xref: /netbsd-src/sys/netinet6/ip6_flow.c (revision d909946ca08dceb44d7d0f22ec9488679695d976)
1 /*	$NetBSD: ip6_flow.c,v 1.30 2016/08/02 04:50:16 knakahara Exp $	*/
2 
3 /*-
4  * Copyright (c) 2007 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by the 3am Software Foundry ("3am").  It was developed by Liam J. Foy
9  * <liamjfoy@netbsd.org> and Matt Thomas <matt@netbsd.org>.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  *
32  * IPv6 version was developed by Liam J. Foy. Original source existed in IPv4
33  * format developed by Matt Thomas. Thanks to Joerg Sonnenberger, Matt
34  * Thomas and Christos Zoulas.
35  *
36  * Thanks to Liverpool John Moores University, especially Dr. David Llewellyn-Jones
37  * for providing resources (to test) and Professor Madjid Merabti.
38  */
39 
40 #include <sys/cdefs.h>
41 __KERNEL_RCSID(0, "$NetBSD: ip6_flow.c,v 1.30 2016/08/02 04:50:16 knakahara Exp $");
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/malloc.h>
46 #include <sys/mbuf.h>
47 #include <sys/domain.h>
48 #include <sys/protosw.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/time.h>
52 #include <sys/kernel.h>
53 #include <sys/pool.h>
54 #include <sys/sysctl.h>
55 #include <sys/workqueue.h>
56 #include <sys/atomic.h>
57 
58 #include <net/if.h>
59 #include <net/if_dl.h>
60 #include <net/route.h>
61 #include <net/pfil.h>
62 
63 #include <netinet/in.h>
64 #include <netinet6/in6_var.h>
65 #include <netinet/in_systm.h>
66 #include <netinet/ip6.h>
67 #include <netinet6/ip6_var.h>
68 #include <netinet6/ip6_private.h>
69 
70 /*
71  * IPv6 Fast Forward caches/hashes flows from one source to destination.
72  *
73  * Upon a successful forward IPv6FF caches and hashes details such as the
74  * route, source and destination. Once another packet is received matching
75  * the source and destination the packet is forwarded straight onto if_output
76  * using the cached details.
77  *
78  * Example:
79  * ether/fddi_input -> ip6flow_fastforward -> if_output
80  */
81 
82 static struct pool ip6flow_pool;
83 
84 LIST_HEAD(ip6flowhead, ip6flow);
85 
86 /*
87  * We could use IPv4 defines (IPFLOW_HASHBITS) but we'll
88  * use our own (possibly for future expansion).
89  */
90 #define	IP6FLOW_TIMER		(5 * PR_SLOWHZ)
91 #define	IP6FLOW_DEFAULT_HASHSIZE	(1 << IP6FLOW_HASHBITS)
92 
93 /*
94  * ip6_flow.c internal lock.
95  * If we use softnet_lock, it would cause recursive lock.
96  *
97  * This is a tentative workaround.
98  * We should make it scalable somehow in the future.
99  */
100 static kmutex_t ip6flow_lock;
101 static struct ip6flowhead *ip6flowtable = NULL;
102 static struct ip6flowhead ip6flowlist;
103 static int ip6flow_inuse;
104 
105 static void ip6flow_slowtimo_work(struct work *, void *);
106 static struct workqueue	*ip6flow_slowtimo_wq;
107 static struct work	ip6flow_slowtimo_wk;
108 
109 static int sysctl_net_inet6_ip6_hashsize(SYSCTLFN_PROTO);
110 static int sysctl_net_inet6_ip6_maxflows(SYSCTLFN_PROTO);
111 static void ip6flow_sysctl_init(struct sysctllog **);
112 
113 /*
114  * Insert an ip6flow into the list.
115  */
116 #define	IP6FLOW_INSERT(bucket, ip6f) \
117 do { \
118 	LIST_INSERT_HEAD((bucket), (ip6f), ip6f_hash); \
119 	LIST_INSERT_HEAD(&ip6flowlist, (ip6f), ip6f_list); \
120 } while (/*CONSTCOND*/ 0)
121 
122 /*
123  * Remove an ip6flow from the list.
124  */
125 #define	IP6FLOW_REMOVE(ip6f) \
126 do { \
127 	LIST_REMOVE((ip6f), ip6f_hash); \
128 	LIST_REMOVE((ip6f), ip6f_list); \
129 } while (/*CONSTCOND*/ 0)
130 
131 #ifndef IP6FLOW_DEFAULT
132 #define	IP6FLOW_DEFAULT		256
133 #endif
134 
135 int ip6_maxflows = IP6FLOW_DEFAULT;
136 int ip6_hashsize = IP6FLOW_DEFAULT_HASHSIZE;
137 
138 /*
139  * Calculate hash table position.
140  */
141 static size_t
142 ip6flow_hash(const struct ip6_hdr *ip6)
143 {
144 	size_t hash;
145 	uint32_t dst_sum, src_sum;
146 	size_t idx;
147 
148 	src_sum = ip6->ip6_src.s6_addr32[0] + ip6->ip6_src.s6_addr32[1]
149 	    + ip6->ip6_src.s6_addr32[2] + ip6->ip6_src.s6_addr32[3];
150 	dst_sum = ip6->ip6_dst.s6_addr32[0] + ip6->ip6_dst.s6_addr32[1]
151 	    + ip6->ip6_dst.s6_addr32[2] + ip6->ip6_dst.s6_addr32[3];
152 
153 	hash = ip6->ip6_flow;
154 
155 	for (idx = 0; idx < 32; idx += IP6FLOW_HASHBITS)
156 		hash += (dst_sum >> (32 - idx)) + (src_sum >> idx);
157 
158 	return hash & (ip6_hashsize-1);
159 }
160 
161 /*
162  * Check to see if a flow already exists - if so return it.
163  */
164 static struct ip6flow *
165 ip6flow_lookup(const struct ip6_hdr *ip6)
166 {
167 	size_t hash;
168 	struct ip6flow *ip6f;
169 
170 	KASSERT(mutex_owned(&ip6flow_lock));
171 
172 	hash = ip6flow_hash(ip6);
173 
174 	LIST_FOREACH(ip6f, &ip6flowtable[hash], ip6f_hash) {
175 		if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6f->ip6f_dst)
176 		    && IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6f->ip6f_src)
177 		    && ip6f->ip6f_flow == ip6->ip6_flow) {
178 		    	/* A cached flow has been found. */
179 			return ip6f;
180 		}
181 	}
182 
183 	return NULL;
184 }
185 
186 void
187 ip6flow_poolinit(void)
188 {
189 
190 	pool_init(&ip6flow_pool, sizeof(struct ip6flow), 0, 0, 0, "ip6flowpl",
191 			NULL, IPL_NET);
192 }
193 
194 /*
195  * Allocate memory and initialise lists. This function is called
196  * from ip6_init and called there after to resize the hash table.
197  * If a newly sized table cannot be malloc'ed we just continue
198  * to use the old one.
199  */
200 static int
201 ip6flow_init_locked(int table_size)
202 {
203 	struct ip6flowhead *new_table;
204 	size_t i;
205 
206 	KASSERT(mutex_owned(&ip6flow_lock));
207 
208 	new_table = (struct ip6flowhead *)malloc(sizeof(struct ip6flowhead) *
209 	    table_size, M_RTABLE, M_NOWAIT);
210 
211 	if (new_table == NULL)
212 		return 1;
213 
214 	if (ip6flowtable != NULL)
215 		free(ip6flowtable, M_RTABLE);
216 
217 	ip6flowtable = new_table;
218 	ip6_hashsize = table_size;
219 
220 	LIST_INIT(&ip6flowlist);
221 	for (i = 0; i < ip6_hashsize; i++)
222 		LIST_INIT(&ip6flowtable[i]);
223 
224 	return 0;
225 }
226 
227 int
228 ip6flow_init(int table_size)
229 {
230 	int ret, error;
231 
232 	error = workqueue_create(&ip6flow_slowtimo_wq, "ip6flow_slowtimo",
233 	    ip6flow_slowtimo_work, NULL, PRI_SOFTNET, IPL_SOFTNET, WQ_MPSAFE);
234 	if (error != 0)
235 		panic("%s: workqueue_create failed (%d)\n", __func__, error);
236 
237 	mutex_init(&ip6flow_lock, MUTEX_DEFAULT, IPL_NONE);
238 
239 	mutex_enter(&ip6flow_lock);
240 	ret = ip6flow_init_locked(table_size);
241 	mutex_exit(&ip6flow_lock);
242 	ip6flow_sysctl_init(NULL);
243 
244 	return ret;
245 }
246 
247 /*
248  * IPv6 Fast Forward routine. Attempt to forward the packet -
249  * if any problems are found return to the main IPv6 input
250  * routine to deal with.
251  */
252 int
253 ip6flow_fastforward(struct mbuf **mp)
254 {
255 	struct ip6flow *ip6f;
256 	struct ip6_hdr *ip6;
257 	struct rtentry *rt;
258 	struct mbuf *m;
259 	const struct sockaddr *dst;
260 	int error;
261 	int ret = 0;
262 
263 	mutex_enter(&ip6flow_lock);
264 
265 	/*
266 	 * Are we forwarding packets and have flows?
267 	 */
268 	if (!ip6_forwarding || ip6flow_inuse == 0)
269 		goto out;
270 
271 	m = *mp;
272 	/*
273 	 * At least size of IPv6 Header?
274 	 */
275 	if (m->m_len < sizeof(struct ip6_hdr))
276 		goto out;
277 	/*
278 	 * Was packet received as a link-level multicast or broadcast?
279 	 * If so, don't try to fast forward.
280 	 */
281 	if ((m->m_flags & (M_BCAST|M_MCAST)) != 0)
282 		goto out;
283 
284 	if (IP6_HDR_ALIGNED_P(mtod(m, const void *)) == 0) {
285 		if ((m = m_copyup(m, sizeof(struct ip6_hdr),
286 				(max_linkhdr + 3) & ~3)) == NULL) {
287 			goto out;
288 		}
289 		*mp = m;
290 	} else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
291 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
292 			goto out;
293 		}
294 		*mp = m;
295 	}
296 
297 	ip6 = mtod(m, struct ip6_hdr *);
298 
299 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
300 		/* Bad version. */
301 		goto out;
302 	}
303 
304 	/*
305 	 * If we have a hop-by-hop extension we must process it.
306 	 * We just leave this up to ip6_input to deal with.
307 	 */
308 	if (ip6->ip6_nxt == IPPROTO_HOPOPTS)
309 		goto out;
310 
311 	/*
312 	 * Attempt to find a flow.
313 	 */
314 	if ((ip6f = ip6flow_lookup(ip6)) == NULL) {
315 		/* No flow found. */
316 		goto out;
317 	}
318 
319 	/*
320 	 * Route and interface still up?
321 	 */
322 	if ((rt = rtcache_validate(&ip6f->ip6f_ro)) == NULL ||
323 	    (rt->rt_ifp->if_flags & IFF_UP) == 0 ||
324 	    (rt->rt_flags & RTF_BLACKHOLE) != 0)
325 		goto out;
326 
327 	/*
328 	 * Packet size greater than MTU?
329 	 */
330 	if (m->m_pkthdr.len > rt->rt_ifp->if_mtu) {
331 		/* Return to main IPv6 input function. */
332 		goto out;
333 	}
334 
335 	/*
336 	 * Clear any in-bound checksum flags for this packet.
337 	 */
338 	m->m_pkthdr.csum_flags = 0;
339 
340 	if (ip6->ip6_hlim <= IPV6_HLIMDEC)
341 		goto out;
342 
343 	/* Decrement hop limit (same as TTL) */
344 	ip6->ip6_hlim -= IPV6_HLIMDEC;
345 
346 	if (rt->rt_flags & RTF_GATEWAY)
347 		dst = rt->rt_gateway;
348 	else
349 		dst = rtcache_getdst(&ip6f->ip6f_ro);
350 
351 	PRT_SLOW_ARM(ip6f->ip6f_timer, IP6FLOW_TIMER);
352 
353 	ip6f->ip6f_uses++;
354 
355 	/* Send on its way - straight to the interface output routine. */
356 	if ((error = if_output_lock(rt->rt_ifp, rt->rt_ifp, m, dst, rt)) != 0) {
357 		ip6f->ip6f_dropped++;
358 	} else {
359 		ip6f->ip6f_forwarded++;
360 	}
361 	ret = 1;
362  out:
363 	mutex_exit(&ip6flow_lock);
364 	return ret;
365 }
366 
367 /*
368  * Add the IPv6 flow statistics to the main IPv6 statistics.
369  */
370 static void
371 ip6flow_addstats(const struct ip6flow *ip6f)
372 {
373 	struct rtentry *rt;
374 	uint64_t *ip6s;
375 
376 	if ((rt = rtcache_validate(&ip6f->ip6f_ro)) != NULL)
377 		rt->rt_use += ip6f->ip6f_uses;
378 	ip6s = IP6_STAT_GETREF();
379 	ip6s[IP6_STAT_FASTFORWARDFLOWS] = ip6flow_inuse;
380 	ip6s[IP6_STAT_CANTFORWARD] += ip6f->ip6f_dropped;
381 	ip6s[IP6_STAT_ODROPPED] += ip6f->ip6f_dropped;
382 	ip6s[IP6_STAT_TOTAL] += ip6f->ip6f_uses;
383 	ip6s[IP6_STAT_FORWARD] += ip6f->ip6f_forwarded;
384 	ip6s[IP6_STAT_FASTFORWARD] += ip6f->ip6f_forwarded;
385 	IP6_STAT_PUTREF();
386 }
387 
388 /*
389  * Add statistics and free the flow.
390  */
391 static void
392 ip6flow_free(struct ip6flow *ip6f)
393 {
394 
395 	KASSERT(mutex_owned(&ip6flow_lock));
396 
397 	/*
398 	 * Remove the flow from the hash table (at elevated IPL).
399 	 * Once it's off the list, we can deal with it at normal
400 	 * network IPL.
401 	 */
402 	IP6FLOW_REMOVE(ip6f);
403 
404 	ip6flow_inuse--;
405 	ip6flow_addstats(ip6f);
406 	rtcache_free(&ip6f->ip6f_ro);
407 	pool_put(&ip6flow_pool, ip6f);
408 }
409 
410 static struct ip6flow *
411 ip6flow_reap_locked(int just_one)
412 {
413 
414 	KASSERT(mutex_owned(&ip6flow_lock));
415 
416 	while (just_one || ip6flow_inuse > ip6_maxflows) {
417 		struct ip6flow *ip6f, *maybe_ip6f = NULL;
418 
419 		ip6f = LIST_FIRST(&ip6flowlist);
420 		while (ip6f != NULL) {
421 			/*
422 			 * If this no longer points to a valid route -
423 			 * reclaim it.
424 			 */
425 			if (rtcache_validate(&ip6f->ip6f_ro) == NULL)
426 				goto done;
427 			/*
428 			 * choose the one that's been least recently
429 			 * used or has had the least uses in the
430 			 * last 1.5 intervals.
431 			 */
432 			if (maybe_ip6f == NULL ||
433 			    ip6f->ip6f_timer < maybe_ip6f->ip6f_timer ||
434 			    (ip6f->ip6f_timer == maybe_ip6f->ip6f_timer &&
435 			     ip6f->ip6f_last_uses + ip6f->ip6f_uses <
436 			         maybe_ip6f->ip6f_last_uses +
437 			         maybe_ip6f->ip6f_uses))
438 				maybe_ip6f = ip6f;
439 			ip6f = LIST_NEXT(ip6f, ip6f_list);
440 		}
441 		ip6f = maybe_ip6f;
442 	    done:
443 		/*
444 		 * Remove the entry from the flow table
445 		 */
446 		IP6FLOW_REMOVE(ip6f);
447 
448 		rtcache_free(&ip6f->ip6f_ro);
449 		if (just_one) {
450 			ip6flow_addstats(ip6f);
451 			return ip6f;
452 		}
453 		ip6flow_inuse--;
454 		ip6flow_addstats(ip6f);
455 		pool_put(&ip6flow_pool, ip6f);
456 	}
457 	return NULL;
458 }
459 
460 /*
461  * Reap one or more flows - ip6flow_reap may remove
462  * multiple flows if net.inet6.ip6.maxflows is reduced.
463  */
464 struct ip6flow *
465 ip6flow_reap(int just_one)
466 {
467 	struct ip6flow *ip6f;
468 
469 	mutex_enter(&ip6flow_lock);
470 	ip6f = ip6flow_reap_locked(just_one);
471 	mutex_exit(&ip6flow_lock);
472 	return ip6f;
473 }
474 
475 static unsigned int ip6flow_work_enqueued = 0;
476 
477 void
478 ip6flow_slowtimo_work(struct work *wk, void *arg)
479 {
480 	struct ip6flow *ip6f, *next_ip6f;
481 
482 	/* We can allow enqueuing another work at this point */
483 	atomic_swap_uint(&ip6flow_work_enqueued, 0);
484 
485 	mutex_enter(softnet_lock);
486 	mutex_enter(&ip6flow_lock);
487 	KERNEL_LOCK(1, NULL);
488 
489 	for (ip6f = LIST_FIRST(&ip6flowlist); ip6f != NULL; ip6f = next_ip6f) {
490 		next_ip6f = LIST_NEXT(ip6f, ip6f_list);
491 		if (PRT_SLOW_ISEXPIRED(ip6f->ip6f_timer) ||
492 		    rtcache_validate(&ip6f->ip6f_ro) == NULL) {
493 			ip6flow_free(ip6f);
494 		} else {
495 			ip6f->ip6f_last_uses = ip6f->ip6f_uses;
496 			ip6flow_addstats(ip6f);
497 			ip6f->ip6f_uses = 0;
498 			ip6f->ip6f_dropped = 0;
499 			ip6f->ip6f_forwarded = 0;
500 		}
501 	}
502 
503 	KERNEL_UNLOCK_ONE(NULL);
504 	mutex_exit(&ip6flow_lock);
505 	mutex_exit(softnet_lock);
506 }
507 
508 void
509 ip6flow_slowtimo(void)
510 {
511 
512 	/* Avoid enqueuing another work when one is already enqueued */
513 	if (atomic_swap_uint(&ip6flow_work_enqueued, 1) == 1)
514 		return;
515 
516 	workqueue_enqueue(ip6flow_slowtimo_wq, &ip6flow_slowtimo_wk, NULL);
517 }
518 
519 /*
520  * We have successfully forwarded a packet using the normal
521  * IPv6 stack. Now create/update a flow.
522  */
523 void
524 ip6flow_create(const struct route *ro, struct mbuf *m)
525 {
526 	const struct ip6_hdr *ip6;
527 	struct ip6flow *ip6f;
528 	size_t hash;
529 
530 	mutex_enter(&ip6flow_lock);
531 
532 	ip6 = mtod(m, const struct ip6_hdr *);
533 
534 	/*
535 	 * If IPv6 Fast Forward is disabled, don't create a flow.
536 	 * It can be disabled by setting net.inet6.ip6.maxflows to 0.
537 	 *
538 	 * Don't create a flow for ICMPv6 messages.
539 	 */
540 	if (ip6_maxflows == 0 || ip6->ip6_nxt == IPPROTO_IPV6_ICMP) {
541 		mutex_exit(&ip6flow_lock);
542 		return;
543 	}
544 
545 	KERNEL_LOCK(1, NULL);
546 
547 	/*
548 	 * See if an existing flow exists.  If so:
549 	 *	- Remove the flow
550 	 *	- Add flow statistics
551 	 *	- Free the route
552 	 *	- Reset statistics
553 	 *
554 	 * If a flow doesn't exist allocate a new one if
555 	 * ip6_maxflows hasn't reached its limit. If it has
556 	 * been reached, reap some flows.
557 	 */
558 	ip6f = ip6flow_lookup(ip6);
559 	if (ip6f == NULL) {
560 		if (ip6flow_inuse >= ip6_maxflows) {
561 			ip6f = ip6flow_reap_locked(1);
562 		} else {
563 			ip6f = pool_get(&ip6flow_pool, PR_NOWAIT);
564 			if (ip6f == NULL)
565 				goto out;
566 			ip6flow_inuse++;
567 		}
568 		memset(ip6f, 0, sizeof(*ip6f));
569 	} else {
570 		IP6FLOW_REMOVE(ip6f);
571 
572 		ip6flow_addstats(ip6f);
573 		rtcache_free(&ip6f->ip6f_ro);
574 		ip6f->ip6f_uses = 0;
575 		ip6f->ip6f_last_uses = 0;
576 		ip6f->ip6f_dropped = 0;
577 		ip6f->ip6f_forwarded = 0;
578 	}
579 
580 	/*
581 	 * Fill in the updated/new details.
582 	 */
583 	rtcache_copy(&ip6f->ip6f_ro, ro);
584 	ip6f->ip6f_dst = ip6->ip6_dst;
585 	ip6f->ip6f_src = ip6->ip6_src;
586 	ip6f->ip6f_flow = ip6->ip6_flow;
587 	PRT_SLOW_ARM(ip6f->ip6f_timer, IP6FLOW_TIMER);
588 
589 	/*
590 	 * Insert into the approriate bucket of the flow table.
591 	 */
592 	hash = ip6flow_hash(ip6);
593 	IP6FLOW_INSERT(&ip6flowtable[hash], ip6f);
594 
595  out:
596 	KERNEL_UNLOCK_ONE(NULL);
597 	mutex_exit(&ip6flow_lock);
598 }
599 
600 /*
601  * Invalidate/remove all flows - if new_size is positive we
602  * resize the hash table.
603  */
604 int
605 ip6flow_invalidate_all(int new_size)
606 {
607 	struct ip6flow *ip6f, *next_ip6f;
608 	int error;
609 
610 	error = 0;
611 
612 	mutex_enter(&ip6flow_lock);
613 
614 	for (ip6f = LIST_FIRST(&ip6flowlist); ip6f != NULL; ip6f = next_ip6f) {
615 		next_ip6f = LIST_NEXT(ip6f, ip6f_list);
616 		ip6flow_free(ip6f);
617 	}
618 
619 	if (new_size)
620 		error = ip6flow_init_locked(new_size);
621 
622 	mutex_exit(&ip6flow_lock);
623 
624 	return error;
625 }
626 
627 /*
628  * sysctl helper routine for net.inet.ip6.maxflows. Since
629  * we could reduce this value, call ip6flow_reap();
630  */
631 static int
632 sysctl_net_inet6_ip6_maxflows(SYSCTLFN_ARGS)
633 {
634 	int error;
635 
636 	error = sysctl_lookup(SYSCTLFN_CALL(rnode));
637 	if (error || newp == NULL)
638 		return (error);
639 
640 	mutex_enter(softnet_lock);
641 	KERNEL_LOCK(1, NULL);
642 
643 	ip6flow_reap(0);
644 
645 	KERNEL_UNLOCK_ONE(NULL);
646 	mutex_exit(softnet_lock);
647 
648 	return (0);
649 }
650 
651 static int
652 sysctl_net_inet6_ip6_hashsize(SYSCTLFN_ARGS)
653 {
654 	int error, tmp;
655 	struct sysctlnode node;
656 
657 	node = *rnode;
658 	tmp = ip6_hashsize;
659 	node.sysctl_data = &tmp;
660 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
661 	if (error || newp == NULL)
662 		return (error);
663 
664 	if ((tmp & (tmp - 1)) == 0 && tmp != 0) {
665 		/*
666 		 * Can only fail due to malloc()
667 		 */
668 		mutex_enter(softnet_lock);
669 		KERNEL_LOCK(1, NULL);
670 
671 		error = ip6flow_invalidate_all(tmp);
672 
673 		KERNEL_UNLOCK_ONE(NULL);
674 		mutex_exit(softnet_lock);
675 	} else {
676 		/*
677 		 * EINVAL if not a power of 2
678 		 */
679 		error = EINVAL;
680 	}
681 
682 	return error;
683 }
684 
685 static void
686 ip6flow_sysctl_init(struct sysctllog **clog)
687 {
688 
689 	sysctl_createv(clog, 0, NULL, NULL,
690 		       CTLFLAG_PERMANENT,
691 		       CTLTYPE_NODE, "inet6",
692 		       SYSCTL_DESCR("PF_INET6 related settings"),
693 		       NULL, 0, NULL, 0,
694 		       CTL_NET, PF_INET6, CTL_EOL);
695 	sysctl_createv(clog, 0, NULL, NULL,
696 		       CTLFLAG_PERMANENT,
697 		       CTLTYPE_NODE, "ip6",
698 		       SYSCTL_DESCR("IPv6 related settings"),
699 		       NULL, 0, NULL, 0,
700 		       CTL_NET, PF_INET6, IPPROTO_IPV6, CTL_EOL);
701 
702 	sysctl_createv(clog, 0, NULL, NULL,
703 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
704 			CTLTYPE_INT, "maxflows",
705 			SYSCTL_DESCR("Number of flows for fast forwarding (IPv6)"),
706 			sysctl_net_inet6_ip6_maxflows, 0, &ip6_maxflows, 0,
707 			CTL_NET, PF_INET6, IPPROTO_IPV6,
708 			CTL_CREATE, CTL_EOL);
709 	sysctl_createv(clog, 0, NULL, NULL,
710 			CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
711 			CTLTYPE_INT, "hashsize",
712 			SYSCTL_DESCR("Size of hash table for fast forwarding (IPv6)"),
713 			sysctl_net_inet6_ip6_hashsize, 0, &ip6_hashsize, 0,
714 			CTL_NET, PF_INET6, IPPROTO_IPV6,
715 			CTL_CREATE, CTL_EOL);
716 }
717