diff options
Diffstat (limited to 'usr/src/uts/common/inet/ip/ip_ftable.c')
| -rw-r--r-- | usr/src/uts/common/inet/ip/ip_ftable.c | 2682 |
1 files changed, 958 insertions, 1724 deletions
diff --git a/usr/src/uts/common/inet/ip/ip_ftable.c b/usr/src/uts/common/inet/ip/ip_ftable.c index 9e228c2925..771dd9f62f 100644 --- a/usr/src/uts/common/inet/ip/ip_ftable.c +++ b/usr/src/uts/common/inet/ip/ip_ftable.c @@ -42,7 +42,6 @@ #include <sys/param.h> #include <sys/socket.h> #include <sys/strsubr.h> -#include <sys/pattr.h> #include <net/if.h> #include <net/route.h> #include <netinet/in.h> @@ -50,6 +49,7 @@ #include <netinet/ip6.h> #include <netinet/icmp6.h> +#include <inet/ipsec_impl.h> #include <inet/common.h> #include <inet/mi.h> #include <inet/mib2.h> @@ -65,7 +65,6 @@ #include <inet/nd.h> #include <net/pfkeyv2.h> -#include <inet/ipsec_info.h> #include <inet/sadb.h> #include <inet/tcp.h> #include <inet/ipclassifier.h> @@ -78,87 +77,34 @@ (((ire)->ire_type & IRE_DEFAULT) || \ (((ire)->ire_type & IRE_INTERFACE) && ((ire)->ire_addr == 0))) -/* - * structure for passing args between ire_ftable_lookup and ire_find_best_route - */ -typedef struct ire_ftable_args_s { - ipaddr_t ift_addr; - ipaddr_t ift_mask; - ipaddr_t ift_gateway; - int ift_type; - const ipif_t *ift_ipif; - zoneid_t ift_zoneid; - uint32_t ift_ihandle; - const ts_label_t *ift_tsl; - int ift_flags; - ire_t *ift_best_ire; -} ire_ftable_args_t; - static ire_t *route_to_dst(const struct sockaddr *, zoneid_t, ip_stack_t *); -static ire_t *ire_round_robin(irb_t *, zoneid_t, ire_ftable_args_t *, - ip_stack_t *); -static void ire_del_host_redir(ire_t *, char *); -static boolean_t ire_find_best_route(struct radix_node *, void *); -static int ip_send_align_hcksum_flags(mblk_t *, ill_t *); -static ire_t *ire_ftable_lookup_simple(ipaddr_t, - ire_t **, zoneid_t, int, ip_stack_t *); +static void ire_del_host_redir(ire_t *, char *); +static boolean_t ire_find_best_route(struct radix_node *, void *); /* * Lookup a route in forwarding table. A specific lookup is indicated by * passing the required parameters and indicating the match required in the * flag field. * - * Looking for default route can be done in three ways - * 1) pass mask as 0 and set MATCH_IRE_MASK in flags field - * along with other matches. - * 2) pass type as IRE_DEFAULT and set MATCH_IRE_TYPE in flags - * field along with other matches. - * 3) if the destination and mask are passed as zeros. - * - * A request to return a default route if no route - * is found, can be specified by setting MATCH_IRE_DEFAULT - * in flags. - * - * It does not support recursion more than one level. It - * will do recursive lookup only when the lookup maps to - * a prefix or default route and MATCH_IRE_RECURSIVE flag is passed. - * - * If the routing table is setup to allow more than one level - * of recursion, the cleaning up cache table will not work resulting - * in invalid routing. - * * Supports IP_BOUND_IF by following the ipif/ill when recursing. - * - * NOTE : When this function returns NULL, pire has already been released. - * pire is valid only when this function successfully returns an - * ire. */ ire_t * -ire_ftable_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, - int type, const ipif_t *ipif, ire_t **pire, zoneid_t zoneid, - uint32_t ihandle, const ts_label_t *tsl, int flags, ip_stack_t *ipst) +ire_ftable_lookup_v4(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, + int type, const ill_t *ill, zoneid_t zoneid, const ts_label_t *tsl, + int flags, uint32_t xmit_hint, ip_stack_t *ipst, uint_t *generationp) { - ire_t *ire = NULL; - ipaddr_t gw_addr; + ire_t *ire; struct rt_sockaddr rdst, rmask; struct rt_entry *rt; ire_ftable_args_t margs; - boolean_t found_incomplete = B_FALSE; - ASSERT(ipif == NULL || !ipif->ipif_isv6); + ASSERT(ill == NULL || !ill->ill_isv6); /* - * When we return NULL from this function, we should make - * sure that *pire is NULL so that the callers will not - * wrongly REFRELE the pire. - */ - if (pire != NULL) - *pire = NULL; - /* - * ire_match_args() will dereference ipif MATCH_IRE_SRC or - * MATCH_IRE_ILL is set. + * ire_match_args() will dereference ill if MATCH_IRE_ILL + * is set. */ - if ((flags & (MATCH_IRE_SRC | MATCH_IRE_ILL)) && (ipif == NULL)) + if ((flags & MATCH_IRE_ILL) && (ill == NULL)) return (NULL); (void) memset(&rdst, 0, sizeof (rdst)); @@ -176,9 +122,8 @@ ire_ftable_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, margs.ift_mask = mask; margs.ift_gateway = gateway; margs.ift_type = type; - margs.ift_ipif = ipif; + margs.ift_ill = ill; margs.ift_zoneid = zoneid; - margs.ift_ihandle = ihandle; margs.ift_tsl = tsl; margs.ift_flags = flags; @@ -191,232 +136,93 @@ ire_ftable_lookup(ipaddr_t addr, ipaddr_t mask, ipaddr_t gateway, * each matching leaf in the radix tree. ire_match_args is * invoked by the callback function ire_find_best_route() * We hold the global tree lock in read mode when calling - * rn_match_args.Before dropping the global tree lock, ensure + * rn_match_args. Before dropping the global tree lock, ensure * that the radix node can't be deleted by incrementing ire_refcnt. */ RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst, ipst->ips_ip_ftable, ire_find_best_route, &margs); ire = margs.ift_best_ire; - RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); - if (rt == NULL) { + RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); return (NULL); - } else { - ASSERT(ire != NULL); } + ASSERT(ire != NULL); DTRACE_PROBE2(ire__found, ire_ftable_args_t *, &margs, ire_t *, ire); - if (!IS_DEFAULT_ROUTE(ire)) - goto found_ire_held; - /* - * If default route is found, see if default matching criteria - * are satisfied. - */ - if (flags & MATCH_IRE_MASK) { - /* - * we were asked to match a 0 mask, and came back with - * a default route. Ok to return it. - */ - goto found_default_ire; - } - if ((flags & MATCH_IRE_TYPE) && - (type & (IRE_DEFAULT | IRE_INTERFACE))) { - /* - * we were asked to match a default ire type. Ok to return it. - */ - goto found_default_ire; - } - if (flags & MATCH_IRE_DEFAULT) { - goto found_default_ire; - } - /* - * we found a default route, but default matching criteria - * are not specified and we are not explicitly looking for - * default. - */ - IRE_REFRELE(ire); - return (NULL); -found_default_ire: /* * round-robin only if we have more than one route in the bucket. + * ips_ip_ecmp_behavior controls when we do ECMP + * 2: always + * 1: for IRE_DEFAULT and /0 IRE_INTERFACE + * 0: never */ - if ((ire->ire_bucket->irb_ire_cnt > 1) && - IS_DEFAULT_ROUTE(ire) && - ((flags & (MATCH_IRE_DEFAULT | MATCH_IRE_MASK)) == - MATCH_IRE_DEFAULT)) { - ire_t *next_ire; - - next_ire = ire_round_robin(ire->ire_bucket, zoneid, &margs, - ipst); - IRE_REFRELE(ire); - if (next_ire != NULL) { + if (ire->ire_bucket->irb_ire_cnt > 1 && !(flags & MATCH_IRE_GW)) { + if (ipst->ips_ip_ecmp_behavior == 2 || + (ipst->ips_ip_ecmp_behavior == 1 && + IS_DEFAULT_ROUTE(ire))) { + ire_t *next_ire; + + margs.ift_best_ire = NULL; + next_ire = ire_round_robin(ire->ire_bucket, &margs, + xmit_hint, ire, ipst); + if (next_ire == NULL) { + /* keep ire if next_ire is null */ + goto done; + } + ire_refrele(ire); ire = next_ire; - } else { - /* no route */ - return (NULL); } } -found_ire_held: - if ((flags & MATCH_IRE_RJ_BHOLE) && - (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) { - return (ire); - } - /* - * At this point, IRE that was found must be an IRE_FORWARDTABLE - * type. If this is a recursive lookup and an IRE_INTERFACE type was - * found, return that. If it was some other IRE_FORWARDTABLE type of - * IRE (one of the prefix types), then it is necessary to fill in the - * parent IRE pointed to by pire, and then lookup the gateway address of - * the parent. For backwards compatiblity, if this lookup returns an - * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level - * of lookup is done. - */ - if (flags & MATCH_IRE_RECURSIVE) { - ipif_t *gw_ipif; - int match_flags = MATCH_IRE_DSTONLY; - ire_t *save_ire; - if (ire->ire_type & IRE_INTERFACE) - return (ire); - if (pire != NULL) - *pire = ire; - /* - * If we can't find an IRE_INTERFACE or the caller has not - * asked for pire, we need to REFRELE the save_ire. - */ - save_ire = ire; +done: + /* Return generation before dropping lock */ + if (generationp != NULL) + *generationp = ire->ire_generation; - if (ire->ire_ipif != NULL) - match_flags |= MATCH_IRE_ILL; + RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); - /* - * ire_ftable_lookup may end up with an incomplete IRE_CACHE - * entry for the gateway (i.e., one for which the - * ire_nce->nce_state is not yet ND_REACHABLE). If the caller - * has specified MATCH_IRE_COMPLETE, such entries will not - * be returned; instead, we return the IF_RESOLVER ire. - */ - ire = ire_route_lookup(ire->ire_gateway_addr, 0, 0, 0, - ire->ire_ipif, NULL, zoneid, tsl, match_flags, ipst); - DTRACE_PROBE2(ftable__route__lookup1, (ire_t *), ire, - (ire_t *), save_ire); - if (ire == NULL || - ((ire->ire_type & IRE_CACHE) && ire->ire_nce && - ire->ire_nce->nce_state != ND_REACHABLE && - (flags & MATCH_IRE_COMPLETE))) { - /* - * Do not release the parent ire if MATCH_IRE_PARENT - * is set. Also return it via ire. - */ - if (ire != NULL) { - ire_refrele(ire); - ire = NULL; - found_incomplete = B_TRUE; - } - if (flags & MATCH_IRE_PARENT) { - if (pire != NULL) { - /* - * Need an extra REFHOLD, if the parent - * ire is returned via both ire and - * pire. - */ - IRE_REFHOLD(save_ire); - } - ire = save_ire; - } else { - ire_refrele(save_ire); - if (pire != NULL) - *pire = NULL; - } - if (!found_incomplete) - return (ire); - } - if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) { - /* - * If the caller did not ask for pire, release - * it now. - */ - if (pire == NULL) { - ire_refrele(save_ire); - } - return (ire); - } - match_flags |= MATCH_IRE_TYPE; - gw_addr = ire->ire_gateway_addr; - gw_ipif = ire->ire_ipif; - ire_refrele(ire); - ire = ire_route_lookup(gw_addr, 0, 0, - (found_incomplete? IRE_INTERFACE : - (IRE_CACHETABLE | IRE_INTERFACE)), - gw_ipif, NULL, zoneid, tsl, match_flags, ipst); - DTRACE_PROBE2(ftable__route__lookup2, (ire_t *), ire, - (ire_t *), save_ire); - if (ire == NULL || - ((ire->ire_type & IRE_CACHE) && ire->ire_nce && - ire->ire_nce->nce_state != ND_REACHABLE && - (flags & MATCH_IRE_COMPLETE))) { - /* - * Do not release the parent ire if MATCH_IRE_PARENT - * is set. Also return it via ire. - */ - if (ire != NULL) { - ire_refrele(ire); - ire = NULL; - } - if (flags & MATCH_IRE_PARENT) { - if (pire != NULL) { - /* - * Need an extra REFHOLD, if the - * parent ire is returned via both - * ire and pire. - */ - IRE_REFHOLD(save_ire); - } - ire = save_ire; - } else { - ire_refrele(save_ire); - if (pire != NULL) - *pire = NULL; - } - return (ire); - } else if (pire == NULL) { - /* - * If the caller did not ask for pire, release - * it now. - */ - ire_refrele(save_ire); - } - return (ire); + /* + * For shared-IP zones we need additional checks to what was + * done in ire_match_args to make sure IRE_LOCALs are handled. + * + * When ip_restrict_interzone_loopback is set, then + * we ensure that IRE_LOCAL are only used for loopback + * between zones when the logical "Ethernet" would + * have looped them back. That is, if in the absense of + * the IRE_LOCAL we would have sent to packet out the + * same ill. + */ + if ((ire->ire_type & IRE_LOCAL) && zoneid != ALL_ZONES && + ire->ire_zoneid != zoneid && ire->ire_zoneid != ALL_ZONES && + ipst->ips_ip_restrict_interzone_loopback) { + ire = ire_alt_local(ire, zoneid, tsl, ill, generationp); + ASSERT(ire != NULL); } - ASSERT(pire == NULL || *pire == NULL); return (ire); } /* * This function is called by - * ip_fast_forward->ire_forward_simple + * ip_input/ire_route_recursive when doing a route lookup on only the + * destination address. + * * The optimizations of this function over ire_ftable_lookup are: * o removing unnecessary flag matching * o doing longest prefix match instead of overloading it further * with the unnecessary "best_prefix_match" - * o Does not do round robin of default route for every packet - * o inlines code of ire_ctable_lookup to look for nexthop cache - * entry before calling ire_route_lookup + * + * If no route is found we return IRE_NOROUTE. */ -static ire_t * -ire_ftable_lookup_simple(ipaddr_t addr, - ire_t **pire, zoneid_t zoneid, int flags, - ip_stack_t *ipst) +ire_t * +ire_ftable_lookup_simple_v4(ipaddr_t addr, uint32_t xmit_hint, ip_stack_t *ipst, + uint_t *generationp) { - ire_t *ire = NULL; - ire_t *tmp_ire = NULL; + ire_t *ire; struct rt_sockaddr rdst; struct rt_entry *rt; - irb_t *irb_ptr; - ire_t *save_ire; - int match_flags; + irb_t *irb; rdst.rt_sin_len = sizeof (rdst); rdst.rt_sin_family = AF_INET; @@ -430,263 +236,125 @@ ire_ftable_lookup_simple(ipaddr_t addr, rt = (struct rt_entry *)ipst->ips_ip_ftable->rnh_matchaddr_args(&rdst, ipst->ips_ip_ftable, NULL, NULL); - if (rt == NULL) { - RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); - return (NULL); - } - irb_ptr = &rt->rt_irb; - if (irb_ptr == NULL || irb_ptr->irb_ire_cnt == 0) { - RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); - return (NULL); - } + if (rt == NULL) + goto bad; - rw_enter(&irb_ptr->irb_lock, RW_READER); - for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { - if (ire->ire_zoneid == zoneid) - break; - } + irb = &rt->rt_irb; + if (irb->irb_ire_cnt == 0) + goto bad; - if (ire == NULL || (ire->ire_marks & IRE_MARK_CONDEMNED)) { - rw_exit(&irb_ptr->irb_lock); - RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); - return (NULL); + rw_enter(&irb->irb_lock, RW_READER); + ire = irb->irb_ire; + if (ire == NULL) { + rw_exit(&irb->irb_lock); + goto bad; } - /* we have a ire that matches */ - if (ire != NULL) - IRE_REFHOLD(ire); - rw_exit(&irb_ptr->irb_lock); - RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); - - if ((flags & MATCH_IRE_RJ_BHOLE) && - (ire->ire_flags & (RTF_BLACKHOLE | RTF_REJECT))) { - return (ire); + while (IRE_IS_CONDEMNED(ire)) { + ire = ire->ire_next; + if (ire == NULL) { + rw_exit(&irb->irb_lock); + goto bad; + } } - /* - * At this point, IRE that was found must be an IRE_FORWARDTABLE - * type. If this is a recursive lookup and an IRE_INTERFACE type was - * found, return that. If it was some other IRE_FORWARDTABLE type of - * IRE (one of the prefix types), then it is necessary to fill in the - * parent IRE pointed to by pire, and then lookup the gateway address of - * the parent. For backwards compatiblity, if this lookup returns an - * IRE other than a IRE_CACHETABLE or IRE_INTERFACE, then one more level - * of lookup is done. - */ - match_flags = MATCH_IRE_DSTONLY; - if (ire->ire_type & IRE_INTERFACE) - return (ire); - *pire = ire; - /* - * If we can't find an IRE_INTERFACE or the caller has not - * asked for pire, we need to REFRELE the save_ire. - */ - save_ire = ire; + /* we have a ire that matches */ + ire_refhold(ire); + rw_exit(&irb->irb_lock); /* - * Currently MATCH_IRE_ILL is never used with - * (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT) while - * sending out packets as MATCH_IRE_ILL is used only - * for communicating with on-link hosts. We can't assert - * that here as RTM_GET calls this function with - * MATCH_IRE_ILL | MATCH_IRE_DEFAULT | MATCH_IRE_RECURSIVE. - * We have already used the MATCH_IRE_ILL in determining - * the right prefix route at this point. To match the - * behavior of how we locate routes while sending out - * packets, we don't want to use MATCH_IRE_ILL below - * while locating the interface route. + * round-robin only if we have more than one route in the bucket. + * ips_ip_ecmp_behavior controls when we do ECMP + * 2: always + * 1: for IRE_DEFAULT and /0 IRE_INTERFACE + * 0: never * - * ire_ftable_lookup may end up with an incomplete IRE_CACHE - * entry for the gateway (i.e., one for which the - * ire_nce->nce_state is not yet ND_REACHABLE). If the caller - * has specified MATCH_IRE_COMPLETE, such entries will not - * be returned; instead, we return the IF_RESOLVER ire. + * Note: if we found an IRE_IF_CLONE we won't look at the bucket with + * other ECMP IRE_INTERFACEs since the IRE_IF_CLONE is a /128 match + * and the IRE_INTERFACESs are likely to be shorter matches. */ - - if (ire->ire_ipif == NULL) { - tmp_ire = ire; - /* - * Look to see if the nexthop entry is in the cachetable - */ - ire = ire_cache_lookup(ire->ire_gateway_addr, zoneid, NULL, - ipst); - if (ire == NULL) { - /* Try ire_route_lookup */ - ire = tmp_ire; - } else { - goto solved; - } - } - if (ire->ire_ipif != NULL) - match_flags |= MATCH_IRE_ILL; - - ire = ire_route_lookup(ire->ire_gateway_addr, 0, - 0, 0, ire->ire_ipif, NULL, zoneid, NULL, match_flags, ipst); -solved: - DTRACE_PROBE2(ftable__route__lookup1, (ire_t *), ire, - (ire_t *), save_ire); - if (ire == NULL) { - /* - * Do not release the parent ire if MATCH_IRE_PARENT - * is set. Also return it via ire. - */ - ire_refrele(save_ire); - *pire = NULL; - return (ire); - } - if (ire->ire_type & (IRE_CACHETABLE | IRE_INTERFACE)) { - /* - * If the caller did not ask for pire, release - * it now. - */ - if (pire == NULL) { - ire_refrele(save_ire); + if (ire->ire_bucket->irb_ire_cnt > 1) { + if (ipst->ips_ip_ecmp_behavior == 2 || + (ipst->ips_ip_ecmp_behavior == 1 && + IS_DEFAULT_ROUTE(ire))) { + ire_t *next_ire; + ire_ftable_args_t margs; + + (void) memset(&margs, 0, sizeof (margs)); + margs.ift_addr = addr; + margs.ift_zoneid = ALL_ZONES; + + next_ire = ire_round_robin(ire->ire_bucket, &margs, + xmit_hint, ire, ipst); + if (next_ire == NULL) { + /* keep ire if next_ire is null */ + if (generationp != NULL) + *generationp = ire->ire_generation; + RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); + return (ire); + } + ire_refrele(ire); + ire = next_ire; } } - return (ire); -} - -/* - * Find an IRE_OFFSUBNET IRE entry for the multicast address 'group' - * that goes through 'ipif'. As a fallback, a route that goes through - * ipif->ipif_ill can be returned. - */ -ire_t * -ipif_lookup_multi_ire(ipif_t *ipif, ipaddr_t group) -{ - ire_t *ire; - ire_t *save_ire = NULL; - ire_t *gw_ire; - irb_t *irb; - ipaddr_t gw_addr; - int match_flags = MATCH_IRE_TYPE | MATCH_IRE_ILL; - ip_stack_t *ipst = ipif->ipif_ill->ill_ipst; - - ASSERT(CLASSD(group)); - - ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, ALL_ZONES, 0, - NULL, MATCH_IRE_DEFAULT, ipst); - - if (ire == NULL) - return (NULL); + /* Return generation before dropping lock */ + if (generationp != NULL) + *generationp = ire->ire_generation; - irb = ire->ire_bucket; - ASSERT(irb); + RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); - IRB_REFHOLD(irb); - ire_refrele(ire); - for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { - if (ire->ire_addr != group || - ipif->ipif_zoneid != ire->ire_zoneid && - ire->ire_zoneid != ALL_ZONES) { - continue; - } + /* + * Since we only did ALL_ZONES matches there is no special handling + * of IRE_LOCALs needed here. ire_ftable_lookup_v4 has to handle that. + */ + return (ire); - switch (ire->ire_type) { - case IRE_DEFAULT: - case IRE_PREFIX: - case IRE_HOST: - gw_addr = ire->ire_gateway_addr; - gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, - ipif, NULL, ALL_ZONES, 0, NULL, match_flags, ipst); - - if (gw_ire != NULL) { - if (save_ire != NULL) { - ire_refrele(save_ire); - } - IRE_REFHOLD(ire); - if (gw_ire->ire_ipif == ipif) { - ire_refrele(gw_ire); - - IRB_REFRELE(irb); - return (ire); - } - ire_refrele(gw_ire); - save_ire = ire; - } - break; - case IRE_IF_NORESOLVER: - case IRE_IF_RESOLVER: - if (ire->ire_ipif == ipif) { - if (save_ire != NULL) { - ire_refrele(save_ire); - } - IRE_REFHOLD(ire); - - IRB_REFRELE(irb); - return (ire); - } - break; - } - } - IRB_REFRELE(irb); +bad: + if (generationp != NULL) + *generationp = IRE_GENERATION_VERIFY; - return (save_ire); + RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); + return (ire_reject(ipst, B_FALSE)); } /* - * Find an IRE_INTERFACE for the multicast group. + * Find the ill matching a multicast group. * Allows different routes for multicast addresses * in the unicast routing table (akin to 224.0.0.0 but could be more specific) * which point at different interfaces. This is used when IP_MULTICAST_IF * isn't specified (when sending) and when IP_ADD_MEMBERSHIP doesn't * specify the interface to join on. * - * Supports IP_BOUND_IF by following the ipif/ill when recursing. + * Supports link-local addresses by using ire_route_recursive which follows + * the ill when recursing. + * + * To handle CGTP, since we don't have a separate IRE_MULTICAST for each group + * and the MULTIRT property can be different for different groups, we + * extract RTF_MULTIRT from the special unicast route added for a group + * with CGTP and pass that back in the multirtp argument. + * This is used in ip_set_destination etc to set ixa_postfragfn for multicast. + * We have a setsrcp argument for the same reason. */ -ire_t * -ire_lookup_multi(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst) +ill_t * +ire_lookup_multi_ill_v4(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst, + boolean_t *multirtp, ipaddr_t *setsrcp) { ire_t *ire; - ipif_t *ipif = NULL; - int match_flags = MATCH_IRE_TYPE; - ipaddr_t gw_addr; - - ire = ire_ftable_lookup(group, 0, 0, 0, NULL, NULL, zoneid, - 0, NULL, MATCH_IRE_DEFAULT, ipst); + ill_t *ill; - /* We search a resolvable ire in case of multirouting. */ - if ((ire != NULL) && (ire->ire_flags & RTF_MULTIRT)) { - ire_t *cire = NULL; - /* - * If the route is not resolvable, the looked up ire - * may be changed here. In that case, ire_multirt_lookup() - * IRE_REFRELE the original ire and change it. - */ - (void) ire_multirt_lookup(&cire, &ire, MULTIRT_CACHEGW, NULL, - NULL, ipst); - if (cire != NULL) - ire_refrele(cire); - } - if (ire == NULL) - return (NULL); - /* - * Make sure we follow ire_ipif. - * - * We need to determine the interface route through - * which the gateway will be reached. - */ - if (ire->ire_ipif != NULL) { - ipif = ire->ire_ipif; - match_flags |= MATCH_IRE_ILL; - } - - switch (ire->ire_type) { - case IRE_DEFAULT: - case IRE_PREFIX: - case IRE_HOST: - gw_addr = ire->ire_gateway_addr; - ire_refrele(ire); - ire = ire_ftable_lookup(gw_addr, 0, 0, - IRE_INTERFACE, ipif, NULL, zoneid, 0, - NULL, match_flags, ipst); - return (ire); - case IRE_IF_NORESOLVER: - case IRE_IF_RESOLVER: - return (ire); - default: + ire = ire_route_recursive_v4(group, 0, NULL, zoneid, NULL, + MATCH_IRE_DSTONLY, B_FALSE, 0, ipst, setsrcp, NULL, NULL); + ASSERT(ire != NULL); + if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { ire_refrele(ire); return (NULL); } + + if (multirtp != NULL) + *multirtp = (ire->ire_flags & RTF_MULTIRT) != 0; + + ill = ire_nexthop_ill(ire); + ire_refrele(ire); + return (ill); } /* @@ -701,7 +369,7 @@ ire_del_host_redir(ire_t *ire, char *gateway) } /* - * Search for all HOST REDIRECT routes that are + * Search for all IRE_HOST RTF_DYNAMIC (aka redirect) routes that are * pointing at the specified gateway and * delete them. This routine is called only * when a default gateway is going away. @@ -718,732 +386,6 @@ ire_delete_host_redirects(ipaddr_t gateway, ip_stack_t *ipst) rtfunc, &rtfarg, irb_refhold_rn, irb_refrele_rn); } -struct ihandle_arg { - uint32_t ihandle; - ire_t *ire; -}; - -static int -ire_ihandle_onlink_match(struct radix_node *rn, void *arg) -{ - struct rt_entry *rt; - irb_t *irb; - ire_t *ire; - struct ihandle_arg *ih = arg; - - rt = (struct rt_entry *)rn; - ASSERT(rt != NULL); - irb = &rt->rt_irb; - for (ire = irb->irb_ire; ire != NULL; ire = ire->ire_next) { - if ((ire->ire_type & IRE_INTERFACE) && - (ire->ire_ihandle == ih->ihandle)) { - ih->ire = ire; - IRE_REFHOLD(ire); - return (1); - } - } - return (0); -} - -/* - * Locate the interface ire that is tied to the cache ire 'cire' via - * cire->ire_ihandle. - * - * We are trying to create the cache ire for an onlink destn. or - * gateway in 'cire'. We are called from ire_add_v4() in the IRE_IF_RESOLVER - * case, after the ire has come back from ARP. - */ -ire_t * -ire_ihandle_lookup_onlink(ire_t *cire) -{ - ire_t *ire; - int match_flags; - struct ihandle_arg ih; - ip_stack_t *ipst; - - ASSERT(cire != NULL); - ipst = cire->ire_ipst; - - /* - * We don't need to specify the zoneid to ire_ftable_lookup() below - * because the ihandle refers to an ipif which can be in only one zone. - */ - match_flags = MATCH_IRE_TYPE | MATCH_IRE_IHANDLE | MATCH_IRE_MASK; - /* - * We know that the mask of the interface ire equals cire->ire_cmask. - * (When ip_newroute() created 'cire' for an on-link destn. it set its - * cmask from the interface ire's mask) - */ - ire = ire_ftable_lookup(cire->ire_addr, cire->ire_cmask, 0, - IRE_INTERFACE, NULL, NULL, ALL_ZONES, cire->ire_ihandle, - NULL, match_flags, ipst); - if (ire != NULL) - return (ire); - /* - * If we didn't find an interface ire above, we can't declare failure. - * For backwards compatibility, we need to support prefix routes - * pointing to next hop gateways that are not on-link. - * - * In the resolver/noresolver case, ip_newroute() thinks it is creating - * the cache ire for an onlink destination in 'cire'. But 'cire' is - * not actually onlink, because ire_ftable_lookup() cheated it, by - * doing ire_route_lookup() twice and returning an interface ire. - * - * Eg. default - gw1 (line 1) - * gw1 - gw2 (line 2) - * gw2 - hme0 (line 3) - * - * In the above example, ip_newroute() tried to create the cache ire - * 'cire' for gw1, based on the interface route in line 3. The - * ire_ftable_lookup() above fails, because there is no interface route - * to reach gw1. (it is gw2). We fall thru below. - * - * Do a brute force search based on the ihandle in a subset of the - * forwarding tables, corresponding to cire->ire_cmask. Otherwise - * things become very complex, since we don't have 'pire' in this - * case. (Also note that this method is not possible in the offlink - * case because we don't know the mask) - */ - (void) memset(&ih, 0, sizeof (ih)); - ih.ihandle = cire->ire_ihandle; - (void) ipst->ips_ip_ftable->rnh_walktree_mt(ipst->ips_ip_ftable, - ire_ihandle_onlink_match, &ih, irb_refhold_rn, irb_refrele_rn); - return (ih.ire); -} - -/* - * IRE iterator used by ire_ftable_lookup[_v6]() to process multiple default - * routes. Given a starting point in the hash list (ire_origin), walk the IREs - * in the bucket skipping default interface routes and deleted entries. - * Returns the next IRE (unheld), or NULL when we're back to the starting point. - * Assumes that the caller holds a reference on the IRE bucket. - */ -ire_t * -ire_get_next_default_ire(ire_t *ire, ire_t *ire_origin) -{ - ASSERT(ire_origin->ire_bucket != NULL); - ASSERT(ire != NULL); - - do { - ire = ire->ire_next; - if (ire == NULL) - ire = ire_origin->ire_bucket->irb_ire; - if (ire == ire_origin) - return (NULL); - } while ((ire->ire_type & IRE_INTERFACE) || - (ire->ire_marks & IRE_MARK_CONDEMNED)); - ASSERT(ire != NULL); - return (ire); -} - -static ipif_t * -ire_forward_src_ipif(ipaddr_t dst, ire_t *sire, ire_t *ire, - int zoneid, ushort_t *marks) -{ - ipif_t *src_ipif; - ill_t *ill = ire->ire_ipif->ipif_ill; - ip_stack_t *ipst = ill->ill_ipst; - - /* - * Pick the best source address from ill. - * - * 1) Try to pick the source address from the destination - * route. Clustering assumes that when we have multiple - * prefixes hosted on an interface, the prefix of the - * source address matches the prefix of the destination - * route. We do this only if the address is not - * DEPRECATED. - * - * 2) If the conn is in a different zone than the ire, we - * need to pick a source address from the right zone. - */ - if ((sire != NULL) && (sire->ire_flags & RTF_SETSRC)) { - /* - * The RTF_SETSRC flag is set in the parent ire (sire). - * Check that the ipif matching the requested source - * address still exists. - */ - src_ipif = ipif_lookup_addr(sire->ire_src_addr, NULL, - zoneid, NULL, NULL, NULL, NULL, ipst); - return (src_ipif); - } - *marks |= IRE_MARK_USESRC_CHECK; - if (IS_IPMP(ill) || - (ire->ire_ipif->ipif_flags & IPIF_DEPRECATED) || - (ill->ill_usesrc_ifindex != 0)) { - src_ipif = ipif_select_source(ill, dst, zoneid); - } else { - src_ipif = ire->ire_ipif; - ASSERT(src_ipif != NULL); - /* hold src_ipif for uniformity */ - ipif_refhold(src_ipif); - } - return (src_ipif); -} - -/* - * This function is called by ip_rput_noire() and ip_fast_forward() - * to resolve the route of incoming packet that needs to be forwarded. - * If the ire of the nexthop is not already in the cachetable, this - * routine will insert it to the table, but won't trigger ARP resolution yet. - * Thus unlike ip_newroute, this function adds incomplete ires to - * the cachetable. ARP resolution for these ires are delayed until - * after all of the packet processing is completed and its ready to - * be sent out on the wire, Eventually, the packet transmit routine - * ip_xmit_v4() attempts to send a packet to the driver. If it finds - * that there is no link layer information, it will do the arp - * resolution and queue the packet in ire->ire_nce->nce_qd_mp and - * then send it out once the arp resolution is over - * (see ip_xmit_v4()->ire_arpresolve()). This scheme is similar to - * the model of BSD/SunOS 4 - * - * In future, the insertion of incomplete ires in the cachetable should - * be implemented in hostpath as well, as doing so will greatly reduce - * the existing complexity for code paths that depend on the context of - * the sender (such as IPsec). - * - * Thus this scheme of adding incomplete ires in cachetable in forwarding - * path can be used as a template for simplifying the hostpath. - */ - -ire_t * -ire_forward(ipaddr_t dst, enum ire_forward_action *ret_action, - ire_t *supplied_ire, ire_t *supplied_sire, const struct ts_label_s *tsl, - ip_stack_t *ipst) -{ - ipaddr_t gw = 0; - ire_t *ire = NULL; - ire_t *sire = NULL, *save_ire; - ill_t *dst_ill = NULL; - int error; - zoneid_t zoneid; - ipif_t *src_ipif = NULL; - mblk_t *res_mp; - ushort_t ire_marks = 0; - tsol_gcgrp_t *gcgrp = NULL; - tsol_gcgrp_addr_t ga; - - zoneid = GLOBAL_ZONEID; - - if (supplied_ire != NULL) { - /* We have arrived here from ipfil_sendpkt */ - ire = supplied_ire; - sire = supplied_sire; - goto create_irecache; - } - - ire = ire_ftable_lookup(dst, 0, 0, 0, NULL, &sire, zoneid, 0, - tsl, MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | - MATCH_IRE_RJ_BHOLE | MATCH_IRE_PARENT|MATCH_IRE_SECATTR, ipst); - - if (ire == NULL) { - ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0, RTA_DST, ipst); - goto icmp_err_ret; - } - - /* - * If we encounter CGTP, we should have the caller use - * ip_newroute to resolve multirt instead of this function. - * CGTP specs explicitly state that it can't be used with routers. - * This essentially prevents insertion of incomplete RTF_MULTIRT - * ires in cachetable. - */ - if (ipst->ips_ip_cgtp_filter && - ((ire->ire_flags & RTF_MULTIRT) || - ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) { - ip3dbg(("ire_forward: packet is to be multirouted- " - "handing it to ip_newroute\n")); - if (sire != NULL) - ire_refrele(sire); - ire_refrele(ire); - /* - * Inform caller about encountering of multirt so that - * ip_newroute() can be called. - */ - *ret_action = Forward_check_multirt; - return (NULL); - } - - /* - * Verify that the returned IRE does not have either - * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is - * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER. - */ - if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) || - (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0) { - ip3dbg(("ire 0x%p is not cache/resolver/noresolver\n", - (void *)ire)); - goto icmp_err_ret; - } - - /* - * If we already have a fully resolved IRE CACHE of the - * nexthop router, just hand over the cache entry - * and we are done. - */ - - if (ire->ire_type & IRE_CACHE) { - - /* - * If we are using this ire cache entry as a - * gateway to forward packets, chances are we - * will be using it again. So turn off - * the temporary flag, thus reducing its - * chances of getting deleted frequently. - */ - if (ire->ire_marks & IRE_MARK_TEMPORARY) { - irb_t *irb = ire->ire_bucket; - rw_enter(&irb->irb_lock, RW_WRITER); - /* - * We need to recheck for IRE_MARK_TEMPORARY after - * acquiring the lock in order to guarantee - * irb_tmp_ire_cnt - */ - if (ire->ire_marks & IRE_MARK_TEMPORARY) { - ire->ire_marks &= ~IRE_MARK_TEMPORARY; - irb->irb_tmp_ire_cnt--; - } - rw_exit(&irb->irb_lock); - } - - if (sire != NULL) { - UPDATE_OB_PKT_COUNT(sire); - sire->ire_last_used_time = lbolt; - ire_refrele(sire); - } - *ret_action = Forward_ok; - return (ire); - } -create_irecache: - /* - * Increment the ire_ob_pkt_count field for ire if it is an - * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and - * increment the same for the parent IRE, sire, if it is some - * sort of prefix IRE (which includes DEFAULT, PREFIX, and HOST). - */ - if ((ire->ire_type & IRE_INTERFACE) != 0) { - UPDATE_OB_PKT_COUNT(ire); - ire->ire_last_used_time = lbolt; - } - - /* - * sire must be either IRE_CACHETABLE OR IRE_INTERFACE type - */ - if (sire != NULL) { - gw = sire->ire_gateway_addr; - ASSERT((sire->ire_type & - (IRE_CACHETABLE | IRE_INTERFACE)) == 0); - UPDATE_OB_PKT_COUNT(sire); - sire->ire_last_used_time = lbolt; - } - - dst_ill = ire->ire_ipif->ipif_ill; - if (IS_IPMP(dst_ill)) - dst_ill = ipmp_illgrp_hold_next_ill(dst_ill->ill_grp); - else - ill_refhold(dst_ill); - - if (dst_ill == NULL) { - ip2dbg(("ire_forward no dst ill; ire 0x%p\n", (void *)ire)); - goto icmp_err_ret; - } - - ASSERT(src_ipif == NULL); - /* Now obtain the src_ipif */ - src_ipif = ire_forward_src_ipif(dst, sire, ire, zoneid, &ire_marks); - if (src_ipif == NULL) - goto icmp_err_ret; - - switch (ire->ire_type) { - case IRE_IF_NORESOLVER: - /* create ire_cache for ire_addr endpoint */ - if (dst_ill->ill_resolver_mp == NULL) { - ip1dbg(("ire_forward: dst_ill %p " - "for IRE_IF_NORESOLVER ire %p has " - "no ill_resolver_mp\n", - (void *)dst_ill, (void *)ire)); - goto icmp_err_ret; - } - /* FALLTHRU */ - case IRE_IF_RESOLVER: - /* - * We have the IRE_IF_RESOLVER of the nexthop gateway - * and now need to build a IRE_CACHE for it. - * In this case, we have the following : - * - * 1) src_ipif - used for getting a source address. - * - * 2) dst_ill - from which we derive ire_stq/ire_rfq. This - * means packets using the IRE_CACHE that we will build - * here will go out on dst_ill. - * - * 3) sire may or may not be NULL. But, the IRE_CACHE that is - * to be created will only be tied to the IRE_INTERFACE - * that was derived from the ire_ihandle field. - * - * If sire is non-NULL, it means the destination is - * off-link and we will first create the IRE_CACHE for the - * gateway. - */ - res_mp = dst_ill->ill_resolver_mp; - if (ire->ire_type == IRE_IF_RESOLVER && - (!OK_RESOLVER_MP(res_mp))) { - goto icmp_err_ret; - } - /* - * To be at this point in the code with a non-zero gw - * means that dst is reachable through a gateway that - * we have never resolved. By changing dst to the gw - * addr we resolve the gateway first. - */ - if (gw != INADDR_ANY) { - /* - * The source ipif that was determined above was - * relative to the destination address, not the - * gateway's. If src_ipif was not taken out of - * the IRE_IF_RESOLVER entry, we'll need to call - * ipif_select_source() again. - */ - if (src_ipif != ire->ire_ipif) { - ipif_refrele(src_ipif); - src_ipif = ipif_select_source(dst_ill, - gw, zoneid); - if (src_ipif == NULL) - goto icmp_err_ret; - } - dst = gw; - gw = INADDR_ANY; - } - /* - * dst has been set to the address of the nexthop. - * - * TSol note: get security attributes of the nexthop; - * Note that the nexthop may either be a gateway, or the - * packet destination itself; Detailed explanation of - * issues involved is provided in the IRE_IF_NORESOLVER - * logic in ip_newroute(). - */ - ga.ga_af = AF_INET; - IN6_IPADDR_TO_V4MAPPED(dst, &ga.ga_addr); - gcgrp = gcgrp_lookup(&ga, B_FALSE); - - if (ire->ire_type == IRE_IF_NORESOLVER) - dst = ire->ire_addr; /* ire_cache for tunnel endpoint */ - - save_ire = ire; - /* - * create an incomplete IRE_CACHE. - * An areq_mp will be generated in ire_arpresolve() for - * RESOLVER interfaces. - */ - ire = ire_create( - (uchar_t *)&dst, /* dest address */ - (uchar_t *)&ip_g_all_ones, /* mask */ - (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ - (uchar_t *)&gw, /* gateway address */ - (save_ire->ire_type == IRE_IF_RESOLVER ? NULL: - &save_ire->ire_max_frag), - NULL, - dst_ill->ill_rq, /* recv-from queue */ - dst_ill->ill_wq, /* send-to queue */ - IRE_CACHE, /* IRE type */ - src_ipif, - ire->ire_mask, /* Parent mask */ - 0, - ire->ire_ihandle, /* Interface handle */ - 0, - &(ire->ire_uinfo), - NULL, - gcgrp, - ipst); - ip1dbg(("incomplete ire_cache 0x%p\n", (void *)ire)); - if (ire != NULL) { - gcgrp = NULL; /* reference now held by IRE */ - ire->ire_marks |= ire_marks; - /* add the incomplete ire: */ - error = ire_add(&ire, NULL, NULL, NULL, B_TRUE); - if (error == 0 && ire != NULL) { - ire->ire_max_frag = save_ire->ire_max_frag; - ip1dbg(("setting max_frag to %d in ire 0x%p\n", - ire->ire_max_frag, (void *)ire)); - } else { - ire_refrele(save_ire); - goto icmp_err_ret; - } - } else { - if (gcgrp != NULL) { - GCGRP_REFRELE(gcgrp); - gcgrp = NULL; - } - } - - ire_refrele(save_ire); - break; - default: - break; - } - - *ret_action = Forward_ok; - if (sire != NULL) - ire_refrele(sire); - if (dst_ill != NULL) - ill_refrele(dst_ill); - if (src_ipif != NULL) - ipif_refrele(src_ipif); - return (ire); -icmp_err_ret: - *ret_action = Forward_ret_icmp_err; - if (sire != NULL) - ire_refrele(sire); - if (dst_ill != NULL) - ill_refrele(dst_ill); - if (src_ipif != NULL) - ipif_refrele(src_ipif); - if (ire != NULL) { - if (ire->ire_flags & RTF_BLACKHOLE) - *ret_action = Forward_blackhole; - ire_refrele(ire); - } - return (NULL); -} - -/* - * Since caller is ip_fast_forward, there is no CGTP or Tsol test - * Also we dont call ftable lookup with MATCH_IRE_PARENT - */ - -ire_t * -ire_forward_simple(ipaddr_t dst, enum ire_forward_action *ret_action, - ip_stack_t *ipst) -{ - ipaddr_t gw = 0; - ire_t *ire = NULL; - ire_t *sire = NULL, *save_ire; - ill_t *dst_ill = NULL; - int error; - zoneid_t zoneid = GLOBAL_ZONEID; - ipif_t *src_ipif = NULL; - mblk_t *res_mp; - ushort_t ire_marks = 0; - - ire = ire_ftable_lookup_simple(dst, &sire, zoneid, - MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_RJ_BHOLE, ipst); - if (ire == NULL) { - ip_rts_change(RTM_MISS, dst, 0, 0, 0, 0, 0, 0, RTA_DST, ipst); - goto icmp_err_ret; - } - - /* - * Verify that the returned IRE does not have either - * the RTF_REJECT or RTF_BLACKHOLE flags set and that the IRE is - * either an IRE_CACHE, IRE_IF_NORESOLVER or IRE_IF_RESOLVER. - */ - if ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) || - ((ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0)) { - ip3dbg(("ire 0x%p is not cache/resolver/noresolver\n", - (void *)ire)); - goto icmp_err_ret; - } - - /* - * If we already have a fully resolved IRE CACHE of the - * nexthop router, just hand over the cache entry - * and we are done. - */ - if (ire->ire_type & IRE_CACHE) { - /* - * If we are using this ire cache entry as a - * gateway to forward packets, chances are we - * will be using it again. So turn off - * the temporary flag, thus reducing its - * chances of getting deleted frequently. - */ - if (ire->ire_marks & IRE_MARK_TEMPORARY) { - irb_t *irb = ire->ire_bucket; - rw_enter(&irb->irb_lock, RW_WRITER); - ire->ire_marks &= ~IRE_MARK_TEMPORARY; - irb->irb_tmp_ire_cnt--; - rw_exit(&irb->irb_lock); - } - - if (sire != NULL) { - UPDATE_OB_PKT_COUNT(sire); - ire_refrele(sire); - } - *ret_action = Forward_ok; - return (ire); - } - /* - * Increment the ire_ob_pkt_count field for ire if it is an - * INTERFACE (IF_RESOLVER or IF_NORESOLVER) IRE type, and - * increment the same for the parent IRE, sire, if it is some - * sort of prefix IRE (which includes DEFAULT, PREFIX, and HOST). - */ - if ((ire->ire_type & IRE_INTERFACE) != 0) { - UPDATE_OB_PKT_COUNT(ire); - ire->ire_last_used_time = lbolt; - } - - /* - * sire must be either IRE_CACHETABLE OR IRE_INTERFACE type - */ - if (sire != NULL) { - gw = sire->ire_gateway_addr; - ASSERT((sire->ire_type & - (IRE_CACHETABLE | IRE_INTERFACE)) == 0); - UPDATE_OB_PKT_COUNT(sire); - } - - dst_ill = ire->ire_ipif->ipif_ill; - if (IS_IPMP(dst_ill)) - dst_ill = ipmp_illgrp_hold_next_ill(dst_ill->ill_grp); - else - ill_refhold(dst_ill); /* for symmetry */ - - if (dst_ill == NULL) { - ip2dbg(("ire_forward_simple: no dst ill; ire 0x%p\n", - (void *)ire)); - goto icmp_err_ret; - } - - ASSERT(src_ipif == NULL); - /* Now obtain the src_ipif */ - src_ipif = ire_forward_src_ipif(dst, sire, ire, zoneid, &ire_marks); - if (src_ipif == NULL) - goto icmp_err_ret; - - switch (ire->ire_type) { - case IRE_IF_NORESOLVER: - /* create ire_cache for ire_addr endpoint */ - case IRE_IF_RESOLVER: - /* - * We have the IRE_IF_RESOLVER of the nexthop gateway - * and now need to build a IRE_CACHE for it. - * In this case, we have the following : - * - * 1) src_ipif - used for getting a source address. - * - * 2) dst_ill - from which we derive ire_stq/ire_rfq. This - * means packets using the IRE_CACHE that we will build - * here will go out on dst_ill. - * - * 3) sire may or may not be NULL. But, the IRE_CACHE that is - * to be created will only be tied to the IRE_INTERFACE - * that was derived from the ire_ihandle field. - * - * If sire is non-NULL, it means the destination is - * off-link and we will first create the IRE_CACHE for the - * gateway. - */ - res_mp = dst_ill->ill_resolver_mp; - if (ire->ire_type == IRE_IF_RESOLVER && - (!OK_RESOLVER_MP(res_mp))) { - ire_refrele(ire); - ire = NULL; - goto out; - } - /* - * To be at this point in the code with a non-zero gw - * means that dst is reachable through a gateway that - * we have never resolved. By changing dst to the gw - * addr we resolve the gateway first. - */ - if (gw != INADDR_ANY) { - /* - * The source ipif that was determined above was - * relative to the destination address, not the - * gateway's. If src_ipif was not taken out of - * the IRE_IF_RESOLVER entry, we'll need to call - * ipif_select_source() again. - */ - if (src_ipif != ire->ire_ipif) { - ipif_refrele(src_ipif); - src_ipif = ipif_select_source(dst_ill, - gw, zoneid); - if (src_ipif == NULL) - goto icmp_err_ret; - } - dst = gw; - gw = INADDR_ANY; - } - - if (ire->ire_type == IRE_IF_NORESOLVER) - dst = ire->ire_addr; /* ire_cache for tunnel endpoint */ - - save_ire = ire; - /* - * create an incomplete IRE_CACHE. - * An areq_mp will be generated in ire_arpresolve() for - * RESOLVER interfaces. - */ - ire = ire_create( - (uchar_t *)&dst, /* dest address */ - (uchar_t *)&ip_g_all_ones, /* mask */ - (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */ - (uchar_t *)&gw, /* gateway address */ - (save_ire->ire_type == IRE_IF_RESOLVER ? NULL: - &save_ire->ire_max_frag), - NULL, - dst_ill->ill_rq, /* recv-from queue */ - dst_ill->ill_wq, /* send-to queue */ - IRE_CACHE, /* IRE type */ - src_ipif, - ire->ire_mask, /* Parent mask */ - 0, - ire->ire_ihandle, /* Interface handle */ - 0, - &(ire->ire_uinfo), - NULL, - NULL, - ipst); - ip1dbg(("incomplete ire_cache 0x%p\n", (void *)ire)); - if (ire != NULL) { - ire->ire_marks |= ire_marks; - /* add the incomplete ire: */ - error = ire_add(&ire, NULL, NULL, NULL, B_TRUE); - if (error == 0 && ire != NULL) { - ire->ire_max_frag = save_ire->ire_max_frag; - ip1dbg(("setting max_frag to %d in ire 0x%p\n", - ire->ire_max_frag, (void *)ire)); - } else { - ire_refrele(save_ire); - goto icmp_err_ret; - } - } - - ire_refrele(save_ire); - break; - default: - break; - } - -out: - *ret_action = Forward_ok; - if (sire != NULL) - ire_refrele(sire); - if (dst_ill != NULL) - ill_refrele(dst_ill); - if (src_ipif != NULL) - ipif_refrele(src_ipif); - return (ire); -icmp_err_ret: - *ret_action = Forward_ret_icmp_err; - if (src_ipif != NULL) - ipif_refrele(src_ipif); - if (dst_ill != NULL) - ill_refrele(dst_ill); - if (sire != NULL) - ire_refrele(sire); - if (ire != NULL) { - if (ire->ire_flags & RTF_BLACKHOLE) - *ret_action = Forward_blackhole; - ire_refrele(ire); - } - /* caller needs to send icmp error message */ - return (NULL); - -} - /* * Obtain the rt_entry and rt_irb for the route to be added to * the ips_ip_ftable. @@ -1489,7 +431,7 @@ ire_get_bucket(ire_t *ire) rt->rt_nodes->rn_key = (char *)&rt->rt_dst; rt->rt_dst = rdst; irb = &rt->rt_irb; - irb->irb_marks |= IRB_MARK_FTABLE; /* dynamically allocated/freed */ + irb->irb_marks |= IRB_MARK_DYNAMIC; /* dynamically allocated/freed */ irb->irb_ipst = ipst; rw_init(&irb->irb_lock, NULL, RW_DEFAULT, NULL); RADIX_NODE_HEAD_WLOCK(ipst->ips_ip_ftable); @@ -1510,7 +452,7 @@ ire_get_bucket(ire_t *ire) } if (rt != NULL) { irb = &rt->rt_irb; - IRB_REFHOLD(irb); + irb_refhold(irb); } RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); return (irb); @@ -1551,10 +493,12 @@ ifindex_lookup(const struct sockaddr *ipaddr, zoneid_t zoneid) ASSERT(ipaddr->sa_family == AF_INET || ipaddr->sa_family == AF_INET6); - if ((ire = route_to_dst(ipaddr, zoneid, ipst)) != NULL) { - ill = ire_to_ill(ire); - if (ill != NULL) + if ((ire = route_to_dst(ipaddr, zoneid, ipst)) != NULL) { + ill = ire_nexthop_ill(ire); + if (ill != NULL) { ifindex = ill->ill_phyint->phyint_ifindex; + ill_refrele(ill); + } ire_refrele(ire); } netstack_rele(ns); @@ -1563,7 +507,7 @@ ifindex_lookup(const struct sockaddr *ipaddr, zoneid_t zoneid) /* * Routine to find the route to a destination. If a ifindex is supplied - * it tries to match the the route to the corresponding ipif for the ifindex + * it tries to match the route to the corresponding ipif for the ifindex */ static ire_t * route_to_dst(const struct sockaddr *dst_addr, zoneid_t zoneid, ip_stack_t *ipst) @@ -1571,27 +515,33 @@ route_to_dst(const struct sockaddr *dst_addr, zoneid_t zoneid, ip_stack_t *ipst) ire_t *ire = NULL; int match_flags; - match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | - MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE); + match_flags = MATCH_IRE_DSTONLY; /* XXX pass NULL tsl for now */ if (dst_addr->sa_family == AF_INET) { - ire = ire_route_lookup( - ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr, - 0, 0, 0, NULL, NULL, zoneid, NULL, match_flags, ipst); + ire = ire_route_recursive_v4( + ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr, 0, NULL, + zoneid, NULL, match_flags, B_TRUE, 0, ipst, NULL, NULL, + NULL); } else { - ire = ire_route_lookup_v6( - &((struct sockaddr_in6 *)dst_addr)->sin6_addr, - 0, 0, 0, NULL, NULL, zoneid, NULL, match_flags, ipst); + ire = ire_route_recursive_v6( + &((struct sockaddr_in6 *)dst_addr)->sin6_addr, 0, NULL, + zoneid, NULL, match_flags, B_TRUE, 0, ipst, NULL, NULL, + NULL); + } + ASSERT(ire != NULL); + if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) { + ire_refrele(ire); + return (NULL); } return (ire); } /* * This routine is called by IP Filter to send a packet out on the wire - * to a specified V4 dst (which may be onlink or offlink). The ifindex may or - * may not be 0. A non-null ifindex indicates IP Filter has stipulated + * to a specified dstination (which may be onlink or offlink). The ifindex may + * or may not be 0. A non-null ifindex indicates IP Filter has stipulated * an outgoing interface and requires the nexthop to be on that interface. * IP WILL NOT DO the following to the data packet before sending it out: * a. manipulate ttl @@ -1611,21 +561,18 @@ route_to_dst(const struct sockaddr *dst_addr, zoneid_t zoneid, ip_stack_t *ipst) * of the offlink dst's nexthop needs to get * resolved before packet can be sent to dst. * Thus transmission is not guaranteed. - * + * Note: No longer have visibility to the ARP queue + * hence no EINPROGRESS. */ - int ipfil_sendpkt(const struct sockaddr *dst_addr, mblk_t *mp, uint_t ifindex, zoneid_t zoneid) { - ire_t *ire = NULL, *sire = NULL; - ire_t *ire_cache = NULL; - int value; - int match_flags; - ipaddr_t dst; + ipaddr_t nexthop; netstack_t *ns; ip_stack_t *ipst; - enum ire_forward_action ret_action; + ip_xmit_attr_t ixas; + int error; ASSERT(mp != NULL); @@ -1646,429 +593,57 @@ ipfil_sendpkt(const struct sockaddr *dst_addr, mblk_t *mp, uint_t ifindex, ASSERT(dst_addr->sa_family == AF_INET || dst_addr->sa_family == AF_INET6); - if (dst_addr->sa_family == AF_INET) { - dst = ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr; - } else { - /* - * We dont have support for V6 yet. It will be provided - * once RFE 6399103 has been delivered. - * Until then, for V6 dsts, IP Filter will not call - * this function. Instead the netinfo framework provides - * its own code path, in ip_inject_impl(), to achieve - * what it needs to do, for the time being. - */ - ip1dbg(("ipfil_sendpkt: no V6 support \n")); - value = ECOMM; - freemsg(mp); - goto discard; - } - - /* - * Lets get the ire. We might get the ire cache entry, - * or the ire,sire pair needed to create the cache entry. - * XXX pass NULL tsl for now. - */ - - if (ifindex == 0) { - /* There is no supplied index. So use the FIB info */ - - match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | - MATCH_IRE_RECURSIVE | MATCH_IRE_RJ_BHOLE); - ire = ire_route_lookup(dst, - 0, 0, 0, NULL, &sire, zoneid, msg_getlabel(mp), - match_flags, ipst); - } else { - ipif_t *supplied_ipif; - ill_t *ill; - - match_flags = (MATCH_IRE_DSTONLY | MATCH_IRE_DEFAULT | - MATCH_IRE_RECURSIVE| MATCH_IRE_RJ_BHOLE| - MATCH_IRE_SECATTR | MATCH_IRE_ILL); - - /* - * If supplied ifindex is non-null, the only valid - * nexthop is one off of the interface corresponding - * to the specified ifindex. - */ - ill = ill_lookup_on_ifindex(ifindex, B_FALSE, - NULL, NULL, NULL, NULL, ipst); - if (ill == NULL) { - ip1dbg(("ipfil_sendpkt: Could not find" - " route to dst\n")); - value = ECOMM; - freemsg(mp); - goto discard; - } - - supplied_ipif = ipif_get_next_ipif(NULL, ill); - ire = ire_route_lookup(dst, 0, 0, 0, supplied_ipif, - &sire, zoneid, msg_getlabel(mp), match_flags, ipst); - if (supplied_ipif != NULL) - ipif_refrele(supplied_ipif); - ill_refrele(ill); - } - + bzero(&ixas, sizeof (ixas)); /* - * Verify that the returned IRE is non-null and does - * not have either the RTF_REJECT or RTF_BLACKHOLE - * flags set and that the IRE is either an IRE_CACHE, - * IRE_IF_NORESOLVER or IRE_IF_RESOLVER. + * No IPsec, no fragmentation, and don't let any hooks see + * the packet. */ - if (ire == NULL || - ((ire->ire_flags & (RTF_REJECT | RTF_BLACKHOLE)) || - (ire->ire_type & (IRE_CACHE | IRE_INTERFACE)) == 0)) { - /* - * Either ire could not be found or we got - * an invalid one - */ - ip1dbg(("ipfil_sendpkt: Could not find route to dst\n")); - value = ENONET; - freemsg(mp); - goto discard; - } - - /* IP Filter and CGTP dont mix. So bail out if CGTP is on */ - if (ipst->ips_ip_cgtp_filter && - ((ire->ire_flags & RTF_MULTIRT) || - ((sire != NULL) && (sire->ire_flags & RTF_MULTIRT)))) { - ip1dbg(("ipfil_sendpkt: IPFilter does not work with CGTP\n")); - value = ECOMM; - freemsg(mp); - goto discard; - } + ixas.ixa_flags = IXAF_NO_IPSEC | IXAF_DONTFRAG | IXAF_NO_PFHOOK; + ixas.ixa_cred = kcred; + ixas.ixa_cpid = NOPID; + ixas.ixa_tsl = NULL; + ixas.ixa_ipst = ipst; + ixas.ixa_ifindex = ifindex; - ASSERT(ire->ire_type != IRE_CACHE || ire->ire_nce != NULL); - - /* - * If needed, we will create the ire cache entry for the - * nexthop, resolve its link-layer address and then send - * the packet out without ttl or IPSec processing. - */ - switch (ire->ire_type) { - case IRE_CACHE: - if (sire != NULL) { - UPDATE_OB_PKT_COUNT(sire); - sire->ire_last_used_time = lbolt; - ire_refrele(sire); - } - ire_cache = ire; - break; - case IRE_IF_NORESOLVER: - case IRE_IF_RESOLVER: - /* - * Call ire_forward(). This function - * will, create the ire cache entry of the - * the nexthop and adds this incomplete ire - * to the ire cache table - */ - ire_cache = ire_forward(dst, &ret_action, ire, sire, - msg_getlabel(mp), ipst); - if (ire_cache == NULL) { - ip1dbg(("ipfil_sendpkt: failed to create the" - " ire cache entry \n")); - value = ENONET; - freemsg(mp); - sire = NULL; - ire = NULL; - goto discard; - } - break; - } - - if (DB_CKSUMFLAGS(mp)) { - if (ip_send_align_hcksum_flags(mp, ire_to_ill(ire_cache))) - goto cleanup; - } - - /* - * Now that we have the ire cache entry of the nexthop, call - * ip_xmit_v4() to trigger mac addr resolution - * if necessary and send it once ready. - */ - - value = ip_xmit_v4(mp, ire_cache, NULL, B_FALSE, NULL); -cleanup: - ire_refrele(ire_cache); - /* - * At this point, the reference for these have already been - * released within ire_forward() and/or ip_xmit_v4(). So we set - * them to NULL to make sure we dont drop the references - * again in case ip_xmit_v4() returns with either SEND_FAILED - * or LLHDR_RESLV_FAILED - */ - sire = NULL; - ire = NULL; - - switch (value) { - case SEND_FAILED: - ip1dbg(("ipfil_sendpkt: Send failed\n")); - value = ECOMM; - break; - case LLHDR_RESLV_FAILED: - ip1dbg(("ipfil_sendpkt: Link-layer resolution" - " failed\n")); - value = ECOMM; - break; - case LOOKUP_IN_PROGRESS: - netstack_rele(ns); - return (EINPROGRESS); - case SEND_PASSED: - netstack_rele(ns); - return (0); - } -discard: if (dst_addr->sa_family == AF_INET) { - BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); - } else { - BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsOutDiscards); - } - if (ire != NULL) - ire_refrele(ire); - if (sire != NULL) - ire_refrele(sire); - netstack_rele(ns); - return (value); -} - - -/* - * We don't check for dohwcksum in here because it should be being used - * elsewhere to control what flags are being set on the mblk. That is, - * if DB_CKSUMFLAGS() is non-zero then we assume dohwcksum to be true - * for this packet. - * - * This function assumes that it is *only* being called for TCP or UDP - * packets and nothing else. - */ -static int -ip_send_align_hcksum_flags(mblk_t *mp, ill_t *ill) -{ - int illhckflags; - int mbhckflags; - uint16_t *up; - uint32_t cksum; - ipha_t *ipha; - ip6_t *ip6; - int proto; - int ipversion; - int length; - int start; - ip6_pkt_t ipp; - - mbhckflags = DB_CKSUMFLAGS(mp); - ASSERT(mbhckflags != 0); - ASSERT(mp->b_datap->db_type == M_DATA); - /* - * Since this function only knows how to manage the hardware checksum - * issue, reject and packets that have flags set on the aside from - * checksum related attributes as we cannot necessarily safely map - * that packet onto the new NIC. Packets that can be potentially - * dropped here include those marked for LSO. - */ - if ((mbhckflags & - ~(HCK_FULLCKSUM|HCK_PARTIALCKSUM|HCK_IPV4_HDRCKSUM)) != 0) { - DTRACE_PROBE2(pbr__incapable, (mblk_t *), mp, (ill_t *), ill); - freemsg(mp); - return (-1); - } - - ipha = (ipha_t *)mp->b_rptr; - - /* - * Find out what the new NIC is capable of, if anything, and - * only allow it to be used with M_DATA mblks being sent out. - */ - if (ILL_HCKSUM_CAPABLE(ill)) { - illhckflags = ill->ill_hcksum_capab->ill_hcksum_txflags; - } else { - /* - * No capabilities, so turn off everything. - */ - illhckflags = 0; - (void) hcksum_assoc(mp, NULL, NULL, 0, 0, 0, 0, 0, 0); - mp->b_datap->db_struioflag &= ~STRUIO_IP; - } - - DTRACE_PROBE4(pbr__info__a, (mblk_t *), mp, (ill_t *), ill, - uint32_t, illhckflags, uint32_t, mbhckflags); - /* - * This block of code that looks for the position of the TCP/UDP - * checksum is early in this function because we need to know - * what needs to be blanked out for the hardware checksum case. - * - * That we're in this function implies that the packet is either - * TCP or UDP on Solaris, so checks are made for one protocol and - * if that fails, the other is therefore implied. - */ - ipversion = IPH_HDR_VERSION(ipha); + ipha_t *ipha = (ipha_t *)mp->b_rptr; - if (ipversion == IPV4_VERSION) { - proto = ipha->ipha_protocol; - if (proto == IPPROTO_TCP) { - up = IPH_TCPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH); - } else { - up = IPH_UDPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH); + ixas.ixa_flags |= IXAF_IS_IPV4; + nexthop = ((struct sockaddr_in *)dst_addr)->sin_addr.s_addr; + if (nexthop != ipha->ipha_dst) { + ixas.ixa_flags |= IXAF_NEXTHOP_SET; + ixas.ixa_nexthop_v4 = nexthop; } + ixas.ixa_multicast_ttl = ipha->ipha_ttl; } else { - uint8_t lasthdr; - - /* - * Nothing I've seen indicates that IPv6 checksum'ing - * precludes the presence of extension headers, so we - * can't just look at the next header value in the IPv6 - * packet header to see if it is TCP/UDP. - */ - ip6 = (ip6_t *)ipha; - (void) memset(&ipp, 0, sizeof (ipp)); - start = ip_find_hdr_v6(mp, ip6, &ipp, &lasthdr); - proto = lasthdr; - - if (proto == IPPROTO_TCP) { - up = IPH_TCPH_CHECKSUMP(ipha, start); - } else { - up = IPH_UDPH_CHECKSUMP(ipha, start); - } - } + ip6_t *ip6h = (ip6_t *)mp->b_rptr; + in6_addr_t *nexthop6; - /* - * The first case here is easiest: - * mblk hasn't asked for full checksum, but the card supports it. - * - * In addition, check for IPv4 header capability. Note that only - * the mblk flag is checked and not ipversion. - */ - if ((((illhckflags & HCKSUM_INET_FULL_V4) && (ipversion == 4)) || - (((illhckflags & HCKSUM_INET_FULL_V6) && (ipversion == 6)))) && - ((mbhckflags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) != 0)) { - int newflags = HCK_FULLCKSUM; - - if ((mbhckflags & HCK_IPV4_HDRCKSUM) != 0) { - if ((illhckflags & HCKSUM_IPHDRCKSUM) != 0) { - newflags |= HCK_IPV4_HDRCKSUM; - } else { - /* - * Rather than call a function, just inline - * the computation of the basic IPv4 header. - */ - cksum = (ipha->ipha_dst >> 16) + - (ipha->ipha_dst & 0xFFFF) + - (ipha->ipha_src >> 16) + - (ipha->ipha_src & 0xFFFF); - IP_HDR_CKSUM(ipha, cksum, - ((uint32_t *)ipha)[0], - ((uint16_t *)ipha)[4]); - } + nexthop6 = &((struct sockaddr_in6 *)dst_addr)->sin6_addr; + if (!IN6_ARE_ADDR_EQUAL(nexthop6, &ip6h->ip6_dst)) { + ixas.ixa_flags |= IXAF_NEXTHOP_SET; + ixas.ixa_nexthop_v6 = *nexthop6; } - - *up = 0; - (void) hcksum_assoc(mp, NULL, NULL, 0, 0, 0, 0, - newflags, 0); - return (0); - } - - DTRACE_PROBE2(pbr__info__b, int, ipversion, int, proto); - - /* - * Start calculating the pseudo checksum over the IP packet header. - * Although the final pseudo checksum used by TCP/UDP consists of - * more than just the address fields, we can use the result of - * adding those together a little bit further down for IPv4. - */ - if (ipversion == IPV4_VERSION) { - cksum = (ipha->ipha_dst >> 16) + (ipha->ipha_dst & 0xFFFF) + - (ipha->ipha_src >> 16) + (ipha->ipha_src & 0xFFFF); - start = IP_SIMPLE_HDR_LENGTH; - length = ntohs(ipha->ipha_length); - DTRACE_PROBE3(pbr__info__e, uint32_t, ipha->ipha_src, - uint32_t, ipha->ipha_dst, int, cksum); - } else { - uint16_t *pseudo; - - pseudo = (uint16_t *)&ip6->ip6_src; - - /* calculate pseudo-header checksum */ - cksum = pseudo[0] + pseudo[1] + pseudo[2] + pseudo[3] + - pseudo[4] + pseudo[5] + pseudo[6] + pseudo[7] + - pseudo[8] + pseudo[9] + pseudo[10] + pseudo[11] + - pseudo[12] + pseudo[13] + pseudo[14] + pseudo[15]; - - length = ntohs(ip6->ip6_plen) + sizeof (ip6_t); - } - - /* Fold the initial sum */ - cksum = (cksum & 0xffff) + (cksum >> 16); - - /* - * If the packet was asking for an IPv4 header checksum to be - * calculated but the interface doesn't support that, fill it in - * using our pseudo checksum as a starting point. - */ - if (((mbhckflags & HCK_IPV4_HDRCKSUM) != 0) && - ((illhckflags & HCKSUM_IPHDRCKSUM) == 0)) { - /* - * IP_HDR_CKSUM uses the 2rd arg to the macro in a destructive - * way so pass in a copy of the checksum calculated thus far. - */ - uint32_t ipsum = cksum; - - DB_CKSUMFLAGS(mp) &= ~HCK_IPV4_HDRCKSUM; - - IP_HDR_CKSUM(ipha, ipsum, ((uint32_t *)ipha)[0], - ((uint16_t *)ipha)[4]); - } - - DTRACE_PROBE3(pbr__info__c, int, start, int, length, int, cksum); - - if (proto == IPPROTO_TCP) { - cksum += IP_TCP_CSUM_COMP; - } else { - cksum += IP_UDP_CSUM_COMP; + ixas.ixa_multicast_ttl = ip6h->ip6_hops; } - cksum += htons(length - start); - cksum = (cksum & 0xffff) + (cksum >> 16); - - /* - * For TCP/UDP, we either want to setup the packet for partial - * checksum or we want to do it all ourselves because the NIC - * offers no support for either partial or full checksum. - */ - if ((illhckflags & HCKSUM_INET_PARTIAL) != 0) { - /* - * The only case we care about here is if the mblk was - * previously set for full checksum offload. If it was - * marked for partial (and the NIC does partial), then - * we have nothing to do. Similarly if the packet was - * not set for partial or full, we do nothing as this - * is cheaper than more work to set something up. - */ - if ((mbhckflags & HCK_FULLCKSUM) != 0) { - uint32_t offset; - - if (proto == IPPROTO_TCP) { - offset = TCP_CHECKSUM_OFFSET; - } else { - offset = UDP_CHECKSUM_OFFSET; - } - *up = cksum; - - DTRACE_PROBE3(pbr__info__f, int, length - start, int, - cksum, int, offset); + error = ip_output_simple(mp, &ixas); + ixa_cleanup(&ixas); - (void) hcksum_assoc(mp, NULL, NULL, start, - start + offset, length, 0, - DB_CKSUMFLAGS(mp) | HCK_PARTIALCKSUM, 0); - } + netstack_rele(ns); + switch (error) { + case 0: + break; - } else if (mbhckflags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)) { - DB_CKSUMFLAGS(mp) &= ~(HCK_PARTIALCKSUM|HCK_FULLCKSUM); + case EHOSTUNREACH: + case ENETUNREACH: + error = ENONET; + break; - *up = 0; - *up = IP_CSUM(mp, start, cksum); + default: + error = ECOMM; + break; } - - DTRACE_PROBE4(pbr__info__d, (mblk_t *), mp, (ipha_t *), ipha, - (uint16_t *), up, int, cksum); - return (0); + return (error); } /* @@ -2094,18 +669,18 @@ ire_find_best_route(struct radix_node *rn, void *arg) rw_enter(&irb_ptr->irb_lock, RW_READER); for (ire = irb_ptr->irb_ire; ire != NULL; ire = ire->ire_next) { - if (ire->ire_marks & IRE_MARK_CONDEMNED) + if (IRE_IS_CONDEMNED(ire)) continue; - if (margs->ift_flags & MATCH_IRE_MASK) + if (margs->ift_flags & (MATCH_IRE_MASK|MATCH_IRE_SHORTERMASK)) match_mask = margs->ift_mask; else match_mask = ire->ire_mask; if (ire_match_args(ire, margs->ift_addr, match_mask, - margs->ift_gateway, margs->ift_type, margs->ift_ipif, - margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl, - margs->ift_flags, NULL)) { - IRE_REFHOLD(ire); + margs->ift_gateway, margs->ift_type, margs->ift_ill, + margs->ift_zoneid, margs->ift_tsl, + margs->ift_flags)) { + ire_refhold(ire); rw_exit(&irb_ptr->irb_lock); margs->ift_best_ire = ire; return (B_TRUE); @@ -2198,107 +773,182 @@ irb_refrele_ftable(irb_t *irb) } /* - * IRE iterator used by ire_ftable_lookup() to process multiple default - * routes. Given a starting point in the hash list (ire_origin), walk the IREs - * in the bucket skipping default interface routes and deleted entries. - * Returns the next IRE (unheld), or NULL when we're back to the starting point. - * Assumes that the caller holds a reference on the IRE bucket. + * IRE iterator used by ire_ftable_lookup to process multiple equal + * routes. Given a starting point in the hash list (hash), walk the IREs + * in the bucket skipping deleted entries. We treat the bucket as a circular + * list for the purposes of walking it. + * Returns the IRE (held) that corresponds to the hash value. If that IRE is + * not applicable (ire_match_args failed) then it returns a subsequent one. + * If we fail to find an IRE we return NULL. * - * In the absence of good IRE_DEFAULT routes, this function will return - * the first IRE_INTERFACE route found (if any). + * Assumes that the caller holds a reference on the IRE bucket and a read lock + * on the radix_node_head (for IPv4) or the ip6_ire_head (for IPv6). + * + * Applies to IPv4 and IPv6. + * + * For CGTP, where an IRE_BROADCAST and IRE_HOST can exist for the same + * address and bucket, we compare against ire_type for the orig_ire. We also + * have IRE_BROADCASTs with and without RTF_MULTIRT, with the former being + * first in the bucket. Thus we compare that ire_flags match the orig_ire. + * + * Due to shared-IP zones we check that an IRE_OFFLINK has a gateway that is + * reachable from the zone i.e., that the ire_gateway_addr is in a subnet + * in which the zone has an IP address. We check this for the global zone + * even if no shared-IP zones are configured. */ ire_t * -ire_round_robin(irb_t *irb_ptr, zoneid_t zoneid, ire_ftable_args_t *margs, - ip_stack_t *ipst) +ire_round_robin(irb_t *irb_ptr, ire_ftable_args_t *margs, uint_t hash, + ire_t *orig_ire, ip_stack_t *ipst) { - ire_t *ire_origin; - ire_t *ire, *maybe_ire = NULL; + ire_t *ire, *maybe_ire = NULL; + uint_t maybe_badcnt; + uint_t maxwalk; - rw_enter(&irb_ptr->irb_lock, RW_WRITER); - ire_origin = irb_ptr->irb_rr_origin; - if (ire_origin != NULL) { - ire_origin = ire_origin->ire_next; - IRE_FIND_NEXT_ORIGIN(ire_origin); - } + /* Fold in more bits from the hint/hash */ + hash = hash ^ (hash >> 8) ^ (hash >> 16); - if (ire_origin == NULL) { - /* - * first time through routine, or we dropped off the end - * of list. - */ - ire_origin = irb_ptr->irb_ire; - IRE_FIND_NEXT_ORIGIN(ire_origin); - } - irb_ptr->irb_rr_origin = ire_origin; - IRB_REFHOLD_LOCKED(irb_ptr); + rw_enter(&irb_ptr->irb_lock, RW_WRITER); + maxwalk = irb_ptr->irb_ire_cnt; /* Excludes condemned */ + hash %= maxwalk; + irb_refhold_locked(irb_ptr); rw_exit(&irb_ptr->irb_lock); - DTRACE_PROBE2(ire__rr__origin, (irb_t *), irb_ptr, - (ire_t *), ire_origin); - /* * Round-robin the routers list looking for a route that * matches the passed in parameters. - * We start with the ire we found above and we walk the hash - * list until we're back where we started. It doesn't matter if - * routes are added or deleted by other threads - we know this - * ire will stay in the list because we hold a reference on the - * ire bucket. + * First we skip "hash" number of non-condemned IREs. + * Then we match the IRE. + * If we find an ire which has a non-zero ire_badcnt then we remember + * it and keep on looking for a lower ire_badcnt. + * If we come to the end of the list we continue (treat the + * bucket list as a circular list) but we match less than "max" + * entries. */ - ire = ire_origin; - while (ire != NULL) { - int match_flags = MATCH_IRE_TYPE | MATCH_IRE_SECATTR; - ire_t *rire; + ire = irb_ptr->irb_ire; + while (maxwalk > 0) { + if (IRE_IS_CONDEMNED(ire)) + goto next_ire_skip; + + /* Skip the first "hash" entries to do ECMP */ + if (hash != 0) { + hash--; + goto next_ire_skip; + } - if (ire->ire_marks & IRE_MARK_CONDEMNED) + /* See CGTP comment above */ + if (ire->ire_type != orig_ire->ire_type || + ire->ire_flags != orig_ire->ire_flags) goto next_ire; - if (!ire_match_args(ire, margs->ift_addr, (ipaddr_t)0, - margs->ift_gateway, margs->ift_type, margs->ift_ipif, - margs->ift_zoneid, margs->ift_ihandle, margs->ift_tsl, - margs->ift_flags, NULL)) + /* + * Note: Since IPv6 has hash buckets instead of radix + * buckers we need to explicitly compare the addresses. + * That makes this less efficient since we will be called + * even if there is no alternatives just because the + * bucket has multiple IREs for different addresses. + */ + if (ire->ire_ipversion == IPV6_VERSION) { + if (!IN6_ARE_ADDR_EQUAL(&orig_ire->ire_addr_v6, + &ire->ire_addr_v6)) + goto next_ire; + } + + /* + * For some reason find_best_route uses ire_mask. We do + * the same. + */ + if (ire->ire_ipversion == IPV4_VERSION ? + !ire_match_args(ire, margs->ift_addr, + ire->ire_mask, margs->ift_gateway, + margs->ift_type, margs->ift_ill, margs->ift_zoneid, + margs->ift_tsl, margs->ift_flags) : + !ire_match_args_v6(ire, &margs->ift_addr_v6, + &ire->ire_mask_v6, &margs->ift_gateway_v6, + margs->ift_type, margs->ift_ill, margs->ift_zoneid, + margs->ift_tsl, margs->ift_flags)) goto next_ire; - if (ire->ire_type & IRE_INTERFACE) { + if (margs->ift_zoneid != ALL_ZONES && + (ire->ire_type & IRE_OFFLINK)) { /* - * keep looking to see if there is a non-interface - * default ire, but save this one as a last resort. + * When we're in a zone, we're only + * interested in routers that are + * reachable through ipifs within our zone. */ - if (maybe_ire == NULL) - maybe_ire = ire; - goto next_ire; + if (ire->ire_ipversion == IPV4_VERSION) { + if (!ire_gateway_ok_zone_v4( + ire->ire_gateway_addr, margs->ift_zoneid, + ire->ire_ill, margs->ift_tsl, ipst, + B_TRUE)) + goto next_ire; + } else { + if (!ire_gateway_ok_zone_v6( + &ire->ire_gateway_addr_v6, + margs->ift_zoneid, ire->ire_ill, + margs->ift_tsl, ipst, B_TRUE)) + goto next_ire; + } } - - if (zoneid == ALL_ZONES) { - IRE_REFHOLD(ire); - IRB_REFRELE(irb_ptr); + mutex_enter(&ire->ire_lock); + /* Look for stale ire_badcnt and clear */ + if (ire->ire_badcnt != 0 && + (TICK_TO_SEC(lbolt64) - ire->ire_last_badcnt > + ipst->ips_ip_ire_badcnt_lifetime)) + ire->ire_badcnt = 0; + mutex_exit(&ire->ire_lock); + + if (ire->ire_badcnt == 0) { + /* We found one with a zero badcnt; done */ + ire_refhold(ire); + /* + * Care needed since irb_refrele grabs WLOCK to free + * the irb_t. + */ + if (ire->ire_ipversion == IPV4_VERSION) { + RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); + irb_refrele(irb_ptr); + RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); + } else { + rw_exit(&ipst->ips_ip6_ire_head_lock); + irb_refrele(irb_ptr); + rw_enter(&ipst->ips_ip6_ire_head_lock, + RW_READER); + } return (ire); } /* - * When we're in a non-global zone, we're only - * interested in routers that are - * reachable through ipifs within our zone. + * keep looking to see if there is a better (lower + * badcnt) matching IRE, but save this one as a last resort. + * If we find a lower badcnt pick that one as the last* resort. */ - if (ire->ire_ipif != NULL) - match_flags |= MATCH_IRE_ILL; - - rire = ire_route_lookup(ire->ire_gateway_addr, 0, 0, - IRE_INTERFACE, ire->ire_ipif, NULL, zoneid, margs->ift_tsl, - match_flags, ipst); - if (rire != NULL) { - ire_refrele(rire); - IRE_REFHOLD(ire); - IRB_REFRELE(irb_ptr); - return (ire); + if (maybe_ire == NULL) { + maybe_ire = ire; + maybe_badcnt = ire->ire_badcnt; + } else if (ire->ire_badcnt < maybe_badcnt) { + maybe_ire = ire; + maybe_badcnt = ire->ire_badcnt; } + next_ire: - ire = (ire->ire_next ? ire->ire_next : irb_ptr->irb_ire); - if (ire == ire_origin) - break; + maxwalk--; +next_ire_skip: + ire = ire->ire_next; + if (ire == NULL) + ire = irb_ptr->irb_ire; } if (maybe_ire != NULL) - IRE_REFHOLD(maybe_ire); - IRB_REFRELE(irb_ptr); + ire_refhold(maybe_ire); + + /* Care needed since irb_refrele grabs WLOCK to free the irb_t. */ + if (ire->ire_ipversion == IPV4_VERSION) { + RADIX_NODE_HEAD_UNLOCK(ipst->ips_ip_ftable); + irb_refrele(irb_ptr); + RADIX_NODE_HEAD_RLOCK(ipst->ips_ip_ftable); + } else { + rw_exit(&ipst->ips_ip6_ire_head_lock); + irb_refrele(irb_ptr); + rw_enter(&ipst->ips_ip6_ire_head_lock, RW_READER); + } return (maybe_ire); } @@ -2306,7 +956,7 @@ void irb_refhold_rn(struct radix_node *rn) { if ((rn->rn_flags & RNF_ROOT) == 0) - IRB_REFHOLD(&((rt_t *)(rn))->rt_irb); + irb_refhold(&((rt_t *)(rn))->rt_irb); } void @@ -2315,3 +965,587 @@ irb_refrele_rn(struct radix_node *rn) if ((rn->rn_flags & RNF_ROOT) == 0) irb_refrele_ftable(&((rt_t *)(rn))->rt_irb); } + +/* + * Select a route for IPv4 and IPv6. Except for multicast, loopback and reject + * routes this routine sets up a ire_nce_cache as well. The caller needs to + * lookup an nce for the multicast case. + */ +ire_t * +ip_select_route(const in6_addr_t *v6dst, ip_xmit_attr_t *ixa, + uint_t *generationp, in6_addr_t *setsrcp, int *errorp, boolean_t *multirtp) +{ + uint_t match_args; + uint_t ire_type; + ill_t *ill; + ire_t *ire; + ip_stack_t *ipst = ixa->ixa_ipst; + ipaddr_t v4dst; + in6_addr_t v6nexthop; + iaflags_t ixaflags = ixa->ixa_flags; + nce_t *nce; + + match_args = MATCH_IRE_SECATTR; + IN6_V4MAPPED_TO_IPADDR(v6dst, v4dst); + if (setsrcp != NULL) + ASSERT(IN6_IS_ADDR_UNSPECIFIED(setsrcp)); + if (errorp != NULL) + ASSERT(*errorp == 0); + + /* + * The content of the ixa will be different if IP_NEXTHOP, + * SO_DONTROUTE, IP_BOUND_IF, IP_PKTINFO etc are set + */ + + if ((ixaflags & IXAF_IS_IPV4) ? CLASSD(v4dst) : + IN6_IS_ADDR_MULTICAST(v6dst)) { + /* Pick up the IRE_MULTICAST for the ill */ + if (ixa->ixa_multicast_ifindex != 0) { + ill = ill_lookup_on_ifindex(ixa->ixa_multicast_ifindex, + !(ixaflags & IXAF_IS_IPV4), ipst); + } else if (ixaflags & IXAF_SCOPEID_SET) { + /* sin6_scope_id takes precedence over ixa_ifindex */ + ASSERT(ixa->ixa_scopeid != 0); + ill = ill_lookup_on_ifindex(ixa->ixa_scopeid, + !(ixaflags & IXAF_IS_IPV4), ipst); + } else if (ixa->ixa_ifindex != 0) { + /* + * In the ipmp case, the ixa_ifindex is set to + * point at an under_ill and we would return the + * ire_multicast() corresponding to that under_ill. + */ + ill = ill_lookup_on_ifindex(ixa->ixa_ifindex, + !(ixaflags & IXAF_IS_IPV4), ipst); + } else if (ixaflags & IXAF_IS_IPV4) { + ipaddr_t v4setsrc = INADDR_ANY; + + ill = ill_lookup_group_v4(v4dst, ixa->ixa_zoneid, ipst, + multirtp, &v4setsrc); + if (setsrcp != NULL) + IN6_IPADDR_TO_V4MAPPED(v4setsrc, setsrcp); + } else { + ill = ill_lookup_group_v6(v6dst, ixa->ixa_zoneid, ipst, + multirtp, setsrcp); + } + if (ill != NULL && IS_VNI(ill)) { + ill_refrele(ill); + ill = NULL; + } + if (ill == NULL) { + if (errorp != NULL) + *errorp = ENXIO; + /* Get a hold on the IRE_NOROUTE */ + ire = ire_reject(ipst, !(ixaflags & IXAF_IS_IPV4)); + return (ire); + } + if (!(ill->ill_flags & ILLF_MULTICAST)) { + ill_refrele(ill); + if (errorp != NULL) + *errorp = EHOSTUNREACH; + /* Get a hold on the IRE_NOROUTE */ + ire = ire_reject(ipst, !(ixaflags & IXAF_IS_IPV4)); + return (ire); + } + /* Get a refcnt on the single IRE_MULTICAST per ill */ + ire = ire_multicast(ill); + ill_refrele(ill); + if (generationp != NULL) + *generationp = ire->ire_generation; + if (errorp != NULL && + (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))) { + *errorp = EHOSTUNREACH; + } + return (ire); + } + + if (ixa->ixa_ifindex != 0 || (ixaflags & IXAF_SCOPEID_SET)) { + if (ixaflags & IXAF_SCOPEID_SET) { + /* sin6_scope_id takes precedence over ixa_ifindex */ + ASSERT(ixa->ixa_scopeid != 0); + ill = ill_lookup_on_ifindex(ixa->ixa_scopeid, + !(ixaflags & IXAF_IS_IPV4), ipst); + } else { + ASSERT(ixa->ixa_ifindex != 0); + ill = ill_lookup_on_ifindex(ixa->ixa_ifindex, + !(ixaflags & IXAF_IS_IPV4), ipst); + } + if (ill != NULL && IS_VNI(ill)) { + ill_refrele(ill); + ill = NULL; + } + if (ill == NULL) { + if (errorp != NULL) + *errorp = ENXIO; + /* Get a hold on the IRE_NOROUTE */ + ire = ire_reject(ipst, !(ixaflags & IXAF_IS_IPV4)); + return (ire); + } + /* + * icmp_send_reply_v6 uses scopeid, and mpathd sets IP*_BOUND_IF + * so for both of them we need to be able look for an under + * interface. + */ + if (IS_UNDER_IPMP(ill)) + match_args |= MATCH_IRE_TESTHIDDEN; + } else { + ill = NULL; + } + + if (ixaflags & IXAF_NEXTHOP_SET) { + /* IP_NEXTHOP was set */ + v6nexthop = ixa->ixa_nexthop_v6; + } else { + v6nexthop = *v6dst; + } + + ire_type = 0; + /* If ill is null then ire_route_recursive will set MATCH_IRE_ILL */ + + /* + * If SO_DONTROUTE is set or if IP_NEXTHOP is set, then + * we only look for an onlink IRE. + */ + if (ixaflags & (IXAF_DONTROUTE|IXAF_NEXTHOP_SET)) { + match_args |= MATCH_IRE_TYPE; + ire_type = IRE_ONLINK; + } + + if (ixaflags & IXAF_IS_IPV4) { + ipaddr_t v4nexthop; + ipaddr_t v4setsrc = INADDR_ANY; + + IN6_V4MAPPED_TO_IPADDR(&v6nexthop, v4nexthop); + ire = ire_route_recursive_v4(v4nexthop, ire_type, ill, + ixa->ixa_zoneid, ixa->ixa_tsl, match_args, B_TRUE, + ixa->ixa_xmit_hint, ipst, &v4setsrc, NULL, generationp); + if (setsrcp != NULL) + IN6_IPADDR_TO_V4MAPPED(v4setsrc, setsrcp); + } else { + ire = ire_route_recursive_v6(&v6nexthop, ire_type, ill, + ixa->ixa_zoneid, ixa->ixa_tsl, match_args, B_TRUE, + ixa->ixa_xmit_hint, ipst, setsrcp, NULL, generationp); + } + +#ifdef DEBUG + if (match_args & MATCH_IRE_TESTHIDDEN) { + ip3dbg(("looking for hidden; dst %x ire %p\n", + v4dst, (void *)ire)); + } +#endif + + if (ill != NULL) + ill_refrele(ill); + + if ((ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) || + (ire->ire_type & IRE_MULTICAST)) { + /* No ire_nce_cache */ + return (ire); + } + + /* Setup ire_nce_cache if it doesn't exist or is condemned. */ + mutex_enter(&ire->ire_lock); + nce = ire->ire_nce_cache; + if (nce == NULL || nce->nce_is_condemned) { + mutex_exit(&ire->ire_lock); + (void) ire_revalidate_nce(ire); + } else { + mutex_exit(&ire->ire_lock); + } + return (ire); +} + +/* + * Find a route given some xmit attributes and a packet. + * Generic for IPv4 and IPv6 + * + * This never returns NULL. But when it returns the IRE_NOROUTE + * it might set errorp. + */ +ire_t * +ip_select_route_pkt(mblk_t *mp, ip_xmit_attr_t *ixa, uint_t *generationp, + int *errorp, boolean_t *multirtp) +{ + if (ixa->ixa_flags & IXAF_IS_IPV4) { + ipha_t *ipha = (ipha_t *)mp->b_rptr; + in6_addr_t v6dst; + + IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst); + + return (ip_select_route(&v6dst, ixa, generationp, + NULL, errorp, multirtp)); + } else { + ip6_t *ip6h = (ip6_t *)mp->b_rptr; + + return (ip_select_route(&ip6h->ip6_dst, ixa, generationp, + NULL, errorp, multirtp)); + } +} + +ire_t * +ip_select_route_v4(ipaddr_t dst, ip_xmit_attr_t *ixa, uint_t *generationp, + ipaddr_t *v4setsrcp, int *errorp, boolean_t *multirtp) +{ + in6_addr_t v6dst; + ire_t *ire; + in6_addr_t setsrc; + + ASSERT(ixa->ixa_flags & IXAF_IS_IPV4); + + IN6_IPADDR_TO_V4MAPPED(dst, &v6dst); + + setsrc = ipv6_all_zeros; + ire = ip_select_route(&v6dst, ixa, generationp, &setsrc, errorp, + multirtp); + if (v4setsrcp != NULL) + IN6_V4MAPPED_TO_IPADDR(&setsrc, *v4setsrcp); + return (ire); +} + +/* + * Recursively look for a route to the destination. Can also match on + * the zoneid, ill, and label. Used for the data paths. See also + * ire_route_recursive. + * + * If ill is set this means we will match it by adding MATCH_IRE_ILL. + * + * Note that this function never returns NULL. It returns an IRE_NOROUTE + * instead. + * + * If we find any IRE_LOCAL|BROADCAST etc past the first iteration it + * is an error. + * Allow at most one RTF_INDIRECT. + */ +ire_t * +ire_route_recursive_impl_v4(ire_t *ire, + ipaddr_t nexthop, uint_t ire_type, const ill_t *ill_arg, + zoneid_t zoneid, const ts_label_t *tsl, uint_t match_args, + boolean_t allocate, uint32_t xmit_hint, ip_stack_t *ipst, ipaddr_t *setsrcp, + tsol_ire_gw_secattr_t **gwattrp, uint_t *generationp) +{ + int i, j; + ire_t *ires[MAX_IRE_RECURSION]; + uint_t generation; + uint_t generations[MAX_IRE_RECURSION]; + boolean_t need_refrele = B_FALSE; + boolean_t invalidate = B_FALSE; + int prefs[MAX_IRE_RECURSION]; + ill_t *ill = NULL; + + if (setsrcp != NULL) + ASSERT(*setsrcp == INADDR_ANY); + if (gwattrp != NULL) + ASSERT(*gwattrp == NULL); + + if (ill_arg != NULL) + match_args |= MATCH_IRE_ILL; + + /* + * We iterate up to three times to resolve a route, even though + * we have four slots in the array. The extra slot is for an + * IRE_IF_CLONE we might need to create. + */ + i = 0; + while (i < MAX_IRE_RECURSION - 1) { + /* ire_ftable_lookup handles round-robin/ECMP */ + if (ire == NULL) { + ire = ire_ftable_lookup_v4(nexthop, 0, 0, ire_type, + (ill_arg != NULL ? ill_arg : ill), zoneid, tsl, + match_args, xmit_hint, ipst, &generation); + } else { + /* Caller passed it; extra hold since we will rele */ + ire_refhold(ire); + if (generationp != NULL) + generation = *generationp; + else + generation = IRE_GENERATION_VERIFY; + } + if (ire == NULL) + ire = ire_reject(ipst, B_FALSE); + + /* Need to return the ire with RTF_REJECT|BLACKHOLE */ + if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) + goto error; + + ASSERT(!(ire->ire_type & IRE_MULTICAST)); /* Not in ftable */ + + prefs[i] = ire_pref(ire); + if (i != 0) { + /* + * Don't allow anything unusual past the first + * iteration. + */ + if ((ire->ire_type & + (IRE_LOCAL|IRE_LOOPBACK|IRE_BROADCAST)) || + prefs[i] <= prefs[i-1]) { + ire_refrele(ire); + ire = ire_reject(ipst, B_FALSE); + goto error; + } + } + /* We have a usable IRE */ + ires[i] = ire; + generations[i] = generation; + i++; + + /* The first RTF_SETSRC address is passed back if setsrcp */ + if ((ire->ire_flags & RTF_SETSRC) && + setsrcp != NULL && *setsrcp == INADDR_ANY) { + ASSERT(ire->ire_setsrc_addr != INADDR_ANY); + *setsrcp = ire->ire_setsrc_addr; + } + + /* The first ire_gw_secattr is passed back if gwattrp */ + if (ire->ire_gw_secattr != NULL && + gwattrp != NULL && *gwattrp == NULL) + *gwattrp = ire->ire_gw_secattr; + + /* + * Check if we have a short-cut pointer to an IRE for this + * destination, and that the cached dependency isn't stale. + * In that case we've rejoined an existing tree towards a + * parent, thus we don't need to continue the loop to + * discover the rest of the tree. + */ + mutex_enter(&ire->ire_lock); + if (ire->ire_dep_parent != NULL && + ire->ire_dep_parent->ire_generation == + ire->ire_dep_parent_generation) { + mutex_exit(&ire->ire_lock); + ire = NULL; + goto done; + } + mutex_exit(&ire->ire_lock); + + /* + * If this type should have an ire_nce_cache (even if it + * doesn't yet have one) then we are done. Includes + * IRE_INTERFACE with a full 32 bit mask. + */ + if (ire->ire_nce_capable) { + ire = NULL; + goto done; + } + ASSERT(!(ire->ire_type & IRE_IF_CLONE)); + /* + * For an IRE_INTERFACE we create an IRE_IF_CLONE for this + * particular destination + */ + if (ire->ire_type & IRE_INTERFACE) { + in6_addr_t v6nexthop; + ire_t *clone; + + ASSERT(ire->ire_masklen != IPV4_ABITS); + + /* + * In the case of ip_input and ILLF_FORWARDING not + * being set, and in the case of RTM_GET, + * there is no point in allocating + * an IRE_IF_CLONE. We return the IRE_INTERFACE. + * Note that !allocate can result in a ire_dep_parent + * which is IRE_IF_* without an IRE_IF_CLONE. + * We recover from that when we need to send packets + * by ensuring that the generations become + * IRE_GENERATION_VERIFY in this case. + */ + if (!allocate) { + invalidate = B_TRUE; + ire = NULL; + goto done; + } + + IN6_IPADDR_TO_V4MAPPED(nexthop, &v6nexthop); + + clone = ire_create_if_clone(ire, &v6nexthop, + &generation); + if (clone == NULL) { + /* + * Temporary failure - no memory. + * Don't want caller to cache IRE_NOROUTE. + */ + invalidate = B_TRUE; + ire = ire_blackhole(ipst, B_FALSE); + goto error; + } + /* + * Make clone next to last entry and the + * IRE_INTERFACE the last in the dependency + * chain since the clone depends on the + * IRE_INTERFACE. + */ + ASSERT(i >= 1); + ASSERT(i < MAX_IRE_RECURSION); + + ires[i] = ires[i-1]; + generations[i] = generations[i-1]; + ires[i-1] = clone; + generations[i-1] = generation; + i++; + + ire = NULL; + goto done; + } + + /* + * We only match on the type and optionally ILL when + * recursing. The type match is used by some callers + * to exclude certain types (such as IRE_IF_CLONE or + * IRE_LOCAL|IRE_LOOPBACK). + */ + match_args &= MATCH_IRE_TYPE; + nexthop = ire->ire_gateway_addr; + if (ill == NULL && ire->ire_ill != NULL) { + ill = ire->ire_ill; + need_refrele = B_TRUE; + ill_refhold(ill); + match_args |= MATCH_IRE_ILL; + } + ire = NULL; + } + ASSERT(ire == NULL); + ire = ire_reject(ipst, B_FALSE); + +error: + ASSERT(ire != NULL); + if (need_refrele) + ill_refrele(ill); + + /* + * In the case of MULTIRT we want to try a different IRE the next + * time. We let the next packet retry in that case. + */ + if (i > 0 && (ires[0]->ire_flags & RTF_MULTIRT)) + (void) ire_no_good(ires[0]); + +cleanup: + /* cleanup ires[i] */ + ire_dep_unbuild(ires, i); + for (j = 0; j < i; j++) + ire_refrele(ires[j]); + + ASSERT(ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)); + /* + * Use IRE_GENERATION_VERIFY to ensure that ip_output will redo the + * ip_select_route since the reject or lack of memory might be gone. + */ + if (generationp != NULL) + *generationp = IRE_GENERATION_VERIFY; + return (ire); + +done: + ASSERT(ire == NULL); + if (need_refrele) { + ill_refrele(ill); + ill = NULL; + } + + /* Build dependencies */ + if (!ire_dep_build(ires, generations, i)) { + /* Something in chain was condemned; tear it apart */ + ire = ire_reject(ipst, B_FALSE); + goto cleanup; + } + + /* + * Release all refholds except the one for ires[0] that we + * will return to the caller. + */ + for (j = 1; j < i; j++) + ire_refrele(ires[j]); + + if (invalidate) { + /* + * Since we needed to allocate but couldn't we need to make + * sure that the dependency chain is rebuilt the next time. + */ + ire_dep_invalidate_generations(ires[0]); + generation = IRE_GENERATION_VERIFY; + } else { + /* + * IREs can have been added or deleted while we did the + * recursive lookup and we can't catch those until we've built + * the dependencies. We verify the stored + * ire_dep_parent_generation to catch any such changes and + * return IRE_GENERATION_VERIFY (which will cause + * ip_select_route to be called again so we can redo the + * recursive lookup next time we send a packet. + */ + generation = ire_dep_validate_generations(ires[0]); + if (generations[0] != ires[0]->ire_generation) { + /* Something changed at the top */ + generation = IRE_GENERATION_VERIFY; + } + } + if (generationp != NULL) + *generationp = generation; + + return (ires[0]); +} + +ire_t * +ire_route_recursive_v4(ipaddr_t nexthop, uint_t ire_type, const ill_t *ill, + zoneid_t zoneid, const ts_label_t *tsl, uint_t match_args, + boolean_t allocate, uint32_t xmit_hint, ip_stack_t *ipst, ipaddr_t *setsrcp, + tsol_ire_gw_secattr_t **gwattrp, uint_t *generationp) +{ + return (ire_route_recursive_impl_v4(NULL, nexthop, ire_type, ill, + zoneid, tsl, match_args, allocate, xmit_hint, ipst, setsrcp, + gwattrp, generationp)); +} + +/* + * Recursively look for a route to the destination. + * We only handle a destination match here, yet we have the same arguments + * as the full match to allow function pointers to select between the two. + * + * Note that this function never returns NULL. It returns an IRE_NOROUTE + * instead. + * + * If we find any IRE_LOCAL|BROADCAST etc past the first iteration it + * is an error. + * Allow at most one RTF_INDIRECT. + */ +ire_t * +ire_route_recursive_dstonly_v4(ipaddr_t nexthop, boolean_t allocate, + uint32_t xmit_hint, ip_stack_t *ipst) +{ + ire_t *ire; + ire_t *ire1; + uint_t generation; + + /* ire_ftable_lookup handles round-robin/ECMP */ + ire = ire_ftable_lookup_simple_v4(nexthop, xmit_hint, ipst, + &generation); + ASSERT(ire != NULL); + + /* + * If this type should have an ire_nce_cache (even if it + * doesn't yet have one) then we are done. Includes + * IRE_INTERFACE with a full 32 bit mask. + */ + if (ire->ire_nce_capable) + return (ire); + + /* + * If the IRE has a current cached parent we know that the whole + * parent chain is current, hence we don't need to discover and + * build any dependencies by doing a recursive lookup. + */ + mutex_enter(&ire->ire_lock); + if (ire->ire_dep_parent != NULL && + ire->ire_dep_parent->ire_generation == + ire->ire_dep_parent_generation) { + mutex_exit(&ire->ire_lock); + return (ire); + } + mutex_exit(&ire->ire_lock); + + /* + * Fallback to loop in the normal code starting with the ire + * we found. Normally this would return the same ire. + */ + ire1 = ire_route_recursive_impl_v4(ire, nexthop, 0, NULL, ALL_ZONES, + NULL, MATCH_IRE_DSTONLY, allocate, xmit_hint, ipst, NULL, NULL, + &generation); + ire_refrele(ire); + return (ire1); +} |