY(*addr, *subnet_mask, subnet); 375 if (IN6_IS_ADDR_V4MAPPED(addr) || 376 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 377 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 378 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 379 IN6_IS_ADDR_MULTICAST(addr)) 380 return (B_FALSE); 381 382 return (B_TRUE); 383 } 384 385 /* 386 * Perform various checks to verify that an address would make sense as a 387 * remote/subnet interface address. 388 */ 389 boolean_t 390 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 391 { 392 in6_addr_t subnet; 393 394 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 395 return (B_TRUE); /* Allow all zeros */ 396 397 V6_MASK_COPY(*addr, *subnet_mask, subnet); 398 if (IN6_IS_ADDR_V4MAPPED(addr) || 399 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 400 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 401 IN6_IS_ADDR_MULTICAST(addr) || 402 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 403 return (B_FALSE); 404 405 return (B_TRUE); 406 } 407 408 /* 409 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 410 * ipif_arg is passed in to associate it with the correct interface 411 * (for link-local destinations and gateways). 412 */ 413 /* ARGSUSED1 */ 414 int 415 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 416 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 417 ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func, 418 struct rtsa_s *sp, ip_stack_t *ipst) 419 { 420 ire_t *ire; 421 ire_t *gw_ire = NULL; 422 ipif_t *ipif; 423 boolean_t ipif_refheld = B_FALSE; 424 uint_t type; 425 int match_flags = MATCH_IRE_TYPE; 426 int error; 427 tsol_gc_t *gc = NULL; 428 tsol_gcgrp_t *gcgrp = NULL; 429 boolean_t gcgrp_xtraref = B_FALSE; 430 431 if (ire_arg != NULL) 432 *ire_arg = NULL; 433 434 /* 435 * Prevent routes with a zero gateway from being created (since 436 * interfaces can currently be plumbed and brought up with no assigned 437 * address). 438 */ 439 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 440 return (ENETUNREACH); 441 442 /* 443 * If this is the case of RTF_HOST being set, then we set the netmask 444 * to all ones (regardless if one was supplied). 445 */ 446 if (flags & RTF_HOST) 447 mask = &ipv6_all_ones; 448 449 /* 450 * Get the ipif, if any, corresponding to the gw_addr 451 */ 452 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, 453 &error, ipst); 454 if (ipif != NULL) 455 ipif_refheld = B_TRUE; 456 else if (error == EINPROGRESS) { 457 ip1dbg(("ip_rt_add_v6: null and EINPROGRESS")); 458 return (error); 459 } 460 461 /* 462 * GateD will attempt to create routes with a loopback interface 463 * address as the gateway and with RTF_GATEWAY set. We allow 464 * these routes to be added, but create them as interface routes 465 * since the gateway is an interface address. 466 */ 467 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) { 468 flags &= ~RTF_GATEWAY; 469 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) && 470 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) && 471 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) { 472 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 473 ipif, ALL_ZONES, NULL, match_flags, ipst); 474 if (ire != NULL) { 475 ire_refrele(ire); 476 if (ipif_refheld) 477 ipif_refrele(ipif); 478 return (EEXIST); 479 } 480 ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x" 481 "for 0x%x\n", (void *)ipif, 482 ipif->ipif_ire_type, 483 ntohl(ipif->ipif_lcl_addr))); 484 ire = ire_create_v6( 485 dst_addr, 486 mask, 487 &ipif->ipif_v6src_addr, 488 NULL, 489 &ipif->ipif_mtu, 490 NULL, 491 NULL, 492 NULL, 493 ipif->ipif_net_type, 494 ipif, 495 NULL, 496 0, 497 0, 498 flags, 499 &ire_uinfo_null, 500 NULL, 501 NULL, 502 ipst); 503 if (ire == NULL) { 504 if (ipif_refheld) 505 ipif_refrele(ipif); 506 return (ENOMEM); 507 } 508 error = ire_add(&ire, q, mp, func, B_FALSE); 509 if (error == 0) 510 goto save_ire; 511 /* 512 * In the result of failure, ire_add() will have already 513 * deleted the ire in question, so there is no need to 514 * do that here. 515 */ 516 if (ipif_refheld) 517 ipif_refrele(ipif); 518 return (error); 519 } 520 } 521 522 /* 523 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 524 * and the gateway address provided is one of the system's interface 525 * addresses. By using the routing socket interface and supplying an 526 * RTA_IFP sockaddr with an interface index, an alternate method of 527 * specifying an interface route to be created is available which uses 528 * the interface index that specifies the outgoing interface rather than 529 * the address of an outgoing interface (which may not be able to 530 * uniquely identify an interface). When coupled with the RTF_GATEWAY 531 * flag, routes can be specified which not only specify the next-hop to 532 * be used when routing to a certain prefix, but also which outgoing 533 * interface should be used. 534 * 535 * Previously, interfaces would have unique addresses assigned to them 536 * and so the address assigned to a particular interface could be used 537 * to identify a particular interface. One exception to this was the 538 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 539 * 540 * With the advent of IPv6 and its link-local addresses, this 541 * restriction was relaxed and interfaces could share addresses between 542 * themselves. In fact, typically all of the link-local interfaces on 543 * an IPv6 node or router will have the same link-local address. In 544 * order to differentiate between these interfaces, the use of an 545 * interface index is necessary and this index can be carried inside a 546 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 547 * of using the interface index, however, is that all of the ipif's that 548 * are part of an ill have the same index and so the RTA_IFP sockaddr 549 * cannot be used to differentiate between ipif's (or logical 550 * interfaces) that belong to the same ill (physical interface). 551 * 552 * For example, in the following case involving IPv4 interfaces and 553 * logical interfaces 554 * 555 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 556 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0:1 557 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0:2 558 * 559 * the ipif's corresponding to each of these interface routes can be 560 * uniquely identified by the "gateway" (actually interface address). 561 * 562 * In this case involving multiple IPv6 default routes to a particular 563 * link-local gateway, the use of RTA_IFP is necessary to specify which 564 * default route is of interest: 565 * 566 * default fe80::123:4567:89ab:cdef U if0 567 * default fe80::123:4567:89ab:cdef U if1 568 */ 569 570 /* RTF_GATEWAY not set */ 571 if (!(flags & RTF_GATEWAY)) { 572 queue_t *stq; 573 574 if (sp != NULL) { 575 ip2dbg(("ip_rt_add_v6: gateway security attributes " 576 "cannot be set with interface route\n")); 577 if (ipif_refheld) 578 ipif_refrele(ipif); 579 return (EINVAL); 580 } 581 582 /* 583 * As the interface index specified with the RTA_IFP sockaddr is 584 * the same for all ipif's off of an ill, the matching logic 585 * below uses MATCH_IRE_ILL if such an index was specified. 586 * This means that routes sharing the same prefix when added 587 * using a RTA_IFP sockaddr must have distinct interface 588 * indices (namely, they must be on distinct ill's). 589 * 590 * On the other hand, since the gateway address will usually be 591 * different for each ipif on the system, the matching logic 592 * uses MATCH_IRE_IPIF in the case of a traditional interface 593 * route. This means that interface routes for the same prefix 594 * can be created if they belong to distinct ipif's and if a 595 * RTA_IFP sockaddr is not present. 596 */ 597 if (ipif_arg != NULL) { 598 if (ipif_refheld) { 599 ipif_refrele(ipif); 600 ipif_refheld = B_FALSE; 601 } 602 ipif = ipif_arg; 603 match_flags |= MATCH_IRE_ILL; 604 } else { 605 /* 606 * Check the ipif corresponding to the gw_addr 607 */ 608 if (ipif == NULL) 609 return (ENETUNREACH); 610 match_flags |= MATCH_IRE_IPIF; 611 } 612 613 ASSERT(ipif != NULL); 614 /* 615 * We check for an existing entry at this point. 616 */ 617 match_flags |= MATCH_IRE_MASK; 618 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE, 619 ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 620 if (ire != NULL) { 621 ire_refrele(ire); 622 if (ipif_refheld) 623 ipif_refrele(ipif); 624 return (EEXIST); 625 } 626 627 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 628 ? ipif->ipif_rq : ipif->ipif_wq; 629 630 /* 631 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or 632 * IRE_IF_RESOLVER with the modified address and netmask. 633 */ 634 ire = ire_create_v6( 635 dst_addr, 636 mask, 637 &ipif->ipif_v6src_addr, 638 NULL, 639 &ipif->ipif_mtu, 640 NULL, 641 NULL, 642 stq, 643 ipif->ipif_net_type, 644 ipif, 645 NULL, 646 0, 647 0, 648 flags, 649 &ire_uinfo_null, 650 NULL, 651 NULL, 652 ipst); 653 if (ire == NULL) { 654 if (ipif_refheld) 655 ipif_refrele(ipif); 656 return (ENOMEM); 657 } 658 659 /* 660 * Some software (for example, GateD and Sun Cluster) attempts 661 * to create (what amount to) IRE_PREFIX routes with the 662 * loopback address as the gateway. This is primarily done to 663 * set up prefixes with the RTF_REJECT flag set (for example, 664 * when generating aggregate routes). We also OR in the 665 * RTF_BLACKHOLE flag as these interface routes, by 666 * definition, can only be that. 667 * 668 * If the IRE type (as defined by ipif->ipif_net_type) is 669 * IRE_LOOPBACK, then we map the request into a 670 * IRE_IF_NORESOLVER. 671 * 672 * Needless to say, the real IRE_LOOPBACK is NOT created by this 673 * routine, but rather using ire_create_v6() directly. 674 */ 675 if (ipif->ipif_net_type == IRE_LOOPBACK) { 676 ire->ire_type = IRE_IF_NORESOLVER; 677 ire->ire_flags |= RTF_BLACKHOLE; 678 } 679 error = ire_add(&ire, q, mp, func, B_FALSE); 680 if (error == 0) 681 goto save_ire; 682 /* 683 * In the result of failure, ire_add() will have already 684 * deleted the ire in question, so there is no need to 685 * do that here. 686 */ 687 if (ipif_refheld) 688 ipif_refrele(ipif); 689 return (error); 690 } 691 if (ipif_refheld) { 692 ipif_refrele(ipif); 693 ipif_refheld = B_FALSE; 694 } 695 696 /* 697 * Get an interface IRE for the specified gateway. 698 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 699 * gateway, it is currently unreachable and we fail the request 700 * accordingly. 701 */ 702 ipif = ipif_arg; 703 if (ipif_arg != NULL) 704 match_flags |= MATCH_IRE_ILL; 705 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, 706 NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 707 if (gw_ire == NULL) 708 return (ENETUNREACH); 709 710 /* 711 * We create one of three types of IREs as a result of this request 712 * based on the netmask. A netmask of all ones (which is automatically 713 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 714 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 715 * created. Otherwise, an IRE_PREFIX route is created for the 716 * destination prefix. 717 */ 718 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 719 type = IRE_HOST; 720 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 721 type = IRE_DEFAULT; 722 else 723 type = IRE_PREFIX; 724 725 /* check for a duplicate entry */ 726 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg, 727 NULL, ALL_ZONES, 0, NULL, 728 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, ipst); 729 if (ire != NULL) { 730 ire_refrele(gw_ire); 731 ire_refrele(ire); 732 return (EEXIST); 733 } 734 735 /* Security attribute exists */ 736 if (sp != NULL) { 737 tsol_gcgrp_addr_t ga; 738 739 /* find or create the gateway credentials group */ 740 ga.ga_af = AF_INET6; 741 ga.ga_addr = *gw_addr; 742 743 /* we hold reference to it upon success */ 744 gcgrp = gcgrp_lookup(&ga, B_TRUE); 745 if (gcgrp == NULL) { 746 ire_refrele(gw_ire); 747 return (ENOMEM); 748 } 749 750 /* 751 * Create and add the security attribute to the group; a 752 * reference to the group is made upon allocating a new 753 * entry successfully. If it finds an already-existing 754 * entry for the security attribute in the group, it simply 755 * returns it and no new reference is made to the group. 756 */ 757 gc = gc_create(sp, gcgrp, &gcgrp_xtraref); 758 if (gc == NULL) { 759 /* release reference held by gcgrp_lookup */ 760 GCGRP_REFRELE(gcgrp); 761 ire_refrele(gw_ire); 762 return (ENOMEM); 763 } 764 } 765 766 /* Create the IRE. */ 767 ire = ire_create_v6( 768 dst_addr, /* dest address */ 769 mask, /* mask */ 770 /* src address assigned by the caller? */ 771 (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ? 772 src_addr : NULL), 773 gw_addr, /* gateway address */ 774 &gw_ire->ire_max_frag, 775 NULL, /* no src nce */ 776 NULL, /* no recv-from queue */ 777 NULL, /* no send-to queue */ 778 (ushort_t)type, /* IRE type */ 779 ipif_arg, 780 NULL, 781 0, 782 0, 783 flags, 784 &gw_ire->ire_uinfo, /* Inherit ULP info from gw */ 785 gc, /* security attribute */ 786 NULL, 787 ipst); 788 789 /* 790 * The ire holds a reference to the 'gc' and the 'gc' holds a 791 * reference to the 'gcgrp'. We can now release the extra reference 792 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used. 793 */ 794 if (gcgrp_xtraref) 795 GCGRP_REFRELE(gcgrp); 796 if (ire == NULL) { 797 if (gc != NULL) 798 GC_REFRELE(gc); 799 ire_refrele(gw_ire); 800 return (ENOMEM); 801 } 802 803 /* 804 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 805 * SUN/OS socket stuff does but do we really want to allow ::0 ? 806 */ 807 808 /* Add the new IRE. */ 809 error = ire_add(&ire, q, mp, func, B_FALSE); 810 /* 811 * In the result of failure, ire_add() will have already 812 * deleted the ire in question, so there is no need to 813 * do that here. 814 */ 815 if (error != 0) { 816 ire_refrele(gw_ire); 817 return (error); 818 } 819 820 if (flags & RTF_MULTIRT) { 821 /* 822 * Invoke the CGTP (multirouting) filtering module 823 * to add the dst address in the filtering database. 824 * Replicated inbound packets coming from that address 825 * will be filtered to discard the duplicates. 826 * It is not necessary to call the CGTP filter hook 827 * when the dst address is a multicast, because an 828 * IP source address cannot be a multicast. 829 */ 830 if (ipst->ips_ip_cgtp_filter_ops != NULL && 831 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 832 int res; 833 834 res = ipst->ips_ip_cgtp_filter_ops->cfo_add_dest_v6( 835 ipst->ips_netstack->netstack_stackid, 836 &ire->ire_addr_v6, 837 &ire->ire_gateway_addr_v6, 838 &ire->ire_src_addr_v6, 839 &gw_ire->ire_src_addr_v6); 840 if (res != 0) { 841 ire_refrele(gw_ire); 842 ire_delete(ire); 843 return (res); 844 } 845 } 846 } 847 848 /* 849 * Now that the prefix IRE entry has been created, delete any 850 * existing gateway IRE cache entries as well as any IRE caches 851 * using the gateway, and force them to be created through 852 * ip_newroute_v6. 853 */ 854 if (gc != NULL) { 855 ASSERT(gcgrp != NULL); 856 ire_clookup_delete_cache_gw_v6(gw_addr, ALL_ZONES, ipst); 857 } 858 859 save_ire: 860 if (gw_ire != NULL) { 861 ire_refrele(gw_ire); 862 } 863 if (ipif != NULL) { 864 mblk_t *save_mp; 865 866 /* 867 * Save enough information so that we can recreate the IRE if 868 * the interface goes down and then up. The metrics associated 869 * with the route will be saved as well when rts_setmetrics() is 870 * called after the IRE has been created. In the case where 871 * memory cannot be allocated, none of this information will be 872 * saved. 873 */ 874 save_mp = allocb(sizeof (ifrt_t), BPRI_MED); 875 if (save_mp != NULL) { 876 ifrt_t *ifrt; 877 878 save_mp->b_wptr += sizeof (ifrt_t); 879 ifrt = (ifrt_t *)save_mp->b_rptr; 880 bzero(ifrt, sizeof (ifrt_t)); 881 ifrt->ifrt_type = ire->ire_type; 882 ifrt->ifrt_v6addr = ire->ire_addr_v6; 883 mutex_enter(&ire->ire_lock); 884 ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6; 885 ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6; 886 mutex_exit(&ire->ire_lock); 887 ifrt->ifrt_v6mask = ire->ire_mask_v6; 888 ifrt->ifrt_flags = ire->ire_flags; 889 ifrt->ifrt_max_frag = ire->ire_max_frag; 890 mutex_enter(&ipif->ipif_saved_ire_lock); 891 save_mp->b_cont = ipif->ipif_saved_ire_mp; 892 ipif->ipif_saved_ire_mp = save_mp; 893 ipif->ipif_saved_ire_cnt++; 894 mutex_exit(&ipif->ipif_saved_ire_lock); 895 } 896 } 897 if (ire_arg != NULL) { 898 /* 899 * Store the ire that was successfully added into where ire_arg 900 * points to so that callers don't have to look it up 901 * themselves (but they are responsible for ire_refrele()ing 902 * the ire when they are finished with it). 903 */ 904 *ire_arg = ire; 905 } else { 906 ire_refrele(ire); /* Held in ire_add */ 907 } 908 if (ipif_refheld) 909 ipif_refrele(ipif); 910 return (0); 911 } 912 913 /* 914 * ip_rt_delete_v6 is called to delete an IPv6 route. 915 * ipif_arg is passed in to associate it with the correct interface 916 * (for link-local destinations and gateways). 917 */ 918 /* ARGSUSED4 */ 919 int 920 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 921 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg, 922 queue_t *q, mblk_t *mp, ipsq_func_t func, ip_stack_t *ipst) 923 { 924 ire_t *ire = NULL; 925 ipif_t *ipif; 926 uint_t type; 927 uint_t match_flags = MATCH_IRE_TYPE; 928 int err = 0; 929 boolean_t ipif_refheld = B_FALSE; 930 931 /* 932 * If this is the case of RTF_HOST being set, then we set the netmask 933 * to all ones. Otherwise, we use the netmask if one was supplied. 934 */ 935 if (flags & RTF_HOST) { 936 mask = &ipv6_all_ones; 937 match_flags |= MATCH_IRE_MASK; 938 } else if (rtm_addrs & RTA_NETMASK) { 939 match_flags |= MATCH_IRE_MASK; 940 } 941 942 /* 943 * Note that RTF_GATEWAY is never set on a delete, therefore 944 * we check if the gateway address is one of our interfaces first, 945 * and fall back on RTF_GATEWAY routes. 946 * 947 * This makes it possible to delete an original 948 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 949 * 950 * As the interface index specified with the RTA_IFP sockaddr is the 951 * same for all ipif's off of an ill, the matching logic below uses 952 * MATCH_IRE_ILL if such an index was specified. This means a route 953 * sharing the same prefix and interface index as the the route 954 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr 955 * is specified in the request. 956 * 957 * On the other hand, since the gateway address will usually be 958 * different for each ipif on the system, the matching logic 959 * uses MATCH_IRE_IPIF in the case of a traditional interface 960 * route. This means that interface routes for the same prefix can be 961 * uniquely identified if they belong to distinct ipif's and if a 962 * RTA_IFP sockaddr is not present. 963 * 964 * For more detail on specifying routes by gateway address and by 965 * interface index, see the comments in ip_rt_add_v6(). 966 */ 967 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err, 968 ipst); 969 if (ipif != NULL) { 970 ipif_refheld = B_TRUE; 971 if (ipif_arg != NULL) { 972 ipif_refrele(ipif); 973 ipif_refheld = B_FALSE; 974 ipif = ipif_arg; 975 match_flags |= MATCH_IRE_ILL; 976 } else { 977 match_flags |= MATCH_IRE_IPIF; 978 } 979 980 if (ipif->ipif_ire_type == IRE_LOOPBACK) 981 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 982 ipif, ALL_ZONES, NULL, match_flags, ipst); 983 if (ire == NULL) 984 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, 985 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, NULL, 986 match_flags, ipst); 987 } else if (err == EINPROGRESS) { 988 return (err); 989 } else { 990 err = 0; 991 } 992 if (ire == NULL) { 993 /* 994 * At this point, the gateway address is not one of our own 995 * addresses or a matching interface route was not found. We 996 * set the IRE type to lookup based on whether 997 * this is a host route, a default route or just a prefix. 998 * 999 * If an ipif_arg was passed in, then the lookup is based on an 1000 * interface index so MATCH_IRE_ILL is added to match_flags. 1001 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is 1002 * set as the route being looked up is not a traditional 1003 * interface route. 1004 */ 1005 match_flags &= ~MATCH_IRE_IPIF; 1006 match_flags |= MATCH_IRE_GW; 1007 if (ipif_arg != NULL) 1008 match_flags |= MATCH_IRE_ILL; 1009 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 1010 type = IRE_HOST; 1011 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 1012 type = IRE_DEFAULT; 1013 else 1014 type = IRE_PREFIX; 1015 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 1016 ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); 1017 } 1018 1019 if (ipif_refheld) { 1020 ipif_refrele(ipif); 1021 ipif_refheld = B_FALSE; 1022 } 1023 if (ire == NULL) 1024 return (ESRCH); 1025 1026 if (ire->ire_flags & RTF_MULTIRT) { 1027 /* 1028 * Invoke the CGTP (multirouting) filtering module 1029 * to remove the dst address from the filtering database. 1030 * Packets coming from that address will no longer be 1031 * filtered to remove duplicates. 1032 */ 1033 if (ipst->ips_ip_cgtp_filter_ops != NULL) { 1034 err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v6( 1035 ipst->ips_netstack->netstack_stackid, 1036 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 1037 } 1038 } 1039 1040 ipif = ire->ire_ipif; 1041 if (ipif != NULL) { 1042 mblk_t **mpp; 1043 mblk_t *mp; 1044 ifrt_t *ifrt; 1045 in6_addr_t gw_addr_v6; 1046 1047 /* Remove from ipif_saved_ire_mp list if it is there */ 1048 mutex_enter(&ire->ire_lock); 1049 gw_addr_v6 = ire->ire_gateway_addr_v6; 1050 mutex_exit(&ire->ire_lock); 1051 mutex_enter(&ipif->ipif_saved_ire_lock); 1052 for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL; 1053 mpp = &(*mpp)->b_cont) { 1054 /* 1055 * On a given ipif, the triple of address, gateway and 1056 * mask is unique for each saved IRE (in the case of 1057 * ordinary interface routes, the gateway address is 1058 * all-zeroes). 1059 */ 1060 mp = *mpp; 1061 ifrt = (ifrt_t *)mp->b_rptr; 1062 if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr, 1063 &ire->ire_addr_v6) && 1064 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr, 1065 &gw_addr_v6) && 1066 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask, 1067 &ire->ire_mask_v6)) { 1068 *mpp = mp->b_cont; 1069 ipif->ipif_saved_ire_cnt--; 1070 freeb(mp); 1071 break; 1072 } 1073 } 1074 mutex_exit(&ipif->ipif_saved_ire_lock); 1075 } 1076 ire_delete(ire); 1077 ire_refrele(ire); 1078 return (err); 1079 } 1080 1081 /* 1082 * Derive a token from the link layer address. 1083 */ 1084 boolean_t 1085 ill_setdefaulttoken(ill_t *ill) 1086 { 1087 int i; 1088 in6_addr_t v6addr, v6mask; 1089 1090 if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length, 1091 ill->ill_phys_addr, &v6addr)) 1092 return (B_FALSE); 1093 1094 (void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask); 1095 1096 for (i = 0; i < 4; i++) 1097 v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^ 1098 (uint32_t)0xffffffff; 1099 1100 V6_MASK_COPY(v6addr, v6mask, ill->ill_token); 1101 ill->ill_token_length = IPV6_TOKEN_LEN; 1102 return (B_TRUE); 1103 } 1104 1105 /* 1106 * Create a link-local address from a token. 1107 */ 1108 static void 1109 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 1110 { 1111 int i; 1112 1113 for (i = 0; i < 4; i++) { 1114 dest->s6_addr32[i] = 1115 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 1116 } 1117 } 1118 1119 /* 1120 * Set a nice default address for either automatic tunnels tsrc/96 or 1121 * 6to4 tunnels 2002:<tsrc>::1/64 1122 */ 1123 static void 1124 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta) 1125 { 1126 sin6_t sin6; 1127 sin_t *sin; 1128 ill_t *ill = ipif->ipif_ill; 1129 tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr; 1130 1131 if (ta->ifta_saddr.ss_family != AF_INET || 1132 (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 || 1133 (ta->ifta_flags & IFTUN_SRC) == 0) 1134 return; 1135 1136 /* 1137 * Check the tunnel type by examining q_next->q_ptr 1138 */ 1139 if (tp->tun_flags & TUN_AUTOMATIC) { 1140 /* this is an automatic tunnel */ 1141 (void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS, 1142 &ipif->ipif_v6net_mask); 1143 bzero(&sin6, sizeof (sin6_t)); 1144 sin = (sin_t *)&ta->ifta_saddr; 1145 V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr; 1146 sin6.sin6_family = AF_INET6; 1147 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1148 NULL, NULL, NULL, NULL); 1149 } else if (tp->tun_flags & TUN_6TO4) { 1150 /* this is a 6to4 tunnel */ 1151 (void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN, 1152 &ipif->ipif_v6net_mask); 1153 sin = (sin_t *)&ta->ifta_saddr; 1154 /* create a 6to4 address from the IPv4 tsrc */ 1155 IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr); 1156 sin6.sin6_family = AF_INET6; 1157 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 1158 NULL, NULL, NULL, NULL); 1159 } else { 1160 ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type")); 1161 return; 1162 } 1163 } 1164 1165 /* 1166 * Set link local for ipif_id 0 of a configured tunnel based on the 1167 * tsrc or tdst parameter 1168 * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as 1169 * the token. 1170 * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address 1171 * as the token for the "outer" link. 1172 */ 1173 void 1174 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta) 1175 { 1176 ipif_t *ipif; 1177 sin_t *sin; 1178 in6_addr_t *s6addr; 1179 1180 ASSERT(IAM_WRITER_ILL(ill)); 1181 1182 /* The first ipif must be id zero. */ 1183 ipif = ill->ill_ipif; 1184 ASSERT(ipif->ipif_id == 0); 1185 1186 /* no link local for automatic tunnels */ 1187 if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) { 1188 ipif_set_tun_auto_addr(ipif, ta); 1189 return; 1190 } 1191 1192 if ((ta->ifta_flags & IFTUN_DST) && 1193 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 1194 sin6_t sin6; 1195 1196 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1197 bzero(&sin6, sizeof (sin6_t)); 1198 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1199 sin = (sin_t *)&ta->ifta_daddr; 1200 V4_PART_OF_V6(sin6.sin6_addr) = 1201 sin->sin_addr.s_addr; 1202 } else { 1203 s6addr = 1204 &((sin6_t *)&ta->ifta_daddr)->sin6_addr; 1205 sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3]; 1206 sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2]; 1207 } 1208 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, 1209 &sin6.sin6_addr); 1210 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1211 } 1212 if ((ta->ifta_flags & IFTUN_SRC)) { 1213 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1214 1215 /* Set the token if it isn't already set */ 1216 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) { 1217 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1218 sin = (sin_t *)&ta->ifta_saddr; 1219 V4_PART_OF_V6(ill->ill_token) = 1220 sin->sin_addr.s_addr; 1221 } else { 1222 s6addr = 1223 &((sin6_t *)&ta->ifta_saddr)->sin6_addr; 1224 ill->ill_token.s6_addr32[3] = 1225 s6addr->s6_addr32[3]; 1226 ill->ill_token.s6_addr32[2] = 1227 s6addr->s6_addr32[2]; 1228 } 1229 ill->ill_token_length = IPV6_TOKEN_LEN; 1230 } 1231 /* 1232 * Attempt to set the link local address if it isn't set. 1233 */ 1234 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) 1235 (void) ipif_setlinklocal(ipif); 1236 } 1237 } 1238 1239 /* 1240 * Is it not possible to set the link local address? 1241 * The address can be set if the token is set, and the token 1242 * isn't too long. 1243 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1244 */ 1245 boolean_t 1246 ipif_cant_setlinklocal(ipif_t *ipif) 1247 { 1248 ill_t *ill = ipif->ipif_ill; 1249 1250 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1251 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1252 return (B_TRUE); 1253 1254 return (B_FALSE); 1255 } 1256 1257 /* 1258 * Generate a link-local address from the token. 1259 * Return zero if the address was set, or non-zero if it couldn't be set. 1260 */ 1261 int 1262 ipif_setlinklocal(ipif_t *ipif) 1263 { 1264 ill_t *ill = ipif->ipif_ill; 1265 in6_addr_t ov6addr; 1266 1267 ASSERT(IAM_WRITER_ILL(ill)); 1268 1269 if (ipif_cant_setlinklocal(ipif)) 1270 return (-1); 1271 1272 ov6addr = ipif->ipif_v6lcl_addr; 1273 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1274 sctp_update_ipif_addr(ipif, ov6addr); 1275 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1276 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1277 ipif->ipif_v6subnet); 1278 1279 if (ipif->ipif_flags & IPIF_NOLOCAL) { 1280 ipif->ipif_v6src_addr = ipv6_all_zeros; 1281 } else { 1282 ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr; 1283 } 1284 return (0); 1285 } 1286 1287 /* 1288 * This function sets up the multicast mappings in NDP. 1289 * Unlike ARP, there are no mapping_mps here. We delete the 1290 * mapping nces and add a new one. 1291 * 1292 * Returns non-zero on error and 0 on success. 1293 */ 1294 int 1295 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce) 1296 { 1297 ill_t *ill = ipif->ipif_ill; 1298 in6_addr_t v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0}; 1299 in6_addr_t v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0}; 1300 in6_addr_t v6_extract_mask; 1301 uchar_t *phys_addr, *bphys_addr, *alloc_phys; 1302 nce_t *mnce = NULL; 1303 int err = 0; 1304 phyint_t *phyi = ill->ill_phyint; 1305 uint32_t hw_extract_start; 1306 dl_unitdata_req_t *dlur; 1307 ip_stack_t *ipst = ill->ill_ipst; 1308 1309 if (ret_nce != NULL) 1310 *ret_nce = NULL; 1311 /* 1312 * Delete the mapping nce. Normally these should not exist 1313 * as a previous ipif_down -> ipif_ndp_down should have deleted 1314 * all the nces. But they can exist if ip_rput_dlpi_writer 1315 * calls this when PHYI_MULTI_BCAST is set. 1316 */ 1317 mnce = ndp_lookup_v6(ill, &v6_mcast_addr, B_FALSE); 1318 if (mnce != NULL) { 1319 ndp_delete(mnce); 1320 NCE_REFRELE(mnce); 1321 mnce = NULL; 1322 } 1323 1324 /* 1325 * Get media specific v6 mapping information. Note that 1326 * nd_lla_len can be 0 for tunnels. 1327 */ 1328 alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP); 1329 if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0)) 1330 return (ENOMEM); 1331 /* 1332 * Determine the broadcast address. 1333 */ 1334 dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr; 1335 if (ill->ill_sap_length < 0) 1336 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset; 1337 else 1338 bphys_addr = (uchar_t *)dlur + 1339 dlur->dl_dest_addr_offset + ill->ill_sap_length; 1340 1341 /* 1342 * Check PHYI_MULTI_BCAST and possible length of physical 1343 * address to determine if we use the mapping or the 1344 * broadcast address. 1345 */ 1346 if ((phyi->phyint_flags & PHYI_MULTI_BCAST) || 1347 (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len, 1348 bphys_addr, alloc_phys, &hw_extract_start, 1349 &v6_extract_mask))) { 1350 if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) { 1351 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1352 return (E2BIG); 1353 } 1354 /* Use the link-layer broadcast address for MULTI_BCAST */ 1355 phys_addr = bphys_addr; 1356 bzero(&v6_extract_mask, sizeof (v6_extract_mask)); 1357 hw_extract_start = ill->ill_nd_lla_len; 1358 } else { 1359 phys_addr = alloc_phys; 1360 } 1361 if ((ipif->ipif_flags & IPIF_BROADCAST) || 1362 (ill->ill_flags & ILLF_MULTICAST) || 1363 (phyi->phyint_flags & PHYI_MULTI_BCAST)) { 1364 mutex_enter(&ipst->ips_ndp6->ndp_g_lock); 1365 err = ndp_add_v6(ill, 1366 phys_addr, 1367 &v6_mcast_addr, /* v6 address */ 1368 &v6_mcast_mask, /* v6 mask */ 1369 &v6_extract_mask, 1370 hw_extract_start, 1371 NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD, 1372 ND_REACHABLE, 1373 &mnce); 1374 mutex_exit(&ipst->ips_ndp6->ndp_g_lock); 1375 if (err == 0) { 1376 if (ret_nce != NULL) { 1377 *ret_nce = mnce; 1378 } else { 1379 NCE_REFRELE(mnce); 1380 } 1381 } 1382 } 1383 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1384 return (err); 1385 } 1386 1387 /* 1388 * Get the resolver set up for a new ipif. (Always called as writer.) 1389 */ 1390 int 1391 ipif_ndp_up(ipif_t *ipif) 1392 { 1393 ill_t *ill = ipif->ipif_ill; 1394 int err = 0; 1395 nce_t *nce = NULL; 1396 nce_t *mnce = NULL; 1397 1398 ip1dbg(("ipif_ndp_up(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 1399 1400 /* 1401 * ND not supported on XRESOLV interfaces. If ND support (multicast) 1402 * added later, take out this check. 1403 */ 1404 if ((ill->ill_flags & ILLF_XRESOLV) || 1405 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) || 1406 (!(ill->ill_net_type & IRE_INTERFACE))) { 1407 ipif->ipif_addr_ready = 1; 1408 return (0); 1409 } 1410 1411 /* 1412 * Need to setup multicast mapping only when the first 1413 * interface is coming UP. 1414 */ 1415 if (ill->ill_ipif_up_count == 0 && 1416 (ill->ill_flags & ILLF_MULTICAST)) { 1417 /* 1418 * We set the multicast before setting up the mapping for 1419 * local address because ipif_ndp_setup_multicast does 1420 * ndp_walk to delete nces which will delete the mapping 1421 * for local address also if we added the mapping for 1422 * local address first. 1423 */ 1424 err = ipif_ndp_setup_multicast(ipif, &mnce); 1425 if (err != 0) 1426 return (err); 1427 } 1428 1429 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1430 uint16_t flags; 1431 uchar_t *hw_addr = NULL; 1432 1433 /* Permanent entries don't need NUD */ 1434 flags = NCE_F_PERMANENT | NCE_F_NONUD; 1435 if (ill->ill_flags & ILLF_ROUTER) 1436 flags |= NCE_F_ISROUTER; 1437 1438 if (ipif->ipif_flags & IPIF_ANYCAST) 1439 flags |= NCE_F_ANYCAST; 1440 1441 if (ill->ill_net_type == IRE_IF_RESOLVER) { 1442 hw_addr = ill->ill_nd_lla; 1443 1444 if (ill->ill_move_in_progress) { 1445 /* 1446 * Addresses are failing over to this ill. 1447 * Don't wait for NUD to see this change. 1448 * Publish our new link-layer address. 1449 */ 1450 flags |= NCE_F_UNSOL_ADV; 1451 } 1452 } 1453 err = ndp_lookup_then_add_v6(ill, 1454 hw_addr, 1455 &ipif->ipif_v6lcl_addr, 1456 &ipv6_all_ones, 1457 &ipv6_all_zeros, 1458 0, 1459 flags, 1460 ND_PROBE, /* Causes Duplicate Address Detection to run */ 1461 &nce); 1462 switch (err) { 1463 case 0: 1464 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1465 ill->ill_name)); 1466 ipif->ipif_addr_ready = 1; 1467 break; 1468 case EINPROGRESS: 1469 ip1dbg(("ipif_ndp_up: running DAD now for %s\n", 1470 ill->ill_name)); 1471 break; 1472 case EEXIST: 1473 NCE_REFRELE(nce); 1474 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1475 ill->ill_name)); 1476 if (mnce != NULL) { 1477 ndp_delete(mnce); 1478 NCE_REFRELE(mnce); 1479 } 1480 return (err); 1481 default: 1482 ip1dbg(("ipif_ndp_up: NCE creation failed %s\n", 1483 ill->ill_name)); 1484 if (mnce != NULL) { 1485 ndp_delete(mnce); 1486 NCE_REFRELE(mnce); 1487 } 1488 return (err); 1489 } 1490 } else { 1491 /* No local NCE for this entry */ 1492 ipif->ipif_addr_ready = 1; 1493 } 1494 if (nce != NULL) 1495 NCE_REFRELE(nce); 1496 if (mnce != NULL) 1497 NCE_REFRELE(mnce); 1498 return (0); 1499 } 1500 1501 /* Remove all cache entries for this logical interface */ 1502 void 1503 ipif_ndp_down(ipif_t *ipif) 1504 { 1505 nce_t *nce; 1506 1507 if (ipif->ipif_isv6) { 1508 nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, 1509 B_FALSE); 1510 if (nce != NULL) { 1511 ndp_delete(nce); 1512 NCE_REFRELE(nce); 1513 } 1514 } 1515 /* 1516 * Remove mapping and all other nces dependent on this ill 1517 * when the last ipif is going away. 1518 */ 1519 if (ipif->ipif_ill->ill_ipif_up_count == 0) { 1520 ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill, 1521 (uchar_t *)ipif->ipif_ill, ipif->ipif_ill->ill_ipst); 1522 } 1523 } 1524 1525 /* 1526 * Used when an interface comes up to recreate any extra routes on this 1527 * interface. 1528 */ 1529 static ire_t ** 1530 ipif_recover_ire_v6(ipif_t *ipif) 1531 { 1532 mblk_t *mp; 1533 ire_t **ipif_saved_irep; 1534 ire_t **irep; 1535 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 1536 1537 ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name, 1538 ipif->ipif_id)); 1539 1540 ASSERT(ipif->ipif_isv6); 1541 1542 mutex_enter(&ipif->ipif_saved_ire_lock); 1543 ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) * 1544 ipif->ipif_saved_ire_cnt, KM_NOSLEEP); 1545 if (ipif_saved_irep == NULL) { 1546 mutex_exit(&ipif->ipif_saved_ire_lock); 1547 return (NULL); 1548 } 1549 1550 irep = ipif_saved_irep; 1551 1552 for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) { 1553 ire_t *ire; 1554 queue_t *rfq; 1555 queue_t *stq; 1556 ifrt_t *ifrt; 1557 in6_addr_t *src_addr; 1558 in6_addr_t *gateway_addr; 1559 char buf[INET6_ADDRSTRLEN]; 1560 ushort_t type; 1561 1562 /* 1563 * When the ire was initially created and then added in 1564 * ip_rt_add_v6(), it was created either using 1565 * ipif->ipif_net_type in the case of a traditional interface 1566 * route, or as one of the IRE_OFFSUBNET types (with the 1567 * exception of IRE_HOST type redirect ire which is created by 1568 * icmp_redirect_v6() and which we don't need to save or 1569 * recover). In the case where ipif->ipif_net_type was 1570 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to 1571 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy 1572 * software like GateD and Sun Cluster which creates routes 1573 * using the the loopback interface's address as a gateway. 1574 * 1575 * As ifrt->ifrt_type reflects the already updated ire_type, 1576 * ire_create_v6() will be called in the same way here as in 1577 * ip_rt_add_v6(), namely using ipif->ipif_net_type when the 1578 * route looks like a traditional interface route (where 1579 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise 1580 * using the saved ifrt->ifrt_type. This means that in 1581 * the case where ipif->ipif_net_type is IRE_LOOPBACK, 1582 * the ire created by ire_create_v6() will be an IRE_LOOPBACK, 1583 * it will then be turned into an IRE_IF_NORESOLVER and then 1584 * added by ire_add_v6(). 1585 */ 1586 ifrt = (ifrt_t *)mp->b_rptr; 1587 if (ifrt->ifrt_type & IRE_INTERFACE) { 1588 rfq = NULL; 1589 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 1590 ? ipif->ipif_rq : ipif->ipif_wq; 1591 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1592 ? &ifrt->ifrt_v6src_addr 1593 : &ipif->ipif_v6src_addr; 1594 gateway_addr = NULL; 1595 type = ipif->ipif_net_type; 1596 } else { 1597 rfq = NULL; 1598 stq = NULL; 1599 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1600 ? &ifrt->ifrt_v6src_addr : NULL; 1601 gateway_addr = &ifrt->ifrt_v6gateway_addr; 1602 type = ifrt->ifrt_type; 1603 } 1604 1605 /* 1606 * Create a copy of the IRE with the saved address and netmask. 1607 */ 1608 ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n", 1609 ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type, 1610 inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)), 1611 ip_mask_to_plen_v6(&ifrt->ifrt_v6mask))); 1612 ire = ire_create_v6( 1613 &ifrt->ifrt_v6addr, 1614 &ifrt->ifrt_v6mask, 1615 src_addr, 1616 gateway_addr, 1617 &ifrt->ifrt_max_frag, 1618 NULL, 1619 rfq, 1620 stq, 1621 type, 1622 ipif, 1623 NULL, 1624 0, 1625 0, 1626 ifrt->ifrt_flags, 1627 &ifrt->ifrt_iulp_info, 1628 NULL, 1629 NULL, 1630 ipst); 1631 if (ire == NULL) { 1632 mutex_exit(&ipif->ipif_saved_ire_lock); 1633 kmem_free(ipif_saved_irep, 1634 ipif->ipif_saved_ire_cnt * sizeof (ire_t *)); 1635 return (NULL); 1636 } 1637 1638 /* 1639 * Some software (for example, GateD and Sun Cluster) attempts 1640 * to create (what amount to) IRE_PREFIX routes with the 1641 * loopback address as the gateway. This is primarily done to 1642 * set up prefixes with the RTF_REJECT flag set (for example, 1643 * when generating aggregate routes.) 1644 * 1645 * If the IRE type (as defined by ipif->ipif_net_type) is 1646 * IRE_LOOPBACK, then we map the request into a 1647 * IRE_IF_NORESOLVER. 1648 */ 1649 if (ipif->ipif_net_type == IRE_LOOPBACK) 1650 ire->ire_type = IRE_IF_NORESOLVER; 1651 /* 1652 * ire held by ire_add, will be refreled' in ipif_up_done 1653 * towards the end 1654 */ 1655 (void) ire_add(&ire, NULL, NULL, NULL, B_FALSE); 1656 *irep = ire; 1657 irep++; 1658 ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire)); 1659 } 1660 mutex_exit(&ipif->ipif_saved_ire_lock); 1661 return (ipif_saved_irep); 1662 } 1663 1664 /* 1665 * Return the scope of the given IPv6 address. If the address is an 1666 * IPv4 mapped IPv6 address, return the scope of the corresponding 1667 * IPv4 address. 1668 */ 1669 in6addr_scope_t 1670 ip_addr_scope_v6(const in6_addr_t *addr) 1671 { 1672 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1673 1674 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1675 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1676 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1677 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1678 return (IP6_SCOPE_LINKLOCAL); 1679 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1680 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1681 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1682 return (IP6_SCOPE_SITELOCAL); 1683 return (IP6_SCOPE_GLOBAL); 1684 } 1685 1686 if (IN6_IS_ADDR_MULTICAST(addr)) 1687 return (IN6_ADDR_MC_SCOPE(addr)); 1688 1689 /* link-local and loopback addresses are of link-local scope */ 1690 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1691 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1692 return (IP6_SCOPE_LINKLOCAL); 1693 if (IN6_IS_ADDR_SITELOCAL(addr)) 1694 return (IP6_SCOPE_SITELOCAL); 1695 return (IP6_SCOPE_GLOBAL); 1696 } 1697 1698 1699 /* 1700 * Returns the length of the common prefix of a1 and a2, as per 1701 * CommonPrefixLen() defined in RFC 3484. 1702 */ 1703 static int 1704 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2) 1705 { 1706 int i; 1707 uint32_t a1val, a2val, mask; 1708 1709 for (i = 0; i < 4; i++) { 1710 if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) { 1711 a1val ^= a2val; 1712 i *= 32; 1713 mask = 0x80000000u; 1714 while (!(a1val & mask)) { 1715 mask >>= 1; 1716 i++; 1717 } 1718 return (i); 1719 } 1720 } 1721 return (IPV6_ABITS); 1722 } 1723 1724 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1725 (((ipif)->ipif_flags & IPIF_UP) && \ 1726 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \ 1727 (ipif)->ipif_addr_ready) 1728 1729 /* source address candidate */ 1730 typedef struct candidate { 1731 ipif_t *cand_ipif; 1732 /* The properties of this candidate */ 1733 boolean_t cand_isdst; 1734 boolean_t cand_isdst_set; 1735 in6addr_scope_t cand_scope; 1736 boolean_t cand_scope_set; 1737 boolean_t cand_isdeprecated; 1738 boolean_t cand_isdeprecated_set; 1739 boolean_t cand_ispreferred; 1740 boolean_t cand_ispreferred_set; 1741 boolean_t cand_matchedinterface; 1742 boolean_t cand_matchedinterface_set; 1743 boolean_t cand_matchedlabel; 1744 boolean_t cand_matchedlabel_set; 1745 boolean_t cand_istmp; 1746 boolean_t cand_istmp_set; 1747 int cand_common_pref; 1748 boolean_t cand_common_pref_set; 1749 boolean_t cand_pref_eq; 1750 boolean_t cand_pref_eq_set; 1751 int cand_pref_len; 1752 boolean_t cand_pref_len_set; 1753 } cand_t; 1754 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1755 #define cand_mask cand_ipif->ipif_v6net_mask 1756 #define cand_flags cand_ipif->ipif_flags 1757 #define cand_ill cand_ipif->ipif_ill 1758 #define cand_zoneid cand_ipif->ipif_zoneid 1759 1760 /* information about the destination for source address selection */ 1761 typedef struct dstinfo { 1762 const in6_addr_t *dst_addr; 1763 ill_t *dst_ill; 1764 uint_t dst_restrict_ill; 1765 boolean_t dst_prefer_src_tmp; 1766 in6addr_scope_t dst_scope; 1767 char *dst_label; 1768 } dstinfo_t; 1769 1770 /* 1771 * The following functions are rules used to select a source address in 1772 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1773 * against the best candidate (bc). Each rule has three possible outcomes; 1774 * the candidate is preferred over the best candidate (CAND_PREFER), the 1775 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1776 * candidate is of equal value as the best candidate (CAND_TIE). 1777 * 1778 * These rules are part of a greater "Default Address Selection for IPv6" 1779 * sheme, which is standards based work coming out of the IETF ipv6 working 1780 * group. The IETF document defines both IPv6 source address selection and 1781 * destination address ordering. The rules defined here implement the IPv6 1782 * source address selection. Destination address ordering is done by 1783 * libnsl, and uses a similar set of rules to implement the sorting. 1784 * 1785 * Most of the rules are defined by the RFC and are not typically altered. The 1786 * last rule, number 8, has language that allows for local preferences. In the 1787 * scheme below, this means that new Solaris rules should normally go between 1788 * rule_ifprefix and rule_prefix. 1789 */ 1790 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1791 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *, 1792 ip_stack_t *); 1793 1794 /* Prefer an address if it is equal to the destination address. */ 1795 /* ARGSUSED3 */ 1796 static rule_res_t 1797 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1798 { 1799 if (!bc->cand_isdst_set) { 1800 bc->cand_isdst = 1801 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1802 bc->cand_isdst_set = B_TRUE; 1803 } 1804 1805 cc->cand_isdst = 1806 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1807 cc->cand_isdst_set = B_TRUE; 1808 1809 if (cc->cand_isdst == bc->cand_isdst) 1810 return (CAND_TIE); 1811 else if (cc->cand_isdst) 1812 return (CAND_PREFER); 1813 else 1814 return (CAND_AVOID); 1815 } 1816 1817 /* 1818 * Prefer addresses that are of closest scope to the destination. Always 1819 * prefer addresses that are of greater scope than the destination over 1820 * those that are of lesser scope than the destination. 1821 */ 1822 /* ARGSUSED3 */ 1823 static rule_res_t 1824 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1825 { 1826 if (!bc->cand_scope_set) { 1827 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1828 bc->cand_scope_set = B_TRUE; 1829 } 1830 1831 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1832 cc->cand_scope_set = B_TRUE; 1833 1834 if (cc->cand_scope < bc->cand_scope) { 1835 if (cc->cand_scope < dstinfo->dst_scope) 1836 return (CAND_AVOID); 1837 else 1838 return (CAND_PREFER); 1839 } else if (bc->cand_scope < cc->cand_scope) { 1840 if (bc->cand_scope < dstinfo->dst_scope) 1841 return (CAND_PREFER); 1842 else 1843 return (CAND_AVOID); 1844 } else { 1845 return (CAND_TIE); 1846 } 1847 } 1848 1849 /* 1850 * Prefer non-deprecated source addresses. 1851 */ 1852 /* ARGSUSED2 */ 1853 static rule_res_t 1854 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1855 ip_stack_t *ipst) 1856 { 1857 if (!bc->cand_isdeprecated_set) { 1858 bc->cand_isdeprecated = 1859 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 1860 bc->cand_isdeprecated_set = B_TRUE; 1861 } 1862 1863 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 1864 cc->cand_isdeprecated_set = B_TRUE; 1865 1866 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 1867 return (CAND_TIE); 1868 else if (cc->cand_isdeprecated) 1869 return (CAND_AVOID); 1870 else 1871 return (CAND_PREFER); 1872 } 1873 1874 /* 1875 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 1876 * rule must be before rule_interface because the flag could be set on any 1877 * interface, not just the interface being used for outgoing packets (for 1878 * example, the IFF_PREFERRED could be set on an address assigned to the 1879 * loopback interface). 1880 */ 1881 /* ARGSUSED2 */ 1882 static rule_res_t 1883 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1884 ip_stack_t *ipst) 1885 { 1886 if (!bc->cand_ispreferred_set) { 1887 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 1888 bc->cand_ispreferred_set = B_TRUE; 1889 } 1890 1891 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 1892 cc->cand_ispreferred_set = B_TRUE; 1893 1894 if (bc->cand_ispreferred == cc->cand_ispreferred) 1895 return (CAND_TIE); 1896 else if (cc->cand_ispreferred) 1897 return (CAND_PREFER); 1898 else 1899 return (CAND_AVOID); 1900 } 1901 1902 /* 1903 * Prefer source addresses that are assigned to the outgoing interface, or 1904 * to an interface that is in the same IPMP group as the outgoing 1905 * interface. 1906 */ 1907 /* ARGSUSED3 */ 1908 static rule_res_t 1909 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1910 ip_stack_t *ipst) 1911 { 1912 ill_t *dstill = dstinfo->dst_ill; 1913 1914 /* 1915 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 1916 * since we know all candidates will be on the same link. 1917 */ 1918 if (dstinfo->dst_restrict_ill) 1919 return (CAND_TIE); 1920 1921 if (!bc->cand_matchedinterface_set) { 1922 bc->cand_matchedinterface = (bc->cand_ill == dstill || 1923 (dstill->ill_group != NULL && 1924 dstill->ill_group == bc->cand_ill->ill_group)); 1925 bc->cand_matchedinterface_set = B_TRUE; 1926 } 1927 1928 cc->cand_matchedinterface = (cc->cand_ill == dstill || 1929 (dstill->ill_group != NULL && 1930 dstill->ill_group == cc->cand_ill->ill_group)); 1931 cc->cand_matchedinterface_set = B_TRUE; 1932 1933 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 1934 return (CAND_TIE); 1935 else if (cc->cand_matchedinterface) 1936 return (CAND_PREFER); 1937 else 1938 return (CAND_AVOID); 1939 } 1940 1941 /* 1942 * Prefer source addresses whose label matches the destination's label. 1943 */ 1944 static rule_res_t 1945 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 1946 { 1947 char *label; 1948 1949 if (!bc->cand_matchedlabel_set) { 1950 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst); 1951 bc->cand_matchedlabel = 1952 ip6_asp_labelcmp(label, dstinfo->dst_label); 1953 bc->cand_matchedlabel_set = B_TRUE; 1954 } 1955 1956 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst); 1957 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 1958 cc->cand_matchedlabel_set = B_TRUE; 1959 1960 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 1961 return (CAND_TIE); 1962 else if (cc->cand_matchedlabel) 1963 return (CAND_PREFER); 1964 else 1965 return (CAND_AVOID); 1966 } 1967 1968 /* 1969 * Prefer public addresses over temporary ones. An application can reverse 1970 * the logic of this rule and prefer temporary addresses by using the 1971 * IPV6_SRC_PREFERENCES socket option. 1972 */ 1973 /* ARGSUSED3 */ 1974 static rule_res_t 1975 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 1976 ip_stack_t *ipst) 1977 { 1978 if (!bc->cand_istmp_set) { 1979 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 1980 bc->cand_istmp_set = B_TRUE; 1981 } 1982 1983 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 1984 cc->cand_istmp_set = B_TRUE; 1985 1986 if (bc->cand_istmp == cc->cand_istmp) 1987 return (CAND_TIE); 1988 1989 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 1990 return (CAND_PREFER); 1991 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 1992 return (CAND_PREFER); 1993 else 1994 return (CAND_AVOID); 1995 } 1996 1997 /* 1998 * Prefer source addresses with longer matching prefix with the destination 1999 * under the interface mask. This gets us on the same subnet before applying 2000 * any Solaris-specific rules. 2001 */ 2002 /* ARGSUSED3 */ 2003 static rule_res_t 2004 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2005 ip_stack_t *ipst) 2006 { 2007 if (!bc->cand_pref_eq_set) { 2008 bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr, 2009 bc->cand_mask, *dstinfo->dst_addr); 2010 bc->cand_pref_eq_set = B_TRUE; 2011 } 2012 2013 cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask, 2014 *dstinfo->dst_addr); 2015 cc->cand_pref_eq_set = B_TRUE; 2016 2017 if (bc->cand_pref_eq) { 2018 if (cc->cand_pref_eq) { 2019 if (!bc->cand_pref_len_set) { 2020 bc->cand_pref_len = 2021 ip_mask_to_plen_v6(&bc->cand_mask); 2022 bc->cand_pref_len_set = B_TRUE; 2023 } 2024 cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask); 2025 cc->cand_pref_len_set = B_TRUE; 2026 if (bc->cand_pref_len == cc->cand_pref_len) 2027 return (CAND_TIE); 2028 else if (bc->cand_pref_len > cc->cand_pref_len) 2029 return (CAND_AVOID); 2030 else 2031 return (CAND_PREFER); 2032 } else { 2033 return (CAND_AVOID); 2034 } 2035 } else { 2036 if (cc->cand_pref_eq) 2037 return (CAND_PREFER); 2038 else 2039 return (CAND_TIE); 2040 } 2041 } 2042 2043 /* 2044 * Prefer to use zone-specific addresses when possible instead of all-zones 2045 * addresses. 2046 */ 2047 /* ARGSUSED2 */ 2048 static rule_res_t 2049 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2050 ip_stack_t *ipst) 2051 { 2052 if ((bc->cand_zoneid == ALL_ZONES) == 2053 (cc->cand_zoneid == ALL_ZONES)) 2054 return (CAND_TIE); 2055 else if (cc->cand_zoneid == ALL_ZONES) 2056 return (CAND_AVOID); 2057 else 2058 return (CAND_PREFER); 2059 } 2060 2061 /* 2062 * Prefer to use DHCPv6 (first) and static addresses (second) when possible 2063 * instead of statelessly autoconfigured addresses. 2064 * 2065 * This is done after trying all other preferences (and before the final tie 2066 * breaker) so that, if all else is equal, we select addresses configured by 2067 * DHCPv6 over other addresses. We presume that DHCPv6 addresses, unlike 2068 * stateless autoconfigured addresses, are deliberately configured by an 2069 * administrator, and thus are correctly set up in DNS and network packet 2070 * filters. 2071 */ 2072 /* ARGSUSED2 */ 2073 static rule_res_t 2074 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2075 ip_stack_t *ipst) 2076 { 2077 #define ATYPE(x) \ 2078 ((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2 2079 int bcval = ATYPE(bc->cand_flags); 2080 int ccval = ATYPE(cc->cand_flags); 2081 #undef ATYPE 2082 2083 if (bcval == ccval) 2084 return (CAND_TIE); 2085 else if (ccval < bcval) 2086 return (CAND_PREFER); 2087 else 2088 return (CAND_AVOID); 2089 } 2090 2091 /* 2092 * Prefer source addresses with longer matching prefix with the destination. 2093 * We do the longest matching prefix calculation by doing an xor of both 2094 * addresses with the destination, and pick the address with the longest string 2095 * of leading zeros, as per CommonPrefixLen() defined in RFC 3484. 2096 */ 2097 /* ARGSUSED3 */ 2098 static rule_res_t 2099 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst) 2100 { 2101 if (!bc->cand_common_pref_set) { 2102 bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr, 2103 dstinfo->dst_addr); 2104 bc->cand_common_pref_set = B_TRUE; 2105 } 2106 2107 cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr, 2108 dstinfo->dst_addr); 2109 cc->cand_common_pref_set = B_TRUE; 2110 2111 if (bc->cand_common_pref == cc->cand_common_pref) 2112 return (CAND_TIE); 2113 else if (bc->cand_common_pref > cc->cand_common_pref) 2114 return (CAND_AVOID); 2115 else 2116 return (CAND_PREFER); 2117 } 2118 2119 /* 2120 * Last rule: we must pick something, so just prefer the current best 2121 * candidate. 2122 */ 2123 /* ARGSUSED */ 2124 static rule_res_t 2125 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, 2126 ip_stack_t *ipst) 2127 { 2128 return (CAND_AVOID); 2129 } 2130 2131 /* 2132 * Determine the best source address given a destination address and a 2133 * destination ill. If no suitable source address is found, it returns 2134 * NULL. If there is a usable address pointed to by the usesrc 2135 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 2136 * fine grained (i.e per interface) 2137 * 2138 * This implementation is based on the "Default Address Selection for IPv6" 2139 * specification produced by the IETF IPv6 working group. It has been 2140 * implemented so that the list of addresses is only traversed once (the 2141 * specification's algorithm could traverse the list of addresses once for 2142 * every rule). 2143 * 2144 * The restrict_ill argument restricts the algorithm to chose a source 2145 * address that is assigned to the destination ill or an ill in the same 2146 * IPMP group as the destination ill. This is used when the destination 2147 * address is a link-local or multicast address, and when 2148 * ipv6_strict_dst_multihoming is turned on. 2149 * 2150 * src_prefs is the caller's set of source address preferences. If source 2151 * address selection is being called to determine the source address of a 2152 * connected socket (from ip_bind_connected_v6()), then the preferences are 2153 * taken from conn_src_preferences. These preferences can be set on a 2154 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 2155 * preference currently implemented is for rfc3041 temporary addresses. 2156 */ 2157 ipif_t * 2158 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 2159 uint_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid) 2160 { 2161 dstinfo_t dstinfo; 2162 char dstr[INET6_ADDRSTRLEN]; 2163 char sstr[INET6_ADDRSTRLEN]; 2164 ipif_t *ipif; 2165 ill_t *ill, *usesrc_ill = NULL; 2166 ill_walk_context_t ctx; 2167 cand_t best_c; /* The best candidate */ 2168 cand_t curr_c; /* The current candidate */ 2169 uint_t index; 2170 boolean_t first_candidate = B_TRUE; 2171 rule_res_t rule_result; 2172 tsol_tpc_t *src_rhtp, *dst_rhtp; 2173 ip_stack_t *ipst = dstill->ill_ipst; 2174 2175 /* 2176 * The list of ordering rules. They are applied in the order they 2177 * appear in the list. 2178 * 2179 * Solaris doesn't currently support Mobile IPv6, so there's no 2180 * rule_mipv6 corresponding to rule 4 in the specification. 2181 */ 2182 rulef_t rules[] = { 2183 rule_isdst, 2184 rule_scope, 2185 rule_deprecated, 2186 rule_preferred, 2187 rule_interface, 2188 rule_label, 2189 rule_temporary, 2190 rule_ifprefix, /* local rules after this */ 2191 rule_zone_specific, 2192 rule_addr_type, 2193 rule_prefix, /* local rules before this */ 2194 rule_must_be_last, /* must always be last */ 2195 NULL 2196 }; 2197 2198 ASSERT(dstill->ill_isv6); 2199 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 2200 2201 /* 2202 * Check if there is a usable src address pointed to by the 2203 * usesrc ifindex. This has higher precedence since it is 2204 * finer grained (i.e per interface) v/s being system wide. 2205 */ 2206 if (dstill->ill_usesrc_ifindex != 0) { 2207 if ((usesrc_ill = 2208 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 2209 NULL, NULL, NULL, NULL, ipst)) != NULL) { 2210 dstinfo.dst_ill = usesrc_ill; 2211 } else { 2212 return (NULL); 2213 } 2214 } else { 2215 dstinfo.dst_ill = dstill; 2216 } 2217 2218 /* 2219 * If we're dealing with an unlabeled destination on a labeled system, 2220 * make sure that we ignore source addresses that are incompatible with 2221 * the destination's default label. That destination's default label 2222 * must dominate the minimum label on the source address. 2223 * 2224 * (Note that this has to do with Trusted Solaris. It's not related to 2225 * the labels described by ip6_asp_lookup.) 2226 */ 2227 dst_rhtp = NULL; 2228 if (is_system_labeled()) { 2229 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE); 2230 if (dst_rhtp == NULL) 2231 return (NULL); 2232 if (dst_rhtp->tpc_tp.host_type != UNLABELED) { 2233 TPC_RELE(dst_rhtp); 2234 dst_rhtp = NULL; 2235 } 2236 } 2237 2238 dstinfo.dst_addr = dst; 2239 dstinfo.dst_scope = ip_addr_scope_v6(dst); 2240 dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst); 2241 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 2242 2243 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 2244 /* 2245 * Section three of the I-D states that for multicast and 2246 * link-local destinations, the candidate set must be restricted to 2247 * an interface that is on the same link as the outgoing interface. 2248 * Also, when ipv6_strict_dst_multihoming is turned on, always 2249 * restrict the source address to the destination link as doing 2250 * otherwise will almost certainly cause problems. 2251 */ 2252 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 2253 ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) { 2254 if (restrict_ill == RESTRICT_TO_NONE) 2255 dstinfo.dst_restrict_ill = RESTRICT_TO_GROUP; 2256 else 2257 dstinfo.dst_restrict_ill = restrict_ill; 2258 } else { 2259 dstinfo.dst_restrict_ill = restrict_ill; 2260 } 2261 2262 bzero(&best_c, sizeof (cand_t)); 2263 2264 /* 2265 * Take a pass through the list of IPv6 interfaces to chose the 2266 * best possible source address. If restrict_ill is true, we only 2267 * iterate through the ill's that are in the same IPMP group as the 2268 * destination's outgoing ill. If restrict_ill is false, we walk 2269 * the entire list of IPv6 ill's. 2270 */ 2271 if (dstinfo.dst_restrict_ill != RESTRICT_TO_NONE) { 2272 if (dstinfo.dst_ill->ill_group != NULL && 2273 dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) { 2274 ill = dstinfo.dst_ill->ill_group->illgrp_ill; 2275 } else { 2276 ill = dstinfo.dst_ill; 2277 } 2278 } else { 2279 ill = ILL_START_WALK_V6(&ctx, ipst); 2280 } 2281 2282 while (ill != NULL) { 2283 ASSERT(ill->ill_isv6); 2284 2285 /* 2286 * Avoid FAILED/OFFLINE ills. 2287 * Global and site local addresses will failover and 2288 * will be available on the new ill. 2289 * But link local addresses don't move. 2290 */ 2291 if (dstinfo.dst_restrict_ill != RESTRICT_TO_ILL && 2292 ill->ill_phyint->phyint_flags & 2293 (PHYI_OFFLINE | PHYI_FAILED)) 2294 goto next_ill; 2295 2296 for (ipif = ill->ill_ipif; ipif != NULL; 2297 ipif = ipif->ipif_next) { 2298 2299 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 2300 continue; 2301 2302 if (zoneid != ALL_ZONES && 2303 ipif->ipif_zoneid != zoneid && 2304 ipif->ipif_zoneid != ALL_ZONES) 2305 continue; 2306 2307 /* 2308 * Check compatibility of local address for 2309 * destination's default label if we're on a labeled 2310 * system. Incompatible addresses can't be used at 2311 * all and must be skipped over. 2312 */ 2313 if (dst_rhtp != NULL) { 2314 boolean_t incompat; 2315 2316 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr, 2317 IPV6_VERSION, B_FALSE); 2318 if (src_rhtp == NULL) 2319 continue; 2320 incompat = 2321 src_rhtp->tpc_tp.host_type != SUN_CIPSO || 2322 src_rhtp->tpc_tp.tp_doi != 2323 dst_rhtp->tpc_tp.tp_doi || 2324 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label, 2325 &src_rhtp->tpc_tp.tp_sl_range_cipso) && 2326 !blinlset(&dst_rhtp->tpc_tp.tp_def_label, 2327 src_rhtp->tpc_tp.tp_sl_set_cipso)); 2328 TPC_RELE(src_rhtp); 2329 if (incompat) 2330 continue; 2331 } 2332 2333 if (first_candidate) { 2334 /* 2335 * This is first valid address in the list. 2336 * It is automatically the best candidate 2337 * so far. 2338 */ 2339 best_c.cand_ipif = ipif; 2340 first_candidate = B_FALSE; 2341 continue; 2342 } 2343 2344 bzero(&curr_c, sizeof (cand_t)); 2345 curr_c.cand_ipif = ipif; 2346 2347 /* 2348 * Compare this current candidate (curr_c) with the 2349 * best candidate (best_c) by applying the 2350 * comparison rules in order until one breaks the 2351 * tie. 2352 */ 2353 for (index = 0; rules[index] != NULL; index++) { 2354 /* Apply a comparison rule. */ 2355 rule_result = 2356 (rules[index])(&best_c, &curr_c, &dstinfo, 2357 ipst); 2358 if (rule_result == CAND_AVOID) { 2359 /* 2360 * The best candidate is still the 2361 * best candidate. Forget about 2362 * this current candidate and go on 2363 * to the next one. 2364 */ 2365 break; 2366 } else if (rule_result == CAND_PREFER) { 2367 /* 2368 * This candidate is prefered. It 2369 * becomes the best candidate so 2370 * far. Go on to the next address. 2371 */ 2372 best_c = curr_c; 2373 break; 2374 } 2375 /* We have a tie, apply the next rule. */ 2376 } 2377 2378 /* 2379 * The last rule must be a tie breaker rule and 2380 * must never produce a tie. At this point, the 2381 * candidate should have either been rejected, or 2382 * have been prefered as the best candidate so far. 2383 */ 2384 ASSERT(rule_result != CAND_TIE); 2385 } 2386 2387 /* 2388 * We may be walking the linked-list of ill's in an 2389 * IPMP group or traversing the IPv6 ill avl tree. If it is a 2390 * usesrc ILL then it can't be part of IPMP group and we 2391 * will exit the while loop. 2392 */ 2393 next_ill: 2394 if (dstinfo.dst_restrict_ill == RESTRICT_TO_ILL) 2395 ill = NULL; 2396 else if (dstinfo.dst_restrict_ill == RESTRICT_TO_GROUP) 2397 ill = ill->ill_group_next; 2398 else 2399 ill = ill_next(&ctx, ill); 2400 } 2401 2402 ipif = best_c.cand_ipif; 2403 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2404 dstinfo.dst_ill->ill_name, 2405 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2406 (ipif == NULL ? "NULL" : 2407 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2408 2409 if (usesrc_ill != NULL) 2410 ill_refrele(usesrc_ill); 2411 2412 if (dst_rhtp != NULL) 2413 TPC_RELE(dst_rhtp); 2414 2415 if (ipif == NULL) { 2416 rw_exit(&ipst->ips_ill_g_lock); 2417 return (NULL); 2418 } 2419 2420 mutex_enter(&ipif->ipif_ill->ill_lock); 2421 if (IPIF_CAN_LOOKUP(ipif)) { 2422 ipif_refhold_locked(ipif); 2423 mutex_exit(&ipif->ipif_ill->ill_lock); 2424 rw_exit(&ipst->ips_ill_g_lock); 2425 return (ipif); 2426 } 2427 mutex_exit(&ipif->ipif_ill->ill_lock); 2428 rw_exit(&ipst->ips_ill_g_lock); 2429 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2430 " returning null \n", (void *)ipif)); 2431 2432 return (NULL); 2433 } 2434 2435 /* 2436 * If old_ipif is not NULL, see if ipif was derived from old 2437 * ipif and if so, recreate the interface route by re-doing 2438 * source address selection. This happens when ipif_down -> 2439 * ipif_update_other_ipifs calls us. 2440 * 2441 * If old_ipif is NULL, just redo the source address selection 2442 * if needed. This happens when illgrp_insert or ipif_up_done_v6 2443 * calls us. 2444 */ 2445 void 2446 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif) 2447 { 2448 ire_t *ire; 2449 ire_t *ipif_ire; 2450 queue_t *stq; 2451 ill_t *ill; 2452 ipif_t *nipif = NULL; 2453 boolean_t nipif_refheld = B_FALSE; 2454 boolean_t ip6_asp_table_held = B_FALSE; 2455 ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; 2456 2457 ill = ipif->ipif_ill; 2458 2459 if (!(ipif->ipif_flags & 2460 (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) { 2461 /* 2462 * Can't possibly have borrowed the source 2463 * from old_ipif. 2464 */ 2465 return; 2466 } 2467 2468 /* 2469 * Is there any work to be done? No work if the address 2470 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST ( 2471 * ipif_select_source_v6() does not borrow addresses from 2472 * NOLOCAL and ANYCAST interfaces). 2473 */ 2474 if ((old_ipif != NULL) && 2475 ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) || 2476 (old_ipif->ipif_ill->ill_wq == NULL) || 2477 (old_ipif->ipif_flags & 2478 (IPIF_NOLOCAL|IPIF_ANYCAST)))) { 2479 return; 2480 } 2481 2482 /* 2483 * Perform the same checks as when creating the 2484 * IRE_INTERFACE in ipif_up_done_v6. 2485 */ 2486 if (!(ipif->ipif_flags & IPIF_UP)) 2487 return; 2488 2489 if ((ipif->ipif_flags & IPIF_NOXMIT)) 2490 return; 2491 2492 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2493 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask)) 2494 return; 2495 2496 /* 2497 * We know that ipif uses some other source for its 2498 * IRE_INTERFACE. Is it using the source of this 2499 * old_ipif? 2500 */ 2501 ipif_ire = ipif_to_ire_v6(ipif); 2502 if (ipif_ire == NULL) 2503 return; 2504 2505 if (old_ipif != NULL && 2506 !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr, 2507 &ipif_ire->ire_src_addr_v6)) { 2508 ire_refrele(ipif_ire); 2509 return; 2510 } 2511 2512 if (ip_debug > 2) { 2513 /* ip1dbg */ 2514 pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE" 2515 " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6); 2516 } 2517 2518 stq = ipif_ire->ire_stq; 2519 2520 /* 2521 * Can't use our source address. Select a different source address 2522 * for the IRE_INTERFACE. We restrict interface route source 2523 * address selection to ipif's assigned to the same link as the 2524 * interface. 2525 */ 2526 if (ip6_asp_can_lookup(ipst)) { 2527 ip6_asp_table_held = B_TRUE; 2528 nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet, 2529 RESTRICT_TO_GROUP, IPV6_PREFER_SRC_DEFAULT, 2530 ipif->ipif_zoneid); 2531 } 2532 if (nipif == NULL) { 2533 /* Last resort - all ipif's have IPIF_NOLOCAL */ 2534 nipif = ipif; 2535 } else { 2536 nipif_refheld = B_TRUE; 2537 } 2538 2539 ire = ire_create_v6( 2540 &ipif->ipif_v6subnet, /* dest pref */ 2541 &ipif->ipif_v6net_mask, /* mask */ 2542 &nipif->ipif_v6src_addr, /* src addr */ 2543 NULL, /* no gateway */ 2544 &ipif->ipif_mtu, /* max frag */ 2545 NULL, /* no src nce */ 2546 NULL, /* no recv from queue */ 2547 stq, /* send-to queue */ 2548 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2549 ipif, 2550 NULL, 2551 0, 2552 0, 2553 0, 2554 &ire_uinfo_null, 2555 NULL, 2556 NULL, 2557 ipst); 2558 2559 if (ire != NULL) { 2560 ire_t *ret_ire; 2561 int error; 2562 2563 /* 2564 * We don't need ipif_ire anymore. We need to delete 2565 * before we add so that ire_add does not detect 2566 * duplicates. 2567 */ 2568 ire_delete(ipif_ire); 2569 ret_ire = ire; 2570 error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE); 2571 ASSERT(error == 0); 2572 ASSERT(ret_ire == ire); 2573 if (ret_ire != NULL) { 2574 /* Held in ire_add */ 2575 ire_refrele(ret_ire); 2576 } 2577 } 2578 /* 2579 * Either we are falling through from above or could not 2580 * allocate a replacement. 2581 */ 2582 ire_refrele(ipif_ire); 2583 if (ip6_asp_table_held) 2584 ip6_asp_table_refrele(ipst); 2585 if (nipif_refheld) 2586 ipif_refrele(nipif); 2587 } 2588 2589 /* 2590 * This old_ipif is going away. 2591 * 2592 * Determine if any other ipif's are using our address as 2593 * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or 2594 * IPIF_DEPRECATED). 2595 * Find the IRE_INTERFACE for such ipif's and recreate them 2596 * to use an different source address following the rules in 2597 * ipif_up_done_v6. 2598 * 2599 * This function takes an illgrp as an argument so that illgrp_delete 2600 * can call this to update source address even after deleting the 2601 * old_ipif->ipif_ill from the ill group. 2602 */ 2603 void 2604 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp) 2605 { 2606 ipif_t *ipif; 2607 ill_t *ill; 2608 char buf[INET6_ADDRSTRLEN]; 2609 2610 ASSERT(IAM_WRITER_IPIF(old_ipif)); 2611 2612 ill = old_ipif->ipif_ill; 2613 2614 ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n", 2615 ill->ill_name, 2616 inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr, 2617 buf, sizeof (buf)))); 2618 2619 /* 2620 * If this part of a group, look at all ills as ipif_select_source 2621 * borrows a source address across all the ills in the group. 2622 */ 2623 if (illgrp != NULL) 2624 ill = illgrp->illgrp_ill; 2625 2626 /* Don't need a lock since this is a writer */ 2627 for (; ill != NULL; ill = ill->ill_group_next) { 2628 for (ipif = ill->ill_ipif; ipif != NULL; 2629 ipif = ipif->ipif_next) { 2630 2631 if (ipif == old_ipif) 2632 continue; 2633 2634 ipif_recreate_interface_routes_v6(old_ipif, ipif); 2635 } 2636 } 2637 } 2638 2639 /* 2640 * Perform an attach and bind to get phys addr plus info_req for 2641 * the physical device. 2642 * q and mp represents an ioctl which will be queued waiting for 2643 * completion of the DLPI message exchange. 2644 * MUST be called on an ill queue. Can not set conn_pending_ill for that 2645 * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q. 2646 * 2647 * Returns EINPROGRESS when mp has been consumed by queueing it on 2648 * ill_pending_mp and the ioctl will complete in ip_rput. 2649 */ 2650 int 2651 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2652 { 2653 mblk_t *v6token_mp = NULL; 2654 mblk_t *v6lla_mp = NULL; 2655 mblk_t *phys_mp = NULL; 2656 mblk_t *info_mp = NULL; 2657 mblk_t *attach_mp = NULL; 2658 mblk_t *bind_mp = NULL; 2659 mblk_t *unbind_mp = NULL; 2660 mblk_t *notify_mp = NULL; 2661 2662 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2663 ASSERT(ill->ill_dlpi_style_set); 2664 ASSERT(WR(q)->q_next != NULL); 2665 2666 if (ill->ill_isv6) { 2667 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2668 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2669 if (v6token_mp == NULL) 2670 goto bad; 2671 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2672 DL_IPV6_TOKEN; 2673 2674 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2675 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2676 if (v6lla_mp == NULL) 2677 goto bad; 2678 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2679 DL_IPV6_LINK_LAYER_ADDR; 2680 } 2681 2682 /* 2683 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2684 */ 2685 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2686 DL_NOTIFY_REQ); 2687 if (notify_mp == NULL) 2688 goto bad; 2689 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2690 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2691 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG); 2692 2693 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2694 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2695 if (phys_mp == NULL) 2696 goto bad; 2697 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2698 DL_CURR_PHYS_ADDR; 2699 2700 info_mp = ip_dlpi_alloc( 2701 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2702 DL_INFO_REQ); 2703 if (info_mp == NULL) 2704 goto bad; 2705 2706 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2707 DL_BIND_REQ); 2708 if (bind_mp == NULL) 2709 goto bad; 2710 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2711 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2712 2713 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2714 if (unbind_mp == NULL) 2715 goto bad; 2716 2717 /* If we need to attach, pre-alloc and initialize the mblk */ 2718 if (ill->ill_needs_attach) { 2719 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2720 DL_ATTACH_REQ); 2721 if (attach_mp == NULL) 2722 goto bad; 2723 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2724 } 2725 2726 /* 2727 * Here we are going to delay the ioctl ack until after 2728 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2729 * original ioctl message before sending the requests 2730 */ 2731 mutex_enter(&ill->ill_lock); 2732 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2733 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2734 /* 2735 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2736 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2737 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2738 */ 2739 ill->ill_phys_addr_pend = 0; 2740 mutex_exit(&ill->ill_lock); 2741 2742 if (attach_mp != NULL) { 2743 ip1dbg(("ill_dl_phys: attach\n")); 2744 ill_dlpi_send(ill, attach_mp); 2745 } 2746 ill_dlpi_send(ill, bind_mp); 2747 ill_dlpi_send(ill, info_mp); 2748 if (ill->ill_isv6) { 2749 ill_dlpi_send(ill, v6token_mp); 2750 ill_dlpi_send(ill, v6lla_mp); 2751 } 2752 ill_dlpi_send(ill, phys_mp); 2753 ill_dlpi_send(ill, notify_mp); 2754 ill_dlpi_send(ill, unbind_mp); 2755 2756 /* 2757 * This operation will complete in ip_rput_dlpi_writer with either 2758 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2759 */ 2760 return (EINPROGRESS); 2761 bad: 2762 freemsg(v6token_mp); 2763 freemsg(v6lla_mp); 2764 freemsg(phys_mp); 2765 freemsg(info_mp); 2766 freemsg(attach_mp); 2767 freemsg(bind_mp); 2768 freemsg(unbind_mp); 2769 freemsg(notify_mp); 2770 return (ENOMEM); 2771 } 2772 2773 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2774 2775 /* 2776 * DLPI is up. 2777 * Create all the IREs associated with an interface bring up multicast. 2778 * Set the interface flag and finish other initialization 2779 * that potentially had to be differed to after DL_BIND_ACK. 2780 */ 2781 int 2782 ipif_up_done_v6(ipif_t *ipif) 2783 { 2784 ire_t *ire_array[20]; 2785 ire_t **irep = ire_array; 2786 ire_t **irep1; 2787 ill_t *ill = ipif->ipif_ill; 2788 queue_t *stq; 2789 in6_addr_t v6addr; 2790 in6_addr_t route_mask; 2791 ipif_t *src_ipif = NULL; 2792 ipif_t *tmp_ipif; 2793 boolean_t flush_ire_cache = B_TRUE; 2794 int err; 2795 char buf[INET6_ADDRSTRLEN]; 2796 phyint_t *phyi; 2797 ire_t **ipif_saved_irep = NULL; 2798 int ipif_saved_ire_cnt; 2799 int cnt; 2800 boolean_t src_ipif_held = B_FALSE; 2801 boolean_t ire_added = B_FALSE; 2802 boolean_t loopback = B_FALSE; 2803 boolean_t ip6_asp_table_held = B_FALSE; 2804 ip_stack_t *ipst = ill->ill_ipst; 2805 2806 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2807 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2808 2809 /* Check if this is a loopback interface */ 2810 if (ipif->ipif_ill->ill_wq == NULL) 2811 loopback = B_TRUE; 2812 2813 ASSERT(ipif->ipif_isv6); 2814 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2815 2816 /* 2817 * If all other interfaces for this ill are down or DEPRECATED, 2818 * or otherwise unsuitable for source address selection, remove 2819 * any IRE_CACHE entries for this ill to make sure source 2820 * address selection gets to take this new ipif into account. 2821 * No need to hold ill_lock while traversing the ipif list since 2822 * we are writer 2823 */ 2824 for (tmp_ipif = ill->ill_ipif; tmp_ipif; 2825 tmp_ipif = tmp_ipif->ipif_next) { 2826 if (((tmp_ipif->ipif_flags & 2827 (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) || 2828 !(tmp_ipif->ipif_flags & IPIF_UP)) || 2829 (tmp_ipif == ipif)) 2830 continue; 2831 /* first useable pre-existing interface */ 2832 flush_ire_cache = B_FALSE; 2833 break; 2834 } 2835 if (flush_ire_cache) 2836 ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE, 2837 IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill); 2838 2839 /* 2840 * Figure out which way the send-to queue should go. Only 2841 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here. 2842 */ 2843 switch (ill->ill_net_type) { 2844 case IRE_IF_RESOLVER: 2845 stq = ill->ill_rq; 2846 break; 2847 case IRE_IF_NORESOLVER: 2848 case IRE_LOOPBACK: 2849 stq = ill->ill_wq; 2850 break; 2851 default: 2852 return (EINVAL); 2853 } 2854 2855 if (IS_LOOPBACK(ill)) { 2856 /* 2857 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 2858 * ipif_lookup_on_name(), but in the case of zones we can have 2859 * several loopback addresses on lo0. So all the interfaces with 2860 * loopback addresses need to be marked IRE_LOOPBACK. 2861 */ 2862 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 2863 ipif->ipif_ire_type = IRE_LOOPBACK; 2864 else 2865 ipif->ipif_ire_type = IRE_LOCAL; 2866 } 2867 2868 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) { 2869 /* 2870 * Can't use our source address. Select a different 2871 * source address for the IRE_INTERFACE and IRE_LOCAL 2872 */ 2873 if (ip6_asp_can_lookup(ipst)) { 2874 ip6_asp_table_held = B_TRUE; 2875 src_ipif = ipif_select_source_v6(ipif->ipif_ill, 2876 &ipif->ipif_v6subnet, RESTRICT_TO_NONE, 2877 IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid); 2878 } 2879 if (src_ipif == NULL) 2880 src_ipif = ipif; /* Last resort */ 2881 else 2882 src_ipif_held = B_TRUE; 2883 } else { 2884 src_ipif = ipif; 2885 } 2886 2887 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 2888 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 2889 2890 /* 2891 * If we're on a labeled system then make sure that zone- 2892 * private addresses have proper remote host database entries. 2893 */ 2894 if (is_system_labeled() && 2895 ipif->ipif_ire_type != IRE_LOOPBACK) { 2896 if (ip6opt_ls == 0) { 2897 cmn_err(CE_WARN, "IPv6 not enabled " 2898 "via /etc/system"); 2899 return (EINVAL); 2900 } 2901 if (!tsol_check_interface_address(ipif)) 2902 return (EINVAL); 2903 } 2904 2905 /* Register the source address for __sin6_src_id */ 2906 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 2907 ipif->ipif_zoneid, ipst); 2908 if (err != 0) { 2909 ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err)); 2910 if (src_ipif_held) 2911 ipif_refrele(src_ipif); 2912 if (ip6_asp_table_held) 2913 ip6_asp_table_refrele(ipst); 2914 return (err); 2915 } 2916 /* 2917 * If the interface address is set, create the LOCAL 2918 * or LOOPBACK IRE. 2919 */ 2920 ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n", 2921 ipif->ipif_ire_type, 2922 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 2923 buf, sizeof (buf)))); 2924 2925 *irep++ = ire_create_v6( 2926 &ipif->ipif_v6lcl_addr, /* dest address */ 2927 &ipv6_all_ones, /* mask */ 2928 &src_ipif->ipif_v6src_addr, /* source address */ 2929 NULL, /* no gateway */ 2930 &ip_loopback_mtu_v6plus, /* max frag size */ 2931 NULL, 2932 ipif->ipif_rq, /* recv-from queue */ 2933 NULL, /* no send-to queue */ 2934 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 2935 ipif, /* interface */ 2936 NULL, 2937 0, 2938 0, 2939 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2940 &ire_uinfo_null, 2941 NULL, 2942 NULL, 2943 ipst); 2944 } 2945 2946 /* 2947 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. 2948 * Note that atun interfaces have an all-zero ipif_v6subnet. 2949 * Thus we allow a zero subnet as long as the mask is non-zero. 2950 */ 2951 if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) && 2952 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2953 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2954 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2955 v6addr = ipif->ipif_v6subnet; 2956 2957 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2958 route_mask = ipv6_all_ones; 2959 } else { 2960 route_mask = ipif->ipif_v6net_mask; 2961 } 2962 2963 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n", 2964 ill->ill_net_type, 2965 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 2966 2967 *irep++ = ire_create_v6( 2968 &v6addr, /* dest pref */ 2969 &route_mask, /* mask */ 2970 &src_ipif->ipif_v6src_addr, /* src addr */ 2971 NULL, /* no gateway */ 2972 &ipif->ipif_mtu, /* max frag */ 2973 NULL, /* no src nce */ 2974 NULL, /* no recv from queue */ 2975 stq, /* send-to queue */ 2976 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2977 ipif, 2978 NULL, 2979 0, 2980 0, 2981 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2982 &ire_uinfo_null, 2983 NULL, 2984 NULL, 2985 ipst); 2986 } 2987 2988 /* 2989 * Setup 2002::/16 route, if this interface is a 6to4 tunnel 2990 */ 2991 if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) && 2992 (ill->ill_is_6to4tun)) { 2993 /* 2994 * Destination address is 2002::/16 2995 */ 2996 #ifdef _BIG_ENDIAN 2997 const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 }; 2998 const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 }; 2999 #else 3000 const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 }; 3001 const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 }; 3002 #endif /* _BIG_ENDIAN */ 3003 char buf2[INET6_ADDRSTRLEN]; 3004 ire_t *isdup; 3005 in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr; 3006 3007 /* 3008 * check to see if this route has already been added for 3009 * this tunnel interface. 3010 */ 3011 isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0, 3012 IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, NULL, 3013 (MATCH_IRE_SRC | MATCH_IRE_MASK), ipst); 3014 3015 if (isdup == NULL) { 3016 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s", 3017 IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr, 3018 buf2, sizeof (buf2)))); 3019 3020 *irep++ = ire_create_v6( 3021 &prefix_addr, /* 2002:: */ 3022 &prefix_mask, /* ffff:: */ 3023 &ipif->ipif_v6lcl_addr, /* src addr */ 3024 NULL, /* gateway */ 3025 &ipif->ipif_mtu, /* max_frag */ 3026 NULL, /* no src nce */ 3027 NULL, /* no rfq */ 3028 ill->ill_wq, /* stq */ 3029 IRE_IF_NORESOLVER, /* type */ 3030 ipif, /* interface */ 3031 NULL, /* v6cmask */ 3032 0, 3033 0, 3034 RTF_UP, 3035 &ire_uinfo_null, 3036 NULL, 3037 NULL, 3038 ipst); 3039 } else { 3040 ire_refrele(isdup); 3041 } 3042 } 3043 3044 /* If an earlier ire_create failed, get out now */ 3045 for (irep1 = irep; irep1 > ire_array; ) { 3046 irep1--; 3047 if (*irep1 == NULL) { 3048 ip1dbg(("ipif_up_done_v6: NULL ire found in" 3049 " ire_array\n")); 3050 err = ENOMEM; 3051 goto bad; 3052 } 3053 } 3054 3055 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 3056 3057 /* 3058 * Need to atomically check for ip_addr_availablity_check 3059 * now under ill_g_lock, and if it fails got bad, and remove 3060 * from group also 3061 */ 3062 rw_enter(&ipst->ips_ill_g_lock, RW_READER); 3063 mutex_enter(&ipst->ips_ip_addr_avail_lock); 3064 ill->ill_ipif_up_count++; 3065 ipif->ipif_flags |= IPIF_UP; 3066 err = ip_addr_availability_check(ipif); 3067 mutex_exit(&ipst->ips_ip_addr_avail_lock); 3068 rw_exit(&ipst->ips_ill_g_lock); 3069 3070 if (err != 0) { 3071 /* 3072 * Our address may already be up on the same ill. In this case, 3073 * the external resolver entry for our ipif replaced the one for 3074 * the other ipif. So we don't want to delete it (otherwise the 3075 * other ipif would be unable to send packets). 3076 * ip_addr_availability_check() identifies this case for us and 3077 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL 3078 * which is the expected error code. 3079 */ 3080 if (err == EADDRINUSE) { 3081 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) { 3082 freemsg(ipif->ipif_arp_del_mp); 3083 ipif->ipif_arp_del_mp = NULL; 3084 } 3085 err = EADDRNOTAVAIL; 3086 } 3087 ill->ill_ipif_up_count--; 3088 ipif->ipif_flags &= ~IPIF_UP; 3089 goto bad; 3090 } 3091 3092 /* 3093 * Add in all newly created IREs. We want to add before 3094 * we call ifgrp_insert which wants to know whether 3095 * IRE_IF_RESOLVER exists or not. 3096 * 3097 * NOTE : We refrele the ire though we may branch to "bad" 3098 * later on where we do ire_delete. This is okay 3099 * because nobody can delete it as we are running 3100 * exclusively. 3101 */ 3102 for (irep1 = irep; irep1 > ire_array; ) { 3103 irep1--; 3104 /* Shouldn't be adding any bcast ire's */ 3105 ASSERT((*irep1)->ire_type != IRE_BROADCAST); 3106 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 3107 /* 3108 * refheld by ire_add. refele towards the end of the func 3109 */ 3110 (void) ire_add(irep1, NULL, NULL, NULL, B_FALSE); 3111 } 3112 if (ip6_asp_table_held) { 3113 ip6_asp_table_refrele(ipst); 3114 ip6_asp_table_held = B_FALSE; 3115 } 3116 ire_added = B_TRUE; 3117 3118 /* 3119 * Form groups if possible. 3120 * 3121 * If we are supposed to be in a ill_group with a name, insert it 3122 * now as we know that at least one ipif is UP. Otherwise form 3123 * nameless groups. 3124 * 3125 * If ip_enable_group_ifs is set and ipif address is not ::0, insert 3126 * this ipif into the appropriate interface group, or create a 3127 * new one. If this is already in a nameless group, we try to form 3128 * a bigger group looking at other ills potentially sharing this 3129 * ipif's prefix. 3130 */ 3131 phyi = ill->ill_phyint; 3132 if (phyi->phyint_groupname_len != 0) { 3133 ASSERT(phyi->phyint_groupname != NULL); 3134 if (ill->ill_ipif_up_count == 1) { 3135 ASSERT(ill->ill_group == NULL); 3136 err = illgrp_insert(&ipst->ips_illgrp_head_v6, ill, 3137 phyi->phyint_groupname, NULL, B_TRUE); 3138 if (err != 0) { 3139 ip1dbg(("ipif_up_done_v6: illgrp allocation " 3140 "failed, error %d\n", err)); 3141 goto bad; 3142 } 3143 } 3144 ASSERT(ill->ill_group != NULL); 3145 } 3146 3147 /* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */ 3148 ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt; 3149 ipif_saved_irep = ipif_recover_ire_v6(ipif); 3150 3151 if (ipif->ipif_ipif_up_count == 1 && !loopback) { 3152 /* 3153 * Need to recover all multicast memberships in the driver. 3154 * This had to be deferred until we had attached. 3155 */ 3156 ill_recover_multicast(ill); 3157 } 3158 /* Join the allhosts multicast address and the solicited node MC */ 3159 ipif_multicast_up(ipif); 3160 3161 if (!loopback) { 3162 /* 3163 * See whether anybody else would benefit from the 3164 * new ipif that we added. We call this always rather 3165 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST 3166 * ipif for the benefit of illgrp_insert (done above) 3167 * which does not do source address selection as it does 3168 * not want to re-create interface routes that we are 3169 * having reference to it here. 3170 */ 3171 ill_update_source_selection(ill); 3172 } 3173 3174 for (irep1 = irep; irep1 > ire_array; ) { 3175 irep1--; 3176 if (*irep1 != NULL) { 3177 /* was held in ire_add */ 3178 ire_refrele(*irep1); 3179 } 3180 } 3181 3182 cnt = ipif_saved_ire_cnt; 3183 for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) { 3184 if (*irep1 != NULL) { 3185 /* was held in ire_add */ 3186 ire_refrele(*irep1); 3187 } 3188 } 3189 3190 if (ipif->ipif_addr_ready) { 3191 ip_rts_ifmsg(ipif); 3192 ip_rts_newaddrmsg(RTM_ADD, 0, ipif); 3193 sctp_update_ipif(ipif, SCTP_IPIF_UP); 3194 } 3195 3196 if (ipif_saved_irep != NULL) { 3197 kmem_free(ipif_saved_irep, 3198 ipif_saved_ire_cnt * sizeof (ire_t *)); 3199 } 3200 3201 if (src_ipif_held) 3202 ipif_refrele(src_ipif); 3203 return (0); 3204 3205 bad: 3206 if (ip6_asp_table_held) 3207 ip6_asp_table_refrele(ipst); 3208 /* 3209 * We don't have to bother removing from ill groups because 3210 * 3211 * 1) For groups with names, we insert only when the first ipif 3212 * comes up. In that case if it fails, it will not be in any 3213 * group. So, we need not try to remove for that case. 3214 * 3215 * 2) For groups without names, either we tried to insert ipif_ill 3216 * in a group as singleton or found some other group to become 3217 * a bigger group. For the former, if it fails we don't have 3218 * anything to do as ipif_ill is not in the group and for the 3219 * latter, there are no failures in illgrp_insert/illgrp_delete 3220 * (ENOMEM can't occur for this. Check ifgrp_insert). 3221 */ 3222 3223 while (irep > ire_array) { 3224 irep--; 3225 if (*irep != NULL) { 3226 ire_delete(*irep); 3227 if (ire_added) 3228 ire_refrele(*irep); 3229 } 3230 3231 } 3232 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst); 3233 3234 if (ipif_saved_irep != NULL) { 3235 kmem_free(ipif_saved_irep, 3236 ipif_saved_ire_cnt * sizeof (ire_t *)); 3237 } 3238 if (src_ipif_held) 3239 ipif_refrele(src_ipif); 3240 3241 ipif_ndp_down(ipif); 3242 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) 3243 ipif_arp_down(ipif); 3244 3245 return (err); 3246 } 3247 3248 /* 3249 * Delete an ND entry and the corresponding IRE_CACHE entry if it exists. 3250 */ 3251 /* ARGSUSED */ 3252 int 3253 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3254 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3255 { 3256 in6_addr_t addr; 3257 sin6_t *sin6; 3258 nce_t *nce; 3259 struct lifreq *lifr; 3260 lif_nd_req_t *lnr; 3261 mblk_t *mp1; 3262 3263 mp1 = mp->b_cont->b_cont; 3264 lifr = (struct lifreq *)mp1->b_rptr; 3265 lnr = &lifr->lifr_nd; 3266 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3267 if (ipif->ipif_id != 0) 3268 return (EINVAL); 3269 3270 if (!ipif->ipif_isv6) 3271 return (EINVAL); 3272 3273 if (lnr->lnr_addr.ss_family != AF_INET6) 3274 return (EAFNOSUPPORT); 3275 3276 sin6 = (sin6_t *)&lnr->lnr_addr; 3277 addr = sin6->sin6_addr; 3278 nce = ndp_lookup_v6(ipif->ipif_ill, &addr, B_FALSE); 3279 if (nce == NULL) 3280 return (ESRCH); 3281 ndp_delete(nce); 3282 NCE_REFRELE(nce); 3283 return (0); 3284 } 3285 3286 /* 3287 * Return nbr cache info. 3288 */ 3289 /* ARGSUSED */ 3290 int 3291 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3292 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3293 { 3294 ill_t *ill = ipif->ipif_ill; 3295 struct lifreq *lifr; 3296 lif_nd_req_t *lnr; 3297 3298 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3299 lnr = &lifr->lifr_nd; 3300 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3301 if (ipif->ipif_id != 0) 3302 return (EINVAL); 3303 3304 if (!ipif->ipif_isv6) 3305 return (EINVAL); 3306 3307 if (lnr->lnr_addr.ss_family != AF_INET6) 3308 return (EAFNOSUPPORT); 3309 3310 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 3311 return (EINVAL); 3312 3313 return (ndp_query(ill, lnr)); 3314 } 3315 3316 /* 3317 * Perform an update of the nd entry for the specified address. 3318 */ 3319 /* ARGSUSED */ 3320 int 3321 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 3322 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 3323 { 3324 ill_t *ill = ipif->ipif_ill; 3325 struct lifreq *lifr; 3326 lif_nd_req_t *lnr; 3327 3328 ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL); 3329 3330 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 3331 lnr = &lifr->lifr_nd; 3332 /* Only allow for logical unit zero i.e. not on "le0:17" */ 3333 if (ipif->ipif_id != 0) 3334 return (EINVAL); 3335 3336 if (!ipif->ipif_isv6) 3337 return (EINVAL); 3338 3339 if (lnr->lnr_addr.ss_family != AF_INET6) 3340 return (EAFNOSUPPORT); 3341 3342 return (ndp_sioc_update(ill, lnr)); 3343 } 3344