1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 /* 27 * Copyright (c) 1990 Mentat Inc. 28 */ 29 30 #pragma ident "%Z%%M% %I% %E% SMI" 31 32 /* 33 * This file contains the interface control functions for IPv6. 34 */ 35 36 #include <sys/types.h> 37 #include <sys/sysmacros.h> 38 #include <sys/stream.h> 39 #include <sys/dlpi.h> 40 #include <sys/stropts.h> 41 #include <sys/strlog.h> 42 #include <sys/ddi.h> 43 #include <sys/cmn_err.h> 44 #include <sys/kstat.h> 45 #include <sys/debug.h> 46 #include <sys/zone.h> 47 48 #include <sys/systm.h> 49 #include <sys/param.h> 50 #include <sys/socket.h> 51 #define _SUN_TPI_VERSION 2 52 #include <sys/tihdr.h> 53 #include <sys/isa_defs.h> 54 #include <net/if.h> 55 #include <net/if_types.h> 56 #include <net/if_dl.h> 57 #include <net/route.h> 58 #include <sys/sockio.h> 59 #include <netinet/in.h> 60 #include <netinet/igmp_var.h> 61 #include <netinet/ip6.h> 62 #include <netinet/icmp6.h> 63 #include <netinet/in.h> 64 65 #include <inet/common.h> 66 #include <inet/mi.h> 67 #include <inet/nd.h> 68 #include <inet/mib2.h> 69 #include <inet/arp.h> 70 #include <inet/ip.h> 71 #include <inet/ip6.h> 72 #include <inet/ip_multi.h> 73 #include <inet/ip_ire.h> 74 #include <inet/ip_rts.h> 75 #include <inet/ip_ndp.h> 76 #include <inet/ip_if.h> 77 #include <inet/ip6_asp.h> 78 #include <inet/tun.h> 79 #include <inet/ipclassifier.h> 80 #include <inet/sctp_ip.h> 81 82 #include <netinet/igmp.h> 83 #include <netinet/ip_mroute.h> 84 85 static in6_addr_t ipv6_ll_template = 86 {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}; 87 88 static ipif_t * 89 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 90 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error); 91 92 /* 93 * ipif_lookup_group_v6 94 */ 95 ipif_t * 96 ipif_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid) 97 { 98 ire_t *ire; 99 ipif_t *ipif; 100 101 ire = ire_lookup_multi_v6(group, zoneid); 102 if (ire == NULL) 103 return (NULL); 104 ipif = ire->ire_ipif; 105 ipif_refhold(ipif); 106 ire_refrele(ire); 107 return (ipif); 108 } 109 110 /* 111 * ill_lookup_group_v6 112 */ 113 ill_t * 114 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid) 115 { 116 ire_t *ire; 117 ill_t *ill; 118 119 ire = ire_lookup_multi_v6(group, zoneid); 120 if (ire == NULL) 121 return (NULL); 122 ill = ire->ire_ipif->ipif_ill; 123 ill_refhold(ill); 124 ire_refrele(ire); 125 return (ill); 126 } 127 128 /* 129 * Look for an ipif with the specified interface address and destination. 130 * The destination address is used only for matching point-to-point interfaces. 131 */ 132 static ipif_t * 133 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst, 134 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error) 135 { 136 ipif_t *ipif; 137 ill_t *ill; 138 ipsq_t *ipsq; 139 ill_walk_context_t ctx; 140 141 if (error != NULL) 142 *error = 0; 143 144 /* 145 * First match all the point-to-point interfaces 146 * before looking at non-point-to-point interfaces. 147 * This is done to avoid returning non-point-to-point 148 * ipif instead of unnumbered point-to-point ipif. 149 */ 150 rw_enter(&ill_g_lock, RW_READER); 151 ill = ILL_START_WALK_V6(&ctx); 152 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 153 GRAB_CONN_LOCK(q); 154 mutex_enter(&ill->ill_lock); 155 for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) { 156 /* Allow the ipif to be down */ 157 if ((ipif->ipif_flags & IPIF_POINTOPOINT) && 158 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, 159 if_addr)) && 160 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 161 dst))) { 162 if (IPIF_CAN_LOOKUP(ipif)) { 163 ipif_refhold_locked(ipif); 164 mutex_exit(&ill->ill_lock); 165 RELEASE_CONN_LOCK(q); 166 rw_exit(&ill_g_lock); 167 return (ipif); 168 } else if (IPIF_CAN_WAIT(ipif, q)) { 169 ipsq = ill->ill_phyint->phyint_ipsq; 170 mutex_enter(&ipsq->ipsq_lock); 171 mutex_exit(&ill->ill_lock); 172 rw_exit(&ill_g_lock); 173 ipsq_enq(ipsq, q, mp, func, NEW_OP, 174 ill); 175 mutex_exit(&ipsq->ipsq_lock); 176 RELEASE_CONN_LOCK(q); 177 *error = EINPROGRESS; 178 return (NULL); 179 } 180 } 181 } 182 mutex_exit(&ill->ill_lock); 183 RELEASE_CONN_LOCK(q); 184 } 185 rw_exit(&ill_g_lock); 186 /* lookup the ipif based on interface address */ 187 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, q, mp, func, 188 error); 189 ASSERT(ipif == NULL || ipif->ipif_isv6); 190 return (ipif); 191 } 192 193 /* 194 * Look for an ipif with the specified address. For point-point links 195 * we look for matches on either the destination address and the local 196 * address, but we ignore the check on the local address if IPIF_UNNUMBERED 197 * is set. 198 * Matches on a specific ill if match_ill is set. 199 */ 200 /* ARGSUSED */ 201 ipif_t * 202 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid, 203 queue_t *q, mblk_t *mp, ipsq_func_t func, int *error) 204 { 205 ipif_t *ipif; 206 ill_t *ill; 207 boolean_t ptp = B_FALSE; 208 ipsq_t *ipsq; 209 ill_walk_context_t ctx; 210 211 if (error != NULL) 212 *error = 0; 213 214 rw_enter(&ill_g_lock, RW_READER); 215 /* 216 * Repeat twice, first based on local addresses and 217 * next time for pointopoint. 218 */ 219 repeat: 220 ill = ILL_START_WALK_V6(&ctx); 221 for (; ill != NULL; ill = ill_next(&ctx, ill)) { 222 if (match_ill != NULL && ill != match_ill) { 223 continue; 224 } 225 GRAB_CONN_LOCK(q); 226 mutex_enter(&ill->ill_lock); 227 for (ipif = ill->ill_ipif; ipif; ipif = ipif->ipif_next) { 228 if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid) 229 continue; 230 /* Allow the ipif to be down */ 231 if ((!ptp && (IN6_ARE_ADDR_EQUAL( 232 &ipif->ipif_v6lcl_addr, addr) && 233 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) || 234 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) && 235 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, 236 addr))) { 237 if (IPIF_CAN_LOOKUP(ipif)) { 238 ipif_refhold_locked(ipif); 239 mutex_exit(&ill->ill_lock); 240 RELEASE_CONN_LOCK(q); 241 rw_exit(&ill_g_lock); 242 return (ipif); 243 } else if (IPIF_CAN_WAIT(ipif, q)) { 244 ipsq = ill->ill_phyint->phyint_ipsq; 245 mutex_enter(&ipsq->ipsq_lock); 246 mutex_exit(&ill->ill_lock); 247 rw_exit(&ill_g_lock); 248 ipsq_enq(ipsq, q, mp, func, NEW_OP, 249 ill); 250 mutex_exit(&ipsq->ipsq_lock); 251 RELEASE_CONN_LOCK(q); 252 *error = EINPROGRESS; 253 return (NULL); 254 } 255 } 256 } 257 mutex_exit(&ill->ill_lock); 258 RELEASE_CONN_LOCK(q); 259 } 260 261 /* Repeat once more if needed */ 262 if (ptp) { 263 rw_exit(&ill_g_lock); 264 if (error != NULL) 265 *error = ENXIO; 266 return (NULL); 267 } 268 ptp = B_TRUE; 269 goto repeat; 270 } 271 272 /* 273 * Perform various checks to verify that an address would make sense as a local 274 * interface address. This is currently only called when an attempt is made 275 * to set a local address. 276 * 277 * Does not allow a v4-mapped address, an address that equals the subnet 278 * anycast address, ... a multicast address, ... 279 */ 280 boolean_t 281 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 282 { 283 in6_addr_t subnet; 284 285 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 286 return (B_TRUE); /* Allow all zeros */ 287 288 /* 289 * Don't allow all zeroes or host part, but allow 290 * all ones netmask. 291 */ 292 V6_MASK_COPY(*addr, *subnet_mask, subnet); 293 if (IN6_IS_ADDR_V4MAPPED(addr) || 294 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 295 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 296 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) || 297 IN6_IS_ADDR_MULTICAST(addr)) 298 return (B_FALSE); 299 300 return (B_TRUE); 301 } 302 303 /* 304 * Perform various checks to verify that an address would make sense as a 305 * remote/subnet interface address. 306 */ 307 boolean_t 308 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask) 309 { 310 in6_addr_t subnet; 311 312 if (IN6_IS_ADDR_UNSPECIFIED(addr)) 313 return (B_TRUE); /* Allow all zeros */ 314 315 V6_MASK_COPY(*addr, *subnet_mask, subnet); 316 if (IN6_IS_ADDR_V4MAPPED(addr) || 317 (IN6_ARE_ADDR_EQUAL(addr, &subnet) && 318 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) || 319 IN6_IS_ADDR_MULTICAST(addr) || 320 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr))))) 321 return (B_FALSE); 322 323 return (B_TRUE); 324 } 325 326 /* 327 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table. 328 * ipif_arg is passed in to associate it with the correct interface 329 * (for link-local destinations and gateways). 330 */ 331 /* ARGSUSED1 */ 332 int 333 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 334 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags, 335 ipif_t *ipif_arg, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func) 336 { 337 ire_t *ire; 338 ire_t *gw_ire = NULL; 339 ipif_t *ipif; 340 boolean_t ipif_refheld = B_FALSE; 341 uint_t type; 342 int match_flags = MATCH_IRE_TYPE; 343 int error; 344 345 if (ire_arg != NULL) 346 *ire_arg = NULL; 347 348 /* 349 * Prevent routes with a zero gateway from being created (since 350 * interfaces can currently be plumbed and brought up with no assigned 351 * address). 352 */ 353 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr)) 354 return (ENETUNREACH); 355 356 /* 357 * If this is the case of RTF_HOST being set, then we set the netmask 358 * to all ones (regardless if one was supplied). 359 */ 360 if (flags & RTF_HOST) 361 mask = &ipv6_all_ones; 362 363 /* 364 * Get the ipif, if any, corresponding to the gw_addr 365 */ 366 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, 367 &error); 368 if (ipif != NULL) 369 ipif_refheld = B_TRUE; 370 else if (error == EINPROGRESS) { 371 ip1dbg(("ip_rt_add_v6: null and EINPROGRESS")); 372 return (error); 373 } 374 375 /* 376 * GateD will attempt to create routes with a loopback interface 377 * address as the gateway and with RTF_GATEWAY set. We allow 378 * these routes to be added, but create them as interface routes 379 * since the gateway is an interface address. 380 */ 381 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) 382 flags &= ~RTF_GATEWAY; 383 384 /* 385 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set 386 * and the gateway address provided is one of the system's interface 387 * addresses. By using the routing socket interface and supplying an 388 * RTA_IFP sockaddr with an interface index, an alternate method of 389 * specifying an interface route to be created is available which uses 390 * the interface index that specifies the outgoing interface rather than 391 * the address of an outgoing interface (which may not be able to 392 * uniquely identify an interface). When coupled with the RTF_GATEWAY 393 * flag, routes can be specified which not only specify the next-hop to 394 * be used when routing to a certain prefix, but also which outgoing 395 * interface should be used. 396 * 397 * Previously, interfaces would have unique addresses assigned to them 398 * and so the address assigned to a particular interface could be used 399 * to identify a particular interface. One exception to this was the 400 * case of an unnumbered interface (where IPIF_UNNUMBERED was set). 401 * 402 * With the advent of IPv6 and its link-local addresses, this 403 * restriction was relaxed and interfaces could share addresses between 404 * themselves. In fact, typically all of the link-local interfaces on 405 * an IPv6 node or router will have the same link-local address. In 406 * order to differentiate between these interfaces, the use of an 407 * interface index is necessary and this index can be carried inside a 408 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction 409 * of using the interface index, however, is that all of the ipif's that 410 * are part of an ill have the same index and so the RTA_IFP sockaddr 411 * cannot be used to differentiate between ipif's (or logical 412 * interfaces) that belong to the same ill (physical interface). 413 * 414 * For example, in the following case involving IPv4 interfaces and 415 * logical interfaces 416 * 417 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0 418 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0:1 419 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0:2 420 * 421 * the ipif's corresponding to each of these interface routes can be 422 * uniquely identified by the "gateway" (actually interface address). 423 * 424 * In this case involving multiple IPv6 default routes to a particular 425 * link-local gateway, the use of RTA_IFP is necessary to specify which 426 * default route is of interest: 427 * 428 * default fe80::123:4567:89ab:cdef U if0 429 * default fe80::123:4567:89ab:cdef U if1 430 */ 431 432 /* RTF_GATEWAY not set */ 433 if (!(flags & RTF_GATEWAY)) { 434 queue_t *stq; 435 436 /* 437 * As the interface index specified with the RTA_IFP sockaddr is 438 * the same for all ipif's off of an ill, the matching logic 439 * below uses MATCH_IRE_ILL if such an index was specified. 440 * This means that routes sharing the same prefix when added 441 * using a RTA_IFP sockaddr must have distinct interface 442 * indices (namely, they must be on distinct ill's). 443 * 444 * On the other hand, since the gateway address will usually be 445 * different for each ipif on the system, the matching logic 446 * uses MATCH_IRE_IPIF in the case of a traditional interface 447 * route. This means that interface routes for the same prefix 448 * can be created if they belong to distinct ipif's and if a 449 * RTA_IFP sockaddr is not present. 450 */ 451 if (ipif_arg != NULL) { 452 if (ipif_refheld) { 453 ipif_refrele(ipif); 454 ipif_refheld = B_FALSE; 455 } 456 ipif = ipif_arg; 457 match_flags |= MATCH_IRE_ILL; 458 } else { 459 /* 460 * Check the ipif corresponding to the gw_addr 461 */ 462 if (ipif == NULL) 463 return (ENETUNREACH); 464 match_flags |= MATCH_IRE_IPIF; 465 } 466 467 ASSERT(ipif != NULL); 468 /* 469 * We check for an existing entry at this point. 470 */ 471 match_flags |= MATCH_IRE_MASK; 472 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, IRE_INTERFACE, 473 ipif, NULL, ALL_ZONES, 0, match_flags); 474 if (ire != NULL) { 475 ire_refrele(ire); 476 if (ipif_refheld) 477 ipif_refrele(ipif); 478 return (EEXIST); 479 } 480 481 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 482 ? ipif->ipif_rq : ipif->ipif_wq; 483 484 /* 485 * Create a copy of the IRE_LOOPBACK, IRE_IF_NORESOLVER or 486 * IRE_IF_RESOLVER with the modified address and netmask. 487 */ 488 ire = ire_create_v6( 489 dst_addr, 490 mask, 491 &ipif->ipif_v6src_addr, 492 NULL, 493 &ipif->ipif_mtu, 494 NULL, 495 NULL, 496 stq, 497 ipif->ipif_net_type, 498 ipif->ipif_resolver_mp, 499 ipif, 500 NULL, 501 0, 502 0, 503 flags, 504 &ire_uinfo_null); 505 if (ire == NULL) { 506 if (ipif_refheld) 507 ipif_refrele(ipif); 508 return (ENOMEM); 509 } 510 511 /* 512 * Some software (for example, GateD and Sun Cluster) attempts 513 * to create (what amount to) IRE_PREFIX routes with the 514 * loopback address as the gateway. This is primarily done to 515 * set up prefixes with the RTF_REJECT flag set (for example, 516 * when generating aggregate routes.) 517 * 518 * If the IRE type (as defined by ipif->ipif_net_type) is 519 * IRE_LOOPBACK, then we map the request into a 520 * IRE_IF_NORESOLVER. 521 * 522 * Needless to say, the real IRE_LOOPBACK is NOT created by this 523 * routine, but rather using ire_create_v6() directly. 524 */ 525 if (ipif->ipif_net_type == IRE_LOOPBACK) 526 ire->ire_type = IRE_IF_NORESOLVER; 527 error = ire_add(&ire, q, mp, func); 528 if (error == 0) 529 goto save_ire; 530 /* 531 * In the result of failure, ire_add() will have already 532 * deleted the ire in question, so there is no need to 533 * do that here. 534 */ 535 if (ipif_refheld) 536 ipif_refrele(ipif); 537 return (error); 538 } 539 if (ipif_refheld) { 540 ipif_refrele(ipif); 541 ipif_refheld = B_FALSE; 542 } 543 544 /* 545 * Get an interface IRE for the specified gateway. 546 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the 547 * gateway, it is currently unreachable and we fail the request 548 * accordingly. 549 */ 550 ipif = ipif_arg; 551 if (ipif_arg != NULL) 552 match_flags |= MATCH_IRE_ILL; 553 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, 554 NULL, ALL_ZONES, 0, match_flags); 555 if (gw_ire == NULL) 556 return (ENETUNREACH); 557 558 /* 559 * We create one of three types of IREs as a result of this request 560 * based on the netmask. A netmask of all ones (which is automatically 561 * assumed when RTF_HOST is set) results in an IRE_HOST being created. 562 * An all zeroes netmask implies a default route so an IRE_DEFAULT is 563 * created. Otherwise, an IRE_PREFIX route is created for the 564 * destination prefix. 565 */ 566 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 567 type = IRE_HOST; 568 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 569 type = IRE_DEFAULT; 570 else 571 type = IRE_PREFIX; 572 573 /* check for a duplicate entry */ 574 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ipif_arg, 575 NULL, ALL_ZONES, 0, match_flags | MATCH_IRE_MASK | MATCH_IRE_GW); 576 if (ire != NULL) { 577 ire_refrele(gw_ire); 578 ire_refrele(ire); 579 return (EEXIST); 580 } 581 582 /* Create the IRE. */ 583 ire = ire_create_v6( 584 dst_addr, /* dest address */ 585 mask, /* mask */ 586 /* src address assigned by the caller? */ 587 (((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr)) ? 588 src_addr : NULL), 589 gw_addr, /* gateway address */ 590 &gw_ire->ire_max_frag, 591 NULL, /* no Fast Path header */ 592 NULL, /* no recv-from queue */ 593 NULL, /* no send-to queue */ 594 (ushort_t)type, /* IRE type */ 595 NULL, 596 ipif_arg, 597 NULL, 598 0, 599 0, 600 flags, 601 &gw_ire->ire_uinfo); /* Inherit ULP info from gw */ 602 if (ire == NULL) { 603 ire_refrele(gw_ire); 604 return (ENOMEM); 605 } 606 607 /* 608 * POLICY: should we allow an RTF_HOST with address INADDR_ANY? 609 * SUN/OS socket stuff does but do we really want to allow ::0 ? 610 */ 611 612 /* Add the new IRE. */ 613 error = ire_add(&ire, q, mp, func); 614 /* 615 * In the result of failure, ire_add() will have already 616 * deleted the ire in question, so there is no need to 617 * do that here. 618 */ 619 if (error != 0) { 620 ire_refrele(gw_ire); 621 return (error); 622 } 623 624 if (flags & RTF_MULTIRT) { 625 /* 626 * Invoke the CGTP (multirouting) filtering module 627 * to add the dst address in the filtering database. 628 * Replicated inbound packets coming from that address 629 * will be filtered to discard the duplicates. 630 * It is not necessary to call the CGTP filter hook 631 * when the dst address is a multicast, because an 632 * IP source address cannot be a multicast. 633 */ 634 if ((ip_cgtp_filter_ops != NULL) && 635 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) { 636 int res = ip_cgtp_filter_ops->cfo_add_dest_v6( 637 &ire->ire_addr_v6, 638 &ire->ire_gateway_addr_v6, 639 &ire->ire_src_addr_v6, 640 &gw_ire->ire_src_addr_v6); 641 if (res != 0) { 642 ire_refrele(gw_ire); 643 ire_delete(ire); 644 return (res); 645 } 646 } 647 } 648 649 save_ire: 650 if (gw_ire != NULL) { 651 ire_refrele(gw_ire); 652 } 653 if (ipif != NULL) { 654 mblk_t *save_mp; 655 656 /* 657 * Save enough information so that we can recreate the IRE if 658 * the interface goes down and then up. The metrics associated 659 * with the route will be saved as well when rts_setmetrics() is 660 * called after the IRE has been created. In the case where 661 * memory cannot be allocated, none of this information will be 662 * saved. 663 */ 664 save_mp = allocb(sizeof (ifrt_t), BPRI_MED); 665 if (save_mp != NULL) { 666 ifrt_t *ifrt; 667 668 save_mp->b_wptr += sizeof (ifrt_t); 669 ifrt = (ifrt_t *)save_mp->b_rptr; 670 bzero(ifrt, sizeof (ifrt_t)); 671 ifrt->ifrt_type = ire->ire_type; 672 ifrt->ifrt_v6addr = ire->ire_addr_v6; 673 mutex_enter(&ire->ire_lock); 674 ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6; 675 ifrt->ifrt_v6src_addr = ire->ire_src_addr_v6; 676 mutex_exit(&ire->ire_lock); 677 ifrt->ifrt_v6mask = ire->ire_mask_v6; 678 ifrt->ifrt_flags = ire->ire_flags; 679 ifrt->ifrt_max_frag = ire->ire_max_frag; 680 mutex_enter(&ipif->ipif_saved_ire_lock); 681 save_mp->b_cont = ipif->ipif_saved_ire_mp; 682 ipif->ipif_saved_ire_mp = save_mp; 683 ipif->ipif_saved_ire_cnt++; 684 mutex_exit(&ipif->ipif_saved_ire_lock); 685 } 686 } 687 if (ire_arg != NULL) { 688 /* 689 * Store the ire that was successfully added into where ire_arg 690 * points to so that callers don't have to look it up 691 * themselves (but they are responsible for ire_refrele()ing 692 * the ire when they are finished with it). 693 */ 694 *ire_arg = ire; 695 } else { 696 ire_refrele(ire); /* Held in ire_add */ 697 } 698 if (ipif_refheld) 699 ipif_refrele(ipif); 700 return (0); 701 } 702 703 /* 704 * ip_rt_delete_v6 is called to delete an IPv6 route. 705 * ipif_arg is passed in to associate it with the correct interface 706 * (for link-local destinations and gateways). 707 */ 708 /* ARGSUSED4 */ 709 int 710 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask, 711 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ipif_t *ipif_arg, 712 queue_t *q, mblk_t *mp, ipsq_func_t func) 713 { 714 ire_t *ire = NULL; 715 ipif_t *ipif; 716 uint_t type; 717 uint_t match_flags = MATCH_IRE_TYPE; 718 int err = 0; 719 boolean_t ipif_refheld = B_FALSE; 720 721 /* 722 * If this is the case of RTF_HOST being set, then we set the netmask 723 * to all ones. Otherwise, we use the netmask if one was supplied. 724 */ 725 if (flags & RTF_HOST) { 726 mask = &ipv6_all_ones; 727 match_flags |= MATCH_IRE_MASK; 728 } else if (rtm_addrs & RTA_NETMASK) { 729 match_flags |= MATCH_IRE_MASK; 730 } 731 732 /* 733 * Note that RTF_GATEWAY is never set on a delete, therefore 734 * we check if the gateway address is one of our interfaces first, 735 * and fall back on RTF_GATEWAY routes. 736 * 737 * This makes it possible to delete an original 738 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1. 739 * 740 * As the interface index specified with the RTA_IFP sockaddr is the 741 * same for all ipif's off of an ill, the matching logic below uses 742 * MATCH_IRE_ILL if such an index was specified. This means a route 743 * sharing the same prefix and interface index as the the route 744 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr 745 * is specified in the request. 746 * 747 * On the other hand, since the gateway address will usually be 748 * different for each ipif on the system, the matching logic 749 * uses MATCH_IRE_IPIF in the case of a traditional interface 750 * route. This means that interface routes for the same prefix can be 751 * uniquely identified if they belong to distinct ipif's and if a 752 * RTA_IFP sockaddr is not present. 753 * 754 * For more detail on specifying routes by gateway address and by 755 * interface index, see the comments in ip_rt_add_v6(). 756 */ 757 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, q, mp, func, &err); 758 if (ipif != NULL) { 759 ipif_refheld = B_TRUE; 760 if (ipif_arg != NULL) { 761 ipif_refrele(ipif); 762 ipif_refheld = B_FALSE; 763 ipif = ipif_arg; 764 match_flags |= MATCH_IRE_ILL; 765 } else { 766 match_flags |= MATCH_IRE_IPIF; 767 } 768 769 if (ipif->ipif_ire_type == IRE_LOOPBACK) 770 ire = ire_ctable_lookup_v6(dst_addr, 0, IRE_LOOPBACK, 771 ipif, ALL_ZONES, match_flags); 772 if (ire == NULL) 773 ire = ire_ftable_lookup_v6(dst_addr, mask, 0, 774 IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0, 775 match_flags); 776 } else if (err == EINPROGRESS) { 777 return (err); 778 } else { 779 err = 0; 780 } 781 if (ire == NULL) { 782 /* 783 * At this point, the gateway address is not one of our own 784 * addresses or a matching interface route was not found. We 785 * set the IRE type to lookup based on whether 786 * this is a host route, a default route or just a prefix. 787 * 788 * If an ipif_arg was passed in, then the lookup is based on an 789 * interface index so MATCH_IRE_ILL is added to match_flags. 790 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is 791 * set as the route being looked up is not a traditional 792 * interface route. 793 */ 794 match_flags &= ~MATCH_IRE_IPIF; 795 match_flags |= MATCH_IRE_GW; 796 if (ipif_arg != NULL) 797 match_flags |= MATCH_IRE_ILL; 798 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) 799 type = IRE_HOST; 800 else if (IN6_IS_ADDR_UNSPECIFIED(mask)) 801 type = IRE_DEFAULT; 802 else 803 type = IRE_PREFIX; 804 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, 805 ipif_arg, NULL, ALL_ZONES, 0, match_flags); 806 if (ire == NULL && type == IRE_HOST) { 807 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, 808 IRE_HOST_REDIRECT, ipif_arg, NULL, ALL_ZONES, 0, 809 match_flags); 810 } 811 } 812 813 if (ipif_refheld) { 814 ipif_refrele(ipif); 815 ipif_refheld = B_FALSE; 816 } 817 if (ire == NULL) 818 return (ESRCH); 819 820 if (ire->ire_flags & RTF_MULTIRT) { 821 /* 822 * Invoke the CGTP (multirouting) filtering module 823 * to remove the dst address from the filtering database. 824 * Packets coming from that address will no longer be 825 * filtered to remove duplicates. 826 */ 827 if (ip_cgtp_filter_ops != NULL) { 828 err = ip_cgtp_filter_ops->cfo_del_dest_v6( 829 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6); 830 } 831 } 832 833 ipif = ire->ire_ipif; 834 if (ipif != NULL) { 835 mblk_t **mpp; 836 mblk_t *mp; 837 ifrt_t *ifrt; 838 in6_addr_t gw_addr_v6; 839 840 /* Remove from ipif_saved_ire_mp list if it is there */ 841 mutex_enter(&ire->ire_lock); 842 gw_addr_v6 = ire->ire_gateway_addr_v6; 843 mutex_exit(&ire->ire_lock); 844 mutex_enter(&ipif->ipif_saved_ire_lock); 845 for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL; 846 mpp = &(*mpp)->b_cont) { 847 /* 848 * On a given ipif, the triple of address, gateway and 849 * mask is unique for each saved IRE (in the case of 850 * ordinary interface routes, the gateway address is 851 * all-zeroes). 852 */ 853 mp = *mpp; 854 ifrt = (ifrt_t *)mp->b_rptr; 855 if (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr, 856 &ire->ire_addr_v6) && 857 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr, 858 &gw_addr_v6) && 859 IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask, 860 &ire->ire_mask_v6)) { 861 *mpp = mp->b_cont; 862 ipif->ipif_saved_ire_cnt--; 863 freeb(mp); 864 break; 865 } 866 } 867 mutex_exit(&ipif->ipif_saved_ire_lock); 868 } 869 ire_delete(ire); 870 ire_refrele(ire); 871 return (err); 872 } 873 874 /* 875 * Derive a token from the link layer address. 876 */ 877 boolean_t 878 ill_setdefaulttoken(ill_t *ill) 879 { 880 int i; 881 in6_addr_t v6addr, v6mask; 882 883 /* 884 * Though we execute on the ipsq, we need to hold the ill_lock 885 * to prevent readers from seeing partially updated values 886 * while we do the update. 887 */ 888 mutex_enter(&ill->ill_lock); 889 if (!MEDIA_V6INTFID(ill->ill_media, ill->ill_phys_addr_length, 890 ill->ill_phys_addr, &v6addr)) { 891 mutex_exit(&ill->ill_lock); 892 return (B_FALSE); 893 } 894 895 (void) ip_plen_to_mask_v6(IPV6_TOKEN_LEN, &v6mask); 896 897 for (i = 0; i < 4; i++) 898 v6mask.s6_addr32[i] = v6mask.s6_addr32[i] ^ 899 (uint32_t)0xffffffff; 900 901 V6_MASK_COPY(v6addr, v6mask, ill->ill_token); 902 ill->ill_token_length = IPV6_TOKEN_LEN; 903 mutex_exit(&ill->ill_lock); 904 return (B_TRUE); 905 } 906 907 /* 908 * Create a link-local address from a token. 909 */ 910 static void 911 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token) 912 { 913 int i; 914 915 for (i = 0; i < 4; i++) { 916 dest->s6_addr32[i] = 917 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i]; 918 } 919 } 920 921 /* 922 * Set a nice default address for either automatic tunnels tsrc/96 or 923 * 6to4 tunnels 2002:<tsrc>::1/64 924 */ 925 static void 926 ipif_set_tun_auto_addr(ipif_t *ipif, struct iftun_req *ta) 927 { 928 sin6_t sin6; 929 sin_t *sin; 930 ill_t *ill = ipif->ipif_ill; 931 tun_t *tp = (tun_t *)ill->ill_wq->q_next->q_ptr; 932 933 if (ta->ifta_saddr.ss_family != AF_INET || 934 (ipif->ipif_flags & IPIF_UP) || !ipif->ipif_isv6 || 935 (ta->ifta_flags & IFTUN_SRC) == 0) 936 return; 937 938 /* 939 * Check the tunnel type by examining q_next->q_ptr 940 */ 941 if (tp->tun_flags & TUN_AUTOMATIC) { 942 /* this is an automatic tunnel */ 943 (void) ip_plen_to_mask_v6(IPV6_ABITS - IP_ABITS, 944 &ipif->ipif_v6net_mask); 945 bzero(&sin6, sizeof (sin6_t)); 946 sin = (sin_t *)&ta->ifta_saddr; 947 V4_PART_OF_V6(sin6.sin6_addr) = sin->sin_addr.s_addr; 948 sin6.sin6_family = AF_INET6; 949 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 950 NULL, NULL, NULL, NULL); 951 } else if (tp->tun_flags & TUN_6TO4) { 952 /* this is a 6to4 tunnel */ 953 (void) ip_plen_to_mask_v6(IPV6_PREFIX_LEN, 954 &ipif->ipif_v6net_mask); 955 sin = (sin_t *)&ta->ifta_saddr; 956 /* create a 6to4 address from the IPv4 tsrc */ 957 IN6_V4ADDR_TO_6TO4(&sin->sin_addr, &sin6.sin6_addr); 958 sin6.sin6_family = AF_INET6; 959 (void) ip_sioctl_addr(ipif, (sin_t *)&sin6, 960 NULL, NULL, NULL, NULL); 961 } else { 962 ip1dbg(("ipif_set_tun_auto_addr: Unknown tunnel type")); 963 return; 964 } 965 } 966 967 /* 968 * Set link local for ipif_id 0 of a configured tunnel based on the 969 * tsrc or tdst parameter 970 * For tunnels over IPv4 use the IPv4 address prepended with 32 zeros as 971 * the token. 972 * For tunnels over IPv6 use the low-order 64 bits of the "inner" IPv6 address 973 * as the token for the "outer" link. 974 */ 975 void 976 ipif_set_tun_llink(ill_t *ill, struct iftun_req *ta) 977 { 978 ipif_t *ipif; 979 sin_t *sin; 980 in6_addr_t *s6addr; 981 982 ASSERT(IAM_WRITER_ILL(ill)); 983 984 /* The first ipif must be id zero. */ 985 ipif = ill->ill_ipif; 986 ASSERT(ipif->ipif_id == 0); 987 988 /* no link local for automatic tunnels */ 989 if (!(ipif->ipif_flags & IPIF_POINTOPOINT)) { 990 ipif_set_tun_auto_addr(ipif, ta); 991 return; 992 } 993 994 if ((ta->ifta_flags & IFTUN_DST) && 995 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) { 996 sin6_t sin6; 997 998 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 999 bzero(&sin6, sizeof (sin6_t)); 1000 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1001 sin = (sin_t *)&ta->ifta_daddr; 1002 V4_PART_OF_V6(sin6.sin6_addr) = 1003 sin->sin_addr.s_addr; 1004 } else { 1005 s6addr = 1006 &((sin6_t *)&ta->ifta_daddr)->sin6_addr; 1007 sin6.sin6_addr.s6_addr32[3] = s6addr->s6_addr32[3]; 1008 sin6.sin6_addr.s6_addr32[2] = s6addr->s6_addr32[2]; 1009 } 1010 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, 1011 &sin6.sin6_addr); 1012 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr; 1013 } 1014 if ((ta->ifta_flags & IFTUN_SRC)) { 1015 ASSERT(!(ipif->ipif_flags & IPIF_UP)); 1016 1017 /* Set the token if it isn't already set */ 1018 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token)) { 1019 if ((ta->ifta_saddr.ss_family == AF_INET)) { 1020 sin = (sin_t *)&ta->ifta_saddr; 1021 V4_PART_OF_V6(ill->ill_token) = 1022 sin->sin_addr.s_addr; 1023 } else { 1024 s6addr = 1025 &((sin6_t *)&ta->ifta_saddr)->sin6_addr; 1026 ill->ill_token.s6_addr32[3] = 1027 s6addr->s6_addr32[3]; 1028 ill->ill_token.s6_addr32[2] = 1029 s6addr->s6_addr32[2]; 1030 } 1031 ill->ill_token_length = IPV6_TOKEN_LEN; 1032 } 1033 /* 1034 * Attempt to set the link local address if it isn't set. 1035 */ 1036 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) 1037 (void) ipif_setlinklocal(ipif); 1038 } 1039 } 1040 1041 /* 1042 * Is it not possible to set the link local address? 1043 * The address can be set if the token is set, and the token 1044 * isn't too long. 1045 * Return B_TRUE if the address can't be set, or B_FALSE if it can. 1046 */ 1047 boolean_t 1048 ipif_cant_setlinklocal(ipif_t *ipif) 1049 { 1050 ill_t *ill = ipif->ipif_ill; 1051 1052 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) || 1053 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN) 1054 return (B_TRUE); 1055 1056 return (B_FALSE); 1057 } 1058 1059 /* 1060 * Generate a link-local address from the token. 1061 * Return zero if the address was set, or non-zero if it couldn't be set. 1062 */ 1063 int 1064 ipif_setlinklocal(ipif_t *ipif) 1065 { 1066 ill_t *ill = ipif->ipif_ill; 1067 1068 ASSERT(IAM_WRITER_ILL(ill)); 1069 1070 if (ipif_cant_setlinklocal(ipif)) 1071 return (-1); 1072 1073 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token); 1074 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask); 1075 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask, 1076 ipif->ipif_v6subnet); 1077 1078 if (ipif->ipif_flags & IPIF_NOLOCAL) { 1079 ipif->ipif_v6src_addr = ipv6_all_zeros; 1080 } else { 1081 ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr; 1082 } 1083 return (0); 1084 } 1085 1086 /* 1087 * This function sets up the multicast mappings in NDP. 1088 * Unlike ARP, there are no mapping_mps here. We delete the 1089 * mapping nces and add a new one. 1090 * 1091 * Returns non-zero on error and 0 on success. 1092 */ 1093 int 1094 ipif_ndp_setup_multicast(ipif_t *ipif, nce_t **ret_nce) 1095 { 1096 ill_t *ill = ipif->ipif_ill; 1097 in6_addr_t v6_mcast_addr = {(uint32_t)V6_MCAST, 0, 0, 0}; 1098 in6_addr_t v6_mcast_mask = {(uint32_t)V6_MCAST, 0, 0, 0}; 1099 in6_addr_t v6_extract_mask; 1100 uchar_t *phys_addr, *bphys_addr, *alloc_phys; 1101 nce_t *mnce = NULL; 1102 int err = 0; 1103 phyint_t *phyi = ill->ill_phyint; 1104 uint32_t hw_extract_start; 1105 dl_unitdata_req_t *dlur; 1106 1107 if (ret_nce != NULL) 1108 *ret_nce = NULL; 1109 /* 1110 * Delete the mapping nce. Normally these should not exist 1111 * as a previous ipif_down -> ipif_ndp_down should have deleted 1112 * all the nces. But they can exist if ip_rput_dlpi_writer 1113 * calls this when PHYI_MULTI_BCAST is set. 1114 */ 1115 mnce = ndp_lookup(ill, &v6_mcast_addr, B_FALSE); 1116 if (mnce != NULL) { 1117 ndp_delete(mnce); 1118 NCE_REFRELE(mnce); 1119 mnce = NULL; 1120 } 1121 1122 /* 1123 * Get media specific v6 mapping information. Note that 1124 * nd_lla_len can be 0 for tunnels. 1125 */ 1126 alloc_phys = kmem_alloc(ill->ill_nd_lla_len, KM_NOSLEEP); 1127 if ((alloc_phys == NULL) && (ill->ill_nd_lla_len != 0)) 1128 return (ENOMEM); 1129 /* 1130 * Determine the broadcast address. 1131 */ 1132 dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr; 1133 if (ill->ill_sap_length < 0) 1134 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset; 1135 else 1136 bphys_addr = (uchar_t *)dlur + 1137 dlur->dl_dest_addr_offset + ill->ill_sap_length; 1138 1139 /* 1140 * Check PHYI_MULTI_BCAST and possible length of physical 1141 * address to determine if we use the mapping or the 1142 * broadcast address. 1143 */ 1144 if ((phyi->phyint_flags & PHYI_MULTI_BCAST) || 1145 (!MEDIA_V6MINFO(ill->ill_media, ill->ill_nd_lla_len, 1146 bphys_addr, alloc_phys, &hw_extract_start, 1147 &v6_extract_mask))) { 1148 if (ill->ill_phys_addr_length > IP_MAX_HW_LEN) { 1149 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1150 return (E2BIG); 1151 } 1152 /* Use the link-layer broadcast address for MULTI_BCAST */ 1153 phys_addr = bphys_addr; 1154 bzero(&v6_extract_mask, sizeof (v6_extract_mask)); 1155 hw_extract_start = ill->ill_nd_lla_len; 1156 } else { 1157 phys_addr = alloc_phys; 1158 } 1159 if ((ipif->ipif_flags & IPIF_BROADCAST) || 1160 (ill->ill_flags & ILLF_MULTICAST) || 1161 (phyi->phyint_flags & PHYI_MULTI_BCAST)) { 1162 mutex_enter(&ndp_g_lock); 1163 err = ndp_add(ill, 1164 phys_addr, 1165 &v6_mcast_addr, /* v6 address */ 1166 &v6_mcast_mask, /* v6 mask */ 1167 &v6_extract_mask, 1168 hw_extract_start, 1169 NCE_F_MAPPING | NCE_F_PERMANENT | NCE_F_NONUD, 1170 ND_REACHABLE, 1171 &mnce); 1172 mutex_exit(&ndp_g_lock); 1173 if (err == 0) { 1174 if (ret_nce != NULL) { 1175 *ret_nce = mnce; 1176 } else { 1177 NCE_REFRELE(mnce); 1178 } 1179 } 1180 } 1181 kmem_free(alloc_phys, ill->ill_nd_lla_len); 1182 return (err); 1183 } 1184 1185 /* 1186 * Get the resolver set up for a new interface address. (Always called 1187 * as writer.) 1188 */ 1189 int 1190 ipif_ndp_up(ipif_t *ipif, const in6_addr_t *addr, boolean_t macaddr_change) 1191 { 1192 ill_t *ill = ipif->ipif_ill; 1193 int err = 0; 1194 nce_t *nce = NULL; 1195 nce_t *mnce = NULL; 1196 1197 ip1dbg(("ipif_ndp_up(%s:%u)\n", 1198 ipif->ipif_ill->ill_name, ipif->ipif_id)); 1199 1200 /* 1201 * ND not supported on XRESOLV interfaces. If ND support (multicast) 1202 * added later, take out this check. 1203 */ 1204 if (ill->ill_flags & ILLF_XRESOLV) 1205 return (0); 1206 1207 if (IN6_IS_ADDR_UNSPECIFIED(addr) || 1208 (!(ill->ill_net_type & IRE_INTERFACE))) 1209 return (0); 1210 1211 /* 1212 * Need to setup multicast mapping only when the first 1213 * interface is coming UP. 1214 */ 1215 if (ill->ill_ipif_up_count == 0 && 1216 (ill->ill_flags & ILLF_MULTICAST)) { 1217 /* 1218 * We set the multicast before setting up the mapping for 1219 * local address because ipif_ndp_setup_multicast does 1220 * ndp_walk to delete nces which will delete the mapping 1221 * for local address also if we added the mapping for 1222 * local address first. 1223 */ 1224 err = ipif_ndp_setup_multicast(ipif, &mnce); 1225 if (err != 0) 1226 return (err); 1227 } 1228 1229 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) { 1230 uint16_t flags; 1231 uchar_t *hw_addr = NULL; 1232 1233 /* Permanent entries don't need NUD */ 1234 flags = NCE_F_PERMANENT; 1235 flags |= NCE_F_NONUD; 1236 if (ill->ill_flags & ILLF_ROUTER) 1237 flags |= NCE_F_ISROUTER; 1238 1239 if (ipif->ipif_flags & IPIF_ANYCAST) 1240 flags |= NCE_F_ANYCAST; 1241 1242 if (ill->ill_net_type == IRE_IF_RESOLVER) { 1243 hw_addr = ill->ill_nd_lla; 1244 1245 if (ill->ill_move_in_progress || macaddr_change) { 1246 /* 1247 * Addresses are failing over to this ill. 1248 * Don't wait for NUD to see this change. 1249 * Publish our new link-layer address. 1250 */ 1251 flags |= NCE_F_UNSOL_ADV; 1252 } 1253 } 1254 err = ndp_lookup_then_add(ill, 1255 hw_addr, 1256 addr, 1257 &ipv6_all_ones, 1258 &ipv6_all_zeros, 1259 0, 1260 flags, 1261 ND_REACHABLE, 1262 &nce); 1263 switch (err) { 1264 case 0: 1265 ip1dbg(("ipif_ndp_up: NCE created for %s\n", 1266 ill->ill_name)); 1267 break; 1268 case EEXIST: 1269 NCE_REFRELE(nce); 1270 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n", 1271 ill->ill_name)); 1272 if (mnce != NULL) { 1273 ndp_delete(mnce); 1274 NCE_REFRELE(mnce); 1275 } 1276 return (err); 1277 default: 1278 ip1dbg(("ipif_ndp_up: NCE creation failed %s\n", 1279 ill->ill_name)); 1280 if (mnce != NULL) { 1281 ndp_delete(mnce); 1282 NCE_REFRELE(mnce); 1283 } 1284 return (err); 1285 } 1286 } 1287 if (nce != NULL) 1288 NCE_REFRELE(nce); 1289 if (mnce != NULL) 1290 NCE_REFRELE(mnce); 1291 return (0); 1292 } 1293 1294 /* Remove all cache entries for this logical interface */ 1295 void 1296 ipif_ndp_down(ipif_t *ipif) 1297 { 1298 nce_t *nce; 1299 1300 nce = ndp_lookup(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, B_FALSE); 1301 if (nce != NULL) { 1302 ndp_delete(nce); 1303 NCE_REFRELE(nce); 1304 } 1305 /* 1306 * Remove mapping and all other nces dependent on this ill 1307 * when the last ipif is going away. 1308 */ 1309 if (ipif->ipif_ill->ill_ipif_up_count == 0) { 1310 ndp_walk(ipif->ipif_ill, (pfi_t)ndp_delete_per_ill, 1311 (uchar_t *)ipif->ipif_ill); 1312 } 1313 } 1314 1315 /* 1316 * Used when an interface comes up to recreate any extra routes on this 1317 * interface. 1318 */ 1319 static ire_t ** 1320 ipif_recover_ire_v6(ipif_t *ipif) 1321 { 1322 mblk_t *mp; 1323 ire_t **ipif_saved_irep; 1324 ire_t **irep; 1325 1326 ip1dbg(("ipif_recover_ire_v6(%s:%u)", ipif->ipif_ill->ill_name, 1327 ipif->ipif_id)); 1328 1329 ASSERT(ipif->ipif_isv6); 1330 1331 mutex_enter(&ipif->ipif_saved_ire_lock); 1332 ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) * 1333 ipif->ipif_saved_ire_cnt, KM_NOSLEEP); 1334 if (ipif_saved_irep == NULL) { 1335 mutex_exit(&ipif->ipif_saved_ire_lock); 1336 return (NULL); 1337 } 1338 1339 irep = ipif_saved_irep; 1340 1341 for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) { 1342 ire_t *ire; 1343 queue_t *rfq; 1344 queue_t *stq; 1345 ifrt_t *ifrt; 1346 in6_addr_t *src_addr; 1347 in6_addr_t *gateway_addr; 1348 mblk_t *resolver_mp; 1349 char buf[INET6_ADDRSTRLEN]; 1350 ushort_t type; 1351 1352 /* 1353 * When the ire was initially created and then added in 1354 * ip_rt_add_v6(), it was created either using 1355 * ipif->ipif_net_type in the case of a traditional interface 1356 * route, or as one of the IRE_OFFSUBNET types (with the 1357 * exception of IRE_HOST_REDIRECT which is created by 1358 * icmp_redirect_v6() and which we don't need to save or 1359 * recover). In the case where ipif->ipif_net_type was 1360 * IRE_LOOPBACK, ip_rt_add_v6() will update the ire_type to 1361 * IRE_IF_NORESOLVER before calling ire_add_v6() to satisfy 1362 * software like GateD and Sun Cluster which creates routes 1363 * using the the loopback interface's address as a gateway. 1364 * 1365 * As ifrt->ifrt_type reflects the already updated ire_type and 1366 * since ire_create_v6() expects that IRE_IF_NORESOLVER will 1367 * have a valid ire_dlureq_mp field (which doesn't make sense 1368 * for a IRE_LOOPBACK), ire_create_v6() will be called in the 1369 * same way here as in ip_rt_add_v6(), namely using 1370 * ipif->ipif_net_type when the route looks like a traditional 1371 * interface route (where ifrt->ifrt_type & IRE_INTERFACE is 1372 * true) and otherwise using the saved ifrt->ifrt_type. This 1373 * means that in the case where ipif->ipif_net_type is 1374 * IRE_LOOPBACK, the ire created by ire_create_v6() will be an 1375 * IRE_LOOPBACK, it will then be turned into an 1376 * IRE_IF_NORESOLVER and then added by ire_add_v6(). 1377 */ 1378 ifrt = (ifrt_t *)mp->b_rptr; 1379 if (ifrt->ifrt_type & IRE_INTERFACE) { 1380 rfq = NULL; 1381 stq = (ipif->ipif_net_type == IRE_IF_RESOLVER) 1382 ? ipif->ipif_rq : ipif->ipif_wq; 1383 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1384 ? &ifrt->ifrt_v6src_addr 1385 : &ipif->ipif_v6src_addr; 1386 gateway_addr = NULL; 1387 resolver_mp = ipif->ipif_resolver_mp; 1388 type = ipif->ipif_net_type; 1389 } else { 1390 rfq = NULL; 1391 stq = NULL; 1392 src_addr = (ifrt->ifrt_flags & RTF_SETSRC) 1393 ? &ifrt->ifrt_v6src_addr : NULL; 1394 gateway_addr = &ifrt->ifrt_v6gateway_addr; 1395 resolver_mp = NULL; 1396 type = ifrt->ifrt_type; 1397 } 1398 1399 /* 1400 * Create a copy of the IRE with the saved address and netmask. 1401 */ 1402 ip1dbg(("ipif_recover_ire_v6: creating IRE %s (%d) for %s/%d\n", 1403 ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type, 1404 inet_ntop(AF_INET6, &ifrt->ifrt_v6addr, buf, sizeof (buf)), 1405 ip_mask_to_plen_v6(&ifrt->ifrt_v6mask))); 1406 ire = ire_create_v6( 1407 &ifrt->ifrt_v6addr, 1408 &ifrt->ifrt_v6mask, 1409 src_addr, 1410 gateway_addr, 1411 &ifrt->ifrt_max_frag, 1412 NULL, 1413 rfq, 1414 stq, 1415 type, 1416 resolver_mp, 1417 ipif, 1418 NULL, 1419 0, 1420 0, 1421 ifrt->ifrt_flags, 1422 &ifrt->ifrt_iulp_info); 1423 if (ire == NULL) { 1424 mutex_exit(&ipif->ipif_saved_ire_lock); 1425 kmem_free(ipif_saved_irep, 1426 ipif->ipif_saved_ire_cnt * sizeof (ire_t *)); 1427 return (NULL); 1428 } 1429 1430 /* 1431 * Some software (for example, GateD and Sun Cluster) attempts 1432 * to create (what amount to) IRE_PREFIX routes with the 1433 * loopback address as the gateway. This is primarily done to 1434 * set up prefixes with the RTF_REJECT flag set (for example, 1435 * when generating aggregate routes.) 1436 * 1437 * If the IRE type (as defined by ipif->ipif_net_type) is 1438 * IRE_LOOPBACK, then we map the request into a 1439 * IRE_IF_NORESOLVER. 1440 */ 1441 if (ipif->ipif_net_type == IRE_LOOPBACK) 1442 ire->ire_type = IRE_IF_NORESOLVER; 1443 /* 1444 * ire held by ire_add, will be refreled' in ipif_up_done 1445 * towards the end 1446 */ 1447 (void) ire_add(&ire, NULL, NULL, NULL); 1448 *irep = ire; 1449 irep++; 1450 ip1dbg(("ipif_recover_ire_v6: added ire %p\n", (void *)ire)); 1451 } 1452 mutex_exit(&ipif->ipif_saved_ire_lock); 1453 return (ipif_saved_irep); 1454 } 1455 1456 /* 1457 * Return the scope of the given IPv6 address. If the address is an 1458 * IPv4 mapped IPv6 address, return the scope of the corresponding 1459 * IPv4 address. 1460 */ 1461 in6addr_scope_t 1462 ip_addr_scope_v6(const in6_addr_t *addr) 1463 { 1464 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT; 1465 1466 if (IN6_IS_ADDR_V4MAPPED(addr)) { 1467 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr))); 1468 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET || 1469 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET) 1470 return (IP6_SCOPE_LINKLOCAL); 1471 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET || 1472 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET || 1473 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET) 1474 return (IP6_SCOPE_SITELOCAL); 1475 return (IP6_SCOPE_GLOBAL); 1476 } 1477 1478 if (IN6_IS_ADDR_MULTICAST(addr)) 1479 return (IN6_ADDR_MC_SCOPE(addr)); 1480 1481 /* link-local and loopback addresses are of link-local scope */ 1482 if (IN6_IS_ADDR_LINKLOCAL(addr) || 1483 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback)) 1484 return (IP6_SCOPE_LINKLOCAL); 1485 if (IN6_IS_ADDR_SITELOCAL(addr)) 1486 return (IP6_SCOPE_SITELOCAL); 1487 return (IP6_SCOPE_GLOBAL); 1488 } 1489 1490 1491 /* 1492 * Calculates the xor of a1 and a2, and stores the result in res. 1493 */ 1494 static void 1495 ip_addr_xor_v6(const in6_addr_t *a1, const in6_addr_t *a2, in6_addr_t *res) 1496 { 1497 int i; 1498 1499 for (i = 0; i < 4; i++) 1500 res->s6_addr32[i] = a1->s6_addr32[i] ^ a2->s6_addr32[i]; 1501 } 1502 1503 #define IPIF_VALID_IPV6_SOURCE(ipif) \ 1504 (((ipif)->ipif_flags & IPIF_UP) && \ 1505 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))) 1506 1507 /* source address candidate */ 1508 typedef struct candidate { 1509 ipif_t *cand_ipif; 1510 /* The properties of this candidate */ 1511 boolean_t cand_isdst; 1512 boolean_t cand_isdst_set; 1513 in6addr_scope_t cand_scope; 1514 boolean_t cand_scope_set; 1515 boolean_t cand_isdeprecated; 1516 boolean_t cand_isdeprecated_set; 1517 boolean_t cand_ispreferred; 1518 boolean_t cand_ispreferred_set; 1519 boolean_t cand_matchedinterface; 1520 boolean_t cand_matchedinterface_set; 1521 boolean_t cand_matchedlabel; 1522 boolean_t cand_matchedlabel_set; 1523 boolean_t cand_istmp; 1524 boolean_t cand_istmp_set; 1525 in6_addr_t cand_xor; 1526 boolean_t cand_xor_set; 1527 } cand_t; 1528 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr 1529 #define cand_flags cand_ipif->ipif_flags 1530 #define cand_ill cand_ipif->ipif_ill 1531 1532 /* information about the destination for source address selection */ 1533 typedef struct dstinfo { 1534 const in6_addr_t *dst_addr; 1535 ill_t *dst_ill; 1536 boolean_t dst_restrict_ill; 1537 boolean_t dst_prefer_src_tmp; 1538 in6addr_scope_t dst_scope; 1539 char *dst_label; 1540 } dstinfo_t; 1541 1542 /* 1543 * The following functions are rules used to select a source address in 1544 * ipif_select_source_v6(). Each rule compares a current candidate (cc) 1545 * against the best candidate (bc). Each rule has three possible outcomes; 1546 * the candidate is preferred over the best candidate (CAND_PREFER), the 1547 * candidate is not preferred over the best candidate (CAND_AVOID), or the 1548 * candidate is of equal value as the best candidate (CAND_TIE). 1549 * 1550 * These rules are part of a greater "Default Address Selection for IPv6" 1551 * sheme, which is standards based work coming out of the IETF ipv6 working 1552 * group. The IETF document defines both IPv6 source address selection and 1553 * destination address ordering. The rules defined here implement the IPv6 1554 * source address selection. Destination address ordering is done by 1555 * libnsl, and uses a similar set of rules to implement the sorting. 1556 */ 1557 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t; 1558 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *); 1559 1560 /* Prefer an address if it is equal to the destination address. */ 1561 static rule_res_t 1562 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1563 { 1564 if (!bc->cand_isdst_set) { 1565 bc->cand_isdst = 1566 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr); 1567 bc->cand_isdst_set = B_TRUE; 1568 } 1569 1570 cc->cand_isdst = 1571 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr); 1572 cc->cand_isdst_set = B_TRUE; 1573 1574 if (cc->cand_isdst == bc->cand_isdst) 1575 return (CAND_TIE); 1576 else if (cc->cand_isdst) 1577 return (CAND_PREFER); 1578 else 1579 return (CAND_AVOID); 1580 } 1581 1582 /* 1583 * Prefer addresses that are of closest scope to the destination. Always 1584 * prefer addresses that are of greater scope than the destination over 1585 * those that are of lesser scope than the destination. 1586 */ 1587 static rule_res_t 1588 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1589 { 1590 if (!bc->cand_scope_set) { 1591 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr); 1592 bc->cand_scope_set = B_TRUE; 1593 } 1594 1595 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr); 1596 cc->cand_scope_set = B_TRUE; 1597 1598 if (cc->cand_scope < bc->cand_scope) { 1599 if (cc->cand_scope < dstinfo->dst_scope) 1600 return (CAND_AVOID); 1601 else 1602 return (CAND_PREFER); 1603 } else if (bc->cand_scope < cc->cand_scope) { 1604 if (bc->cand_scope < dstinfo->dst_scope) 1605 return (CAND_PREFER); 1606 else 1607 return (CAND_AVOID); 1608 } else { 1609 return (CAND_TIE); 1610 } 1611 } 1612 1613 /* 1614 * Prefer non-deprecated source addresses. 1615 */ 1616 /* ARGSUSED2 */ 1617 static rule_res_t 1618 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1619 { 1620 if (!bc->cand_isdeprecated_set) { 1621 bc->cand_isdeprecated = 1622 ((bc->cand_flags & IPIF_DEPRECATED) != 0); 1623 bc->cand_isdeprecated_set = B_TRUE; 1624 } 1625 1626 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0); 1627 cc->cand_isdeprecated_set = B_TRUE; 1628 1629 if (bc->cand_isdeprecated == cc->cand_isdeprecated) 1630 return (CAND_TIE); 1631 else if (cc->cand_isdeprecated) 1632 return (CAND_AVOID); 1633 else 1634 return (CAND_PREFER); 1635 } 1636 1637 /* 1638 * Prefer source addresses that have the IPIF_PREFERRED flag set. This 1639 * rule must be before rule_interface because the flag could be set on any 1640 * interface, not just the interface being used for outgoing packets (for 1641 * example, the IFF_PREFERRED could be set on an address assigned to the 1642 * loopback interface). 1643 */ 1644 /* ARGSUSED2 */ 1645 static rule_res_t 1646 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1647 { 1648 if (!bc->cand_ispreferred_set) { 1649 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0); 1650 bc->cand_ispreferred_set = B_TRUE; 1651 } 1652 1653 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0); 1654 cc->cand_ispreferred_set = B_TRUE; 1655 1656 if (bc->cand_ispreferred == cc->cand_ispreferred) 1657 return (CAND_TIE); 1658 else if (cc->cand_ispreferred) 1659 return (CAND_PREFER); 1660 else 1661 return (CAND_AVOID); 1662 } 1663 1664 /* 1665 * Prefer source addresses that are assigned to the outgoing interface, or 1666 * to an interface that is in the same IPMP group as the outgoing 1667 * interface. 1668 */ 1669 static rule_res_t 1670 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1671 { 1672 ill_t *dstill = dstinfo->dst_ill; 1673 1674 /* 1675 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary 1676 * since we know all candidates will be on the same link. 1677 */ 1678 if (dstinfo->dst_restrict_ill) 1679 return (CAND_TIE); 1680 1681 if (!bc->cand_matchedinterface_set) { 1682 bc->cand_matchedinterface = (bc->cand_ill == dstill || 1683 (dstill->ill_group != NULL && 1684 dstill->ill_group == bc->cand_ill->ill_group)); 1685 bc->cand_matchedinterface_set = B_TRUE; 1686 } 1687 1688 cc->cand_matchedinterface = (cc->cand_ill == dstill || 1689 (dstill->ill_group != NULL && 1690 dstill->ill_group == cc->cand_ill->ill_group)); 1691 cc->cand_matchedinterface_set = B_TRUE; 1692 1693 if (bc->cand_matchedinterface == cc->cand_matchedinterface) 1694 return (CAND_TIE); 1695 else if (cc->cand_matchedinterface) 1696 return (CAND_PREFER); 1697 else 1698 return (CAND_AVOID); 1699 } 1700 1701 /* 1702 * Prefer source addresses whose label matches the destination's label. 1703 */ 1704 static rule_res_t 1705 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1706 { 1707 char *label; 1708 1709 if (!bc->cand_matchedlabel_set) { 1710 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL); 1711 bc->cand_matchedlabel = 1712 ip6_asp_labelcmp(label, dstinfo->dst_label); 1713 bc->cand_matchedlabel_set = B_TRUE; 1714 } 1715 1716 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL); 1717 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label); 1718 cc->cand_matchedlabel_set = B_TRUE; 1719 1720 if (bc->cand_matchedlabel == cc->cand_matchedlabel) 1721 return (CAND_TIE); 1722 else if (cc->cand_matchedlabel) 1723 return (CAND_PREFER); 1724 else 1725 return (CAND_AVOID); 1726 } 1727 1728 /* 1729 * Prefer public addresses over temporary ones. An application can reverse 1730 * the logic of this rule and prefer temporary addresses by using the 1731 * IPV6_SRC_PREFERENCES socket option. 1732 */ 1733 static rule_res_t 1734 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1735 { 1736 if (!bc->cand_istmp_set) { 1737 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0); 1738 bc->cand_istmp_set = B_TRUE; 1739 } 1740 1741 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0); 1742 cc->cand_istmp_set = B_TRUE; 1743 1744 if (bc->cand_istmp == cc->cand_istmp) 1745 return (CAND_TIE); 1746 1747 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp) 1748 return (CAND_PREFER); 1749 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp) 1750 return (CAND_PREFER); 1751 else 1752 return (CAND_AVOID); 1753 } 1754 1755 /* 1756 * Prefer source addresses with longer matching prefix with the 1757 * destination. Since this is the last rule, it must not produce a tie. 1758 * We do the longest matching prefix calculation and the tie break in one 1759 * calculation by doing an xor of both addresses with the destination, and 1760 * pick the address with the smallest xor value. That way, we're both 1761 * picking the address with the longest matching prefix, and breaking the 1762 * tie if they happen to have both have equal mathing prefixes. 1763 */ 1764 static rule_res_t 1765 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo) 1766 { 1767 int i; 1768 1769 if (!bc->cand_xor_set) { 1770 ip_addr_xor_v6(&bc->cand_srcaddr, 1771 dstinfo->dst_addr, &bc->cand_xor); 1772 bc->cand_xor_set = B_TRUE; 1773 } 1774 1775 ip_addr_xor_v6(&cc->cand_srcaddr, dstinfo->dst_addr, &cc->cand_xor); 1776 cc->cand_xor_set = B_TRUE; 1777 1778 for (i = 0; i < 4; i++) { 1779 if (bc->cand_xor.s6_addr32[i] != cc->cand_xor.s6_addr32[i]) 1780 break; 1781 } 1782 1783 if (cc->cand_xor.s6_addr32[i] < bc->cand_xor.s6_addr32[i]) 1784 return (CAND_PREFER); 1785 else 1786 return (CAND_AVOID); 1787 } 1788 1789 /* 1790 * Determine the best source address given a destination address and a 1791 * destination ill. If no suitable source address is found, it returns 1792 * NULL. If there is a usable address pointed to by the usesrc 1793 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more 1794 * fine grained (i.e per interface) 1795 * 1796 * This implementation is based on the "Default Address Selection for IPv6" 1797 * specification produced by the IETF IPv6 working group. It has been 1798 * implemented so that the list of addresses is only traversed once (the 1799 * specification's algorithm could traverse the list of addresses once for 1800 * every rule). 1801 * 1802 * The restrict_ill argument restricts the algorithm to chose a source 1803 * address that is assigned to the destination ill or an ill in the same 1804 * IPMP group as the destination ill. This is used when the destination 1805 * address is a link-local or multicast address, and when 1806 * ipv6_strict_dst_multihoming is turned on. 1807 * 1808 * src_prefs is the caller's set of source address preferences. If source 1809 * address selection is being called to determine the source address of a 1810 * connected socket (from ip_bind_connected_v6()), then the preferences are 1811 * taken from conn_src_preferences. These preferences can be set on a 1812 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only 1813 * preference currently implemented is for rfc3041 temporary addresses. 1814 */ 1815 ipif_t * 1816 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst, 1817 boolean_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid) 1818 { 1819 dstinfo_t dstinfo; 1820 char dstr[INET6_ADDRSTRLEN]; 1821 char sstr[INET6_ADDRSTRLEN]; 1822 ipif_t *ipif; 1823 ill_t *ill, *usesrc_ill = NULL; 1824 ill_walk_context_t ctx; 1825 cand_t best_c; /* The best candidate */ 1826 cand_t curr_c; /* The current candidate */ 1827 uint_t index; 1828 boolean_t first_candidate = B_TRUE; 1829 rule_res_t rule_result; 1830 phyint_t *phyi; 1831 1832 /* 1833 * The list of ordering rules. They are applied in the order they 1834 * appear in the list. 1835 * 1836 * XXX rule_mipv6 will need to be implemented (the specification's 1837 * rules 4) if a mobile IPv6 node is ever implemented. 1838 */ 1839 rulef_t rules[] = { 1840 rule_isdst, 1841 rule_scope, 1842 rule_deprecated, 1843 rule_preferred, 1844 rule_interface, 1845 rule_label, 1846 rule_temporary, 1847 rule_prefix, 1848 NULL 1849 }; 1850 1851 ASSERT(dstill->ill_isv6); 1852 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst)); 1853 1854 /* 1855 * Check if there is a usable src address pointed to by the 1856 * usesrc ifindex. This has higher precedence since it is 1857 * finer grained (i.e per interface) v/s being system wide. 1858 */ 1859 if (dstill->ill_usesrc_ifindex != 0) { 1860 if ((usesrc_ill = 1861 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE, 1862 NULL, NULL, NULL, NULL)) != NULL) { 1863 dstinfo.dst_ill = usesrc_ill; 1864 } else { 1865 return (NULL); 1866 } 1867 } else { 1868 dstinfo.dst_ill = dstill; 1869 } 1870 1871 dstinfo.dst_addr = dst; 1872 dstinfo.dst_scope = ip_addr_scope_v6(dst); 1873 dstinfo.dst_label = ip6_asp_lookup(dst, NULL); 1874 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0); 1875 1876 rw_enter(&ill_g_lock, RW_READER); 1877 /* 1878 * Section three of the I-D states that for multicast and 1879 * link-local destinations, the candidate set must be restricted to 1880 * an interface that is on the same link as the outgoing interface. 1881 * Also, when ipv6_strict_dst_multihoming is turned on, always 1882 * restrict the source address to the destination link as doing 1883 * otherwise will almost certainly cause problems. 1884 */ 1885 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) || 1886 ipv6_strict_dst_multihoming || usesrc_ill != NULL) 1887 dstinfo.dst_restrict_ill = B_TRUE; 1888 else 1889 dstinfo.dst_restrict_ill = restrict_ill; 1890 1891 bzero(&best_c, sizeof (cand_t)); 1892 1893 /* 1894 * Take a pass through the list of IPv6 interfaces to chose the 1895 * best possible source address. If restrict_ill is true, we only 1896 * iterate through the ill's that are in the same IPMP group as the 1897 * destination's outgoing ill. If restrict_ill is false, we walk 1898 * the entire list of IPv6 ill's. 1899 */ 1900 if (dstinfo.dst_restrict_ill) { 1901 if (dstinfo.dst_ill->ill_group != NULL) { 1902 /* 1903 * Try to avoid FAILED/OFFLINE ills. Global and 1904 * site local addresses will failover and are not 1905 * an issue even if we select them. (i.e. this is 1906 * a race where we hit this path before in.mpathd 1907 * moves them. But link local addresses don't move. 1908 * This creates a problem for NUD. If NUD ends up 1909 * (nce_xmit) using the src addr from a failed 1910 * interface NUD will fail and end up deleting the nce 1911 * This will cause performance issues where ires 1912 * are frequently created and deleted every few secs. 1913 */ 1914 for (ill = dstinfo.dst_ill->ill_group->illgrp_ill; 1915 ill != NULL; ill = ill->ill_group_next) { 1916 phyi = ill->ill_phyint; 1917 if (!(phyi->phyint_flags & 1918 (PHYI_OFFLINE | PHYI_FAILED))) 1919 break; 1920 } 1921 if (ill == NULL) 1922 ill = dstinfo.dst_ill->ill_group->illgrp_ill; 1923 } else { 1924 ill = dstinfo.dst_ill; 1925 } 1926 } else { 1927 ill = ILL_START_WALK_V6(&ctx); 1928 } 1929 1930 while (ill != NULL) { 1931 ASSERT(ill->ill_isv6); 1932 1933 for (ipif = ill->ill_ipif; ipif != NULL; 1934 ipif = ipif->ipif_next) { 1935 1936 if (!IPIF_VALID_IPV6_SOURCE(ipif)) 1937 continue; 1938 1939 if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid) 1940 continue; 1941 1942 if (first_candidate) { 1943 /* 1944 * This is first valid address in the list. 1945 * It is automatically the best candidate 1946 * so far. 1947 */ 1948 best_c.cand_ipif = ipif; 1949 first_candidate = B_FALSE; 1950 continue; 1951 } 1952 1953 bzero(&curr_c, sizeof (cand_t)); 1954 curr_c.cand_ipif = ipif; 1955 1956 /* 1957 * Compare this current candidate (curr_c) with the 1958 * best candidate (best_c) by applying the 1959 * comparison rules in order until one breaks the 1960 * tie. 1961 */ 1962 for (index = 0; rules[index] != NULL; index++) { 1963 /* Apply a comparison rule. */ 1964 rule_result = 1965 (rules[index])(&best_c, &curr_c, &dstinfo); 1966 if (rule_result == CAND_AVOID) { 1967 /* 1968 * The best candidate is still the 1969 * best candidate. Forget about 1970 * this current candidate and go on 1971 * to the next one. 1972 */ 1973 break; 1974 } else if (rule_result == CAND_PREFER) { 1975 /* 1976 * This candidate is prefered. It 1977 * becomes the best candidate so 1978 * far. Go on to the next address. 1979 */ 1980 best_c = curr_c; 1981 break; 1982 } 1983 /* We have a tie, apply the next rule. */ 1984 } 1985 1986 /* 1987 * The last rule must be a tie breaker rule and 1988 * must never produce a tie. At this point, the 1989 * candidate should have either been rejected, or 1990 * have been prefered as the best candidate so far. 1991 */ 1992 ASSERT(rule_result != CAND_TIE); 1993 } 1994 1995 /* 1996 * We may be walking the linked-list of ill's in an 1997 * IPMP group or traversing the IPv6 ill avl tree. If it is a 1998 * usesrc ILL then it can't be part of IPMP group and we 1999 * will exit the while loop. 2000 */ 2001 if (dstinfo.dst_restrict_ill) 2002 ill = ill->ill_group_next; 2003 else 2004 ill = ill_next(&ctx, ill); 2005 } 2006 2007 ipif = best_c.cand_ipif; 2008 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n", 2009 dstinfo.dst_ill->ill_name, 2010 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)), 2011 (ipif == NULL ? "NULL" : 2012 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr))))); 2013 2014 if (usesrc_ill != NULL) 2015 ill_refrele(usesrc_ill); 2016 2017 if (ipif == NULL) { 2018 rw_exit(&ill_g_lock); 2019 return (NULL); 2020 } 2021 2022 mutex_enter(&ipif->ipif_ill->ill_lock); 2023 if (IPIF_CAN_LOOKUP(ipif)) { 2024 ipif_refhold_locked(ipif); 2025 mutex_exit(&ipif->ipif_ill->ill_lock); 2026 rw_exit(&ill_g_lock); 2027 return (ipif); 2028 } 2029 mutex_exit(&ipif->ipif_ill->ill_lock); 2030 rw_exit(&ill_g_lock); 2031 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p" 2032 " returning null \n", (void *)ipif)); 2033 2034 return (NULL); 2035 } 2036 2037 /* 2038 * If old_ipif is not NULL, see if ipif was derived from old 2039 * ipif and if so, recreate the interface route by re-doing 2040 * source address selection. This happens when ipif_down -> 2041 * ipif_update_other_ipifs calls us. 2042 * 2043 * If old_ipif is NULL, just redo the source address selection 2044 * if needed. This happens when illgrp_insert or ipif_up_done_v6 2045 * calls us. 2046 */ 2047 void 2048 ipif_recreate_interface_routes_v6(ipif_t *old_ipif, ipif_t *ipif) 2049 { 2050 ire_t *ire; 2051 ire_t *ipif_ire; 2052 queue_t *stq; 2053 ill_t *ill; 2054 ipif_t *nipif = NULL; 2055 boolean_t nipif_refheld = B_FALSE; 2056 boolean_t ip6_asp_table_held = B_FALSE; 2057 2058 ill = ipif->ipif_ill; 2059 2060 if (!(ipif->ipif_flags & 2061 (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) { 2062 /* 2063 * Can't possibly have borrowed the source 2064 * from old_ipif. 2065 */ 2066 return; 2067 } 2068 2069 /* 2070 * Is there any work to be done? No work if the address 2071 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST ( 2072 * ipif_select_source_v6() does not borrow addresses from 2073 * NOLOCAL and ANYCAST interfaces). 2074 */ 2075 if ((old_ipif != NULL) && 2076 ((IN6_IS_ADDR_UNSPECIFIED(&old_ipif->ipif_v6lcl_addr)) || 2077 (old_ipif->ipif_ill->ill_wq == NULL) || 2078 (old_ipif->ipif_flags & 2079 (IPIF_NOLOCAL|IPIF_ANYCAST)))) { 2080 return; 2081 } 2082 2083 /* 2084 * Perform the same checks as when creating the 2085 * IRE_INTERFACE in ipif_up_done_v6. 2086 */ 2087 if (!(ipif->ipif_flags & IPIF_UP)) 2088 return; 2089 2090 if ((ipif->ipif_flags & IPIF_NOXMIT)) 2091 return; 2092 2093 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2094 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask)) 2095 return; 2096 2097 /* 2098 * We know that ipif uses some other source for its 2099 * IRE_INTERFACE. Is it using the source of this 2100 * old_ipif? 2101 */ 2102 ipif_ire = ipif_to_ire_v6(ipif); 2103 if (ipif_ire == NULL) 2104 return; 2105 2106 if (old_ipif != NULL && 2107 !IN6_ARE_ADDR_EQUAL(&old_ipif->ipif_v6lcl_addr, 2108 &ipif_ire->ire_src_addr_v6)) { 2109 ire_refrele(ipif_ire); 2110 return; 2111 } 2112 2113 if (ip_debug > 2) { 2114 /* ip1dbg */ 2115 pr_addr_dbg("ipif_recreate_interface_routes_v6: deleting IRE" 2116 " for src %s\n", AF_INET6, &ipif_ire->ire_src_addr_v6); 2117 } 2118 2119 stq = ipif_ire->ire_stq; 2120 2121 /* 2122 * Can't use our source address. Select a different source address 2123 * for the IRE_INTERFACE. We restrict interface route source 2124 * address selection to ipif's assigned to the same link as the 2125 * interface. 2126 */ 2127 if (ip6_asp_can_lookup()) { 2128 ip6_asp_table_held = B_TRUE; 2129 nipif = ipif_select_source_v6(ill, &ipif->ipif_v6subnet, 2130 B_TRUE, IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid); 2131 } 2132 if (nipif == NULL) { 2133 /* Last resort - all ipif's have IPIF_NOLOCAL */ 2134 nipif = ipif; 2135 } else { 2136 nipif_refheld = B_TRUE; 2137 } 2138 2139 ire = ire_create_v6( 2140 &ipif->ipif_v6subnet, /* dest pref */ 2141 &ipif->ipif_v6net_mask, /* mask */ 2142 &nipif->ipif_v6src_addr, /* src addr */ 2143 NULL, /* no gateway */ 2144 &ipif->ipif_mtu, /* max frag */ 2145 NULL, /* no Fast path header */ 2146 NULL, /* no recv from queue */ 2147 stq, /* send-to queue */ 2148 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2149 ill->ill_resolver_mp, /* xmit header */ 2150 ipif, 2151 NULL, 2152 0, 2153 0, 2154 0, 2155 &ire_uinfo_null); 2156 2157 if (ire != NULL) { 2158 ire_t *ret_ire; 2159 int error; 2160 2161 /* 2162 * We don't need ipif_ire anymore. We need to delete 2163 * before we add so that ire_add does not detect 2164 * duplicates. 2165 */ 2166 ire_delete(ipif_ire); 2167 ret_ire = ire; 2168 error = ire_add(&ret_ire, NULL, NULL, NULL); 2169 ASSERT(error == 0); 2170 ASSERT(ret_ire == ire); 2171 if (ret_ire != NULL) { 2172 /* Held in ire_add */ 2173 ire_refrele(ret_ire); 2174 } 2175 } 2176 /* 2177 * Either we are falling through from above or could not 2178 * allocate a replacement. 2179 */ 2180 ire_refrele(ipif_ire); 2181 if (ip6_asp_table_held) 2182 ip6_asp_table_refrele(); 2183 if (nipif_refheld) 2184 ipif_refrele(nipif); 2185 } 2186 2187 /* 2188 * This old_ipif is going away. 2189 * 2190 * Determine if any other ipif's are using our address as 2191 * ipif_v6lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or 2192 * IPIF_DEPRECATED). 2193 * Find the IRE_INTERFACE for such ipif's and recreate them 2194 * to use an different source address following the rules in 2195 * ipif_up_done_v6. 2196 * 2197 * This function takes an illgrp as an argument so that illgrp_delete 2198 * can call this to update source address even after deleting the 2199 * old_ipif->ipif_ill from the ill group. 2200 */ 2201 void 2202 ipif_update_other_ipifs_v6(ipif_t *old_ipif, ill_group_t *illgrp) 2203 { 2204 ipif_t *ipif; 2205 ill_t *ill; 2206 char buf[INET6_ADDRSTRLEN]; 2207 2208 ASSERT(IAM_WRITER_IPIF(old_ipif)); 2209 2210 ill = old_ipif->ipif_ill; 2211 2212 ip1dbg(("ipif_update_other_ipifs_v6(%s, %s)\n", 2213 ill->ill_name, 2214 inet_ntop(AF_INET6, &old_ipif->ipif_v6lcl_addr, 2215 buf, sizeof (buf)))); 2216 2217 /* 2218 * If this part of a group, look at all ills as ipif_select_source 2219 * borrows a source address across all the ills in the group. 2220 */ 2221 if (illgrp != NULL) 2222 ill = illgrp->illgrp_ill; 2223 2224 /* Don't need a lock since this is a writer */ 2225 for (; ill != NULL; ill = ill->ill_group_next) { 2226 for (ipif = ill->ill_ipif; ipif != NULL; 2227 ipif = ipif->ipif_next) { 2228 2229 if (ipif == old_ipif) 2230 continue; 2231 2232 ipif_recreate_interface_routes_v6(old_ipif, ipif); 2233 } 2234 } 2235 } 2236 2237 /* 2238 * Perform an attach and bind to get phys addr plus info_req for 2239 * the physical device. 2240 * q and mp represents an ioctl which will be queued waiting for 2241 * completion of the DLPI message exchange. 2242 * MUST be called on an ill queue. Can not set conn_pending_ill for that 2243 * reason thus the DL_PHYS_ADDR_ACK code does not assume ill_pending_q. 2244 * 2245 * Returns EINPROGRESS when mp has been consumed by queueing it on 2246 * ill_pending_mp and the ioctl will complete in ip_rput. 2247 */ 2248 int 2249 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q) 2250 { 2251 mblk_t *v6token_mp = NULL; 2252 mblk_t *v6lla_mp = NULL; 2253 mblk_t *phys_mp = NULL; 2254 mblk_t *info_mp = NULL; 2255 mblk_t *attach_mp = NULL; 2256 mblk_t *detach_mp = NULL; 2257 mblk_t *bind_mp = NULL; 2258 mblk_t *unbind_mp = NULL; 2259 mblk_t *notify_mp = NULL; 2260 2261 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id)); 2262 ASSERT(ill->ill_dlpi_style_set); 2263 ASSERT(WR(q)->q_next != NULL); 2264 2265 if (ill->ill_isv6) { 2266 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2267 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2268 if (v6token_mp == NULL) 2269 goto bad; 2270 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type = 2271 DL_IPV6_TOKEN; 2272 2273 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2274 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2275 if (v6lla_mp == NULL) 2276 goto bad; 2277 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type = 2278 DL_IPV6_LINK_LAYER_ADDR; 2279 } 2280 2281 /* 2282 * Allocate a DL_NOTIFY_REQ and set the notifications we want. 2283 */ 2284 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long), 2285 DL_NOTIFY_REQ); 2286 if (notify_mp == NULL) 2287 goto bad; 2288 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications = 2289 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH | 2290 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG); 2291 2292 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) + 2293 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ); 2294 if (phys_mp == NULL) 2295 goto bad; 2296 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type = 2297 DL_CURR_PHYS_ADDR; 2298 2299 info_mp = ip_dlpi_alloc( 2300 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t), 2301 DL_INFO_REQ); 2302 if (info_mp == NULL) 2303 goto bad; 2304 2305 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long), 2306 DL_BIND_REQ); 2307 if (bind_mp == NULL) 2308 goto bad; 2309 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap; 2310 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS; 2311 2312 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ); 2313 if (unbind_mp == NULL) 2314 goto bad; 2315 2316 /* If we need to attach/detach, pre-alloc and initialize the mblks */ 2317 if (ill->ill_needs_attach) { 2318 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t), 2319 DL_ATTACH_REQ); 2320 if (attach_mp == NULL) 2321 goto bad; 2322 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa; 2323 2324 detach_mp = ip_dlpi_alloc(sizeof (dl_detach_req_t), 2325 DL_DETACH_REQ); 2326 if (detach_mp == NULL) 2327 goto bad; 2328 } 2329 2330 /* 2331 * Here we are going to delay the ioctl ack until after 2332 * ACKs from DL_PHYS_ADDR_REQ. So need to save the 2333 * original ioctl message before sending the requests 2334 */ 2335 mutex_enter(&ill->ill_lock); 2336 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */ 2337 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0); 2338 /* 2339 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of 2340 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will 2341 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd. 2342 */ 2343 ill->ill_phys_addr_pend = 0; 2344 mutex_exit(&ill->ill_lock); 2345 2346 if (attach_mp != NULL) { 2347 ip1dbg(("ill_dl_phys: attach\n")); 2348 ill_dlpi_send(ill, attach_mp); 2349 } 2350 ill_dlpi_send(ill, bind_mp); 2351 ill_dlpi_send(ill, info_mp); 2352 if (ill->ill_isv6) { 2353 ill_dlpi_send(ill, v6token_mp); 2354 ill_dlpi_send(ill, v6lla_mp); 2355 } 2356 ill_dlpi_send(ill, phys_mp); 2357 ill_dlpi_send(ill, notify_mp); 2358 ill_dlpi_send(ill, unbind_mp); 2359 2360 /* 2361 * Save the DL_DETACH_REQ (if there is one) for use in ill_delete(). 2362 */ 2363 ASSERT(ill->ill_detach_mp == NULL); 2364 ill->ill_detach_mp = detach_mp; 2365 2366 /* 2367 * This operation will complete in ip_rput_dlpi_writer with either 2368 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK. 2369 */ 2370 return (EINPROGRESS); 2371 bad: 2372 if (v6token_mp != NULL) 2373 freemsg(v6token_mp); 2374 if (v6lla_mp != NULL) 2375 freemsg(v6lla_mp); 2376 if (phys_mp != NULL) 2377 freemsg(phys_mp); 2378 if (info_mp != NULL) 2379 freemsg(info_mp); 2380 if (attach_mp != NULL) 2381 freemsg(attach_mp); 2382 if (detach_mp != NULL) 2383 freemsg(detach_mp); 2384 if (bind_mp != NULL) 2385 freemsg(bind_mp); 2386 if (unbind_mp != NULL) 2387 freemsg(unbind_mp); 2388 if (notify_mp != NULL) 2389 freemsg(notify_mp); 2390 return (ENOMEM); 2391 } 2392 2393 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20; 2394 2395 /* 2396 * DLPI is up. 2397 * Create all the IREs associated with an interface bring up multicast. 2398 * Set the interface flag and finish other initialization 2399 * that potentially had to be differed to after DL_BIND_ACK. 2400 */ 2401 int 2402 ipif_up_done_v6(ipif_t *ipif) 2403 { 2404 ire_t *ire_array[20]; 2405 ire_t **irep = ire_array; 2406 ire_t **irep1; 2407 ill_t *ill = ipif->ipif_ill; 2408 queue_t *stq; 2409 in6_addr_t v6addr; 2410 in6_addr_t route_mask; 2411 ipif_t *src_ipif = NULL; 2412 ipif_t *tmp_ipif; 2413 boolean_t flush_ire_cache = B_TRUE; 2414 int err; 2415 char buf[INET6_ADDRSTRLEN]; 2416 phyint_t *phyi; 2417 ire_t **ipif_saved_irep = NULL; 2418 int ipif_saved_ire_cnt; 2419 int cnt; 2420 boolean_t src_ipif_held = B_FALSE; 2421 boolean_t ire_added = B_FALSE; 2422 boolean_t loopback = B_FALSE; 2423 boolean_t ip6_asp_table_held = B_FALSE; 2424 2425 ip1dbg(("ipif_up_done_v6(%s:%u)\n", 2426 ipif->ipif_ill->ill_name, ipif->ipif_id)); 2427 2428 /* Check if this is a loopback interface */ 2429 if (ipif->ipif_ill->ill_wq == NULL) 2430 loopback = B_TRUE; 2431 2432 ASSERT(ipif->ipif_isv6); 2433 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2434 2435 /* 2436 * If all other interfaces for this ill are down or DEPRECATED, 2437 * or otherwise unsuitable for source address selection, remove 2438 * any IRE_CACHE entries for this ill to make sure source 2439 * address selection gets to take this new ipif into account. 2440 * No need to hold ill_lock while traversing the ipif list since 2441 * we are writer 2442 */ 2443 for (tmp_ipif = ill->ill_ipif; tmp_ipif; 2444 tmp_ipif = tmp_ipif->ipif_next) { 2445 if (((tmp_ipif->ipif_flags & 2446 (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) || 2447 !(tmp_ipif->ipif_flags & IPIF_UP)) || 2448 (tmp_ipif == ipif)) 2449 continue; 2450 /* first useable pre-existing interface */ 2451 flush_ire_cache = B_FALSE; 2452 break; 2453 } 2454 if (flush_ire_cache) 2455 ire_walk_ill_v6(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE, 2456 IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill); 2457 2458 /* 2459 * Figure out which way the send-to queue should go. Only 2460 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER should show up here. 2461 */ 2462 switch (ill->ill_net_type) { 2463 case IRE_IF_RESOLVER: 2464 stq = ill->ill_rq; 2465 break; 2466 case IRE_IF_NORESOLVER: 2467 case IRE_LOOPBACK: 2468 stq = ill->ill_wq; 2469 break; 2470 default: 2471 return (EINVAL); 2472 } 2473 2474 if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) { 2475 /* 2476 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in 2477 * ipif_lookup_on_name(), but in the case of zones we can have 2478 * several loopback addresses on lo0. So all the interfaces with 2479 * loopback addresses need to be marked IRE_LOOPBACK. 2480 */ 2481 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback)) 2482 ipif->ipif_ire_type = IRE_LOOPBACK; 2483 else 2484 ipif->ipif_ire_type = IRE_LOCAL; 2485 } 2486 2487 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) { 2488 /* 2489 * Can't use our source address. Select a different 2490 * source address for the IRE_INTERFACE and IRE_LOCAL 2491 */ 2492 if (ip6_asp_can_lookup()) { 2493 ip6_asp_table_held = B_TRUE; 2494 src_ipif = ipif_select_source_v6(ipif->ipif_ill, 2495 &ipif->ipif_v6subnet, B_FALSE, 2496 IPV6_PREFER_SRC_DEFAULT, ipif->ipif_zoneid); 2497 } 2498 if (src_ipif == NULL) 2499 src_ipif = ipif; /* Last resort */ 2500 else 2501 src_ipif_held = B_TRUE; 2502 } else { 2503 src_ipif = ipif; 2504 } 2505 2506 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) && 2507 !(ipif->ipif_flags & IPIF_NOLOCAL)) { 2508 /* Register the source address for __sin6_src_id */ 2509 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr, 2510 ipif->ipif_zoneid); 2511 if (err != 0) { 2512 ip0dbg(("ipif_up_done_v6: srcid_insert %d\n", err)); 2513 if (src_ipif_held) 2514 ipif_refrele(src_ipif); 2515 if (ip6_asp_table_held) 2516 ip6_asp_table_refrele(); 2517 return (err); 2518 } 2519 /* 2520 * If the interface address is set, create the LOCAL 2521 * or LOOPBACK IRE. 2522 */ 2523 ip1dbg(("ipif_up_done_v6: creating IRE %d for %s\n", 2524 ipif->ipif_ire_type, 2525 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, 2526 buf, sizeof (buf)))); 2527 2528 *irep++ = ire_create_v6( 2529 &ipif->ipif_v6lcl_addr, /* dest address */ 2530 &ipv6_all_ones, /* mask */ 2531 &src_ipif->ipif_v6src_addr, /* source address */ 2532 NULL, /* no gateway */ 2533 &ip_loopback_mtu_v6plus, /* max frag size */ 2534 NULL, 2535 ipif->ipif_rq, /* recv-from queue */ 2536 NULL, /* no send-to queue */ 2537 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */ 2538 NULL, 2539 ipif, /* interface */ 2540 NULL, 2541 0, 2542 0, 2543 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2544 &ire_uinfo_null); 2545 } 2546 2547 /* 2548 * Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. 2549 * Note that atun interfaces have an all-zero ipif_v6subnet. 2550 * Thus we allow a zero subnet as long as the mask is non-zero. 2551 */ 2552 if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) && 2553 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) && 2554 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) { 2555 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */ 2556 v6addr = ipif->ipif_v6subnet; 2557 2558 if (ipif->ipif_flags & IPIF_POINTOPOINT) { 2559 route_mask = ipv6_all_ones; 2560 } else { 2561 route_mask = ipif->ipif_v6net_mask; 2562 } 2563 2564 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s\n", 2565 ill->ill_net_type, 2566 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf)))); 2567 2568 *irep++ = ire_create_v6( 2569 &v6addr, /* dest pref */ 2570 &route_mask, /* mask */ 2571 &src_ipif->ipif_v6src_addr, /* src addr */ 2572 NULL, /* no gateway */ 2573 &ipif->ipif_mtu, /* max frag */ 2574 NULL, /* no Fast path header */ 2575 NULL, /* no recv from queue */ 2576 stq, /* send-to queue */ 2577 ill->ill_net_type, /* IF_[NO]RESOLVER */ 2578 ill->ill_resolver_mp, /* xmit header */ 2579 ipif, 2580 NULL, 2581 0, 2582 0, 2583 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0, 2584 &ire_uinfo_null); 2585 } 2586 2587 /* 2588 * Setup 2002::/16 route, if this interface is a 6to4 tunnel 2589 */ 2590 if (IN6_IS_ADDR_6TO4(&ipif->ipif_v6lcl_addr) && 2591 (ill->ill_is_6to4tun)) { 2592 /* 2593 * Destination address is 2002::/16 2594 */ 2595 #ifdef _BIG_ENDIAN 2596 const in6_addr_t prefix_addr = { 0x20020000U, 0, 0, 0 }; 2597 const in6_addr_t prefix_mask = { 0xffff0000U, 0, 0, 0 }; 2598 #else 2599 const in6_addr_t prefix_addr = { 0x00000220U, 0, 0, 0 }; 2600 const in6_addr_t prefix_mask = { 0x0000ffffU, 0, 0, 0 }; 2601 #endif /* _BIG_ENDIAN */ 2602 char buf2[INET6_ADDRSTRLEN]; 2603 ire_t *isdup; 2604 in6_addr_t *first_addr = &ill->ill_ipif->ipif_v6lcl_addr; 2605 2606 /* 2607 * check to see if this route has already been added for 2608 * this tunnel interface. 2609 */ 2610 isdup = ire_ftable_lookup_v6(first_addr, &prefix_mask, 0, 2611 IRE_IF_NORESOLVER, ill->ill_ipif, NULL, ALL_ZONES, 0, 2612 (MATCH_IRE_SRC | MATCH_IRE_MASK)); 2613 2614 if (isdup == NULL) { 2615 ip1dbg(("ipif_up_done_v6: creating if IRE %d for %s", 2616 IRE_IF_NORESOLVER, inet_ntop(AF_INET6, &v6addr, 2617 buf2, sizeof (buf2)))); 2618 2619 *irep++ = ire_create_v6( 2620 &prefix_addr, /* 2002:: */ 2621 &prefix_mask, /* ffff:: */ 2622 &ipif->ipif_v6lcl_addr, /* src addr */ 2623 NULL, /* gateway */ 2624 &ipif->ipif_mtu, /* max_frag */ 2625 NULL, /* no Fast Path hdr */ 2626 NULL, /* no rfq */ 2627 ill->ill_wq, /* stq */ 2628 IRE_IF_NORESOLVER, /* type */ 2629 ill->ill_resolver_mp, /* dlureq_mp */ 2630 ipif, /* interface */ 2631 NULL, /* v6cmask */ 2632 0, 2633 0, 2634 RTF_UP, 2635 &ire_uinfo_null); 2636 } else { 2637 ire_refrele(isdup); 2638 } 2639 } 2640 2641 /* If an earlier ire_create failed, get out now */ 2642 for (irep1 = irep; irep1 > ire_array; ) { 2643 irep1--; 2644 if (*irep1 == NULL) { 2645 ip1dbg(("ipif_up_done_v6: NULL ire found in" 2646 " ire_array\n")); 2647 err = ENOMEM; 2648 goto bad; 2649 } 2650 } 2651 2652 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2653 2654 /* 2655 * Need to atomically check for ip_addr_availablity_check 2656 * now under ill_g_lock, and if it fails got bad, and remove 2657 * from group also 2658 */ 2659 rw_enter(&ill_g_lock, RW_READER); 2660 mutex_enter(&ip_addr_avail_lock); 2661 ill->ill_ipif_up_count++; 2662 ipif->ipif_flags |= IPIF_UP; 2663 err = ip_addr_availability_check(ipif); 2664 mutex_exit(&ip_addr_avail_lock); 2665 rw_exit(&ill_g_lock); 2666 2667 if (err != 0) { 2668 /* 2669 * Our address may already be up on the same ill. In this case, 2670 * the external resolver entry for our ipif replaced the one for 2671 * the other ipif. So we don't want to delete it (otherwise the 2672 * other ipif would be unable to send packets). 2673 * ip_addr_availability_check() identifies this case for us and 2674 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL 2675 * which is the expected error code. 2676 */ 2677 if (err == EADDRINUSE) { 2678 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) { 2679 freemsg(ipif->ipif_arp_del_mp); 2680 ipif->ipif_arp_del_mp = NULL; 2681 } 2682 err = EADDRNOTAVAIL; 2683 } 2684 ill->ill_ipif_up_count--; 2685 ipif->ipif_flags &= ~IPIF_UP; 2686 goto bad; 2687 } 2688 2689 /* 2690 * Add in all newly created IREs. We want to add before 2691 * we call ifgrp_insert which wants to know whether 2692 * IRE_IF_RESOLVER exists or not. 2693 * 2694 * NOTE : We refrele the ire though we may branch to "bad" 2695 * later on where we do ire_delete. This is okay 2696 * because nobody can delete it as we are running 2697 * exclusively. 2698 */ 2699 for (irep1 = irep; irep1 > ire_array; ) { 2700 irep1--; 2701 /* Shouldn't be adding any bcast ire's */ 2702 ASSERT((*irep1)->ire_type != IRE_BROADCAST); 2703 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock)); 2704 /* 2705 * refheld by ire_add. refele towards the end of the func 2706 */ 2707 (void) ire_add(irep1, NULL, NULL, NULL); 2708 } 2709 if (ip6_asp_table_held) { 2710 ip6_asp_table_refrele(); 2711 ip6_asp_table_held = B_FALSE; 2712 } 2713 ire_added = B_TRUE; 2714 2715 /* 2716 * Form groups if possible. 2717 * 2718 * If we are supposed to be in a ill_group with a name, insert it 2719 * now as we know that at least one ipif is UP. Otherwise form 2720 * nameless groups. 2721 * 2722 * If ip_enable_group_ifs is set and ipif address is not ::0, insert 2723 * this ipif into the appropriate interface group, or create a 2724 * new one. If this is already in a nameless group, we try to form 2725 * a bigger group looking at other ills potentially sharing this 2726 * ipif's prefix. 2727 */ 2728 phyi = ill->ill_phyint; 2729 if (phyi->phyint_groupname_len != 0) { 2730 ASSERT(phyi->phyint_groupname != NULL); 2731 if (ill->ill_ipif_up_count == 1) { 2732 ASSERT(ill->ill_group == NULL); 2733 err = illgrp_insert(&illgrp_head_v6, ill, 2734 phyi->phyint_groupname, NULL, B_TRUE); 2735 if (err != 0) { 2736 ip1dbg(("ipif_up_done_v6: illgrp allocation " 2737 "failed, error %d\n", err)); 2738 goto bad; 2739 } 2740 } 2741 ASSERT(ill->ill_group != NULL); 2742 } 2743 2744 /* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */ 2745 ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt; 2746 ipif_saved_irep = ipif_recover_ire_v6(ipif); 2747 2748 if (ipif->ipif_ipif_up_count == 1 && !loopback) { 2749 /* 2750 * Need to recover all multicast memberships in the driver. 2751 * This had to be deferred until we had attached. 2752 */ 2753 ill_recover_multicast(ill); 2754 } 2755 /* Join the allhosts multicast address and the solicited node MC */ 2756 ipif_multicast_up(ipif); 2757 2758 if (!loopback) { 2759 /* 2760 * See whether anybody else would benefit from the 2761 * new ipif that we added. We call this always rather 2762 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST 2763 * ipif for the benefit of illgrp_insert (done above) 2764 * which does not do source address selection as it does 2765 * not want to re-create interface routes that we are 2766 * having reference to it here. 2767 */ 2768 ill_update_source_selection(ill); 2769 } 2770 2771 for (irep1 = irep; irep1 > ire_array; ) { 2772 irep1--; 2773 if (*irep1 != NULL) { 2774 /* was held in ire_add */ 2775 ire_refrele(*irep1); 2776 } 2777 } 2778 2779 cnt = ipif_saved_ire_cnt; 2780 for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) { 2781 if (*irep1 != NULL) { 2782 /* was held in ire_add */ 2783 ire_refrele(*irep1); 2784 } 2785 } 2786 2787 2788 ip_rts_ifmsg(ipif); 2789 ip_rts_newaddrmsg(RTM_ADD, 0, ipif); 2790 if (ipif_saved_irep != NULL) { 2791 kmem_free(ipif_saved_irep, 2792 ipif_saved_ire_cnt * sizeof (ire_t *)); 2793 } 2794 2795 if (src_ipif_held) 2796 ipif_refrele(src_ipif); 2797 sctp_update_ipif(ipif, SCTP_IPIF_UP); 2798 return (0); 2799 2800 bad: 2801 if (ip6_asp_table_held) 2802 ip6_asp_table_refrele(); 2803 /* 2804 * We don't have to bother removing from ill groups because 2805 * 2806 * 1) For groups with names, we insert only when the first ipif 2807 * comes up. In that case if it fails, it will not be in any 2808 * group. So, we need not try to remove for that case. 2809 * 2810 * 2) For groups without names, either we tried to insert ipif_ill 2811 * in a group as singleton or found some other group to become 2812 * a bigger group. For the former, if it fails we don't have 2813 * anything to do as ipif_ill is not in the group and for the 2814 * latter, there are no failures in illgrp_insert/illgrp_delete 2815 * (ENOMEM can't occur for this. Check ifgrp_insert). 2816 */ 2817 2818 while (irep > ire_array) { 2819 irep--; 2820 if (*irep != NULL) { 2821 ire_delete(*irep); 2822 if (ire_added) 2823 ire_refrele(*irep); 2824 } 2825 2826 } 2827 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid); 2828 2829 if (ipif_saved_irep != NULL) { 2830 kmem_free(ipif_saved_irep, 2831 ipif_saved_ire_cnt * sizeof (ire_t *)); 2832 } 2833 if (src_ipif_held) 2834 ipif_refrele(src_ipif); 2835 2836 ipif_ndp_down(ipif); 2837 if (ipif->ipif_ill->ill_flags & ILLF_XRESOLV) 2838 ipif_arp_down(ipif); 2839 2840 return (err); 2841 } 2842 2843 /* 2844 * Delete an ND entry and the corresponding IRE_CACHE entry if it exists. 2845 */ 2846 /* ARGSUSED */ 2847 int 2848 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2849 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2850 { 2851 in6_addr_t addr; 2852 sin6_t *sin6; 2853 nce_t *nce; 2854 struct lifreq *lifr; 2855 lif_nd_req_t *lnr; 2856 mblk_t *mp1; 2857 2858 mp1 = mp->b_cont->b_cont; 2859 lifr = (struct lifreq *)mp1->b_rptr; 2860 lnr = &lifr->lifr_nd; 2861 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2862 if (ipif->ipif_id != 0) 2863 return (EINVAL); 2864 2865 if (!ipif->ipif_isv6) 2866 return (EINVAL); 2867 2868 if (lnr->lnr_addr.ss_family != AF_INET6) 2869 return (EAFNOSUPPORT); 2870 2871 sin6 = (sin6_t *)&lnr->lnr_addr; 2872 addr = sin6->sin6_addr; 2873 nce = ndp_lookup(ipif->ipif_ill, &addr, B_FALSE); 2874 if (nce == NULL) 2875 return (ESRCH); 2876 ndp_delete(nce); 2877 NCE_REFRELE(nce); 2878 return (0); 2879 } 2880 2881 /* 2882 * Return nbr cache info. 2883 */ 2884 /* ARGSUSED */ 2885 int 2886 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2887 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2888 { 2889 ill_t *ill = ipif->ipif_ill; 2890 struct lifreq *lifr; 2891 lif_nd_req_t *lnr; 2892 2893 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2894 lnr = &lifr->lifr_nd; 2895 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2896 if (ipif->ipif_id != 0) 2897 return (EINVAL); 2898 2899 if (!ipif->ipif_isv6) 2900 return (EINVAL); 2901 2902 if (lnr->lnr_addr.ss_family != AF_INET6) 2903 return (EAFNOSUPPORT); 2904 2905 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr)) 2906 return (EINVAL); 2907 2908 return (ndp_query(ill, lnr)); 2909 } 2910 2911 /* 2912 * Perform an update of the nd entry for the specified address. 2913 */ 2914 /* ARGSUSED */ 2915 int 2916 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp, 2917 ip_ioctl_cmd_t *ipip, void *dummy_ifreq) 2918 { 2919 ill_t *ill = ipif->ipif_ill; 2920 struct lifreq *lifr; 2921 lif_nd_req_t *lnr; 2922 2923 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr; 2924 lnr = &lifr->lifr_nd; 2925 /* Only allow for logical unit zero i.e. not on "le0:17" */ 2926 if (ipif->ipif_id != 0) 2927 return (EINVAL); 2928 2929 if (!ipif->ipif_isv6) 2930 return (EINVAL); 2931 2932 if (lnr->lnr_addr.ss_family != AF_INET6) 2933 return (EAFNOSUPPORT); 2934 2935 return (ndp_sioc_update(ill, lnr)); 2936 } 2937