ip6_output.c revision d3d50737e566cade9a08d73d2af95105ac7cd960
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
/* Copyright (c) 1990 Mentat Inc. */
#include <inet/kstatcom.h>
#include <netinet/igmp_var.h>
#include <inet/ip_multi.h>
#include <inet/ip_ftable.h>
#include <inet/ip_listutils.h>
#include <netinet/ip_mroute.h>
#include <inet/ipp_common.h>
#include <inet/ipsec_impl.h>
#include <inet/ip_netinfo.h>
#include <inet/ipclassifier.h>
#include <inet/udp_impl.h>
#ifdef DEBUG
extern boolean_t skip_sctp_cksum;
#endif
int
{
int error;
&nexthdrp)) {
/* Malformed packet */
return (EINVAL);
}
/*
* Assumes that source routed packets have already been massaged by
* the ULP (ip_massage_options_v6) and as a result ip6_dst is the next
* hop in the source route. The final destination is used for IPsec
* policy and DCE lookup.
*/
error = 0;
&multirt);
if (error != 0) {
goto done;
}
/* ire_ill might be NULL hence need to skip some code */
if (ixaflags & IXAF_SET_SOURCE)
ire->ire_ob_pkt_count++;
/* No dce yet; use default one */
goto done;
}
/* Note that ip6_dst is only used for IRE_MULTICAST */
/* Allocation failure? */
goto done;
}
if (nce->nce_is_condemned) {
if (!repeat) {
/* Try finding a better IRE */
goto repeat_ire;
}
/* Tried twice - drop packet */
goto done;
}
}
/*
* For multicast with multirt we have a flag passed back from
* ire_lookup_multi_ill_v6 since we don't have an IRE for each
* possible multicast address.
* We also need a flag for multicast since we can't check
* whether RTF_MULTIRT is set in ixa_ire for multicast.
*/
if (multirt) {
} else {
}
/*
* Check for a dce_t with a path mtu.
*/
ifindex = 0;
if (IN6_IS_ADDR_LINKSCOPE(&dst))
if (!(ixaflags & IXAF_PMTU_DISCOVERY)) {
/*
* To avoid a periodic timer to increase the path MTU we
* look at dce_last_change_time each time we send a packet.
*/
now = ddi_get_lbolt64();
/*
* Older than 20 minutes. Drop the path MTU information.
*/
} else {
}
} else {
}
/*
* We use use ire_nexthop_ill (and not ncec_ill) to avoid the under ipmp
* interface for source address selection.
*/
if (ixaflags & IXAF_SET_SOURCE) {
/*
* We use the final destination to get
* correct selection for source routed packets
*/
/* If unreachable we have no ill but need some source */
src = ipv6_loopback;
error = 0;
} else {
}
if (error != 0) {
ip_drop_output("ipIfStatsOutDiscards - no source",
goto done;
}
} else if (ixaflags & IXAF_VERIFY_SOURCE) {
/* Check if the IP source is assigned to the host. */
/* Don't send a packet with a source that isn't ours */
ip_drop_output("ipIfStatsOutDiscards - invalid source",
goto done;
}
}
/*
* IPsec will set IXAF_IPSEC_* and ixa_ipsec_* as appropriate.
*/
/* MIB and ip_drop_packet already done */
return (EHOSTUNREACH); /* IPsec policy failure */
}
}
} else {
}
/*
* We update the statistics on the most specific IRE i.e., the first
* one we found.
* We don't have an IRE when we fragment, hence ire_ob_pkt_count
* can only count the use prior to fragmentation. However the MIB
* counters on the ill will be incremented in post fragmentation.
*/
ire->ire_ob_pkt_count++;
/*
* Based on ire_type and ire_flags call one of:
* ire_send_local_v6 - for IRE_LOCAL and IRE_LOOPBACK
* ire_send_multirt_v6 - if RTF_MULTIRT
* ire_send_noroute_v6 - if RTF_REJECT or RTF_BLACHOLE
* ire_send_multicast_v6 - for IRE_MULTICAST
* ire_send_wire_v6 - for the rest.
*/
done:
return (error);
}
/*
* ire_sendfn() functions.
* These functions use the following xmit_attr:
* - ixa_fragsize - read to determine whether or not to fragment
* - IXAF_IPSEC_SECURE - to determine whether or not to invoke IPsec
* - ixa_ipsec_* are used inside IPsec
* - IXAF_LOOPBACK_COPY - for multicast
*/
/*
* ire_sendfn for IRE_LOCAL and IRE_LOOPBACK
*
* The checks for restrict_interzone_loopback are done in ire_route_recursive.
*/
/* ARGSUSED4 */
int
{
/*
* No fragmentation, no nce, and no application of IPsec.
*
*
* Note different order between IP provider and FW_HOOKS than in
* send_wire case.
*/
/*
* DTrace this as ip:::send. A packet blocked by FW_HOOKS will fire the
* send probe, but not the receive probe.
*/
int, 1);
if (HOOKS6_INTERESTED_LOOPBACK_OUT(ipst)) {
int error;
return (error);
/*
* Even if the destination was changed by the filter we use the
* forwarding decision that was made based on the address
* in ip_output/ip_set_destination.
*/
/* Length could be different */
}
/*
* If a callback is enabled then we need to know the
* source and destination zoneids for the packet. We already
* have those handy.
*/
if (stackzoneid == GLOBAL_ZONEID) {
/* Shared-IP zone */
} else {
}
}
/* Handle lo0 stats */
/*
* Update output mib stats. Note that we can't move into the icmp
* sender (icmp_output etc) since they don't know the ill and the
* stats are per ill.
*/
}
if (HOOKS6_INTERESTED_LOOPBACK_IN(ipst)) {
int error;
return (error);
/*
* Even if the destination was changed by the filter we use the
* forwarding decision that was made based on the address
* in ip_output/ip_set_destination.
*/
/* Length could be different */
}
int, 1);
/* Map ixa to ira including IPsec policies */
ire->ire_ib_pkt_count++;
/* Destined to ire_zoneid - use that for fanout */
if (is_system_labeled()) {
/*
* This updates ira_cred, ira_tsl and ira_free_flags based
* on the label. We don't expect this to ever fail for
* loopback packets, so we silently drop the packet should it
* fail.
*/
return (0);
}
/* tsol_get_pkt_label sometimes does pullupmsg */
}
/* We moved any IPsec refs from ixa to iras */
return (0);
}
static void
{
/* Limit the TTL on multirt packets. Do this even if IPV6_HOPLIMIT */
ip2dbg(("ire_send_multirt_v6: forcing multicast "
}
} else if ((ipst->ips_ip_multirt_ttl > 0) &&
/*
* Need to ensure we don't increase the ttl should we go through
* ire_send_multicast.
*/
}
/* For IPv6 this also needs to insert a fragment header */
}
/*
* ire_sendfn for IRE_MULTICAST
*
* Note that we do path MTU discovery by default for IPv6 multicast. But
* since unconnected UDP and RAW sockets don't set IXAF_PMTU_DISCOVERY
* only connected sockets get this by default.
*/
int
{
/*
* The IRE_MULTICAST is the same whether or not multirt is in use.
* Hence we need special-case code.
*/
if (ixaflags & IXAF_MULTIRT_MULTICAST)
/*
* Check if anything in ip_input_v6 wants a copy of the transmitted
* packet (after IPsec and fragmentation)
*
* 1. Multicast routers always need a copy unless SO_DONTROUTE is set
* RSVP and the rsvp daemon is an example of a
* protocol and user level process that
* handles it's own routing. Hence, it uses the
* SO_DONTROUTE option to accomplish this.
* 2. If the sender has set IP_MULTICAST_LOOP, then we just
* check whether there are any receivers for the group on the ill
* (ignoring the zoneid).
* 3. If IP_MULTICAST_LOOP is not set, then we check if there are
* any members in other shared-IP zones.
* If such members exist, then we indicate that the sending zone
* shouldn't get a loopback copy to preserve the IP_MULTICAST_LOOP
* behavior.
*
* When we loopback we skip hardware checksum to make sure loopback
* copy is checksumed.
*
* Note that ire_ill is the upper in the case of IPMP.
*/
!(ixaflags & IXAF_DONTROUTE)) {
} else if (ixaflags & IXAF_MULTICAST_LOOP) {
/*
* If this zone or any other zone has members then loopback
* a copy.
*/
/*
* This zone should not have a copy. But there are some other
* zones which might have members.
*/
ixa->ixa_zoneid)) {
}
}
/*
* Unless IPV6_HOPLIMIT or ire_send_multirt_v6 already set a ttl,
* force the ttl to the IP_MULTICAST_TTL value
*/
if (!(ixaflags & IXAF_NO_TTL_CHANGE)) {
}
}
/*
* ire_sendfn for IREs with RTF_MULTIRT
*/
int
{
else
}
/*
* ire_sendfn for IREs with RTF_REJECT/RTF_BLACKHOLE, including IRE_NOROUTE
*/
/* ARGSUSED4 */
int
{
/* A lack of a route as opposed to RTF_REJECT|BLACKHOLE */
}
/* No error even for local senders - silent blackhole */
return (0);
}
/*
* We need an ill_t for the ip_recv_attr_t even though this packet
* was never received and icmp_unreachable doesn't currently use
* ira_ill.
*/
return (EHOSTUNREACH);
}
/* Map ixa to ira including IPsec policies */
/* We moved any IPsec refs from ixa to iras */
return (EHOSTUNREACH);
}
/*
* Calculate a checksum ignoring any hardware capabilities
*
* Returns B_FALSE if the packet was too short for the checksum. Caller
* should free and do stats.
*/
static boolean_t
{
/* Just in case it contained garbage */
/*
* Calculate ULP checksum
*/
if (protocol == IPPROTO_TCP) {
} else if (protocol == IPPROTO_UDP) {
} else if (protocol == IPPROTO_SCTP) {
/*
* Zero out the checksum field to ensure proper
* checksum calculation.
*/
#ifdef DEBUG
if (!skip_sctp_cksum)
#endif
return (B_TRUE);
/*
* icmp has placed length and routing
* header adjustment in the checksum field.
*/
} else if (protocol == IPPROTO_ICMPV6) {
} else {
return (B_TRUE);
}
/* ULP puts the checksum field is in the first mblk */
/*
* We accumulate the pseudo header checksum in cksum.
* This is pretty hairy code, so watch close. One
* thing to keep in mind is that UDP and TCP have
* stored their respective datagram lengths in their
* checksum fields. This lines things up real nice.
*/
/*
* Change to 0xffff
*/
else
/* No IP header checksum for IPv6 */
return (B_TRUE);
}
/* There are drivers that can't do partial checksum for ICMPv6 */
int nxge_cksum_workaround = 1;
/*
* Calculate the ULP checksum - try to use hardware.
* In the case of MULTIRT or multicast the
* IXAF_NO_HW_CKSUM is set in which case we use software.
*
* Returns B_FALSE if the packet was too short for the checksum. Caller
* should free and do stats.
*/
static boolean_t
{
!dohwcksum) {
}
/*
* Calculate ULP checksum. Note that we don't use cksump and cksum
* if the ill has FULL support.
*/
if (protocol == IPPROTO_TCP) {
} else if (protocol == IPPROTO_UDP) {
} else if (protocol == IPPROTO_SCTP) {
/*
* Zero out the checksum field to ensure proper
* checksum calculation.
*/
#ifdef DEBUG
if (!skip_sctp_cksum)
#endif
goto ip_hdr_cksum;
/*
* icmp has placed length and routing
* header adjustment in the checksum field.
*/
} else if (protocol == IPPROTO_ICMPV6) {
} else {
/* No IP header checksum for IPv6 */
return (B_TRUE);
}
/* ULP puts the checksum field is in the first mblk */
/*
* Underlying interface supports hardware checksum offload for
* the payload; leave the payload checksum for the hardware to
* calculate. N.B: We only need to set up checksum info on the
* first mblk.
*/
if (hck_flags & HCKSUM_INET_FULL_V6) {
/*
* Hardware calculates pseudo-header, header and the
* payload checksums, so clear the checksum field in
* the protocol header.
*/
*cksump = 0;
return (B_TRUE);
}
if (((hck_flags) & HCKSUM_INET_PARTIAL) &&
/*
* Partial checksum offload has been enabled. Fill
* the checksum field in the protocol header with the
* pseudo-header checksum value.
*
* We accumulate the pseudo header checksum in cksum.
* This is pretty hairy code, so watch close. One
* thing to keep in mind is that UDP and TCP have
* stored their respective datagram lengths in their
* checksum fields. This lines things up real nice.
*/
/*
* Offsets are relative to beginning of IP header.
*/
return (B_TRUE);
}
/* Hardware capabilities include neither full nor partial IPv6 */
}
/*
* ire_sendfn for offlink and onlink destinations.
* Also called from the multicast, and multirt send functions.
*
* Assumes that the caller has a hold on the ire.
*
* This function doesn't care if the IRE just became condemned since that
* can happen at any time.
*/
/* ARGSUSED */
int
{
/*
* Update output mib stats. Note that we can't move into the icmp
* sender (icmp_output etc) since they don't know the ill and the
* stats are per ill.
*
* With IPMP we record the stats on the upper ill.
*/
icmp6);
}
if (ixaflags & IXAF_DONTROUTE)
/*
* This might set b_band, thus the IPsec and fragmentation
* code in IP ensures that b_band is updated in the first mblk.
*/
/* ip_process translates an IS_UNDER_IPMP */
/* ip_drop_packet and MIB done */
return (0); /* Might just be delayed */
}
}
/*
* while we still have ixa_tsl
*/
ip_drop_output("ipIfStatsOutDiscards - newcr",
return (ENOBUFS);
}
}
/*
* IXAF_IPV6_ADD_FRAGHDR is set for CGTP so that we will add a
* fragment header without fragmenting. CGTP on the receiver will
* filter duplicates on the ident field.
*/
uint32_t ident;
if (ixaflags & IXAF_IPSEC_SECURE)
if (pktlen > IP_MAXPACKET)
return (EMSGSIZE);
if (ixaflags & IXAF_SET_ULP_CKSUM) {
/*
* Compute ULP checksum using software
*/
return (EINVAL);
}
/* Avoid checksum again below if we only add fraghdr */
}
/*
* If we need a fragment header, pick the ident and insert
* the header before IPsec to we have a place to store
* the ident value.
*/
if ((ixaflags & IXAF_IPV6_ADD_FRAGHDR) ||
/*
* If this packet would generate a icmp_frag_needed
* message, we need to handle it before we do the IPsec
* processing. Otherwise, we need to strip the IPsec
* headers before we send up the message to the ULPs
* which becomes messy and difficult.
*/
(ixaflags & IXAF_DONTFRAG)) {
/* Generate ICMP and return error */
/* Map ixa to ira including IPsec policies */
&iras);
/* We moved any IPsec refs from ixa to iras */
return (EMSGSIZE);
}
/*
* Assign an ident value for this packet. There could
* be other threads targeting the same destination, so
* we have to arrange for a atomic increment.
* Normally ixa_extra_ident is 0, but in the case of
* LSO it will be the number of TCP segments that the
*
* Note that cl_inet_ipident has only been used for
* IPv4. We don't use it here.
*/
1);
#ifndef _BIG_ENDIAN
ident = htonl(ident);
#endif
}
if (ixaflags & IXAF_IPSEC_SECURE) {
/*
* Pass in sufficient information so that
* IPsec can determine whether to fragment, and
* which function to call after fragmentation.
*/
}
/* MIB and ip_drop_output already done */
return (ENOMEM);
}
pktlen += sizeof (ip6_frag_t);
&ixa->ixa_cookie));
}
}
if (ixaflags & IXAF_SET_ULP_CKSUM) {
/* Compute ULP checksum and IP header checksum */
/* An IS_UNDER_IPMP ill is ok here */
return (EINVAL);
}
}
}
/*
* Post fragmentation function for RTF_MULTIRT routes.
* Since IRE_MULTICASTs might have RTF_MULTIRT, this function
* checks IXAF_LOOPBACK_COPY.
*
* If no packet is sent due to failures then we return an errno, but if at
* least one succeeded we return zero.
*/
int
{
int error = 0;
int num_sent = 0;
int err;
/* Check for IXAF_LOOPBACK_COPY */
if (ixaflags & IXAF_LOOPBACK_COPY) {
/* Failed to deliver the loopback copy. */
} else {
nolzid);
}
}
/*
* Loop over RTF_MULTIRT for ip6_dst in the same bucket. Send
* a copy to each one.
* Use the nce (nexthop) and ip6_dst to find the ire.
*
* MULTIRT is not designed to work with shared-IP zones thus we don't
* need to pass a zoneid or a label to the IRE lookup.
*/
/* Broadcast and multicast case */
} else {
/* Unicast case */
}
/* Drop */
ip_drop_output("ip_postfrag_multirt didn't find route",
return (ENETUNREACH);
}
if (IRE_IS_CONDEMNED(ire1) ||
continue;
/* Note: When IPv6 uses radix tree we don't need this check */
continue;
/* Do the ire argument one after the loop */
continue;
/*
* This ire might not have been picked by
* ire_route_recursive, in which case ire_dep might
* not have been setup yet.
* We kick ire_route_recursive to try to resolve
* starting at ire1.
*/
}
ip_drop_output("ipIfStatsOutDiscards - no ill",
error = ENETUNREACH;
continue;
}
/* Pick the addr and type to use for ndp_nce_init */
} else {
}
/* If IPMP meta or under, then we just drop */
ip_drop_output("ipIfStatsOutDiscards - IPMP",
error = ENETUNREACH;
continue;
}
ip_drop_output("ipIfStatsOutDiscards - no nce",
continue;
}
continue;
}
/* Preserve HW checksum for this copy */
ire1->ire_ob_pkt_count++;
0, ixacookie);
if (err == 0)
num_sent++;
else
}
/* Finally, the main one */
if (err == 0)
num_sent++;
else
if (num_sent > 0)
return (0);
else
return (error);
}