17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cd2Sjpk * Common Development and Distribution License (the "License").
645916cd2Sjpk * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
2278377681SSowmini Varadhan * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate * Copyright (c) 1990 Mentat Inc.
247c478bd9Sstevel@tonic-gate */
257c478bd9Sstevel@tonic-gate
267c478bd9Sstevel@tonic-gate /*
277c478bd9Sstevel@tonic-gate * This file contains routines that manipulate Internet Routing Entries (IREs).
287c478bd9Sstevel@tonic-gate */
297c478bd9Sstevel@tonic-gate #include <sys/types.h>
307c478bd9Sstevel@tonic-gate #include <sys/stream.h>
317c478bd9Sstevel@tonic-gate #include <sys/stropts.h>
327c478bd9Sstevel@tonic-gate #include <sys/ddi.h>
337c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h>
347c478bd9Sstevel@tonic-gate
357c478bd9Sstevel@tonic-gate #include <sys/systm.h>
367c478bd9Sstevel@tonic-gate #include <sys/param.h>
377c478bd9Sstevel@tonic-gate #include <sys/socket.h>
387c478bd9Sstevel@tonic-gate #include <net/if.h>
397c478bd9Sstevel@tonic-gate #include <net/route.h>
407c478bd9Sstevel@tonic-gate #include <netinet/in.h>
417c478bd9Sstevel@tonic-gate #include <net/if_dl.h>
427c478bd9Sstevel@tonic-gate #include <netinet/ip6.h>
437c478bd9Sstevel@tonic-gate #include <netinet/icmp6.h>
447c478bd9Sstevel@tonic-gate
457c478bd9Sstevel@tonic-gate #include <inet/common.h>
467c478bd9Sstevel@tonic-gate #include <inet/mi.h>
477c478bd9Sstevel@tonic-gate #include <inet/ip.h>
487c478bd9Sstevel@tonic-gate #include <inet/ip6.h>
497c478bd9Sstevel@tonic-gate #include <inet/ip_ndp.h>
507c478bd9Sstevel@tonic-gate #include <inet/ip_if.h>
517c478bd9Sstevel@tonic-gate #include <inet/ip_ire.h>
527c478bd9Sstevel@tonic-gate #include <inet/ipclassifier.h>
537c478bd9Sstevel@tonic-gate #include <inet/nd.h>
546e91bba0SGirish Moodalbail #include <inet/tunables.h>
557c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
567c478bd9Sstevel@tonic-gate #include <sys/zone.h>
577c478bd9Sstevel@tonic-gate
5845916cd2Sjpk #include <sys/tsol/label.h>
5945916cd2Sjpk #include <sys/tsol/tnet.h>
6045916cd2Sjpk
61bd670b35SErik Nordmark #define IS_DEFAULT_ROUTE_V6(ire) \
62bd670b35SErik Nordmark (((ire)->ire_type & IRE_DEFAULT) || \
63bd670b35SErik Nordmark (((ire)->ire_type & IRE_INTERFACE) && \
64bd670b35SErik Nordmark (IN6_IS_ADDR_UNSPECIFIED(&(ire)->ire_addr_v6))))
65bd670b35SErik Nordmark
667c478bd9Sstevel@tonic-gate static ire_t ire_null;
677c478bd9Sstevel@tonic-gate
68bd670b35SErik Nordmark static ire_t *
69bd670b35SErik Nordmark ire_ftable_lookup_impl_v6(const in6_addr_t *addr, const in6_addr_t *mask,
70bd670b35SErik Nordmark const in6_addr_t *gateway, int type, const ill_t *ill,
71bd670b35SErik Nordmark zoneid_t zoneid, const ts_label_t *tsl, int flags,
72bd670b35SErik Nordmark ip_stack_t *ipst);
737c478bd9Sstevel@tonic-gate
747c478bd9Sstevel@tonic-gate /*
757c478bd9Sstevel@tonic-gate * Initialize the ire that is specific to IPv6 part and call
767c478bd9Sstevel@tonic-gate * ire_init_common to finish it.
77bd670b35SErik Nordmark * Returns zero or errno.
787c478bd9Sstevel@tonic-gate */
79bd670b35SErik Nordmark int
ire_init_v6(ire_t * ire,const in6_addr_t * v6addr,const in6_addr_t * v6mask,const in6_addr_t * v6gateway,ushort_t type,ill_t * ill,zoneid_t zoneid,uint_t flags,tsol_gc_t * gc,ip_stack_t * ipst)8054da8755Ssowmini ire_init_v6(ire_t *ire, const in6_addr_t *v6addr, const in6_addr_t *v6mask,
81bd670b35SErik Nordmark const in6_addr_t *v6gateway, ushort_t type, ill_t *ill,
82bd670b35SErik Nordmark zoneid_t zoneid, uint_t flags, tsol_gc_t *gc, ip_stack_t *ipst)
837c478bd9Sstevel@tonic-gate {
84bd670b35SErik Nordmark int error;
85c793af95Ssangeeta
8645916cd2Sjpk /*
87bd670b35SErik Nordmark * Reject IRE security attmakeribute creation/initialization
8845916cd2Sjpk * if system is not running in Trusted mode.
8945916cd2Sjpk */
90bd670b35SErik Nordmark if (gc != NULL && !is_system_labeled())
91bd670b35SErik Nordmark return (EINVAL);
927c478bd9Sstevel@tonic-gate
93f4b3ec61Sdh BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_alloced);
94bd670b35SErik Nordmark if (v6addr != NULL)
95bd670b35SErik Nordmark ire->ire_addr_v6 = *v6addr;
967c478bd9Sstevel@tonic-gate if (v6gateway != NULL)
977c478bd9Sstevel@tonic-gate ire->ire_gateway_addr_v6 = *v6gateway;
987c478bd9Sstevel@tonic-gate
99bd670b35SErik Nordmark /* Make sure we don't have stray values in some fields */
100bd670b35SErik Nordmark switch (type) {
101bd670b35SErik Nordmark case IRE_LOOPBACK:
102bd670b35SErik Nordmark case IRE_HOST:
103bd670b35SErik Nordmark case IRE_LOCAL:
104bd670b35SErik Nordmark case IRE_IF_CLONE:
105bd670b35SErik Nordmark ire->ire_mask_v6 = ipv6_all_ones;
106bd670b35SErik Nordmark ire->ire_masklen = IPV6_ABITS;
107bd670b35SErik Nordmark break;
108bd670b35SErik Nordmark case IRE_PREFIX:
109bd670b35SErik Nordmark case IRE_DEFAULT:
110bd670b35SErik Nordmark case IRE_IF_RESOLVER:
111bd670b35SErik Nordmark case IRE_IF_NORESOLVER:
112bd670b35SErik Nordmark if (v6mask != NULL) {
113bd670b35SErik Nordmark ire->ire_mask_v6 = *v6mask;
114bd670b35SErik Nordmark ire->ire_masklen =
115bd670b35SErik Nordmark ip_mask_to_plen_v6(&ire->ire_mask_v6);
116bd670b35SErik Nordmark }
117bd670b35SErik Nordmark break;
118bd670b35SErik Nordmark case IRE_MULTICAST:
119bd670b35SErik Nordmark case IRE_NOROUTE:
120bd670b35SErik Nordmark ASSERT(v6mask == NULL);
121bd670b35SErik Nordmark break;
122bd670b35SErik Nordmark default:
123bd670b35SErik Nordmark ASSERT(0);
124bd670b35SErik Nordmark return (EINVAL);
1257c478bd9Sstevel@tonic-gate }
1267c478bd9Sstevel@tonic-gate
127bd670b35SErik Nordmark error = ire_init_common(ire, type, ill, zoneid, flags, IPV6_VERSION,
128bd670b35SErik Nordmark gc, ipst);
12963d2ef3cSToomas Soome if (error != 0)
130bd670b35SErik Nordmark return (error);
1317c478bd9Sstevel@tonic-gate
132bd670b35SErik Nordmark /* Determine which function pointers to use */
133bd670b35SErik Nordmark ire->ire_postfragfn = ip_xmit; /* Common case */
1347c478bd9Sstevel@tonic-gate
135bd670b35SErik Nordmark switch (ire->ire_type) {
136bd670b35SErik Nordmark case IRE_LOCAL:
137bd670b35SErik Nordmark ire->ire_sendfn = ire_send_local_v6;
138bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_local_v6;
139bd670b35SErik Nordmark ASSERT(ire->ire_ill != NULL);
1401cb875aeSCathy Zhou if (ire->ire_ill->ill_flags & ILLF_NOACCEPT)
141bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_noaccept_v6;
142bd670b35SErik Nordmark break;
143bd670b35SErik Nordmark case IRE_LOOPBACK:
144bd670b35SErik Nordmark ire->ire_sendfn = ire_send_local_v6;
145bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_loopback_v6;
146bd670b35SErik Nordmark break;
147bd670b35SErik Nordmark case IRE_MULTICAST:
148bd670b35SErik Nordmark ire->ire_postfragfn = ip_postfrag_loopcheck;
149bd670b35SErik Nordmark ire->ire_sendfn = ire_send_multicast_v6;
150bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_multicast_v6;
151bd670b35SErik Nordmark break;
152bd670b35SErik Nordmark default:
153bd670b35SErik Nordmark /*
154bd670b35SErik Nordmark * For IRE_IF_ALL and IRE_OFFLINK we forward received
155bd670b35SErik Nordmark * packets by default.
156bd670b35SErik Nordmark */
157bd670b35SErik Nordmark ire->ire_sendfn = ire_send_wire_v6;
158bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_forward_v6;
159bd670b35SErik Nordmark break;
1607c478bd9Sstevel@tonic-gate }
161bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
162bd670b35SErik Nordmark ire->ire_sendfn = ire_send_noroute_v6;
163bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_noroute_v6;
164bd670b35SErik Nordmark } else if (ire->ire_flags & RTF_MULTIRT) {
165bd670b35SErik Nordmark ire->ire_postfragfn = ip_postfrag_multirt_v6;
166bd670b35SErik Nordmark ire->ire_sendfn = ire_send_multirt_v6;
167bd670b35SErik Nordmark ire->ire_recvfn = ire_recv_multirt_v6;
1687c478bd9Sstevel@tonic-gate }
169bd670b35SErik Nordmark ire->ire_nce_capable = ire_determine_nce_capable(ire);
170bd670b35SErik Nordmark return (0);
1717c478bd9Sstevel@tonic-gate }
1727c478bd9Sstevel@tonic-gate
1737c478bd9Sstevel@tonic-gate /*
1747c478bd9Sstevel@tonic-gate * ire_create_v6 is called to allocate and initialize a new IRE.
1757c478bd9Sstevel@tonic-gate *
1767c478bd9Sstevel@tonic-gate * NOTE : This is called as writer sometimes though not required
1777c478bd9Sstevel@tonic-gate * by this function.
1787c478bd9Sstevel@tonic-gate */
17954da8755Ssowmini /* ARGSUSED */
1807c478bd9Sstevel@tonic-gate ire_t *
ire_create_v6(const in6_addr_t * v6addr,const in6_addr_t * v6mask,const in6_addr_t * v6gateway,ushort_t type,ill_t * ill,zoneid_t zoneid,uint_t flags,tsol_gc_t * gc,ip_stack_t * ipst)1817c478bd9Sstevel@tonic-gate ire_create_v6(const in6_addr_t *v6addr, const in6_addr_t *v6mask,
182bd670b35SErik Nordmark const in6_addr_t *v6gateway, ushort_t type, ill_t *ill, zoneid_t zoneid,
183bd670b35SErik Nordmark uint_t flags, tsol_gc_t *gc, ip_stack_t *ipst)
1847c478bd9Sstevel@tonic-gate {
1857c478bd9Sstevel@tonic-gate ire_t *ire;
186bd670b35SErik Nordmark int error;
1877c478bd9Sstevel@tonic-gate
1887c478bd9Sstevel@tonic-gate ASSERT(!IN6_IS_ADDR_V4MAPPED(v6addr));
1897c478bd9Sstevel@tonic-gate
1907c478bd9Sstevel@tonic-gate ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
1917c478bd9Sstevel@tonic-gate if (ire == NULL) {
192bd670b35SErik Nordmark DTRACE_PROBE(kmem__cache__alloc);
1937c478bd9Sstevel@tonic-gate return (NULL);
1947c478bd9Sstevel@tonic-gate }
1957c478bd9Sstevel@tonic-gate *ire = ire_null;
1967c478bd9Sstevel@tonic-gate
197bd670b35SErik Nordmark error = ire_init_v6(ire, v6addr, v6mask, v6gateway,
198bd670b35SErik Nordmark type, ill, zoneid, flags, gc, ipst);
1997c478bd9Sstevel@tonic-gate
200bd670b35SErik Nordmark if (error != 0) {
201bd670b35SErik Nordmark DTRACE_PROBE2(ire__init__v6, ire_t *, ire, int, error);
2027c478bd9Sstevel@tonic-gate kmem_cache_free(ire_cache, ire);
2037c478bd9Sstevel@tonic-gate return (NULL);
2047c478bd9Sstevel@tonic-gate }
2057c478bd9Sstevel@tonic-gate return (ire);
2067c478bd9Sstevel@tonic-gate }
2077c478bd9Sstevel@tonic-gate
2087c478bd9Sstevel@tonic-gate /*
209bd670b35SErik Nordmark * Find the ill matching a multicast group.
2107c478bd9Sstevel@tonic-gate * Allows different routes for multicast addresses
2117c478bd9Sstevel@tonic-gate * in the unicast routing table (akin to FF::0/8 but could be more specific)
2127c478bd9Sstevel@tonic-gate * which point at different interfaces. This is used when IPV6_MULTICAST_IF
2137c478bd9Sstevel@tonic-gate * isn't specified (when sending) and when IPV6_JOIN_GROUP doesn't
2147c478bd9Sstevel@tonic-gate * specify the interface to join on.
2157c478bd9Sstevel@tonic-gate *
216bd670b35SErik Nordmark * Supports link-local addresses by using ire_route_recursive which follows
217bd670b35SErik Nordmark * the ill when recursing.
218bd670b35SErik Nordmark *
219bd670b35SErik Nordmark * To handle CGTP, since we don't have a separate IRE_MULTICAST for each group
220bd670b35SErik Nordmark * and the MULTIRT property can be different for different groups, we
221bd670b35SErik Nordmark * extract RTF_MULTIRT from the special unicast route added for a group
222bd670b35SErik Nordmark * with CGTP and pass that back in the multirtp argument.
223bd670b35SErik Nordmark * This is used in ip_set_destination etc to set ixa_postfragfn for multicast.
224bd670b35SErik Nordmark * We have a setsrcp argument for the same reason.
2257c478bd9Sstevel@tonic-gate */
226bd670b35SErik Nordmark ill_t *
ire_lookup_multi_ill_v6(const in6_addr_t * group,zoneid_t zoneid,ip_stack_t * ipst,boolean_t * multirtp,in6_addr_t * setsrcp)227bd670b35SErik Nordmark ire_lookup_multi_ill_v6(const in6_addr_t *group, zoneid_t zoneid,
228bd670b35SErik Nordmark ip_stack_t *ipst, boolean_t *multirtp, in6_addr_t *setsrcp)
2297c478bd9Sstevel@tonic-gate {
2307c478bd9Sstevel@tonic-gate ire_t *ire;
231bd670b35SErik Nordmark ill_t *ill;
2327c478bd9Sstevel@tonic-gate
233bd670b35SErik Nordmark ire = ire_route_recursive_v6(group, 0, NULL, zoneid, NULL,
2349e3469d3SErik Nordmark MATCH_IRE_DSTONLY, IRR_NONE, 0, ipst, setsrcp, NULL, NULL);
235bd670b35SErik Nordmark ASSERT(ire != NULL);
2367c478bd9Sstevel@tonic-gate
237bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
2387c478bd9Sstevel@tonic-gate ire_refrele(ire);
2397c478bd9Sstevel@tonic-gate return (NULL);
2407c478bd9Sstevel@tonic-gate }
2417c478bd9Sstevel@tonic-gate
242bd670b35SErik Nordmark if (multirtp != NULL)
243bd670b35SErik Nordmark *multirtp = (ire->ire_flags & RTF_MULTIRT) != 0;
2447c478bd9Sstevel@tonic-gate
245bd670b35SErik Nordmark ill = ire_nexthop_ill(ire);
246bd670b35SErik Nordmark ire_refrele(ire);
247bd670b35SErik Nordmark return (ill);
2487c478bd9Sstevel@tonic-gate }
2497c478bd9Sstevel@tonic-gate
2507c478bd9Sstevel@tonic-gate /*
2517c478bd9Sstevel@tonic-gate * This function takes a mask and returns number of bits set in the
2527c478bd9Sstevel@tonic-gate * mask (the represented prefix length). Assumes a contiguous mask.
2537c478bd9Sstevel@tonic-gate */
2547c478bd9Sstevel@tonic-gate int
ip_mask_to_plen_v6(const in6_addr_t * v6mask)2557c478bd9Sstevel@tonic-gate ip_mask_to_plen_v6(const in6_addr_t *v6mask)
2567c478bd9Sstevel@tonic-gate {
2577c478bd9Sstevel@tonic-gate int bits;
2587c478bd9Sstevel@tonic-gate int plen = IPV6_ABITS;
2597c478bd9Sstevel@tonic-gate int i;
2607c478bd9Sstevel@tonic-gate
2617c478bd9Sstevel@tonic-gate for (i = 3; i >= 0; i--) {
2627c478bd9Sstevel@tonic-gate if (v6mask->s6_addr32[i] == 0) {
2637c478bd9Sstevel@tonic-gate plen -= 32;
2647c478bd9Sstevel@tonic-gate continue;
2657c478bd9Sstevel@tonic-gate }
2667c478bd9Sstevel@tonic-gate bits = ffs(ntohl(v6mask->s6_addr32[i])) - 1;
2677c478bd9Sstevel@tonic-gate if (bits == 0)
2687c478bd9Sstevel@tonic-gate break;
2697c478bd9Sstevel@tonic-gate plen -= bits;
2707c478bd9Sstevel@tonic-gate }
2717c478bd9Sstevel@tonic-gate
2727c478bd9Sstevel@tonic-gate return (plen);
2737c478bd9Sstevel@tonic-gate }
2747c478bd9Sstevel@tonic-gate
2757c478bd9Sstevel@tonic-gate /*
2767c478bd9Sstevel@tonic-gate * Convert a prefix length to the mask for that prefix.
2777c478bd9Sstevel@tonic-gate * Returns the argument bitmask.
2787c478bd9Sstevel@tonic-gate */
2797c478bd9Sstevel@tonic-gate in6_addr_t *
ip_plen_to_mask_v6(uint_t plen,in6_addr_t * bitmask)2807c478bd9Sstevel@tonic-gate ip_plen_to_mask_v6(uint_t plen, in6_addr_t *bitmask)
2817c478bd9Sstevel@tonic-gate {
2827c478bd9Sstevel@tonic-gate uint32_t *ptr;
2837c478bd9Sstevel@tonic-gate
2847c478bd9Sstevel@tonic-gate if (plen < 0 || plen > IPV6_ABITS)
2857c478bd9Sstevel@tonic-gate return (NULL);
2867c478bd9Sstevel@tonic-gate *bitmask = ipv6_all_zeros;
287bd670b35SErik Nordmark if (plen == 0)
288bd670b35SErik Nordmark return (bitmask);
2897c478bd9Sstevel@tonic-gate
2907c478bd9Sstevel@tonic-gate ptr = (uint32_t *)bitmask;
2917c478bd9Sstevel@tonic-gate while (plen > 32) {
2927c478bd9Sstevel@tonic-gate *ptr++ = 0xffffffffU;
2937c478bd9Sstevel@tonic-gate plen -= 32;
2947c478bd9Sstevel@tonic-gate }
2957c478bd9Sstevel@tonic-gate *ptr = htonl(0xffffffffU << (32 - plen));
2967c478bd9Sstevel@tonic-gate return (bitmask);
2977c478bd9Sstevel@tonic-gate }
2987c478bd9Sstevel@tonic-gate
2997c478bd9Sstevel@tonic-gate /*
300bd670b35SErik Nordmark * Add a fully initialized IPv6 IRE to the forwarding table.
301bd670b35SErik Nordmark * This returns NULL on failure, or a held IRE on success.
302bd670b35SErik Nordmark * Normally the returned IRE is the same as the argument. But a different
303bd670b35SErik Nordmark * IRE will be returned if the added IRE is deemed identical to an existing
304bd670b35SErik Nordmark * one. In that case ire_identical_ref will be increased.
305bd670b35SErik Nordmark * The caller always needs to do an ire_refrele() on the returned IRE.
3067c478bd9Sstevel@tonic-gate */
307bd670b35SErik Nordmark ire_t *
ire_add_v6(ire_t * ire)308bd670b35SErik Nordmark ire_add_v6(ire_t *ire)
3097c478bd9Sstevel@tonic-gate {
3107c478bd9Sstevel@tonic-gate ire_t *ire1;
3117c478bd9Sstevel@tonic-gate int mask_table_index;
3127c478bd9Sstevel@tonic-gate irb_t *irb_ptr;
3137c478bd9Sstevel@tonic-gate ire_t **irep;
314bd670b35SErik Nordmark int match_flags;
3157c478bd9Sstevel@tonic-gate int error;
316f4b3ec61Sdh ip_stack_t *ipst = ire->ire_ipst;
3177c478bd9Sstevel@tonic-gate
3187c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV6_VERSION);
3197c478bd9Sstevel@tonic-gate
3207c478bd9Sstevel@tonic-gate /* Make sure the address is properly masked. */
3217c478bd9Sstevel@tonic-gate V6_MASK_COPY(ire->ire_addr_v6, ire->ire_mask_v6, ire->ire_addr_v6);
3227c478bd9Sstevel@tonic-gate
323bd670b35SErik Nordmark mask_table_index = ip_mask_to_plen_v6(&ire->ire_mask_v6);
324bd670b35SErik Nordmark if ((ipst->ips_ip_forwarding_table_v6[mask_table_index]) == NULL) {
325bd670b35SErik Nordmark irb_t *ptr;
326bd670b35SErik Nordmark int i;
3277c478bd9Sstevel@tonic-gate
328bd670b35SErik Nordmark ptr = (irb_t *)mi_zalloc((ipst->ips_ip6_ftable_hash_size *
329bd670b35SErik Nordmark sizeof (irb_t)));
330bd670b35SErik Nordmark if (ptr == NULL) {
3317c478bd9Sstevel@tonic-gate ire_delete(ire);
332bd670b35SErik Nordmark return (NULL);
3337c478bd9Sstevel@tonic-gate }
334bd670b35SErik Nordmark for (i = 0; i < ipst->ips_ip6_ftable_hash_size; i++) {
335bd670b35SErik Nordmark rw_init(&ptr[i].irb_lock, NULL, RW_DEFAULT, NULL);
336f1c454b4SSowmini Varadhan ptr[i].irb_ipst = ipst;
337bd670b35SErik Nordmark }
338bd670b35SErik Nordmark mutex_enter(&ipst->ips_ire_ft_init_lock);
339bd670b35SErik Nordmark if (ipst->ips_ip_forwarding_table_v6[mask_table_index] ==
340bd670b35SErik Nordmark NULL) {
341bd670b35SErik Nordmark ipst->ips_ip_forwarding_table_v6[mask_table_index] =
342bd670b35SErik Nordmark ptr;
343bd670b35SErik Nordmark mutex_exit(&ipst->ips_ire_ft_init_lock);
344bd670b35SErik Nordmark } else {
345bd670b35SErik Nordmark /*
346bd670b35SErik Nordmark * Some other thread won the race in
347bd670b35SErik Nordmark * initializing the forwarding table at the
348bd670b35SErik Nordmark * same index.
349bd670b35SErik Nordmark */
350bd670b35SErik Nordmark mutex_exit(&ipst->ips_ire_ft_init_lock);
351bd670b35SErik Nordmark for (i = 0; i < ipst->ips_ip6_ftable_hash_size; i++) {
352bd670b35SErik Nordmark rw_destroy(&ptr[i].irb_lock);
353bd670b35SErik Nordmark }
354bd670b35SErik Nordmark mi_free(ptr);
3557c478bd9Sstevel@tonic-gate }
3567c478bd9Sstevel@tonic-gate }
357bd670b35SErik Nordmark irb_ptr = &(ipst->ips_ip_forwarding_table_v6[mask_table_index][
358bd670b35SErik Nordmark IRE_ADDR_MASK_HASH_V6(ire->ire_addr_v6, ire->ire_mask_v6,
359bd670b35SErik Nordmark ipst->ips_ip6_ftable_hash_size)]);
3607c478bd9Sstevel@tonic-gate
361bd670b35SErik Nordmark match_flags = (MATCH_IRE_MASK | MATCH_IRE_TYPE | MATCH_IRE_GW);
362bd670b35SErik Nordmark if (ire->ire_ill != NULL)
363bd670b35SErik Nordmark match_flags |= MATCH_IRE_ILL;
3647c478bd9Sstevel@tonic-gate /*
365bd670b35SErik Nordmark * Start the atomic add of the ire. Grab the bucket lock and the
366bd670b35SErik Nordmark * ill lock. Check for condemned.
3677c478bd9Sstevel@tonic-gate */
368bd670b35SErik Nordmark error = ire_atomic_start(irb_ptr, ire);
369bd670b35SErik Nordmark if (error != 0) {
370bd670b35SErik Nordmark ire_delete(ire);
371bd670b35SErik Nordmark return (NULL);
372bd670b35SErik Nordmark }
373e11c3f44Smeem
3747c478bd9Sstevel@tonic-gate /*
375e11c3f44Smeem * If we are creating a hidden IRE, make sure we search for
376e11c3f44Smeem * hidden IREs when searching for duplicates below.
377e11c3f44Smeem * Otherwise, we might find an IRE on some other interface
378e11c3f44Smeem * that's not marked hidden.
3797c478bd9Sstevel@tonic-gate */
380bd670b35SErik Nordmark if (ire->ire_testhidden)
381bd670b35SErik Nordmark match_flags |= MATCH_IRE_TESTHIDDEN;
3827c478bd9Sstevel@tonic-gate
3837c478bd9Sstevel@tonic-gate /*
3847c478bd9Sstevel@tonic-gate * Atomically check for duplicate and insert in the table.
3857c478bd9Sstevel@tonic-gate */
3867c478bd9Sstevel@tonic-gate for (ire1 = irb_ptr->irb_ire; ire1 != NULL; ire1 = ire1->ire_next) {
387bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire1))
3887c478bd9Sstevel@tonic-gate continue;
389bd670b35SErik Nordmark /*
390bd670b35SErik Nordmark * Here we need an exact match on zoneid, i.e.,
391bd670b35SErik Nordmark * ire_match_args doesn't fit.
392bd670b35SErik Nordmark */
3937c478bd9Sstevel@tonic-gate if (ire1->ire_zoneid != ire->ire_zoneid)
3947c478bd9Sstevel@tonic-gate continue;
395bd670b35SErik Nordmark
396bd670b35SErik Nordmark if (ire1->ire_type != ire->ire_type)
397bd670b35SErik Nordmark continue;
398bd670b35SErik Nordmark
399bd670b35SErik Nordmark /*
400bd670b35SErik Nordmark * Note: We do not allow multiple routes that differ only
401bd670b35SErik Nordmark * in the gateway security attributes; such routes are
402bd670b35SErik Nordmark * considered duplicates.
403bd670b35SErik Nordmark * To change that we explicitly have to treat them as
404bd670b35SErik Nordmark * different here.
405bd670b35SErik Nordmark */
4067c478bd9Sstevel@tonic-gate if (ire_match_args_v6(ire1, &ire->ire_addr_v6,
4077c478bd9Sstevel@tonic-gate &ire->ire_mask_v6, &ire->ire_gateway_addr_v6,
408bd670b35SErik Nordmark ire->ire_type, ire->ire_ill, ire->ire_zoneid, NULL,
409bd670b35SErik Nordmark match_flags)) {
4107c478bd9Sstevel@tonic-gate /*
4117c478bd9Sstevel@tonic-gate * Return the old ire after doing a REFHOLD.
4127c478bd9Sstevel@tonic-gate * As most of the callers continue to use the IRE
4137c478bd9Sstevel@tonic-gate * after adding, we return a held ire. This will
4147c478bd9Sstevel@tonic-gate * avoid a lookup in the caller again. If the callers
4157c478bd9Sstevel@tonic-gate * don't want to use it, they need to do a REFRELE.
41678377681SSowmini Varadhan *
41778377681SSowmini Varadhan * We only allow exactly one IRE_IF_CLONE for any dst,
41878377681SSowmini Varadhan * so, if the is an IF_CLONE, return the ire without
41978377681SSowmini Varadhan * an identical_ref, but with an ire_ref held.
4207c478bd9Sstevel@tonic-gate */
42178377681SSowmini Varadhan if (ire->ire_type != IRE_IF_CLONE) {
42278377681SSowmini Varadhan atomic_add_32(&ire1->ire_identical_ref, 1);
42378377681SSowmini Varadhan DTRACE_PROBE2(ire__add__exist, ire_t *, ire1,
42478377681SSowmini Varadhan ire_t *, ire);
42578377681SSowmini Varadhan }
4267c478bd9Sstevel@tonic-gate ip1dbg(("found dup ire existing %p new %p",
4277c478bd9Sstevel@tonic-gate (void *)ire1, (void *)ire));
428bd670b35SErik Nordmark ire_refhold(ire1);
4297c478bd9Sstevel@tonic-gate ire_atomic_end(irb_ptr, ire);
4307c478bd9Sstevel@tonic-gate ire_delete(ire);
431bd670b35SErik Nordmark return (ire1);
4327c478bd9Sstevel@tonic-gate }
4337c478bd9Sstevel@tonic-gate }
4347c478bd9Sstevel@tonic-gate
4357c478bd9Sstevel@tonic-gate /*
436bd670b35SErik Nordmark * Normally we do head insertion since most things do not care about
437bd670b35SErik Nordmark * the order of the IREs in the bucket.
438bd670b35SErik Nordmark * However, due to shared-IP zones (and restrict_interzone_loopback)
439bd670b35SErik Nordmark * we can have an IRE_LOCAL as well as IRE_IF_CLONE for the same
440bd670b35SErik Nordmark * address. For that reason we do tail insertion for IRE_IF_CLONE.
4417c478bd9Sstevel@tonic-gate */
4427c478bd9Sstevel@tonic-gate irep = (ire_t **)irb_ptr;
443bd670b35SErik Nordmark if (ire->ire_type & IRE_IF_CLONE) {
444bd670b35SErik Nordmark while ((ire1 = *irep) != NULL)
4457c478bd9Sstevel@tonic-gate irep = &ire1->ire_next;
4467c478bd9Sstevel@tonic-gate }
4477c478bd9Sstevel@tonic-gate /* Insert at *irep */
4487c478bd9Sstevel@tonic-gate ire1 = *irep;
4497c478bd9Sstevel@tonic-gate if (ire1 != NULL)
4507c478bd9Sstevel@tonic-gate ire1->ire_ptpn = &ire->ire_next;
4517c478bd9Sstevel@tonic-gate ire->ire_next = ire1;
4527c478bd9Sstevel@tonic-gate /* Link the new one in. */
4537c478bd9Sstevel@tonic-gate ire->ire_ptpn = irep;
4547c478bd9Sstevel@tonic-gate /*
4557c478bd9Sstevel@tonic-gate * ire_walk routines de-reference ire_next without holding
4567c478bd9Sstevel@tonic-gate * a lock. Before we point to the new ire, we want to make
4577c478bd9Sstevel@tonic-gate * sure the store that sets the ire_next of the new ire
4587c478bd9Sstevel@tonic-gate * reaches global visibility, so that ire_walk routines
4597c478bd9Sstevel@tonic-gate * don't see a truncated list of ires i.e if the ire_next
4607c478bd9Sstevel@tonic-gate * of the new ire gets set after we do "*irep = ire" due
4617c478bd9Sstevel@tonic-gate * to re-ordering, the ire_walk thread will see a NULL
4627c478bd9Sstevel@tonic-gate * once it accesses the ire_next of the new ire.
4637c478bd9Sstevel@tonic-gate * membar_producer() makes sure that the following store
4647c478bd9Sstevel@tonic-gate * happens *after* all of the above stores.
4657c478bd9Sstevel@tonic-gate */
4667c478bd9Sstevel@tonic-gate membar_producer();
4677c478bd9Sstevel@tonic-gate *irep = ire;
4687c478bd9Sstevel@tonic-gate ire->ire_bucket = irb_ptr;
4697c478bd9Sstevel@tonic-gate /*
4707c478bd9Sstevel@tonic-gate * We return a bumped up IRE above. Keep it symmetrical
4717c478bd9Sstevel@tonic-gate * so that the callers will always have to release. This
4727c478bd9Sstevel@tonic-gate * helps the callers of this function because they continue
4737c478bd9Sstevel@tonic-gate * to use the IRE after adding and hence they don't have to
4747c478bd9Sstevel@tonic-gate * lookup again after we return the IRE.
4757c478bd9Sstevel@tonic-gate *
4767c478bd9Sstevel@tonic-gate * NOTE : We don't have to use atomics as this is appearing
4777c478bd9Sstevel@tonic-gate * in the list for the first time and no one else can bump
4787c478bd9Sstevel@tonic-gate * up the reference count on this yet.
4797c478bd9Sstevel@tonic-gate */
480bd670b35SErik Nordmark ire_refhold_locked(ire);
481f4b3ec61Sdh BUMP_IRE_STATS(ipst->ips_ire_stats_v6, ire_stats_inserted);
4827c478bd9Sstevel@tonic-gate irb_ptr->irb_ire_cnt++;
4837c478bd9Sstevel@tonic-gate
484bd670b35SErik Nordmark if (ire->ire_ill != NULL) {
485bd670b35SErik Nordmark DTRACE_PROBE3(ill__incr__cnt, (ill_t *), ire->ire_ill,
486968d2fd1Ssowmini (char *), "ire", (void *), ire);
487bd670b35SErik Nordmark ire->ire_ill->ill_ire_cnt++;
488bd670b35SErik Nordmark ASSERT(ire->ire_ill->ill_ire_cnt != 0); /* Wraparound */
4897c478bd9Sstevel@tonic-gate }
4907c478bd9Sstevel@tonic-gate ire_atomic_end(irb_ptr, ire);
4917c478bd9Sstevel@tonic-gate
492bd670b35SErik Nordmark /* Make any caching of the IREs be notified or updated */
493bd670b35SErik Nordmark ire_flush_cache_v6(ire, IRE_FLUSH_ADD);
4947c478bd9Sstevel@tonic-gate
495bd670b35SErik Nordmark return (ire);
4967c478bd9Sstevel@tonic-gate }
4977c478bd9Sstevel@tonic-gate
4987c478bd9Sstevel@tonic-gate /*
4997c478bd9Sstevel@tonic-gate * Search for all HOST REDIRECT routes that are
5007c478bd9Sstevel@tonic-gate * pointing at the specified gateway and
5017c478bd9Sstevel@tonic-gate * delete them. This routine is called only
5027c478bd9Sstevel@tonic-gate * when a default gateway is going away.
5037c478bd9Sstevel@tonic-gate */
5047c478bd9Sstevel@tonic-gate static void
ire_delete_host_redirects_v6(const in6_addr_t * gateway,ip_stack_t * ipst)505f4b3ec61Sdh ire_delete_host_redirects_v6(const in6_addr_t *gateway, ip_stack_t *ipst)
5067c478bd9Sstevel@tonic-gate {
5077c478bd9Sstevel@tonic-gate irb_t *irb_ptr;
5087c478bd9Sstevel@tonic-gate irb_t *irb;
5097c478bd9Sstevel@tonic-gate ire_t *ire;
5107c478bd9Sstevel@tonic-gate in6_addr_t gw_addr_v6;
5117c478bd9Sstevel@tonic-gate int i;
5127c478bd9Sstevel@tonic-gate
5137c478bd9Sstevel@tonic-gate /* get the hash table for HOST routes */
514f4b3ec61Sdh irb_ptr = ipst->ips_ip_forwarding_table_v6[(IP6_MASK_TABLE_SIZE - 1)];
5157c478bd9Sstevel@tonic-gate if (irb_ptr == NULL)
5167c478bd9Sstevel@tonic-gate return;
517f4b3ec61Sdh for (i = 0; (i < ipst->ips_ip6_ftable_hash_size); i++) {
5187c478bd9Sstevel@tonic-gate irb = &irb_ptr[i];
519bd670b35SErik Nordmark irb_refhold(irb);
5207c478bd9Sstevel@tonic-gate for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) {
5216bdb8e66Sdd if (!(ire->ire_flags & RTF_DYNAMIC))
5227c478bd9Sstevel@tonic-gate continue;
5237c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock);
5247c478bd9Sstevel@tonic-gate gw_addr_v6 = ire->ire_gateway_addr_v6;
5257c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock);
5267c478bd9Sstevel@tonic-gate if (IN6_ARE_ADDR_EQUAL(&gw_addr_v6, gateway))
5277c478bd9Sstevel@tonic-gate ire_delete(ire);
5287c478bd9Sstevel@tonic-gate }
529bd670b35SErik Nordmark irb_refrele(irb);
5307c478bd9Sstevel@tonic-gate }
5317c478bd9Sstevel@tonic-gate }
5327c478bd9Sstevel@tonic-gate
5337c478bd9Sstevel@tonic-gate /*
5347c478bd9Sstevel@tonic-gate * Delete the specified IRE.
5357c478bd9Sstevel@tonic-gate * All calls should use ire_delete().
5367c478bd9Sstevel@tonic-gate * Sometimes called as writer though not required by this function.
5377c478bd9Sstevel@tonic-gate *
5387c478bd9Sstevel@tonic-gate * NOTE : This function is called only if the ire was added
5397c478bd9Sstevel@tonic-gate * in the list.
5407c478bd9Sstevel@tonic-gate */
5417c478bd9Sstevel@tonic-gate void
ire_delete_v6(ire_t * ire)5427c478bd9Sstevel@tonic-gate ire_delete_v6(ire_t *ire)
5437c478bd9Sstevel@tonic-gate {
5447c478bd9Sstevel@tonic-gate in6_addr_t gw_addr_v6;
545f4b3ec61Sdh ip_stack_t *ipst = ire->ire_ipst;
5467c478bd9Sstevel@tonic-gate
547bd670b35SErik Nordmark /*
548bd670b35SErik Nordmark * Make sure ire_generation increases from ire_flush_cache happen
549bd670b35SErik Nordmark * after any lookup/reader has read ire_generation.
550bd670b35SErik Nordmark * Since the rw_enter makes us wait until any lookup/reader has
551bd670b35SErik Nordmark * completed we can exit the lock immediately.
552bd670b35SErik Nordmark */
553bd670b35SErik Nordmark rw_enter(&ipst->ips_ip6_ire_head_lock, RW_WRITER);
554bd670b35SErik Nordmark rw_exit(&ipst->ips_ip6_ire_head_lock);
555bd670b35SErik Nordmark
5567c478bd9Sstevel@tonic-gate ASSERT(ire->ire_refcnt >= 1);
5577c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV6_VERSION);
5587c478bd9Sstevel@tonic-gate
559bd670b35SErik Nordmark ire_flush_cache_v6(ire, IRE_FLUSH_DELETE);
560bd670b35SErik Nordmark
5617c478bd9Sstevel@tonic-gate if (ire->ire_type == IRE_DEFAULT) {
5627c478bd9Sstevel@tonic-gate /*
5637c478bd9Sstevel@tonic-gate * when a default gateway is going away
5647c478bd9Sstevel@tonic-gate * delete all the host redirects pointing at that
5657c478bd9Sstevel@tonic-gate * gateway.
5667c478bd9Sstevel@tonic-gate */
5677c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock);
5687c478bd9Sstevel@tonic-gate gw_addr_v6 = ire->ire_gateway_addr_v6;
5697c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock);
570f4b3ec61Sdh ire_delete_host_redirects_v6(&gw_addr_v6, ipst);
5717c478bd9Sstevel@tonic-gate }
5727c478bd9Sstevel@tonic-gate
573bd670b35SErik Nordmark /*
574bd670b35SErik Nordmark * If we are deleting an IRE_INTERFACE then we make sure we also
575bd670b35SErik Nordmark * delete any IRE_IF_CLONE that has been created from it.
576bd670b35SErik Nordmark * Those are always in ire_dep_children.
577bd670b35SErik Nordmark */
578bd670b35SErik Nordmark if ((ire->ire_type & IRE_INTERFACE) && ire->ire_dep_children != 0)
579bd670b35SErik Nordmark ire_dep_delete_if_clone(ire);
5807c478bd9Sstevel@tonic-gate
581bd670b35SErik Nordmark /* Remove from parent dependencies and child */
582bd670b35SErik Nordmark rw_enter(&ipst->ips_ire_dep_lock, RW_WRITER);
583bd670b35SErik Nordmark if (ire->ire_dep_parent != NULL) {
584bd670b35SErik Nordmark ire_dep_remove(ire);
5857c478bd9Sstevel@tonic-gate }
586bd670b35SErik Nordmark while (ire->ire_dep_children != NULL)
587bd670b35SErik Nordmark ire_dep_remove(ire->ire_dep_children);
588bd670b35SErik Nordmark rw_exit(&ipst->ips_ire_dep_lock);
5897c478bd9Sstevel@tonic-gate }
5907c478bd9Sstevel@tonic-gate
5917c478bd9Sstevel@tonic-gate /*
592bd670b35SErik Nordmark * When an IRE is added or deleted this routine is called to make sure
593bd670b35SErik Nordmark * any caching of IRE information is notified or updated.
5947c478bd9Sstevel@tonic-gate *
595bd670b35SErik Nordmark * The flag argument indicates if the flush request is due to addition
596bd670b35SErik Nordmark * of new route (IRE_FLUSH_ADD), deletion of old route (IRE_FLUSH_DELETE),
597bd670b35SErik Nordmark * or a change to ire_gateway_addr (IRE_FLUSH_GWCHANGE).
5987c478bd9Sstevel@tonic-gate */
5997c478bd9Sstevel@tonic-gate void
ire_flush_cache_v6(ire_t * ire,int flag)6007c478bd9Sstevel@tonic-gate ire_flush_cache_v6(ire_t *ire, int flag)
6017c478bd9Sstevel@tonic-gate {
602bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst;
6037c478bd9Sstevel@tonic-gate
604bd670b35SErik Nordmark /*
605bd670b35SErik Nordmark * IRE_IF_CLONE ire's don't provide any new information
606bd670b35SErik Nordmark * than the parent from which they are cloned, so don't
607bd670b35SErik Nordmark * perturb the generation numbers.
608bd670b35SErik Nordmark */
609bd670b35SErik Nordmark if (ire->ire_type & IRE_IF_CLONE)
61054da8755Ssowmini return;
6117c478bd9Sstevel@tonic-gate
6127c478bd9Sstevel@tonic-gate /*
613bd670b35SErik Nordmark * Ensure that an ire_add during a lookup serializes the updates of
614bd670b35SErik Nordmark * the generation numbers under ire_head_lock so that the lookup gets
615bd670b35SErik Nordmark * either the old ire and old generation number, or a new ire and new
616bd670b35SErik Nordmark * generation number.
617bd670b35SErik Nordmark */
618bd670b35SErik Nordmark rw_enter(&ipst->ips_ip6_ire_head_lock, RW_WRITER);
619bd670b35SErik Nordmark
620bd670b35SErik Nordmark /*
621bd670b35SErik Nordmark * If a route was just added, we need to notify everybody that
622bd670b35SErik Nordmark * has cached an IRE_NOROUTE since there might now be a better
623bd670b35SErik Nordmark * route for them.
6247c478bd9Sstevel@tonic-gate */
6257c478bd9Sstevel@tonic-gate if (flag == IRE_FLUSH_ADD) {
626bd670b35SErik Nordmark ire_increment_generation(ipst->ips_ire_reject_v6);
627bd670b35SErik Nordmark ire_increment_generation(ipst->ips_ire_blackhole_v6);
628bd670b35SErik Nordmark }
629bd670b35SErik Nordmark
630bd670b35SErik Nordmark /* Adding a default can't otherwise provide a better route */
631bd670b35SErik Nordmark if (ire->ire_type == IRE_DEFAULT && flag == IRE_FLUSH_ADD) {
632bd670b35SErik Nordmark rw_exit(&ipst->ips_ip6_ire_head_lock);
633bd670b35SErik Nordmark return;
634bd670b35SErik Nordmark }
635bd670b35SErik Nordmark
636bd670b35SErik Nordmark switch (flag) {
637bd670b35SErik Nordmark case IRE_FLUSH_DELETE:
638bd670b35SErik Nordmark case IRE_FLUSH_GWCHANGE:
6397c478bd9Sstevel@tonic-gate /*
640bd670b35SErik Nordmark * Update ire_generation for all ire_dep_children chains
641bd670b35SErik Nordmark * starting with this IRE
6427c478bd9Sstevel@tonic-gate */
643bd670b35SErik Nordmark ire_dep_incr_generation(ire);
644bd670b35SErik Nordmark break;
645bd670b35SErik Nordmark case IRE_FLUSH_ADD: {
646bd670b35SErik Nordmark in6_addr_t addr;
647bd670b35SErik Nordmark in6_addr_t mask;
648bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst;
649bd670b35SErik Nordmark uint_t masklen;
650bd670b35SErik Nordmark
6517c478bd9Sstevel@tonic-gate /*
652bd670b35SErik Nordmark * Find an IRE which is a shorter match than the ire to be added
653bd670b35SErik Nordmark * For any such IRE (which we repeat) we update the
654bd670b35SErik Nordmark * ire_generation the same way as in the delete case.
6557c478bd9Sstevel@tonic-gate */
656bd670b35SErik Nordmark addr = ire->ire_addr_v6;
657bd670b35SErik Nordmark mask = ire->ire_mask_v6;
658bd670b35SErik Nordmark masklen = ip_mask_to_plen_v6(&mask);
659bd670b35SErik Nordmark
660bd670b35SErik Nordmark ire = ire_ftable_lookup_impl_v6(&addr, &mask, NULL, 0, NULL,
661bd670b35SErik Nordmark ALL_ZONES, NULL, MATCH_IRE_SHORTERMASK, ipst);
662bd670b35SErik Nordmark while (ire != NULL) {
663bd670b35SErik Nordmark /* We need to handle all in the same bucket */
664bd670b35SErik Nordmark irb_increment_generation(ire->ire_bucket);
665bd670b35SErik Nordmark
666bd670b35SErik Nordmark mask = ire->ire_mask_v6;
667bd670b35SErik Nordmark ASSERT(masklen > ip_mask_to_plen_v6(&mask));
668bd670b35SErik Nordmark masklen = ip_mask_to_plen_v6(&mask);
669bd670b35SErik Nordmark ire_refrele(ire);
670bd670b35SErik Nordmark ire = ire_ftable_lookup_impl_v6(&addr, &mask, NULL, 0,
671bd670b35SErik Nordmark NULL, ALL_ZONES, NULL, MATCH_IRE_SHORTERMASK, ipst);
6727c478bd9Sstevel@tonic-gate }
673bd670b35SErik Nordmark }
674bd670b35SErik Nordmark break;
6757c478bd9Sstevel@tonic-gate }
676bd670b35SErik Nordmark rw_exit(&ipst->ips_ip6_ire_head_lock);
6777c478bd9Sstevel@tonic-gate }
6787c478bd9Sstevel@tonic-gate
6797c478bd9Sstevel@tonic-gate /*
6807c478bd9Sstevel@tonic-gate * Matches the arguments passed with the values in the ire.
6817c478bd9Sstevel@tonic-gate *
682bd670b35SErik Nordmark * Note: for match types that match using "ill" passed in, ill
6837c478bd9Sstevel@tonic-gate * must be checked for non-NULL before calling this routine.
6847c478bd9Sstevel@tonic-gate */
685bd670b35SErik Nordmark boolean_t
ire_match_args_v6(ire_t * ire,const in6_addr_t * addr,const in6_addr_t * mask,const in6_addr_t * gateway,int type,const ill_t * ill,zoneid_t zoneid,const ts_label_t * tsl,int match_flags)6867c478bd9Sstevel@tonic-gate ire_match_args_v6(ire_t *ire, const in6_addr_t *addr, const in6_addr_t *mask,
687bd670b35SErik Nordmark const in6_addr_t *gateway, int type, const ill_t *ill, zoneid_t zoneid,
688bd670b35SErik Nordmark const ts_label_t *tsl, int match_flags)
6897c478bd9Sstevel@tonic-gate {
690*ab82c29bSToomas Soome in6_addr_t gw_addr_v6 = { 0 };
6917c478bd9Sstevel@tonic-gate ill_t *ire_ill = NULL, *dst_ill;
692bd670b35SErik Nordmark ip_stack_t *ipst = ire->ire_ipst;
6937c478bd9Sstevel@tonic-gate
6947c478bd9Sstevel@tonic-gate ASSERT(ire->ire_ipversion == IPV6_VERSION);
6957c478bd9Sstevel@tonic-gate ASSERT(addr != NULL);
6967c478bd9Sstevel@tonic-gate ASSERT(mask != NULL);
6977c478bd9Sstevel@tonic-gate ASSERT((!(match_flags & MATCH_IRE_GW)) || gateway != NULL);
69844b099c4SSowmini Varadhan ASSERT((!(match_flags & (MATCH_IRE_ILL|MATCH_IRE_SRC_ILL))) ||
699bd670b35SErik Nordmark (ill != NULL && ill->ill_isv6));
7007c478bd9Sstevel@tonic-gate
7017c478bd9Sstevel@tonic-gate /*
702bd670b35SErik Nordmark * If MATCH_IRE_TESTHIDDEN is set, then only return the IRE if it
703bd670b35SErik Nordmark * is in fact hidden, to ensure the caller gets the right one.
7047c478bd9Sstevel@tonic-gate */
705bd670b35SErik Nordmark if (ire->ire_testhidden) {
706bd670b35SErik Nordmark if (!(match_flags & MATCH_IRE_TESTHIDDEN))
707e11c3f44Smeem return (B_FALSE);
708e11c3f44Smeem }
7097c478bd9Sstevel@tonic-gate
71045916cd2Sjpk if (zoneid != ALL_ZONES && zoneid != ire->ire_zoneid &&
71145916cd2Sjpk ire->ire_zoneid != ALL_ZONES) {
7127c478bd9Sstevel@tonic-gate /*
713bd670b35SErik Nordmark * If MATCH_IRE_ZONEONLY has been set and the supplied zoneid
714bd670b35SErik Nordmark * does not match that of ire_zoneid, a failure to
7157c478bd9Sstevel@tonic-gate * match is reported at this point. Otherwise, since some IREs
7167c478bd9Sstevel@tonic-gate * that are available in the global zone can be used in local
7177c478bd9Sstevel@tonic-gate * zones, additional checks need to be performed:
7187c478bd9Sstevel@tonic-gate *
719bd670b35SErik Nordmark * IRE_LOOPBACK
720bd670b35SErik Nordmark * entries should never be matched in this situation.
721bd670b35SErik Nordmark * Each zone has its own IRE_LOOPBACK.
7227c478bd9Sstevel@tonic-gate *
723bd670b35SErik Nordmark * IRE_LOCAL
724bd670b35SErik Nordmark * We allow them for any zoneid. ire_route_recursive
725bd670b35SErik Nordmark * does additional checks when
726bd670b35SErik Nordmark * ip_restrict_interzone_loopback is set.
7277c478bd9Sstevel@tonic-gate *
728bd670b35SErik Nordmark * If ill_usesrc_ifindex is set
729bd670b35SErik Nordmark * Then we check if the zone has a valid source address
730bd670b35SErik Nordmark * on the usesrc ill.
7317c478bd9Sstevel@tonic-gate *
732bd670b35SErik Nordmark * If ire_ill is set, then check that the zone has an ipif
733bd670b35SErik Nordmark * on that ill.
734bd670b35SErik Nordmark *
735bd670b35SErik Nordmark * Outside of this function (in ire_round_robin) we check
736bd670b35SErik Nordmark * that any IRE_OFFLINK has a gateway that reachable from the
737bd670b35SErik Nordmark * zone when we have multiple choices (ECMP).
7387c478bd9Sstevel@tonic-gate */
7397c478bd9Sstevel@tonic-gate if (match_flags & MATCH_IRE_ZONEONLY)
7407c478bd9Sstevel@tonic-gate return (B_FALSE);
741bd670b35SErik Nordmark if (ire->ire_type & IRE_LOOPBACK)
7427c478bd9Sstevel@tonic-gate return (B_FALSE);
743bd670b35SErik Nordmark
744bd670b35SErik Nordmark if (ire->ire_type & IRE_LOCAL)
745bd670b35SErik Nordmark goto matchit;
746bd670b35SErik Nordmark
7477c478bd9Sstevel@tonic-gate /*
748bd670b35SErik Nordmark * The normal case of IRE_ONLINK has a matching zoneid.
749bd670b35SErik Nordmark * Here we handle the case when shared-IP zones have been
750bd670b35SErik Nordmark * configured with IP addresses on vniN. In that case it
751bd670b35SErik Nordmark * is ok for traffic from a zone to use IRE_ONLINK routes
752bd670b35SErik Nordmark * if the ill has a usesrc pointing at vniN
753bd670b35SErik Nordmark * Applies to IRE_INTERFACE.
7547c478bd9Sstevel@tonic-gate */
755bd670b35SErik Nordmark dst_ill = ire->ire_ill;
756bd670b35SErik Nordmark if (ire->ire_type & IRE_ONLINK) {
757bd670b35SErik Nordmark uint_t ifindex;
758bd670b35SErik Nordmark
759bd670b35SErik Nordmark /*
760bd670b35SErik Nordmark * Note there is no IRE_INTERFACE on vniN thus
761bd670b35SErik Nordmark * can't do an IRE lookup for a matching route.
762bd670b35SErik Nordmark */
763bd670b35SErik Nordmark ifindex = dst_ill->ill_usesrc_ifindex;
764bd670b35SErik Nordmark if (ifindex == 0)
765bd670b35SErik Nordmark return (B_FALSE);
766bd670b35SErik Nordmark
7677c478bd9Sstevel@tonic-gate /*
7687c478bd9Sstevel@tonic-gate * If there is a usable source address in the
769bd670b35SErik Nordmark * zone, then it's ok to return this IRE_INTERFACE
7707c478bd9Sstevel@tonic-gate */
771bd670b35SErik Nordmark if (!ipif_zone_avail(ifindex, dst_ill->ill_isv6,
772bd670b35SErik Nordmark zoneid, ipst)) {
773bd670b35SErik Nordmark ip3dbg(("ire_match_args: no usrsrc for zone"
7747c478bd9Sstevel@tonic-gate " dst_ill %p\n", (void *)dst_ill));
7757c478bd9Sstevel@tonic-gate return (B_FALSE);
7767c478bd9Sstevel@tonic-gate }
7777c478bd9Sstevel@tonic-gate }
778bd670b35SErik Nordmark /*
77944b099c4SSowmini Varadhan * For example, with
780bd670b35SErik Nordmark * route add 11.0.0.0 gw1 -ifp bge0
781bd670b35SErik Nordmark * route add 11.0.0.0 gw2 -ifp bge1
782bd670b35SErik Nordmark * this code would differentiate based on
783bd670b35SErik Nordmark * where the sending zone has addresses.
784bd670b35SErik Nordmark * Only if the zone has an address on bge0 can it use the first
785bd670b35SErik Nordmark * route. It isn't clear if this behavior is documented
786bd670b35SErik Nordmark * anywhere.
787bd670b35SErik Nordmark */
788bd670b35SErik Nordmark if (dst_ill != NULL && (ire->ire_type & IRE_OFFLINK)) {
7897c478bd9Sstevel@tonic-gate ipif_t *tipif;
7907c478bd9Sstevel@tonic-gate
791bd670b35SErik Nordmark mutex_enter(&dst_ill->ill_lock);
792bd670b35SErik Nordmark for (tipif = dst_ill->ill_ipif;
7937c478bd9Sstevel@tonic-gate tipif != NULL; tipif = tipif->ipif_next) {
794bd670b35SErik Nordmark if (!IPIF_IS_CONDEMNED(tipif) &&
7957c478bd9Sstevel@tonic-gate (tipif->ipif_flags & IPIF_UP) &&
79645916cd2Sjpk (tipif->ipif_zoneid == zoneid ||
79745916cd2Sjpk tipif->ipif_zoneid == ALL_ZONES))
7987c478bd9Sstevel@tonic-gate break;
7997c478bd9Sstevel@tonic-gate }
800bd670b35SErik Nordmark mutex_exit(&dst_ill->ill_lock);
8017c478bd9Sstevel@tonic-gate if (tipif == NULL)
8027c478bd9Sstevel@tonic-gate return (B_FALSE);
8037c478bd9Sstevel@tonic-gate }
8047c478bd9Sstevel@tonic-gate }
8057c478bd9Sstevel@tonic-gate
806bd670b35SErik Nordmark matchit:
80744b099c4SSowmini Varadhan ire_ill = ire->ire_ill;
8087c478bd9Sstevel@tonic-gate if (match_flags & MATCH_IRE_GW) {
8097c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock);
8107c478bd9Sstevel@tonic-gate gw_addr_v6 = ire->ire_gateway_addr_v6;
8117c478bd9Sstevel@tonic-gate mutex_exit(&ire->ire_lock);
8127c478bd9Sstevel@tonic-gate }
813e11c3f44Smeem if (match_flags & MATCH_IRE_ILL) {
8147c478bd9Sstevel@tonic-gate
815bd670b35SErik Nordmark /*
816bd670b35SErik Nordmark * If asked to match an ill, we *must* match
817bd670b35SErik Nordmark * on the ire_ill for ipmp test addresses, or
818bd670b35SErik Nordmark * any of the ill in the group for data addresses.
819bd670b35SErik Nordmark * If we don't, we may as well fail.
820bd670b35SErik Nordmark * However, we need an exception for IRE_LOCALs to ensure
821bd670b35SErik Nordmark * we loopback packets even sent to test addresses on different
822bd670b35SErik Nordmark * interfaces in the group.
823bd670b35SErik Nordmark */
824bd670b35SErik Nordmark if ((match_flags & MATCH_IRE_TESTHIDDEN) &&
825bd670b35SErik Nordmark !(ire->ire_type & IRE_LOCAL)) {
826bd670b35SErik Nordmark if (ire->ire_ill != ill)
827bd670b35SErik Nordmark return (B_FALSE);
828bd670b35SErik Nordmark } else {
829bd670b35SErik Nordmark match_flags &= ~MATCH_IRE_TESTHIDDEN;
830bd670b35SErik Nordmark /*
831bd670b35SErik Nordmark * We know that ill is not NULL, but ire_ill could be
832bd670b35SErik Nordmark * NULL
833bd670b35SErik Nordmark */
834bd670b35SErik Nordmark if (ire_ill == NULL || !IS_ON_SAME_LAN(ill, ire_ill))
835bd670b35SErik Nordmark return (B_FALSE);
836bd670b35SErik Nordmark }
837bd670b35SErik Nordmark }
83844b099c4SSowmini Varadhan if (match_flags & MATCH_IRE_SRC_ILL) {
83944b099c4SSowmini Varadhan if (ire_ill == NULL)
84044b099c4SSowmini Varadhan return (B_FALSE);
84144b099c4SSowmini Varadhan if (!IS_ON_SAME_LAN(ill, ire_ill)) {
84244b099c4SSowmini Varadhan if (ire_ill->ill_usesrc_ifindex == 0 ||
84344b099c4SSowmini Varadhan (ire_ill->ill_usesrc_ifindex !=
84444b099c4SSowmini Varadhan ill->ill_phyint->phyint_ifindex))
84544b099c4SSowmini Varadhan return (B_FALSE);
84644b099c4SSowmini Varadhan }
84744b099c4SSowmini Varadhan }
84844b099c4SSowmini Varadhan
8497c478bd9Sstevel@tonic-gate /* No ire_addr_v6 bits set past the mask */
8507c478bd9Sstevel@tonic-gate ASSERT(V6_MASK_EQ(ire->ire_addr_v6, ire->ire_mask_v6,
8517c478bd9Sstevel@tonic-gate ire->ire_addr_v6));
8527c478bd9Sstevel@tonic-gate if (V6_MASK_EQ(*addr, *mask, ire->ire_addr_v6) &&
8537c478bd9Sstevel@tonic-gate ((!(match_flags & MATCH_IRE_GW)) ||
85401685f97SSowmini Varadhan ((!(match_flags & MATCH_IRE_DIRECT)) ||
85501685f97SSowmini Varadhan !(ire->ire_flags & RTF_INDIRECT)) &&
85654da8755Ssowmini IN6_ARE_ADDR_EQUAL(&gw_addr_v6, gateway)) &&
857bd670b35SErik Nordmark ((!(match_flags & MATCH_IRE_TYPE)) || (ire->ire_type & type)) &&
858bd670b35SErik Nordmark ((!(match_flags & MATCH_IRE_TESTHIDDEN)) || ire->ire_testhidden) &&
859bd670b35SErik Nordmark ((!(match_flags & MATCH_IRE_MASK)) ||
860bd670b35SErik Nordmark (IN6_ARE_ADDR_EQUAL(&ire->ire_mask_v6, mask))) &&
86145916cd2Sjpk ((!(match_flags & MATCH_IRE_SECATTR)) ||
86254da8755Ssowmini (!is_system_labeled()) ||
86354da8755Ssowmini (tsol_ire_match_gwattr(ire, tsl) == 0))) {
8647c478bd9Sstevel@tonic-gate /* We found the matched IRE */
8657c478bd9Sstevel@tonic-gate return (B_TRUE);
8667c478bd9Sstevel@tonic-gate }
8677c478bd9Sstevel@tonic-gate return (B_FALSE);
8687c478bd9Sstevel@tonic-gate }
8697c478bd9Sstevel@tonic-gate
8707c478bd9Sstevel@tonic-gate /*
871bd670b35SErik Nordmark * Check if the zoneid (not ALL_ZONES) has an IRE_INTERFACE for the specified
872bd670b35SErik Nordmark * gateway address. If ill is non-NULL we also match on it.
873bd670b35SErik Nordmark * The caller must hold a read lock on RADIX_NODE_HEAD if lock_held is set.
8747c478bd9Sstevel@tonic-gate */
875bd670b35SErik Nordmark boolean_t
ire_gateway_ok_zone_v6(const in6_addr_t * gateway,zoneid_t zoneid,ill_t * ill,const ts_label_t * tsl,ip_stack_t * ipst,boolean_t lock_held)876bd670b35SErik Nordmark ire_gateway_ok_zone_v6(const in6_addr_t *gateway, zoneid_t zoneid, ill_t *ill,
877bd670b35SErik Nordmark const ts_label_t *tsl, ip_stack_t *ipst, boolean_t lock_held)
8787c478bd9Sstevel@tonic-gate {
879bd670b35SErik Nordmark ire_t *ire;
880bd670b35SErik Nordmark uint_t match_flags;
8817c478bd9Sstevel@tonic-gate
882bd670b35SErik Nordmark if (lock_held)
883bd670b35SErik Nordmark ASSERT(RW_READ_HELD(&ipst->ips_ip6_ire_head_lock));
884bd670b35SErik Nordmark else
885bd670b35SErik Nordmark rw_enter(&ipst->ips_ip6_ire_head_lock, RW_READER);
8867c478bd9Sstevel@tonic-gate
887bd670b35SErik Nordmark match_flags = MATCH_IRE_TYPE | MATCH_IRE_SECATTR;
888bd670b35SErik Nordmark if (ill != NULL)
889bd670b35SErik Nordmark match_flags |= MATCH_IRE_ILL;
890bd670b35SErik Nordmark
891bd670b35SErik Nordmark ire = ire_ftable_lookup_impl_v6(gateway, &ipv6_all_zeros,
892bd670b35SErik Nordmark &ipv6_all_zeros, IRE_INTERFACE, ill, zoneid, tsl, match_flags,
893bd670b35SErik Nordmark ipst);
894bd670b35SErik Nordmark
895bd670b35SErik Nordmark if (!lock_held)
896bd670b35SErik Nordmark rw_exit(&ipst->ips_ip6_ire_head_lock);
897bd670b35SErik Nordmark if (ire != NULL) {
898bd670b35SErik Nordmark ire_refrele(ire);
899bd670b35SErik Nordmark return (B_TRUE);
900bd670b35SErik Nordmark } else {
901bd670b35SErik Nordmark return (B_FALSE);
9027c478bd9Sstevel@tonic-gate }
9037c478bd9Sstevel@tonic-gate }
9047c478bd9Sstevel@tonic-gate
9057c478bd9Sstevel@tonic-gate /*
9067c478bd9Sstevel@tonic-gate * Lookup a route in forwarding table.
9077c478bd9Sstevel@tonic-gate * specific lookup is indicated by passing the
9087c478bd9Sstevel@tonic-gate * required parameters and indicating the
9097c478bd9Sstevel@tonic-gate * match required in flag field.
9107c478bd9Sstevel@tonic-gate *
9117c478bd9Sstevel@tonic-gate * Supports link-local addresses by following the ipif/ill when recursing.
9127c478bd9Sstevel@tonic-gate */
9137c478bd9Sstevel@tonic-gate ire_t *
ire_ftable_lookup_v6(const in6_addr_t * addr,const in6_addr_t * mask,const in6_addr_t * gateway,int type,const ill_t * ill,zoneid_t zoneid,const ts_label_t * tsl,int flags,uint32_t xmit_hint,ip_stack_t * ipst,uint_t * generationp)9147c478bd9Sstevel@tonic-gate ire_ftable_lookup_v6(const in6_addr_t *addr, const in6_addr_t *mask,
915bd670b35SErik Nordmark const in6_addr_t *gateway, int type, const ill_t *ill,
916bd670b35SErik Nordmark zoneid_t zoneid, const ts_label_t *tsl, int flags,
917bd670b35SErik Nordmark uint32_t xmit_hint, ip_stack_t *ipst, uint_t *generationp)
9187c478bd9Sstevel@tonic-gate {
9197c478bd9Sstevel@tonic-gate ire_t *ire = NULL;
9207c478bd9Sstevel@tonic-gate
9217c478bd9Sstevel@tonic-gate ASSERT(addr != NULL);
9227c478bd9Sstevel@tonic-gate ASSERT((!(flags & MATCH_IRE_MASK)) || mask != NULL);
9237c478bd9Sstevel@tonic-gate ASSERT((!(flags & MATCH_IRE_GW)) || gateway != NULL);
924bd670b35SErik Nordmark ASSERT(ill == NULL || ill->ill_isv6);
925bd670b35SErik Nordmark
926bd670b35SErik Nordmark ASSERT(!IN6_IS_ADDR_V4MAPPED(addr));
927bd670b35SErik Nordmark
928bd670b35SErik Nordmark /*
929bd670b35SErik Nordmark * ire_match_args_v6() will dereference ill if MATCH_IRE_ILL
93044b099c4SSowmini Varadhan * or MATCH_IRE_SRC_ILL is set.
931bd670b35SErik Nordmark */
93244b099c4SSowmini Varadhan if ((flags & (MATCH_IRE_ILL|MATCH_IRE_SRC_ILL)) && (ill == NULL))
933bd670b35SErik Nordmark return (NULL);
934bd670b35SErik Nordmark
935bd670b35SErik Nordmark rw_enter(&ipst->ips_ip6_ire_head_lock, RW_READER);
936bd670b35SErik Nordmark ire = ire_ftable_lookup_impl_v6(addr, mask, gateway, type, ill, zoneid,
937bd670b35SErik Nordmark tsl, flags, ipst);
938bd670b35SErik Nordmark if (ire == NULL) {
939bd670b35SErik Nordmark rw_exit(&ipst->ips_ip6_ire_head_lock);
940bd670b35SErik Nordmark return (NULL);
941bd670b35SErik Nordmark }
9427c478bd9Sstevel@tonic-gate
9437c478bd9Sstevel@tonic-gate /*
944bd670b35SErik Nordmark * round-robin only if we have more than one route in the bucket.
945bd670b35SErik Nordmark * ips_ip_ecmp_behavior controls when we do ECMP
946bd670b35SErik Nordmark * 2: always
947bd670b35SErik Nordmark * 1: for IRE_DEFAULT and /0 IRE_INTERFACE
948bd670b35SErik Nordmark * 0: never
949bd670b35SErik Nordmark *
950bd670b35SErik Nordmark * Note: if we found an IRE_IF_CLONE we won't look at the bucket with
951bd670b35SErik Nordmark * other ECMP IRE_INTERFACEs since the IRE_IF_CLONE is a /128 match
952bd670b35SErik Nordmark * and the IRE_INTERFACESs are likely to be shorter matches.
9537c478bd9Sstevel@tonic-gate */
954bd670b35SErik Nordmark if (ire->ire_bucket->irb_ire_cnt > 1 && !(flags & MATCH_IRE_GW)) {
955bd670b35SErik Nordmark if (ipst->ips_ip_ecmp_behavior == 2 ||
956bd670b35SErik Nordmark (ipst->ips_ip_ecmp_behavior == 1 &&
957bd670b35SErik Nordmark IS_DEFAULT_ROUTE_V6(ire))) {
958bd670b35SErik Nordmark ire_t *next_ire;
959bd670b35SErik Nordmark ire_ftable_args_t margs;
960bd670b35SErik Nordmark
961188e1664SErik Nordmark bzero(&margs, sizeof (margs));
962bd670b35SErik Nordmark margs.ift_addr_v6 = *addr;
963bd670b35SErik Nordmark if (mask != NULL)
964bd670b35SErik Nordmark margs.ift_mask_v6 = *mask;
965bd670b35SErik Nordmark if (gateway != NULL)
966bd670b35SErik Nordmark margs.ift_gateway_v6 = *gateway;
967bd670b35SErik Nordmark margs.ift_type = type;
968bd670b35SErik Nordmark margs.ift_ill = ill;
969bd670b35SErik Nordmark margs.ift_zoneid = zoneid;
970bd670b35SErik Nordmark margs.ift_tsl = tsl;
971bd670b35SErik Nordmark margs.ift_flags = flags;
972bd670b35SErik Nordmark
973bd670b35SErik Nordmark next_ire = ire_round_robin(ire->ire_bucket, &margs,
974bd670b35SErik Nordmark xmit_hint, ire, ipst);
975bd670b35SErik Nordmark if (next_ire == NULL) {
976bd670b35SErik Nordmark /* keep ire if next_ire is null */
977bd670b35SErik Nordmark goto done;
978bd670b35SErik Nordmark }
979bd670b35SErik Nordmark ire_refrele(ire);
980bd670b35SErik Nordmark ire = next_ire;
981bd670b35SErik Nordmark }
982bd670b35SErik Nordmark }
983bd670b35SErik Nordmark
984bd670b35SErik Nordmark done:
985bd670b35SErik Nordmark /* Return generation before dropping lock */
986bd670b35SErik Nordmark if (generationp != NULL)
987bd670b35SErik Nordmark *generationp = ire->ire_generation;
988bd670b35SErik Nordmark
989bd670b35SErik Nordmark rw_exit(&ipst->ips_ip6_ire_head_lock);
990bd670b35SErik Nordmark
9917c478bd9Sstevel@tonic-gate /*
992bd670b35SErik Nordmark * For shared-IP zones we need additional checks to what was
993bd670b35SErik Nordmark * done in ire_match_args to make sure IRE_LOCALs are handled.
994bd670b35SErik Nordmark *
995bd670b35SErik Nordmark * When ip_restrict_interzone_loopback is set, then
996bd670b35SErik Nordmark * we ensure that IRE_LOCAL are only used for loopback
997bd670b35SErik Nordmark * between zones when the logical "Ethernet" would
998bd670b35SErik Nordmark * have looped them back. That is, if in the absense of
999bd670b35SErik Nordmark * the IRE_LOCAL we would have sent to packet out the
1000bd670b35SErik Nordmark * same ill.
10017c478bd9Sstevel@tonic-gate */
1002bd670b35SErik Nordmark if ((ire->ire_type & IRE_LOCAL) && zoneid != ALL_ZONES &&
1003bd670b35SErik Nordmark ire->ire_zoneid != zoneid && ire->ire_zoneid != ALL_ZONES &&
1004bd670b35SErik Nordmark ipst->ips_ip_restrict_interzone_loopback) {
1005bd670b35SErik Nordmark ire = ire_alt_local(ire, zoneid, tsl, ill, generationp);
1006bd670b35SErik Nordmark ASSERT(ire != NULL);
1007bd670b35SErik Nordmark }
1008bd670b35SErik Nordmark
1009bd670b35SErik Nordmark return (ire);
1010bd670b35SErik Nordmark }
1011bd670b35SErik Nordmark
1012bd670b35SErik Nordmark /*
1013bd670b35SErik Nordmark * Look up a single ire. The caller holds either the read or write lock.
1014bd670b35SErik Nordmark */
1015bd670b35SErik Nordmark ire_t *
ire_ftable_lookup_impl_v6(const in6_addr_t * addr,const in6_addr_t * mask,const in6_addr_t * gateway,int type,const ill_t * ill,zoneid_t zoneid,const ts_label_t * tsl,int flags,ip_stack_t * ipst)1016bd670b35SErik Nordmark ire_ftable_lookup_impl_v6(const in6_addr_t *addr, const in6_addr_t *mask,
1017bd670b35SErik Nordmark const in6_addr_t *gateway, int type, const ill_t *ill,
1018bd670b35SErik Nordmark zoneid_t zoneid, const ts_label_t *tsl, int flags,
1019bd670b35SErik Nordmark ip_stack_t *ipst)
1020bd670b35SErik Nordmark {
1021bd670b35SErik Nordmark irb_t *irb_ptr;
1022bd670b35SErik Nordmark ire_t *ire = NULL;
1023bd670b35SErik Nordmark int i;
1024bd670b35SErik Nordmark
1025bd670b35SErik Nordmark ASSERT(RW_LOCK_HELD(&ipst->ips_ip6_ire_head_lock));
10267c478bd9Sstevel@tonic-gate
10277c478bd9Sstevel@tonic-gate /*
10287c478bd9Sstevel@tonic-gate * If the mask is known, the lookup
10297c478bd9Sstevel@tonic-gate * is simple, if the mask is not known
10307c478bd9Sstevel@tonic-gate * we need to search.
10317c478bd9Sstevel@tonic-gate */
10327c478bd9Sstevel@tonic-gate if (flags & MATCH_IRE_MASK) {
10337c478bd9Sstevel@tonic-gate uint_t masklen;
10347c478bd9Sstevel@tonic-gate
10357c478bd9Sstevel@tonic-gate masklen = ip_mask_to_plen_v6(mask);
1036bd670b35SErik Nordmark if (ipst->ips_ip_forwarding_table_v6[masklen] == NULL) {
10377c478bd9Sstevel@tonic-gate return (NULL);
1038bd670b35SErik Nordmark }
1039f4b3ec61Sdh irb_ptr = &(ipst->ips_ip_forwarding_table_v6[masklen][
1040f4b3ec61Sdh IRE_ADDR_MASK_HASH_V6(*addr, *mask,
104154da8755Ssowmini ipst->ips_ip6_ftable_hash_size)]);
10427c478bd9Sstevel@tonic-gate rw_enter(&irb_ptr->irb_lock, RW_READER);
10437c478bd9Sstevel@tonic-gate for (ire = irb_ptr->irb_ire; ire != NULL;
10447c478bd9Sstevel@tonic-gate ire = ire->ire_next) {
1045bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire))
10467c478bd9Sstevel@tonic-gate continue;
10477c478bd9Sstevel@tonic-gate if (ire_match_args_v6(ire, addr, mask, gateway, type,
1048bd670b35SErik Nordmark ill, zoneid, tsl, flags))
10497c478bd9Sstevel@tonic-gate goto found_ire;
10507c478bd9Sstevel@tonic-gate }
10517c478bd9Sstevel@tonic-gate rw_exit(&irb_ptr->irb_lock);
10527c478bd9Sstevel@tonic-gate } else {
1053bd670b35SErik Nordmark uint_t masklen;
1054bd670b35SErik Nordmark
10557c478bd9Sstevel@tonic-gate /*
10567c478bd9Sstevel@tonic-gate * In this case we don't know the mask, we need to
10577c478bd9Sstevel@tonic-gate * search the table assuming different mask sizes.
10587c478bd9Sstevel@tonic-gate */
1059bd670b35SErik Nordmark if (flags & MATCH_IRE_SHORTERMASK) {
1060bd670b35SErik Nordmark masklen = ip_mask_to_plen_v6(mask);
1061bd670b35SErik Nordmark if (masklen == 0) {
1062bd670b35SErik Nordmark /* Nothing shorter than zero */
1063bd670b35SErik Nordmark return (NULL);
1064bd670b35SErik Nordmark }
1065bd670b35SErik Nordmark masklen--;
1066bd670b35SErik Nordmark } else {
1067bd670b35SErik Nordmark masklen = IP6_MASK_TABLE_SIZE - 1;
1068bd670b35SErik Nordmark }
1069bd670b35SErik Nordmark
1070bd670b35SErik Nordmark for (i = masklen; i >= 0; i--) {
10717c478bd9Sstevel@tonic-gate in6_addr_t tmpmask;
10727c478bd9Sstevel@tonic-gate
1073f4b3ec61Sdh if ((ipst->ips_ip_forwarding_table_v6[i]) == NULL)
10747c478bd9Sstevel@tonic-gate continue;
10757c478bd9Sstevel@tonic-gate (void) ip_plen_to_mask_v6(i, &tmpmask);
1076f4b3ec61Sdh irb_ptr = &ipst->ips_ip_forwarding_table_v6[i][
10777c478bd9Sstevel@tonic-gate IRE_ADDR_MASK_HASH_V6(*addr, tmpmask,
1078f4b3ec61Sdh ipst->ips_ip6_ftable_hash_size)];
10797c478bd9Sstevel@tonic-gate rw_enter(&irb_ptr->irb_lock, RW_READER);
10807c478bd9Sstevel@tonic-gate for (ire = irb_ptr->irb_ire; ire != NULL;
10817c478bd9Sstevel@tonic-gate ire = ire->ire_next) {
1082bd670b35SErik Nordmark if (IRE_IS_CONDEMNED(ire))
10837c478bd9Sstevel@tonic-gate continue;
10847c478bd9Sstevel@tonic-gate if (ire_match_args_v6(ire, addr,
1085bd670b35SErik Nordmark &ire->ire_mask_v6, gateway, type, ill,
1086bd670b35SErik Nordmark zoneid, tsl, flags))
10877c478bd9Sstevel@tonic-gate goto found_ire;
10887c478bd9Sstevel@tonic-gate }
10897c478bd9Sstevel@tonic-gate rw_exit(&irb_ptr->irb_lock);
10907c478bd9Sstevel@tonic-gate }
10917c478bd9Sstevel@tonic-gate }
1092bd670b35SErik Nordmark ASSERT(ire == NULL);
1093bd670b35SErik Nordmark ip1dbg(("ire_ftable_lookup_v6: returning NULL ire"));
1094bd670b35SErik Nordmark return (NULL);
1095bd670b35SErik Nordmark
1096bd670b35SErik Nordmark found_ire:
1097bd670b35SErik Nordmark ire_refhold(ire);
1098bd670b35SErik Nordmark rw_exit(&irb_ptr->irb_lock);
1099bd670b35SErik Nordmark return (ire);
1100bd670b35SErik Nordmark }
1101bd670b35SErik Nordmark
1102bd670b35SErik Nordmark
1103bd670b35SErik Nordmark /*
1104bd670b35SErik Nordmark * This function is called by
1105bd670b35SErik Nordmark * ip_input/ire_route_recursive when doing a route lookup on only the
1106bd670b35SErik Nordmark * destination address.
1107bd670b35SErik Nordmark *
1108bd670b35SErik Nordmark * The optimizations of this function over ire_ftable_lookup are:
1109bd670b35SErik Nordmark * o removing unnecessary flag matching
1110bd670b35SErik Nordmark * o doing longest prefix match instead of overloading it further
1111bd670b35SErik Nordmark * with the unnecessary "best_prefix_match"
1112bd670b35SErik Nordmark *
1113bd670b35SErik Nordmark * If no route is found we return IRE_NOROUTE.
1114bd670b35SErik Nordmark */
1115bd670b35SErik Nordmark ire_t *
ire_ftable_lookup_simple_v6(const in6_addr_t * addr,uint32_t xmit_hint,ip_stack_t * ipst,uint_t * generationp)1116bd670b35SErik Nordmark ire_ftable_lookup_simple_v6(const in6_addr_t *addr, uint32_t xmit_hint,
1117bd670b35SErik Nordmark ip_stack_t *ipst, uint_t *generationp)
1118bd670b35SErik Nordmark {
1119bd670b35SErik Nordmark ire_t *ire;
1120bd670b35SErik Nordmark
1121bd670b35SErik Nordmark ire = ire_ftable_lookup_v6(addr, NULL, NULL, 0, NULL, ALL_ZONES, NULL,
1122bd670b35SErik Nordmark MATCH_IRE_DSTONLY, xmit_hint, ipst, generationp);
1123bd670b35SErik Nordmark if (ire == NULL) {
1124bd670b35SErik Nordmark ire = ire_reject(ipst, B_TRUE);
1125bd670b35SErik Nordmark if (generationp != NULL)
1126bd670b35SErik Nordmark *generationp = IRE_GENERATION_VERIFY;
1127bd670b35SErik Nordmark }
1128bd670b35SErik Nordmark /* ftable_lookup did round robin */
1129bd670b35SErik Nordmark return (ire);
1130bd670b35SErik Nordmark }
1131bd670b35SErik Nordmark
1132bd670b35SErik Nordmark ire_t *
ip_select_route_v6(const in6_addr_t * dst,const in6_addr_t src,ip_xmit_attr_t * ixa,uint_t * generationp,in6_addr_t * setsrcp,int * errorp,boolean_t * multirtp)113344b099c4SSowmini Varadhan ip_select_route_v6(const in6_addr_t *dst, const in6_addr_t src,
113444b099c4SSowmini Varadhan ip_xmit_attr_t *ixa, uint_t *generationp, in6_addr_t *setsrcp,
113544b099c4SSowmini Varadhan int *errorp, boolean_t *multirtp)
1136bd670b35SErik Nordmark {
1137bd670b35SErik Nordmark ASSERT(!(ixa->ixa_flags & IXAF_IS_IPV4));
1138bd670b35SErik Nordmark
113944b099c4SSowmini Varadhan return (ip_select_route(dst, src, ixa, generationp, setsrcp, errorp,
1140bd670b35SErik Nordmark multirtp));
1141bd670b35SErik Nordmark }
1142bd670b35SErik Nordmark
1143bd670b35SErik Nordmark /*
1144bd670b35SErik Nordmark * Recursively look for a route to the destination. Can also match on
1145bd670b35SErik Nordmark * the zoneid, ill, and label. Used for the data paths. See also
1146bd670b35SErik Nordmark * ire_route_recursive_dstonly.
1147bd670b35SErik Nordmark *
11489e3469d3SErik Nordmark * If IRR_ALLOCATE is not set then we will only inspect the existing IREs; never
1149bd670b35SErik Nordmark * create an IRE_IF_CLONE. This is used on the receive side when we are not
1150bd670b35SErik Nordmark * forwarding.
11519e3469d3SErik Nordmark * If IRR_INCOMPLETE is set then we return the IRE even if we can't correctly
11529e3469d3SErik Nordmark * resolve the gateway.
1153bd670b35SErik Nordmark *
1154bd670b35SErik Nordmark * Note that this function never returns NULL. It returns an IRE_NOROUTE
1155bd670b35SErik Nordmark * instead.
1156bd670b35SErik Nordmark *
1157bd670b35SErik Nordmark * If we find any IRE_LOCAL|BROADCAST etc past the first iteration it
1158bd670b35SErik Nordmark * is an error.
1159bd670b35SErik Nordmark * Allow at most one RTF_INDIRECT.
1160bd670b35SErik Nordmark */
1161bd670b35SErik Nordmark ire_t *
ire_route_recursive_impl_v6(ire_t * ire,const in6_addr_t * nexthop,uint_t ire_type,const ill_t * ill_arg,zoneid_t zoneid,const ts_label_t * tsl,uint_t match_args,uint_t irr_flags,uint32_t xmit_hint,ip_stack_t * ipst,in6_addr_t * setsrcp,tsol_ire_gw_secattr_t ** gwattrp,uint_t * generationp)1162bd670b35SErik Nordmark ire_route_recursive_impl_v6(ire_t *ire,
1163bd670b35SErik Nordmark const in6_addr_t *nexthop, uint_t ire_type, const ill_t *ill_arg,
1164bd670b35SErik Nordmark zoneid_t zoneid, const ts_label_t *tsl, uint_t match_args,
11659e3469d3SErik Nordmark uint_t irr_flags, uint32_t xmit_hint, ip_stack_t *ipst,
1166bd670b35SErik Nordmark in6_addr_t *setsrcp, tsol_ire_gw_secattr_t **gwattrp, uint_t *generationp)
1167bd670b35SErik Nordmark {
1168bd670b35SErik Nordmark int i, j;
1169bd670b35SErik Nordmark in6_addr_t v6nexthop = *nexthop;
1170bd670b35SErik Nordmark ire_t *ires[MAX_IRE_RECURSION];
1171bd670b35SErik Nordmark uint_t generation;
1172bd670b35SErik Nordmark uint_t generations[MAX_IRE_RECURSION];
1173bd670b35SErik Nordmark boolean_t need_refrele = B_FALSE;
1174bd670b35SErik Nordmark boolean_t invalidate = B_FALSE;
1175bd670b35SErik Nordmark ill_t *ill = NULL;
117601685f97SSowmini Varadhan uint_t maskoff = (IRE_LOCAL|IRE_LOOPBACK);
1177bd670b35SErik Nordmark
1178bd670b35SErik Nordmark if (setsrcp != NULL)
1179bd670b35SErik Nordmark ASSERT(IN6_IS_ADDR_UNSPECIFIED(setsrcp));
1180bd670b35SErik Nordmark if (gwattrp != NULL)
1181bd670b35SErik Nordmark ASSERT(*gwattrp == NULL);
1182bd670b35SErik Nordmark
11837c478bd9Sstevel@tonic-gate /*
1184bd670b35SErik Nordmark * We iterate up to three times to resolve a route, even though
1185bd670b35SErik Nordmark * we have four slots in the array. The extra slot is for an
1186bd670b35SErik Nordmark * IRE_IF_CLONE we might need to create.
11877c478bd9Sstevel@tonic-gate */
1188bd670b35SErik Nordmark i = 0;
1189bd670b35SErik Nordmark while (i < MAX_IRE_RECURSION - 1) {
1190bd670b35SErik Nordmark /* ire_ftable_lookup handles round-robin/ECMP */
1191bd670b35SErik Nordmark if (ire == NULL) {
1192bd670b35SErik Nordmark ire = ire_ftable_lookup_v6(&v6nexthop, 0, 0, ire_type,
119344b099c4SSowmini Varadhan (ill != NULL ? ill : ill_arg), zoneid, tsl,
1194bd670b35SErik Nordmark match_args, xmit_hint, ipst, &generation);
1195bd670b35SErik Nordmark } else {
1196bd670b35SErik Nordmark /* Caller passed it; extra hold since we will rele */
1197bd670b35SErik Nordmark ire_refhold(ire);
1198bd670b35SErik Nordmark if (generationp != NULL)
1199bd670b35SErik Nordmark generation = *generationp;
1200bd670b35SErik Nordmark else
1201bd670b35SErik Nordmark generation = IRE_GENERATION_VERIFY;
1202bd670b35SErik Nordmark }
12037c478bd9Sstevel@tonic-gate
120401685f97SSowmini Varadhan if (ire == NULL) {
120501685f97SSowmini Varadhan if (i > 0 && (irr_flags & IRR_INCOMPLETE)) {
120601685f97SSowmini Varadhan ire = ires[0];
120701685f97SSowmini Varadhan ire_refhold(ire);
120801685f97SSowmini Varadhan } else {
120901685f97SSowmini Varadhan ire = ire_reject(ipst, B_TRUE);
121001685f97SSowmini Varadhan }
121101685f97SSowmini Varadhan goto error;
121201685f97SSowmini Varadhan }
12137c478bd9Sstevel@tonic-gate
1214bd670b35SErik Nordmark /* Need to return the ire with RTF_REJECT|BLACKHOLE */
1215bd670b35SErik Nordmark if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))
1216bd670b35SErik Nordmark goto error;
1217bd670b35SErik Nordmark
1218bd670b35SErik Nordmark ASSERT(!(ire->ire_type & IRE_MULTICAST)); /* Not in ftable */
1219fff7ec1dSSowmini Varadhan /*
1220fff7ec1dSSowmini Varadhan * Verify that the IRE_IF_CLONE has a consistent generation
1221fff7ec1dSSowmini Varadhan * number.
1222fff7ec1dSSowmini Varadhan */
1223fff7ec1dSSowmini Varadhan if ((ire->ire_type & IRE_IF_CLONE) && !ire_clone_verify(ire)) {
1224fff7ec1dSSowmini Varadhan ire_refrele(ire);
1225fff7ec1dSSowmini Varadhan ire = NULL;
1226fff7ec1dSSowmini Varadhan continue;
1227fff7ec1dSSowmini Varadhan }
1228bd670b35SErik Nordmark
122901685f97SSowmini Varadhan /*
123001685f97SSowmini Varadhan * Don't allow anything unusual past the first iteration.
123101685f97SSowmini Varadhan * After the first lookup, we should no longer look for
123201685f97SSowmini Varadhan * (IRE_LOCAL|IRE_LOOPBACK) or RTF_INDIRECT routes.
123301685f97SSowmini Varadhan *
123401685f97SSowmini Varadhan * In addition, after we have found a direct IRE_OFFLINK,
123501685f97SSowmini Varadhan * we should only look for interface or clone routes.
123601685f97SSowmini Varadhan */
123701685f97SSowmini Varadhan match_args |= MATCH_IRE_DIRECT; /* no more RTF_INDIRECTs */
123801685f97SSowmini Varadhan if ((ire->ire_type & IRE_OFFLINK) &&
123901685f97SSowmini Varadhan !(ire->ire_flags & RTF_INDIRECT)) {
124001685f97SSowmini Varadhan ire_type = IRE_IF_ALL;
124101685f97SSowmini Varadhan } else {
124201685f97SSowmini Varadhan if (!(match_args & MATCH_IRE_TYPE))
124301685f97SSowmini Varadhan ire_type = (IRE_OFFLINK|IRE_ONLINK);
124401685f97SSowmini Varadhan ire_type &= ~maskoff; /* no more LOCAL, LOOPBACK */
12457c478bd9Sstevel@tonic-gate }
124601685f97SSowmini Varadhan match_args |= MATCH_IRE_TYPE;
1247bd670b35SErik Nordmark /* We have a usable IRE */
1248bd670b35SErik Nordmark ires[i] = ire;
1249bd670b35SErik Nordmark generations[i] = generation;
1250bd670b35SErik Nordmark i++;
1251bd670b35SErik Nordmark
1252bd670b35SErik Nordmark /* The first RTF_SETSRC address is passed back if setsrcp */
1253bd670b35SErik Nordmark if ((ire->ire_flags & RTF_SETSRC) &&
1254bd670b35SErik Nordmark setsrcp != NULL && IN6_IS_ADDR_UNSPECIFIED(setsrcp)) {
1255bd670b35SErik Nordmark ASSERT(!IN6_IS_ADDR_UNSPECIFIED(
1256bd670b35SErik Nordmark &ire->ire_setsrc_addr_v6));
1257bd670b35SErik Nordmark *setsrcp = ire->ire_setsrc_addr_v6;
1258bd670b35SErik Nordmark }
1259bd670b35SErik Nordmark
1260bd670b35SErik Nordmark /* The first ire_gw_secattr is passed back if gwattrp */
1261bd670b35SErik Nordmark if (ire->ire_gw_secattr != NULL &&
1262bd670b35SErik Nordmark gwattrp != NULL && *gwattrp == NULL)
1263bd670b35SErik Nordmark *gwattrp = ire->ire_gw_secattr;
12647c478bd9Sstevel@tonic-gate
12657c478bd9Sstevel@tonic-gate /*
1266bd670b35SErik Nordmark * Check if we have a short-cut pointer to an IRE for this
1267bd670b35SErik Nordmark * destination, and that the cached dependency isn't stale.
1268bd670b35SErik Nordmark * In that case we've rejoined an existing tree towards a
1269bd670b35SErik Nordmark * parent, thus we don't need to continue the loop to
1270bd670b35SErik Nordmark * discover the rest of the tree.
12717c478bd9Sstevel@tonic-gate */
1272bd670b35SErik Nordmark mutex_enter(&ire->ire_lock);
1273bd670b35SErik Nordmark if (ire->ire_dep_parent != NULL &&
1274bd670b35SErik Nordmark ire->ire_dep_parent->ire_generation ==
1275bd670b35SErik Nordmark ire->ire_dep_parent_generation) {
1276bd670b35SErik Nordmark mutex_exit(&ire->ire_lock);
1277bd670b35SErik Nordmark ire = NULL;
1278bd670b35SErik Nordmark goto done;
12797c478bd9Sstevel@tonic-gate }
1280bd670b35SErik Nordmark mutex_exit(&ire->ire_lock);
12817c478bd9Sstevel@tonic-gate
12827c478bd9Sstevel@tonic-gate /*
1283bd670b35SErik Nordmark * If this type should have an ire_nce_cache (even if it
1284bd670b35SErik Nordmark * doesn't yet have one) then we are done. Includes
1285bd670b35SErik Nordmark * IRE_INTERFACE with a full 128 bit mask.
12867c478bd9Sstevel@tonic-gate */
1287bd670b35SErik Nordmark if (ire->ire_nce_capable) {
12887c478bd9Sstevel@tonic-gate ire = NULL;
1289bd670b35SErik Nordmark goto done;
12907c478bd9Sstevel@tonic-gate }
1291bd670b35SErik Nordmark ASSERT(!(ire->ire_type & IRE_IF_CLONE));
12927c478bd9Sstevel@tonic-gate /*
1293bd670b35SErik Nordmark * For an IRE_INTERFACE we create an IRE_IF_CLONE for this
1294bd670b35SErik Nordmark * particular destination
12957c478bd9Sstevel@tonic-gate */
1296bd670b35SErik Nordmark if (ire->ire_type & IRE_INTERFACE) {
1297bd670b35SErik Nordmark ire_t *clone;
1298bd670b35SErik Nordmark
1299bd670b35SErik Nordmark ASSERT(ire->ire_masklen != IPV6_ABITS);
13007c478bd9Sstevel@tonic-gate
1301bd670b35SErik Nordmark /*
1302bd670b35SErik Nordmark * In the case of ip_input and ILLF_FORWARDING not
13039e3469d3SErik Nordmark * being set, and in the case of RTM_GET, there is
13049e3469d3SErik Nordmark * no point in allocating an IRE_IF_CLONE. We return
13059e3469d3SErik Nordmark * the IRE_INTERFACE. Note that !IRR_ALLOCATE can
13069e3469d3SErik Nordmark * result in a ire_dep_parent which is IRE_IF_*
13079e3469d3SErik Nordmark * without an IRE_IF_CLONE.
1308bd670b35SErik Nordmark * We recover from that when we need to send packets
1309bd670b35SErik Nordmark * by ensuring that the generations become
1310bd670b35SErik Nordmark * IRE_GENERATION_VERIFY in this case.
1311bd670b35SErik Nordmark */
13129e3469d3SErik Nordmark if (!(irr_flags & IRR_ALLOCATE)) {
1313bd670b35SErik Nordmark invalidate = B_TRUE;
1314bd670b35SErik Nordmark ire = NULL;
1315bd670b35SErik Nordmark goto done;
1316bd670b35SErik Nordmark }
13177c478bd9Sstevel@tonic-gate
1318bd670b35SErik Nordmark clone = ire_create_if_clone(ire, &v6nexthop,
1319bd670b35SErik Nordmark &generation);
1320bd670b35SErik Nordmark if (clone == NULL) {
13217c478bd9Sstevel@tonic-gate /*
1322bd670b35SErik Nordmark * Temporary failure - no memory.
1323bd670b35SErik Nordmark * Don't want caller to cache IRE_NOROUTE.
13247c478bd9Sstevel@tonic-gate */
1325bd670b35SErik Nordmark invalidate = B_TRUE;
1326bd670b35SErik Nordmark ire = ire_blackhole(ipst, B_TRUE);
1327bd670b35SErik Nordmark goto error;
13287c478bd9Sstevel@tonic-gate }
13297c478bd9Sstevel@tonic-gate /*
1330bd670b35SErik Nordmark * Make clone next to last entry and the
1331bd670b35SErik Nordmark * IRE_INTERFACE the last in the dependency
1332bd670b35SErik Nordmark * chain since the clone depends on the
1333bd670b35SErik Nordmark * IRE_INTERFACE.
13347c478bd9Sstevel@tonic-gate */
1335bd670b35SErik Nordmark ASSERT(i >= 1);
1336bd670b35SErik Nordmark ASSERT(i < MAX_IRE_RECURSION);
13377c478bd9Sstevel@tonic-gate
1338bd670b35SErik Nordmark ires[i] = ires[i-1];
1339bd670b35SErik Nordmark generations[i] = generations[i-1];
1340bd670b35SErik Nordmark ires[i-1] = clone;
1341bd670b35SErik Nordmark generations[i-1] = generation;
1342bd670b35SErik Nordmark i++;
13437c478bd9Sstevel@tonic-gate
1344bd670b35SErik Nordmark ire = NULL;
1345bd670b35SErik Nordmark goto done;
1346bd670b35SErik Nordmark }
13477c478bd9Sstevel@tonic-gate
1348bd670b35SErik Nordmark /*
1349bd670b35SErik Nordmark * We only match on the type and optionally ILL when
1350bd670b35SErik Nordmark * recursing. The type match is used by some callers
1351bd670b35SErik Nordmark * to exclude certain types (such as IRE_IF_CLONE or
1352bd670b35SErik Nordmark * IRE_LOCAL|IRE_LOOPBACK).
135344b099c4SSowmini Varadhan *
135444b099c4SSowmini Varadhan * In the MATCH_IRE_SRC_ILL case, ill_arg may be the 'srcof'
135544b099c4SSowmini Varadhan * ire->ire_ill, and we want to find the IRE_INTERFACE for
135644b099c4SSowmini Varadhan * ire_ill, so we set ill to the ire_ill
1357bd670b35SErik Nordmark */
135801685f97SSowmini Varadhan match_args &= (MATCH_IRE_TYPE | MATCH_IRE_DIRECT);
1359bd670b35SErik Nordmark v6nexthop = ire->ire_gateway_addr_v6;
1360bd670b35SErik Nordmark if (ill == NULL && ire->ire_ill != NULL) {
1361bd670b35SErik Nordmark ill = ire->ire_ill;
1362bd670b35SErik Nordmark need_refrele = B_TRUE;
1363bd670b35SErik Nordmark ill_refhold(ill);
1364bd670b35SErik Nordmark match_args |= MATCH_IRE_ILL;
13657c478bd9Sstevel@tonic-gate }
1366bd670b35SErik Nordmark ire = NULL;
13677c478bd9Sstevel@tonic-gate }
13687c478bd9Sstevel@tonic-gate ASSERT(ire == NULL);
1369bd670b35SErik Nordmark ire = ire_reject(ipst, B_TRUE);
1370bd670b35SErik Nordmark
1371bd670b35SErik Nordmark error:
1372bd670b35SErik Nordmark ASSERT(ire != NULL);
1373bd670b35SErik Nordmark if (need_refrele)
1374bd670b35SErik Nordmark ill_refrele(ill);
13757c478bd9Sstevel@tonic-gate
13767c478bd9Sstevel@tonic-gate /*
1377bd670b35SErik Nordmark * In the case of MULTIRT we want to try a different IRE the next
1378bd670b35SErik Nordmark * time. We let the next packet retry in that case.
13797c478bd9Sstevel@tonic-gate */
1380bd670b35SErik Nordmark if (i > 0 && (ires[0]->ire_flags & RTF_MULTIRT))
1381bd670b35SErik Nordmark (void) ire_no_good(ires[0]);
13827c478bd9Sstevel@tonic-gate
1383bd670b35SErik Nordmark cleanup:
1384bd670b35SErik Nordmark /* cleanup ires[i] */
1385bd670b35SErik Nordmark ire_dep_unbuild(ires, i);
1386bd670b35SErik Nordmark for (j = 0; j < i; j++)
1387bd670b35SErik Nordmark ire_refrele(ires[j]);
13887c478bd9Sstevel@tonic-gate
13899e3469d3SErik Nordmark ASSERT((ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) ||
13909e3469d3SErik Nordmark (irr_flags & IRR_INCOMPLETE));
1391bd670b35SErik Nordmark /*
1392bd670b35SErik Nordmark * Use IRE_GENERATION_VERIFY to ensure that ip_output will redo the
1393bd670b35SErik Nordmark * ip_select_route since the reject or lack of memory might be gone.
1394bd670b35SErik Nordmark */
1395bd670b35SErik Nordmark if (generationp != NULL)
1396bd670b35SErik Nordmark *generationp = IRE_GENERATION_VERIFY;
13977c478bd9Sstevel@tonic-gate return (ire);
13987c478bd9Sstevel@tonic-gate
1399bd670b35SErik Nordmark done:
1400bd670b35SErik Nordmark ASSERT(ire == NULL);
1401bd670b35SErik Nordmark if (need_refrele)
1402bd670b35SErik Nordmark ill_refrele(ill);
1403bd670b35SErik Nordmark
1404bd670b35SErik Nordmark /* Build dependencies */
1405188e1664SErik Nordmark if (i > 1 && !ire_dep_build(ires, generations, i)) {
1406bd670b35SErik Nordmark /* Something in chain was condemned; tear it apart */
1407bd670b35SErik Nordmark ire = ire_blackhole(ipst, B_TRUE);
1408bd670b35SErik Nordmark goto cleanup;
1409bd670b35SErik Nordmark }
141045916cd2Sjpk
1411bd670b35SErik Nordmark /*
1412bd670b35SErik Nordmark * Release all refholds except the one for ires[0] that we
1413bd670b35SErik Nordmark * will return to the caller.
1414bd670b35SErik Nordmark */
1415bd670b35SErik Nordmark for (j = 1; j < i; j++)
1416bd670b35SErik Nordmark ire_refrele(ires[j]);
141745916cd2Sjpk
1418bd670b35SErik Nordmark if (invalidate) {
1419bd670b35SErik Nordmark /*
1420bd670b35SErik Nordmark * Since we needed to allocate but couldn't we need to make
1421bd670b35SErik Nordmark * sure that the dependency chain is rebuilt the next time.
1422bd670b35SErik Nordmark */
1423bd670b35SErik Nordmark ire_dep_invalidate_generations(ires[0]);
1424bd670b35SErik Nordmark generation = IRE_GENERATION_VERIFY;
1425bd670b35SErik Nordmark } else {
1426bd670b35SErik Nordmark /*
1427bd670b35SErik Nordmark * IREs can have been added or deleted while we did the
1428bd670b35SErik Nordmark * recursive lookup and we can't catch those until we've built
1429bd670b35SErik Nordmark * the dependencies. We verify the stored
1430bd670b35SErik Nordmark * ire_dep_parent_generation to catch any such changes and
1431bd670b35SErik Nordmark * return IRE_GENERATION_VERIFY (which will cause
1432bd670b35SErik Nordmark * ip_select_route to be called again so we can redo the
1433bd670b35SErik Nordmark * recursive lookup next time we send a packet.
1434bd670b35SErik Nordmark */
1435188e1664SErik Nordmark if (ires[0]->ire_dep_parent == NULL)
1436188e1664SErik Nordmark generation = ires[0]->ire_generation;
1437188e1664SErik Nordmark else
1438188e1664SErik Nordmark generation = ire_dep_validate_generations(ires[0]);
1439bd670b35SErik Nordmark if (generations[0] != ires[0]->ire_generation) {
1440bd670b35SErik Nordmark /* Something changed at the top */
1441bd670b35SErik Nordmark generation = IRE_GENERATION_VERIFY;
144245916cd2Sjpk }
144345916cd2Sjpk }
1444bd670b35SErik Nordmark if (generationp != NULL)
1445bd670b35SErik Nordmark *generationp = generation;
144645916cd2Sjpk
1447bd670b35SErik Nordmark return (ires[0]);
144845916cd2Sjpk }
144945916cd2Sjpk
14507c478bd9Sstevel@tonic-gate ire_t *
ire_route_recursive_v6(const in6_addr_t * nexthop,uint_t ire_type,const ill_t * ill,zoneid_t zoneid,const ts_label_t * tsl,uint_t match_args,uint_t irr_flags,uint32_t xmit_hint,ip_stack_t * ipst,in6_addr_t * setsrcp,tsol_ire_gw_secattr_t ** gwattrp,uint_t * generationp)1451bd670b35SErik Nordmark ire_route_recursive_v6(const in6_addr_t *nexthop, uint_t ire_type,
1452bd670b35SErik Nordmark const ill_t *ill, zoneid_t zoneid, const ts_label_t *tsl, uint_t match_args,
14539e3469d3SErik Nordmark uint_t irr_flags, uint32_t xmit_hint, ip_stack_t *ipst,
1454bd670b35SErik Nordmark in6_addr_t *setsrcp, tsol_ire_gw_secattr_t **gwattrp, uint_t *generationp)
14557c478bd9Sstevel@tonic-gate {
1456bd670b35SErik Nordmark return (ire_route_recursive_impl_v6(NULL, nexthop, ire_type, ill,
14579e3469d3SErik Nordmark zoneid, tsl, match_args, irr_flags, xmit_hint, ipst, setsrcp,
1458bd670b35SErik Nordmark gwattrp, generationp));
14597c478bd9Sstevel@tonic-gate }
14607c478bd9Sstevel@tonic-gate
14617c478bd9Sstevel@tonic-gate /*
1462bd670b35SErik Nordmark * Recursively look for a route to the destination.
1463bd670b35SErik Nordmark * We only handle a destination match here, yet we have the same arguments
1464bd670b35SErik Nordmark * as the full match to allow function pointers to select between the two.
14655597b60aSnordmark *
1466bd670b35SErik Nordmark * Note that this function never returns NULL. It returns an IRE_NOROUTE
1467bd670b35SErik Nordmark * instead.
14685597b60aSnordmark *
1469bd670b35SErik Nordmark * If we find any IRE_LOCAL|BROADCAST etc past the first iteration it
1470bd670b35SErik Nordmark * is an error.
1471bd670b35SErik Nordmark * Allow at most one RTF_INDIRECT.
14727c478bd9Sstevel@tonic-gate */
14737c478bd9Sstevel@tonic-gate ire_t *
ire_route_recursive_dstonly_v6(const in6_addr_t * nexthop,uint_t irr_flags,uint32_t xmit_hint,ip_stack_t * ipst)14749e3469d3SErik Nordmark ire_route_recursive_dstonly_v6(const in6_addr_t *nexthop, uint_t irr_flags,
1475bd670b35SErik Nordmark uint32_t xmit_hint, ip_stack_t *ipst)
14767c478bd9Sstevel@tonic-gate {
14777c478bd9Sstevel@tonic-gate ire_t *ire;
1478bd670b35SErik Nordmark ire_t *ire1;
1479bd670b35SErik Nordmark uint_t generation;
14807c478bd9Sstevel@tonic-gate
1481bd670b35SErik Nordmark /* ire_ftable_lookup handles round-robin/ECMP */
1482bd670b35SErik Nordmark ire = ire_ftable_lookup_simple_v6(nexthop, xmit_hint, ipst,
1483bd670b35SErik Nordmark &generation);
1484bd670b35SErik Nordmark ASSERT(ire != NULL);
14857c478bd9Sstevel@tonic-gate
14867c478bd9Sstevel@tonic-gate /*
1487bd670b35SErik Nordmark * If the IRE has a current cached parent we know that the whole
1488bd670b35SErik Nordmark * parent chain is current, hence we don't need to discover and
1489bd670b35SErik Nordmark * build any dependencies by doing a recursive lookup.
14907c478bd9Sstevel@tonic-gate */
14917c478bd9Sstevel@tonic-gate mutex_enter(&ire->ire_lock);
1492fff7ec1dSSowmini Varadhan if (ire->ire_dep_parent != NULL) {
1493fff7ec1dSSowmini Varadhan if (ire->ire_dep_parent->ire_generation ==
1494fff7ec1dSSowmini Varadhan ire->ire_dep_parent_generation) {
1495fff7ec1dSSowmini Varadhan mutex_exit(&ire->ire_lock);
1496fff7ec1dSSowmini Varadhan return (ire);
1497fff7ec1dSSowmini Varadhan }
1498fff7ec1dSSowmini Varadhan mutex_exit(&ire->ire_lock);
1499fff7ec1dSSowmini Varadhan } else {
1500bd670b35SErik Nordmark mutex_exit(&ire->ire_lock);
1501fff7ec1dSSowmini Varadhan /*
1502fff7ec1dSSowmini Varadhan * If this type should have an ire_nce_cache (even if it
1503fff7ec1dSSowmini Varadhan * doesn't yet have one) then we are done. Includes
1504fff7ec1dSSowmini Varadhan * IRE_INTERFACE with a full 128 bit mask.
1505fff7ec1dSSowmini Varadhan */
1506fff7ec1dSSowmini Varadhan if (ire->ire_nce_capable)
1507fff7ec1dSSowmini Varadhan return (ire);
15087c478bd9Sstevel@tonic-gate }
15097c478bd9Sstevel@tonic-gate
15107c478bd9Sstevel@tonic-gate /*
1511bd670b35SErik Nordmark * Fallback to loop in the normal code starting with the ire
1512bd670b35SErik Nordmark * we found. Normally this would return the same ire.
15137c478bd9Sstevel@tonic-gate */
1514bd670b35SErik Nordmark ire1 = ire_route_recursive_impl_v6(ire, nexthop, 0, NULL, ALL_ZONES,
15159e3469d3SErik Nordmark NULL, MATCH_IRE_DSTONLY, irr_flags, xmit_hint, ipst, NULL, NULL,
1516bd670b35SErik Nordmark &generation);
15177c478bd9Sstevel@tonic-gate ire_refrele(ire);
1518bd670b35SErik Nordmark return (ire1);
15195b17e9bdSJon Anderson }
1520