Print this page
7127 remove -Wno-missing-braces from Makefile.uts
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/inet/ip/ip6_if.c
+++ new/usr/src/uts/common/inet/ip/ip6_if.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
23 23 * Copyright (c) 1990 Mentat Inc.
24 24 */
25 25
26 26 /*
27 27 * This file contains the interface control functions for IPv6.
28 28 */
29 29
30 30 #include <sys/types.h>
31 31 #include <sys/sysmacros.h>
32 32 #include <sys/stream.h>
33 33 #include <sys/dlpi.h>
34 34 #include <sys/stropts.h>
35 35 #include <sys/ddi.h>
36 36 #include <sys/cmn_err.h>
37 37 #include <sys/kstat.h>
38 38 #include <sys/debug.h>
39 39 #include <sys/zone.h>
40 40 #include <sys/policy.h>
41 41
42 42 #include <sys/systm.h>
43 43 #include <sys/param.h>
44 44 #include <sys/socket.h>
45 45 #include <sys/isa_defs.h>
46 46 #include <net/if.h>
47 47 #include <net/if_dl.h>
48 48 #include <net/route.h>
49 49 #include <netinet/in.h>
50 50 #include <netinet/igmp_var.h>
51 51 #include <netinet/ip6.h>
52 52 #include <netinet/icmp6.h>
53 53
54 54 #include <inet/common.h>
55 55 #include <inet/nd.h>
56 56 #include <inet/tunables.h>
57 57 #include <inet/mib2.h>
58 58 #include <inet/ip.h>
59 59 #include <inet/ip6.h>
60 60 #include <inet/ip_multi.h>
61 61 #include <inet/ip_ire.h>
|
↓ open down ↓ |
61 lines elided |
↑ open up ↑ |
62 62 #include <inet/ip_rts.h>
63 63 #include <inet/ip_ndp.h>
64 64 #include <inet/ip_if.h>
65 65 #include <inet/ip6_asp.h>
66 66 #include <inet/ipclassifier.h>
67 67 #include <inet/sctp_ip.h>
68 68
69 69 #include <sys/tsol/tndb.h>
70 70 #include <sys/tsol/tnet.h>
71 71
72 -static in6_addr_t ipv6_ll_template =
73 - {(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0};
72 +static in6_addr_t ipv6_ll_template = {
73 + {{(uint32_t)V6_LINKLOCAL, 0x0, 0x0, 0x0}}};
74 74
75 75 static ipif_t *
76 76 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
77 77 ip_stack_t *ipst);
78 78
79 79 static int ipif_add_ires_v6(ipif_t *, boolean_t);
80 80
81 81 /*
82 82 * This function is called when an application does not specify an interface
83 83 * to be used for multicast traffic. It calls ire_lookup_multi_v6() to look
84 84 * for an interface route for the specified multicast group. Doing
85 85 * this allows the administrator to add prefix routes for multicast to
86 86 * indicate which interface to be used for multicast traffic in the above
87 87 * scenario. The route could be for all multicast (ff00::/8), for a single
88 88 * multicast group (a /128 route) or anything in between. If there is no
89 89 * such multicast route, we just find any multicast capable interface and
90 90 * return it.
91 91 *
92 92 * We support MULTIRT and RTF_SETSRC on the multicast routes added to the
93 93 * unicast table. This is used by CGTP.
94 94 */
95 95 ill_t *
96 96 ill_lookup_group_v6(const in6_addr_t *group, zoneid_t zoneid, ip_stack_t *ipst,
97 97 boolean_t *multirtp, in6_addr_t *setsrcp)
98 98 {
99 99 ill_t *ill;
100 100
101 101 ill = ire_lookup_multi_ill_v6(group, zoneid, ipst, multirtp, setsrcp);
102 102 if (ill != NULL)
103 103 return (ill);
104 104
105 105 return (ill_lookup_multicast(ipst, zoneid, B_TRUE));
106 106 }
107 107
108 108 /*
109 109 * Look for an ipif with the specified interface address and destination.
110 110 * The destination address is used only for matching point-to-point interfaces.
111 111 */
112 112 static ipif_t *
113 113 ipif_lookup_interface_v6(const in6_addr_t *if_addr, const in6_addr_t *dst,
114 114 ip_stack_t *ipst)
115 115 {
116 116 ipif_t *ipif;
117 117 ill_t *ill;
118 118 ill_walk_context_t ctx;
119 119
120 120 /*
121 121 * First match all the point-to-point interfaces
122 122 * before looking at non-point-to-point interfaces.
123 123 * This is done to avoid returning non-point-to-point
124 124 * ipif instead of unnumbered point-to-point ipif.
125 125 */
126 126 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
127 127 ill = ILL_START_WALK_V6(&ctx, ipst);
128 128 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
129 129 mutex_enter(&ill->ill_lock);
130 130 for (ipif = ill->ill_ipif; ipif != NULL;
131 131 ipif = ipif->ipif_next) {
132 132 /* Allow the ipif to be down */
133 133 if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
134 134 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
135 135 if_addr)) &&
136 136 (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
137 137 dst))) {
138 138 if (!IPIF_IS_CONDEMNED(ipif)) {
139 139 ipif_refhold_locked(ipif);
140 140 mutex_exit(&ill->ill_lock);
141 141 rw_exit(&ipst->ips_ill_g_lock);
142 142 return (ipif);
143 143 }
144 144 }
145 145 }
146 146 mutex_exit(&ill->ill_lock);
147 147 }
148 148 rw_exit(&ipst->ips_ill_g_lock);
149 149 /* lookup the ipif based on interface address */
150 150 ipif = ipif_lookup_addr_v6(if_addr, NULL, ALL_ZONES, ipst);
151 151 ASSERT(ipif == NULL || ipif->ipif_isv6);
152 152 return (ipif);
153 153 }
154 154
155 155 /*
156 156 * Common function for ipif_lookup_addr_v6() and ipif_lookup_addr_exact_v6().
157 157 */
158 158 static ipif_t *
159 159 ipif_lookup_addr_common_v6(const in6_addr_t *addr, ill_t *match_ill,
160 160 uint32_t match_flags, zoneid_t zoneid, ip_stack_t *ipst)
161 161 {
162 162 ipif_t *ipif;
163 163 ill_t *ill;
164 164 boolean_t ptp = B_FALSE;
165 165 ill_walk_context_t ctx;
166 166 boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP);
167 167 boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP);
168 168
169 169 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
170 170 /*
171 171 * Repeat twice, first based on local addresses and
172 172 * next time for pointopoint.
173 173 */
174 174 repeat:
175 175 ill = ILL_START_WALK_V6(&ctx, ipst);
176 176 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
177 177 if (match_ill != NULL && ill != match_ill &&
178 178 (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
179 179 continue;
180 180 }
181 181 mutex_enter(&ill->ill_lock);
182 182 for (ipif = ill->ill_ipif; ipif != NULL;
183 183 ipif = ipif->ipif_next) {
184 184 if (zoneid != ALL_ZONES &&
185 185 ipif->ipif_zoneid != zoneid &&
186 186 ipif->ipif_zoneid != ALL_ZONES)
187 187 continue;
188 188
189 189 if (no_duplicate &&
190 190 !(ipif->ipif_flags & IPIF_UP)) {
191 191 continue;
192 192 }
193 193
194 194 /* Allow the ipif to be down */
195 195 if ((!ptp && (IN6_ARE_ADDR_EQUAL(
196 196 &ipif->ipif_v6lcl_addr, addr) &&
197 197 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
198 198 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
199 199 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
200 200 addr))) {
201 201 if (!IPIF_IS_CONDEMNED(ipif)) {
202 202 ipif_refhold_locked(ipif);
203 203 mutex_exit(&ill->ill_lock);
204 204 rw_exit(&ipst->ips_ill_g_lock);
205 205 return (ipif);
206 206 }
207 207 }
208 208 }
209 209 mutex_exit(&ill->ill_lock);
210 210 }
211 211
212 212 /* If we already did the ptp case, then we are done */
213 213 if (ptp) {
214 214 rw_exit(&ipst->ips_ill_g_lock);
215 215 return (NULL);
216 216 }
217 217 ptp = B_TRUE;
218 218 goto repeat;
219 219 }
220 220
221 221 /*
222 222 * Lookup an ipif with the specified address. For point-to-point links we
223 223 * look for matches on either the destination address or the local address,
224 224 * but we skip the local address check if IPIF_UNNUMBERED is set. If the
225 225 * `match_ill' argument is non-NULL, the lookup is restricted to that ill
226 226 * (or illgrp if `match_ill' is in an IPMP group).
227 227 */
228 228 ipif_t *
229 229 ipif_lookup_addr_v6(const in6_addr_t *addr, ill_t *match_ill, zoneid_t zoneid,
230 230 ip_stack_t *ipst)
231 231 {
232 232 return (ipif_lookup_addr_common_v6(addr, match_ill, IPIF_MATCH_ILLGRP,
233 233 zoneid, ipst));
234 234 }
235 235
236 236 /*
237 237 * Lookup an ipif with the specified address. Similar to ipif_lookup_addr,
238 238 * except that we will only return an address if it is not marked as
239 239 * IPIF_DUPLICATE
240 240 */
241 241 ipif_t *
242 242 ipif_lookup_addr_nondup_v6(const in6_addr_t *addr, ill_t *match_ill,
243 243 zoneid_t zoneid, ip_stack_t *ipst)
244 244 {
245 245 return (ipif_lookup_addr_common_v6(addr, match_ill,
246 246 (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP), zoneid,
247 247 ipst));
248 248 }
249 249
250 250 /*
251 251 * Special abbreviated version of ipif_lookup_addr_v6() that doesn't match
252 252 * `match_ill' across the IPMP group. This function is only needed in some
253 253 * corner-cases; almost everything should use ipif_lookup_addr_v6().
254 254 */
255 255 ipif_t *
256 256 ipif_lookup_addr_exact_v6(const in6_addr_t *addr, ill_t *match_ill,
257 257 ip_stack_t *ipst)
258 258 {
259 259 ASSERT(match_ill != NULL);
260 260 return (ipif_lookup_addr_common_v6(addr, match_ill, 0, ALL_ZONES,
261 261 ipst));
262 262 }
263 263
264 264 /*
265 265 * Look for an ipif with the specified address. For point-point links
266 266 * we look for matches on either the destination address and the local
267 267 * address, but we ignore the check on the local address if IPIF_UNNUMBERED
268 268 * is set.
269 269 * If the `match_ill' argument is non-NULL, the lookup is restricted to that
270 270 * ill (or illgrp if `match_ill' is in an IPMP group).
271 271 * Return the zoneid for the ipif. ALL_ZONES if none found.
272 272 */
273 273 zoneid_t
274 274 ipif_lookup_addr_zoneid_v6(const in6_addr_t *addr, ill_t *match_ill,
275 275 ip_stack_t *ipst)
276 276 {
277 277 ipif_t *ipif;
278 278 ill_t *ill;
279 279 boolean_t ptp = B_FALSE;
280 280 ill_walk_context_t ctx;
281 281 zoneid_t zoneid;
282 282
283 283 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
284 284 /*
285 285 * Repeat twice, first based on local addresses and
286 286 * next time for pointopoint.
287 287 */
288 288 repeat:
289 289 ill = ILL_START_WALK_V6(&ctx, ipst);
290 290 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
291 291 if (match_ill != NULL && ill != match_ill &&
292 292 !IS_IN_SAME_ILLGRP(ill, match_ill)) {
293 293 continue;
294 294 }
295 295 mutex_enter(&ill->ill_lock);
296 296 for (ipif = ill->ill_ipif; ipif != NULL;
297 297 ipif = ipif->ipif_next) {
298 298 /* Allow the ipif to be down */
299 299 if ((!ptp && (IN6_ARE_ADDR_EQUAL(
300 300 &ipif->ipif_v6lcl_addr, addr) &&
301 301 (ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
302 302 (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
303 303 IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr,
304 304 addr)) &&
305 305 !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
306 306 zoneid = ipif->ipif_zoneid;
307 307 mutex_exit(&ill->ill_lock);
308 308 rw_exit(&ipst->ips_ill_g_lock);
309 309 /*
310 310 * If ipif_zoneid was ALL_ZONES then we have
311 311 * a trusted extensions shared IP address.
312 312 * In that case GLOBAL_ZONEID works to send.
313 313 */
314 314 if (zoneid == ALL_ZONES)
315 315 zoneid = GLOBAL_ZONEID;
316 316 return (zoneid);
317 317 }
318 318 }
319 319 mutex_exit(&ill->ill_lock);
320 320 }
321 321
322 322 /* If we already did the ptp case, then we are done */
323 323 if (ptp) {
324 324 rw_exit(&ipst->ips_ill_g_lock);
325 325 return (ALL_ZONES);
326 326 }
327 327 ptp = B_TRUE;
328 328 goto repeat;
329 329 }
330 330
331 331 /*
332 332 * Perform various checks to verify that an address would make sense as a local
333 333 * interface address. This is currently only called when an attempt is made
334 334 * to set a local address.
335 335 *
336 336 * Does not allow a v4-mapped address, an address that equals the subnet
337 337 * anycast address, ... a multicast address, ...
338 338 */
339 339 boolean_t
340 340 ip_local_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
341 341 {
342 342 in6_addr_t subnet;
343 343
344 344 if (IN6_IS_ADDR_UNSPECIFIED(addr))
345 345 return (B_TRUE); /* Allow all zeros */
346 346
347 347 /*
348 348 * Don't allow all zeroes or host part, but allow
349 349 * all ones netmask.
350 350 */
351 351 V6_MASK_COPY(*addr, *subnet_mask, subnet);
352 352 if (IN6_IS_ADDR_V4MAPPED(addr) ||
353 353 (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
354 354 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
355 355 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))) ||
356 356 IN6_IS_ADDR_MULTICAST(addr))
357 357 return (B_FALSE);
358 358
359 359 return (B_TRUE);
360 360 }
361 361
362 362 /*
363 363 * Perform various checks to verify that an address would make sense as a
364 364 * remote/subnet interface address.
365 365 */
366 366 boolean_t
367 367 ip_remote_addr_ok_v6(const in6_addr_t *addr, const in6_addr_t *subnet_mask)
368 368 {
369 369 in6_addr_t subnet;
370 370
371 371 if (IN6_IS_ADDR_UNSPECIFIED(addr))
372 372 return (B_TRUE); /* Allow all zeros */
373 373
374 374 V6_MASK_COPY(*addr, *subnet_mask, subnet);
375 375 if (IN6_IS_ADDR_V4MAPPED(addr) ||
376 376 (IN6_ARE_ADDR_EQUAL(addr, &subnet) &&
377 377 !IN6_ARE_ADDR_EQUAL(subnet_mask, &ipv6_all_ones)) ||
378 378 IN6_IS_ADDR_MULTICAST(addr) ||
379 379 (IN6_IS_ADDR_V4COMPAT(addr) && CLASSD(V4_PART_OF_V6((*addr)))))
380 380 return (B_FALSE);
381 381
382 382 return (B_TRUE);
383 383 }
384 384
385 385 /*
386 386 * ip_rt_add_v6 is called to add an IPv6 route to the forwarding table.
387 387 * ill is passed in to associate it with the correct interface
388 388 * (for link-local destinations and gateways).
389 389 * If ire_arg is set, then we return the held IRE in that location.
390 390 */
391 391 /* ARGSUSED1 */
392 392 int
393 393 ip_rt_add_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
394 394 const in6_addr_t *gw_addr, const in6_addr_t *src_addr, int flags,
395 395 ill_t *ill, ire_t **ire_arg, struct rtsa_s *sp, ip_stack_t *ipst,
396 396 zoneid_t zoneid)
397 397 {
398 398 ire_t *ire, *nire;
399 399 ire_t *gw_ire = NULL;
400 400 ipif_t *ipif;
401 401 uint_t type;
402 402 int match_flags = MATCH_IRE_TYPE;
403 403 tsol_gc_t *gc = NULL;
404 404 tsol_gcgrp_t *gcgrp = NULL;
405 405 boolean_t gcgrp_xtraref = B_FALSE;
406 406 boolean_t unbound = B_FALSE;
407 407
408 408 if (ire_arg != NULL)
409 409 *ire_arg = NULL;
410 410
411 411 /*
412 412 * Prevent routes with a zero gateway from being created (since
413 413 * interfaces can currently be plumbed and brought up with no assigned
414 414 * address).
415 415 */
416 416 if (IN6_IS_ADDR_UNSPECIFIED(gw_addr))
417 417 return (ENETUNREACH);
418 418
419 419 /*
420 420 * If this is the case of RTF_HOST being set, then we set the netmask
421 421 * to all ones (regardless if one was supplied).
422 422 */
423 423 if (flags & RTF_HOST)
424 424 mask = &ipv6_all_ones;
425 425
426 426 /*
427 427 * Get the ipif, if any, corresponding to the gw_addr
428 428 * If -ifp was specified we restrict ourselves to the ill, otherwise
429 429 * we match on the gatway and destination to handle unnumbered pt-pt
430 430 * interfaces.
431 431 */
432 432 if (ill != NULL)
433 433 ipif = ipif_lookup_addr_v6(gw_addr, ill, ALL_ZONES, ipst);
434 434 else
435 435 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst);
436 436 if (ipif != NULL) {
437 437 if (IS_VNI(ipif->ipif_ill)) {
438 438 ipif_refrele(ipif);
439 439 return (EINVAL);
440 440 }
441 441 }
442 442
443 443 /*
444 444 * GateD will attempt to create routes with a loopback interface
445 445 * address as the gateway and with RTF_GATEWAY set. We allow
446 446 * these routes to be added, but create them as interface routes
447 447 * since the gateway is an interface address.
448 448 */
449 449 if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
450 450 flags &= ~RTF_GATEWAY;
451 451 if (IN6_ARE_ADDR_EQUAL(gw_addr, &ipv6_loopback) &&
452 452 IN6_ARE_ADDR_EQUAL(dst_addr, &ipv6_loopback) &&
453 453 IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones)) {
454 454 ire = ire_ftable_lookup_v6(dst_addr, 0, 0, IRE_LOOPBACK,
455 455 NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
456 456 NULL);
457 457 if (ire != NULL) {
458 458 ire_refrele(ire);
459 459 ipif_refrele(ipif);
460 460 return (EEXIST);
461 461 }
462 462 ip1dbg(("ip_rt_add_v6: 0x%p creating IRE 0x%x"
463 463 "for 0x%x\n", (void *)ipif,
464 464 ipif->ipif_ire_type,
465 465 ntohl(ipif->ipif_lcl_addr)));
466 466 ire = ire_create_v6(
467 467 dst_addr,
468 468 mask,
469 469 NULL,
470 470 ipif->ipif_ire_type, /* LOOPBACK */
471 471 ipif->ipif_ill,
472 472 zoneid,
473 473 (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
474 474 NULL,
475 475 ipst);
476 476
477 477 if (ire == NULL) {
478 478 ipif_refrele(ipif);
479 479 return (ENOMEM);
480 480 }
481 481 /* src address assigned by the caller? */
482 482 if ((flags & RTF_SETSRC) &&
483 483 !IN6_IS_ADDR_UNSPECIFIED(src_addr))
484 484 ire->ire_setsrc_addr_v6 = *src_addr;
485 485
486 486 nire = ire_add(ire);
487 487 if (nire == NULL) {
488 488 /*
489 489 * In the result of failure, ire_add() will have
490 490 * already deleted the ire in question, so there
491 491 * is no need to do that here.
492 492 */
493 493 ipif_refrele(ipif);
494 494 return (ENOMEM);
495 495 }
496 496 /*
497 497 * Check if it was a duplicate entry. This handles
498 498 * the case of two racing route adds for the same route
499 499 */
500 500 if (nire != ire) {
501 501 ASSERT(nire->ire_identical_ref > 1);
502 502 ire_delete(nire);
503 503 ire_refrele(nire);
504 504 ipif_refrele(ipif);
505 505 return (EEXIST);
506 506 }
507 507 ire = nire;
508 508 goto save_ire;
509 509 }
510 510 }
511 511
512 512 /*
513 513 * The routes for multicast with CGTP are quite special in that
514 514 * the gateway is the local interface address, yet RTF_GATEWAY
515 515 * is set. We turn off RTF_GATEWAY to provide compatibility with
516 516 * this undocumented and unusual use of multicast routes.
517 517 */
518 518 if ((flags & RTF_MULTIRT) && ipif != NULL)
519 519 flags &= ~RTF_GATEWAY;
520 520
521 521 /*
522 522 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
523 523 * and the gateway address provided is one of the system's interface
524 524 * addresses. By using the routing socket interface and supplying an
525 525 * RTA_IFP sockaddr with an interface index, an alternate method of
526 526 * specifying an interface route to be created is available which uses
527 527 * the interface index that specifies the outgoing interface rather than
528 528 * the address of an outgoing interface (which may not be able to
529 529 * uniquely identify an interface). When coupled with the RTF_GATEWAY
530 530 * flag, routes can be specified which not only specify the next-hop to
531 531 * be used when routing to a certain prefix, but also which outgoing
532 532 * interface should be used.
533 533 *
534 534 * Previously, interfaces would have unique addresses assigned to them
535 535 * and so the address assigned to a particular interface could be used
536 536 * to identify a particular interface. One exception to this was the
537 537 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
538 538 *
539 539 * With the advent of IPv6 and its link-local addresses, this
540 540 * restriction was relaxed and interfaces could share addresses between
541 541 * themselves. In fact, typically all of the link-local interfaces on
542 542 * an IPv6 node or router will have the same link-local address. In
543 543 * order to differentiate between these interfaces, the use of an
544 544 * interface index is necessary and this index can be carried inside a
545 545 * RTA_IFP sockaddr (which is actually a sockaddr_dl). One restriction
546 546 * of using the interface index, however, is that all of the ipif's that
547 547 * are part of an ill have the same index and so the RTA_IFP sockaddr
548 548 * cannot be used to differentiate between ipif's (or logical
549 549 * interfaces) that belong to the same ill (physical interface).
550 550 *
551 551 * For example, in the following case involving IPv4 interfaces and
552 552 * logical interfaces
553 553 *
554 554 * 192.0.2.32 255.255.255.224 192.0.2.33 U if0
555 555 * 192.0.2.32 255.255.255.224 192.0.2.34 U if0
556 556 * 192.0.2.32 255.255.255.224 192.0.2.35 U if0
557 557 *
558 558 * the ipif's corresponding to each of these interface routes can be
559 559 * uniquely identified by the "gateway" (actually interface address).
560 560 *
561 561 * In this case involving multiple IPv6 default routes to a particular
562 562 * link-local gateway, the use of RTA_IFP is necessary to specify which
563 563 * default route is of interest:
564 564 *
565 565 * default fe80::123:4567:89ab:cdef U if0
566 566 * default fe80::123:4567:89ab:cdef U if1
567 567 */
568 568
569 569 /* RTF_GATEWAY not set */
570 570 if (!(flags & RTF_GATEWAY)) {
571 571 if (sp != NULL) {
572 572 ip2dbg(("ip_rt_add_v6: gateway security attributes "
573 573 "cannot be set with interface route\n"));
574 574 if (ipif != NULL)
575 575 ipif_refrele(ipif);
576 576 return (EINVAL);
577 577 }
578 578
579 579 /*
580 580 * Whether or not ill (RTA_IFP) is set, we require that
581 581 * the gateway is one of our local addresses.
582 582 */
583 583 if (ipif == NULL)
584 584 return (ENETUNREACH);
585 585
586 586 /*
587 587 * We use MATCH_IRE_ILL here. If the caller specified an
588 588 * interface (from the RTA_IFP sockaddr) we use it, otherwise
589 589 * we use the ill derived from the gateway address.
590 590 * We can always match the gateway address since we record it
591 591 * in ire_gateway_addr.
592 592 * We don't allow RTA_IFP to specify a different ill than the
593 593 * one matching the ipif to make sure we can delete the route.
594 594 */
595 595 match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL;
596 596 if (ill == NULL) {
597 597 ill = ipif->ipif_ill;
598 598 } else if (ill != ipif->ipif_ill) {
599 599 ipif_refrele(ipif);
600 600 return (EINVAL);
601 601 }
602 602
603 603 /*
604 604 * We check for an existing entry at this point.
605 605 */
606 606 match_flags |= MATCH_IRE_MASK;
607 607 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr,
608 608 IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst,
609 609 NULL);
610 610 if (ire != NULL) {
611 611 ire_refrele(ire);
612 612 ipif_refrele(ipif);
613 613 return (EEXIST);
614 614 }
615 615
616 616 /*
617 617 * Some software (for example, GateD and Sun Cluster) attempts
618 618 * to create (what amount to) IRE_PREFIX routes with the
619 619 * loopback address as the gateway. This is primarily done to
620 620 * set up prefixes with the RTF_REJECT flag set (for example,
621 621 * when generating aggregate routes). We also OR in the
622 622 * RTF_BLACKHOLE flag as these interface routes, by
623 623 * definition, can only be that.
624 624 *
625 625 * If the IRE type (as defined by ill->ill_net_type) would be
626 626 * IRE_LOOPBACK, then we map the request into a
627 627 * IRE_IF_NORESOLVER.
628 628 *
629 629 * Needless to say, the real IRE_LOOPBACK is NOT created by this
630 630 * routine, but rather using ire_create_v6() directly.
631 631 */
632 632 type = ill->ill_net_type;
633 633 if (type == IRE_LOOPBACK) {
634 634 type = IRE_IF_NORESOLVER;
635 635 flags |= RTF_BLACKHOLE;
636 636 }
637 637
638 638 /*
639 639 * Create a copy of the IRE_IF_NORESOLVER or
640 640 * IRE_IF_RESOLVER with the modified address, netmask, and
641 641 * gateway.
642 642 */
643 643 ire = ire_create_v6(
644 644 dst_addr,
645 645 mask,
646 646 gw_addr,
647 647 type,
648 648 ill,
649 649 zoneid,
650 650 flags,
651 651 NULL,
652 652 ipst);
653 653 if (ire == NULL) {
654 654 ipif_refrele(ipif);
655 655 return (ENOMEM);
656 656 }
657 657
658 658 /* src address assigned by the caller? */
659 659 if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr))
660 660 ire->ire_setsrc_addr_v6 = *src_addr;
661 661
662 662 nire = ire_add(ire);
663 663 if (nire == NULL) {
664 664 /*
665 665 * In the result of failure, ire_add() will have
666 666 * already deleted the ire in question, so there
667 667 * is no need to do that here.
668 668 */
669 669 ipif_refrele(ipif);
670 670 return (ENOMEM);
671 671 }
672 672 /*
673 673 * Check if it was a duplicate entry. This handles
674 674 * the case of two racing route adds for the same route
675 675 */
676 676 if (nire != ire) {
677 677 ASSERT(nire->ire_identical_ref > 1);
678 678 ire_delete(nire);
679 679 ire_refrele(nire);
680 680 ipif_refrele(ipif);
681 681 return (EEXIST);
682 682 }
683 683 ire = nire;
684 684 goto save_ire;
685 685 }
686 686
687 687 /*
688 688 * Get an interface IRE for the specified gateway.
689 689 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
690 690 * gateway, it is currently unreachable and we fail the request
691 691 * accordingly. We reject any RTF_GATEWAY routes where the gateway
692 692 * is an IRE_LOCAL or IRE_LOOPBACK.
693 693 * If RTA_IFP was specified we look on that particular ill.
694 694 */
695 695 if (ill != NULL)
696 696 match_flags |= MATCH_IRE_ILL;
697 697
698 698 /* Check whether the gateway is reachable. */
699 699 again:
700 700 type = IRE_INTERFACE | IRE_LOCAL | IRE_LOOPBACK;
701 701 if (flags & RTF_INDIRECT)
702 702 type |= IRE_OFFLINK;
703 703
704 704 gw_ire = ire_ftable_lookup_v6(gw_addr, 0, 0, type, ill,
705 705 ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
706 706 if (gw_ire == NULL) {
707 707 /*
708 708 * With IPMP, we allow host routes to influence in.mpathd's
709 709 * target selection. However, if the test addresses are on
710 710 * their own network, the above lookup will fail since the
711 711 * underlying IRE_INTERFACEs are marked hidden. So allow
712 712 * hidden test IREs to be found and try again.
713 713 */
714 714 if (!(match_flags & MATCH_IRE_TESTHIDDEN)) {
715 715 match_flags |= MATCH_IRE_TESTHIDDEN;
716 716 goto again;
717 717 }
718 718 if (ipif != NULL)
719 719 ipif_refrele(ipif);
720 720 return (ENETUNREACH);
721 721 }
722 722 if (gw_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) {
723 723 ire_refrele(gw_ire);
724 724 if (ipif != NULL)
725 725 ipif_refrele(ipif);
726 726 return (ENETUNREACH);
727 727 }
728 728 if (ill == NULL && !(flags & RTF_INDIRECT)) {
729 729 unbound = B_TRUE;
730 730 if (ipst->ips_ipv6_strict_src_multihoming > 0)
731 731 ill = gw_ire->ire_ill;
732 732 }
733 733
734 734 /*
735 735 * We create one of three types of IREs as a result of this request
736 736 * based on the netmask. A netmask of all ones (which is automatically
737 737 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
738 738 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
739 739 * created. Otherwise, an IRE_PREFIX route is created for the
740 740 * destination prefix.
741 741 */
742 742 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
743 743 type = IRE_HOST;
744 744 else if (IN6_IS_ADDR_UNSPECIFIED(mask))
745 745 type = IRE_DEFAULT;
746 746 else
747 747 type = IRE_PREFIX;
748 748
749 749 /* check for a duplicate entry */
750 750 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type, ill,
751 751 ALL_ZONES, NULL,
752 752 match_flags | MATCH_IRE_MASK | MATCH_IRE_GW, 0, ipst, NULL);
753 753 if (ire != NULL) {
754 754 if (ipif != NULL)
755 755 ipif_refrele(ipif);
756 756 ire_refrele(gw_ire);
757 757 ire_refrele(ire);
758 758 return (EEXIST);
759 759 }
760 760
761 761 /* Security attribute exists */
762 762 if (sp != NULL) {
763 763 tsol_gcgrp_addr_t ga;
764 764
765 765 /* find or create the gateway credentials group */
766 766 ga.ga_af = AF_INET6;
767 767 ga.ga_addr = *gw_addr;
768 768
769 769 /* we hold reference to it upon success */
770 770 gcgrp = gcgrp_lookup(&ga, B_TRUE);
771 771 if (gcgrp == NULL) {
772 772 if (ipif != NULL)
773 773 ipif_refrele(ipif);
774 774 ire_refrele(gw_ire);
775 775 return (ENOMEM);
776 776 }
777 777
778 778 /*
779 779 * Create and add the security attribute to the group; a
780 780 * reference to the group is made upon allocating a new
781 781 * entry successfully. If it finds an already-existing
782 782 * entry for the security attribute in the group, it simply
783 783 * returns it and no new reference is made to the group.
784 784 */
785 785 gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
786 786 if (gc == NULL) {
787 787 /* release reference held by gcgrp_lookup */
788 788 GCGRP_REFRELE(gcgrp);
789 789 if (ipif != NULL)
790 790 ipif_refrele(ipif);
791 791 ire_refrele(gw_ire);
792 792 return (ENOMEM);
793 793 }
794 794 }
795 795
796 796 /* Create the IRE. */
797 797 ire = ire_create_v6(
798 798 dst_addr, /* dest address */
799 799 mask, /* mask */
800 800 gw_addr, /* gateway address */
801 801 (ushort_t)type, /* IRE type */
802 802 ill,
803 803 zoneid,
804 804 flags,
805 805 gc, /* security attribute */
806 806 ipst);
807 807
808 808 /*
809 809 * The ire holds a reference to the 'gc' and the 'gc' holds a
810 810 * reference to the 'gcgrp'. We can now release the extra reference
811 811 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
812 812 */
813 813 if (gcgrp_xtraref)
814 814 GCGRP_REFRELE(gcgrp);
815 815 if (ire == NULL) {
816 816 if (gc != NULL)
817 817 GC_REFRELE(gc);
818 818 if (ipif != NULL)
819 819 ipif_refrele(ipif);
820 820 ire_refrele(gw_ire);
821 821 return (ENOMEM);
822 822 }
823 823
824 824 /* src address assigned by the caller? */
825 825 if ((flags & RTF_SETSRC) && !IN6_IS_ADDR_UNSPECIFIED(src_addr))
826 826 ire->ire_setsrc_addr_v6 = *src_addr;
827 827
828 828 ire->ire_unbound = unbound;
829 829
830 830 /*
831 831 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
832 832 * SUN/OS socket stuff does but do we really want to allow ::0 ?
833 833 */
834 834
835 835 /* Add the new IRE. */
836 836 nire = ire_add(ire);
837 837 if (nire == NULL) {
838 838 /*
839 839 * In the result of failure, ire_add() will have
840 840 * already deleted the ire in question, so there
841 841 * is no need to do that here.
842 842 */
843 843 if (ipif != NULL)
844 844 ipif_refrele(ipif);
845 845 ire_refrele(gw_ire);
846 846 return (ENOMEM);
847 847 }
848 848 /*
849 849 * Check if it was a duplicate entry. This handles
850 850 * the case of two racing route adds for the same route
851 851 */
852 852 if (nire != ire) {
853 853 ASSERT(nire->ire_identical_ref > 1);
854 854 ire_delete(nire);
855 855 ire_refrele(nire);
856 856 if (ipif != NULL)
857 857 ipif_refrele(ipif);
858 858 ire_refrele(gw_ire);
859 859 return (EEXIST);
860 860 }
861 861 ire = nire;
862 862
863 863 if (flags & RTF_MULTIRT) {
864 864 /*
865 865 * Invoke the CGTP (multirouting) filtering module
866 866 * to add the dst address in the filtering database.
867 867 * Replicated inbound packets coming from that address
868 868 * will be filtered to discard the duplicates.
869 869 * It is not necessary to call the CGTP filter hook
870 870 * when the dst address is a multicast, because an
871 871 * IP source address cannot be a multicast.
872 872 */
873 873 if (ipst->ips_ip_cgtp_filter_ops != NULL &&
874 874 !IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6))) {
875 875 int res;
876 876 ipif_t *src_ipif;
877 877
878 878 /* Find the source address corresponding to gw_ire */
879 879 src_ipif = ipif_lookup_addr_v6(
880 880 &gw_ire->ire_gateway_addr_v6, NULL, zoneid, ipst);
881 881 if (src_ipif != NULL) {
882 882 res = ipst->ips_ip_cgtp_filter_ops->
883 883 cfo_add_dest_v6(
884 884 ipst->ips_netstack->netstack_stackid,
885 885 &ire->ire_addr_v6,
886 886 &ire->ire_gateway_addr_v6,
887 887 &ire->ire_setsrc_addr_v6,
888 888 &src_ipif->ipif_v6lcl_addr);
889 889 ipif_refrele(src_ipif);
890 890 } else {
891 891 res = EADDRNOTAVAIL;
892 892 }
893 893 if (res != 0) {
894 894 if (ipif != NULL)
895 895 ipif_refrele(ipif);
896 896 ire_refrele(gw_ire);
897 897 ire_delete(ire);
898 898 ire_refrele(ire); /* Held in ire_add */
899 899 return (res);
900 900 }
901 901 }
902 902 }
903 903
904 904 save_ire:
905 905 if (gw_ire != NULL) {
906 906 ire_refrele(gw_ire);
907 907 gw_ire = NULL;
908 908 }
909 909 if (ire->ire_ill != NULL) {
910 910 /*
911 911 * Save enough information so that we can recreate the IRE if
912 912 * the ILL goes down and then up. The metrics associated
913 913 * with the route will be saved as well when rts_setmetrics() is
914 914 * called after the IRE has been created. In the case where
915 915 * memory cannot be allocated, none of this information will be
916 916 * saved.
917 917 */
918 918 ill_save_ire(ire->ire_ill, ire);
919 919 }
920 920
921 921 if (ire_arg != NULL) {
922 922 /*
923 923 * Store the ire that was successfully added into where ire_arg
924 924 * points to so that callers don't have to look it up
925 925 * themselves (but they are responsible for ire_refrele()ing
926 926 * the ire when they are finished with it).
927 927 */
928 928 *ire_arg = ire;
929 929 } else {
930 930 ire_refrele(ire); /* Held in ire_add */
931 931 }
932 932 if (ipif != NULL)
933 933 ipif_refrele(ipif);
934 934 return (0);
935 935 }
936 936
937 937 /*
938 938 * ip_rt_delete_v6 is called to delete an IPv6 route.
939 939 * ill is passed in to associate it with the correct interface.
940 940 * (for link-local destinations and gateways).
941 941 */
942 942 /* ARGSUSED4 */
943 943 int
944 944 ip_rt_delete_v6(const in6_addr_t *dst_addr, const in6_addr_t *mask,
945 945 const in6_addr_t *gw_addr, uint_t rtm_addrs, int flags, ill_t *ill,
946 946 ip_stack_t *ipst, zoneid_t zoneid)
947 947 {
948 948 ire_t *ire = NULL;
949 949 ipif_t *ipif;
950 950 uint_t type;
951 951 uint_t match_flags = MATCH_IRE_TYPE;
952 952 int err = 0;
953 953
954 954 /*
955 955 * If this is the case of RTF_HOST being set, then we set the netmask
956 956 * to all ones. Otherwise, we use the netmask if one was supplied.
957 957 */
958 958 if (flags & RTF_HOST) {
959 959 mask = &ipv6_all_ones;
960 960 match_flags |= MATCH_IRE_MASK;
961 961 } else if (rtm_addrs & RTA_NETMASK) {
962 962 match_flags |= MATCH_IRE_MASK;
963 963 }
964 964
965 965 /*
966 966 * Note that RTF_GATEWAY is never set on a delete, therefore
967 967 * we check if the gateway address is one of our interfaces first,
968 968 * and fall back on RTF_GATEWAY routes.
969 969 *
970 970 * This makes it possible to delete an original
971 971 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
972 972 * However, we have RTF_KERNEL set on the ones created by ipif_up
973 973 * and those can not be deleted here.
974 974 *
975 975 * We use MATCH_IRE_ILL if we know the interface. If the caller
976 976 * specified an interface (from the RTA_IFP sockaddr) we use it,
977 977 * otherwise we use the ill derived from the gateway address.
978 978 * We can always match the gateway address since we record it
979 979 * in ire_gateway_addr.
980 980 *
981 981 * For more detail on specifying routes by gateway address and by
982 982 * interface index, see the comments in ip_rt_add_v6().
983 983 */
984 984 ipif = ipif_lookup_interface_v6(gw_addr, dst_addr, ipst);
985 985 if (ipif != NULL) {
986 986 ill_t *ill_match;
987 987
988 988 if (ill != NULL)
989 989 ill_match = ill;
990 990 else
991 991 ill_match = ipif->ipif_ill;
992 992
993 993 match_flags |= MATCH_IRE_ILL;
994 994 if (ipif->ipif_ire_type == IRE_LOOPBACK) {
995 995 ire = ire_ftable_lookup_v6(dst_addr, mask, 0,
996 996 IRE_LOOPBACK, ill_match, ALL_ZONES, NULL,
997 997 match_flags, 0, ipst, NULL);
998 998 }
999 999 if (ire == NULL) {
1000 1000 match_flags |= MATCH_IRE_GW;
1001 1001 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr,
1002 1002 IRE_INTERFACE, ill_match, ALL_ZONES, NULL,
1003 1003 match_flags, 0, ipst, NULL);
1004 1004 }
1005 1005 /* Avoid deleting routes created by kernel from an ipif */
1006 1006 if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) {
1007 1007 ire_refrele(ire);
1008 1008 ire = NULL;
1009 1009 }
1010 1010
1011 1011 /* Restore in case we didn't find a match */
1012 1012 match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL);
1013 1013 }
1014 1014
1015 1015 if (ire == NULL) {
1016 1016 /*
1017 1017 * At this point, the gateway address is not one of our own
1018 1018 * addresses or a matching interface route was not found. We
1019 1019 * set the IRE type to lookup based on whether
1020 1020 * this is a host route, a default route or just a prefix.
1021 1021 *
1022 1022 * If an ill was passed in, then the lookup is based on an
1023 1023 * interface index so MATCH_IRE_ILL is added to match_flags.
1024 1024 */
1025 1025 match_flags |= MATCH_IRE_GW;
1026 1026 if (ill != NULL)
1027 1027 match_flags |= MATCH_IRE_ILL;
1028 1028 if (IN6_ARE_ADDR_EQUAL(mask, &ipv6_all_ones))
1029 1029 type = IRE_HOST;
1030 1030 else if (IN6_IS_ADDR_UNSPECIFIED(mask))
1031 1031 type = IRE_DEFAULT;
1032 1032 else
1033 1033 type = IRE_PREFIX;
1034 1034 ire = ire_ftable_lookup_v6(dst_addr, mask, gw_addr, type,
1035 1035 ill, ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
1036 1036 }
1037 1037
1038 1038 if (ipif != NULL) {
1039 1039 ipif_refrele(ipif);
1040 1040 ipif = NULL;
1041 1041 }
1042 1042 if (ire == NULL)
1043 1043 return (ESRCH);
1044 1044
1045 1045 if (ire->ire_flags & RTF_MULTIRT) {
1046 1046 /*
1047 1047 * Invoke the CGTP (multirouting) filtering module
1048 1048 * to remove the dst address from the filtering database.
1049 1049 * Packets coming from that address will no longer be
1050 1050 * filtered to remove duplicates.
1051 1051 */
1052 1052 if (ipst->ips_ip_cgtp_filter_ops != NULL) {
1053 1053 err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v6(
1054 1054 ipst->ips_netstack->netstack_stackid,
1055 1055 &ire->ire_addr_v6, &ire->ire_gateway_addr_v6);
1056 1056 }
1057 1057 }
1058 1058
1059 1059 ill = ire->ire_ill;
1060 1060 if (ill != NULL)
1061 1061 ill_remove_saved_ire(ill, ire);
1062 1062 ire_delete(ire);
1063 1063 ire_refrele(ire);
1064 1064 return (err);
1065 1065 }
1066 1066
1067 1067 /*
1068 1068 * Derive an interface id from the link layer address.
1069 1069 */
1070 1070 void
1071 1071 ill_setdefaulttoken(ill_t *ill)
1072 1072 {
1073 1073 if (!ill->ill_manual_token) {
1074 1074 bzero(&ill->ill_token, sizeof (ill->ill_token));
1075 1075 MEDIA_V6INTFID(ill->ill_media, ill, &ill->ill_token);
1076 1076 ill->ill_token_length = IPV6_TOKEN_LEN;
1077 1077 }
1078 1078 }
1079 1079
1080 1080 void
1081 1081 ill_setdesttoken(ill_t *ill)
1082 1082 {
1083 1083 bzero(&ill->ill_dest_token, sizeof (ill->ill_dest_token));
1084 1084 MEDIA_V6DESTINTFID(ill->ill_media, ill, &ill->ill_dest_token);
1085 1085 }
1086 1086
1087 1087 /*
1088 1088 * Create a link-local address from a token.
1089 1089 */
1090 1090 static void
1091 1091 ipif_get_linklocal(in6_addr_t *dest, const in6_addr_t *token)
1092 1092 {
1093 1093 int i;
1094 1094
1095 1095 for (i = 0; i < 4; i++) {
1096 1096 dest->s6_addr32[i] =
1097 1097 token->s6_addr32[i] | ipv6_ll_template.s6_addr32[i];
1098 1098 }
1099 1099 }
1100 1100
1101 1101 /*
1102 1102 * Set a default IPv6 address for a 6to4 tunnel interface 2002:<tsrc>::1/16
1103 1103 */
1104 1104 static void
1105 1105 ipif_set6to4addr(ipif_t *ipif)
1106 1106 {
1107 1107 ill_t *ill = ipif->ipif_ill;
1108 1108 struct in_addr v4phys;
1109 1109
1110 1110 ASSERT(ill->ill_mactype == DL_6TO4);
1111 1111 ASSERT(ill->ill_phys_addr_length == sizeof (struct in_addr));
1112 1112 ASSERT(ipif->ipif_isv6);
1113 1113
1114 1114 if (ipif->ipif_flags & IPIF_UP)
1115 1115 return;
1116 1116
1117 1117 (void) ip_plen_to_mask_v6(16, &ipif->ipif_v6net_mask);
1118 1118 bcopy(ill->ill_phys_addr, &v4phys, sizeof (struct in_addr));
1119 1119 IN6_V4ADDR_TO_6TO4(&v4phys, &ipif->ipif_v6lcl_addr);
1120 1120 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
1121 1121 ipif->ipif_v6subnet);
1122 1122 }
1123 1123
1124 1124 /*
1125 1125 * Is it not possible to set the link local address?
1126 1126 * The address can be set if the token is set, and the token
1127 1127 * isn't too long.
1128 1128 * Return B_TRUE if the address can't be set, or B_FALSE if it can.
1129 1129 */
1130 1130 boolean_t
1131 1131 ipif_cant_setlinklocal(ipif_t *ipif)
1132 1132 {
1133 1133 ill_t *ill = ipif->ipif_ill;
1134 1134
1135 1135 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token) ||
1136 1136 ill->ill_token_length > IPV6_ABITS - IPV6_LL_PREFIXLEN)
1137 1137 return (B_TRUE);
1138 1138
1139 1139 return (B_FALSE);
1140 1140 }
1141 1141
1142 1142 /*
1143 1143 * Generate a link-local address from the token.
1144 1144 */
1145 1145 void
1146 1146 ipif_setlinklocal(ipif_t *ipif)
1147 1147 {
1148 1148 ill_t *ill = ipif->ipif_ill;
1149 1149 in6_addr_t ov6addr;
1150 1150
1151 1151 ASSERT(IAM_WRITER_ILL(ill));
1152 1152
1153 1153 /*
1154 1154 * If the interface was created with no link-local address
1155 1155 * on it and the flag ILLF_NOLINKLOCAL was set, then we
1156 1156 * dont want to update the link-local.
1157 1157 */
1158 1158 if ((ill->ill_flags & ILLF_NOLINKLOCAL) &&
1159 1159 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
1160 1160 return;
1161 1161 /*
1162 1162 * ill_manual_linklocal is set when the link-local address was
1163 1163 * manually configured.
1164 1164 */
1165 1165 if (ill->ill_manual_linklocal)
1166 1166 return;
1167 1167
1168 1168 /*
1169 1169 * IPv6 interfaces over 6to4 tunnels are special. They do not have
1170 1170 * link-local addresses, but instead have a single automatically
1171 1171 * generated global address.
1172 1172 */
1173 1173 if (ill->ill_mactype == DL_6TO4) {
1174 1174 ipif_set6to4addr(ipif);
1175 1175 return;
1176 1176 }
1177 1177
1178 1178 if (ipif_cant_setlinklocal(ipif))
1179 1179 return;
1180 1180
1181 1181 ov6addr = ipif->ipif_v6lcl_addr;
1182 1182 ipif_get_linklocal(&ipif->ipif_v6lcl_addr, &ill->ill_token);
1183 1183 sctp_update_ipif_addr(ipif, ov6addr);
1184 1184 (void) ip_plen_to_mask_v6(IPV6_LL_PREFIXLEN, &ipif->ipif_v6net_mask);
1185 1185 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)) {
1186 1186 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
1187 1187 ipif->ipif_v6subnet);
1188 1188 }
1189 1189
1190 1190 ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
1191 1191 }
1192 1192
1193 1193 /*
1194 1194 * Generate a destination link-local address for a point-to-point IPv6
1195 1195 * interface with a destination interface id (IP tunnels are such interfaces)
1196 1196 * based on the destination token.
1197 1197 */
1198 1198 void
1199 1199 ipif_setdestlinklocal(ipif_t *ipif)
1200 1200 {
1201 1201 ill_t *ill = ipif->ipif_ill;
1202 1202
1203 1203 ASSERT(IAM_WRITER_ILL(ill));
1204 1204
1205 1205 if (ill->ill_manual_dst_linklocal)
1206 1206 return;
1207 1207
1208 1208 if (IN6_IS_ADDR_UNSPECIFIED(&ill->ill_dest_token))
1209 1209 return;
1210 1210
1211 1211 ipif_get_linklocal(&ipif->ipif_v6pp_dst_addr, &ill->ill_dest_token);
1212 1212 ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
1213 1213 }
1214 1214
1215 1215 /*
1216 1216 * Get the resolver set up for a new ipif. (Always called as writer.)
1217 1217 */
1218 1218 int
1219 1219 ipif_ndp_up(ipif_t *ipif, boolean_t initial)
1220 1220 {
1221 1221 ill_t *ill = ipif->ipif_ill;
1222 1222 int err = 0;
1223 1223 nce_t *nce = NULL;
1224 1224 boolean_t added_ipif = B_FALSE;
1225 1225
1226 1226 DTRACE_PROBE3(ipif__downup, char *, "ipif_ndp_up",
1227 1227 ill_t *, ill, ipif_t *, ipif);
1228 1228 ip1dbg(("ipif_ndp_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
1229 1229
1230 1230 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) ||
1231 1231 (!(ill->ill_net_type & IRE_INTERFACE))) {
1232 1232 ipif->ipif_addr_ready = 1;
1233 1233 return (0);
1234 1234 }
1235 1235
1236 1236 if ((ipif->ipif_flags & (IPIF_UNNUMBERED|IPIF_NOLOCAL)) == 0) {
1237 1237 uint16_t flags;
1238 1238 uint16_t state;
1239 1239 uchar_t *hw_addr;
1240 1240 ill_t *bound_ill;
1241 1241 ipmp_illgrp_t *illg = ill->ill_grp;
1242 1242 uint_t hw_addr_len;
1243 1243
1244 1244 flags = NCE_F_MYADDR | NCE_F_NONUD | NCE_F_PUBLISH |
1245 1245 NCE_F_AUTHORITY;
1246 1246 if (ill->ill_flags & ILLF_ROUTER)
1247 1247 flags |= NCE_F_ISROUTER;
1248 1248
1249 1249 if (ipif->ipif_flags & IPIF_ANYCAST)
1250 1250 flags |= NCE_F_ANYCAST;
1251 1251
1252 1252 if (IS_IPMP(ill)) {
1253 1253 ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
1254 1254 /*
1255 1255 * If we're here via ipif_up(), then the ipif won't be
1256 1256 * bound yet -- add it to the group, which will bind
1257 1257 * it if possible. (We would add it in ipif_up(), but
1258 1258 * deleting on failure there is gruesome.) If we're
1259 1259 * here via ipmp_ill_bind_ipif(), then the ipif has
1260 1260 * already been added to the group and we just need to
1261 1261 * use the binding.
1262 1262 */
1263 1263 if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) {
1264 1264 bound_ill = ipmp_illgrp_add_ipif(illg, ipif);
1265 1265 if (bound_ill == NULL) {
1266 1266 /*
1267 1267 * We couldn't bind the ipif to an ill
1268 1268 * yet, so we have nothing to publish.
1269 1269 * Set ipif_addr_ready so that this
1270 1270 * address can be used locally for now.
1271 1271 * The routing socket message will be
1272 1272 * sent from ipif_up_done_v6().
1273 1273 */
1274 1274 ipif->ipif_addr_ready = 1;
1275 1275 return (0);
1276 1276 }
1277 1277 added_ipif = B_TRUE;
1278 1278 }
1279 1279 hw_addr = bound_ill->ill_nd_lla;
1280 1280 hw_addr_len = bound_ill->ill_phys_addr_length;
1281 1281 } else {
1282 1282 bound_ill = ill;
1283 1283 hw_addr = ill->ill_nd_lla;
1284 1284 hw_addr_len = ill->ill_phys_addr_length;
1285 1285 }
1286 1286
1287 1287 /*
1288 1288 * If this is an initial bring-up (or the ipif was never
1289 1289 * completely brought up), do DAD. Otherwise, we're here
1290 1290 * because IPMP has rebound an address to this ill: send
1291 1291 * unsolicited advertisements to inform others.
1292 1292 */
1293 1293 if (initial || !ipif->ipif_addr_ready) {
1294 1294 /* Causes Duplicate Address Detection to run */
1295 1295 state = ND_PROBE;
1296 1296 } else {
1297 1297 state = ND_REACHABLE;
1298 1298 flags |= NCE_F_UNSOL_ADV;
1299 1299 }
1300 1300
1301 1301 retry:
1302 1302 err = nce_lookup_then_add_v6(ill, hw_addr, hw_addr_len,
1303 1303 &ipif->ipif_v6lcl_addr, flags, state, &nce);
1304 1304 switch (err) {
1305 1305 case 0:
1306 1306 ip1dbg(("ipif_ndp_up: NCE created for %s\n",
1307 1307 ill->ill_name));
1308 1308 ipif->ipif_addr_ready = 1;
1309 1309 ipif->ipif_added_nce = 1;
1310 1310 nce->nce_ipif_cnt++;
1311 1311 break;
1312 1312 case EINPROGRESS:
1313 1313 ip1dbg(("ipif_ndp_up: running DAD now for %s\n",
1314 1314 ill->ill_name));
1315 1315 ipif->ipif_added_nce = 1;
1316 1316 nce->nce_ipif_cnt++;
1317 1317 break;
1318 1318 case EEXIST:
1319 1319 ip1dbg(("ipif_ndp_up: NCE already exists for %s\n",
1320 1320 ill->ill_name));
1321 1321 if (!NCE_MYADDR(nce->nce_common)) {
1322 1322 /*
1323 1323 * A leftover nce from before this address
1324 1324 * existed
1325 1325 */
1326 1326 ncec_delete(nce->nce_common);
1327 1327 nce_refrele(nce);
1328 1328 nce = NULL;
1329 1329 goto retry;
1330 1330 }
1331 1331 if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
1332 1332 nce_refrele(nce);
1333 1333 nce = NULL;
1334 1334 ip1dbg(("ipif_ndp_up: NCE already exists "
1335 1335 "for %s\n", ill->ill_name));
1336 1336 goto fail;
1337 1337 }
1338 1338 /*
1339 1339 * Duplicate local addresses are permissible for
1340 1340 * IPIF_POINTOPOINT interfaces which will get marked
1341 1341 * IPIF_UNNUMBERED later in
1342 1342 * ip_addr_availability_check().
1343 1343 *
1344 1344 * The nce_ipif_cnt field tracks the number of
1345 1345 * ipifs that have nce_addr as their local address.
1346 1346 */
1347 1347 ipif->ipif_addr_ready = 1;
1348 1348 ipif->ipif_added_nce = 1;
1349 1349 nce->nce_ipif_cnt++;
1350 1350 err = 0;
1351 1351 break;
1352 1352 default:
1353 1353 ip1dbg(("ipif_ndp_up: NCE creation failed for %s\n",
1354 1354 ill->ill_name));
1355 1355 goto fail;
1356 1356 }
1357 1357 } else {
1358 1358 /* No local NCE for this entry */
1359 1359 ipif->ipif_addr_ready = 1;
1360 1360 }
1361 1361 if (nce != NULL)
1362 1362 nce_refrele(nce);
1363 1363 return (0);
1364 1364 fail:
1365 1365 if (added_ipif)
1366 1366 ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
1367 1367
1368 1368 return (err);
1369 1369 }
1370 1370
1371 1371 /* Remove all cache entries for this logical interface */
1372 1372 void
1373 1373 ipif_ndp_down(ipif_t *ipif)
1374 1374 {
1375 1375 ipif_nce_down(ipif);
1376 1376 }
1377 1377
1378 1378 /*
1379 1379 * Return the scope of the given IPv6 address. If the address is an
1380 1380 * IPv4 mapped IPv6 address, return the scope of the corresponding
1381 1381 * IPv4 address.
1382 1382 */
1383 1383 in6addr_scope_t
1384 1384 ip_addr_scope_v6(const in6_addr_t *addr)
1385 1385 {
1386 1386 static in6_addr_t ipv6loopback = IN6ADDR_LOOPBACK_INIT;
1387 1387
1388 1388 if (IN6_IS_ADDR_V4MAPPED(addr)) {
1389 1389 in_addr_t v4addr_h = ntohl(V4_PART_OF_V6((*addr)));
1390 1390 if ((v4addr_h >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
1391 1391 (v4addr_h & IN_AUTOCONF_MASK) == IN_AUTOCONF_NET)
1392 1392 return (IP6_SCOPE_LINKLOCAL);
1393 1393 if ((v4addr_h & IN_PRIVATE8_MASK) == IN_PRIVATE8_NET ||
1394 1394 (v4addr_h & IN_PRIVATE12_MASK) == IN_PRIVATE12_NET ||
1395 1395 (v4addr_h & IN_PRIVATE16_MASK) == IN_PRIVATE16_NET)
1396 1396 return (IP6_SCOPE_SITELOCAL);
1397 1397 return (IP6_SCOPE_GLOBAL);
1398 1398 }
1399 1399
1400 1400 if (IN6_IS_ADDR_MULTICAST(addr))
1401 1401 return (IN6_ADDR_MC_SCOPE(addr));
1402 1402
1403 1403 /* link-local and loopback addresses are of link-local scope */
1404 1404 if (IN6_IS_ADDR_LINKLOCAL(addr) ||
1405 1405 IN6_ARE_ADDR_EQUAL(addr, &ipv6loopback))
1406 1406 return (IP6_SCOPE_LINKLOCAL);
1407 1407 if (IN6_IS_ADDR_SITELOCAL(addr))
1408 1408 return (IP6_SCOPE_SITELOCAL);
1409 1409 return (IP6_SCOPE_GLOBAL);
1410 1410 }
1411 1411
1412 1412
1413 1413 /*
1414 1414 * Returns the length of the common prefix of a1 and a2, as per
1415 1415 * CommonPrefixLen() defined in RFC 3484.
1416 1416 */
1417 1417 static int
1418 1418 ip_common_prefix_v6(const in6_addr_t *a1, const in6_addr_t *a2)
1419 1419 {
1420 1420 int i;
1421 1421 uint32_t a1val, a2val, mask;
1422 1422
1423 1423 for (i = 0; i < 4; i++) {
1424 1424 if ((a1val = a1->s6_addr32[i]) != (a2val = a2->s6_addr32[i])) {
1425 1425 a1val ^= a2val;
1426 1426 i *= 32;
1427 1427 mask = 0x80000000u;
1428 1428 while (!(a1val & mask)) {
1429 1429 mask >>= 1;
1430 1430 i++;
1431 1431 }
1432 1432 return (i);
1433 1433 }
1434 1434 }
1435 1435 return (IPV6_ABITS);
1436 1436 }
1437 1437
1438 1438 #define IPIF_VALID_IPV6_SOURCE(ipif) \
1439 1439 (((ipif)->ipif_flags & IPIF_UP) && \
1440 1440 !((ipif)->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST)) && \
1441 1441 !((ipif)->ipif_ill->ill_flags & ILLF_NOACCEPT))
1442 1442
1443 1443 /* source address candidate */
1444 1444 typedef struct candidate {
1445 1445 ipif_t *cand_ipif;
1446 1446 /* The properties of this candidate */
1447 1447 boolean_t cand_isdst;
1448 1448 boolean_t cand_isdst_set;
1449 1449 in6addr_scope_t cand_scope;
1450 1450 boolean_t cand_scope_set;
1451 1451 boolean_t cand_isdeprecated;
1452 1452 boolean_t cand_isdeprecated_set;
1453 1453 boolean_t cand_ispreferred;
1454 1454 boolean_t cand_ispreferred_set;
1455 1455 boolean_t cand_matchedinterface;
1456 1456 boolean_t cand_matchedinterface_set;
1457 1457 boolean_t cand_matchedlabel;
1458 1458 boolean_t cand_matchedlabel_set;
1459 1459 boolean_t cand_istmp;
1460 1460 boolean_t cand_istmp_set;
1461 1461 int cand_common_pref;
1462 1462 boolean_t cand_common_pref_set;
1463 1463 boolean_t cand_pref_eq;
1464 1464 boolean_t cand_pref_eq_set;
1465 1465 int cand_pref_len;
1466 1466 boolean_t cand_pref_len_set;
1467 1467 } cand_t;
1468 1468 #define cand_srcaddr cand_ipif->ipif_v6lcl_addr
1469 1469 #define cand_mask cand_ipif->ipif_v6net_mask
1470 1470 #define cand_flags cand_ipif->ipif_flags
1471 1471 #define cand_ill cand_ipif->ipif_ill
1472 1472 #define cand_zoneid cand_ipif->ipif_zoneid
1473 1473
1474 1474 /* information about the destination for source address selection */
1475 1475 typedef struct dstinfo {
1476 1476 const in6_addr_t *dst_addr;
1477 1477 ill_t *dst_ill;
1478 1478 uint_t dst_restrict_ill;
1479 1479 boolean_t dst_prefer_src_tmp;
1480 1480 in6addr_scope_t dst_scope;
1481 1481 char *dst_label;
1482 1482 } dstinfo_t;
1483 1483
1484 1484 /*
1485 1485 * The following functions are rules used to select a source address in
1486 1486 * ipif_select_source_v6(). Each rule compares a current candidate (cc)
1487 1487 * against the best candidate (bc). Each rule has three possible outcomes;
1488 1488 * the candidate is preferred over the best candidate (CAND_PREFER), the
1489 1489 * candidate is not preferred over the best candidate (CAND_AVOID), or the
1490 1490 * candidate is of equal value as the best candidate (CAND_TIE).
1491 1491 *
1492 1492 * These rules are part of a greater "Default Address Selection for IPv6"
1493 1493 * sheme, which is standards based work coming out of the IETF ipv6 working
1494 1494 * group. The IETF document defines both IPv6 source address selection and
1495 1495 * destination address ordering. The rules defined here implement the IPv6
1496 1496 * source address selection. Destination address ordering is done by
1497 1497 * libnsl, and uses a similar set of rules to implement the sorting.
1498 1498 *
1499 1499 * Most of the rules are defined by the RFC and are not typically altered. The
1500 1500 * last rule, number 8, has language that allows for local preferences. In the
1501 1501 * scheme below, this means that new Solaris rules should normally go between
1502 1502 * rule_ifprefix and rule_prefix.
1503 1503 */
1504 1504 typedef enum {CAND_AVOID, CAND_TIE, CAND_PREFER} rule_res_t;
1505 1505 typedef rule_res_t (*rulef_t)(cand_t *, cand_t *, const dstinfo_t *,
1506 1506 ip_stack_t *);
1507 1507
1508 1508 /* Prefer an address if it is equal to the destination address. */
1509 1509 /* ARGSUSED3 */
1510 1510 static rule_res_t
1511 1511 rule_isdst(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1512 1512 {
1513 1513 if (!bc->cand_isdst_set) {
1514 1514 bc->cand_isdst =
1515 1515 IN6_ARE_ADDR_EQUAL(&bc->cand_srcaddr, dstinfo->dst_addr);
1516 1516 bc->cand_isdst_set = B_TRUE;
1517 1517 }
1518 1518
1519 1519 cc->cand_isdst =
1520 1520 IN6_ARE_ADDR_EQUAL(&cc->cand_srcaddr, dstinfo->dst_addr);
1521 1521 cc->cand_isdst_set = B_TRUE;
1522 1522
1523 1523 if (cc->cand_isdst == bc->cand_isdst)
1524 1524 return (CAND_TIE);
1525 1525 else if (cc->cand_isdst)
1526 1526 return (CAND_PREFER);
1527 1527 else
1528 1528 return (CAND_AVOID);
1529 1529 }
1530 1530
1531 1531 /*
1532 1532 * Prefer addresses that are of closest scope to the destination. Always
1533 1533 * prefer addresses that are of greater scope than the destination over
1534 1534 * those that are of lesser scope than the destination.
1535 1535 */
1536 1536 /* ARGSUSED3 */
1537 1537 static rule_res_t
1538 1538 rule_scope(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1539 1539 {
1540 1540 if (!bc->cand_scope_set) {
1541 1541 bc->cand_scope = ip_addr_scope_v6(&bc->cand_srcaddr);
1542 1542 bc->cand_scope_set = B_TRUE;
1543 1543 }
1544 1544
1545 1545 cc->cand_scope = ip_addr_scope_v6(&cc->cand_srcaddr);
1546 1546 cc->cand_scope_set = B_TRUE;
1547 1547
1548 1548 if (cc->cand_scope < bc->cand_scope) {
1549 1549 if (cc->cand_scope < dstinfo->dst_scope)
1550 1550 return (CAND_AVOID);
1551 1551 else
1552 1552 return (CAND_PREFER);
1553 1553 } else if (bc->cand_scope < cc->cand_scope) {
1554 1554 if (bc->cand_scope < dstinfo->dst_scope)
1555 1555 return (CAND_PREFER);
1556 1556 else
1557 1557 return (CAND_AVOID);
1558 1558 } else {
1559 1559 return (CAND_TIE);
1560 1560 }
1561 1561 }
1562 1562
1563 1563 /*
1564 1564 * Prefer non-deprecated source addresses.
1565 1565 */
1566 1566 /* ARGSUSED2 */
1567 1567 static rule_res_t
1568 1568 rule_deprecated(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1569 1569 ip_stack_t *ipst)
1570 1570 {
1571 1571 if (!bc->cand_isdeprecated_set) {
1572 1572 bc->cand_isdeprecated =
1573 1573 ((bc->cand_flags & IPIF_DEPRECATED) != 0);
1574 1574 bc->cand_isdeprecated_set = B_TRUE;
1575 1575 }
1576 1576
1577 1577 cc->cand_isdeprecated = ((cc->cand_flags & IPIF_DEPRECATED) != 0);
1578 1578 cc->cand_isdeprecated_set = B_TRUE;
1579 1579
1580 1580 if (bc->cand_isdeprecated == cc->cand_isdeprecated)
1581 1581 return (CAND_TIE);
1582 1582 else if (cc->cand_isdeprecated)
1583 1583 return (CAND_AVOID);
1584 1584 else
1585 1585 return (CAND_PREFER);
1586 1586 }
1587 1587
1588 1588 /*
1589 1589 * Prefer source addresses that have the IPIF_PREFERRED flag set. This
1590 1590 * rule must be before rule_interface because the flag could be set on any
1591 1591 * interface, not just the interface being used for outgoing packets (for
1592 1592 * example, the IFF_PREFERRED could be set on an address assigned to the
1593 1593 * loopback interface).
1594 1594 */
1595 1595 /* ARGSUSED2 */
1596 1596 static rule_res_t
1597 1597 rule_preferred(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1598 1598 ip_stack_t *ipst)
1599 1599 {
1600 1600 if (!bc->cand_ispreferred_set) {
1601 1601 bc->cand_ispreferred = ((bc->cand_flags & IPIF_PREFERRED) != 0);
1602 1602 bc->cand_ispreferred_set = B_TRUE;
1603 1603 }
1604 1604
1605 1605 cc->cand_ispreferred = ((cc->cand_flags & IPIF_PREFERRED) != 0);
1606 1606 cc->cand_ispreferred_set = B_TRUE;
1607 1607
1608 1608 if (bc->cand_ispreferred == cc->cand_ispreferred)
1609 1609 return (CAND_TIE);
1610 1610 else if (cc->cand_ispreferred)
1611 1611 return (CAND_PREFER);
1612 1612 else
1613 1613 return (CAND_AVOID);
1614 1614 }
1615 1615
1616 1616 /*
1617 1617 * Prefer source addresses that are assigned to the outgoing interface.
1618 1618 */
1619 1619 /* ARGSUSED3 */
1620 1620 static rule_res_t
1621 1621 rule_interface(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1622 1622 ip_stack_t *ipst)
1623 1623 {
1624 1624 ill_t *dstill = dstinfo->dst_ill;
1625 1625
1626 1626 /*
1627 1627 * If dstinfo->dst_restrict_ill is set, this rule is unnecessary
1628 1628 * since we know all candidates will be on the same link.
1629 1629 */
1630 1630 if (dstinfo->dst_restrict_ill)
1631 1631 return (CAND_TIE);
1632 1632
1633 1633 if (!bc->cand_matchedinterface_set) {
1634 1634 bc->cand_matchedinterface = bc->cand_ill == dstill;
1635 1635 bc->cand_matchedinterface_set = B_TRUE;
1636 1636 }
1637 1637
1638 1638 cc->cand_matchedinterface = cc->cand_ill == dstill;
1639 1639 cc->cand_matchedinterface_set = B_TRUE;
1640 1640
1641 1641 if (bc->cand_matchedinterface == cc->cand_matchedinterface)
1642 1642 return (CAND_TIE);
1643 1643 else if (cc->cand_matchedinterface)
1644 1644 return (CAND_PREFER);
1645 1645 else
1646 1646 return (CAND_AVOID);
1647 1647 }
1648 1648
1649 1649 /*
1650 1650 * Prefer source addresses whose label matches the destination's label.
1651 1651 */
1652 1652 static rule_res_t
1653 1653 rule_label(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1654 1654 {
1655 1655 char *label;
1656 1656
1657 1657 if (!bc->cand_matchedlabel_set) {
1658 1658 label = ip6_asp_lookup(&bc->cand_srcaddr, NULL, ipst);
1659 1659 bc->cand_matchedlabel =
1660 1660 ip6_asp_labelcmp(label, dstinfo->dst_label);
1661 1661 bc->cand_matchedlabel_set = B_TRUE;
1662 1662 }
1663 1663
1664 1664 label = ip6_asp_lookup(&cc->cand_srcaddr, NULL, ipst);
1665 1665 cc->cand_matchedlabel = ip6_asp_labelcmp(label, dstinfo->dst_label);
1666 1666 cc->cand_matchedlabel_set = B_TRUE;
1667 1667
1668 1668 if (bc->cand_matchedlabel == cc->cand_matchedlabel)
1669 1669 return (CAND_TIE);
1670 1670 else if (cc->cand_matchedlabel)
1671 1671 return (CAND_PREFER);
1672 1672 else
1673 1673 return (CAND_AVOID);
1674 1674 }
1675 1675
1676 1676 /*
1677 1677 * Prefer public addresses over temporary ones. An application can reverse
1678 1678 * the logic of this rule and prefer temporary addresses by using the
1679 1679 * IPV6_SRC_PREFERENCES socket option.
1680 1680 */
1681 1681 /* ARGSUSED3 */
1682 1682 static rule_res_t
1683 1683 rule_temporary(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1684 1684 ip_stack_t *ipst)
1685 1685 {
1686 1686 if (!bc->cand_istmp_set) {
1687 1687 bc->cand_istmp = ((bc->cand_flags & IPIF_TEMPORARY) != 0);
1688 1688 bc->cand_istmp_set = B_TRUE;
1689 1689 }
1690 1690
1691 1691 cc->cand_istmp = ((cc->cand_flags & IPIF_TEMPORARY) != 0);
1692 1692 cc->cand_istmp_set = B_TRUE;
1693 1693
1694 1694 if (bc->cand_istmp == cc->cand_istmp)
1695 1695 return (CAND_TIE);
1696 1696
1697 1697 if (dstinfo->dst_prefer_src_tmp && cc->cand_istmp)
1698 1698 return (CAND_PREFER);
1699 1699 else if (!dstinfo->dst_prefer_src_tmp && !cc->cand_istmp)
1700 1700 return (CAND_PREFER);
1701 1701 else
1702 1702 return (CAND_AVOID);
1703 1703 }
1704 1704
1705 1705 /*
1706 1706 * Prefer source addresses with longer matching prefix with the destination
1707 1707 * under the interface mask. This gets us on the same subnet before applying
1708 1708 * any Solaris-specific rules.
1709 1709 */
1710 1710 /* ARGSUSED3 */
1711 1711 static rule_res_t
1712 1712 rule_ifprefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1713 1713 ip_stack_t *ipst)
1714 1714 {
1715 1715 if (!bc->cand_pref_eq_set) {
1716 1716 bc->cand_pref_eq = V6_MASK_EQ_2(bc->cand_srcaddr,
1717 1717 bc->cand_mask, *dstinfo->dst_addr);
1718 1718 bc->cand_pref_eq_set = B_TRUE;
1719 1719 }
1720 1720
1721 1721 cc->cand_pref_eq = V6_MASK_EQ_2(cc->cand_srcaddr, cc->cand_mask,
1722 1722 *dstinfo->dst_addr);
1723 1723 cc->cand_pref_eq_set = B_TRUE;
1724 1724
1725 1725 if (bc->cand_pref_eq) {
1726 1726 if (cc->cand_pref_eq) {
1727 1727 if (!bc->cand_pref_len_set) {
1728 1728 bc->cand_pref_len =
1729 1729 ip_mask_to_plen_v6(&bc->cand_mask);
1730 1730 bc->cand_pref_len_set = B_TRUE;
1731 1731 }
1732 1732 cc->cand_pref_len = ip_mask_to_plen_v6(&cc->cand_mask);
1733 1733 cc->cand_pref_len_set = B_TRUE;
1734 1734 if (bc->cand_pref_len == cc->cand_pref_len)
1735 1735 return (CAND_TIE);
1736 1736 else if (bc->cand_pref_len > cc->cand_pref_len)
1737 1737 return (CAND_AVOID);
1738 1738 else
1739 1739 return (CAND_PREFER);
1740 1740 } else {
1741 1741 return (CAND_AVOID);
1742 1742 }
1743 1743 } else {
1744 1744 if (cc->cand_pref_eq)
1745 1745 return (CAND_PREFER);
1746 1746 else
1747 1747 return (CAND_TIE);
1748 1748 }
1749 1749 }
1750 1750
1751 1751 /*
1752 1752 * Prefer to use zone-specific addresses when possible instead of all-zones
1753 1753 * addresses.
1754 1754 */
1755 1755 /* ARGSUSED2 */
1756 1756 static rule_res_t
1757 1757 rule_zone_specific(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1758 1758 ip_stack_t *ipst)
1759 1759 {
1760 1760 if ((bc->cand_zoneid == ALL_ZONES) ==
1761 1761 (cc->cand_zoneid == ALL_ZONES))
1762 1762 return (CAND_TIE);
1763 1763 else if (cc->cand_zoneid == ALL_ZONES)
1764 1764 return (CAND_AVOID);
1765 1765 else
1766 1766 return (CAND_PREFER);
1767 1767 }
1768 1768
1769 1769 /*
1770 1770 * Prefer to use DHCPv6 (first) and static addresses (second) when possible
1771 1771 * instead of statelessly autoconfigured addresses.
1772 1772 *
1773 1773 * This is done after trying all other preferences (and before the final tie
1774 1774 * breaker) so that, if all else is equal, we select addresses configured by
1775 1775 * DHCPv6 over other addresses. We presume that DHCPv6 addresses, unlike
1776 1776 * stateless autoconfigured addresses, are deliberately configured by an
1777 1777 * administrator, and thus are correctly set up in DNS and network packet
1778 1778 * filters.
1779 1779 */
1780 1780 /* ARGSUSED2 */
1781 1781 static rule_res_t
1782 1782 rule_addr_type(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1783 1783 ip_stack_t *ipst)
1784 1784 {
1785 1785 #define ATYPE(x) \
1786 1786 ((x) & IPIF_DHCPRUNNING) ? 1 : ((x) & IPIF_ADDRCONF) ? 3 : 2
1787 1787 int bcval = ATYPE(bc->cand_flags);
1788 1788 int ccval = ATYPE(cc->cand_flags);
1789 1789 #undef ATYPE
1790 1790
1791 1791 if (bcval == ccval)
1792 1792 return (CAND_TIE);
1793 1793 else if (ccval < bcval)
1794 1794 return (CAND_PREFER);
1795 1795 else
1796 1796 return (CAND_AVOID);
1797 1797 }
1798 1798
1799 1799 /*
1800 1800 * Prefer source addresses with longer matching prefix with the destination.
1801 1801 * We do the longest matching prefix calculation by doing an xor of both
1802 1802 * addresses with the destination, and pick the address with the longest string
1803 1803 * of leading zeros, as per CommonPrefixLen() defined in RFC 3484.
1804 1804 */
1805 1805 /* ARGSUSED3 */
1806 1806 static rule_res_t
1807 1807 rule_prefix(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo, ip_stack_t *ipst)
1808 1808 {
1809 1809 if (!bc->cand_common_pref_set) {
1810 1810 bc->cand_common_pref = ip_common_prefix_v6(&bc->cand_srcaddr,
1811 1811 dstinfo->dst_addr);
1812 1812 bc->cand_common_pref_set = B_TRUE;
1813 1813 }
1814 1814
1815 1815 cc->cand_common_pref = ip_common_prefix_v6(&cc->cand_srcaddr,
1816 1816 dstinfo->dst_addr);
1817 1817 cc->cand_common_pref_set = B_TRUE;
1818 1818
1819 1819 if (bc->cand_common_pref == cc->cand_common_pref)
1820 1820 return (CAND_TIE);
1821 1821 else if (bc->cand_common_pref > cc->cand_common_pref)
1822 1822 return (CAND_AVOID);
1823 1823 else
1824 1824 return (CAND_PREFER);
1825 1825 }
1826 1826
1827 1827 /*
1828 1828 * Last rule: we must pick something, so just prefer the current best
1829 1829 * candidate.
1830 1830 */
1831 1831 /* ARGSUSED */
1832 1832 static rule_res_t
1833 1833 rule_must_be_last(cand_t *bc, cand_t *cc, const dstinfo_t *dstinfo,
1834 1834 ip_stack_t *ipst)
1835 1835 {
1836 1836 return (CAND_AVOID);
1837 1837 }
1838 1838
1839 1839 /*
1840 1840 * Determine the best source address given a destination address and a
1841 1841 * destination ill. If no suitable source address is found, it returns
1842 1842 * NULL. If there is a usable address pointed to by the usesrc
1843 1843 * (i.e ill_usesrc_ifindex != 0) then return that first since it is more
1844 1844 * fine grained (i.e per interface)
1845 1845 *
1846 1846 * This implementation is based on the "Default Address Selection for IPv6"
1847 1847 * specification produced by the IETF IPv6 working group. It has been
1848 1848 * implemented so that the list of addresses is only traversed once (the
1849 1849 * specification's algorithm could traverse the list of addresses once for
1850 1850 * every rule).
1851 1851 *
1852 1852 * The restrict_ill argument restricts the algorithm to choose a source
1853 1853 * address that is assigned to the destination ill. This is used when
1854 1854 * the destination address is a link-local or multicast address, and when
1855 1855 * ipv6_strict_dst_multihoming is turned on.
1856 1856 *
1857 1857 * src_prefs is the caller's set of source address preferences. If source
1858 1858 * address selection is being called to determine the source address of a
1859 1859 * connected socket (from ip_set_destination_v6()), then the preferences are
1860 1860 * taken from conn_ixa->ixa_src_preferences. These preferences can be set on a
1861 1861 * per-socket basis using the IPV6_SRC_PREFERENCES socket option. The only
1862 1862 * preference currently implemented is for rfc3041 temporary addresses.
1863 1863 */
1864 1864 ipif_t *
1865 1865 ipif_select_source_v6(ill_t *dstill, const in6_addr_t *dst,
1866 1866 boolean_t restrict_ill, uint32_t src_prefs, zoneid_t zoneid,
1867 1867 boolean_t allow_usesrc, boolean_t *notreadyp)
1868 1868 {
1869 1869 dstinfo_t dstinfo;
1870 1870 char dstr[INET6_ADDRSTRLEN];
1871 1871 char sstr[INET6_ADDRSTRLEN];
1872 1872 ipif_t *ipif, *start_ipif, *next_ipif;
1873 1873 ill_t *ill, *usesrc_ill = NULL, *ipmp_ill = NULL;
1874 1874 ill_walk_context_t ctx;
1875 1875 cand_t best_c; /* The best candidate */
1876 1876 cand_t curr_c; /* The current candidate */
1877 1877 uint_t index;
1878 1878 boolean_t first_candidate = B_TRUE;
1879 1879 rule_res_t rule_result;
1880 1880 tsol_tpc_t *src_rhtp, *dst_rhtp;
1881 1881 ip_stack_t *ipst = dstill->ill_ipst;
1882 1882
1883 1883 /*
1884 1884 * The list of ordering rules. They are applied in the order they
1885 1885 * appear in the list.
1886 1886 *
1887 1887 * Solaris doesn't currently support Mobile IPv6, so there's no
1888 1888 * rule_mipv6 corresponding to rule 4 in the specification.
1889 1889 */
1890 1890 rulef_t rules[] = {
1891 1891 rule_isdst,
1892 1892 rule_scope,
1893 1893 rule_deprecated,
1894 1894 rule_preferred,
1895 1895 rule_interface,
1896 1896 rule_label,
1897 1897 rule_temporary,
1898 1898 rule_ifprefix, /* local rules after this */
1899 1899 rule_zone_specific,
1900 1900 rule_addr_type,
1901 1901 rule_prefix, /* local rules before this */
1902 1902 rule_must_be_last, /* must always be last */
1903 1903 NULL
1904 1904 };
1905 1905
1906 1906 ASSERT(dstill->ill_isv6);
1907 1907 ASSERT(!IN6_IS_ADDR_V4MAPPED(dst));
1908 1908
1909 1909 /*
1910 1910 * Check if there is a usable src address pointed to by the
1911 1911 * usesrc ifindex. This has higher precedence since it is
1912 1912 * finer grained (i.e per interface) v/s being system wide.
1913 1913 */
1914 1914 if (dstill->ill_usesrc_ifindex != 0 && allow_usesrc) {
1915 1915 if ((usesrc_ill =
1916 1916 ill_lookup_on_ifindex(dstill->ill_usesrc_ifindex, B_TRUE,
1917 1917 ipst)) != NULL) {
1918 1918 dstinfo.dst_ill = usesrc_ill;
1919 1919 } else {
1920 1920 return (NULL);
1921 1921 }
1922 1922 } else if (IS_UNDER_IPMP(dstill)) {
1923 1923 /*
1924 1924 * Test addresses should never be used for source address
1925 1925 * selection, so if we were passed an underlying ill, switch
1926 1926 * to the IPMP meta-interface.
1927 1927 */
1928 1928 if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(dstill)) != NULL)
1929 1929 dstinfo.dst_ill = ipmp_ill;
1930 1930 else
1931 1931 return (NULL);
1932 1932 } else {
1933 1933 dstinfo.dst_ill = dstill;
1934 1934 }
1935 1935
1936 1936 /*
1937 1937 * If we're dealing with an unlabeled destination on a labeled system,
1938 1938 * make sure that we ignore source addresses that are incompatible with
1939 1939 * the destination's default label. That destination's default label
1940 1940 * must dominate the minimum label on the source address.
1941 1941 *
1942 1942 * (Note that this has to do with Trusted Solaris. It's not related to
1943 1943 * the labels described by ip6_asp_lookup.)
1944 1944 */
1945 1945 dst_rhtp = NULL;
1946 1946 if (is_system_labeled()) {
1947 1947 dst_rhtp = find_tpc(dst, IPV6_VERSION, B_FALSE);
1948 1948 if (dst_rhtp == NULL)
1949 1949 return (NULL);
1950 1950 if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
1951 1951 TPC_RELE(dst_rhtp);
1952 1952 dst_rhtp = NULL;
1953 1953 }
1954 1954 }
1955 1955
1956 1956 dstinfo.dst_addr = dst;
1957 1957 dstinfo.dst_scope = ip_addr_scope_v6(dst);
1958 1958 dstinfo.dst_label = ip6_asp_lookup(dst, NULL, ipst);
1959 1959 dstinfo.dst_prefer_src_tmp = ((src_prefs & IPV6_PREFER_SRC_TMP) != 0);
1960 1960 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
1961 1961 /*
1962 1962 * Section three of the I-D states that for multicast and
1963 1963 * link-local destinations, the candidate set must be restricted to
1964 1964 * an interface that is on the same link as the outgoing interface.
1965 1965 * Also, when ipv6_strict_dst_multihoming is turned on, always
1966 1966 * restrict the source address to the destination link as doing
1967 1967 * otherwise will almost certainly cause problems.
1968 1968 */
1969 1969 if (IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst) ||
1970 1970 ipst->ips_ipv6_strict_dst_multihoming || usesrc_ill != NULL) {
1971 1971 dstinfo.dst_restrict_ill = B_TRUE;
1972 1972 } else {
1973 1973 dstinfo.dst_restrict_ill = restrict_ill;
1974 1974 }
1975 1975
1976 1976 bzero(&best_c, sizeof (cand_t));
1977 1977
1978 1978 /*
1979 1979 * Take a pass through the list of IPv6 interfaces to choose the best
1980 1980 * possible source address. If restrict_ill is set, just use dst_ill.
1981 1981 */
1982 1982 if (dstinfo.dst_restrict_ill)
1983 1983 ill = dstinfo.dst_ill;
1984 1984 else
1985 1985 ill = ILL_START_WALK_V6(&ctx, ipst);
1986 1986
1987 1987 for (; ill != NULL; ill = ill_next(&ctx, ill)) {
1988 1988 ASSERT(ill->ill_isv6);
1989 1989
1990 1990 /*
1991 1991 * Test addresses should never be used for source address
1992 1992 * selection, so ignore underlying ills.
1993 1993 */
1994 1994 if (IS_UNDER_IPMP(ill))
1995 1995 continue;
1996 1996
1997 1997 if (ill->ill_ipif == NULL)
1998 1998 continue;
1999 1999 /*
2000 2000 * For source address selection, we treat the ipif list as
2001 2001 * circular and continue until we get back to where we
2002 2002 * started. This allows IPMP to vary source address selection
2003 2003 * (which improves inbound load spreading) by caching its last
2004 2004 * ending point and starting from there. NOTE: we don't have
2005 2005 * to worry about ill_src_ipif changing ills since that can't
2006 2006 * happen on the IPMP ill.
2007 2007 */
2008 2008 start_ipif = ill->ill_ipif;
2009 2009 if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
2010 2010 start_ipif = ill->ill_src_ipif;
2011 2011
2012 2012 ipif = start_ipif;
2013 2013 do {
2014 2014 if ((next_ipif = ipif->ipif_next) == NULL)
2015 2015 next_ipif = ill->ill_ipif;
2016 2016
2017 2017 if (!IPIF_VALID_IPV6_SOURCE(ipif))
2018 2018 continue;
2019 2019
2020 2020 if (!ipif->ipif_addr_ready) {
2021 2021 if (notreadyp != NULL)
2022 2022 *notreadyp = B_TRUE;
2023 2023 continue;
2024 2024 }
2025 2025
2026 2026 if (zoneid != ALL_ZONES &&
2027 2027 ipif->ipif_zoneid != zoneid &&
2028 2028 ipif->ipif_zoneid != ALL_ZONES)
2029 2029 continue;
2030 2030
2031 2031 /*
2032 2032 * Check compatibility of local address for
2033 2033 * destination's default label if we're on a labeled
2034 2034 * system. Incompatible addresses can't be used at
2035 2035 * all and must be skipped over.
2036 2036 */
2037 2037 if (dst_rhtp != NULL) {
2038 2038 boolean_t incompat;
2039 2039
2040 2040 src_rhtp = find_tpc(&ipif->ipif_v6lcl_addr,
2041 2041 IPV6_VERSION, B_FALSE);
2042 2042 if (src_rhtp == NULL)
2043 2043 continue;
2044 2044 incompat =
2045 2045 src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
2046 2046 src_rhtp->tpc_tp.tp_doi !=
2047 2047 dst_rhtp->tpc_tp.tp_doi ||
2048 2048 (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
2049 2049 &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
2050 2050 !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
2051 2051 src_rhtp->tpc_tp.tp_sl_set_cipso));
2052 2052 TPC_RELE(src_rhtp);
2053 2053 if (incompat)
2054 2054 continue;
2055 2055 }
2056 2056
2057 2057 if (first_candidate) {
2058 2058 /*
2059 2059 * This is first valid address in the list.
2060 2060 * It is automatically the best candidate
2061 2061 * so far.
2062 2062 */
2063 2063 best_c.cand_ipif = ipif;
2064 2064 first_candidate = B_FALSE;
2065 2065 continue;
2066 2066 }
2067 2067
2068 2068 bzero(&curr_c, sizeof (cand_t));
2069 2069 curr_c.cand_ipif = ipif;
2070 2070
2071 2071 /*
2072 2072 * Compare this current candidate (curr_c) with the
2073 2073 * best candidate (best_c) by applying the
2074 2074 * comparison rules in order until one breaks the
2075 2075 * tie.
2076 2076 */
2077 2077 for (index = 0; rules[index] != NULL; index++) {
2078 2078 /* Apply a comparison rule. */
2079 2079 rule_result = (rules[index])(&best_c, &curr_c,
2080 2080 &dstinfo, ipst);
2081 2081 if (rule_result == CAND_AVOID) {
2082 2082 /*
2083 2083 * The best candidate is still the
2084 2084 * best candidate. Forget about
2085 2085 * this current candidate and go on
2086 2086 * to the next one.
2087 2087 */
2088 2088 break;
2089 2089 } else if (rule_result == CAND_PREFER) {
2090 2090 /*
2091 2091 * This candidate is prefered. It
2092 2092 * becomes the best candidate so
2093 2093 * far. Go on to the next address.
2094 2094 */
2095 2095 best_c = curr_c;
2096 2096 break;
2097 2097 }
2098 2098 /* We have a tie, apply the next rule. */
2099 2099 }
2100 2100
2101 2101 /*
2102 2102 * The last rule must be a tie breaker rule and
2103 2103 * must never produce a tie. At this point, the
2104 2104 * candidate should have either been rejected, or
2105 2105 * have been prefered as the best candidate so far.
2106 2106 */
2107 2107 ASSERT(rule_result != CAND_TIE);
2108 2108 } while ((ipif = next_ipif) != start_ipif);
2109 2109
2110 2110 /*
2111 2111 * For IPMP, update the source ipif rotor to the next ipif,
2112 2112 * provided we can look it up. (We must not use it if it's
2113 2113 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
2114 2114 * ipif_free() checked ill_src_ipif.)
2115 2115 */
2116 2116 if (IS_IPMP(ill) && ipif != NULL) {
2117 2117 mutex_enter(&ipif->ipif_ill->ill_lock);
2118 2118 next_ipif = ipif->ipif_next;
2119 2119 if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif))
2120 2120 ill->ill_src_ipif = next_ipif;
2121 2121 else
2122 2122 ill->ill_src_ipif = NULL;
2123 2123 mutex_exit(&ipif->ipif_ill->ill_lock);
2124 2124 }
2125 2125
2126 2126 /*
2127 2127 * Only one ill to consider if dst_restrict_ill is set.
2128 2128 */
2129 2129 if (dstinfo.dst_restrict_ill)
2130 2130 break;
2131 2131 }
2132 2132
2133 2133 ipif = best_c.cand_ipif;
2134 2134 ip1dbg(("ipif_select_source_v6(%s, %s) -> %s\n",
2135 2135 dstinfo.dst_ill->ill_name,
2136 2136 inet_ntop(AF_INET6, dstinfo.dst_addr, dstr, sizeof (dstr)),
2137 2137 (ipif == NULL ? "NULL" :
2138 2138 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr, sstr, sizeof (sstr)))));
2139 2139
2140 2140 if (usesrc_ill != NULL)
2141 2141 ill_refrele(usesrc_ill);
2142 2142
2143 2143 if (ipmp_ill != NULL)
2144 2144 ill_refrele(ipmp_ill);
2145 2145
2146 2146 if (dst_rhtp != NULL)
2147 2147 TPC_RELE(dst_rhtp);
2148 2148
2149 2149 if (ipif == NULL) {
2150 2150 rw_exit(&ipst->ips_ill_g_lock);
2151 2151 return (NULL);
2152 2152 }
2153 2153
2154 2154 mutex_enter(&ipif->ipif_ill->ill_lock);
2155 2155 if (!IPIF_IS_CONDEMNED(ipif)) {
2156 2156 ipif_refhold_locked(ipif);
2157 2157 mutex_exit(&ipif->ipif_ill->ill_lock);
2158 2158 rw_exit(&ipst->ips_ill_g_lock);
2159 2159 return (ipif);
2160 2160 }
2161 2161 mutex_exit(&ipif->ipif_ill->ill_lock);
2162 2162 rw_exit(&ipst->ips_ill_g_lock);
2163 2163 ip1dbg(("ipif_select_source_v6 cannot lookup ipif %p"
2164 2164 " returning null \n", (void *)ipif));
2165 2165
2166 2166 return (NULL);
2167 2167 }
2168 2168
2169 2169 /*
2170 2170 * Pick a source address based on the destination ill and an optional setsrc
2171 2171 * address.
2172 2172 * The result is stored in srcp. If generation is set, then put the source
2173 2173 * generation number there before we look for the source address (to avoid
2174 2174 * missing changes in the set of source addresses.
2175 2175 * If flagsp is set, then us it to pass back ipif_flags.
2176 2176 *
2177 2177 * If the caller wants to cache the returned source address and detect when
2178 2178 * that might be stale, the caller should pass in a generation argument,
2179 2179 * which the caller can later compare against ips_src_generation
2180 2180 *
2181 2181 * The precedence order for selecting an IPv6 source address is:
2182 2182 * - RTF_SETSRC on the first ire in the recursive lookup always wins.
2183 2183 * - If usrsrc is set, swap the ill to be the usesrc one.
2184 2184 * - If IPMP is used on the ill, select a random address from the most
2185 2185 * preferred ones below:
2186 2186 * That is followed by the long list of IPv6 source address selection rules
2187 2187 * starting with rule_isdst(), rule_scope(), etc.
2188 2188 *
2189 2189 * We have lower preference for ALL_ZONES IP addresses,
2190 2190 * as they pose problems with unlabeled destinations.
2191 2191 *
2192 2192 * Note that when multiple IP addresses match e.g., with rule_scope() we pick
2193 2193 * the first one if IPMP is not in use. With IPMP we randomize.
2194 2194 */
2195 2195 int
2196 2196 ip_select_source_v6(ill_t *ill, const in6_addr_t *setsrc, const in6_addr_t *dst,
2197 2197 zoneid_t zoneid, ip_stack_t *ipst, uint_t restrict_ill, uint32_t src_prefs,
2198 2198 in6_addr_t *srcp, uint32_t *generation, uint64_t *flagsp)
2199 2199 {
2200 2200 ipif_t *ipif;
2201 2201 boolean_t notready = B_FALSE; /* Set if !ipif_addr_ready found */
2202 2202
2203 2203 if (flagsp != NULL)
2204 2204 *flagsp = 0;
2205 2205
2206 2206 /*
2207 2207 * Need to grab the generation number before we check to
2208 2208 * avoid a race with a change to the set of local addresses.
2209 2209 * No lock needed since the thread which updates the set of local
2210 2210 * addresses use ipif/ill locks and exit those (hence a store memory
2211 2211 * barrier) before doing the atomic increase of ips_src_generation.
2212 2212 */
2213 2213 if (generation != NULL) {
2214 2214 *generation = ipst->ips_src_generation;
2215 2215 }
2216 2216
2217 2217 /* Was RTF_SETSRC set on the first IRE in the recursive lookup? */
2218 2218 if (setsrc != NULL && !IN6_IS_ADDR_UNSPECIFIED(setsrc)) {
2219 2219 *srcp = *setsrc;
2220 2220 return (0);
2221 2221 }
2222 2222
2223 2223 ipif = ipif_select_source_v6(ill, dst, restrict_ill, src_prefs, zoneid,
2224 2224 B_TRUE, ¬ready);
2225 2225 if (ipif == NULL) {
2226 2226 if (notready)
2227 2227 return (ENETDOWN);
2228 2228 else
2229 2229 return (EADDRNOTAVAIL);
2230 2230 }
2231 2231 *srcp = ipif->ipif_v6lcl_addr;
2232 2232 if (flagsp != NULL)
2233 2233 *flagsp = ipif->ipif_flags;
2234 2234 ipif_refrele(ipif);
2235 2235 return (0);
2236 2236 }
2237 2237
2238 2238 /*
2239 2239 * Perform an attach and bind to get phys addr plus info_req for
2240 2240 * the physical device.
2241 2241 * q and mp represents an ioctl which will be queued waiting for
2242 2242 * completion of the DLPI message exchange.
2243 2243 * MUST be called on an ill queue.
2244 2244 *
2245 2245 * Returns EINPROGRESS when mp has been consumed by queueing it.
2246 2246 * The ioctl will complete in ip_rput.
2247 2247 */
2248 2248 int
2249 2249 ill_dl_phys(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
2250 2250 {
2251 2251 mblk_t *v6token_mp = NULL;
2252 2252 mblk_t *v6lla_mp = NULL;
2253 2253 mblk_t *dest_mp = NULL;
2254 2254 mblk_t *phys_mp = NULL;
2255 2255 mblk_t *info_mp = NULL;
2256 2256 mblk_t *attach_mp = NULL;
2257 2257 mblk_t *bind_mp = NULL;
2258 2258 mblk_t *unbind_mp = NULL;
2259 2259 mblk_t *notify_mp = NULL;
2260 2260 mblk_t *capab_mp = NULL;
2261 2261
2262 2262 ip1dbg(("ill_dl_phys(%s:%u)\n", ill->ill_name, ipif->ipif_id));
2263 2263 ASSERT(ill->ill_dlpi_style_set);
2264 2264 ASSERT(WR(q)->q_next != NULL);
2265 2265
2266 2266 if (ill->ill_isv6) {
2267 2267 v6token_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2268 2268 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2269 2269 if (v6token_mp == NULL)
2270 2270 goto bad;
2271 2271 ((dl_phys_addr_req_t *)v6token_mp->b_rptr)->dl_addr_type =
2272 2272 DL_IPV6_TOKEN;
2273 2273
2274 2274 v6lla_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2275 2275 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2276 2276 if (v6lla_mp == NULL)
2277 2277 goto bad;
2278 2278 ((dl_phys_addr_req_t *)v6lla_mp->b_rptr)->dl_addr_type =
2279 2279 DL_IPV6_LINK_LAYER_ADDR;
2280 2280 }
2281 2281
2282 2282 if (ill->ill_mactype == DL_IPV4 || ill->ill_mactype == DL_IPV6) {
2283 2283 dest_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2284 2284 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2285 2285 if (dest_mp == NULL)
2286 2286 goto bad;
2287 2287 ((dl_phys_addr_req_t *)dest_mp->b_rptr)->dl_addr_type =
2288 2288 DL_CURR_DEST_ADDR;
2289 2289 }
2290 2290
2291 2291 /*
2292 2292 * Allocate a DL_NOTIFY_REQ and set the notifications we want.
2293 2293 */
2294 2294 notify_mp = ip_dlpi_alloc(sizeof (dl_notify_req_t) + sizeof (long),
2295 2295 DL_NOTIFY_REQ);
2296 2296 if (notify_mp == NULL)
2297 2297 goto bad;
2298 2298 ((dl_notify_req_t *)notify_mp->b_rptr)->dl_notifications =
2299 2299 (DL_NOTE_PHYS_ADDR | DL_NOTE_SDU_SIZE | DL_NOTE_FASTPATH_FLUSH |
2300 2300 DL_NOTE_LINK_UP | DL_NOTE_LINK_DOWN | DL_NOTE_CAPAB_RENEG |
2301 2301 DL_NOTE_PROMISC_ON_PHYS | DL_NOTE_PROMISC_OFF_PHYS |
2302 2302 DL_NOTE_REPLUMB | DL_NOTE_ALLOWED_IPS | DL_NOTE_SDU_SIZE2);
2303 2303
2304 2304 phys_mp = ip_dlpi_alloc(sizeof (dl_phys_addr_req_t) +
2305 2305 sizeof (t_scalar_t), DL_PHYS_ADDR_REQ);
2306 2306 if (phys_mp == NULL)
2307 2307 goto bad;
2308 2308 ((dl_phys_addr_req_t *)phys_mp->b_rptr)->dl_addr_type =
2309 2309 DL_CURR_PHYS_ADDR;
2310 2310
2311 2311 info_mp = ip_dlpi_alloc(
2312 2312 sizeof (dl_info_req_t) + sizeof (dl_info_ack_t),
2313 2313 DL_INFO_REQ);
2314 2314 if (info_mp == NULL)
2315 2315 goto bad;
2316 2316
2317 2317 ASSERT(ill->ill_dlpi_capab_state == IDCS_UNKNOWN);
2318 2318 capab_mp = ip_dlpi_alloc(sizeof (dl_capability_req_t),
2319 2319 DL_CAPABILITY_REQ);
2320 2320 if (capab_mp == NULL)
2321 2321 goto bad;
2322 2322
2323 2323 bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
2324 2324 DL_BIND_REQ);
2325 2325 if (bind_mp == NULL)
2326 2326 goto bad;
2327 2327 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
2328 2328 ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
2329 2329
2330 2330 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
2331 2331 if (unbind_mp == NULL)
2332 2332 goto bad;
2333 2333
2334 2334 /* If we need to attach, pre-alloc and initialize the mblk */
2335 2335 if (ill->ill_needs_attach) {
2336 2336 attach_mp = ip_dlpi_alloc(sizeof (dl_attach_req_t),
2337 2337 DL_ATTACH_REQ);
2338 2338 if (attach_mp == NULL)
2339 2339 goto bad;
2340 2340 ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = ill->ill_ppa;
2341 2341 }
2342 2342
2343 2343 /*
2344 2344 * Here we are going to delay the ioctl ack until after
2345 2345 * ACKs from DL_PHYS_ADDR_REQ. So need to save the
2346 2346 * original ioctl message before sending the requests
2347 2347 */
2348 2348 mutex_enter(&ill->ill_lock);
2349 2349 /* ipsq_pending_mp_add won't fail since we pass in a NULL connp */
2350 2350 (void) ipsq_pending_mp_add(NULL, ipif, ill->ill_wq, mp, 0);
2351 2351 /*
2352 2352 * Set ill_phys_addr_pend to zero. It will be set to the addr_type of
2353 2353 * the DL_PHYS_ADDR_REQ in ill_dlpi_send() and ill_dlpi_done(). It will
2354 2354 * be used to track which DL_PHYS_ADDR_REQ is being ACK'd/NAK'd.
2355 2355 */
2356 2356 ill->ill_phys_addr_pend = 0;
2357 2357 mutex_exit(&ill->ill_lock);
2358 2358
2359 2359 if (attach_mp != NULL) {
2360 2360 ip1dbg(("ill_dl_phys: attach\n"));
2361 2361 ill_dlpi_send(ill, attach_mp);
2362 2362 }
2363 2363 ill_dlpi_send(ill, bind_mp);
2364 2364 ill_dlpi_send(ill, info_mp);
2365 2365
2366 2366 /*
2367 2367 * Send the capability request to get the VRRP capability information.
2368 2368 */
2369 2369 ill_capability_send(ill, capab_mp);
2370 2370
2371 2371 if (v6token_mp != NULL)
2372 2372 ill_dlpi_send(ill, v6token_mp);
2373 2373 if (v6lla_mp != NULL)
2374 2374 ill_dlpi_send(ill, v6lla_mp);
2375 2375 if (dest_mp != NULL)
2376 2376 ill_dlpi_send(ill, dest_mp);
2377 2377 ill_dlpi_send(ill, phys_mp);
2378 2378 ill_dlpi_send(ill, notify_mp);
2379 2379 ill_dlpi_send(ill, unbind_mp);
2380 2380
2381 2381 /*
2382 2382 * This operation will complete in ip_rput_dlpi_writer with either
2383 2383 * a DL_PHYS_ADDR_ACK or DL_ERROR_ACK.
2384 2384 */
2385 2385 return (EINPROGRESS);
2386 2386 bad:
2387 2387 freemsg(v6token_mp);
2388 2388 freemsg(v6lla_mp);
2389 2389 freemsg(dest_mp);
2390 2390 freemsg(phys_mp);
2391 2391 freemsg(info_mp);
2392 2392 freemsg(attach_mp);
2393 2393 freemsg(bind_mp);
2394 2394 freemsg(capab_mp);
2395 2395 freemsg(unbind_mp);
2396 2396 freemsg(notify_mp);
2397 2397 return (ENOMEM);
2398 2398 }
2399 2399
2400 2400 /* Add room for tcp+ip headers */
2401 2401 uint_t ip_loopback_mtu_v6plus = IP_LOOPBACK_MTU + IPV6_HDR_LEN + 20;
2402 2402
2403 2403 /*
2404 2404 * DLPI is up.
2405 2405 * Create all the IREs associated with an interface bring up multicast.
2406 2406 * Set the interface flag and finish other initialization
2407 2407 * that potentially had to be differed to after DL_BIND_ACK.
2408 2408 */
2409 2409 int
2410 2410 ipif_up_done_v6(ipif_t *ipif)
2411 2411 {
2412 2412 ill_t *ill = ipif->ipif_ill;
2413 2413 int err;
2414 2414 boolean_t loopback = B_FALSE;
2415 2415
2416 2416 ip1dbg(("ipif_up_done_v6(%s:%u)\n",
2417 2417 ipif->ipif_ill->ill_name, ipif->ipif_id));
2418 2418 DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done_v6",
2419 2419 ill_t *, ill, ipif_t *, ipif);
2420 2420
2421 2421 /* Check if this is a loopback interface */
2422 2422 if (ipif->ipif_ill->ill_wq == NULL)
2423 2423 loopback = B_TRUE;
2424 2424
2425 2425 ASSERT(ipif->ipif_isv6);
2426 2426 ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
2427 2427
2428 2428 if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) {
2429 2429 nce_t *loop_nce = NULL;
2430 2430 uint16_t flags = (NCE_F_MYADDR | NCE_F_NONUD | NCE_F_AUTHORITY);
2431 2431
2432 2432 /*
2433 2433 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
2434 2434 * ipif_lookup_on_name(), but in the case of zones we can have
2435 2435 * several loopback addresses on lo0. So all the interfaces with
2436 2436 * loopback addresses need to be marked IRE_LOOPBACK.
2437 2437 */
2438 2438 if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr, &ipv6_loopback))
2439 2439 ipif->ipif_ire_type = IRE_LOOPBACK;
2440 2440 else
2441 2441 ipif->ipif_ire_type = IRE_LOCAL;
2442 2442 if (ill->ill_net_type != IRE_LOOPBACK)
2443 2443 flags |= NCE_F_PUBLISH;
2444 2444 err = nce_lookup_then_add_v6(ill, NULL,
2445 2445 ill->ill_phys_addr_length,
2446 2446 &ipif->ipif_v6lcl_addr, flags, ND_REACHABLE, &loop_nce);
2447 2447
2448 2448 /* A shared-IP zone sees EEXIST for lo0:N */
2449 2449 if (err == 0 || err == EEXIST) {
2450 2450 ipif->ipif_added_nce = 1;
2451 2451 loop_nce->nce_ipif_cnt++;
2452 2452 nce_refrele(loop_nce);
2453 2453 err = 0;
2454 2454 } else {
2455 2455 ASSERT(loop_nce == NULL);
2456 2456 return (err);
2457 2457 }
2458 2458 }
2459 2459
2460 2460 err = ipif_add_ires_v6(ipif, loopback);
2461 2461 if (err != 0) {
2462 2462 /*
2463 2463 * See comments about return value from
2464 2464 * ipif_addr_availability_check() in ipif_add_ires_v6().
2465 2465 */
2466 2466 if (err != EADDRINUSE) {
2467 2467 ipif_ndp_down(ipif);
2468 2468 } else {
2469 2469 /*
2470 2470 * Make IPMP aware of the deleted ipif so that
2471 2471 * the needed ipmp cleanup (e.g., of ipif_bound_ill)
2472 2472 * can be completed. Note that we do not want to
2473 2473 * destroy the nce that was created on the ipmp_ill
2474 2474 * for the active copy of the duplicate address in
2475 2475 * use.
2476 2476 */
2477 2477 if (IS_IPMP(ill))
2478 2478 ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
2479 2479 err = EADDRNOTAVAIL;
2480 2480 }
2481 2481 return (err);
2482 2482 }
2483 2483
2484 2484 if (ill->ill_ipif_up_count == 1 && !loopback) {
2485 2485 /* Recover any additional IREs entries for this ill */
2486 2486 (void) ill_recover_saved_ire(ill);
2487 2487 }
2488 2488
2489 2489 if (ill->ill_need_recover_multicast) {
2490 2490 /*
2491 2491 * Need to recover all multicast memberships in the driver.
2492 2492 * This had to be deferred until we had attached.
2493 2493 */
2494 2494 ill_recover_multicast(ill);
2495 2495 }
2496 2496
2497 2497 if (ill->ill_ipif_up_count == 1) {
2498 2498 /*
2499 2499 * Since the interface is now up, it may now be active.
2500 2500 */
2501 2501 if (IS_UNDER_IPMP(ill))
2502 2502 ipmp_ill_refresh_active(ill);
2503 2503 }
2504 2504
2505 2505 /* Join the allhosts multicast address and the solicited node MC */
2506 2506 ipif_multicast_up(ipif);
2507 2507
2508 2508 /* Perhaps ilgs should use this ill */
2509 2509 update_conn_ill(NULL, ill->ill_ipst);
2510 2510
2511 2511 if (ipif->ipif_addr_ready)
2512 2512 ipif_up_notify(ipif);
2513 2513
2514 2514 return (0);
2515 2515 }
2516 2516
2517 2517 /*
2518 2518 * Add the IREs associated with the ipif.
2519 2519 * Those MUST be explicitly removed in ipif_delete_ires_v6.
2520 2520 */
2521 2521 static int
2522 2522 ipif_add_ires_v6(ipif_t *ipif, boolean_t loopback)
2523 2523 {
2524 2524 ill_t *ill = ipif->ipif_ill;
2525 2525 ip_stack_t *ipst = ill->ill_ipst;
2526 2526 in6_addr_t v6addr;
2527 2527 in6_addr_t route_mask;
2528 2528 int err;
2529 2529 char buf[INET6_ADDRSTRLEN];
2530 2530 ire_t *ire_local = NULL; /* LOCAL or LOOPBACK */
2531 2531 ire_t *ire_if = NULL;
2532 2532 in6_addr_t *gw;
2533 2533
2534 2534 if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
2535 2535 !(ipif->ipif_flags & IPIF_NOLOCAL)) {
2536 2536
2537 2537 /*
2538 2538 * If we're on a labeled system then make sure that zone-
2539 2539 * private addresses have proper remote host database entries.
2540 2540 */
2541 2541 if (is_system_labeled() &&
2542 2542 ipif->ipif_ire_type != IRE_LOOPBACK) {
2543 2543 if (ip6opt_ls == 0) {
2544 2544 cmn_err(CE_WARN, "IPv6 not enabled "
2545 2545 "via /etc/system");
2546 2546 return (EINVAL);
2547 2547 }
2548 2548 if (!tsol_check_interface_address(ipif))
2549 2549 return (EINVAL);
2550 2550 }
2551 2551
2552 2552 if (loopback)
2553 2553 gw = &ipif->ipif_v6lcl_addr;
2554 2554 else
2555 2555 gw = NULL;
2556 2556
2557 2557 /* Register the source address for __sin6_src_id */
2558 2558 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
2559 2559 ipif->ipif_zoneid, ipst);
2560 2560 if (err != 0) {
2561 2561 ip0dbg(("ipif_add_ires_v6: srcid_insert %d\n", err));
2562 2562 return (err);
2563 2563 }
2564 2564 /*
2565 2565 * If the interface address is set, create the LOCAL
2566 2566 * or LOOPBACK IRE.
2567 2567 */
2568 2568 ip1dbg(("ipif_add_ires_v6: creating IRE %d for %s\n",
2569 2569 ipif->ipif_ire_type,
2570 2570 inet_ntop(AF_INET6, &ipif->ipif_v6lcl_addr,
2571 2571 buf, sizeof (buf))));
2572 2572
2573 2573 ire_local = ire_create_v6(
2574 2574 &ipif->ipif_v6lcl_addr, /* dest address */
2575 2575 &ipv6_all_ones, /* mask */
2576 2576 gw, /* gateway */
2577 2577 ipif->ipif_ire_type, /* LOCAL or LOOPBACK */
2578 2578 ipif->ipif_ill, /* interface */
2579 2579 ipif->ipif_zoneid,
2580 2580 ((ipif->ipif_flags & IPIF_PRIVATE) ?
2581 2581 RTF_PRIVATE : 0) | RTF_KERNEL,
2582 2582 NULL,
2583 2583 ipst);
2584 2584 if (ire_local == NULL) {
2585 2585 ip1dbg(("ipif_up_done_v6: NULL ire_local\n"));
2586 2586 err = ENOMEM;
2587 2587 goto bad;
2588 2588 }
2589 2589 }
2590 2590
2591 2591 /* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
2592 2592 if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) &&
2593 2593 !(IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet) &&
2594 2594 IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))) {
2595 2595 /* ipif_v6subnet is ipif_v6pp_dst_addr for pt-pt */
2596 2596 v6addr = ipif->ipif_v6subnet;
2597 2597
2598 2598 if (ipif->ipif_flags & IPIF_POINTOPOINT) {
2599 2599 route_mask = ipv6_all_ones;
2600 2600 } else {
2601 2601 route_mask = ipif->ipif_v6net_mask;
2602 2602 }
2603 2603
2604 2604 ip1dbg(("ipif_add_ires_v6: creating if IRE %d for %s\n",
2605 2605 ill->ill_net_type,
2606 2606 inet_ntop(AF_INET6, &v6addr, buf, sizeof (buf))));
2607 2607
2608 2608 ire_if = ire_create_v6(
2609 2609 &v6addr, /* dest pref */
2610 2610 &route_mask, /* mask */
2611 2611 &ipif->ipif_v6lcl_addr, /* gateway */
2612 2612 ill->ill_net_type, /* IF_[NO]RESOLVER */
2613 2613 ipif->ipif_ill,
2614 2614 ipif->ipif_zoneid,
2615 2615 ((ipif->ipif_flags & IPIF_PRIVATE) ?
2616 2616 RTF_PRIVATE : 0) | RTF_KERNEL,
2617 2617 NULL,
2618 2618 ipst);
2619 2619 if (ire_if == NULL) {
2620 2620 ip1dbg(("ipif_up_done: NULL ire_if\n"));
2621 2621 err = ENOMEM;
2622 2622 goto bad;
2623 2623 }
2624 2624 }
2625 2625
2626 2626 /*
2627 2627 * Need to atomically check for IP address availability under
2628 2628 * ip_addr_avail_lock. ill_g_lock is held as reader to ensure no new
2629 2629 * ills or new ipifs can be added while we are checking availability.
2630 2630 */
2631 2631 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
2632 2632 mutex_enter(&ipst->ips_ip_addr_avail_lock);
2633 2633 ill->ill_ipif_up_count++;
2634 2634 ipif->ipif_flags |= IPIF_UP;
2635 2635 err = ip_addr_availability_check(ipif);
2636 2636 mutex_exit(&ipst->ips_ip_addr_avail_lock);
2637 2637 rw_exit(&ipst->ips_ill_g_lock);
2638 2638
2639 2639 if (err != 0) {
2640 2640 /*
2641 2641 * Our address may already be up on the same ill. In this case,
2642 2642 * the external resolver entry for our ipif replaced the one for
2643 2643 * the other ipif. So we don't want to delete it (otherwise the
2644 2644 * other ipif would be unable to send packets).
2645 2645 * ip_addr_availability_check() identifies this case for us and
2646 2646 * returns EADDRINUSE; Caller must turn it into EADDRNOTAVAIL
2647 2647 * which is the expected error code.
2648 2648 *
2649 2649 * Note that ipif_ndp_down() will only delete the nce in the
2650 2650 * case when the nce_ipif_cnt drops to 0.
2651 2651 */
2652 2652 ill->ill_ipif_up_count--;
2653 2653 ipif->ipif_flags &= ~IPIF_UP;
2654 2654 goto bad;
2655 2655 }
2656 2656
2657 2657 /*
2658 2658 * Add in all newly created IREs.
2659 2659 * We add the IRE_INTERFACE before the IRE_LOCAL to ensure
2660 2660 * that lookups find the IRE_LOCAL even if the IRE_INTERFACE is
2661 2661 * a /128 route.
2662 2662 */
2663 2663 if (ire_if != NULL) {
2664 2664 ire_if = ire_add(ire_if);
2665 2665 if (ire_if == NULL) {
2666 2666 err = ENOMEM;
2667 2667 goto bad2;
2668 2668 }
2669 2669 #ifdef DEBUG
2670 2670 ire_refhold_notr(ire_if);
2671 2671 ire_refrele(ire_if);
2672 2672 #endif
2673 2673 }
2674 2674 if (ire_local != NULL) {
2675 2675 ire_local = ire_add(ire_local);
2676 2676 if (ire_local == NULL) {
2677 2677 err = ENOMEM;
2678 2678 goto bad2;
2679 2679 }
2680 2680 #ifdef DEBUG
2681 2681 ire_refhold_notr(ire_local);
2682 2682 ire_refrele(ire_local);
2683 2683 #endif
2684 2684 }
2685 2685 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
2686 2686 if (ire_local != NULL)
2687 2687 ipif->ipif_ire_local = ire_local;
2688 2688 if (ire_if != NULL)
2689 2689 ipif->ipif_ire_if = ire_if;
2690 2690 rw_exit(&ipst->ips_ill_g_lock);
2691 2691 ire_local = NULL;
2692 2692 ire_if = NULL;
2693 2693
2694 2694 if (ipif->ipif_addr_ready)
2695 2695 ipif_up_notify(ipif);
2696 2696 return (0);
2697 2697
2698 2698 bad2:
2699 2699 ill->ill_ipif_up_count--;
2700 2700 ipif->ipif_flags &= ~IPIF_UP;
2701 2701
2702 2702 bad:
2703 2703 if (ire_local != NULL)
2704 2704 ire_delete(ire_local);
2705 2705 if (ire_if != NULL)
2706 2706 ire_delete(ire_if);
2707 2707
2708 2708 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
2709 2709 ire_local = ipif->ipif_ire_local;
2710 2710 ipif->ipif_ire_local = NULL;
2711 2711 ire_if = ipif->ipif_ire_if;
2712 2712 ipif->ipif_ire_if = NULL;
2713 2713 rw_exit(&ipst->ips_ill_g_lock);
2714 2714 if (ire_local != NULL) {
2715 2715 ire_delete(ire_local);
2716 2716 ire_refrele_notr(ire_local);
2717 2717 }
2718 2718 if (ire_if != NULL) {
2719 2719 ire_delete(ire_if);
2720 2720 ire_refrele_notr(ire_if);
2721 2721 }
2722 2722 (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
2723 2723
2724 2724 return (err);
2725 2725 }
2726 2726
2727 2727 /* Remove all the IREs created by ipif_add_ires_v6 */
2728 2728 void
2729 2729 ipif_delete_ires_v6(ipif_t *ipif)
2730 2730 {
2731 2731 ill_t *ill = ipif->ipif_ill;
2732 2732 ip_stack_t *ipst = ill->ill_ipst;
2733 2733 ire_t *ire;
2734 2734
2735 2735 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
2736 2736 ire = ipif->ipif_ire_local;
2737 2737 ipif->ipif_ire_local = NULL;
2738 2738 rw_exit(&ipst->ips_ill_g_lock);
2739 2739 if (ire != NULL) {
2740 2740 /*
2741 2741 * Move count to ipif so we don't loose the count due to
2742 2742 * a down/up dance.
2743 2743 */
2744 2744 atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count);
2745 2745
2746 2746 ire_delete(ire);
2747 2747 ire_refrele_notr(ire);
2748 2748 }
2749 2749 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
2750 2750 ire = ipif->ipif_ire_if;
2751 2751 ipif->ipif_ire_if = NULL;
2752 2752 rw_exit(&ipst->ips_ill_g_lock);
2753 2753 if (ire != NULL) {
2754 2754 ire_delete(ire);
2755 2755 ire_refrele_notr(ire);
2756 2756 }
2757 2757 }
2758 2758
2759 2759 /*
2760 2760 * Delete an ND entry if it exists.
2761 2761 */
2762 2762 /* ARGSUSED */
2763 2763 int
2764 2764 ip_siocdelndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
2765 2765 ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
2766 2766 {
2767 2767 sin6_t *sin6;
2768 2768 struct lifreq *lifr;
2769 2769 lif_nd_req_t *lnr;
2770 2770 ill_t *ill = ipif->ipif_ill;
2771 2771 nce_t *nce;
2772 2772
2773 2773 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
2774 2774 lnr = &lifr->lifr_nd;
2775 2775 /* Only allow for logical unit zero i.e. not on "le0:17" */
2776 2776 if (ipif->ipif_id != 0)
2777 2777 return (EINVAL);
2778 2778
2779 2779 if (!ipif->ipif_isv6)
2780 2780 return (EINVAL);
2781 2781
2782 2782 if (lnr->lnr_addr.ss_family != AF_INET6)
2783 2783 return (EAFNOSUPPORT);
2784 2784
2785 2785 sin6 = (sin6_t *)&lnr->lnr_addr;
2786 2786
2787 2787 /*
2788 2788 * Since ND mappings must be consistent across an IPMP group, prohibit
2789 2789 * deleting ND mappings on underlying interfaces.
2790 2790 * Don't allow deletion of mappings for local addresses.
2791 2791 */
2792 2792 if (IS_UNDER_IPMP(ill))
2793 2793 return (EPERM);
2794 2794
2795 2795 nce = nce_lookup_v6(ill, &sin6->sin6_addr);
2796 2796 if (nce == NULL)
2797 2797 return (ESRCH);
2798 2798
2799 2799 if (NCE_MYADDR(nce->nce_common)) {
2800 2800 nce_refrele(nce);
2801 2801 return (EPERM);
2802 2802 }
2803 2803
2804 2804 /*
2805 2805 * delete the nce_common which will also delete the nces on any
2806 2806 * under_ill in the case of ipmp.
2807 2807 */
2808 2808 ncec_delete(nce->nce_common);
2809 2809 nce_refrele(nce);
2810 2810 return (0);
2811 2811 }
2812 2812
2813 2813 /*
2814 2814 * Return nbr cache info.
2815 2815 */
2816 2816 /* ARGSUSED */
2817 2817 int
2818 2818 ip_siocqueryndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
2819 2819 ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
2820 2820 {
2821 2821 ill_t *ill = ipif->ipif_ill;
2822 2822 struct lifreq *lifr;
2823 2823 lif_nd_req_t *lnr;
2824 2824
2825 2825 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
2826 2826 lnr = &lifr->lifr_nd;
2827 2827 /* Only allow for logical unit zero i.e. not on "le0:17" */
2828 2828 if (ipif->ipif_id != 0)
2829 2829 return (EINVAL);
2830 2830
2831 2831 if (!ipif->ipif_isv6)
2832 2832 return (EINVAL);
2833 2833
2834 2834 if (lnr->lnr_addr.ss_family != AF_INET6)
2835 2835 return (EAFNOSUPPORT);
2836 2836
2837 2837 if (ill->ill_phys_addr_length > sizeof (lnr->lnr_hdw_addr))
2838 2838 return (EINVAL);
2839 2839
2840 2840 return (ndp_query(ill, lnr));
2841 2841 }
2842 2842
2843 2843 /*
2844 2844 * Perform an update of the nd entry for the specified address.
2845 2845 */
2846 2846 /* ARGSUSED */
2847 2847 int
2848 2848 ip_siocsetndp_v6(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
2849 2849 ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
2850 2850 {
2851 2851 sin6_t *sin6;
2852 2852 ill_t *ill = ipif->ipif_ill;
2853 2853 struct lifreq *lifr;
2854 2854 lif_nd_req_t *lnr;
2855 2855 ire_t *ire;
2856 2856
2857 2857 lifr = (struct lifreq *)mp->b_cont->b_cont->b_rptr;
2858 2858 lnr = &lifr->lifr_nd;
2859 2859 /* Only allow for logical unit zero i.e. not on "le0:17" */
2860 2860 if (ipif->ipif_id != 0)
2861 2861 return (EINVAL);
2862 2862
2863 2863 if (!ipif->ipif_isv6)
2864 2864 return (EINVAL);
2865 2865
2866 2866 if (lnr->lnr_addr.ss_family != AF_INET6)
2867 2867 return (EAFNOSUPPORT);
2868 2868
2869 2869 sin6 = (sin6_t *)&lnr->lnr_addr;
2870 2870
2871 2871 /*
2872 2872 * Since ND mappings must be consistent across an IPMP group, prohibit
2873 2873 * updating ND mappings on underlying interfaces. Also, since ND
2874 2874 * mappings for IPMP data addresses are owned by IP itself, prohibit
2875 2875 * updating them.
2876 2876 */
2877 2877 if (IS_UNDER_IPMP(ill))
2878 2878 return (EPERM);
2879 2879
2880 2880 if (IS_IPMP(ill)) {
2881 2881 ire = ire_ftable_lookup_v6(&sin6->sin6_addr, NULL, NULL,
2882 2882 IRE_LOCAL, ill, ALL_ZONES, NULL,
2883 2883 MATCH_IRE_TYPE | MATCH_IRE_ILL, 0, ill->ill_ipst, NULL);
2884 2884 if (ire != NULL) {
2885 2885 ire_refrele(ire);
2886 2886 return (EPERM);
2887 2887 }
2888 2888 }
2889 2889
2890 2890 return (ndp_sioc_update(ill, lnr));
2891 2891 }
|
↓ open down ↓ |
2808 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX